From: Zhang Lubo <lubo.zhang@intel.com>
Date: Wed, 8 Jul 2015 12:17:11 +0000 (+0000)
Subject: NetworkPkg:Replace unsafe string functions.
X-Git-Tag: edk2-stable201903~9388
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=c960bdc2dcfad4ececbe208fbe3a25adea6dceea;ds=sidebyside

NetworkPkg:Replace unsafe string functions.

Replace unsafe string functions with new added safe string functions.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <lubo.zhang@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17887 6f19259b-4bc3-4df7-8a09-765794883524
---

diff --git a/NetworkPkg/Application/IfConfig6/IfConfig6.c b/NetworkPkg/Application/IfConfig6/IfConfig6.c
index 9e228ca7bc..4cec44f8d5 100644
--- a/NetworkPkg/Application/IfConfig6/IfConfig6.c
+++ b/NetworkPkg/Application/IfConfig6/IfConfig6.c
@@ -1,7 +1,7 @@
 /** @file
   The implementation for Shell application IfConfig6.
 
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -127,16 +127,15 @@ SplitStrToList (
   ARG_LIST    *ArgList;
   ARG_LIST    *ArgNode;
 
-  if (*String == L'\0') {
+  if (*String == L'\0' || *String == NULL) {
     return NULL;
   }
 
   //
   // Copy the CONST string to a local copy.
   //
-  Str     = (CHAR16 *) AllocateZeroPool (StrSize (String));
+  Str     = AllocateCopyPool (StrSize (String), String);
   ASSERT (Str != NULL);
-  Str     = StrnCpy (Str, String, StrLen (String));
   ArgStr  = Str;
 
   //
@@ -1717,10 +1716,8 @@ IfConfig6Initialize (
     Private->OpCode = IfConfig6OpList;
     ValueStr = ShellCommandLineGetValue (ParamPackage, L"-l");
     if (ValueStr != NULL) {
-      Str             = (CHAR16 *) AllocateZeroPool (StrSize (ValueStr));
+      Str             = AllocateCopyPool (StrSize (ValueStr), ValueStr);
       ASSERT (Str != NULL);
-
-      Str             = StrnCpy (Str, ValueStr, StrLen (ValueStr));
       Private->IfName = Str;
     }
   }
@@ -1731,10 +1728,8 @@ IfConfig6Initialize (
     Private->OpCode = IfConfig6OpClear;
     ValueStr = ShellCommandLineGetValue (ParamPackage, L"-r");
     if (ValueStr != NULL) {
-      Str             = (CHAR16 *) AllocateZeroPool (StrSize (ValueStr));
+      Str             = AllocateCopyPool (StrSize (ValueStr), ValueStr);
       ASSERT (Str != NULL);
-
-      Str             = StrnCpy (Str, ValueStr, StrLen (ValueStr));
       Private->IfName = Str;
     }
   }
diff --git a/NetworkPkg/Application/IpsecConfig/Indexer.c b/NetworkPkg/Application/IpsecConfig/Indexer.c
index 9e066b1cb5..83ceda4b57 100644
--- a/NetworkPkg/Application/IpsecConfig/Indexer.c
+++ b/NetworkPkg/Application/IpsecConfig/Indexer.c
@@ -1,7 +1,7 @@
 /** @file
   The implementation of construct ENTRY_INDEXER in IpSecConfig application.
 
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -235,7 +235,7 @@ ConstructPadIndexer (
 
       Indexer->PadId.PeerIdValid = TRUE;
       ZeroMem (Indexer->PadId.Id.PeerId, MAX_PEERID_LEN);
-      StrnCpy ((CHAR16 *) Indexer->PadId.Id.PeerId, ValueStr, ARRAY_SIZE (Indexer->PadId.Id.PeerId) - 1);
+      StrnCpyS ((CHAR16 *) Indexer->PadId.Id.PeerId, MAX_PEERID_LEN / sizeof (CHAR16), ValueStr, MAX_PEERID_LEN / sizeof (CHAR16) - 1);
     }
   }
 
diff --git a/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c b/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c
index 7e04573022..970caa16ca 100644
--- a/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c
+++ b/NetworkPkg/Application/IpsecConfig/PolicyEntryOperation.c
@@ -1,7 +1,7 @@
 /** @file
   The implementation of policy entry operation function in IpSecConfig application.
 
