From: Qiu Shumin <shumin.qiu@intel.com>
Date: Tue, 30 Jun 2015 03:18:31 +0000 (+0000)
Subject: ShellPkg: Use safe string functions to refine code.
X-Git-Tag: edk2-stable201903~9543
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=e75390f02971bcd4d67a9696508050bee4936a01

ShellPkg: Use safe string functions to refine code.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17730 6f19259b-4bc3-4df7-8a09-765794883524
---

diff --git a/ShellPkg/Application/Shell/FileHandleWrappers.c b/ShellPkg/Application/Shell/FileHandleWrappers.c
index 984cd36957..fc68b78d57 100644
--- a/ShellPkg/Application/Shell/FileHandleWrappers.c
+++ b/ShellPkg/Application/Shell/FileHandleWrappers.c
@@ -2,7 +2,7 @@
   EFI_FILE_PROTOCOL wrappers for other items (Like Environment Variables,
   StdIn, StdOut, StdErr, etc...).
 
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
   (C) Copyright 2013 Hewlett-Packard Development Company, L.P.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -509,19 +509,23 @@ FileInterfaceStdInRead(
         if (StrStr(CurrentString + TabPos, L":") == NULL) {
           Cwd = ShellInfoObject.NewEfiShellProtocol->GetCurDir(NULL);
           if (Cwd != NULL) {
-            StrnCpy(TabStr, Cwd, (*BufferSize)/sizeof(CHAR16) - 1);
+            StrCpyS(TabStr, (*BufferSize)/sizeof(CHAR16), Cwd);
             if (TabStr[StrLen(TabStr)-1] == L'\\' && *(CurrentString + TabPos) == L'\\' ) {
               TabStr[StrLen(TabStr)-1] = CHAR_NULL;
             }
-            StrnCat(TabStr, CurrentString + TabPos, (StringLen - TabPos) * sizeof (CHAR16));
+            StrnCatS( TabStr, 
+                      (*BufferSize)/sizeof(CHAR16), 
+                      CurrentString + TabPos, 
+                      (StringLen - TabPos) * sizeof (CHAR16)
+                      );
           } else {
             *TabStr = CHAR_NULL;
-            StrnCat(TabStr, CurrentString + TabPos, (StringLen - TabPos) * sizeof (CHAR16));
+            StrnCatS(TabStr, (*BufferSize)/sizeof(CHAR16), CurrentString + TabPos, (StringLen - TabPos) * sizeof (CHAR16));
           }
         } else {
-          StrnCpy(TabStr, CurrentString + TabPos, (*BufferSize)/sizeof(CHAR16) - 1);
+          StrCpyS(TabStr, (*BufferSize)/sizeof(CHAR16), CurrentString + TabPos);
         }
-        StrnCat(TabStr, L"*", (*BufferSize)/sizeof(CHAR16) - 1 - StrLen(TabStr));
+        StrnCatS(TabStr, (*BufferSize)/sizeof(CHAR16), L"*", (*BufferSize)/sizeof(CHAR16) - 1 - StrLen(TabStr));
         FoundFileList = NULL;
         Status  = ShellInfoObject.NewEfiShellProtocol->FindFiles(TabStr, &FoundFileList);
         for ( TempStr = CurrentString
diff --git a/ShellPkg/Application/Shell/Shell.c b/ShellPkg/Application/Shell/Shell.c
index 377e1ca7b7..779bb53df6 100644
--- a/ShellPkg/Application/Shell/Shell.c
+++ b/ShellPkg/Application/Shell/Shell.c
@@ -1079,10 +1079,10 @@ DoStartupScript(
     if (FileStringPath == NULL) {
       return (EFI_OUT_OF_RESOURCES);
     }
-    StrnCpy(FileStringPath, ShellInfoObject.ShellInitSettings.FileName, NewSize/sizeof(CHAR16) -1);
+    StrCpyS(FileStringPath, NewSize/sizeof(CHAR16), ShellInfoObject.ShellInitSettings.FileName);
     if (ShellInfoObject.ShellInitSettings.FileOptions != NULL) {
-      StrnCat(FileStringPath, L" ", NewSize/sizeof(CHAR16) - StrLen(FileStringPath) -1);
-      StrnCat(FileStringPath, ShellInfoObject.ShellInitSettings.FileOptions, NewSize/sizeof(CHAR16) - StrLen(FileStringPath) -1);
+      StrnCatS(FileStringPath, NewSize/sizeof(CHAR16), L" ", NewSize/sizeof(CHAR16) - StrLen(FileStringPath) -1);
+      StrnCatS(FileStringPath, NewSize/sizeof(CHAR16), ShellInfoObject.ShellInitSettings.FileOptions, NewSize/sizeof(CHAR16) - StrLen(FileStringPath) -1);
     }
     Status = RunCommand(FileStringPath);
     FreePool(FileStringPath);
@@ -1488,11 +1488,20 @@ ShellConvertVariables (
     ;  MasterEnvList != NULL && *MasterEnvList != CHAR_NULL
     ;  MasterEnvList += StrLen(MasterEnvList) + 1
    ){
-    StrnCpy(ItemTemp, L"%", ((ItemSize+(2*sizeof(CHAR16)))/sizeof(CHAR16))-1);
-    StrnCat(ItemTemp, MasterEnvList, ((ItemSize+(2*sizeof(CHAR16)))/sizeof(CHAR16))-1 - StrLen(ItemTemp));
-    StrnCat(ItemTemp, L"%", ((ItemSize+(2*sizeof(CHAR16)))/sizeof(CHAR16))-1 - StrLen(ItemTemp));
+    StrCpyS( ItemTemp, 
+              ((ItemSize+(2*sizeof(CHAR16)))/sizeof(CHAR16)), 
+              L"%"
+              );
+    StrCatS( ItemTemp, 
+              ((ItemSize+(2*sizeof(CHAR16)))/sizeof(CHAR16)), 
+              MasterEnvList
+              );
+    StrCatS( ItemTemp, 
+              ((ItemSize+(2*sizeof(CHAR16)))/sizeof(CHAR16)), 
+              L"%"
+              );
     ShellCopySearchAndReplace(NewCommandLine1, NewCommandLine2, NewSize, ItemTemp, EfiShellGetEnv(MasterEnvList), TRUE, FALSE);
-    StrnCpy(NewCommandLine1, NewCommandLine2, NewSize/sizeof(CHAR16)-1);
+    StrCpyS(NewCommandLine1, NewSize/sizeof(CHAR16), NewCommandLine2);
   }
   if (CurrentScriptFile != NULL) {
     for (AliasListNode = (ALIAS_LIST*)GetFirstNode(&CurrentScriptFile->SubstList)
@@ -1500,7 +1509,7 @@ ShellConvertVariables (
       ;  AliasListNode = (ALIAS_LIST*)GetNextNode(&CurrentScriptFile->SubstList, &AliasListNode->Link)
    ){
     ShellCopySearchAndReplace(NewCommandLine1, NewCommandLine2, NewSize, AliasListNode->Alias, AliasListNode->CommandString, TRUE, FALSE);
-    StrnCpy(NewCommandLine1, NewCommandLine2, NewSize/sizeof(CHAR16)-1);
+    StrCpyS(NewCommandLine1, NewSize/sizeof(CHAR16), NewCommandLine2);
     }
   }
 
