diff --git a/include/common/trow.h b/include/common/trow.h
index 3680a82594..8b0349c99b 100644
--- a/include/common/trow.h
+++ b/include/common/trow.h
@@ -30,7 +30,7 @@
 extern "C" {
 #endif
 
-typedef struct {
+typedef struct STSRow {
   TSKEY ts;
   union {
     uint32_t info;
diff --git a/source/client/src/clientImpl.c b/source/client/src/clientImpl.c
index 45d2de4a7a..08f883dce0 100644
--- a/source/client/src/clientImpl.c
+++ b/source/client/src/clientImpl.c
@@ -186,8 +186,8 @@ int32_t buildRequest(uint64_t connId, const char* sql, int sqlLen, void* param,
   STscObj* pTscObj = (*pRequest)->pTscObj;
   if (taosHashPut(pTscObj->pRequests, &(*pRequest)->self, sizeof((*pRequest)->self), &(*pRequest)->self,
                   sizeof((*pRequest)->self))) {
-    tscError("%" PRIx64 " failed to add to request container, reqId:0x%" PRIu64 ", conn:%" PRIx64 ", %s", (*pRequest)->self,
-             (*pRequest)->requestId, pTscObj->id, sql);
+    tscError("%" PRIx64 " failed to add to request container, reqId:0x%" PRIu64 ", conn:%" PRIx64 ", %s",
+             (*pRequest)->self, (*pRequest)->requestId, pTscObj->id, sql);
 
     taosMemoryFree(param);
     destroyRequest(*pRequest);
@@ -199,8 +199,8 @@ int32_t buildRequest(uint64_t connId, const char* sql, int sqlLen, void* param,
   if (tsQueryUseNodeAllocator && !qIsInsertValuesSql((*pRequest)->sqlstr, (*pRequest)->sqlLen)) {
     if (TSDB_CODE_SUCCESS !=
         nodesCreateAllocator((*pRequest)->requestId, tsQueryNodeChunkSize, &((*pRequest)->allocatorRefId))) {
-      tscError("%d failed to create node allocator, reqId:0x%" PRIx64 ", conn:%" PRId64 ", %s", (*pRequest)->self,
-               (*pRequest)->requestId, pTscObj->id, sql);
+      tscError("%" PRId64 " failed to create node allocator, reqId:0x%" PRIx64 ", conn:%" PRId64 ", %s",
+               (*pRequest)->self, (*pRequest)->requestId, pTscObj->id, sql);
 
       destroyRequest(*pRequest);
       *pRequest = NULL;
@@ -1040,39 +1040,39 @@ static int32_t asyncExecSchQuery(SRequestObj* pRequest, SQuery* pQuery, SMetaDat
                                  SSqlCallbackWrapper* pWrapper) {
   pRequest->type = pQuery->msgType;
 
-  SArray*      pMnodeList = taosArrayInit(4, sizeof(SQueryNodeLoad));
+  SArray* pMnodeList = taosArrayInit(4, sizeof(SQueryNodeLoad));
 
   SPlanContext cxt = {.queryId = pRequest->requestId,
-                          .acctId = pRequest->pTscObj->acctId,
-                          .mgmtEpSet = getEpSet_s(&pRequest->pTscObj->pAppInfo->mgmtEp),
-                          .pAstRoot = pQuery->pRoot,
-                          .showRewrite = pQuery->showRewrite,
-                          .pMsg = pRequest->msgBuf,
-                          .msgLen = ERROR_MSG_BUF_DEFAULT_SIZE,
-                          .pUser = pRequest->pTscObj->user,
-                          .sysInfo = pRequest->pTscObj->sysInfo,
-                          .allocatorId = pRequest->allocatorRefId};
+                      .acctId = pRequest->pTscObj->acctId,
+                      .mgmtEpSet = getEpSet_s(&pRequest->pTscObj->pAppInfo->mgmtEp),
+                      .pAstRoot = pQuery->pRoot,
+                      .showRewrite = pQuery->showRewrite,
+                      .pMsg = pRequest->msgBuf,
+                      .msgLen = ERROR_MSG_BUF_DEFAULT_SIZE,
+                      .pUser = pRequest->pTscObj->user,
+                      .sysInfo = pRequest->pTscObj->sysInfo,
+                      .allocatorId = pRequest->allocatorRefId};
 
-      SAppInstInfo* pAppInfo = getAppInfo(pRequest);
-      SQueryPlan*   pDag = NULL;
+  SAppInstInfo* pAppInfo = getAppInfo(pRequest);
+  SQueryPlan*   pDag = NULL;
 
   int64_t st = taosGetTimestampUs();
   int32_t code = qCreateQueryPlan(&cxt, &pDag, pMnodeList);
-      if (code) {
-        tscError("0x%" PRIx64 " failed to create query plan, code:%s 0x%" PRIx64, pRequest->self, tstrerror(code),
-                 pRequest->requestId);
-      } else {
-        pRequest->body.subplanNum = pDag->numOfSubplans;
-      }
+  if (code) {
+    tscError("0x%" PRIx64 " failed to create query plan, code:%s 0x%" PRIx64, pRequest->self, tstrerror(code),
+             pRequest->requestId);
+  } else {
+    pRequest->body.subplanNum = pDag->numOfSubplans;
+  }
 
-      pRequest->metric.planEnd = taosGetTimestampUs();
+  pRequest->metric.planEnd = taosGetTimestampUs();
   if (code == TSDB_CODE_SUCCESS) {
     tscDebug("0x%" PRIx64 " create query plan success, elapsed time:%.2f ms, 0x%" PRIx64, pRequest->self,
-             (pRequest->metric.planEnd - st)/1000.0, pRequest->requestId);
+             (pRequest->metric.planEnd - st) / 1000.0, pRequest->requestId);
   }
-      if (TSDB_CODE_SUCCESS == code && !pRequest->validateOnly) {
-        SArray* pNodeList = NULL;
-        buildAsyncExecNodeList(pRequest, &pNodeList, pMnodeList, pResultMeta);
+  if (TSDB_CODE_SUCCESS == code && !pRequest->validateOnly) {
+    SArray* pNodeList = NULL;
+    buildAsyncExecNodeList(pRequest, &pNodeList, pMnodeList, pResultMeta);
 
     SRequestConnInfo conn = {.pTrans = getAppInfo(pRequest)->pTransporter,
                              .requestId = pRequest->requestId,
@@ -2262,7 +2262,7 @@ void taosAsyncQueryImpl(uint64_t connId, const char* sql, __taos_async_fn_t fp,
     if (fp) {
       fp(param, NULL, terrno);
     }
-    
+
     return;
   }
 
diff --git a/source/libs/executor/src/dataDeleter.c b/source/libs/executor/src/dataDeleter.c
index 55978855d1..f4e6528b45 100644
--- a/source/libs/executor/src/dataDeleter.c
+++ b/source/libs/executor/src/dataDeleter.c
@@ -177,6 +177,7 @@ static void getDataLength(SDataSinkHandle* pHandle, int64_t* pLen, bool* pQueryE
 
   SDataDeleterBuf* pBuf = NULL;
   taosReadQitem(pDeleter->pDataBlocks, (void**)&pBuf);
+  ASSERT(NULL != pBuf);
   memcpy(&pDeleter->nextOutput, pBuf, sizeof(SDataDeleterBuf));
   taosFreeQitem(pBuf);
 
diff --git a/source/libs/nodes/src/nodesMsgFuncs.c b/source/libs/nodes/src/nodesMsgFuncs.c
index 9e89955ae5..04e6bcff43 100644
--- a/source/libs/nodes/src/nodesMsgFuncs.c
+++ b/source/libs/nodes/src/nodesMsgFuncs.c
@@ -84,13 +84,12 @@ static void endTlvEncode(STlvEncoder* pEncoder, char** pMsg, int32_t* pLen) {
   *pMsg = pEncoder->pBuf;
   pEncoder->pBuf = NULL;
   *pLen = pEncoder->offset;
-  // nodesWarn("encode tlv count = %d, tl size = %d", pEncoder->tlvCount, sizeof(STlv) * pEncoder->tlvCount);
 }
 
 static int32_t tlvEncodeImpl(STlvEncoder* pEncoder, int16_t type, const void* pValue, int32_t len) {
   int32_t tlvLen = sizeof(STlv) + len;
   if (pEncoder->offset + tlvLen > pEncoder->allocSize) {
-    pEncoder->allocSize = TMAX(pEncoder->allocSize * 2, pEncoder->allocSize + pEncoder->offset + tlvLen);
+    pEncoder->allocSize = TMAX(pEncoder->allocSize * 2, pEncoder->allocSize + tlvLen);
     void* pNewBuf = taosMemoryRealloc(pEncoder->pBuf, pEncoder->allocSize);
     if (NULL == pNewBuf) {
       return TSDB_CODE_OUT_OF_MEMORY;
@@ -241,6 +240,15 @@ static int32_t tlvEncodeObj(STlvEncoder* pEncoder, int16_t type, FToMsg func, co
     return TSDB_CODE_SUCCESS;
   }
 
+  if (pEncoder->offset + sizeof(STlv) > pEncoder->allocSize) {
+    pEncoder->allocSize = TMAX(pEncoder->allocSize * 2, pEncoder->allocSize + sizeof(STlv));
+    void* pNewBuf = taosMemoryRealloc(pEncoder->pBuf, pEncoder->allocSize);
+    if (NULL == pNewBuf) {
+      return TSDB_CODE_OUT_OF_MEMORY;
+    }
+    pEncoder->pBuf = pNewBuf;
+  }
+
   int32_t start = pEncoder->offset;
   pEncoder->offset += sizeof(STlv);
   int32_t code = func(pObj, pEncoder);
@@ -307,7 +315,7 @@ static int32_t tlvDecodeImpl(STlv* pTlv, void* pValue, int32_t len) {
 }
 
 static int32_t tlvDecodeValueImpl(STlvDecoder* pDecoder, void* pValue, int32_t len) {
-  if (pDecoder->offset + len > pDecoder->bufSize) {
+  if (len > pDecoder->bufSize - pDecoder->offset) {
     return TSDB_CODE_FAILED;
   }
   memcpy(pValue, pDecoder->pBuf + pDecoder->offset, len);
@@ -911,6 +919,10 @@ static int32_t msgToDatum(STlv* pTlv, void* pObj) {
     case TSDB_DATA_TYPE_NCHAR:
     case TSDB_DATA_TYPE_VARCHAR:
     case TSDB_DATA_TYPE_VARBINARY: {
+      if (pTlv->len > pNode->node.resType.bytes + VARSTR_HEADER_SIZE) {
+        code = TSDB_CODE_FAILED;
+        break;
+      }
       pNode->datum.p = taosMemoryCalloc(1, pNode->node.resType.bytes + VARSTR_HEADER_SIZE + 1);
       if (NULL == pNode->datum.p) {
         code = TSDB_CODE_OUT_OF_MEMORY;
diff --git a/source/libs/nodes/src/nodesUtilFuncs.c b/source/libs/nodes/src/nodesUtilFuncs.c
index bc0c4d42bb..e647438800 100644
--- a/source/libs/nodes/src/nodesUtilFuncs.c
+++ b/source/libs/nodes/src/nodesUtilFuncs.c
@@ -190,14 +190,23 @@ int32_t nodesReleaseAllocator(int64_t allocatorId) {
     return TSDB_CODE_SUCCESS;
   }
 
-  if (NULL == g_pNodeAllocator) {
+  SNodeAllocator* pAllocator = taosAcquireRef(g_allocatorReqRefPool, allocatorId);
+  if (NULL == pAllocator) {
+    return terrno;
+  }
+
+  int32_t code = taosThreadMutexTryLock(&pAllocator->mutex);
+  if (EBUSY != code) {
     nodesError("allocator id %" PRIx64
                " release failed: The nodesReleaseAllocator function needs to be called after the nodesAcquireAllocator "
                "function is called!",
                allocatorId);
+    if (0 == code) {
+      taosThreadMutexUnlock(&pAllocator->mutex);
+    }
     return TSDB_CODE_FAILED;
   }
-  SNodeAllocator* pAllocator = g_pNodeAllocator;
+
   g_pNodeAllocator = NULL;
   taosThreadMutexUnlock(&pAllocator->mutex);
   return taosReleaseRef(g_allocatorReqRefPool, allocatorId);
@@ -1826,7 +1835,7 @@ static EDealRes collectFuncs(SNode* pNode, void* pContext) {
   if (QUERY_NODE_FUNCTION == nodeType(pNode) && pCxt->classifier(((SFunctionNode*)pNode)->funcId) &&
       !(((SExprNode*)pNode)->orderAlias)) {
     SExprNode* pExpr = (SExprNode*)pNode;
-    if (NULL == taosHashGet(pCxt->pFuncsSet, &pExpr, POINTER_BYTES)) {
+    if (NULL == taosHashGet(pCxt->pFuncsSet, &pExpr, sizeof(SExprNode*))) {
       pCxt->errCode = nodesListStrictAppend(pCxt->pFuncs, nodesCloneNode(pNode));
       taosHashPut(pCxt->pFuncsSet, &pExpr, POINTER_BYTES, &pExpr, POINTER_BYTES);
     }
diff --git a/source/libs/parser/src/parInsert.c b/source/libs/parser/src/parInsert.c
index f59a6c7f9b..65cc44b1e9 100644
--- a/source/libs/parser/src/parInsert.c
+++ b/source/libs/parser/src/parInsert.c
@@ -1365,8 +1365,12 @@ static int32_t parseCsvFile(SInsertParseContext* pCxt, TdFilePtr fp, STableDataB
     strtolower(pLine, pLine);
     char* pRawSql = pCxt->pSql;
     pCxt->pSql = pLine;
-    bool gotRow = false;
-    CHECK_CODE(parseOneRow(pCxt, pDataBlock, tinfo.precision, &gotRow, tmpTokenBuf));
+    bool    gotRow = false;
+    int32_t code = parseOneRow(pCxt, pDataBlock, tinfo.precision, &gotRow, tmpTokenBuf);
+    if (TSDB_CODE_SUCCESS != code) {
+      pCxt->pSql = pRawSql;
+      return code;
+    }
     if (gotRow) {
       pDataBlock->size += extendedRowSize;  // len;
       (*numOfRows)++;
diff --git a/source/libs/parser/src/parInsertData.c b/source/libs/parser/src/parInsertData.c
index 09e40cad60..954c1b332a 100644
--- a/source/libs/parser/src/parInsertData.c
+++ b/source/libs/parser/src/parInsertData.c
@@ -222,6 +222,21 @@ int32_t buildCreateTbMsg(STableDataBlocks* pBlocks, SVCreateTbReq* pCreateTbReq)
   return code;
 }
 
+static void destroyDataBlock(STableDataBlocks* pDataBlock) {
+  if (pDataBlock == NULL) {
+    return;
+  }
+
+  taosMemoryFreeClear(pDataBlock->pData);
+  //  if (!pDataBlock->cloned) {
+  // free the refcount for metermeta
+  taosMemoryFreeClear(pDataBlock->pTableMeta);
+
+  destroyBoundColumnInfo(&pDataBlock->boundColumnInfo);
+  //  }
+  taosMemoryFreeClear(pDataBlock);
+}
+
 int32_t getDataBlockFromList(SHashObj* pHashList, void* id, int32_t idLen, int32_t size, int32_t startOffset,
                              int32_t rowSize, STableMeta* pTableMeta, STableDataBlocks** dataBlocks, SArray* pBlockList,
                              SVCreateTbReq* pCreateTbReq) {
@@ -240,11 +255,13 @@ int32_t getDataBlockFromList(SHashObj* pHashList, void* id, int32_t idLen, int32
     if (NULL != pCreateTbReq && NULL != pCreateTbReq->ctb.pTag) {
       ret = buildCreateTbMsg(*dataBlocks, pCreateTbReq);
       if (ret != TSDB_CODE_SUCCESS) {
+        destroyDataBlock(*dataBlocks);
         return ret;
       }
     }
 
-    taosHashPut(pHashList, id, idLen, dataBlocks, POINTER_BYTES);
+    // converting to 'const char*' is to handle coverity scan errors
+    taosHashPut(pHashList, (const char*)id, idLen, (const char*)dataBlocks, POINTER_BYTES);
     if (pBlockList) {
       taosArrayPush(pBlockList, dataBlocks);
     }
@@ -266,21 +283,6 @@ static int32_t getRowExpandSize(STableMeta* pTableMeta) {
   return result;
 }
 
-static void destroyDataBlock(STableDataBlocks* pDataBlock) {
-  if (pDataBlock == NULL) {
-    return;
-  }
-
-  taosMemoryFreeClear(pDataBlock->pData);
-  //  if (!pDataBlock->cloned) {
-  // free the refcount for metermeta
-  taosMemoryFreeClear(pDataBlock->pTableMeta);
-
-  destroyBoundColumnInfo(&pDataBlock->boundColumnInfo);
-  //  }
-  taosMemoryFreeClear(pDataBlock);
-}
-
 void destroyBlockArrayList(SArray* pDataBlockList) {
   if (pDataBlockList == NULL) {
     return;
diff --git a/source/libs/parser/src/parUtil.c b/source/libs/parser/src/parUtil.c
index 95eb094edb..2ce6a39fe5 100644
--- a/source/libs/parser/src/parUtil.c
+++ b/source/libs/parser/src/parUtil.c
@@ -248,8 +248,11 @@ int32_t getNumOfTags(const STableMeta* pTableMeta) { return getTableInfo(pTableM
 STableComInfo getTableInfo(const STableMeta* pTableMeta) { return pTableMeta->tableInfo; }
 
 STableMeta* tableMetaDup(const STableMeta* pTableMeta) {
-  size_t size = TABLE_META_SIZE(pTableMeta);
+  if (TABLE_TOTAL_COL_NUM(pTableMeta) > TSDB_MAX_COLUMNS || TABLE_TOTAL_COL_NUM(pTableMeta) < TSDB_MIN_COLUMNS) {
+    return NULL;
+  }
 
+  size_t      size = TABLE_META_SIZE(pTableMeta);
   STableMeta* p = taosMemoryMalloc(size);
   memcpy(p, pTableMeta, size);
   return p;
diff --git a/source/libs/qcom/src/queryUtil.c b/source/libs/qcom/src/queryUtil.c
index 618f597d72..23f177ffe2 100644
--- a/source/libs/qcom/src/queryUtil.c
+++ b/source/libs/qcom/src/queryUtil.c
@@ -423,13 +423,14 @@ int32_t cloneTableMeta(STableMeta* pSrc, STableMeta** pDst) {
     return TSDB_CODE_SUCCESS;
   }
 
-  if ((pSrc->tableInfo.numOfColumns + pSrc->tableInfo.numOfTags) > TSDB_MAX_COL_TAG_NUM) {
+  int32_t numOfField = pSrc->tableInfo.numOfColumns + pSrc->tableInfo.numOfTags;
+  if (numOfField > TSDB_MAX_COL_TAG_NUM || numOfField < TSDB_MIN_COLUMNS) {
     *pDst = NULL;
     qError("too many column and tag num:%d,%d", pSrc->tableInfo.numOfColumns, pSrc->tableInfo.numOfTags);
     return TSDB_CODE_INVALID_PARA;
   }
 
-  int32_t metaSize = sizeof(STableMeta) + (pSrc->tableInfo.numOfColumns + pSrc->tableInfo.numOfTags) * sizeof(SSchema);
+  int32_t metaSize = sizeof(STableMeta) + numOfField * sizeof(SSchema);
   *pDst = taosMemoryMalloc(metaSize);
   if (NULL == *pDst) {
     return TSDB_CODE_TSC_OUT_OF_MEMORY;