diff --git a/Platform/user/configm/config-server/authfree_config/authfree.c b/Platform/user/configm/config-server/authfree_config/authfree.c
index 67d84572f..e983c5eeb 100644
--- a/Platform/user/configm/config-server/authfree_config/authfree.c
+++ b/Platform/user/configm/config-server/authfree_config/authfree.c
@@ -15,10 +15,10 @@
 freeauth_configure_t *localuser;
 
 /*全局变量初始化 失败为1 成功为0*/
-int authfreeInit(freeauth_configure_t *localuser)
+int authfreeInit(freeauth_configure_t **localuser)
 {
-    localuser = (freeauth_configure_t *)malloc(sizeof * localuser);
-    if (NULL == localuser)
+    *localuser = (freeauth_configure_t *)malloc(sizeof(freeauth_configure_t));
+    if (NULL == *localuser)
     {
         return 1;
     }
@@ -81,9 +81,11 @@ if (struct_freeauth == NULL)
 }else
 {   
     char str[32];
+    memset(str, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_freeauth->sip, str, 32);
     char *sip_addr = str;
     char dtr[32];
+    memset(dtr, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_freeauth->dip, dtr, 32);
     char *dip_addr = dtr;
     printf("set_freeauthcfg_waitack :name %s  sip %s  dip %s  dport %d\n",
@@ -141,7 +143,7 @@ ret_code freeauth_config_chk(uint source, uint *config_type,
                         pointer output, int *output_len)
 {   
     ret_code ret = RET_OK;
-    cJSON *cjson, *res;
+    cJSON *cjson;
 
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -163,28 +165,36 @@ ret_code freeauth_config_chk(uint source, uint *config_type,
     printf("freeauth configure: name: %s sip: %d dip: %d dport: %d\n",
                  struct_freeauth->name,struct_freeauth->sip, struct_freeauth->dip, struct_freeauth->dport);
 
-    if(*input_len < sizeof(freeauth_configure_t) )
-    {
+    if((*input_len < sizeof(freeauth_configure_t)) || (*input_len > sizeof(freeauth_configure_t)))
+    {   
+        free(struct_freeauth);
+        cJSON_Delete(cjson);
         ret = RET_INPUTERR;
         ASSERT_RET(ret);
         return ret;
     }
     
     char str[32];
+    memset(str, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_freeauth->sip, str, 32);
     char *sip_addr = str;
     if( isIpV4Addr(sip_addr) < 0 )
     {
+        free(struct_freeauth);
+        cJSON_Delete(cjson);
         ret = RET_IPINVALID;
         ASSERT_RET(ret);
         return ret;
     }
 
     char dtr[32];
+    memset(dtr, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_freeauth->dip, dtr, 32);
     char *dip_addr = dtr;
     if( isIpV4Addr(dip_addr) < 0 )
     {
+        free(struct_freeauth);
+        cJSON_Delete(cjson);
         ret = RET_IPINVALID;
         ASSERT_RET(ret);
         return ret;
@@ -192,10 +202,15 @@ ret_code freeauth_config_chk(uint source, uint *config_type,
 
     if ( (struct_freeauth->dport < DPORT_MIN_NUM) && (struct_freeauth->dport > DPORT_MAX_NUM ))
     {
+        free(struct_freeauth);
+        cJSON_Delete(cjson);
         ret = RET_IPINVALID; /*先用IPVAILD表示，后面加PORTVAILD */
         ASSERT_RET(ret);
         return ret;
     }
+    
+    free(struct_freeauth);
+    cJSON_Delete(cjson);
 
     return RET_OK;  
 }
@@ -209,7 +224,7 @@ ret_code freeauth_config_proc(uint source, uint config_type,
     ret_code ret = RET_OK;
     cJSON *cjson, *res;
     char * ret_char = NULL;
-    int * ret_int = NULL;
+    unsigned int ret_int = 0;
 
