From a0d46fe9f4de7d6cb59c5a7363b70b5608d27ac9 Mon Sep 17 00:00:00 2001
From: wangmm0220 <wangmm0220@gmail.com>
Date: Fri, 30 Dec 2022 14:24:32 +0800
Subject: [PATCH] fix:json parse error

---
 source/client/inc/clientSml.h     |  3 ++-
 source/client/src/clientSmlJson.c | 18 +++++++++++++++++-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/source/client/inc/clientSml.h b/source/client/inc/clientSml.h
index 66b82d2b1e..daf610a79c 100644
--- a/source/client/inc/clientSml.h
+++ b/source/client/inc/clientSml.h
@@ -69,6 +69,7 @@ extern "C" {
 #define VALUE     "_value"
 #define VALUE_LEN 6
 
+#define OTD_JSON_FIELDS_NUM     4
 #define MAX_RETRY_TIMES 5
 typedef TSDB_SML_PROTOCOL_TYPE SMLProtocolType;
 
@@ -178,7 +179,7 @@ typedef struct {
   SSmlMsgBuf   msgBuf;
 
   cJSON       *root;  // for parse json
-  int8_t             offset[4];
+  int8_t             offset[OTD_JSON_FIELDS_NUM];
   SSmlLineInfo      *lines; // element is SSmlLineInfo
 
   //
diff --git a/source/client/src/clientSmlJson.c b/source/client/src/clientSmlJson.c
index d919805a8a..c1694d4aa7 100644
--- a/source/client/src/clientSmlJson.c
+++ b/source/client/src/clientSmlJson.c
@@ -20,7 +20,6 @@
 #include "clientSml.h"
 
 #define OTD_JSON_SUB_FIELDS_NUM 2
-#define OTD_JSON_FIELDS_NUM     4
 
 #define JUMP_JSON_SPACE(start) \
 while(*(start)){\
@@ -249,6 +248,11 @@ int smlJsonParseObjFirst(char **start, SSmlLineInfo *element, int8_t *offset){
       continue;
     }
 
+    if(unlikely(index >= OTD_JSON_FIELDS_NUM)) {
+      uError("index >= %d, %s", OTD_JSON_FIELDS_NUM, *start)
+      break;
+    }
+
     char *sTmp = *start;
     if((*start)[1] == 'm' && (*start)[2] == 'e' && (*start)[3] == 't'
        && (*start)[4] == 'r' &&  (*start)[5] == 'i' && (*start)[6] == 'c' && (*start)[7] == '"'){
@@ -353,6 +357,11 @@ int smlJsonParseObj(char **start, SSmlLineInfo *element, int8_t *offset){
       continue;
     }
 
+    if(unlikely(index >= OTD_JSON_FIELDS_NUM)) {
+      uError("index >= %d, %s", OTD_JSON_FIELDS_NUM, *start)
+      break;
+    }
+
     if((*start)[1] == 'm'){
       (*start) += offset[index++];
       element->measure = *start;
@@ -980,6 +989,13 @@ static int32_t smlParseJSONStringExt(SSmlHandle *info, cJSON *root, SSmlLineInfo
   cJSON *valueJson = NULL;
   cJSON *tagsJson = NULL;
 
+  int32_t size = cJSON_GetArraySize(root);
+  // outmost json fields has to be exactly 4
+  if (size != OTD_JSON_FIELDS_NUM) {
+    uError("OTD:0x%" PRIx64 " Invalid number of JSON fields in data point %d", info->id, size);
+    return TSDB_CODE_TSC_INVALID_JSON;
+  }
+
   cJSON **marks[OTD_JSON_FIELDS_NUM] = {&metricJson, &tsJson, &valueJson, &tagsJson};
   ret = smlGetJsonElements(root, marks);
   if (unlikely(ret != TSDB_CODE_SUCCESS)) {