• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

taosdata / TDengine / #4440

04 Jul 2025 02:10AM UTC coverage: 63.29% (-0.4%) from 63.643%
#4440

push

travis-ci

web-flow
fix:(stmt2) heap buffer overflow (#31607)

159782 of 321690 branches covered (49.67%)

Branch coverage included in aggregate %.

19 of 22 new or added lines in 3 files covered. (86.36%)

5735 existing lines in 195 files now uncovered.

246739 of 320626 relevant lines covered (76.96%)

6757056.21 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

68.63
/source/dnode/mgmt/mgmt_vnode/src/vmFile.c
1
/*
2
 * Copyright (c) 2019 TAOS Data, Inc. <jhtao@taosdata.com>
3
 *
4
 * This program is free software: you can use, redistribute, and/or modify
5
 * it under the terms of the GNU Affero General Public License, version 3
6
 * or later ("AGPL"), as published by the Free Software Foundation.
7
 *
8
 * This program is distributed in the hope that it will be useful, but WITHOUT
9
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10
 * FITNESS FOR A PARTICULAR PURPOSE.
11
 *
12
 * You should have received a copy of the GNU Affero General Public License
13
 * along with this program. If not, see <http:www.gnu.org/licenses/>.
14
 */
15

16
#define _DEFAULT_SOURCE
17
#include "tjson.h"
18
#include "vmInt.h"
19

20
#define MAX_CONTENT_LEN 2 * 1024 * 1024
21

22
int32_t vmGetAllVnodeListFromHash(SVnodeMgmt *pMgmt, int32_t *numOfVnodes, SVnodeObj ***ppVnodes) {
22,663✔
23
  int32_t num = 0;
22,663✔
24
  int32_t size = taosHashGetSize(pMgmt->runngingHash);
22,663✔
25
  int32_t closedSize = taosHashGetSize(pMgmt->closedHash);
22,663✔
26
  size += closedSize;
22,663✔
27
  SVnodeObj **pVnodes = taosMemoryCalloc(size, sizeof(SVnodeObj *));
22,663!
28
  if (pVnodes == NULL) {
22,663!
UNCOV
29
    return terrno;
×
30
  }
31

32
  void *pIter = taosHashIterate(pMgmt->runngingHash, NULL);
22,663✔
33
  while (pIter) {
139,438✔
34
    SVnodeObj **ppVnode = pIter;
116,775✔
35
    SVnodeObj  *pVnode = *ppVnode;
116,775✔
36
    if (pVnode && num < size) {
233,550!
37
      int32_t refCount = atomic_add_fetch_32(&pVnode->refCount, 1);
116,775✔
38
      dTrace("vgId:%d,acquire vnode, vnode:%p, ref:%d", pVnode->vgId, pVnode, refCount);
116,775✔
39
      pVnodes[num++] = (*ppVnode);
116,775✔
40
      pIter = taosHashIterate(pMgmt->runngingHash, pIter);
116,775✔
41
    } else {
UNCOV
42
      taosHashCancelIterate(pMgmt->runngingHash, pIter);
×
43
    }
44
  }
45

46
  pIter = taosHashIterate(pMgmt->closedHash, NULL);
22,663✔
47
  while (pIter) {
22,664✔
48
    SVnodeObj **ppVnode = pIter;
1✔
49
    SVnodeObj  *pVnode = *ppVnode;
1✔
50
    if (pVnode && num < size) {
2!
51
      int32_t refCount = atomic_add_fetch_32(&pVnode->refCount, 1);
1✔
52
      dTrace("vgId:%d, acquire vnode, vnode:%p, ref:%d", pVnode->vgId, pVnode, refCount);
1!
53
      pVnodes[num++] = (*ppVnode);
1✔
54
      pIter = taosHashIterate(pMgmt->closedHash, pIter);
1✔
55
    } else {
UNCOV
56
      taosHashCancelIterate(pMgmt->closedHash, pIter);
×
57
    }
58
  }
59

60
  *numOfVnodes = num;
22,663✔
61
  *ppVnodes = pVnodes;
22,663✔
62

63
  return 0;
22,663✔
64
}
65

66
int32_t vmGetAllVnodeListFromHashWithCreating(SVnodeMgmt *pMgmt, int32_t *numOfVnodes, SVnodeObj ***ppVnodes) {
12,443✔
67
  (void)taosThreadRwlockRdlock(&pMgmt->hashLock);
12,443✔
68

