NetworkPkg/IpSecDxe: Fix issue to parse SA Payload.

[mirror_edk2.git] / NetworkPkg / IpSecDxe / Ikev2 / Utility.c

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Utility.c b/NetworkPkg/IpSecDxe/Ikev2/Utility.c
index f12766f3cbdadad5d1be988286555392c377e978..162bbb27ee3817434a120e744acd11dec7cde35a 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Utility.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Utility.c
@@ -1,7 +1,8 @@
 /** @file\r
   The Common operations used by IKE Exchange Process.\r
 \r
 /** @file\r
   The Common operations used by IKE Exchange Process.\r
 \r

-  Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>\r
+  (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>\r
+  Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>\r

 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r


@@ -20,7 +21,7 @@
 \r
 UINT16 mIkev2EncryptAlgorithmList[IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM] = {\r
   IKEV2_TRANSFORM_ID_ENCR_3DES,\r
 \r
 UINT16 mIkev2EncryptAlgorithmList[IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM] = {\r
   IKEV2_TRANSFORM_ID_ENCR_3DES,\r

-  IKEV2_TRANSFORM_ID_ENCR_AES_CBC, \r
+  IKEV2_TRANSFORM_ID_ENCR_AES_CBC,\r

 };\r
 \r
 UINT16 mIkev2PrfAlgorithmList[IKEV2_SUPPORT_PRF_ALGORITHM_NUM] = {\r
 };\r
 \r
 UINT16 mIkev2PrfAlgorithmList[IKEV2_SUPPORT_PRF_ALGORITHM_NUM] = {\r


@@ -56,7 +57,9 @@ Ikev2SaSessionAlloc (
   IKEV2_SA_SESSION      *IkeSaSession;\r
 \r
   IkeSaSession = AllocateZeroPool (sizeof (IKEV2_SA_SESSION));\r
   IKEV2_SA_SESSION      *IkeSaSession;\r
 \r
   IkeSaSession = AllocateZeroPool (sizeof (IKEV2_SA_SESSION));\r

-  ASSERT (IkeSaSession != NULL);\r
+  if (IkeSaSession == NULL) {\r
+    return NULL;\r
+  }\r

 \r
   //\r
   // Initialize the fields of IkeSaSession and its SessionCommon.\r
 \r
   //\r
   // Initialize the fields of IkeSaSession and its SessionCommon.\r


@@ -66,7 +69,7 @@ Ikev2SaSessionAlloc (
   IkeSaSession->InitiatorCookie      = IkeGenerateCookie ();\r
   IkeSaSession->ResponderCookie      = 0;\r
   //\r
   IkeSaSession->InitiatorCookie      = IkeGenerateCookie ();\r
   IkeSaSession->ResponderCookie      = 0;\r
   //\r

-  // BUGBUG: Message ID starts from 2 is to match the OpenSwan requirement, but it \r
+  // BUGBUG: Message ID starts from 2 is to match the OpenSwan requirement, but it\r

   // might not match the IPv6 Logo. In its test specification, it mentions that\r
   // the Message ID should start from zero after the IKE_SA_INIT exchange.\r
   //\r
   // might not match the IPv6 Logo. In its test specification, it mentions that\r
   // the Message ID should start from zero after the IKE_SA_INIT exchange.\r
   //\r


@@ -140,7 +143,7 @@ Ikev2SaSessionReg (
 \r
   //\r
   // Cleanup the fields of SessionCommon for processing.\r
 \r
   //\r
   // Cleanup the fields of SessionCommon for processing.\r

-  // \r
+  //\r

   Ikev2SessionCommonRefresh (SessionCommon);\r
 \r
   //\r
   Ikev2SessionCommonRefresh (SessionCommon);\r
 \r
   //\r


@@ -160,8 +163,8 @@ Ikev2SaSessionReg (
                   );\r
   if (EFI_ERROR(Status)){\r
     //\r
                   );\r
   if (EFI_ERROR(Status)){\r
     //\r

-    // If TimerEvent creation failed, the SA will be alive untill user disable it or \r
-    // receiving a Delete Payload from peer. \r
+    // If TimerEvent creation failed, the SA will be alive untill user disable it or\r
+    // receiving a Delete Payload from peer.\r

     //\r
     return;\r
   }\r
     //\r
     return;\r
   }\r


@@ -174,7 +177,7 @@ Ikev2SaSessionReg (
   } else {\r
     Lifetime = IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;\r
   }\r
   } else {\r
     Lifetime = IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;\r
   }\r

-  \r
+\r

   Status = gBS->SetTimer (\r
                   SessionCommon->TimeoutEvent,\r
                   TimerRelative,\r
   Status = gBS->SetTimer (\r
                   SessionCommon->TimeoutEvent,\r
                   TimerRelative,\r


@@ -182,8 +185,8 @@ Ikev2SaSessionReg (
                   );\r
   if (EFI_ERROR(Status)){\r
     //\r
                   );\r
   if (EFI_ERROR(Status)){\r
     //\r

-    // If SetTimer failed, the SA will be alive untill user disable it or \r
-    // receiving a Delete Payload from peer. \r
+    // If SetTimer failed, the SA will be alive untill user disable it or\r
+    // receiving a Delete Payload from peer.\r

     //\r
     return ;\r
   }\r
     //\r
     return ;\r
   }\r


@@ -236,8 +239,8 @@ Ikev2SaSessionLookup (
   Private->Ikev2SaSession list or Private->Ikev2EstablishedList list.\r
 \r
   @param[in]  SaSessionList   Pointer to list to be inserted into.\r
   Private->Ikev2SaSession list or Private->Ikev2EstablishedList list.\r
 \r
   @param[in]  SaSessionList   Pointer to list to be inserted into.\r

-  @param[in]  IkeSaSession    Pointer to IKEV2_SA_SESSION to be inserted. \r
-  @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESSS to indicate the \r
+  @param[in]  IkeSaSession    Pointer to IKEV2_SA_SESSION to be inserted.\r
+  @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESSS to indicate the\r

                               unique IKEV2_SA_SESSION.\r
 \r
 **/\r
                               unique IKEV2_SA_SESSION.\r
 \r
 **/\r


@@ -258,7 +261,7 @@ Ikev2SaSessionInsert (
   @param[in]  SaSessionList   Pointer to list to be searched.\r
   @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESS to use for SA Session search.\r
 \r
   @param[in]  SaSessionList   Pointer to list to be searched.\r
   @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESS to use for SA Session search.\r
 \r

-  @retval Pointer to IKEV2_SA_SESSION with the specified remote IP address or NULL. \r
+  @retval Pointer to IKEV2_SA_SESSION with the specified remote IP address or NULL.\r

 \r
 **/\r
 IKEV2_SA_SESSION *\r
 \r
 **/\r
 IKEV2_SA_SESSION *\r


@@ -287,24 +290,9 @@ Ikev2SaSessionRemove (
   return NULL;\r
 }\r
 \r
   return NULL;\r
 }\r
 \r

-/**\r
-  Marking a SA session as on deleting.\r
-\r
-  @param[in]  IkeSaSession  Pointer to IKEV2_SA_SESSION.\r
-\r
-  @retval     EFI_SUCCESS   Find the related SA session and marked it.\r
-\r
-**/\r
-EFI_STATUS\r
-Ikev2SaSessionOnDeleting (\r
-  IN IKEV2_SA_SESSION          *IkeSaSession\r
-  )\r
-{\r
-  return EFI_SUCCESS;\r
-}\r

 \r
 /**\r
 \r
 /**\r

-  Free specified Seession Common. The session common would belong to a IKE SA or \r
+  Free specified Seession Common. The session common would belong to a IKE SA or\r

   a Child SA.\r
 \r
   @param[in]   SessionCommon   Pointer to a Session Common.\r
   a Child SA.\r
 \r
   @param[in]   SessionCommon   Pointer to a Session Common.\r


@@ -355,7 +343,7 @@ Ikev2SessionCommonRefresh (
   return ;\r
 }\r
 /**\r
   return ;\r
 }\r
 /**\r

-  Free specified IKEV2 SA Session. \r
+  Free specified IKEV2 SA Session.\r

 \r
   @param[in]    IkeSaSession   Pointer to IKEV2_SA_SESSION to be freed.\r
 \r
 \r
   @param[in]    IkeSaSession   Pointer to IKEV2_SA_SESSION to be freed.\r
 \r


@@ -371,7 +359,7 @@ Ikev2SaSessionFree (
   IKEV2_DH_BUFFER         *DhBuffer;\r
 \r
   ASSERT (IkeSaSession != NULL);\r
   IKEV2_DH_BUFFER         *DhBuffer;\r
 \r
   ASSERT (IkeSaSession != NULL);\r

-  \r
+\r

   //\r
   // Delete Common Session\r
   //\r
   //\r
   // Delete Common Session\r
   //\r


@@ -416,7 +404,7 @@ Ikev2SaSessionFree (
 \r
     //\r
     // Delete Keys\r
 \r
     //\r
     // Delete Keys\r

-    //    \r
+    //\r

     if (IkeKeys->SkAiKey != NULL) {\r
       FreePool (IkeKeys->SkAiKey);\r
     }\r
     if (IkeKeys->SkAiKey != NULL) {\r
       FreePool (IkeKeys->SkAiKey);\r
     }\r


@@ -492,9 +480,9 @@ Ikev2SaSessionIncreaseMessageId (
 \r
 /**\r
   Allocate memory for IKEV2 Child SA Session.\r
 \r
 /**\r
   Allocate memory for IKEV2 Child SA Session.\r

-  \r
+\r

   @param[in]   UdpService     Pointer to IKE_UDP_SERVICE.\r
   @param[in]   UdpService     Pointer to IKE_UDP_SERVICE.\r

-  @param[in]   IkeSaSession   Pointer to IKEV2_SA_SESSION related to this Child SA \r
+  @param[in]   IkeSaSession   Pointer to IKEV2_SA_SESSION related to this Child SA\r

                               Session.\r
 \r
   @retval  Pointer of a new created IKEV2 Child SA Session or NULL.\r
                               Session.\r
 \r
   @retval  Pointer of a new created IKEV2 Child SA Session or NULL.\r


@@ -522,7 +510,16 @@ Ikev2ChildSaSessionAlloc (
   ChildSaSession->Signature          = IKEV2_CHILD_SA_SESSION_SIGNATURE;\r
   ChildSaSession->IkeSaSession       = IkeSaSession;\r
   ChildSaSession->MessageId          = IkeSaSession->MessageId;\r
   ChildSaSession->Signature          = IKEV2_CHILD_SA_SESSION_SIGNATURE;\r
   ChildSaSession->IkeSaSession       = IkeSaSession;\r
   ChildSaSession->MessageId          = IkeSaSession->MessageId;\r

