Merge pull request #7049 from taosdata/fix/TD-5534

[TD-5534]<fix>:fix the coverity high risk of client&query

src/client/src/TSDBJNIConnector.c

@@ -726,12 +726,12 @@ JNIEXPORT jlong JNICALL Java_com_taosdata_jdbc_TSDBJNIConnector_prepareStmtImp(J
 
   TAOS_STMT* pStmt = taos_stmt_init(tscon);
   int32_t code = taos_stmt_prepare(pStmt, str, len);
+  tfree(str);
   if (code != TSDB_CODE_SUCCESS) {
     jniError("jobj:%p, conn:%p, code:%s", jobj, tscon, tstrerror(code));
     return JNI_TDENGINE_ERROR;
   }
 
-  free(str);
   return (jlong) pStmt;
 }
 
@@ -937,13 +937,13 @@ JNIEXPORT jint JNICALL Java_com_taosdata_jdbc_TSDBJNIConnector_setTableNameTagsI
   tfree(lengthArray);
   tfree(typeArray);
   tfree(nullArray);
+  tfree(tagsBind);
   (*env)->ReleaseStringUTFChars(env, tableName, name);
 
   if (code != TSDB_CODE_SUCCESS) {
     jniError("jobj:%p, conn:%p, code:%s", jobj, tsconn, tstrerror(code));
     return JNI_TDENGINE_ERROR;
   }
-
   return JNI_SUCCESS;
 }
 
@@ -957,7 +957,10 @@ JNIEXPORT jlong JNICALL Java_com_taosdata_jdbc_TSDBJNIConnector_insertLinesImp(J
 
   int numLines = (*env)->GetArrayLength(env, lines);
   char** c_lines = calloc(numLines, sizeof(char*));
-
+  if (c_lines == NULL) {
+    jniError("c_lines:%p, alloc memory failed", c_lines);
+    return JNI_OUT_OF_MEMORY;
+  }
   for (int i = 0; i < numLines; ++i) {
     jstring line = (jstring) ((*env)->GetObjectArrayElement(env, lines, i));
     c_lines[i] = (char*)(*env)->GetStringUTFChars(env, line, 0);
@@ -970,10 +973,11 @@ JNIEXPORT jlong JNICALL Java_com_taosdata_jdbc_TSDBJNIConnector_insertLinesImp(J
     (*env)->ReleaseStringUTFChars(env, line, c_lines[i]);
   }
 
+  tfree(c_lines);
   if (code != TSDB_CODE_SUCCESS) {
     jniError("jobj:%p, conn:%p, code:%s", jobj, taos, tstrerror(code));
+
     return JNI_TDENGINE_ERROR;
   }
-
   return code;
 }
\ No newline at end of file

src/client/src/tscAsync.c

@@ -409,9 +409,6 @@ void tscTableMetaCallBack(void *param, TAOS_RES *res, int code) {
     return;
   }
 
-  taosReleaseRef(tscObjRef, pSql->self);
-  return;
-
   _error:
   pRes->code = code;
   tscAsyncResultOnError(pSql);

src/client/src/tscGlobalmerge.c

@@ -135,7 +135,7 @@ int32_t tscCreateGlobalMerger(tExtMemBuffer **pMemBuffer, int32_t numOfBuffer, t
       SLocalDataSource *ds = (SLocalDataSource *)malloc(sizeof(SLocalDataSource) + pMemBuffer[0]->pageSize);
       if (ds == NULL) {
         tscError("0x%"PRIx64" failed to create merge structure", id);
-        tfree(pMerger);
+        tfree(*pMerger);
         return TSDB_CODE_TSC_OUT_OF_MEMORY;
       }
       
@@ -444,6 +444,9 @@ int32_t tscCreateGlobalMergerEnv(SQueryInfo *pQueryInfo, tExtMemBuffer ***pMemBu
   
   pModel = createColumnModel(pSchema, (int32_t)size, capacity);
   tfree(pSchema);
+  if (pModel == NULL){
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
 
   int32_t pg = DEFAULT_PAGE_SIZE;
   int32_t overhead = sizeof(tFilePage);
@@ -458,6 +461,7 @@ int32_t tscCreateGlobalMergerEnv(SQueryInfo *pQueryInfo, tExtMemBuffer ***pMemBu
   }
 
   if (createOrderDescriptor(pOrderDesc, pQueryInfo, pModel) != TSDB_CODE_SUCCESS) {
+    tfree(pModel);
     return TSDB_CODE_TSC_OUT_OF_MEMORY;
   }
 

src/client/src/tscLocal.c

@@ -851,14 +851,18 @@ static int32_t tscProcessServStatus(SSqlObj *pSql) {
   SSqlObj* pHb = (SSqlObj*)taosAcquireRef(tscObjRef, pObj->hbrid);
   if (pHb != NULL) {
     pSql->res.code = pHb->res.code;
-    taosReleaseRef(tscObjRef, pObj->hbrid);
   }
 
   if (pSql->res.code == TSDB_CODE_RPC_NETWORK_UNAVAIL) {
+    taosReleaseRef(tscObjRef, pObj->hbrid);
     return pSql->res.code;
   }
 
-  pSql->res.code = checkForOnlineNode(pHb);
+  if (pHb != NULL) {
+    pSql->res.code = checkForOnlineNode(pHb);
+    taosReleaseRef(tscObjRef, pObj->hbrid);
+  }
+
   if (pSql->res.code == TSDB_CODE_RPC_NETWORK_UNAVAIL) {
     return pSql->res.code;
   }

src/client/src/tscParseInsert.c

@@ -2105,7 +2105,7 @@ static void parseFileSendDataBlock(void *param, TAOS_RES *tres, int32_t numOfRow
       pParentSql->fp = pParentSql->fetchFp;
 
