From d5e0bfc42eeb3d8ad7595bc7e0d2a2498304fa0b Mon Sep 17 00:00:00 2001
From: Haojun Liao <hjliao@taosdata.com>
Date: Tue, 14 Jul 2020 22:58:37 +0800
Subject: [PATCH] [td-225] fix invalid write in tbname query

---
 src/query/src/qast.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/query/src/qast.c b/src/query/src/qast.c
index ffd339f111..03504a4244 100644
--- a/src/query/src/qast.c
+++ b/src/query/src/qast.c
@@ -1062,10 +1062,9 @@ tExprNode* exprTreeFromTableName(const char* tbnameCond) {
       if (*e == TS_PATH_DELIMITER[0]) {
         cond = e + 1;
       } else if (*e == ',') {
-        size_t len = e - cond + VARSTR_HEADER_SIZE;
-        char* p = exception_malloc(len);
-        varDataSetLen(p, len - VARSTR_HEADER_SIZE);
-        memcpy(varDataVal(p), cond, len);
+        size_t len = e - cond;
+        char* p = exception_malloc(len + VARSTR_HEADER_SIZE);
+        STR_WITH_SIZE_TO_VARSTR(p, cond, len);
         cond += len;
         taosArrayPush(pVal->arr, &p);
       }
-- 
GitLab