diff --git a/include/common/tmsg.h b/include/common/tmsg.h
index a090f6925c..23e3f3ba29 100644
--- a/include/common/tmsg.h
+++ b/include/common/tmsg.h
@@ -349,15 +349,15 @@ typedef struct {
   int64_t maxStorage;   // In unit of GB
 } SCreateAcctReq, SAlterAcctReq;
 
-int32_t tSerializeSCreateAcctReq(void** buf, SCreateAcctReq* pReq);
-void*   tDeserializeSCreateAcctReq(void* buf, SCreateAcctReq* pReq);
+int32_t tSerializeSCreateAcctReq(void* buf, int32_t bufLen, SCreateAcctReq* pReq);
+int32_t tDeserializeSCreateAcctReq(void* buf, int32_t bufLen, SCreateAcctReq* pReq);
 
 typedef struct {
   char user[TSDB_USER_LEN];
 } SDropUserReq, SDropAcctReq;
 
-int32_t tSerializeSDropUserReq(void** buf, SDropUserReq* pReq);
-void*   tDeserializeSDropUserReq(void* buf, SDropUserReq* pReq);
+int32_t tSerializeSDropUserReq(void* buf, int32_t bufLen, SDropUserReq* pReq);
+int32_t tDeserializeSDropUserReq(void* buf, int32_t bufLen, SDropUserReq* pReq);
 
 typedef struct {
   int8_t createType;
@@ -366,8 +366,8 @@ typedef struct {
   char   pass[TSDB_PASSWORD_LEN];
 } SCreateUserReq;
 
-int32_t tSerializeSCreateUserReq(void** buf, SCreateUserReq* pReq);
-void*   tDeserializeSCreateUserReq(void* buf, SCreateUserReq* pReq);
+int32_t tSerializeSCreateUserReq(void* buf, int32_t bufLen, SCreateUserReq* pReq);
+int32_t tDeserializeSCreateUserReq(void* buf, int32_t bufLen, SCreateUserReq* pReq);
 
 typedef struct {
   int8_t alterType;
@@ -377,15 +377,15 @@ typedef struct {
   char   dbname[TSDB_DB_FNAME_LEN];
 } SAlterUserReq;
 
-int32_t tSerializeSAlterUserReq(void** buf, SAlterUserReq* pReq);
-void*   tDeserializeSAlterUserReq(void* buf, SAlterUserReq* pReq);
+int32_t tSerializeSAlterUserReq(void* buf, int32_t bufLen, SAlterUserReq* pReq);
+int32_t tDeserializeSAlterUserReq(void* buf, int32_t bufLen, SAlterUserReq* pReq);
 
 typedef struct {
   char user[TSDB_USER_LEN];
 } SGetUserAuthReq;
 
-int32_t tSerializeSGetUserAuthReq(void** buf, SGetUserAuthReq* pReq);
-void*   tDeserializeSGetUserAuthReq(void* buf, SGetUserAuthReq* pReq);
+int32_t tSerializeSGetUserAuthReq(void* buf, int32_t bufLen, SGetUserAuthReq* pReq);
+int32_t tDeserializeSGetUserAuthReq(void* buf, int32_t bufLen, SGetUserAuthReq* pReq);
 
 typedef struct {
   char      user[TSDB_USER_LEN];
@@ -394,8 +394,8 @@ typedef struct {
   SHashObj* writeDbs;
 } SGetUserAuthRsp;
 
-int32_t tSerializeSGetUserAuthRsp(void** buf, SGetUserAuthRsp* pReq);
-void*   tDeserializeSGetUserAuthRsp(void* buf, SGetUserAuthRsp* pReq);
+int32_t tSerializeSGetUserAuthRsp(void* buf, int32_t bufLen, SGetUserAuthRsp* pReq);
+int32_t tDeserializeSGetUserAuthRsp(void* buf, int32_t bufLen, SGetUserAuthRsp* pReq);
 
 typedef struct {
   int16_t colId;     // column id
diff --git a/source/common/src/tmsg.c b/source/common/src/tmsg.c
index 33add3eb6b..b710d494ff 100644
--- a/source/common/src/tmsg.c
+++ b/source/common/src/tmsg.c
@@ -600,142 +600,226 @@ void *tDeserializeSStatusRsp(void *buf, SStatusRsp *pRsp) {
   return buf;
 }
 