       // all data has been sent to vnode, call user function
-      int32_t v = (code != TSDB_CODE_SUCCESS) ? code : (int32_t)pParentSql->res.numOfRows;
+      int32_t v = (int32_t)pParentSql->res.numOfRows;
       (*pParentSql->fp)(pParentSql->param, pParentSql, v);
       return;
     }

src/client/src/tscParseLineProtocol.c

@@ -424,6 +424,11 @@ int32_t loadTableMeta(TAOS* taos, char* tableName, SSmlSTableSchema* schema, SSm
   taos_free_result(res);
 
   SSqlObj* pSql = calloc(1, sizeof(SSqlObj));
+  if (pSql == NULL){
+      tscError("failed to allocate memory, reason:%s", strerror(errno));
+      code = TSDB_CODE_TSC_OUT_OF_MEMORY;
+      return code;
+  }
   pSql->pTscObj = taos;
   pSql->signature = pSql;
   pSql->fp = NULL;
@@ -434,20 +439,18 @@ int32_t loadTableMeta(TAOS* taos, char* tableName, SSmlSTableSchema* schema, SSm
   if (tscValidateName(&tableToken) != TSDB_CODE_SUCCESS) {
     code = TSDB_CODE_TSC_INVALID_TABLE_ID_LENGTH;
     sprintf(pSql->cmd.payload, "table name is invalid");
+    tscFreeSqlObj(pSql);
     return code;
   }
 
   SName sname = {0};
   if ((code = tscSetTableFullName(&sname, &tableToken, pSql)) != TSDB_CODE_SUCCESS) {
+    tscFreeSqlObj(pSql);
     return code;
   }
   char  fullTableName[TSDB_TABLE_FNAME_LEN] = {0};
   memset(fullTableName, 0, tListLen(fullTableName));
   tNameExtractFullName(&sname, fullTableName);
-  if (code != TSDB_CODE_SUCCESS) {
-    tscFreeSqlObj(pSql);
-    return code;
-  }
   tscFreeSqlObj(pSql);
 
   schema->tags = taosArrayInit(8, sizeof(SSchema));
@@ -636,6 +639,10 @@ static int32_t creatChildTableIfNotExists(TAOS* taos, const char* cTableName, co
                                           SArray* tagsSchema, SArray* tagsBind, SSmlLinesInfo* info) {
   size_t numTags = taosArrayGetSize(tagsSchema);
   char* sql = malloc(tsMaxSQLStringLen+1);
+  if (sql == NULL) {
+    tscError("malloc sql memory error");
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
   int freeBytes = tsMaxSQLStringLen + 1;
   sprintf(sql, "create table if not exists %s using %s", cTableName, sTableName);
 
@@ -657,23 +664,30 @@ static int32_t creatChildTableIfNotExists(TAOS* taos, const char* cTableName, co
   tscDebug("SML:0x%"PRIx64" create table : %s", info->id, sql);
 
   TAOS_STMT* stmt = taos_stmt_init(taos);
+  if (stmt == NULL) {
+    free(sql);
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
   int32_t code;
   code = taos_stmt_prepare(stmt, sql, (unsigned long)strlen(sql));
   free(sql);
 
   if (code != 0) {
+    tfree(stmt);
     tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
     return code;
   }
 
   code = taos_stmt_bind_param(stmt, TARRAY_GET_START(tagsBind));
   if (code != 0) {
+    tfree(stmt);
     tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
     return code;
   }
 
   code = taos_stmt_execute(stmt);
   if (code != 0) {
+    tfree(stmt);
     tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
     return code;
   }
@@ -689,6 +703,11 @@ static int32_t creatChildTableIfNotExists(TAOS* taos, const char* cTableName, co
 static int32_t insertChildTableBatch(TAOS* taos,  char* cTableName, SArray* colsSchema, SArray* rowsBind, SSmlLinesInfo* info) {
   size_t numCols = taosArrayGetSize(colsSchema);
   char* sql = malloc(tsMaxSQLStringLen+1);
+  if (sql == NULL) {
+    tscError("malloc sql memory error");
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
+
   int32_t freeBytes = tsMaxSQLStringLen + 1 ;
   sprintf(sql, "insert into ? (");
 
@@ -710,11 +729,15 @@ static int32_t insertChildTableBatch(TAOS* taos,  char* cTableName, SArray* cols
   int32_t try = 0;
 
   TAOS_STMT* stmt = taos_stmt_init(taos);
-
+  if (stmt == NULL) {
+    tfree(sql);
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
   code = taos_stmt_prepare(stmt, sql, (unsigned long)strlen(sql));
-  free(sql);
+  tfree(sql);
 
   if (code != 0) {
+    tfree(stmt);
     tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
     return code;
   }
@@ -722,6 +745,7 @@ static int32_t insertChildTableBatch(TAOS* taos,  char* cTableName, SArray* cols
   do {
     code = taos_stmt_set_tbname(stmt, cTableName);
     if (code != 0) {
+      tfree(stmt);
       tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
       return code;
     }
@@ -731,11 +755,13 @@ static int32_t insertChildTableBatch(TAOS* taos,  char* cTableName, SArray* cols
       TAOS_BIND* colsBinds = taosArrayGetP(rowsBind, i);
       code = taos_stmt_bind_param(stmt, colsBinds);
       if (code != 0) {
+        tfree(stmt);
         tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
         return code;
       }
       code = taos_stmt_add_batch(stmt);
       if (code != 0) {
+        tfree(stmt);
         tscError("SML:0x%"PRIx64" %s", info->id, taos_stmt_errstr(stmt));
         return code;
       }
@@ -1757,7 +1783,7 @@ static bool checkDuplicateKey(char *key, SHashObj *pHash) {
 