@@ -1513,7 +1522,7 @@ ShellConvertVariables (
   // Now cleanup any straggler intentionally ignored "%" characters
   //
   ShellCopySearchAndReplace(NewCommandLine1, NewCommandLine2, NewSize, L"^%", L"%", TRUE, FALSE);
-  StrnCpy(NewCommandLine1, NewCommandLine2, NewSize/sizeof(CHAR16)-1);
+  StrCpyS(NewCommandLine1, NewSize/sizeof(CHAR16), NewCommandLine2);
   
   FreePool(NewCommandLine2);
   FreePool(ItemTemp);
@@ -1991,6 +2000,7 @@ DoHelpUpdate(
   CHAR16 *Walker;
   CHAR16 *NewCommandLine;
   EFI_STATUS Status;
+  UINTN  NewCmdLineSize;
 
   Status = EFI_SUCCESS;
 
@@ -2005,7 +2015,8 @@ DoHelpUpdate(
       if (StrStr(CurrentParameter, L"-?") == CurrentParameter) {
         CurrentParameter[0] = L' ';
         CurrentParameter[1] = L' ';
-        NewCommandLine = AllocateZeroPool(StrSize(L"help ") + StrSize(*CmdLine));
+        NewCmdLineSize = StrSize(L"help ") + StrSize(*CmdLine);
+        NewCommandLine = AllocateZeroPool(NewCmdLineSize);
         if (NewCommandLine == NULL) {
           Status = EFI_OUT_OF_RESOURCES;
           break;
@@ -2014,8 +2025,8 @@ DoHelpUpdate(
         //
         // We know the space is sufficient since we just calculated it.
         //
-        StrnCpy(NewCommandLine, L"help ", 5);
-        StrnCat(NewCommandLine, *CmdLine, StrLen(*CmdLine));
+        StrnCpyS(NewCommandLine, NewCmdLineSize/sizeof(CHAR16), L"help ", 5);
+        StrnCatS(NewCommandLine, NewCmdLineSize/sizeof(CHAR16), *CmdLine, StrLen(*CmdLine));
         SHELL_FREE_NON_NULL(*CmdLine);
         *CmdLine = NewCommandLine;
         break;
@@ -2658,7 +2669,10 @@ RunScriptFileHandle (
       ; // conditional increment in the body of the loop
   ){
     ASSERT(CommandLine2 != NULL);
-    StrnCpy(CommandLine2, NewScriptFile->CurrentCommand->Cl, PcdGet16(PcdShellPrintBufferSize)/sizeof(CHAR16)-1);
+    StrCpyS( CommandLine2, 
+              PcdGet16(PcdShellPrintBufferSize)/sizeof(CHAR16), 
+              NewScriptFile->CurrentCommand->Cl
+              );
 
     //
     // NULL out comments
@@ -2679,7 +2693,10 @@ RunScriptFileHandle (
       //
       // Due to variability in starting the find and replace action we need to have both buffers the same.
       //
-      StrnCpy(CommandLine, CommandLine2, PcdGet16(PcdShellPrintBufferSize)/sizeof(CHAR16)-1);
+      StrCpyS( CommandLine, 
+                PcdGet16(PcdShellPrintBufferSize)/sizeof(CHAR16), 
+                CommandLine2
+                );
 
       //
       // Remove the %0 to %9 from the command line (if we have some arguments)
@@ -2731,7 +2748,10 @@ RunScriptFileHandle (
       Status = ShellCopySearchAndReplace(CommandLine,  CommandLine2, PcdGet16 (PcdShellPrintBufferSize), L"%8", L"\"\"", FALSE, FALSE);
       Status = ShellCopySearchAndReplace(CommandLine2,  CommandLine, PcdGet16 (PcdShellPrintBufferSize), L"%9", L"\"\"", FALSE, FALSE);
 
-      StrnCpy(CommandLine2, CommandLine, PcdGet16(PcdShellPrintBufferSize)/sizeof(CHAR16)-1);
+      StrCpyS( CommandLine2, 
+                PcdGet16(PcdShellPrintBufferSize)/sizeof(CHAR16), 
+                CommandLine
+                );
 
       LastCommand = NewScriptFile->CurrentCommand;
 
diff --git a/ShellPkg/Application/Shell/ShellEnvVar.c b/ShellPkg/Application/Shell/ShellEnvVar.c
index de09174c62..8ed14b34a2 100644
--- a/ShellPkg/Application/Shell/ShellEnvVar.c
+++ b/ShellPkg/Application/Shell/ShellEnvVar.c
@@ -339,7 +339,10 @@ SetEnvironmentVariables(
     //
     // Copy the string into the Key, leaving the last character allocated as NULL to terminate
     //
-    StrnCpy(Node->Key, CurrentString, StrStr(CurrentString, L"=") - CurrentString);
+    StrCpyS( Node->Key, 
+              StrStr(CurrentString, L"=") - CurrentString + 1, 
+              CurrentString
+              );
 
     //
     // ValueSize = TotalSize - already removed size - size for '=' + size for terminator (the last 2 items cancel each other)
diff --git a/ShellPkg/Application/Shell/ShellManParser.c b/ShellPkg/Application/Shell/ShellManParser.c
index 30470e1987..78b8decd83 100644
--- a/ShellPkg/Application/Shell/ShellManParser.c
+++ b/ShellPkg/Application/Shell/ShellManParser.c
@@ -1,7 +1,7 @@
 /** @file
   Provides interface to shell MAN file parser.
 
