From 187735dede3d9d01028032836b444223e2bb2d66 Mon Sep 17 00:00:00 2001 From: Haojun Liao Date: Tue, 11 Oct 2022 10:49:19 +0800 Subject: [PATCH] fix(query): fix the invalid write. --- source/libs/scalar/src/sclfunc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/source/libs/scalar/src/sclfunc.c b/source/libs/scalar/src/sclfunc.c index 7279307d5f..6060f8cd92 100644 --- a/source/libs/scalar/src/sclfunc.c +++ b/source/libs/scalar/src/sclfunc.c @@ -711,7 +711,7 @@ int32_t castFunction(SScalarParam *pInput, int32_t inputNum, SScalarParam *pOutp int32_t code = TSDB_CODE_SUCCESS; char * convBuf = taosMemoryMalloc(inputLen); - char * output = taosMemoryCalloc(1, outputLen); + char * output = taosMemoryCalloc(1, outputLen + TSDB_NCHAR_SIZE); char buf[400] = {0}; if (convBuf == NULL || output == NULL) { @@ -947,11 +947,12 @@ int32_t castFunction(SScalarParam *pInput, int32_t inputNum, SScalarParam *pOutp } case TSDB_DATA_TYPE_BINARY: { if (inputType == TSDB_DATA_TYPE_BOOL) { + // NOTE: sprintf will append '\0' at the end of string int32_t len = sprintf(varDataVal(output), "%.*s", (int32_t)(outputLen - VARSTR_HEADER_SIZE), *(int8_t *)input ? "true" : "false"); varDataSetLen(output, len); } else if (inputType == TSDB_DATA_TYPE_BINARY) { int32_t len = TMIN(varDataLen(input), outputLen - VARSTR_HEADER_SIZE); - len = sprintf(varDataVal(output), "%.*s", len, varDataVal(input)); + memcpy(varDataVal(output), varDataVal(input), len); varDataSetLen(output, len); } else if (inputType == TSDB_DATA_TYPE_NCHAR) { int32_t len = taosUcs4ToMbs((TdUcs4 *)varDataVal(input), varDataLen(input), convBuf); -- GitLab