From 7f2a2cfbd07ded9de79f61c621c2b4f1f969787c Mon Sep 17 00:00:00 2001
From: xsren <285808407@qq.com>
Date: Tue, 8 Oct 2024 14:25:51 +0800
Subject: [PATCH 1/6] enh: safe function

---
 include/os/osString.h                   |   1 +
 source/client/src/clientRawBlockWrite.c |   4 +-
 source/libs/command/src/command.c       | 163 ++++++++++++++++--------
 source/libs/function/src/tudf.c         |   7 +-
 source/libs/function/src/udfd.c         |   2 +-
 source/libs/qcom/src/queryUtil.c        |  26 ++--
 source/libs/qcom/src/querymsg.c         |  16 +--
 7 files changed, 137 insertions(+), 82 deletions(-)

diff --git a/include/os/osString.h b/include/os/osString.h
index 30bfd61b62..b184e7efdb 100644
--- a/include/os/osString.h
+++ b/include/os/osString.h
@@ -68,6 +68,7 @@ typedef enum { M2C = 0, C2M } ConvType;
 #define TAOS_STRCPY(_dst, _src) ((void)strcpy(_dst, _src))
 #define TAOS_STRNCPY(_dst, _src, _size) ((void)strncpy(_dst, _src, _size))
 #define TAOS_STRCAT(_dst, _src) ((void)strcat(_dst, _src))
+#define TAOS_STRNCAT(_dst, _src, len) ((void)strncat(_dst, _src, len))
 
 char   *tstrdup(const char *src);
 int32_t taosUcs4len(TdUcs4 *ucs4);
diff --git a/source/client/src/clientRawBlockWrite.c b/source/client/src/clientRawBlockWrite.c
index 8ce4685716..d2578ac8e0 100644
--- a/source/client/src/clientRawBlockWrite.c
+++ b/source/client/src/clientRawBlockWrite.c
@@ -460,8 +460,10 @@ static void buildChildElement(cJSON* json, SVCreateTbReq* pCreateReq) {
       char* buf = NULL;
       if (pTagVal->type == TSDB_DATA_TYPE_VARBINARY) {
         buf = taosMemoryCalloc(pTagVal->nData * 2 + 2 + 3, 1);
-      } else {
+      } else if (IS_VAR_DATA_TYPE(pTagVal->type)) {
         buf = taosMemoryCalloc(pTagVal->nData + 3, 1);
+      } else {
+        buf = taosMemoryCalloc(32, 1);
       }
 
       RAW_NULL_CHECK(buf);
diff --git a/source/libs/command/src/command.c b/source/libs/command/src/command.c
index d24f830ea7..28ff8e7436 100644
--- a/source/libs/command/src/command.c
+++ b/source/libs/command/src/command.c
@@ -291,7 +291,8 @@ static int32_t buildRetension(SArray* pRetension, char** ppRetentions) {
     return TSDB_CODE_SUCCESS;
   }
 
-  char* p1 = taosMemoryCalloc(1, 100);
+  const int lMaxLen = 128;
+  char* p1 = taosMemoryCalloc(1, lMaxLen);
   if (NULL == p1) {
     return terrno;
   }
@@ -302,13 +303,13 @@ static int32_t buildRetension(SArray* pRetension, char** ppRetentions) {
     int64_t     v1 = getValOfDiffPrecision(p->freqUnit, p->freq);
     int64_t     v2 = getValOfDiffPrecision(p->keepUnit, p->keep);
     if (i == 0) {
-      len += sprintf(p1 + len, "-:%" PRId64 "%c", v2, p->keepUnit);
+      len += snprintf(p1 + len, lMaxLen - len, "-:%" PRId64 "%c", v2, p->keepUnit);
     } else {
-      len += sprintf(p1 + len, "%" PRId64 "%c:%" PRId64 "%c", v1, p->freqUnit, v2, p->keepUnit);
+      len += snprintf(p1 + len, lMaxLen - len, "%" PRId64 "%c:%" PRId64 "%c", v1, p->freqUnit, v2, p->keepUnit);
     }
 
     if (i < size - 1) {
-      len += sprintf(p1 + len, ",");
+      len += snprintf(p1 + len, lMaxLen - len, ",");
     }
   }
 
@@ -345,15 +346,19 @@ static const char* encryptAlgorithmStr(int8_t encryptAlgorithm) {
 }
 
 int32_t formatDurationOrKeep(char* buffer, int32_t timeInMinutes) {
+    if (buffer == NULL) {
+        return 0;
+    }
+    int lMaxLen = 32;
     int32_t len = 0;
     if (timeInMinutes % 1440 == 0) {
         int32_t days = timeInMinutes / 1440;
-        len = sprintf(buffer, "%dd", days);
+        len = snprintf(buffer, lMaxLen,"%dd", days);
     } else if (timeInMinutes % 60 == 0) {
         int32_t hours = timeInMinutes / 60;
-        len = sprintf(buffer, "%dh", hours);
+        len = snprintf(buffer, lMaxLen,"%dh", hours);
     } else {
-        len = sprintf(buffer, "%dm", timeInMinutes);
+        len = snprintf(buffer, lMaxLen,"%dm", timeInMinutes);
     }
     return len;
 }
@@ -406,9 +411,9 @@ static int32_t setCreateDBResultIntoDataBlock(SSDataBlock* pBlock, char* dbName,
   int32_t lenKeep2 = formatDurationOrKeep(keep2Str, pCfg->daysToKeep2);
 
   if (IS_SYS_DBNAME(dbName)) {
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE, "CREATE DATABASE `%s`", dbName);
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE, SHOW_CREATE_DB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE, "CREATE DATABASE `%s`", dbName);
   } else {
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE,
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE, SHOW_CREATE_DB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE,
                    "CREATE DATABASE `%s` BUFFER %d CACHESIZE %d CACHEMODEL '%s' COMP %d DURATION %s "
                    "WAL_FSYNC_PERIOD %d MAXROWS %d MINROWS %d STT_TRIGGER %d KEEP %s,%s,%s PAGES %d PAGESIZE %d "
                    "PRECISION '%s' REPLICA %d "
@@ -426,7 +431,7 @@ static int32_t setCreateDBResultIntoDataBlock(SSDataBlock* pBlock, char* dbName,
                    pCfg->s3KeepLocal, pCfg->s3Compact);
 
     if (pRetentions) {
-      len += sprintf(buf2 + VARSTR_HEADER_SIZE + len, " RETENTIONS %s", pRetentions);
+      len += snprintf(buf2 + VARSTR_HEADER_SIZE + len, SHOW_CREATE_DB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE, " RETENTIONS %s", pRetentions);
     }
   }
 
@@ -503,28 +508,32 @@ static int32_t buildCreateViewResultDataBlock(SSDataBlock** pOutput) {
 void appendColumnFields(char* buf, int32_t* len, STableCfg* pCfg) {
   for (int32_t i = 0; i < pCfg->numOfColumns; ++i) {
     SSchema* pSchema = pCfg->pSchemas + i;
-    char     type[32 + 60];  // 60 byte for compress info
-    sprintf(type, "%s", tDataTypes[pSchema->type].name);
+#define LTYPE_LEN (32 + 60)  // 60 byte for compress info
+    char type[LTYPE_LEN];
+    snprintf(type, LTYPE_LEN, "%s", tDataTypes[pSchema->type].name);
     if (TSDB_DATA_TYPE_VARCHAR == pSchema->type || TSDB_DATA_TYPE_VARBINARY == pSchema->type ||
         TSDB_DATA_TYPE_GEOMETRY == pSchema->type) {
-      sprintf(type + strlen(type), "(%d)", (int32_t)(pSchema->bytes - VARSTR_HEADER_SIZE));
+      snprintf(type + strlen(type), LTYPE_LEN - strlen(type), "(%d)", (int32_t)(pSchema->bytes - VARSTR_HEADER_SIZE));
     } else if (TSDB_DATA_TYPE_NCHAR == pSchema->type) {
-      sprintf(type + strlen(type), "(%d)", (int32_t)((pSchema->bytes - VARSTR_HEADER_SIZE) / TSDB_NCHAR_SIZE));
+      snprintf(type + strlen(type), LTYPE_LEN - strlen(type), "(%d)",
+               (int32_t)((pSchema->bytes - VARSTR_HEADER_SIZE) / TSDB_NCHAR_SIZE));
     }
 