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -43,8 +43,16 @@ GetManFileName(
   } else {
     Buffer = AllocateZeroPool(StrSize(ManFileName) + 4*sizeof(CHAR16));
     if (Buffer != NULL) {
-      StrnCpy(Buffer, ManFileName, StrLen(ManFileName));
-      StrnCat(Buffer, L".man", 4);
+      StrnCpyS( Buffer, 
+                (StrSize(ManFileName) + 4*sizeof(CHAR16))/sizeof(CHAR16), 
+                ManFileName, 
+                StrLen(ManFileName)
+                );
+      StrnCatS( Buffer, 
+                (StrSize(ManFileName) + 4*sizeof(CHAR16))/sizeof(CHAR16),
+                L".man", 
+                4
+                );
     }
   }
   return (Buffer);
@@ -392,9 +400,9 @@ ManBufferFindTitleSection(
   if (TitleString == NULL) {
     return (EFI_OUT_OF_RESOURCES);
   }
-  StrnCpy(TitleString, StartString, TitleLength/sizeof(CHAR16) - 1);
-  StrnCat(TitleString, Command,     TitleLength/sizeof(CHAR16) - 1 - StrLen(TitleString));
-  StrnCat(TitleString, EndString,   TitleLength/sizeof(CHAR16) - 1 - StrLen(TitleString));
+  StrCpyS(TitleString, TitleLength/sizeof(CHAR16), StartString);
+  StrCatS(TitleString, TitleLength/sizeof(CHAR16), Command);
+  StrCatS(TitleString, TitleLength/sizeof(CHAR16), EndString);
 
   CurrentLocation = StrStr(*Buffer, TitleString);
   if (CurrentLocation == NULL){
@@ -418,7 +426,7 @@ ManBufferFindTitleSection(
         if (*BriefDesc == NULL) {
           Status = EFI_OUT_OF_RESOURCES;
         } else {
-          StrnCpy(*BriefDesc, CurrentLocation, TitleEnd-CurrentLocation);
+          StrnCpyS(*BriefDesc, (*BriefSize)/sizeof(CHAR16), CurrentLocation, TitleEnd-CurrentLocation);
         }
       }
 
@@ -495,8 +503,8 @@ ManFileFindTitleSection(
     FreePool(ReadLine);
     return (EFI_OUT_OF_RESOURCES);
   }
-  StrnCpy(TitleString, L".TH ", TitleSize/sizeof(CHAR16) - 1);
-  StrnCat(TitleString, Command, TitleSize/sizeof(CHAR16) - 1 - StrLen(TitleString));
+  StrCpyS(TitleString, TitleSize/sizeof(CHAR16), L".TH ");
+  StrCatS(TitleString, TitleSize/sizeof(CHAR16), Command);
 
   TitleLen = StrLen(TitleString);
   for (;!ShellFileHandleEof(Handle);Size = 1024) {
@@ -532,7 +540,7 @@ ManFileFindTitleSection(
           Status = EFI_OUT_OF_RESOURCES;
           break;
         }
-        StrnCpy(*BriefDesc, TitleEnd, (*BriefSize)/sizeof(CHAR16) - 1);
+        StrCpyS(*BriefDesc, (*BriefSize)/sizeof(CHAR16), TitleEnd);
       }
       break;
     }
diff --git a/ShellPkg/Application/Shell/ShellParametersProtocol.c b/ShellPkg/Application/Shell/ShellParametersProtocol.c
index 00b413e90b..de29c25ae8 100644
--- a/ShellPkg/Application/Shell/ShellParametersProtocol.c
+++ b/ShellPkg/Application/Shell/ShellParametersProtocol.c
@@ -125,7 +125,7 @@ DEBUG_CODE_END();
     return (EFI_NOT_FOUND);
   }
 
-  StrnCpy(*TempParameter, (*Walker), NextDelim - *Walker);
+  StrnCpyS(*TempParameter, Length, (*Walker), NextDelim - *Walker);
 
   //
   // Add a CHAR_NULL if we didnt get one via the copy
@@ -1012,7 +1012,7 @@ UpdateStdInStdOutStdErr(
   //
   // re-populate the string to support any filenames that were in quotes.
   //
-  StrnCpy(CommandLineCopy, NewCommandLine, StrLen(NewCommandLine));
+  StrnCpyS(CommandLineCopy, StrSize(CommandLineCopy)/sizeof(CHAR16), NewCommandLine, StrLen(NewCommandLine));
 
   if (FirstLocation != CommandLineCopy + StrLen(CommandLineCopy)
     && ((UINTN)(FirstLocation - CommandLineCopy) < StrLen(NewCommandLine))
diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c
index 72d42d7222..249e1e19d8 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -537,12 +537,12 @@ EfiShellGetDevicePathFromFilePath(
     if (NewPath == NULL) {
       return (NULL);
     }
-    StrnCpy(NewPath, Cwd, Size/sizeof(CHAR16)-1);
+    StrCpyS(NewPath, Size/sizeof(CHAR16), Cwd);
     if (*Path == L'\\') {
       Path++;
       while (PathRemoveLastItem(NewPath)) ;
     }
-    StrnCat(NewPath, Path, Size/sizeof(CHAR16) - 1 - StrLen(NewPath));
+    StrCatS(NewPath, Size/sizeof(CHAR16), Path);
     DevicePathForReturn = EfiShellGetDevicePathFromFilePath(NewPath);
     FreePool(NewPath);
     return (DevicePathForReturn);
@@ -2220,7 +2220,7 @@ ShellSearchHandle(
 
   CurrentFilePattern = AllocateZeroPool((NextFilePatternStart-FilePattern+1)*sizeof(CHAR16));
   ASSERT(CurrentFilePattern != NULL);
-  StrnCpy(CurrentFilePattern, FilePattern, NextFilePatternStart-FilePattern);
+  StrCpyS(CurrentFilePattern, NextFilePatternStart-FilePattern+1, FilePattern);
 
   if (CurrentFilePattern[0]   == CHAR_NULL
     &&NextFilePatternStart[0] == CHAR_NULL
@@ -2284,8 +2284,8 @@ ShellSearchHandle(
             if (NewFullName == NULL) {
               Status = EFI_OUT_OF_RESOURCES;
             } else {
-              StrnCpy(NewFullName, MapName, Size/sizeof(CHAR16)-1);
-              StrnCat(NewFullName, ShellInfoNode->FullName+1, (Size/sizeof(CHAR16))-StrLen(NewFullName)-1);
+              StrCpyS(NewFullName, Size/sizeof(CHAR16), MapName);
+              StrCatS(NewFullName, Size/sizeof(CHAR16), ShellInfoNode->FullName+1);
               FreePool((VOID*)ShellInfoNode->FullName);
               ShellInfoNode->FullName = NewFullName;
             }
@@ -2615,7 +2615,10 @@ EfiShellGetEnvEx(
       ; Node = (ENV_VAR_LIST*)GetNextNode(&List, &Node->Link)
      ){
       ASSERT(Node->Key != NULL);
-      StrnCpy(CurrentWriteLocation, Node->Key,  (Size)/sizeof(CHAR16) - (CurrentWriteLocation - ((CHAR16*)Buffer)) - 1);
+      StrCpyS( CurrentWriteLocation, 
+                (Size)/sizeof(CHAR16) - (CurrentWriteLocation - ((CHAR16*)Buffer)), 
+                Node->Key
+                );
       CurrentWriteLocation += StrLen(CurrentWriteLocation) + 1;
     }
 
