From 69352e6e8954d1aedcb414627fd43959a1121deb Mon Sep 17 00:00:00 2001
From: Liu Jicong <liujicong@qq.com>
Date: Wed, 12 Oct 2022 10:28:07 +0800
Subject: [PATCH] fix tbanme length check

---
 source/dnode/mnode/impl/src/mndConsumer.c | 1 +
 source/dnode/mnode/impl/src/mndOffset.c   | 5 +++++
 source/dnode/mnode/impl/src/mndTopic.c    | 1 +
 source/dnode/vnode/src/tq/tqMeta.c        | 1 +
 source/libs/executor/src/scanoperator.c   | 3 ++-
 source/libs/wal/src/walMeta.c             | 5 +++--
 source/libs/wal/src/walRead.c             | 2 +-
 7 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/source/dnode/mnode/impl/src/mndConsumer.c b/source/dnode/mnode/impl/src/mndConsumer.c
index c853828bf2..7ffa3cef99 100644
--- a/source/dnode/mnode/impl/src/mndConsumer.c
+++ b/source/dnode/mnode/impl/src/mndConsumer.c
@@ -117,6 +117,7 @@ static int32_t mndProcessConsumerLostMsg(SRpcMsg *pMsg) {
   if (mndTransPrepare(pMnode, pTrans) != 0) goto FAIL;
 
   mndTransDrop(pTrans);
+  tDeleteSMqConsumerObj(pConsumerNew);
   return 0;
 FAIL:
   tDeleteSMqConsumerObj(pConsumerNew);
diff --git a/source/dnode/mnode/impl/src/mndOffset.c b/source/dnode/mnode/impl/src/mndOffset.c
index 2ada3e00bb..8d779f0021 100644
--- a/source/dnode/mnode/impl/src/mndOffset.c
+++ b/source/dnode/mnode/impl/src/mndOffset.c
@@ -182,6 +182,11 @@ static int32_t mndProcessCommitOffsetReq(SRpcMsg *pMsg) {
   tDecodeSMqCMCommitOffsetReq(&decoder, &commitOffsetReq);
 
   STrans *pTrans = mndTransCreate(pMnode, TRN_POLICY_ROLLBACK, TRN_CONFLICT_NOTHING, pMsg, "commit-offset");
+  if (pTrans == NULL) {
+    terrno = TSDB_CODE_OUT_OF_MEMORY;
+    tDecoderClear(&decoder);
+    return -1;
+  }
 
   for (int32_t i = 0; i < commitOffsetReq.num; i++) {
     SMqOffset *pOffset = &commitOffsetReq.offsets[i];
diff --git a/source/dnode/mnode/impl/src/mndTopic.c b/source/dnode/mnode/impl/src/mndTopic.c
index 5d3a2be79a..ae259b95be 100644
--- a/source/dnode/mnode/impl/src/mndTopic.c
+++ b/source/dnode/mnode/impl/src/mndTopic.c
@@ -222,6 +222,7 @@ SSdbRow *mndTopicActionDecode(SSdbRaw *pRaw) {
     }
     SDB_GET_BINARY(pRaw, dataPos, buf, len, TOPIC_DECODE_OVER);
     if (taosDecodeSSchemaWrapper(buf, &pTopic->schema) == NULL) {
+      taosMemoryFree(buf);
       goto TOPIC_DECODE_OVER;
     }
     taosMemoryFree(buf);
diff --git a/source/dnode/vnode/src/tq/tqMeta.c b/source/dnode/vnode/src/tq/tqMeta.c
index 1a57a391b1..1c5eee7378 100644
--- a/source/dnode/vnode/src/tq/tqMeta.c
+++ b/source/dnode/vnode/src/tq/tqMeta.c
@@ -170,6 +170,7 @@ int32_t tqMetaRestoreCheckInfo(STQ* pTq) {
     tDecoderInit(&decoder, (uint8_t*)pVal, vLen);
     if (tDecodeSTqCheckInfo(&decoder, &info) < 0) {
       terrno = TSDB_CODE_OUT_OF_MEMORY;
+      tdbFree(pKey);
       tdbTbcClose(pCur);
       return -1;
     }
diff --git a/source/libs/executor/src/scanoperator.c b/source/libs/executor/src/scanoperator.c
index df7e5ff06f..0cfdd2b68e 100644
--- a/source/libs/executor/src/scanoperator.c
+++ b/source/libs/executor/src/scanoperator.c
@@ -1341,7 +1341,8 @@ static void calBlockTbName(SExprSupp* pTbNameCalSup, SSDataBlock* pBlock) {
   void* pData = colDataGetData(pCol, 0);
   // TODO check tbname validation
   if (pData != (void*)-1 && pData != NULL) {
-    memcpy(pBlock->info.parTbName, varDataVal(pData), varDataLen(pData));
+    memcpy(pBlock->info.parTbName, varDataVal(pData), TMIN(varDataLen(pData), TSDB_TABLE_NAME_LEN));
+    pBlock->info.parTbName[TSDB_TABLE_NAME_LEN - 1] = 0;
   } else {
     pBlock->info.parTbName[0] = 0;
   }
diff --git a/source/libs/wal/src/walMeta.c b/source/libs/wal/src/walMeta.c
index 62f2d51f1b..e49a963191 100644
--- a/source/libs/wal/src/walMeta.c
+++ b/source/libs/wal/src/walMeta.c
@@ -35,8 +35,8 @@ int64_t FORCE_INLINE walGetCommittedVer(SWal* pWal) { return pWal->vers.commitVe
 
 int64_t FORCE_INLINE walGetAppliedVer(SWal* pWal) { return pWal->vers.appliedVer; }
 
-static FORCE_INLINE int walBuildMetaName(SWal* pWal, int metaVer, char* buf) {
-  return sprintf(buf, "%s/meta-ver%d", pWal->path, metaVer);
+static FORCE_INLINE void walBuildMetaName(SWal* pWal, int metaVer, char* buf) {
+  sprintf(buf, "%s/meta-ver%d", pWal->path, metaVer);
 }
 
 static FORCE_INLINE int64_t walScanLogGetLastVer(SWal* pWal) {
@@ -615,6 +615,7 @@ int walLoadMeta(SWal* pWal) {
   TdFilePtr pFile = taosOpenFile(fnameStr, TD_FILE_READ);
   if (pFile == NULL) {
     terrno = TSDB_CODE_WAL_FILE_CORRUPTED;
+    taosMemoryFree(buf);
     return -1;
   }
   if (taosReadFile(pFile, buf, size) != size) {
diff --git a/source/libs/wal/src/walRead.c b/source/libs/wal/src/walRead.c
index cc6f827b8e..1acaf5e7f3 100644
--- a/source/libs/wal/src/walRead.c
+++ b/source/libs/wal/src/walRead.c
@@ -399,7 +399,7 @@ int32_t walFetchBody(SWalReader *pRead, SWalCkHead **ppHead) {
       terrno = TSDB_CODE_WAL_OUT_OF_MEMORY;
       return -1;
     }
-    *ppHead = ptr;
+    *ppHead = (SWalCkHead *)ptr;
     pReadHead = &((*ppHead)->head);
     pRead->capacity = pReadHead->bodyLen;
   }
-- 
GitLab