diff --git a/audio/hal/hdi_binder/server/src/hdf_audio_server_common.c b/audio/hal/hdi_binder/server/src/hdf_audio_server_common.c
index 5f7cf1f7b146a2199a875834fe3a9ec4bc9cd18a..778d4619f91418bccf89cc1c3882438fa836a489 100644
--- a/audio/hal/hdi_binder/server/src/hdf_audio_server_common.c
+++ b/audio/hal/hdi_binder/server/src/hdf_audio_server_common.c
@@ -1312,7 +1312,10 @@ static void AudioRouteDevFreeByNum(const struct AudioRouteNode *routeNode, uint3
         AUDIO_FUNC_LOGI("routeNode has been freed");
         return;
     }
-
+    if (num > 2) {
+        AUDIO_FUNC_LOGI("num is over");
+        return;
+    }
     for (nodeCnt = 0; nodeCnt < num; nodeCnt++) {
         if (routeNode[nodeCnt].type == AUDIO_PORT_DEVICE_TYPE) {
             AudioDevExtInfoFree((struct AudioDevExtInfo *)&routeNode[nodeCnt].ext.device, false);
diff --git a/sensor/hal/src/sensor_controller.c b/sensor/hal/src/sensor_controller.c
index 34741622f6ea27ef68ad055abd9d978d6f00a04d..4158b358cd10ea243d8883e8ac38daae6f78ad46 100644
--- a/sensor/hal/src/sensor_controller.c
+++ b/sensor/hal/src/sensor_controller.c
@@ -437,7 +437,7 @@ static int32_t ReadData(int32_t sensorId, struct SensorEvents *event)
     CHECK_NULL_PTR_RETURN_VALUE(msg, SENSOR_NULL_PTR);
     struct HdfSBuf *reply = HdfSbufObtain(HDF_SENSOR_EVENT_MAX_SIZE);
     if (reply == NULL) {
-        HDF_LOGE("%s: Sensor write id fail!", __func__);
+        HDF_LOGE("%{public}s: Sensor write id fail!", __func__);
         HdfSbufRecycle(msg);
         return SENSOR_FAILURE;
     }