diff --git a/src/dnode/src/dnodeMgmt.c b/src/dnode/src/dnodeMgmt.c
index c4a07518ea7bf09f1e4dbf5d99ea90690d4c3c17..14c2a725d921f0d7f8215e792daac948df7b71ce 100644
--- a/src/dnode/src/dnodeMgmt.c
+++ b/src/dnode/src/dnodeMgmt.c
@@ -369,7 +369,8 @@ static void dnodeUpdateMnodeInfos(SDMMnodeInfos *pMnodes) {
 }
 
 static bool dnodeReadMnodeInfos() {
-  char ipFile[TSDB_FILENAME_LEN] = {0};
+  char ipFile[TSDB_FILENAME_LEN*2] = {0};
+  
   sprintf(ipFile, "%s/mnodeIpList.json", tsDnodeDir);
   FILE *fp = fopen(ipFile, "r");
   if (!fp) {
@@ -537,7 +538,8 @@ static void dnodeSendStatusMsg(void *handle, void *tmrId) {
 }
 
 static bool dnodeReadDnodeCfg() {
-  char dnodeCfgFile[TSDB_FILENAME_LEN] = {0};
+  char dnodeCfgFile[TSDB_FILENAME_LEN*2] = {0};
+  
   sprintf(dnodeCfgFile, "%s/dnodeCfg.json", tsDnodeDir);
 
   FILE *fp = fopen(dnodeCfgFile, "r");
diff --git a/src/dnode/src/dnodeSystem.c b/src/dnode/src/dnodeSystem.c
index a7bfc2d7d2224287dec353b7a40b239307d93a74..0f8dabd75a7b0e10263a721b77e765971d5272c0 100644
--- a/src/dnode/src/dnodeSystem.c
+++ b/src/dnode/src/dnodeSystem.c
@@ -28,8 +28,12 @@ int32_t main(int32_t argc, char *argv[]) {
   // Set global configuration file
   for (int32_t i = 1; i < argc; ++i) {
     if (strcmp(argv[i], "-c") == 0) {
-      if (i < argc - 1) {
-        strcpy(configDir, argv[++i]);
+      if (i < argc - 1) {        
+        if (strlen(argv[++i]) > TSDB_FILENAME_LEN - 1) {
+          printf("config file path overflow");
+          exit(EXIT_FAILURE);
+        }
+        strcpy(configDir, argv[i]);
       } else {
         printf("'-c' requires a parameter, default:%s\n", configDir);
         exit(EXIT_FAILURE);
diff --git a/src/dnode/src/dnodeVWrite.c b/src/dnode/src/dnodeVWrite.c
index bbddfa09279160b903c1a2dc57a65b6271c8d3b9..20c50c5f8c3528d8be2773486d859d3d007841b6 100644
--- a/src/dnode/src/dnodeVWrite.c
+++ b/src/dnode/src/dnodeVWrite.c
@@ -129,7 +129,10 @@ void *dnodeAllocateVnodeWqueue(void *pVnode) {
 
   if (pWorker->qset == NULL) {
     pWorker->qset = taosOpenQset();
-    if (pWorker->qset == NULL) return NULL;
+    if (pWorker->qset == NULL) {
+      taosCloseQueue(queue);
+      return NULL;
+    }
 