     if (useCompress(pCfg->tableType) && pCfg->pSchemaExt) {
-      sprintf(type + strlen(type), " ENCODE \'%s\'",
-              columnEncodeStr(COMPRESS_L1_TYPE_U32(pCfg->pSchemaExt[i].compress)));
-      sprintf(type + strlen(type), " COMPRESS \'%s\'",
-              columnCompressStr(COMPRESS_L2_TYPE_U32(pCfg->pSchemaExt[i].compress)));
-      sprintf(type + strlen(type), " LEVEL \'%s\'",
-              columnLevelStr(COMPRESS_L2_TYPE_LEVEL_U32(pCfg->pSchemaExt[i].compress)));
+      snprintf(type + strlen(type), LTYPE_LEN - strlen(type), " ENCODE \'%s\'",
+               columnEncodeStr(COMPRESS_L1_TYPE_U32(pCfg->pSchemaExt[i].compress)));
+      snprintf(type + strlen(type), LTYPE_LEN - strlen(type), " COMPRESS \'%s\'",
+               columnCompressStr(COMPRESS_L2_TYPE_U32(pCfg->pSchemaExt[i].compress)));
+      snprintf(type + strlen(type), LTYPE_LEN - strlen(type), " LEVEL \'%s\'",
+               columnLevelStr(COMPRESS_L2_TYPE_LEVEL_U32(pCfg->pSchemaExt[i].compress)));
     }
     if (!(pSchema->flags & COL_IS_KEY)) {
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "%s`%s` %s", ((i > 0) ? ", " : ""), pSchema->name, type);
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len), "%s`%s` %s",
+                       ((i > 0) ? ", " : ""), pSchema->name, type);
     } else {
       char* pk = "PRIMARY KEY";
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "%s`%s` %s %s", ((i > 0) ? ", " : ""), pSchema->name, type, pk);
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len), "%s`%s` %s %s",
+                       ((i > 0) ? ", " : ""), pSchema->name, type, pk);
     }
   }
 }
@@ -533,22 +542,25 @@ void appendTagFields(char* buf, int32_t* len, STableCfg* pCfg) {
   for (int32_t i = 0; i < pCfg->numOfTags; ++i) {
     SSchema* pSchema = pCfg->pSchemas + pCfg->numOfColumns + i;
     char     type[32];
-    sprintf(type, "%s", tDataTypes[pSchema->type].name);
+    snprintf(type, 32, "%s", tDataTypes[pSchema->type].name);
     if (TSDB_DATA_TYPE_VARCHAR == pSchema->type || TSDB_DATA_TYPE_VARBINARY == pSchema->type ||
         TSDB_DATA_TYPE_GEOMETRY == pSchema->type) {
-      sprintf(type + strlen(type), "(%d)", (int32_t)(pSchema->bytes - VARSTR_HEADER_SIZE));
+      snprintf(type + strlen(type), 32 - strlen(type), "(%d)", (int32_t)(pSchema->bytes - VARSTR_HEADER_SIZE));
     } else if (TSDB_DATA_TYPE_NCHAR == pSchema->type) {
-      sprintf(type + strlen(type), "(%d)", (int32_t)((pSchema->bytes - VARSTR_HEADER_SIZE) / TSDB_NCHAR_SIZE));
+      snprintf(type + strlen(type), 32 - strlen(type), "(%d)",
+               (int32_t)((pSchema->bytes - VARSTR_HEADER_SIZE) / TSDB_NCHAR_SIZE));
     }
 
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "%s`%s` %s", ((i > 0) ? ", " : ""), pSchema->name, type);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, 32 - (VARSTR_HEADER_SIZE + *len), "%s`%s` %s",
+                     ((i > 0) ? ", " : ""), pSchema->name, type);
   }
 }
 
 void appendTagNameFields(char* buf, int32_t* len, STableCfg* pCfg) {
   for (int32_t i = 0; i < pCfg->numOfTags; ++i) {
     SSchema* pSchema = pCfg->pSchemas + pCfg->numOfColumns + i;
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "%s`%s`", ((i > 0) ? ", " : ""), pSchema->name);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     "%s`%s`", ((i > 0) ? ", " : ""), pSchema->name);
   }
 }
 
@@ -565,11 +577,12 @@ int32_t appendTagValues(char* buf, int32_t* len, STableCfg* pCfg) {
   if (tTagIsJson(pTag)) {
     char* pJson = NULL;
     parseTagDatatoJson(pTag, &pJson);
-    if(NULL == pJson) {
+    if (NULL == pJson) {
       qError("failed to parse tag to json, pJson is NULL");
       return terrno;
     }
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "%s", pJson);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     "%s", pJson);
     taosMemoryFree(pJson);
 
     return TSDB_CODE_SUCCESS;
@@ -582,11 +595,13 @@ int32_t appendTagValues(char* buf, int32_t* len, STableCfg* pCfg) {
   for (int32_t i = 0; i < pCfg->numOfTags; ++i) {
     SSchema* pSchema = pCfg->pSchemas + pCfg->numOfColumns + i;
     if (i > 0) {
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, ", ");
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       ", ");
     }
 
     if (j >= valueNum) {
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "NULL");
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       "NULL");
       continue;
     }
 
@@ -609,7 +624,8 @@ int32_t appendTagValues(char* buf, int32_t* len, STableCfg* pCfg) {
       *len += tlen;
       j++;
     } else {
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "NULL");
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       "NULL");
     }
   }
 _exit:
@@ -620,37 +636,47 @@ _exit:
 
 void appendTableOptions(char* buf, int32_t* len, SDbCfgInfo* pDbCfg, STableCfg* pCfg) {
   if (pCfg->commentLen > 0) {
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " COMMENT '%s'", pCfg->pComment);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     " COMMENT '%s'", pCfg->pComment);
   } else if (0 == pCfg->commentLen) {
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " COMMENT ''");
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     " COMMENT ''");
   }
 
   if (NULL != pDbCfg->pRetensions && pCfg->watermark1 > 0) {
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " WATERMARK %" PRId64 "a", pCfg->watermark1);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     " WATERMARK %" PRId64 "a", pCfg->watermark1);
     if (pCfg->watermark2 > 0) {
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, ", %" PRId64 "a", pCfg->watermark2);
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       ", %" PRId64 "a", pCfg->watermark2);
     }
   }
 
   if (NULL != pDbCfg->pRetensions && pCfg->delay1 > 0) {
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " MAX_DELAY %" PRId64 "a", pCfg->delay1);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     " MAX_DELAY %" PRId64 "a", pCfg->delay1);
     if (pCfg->delay2 > 0) {
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, ", %" PRId64 "a", pCfg->delay2);
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       ", %" PRId64 "a", pCfg->delay2);
     }
   }
 
   int32_t funcNum = taosArrayGetSize(pCfg->pFuncs);
   if (NULL != pDbCfg->pRetensions && funcNum > 0) {
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " ROLLUP(");
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     " ROLLUP(");
     for (int32_t i = 0; i < funcNum; ++i) {
       char* pFunc = taosArrayGet(pCfg->pFuncs, i);
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "%s%s", ((i > 0) ? ", " : ""), pFunc);
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       "%s%s", ((i > 0) ? ", " : ""), pFunc);
     }
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, ")");
+    *len +=
+        snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len), ")");
   }
 
   if (pCfg->ttl > 0) {
-    *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " TTL %d", pCfg->ttl);
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                     " TTL %d", pCfg->ttl);
   }
 
   if (TSDB_SUPER_TABLE == pCfg->tableType || TSDB_NORMAL_TABLE == pCfg->tableType) {
@@ -663,18 +689,23 @@ void appendTableOptions(char* buf, int32_t* len, SDbCfgInfo* pDbCfg, STableCfg*
 
     if (nSma < pCfg->numOfColumns && nSma > 0) {
       bool smaOn = false;
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, " SMA(");
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len),
+                       " SMA(");
       for (int32_t i = 0; i < pCfg->numOfColumns; ++i) {
         if (IS_BSMA_ON(pCfg->pSchemas + i)) {
           if (smaOn) {
-            *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, ",`%s`", (pCfg->pSchemas + i)->name);
+            *len += snprintf(buf + VARSTR_HEADER_SIZE + *len,
+                             SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len), ",`%s`",
+                             (pCfg->pSchemas + i)->name);
           } else {
             smaOn = true;
-            *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, "`%s`", (pCfg->pSchemas + i)->name);
+            *len += snprintf(buf + VARSTR_HEADER_SIZE + *len,
+                             SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len), "`%s`",
+                             (pCfg->pSchemas + i)->name);
           }
         }
       }
-      *len += sprintf(buf + VARSTR_HEADER_SIZE + *len, ")");
+      *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE, ")");
     }
   }
 }
@@ -698,24 +729,32 @@ static int32_t setCreateTBResultIntoDataBlock(SSDataBlock* pBlock, SDbCfgInfo* p
   int32_t len = 0;
 
   if (TSDB_SUPER_TABLE == pCfg->tableType) {
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE, "CREATE STABLE `%s` (", tbName);
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE, SHOW_CREATE_TB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE,
+                    "CREATE STABLE `%s` (", tbName);
     appendColumnFields(buf2, &len, pCfg);
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE + len, ") TAGS (");
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE + len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + len),
+                    ") TAGS (");
     appendTagFields(buf2, &len, pCfg);
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE + len, ")");
+    len +=
+        snprintf(buf2 + VARSTR_HEADER_SIZE + len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + len), ")");
     appendTableOptions(buf2, &len, pDbCfg, pCfg);
   } else if (TSDB_CHILD_TABLE == pCfg->tableType) {
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE, "CREATE TABLE `%s` USING `%s` (", tbName, pCfg->stbName);
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE, SHOW_CREATE_TB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE,
+                    "CREATE TABLE `%s` USING `%s` (", tbName, pCfg->stbName);
     appendTagNameFields(buf2, &len, pCfg);
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE + len, ") TAGS (");
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE + len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + len),
+                    ") TAGS (");
     code = appendTagValues(buf2, &len, pCfg);
     TAOS_CHECK_ERRNO(code);
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE + len, ")");
+    len +=
+        snprintf(buf2 + VARSTR_HEADER_SIZE + len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + len), ")");
     appendTableOptions(buf2, &len, pDbCfg, pCfg);
   } else {
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE, "CREATE TABLE `%s` (", tbName);
+    len += snprintf(buf2 + VARSTR_HEADER_SIZE, SHOW_CREATE_TB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE,
+                    "CREATE TABLE `%s` (", tbName);
     appendColumnFields(buf2, &len, pCfg);
-    len += sprintf(buf2 + VARSTR_HEADER_SIZE + len, ")");
+    len +=
+        snprintf(buf2 + VARSTR_HEADER_SIZE + len, SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + len), ")");
     appendTableOptions(buf2, &len, pDbCfg, pCfg);
   }
 