 static int32_t parseSmlKey(TAOS_SML_KV *pKV, const char **index, SHashObj *pHash) {
   const char *cur = *index;
-  char key[TSDB_COL_NAME_LEN];
+  char key[TSDB_COL_NAME_LEN + 1];  // +1 to avoid key[len] over write
   uint16_t len = 0;
 
   //key field cannot start with digit
@@ -1839,7 +1865,10 @@ static int32_t parseSmlMeasurement(TAOS_SML_DATA_POINT *pSml, const char **index
   const char *cur = *index;
   uint16_t len = 0;
 
-  pSml->stableName = calloc(TSDB_TABLE_NAME_LEN, 1);
+  pSml->stableName = calloc(TSDB_TABLE_NAME_LEN + 1, 1);    // +1 to avoid 1772 line over write
+  if (pSml->stableName == NULL){
+      return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
   if (isdigit(*cur)) {
     tscError("Measurement field cannnot start with digit");
     free(pSml->stableName);

src/client/src/tscPrepare.c

@@ -1628,8 +1628,8 @@ int taos_stmt_set_tbname_tags(TAOS_STMT* stmt, const char* name, TAOS_BIND* tags
   if (pStmt->mtb.subSet && taosHashGetSize(pStmt->mtb.pTableHash) > 0) {
     STableMetaInfo* pTableMetaInfo = tscGetTableMetaInfoFromCmd(pCmd, 0);
     STableMeta* pTableMeta = pTableMetaInfo->pTableMeta;
-    char sTableName[TSDB_TABLE_FNAME_LEN];
-    strncpy(sTableName, pTableMeta->sTableName, sizeof(sTableName));
+    char sTableName[TSDB_TABLE_FNAME_LEN] = {0};
+    tstrncpy(sTableName, pTableMeta->sTableName, sizeof(sTableName));
 
     SStrToken tname = {0};
     tname.type = TK_STRING;
@@ -1773,7 +1773,9 @@ int taos_stmt_close(TAOS_STMT* stmt) {
       }
       tscDestroyDataBlock(pStmt->mtb.lastBlock, rmMeta);
       pStmt->mtb.pTableBlockHashList = tscDestroyBlockHashTable(pStmt->mtb.pTableBlockHashList, rmMeta);
-      taosHashCleanup(pStmt->pSql->cmd.insertParam.pTableBlockHashList);
+      if (pStmt->pSql){
+        taosHashCleanup(pStmt->pSql->cmd.insertParam.pTableBlockHashList);
+      }
       pStmt->pSql->cmd.insertParam.pTableBlockHashList = NULL;
       taosArrayDestroy(pStmt->mtb.tags);
       tfree(pStmt->mtb.sqlstr);

src/client/src/tscSQLParser.c

@@ -421,7 +421,8 @@ int32_t readFromFile(char *name, uint32_t *len, void **buf) {
     tfree(*buf);
     return TSDB_CODE_TSC_APP_ERROR;
   }
-
+  close(fd);
+  tfree(*buf);
   return TSDB_CODE_SUCCESS;
 }
 
@@ -6869,7 +6870,8 @@ static int32_t doAddGroupbyColumnsOnDemand(SSqlCmd* pCmd, SQueryInfo* pQueryInfo
     tagSchema = tscGetTableTagSchema(pTableMetaInfo->pTableMeta);
   }
 
-  SSchema* s = NULL;
+  SSchema tmp = {.type = 0, .name = "", .colId = 0, .bytes = 0};
+  SSchema* s = &tmp;
 
   for (int32_t i = 0; i < pQueryInfo->groupbyExpr.numOfGroupCols; ++i) {
     SColIndex* pColIndex = taosArrayGet(pQueryInfo->groupbyExpr.columnInfo, i);
@@ -6879,7 +6881,9 @@ static int32_t doAddGroupbyColumnsOnDemand(SSqlCmd* pCmd, SQueryInfo* pQueryInfo
       s = tGetTbnameColumnSchema();
     } else {
       if (TSDB_COL_IS_TAG(pColIndex->flag)) {
-        s = &tagSchema[colIndex];
+        if(tagSchema){
+          s = &tagSchema[colIndex];
+        }
       } else {
         s = &pSchema[colIndex];
       }
@@ -8120,7 +8124,8 @@ int32_t loadAllTableMeta(SSqlObj* pSql, struct SSqlInfo* pInfo) {
   assert(maxSize < 80 * TSDB_MAX_COLUMNS);
   if (!pSql->pBuf) {
     if (NULL == (pSql->pBuf = tcalloc(1, 80 * TSDB_MAX_COLUMNS))) {
-      return TSDB_CODE_TSC_OUT_OF_MEMORY;
+      code = TSDB_CODE_TSC_OUT_OF_MEMORY;
+      goto _end;
     }
   }
 
@@ -8399,14 +8404,18 @@ static int32_t doValidateSubquery(SSqlNode* pSqlNode, int32_t index, SSqlObj* pS
 
