From ecea1ce747a00ef859e3ec3241eb803358dac1a8 Mon Sep 17 00:00:00 2001
From: tickduan <417921451@qq.com>
Date: Fri, 13 Aug 2021 11:17:55 +0800
Subject: [PATCH] fixed realloc can cause memory leak

---
 deps/MsvcLibX/src/iconv.c      |  6 ++++--
 deps/MsvcLibX/src/main.c       | 10 +++++++---
 deps/MsvcLibX/src/realpath.c   | 16 ++++++++++++----
 src/balance/src/bnScore.c      |  3 ++-
 src/client/src/tscPrepare.c    |  5 +++--
 src/client/src/tscSql.c        |  4 +++-
 src/client/src/tscUtil.c       | 12 +++++++++---
 src/common/inc/tdataformat.h   | 10 ++++++----
 src/common/src/tdataformat.c   |  5 +++--
 src/kit/shell/src/shellCheck.c |  5 +++--
 src/kit/taospack/taospack.c    |  5 ++++-
 src/mnode/src/mnodeTable.c     |  5 +++--
 src/os/src/detail/osMemory.c   |  5 +++--
 src/os/src/windows/wGetline.c  |  6 ++++--
 src/query/src/qTsbuf.c         |  7 +++++--
 15 files changed, 71 insertions(+), 33 deletions(-)

diff --git a/deps/MsvcLibX/src/iconv.c b/deps/MsvcLibX/src/iconv.c
index 40b6e6462d..1ec0dc7354 100644
--- a/deps/MsvcLibX/src/iconv.c
+++ b/deps/MsvcLibX/src/iconv.c
@@ -98,6 +98,7 @@ int ConvertString(char *buf, size_t nBytes, UINT cpFrom, UINT cpTo, LPCSTR lpDef
 char *DupAndConvert(const char *string, UINT cpFrom, UINT cpTo, LPCSTR lpDefaultChar) {
   int nBytes;
   char *pBuf;
+  char *pBuf1;
   nBytes = 4 * ((int)lstrlen(string) + 1); /* Worst case for the size needed */
   pBuf = (char *)malloc(nBytes);
   if (!pBuf) {
@@ -110,8 +111,9 @@ char *DupAndConvert(const char *string, UINT cpFrom, UINT cpTo, LPCSTR lpDefault
     free(pBuf);
     return NULL;
   }
-  pBuf = realloc(pBuf, nBytes+1);
-  return pBuf;
+  pBuf1 = realloc(pBuf, nBytes+1);
+  if(pBuf1 == NULL && pBuf != NULL)  free(pBuf);
+  return pBuf1;
 }
 
 int CountCharacters(const char *string, UINT cp) {
diff --git a/deps/MsvcLibX/src/main.c b/deps/MsvcLibX/src/main.c
index f366b081ad..9b9b4a46af 100644
--- a/deps/MsvcLibX/src/main.c
+++ b/deps/MsvcLibX/src/main.c
@@ -68,6 +68,7 @@ int BreakArgLine(LPSTR pszCmdLine, char ***pppszArg) {
   int iString = FALSE;	/* TRUE = string mode; FALSE = non-string mode */
   int nBackslash = 0;
   char **ppszArg;
+  char **ppszArg1;
   int iArg = FALSE;	/* TRUE = inside an argument; FALSE = between arguments */
 
   ppszArg = (char **)malloc((argc+1)*sizeof(char *));
@@ -89,7 +90,10 @@ int BreakArgLine(LPSTR pszCmdLine, char ***pppszArg) {
     if ((!iArg) && (c != ' ') && (c != '\t')) { /* Beginning of a new argument */
       iArg = TRUE;
       ppszArg[argc++] = pszCopy+j;
-      ppszArg = (char **)realloc(ppszArg, (argc+1)*sizeof(char *));
+      ppszArg1 = (char **)realloc(ppszArg, (argc+1)*sizeof(char *));
+      if(ppszArg1 == NULL && ppszArg != NULL)
+            free(ppszArg); 
+      ppszArg = ppszArg1;
       if (!ppszArg) return -1;
       pszCopy[j] = c0 = '\0';
     }
@@ -212,14 +216,14 @@ int _initU(void) {
     fprintf(stderr, "Warning: Can't convert the argument line to UTF-8\n");
     _acmdln[0] = '\0';
   }
-  realloc(_acmdln, n+1); /* Resize the memory block to fit the UTF-8 line */
+  //realloc(_acmdln, n+1); /* Resize the memory block to fit the UTF-8 line */
   /* Should not fail since we make it smaller */
 
