diff --git a/common/coauth/inc/coauth.h b/common/coauth/inc/coauth.h
index 6f70679c88d4ce4d69ff95994b517ca5e08a180f..e1adfe49181c201274b778bdfe770b650521ae37 100644
--- a/common/coauth/inc/coauth.h
+++ b/common/coauth/inc/coauth.h
@@ -18,7 +18,7 @@
 
 #include "pool.h"
 
-#define INAVLID_SESSION_ID 0
+#define INVALID_SESSION_ID 0
 #define MAX_EXECUTOR_SIZE 2
 
 typedef enum ScheduleMode {
diff --git a/common/coauth/src/coauth.c b/common/coauth/src/coauth.c
index a123679ab0cb17219cb1b2535ef5e84c8fb37c17..28afcf2403fe42ece7a6202778b00b1a3b9647fb 100644
--- a/common/coauth/src/coauth.c
+++ b/common/coauth/src/coauth.c
@@ -81,6 +81,7 @@ ResultCode AddCoAuthSchedule(CoAuthSchedule *coAuthSchedule)
     }
     if (memcpy_s(schedule, sizeof(CoAuthSchedule), coAuthSchedule, sizeof(CoAuthSchedule)) != EOK) {
         LOG_ERROR("copy fail");
+        Free(schedule);
         return RESULT_BAD_COPY;
     }
     ResultCode result = g_scheduleList->insert(g_scheduleList, schedule);
@@ -127,14 +128,14 @@ ResultCode GetCoAuthSchedule(CoAuthSchedule *coAuthSchedule)
         LOG_ERROR("create iterator fail");
         return RESULT_NO_MEMORY;
     }
-    int32_t result = RESULT_NO_MEMORY;
+    int32_t result = RESULT_BAD_MATCH;
     while (iterator->hasNext(iterator)) {
         CoAuthSchedule *schedule = (CoAuthSchedule *)iterator->next(iterator);
         if (schedule->scheduleId != coAuthSchedule->scheduleId) {
             continue;
         }
         if (memcpy_s(coAuthSchedule, sizeof(CoAuthSchedule), schedule, sizeof(CoAuthSchedule)) != EOK) {
-            LOG_ERROR("create iterator fail");
+            LOG_ERROR("memcpy fail");
             result = RESULT_BAD_COPY;
             break;
         }
@@ -168,7 +169,7 @@ static ResultCode GenerateValidScheduleId(uint64_t *scheduleId)
         return RESULT_BAD_PARAM;
     }
 
-    for (uint32_t i = 0; i < MAX_DULPLICATE_CHECK; i++) {
+    for (uint32_t i = 0; i < MAX_DUPLICATE_CHECK; i++) {
         uint64_t tempRandom;
         if (SecureRandom((uint8_t *)&tempRandom, sizeof(uint64_t)) != RESULT_SUCCESS) {
             LOG_ERROR("get random failed");
@@ -202,7 +203,7 @@ static ResultCode MountExecutor(uint32_t authType, CoAuthSchedule *coAuthSchedul
     LinkedListNode *tempNode = executors->head;
     for (uint32_t i = 0; i < coAuthSchedule->executorSize; i++) {
         if (tempNode == NULL || tempNode->data == NULL) {
-            LOG_ERROR("something bad");
+            LOG_ERROR("tempNode or data is null");
             ret = RESULT_UNKNOWN;
             goto EXIT;
         }
@@ -287,4 +288,4 @@ CoAuthSchedule *GenerateIdmSchedule(uint64_t challenge, uint32_t authType, uint6
 EXIT:
     Free(coAuthSchedule);
     return NULL;
-}
\ No newline at end of file
+}
diff --git a/common/coauth/src/coauth_funcs.c b/common/coauth/src/coauth_funcs.c
index f71eeb07315feff6d8152c58c8fdbf5b10e1c392..af8621b3736507af2aa7b5d69a89b3e70b3d89df 100644
--- a/common/coauth/src/coauth_funcs.c
+++ b/common/coauth/src/coauth_funcs.c
@@ -112,6 +112,7 @@ int32_t ScheduleFinish(const Buffer *executorMsg, ScheduleTokenHal *scheduleToke
         DestoryBuffer(publicKey);
         goto EXIT;
     }
+
     ret = TokenDataGetAndSign(coAuthSchedule.executors[0].authType, resultInfo, scheduleToken);
     DestoryBuffer(publicKey);
 
@@ -152,10 +153,12 @@ bool IsExecutorExistFunc(uint32_t authType)
     LinkedList *executorsQuery = NULL;
     int32_t ret = QueryExecutor(authType, &executorsQuery);
     if (ret != RESULT_SUCCESS || executorsQuery == NULL) {
+        LOG_ERROR("query executor fail");
         return false;
     }
 
     if (executorsQuery->getSize(executorsQuery) == 0) {
+        LOG_ERROR("get size fail");
         DestroyLinkedList(executorsQuery);
         return false;
     }
diff --git a/common/coauth/src/coauth_sign_centre.c b/common/coauth/src/coauth_sign_centre.c
index 7e4e91ed470eea06146985b421d435c380617618..4ba0144ed8487a95951ecf9b23343469a3c0c929 100644
--- a/common/coauth/src/coauth_sign_centre.c
+++ b/common/coauth/src/coauth_sign_centre.c
@@ -51,8 +51,8 @@ ResultCode CoAuthTokenSign(ScheduleTokenHal *coAuthToken)
     }
     coAuthToken->version = TOKEN_VERSION;
     ResultCode ret = RESULT_SUCCESS;
-    Buffer *data = CreateBufferByData((uint8_t *)coAuthToken, COAUTH_TOKEN_DATA_LEN);
-    Buffer *key = CreateBufferByData(g_coAuthTokenKey, SHA256_KEY_LEN);
+    Buffer *data = CreateBufferByData((uint8_t *)coAuthToken, sizeof(ScheduleTokenHal));
+    Buffer *key = CreateBufferByData(g_coAuthTokenKey, sizeof(g_coAuthTokenKey));
     Buffer *sign = NULL;
     if (data == NULL || key == NULL) {
         LOG_ERROR("lack of member");
@@ -65,7 +65,7 @@ ResultCode CoAuthTokenSign(ScheduleTokenHal *coAuthToken)
         goto EXIT;
     }
 
