From: jcarsey <jcarsey@6f19259b-4bc3-4df7-8a09-765794883524>
Date: Wed, 30 Mar 2011 19:33:03 +0000 (+0000)
Subject: pointer verification (not NULL) and buffer overrun fixes.
X-Git-Tag: edk2-stable201903~15020
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=33c031ee2092282a069ce07d30202082ceaf61fe

pointer verification (not NULL) and buffer overrun fixes.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@11459 6f19259b-4bc3-4df7-8a09-765794883524
---

diff --git a/ShellPkg/Application/Shell/Shell.c b/ShellPkg/Application/Shell/Shell.c
index 17943531db..ecd48cdd78 100644
--- a/ShellPkg/Application/Shell/Shell.c
+++ b/ShellPkg/Application/Shell/Shell.c
@@ -731,7 +731,7 @@ ProcessCommandLine(
     ShellInfoObject.ShellInitSettings.Delay = 0;
   } else if (ShellInfoObject.ShellInitSettings.BitUnion.Bits.Delay) {
     TempConst = ShellCommandLineGetValue(Package, L"-delay");
-    if (*TempConst == L':') {
+    if (TempConst != NULL && *TempConst == L':') {
       TempConst++;
     }
     if (TempConst != NULL && !EFI_ERROR(ShellConvertStringToUint64(TempConst, &Intermediate, FALSE, FALSE))) {
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/Bcfg.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/Bcfg.c
index 73e8c57637..d278ee60e6 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/Bcfg.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/Bcfg.c
@@ -265,27 +265,31 @@ BcfgAddDebug1(
     FilePathSize = GetDevicePathSize (FilePath);
 
     TempByteBuffer = AllocateZeroPool(sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize);
-    TempByteStart  = TempByteBuffer;
-    *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
-    TempByteBuffer += sizeof (UINT32);
+    if (TempByteBuffer != NULL) {
+      TempByteStart  = TempByteBuffer;
+      *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
+      TempByteBuffer += sizeof (UINT32);
 
-    *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
-    TempByteBuffer += sizeof (UINT16);
+      *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
+      TempByteBuffer += sizeof (UINT16);
 
-    CopyMem (TempByteBuffer, Desc, DescSize);
-    TempByteBuffer += DescSize;
-    CopyMem (TempByteBuffer, FilePath, FilePathSize);
+      CopyMem (TempByteBuffer, Desc, DescSize);
+      TempByteBuffer += DescSize;
+      CopyMem (TempByteBuffer, FilePath, FilePathSize);
 
-    UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
-    Status = gRT->SetVariable (
-          OptionStr,
-          &gEfiGlobalVariableGuid,
-          EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-          sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
-          TempByteStart
-         );
-
-    FreePool(TempByteStart);
+      UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
+      Status = gRT->SetVariable (
+            OptionStr,
+            &gEfiGlobalVariableGuid,
+            EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+            sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
+            TempByteStart
+           );
+
+      FreePool(TempByteStart);
+    } else {
+      Status = EFI_OUT_OF_RESOURCES;
+    }
 
     if (EFI_ERROR(Status)) {
       ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_SET_VAR_FAIL), gShellDebug1HiiHandle, OptionStr, Status);
@@ -385,22 +389,25 @@ BcfgRemoveDebug1(
     return (SHELL_INVALID_PARAMETER);
   }
   NewOrder = AllocateZeroPool(OrderCount*sizeof(CurrentOrder[0]));
-  NewCount = OrderCount;
-  CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
-  for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
-    if (NewOrder[LoopVar] == Location) {
-      CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
-      NewCount--;
+  if (NewOrder != NULL) {
+    NewCount = OrderCount;
+    CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
+    for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
+      if (NewOrder[LoopVar] == Location) {
+        CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
+        NewCount--;
+      }
     }
+    Status = gRT->SetVariable(
+      Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
+      (EFI_GUID*)&gEfiGlobalVariableGuid,
+      EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+      NewCount*sizeof(NewOrder[0]),
+      NewOrder);
+    FreePool(NewOrder);
+  } else {
+    Status = EFI_OUT_OF_RESOURCES;
   }
-  Status = gRT->SetVariable(
-    Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
-    (EFI_GUID*)&gEfiGlobalVariableGuid,
-    EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-    NewCount*sizeof(NewOrder[0]),
-    NewOrder);
-  FreePool(NewOrder);
-
   if (EFI_ERROR(Status)) {
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_WRITE_FAIL), gShellDebug1HiiHandle, Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder", Status);
     return (SHELL_INVALID_PARAMETER);
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
index 5b48481913..fcd0de5cb5 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
@@ -247,10 +247,10 @@ MoveLine (
   // if > 0, the advance
   //
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = InternalEditorMiscLineRetreat (AbsCount,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   } else {
-    Line = InternalEditorMiscLineAdvance (Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
+    Line = InternalEditorMiscLineAdvance ((UINTN)Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   }
 
   return Line;
@@ -317,7 +317,7 @@ FileBufferRestoreMousePosition (
         CurrentLine = FileBuffer.CurrentLine;
         Line        = MoveLine (FRow - FileBuffer.FilePosition.Row);
 