   /* Record the console code page, to allow converting the output accordingly */
   codePage = GetConsoleOutputCP();
 
   return 0;
-}
+}ß
 
 #endif /* defined(_WIN32) */
 
diff --git a/deps/MsvcLibX/src/realpath.c b/deps/MsvcLibX/src/realpath.c
index 5fbcf773a2..ec1b606bf6 100644
--- a/deps/MsvcLibX/src/realpath.c
+++ b/deps/MsvcLibX/src/realpath.c
@@ -196,6 +196,7 @@ not_compact_enough:
 /* Normally defined in stdlib.h. Output buf must contain PATH_MAX bytes */
 char *realpath(const char *path, char *outbuf) {
   char *pOutbuf = outbuf;
+  char *pOutbuf1;
   int iErr;
   const char *pc;
 
@@ -242,8 +243,11 @@ realpath_failed:
     return NULL;
   }
 
-  if (!outbuf) pOutbuf = realloc(pOutbuf, strlen(pOutbuf) + 1);
-  return pOutbuf;
+  if (!outbuf) {
+    pOutbuf1 = realloc(pOutbuf, strlen(pOutbuf) + 1);
+    if(pOutbuf1 == NULL && pOutbuf) free(pOutbuf);
+  }
+  return pOutbuf1;
 }
 
 #endif
@@ -517,6 +521,7 @@ int ResolveLinksA(const char *path, char *buf, size_t bufsize) {
 /* Normally defined in stdlib.h. Output buf must contain PATH_MAX bytes */
 char *realpathU(const char *path, char *outbuf) {
   char *pOutbuf = outbuf;
+  char *pOutbuf1;
   char *pPath1 = NULL;
   char *pPath2 = NULL;
   int iErr;
@@ -590,10 +595,13 @@ realpathU_failed:
   }
 
   DEBUG_LEAVE(("return 0x%p; // \"%s\"\n", pOutbuf, pOutbuf));
-  if (!outbuf) pOutbuf = realloc(pOutbuf, strlen(pOutbuf) + 1);
+  if (!outbuf) {
+    pOutbuf1 = realloc(pOutbuf, strlen(pOutbuf) + 1);
+    if(pOutbuf1 == NULL && pOutbuf) free(pOutbuf);
+  }  
   free(pPath1);
   free(pPath2);
-  return pOutbuf;
+  return pOutbuf1;
 }
 
 #endif /* defined(_WIN32) */
diff --git a/src/balance/src/bnScore.c b/src/balance/src/bnScore.c
index 7d94df1c23..a2b9ba8e09 100644
--- a/src/balance/src/bnScore.c
+++ b/src/balance/src/bnScore.c
@@ -117,7 +117,8 @@ void bnCleanupDnodes() {
 static void bnCheckDnodesSize(int32_t dnodesNum) {
   if (tsBnDnodes.maxSize <= dnodesNum) {
     tsBnDnodes.maxSize = dnodesNum * 2;
-    tsBnDnodes.list = realloc(tsBnDnodes.list, tsBnDnodes.maxSize * sizeof(SDnodeObj *));
+    SDnodeObj** list1 = realloc(tsBnDnodes.list, tsBnDnodes.maxSize * sizeof(SDnodeObj *));
+    if(list1) tsBnDnodes.list = list1;
   }
 }
 
diff --git a/src/client/src/tscPrepare.c b/src/client/src/tscPrepare.c
index 40664241c1..06a9505086 100644
--- a/src/client/src/tscPrepare.c
+++ b/src/client/src/tscPrepare.c
@@ -1527,8 +1527,9 @@ int taos_stmt_prepare(TAOS_STMT* stmt, const char* sql, unsigned long length) {
   pCmd->insertParam.insertType = TSDB_QUERY_TYPE_STMT_INSERT;
   pCmd->insertParam.objectId = pSql->self;
 
