diff --git a/interfaces/innerkits/dec_util/src/dec_api.cpp b/interfaces/innerkits/dec_util/src/dec_api.cpp
index dd64931636780b1e10af71988a93b2f98d4c739b..acf6b6208f1eafc3a28b52b1a6dc2529fdb21fc4 100644
--- a/interfaces/innerkits/dec_util/src/dec_api.cpp
+++ b/interfaces/innerkits/dec_util/src/dec_api.cpp
@@ -121,6 +121,7 @@ static void ProcessConfig(const cJSON *config, std::map<std::string, std::vector
     int arraySize = cJSON_GetArraySize(permission);
     for (int i = 0; i < arraySize; ++i) {
         cJSON *item = cJSON_GetArrayItem(permission, i);
+        APPSPAWN_CHECK(item != nullptr && cJSON_IsObject(item), continue, "Invalid item in permission array");
         cJSON *permissionChild = item->child;
         while (permissionChild != nullptr && cJSON_IsArray(permissionChild)) {
             cJSON *permItem = cJSON_GetArrayItem(permissionChild, 0);