-int32_t tSerializeSCreateAcctReq(void **buf, SCreateAcctReq *pReq) {
-  int32_t tlen = 0;
-  tlen += taosEncodeString(buf, pReq->user);
-  tlen += taosEncodeString(buf, pReq->pass);
-  tlen += taosEncodeFixedI32(buf, pReq->maxUsers);
-  tlen += taosEncodeFixedI32(buf, pReq->maxDbs);
-  tlen += taosEncodeFixedI32(buf, pReq->maxTimeSeries);
-  tlen += taosEncodeFixedI32(buf, pReq->maxStreams);
-  tlen += taosEncodeFixedI32(buf, pReq->accessState);
-  tlen += taosEncodeFixedI64(buf, pReq->maxStorage);
+int32_t tSerializeSCreateAcctReq(void *buf, int32_t bufLen, SCreateAcctReq *pReq) {
+  SCoder encoder = {0};
+  tCoderInit(&encoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_ENCODER);
+
+  if (tStartEncode(&encoder) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->user) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->pass) < 0) return -1;
+  if (tEncodeI32(&encoder, pReq->maxUsers) < 0) return -1;
+  if (tEncodeI32(&encoder, pReq->maxDbs) < 0) return -1;
+  if (tEncodeI32(&encoder, pReq->maxTimeSeries) < 0) return -1;
+  if (tEncodeI32(&encoder, pReq->maxStreams) < 0) return -1;
+  if (tEncodeI32(&encoder, pReq->accessState) < 0) return -1;
+  if (tEncodeI64(&encoder, pReq->maxStorage) < 0) return -1;
+  tEndEncode(&encoder);
+
+  int32_t tlen = encoder.pos;
+  tCoderClear(&encoder);
   return tlen;
 }
 
-void *tDeserializeSCreateAcctReq(void *buf, SCreateAcctReq *pReq) {
-  buf = taosDecodeStringTo(buf, pReq->user);
-  buf = taosDecodeStringTo(buf, pReq->pass);
-  buf = taosDecodeFixedI32(buf, &pReq->maxUsers);
-  buf = taosDecodeFixedI32(buf, &pReq->maxDbs);
-  buf = taosDecodeFixedI32(buf, &pReq->maxTimeSeries);
-  buf = taosDecodeFixedI32(buf, &pReq->maxStreams);
-  buf = taosDecodeFixedI32(buf, &pReq->accessState);
-  buf = taosDecodeFixedI64(buf, &pReq->maxStorage);
-  return buf;
+int32_t tDeserializeSCreateAcctReq(void *buf, int32_t bufLen, SCreateAcctReq *pReq) {
+  SCoder decoder = {0};
+  tCoderInit(&decoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_DECODER);
+
+  if (tStartDecode(&decoder) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->user) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->pass) < 0) return -1;
+  if (tDecodeI32(&decoder, &pReq->maxUsers) < 0) return -1;
+  if (tDecodeI32(&decoder, &pReq->maxDbs) < 0) return -1;
+  if (tDecodeI32(&decoder, &pReq->maxTimeSeries) < 0) return -1;
+  if (tDecodeI32(&decoder, &pReq->maxStreams) < 0) return -1;
+  if (tDecodeI32(&decoder, &pReq->accessState) < 0) return -1;
+  if (tDecodeI64(&decoder, &pReq->maxStorage) < 0) return -1;
+  tEndDecode(&decoder);
+
+  tCoderClear(&decoder);
+  return 0;
 }
 