-        if (FColumn > Line->Size) {
+        if (Line == NULL || FColumn > Line->Size) {
           HasCharacter = FALSE;
         }
 
@@ -500,7 +500,7 @@ FileBufferPrintLine (
     Limit = 0;
   }
 
-  StrnCpy (PrintLine, Buffer, Limit > MainEditor.ScreenSize.Column ? MainEditor.ScreenSize.Column : Limit);
+  StrnCpy (PrintLine, Buffer, MIN(MIN(Limit,MainEditor.ScreenSize.Column), 200));
   for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
     PrintLine[Limit] = L' ';
   }
@@ -1446,7 +1446,7 @@ FileBufferSave (
   //
   // if is the old file
   //
-  if (StrCmp (FileName, FileBuffer.FileName) == 0) {
+  if (FileBuffer.FileName != NULL && StrCmp (FileName, FileBuffer.FileName) == 0) {
     //
     // file has not been modified
     //
@@ -2316,7 +2316,7 @@ FileBufferPageDown (
   //
   // if that line, is not that long, so move to the end of that line
   //
-  if (FCol > Line->Size) {
+  if (Line != NULL && FCol > Line->Size) {
     FCol = Line->Size + 1;
   }
 
@@ -2372,7 +2372,7 @@ FileBufferPageUp (
   //
   // if that line is not that long, so move to the end of that line
   //
-  if (FCol > Line->Size) {
+  if (Line != NULL && FCol > Line->Size) {
     FCol = Line->Size + 1;
   }
 
@@ -2650,10 +2650,10 @@ MoveCurrentLine (
   UINTN           AbsCount;
 
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = InternalEditorMiscLineRetreat (AbsCount,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   } else {
-    Line = InternalEditorMiscLineAdvance (Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
+    Line = InternalEditorMiscLineAdvance ((UINTN)Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   }
 
   if (Line == NULL) {
@@ -2720,7 +2720,7 @@ FileBufferMovePosition (
       //
       FileBuffer.FilePosition.Row = NewFilePosRow;
       if (RowGap < 0) {
-        Abs = -RowGap;
+        Abs = (UINTN)ABS(RowGap);
         FileBuffer.DisplayPosition.Row -= Abs;
       } else {
         FileBuffer.DisplayPosition.Row += RowGap;
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/BufferImage.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/BufferImage.c
index 60e0b75435..675850cff4 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/BufferImage.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/BufferImage.c
@@ -637,7 +637,7 @@ HBufferImageRestoreMousePosition (
         CurrentLine = HBufferImage.CurrentLine;
         Line        = HMoveLine (FRow - HBufferImage.BufferPosition.Row);
 
-        if (FColumn > Line->Size) {
+        if (Line == NULL || FColumn > Line->Size) {
           HasCharacter = FALSE;
         }
 
@@ -1620,7 +1620,7 @@ Returns:
       //
       HBufferImage.BufferPosition.Row = NewFilePosRow;
       if (RowGap <= 0) {
-        Abs = -RowGap;
+        Abs = (UINTN)ABS(RowGap);
         HBufferImage.DisplayPosition.Row -= Abs;
       } else {
         HBufferImage.DisplayPosition.Row += RowGap;
@@ -1931,7 +1931,7 @@ Returns:
   //
   // if that line, is not that long, so move to the end of that line
   //
-  if (FCol > Line->Size) {
+  if (Line != NULL && FCol > Line->Size) {
     FCol      = Line->Size + 1;
     HighBits  = TRUE;
   }
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/FileImage.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/FileImage.c
index 57cefb882c..fd6387a20a 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/FileImage.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/FileImage.c
@@ -383,7 +383,7 @@ Returns:
   //
   // if is the old file
   //
-  if (StrCmp (FileName, HFileImage.FileName) == 0) {
+  if (HFileImage.FileName != NULL && FileName != NULL && StrCmp (FileName, HFileImage.FileName) == 0) {
     //
     // check whether file exists on disk
     //
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/HexEdit.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/HexEdit.c
index 0a97a6ca29..53718c7751 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/HexEdit.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/HexEdit.c
@@ -110,7 +110,7 @@ ShellCommandRunHexEdit (
         ShellStatus = SHELL_INVALID_PARAMETER;
       } else {
         Name      = ShellCommandLineGetRawValue(Package, 1);
-        if (!IsValidFileName(Name)) {
+        if (Name == NULL || !IsValidFileName(Name)) {
           ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_GEN_PROBLEM), gShellDebug1HiiHandle, Name);
           ShellStatus = SHELL_INVALID_PARAMETER;
         } else {
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/Misc.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/Misc.c
index 8ae21450c4..da11789625 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/Misc.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/Misc.c
@@ -256,10 +256,10 @@ Returns:
   //     do not set currentline to Line
   //
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = _HLineRetreat (AbsCount);
   } else {
-    Line = _HLineAdvance (Count);
+    Line = _HLineAdvance ((UINTN)Count);
   }
 
   return Line;
@@ -297,10 +297,10 @@ Returns:
   // >0: advance
   //
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = _HLineRetreat (AbsCount);
   } else {
-    Line = _HLineAdvance (Count);
+    Line = _HLineAdvance ((UINTN)Count);
   }
 
   if (Line == NULL) {
@@ -399,7 +399,10 @@ Returns:
   Lenp        = StrLen (Pat);
   Lens        = StrLen (Str);
 
-  Failure     = AllocateZeroPool (Lenp * sizeof (INTN));
+  Failure     = AllocateZeroPool ((UINTN)(Lenp * sizeof (INTN)));
+  if (Failure == NULL) {
+    return 0;
+  }
   Failure[0]  = -1;
   for (j = 1; j < Lenp; j++) {
     i = Failure[j - 1];
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c
index 324db922e6..afccf7bd58 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c
@@ -154,11 +154,15 @@ ShellCommandRunSetVar (
             // arbitrary buffer
             //
             Buffer = AllocateZeroPool((StrLen(Data) / 2));
-            for (LoopVar = 0 ; LoopVar < (StrLen(Data) / 2) ; LoopVar++) {
-              ((UINT8*)Buffer)[LoopVar] = (UINT8)(HexCharToUintn(Data[LoopVar*2]) * 16);
-              ((UINT8*)Buffer)[LoopVar] = (UINT8)(((UINT8*)Buffer)[LoopVar] + HexCharToUintn(Data[LoopVar*2+1]));
+            if (Buffer == NULL) {
+              Status = EFI_OUT_OF_RESOURCES;
+            } else {
+              for (LoopVar = 0 ; LoopVar < (StrLen(Data) / 2) ; LoopVar++) {
+                ((UINT8*)Buffer)[LoopVar] = (UINT8)(HexCharToUintn(Data[LoopVar*2]) * 16);
+                ((UINT8*)Buffer)[LoopVar] = (UINT8)(((UINT8*)Buffer)[LoopVar] + HexCharToUintn(Data[LoopVar*2+1]));
+              }
+              Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, StrLen(Data) / 2, Buffer);
             }
-            Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, StrLen(Data) / 2, Buffer);
             if (EFI_ERROR(Status)) {
               ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SETVAR_ERROR_SET), gShellDebug1HiiHandle, &Guid, VariableName, Status);
               ShellStatus = SHELL_ACCESS_DENIED;
@@ -181,11 +185,13 @@ ShellCommandRunSetVar (
           //
           Data++;
           Buffer = AllocateZeroPool(StrSize(Data) / 2);
-          AsciiSPrint(Buffer, StrSize(Data) / 2, "%s", Data);
-          ((CHAR8*)Buffer)[AsciiStrLen(Buffer)-1] = CHAR_NULL;
-
-          
-          Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, AsciiStrSize(Buffer)-sizeof(CHAR8), Buffer);
+          if (Buffer == NULL) {
+            Status = EFI_OUT_OF_RESOURCES;
+          } else {
+            AsciiSPrint(Buffer, StrSize(Data) / 2, "%s", Data);
+            ((CHAR8*)Buffer)[AsciiStrLen(Buffer)-1] = CHAR_NULL;
+            Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, AsciiStrSize(Buffer)-sizeof(CHAR8), Buffer);
+          }
           if (EFI_ERROR(Status)) {
             ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SETVAR_ERROR_SET), gShellDebug1HiiHandle, &Guid, VariableName, Status);
             ShellStatus = SHELL_ACCESS_DENIED;
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/EventLogInfo.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/EventLogInfo.c
index f0a9d54b73..a1e14678f3 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/EventLogInfo.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/EventLogInfo.c
@@ -340,55 +340,56 @@ DisplaySysEventLogData (
   //
   Offset  = 0;
   Log     = (LOG_RECORD_FORMAT *) LogData;
-  while (Log->Type != END_OF_LOG && Offset < LogAreaLength) {
+  while (Log != NULL && Log->Type != END_OF_LOG && Offset < LogAreaLength) {
     //
     // Get a Event Log Record
     //
     Log = (LOG_RECORD_FORMAT *) (LogData + Offset);
 
