Merge pull request #2498 from taosdata/hotfix/invalidWrite

check the application message length before passing it to server

src/rpc/src/rpcMain.c

@@ -1034,15 +1034,20 @@ static void rpcProcessIncomingMsg(SRpcConn *pConn, SRpcHead *pHead) {
   rpcMsg.ahandle = pConn->ahandle;
    
   if ( rpcIsReq(pHead->msgType) ) {
-    rpcMsg.handle = pConn;
-    rpcAddRef(pRpc);  // add the refCount for requests
+    if (rpcMsg.contLen > 0) {
+      rpcMsg.handle = pConn;
+      rpcAddRef(pRpc);  // add the refCount for requests
 
-    // start the progress timer to monitor the response from server app
-    if (pConn->connType != RPC_CONN_TCPS) 
-      pConn->pTimer = taosTmrStart(rpcProcessProgressTimer, tsProgressTimer, pConn, pRpc->tmrCtrl);
+      // start the progress timer to monitor the response from server app
+      if (pConn->connType != RPC_CONN_TCPS) 
+        pConn->pTimer = taosTmrStart(rpcProcessProgressTimer, tsProgressTimer, pConn, pRpc->tmrCtrl);
  
-    // notify the server app
-    (*(pRpc->cfp))(&rpcMsg, NULL);
+      // notify the server app
+      (*(pRpc->cfp))(&rpcMsg, NULL);
+    } else {
+      tDebug("%s, message body is empty, ignore", pConn->info);
+      rpcFreeCont(rpcMsg.pCont);
+    }
   } else {
     // it's a response
     SRpcReqContext *pContext = pConn->pContext;