-  ChildSaSession->LocalPeerSpi       = IkeGenerateSpi ();\r
+\r
+  //\r
+  // Generate an new SPI.\r
+  //\r
+  Status = IkeGenerateSpi (IkeSaSession, &(ChildSaSession->LocalPeerSpi));\r
+  if (EFI_ERROR (Status)) {\r
+    FreePool (ChildSaSession);\r
+    return NULL;\r
+  }\r
+\r

   ChildSaCommon                      = &ChildSaSession->SessionCommon;\r
   ChildSaCommon->UdpService          = UdpService;\r
   ChildSaCommon->Private             = IkeSaSession->SessionCommon.Private;\r
   ChildSaCommon                      = &ChildSaSession->SessionCommon;\r
   ChildSaCommon->UdpService          = UdpService;\r
   ChildSaCommon->Private             = IkeSaSession->SessionCommon.Private;\r


@@ -554,8 +551,8 @@ Ikev2ChildSaSessionAlloc (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Register a established IKEv2 Child SA into IkeSaSession->ChildSaEstablishSessionList. \r
-  If the there is IKEV2_CHILD_SA_SESSION with same remote peer IP, remove the old one \r
+  Register a established IKEv2 Child SA into IkeSaSession->ChildSaEstablishSessionList.\r
+  If the there is IKEV2_CHILD_SA_SESSION with same remote peer IP, remove the old one\r

   then register the new one.\r
 \r
   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION to be registered.\r
   then register the new one.\r
 \r
   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION to be registered.\r


@@ -571,7 +568,6 @@ Ikev2ChildSaSessionReg (
   IKEV2_SESSION_COMMON         *SessionCommon;\r
   IKEV2_CHILD_SA_SESSION       *OldChildSaSession;\r
   IKEV2_SA_SESSION             *IkeSaSession;\r
   IKEV2_SESSION_COMMON         *SessionCommon;\r
   IKEV2_CHILD_SA_SESSION       *OldChildSaSession;\r
   IKEV2_SA_SESSION             *IkeSaSession;\r

-  IKEV2_SA_PARAMS              *SaParams;\r

   EFI_STATUS                   Status;\r
   UINT64                       Lifetime;\r
 \r
   EFI_STATUS                   Status;\r
   UINT64                       Lifetime;\r
 \r


@@ -599,9 +595,9 @@ Ikev2ChildSaSessionReg (
 \r
   //\r
   // Cleanup the fields of SessionCommon for processing.\r
 \r
   //\r
   // Cleanup the fields of SessionCommon for processing.\r

-  // \r
+  //\r

   Ikev2SessionCommonRefresh (SessionCommon);\r
   Ikev2SessionCommonRefresh (SessionCommon);\r

- \r
+\r

   //\r
   // Insert the ready child SA session into established list.\r
   //\r
   //\r
   // Insert the ready child SA session into established list.\r
   //\r


@@ -624,7 +620,6 @@ Ikev2ChildSaSessionReg (
   //\r
   // Start to count the lifetime of the IKE SA.\r
   //\r
   //\r
   // Start to count the lifetime of the IKE SA.\r
   //\r

-  SaParams = SessionCommon->SaParams;\r

   if (ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime != 0){\r
     Lifetime = ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;\r
   } else {\r
   if (ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime != 0){\r
     Lifetime = ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;\r
   } else {\r


@@ -649,40 +644,13 @@ Ikev2ChildSaSessionReg (
   return ;\r
 }\r
 \r
   return ;\r
 }\r
 \r

-/**\r
-  Find the ChildSaSession by it's MessagId.\r
-\r
-  @param[in] SaSessionList  Pointer to a ChildSaSession List.\r
-  @param[in] Mid            The messageId used to search ChildSaSession.\r
-\r
-  @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.\r
-\r
-**/\r
-IKEV2_CHILD_SA_SESSION *\r
-Ikev2ChildSaSessionLookupByMid (\r
-  IN LIST_ENTRY           *SaSessionList,\r
-  IN UINT32               Mid\r
-  )\r
-{\r
-  LIST_ENTRY              *Entry;\r
-  IKEV2_CHILD_SA_SESSION  *ChildSaSession;\r
-\r
-  NET_LIST_FOR_EACH (Entry, SaSessionList) {\r
-    ChildSaSession  = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
-\r
-    if (ChildSaSession->MessageId == Mid) {\r
-      return ChildSaSession;\r
-    }\r
-  }\r
-  return NULL;\r
-}\r

 \r
 /**\r
   This function find the Child SA by the specified SPI.\r
 \r
   This functin find a ChildSA session by searching the ChildSaSessionlist of\r
   the input IKEV2_SA_SESSION by specified MessageID.\r
 \r
 /**\r
   This function find the Child SA by the specified SPI.\r
 \r
   This functin find a ChildSA session by searching the ChildSaSessionlist of\r
   the input IKEV2_SA_SESSION by specified MessageID.\r

-  \r
+\r

   @param[in]  SaSessionList      Pointer to List to be searched.\r
   @param[in]  Spi                Specified SPI.\r
 \r
   @param[in]  SaSessionList      Pointer to List to be searched.\r
   @param[in]  Spi                Specified SPI.\r
 \r


@@ -727,19 +695,19 @@ Ikev2ChildSaSessionInsert (
 \r
 /**\r
   Remove the IKEV2_CHILD_SA_SESSION from IkeSaSessionList.\r
 \r
 /**\r
   Remove the IKEV2_CHILD_SA_SESSION from IkeSaSessionList.\r

-  \r
+\r

   @param[in]  SaSessionList      The SA Session List to be iterated.\r
   @param[in]  Spi                Spi used to identified the IKEV2_CHILD_SA_SESSION.\r
   @param[in]  SaSessionList      The SA Session List to be iterated.\r
   @param[in]  Spi                Spi used to identified the IKEV2_CHILD_SA_SESSION.\r

-  @param[in]  ListType           The type of the List to indicate whether it is a \r
-                                 Established. \r
+  @param[in]  ListType           The type of the List to indicate whether it is a\r
+                                 Established.\r

 \r
   @return The point to IKEV2_CHILD_SA_SESSION or NULL.\r
 \r
   @return The point to IKEV2_CHILD_SA_SESSION or NULL.\r

-  \r
+\r

 **/\r
 IKEV2_CHILD_SA_SESSION *\r
 Ikev2ChildSaSessionRemove (\r
   IN LIST_ENTRY           *SaSessionList,\r
 **/\r
 IKEV2_CHILD_SA_SESSION *\r
 Ikev2ChildSaSessionRemove (\r
   IN LIST_ENTRY           *SaSessionList,\r

-  IN UINT32               Spi, \r
+  IN UINT32               Spi,\r

   IN UINT8                ListType\r
   )\r
 {\r
   IN UINT8                ListType\r
   )\r
 {\r


@@ -748,7 +716,7 @@ Ikev2ChildSaSessionRemove (
   IKEV2_CHILD_SA_SESSION  *ChildSaSession;\r
 \r
   NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, SaSessionList) {\r
   IKEV2_CHILD_SA_SESSION  *ChildSaSession;\r
 \r
   NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, SaSessionList) {\r

-    \r
+\r

     if (ListType == IKEV2_ESTABLISHED_CHILDSA_LIST || ListType == IKEV2_ESTABLISHING_CHILDSA_LIST) {\r
       ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
     } else if (ListType == IKEV2_DELET_CHILDSA_LIST) {\r
     if (ListType == IKEV2_ESTABLISHED_CHILDSA_LIST || ListType == IKEV2_ESTABLISHING_CHILDSA_LIST) {\r
       ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
     } else if (ListType == IKEV2_DELET_CHILDSA_LIST) {\r


@@ -767,23 +735,7 @@ Ikev2ChildSaSessionRemove (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Mark a specified Child SA Session as on deleting.\r
-\r
-  @param[in]  ChildSaSession   Pointer to IKEV2_CHILD_SA_SESSION.\r
-\r
-  @retval     EFI_SUCCESS      Operation is successful.\r
-\r
-**/\r
-EFI_STATUS\r
-Ikev2ChildSaSessionOnDeleting (\r
-  IN IKEV2_CHILD_SA_SESSION   *ChildSaSession\r
-  )\r
-{\r
-  return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
-  Free the memory located for the specified IKEV2_CHILD_SA_SESSION. \r
+  Free the memory located for the specified IKEV2_CHILD_SA_SESSION.\r

 \r
   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION.\r
 \r
 \r
   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION.\r
 \r


@@ -878,7 +830,6 @@ Ikev2ChildSaSilentDelete (
   IKEV2_CHILD_SA_SESSION    *ChildSession;\r
   EFI_IPSEC_CONFIG_SELECTOR *LocalSelector;\r
   EFI_IPSEC_CONFIG_SELECTOR *RemoteSelector;\r
   IKEV2_CHILD_SA_SESSION    *ChildSession;\r
   EFI_IPSEC_CONFIG_SELECTOR *LocalSelector;\r
   EFI_IPSEC_CONFIG_SELECTOR *RemoteSelector;\r

-  IKE_UDP_SERVICE           *UdpService;\r

   IPSEC_PRIVATE_DATA        *Private;\r
 \r
   if (IkeSaSession == NULL) {\r
   IPSEC_PRIVATE_DATA        *Private;\r
 \r
   if (IkeSaSession == NULL) {\r


@@ -890,18 +841,15 @@ Ikev2ChildSaSilentDelete (
   ChildSession    = NULL;\r
   LocalSelector   = NULL;\r
   RemoteSelector  = NULL;\r
   ChildSession    = NULL;\r
   LocalSelector   = NULL;\r
   RemoteSelector  = NULL;\r

-  UdpService      = IkeSaSession->SessionCommon.UdpService;\r

 \r
 \r

-  Private  = (UdpService->IpVersion == IP_VERSION_4) ?\r
-             IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :\r
-             IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);\r
+  Private = IkeSaSession->SessionCommon.Private;\r

 \r
   //\r
   // Remove the Established SA from ChildSaEstablishlist.\r
   //\r
   ChildSession = Ikev2ChildSaSessionRemove(\r
                    &(IkeSaSession->ChildSaEstablishSessionList),\r
 \r
   //\r
   // Remove the Established SA from ChildSaEstablishlist.\r
   //\r
   ChildSession = Ikev2ChildSaSessionRemove(\r
                    &(IkeSaSession->ChildSaEstablishSessionList),\r

-                   Spi, \r
+                   Spi,\r

                    IKEV2_ESTABLISHED_CHILDSA_LIST\r
                    );\r
   if (ChildSession == NULL) {\r
                    IKEV2_ESTABLISHED_CHILDSA_LIST\r
                    );\r
   if (ChildSession == NULL) {\r


