4 files changed, 18 insertions, 20 deletions
diff --git a/MdeModulePkg/Application/UiApp/BootMaint/BootOption.c b/MdeModulePkg/Application/UiApp/BootMaint/BootOption.c
index fa88f6344f..5213e3cc98 100644
--- a/MdeModulePkg/Application/UiApp/BootMaint/BootOption.c
+++ b/MdeModulePkg/Application/UiApp/BootMaint/BootOption.c
@@ -786,7 +786,7 @@ BOpt_GetBootOptions (
 
     NewLoadContext->Description = AllocateZeroPool (StrSize((UINT16*)LoadOptionPtr));
     ASSERT (NewLoadContext->Description != NULL);
-    StrCpy (NewLoadContext->Description, (UINT16*)LoadOptionPtr);
+    StrCpyS (NewLoadContext->Description, StrSize((UINT16*)LoadOptionPtr) / sizeof (UINT16), (UINT16*)LoadOptionPtr);
     
     ASSERT (NewLoadContext->Description != NULL);
     NewMenuEntry->DisplayString = NewLoadContext->Description;
@@ -862,27 +862,25 @@ BOpt_AppendFileName (
   IN  CHAR16  *Str2
   )
 {
-  UINTN   Size1;
-  UINTN   Size2;
+  UINTN   DestMax;
   CHAR16  *Str;
   CHAR16  *TmpStr;
   CHAR16  *Ptr;
   CHAR16  *LastSlash;
 
-  Size1 = StrSize (Str1);
-  Size2 = StrSize (Str2);
-  Str   = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
+  DestMax = (StrSize (Str1) + StrSize (Str2) + sizeof (CHAR16)) / sizeof (CHAR16);
+  Str   = AllocateZeroPool (DestMax * sizeof (CHAR16));
   ASSERT (Str != NULL);
 
-  TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16)); 
+  TmpStr = AllocateZeroPool (DestMax * sizeof (CHAR16)); 
   ASSERT (TmpStr != NULL);
 
-  StrCat (Str, Str1);
+  StrCatS (Str, DestMax, Str1);
   if (!((*Str == '\\') && (*(Str + 1) == 0))) {
-    StrCat (Str, L"\\");
+    StrCatS (Str, DestMax, L"\\");
   }
 
-  StrCat (Str, Str2);
+  StrCatS (Str, DestMax, Str2);
 
   Ptr       = Str;
   LastSlash = Str;
@@ -895,11 +893,11 @@ BOpt_AppendFileName (
       //
 
       //
-      // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings 
+      // Use TmpStr as a backup, as StrCpyS in BaseLib does not handle copy of two strings 
       // that overlap.
       //
-      StrCpy (TmpStr, Ptr + 3);
-      StrCpy (LastSlash, TmpStr);
+      StrCpyS (TmpStr, DestMax, Ptr + 3);
+      StrCpyS (LastSlash, DestMax - (UINTN) (LastSlash - Str), TmpStr);
       Ptr = LastSlash;
     } else if (*Ptr == '\\' && *(Ptr + 1) == '.' && *(Ptr + 2) == '\\') {
       //
@@ -907,11 +905,11 @@ BOpt_AppendFileName (
       //
 
       //
-      // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings 
+      // Use TmpStr as a backup, as StrCpyS in BaseLib does not handle copy of two strings 
       // that overlap.
       //
-      StrCpy (TmpStr, Ptr + 2);
-      StrCpy (Ptr, TmpStr);
+      StrCpyS (TmpStr, DestMax, Ptr + 2);
+      StrCpyS (Ptr, DestMax - (UINTN) (Ptr - Str), TmpStr);
       Ptr = LastSlash;
     } else if (*Ptr == '\\') {
       LastSlash = Ptr;
diff --git a/MdeModulePkg/Application/UiApp/BootMaint/FormGuid.h b/MdeModulePkg/Application/UiApp/BootMaint/FormGuid.h
index c80d7921a0..ab3d9c9aa6 100644
--- a/MdeModulePkg/Application/UiApp/BootMaint/FormGuid.h
+++ b/MdeModulePkg/Application/UiApp/BootMaint/FormGuid.h
@@ -195,7 +195,7 @@ typedef struct {
 /// This is the data structure used by File Explorer formset
 ///
 typedef struct {
-  UINT16  DescriptionData[75];
+  UINT16  DescriptionData[MAX_MENU_NUMBER];
   UINT16  OptionalData[127];
   UINT8   Active;
   UINT8   ForceReconnect;
diff --git a/MdeModulePkg/Application/UiApp/BootMaint/UpdatePage.c b/MdeModulePkg/Application/UiApp/BootMaint/UpdatePage.c
index d85f2eaef9..0e85a832c1 100644
--- a/MdeModulePkg/Application/UiApp/BootMaint/UpdatePage.c
+++ b/MdeModulePkg/Application/UiApp/BootMaint/UpdatePage.c
@@ -838,7 +838,7 @@ UpdateConModePage (
     //
     UnicodeValueToString (ModeString, 0, Col, 0);
     PStr = &ModeString[0];
-    StrnCat (PStr, L" x ", StrLen(L" x ") + 1);
+    StrnCatS (PStr, sizeof (ModeString) / sizeof (ModeString[0]), L" x ", StrLen(L" x ") + 1);
     PStr = PStr + StrLen (PStr);
     UnicodeValueToString (PStr , 0, Row, 0);
 
diff --git a/MdeModulePkg/Application/UiApp/BootMaint/Variable.c b/MdeModulePkg/Application/UiApp/BootMaint/Variable.c
index 5e5592fb93..4fe8c534eb 100644
--- a/MdeModulePkg/Application/UiApp/BootMaint/Variable.c
+++ b/MdeModulePkg/Application/UiApp/BootMaint/Variable.c
@@ -559,7 +559,7 @@ Var_UpdateDriverOption (
     );
 
   if (*DescriptionData == 0x0000) {
-    StrCpy (DescriptionData, DriverString);
+    StrCpyS (DescriptionData, MAX_MENU_NUMBER, DriverString);
   }
 
   BufferSize = sizeof (UINT32) + sizeof (UINT16) + StrSize (DescriptionData);
@@ -727,7 +727,7 @@ Var_UpdateBootOption (
   UnicodeSPrint (BootString, sizeof (BootString), L"Boot%04x", Index);
 
   if (NvRamMap->DescriptionData[0] == 0x0000) {
-    StrCpy (NvRamMap->DescriptionData, BootString);
+    StrCpyS (NvRamMap->DescriptionData, sizeof (NvRamMap->DescriptionData) / sizeof (NvRamMap->DescriptionData[0]), BootString);
   }
 
   BufferSize = sizeof (UINT32) + sizeof (UINT16) + StrSize (NvRamMap->DescriptionData);