[edk2] [patch v3] MdeModulePkg: Replace unsafe string functions.

[Zhang Lubo]

Version v3 including the following updates relative to original one:
Use AllocateCopyPool instead of AllcoateZeroPool to make code easier to understand.
Use macro definition instead of constant number.
Use non-n version of safe string copy function in some cases.
Change the 2nd parameter in safe function from max free buffer size to max size in some cases.
Update Copyright year.

Replace unsafe string functions with new added safe string functions.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <***@intel.com>
Reviewed-by: Fu Siyuan <***@intel.com>
Reviewed-by: Qiu Shumin <***@intel.com>
Reviewed-by: Jaben Carsey <***@intel.com>
---
MdeModulePkg/Library/DxeNetLib/DxeNetLib.c | 7 +++----
.../Universal/Network/IScsiDxe/IScsiConfig.c | 4 ++--
.../Universal/Network/IScsiDxe/IScsiDhcp.c | 4 ++--
.../Network/IScsiDxe/IScsiExtScsiPassThru.c | 4 ++--
.../Universal/Network/IScsiDxe/IScsiMisc.c | 4 ++--
.../Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c | 7 +++----
.../Universal/Network/Mtftp4Dxe/Mtftp4Support.c | 15 +++++++++------
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c | 22 +++++++++++-----------
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h | 3 ++-
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.c | 14 ++++++++------
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.h | 13 ++++++++-----
.../Network/VlanConfigDxe/VlanConfigImpl.c | 14 +++++++-------
12 files changed, 59 insertions(+), 52 deletions(-)

diff --git a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
index 467b822..a860e79 100644
--- a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
+++ b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
@@ -1,9 +1,9 @@
/** @file
Network library.

-Copyright (c) 2005 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -2621,15 +2621,14 @@ NetLibDefaultAddressIsStatic (
if (ConfigHdr == NULL) {
return TRUE;
}

Len = StrLen (ConfigHdr);
- ConfigResp = AllocateZeroPool ((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
+ ConfigResp = AllocateCopyPool((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16), ConfigHdr);
if (ConfigResp == NULL) {
goto ON_EXIT;
}
- StrCpy (ConfigResp, ConfigHdr);

String = ConfigResp + Len;
UnicodeSPrint (
String,
(8 + 4 + 7 + 4 + 1) * sizeof (CHAR16),
@@ -3385,11 +3384,11 @@ NetLibIp6ToStr (

if ((UINTN)Ptr - (UINTN)Buffer > StringSize) {
return EFI_BUFFER_TOO_SMALL;
}

- StrCpy (String, Buffer);
+ StrCpyS (String, StringSize / sizeof (CHAR16), Buffer);

return EFI_SUCCESS;
}

/**
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
index e263f0e..7b77fd3 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
@@ -1,9 +1,9 @@
/** @file
Helper functions for configuring or getting the parameters relating to iSCSI.

-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -776,11 +776,11 @@ IScsiFormCallback (
IScsiUnicodeStrToAsciiStr (IfrNvData->TargetName, IScsiName);
Status = IScsiNormalizeName (IScsiName, AsciiStrLen (IScsiName));
if (EFI_ERROR (Status)) {
CreatePopUp (EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE, &Key, L"Invalid iSCSI Name!", NULL);
} else {
- AsciiStrCpy (Private->Current->SessionConfigData.TargetName, IScsiName);
+ AsciiStrCpyS (Private->Current->SessionConfigData.TargetName, ISCSI_NAME_MAX_SIZE, IScsiName);
}

break;

case KEY_DHCP_ENABLE:
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
index 79e7093..d574ce2 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
@@ -1,9 +1,9 @@
/** @file
iSCSI DHCP related configuration routines.

-Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -156,11 +156,11 @@ IScsiDhcpExtractRootPath (
Status = IScsiNormalizeName (Field->Str, AsciiStrLen (Field->Str));
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}

- AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+ AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);

ON_EXIT:

FreePool (TmpStr);

diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
index da14105..e9e37b7 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
@@ -1,9 +1,9 @@
/** @file
The IScsi's EFI_EXT_SCSI_PASS_THRU_PROTOCOL driver.

-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -242,11 +242,11 @@ IScsiExtScsiPassThruBuildDevicePath (
break;
}

CopyMem (&Node->Iscsi.Lun, ConfigNvData->BootLun, sizeof (UINT64));
Node->Iscsi.TargetPortalGroupTag = Session->TargetPortalGroupTag;
- AsciiStrCpy ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), ConfigNvData->TargetName);
+ AsciiStrCpyS ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), AsciiStrLen (ConfigNvData->TargetName) + 1, ConfigNvData->TargetName);

*DevicePath = (EFI_DEVICE_PATH_PROTOCOL *) Node;

return EFI_SUCCESS;
}
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
index 1cb1fb8..61c407e 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
@@ -1,9 +1,9 @@
/** @file
Miscellaneous routines for iSCSI driver.

