diff --git a/deps/oblib/src/lib/string/ob_hex_utils_base.cpp b/deps/oblib/src/lib/string/ob_hex_utils_base.cpp
index e577e6192..61b5bd075 100644
--- a/deps/oblib/src/lib/string/ob_hex_utils_base.cpp
+++ b/deps/oblib/src/lib/string/ob_hex_utils_base.cpp
@@ -55,8 +55,12 @@ int ObHexUtilsBase::unhex(const ObString& text, ObIAllocator& alloc, ObObj& resu
     while (OB_SUCC(ret) && all_valid_char && i < text.length()) {
       if (isxdigit(c1) && isxdigit(c2)) {
         buf[i / 2] = (char)((get_xdigit(c1) << 4) | get_xdigit(c2));
-        c1 = text[++i];
-        c2 = text[++i];
+        if (i + 2 < text.length()) {
+          c1 = text[++i];
+          c2 = text[++i];
+        } else {
+          break;
+        }
       } else if (lib::is_oracle_mode()) {
         ret = OB_ERR_INVALID_HEX_NUMBER;
         LOG_WARN("invalid hex number", K(ret), K(c1), K(c2), K(text));
diff --git a/src/share/object/ob_obj_cast.cpp b/src/share/object/ob_obj_cast.cpp
index e2c833bad..e30df973b 100644
--- a/src/share/object/ob_obj_cast.cpp
+++ b/src/share/object/ob_obj_cast.cpp
@@ -538,8 +538,12 @@ int ObHexUtils::unhex(const ObString& text, ObCastCtx& cast_ctx, ObObj& result)
     while (OB_SUCC(ret) && i < text.length()) {
       if (isxdigit(c1) && isxdigit(c2)) {
         buf[i / 2] = (char)((get_xdigit(c1) << 4) | get_xdigit(c2));
-        c1 = text[++i];
-        c2 = text[++i];
+        if (i + 2 < text.length()) {
+          c1 = text[++i];
+          c2 = text[++i];
+        } else {
+          break;
+        }
       } else {
         ret = OB_ERR_INVALID_HEX_NUMBER;
         LOG_WARN("invalid hex number", K(ret), K(c1), K(c2), K(text));
diff --git a/src/sql/engine/expr/ob_datum_cast.cpp b/src/sql/engine/expr/ob_datum_cast.cpp
index 8583e4496..2d7e5db95 100644
--- a/src/sql/engine/expr/ob_datum_cast.cpp
+++ b/src/sql/engine/expr/ob_datum_cast.cpp
@@ -512,8 +512,12 @@ int ObDatumHexUtils::unhex(const ObExpr& expr, const ObString& in_str, ObEvalCtx
     while (OB_SUCC(ret) && i < in_str.length()) {
       if (isxdigit(c1) && isxdigit(c2)) {
         buf[i / 2] = (char)((get_xdigit(c1) << 4) | get_xdigit(c2));
-        c1 = in_str[++i];
-        c2 = in_str[++i];
+        if (i + 2 < in_str.length()) {
+          c1 = in_str[++i];
+          c2 = in_str[++i];
+        } else {
+          break;
+        }
       } else {
         ret = OB_ERR_INVALID_HEX_NUMBER;
         LOG_WARN("invalid hex number", K(ret), K(c1), K(c2), K(in_str));