-    //
-    // Display Event Log Record Information
-    //
-    DisplaySELVarDataFormatType (Log->Type, SHOW_DETAIL);
-    DisplaySELLogHeaderLen (Log->Length, SHOW_DETAIL);
-
-    Offset += Log->Length;
-
-    //
-    // Display Log Header Date/Time Fields
-    // These fields contain the BCD representation of the date and time
-    // (as read from CMOS) of the occurrence of the event
-    // So Print as hex and represent decimal
-    //
-    ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_DATE), gShellDebug1HiiHandle);
-    if (Log != NULL && Log->Year >= 80 && Log->Year <= 99) {
-      Print (L"19");
-    } else if (Log != NULL && Log->Year <= 79) {
-      Print (L"20");
-    } else {
-      ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_ERROR), gShellDebug1HiiHandle);
-      continue;
+    if (Log != NULL) {
+      //
+      // Display Event Log Record Information
+      //
+      DisplaySELVarDataFormatType (Log->Type, SHOW_DETAIL);
+      DisplaySELLogHeaderLen (Log->Length, SHOW_DETAIL);
+
+      Offset += Log->Length;
+      //
+      // Display Log Header Date/Time Fields
+      // These fields contain the BCD representation of the date and time
+      // (as read from CMOS) of the occurrence of the event
+      // So Print as hex and represent decimal
+      //
+      ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_DATE), gShellDebug1HiiHandle);
+      if (Log != NULL && Log->Year >= 80 && Log->Year <= 99) {
+        Print (L"19");
+      } else if (Log != NULL && Log->Year <= 79) {
+        Print (L"20");
+      } else {
+        ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_ERROR), gShellDebug1HiiHandle);
+        continue;
+      }
+
+      ShellPrintHiiEx(-1,-1,NULL,
+        STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_TIME_SIX_VARS),
+        gShellDebug1HiiHandle,
+        Log->Year,
+        Log->Month,
+        Log->Day,
+        Log->Hour,
+        Log->Minute,
+        Log->Second
+       );
+
+      //
+      // Display Variable Data Format
+      //
+      if (Log->Length <= (sizeof (LOG_RECORD_FORMAT) - 1)) {
+        continue;
+      }
+
+      ElVdfType = Log->LogVariableData[0];
+      DisplayElVdfInfo (ElVdfType, Log->LogVariableData);
     }
-
-    ShellPrintHiiEx(-1,-1,NULL,
-      STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_TIME_SIX_VARS),
-      gShellDebug1HiiHandle,
-      Log->Year,
-      Log->Month,
-      Log->Day,
-      Log->Hour,
-      Log->Minute,
-      Log->Second
-     );
-
-    //
-    // Display Variable Data Format
-    //
-    if (Log->Length <= (sizeof (LOG_RECORD_FORMAT) - 1)) {
-      continue;
-    }
-
-    ElVdfType = Log->LogVariableData[0];
-    DisplayElVdfInfo (ElVdfType, Log->LogVariableData);
   }
 }
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c
index c04dba5b76..7b7e5928bd 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c
@@ -2,7 +2,7 @@
   Build a table, each item is (Key, Info) pair.
   And give a interface of query a string out of a table.
 
-  Copyright (c) 2005 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -2921,27 +2921,8 @@ TABLE_ITEM  StructureTypeInfoTable[] = {
 };
 
 
-UINT8
-QueryTable (
-  IN  TABLE_ITEM    *Table,
-  IN  UINTN         Number,
-  IN  UINT8         Key,
-  IN  OUT CHAR16    *Info
-  )
-/*++
-Routine Description:
-  Function Description
-    Given a table and a Key, return the responding info.
-
-  Arguments:
-    Table   -  The begin address of table
-    Number  -  The number of table items
-    Key     -  The query Key
-    Info    -  Input as empty buffer; output as data buffer.
-
-  Returns:
-    if Key found   - return found Key and Info
-    if Key unfound - return QUERY_TABLE_UNFOUND, Info=NULL
+/**
+  Given a table and a Key, return the responding info.
 
   Notes:
     Table[Index].Key is change from UINT8 to UINT16,
@@ -2955,7 +2936,23 @@ Routine Description:
     Then all the Key Value between Low and High gets the same string
     L"Unused".
 
