diff --git a/src/client/src/tscAst.c b/src/client/src/tscAst.c
index a06a07524828aede3378e3f5487d729b1e8326a8..d071358dbf0b9611eabac34d5f4a87eef0b6a646 100644
--- a/src/client/src/tscAst.c
+++ b/src/client/src/tscAst.c
@@ -643,13 +643,12 @@ int32_t intersect(tQueryResultset *pLeft, tQueryResultset *pRight, tQueryResults
 }
 
 /*
- *
+ * traverse the result and apply the function to each item to check if the item is qualified or not
  */
-void tSQLListTraverseOnResult(struct tSQLBinaryExpr *pExpr, bool (*fp)(tSkipListNode *, void *),
-                              tQueryResultset *      pResult) {
+static void tSQLListTraverseOnResult(struct tSQLBinaryExpr *pExpr, __result_filter_fn_t  fp, tQueryResultset *pResult) {
   assert(pExpr->pLeft->nodeType == TSQL_NODE_COL && pExpr->pRight->nodeType == TSQL_NODE_VALUE);
 
-  // brutal force search
+  // brutal force scan the result list and check for each item in the list
   int64_t num = pResult->num;
   for (int32_t i = 0, j = 0; i < pResult->num; ++i) {
     if (fp == NULL || (fp(pResult->pRes[i], pExpr->info) == true)) {
diff --git a/src/client/src/tscServer.c b/src/client/src/tscServer.c
index 28cefeea7326d2f225d582dec1e0c58bc3b885c3..0913cf956c66f7bbb8a105d40246465c2b61f828 100644
--- a/src/client/src/tscServer.c
+++ b/src/client/src/tscServer.c
@@ -3350,7 +3350,7 @@ int tscProcessShowRsp(SSqlObj *pSql) {
 }
 
 int tscProcessConnectRsp(SSqlObj *pSql) {
-  char         temp[TSDB_METER_ID_LEN];
+  char         temp[TSDB_METER_ID_LEN*2];
   SConnectRsp *pConnect;
 
   STscObj *pObj = pSql->pTscObj;
@@ -3358,8 +3358,11 @@ int tscProcessConnectRsp(SSqlObj *pSql) {
 
   pConnect = (SConnectRsp *)pRes->pRsp;
   strcpy(pObj->acctId, pConnect->acctId);  // copy acctId from response
-  sprintf(temp, "%s%s%s", pObj->acctId, TS_PATH_DELIMITER, pObj->db);
-  strcpy(pObj->db, temp);
+  int32_t len  =sprintf(temp, "%s%s%s", pObj->acctId, TS_PATH_DELIMITER, pObj->db);
+  
+  assert(len <= tListLen(pObj->db));
+  strncpy(pObj->db, temp, tListLen(pObj->db));
+  
 #ifdef CLUSTER
   SIpList *    pIpList;
   char *rsp = pRes->pRsp + sizeof(SConnectRsp);
diff --git a/src/client/src/tscSub.c b/src/client/src/tscSub.c
index d6bc1eebe94f7f8bee37ba588d232d0347ea6ec1..f2e9395c68b0dfc5a057b331cf00d38dbd9cb311 100644
--- a/src/client/src/tscSub.c
+++ b/src/client/src/tscSub.c
@@ -56,7 +56,7 @@ TAOS_SUB *taos_subscribe(const char *host, const char *user, const char *pass, c
   if (pSub->taos == NULL) {
     tfree(pSub);
   } else {
-    char qstr[128];
+    char qstr[256] = {0};
     sprintf(qstr, "use %s", db);
     int res = taos_query(pSub->taos, qstr);
     if (res != 0) {
@@ -64,7 +64,7 @@ TAOS_SUB *taos_subscribe(const char *host, const char *user, const char *pass, c
       taos_close(pSub->taos);
       tfree(pSub);
     } else {
-      sprintf(qstr, "select * from %s where _c0 > now+1000d", pSub->name);
+      snprintf(qstr, tListLen(qstr), "select * from %s where _c0 > now+1000d", pSub->name);
       if (taos_query(pSub->taos, qstr)) {
         tscTrace("failed to select, reason:%s", taos_errstr(pSub->taos));
         taos_close(pSub->taos);
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index 3ff262bf6804fe04edbbed20d2fa559f4e7247a6..288e564cb0b9e11d571e85160ef74dfbbdea74ed 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -1138,7 +1138,8 @@ void tscColumnFilterInfoCopy(SColumnFilterInfo* dst, const SColumnFilterInfo* sr
   *dst = *src;
   if (dst->filterOnBinary) {
     size_t len = (size_t) dst->len + 1;
-    dst->pz = calloc(1, len);
+    char* pTmp = calloc(1, len);
+    dst->pz = (int64_t) pTmp;
     memcpy((char*) dst->pz, (char*) src->pz, (size_t) len);
   }
 }