---
id: "bug-1956"
status: "cannot-reproduce"
status_updated: "2026-10-10"
status_note: "no NULL path from the wire; the explicit NULL branch in job_start_local_task is unreachable through decoding"
component: "worker"
severity: "crash"
timestamp: "2026-10-10T08:46:13Z"
last_seen: "2026-10-10T08:46:13Z"
occurrences: 1
files: ["src/worker/src/controller_connector.c"]
tags: ["worker", "crash", "launch-type"]
related: []
repro_attempts: "decoder analysis 2026-10-10: empty launchType decodes to \"\" (capn_val0 default + strdup), never NULL"
gitea_issue: 387
gitea_synced_status: "cannot-reproduce"
gitea_synced_hash: "46653c4397e0"
---

# bug-1956: xcecd compares a NULL launch_type with strcmp when a job has no launch type (possible crash)

## Description
**Observed:** (source reading, 2026-10-10; suspected, not reproduced)
`job_start_local_task()` stores NULL when the start info has no launch type
and then dereferences it:
```c
if (d->start_info->launch_type) {
    job_ctx->startinfo->launch_type = strdup(...);
} else {
    job_ctx->startinfo->launch_type = NULL;          /* :981-985 */
}
...
if (strcmp(job_ctx->startinfo->launch_type, "openmpi") == 0   /* :994 */
```
`job_start_remote_task()` does the same without a check (`:753`). The apiserver
sends no launch type when the user gives none (`cStringOrNil`,
`backend/convert.go:339`). Jobs without a launch type do run in existing
tests, so the decoder may deliver an empty string rather than NULL: not
confirmed either way.

**Expected:** a missing launch type means a plain (non-MPI) job; no NULL
dereference.
**Impact:** possible worker crash at job start for jobs without a launch
type.
**Found by:** review of the bug-1940/1942 fixes, 2026-10-10.

UPDATE (2026-10-10): Not confirmed: the generated decoder reads launchType with capn_get_text(..., capn_val0) whose default is {0,"",0} and then STRING_DUPs (strdup) it (src/xce.build/lib/controller.capnp.c:6398), so a job start without a launch type reaches the worker as "" (non-NULL); strcmp at controller_connector.c:753/994 is safe. job_start_local_task's explicit NULL assignment (:985) is only reachable if start_info->launch_type is NULL, which decoding never produces.

## Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (xce.build)
- Code: scheduler-framework @ 8568c8ab-dirty
- Deployment: real `xcecd` worker (systemd/dbus); multi-host for the remote-task case

## Reproduction
1. Decode a job start message whose start info has no launch type and run
   `job_start_local_task()` (worker unit test), or submit a job without a
   launch type through libxce/harness to a real `xcecd`.
2. Check whether `startinfo->launch_type` is NULL at `:994`.
- Frequency: deterministic by code reading (not yet run)
- Evidence: the code quoted in Description; no logs kept.

## Root cause
TODO: required for fixed/partial

## Fix
TODO: required for fixed/partial

## Verification
- Test: TODO: name + file; RED before the fix, GREEN after
- Suites: TODO: suite results and build profile
- Live: TODO: soak/deploy run, or n/a and why

## References
- Related: none