diff --git a/Platform/user/configm/config-server/agingtime_config/agingtime.c b/Platform/user/configm/config-server/agingtime_config/agingtime.c
index 0e8a2feda..b78a0e384 100644
--- a/Platform/user/configm/config-server/agingtime_config/agingtime.c
+++ b/Platform/user/configm/config-server/agingtime_config/agingtime.c
@@ -96,10 +96,7 @@ ret_code agingtime_config_chk(uint source, uint *config_type,
                         pointer output, int *output_len)
 {
     ret_code ret = RET_OK;
-    
-    cJSON *cjson, *time, *res;
-    char * ret_char = NULL;
-    int * ret_int = NULL;
+    cJSON *cjson,*time;
     
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -114,20 +111,23 @@ ret_code agingtime_config_chk(uint source, uint *config_type,
     time = cJSON_GetObjectItem(cjson , "time"); 
     if(!time)
     {
+        cJSON_Delete(cjson);
         ret = RET_INPUTERR;
         ASSERT_RET(ret);
-        cJSON_Delete(cjson);
         return ret;
     }
 
     if(time->valueint < 0)
     {
+        cJSON_Delete(cjson);
+        free(time);
         ret = RET_ERR;
         ASSERT_RET(ret);
         return ret;
     }
 
     cJSON_Delete(cjson);
+    free(time);
 
     ASSERT_RET(ret);
     return RET_OK;  
@@ -141,10 +141,10 @@ ret_code agingtime_config_proc(uint source, uint config_type,
                         pointer output, int *output_len)
 {
     ret_code ret = RET_OK; 
-    cJSON *cjson, *time, *res;
+    cJSON *cjson, *res, *time;
     int * agingtime = NULL;
     char * ret_char = NULL;
-    int * ret_int = NULL;
+    unsigned int ret_int = 0;
 
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -159,9 +159,9 @@ ret_code agingtime_config_proc(uint source, uint config_type,
     time = cJSON_GetObjectItem(cjson , "time"); 
     if(!time)
     {
-        ret = RET_INPUTERR;
-        ASSERT_RET(ret);
         cJSON_Delete(cjson);
+        ret = RET_INPUTERR;
+        ASSERT_RET(ret);  
         return ret;
     }
     else
@@ -170,7 +170,7 @@ ret_code agingtime_config_proc(uint source, uint config_type,
         agingtime = &a;
     }
     
-    rpc_log_info("agingtime configure:  agingtime %d\n", time->valueint);
+    rpc_log_info("agingtime configure:  agingtime %d\n", *agingtime);
 
     /*用户态下发到内核态auth_hook */
     int r = -1;
@@ -181,6 +181,8 @@ ret_code agingtime_config_proc(uint source, uint config_type,
     if(r < 0)
     {
         printf(" pdlivnl_open fail, exit.\r\n");
+        cJSON_Delete(cjson);
+        free(time);
         return RET_ERR;
     }
 
@@ -189,6 +191,8 @@ ret_code agingtime_config_proc(uint source, uint config_type,
     if(r < 0)
     {
         printf("set_cfg_debug_waitack failed.\r\n");
+        cJSON_Delete(cjson);
+        free(time);
         return RET_ERR;
     }
 
@@ -210,16 +214,37 @@ ret_code agingtime_config_proc(uint source, uint config_type,
     cJSON_AddNumberToObject(res, "result", r); 
 
     /*将json对象转换成json字符串 */
-    ret_char = cJSON_PrintUnformatted(res);
-    ret_int =(int*)ret_char;
-    memcpy(output, ret_int, sizeof(ret_int)+1);
-   
+    ret_char = cJSON_PrintUnformatted(res); 
+    ret_int = strlen(ret_char);
+
+    if(output_len)
+    {
+        *output_len = ret_int;
+    }
+    
+    /*超出2k的内存，报错 */
+    if(ret_int >= 1024 * 2)
+    {
+        free(time);
+        cJSON_Delete(cjson);
+        free(ret_char);
+        cJSON_Delete(res);
+        return RET_NOMEM;
+    }
+
+    memcpy(output, 0, ret_int + 1);
+    strcpy(output, ret_char);
+
     free(ret_char);
-    cJSON_Delete(cjson);
     cJSON_Delete(res);
+    cJSON_Delete(cjson);
+    free(time);
+
 
