diff --git a/src/client/src/tscSubquery.c b/src/client/src/tscSubquery.c
index ad563454a58b6d7fbc727c9a07effb5d4eac8719..b49fdbb97f2e39ed7d45705b0309207779512ba0 100644
--- a/src/client/src/tscSubquery.c
+++ b/src/client/src/tscSubquery.c
@@ -227,6 +227,7 @@ static int64_t doTSBlockIntersect(SSqlObj* pSql, STimeWindow * win) {
       if (skipped) {
         slot = 0;
         stackidx = 0;
+        tVariantDestroy(&tag);
         continue;
       }
 
@@ -334,6 +335,7 @@ static int64_t doTSBlockIntersect(SSqlObj* pSql, STimeWindow * win) {
       }
 
       if (mergeDone) {
+        tVariantDestroy(&tag);
         break;
       }
 
@@ -341,6 +343,7 @@ static int64_t doTSBlockIntersect(SSqlObj* pSql, STimeWindow * win) {
       stackidx = 0;
 
       skipRemainValue(mainCtx->p->pTSBuf, &tag);
+      tVariantDestroy(&tag);
     }
 
     stackidx = 0;
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index 588853d999ace6c582d50364729e2cbee689a967..55710c28d1f1a52887d512ef4cfa6fb608d06f1c 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -5414,7 +5414,7 @@ void getJsonTagValueAll(void* data, void* dst, int16_t bytes) {
   }
 
   int32_t length = 0;
-  if(!taosMbsToUcs4(json, strlen(json), varDataVal(tagData), bytes - VARSTR_HEADER_SIZE, &length)){
+  if(!taosMbsToUcs4(json, strlen(json), varDataVal(tagData), bytes - VARSTR_HEADER_SIZE - CHAR_BYTES, &length)){
     tscError("getJsonTagValueAll mbstoucs4 error! length:%d", length);
   }
   varDataSetLen(tagData, length);
@@ -5589,11 +5589,11 @@ int parseJsontoTagData(char* json, SKVRowBuilder* kvRowBuilder, char* errMsg, in
       char *jsonValue = item->valuestring;
       strtrim(jsonValue);
       outLen = 0;
-      char tagVal[TSDB_MAX_JSON_TAGS_LEN + CHAR_BYTES] = {0};
+      char tagVal[TSDB_MAX_JSON_TAGS_LEN] = {0};
       *tagVal = jsonType2DbType(0, item->type);     // type
       char* tagData = POINTER_SHIFT(tagVal,CHAR_BYTES);
       if (!taosMbsToUcs4(jsonValue, strlen(jsonValue), varDataVal(tagData),
-                         TSDB_MAX_JSON_TAGS_LEN, &outLen)) {
+                         TSDB_MAX_JSON_TAGS_LEN - CHAR_BYTES - VARSTR_HEADER_SIZE, &outLen)) {
         tscError("json string error:%s|%s", strerror(errno), jsonValue);
         retCode = tscSQLSyntaxErrMsg(errMsg, "serizelize json error", NULL);
         goto end;
@@ -5675,4 +5675,4 @@ void* getJsonTagValue(STable* pTable, char* key, int32_t keyLen, int16_t* retCol
     return tdGetKVRowValOfCol(((STable*)(p->table))->tagVal, colId);
   }
   return NULL;
-}
\ No newline at end of file
+}
diff --git a/src/common/src/tvariant.c b/src/common/src/tvariant.c
index 175a8174ab386d5114fc95de59c3da5b61f6b81f..511b03f65b57204acdd60a48f9da329cdf251d5f 100644
--- a/src/common/src/tvariant.c
+++ b/src/common/src/tvariant.c
@@ -191,7 +191,7 @@ void tVariantCreateFromBinary(tVariant *pVar, const char *pz, size_t len, uint32
 void tVariantDestroy(tVariant *pVar) {
   if (pVar == NULL) return;
   
-  if (pVar->nType == TSDB_DATA_TYPE_BINARY || pVar->nType == TSDB_DATA_TYPE_NCHAR) {
+  if (pVar->nType == TSDB_DATA_TYPE_BINARY || pVar->nType == TSDB_DATA_TYPE_NCHAR || pVar->nType == TSDB_DATA_TYPE_JSON) {
     tfree(pVar->pz);
     pVar->nLen = 0;
   }
diff --git a/src/tsdb/src/tsdbMeta.c b/src/tsdb/src/tsdbMeta.c
index 17abb2c3b81bc109bff070db06adbfceba153349..9c2d86fe017a893bc2f5af57371125b7214712f5 100644
--- a/src/tsdb/src/tsdbMeta.c
+++ b/src/tsdb/src/tsdbMeta.c
@@ -1179,7 +1179,7 @@ static int tsdbRemoveTableFromIndex(STsdbMeta *pMeta, STable *pTable) {
     int16_t nCols = kvRowNCols(pTable->tagVal);
     ASSERT(nCols%2 == 1);
     for (int j = 0; j < nCols; ++j) {
-      if (j != 0 && j != 2 && j%2 == 0) continue; // jump value
+      if (j != 0 && j%2 == 0) continue; // jump value
       SColIdx * pColIdx = kvRowColIdxAt(pTable->tagVal, j);
       void* val = (kvRowColVal(pTable->tagVal, pColIdx));
       if (j == 0){        // json value is the first