-  Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -1104,7 +1104,7 @@ CreatePadEntry (
   ValueStr = ShellCommandLineGetValue (ParamPackage, L"--peer-id");
   if (ValueStr != NULL) {
     (*PadId)->PeerIdValid = TRUE;
-    StrnCpy ((CHAR16 *) (*PadId)->Id.PeerId, ValueStr, ARRAY_SIZE ((*PadId)->Id.PeerId) - 1);
+    StrnCpyS ((CHAR16 *) (*PadId)->Id.PeerId, MAX_PEERID_LEN / sizeof (CHAR16), ValueStr, MAX_PEERID_LEN / sizeof (CHAR16) - 1);
     *Mask |= PEER_ID;
   }
 
@@ -1399,7 +1399,7 @@ CombineSpdEntry (
   // Process Data
   //
   if ((Mask & NAME) != 0) {
-    AsciiStrCpy ((CHAR8 *) OldData->Name, (CHAR8 *) NewData->Name);
+    AsciiStrCpyS ((CHAR8 *) OldData->Name, MAX_PEERID_LEN, (CHAR8 *) NewData->Name);
   }
 
   if ((Mask & PACKET_FLAG) != 0) {
diff --git a/NetworkPkg/IScsiDxe/IScsiConfig.c b/NetworkPkg/IScsiDxe/IScsiConfig.c
index 5cb11572bb..69a400389d 100644
--- a/NetworkPkg/IScsiDxe/IScsiConfig.c
+++ b/NetworkPkg/IScsiDxe/IScsiConfig.c
@@ -2393,7 +2393,7 @@ IScsiFormCallback (
           NULL
           );
       } else {
-        AsciiStrCpy (Private->Current->SessionConfigData.TargetName, IScsiName);
+        AsciiStrCpyS (Private->Current->SessionConfigData.TargetName, ISCSI_NAME_MAX_SIZE, IScsiName);
       }
 
       break;
diff --git a/NetworkPkg/IScsiDxe/IScsiDhcp.c b/NetworkPkg/IScsiDxe/IScsiDhcp.c
index 3706256db5..fa2412ebd8 100644
--- a/NetworkPkg/IScsiDxe/IScsiDhcp.c
+++ b/NetworkPkg/IScsiDxe/IScsiDhcp.c
@@ -175,7 +175,7 @@ IScsiDhcpExtractRootPath (
     goto ON_EXIT;
   }
 
-  AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+  AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);
 
 ON_EXIT:
 
diff --git a/NetworkPkg/IScsiDxe/IScsiDhcp6.c b/NetworkPkg/IScsiDxe/IScsiDhcp6.c
index 2627a59dd6..331b0f161b 100644
--- a/NetworkPkg/IScsiDxe/IScsiDhcp6.c
+++ b/NetworkPkg/IScsiDxe/IScsiDhcp6.c
@@ -1,7 +1,7 @@
 /** @file
   iSCSI DHCP6 related configuration routines.
 
-Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -203,7 +203,7 @@ IScsiDhcp6ExtractRootPath (
     goto ON_EXIT;
   }
 
-  AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+  AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);
 
 ON_EXIT:
 
diff --git a/NetworkPkg/IScsiDxe/IScsiExtScsiPassThru.c b/NetworkPkg/IScsiDxe/IScsiExtScsiPassThru.c
index c785853bd8..f9712449b5 100644
--- a/NetworkPkg/IScsiDxe/IScsiExtScsiPassThru.c
+++ b/NetworkPkg/IScsiDxe/IScsiExtScsiPassThru.c
@@ -1,7 +1,7 @@
 /** @file
   The implementation of EFI_EXT_SCSI_PASS_THRU_PROTOCOL.
 
-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -273,7 +273,7 @@ IScsiExtScsiPassThruBuildDevicePath (
 
   CopyMem (&Node->Iscsi.Lun, ConfigNvData->BootLun, sizeof (UINT64));
   Node->Iscsi.TargetPortalGroupTag = Session->TargetPortalGroupTag;
-  AsciiStrCpy ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), ConfigNvData->TargetName);
+  AsciiStrCpyS ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), AsciiStrLen (ConfigNvData->TargetName) + 1, ConfigNvData->TargetName);
 
   *DevicePath = (EFI_DEVICE_PATH_PROTOCOL *) Node;
 
diff --git a/NetworkPkg/Mtftp6Dxe/Mtftp6Support.c b/NetworkPkg/Mtftp6Dxe/Mtftp6Support.c
index f5b22313ee..91680b2466 100644
--- a/NetworkPkg/Mtftp6Dxe/Mtftp6Support.c
+++ b/NetworkPkg/Mtftp6Dxe/Mtftp6Support.c
@@ -1,7 +1,7 @@
 /** @file
   Mtftp6 support functions implementation.
 
