diff --git a/interfaces/innerkits/appverify/src/init/json_parser_utils.cpp b/interfaces/innerkits/appverify/src/init/json_parser_utils.cpp
index 68417447bc3d74cb4f1c9d02157cf39e5d9b38c0..ed158222c19e74eeb0de8bc6d37b94e8ddeed542 100644
--- a/interfaces/innerkits/appverify/src/init/json_parser_utils.cpp
+++ b/interfaces/innerkits/appverify/src/init/json_parser_utils.cpp
@@ -26,6 +26,10 @@ namespace Verify {
 bool JsonParserUtils::ReadTrustedRootCAFromJson(cJSON** jsonObj,
     const std::string& jsonPath, std::string& error)
 {
+    if (jsonObj == NULL) {
+        error += "jsonObj is NULL";
+        return false;
+    }
     std::ifstream jsonFileStream;
     jsonFileStream.open(jsonPath.c_str(), std::ios::in);
     if (!jsonFileStream.is_open()) {
diff --git a/interfaces/innerkits/appverify/src/init/trusted_root_ca.cpp b/interfaces/innerkits/appverify/src/init/trusted_root_ca.cpp
index 8e0e62fa1e240cbbddd9a617756c32edaceb49c3..0d8b33be6c4527ef3a88dfab27d37db34a9e3636 100644
--- a/interfaces/innerkits/appverify/src/init/trusted_root_ca.cpp
+++ b/interfaces/innerkits/appverify/src/init/trusted_root_ca.cpp
@@ -112,6 +112,7 @@ bool TrustedRootCa::GetTrustedRootCAFromJson(StringCertMap& rootCertMap, const s
         if (cert == nullptr) {
             HAPVERIFY_LOG_ERROR("GetX509CertFromPemString failed, key: %{public}s value: %{public}s",
                 jsonPair.first.c_str(), jsonPair.second.c_str());
+            cJSON_Delete(trustedRootCAJson);
             return false;
         }
         rootCertMap[jsonPair.first] = cert;
@@ -119,6 +120,7 @@ bool TrustedRootCa::GetTrustedRootCAFromJson(StringCertMap& rootCertMap, const s
 
     if (rootCertMap.empty()) {
         HAPVERIFY_LOG_ERROR("no root cert");
+        cJSON_Delete(trustedRootCAJson);
         return false;
     }
     cJSON_Delete(trustedRootCAJson);
diff --git a/interfaces/innerkits/appverify/src/init/trusted_source_manager.cpp b/interfaces/innerkits/appverify/src/init/trusted_source_manager.cpp
index 5a52ebae4135142e1c95d9e098d4ebd740d5d1cb..f242f7ce6979535afb3f7ba9ba705f6dc30f6783 100644
--- a/interfaces/innerkits/appverify/src/init/trusted_source_manager.cpp
+++ b/interfaces/innerkits/appverify/src/init/trusted_source_manager.cpp
@@ -107,24 +107,29 @@ bool TrustedSourceManager::GetAppTrustedSources(SourceInfoVec& trustedAppSources
     }
     if (!JsonParserUtils::GetJsonString(trustedSourceJson, KEY_OF_APP_TRUSTED_SOURCE_VERSION, souucesVersion)) {
         HAPVERIFY_LOG_ERROR("get version failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     if (!JsonParserUtils::GetJsonString(trustedSourceJson,
         KEY_OF_APP_TRUSTED_SOURCE_RELEASETIME, souucesReleaseTime)) {
         HAPVERIFY_LOG_ERROR("get releaseTime failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     JsonObjVec trustedAppSourceJson;
     if (!JsonParserUtils::ParseJsonToObjVec(trustedSourceJson, KEY_OF_APP_TRUSTED_SOURCE, trustedAppSourceJson)) {
         HAPVERIFY_LOG_ERROR("get JsonObjVec failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     if (!ParseTrustedAppSourceJson(trustedAppSources, trustedAppSourceJson)) {
         HAPVERIFY_LOG_ERROR("parse JsonObjVec failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     if (trustedAppSources.empty()) {
         HAPVERIFY_LOG_ERROR("no app trusted source");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     cJSON_Delete(trustedSourceJson);
diff --git a/interfaces/innerkits/appverify/src/init/trusted_ticket_manager.cpp b/interfaces/innerkits/appverify/src/init/trusted_ticket_manager.cpp
index 47ea21ecebf421fdfff875f4d374866781ed31c2..3299faa655b19a0d42182c36216786628cb2291e 100644
--- a/interfaces/innerkits/appverify/src/init/trusted_ticket_manager.cpp
+++ b/interfaces/innerkits/appverify/src/init/trusted_ticket_manager.cpp
@@ -80,24 +80,29 @@ bool TrustedTicketManager::GetTicketTrustedSources(TicketSourceInfoVec& trustedT
     }
     if (!JsonParserUtils::GetJsonString(trustedSourceJson, KEY_OF_TICKET_TRUSTED_SOURCE_VERSION, sourcesVersion)) {
         HAPVERIFY_LOG_ERROR("get version failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     if (!JsonParserUtils::GetJsonString(trustedSourceJson,
         KEY_OF_TICKET_TRUSTED_SOURCE_RELEASETIME, sourcesReleaseTime)) {
         HAPVERIFY_LOG_ERROR("get releaseTime failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     JsonObjVec trustedTicketJson;
     if (!JsonParserUtils::ParseJsonToObjVec(trustedSourceJson, KEY_OF_TICKET_TRUSTED_SOURCE, trustedTicketJson)) {
         HAPVERIFY_LOG_ERROR("get JsonObjVec failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     if (!ParseTrustedTicketSourceJson(trustedTicketSources, trustedTicketJson)) {
         HAPVERIFY_LOG_ERROR("parse JsonObjVec failed");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     if (trustedTicketSources.empty()) {
         HAPVERIFY_LOG_ERROR("no ticket trusted source");
+        cJSON_Delete(trustedSourceJson);
         return false;
     }
     cJSON_Delete(trustedSourceJson);
diff --git a/interfaces/innerkits/appverify/src/provision/provision_verify.cpp b/interfaces/innerkits/appverify/src/provision/provision_verify.cpp
index a9cfbdb7c9decff550f10c5c2463540049860c1a..614a5f321e95b39c0f195ea34f20926d2e59fa0b 100644
--- a/interfaces/innerkits/appverify/src/provision/provision_verify.cpp
+++ b/interfaces/innerkits/appverify/src/provision/provision_verify.cpp
@@ -253,7 +253,7 @@ void from_json(const cJSON* obj, ProvisionInfo& out)
         if (dumpString != NULL) {
             out.appServiceCapabilities = dumpString;
         }
-        free(dumpString);
+        cJSON_free(dumpString);
     }
 }