---
id: "bug-1705"
status: "fixed"
status_updated: "2026-09-28"
status_note: ""
component: "controller"
severity: "leak"
timestamp: "2026-08-26T09:32:18Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/harness/test.c"]
tags: ["controller", "testsuite", "xce_test", "cmd_jobsub", "dead-flag", "silent-data-loss", "memory-leak", "cli-ux-audit"]
related: []
fix_commits: ["da1a663f"]
legacy: true
gitea_issue: 301
gitea_synced_status: "fixed"
gitea_synced_hash: "fe75b0b8060f"
---

# bug-1705: cmd_jobsub's `-x <exdata>` flag is documented (USAGE_JOBSUB) as overriding the built-in PATH-only…

## Description
cmd_jobsub's `-x <exdata>` flag is documented (USAGE_JOBSUB) as overriding the built-in PATH-only exdata JSON, but build_job_exdata()/build_job_envs() unconditionally overwrite submit.start_info->exdata with the built-in PATH JSON regardless of whether -x already set a value -- the exact opposite of the documented behavior. The original -x value is also leaked (never freed before being replaced).

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
build_job_exdata()/build_job_envs() have no guard for an already-non-NULL exdata field before overwriting it.

## Fix
The default exdata comes from cmdutil_default_exdata(), which only builds the PATH JSON when exdata is still NULL, so -x's value is kept and no longer leaked; a repeated -x frees the earlier copy. cmd_jobsub's cleanup also frees execuser/exechome/execcwd, which leaked on every call.

## Verification
- Test: test_default_exdata_keeps_caller_value and test_default_exdata_builds_path_json_when_unset in src/harness/testsuite/test_cmdutil.c; the old build_job_exdata() overwrote exdata unconditionally, which the first test forbids
- Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
- Live: n/a; xce_test is a client tool and every case above runs without a controller

## References
_Not recorded (migrated from buglog.json)._