3 files changed, 48 insertions, 19 deletions
diff --git a/src/Common/Dlgcode.c b/src/Common/Dlgcode.c
index 9d5c0d06..7b3d2d45 100644
--- a/src/Common/Dlgcode.c
+++ b/src/Common/Dlgcode.c
@@ -579,93 +579,97 @@ BOOL LoadInt16 (const wchar_t *filePath, int *result, __int64 fileOffset)
 	src = CreateFile (filePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
 
 	if (src == INVALID_HANDLE_VALUE)
 	{
 		free (buffer);
 		return FALSE;
 	}
 
 	seekOffset.QuadPart = fileOffset;
 
 	if (SetFilePointerEx (src, seekOffset, &seekOffsetNew, FILE_BEGIN) == 0)
 		goto fsif_end;
 
 	if (ReadFile (src, buffer, bufSize, &bytesRead, NULL) == 0
 		|| bytesRead != bufSize)
 		goto fsif_end;
 
 
 	retVal = TRUE;
 
 	*result = mgetWord(bufferPtr);
 
 fsif_end:
 	CloseHandle (src);
 	free (buffer);
 
 	return retVal;
 }
 
 // Returns NULL if there's any error. Although the buffer can contain binary data, it is always null-terminated.
 char *LoadFile (const wchar_t *fileName, DWORD *size)
 {
 	char *buf;
 	DWORD fileSize = INVALID_FILE_SIZE;
 	HANDLE h = CreateFile (fileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	*size = 0;
 	if (h == INVALID_HANDLE_VALUE)
 		return NULL;
 
 	if ((fileSize = GetFileSize (h, NULL)) == INVALID_FILE_SIZE)
 	{
 		CloseHandle (h);
 		return NULL;
 	}
 
-	*size = fileSize;
-	buf = (char *) calloc (*size + 1, 1);
+	buf = (char *) calloc (fileSize + 1, 1);
 
 	if (buf == NULL)
 	{
 		CloseHandle (h);
 		return NULL;
 	}
 
-	if (!ReadFile (h, buf, *size, size, NULL))
+	if (!ReadFile (h, buf, fileSize, size, NULL))
 	{
 		free (buf);
 		buf = NULL;
 	}
+	else
+	{
+		buf[*size] = 0; //make coverity happy eventhough buf is guaranteed to be null terminated because of fileSize+1 in calloc call
+	}
 
 	CloseHandle (h);
 	return buf;
 }
 
 
 // Returns NULL if there's any error.
 char *LoadFileBlock (const wchar_t *fileName, __int64 fileOffset, DWORD count)
 {
 	char *buf;
 	DWORD bytesRead = 0;
 	LARGE_INTEGER seekOffset, seekOffsetNew;
 	BOOL bStatus;
 
 	HANDLE h = CreateFile (fileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
 	if (h == INVALID_HANDLE_VALUE)
 		return NULL;
 
 	seekOffset.QuadPart = fileOffset;
 
 	if (SetFilePointerEx (h, seekOffset, &seekOffsetNew, FILE_BEGIN) == 0)
 	{
 		CloseHandle (h);
 		return NULL;
 	}
 
 	buf = (char *) calloc (count, 1);
 
 	if (buf == NULL)
 	{
 		CloseHandle (h);
 		return NULL;
 	}
 
 	bStatus = ReadFile (h, buf, count, &bytesRead, NULL);
diff --git a/src/Common/Language.c b/src/Common/Language.c
index 844f4dad..278b7dd1 100644
--- a/src/Common/Language.c
+++ b/src/Common/Language.c
@@ -579,60 +579,61 @@ BOOL CALLBACK LanguageDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 
 		if (lw == IDCANCEL)
 		{
 			EndDialog (hwndDlg, lw);
 			return 1;
 		}
 
 		if (lw == IDC_GET_LANG_PACKS)
 		{
 			char tmpstr [256];
 
 			if (strlen (ActiveLangPackVersion) > 0 && strlen (GetPreferredLangId()) > 0)
 				StringCbPrintfA (tmpstr, sizeof(tmpstr), "&langpackversion=%s&lang=%s", ActiveLangPackVersion, GetPreferredLangId());
 			else
 				tmpstr[0] = 0;
 
