From 1d0ab80e75a78445268acef2f3a310755f71227c Mon Sep 17 00:00:00 2001
From: Haojun Liao <hjliao@taosdata.com>
Date: Tue, 31 Dec 2024 11:59:13 +0800
Subject: [PATCH] fix(stream): check return value  for snprintf

---
 source/libs/stream/src/streamSnapshot.c | 4 ++--
 source/libs/stream/src/streamTask.c     | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/source/libs/stream/src/streamSnapshot.c b/source/libs/stream/src/streamSnapshot.c
index cb4386067b..88495ac760 100644
--- a/source/libs/stream/src/streamSnapshot.c
+++ b/source/libs/stream/src/streamSnapshot.c
@@ -130,7 +130,7 @@ int32_t streamGetFileSize(char* path, char* name, int64_t* sz) {
   }
 
   ret = snprintf(fullname, len, "%s%s%s", path, TD_DIRSEP, name);
-  if (ret < 0) {
+  if (ret < 0 || ret >= len) {
     stError("%s failed to set the file path for get the file size, code: out of buffer", name);
     return TSDB_CODE_OUT_OF_BUFFER;
   }
@@ -819,7 +819,7 @@ int32_t streamSnapWrite(SStreamSnapWriter* pWriter, uint8_t* pData, uint32_t nDa
 
     int32_t ret = snprintf(path, bufLen, "%s%s%s%s%s%s%s%" PRId64 "", pHandle->metaPath, TD_DIRSEP, idstr, TD_DIRSEP,
                    "checkpoints", TD_DIRSEP, "checkpoint", snapInfo.chkpId);
-    if (ret < 0) {
+    if (ret < 0 || ret >= bufLen) {
       stError("s-task:0x%x failed to set the path for take snapshot, code: out of buffer, %s", (int32_t)snapInfo.taskId,
               pHandle->metaPath);
       return TSDB_CODE_OUT_OF_BUFFER;
diff --git a/source/libs/stream/src/streamTask.c b/source/libs/stream/src/streamTask.c
index e3a1f5f94a..d27ed520c6 100644
--- a/source/libs/stream/src/streamTask.c
+++ b/source/libs/stream/src/streamTask.c
@@ -134,7 +134,7 @@ int32_t tNewStreamTask(int64_t streamId, int8_t taskLevel, SEpSet* pEpset, bool
 
   char    buf[128] = {0};
   int32_t ret = snprintf(buf, tListLen(buf), "0x%" PRIx64 "-0x%x", pTask->id.streamId, pTask->id.taskId);
-  if (ret < 0) {
+  if (ret < 0 || ret >= tListLen(buf)) {
     stError("s-task:0x%x failed to set the taskIdstr, code: out of buffer", pTask->id.taskId);
     return TSDB_CODE_OUT_OF_BUFFER;
   }
@@ -418,7 +418,7 @@ int32_t streamTaskSetBackendPath(SStreamTask* pTask) {
   }
 
   int32_t code = snprintf(pTask->backendPath, len + nBytes + 2, "%s%s%s", pTask->pMeta->path, TD_DIRSEP, id);
-  if (code < 0) {
+  if (code < 0 || code >= len + nBytes + 2) {
     stError("s-task:%s failed to set backend path:%s, code: out of buffer", pTask->id.idStr, pTask->backendPath);
     return TSDB_CODE_OUT_OF_BUFFER;
   } else {
@@ -1138,7 +1138,7 @@ SEpSet* streamTaskGetDownstreamEpInfo(SStreamTask* pTask, int32_t taskId) {
 int32_t createStreamTaskIdStr(int64_t streamId, int32_t taskId, const char** pId) {
   char buf[128] = {0};
   int32_t code = snprintf(buf, tListLen(buf),"0x%" PRIx64 "-0x%x", streamId, taskId);
-  if (code < 0) {
+  if (code < 0 || code >= tListLen(buf)) {
     return TSDB_CODE_OUT_OF_BUFFER;
   }