-    if (memcpy_s(coAuthToken->sign, SHA256_SIGN_LEN, sign->buf, sign->contentSize) != EOK) {
+    if (memcpy_s(coAuthToken->sign, sizeof(coAuthToken->sign), sign->buf, sign->contentSize) != EOK) {
         LOG_ERROR("sign copy failed");
         ret = RESULT_BAD_COPY;
         goto EXIT;
diff --git a/common/coauth/src/executor_message.c b/common/coauth/src/executor_message.c
index b5e0a1ff6df80891fcef6a7e14621b724518d867..c4d1138d19670a66aa8ccc633dfcb787aa07c902 100644
--- a/common/coauth/src/executor_message.c
+++ b/common/coauth/src/executor_message.c
@@ -138,6 +138,7 @@ static ResultCode ParseRoot(ExecutorResultInfo *result, TlvListNode *body)
     TlvListNode *parseBody = CreateTlvList();
     if (parseBody == NULL) {
         LOG_ERROR("parseBody is null");
+        DestoryBuffer(data);
         return false;
     }
     int ret = ParseTlvWrapper(data->buf, data->contentSize, parseBody);
diff --git a/common/common/inc/defines.h b/common/common/inc/defines.h
index f737a39a1c546883a3f9109189734a5acf9915a1..f9622195c159bb50fb14d4d9b6894e5c654c6e66 100644
--- a/common/common/inc/defines.h
+++ b/common/common/inc/defines.h
@@ -52,6 +52,6 @@ typedef enum AuthSubType {
     DEFAULT_TYPE = 0,
 } AuthSubType;
 
-#define MAX_DULPLICATE_CHECK 100
+#define MAX_DUPLICATE_CHECK 100
 
 #endif
diff --git a/common/common/src/buffer.c b/common/common/src/buffer.c
index ff5c68f01b9becfe96964fa6e1b6822ac5d41f41..b2e046dfc8073acf7cb928270c3748b7718fc5c1 100644
--- a/common/common/src/buffer.c
+++ b/common/common/src/buffer.c
@@ -124,7 +124,7 @@ void DestoryBuffer(Buffer *buffer)
 {
     if (buffer != NULL) {
         if (buffer->buf != NULL) {
-            if (memset_s(buffer->buf, buffer->contentSize, 0, buffer->contentSize) != EOK) {
+            if (memset_s(buffer->buf, buffer->maxSize, 0, buffer->maxSize) != EOK) {
                 LOG_ERROR("DestoryBuffer memset fail!");
             }
             Free(buffer->buf);
diff --git a/common/database/src/idm_common.c b/common/database/src/idm_common.c
index 46c4f5afbf7681640952b4774798fa99b8e89ad7..f5a699e102bfb96daf3d5fb1857dc72a88c7408a 100644
--- a/common/database/src/idm_common.c
+++ b/common/database/src/idm_common.c
@@ -66,8 +66,8 @@ UserInfo *InitUserInfoNode(void)
     userInfo->enrolledInfoList = CreateLinkedList(DestroyEnrolledNode);
     if (userInfo->enrolledInfoList == NULL) {
         LOG_ERROR("create enrolledInfoList failed");
-        Free(userInfo);
         DestroyLinkedList(userInfo->enrolledInfoList);
+        Free(userInfo);
         return NULL;
     }
     return userInfo;
diff --git a/common/database/src/idm_database.c b/common/database/src/idm_database.c
index 3ef96ac8aa157aafbda28f8463f842e3a212c973..143f7b985186d586ea6e08ec8de64ce551574328 100644
--- a/common/database/src/idm_database.c
+++ b/common/database/src/idm_database.c
@@ -21,7 +21,7 @@
 #include "adaptor_log.h"
 #include "idm_file_manager.h"
 
-#define MAX_DULPLICATE_CHECK 100
+#define MAX_DUPLICATE_CHECK 100
 #define PRE_APPLY_NUM 5
 #define MEM_GROWTH_FACTOR 2
 #define MAX_CREDENTIAL_RETURN 5000
@@ -122,7 +122,7 @@ ResultCode GetEnrolledInfoAuthType(int32_t userId, uint32_t authType, EnrolledIn
         return RESULT_NOT_FOUND;
     }
     if (user->enrolledInfoList == NULL) {
-        LOG_ERROR("something bad");
+        LOG_ERROR("enrolledInfoList is null");
         return RESULT_UNKNOWN;
     }
 
@@ -377,7 +377,7 @@ static ResultCode GenerateDeduplicateUint64(LinkedList *collection, uint64_t *de
         return RESULT_BAD_PARAM;
     }
 
-    for (uint32_t i = 0; i < MAX_DULPLICATE_CHECK; i++) {
+    for (uint32_t i = 0; i < MAX_DUPLICATE_CHECK; i++) {
         uint64_t tempRandom;
         if (SecureRandom((uint8_t *)&tempRandom, sizeof(uint64_t)) != RESULT_SUCCESS) {
             LOG_ERROR("get random failed");
@@ -389,7 +389,7 @@ static ResultCode GenerateDeduplicateUint64(LinkedList *collection, uint64_t *de
         }
     }
 