@@ -792,9 +831,21 @@ static int32_t execAlterCmd(char* cmd, char* value, bool* processed) {
     taosResetLog();
     cfgDumpCfg(tsCfg, 0, false);
   } else if (0 == strcasecmp(cmd, COMMAND_SCHEDULE_POLICY)) {
-    code = schedulerUpdatePolicy(atoi(value));
+    int32_t tmp = 0;
+    code = taosStr2int32(value, &tmp);
+    if (code) {
+      qError("invalid value:%s, error:%s", value, tstrerror(code));
+      return code;
+    }
+    code = schedulerUpdatePolicy(tmp);
   } else if (0 == strcasecmp(cmd, COMMAND_ENABLE_RESCHEDULE)) {
-    code = schedulerEnableReSchedule(atoi(value));
+    int32_t tmp = 0;
+    code = taosStr2int32(value, &tmp);
+    if (code) {
+      qError("invalid value:%s, error:%s", value, tstrerror(code));
+      return code;
+    }
+    code = schedulerEnableReSchedule(tmp != 0);
   } else if (0 == strcasecmp(cmd, COMMAND_CATALOG_DEBUG)) {
     code = ctgdHandleDbgCommand(value);
   } else if (0 == strcasecmp(cmd, COMMAND_ENABLE_MEM_DEBUG)) {
diff --git a/source/libs/function/src/tudf.c b/source/libs/function/src/tudf.c
index ffdd4ea500..bc8237992d 100644
--- a/source/libs/function/src/tudf.c
+++ b/source/libs/function/src/tudf.c
@@ -158,10 +158,11 @@ static int32_t udfSpawnUdfd(SUdfdData *pData) {
   char *taosFqdnEnvItem = NULL;
   char *taosFqdn = getenv("TAOS_FQDN");
   if (taosFqdn != NULL) {
-    taosFqdnEnvItem = taosMemoryMalloc(strlen("TAOS_FQDN=") + strlen(taosFqdn) + 1);
+    int len = strlen("TAOS_FQDN=") + strlen(taosFqdn) + 1;
+    taosFqdnEnvItem = taosMemoryMalloc(len);
     if (taosFqdnEnvItem != NULL) {
-      strcpy(taosFqdnEnvItem, "TAOS_FQDN=");
-      TAOS_STRCAT(taosFqdnEnvItem, taosFqdn);
+      TAOS_STRNCPY(taosFqdnEnvItem, "TAOS_FQDN=", len);
+      TAOS_STRNCAT(taosFqdnEnvItem, taosFqdn, strlen(taosFqdn));
       fnInfo("[UDFD]Succsess to set TAOS_FQDN:%s", taosFqdn);
     } else {
       fnError("[UDFD]Failed to allocate memory for TAOS_FQDN");
diff --git a/source/libs/function/src/udfd.c b/source/libs/function/src/udfd.c
index e1dfd686d4..255cf1a4de 100644
--- a/source/libs/function/src/udfd.c
+++ b/source/libs/function/src/udfd.c
@@ -396,7 +396,7 @@ int32_t udfdLoadSharedLib(char *libPath, uv_lib_t *pLib, const char *funcName[],
 int32_t udfdInitializePythonPlugin(SUdfScriptPlugin *plugin) {
   plugin->scriptType = TSDB_FUNC_SCRIPT_PYTHON;
   // todo: windows support
-  sprintf(plugin->libPath, "%s", "libtaospyudf.so");
+  snprintf(plugin->libPath, PATH_MAX, "%s", "libtaospyudf.so");
   plugin->libLoaded = false;
   const char *funcName[UDFD_MAX_PLUGIN_FUNCS] = {"pyOpen",         "pyClose",         "pyUdfInit",
                                                  "pyUdfDestroy",   "pyUdfScalarProc", "pyUdfAggStart",
diff --git a/source/libs/qcom/src/queryUtil.c b/source/libs/qcom/src/queryUtil.c
index ff20211af2..dfc2596a29 100644
--- a/source/libs/qcom/src/queryUtil.c
+++ b/source/libs/qcom/src/queryUtil.c
@@ -313,42 +313,42 @@ void destroyQueryExecRes(SExecResult* pRes) {
   }
 }
 // clang-format on
-
+#define MAX_NUMERICAL_LENGTH (32)
 int32_t dataConverToStr(char* str, int type, void* buf, int32_t bufSize, int32_t* len) {
   int32_t n = 0;
 
   switch (type) {
     case TSDB_DATA_TYPE_NULL:
-      n = sprintf(str, "null");
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "null");
       break;
 
     case TSDB_DATA_TYPE_BOOL:
-      n = sprintf(str, (*(int8_t*)buf) ? "true" : "false");
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, (*(int8_t*)buf) ? "true" : "false");
       break;
 
     case TSDB_DATA_TYPE_TINYINT:
-      n = sprintf(str, "%d", *(int8_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(int8_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_SMALLINT:
-      n = sprintf(str, "%d", *(int16_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(int16_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_INT:
-      n = sprintf(str, "%d", *(int32_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(int32_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_BIGINT:
     case TSDB_DATA_TYPE_TIMESTAMP:
-      n = sprintf(str, "%" PRId64, *(int64_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%" PRId64, *(int64_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_FLOAT:
-      n = sprintf(str, "%e", GET_FLOAT_VAL(buf));
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%e", GET_FLOAT_VAL(buf));
       break;
 
     case TSDB_DATA_TYPE_DOUBLE:
-      n = sprintf(str, "%e", GET_DOUBLE_VAL(buf));
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%e", GET_DOUBLE_VAL(buf));
       break;
 
     case TSDB_DATA_TYPE_VARBINARY: {
@@ -395,19 +395,19 @@ int32_t dataConverToStr(char* str, int type, void* buf, int32_t bufSize, int32_t
       n = length + 2;
       break;
     case TSDB_DATA_TYPE_UTINYINT:
-      n = sprintf(str, "%d", *(uint8_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(uint8_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_USMALLINT:
-      n = sprintf(str, "%d", *(uint16_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(uint16_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_UINT:
-      n = sprintf(str, "%u", *(uint32_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%u", *(uint32_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_UBIGINT:
-      n = sprintf(str, "%" PRIu64, *(uint64_t*)buf);
+      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%" PRIu64, *(uint64_t*)buf);
       break;
 
     default:
diff --git a/source/libs/qcom/src/querymsg.c b/source/libs/qcom/src/querymsg.c
index 542e549d40..a3abadec01 100644
--- a/source/libs/qcom/src/querymsg.c
+++ b/source/libs/qcom/src/querymsg.c
@@ -688,14 +688,14 @@ int32_t queryProcessTableMetaRsp(void *output, char *msg, int32_t msgSize) {
   }
 
   STableMetaOutput *pOut = output;
-  strcpy(pOut->dbFName, metaRsp.dbFName);
+  strncpy(pOut->dbFName, metaRsp.dbFName, TSDB_DB_FNAME_LEN);
   pOut->dbId = metaRsp.dbId;
 
   if (metaRsp.tableType == TSDB_CHILD_TABLE) {
     SET_META_TYPE_BOTH_TABLE(pOut->metaType);
 
-    strcpy(pOut->ctbName, metaRsp.tbName);
-    strcpy(pOut->tbName, metaRsp.stbName);
+    strncpy(pOut->ctbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
+    strncpy(pOut->tbName, metaRsp.stbName, TSDB_TABLE_NAME_LEN);
 
     pOut->ctbMeta.vgId = metaRsp.vgId;
     pOut->ctbMeta.tableType = metaRsp.tableType;
@@ -705,7 +705,7 @@ int32_t queryProcessTableMetaRsp(void *output, char *msg, int32_t msgSize) {
     code = queryCreateTableMetaFromMsg(&metaRsp, true, &pOut->tbMeta);
   } else {
     SET_META_TYPE_TABLE(pOut->metaType);
-    strcpy(pOut->tbName, metaRsp.tbName);
+    strncpy(pOut->tbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
     code = queryCreateTableMetaFromMsg(&metaRsp, (metaRsp.tableType == TSDB_SUPER_TABLE), &pOut->tbMeta);
   }
 
@@ -744,14 +744,14 @@ static int32_t queryProcessTableNameRsp(void *output, char *msg, int32_t msgSize
   }
 
