diff --git a/src/client/src/tscLocal.c b/src/client/src/tscLocal.c
index 07db18b498873f4a023d8ea76aadd7e76a4cd8d2..c1141898cd539bda8e87f497ba5b0b27c9e95caa 100644
--- a/src/client/src/tscLocal.c
+++ b/src/client/src/tscLocal.c
@@ -89,7 +89,10 @@ static int32_t tscSetValueToResObj(SSqlObj *pSql, int32_t rowLen) {
     STR_WITH_MAXSIZE_TO_VARSTR(dst, type, pField->bytes);
     
     int32_t bytes = pSchema[i].bytes;
-    if (pSchema[i].type == TSDB_DATA_TYPE_BINARY || pSchema[i].type == TSDB_DATA_TYPE_NCHAR) {
+    if (pSchema[i].type == TSDB_DATA_TYPE_BINARY || (pSchema[i].type == TSDB_DATA_TYPE_JSON && JSON_TYPE_BINARY)){
+      bytes -= VARSTR_HEADER_SIZE;
+    }
+    else if(pSchema[i].type == TSDB_DATA_TYPE_NCHAR || (pSchema[i].type == TSDB_DATA_TYPE_JSON && JSON_TYPE_NCHAR)) {
       bytes -= VARSTR_HEADER_SIZE;
       
       if (pSchema[i].type == TSDB_DATA_TYPE_NCHAR) {
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index ec9bacd6a4da93abba3480953b9925f8634056af..afb5deca8886681459085b0c6cc5aca62cd15f33 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -5325,7 +5325,7 @@ int parseJsontoTagData(char* json, SKVRowBuilder* kvRowBuilder, char* errMsg, in
     char tagVal[TSDB_MAX_TAGS_LEN] = {0};
     int32_t outLen = 0;
     if (JSON_TYPE_BINARY){
-      strncpy(tagVal, item->string, strlen(item->string));
+      strncpy(varDataVal(tagVal), item->string, strlen(item->string));
       outLen = strlen(item->string);
     }else if(JSON_TYPE_NCHAR){
       if (!taosMbsToUcs4(item->string, strlen(item->string), varDataVal(tagVal), TSDB_MAX_TAGS_LEN - VARSTR_HEADER_SIZE, &outLen)) {
@@ -5344,7 +5344,7 @@ int parseJsontoTagData(char* json, SKVRowBuilder* kvRowBuilder, char* errMsg, in
       *tagVal = jsonType2DbType(0, item->type);     // type
       char* tagData = POINTER_SHIFT(tagVal,CHAR_BYTES);
       if (JSON_TYPE_BINARY){
-        strncpy(tagVal, item->valuestring, strlen(item->valuestring));
+        strncpy(varDataVal(tagData), item->valuestring, strlen(item->valuestring));
         outLen = strlen(item->valuestring);
       }else if(JSON_TYPE_NCHAR) {
         if (!taosMbsToUcs4(item->valuestring, strlen(item->valuestring), varDataVal(tagData),
diff --git a/src/query/src/qExecutor.c b/src/query/src/qExecutor.c
index fc4b4af1c72b69fb6a2fe0d32ffabdcd25d350fe..91dace974b616430238fe0f2367a03a27f7d98e1 100644
--- a/src/query/src/qExecutor.c
+++ b/src/query/src/qExecutor.c
@@ -7181,7 +7181,6 @@ static SSDataBlock* doTagScan(void* param, bool* newgroup) {
         type  = pExprInfo[j].base.resType;
         bytes = pExprInfo[j].base.resBytes;
 
-        char* tagJsonElementData = NULL;
         dst  = pColInfo->pData + count * pExprInfo[j].base.resBytes;
         if (pExprInfo[j].base.colInfo.colId == TSDB_TBNAME_COLUMN_INDEX) {
           data = tsdbGetTableName(item->pTable);
@@ -7189,7 +7188,7 @@ static SSDataBlock* doTagScan(void* param, bool* newgroup) {
           if(type == TSDB_DATA_TYPE_JSON){
             data = tsdbGetTableTagVal(item->pTable, pExprInfo[j].base.colInfo.colId, type, bytes);
             if(pExprInfo[j].base.numOfParams > 0){ // tag-> operation
-              tagJsonElementData = calloc(bytes, 1);
+              char* tagJsonElementData = calloc(bytes, 1);
               findTagValue(item->pTable, pExprInfo[j].base.param[0].pz, pExprInfo[j].base.param[0].nLen, tagJsonElementData, bytes);
               *dst = SELECT_ELEMENT_JSON_TAG;   // select tag->element
               dst++;
diff --git a/src/util/src/tarray.c b/src/util/src/tarray.c
index 007ce0682974d06bf506a82d8bbbc809092eb9e4..2fb94036833b6855e8a5c2eed3c08983f809e22e 100644
--- a/src/util/src/tarray.c
+++ b/src/util/src/tarray.c
@@ -281,8 +281,8 @@ void taosArrayClear(SArray* pArray) {
 
 void* taosArrayDestroy(SArray* pArray) {
   if (pArray) {
-    free(pArray->pData);
-    free(pArray);
+    tfree(pArray->pData);
+    tfree(pArray);
   }
 
   return NULL;
diff --git a/tests/pytest/stable/json_tag.py b/tests/pytest/stable/json_tag.py
index 0b669b548cac9a9be5c8486769469aa45b499e6a..31517d1e474fadd7fc8cdc25b77bf6b2f371d170 100644
--- a/tests/pytest/stable/json_tag.py
+++ b/tests/pytest/stable/json_tag.py
@@ -142,6 +142,18 @@ class TDTestCase:
         tdSql.query("select *,tbname from db_json_tag_test.jsons1 where (jtag->'location' like 'bei%' or jtag->'num'=34) and jtag->'class'=55")
         tdSql.checkRows(0)
 
+        # test where condition in
+        tdSql.query("select * from db_json_tag_test.jsons1 where jtag->'location' in ('beijing')")
+        tdSql.checkRows(2)
+
+        tdSql.query("select * from db_json_tag_test.jsons1 where jtag->'num' in (5,34)")
+        tdSql.checkRows(2)
+
+        tdSql.error("select * from db_json_tag_test.jsons1 where jtag->'num' in ('5',34)")
+
+        tdSql.query("select * from db_json_tag_test.jsons1 where jtag->'location' in ('shanghai') and jtag->'class'=55")
+        tdSql.checkRows(1)
+
 
     def stop(self):
         tdSql.close()