myxce/.wolf/bugs/bug-1797.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits	legacy	gitea_issue	gitea_synced_status	gitea_synced_hash
bug-1797	fixed	2026-09-28		controller	leak	2026-09-09T22:00:00Z	2026-09-19T09:00:00Z	3	src/harness/test.c	controller testsuite xce_test cmd_qctrl leak asan xce-test-cli-ux task-4.2 pre-existing deferred	bug-1796	da1a663f	true	310	fixed	684c8cf60fbb

bug-1797: cmd_qctrl leaks its strdup()'d queue name on the xcecli_queuectrl() RPC-error return path (ASAN…

Description

cmd_qctrl leaks its strdup()'d queue name on the xcecli_queuectrl() RPC-error return path (ASAN LeakSanitizer-confirmed, 14 bytes).

Environment

Not recorded (migrated from buglog.json).

Reproduction

Not recorded (migrated from buglog.json).

Root cause

cmd_qctrl does queue = strdup(optarg) while parsing -q, then on if (rc < 0) { perror("xcecli_queuectrl"); return rc; } (the RPC-error branch) returns without free(queue) -- only the success path frees it. Distinct from the adjacent, intentional non-free on the EINTR/abandoned-worker path (ownership legitimately transferred there per the interruptible-call adapter's contract). Found during xce-test-cli-ux task 4.2's live confirmation-gate verification (a bypassed qctrl against a bogus queue name triggered this exact RPC-error branch under the asan build). Confirmed pre-existing (commit 41f56fa6e, 2025-11-05), predating the whole xce-test-cli-ux spec and untouched by task 3.1's flagspec migration; not caused by any change in this spec.

Fix

cmd_qctrl frees the queue name on the RPC-error path and when the call allocation fails, and a repeated -q frees the earlier copy (hostctrl's -h likewise). The interrupted-call path still hands the name to the worker thread, as before.

Verification

• Test: LeakSanitizer run of the fixed xce_test (qctrl -q bogus -a with no controller, ASAN_OPTIONS=detect_leaks=1): no leak with a cmd_qctrl frame; an automated test is not practical because the harness suites run with detect_leaks=0 and xce_test leaks elsewhere at exit
• Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
• Live: n/a; xce_test is a client tool and every case above runs without a controller

References

• Related: bug-1796