@@ -3046,7 +3049,11 @@ EfiShellGetHelpText(
       FixCommand = AllocateZeroPool(StrSize(Command) - 4 * sizeof (CHAR16));
       ASSERT(FixCommand != NULL);
 
-      StrnCpy(FixCommand, Command, StrLen(Command)-4);
+      StrnCpyS( FixCommand, 
+                (StrSize(Command) - 4 * sizeof (CHAR16))/sizeof(CHAR16), 
+                Command, 
+                StrLen(Command)-4
+                );
       Status = ProcessManFile(FixCommand, FixCommand, Sections, NULL, HelpText);
       FreePool(FixCommand);
       return Status;
diff --git a/ShellPkg/Library/UefiDpLib/DpUtilities.c b/ShellPkg/Library/UefiDpLib/DpUtilities.c
index ef204ffef1..7290285e23 100644
--- a/ShellPkg/Library/UefiDpLib/DpUtilities.c
+++ b/ShellPkg/Library/UefiDpLib/DpUtilities.c
@@ -1,7 +1,7 @@
 /** @file
   Utility functions used by the Dp application.
 
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -141,10 +141,10 @@ GetShortPdbFileName (
   UINTN StartIndex;
   UINTN EndIndex;
 
-  ZeroMem (UnicodeBuffer, DXE_PERFORMANCE_STRING_LENGTH * sizeof (CHAR16));
+  ZeroMem (UnicodeBuffer, (DP_GAUGE_STRING_LENGTH + 1) * sizeof (CHAR16));
 
   if (PdbFileName == NULL) {
-    StrnCpy (UnicodeBuffer, L" ", 1);
+    StrnCpyS (UnicodeBuffer, DP_GAUGE_STRING_LENGTH + 1, L" ", 1);
   } else {
     StartIndex = 0;
     for (EndIndex = 0; PdbFileName[EndIndex] != 0; EndIndex++)
@@ -261,7 +261,7 @@ GetNameFromHandle (
                                );
     if (!EFI_ERROR (Status)) {
       SHELL_FREE_NON_NULL (PlatformLanguage);
-      StrnCpy (mGaugeString, StringPtr, DP_GAUGE_STRING_LENGTH);
+      StrCpyS (mGaugeString, DP_GAUGE_STRING_LENGTH + 1, StringPtr);
       mGaugeString[DP_GAUGE_STRING_LENGTH] = 0;
       return;
     }
@@ -305,7 +305,7 @@ GetNameFromHandle (
         //
         // Method 3. Get the name string from FFS UI section
         //
-        StrnCpy (mGaugeString, NameString, DP_GAUGE_STRING_LENGTH);
+        StrCpyS (mGaugeString, DP_GAUGE_STRING_LENGTH + 1, NameString);
         mGaugeString[DP_GAUGE_STRING_LENGTH] = 0;
         FreePool (NameString);
       } else {
@@ -321,7 +321,7 @@ GetNameFromHandle (
       //
       NameString = ConvertDevicePathToText (LoadedImageDevicePath, TRUE, FALSE);
       if (NameString != NULL) {
-        StrnCpy (mGaugeString, NameString, DP_GAUGE_STRING_LENGTH);
+        StrCpyS (mGaugeString, DP_GAUGE_STRING_LENGTH + 1, NameString);
         mGaugeString[DP_GAUGE_STRING_LENGTH] = 0;
         FreePool (NameString);
         return;
@@ -334,7 +334,7 @@ GetNameFromHandle (
   //
   StringPtr = HiiGetString (gDpHiiHandle, STRING_TOKEN (STR_DP_ERROR_NAME), NULL);
   ASSERT (StringPtr != NULL);
-  StrnCpy (mGaugeString, StringPtr, DP_GAUGE_STRING_LENGTH);
+  StrCpyS (mGaugeString, DP_GAUGE_STRING_LENGTH + 1, StringPtr);
   FreePool (StringPtr);
 }
 
diff --git a/ShellPkg/Library/UefiShellCommandLib/ConsistMapping.c b/ShellPkg/Library/UefiShellCommandLib/ConsistMapping.c
index 368d6a487b..9bd7b2cedd 100644
--- a/ShellPkg/Library/UefiShellCommandLib/ConsistMapping.c
+++ b/ShellPkg/Library/UefiShellCommandLib/ConsistMapping.c
@@ -1,7 +1,7 @@
 /** @file
   Main file for support of shell consist mapping.
 
-  Copyright (c) 2005 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution. The full text of the license may be found at
@@ -116,7 +116,7 @@ CatPrint (
     ASSERT (Str->Str != NULL);
   }
 
-  StrnCat (Str->Str, AppendStr, StringSize/sizeof(CHAR16) - 1 - StrLen(Str->Str));
+  StrCatS (Str->Str, StringSize/sizeof(CHAR16), AppendStr);
   Str->Len = StringSize;
 
   FreePool (AppendStr);
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/DmpStore.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/DmpStore.c
index 3ae61c9c3f..d818b9b8d4 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/DmpStore.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/DmpStore.c
@@ -2,7 +2,7 @@
   Main file for DmpStore shell Debug1 function.
    
   (C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2005 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -406,7 +406,7 @@ CascadeProcessVariables (
     FoundVarName = AllocateZeroPool (NameSize);
     if (FoundVarName != NULL) {
       if (PrevName != NULL) {
-        StrnCpy(FoundVarName, PrevName, NameSize/sizeof(CHAR16)-1);
+        StrCpyS(FoundVarName, NameSize/sizeof(CHAR16), PrevName);
       }
 
       Status = gRT->GetNextVariableName (&NameSize, FoundVarName, &FoundVarGuid);
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
index ed23365363..acd8512ff3 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
@@ -1,7 +1,7 @@
 /** @file
   Implements filebuffer interface functions.
 