+  @param[in] Table    The begin address of table.
+  @param[in] Number   The number of table items.
+  @param[in] Key      The query Key.
+  @param[in,out] Info Input as empty buffer; output as data buffer.
+  @param[in] InfoLen  The max number of characters for Info.
+
+  @return the found Key and Info is valid.
+  @retval QUERY_TABLE_UNFOUND and Info should be NULL.
 **/
+UINT8
+QueryTable (
+  IN  TABLE_ITEM    *Table,
+  IN  UINTN         Number,
+  IN  UINT8         Key,
+  IN  OUT CHAR16    *Info,
+  IN  UINTN         InfoLen
+  )
 {
   UINTN Index;
   //
@@ -2971,7 +2968,7 @@ Routine Description:
     // Check if Key is in the range
     //
     if (High > Low && Key >= Low && Key <= High) {
-      StrCpy (Info, Table[Index].Info);
+      StrnCpy (Info, Table[Index].Info, InfoLen-1);
       StrCat (Info, L"\n");
       return Key;
     }
@@ -2979,13 +2976,13 @@ Routine Description:
     // Check if Key == Value in the table
     //
     if (Table[Index].Key == Key) {
-      StrCpy (Info, Table[Index].Info);
+      StrnCpy (Info, Table[Index].Info, InfoLen-1);
       StrCat (Info, L"\n");
       return Key;
     }
   }
 
-  StrCpy (Info, L"Undefined Value\n");
+  StrnCpy (Info, L"Undefined Value\n", InfoLen);
   return QUERY_TABLE_UNFOUND;
 }
 
@@ -3069,7 +3066,7 @@ PrintBitsInfo (
     CHAR16  Info[66]; \
     Num = sizeof (Table) / sizeof (TABLE_ITEM); \
     ZeroMem (Info, sizeof (Info)); \
-    QueryTable (Table, Num, Key, Info); \
+    QueryTable (Table, Num, Key, Info, sizeof(Info)/sizeof(Info[0])); \
     Print (Info); \
   } while (0);
 
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.h b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.h
index adacc41cf3..1022132f10 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.h
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.h
@@ -2,7 +2,7 @@
   Build a table, each item is (key, info) pair.
   and give a interface of query a string out of a table.
 
-  Copyright (c) 2005 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -37,12 +37,37 @@ typedef struct TABLE_ITEM {
     } \
   } while (0);
 
+/**
+  Given a table and a Key, return the responding info.
+
+  Notes:
+    Table[Index].Key is change from UINT8 to UINT16,
+    in order to deal with "0xaa - 0xbb".
+
+    For example:
+      DisplaySELVariableDataFormatTypes(UINT8 Type, UINT8 Option)
+    has a item:
+      "0x07-0x7F,   Unused"
+    Now define Key = 0x7F07, that is to say: High = 0x7F, Low = 0x07.
+    Then all the Key Value between Low and High gets the same string
+    L"Unused".
+
+  @param[in] Table    The begin address of table.
+  @param[in] Number   The number of table items.
+  @param[in] Key      The query Key.
+  @param[in,out] Info Input as empty buffer; output as data buffer.
+  @param[in] InfoLen  The max number of characters for Info.
+
+  @return the found Key and Info is valid.
+  @retval QUERY_TABLE_UNFOUND and Info should be NULL.
+**/
 UINT8
 QueryTable (
   IN  TABLE_ITEM    *Table,
   IN  UINTN         Number,
   IN  UINT8         Key,
-  IN  OUT CHAR16    *Info
+  IN  OUT CHAR16    *Info,
+  IN  UINTN         InfoLen
   );
 
 VOID
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLib.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLib.c
index 226dd90397..cccec126b4 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLib.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLib.c
@@ -310,7 +310,9 @@ ConvertStringToGuid (
   TempCopy = StrnCatGrow(&TempCopy, NULL, StringGuid, 0);
   Walker   = TempCopy;
   TempSpot = StrStr(Walker, L"-");
-  *TempSpot = CHAR_NULL;
+  if (TempSpot != NULL) {
+    *TempSpot = CHAR_NULL;
+  }
   Status = ShellConvertStringToUint64(Walker, &TempVal, TRUE, FALSE);
   if (EFI_ERROR(Status)) {
     FreePool(TempCopy);
@@ -319,7 +321,9 @@ ConvertStringToGuid (
   Guid->Data1 = (UINT32)TempVal;
   Walker += 9;
   TempSpot = StrStr(Walker, L"-");
-  *TempSpot = CHAR_NULL;
+  if (TempSpot != NULL) {
+    *TempSpot = CHAR_NULL;
+  }
   Status = ShellConvertStringToUint64(Walker, &TempVal, TRUE, FALSE);
   if (EFI_ERROR(Status)) {
     FreePool(TempCopy);
@@ -328,7 +332,9 @@ ConvertStringToGuid (
   Guid->Data2 = (UINT16)TempVal;
   Walker += 5;
   TempSpot = StrStr(Walker, L"-");
-  *TempSpot = CHAR_NULL;
+  if (TempSpot != NULL) {
+    *TempSpot = CHAR_NULL;
+  }
   Status = ShellConvertStringToUint64(Walker, &TempVal, TRUE, FALSE);
   if (EFI_ERROR(Status)) {
     FreePool(TempCopy);
diff --git a/ShellPkg/Library/UefiShellInstall1CommandsLib/Bcfg.c b/ShellPkg/Library/UefiShellInstall1CommandsLib/Bcfg.c
index f5a2286657..ec03df1d60 100644
--- a/ShellPkg/Library/UefiShellInstall1CommandsLib/Bcfg.c
+++ b/ShellPkg/Library/UefiShellInstall1CommandsLib/Bcfg.c
@@ -265,27 +265,31 @@ BcfgAddInstall1(
     FilePathSize = GetDevicePathSize (FilePath);
 
