Merge pull request #20102 from taosdata/fix/TD-22665

fix: coverity scan problem

include/common/tdataformat.h

@@ -106,7 +106,7 @@ int32_t tBufferReserve(SBuffer *pBuffer, int64_t nData, void **ppData);
 
 // SRow ================================
 int32_t tRowBuild(SArray *aColVal, const STSchema *pTSchema, SRow **ppRow);
-void    tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal);
+int32_t tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal);
 void    tRowDestroy(SRow *pRow);
 void    tRowSort(SArray *aRowP);
 int32_t tRowMerge(SArray *aRowP, STSchema *pTSchema, int8_t flag);

include/util/taoserror.h

@@ -119,6 +119,7 @@ int32_t* taosGetErrno();
 
 #define TSDB_CODE_APP_IS_STARTING               TAOS_DEF_ERROR_CODE(0, 0x0130) //
 #define TSDB_CODE_APP_IS_STOPPING               TAOS_DEF_ERROR_CODE(0, 0x0131) //
+#define TSDB_CODE_IVLD_DATA_FMT                 TAOS_DEF_ERROR_CODE(0, 0x0132) //
 
 //client
 #define TSDB_CODE_TSC_INVALID_OPERATION         TAOS_DEF_ERROR_CODE(0, 0x0200)

source/common/src/tdataformat.c

@@ -139,7 +139,10 @@ int32_t tRowBuild(SArray *aColVal, const STSchema *pTSchema, SRow **ppRow) {
           nkv += tPutI16v(NULL, -pTColumn->colId);
           nIdx++;
         } else {
-          ASSERT(0);
+          if (ASSERTS(0, "invalid input")) {
+            code = TSDB_CODE_INVALID_PARA;
+            goto _exit;
+          }
         }
 
         pTColumn = (++iTColumn < pTSchema->numOfCols) ? pTSchema->columns + iTColumn : NULL;
@@ -176,8 +179,10 @@ int32_t tRowBuild(SArray *aColVal, const STSchema *pTSchema, SRow **ppRow) {
       ntp = sizeof(SRow) + BIT2_SIZE(pTSchema->numOfCols - 1) + pTSchema->flen + ntp;
       break;
     default:
-      ASSERT(0);
-      break;
+      if (ASSERTS(0, "impossible")) {
+        code = TSDB_CODE_INVALID_PARA;
+        goto _exit;
+      }
   }
   if (maxIdx <= UINT8_MAX) {
     nkv = sizeof(SRow) + sizeof(SKVIdx) + nIdx + nkv;
@@ -306,8 +311,10 @@ int32_t tRowBuild(SArray *aColVal, const STSchema *pTSchema, SRow **ppRow) {
         pv = pf + pTSchema->flen;
         break;
       default:
-        ASSERT(0);
-        break;
+        if (ASSERTS(0, "impossible")) {
+          code = TSDB_CODE_INVALID_PARA;
+          goto _exit;
+        }
     }
 
     if (pb) {
@@ -370,7 +377,7 @@ _exit:
   return code;
 }
 
-void tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal) {
+int32_t tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal) {
   ASSERT(iCol < pTSchema->numOfCols);
   ASSERT(pRow->sver == pTSchema->version);
 
@@ -381,17 +388,17 @@ void tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal) {
     pColVal->type = pTColumn->type;
     pColVal->flag = CV_FLAG_VALUE;
     memcpy(&pColVal->value.val, &pRow->ts, sizeof(TSKEY));
-    return;
+    return 0;
   }
 
   if (pRow->flag == HAS_NONE) {
     *pColVal = COL_VAL_NONE(pTColumn->colId, pTColumn->type);
-    return;
+    return 0;
   }
 
   if (pRow->flag == HAS_NULL) {
     *pColVal = COL_VAL_NULL(pTColumn->colId, pTColumn->type);
-    return;
+    return 0;
   }
 
   if (pRow->flag >> 4) {  // KV Row
@@ -440,7 +447,7 @@ void tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal) {
             memcpy(&pColVal->value.val, pData, pTColumn->bytes);
           }
         }
-        return;
+        return 0;
       } else if (TABS(cid) < pTColumn->colId) {
         lidx = mid + 1;
       } else {
@@ -492,16 +499,16 @@ void tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal) {
           pv = pf + pTSchema->flen;
           break;
         default:
-          ASSERT(0);
-          break;
+          ASSERTS(0, "invalid row format");
+          return TSDB_CODE_IVLD_DATA_FMT;
       }
 
