From 51797a45d5ecb05943935b025e5b3570c2439921 Mon Sep 17 00:00:00 2001
From: Hongze Cheng <hzcheng@taosdata.com>
Date: Tue, 21 Jul 2020 15:39:58 +0800
Subject: [PATCH] fix invalid write

---
 src/tsdb/src/tsdbRWHelper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tsdb/src/tsdbRWHelper.c b/src/tsdb/src/tsdbRWHelper.c
index cec3b0d36b..9d0efd0de2 100644
--- a/src/tsdb/src/tsdbRWHelper.c
+++ b/src/tsdb/src/tsdbRWHelper.c
@@ -530,7 +530,7 @@ int tsdbLoadCompIdx(SRWHelper *pHelper, void *target) {
         size_t tlen = tsizeof(pHelper->idxH.pIdxArray);
         pHelper->idxH.numOfIdx++;
 
-        if (tlen < pHelper->idxH.numOfIdx) {
+        if (tlen < pHelper->idxH.numOfIdx * sizoef(SCompIdx)) {
           pHelper->idxH.pIdxArray = (SCompIdx *)trealloc(pHelper->idxH.pIdxArray, (tlen == 0) ? 1024 : tlen * 2);
           if (pHelper->idxH.pIdxArray == NULL) {
             terrno = TSDB_CODE_TDB_OUT_OF_MEMORY;