diff --git a/source/dnode/mnode/impl/src/mndUser.c b/source/dnode/mnode/impl/src/mndUser.c
index 63390d4772..d1920e4956 100644
--- a/source/dnode/mnode/impl/src/mndUser.c
+++ b/source/dnode/mnode/impl/src/mndUser.c
@@ -1862,13 +1862,13 @@ static int32_t mndProcessCreateUserReq(SRpcMsg *pReq) {
   if (code == 0) code = TSDB_CODE_ACTION_IN_PROGRESS;
 
   char detail[1000] = {0};
-  (void)sprintf(detail, "enable:%d, superUser:%d, sysInfo:%d, password:xxx", createReq.enable, createReq.superUser,
-                createReq.sysInfo);
+  TAOS_UNUSED(snprintf(detail, sizeof(detail), "enable:%d, superUser:%d, sysInfo:%d, password:xxx", createReq.enable,
+                       createReq.superUser, createReq.sysInfo));
   char operation[15] = {0};
   if (createReq.isImport == 1) {
-    (void)strcpy(operation, "importUser");
+    tstrncpy(operation, "importUser", sizeof(operation));
   } else {
-    (void)strcpy(operation, "createUser");
+    tstrncpy(operation, "createUser", sizeof(operation));
   }
 
   auditRecord(pReq, pMnode->clusterId, operation, "", createReq.user, detail, strlen(detail));
@@ -2466,9 +2466,10 @@ static int32_t mndProcessAlterUserReq(SRpcMsg *pReq) {
 
   if (alterReq.alterType == TSDB_ALTER_USER_PASSWD) {
     char detail[1000] = {0};
-    (void)sprintf(detail, "alterType:%s, enable:%d, superUser:%d, sysInfo:%d, createdb:%d, tabName:%s, password:xxx",
-                  mndUserAuditTypeStr(alterReq.alterType), alterReq.enable, alterReq.superUser, alterReq.sysInfo,
-                  alterReq.createdb ? 1 : 0, alterReq.tabName);
+    (void)snprintf(detail, sizeof(detail),
+                   "alterType:%s, enable:%d, superUser:%d, sysInfo:%d, createdb:%d, tabName:%s, password:xxx",
+                   mndUserAuditTypeStr(alterReq.alterType), alterReq.enable, alterReq.superUser, alterReq.sysInfo,
+                   alterReq.createdb ? 1 : 0, alterReq.tabName);
     auditRecord(pReq, pMnode->clusterId, "alterUser", "", alterReq.user, detail, strlen(detail));
   } else if (alterReq.alterType == TSDB_ALTER_USER_SUPERUSER || alterReq.alterType == TSDB_ALTER_USER_ENABLE ||
              alterReq.alterType == TSDB_ALTER_USER_SYSINFO || alterReq.alterType == TSDB_ALTER_USER_CREATEDB) {
@@ -2841,8 +2842,8 @@ static int32_t mndLoopHash(SHashObj *hash, char *priType, SSDataBlock *pBlock, i
       SNode  *pAst = NULL;
       int32_t sqlLen = 0;
       size_t  bufSz = strlen(value) + 1;
-      if (bufSz < 5) bufSz = 5;
-      TAOS_MEMORY_REALLOC(*sql, bufSz + 1);
+      if (bufSz < 6) bufSz = 6;
+      TAOS_MEMORY_REALLOC(*sql, bufSz);
       if (*sql == NULL) {
         code = terrno;
         goto _exit;
@@ -2856,12 +2857,12 @@ static int32_t mndLoopHash(SHashObj *hash, char *priType, SSDataBlock *pBlock, i
       if (nodesStringToNode(value, &pAst) == 0) {
         if (nodesNodeToSQL(pAst, *sql, bufSz, &sqlLen) != 0) {
           sqlLen = 5;
-          (void)sprintf(*sql, "error");
+          (void)snprintf(*sql, bufSz, "error");
         }
         nodesDestroyNode(pAst);
       } else {
         sqlLen = 5;
-        (void)sprintf(*sql, "error");
+        (void)snprintf(*sql, bufSz, "error");
       }
 
