From e39139d1c033f41739aafd3f4f35645a548bdae1 Mon Sep 17 00:00:00 2001
From: Minglei Jin <mljin@taosdata.com>
Date: Fri, 9 Apr 2021 15:46:28 +0800
Subject: [PATCH] [TD-3706]<fix>: [mnode] validate super table columns and tags
 count

---
 src/inc/taoserror.h        |  1 +
 src/mnode/src/mnodeTable.c | 28 ++++++++++++++++++++--------
 src/util/src/terror.c      |  1 +
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/src/inc/taoserror.h b/src/inc/taoserror.h
index 8daccee1f2..eff4eecbc1 100644
--- a/src/inc/taoserror.h
+++ b/src/inc/taoserror.h
@@ -163,6 +163,7 @@ int32_t* taosGetErrno();
 #define TSDB_CODE_MND_INVALID_TABLE_NAME        TAOS_DEF_ERROR_CODE(0, 0x0362)  //"Table does not exist")
 #define TSDB_CODE_MND_INVALID_TABLE_TYPE        TAOS_DEF_ERROR_CODE(0, 0x0363)  //"Invalid table type in tsdb")
 #define TSDB_CODE_MND_TOO_MANY_TAGS             TAOS_DEF_ERROR_CODE(0, 0x0364)  //"Too many tags")
+#define TSDB_CODE_MND_TOO_MANY_COLUMNS          TAOS_DEF_ERROR_CODE(0, 0x0365)  //"Too many columns")
 #define TSDB_CODE_MND_TOO_MANY_TIMESERIES       TAOS_DEF_ERROR_CODE(0, 0x0366)  //"Too many time series")
 #define TSDB_CODE_MND_NOT_SUPER_TABLE           TAOS_DEF_ERROR_CODE(0, 0x0367)  //"Not super table")           // operation only available for super table
 #define TSDB_CODE_MND_COL_NAME_TOO_LONG         TAOS_DEF_ERROR_CODE(0, 0x0368)  //"Tag name too long")
diff --git a/src/mnode/src/mnodeTable.c b/src/mnode/src/mnodeTable.c
index 39eca8819d..2a8e941fcb 100644
--- a/src/mnode/src/mnodeTable.c
+++ b/src/mnode/src/mnodeTable.c
@@ -1037,6 +1037,19 @@ static int32_t mnodeProcessCreateSuperTableMsg(SMnodeMsg *pMsg) {
 
   SCreateTableMsg* pCreate = (SCreateTableMsg*)((char*)pCreate1 + sizeof(SCMCreateTableMsg));
 
+  int16_t numOfTags = htons(pCreate->numOfTags);
+  if (numOfTags > TSDB_MAX_TAGS) {
+    mError("msg:%p, app:%p table:%s, failed to create, too many tags", pMsg, pMsg->rpcMsg.ahandle, pCreate->tableName);
+    return TSDB_CODE_MND_TOO_MANY_TAGS;
+  }
+
+  int16_t numOfColumns = htons(pCreate->numOfColumns);
+  int32_t numOfCols = numOfColumns + numOfTags;
+  if (numOfCols > TSDB_MAX_COLUMNS) {
+    mError("msg:%p, app:%p table:%s, failed to create, too many columns", pMsg, pMsg->rpcMsg.ahandle, pCreate->tableName);
+    return TSDB_CODE_MND_TOO_MANY_COLUMNS;
+  }
+
   SSTableObj *   pStable = calloc(1, sizeof(SSTableObj));
   if (pStable == NULL) {
     mError("msg:%p, app:%p table:%s, failed to create, no enough memory", pMsg, pMsg->rpcMsg.ahandle, pCreate->tableName);
@@ -1050,10 +1063,9 @@ static int32_t mnodeProcessCreateSuperTableMsg(SMnodeMsg *pMsg) {
   pStable->uid          = (us << 24) + ((sdbGetVersion() & ((1ul << 16) - 1ul)) << 8) + (taosRand() & ((1ul << 8) - 1ul));
   pStable->sversion     = 0;
   pStable->tversion     = 0;
-  pStable->numOfColumns = htons(pCreate->numOfColumns);
-  pStable->numOfTags    = htons(pCreate->numOfTags);
+  pStable->numOfColumns = numOfColumns;
+  pStable->numOfTags    = numOfTags;
 
-  int32_t numOfCols = pStable->numOfColumns + pStable->numOfTags;
   int32_t schemaSize = numOfCols * sizeof(SSchema);
   pStable->schema = (SSchema *)calloc(1, schemaSize);
   if (pStable->schema == NULL) {
@@ -1064,11 +1076,6 @@ static int32_t mnodeProcessCreateSuperTableMsg(SMnodeMsg *pMsg) {
 
   memcpy(pStable->schema, pCreate->schema, numOfCols * sizeof(SSchema));
 
-  if (pStable->numOfColumns > TSDB_MAX_COLUMNS || pStable->numOfTags > TSDB_MAX_TAGS) {
-    mError("msg:%p, app:%p table:%s, failed to create, too many columns", pMsg, pMsg->rpcMsg.ahandle, pCreate->tableName);
-    return TSDB_CODE_MND_INVALID_TABLE_NAME;
-  }
-
   pStable->nextColId = 0;
 
   for (int32_t col = 0; col < numOfCols; col++) {
@@ -1340,6 +1347,11 @@ static int32_t mnodeAddSuperTableColumn(SMnodeMsg *pMsg, SSchema schema[], int32
     return TSDB_CODE_MND_APP_ERROR;
   }
 
+  if (pStable->numOfColumns + ncols + pStable->numOfTags > TSDB_MAX_COLUMNS) {
+    mError("msg:%p, app:%p stable:%s, add column, too many columns", pMsg, pMsg->rpcMsg.ahandle, pStable->info.tableId);
+    return TSDB_CODE_MND_TOO_MANY_COLUMNS;
+  }
+
   for (int32_t i = 0; i < ncols; i++) {
     if (mnodeFindSuperTableColumnIndex(pStable, schema[i].name) > 0) {
       mError("msg:%p, app:%p stable:%s, add column, column:%s already exist", pMsg, pMsg->rpcMsg.ahandle,
diff --git a/src/util/src/terror.c b/src/util/src/terror.c
index 918ccc4935..586a886f47 100644
--- a/src/util/src/terror.c
+++ b/src/util/src/terror.c
@@ -175,6 +175,7 @@ TAOS_DEFINE_ERROR(TSDB_CODE_MND_INVALID_TABLE_ID,         "Table name too long")
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_INVALID_TABLE_NAME,       "Table does not exist")
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_INVALID_TABLE_TYPE,       "Invalid table type in tsdb")
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_TOO_MANY_TAGS,            "Too many tags")
+TAOS_DEFINE_ERROR(TSDB_CODE_MND_TOO_MANY_COLUMNS,         "Too many columns")
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_TOO_MANY_TIMESERIES,      "Too many time series")
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_NOT_SUPER_TABLE,          "Not super table")           // operation only available for super table
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_COL_NAME_TOO_LONG,        "Tag name too long")
-- 
GitLab