     TempByteBuffer = AllocateZeroPool(sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize);
-    TempByteStart  = TempByteBuffer;
-    *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
-    TempByteBuffer += sizeof (UINT32);
+    if (TempByteBuffer != NULL) {
+      TempByteStart  = TempByteBuffer;
+      *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
+      TempByteBuffer += sizeof (UINT32);
 
-    *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
-    TempByteBuffer += sizeof (UINT16);
+      *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
+      TempByteBuffer += sizeof (UINT16);
 
-    CopyMem (TempByteBuffer, Desc, DescSize);
-    TempByteBuffer += DescSize;
-    CopyMem (TempByteBuffer, FilePath, FilePathSize);
+      CopyMem (TempByteBuffer, Desc, DescSize);
+      TempByteBuffer += DescSize;
+      CopyMem (TempByteBuffer, FilePath, FilePathSize);
 
-    UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
-    Status = gRT->SetVariable (
-          OptionStr,
-          &gEfiGlobalVariableGuid,
-          EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-          sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
-          TempByteStart
-         );
-
-    FreePool(TempByteStart);
+      UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
+      Status = gRT->SetVariable (
+            OptionStr,
+            &gEfiGlobalVariableGuid,
+            EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+            sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
+            TempByteStart
+           );
+
+      FreePool(TempByteStart);
+    } else {
+      Status = EFI_OUT_OF_RESOURCES;
+    }
 
     if (EFI_ERROR(Status)) {
       ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_SET_VAR_FAIL), gShellInstall1HiiHandle, OptionStr, Status);
@@ -385,22 +389,25 @@ BcfgRemoveInstall1(
     return (SHELL_INVALID_PARAMETER);
   }
   NewOrder = AllocateZeroPool(OrderCount*sizeof(CurrentOrder[0]));
-  NewCount = OrderCount;
-  CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
-  for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
-    if (NewOrder[LoopVar] == Location) {
-      CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
-      NewCount--;
+  if (NewOrder != NULL) {
+    NewCount = OrderCount;
+    CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
+    for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
+      if (NewOrder[LoopVar] == Location) {
+        CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
+        NewCount--;
+      }
     }
+    Status = gRT->SetVariable(
+      Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
+      (EFI_GUID*)&gEfiGlobalVariableGuid,
+      EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+      NewCount*sizeof(NewOrder[0]),
+      NewOrder);
+    FreePool(NewOrder);
+  } else {
+    Status = EFI_OUT_OF_RESOURCES;
   }
-  Status = gRT->SetVariable(
-    Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
-    (EFI_GUID*)&gEfiGlobalVariableGuid,
-    EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-    NewCount*sizeof(NewOrder[0]),
-    NewOrder);
-  FreePool(NewOrder);
-
   if (EFI_ERROR(Status)) {
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_WRITE_FAIL), gShellInstall1HiiHandle, Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder", Status);
     return (SHELL_INVALID_PARAMETER);
diff --git a/ShellPkg/Library/UefiShellLevel1CommandsLib/For.c b/ShellPkg/Library/UefiShellLevel1CommandsLib/For.c
index 006ce6c675..ddcfd45de3 100644
--- a/ShellPkg/Library/UefiShellLevel1CommandsLib/For.c
+++ b/ShellPkg/Library/UefiShellLevel1CommandsLib/For.c
@@ -86,7 +86,17 @@ ShellCommandRunEndFor (
   Found = MoveToTag(GetPreviousNode, L"for", L"endfor", NULL, ShellCommandGetCurrentScriptFile(), FALSE, FALSE, FALSE);
 
   if (!Found) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"For", L"EndFor", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"For", 
+      L"EndFor", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_NOT_FOUND);
   }
   return (SHELL_SUCCESS);
@@ -305,7 +315,16 @@ ShellCommandRunFor (
     // Make sure that an End exists.
     //
     if (!MoveToTag(GetNextNode, L"endfor", L"for", NULL, CurrentScriptFile, TRUE, TRUE, FALSE)) {
-      ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"EndFor", L"For", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+      ShellPrintHiiEx(
+        -1, 
+        -1, 
+        NULL, 
+        STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+        gShellLevel1HiiHandle, 
+        L"EndFor", 
+        L"For", 
+        CurrentScriptFile->CurrentCommand!=NULL
+          ?CurrentScriptFile->CurrentCommand->Line:0);
       return (SHELL_DEVICE_ERROR);
     }
 