@@ -910,12 +858,12 @@ Ikev2ChildSaSilentDelete (
 \r
   LocalSpi  = ChildSession->LocalPeerSpi;\r
   RemoteSpi = ChildSession->RemotePeerSpi;\r
 \r
   LocalSpi  = ChildSession->LocalPeerSpi;\r
   RemoteSpi = ChildSession->RemotePeerSpi;\r

-  \r
+\r

   SelectorSize  = sizeof (EFI_IPSEC_CONFIG_SELECTOR);\r
   Selector      = AllocateZeroPool (SelectorSize);\r
   SelectorSize  = sizeof (EFI_IPSEC_CONFIG_SELECTOR);\r
   Selector      = AllocateZeroPool (SelectorSize);\r

-  ASSERT (Selector != NULL);\r
-\r
-  \r
+  if (Selector == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r

 \r
   while (1) {\r
     Status = EfiIpSecConfigGetNextSelector (\r
 \r
   while (1) {\r
     Status = EfiIpSecConfigGetNextSelector (\r


@@ -928,6 +876,11 @@ Ikev2ChildSaSilentDelete (
       FreePool (Selector);\r
 \r
       Selector = AllocateZeroPool (SelectorSize);\r
       FreePool (Selector);\r
 \r
       Selector = AllocateZeroPool (SelectorSize);\r

+      if (Selector == NULL) {\r
+        Status = EFI_OUT_OF_RESOURCES;\r
+        break;\r
+      }\r
+\r

       Status   = EfiIpSecConfigGetNextSelector (\r
                    &Private->IpSecConfig,\r
                    IPsecConfigDataTypeSad,\r
       Status   = EfiIpSecConfigGetNextSelector (\r
                    &Private->IpSecConfig,\r
                    IPsecConfigDataTypeSad,\r


@@ -947,7 +900,11 @@ Ikev2ChildSaSilentDelete (
       //\r
       IsRemoteFound   = TRUE;\r
       RemoteSelector  = AllocateZeroPool (SelectorSize);\r
       //\r
       IsRemoteFound   = TRUE;\r
       RemoteSelector  = AllocateZeroPool (SelectorSize);\r

-      ASSERT (RemoteSelector != NULL);\r
+      if (RemoteSelector == NULL) {\r
+        Status = EFI_OUT_OF_RESOURCES;\r
+        break;\r
+      }\r
+\r

       CopyMem (RemoteSelector, Selector, SelectorSize);\r
     }\r
 \r
       CopyMem (RemoteSelector, Selector, SelectorSize);\r
     }\r
 \r


@@ -958,7 +915,11 @@ Ikev2ChildSaSilentDelete (
       //\r
       IsLocalFound  = TRUE;\r
       LocalSelector = AllocateZeroPool (SelectorSize);\r
       //\r
       IsLocalFound  = TRUE;\r
       LocalSelector = AllocateZeroPool (SelectorSize);\r

-      ASSERT (LocalSelector != NULL);\r
+      if (LocalSelector == NULL) {\r
+        Status = EFI_OUT_OF_RESOURCES;\r
+        break;\r
+      }\r
+\r

       CopyMem (LocalSelector, Selector, SelectorSize);\r
     }\r
   }\r
       CopyMem (LocalSelector, Selector, SelectorSize);\r
     }\r
   }\r


@@ -1013,12 +974,12 @@ Ikev2ChildSaSilentDelete (
   Free the specified DhBuffer.\r
 \r
   @param[in] DhBuffer   Pointer to IKEV2_DH_BUFFER to be freed.\r
   Free the specified DhBuffer.\r
 \r
   @param[in] DhBuffer   Pointer to IKEV2_DH_BUFFER to be freed.\r

-  \r
+\r

 **/\r
 VOID\r
 Ikev2DhBufferFree (\r
   IKEV2_DH_BUFFER *DhBuffer\r
 **/\r
 VOID\r
 Ikev2DhBufferFree (\r
   IKEV2_DH_BUFFER *DhBuffer\r

-) \r
+)\r

 {\r
   if (DhBuffer != NULL) {\r
     if (DhBuffer->GxBuffer != NULL) {\r
 {\r
   if (DhBuffer != NULL) {\r
     if (DhBuffer->GxBuffer != NULL) {\r


@@ -1039,7 +1000,7 @@ Ikev2DhBufferFree (
 \r
 /**\r
   This function is to parse a request IKE packet and return its request type.\r
 \r
 /**\r
   This function is to parse a request IKE packet and return its request type.\r

-  The request type is one of IKE CHILD SA creation, IKE SA rekeying and \r
+  The request type is one of IKE CHILD SA creation, IKE SA rekeying and\r

   IKE CHILD SA rekeying.\r
 \r
   @param[in] IkePacket  IKE packet to be prased.\r
   IKE CHILD SA rekeying.\r
 \r
   @param[in] IkePacket  IKE packet to be prased.\r


@@ -1066,10 +1027,10 @@ Ikev2ChildExchangeRequestType(
       //\r
       Flag = TRUE;\r
     }\r
       //\r
       Flag = TRUE;\r
     }\r

-    if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NOTIFY) { \r
+    if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NOTIFY) {\r

       if (((IKEV2_NOTIFY*)IkePayload)->MessageType == IKEV2_NOTIFICATION_REKEY_SA) {\r
         //\r
       if (((IKEV2_NOTIFY*)IkePayload)->MessageType == IKEV2_NOTIFICATION_REKEY_SA) {\r
         //\r

-        // If notify payload with REKEY_SA message type, the IkePacket is for \r
+        // If notify payload with REKEY_SA message type, the IkePacket is for\r

         // rekeying Child SA.\r
         //\r
         return IkeRequestTypeRekeyChildSa;\r
         // rekeying Child SA.\r
         //\r
         return IkeRequestTypeRekeyChildSa;\r


@@ -1084,7 +1045,7 @@ Ikev2ChildExchangeRequestType(
     return IkeRequestTypeRekeyIkeSa;\r
   } else {\r
     //\r
     return IkeRequestTypeRekeyIkeSa;\r
   } else {\r
     //\r

-    // If the Notify payloaad with transport mode message type, the IkePacket is \r
+    // If the Notify payloaad with transport mode message type, the IkePacket is\r

     // for create Child SA.\r
     //\r
     return IkeRequestTypeCreateChildSa;\r
     // for create Child SA.\r
     //\r
     return IkeRequestTypeCreateChildSa;\r


@@ -1094,10 +1055,10 @@ Ikev2ChildExchangeRequestType(
 /**\r
   Associate a SPD selector to the Child SA Session.\r
 \r
 /**\r
   Associate a SPD selector to the Child SA Session.\r
 \r

-  This function is called when the Child SA is not the first child SA of its \r
+  This function is called when the Child SA is not the first child SA of its\r

   IKE SA. It associate a SPD to this Child SA.\r
 \r
   IKE SA. It associate a SPD to this Child SA.\r
 \r

-  @param[in, out]  ChildSaSession     Pointer to the Child SA Session to be associated to \r
+  @param[in, out]  ChildSaSession     Pointer to the Child SA Session to be associated to\r

                                       a SPD selector.\r
 \r
   @retval EFI_SUCCESS        Associate one SPD selector to this Child SA Session successfully.\r
                                       a SPD selector.\r
 \r
   @retval EFI_SUCCESS        Associate one SPD selector to this Child SA Session successfully.\r


@@ -1118,24 +1079,6 @@ Ikev2ChildSaAssociateSpdEntry (
 }\r
 \r
 \r
 }\r
 \r
 \r

-/**\r
-  This function finds the SPI from Create Child SA Exchange Packet.\r
- \r
-  @param[in] IkePacket       Pointer to IKE_PACKET to be searched.\r
-\r
-  @retval SPI number or 0 if it is not supported.\r
-\r
-**/\r
-UINT32\r
-Ikev2ChildExchangeRekeySpi (\r
-  IN IKE_PACKET               *IkePacket\r
-  )\r
-{\r
-  //\r
-  // Not support yet.\r
-  // \r
-  return 0;\r
-}\r

 \r
 /**\r
   Validate the IKE header of received IKE packet.\r
 \r
 /**\r
   Validate the IKE header of received IKE packet.\r


@@ -1183,7 +1126,7 @@ Ikev2ValidateHeader (
   //\r
   // Information Exchagne and Create Child Exchange can be started from each part.\r
   //\r
   //\r
   // Information Exchagne and Create Child Exchange can be started from each part.\r
   //\r

-  if (IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_INFO && \r
+  if (IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_INFO &&\r

       IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_CREATE_CHILD\r
       ) {\r
     if (IkeSaSession->SessionCommon.IsInitiator) {\r
       IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_CREATE_CHILD\r
       ) {\r
     if (IkeSaSession->SessionCommon.IsInitiator) {\r


@@ -1258,7 +1201,7 @@ Ikev2InitializeSaData (
   ProposalData->ProposalIndex   = 1;\r
 \r
   //\r
   ProposalData->ProposalIndex   = 1;\r
 \r
   //\r

-  // If SA data for IKE_SA_INIT exchage, contains 4 transforms. If SA data for \r
+  // If SA data for IKE_SA_INIT exchage, contains 4 transforms. If SA data for\r

   // IKE_AUTH exchange contains 3 transforms.\r
   //\r
   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
   // IKE_AUTH exchange contains 3 transforms.\r
   //\r
   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r


@@ -1274,7 +1217,11 @@ Ikev2InitializeSaData (
     ChildSaSession              = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);\r
     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;\r
     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));\r
     ChildSaSession              = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);\r
     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;\r
     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));\r

-    ASSERT (ProposalData->Spi != NULL);\r
+    if (ProposalData->Spi == NULL) {\r
+      FreePool (SaData);\r
+      return NULL;\r
+    }\r
+\r

     CopyMem (\r
       ProposalData->Spi,\r
       &ChildSaSession->LocalPeerSpi,\r
     CopyMem (\r
       ProposalData->Spi,\r
       &ChildSaSession->LocalPeerSpi,\r


@@ -1342,7 +1289,12 @@ Ikev2InitializeSaData (
     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;\r
     ProposalData->NumTransforms = 3;\r
     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));\r
     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;\r
     ProposalData->NumTransforms = 3;\r
     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));\r

-    ASSERT (ProposalData->Spi != NULL);\r
+    if (ProposalData->Spi == NULL) {\r
+      FreePool (((IKEV2_PROPOSAL_DATA *) (SaData + 1))->Spi);\r
+      FreePool (SaData);\r
+      return NULL;\r
+    }\r
+\r

     CopyMem (\r
       ProposalData->Spi,\r
       &ChildSaSession->LocalPeerSpi,\r
     CopyMem (\r
       ProposalData->Spi,\r
       &ChildSaSession->LocalPeerSpi,\r


@@ -1428,9 +1380,9 @@ Ikev2StoreSaData (
 \r
   //\r
   // Create a SpdSelector. In this implementation, one SPD represents\r
 \r
   //\r
   // Create a SpdSelector. In this implementation, one SPD represents\r