   // create dummy table meta info
   STableMetaInfo* pTableMetaInfo1 = calloc(1, sizeof(STableMetaInfo));
+  if (pTableMetaInfo1 == NULL) {
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
   pTableMetaInfo1->pTableMeta = extractTempTableMetaFromSubquery(pSub);
 
   if (subInfo->aliasName.n > 0) {
     if (subInfo->aliasName.n >= TSDB_TABLE_FNAME_LEN) {
+      tfree(pTableMetaInfo1);
       return invalidOperationMsg(msgBuf, "subquery alias name too long");
     }
 
-    strncpy(pTableMetaInfo1->aliasName, subInfo->aliasName.z, subInfo->aliasName.n);
+    tstrncpy(pTableMetaInfo1->aliasName, subInfo->aliasName.z, subInfo->aliasName.n + 1);
   }
 
   taosArrayPush(pQueryInfo->pUpstream, &pSub);
@@ -8416,6 +8425,7 @@ static int32_t doValidateSubquery(SSqlNode* pSqlNode, int32_t index, SSqlObj* pS
 
   STableMetaInfo** tmp = realloc(pQueryInfo->pTableMetaInfo, (pQueryInfo->numOfTables + 1) * POINTER_BYTES);
   if (tmp == NULL) {
+    tfree(pTableMetaInfo1);
     return TSDB_CODE_TSC_OUT_OF_MEMORY;
   }
 

src/client/src/tscServer.c

@@ -164,7 +164,7 @@ static void tscUpdateVgroupInfo(SSqlObj *pSql, SRpcEpSet *pEpSet) {
   vgroupInfo.inUse    = pEpSet->inUse;
   vgroupInfo.numOfEps = pEpSet->numOfEps;
   for (int32_t i = 0; i < vgroupInfo.numOfEps; i++) {
-    strncpy(vgroupInfo.ep[i].fqdn, pEpSet->fqdn[i], TSDB_FQDN_LEN);
+    tstrncpy(vgroupInfo.ep[i].fqdn, pEpSet->fqdn[i], TSDB_FQDN_LEN);
     vgroupInfo.ep[i].port = pEpSet->port[i];
   }
 
@@ -699,7 +699,9 @@ static char *doSerializeTableInfo(SQueryTableMsg *pQueryMsg, SSqlObj *pSql, STab
       tscDumpEpSetFromVgroupInfo(&pSql->epSet, &vgroupInfo);
     }
 
-    pSql->epSet.inUse = rand()%pSql->epSet.numOfEps;
+    if (pSql->epSet.numOfEps > 0){
+      pSql->epSet.inUse = rand()%pSql->epSet.numOfEps;
+    }
     pQueryMsg->head.vgId = htonl(vgId);
 
     STableIdInfo *pTableIdInfo = (STableIdInfo *)pMsg;
@@ -976,7 +978,7 @@ int tscBuildQueryMsg(SSqlObj *pSql, SSqlInfo *pInfo) {
     }
   }
 
-  if (query.numOfTags > 0) {
+  if (query.numOfTags > 0 && query.tagColList != NULL) {
     for (int32_t i = 0; i < query.numOfTags; ++i) {
       SColumnInfo* pTag = &query.tagColList[i];
 
@@ -2025,8 +2027,12 @@ int tscProcessTableMetaRsp(SSqlObj *pSql) {
   assert(pTableMetaInfo->pTableMeta == NULL);
 
   STableMeta* pTableMeta = tscCreateTableMetaFromMsg(pMetaMsg);
+  if (pTableMeta == NULL){
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
   if (!tIsValidSchema(pTableMeta->schema, pTableMeta->tableInfo.numOfColumns, pTableMeta->tableInfo.numOfTags)) {
     tscError("0x%"PRIx64" invalid table meta from mnode, name:%s", pSql->self, tNameGetTableName(&pTableMetaInfo->name));
+    tfree(pTableMeta);
     return TSDB_CODE_TSC_INVALID_VALUE;
   }
 
@@ -2366,6 +2372,9 @@ int tscProcessSTableVgroupRsp(SSqlObj *pSql) {
       break;
     }
 
+    if (!pInfo){
+      continue;
+    }
     int32_t size = 0;
     pInfo->vgroupList = createVgroupInfoFromMsg(pMsg, &size, pSql->self);
     pMsg += size;

src/client/src/tscSql.c

@@ -963,8 +963,14 @@ int taos_load_table_info(TAOS *taos, const char *tableNameList) {
 
   strtolower(str, tableNameList);
   SArray* plist = taosArrayInit(4, POINTER_BYTES);
+  if (plist == NULL) {
+    tfree(str);
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
+
   SArray* vgroupList = taosArrayInit(4, POINTER_BYTES);
-  if (plist == NULL || vgroupList == NULL) {
+  if (vgroupList == NULL) {
+    taosArrayDestroy(plist);
     tfree(str);
     return TSDB_CODE_TSC_OUT_OF_MEMORY;
   }
@@ -980,6 +986,8 @@ int taos_load_table_info(TAOS *taos, const char *tableNameList) {
 
   if (code != TSDB_CODE_SUCCESS) {
     tscFreeSqlObj(pSql);
+    taosArrayDestroyEx(plist, freeElem);
+    taosArrayDestroyEx(vgroupList, freeElem);
     return code;
   }
 

src/client/src/tscStream.c

@@ -271,7 +271,7 @@ static void tscProcessStreamRetrieveResult(void *param, TAOS_RES *res, int numOf
 
