[td-255] add check for memory allocation failure.

src/client/inc/tscUtil.h

@@ -217,7 +217,7 @@ STableMetaInfo* tscGetTableMetaInfoFromCmd(SSqlCmd *pCmd, int32_t subClauseIndex
 STableMetaInfo* tscGetMetaInfo(SQueryInfo *pQueryInfo, int32_t tableIndex);
 
 SQueryInfo *tscGetQueryInfoDetail(SSqlCmd* pCmd, int32_t subClauseIndex);
-int32_t tscGetQueryInfoDetailSafely(SSqlCmd *pCmd, int32_t subClauseIndex, SQueryInfo** pQueryInfo);
+SQueryInfo *tscGetQueryInfoDetailSafely(SSqlCmd *pCmd, int32_t subClauseIndex);
 
 void tscClearTableMetaInfo(STableMetaInfo* pTableMetaInfo, bool removeFromCache);
 

src/client/inc/tsclient.h

@@ -35,6 +35,40 @@ extern "C" {
 #include "qTsbuf.h"
 #include "tcmdtype.h"
 
+#if 0
+static UNUSED_FUNC void *u_malloc (size_t __size) {
+  uint32_t v = rand();
+
+  if (v % 5000 <= 0) {
+    return NULL;
+  } else {
+    return malloc(__size);
+  }
+}
+
+static UNUSED_FUNC void* u_calloc(size_t num, size_t __size) {
+  uint32_t v = rand();
+  if (v % 5000 <= 0) {
+    return NULL;
+  } else {
+    return calloc(num, __size);
+  }
+}
+
+static UNUSED_FUNC void* u_realloc(void* p, size_t __size) {
+  uint32_t v = rand();
+  if (v % 5000 <= 0) {
+    return NULL;
+  } else {
+    return realloc(p, __size);
+  }
+}
+
+#define calloc  u_calloc
+#define malloc  u_malloc
+#define realloc u_realloc
+#endif
+
 // forward declaration
 struct SSqlInfo;
 struct SLocalReducer;

src/client/src/tscParseInsert.c

@@ -1031,11 +1031,11 @@ int tsParseInsertSql(SSqlObj *pSql) {
   SQueryInfo *pQueryInfo = tscGetQueryInfoDetail(pCmd, 0);
   assert(pQueryInfo != NULL);
 
-  STableMetaInfo *pTableMetaInfo = NULL;
-  if (pQueryInfo->numOfTables == 0) {
-    pTableMetaInfo = tscAddEmptyMetaInfo(pQueryInfo);
-  } else {
-    pTableMetaInfo = tscGetMetaInfo(pQueryInfo, 0);
+  STableMetaInfo *pTableMetaInfo = (pQueryInfo->numOfTables == 0)? tscAddEmptyMetaInfo(pQueryInfo):tscGetMetaInfo(pQueryInfo, 0);
+  if (pTableMetaInfo == NULL) {
+    terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+    code = terrno;
+    return code;
   }
 
   if ((code = tscAllocPayload(pCmd, TSDB_DEFAULT_PAYLOAD_SIZE)) != TSDB_CODE_SUCCESS) {
@@ -1292,8 +1292,7 @@ int tsInsertInitialCheck(SSqlObj *pSql) {
   pCmd->command = TSDB_SQL_INSERT;
   pSql->res.numOfRows = 0;
 
-  SQueryInfo *pQueryInfo = NULL;
-  tscGetQueryInfoDetailSafely(pCmd, pCmd->clauseIndex, &pQueryInfo);
+  SQueryInfo *pQueryInfo = tscGetQueryInfoDetailSafely(pCmd, pCmd->clauseIndex);
 
   TSDB_QUERY_SET_TYPE(pQueryInfo->type, TSDB_QUERY_TYPE_INSERT | pCmd->insertType);
 

src/client/src/tscSQLParser.c

@@ -179,20 +179,24 @@ int32_t tscToSQLCmd(SSqlObj* pSql, struct SSqlInfo* pInfo) {
     return TSDB_CODE_TSC_APP_ERROR;
   }
 
