From a56c99daac1976b9276593c3dfc54e22e41280f4 Mon Sep 17 00:00:00 2001 From: Hongze Cheng Date: Wed, 8 Mar 2023 14:45:04 +0800 Subject: [PATCH 1/2] fix: add more msg check --- source/dnode/vnode/src/vnd/vnodeSvr.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/source/dnode/vnode/src/vnd/vnodeSvr.c b/source/dnode/vnode/src/vnd/vnodeSvr.c index 2b275f5122..fc40f81ed5 100644 --- a/source/dnode/vnode/src/vnd/vnodeSvr.c +++ b/source/dnode/vnode/src/vnd/vnodeSvr.c @@ -211,6 +211,11 @@ static int32_t vnodePreProcessSubmitMsg(SVnode *pVnode, SRpcMsg *pMsg) { SDecoder *pCoder = &(SDecoder){0}; + if (((SSubmitReq2Msg *)pMsg->pCont)->version != 1) { + code = TSDB_CODE_INVALID_MSG; + TSDB_CHECK_CODE(code, lino, _exit); + } + tDecoderInit(pCoder, (uint8_t *)pMsg->pCont + sizeof(SSubmitReq2Msg), pMsg->contLen - sizeof(SSubmitReq2Msg)); if (tStartDecode(pCoder) < 0) { @@ -1218,6 +1223,11 @@ static int32_t vnodeProcessSubmitReq(SVnode *pVnode, int64_t version, void *pReq for (int32_t i = 0; i < TARRAY_SIZE(pSubmitReq->aSubmitTbData); ++i) { SSubmitTbData *pSubmitTbData = taosArrayGet(pSubmitReq->aSubmitTbData, i); + if (pSubmitTbData->pCreateTbReq && pSubmitTbData->pCreateTbReq->uid == 0) { + code = TSDB_CODE_INVALID_MSG; + goto _exit; + } + if (pSubmitTbData->flags & SUBMIT_REQ_COLUMN_DATA_FORMAT) { if (TARRAY_SIZE(pSubmitTbData->aCol) <= 0) { code = TSDB_CODE_INVALID_MSG; From 05688386a0901f4db0a43b008199320a6829aea0 Mon Sep 17 00:00:00 2001 From: Hongze Cheng Date: Wed, 8 Mar 2023 15:19:55 +0800 Subject: [PATCH 2/2] little fix --- source/dnode/vnode/src/vnd/vnodeSvr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/dnode/vnode/src/vnd/vnodeSvr.c b/source/dnode/vnode/src/vnd/vnodeSvr.c index fc40f81ed5..fb8d230eba 100644 --- a/source/dnode/vnode/src/vnd/vnodeSvr.c +++ b/source/dnode/vnode/src/vnd/vnodeSvr.c @@ -211,7 +211,7 @@ static int32_t vnodePreProcessSubmitMsg(SVnode *pVnode, SRpcMsg *pMsg) { SDecoder *pCoder = &(SDecoder){0}; - if (((SSubmitReq2Msg *)pMsg->pCont)->version != 1) { + if (taosHton64(((SSubmitReq2Msg *)pMsg->pCont)->version) != 1) { code = TSDB_CODE_INVALID_MSG; TSDB_CHECK_CODE(code, lino, _exit); }