Merge pull request #18411 from taosdata/fix/TD-20607

fix: [ASAN] heap buffer overflow in sclfunc.c
This commit is contained in:
Shengliang Guan 2022-11-24 08:19:07 +08:00 committed by GitHub
commit f13d3155d9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 34 additions and 7 deletions

View File

@ -1758,18 +1758,45 @@ int32_t sumScalarFunction(SScalarParam *pInput, int32_t inputNum, SScalarParam *
break; break;
} }
if (IS_SIGNED_NUMERIC_TYPE(type)) { if (IS_SIGNED_NUMERIC_TYPE(type) || type == TSDB_DATA_TYPE_BOOL) {
int64_t *in = (int64_t *)pInputData->pData;
int64_t *out = (int64_t *)pOutputData->pData; int64_t *out = (int64_t *)pOutputData->pData;
*out += in[i]; if (type == TSDB_DATA_TYPE_TINYINT || type == TSDB_DATA_TYPE_BOOL) {
int8_t *in = (int8_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_SMALLINT) {
int16_t *in = (int16_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_INT) {
int32_t *in = (int32_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_BIGINT) {
int64_t *in = (int64_t *)pInputData->pData;
*out += in[i];
}
} else if (IS_UNSIGNED_NUMERIC_TYPE(type)) { } else if (IS_UNSIGNED_NUMERIC_TYPE(type)) {
uint64_t *in = (uint64_t *)pInputData->pData;
uint64_t *out = (uint64_t *)pOutputData->pData; uint64_t *out = (uint64_t *)pOutputData->pData;
*out += in[i]; if (type == TSDB_DATA_TYPE_UTINYINT) {
uint8_t *in = (uint8_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_USMALLINT) {
uint16_t *in = (uint16_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_UINT) {
uint32_t *in = (uint32_t *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_UBIGINT) {
uint64_t *in = (uint64_t *)pInputData->pData;
*out += in[i];
}
} else if (IS_FLOAT_TYPE(type)) { } else if (IS_FLOAT_TYPE(type)) {
double *in = (double *)pInputData->pData;
double *out = (double *)pOutputData->pData; double *out = (double *)pOutputData->pData;
*out += in[i]; if (type == TSDB_DATA_TYPE_FLOAT) {
float *in = (float *)pInputData->pData;
*out += in[i];
} else if (type == TSDB_DATA_TYPE_DOUBLE) {
double *in = (double *)pInputData->pData;
*out += in[i];
}
} }
} }