69
  int32_t num = 0;
12,443✔
70
  int32_t size = taosHashGetSize(pMgmt->runngingHash);
12,443✔
71
  int32_t creatingSize = taosHashGetSize(pMgmt->creatingHash);
12,443✔
72
  size += creatingSize;
12,443✔
73
  SVnodeObj **pVnodes = taosMemoryCalloc(size, sizeof(SVnodeObj *));
12,443!
74
  if (pVnodes == NULL) {
12,443!
UNCOV
75
    (void)taosThreadRwlockUnlock(&pMgmt->hashLock);
×
UNCOV
76
    return terrno;
×
77
  }
78

79
  void *pIter = taosHashIterate(pMgmt->runngingHash, NULL);
12,443✔
80
  while (pIter) {
58,165✔
81
    SVnodeObj **ppVnode = pIter;
45,722✔
82
    SVnodeObj  *pVnode = *ppVnode;
45,722✔
83
    if (pVnode && num < size) {
91,444!
84
      int32_t refCount = atomic_add_fetch_32(&pVnode->refCount, 1);
45,722✔
85
      dTrace("vgId:%d,acquire vnode, vnode:%p, ref:%d", pVnode->vgId, pVnode, refCount);
45,722✔
86
      pVnodes[num++] = (*ppVnode);
45,722✔
87
      pIter = taosHashIterate(pMgmt->runngingHash, pIter);
45,722✔
88
    } else {
UNCOV
89
      taosHashCancelIterate(pMgmt->runngingHash, pIter);
×
90
    }
91
  }
92

93
  pIter = taosHashIterate(pMgmt->creatingHash, NULL);
12,443✔
94
  while (pIter) {
37,152✔
95
    SVnodeObj **ppVnode = pIter;
24,709✔
96
    SVnodeObj  *pVnode = *ppVnode;
24,709✔
97
    if (pVnode && num < size) {
49,418!
98
      int32_t refCount = atomic_add_fetch_32(&pVnode->refCount, 1);
24,709✔
99
      dTrace("vgId:%d, acquire vnode, vnode:%p, ref:%d", pVnode->vgId, pVnode, refCount);
24,709✔
100
      pVnodes[num++] = (*ppVnode);
24,709✔
101
      pIter = taosHashIterate(pMgmt->creatingHash, pIter);
24,709✔
102
    } else {
UNCOV
103
      taosHashCancelIterate(pMgmt->creatingHash, pIter);
×
104
    }
105
  }
106
  (void)taosThreadRwlockUnlock(&pMgmt->hashLock);
12,443✔
107

108
  *numOfVnodes = num;
12,443✔
109
  *ppVnodes = pVnodes;
12,443✔
110

111
  return 0;
12,443✔
112
}
113

114
int32_t vmGetVnodeListFromHash(SVnodeMgmt *pMgmt, int32_t *numOfVnodes, SVnodeObj ***ppVnodes) {
9,064✔
115
  (void)taosThreadRwlockRdlock(&pMgmt->hashLock);
9,064✔
116

117
  int32_t     num = 0;
9,064✔
118
  int32_t     size = taosHashGetSize(pMgmt->runngingHash);
9,064✔
119
  SVnodeObj **pVnodes = taosMemoryCalloc(size, sizeof(SVnodeObj *));
9,064!
120
  if (pVnodes == NULL) {
9,064!
UNCOV
121
    (void)taosThreadRwlockUnlock(&pMgmt->hashLock);
×
UNCOV
122
    return terrno;
×
123
  }
124

125
  void *pIter = taosHashIterate(pMgmt->runngingHash, NULL);
9,064✔
126
  while (pIter) {
26,449✔
127
    SVnodeObj **ppVnode = pIter;
17,385✔
128
    SVnodeObj  *pVnode = *ppVnode;
17,385✔
129
    if (pVnode && num < size) {
34,770!
130
      int32_t refCount = atomic_add_fetch_32(&pVnode->refCount, 1);
17,385✔
131
      dTrace("vgId:%d, acquire vnode, vnode:%p, ref:%d", pVnode->vgId, pVnode, refCount);
17,385✔
132
      pVnodes[num++] = (*ppVnode);
17,385✔
133
      pIter = taosHashIterate(pMgmt->runngingHash, pIter);
17,385✔
134
    } else {
UNCOV
135
      taosHashCancelIterate(pMgmt->runngingHash, pIter);
×
136
    }
137
  }
138

