From e5bb56752a08c2019f84493867697d5bbdb61cbe Mon Sep 17 00:00:00 2001 From: Haojun Liao Date: Wed, 25 May 2022 23:09:03 +0800 Subject: [PATCH] fix(query): check for invalid parameters of substr function. --- source/libs/function/src/builtins.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/source/libs/function/src/builtins.c b/source/libs/function/src/builtins.c index b891e9a37a..69d1b7314b 100644 --- a/source/libs/function/src/builtins.c +++ b/source/libs/function/src/builtins.c @@ -745,19 +745,32 @@ static int32_t translateSubstr(SFunctionNode* pFunc, char* pErrBuf, int32_t len) return invaildFuncParaNumErrMsg(pErrBuf, len, pFunc->functionName); } - SExprNode* pPara1 = (SExprNode*)nodesListGetNode(pFunc->pParameterList, 0); - uint8_t para2Type = ((SExprNode*)nodesListGetNode(pFunc->pParameterList, 1))->resType.type; - if (!IS_VAR_DATA_TYPE(pPara1->resType.type) || !IS_INTEGER_TYPE(para2Type)) { + SExprNode* pPara0 = (SExprNode*)nodesListGetNode(pFunc->pParameterList, 0); + SExprNode* p1 = (SExprNode*)nodesListGetNode(pFunc->pParameterList, 1); + + uint8_t para1Type = p1->resType.type; + if (!IS_VAR_DATA_TYPE(pPara0->resType.type) || !IS_INTEGER_TYPE(para1Type)) { return invaildFuncParaTypeErrMsg(pErrBuf, len, pFunc->functionName); } + + if (((SValueNode*)p1)->datum.i < 1) { + return invaildFuncParaValueErrMsg(pErrBuf, len, pFunc->functionName); + } + if (3 == numOfParams) { - uint8_t para3Type = ((SExprNode*)nodesListGetNode(pFunc->pParameterList, 1))->resType.type; - if (!IS_INTEGER_TYPE(para3Type)) { + SExprNode* p2 = (SExprNode*)nodesListGetNode(pFunc->pParameterList, 2); + uint8_t para2Type = p2->resType.type; + if (!IS_INTEGER_TYPE(para2Type)) { return invaildFuncParaTypeErrMsg(pErrBuf, len, pFunc->functionName); } + + int64_t v = ((SValueNode*)p1)->datum.i; + if (v < 0 || v > INT16_MAX) { + return invaildFuncParaValueErrMsg(pErrBuf, len, pFunc->functionName); + } } - pFunc->node.resType = (SDataType){.bytes = pPara1->resType.bytes, .type = pPara1->resType.type}; + pFunc->node.resType = (SDataType){.bytes = pPara0->resType.bytes, .type = pPara0->resType.type}; return TSDB_CODE_SUCCESS; }