From b92de1e9e6a5d6b32b89cd8356c0b231ca2adb8b Mon Sep 17 00:00:00 2001
From: Haojun Liao <hjliao@taosdata.com>
Date: Tue, 28 Feb 2023 09:34:16 +0800
Subject: [PATCH] fix(query): fix invalid read.

---
 source/libs/executor/src/executil.c    | 44 +++++++++++++-------------
 source/libs/nodes/src/nodesUtilFuncs.c |  6 ++--
 tools/shell/src/shellAuto.c            |  9 ++++--
 3 files changed, 32 insertions(+), 27 deletions(-)

diff --git a/source/libs/executor/src/executil.c b/source/libs/executor/src/executil.c
index 6b6f5cfe93..9537751ff0 100644
--- a/source/libs/executor/src/executil.c
+++ b/source/libs/executor/src/executil.c
@@ -850,32 +850,32 @@ static SSDataBlock* createTagValBlockForFilter(SArray* pColList, int32_t numOfTa
         tagVal.cid = pColInfo->info.colId;
         if (p1->pTagVal == NULL) {
           colDataSetNULL(pColInfo, i);
-        }
-
-        const char* p = metaGetTableTagVal(p1->pTagVal, pColInfo->info.type, &tagVal);
-
-        if (p == NULL || (pColInfo->info.type == TSDB_DATA_TYPE_JSON && ((STag*)p)->nTag == 0)) {
-          colDataSetNULL(pColInfo, i);
-        } else if (pColInfo->info.type == TSDB_DATA_TYPE_JSON) {
-          colDataSetVal(pColInfo, i, p, false);
-        } else if (IS_VAR_DATA_TYPE(pColInfo->info.type)) {
-          char* tmp = taosMemoryMalloc(tagVal.nData + VARSTR_HEADER_SIZE + 1);
-          varDataSetLen(tmp, tagVal.nData);
-          memcpy(tmp + VARSTR_HEADER_SIZE, tagVal.pData, tagVal.nData);
-          colDataSetVal(pColInfo, i, tmp, false);
+        } else {
+          const char* p = metaGetTableTagVal(p1->pTagVal, pColInfo->info.type, &tagVal);
+
+          if (p == NULL || (pColInfo->info.type == TSDB_DATA_TYPE_JSON && ((STag*)p)->nTag == 0)) {
+            colDataSetNULL(pColInfo, i);
+          } else if (pColInfo->info.type == TSDB_DATA_TYPE_JSON) {
+            colDataSetVal(pColInfo, i, p, false);
+          } else if (IS_VAR_DATA_TYPE(pColInfo->info.type)) {
+            char* tmp = taosMemoryMalloc(tagVal.nData + VARSTR_HEADER_SIZE + 1);
+            varDataSetLen(tmp, tagVal.nData);
+            memcpy(tmp + VARSTR_HEADER_SIZE, tagVal.pData, tagVal.nData);
+            colDataSetVal(pColInfo, i, tmp, false);
 #if TAG_FILTER_DEBUG
-          qDebug("tagfilter varch:%s", tmp + 2);
+            qDebug("tagfilter varch:%s", tmp + 2);
 #endif
-          taosMemoryFree(tmp);
-        } else {
-          colDataSetVal(pColInfo, i, (const char*)&tagVal.i64, false);
+            taosMemoryFree(tmp);
+          } else {
+            colDataSetVal(pColInfo, i, (const char*)&tagVal.i64, false);
 #if TAG_FILTER_DEBUG
-          if (pColInfo->info.type == TSDB_DATA_TYPE_INT) {
-            qDebug("tagfilter int:%d", *(int*)(&tagVal.i64));
-          } else if (pColInfo->info.type == TSDB_DATA_TYPE_DOUBLE) {
-            qDebug("tagfilter double:%f", *(double*)(&tagVal.i64));
-          }
