From 62cfda1a88621c29ede0e1f01c8d4f3f3c4c9452 Mon Sep 17 00:00:00 2001
From: Minglei Jin <mljin@taosdata.com>
Date: Mon, 17 Jul 2023 17:35:08 +0800
Subject: [PATCH] tsdb/read2: fix UAF

---
 source/dnode/vnode/src/tsdb/tsdbMergeTree.c | 1 -
 source/dnode/vnode/src/tsdb/tsdbRead2.c     | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/source/dnode/vnode/src/tsdb/tsdbMergeTree.c b/source/dnode/vnode/src/tsdb/tsdbMergeTree.c
index c8672e5b9d..60ba1c2b94 100644
--- a/source/dnode/vnode/src/tsdb/tsdbMergeTree.c
+++ b/source/dnode/vnode/src/tsdb/tsdbMergeTree.c
@@ -426,7 +426,6 @@ int32_t tLDataIterOpen2(struct SLDataIter *pIter, SSttFileReader *pSttFileReader
       return code;
     }
 
-    // code = loadSttTombDataForAll(pReader1, pIter->pReader, pBlockLoadInfo);
     code = loadTombFn(pReader1, pIter->pReader, pBlockLoadInfo);
 
     double el = (taosGetTimestampUs() - st) / 1000.0;
diff --git a/source/dnode/vnode/src/tsdb/tsdbRead2.c b/source/dnode/vnode/src/tsdb/tsdbRead2.c
index a00fafcbf9..c93af0098f 100644
--- a/source/dnode/vnode/src/tsdb/tsdbRead2.c
+++ b/source/dnode/vnode/src/tsdb/tsdbRead2.c
@@ -4928,9 +4928,10 @@ void tsdbUntakeReadSnap2(STsdbReader* pReader, STsdbReadSnap* pSnap, bool proact
     tsdbFSUnref(pTsdb, &pSnap->fs);
     if (pSnap->pNode) taosMemoryFree(pSnap->pNode);
     if (pSnap->pINode) taosMemoryFree(pSnap->pINode);
-    taosMemoryFree(pSnap);
 
     tsdbFSDestroyRefSnapshot(&pSnap->pfSetArray);
+
+    taosMemoryFree(pSnap);
   }
   tsdbTrace("vgId:%d, untake read snapshot", TD_VID(pTsdb->pVnode));
 }