-  pSql->sqlstr = realloc(pSql->sqlstr, sqlLen + 1);
-
+  char* sqlstr = realloc(pSql->sqlstr, sqlLen + 1);
+  if(sqlstr == NULL && pSql->sqlstr) free(pSql->sqlstr);  
+  pSql->sqlstr = sqlstr;
   if (pSql->sqlstr == NULL) {
     tscError("%p failed to malloc sql string buffer", pSql);
     STMT_RET(TSDB_CODE_TSC_OUT_OF_MEMORY);
diff --git a/src/client/src/tscSql.c b/src/client/src/tscSql.c
index 6f3d5c3a63..026c65a595 100644
--- a/src/client/src/tscSql.c
+++ b/src/client/src/tscSql.c
@@ -887,7 +887,9 @@ int taos_validate_sql(TAOS *taos, const char *sql) {
     return TSDB_CODE_TSC_EXCEED_SQL_LIMIT;
   }
 
-  pSql->sqlstr = realloc(pSql->sqlstr, sqlLen + 1);
+  char* sqlstr = realloc(pSql->sqlstr, sqlLen + 1);
+  if(sqlstr == NULL && pSql->sqlstr) free(pSql->sqlstr);
+  pSql->sqlstr = sqlstr;
   if (pSql->sqlstr == NULL) {
     tscError("0x%"PRIx64" failed to malloc sql string buffer", pSql->self);
     tfree(pSql);
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index 3c35795b0d..ca7a5cbf77 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -625,8 +625,10 @@ static void setResRawPtrImpl(SSqlRes* pRes, SInternalField* pInfo, int32_t i, bo
 
   } else if (convertNchar && pInfo->field.type == TSDB_DATA_TYPE_NCHAR) {
     // convert unicode to native code in a temporary buffer extra one byte for terminated symbol
-    pRes->buffer[i] = realloc(pRes->buffer[i], pInfo->field.bytes * pRes->numOfRows);
-
+    char* buffer = realloc(pRes->buffer[i], pInfo->field.bytes * pRes->numOfRows);
+    if(buffer == NULL)
+       return ;
+    pRes->buffer[i] = buffer;
     // string terminated char for binary data
     memset(pRes->buffer[i], 0, pInfo->field.bytes * pRes->numOfRows);
 
@@ -4364,6 +4366,7 @@ int32_t tscCreateTableMetaFromSTableMeta(STableMeta** ppChild, const char* name,
   STableMeta* p    = NULL;
   size_t      sz   = 0;
   STableMeta* pChild = *ppChild;
+  STableMeta* pChild1;
    
   taosHashGetCloneExt(tscTableMetaMap, pChild->sTableName, strnlen(pChild->sTableName, TSDB_TABLE_FNAME_LEN), NULL, (void **)&p, &sz);
 
@@ -4374,7 +4377,10 @@ int32_t tscCreateTableMetaFromSTableMeta(STableMeta** ppChild, const char* name,
     int32_t totalBytes    = (p->tableInfo.numOfColumns + p->tableInfo.numOfTags) * sizeof(SSchema);
     int32_t tableMetaSize =  sizeof(STableMeta)  + totalBytes;
     if (*tableMetaCapacity < tableMetaSize) {
-      pChild = realloc(pChild, tableMetaSize); 
+      pChild1 = realloc(pChild, tableMetaSize);
+      if(pChild1 == NULL) 
+        return -1;
+      pChild = pChild1; 
       *tableMetaCapacity = (size_t)tableMetaSize;
     }
 
