diff --git a/src/client/src/tscServer.c b/src/client/src/tscServer.c
index 1c838d22ae692ea01253b3f6acf81eef7dafd072..ec48430453c27e149dfbe24828725421286a3d1a 100644
--- a/src/client/src/tscServer.c
+++ b/src/client/src/tscServer.c
@@ -217,14 +217,19 @@ int tscSendMsgToServer(SSqlObj *pSql) {
     int32_t totalMsgLen = pSql->cmd.payloadLen + tsRpcHeadSize + sizeof(STaosDigest);
 
     // the memory will be released by taosProcessResponse, so no memory leak here
-    char* buf = malloc(totalMsgLen);
-    memcpy(buf, pSql->cmd.payload, totalMsgLen);
+    char *buf = malloc(totalMsgLen);
+    if (NULL == buf) {
+      tscError("%p msg:%s malloc fail", pSql, taosMsg[pSql->cmd.msgType]);
+      return TSDB_CODE_CLI_OUT_OF_MEMORY;
+    }
 
+    memcpy(buf, pSql->cmd.payload, (size_t) totalMsgLen);
     tscTrace("%p msg:%s is sent to server", pSql, taosMsg[pSql->cmd.msgType]);
     char *pStart = taosBuildReqHeader(pSql->thandle, pSql->cmd.msgType, buf);
     if (pStart) {
       if (tscUpdateVnodeMsg[pSql->cmd.command]) (*tscUpdateVnodeMsg[pSql->cmd.command])(pSql, buf);
       int ret = taosSendMsgToPeerH(pSql->thandle, pStart, pSql->cmd.payloadLen, pSql);
+
       if (ret >= 0) code = 0;
       tscTrace("%p send msg ret:%d code:%d sig:%p", pSql, ret, code, pSql->signature);
     }
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index a8ea4a820dbaa75f15e0be2168b449fb987a2b3c..4fb6b655affb0ef974b7ee1da000ac17e7cf5c0b 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -384,11 +384,22 @@ int32_t tscCopyDataBlockToPayload(SSqlObj* pSql, STableDataBlocks* pDataBlock) {
   pCmd->count = pDataBlock->numOfMeters;
   strncpy(pCmd->name, pDataBlock->meterId, TSDB_METER_ID_LEN);
 
-  tscAllocPayloadWithSize(pCmd, pDataBlock->nAllocSize);
+  /*
+   * the submit message consists of : [RPC header|message body|digest]
+   * the dataBlock only includes the RPC Header buffer and actual submit messsage body, space for digest needs
+   * additional space.
+   */
+  int ret = tscAllocPayloadWithSize(pCmd, pDataBlock->nAllocSize + sizeof(STaosDigest));
+  if (TSDB_CODE_SUCCESS != ret) return ret;
   memcpy(pCmd->payload, pDataBlock->pData, pDataBlock->nAllocSize);
 
-  // set the message length
-  pCmd->payloadLen = pDataBlock->nAllocSize;
+  /*
+   * the payloadLen should be actual message body size
+   * the old value of payloadLen is the allocated payload size
+   */
+  pCmd->payloadLen = pDataBlock->nAllocSize - tsRpcHeadSize;
+
+  assert(pCmd->allocSize >= pCmd->payloadLen + tsRpcHeadSize + sizeof(STaosDigest));
   return tscGetMeterMeta(pSql, pCmd->name);
 }