Merge pull request #2350 from taosdata/hotfix/crash

[TD-543] coverity scan

src/mnode/src/mnodeDb.c

@@ -960,6 +960,8 @@ static int32_t mnodeProcessAlterDbMsg(SMnodeMsg *pMsg) {
 }
 
 static int32_t mnodeDropDb(SMnodeMsg *pMsg) {
+  if (pMsg == NULL) return TSDB_CODE_MND_APP_ERROR;
+  
   SDbObj *pDb = pMsg->pDb;
   mPrint("db:%s, drop db from sdb", pDb->name);
 
@@ -973,7 +975,7 @@ static int32_t mnodeDropDb(SMnodeMsg *pMsg) {
   int32_t code = sdbDeleteRow(&oper);
   if (code == TSDB_CODE_SUCCESS) {
     mLPrint("db:%s, is dropped by %s", pDb->name, mnodeGetUserFromMsg(pMsg));
-    if (pMsg != NULL) code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
+    code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
   }
 
   return code;

src/mnode/src/mnodeDnode.c

@@ -90,11 +90,12 @@ static int32_t mnodeDnodeActionDelete(SSdbOper *pOper) {
 static int32_t mnodeDnodeActionUpdate(SSdbOper *pOper) {
   SDnodeObj *pDnode = pOper->pObj;
   SDnodeObj *pSaved = mnodeGetDnode(pDnode->dnodeId);
-  if (pDnode != pSaved && pDnode != NULL && pSaved != NULL) {
+  if (pSaved != NULL && pDnode != pSaved) {
     memcpy(pSaved, pDnode, pOper->rowSize);
     free(pDnode);
-  }
     mnodeDecDnodeRef(pSaved);
+  }
+
   return TSDB_CODE_SUCCESS;
 }
 
@@ -120,9 +121,11 @@ static int32_t mnodeDnodeActionRestored() {
     mPrint("dnode first deploy, create dnode:%s", tsLocalEp);
     mnodeCreateDnode(tsLocalEp, NULL);
     SDnodeObj *pDnode = mnodeGetDnodeByEp(tsLocalEp);
+    if (pDnode != NULL) {
       mnodeAddMnode(pDnode->dnodeId);
       mnodeDecDnodeRef(pDnode);
     }
+  }
 
   return TSDB_CODE_SUCCESS;
 }
@@ -371,6 +374,7 @@ static int32_t mnodeProcessDnodeStatusMsg(SMnodeMsg *pMsg) {
     bool ret = mnodeCheckClusterCfgPara(&(pStatus->clusterCfg));
     if (false == ret) {
       mnodeDecDnodeRef(pDnode);
+      rpcFreeCont(pRsp);
       mError("dnode %s cluster cfg parameters inconsistent", pStatus->dnodeEp);
       return TSDB_CODE_MND_CLUSTER_CFG_INCONSISTENT;
     }

src/mnode/src/mnodeShow.c

@@ -122,7 +122,7 @@ static int32_t mnodeProcessShowMsg(SMnodeMsg *pMsg) {
   SShowObj *pShow = (SShowObj *) calloc(1, showObjSize);
   pShow->type       = pShowMsg->type;
   pShow->payloadLen = htons(pShowMsg->payloadLen);
-  strcpy(pShow->db, pShowMsg->db);
+  tstrncpy(pShow->db, pShowMsg->db, TSDB_DB_NAME_LEN);
   memcpy(pShow->payload, pShowMsg->payload, pShow->payloadLen);
 
   pShow = mnodePutShowObj(pShow, showObjSize);

src/mnode/src/mnodeTable.c

@@ -443,7 +443,7 @@ static int32_t mnodeSuperTableActionDelete(SSdbOper *pOper) {
 static int32_t mnodeSuperTableActionUpdate(SSdbOper *pOper) {
   SSuperTableObj *pNew = pOper->pObj;
   SSuperTableObj *pTable = mnodeGetSuperTable(pNew->info.tableId);
-  if (pTable != pNew) {
+  if (pTable != NULL && pTable != pNew) {
     void *oldTableId = pTable->info.tableId;
     void *oldSchema = pTable->schema;
     void *oldVgHash = pTable->vgHash;
@@ -457,8 +457,10 @@ static int32_t mnodeSuperTableActionUpdate(SSdbOper *pOper) {
     free(pNew);
     free(oldTableId);
     free(oldSchema);
-  }
+  
     mnodeDecTableRef(pTable);
+  }
+
   return TSDB_CODE_SUCCESS;
 }
 