 			Applink ("localizations");
 
 			return 1;
 		}
 		return 0;
 	}
 
 	return 0;
 }
 
 
 char *GetPreferredLangId ()
 {
 	return PreferredLangId;
 }
 
 
 void SetPreferredLangId (char *langId)
 {
-	StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), langId);
+	if (strlen(langId) < sizeof(PreferredLangId))
+		StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), langId);
 }
 
 
 char *GetActiveLangPackVersion ()
 {
 	return ActiveLangPackVersion;
 }
 
 
 wchar_t *GetString (const char *stringId)
 {
 	WCHAR *str = (WCHAR *) GetDictionaryValue (stringId);
 	if (str != NULL) return str;
 
 	StringCbPrintfW (UnknownString, sizeof(UnknownString), UNKNOWN_STRING_ID L"%hs" UNKNOWN_STRING_ID, stringId);
 	return UnknownString;
 }
 
 
 Font *GetFont (char *fontType)
 {
 	return (Font *) GetDictionaryValue (fontType);
 
 }
diff --git a/src/Common/Tests.c b/src/Common/Tests.c
index 0fcd93ce..4f53d4ed 100644
--- a/src/Common/Tests.c
+++ b/src/Common/Tests.c
@@ -1487,114 +1487,138 @@ BOOL AutoTestAlgorithms (void)
 		EnableHwEncryption (hwEncryptionEnabled);
 #if defined (_MSC_VER) && !defined (_UEFI)
 	}
     __except (EXCEPTION_EXECUTE_HANDLER)
 	{
 		exceptionCatched = TRUE;
 	}
 
 	if (exceptionCatched)
 	{
 		/* unexepected exception raised. Disable all CPU extended feature and try again */
 		EnableHwEncryption (hwEncryptionEnabled);
 		DisableCPUExtendedFeatures ();
 		__try
 		{
 			result = DoAutoTestAlgorithms();
 		}
 	    __except (EXCEPTION_EXECUTE_HANDLER)
 		{
 			/* exception still occuring. Report failure. */
 			result = FALSE;
 		}
 	}
 #endif
 	return result;
 }
 
 BOOL test_hmac_sha256 ()
 {
 	unsigned int i;
 	int nTestsPerformed = 0;
 
 	for (i = 0; i < sizeof (hmac_sha256_test_data) / sizeof(char *); i++)
 	{
 		char digest[1024]; /* large enough to hold digets and test vector inputs */
-		memcpy (digest, hmac_sha256_test_data[i], strlen (hmac_sha256_test_data[i]));
-		hmac_sha256 (hmac_sha256_test_keys[i], (int) strlen (hmac_sha256_test_keys[i]), digest, (int) strlen (hmac_sha256_test_data[i]));
-		if (memcmp (digest, hmac_sha256_test_vectors[i], SHA256_DIGESTSIZE) != 0)
-			return FALSE;
+		size_t dataLen = strlen (hmac_sha256_test_data[i]);
+		if (dataLen <= sizeof(digest))
+		{
+			memcpy (digest, hmac_sha256_test_data[i], dataLen);
+			hmac_sha256 (hmac_sha256_test_keys[i], (int) strlen (hmac_sha256_test_keys[i]), digest, (int) dataLen);
+			if (memcmp (digest, hmac_sha256_test_vectors[i], SHA256_DIGESTSIZE) != 0)
+				return FALSE;
+			else
+				nTestsPerformed++;
+		}
 		else
-			nTestsPerformed++;
+		{
+			return FALSE;
+		}
 	}
 
 	return (nTestsPerformed == 6);
 }
 
 BOOL test_hmac_sha512 ()
 {
 	unsigned int i;
 	int nTestsPerformed = 0;
 