       STR_WITH_MAXSIZE_TO_VARSTR((*condition), (*sql), pShow->pMeta->pSchemas[cols].bytes);
diff --git a/source/dnode/vnode/src/sma/smaRollup.c b/source/dnode/vnode/src/sma/smaRollup.c
index 5a515b1440..7d83dbcf84 100644
--- a/source/dnode/vnode/src/sma/smaRollup.c
+++ b/source/dnode/vnode/src/sma/smaRollup.c
@@ -308,7 +308,7 @@ static int32_t tdSetRSmaInfoItemParams(SSma *pSma, SRSmaParam *param, SRSmaStat
     if (!pStreamTask->exec.qmsg) {
       TAOS_RETURN(terrno);
     }
-    (void)sprintf(pStreamTask->exec.qmsg, "%s", RSMA_EXEC_TASK_FLAG);
+    TAOS_UNUSED(snprintf(pStreamTask->exec.qmsg, strlen(RSMA_EXEC_TASK_FLAG) + 1, "%s", RSMA_EXEC_TASK_FLAG));
     pStreamTask->chkInfo.checkpointId = streamMetaGetLatestCheckpointId(pStreamTask->pMeta);
     tdRSmaTaskInit(pStreamTask->pMeta, pItem, &pStreamTask->id);
 
diff --git a/source/libs/tfs/src/tfs.c b/source/libs/tfs/src/tfs.c
index 51fda85f0a..2f175d0688 100644
--- a/source/libs/tfs/src/tfs.c
+++ b/source/libs/tfs/src/tfs.c
@@ -200,10 +200,8 @@ bool tfsIsSameFile(const STfsFile *pFile1, const STfsFile *pFile2) {
   if (pFile1->did.level != pFile2->did.level) return false;
   if (pFile1->did.id != pFile2->did.id) return false;
   char nameBuf1[TMPNAME_LEN], nameBuf2[TMPNAME_LEN];
-  (void)strncpy(nameBuf1, pFile1->rname, TMPNAME_LEN);
-  (void)strncpy(nameBuf2, pFile2->rname, TMPNAME_LEN);
-  nameBuf1[TMPNAME_LEN - 1] = 0;
-  nameBuf2[TMPNAME_LEN - 1] = 0;
+  tstrncpy(nameBuf1, pFile1->rname, TMPNAME_LEN);
+  tstrncpy(nameBuf2, pFile2->rname, TMPNAME_LEN);
   TAOS_UNUSED(taosRealPath(nameBuf1, NULL, TMPNAME_LEN));
   TAOS_UNUSED(taosRealPath(nameBuf2, NULL, TMPNAME_LEN));
   if (strncmp(nameBuf1, nameBuf2, TMPNAME_LEN) != 0) return false;
@@ -573,7 +571,7 @@ static int32_t tfsCheckAndFormatCfg(STfs *pTfs, SDiskCfg *pCfg) {
     TAOS_RETURN(TSDB_CODE_FS_INVLD_CFG);
   }
 
-  strncpy(pCfg->dir, dirName, TSDB_FILENAME_LEN);
+  tstrncpy(pCfg->dir, dirName, TSDB_FILENAME_LEN);
 