   if (pSql == NULL || numOfRows < 0) {
     int64_t retryDelayTime = tscGetRetryDelayTime(pStream, pStream->interval.sliding, pStream->precision);
-    tscError("0x%"PRIx64" stream:%p, retrieve data failed, code:0x%08x, retry in %" PRId64 " ms", pSql->self, pStream, numOfRows, retryDelayTime);
+    tscError("stream:%p, retrieve data failed, code:0x%08x, retry in %" PRId64 " ms", pStream, numOfRows, retryDelayTime);
   
     tscSetRetryTimer(pStream, pStream->pSql, retryDelayTime);
     return;

src/client/src/tscSubquery.c

@@ -2476,8 +2476,9 @@ int32_t tscHandleMasterSTableQuery(SSqlObj *pSql) {
     pState->states = calloc(pState->numOfSub, sizeof(*pState->states));
     if (pState->states == NULL) {
       pRes->code = TSDB_CODE_TSC_OUT_OF_MEMORY;
+      tscDestroyGlobalMergerEnv(pMemoryBuf, pDesc,pState->numOfSub);
+
       tscAsyncResultOnError(pSql);
-      tfree(pMemoryBuf);
       return ret;
     }
 
@@ -2749,6 +2750,9 @@ void tscHandleSubqueryError(SRetrieveSupport *trsupport, SSqlObj *pSql, int numO
 }
 
 static void tscAllDataRetrievedFromDnode(SRetrieveSupport *trsupport, SSqlObj* pSql) {
+  if (trsupport->pExtMemBuffer == NULL){
+    return;
+  }
   int32_t           idx = trsupport->subqueryIndex;
   SSqlObj *         pParentSql = trsupport->pParentSql;
   tOrderDescriptor *pDesc = trsupport->pOrderDescriptor;

src/client/src/tscUtil.c

@@ -275,16 +275,6 @@ bool tscIsProjectionQuery(SQueryInfo* pQueryInfo) {
         f != TSDB_FUNC_DERIVATIVE) {
       return false;
     }
-
-    if (f < 0) {
-      SUdfInfo* pUdfInfo = taosArrayGet(pQueryInfo->pUdfInfo, -1 * f - 1);
-      if (pUdfInfo->funcType == TSDB_UDF_TYPE_AGGREGATE) {
-        return false;
-      }
-
-      continue;
-    }
-
   }
 
   return true;
@@ -3432,7 +3422,7 @@ STableMetaInfo* tscAddTableMetaInfo(SQueryInfo* pQueryInfo, SName* name, STableM
     return NULL;
   }
 
-  if (pTagCols != NULL) {
+  if (pTagCols != NULL && pTableMetaInfo->pTableMeta != NULL) {
     tscColumnListCopy(pTableMetaInfo->tagColList, pTagCols, pTableMetaInfo->pTableMeta->id.uid);
   }
 
@@ -3861,7 +3851,8 @@ void executeQuery(SSqlObj* pSql, SQueryInfo* pQueryInfo) {
       SSqlObj* pNew = (SSqlObj*)calloc(1, sizeof(SSqlObj));
       if (pNew == NULL) {
         terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
-        //      return NULL;
+        tscError("pNew == NULL, out of memory");
+        return;
       }
 
       pNew->pTscObj = pSql->pTscObj;
@@ -4349,7 +4340,7 @@ uint32_t tscGetTableMetaSize(STableMeta* pTableMeta) {
   assert(pTableMeta != NULL);
 
   int32_t totalCols = 0;
-  if (pTableMeta->tableInfo.numOfColumns >= 0 && pTableMeta->tableInfo.numOfTags >= 0) {
+  if (pTableMeta->tableInfo.numOfColumns >= 0) {
     totalCols = pTableMeta->tableInfo.numOfColumns + pTableMeta->tableInfo.numOfTags;
   }
   
@@ -4382,7 +4373,7 @@ int32_t tscCreateTableMetaFromSTableMeta(STableMeta* pChild, const char* name, v
     pChild->sversion = p->sversion;
     pChild->tversion = p->tversion;
 
-    memcpy(&pChild->tableInfo, &p->tableInfo, sizeof(STableInfo));
+    memcpy(&pChild->tableInfo, &p->tableInfo, sizeof(STableComInfo));
     int32_t total = pChild->tableInfo.numOfColumns + pChild->tableInfo.numOfTags;
 
     memcpy(pChild->schema, p->schema, sizeof(SSchema) *total);
@@ -4749,7 +4740,7 @@ static int32_t doAddTableName(char* nextStr, char** str, SArray* pNameArray, SSq
   int32_t len = 0;
 
   if (nextStr == NULL) {
-    strncpy(tablename, *str, TSDB_TABLE_FNAME_LEN);
+    tstrncpy(tablename, *str, TSDB_TABLE_FNAME_LEN);
     len = (int32_t) strlen(tablename);
   } else {
     len = (int32_t)(nextStr - (*str));

src/common/src/tname.c

@@ -319,7 +319,7 @@ int32_t tNameGetDbName(const SName* name, char* dst) {
 
 int32_t tNameGetFullDbName(const SName* name, char* dst) {
   assert(name != NULL && dst != NULL);
-  snprintf(dst, TSDB_ACCT_ID_LEN + TS_PATH_DELIMITER_LEN + TSDB_DB_NAME_LEN,
+  snprintf(dst, TSDB_ACCT_ID_LEN + TS_PATH_DELIMITER_LEN + TSDB_DB_NAME_LEN,    // there is a over write risk
       "%s.%s", name->acctId, name->dbname);
   return 0;
 }

src/query/inc/qTableMeta.h

@@ -60,7 +60,7 @@ typedef struct STableComInfo {
 typedef struct STableMeta {
   int32_t        vgId;
   STableId       id;
-  uint8_t        tableType;
+  int8_t         tableType;
   char           sTableName[TSDB_TABLE_FNAME_LEN];  // super table name
   uint64_t       suid;       // super table id
   int16_t        sversion;

src/query/src/qExecutor.c

@@ -30,6 +30,7 @@
 #include "tcompare.h"
 #include "tscompression.h"
 #include "qScript.h"
+#include "tscLog.h"
 
