diff --git a/src/client/src/tscPrepare.c b/src/client/src/tscPrepare.c
index 68f2ecbf0e194bc13362b0af965959367a9f86b8..30e07294272fa2c8aae823bee428320455d9eb0f 100644
--- a/src/client/src/tscPrepare.c
+++ b/src/client/src/tscPrepare.c
@@ -258,11 +258,7 @@ static char* normalStmtBuildSql(STscStmt* stmt) {
 
 static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
   if (bind->is_null != NULL && *(bind->is_null)) {
-    if (param->type == TSDB_DATA_TYPE_BINARY || param->type == TSDB_DATA_TYPE_NCHAR) {
-      setVardataNull(data + param->offset, param->type);
-    } else {
-      setNull(data + param->offset, param->type, param->bytes);
-    }
+    setNull(data + param->offset, param->type, param->bytes);
     return TSDB_CODE_SUCCESS;
   }
 
@@ -312,13 +308,13 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
               break;
             }
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_FLOAT:
           case TSDB_DATA_TYPE_DOUBLE:
           case TSDB_DATA_TYPE_TIMESTAMP:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
         }
         memcpy(data + param->offset, &u.v1, sizeof(u.v1));
         return TSDB_CODE_SUCCESS;
@@ -336,40 +332,40 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
             u.v1 = (int8_t)v;
             if (v >= SCHAR_MIN && v <= SCHAR_MAX) break;
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_INT: {
             int32_t v = *(int32_t*)bind->buffer;
             u.v1 = (int8_t)v;
             if (v >= SCHAR_MIN && v <= SCHAR_MAX) break;
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_BIGINT: {
             int64_t v = *(int64_t*)bind->buffer;
             u.v1 = (int8_t)v;
             if (v >= SCHAR_MIN && v <= SCHAR_MAX) break;
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_BINARY:
           case TSDB_DATA_TYPE_NCHAR: {
             int64_t v;
-            int n,r;
+            int     n, r;
             r = sscanf((const char*)bind->buffer, "%" PRId64 "%n", &v, &n);
-            if (r==1 && n==strlen((const char*)bind->buffer)) {
+            if (r == 1 && n == strlen((const char*)bind->buffer)) {
               u.v1 = (int8_t)v;
               if (v >= SCHAR_MIN && v <= SCHAR_MAX) break;
             }
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_FLOAT:
           case TSDB_DATA_TYPE_DOUBLE:
           case TSDB_DATA_TYPE_TIMESTAMP:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
         }
         memcpy(data + param->offset, &u.v1, sizeof(u.v1));
         return TSDB_CODE_SUCCESS;
-			} break;
+      }
       case TSDB_DATA_TYPE_SMALLINT: {
         switch (bind->buffer_type) {
           case TSDB_DATA_TYPE_BOOL:
@@ -383,34 +379,34 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
             u.v2 = (int16_t)v;
             if (v >= SHRT_MIN && v <= SHRT_MAX) break;
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_BIGINT: {
             int64_t v = *(int64_t*)bind->buffer;
             u.v2 = (int16_t)v;
             if (v >= SHRT_MIN && v <= SHRT_MAX) break;
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_BINARY:
           case TSDB_DATA_TYPE_NCHAR: {
             int64_t v;
-            int n,r;
+            int     n, r;
             r = sscanf((const char*)bind->buffer, "%" PRId64 "%n", &v, &n);
-            if (r==1 && n==strlen((const char*)bind->buffer)) {
+            if (r == 1 && n == strlen((const char*)bind->buffer)) {
               u.v2 = (int16_t)v;
               if (v >= SHRT_MIN && v <= SHRT_MAX) break;
             }
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_FLOAT:
           case TSDB_DATA_TYPE_DOUBLE:
           case TSDB_DATA_TYPE_TIMESTAMP:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
         }
         memcpy(data + param->offset, &u.v2, sizeof(u.v2));
         return TSDB_CODE_SUCCESS;
-			} break;
+      }
       case TSDB_DATA_TYPE_INT: {
         switch (bind->buffer_type) {
           case TSDB_DATA_TYPE_BOOL:
@@ -514,17 +510,17 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
               break;
             }
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_FLOAT:
           case TSDB_DATA_TYPE_DOUBLE:
           case TSDB_DATA_TYPE_TIMESTAMP:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
         }
         memcpy(data + param->offset, &u.v8, sizeof(u.v8));
         return TSDB_CODE_SUCCESS;
-			} break;
+      }
       case TSDB_DATA_TYPE_DOUBLE: {
         switch (bind->buffer_type) {
           case TSDB_DATA_TYPE_BOOL:
@@ -556,15 +552,15 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
               break;
             }
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
           case TSDB_DATA_TYPE_TIMESTAMP:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
-        } break;
+          }
+        }
         memcpy(data + param->offset, &u.f8, sizeof(u.f8));
         return TSDB_CODE_SUCCESS;
-			} break;
+      }
       case TSDB_DATA_TYPE_TIMESTAMP: {
         switch (bind->buffer_type) {
           case TSDB_DATA_TYPE_TIMESTAMP: {
@@ -589,10 +585,10 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
           } break;
-        } break;
+        };
         memcpy(data + param->offset, &u.v8, sizeof(u.v8));
         return TSDB_CODE_SUCCESS;
-			} break;
+			}
       case TSDB_DATA_TYPE_BINARY: {
         switch (bind->buffer_type) {
           case TSDB_DATA_TYPE_BINARY: {
@@ -602,7 +598,7 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
             short size = (short)*bind->length;
             STR_WITH_SIZE_TO_VARSTR(data + param->offset, bind->buffer, size);
             return TSDB_CODE_SUCCESS;
-          } break;
+          }
           case TSDB_DATA_TYPE_BOOL:
           case TSDB_DATA_TYPE_TINYINT:
           case TSDB_DATA_TYPE_SMALLINT:
@@ -614,9 +610,9 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
           case TSDB_DATA_TYPE_NCHAR:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
         }
-			} break;
+      }
       case TSDB_DATA_TYPE_NCHAR: {
         switch (bind->buffer_type) {
           case TSDB_DATA_TYPE_NCHAR: {
@@ -626,7 +622,7 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
             }
             varDataSetLen(data + param->offset, output);
             return TSDB_CODE_SUCCESS;
-          } break;
+          }
           case TSDB_DATA_TYPE_BOOL:
           case TSDB_DATA_TYPE_TINYINT:
           case TSDB_DATA_TYPE_SMALLINT:
@@ -638,12 +634,12 @@ static int doBindParam(char* data, SParamInfo* param, TAOS_BIND* bind) {
           case TSDB_DATA_TYPE_BINARY:
           default: {
             return TSDB_CODE_TSC_INVALID_VALUE;
-          } break;
+          }
         }
-			} break;
+      }
       default: {
         return TSDB_CODE_TSC_INVALID_VALUE;
-      } break;
+      }
     }
   }
 