   TAOS_RETURN(0);
 }
@@ -592,7 +590,16 @@ static int32_t tfsFormatDir(char *idir, char *odir) {
     wordfree(&wep);
     TAOS_RETURN(code);
   }
-  strcpy(odir, tmp);
+
+  int32_t dirLen = strlen(tmp);
+  if (dirLen >= TSDB_FILENAME_LEN) {
+    wordfree(&wep);
+    code = TSDB_CODE_OUT_OF_RANGE;
+    fError("failed to mount %s to FS since %s, real path:%s", idir, tstrerror(code), tmp);
+    TAOS_RETURN(code);
+  }
+
+  tstrncpy(odir, tmp, TSDB_FILENAME_LEN);
 
   wordfree(&wep);
   TAOS_RETURN(0);
diff --git a/source/util/src/tlog.c b/source/util/src/tlog.c
index 7a5852f329..665bf41f32 100644
--- a/source/util/src/tlog.c
+++ b/source/util/src/tlog.c
@@ -398,12 +398,12 @@ typedef struct {
 } OldFileKeeper;
 static OldFileKeeper *taosOpenNewFile() {
   char keepName[PATH_MAX + 20];
-  sprintf(keepName, "%s.%d", tsLogObj.logName, tsLogObj.flag);
+  TAOS_UNUSED(snprintf(keepName, sizeof(keepName), "%s.%d", tsLogObj.logName, tsLogObj.flag));
 
   tsLogObj.flag ^= 1;
   tsLogObj.lines = 0;
   char name[PATH_MAX + 20];
-  sprintf(name, "%s.%d", tsLogObj.logName, tsLogObj.flag);
+  TAOS_UNUSED(snprintf(name, sizeof(name), "%s.%d", tsLogObj.logName, tsLogObj.flag));
 
   TAOS_UNUSED(taosUmaskFile(0));
 
@@ -439,9 +439,9 @@ static OldFileKeeper *taosOpenNewFile() {
 
 static void *taosThreadToCloseOldFile(void *param) {
   if (!param) return NULL;
-  taosWLockLatch(&tsLogRotateLatch);
   OldFileKeeper *oldFileKeeper = (OldFileKeeper *)param;
   taosSsleep(20);
+  taosWLockLatch(&tsLogRotateLatch);
   taosCloseLogByFd(oldFileKeeper->pOldFile);
   taosKeepOldLog(oldFileKeeper->keepName);
   taosMemoryFree(oldFileKeeper);
@@ -578,22 +578,22 @@ static void decideLogFileName(const char *fn, int32_t maxFileNum) {
   }
 
   if (strlen(fn) < PATH_MAX) {
-    strcpy(tsLogObj.logName, fn);
+    tstrncpy(tsLogObj.logName, fn, PATH_MAX);
   }
 }
 
 static void decideLogFileNameFlag() {
-  char    name[PATH_MAX + 50] = "\0";
+  char    name[PATH_MAX] = "\0";
   int64_t logstat0_mtime = 0;
   int64_t logstat1_mtime = 0;
   bool    log0Exist = false;
   bool    log1Exist = false;
 
-  if (strlen(tsLogObj.logName) < PATH_MAX + 50 - 2) {
-    strcpy(name, tsLogObj.logName);
-    strcat(name, ".0");
+  int32_t logNameLen = strlen(tsLogObj.logName) + 2;
+  if (logNameLen < PATH_MAX) {
+    TAOS_UNUSED(snprintf(name, PATH_MAX, "%s%s", tsLogObj.logName, ".0"));
     log0Exist = taosStatFile(name, NULL, &logstat0_mtime, NULL) == 0;
-    name[strlen(name) - 1] = '1';
+    name[logNameLen - 1] = '1';
     log1Exist = taosStatFile(name, NULL, &logstat1_mtime, NULL) == 0;
   }
 
@@ -628,7 +628,7 @@ static int32_t taosInitNormalLog(const char *logName, int32_t maxFileNum) {
   processLogFileName(logName, maxFileNum);
 
   char name[PATH_MAX + 50] = "\0";
-  (void)sprintf(name, "%s.%d", tsLogObj.logName, tsLogObj.flag);
+  (void)snprintf(name, sizeof(name), "%s.%d", tsLogObj.logName, tsLogObj.flag);
   (void)taosThreadMutexInit(&tsLogObj.logMutex, NULL);
 
   TAOS_UNUSED(taosUmaskFile(0));
@@ -657,19 +657,19 @@ static int32_t taosInitNormalLog(const char *logName, int32_t maxFileNum) {
     return terrno;
   }
 
-  (void)sprintf(name, "==================================================\n");
+  (void)snprintf(name, sizeof(name), "==================================================\n");
   if (taosWriteFile(tsLogObj.logHandle->pFile, name, (uint32_t)strlen(name)) <= 0) {
     TAOS_UNUSED(printf("failed to write to log file:%s, reason:%s\n", name, tstrerror(terrno)));
     taosUnLockLogFile(tsLogObj.logHandle->pFile);
     return terrno;
   }
-  (void)sprintf(name, "                new log file                      \n");
+  (void)snprintf(name, sizeof(name), "                new log file                      \n");
   if (taosWriteFile(tsLogObj.logHandle->pFile, name, (uint32_t)strlen(name)) <= 0) {
     TAOS_UNUSED(printf("failed to write to log file:%s, reason:%s\n", name, tstrerror(terrno)));
     taosUnLockLogFile(tsLogObj.logHandle->pFile);
     return terrno;
   }
-  (void)sprintf(name, "==================================================\n");
+  (void)snprintf(name, sizeof(name), "==================================================\n");
   if (taosWriteFile(tsLogObj.logHandle->pFile, name, (uint32_t)strlen(name)) <= 0) {
     TAOS_UNUSED(printf("failed to write to log file:%s, reason:%s\n", name, tstrerror(terrno)));
     taosUnLockLogFile(tsLogObj.logHandle->pFile);
@@ -706,13 +706,13 @@ static inline int32_t taosBuildLogHead(char *buffer, const char *flags) {
   TAOS_UNUSED(taosGetTimeOfDay(&timeSecs));
   time_t curTime = timeSecs.tv_sec;
   ptm = taosLocalTime(&curTime, &Tm, NULL, 0, NULL);
-  if (ptm == NULL){
-    uError("%s failed to get local time, code:%d", __FUNCTION__ , errno);
+  if (ptm == NULL) {
+    uError("%s failed to get local time, code:%d", __FUNCTION__, errno);
     return 0;
   }
-  return sprintf(buffer, "%02d/%02d %02d:%02d:%02d.%06d %08" PRId64 " %s %s", ptm->tm_mon + 1, ptm->tm_mday,
-                 ptm->tm_hour, ptm->tm_min, ptm->tm_sec, (int32_t)timeSecs.tv_usec, taosGetSelfPthreadId(),
-                 LOG_EDITION_FLG, flags);
+  return snprintf(buffer, LOG_MAX_STACK_LINE_BUFFER_SIZE, "%02d/%02d %02d:%02d:%02d.%06d %08" PRId64 " %s %s",
+                  ptm->tm_mon + 1, ptm->tm_mday, ptm->tm_hour, ptm->tm_min, ptm->tm_sec, (int32_t)timeSecs.tv_usec,
+                  taosGetSelfPthreadId(), LOG_EDITION_FLG, flags);
 }
 
 static inline void taosPrintLogImp(ELogLevel level, int32_t dflag, const char *buffer, int32_t len) {
@@ -871,6 +871,7 @@ void taosPrintSlowLog(const char *format, ...) {
   taosMemoryFree(buffer);
 }
 
+#if 0
 void taosDumpData(unsigned char *msg, int32_t len) {
   if (!osLogSpaceAvailable()) return;
   taosUpdateLogNums(DEBUG_DUMP);
@@ -894,6 +895,7 @@ void taosDumpData(unsigned char *msg, int32_t len) {
 
   TAOS_UNUSED(taosWriteFile(tsLogObj.logHandle->pFile, temp, (uint32_t)pos));
 }
+#endif
 
 static void taosCloseLogByFd(TdFilePtr pFile) {
   if (pFile != NULL) {