   STableMetaOutput *pOut = output;
-  strcpy(pOut->dbFName, metaRsp.dbFName);
+  strncpy(pOut->dbFName, metaRsp.dbFName, TSDB_DB_FNAME_LEN);
   pOut->dbId = metaRsp.dbId;
 
   if (metaRsp.tableType == TSDB_CHILD_TABLE) {
     SET_META_TYPE_BOTH_TABLE(pOut->metaType);
 
-    strcpy(pOut->ctbName, metaRsp.tbName);
-    strcpy(pOut->tbName, metaRsp.stbName);
+    strncpy(pOut->ctbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
+    strncpy(pOut->tbName, metaRsp.stbName, TSDB_TABLE_NAME_LEN);
 
     pOut->ctbMeta.vgId = metaRsp.vgId;
     pOut->ctbMeta.tableType = metaRsp.tableType;
@@ -761,7 +761,7 @@ static int32_t queryProcessTableNameRsp(void *output, char *msg, int32_t msgSize
     code = queryCreateTableMetaExFromMsg(&metaRsp, true, &pOut->tbMeta);
   } else {
     SET_META_TYPE_TABLE(pOut->metaType);
-    strcpy(pOut->tbName, metaRsp.tbName);
+    strncpy(pOut->tbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
     code = queryCreateTableMetaExFromMsg(&metaRsp, (metaRsp.tableType == TSDB_SUPER_TABLE), &pOut->tbMeta);
   }
 

From 8acdbe597d4305037361bcd35992a53bec577554 Mon Sep 17 00:00:00 2001
From: Jing Sima <simondominic9997@outlook.com>
Date: Mon, 30 Sep 2024 11:16:42 +0800
Subject: [PATCH 2/6] fix:[TD-32372] Clean up in a right way.

---
 source/libs/executor/inc/executorInt.h        |  3 ++
 source/libs/executor/src/aggregateoperator.c  | 40 ++++++++++++++++++-
 source/libs/executor/src/timewindowoperator.c | 21 +++++-----
 3 files changed, 50 insertions(+), 14 deletions(-)

diff --git a/source/libs/executor/inc/executorInt.h b/source/libs/executor/inc/executorInt.h
index e391d274e3..572ff88be9 100644
--- a/source/libs/executor/inc/executorInt.h
+++ b/source/libs/executor/inc/executorInt.h
@@ -833,6 +833,9 @@ void     cleanupResultInfoInStream(SExecTaskInfo* pTaskInfo, void* pState, SExpr
                                    SGroupResInfo* pGroupResInfo);
 void     cleanupResultInfo(SExecTaskInfo* pTaskInfo, SExprSupp* pSup, SDiskbasedBuf* pBuf,
                           SGroupResInfo* pGroupResInfo, SSHashObj* pHashmap);
+void     cleanupResultInfoWithoutHash(SExecTaskInfo* pTaskInfo, SExprSupp* pSup, SDiskbasedBuf* pBuf,
+                                      SGroupResInfo* pGroupResInfo);
+
 int32_t initAggSup(SExprSupp* pSup, SAggSupporter* pAggSup, SExprInfo* pExprInfo, int32_t numOfCols, size_t keyBufSize,
                    const char* pkey, void* pState, SFunctionStateStore* pStore);
 void    cleanupAggSup(SAggSupporter* pAggSup);
diff --git a/source/libs/executor/src/aggregateoperator.c b/source/libs/executor/src/aggregateoperator.c
index 9e5ad132f7..91b435fbec 100644
--- a/source/libs/executor/src/aggregateoperator.c
+++ b/source/libs/executor/src/aggregateoperator.c
@@ -159,8 +159,8 @@ void destroyAggOperatorInfo(void* param) {
   cleanupBasicInfo(&pInfo->binfo);
 
   if (pInfo->pOperator) {
-    cleanupResultInfo(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
-                      &pInfo->groupResInfo, pInfo->aggSup.pResultRowHashTable);
+    cleanupResultInfoWithoutHash(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
+                                 &pInfo->groupResInfo);
     pInfo->pOperator = NULL;
   }
   cleanupAggSup(&pInfo->aggSup);
@@ -627,6 +627,42 @@ void cleanupResultInfoInStream(SExecTaskInfo* pTaskInfo, void* pState, SExprSupp
   }
 }
 
+void cleanupResultInfoWithoutHash(SExecTaskInfo* pTaskInfo, SExprSupp* pSup, SDiskbasedBuf* pBuf,
+                                  SGroupResInfo* pGroupResInfo) {
+  int32_t         numOfExprs = pSup->numOfExprs;
+  int32_t*        rowEntryOffset = pSup->rowEntryInfoOffset;
+  SqlFunctionCtx* pCtx = pSup->pCtx;
+  int32_t         numOfRows = getNumOfTotalRes(pGroupResInfo);
+  bool            needCleanup = false;
+
+  for (int32_t j = 0; j < numOfExprs; ++j) {
+    needCleanup |= pCtx[j].needCleanup;
+  }
+  if (!needCleanup) {
+    return;
+  }
+
+  for (int32_t i = pGroupResInfo->index; i < numOfRows; i += 1) {
+    SResultRow*        pRow = NULL;
+    SResKeyPos*        pPos = taosArrayGetP(pGroupResInfo->pRows, i);
+    SFilePage*         page = getBufPage(pBuf, pPos->pos.pageId);
+    if (page == NULL) {
+      qError("failed to get buffer, code:%s, %s", tstrerror(terrno), GET_TASKID(pTaskInfo));
+      continue;
+    }
+    pRow = (SResultRow*)((char*)page + pPos->pos.offset);
+
+
+    for (int32_t j = 0; j < numOfExprs; ++j) {
+      pCtx[j].resultInfo = getResultEntryInfo(pRow, j, rowEntryOffset);
+      if (pCtx[j].fpSet.cleanup) {
+        pCtx[j].fpSet.cleanup(&pCtx[j]);
+      }
+    }
+    releaseBufPage(pBuf, page);
+  }
+}
+
 void cleanupResultInfo(SExecTaskInfo* pTaskInfo, SExprSupp* pSup, SDiskbasedBuf* pBuf,
                        SGroupResInfo* pGroupResInfo, SSHashObj* pHashmap) {
   int32_t         numOfExprs = pSup->numOfExprs;
diff --git a/source/libs/executor/src/timewindowoperator.c b/source/libs/executor/src/timewindowoperator.c
index 8164281871..3817ef5b69 100644
--- a/source/libs/executor/src/timewindowoperator.c
+++ b/source/libs/executor/src/timewindowoperator.c
@@ -1229,10 +1229,9 @@ static void destroyStateWindowOperatorInfo(void* param) {
   SStateWindowOperatorInfo* pInfo = (SStateWindowOperatorInfo*)param;
   cleanupBasicInfo(&pInfo->binfo);
   taosMemoryFreeClear(pInfo->stateKey.pData);
-
-  if (pInfo->pOperator != NULL) {
-    cleanupResultInfo(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
-                      &pInfo->groupResInfo, pInfo->aggSup.pResultRowHashTable);
+  if (pInfo->pOperator) {
+    cleanupResultInfoWithoutHash(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
+                                 &pInfo->groupResInfo);
     pInfo->pOperator = NULL;
   }
 
@@ -1257,10 +1256,9 @@ void destroyIntervalOperatorInfo(void* param) {
   SIntervalAggOperatorInfo* pInfo = (SIntervalAggOperatorInfo*)param;
 
   cleanupBasicInfo(&pInfo->binfo);
-
-  if (pInfo->pOperator != NULL) {
-    cleanupResultInfo(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
-                      &pInfo->groupResInfo, pInfo->aggSup.pResultRowHashTable);
+  if (pInfo->pOperator) {
+    cleanupResultInfoWithoutHash(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
+                                 &pInfo->groupResInfo);
     pInfo->pOperator = NULL;
   }
 
@@ -1764,10 +1762,9 @@ void destroySWindowOperatorInfo(void* param) {
 
   cleanupBasicInfo(&pInfo->binfo);
   colDataDestroy(&pInfo->twAggSup.timeWindowData);
-
-  if (pInfo->pOperator != NULL) {
-    cleanupResultInfo(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
-                      &pInfo->groupResInfo, pInfo->aggSup.pResultRowHashTable);
+  if (pInfo->pOperator) {
+    cleanupResultInfoWithoutHash(pInfo->pOperator->pTaskInfo, &pInfo->pOperator->exprSupp, pInfo->aggSup.pResultBuf,
+                                 &pInfo->groupResInfo);
     pInfo->pOperator = NULL;
   }
 

From e88a8317afeda7c469338a59dc08b28b5f510ea4 Mon Sep 17 00:00:00 2001
From: xsren <285808407@qq.com>
Date: Wed, 9 Oct 2024 09:45:56 +0800
Subject: [PATCH 3/6] fix: buff size