@@ -779,6 +781,8 @@ static int32_t mnodeProcessTableMetaMsg(SMnodeMsg *pMsg) {
 }
 
 static int32_t mnodeProcessCreateSuperTableMsg(SMnodeMsg *pMsg) {
+  if (pMsg == NULL) return TSDB_CODE_MND_APP_ERROR;
+
   SCMCreateTableMsg *pCreate = pMsg->rpcMsg.pCont;
   SSuperTableObj *   pStable = calloc(1, sizeof(SSuperTableObj));
   if (pStable == NULL) {
@@ -830,13 +834,15 @@ static int32_t mnodeProcessCreateSuperTableMsg(SMnodeMsg *pMsg) {
   } else {
     mLPrint("app:%p:%p, table:%s, is created, tags:%d fields:%d", pMsg->rpcMsg.ahandle, pMsg, pStable->info.tableId,
             pStable->numOfTags, pStable->numOfColumns);
-    if (pMsg != NULL) code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
+    code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
   }
 
   return code;
 }
 
 static int32_t mnodeProcessDropSuperTableMsg(SMnodeMsg *pMsg) {
+  if (pMsg == NULL) return TSDB_CODE_MND_APP_ERROR;
+
   SSuperTableObj *pStable = (SSuperTableObj *)pMsg->pTable;
   if (pStable->numOfTables != 0) {
     SHashMutableIterator *pIter = taosHashCreateIter(pStable->vgHash);
@@ -873,7 +879,7 @@ static int32_t mnodeProcessDropSuperTableMsg(SMnodeMsg *pMsg) {
   int32_t code = sdbDeleteRow(&oper);
   if (code == TSDB_CODE_SUCCESS) {
     mLPrint("stable:%s, is dropped from sdb, result:%s", pStable->info.tableId, tstrerror(code));
-    if (pMsg != NULL) code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
+    code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
   }
 
   return code;
@@ -1418,7 +1424,7 @@ static int32_t mnodeProcessSuperTableVgroupMsg(SMnodeMsg *pMsg) {
           SDnodeObj *pDnode = pVgroup->vnodeGid[vn].pDnode;
           if (pDnode == NULL) break;
 
-          strncpy(pVgroupInfo->vgroups[vgSize].ipAddr[vn].fqdn, pDnode->dnodeFqdn, tListLen(pDnode->dnodeFqdn));
+          tstrncpy(pVgroupInfo->vgroups[vgSize].ipAddr[vn].fqdn, pDnode->dnodeFqdn, TSDB_FQDN_LEN);
           pVgroupInfo->vgroups[vgSize].ipAddr[vn].port = htons(pDnode->dnodePort);
 
           pVgroupInfo->vgroups[vgSize].numOfIps++;
@@ -1462,10 +1468,10 @@ static void *mnodeBuildCreateChildTableMsg(SCMCreateTableMsg *pMsg, SChildTableO
   int32_t contLen = 0;
   if (pTable->info.type == TSDB_CHILD_TABLE) {
     totalCols = pTable->superTable->numOfColumns + pTable->superTable->numOfTags;
-    contLen = sizeof(SMDCreateTableMsg) + totalCols * sizeof(SSchema) + tagDataLen + pTable->sqlLen;
+    contLen = sizeof(SMDCreateTableMsg) + totalCols * sizeof(SSchema) + pTable->sqlLen;
     if (pMsg != NULL) {
       pTagData = (STagData *)pMsg->schema;
-      tagDataLen = ntohl(pTagData->dataLen);
+      tagDataLen = htonl(pTagData->dataLen);
       contLen += tagDataLen;
     }
   } else {
@@ -1714,7 +1720,7 @@ static int32_t mnodeProcessDropChildTableMsg(SMnodeMsg *pMsg) {
     return TSDB_CODE_MND_OUT_OF_MEMORY;
   }
 
-  strcpy(pDrop->tableId, pTable->info.tableId);
+  tstrncpy(pDrop->tableId, pTable->info.tableId, TSDB_TABLE_ID_LEN);
   pDrop->vgId    = htonl(pTable->vgId);
   pDrop->contLen = htonl(sizeof(SMDDropTableMsg));
   pDrop->sid     = htonl(pTable->sid);
@@ -1873,7 +1879,7 @@ static int32_t mnodeDoGetChildTableMeta(SMnodeMsg *pMsg, STableMetaMsg *pMeta) {
   pMeta->sid       = htonl(pTable->sid);
   pMeta->precision = pDb->cfg.precision;
   pMeta->tableType = pTable->info.type;
-  strncpy(pMeta->tableId, pTable->info.tableId, strlen(pTable->info.tableId));
+  tstrncpy(pMeta->tableId, pTable->info.tableId, TSDB_TABLE_ID_LEN);
 
   if (pTable->info.type == TSDB_CHILD_TABLE) {
     pMeta->sversion     = htons(pTable->superTable->sversion);
@@ -1916,7 +1922,7 @@ static int32_t mnodeAutoCreateChildTable(SMnodeMsg *pMsg) {
   SCMTableInfoMsg *pInfo = pMsg->rpcMsg.pCont;
   STagData *pTag = (STagData *)pInfo->tags;
 
