diff --git a/services/bluetooth/server/src/bluetooth_gatt_server_server.cpp b/services/bluetooth/server/src/bluetooth_gatt_server_server.cpp
index 6c968159f3fa6c51dd8a1bf24374d8298d94d5a5..5b1e4a3e377c514f5e6bb1a1bd15bd4521ea85bb 100644
--- a/services/bluetooth/server/src/bluetooth_gatt_server_server.cpp
+++ b/services/bluetooth/server/src/bluetooth_gatt_server_server.cpp
@@ -226,7 +226,9 @@ BluetoothGattServerServer::impl::GattServerCallbackImpl::GattServerCallbackImpl(
     const sptr<IBluetoothGattServerCallback> &callback, BluetoothGattServerServer &owner)
     : callback_(callback), deathRecipient_(new GattServerCallbackDeathRecipient(callback, owner))
 {
-    if (!callback_->AsObject()->AddDeathRecipient(deathRecipient_)) {
+    if (callback_ != nullptr &&
+        callback_->AsObject() != nullptr &&
+        !callback_->AsObject()->AddDeathRecipient(deathRecipient_)) {
         HILOGE("Failed to link death recipient to callback");
     }
     tokenId_ = IPCSkeleton::GetCallingTokenID();
diff --git a/services/bluetooth/stack/src/btm/btm.c b/services/bluetooth/stack/src/btm/btm.c
index d322c126c947f2fe5ad872773ff3a78dc37df744..1ea7111d93a1fd02bdd082217bd76f4dba058d04 100644
--- a/services/bluetooth/stack/src/btm/btm.c
+++ b/services/bluetooth/stack/src/btm/btm.c
@@ -199,7 +199,7 @@ int BTM_Initialize()
     return result;
 }
 
-int BTM_Close()
+NO_SANITIZE("cfi") int BTM_Close()
 {
     LOG_DEBUG("%{public}s start", __FUNCTION__);