---
 include/libs/command/command.h          |  2 +-
 include/libs/qcom/query.h               |  2 +-
 source/client/src/clientRawBlockWrite.c | 18 ++++++-----
 source/dnode/mnode/impl/src/mndDb.c     |  8 ++---
 source/libs/command/src/command.c       | 41 ++++++++++++++-----------
 source/libs/function/src/tudf.c         |  2 +-
 source/libs/qcom/src/queryUtil.c        | 27 ++++++++--------
 7 files changed, 53 insertions(+), 47 deletions(-)

diff --git a/include/libs/command/command.h b/include/libs/command/command.h
index 284f54e5ae..9fb2ca40b9 100644
--- a/include/libs/command/command.h
+++ b/include/libs/command/command.h
@@ -29,6 +29,6 @@ int32_t qExecExplainBegin(SQueryPlan *pDag, SExplainCtx **pCtx, int64_t startTs)
 int32_t qExecExplainEnd(SExplainCtx *pCtx, SRetrieveTableRsp **pRsp);
 int32_t qExplainUpdateExecInfo(SExplainCtx *pCtx, SExplainRsp *pRspMsg, int32_t groupId, SRetrieveTableRsp **pRsp);
 void    qExplainFreeCtx(SExplainCtx *pCtx);
-int32_t formatDurationOrKeep(char* buffer, int32_t timeInMinutes);
+int32_t formatDurationOrKeep(char* buffer, int64_t bufSize, int32_t timeInMinutes);
 
 #endif
diff --git a/include/libs/qcom/query.h b/include/libs/qcom/query.h
index bcb1aa90d1..e0c7ff9a20 100644
--- a/include/libs/qcom/query.h
+++ b/include/libs/qcom/query.h
@@ -336,7 +336,7 @@ char*   jobTaskStatusStr(int32_t status);
 SSchema createSchema(int8_t type, int32_t bytes, col_id_t colId, const char* name);
 
 void    destroyQueryExecRes(SExecResult* pRes);
-int32_t dataConverToStr(char* str, int type, void* buf, int32_t bufSize, int32_t* len);
+int32_t dataConverToStr(char* str, int64_t capacity, int type, void* buf, int32_t bufSize, int32_t* len);
 void    parseTagDatatoJson(void* p, char** jsonStr);
 int32_t cloneTableMeta(STableMeta* pSrc, STableMeta** pDst);
 void    getColumnTypeFromMeta(STableMeta* pMeta, char* pName, ETableColumnType* pType);
diff --git a/source/client/src/clientRawBlockWrite.c b/source/client/src/clientRawBlockWrite.c
index d2578ac8e0..0804771a1b 100644
--- a/source/client/src/clientRawBlockWrite.c
+++ b/source/client/src/clientRawBlockWrite.c
@@ -458,17 +458,17 @@ static void buildChildElement(cJSON* json, SVCreateTbReq* pCreateReq) {
     cJSON* tvalue = NULL;
     if (IS_VAR_DATA_TYPE(pTagVal->type)) {
       char* buf = NULL;
+      int64_t bufSize = 0;
       if (pTagVal->type == TSDB_DATA_TYPE_VARBINARY) {
-        buf = taosMemoryCalloc(pTagVal->nData * 2 + 2 + 3, 1);
-      } else if (IS_VAR_DATA_TYPE(pTagVal->type)) {
-        buf = taosMemoryCalloc(pTagVal->nData + 3, 1);
+        bufSize = pTagVal->nData * 2 + 2 + 3;
       } else {
-        buf = taosMemoryCalloc(32, 1);
+        bufSize = pTagVal->nData + 3;
       }
+      buf = taosMemoryCalloc(bufSize, 1);
 
       RAW_NULL_CHECK(buf);
       if (!buf) goto end;
-      if (dataConverToStr(buf, pTagVal->type, pTagVal->pData, pTagVal->nData, NULL) != TSDB_CODE_SUCCESS) {
+      if (dataConverToStr(buf, bufSize, pTagVal->type, pTagVal->pData, pTagVal->nData, NULL) != TSDB_CODE_SUCCESS) {
         taosMemoryFree(buf);
         goto end;
       }
@@ -738,13 +738,15 @@ static void processAlterTable(SMqMetaRsp* metaRsp, cJSON** pJson) {
             goto end;
           }
         } else {
+          int64_t bufSize = 0;
           if (vAlterTbReq.tagType == TSDB_DATA_TYPE_VARBINARY) {
-            buf = taosMemoryCalloc(vAlterTbReq.nTagVal * 2 + 2 + 3, 1);
+            bufSize = vAlterTbReq.nTagVal * 2 + 2 + 3;
           } else {
-            buf = taosMemoryCalloc(vAlterTbReq.nTagVal + 3, 1);
+            bufSize = vAlterTbReq.nTagVal + 3;
           }
+          buf = taosMemoryCalloc(bufSize, 1);
           RAW_NULL_CHECK(buf);
-          if (dataConverToStr(buf, vAlterTbReq.tagType, vAlterTbReq.pTagVal, vAlterTbReq.nTagVal, NULL) !=
+          if (dataConverToStr(buf, bufSize, vAlterTbReq.tagType, vAlterTbReq.pTagVal, vAlterTbReq.nTagVal, NULL) !=
               TSDB_CODE_SUCCESS) {
             taosMemoryFree(buf);
             goto end;
diff --git a/source/dnode/mnode/impl/src/mndDb.c b/source/dnode/mnode/impl/src/mndDb.c
index 0403029f74..7c42564f4c 100644
--- a/source/dnode/mnode/impl/src/mndDb.c
+++ b/source/dnode/mnode/impl/src/mndDb.c
@@ -2366,7 +2366,7 @@ static void mndDumpDbInfoData(SMnode *pMnode, SSDataBlock *pBlock, SDbObj *pDb,
     TAOS_CHECK_GOTO(colDataSetVal(pColInfo, rows, (const char *)strictVstr, false), &lino, _OVER);
 
     char    durationVstr[128] = {0};
-    int32_t len = formatDurationOrKeep(&durationVstr[VARSTR_HEADER_SIZE], pDb->cfg.daysPerFile);
+    int32_t len = formatDurationOrKeep(&durationVstr[VARSTR_HEADER_SIZE], sizeof(durationVstr) - VARSTR_HEADER_SIZE, pDb->cfg.daysPerFile);
 
     varDataSetLen(durationVstr, len);
     pColInfo = taosArrayGet(pBlock->pDataBlock, cols++);
@@ -2377,9 +2377,9 @@ static void mndDumpDbInfoData(SMnode *pMnode, SSDataBlock *pBlock, SDbObj *pDb,
     char keep1Str[128] = {0};
     char keep2Str[128] = {0};
 
-    int32_t lenKeep0 = formatDurationOrKeep(keep0Str, pDb->cfg.daysToKeep0);
-    int32_t lenKeep1 = formatDurationOrKeep(keep1Str, pDb->cfg.daysToKeep1);
-    int32_t lenKeep2 = formatDurationOrKeep(keep2Str, pDb->cfg.daysToKeep2);
+    int32_t lenKeep0 = formatDurationOrKeep(keep0Str, sizeof(keep0Str), pDb->cfg.daysToKeep0);
+    int32_t lenKeep1 = formatDurationOrKeep(keep1Str, sizeof(keep1Str), pDb->cfg.daysToKeep1);
+    int32_t lenKeep2 = formatDurationOrKeep(keep2Str, sizeof(keep2Str), pDb->cfg.daysToKeep2);
 
     if (pDb->cfg.daysToKeep0 > pDb->cfg.daysToKeep1 || pDb->cfg.daysToKeep0 > pDb->cfg.daysToKeep2) {
         len = sprintf(&keepVstr[VARSTR_HEADER_SIZE], "%s,%s,%s", keep1Str, keep2Str, keep0Str);
diff --git a/source/libs/command/src/command.c b/source/libs/command/src/command.c
index 28ff8e7436..1ab568905f 100644
--- a/source/libs/command/src/command.c
+++ b/source/libs/command/src/command.c
@@ -345,20 +345,19 @@ static const char* encryptAlgorithmStr(int8_t encryptAlgorithm) {
   return TSDB_CACHE_MODEL_NONE_STR;
 }
 
-int32_t formatDurationOrKeep(char* buffer, int32_t timeInMinutes) {
-    if (buffer == NULL) {
+int32_t formatDurationOrKeep(char* buffer, int64_t bufSize, int32_t timeInMinutes) {
+    if (buffer == NULL || bufSize <= 0) {
         return 0;
     }
-    int lMaxLen = 32;
     int32_t len = 0;
     if (timeInMinutes % 1440 == 0) {
-        int32_t days = timeInMinutes / 1440;
-        len = snprintf(buffer, lMaxLen,"%dd", days);
+      int32_t days = timeInMinutes / 1440;
+      len = snprintf(buffer, bufSize, "%dd", days);
     } else if (timeInMinutes % 60 == 0) {
-        int32_t hours = timeInMinutes / 60;
-        len = snprintf(buffer, lMaxLen,"%dh", hours);
+      int32_t hours = timeInMinutes / 60;
+      len = snprintf(buffer, bufSize, "%dh", hours);
     } else {
-        len = snprintf(buffer, lMaxLen,"%dm", timeInMinutes);
+      len = snprintf(buffer, bufSize, "%dm", timeInMinutes);
     }
     return len;
 }
@@ -405,10 +404,10 @@ static int32_t setCreateDBResultIntoDataBlock(SSDataBlock* pBlock, char* dbName,
   char keep1Str[128] = {0};
   char keep2Str[128] = {0};
 
