diff --git a/interfaces/innerkits/fs_manager/fstab_mount.c b/interfaces/innerkits/fs_manager/fstab_mount.c
index 78020c87cb539b5fe637e11cebf716ebc51ef66e..21e22abd4401efdcbb68596094ed3747a485ef12 100755
--- a/interfaces/innerkits/fs_manager/fstab_mount.c
+++ b/interfaces/innerkits/fs_manager/fstab_mount.c
@@ -455,7 +455,7 @@ static int MountWithCheckpoint(const char *source, const char *target, const cha
     int gcAllowance = 0;
     do {
         char realData[FS_MANAGER_BUFFER_SIZE] = {0};
-        size_t bytes = snprintf_s(realData, FS_MANAGER_BUFFER_SIZE, FS_MANAGER_BUFFER_SIZE - 1, "%s,%s:%d%%",
+        int bytes = snprintf_s(realData, FS_MANAGER_BUFFER_SIZE, FS_MANAGER_BUFFER_SIZE - 1, "%s,%s:%d%%",
             data, "checkpoint=disable", gcAllowance);
         BEGET_ERROR_CHECK(bytes > 0, break, "build realData failed");
         if (bytes <= 0) {
diff --git a/interfaces/innerkits/fs_manager/libfs_dm/fs_dm_linear.c b/interfaces/innerkits/fs_manager/libfs_dm/fs_dm_linear.c
index ef32ff23667547faef08ab8cde1f822387a3e621..fe97cdee302ead9d29d63cc30b9808a72c703185 100644
--- a/interfaces/innerkits/fs_manager/libfs_dm/fs_dm_linear.c
+++ b/interfaces/innerkits/fs_manager/libfs_dm/fs_dm_linear.c
@@ -48,7 +48,7 @@ static int LoadDmLinearDeviceTable(int fd, const char *devName, DmLinearTarget *
     io->data_start = sizeof(*io);
     io->target_count = targetNum;
     uint32_t i = 0;
-    int len = 0;
+    uint32_t len = 0;
     char *paras = NULL;
     do {
         FS_DM_RETURN_ERR_IF_NULL(target[i].paras);
diff --git a/interfaces/innerkits/syspara/param_comm.c b/interfaces/innerkits/syspara/param_comm.c
index 9b4047e72fbd1fd27e70ffc57951864f81dcbd7f..017708a69bba7492d52b44972d01951db85ae896 100644
--- a/interfaces/innerkits/syspara/param_comm.c
+++ b/interfaces/innerkits/syspara/param_comm.c
@@ -77,7 +77,7 @@ INIT_LOCAL_API int GetParameter_(const char *key, const char *def, char *value,
         if (def == NULL) {
             return GetSystemError(ret);
         }
-        if (strlen(def) > len) {
+        if (strlen(def) >= len) {
             return EC_INVALID;
         }
         ret = strcpy_s(value, len, def);
diff --git a/services/init/init_cgroup.c b/services/init/init_cgroup.c
index 2f4ed3b9adc6a37bd6817d4f64d501e52a33beba..7104ba25ecfba1858b8fba9174d40241f1b0519e 100644
--- a/services/init/init_cgroup.c
+++ b/services/init/init_cgroup.c
@@ -95,6 +95,7 @@ static void RmdirTimer(Service *service, uint64_t timeout)
     serviceRmdir->pid = service->pid;
     int strLen = strlen(service->name);
     serviceRmdir->name = (char *)malloc(sizeof(char)*(strLen + 1));
+    INIT_ERROR_CHECK(serviceRmdir->name != NULL, free(serviceRmdir); return, "Failed to malloc for serviceRmdir->name");
     int ret = strcpy_s(serviceRmdir->name, strLen + 1, service->name);
     if (ret != 0) {
         free(serviceRmdir->name);
diff --git a/services/init/init_common_service.c b/services/init/init_common_service.c
index 7956dae255ede693ca42df5722f0b3dce802faef..83de46a88f940e7356a619dcc6d673279fb7769d 100644
--- a/services/init/init_common_service.c
