diff --git a/include/libs/wal/wal.h b/include/libs/wal/wal.h
index 999adc2eff..68f1de643d 100644
--- a/include/libs/wal/wal.h
+++ b/include/libs/wal/wal.h
@@ -36,6 +36,7 @@ extern "C" {
 #define WAL_FILE_LEN      (WAL_PATH_LEN + 32)
 #define WAL_MAGIC         0xFAFBFCFDF4F3F2F1ULL
 #define WAL_SCAN_BUF_SIZE (1024 * 1024 * 3)
+#define WAL_JSON_BUF_SIZE 30
 
 typedef enum {
   TAOS_WAL_SKIP = 0,
diff --git a/source/libs/sync/src/syncMain.c b/source/libs/sync/src/syncMain.c
index b9e2d3435f..fbde104f4e 100644
--- a/source/libs/sync/src/syncMain.c
+++ b/source/libs/sync/src/syncMain.c
@@ -692,7 +692,7 @@ int32_t syncGetArbToken(int64_t rid, char* outToken) {
 
   memset(outToken, 0, TSDB_ARB_TOKEN_SIZE);
   (void)taosThreadMutexLock(&pSyncNode->arbTokenMutex);
-  strncpy(outToken, pSyncNode->arbToken, TSDB_ARB_TOKEN_SIZE);
+  tstrncpy(outToken, pSyncNode->arbToken, TSDB_ARB_TOKEN_SIZE);
   (void)taosThreadMutexUnlock(&pSyncNode->arbTokenMutex);
 
   syncNodeRelease(pSyncNode);
diff --git a/source/libs/wal/src/walMeta.c b/source/libs/wal/src/walMeta.c
index 78f13a58ab..3faeb53499 100644
--- a/source/libs/wal/src/walMeta.c
+++ b/source/libs/wal/src/walMeta.c
@@ -39,11 +39,11 @@ int64_t FORCE_INLINE walGetCommittedVer(SWal* pWal) { return pWal->vers.commitVe
 int64_t FORCE_INLINE walGetAppliedVer(SWal* pWal) { return pWal->vers.appliedVer; }
 
 static FORCE_INLINE int walBuildMetaName(SWal* pWal, int metaVer, char* buf) {
-  return sprintf(buf, "%s/meta-ver%d", pWal->path, metaVer);
+  return snprintf(buf, WAL_FILE_LEN, "%s/meta-ver%d", pWal->path, metaVer);
 }
 
 static FORCE_INLINE int walBuildTmpMetaName(SWal* pWal, char* buf) {
-  return sprintf(buf, "%s/meta-ver.tmp", pWal->path);
+  return snprintf(buf, WAL_FILE_LEN, "%s/meta-ver.tmp", pWal->path);
 }
 
 static FORCE_INLINE int32_t walScanLogGetLastVer(SWal* pWal, int32_t fileIdx, int64_t* lastVer) {
@@ -819,7 +819,7 @@ int32_t walRollFileInfo(SWal* pWal) {
 }
 
 int32_t walMetaSerialize(SWal* pWal, char** serialized) {
-  char   buf[30];
+  char   buf[WAL_JSON_BUF_SIZE];
   int    sz = taosArrayGetSize(pWal->fileInfoSet);
   cJSON* pRoot = cJSON_CreateObject();
   cJSON* pMeta = cJSON_CreateObject();
@@ -841,19 +841,19 @@ int32_t walMetaSerialize(SWal* pWal, char** serialized) {
   if (!cJSON_AddItemToObject(pRoot, "meta", pMeta)) {
     wInfo("vgId:%d, failed to add meta to root", pWal->cfg.vgId);
   }
-  (void)sprintf(buf, "%" PRId64, pWal->vers.firstVer);
+  snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pWal->vers.firstVer);
   if (cJSON_AddStringToObject(pMeta, "firstVer", buf) == NULL) {
     wInfo("vgId:%d, failed to add firstVer to meta", pWal->cfg.vgId);
   }
-  (void)sprintf(buf, "%" PRId64, pWal->vers.snapshotVer);
+  (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pWal->vers.snapshotVer);
   if (cJSON_AddStringToObject(pMeta, "snapshotVer", buf) == NULL) {
     wInfo("vgId:%d, failed to add snapshotVer to meta", pWal->cfg.vgId);
   }
-  (void)sprintf(buf, "%" PRId64, pWal->vers.commitVer);
+  (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pWal->vers.commitVer);
   if (cJSON_AddStringToObject(pMeta, "commitVer", buf) == NULL) {
     wInfo("vgId:%d, failed to add commitVer to meta", pWal->cfg.vgId);
   }
-  (void)sprintf(buf, "%" PRId64, pWal->vers.lastVer);
+  (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pWal->vers.lastVer);
   if (cJSON_AddStringToObject(pMeta, "lastVer", buf) == NULL) {
     wInfo("vgId:%d, failed to add lastVer to meta", pWal->cfg.vgId);
   }
@@ -874,23 +874,23 @@ int32_t walMetaSerialize(SWal* pWal, char** serialized) {
     }
     // cjson only support int32_t or double
     // string are used to prohibit the loss of precision
-    (void)sprintf(buf, "%" PRId64, pInfo->firstVer);
+    (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pInfo->firstVer);
     if (cJSON_AddStringToObject(pField, "firstVer", buf) == NULL) {
       wInfo("vgId:%d, failed to add firstVer to field", pWal->cfg.vgId);
     }
-    (void)sprintf(buf, "%" PRId64, pInfo->lastVer);
+    (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pInfo->lastVer);
     if (cJSON_AddStringToObject(pField, "lastVer", buf) == NULL) {
       wInfo("vgId:%d, failed to add lastVer to field", pWal->cfg.vgId);
     }
-    (void)sprintf(buf, "%" PRId64, pInfo->createTs);
+    (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pInfo->createTs);
     if (cJSON_AddStringToObject(pField, "createTs", buf) == NULL) {
       wInfo("vgId:%d, failed to add createTs to field", pWal->cfg.vgId);
     }
-    (void)sprintf(buf, "%" PRId64, pInfo->closeTs);
+    (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pInfo->closeTs);
     if (cJSON_AddStringToObject(pField, "closeTs", buf) == NULL) {
       wInfo("vgId:%d, failed to add closeTs to field", pWal->cfg.vgId);
     }
-    (void)sprintf(buf, "%" PRId64, pInfo->fileSize);
+    (void)snprintf(buf, WAL_JSON_BUF_SIZE, "%" PRId64, pInfo->fileSize);
     if (cJSON_AddStringToObject(pField, "fileSize", buf) == NULL) {
       wInfo("vgId:%d, failed to add fileSize to field", pWal->cfg.vgId);
     }
diff --git a/source/libs/wal/src/walRead.c b/source/libs/wal/src/walRead.c
index da5e1f47e9..f62f8e1bcf 100644
--- a/source/libs/wal/src/walRead.c
+++ b/source/libs/wal/src/walRead.c
@@ -539,7 +539,7 @@ int32_t decryptBody(SWalCfg *cfg, SWalCkHead *pHead, int32_t plainBodyLen, const
     opts.source = pHead->head.body;
     opts.result = newBody;
     opts.unitLen = 16;
-    TAOS_UNUSED(strncpy((char *)opts.key, cfg->encryptKey, 16));
+    tstrncpy((char *)opts.key, cfg->encryptKey, 16);
 
     int32_t count = CBC_Decrypt(&opts);