diff --git a/opencryptoki-3.17.0-covscan.patch b/opencryptoki-3.17.0-covscan.patch
new file mode 100644
index 0000000..e331a14
--- /dev/null
+++ b/opencryptoki-3.17.0-covscan.patch
@@ -0,0 +1,24 @@
+diff -up opencryptoki-3.17.0/usr/lib/common/asn1.c.me opencryptoki-3.17.0/usr/lib/common/asn1.c
+--- opencryptoki-3.17.0/usr/lib/common/asn1.c.me	2021-11-22 21:13:31.408617676 +0100
++++ opencryptoki-3.17.0/usr/lib/common/asn1.c	2021-11-22 21:13:40.759754932 +0100
+@@ -3483,7 +3483,6 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL le
+         TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__);
+         ber_free(ber, 1);
+         ber_bvfree(val);
+-        free(buf);
+         free(buf2);
+         return CKR_FUNCTION_FAILED;
+     }
+diff -up opencryptoki-3.17.0/usr/lib/common/mech_openssl.c.me opencryptoki-3.17.0/usr/lib/common/mech_openssl.c
+diff -up opencryptoki-3.17.0/usr/sbin/p11sak/p11sak.c.me opencryptoki-3.17.0/usr/sbin/p11sak/p11sak.c
+--- opencryptoki-3.17.0/usr/sbin/p11sak/p11sak.c.me	2021-11-23 13:25:37.950776199 +0100
++++ opencryptoki-3.17.0/usr/sbin/p11sak/p11sak.c	2021-11-23 13:27:03.560963809 +0100
+@@ -1148,7 +1148,7 @@ static CK_RV print_vendor(CK_SESSION_HAN
+     int f;
+     struct ConfigBaseNode *c, *name, *hex_string, *type;
+     struct ConfigStructNode *structnode;
+-    int def_attr;
++    int def_attr = 0;
+     
+     if (cfg != NULL)
+     {