Fix a security hole in shell binaries:

For gBS->LoadImage() if the return status is EFI_SECURITY_VIOLATION, the image handle may not be NULL.
Shell environment should not have the assumption that the output ImageHandle must be NULL if the error status is returned by gBS->LoadImage().

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@9838 6f19259b-4bc3-4df7-8a09-765794883524

92 files changed, 18 insertions, 2 deletions

diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Dblk.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Dblk.efi
index 104879a2bc..6ddc3ae13a 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Dblk.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Dblk.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Devices.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Devices.efi
index 9caf7f7266..fad072a051 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Devices.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Devices.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Devtree.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Devtree.efi
index e955e1a89c..43512226a3 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Devtree.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Devtree.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Guid.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Guid.efi
index bf11f0d9b4..a0f49d27aa 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Guid.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Guid.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/IfConfig.efi b/EdkShellBinPkg/Bin/Ia32/Apps/IfConfig.efi
index 312e517ee2..299da06b50 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/IfConfig.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/IfConfig.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/IpConfig.efi b/EdkShellBinPkg/Bin/Ia32/Apps/IpConfig.efi
index 216a7be4c7..091b88b5a7 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/IpConfig.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/IpConfig.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/LoadPciRom.efi b/EdkShellBinPkg/Bin/Ia32/Apps/LoadPciRom.efi
index b5dd97f51b..49b680a9a9 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/LoadPciRom.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/LoadPciRom.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Mount.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Mount.efi
index 56ade1c95b..071f320f92 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Mount.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Mount.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Openinfo.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Openinfo.efi
index 2b8f35b0f4..909b37a63d 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Openinfo.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Openinfo.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/Ping.efi b/EdkShellBinPkg/Bin/Ia32/Apps/Ping.efi
index 5af429e870..995251d37a 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/Ping.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/Ping.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/SmbiosView.efi b/EdkShellBinPkg/Bin/Ia32/Apps/SmbiosView.efi
index 29e473723c..54b8313b6e 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/SmbiosView.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/SmbiosView.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/TelnetMgmt.efi b/EdkShellBinPkg/Bin/Ia32/Apps/TelnetMgmt.efi
index 4731764bbc..802dd5be5c 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/TelnetMgmt.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/TelnetMgmt.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/comp.efi b/EdkShellBinPkg/Bin/Ia32/Apps/comp.efi
index 6f270b1ce7..858b401970 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/comp.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/comp.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/dmem.efi b/EdkShellBinPkg/Bin/Ia32/Apps/dmem.efi
index c3241347fb..64ae8614b0 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/dmem.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/dmem.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/dmpstore.efi b/EdkShellBinPkg/Bin/Ia32/Apps/dmpstore.efi
index 759d0967a0..a9204632be 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/dmpstore.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/dmpstore.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/edit.efi b/EdkShellBinPkg/Bin/Ia32/Apps/edit.efi
index acf3aa17aa..8914cb6c5e 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/edit.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/edit.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/eficompress.efi b/EdkShellBinPkg/Bin/Ia32/Apps/eficompress.efi
index 9552fe07c2..8459d04823 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/eficompress.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/eficompress.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/efidecompress.efi b/EdkShellBinPkg/Bin/Ia32/Apps/efidecompress.efi
index 2238af9a02..0d26d19827 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/efidecompress.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/efidecompress.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/err.efi b/EdkShellBinPkg/Bin/Ia32/Apps/err.efi
index 073e77d626..690a46ba4f 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/err.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/err.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/hexedit.efi b/EdkShellBinPkg/Bin/Ia32/Apps/hexedit.efi
index c8ccad0d96..9339b7f92c 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/hexedit.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/hexedit.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/mem.efi b/EdkShellBinPkg/Bin/Ia32/Apps/mem.efi
index 32318c8f6a..279b374b3e 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/mem.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/mem.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/memmap.efi b/EdkShellBinPkg/Bin/Ia32/Apps/memmap.efi