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -230,9 +245,11 @@ ret_code freeauth_config_proc(uint source, uint config_type,
     s2j_struct_get_basic_element(struct_freeauth, cjson, int, dport);
     
     char str[32];
+    memset(str, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_freeauth->sip, str, 32);
     char *sip_addr = str;
     char dtr[32];
+    memset(dtr, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_freeauth->dip, dtr, 32);
     char *dip_addr = dtr;
     rpc_log_info("freeauth configure: name %s sip %s dip %s dport %d\n",
@@ -247,6 +264,8 @@ ret_code freeauth_config_proc(uint source, uint config_type,
     if(r < 0)
     {
         printf(" pdlivnl_open fail, exit.\r\n");
+        free(struct_freeauth);
+        cJSON_Delete(cjson);
         return RET_ERR;
     }
 
@@ -255,6 +274,8 @@ ret_code freeauth_config_proc(uint source, uint config_type,
     if(r < 0)
     {
         printf("set_cfg_debug_waitack failed.\r\n");
+        free(struct_freeauth);
+        cJSON_Delete(cjson);
         return RET_ERR;
     }
 
@@ -266,6 +287,7 @@ ret_code freeauth_config_proc(uint source, uint config_type,
     res = cJSON_CreateObject();
     if(!res)
     {
+        free(struct_freeauth);
         ret = RET_ERR;
         ASSERT_RET(ret);
         return ret;
@@ -275,14 +297,35 @@ ret_code freeauth_config_proc(uint source, uint config_type,
 
     /*将json对象转换成json字符串 */
     ret_char = cJSON_PrintUnformatted(res);
-    ret_int = (int*)ret_char;
-    memcpy(output, ret_int, sizeof(ret_int)+1);
+    ret_int = strlen(ret_char);
+
+    if(output_len)
+    {
+        *output_len = ret_int;
+    }
+    
+    /*超出2k的内存，报错 */
+    if(ret_int >= 1024 * 2)
+    {
+        free(struct_freeauth);
+        free(ret_char);
+        cJSON_Delete(res);
+        return RET_NOMEM;
+    }
+
+    memcpy(output, 0, ret_int + 1);
+    strcpy(output, ret_char);
 
     free(ret_char);
     cJSON_Delete(res);
-    
+    cJSON_Delete(cjson);
+
+
     /*把免认证规则的配置信息存入全局变量 */
-    localuser = struct_freeauth;
+    localuser->sip = struct_freeauth->sip;
+
+
+    free(struct_freeauth);  
     return RET_OK;  
 }
 
diff --git a/Platform/user/configm/config-server/include/authfree.h b/Platform/user/configm/config-server/include/authfree.h
index 815373b8d..332a6e102 100644
--- a/Platform/user/configm/config-server/include/authfree.h
+++ b/Platform/user/configm/config-server/include/authfree.h
@@ -26,7 +26,7 @@ typedef struct {
 
 
 /*全局变量初始化 失败为1 成功为0*/
-int authfreeInit(freeauth_configure_t *localuser);
+int authfreeInit(freeauth_configure_t **localuser);
 
 
 /* 判断IPv4格式是否正确*/
diff --git a/Platform/user/configm/config-server/include/localportal.h b/Platform/user/configm/config-server/include/localportal.h
index d9e7f6e06..cc843e87b 100644
--- a/Platform/user/configm/config-server/include/localportal.h
+++ b/Platform/user/configm/config-server/include/localportal.h
@@ -21,7 +21,7 @@ typedef struct {
 }localportal_configure_t;
 
 /*全局变量初始化 失败为1 成功为0*/
-int localportalInit(localportal_configure_t *localportal);
+int localportalInit(localportal_configure_t **localportal);
 
 
 /*检查IP地址是否有效，端口号是否被占用 */
diff --git a/Platform/user/configm/config-server/localportal_config/localportal.c b/Platform/user/configm/config-server/localportal_config/localportal.c
index aab5c40da..999b4b788 100644
--- a/Platform/user/configm/config-server/localportal_config/localportal.c
+++ b/Platform/user/configm/config-server/localportal_config/localportal.c
@@ -11,10 +11,10 @@
 localportal_configure_t *localportal;
 