139
  (void)taosThreadRwlockUnlock(&pMgmt->hashLock);
9,064✔
140
  *numOfVnodes = num;
9,064✔
141
  *ppVnodes = pVnodes;
9,064✔
142

143
  return 0;
9,064✔
144
}
145

146
static int32_t vmDecodeVnodeList(SJson *pJson, SVnodeMgmt *pMgmt, SWrapperCfg **ppCfgs, int32_t *numOfVnodes) {
497✔
147
  int32_t      code = -1;
497✔
148
  SWrapperCfg *pCfgs = NULL;
497✔
149
  *ppCfgs = NULL;
497✔
150

151
  SJson *vnodes = tjsonGetObjectItem(pJson, "vnodes");
497✔
152
  if (vnodes == NULL) return TSDB_CODE_INVALID_JSON_FORMAT;
497!
153

154
  int32_t vnodesNum = cJSON_GetArraySize(vnodes);
497✔
155
  if (vnodesNum > 0) {
497✔
156
    pCfgs = taosMemoryCalloc(vnodesNum, sizeof(SWrapperCfg));
494!
157
    if (pCfgs == NULL) return terrno;
494!
158
  }
159

160
  for (int32_t i = 0; i < vnodesNum; ++i) {
1,829✔
161
    SJson *vnode = tjsonGetArrayItem(vnodes, i);
1,332✔
162
    if (vnode == NULL) {
1,332!
UNCOV
163
      code = TSDB_CODE_INVALID_JSON_FORMAT;
×
UNCOV
164
      goto _OVER;
×
165
    }
166

167
    SWrapperCfg *pCfg = &pCfgs[i];
1,332✔
168
    tjsonGetInt32ValueFromDouble(vnode, "vgId", pCfg->vgId, code);
1,332✔
169
    if (code != 0) goto _OVER;
1,332!
170
    tjsonGetInt32ValueFromDouble(vnode, "dropped", pCfg->dropped, code);
1,332✔
171
    if (code != 0) goto _OVER;
1,332!
172
    tjsonGetInt32ValueFromDouble(vnode, "vgVersion", pCfg->vgVersion, code);
1,332✔
173
    if (code != 0) goto _OVER;
1,332!
174
    tjsonGetInt32ValueFromDouble(vnode, "diskPrimary", pCfg->diskPrimary, code);
1,332✔
175
    if (code != 0) goto _OVER;
1,332!
176
    tjsonGetInt32ValueFromDouble(vnode, "toVgId", pCfg->toVgId, code);
1,332✔
177
    if (code != 0) goto _OVER;
1,332!
178

179
    snprintf(pCfg->path, sizeof(pCfg->path), "%s%svnode%d", pMgmt->path, TD_DIRSEP, pCfg->vgId);
1,332✔
180
  }
181

182
  code = 0;
497✔
183
  *ppCfgs = pCfgs;
497✔
184
  *numOfVnodes = vnodesNum;
497✔
185

186
_OVER:
497✔
187
  if (*ppCfgs == NULL) taosMemoryFree(pCfgs);
497!
188
  return code;
497✔
189
}
190

191
int32_t vmGetVnodeListFromFile(SVnodeMgmt *pMgmt, SWrapperCfg **ppCfgs, int32_t *numOfVnodes) {
3,138✔
192
  int32_t      code = -1;
3,138✔
193
  TdFilePtr    pFile = NULL;
3,138✔
194
  char        *pData = NULL;
3,138✔
195
  SJson       *pJson = NULL;
3,138✔
196
  char         file[PATH_MAX] = {0};
3,138✔
197
  SWrapperCfg *pCfgs = NULL;
3,138✔
198
  snprintf(file, sizeof(file), "%s%svnodes.json", pMgmt->path, TD_DIRSEP);
3,138✔
199

200
  if (taosStatFile(file, NULL, NULL, NULL) < 0) {
3,138✔
201
    code = terrno;
2,641✔
202
    dInfo("vnode file:%s not exist, reason:%s", file, tstrerror(code));
2,641!
203
    code = 0;
2,641✔
204
    return code;
2,641✔
205
  }
206

207
  pFile = taosOpenFile(file, TD_FILE_READ);
497✔
208
  if (pFile == NULL) {
497!
UNCOV
209
    code = terrno;
×
UNCOV
210
    dError("failed to open vnode file:%s since %s", file, tstrerror(code));
×
UNCOV
211
    goto _OVER;
×
212
  }
213