-int32_t tSerializeSDropUserReq(void **buf, SDropUserReq *pReq) {
-  int32_t tlen = 0;
-  tlen += taosEncodeString(buf, pReq->user);
+int32_t tSerializeSDropUserReq(void *buf, int32_t bufLen, SDropUserReq *pReq) {
+  SCoder encoder = {0};
+  tCoderInit(&encoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_ENCODER);
+
+  if (tStartEncode(&encoder) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->user) < 0) return -1;
+  tEndEncode(&encoder);
+
+  int32_t tlen = encoder.pos;
+  tCoderClear(&encoder);
   return tlen;
 }
 
-void *tDeserializeSDropUserReq(void *buf, SDropUserReq *pReq) {
-  buf = taosDecodeStringTo(buf, pReq->user);
-  return buf;
+int32_t tDeserializeSDropUserReq(void *buf, int32_t bufLen, SDropUserReq *pReq) {
+  SCoder decoder = {0};
+  tCoderInit(&decoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_DECODER);
+
+  if (tStartDecode(&decoder) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->user) < 0) return -1;
+  tEndDecode(&decoder);
+
+  tCoderClear(&decoder);
+  return 0;
 }
 
-int32_t tSerializeSCreateUserReq(void **buf, SCreateUserReq *pReq) {
-  int32_t tlen = 0;
-  tlen += taosEncodeFixedI8(buf, pReq->createType);
-  tlen += taosEncodeFixedI8(buf, pReq->superUser);
-  tlen += taosEncodeString(buf, pReq->user);
-  tlen += taosEncodeString(buf, pReq->pass);
+int32_t tSerializeSCreateUserReq(void *buf, int32_t bufLen, SCreateUserReq *pReq) {
+  SCoder encoder = {0};
+  tCoderInit(&encoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_ENCODER);
+
+  if (tStartEncode(&encoder) < 0) return -1;
+  if (tEncodeI8(&encoder, pReq->createType) < 0) return -1;
+  if (tEncodeI8(&encoder, pReq->superUser) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->user) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->pass) < 0) return -1;
+  tEndEncode(&encoder);
+
+  int32_t tlen = encoder.pos;
+  tCoderClear(&encoder);
   return tlen;
 }
 
-void *tDeserializeSCreateUserReq(void *buf, SCreateUserReq *pReq) {
-  buf = taosDecodeFixedI8(buf, &pReq->createType);
-  buf = taosDecodeFixedI8(buf, &pReq->superUser);
-  buf = taosDecodeStringTo(buf, pReq->user);
-  buf = taosDecodeStringTo(buf, pReq->pass);
-  return buf;
+int32_t tDeserializeSCreateUserReq(void *buf, int32_t bufLen, SCreateUserReq *pReq) {
+  SCoder decoder = {0};
+  tCoderInit(&decoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_DECODER);
+
+  if (tStartDecode(&decoder) < 0) return -1;
+  if (tDecodeI8(&decoder, &pReq->createType) < 0) return -1;
+  if (tDecodeI8(&decoder, &pReq->superUser) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->user) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->pass) < 0) return -1;
+  tEndDecode(&decoder);
+
+  tCoderClear(&decoder);
+  return 0;
 }
 
-int32_t tSerializeSAlterUserReq(void **buf, SAlterUserReq *pReq) {
-  int32_t tlen = 0;
-  tlen += taosEncodeFixedI8(buf, pReq->alterType);
-  tlen += taosEncodeString(buf, pReq->user);
-  tlen += taosEncodeString(buf, pReq->pass);
-  tlen += taosEncodeString(buf, pReq->dbname);
-  tlen += taosEncodeFixedI8(buf, pReq->superUser);
+int32_t tSerializeSAlterUserReq(void *buf, int32_t bufLen, SAlterUserReq *pReq) {
+  SCoder encoder = {0};
+  tCoderInit(&encoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_ENCODER);
+
+  if (tStartEncode(&encoder) < 0) return -1;
+  if (tEncodeI8(&encoder, pReq->alterType) < 0) return -1;
+  if (tEncodeI8(&encoder, pReq->superUser) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->user) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->pass) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->dbname) < 0) return -1;
+  tEndEncode(&encoder);
+
+  int32_t tlen = encoder.pos;
+  tCoderClear(&encoder);
   return tlen;
 }
 