-  int32_t lenDuration = formatDurationOrKeep(durationStr, pCfg->daysPerFile);
-  int32_t lenKeep0 = formatDurationOrKeep(keep0Str, pCfg->daysToKeep0);
-  int32_t lenKeep1 = formatDurationOrKeep(keep1Str, pCfg->daysToKeep1);
-  int32_t lenKeep2 = formatDurationOrKeep(keep2Str, pCfg->daysToKeep2);
+  int32_t lenDuration = formatDurationOrKeep(durationStr, sizeof(durationStr), pCfg->daysPerFile);
+  int32_t lenKeep0 = formatDurationOrKeep(keep0Str, sizeof(keep0Str), pCfg->daysToKeep0);
+  int32_t lenKeep1 = formatDurationOrKeep(keep1Str, sizeof(keep1Str), pCfg->daysToKeep1);
+  int32_t lenKeep2 = formatDurationOrKeep(keep2Str, sizeof(keep2Str), pCfg->daysToKeep2);
 
   if (IS_SYS_DBNAME(dbName)) {
     len += snprintf(buf2 + VARSTR_HEADER_SIZE, SHOW_CREATE_DB_RESULT_FIELD2_LEN - VARSTR_HEADER_SIZE, "CREATE DATABASE `%s`", dbName);
@@ -542,16 +541,16 @@ void appendTagFields(char* buf, int32_t* len, STableCfg* pCfg) {
   for (int32_t i = 0; i < pCfg->numOfTags; ++i) {
     SSchema* pSchema = pCfg->pSchemas + pCfg->numOfColumns + i;
     char     type[32];
-    snprintf(type, 32, "%s", tDataTypes[pSchema->type].name);
+    snprintf(type, sizeof(type), "%s", tDataTypes[pSchema->type].name);
     if (TSDB_DATA_TYPE_VARCHAR == pSchema->type || TSDB_DATA_TYPE_VARBINARY == pSchema->type ||
         TSDB_DATA_TYPE_GEOMETRY == pSchema->type) {
-      snprintf(type + strlen(type), 32 - strlen(type), "(%d)", (int32_t)(pSchema->bytes - VARSTR_HEADER_SIZE));
+      snprintf(type + strlen(type), sizeof(type) - strlen(type), "(%d)", (int32_t)(pSchema->bytes - VARSTR_HEADER_SIZE));
     } else if (TSDB_DATA_TYPE_NCHAR == pSchema->type) {
-      snprintf(type + strlen(type), 32 - strlen(type), "(%d)",
+      snprintf(type + strlen(type), sizeof(type) - strlen(type), "(%d)",
                (int32_t)((pSchema->bytes - VARSTR_HEADER_SIZE) / TSDB_NCHAR_SIZE));
     }
 
-    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, 32 - (VARSTR_HEADER_SIZE + *len), "%s`%s` %s",
+    *len += snprintf(buf + VARSTR_HEADER_SIZE + *len, sizeof(type) - (VARSTR_HEADER_SIZE + *len), "%s`%s` %s",
                      ((i > 0) ? ", " : ""), pSchema->name, type);
   }
 }
@@ -614,11 +613,17 @@ int32_t appendTagValues(char* buf, int32_t* len, STableCfg* pCfg) {
       char    type = pTagVal->type;
       int32_t tlen = 0;
 
+      int64_t leftSize = SHOW_CREATE_TB_RESULT_FIELD2_LEN - (VARSTR_HEADER_SIZE + *len);
+      if (leftSize <= 0) {
+        qError("no enough space to store tag value, leftSize:%" PRId64, leftSize);
+        code = TSDB_CODE_APP_ERROR;
+        TAOS_CHECK_ERRNO(code);
+      }
       if (IS_VAR_DATA_TYPE(type)) {
-        code = dataConverToStr(buf + VARSTR_HEADER_SIZE + *len, type, pTagVal->pData, pTagVal->nData, &tlen);
+        code = dataConverToStr(buf + VARSTR_HEADER_SIZE + *len, leftSize, type, pTagVal->pData, pTagVal->nData, &tlen);
         TAOS_CHECK_ERRNO(code);
       } else {
-        code = dataConverToStr(buf + VARSTR_HEADER_SIZE + *len, type, &pTagVal->i64, tDataTypes[type].bytes, &tlen);
+        code = dataConverToStr(buf + VARSTR_HEADER_SIZE + *len, leftSize, type, &pTagVal->i64, tDataTypes[type].bytes, &tlen);
         TAOS_CHECK_ERRNO(code);
       }
       *len += tlen;
diff --git a/source/libs/function/src/tudf.c b/source/libs/function/src/tudf.c
index bc8237992d..74a1919850 100644
--- a/source/libs/function/src/tudf.c
+++ b/source/libs/function/src/tudf.c
@@ -161,7 +161,7 @@ static int32_t udfSpawnUdfd(SUdfdData *pData) {
     int len = strlen("TAOS_FQDN=") + strlen(taosFqdn) + 1;
     taosFqdnEnvItem = taosMemoryMalloc(len);
     if (taosFqdnEnvItem != NULL) {
-      TAOS_STRNCPY(taosFqdnEnvItem, "TAOS_FQDN=", len);
+      tstrncpy(taosFqdnEnvItem, "TAOS_FQDN=", len);
       TAOS_STRNCAT(taosFqdnEnvItem, taosFqdn, strlen(taosFqdn));
       fnInfo("[UDFD]Succsess to set TAOS_FQDN:%s", taosFqdn);
     } else {
diff --git a/source/libs/qcom/src/queryUtil.c b/source/libs/qcom/src/queryUtil.c
index dfc2596a29..7d6b0f99a1 100644
--- a/source/libs/qcom/src/queryUtil.c
+++ b/source/libs/qcom/src/queryUtil.c
@@ -313,42 +313,41 @@ void destroyQueryExecRes(SExecResult* pRes) {
   }
 }
 // clang-format on
-#define MAX_NUMERICAL_LENGTH (32)
-int32_t dataConverToStr(char* str, int type, void* buf, int32_t bufSize, int32_t* len) {
+int32_t dataConverToStr(char* str, int64_t capacity, int type, void* buf, int32_t bufSize, int32_t* len) {
   int32_t n = 0;
 
   switch (type) {
     case TSDB_DATA_TYPE_NULL:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "null");
+      n = snprintf(str, capacity, "null");
       break;
 
     case TSDB_DATA_TYPE_BOOL:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, (*(int8_t*)buf) ? "true" : "false");
+      n = snprintf(str, capacity, (*(int8_t*)buf) ? "true" : "false");
       break;
 
     case TSDB_DATA_TYPE_TINYINT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(int8_t*)buf);
+      n = snprintf(str, capacity, "%d", *(int8_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_SMALLINT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(int16_t*)buf);
+      n = snprintf(str, capacity, "%d", *(int16_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_INT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(int32_t*)buf);
+      n = snprintf(str, capacity, "%d", *(int32_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_BIGINT:
     case TSDB_DATA_TYPE_TIMESTAMP:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%" PRId64, *(int64_t*)buf);
+      n = snprintf(str, capacity, "%" PRId64, *(int64_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_FLOAT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%e", GET_FLOAT_VAL(buf));
+      n = snprintf(str, capacity, "%e", GET_FLOAT_VAL(buf));
       break;
 
     case TSDB_DATA_TYPE_DOUBLE:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%e", GET_DOUBLE_VAL(buf));
+      n = snprintf(str, capacity, "%e", GET_DOUBLE_VAL(buf));
       break;
 
     case TSDB_DATA_TYPE_VARBINARY: {
@@ -395,19 +394,19 @@ int32_t dataConverToStr(char* str, int type, void* buf, int32_t bufSize, int32_t
       n = length + 2;
       break;
     case TSDB_DATA_TYPE_UTINYINT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(uint8_t*)buf);
+      n = snprintf(str, capacity, "%d", *(uint8_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_USMALLINT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%d", *(uint16_t*)buf);
+      n = snprintf(str, capacity, "%d", *(uint16_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_UINT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%u", *(uint32_t*)buf);
+      n = snprintf(str, capacity, "%u", *(uint32_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_UBIGINT:
-      n = snprintf(str, MAX_NUMERICAL_LENGTH, "%" PRIu64, *(uint64_t*)buf);
+      n = snprintf(str, capacity, "%" PRIu64, *(uint64_t*)buf);
       break;
 
     default:

From 95a26d7ee9889801e1885498cb86fd1d529054ca Mon Sep 17 00:00:00 2001
From: xsren <285808407@qq.com>
Date: Wed, 9 Oct 2024 09:53:32 +0800
Subject: [PATCH 4/6] tstrncpy

---
 source/libs/qcom/src/querymsg.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/source/libs/qcom/src/querymsg.c b/source/libs/qcom/src/querymsg.c
index a3abadec01..70309ace69 100644
--- a/source/libs/qcom/src/querymsg.c
+++ b/source/libs/qcom/src/querymsg.c
@@ -107,7 +107,7 @@ int32_t queryBuildUseDbMsg(void *input, char **msg, int32_t msgSize, int32_t *ms
   }
 
