fix(query): fix the invalid write.

source/libs/scalar/src/sclfunc.c

@@ -711,7 +711,7 @@ int32_t castFunction(SScalarParam *pInput, int32_t inputNum, SScalarParam *pOutp
 
   int32_t code = TSDB_CODE_SUCCESS;
   char *  convBuf = taosMemoryMalloc(inputLen);
-  char *  output = taosMemoryCalloc(1, outputLen);
+  char *  output = taosMemoryCalloc(1, outputLen + TSDB_NCHAR_SIZE);
   char    buf[400] = {0};
 
   if (convBuf == NULL || output == NULL) {
@@ -947,11 +947,12 @@ int32_t castFunction(SScalarParam *pInput, int32_t inputNum, SScalarParam *pOutp
       }
       case TSDB_DATA_TYPE_BINARY: {
         if (inputType == TSDB_DATA_TYPE_BOOL) {
+          // NOTE: sprintf will append '\0' at the end of string
           int32_t len = sprintf(varDataVal(output), "%.*s", (int32_t)(outputLen - VARSTR_HEADER_SIZE), *(int8_t *)input ? "true" : "false");
           varDataSetLen(output, len);
         } else if (inputType == TSDB_DATA_TYPE_BINARY) {
           int32_t len = TMIN(varDataLen(input), outputLen - VARSTR_HEADER_SIZE);
-          len = sprintf(varDataVal(output), "%.*s", len, varDataVal(input));
+          memcpy(varDataVal(output), varDataVal(input), len);
           varDataSetLen(output, len);
         } else if (inputType == TSDB_DATA_TYPE_NCHAR) {
           int32_t len = taosUcs4ToMbs((TdUcs4 *)varDataVal(input), varDataLen(input), convBuf);