-void *tDeserializeSAlterUserReq(void *buf, SAlterUserReq *pReq) {
-  buf = taosDecodeFixedI8(buf, &pReq->alterType);
-  buf = taosDecodeStringTo(buf, pReq->user);
-  buf = taosDecodeStringTo(buf, pReq->pass);
-  buf = taosDecodeStringTo(buf, pReq->dbname);
-  buf = taosDecodeFixedI8(buf, &pReq->superUser);
-  return buf;
+int32_t tDeserializeSAlterUserReq(void *buf, int32_t bufLen, SAlterUserReq *pReq) {
+  SCoder decoder = {0};
+  tCoderInit(&decoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_DECODER);
+
+  if (tStartDecode(&decoder) < 0) return -1;
+  if (tDecodeI8(&decoder, &pReq->alterType) < 0) return -1;
+  if (tDecodeI8(&decoder, &pReq->superUser) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->user) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->pass) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->dbname) < 0) return -1;
+  tEndDecode(&decoder);
+
+  tCoderClear(&decoder);
+  return 0;
 }
 
-int32_t tSerializeSGetUserAuthReq(void **buf, SGetUserAuthReq *pReq) {
-  int32_t tlen = 0;
-  tlen += taosEncodeString(buf, pReq->user);
+int32_t tSerializeSGetUserAuthReq(void *buf, int32_t bufLen, SGetUserAuthReq *pReq) {
+  SCoder encoder = {0};
+  tCoderInit(&encoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_ENCODER);
+
+  if (tStartEncode(&encoder) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->user) < 0) return -1;
+  tEndEncode(&encoder);
+
+  int32_t tlen = encoder.pos;
+  tCoderClear(&encoder);
   return tlen;
 }
 
-void *tDeserializeSGetUserAuthReq(void *buf, SGetUserAuthReq *pReq) {
-  buf = taosDecodeStringTo(buf, pReq->user);
-  return buf;
+int32_t tDeserializeSGetUserAuthReq(void *buf, int32_t bufLen, SGetUserAuthReq *pReq) {
+  SCoder decoder = {0};
+  tCoderInit(&decoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_DECODER);
+
+  if (tStartDecode(&decoder) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->user) < 0) return -1;
+  tEndDecode(&decoder);
+
+  tCoderClear(&decoder);
+  return 0;
 }
 
-int32_t tSerializeSGetUserAuthRsp(void **buf, SGetUserAuthRsp *pReq) {
-  int32_t tlen = 0;
-  tlen += taosEncodeString(buf, pReq->user);
-  tlen += taosEncodeFixedI8(buf, pReq->superAuth);
+int32_t tSerializeSGetUserAuthRsp(void *buf, int32_t bufLen, SGetUserAuthRsp *pReq) {
+  SCoder encoder = {0};
+  tCoderInit(&encoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_ENCODER);
+
+  if (tStartEncode(&encoder) < 0) return -1;
+  if (tEncodeCStr(&encoder, pReq->user) < 0) return -1;
+  if (tEncodeI8(&encoder, pReq->superAuth) < 0) return -1;
 
   int32_t numOfReadDbs = taosHashGetSize(pReq->readDbs);
   int32_t numOfWriteDbs = taosHashGetSize(pReq->writeDbs);
-  tlen += taosEncodeFixedI32(buf, numOfReadDbs);
-  tlen += taosEncodeFixedI32(buf, numOfWriteDbs);
+  if (tEncodeI32(&encoder, numOfReadDbs) < 0) return -1;
+  if (tEncodeI32(&encoder, numOfWriteDbs) < 0) return -1;
 
   char *db = taosHashIterate(pReq->readDbs, NULL);
   while (db != NULL) {
-    tlen += taosEncodeString(buf, db);
+    if (tEncodeCStr(&encoder, db) < 0) return -1;
     db = taosHashIterate(pReq->readDbs, db);
   }
 
   db = taosHashIterate(pReq->writeDbs, NULL);
   while (db != NULL) {
-    tlen += taosEncodeString(buf, db);
+    if (tEncodeCStr(&encoder, db) < 0) return -1;
     db = taosHashIterate(pReq->writeDbs, db);
   }
 