-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -202,11 +202,11 @@ IScsiLunToUnicodeStr (
TempStr = Str;

for (Index = 0; Index < 4; Index++) {

if ((Lun[2 * Index] | Lun[2 * Index + 1]) == 0) {
- StrCpy (TempStr, L"0-");
+ CopyMem(TempStr, L"0-", sizeof (L"0-"));
} else {
TempStr[0] = (CHAR16) IScsiHexString[Lun[2 * Index] >> 4];
TempStr[1] = (CHAR16) IScsiHexString[Lun[2 * Index] & 0x0F];
TempStr[2] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] >> 4];
TempStr[3] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] & 0x0F];
diff --git a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
index 89e1dda..81c9263 100644
--- a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
+++ b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
@@ -1,9 +1,9 @@
/** @file
Helper functions for configuring or getting the parameters relating to Ip4.

-Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -482,17 +482,16 @@ Ip4DeviceExtractConfig (

if (Request == NULL) {
Size = StrLen (DeviceResult);
Size = Size + 1;
Size = Size + StrLen (FormResult) + 1;
- *Results = AllocateZeroPool (Size * sizeof (CHAR16));
+ *Results = AllocateCopyPool(Size * sizeof (CHAR16), DeviceResult);
ASSERT (*Results != NULL);
StrPointer = *Results;
- StrCpy (StrPointer, DeviceResult);
StrPointer = StrPointer + StrLen (StrPointer);
*StrPointer = L'&';
- StrCpy (StrPointer + 1, FormResult);
+ StrCpyS (StrPointer + 1, StrLen (FormResult) + 1, FormResult);
FreePool (DeviceResult);
FreePool (FormResult);
} else if (HiiIsConfigHdrMatch (Request, &gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
*Results = DeviceResult;
} else if (HiiIsConfigHdrMatch (Request, &gNicIp4ConfigNvDataGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
diff --git a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
index df79c85..cfb4b26 100644
--- a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
+++ b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
@@ -1,9 +1,9 @@
/** @file
Support routines for Mtftp.

-Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php<BR>

@@ -317,21 +317,24 @@ Mtftp4SendRequest (
Packet = (EFI_MTFTP4_PACKET *) NetbufAllocSpace (Nbuf, Len, FALSE);
ASSERT (Packet != NULL);

Packet->OpCode = HTONS (Instance->Operation);
Cur = Packet->Rrq.Filename;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Token->Filename);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2, (CHAR8 *) Token->Filename);
Cur += AsciiStrLen ((CHAR8 *) Token->Filename) + 1;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Mode);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2 - (AsciiStrLen ((CHAR8 *) Token->Filename) + 1), (CHAR8 *) Mode);
Cur += AsciiStrLen ((CHAR8 *) Mode) + 1;
+ Len -= ((UINT32) AsciiStrLen ((CHAR8 *) Token->Filename) + (UINT32) AsciiStrLen ((CHAR8 *) Mode) + 4);

for (Index = 0; Index < Token->OptionCount; ++Index) {
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].OptionStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].OptionStr);
Cur += AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1);

- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].ValueStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].ValueStr);
Cur += AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1);
}

return Mtftp4SendPacket (Instance, Nbuf);
}

@@ -369,11 +372,11 @@ Mtftp4SendError (
ASSERT (TftpError != NULL);

TftpError->OpCode = HTONS (EFI_MTFTP4_OPCODE_ERROR);
TftpError->Error.ErrorCode = HTONS (ErrCode);

- AsciiStrCpy ((CHAR8 *) TftpError->Error.ErrorMessage, (CHAR8 *) ErrInfo);
+ AsciiStrCpyS ((CHAR8 *) TftpError->Error.ErrorMessage, Len, (CHAR8 *) ErrInfo);

return Mtftp4SendPacket (Instance, Packet);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
index aa73132..e0c4943 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -1,9 +1,9 @@
/** @file
PxeBc MTFTP functions.

-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -58,11 +58,11 @@ PxeBcCheckPacket (
Status = EFI_SUCCESS;

if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
+ AsciiStrCpyS (Private->Mode.TftpError.ErrorString, PXE_MTFTP_ERROR_STRING_LENGTH, (CHAR8 *) Packet->Error.ErrorMessage);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}

if (Callback != NULL) {

@@ -133,17 +133,17 @@ PxeBcTftpGetFileSize (

return Status;
}

ReqOpt[0].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
- UtoA10 (0, (CHAR8 *) OptBuf);
+ UtoA10 (0, (CHAR8 *) OptBuf, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
ReqOpt[0].ValueStr = OptBuf;

if (BlockSize != NULL) {
ReqOpt[1].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[1].ValueStr = ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
OptCnt++;
}