-  Copyright (c) 2005 - 2014, Intel Corporation. All rights reserved. <BR>
+  Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved. <BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -507,7 +507,7 @@ FileBufferPrintLine (
   PrintLine = AllocatePool (BufLen);
   ASSERT (PrintLine != NULL);
 
-  StrnCpy (PrintLine, Buffer, MIN(Limit, MainEditor.ScreenSize.Column));
+  StrnCpyS (PrintLine, BufLen/sizeof(CHAR16), Buffer, MIN(Limit, MainEditor.ScreenSize.Column));
   for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
     PrintLine[Limit] = L' ';
   }
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c
index b91ae360ca..dd878c4cb7 100644
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c
@@ -3229,13 +3229,13 @@ QueryTable (
     //
     if ((High > Low && Key >= Low && Key <= High) 
       || (Table[Index].Key == Key)) {
-      StrnCpy (Info, Table[Index].Info, InfoLen-1);
-      StrnCat (Info, L"\n", InfoLen - 1 - StrLen(Info));
+      StrCpyS (Info, InfoLen, Table[Index].Info);
+      StrCatS (Info, InfoLen, L"\n");
       return Key;
     }
   }
 
-  StrnCpy (Info, L"Undefined Value\n", InfoLen - 1);
+  StrCpyS (Info, InfoLen, L"Undefined Value\n");
   return QUERY_TABLE_UNFOUND;
 }
 
diff --git a/ShellPkg/Library/UefiShellDriver1CommandsLib/Drivers.c b/ShellPkg/Library/UefiShellDriver1CommandsLib/Drivers.c
index f1c2a7f7bf..06bd351519 100644
--- a/ShellPkg/Library/UefiShellDriver1CommandsLib/Drivers.c
+++ b/ShellPkg/Library/UefiShellDriver1CommandsLib/Drivers.c
@@ -2,7 +2,7 @@
   Main file for Drivers shell Driver1 function.
 
   (C) Copyright 2012-2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -282,7 +282,7 @@ ShellCommandRunDrivers (
         TruncatedDriverName = NULL;
         if (!SfoFlag && (FullDriverName != NULL)) {
           TruncatedDriverName = AllocateZeroPool ((MAX_LEN_DRIVER_NAME + 1) * sizeof (CHAR16));
-          StrnCpy (TruncatedDriverName, FullDriverName, MAX_LEN_DRIVER_NAME);
+          StrCpyS (TruncatedDriverName, MAX_LEN_DRIVER_NAME + 1, FullDriverName);
         }
 
         ShellPrintEx(
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Cp.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Cp.c
index 8faa54beee..deff42e049 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Cp.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Cp.c
@@ -2,7 +2,7 @@
   Main file for cp shell level 2 function.
 
   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -427,20 +427,20 @@ ValidateAndCopyFiles(
         // simple copy of a single file
         //
         if (Cwd != NULL) {
-          StrnCpy(DestPath, Cwd, PathSize/sizeof(CHAR16)-1);
+          StrCpyS(DestPath, PathSize / sizeof(CHAR16), Cwd);
         } else {
           ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_GEN_DIR_NF), gShellLevel2HiiHandle, L"cp", CleanFilePathStr);  
           FreePool (CleanFilePathStr);
           return (SHELL_INVALID_PARAMETER);
         }
         if (DestPath[StrLen(DestPath)-1] != L'\\' && CleanFilePathStr[0] != L'\\') {
-          StrnCat(DestPath, L"\\", PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+          StrCatS(DestPath, PathSize / sizeof(CHAR16), L"\\");
         } else if (DestPath[StrLen(DestPath)-1] == L'\\' && CleanFilePathStr[0] == L'\\') {
           ((CHAR16*)DestPath)[StrLen(DestPath)-1] = CHAR_NULL;
         }
-        StrnCat(DestPath, CleanFilePathStr, PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+        StrCatS(DestPath, PathSize/sizeof(CHAR16), CleanFilePathStr);
       } else {
-        StrnCpy(DestPath, CleanFilePathStr, PathSize/sizeof(CHAR16) -1);
+        StrCpyS(DestPath, PathSize/sizeof(CHAR16), CleanFilePathStr);
       }
     } else {
       //
@@ -455,44 +455,44 @@ ValidateAndCopyFiles(
          // Copy to the root of CWD
          //
         if (Cwd != NULL) {
-          StrnCpy(DestPath, Cwd, PathSize/sizeof(CHAR16) -1);
+          StrCpyS(DestPath, PathSize/sizeof(CHAR16), Cwd);
         } else {
           ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_GEN_DIR_NF), gShellLevel2HiiHandle, L"cp",  CleanFilePathStr); 
           FreePool(CleanFilePathStr);
           return (SHELL_INVALID_PARAMETER);
         }
         while (PathRemoveLastItem(DestPath));
-        StrnCat(DestPath, CleanFilePathStr+1, PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
-        StrnCat(DestPath, Node->FileName, PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+        StrCatS(DestPath, PathSize/sizeof(CHAR16), CleanFilePathStr+1);
+        StrCatS(DestPath, PathSize/sizeof(CHAR16), Node->FileName);
       } else if (StrStr(CleanFilePathStr, L":") == NULL) {
         if (Cwd != NULL) {
-          StrnCpy(DestPath, Cwd, PathSize/sizeof(CHAR16) -1);
+          StrCpyS(DestPath, PathSize/sizeof(CHAR16), Cwd);
         } else {
           ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_GEN_DIR_NF), gShellLevel2HiiHandle, L"cp", CleanFilePathStr);  
           FreePool(CleanFilePathStr);
           return (SHELL_INVALID_PARAMETER);
         }
         if (DestPath[StrLen(DestPath)-1] != L'\\' && CleanFilePathStr[0] != L'\\') {
-          StrnCat(DestPath, L"\\", PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+          StrCatS(DestPath, PathSize/sizeof(CHAR16), L"\\");
         } else if (DestPath[StrLen(DestPath)-1] == L'\\' && CleanFilePathStr[0] == L'\\') {
           ((CHAR16*)DestPath)[StrLen(DestPath)-1] = CHAR_NULL;
         }
-        StrnCat(DestPath, CleanFilePathStr, PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+        StrCatS(DestPath, PathSize/sizeof(CHAR16), CleanFilePathStr);
         if (CleanFilePathStr[StrLen(CleanFilePathStr)-1] != L'\\' && Node->FileName[0] != L'\\') {
-          StrnCat(DestPath, L"\\", PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+          StrCatS(DestPath, PathSize/sizeof(CHAR16), L"\\");
         } else if (CleanFilePathStr[StrLen(CleanFilePathStr)-1] == L'\\' && Node->FileName[0] == L'\\') {
           ((CHAR16*)DestPath)[StrLen(DestPath)-1] = CHAR_NULL;
         }
-        StrnCat(DestPath, Node->FileName, PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+        StrCatS(DestPath, PathSize/sizeof(CHAR16), Node->FileName);
 
       } else {
-        StrnCpy(DestPath, CleanFilePathStr, PathSize/sizeof(CHAR16) -1);
+        StrCpyS(DestPath, PathSize/sizeof(CHAR16), CleanFilePathStr);
         if (CleanFilePathStr[StrLen(CleanFilePathStr)-1] != L'\\' && Node->FileName[0] != L'\\') {
-          StrnCat(DestPath, L"\\", PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+          StrCatS(DestPath, PathSize/sizeof(CHAR16), L"\\");
         } else if (CleanFilePathStr[StrLen(CleanFilePathStr)-1] == L'\\' && Node->FileName[0] == L'\\') {
           ((CHAR16*)CleanFilePathStr)[StrLen(CleanFilePathStr)-1] = CHAR_NULL;
         }
-        StrnCat(DestPath, Node->FileName, PathSize/sizeof(CHAR16) - StrLen(DestPath) -1);
+        StrCatS(DestPath, PathSize/sizeof(CHAR16), Node->FileName);
       }
     }
     
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Mv.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Mv.c
index c025cebe56..40ba00b493 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Mv.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Mv.c
@@ -2,7 +2,7 @@
   Main file for mv shell level 2 function.
 
