diff --git a/src/query/src/qast.c b/src/query/src/qast.c
index 1db965e8a3abb54008a955d3563dce0a2576060e..8d2202563d324de926629e41ad562f8bd4f3873b 100644
--- a/src/query/src/qast.c
+++ b/src/query/src/qast.c
@@ -496,7 +496,6 @@ static int32_t setQueryCond(tQueryInfo *queryColInfo, SQueryCond* pCond) {
     printf("relation is like\n");
     assert(0);
   }
-  
   return TSDB_CODE_SUCCESS;
 }
 
@@ -511,7 +510,7 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
   if (cond.start != NULL) {
     iter = tSkipListCreateIterFromVal(pSkipList, (char*) cond.start->v, pSkipList->keyInfo.type, TSDB_ORDER_ASC);
   } else {
-    iter = tSkipListCreateIterFromVal(pSkipList, (char*) cond.end->v, pSkipList->keyInfo.type, TSDB_ORDER_DESC);
+    iter = tSkipListCreateIterFromVal(pSkipList, (char*)(cond.end ? cond.end->v: NULL), pSkipList->keyInfo.type, TSDB_ORDER_DESC);
   }
   
   if (cond.start != NULL) {
@@ -601,6 +600,9 @@ static void tQueryIndexColumn(SSkipList* pSkipList, tQueryInfo* pQueryInfo, SArr
       }
     }
   }
+  free(cond.start); 
+  free(cond.end);
+  tSkipListDestroyIter(iter);
 }
 
 int32_t merge(SArray *pLeft, SArray *pRight, SArray *pFinalRes) {
@@ -748,6 +750,7 @@ static void exprTreeTraverseImpl(tExprNode *pExpr, SArray *pResult, SExprTravers
   }
   
   taosArrayCopy(pResult, array);
+  taosArrayDestroy(array);
 }
 
 static void tSQLBinaryTraverseOnSkipList(tExprNode *pExpr, SArray *pResult, SSkipList *pSkipList, SExprTraverseSupp *param ) {
@@ -1182,4 +1185,4 @@ tExprNode* exprTreeFromTableName(const char* tbnameCond) {
 
   CLEANUP_EXECUTE_TO(anchor, false);
   return expr;
-}
\ No newline at end of file
+}
diff --git a/src/query/src/qextbuffer.c b/src/query/src/qextbuffer.c
index 6351b850d879efc2eb4f5bc11f44a29fb5f63ab5..e0a90e04082706eb720960e88356df466dbd017f 100644
--- a/src/query/src/qextbuffer.c
+++ b/src/query/src/qextbuffer.c
@@ -896,6 +896,7 @@ void tColModelDisplay(SColumnModel *pModel, void *pData, int32_t numOfRows, int3
           char buf[4096] = {0};
           taosUcs4ToMbs(val, pModel->pFields[j].field.bytes, buf);
           printf("%s\t", buf);
+          break;
         }
         case TSDB_DATA_TYPE_BINARY: {
           printBinaryData(val, pModel->pFields[j].field.bytes);
@@ -947,6 +948,7 @@ void tColModelDisplayEx(SColumnModel *pModel, void *pData, int32_t numOfRows, in
           char buf[128] = {0};
           taosUcs4ToMbs(val, pModel->pFields[j].field.bytes, buf);
           printf("%s\t", buf);
+          break;
         }
         case TSDB_DATA_TYPE_BINARY: {
           printBinaryDataEx(val, pModel->pFields[j].field.bytes, &param[j]);
diff --git a/src/query/src/qparserImpl.c b/src/query/src/qparserImpl.c
index 4a3cb8adda6952b669787fa9bf67ff24481e3514..87add1e69e6f5ad1f7422a0dcb8d69c4b57e95c8 100644
--- a/src/query/src/qparserImpl.c
+++ b/src/query/src/qparserImpl.c
@@ -775,19 +775,14 @@ void setDCLSQLElems(SSqlInfo *pInfo, int32_t type, int32_t nParam, ...) {
 
   while (nParam-- > 0) {
     SSQLToken *pToken = va_arg(va, SSQLToken *);
-    (void)tTokenListAppend(pInfo->pDCLInfo, pToken);
+    pInfo->pDCLInfo = tTokenListAppend(pInfo->pDCLInfo, pToken);
   }
   va_end(va);
 }
 
 void setDropDBTableInfo(SSqlInfo *pInfo, int32_t type, SSQLToken* pToken, SSQLToken* existsCheck) {
   pInfo->type = type;
-  
-  if (pInfo->pDCLInfo == NULL) {
-    pInfo->pDCLInfo = calloc(1, sizeof(tDCLSQL));
-  }
-  
-  tTokenListAppend(pInfo->pDCLInfo, pToken);
+  pInfo->pDCLInfo = tTokenListAppend(pInfo->pDCLInfo, pToken);
   pInfo->pDCLInfo->existsCheck = (existsCheck->n == 1);
 }
 
diff --git a/src/query/src/qpercentile.c b/src/query/src/qpercentile.c
index 286171bdab794dde6fdf07d65fbcfa1d6875215b..367028928b71c345123eaf432fb72178b81957f3 100644
--- a/src/query/src/qpercentile.c
+++ b/src/query/src/qpercentile.c
@@ -241,7 +241,6 @@ void tBucketDoubleHash(tMemBucket *pBucket, void *value, int16_t *segIdx, int16_
 tMemBucket *tMemBucketCreate(int32_t totalSlots, int32_t nBufferSize, int16_t nElemSize, int16_t dataType,
                              tOrderDescriptor *pDesc) {
   tMemBucket *pBucket = (tMemBucket *)malloc(sizeof(tMemBucket));
-
   pBucket->nTotalSlots = totalSlots;
   pBucket->nSlotsOfSeg = 1 << 6;  // 64 Segments, 16 slots each seg.
   pBucket->dataType = dataType;
@@ -258,6 +257,7 @@ tMemBucket *tMemBucketCreate(int32_t totalSlots, int32_t nBufferSize, int16_t nE
   pBucket->numOfTotalPages = pBucket->nTotalBufferSize / pBucket->pageSize;
   pBucket->numOfAvailPages = pBucket->numOfTotalPages;
 