diff --git a/src/client/src/tscSQLParser.c b/src/client/src/tscSQLParser.c
index 15d2647c5117d0bffe6dd301fb503f7e9d54235f..f859d2969ead620a939ff3e9f571f1f650e84ff6 100644
--- a/src/client/src/tscSQLParser.c
+++ b/src/client/src/tscSQLParser.c
@@ -80,7 +80,6 @@ static int32_t parseSelectClause(SSqlCmd* pCmd, int32_t clauseIndex, tSQLExprLis
 static bool validateIpAddress(const char* ip, size_t size);
 static bool hasUnsupportFunctionsForSTableQuery(SSqlCmd* pCmd, SQueryInfo* pQueryInfo);
 static bool functionCompatibleCheck(SQueryInfo* pQueryInfo, bool joinQuery);
-static void setColumnOffsetValueInResultset(SQueryInfo* pQueryInfo);
 
 static int32_t parseGroupbyClause(SQueryInfo* pQueryInfo, SArray* pList, SSqlCmd* pCmd);
 
@@ -2951,14 +2950,6 @@ int32_t parseGroupbyClause(SQueryInfo* pQueryInfo, SArray* pList, SSqlCmd* pCmd)
   return TSDB_CODE_SUCCESS;
 }
 
-void setColumnOffsetValueInResultset(SQueryInfo* pQueryInfo) {
-  if (QUERY_IS_STABLE_QUERY(pQueryInfo->type)) {
-    tscFieldInfoUpdateOffset(pQueryInfo);
-  } else {
-    tscFieldInfoUpdateOffset(pQueryInfo);
-  }
-}
-
 static SColumnFilterInfo* addColumnFilterInfo(SColumn* pColumn) {
   if (pColumn == NULL) {
     return NULL;
@@ -3537,7 +3528,7 @@ static int32_t validateSQLExpr(SSqlCmd* pCmd, tSQLExpr* pExpr, SQueryInfo* pQuer
 
       if (i == 0) {
         id = p1->uid;
-      } else if (id != p1->uid){
+      } else if (id != p1->uid) {
         return TSDB_CODE_TSC_INVALID_SQL;
       }
     }
@@ -6531,7 +6522,7 @@ int32_t doCheckForQuery(SSqlObj* pSql, SQuerySQL* pQuerySql, int32_t index) {
     return code;
   }
 
-  setColumnOffsetValueInResultset(pQueryInfo);
+  tscFieldInfoUpdateOffset(pQueryInfo);
 
