diff --git a/interfaces/innerkits/common/include/parse_util.h b/interfaces/innerkits/common/include/parse_util.h
index be6224a900dabc9ab1cf91e9a64ca30db0f3370a..ca19528e7556b651c27bc806f53390cd580a8075 100755
--- a/interfaces/innerkits/common/include/parse_util.h
+++ b/interfaces/innerkits/common/include/parse_util.h
@@ -50,6 +50,7 @@ private:
     bool CheckRootTag(const xmlNodePtr& rootNodePtr);
     bool ParseTrustConfigInner(const xmlNodePtr& rootNodePtr, std::map<std::u16string, std::set<int32_t>>& values);
     bool ParseSaId(const xmlNodePtr& rootNode, int32_t& saId);
+    std::string GetRealPath(const std::string& profilePath) const;
     std::list<SaProfile> saProfiles_;
     std::u16string procName_;
 };
diff --git a/services/common/src/parse_util.cpp b/services/common/src/parse_util.cpp
index 884fdebc464ba625e224fb2f50f1c19c123f693c..fd1262240403aa554832908f84641018a60ebaef 100755
--- a/services/common/src/parse_util.cpp
+++ b/services/common/src/parse_util.cpp
@@ -219,12 +219,13 @@ bool ParseUtil::ParseProcess(const xmlNodePtr& rootNode, std::u16string& process
 bool ParseUtil::ParseSaProfiles(const string& profilePath)
 {
     HILOGI("xmlFile:%{private}s", profilePath.c_str());
-    if (!CheckPathExist(profilePath.c_str())) {
+    std::string realPath = GetRealPath(profilePath);
+    if (!CheckPathExist(realPath.c_str())) {
         HILOGE("bad profile path!");
         return false;
     }
     std::unique_ptr<xmlDoc, decltype(&xmlFreeDoc)> ptrDoc(
-        xmlReadFile(profilePath.c_str(), nullptr, XML_PARSE_NOBLANKS), xmlFreeDoc);
+        xmlReadFile(realPath.c_str(), nullptr, XML_PARSE_NOBLANKS), xmlFreeDoc);
 
     if (ptrDoc == nullptr) {
         HILOGE("xmlReadFile error!");
@@ -268,6 +269,17 @@ std::u16string ParseUtil::GetProcessName() const
     return procName_;
 }
 
+std::string ParseUtil::GetRealPath(const string& profilePath) const
+{
+    char path[PATH_MAX] = {'\0'};
+    if (realpath(profilePath.c_str(), path) == nullptr) {
+        HILOGE("get real path fail");
+        return "";
+    }
+    std::string realPath(path);
+    return realPath;
+}
+
 bool ParseUtil::CheckPathExist(const string& profilePath)
 {
     std::ifstream profileStream(profilePath.c_str());
@@ -278,12 +290,13 @@ bool ParseUtil::ParseTrustConfig(const string& profilePath,
     std::map<std::u16string, std::set<int32_t>>& values)
 {
     HILOGI("config path:%{private}s", profilePath.c_str());
-    if (!CheckPathExist(profilePath.c_str())) {
+    std::string realPath = GetRealPath(profilePath);
+    if (!CheckPathExist(realPath.c_str())) {
         HILOGE("bad profile path!");
         return false;
     }
     std::unique_ptr<xmlDoc, decltype(&xmlFreeDoc)> docPtr(
-        xmlReadFile(profilePath.c_str(), nullptr, XML_PARSE_NOBLANKS), xmlFreeDoc);
+        xmlReadFile(realPath.c_str(), nullptr, XML_PARSE_NOBLANKS), xmlFreeDoc);
     if (docPtr == nullptr) {
         HILOGE("ParseTrustConfig xmlReadFile error!");
         return false;
diff --git a/services/samgr/native/source/system_ability_manager_stub.cpp b/services/samgr/native/source/system_ability_manager_stub.cpp
index db9a845ae805798ae57009b4932ccbeb2c5bf50d..7eee05e6a3010f04384c06fedfea5177e06c5e5f 100755
--- a/services/samgr/native/source/system_ability_manager_stub.cpp
+++ b/services/samgr/native/source/system_ability_manager_stub.cpp
@@ -299,14 +299,14 @@ int32_t SystemAbilityManagerStub::UnmarshalingSaExtraProp(MessageParcel& data, S
 
     int32_t dumpFlags = 0;
     ret = data.ReadInt32(dumpFlags);
-    if (!ret) {
-        HILOGW("SystemAbilityManagerStub::UnmarshalingSaExtraProp read dumpFlags failed!");
+    if (!ret || dumpFlags < 0) {
+        HILOGW("SystemAbilityManagerStub::UnmarshalingSaExtraProp dumpFlags failed!");
         return ERR_FLATTEN_OBJECT;
     }
     std::u16string capability = data.ReadString16();
     std::u16string permission = data.ReadString16();
     extraProp.isDistributed = isDistributed;
-    extraProp.dumpFlags = dumpFlags;
+    extraProp.dumpFlags = static_cast<uint32_t>(dumpFlags);
     extraProp.capability = capability;
     extraProp.permission = permission;
     return ERR_OK;