MdeModulePkg:Use safe string functions

[mirror_edk2.git] / MdeModulePkg / Universal / SetupBrowserDxe / IfrParse.c

diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/IfrParse.c b/MdeModulePkg/Universal/SetupBrowserDxe/IfrParse.c
index 45405609c14f9d4cb6deafcf91639d04dce4afdc..953e3a50717be2c936e8eaded027ec00670d2ac5 100644 (file)
--- a/MdeModulePkg/Universal/SetupBrowserDxe/IfrParse.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/IfrParse.c
@@ -688,6 +688,7 @@ InitializeRequestElement (
   LIST_ENTRY       *Link;\r
   BOOLEAN          Find;\r
   FORM_BROWSER_CONFIG_REQUEST  *ConfigInfo;\r
+  UINTN            MaxLen;\r
 \r
   Storage = Question->Storage;\r
   if (Storage == NULL) {\r
@@ -732,6 +733,8 @@ InitializeRequestElement (
   //\r
   FormsetStorage = GetFstStgFromVarId(FormSet, Question->VarStoreId);\r
   ASSERT (FormsetStorage != NULL);\r
+  StringSize = (FormsetStorage->ConfigRequest != NULL) ? StrSize (FormsetStorage->ConfigRequest) : sizeof (CHAR16);\r
+  MaxLen = StringSize / sizeof (CHAR16) + FormsetStorage->SpareStrLen;\r
 \r
   //\r
   // Append <RequestElement> to <ConfigRequest>\r
@@ -740,8 +743,8 @@ InitializeRequestElement (
     //\r
     // Old String buffer is not sufficient for RequestElement, allocate a new one\r
     //\r
-    StringSize = (FormsetStorage->ConfigRequest != NULL) ? StrSize (FormsetStorage->ConfigRequest) : sizeof (CHAR16);\r
-    NewStr = AllocateZeroPool (StringSize + CONFIG_REQUEST_STRING_INCREMENTAL * sizeof (CHAR16));\r
+    MaxLen = StringSize / sizeof (CHAR16) + CONFIG_REQUEST_STRING_INCREMENTAL;\r
+    NewStr = AllocateZeroPool (MaxLen * sizeof (CHAR16));\r
     ASSERT (NewStr != NULL);\r
     if (FormsetStorage->ConfigRequest != NULL) {\r
       CopyMem (NewStr, FormsetStorage->ConfigRequest, StringSize);\r
@@ -751,7 +754,7 @@ InitializeRequestElement (
     FormsetStorage->SpareStrLen   = CONFIG_REQUEST_STRING_INCREMENTAL;\r
   }\r
 \r
-  StrCat (FormsetStorage->ConfigRequest, RequestElement);\r
+  StrCatS (FormsetStorage->ConfigRequest, MaxLen, RequestElement);\r
   FormsetStorage->ElementCount++;\r
   FormsetStorage->SpareStrLen -= StrLen;\r
 \r
@@ -782,6 +785,8 @@ InitializeRequestElement (
     ConfigInfo->Storage       = FormsetStorage->BrowserStorage;\r
     InsertTailList(&Form->ConfigRequestHead, &ConfigInfo->Link);\r
   }\r
+  StringSize = (ConfigInfo->ConfigRequest != NULL) ? StrSize (ConfigInfo->ConfigRequest) : sizeof (CHAR16);\r
+  MaxLen = StringSize / sizeof (CHAR16) + ConfigInfo->SpareStrLen;\r
 \r
   //\r
   // Append <RequestElement> to <ConfigRequest>\r
@@ -790,8 +795,8 @@ InitializeRequestElement (
     //\r
     // Old String buffer is not sufficient for RequestElement, allocate a new one\r
     //\r
-    StringSize = (ConfigInfo->ConfigRequest != NULL) ? StrSize (ConfigInfo->ConfigRequest) : sizeof (CHAR16);\r
-    NewStr = AllocateZeroPool (StringSize + CONFIG_REQUEST_STRING_INCREMENTAL * sizeof (CHAR16));\r
+    MaxLen = StringSize / sizeof (CHAR16) + CONFIG_REQUEST_STRING_INCREMENTAL;\r
+    NewStr = AllocateZeroPool (MaxLen * sizeof (CHAR16));\r
     ASSERT (NewStr != NULL);\r
     if (ConfigInfo->ConfigRequest != NULL) {\r
       CopyMem (NewStr, ConfigInfo->ConfigRequest, StringSize);\r
@@ -801,7 +806,7 @@ InitializeRequestElement (
     ConfigInfo->SpareStrLen   = CONFIG_REQUEST_STRING_INCREMENTAL;\r
   }\r
 \r
-  StrCat (ConfigInfo->ConfigRequest, RequestElement);\r
+  StrCatS (ConfigInfo->ConfigRequest, MaxLen, RequestElement);\r
   ConfigInfo->ElementCount++;\r
   ConfigInfo->SpareStrLen -= StrLen;\r
   return EFI_SUCCESS;\r