index c94ef49a78..4e9a8ad485 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/memmap.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/memmap.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/mm.efi b/EdkShellBinPkg/Bin/Ia32/Apps/mm.efi
index 77ab9f835c..967093e7a5 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/mm.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/mm.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/mode.efi b/EdkShellBinPkg/Bin/Ia32/Apps/mode.efi
index 9ffe2a61a8..02ce6b23bc 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/mode.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/mode.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/pci.efi b/EdkShellBinPkg/Bin/Ia32/Apps/pci.efi
index 1593a8f07d..2f9a0452a5 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/pci.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/pci.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/sermode.efi b/EdkShellBinPkg/Bin/Ia32/Apps/sermode.efi
index 1a7b0cc707..ce3bd24775 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/sermode.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/sermode.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/stall.efi b/EdkShellBinPkg/Bin/Ia32/Apps/stall.efi
index cf059d171d..2511644e00 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/stall.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/stall.efi
diff --git a/EdkShellBinPkg/Bin/Ia32/Apps/timezone.efi b/EdkShellBinPkg/Bin/Ia32/Apps/timezone.efi
index 18427940be..b2c87688c9 100644
--- a/EdkShellBinPkg/Bin/Ia32/Apps/timezone.efi
+++ b/EdkShellBinPkg/Bin/Ia32/Apps/timezone.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Dblk.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Dblk.efi
index d45552f2e0..a1c6ba455e 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Dblk.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Dblk.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Devices.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Devices.efi
index 8e6aad254b..193ae20acb 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Devices.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Devices.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Devtree.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Devtree.efi
index cebd77e4b1..649031ca96 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Devtree.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Devtree.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Guid.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Guid.efi
index 3f1c0fd7a1..f53f5b0c29 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Guid.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Guid.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/IfConfig.efi b/EdkShellBinPkg/Bin/Ipf/Apps/IfConfig.efi
index 6823865ac5..8ce71854c9 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/IfConfig.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/IfConfig.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/IpConfig.efi b/EdkShellBinPkg/Bin/Ipf/Apps/IpConfig.efi
index 8dccbde4d8..de78afeb4f 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/IpConfig.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/IpConfig.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/LoadPciRom.efi b/EdkShellBinPkg/Bin/Ipf/Apps/LoadPciRom.efi
index 3be69d1b05..2893adb493 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/LoadPciRom.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/LoadPciRom.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Mount.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Mount.efi
index 5809ecb1d4..3d1dad21a3 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Mount.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Mount.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Openinfo.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Openinfo.efi
index d781a5340d..74076518c1 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Openinfo.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Openinfo.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/Ping.efi b/EdkShellBinPkg/Bin/Ipf/Apps/Ping.efi
index b5bad29c9a..1f69265a31 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/Ping.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/Ping.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/SmbiosView.efi b/EdkShellBinPkg/Bin/Ipf/Apps/SmbiosView.efi
index 0ed43f474e..6191d1e889 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/SmbiosView.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/SmbiosView.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/TelnetMgmt.efi b/EdkShellBinPkg/Bin/Ipf/Apps/TelnetMgmt.efi
index 44eb55d110..ef4e32a372 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/TelnetMgmt.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/TelnetMgmt.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/comp.efi b/EdkShellBinPkg/Bin/Ipf/Apps/comp.efi
index 48fcde6c77..5fe5627d98 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/comp.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/comp.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/dmem.efi b/EdkShellBinPkg/Bin/Ipf/Apps/dmem.efi
index e3404c168f..5fe3ceba68 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/dmem.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/dmem.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/dmpstore.efi b/EdkShellBinPkg/Bin/Ipf/Apps/dmpstore.efi
index 531a5f5a83..325c4cb360 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/dmpstore.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/dmpstore.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/edit.efi b/EdkShellBinPkg/Bin/Ipf/Apps/edit.efi
index 40e0420079..9bff0fd179 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/edit.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/edit.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/eficompress.efi b/EdkShellBinPkg/Bin/Ipf/Apps/eficompress.efi
