Merge pull request #10431 from taosdata/feature/ZhiqiangWang/config

invalid read

source/libs/transport/src/transCli.c

@@ -127,7 +127,7 @@ static void clientHandleResp(SCliConn* conn) {
   // buf's mem alread translated to rpcMsg.pCont
   transClearBuffer(&conn->readBuf);
 
-  SRpcMsg rpcMsg;
+  SRpcMsg rpcMsg = {0};
   rpcMsg.contLen = transContLenFromMsg(pHead->msgLen);
   rpcMsg.pCont = transContFromHead((char*)pHead);
   rpcMsg.code = pHead->code;

source/util/src/tconfig.c

@@ -96,6 +96,7 @@ void cfgCleanup(SConfig *pCfg) {
       SConfigItem *pItem = taosHashIterate(pCfg->hash, NULL);
       while (pItem != NULL) {
         cfgFreeItem(pItem);
+        tfree(pItem->name);
         pItem = taosHashIterate(pCfg->hash, pItem);
       }
       taosHashCleanup(pCfg->hash);
@@ -249,9 +250,7 @@ static int32_t cfgSetString(SConfigItem *pItem, const char *value, ECfgSrcType s
 }
 
 static int32_t cfgSetDir(SConfigItem *pItem, const char *value, ECfgSrcType stype) {
-  char *tmp = strdup(value);
-  if (tmp == NULL || cfgCheckAndSetDir(pItem, value) != 0) {
-    free(tmp);
+  if (cfgCheckAndSetDir(pItem, value) != 0) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     uError("cfg:%s, type:%s src:%s value:%s failed to dup since %s, use last src:%s value:%s", pItem->name,
            cfgDtypeStr(pItem->dtype), cfgStypeStr(stype), value, terrstr(), cfgStypeStr(pItem->stype), pItem->str);
@@ -263,9 +262,7 @@ static int32_t cfgSetDir(SConfigItem *pItem, const char *value, ECfgSrcType styp
 }
 
 static int32_t cfgSetLocale(SConfigItem *pItem, const char *value, ECfgSrcType stype) {
-  char *tmp = strdup(value);
-  if (tmp == NULL || cfgCheckAndSetLocale(pItem, value) != 0) {
-    free(tmp);
+  if (cfgCheckAndSetLocale(pItem, value) != 0) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     uError("cfg:%s, type:%s src:%s value:%s failed to dup since %s, use last src:%s value:%s", pItem->name,
            cfgDtypeStr(pItem->dtype), cfgStypeStr(stype), value, terrstr(), cfgStypeStr(pItem->stype), pItem->str);
@@ -277,9 +274,7 @@ static int32_t cfgSetLocale(SConfigItem *pItem, const char *value, ECfgSrcType s
 }
 
 static int32_t cfgSetCharset(SConfigItem *pItem, const char *value, ECfgSrcType stype) {
-  char *tmp = strdup(value);
-  if (tmp == NULL || cfgCheckAndSetCharset(pItem, value) != 0) {
-    free(tmp);
+  if (cfgCheckAndSetCharset(pItem, value) != 0) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     uError("cfg:%s, type:%s src:%s value:%s failed to dup since %s, use last src:%s value:%s", pItem->name,
            cfgDtypeStr(pItem->dtype), cfgStypeStr(stype), value, terrstr(), cfgStypeStr(pItem->stype), pItem->str);
@@ -291,9 +286,7 @@ static int32_t cfgSetCharset(SConfigItem *pItem, const char *value, ECfgSrcType
 }
 
 static int32_t cfgSetTimezone(SConfigItem *pItem, const char *value, ECfgSrcType stype) {
-  char *tmp = strdup(value);
-  if (tmp == NULL || cfgCheckAndSetTimezone(pItem, value) != 0) {
-    free(tmp);
+  if (cfgCheckAndSetTimezone(pItem, value) != 0) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     uError("cfg:%s, type:%s src:%s value:%s failed to dup since %s, use last src:%s value:%s", pItem->name,
            cfgDtypeStr(pItem->dtype), cfgStypeStr(stype), value, terrstr(), cfgStypeStr(pItem->stype), pItem->str);
@@ -366,11 +359,11 @@ int32_t cfgSetItem(SConfig *pCfg, const char *name, const char *value, ECfgSrcTy
 }
 