-  SSqlCmd*    pCmd = &(pSql->cmd);
-  SQueryInfo* pQueryInfo = NULL;
+  SSqlCmd* pCmd = &pSql->cmd;
+  SSqlRes* pRes = &pSql->res;
 
+  int32_t code = TSDB_CODE_SUCCESS;
   if (!pInfo->valid) {
     return invalidSqlErrMsg(tscGetErrorMsgPayload(pCmd), pInfo->pzErrMsg);
   }
 
-  int32_t code = tscGetQueryInfoDetailSafely(pCmd, pCmd->clauseIndex, &pQueryInfo);
+  SQueryInfo* pQueryInfo = tscGetQueryInfoDetailSafely(pCmd, pCmd->clauseIndex);
+  if (pQueryInfo == NULL) {
+    pRes->code = terrno;
+    return pRes->code;
+  }
 
-  STableMetaInfo* pTableMetaInfo = NULL;
-  if (pQueryInfo->numOfTables == 0) {
-    pTableMetaInfo = tscAddEmptyMetaInfo(pQueryInfo);
-  } else {
-    pTableMetaInfo = pQueryInfo->pTableMetaInfo[0];
+  STableMetaInfo* pTableMetaInfo = (pQueryInfo->numOfTables == 0)? tscAddEmptyMetaInfo(pQueryInfo) : pQueryInfo->pTableMetaInfo[0];
+  if (pTableMetaInfo == NULL) {
+    pRes->code = TSDB_CODE_TSC_OUT_OF_MEMORY;
+    return pRes->code;
   }
 
   pCmd->command = pInfo->type;
@@ -487,9 +491,10 @@ int32_t tscToSQLCmd(SSqlObj* pSql, struct SSqlInfo* pInfo) {
       const char* msg1 = "columns in select clause not identical";
 
       for (int32_t i = pCmd->numOfClause; i < pInfo->subclauseInfo.numOfClause; ++i) {
-        SQueryInfo* pqi = NULL;
-        if ((code = tscGetQueryInfoDetailSafely(pCmd, i, &pqi)) != TSDB_CODE_SUCCESS) {
-          return code;
+        SQueryInfo* pqi = tscGetQueryInfoDetailSafely(pCmd, i);
+        if (pqi == NULL) {
+          pRes->code = terrno;
+          return pRes->code;
         }
       }
 
@@ -2678,9 +2683,12 @@ static SColumnFilterInfo* addColumnFilterInfo(SColumn* pColumn) {
   }
 
   int32_t size = pColumn->numOfFilters + 1;
-  char*   tmp = (char*)realloc((void*)(pColumn->filterInfo), sizeof(SColumnFilterInfo) * (size));
+
+  char* tmp = (char*) realloc((void*)(pColumn->filterInfo), sizeof(SColumnFilterInfo) * (size));
   if (tmp != NULL) {
     pColumn->filterInfo = (SColumnFilterInfo*)tmp;
+  } else {
+    return NULL;
   }
 
   pColumn->numOfFilters++;
@@ -2964,9 +2972,16 @@ static int32_t extractColumnFilterInfo(SSqlCmd* pCmd, SQueryInfo* pQueryInfo, SC
     } else {  // update the existed column filter information, find the filter info here
       pColFilter = &pColumn->filterInfo[0];
     }
+
+    if (pColFilter == NULL) {
+      return TSDB_CODE_TSC_OUT_OF_MEMORY;
+    }
   } else if (sqlOptr == TK_OR) {
     // TODO fixme: failed to invalid the filter expression: "col1 = 1 OR col2 = 2"
     pColFilter = addColumnFilterInfo(pColumn);
+    if (pColFilter == NULL) {
+      return TSDB_CODE_TSC_OUT_OF_MEMORY;
+    }
   } else {  // error;
     return TSDB_CODE_TSC_INVALID_SQL;
   }

src/client/src/tscServer.c

@@ -1956,8 +1956,12 @@ static void createHBObj(STscObj* pObj) {
 
   pSql->fp = tscProcessHeartBeatRsp;
 
