From 4706b400d089065663d837ca30dc5eeaaaedf93b Mon Sep 17 00:00:00 2001
From: Haojun Liao <hjliao@taosdata.com>
Date: Sat, 8 Aug 2020 14:18:58 +0800
Subject: [PATCH] [td-225] fix invalid read.

---
 src/query/inc/qAst.h    |  2 +-
 src/query/src/qAst.c    | 26 ++++++++++++++++----------
 src/tsdb/src/tsdbRead.c |  2 +-
 3 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/src/query/inc/qAst.h b/src/query/inc/qAst.h
index 01b4c16ac1..ec568a6cdb 100644
--- a/src/query/inc/qAst.h
+++ b/src/query/inc/qAst.h
@@ -48,7 +48,7 @@ typedef struct tQueryInfo {
   SSchema       sch;      // schema of tags
   char*         q;
   __compar_fn_t compare;  // filter function
-  void*         param;    // STSchema
+  bool          indexed;  // indexed columns
 } tQueryInfo;
 
 typedef struct SExprTraverseSupp {
diff --git a/src/query/src/qAst.c b/src/query/src/qAst.c
index 05df8d95ba..6d9e5856e2 100644
--- a/src/query/src/qAst.c
+++ b/src/query/src/qAst.c
@@ -427,8 +427,9 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
         if (ret != 0) {
           break;
         }
-        
-        taosArrayPush(result, SL_GET_NODE_DATA(pNode));
+
+        STableKeyInfo info = {.pTable = *(void**)SL_GET_NODE_DATA(pNode), .lastKey = TSKEY_INITIAL_VAL};
+        taosArrayPush(result, &info);
       }
     } else if (optr == TSDB_RELATION_GREATER || optr == TSDB_RELATION_GREATER_EQUAL) { // greater equal
       bool comp = true;
@@ -445,7 +446,8 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
         if (ret == 0 && optr == TSDB_RELATION_GREATER) {
           continue;
         } else {
-          taosArrayPush(result, SL_GET_NODE_DATA(pNode));
+          STableKeyInfo info = {.pTable = *(void**)SL_GET_NODE_DATA(pNode), .lastKey = TSKEY_INITIAL_VAL};
+          taosArrayPush(result, &info);
           comp = false;
         }
       }
@@ -458,8 +460,9 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
         if (comp) {
           continue;
         }
-        
-        taosArrayPush(result, SL_GET_NODE_DATA(pNode));
+
+        STableKeyInfo info = {.pTable = *(void**)SL_GET_NODE_DATA(pNode), .lastKey = TSKEY_INITIAL_VAL};
+        taosArrayPush(result, &info);
       }
       
       tSkipListDestroyIter(iter);
@@ -472,8 +475,9 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
         if (comp) {
           continue;
         }
-  
-        taosArrayPush(result, SL_GET_NODE_DATA(pNode));
+
+        STableKeyInfo info = {.pTable = *(void**)SL_GET_NODE_DATA(pNode), .lastKey = TSKEY_INITIAL_VAL};
+        taosArrayPush(result, &info);
       }
   
     } else {
@@ -496,12 +500,14 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
         if (ret == 0 && optr == TSDB_RELATION_LESS) {
           continue;
         } else {
-          taosArrayPush(result, SL_GET_NODE_DATA(pNode));
+          STableKeyInfo info = {.pTable = *(void**)SL_GET_NODE_DATA(pNode), .lastKey = TSKEY_INITIAL_VAL};
+          taosArrayPush(result, &info);
           comp = false;  // no need to compare anymore
         }
       }
     }
   }
+
   free(cond.start); 
   free(cond.end);
   tSkipListDestroyIter(iter);
@@ -689,7 +695,7 @@ static void tQueryIndexlessColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo,
     }
 
     if (addToResult) {
-      STableKeyInfo info = {.pTable = *(void**)pData, .lastKey = -1};
+      STableKeyInfo info = {.pTable = *(void**)pData, .lastKey = TSKEY_INITIAL_VAL};
       taosArrayPush(res, &info);
     }
   }
@@ -717,7 +723,7 @@ void tExprTreeTraverse(tExprNode *pExpr, SSkipList *pSkipList, SArray *result, S
     }
 
     tQueryInfo *pQueryInfo = pExpr->_node.info;
-    if (pQueryInfo->sch.colId == PRIMARYKEY_TIMESTAMP_COL_INDEX && pQueryInfo->optr != TSDB_RELATION_LIKE) {
+    if (pQueryInfo->indexed && pQueryInfo->optr != TSDB_RELATION_LIKE) {
       tQueryIndexColumn(pSkipList, pQueryInfo, result);
     } else {
       tQueryIndexlessColumn(pSkipList, pQueryInfo, result, param->nodeFilterFn);
diff --git a/src/tsdb/src/tsdbRead.c b/src/tsdb/src/tsdbRead.c
index b086451dd1..e06bced896 100644
--- a/src/tsdb/src/tsdbRead.c
+++ b/src/tsdb/src/tsdbRead.c
@@ -2102,7 +2102,7 @@ void filterPrepare(void* expr, void* param) {
   pInfo->sch      = *pSchema;
   pInfo->optr     = pExpr->_node.optr;
   pInfo->compare  = getComparFunc(pSchema->type, pInfo->optr);
-  pInfo->param    = pTSSchema;
+  pInfo->indexed  = pTSSchema->columns->colId == pInfo->sch.colId;
 
   if (pInfo->optr == TSDB_RELATION_IN) {
     pInfo->q = (char*) pCond->arr;
-- 
GitLab