---
id: "bug-1797"
status: "open"
status_updated: "2026-09-24"
status_note: "cmd_qctrl leaks strdup'd queue name on RPC error (src/harness/test.c)"
component: "controller"
severity: "leak"
timestamp: "2026-09-09T22:00:00Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 3
files: ["src/controller/testsuite/test.c (cmd_qctrl)"]
tags: ["controller", "testsuite", "xce_test", "cmd_qctrl", "leak", "asan", "xce-test-cli-ux", "task-4.2", "pre-existing", "deferred"]
related: ["bug-1796"]
legacy: true
---

# bug-1797: cmd_qctrl leaks its strdup()'d queue name on the xcecli_queuectrl() RPC-error return path (ASAN…

## Description
cmd_qctrl leaks its strdup()'d queue name on the xcecli_queuectrl() RPC-error return path (ASAN LeakSanitizer-confirmed, 14 bytes).

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
cmd_qctrl does `queue = strdup(optarg)` while parsing -q, then on `if (rc < 0) { perror("xcecli_queuectrl"); return rc; }` (the RPC-error branch) returns without `free(queue)` -- only the success path frees it. Distinct from the adjacent, intentional non-free on the EINTR/abandoned-worker path (ownership legitimately transferred there per the interruptible-call adapter's contract). Found during xce-test-cli-ux task 4.2's live confirmation-gate verification (a bypassed qctrl against a bogus queue name triggered this exact RPC-error branch under the asan build). Confirmed pre-existing (commit 41f56fa6e, 2025-11-05), predating the whole xce-test-cli-ux spec and untouched by task 3.1's flagspec migration; not caused by any change in this spec.

## Fix
NOT YET FIXED (found and deliberately deferred -- out of boundary for task 4.2, a pure live-verification task with no source changes permitted). Recommended: add `free(queue);` on the RPC-error return path (or restructure with a single cleanup label), and check `cmd_hostctrl`/`cmd_jobkill`'s sibling strdup'd-argument fields for the same pattern.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Related: bug-1796