214
  int64_t size = 0;
497✔
215
  code = taosFStatFile(pFile, &size, NULL);
497✔
216
  if (code != 0) {
497!
UNCOV
217
    dError("failed to fstat mnode file:%s since %s", file, tstrerror(code));
×
UNCOV
218
    goto _OVER;
×
219
  }
220

221
  pData = taosMemoryMalloc(size + 1);
497!
222
  if (pData == NULL) {
497!
UNCOV
223
    code = terrno;
×
UNCOV
224
    goto _OVER;
×
225
  }
226

227
  if (taosReadFile(pFile, pData, size) != size) {
497!
228
    code = terrno;
×
UNCOV
229
    dError("failed to read vnode file:%s since %s", file, tstrerror(code));
×
UNCOV
230
    goto _OVER;
×
231
  }
232

233
  pData[size] = '\0';
497✔
234

235
  pJson = tjsonParse(pData);
497✔
236
  if (pJson == NULL) {
497!
UNCOV
237
    code = TSDB_CODE_INVALID_JSON_FORMAT;
×
UNCOV
238
    goto _OVER;
×
239
  }
240

241
  if (vmDecodeVnodeList(pJson, pMgmt, ppCfgs, numOfVnodes) < 0) {
497!
242
    code = TSDB_CODE_INVALID_JSON_FORMAT;
×
UNCOV
243
    goto _OVER;
×
244
  }
245

246
  code = 0;
497✔
247
  dInfo("succceed to read vnode file %s", file);
497!
248

UNCOV
249
_OVER:
×
250
  if (pData != NULL) taosMemoryFree(pData);
497!
251
  if (pJson != NULL) cJSON_Delete(pJson);
497!
252
  if (pFile != NULL) taosCloseFile(&pFile);
497!
253

254
  if (code != 0) {
497!
UNCOV
255
    dError("failed to read vnode file:%s since %s", file, tstrerror(code));
×
256
  }
257
  return code;
497✔
258
}
259

260
static int32_t vmEncodeVnodeList(SJson *pJson, SVnodeObj **ppVnodes, int32_t numOfVnodes) {
22,663✔
261
  int32_t code = 0;
22,663✔
262
  SJson  *vnodes = tjsonCreateArray();
22,663✔
263
  if (vnodes == NULL) {
22,663!
UNCOV
264
    return terrno;
×
265
  }
266
  if ((code = tjsonAddItemToObject(pJson, "vnodes", vnodes)) < 0) {
22,663!
UNCOV
267
    tjsonDelete(vnodes);
×
268
    return code;
×
269
  };
270

271
  for (int32_t i = 0; i < numOfVnodes; ++i) {
139,439✔
272
    SVnodeObj *pVnode = ppVnodes[i];
116,776✔
273
    if (pVnode == NULL) continue;
116,776!
274

275
    SJson *vnode = tjsonCreateObject();
116,776✔
276
    if (vnode == NULL) return terrno;
116,776!
277
    if ((code = tjsonAddDoubleToObject(vnode, "vgId", pVnode->vgId)) < 0) return code;
116,776!
278
    if ((code = tjsonAddDoubleToObject(vnode, "dropped", pVnode->dropped)) < 0) return code;
116,776!
279
    if ((code = tjsonAddDoubleToObject(vnode, "vgVersion", pVnode->vgVersion)) < 0) return code;
116,776!
280
    if ((code = tjsonAddDoubleToObject(vnode, "diskPrimary", pVnode->diskPrimary)) < 0) return code;
116,776!
281
    if (pVnode->toVgId) {
116,776✔
282
      if ((code = tjsonAddDoubleToObject(vnode, "toVgId", pVnode->toVgId)) < 0) return code;
80!
283
    }
284
    if ((code = tjsonAddItemToArray(vnodes, vnode)) < 0) return code;
116,776!
285
  }
286

287
  return 0;
22,663✔
288
}
289

290
int32_t vmWriteVnodeListToFile(SVnodeMgmt *pMgmt) {
22,663✔
291
  int32_t     code = -1;
22,663✔
292
  char       *buffer = NULL;
22,663✔
293
  SJson      *pJson = NULL;
22,663✔
294
  TdFilePtr   pFile = NULL;
22,663✔
295
  SVnodeObj **ppVnodes = NULL;
22,663✔
296
  char        file[PATH_MAX] = {0};
22,663✔
297
  char        realfile[PATH_MAX] = {0};
22,663✔
298
  int32_t     lino = 0;
22,663✔
299
  int32_t     ret = -1;
22,663✔
300

