diff --git a/frameworks/ddk/scsi/scsi_ddk_api.cpp b/frameworks/ddk/scsi/scsi_ddk_api.cpp
index 961ce7a698dd6e125b19a14695f0f07d5821b211..5cb1cefa2b962c3adf6452025dad02852c1f3373 100644
--- a/frameworks/ddk/scsi/scsi_ddk_api.cpp
+++ b/frameworks/ddk/scsi/scsi_ddk_api.cpp
@@ -423,6 +423,10 @@ int32_t OH_ScsiPeripheral_Inquiry(ScsiPeripheral_Device *dev, ScsiPeripheral_Inq
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "copy revProduct failed");
         return SCSIPERIPHERAL_DDK_MEMORY_ERROR;
     }
+    if (hdiResponse.transferredLength < 0) {
+        EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "transferredLength is invalid: %{public}d", hdiResponse.transferredLength);
+        return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
+    }
     inquiryInfo->data->transferredLength = static_cast<uint32_t>(hdiResponse.transferredLength);
 
     return CopyResponse(hdiResponse, response);
@@ -490,7 +494,7 @@ int32_t OH_ScsiPeripheral_Read10(ScsiPeripheral_Device *dev, ScsiPeripheral_IORe
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "invalid obj");
         return SCSIPERIPHERAL_DDK_INIT_ERROR;
     }
-    if (dev == nullptr || request == nullptr || request->data ==nullptr || response == nullptr) {
+    if (dev == nullptr || request == nullptr || request->data == nullptr || response == nullptr) {
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "param is null");
         return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
     }
@@ -501,11 +505,16 @@ int32_t OH_ScsiPeripheral_Read10(ScsiPeripheral_Device *dev, ScsiPeripheral_IORe
     hdiResponse.senseData.resize(sizeof(response->senseData));
 
     int32_t ret = TransToDdkErrCode(g_ddk->Read10(dev->impl, hdiIORequest, hdiResponse));
-    if (ret !=  SCSIPERIPHERAL_DDK_SUCCESS) {
+    if (ret != SCSIPERIPHERAL_DDK_SUCCESS) {
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "read10 failed");
         return ret;
     }
 
+    if (hdiResponse.transferredLength < 0) {
+        EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "transferredLength is invalid: %{public}d", hdiResponse.transferredLength);
+        return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
+    }
+
     request->data->transferredLength = static_cast<uint32_t>(hdiResponse.transferredLength);
 
     return CopyResponse(hdiResponse, response);
@@ -518,7 +527,7 @@ int32_t OH_ScsiPeripheral_Write10(ScsiPeripheral_Device *dev, ScsiPeripheral_IOR
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "invalid obj");
         return SCSIPERIPHERAL_DDK_INIT_ERROR;
     }
-    if (dev == nullptr || request == nullptr || request->data ==nullptr || response == nullptr) {
+    if (dev == nullptr || request == nullptr || request->data == nullptr || response == nullptr) {
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "param is null");
         return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
     }
@@ -529,11 +538,16 @@ int32_t OH_ScsiPeripheral_Write10(ScsiPeripheral_Device *dev, ScsiPeripheral_IOR
     hdiResponse.senseData.resize(sizeof(response->senseData));
 
     int32_t ret = TransToDdkErrCode(g_ddk->Write10(dev->impl, hdiIORequest, hdiResponse));
-    if (ret !=  SCSIPERIPHERAL_DDK_SUCCESS) {
+    if (ret != SCSIPERIPHERAL_DDK_SUCCESS) {
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "write10 failed");
         return ret;
     }
 
+    if (hdiResponse.transferredLength < 0) {
+        EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "transferredLength is invalid: %{public}d", hdiResponse.transferredLength);
+        return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
+    }
+
     request->data->transferredLength = static_cast<uint32_t>(hdiResponse.transferredLength);
 
     return CopyResponse(hdiResponse, response);
@@ -578,7 +592,7 @@ int32_t OH_ScsiPeripheral_SendRequestByCdb(ScsiPeripheral_Device *dev, ScsiPerip
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "invalid obj");
         return SCSIPERIPHERAL_DDK_INIT_ERROR;
     }
-    if (dev == nullptr || request == nullptr || request->data ==nullptr || response == nullptr) {
+    if (dev == nullptr || request == nullptr || request->data == nullptr || response == nullptr) {
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "param is null");
         return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
     }
@@ -597,11 +611,16 @@ int32_t OH_ScsiPeripheral_SendRequestByCdb(ScsiPeripheral_Device *dev, ScsiPerip
     hdiResponse.senseData.resize(sizeof(response->senseData));
 
     int32_t ret = TransToDdkErrCode(g_ddk->SendRequestByCDB(dev->impl, hdiRequest, hdiResponse));
-    if (ret !=  SCSIPERIPHERAL_DDK_SUCCESS) {
+    if (ret != SCSIPERIPHERAL_DDK_SUCCESS) {
         EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "send request by cdb failed");
         return ret;
     }
 
+    if (hdiResponse.transferredLength < 0) {
+        EDM_LOGE(MODULE_SCSIPERIPHERAL_DDK, "transferredLength is invalid: %{public}d", hdiResponse.transferredLength);
+        return SCSIPERIPHERAL_DDK_INVALID_PARAMETER;
+    }
+
     request->data->transferredLength = static_cast<uint32_t>(hdiResponse.transferredLength);
 
     return CopyResponse(hdiResponse, response);
diff --git a/frameworks/ddk/usb/usb_ddk_api.cpp b/frameworks/ddk/usb/usb_ddk_api.cpp
index da306722d00932ac1b398b55f4387fb04e9c4d7f..a2fa70650849863322bafca503b4283b75cec4ae 100644
--- a/frameworks/ddk/usb/usb_ddk_api.cpp
+++ b/frameworks/ddk/usb/usb_ddk_api.cpp
@@ -314,6 +314,7 @@ void OH_Usb_DestroyDeviceMemMap(UsbDeviceMemMap *devMmap)
         return;
     }
     delete devMmap;
+    devMmap = nullptr;
 }
 
 int32_t OH_Usb_GetDevices(struct Usb_DeviceArray *devices)