 #define IS_MASTER_SCAN(runtime)        ((runtime)->scanFlag == MASTER_SCAN)
 #define IS_REVERSE_SCAN(runtime)       ((runtime)->scanFlag == REVERSE_SCAN)
@@ -787,7 +788,7 @@ static int32_t getNumOfRowsInTimeWindow(SQueryRuntimeEnv* pRuntimeEnv, SDataBloc
   int32_t step  = GET_FORWARD_DIRECTION_FACTOR(order);
 
   if (QUERY_IS_ASC_QUERY(pQueryAttr)) {
-    if (ekey < pDataBlockInfo->window.ekey) {
+    if (ekey < pDataBlockInfo->window.ekey && pPrimaryColumn) {
       num = getForwardStepsInBlock(pDataBlockInfo->rows, searchFn, ekey, startPos, order, pPrimaryColumn);
       if (updateLastKey) { // update the last key
         item->lastKey = pPrimaryColumn[startPos + (num - 1)] + step;
@@ -799,7 +800,7 @@ static int32_t getNumOfRowsInTimeWindow(SQueryRuntimeEnv* pRuntimeEnv, SDataBloc
       }
     }
   } else {  // desc
-    if (ekey > pDataBlockInfo->window.skey) {
+    if (ekey > pDataBlockInfo->window.skey && pPrimaryColumn) {
       num = getForwardStepsInBlock(pDataBlockInfo->rows, searchFn, ekey, startPos, order, pPrimaryColumn);
       if (updateLastKey) {  // update the last key
         item->lastKey = pPrimaryColumn[startPos - (num - 1)] + step;
@@ -1336,6 +1337,10 @@ static void doWindowBorderInterpolation(SOperatorInfo* pOperatorInfo, SSDataBloc
   assert(pBlock != NULL);
   int32_t step = GET_FORWARD_DIRECTION_FACTOR(pQueryAttr->order.order);
 
+  if (pBlock->pDataBlock == NULL){
+    tscError("pBlock->pDataBlock == NULL");
+    return;
+  }
   SColumnInfoData *pColInfo = taosArrayGet(pBlock->pDataBlock, 0);
 
   TSKEY  *tsCols = (TSKEY *)(pColInfo->pData);
@@ -3600,6 +3605,7 @@ STableQueryInfo* createTmpTableQueryInfo(STimeWindow win) {
   int32_t initialSize = 16;
   int32_t code = initResultRowInfo(&pTableQueryInfo->resInfo, initialSize, TSDB_DATA_TYPE_INT);
   if (code != TSDB_CODE_SUCCESS) {
+    tfree(pTableQueryInfo);
     return NULL;
   }
 
@@ -7302,9 +7308,7 @@ void destroyUdfInfo(SUdfInfo* pUdfInfo) {
   tfree(pUdfInfo);
 }
 
-static char* getUdfFuncName(char* name, int type) {
-  char* funcname = calloc(1, TSDB_FUNCTIONS_NAME_MAX_LENGTH + 10);
-
+static char* getUdfFuncName(char* funcname, char* name, int type) {
   switch (type) {
     case TSDB_UDF_FUNC_NORMAL:
       strcpy(funcname, name);
@@ -7375,19 +7379,20 @@ int32_t initUdfInfo(SUdfInfo* pUdfInfo) {
       return TSDB_CODE_QRY_SYS_ERROR;
     }
 
-    pUdfInfo->funcs[TSDB_UDF_FUNC_NORMAL] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(pUdfInfo->name, TSDB_UDF_FUNC_NORMAL));
+    char funcname[TSDB_FUNCTIONS_NAME_MAX_LENGTH + 10] = {0};
+    pUdfInfo->funcs[TSDB_UDF_FUNC_NORMAL] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(funcname, pUdfInfo->name, TSDB_UDF_FUNC_NORMAL));
     if (NULL == pUdfInfo->funcs[TSDB_UDF_FUNC_NORMAL]) {
       return TSDB_CODE_QRY_SYS_ERROR;
     }
 
-    pUdfInfo->funcs[TSDB_UDF_FUNC_INIT] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(pUdfInfo->name, TSDB_UDF_FUNC_INIT));
+    pUdfInfo->funcs[TSDB_UDF_FUNC_INIT] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(funcname, pUdfInfo->name, TSDB_UDF_FUNC_INIT));
 
     if (pUdfInfo->funcType == TSDB_UDF_TYPE_AGGREGATE) {
-      pUdfInfo->funcs[TSDB_UDF_FUNC_FINALIZE] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(pUdfInfo->name, TSDB_UDF_FUNC_FINALIZE));
-      pUdfInfo->funcs[TSDB_UDF_FUNC_MERGE] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(pUdfInfo->name, TSDB_UDF_FUNC_MERGE));
+      pUdfInfo->funcs[TSDB_UDF_FUNC_FINALIZE] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(funcname, pUdfInfo->name, TSDB_UDF_FUNC_FINALIZE));
+      pUdfInfo->funcs[TSDB_UDF_FUNC_MERGE] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(funcname, pUdfInfo->name, TSDB_UDF_FUNC_MERGE));
     }
 
