xxq250
/
homework-jianmu
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge pull request #18411 from taosdata/fix/TD-20607 

fix: [ASAN] heap buffer overflow in sclfunc.c
This commit is contained in:
Shengliang Guan 2022-11-24 08:19:07 +08:00 committed by GitHub
parent 962aa4aff4 dff0b3c4bb
commit f13d3155d9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 34 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
source/libs/scalar/src/sclfunc.c
View File

@ -1758,18 +1758,45 @@ int32_t sumScalarFunction(SScalarParam *pInput, int32_t inputNum, SScalarParam *
break;
}
if (IS_SIGNED_NUMERIC_TYPE(type)) {
int64_t *in = (int64_t *)pInputData->pData;
if (IS_SIGNED_NUMERIC_TYPE(type) || type == TSDB_DATA_TYPE_BOOL) {
int64_t *out = (int64_t *)pOutputData->pData;
*out += in[i];
if (type == TSDB_DATA_TYPE_TINYINT || type == TSDB_DATA_TYPE_BOOL) {
int8_t *in = (int8_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_SMALLINT) {
int16_t *in = (int16_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_INT) {
int32_t *in = (int32_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_BIGINT) {
int64_t *in = (int64_t *)pInputData->pData;
*out += in[i];
}
} else if (IS_UNSIGNED_NUMERIC_TYPE(type)) {
uint64_t *in = (uint64_t *)pInputData->pData;
uint64_t *out = (uint64_t *)pOutputData->pData;
*out += in[i];
if (type == TSDB_DATA_TYPE_UTINYINT) {
uint8_t *in = (uint8_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_USMALLINT) {
uint16_t *in = (uint16_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_UINT) {
uint32_t *in = (uint32_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_UBIGINT) {
uint64_t *in = (uint64_t *)pInputData->pData;
*out += in[i];
}
} else if (IS_FLOAT_TYPE(type)) {
double *in = (double *)pInputData->pData;
double *out = (double *)pOutputData->pData;
*out += in[i];
if (type == TSDB_DATA_TYPE_FLOAT) {
float *in = (float *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_DOUBLE) {
double *in = (double *)pInputData->pData;
*out += in[i];
}
}
}