Status = Mtftp4->GetInfo (
Mtftp4,
@@ -158,14 +158,14 @@ PxeBcTftpGetFileSize (

if (EFI_ERROR (Status)) {
if (Status == EFI_TFTP_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (
- Private->Mode.TftpError.ErrorString,
- (CHAR8 *) Packet->Error.ErrorMessage,
- PXE_MTFTP_ERROR_STRING_LENGTH
+ AsciiStrCpyS (
+ Private->Mode.TftpError.ErrorString,
+ PXE_MTFTP_ERROR_STRING_LENGTH,
+ (CHAR8 *) Packet->Error.ErrorMessage
);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}
goto ON_ERROR;
}
@@ -259,11 +259,11 @@ PxeBcTftpReadFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -342,11 +342,11 @@ PxeBcTftpWriteFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -416,11 +416,11 @@ PxeBcTftpReadDirectory (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
index 9920aff..241b079 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
@@ -1,9 +1,9 @@
/** @file
Mtftp routines for PxeBc.

-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -20,10 +20,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define PXE_MTFTP_OPTION_TSIZE_INDEX 2
#define PXE_MTFTP_OPTION_MULTICAST_INDEX 3
#define PXE_MTFTP_OPTION_MAXIMUM_INDEX 4

#define PXE_MTFTP_ERROR_STRING_LENGTH 127
+#define PXE_MTFTP_OPTBUF_MAXNUM_INDEX 128


/**
This function is to get size of a file by Tftp.

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
index 327e4a2..3016da7 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
@@ -1,9 +1,9 @@
/** @file
Support routines for PxeBc.

-Copyright (c) 2007 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -138,20 +138,22 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
)
{
UINTN Index;
CHAR8 TempStr[64];

@@ -162,11 +164,11 @@ UtoA10 (
Index--;
TempStr[Index] = (CHAR8) ('0' + (Number % 10));
Number = Number / 10;
} while (Number != 0);

- AsciiStrCpy (Buffer, &TempStr[Index]);
+ AsciiStrCpyS (Buffer, BufferSize, &TempStr[Index]);

return AsciiStrLen (Buffer);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
index 96f48f5..6f41aa6 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
@@ -1,8 +1,8 @@
/** @file
Support routines for PxeBc.
-Copyright (c) 2007 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -80,20 +80,23 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
+
);


/**
Convert ASCII numeric string to a UINTN value.
diff --git a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
index fd8555e..5e0fe42 100644
--- a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
+++ b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
@@ -1,9 +1,9 @@
/** @file
HII Config Access protocol implementation of VLAN configuration module.

-Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions
of the BSD License which accompanies this distribution. The full
text of the license may be found at<BR>
http://opensource.org/licenses/bsd-license.php
@@ -410,21 +410,21 @@ VlanUpdateForm (

ZeroMem (PrivateData->VlanId, MAX_VLAN_NUMBER);
for (Index = 0; Index < NumberOfVlan; Index++) {
String = VlanStr;

- StrCpy (String, L" VLAN ID:");
+ StrCpyS (String, (sizeof (VlanStr) /sizeof (CHAR16)), L" VLAN ID:");
String += 10;
//
// Pad VlanId string up to 4 characters with space
//
DigitalCount = UnicodeValueToString (VlanIdStr, 0, VlanData[Index].VlanId, 5);
SetMem16 (String, (4 - DigitalCount) * sizeof (CHAR16), L' ');
- StrCpy (String + 4 - DigitalCount, VlanIdStr);
+ StrCpyS (String + 4 - DigitalCount, (sizeof (VlanStr) /sizeof (CHAR16)) - 10 - (4 - DigitalCount), VlanIdStr);
String += 4;

- StrCpy (String, L", Priority:");
+ StrCpyS (String, (sizeof (VlanStr) /sizeof (CHAR16)) - 10 - (4 - DigitalCount) - 4, L", Priority:");
String += 11;
String += UnicodeValueToString (String, 0, VlanData[Index].Priority, 4);
*String = 0;

StringId = HiiSetString (PrivateData->HiiHandle, 0, VlanStr, NULL);
@@ -557,13 +557,13 @@ InstallVlanConfigForm (
if (EFI_ERROR (Status)) {
return Status;
}
PrivateData->MacString = MacString;

- StrCpy (Str, L"VLAN Configuration (MAC:");
- StrnCat (Str, MacString, sizeof (EFI_MAC_ADDRESS) * 2);
- StrCat (Str, L")");
+ StrCpyS (Str, sizeof (Str) / sizeof (CHAR16), L"VLAN Configuration (MAC:");
+ StrCatS (Str, sizeof (Str) / sizeof (CHAR16), MacString);
+ StrCatS (Str, sizeof (Str) / sizeof (CHAR16), L")");
HiiSetString (
HiiHandle,
STRING_TOKEN (STR_VLAN_FORM_SET_TITLE_HELP),
Str,
NULL