-    pUdfInfo->funcs[TSDB_UDF_FUNC_DESTROY] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(pUdfInfo->name, TSDB_UDF_FUNC_DESTROY));
+    pUdfInfo->funcs[TSDB_UDF_FUNC_DESTROY] = taosLoadSym(pUdfInfo->handle, getUdfFuncName(funcname, pUdfInfo->name, TSDB_UDF_FUNC_DESTROY));
 
     if (pUdfInfo->funcs[TSDB_UDF_FUNC_INIT]) {
       return (*(udfInitFunc)pUdfInfo->funcs[TSDB_UDF_FUNC_INIT])(&pUdfInfo->init);
@@ -7459,10 +7464,12 @@ int32_t createQueryFunc(SQueriedTableInfo* pTableInfo, int32_t numOfOutput, SExp
       int32_t j = getColumnIndexInSource(pTableInfo, &pExprs[i].base, pTagCols);
       if (TSDB_COL_IS_TAG(pExprs[i].base.colInfo.flag)) {
         if (j < TSDB_TBNAME_COLUMN_INDEX || j >= pTableInfo->numOfTags) {
+          tfree(pExprs);
           return TSDB_CODE_QRY_INVALID_MSG;
         }
       } else {
         if (j < PRIMARYKEY_TIMESTAMP_COL_INDEX || j >= pTableInfo->numOfCols) {
+          tfree(pExprs);
           return TSDB_CODE_QRY_INVALID_MSG;
         }
       }
@@ -7482,6 +7489,7 @@ int32_t createQueryFunc(SQueriedTableInfo* pTableInfo, int32_t numOfOutput, SExp
         int32_t ret = cloneExprFilterInfo(&pExprs[i].base.flist.filterInfo, pExprMsg[i]->flist.filterInfo,
             pExprMsg[i]->flist.numOfFilters);
         if (ret) {
+          tfree(pExprs);
           return ret;
         }
       }
@@ -7600,7 +7608,7 @@ SGroupbyExpr *createGroupbyExprFromMsg(SQueryTableMsg *pQueryMsg, SColIndex *pCo
 
 int32_t doCreateFilterInfo(SColumnInfo* pCols, int32_t numOfCols, int32_t numOfFilterCols, SSingleColumnFilterInfo** pFilterInfo, uint64_t qId) {
   *pFilterInfo = calloc(1, sizeof(SSingleColumnFilterInfo) * numOfFilterCols);
-  if (pFilterInfo == NULL) {
+  if (*pFilterInfo == NULL) {
     return TSDB_CODE_QRY_OUT_OF_MEMORY;
   }
 

src/query/src/qPlan.c

@@ -40,7 +40,7 @@ static SQueryNode* createQueryNode(int32_t type, const char* name, SQueryNode**
   pNode->info.type = type;
   pNode->info.name = strdup(name);
 
-  if (pTableInfo->id.uid != 0) { // it is a true table
+  if (pTableInfo->id.uid != 0 && pTableInfo->tableName) { // it is a true table
     pNode->tableInfo.id = pTableInfo->id;
     pNode->tableInfo.tableName = strdup(pTableInfo->tableName);
   }
@@ -222,6 +222,7 @@ SArray* createQueryPlanImpl(SQueryInfo* pQueryInfo) {
 
   if (pQueryInfo->numOfTables > 1) {  // it is a join query
     // 1. separate the select clause according to table
+    taosArrayDestroy(upstream);
     upstream = taosArrayInit(5, POINTER_BYTES);
 
     for(int32_t i = 0; i < pQueryInfo->numOfTables; ++i) {
@@ -231,6 +232,7 @@ SArray* createQueryPlanImpl(SQueryInfo* pQueryInfo) {
       SArray* exprList = taosArrayInit(4, POINTER_BYTES);
       if (tscExprCopy(exprList, pQueryInfo->exprList, uid, true) != 0) {
         terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+        tscExprDestroy(exprList);
         exit(-1);
       }
 
@@ -245,6 +247,8 @@ SArray* createQueryPlanImpl(SQueryInfo* pQueryInfo) {
 
       // 4. add the projection query node
       SQueryNode* pNode = doAddTableColumnNode(pQueryInfo, pTableMetaInfo, &info, exprList, tableColumnList);
+      tscColumnListDestroy(tableColumnList);
+      tscExprDestroy(exprList);
       taosArrayPush(upstream, &pNode);
     }
 

src/query/src/qResultbuf.c

@@ -78,8 +78,9 @@ static char* doDecompressData(void* data, int32_t srcSize, int32_t *dst, SDiskba
   }
 