       if (bv == BIT_FLG_NONE) {
         *pColVal = COL_VAL_NONE(pTColumn->colId, pTColumn->type);
-        return;
+        return 0;
       } else if (bv == BIT_FLG_NULL) {
         *pColVal = COL_VAL_NULL(pTColumn->colId, pTColumn->type);
-        return;
+        return 0;
       }
 
       pColVal->cid = pTColumn->colId;
@@ -520,6 +527,8 @@ void tRowGet(SRow *pRow, STSchema *pTSchema, int32_t iCol, SColVal *pColVal) {
       }
     }
   }
+
+  return 0;
 }
 
 void tRowDestroy(SRow *pRow) {
@@ -710,7 +719,6 @@ int32_t tRowIterOpen(SRow *pRow, STSchema *pTSchema, SRowIter **ppIter) {
 _exit:
   if (code) {
     *ppIter = NULL;
-    if (pIter) taosMemoryFree(pIter);
   } else {
     *ppIter = pIter;
   }
@@ -929,8 +937,8 @@ static int32_t tRowTupleUpsertColData(SRow *pRow, STSchema *pTSchema, SColData *
       pv = pf + pTSchema->flen;
       break;
     default:
-      ASSERT(0);
-      break;
+      ASSERTS(0, "Invalid row flag");
+      return TSDB_CODE_IVLD_DATA_FMT;
   }
 
   while (pColData) {
@@ -954,8 +962,8 @@ static int32_t tRowTupleUpsertColData(SRow *pRow, STSchema *pTSchema, SColData *
               bv = GET_BIT2(pb, iTColumn - 1);
               break;
             default:
-              ASSERT(0);
-              break;
+              ASSERTS(0, "Invalid row flag");
+              return TSDB_CODE_IVLD_DATA_FMT;
           }
 
           if (bv == BIT_FLG_NONE) {
@@ -1045,7 +1053,8 @@ static int32_t tRowKVUpsertColData(SRow *pRow, STSchema *pTSchema, SColData *aCo
           } else if (pRow->flag & KV_FLG_BIG) {
             pData = pv + ((uint32_t *)pKVIdx->idx)[iCol];
           } else {
-            ASSERT(0);
+            ASSERTS(0, "Invalid KV row format");
+            return TSDB_CODE_IVLD_DATA_FMT;
           }
 
           int16_t cid;
@@ -1579,7 +1588,7 @@ static FORCE_INLINE int32_t tColDataPutValue(SColData *pColData, uint8_t *pData,
   int32_t code = 0;
 
   if (IS_VAR_DATA_TYPE(pColData->type)) {
-    code = tRealloc((uint8_t **)(&pColData->aOffset), (pColData->nVal + 1) << 2);
+    code = tRealloc((uint8_t **)(&pColData->aOffset), ((int64_t)(pColData->nVal + 1)) << 2);
     if (code) goto _exit;
     pColData->aOffset[pColData->nVal] = pColData->nData;
 
@@ -2312,35 +2321,25 @@ void tColDataGetValue(SColData *pColData, int32_t iVal, SColVal *pColVal) {
 }
 
 uint8_t tColDataGetBitValue(const SColData *pColData, int32_t iVal) {
-  uint8_t v;
   switch (pColData->flag) {
     case HAS_NONE:
-      v = 0;
-      break;
+      return 0;
     case HAS_NULL:
-      v = 1;
-      break;
+      return 1;
     case (HAS_NULL | HAS_NONE):
-      v = GET_BIT1(pColData->pBitMap, iVal);
-      break;
+      return GET_BIT1(pColData->pBitMap, iVal);
     case HAS_VALUE:
-      v = 2;
-      break;
+      return 2;
     case (HAS_VALUE | HAS_NONE):
-      v = GET_BIT1(pColData->pBitMap, iVal);
-      if (v) v = 2;
-      break;
+      return (GET_BIT1(pColData->pBitMap, iVal)) ? 2 : 0;
     case (HAS_VALUE | HAS_NULL):
-      v = GET_BIT1(pColData->pBitMap, iVal) + 1;
-      break;
+      return GET_BIT1(pColData->pBitMap, iVal) + 1;
     case (HAS_VALUE | HAS_NULL | HAS_NONE):
-      v = GET_BIT2(pColData->pBitMap, iVal);
-      break;
+      return GET_BIT2(pColData->pBitMap, iVal);
     default:
-      ASSERT(0);
-      break;
+      ASSERTS(0, "not possible");
+      return 0;
   }
-  return v;
 }
 
