Fix coverity for release (#2661)

Port of: #2601

Co-authored-by: Vladimir Zlobin <[email protected]>

Author: as-suvorov

src/cpp/src/gguf_utils/gguf_tokenizer.cpp

@@ -299,6 +299,10 @@ std::vector<std::string> split_utf8_chars(const std::string& input) {
             std::cerr << "Invalid UTF-8 sequence at byte index " << i << std::endl;
             break;  // Stop on error
         }
+        OPENVINO_ASSERT(
+            std::numeric_limits<size_t>::max() - i > len,
+            "UTF-8 character length exceeds size_t limit at index ", i
+        );
         result.emplace_back(input.substr(i, len));
         i += len;
     }

src/cpp/src/speculative_decoding/speculative_decoding_impl.cpp

@@ -348,6 +348,7 @@ ContinuousBatchingPipeline::SpeculativeDecodingImpl::generate(const std::vector<
 
 SpeculativeDecodingMetrics
 ContinuousBatchingPipeline::SpeculativeDecodingImpl::get_speculative_decoding_metrics() {
+    std::lock_guard<std::mutex> lock{m_draft_generations_mutex};
     return m_sd_metrics;
 };
 

src/cpp/src/visual_language/phi3_vision/classes.cpp

@@ -483,7 +483,9 @@ std::vector<std::variant<ov::Tensor, size_t>> split_tokenize(const std::string&
         {0, 1}  // Every match emits two values: whole match and submatch
     }; iter != std::sregex_token_iterator{}; ++iter) {
         if (is_submatch) {
-            tokenized.push_back(std::stoul(iter->str()) - 1);
+            size_t idx = std::stoul(iter->str());
+            OPENVINO_ASSERT(idx != 0);
+            tokenized.push_back(idx - 1);
         } else {
             std::string regular_text{prefix_begin, iter->first};
             if (!regular_text.empty()) {