-  // 2 direction traffic, so in here, there needs to reverse the local address \r
+  // 2 direction traffic, so in here, there needs to reverse the local address\r

   // and remote address for Remote Peer's SA, then reverse again for the locate\r
   // and remote address for Remote Peer's SA, then reverse again for the locate\r

-  // SA. \r
+  // SA.\r

   //\r
   TempAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;\r
   TempAddressInfo  = ChildSaSession->SpdSelector->LocalAddress;\r
   //\r
   TempAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;\r
   TempAddressInfo  = ChildSaSession->SpdSelector->LocalAddress;\r


@@ -1455,7 +1407,7 @@ Ikev2StoreSaData (
   //\r
   if (SaData.Mode == EfiIPsecTunnel) {\r
     CopyMem (\r
   //\r
   if (SaData.Mode == EfiIPsecTunnel) {\r
     CopyMem (\r

-      &SaData.TunnelSourceAddress, \r
+      &SaData.TunnelSourceAddress,\r

       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,\r
       sizeof (EFI_IP_ADDRESS)\r
       );\r
       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,\r
       sizeof (EFI_IP_ADDRESS)\r
       );\r


@@ -1484,13 +1436,13 @@ Ikev2StoreSaData (
 \r
   //\r
   // Store the local SA into SAD.\r
 \r
   //\r
   // Store the local SA into SAD.\r

-  //  \r
+  //\r

   ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;\r
   ChildSaSession->SpdSelector->RemoteAddress      = ChildSaSession->SpdSelector->LocalAddress;\r
 \r
   ChildSaSession->SpdSelector->LocalAddress       = TempAddressInfo;\r
   ChildSaSession->SpdSelector->LocalAddressCount  = TempAddressCount;\r
   ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;\r
   ChildSaSession->SpdSelector->RemoteAddress      = ChildSaSession->SpdSelector->LocalAddress;\r
 \r
   ChildSaSession->SpdSelector->LocalAddress       = TempAddressInfo;\r
   ChildSaSession->SpdSelector->LocalAddressCount  = TempAddressCount;\r

-  \r
+\r

   SaId.Spi = ChildSaSession->RemotePeerSpi;\r
 \r
   CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.RemotePeerIp, sizeof (EFI_IP_ADDRESS));\r
   SaId.Spi = ChildSaSession->RemotePeerSpi;\r
 \r
   CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.RemotePeerIp, sizeof (EFI_IP_ADDRESS));\r


@@ -1527,12 +1479,12 @@ Ikev2StoreSaData (
 /**\r
   Call back function of the IKE life time is over.\r
 \r
 /**\r
   Call back function of the IKE life time is over.\r
 \r

-  This function will mark the related IKE SA Session as deleting and trigger a \r
+  This function will mark the related IKE SA Session as deleting and trigger a\r

   Information negotiation.\r
 \r
   @param[in]    Event     The signaled Event.\r
   @param[in]    Context   Pointer to data passed by caller.\r
   Information negotiation.\r
 \r
   @param[in]    Event     The signaled Event.\r
   @param[in]    Context   Pointer to data passed by caller.\r

-  \r
+\r

 **/\r
 VOID\r
 EFIAPI\r
 **/\r
 VOID\r
 EFIAPI\r


@@ -1574,7 +1526,7 @@ Ikev2LifetimeNotify (
 \r
     //\r
     // Change the Child SA Session's State to IKE_STATE_SA_DELETING.\r
 \r
     //\r
     // Change the Child SA Session's State to IKE_STATE_SA_DELETING.\r

-    //    \r
+    //\r

     DEBUG ((\r
       DEBUG_INFO,\r
       "\n------ChildSa Lifetime is out(SPI):(0x%x)------\n",\r
     DEBUG ((\r
       DEBUG_INFO,\r
       "\n------ChildSa Lifetime is out(SPI):(0x%x)------\n",\r


@@ -1610,7 +1562,7 @@ Ikev2ResendNotify (
   UINT8                        Value;\r
   EFI_STATUS                   Status;\r
 \r
   UINT8                        Value;\r
   EFI_STATUS                   Status;\r
 \r

-  ASSERT (Context != NULL); \r
+  ASSERT (Context != NULL);\r

   IkeSaSession   = NULL;\r
   ChildSaSession = NULL;\r
   SessionCommon  = (IKEV2_SESSION_COMMON *) Context;\r
   IkeSaSession   = NULL;\r
   ChildSaSession = NULL;\r
   SessionCommon  = (IKEV2_SESSION_COMMON *) Context;\r


@@ -1686,9 +1638,9 @@ Ikev2ResendNotify (
       if (ChildSaSession->SessionCommon.State == IkeStateSaDeleting) {\r
 \r
         //\r
       if (ChildSaSession->SessionCommon.State == IkeStateSaDeleting) {\r
 \r
         //\r

-        // Established Child SA should be remove from the SAD entry and \r
-        // DeleteList. The function of Ikev2DeleteChildSaSilent() will remove \r
-        // the childSA from the IkeSaSession->ChildSaEstablishedList. So there \r
+        // Established Child SA should be remove from the SAD entry and\r
+        // DeleteList. The function of Ikev2DeleteChildSaSilent() will remove\r
+        // the childSA from the IkeSaSession->ChildSaEstablishedList. So there\r

         // is no need to remove it here.\r
         //\r
         Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);\r
         // is no need to remove it here.\r
         //\r
         Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);\r


@@ -1731,44 +1683,70 @@ Ikev2ResendNotify (
   Copy ChildSaSession->Spd->Selector to ChildSaSession->SpdSelector.\r
 \r
   ChildSaSession->SpdSelector stores the real Spdselector for its SA. Sometime,\r
   Copy ChildSaSession->Spd->Selector to ChildSaSession->SpdSelector.\r
 \r
   ChildSaSession->SpdSelector stores the real Spdselector for its SA. Sometime,\r

-  the SpdSelector in ChildSaSession is more accurated or the scope is smaller \r
+  the SpdSelector in ChildSaSession is more accurated or the scope is smaller\r

   than the one in ChildSaSession->Spd, especially for the tunnel mode.\r
   than the one in ChildSaSession->Spd, especially for the tunnel mode.\r

-    \r
+\r

   @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to.\r
   @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to.\r

-  \r
+\r
+  @retval EFI_SUCCESS            The operation complete successfully.\r
+  @retval EFI_OUT_OF_RESOURCES   If the required resource can't be allocated.\r
+\r

 **/\r
 **/\r

-VOID\r
+EFI_STATUS\r

 Ikev2ChildSaSessionSpdSelectorCreate (\r
   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession\r
 Ikev2ChildSaSessionSpdSelectorCreate (\r
   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession\r

-  ) \r
+  )\r

 {\r
 {\r

+  EFI_STATUS          Status;\r
+\r
+  Status = EFI_SUCCESS;\r
+\r

   if (ChildSaSession->Spd != NULL && ChildSaSession->Spd->Selector != NULL) {\r
     if (ChildSaSession->SpdSelector == NULL) {\r
       ChildSaSession->SpdSelector = AllocateZeroPool (sizeof (EFI_IPSEC_SPD_SELECTOR));\r
   if (ChildSaSession->Spd != NULL && ChildSaSession->Spd->Selector != NULL) {\r
     if (ChildSaSession->SpdSelector == NULL) {\r
       ChildSaSession->SpdSelector = AllocateZeroPool (sizeof (EFI_IPSEC_SPD_SELECTOR));\r

-      ASSERT (ChildSaSession->SpdSelector != NULL);\r
+      if (ChildSaSession->SpdSelector == NULL) {\r
+        Status = EFI_OUT_OF_RESOURCES;\r
+        return Status;\r
+      }\r

     }\r
     CopyMem (\r
     }\r
     CopyMem (\r

-      ChildSaSession->SpdSelector, \r
-      ChildSaSession->Spd->Selector, \r
+      ChildSaSession->SpdSelector,\r
+      ChildSaSession->Spd->Selector,\r

       sizeof (EFI_IPSEC_SPD_SELECTOR)\r
       );\r
     ChildSaSession->SpdSelector->RemoteAddress = AllocateCopyPool (\r
       sizeof (EFI_IPSEC_SPD_SELECTOR)\r
       );\r
     ChildSaSession->SpdSelector->RemoteAddress = AllocateCopyPool (\r

-                                                   ChildSaSession->Spd->Selector->RemoteAddressCount * \r
-                                                   sizeof (EFI_IP_ADDRESS_INFO), \r
+                                                   ChildSaSession->Spd->Selector->RemoteAddressCount *\r
+                                                   sizeof (EFI_IP_ADDRESS_INFO),\r

                                                    ChildSaSession->Spd->Selector->RemoteAddress\r
                                                    );\r
                                                    ChildSaSession->Spd->Selector->RemoteAddress\r
                                                    );\r

+    if (ChildSaSession->SpdSelector->RemoteAddress == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+\r
+      FreePool (ChildSaSession->SpdSelector);\r
+\r
+      return Status;\r
+    }\r
+\r

     ChildSaSession->SpdSelector->LocalAddress = AllocateCopyPool (\r
     ChildSaSession->SpdSelector->LocalAddress = AllocateCopyPool (\r

-                                                  ChildSaSession->Spd->Selector->LocalAddressCount * \r
-                                                  sizeof (EFI_IP_ADDRESS_INFO), \r
+                                                  ChildSaSession->Spd->Selector->LocalAddressCount *\r
+                                                  sizeof (EFI_IP_ADDRESS_INFO),\r

                                                   ChildSaSession->Spd->Selector->LocalAddress\r
                                                   );\r
                                                   ChildSaSession->Spd->Selector->LocalAddress\r
                                                   );\r

+    if (ChildSaSession->SpdSelector->LocalAddress == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+\r
+      FreePool (ChildSaSession->SpdSelector->RemoteAddress);\r
+\r
+      FreePool (ChildSaSession->SpdSelector);\r

 \r
 \r

-    ASSERT (ChildSaSession->SpdSelector->LocalAddress != NULL);\r
-    ASSERT (ChildSaSession->SpdSelector->RemoteAddress != NULL);\r
+      return Status;\r
+    }\r

 \r
     ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->Spd->Selector->RemoteAddressCount;\r
 \r
     ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->Spd->Selector->RemoteAddressCount;\r

-    ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->Spd->Selector->LocalAddressCount; \r
+    ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->Spd->Selector->LocalAddressCount;\r

   }\r
   }\r

+\r
+  return Status;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -1793,11 +1771,13 @@ Ikev2ChildSaSessionCreate (
   // Create a new ChildSaSession.Insert it into processing list and initiate the common parameters.\r
   //\r
   ChildSaSession = Ikev2ChildSaSessionAlloc (UdpService, IkeSaSession);\r
   // Create a new ChildSaSession.Insert it into processing list and initiate the common parameters.\r
   //\r
   ChildSaSession = Ikev2ChildSaSessionAlloc (UdpService, IkeSaSession);\r