   (C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -187,7 +187,7 @@ GetDestinationLocation(
     if (DestPath == NULL) {
       return (SHELL_OUT_OF_RESOURCES);
     }
-    StrCpy(DestPath, Cwd);
+    StrCpyS(DestPath, StrSize(Cwd) / sizeof(CHAR16), Cwd);
     while (PathRemoveLastItem(DestPath)) ;
 
     //
@@ -220,13 +220,13 @@ GetDestinationLocation(
         ShellCloseFileMetaArg(&DestList);
         return (SHELL_OUT_OF_RESOURCES);
       }
-      StrCpy(DestPath, Cwd);
+      StrCpyS(DestPath, NewSize / sizeof(CHAR16), Cwd);
       if (DestPath[StrLen(DestPath)-1] != L'\\' && DestParameter[0] != L'\\') {
-        StrCat(DestPath, L"\\");
+        StrCatS(DestPath, NewSize / sizeof(CHAR16), L"\\");
       } else if (DestPath[StrLen(DestPath)-1] == L'\\' && DestParameter[0] == L'\\') {
         ((CHAR16*)DestPath)[StrLen(DestPath)-1] = CHAR_NULL;
       }
-      StrCat(DestPath, DestParameter);
+      StrCatS(DestPath, NewSize / sizeof(CHAR16), DestParameter);
     } else {
       ASSERT(DestPath == NULL);
       DestPath = StrnCatGrow(&DestPath, NULL, DestParameter, 0);
@@ -256,8 +256,8 @@ GetDestinationLocation(
         ShellCloseFileMetaArg(&DestList);
         return (SHELL_OUT_OF_RESOURCES);
       }
-      StrCpy(DestPath, Node->FullName);
-      StrCat(DestPath, L"\\");
+      StrCpyS(DestPath, (StrSize(Node->FullName)+sizeof(CHAR16)) / sizeof(CHAR16), Node->FullName);
+      StrCatS(DestPath, (StrSize(Node->FullName)+sizeof(CHAR16)) / sizeof(CHAR16), L"\\");
     } else {
       //
       // cant move multiple files onto a single file.
@@ -351,11 +351,11 @@ CreateFullDestPath(
     return (EFI_OUT_OF_RESOURCES);
   }
 
-  StrnCpy(*FullDestPath, *DestPath, Size / sizeof(CHAR16) - 1);
+  StrCpyS(*FullDestPath, Size / sizeof(CHAR16), *DestPath);
   if ((*FullDestPath)[StrLen(*FullDestPath)-1] != L'\\' && FileName[0] != L'\\') {
-    StrnCat(*FullDestPath, L"\\",Size / sizeof(CHAR16) - 1 - StrLen(*FullDestPath));
+    StrCatS(*FullDestPath, Size / sizeof(CHAR16), L"\\");
   }
-  StrnCat(*FullDestPath, FileName, Size / sizeof(CHAR16) - 1 - StrLen(*FullDestPath));
+  StrCatS(*FullDestPath, Size / sizeof(CHAR16), FileName);
 
   return (EFI_SUCCESS);
 }
@@ -403,10 +403,10 @@ MoveWithinFileSystems(
   } else {
     CopyMem(NewFileInfo, Node->Info, SIZE_OF_EFI_FILE_INFO);
     if (DestPath[0] != L'\\') {
-      StrCpy(NewFileInfo->FileName, L"\\");
-      StrCat(NewFileInfo->FileName, DestPath);
+      StrCpyS(NewFileInfo->FileName, (NewSize - SIZE_OF_EFI_FILE_INFO) / sizeof(CHAR16), L"\\");
+      StrCatS(NewFileInfo->FileName, (NewSize - SIZE_OF_EFI_FILE_INFO) / sizeof(CHAR16), DestPath);
     } else {
-      StrCpy(NewFileInfo->FileName, DestPath);
+      StrCpyS(NewFileInfo->FileName, (NewSize - SIZE_OF_EFI_FILE_INFO) / sizeof(CHAR16), DestPath);
     }
     Length = StrLen(NewFileInfo->FileName);
     if (Length > 0) {
@@ -419,7 +419,7 @@ MoveWithinFileSystems(
         //
         NewFileInfo->FileName[Length] = CHAR_NULL;
       }
-      StrCat(NewFileInfo->FileName, Node->FileName);
+      StrCatS(NewFileInfo->FileName, (NewSize - SIZE_OF_EFI_FILE_INFO) / sizeof(CHAR16), Node->FileName);
     }
     NewFileInfo->Size = SIZE_OF_EFI_FILE_INFO + StrSize(NewFileInfo->FileName);
 
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Rm.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Rm.c
index e4176adfe0..a53a88c237 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Rm.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Rm.c
@@ -2,7 +2,7 @@
   Main file for attrib shell level 2 function.
 
   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -132,9 +132,9 @@ CascadeDelete(
           if (TempName == NULL) {
             ShellStatus = SHELL_OUT_OF_RESOURCES;
           } else {
-            StrnCpy(TempName, Node->FullName, NewSize/sizeof(CHAR16) -1);
+            StrCpyS(TempName, NewSize/sizeof(CHAR16), Node->FullName);
             TempName[StrStr(TempName, L":")+1-TempName] = CHAR_NULL;
-            StrnCat(TempName, Node2->FullName, NewSize/sizeof(CHAR16) -1 - StrLen(TempName));
+            StrCatS(TempName, NewSize/sizeof(CHAR16), Node2->FullName);
             FreePool((VOID*)Node2->FullName);
             Node2->FullName = TempName;
 
diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c
index 39b8ad9ec8..a6f0296d76 100644
--- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c
+++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c
@@ -2,7 +2,7 @@
   Main file for vol shell level 2 function.
 