 	for (i = 0; i < sizeof (hmac_sha512_test_data) / sizeof(char *); i++)
 	{
 		char digest[1024]; /* large enough to hold digets and test vector inputs */
-		memcpy (digest, hmac_sha512_test_data[i], (int) strlen (hmac_sha512_test_data[i]));
-		hmac_sha512 (hmac_sha512_test_keys[i], (int) strlen (hmac_sha512_test_keys[i]), digest, (int) strlen (hmac_sha512_test_data[i]));
-		if (memcmp (digest, hmac_sha512_test_vectors[i], SHA512_DIGESTSIZE) != 0)
-			return FALSE;
+		size_t dataLen = strlen (hmac_sha512_test_data[i]);
+		if (dataLen <= sizeof(digest))
+		{
+			memcpy (digest, hmac_sha512_test_data[i], dataLen );
+			hmac_sha512 (hmac_sha512_test_keys[i], (int) strlen (hmac_sha512_test_keys[i]), digest, (int) dataLen);
+			if (memcmp (digest, hmac_sha512_test_vectors[i], SHA512_DIGESTSIZE) != 0)
+				return FALSE;
+			else
+				nTestsPerformed++;
+		}
 		else
-			nTestsPerformed++;
+		{
+			return FALSE;
+		}
 	}
 
 	return (nTestsPerformed == 6);
 }
 
 BOOL test_hmac_blake2s ()
 {
 	unsigned int i;
 	int nTestsPerformed = 0;
 
 	for (i = 0; i < sizeof (hmac_blake2s_test_data) / sizeof(char *); i++)
 	{
 		char digest[1024]; /* large enough to hold digets and test vector inputs */
-		memcpy (digest, hmac_blake2s_test_data[i], strlen (hmac_blake2s_test_data[i]));
-		hmac_blake2s (hmac_blake2s_test_keys[i], (int) strlen (hmac_blake2s_test_keys[i]), digest, (int) strlen (hmac_blake2s_test_data[i]));
-		if (memcmp (digest, hmac_blake2s_test_vectors[i], BLAKE2S_DIGESTSIZE) != 0)
-			return FALSE;
+		size_t dataLen = strlen (hmac_blake2s_test_data[i]);
+		if (dataLen <= sizeof(digest))
+		{
+			memcpy (digest, hmac_blake2s_test_data[i], dataLen);
+			hmac_blake2s (hmac_blake2s_test_keys[i], (int) strlen (hmac_blake2s_test_keys[i]), digest, (int) dataLen);
+			if (memcmp (digest, hmac_blake2s_test_vectors[i], BLAKE2S_DIGESTSIZE) != 0)
+				return FALSE;
+			else
+				nTestsPerformed++;
+		}
 		else
-			nTestsPerformed++;
+		{
+			return FALSE;
+		}
 	}
 
 	return (nTestsPerformed == 6);
 }
 
 int __cdecl Blake2sHash (unsigned char* input, unsigned long inputLen, unsigned char* output)
 {
 	blake2s(output, input, (size_t) inputLen);
 	return BLAKE2S_DIGESTSIZE;
 }
 
 BOOL test_hmac_whirlpool ()
 {
 	unsigned char digest[1024]; /* large enough to hold digets and test vector inputs */
 
 	memcpy (digest, hmac_whirlpool_test_data, strlen (hmac_whirlpool_test_data));
 	hmac_whirlpool (hmac_whirlpool_test_key, 64, digest, (int) strlen (hmac_whirlpool_test_data));
 	if (memcmp (digest, hmac_whirlpool_test_vectors, WHIRLPOOL_DIGESTSIZE) != 0)
 		return FALSE;
 
 	return TRUE;
 }
 
 /* http://www.tc26.ru/methods/recommendation/%D0%A2%D0%9A26%D0%90%D0%9B%D0%93.pdf */
 /* https://tools.ietf.org/html/draft-smyshlyaev-gost-usage-00 */
 /* https://datatracker.ietf.org/doc/rfc7836/?include_text=1 */
 static const unsigned char gost3411_2012_hmac_k1[] = {
 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
 	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
 	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
 };
 static const unsigned char gost3411_2012_hmac_m1[] = {
 	0x01, 0x26, 0xbd, 0xb8, 0x78, 0x00, 0xaf, 0x21,
 	0x43, 0x41, 0x45, 0x65, 0x63, 0x78, 0x01, 0x00