-  ASSERT (ChildSaSession != NULL);\r
+  if (ChildSaSession == NULL) {\r
+    return NULL;\r
+  }\r

 \r
   //\r
   // Set the specific parameters.\r
 \r
   //\r
   // Set the specific parameters.\r

-  // \r
+  //\r

   ChildSaSession->Spd        = IkeSaSession->Spd;\r
   ChildSaCommon              = &ChildSaSession->SessionCommon;\r
   ChildSaCommon->IsInitiator = IkeSaSession->SessionCommon.IsInitiator;\r
   ChildSaSession->Spd        = IkeSaSession->Spd;\r
   ChildSaCommon              = &ChildSaSession->SessionCommon;\r
   ChildSaCommon->IsInitiator = IkeSaSession->SessionCommon.IsInitiator;\r


@@ -1814,24 +1794,35 @@ Ikev2ChildSaSessionCreate (
   // The ChildSaSession->SpdSelector might be changed after the traffic selector\r
   // negoniation and it will be copied into the SAData after ChildSA established.\r
   //\r
   // The ChildSaSession->SpdSelector might be changed after the traffic selector\r
   // negoniation and it will be copied into the SAData after ChildSA established.\r
   //\r

-  Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession);\r
+  if (EFI_ERROR (Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession))) {\r
+    Ikev2ChildSaSessionFree (ChildSaSession);\r
+    return NULL;\r
+  }\r

 \r
   //\r
   // Copy first NiBlock and NrBlock to ChildSa Session\r
   //\r
   ChildSaSession->NiBlock   = AllocateZeroPool (IkeSaSession->NiBlkSize);\r
 \r
   //\r
   // Copy first NiBlock and NrBlock to ChildSa Session\r
   //\r
   ChildSaSession->NiBlock   = AllocateZeroPool (IkeSaSession->NiBlkSize);\r

-  ASSERT (ChildSaSession->NiBlock != NULL);\r
+  if (ChildSaSession->NiBlock == NULL) {\r
+    Ikev2ChildSaSessionFree (ChildSaSession);\r
+    return NULL;\r
+  }\r
+\r

   ChildSaSession->NiBlkSize = IkeSaSession->NiBlkSize;\r
   CopyMem (ChildSaSession->NiBlock, IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);\r
 \r
   ChildSaSession->NrBlock   = AllocateZeroPool (IkeSaSession->NrBlkSize);\r
   ChildSaSession->NiBlkSize = IkeSaSession->NiBlkSize;\r
   CopyMem (ChildSaSession->NiBlock, IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);\r
 \r
   ChildSaSession->NrBlock   = AllocateZeroPool (IkeSaSession->NrBlkSize);\r

-  ASSERT (ChildSaSession->NrBlock != NULL);\r
+  if (ChildSaSession->NrBlock == NULL) {\r
+    Ikev2ChildSaSessionFree (ChildSaSession);\r
+    return NULL;\r
+  }\r
+\r

   ChildSaSession->NrBlkSize = IkeSaSession->NrBlkSize;\r
   CopyMem (ChildSaSession->NrBlock, IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);\r
 \r
   //\r
   ChildSaSession->NrBlkSize = IkeSaSession->NrBlkSize;\r
   CopyMem (ChildSaSession->NrBlock, IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);\r
 \r
   //\r

-  //  Only if the Create Child SA is called for the IKE_INIT Exchange and \r
-  //  IkeSaSession is initiator (Only Initiator's SPD is not NULL), Set the \r
+  //  Only if the Create Child SA is called for the IKE_INIT Exchange and\r
+  //  IkeSaSession is initiator (Only Initiator's SPD is not NULL), Set the\r

   //  Traffic Selectors related information here.\r
   //\r
   if (IkeSaSession->SessionCommon.State == IkeStateAuth && IkeSaSession->Spd != NULL) {\r
   //  Traffic Selectors related information here.\r
   //\r
   if (IkeSaSession->SessionCommon.State == IkeStateAuth && IkeSaSession->Spd != NULL) {\r


@@ -1851,20 +1842,20 @@ Ikev2ChildSaSessionCreate (
   Check if the SPD is related to the input Child SA Session.\r
 \r
   This function is the subfunction of Ikev1AssociateSpdEntry(). It is the call\r
   Check if the SPD is related to the input Child SA Session.\r
 \r
   This function is the subfunction of Ikev1AssociateSpdEntry(). It is the call\r

-  back function of IpSecVisitConfigData(). \r
-  \r
+  back function of IpSecVisitConfigData().\r
+\r

 \r
   @param[in]  Type               Type of the input Config Selector.\r
 \r
   @param[in]  Type               Type of the input Config Selector.\r

-  @param[in]  Selector           Pointer to the Configure Selector to be checked. \r
-  @param[in]  Data               Pointer to the Configure Selector's Data passed \r
+  @param[in]  Selector           Pointer to the Configure Selector to be checked.\r
+  @param[in]  Data               Pointer to the Configure Selector's Data passed\r

                                  from the caller.\r
   @param[in]  SelectorSize       The buffer size of Selector.\r
   @param[in]  DataSize           The buffer size of the Data.\r
   @param[in]  Context            The data passed from the caller. It is a Child\r
                                  SA Session in this context.\r
 \r
                                  from the caller.\r
   @param[in]  SelectorSize       The buffer size of Selector.\r
   @param[in]  DataSize           The buffer size of the Data.\r
   @param[in]  Context            The data passed from the caller. It is a Child\r
                                  SA Session in this context.\r
 \r

-  @retval EFI_SUCCESS        The SPD Selector is not related to the Child SA Session. \r
-  @retval EFI_ABORTED        The SPD Selector is related to the Child SA session and \r
+  @retval EFI_SUCCESS        The SPD Selector is not related to the Child SA Session.\r
+  @retval EFI_ABORTED        The SPD Selector is related to the Child SA session and\r

                              set the ChildSaSession->Spd to point to this SPD Selector.\r
 \r
 **/\r
                              set the ChildSaSession->Spd to point to this SPD Selector.\r
 \r
 **/\r


@@ -1895,7 +1886,7 @@ Ikev2MatchSpdEntry (
 \r
   ChildSaSession  = (IKEV2_CHILD_SA_SESSION *) Context;\r
   IpVersion       = ChildSaSession->SessionCommon.UdpService->IpVersion;\r
 \r
   ChildSaSession  = (IKEV2_CHILD_SA_SESSION *) Context;\r
   IpVersion       = ChildSaSession->SessionCommon.UdpService->IpVersion;\r

-  SpdSelector     = (EFI_IPSEC_SPD_SELECTOR *) Selector;  \r
+  SpdSelector     = (EFI_IPSEC_SPD_SELECTOR *) Selector;\r

   IsMatch         = TRUE;\r
 \r
   if (SpdSelector->NextLayerProtocol == EFI_IP_PROTO_UDP &&\r
   IsMatch         = TRUE;\r
 \r
   if (SpdSelector->NextLayerProtocol == EFI_IP_PROTO_UDP &&\r


@@ -1924,7 +1915,7 @@ Ikev2MatchSpdEntry (
     IsMatch = FALSE;\r
   }\r
 \r
     IsMatch = FALSE;\r
   }\r
 \r

-  IsMatch = (BOOLEAN) (IsMatch && \r
+  IsMatch = (BOOLEAN) (IsMatch &&\r

                        IpSecMatchIpAddress (\r
                          IpVersion,\r
                          &ChildSaSession->SessionCommon.LocalPeerIp,\r
                        IpSecMatchIpAddress (\r
                          IpVersion,\r
                          &ChildSaSession->SessionCommon.LocalPeerIp,\r


@@ -1932,7 +1923,7 @@ Ikev2MatchSpdEntry (
                          SpdSelector->LocalAddressCount\r
                          ));\r
 \r
                          SpdSelector->LocalAddressCount\r
                          ));\r
 \r

-  IsMatch = (BOOLEAN) (IsMatch && \r
+  IsMatch = (BOOLEAN) (IsMatch &&\r

                        IpSecMatchIpAddress (\r
                          IpVersion,\r
                          &ChildSaSession->SessionCommon.RemotePeerIp,\r
                        IpSecMatchIpAddress (\r
                          IpVersion,\r
                          &ChildSaSession->SessionCommon.RemotePeerIp,\r


@@ -2004,32 +1995,49 @@ Ikev2IsSupportAlg (
 /**\r
   Get the preferred algorithm types from ProposalData.\r
 \r
 /**\r
   Get the preferred algorithm types from ProposalData.\r
 \r

-  @param[in]  ProposalData              Pointer to related IKEV2_PROPOSAL_DATA.\r
-  @param[out] PreferEncryptAlgorithm    Output of preferred encrypt algorithm.\r
-  @param[out] PreferIntegrityAlgorithm  Output of preferred integrity algorithm. \r
-  @param[out] PreferPrfAlgorithm        Output of preferred PRF algorithm. Only \r
-                                        for IKE SA.\r
-  @param[out] PreferDhGroup             Output of preferred DH group. Only for \r
-                                        IKE SA.\r
-  @param[out] PreferEncryptKeylength    Output of preferred encrypt key length \r
-                                        in bytes.\r
-  @param[out] IsSupportEsn              Output of value about the Extented Sequence\r
-                                        Number is support or not. Only for Child SA.\r
-  @param[in]  IsChildSa                 If it is ture, the ProposalData is for IKE\r
-                                        SA. Otherwise the proposalData is for Child SA.\r
+  @param[in]      ProposalData              Pointer to related IKEV2_PROPOSAL_DATA.\r
+  @param[in, out] PreferEncryptAlgorithm    Pointer to buffer which is used to store the\r
+                                            preferred encrypt algorithm.\r
+                                            Input value shall be initialized to zero that\r
+                                            indicates to be parsed from ProposalData.\r
+                                            Output of preferred encrypt algorithm.\r
+  @param[in, out] PreferIntegrityAlgorithm  Pointer to buffer which is used to store the\r
+                                            preferred integrity algorithm.\r
+                                            Input value shall be initialized to zero that\r
+                                            indicates to be parsed from ProposalData.\r
+                                            Output of preferred integrity algorithm.\r
+  @param[in, out] PreferPrfAlgorithm        Pointer to buffer which is used to store the\r
+                                            preferred PRF algorithm.\r
+                                            Input value shall be initialized to zero that\r
+                                            indicates to be parsed from ProposalData.\r
+                                            Output of preferred PRF algorithm. Only\r
+                                            for IKE SA.\r
+  @param[in, out] PreferDhGroup             Pointer to buffer which is used to store the\r
+                                            preferred DH group.\r
+                                            Input value shall be initialized to zero that\r
+                                            indicates to be parsed from ProposalData.\r
+                                            Output of preferred DH group. Only for\r
+                                            IKE SA.\r
+  @param[out]     PreferEncryptKeylength    Pointer to buffer which is used to store the\r
+                                            preferred encrypt key length in bytes.\r
+  @param[out]     IsSupportEsn              Pointer to buffer which is used to store the\r
+                                            value about the Extented Sequence Number is\r
+                                            support or not. Only for Child SA.\r
+  @param[in]      IsChildSa                 If it is ture, the ProposalData is for IKE\r
+                                            SA. Otherwise the proposalData is for Child SA.\r

