From 76eca45cf85fb67d66eefe0463a95b74e1056274 Mon Sep 17 00:00:00 2001 From: Luis Manuel Diaz Angulo Date: Tue, 5 May 2026 15:13:19 +0200 Subject: [PATCH] Fix unbounded struct control chain growth in cp_evloop Every call to cp_evloop() via ngSpice_Command() appended a new struct control node to the control[stackp] linked chain but the executed nodes were never freed. Over thousands of command calls (e.g. repeated 'alter' commands in MTLN co-simulation) the chain grew without bound, leaking ~4 KB per step. After executing a top-level block (co_parent == NULL), free the entire chain via ctl_free(control[stackp]) and reset the pointers. The comment '/* va: TODO: free old structure ... */' in the same function acknowledged this gap. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/frontend/control.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/frontend/control.c b/src/frontend/control.c index 5c724ec12..aabf97664 100644 --- a/src/frontend/control.c +++ b/src/frontend/control.c @@ -889,6 +889,11 @@ cp_evloop(char *string) if (x) x = x->co_next; } while (x); + /* Free the executed top-level control structure chain. + * Without this, every command call accumulates struct control + * nodes (with their co_text wordlist copies) indefinitely. */ + ctl_free(control[stackp]); + control[stackp] = cend[stackp] = NULL; } wl_free(freewl); if (string)