未验证 提交 8141958f 编写于 作者: H Haojun Liao 提交者: GitHub

Merge pull request #8714 from xiaohu4313888/develop

Fix/td 8690 fix size buffer (STRING_OVERFLOW)
......@@ -1536,7 +1536,17 @@ int tscBuildCreateTableMsg(SSqlObj *pSql, SSqlInfo *pInfo) {
pMsg += sizeof(SCreateTableMsg);
SCreatedTableInfo* p = taosArrayGet(list, i);
strcpy(pCreate->tableName, p->fullname);
//what pCreate->tableName point is a fixed char array which size is 237
//what p->fullname point is a char*
//before the time we copy p->fullname to pCreate->tableName , we need to check the length of p->fullname
if (strlen(p->fullname) > 237) {
tscError("failed to write this name, which is over 237, just save the first 237 char here");
strncpy(pCreate->tableName, p->fullname,237);
pCreate->tableName[236]='\0';//I don't know if this line is working properly
}else{
strcpy(pCreate->tableName, p->fullname);
}
pCreate->igExists = (p->igExist)? 1 : 0;
// use dbinfo from table id without modifying current db info
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册