fix(query): fix invalid write.

source/dnode/vnode/src/tsdb/tsdbRead.c

@@ -694,10 +694,12 @@ static int32_t doLoadBlockIndex(STsdbReader* pReader, SDataFReader* pFileReader,
       continue;
     }
 
-    if (pBlockIdx->uid == pList->tableUidList[j]) {
-      i += 1;
+    if (pBlockIdx->uid > pList->tableUidList[j]) {
       j += 1;
+      continue;
+    }
 
+    if (pBlockIdx->uid == pList->tableUidList[j]) {
       // this block belongs to a table that is not queried.
       void* p = taosHashGet(pReader->status.pTableMap, &pBlockIdx->uid, sizeof(uint64_t));
       if (p == NULL) {
@@ -711,9 +713,8 @@ static int32_t doLoadBlockIndex(STsdbReader* pReader, SDataFReader* pFileReader,
       }
 
       taosArrayPush(pIndexList, pBlockIdx);
-    }
 
-    if (pBlockIdx->uid > pList->tableUidList[j]) {
+      i += 1;
       j += 1;
     }
   }

source/libs/executor/src/executil.c

@@ -127,23 +127,29 @@ void initGroupedResultInfo(SGroupResInfo* pGroupResInfo, SSHashObj* pHashmap, in
   pGroupResInfo->pRows = taosArrayInit(size, POINTER_BYTES);
 
   size_t  keyLen = 0;
-  int32_t num = 0, iter = 0, itemSize = 0;
+  int32_t iter = 0;
+  int32_t bufLen = 0, offset = 0;
 
+  // todo move away and record this during create window
+  while ((pData = tSimpleHashIterate(pHashmap, pData, &iter)) != NULL) {
+    /*void* key = */tSimpleHashGetKey(pData, &keyLen);
+    bufLen += keyLen + sizeof(SResultRowPosition);
+  }
+
+  pGroupResInfo->pBuf = taosMemoryMalloc(bufLen);
+
+  iter = 0;
   while ((pData = tSimpleHashIterate(pHashmap, pData, &iter)) != NULL) {
     void* key = tSimpleHashGetKey(pData, &keyLen);
 
-    if (pGroupResInfo->pBuf == NULL) {
-      itemSize = keyLen + sizeof(SResultRowPosition);
-      pGroupResInfo->pBuf = taosMemoryMalloc(size * itemSize);
-    }
-
-    SResKeyPos* p = (SResKeyPos*)(pGroupResInfo->pBuf + num * itemSize);
+    SResKeyPos* p = (SResKeyPos*) (pGroupResInfo->pBuf + offset);
 
     p->groupId = *(uint64_t*)key;
     p->pos = *(SResultRowPosition*)pData;
     memcpy(p->key, (char*)key + sizeof(uint64_t), keyLen - sizeof(uint64_t));
     taosArrayPush(pGroupResInfo->pRows, &p);
-    num += 1;
+
+    offset += keyLen + sizeof(struct SResultRowPosition);
   }
 
   if (order == TSDB_ORDER_ASC || order == TSDB_ORDER_DESC) {

tests/script/tsim/parser/regressiontest.sim

@@ -165,7 +165,7 @@ if $data00 != 10 then
   return -1
 endi
 
-sql select last_row(*) from st1 group by a
+sql select last_row(*) from st1 group by a order by a desc
 if $rows != 2 then
   return -1
 endi