diff --git a/src/common/inc/tdataformat.h b/src/common/inc/tdataformat.h
index 46259c8488..a01c377539 100644
--- a/src/common/inc/tdataformat.h
+++ b/src/common/inc/tdataformat.h
@@ -547,8 +547,9 @@ SKVRow tdGetKVRowFromBuilder(SKVRowBuilder *pBuilder);
 static FORCE_INLINE int tdAddColToKVRow(SKVRowBuilder *pBuilder, int16_t colId, int8_t type, void *value) {
   if (pBuilder->nCols >= pBuilder->tCols) {
     pBuilder->tCols *= 2;
-    pBuilder->pColIdx = (SColIdx *)realloc((void *)(pBuilder->pColIdx), sizeof(SColIdx) * pBuilder->tCols);
-    if (pBuilder->pColIdx == NULL) return -1;
+    SColIdx* pColIdx = (SColIdx *)realloc((void *)(pBuilder->pColIdx), sizeof(SColIdx) * pBuilder->tCols);
+    if (pColIdx == NULL) return -1;
+    pBuilder->pColIdx = pColIdx;
   }
 
   pBuilder->pColIdx[pBuilder->nCols].colId = colId;
@@ -561,8 +562,9 @@ static FORCE_INLINE int tdAddColToKVRow(SKVRowBuilder *pBuilder, int16_t colId,
     while (tlen > pBuilder->alloc - pBuilder->size) {
       pBuilder->alloc *= 2;
     }
-    pBuilder->buf = realloc(pBuilder->buf, pBuilder->alloc);
-    if (pBuilder->buf == NULL) return -1;
+    void* buf = realloc(pBuilder->buf, pBuilder->alloc);
+    if (buf == NULL) return -1;
+    pBuilder->buf = buf;
   }
 
   memcpy(POINTER_SHIFT(pBuilder->buf, pBuilder->size), value, tlen);
diff --git a/src/common/src/tdataformat.c b/src/common/src/tdataformat.c
index a3a6c0fed4..181afa225d 100644
--- a/src/common/src/tdataformat.c
+++ b/src/common/src/tdataformat.c
@@ -138,8 +138,9 @@ int tdAddColToSchema(STSchemaBuilder *pBuilder, int8_t type, int16_t colId, int1
 
   if (pBuilder->nCols >= pBuilder->tCols) {
     pBuilder->tCols *= 2;
-    pBuilder->columns = (STColumn *)realloc(pBuilder->columns, sizeof(STColumn) * pBuilder->tCols);
-    if (pBuilder->columns == NULL) return -1;
+    STColumn* columns = (STColumn *)realloc(pBuilder->columns, sizeof(STColumn) * pBuilder->tCols);
+    if (columns == NULL) return -1;
+    pBuilder->columns = columns;
   }
 
   STColumn *pCol = &(pBuilder->columns[pBuilder->nCols]);
diff --git a/src/kit/shell/src/shellCheck.c b/src/kit/shell/src/shellCheck.c
index d78f1a6b99..7fc8b1409a 100644
--- a/src/kit/shell/src/shellCheck.c
+++ b/src/kit/shell/src/shellCheck.c
@@ -72,12 +72,13 @@ static int32_t shellShowTables(TAOS *con, char *db) {
       int32_t tbIndex = tbNum++;
       if (tbMallocNum < tbNum) {
         tbMallocNum = (tbMallocNum * 2 + 1);
-        tbNames = realloc(tbNames, tbMallocNum * sizeof(char *));
-        if (tbNames == NULL) {
+        char** tbNames1 = realloc(tbNames, tbMallocNum * sizeof(char *));
+        if (tbNames1 == NULL) {
           fprintf(stdout, "failed to malloc tablenames, num:%d\n", tbMallocNum);
           code = TSDB_CODE_TSC_OUT_OF_MEMORY;
           break;
         }
+        tbNames = tbNames1;
       }
 