-  SQueryInfo *pQueryInfo = NULL;
-  tscGetQueryInfoDetailSafely(&pSql->cmd, 0, &pQueryInfo);
+  SQueryInfo *pQueryInfo = tscGetQueryInfoDetailSafely(&pSql->cmd, 0);
+  if (pQueryInfo == NULL) {
+    pSql->res.code = terrno;
+    return;
+  }
+
   pQueryInfo->command = TSDB_SQL_HB;
 
   pSql->cmd.command = pQueryInfo->command;
@@ -2142,8 +2146,7 @@ static int32_t getTableMetaFromMgmt(SSqlObj *pSql, STableMetaInfo *pTableMetaInf
 
   tscAddSubqueryInfo(&pNew->cmd);
 
-  SQueryInfo *pNewQueryInfo = NULL;
-  tscGetQueryInfoDetailSafely(&pNew->cmd, 0, &pNewQueryInfo);
+  SQueryInfo *pNewQueryInfo = tscGetQueryInfoDetailSafely(&pNew->cmd, 0);
 
   pNew->cmd.autoCreated = pSql->cmd.autoCreated;  // create table if not exists
   if (TSDB_CODE_SUCCESS != tscAllocPayload(&pNew->cmd, TSDB_DEFAULT_PAYLOAD_SIZE + pSql->cmd.payloadLen)) {
@@ -2246,8 +2249,8 @@ int tscGetSTableVgroupInfo(SSqlObj *pSql, int32_t clauseIndex) {
 
   pNew->cmd.command = TSDB_SQL_STABLEVGROUP;
   
-  SQueryInfo *pNewQueryInfo = NULL;
-  if ((code = tscGetQueryInfoDetailSafely(&pNew->cmd, 0, &pNewQueryInfo)) != TSDB_CODE_SUCCESS) {
+  SQueryInfo *pNewQueryInfo = tscGetQueryInfoDetailSafely(&pNew->cmd, 0);
+  if (pNewQueryInfo == NULL) {
     tscFreeSqlObj(pNew);
     return code;
   }

src/client/src/tscSql.c

@@ -827,8 +827,11 @@ static int tscParseTblNameList(SSqlObj *pSql, const char *tblNameList, int32_t t
   int   code = TSDB_CODE_TSC_INVALID_TABLE_ID_LENGTH;
   char *str = (char *)tblNameList;
 
-  SQueryInfo *pQueryInfo = NULL;
-  tscGetQueryInfoDetailSafely(pCmd, pCmd->clauseIndex, &pQueryInfo);
+  SQueryInfo *pQueryInfo = tscGetQueryInfoDetailSafely(pCmd, pCmd->clauseIndex);
+  if (pQueryInfo == NULL) {
+    pSql->res.code = terrno;
+    return terrno;
+  }
 
   STableMetaInfo *pTableMetaInfo = tscAddEmptyMetaInfo(pQueryInfo);
 

src/client/src/tscSubquery.c

@@ -437,6 +437,7 @@ int32_t tscCompareTidTags(const void* p1, const void* p2) {
   if (t1->vgId != t2->vgId) {
     return (t1->vgId > t2->vgId) ? 1 : -1;
   }
+
   if (t1->tid != t2->tid) {
     return (t1->tid > t2->tid) ? 1 : -1;
   }
@@ -543,6 +544,7 @@ static bool checkForDuplicateTagVal(SQueryInfo* pQueryInfo, SJoinSupporter* p1,
   for(int32_t i = 1; i < p1->num; ++i) {
     STidTags* prev = (STidTags*) varDataVal(p1->pIdTagList + (i - 1) * p1->tagSize);
     STidTags* p = (STidTags*) varDataVal(p1->pIdTagList + i * p1->tagSize);
+    assert(prev->vgId >= 1 && p->vgId >= 1);
 
     if (doCompare(prev->tag, p->tag, pColSchema->type, pColSchema->bytes) == 0) {
       tscError("%p join tags have same value for different table, free all sub SqlObj and quit", pPSqlObj);
@@ -579,6 +581,7 @@ static int32_t getIntersectionOfTableTuple(SQueryInfo* pQueryInfo, SSqlObj* pPar
   while(i < p1->num && j < p2->num) {
     STidTags* pp1 = (STidTags*) varDataVal(p1->pIdTagList + i * p1->tagSize);
     STidTags* pp2 = (STidTags*) varDataVal(p2->pIdTagList + j * p2->tagSize);
+    assert(pp1->tid != 0 && pp2->tid != 0);
 