-  Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -512,19 +512,22 @@ Mtftp6SendRequest (
 
   Packet->OpCode = HTONS (Operation);
   Cur            = Packet->Rrq.Filename;
-  Cur            = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Token->Filename);
+  Cur            = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2, (CHAR8 *) Token->Filename);
   Cur           += AsciiStrLen ((CHAR8 *) Token->Filename) + 1;
-  Cur            = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Mode);
+  Cur            = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2 - (AsciiStrLen ((CHAR8 *) Token->Filename) + 1), (CHAR8 *) Mode);
   Cur           += AsciiStrLen ((CHAR8 *) Mode) + 1;
+  Len -= ((UINT32) AsciiStrLen ((CHAR8 *) Token->Filename) + (UINT32) AsciiStrLen ((CHAR8 *) Mode) + 4);
 
   //
   // Copy all the extension options into the packet.
   //
   for (Index = 0; Index < Token->OptionCount; ++Index) {
-    Cur  = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].OptionStr);
+    Cur  = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].OptionStr);
     Cur += AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1;
-    Cur  = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].ValueStr);
+    Len -= (UINT32)(AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1);
+    Cur  = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].ValueStr);
     Cur += AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1;
+    Len -= (UINT32)(AsciiStrLen ((CHAR8 *) Options[Index].ValueStr) + 1);
   }
 
   //
@@ -584,7 +587,7 @@ Mtftp6SendError (
   TftpError->OpCode          = HTONS (EFI_MTFTP6_OPCODE_ERROR);
   TftpError->Error.ErrorCode = HTONS (ErrCode);
 
-  AsciiStrCpy ((CHAR8 *) TftpError->Error.ErrorMessage, (CHAR8 *) ErrInfo);
+  AsciiStrCpyS ((CHAR8 *) TftpError->Error.ErrorMessage, sizeof (TftpError->Error.ErrorMessage) / sizeof (TftpError->Error.ErrorMessage[0]), (CHAR8 *) ErrInfo);
 
   //
   // Save the packet buf for retransmit
diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
index 09196c7ac6..270190d42e 100644
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
@@ -1,7 +1,7 @@
 /** @file
   Functions implementation related with Mtftp for UefiPxeBc Driver.
 
-  Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -64,10 +64,11 @@ PxeBcMtftp6CheckPacket (
     //
     Private->Mode.TftpErrorReceived   = TRUE;
     Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
-    AsciiStrnCpy (
+    AsciiStrnCpyS (
       Private->Mode.TftpError.ErrorString,
+      PXE_MTFTP_ERROR_STRING_LENGTH,
       (CHAR8 *) Packet->Error.ErrorMessage,
-      PXE_MTFTP_ERROR_STRING_LENGTH
+      PXE_MTFTP_ERROR_STRING_LENGTH - 1
       );
     Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
   }
@@ -151,13 +152,13 @@ PxeBcMtftp6GetFileSize (
   // Build the required options for get info.
   //
   ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
-  PxeBcUintnToAscDec (0, OptBuf);
+  PxeBcUintnToAscDec (0, OptBuf, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
   ReqOpt[0].ValueStr  = OptBuf;
 
   if (BlockSize != NULL) {
     ReqOpt[1].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[1].ValueStr  = (UINT8 *) (ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1);
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[1].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[1].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
     OptCnt++;
   }
 
@@ -178,10 +179,11 @@ PxeBcMtftp6GetFileSize (
       //
       Private->Mode.TftpErrorReceived   = TRUE;
       Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
-      AsciiStrnCpy (
+      AsciiStrnCpyS (
         Private->Mode.TftpError.ErrorString,
+        PXE_MTFTP_ERROR_STRING_LENGTH,
         (CHAR8 *) Packet->Error.ErrorMessage,
-        PXE_MTFTP_ERROR_STRING_LENGTH
+        PXE_MTFTP_ERROR_STRING_LENGTH - 1
         );
       Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
     }
@@ -273,7 +275,7 @@ PxeBcMtftp6ReadFile (
   if (BlockSize != NULL) {
     ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[0].ValueStr  = OptBuf;
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
     OptCnt++;
   }
 
@@ -356,7 +358,7 @@ PxeBcMtftp6WriteFile (
   if (BlockSize != NULL) {
     ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[0].ValueStr  = OptBuf;
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
     OptCnt++;
   }
 
@@ -431,7 +433,7 @@ PxeBcMtftp6ReadDirectory (
   if (BlockSize != NULL) {
     ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[0].ValueStr  = OptBuf;
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
     OptCnt++;
   }
 
@@ -508,10 +510,11 @@ PxeBcMtftp4CheckPacket (
     //
     Private->Mode.TftpErrorReceived   = TRUE;
     Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
-    AsciiStrnCpy (
+    AsciiStrnCpyS (
       Private->Mode.TftpError.ErrorString,
+      PXE_MTFTP_ERROR_STRING_LENGTH,
       (CHAR8 *) Packet->Error.ErrorMessage,
-      PXE_MTFTP_ERROR_STRING_LENGTH
+      PXE_MTFTP_ERROR_STRING_LENGTH - 1
       );
     Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
   }
@@ -595,13 +598,13 @@ PxeBcMtftp4GetFileSize (
   // Build the required options for get info.
   //
   ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
-  PxeBcUintnToAscDec (0, OptBuf);
+  PxeBcUintnToAscDec (0, OptBuf, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
   ReqOpt[0].ValueStr  = OptBuf;
 
   if (BlockSize != NULL) {
     ReqOpt[1].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[1].ValueStr  = (UINT8 *) (ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1);
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[1].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[1].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
     OptCnt++;
   }
 