diff --git a/ShellPkg/Library/UefiShellLevel1CommandsLib/Goto.c b/ShellPkg/Library/UefiShellLevel1CommandsLib/Goto.c
index 8213fae7ac..3e5a59c575 100644
--- a/ShellPkg/Library/UefiShellLevel1CommandsLib/Goto.c
+++ b/ShellPkg/Library/UefiShellLevel1CommandsLib/Goto.c
@@ -79,7 +79,17 @@ ShellCommandRunGoto (
       // Check forwards and then backwards for a label...
       //
       if (!MoveToTag(GetNextNode, L"endfor", L"for", CompareString, ShellCommandGetCurrentScriptFile(), FALSE, FALSE, TRUE)) {
-        ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, CompareString, L"Goto", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+        ShellPrintHiiEx(
+          -1, 
+          -1, 
+          NULL, 
+          STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+          gShellLevel1HiiHandle, 
+          CompareString, 
+          L"Goto", 
+          ShellCommandGetCurrentScriptFile()!=NULL
+            &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+              ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
         ShellStatus = SHELL_NOT_FOUND;
       }
     FreePool(CompareString);
diff --git a/ShellPkg/Library/UefiShellLevel1CommandsLib/If.c b/ShellPkg/Library/UefiShellLevel1CommandsLib/If.c
index 59069e568f..a3c4482bb3 100644
--- a/ShellPkg/Library/UefiShellLevel1CommandsLib/If.c
+++ b/ShellPkg/Library/UefiShellLevel1CommandsLib/If.c
@@ -844,7 +844,17 @@ ShellCommandRunIf (
   // Make sure that an End exists.
   //
   if (!MoveToTag(GetNextNode, L"endif", L"if", NULL, ShellCommandGetCurrentScriptFile(), TRUE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"EnfIf", L"If", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"EnfIf", 
+      L"If", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
@@ -983,16 +993,46 @@ ShellCommandRunElse (
 
 
   if (!MoveToTag(GetPreviousNode, L"if", L"endif", NULL, ShellCommandGetCurrentScriptFile(), FALSE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"If", L"Else", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"If", 
+      L"Else", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
   if (!MoveToTag(GetPreviousNode, L"if", L"else", NULL, ShellCommandGetCurrentScriptFile(), FALSE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"If", L"Else", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"If", 
+      L"Else", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
   if (!MoveToTag(GetNextNode, L"endif", L"if", NULL, ShellCommandGetCurrentScriptFile(), FALSE, FALSE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"EndIf", "Else", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"EndIf", 
+      "Else", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
@@ -1025,7 +1065,17 @@ ShellCommandRunEndIf (
   }
 
   if (!MoveToTag(GetPreviousNode, L"if", L"endif", NULL, ShellCommandGetCurrentScriptFile(), FALSE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"If", L"EndIf", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"If", 
+      L"EndIf", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
index 2b608a02cf..e7d19c9bed 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
@@ -330,6 +330,9 @@ MappingListHasType(
   //
   if (Specific != NULL) {
     NewSpecific = AllocateZeroPool(StrSize(Specific) + sizeof(CHAR16));
+    if (NewSpecific == NULL){
+      return FALSE;
+    }
     StrCpy(NewSpecific, Specific);
     if (NewSpecific[StrLen(NewSpecific)-1] != L':') {
       StrCat(NewSpecific, L":");
@@ -609,7 +612,7 @@ PerformMappingDisplay(
   // Get the map name(s) for each one.
   //
   for ( LoopVar = 0, Found = FALSE
-      ; LoopVar < (BufferSize / sizeof(EFI_HANDLE))
+      ; LoopVar < (BufferSize / sizeof(EFI_HANDLE)) && HandleBuffer != NULL
       ; LoopVar ++
      ){
     Status = PerformSingleMappingDisplay(
@@ -635,7 +638,7 @@ PerformMappingDisplay(
     &BufferSize,
     HandleBuffer);
   if (Status == EFI_BUFFER_TOO_SMALL) {
-    FreePool(HandleBuffer);
+    SHELL_FREE_NON_NULL(HandleBuffer);
     HandleBuffer = AllocateZeroPool(BufferSize);
     if (HandleBuffer == NULL) {
       return (SHELL_OUT_OF_RESOURCES);
@@ -897,6 +900,9 @@ AddMappingFromMapping(
   CHAR16                          *NewSName;
   
   NewSName = AllocateZeroPool(StrSize(SName) + sizeof(CHAR16));
+  if (NewSName == NULL) {
+    return (SHELL_OUT_OF_RESOURCES);
+  }
   StrCpy(NewSName, SName);
   if (NewSName[StrLen(NewSName)-1] != L':') {
     StrCat(NewSName, L":");
@@ -947,6 +953,9 @@ AddMappingFromHandle(
   CHAR16                    *NewSName;
   
