diff --git a/frameworks/huks_standard/main/core/src/hks_verifier.c b/frameworks/huks_standard/main/core/src/hks_verifier.c
index 22773caf..c7d85bb0 100644
--- a/frameworks/huks_standard/main/core/src/hks_verifier.c
+++ b/frameworks/huks_standard/main/core/src/hks_verifier.c
@@ -254,6 +254,7 @@ static int32_t EncodeTlvAndGetLength(uint8_t **buf, uint32_t *outLength, uint32_
     uint32_t length = 0; /* length of the payload */
 
     uint32_t tmp;
+    HKS_IF_NULL_LOGE_RETURN(*buf, HKS_ERROR_INVALID_ARGUMENT, "invalid input param");
     HKS_ASN1_DECODE_BYTE(*buf, tmp); /* get type */
     if ((*buf)[0] < ASN_1_MIN_VAL_1_EXTRA_LEN_BYTE) {
         /* Current byte tells the length */
diff --git a/services/huks_standard/huks_engine/main/device_cert_manager/src/dcm_asn1.c b/services/huks_standard/huks_engine/main/device_cert_manager/src/dcm_asn1.c
index 49859b47..8787b8d8 100644
--- a/services/huks_standard/huks_engine/main/device_cert_manager/src/dcm_asn1.c
+++ b/services/huks_standard/huks_engine/main/device_cert_manager/src/dcm_asn1.c
@@ -131,6 +131,7 @@ static int32_t Asn1GetObj(struct HksBlob *next, struct HksAsn1Obj *obj, const st
     uint8_t *buf = data->data;
     uint32_t length = 0;
     obj->header.data = buf;
+    HKS_IF_NULL_LOGE_RETURN(buf, HKS_ERROR_INVALID_ARGUMENT, "invalid input param");
     HKS_ASN1_DECODE_BYTE(buf, obj->header.type);
     if (buf[0] < ASN_1_MIN_VAL_1_EXTRA_LEN_BYTE) {
         HKS_ASN1_DECODE_BYTE(buf, length);