diff --git a/dm/src/display_manager.cpp b/dm/src/display_manager.cpp
index 689ea2e9..8246e719 100644
--- a/dm/src/display_manager.cpp
+++ b/dm/src/display_manager.cpp
@@ -28,6 +28,7 @@
 namespace OHOS::Rosen {
 namespace {
     constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "DisplayManager"};
+    const static uint32_t MAX_DISPLAY_SIZE = 32;
 }
 WM_IMPLEMENT_SINGLE_INSTANCE(DisplayManager)
 
@@ -635,6 +636,10 @@ bool DisplayManager::Freeze(std::vector<DisplayId> displayIds)
         WLOGFE("freeze display fail, num of display is 0");
         return false;
     }
+    if (displayIds.size() > MAX_DISPLAY_SIZE) {
+        WLOGFE("freeze display fail, displayIds size is bigger than %{public}u.", MAX_DISPLAY_SIZE);
+        return false;
+    }
     return SingletonContainer::Get<DisplayManagerAdapter>().SetFreeze(displayIds, true);
 }
 
@@ -645,6 +650,10 @@ bool DisplayManager::Unfreeze(std::vector<DisplayId> displayIds)
         WLOGFE("unfreeze display fail, num of display is 0");
         return false;
     }
+    if (displayIds.size() > MAX_DISPLAY_SIZE) {
+        WLOGFE("unfreeze display fail, displayIds size is bigger than %{public}u.", MAX_DISPLAY_SIZE);
+        return false;
+    }
     return SingletonContainer::Get<DisplayManagerAdapter>().SetFreeze(displayIds, false);
 }
 } // namespace OHOS::Rosen
\ No newline at end of file
diff --git a/dm/src/screen_manager.cpp b/dm/src/screen_manager.cpp
index 260cbfbe..090a93da 100644
--- a/dm/src/screen_manager.cpp
+++ b/dm/src/screen_manager.cpp
@@ -28,6 +28,7 @@
 namespace OHOS::Rosen {
 namespace {
     constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "ScreenManager"};
+    const static uint32_t MAX_SCREEN_SIZE = 32;
 }
 class ScreenManager::Impl : public RefBase {
 public:
@@ -341,19 +342,26 @@ bool ScreenManager::UnregisterScreenGroupListener(sptr<IScreenGroupListener> lis
 
 ScreenId ScreenManager::MakeExpand(const std::vector<ExpandOption>& options)
 {
-    WLOGFI("make expand");
+    WLOGFI("Make expand");
     if (options.empty()) {
         return SCREEN_ID_INVALID;
     }
+    if (options.size() > MAX_SCREEN_SIZE) {
+        WLOGFW("Make expand failed. The options size is bigger than %{public}u.", MAX_SCREEN_SIZE);
+        return SCREEN_ID_INVALID;
+    }
     std::vector<ScreenId> screenIds;
     std::vector<Point> startPoints;
     for (auto& option: options) {
+        if (std::find(screenIds.begin(), screenIds.end(), option.screenId_) != screenIds.end()) {
+            continue;
+        }
         screenIds.emplace_back(option.screenId_);
         startPoints.emplace_back(Point(option.startX_, option.startY_));
     }
     ScreenId group = SingletonContainer::Get<ScreenManagerAdapter>().MakeExpand(screenIds, startPoints);
     if (group == SCREEN_ID_INVALID) {
-        WLOGFI("make expand failed");
+        WLOGFI("Make expand failed");
     }
     return group;
 }
@@ -361,6 +369,10 @@ ScreenId ScreenManager::MakeExpand(const std::vector<ExpandOption>& options)
 ScreenId ScreenManager::MakeMirror(ScreenId mainScreenId, std::vector<ScreenId> mirrorScreenId)
 {
     WLOGFI("create mirror for screen: %{public}" PRIu64"", mainScreenId);
+    if (mirrorScreenId.size() > MAX_SCREEN_SIZE) {
+        WLOGFW("Make Mirror failed. The mirrorScreenId size is bigger than %{public}u.", MAX_SCREEN_SIZE);
+        return SCREEN_ID_INVALID;
+    }
     ScreenId group = SingletonContainer::Get<ScreenManagerAdapter>().MakeMirror(mainScreenId, mirrorScreenId);
     if (group == SCREEN_ID_INVALID) {
         WLOGFI("create mirror failed");
@@ -370,6 +382,14 @@ ScreenId ScreenManager::MakeMirror(ScreenId mainScreenId, std::vector<ScreenId>
 
 void ScreenManager::RemoveVirtualScreenFromGroup(std::vector<ScreenId> screens)
 {
+    if (screens.empty()) {
+        WLOGFW("RemoveVirtualScreenFromGroup failed. screens is empty.");
+        return;
+    }
+    if (screens.size() > MAX_SCREEN_SIZE) {
+        WLOGFW("RemoveVirtualScreenFromGroup failed. The screens size is bigger than %{public}u.", MAX_SCREEN_SIZE);
+        return;
+    }
     SingletonContainer::Get<ScreenManagerAdapter>().RemoveVirtualScreenFromGroup(screens);
 }
 
diff --git a/dmserver/src/abstract_screen_controller.cpp b/dmserver/src/abstract_screen_controller.cpp
index 37e8133f..cf42319e 100644
--- a/dmserver/src/abstract_screen_controller.cpp
+++ b/dmserver/src/abstract_screen_controller.cpp
@@ -81,6 +81,10 @@ std::vector<ScreenId> AbstractScreenController::GetShotScreenIds(std::vector<Scr
     std::lock_guard<std::recursive_mutex> lock(mutex_);
     std::vector<ScreenId> screenIds;
     for (ScreenId screenId : mirrorScreenIds) {
+        auto iter = std::find(screenIds.begin(), screenIds.end(), screenId);
+        if (iter != screenIds.end()) {
+            continue;
+        }
         auto dmsScreenIter = dmsScreenMap_.find(screenId);
         if (screenIdManager_.HasDmsScreenId(screenId) && dmsScreenIter == dmsScreenMap_.end()) {
             screenIds.emplace_back(screenId);
@@ -96,6 +100,10 @@ std::vector<ScreenId> AbstractScreenController::GetAllExpandOrMirrorScreenIds(
     std::lock_guard<std::recursive_mutex> lock(mutex_);
     std::vector<ScreenId> screenIds;
     for (ScreenId screenId : mirrorScreenIds) {
+        auto screenIdIter = std::find(screenIds.begin(), screenIds.end(), screenId);
+        if (screenIdIter != screenIds.end()) {
+            continue;
+        }
         auto iter = dmsScreenMap_.find(screenId);
         if (iter != dmsScreenMap_.end()) {
             screenIds.emplace_back(screenId);
diff --git a/dmserver/src/display_manager_stub.cpp b/dmserver/src/display_manager_stub.cpp
index 97e38735..e4a48b81 100644
--- a/dmserver/src/display_manager_stub.cpp
+++ b/dmserver/src/display_manager_stub.cpp
@@ -109,11 +109,8 @@ int32_t DisplayManagerStub::OnRemoteRequest(uint32_t code, MessageParcel &data,
         case TRANS_ID_GET_DISPLAY_SNAPSHOT: {
             DisplayId displayId = data.ReadUint64();
             std::shared_ptr<Media::PixelMap> displaySnapshot = GetDisplaySnapshot(displayId);
-            if (displaySnapshot == nullptr) {
-                reply.WriteParcelable(nullptr);
-                break;
-            }
-            reply.WriteParcelable(displaySnapshot.get());
+            reply.WriteParcelable(displaySnapshot == nullptr ? nullptr : displaySnapshot.get());
+            break;
         }
         case TRANS_ID_REGISTER_DISPLAY_MANAGER_AGENT: {
             auto agent = iface_cast<IDisplayManagerAgent>(data.ReadRemoteObject());
@@ -217,9 +214,25 @@ int32_t DisplayManagerStub::OnRemoteRequest(uint32_t code, MessageParcel &data,
             }
             std::vector<Point> startPoint;
             uint32_t nums = data.ReadUint32();
+            if (nums > data.GetReadableBytes() || nums > startPoint.max_size()) {
+                WLOGE("fail to receive startPoint size.");
+                break;
+            }
+            startPoint.resize(nums);
+            if (startPoint.size() < nums) {
+                WLOGE("fail to resize startPoint.");
+                break;
+            }
+            bool readVectorRes = true;
             for (uint32_t i = 0; i < nums; ++i) {
-                Point point { data.ReadInt32(), data.ReadInt32() };
-                startPoint.push_back(point);
+                readVectorRes = data.ReadInt32(startPoint[i].posX_) && data.ReadInt32(startPoint[i].posY_);
+                if (!readVectorRes) {
+                    WLOGE("fail to ReadInt32. index:%{public}u, nums:%{public}u", i, nums);
+                    break;
+                }
+            }
+            if (!readVectorRes) {
+                break;
             }
             ScreenId result = MakeExpand(screenId, startPoint);
             reply.WriteUint64(static_cast<uint64_t>(result));