From dd0bc0e0500d758a4ac99523f5afeeda021779fb Mon Sep 17 00:00:00 2001
From: wangmm0220 <wangmm0220@gmail.com>
Date: Mon, 14 Aug 2023 09:42:55 +0800
Subject: [PATCH] fix:heap use after free

---
 include/libs/wal/wal.h             | 1 -
 source/dnode/vnode/src/tq/tqRead.c | 3 +++
 source/dnode/vnode/src/tq/tqUtil.c | 1 -
 source/libs/wal/src/walRead.c      | 1 -
 4 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/libs/wal/wal.h b/include/libs/wal/wal.h
index 1f7323a06a..cfe70a186c 100644
--- a/include/libs/wal/wal.h
+++ b/include/libs/wal/wal.h
@@ -206,7 +206,6 @@ void        walReaderValidVersionRange(SWalReader *pReader, int64_t *sver, int64
 void        walReaderVerifyOffset(SWalReader *pWalReader, STqOffsetVal* pOffset);
 
 // only for tq usage
-void    walSetReaderCapacity(SWalReader *pRead, int32_t capacity);
 int32_t walFetchHead(SWalReader *pRead, int64_t ver);
 int32_t walFetchBody(SWalReader *pRead);
 int32_t walSkipFetchBody(SWalReader *pRead);
diff --git a/source/dnode/vnode/src/tq/tqRead.c b/source/dnode/vnode/src/tq/tqRead.c
index 6c091fa4cb..252a0642fa 100644
--- a/source/dnode/vnode/src/tq/tqRead.c
+++ b/source/dnode/vnode/src/tq/tqRead.c
@@ -219,11 +219,13 @@ int32_t tqFetchLog(STQ* pTq, STqHandle* pHandle, int64_t* fetchOffset, uint64_t
             goto END;
           }
 
+          pHead = &(pHandle->pWalReader->pHead->head);
           if (isValValidForTable(pHandle, pHead)) {
             code = 0;
             goto END;
           } else {
             offset++;
+            code = -1;
             continue;
           }
         }
@@ -234,6 +236,7 @@ int32_t tqFetchLog(STQ* pTq, STqHandle* pHandle, int64_t* fetchOffset, uint64_t
       }
       offset++;
     }
+    code = -1;
   }
 
 END:
diff --git a/source/dnode/vnode/src/tq/tqUtil.c b/source/dnode/vnode/src/tq/tqUtil.c
index 42aac52c63..b7fd505784 100644
--- a/source/dnode/vnode/src/tq/tqUtil.c
+++ b/source/dnode/vnode/src/tq/tqUtil.c
@@ -216,7 +216,6 @@ static int32_t extractDataAndRspForDbStbSubscribe(STQ* pTq, STqHandle* pHandle,
     walReaderVerifyOffset(pHandle->pWalReader, offset);
     int64_t fetchVer = offset->version;
 
-    walSetReaderCapacity(pHandle->pWalReader, 2048);
     int totalRows = 0;
     while (1) {
       int32_t savedEpoch = atomic_load_32(&pHandle->epoch);
diff --git a/source/libs/wal/src/walRead.c b/source/libs/wal/src/walRead.c
index 01404494e3..d9e43e4324 100644
--- a/source/libs/wal/src/walRead.c
+++ b/source/libs/wal/src/walRead.c
@@ -250,7 +250,6 @@ int32_t walReaderSeekVer(SWalReader *pReader, int64_t ver) {
   return 0;
 }
 
-void walSetReaderCapacity(SWalReader *pRead, int32_t capacity) { pRead->capacity = capacity; }
 
 int32_t walFetchHead(SWalReader *pRead, int64_t ver) {
   int64_t code;
-- 
GitLab