diff --git a/src/client/src/tscParseLineProtocol.c b/src/client/src/tscParseLineProtocol.c
index fadc0e6ac8cc23d73891970c6d6816b0ac2fd0dd..d4e936327271890bd2ec560424988a38b27cdc26 100644
--- a/src/client/src/tscParseLineProtocol.c
+++ b/src/client/src/tscParseLineProtocol.c
@@ -1298,7 +1298,11 @@ static int doSmlInsertOneDataPoint(TAOS* taos, TAOS_SML_DATA_POINT* point, SSmlL
   for (int col = 1; col < point->fieldNum; ++col) {
     TAOS_SML_KV* kv = point->fields + col;
     int32_t      len = 0;
-    converToStr(sql + sqlLen, kv->type, kv->value, kv->length, &len);
+    retLen = converToStr(sql + sqlLen, kv->type, kv->value, kv->length, &len);
+    if (retLen >= kv->length || retLen == TSDB_CODE_TSC_INVALID_VALUE) {
+      tscError("SML:0x%" PRIx64 " no free space for converToStr", info->id);
+      return TSDB_CODE_TSC_OUT_OF_MEMORY;
+    }
     sqlLen += len;
     retLen = snprintf(sql + sqlLen, freeBytes - sqlLen, ",");
     if (retLen >= freeBytes - sqlLen) {
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index ec4f2c1daf4cd35a984f7e2f2cf4dab8f47659f8..627e1da9289f9570ca64dd89e22528de940c1d7c 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -42,51 +42,51 @@ int32_t converToStr(char *str, int type, void *buf, int32_t bufSize, int32_t *le
 
   switch (type) {
     case TSDB_DATA_TYPE_NULL:
-      n = sprintf(str, "null");
+      n = snprintf(str, bufSize, "null");
       break;
 
     case TSDB_DATA_TYPE_BOOL:
-      n = sprintf(str, (*(int8_t*)buf) ? "true" : "false");
+      n = snprintf(str, bufSize, (*(int8_t*)buf) ? "true" : "false");
       break;
 
     case TSDB_DATA_TYPE_TINYINT:
-      n = sprintf(str, "%d", *(int8_t*)buf);
+      n = snprintf(str, bufSize, "%d", *(int8_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_SMALLINT:
-      n = sprintf(str, "%d", *(int16_t*)buf);
+      n = snprintf(str, bufSize, "%d", *(int16_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_INT:
-      n = sprintf(str, "%d", *(int32_t*)buf);
+      n = snprintf(str, bufSize, "%d", *(int32_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_BIGINT:
     case TSDB_DATA_TYPE_TIMESTAMP:
-      n = sprintf(str, "%" PRId64, *(int64_t*)buf);
+      n = snprintf(str, bufSize, "%" PRId64, *(int64_t*)buf);
       break;
     case TSDB_DATA_TYPE_UTINYINT:
-      n = sprintf(str, "%d", *(uint8_t*)buf);
+      n = snprintf(str, bufSize, "%d", *(uint8_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_USMALLINT:
-      n = sprintf(str, "%d", *(uint16_t*)buf);
+      n = snprintf(str, bufSize, "%d", *(uint16_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_UINT:
-      n = sprintf(str, "%d", *(uint32_t*)buf);
+      n = snprintf(str, bufSize, "%d", *(uint32_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_UBIGINT:
-      n = sprintf(str, "%" PRId64, *(uint64_t*)buf);
+      n = snprintf(str, bufSize, "%" PRId64, *(uint64_t*)buf);
       break;
 
     case TSDB_DATA_TYPE_FLOAT:
-      n = sprintf(str, "%.*e", DECIMAL_DIG, GET_FLOAT_VAL(buf));
+      n = snprintf(str, bufSize, "%.*e", DECIMAL_DIG, GET_FLOAT_VAL(buf));
       break;
 
     case TSDB_DATA_TYPE_DOUBLE:
-      n = sprintf(str, "%.*e", DECIMAL_DIG, GET_DOUBLE_VAL(buf));
+      n = snprintf(str, bufSize, "%.*e", DECIMAL_DIG, GET_DOUBLE_VAL(buf));
       break;
 
     case TSDB_DATA_TYPE_BINARY: