diff --git a/which-2.21-coverity-fixes.patch b/which-2.21-coverity-fixes.patch
new file mode 100644
index 0000000..50ba4e8
--- /dev/null
+++ b/which-2.21-coverity-fixes.patch
@@ -0,0 +1,14 @@
+diff -up which-2.21/tilde/tilde.c.me which-2.21/tilde/tilde.c
+--- which-2.21/tilde/tilde.c.me	2018-07-23 14:32:47.002225732 +0200
++++ which-2.21/tilde/tilde.c	2018-07-23 14:49:06.363623898 +0200
+@@ -196,7 +196,8 @@ tilde_expand (string)
+   int result_size, result_index;
+ 
+   result_index = result_size = 0;
+-  if (result = strchr (string, '~'))
++  result = strchr (string, '~');
++  if (result)
+     result = (char *)xmalloc (result_size = (strlen (string) + 16));
+   else
+     result = (char *)xmalloc (result_size = (strlen (string) + 1));
+diff -up which-2.21/which.c.me which-2.21/which.c
diff --git a/which.spec b/which.spec
index 595d75f..97b3c7c 100644
--- a/which.spec
+++ b/which.spec
@@ -1,11 +1,12 @@
 Summary: Displays where a particular program in your path is located
 Name: which
 Version: 2.21
-Release: 9%{?dist}
+Release: 10%{?dist}
 License: GPLv3
 Source0: http://ftp.gnu.org/gnu/which/%{name}-%{version}.tar.gz
 Source1: which2.sh
 Source2: which2.csh
+Patch0: which-2.21-coverity-fixes.patch
 Url: https://savannah.gnu.org/projects/which/
 BuildRequires:  gcc
 BuildRequires: readline-devel
@@ -16,6 +17,7 @@ the specified program is in your PATH.
 
 %prep
 %setup -q
+%patch0 -p1 -b .coverity
 
 %build
 %configure
@@ -37,6 +39,9 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 %{_mandir}/man1/which.1*
 
 %changelog
+* Mon Jul 23 2018 Than Ngo <than@redhat.com> - 2.21-10
+- Fix coverity issues
+
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.21-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild