diff -up ./src/coolkey/object.cpp.p15-coverity ./src/coolkey/object.cpp

--- ./src/coolkey/object.cpp.p15-coverity	2015-07-06 18:02:34.604191118 -0700

+++ ./src/coolkey/object.cpp	2015-07-06 19:06:04.432062377 -0700

@@ -1558,7 +1558,7 @@ unsigned long GetBits(const CKYByte *ent

    /* turn the flags into an int */

    for (i=0; i < entrySize; i++) {

 	CKYByte c = rev[entry[i]];

-	bits  = bits | (c << i*8);

+	bits  = bits | (((unsigned long)c) << (i*8));

    }

    return bits | bitFlag;

 }

@@ -1585,8 +1585,8 @@ CKYStatus PK15ObjectPath::setObjectPath(

     if (entry == NULL) { return CKYINVALIDDATA; }

     tagSize = entry - current;

     current += entrySize + tagSize;

+    if (size < (entrySize + tagSize)) { return CKYINVALIDDATA; }

     size -= (entrySize +tagSize);

-    if (size < 0) { return CKYINVALIDDATA; }

     status = CKYBuffer_Replace(&path, 0, entry, entrySize);

     if (status != CKYSUCCESS) {

 	return status;

@@ -1598,8 +1598,8 @@ CKYStatus PK15ObjectPath::setObjectPath(

 	if (entry == NULL) { return CKYINVALIDDATA; }

 	tagSize = entry - current;

 	current += entrySize + tagSize;

+	if (size < (entrySize + tagSize)) { return CKYINVALIDDATA; }

 	size -= (entrySize +tagSize);

-	if (size < 0) { return CKYINVALIDDATA; }

 	if (entrySize > 5) { return CKYINVALIDDATA; }

 	for (index = 0, i=0; i < entrySize; i++) {

 	    index = (index << 8) + (unsigned int) entry[i];

@@ -1612,8 +1612,8 @@ CKYStatus PK15ObjectPath::setObjectPath(

 	if (entry == NULL) { return CKYINVALIDDATA; }

 	tagSize = entry - current;

 	current += entrySize + tagSize;

+	if (size < (entrySize + tagSize)) { return CKYINVALIDDATA; }

 	size -= (entrySize +tagSize);

-	if (size < 0) { return CKYINVALIDDATA; }

 	if (entrySize > 5) { return CKYINVALIDDATA; }

 	for (length = 0, i=0; i < entrySize; i++) {

 	    length = (length << 8) + (unsigned int) entry[i];

@@ -1741,8 +1741,8 @@ set_key_type:

     /* point current to the next section (cass attributes)  */

     tagSize = commonAttributes - current;

     current += commonSize + tagSize;

+    if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

     currentSize -= (commonSize +tagSize);

-    if (currentSize < 0) { return CKYINVALIDDATA; }

     /* get the CKA_LABEL */

     if (commonAttributes[0] != ASN1_UTF8_STRING) { return CKYINVALIDDATA; }

@@ -1835,8 +1835,8 @@ PK15Object::completeCertObject(const CKY

     /* point current to the next section (type attributes)  */

     tagSize = commonCertAttributes - current;

     current += commonSize + tagSize;

+    if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

     currentSize -= (commonSize +tagSize);

-    if (currentSize < 0) { return CKYINVALIDDATA; }

     /* get the id */

     if (commonCertAttributes[0] != ASN1_OCTET_STRING) { return CKYINVALIDDATA; }

@@ -1907,8 +1907,8 @@ PK15Object::completeAuthObject(const CKY

 	if (commonAuthAttributes == NULL) { return CKYINVALIDDATA; }

 	tagSize = commonAuthAttributes - current;

 	current += commonSize + tagSize;

+	if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

 	currentSize -= (commonSize + tagSize);

-	if (currentSize < 0) { return CKYINVALIDDATA; }

 	if (commonAuthAttributes[0] != ASN1_OCTET_STRING) {

 	    return CKYINVALIDDATA;

 	}

@@ -1930,8 +1930,8 @@ PK15Object::completeAuthObject(const CKY

     if (commonAuthAttributes == NULL) { return CKYINVALIDDATA; }

     tagSize = commonAuthAttributes - current;

     current += commonSize + tagSize;

-    currentSize -= (commonSize +tagSize);

-    if (currentSize < 0) { return CKYINVALIDDATA; }

+    if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

+    currentSize -= (commonSize + tagSize);

     /*

      * parse the Pin Auth Attributes 

      *     pinFlags  BIT_STRING

@@ -2093,8 +2093,8 @@ PK15Object::completeKeyObject(const CKYB

     /* point current to the next section (sublcass attributes)  */

     tagSize = commonKeyAttributes - current;

     current += commonSize + tagSize;

-    currentSize -= (commonSize +tagSize);

-    if (currentSize < 0) { return CKYINVALIDDATA; }

+    if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

+    currentSize -= (commonSize + tagSize);

     /* get the id */

     if (commonKeyAttributes[0] != ASN1_OCTET_STRING) { return CKYINVALIDDATA; }

@@ -2263,8 +2263,8 @@ CKYStatus PK15Object::completePrivKeyObj

 	/* point current to the next section (type attributes)  */

 	tagSize = commonPrivKeyAttributes - current;

 	current += commonSize + tagSize;

+	if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

 	currentSize -= (commonSize +tagSize);