@@ -622,10 +625,11 @@ PxeBcMtftp4GetFileSize (
       //
       Private->Mode.TftpErrorReceived   = TRUE;
       Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
-      AsciiStrnCpy (
+      AsciiStrnCpyS (
         Private->Mode.TftpError.ErrorString,
+        PXE_MTFTP_ERROR_STRING_LENGTH,
         (CHAR8 *) Packet->Error.ErrorMessage,
-        PXE_MTFTP_ERROR_STRING_LENGTH
+        PXE_MTFTP_ERROR_STRING_LENGTH - 1
         );
       Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
     }
@@ -717,7 +721,7 @@ PxeBcMtftp4ReadFile (
   if (BlockSize != NULL) {
     ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[0].ValueStr  = OptBuf;
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
     OptCnt++;
   }
 
@@ -800,7 +804,7 @@ PxeBcMtftp4WriteFile (
   if (BlockSize != NULL) {
     ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[0].ValueStr  = OptBuf;
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
     OptCnt++;
   }
 
@@ -875,7 +879,7 @@ PxeBcMtftp4ReadDirectory (
   if (BlockSize != NULL) {
     ReqOpt[0].OptionStr = (UINT8 *) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
     ReqOpt[0].ValueStr  = OptBuf;
-    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr);
+    PxeBcUintnToAscDec (*BlockSize, ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
     OptCnt++;
   }
 
diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.h b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.h
index 1064195a82..f1150762c6 100644
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.h
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.h
@@ -1,7 +1,7 @@
 /** @file
   Functions declaration related with Mtftp for UefiPxeBc Driver.
 
-  Copyright (c) 2007 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -21,6 +21,7 @@
 #define PXE_MTFTP_OPTION_TSIZE_INDEX       2
 #define PXE_MTFTP_OPTION_MULTICAST_INDEX   3
 #define PXE_MTFTP_OPTION_MAXIMUM_INDEX     4
+#define PXE_MTFTP_OPTBUF_MAXNUM_INDEX      128
 
 #define PXE_MTFTP_ERROR_STRING_LENGTH      127   // refer to definition of struct EFI_PXE_BASE_CODE_TFTP_ERROR.
 #define PXE_MTFTP_DEFAULT_BLOCK_SIZE       512   // refer to rfc-1350.
diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
index 88ae7b6a7a..36b0665a96 100644
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
@@ -1,7 +1,7 @@
 /** @file
   Support functions implementation for UefiPxeBc Driver.
 
-  Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -1392,6 +1392,7 @@ PxeBcUintnToAscDecWithFormat (
 
   @param[in]  Number         Numeric value to be converted.
   @param[in]  Buffer         The pointer to the buffer for ASCII string.
+  @param[in]  BufferSize     The maxsize of the buffer.
 
   @return     Length         The actual length of the ASCII string.
 
@@ -1399,7 +1400,8 @@ PxeBcUintnToAscDecWithFormat (
 UINTN
 PxeBcUintnToAscDec (
   IN UINTN               Number,
-  IN UINT8               *Buffer
+  IN UINT8               *Buffer,
+  IN UINTN               BufferSize
   )
 {
   UINTN           Index;
@@ -1415,7 +1417,7 @@ PxeBcUintnToAscDec (
     Number         = (UINTN) (Number / 10);
   } while (Number != 0);
 
-  AsciiStrCpy ((CHAR8 *) Buffer, &TempStr[Index]);
+  AsciiStrCpyS ((CHAR8 *) Buffer, BufferSize, &TempStr[Index]);
 
   Length = AsciiStrLen ((CHAR8 *) Buffer);
 
diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.h b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.h
index fc99fadad6..0a43aeb79b 100644
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.h
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.h
@@ -448,14 +448,16 @@ PxeBcUintnToAscDecWithFormat (
 
   @param[in]  Number         Numeric value to be converted.
   @param[in]  Buffer         Pointer to the buffer for ASCII string.
-
+  @param[in]  BufferSize     The maxsize of the buffer.
+  
   @return     Length         The actual length of the ASCII string.
 
 **/
 UINTN
 PxeBcUintnToAscDec (
   IN UINTN               Number,
-  IN UINT8               *Buffer
+  IN UINT8               *Buffer,
+  IN UINTN               BufferSize
   );
 
 /**