From 17f953da67b29e4c3d42068bc75316d4f8a86edc Mon Sep 17 00:00:00 2001
From: xywang <xywang@taosdata.com>
Date: Wed, 1 Dec 2021 13:38:48 +0800
Subject: [PATCH] [TS-715]<fix>: fixed coredump caused by result column id
 underflow

---
 src/client/src/tscServer.c         |  6 +++++-
 src/inc/taoserror.h                |  1 +
 src/util/src/terror.c              |  7 ++++---
 tests/pytest/query/unionAllTest.py | 25 ++++++++++++++++++++++++-
 4 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/src/client/src/tscServer.c b/src/client/src/tscServer.c
index 4d4667e135..64be120aee 100644
--- a/src/client/src/tscServer.c
+++ b/src/client/src/tscServer.c
@@ -980,7 +980,11 @@ static int32_t serializeSqlExpr(SSqlExpr* pExpr, STableMetaInfo* pTableMetaInfo,
     return TSDB_CODE_TSC_INVALID_OPERATION;
   }
 
-  assert(pExpr->resColId < 0);
+  if (pExpr->resColId >= 0) {
+    tscError("result column id underflowed: %d", pExpr->resColId);
+    return TSDB_CODE_TSC_RES_TOO_MANY;
+  }
+
   SSqlExpr* pSqlExpr = (SSqlExpr *)(*pMsg);
 
   SColIndex* pIndex = &pSqlExpr->colInfo;
diff --git a/src/inc/taoserror.h b/src/inc/taoserror.h
index 000703464c..4bf4c78491 100644
--- a/src/inc/taoserror.h
+++ b/src/inc/taoserror.h
@@ -106,6 +106,7 @@ int32_t* taosGetErrno();
 #define TSDB_CODE_TSC_DUP_COL_NAMES             TAOS_DEF_ERROR_CODE(0, 0x021D)  //"duplicated column names")
 #define TSDB_CODE_TSC_INVALID_TAG_LENGTH        TAOS_DEF_ERROR_CODE(0, 0x021E)  //"Invalid tag length")
 #define TSDB_CODE_TSC_INVALID_COLUMN_LENGTH     TAOS_DEF_ERROR_CODE(0, 0x021F)  //"Invalid column length")
+#define TSDB_CODE_TSC_RES_TOO_MANY              TAOS_DEF_ERROR_CODE(0, 0x0227)  //"Result set too large to be output")
 
 // mnode
 #define TSDB_CODE_MND_MSG_NOT_PROCESSED         TAOS_DEF_ERROR_CODE(0, 0x0300)  //"Message not processed")
diff --git a/src/util/src/terror.c b/src/util/src/terror.c
index 0b9a76004b..d1ecc2188b 100644
--- a/src/util/src/terror.c
+++ b/src/util/src/terror.c
@@ -112,9 +112,10 @@ TAOS_DEFINE_ERROR(TSDB_CODE_TSC_EXCEED_SQL_LIMIT,         "SQL statement too lon
 TAOS_DEFINE_ERROR(TSDB_CODE_TSC_FILE_EMPTY,               "File is empty")
 TAOS_DEFINE_ERROR(TSDB_CODE_TSC_LINE_SYNTAX_ERROR,        "Syntax error in Line")
 TAOS_DEFINE_ERROR(TSDB_CODE_TSC_NO_META_CACHED,           "No table meta cached")
-TAOS_DEFINE_ERROR(TSDB_CODE_TSC_DUP_COL_NAMES,             "duplicated column names")
-TAOS_DEFINE_ERROR(TSDB_CODE_TSC_INVALID_TAG_LENGTH,        "Invalid tag length")
-TAOS_DEFINE_ERROR(TSDB_CODE_TSC_INVALID_COLUMN_LENGTH,     "Invalid column length")
+TAOS_DEFINE_ERROR(TSDB_CODE_TSC_DUP_COL_NAMES,            "duplicated column names")
+TAOS_DEFINE_ERROR(TSDB_CODE_TSC_INVALID_TAG_LENGTH,       "Invalid tag length")
+TAOS_DEFINE_ERROR(TSDB_CODE_TSC_INVALID_COLUMN_LENGTH,    "Invalid column length")
+TAOS_DEFINE_ERROR(TSDB_CODE_TSC_RES_TOO_MANY,             "Result set too large to be output")
 
 // mnode
 TAOS_DEFINE_ERROR(TSDB_CODE_MND_MSG_NOT_PROCESSED,        "Message not processed")
diff --git a/tests/pytest/query/unionAllTest.py b/tests/pytest/query/unionAllTest.py
index d1e1bf4d3e..cfa7fe568f 100644
--- a/tests/pytest/query/unionAllTest.py
+++ b/tests/pytest/query/unionAllTest.py
@@ -103,10 +103,33 @@ class TDTestCase:
                     select count(*) as count, loc from st where ts between 1600000000000 and 1600000000010 group by loc''')
         tdSql.checkRows(6)
 
+        # https://jira.taosdata.com:18080/browse/TS-715
+        tdLog.info("test case for TS-715")
+        sql = ""
+
+        tdSql.execute("create table st2(ts timestamp, c1 int, c2 int, c3 int) tags(loc nchar(20))")
+
+        for i in range(7000):
+            if i == 0:
+                sql = "select last(*) from sub0 "
+            else:
+                sql += f"union all select last(*) from sub{i} "
+
+            tdSql.execute("create table sub%d using st2 tags('nchar%d')" % (i, i))
+            tdSql.execute("insert into sub%d values(%d, %d, %d, %d)" % (i, self.ts + i, i, i, i))
+
+        exception = "Exception(\"ProgrammingError('Result set too large to be output', -2147483097)\")"
+        try:
+            tdSql.query(sql)
+        except Exception as e:
+            if {exception} != {repr(e)}:
+                tdLog.info(f"sql: {sql}, {exception} expected, actually raises {repr(e)}")
+                raise e
+
     def stop(self):
         tdSql.close()
         tdLog.success("%s successfully executed" % __file__)
 
 
 tdCases.addWindows(__file__, TDTestCase())
-tdCases.addLinux(__file__, TDTestCase())
\ No newline at end of file
+tdCases.addLinux(__file__, TDTestCase())
-- 
GitLab