-	if (currentSize < 0) { return CKYINVALIDDATA; }

  	/* subjectName */

 	if (commonPrivKeyAttributes[0] == ASN1_SEQUENCE) {

@@ -2385,8 +2385,8 @@ PK15Object::completePubKeyObject(const C

 	/* point current to the next section (type attributes)  */

 	tagSize = commonPubKeyAttributes - current;

 	current += commonSize + tagSize;

-	currentSize -= (commonSize +tagSize);

-	if (currentSize < 0) { return CKYINVALIDDATA; }

+	if (currentSize < (commonSize + tagSize)) { return CKYINVALIDDATA; }

+	currentSize -= (commonSize + tagSize);

  	/* subjectName */

 	if (commonPubKeyAttributes[0] == ASN1_SEQUENCE) {

@@ -2535,8 +2535,8 @@ PK15Object::completeRawPublicKey(const C

     if (entry == NULL) { return CKYINVALIDDATA; }

     tagSize = entry - current;

     current += entrySize + tagSize;

+    if (size < (entrySize + tagSize)) { return CKYINVALIDDATA; }

     size -= (entrySize +tagSize);

-    if (size < 0) { return CKYINVALIDDATA; }

     if ((entry[0] == 0) && (entrySize > 1)) {

 	entry++; entrySize--;

     }

@@ -2548,8 +2548,8 @@ PK15Object::completeRawPublicKey(const C

     if (entry == NULL) { return CKYINVALIDDATA; }

     tagSize = entry - current;

     current += entrySize + tagSize;

-    size -= (entrySize +tagSize);

-    if (size < 0) { return CKYINVALIDDATA; }

+    if (size < (entrySize + tagSize)) { return CKYINVALIDDATA; }

+    size -= (entrySize + tagSize);

     if ((entry[0] == 0) && (entrySize > 1)) {

 	entry++; entrySize--;

     }

@@ -2682,11 +2682,11 @@ DEREncodedTokenInfo::DEREncodedTokenInfo

     if (entry == NULL) return;

     tagSize = entry - current;

     current += tagSize + entrySize;

+    if (size < tagSize + entrySize) return;

     size -= tagSize + entrySize;

     if (entrySize < 1) {

 	version = *entry;

     }

-    if (size < 0) return;

     /* get the serial number */

     if (current[0] != ASN1_OCTET_STRING) { return ; }

@@ -2729,6 +2729,8 @@ DEREncodedTokenInfo::DEREncodedTokenInfo

     }

     /* parsing flags */

+#ifdef notdef

+    /* we arn't using this right now, keep it for future reference */

     if (current[0] == ASN1_BIT_STRING) {

     /* recordinfo parsing would go here */

 	unsigned long bits;

@@ -2739,6 +2741,7 @@ DEREncodedTokenInfo::DEREncodedTokenInfo

 	size -= tagSize + entrySize;

 	bits = GetBits(entry, entrySize,8,2);

     }

+#endif

     return;

 }

diff -up ./src/coolkey/slot.cpp.p15-coverity ./src/coolkey/slot.cpp

--- ./src/coolkey/slot.cpp.p15-coverity	2015-07-06 18:02:34.606191081 -0700

+++ ./src/coolkey/slot.cpp	2015-07-06 18:02:34.610191006 -0700

@@ -3714,7 +3714,6 @@ void

 Slot::attemptP15Login(CK_USER_TYPE user)

 {

     PinCache *pinCachePtr  = userPinCache(user);

-    const CKYBuffer *path;

     if (user == CKU_USER) {

 	loggedIn = false;

@@ -3729,7 +3728,6 @@ Slot::attemptP15Login(CK_USER_TYPE user)

 			"No PKCS #15 auth object for user %d\n", user);

     }

-    path = auth[user]->getObjectPath().getPath();

     status = selectPath(auth[user]->getObjectPath().getPath(), &result);

     if( status == CKYSCARDERR )  {

 	handleConnectionError();

diff -up ./src/libckyapplet/cky_applet.c.p15-coverity ./src/libckyapplet/cky_applet.c

--- ./src/libckyapplet/cky_applet.c.p15-coverity	2015-07-06 18:02:34.606191081 -0700

+++ ./src/libckyapplet/cky_applet.c	2015-07-06 18:02:34.610191006 -0700

@@ -1361,6 +1361,9 @@ P15Applet_SignDecrypt(CKYCardConnection

 	appendLength = length;

     } else {

 	ret = CKYBuffer_Reserve(&tmp, length);

+	if (ret != CKYSUCCESS) {

+	    goto done;

+	}

     }

     CKYBuffer_AppendBuffer(&tmp, data, offset, appendLength);

     pso.chain = 0;

diff -up ./src/libckyapplet/cky_base.c.p15-coverity ./src/libckyapplet/cky_base.c

--- ./src/libckyapplet/cky_base.c.p15-coverity	2015-07-06 18:02:34.607191062 -0700

+++ ./src/libckyapplet/cky_base.c	2015-07-06 18:02:34.610191006 -0700

@@ -736,7 +736,7 @@ CKYAPDU_SetShortReceiveLen(CKYAPDU *apdu

     CKYStatus ret;

     if (recvlen <= CKYAPDU_MAX_DATA_LEN) {

-	return APDU_SetReceiveLen(apdu, (CKYByte)(recvlen & 0xff));

+	return CKYAPDU_SetReceiveLen(apdu, (CKYByte)(recvlen & 0xff));

     }

     ret = CKYBuffer_Resize(&apdu->apduBuf, CKYAPDU_HEADER_LEN+2);

     if (ret != CKYSUCCESS) {