-    LOG_ERROR("a rare failure");
+    LOG_ERROR("generate random fail");
     return RESULT_GENERAL_ERROR;
 }
 
@@ -399,7 +399,7 @@ static ResultCode UpdateEnrolledId(LinkedList *enrolledList, uint32_t authType)
     EnrolledInfoHal *enrolledInfo = NULL;
     while (temp != NULL) {
         EnrolledInfoHal *nodeData = (EnrolledInfoHal *)temp->data;
-        if (enrolledInfo != NULL && enrolledInfo->authType == authType) {
+        if (nodeData != NULL && nodeData->authType == authType) {
             enrolledInfo = nodeData;
             break;
         }
diff --git a/common/hal_sdk/coauth_interface.cpp b/common/hal_sdk/coauth_interface.cpp
index f6786f9460db1fef05a70942b73dc7373818f519..1b7ff38fc8db3836321928af4dd88c54dfb33cfc 100644
--- a/common/hal_sdk/coauth_interface.cpp
+++ b/common/hal_sdk/coauth_interface.cpp
@@ -34,7 +34,9 @@ static ExecutorInfo CopyExecutorInfoOut(const ExecutorInfoHal &executorInfoHal)
     executorInfo.authAbility = executorInfoHal.authAbility;
     executorInfo.esl = executorInfoHal.esl;
     executorInfo.executorType = executorInfoHal.executorType;
-    (void)memcpy_s(executorInfo.publicKey, PUBLIC_KEY_LEN, executorInfoHal.pubKey, PUBLIC_KEY_LEN);
+    if (memcpy_s(executorInfo.publicKey, PUBLIC_KEY_LEN, executorInfoHal.pubKey, PUBLIC_KEY_LEN) != EOK) {
+        LOG_ERROR("memcpy fail");
+    }
     return executorInfo;
 }
 
@@ -45,7 +47,9 @@ static ExecutorInfoHal CopyExecutorInfoIn(const ExecutorInfo &executorInfo)
     executorInfoHal.authAbility = executorInfo.authAbility;
     executorInfoHal.esl = executorInfo.esl;
     executorInfoHal.executorType = executorInfo.executorType;
-    (void)memcpy_s(executorInfoHal.pubKey, PUBLIC_KEY_LEN, executorInfo.publicKey, PUBLIC_KEY_LEN);
+    if (memcpy_s(executorInfoHal.pubKey, PUBLIC_KEY_LEN, executorInfo.publicKey, PUBLIC_KEY_LEN) != EOK) {
+        LOG_ERROR("memcpy fail");
+    }
     return executorInfoHal;
 }
 
diff --git a/common/hal_sdk/useriam_common.cpp b/common/hal_sdk/useriam_common.cpp
index f64231da87e69b60d725f6edb8439b19fcbaa4d1..a8d66483ebd1dceeaed7f3c04ed1a8b8a3d099db 100644
--- a/common/hal_sdk/useriam_common.cpp
+++ b/common/hal_sdk/useriam_common.cpp
@@ -44,8 +44,9 @@ int32_t Init()
         LOG_ERROR("init user auth failed");
         goto FAIL;
     }
-    if (InitResorcePool() != RESULT_SUCCESS) {
-        LOG_ERROR("init resorce pool failed");
+
+    if (InitResourcePool() != RESULT_SUCCESS) {
+        LOG_ERROR("init resource pool failed");
         goto FAIL;
     }
     if (InitUserInfoList() != RESULT_SUCCESS) {
@@ -72,7 +73,7 @@ int32_t Close()
     DestoryUserAuthContextList();
     DestoryCoAuth();
     DestroyUserInfoList();
-    DestroyResorcePool();
+    DestroyResourcePool();
     g_isInitUserIAM = false;
     GlobalUnLock();
     return RESULT_SUCCESS;
diff --git a/common/hal_sdk/useridm_interface.cpp b/common/hal_sdk/useridm_interface.cpp
index 986f704826c7c793f67da7089de7834447aa8dd7..4acd791c95e4f4be9875f62e8e9eb59baa51ded4 100644
--- a/common/hal_sdk/useridm_interface.cpp
+++ b/common/hal_sdk/useridm_interface.cpp
@@ -62,7 +62,7 @@ int32_t InitSchedulation(std::vector<uint8_t> authToken, int32_t userId, uint32_
     }
     PermissionCheckParam param;
     if (authToken.size() == sizeof(UserAuth::UserAuthToken) &&
-        memcpy_s(param.token, AUTH_TOKEN_LEN, &authToken[0], authToken.size()) != EOK) {
+        memcpy_s(param.token, sizeof(param.token), &authToken[0], authToken.size()) != EOK) {
         GlobalUnLock();
         return RESULT_BAD_COPY;
     }
@@ -93,7 +93,7 @@ int32_t AddCredential(std::vector<uint8_t> enrollToken, uint64_t &credentialId)
         return RESULT_BAD_PARAM;
     }
     uint8_t enrollTokenIn[sizeof(ScheduleTokenHal)];
-    if (memcpy_s(enrollTokenIn, sizeof(ScheduleTokenHal), &enrollToken[0], enrollToken.size()) != EOK) {
+    if (memcpy_s(enrollTokenIn, sizeof(enrollTokenIn), &enrollToken[0], enrollToken.size()) != EOK) {
         LOG_ERROR("enrollToken copy failed");
         GlobalUnLock();
         return RESULT_BAD_COPY;
@@ -115,7 +115,7 @@ int32_t DeleteCredential(int32_t userId, uint64_t credentialId, std::vector<uint
         return RESULT_BAD_PARAM;
     }
     CredentialDeleteParam param;
-    if (memcpy_s(param.token, AUTH_TOKEN_LEN, &authToken[0], authToken.size()) != EOK) {
+    if (memcpy_s(param.token, sizeof(param.token), &authToken[0], authToken.size()) != EOK) {
         LOG_ERROR("param token copy failed");
         GlobalUnLock();
         return RESULT_BAD_COPY;
diff --git a/common/idm/src/user_idm_funcs.c b/common/idm/src/user_idm_funcs.c
index 8b7784c821030df74e8c93333896a6d00b5187b0..27bcd721e98e4dcfec161eb6f4def57f59f636f5 100644
--- a/common/idm/src/user_idm_funcs.c
+++ b/common/idm/src/user_idm_funcs.c
@@ -171,7 +171,7 @@ int32_t DeleteCredentialFunc(CredentialDeleteParam param, CredentialInfoHal *cre
         return RESULT_BAD_PARAM;
     }
     UserAuthTokenHal token;
-    if (memcpy_s(&token, sizeof(UserAuthTokenHal), param.token, AUTH_TOKEN_LEN) != EOK) {
+    if (memcpy_s(&token, sizeof(UserAuthTokenHal), param.token, sizeof(param.token)) != EOK) {
         LOG_ERROR("token copy failed");
         return RESULT_BAD_COPY;
     }
diff --git a/common/pool/inc/pool.h b/common/pool/inc/pool.h
index c246391389b997fca6a6fd08660649b707b147ee..e92e7e7fabbb2c352a6d716df3bb15eb30483018 100644
--- a/common/pool/inc/pool.h
+++ b/common/pool/inc/pool.h
@@ -36,8 +36,8 @@ typedef struct ExecutorInfoHal {
     uint8_t pubKey[PUBLIC_KEY_LEN];
 } ExecutorInfoHal;
 
-ResultCode InitResorcePool(void);
-void DestroyResorcePool(void);
+ResultCode InitResourcePool(void);
+void DestroyResourcePool(void);
 ResultCode RegisterExecutorToPool(ExecutorInfoHal *executorInfo);
 ResultCode UnregisterExecutorToPool(uint64_t executorId);
 ResultCode QueryExecutor(uint32_t authType, LinkedList **result);
diff --git a/common/pool/src/pool.c b/common/pool/src/pool.c
index 465d10009be8b7d7db1125fa638c002a46dc7294..59763d609c4e1b3001fd87db81d033cc8f6e2af4 100644
--- a/common/pool/src/pool.c
+++ b/common/pool/src/pool.c
@@ -21,7 +21,7 @@
 #include "adaptor_log.h"
 #include "adaptor_memory.h"
 
-#define MAX_DULPLICATE_CHECK 100
+#define MAX_DUPLICATE_CHECK 100
 
 // Resource pool list, which caches registered executor information.
 static LinkedList *g_poolList = NULL;
@@ -29,7 +29,7 @@ static LinkedList *g_poolList = NULL;
 static void DestroyExecutorInfo(void *data)
 {
     if (data  == NULL) {
-        LOG_ERROR("get null data");
+        LOG_ERROR("data is null");
         return;
     }
     Free(data);
@@ -38,7 +38,7 @@ static void DestroyExecutorInfo(void *data)
 static bool IsExecutorIdMatchById(void *data, void *condition)
 {
     if ((condition == NULL) || (data == NULL)) {
-        LOG_ERROR("get null data");
+        LOG_ERROR("input para is null");
         return false;
     }
     uint64_t executorId = *(uint64_t *)condition;
@@ -63,7 +63,7 @@ static bool IsInit()
     return g_poolList != NULL;
 }
 
-ResultCode InitResorcePool(void)
+ResultCode InitResourcePool(void)
 {
     if (!IsInit()) {
         g_poolList = CreateLinkedList(DestroyExecutorInfo);
@@ -74,7 +74,7 @@ ResultCode InitResorcePool(void)
     return RESULT_SUCCESS;
 }
 
-void DestroyResorcePool(void)
+void DestroyResourcePool(void)
 {
     DestroyLinkedList(g_poolList);
     g_poolList = NULL;
@@ -111,7 +111,7 @@ static ResultCode GenerateValidExecutorId(uint64_t *executorId)
         return RESULT_BAD_PARAM;
     }
 
-    for (uint32_t i = 0; i < MAX_DULPLICATE_CHECK; i++) {
+    for (uint32_t i = 0; i < MAX_DUPLICATE_CHECK; i++) {
         uint64_t tempRandom;
         if (SecureRandom((uint8_t *)&tempRandom, sizeof(uint64_t)) != RESULT_SUCCESS) {
             LOG_ERROR("get random failed");
diff --git a/common/user_auth/src/context_manager.c b/common/user_auth/src/context_manager.c
index 2271904b0b60720de414baba97bb7972e578985c..44a7d0526bb690ffb7695e6845d1134affe17f33 100644
--- a/common/user_auth/src/context_manager.c
+++ b/common/user_auth/src/context_manager.c
@@ -209,10 +209,12 @@ ResultCode GetScheduleIds(UserAuthContext *context, uint64_t **scheduleIds, uint
     }
     LinkedList *schedules = context->scheduleList;
     *scheduleNum = schedules->getSize(schedules);
-    *scheduleIds = Malloc(*scheduleNum * sizeof(uint64_t));
     if (*scheduleNum == 0) {
+        LOG_INFO("scheduleNum is 0");
         return RESULT_SUCCESS;
     }
+
+    *scheduleIds = Malloc(*scheduleNum * sizeof(uint64_t));
     if (*scheduleIds == NULL) {
         LOG_ERROR("scheduleIds malloc failed");
         return RESULT_NO_MEMORY;
@@ -222,19 +224,19 @@ ResultCode GetScheduleIds(UserAuthContext *context, uint64_t **scheduleIds, uint
     for (uint32_t index = 0; index < *scheduleNum; index++) {
         if (temp == NULL) {
             LOG_ERROR("something is wrong, please check");
-            goto EXIT;
+            goto ERROR;
         }
         CoAuthSchedule *schedule = temp->data;
         if (schedule == NULL) {
             LOG_ERROR("data is null");
-            goto EXIT;
+            goto ERROR;
         }
         (*scheduleIds)[index] = schedule->scheduleId;
         temp = temp->next;
     }
     return RESULT_SUCCESS;
 
