fix(query): fix invalid read/write.

source/dnode/vnode/src/tsdb/tsdbRead.c

@@ -2244,9 +2244,12 @@ static void extractOrderedTableUidList(SUidOrderCheckInfo* pOrderCheckInfo, SRea
 }
 
 static int32_t initOrderCheckInfo(SUidOrderCheckInfo* pOrderCheckInfo, SReaderStatus* pStatus) {
-  if (pOrderCheckInfo->tableUidList == NULL) {
-    int32_t total = taosHashGetSize(pStatus->pTableMap);
+  int32_t total = taosHashGetSize(pStatus->pTableMap);
+  if (total == 0) {
+    return TSDB_CODE_SUCCESS;
+  }
 
+  if (pOrderCheckInfo->tableUidList == NULL) {
     pOrderCheckInfo->currentIndex = 0;
     pOrderCheckInfo->tableUidList = taosMemoryMalloc(total * sizeof(uint64_t));
     if (pOrderCheckInfo->tableUidList == NULL) {
@@ -2254,21 +2257,17 @@ static int32_t initOrderCheckInfo(SUidOrderCheckInfo* pOrderCheckInfo, SReaderSt
     }
 
     extractOrderedTableUidList(pOrderCheckInfo, pStatus);
-
     uint64_t uid = pOrderCheckInfo->tableUidList[0];
     pStatus->pTableIter = taosHashGet(pStatus->pTableMap, &uid, sizeof(uid));
   } else {
     if (pStatus->pTableIter == NULL) {  // it is the last block of a new file
-      //      ASSERT(pOrderCheckInfo->currentIndex == taosHashGetSize(pStatus->pTableMap));
-
       pOrderCheckInfo->currentIndex = 0;
       uint64_t uid = pOrderCheckInfo->tableUidList[pOrderCheckInfo->currentIndex];
       pStatus->pTableIter = taosHashGet(pStatus->pTableMap, &uid, sizeof(uid));
 
       // the tableMap has already updated
       if (pStatus->pTableIter == NULL) {
-        void* p =
-            taosMemoryRealloc(pOrderCheckInfo->tableUidList, taosHashGetSize(pStatus->pTableMap) * sizeof(uint64_t));
+        void* p = taosMemoryRealloc(pOrderCheckInfo->tableUidList, total * sizeof(uint64_t));
         if (p == NULL) {
           return TSDB_CODE_OUT_OF_MEMORY;
         }

source/libs/executor/inc/executil.h

@@ -87,9 +87,7 @@ struct SqlFunctionCtx;
 
 size_t getResultRowSize(struct SqlFunctionCtx* pCtx, int32_t numOfOutput);
 void   initResultRowInfo(SResultRowInfo* pResultRowInfo);
-
-void initResultRow(SResultRow* pResultRow);
-void closeResultRow(SResultRow* pResultRow);
+void   closeResultRow(SResultRow* pResultRow);
 
 struct SResultRowEntryInfo* getResultEntryInfo(const SResultRow* pRow, int32_t index, const int32_t* offset);
 

source/libs/executor/src/timewindowoperator.c

@@ -609,6 +609,7 @@ static void doInterpUnclosedTimeWindow(SOperatorInfo* pOperatorInfo, int32_t num
   while (1) {
     SListNode* pn = tdListGetHead(pResultRowInfo->openWindow);
     SOpenWindowInfo* pOpenWin = (SOpenWindowInfo *)pn->data;
+
     uint64_t groupId = pOpenWin->groupId;
     SResultRowPosition* p1 = &pOpenWin->pos;
     if (p->pageId == p1->pageId && p->offset == p1->offset) {
@@ -621,7 +622,8 @@ static void doInterpUnclosedTimeWindow(SOperatorInfo* pOperatorInfo, int32_t num
     if (pr->closed) {
       ASSERT(isResultRowInterpolated(pr, RESULT_ROW_START_INTERP) &&
              isResultRowInterpolated(pr, RESULT_ROW_END_INTERP));
-      tdListPopHead(pResultRowInfo->openWindow);
+      SListNode* pNode = tdListPopHead(pResultRowInfo->openWindow);
+      taosMemoryFree(pNode);
       continue;
     }
 
@@ -650,7 +652,8 @@ static void doInterpUnclosedTimeWindow(SOperatorInfo* pOperatorInfo, int32_t num
 
     if (isResultRowInterpolated(pResult, RESULT_ROW_END_INTERP)) {
       closeResultRow(pr);
-      tdListPopHead(pResultRowInfo->openWindow);
+      SListNode* pNode = tdListPopHead(pResultRowInfo->openWindow);
+      taosMemoryFree(pNode);
     } else {  // the remains are can not be closed yet.
       break;
     }
@@ -1730,6 +1733,10 @@ void destroyIntervalOperatorInfo(void* param) {
   SIntervalAggOperatorInfo* pInfo = (SIntervalAggOperatorInfo*)param;
   cleanupBasicInfo(&pInfo->binfo);
   cleanupAggSup(&pInfo->aggSup);
+  cleanupExprSupp(&pInfo->scalarSupp);
+
+  tdListFree(pInfo->binfo.resultRowInfo.openWindow);
+
   pInfo->pRecycledPages = taosArrayDestroy(pInfo->pRecycledPages);
   pInfo->pInterpCols = taosArrayDestroy(pInfo->pInterpCols);
   taosArrayDestroyEx(pInfo->pPrevValues, freeItem);

tests/script/tsim/parser/slimit_alter_tags.sim

@@ -128,6 +128,7 @@ if $rows != 5 then
   return -1
 endi
 if $data00 != $rowNum then
+  print expect $rowNum , actual: $data00
   return -1
 endi
 if $data10 != $rowNum then