diff --git a/services/engine/BUILD.gn b/services/engine/BUILD.gn
index e45692520b606c5b29bfc9337a3ccc5fa48c0545..a62cccdb13caea749f221ff9fb21b42b6371453d 100644
--- a/services/engine/BUILD.gn
+++ b/services/engine/BUILD.gn
@@ -35,6 +35,9 @@ ohos_prebuilt_etc("updater_sa.cfg") {
 ohos_shared_library("$updateengine_library_name") {
   sanitize = {
     boundary_sanitize = true
+    cfi = true
+    cfi_cross_dso = true
+    debug = true
   }
   shlib_type = "sa"
   include_dirs = sa_include_dirs
diff --git a/services/engine/cfi_blocklist.txt b/services/engine/cfi_blocklist.txt
new file mode 100644
index 0000000000000000000000000000000000000000..c2042363cb40e39434e45faa641109f035aaafea
--- /dev/null
+++ b/services/engine/cfi_blocklist.txt
@@ -0,0 +1,12 @@
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[cfi]
+type:*OHOS::UpdateEngine::UpdateServiceImplFirmware*
diff --git a/services/engine/src/update_service_impl_firmware.cpp b/services/engine/src/update_service_impl_firmware.cpp
index f8e0f0423c64b8aee7fcc9a89cedc6daf3e077e0..2e217a1d1eb330336edcdaa208e9975b1eec7d98 100644
--- a/services/engine/src/update_service_impl_firmware.cpp
+++ b/services/engine/src/update_service_impl_firmware.cpp
@@ -39,14 +39,18 @@ const std::string LANGUAGE_END = "</language>";
 int32_t UpdateServiceImplFirmware::CheckNewVersion(const UpgradeInfo &info, BusinessError &businessError,
     CheckResult &checkResult)
 {
+    FIRMWARE_LOGE("XXXXYYYZZ:   checkNewversion");
     wptr<UpdateServiceImplFirmware> weakPtr(this);
+     FIRMWARE_LOGE("XXXXYYYZZ:   checkNewversion");
     FirmwareManager::GetInstance()->DoCheck(
         [&, weakPtr](const BusinessError &error, const CheckResult &result) {
+             FIRMWARE_LOGE("XXXXYYYZZ:   checkNewversion");
             sptr<UpdateServiceImplFirmware> firmwareSptr = weakPtr.promote();
             if (firmwareSptr == nullptr) {
                 FIRMWARE_LOGE("UpdateServiceImplFirmware has been destructed, CheckNewVersion is TimeOut");
                 return;
             }
+             FIRMWARE_LOGE("XXXXYYYZZ:   checkNewversion");
             businessError = error;
             checkResult = result;
             firmwareSptr->checkComplete_ = true;
@@ -60,7 +64,9 @@ int32_t UpdateServiceImplFirmware::CheckNewVersion(const UpgradeInfo &info, Busi
         businessError.errorNum = CallResult::TIME_OUT;
         businessError.message = "CheckNewVersion TimeOut";
     }
+     FIRMWARE_LOGE("XXXXYYYZZ:   checkNewversion");
     weakPtr->checkComplete_ = false;
+     FIRMWARE_LOGE("XXXXYYYZZ:   checkNewversion");
     return INT_CALL_SUCCESS;
 }
 
diff --git a/services/firmware/check/include/firmware_icheck.h b/services/firmware/check/include/firmware_icheck.h
index 98b547b131f16fba9e7629dbd00f9ce4459a2c5f..706521fccad627f3c3fdce421dfba060d987611b 100644
--- a/services/firmware/check/include/firmware_icheck.h
+++ b/services/firmware/check/include/firmware_icheck.h
@@ -122,15 +122,22 @@ private:
     {
         response.content.assign(buffer.begin(), buffer.end());
         response.status = static_cast<int64_t>(HttpConstant::SUCCESS);
-        cJSONPtr root(cJSON_Parse(buffer.data()), cJSON_Delete);
-        ENGINE_CHECK(root != nullptr, return -1, "Error get root");
-        cJSON *item = cJSON_GetObjectItem(root.get(), "searchStatus");
-        ENGINE_CHECK(item != nullptr, return -1, "Error get searchStatus");
+        cJSON *root = cJSON_Parse(buffer.data());
+        ENGINE_CHECK(root != nullptr,
+            cJSON_Delete(root);
+            return -1, "Error get root");
+        cJSON *item = cJSON_GetObjectItem(root, "searchStatus");
+        ENGINE_CHECK(item != nullptr,
+            cJSON_Delete(root);
+            return -1, "Error get searchStatus");
         if (!cJSON_IsNumber(item)) {
             FIRMWARE_LOGE("Error json parse");
+            cJSON_Delete(root);
             return -1;
         }
-        return CAST_INT(static_cast<SearchStatus>(item->valueint));
+        int32_t ret = item->valueint;
+        cJSON_Delete(root);
+        return ret;
     }
 
     int32_t ReadDataFromSSL(int32_t engineSocket, NetworkResponse &response)