-EXIT:
+ERROR:
     Free(scheduleIds);
     *scheduleIds = NULL;
     return RESULT_GENERAL_ERROR;
diff --git a/common/user_auth/src/user_auth_funcs.c b/common/user_auth/src/user_auth_funcs.c
index 5a48368c8eefef0a8bedd38367fa2d7fb6f7dd84..59fee2456e5119fb47d1ee82021db0050bc72394 100644
--- a/common/user_auth/src/user_auth_funcs.c
+++ b/common/user_auth/src/user_auth_funcs.c
@@ -125,7 +125,7 @@ int32_t CancelContextFunc(uint64_t contextId, uint64_t **scheduleIdArray, uint32
     }
     int32_t ret = GetScheduleIds(authContext, scheduleIdArray, scheduleNum);
     if (ret != RESULT_SUCCESS) {
-        LOG_ERROR("get schedule faield");
+        LOG_ERROR("get schedule failed");
     }
     DestoryContext(authContext);
     return ret;
diff --git a/common/user_auth/src/user_sign_centre.c b/common/user_auth/src/user_sign_centre.c
index 45cf0c141a90b26493f2d013e108744f4589d38e..f089d212d20ae158e316abb50b62d79b018fb335 100644
--- a/common/user_auth/src/user_sign_centre.c
+++ b/common/user_auth/src/user_sign_centre.c
@@ -52,8 +52,8 @@ ResultCode UserAuthTokenSign(UserAuthTokenHal *userAuthToken)
     }
     userAuthToken->version = TOKEN_VERSION;
     ResultCode ret = RESULT_SUCCESS;
-    Buffer *data = CreateBufferByData((uint8_t *)userAuthToken, AUTH_TOKEN_DATA_LEN);
-    Buffer *key = CreateBufferByData(g_userAuthTokenKey, SHA256_KEY_LEN);
+    Buffer *data = CreateBufferByData((uint8_t *)userAuthToken, sizeof(UserAuthTokenHal));
+    Buffer *key = CreateBufferByData(g_userAuthTokenKey, sizeof(g_userAuthTokenKey));
     Buffer *sign = NULL;
     if (data == NULL || key == NULL) {
         LOG_ERROR("lack of member");
@@ -66,7 +66,7 @@ ResultCode UserAuthTokenSign(UserAuthTokenHal *userAuthToken)
         goto EXIT;
     }
 
-    if (memcpy_s(userAuthToken->sign, SHA256_SIGN_LEN, sign->buf, sign->contentSize) != EOK) {
+    if (memcpy_s(userAuthToken->sign, sizeof(userAuthToken->sign), sign->buf, sign->contentSize) != EOK) {
         LOG_ERROR("sign copy failed");
         ret = RESULT_BAD_COPY;
         goto EXIT;
diff --git a/frameworks/kitsimpl/src/set_prop_callback_proxy.cpp b/frameworks/kitsimpl/src/set_prop_callback_proxy.cpp
index e76d33a7a1bdbb6f7b56a0a8656189d4a19d0e79..5b34024a0b2589b37c9a4a7c81cd1c54e193d9f6 100644
--- a/frameworks/kitsimpl/src/set_prop_callback_proxy.cpp
+++ b/frameworks/kitsimpl/src/set_prop_callback_proxy.cpp
@@ -30,7 +30,7 @@ void SetPropCallbackProxy::OnResult(uint32_t result, std::vector<uint8_t> &extra
     }
 
     if (!data.WriteUInt8Vector(extraInfo)) {
-        COAUTH_HILOGE(MODULE_INNERKIT, "fail to wirte WriteUInt8Vector extraInfo");
+        COAUTH_HILOGE(MODULE_INNERKIT, "fail to write WriteUInt8Vector extraInfo");
     }
 
     bool ret = SendRequest(static_cast<int32_t>(ISetPropCallback::ONRESULT), data, reply);
diff --git a/interfaces/innerkits/include/auth_attributes.h b/interfaces/innerkits/include/auth_attributes.h
index bf2d4cb28c57da67cfe952216110f98e6c49eef9..3d23e9a63e802a596638781da2b2a47799761ba6 100644
--- a/interfaces/innerkits/include/auth_attributes.h
+++ b/interfaces/innerkits/include/auth_attributes.h
@@ -85,6 +85,13 @@ private:
                       std::vector<uint8_t> &buffer);
     void Write64Array(std::vector<uint64_t> &uint64ArraylValue, uint8_t *writePointer,
                       std::vector<uint8_t> &buffer);
+    bool CheckLengthPass(ValueType type, uint32_t currIndex, uint32_t dataLength, uint32_t bufferLength);
+    void UnpackUint32ArrayType(std::vector<uint8_t> &buffer, AuthAttributeType tag, uint32_t& authDataLength,
+        uint32_t& dataLength);
+    void UnpackUint64ArrayType(std::vector<uint8_t> &buffer, AuthAttributeType tag, uint32_t& authDataLength,
+        uint32_t& dataLength);
+    void UnpackUint8ArrayType(std::vector<uint8_t> &buffer, AuthAttributeType tag, uint32_t& authDataLength,
+        uint32_t& dataLength);
 };
 } // namespace AuthResPool
 } // namespace UserIAM
diff --git a/interfaces/innerkits/src/auth_attributes.cpp b/interfaces/innerkits/src/auth_attributes.cpp
index f5be45dfe04ed34de439cb45f0791fc9cae05d8f..f1e2ea112eb100f26d6280d87448da3361446ce2 100644
--- a/interfaces/innerkits/src/auth_attributes.cpp
+++ b/interfaces/innerkits/src/auth_attributes.cpp
@@ -203,6 +203,66 @@ void AuthAttributes::UnpackTag(AuthAttributeType &tag, std::vector<uint8_t> &buf
     authDataLength += sizeof(uint32_t);
 }
 
