diff --git a/OptionRomPkg/AtapiPassThruDxe/AtapiPassThru.c b/OptionRomPkg/AtapiPassThruDxe/AtapiPassThru.c
index d2a9d7b11e..3578a1e445 100644
--- a/OptionRomPkg/AtapiPassThruDxe/AtapiPassThru.c
+++ b/OptionRomPkg/AtapiPassThruDxe/AtapiPassThru.c
@@ -1749,10 +1749,12 @@ Returns:
 {
   UINT8 Index;
   UINT8 *OpCode;
+  UINT8 ArrayLen;
 
   OpCode = (UINT8 *) (Packet->Cdb);
+  ArrayLen = (UINT8) (sizeof (gSupportedATAPICommands) / sizeof (gSupportedATAPICommands[0]));
 
-  for (Index = 0; CompareMem (&gSupportedATAPICommands[Index], &gEndTable, sizeof (SCSI_COMMAND_SET)); Index++) {
+  for (Index = 0; (Index < ArrayLen) && (CompareMem (&gSupportedATAPICommands[Index], &gEndTable, sizeof (SCSI_COMMAND_SET)) != 0); Index++) {
 
     if (*OpCode == gSupportedATAPICommands[Index].OpCode) {
       //
@@ -1990,10 +1992,12 @@ Returns:
 {
   UINT8 Index;
   UINT8 *OpCode;
+  UINT8 ArrayLen;
 
   OpCode = (UINT8 *) (Packet->Cdb);
+  ArrayLen = (UINT8) (sizeof (gSupportedATAPICommands) / sizeof (gSupportedATAPICommands[0]));
 
-  for (Index = 0; CompareMem (&gSupportedATAPICommands[Index], &gEndTable, sizeof (SCSI_COMMAND_SET)); Index++) {
+  for (Index = 0; (Index < ArrayLen) && (CompareMem (&gSupportedATAPICommands[Index], &gEndTable, sizeof (SCSI_COMMAND_SET)) != 0); Index++) {
 
     if (*OpCode == gSupportedATAPICommands[Index].OpCode) {
       //
diff --git a/OptionRomPkg/CirrusLogic5430Dxe/CirrusLogic5430GraphicsOutput.c b/OptionRomPkg/CirrusLogic5430Dxe/CirrusLogic5430GraphicsOutput.c
index 8ba2f98cb9..d4b3eafb27 100644
--- a/OptionRomPkg/CirrusLogic5430Dxe/CirrusLogic5430GraphicsOutput.c
+++ b/OptionRomPkg/CirrusLogic5430Dxe/CirrusLogic5430GraphicsOutput.c
@@ -523,6 +523,7 @@ CirrusLogic5430GraphicsOutputConstructor (
   // Initialize the hardware
   //
   GraphicsOutput->SetMode (GraphicsOutput, 0);
+  ASSERT (Private->GraphicsOutput.Mode->Mode < CIRRUS_LOGIC_5430_MODE_COUNT);
   DrawLogo (
     Private,
     Private->ModeData[Private->GraphicsOutput.Mode->Mode].HorizontalResolution,
diff --git a/OptionRomPkg/UndiRuntimeDxe/Decode.c b/OptionRomPkg/UndiRuntimeDxe/Decode.c
index 56a7012787..0eabc2ad8f 100644
--- a/OptionRomPkg/UndiRuntimeDxe/Decode.c
+++ b/OptionRomPkg/UndiRuntimeDxe/Decode.c
@@ -254,9 +254,9 @@ UNDI_GetInitInfo (
   DbPtr->MCastFilterCnt = MAX_MCAST_ADDRESS_CNT;
 
   DbPtr->TxBufCnt = TX_BUFFER_COUNT;
-  DbPtr->TxBufSize = sizeof (TxCB);
+  DbPtr->TxBufSize = (UINT16) sizeof (TxCB);
   DbPtr->RxBufCnt = RX_BUFFER_COUNT;
-  DbPtr->RxBufSize = sizeof (RxFD);
+  DbPtr->RxBufSize = (UINT16) sizeof (RxFD);
 
   DbPtr->IFtype = PXE_IFTYPE_ETHERNET;
   DbPtr->SupportedDuplexModes = PXE_DUPLEX_ENABLE_FULL_SUPPORTED |
@@ -1032,7 +1032,7 @@ UNDI_Status (
     //
     // We already filled in 2 UINT32s.
     //
-    CdbPtr->DBsize = sizeof (UINT32) * 2;
+    CdbPtr->DBsize = (UINT16) (sizeof (UINT32) * 2);
 