 SConfigItem *cfgGetItem(SConfig *pCfg, const char *name) {
+  int32_t len = strlen(name);
   char    lowcaseName[CFG_NAME_MAX_LEN + 1] = {0};
-  memcpy(lowcaseName, name, CFG_NAME_MAX_LEN);
-  strntolower(lowcaseName, name, CFG_NAME_MAX_LEN);
+  strntolower(lowcaseName, name, TMIN(CFG_NAME_MAX_LEN, len));
 
-  SConfigItem *pItem = taosHashGet(pCfg->hash, lowcaseName, strlen(lowcaseName) + 1);
+  SConfigItem *pItem = taosHashGet(pCfg->hash, lowcaseName, len + 1);
   if (pItem == NULL) {
     terrno = TSDB_CODE_CFG_NOT_FOUND;
   }
@@ -386,11 +379,11 @@ static int32_t cfgAddItem(SConfig *pCfg, SConfigItem *pItem, const char *name) {
     return -1;
   }
 
+  int32_t len = strlen(name);
   char    lowcaseName[CFG_NAME_MAX_LEN + 1] = {0};
-  memcpy(lowcaseName, name, CFG_NAME_MAX_LEN);
-  strntolower(lowcaseName, name, CFG_NAME_MAX_LEN);
+  strntolower(lowcaseName, name, TMIN(CFG_NAME_MAX_LEN, len));
 
-  if (taosHashPut(pCfg->hash, lowcaseName, strlen(lowcaseName) + 1, pItem, sizeof(SConfigItem)) != 0) {
+  if (taosHashPut(pCfg->hash, lowcaseName, len + 1, pItem, sizeof(SConfigItem)) != 0) {
     if (pItem->dtype == CFG_DTYPE_STRING) {
       free(pItem->str);
     }

source/util/src/tlog.c

@@ -64,16 +64,17 @@ typedef struct {
   pthread_mutex_t logMutex;
 } SLogObj;
 
-int8_t tscEmbeddedInUtil = 0;
+static int8_t  tsLogInited = 0;
+static SLogObj tsLogObj = {.fileNum = 1};
 
+int8_t  tscEmbeddedInUtil = 0;
 int32_t tsLogKeepDays = 0;
 bool    tsAsyncLog = true;
-int8_t  tsLogInited = 0;
-int64_t asyncLogLostLines = 0;
-int32_t writeInterval = LOG_DEFAULT_INTERVAL;
+int32_t tsNumOfLogLines = 10000000;
+int64_t tsAsyncLogLostLines = 0;
+int32_t tsWriteInterval = LOG_DEFAULT_INTERVAL;
 
 // log
-int32_t tsNumOfLogLines = 10000000;
 int32_t dDebugFlag = 135;
 int32_t vDebugFlag = 135;
 int32_t mDebugFlag = 131;
@@ -95,13 +96,11 @@ int64_t dbgSmallWN = 0;
 int64_t dbgBigWN = 0;
 int64_t dbgWSize = 0;
 
-static SLogObj   tsLogObj = {.fileNum = 1};
 static void     *taosAsyncOutputLog(void *param);
 static int32_t   taosPushLogBuffer(SLogBuff *tLogBuff, char *msg, int32_t msgLen);
 static SLogBuff *taosLogBuffNew(int32_t bufSize);
 static void      taosCloseLogByFd(TdFilePtr pFile);
 static int32_t   taosOpenLogFile(char *fn, int32_t maxLines, int32_t maxFileNum);
-extern void      taosPrintCfg();
 static int32_t   taosCompressFile(char *srcFileName, char *destFileName);
 
 static int32_t taosStartLog() {
@@ -125,7 +124,6 @@ int32_t taosInitLog(const char *logName, int maxFiles) {
   if (tsLogObj.logHandle == NULL) return -1;
   if (taosOpenLogFile(fullName, tsNumOfLogLines, maxFiles) < 0) return -1;
   if (taosStartLog() < 0) return -1;
-  tsLogInited = true;
   return 0;
 }
 
