diff --git a/frameworks/accesstoken/src/hap_token_info_for_sync_parcel.cpp b/frameworks/accesstoken/src/hap_token_info_for_sync_parcel.cpp
index 89766e8710ea91aff07ed7885a5e1ff45238738d..769bf40465972045dc29cf01043c0205c7170855 100644
--- a/frameworks/accesstoken/src/hap_token_info_for_sync_parcel.cpp
+++ b/frameworks/accesstoken/src/hap_token_info_for_sync_parcel.cpp
@@ -30,7 +30,7 @@ bool HapTokenInfoForSyncParcel::Marshalling(Parcel& out) const
     const std::vector<PermissionStateFull>& permStateList = this->hapTokenInfoForSyncParams.permStateList;
     int32_t permStateListSize = static_cast<int32_t>(permStateList.size());
     RETURN_IF_FALSE(out.WriteInt32(permStateListSize));
-
+    RETURN_IF_FALSE((permStateListSize <= MAX_PERMLIST_SIZE));
     for (int i = 0; i < permStateListSize; i++) {
         PermissionStateFullParcel permStateParcel;
         permStateParcel.permStatFull = permStateList[i];
diff --git a/frameworks/accesstoken/src/native_token_info_for_sync_parcel.cpp b/frameworks/accesstoken/src/native_token_info_for_sync_parcel.cpp
index 541bbea1d858d90fe39cca12f7b394c5a978514d..cfbddc9f7a412309d59664c10b59877408df9243 100644
--- a/frameworks/accesstoken/src/native_token_info_for_sync_parcel.cpp
+++ b/frameworks/accesstoken/src/native_token_info_for_sync_parcel.cpp
@@ -30,7 +30,7 @@ bool NativeTokenInfoForSyncParcel::Marshalling(Parcel& out) const
     const std::vector<PermissionStateFull>& permStateList = this->nativeTokenInfoForSyncParams.permStateList;
     int32_t permStateListSize = static_cast<int32_t>(permStateList.size());
     RETURN_IF_FALSE(out.WriteInt32(permStateListSize));
-
+    RETURN_IF_FALSE((permStateListSize <= MAX_PERMLIST_SIZE));
     for (int i = 0; i < permStateListSize; i++) {
         PermissionStateFullParcel permStateParcel;
         permStateParcel.permStatFull = permStateList[i];
diff --git a/frameworks/common/include/parcel_utils.h b/frameworks/common/include/parcel_utils.h
index ddc87d6884a0999ed97cdef2bd329fb517a354d9..d6b7e8b6b56f3dbc7133fad4555428a10f0d36d9 100644
--- a/frameworks/common/include/parcel_utils.h
+++ b/frameworks/common/include/parcel_utils.h
@@ -15,6 +15,7 @@
 
 #ifndef PARCEL_UTILS_H
 #define PARCEL_UTILS_H
+#define MAX_PERMLIST_SIZE 256
 namespace OHOS {
 namespace Security {
 namespace AccessToken {