Merge pull request #20485 from taosdata/fix/TS-2891-M

fix(query): invalid write when query of ins_columns

source/dnode/mnode/impl/src/mndStb.c

@@ -3114,6 +3114,7 @@ static int32_t mndRetrieveStbCol(SRpcMsg *pReq, SShowObj *pShow, SSDataBlock *pB
   char typeName[TSDB_TABLE_FNAME_LEN + VARSTR_HEADER_SIZE] = {0};
   STR_TO_VARSTR(typeName, "SUPER_TABLE");
   while (numOfRows < rows) {
+    void *prevIter = pShow->pIter;
     pShow->pIter = sdbFetch(pSdb, SDB_STB, pShow->pIter, (void **)&pStb);
     if (pShow->pIter == NULL) break;
 
@@ -3122,6 +3123,12 @@ static int32_t mndRetrieveStbCol(SRpcMsg *pReq, SShowObj *pShow, SSDataBlock *pB
       continue;
     }
 
+    if ((numOfRows + pStb->numOfColumns) > rows) {
+      pShow->pIter = prevIter;
+      sdbRelease(pSdb, pStb);
+      break;
+    }
+
     SName name = {0};
     char  stbName[TSDB_TABLE_NAME_LEN + VARSTR_HEADER_SIZE] = {0};
     mndExtractTbNameFromStbFullName(pStb->name, &stbName[VARSTR_HEADER_SIZE], TSDB_TABLE_NAME_LEN);

source/libs/executor/src/sysscanoperator.c

@@ -562,15 +562,17 @@ static SSDataBlock* sysTableScanUserCols(SOperatorInfo* pOperator) {
       continue;
     }
 
-    sysTableUserColsFillOneTableCols(pInfo, dbname, &numOfRows, dataBlock, tableName, schemaRow, typeName);
-
-    if (numOfRows >= pOperator->resultInfo.capacity) {
+    if ((numOfRows + schemaRow->nCols) > pOperator->resultInfo.capacity) {
       relocateAndFilterSysTagsScanResult(pInfo, numOfRows, dataBlock, pOperator->exprSupp.pFilterInfo);
       numOfRows = 0;
 
+      metaTbCursorPrev(pInfo->pCur);
+
       if (pInfo->pRes->info.rows > 0) {
         break;
       }
+    } else {
+      sysTableUserColsFillOneTableCols(pInfo, dbname, &numOfRows, dataBlock, tableName, schemaRow, typeName);
     }
   }
 

tests/system-test/0-others/information_schema.py

@@ -101,10 +101,18 @@ class TDTestCase:
                 tdSql.checkEqual(i[1],len(self.perf_list))
             elif i[0].lower() == self.dbname:
                 tdSql.checkEqual(i[1],self.tbnum+1)
+    def ins_columns_check(self):
+        tdSql.execute('create database db2 vgroups 2 replica 1')
+        tdSql.execute('create table db2.stb2 (ts timestamp,c0 int,c1 int, c2 double, c3 float, c4 binary(1000), c5 nchar(100),c7 bigint, c8 bool, c9 smallint) tags(t0 int)')
+        for i in range(2000):
+            tdSql.execute("create table db2.ctb%d using db2.stb2 tags(%d)" %(i,i))
+        tdSql.query(f'select * from information_schema.ins_columns where db_name="db2" and table_type="CHILD_TABLE"')
+        tdSql.checkEqual(20000,len(tdSql.queryResult))
+        print("number of ins_columns of child table in db2 is %s" % len(tdSql.queryResult))
     def run(self):
         self.prepare_data()
         self.count_check()
-
+        self.ins_columns_check()
     def stop(self):
         tdSql.close()
         tdLog.success("%s successfully executed" % __file__)