 /*全局变量初始化 失败为1 成功为0*/
-int localportalInit(localportal_configure_t *localportal)
+int localportalInit(localportal_configure_t **localportal)
 {
-    localportal = (localportal_configure_t *)malloc(sizeof * localportal);
-    if (NULL == localportal)
+    *localportal = (localportal_configure_t *)malloc(sizeof(localportal_configure_t));
+    if (NULL == *localportal)
     {
         return 1;
     }
@@ -66,13 +66,15 @@ int _valid_ipv4_port(const char *str, int port)
     }
 
   else if (ret < 0)
-    {
+    {   
         fprintf(stderr, "EAFNOSUPPORT: %s\n", strerror(local_errno));
+        close(fd);
         return -1;
     }
   else
     {
         fprintf(stderr, "\"%s\" is not a vaild IPv4 address\n", str);
+        close(fd);
         return -1;
     }
 }
@@ -90,7 +92,7 @@ ret_code portalserver_config_chk(uint source, uint *config_type,
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
     if(!cjson)
-    {
+    {  
         ret = RET_INPUTERR;
         ASSERT_RET(ret);
         return ret;
@@ -105,20 +107,30 @@ ret_code portalserver_config_chk(uint source, uint *config_type,
     rpc_log_info("localport configure: ip: %d port: %d\n",
                 struct_portal->ip,struct_portal->port);
    
-    if(*input_len < sizeof(localportal_configure_t) )
-    {
+    if((*input_len < sizeof(localportal_configure_t)) || (*input_len > sizeof(localportal_configure_t)) )
+    {   
+        cJSON_Delete(cjson);
+        free(struct_portal);
         ret = RET_INPUTERR;
+        return ret;
     }
-    
+
     char str[32];
+    memset(str, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_portal->ip, str, 32);
     char *ip_addr = str;
     if( (_valid_ipv4_port(ip_addr, struct_portal->port)) < 0 )
     {
+        cJSON_Delete(cjson);
+        free(struct_portal);
         ret = RET_ERR;
+        return ret;
     }
 
     ASSERT_RET(ret);
+    
+    cJSON_Delete(cjson);
+    free(struct_portal);
 
     return RET_OK;  
 } 
@@ -132,7 +144,7 @@ ret_code portalserver_config_proc(uint source, uint config_type,
     ret_code ret = RET_OK;
     cJSON *cjson, *res;
     char * ret_char = NULL;
-    int * ret_int = NULL;
+    unsigned int ret_int = 0;
 
     /*JSON字符串到JSON格式 */
     cjson = cJSON_Parse(input);
@@ -151,6 +163,7 @@ ret_code portalserver_config_proc(uint source, uint config_type,
     s2j_struct_get_basic_element(struct_portal, cjson, int, port);
   
     char str[32];
+    memset(str, 0, 32);
     inet_ntop(AF_INET, (void *)&struct_portal->ip, str, 32);
     char *ip_addr = str;
     rpc_log_info("portalserver configure:  ip: %s port: %d\n",
@@ -163,6 +176,7 @@ ret_code portalserver_config_proc(uint source, uint config_type,
     res = cJSON_CreateObject();
     if(!res)
     {
+        free(struct_portal);
         ret = RET_ERR;
         ASSERT_RET(ret);
         return ret;
@@ -171,16 +185,35 @@ ret_code portalserver_config_proc(uint source, uint config_type,
     cJSON_AddNumberToObject(res, "result", r); 
 
     /*将json对象转换成json字符串 */
-    ret_char = cJSON_PrintUnformatted(res);
-    ret_int = (int*)ret_char;
-    memcpy(output, ret_int, sizeof(ret_int)+1);
+    ret_char = cJSON_PrintUnformatted(res); 
+    ret_int = strlen(ret_char);
+
+    if(output_len)
+    {
+        *output_len = ret_int;
+    }
+    
+    /*超出2k的内存，报错 */
+    if(ret_int >= 1024 * 2)
+    {
+        free(struct_portal);
+        free(ret_char);
+        cJSON_Delete(res);
+        return RET_NOMEM;
+    }
+
+    memcpy(output, 0, ret_int + 1);
+    strcpy(output, ret_char);
 
     free(ret_char);
     cJSON_Delete(res);
 
     /*把本地Portal server的配置信息存入全局变量 */
-    localportal = struct_portal;
+    localportal->ip = struct_portal->ip;
+    localportal->port = struct_portal->port;
+ 
 
+    free(struct_portal);
     return RET_OK;
 }