+bool AuthAttributes::CheckLengthPass(ValueType type, uint32_t currIndex, uint32_t dataLength, uint32_t bufferLength)
+{
+    if (currIndex + dataLength > bufferLength) {
+        COAUTH_HILOGE(MODULE_INNERKIT, "buffer read exceed buffer size");
+        return false;
+    }
+
+    switch (type) {
+        case BOOLTYPE:
+            if (dataLength != sizeof(bool)) {
+                COAUTH_HILOGE(MODULE_INNERKIT, "data length mismatch(bool)");
+                return false;
+            }
+            break;
+        case UINT32TYPE:
+            if (dataLength != sizeof(uint32_t)) {
+                COAUTH_HILOGE(MODULE_INNERKIT, "data length mismatch(uint32_t)");
+                return false;
+            }
+            break;
+        case UINT64TYPE:
+            if (dataLength != sizeof(uint64_t)) {
+                COAUTH_HILOGE(MODULE_INNERKIT, "data length mismatch(uint64_t)");
+                return false;
+            }
+            break;
+        default:
+            break;
+    }
+    return true;
+}
+
+void AuthAttributes::UnpackUint32ArrayType(std::vector<uint8_t> &buffer, AuthAttributeType tag, uint32_t& authDataLength,
+    uint32_t& dataLength)
+{
+    std::vector<uint32_t> uint32ArraylValue = GetUint32ArrayFromUint8(buffer, authDataLength, dataLength);
+    SetUint32ArrayValue(tag, uint32ArraylValue);
+    authDataLength += dataLength;
+}
+
+void AuthAttributes::UnpackUint64ArrayType(std::vector<uint8_t> &buffer, AuthAttributeType tag, uint32_t& authDataLength,
+    uint32_t& dataLength)
+{
+    std::vector<uint64_t> uint64ArraylValue = GetUint64ArrayFromUint8(buffer, authDataLength, dataLength);
+    SetUint64ArrayValue(tag, uint64ArraylValue);
+    authDataLength += dataLength;
+}
+
+void AuthAttributes::UnpackUint8ArrayType(std::vector<uint8_t> &buffer, AuthAttributeType tag, uint32_t& authDataLength,
+    uint32_t& dataLength)
+{
+    if (dataLength == 0) {
+        return;
+    }
+    std::vector<uint8_t> uint8ArrayValue(buffer.begin() + authDataLength,
+        buffer.begin() + authDataLength + dataLength);
+    SetUint8ArrayValue(tag, uint8ArrayValue);
+    authDataLength += dataLength;
+}
+
 AuthAttributes* AuthAttributes::Unpack(std::vector<uint8_t> &buffer)
 {
     if (buffer.size() == 0) {
@@ -211,14 +271,16 @@ AuthAttributes* AuthAttributes::Unpack(std::vector<uint8_t> &buffer)
     uint32_t dataLength;
     uint32_t authDataLength = 0;
     AuthAttributeType tag;
-    std::vector<uint32_t> uint32ArraylValue;
-    std::vector<uint64_t> uint64ArraylValue;
-    std::vector<uint8_t> uint8ArrayValue;
+    // skip unused tag
     UnpackTag(tag, buffer, authDataLength, dataLength);
     UnpackTag(tag, buffer, authDataLength, dataLength);
     while (authDataLength < buffer.size()) {
         UnpackTag(tag, buffer, authDataLength, dataLength);
         std::map<AuthAttributeType, ValueType>::iterator iter = authAttributesPosition_.find(tag);
+        if (!CheckLengthPass(iter->second, authDataLength, dataLength, buffer.size())) {
+            return nullptr;
+        }
+        COAUTH_HILOGE(MODULE_INNERKIT, "buffer read %{public}d", tag);
         switch (iter->second) {
             case BOOLTYPE:
                 SetBoolValue(tag, GetBoolFromUint8(buffer, authDataLength));
@@ -233,22 +295,13 @@ AuthAttributes* AuthAttributes::Unpack(std::vector<uint8_t> &buffer)
                 authDataLength += sizeof(uint64_t);
                 break;
             case UINT32ARRAYTYPE:
-                uint32ArraylValue = GetUint32ArrayFromUint8(buffer, authDataLength, dataLength);
-                SetUint32ArrayValue(tag, uint32ArraylValue);
-                authDataLength += dataLength;
+                UnpackUint32ArrayType(buffer, tag, authDataLength, dataLength);
                 break;
             case UINT64ARRAYTYPE:
-                uint64ArraylValue = GetUint64ArrayFromUint8(buffer, authDataLength, dataLength);
-                SetUint64ArrayValue(tag, uint64ArraylValue);
-                authDataLength += dataLength;
+                UnpackUint64ArrayType(buffer, tag, authDataLength, dataLength);
                 break;
             case UINT8ARRAYTYPE:
-                if (dataLength != 0) {
-                    uint8ArrayValue.insert(uint8ArrayValue.begin(), buffer.begin() + authDataLength,
-                                           buffer.begin() + authDataLength + dataLength);
-                    SetUint8ArrayValue(tag, uint8ArrayValue);
-                    authDataLength += dataLength;
-                }
+                UnpackUint8ArrayType(buffer, tag, authDataLength, dataLength);
                 break;
             default:
                 break;
@@ -314,7 +367,7 @@ int32_t AuthAttributes::Pack(std::vector<uint8_t> &buffer)
     uint32_t authDataLength = 0;
     buffer.clear();
     sort(existAttributes_.begin(), existAttributes_.end());
-    for (int32_t i = 0; i != existAttributes_.size(); i++) {
+    for (uint32_t i = 0; i != existAttributes_.size(); i++) {
         if (existAttributes_[i] == AUTH_ROOT ||
             existAttributes_[i] == AUTH_DATA ||
             existAttributes_[i] == AUTH_SIGNATURE) {
diff --git a/services/src/auth_res_manager.cpp b/services/src/auth_res_manager.cpp
index 527f5649038fd0926085ce0e9293e729cb678795..a23fe1d5ee4dc3c10fdf991c754a3b683879b341 100644
--- a/services/src/auth_res_manager.cpp
+++ b/services/src/auth_res_manager.cpp
@@ -43,7 +43,7 @@ uint64_t AuthResManager::Register(std::shared_ptr<ResAuthExecutor> executorInfo,
     info.esl = esl;
     info.executorType = exeType;
     if (publicKey.size() > PUBLIC_KEY_LEN) {
-        COAUTH_HILOGE(MODULE_SERVICE, "publicKey is wrong!");
+        COAUTH_HILOGE(MODULE_SERVICE, "publicKey length too long");
         return executorId;
     } else {
         for (std::size_t i = 0; i < publicKey.size(); i++) {
@@ -58,12 +58,12 @@ uint64_t AuthResManager::Register(std::shared_ptr<ResAuthExecutor> executorInfo,
             return INVALID_EXECUTOR_ID;
         }
         coAuthResPool_.Insert(executorId, executorInfo, callback); // Cache executorId
-        COAUTH_HILOGI(MODULE_SERVICE, "register is sucessfull!");
+        COAUTH_HILOGI(MODULE_SERVICE, "register is successfull!");
         // Assign messenger
         sptr<UserIAM::AuthResPool::IExecutorMessenger> messenger =
         new UserIAM::AuthResPool::ExecutorMessenger(&coAuthResPool_);
         callback->OnMessengerReady(messenger);
-        COAUTH_HILOGD(MODULE_SERVICE, "register is sucessfull,exeID is XXXX%{public}04" PRIx64, executorId);
+        COAUTH_HILOGD(MODULE_SERVICE, "register is successfull,exeID is XXXX%{public}04" PRIx64, executorId);
         return executorId; // executorId returned after successful registration
     }
     if (result == FAIL) {
@@ -85,15 +85,15 @@ void AuthResManager::QueryStatus(ResAuthExecutor &executorInfo, sptr<ResIQueryCa
     }
     result = executorInfo.GetAuthType(authType);
     if (result == SUCCESS) {
-        COAUTH_HILOGI(MODULE_SERVICE, "GetAuthType is SUCESS");
+        COAUTH_HILOGI(MODULE_SERVICE, "GetAuthType is success");
         isExist = IsExecutorExist(authType); // call TA
     } else {
         COAUTH_HILOGE(MODULE_SERVICE, "GetAuthType is failure");
     }
     if (isExist == false) {
-        COAUTH_HILOGE(MODULE_SERVICE, "queryustatus executor register is not exist!");
+        COAUTH_HILOGE(MODULE_SERVICE, "query status executor register is not exist!");
     } else {
-        COAUTH_HILOGI(MODULE_SERVICE, "queryustatus executor register is exist!");
+        COAUTH_HILOGI(MODULE_SERVICE, "query status executor register is exist!");
     }
     callback->OnResult(isExist ? SUCCESS : FAIL);
 }
diff --git a/services/src/auth_res_pool.cpp b/services/src/auth_res_pool.cpp
index 4e80509a754890c887795cc69d50b7a658aa468a..a5cdc79781183254c1fb887719ff1effb499e185 100644
--- a/services/src/auth_res_pool.cpp
+++ b/services/src/auth_res_pool.cpp
@@ -72,15 +72,15 @@ int32_t AuthResPool::FindExecutorCallback(uint64_t executorID, sptr<ResIExecutor
     return resultCode;
 }
 