+  pBucket->pSegs = NULL;
   pBucket->pOrderDesc = pDesc;
 
   switch (pBucket->dataType) {
@@ -315,7 +315,7 @@ tMemBucket *tMemBucketCreate(int32_t totalSlots, int32_t nBufferSize, int16_t nE
     pBucket->pSegs[i].pBoundingEntries = NULL;
   }
 
-  uTrace("MemBucket:%p,created,buffer size:%d,elem size:%d", pBucket, pBucket->numOfTotalPages * DEFAULT_PAGE_SIZE,
+  uTrace("MemBucket:%p,created,buffer size:%ld,elem size:%d", pBucket, pBucket->numOfTotalPages * DEFAULT_PAGE_SIZE,
          pBucket->nElemSize);
 
   return pBucket;
@@ -751,7 +751,7 @@ double getPercentileImpl(tMemBucket *pMemBucket, int32_t count, double fraction)
 
           char * thisVal = buffer->data + pMemBucket->nElemSize * currentIdx;
           char * nextVal = thisVal + pMemBucket->nElemSize;
-          double td, nd;
+          double td = 1.0, nd = 1.0;
           switch (pMemBucket->dataType) {
             case TSDB_DATA_TYPE_SMALLINT: {
               td = *(int16_t *)thisVal;
diff --git a/src/query/src/qresultBuf.c b/src/query/src/qresultBuf.c
index 55ec57b763cb9547f8946ec9577279b1bd2f2170..19353c9c5a6ea88fa536e9bb4e38c89c3fefd4f7 100644
--- a/src/query/src/qresultBuf.c
+++ b/src/query/src/qresultBuf.c
@@ -6,7 +6,12 @@
 #include "queryLog.h"
 
 int32_t createDiskbasedResultBuffer(SDiskbasedResultBuf** pResultBuf, int32_t size, int32_t rowSize, void* handle) {
-  SDiskbasedResultBuf* pResBuf = calloc(1, sizeof(SDiskbasedResultBuf));
+  *pResultBuf = calloc(1, sizeof(SDiskbasedResultBuf));
+  SDiskbasedResultBuf* pResBuf = *pResultBuf;
+  if (pResBuf == NULL) {
+    return TSDB_CODE_COM_OUT_OF_MEMORY;  
+  }
+  
   pResBuf->numOfRowsPerPage = (DEFAULT_INTERN_BUF_PAGE_SIZE - sizeof(tFilePage)) / rowSize;
   pResBuf->numOfPages = size;
 
@@ -46,7 +51,6 @@ int32_t createDiskbasedResultBuffer(SDiskbasedResultBuf** pResultBuf, int32_t si
   qTrace("QInfo:%p create tmp file for output result, %s, %" PRId64 "bytes", handle, pResBuf->path,
       pResBuf->totalBufSize);
   
-  *pResultBuf = pResBuf;
   return TSDB_CODE_SUCCESS;
 }
 
@@ -210,7 +214,7 @@ void destroyResultBuf(SDiskbasedResultBuf* pResultBuf, void* handle) {
 }
 
 int32_t getLastPageId(SIDList *pList) {
-  if (pList == NULL && pList->size <= 0) {
+  if (pList == NULL || pList->size <= 0) {
     return -1;
   }
   
diff --git a/src/query/src/qtsbuf.c b/src/query/src/qtsbuf.c
index 869299f30936bb7fd7e40a89b02c15d06f307b8d..834f648b7a83ac12d2cc3eb0e6b7a387d5aa98e8 100644
--- a/src/query/src/qtsbuf.c
+++ b/src/query/src/qtsbuf.c
@@ -533,7 +533,7 @@ STSVnodeBlockInfo* tsBufGetVnodeBlockInfo(STSBuf* pTSBuf, int32_t vnodeId) {
 }
 
 int32_t STSBufUpdateHeader(STSBuf* pTSBuf, STSBufFileHeader* pHeader) {
-  if ((pTSBuf->f == NULL) || pHeader == NULL || pHeader->numOfVnode < 0 || pHeader->magic != TS_COMP_FILE_MAGIC) {
+  if ((pTSBuf->f == NULL) || pHeader == NULL || pHeader->numOfVnode == 0 || pHeader->magic != TS_COMP_FILE_MAGIC) {
     return -1;
   }
   
diff --git a/src/query/src/tvariant.c b/src/query/src/tvariant.c
index b11850a672a15d56fc776f8f12f0ed227731a34c..32d06225c513dfef071113278666d451bd9a0ae3 100644
--- a/src/query/src/tvariant.c
+++ b/src/query/src/tvariant.c
@@ -357,7 +357,7 @@ static int32_t toBinary(tVariant *pVariant, char **pDest, int32_t *pDestSize) {
   if (pVariant->nType == TSDB_DATA_TYPE_NCHAR) {
     size_t newSize = pVariant->nLen * TSDB_NCHAR_SIZE;
     if (pBuf != NULL) {
-      if (newSize > INITIAL_ALLOC_SIZE) {
+      if (newSize >= INITIAL_ALLOC_SIZE) {
         pBuf = realloc(pBuf, newSize + 1);
       }