diff --git a/interfaces/inner_api/syscap_interface.c b/interfaces/inner_api/syscap_interface.c
index 4eb457c..d28800a 100644
--- a/interfaces/inner_api/syscap_interface.c
+++ b/interfaces/inner_api/syscap_interface.c
@@ -119,6 +119,10 @@ bool EncodePrivateSyscap(char **output, int *outputLen)
         return false;
     }
 
+    if (bufferLen < (PCID_MAIN_BYTES + 1) || bufferLen > INT32_MAX) {
+        PRINT_ERR("Parameter bufferLen out of range.");
+        return false;
+    }
     uint32_t priLen = bufferLen - PCID_MAIN_BYTES - 1;
     if ((int)priLen <= 0) {
         *outputLen = 0;
diff --git a/src/create_pcid.c b/src/create_pcid.c
index cea4e57..30cd37e 100644
--- a/src/create_pcid.c
+++ b/src/create_pcid.c
@@ -254,6 +254,7 @@ int32_t CreatePCID(char *inputFile, char *outDirPath)
     cJSON *jsonSyscapObj = cJSON_GetObjectItem(jsonRootObj, "syscap");
     if (jsonSyscapObj == NULL || !cJSON_IsObject(jsonSyscapObj)) {
         PRINT_ERR("get \"syscap\" object failed\n");
+        cJSON_Delete(jsonRootObj);
         return FreeAfterCreatePCID(NULL, allOsSyscapObj, contextBuffer, 0, -1);
     }
 
@@ -267,6 +268,7 @@ int32_t CreatePCID(char *inputFile, char *outDirPath)
     uint16_t allPriSyscapStrLen = 0;
     ret = GetPriSyscapLen(privateCapSize, jsonPriSyscapObj, &allPriSyscapStrLen);
     if (ret != 0) {
+        cJSON_Delete(jsonRootObj);
         return FreeAfterCreatePCID(NULL, allOsSyscapObj, contextBuffer, 0, ret);
     }
 
@@ -274,6 +276,7 @@ int32_t CreatePCID(char *inputFile, char *outDirPath)
     PCIDMain *pcidBuffer = (PCIDMain *)malloc(pcidLength);
     if (pcidBuffer == NULL) {
         PRINT_ERR("malloc for pcid buffer failed\n");
+        cJSON_Delete(jsonRootObj);
         return FreeAfterCreatePCID(NULL, allOsSyscapObj, contextBuffer, 0, -1);
     }
     (void)memset_s(pcidBuffer, pcidLength, 0, pcidLength);
@@ -305,6 +308,7 @@ int32_t GetOsSyscap(PCIDMain *pcidMain, cJSON *sysCapObject)
     errno_t nRet = memcpy_s(osSyscap, OS_SYSCAP_BYTES, (uint8_t *)pcidMain + 8, OS_SYSCAP_BYTES);
     if (nRet != EOK) {
         PRINT_ERR("memcpy_s failed.");
+        cJSON_Delete(capVectorPtr);
         return -1;
     }
 
@@ -361,10 +365,12 @@ int32_t GetPriSyscap(PCIDMain *pcidMain, cJSON *sysCapObject, size_t contextBufL
             int32_t ret = sprintf_s(fullCapStr, SINGLE_SYSCAP_LEN, "SystemCapability.%s", priSyscapStr);
             if (ret == -1) {
                 printf("sprintf_s failed\n");
+                cJSON_Delete(capVectorPtr);
                 return -1;
             }
             if (!cJSON_AddItemToArray(capVectorPtr, cJSON_CreateString(fullCapStr))) {
                 printf("cJSON_AddItemToArray or cJSON_CreateString failed\n");
+                cJSON_Delete(capVectorPtr);
                 return -1;
             }
             tempPriSyscapStr = priSyscapStr;
@@ -643,6 +649,7 @@ static int32_t AddPriSyscapToJsonObj(char *priSyscapString, uint32_t priSyscapSt
     if (priSyscapStringLen == 0) {
         if (!cJSON_AddItemToObject(sysCapObj, "private", sysCapArray)) {
             PRINT_ERR("Add private syscap array to json failed.\n");
+            cJSON_Delete(sysCapArray);
             free(sysCapArray);
             return -1;
         }
@@ -653,6 +660,7 @@ static int32_t AddPriSyscapToJsonObj(char *priSyscapString, uint32_t priSyscapSt
     while (token != NULL) {
         if (!cJSON_AddItemToArray(sysCapArray, cJSON_CreateString(token))) {
             PRINT_ERR("Add private syscap string to json failed.\n");
+            cJSON_Delete(sysCapArray);
             free(sysCapArray);
             return -1;
         }
@@ -714,10 +722,11 @@ int32_t DecodeStringPCIDToJson(char *input, char *outDirPath)
     }
     ret = 0;
 
-    SAVE_FAILED:
+SAVE_FAILED:
     free(jsonBuffer);
-    ADD_JSON_FAILED:
+ADD_JSON_FAILED:
     cJSON_Delete(rootObj);
+    cJSON_Delete(sysCapObj);
     PARSE_FAILED:
     free(ctx);
     return ret;
diff --git a/src/main.c b/src/main.c
index 4cc9e42..47a7769 100644
--- a/src/main.c
+++ b/src/main.c
@@ -37,6 +37,7 @@
 #define INPUT_FILE 8
 #define OUTPUT_FILE 9
 #define HELP 10
+#define INPUT_FILE_NUM 4
 
 static void PrintHelp(void);
 static void PrintVersion(void);
@@ -85,7 +86,7 @@ int main(int argc, char **argv)
             break;
         }
         if (flag == 'C') {
-            if (argc != 4 || optind < 0 || optind >= argc) {  // 4, argc of ./syscap_tool -C f1 f2
+            if (argc != INPUT_FILE_NUM || optind < 0 || optind >= argc) {  // 4, argc of ./syscap_tool -C f1 f2
                 PRINT_ERR("Input file too few or too many.\n");
                 return -1;
             }
@@ -126,7 +127,12 @@ int32_t OperateByBitMap(char *const *argv, uint16_t bitMap, char *outputpath)
         case 0x10E: // 0x10E, -Rdsi inputfile
             printf("-Rdsi is not support currently.\n"); break;
         case 0x80:  // 0x80,  -v
-            (void)OutputVersion(argv[optind], optind);  break;
+            if (optind < 0 || optind >= INPUT_FILE_NUM) {
+                PRINT_ERR("Input file too few or too many.\n");
+                return -1;
+            } else {
+                (void)OutputVersion(argv[optind], optind);  break;
+            }
         default:
             (void)OutputHelp();
     }