From 990d36654db5f177008cde1cccdee0e759cef5cc Mon Sep 17 00:00:00 2001
From: liuyao <54liuyao@163.com>
Date: Mon, 16 Oct 2023 19:49:45 +0800
Subject: [PATCH 1/2] release buff

---
 source/libs/stream/src/tstreamFileState.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/source/libs/stream/src/tstreamFileState.c b/source/libs/stream/src/tstreamFileState.c
index ac404893f0..b10db2a1af 100644
--- a/source/libs/stream/src/tstreamFileState.c
+++ b/source/libs/stream/src/tstreamFileState.c
@@ -297,6 +297,10 @@ void popUsedBuffs(SStreamFileState* pFileState, SStreamSnapshot* pFlushList, uin
   while ((pNode = tdListNext(&iter)) != NULL && i < max) {
     SRowBuffPos* pPos = *(SRowBuffPos**)pNode->data;
     if (pPos->beUsed == used) {
+      if (used && !pPos->pRowBuff) {
+        ASSERT(pPos->needFree == true);
+        continue;
+      }
       tdListAppend(pFlushList, &pPos);
       pFileState->flushMark = TMAX(pFileState->flushMark, pFileState->getTs(pPos->pKey));
       pFileState->stateBuffRemoveByPosFn(pFileState, pPos);

From 5e0f9cb908b363f4b4cc7dcb02b50affdf67d6af Mon Sep 17 00:00:00 2001
From: liuyao <54liuyao@163.com>
Date: Tue, 17 Oct 2023 14:32:09 +0800
Subject: [PATCH 2/2] double free

---
 source/libs/executor/src/streamtimewindowoperator.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/source/libs/executor/src/streamtimewindowoperator.c b/source/libs/executor/src/streamtimewindowoperator.c
index 2eb6fb2d64..fd8415c148 100644
--- a/source/libs/executor/src/streamtimewindowoperator.c
+++ b/source/libs/executor/src/streamtimewindowoperator.c
@@ -373,8 +373,11 @@ void clearGroupResInfo(SGroupResInfo* pGroupResInfo) {
   if (pGroupResInfo->freeItem) {
     int32_t size = taosArrayGetSize(pGroupResInfo->pRows);
     for (int32_t i = pGroupResInfo->index; i < size; i++) {
-      void* pVal = taosArrayGetP(pGroupResInfo->pRows, i);
-      taosMemoryFree(pVal);
+      SRowBuffPos* pPos = taosArrayGetP(pGroupResInfo->pRows, i);
+      if (!pPos->needFree && !pPos->pRowBuff) {
+        taosMemoryFreeClear(pPos->pKey);
+        taosMemoryFree(pPos);
+      }
     }
     pGroupResInfo->freeItem = false;
   }