-int32_t AuthResPool::FindExecutorCallback(uint32_t authType, sptr<ResIExecutorCallback> &callback)
+int32_t AuthResPool::FindExecutorCallback(uint32_t authType2Find, sptr<ResIExecutorCallback> &callback)
 {
     int32_t resultCode = SUCCESS;
-    AuthType getAuthType;
+    AuthType authType;
     std::lock_guard<std::mutex> lock(authMutex_);
     std::map<uint64_t, std::shared_ptr<ExecutorRegister>>::iterator iter;
     for (iter = authResPool_.begin(); iter != authResPool_.end(); ++iter) {
-        iter->second->executorInfo->GetAuthType(getAuthType);
-        if (getAuthType == (int32_t)authType) {
+        iter->second->executorInfo->GetAuthType(authType);
+        if ((AuthType)authType2Find == authType) {
             callback = iter->second->callback;
             COAUTH_HILOGI(MODULE_SERVICE, "Executor callback is found");
             return resultCode;
@@ -173,4 +173,4 @@ int32_t AuthResPool::DeleteScheduleCallback(uint64_t scheduleId)
 }
 } // namespace CoAuth
 } // namespace UserIAM
-} // namespace OHOS
\ No newline at end of file
+} // namespace OHOS
diff --git a/services/src/coauth_manager.cpp b/services/src/coauth_manager.cpp
index b955abfc8a7fd9f586de014f18f1e1b23afccd8f..e046c85c8d22c750506a9dd9160e9e434b4c0fb8 100644
--- a/services/src/coauth_manager.cpp
+++ b/services/src/coauth_manager.cpp
@@ -37,7 +37,7 @@ void CoAuthManager::CoAuthHandle(uint64_t scheduleId, AuthInfo &authInfo, sptr<I
     std::vector<uint8_t> scheduleToken;
     int32_t ret = GetScheduleInfo(scheduleId, scheduleInfo);
     if (ret != SUCCESS) {
-        COAUTH_HILOGI(MODULE_SERVICE, "Schedule faild.");
+        COAUTH_HILOGI(MODULE_SERVICE, "Schedule failed.");
         return callback->OnFinish(ret, scheduleToken);
     }
     std::size_t executorNum = scheduleInfo.executors.size();
@@ -114,7 +114,7 @@ int32_t CoAuthManager::Cancel(uint64_t scheduleId)
         COAUTH_HILOGE(MODULE_SERVICE, "cancel is failure");
         return FAIL;
     }
-    COAUTH_HILOGI(MODULE_SERVICE, "cancel is sucessfull");
+    COAUTH_HILOGI(MODULE_SERVICE, "cancel is successfull");
     std::size_t executorNum = scheduleInfo.executors.size();
     if (executorNum == 0) {
         COAUTH_HILOGE(MODULE_SERVICE, "executorId does not exist.");
@@ -173,7 +173,7 @@ void CoAuthManager::SetExecutorProp(ResAuthAttributes &conditions, sptr<ISetProp
     if (result != SUCCESS) {
         COAUTH_HILOGE(MODULE_SERVICE, "set properties failure");
     }
-    COAUTH_HILOGI(MODULE_SERVICE, "set properties sucessfull");
+    COAUTH_HILOGI(MODULE_SERVICE, "set properties successfull");
     callback->OnResult(result, extraInfo);
 }
 