@@ -137,8 +135,6 @@ static void taosStopLog() {
 
 void taosCloseLog() {
   taosStopLog();
-  // tsem_post(&(tsLogObj.logHandle->buffNotEmpty));
-  taosMsleep(LOG_MAX_INTERVAL / 1000);
   if (taosCheckPthreadValid(tsLogObj.logHandle->asyncThread)) {
     pthread_join(tsLogObj.logHandle->asyncThread, NULL);
   }
@@ -218,7 +214,6 @@ static void *taosThreadToOpenNewFile(void *param) {
 
   uInfo("   new log file:%d is opened", tsLogObj.flag);
   uInfo("==================================");
-  // taosPrintCfg();
   taosKeepOldLog(keepName);
 
   return NULL;
@@ -498,12 +493,6 @@ void taosPrintLongString(const char *flags, int32_t dflag, const char *format, .
   if (dflag & DEBUG_SCREEN) write(1, buffer, (uint32_t)len);
 }
 
-#if 0
-void taosCloseLog() { 
-  taosCloseLogByFd(tsLogObj.logHandle->pFile); 
-}
-#endif
-
 static void taosCloseLogByFd(TdFilePtr pFile) {
   if (pFile != NULL) {
     taosUnLockLogFile(pFile);
@@ -536,15 +525,6 @@ _err:
   return NULL;
 }
 
-#if 0
-static void taosLogBuffDestroy(SLogBuff *tLogBuff) {
-  tsem_destroy(&(tLogBuff->buffNotEmpty));
-  pthread_mutex_destroy(&(tLogBuff->buffMutex));
-  free(tLogBuff->buffer);
-  tfree(tLogBuff);
-}
-#endif
-
 static void taosCopyLogBuffer(SLogBuff *tLogBuff, int32_t start, int32_t end, char *msg, int32_t msgLen) {
   if (start > end) {
     memcpy(LOG_BUF_BUFFER(tLogBuff) + end, msg, msgLen);
@@ -582,7 +562,7 @@ static int32_t taosPushLogBuffer(SLogBuff *tLogBuff, char *msg, int32_t msgLen)
 
   if (remainSize <= msgLen || ((lostLine > 0) && (remainSize <= (msgLen + tmpBufLen)))) {
     lostLine++;
-    asyncLogLostLines++;
+    tsAsyncLogLostLines++;
     pthread_mutex_unlock(&LOG_BUF_MUTEX(tLogBuff));
     return -1;
   }
@@ -627,13 +607,13 @@ static void taosWriteLog(SLogBuff *tLogBuff) {
 
       if (start == end) {
         dbgEmptyW++;
-        writeInterval = LOG_MAX_INTERVAL;
+        tsWriteInterval = LOG_MAX_INTERVAL;
         return;
       }
 
       pollSize = taosGetLogRemainSize(tLogBuff, start, end);
       if (pollSize < tLogBuff->minBuffSize) {
-        lastDuration += writeInterval;
+        lastDuration += tsWriteInterval;
         if (lastDuration < LOG_MAX_WAIT_MSEC) {
           break;
         }
@@ -656,15 +636,15 @@ static void taosWriteLog(SLogBuff *tLogBuff) {
 
     if (pollSize < tLogBuff->minBuffSize) {
       dbgSmallWN++;
-      if (writeInterval < LOG_MAX_INTERVAL) {
-        writeInterval += LOG_INTERVAL_STEP;
+      if (tsWriteInterval < LOG_MAX_INTERVAL) {
+        tsWriteInterval += LOG_INTERVAL_STEP;
       }
     } else if (pollSize > LOG_BUF_SIZE(tLogBuff) / 3) {
       dbgBigWN++;
-      writeInterval = LOG_MIN_INTERVAL;
+      tsWriteInterval = LOG_MIN_INTERVAL;
     } else if (pollSize > LOG_BUF_SIZE(tLogBuff) / 4) {
-      if (writeInterval > LOG_MIN_INTERVAL) {
-        writeInterval -= LOG_INTERVAL_STEP;
+      if (tsWriteInterval > LOG_MIN_INTERVAL) {
+        tsWriteInterval -= LOG_INTERVAL_STEP;
       }
     }
 
@@ -678,7 +658,7 @@ static void taosWriteLog(SLogBuff *tLogBuff) {
       break;
     }
 
-    writeInterval = LOG_MIN_INTERVAL;
+    tsWriteInterval = LOG_MIN_INTERVAL;
 
     remainChecked = 1;
   } while (1);
@@ -689,7 +669,7 @@ static void *taosAsyncOutputLog(void *param) {
   setThreadName("log");
 
   while (1) {
-    taosMsleep(writeInterval);
+    taosMsleep(tsWriteInterval);
 
     // Polling the buffer
     taosWriteLog(tLogBuff);