     int32_t ret = doCompare(pp1->tag, pp2->tag, pColSchema->type, pColSchema->bytes);
     if (ret == 0) {
@@ -1221,6 +1224,16 @@ int32_t tscLaunchJoinSubquery(SSqlObj *pSql, int16_t tableIndex, SJoinSupporter
       int32_t tagColId = tscGetJoinTagColIdByUid(pTagCond, pTableMetaInfo->pTableMeta->id.uid);
       SSchema* s = tscGetTableColumnSchemaById(pTableMetaInfo->pTableMeta, tagColId);
 
+      // get the tag colId column index
+      int32_t numOfTags = tscGetNumOfTags(pTableMetaInfo->pTableMeta);
+      SSchema* pSchema = tscGetTableTagSchema(pTableMetaInfo->pTableMeta);
+      for(int32_t i = 0; i < numOfTags; ++i) {
+        if (pSchema[i].colId == tagColId) {
+          index.columnIndex = i;
+          break;
+        }
+      }
+
       int16_t bytes = 0;
       int16_t type  = 0;
       int32_t inter = 0;

src/client/src/tscUtil.c

@@ -486,15 +486,6 @@ int32_t tscCopyDataBlockToPayload(SSqlObj* pSql, STableDataBlocks* pDataBlock) {
   return TSDB_CODE_SUCCESS;
 }
 
-//void tscFreeUnusedDataBlocks(SDataBlockList* pList) {
-//  /* release additional memory consumption */
-//  for (int32_t i = 0; i < pList->nSize; ++i) {
-//    STableDataBlocks* pDataBlock = pList->pData[i];
-//    pDataBlock->pData = realloc(pDataBlock->pData, pDataBlock->size);
-//    pDataBlock->nAllocSize = (uint32_t)pDataBlock->size;
-//  }
-//}
-
 /**
  * create the in-memory buffer for each table to keep the submitted data block
  * @param initialSize
@@ -519,6 +510,11 @@ int32_t tscCreateDataBlock(size_t initialSize, int32_t rowSize, int32_t startOff
   }
   
   dataBuf->pData = calloc(1, dataBuf->nAllocSize);
+  if (dataBuf->pData == NULL) {
+    tscError("failed to allocated memory, reason:%s", strerror(errno));
+    return TSDB_CODE_TSC_OUT_OF_MEMORY;
+  }
+
   dataBuf->ordered = true;
   dataBuf->prevTS = INT64_MIN;
 
@@ -931,8 +927,12 @@ static SSqlExpr* doBuildSqlExpr(SQueryInfo* pQueryInfo, int16_t functionId, SCol
   STableMetaInfo* pTableMetaInfo = tscGetMetaInfo(pQueryInfo, pColIndex->tableIndex);
   
   SSqlExpr* pExpr = calloc(1, sizeof(SSqlExpr));
+  if (pExpr == NULL) {
+    return NULL;
+  }
+
   pExpr->functionId = functionId;
-  
+
   // set the correct columnIndex index
   if (pColIndex->columnIndex == TSDB_TBNAME_COLUMN_INDEX) {
     pExpr->colInfo.colId = TSDB_TBNAME_COLUMN_INDEX;
@@ -1063,8 +1063,11 @@ void tscSqlExprCopy(SArray* dst, const SArray* src, uint64_t uid, bool deepcopy)
       
       if (deepcopy) {
         SSqlExpr* p1 = calloc(1, sizeof(SSqlExpr));
+        if (p1 == NULL) {
+          assert(0);
+        }
+
         *p1 = *pExpr;
-  
         for (int32_t j = 0; j < pExpr->numOfParams; ++j) {
           tVariantAssign(&p1->param[j], &pExpr->param[j]);
         }
@@ -1100,16 +1103,22 @@ SColumn* tscColumnListInsert(SArray* pColumnList, SColumnIndex* pColIndex) {
 
