3 files changed, 48 insertions, 19 deletions
diff --git a/src/Common/Dlgcode.c b/src/Common/Dlgcode.c
index 9d5c0d06..7b3d2d45 100644
--- a/src/Common/Dlgcode.c
+++ b/src/Common/Dlgcode.c
@@ -611,6 +611,7 @@ char *LoadFile (const wchar_t *fileName, DWORD *size)
 	char *buf;
 	DWORD fileSize = INVALID_FILE_SIZE;
 	HANDLE h = CreateFile (fileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	*size = 0;
 	if (h == INVALID_HANDLE_VALUE)
 		return NULL;
 
@@ -620,8 +621,7 @@ char *LoadFile (const wchar_t *fileName, DWORD *size)
 		return NULL;
 	}
 
-	*size = fileSize;
-	buf = (char *) calloc (*size + 1, 1);
+	buf = (char *) calloc (fileSize + 1, 1);
 
 	if (buf == NULL)
 	{
@@ -629,11 +629,15 @@ char *LoadFile (const wchar_t *fileName, DWORD *size)
 		return NULL;
 	}
 
-	if (!ReadFile (h, buf, *size, size, NULL))
+	if (!ReadFile (h, buf, fileSize, size, NULL))
 	{
 		free (buf);
 		buf = NULL;
 	}
+	else
+	{
+		buf[*size] = 0; //make coverity happy eventhough buf is guaranteed to be null terminated because of fileSize+1 in calloc call
+	}
 
 	CloseHandle (h);
 	return buf;
diff --git a/src/Common/Language.c b/src/Common/Language.c
index 844f4dad..278b7dd1 100644
--- a/src/Common/Language.c
+++ b/src/Common/Language.c
@@ -611,7 +611,8 @@ char *GetPreferredLangId ()
 
 void SetPreferredLangId (char *langId)
 {
-	StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), langId);
+	if (strlen(langId) < sizeof(PreferredLangId))
+		StringCbCopyA (PreferredLangId, sizeof(PreferredLangId), langId);
 }
 
 
diff --git a/src/Common/Tests.c b/src/Common/Tests.c
index 0fcd93ce..4f53d4ed 100644
--- a/src/Common/Tests.c
+++ b/src/Common/Tests.c
@@ -1519,12 +1519,20 @@ BOOL test_hmac_sha256 ()
 	for (i = 0; i < sizeof (hmac_sha256_test_data) / sizeof(char *); i++)
 	{
 		char digest[1024]; /* large enough to hold digets and test vector inputs */
-		memcpy (digest, hmac_sha256_test_data[i], strlen (hmac_sha256_test_data[i]));
-		hmac_sha256 (hmac_sha256_test_keys[i], (int) strlen (hmac_sha256_test_keys[i]), digest, (int) strlen (hmac_sha256_test_data[i]));
-		if (memcmp (digest, hmac_sha256_test_vectors[i], SHA256_DIGESTSIZE) != 0)
-			return FALSE;
+		size_t dataLen = strlen (hmac_sha256_test_data[i]);
+		if (dataLen <= sizeof(digest))
+		{
+			memcpy (digest, hmac_sha256_test_data[i], dataLen);
+			hmac_sha256 (hmac_sha256_test_keys[i], (int) strlen (hmac_sha256_test_keys[i]), digest, (int) dataLen);
+			if (memcmp (digest, hmac_sha256_test_vectors[i], SHA256_DIGESTSIZE) != 0)
+				return FALSE;
+			else
+				nTestsPerformed++;
+		}
 		else
-			nTestsPerformed++;
+		{
+			return FALSE;
+		}
 	}
 
 	return (nTestsPerformed == 6);
@@ -1538,12 +1546,20 @@ BOOL test_hmac_sha512 ()
 	for (i = 0; i < sizeof (hmac_sha512_test_data) / sizeof(char *); i++)
 	{
 		char digest[1024]; /* large enough to hold digets and test vector inputs */
-		memcpy (digest, hmac_sha512_test_data[i], (int) strlen (hmac_sha512_test_data[i]));
-		hmac_sha512 (hmac_sha512_test_keys[i], (int) strlen (hmac_sha512_test_keys[i]), digest, (int) strlen (hmac_sha512_test_data[i]));
-		if (memcmp (digest, hmac_sha512_test_vectors[i], SHA512_DIGESTSIZE) != 0)
-			return FALSE;
+		size_t dataLen = strlen (hmac_sha512_test_data[i]);
+		if (dataLen <= sizeof(digest))
+		{
+			memcpy (digest, hmac_sha512_test_data[i], dataLen );
+			hmac_sha512 (hmac_sha512_test_keys[i], (int) strlen (hmac_sha512_test_keys[i]), digest, (int) dataLen);
+			if (memcmp (digest, hmac_sha512_test_vectors[i], SHA512_DIGESTSIZE) != 0)
+				return FALSE;
+			else
+				nTestsPerformed++;
+		}
 		else
-			nTestsPerformed++;
+		{
+			return FALSE;
+		}
 	}
 
 	return (nTestsPerformed == 6);
@@ -1557,12 +1573,20 @@ BOOL test_hmac_blake2s ()
 	for (i = 0; i < sizeof (hmac_blake2s_test_data) / sizeof(char *); i++)
 	{
 		char digest[1024]; /* large enough to hold digets and test vector inputs */
-		memcpy (digest, hmac_blake2s_test_data[i], strlen (hmac_blake2s_test_data[i]));
-		hmac_blake2s (hmac_blake2s_test_keys[i], (int) strlen (hmac_blake2s_test_keys[i]), digest, (int) strlen (hmac_blake2s_test_data[i]));
-		if (memcmp (digest, hmac_blake2s_test_vectors[i], BLAKE2S_DIGESTSIZE) != 0)
-			return FALSE;
+		size_t dataLen = strlen (hmac_blake2s_test_data[i]);
+		if (dataLen <= sizeof(digest))
+		{
+			memcpy (digest, hmac_blake2s_test_data[i], dataLen);
+			hmac_blake2s (hmac_blake2s_test_keys[i], (int) strlen (hmac_blake2s_test_keys[i]), digest, (int) dataLen);
+			if (memcmp (digest, hmac_blake2s_test_vectors[i], BLAKE2S_DIGESTSIZE) != 0)
+				return FALSE;
+			else
+				nTestsPerformed++;
+		}
 		else
-			nTestsPerformed++;
+		{
+			return FALSE;
+		}
 	}
 
 	return (nTestsPerformed == 6);