     /*把免认证规则的配置信息存入全局变量 */
-    aging_time = agingtime;
+    *aging_time= *agingtime;
+
+    free(aging_time);
     return RET_OK;  
 }
 
diff --git a/Platform/user/configm/config-server/include/userlock.h b/Platform/user/configm/config-server/include/userlock.h
index c260afba0..a74b60911 100644
--- a/Platform/user/configm/config-server/include/userlock.h
+++ b/Platform/user/configm/config-server/include/userlock.h
@@ -28,7 +28,7 @@ typedef struct {
 
 
 /*全局变量初始化 失败为1 成功为0*/
-int Init(userlock_configure_t *userlock);
+int Init(userlock_configure_t **userlock);
 
 
 /*判断锁定配置信息是否有效，时间范围大于0，失败的次数大于0，锁定时间大于0 */
diff --git a/Platform/user/configm/config-server/jumppage_config/jumppage.c b/Platform/user/configm/config-server/jumppage_config/jumppage.c
index 896ddde14..bf6562d0a 100644
--- a/Platform/user/configm/config-server/jumppage_config/jumppage.c
+++ b/Platform/user/configm/config-server/jumppage_config/jumppage.c
@@ -19,7 +19,7 @@ ret_code jumppage_config_proc(uint source, uint config_type,
     ret_code ret = RET_OK;
     cJSON *cjson, *url, *res;
     char * ret_char = NULL;
-    char * jump_url;
+    unsigned int ret_int = 0;
     
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -41,10 +41,7 @@ ret_code jumppage_config_proc(uint source, uint config_type,
     }
 
     rpc_log_info("jumppage configure: url %s\n", url->valuestring);
-
-    jump_url = url->valuestring;
-   // jump_url = &i;
-    cJSON_Delete(cjson);
+ 
 
     /*将配置信息发送到web server 发送结果int表示，0表示发送成功，-1表示发送失败*/
     int r;
@@ -59,21 +56,45 @@ ret_code jumppage_config_proc(uint source, uint config_type,
         return ret;
     }
 
-    cJSON_AddNumberToObject(res, "result", r); 
+   cJSON_AddNumberToObject(res, "result", r); 
 
     /*将json对象转换成json字符串 */
-    ret_char = cJSON_PrintUnformatted(res);
-    memcpy(output, ret_char, sizeof(ret_char)+1);
+    ret_char = cJSON_PrintUnformatted(res); 
+    ret_int = strlen(ret_char);
 
-    //cJSON_Delete(ret_char);
+    if(output_len)
+    {
+        *output_len = ret_int;
+    }
+    
+    /*超出2k的内存，报错 */
+    if(ret_int >= 1024 * 2)
+    {
+        free(url);
+        cJSON_Delete(cjson);
+        free(ret_char);
+        cJSON_Delete(res);
+        return RET_NOMEM;
+    }
+
+    memcpy(output, 0, ret_int + 1);
+    strcpy(output, ret_char);
+
+    free(url);
+    cJSON_Delete(cjson);
     free(ret_char);
-    ret_char = NULL;
     cJSON_Delete(res);
+   
+    
+  
+ 
     return RET_OK;  
 
     /*把本地Portal server的配置信息存入全局变量 */
-    jumpurl = jump_url;
+    jumpurl = url->valuestring;
 
+
+    free(jumpurl);
     return RET_OK;
 }
 
diff --git a/Platform/user/configm/config-server/localportal_config/localportal.c b/Platform/user/configm/config-server/localportal_config/localportal.c
index 999b4b788..1eb2a661c 100644
--- a/Platform/user/configm/config-server/localportal_config/localportal.c
+++ b/Platform/user/configm/config-server/localportal_config/localportal.c
@@ -197,6 +197,7 @@ ret_code portalserver_config_proc(uint source, uint config_type,
     if(ret_int >= 1024 * 2)
     {
         free(struct_portal);
+        cJSON_Delete(cjson);
         free(ret_char);
         cJSON_Delete(res);
         return RET_NOMEM;
@@ -207,6 +208,7 @@ ret_code portalserver_config_proc(uint source, uint config_type,
 
     free(ret_char);
     cJSON_Delete(res);
+    cJSON_Delete(cjson);
 
     /*把本地Portal server的配置信息存入全局变量 */
     localportal->ip = struct_portal->ip;
diff --git a/Platform/user/configm/config-server/userlock_config/userlock.c b/Platform/user/configm/config-server/userlock_config/userlock.c
index 9bc04c907..fe36f806f 100644
--- a/Platform/user/configm/config-server/userlock_config/userlock.c
+++ b/Platform/user/configm/config-server/userlock_config/userlock.c
@@ -13,10 +13,10 @@ userlock_configure_t *userlock;
 
 
 /*全局变量初始化 失败为1 成功为0*/
-int Init(userlock_configure_t *userlock)
+int Init(userlock_configure_t **userlock)
 {
-    userlock = (userlock_configure_t *)malloc(sizeof * userlock);
-    if (NULL == userlock)
+    *userlock = (userlock_configure_t *)malloc(sizeof(userlock_configure_t));
+    if (NULL == *userlock)
     {
         return 1;
     }
@@ -32,7 +32,7 @@ ret_code userlock_config_chk(uint source, uint *config_type,
                         pointer output, int *output_len)
 {   
     ret_code ret = RET_OK;
-    cJSON *cjson, *res;
+    cJSON *cjson;
 
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -57,8 +57,10 @@ ret_code userlock_config_chk(uint source, uint *config_type,
                 struct_userlock->logintime, struct_userlock->failcount,
                 struct_userlock->timehorizon, struct_userlock->locktime);
 
-    if(*input_len < sizeof(userlock_configure_t))
+    if((*input_len < sizeof(userlock_configure_t)) || (*input_len > sizeof(userlock_configure_t)))
     {
+        free(struct_userlock);
+        cJSON_Delete(cjson);
         ret = RET_INPUTERR;
         ASSERT_RET(ret);
         return ret;
@@ -67,6 +69,8 @@ ret_code userlock_config_chk(uint source, uint *config_type,
     /*配置的用户失败次数如果小于0，则配置错误 */
     if(struct_userlock->failcount < FAIL_MIN_NUM )
     {
+        free(struct_userlock);
+        cJSON_Delete(cjson);
         ret = RET_ERR;
         ASSERT_RET(ret);
         return ret;
@@ -76,6 +80,8 @@ ret_code userlock_config_chk(uint source, uint *config_type,
     /*配置的用户锁定时间如果小于0，则配置错误 */
     if(struct_userlock->locktime < LOCK_MIN_TIME )
     {
+        free(struct_userlock);
+        cJSON_Delete(cjson);
         ret = RET_ERR;
         ASSERT_RET(ret);
         return ret;
@@ -85,6 +91,8 @@ ret_code userlock_config_chk(uint source, uint *config_type,
     /*配置的用户认证时间范围如果小于0，则配置错误 */  
     if(struct_userlock->timehorizon < HORIZON_MIN_VALUE )
     {
+        free(struct_userlock);
+        cJSON_Delete(cjson);
         ret = RET_ERR;
         ASSERT_RET(ret);
         return ret;
@@ -92,6 +100,8 @@ ret_code userlock_config_chk(uint source, uint *config_type,
     }
 
     ASSERT_RET(ret);
+    free(struct_userlock);
+    cJSON_Delete(cjson);
 
     return RET_OK;  
 } 
@@ -105,7 +115,7 @@ ret_code userlock_config_proc(uint source, uint config_type,
     ret_code ret = RET_OK;
     cJSON *cjson, *res;
     char *ret_char = NULL;
-    int *ret_int = NULL;
+    unsigned int ret_int = 0;
 
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -142,19 +152,41 @@ ret_code userlock_config_proc(uint source, uint config_type,
         return ret;
     }
 
+    
     cJSON_AddNumberToObject(res, "result", r); 
 
     /*将json对象转换成json字符串 */
-    ret_char = cJSON_PrintUnformatted(res);
-    ret_int = (int*)ret_char;
-    memcpy(output, ret_int, sizeof(ret_int)+1);
+    ret_char = cJSON_PrintUnformatted(res); 
+    ret_int = strlen(ret_char);
+
+    if(output_len)
+    {
+        *output_len = ret_int;
+    }
+    
+    /*超出2k的内存，报错 */
+    if(ret_int >= 1024 * 2)
+    {
+        free(struct_userlock);
+        cJSON_Delete(cjson);
+        free(ret_char);
+        cJSON_Delete(res);
+        return RET_NOMEM;
+    }
+
+    memcpy(output, 0, ret_int + 1);
+    strcpy(output, ret_char);
 
     free(ret_char);
     cJSON_Delete(res);
+    cJSON_Delete(cjson);
+
 
     /*把本地Portal server的配置信息存入全局变量 */
-    userlock = struct_userlock;
+    userlock->failcount = struct_userlock->failcount;
 
+    
+    free(struct_userlock);
     return RET_OK;
 }