     //
     // will claim any hanging free CBs
@@ -1042,7 +1042,7 @@ UNDI_Status (
     if (AdapterInfo->xmit_done_head == AdapterInfo->xmit_done_tail) {
       CdbPtr->StatFlags |= PXE_STATFLAGS_GET_STATUS_TXBUF_QUEUE_EMPTY;
     } else {
-      for (Index = 0; NumEntries >= sizeof (UINT64); Index++, NumEntries -= sizeof (UINT64)) {
+      for (Index = 0; ((Index < MAX_XMIT_BUFFERS) && (NumEntries >= sizeof (UINT64))); Index++, NumEntries -= sizeof (UINT64)) {
         if (AdapterInfo->xmit_done_head != AdapterInfo->xmit_done_tail) {
           DbPtr->TxBuffer[Index]      = AdapterInfo->xmit_done[AdapterInfo->xmit_done_head];
           AdapterInfo->xmit_done_head = next (AdapterInfo->xmit_done_head);
@@ -1476,7 +1476,7 @@ PxeStructInit (
   // Initialize the !PXE structure
   //
   PxePtr->Signature = PXE_ROMID_SIGNATURE;
-  PxePtr->Len       = sizeof (PXE_SW_UNDI);
+  PxePtr->Len       = (UINT8) sizeof (PXE_SW_UNDI);
   //
   // cksum
   //
diff --git a/OptionRomPkg/UndiRuntimeDxe/E100b.c b/OptionRomPkg/UndiRuntimeDxe/E100b.c
index 6f953c3195..41308ba6fd 100644
--- a/OptionRomPkg/UndiRuntimeDxe/E100b.c
+++ b/OptionRomPkg/UndiRuntimeDxe/E100b.c
@@ -517,7 +517,8 @@ Configure (
   UINT8 my_filter;
 
   cmd_ptr   = GetFreeCB (AdapterInfo);
-  data_ptr  = (UINT8 *) (&cmd_ptr->PhysTBDArrayAddres);
+  ASSERT (cmd_ptr != NULL);
+  data_ptr  = (UINT8 *) cmd_ptr + sizeof (struct CB_Header);
 
   //
   // start the config data right after the command header
@@ -588,7 +589,8 @@ E100bSetupIAAddr (
   eaddrs    = (UINT16 *) AdapterInfo->CurrentNodeAddress;
 
   cmd_ptr   = GetFreeCB (AdapterInfo);
-  data_ptr  = (UINT16 *) (&cmd_ptr->PhysTBDArrayAddres);
+  ASSERT (cmd_ptr != NULL);
+  data_ptr  = (UINT16 *) ((UINT8 *) cmd_ptr +sizeof (struct CB_Header));
 
   //
   // AVOID a bug (?!) here by marking the command already completed.
@@ -1022,6 +1024,7 @@ E100bTransmit (
 
   tx_ptr_1  = (PXE_CPB_TRANSMIT *) (UINTN) cpb;
   tx_ptr_f  = (PXE_CPB_TRANSMIT_FRAGMENTS *) (UINTN) cpb;
+  Tmp_ptr = 0;
 
   //
   // stop reentrancy here
@@ -1387,7 +1390,7 @@ E100bReadEepromAndStationAddress (
   // in words
   //
   AdapterInfo->NVData_Len = eeprom_len = (UINT16) (1 << addr_len);
-  for (Index2 = 0, Index = 0; Index < eeprom_len; Index++) {
+  for (Index2 = 0, Index = 0; ((Index2 < PXE_MAC_LENGTH - 1) && (Index < eeprom_len)); Index++) {
     UINT16  value;
     value         = E100bReadEeprom (AdapterInfo, Index, addr_len);
     eedata[Index] = value;
@@ -2258,7 +2261,7 @@ E100bStatistics (
                   AdapterInfo->statistics->tx_lost_carrier;
 
   if (DBsize > sizeof db) {
-    DBsize = sizeof db;
+    DBsize = (UINT16) sizeof (db);
   }
 
   CopyMem ((VOID *) (UINTN) DBaddr, (VOID *) &db, (UINTN) DBsize);
diff --git a/OptionRomPkg/UndiRuntimeDxe/Init.c b/OptionRomPkg/UndiRuntimeDxe/Init.c
index 7406b6d290..77931681e7 100644
--- a/OptionRomPkg/UndiRuntimeDxe/Init.c
+++ b/OptionRomPkg/UndiRuntimeDxe/Init.c
@@ -882,7 +882,7 @@ AppendMac2DevPath (
 
   MacAddrNode.Header.Type       = MESSAGING_DEVICE_PATH;
   MacAddrNode.Header.SubType    = MSG_MAC_ADDR_DP;
-  MacAddrNode.Header.Length[0]  = sizeof (MacAddrNode);
+  MacAddrNode.Header.Length[0]  = (UINT8) sizeof (MacAddrNode);
   MacAddrNode.Header.Length[1]  = 0;
 
   //