From 80586ad997994924f77810c79850d39d14171d41 Mon Sep 17 00:00:00 2001
From: dapan1121 <wpan@taosdata.com>
Date: Mon, 9 Jan 2023 11:33:26 +0800
Subject: [PATCH] fix: invalid free issue

---
 source/dnode/vnode/src/inc/tsdb.h      |  1 +
 source/dnode/vnode/src/tsdb/tsdbUtil.c | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/source/dnode/vnode/src/inc/tsdb.h b/source/dnode/vnode/src/inc/tsdb.h
index 5a2e462c8c..77a3bb7a2f 100644
--- a/source/dnode/vnode/src/inc/tsdb.h
+++ b/source/dnode/vnode/src/inc/tsdb.h
@@ -573,6 +573,7 @@ struct STSDBRowIter {
 struct SRowMerger {
   STSchema *pTSchema;
   int64_t   version;
+  bool      merged;
   SArray   *pArray;  // SArray<SColVal>
 };
 
diff --git a/source/dnode/vnode/src/tsdb/tsdbUtil.c b/source/dnode/vnode/src/tsdb/tsdbUtil.c
index 112fbb61c6..a9c31c19cb 100644
--- a/source/dnode/vnode/src/tsdb/tsdbUtil.c
+++ b/source/dnode/vnode/src/tsdb/tsdbUtil.c
@@ -776,10 +776,12 @@ _exit:
 }
 
 void tRowMergerClear(SRowMerger *pMerger) { 
-  for (int32_t iCol = 1; iCol < pMerger->pTSchema->numOfCols; iCol++) {
-    SColVal *pTColVal = taosArrayGet(pMerger->pArray, iCol);
-    if (IS_VAR_DATA_TYPE(pTColVal->type)) {
-      tFree(pTColVal->value.pData);
+  if (pMerger->merged) {
+    for (int32_t iCol = 1; iCol < pMerger->pTSchema->numOfCols; iCol++) {
+      SColVal *pTColVal = taosArrayGet(pMerger->pArray, iCol);
+      if (IS_VAR_DATA_TYPE(pTColVal->type)) {
+        tFree(pTColVal->value.pData);
+      }
     }
   }
 
@@ -801,6 +803,7 @@ int32_t tRowMerge(SRowMerger *pMerger, TSDBROW *pRow) {
         if (IS_VAR_DATA_TYPE(pColVal->type)) {
           SColVal *pTColVal = taosArrayGet(pMerger->pArray, iCol);
 
+          pTColVal->value.pData = NULL;
           code = tRealloc(&pTColVal->value.pData, pColVal->value.nData);
           if (code) goto _exit;
 
@@ -821,6 +824,7 @@ int32_t tRowMerge(SRowMerger *pMerger, TSDBROW *pRow) {
   }
 
   pMerger->version = key.version;
+  pMerger->merged = true;
 
 _exit:
   return code;