fix tbanme length check

source/dnode/mnode/impl/src/mndConsumer.c

@@ -117,6 +117,7 @@ static int32_t mndProcessConsumerLostMsg(SRpcMsg *pMsg) {
   if (mndTransPrepare(pMnode, pTrans) != 0) goto FAIL;
 
   mndTransDrop(pTrans);
+  tDeleteSMqConsumerObj(pConsumerNew);
   return 0;
 FAIL:
   tDeleteSMqConsumerObj(pConsumerNew);

source/dnode/mnode/impl/src/mndOffset.c

@@ -182,6 +182,11 @@ static int32_t mndProcessCommitOffsetReq(SRpcMsg *pMsg) {
   tDecodeSMqCMCommitOffsetReq(&decoder, &commitOffsetReq);
 
   STrans *pTrans = mndTransCreate(pMnode, TRN_POLICY_ROLLBACK, TRN_CONFLICT_NOTHING, pMsg, "commit-offset");
+  if (pTrans == NULL) {
+    terrno = TSDB_CODE_OUT_OF_MEMORY;
+    tDecoderClear(&decoder);
+    return -1;
+  }
 
   for (int32_t i = 0; i < commitOffsetReq.num; i++) {
     SMqOffset *pOffset = &commitOffsetReq.offsets[i];

source/dnode/mnode/impl/src/mndTopic.c

@@ -222,6 +222,7 @@ SSdbRow *mndTopicActionDecode(SSdbRaw *pRaw) {
     }
     SDB_GET_BINARY(pRaw, dataPos, buf, len, TOPIC_DECODE_OVER);
     if (taosDecodeSSchemaWrapper(buf, &pTopic->schema) == NULL) {
+      taosMemoryFree(buf);
       goto TOPIC_DECODE_OVER;
     }
     taosMemoryFree(buf);

source/dnode/vnode/src/tq/tqMeta.c

@@ -170,6 +170,7 @@ int32_t tqMetaRestoreCheckInfo(STQ* pTq) {
     tDecoderInit(&decoder, (uint8_t*)pVal, vLen);
     if (tDecodeSTqCheckInfo(&decoder, &info) < 0) {
       terrno = TSDB_CODE_OUT_OF_MEMORY;
+      tdbFree(pKey);
       tdbTbcClose(pCur);
       return -1;
     }

source/libs/executor/src/scanoperator.c

@@ -1341,7 +1341,8 @@ static void calBlockTbName(SExprSupp* pTbNameCalSup, SSDataBlock* pBlock) {
   void* pData = colDataGetData(pCol, 0);
   // TODO check tbname validation
   if (pData != (void*)-1 && pData != NULL) {
-    memcpy(pBlock->info.parTbName, varDataVal(pData), varDataLen(pData));
+    memcpy(pBlock->info.parTbName, varDataVal(pData), TMIN(varDataLen(pData), TSDB_TABLE_NAME_LEN));
+    pBlock->info.parTbName[TSDB_TABLE_NAME_LEN - 1] = 0;
   } else {
     pBlock->info.parTbName[0] = 0;
   }

source/libs/wal/src/walMeta.c

@@ -35,8 +35,8 @@ int64_t FORCE_INLINE walGetCommittedVer(SWal* pWal) { return pWal->vers.commitVe
 
 int64_t FORCE_INLINE walGetAppliedVer(SWal* pWal) { return pWal->vers.appliedVer; }
 
-static FORCE_INLINE int walBuildMetaName(SWal* pWal, int metaVer, char* buf) {
-  return sprintf(buf, "%s/meta-ver%d", pWal->path, metaVer);
+static FORCE_INLINE void walBuildMetaName(SWal* pWal, int metaVer, char* buf) {
+  sprintf(buf, "%s/meta-ver%d", pWal->path, metaVer);
 }
 
 static FORCE_INLINE int64_t walScanLogGetLastVer(SWal* pWal) {
@@ -615,6 +615,7 @@ int walLoadMeta(SWal* pWal) {
   TdFilePtr pFile = taosOpenFile(fnameStr, TD_FILE_READ);
   if (pFile == NULL) {
     terrno = TSDB_CODE_WAL_FILE_CORRUPTED;
+    taosMemoryFree(buf);
     return -1;
   }
   if (taosReadFile(pFile, buf, size) != size) {

source/libs/wal/src/walRead.c

@@ -399,7 +399,7 @@ int32_t walFetchBody(SWalReader *pRead, SWalCkHead **ppHead) {
       terrno = TSDB_CODE_WAL_OUT_OF_MEMORY;
       return -1;
     }
-    *ppHead = ptr;
+    *ppHead = (SWalCkHead *)ptr;
     pReadHead = &((*ppHead)->head);
     pRead->capacity = pReadHead->bodyLen;
   }