   *dst = tsDecompressString(data, srcSize, 1, pResultBuf->assistBuf, pResultBuf->pageSize, ONE_STAGE_COMP, NULL, 0);
-
-  memcpy(data, pResultBuf->assistBuf, *dst);
+  if (*dst > 0) {
+    memcpy(data, pResultBuf->assistBuf, *dst);
+  }
   return data;
 }
 

src/query/src/qScript.c

@@ -378,9 +378,11 @@ ScriptEnv* getScriptEnvFromPool() {
     return NULL;
   }  
   SListNode *pNode = tdListPopHead(pool->scriptEnvs);
-  tdListNodeGetData(pool->scriptEnvs, pNode, (void *)(&pEnv));
-  listNodeFree(pNode); 
-  
+  if (pNode){
+    tdListNodeGetData(pool->scriptEnvs, pNode, (void *)(&pEnv));
+    listNodeFree(pNode);
+  }
+
   pool->cSize--;
   pthread_mutex_unlock(&pool->mutex); 
   return pEnv; 

src/query/src/qSqlParser.c

@@ -142,14 +142,17 @@ tSqlExpr *tSqlExprCreateIdValue(SStrToken *pToken, int32_t optrType) {
   }
 
   if (optrType == TK_NULL) {
-    pToken->type = TSDB_DATA_TYPE_NULL;
-    tVariantCreate(&pSqlExpr->value, pToken);
+    if (pToken){
+      pToken->type = TSDB_DATA_TYPE_NULL;
+      tVariantCreate(&pSqlExpr->value, pToken);
+    }
     pSqlExpr->tokenId = optrType;
     pSqlExpr->type    = SQL_NODE_VALUE;
   } else if (optrType == TK_INTEGER || optrType == TK_STRING || optrType == TK_FLOAT || optrType == TK_BOOL) {
-    toTSDBType(pToken->type);
-
-    tVariantCreate(&pSqlExpr->value, pToken);
+    if (pToken) {
+      toTSDBType(pToken->type);
+      tVariantCreate(&pSqlExpr->value, pToken);
+    }
     pSqlExpr->tokenId = optrType;
     pSqlExpr->type    = SQL_NODE_VALUE;
   } else if (optrType == TK_NOW) {
@@ -162,9 +165,11 @@ tSqlExpr *tSqlExprCreateIdValue(SStrToken *pToken, int32_t optrType) {
   } else if (optrType == TK_VARIABLE) {
     // use nanosecond by default
     // TODO set value after getting database precision
-    int32_t ret = parseAbsoluteDuration(pToken->z, pToken->n, &pSqlExpr->value.i64, TSDB_TIME_PRECISION_NANO);
-    if (ret != TSDB_CODE_SUCCESS) {
-      terrno = TSDB_CODE_TSC_SQL_SYNTAX_ERROR;
+    if (pToken) {
+      int32_t ret = parseAbsoluteDuration(pToken->z, pToken->n, &pSqlExpr->value.i64, TSDB_TIME_PRECISION_NANO);
+      if (ret != TSDB_CODE_SUCCESS) {
+        terrno = TSDB_CODE_TSC_SQL_SYNTAX_ERROR;
+      }
     }
 
     pSqlExpr->flags  |= 1 << EXPR_FLAG_NS_TIMESTAMP;
@@ -340,8 +345,9 @@ static FORCE_INLINE int32_t tStrTokenCompare(SStrToken* left, SStrToken* right)
   return (left->type == right->type && left->n == right->n && strncasecmp(left->z, right->z, left->n) == 0) ? 0 : 1;
 }
 
+// this function is not used for temporary
 int32_t tSqlExprCompare(tSqlExpr *left, tSqlExpr *right) {
-  if ((left == NULL && right) || (left && right == NULL)) {
+  if ((left == NULL && right) || (left && right == NULL) || (left == NULL && right == NULL)) {
     return 1;
   }
 

src/query/src/qTableMeta.c

@@ -72,7 +72,7 @@ SSchema* tscGetColumnSchemaById(STableMeta* pTableMeta, int16_t colId) {
 }
 
 STableMeta* tscCreateTableMetaFromMsg(STableMetaMsg* pTableMetaMsg) {
-  assert(pTableMetaMsg != NULL && pTableMetaMsg->numOfColumns >= 2 && pTableMetaMsg->numOfTags >= 0);
+  assert(pTableMetaMsg != NULL && pTableMetaMsg->numOfColumns >= 2);
 
   int32_t schemaSize = (pTableMetaMsg->numOfColumns + pTableMetaMsg->numOfTags) * sizeof(SSchema);
   STableMeta* pTableMeta = calloc(1, sizeof(STableMeta) + schemaSize);

src/query/src/queryMain.c

@@ -261,7 +261,7 @@ int32_t qRetrieveQueryResultInfo(qinfo_t qinfo, bool* buildRes, void* pRspContex
   SQInfo *pQInfo = (SQInfo *)qinfo;
 
   if (pQInfo == NULL || !isValidQInfo(pQInfo)) {
-    qError("QInfo:0x%"PRIx64" invalid qhandle", pQInfo->qId);
+    qError("QInfo invalid qhandle");
     return TSDB_CODE_QRY_INVALID_QHANDLE;
   }
 

src/util/inc/tlist.h

@@ -44,7 +44,7 @@ typedef struct {
 #define listNEles(l) (l)->numOfEles
 #define listEleSize(l) (l)->eleSize
 #define isListEmpty(l) ((l)->numOfEles == 0)
-#define listNodeFree(n) free(n);
+#define listNodeFree(n) free(n)
 
 SList *    tdListNew(int eleSize);
 void *     tdListFree(SList *list);

tests/script/general/parser/function.sim

@@ -783,7 +783,7 @@ endi
 sql create stable st1 (ts timestamp, f1 int, f2 int) tags (id int);
 sql create table tb1 using st1 tags(1);
 
-sql insert into tb1 values (now, 1, 1);
+sql insert into tb1 values ('2021-07-02 00:00:00', 1, 1);
 
 sql select stddev(f1) from st1 group by f1;