diff --git a/services/engine/BUILD.gn b/services/engine/BUILD.gn
index 767bc87b45747ba7259aef70d8155d22f18e9e06..7cd0289d78ab99cad64462a93edeecdaf1f848df 100644
--- a/services/engine/BUILD.gn
+++ b/services/engine/BUILD.gn
@@ -40,6 +40,7 @@ ohos_shared_library("$updateengine_library_name") {
     cfi = true
     cfi_cross_dso = true
     debug = false
+    blocklist = "./cfi_blocklist.txt"
   }
   branch_protector_ret = "pac_ret"
   shlib_type = "sa"
diff --git a/services/engine/cfi_blocklist.txt b/services/engine/cfi_blocklist.txt
new file mode 100644
index 0000000000000000000000000000000000000000..317b63380700180b5baedc8f91945cdf5d6e5eae
--- /dev/null
+++ b/services/engine/cfi_blocklist.txt
@@ -0,0 +1,16 @@
+# Copyright (C) 2022-2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[cfi]
+type:*OHOS::UpdateEngine::UpdateServiceImplFirmware*
+src:*update_service_impl_firmware.cpp
diff --git a/services/firmware/check/include/firmware_icheck.h b/services/firmware/check/include/firmware_icheck.h
index 85f2536e28cbaf4a4e95457ed64aca868fea1c11..aef832a7ce9d4d22b29913503de3eba056a08c28 100644
--- a/services/firmware/check/include/firmware_icheck.h
+++ b/services/firmware/check/include/firmware_icheck.h
@@ -54,7 +54,6 @@ const std::string PARAM_NAME_FOR_SEARCH = "update.serverip.search";
 using CheckCallback = std::function<void(CheckStatus status, const Duration &duration,
     const std::vector<FirmwareComponent> &firmwareCheckResultList, const CheckAndAuthInfo &checkAndAuthInfo)>;
 
-using cJSONPtr = std::unique_ptr<cJSON, decltype(&cJSON_Delete)>;
 struct FirmwareCheckCallback {
     CheckCallback callback;
 };
@@ -118,15 +117,17 @@ private:
     {
         response.content.assign(buffer.begin(), buffer.end());
         response.status = static_cast<int64_t>(HttpConstant::SUCCESS);
-        cJSONPtr root(cJSON_Parse(buffer.data()), cJSON_Delete);
+        cJSON *root = cJSON_Parse(buffer.data());
         ENGINE_CHECK(root != nullptr, return -1, "Error get root");
-        cJSON *item = cJSON_GetObjectItem(root.get(), "searchStatus");
-        ENGINE_CHECK(root != nullptr, return -1, "Error get searchStatus");
+        cJSON *item = cJSON_GetObjectItem(root, "searchStatus");
+        ENGINE_CHECK(item != nullptr, cJSON_Delete(root);
+            return -1, "Error get searchStatus");
         if (!cJSON_IsNumber(item)) {
             FIRMWARE_LOGE("Error json parse");
             return -1;
         }
-        return CAST_INT(static_cast<SearchStatus>(item->valueint));
+        int32_t result = item->valueint;
+        return result;
     }
 
     int32_t ReadDataFromSSL(int32_t engineSocket, NetworkResponse &response)