index 89403a975d..adf071617c 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/eficompress.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/eficompress.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/efidecompress.efi b/EdkShellBinPkg/Bin/Ipf/Apps/efidecompress.efi
index 61319bbd5e..5e7dc0e5c3 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/efidecompress.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/efidecompress.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/err.efi b/EdkShellBinPkg/Bin/Ipf/Apps/err.efi
index 52667c4e18..3a6b6d7132 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/err.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/err.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/hexedit.efi b/EdkShellBinPkg/Bin/Ipf/Apps/hexedit.efi
index 5e99f582b9..55027c8cf0 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/hexedit.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/hexedit.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/mem.efi b/EdkShellBinPkg/Bin/Ipf/Apps/mem.efi
index d2e5530605..0a8b0c86e4 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/mem.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/mem.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/memmap.efi b/EdkShellBinPkg/Bin/Ipf/Apps/memmap.efi
index 4f56b5fe75..b1755b7e06 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/memmap.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/memmap.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/mm.efi b/EdkShellBinPkg/Bin/Ipf/Apps/mm.efi
index 33f5a1b9db..7d7ebde72a 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/mm.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/mm.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/mode.efi b/EdkShellBinPkg/Bin/Ipf/Apps/mode.efi
index b54d36bbf9..807dfa6507 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/mode.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/mode.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/pci.efi b/EdkShellBinPkg/Bin/Ipf/Apps/pci.efi
index ef0232ed67..9dbb666986 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/pci.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/pci.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/sermode.efi b/EdkShellBinPkg/Bin/Ipf/Apps/sermode.efi
index 3d2cf4a4b3..aebb8d7981 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/sermode.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/sermode.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/stall.efi b/EdkShellBinPkg/Bin/Ipf/Apps/stall.efi
index ec351a88a6..a85e0310f5 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/stall.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/stall.efi
diff --git a/EdkShellBinPkg/Bin/Ipf/Apps/timezone.efi b/EdkShellBinPkg/Bin/Ipf/Apps/timezone.efi
index 4802b5500a..15683ef3b4 100644
--- a/EdkShellBinPkg/Bin/Ipf/Apps/timezone.efi
+++ b/EdkShellBinPkg/Bin/Ipf/Apps/timezone.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Dblk.efi b/EdkShellBinPkg/Bin/X64/Apps/Dblk.efi
index dc4f29fc19..dabd93e6d7 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Dblk.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Dblk.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Devices.efi b/EdkShellBinPkg/Bin/X64/Apps/Devices.efi
index 957b3a5850..7067407f68 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Devices.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Devices.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Devtree.efi b/EdkShellBinPkg/Bin/X64/Apps/Devtree.efi
index 3005dcb1fd..811c456091 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Devtree.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Devtree.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Guid.efi b/EdkShellBinPkg/Bin/X64/Apps/Guid.efi
index 4fe3587390..b13a851d0a 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Guid.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Guid.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/IfConfig.efi b/EdkShellBinPkg/Bin/X64/Apps/IfConfig.efi
index b8899ff3b9..2a5d110849 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/IfConfig.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/IfConfig.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/IpConfig.efi b/EdkShellBinPkg/Bin/X64/Apps/IpConfig.efi
index ee2e244490..df0cddfb60 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/IpConfig.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/IpConfig.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/LoadPciRom.efi b/EdkShellBinPkg/Bin/X64/Apps/LoadPciRom.efi
index 73e96080f6..25516b4f8c 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/LoadPciRom.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/LoadPciRom.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Mount.efi b/EdkShellBinPkg/Bin/X64/Apps/Mount.efi
index fcfe2191e3..ca780a04c0 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Mount.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Mount.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Openinfo.efi b/EdkShellBinPkg/Bin/X64/Apps/Openinfo.efi
index b6e3aecfb7..dc6e4c250a 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Openinfo.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Openinfo.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/Ping.efi b/EdkShellBinPkg/Bin/X64/Apps/Ping.efi
index f509b2f684..c46df50cf8 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/Ping.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/Ping.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/SmbiosView.efi b/EdkShellBinPkg/Bin/X64/Apps/SmbiosView.efi
index effc7d469e..a846d25699 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/SmbiosView.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/SmbiosView.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/TelnetMgmt.efi b/EdkShellBinPkg/Bin/X64/Apps/TelnetMgmt.efi