   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2011 - 2015, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -120,7 +120,10 @@ HandleVol(
       } 
     }
     if (SysInfo != NULL) {
-      StrnCpy ((CHAR16 *) SysInfo->VolumeLabel, Name, (Size1 > Size2?Size1/sizeof(CHAR16):Size2/sizeof(CHAR16))-1);
+      StrCpyS ( (CHAR16 *) SysInfo->VolumeLabel, 
+                  (Size1>Size2? Size1/sizeof(CHAR16) : Size2/sizeof(CHAR16)), 
+                  Name
+                  );
       SysInfo->Size = SIZE_OF_EFI_FILE_SYSTEM_INFO + Size1;
       Status = EfiFpHandle->SetInfo(
         EfiFpHandle,
diff --git a/ShellPkg/Library/UefiShellLib/UefiShellLib.c b/ShellPkg/Library/UefiShellLib/UefiShellLib.c
index f82668b60f..5b4c6d3fb7 100644
--- a/ShellPkg/Library/UefiShellLib/UefiShellLib.c
+++ b/ShellPkg/Library/UefiShellLib/UefiShellLib.c
@@ -1713,8 +1713,8 @@ ShellFindFilePath (
     if (TestPath == NULL) {
       return (NULL);
     }
-    StrnCpy(TestPath, Path, Size/sizeof(CHAR16) - 1);
-    StrnCat(TestPath, FileName, Size/sizeof(CHAR16) - 1 - StrLen(TestPath));
+    StrCpyS(TestPath, Size/sizeof(CHAR16), Path);
+    StrCatS(TestPath, Size/sizeof(CHAR16), FileName);
     Status = ShellOpenFileByName(TestPath, &Handle, EFI_FILE_MODE_READ, 0);
     if (!EFI_ERROR(Status)){
       if (FileHandleIsDirectory(Handle) != EFI_SUCCESS) {
@@ -1746,12 +1746,12 @@ ShellFindFilePath (
           *TempChar = CHAR_NULL;
         }
         if (TestPath[StrLen(TestPath)-1] != L'\\') {
-          StrnCat(TestPath, L"\\", Size/sizeof(CHAR16) - 1 - StrLen(TestPath));
+          StrCatS(TestPath, Size/sizeof(CHAR16), L"\\");
         }
         if (FileName[0] == L'\\') {
           FileName++;
         }
-        StrnCat(TestPath, FileName, Size/sizeof(CHAR16) - 1 - StrLen(TestPath));
+        StrCatS(TestPath, Size/sizeof(CHAR16), FileName);
         if (StrStr(Walker, L";") != NULL) {
           Walker = StrStr(Walker, L";") + 1;
         } else {
@@ -1820,9 +1820,9 @@ ShellFindFilePathEx (
     return (NULL);
   }
   for (ExtensionWalker = FileExtension, TempChar2 = (CHAR16*)FileExtension;  TempChar2 != NULL ; ExtensionWalker = TempChar2 + 1){
-    StrnCpy(TestPath, FileName, Size/sizeof(CHAR16) - 1);
+    StrCpyS(TestPath, Size/sizeof(CHAR16), FileName);
     if (ExtensionWalker != NULL) {
-      StrnCat(TestPath, ExtensionWalker, Size/sizeof(CHAR16) - 1 - StrLen(TestPath));
+      StrCatS(TestPath, Size/sizeof(CHAR16), ExtensionWalker);
     }
     TempChar = StrStr(TestPath, L";");
     if (TempChar != NULL) {
@@ -2109,10 +2109,19 @@ InternalCommandLineParse (
       CurrentItemPackage->Value = ReallocatePool(ValueSize, CurrentValueSize, CurrentItemPackage->Value);
       ASSERT(CurrentItemPackage->Value != NULL);
       if (ValueSize == 0) {
-        StrnCpy(CurrentItemPackage->Value, Argv[LoopCounter], CurrentValueSize/sizeof(CHAR16) - 1);
+        StrCpyS( CurrentItemPackage->Value, 
+                  CurrentValueSize/sizeof(CHAR16), 
+                  Argv[LoopCounter]
+                  );
       } else {
-        StrnCat(CurrentItemPackage->Value, L" ", CurrentValueSize/sizeof(CHAR16) - 1 - StrLen(CurrentItemPackage->Value));
-        StrnCat(CurrentItemPackage->Value, Argv[LoopCounter], CurrentValueSize/sizeof(CHAR16) - 1 - StrLen(CurrentItemPackage->Value));
+        StrCatS( CurrentItemPackage->Value, 
+                  CurrentValueSize/sizeof(CHAR16), 
+                  L" "
+                  );
+        StrCatS( CurrentItemPackage->Value, 
+                  CurrentValueSize/sizeof(CHAR16), 
+                  Argv[LoopCounter]
+                  );
       }
       ValueSize += StrSize(Argv[LoopCounter]) + sizeof(CHAR16);
       
@@ -2635,14 +2644,14 @@ ShellCopySearchAndReplace(
         FreePool(Replace);
         return (EFI_BUFFER_TOO_SMALL);
       }
-      StrnCat(NewString, Replace, NewSize/sizeof(CHAR16) - 1 - StrLen(NewString));
+      StrCatS(NewString, NewSize/sizeof(CHAR16), Replace);
     } else {
       Size = StrSize(NewString);
       if (Size + sizeof(CHAR16) > NewSize) {
         FreePool(Replace);
         return (EFI_BUFFER_TOO_SMALL);
       }
-      StrnCat(NewString, SourceString, 1);
+      StrnCatS(NewString, NewSize/sizeof(CHAR16), SourceString, 1);
       SourceString++;
     }
   }
@@ -3254,7 +3263,9 @@ StrnCatGrow (
   if (*Destination == NULL) {
     return (NULL);
   }
-  return StrnCat(*Destination, Source, Count);
+  
+  StrCatS(*Destination, Count + 1, Source);
+  return *Destination;
 }
 
 /**
diff --git a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c
index 7c3f809853..fa00d6c6e9 100644
--- a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c
+++ b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c
@@ -2,7 +2,7 @@
   The implementation for ifcommand shell command.
 
   (C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -251,6 +251,8 @@ GetChildHandle (
   Append OFFSET/WIDTH/VALUE items at the beginning of string.
 
   @param[in, out]  String      The pointer to the string to append onto.
+  @param[in]       MaxLen      The max number of UNICODE char in String
+                               including the terminate NULL char.
   @param[in]       Offset      Offset value.
   @param[in]       Width       Width value.
   @param[in]       Block       Point to data buffer.
@@ -261,6 +263,7 @@ UINTN
 EFIAPI
 AppendOffsetWidthValue (
   IN OUT CHAR16               *String,
+  IN UINTN                    MaxLen,
   IN UINTN                    Offset,
   IN UINTN                    Width,
   IN CONST UINT8              *Block
@@ -271,16 +274,16 @@ AppendOffsetWidthValue (
 
   OriString = String;
 
-  StrnCpy (String, L"&OFFSET=", 9);
+  StrnCpyS (String, MaxLen, L"&OFFSET=", 9);
   String += StrLen (L"&OFFSET=");
   String += UnicodeSPrint (String, 20, L"%x", Offset);
 
