From e69498353679c608a678cc43c95ef4bc559e48ec Mon Sep 17 00:00:00 2001
From: Brian Taylor <lbwnet@comcast.net>
Date: Sun, 21 Sep 2025 09:32:06 -0700
Subject: [PATCH] Fix memory leaks in INPpas4 and get_number_terminals found
 using paranoia_parallel.

---
 src/frontend/inpcom.c         | 18 +++++++++++++-----
 src/spicelib/parser/inppas4.c |  1 +
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/frontend/inpcom.c b/src/frontend/inpcom.c
index 9c354356e..ff693b115 100644
--- a/src/frontend/inpcom.c
+++ b/src/frontend/inpcom.c
@@ -5171,7 +5171,6 @@ int get_number_terminals(char *c)
 {
     int   i, j, k;
     char *inst;
-    char *name[12];
     bool  area_found = FALSE;
 
     if (!c)
@@ -5277,20 +5276,26 @@ int get_number_terminals(char *c)
              * <TEMP=T> */
             /* 12 tokens maximum */
         {
+            char *name[12];
             char* cc, * ccfree;
 
+            (void) memset(name, 0, sizeof(name));
             cc = copy(c);
             /* required to make m= 1 a single token m=1 */
             ccfree = cc = inp_remove_ws(cc);
             for (i = j = 0; (i < 12) && (*cc != '\0'); ++i) {
 
                 name[i] = gettok_instance(&cc);
+                if (!name[i] || name[i][0] == '\0') {
+                    continue;
+                }
                 if (search_plain_identifier(name[i], "off")) {
                     j++;
                 }
 #ifdef CIDER
-                if (search_plain_identifier(name[i], "save") ||
-                    search_plain_identifier(name[i], "print")) {
+                if (search_plain_identifier(name[i], "save")) {
+                    j++;
+                } else if (search_plain_identifier(name[i], "print")) {
                     j++;
                 }
 #endif
@@ -5320,8 +5325,11 @@ int get_number_terminals(char *c)
                 if (only_digits && (strchr(name[k - 1], ',') == NULL))
                     area_found = TRUE;
             }
-            for (k = i; k >= 0; k--)
-                tfree(name[k]);
+            for (k = 0; k < 12; k++) {
+                if (name[k]) {
+                    tfree(name[k]);
+                }
+            }
             if (area_found) {
                 return i - j - 2;
             }
diff --git a/src/spicelib/parser/inppas4.c b/src/spicelib/parser/inppas4.c
index f053435d8..dd6096577 100644
--- a/src/spicelib/parser/inppas4.c
+++ b/src/spicelib/parser/inppas4.c
@@ -58,6 +58,7 @@ void INPpas4(CKTcircuit *ckt, INPtables *tab)
             char* devname = tprintf("capac%dshunt", nn);
 
             (*(ft_sim->newInstance))(ckt, tab->defCmod, &fast, devname);
+            txfree(devname);
 
            /* the top node, second node is gnd automatically */
             (*(ft_sim->bindNode))(ckt, fast, 1, node);