+  tEndEncode(&encoder);
+
+  int32_t tlen = encoder.pos;
+  tCoderClear(&encoder);
   return tlen;
 }
 
-void *tDeserializeSGetUserAuthRsp(void *buf, SGetUserAuthRsp *pReq) {
-  buf = taosDecodeStringTo(buf, pReq->user);
-  buf = taosDecodeFixedI8(buf, &pReq->superAuth);
-
+int32_t tDeserializeSGetUserAuthRsp(void *buf, int32_t bufLen, SGetUserAuthRsp *pReq) {
   pReq->readDbs = taosHashInit(4, taosGetDefaultHashFunction(TSDB_DATA_TYPE_BINARY), true, false);
   pReq->writeDbs = taosHashInit(4, taosGetDefaultHashFunction(TSDB_DATA_TYPE_BINARY), true, false);
   if (pReq->readDbs == NULL || pReq->writeDbs == NULL) {
-    return NULL;
+    return -1;
   }
 
+  SCoder decoder = {0};
+  tCoderInit(&decoder, TD_LITTLE_ENDIAN, buf, bufLen, TD_DECODER);
+
+  if (tStartDecode(&decoder) < 0) return -1;
+  if (tDecodeCStrTo(&decoder, pReq->user) < 0) return -1;
+  if (tDecodeI8(&decoder, &pReq->superAuth) < 0) return -1;
+
   int32_t numOfReadDbs = 0;
   int32_t numOfWriteDbs = 0;
-  buf = taosDecodeFixedI32(buf, &numOfReadDbs);
-  buf = taosDecodeFixedI32(buf, &numOfWriteDbs);
+  if (tDecodeI32(&decoder, &numOfReadDbs) < 0) return -1;
+  if (tDecodeI32(&decoder, &numOfWriteDbs) < 0) return -1;
 
   for (int32_t i = 0; i < numOfReadDbs; ++i) {
     char db[TSDB_DB_FNAME_LEN] = {0};
-    buf = taosDecodeStringTo(buf, db);
+    if (tDecodeCStrTo(&decoder, db) < 0) return -1;
     int32_t len = strlen(db) + 1;
     taosHashPut(pReq->readDbs, db, len, db, len);
   }
 
   for (int32_t i = 0; i < numOfWriteDbs; ++i) {
     char db[TSDB_DB_FNAME_LEN] = {0};
-    buf = taosDecodeStringTo(buf, db);
+    if (tDecodeCStrTo(&decoder, db) < 0) return -1;
     int32_t len = strlen(db) + 1;
     taosHashPut(pReq->writeDbs, db, len, db, len);
   }
 
-  return buf;
+  tEndDecode(&decoder);
+
+  tCoderClear(&decoder);
+  return 0;
 }
diff --git a/source/dnode/mnode/impl/src/mndUser.c b/source/dnode/mnode/impl/src/mndUser.c
index b54200f114..5c290c9c4f 100644
--- a/source/dnode/mnode/impl/src/mndUser.c
+++ b/source/dnode/mnode/impl/src/mndUser.c
@@ -302,7 +302,7 @@ static int32_t mndProcessCreateUserReq(SMnodeMsg *pReq) {
   SUserObj      *pOperUser = NULL;
   SCreateUserReq createReq = {0};
 
-  if (tDeserializeSCreateUserReq(pReq->rpcMsg.pCont, &createReq) == NULL) goto CREATE_USER_OVER;
+  if (tDeserializeSCreateUserReq(pReq->rpcMsg.pCont, pReq->rpcMsg.contLen, &createReq) != 0) goto CREATE_USER_OVER;
 
   mDebug("user:%s, start to create", createReq.user);
 
@@ -402,7 +402,7 @@ static int32_t mndProcessAlterUserReq(SMnodeMsg *pReq) {
   SUserObj      newUser = {0};
   SAlterUserReq alterReq = {0};
 
-  if (tDeserializeSAlterUserReq(pReq->rpcMsg.pCont, &alterReq) == NULL) goto ALTER_USER_OVER;
+  if (tDeserializeSAlterUserReq(pReq->rpcMsg.pCont, pReq->rpcMsg.contLen, &alterReq) != 0) goto ALTER_USER_OVER;
 
   mDebug("user:%s, start to alter", alterReq.user);
 
@@ -537,7 +537,7 @@ static int32_t mndProcessDropUserReq(SMnodeMsg *pReq) {
   SUserObj    *pOperUser = NULL;
   SDropUserReq dropReq = {0};
 
-  if (tDeserializeSDropUserReq(pReq->rpcMsg.pCont, &dropReq) == NULL) goto DROP_USER_OVER;
+  if (tDeserializeSDropUserReq(pReq->rpcMsg.pCont, pReq->rpcMsg.contLen, &dropReq) != 0) goto DROP_USER_OVER;
 
   mDebug("user:%s, start to drop", dropReq.user);
 
@@ -583,7 +583,7 @@ static int32_t mndProcessGetUserAuthReq(SMnodeMsg *pReq) {
   SGetUserAuthReq authReq = {0};
   SGetUserAuthRsp authRsp = {0};
 
-  if (tDeserializeSGetUserAuthReq(pReq->rpcMsg.pCont, &authReq) == NULL) goto GET_AUTH_OVER;
+  if (tDeserializeSGetUserAuthReq(pReq->rpcMsg.pCont, pReq->rpcMsg.contLen, &authReq) != 0) goto GET_AUTH_OVER;
 
   mTrace("user:%s, start to get auth", authReq.user);
 
@@ -614,15 +614,14 @@ static int32_t mndProcessGetUserAuthReq(SMnodeMsg *pReq) {
     sdbRelease(pSdb, pDb);
   }
 
-  int32_t contLen = tSerializeSGetUserAuthRsp(NULL, &authRsp);
+  int32_t contLen = tSerializeSGetUserAuthRsp(NULL, 0, &authRsp);
   void   *pRsp = rpcMallocCont(contLen);
   if (pRsp == NULL) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     goto GET_AUTH_OVER;
   }
 
-  void *pBuf = pRsp;
-  tSerializeSGetUserAuthRsp(&pBuf, &authRsp);
+  tSerializeSGetUserAuthRsp(pRsp, contLen, &authRsp);
 