301
  int32_t nBytes = snprintf(file, sizeof(file), "%s%svnodes_tmp.json", pMgmt->path, TD_DIRSEP);
22,663✔
302
  if (nBytes <= 0 || nBytes >= sizeof(file)) {
22,663!
UNCOV
303
    return TSDB_CODE_OUT_OF_RANGE;
×
304
  }
305

306
  nBytes = snprintf(realfile, sizeof(realfile), "%s%svnodes.json", pMgmt->path, TD_DIRSEP);
22,663✔
307
  if (nBytes <= 0 || nBytes >= sizeof(realfile)) {
22,663!
UNCOV
308
    return TSDB_CODE_OUT_OF_RANGE;
×
309
  }
310

311
  int32_t numOfVnodes = 0;
22,663✔
312
  (void)taosThreadRwlockWrlock(&pMgmt->hashLock);
22,663✔
313
  TAOS_CHECK_GOTO(vmGetAllVnodeListFromHash(pMgmt, &numOfVnodes, &ppVnodes), &lino, _OVER);
22,663!
314

315
  // terrno = TSDB_CODE_OUT_OF_MEMORY;
316
  pJson = tjsonCreateObject();
22,663✔
317
  if (pJson == NULL) {
22,663!
UNCOV
318
    code = terrno;
×
UNCOV
319
    goto _OVER;
×
320
  }
321
  TAOS_CHECK_GOTO(vmEncodeVnodeList(pJson, ppVnodes, numOfVnodes), &lino, _OVER);
22,663!
322

323
  buffer = tjsonToString(pJson);
22,663✔
324
  if (buffer == NULL) {
22,663!
UNCOV
325
    code = TSDB_CODE_INVALID_JSON_FORMAT;
×
UNCOV
326
    lino = __LINE__;
×
UNCOV
327
    goto _OVER;
×
328
  }
329

330

331
  pFile = taosOpenFile(file, TD_FILE_CREATE | TD_FILE_WRITE | TD_FILE_TRUNC | TD_FILE_WRITE_THROUGH);
22,663✔
332
  if (pFile == NULL) {
22,663!
UNCOV
333
    code = terrno;
×
UNCOV
334
    lino = __LINE__;
×
335
    goto _OVER;
×
336
  }
337

338
  int32_t len = strlen(buffer);
22,663✔
339
  if (taosWriteFile(pFile, buffer, len) <= 0) {
22,663!
UNCOV
340
    code = terrno;
×
341
    lino = __LINE__;
×
342
    goto _OVER;
×
343
  }
344
  if (taosFsyncFile(pFile) < 0) {
22,663!
UNCOV
345
    code = TAOS_SYSTEM_ERROR(ERRNO);
×
UNCOV
346
    lino = __LINE__;
×
UNCOV
347
    goto _OVER;
×
348
  }
349

350
  code = taosCloseFile(&pFile);
22,663✔
351
  if (code != 0) {
22,663!
UNCOV
352
    code = TAOS_SYSTEM_ERROR(ERRNO);
×
353
    lino = __LINE__;
×
354
    goto _OVER;
×
355
  }
356
  TAOS_CHECK_GOTO(taosRenameFile(file, realfile), &lino, _OVER);
22,663!
357

358
  dInfo("succeed to write vnodes file:%s, vnodes:%d", realfile, numOfVnodes);
22,663!
359

360
_OVER:
×
361
  (void)taosThreadRwlockUnlock(&pMgmt->hashLock);
22,663✔
362

363
  if (pJson != NULL) tjsonDelete(pJson);
22,663!
364
  if (buffer != NULL) taosMemoryFree(buffer);
22,663!
365
  if (pFile != NULL) taosCloseFile(&pFile);
22,663!
366
  if (ppVnodes != NULL) {
22,663!
367
    for (int32_t i = 0; i < numOfVnodes; ++i) {
139,439✔
368
      SVnodeObj *pVnode = ppVnodes[i];
116,776✔
369
      if (pVnode != NULL) {
116,776!
370
        vmReleaseVnode(pMgmt, pVnode);
116,776✔
371
      }
372
    }
373
    taosMemoryFree(ppVnodes);
22,663!
374
  }
375

376
  if (code != 0) {
22,663!
UNCOV
377
    dError("failed to write vnodes file:%s at line:%d since %s, vnodes:%d", realfile, lino, tstrerror(code),
×
378
           numOfVnodes);
379
  }
380
  return code;
22,663✔
381
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc