diff --git a/adapter/khdf/linux/manager/src/devmgr_pm_reg.c b/adapter/khdf/linux/manager/src/devmgr_pm_reg.c
index 8dceb409b4e0e5977fc909c9442b6d213a739b8b..a8a67a1d0d00af7f1a0b4a677a139395ee4ca0e3 100644
--- a/adapter/khdf/linux/manager/src/devmgr_pm_reg.c
+++ b/adapter/khdf/linux/manager/src/devmgr_pm_reg.c
@@ -35,7 +35,10 @@ static int DevmgrPmSuspend(void)
 
     if (devmgrService->PowerStateChange(devmgrService, POWER_STATE_SUSPEND) != HDF_SUCCESS) {
         HDF_LOGE("%s drivers suspend failed", __func__);
-        devmgrService->PowerStateChange(devmgrService, POWER_STATE_RESUME);
+        int ret = devmgrService->PowerStateChange(devmgrService, POWER_STATE_RESUME);
+        if (ret != HDF_SUCCESS) {
+            HDF_LOGE("%s drivers resume failed", __func__);
+        }
         return HDF_FAILURE;
     }
 
diff --git a/adapter/khdf/linux/model/camera/src/contig_dma.c b/adapter/khdf/linux/model/camera/src/contig_dma.c
index 78d06757c9038a6d2ea7cbfb814332f078f038d0..dd142053df5af0ea626cc379607ebba1c1f7ec95 100644
--- a/adapter/khdf/linux/model/camera/src/contig_dma.c
+++ b/adapter/khdf/linux/model/camera/src/contig_dma.c
@@ -38,6 +38,10 @@ static unsigned long GetContiguousSize(struct sg_table *sgt)
     dma_addr_t expected = sg_dma_address(sgt->sgl);
     uint32_t i;
     unsigned long size = 0;
+    if (sgt == NULL) {
+        HDF_LOGE("sgt is NULL!");
+        return size;
+    }
 
     for_each_sgtable_dma_sg(sgt, slist, i) {
         if (sg_dma_address(slist) != expected) {
diff --git a/adapter/khdf/linux/model/camera/src/sg_dma.c b/adapter/khdf/linux/model/camera/src/sg_dma.c
index 6bb8aa476bd0ddef71681b705583ea4706111297..80303e8725e96b7a940e4d9de9da9f2837322499 100644
--- a/adapter/khdf/linux/model/camera/src/sg_dma.c
+++ b/adapter/khdf/linux/model/camera/src/sg_dma.c
@@ -89,6 +89,10 @@ static int32_t SgAllocCompacted(struct SgDmaBuffer *buf, gfp_t gfpFlags)
         for (i = 0; i < (1 << order); i++) {
             buf->pages[lastPage++] = &pages[i];
         }
+        if (size < (PAGE_SIZE << order)) {
+            HDF_LOGE("%s: size invalid", __func__);
+            return -EINVAL;
+        }
 
         size -= PAGE_SIZE << order;
     }
diff --git a/adapter/platform/gpio/gpio_asr.c b/adapter/platform/gpio/gpio_asr.c
index a18eb08435f35c76cb278971175a86b5a2076f24..195ffe822f635cf001a7b085350e66d2f5a8da08 100644
--- a/adapter/platform/gpio/gpio_asr.c
+++ b/adapter/platform/gpio/gpio_asr.c
@@ -79,6 +79,10 @@ static void OemGpioIrqHdl(uint16_t *arg)
 {
     asr_gpio_dev_t *dev = NULL;
     uint16_t gpio = (uint16_t)arg;
+    if (gpio > ASR_GPIO_TOTAL_NUM) {
+        HDF_LOGE("invalid gpio");
+        return;
+    }
 
     dev = &g_gpioPinMap[gpio];
     if ((uint16_t)dev->port >= ASR_GPIO_TOTAL_NUM) {
diff --git a/framework/core/manager/src/devmgr_service.c b/framework/core/manager/src/devmgr_service.c
index 0ca8e609a26cdf49615fa4874b2aade73dec5560..ad72ae34e1bc9c84321290d983aeaa051fc9e926 100644
--- a/framework/core/manager/src/devmgr_service.c
+++ b/framework/core/manager/src/devmgr_service.c
@@ -31,6 +31,10 @@ static bool DevmgrServiceDynamicDevInfoFound(
     if (devMgrSvc == NULL) {
         return false;
     }
+    if (targetHostClnt == NULL || targetDeviceInfo == NULL) {
+        HDF_LOGE("invalid params");
+        return false;
+    }
 
     DLIST_FOR_EACH_ENTRY(hostClnt, &devMgrSvc->hosts, struct DevHostServiceClnt, node) {
         HdfSListIteratorInit(&itDeviceInfo, &hostClnt->dynamicDevInfos);
diff --git a/framework/core/manager/test/unittest/common/hdf_remote_adapter_test.cpp b/framework/core/manager/test/unittest/common/hdf_remote_adapter_test.cpp
index 8fa4436c57910c316c34fbfdc3bd50e2518996e9..e785fe6eddf82870398f944e983d43071cfd79ee 100644
--- a/framework/core/manager/test/unittest/common/hdf_remote_adapter_test.cpp
+++ b/framework/core/manager/test/unittest/common/hdf_remote_adapter_test.cpp
@@ -115,6 +115,7 @@ HWTEST_F(HdfRemoteAdapterTest, HdfRemoteAdapterTest004, TestSize.Level1)
 #ifdef WITH_SELINUX
     char *callingSid = HdfRemoteGetCallingSid();
     ASSERT_TRUE(callingSid != nullptr);
+    delete callingSid;
 #endif
 }
 
diff --git a/framework/support/platform/src/hdmi/hdmi_hdr.c b/framework/support/platform/src/hdmi/hdmi_hdr.c
index 291157b98e2c3dc4c734fc2dc704e25afb99ecfd..616e0858dac5a2355dd64fba7e6969121a6bad9f 100644
--- a/framework/support/platform/src/hdmi/hdmi_hdr.c
+++ b/framework/support/platform/src/hdmi/hdmi_hdr.c
@@ -36,6 +36,10 @@ static void HdmiHdrZeroDrmInfoFrameTimerSet(struct HdmiCntlr *cntlr, bool start)
 {
     struct HdmiHdrInfo *hdrInfo = &(cntlr->hdr->info);
     struct HdmiHdrAttr *hdrAttr = &(cntlr->attr.hdrAttr);
+    if (hdrInfo == NULL || hdrAttr == NULL) {
+        HDF_LOGE("invalid params");
+        return;
+    }
 
     hdrInfo->zeroDrmIfTimer.start = false;
     hdrInfo->zeroDrmIfTimer.timerType = HDMI_HDR_TIMER_ZERO_DRMIF;
diff --git a/framework/support/platform/src/hdmi/hdmi_infoframe.c b/framework/support/platform/src/hdmi/hdmi_infoframe.c
index 351e2452d7d66ae5d68974fff7655988edd7049f..c724e53d7c5899408b7353cf42612fbadd6f6f29 100644
--- a/framework/support/platform/src/hdmi/hdmi_infoframe.c
+++ b/framework/support/platform/src/hdmi/hdmi_infoframe.c
@@ -469,6 +469,10 @@ static void HdmiFillAviInfoFrame(struct HdmiAviInfoFrame *avi,
     struct HdmiVideoAttr *videoAttr, struct HdmiHdrAttr *hdrAttr, struct HdmiCommonAttr *commAttr)
 {
     bool enable3d = true;
+    if (avi == NULL) {
+        HDF_LOGE("invalid param: avi.");
+        return;
+    }
 
     if (memset_s(avi, sizeof(struct HdmiAviInfoFrame), 0, sizeof(struct HdmiAviInfoFrame)) != EOK) {
         HDF_LOGE("fill vsif, memset_s fail.");
@@ -522,6 +526,10 @@ int32_t HdmiAviInfoFrameSend(struct HdmiInfoFrame *frame, bool enable)
 
 static void HdmiFillAudioInfoFrame(struct HdmiAudioInfoFrame *audio, const struct HdmiAudioAttr *audioAttr)
 {
+    if (audio == NULL) {
+        HDF_LOGE("invalid param: audio.");
+        return;
+    }
     if (memset_s(audio, sizeof(struct HdmiAudioInfoFrame), 0, sizeof(struct HdmiAudioInfoFrame)) != EOK) {
         HDF_LOGE("fill vsif, memset_s fail.");
         return;
diff --git a/framework/tools/hdi-gen/util/string_builder.cpp b/framework/tools/hdi-gen/util/string_builder.cpp
index fdabf36f319cda19f6a1e039b2c2ff67b28086c4..ab3cb557e32d7e00b015b51ef15d55517bbfb009 100644
--- a/framework/tools/hdi-gen/util/string_builder.cpp
+++ b/framework/tools/hdi-gen/util/string_builder.cpp
@@ -152,7 +152,6 @@ bool StringBuilder::Grow(size_t size)
         int ret = memcpy_s(newBuffer, newSize, buffer_, capacity_);
         if (ret != 0) {
             Logger::E(TAG, "memcpy_s error ret = %d!", ret);
-            free(buffer_);
             free(newBuffer);
             return false;
         }