   SUseDbReq usedbReq = {0};
-  strncpy(usedbReq.db, pInput->db, sizeof(usedbReq.db));
+  tstrncpy(usedbReq.db, pInput->db, TSDB_DB_FNAME_LEN);
   usedbReq.db[sizeof(usedbReq.db) - 1] = 0;
   usedbReq.vgVersion = pInput->vgVersion;
   usedbReq.dbId = pInput->dbId;
@@ -688,14 +688,14 @@ int32_t queryProcessTableMetaRsp(void *output, char *msg, int32_t msgSize) {
   }
 
   STableMetaOutput *pOut = output;
-  strncpy(pOut->dbFName, metaRsp.dbFName, TSDB_DB_FNAME_LEN);
+  tstrncpy(pOut->dbFName, metaRsp.dbFName, TSDB_DB_FNAME_LEN);
   pOut->dbId = metaRsp.dbId;
 
   if (metaRsp.tableType == TSDB_CHILD_TABLE) {
     SET_META_TYPE_BOTH_TABLE(pOut->metaType);
 
-    strncpy(pOut->ctbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
-    strncpy(pOut->tbName, metaRsp.stbName, TSDB_TABLE_NAME_LEN);
+    tstrncpy(pOut->ctbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
+    tstrncpy(pOut->tbName, metaRsp.stbName, TSDB_TABLE_NAME_LEN);
 
     pOut->ctbMeta.vgId = metaRsp.vgId;
     pOut->ctbMeta.tableType = metaRsp.tableType;
@@ -705,7 +705,7 @@ int32_t queryProcessTableMetaRsp(void *output, char *msg, int32_t msgSize) {
     code = queryCreateTableMetaFromMsg(&metaRsp, true, &pOut->tbMeta);
   } else {
     SET_META_TYPE_TABLE(pOut->metaType);
-    strncpy(pOut->tbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
+    tstrncpy(pOut->tbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
     code = queryCreateTableMetaFromMsg(&metaRsp, (metaRsp.tableType == TSDB_SUPER_TABLE), &pOut->tbMeta);
   }
 
@@ -744,14 +744,14 @@ static int32_t queryProcessTableNameRsp(void *output, char *msg, int32_t msgSize
   }
 
   STableMetaOutput *pOut = output;
-  strncpy(pOut->dbFName, metaRsp.dbFName, TSDB_DB_FNAME_LEN);
+  tstrncpy(pOut->dbFName, metaRsp.dbFName, TSDB_DB_FNAME_LEN);
   pOut->dbId = metaRsp.dbId;
 
   if (metaRsp.tableType == TSDB_CHILD_TABLE) {
     SET_META_TYPE_BOTH_TABLE(pOut->metaType);
 
-    strncpy(pOut->ctbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
-    strncpy(pOut->tbName, metaRsp.stbName, TSDB_TABLE_NAME_LEN);
+    tstrncpy(pOut->ctbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
+    tstrncpy(pOut->tbName, metaRsp.stbName, TSDB_TABLE_NAME_LEN);
 
     pOut->ctbMeta.vgId = metaRsp.vgId;
     pOut->ctbMeta.tableType = metaRsp.tableType;
@@ -761,7 +761,7 @@ static int32_t queryProcessTableNameRsp(void *output, char *msg, int32_t msgSize
     code = queryCreateTableMetaExFromMsg(&metaRsp, true, &pOut->tbMeta);
   } else {
     SET_META_TYPE_TABLE(pOut->metaType);
-    strncpy(pOut->tbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
+    tstrncpy(pOut->tbName, metaRsp.tbName, TSDB_TABLE_NAME_LEN);
     code = queryCreateTableMetaExFromMsg(&metaRsp, (metaRsp.tableType == TSDB_SUPER_TABLE), &pOut->tbMeta);
   }
 

From 283e88196c90609e598db19da22f0fef50ce2e7d Mon Sep 17 00:00:00 2001
From: yihaoDeng <luomoxyz@126.com>
Date: Wed, 9 Oct 2024 11:22:28 +0800
Subject: [PATCH 5/6] fix double free

---
 source/dnode/mnode/impl/src/mndIndex.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/source/dnode/mnode/impl/src/mndIndex.c b/source/dnode/mnode/impl/src/mndIndex.c
index 0b3a0998f0..718c34e85a 100644
--- a/source/dnode/mnode/impl/src/mndIndex.c
+++ b/source/dnode/mnode/impl/src/mndIndex.c
@@ -157,7 +157,7 @@ static void *mndBuildDropIdxReq(SMnode *pMnode, SVgObj *pVgroup, SStbObj *pStbOb
   pHead->contLen = htonl(len);
   pHead->vgId = htonl(pVgroup->vgId);
 
-  void *pBuf = POINTER_SHIFT(pHead, sizeof(SMsgHead));
+  void   *pBuf = POINTER_SHIFT(pHead, sizeof(SMsgHead));
   int32_t ret = 0;
   if ((ret = tSerializeSDropIdxReq(pBuf, len - sizeof(SMsgHead), &req)) < 0) {
     terrno = ret;
@@ -662,6 +662,8 @@ static int32_t mndSetUpdateIdxStbCommitLogs(SMnode *pMnode, STrans *pTrans, SStb
 
   pNew->pTags = NULL;
   pNew->pColumns = NULL;
+  pNew->pCmpr = NULL;
+  pNew->pTags = NULL;
   pNew->updateTime = taosGetTimestampMs();
   pNew->lock = 0;
 

From eaf8bf0ca65a254a09bc9cead2d1b2ca284909d9 Mon Sep 17 00:00:00 2001
From: xsren <285808407@qq.com>
Date: Wed, 9 Oct 2024 11:26:35 +0800
Subject: [PATCH 6/6] tstrncpy

---
 include/common/tglobal.h        |  2 +-
 source/libs/function/src/tudf.c | 14 +++++++-------
 source/libs/function/src/udfd.c |  8 ++++----
 source/libs/qcom/src/querymsg.c | 18 +++++++++---------
 4 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/include/common/tglobal.h b/include/common/tglobal.h
index bece14c17d..cf918c6e0d 100644
--- a/include/common/tglobal.h
+++ b/include/common/tglobal.h
@@ -214,7 +214,7 @@ extern int64_t  tsMinDiskFreeSize;
 // udf
 extern bool tsStartUdfd;
 extern char tsUdfdResFuncs[];
-extern char tsUdfdLdLibPath[];
+extern char tsUdfdLdLibPath[512];
 
 // schemaless
 extern char tsSmlChildTableName[];
diff --git a/source/libs/function/src/tudf.c b/source/libs/function/src/tudf.c
index 74a1919850..3a0cff7cf3 100644
--- a/source/libs/function/src/tudf.c
+++ b/source/libs/function/src/tudf.c
@@ -143,10 +143,10 @@ static int32_t udfSpawnUdfd(SUdfdData *pData) {
 
   char   udfdPathLdLib[1024] = {0};
   size_t udfdLdLibPathLen = strlen(tsUdfdLdLibPath);
-  strncpy(udfdPathLdLib, tsUdfdLdLibPath, tListLen(udfdPathLdLib));
+  tstrncpy(udfdPathLdLib, tsUdfdLdLibPath, sizeof(udfdPathLdLib) < sizeof(tsUdfdLdLibPath) ? sizeof(udfdPathLdLib) : sizeof(tsUdfdLdLibPath));
 
   udfdPathLdLib[udfdLdLibPathLen] = ':';
-  strncpy(udfdPathLdLib + udfdLdLibPathLen + 1, pathTaosdLdLib, sizeof(udfdPathLdLib) - udfdLdLibPathLen - 1);
+  tstrncpy(udfdPathLdLib + udfdLdLibPathLen + 1, pathTaosdLdLib, sizeof(udfdPathLdLib) - udfdLdLibPathLen - 1);
   if (udfdLdLibPathLen + taosdLdLibPathLen < 1024) {
     fnInfo("[UDFD]udfd LD_LIBRARY_PATH: %s", udfdPathLdLib);
   } else {
@@ -1073,7 +1073,7 @@ int32_t acquireUdfFuncHandle(char *udfName, UdfcFuncHandle *pHandle) {
   int32_t code = 0, line = 0;
   uv_mutex_lock(&gUdfcProxy.udfStubsMutex);
   SUdfcFuncStub key = {0};
-  strncpy(key.udfName, udfName, TSDB_FUNC_NAME_LEN);
+  tstrncpy(key.udfName, udfName, TSDB_FUNC_NAME_LEN);
   int32_t stubIndex = taosArraySearchIdx(gUdfcProxy.udfStubs, &key, compareUdfcFuncSub, TD_EQ);
   if (stubIndex != -1) {
     SUdfcFuncStub *foundStub = taosArrayGet(gUdfcProxy.udfStubs, stubIndex);
@@ -1106,7 +1106,7 @@ int32_t acquireUdfFuncHandle(char *udfName, UdfcFuncHandle *pHandle) {
   code = doSetupUdf(udfName, pHandle);
   if (code == TSDB_CODE_SUCCESS) {
     SUdfcFuncStub stub = {0};
-    strncpy(stub.udfName, udfName, TSDB_FUNC_NAME_LEN);
+    tstrncpy(stub.udfName, udfName, TSDB_FUNC_NAME_LEN);
     stub.handle = *pHandle;
     ++stub.refCount;
     stub.createTime = taosGetTimestampUs();
@@ -1130,7 +1130,7 @@ _exit:
 void releaseUdfFuncHandle(char *udfName, UdfcFuncHandle handle) {
   uv_mutex_lock(&gUdfcProxy.udfStubsMutex);
   SUdfcFuncStub key = {0};
-  strncpy(key.udfName, udfName, TSDB_FUNC_NAME_LEN);
+  tstrncpy(key.udfName, udfName, TSDB_FUNC_NAME_LEN);
   SUdfcFuncStub *foundStub = taosArraySearch(gUdfcProxy.udfStubs, &key, compareUdfcFuncSub, TD_EQ);
   SUdfcFuncStub *expiredStub = taosArraySearch(gUdfcProxy.expiredUdfStubs, &key, compareUdfcFuncSub, TD_EQ);
   if (!foundStub && !expiredStub) {
@@ -2021,7 +2021,7 @@ int32_t doSetupUdf(char udfName[], UdfcFuncHandle *funcHandle) {
   task->type = UDF_TASK_SETUP;
 
