MdeModulePkg:Use safe string functions

[mirror_edk2.git] / MdeModulePkg / Universal / SetupBrowserDxe / Expression.c

diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/Expression.c b/MdeModulePkg/Universal/SetupBrowserDxe/Expression.c
index f1a65b2e89b1ff8fd9e2c9aa39aa444e95350517..688a1d66cb40b68f1314790dcd514e59fb58011e 100644 (file)
--- a/MdeModulePkg/Universal/SetupBrowserDxe/Expression.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/Expression.c
@@ -1324,6 +1324,7 @@ IfrCatenate (
   UINT16         Length0;\r
   UINT16         Length1;\r
   UINT8          *TmpBuf;\r
+  UINTN          MaxLen;\r
 \r
   //\r
   // String[0] - The second string\r
@@ -1363,10 +1364,11 @@ IfrCatenate (
 \r
   if (Value[0].Type == EFI_IFR_TYPE_STRING) {\r
     Size = StrSize (String[0]);\r
-    StringPtr= AllocatePool (StrSize (String[1]) + Size);\r
+    MaxLen = (StrSize (String[1]) + Size) / sizeof (CHAR16);\r
+    StringPtr= AllocatePool (MaxLen * sizeof (CHAR16));\r
     ASSERT (StringPtr != NULL);\r
-    StrCpy (StringPtr, String[1]);\r
-    StrCat (StringPtr, String[0]);\r
+    StrCpyS (StringPtr, MaxLen, String[1]);\r
+    StrCatS (StringPtr, MaxLen, String[0]);\r
 \r
     Result->Type = EFI_IFR_TYPE_STRING;\r
     Result->Value.string = NewString (StringPtr, FormSet->HiiHandle);\r