diff --git a/source/client/src/clientImpl.c b/source/client/src/clientImpl.c
index e8eef0d287af9ef94c8d1f8f40ff3c21df63e7bb..73374c7f774beecca4c9ff78ed4e3ff87c48c4e7 100644
--- a/source/client/src/clientImpl.c
+++ b/source/client/src/clientImpl.c
@@ -1609,11 +1609,13 @@ static int32_t doConvertJson(SReqResultInfo* pResultInfo, int32_t numOfCols, int
   if (pResultInfo->convertJson == NULL) return TSDB_CODE_OUT_OF_MEMORY;
   char* p1 = pResultInfo->convertJson;
 
+  int32_t totalLen = 0;
   int32_t len = sizeof(int32_t) + sizeof(uint64_t) + numOfCols * (sizeof(int16_t) + sizeof(int32_t));
   memcpy(p1, p, len);
 
   p += len;
   p1 += len;
+  totalLen += len;
 
   len = sizeof(int32_t) * numOfCols;
   int32_t* colLength = (int32_t*)p;
@@ -1621,6 +1623,7 @@ static int32_t doConvertJson(SReqResultInfo* pResultInfo, int32_t numOfCols, int
   memcpy(p1, p, len);
   p += len;
   p1 += len;
+  totalLen += len;
 
   char* pStart = p;
   char* pStart1 = p1;
@@ -1636,6 +1639,7 @@ static int32_t doConvertJson(SReqResultInfo* pResultInfo, int32_t numOfCols, int
       memcpy(pStart1, pStart, len);
       pStart += len;
       pStart1 += len;
+      totalLen += len;
 
       len = 0;
       for (int32_t j = 0; j < numOfRows; ++j) {
@@ -1680,24 +1684,30 @@ static int32_t doConvertJson(SReqResultInfo* pResultInfo, int32_t numOfCols, int
         len += varDataTLen(dst);
       }
       colLen1 = len;
+      totalLen += colLen1;
       colLength1[i] = htonl(len);
     } else if (IS_VAR_DATA_TYPE(pResultInfo->fields[i].type)) {
       len = numOfRows * sizeof(int32_t);
       memcpy(pStart1, pStart, len);
       pStart += len;
       pStart1 += len;
+      totalLen += len;
+      totalLen += colLen;
       memcpy(pStart1, pStart, colLen);
     } else {
       len = BitmapLen(pResultInfo->numOfRows);
       memcpy(pStart1, pStart, len);
       pStart += len;
       pStart1 += len;
+      totalLen += len;
+      totalLen += colLen;
       memcpy(pStart1, pStart, colLen);
     }
     pStart += colLen;
     pStart1 += colLen1;
   }
 
+  *(int32_t*)(pResultInfo->convertJson) = totalLen;
   pResultInfo->pData = pResultInfo->convertJson;
   return TSDB_CODE_SUCCESS;
 }
diff --git a/source/client/src/clientSml.c b/source/client/src/clientSml.c
index 5f26db67fc7df53873f155e46ccdbf772da1ca6e..83f2cf9307193b26098a05cb599a68fbd9b777ab 100644
--- a/source/client/src/clientSml.c
+++ b/source/client/src/clientSml.c
@@ -609,7 +609,7 @@ static bool smlParseNumber(SSmlKv *kvVal, SSmlMsgBuf *msg) {
     }
     kvVal->type = TSDB_DATA_TYPE_BIGINT;
     kvVal->i = (int64_t)result;
-  } else if ((left == 3 && strncasecmp(endptr, "u64", left) == 0)) {
+  } else if ((left == 1 && *endptr == 'u') || (left == 3 && strncasecmp(endptr, "u64", left) == 0)) {
     if (result >= (double)UINT64_MAX || result < 0) {
       errno = 0;
       uint64_t tmp = taosStr2UInt64(pVal, &endptr, 10);
@@ -1047,6 +1047,10 @@ static int32_t smlParseTelnetTags(const char *data, SArray *cols, char *childTab
       continue;
     }
 
+    if(valueLen > (TSDB_MAX_NCHAR_LEN - VARSTR_HEADER_SIZE) / TSDB_NCHAR_SIZE){
+      return TSDB_CODE_PAR_INVALID_VAR_COLUMN_LEN;
+    }
+
     // add kv to SSmlKv
     SSmlKv *kv = (SSmlKv *)taosMemoryCalloc(sizeof(SSmlKv), 1);
     if (!kv) return TSDB_CODE_OUT_OF_MEMORY;
diff --git a/source/client/test/smlTest.cpp b/source/client/test/smlTest.cpp
index 17025db730eeefe4c445e7810f7266e71dafdac9..59eb841ab3869c6c7ae11c0282f422f5a9a4512d 100644
--- a/source/client/test/smlTest.cpp
+++ b/source/client/test/smlTest.cpp
@@ -499,6 +499,32 @@ TEST(testCase, smlGetTimestampLen_Test) {
   ASSERT_EQ(len, 3);
 }
 
+TEST(testCase, smlParseNumber_Test) {
+  SSmlKv kv = {0};
+  char buf[64] = {0};
+  SSmlMsgBuf msg = {0};
+  msg.buf = buf;
+  msg.len = 64;
+  kv.value = "3.2e-900";
+  kv.length = 8;
+  bool res = smlParseNumber(&kv, &msg);
+  printf("res:%d,v:%f, %f\n", res,kv.d, HUGE_VAL);
+}
+
+//#include <stdlib.h>
+//TEST(testCase, number_Test) {
+//  char *str[] = {
+////    "-000 0999",
+//      "- abc",
+//  };
+//  for(int i = 0; i < sizeof(str)/sizeof(str[0]); i++){
+//    errno = 0;
+//    char *end = NULL;
+//    long result = strtol(str[i], &end, 10);
+//    printf("errno:%d,len:%d,result:%ld\n", errno, end - str[i], result);
+//  }
+//
+//}
 /*
 TEST(testCase, smlProcess_influx_Test) {
   TAOS *taos = taos_connect("localhost", "root", "taosdata", NULL, 0);