   if (i >= numOfCols || numOfCols == 0) {
     SColumn* b = calloc(1, sizeof(SColumn));
+    if (b == NULL) {
+      return NULL;
+    }
+
     b->colIndex = *pColIndex;
-    
     taosArrayInsert(pColumnList, i, &b);
   } else {
     SColumn* pCol = taosArrayGetP(pColumnList, i);
   
     if (i < numOfCols && (pCol->colIndex.columnIndex > col || pCol->colIndex.tableIndex != pColIndex->tableIndex)) {
       SColumn* b = calloc(1, sizeof(SColumn));
+      if (b == NULL) {
+        return NULL;
+      }
+
       b->colIndex = *pColIndex;
-      
       taosArrayInsert(pColumnList, i, &b);
     }
   }
@@ -1131,7 +1140,10 @@ SColumn* tscColumnClone(const SColumn* src) {
   assert(src != NULL);
   
   SColumn* dst = calloc(1, sizeof(SColumn));
-  
+  if (dst == NULL) {
+    return NULL;
+  }
+
   dst->colIndex     = src->colIndex;
   dst->numOfFilters = src->numOfFilters;
   dst->filterInfo   = tscFilterInfoClone(src->filterInfo, src->numOfFilters);
@@ -1341,6 +1353,10 @@ void tscTagCondCopy(STagCond* dest, const STagCond* src) {
     if (pCond->len > 0) {
       assert(pCond->cond != NULL);
       c.cond = malloc(c.len);
+      if (c.cond == NULL) {
+        assert(0);
+      }
+
       memcpy(c.cond, pCond->cond, c.len);
     }
     
@@ -1466,20 +1482,20 @@ STableMetaInfo* tscGetMetaInfo(SQueryInfo* pQueryInfo, int32_t tableIndex) {
   return pQueryInfo->pTableMetaInfo[tableIndex];
 }
 
-int32_t tscGetQueryInfoDetailSafely(SSqlCmd* pCmd, int32_t subClauseIndex, SQueryInfo** pQueryInfo) {
+SQueryInfo* tscGetQueryInfoDetailSafely(SSqlCmd* pCmd, int32_t subClauseIndex) {
+  SQueryInfo* pQueryInfo = tscGetQueryInfoDetail(pCmd, subClauseIndex);
   int32_t ret = TSDB_CODE_SUCCESS;
 
-  *pQueryInfo = tscGetQueryInfoDetail(pCmd, subClauseIndex);
-
-  while ((*pQueryInfo) == NULL) {
+  while ((pQueryInfo) == NULL) {
     if ((ret = tscAddSubqueryInfo(pCmd)) != TSDB_CODE_SUCCESS) {
-      return ret;
+      terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+      return NULL;
     }
 
-    (*pQueryInfo) = tscGetQueryInfoDetail(pCmd, subClauseIndex);
+    pQueryInfo = tscGetQueryInfoDetail(pCmd, subClauseIndex);
   }
 
-  return TSDB_CODE_SUCCESS;
+  return pQueryInfo;
 }
 
 STableMetaInfo* tscGetTableMetaInfoByUid(SQueryInfo* pQueryInfo, uint64_t uid, int32_t* index) {
@@ -1591,14 +1607,18 @@ STableMetaInfo* tscAddTableMetaInfo(SQueryInfo* pQueryInfo, const char* name, ST
                                     SVgroupsInfo* vgroupList, SArray* pTagCols) {
   void* pAlloc = realloc(pQueryInfo->pTableMetaInfo, (pQueryInfo->numOfTables + 1) * POINTER_BYTES);
   if (pAlloc == NULL) {
+    terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
     return NULL;
   }
 
   pQueryInfo->pTableMetaInfo = pAlloc;
-  pQueryInfo->pTableMetaInfo[pQueryInfo->numOfTables] = calloc(1, sizeof(STableMetaInfo));
+  STableMetaInfo* pTableMetaInfo = calloc(1, sizeof(STableMetaInfo));
+  if (pTableMetaInfo == NULL) {
+    terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+    return NULL;
+  }
 
