44 lines
2.4 KiB
Markdown
44 lines
2.4 KiB
Markdown
---
|
|
id: "bug-1797"
|
|
status: "fixed"
|
|
status_updated: "2026-09-28"
|
|
status_note: ""
|
|
component: "controller"
|
|
severity: "leak"
|
|
timestamp: "2026-09-09T22:00:00Z"
|
|
last_seen: "2026-09-19T09:00:00Z"
|
|
occurrences: 3
|
|
files: ["src/harness/test.c"]
|
|
tags: ["controller", "testsuite", "xce_test", "cmd_qctrl", "leak", "asan", "xce-test-cli-ux", "task-4.2", "pre-existing", "deferred"]
|
|
related: ["bug-1796"]
|
|
fix_commits: ["da1a663f"]
|
|
legacy: true
|
|
gitea_issue: 310
|
|
gitea_synced_status: "fixed"
|
|
gitea_synced_hash: "684c8cf60fbb"
|
|
---
|
|
|
|
# bug-1797: cmd_qctrl leaks its strdup()'d queue name on the xcecli_queuectrl() RPC-error return path (ASAN…
|
|
|
|
## Description
|
|
cmd_qctrl leaks its strdup()'d queue name on the xcecli_queuectrl() RPC-error return path (ASAN LeakSanitizer-confirmed, 14 bytes).
|
|
|
|
## Environment
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Reproduction
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Root cause
|
|
cmd_qctrl does `queue = strdup(optarg)` while parsing -q, then on `if (rc < 0) { perror("xcecli_queuectrl"); return rc; }` (the RPC-error branch) returns without `free(queue)` -- only the success path frees it. Distinct from the adjacent, intentional non-free on the EINTR/abandoned-worker path (ownership legitimately transferred there per the interruptible-call adapter's contract). Found during xce-test-cli-ux task 4.2's live confirmation-gate verification (a bypassed qctrl against a bogus queue name triggered this exact RPC-error branch under the asan build). Confirmed pre-existing (commit 41f56fa6e, 2025-11-05), predating the whole xce-test-cli-ux spec and untouched by task 3.1's flagspec migration; not caused by any change in this spec.
|
|
|
|
## Fix
|
|
cmd_qctrl frees the queue name on the RPC-error path and when the call allocation fails, and a repeated -q frees the earlier copy (hostctrl's -h likewise). The interrupted-call path still hands the name to the worker thread, as before.
|
|
|
|
## Verification
|
|
- Test: LeakSanitizer run of the fixed xce_test (`qctrl -q bogus -a` with no controller, ASAN_OPTIONS=detect_leaks=1): no leak with a cmd_qctrl frame; an automated test is not practical because the harness suites run with detect_leaks=0 and xce_test leaks elsewhere at exit
|
|
- Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
|
|
- Live: n/a; xce_test is a client tool and every case above runs without a controller
|
|
|
|
## References
|
|
- Related: bug-1796
|