   pReq->pCont = pRsp;
   pReq->contLen = contLen;
diff --git a/source/dnode/mnode/impl/test/trans/trans.cpp b/source/dnode/mnode/impl/test/trans/trans.cpp
index 0c9f560fce..68d780a391 100644
--- a/source/dnode/mnode/impl/test/trans/trans.cpp
+++ b/source/dnode/mnode/impl/test/trans/trans.cpp
@@ -67,10 +67,9 @@ TEST_F(MndTestTrans, 01_Create_User_Crash) {
     strcpy(createReq.user, "u1");
     strcpy(createReq.pass, "p1");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
diff --git a/source/dnode/mnode/impl/test/user/user.cpp b/source/dnode/mnode/impl/test/user/user.cpp
index 5d8c958f15..8f9edfab09 100644
--- a/source/dnode/mnode/impl/test/user/user.cpp
+++ b/source/dnode/mnode/impl/test/user/user.cpp
@@ -49,10 +49,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     strcpy(createReq.user, "");
     strcpy(createReq.pass, "p1");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -64,10 +63,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     strcpy(createReq.user, "u1");
     strcpy(createReq.pass, "");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -79,10 +77,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     strcpy(createReq.user, "root");
     strcpy(createReq.pass, "1");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -94,10 +91,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     strcpy(createReq.user, "u1");
     strcpy(createReq.pass, "p1");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -121,10 +117,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "u1");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -141,10 +136,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     strcpy(createReq.pass, "p1");
     createReq.superUser = 1;
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -168,10 +162,9 @@ TEST_F(MndTestUser, 02_Create_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "u2");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -190,10 +183,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(createReq.pass, "p1");
     createReq.superUser = 1;
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -210,10 +202,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.user, "");
     strcpy(alterReq.pass, "p1");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -226,10 +217,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.user, "u3");
     strcpy(alterReq.pass, "");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -242,10 +232,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.user, "u4");
     strcpy(alterReq.pass, "1");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -258,10 +247,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.user, "u3");
     strcpy(alterReq.pass, "1");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -275,10 +263,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.pass, "1");
     alterReq.superUser = 1;
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -291,10 +278,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.user, "u3");
     strcpy(alterReq.pass, "1");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -307,10 +293,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.user, "u3");
     strcpy(alterReq.pass, "1");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -324,10 +309,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.pass, "1");
     strcpy(alterReq.dbname, "d1");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -371,10 +355,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.pass, "1");
     strcpy(alterReq.dbname, "1.d2");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -388,10 +371,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.pass, "1");
     strcpy(alterReq.dbname, "1.d2");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -401,17 +383,16 @@ TEST_F(MndTestUser, 03_Alter_User) {
   {
     SGetUserAuthReq authReq = {0};
     strcpy(authReq.user, "u3");
-    int32_t contLen = tSerializeSGetUserAuthReq(NULL, &authReq);
+    int32_t contLen = tSerializeSGetUserAuthReq(NULL, 0, &authReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSGetUserAuthReq(&pBuf, &authReq);
+    tSerializeSGetUserAuthReq(pReq, contLen, &authReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_GET_USER_AUTH, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
     ASSERT_EQ(pRsp->code, 0);
 
     SGetUserAuthRsp authRsp = {0};
-    tDeserializeSGetUserAuthRsp(pRsp->pCont, &authRsp);
+    tDeserializeSGetUserAuthRsp(pRsp->pCont, pRsp->contLen, &authRsp);
     EXPECT_STREQ(authRsp.user, "u3");
     EXPECT_EQ(authRsp.superAuth, 1);
     int32_t numOfReadDbs = taosHashGetSize(authRsp.readDbs);
@@ -433,10 +414,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     strcpy(alterReq.pass, "1");
     strcpy(alterReq.dbname, "1.d2");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -447,10 +427,9 @@ TEST_F(MndTestUser, 03_Alter_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "u3");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -467,10 +446,9 @@ TEST_F(MndTestUser, 05_Drop_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -481,10 +459,9 @@ TEST_F(MndTestUser, 05_Drop_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "u4");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -496,10 +473,9 @@ TEST_F(MndTestUser, 05_Drop_User) {
     strcpy(createReq.user, "u1");
     strcpy(createReq.pass, "p1");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -510,10 +486,9 @@ TEST_F(MndTestUser, 05_Drop_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "u1");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -533,10 +508,9 @@ TEST_F(MndTestUser, 06_Create_Drop_Alter_User) {
     strcpy(createReq.user, "u1");
     strcpy(createReq.pass, "p1");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -548,10 +522,9 @@ TEST_F(MndTestUser, 06_Create_Drop_Alter_User) {
     strcpy(createReq.user, "u2");
     strcpy(createReq.pass, "p2");
 