-  int32_t contLen = sizeof(SCMCreateTableMsg) + offsetof(STagData, data) + ntohl(pTag->dataLen);
+  int32_t contLen = sizeof(SCMCreateTableMsg) + offsetof(STagData, data) + htonl(pTag->dataLen);
   SCMCreateTableMsg *pCreateMsg = rpcMallocCont(contLen);
   if (pCreateMsg == NULL) {
     mError("app:%p:%p, table:%s, failed to create table while get meta info, no enough memory", pMsg->rpcMsg.ahandle,
@@ -2380,8 +2386,7 @@ static int32_t mnodeProcessAlterTableMsg(SMnodeMsg *pMsg) {
 
   if (pMsg->pTable == NULL) pMsg->pTable = mnodeGetTable(pAlter->tableId);
   if (pMsg->pTable == NULL) {
-    mError("app:%p:%p, table:%s, failed to alter table, table not exist", pMsg->rpcMsg.ahandle, pMsg,
-           pMsg->pTable->tableId);
+    mError("app:%p:%p, table:%s, failed to alter table, table not exist", pMsg->rpcMsg.ahandle, pMsg, pAlter->tableId);
     return TSDB_CODE_MND_INVALID_TABLE_NAME;
   }
 

src/mnode/src/mnodeUser.c

@@ -216,7 +216,7 @@ int32_t mnodeCreateUser(SAcctObj *pAcct, char *name, char *pass, void *pMsg) {
   }
 
   pUser = calloc(1, sizeof(SUserObj));
-  strcpy(pUser->user, name);
+  tstrncpy(pUser->user, name, TSDB_USER_LEN);
   taosEncryptPass((uint8_t*) pass, strlen(pass), pUser->pass);
   strcpy(pUser->acct, pAcct->user);
   pUser->createdTime = taosGetTimestampMs();
@@ -368,7 +368,7 @@ SUserObj *mnodeGetUserFromConn(void *pConn) {
 
 char *mnodeGetUserFromMsg(void *pMsg) {
   SMnodeMsg *pMnodeMsg = pMsg;
-  if (pMnodeMsg != NULL &&pMnodeMsg->pUser != NULL) {
+  if (pMnodeMsg != NULL && pMnodeMsg->pUser != NULL) {
     return pMnodeMsg->pUser->user;
   } else {
     return "system";

src/mnode/src/mnodeVgroup.c

@@ -133,7 +133,7 @@ static void mnodeVgroupUpdateIdPool(SVgObj *pVgroup) {
       taosUpdateIdPool(pVgroup->idPool, pDb->cfg.maxTables);
       int32_t size = sizeof(SChildTableObj *) * pDb->cfg.maxTables;
       pVgroup->tableList = (SChildTableObj **)realloc(pVgroup->tableList, size);
-      memset(pVgroup->tableList + oldTables, 0, (pDb->cfg.maxTables - oldTables) * sizeof(SChildTableObj **));
+      memset(pVgroup->tableList + oldTables, 0, (pDb->cfg.maxTables - oldTables) * sizeof(SChildTableObj *));
     }
   }
 }
@@ -252,7 +252,9 @@ void mnodeUpdateVgroup(SVgObj *pVgroup) {
     .pObj = pVgroup
   };
 
-  sdbUpdateRow(&oper);
+  if (sdbUpdateRow(&oper) != TSDB_CODE_SUCCESS) {
+    mError("vgId:%d, failed to update vgroup", pVgroup->vgId);
+  }
   mnodeSendCreateVgroupMsg(pVgroup, NULL);
 }
 
@@ -323,8 +325,10 @@ static int32_t mnodeCreateVgroupCb(SMnodeMsg *pMsg, int32_t code) {
 }
 
 int32_t mnodeCreateVgroup(SMnodeMsg *pMsg, SDbObj *pDb) {
+  if (pMsg == NULL) return TSDB_CODE_MND_APP_ERROR;
+
   SVgObj *pVgroup = (SVgObj *)calloc(1, sizeof(SVgObj));
-  strcpy(pVgroup->dbName, pDb->name);
+  tstrncpy(pVgroup->dbName, pDb->name, TSDB_DB_NAME_LEN);
   pVgroup->numOfVnodes = pDb->cfg.replications;
   pVgroup->createdTime = taosGetTimestampMs();
   pVgroup->accessState = TSDB_VN_ALL_ACCCESS;
@@ -350,7 +354,7 @@ int32_t mnodeCreateVgroup(SMnodeMsg *pMsg, SDbObj *pDb) {
     pMsg->pVgroup = NULL;
     tfree(pVgroup);
   } else {
-    if (pMsg != NULL) code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
+    code = TSDB_CODE_MND_ACTION_IN_PROGRESS;
   }
 
   return code;