-  StrnCpy (String,L"&WIDTH=", 8);
+  StrnCpyS (String, MaxLen, L"&WIDTH=", 8);
   String += StrLen (L"&WIDTH=");
   String += UnicodeSPrint (String, 20, L"%x", Width);
 
   if (Block != NULL) {
-    StrnCpy (String,L"&VALUE=", 8);
+    StrnCpyS (String, MaxLen, L"&VALUE=", 8);
     String += StrLen (L"&VALUE=");
     while ((Width--) != 0) {
       String += UnicodeSPrint (String, 20, L"%x", Block[Width]);
@@ -342,6 +345,7 @@ ConstructConfigHdr (
 {
   EFI_STATUS                 Status;
   CHAR16                     *ConfigHdr;
+  UINTN                      ConfigHdrBufferSize;
   EFI_DEVICE_PATH_PROTOCOL   *DevicePath;
   CHAR16                     *String;
   UINTN                      Index;
@@ -363,13 +367,14 @@ ConstructConfigHdr (
 
   DevicePathLength = GetDevicePathSize (DevicePath);
   NameLength = StrLen (Name);
-  ConfigHdr = AllocateZeroPool ((5 + sizeof (EFI_GUID) * 2 + 6 + NameLength * 4 + 6 + DevicePathLength * 2 + 1) * sizeof (CHAR16));
+  ConfigHdrBufferSize = (5 + sizeof (EFI_GUID) * 2 + 6 + NameLength * 4 + 6 + DevicePathLength * 2 + 1) * sizeof (CHAR16);
+  ConfigHdr = AllocateZeroPool (ConfigHdrBufferSize);
   if (ConfigHdr == NULL) {
     return NULL;
   } 
 
   String = ConfigHdr;
-  StrnCpy (String, L"GUID=", 6);
+  StrnCpyS (String, ConfigHdrBufferSize/sizeof(CHAR16), L"GUID=", 6);
   String += StrLen (L"GUID=");
 
   //
@@ -382,7 +387,7 @@ ConstructConfigHdr (
   //
   // Append L"&NAME="
   //
-  StrnCpy (String, L"&NAME=", 7);
+  StrnCpyS (String, ConfigHdrBufferSize/sizeof(CHAR16), L"&NAME=", 7);
   String += StrLen (L"&NAME=");
   for (Index = 0; Index < NameLength ; Index++) {
     String += UnicodeSPrint (String, 10, L"00%x", Name[Index]);
@@ -391,7 +396,7 @@ ConstructConfigHdr (
   //
   // Append L"&PATH="
   //
-  StrnCpy (String, L"&PATH=", 7);
+  StrnCpyS (String, ConfigHdrBufferSize/sizeof(CHAR16), L"&PATH=", 7);
   String += StrLen (L"&PATH=");
   for (Index = 0, Buffer = (UINT8 *) DevicePath; Index < DevicePathLength; Index++) {
     String += UnicodeSPrint (String, 6, L"%02x", *Buffer++);
@@ -548,6 +553,7 @@ IfconfigGetAllNicInfoByHii (
   EFI_HANDLE                    *Handles;
   UINTN                         HandleCount;
   CHAR16                        *ConfigResp;
+  UINTN                         ConfigRespBufferSize;
   CHAR16                        *ConfigHdr;
   UINTN                         Index;
   CHAR16                        *AccessProgress;
@@ -612,13 +618,14 @@ IfconfigGetAllNicInfoByHii (
     } else {
       Length = 0;
     }
-    ConfigResp = AllocateZeroPool ((Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
+    ConfigRespBufferSize = (Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16);
+    ConfigResp = AllocateZeroPool (ConfigRespBufferSize);
     if (ConfigResp == NULL) {
       Status = EFI_OUT_OF_RESOURCES;
       goto ON_ERROR;
     }
     if (ConfigHdr != NULL) {
-      StrnCpy (ConfigResp, ConfigHdr, Length + NIC_ITEM_CONFIG_SIZE * 2 + 100 - 1);
+      StrnCpyS (ConfigResp, ConfigRespBufferSize/sizeof(CHAR16), ConfigHdr, Length + NIC_ITEM_CONFIG_SIZE * 2 + 100 - 1);
     }
  
     //
@@ -626,7 +633,12 @@ IfconfigGetAllNicInfoByHii (
     //
     String = ConfigResp + Length;
     Offset = 0;
-    AppendOffsetWidthValue (String, Offset, NIC_ITEM_CONFIG_SIZE, NULL);
+    AppendOffsetWidthValue (String, 
+                            ConfigRespBufferSize/sizeof(CHAR16) - Length, 
+                            Offset, 
+                            NIC_ITEM_CONFIG_SIZE, 
+                            NULL
+                            );
 
     NicInfo = AllocateZeroPool (sizeof (NIC_INFO));
     if (NicInfo == NULL) {
@@ -754,6 +766,7 @@ IfconfigSetNicAddrByHii (
   SHELL_STATUS                  ShellStatus;
   NIC_IP4_CONFIG_INFO           *NicConfig;
   CHAR16                        *ConfigResp;
+  UINTN                         ConfigRespBufferSize;
   CHAR16                        *ConfigHdr;
   CHAR16                        *AccessProgress;
   CHAR16                        *AccessResults;
@@ -785,13 +798,14 @@ IfconfigSetNicAddrByHii (
     ShellStatus = SHELL_OUT_OF_RESOURCES;
     goto ON_EXIT;
   }
-  ConfigResp = AllocateZeroPool ((Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
+  ConfigRespBufferSize = (Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16);
+  ConfigResp = AllocateZeroPool (ConfigRespBufferSize);
   if (ConfigResp == NULL) {
     ShellStatus = SHELL_OUT_OF_RESOURCES;
     goto ON_EXIT;
   }
   if (ConfigHdr != NULL) {
-    StrnCpy (ConfigResp, ConfigHdr, Length + NIC_ITEM_CONFIG_SIZE * 2 + 100 - 1);
+    StrnCpyS (ConfigResp, ConfigRespBufferSize/sizeof(CHAR16), ConfigHdr, Length + NIC_ITEM_CONFIG_SIZE * 2 + 100 - 1);
   }
 
   NicConfig = AllocateZeroPool (NIC_ITEM_CONFIG_SIZE);
@@ -809,7 +823,12 @@ IfconfigSetNicAddrByHii (
   //
   String = ConfigResp + Length;
   Offset = 0;
-  AppendOffsetWidthValue (String, Offset, NIC_ITEM_CONFIG_SIZE, NULL);
+  AppendOffsetWidthValue (String, 
+                          ConfigRespBufferSize/sizeof(CHAR16) - Length,
+                          Offset, 
+                          NIC_ITEM_CONFIG_SIZE, 
+                          NULL
+                          );
 
   //
   // Call HII helper function to generate configuration string