KeyOption points to a buffer holding the content of Key####. So its size is smaller than EFI_BOOT_MANAGER_KEY_OPTION. Old code to assign value to KeyOption->OptionNumber modifies the memory outside of the KeyOption buffer. The patch fixes this bug. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com> Cc: Steven Shi <steven.shi@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Jeff Fan <jeff.fan@intel.com>