-  STableMetaInfo* pTableMetaInfo = pQueryInfo->pTableMetaInfo[pQueryInfo->numOfTables];
-  assert(pTableMetaInfo != NULL);
+  pQueryInfo->pTableMetaInfo[pQueryInfo->numOfTables] = pTableMetaInfo;
 
   if (name != NULL) {
     tstrncpy(pTableMetaInfo->name, name, sizeof(pTableMetaInfo->name));
@@ -1609,10 +1629,18 @@ STableMetaInfo* tscAddTableMetaInfo(SQueryInfo* pQueryInfo, const char* name, ST
   if (vgroupList != NULL) {
     size_t size = sizeof(SVgroupsInfo) + sizeof(SCMVgroupInfo) * vgroupList->numOfVgroups;
     pTableMetaInfo->vgroupList = malloc(size);
+    if (pTableMetaInfo->vgroupList == NULL) {
+      return NULL;
+    }
+
     memcpy(pTableMetaInfo->vgroupList, vgroupList, size);
   }
 
   pTableMetaInfo->tagColList = taosArrayInit(4, POINTER_BYTES);
+  if (pTableMetaInfo->tagColList == NULL) {
+    return NULL;
+  }
+
   if (pTagCols != NULL) {
     tscColumnListCopy(pTableMetaInfo->tagColList, pTagCols, -1);
   }
@@ -1678,8 +1706,7 @@ SSqlObj* createSimpleSubObj(SSqlObj* pSql, void (*fp)(), void* param, int32_t cm
     return NULL;
   }
 
-  SQueryInfo* pQueryInfo = NULL;
-  tscGetQueryInfoDetailSafely(pCmd, 0, &pQueryInfo);
+  SQueryInfo* pQueryInfo = tscGetQueryInfoDetailSafely(pCmd, 0);
 
   assert(pSql->cmd.clauseIndex == 0);
   STableMetaInfo* pMasterTableMetaInfo = tscGetTableMetaInfoFromCmd(&pSql->cmd, pSql->cmd.clauseIndex, 0);
@@ -1777,10 +1804,8 @@ SSqlObj* createSubqueryObj(SSqlObj* pSql, int16_t tableIndex, void (*fp)(), void
   pNew->sqlstr = strdup(pSql->sqlstr);
   if (pNew->sqlstr == NULL) {
     tscError("%p new subquery failed, tableIndex:%d, vgroupIndex:%d", pSql, tableIndex, pTableMetaInfo->vgroupIndex);
-
-    free(pNew);
     terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
-    return NULL;
+    goto _error;
   }
 
   SSqlCmd* pnCmd = &pNew->cmd;
@@ -1797,9 +1822,8 @@ SSqlObj* createSubqueryObj(SSqlObj* pSql, int16_t tableIndex, void (*fp)(), void
   pnCmd->parseFinished = 1;
 
   if (tscAddSubqueryInfo(pnCmd) != TSDB_CODE_SUCCESS) {
-    tscFreeSqlObj(pNew);
     terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
-    return NULL;
+    goto _error;
   }
 
   SQueryInfo* pNewQueryInfo = tscGetQueryInfoDetail(pnCmd, 0);
@@ -1824,20 +1848,28 @@ SSqlObj* createSubqueryObj(SSqlObj* pSql, int16_t tableIndex, void (*fp)(), void
   pNewQueryInfo->groupbyExpr = pQueryInfo->groupbyExpr;
   if (pQueryInfo->groupbyExpr.columnInfo != NULL) {
     pNewQueryInfo->groupbyExpr.columnInfo = taosArrayClone(pQueryInfo->groupbyExpr.columnInfo);
+    if (pNewQueryInfo->groupbyExpr.columnInfo == NULL) {
+      terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+      goto _error;
+    }
   }
   
   tscTagCondCopy(&pNewQueryInfo->tagCond, &pQueryInfo->tagCond);
 