+++ b/services/init/init_common_service.c
@@ -379,7 +379,7 @@ static int PublishHoldFds(Service *service)
             continue;
         }
         ret = snprintf_s((char *)fdBuffer + pos, sizeof(fdBuffer) - pos, sizeof(fdBuffer) - 1, "%d ", fd);
-        INIT_ERROR_CHECK(ret >= 0, return INIT_EFORMAT,
+        INIT_ERROR_CHECK(ret >= 0, close(fd); return INIT_EFORMAT,
             "Service error %d %s, failed to format fd for publish", ret, service->name);
         pos += (size_t)ret;
     }
diff --git a/services/param/manager/param_manager.c b/services/param/manager/param_manager.c
index db4d1ce556925b12b1adf4e28a25bcf8cee0b147..31ed67ea0816a16a73b14a2d586a45d85159b98f 100644
--- a/services/param/manager/param_manager.c
+++ b/services/param/manager/param_manager.c
@@ -456,7 +456,7 @@ static int UpdateParam(const WorkSpace *workSpace, uint32_t *dataIndex, const ch
     uint32_t valueLen = strlen(value);
     uint32_t commitId = ATOMIC_LOAD_EXPLICIT(&entry->commitId, MEMORY_ORDER_RELAXED);
     ATOMIC_STORE_EXPLICIT(&entry->commitId, commitId | PARAM_FLAGS_MODIFY, MEMORY_ORDER_RELAXED);
-    if (((mode & LOAD_PARAM_UPDATE_CONST) == LOAD_PARAM_UPDATE_CONST) &&
+    if ((((uint32_t)mode & LOAD_PARAM_UPDATE_CONST) == LOAD_PARAM_UPDATE_CONST) &&
         (entry->valueLength < PARAM_CONST_VALUE_LEN_MAX && valueLen < PARAM_CONST_VALUE_LEN_MAX)) {
         int ret = PARAM_MEMCPY(entry->data + entry->keyLength + 1, PARAM_CONST_VALUE_LEN_MAX, value, valueLen + 1);
         PARAM_CHECK(ret == 0, return PARAM_CODE_INVALID_VALUE, "Failed to copy value");
diff --git a/services/sandbox/sandbox.c b/services/sandbox/sandbox.c
index fb27356474d3db341a7fcee05236c0e25544eafc..ea980270b805be3afbff867008a227e723be0e15 100755
--- a/services/sandbox/sandbox.c
+++ b/services/sandbox/sandbox.c
@@ -278,7 +278,8 @@ static int AddSymbolLinksToSandbox(sandbox_t *sandbox, cJSON *item, const char *
     tmpLink->target = strdup(target);
     BEGET_ERROR_CHECK(tmpLink->target != NULL, free(tmpLink); return -1, "Failed to dup target");
     tmpLink->linkName = strdup(name);
-    BEGET_ERROR_CHECK(tmpLink->linkName != NULL, free(tmpLink); return -1, "Failed to dup linkName");
+    BEGET_ERROR_CHECK(tmpLink->linkName != NULL, free(tmpLink->target); free(tmpLink); return -1,
+        "Failed to dup linkName");
     OH_ListInit(&tmpLink->node);
     RemoveOldSandboxLinkListNode(&sandbox->linksHead, tmpLink->linkName);
     OH_ListAddTail(&sandbox->linksHead, &tmpLink->node);
diff --git a/ueventd/standard/ueventd_parameter.c b/ueventd/standard/ueventd_parameter.c
index 4145c80d4e5644a2bea8073f71175415d3a04b5c..1de8f8e8a893ce8703913077c01332e13ea3fbf5 100644
--- a/ueventd/standard/ueventd_parameter.c
+++ b/ueventd/standard/ueventd_parameter.c
@@ -78,6 +78,7 @@ static void *ThreadRun(void *data)
             pthread_cond_timedwait(&(parameterCtrl->hasData), &(parameterCtrl->lock), &abstime);
         }
         if (parameterCtrl->shutdown) {
+            pthread_mutex_unlock(&(parameterCtrl->lock));
             break;
         }
         pthread_mutex_unlock(&(parameterCtrl->lock));