   NewSName = AllocateZeroPool(StrSize(SName) + sizeof(CHAR16));
+  if (NewSName == NULL) {
+    return (SHELL_OUT_OF_RESOURCES);
+  }
   StrCpy(NewSName, SName);
   if (NewSName[StrLen(NewSName)-1] != L':') {
     StrCat(NewSName, L":");
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/TimeDate.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/TimeDate.c
index 115013a1e3..780b39e2fd 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/TimeDate.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/TimeDate.c
@@ -124,7 +124,7 @@ CheckAndSetDate (
   if (Walker1 != NULL) {
     Walker = Walker1 + 1;
   }
-  Walker1 = StrStr(Walker, L"/");
+  Walker1 = Walker!=NULL?StrStr(Walker, L"/"):NULL;
   if (Walker1 != NULL && *Walker1 == L'/') {
     *Walker1 = CHAR_NULL;
   }
@@ -133,7 +133,7 @@ CheckAndSetDate (
     if (Walker1 != NULL) {
       Walker = Walker1 + 1;
     }
-    Walker1 = StrStr(Walker, L"/");
+    Walker1 = Walker!=NULL?StrStr(Walker, L"/"):NULL;
     if (Walker1 != NULL && *Walker1 == L'/') {
       *Walker1 = CHAR_NULL;
     }
@@ -312,7 +312,7 @@ CheckAndSetTime (
     TheTime.Hour    = 0xFF;
     TheTime.Minute  = 0xFF;
 
-    Walker2          = StrStr(Walker1, L":");
+    Walker2          = Walker1!=NULL?StrStr(Walker1, L":"):NULL;
     if (Walker2 != NULL && *Walker2 == L':') {
       *Walker2 = CHAR_NULL;
     }
@@ -320,7 +320,7 @@ CheckAndSetTime (
     if (Walker2 != NULL) {
       Walker1 = Walker2 + 1;
     }
-    Walker2          = StrStr(Walker1, L":");
+    Walker2          = Walker1!=NULL?StrStr(Walker1, L":"):NULL;
     if (Walker2 != NULL && *Walker2 == L':') {
       *Walker2 = CHAR_NULL;
     }
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c
index e9cd0d0982..53b7770dfe 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c
@@ -97,6 +97,8 @@ HandleVol(
       SysInfo);
   }
 
+  ASSERT(SysInfo != NULL);
+
   if (Delete) {
     StrCpy ((CHAR16 *) SysInfo->VolumeLabel, L"");
     SysInfo->Size = SIZE_OF_EFI_FILE_SYSTEM_INFO + StrSize(SysInfo->VolumeLabel);
diff --git a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c
index 94c9c021ac..3bfdf847de 100644
--- a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c
+++ b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c
@@ -606,13 +606,19 @@ IfconfigGetAllNicInfoByHii (
     // Construct configuration request string header
     //
     ConfigHdr = ConstructConfigHdr (&gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE, ChildHandle);
-    Length = StrLen (ConfigHdr);
+    if (ConfigHdr != NULL) {
+      Length = StrLen (ConfigHdr);
+    } else {
+      Length = 0;
+    }
     ConfigResp = AllocateZeroPool ((Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
     if (ConfigResp == NULL) {
       Status = EFI_OUT_OF_RESOURCES;
       goto ON_ERROR;
     }
-    StrCpy (ConfigResp, ConfigHdr);
+    if (ConfigHdr != NULL) {
+      StrCpy (ConfigResp, ConfigHdr);
+    }
  
     //
     // Append OFFSET/WIDTH pair
@@ -772,10 +778,15 @@ IfconfigSetNicAddrByHii (
   // Construct config request string header
   //
   ConfigHdr = ConstructConfigHdr (&gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE, ChildHandle);
-
-  Length = StrLen (ConfigHdr);
+  if (ConfigHdr != NULL) {
+    Length = StrLen (ConfigHdr);
+  } else {
+    Length = 0;
+  }
   ConfigResp = AllocateZeroPool ((Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
-  StrCpy (ConfigResp, ConfigHdr);
+  if (ConfigHdr != NULL) {
+    StrCpy (ConfigResp, ConfigHdr);
+  }
 
   NicConfig = AllocateZeroPool (NIC_ITEM_CONFIG_SIZE);
   if (NicConfig == NULL) {
diff --git a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c
index 493de26f8a..7982f99c57 100644
--- a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c
+++ b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c
@@ -883,7 +883,7 @@ PingCreateIpInstance (
                   &HandleNum,
                   &HandleBuffer
                   );
-  if (EFI_ERROR (Status) || (HandleNum == 0)) {
+  if (EFI_ERROR (Status) || (HandleNum == 0) || (HandleBuffer == NULL)) {
     return EFI_ABORTED;
   }
   //