peer_control: Fix a use-after-free bug.

Author: ZmnSCPxj

lightningd/peer_control.c

@@ -458,7 +458,9 @@ void peer_sent_nongossip(struct lightningd *ld,
 	}
 
 	/* Weird request. */
-	error = towire_errorfmt(ld, channel_id,
+	/* Allocate off in_msg, which should get freed by the
+	 * caller. */
+	error = towire_errorfmt(in_msg, channel_id,
 				"Unexpected message %i for peer",
 				fromwire_peektype(in_msg));
 
@@ -469,7 +471,8 @@ void peer_sent_nongossip(struct lightningd *ld,
 	subd_send_msg(ld->gossip, take(msg));
 	subd_send_fd(ld->gossip, peer_fd);
 	subd_send_fd(ld->gossip, gossip_fd);
-	tal_free(error);
+	/* Either error is allocated off in_msg, or error is owned by
+	 * the channel. Either way we have no need to free error here. */
 }
 
 static enum watch_result funding_announce_cb(struct channel *channel,