 int32_t tColDataCopy(SColData *pColDataFrom, SColData *pColData, xMallocFn xMalloc, void *arg) {

source/dnode/vnode/src/tsdb/tsdbSnapshot.c

@@ -328,10 +328,6 @@ static int32_t tsdbSnapCmprTombData(STsdbSnapReader* pReader, uint8_t** ppData)
 _exit:
   if (code) {
     tsdbError("vgId:%d %s failed at line %d since %s", TD_VID(pReader->pTsdb->pVnode), __func__, lino, tstrerror(code));
-    if (pData) {
-      taosMemoryFree(pData);
-      pData = NULL;
-    }
   }
   *ppData = pData;
   return code;
@@ -404,7 +400,7 @@ static int32_t tsdbSnapReadTombData(STsdbSnapReader* pReader, uint8_t** ppData)
   }
 
   while (pDelInfo && pDelInfo->suid == pReader->tbid.suid && pDelInfo->uid == pReader->tbid.uid) {
-    if (taosArrayPush(pReader->aDelData, &pDelInfo->delData) < 0) {
+    if (taosArrayPush(pReader->aDelData, &pDelInfo->delData) == NULL) {
       code = TSDB_CODE_OUT_OF_MEMORY;
       TSDB_CHECK_CODE(code, lino, _exit);
     }
@@ -1252,7 +1248,7 @@ static int32_t tsdbSnapWriteDelTableData(STsdbSnapWriter* pWriter, TABLEID* pId,
     SDelData delData;
     n += tGetDelData(pData + n, &delData);
 
-    if (taosArrayPush(pWriter->aDelData, &delData) < 0) {
+    if (taosArrayPush(pWriter->aDelData, &delData) == NULL) {
       code = TSDB_CODE_OUT_OF_MEMORY;
       TSDB_CHECK_CODE(code, lino, _exit);
     }
@@ -1420,6 +1416,7 @@ _exit:
       tBlockDataDestroy(&pWriter->bData);
       tBlockDataDestroy(&pWriter->inData);
       tsdbFSDestroy(&pWriter->fs);
+      taosMemoryFree(pWriter);
       pWriter = NULL;
     }
   } else {

source/dnode/vnode/src/tsdb/tsdbUtil.c

@@ -116,12 +116,7 @@ int32_t tMapDataToArray(SMapData *pMapData, int32_t itemSize, int32_t (*tGetItem
   }
 
 _exit:
-  if (code) {
-    *ppArray = NULL;
-    if (pArray) taosArrayDestroy(pArray);
-  } else {
-    *ppArray = pArray;
-  }
+  *ppArray = pArray;
   return code;
 }
 
@@ -1233,14 +1228,22 @@ int32_t tBlockDataInit(SBlockData *pBlockData, TABLEID *pId, STSchema *pTSchema,
     int32_t   iColumn = 1;
     STColumn *pTColumn = &pTSchema->columns[iColumn];
     for (int32_t iCid = 0; iCid < nCid; iCid++) {
-      ASSERT(pTColumn);
+      if (ASSERTS(pTColumn != NULL, "invalid input param")) {
+        code = TSDB_CODE_INVALID_PARA;
+        goto _exit;
+      }
+
       while (pTColumn->colId < aCid[iCid]) {
         iColumn++;
         ASSERT(iColumn < pTSchema->numOfCols);
         pTColumn = &pTSchema->columns[iColumn];
       }
 
-      ASSERT(pTColumn->colId == aCid[iCid]);
+      if (ASSERTS(pTColumn->colId == aCid[iCid], "invalid input param")) {
+        code = TSDB_CODE_INVALID_PARA;
+        goto _exit;
+      }
+
       tColDataInit(&pBlockData->aColData[iCid], pTColumn->colId, pTColumn->type,
                    (pTColumn->flags & COL_SMA_ON) ? 1 : 0);
 

source/dnode/vnode/src/tsdb/tsdbWrite.c

@@ -31,7 +31,9 @@ int tsdbInsertData(STsdb *pTsdb, int64_t version, SSubmitReq2 *pMsg, SSubmitRsp2
   int32_t affectedrows = 0;
   int32_t numOfRows = 0;
 
-  ASSERT(pTsdb->mem != NULL);
+  if (ASSERTS(pTsdb->mem != NULL, "vgId:%d, mem is NULL", TD_VID(pTsdb->pVnode))) {
+    return -1;
+  }
 
   if (pMsg) {
     arrSize = taosArrayGetSize(pMsg->aSubmitTbData);

source/dnode/vnode/src/vnd/vnodeCompact.c

@@ -36,8 +36,8 @@ static int32_t vnodeCompactTask(void *param) {
   vnodeCommitInfo(dir);
 
