diff --git a/mpp/hal/rkenc/common/vepu541_common.c b/mpp/hal/rkenc/common/vepu541_common.c
index d4c2be12..21fa6966 100644
--- a/mpp/hal/rkenc/common/vepu541_common.c
+++ b/mpp/hal/rkenc/common/vepu541_common.c
@@ -484,6 +484,13 @@ MPP_RET vepu541_set_osd(Vepu541OsdCfg *cfg)
     if (NULL == osd || osd->num_region == 0 || NULL == osd->buf)
         return MPP_OK;
 
+    if (osd->num_region > 8) {
+        mpp_err_f("do NOT support more than 8 regions invalid num %d\n",
+                  osd->num_region);
+        mpp_assert(osd->num_region <= 8);
+        return MPP_NOK;
+    }
+
     MppBuffer buf = osd->buf;
     RK_S32 fd = mpp_buffer_get_fd(buf);
     if (fd < 0) {
diff --git a/mpp/hal/worker/inc/mpp_device_patch.h b/mpp/hal/worker/inc/mpp_device_patch.h
index 2901973c..3029dd17 100644
--- a/mpp/hal/worker/inc/mpp_device_patch.h
+++ b/mpp/hal/worker/inc/mpp_device_patch.h
@@ -19,6 +19,8 @@
 #include "rk_type.h"
 #include "mpp_err.h"
 
+#define MPX_PATCH_NUM       16
+
 typedef struct RegPatchSlotInfo_t {
     RK_U32          reg_idx;
     RK_U32          offset;
@@ -27,7 +29,7 @@ typedef struct RegPatchSlotInfo_t {
 typedef struct RegExtraInfo_t {
     RK_U32          magic;      // Fix magic value 0x4C4A46
     RK_U32          count;      // valid patch info count
-    RegPatchInfo    patchs[5];
+    RegPatchInfo    patchs[MPX_PATCH_NUM];
 } RegExtraInfo;
 
 #ifdef __cplusplus
diff --git a/mpp/hal/worker/mpp_device/mpp_device.c b/mpp/hal/worker/mpp_device/mpp_device.c
index 7a0cbda2..42c9c30d 100644
--- a/mpp/hal/worker/mpp_device/mpp_device.c
+++ b/mpp/hal/worker/mpp_device/mpp_device.c
@@ -678,6 +678,13 @@ void mpp_device_patch_add(RK_U32 *reg, RegExtraInfo *extra, RK_U32 reg_idx, RK_U
         return ;
     }
 
+    if (extra->count >= MPX_PATCH_NUM) {
+        mpp_err_f("too much %d patch count larger than %d\n",
+                  extra->count, MPX_PATCH_NUM);
+
+        return ;
+    }
+
     RegPatchInfo *info = &extra->patchs[extra->count++];
     info->reg_idx = reg_idx;
     info->offset = offset;
diff --git a/mpp/legacy/vpu.c b/mpp/legacy/vpu.c
index 308ced83..1bcbfad6 100644
--- a/mpp/legacy/vpu.c
+++ b/mpp/legacy/vpu.c
@@ -68,6 +68,8 @@ typedef struct mppReqV1_t {
     RK_U64 data_ptr;
 } MppReqV1;
 
+#define MPX_PATCH_NUM       16
+
 typedef struct RegPatchSlotInfo_t {
     RK_U32          reg_idx;
     RK_U32          offset;
@@ -76,7 +78,7 @@ typedef struct RegPatchSlotInfo_t {
 typedef struct RegExtraInfo_t {
     RK_U32          magic;      // Fix magic value 0x4C4A46
     RK_U32          count;      // valid patch info count
-    RegPatchInfo    patchs[5];
+    RegPatchInfo    patchs[MPX_PATCH_NUM];
 } RegExtraInfo;
 
 static RK_U32 vpu_debug = 0;