 \r
 **/\r
 VOID\r
 Ikev2ParseProposalData (\r
 \r
 **/\r
 VOID\r
 Ikev2ParseProposalData (\r

-  IN     IKEV2_PROPOSAL_DATA  *ProposalData, \r
-     OUT UINT16               *PreferEncryptAlgorithm,\r
-     OUT UINT16               *PreferIntegrityAlgorithm,\r
-     OUT UINT16               *PreferPrfAlgorithm,\r
-     OUT UINT16               *PreferDhGroup,\r
+  IN     IKEV2_PROPOSAL_DATA  *ProposalData,\r
+  IN OUT UINT16               *PreferEncryptAlgorithm,\r
+  IN OUT UINT16               *PreferIntegrityAlgorithm,\r
+  IN OUT UINT16               *PreferPrfAlgorithm,\r
+  IN OUT UINT16               *PreferDhGroup,\r

      OUT UINTN                *PreferEncryptKeylength,\r
      OUT BOOLEAN              *IsSupportEsn,\r
   IN     BOOLEAN              IsChildSa\r
      OUT UINTN                *PreferEncryptKeylength,\r
      OUT BOOLEAN              *IsSupportEsn,\r
   IN     BOOLEAN              IsChildSa\r

-) \r
+)\r

 {\r
   IKEV2_TRANSFORM_DATA *TransformData;\r
   UINT8                TransformIndex;\r
 {\r
   IKEV2_TRANSFORM_DATA *TransformData;\r
   UINT8                TransformIndex;\r


@@ -2038,7 +2046,7 @@ Ikev2ParseProposalData (
   // Check input parameters.\r
   //\r
   if (ProposalData == NULL ||\r
   // Check input parameters.\r
   //\r
   if (ProposalData == NULL ||\r

-      PreferEncryptAlgorithm == NULL || \r
+      PreferEncryptAlgorithm == NULL ||\r

       PreferIntegrityAlgorithm == NULL ||\r
       PreferEncryptKeylength == NULL\r
       ) {\r
       PreferIntegrityAlgorithm == NULL ||\r
       PreferEncryptKeylength == NULL\r
       ) {\r


@@ -2053,14 +2061,14 @@ Ikev2ParseProposalData (
     if (PreferPrfAlgorithm == NULL || PreferDhGroup == NULL) {\r
       return;\r
     }\r
     if (PreferPrfAlgorithm == NULL || PreferDhGroup == NULL) {\r
       return;\r
     }\r

-  }  \r
+  }\r

 \r
   TransformData = (IKEV2_TRANSFORM_DATA *)(ProposalData + 1);\r
   for (TransformIndex = 0; TransformIndex < ProposalData->NumTransforms; TransformIndex++) {\r
 \r
   TransformData = (IKEV2_TRANSFORM_DATA *)(ProposalData + 1);\r
   for (TransformIndex = 0; TransformIndex < ProposalData->NumTransforms; TransformIndex++) {\r

-    switch (TransformData->TransformType) {          \r
+    switch (TransformData->TransformType) {\r

     //\r
     //\r

-    // For IKE SA there are four algorithm types. Encryption Algorithm, Pseudo-random Function, \r
-    // Integrity Algorithm, Diffie-Hellman Group. For Child SA, there are three algorithm types. \r
+    // For IKE SA there are four algorithm types. Encryption Algorithm, Pseudo-random Function,\r
+    // Integrity Algorithm, Diffie-Hellman Group. For Child SA, there are three algorithm types.\r

     // Encryption Algorithm, Integrity Algorithm, Extended Sequence Number.\r
     //\r
     case IKEV2_TRANSFORM_TYPE_ENCR:\r
     // Encryption Algorithm, Integrity Algorithm, Extended Sequence Number.\r
     //\r
     case IKEV2_TRANSFORM_TYPE_ENCR:\r


@@ -2087,7 +2095,7 @@ Ikev2ParseProposalData (
         if (*PreferPrfAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_PRF_TYPE)) {\r
           *PreferPrfAlgorithm = TransformData->TransformId;\r
         }\r
         if (*PreferPrfAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_PRF_TYPE)) {\r
           *PreferPrfAlgorithm = TransformData->TransformId;\r
         }\r

-      }       \r
+      }\r

       break;\r
 \r
     case IKEV2_TRANSFORM_TYPE_INTEG :\r
       break;\r
 \r
     case IKEV2_TRANSFORM_TYPE_INTEG :\r


@@ -2095,21 +2103,21 @@ Ikev2ParseProposalData (
         *PreferIntegrityAlgorithm = TransformData->TransformId;\r
       }\r
       break;\r
         *PreferIntegrityAlgorithm = TransformData->TransformId;\r
       }\r
       break;\r

-      \r
+\r

     case IKEV2_TRANSFORM_TYPE_DH :\r
       if (!IsChildSa) {\r
         if (*PreferDhGroup == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_DH_TYPE)) {\r
           *PreferDhGroup = TransformData->TransformId;\r
         }\r
     case IKEV2_TRANSFORM_TYPE_DH :\r
       if (!IsChildSa) {\r
         if (*PreferDhGroup == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_DH_TYPE)) {\r
           *PreferDhGroup = TransformData->TransformId;\r
         }\r

-      }        \r
+      }\r

       break;\r
       break;\r

-    \r
+\r

     case IKEV2_TRANSFORM_TYPE_ESN :\r
       if (IsChildSa) {\r
         if (TransformData->TransformId != 0) {\r
           *IsSupportEsn = TRUE;\r
         }\r
     case IKEV2_TRANSFORM_TYPE_ESN :\r
       if (IsChildSa) {\r
         if (TransformData->TransformId != 0) {\r
           *IsSupportEsn = TRUE;\r
         }\r

-      }        \r
+      }\r

       break;\r
 \r
     default:\r
       break;\r
 \r
     default:\r


@@ -2121,14 +2129,14 @@ Ikev2ParseProposalData (
 \r
 /**\r
   Parse the received Initial Exchange Packet.\r
 \r
 /**\r
   Parse the received Initial Exchange Packet.\r

-  \r
-  This function parse the SA Payload and Key Payload to find out the cryptographic \r
-  suite for the further IKE negotiation and fill it into the IKE SA Session's \r
+\r
+  This function parse the SA Payload and Key Payload to find out the cryptographic\r
+  suite for the further IKE negotiation and fill it into the IKE SA Session's\r

   CommonSession->SaParams.\r
 \r
   @param[in, out]  IkeSaSession  Pointer to related IKEV2_SA_SESSION.\r
   @param[in]       SaPayload     The received packet.\r
   CommonSession->SaParams.\r
 \r
   @param[in, out]  IkeSaSession  Pointer to related IKEV2_SA_SESSION.\r
   @param[in]       SaPayload     The received packet.\r

-  @param[in]       Type          The received packet IKE header flag. \r
+  @param[in]       Type          The received packet IKE header flag.\r

 \r
   @retval          TRUE          If the SA proposal in Packet is acceptable.\r
   @retval          FALSE         If the SA proposal in Packet is not acceptable.\r
 \r
   @retval          TRUE          If the SA proposal in Packet is acceptable.\r
   @retval          FALSE         If the SA proposal in Packet is not acceptable.\r


@@ -2179,7 +2187,7 @@ Ikev2SaParseSaPayload (
         // Get the preferred algorithms.\r
         //\r
         Ikev2ParseProposalData (\r
         // Get the preferred algorithms.\r
         //\r
         Ikev2ParseProposalData (\r

-          ProposalData, \r
+          ProposalData,\r

           &PreferEncryptAlgorithm,\r
           &PreferIntegrityAlgorithm,\r
           &PreferPrfAlgorithm,\r
           &PreferEncryptAlgorithm,\r
           &PreferIntegrityAlgorithm,\r
           &PreferPrfAlgorithm,\r


@@ -2191,14 +2199,17 @@ Ikev2SaParseSaPayload (
 \r
         if (PreferEncryptAlgorithm != 0 &&\r
               PreferIntegrityAlgorithm != 0 &&\r
 \r
         if (PreferEncryptAlgorithm != 0 &&\r
               PreferIntegrityAlgorithm != 0 &&\r

-              PreferPrfAlgorithm != 0 && \r
+              PreferPrfAlgorithm != 0 &&\r

               PreferDhGroup != 0\r
               ) {\r
             //\r
               PreferDhGroup != 0\r
               ) {\r
             //\r

-            // Find the matched one. \r
+            // Find the matched one.\r

             //\r
             IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
             //\r
             IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r

-            ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);\r
+            if (IkeSaSession->SessionCommon.SaParams == NULL) {\r
+              return FALSE;\r
+            }\r
+\r

             IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
             IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
             IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;\r
             IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
             IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
             IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;\r


@@ -2213,7 +2224,10 @@ Ikev2SaParseSaPayload (
                                    sizeof (IKEV2_PROPOSAL_DATA) +\r
                                    sizeof (IKEV2_TRANSFORM_DATA) * 4;\r
             IkeSaSession->SaData = AllocateZeroPool (SaDataSize);\r
                                    sizeof (IKEV2_PROPOSAL_DATA) +\r
                                    sizeof (IKEV2_TRANSFORM_DATA) * 4;\r
             IkeSaSession->SaData = AllocateZeroPool (SaDataSize);\r

-            ASSERT (IkeSaSession->SaData != NULL);\r
+            if (IkeSaSession->SaData == NULL) {\r
+              FreePool (IkeSaSession->SessionCommon.SaParams);\r
+              return FALSE;\r
+            }\r

 \r
             IkeSaSession->SaData->NumProposals  = 1;\r
 \r
 \r
             IkeSaSession->SaData->NumProposals  = 1;\r
 \r


@@ -2223,12 +2237,13 @@ Ikev2SaParseSaPayload (
             // one than one transform with same type.\r
             //\r
             CopyMem (\r
             // one than one transform with same type.\r
             //\r
             CopyMem (\r

-              (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1), \r
-               ProposalData, \r
+              (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1),\r
+               ProposalData,\r

