Morris遍历即可

class Solution {
public:
    vector<int> findError(TreeNode* root) {
        // write code here
        vector<int> res;
        TreeNode* cur = root;
        int pre = 0;
        while(cur){
            if(cur->left){
                TreeNode* temp = cur->left;
                while(temp->right != nullptr && temp->right != cur){
                    temp = temp->right;
                }
                if(temp->right == nullptr){
                    temp->right = cur;
                    cur = cur->left;
                }else{
                    temp->right == nullptr;
                    if(cur->val < pre){
                        res.push_back(pre);
                        res.push_back(cur->val);
                    }
                    pre = cur->val;
                    cur = cur->right;
                }
            }else{
                if(cur->val < pre){
                    res.push_back(pre);
                    res.push_back(cur->val);
                }
                pre = cur->val;
                cur = cur->right;
            }
        }
        if(res.size() == 2){
            return {res[1],res[0]};
        }else{
            return {res[3],res[0]};
        }
    }
};