       tbNames[tbIndex] = malloc(TSDB_TABLE_NAME_LEN);
diff --git a/src/kit/taospack/taospack.c b/src/kit/taospack/taospack.c
index 33d779dfcf..1b22c16ee0 100644
--- a/src/kit/taospack/taospack.c
+++ b/src/kit/taospack/taospack.c
@@ -148,7 +148,10 @@ float* read_float(const char* inFile, int* pcount){
     //printf(" buff=%s float=%.50f \n ", buf, floats[fi]);
     if ( ++fi == malloc_cnt ) {
       malloc_cnt += 100000;
-      floats = realloc(floats, malloc_cnt*sizeof(float));
+      float* floats1 = realloc(floats, malloc_cnt*sizeof(float));
+      if(floats1 == NULL)
+         break;
+      floats = floats1;   
     }
     memset(buf, 0, sizeof(buf));
   }
diff --git a/src/mnode/src/mnodeTable.c b/src/mnode/src/mnodeTable.c
index 0bc114ffdf..a4ecf5d6f3 100644
--- a/src/mnode/src/mnodeTable.c
+++ b/src/mnode/src/mnodeTable.c
@@ -2921,10 +2921,11 @@ static SMultiTableMeta* ensureMsgBufferSpace(SMultiTableMeta *pMultiMeta, SArray
       (*totalMallocLen) *= 2;
     }
 
-    pMultiMeta = realloc(pMultiMeta, *totalMallocLen);
-    if (pMultiMeta == NULL) {
+    SMultiTableMeta* pMultiMeta1 = realloc(pMultiMeta, *totalMallocLen);
+    if (pMultiMeta1 == NULL) {
       return NULL;
     }
+    pMultiMeta = pMultiMeta1;
   }
 
   return pMultiMeta;
diff --git a/src/os/src/detail/osMemory.c b/src/os/src/detail/osMemory.c
index d8194feab4..22954f1523 100644
--- a/src/os/src/detail/osMemory.c
+++ b/src/os/src/detail/osMemory.c
@@ -504,8 +504,9 @@ void * taosTRealloc(void *ptr, size_t size) {
 
   void * tptr = (void *)((char *)ptr - sizeof(size_t));
   size_t tsize = size + sizeof(size_t);
-  tptr = realloc(tptr, tsize);
-  if (tptr == NULL) return NULL;
+  void* tptr1 = realloc(tptr, tsize);
+  if (tptr1 == NULL) return NULL;
+  tptr = tptr1;
 
   *(size_t *)tptr = size;
 
diff --git a/src/os/src/windows/wGetline.c b/src/os/src/windows/wGetline.c
index 553aecaf0a..aa45854884 100644
--- a/src/os/src/windows/wGetline.c
+++ b/src/os/src/windows/wGetline.c
@@ -81,11 +81,13 @@ int32_t getstr(char **lineptr, size_t *n, FILE *stream, char terminator, int32_t
         *n += MIN_CHUNK;
 
       nchars_avail = (int32_t)(*n + *lineptr - read_pos);
-      *lineptr = realloc(*lineptr, *n);
-      if (!*lineptr) {
+      char* lineptr1 = realloc(*lineptr, *n);
+      if (!lineptr1) {
         errno = ENOMEM;
         return -1;
       }
+      *lineptr = lineptr1;
+
       read_pos = *n - nchars_avail + *lineptr;
       assert((*lineptr + *n) == (read_pos + nchars_avail));
     }
diff --git a/src/query/src/qTsbuf.c b/src/query/src/qTsbuf.c
index 825b7960de..4cf05dd2c7 100644
--- a/src/query/src/qTsbuf.c
+++ b/src/query/src/qTsbuf.c
@@ -223,8 +223,11 @@ static STSGroupBlockInfoEx* addOneGroupInfo(STSBuf* pTSBuf, int32_t id) {
 static void shrinkBuffer(STSList* ptsData) {
   // shrink tmp buffer size if it consumes too many memory compared to the pre-defined size
   if (ptsData->allocSize >= ptsData->threshold * 2) {
-    ptsData->rawBuf = realloc(ptsData->rawBuf, MEM_BUF_SIZE);
-    ptsData->allocSize = MEM_BUF_SIZE;
+    char* rawBuf = realloc(ptsData->rawBuf, MEM_BUF_SIZE);
+    if(rawBuf) {
+      ptsData->rawBuf = rawBuf;
+      ptsData->allocSize = MEM_BUF_SIZE;
+    }
   }
 }