+            if (pColInfo->info.type == TSDB_DATA_TYPE_INT) {
+              qDebug("tagfilter int:%d", *(int*)(&tagVal.i64));
+            } else if (pColInfo->info.type == TSDB_DATA_TYPE_DOUBLE) {
+              qDebug("tagfilter double:%f", *(double*)(&tagVal.i64));
+            }
 #endif
+          }
         }
       }
     }
diff --git a/source/libs/nodes/src/nodesUtilFuncs.c b/source/libs/nodes/src/nodesUtilFuncs.c
index 0419c883e6..024130b5f8 100644
--- a/source/libs/nodes/src/nodesUtilFuncs.c
+++ b/source/libs/nodes/src/nodesUtilFuncs.c
@@ -2101,9 +2101,9 @@ void nodesValueNodeToVariant(const SValueNode* pNode, SVariant* pVal) {
     case TSDB_DATA_TYPE_NCHAR:
     case TSDB_DATA_TYPE_VARCHAR:
     case TSDB_DATA_TYPE_VARBINARY:
-      pVal->pz = taosMemoryMalloc(pVal->nLen + VARSTR_HEADER_SIZE + 1);
-      memcpy(pVal->pz, pNode->datum.p, pVal->nLen + VARSTR_HEADER_SIZE);
-      pVal->pz[pVal->nLen + VARSTR_HEADER_SIZE] = 0;
+      pVal->pz = taosMemoryMalloc(pVal->nLen + 1);
+      memcpy(pVal->pz, pNode->datum.p, pVal->nLen);
+      pVal->pz[pVal->nLen] = 0;
       break;
     case TSDB_DATA_TYPE_JSON:
       pVal->nLen = getJsonValueLen(pNode->datum.p);
diff --git a/tools/shell/src/shellAuto.c b/tools/shell/src/shellAuto.c
index 1d872e3f0d..a8bc93dd0c 100644
--- a/tools/shell/src/shellAuto.c
+++ b/tools/shell/src/shellAuto.c
@@ -98,6 +98,7 @@ SWords shellCommands[] = {
     {"describe <all_table>", 0, 0, NULL},
     {"delete from <all_table> where ", 0, 0, NULL},
     {"drop database <db_name>", 0, 0, NULL},
+    {"drop index <anyword>", 0, 0, NULL},
     {"drop table <all_table>", 0, 0, NULL},
     {"drop dnode <dnode_id>", 0, 0, NULL},
     {"drop mnode on dnode <dnode_id> ;", 0, 0, NULL},
@@ -384,7 +385,7 @@ void showHelp() {
     create table <tb_name> using <stb_name> tags ...\n\
     create database <db_name> <db_options>  ...\n\
     create dnode \"fqdn:port\" ...\n\
-    create index ...\n\
+    create index <index_name> on <stb_name> (tag_column_name);\n\
     create mnode on dnode <dnode_id> ;\n\
     create qnode on dnode <dnode_id> ;\n\
     create stream <stream_name> into <stb_name> as select ...\n\
@@ -404,6 +405,7 @@ void showHelp() {
     drop consumer group ... \n\
     drop topic <topic_name> ;\n\
     drop stream <stream_name> ;\n\
+    drop index <index_name>;\n\
   ----- E ----- \n\
     explain select clause ...\n\
   ----- F ----- \n\
@@ -534,7 +536,7 @@ SWord* addWord(const char* p, int32_t len, bool pattern) {
   word->len = len;
 
   // check format
-  if (pattern) {
+  if (pattern && len > 0) {
     word->type = wordType(p, len);
   } else {
     word->type = WT_TEXT;
@@ -1724,6 +1726,9 @@ bool matchEnd(TAOS* con, SShellCmd* cmd) {
   if (strlen(last) == 0) {
     goto _return;
   }
+  if (strcmp(last, " ") == 0) {
+    goto _return;
+  }
 
   // match database
   if (elast == NULL) {
-- 
GitLab