 _exit:
-  taosMemoryFree(pInfo);
   tsem_post(&pInfo->pVnode->canCommit);
+  taosMemoryFree(pInfo);
   return code;
 }
 static int32_t vnodePrepareCompact(SVnode *pVnode, SCompactInfo *pInfo) {
@@ -59,9 +59,17 @@ static int32_t vnodePrepareCompact(SVnode *pVnode, SCompactInfo *pInfo) {
     snprintf(dir, TSDB_FILENAME_LEN, "%s", pVnode->path);
   }
 
-  vnodeLoadInfo(dir, &info);
+  if (vnodeLoadInfo(dir, &info) < 0) {
+    code = terrno;
+    goto _exit;
+  }
+
   info.state.commitID = pInfo->commitID;
-  vnodeSaveInfo(dir, &info);
+
+  if (vnodeSaveInfo(dir, &info) < 0) {
+    code = terrno;
+    goto _exit;
+  }
 
 _exit:
   if (code) {

source/dnode/vnode/src/vnd/vnodeOpen.c

@@ -48,7 +48,7 @@ int32_t vnodeCreate(const char *path, SVnodeCfg *pCfg, STfs *pTfs) {
   info.state.applied = -1;
   info.state.commitID = 0;
 
-  vInfo("vgId:%d, save config while create", pCfg->vgId);
+  vInfo("vgId:%d, save config while create", info.config.vgId);
   if (vnodeSaveInfo(dir, &info) < 0 || vnodeCommitInfo(dir) < 0) {
     vError("vgId:%d, failed to save vnode config since %s", pCfg ? pCfg->vgId : 0, tstrerror(terrno));
     return -1;
@@ -124,7 +124,7 @@ int32_t vnodeRenameVgroupId(const char *srcPath, const char *dstPath, int32_t sr
   while (1) {
     const STfsFile *tsdbFile = tfsReaddir(tsdbDir);
     if (tsdbFile == NULL) break;
-    if (tsdbFile->rname == NULL) continue;
+    if (tsdbFile->rname[0] == '\0') continue;
     tstrncpy(oldRname, tsdbFile->rname, TSDB_FILENAME_LEN);
 
     char *tsdbFilePrefixPos = strstr(oldRname, tsdbFilePrefix);

source/dnode/vnode/src/vnd/vnodeSvr.c

@@ -141,7 +141,10 @@ static int32_t vnodePreProcessSubmitTbData(SVnode *pVnode, SDecoder *pCoder, int
     *(int64_t *)(pCoder->data + pCoder->pos) = uid;
     pCoder->pos += sizeof(int64_t);
   } else {
-    tDecodeI64(pCoder, &submitTbData.uid);
+    if (tDecodeI64(pCoder, &submitTbData.uid) < 0) {
+      code = TSDB_CODE_INVALID_MSG;
+      TSDB_CHECK_CODE(code, lino, _exit);
+    }
   }
 
   if (tDecodeI32v(pCoder, &submitTbData.sver) < 0) {
@@ -168,6 +171,11 @@ static int32_t vnodePreProcessSubmitTbData(SVnode *pVnode, SDecoder *pCoder, int
     SColData colData = {0};
     pCoder->pos += tGetColData(pCoder->data + pCoder->pos, &colData);
 
+    if (colData.flag != HAS_VALUE) {
+      code = TSDB_CODE_INVALID_MSG;
+      goto _exit;
+    }
+
     for (int32_t iRow = 0; iRow < colData.nVal; iRow++) {
       if (((TSKEY *)colData.pData)[iRow] < minKey || ((TSKEY *)colData.pData)[iRow] > maxKey) {
         code = TSDB_CODE_TDB_TIMESTAMP_OUT_OF_RANGE;

source/util/src/terror.c

@@ -97,6 +97,7 @@ TAOS_DEFINE_ERROR(TSDB_CODE_TIMEOUT_ERROR,                "Operation timeout")
 
 TAOS_DEFINE_ERROR(TSDB_CODE_APP_IS_STARTING,              "Database is starting up")
 TAOS_DEFINE_ERROR(TSDB_CODE_APP_IS_STOPPING,              "Database is closing down")
+TAOS_DEFINE_ERROR(TSDB_CODE_IVLD_DATA_FMT,                "Invalid data format")
 
 //client
 TAOS_DEFINE_ERROR(TSDB_CODE_TSC_INVALID_OPERATION,        "Invalid operation")