-    int32_t contLen = tSerializeSCreateUserReq(NULL, &createReq);
+    int32_t contLen = tSerializeSCreateUserReq(NULL, 0, &createReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSCreateUserReq(&pBuf, &createReq);
+    tSerializeSCreateUserReq(pReq, contLen, &createReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_CREATE_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -583,10 +556,9 @@ TEST_F(MndTestUser, 06_Create_Drop_Alter_User) {
     strcpy(alterReq.user, "u1");
     strcpy(alterReq.pass, "p2");
 
-    int32_t contLen = tSerializeSAlterUserReq(NULL, &alterReq);
+    int32_t contLen = tSerializeSAlterUserReq(NULL, 0, &alterReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSAlterUserReq(&pBuf, &alterReq);
+    tSerializeSAlterUserReq(pReq, contLen, &alterReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_ALTER_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
@@ -616,10 +588,9 @@ TEST_F(MndTestUser, 06_Create_Drop_Alter_User) {
     SDropUserReq dropReq = {0};
     strcpy(dropReq.user, "u1");
 
-    int32_t contLen = tSerializeSDropUserReq(NULL, &dropReq);
+    int32_t contLen = tSerializeSDropUserReq(NULL, 0, &dropReq);
     void*   pReq = rpcMallocCont(contLen);
-    void*   pBuf = pReq;
-    tSerializeSDropUserReq(&pBuf, &dropReq);
+    tSerializeSDropUserReq(pReq, contLen, &dropReq);
 
     SRpcMsg* pRsp = test.SendReq(TDMT_MND_DROP_USER, pReq, contLen);
     ASSERT_NE(pRsp, nullptr);
diff --git a/source/libs/parser/src/astToMsg.c b/source/libs/parser/src/astToMsg.c
index 15ad283438..2c9e9df505 100644
--- a/source/libs/parser/src/astToMsg.c
+++ b/source/libs/parser/src/astToMsg.c
@@ -16,15 +16,14 @@ char* buildUserManipulationMsg(SSqlInfo* pInfo, int32_t* outputLen, int64_t id,
     strncpy(createReq.pass, pUser->passwd.z, pUser->passwd.n);
   }
 
-  int32_t tlen = tSerializeSCreateUserReq(NULL, &createReq);
+  int32_t tlen = tSerializeSCreateUserReq(NULL, 0, &createReq);
   void*   pReq = malloc(tlen);
   if (pReq == NULL) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     return NULL;
   }
 
-  void* pBuf = pReq;
-  tSerializeSCreateUserReq(&pBuf, &createReq);
+  tSerializeSCreateUserReq(pReq, tlen, &createReq);
   *outputLen = tlen;
   return pReq;
 }
@@ -63,15 +62,14 @@ char* buildAcctManipulationMsg(SSqlInfo* pInfo, int32_t* outputLen, int64_t id,
     }
   }
 
-  int32_t tlen = tSerializeSCreateAcctReq(NULL, &createReq);
+  int32_t tlen = tSerializeSCreateAcctReq(NULL, 0, &createReq);
   void*   pReq = malloc(tlen);
   if (pReq == NULL) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     return NULL;
   }
 
-  void* pBuf = pReq;
-  tSerializeSCreateAcctReq(&pBuf, &createReq);
+  tSerializeSCreateAcctReq(pReq, tlen, &createReq);
   *outputLen = tlen;
   return pReq;
 }
@@ -86,15 +84,14 @@ char* buildDropUserMsg(SSqlInfo* pInfo, int32_t* msgLen, int64_t id, char* msgBu
 
   strncpy(dropReq.user, pName->z, pName->n);
 
-  int32_t tlen = tSerializeSDropUserReq(NULL, &dropReq);
+  int32_t tlen = tSerializeSDropUserReq(NULL, 0, &dropReq);
   void*   pReq = malloc(tlen);
   if (pReq == NULL) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
     return NULL;
   }
 
-  void* pBuf = pReq;
-  tSerializeSDropUserReq(&pBuf, &dropReq);
+  tSerializeSDropUserReq(pReq, tlen, &dropReq);
   *msgLen = tlen;
   return pReq;
 }