   /*
    * fill options are set at the end position, when all columns are set properly
diff --git a/src/client/src/tscServer.c b/src/client/src/tscServer.c
index eaa00f290b683ded9739efe1712f3b0a8cf64a11..15859674ab9c891814b26fe054a478de8b398ca7 100644
--- a/src/client/src/tscServer.c
+++ b/src/client/src/tscServer.c
@@ -62,7 +62,7 @@ static void tscSetDnodeEpSet(SSqlObj* pSql, SVgroupInfo* pVgroupInfo) {
 
   pEpSet->numOfEps = pVgroupInfo->numOfEps;
   for(int32_t i = 0; i < pVgroupInfo->numOfEps; ++i) {
-    strcpy(pEpSet->fqdn[i], pVgroupInfo->epAddr[i].fqdn);
+    tstrncpy(pEpSet->fqdn[i], pVgroupInfo->epAddr[i].fqdn, tListLen(pEpSet->fqdn[i]));
     pEpSet->port[i] = pVgroupInfo->epAddr[i].port;
 
     if (!hasFqdn) {
@@ -2031,7 +2031,8 @@ static void createHBObj(STscObj* pObj) {
 
   SQueryInfo *pQueryInfo = tscGetQueryInfoDetailSafely(&pSql->cmd, 0);
   if (pQueryInfo == NULL) {
-    pSql->res.code = terrno;
+    terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
+    tfree(pSql);
     return;
   }
 
@@ -2039,6 +2040,7 @@ static void createHBObj(STscObj* pObj) {
 
   pSql->cmd.command = pQueryInfo->command;
   if (TSDB_CODE_SUCCESS != tscAllocPayload(&(pSql->cmd), TSDB_DEFAULT_PAYLOAD_SIZE)) {
+    terrno = TSDB_CODE_TSC_OUT_OF_MEMORY;
     tfree(pSql);
     return;
   }
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index 7a82bcaaab63603d136ae79f28b1625c90944779..a75f6d829615fac6dda3b5d654374d06cf699e8a 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -451,14 +451,16 @@ void tscFreeRegisteredSqlObj(void *pSql) {
   STscObj* pTscObj = (*p)->pTscObj;
 
   assert((*p)->self != 0 && (*p)->self == (p));
+
+  SSqlObj* ptr = *p;
   tscFreeSqlObj(*p);
 
   int32_t ref = T_REF_DEC(pTscObj);
   assert(ref >= 0);
 
-  tscDebug("%p free sqlObj completed, tscObj:%p ref:%d", *p, pTscObj, ref);
+  tscDebug("%p free sqlObj completed, tscObj:%p ref:%d", ptr, pTscObj, ref);
   if (ref == 0) {
-    tscDebug("%p all sqlObj freed, free tscObj:%p", *p, pTscObj);
+    tscDebug("%p all sqlObj freed, free tscObj:%p", ptr, pTscObj);
     taosRemoveRef(tscRefId, pTscObj->rid);
   }
 }
@@ -644,6 +646,7 @@ int32_t tscCreateDataBlock(size_t initialSize, int32_t rowSize, int32_t startOff
   dataBuf->pData = calloc(1, dataBuf->nAllocSize);
   if (dataBuf->pData == NULL) {
     tscError("failed to allocated memory, reason:%s", strerror(errno));
+    tfree(dataBuf);
     return TSDB_CODE_TSC_OUT_OF_MEMORY;
   }
 
diff --git a/src/common/src/tvariant.c b/src/common/src/tvariant.c
index 6dd065382265cb09e26f8d1b6f86c4b5b3f5110b..fc00f50a7af0cd6b92262438baa293dda7066a07 100644
--- a/src/common/src/tvariant.c
+++ b/src/common/src/tvariant.c
@@ -171,7 +171,9 @@ void tVariantAssign(tVariant *pDst, const tVariant *pSrc) {
     }
   }
 
-  pDst->nLen = tDataTypeDesc[pDst->nType].nSize;
+  if (pDst->nType != TSDB_DATA_TYPE_ARRAY) {
+    pDst->nLen = tDataTypeDesc[pDst->nType].nSize;
+  }
 }
 
 int32_t tVariantCompare(const tVariant* p1, const tVariant* p2) {
diff --git a/src/query/src/qExecutor.c b/src/query/src/qExecutor.c
index 630a469dd7cb148c42a322a585686b30faa7eaae..3fcf44f057cc17b99e8f2a6cdce09805a80decd3 100644
--- a/src/query/src/qExecutor.c
+++ b/src/query/src/qExecutor.c
@@ -6814,7 +6814,7 @@ static int32_t doDumpQueryResult(SQInfo *pQInfo, char *data) {
 
