diff --git a/src/client/src/tscServer.c b/src/client/src/tscServer.c
index 4b564f381b799b129f8fc2521cee883441ad6181..4b2f41ae098d41d18da6de7365c711d6d7beca55 100644
--- a/src/client/src/tscServer.c
+++ b/src/client/src/tscServer.c
@@ -1037,6 +1037,10 @@ int tscBuildQueryMsg(SSqlObj *pSql, SSqlInfo *pInfo) {
   int32_t code = TSDB_CODE_SUCCESS;
   int32_t size = tscEstimateQueryMsgSize(pSql);
   assert(size > 0);
+  if (pSql != pSql->signature) {
+    tscError("%p query msg has been freed", pSql);
+    return TSDB_CODE_TSC_INVALID_OPERATION;
+  }
 
   if (TSDB_CODE_SUCCESS != tscAllocPayloadFast(pCmd, size)) {
     tscError("%p failed to malloc for query msg", pSql);
diff --git a/src/client/src/tscSubquery.c b/src/client/src/tscSubquery.c
index 28daa227a05d80d5c0986d500abcaf917eb66efe..7f42c6c9a21b66b41922b994312340d4c26a5427 100644
--- a/src/client/src/tscSubquery.c
+++ b/src/client/src/tscSubquery.c
@@ -2785,6 +2785,10 @@ static void doSendQueryReqs(SSchedMsg* pSchedMsg) {
         tscError("0x%"PRIx64"subqueries objs reset unexpectedly. numOfSub:%d", pSql->self, pSql->subState.numOfSub);
         break;
     }
+    if (pSub != pSub->signature) {
+      tscError("%p query msg has been freed", pSub);
+      break;
+    }
     SRetrieveSupport* pSupport = pSub->param;
 
     tscDebug("0x%"PRIx64" sub:0x%"PRIx64" launch subquery, orderOfSub:%d.", pSql->self, pSub->self, pSupport->subqueryIndex);