   if (pQueryInfo->fillType != TSDB_FILL_NONE) {
     pNewQueryInfo->fillVal = malloc(pQueryInfo->fieldsInfo.numOfOutput * sizeof(int64_t));
+    if (pNewQueryInfo->fillVal == NULL) {
+      terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+      goto _error;
+    }
+
     memcpy(pNewQueryInfo->fillVal, pQueryInfo->fillVal, pQueryInfo->fieldsInfo.numOfOutput * sizeof(int64_t));
   }
 
   if (tscAllocPayload(pnCmd, TSDB_DEFAULT_PAYLOAD_SIZE) != TSDB_CODE_SUCCESS) {
     tscError("%p new subquery failed, tableIndex:%d, vgroupIndex:%d", pSql, tableIndex, pTableMetaInfo->vgroupIndex);
-    tscFreeSqlObj(pNew);
     terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
-    return NULL;
+    goto _error;
   }
   
   tscColumnListCopy(pNewQueryInfo->colList, pQueryInfo->colList, (int16_t)tableIndex);
@@ -1880,16 +1912,15 @@ SSqlObj* createSubqueryObj(SSqlObj* pSql, int16_t tableIndex, void (*fp)(), void
 
   if (pFinalInfo->pTableMeta == NULL) {
     tscError("%p new subquery failed since no tableMeta in cache, name:%s", pSql, name);
-    tscFreeSqlObj(pNew);
 
-    if (pPrevSql != NULL) {
+    if (pPrevSql != NULL) { // pass the previous error to client
       assert(pPrevSql->res.code != TSDB_CODE_SUCCESS);
       terrno = pPrevSql->res.code;
     } else {
       terrno = TSDB_CODE_TSC_APP_ERROR;
     }
 
-    return NULL;
+    goto _error;
   }
   
   assert(pNewQueryInfo->numOfTables == 1);
@@ -1914,6 +1945,10 @@ SSqlObj* createSubqueryObj(SSqlObj* pSql, int16_t tableIndex, void (*fp)(), void
   }
 
   return pNew;
+
+_error:
+  tscFreeSqlObj(pNew);
+  return NULL;
 }
 
 /**

src/query/src/qParserImpl.c

@@ -179,10 +179,12 @@ tSQLExpr *tSQLExprCreateFunction(tSQLExprList *pList, SStrToken *pFuncToken, SSt
 tSQLExpr *tSQLExprCreate(tSQLExpr *pLeft, tSQLExpr *pRight, int32_t optrType) {
   tSQLExpr *pExpr = calloc(1, sizeof(tSQLExpr));
 
-  char* endPos = pRight->token.z + pRight->token.n;
-  pExpr->token.z = pLeft->token.z;
-  pExpr->token.n = endPos - pExpr->token.z;
-  pExpr->token.type = pLeft->token.type;
+  if (pRight != NULL && pLeft != NULL) {
+    char* endPos = pRight->token.z + pRight->token.n;
+    pExpr->token.z = pLeft->token.z;
+    pExpr->token.n = endPos - pExpr->token.z;
+    pExpr->token.type = pLeft->token.type;
+  }
 
   if (optrType == TK_PLUS || optrType == TK_MINUS || optrType == TK_STAR || optrType == TK_DIVIDE || optrType == TK_REM) {
     /*

tests/script/general/parser/join.sim

@@ -330,8 +330,8 @@ sql_error select join_tb1.* from $tb1 , $tb2 where join_tb1.ts != join_tb0.ts an
 sql_error select join_tb1.* from $tb1 , $tb1 where join_tb1.ts = join_tb1.ts and join_tb1.ts >= 100000;
 sql_error select join_tb1.* from $tb1 , $tb1 where join_tb1.ts = join_tb1.ts order by ts;
 sql_error select join_tb1.* from $tb1 , $tb1 where join_tb1.ts = join_tb1.ts order by join_tb1.c7;
-sql_error select * from $tb1, $tb2;
-sql_error select last_row(*) from $tb1, $tb2
+sql_error select * from join_tb0, join_tb1
+sql_error select last_row(*) from join_tb0, join_tb1
 sql_error select last_row(*) from $tb1, $tb2 where join_tb1.ts < now
 sql_error select last_row(*) from $tb1, $tb2 where join_tb1.ts = join_tb2.ts