From 44cbebec2ad848a5c7f7c476f7a4483ea9609abc Mon Sep 17 00:00:00 2001
From: Hao Wu <hao.a.wu@intel.com>
Date: Tue, 30 Jun 2015 06:27:44 +0000
Subject: IntelFrameworkModulePkg BootMngr: Use safe string functions

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jeff Fan <jeff.fan@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17737 6f19259b-4bc3-4df7-8a09-765794883524
---
 .../Universal/BdsDxe/BootMngr/BootManager.c                   | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c
index dc1364899e..978959d6e7 100644
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c
@@ -1,7 +1,7 @@
 /** @file
   The platform boot manager reference implementation
 
-Copyright (c) 2004 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -205,11 +205,11 @@ CallBootManager (
   EFI_STRING_ID               Token;
   EFI_INPUT_KEY               Key;
   CHAR16                      *HelpString;
+  UINTN                       HelpSize;
   EFI_STRING_ID               HelpToken;
   UINT16                      *TempStr;
   EFI_HII_HANDLE              HiiHandle;
   EFI_BROWSER_ACTION_REQUEST  ActionRequest;
-  UINTN                       TempSize;
   VOID                        *StartOpCodeHandle;
   VOID                        *EndOpCodeHandle;
   EFI_IFR_GUID_LABEL          *StartLabel;
@@ -318,11 +318,10 @@ CallBootManager (
     Token = HiiSetString (HiiHandle, 0, Option->Description, NULL);
 
     TempStr = DevicePathToStr (Option->DevicePath);
-    TempSize = StrSize (TempStr);
-    HelpString = AllocateZeroPool (TempSize + StrSize (L"Device Path : "));
+    HelpSize = StrSize (TempStr) + StrSize (L"Device Path : ");
+    HelpString = AllocateCopyPool (HelpSize, L"Device Path : ");
     ASSERT (HelpString != NULL);
-    StrCat (HelpString, L"Device Path : ");
-    StrCat (HelpString, TempStr);
+    StrCatS (HelpString, HelpSize / sizeof (CHAR16), TempStr);
 
     HelpToken = HiiSetString (HiiHandle, 0, HelpString, NULL);
 
-- 
cgit v1.2.3