       qDebug("QInfo:%p ts comp data return, file:%s, size:%"PRId64, pQInfo, pQuery->sdata[0]->data, s);
       if (lseek(fd, 0, SEEK_SET) >= 0) {
-        size_t sz = read(fd, data, (uint32_t)s);
+        size_t sz = read(fd, data, (uint32_t) s);
         if(sz < s) {  // todo handle error
           assert(0);
         }
diff --git a/src/query/src/qParserImpl.c b/src/query/src/qParserImpl.c
index 0853565fc633d9ed32eb4d562dd4f2901c059d04..5cd9d3c77a5211fa1c0058978799447f38867180 100644
--- a/src/query/src/qParserImpl.c
+++ b/src/query/src/qParserImpl.c
@@ -187,7 +187,8 @@ tSQLExpr *tSQLExprCreate(tSQLExpr *pLeft, tSQLExpr *pRight, int32_t optrType) {
     pExpr->token.type = pLeft->token.type;
   }
 
-  if (optrType == TK_PLUS || optrType == TK_MINUS || optrType == TK_STAR || optrType == TK_DIVIDE || optrType == TK_REM) {
+  if ((pLeft != NULL && pRight != NULL) &&
+      (optrType == TK_PLUS || optrType == TK_MINUS || optrType == TK_STAR || optrType == TK_DIVIDE || optrType == TK_REM)) {
     /*
      * if a token is noted as the TK_TIMESTAMP, the time precision is microsecond
      * Otherwise, the time precision is adaptive, determined by the time precision from databases.
diff --git a/src/query/src/qResultbuf.c b/src/query/src/qResultbuf.c
index 67cb7af074b1982eb322ebf311d2c337bfa5fc55..dfa8bcd95bd43e5030540e9380eaf534e6580897 100644
--- a/src/query/src/qResultbuf.c
+++ b/src/query/src/qResultbuf.c
@@ -119,8 +119,11 @@ static char* doFlushPageToDisk(SDiskbasedResultBuf* pResultBuf, SPageInfo* pg) {
     pg->info.offset = allocatePositionInFile(pResultBuf, size);
     pResultBuf->nextPos += size;
 
-    fseek(pResultBuf->file, pg->info.offset, SEEK_SET);
-    /*int32_t ret =*/ fwrite(t, 1, size, pResultBuf->file);
+    int32_t ret = fseek(pResultBuf->file, pg->info.offset, SEEK_SET);
+    assert(ret == 0);
+
+    ret = fwrite(t, 1, size, pResultBuf->file);
+    assert(ret == size);
 
     if (pResultBuf->fileSize < pg->info.offset + pg->info.length) {
       pResultBuf->fileSize = pg->info.offset + pg->info.length;
diff --git a/src/query/src/qTsbuf.c b/src/query/src/qTsbuf.c
index 8a5a87baab5abbfd04f1c97dbe91a7226606263e..d0c59fe5efe08aa1c9dbe3bbe65db139b074ebee 100644
--- a/src/query/src/qTsbuf.c
+++ b/src/query/src/qTsbuf.c
@@ -341,8 +341,10 @@ STSBlock* readDataFromDisk(STSBuf* pTSBuf, int32_t order, bool decomp) {
     pBlock->tag.pz = tp;
 
     sz = fread(pBlock->tag.pz, (size_t)pBlock->tag.nLen, 1, pTSBuf->f);
-  } else if (pBlock->tag.nType != TSDB_DATA_TYPE_NULL) {
+    UNUSED(sz);
+  } else if (pBlock->tag.nType != TSDB_DATA_TYPE_NULL) { //TODO check the return value
     sz = fread(&pBlock->tag.i64Key, (size_t) pBlock->tag.nLen, 1, pTSBuf->f);
+    UNUSED(sz);
   }
 
   sz = fread(&pBlock->numOfElem, sizeof(pBlock->numOfElem), 1, pTSBuf->f);
diff --git a/tests/script/general/parser/col_arithmetic_operation.sim b/tests/script/general/parser/col_arithmetic_operation.sim
index c05229ab655360e75f4a4b680f00978522d267b4..64f41ae11f5722502ce911ea75d683eb2a71730b 100644
--- a/tests/script/general/parser/col_arithmetic_operation.sim
+++ b/tests/script/general/parser/col_arithmetic_operation.sim
@@ -73,7 +73,6 @@ run general/parser/col_arithmetic_query.sim
 print ====================> crash
 # sql select spread(ts )/(1000*3600*24) from ca_stb0 interval(1y)
 
-
 sql_error select first(c1, c2) - last(c1, c2) from stb interval(1y)
 sql_error select first(ts) - last(ts) from stb interval(1y)
 sql_error select top(c1, 2) - last(c1) from stb;