index febb97afec..1e6d9dd757 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/TelnetMgmt.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/TelnetMgmt.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/comp.efi b/EdkShellBinPkg/Bin/X64/Apps/comp.efi
index 1497c6c062..af2d2a8adf 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/comp.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/comp.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/dmem.efi b/EdkShellBinPkg/Bin/X64/Apps/dmem.efi
index b4f1bd6414..91eb3a4e0d 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/dmem.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/dmem.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/dmpstore.efi b/EdkShellBinPkg/Bin/X64/Apps/dmpstore.efi
index 540b653d7d..5588b57070 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/dmpstore.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/dmpstore.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/edit.efi b/EdkShellBinPkg/Bin/X64/Apps/edit.efi
index 8a63921036..5187fba1c3 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/edit.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/edit.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/eficompress.efi b/EdkShellBinPkg/Bin/X64/Apps/eficompress.efi
index f551f0086d..c186539078 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/eficompress.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/eficompress.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/efidecompress.efi b/EdkShellBinPkg/Bin/X64/Apps/efidecompress.efi
index a8cda7170d..cffe2b147c 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/efidecompress.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/efidecompress.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/err.efi b/EdkShellBinPkg/Bin/X64/Apps/err.efi
index 6468d0cf16..19872103a6 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/err.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/err.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/hexedit.efi b/EdkShellBinPkg/Bin/X64/Apps/hexedit.efi
index 630f07c75b..e423d9dfcb 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/hexedit.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/hexedit.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/mem.efi b/EdkShellBinPkg/Bin/X64/Apps/mem.efi
index 51da8e480e..18a3557f64 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/mem.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/mem.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/memmap.efi b/EdkShellBinPkg/Bin/X64/Apps/memmap.efi
index 2258d3b9d8..2404724088 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/memmap.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/memmap.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/mm.efi b/EdkShellBinPkg/Bin/X64/Apps/mm.efi
index 91393ce081..f241998569 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/mm.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/mm.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/mode.efi b/EdkShellBinPkg/Bin/X64/Apps/mode.efi
index 2a4f44d31b..bae7cfec44 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/mode.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/mode.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/pci.efi b/EdkShellBinPkg/Bin/X64/Apps/pci.efi
index 0fd1883099..8edee34ab8 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/pci.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/pci.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/sermode.efi b/EdkShellBinPkg/Bin/X64/Apps/sermode.efi
index a77e6c5dfb..c33cdc8a9a 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/sermode.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/sermode.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/stall.efi b/EdkShellBinPkg/Bin/X64/Apps/stall.efi
index 3fb1dbb5e8..21ed51c36e 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/stall.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/stall.efi
diff --git a/EdkShellBinPkg/Bin/X64/Apps/timezone.efi b/EdkShellBinPkg/Bin/X64/Apps/timezone.efi
index b54605b008..b0baa0fa91 100644
--- a/EdkShellBinPkg/Bin/X64/Apps/timezone.efi
+++ b/EdkShellBinPkg/Bin/X64/Apps/timezone.efi
diff --git a/EdkShellBinPkg/FullShell/Ia32/Shell_Full.efi b/EdkShellBinPkg/FullShell/Ia32/Shell_Full.efi
index 8af463b578..c416e96881 100644
--- a/EdkShellBinPkg/FullShell/Ia32/Shell_Full.efi
+++ b/EdkShellBinPkg/FullShell/Ia32/Shell_Full.efi
diff --git a/EdkShellBinPkg/FullShell/Ipf/Shell_Full.efi b/EdkShellBinPkg/FullShell/Ipf/Shell_Full.efi
index c18a1ec292..b31790f4f4 100644
--- a/EdkShellBinPkg/FullShell/Ipf/Shell_Full.efi
+++ b/EdkShellBinPkg/FullShell/Ipf/Shell_Full.efi
diff --git a/EdkShellBinPkg/FullShell/X64/Shell_full.efi b/EdkShellBinPkg/FullShell/X64/Shell_full.efi
index 23290306c4..b39268dd53 100644
--- a/EdkShellBinPkg/FullShell/X64/Shell_full.efi
+++ b/EdkShellBinPkg/FullShell/X64/Shell_full.efi
diff --git a/EdkShellBinPkg/MinimumShell/Ia32/Shell.efi b/EdkShellBinPkg/MinimumShell/Ia32/Shell.efi
index fb4ac3fc7e..974f3802b9 100644
--- a/EdkShellBinPkg/MinimumShell/Ia32/Shell.efi
+++ b/EdkShellBinPkg/MinimumShell/Ia32/Shell.efi
diff --git a/EdkShellBinPkg/MinimumShell/Ipf/Shell.efi b/EdkShellBinPkg/MinimumShell/Ipf/Shell.efi
index be21bc6bfb..f2a27cda8b 100644
--- a/EdkShellBinPkg/MinimumShell/Ipf/Shell.efi
+++ b/EdkShellBinPkg/MinimumShell/Ipf/Shell.efi
diff --git a/EdkShellBinPkg/MinimumShell/X64/Shell.efi b/EdkShellBinPkg/MinimumShell/X64/Shell.efi
index cef9217ab0..ee61fc1958 100644
--- a/EdkShellBinPkg/MinimumShell/X64/Shell.efi
+++ b/EdkShellBinPkg/MinimumShell/X64/Shell.efi
diff --git a/EdkShellBinPkg/ReadMe.txt b/EdkShellBinPkg/ReadMe.txt
index e4a2e335d8..75a2f60cd5 100644
--- a/EdkShellBinPkg/ReadMe.txt
+++ b/EdkShellBinPkg/ReadMe.txt
@@ -1,10 +1,11 @@
-The binaries of EdkShellBinPkg are generated with Efi-Shell-Dev-Snapshot-20091214.zip and build with Edk Compatibility & BaseTools Package