diff --git a/services/src/coauth_service.cpp b/services/src/coauth_service.cpp
index 7ba19fa68ec8866d5a0b1dfdf26b40cf57b97a44..9d288b7587e77e91fdc2c48bdf21bfcf8333b0c6 100755
--- a/services/src/coauth_service.cpp
+++ b/services/src/coauth_service.cpp
@@ -88,7 +88,7 @@ void CoAuthService::OnStart()
     // Send registration broadcast
     SendRegisterBroadcast();
 
-    // Start other sevice
+    // Start other service
     std::thread checkThread(OHOS::UserIAM::CoAuth::CheckSystemAbility);
     checkThread.join();
 }
diff --git a/utils/native/include/coauth_hilog_wrapper.h b/utils/native/include/coauth_hilog_wrapper.h
index 09a230523be6e732801d3acb3fa84c87139bbfea..1d938a3a20cbba4cd6acec444ca3b4f1caeb18ac 100755
--- a/utils/native/include/coauth_hilog_wrapper.h
+++ b/utils/native/include/coauth_hilog_wrapper.h
@@ -22,7 +22,7 @@
 namespace OHOS {
 namespace UserIAM {
 #define FILENAME           (__builtin_strrchr(__FILE__, '/') ? __builtin_strrchr(__FILE__, '/') + 1 : __FILE__)
-#define FORMATED(fmt, ...)    "[%{public}s] %{public}s# " fmt, FILENAME, __FUNCTION__, ##__VA_ARGS__
+#define FORMATTED(fmt, ...)    "[%{public}s] %{public}s# " fmt, FILENAME, __FUNCTION__, ##__VA_ARGS__
 
 #ifdef COAUTH_HILOGF
 #undef COAUTH_HILOGF
@@ -73,11 +73,11 @@ static constexpr OHOS::HiviewDFX::HiLogLabel COAUTH_LABEL[COAUTH_MODULE_BUTT] =
 
 // In order to improve performance, do not check the module range.
 // Besides, make sure module is less than COAUTH_MODULE_BUTT.
-#define COAUTH_HILOGF(module, ...) (void)OHOS::HiviewDFX::HiLog::Fatal(COAUTH_LABEL[module], FORMATED(__VA_ARGS__))
-#define COAUTH_HILOGE(module, ...) (void)OHOS::HiviewDFX::HiLog::Error(COAUTH_LABEL[module], FORMATED(__VA_ARGS__))
-#define COAUTH_HILOGW(module, ...) (void)OHOS::HiviewDFX::HiLog::Warn(COAUTH_LABEL[module], FORMATED(__VA_ARGS__))
-#define COAUTH_HILOGI(module, ...) (void)OHOS::HiviewDFX::HiLog::Info(COAUTH_LABEL[module], FORMATED(__VA_ARGS__))
-#define COAUTH_HILOGD(module, ...) (void)OHOS::HiviewDFX::HiLog::Debug(COAUTH_LABEL[module], FORMATED(__VA_ARGS__))
+#define COAUTH_HILOGF(module, ...) (void)OHOS::HiviewDFX::HiLog::Fatal(COAUTH_LABEL[module], FORMATTED(__VA_ARGS__))
+#define COAUTH_HILOGE(module, ...) (void)OHOS::HiviewDFX::HiLog::Error(COAUTH_LABEL[module], FORMATTED(__VA_ARGS__))
+#define COAUTH_HILOGW(module, ...) (void)OHOS::HiviewDFX::HiLog::Warn(COAUTH_LABEL[module], FORMATTED(__VA_ARGS__))
+#define COAUTH_HILOGI(module, ...) (void)OHOS::HiviewDFX::HiLog::Info(COAUTH_LABEL[module], FORMATTED(__VA_ARGS__))
+#define COAUTH_HILOGD(module, ...) (void)OHOS::HiviewDFX::HiLog::Debug(COAUTH_LABEL[module], FORMATTED(__VA_ARGS__))
 } // namespace UserIAM
 } // namespace OHOS