Merge pull request #19861 from taosdata/feat/3.0_wxy

fix: invild free

source/libs/executor/src/dataDeleter.c

@@ -62,8 +62,8 @@ static void toDataCacheEntry(SDataDeleterHandle* pHandle, const SInputData* pInp
   pEntry->numOfCols = taosArrayGetSize(pInput->pData->pDataBlock);
   pEntry->dataLen = sizeof(SDeleterRes);
 
-//  ASSERT(1 == pEntry->numOfRows);
-//  ASSERT(3 == pEntry->numOfCols);
+  //  ASSERT(1 == pEntry->numOfRows);
+  //  ASSERT(3 == pEntry->numOfCols);
 
   pBuf->useSize = sizeof(SDataCacheEntry);
 
@@ -142,7 +142,7 @@ static int32_t putDataBlock(SDataSinkHandle* pHandle, const SInputData* pInput,
     taosFreeQitem(pBuf);
     return TSDB_CODE_OUT_OF_MEMORY;
   }
-  
+
   toDataCacheEntry(pDeleter, pInput, pBuf);
   taosWriteQitem(pDeleter->pDataBlocks, pBuf);
   *pContinue = (DS_BUF_LOW == updateStatus(pDeleter) ? true : false);
@@ -167,8 +167,10 @@ static void getDataLength(SDataSinkHandle* pHandle, int64_t* pLen, bool* pQueryE
 
   SDataDeleterBuf* pBuf = NULL;
   taosReadQitem(pDeleter->pDataBlocks, (void**)&pBuf);
-  memcpy(&pDeleter->nextOutput, pBuf, sizeof(SDataDeleterBuf));
-  taosFreeQitem(pBuf);
+  if (pBuf != NULL) {
+    memcpy(&pDeleter->nextOutput, pBuf, sizeof(SDataDeleterBuf));
+    taosFreeQitem(pBuf);
+  }
 
   SDataCacheEntry* pEntry = (SDataCacheEntry*)pDeleter->nextOutput.pData;
   *pLen = pEntry->dataLen;
@@ -256,7 +258,7 @@ int32_t createDataDeleter(SDataSinkManager* pManager, const SDataSinkNode* pData
   deleter->pDeleter = pDeleterNode;
   deleter->pSchema = pDataSink->pInputDataBlockDesc;
 
-  if(pParam == NULL) {
+  if (pParam == NULL) {
     code = TSDB_CODE_QRY_INVALID_INPUT;
     qError("invalid input param in creating data deleter, code%s", tstrerror(code));
     goto _end;
@@ -275,7 +277,7 @@ int32_t createDataDeleter(SDataSinkManager* pManager, const SDataSinkNode* pData
   *pHandle = deleter;
   return code;
 
-  _end:
+_end:
   if (deleter != NULL) {
     destroyDataSinker((SDataSinkHandle*)deleter);
     taosMemoryFree(deleter);

source/libs/parser/src/parTranslater.c

@@ -3517,7 +3517,7 @@ static int32_t translateSetOperProject(STranslateContext* pCxt, SSetOperator* pS
     if (comp > 0) {
       SNode*  pRightFunc = NULL;
       int32_t code = createCastFunc(pCxt, pRight, pLeftExpr->resType, &pRightFunc);
-      if (TSDB_CODE_SUCCESS != code || NULL == pRightFunc) { // deal scan coverity
+      if (TSDB_CODE_SUCCESS != code || NULL == pRightFunc) {  // deal scan coverity
         return code;
       }
       REPLACE_LIST2_NODE(pRightFunc);
@@ -3525,7 +3525,7 @@ static int32_t translateSetOperProject(STranslateContext* pCxt, SSetOperator* pS
     } else if (comp < 0) {
       SNode*  pLeftFunc = NULL;
       int32_t code = createCastFunc(pCxt, pLeft, pRightExpr->resType, &pLeftFunc);
-      if (TSDB_CODE_SUCCESS != code || NULL == pLeftFunc) { // deal scan coverity
+      if (TSDB_CODE_SUCCESS != code || NULL == pLeftFunc) {  // deal scan coverity
         return code;
       }
       REPLACE_LIST1_NODE(pLeftFunc);
@@ -5809,7 +5809,7 @@ static int32_t projColPosCompar(const void* l, const void* r) {
   return ((SProjColPos*)l)->colId > ((SProjColPos*)r)->colId;
 }
 
-static void projColPosDelete(void* p) { taosMemoryFree(((SProjColPos*)p)->pProj); }
+static void projColPosDelete(void* p) { nodesDestroyNode(((SProjColPos*)p)->pProj); }
 
 static int32_t addProjToProjColPos(STranslateContext* pCxt, const SSchema* pSchema, SNode* pProj, SArray* pProjColPos) {
   SNode* pNewProj = nodesCloneNode(pProj);