   SUdfSetupRequest *req = &task->_setup.req;
-  strncpy(req->udfName, udfName, TSDB_FUNC_NAME_LEN);
+  tstrncpy(req->udfName, udfName, TSDB_FUNC_NAME_LEN);
 
   code = udfcRunUdfUvTask(task, UV_TASK_CONNECT);
   TAOS_CHECK_GOTO(code, &lino, _exit);
@@ -2034,7 +2034,7 @@ int32_t doSetupUdf(char udfName[], UdfcFuncHandle *funcHandle) {
   task->session->outputType = rsp->outputType;
   task->session->bytes = rsp->bytes;
   task->session->bufSize = rsp->bufSize;
-  strncpy(task->session->udfName, udfName, TSDB_FUNC_NAME_LEN);
+  tstrncpy(task->session->udfName, udfName, TSDB_FUNC_NAME_LEN);
   fnInfo("successfully setup udf func handle. udfName: %s, handle: %p", udfName, task->session);
   *funcHandle = task->session;
   taosMemoryFree(task);
diff --git a/source/libs/function/src/udfd.c b/source/libs/function/src/udfd.c
index 255cf1a4de..c360cf6894 100644
--- a/source/libs/function/src/udfd.c
+++ b/source/libs/function/src/udfd.c
@@ -617,7 +617,7 @@ int32_t udfdNewUdf(SUdf **pUdf, const char *udfName) {
   }
   udfNew->refCount = 1;
   udfNew->lastFetchTime = taosGetTimestampMs();
-  strncpy(udfNew->name, udfName, TSDB_FUNC_NAME_LEN);
+  tstrncpy(udfNew->name, udfName, TSDB_FUNC_NAME_LEN);
 
   udfNew->state = UDF_STATE_INIT;
   if (uv_mutex_init(&udfNew->lock) != 0) return TSDB_CODE_UDF_UV_EXEC_FAILURE;
@@ -997,7 +997,7 @@ int32_t udfdSaveFuncBodyToFile(SFuncInfo *pFuncInfo, SUdf *udf) {
   udfdGetFuncBodyPath(udf, path);
   bool fileExist = !(taosStatFile(path, NULL, NULL, NULL) < 0);
   if (fileExist) {
-    strncpy(udf->path, path, PATH_MAX);
+    tstrncpy(udf->path, path, PATH_MAX);
     fnInfo("udfd func body file. reuse existing file %s", path);
     return TSDB_CODE_SUCCESS;
   }
@@ -1017,7 +1017,7 @@ int32_t udfdSaveFuncBodyToFile(SFuncInfo *pFuncInfo, SUdf *udf) {
     return TSDB_CODE_FILE_CORRUPTED;
   }
 
-  strncpy(udf->path, path, PATH_MAX);
+  tstrncpy(udf->path, path, PATH_MAX);
   return TSDB_CODE_SUCCESS;
 }
 
@@ -1612,7 +1612,7 @@ int32_t udfdInitResidentFuncs() {
   char *token;
   while ((token = strtok_r(pSave, ",", &pSave)) != NULL) {
     char func[TSDB_FUNC_NAME_LEN + 1] = {0};
-    strncpy(func, token, TSDB_FUNC_NAME_LEN);
+    tstrncpy(func, token, TSDB_FUNC_NAME_LEN);
     fnInfo("udfd add resident function %s", func);
     if(taosArrayPush(global.residentFuncs, func) == NULL)
     {
diff --git a/source/libs/qcom/src/querymsg.c b/source/libs/qcom/src/querymsg.c
index 70309ace69..60c760a60e 100644
--- a/source/libs/qcom/src/querymsg.c
+++ b/source/libs/qcom/src/querymsg.c
@@ -207,7 +207,7 @@ int32_t queryBuildGetDBCfgMsg(void *input, char **msg, int32_t msgSize, int32_t
   }
 
   SDbCfgReq dbCfgReq = {0};
-  strncpy(dbCfgReq.db, input, sizeof(dbCfgReq.db) - 1);
+  tstrncpy(dbCfgReq.db, input, TSDB_DB_FNAME_LEN);
 
   int32_t bufLen = tSerializeSDbCfgReq(NULL, 0, &dbCfgReq);
   void   *pBuf = (*mallcFp)(bufLen);
@@ -231,7 +231,7 @@ int32_t queryBuildGetIndexMsg(void *input, char **msg, int32_t msgSize, int32_t
   }
 
   SUserIndexReq indexReq = {0};
-  strncpy(indexReq.indexFName, input, sizeof(indexReq.indexFName) - 1);
+  tstrncpy(indexReq.indexFName, input, TSDB_INDEX_FNAME_LEN);
 
   int32_t bufLen = tSerializeSUserIndexReq(NULL, 0, &indexReq);
   void   *pBuf = (*mallcFp)(bufLen);
@@ -293,7 +293,7 @@ int32_t queryBuildGetUserAuthMsg(void *input, char **msg, int32_t msgSize, int32
   }
 
   SGetUserAuthReq req = {0};
-  strncpy(req.user, input, sizeof(req.user) - 1);
+  tstrncpy(req.user, input, TSDB_USER_LEN);
 
   int32_t bufLen = tSerializeSGetUserAuthReq(NULL, 0, &req);
   void   *pBuf = (*mallcFp)(bufLen);
@@ -316,7 +316,7 @@ int32_t queryBuildGetTbIndexMsg(void *input, char **msg, int32_t msgSize, int32_
   }
 
   STableIndexReq indexReq = {0};
-  strncpy(indexReq.tbFName, input, sizeof(indexReq.tbFName) - 1);
+  tstrncpy(indexReq.tbFName, input, TSDB_TABLE_FNAME_LEN);
 
   int32_t bufLen = tSerializeSTableIndexReq(NULL, 0, &indexReq);
   void   *pBuf = (*mallcFp)(bufLen);
@@ -342,8 +342,8 @@ int32_t queryBuildGetTbCfgMsg(void *input, char **msg, int32_t msgSize, int32_t
   SBuildTableInput *pInput = input;
   STableCfgReq      cfgReq = {0};
   cfgReq.header.vgId = pInput->vgId;
-  strncpy(cfgReq.dbFName, pInput->dbFName, sizeof(cfgReq.dbFName) - 1);
-  strncpy(cfgReq.tbName, pInput->tbName, sizeof(cfgReq.tbName) - 1);
+  tstrncpy(cfgReq.dbFName, pInput->dbFName, TSDB_DB_FNAME_LEN);
+  tstrncpy(cfgReq.tbName, pInput->tbName, TSDB_TABLE_NAME_LEN);
 
   int32_t bufLen = tSerializeSTableCfgReq(NULL, 0, &cfgReq);
   void   *pBuf = (*mallcFp)(bufLen);
@@ -367,7 +367,7 @@ int32_t queryBuildGetViewMetaMsg(void *input, char **msg, int32_t msgSize, int32
   }
 
   SViewMetaReq req = {0};
-  strncpy(req.fullname, input, sizeof(req.fullname) - 1);
+  tstrncpy(req.fullname, input, TSDB_VIEW_FNAME_LEN);
 
   int32_t bufLen = tSerializeSViewMetaReq(NULL, 0, &req);
   void   *pBuf = (*mallcFp)(bufLen);
@@ -392,7 +392,7 @@ int32_t queryBuildGetTableTSMAMsg(void *input, char **msg, int32_t msgSize, int3
   }
 
   STableTSMAInfoReq req = {0};
-  strncpy(req.name, input, sizeof(req.name) - 1);
+  tstrncpy(req.name, input, TSDB_TABLE_FNAME_LEN);
 
   int32_t bufLen = tSerializeTableTSMAInfoReq(NULL, 0, &req);
   void *  pBuf = (*mallcFp)(bufLen);
@@ -417,7 +417,7 @@ int32_t queryBuildGetTSMAMsg(void *input, char **msg, int32_t msgSize, int32_t *
 
   STableTSMAInfoReq req = {0};
   req.fetchingWithTsmaName = true;
-  strncpy(req.name, input, sizeof(req.name) - 1);
+  tstrncpy(req.name, input, TSDB_TABLE_FNAME_LEN);
 
   int32_t bufLen = tSerializeTableTSMAInfoReq(NULL, 0, &req);
   void *  pBuf = (*mallcFp)(bufLen);