     taosAddIntoQset(pWorker->qset, queue, pVnode);
     pWorker->qall = taosAllocateQall();
diff --git a/src/kit/shell/src/shellDarwin.c b/src/kit/shell/src/shellDarwin.c
index 98ea6510d7abd2cae75037653102d5487faba41d..439ca6edada6b9ffd1f2d2a0385e94ec7831913e 100644
--- a/src/kit/shell/src/shellDarwin.c
+++ b/src/kit/shell/src/shellDarwin.c
@@ -96,8 +96,12 @@ void shellParseArgument(int argc, char *argv[], struct arguments *arguments) {
         exit(EXIT_FAILURE);
       }
     } else if (strcmp(argv[i], "-c") == 0) {
-      if (i < argc - 1) {
-        strcpy(configDir, argv[++i]);
+      if (i < argc - 1) { 
+        if (strlen(argv[++i]) > TSDB_FILENAME_LEN - 1) {
+          fprintf(stderr, "config file path: %s overflow max len %d\n", argv[i], TSDB_FILENAME_LEN - 1);
+          exit(EXIT_FAILURE);
+        }
+        strcpy(configDir, argv[i]);
       } else {
         fprintf(stderr, "Option -c requires an argument\n");
         exit(EXIT_FAILURE);
diff --git a/src/kit/shell/src/shellLinux.c b/src/kit/shell/src/shellLinux.c
index b4b74eae3ab13b4a22e7fa992317fd8f33bc3fbc..7d035126c00351444220ab66ea340bc362219ebc 100644
--- a/src/kit/shell/src/shellLinux.c
+++ b/src/kit/shell/src/shellLinux.c
@@ -80,6 +80,11 @@ static error_t parse_opt(int key, char *arg, struct argp_state *state) {
       if (wordexp(arg, &full_path, 0) != 0) {
         fprintf(stderr, "Invalid path %s\n", arg);
         return -1;
+      }       
+      if (strlen(full_path.we_wordv[0]) > TSDB_FILENAME_LEN - 1) {
+        fprintf(stderr, "config file path: %s overflow max len %d\n", full_path.we_wordv[0], TSDB_FILENAME_LEN - 1);
+        wordfree(&full_path);
+        return -1;
       }
       strcpy(configDir, full_path.we_wordv[0]);
       wordfree(&full_path);
diff --git a/src/kit/shell/src/shellWindows.c b/src/kit/shell/src/shellWindows.c
index 48545f537e3848b955195ae261080b307e06a2f9..cf96bce5a89d76216535b68d745ea9b826cd0b01 100644
--- a/src/kit/shell/src/shellWindows.c
+++ b/src/kit/shell/src/shellWindows.c
@@ -76,8 +76,12 @@ void shellParseArgument(int argc, char *argv[], struct arguments *arguments) {
         exit(EXIT_FAILURE);
       }
     } else if (strcmp(argv[i], "-c") == 0) {
-      if (i < argc - 1) {
-        strcpy(configDir, argv[++i]);
+      if (i < argc - 1) {   
+        if (strlen(argv[++i]) > TSDB_FILENAME_LEN - 1) {
+          fprintf(stderr, "config file path: %s overflow max len %d\n", argv[i], TSDB_FILENAME_LEN - 1);
+          exit(EXIT_FAILURE);
+        }
+        strcpy(configDir, argv[i]);
       } else {
         fprintf(stderr, "Option -c requires an argument\n");
         exit(EXIT_FAILURE);
diff --git a/src/mnode/src/mnodeShow.c b/src/mnode/src/mnodeShow.c
index b126e734d17e9722ff81d25f8d33156f0ed3f653..d28d0b5b307e47b68ad18c4c33abe8cf2d5e9d15 100644
--- a/src/mnode/src/mnodeShow.c
+++ b/src/mnode/src/mnodeShow.c
@@ -132,6 +132,7 @@ static int32_t mnodeProcessShowMsg(SMnodeMsg *pMsg) {
   int32_t size = sizeof(SCMShowRsp) + sizeof(SSchema) * TSDB_MAX_COLUMNS + TSDB_EXTRA_PAYLOAD_SIZE;
   SCMShowRsp *pShowRsp = rpcMallocCont(size);
   if (pShowRsp == NULL) {
+    mnodeFreeShowObj(pShow);
     return TSDB_CODE_SERV_OUT_OF_MEMORY;
   }
   pShowRsp->qhandle = htobe64((uint64_t) pShow);
diff --git a/src/mnode/src/mnodeTable.c b/src/mnode/src/mnodeTable.c
index 07520fbb2b3de18b055986e4fd0c0729a5ebecf6..3befeab4aa12233195346ab2fcaba8f19cfe2a27 100644
--- a/src/mnode/src/mnodeTable.c
+++ b/src/mnode/src/mnodeTable.c
@@ -484,7 +484,10 @@ static int32_t mnodeSuperTableActionDecode(SSdbOper *pOper) {
   if (pStable == NULL) return TSDB_CODE_SERV_OUT_OF_MEMORY;
 
   int32_t len = strlen(pOper->rowData);
-  if (len > TSDB_TABLE_ID_LEN) return TSDB_CODE_INVALID_TABLE_ID;
+  if (len > TSDB_TABLE_ID_LEN){
+    free(pStable);
+    return TSDB_CODE_INVALID_TABLE_ID;
+  }
   pStable->info.tableId = strdup(pOper->rowData);
   len++;
 
@@ -2356,4 +2359,4 @@ static int32_t mnodeRetrieveStreams(SShowObj *pShow, char *data, int32_t rows, v
   mnodeDecDbRef(pDb);
 
   return numOfRows;
-}
\ No newline at end of file
+}
diff --git a/src/plugins/http/src/tgHandle.c b/src/plugins/http/src/tgHandle.c
index 1a55c325d5cfb1ccf6d6a6f83da7f2e2880cad83..61f9da63688f6d0f541a1fbae56b4d2037978269 100644
--- a/src/plugins/http/src/tgHandle.c
+++ b/src/plugins/http/src/tgHandle.c
@@ -281,7 +281,7 @@ int tgReadSchema(char *fileName) {
 }
 
 void tgInitHandle(HttpServer *pServer) {
-  char fileName[256] = {0};
+  char fileName[TSDB_FILENAME_LEN*2] = {0};
   sprintf(fileName, "%s/taos.telegraf.cfg", configDir);
   if (tgReadSchema(fileName) <= 0) {
     tgFreeSchemas();
diff --git a/src/util/src/tconfig.c b/src/util/src/tconfig.c
index 32a3df844c2be3bbbf634af796e56fb2c47a05ed..203a34fd15341acf263e74166717a14d4787a23d 100644
--- a/src/util/src/tconfig.c
+++ b/src/util/src/tconfig.c
@@ -241,7 +241,12 @@ void taosReadGlobalLogCfg() {
 
   wordexp_t full_path;
   wordexp(configDir, &full_path, 0);
-  if (full_path.we_wordv != NULL && full_path.we_wordv[0] != NULL) {
+  if (full_path.we_wordv != NULL && full_path.we_wordv[0] != NULL) {    
+    if (strlen(full_path.we_wordv[0]) > TSDB_FILENAME_LEN - 1) {
+      printf("\nconfig file: %s path overflow max len %d, all variables are set to default\n", full_path.we_wordv[0], TSDB_FILENAME_LEN - 1);
+      wordfree(&full_path);
+      return;
+    }
     strcpy(configDir, full_path.we_wordv[0]);
   } else {
     printf("configDir:%s not there, use default value: /etc/taos", configDir);