                SaDataSize - sizeof (IKEV2_SA_DATA)\r
               );\r
 \r
             ((IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1))->ProposalIndex = 1;\r
                SaDataSize - sizeof (IKEV2_SA_DATA)\r
               );\r
 \r
             ((IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1))->ProposalIndex = 1;\r

+\r

             return TRUE;\r
           } else {\r
             PreferEncryptAlgorithm   = 0;\r
             return TRUE;\r
           } else {\r
             PreferEncryptAlgorithm   = 0;\r


@@ -2241,21 +2256,21 @@ Ikev2SaParseSaPayload (
       //\r
       // Point to next Proposal.\r
       //\r
       //\r
       // Point to next Proposal.\r
       //\r

-      ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) + \r
+      ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +\r

                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r
     }\r
   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {\r
     //\r
                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r
     }\r
   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {\r
     //\r

-    // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is \r
-    // the responded SA proposal, suppose it only has one proposal and the transform Numbers \r
-    // is 4. \r
+    // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is\r
+    // the responded SA proposal, suppose it only has one proposal and the transform Numbers\r
+    // is 4.\r

     //\r
     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);\r
     if (ProposalData->ProtocolId != IPSEC_PROTO_ISAKMP || ProposalData->NumTransforms != 4) {\r
       return FALSE;\r
     }\r
     //\r
     //\r
     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);\r
     if (ProposalData->ProtocolId != IPSEC_PROTO_ISAKMP || ProposalData->NumTransforms != 4) {\r
       return FALSE;\r
     }\r
     //\r

-    // Get the preferred algorithms. \r
+    // Get the preferred algorithms.\r

     //\r
     Ikev2ParseProposalData (\r
       ProposalData,\r
     //\r
     Ikev2ParseProposalData (\r
       ProposalData,\r


@@ -2264,17 +2279,17 @@ Ikev2SaParseSaPayload (
       &PreferPrfAlgorithm,\r
       &PreferDhGroup,\r
       &PreferEncryptKeylength,\r
       &PreferPrfAlgorithm,\r
       &PreferDhGroup,\r
       &PreferEncryptKeylength,\r

-      NULL, \r
+      NULL,\r

       FALSE\r
       );\r
       FALSE\r
       );\r

-    // \r
+    //\r

     // Check if the Sa proposal data from received packet is in the IkeSaSession->SaData.\r
     //\r
     ProposalData = (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1);\r
 \r
     for (ProposalIndex = 0; ProposalIndex < IkeSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {\r
       Ikev2ParseProposalData (\r
     // Check if the Sa proposal data from received packet is in the IkeSaSession->SaData.\r
     //\r
     ProposalData = (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1);\r
 \r
     for (ProposalIndex = 0; ProposalIndex < IkeSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {\r
       Ikev2ParseProposalData (\r

-          ProposalData, \r
+          ProposalData,\r

           &EncryptAlgorithm,\r
           &IntegrityAlgorithm,\r
           &PrfAlgorithm,\r
           &EncryptAlgorithm,\r
           &IntegrityAlgorithm,\r
           &PrfAlgorithm,\r


@@ -2295,40 +2310,44 @@ Ikev2SaParseSaPayload (
         IntegrityAlgorithm = 0;\r
         PrfAlgorithm       = 0;\r
         DhGroup            = 0;\r
         IntegrityAlgorithm = 0;\r
         PrfAlgorithm       = 0;\r
         DhGroup            = 0;\r

-        EncryptKeylength   = 0; \r
+        EncryptKeylength   = 0;\r

       }\r
 \r
       }\r
 \r

-      ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) + \r
-                     ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));    \r
+      ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +\r
+                     ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r

     }\r
 \r
     if (IsMatch) {\r
         IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
     }\r
 \r
     if (IsMatch) {\r
         IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r

-        ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);\r
+        if (IkeSaSession->SessionCommon.SaParams == NULL) {\r
+          return FALSE;\r
+        }\r
+\r

         IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
         IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
         IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;\r
         IkeSaSession->SessionCommon.SaParams->Prf        = PreferPrfAlgorithm;\r
         IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
         IkeSaSession->SessionCommon.PreferDhGroup        = PreferDhGroup;\r
         IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
         IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
         IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;\r
         IkeSaSession->SessionCommon.SaParams->Prf        = PreferPrfAlgorithm;\r
         IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
         IkeSaSession->SessionCommon.PreferDhGroup        = PreferDhGroup;\r

-      \r
+\r

         return TRUE;\r
     }\r
   }\r
         return TRUE;\r
     }\r
   }\r

+\r

   return FALSE;\r
 }\r
 \r
 /**\r
   Parse the received Authentication Exchange Packet.\r
   return FALSE;\r
 }\r
 \r
 /**\r
   Parse the received Authentication Exchange Packet.\r

-  \r
+\r

   This function parse the SA Payload and Key Payload to find out the cryptographic\r
   suite for the ESP and fill it into the Child SA Session's CommonSession->SaParams.\r
   This function parse the SA Payload and Key Payload to find out the cryptographic\r
   suite for the ESP and fill it into the Child SA Session's CommonSession->SaParams.\r

-  \r
-  @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to \r
+\r
+  @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to\r

                                    this Authentication Exchange.\r
   @param[in]       SaPayload       The received packet.\r
                                    this Authentication Exchange.\r
   @param[in]       SaPayload       The received packet.\r

-  @param[in]       Type            The IKE header's flag of received packet . \r
-  \r
+  @param[in]       Type            The IKE header's flag of received packet .\r
+\r

   @retval          TRUE            If the SA proposal in Packet is acceptable.\r
   @retval          FALSE           If the SA proposal in Packet is not acceptable.\r
 \r
   @retval          TRUE            If the SA proposal in Packet is acceptable.\r
   @retval          FALSE           If the SA proposal in Packet is not acceptable.\r
 \r


@@ -2360,7 +2379,7 @@ Ikev2ChildSaParseSaPayload (
   IntegrityAlgorithm       = 0;\r
   EncryptAlgorithm         = 0;\r
   EncryptKeylength         = 0;\r
   IntegrityAlgorithm       = 0;\r
   EncryptAlgorithm         = 0;\r
   EncryptKeylength         = 0;\r

-  IsMatch                  = TRUE;\r
+  IsMatch                  = FALSE;\r

   IsSupportEsn             = FALSE;\r
   PreferIsSupportEsn       = FALSE;\r
 \r
   IsSupportEsn             = FALSE;\r
   PreferIsSupportEsn       = FALSE;\r
 \r


@@ -2387,15 +2406,18 @@ Ikev2ChildSaParseSaPayload (
         //\r
         // Don't support the ESN now.\r
         //\r
         //\r
         // Don't support the ESN now.\r
         //\r

-        if (PreferEncryptAlgorithm != 0 && \r
+        if (PreferEncryptAlgorithm != 0 &&\r

             PreferIntegrityAlgorithm != 0 &&\r
             !IsSupportEsn\r
             ) {\r
           //\r
             PreferIntegrityAlgorithm != 0 &&\r
             !IsSupportEsn\r
             ) {\r
           //\r

-          // Find the matched one. \r
+          // Find the matched one.\r

           //\r
           ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
           //\r
           ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r

-          ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);\r
+          if (ChildSaSession->SessionCommon.SaParams == NULL) {\r
+            return FALSE;\r
+          }\r
+\r

           ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
           ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
           ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
           ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
           ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
           ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r


@@ -2409,13 +2431,16 @@ Ikev2ChildSaParseSaPayload (
                                  sizeof (IKEV2_TRANSFORM_DATA) * 4;\r
 \r
           ChildSaSession->SaData = AllocateZeroPool (SaDataSize);\r
                                  sizeof (IKEV2_TRANSFORM_DATA) * 4;\r
 \r
           ChildSaSession->SaData = AllocateZeroPool (SaDataSize);\r

-          ASSERT (ChildSaSession->SaData != NULL);\r
+          if (ChildSaSession->SaData == NULL) {\r
+            FreePool (ChildSaSession->SessionCommon.SaParams);\r
+            return FALSE;\r
+          }\r

 \r
           ChildSaSession->SaData->NumProposals  = 1;\r
 \r
           //\r
           // BUGBUG: Suppose there are 4 transforms in the matched proposal. If\r
 \r
           ChildSaSession->SaData->NumProposals  = 1;\r
 \r
           //\r
           // BUGBUG: Suppose there are 4 transforms in the matched proposal. If\r

-          // the matched Proposal has more than 4 transforms that means there \r
+          // the matched Proposal has more than 4 transforms that means there\r

           // are more than one transform with same type.\r
           //\r
           CopyMem (\r
           // are more than one transform with same type.\r
           //\r
           CopyMem (\r


@@ -2427,10 +2452,17 @@ Ikev2ChildSaParseSaPayload (
           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->ProposalIndex = 1;\r
 \r
           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi = AllocateCopyPool (\r
           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->ProposalIndex = 1;\r
 \r
           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi = AllocateCopyPool (\r

-                                                                          sizeof (ChildSaSession->LocalPeerSpi), \r
+                                                                          sizeof (ChildSaSession->LocalPeerSpi),\r

                                                                           &ChildSaSession->LocalPeerSpi\r
                                                                           );\r
                                                                           &ChildSaSession->LocalPeerSpi\r
                                                                           );\r

-          ASSERT (((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi != NULL);\r
+          if (((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi == NULL) {\r
+            FreePool (ChildSaSession->SessionCommon.SaParams);\r
+\r
+            FreePool (ChildSaSession->SaData );\r
+\r
+            return FALSE;\r
+          }\r
+\r

           return TRUE;\r
 \r
         } else {\r
           return TRUE;\r
 \r
         } else {\r


@@ -2442,14 +2474,14 @@ Ikev2ChildSaParseSaPayload (
       //\r
       // Point to next Proposal\r
       //\r
       //\r
       // Point to next Proposal\r
       //\r

-      ProposalData = (IKEV2_PROPOSAL_DATA *)((UINT8 *)(ProposalData + 1) + \r
+      ProposalData = (IKEV2_PROPOSAL_DATA *)((UINT8 *)(ProposalData + 1) +\r

                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r
     }\r
   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {\r
     //\r
                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r
     }\r
   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {\r
     //\r

-    // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is \r
-    // the responded SA proposal, suppose it only has one proposal and the transform Numbers \r
-    // is 3. \r
+    // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is\r
+    // the responded SA proposal, suppose it only has one proposal and the transform Numbers\r
+    // is 3.\r

     //\r
     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
     if (ProposalData->ProtocolId != IPSEC_PROTO_IPSEC_ESP || ProposalData->NumTransforms != 3) {\r
     //\r
     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
     if (ProposalData->ProtocolId != IPSEC_PROTO_IPSEC_ESP || ProposalData->NumTransforms != 3) {\r