+The binaries of EdkShellBinPkg are generated with Efi-Shell-Dev-Snapshot-20091214.zip (plus a security hot-fix see EdkShellbinPkg\SecurityPatch.diff) and build with Edk Compatibility & BaseTools Package

 (r9623)

 

 The following steps can help to re-generate these binaries for customization:

 1. Check out EdkCompatibilityPkg (r9623) to $(WORKSPACE)\EdkCompatibilityPkg (svn https://edk2.tianocore.org/svn/edk2/trunk/edk2/EdkCompatibilityPkg).

 2. Check out EdkShellPkg(r9623) to $(WORKSPACE)\EdkShellPkg (svn https://edk2.tianocore.org/svn/edk2/trunk/edk2/EdkShellPkg).

-3  Check out Edk Shell project source (r36) to $(WORKSPACE) (svn https://efi-shell.tianocore.org/svn/efi-shell/trunk/Shell).  It is read-only and current revison (r36) is identical to Efi-Shell-Dev-Snapshot-20091214.zip. 

+3a.Check out Edk Shell project source (r36) to $(WORKSPACE) (svn https://efi-shell.tianocore.org/svn/efi-shell/trunk/Shell).  It is read-only and current revison (r36) is identical to Efi-Shell-Dev-Snapshot-20091214.zip. 

+3b.Apply the security hot fix in EdkShellBinPkg\SecurityPatch.diff to patch in Shell\shellenv\exec.c

 4. Update to the newest BaseTools package. (r9623 or later)

 5. Under workspace directory (i.e. c:\EdkII), 

    To generate Minimum Shell, execute: "build -a IA32 -a X64 -a IPF -p EdkShellPkg\EdkShellPkg.dsc -m EdkShellPkg\Shell\Shell.inf" 

diff --git a/EdkShellBinPkg/SecurityPatch.diff b/EdkShellBinPkg/SecurityPatch.diff
new file mode 100644
index 0000000000..01a05c065a
--- /dev/null
+++ b/EdkShellBinPkg/SecurityPatch.diff
@@ -0,0 +1,15 @@
+Index: shellenv/exec.c

+===================================================================

+--- shellenv/exec.c	(revision 36)

++++ shellenv/exec.c	(working copy)

+@@ -2079,6 +2079,10 @@

+         if (!EFI_ERROR (Status)) {
+           goto Done;
+         } else {
++          //
++          // Set ImageHandle to NULL if any error status is returned.
++          //
++          ImageHandle = NULL;
+           Status = LibGetImageHeader (
+                      DevicePath,
+                      &DosHeader,