diff --git a/interfaces/innerkits/nativetoken/include/nativetoken.h b/interfaces/innerkits/nativetoken/include/nativetoken.h
index 7c3c9f9be0143fdc850f6ec2d85c05aecf08ef5c..3ae94f1eb435dd8d8bcbb8906d6b5707437a96fb 100644
--- a/interfaces/innerkits/nativetoken/include/nativetoken.h
+++ b/interfaces/innerkits/nativetoken/include/nativetoken.h
@@ -38,6 +38,7 @@ extern "C" {
 #define PATH_MAX_LEN 4096
 #define MAX_RETRY_TIMES 1000
 #define TOKEN_RANDOM_MASK ((1 << 20) - 1)
+#define MAX_ARRAY_SIZE 10240
 
 #define ATRET_FAILED 1
 #define ATRET_SUCCESS 0
@@ -95,4 +96,4 @@ extern int32_t GetFileBuff(const char *cfg, char **retBuff);
 }
 #endif
 
-#endif // NATIVE_TOKEN_H
\ No newline at end of file
+#endif // NATIVE_TOKEN_H
diff --git a/interfaces/innerkits/nativetoken/include/nativetoken_json_oper.h b/interfaces/innerkits/nativetoken/include/nativetoken_json_oper.h
index 820f56581be6a542587f5b3a5baff8048f93ea83..eafac202d3d4ce18738f1ec79d087f6c0edeb7ee 100644
--- a/interfaces/innerkits/nativetoken/include/nativetoken_json_oper.h
+++ b/interfaces/innerkits/nativetoken/include/nativetoken_json_oper.h
@@ -30,10 +30,10 @@ extern uint32_t GetTokenIdFromJson(cJSON *cjsonItem, NativeTokenList *tokenNode)
 extern uint32_t GetAplFromJson(cJSON *cjsonItem, NativeTokenList *tokenNode);
 extern uint32_t GetInfoArrFromJson(cJSON *cjsonItem, char *strArr[], int32_t *strNum, StrArrayAttr *attr);
 extern cJSON *CreateNativeTokenJsonObject(const NativeTokenList *curr);
-extern uint32_t UpdateGoalItemFromRecord(const NativeTokenList *tokenNode, cJSON *record);
+extern uint32_t UpdateGoalItemFromRecord(const NativeTokenList *tokenNode, const cJSON *record);
 
 #ifdef __cplusplus
 }
 #endif
 
-#endif // NATIVETOKEN_JSON_OPER_H
\ No newline at end of file
+#endif // NATIVETOKEN_JSON_OPER_H
diff --git a/interfaces/innerkits/nativetoken/src/nativetoken.c b/interfaces/innerkits/nativetoken/src/nativetoken.c
index 8a58d5fb5a40b7831f9d41692210f3fde2b504d5..a59fe6031888a737f14e1db778d1df6c885cf75a 100644
--- a/interfaces/innerkits/nativetoken/src/nativetoken.c
+++ b/interfaces/innerkits/nativetoken/src/nativetoken.c
@@ -143,7 +143,9 @@ static int32_t GetTokenList(const cJSON *object)
         return ATRET_FAILED;
     }
     int32_t arraySize = cJSON_GetArraySize(object);
-
+    if (arraySize > MAX_ARRAY_SIZE) {
+        return ATRET_FAILED;
+    }
     for (int32_t i = 0; i < arraySize; i++) {
         tmp = (NativeTokenList *)malloc(sizeof(NativeTokenList));
         if (tmp == NULL) {
@@ -183,7 +185,6 @@ static int32_t ParseTokenInfo(void)
     record = cJSON_Parse(fileBuff);
     free(fileBuff);
     fileBuff = NULL;
-
     ret = GetTokenList(record);
     cJSON_Delete(record);
 
@@ -616,7 +617,6 @@ static uint32_t UpdateInfoInCfgFile(const NativeTokenList *tokenNode)
         cJSON_Delete(record);
         return ATRET_FAILED;
     }
-
     WriteToFile(record);
     cJSON_Delete(record);
     return ATRET_SUCCESS;
diff --git a/interfaces/innerkits/nativetoken/src/nativetoken_json_oper.c b/interfaces/innerkits/nativetoken/src/nativetoken_json_oper.c
index 25062d1b7715470920cb20b7fc44610507b696b8..e06ec85a47330e29c8b0ca78195ebcc096a16ca9 100644
--- a/interfaces/innerkits/nativetoken/src/nativetoken_json_oper.c
+++ b/interfaces/innerkits/nativetoken/src/nativetoken_json_oper.c
@@ -81,7 +81,7 @@ uint32_t GetInfoArrFromJson(cJSON *cjsonItem, char *strArr[], int32_t *strNum, S
 {
     cJSON *strArrJson = cJSON_GetObjectItem(cjsonItem, attr->strKey);
     int32_t size = cJSON_GetArraySize(strArrJson);
-    if (size > attr->maxStrNum) {
+    if (size > attr->maxStrNum || size < 0) {
         AT_LOG_ERROR("[ATLIB-%s]:size = %d is invalid.", __func__, size);
         return ATRET_FAILED;
     }
@@ -273,9 +273,12 @@ static uint32_t UpdateItemcontent(const NativeTokenList *tokenNode, cJSON *recor
     return ATRET_SUCCESS;
 }
 
-uint32_t UpdateGoalItemFromRecord(const NativeTokenList *tokenNode, cJSON *record)
+uint32_t UpdateGoalItemFromRecord(const NativeTokenList *tokenNode, const cJSON *record)
 {
     int32_t arraySize = cJSON_GetArraySize(record);
+    if (arraySize > MAX_ARRAY_SIZE) {
+        return ATRET_FAILED;
+    }
     for (int32_t i = 0; i < arraySize; i++) {
         cJSON *cjsonItem = cJSON_GetArrayItem(record, i);
         if (cjsonItem == NULL) {