Merge pull request #18429 from taosdata/feature/stream

fix(stream): heap uaf
taosdata · Nov 24, 2022 · 01e8b03 · 01e8b03
2 parents 10ebfac + fcf4605
commit 01e8b03
Showing 1 changed file with 9 additions and 9 deletions.
diff --git a/source/dnode/mnode/impl/src/mndStb.c b/source/dnode/mnode/impl/src/mndStb.c
@@ -1187,11 +1187,11 @@ static int32_t mndCheckAlterColForTopic(SMnode *pMnode, const char *stbFullName,
         goto NEXT;
       }
       if (pCol->colId > 0 && pCol->colId == colId) {
-        sdbRelease(pSdb, pTopic);
-        nodesDestroyNode(pAst);
-        nodesDestroyList(pNodeList);
         terrno = TSDB_CODE_MND_FIELD_CONFLICT_WITH_TOPIC;
         mError("topic:%s, check colId:%d conflicted", pTopic->name, pCol->colId);
+        nodesDestroyNode(pAst);
+        nodesDestroyList(pNodeList);
+        sdbRelease(pSdb, pTopic);
         return -1;
       }
       mInfo("topic:%s, check colId:%d passed", pTopic->name, pCol->colId);
@@ -1230,11 +1230,11 @@ static int32_t mndCheckAlterColForStream(SMnode *pMnode, const char *stbFullName
         goto NEXT;
       }
       if (pCol->colId > 0 && pCol->colId == colId) {
-        sdbRelease(pSdb, pStream);
-        nodesDestroyNode(pAst);
-        nodesDestroyList(pNodeList);
         terrno = TSDB_CODE_MND_STREAM_MUST_BE_DELETED;
         mError("stream:%s, check colId:%d conflicted", pStream->name, pCol->colId);
+        nodesDestroyNode(pAst);
+        nodesDestroyList(pNodeList);
+        sdbRelease(pSdb, pStream);
         return -1;
       }
       mInfo("stream:%s, check colId:%d passed", pStream->name, pCol->colId);
@@ -1279,11 +1279,11 @@ static int32_t mndCheckAlterColForTSma(SMnode *pMnode, const char *stbFullName,
         goto NEXT;
       }
       if ((pCol->colId) > 0 && (pCol->colId == colId)) {
-        sdbRelease(pSdb, pSma);
-        nodesDestroyNode(pAst);
-        nodesDestroyList(pNodeList);
         terrno = TSDB_CODE_MND_FIELD_CONFLICT_WITH_TSMA;
         mError("tsma:%s, check colId:%d conflicted", pSma->name, pCol->colId);
+        nodesDestroyNode(pAst);
+        nodesDestroyList(pNodeList);
+        sdbRelease(pSdb, pSma);
         return -1;
       }
       mInfo("tsma:%s, check colId:%d passed", pSma->name, pCol->colId);