@@ -2473,7 +2505,7 @@ Ikev2ChildSaParseSaPayload (
 \r
     for (ProposalIndex = 0; ProposalIndex < ChildSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {\r
       Ikev2ParseProposalData (\r
 \r
     for (ProposalIndex = 0; ProposalIndex < ChildSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {\r
       Ikev2ParseProposalData (\r

-          ProposalData, \r
+          ProposalData,\r

           &EncryptAlgorithm,\r
           &IntegrityAlgorithm,\r
           NULL,\r
           &EncryptAlgorithm,\r
           &IntegrityAlgorithm,\r
           NULL,\r


@@ -2485,22 +2517,26 @@ Ikev2ChildSaParseSaPayload (
       if (EncryptAlgorithm == PreferEncryptAlgorithm &&\r
           EncryptKeylength == PreferEncryptKeylength &&\r
           IntegrityAlgorithm == PreferIntegrityAlgorithm &&\r
       if (EncryptAlgorithm == PreferEncryptAlgorithm &&\r
           EncryptKeylength == PreferEncryptKeylength &&\r
           IntegrityAlgorithm == PreferIntegrityAlgorithm &&\r

-          IsSupportEsn == PreferIsSupportEsn          \r
+          IsSupportEsn == PreferIsSupportEsn\r

           ) {\r
         IsMatch = TRUE;\r
       } else {\r
           ) {\r
         IsMatch = TRUE;\r
       } else {\r

-        PreferEncryptAlgorithm   = 0;\r
-        PreferIntegrityAlgorithm = 0;\r
-        IsSupportEsn             = TRUE;\r
+        IntegrityAlgorithm = 0;\r
+        EncryptAlgorithm   = 0;\r
+        EncryptKeylength   = 0;\r
+        IsSupportEsn       = FALSE;\r

       }\r
       }\r

-       ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) + \r
-                     ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));  \r
+      ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +\r
+                     ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r

     }\r
     }\r

-  \r
+\r

     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
     if (IsMatch) {\r
         ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
     if (IsMatch) {\r
         ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r

-        ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);\r
+        if (ChildSaSession->SessionCommon.SaParams == NULL) {\r
+          return FALSE;\r
+        }\r
+\r

         ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
         ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
         ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
         ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;\r
         ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;\r
         ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r


@@ -2515,17 +2551,17 @@ Ikev2ChildSaParseSaPayload (
 /**\r
   Generate Key buffer from fragments.\r
 \r
 /**\r
   Generate Key buffer from fragments.\r
 \r

-  If the digest length of specified HashAlgId is larger than or equal with the \r
-  required output key length, derive the key directly. Otherwise, Key Material \r
-  needs to be PRF-based concatenation according to 2.13 of RFC 4306: \r
+  If the digest length of specified HashAlgId is larger than or equal with the\r
+  required output key length, derive the key directly. Otherwise, Key Material\r
+  needs to be PRF-based concatenation according to 2.13 of RFC 4306:\r

   prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),\r
   T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)\r
   then derive the key from this key material.\r
   prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),\r
   T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)\r
   then derive the key from this key material.\r

-  \r
+\r

   @param[in]       HashAlgId        The Hash Algorithm ID used to generate key.\r
   @param[in]       HashKey          Pointer to a key buffer which contains hash key.\r
   @param[in]       HashKeyLength    The length of HashKey in bytes.\r
   @param[in]       HashAlgId        The Hash Algorithm ID used to generate key.\r
   @param[in]       HashKey          Pointer to a key buffer which contains hash key.\r
   @param[in]       HashKeyLength    The length of HashKey in bytes.\r

-  @param[in, out]  OutputKey        Pointer to buffer which is used to receive the \r
+  @param[in, out]  OutputKey        Pointer to buffer which is used to receive the\r

                                     output key.\r
   @param[in]       OutputKeyLength  The length of OutPutKey buffer.\r
   @param[in]       Fragments        Pointer to the data to be used to generate key.\r
                                     output key.\r
   @param[in]       OutputKeyLength  The length of OutPutKey buffer.\r
   @param[in]       Fragments        Pointer to the data to be used to generate key.\r


@@ -2533,6 +2569,8 @@ Ikev2ChildSaParseSaPayload (
 \r
   @retval EFI_SUCCESS            The operation complete successfully.\r
   @retval EFI_INVALID_PARAMETER  If NumFragments is zero.\r
 \r
   @retval EFI_SUCCESS            The operation complete successfully.\r
   @retval EFI_INVALID_PARAMETER  If NumFragments is zero.\r

+                                 If the authentication algorithm given by HashAlgId\r
+                                 cannot be found.\r

   @retval EFI_OUT_OF_RESOURCES   If the required resource can't be allocated.\r
   @retval Others                 The operation is failed.\r
 \r
   @retval EFI_OUT_OF_RESOURCES   If the required resource can't be allocated.\r
   @retval Others                 The operation is failed.\r
 \r


@@ -2569,6 +2607,10 @@ Ikev2SaGenerateKey (
   LocalFragments[2].Data = NULL;\r
 \r
   AuthKeyLength = IpSecGetHmacDigestLength (HashAlgId);\r
   LocalFragments[2].Data = NULL;\r
 \r
   AuthKeyLength = IpSecGetHmacDigestLength (HashAlgId);\r

+  if (AuthKeyLength == 0) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r

   DigestSize    = AuthKeyLength;\r
   Digest        = AllocateZeroPool (AuthKeyLength);\r
 \r
   DigestSize    = AuthKeyLength;\r
   Digest        = AllocateZeroPool (AuthKeyLength);\r
 \r


@@ -2582,11 +2624,11 @@ Ikev2SaGenerateKey (
   if (OutputKeyLength <=  DigestSize) {\r
     Status = IpSecCryptoIoHmac (\r
                HashAlgId,\r
   if (OutputKeyLength <=  DigestSize) {\r
     Status = IpSecCryptoIoHmac (\r
                HashAlgId,\r

-               HashKey, \r
-               HashKeyLength, \r
-               (HASH_DATA_FRAGMENT *) Fragments, \r
-               NumFragments, \r
-               Digest, \r
+               HashKey,\r
+               HashKeyLength,\r
+               (HASH_DATA_FRAGMENT *) Fragments,\r
+               NumFragments,\r
+               Digest,\r

                DigestSize\r
                );\r
     if (EFI_ERROR (Status)) {\r
                DigestSize\r
                );\r
     if (EFI_ERROR (Status)) {\r


@@ -2609,7 +2651,11 @@ Ikev2SaGenerateKey (
   }\r
 \r
   LocalFragments[1].Data     = AllocateZeroPool (FragmentsSize);\r
   }\r
 \r
   LocalFragments[1].Data     = AllocateZeroPool (FragmentsSize);\r

-  ASSERT (LocalFragments[1].Data != NULL);\r
+  if (LocalFragments[1].Data == NULL) {\r
+    Status = EFI_OUT_OF_RESOURCES;\r
+    goto Exit;\r
+  }\r
+\r

   LocalFragments[1].DataSize = FragmentsSize;\r
 \r
   //\r
   LocalFragments[1].DataSize = FragmentsSize;\r
 \r
   //\r


@@ -2618,7 +2664,7 @@ Ikev2SaGenerateKey (
   FragmentsSize = 0;\r
   for (Index = 0; Index < NumFragments; Index++) {\r
     CopyMem (\r
   FragmentsSize = 0;\r
   for (Index = 0; Index < NumFragments; Index++) {\r
     CopyMem (\r

-      LocalFragments[1].Data + FragmentsSize, \r
+      LocalFragments[1].Data + FragmentsSize,\r

       Fragments[Index].Data,\r
       Fragments[Index].DataSize\r
       );\r
       Fragments[Index].Data,\r
       Fragments[Index].DataSize\r
       );\r


@@ -2635,17 +2681,21 @@ Ikev2SaGenerateKey (
   // Allocate buffer for the first fragment\r
   //\r
   LocalFragments[0].Data     = AllocateZeroPool (AuthKeyLength);\r
   // Allocate buffer for the first fragment\r
   //\r
   LocalFragments[0].Data     = AllocateZeroPool (AuthKeyLength);\r

-  ASSERT (LocalFragments[0].Data != NULL);\r
+  if (LocalFragments[0].Data == NULL) {\r
+    Status = EFI_OUT_OF_RESOURCES;\r
+    goto Exit;\r
+  }\r
+\r

   LocalFragments[0].DataSize = AuthKeyLength;\r
 \r
   Round = (OutputKeyLength - 1) / AuthKeyLength + 1;\r
   for (Index = 0; Index < Round; Index++) {\r
     Status = IpSecCryptoIoHmac (\r
   LocalFragments[0].DataSize = AuthKeyLength;\r
 \r
   Round = (OutputKeyLength - 1) / AuthKeyLength + 1;\r
   for (Index = 0; Index < Round; Index++) {\r
     Status = IpSecCryptoIoHmac (\r

-               HashAlgId, \r
-               HashKey, \r
-               HashKeyLength, \r
+               HashAlgId,\r
+               HashKey,\r
+               HashKeyLength,\r

                (HASH_DATA_FRAGMENT *)(Index == 0 ? &LocalFragments[1] : LocalFragments),\r
                (HASH_DATA_FRAGMENT *)(Index == 0 ? &LocalFragments[1] : LocalFragments),\r

-               Index == 0 ? 2 : 3, \r
+               Index == 0 ? 2 : 3,\r

                Digest,\r
                DigestSize\r
                );\r
                Digest,\r
                DigestSize\r
                );\r


@@ -2653,25 +2703,25 @@ Ikev2SaGenerateKey (
       goto Exit;\r
     }\r
     CopyMem (\r
       goto Exit;\r
     }\r
     CopyMem (\r

-      LocalFragments[0].Data, \r
-      Digest, \r
+      LocalFragments[0].Data,\r
+      Digest,\r

       DigestSize\r
       );\r
     if (OutputKeyLength > DigestSize * (Index + 1)) {\r
       CopyMem (\r
       DigestSize\r
       );\r
     if (OutputKeyLength > DigestSize * (Index + 1)) {\r
       CopyMem (\r

-        OutputKey + Index * DigestSize, \r
-        Digest, \r
+        OutputKey + Index * DigestSize,\r
+        Digest,\r

         DigestSize\r
         );\r
       LocalFragments[0].DataSize = DigestSize;\r
       TailData ++;\r
     } else {\r
         DigestSize\r
         );\r
       LocalFragments[0].DataSize = DigestSize;\r
       TailData ++;\r
     } else {\r

-      // \r
+      //\r

       // The last round\r
       //\r
       CopyMem (\r
       // The last round\r
       //\r
       CopyMem (\r

-        OutputKey + Index * DigestSize, \r
-        Digest, \r
+        OutputKey + Index * DigestSize,\r
+        Digest,\r

         OutputKeyLength - Index * DigestSize\r
       );\r
     }\r
         OutputKeyLength - Index * DigestSize\r
       );\r
     }\r