space is allocated for a "temporary" string to append "/" after it is duplicated, the only reference to the new memory falls of the stack when the function exits this is in rpm-4.0-55/lib/depends.c
If you are referring to (from lib/depends.c): ... /* This canonicalizes the root */ rootLen = strlen(rootDir); if (!(rootLen && rootDir[rootLen - 1] == '/')) { char * t; t = alloca(rootLen + 2); *t = '\0'; (void) stpcpy( stpcpy(t, rootDir), "/"); rootDir = t; } this is alloca's, not malloc'd, memory that is released on return.