int
http_parse_header_line(struct http_parser *prsr, const char **bufp,
		       const char *end_buf, int max_hname_len)
{
	char c;
	unsigned char ch;
	const char *p = *bufp;
	const char *header_name_start = p;
	prsr->hdr_name_idx = 0;

	enum {
		sw_start = 0,
		skip_status_line,
		skipped_status_line_almost_done,
		sw_name,
		sw_space_before_value,
		sw_value,
		sw_space_after_value,
		sw_almost_done,
		sw_header_almost_done
	} state = sw_start;

	static char lowcase[] =
			"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
			"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-\0\0" "0123456789"
			"\0\0\0\0\0\0\0abcdefghijklmnopqrstuvwxyz\0\0\0\0_\0"
			"abcdefghijklmnopqrstuvwxyz\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
			"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
			"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
			"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
			"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
			"\0\0\0\0\0\0\0\0\0\0";

	for (; p < end_buf; p++) {
		ch = *p;
		switch (state) {

		case sw_start:
			switch (ch) {
			case CR:
				prsr->hdr_value_end = p;
				state = sw_header_almost_done;
				break;
			case LF:
				prsr->hdr_value_end = p;
				goto header_done;
			default:
				state = sw_name;
				c = lowcase[ch];
				if (c != 0) {
					prsr->hdr_name[0] = c;
					prsr->hdr_name_idx = 1;
					break;
				}
				if (ch == '\0') {
					return HTTP_PARSE_INVALID;
				}
				break;
			}
			break;
		case skip_status_line:
			switch (ch) {
			case LF:
				goto skipped_status;
			case CR:
				state = skipped_status_line_almost_done;
			default:
				break;
			}
			break;
		case skipped_status_line_almost_done:
			switch (ch) {
			case LF:
				goto skipped_status;
			case CR:
				break;
			default:
				return HTTP_PARSE_INVALID;
			}
			break;

		case sw_name:
			c = lowcase[ch];
			if (c != 0) {
				if (prsr->hdr_name_idx < max_hname_len) {
					prsr->hdr_name[prsr->hdr_name_idx] = c;
					prsr->hdr_name_idx++;
				}
				break;
			}
			if (ch == ':') {
				state = sw_space_before_value;
				break;
			}
			if (ch == CR) {
				prsr->hdr_value_start = p;
				prsr->hdr_value_end = p;
				state = sw_almost_done;
				break;
			}
			if (ch == LF) {
				prsr->hdr_value_start = p;
				prsr->hdr_value_end = p;
				goto done;
			}

			if (ch == '/' && p - header_name_start == 4 &&
				strncmp(header_name_start, "HTTP", 4) == 0) {
				int rc = http_parse_status_line(prsr,
							&header_name_start,
							end_buf);
				if (rc == HTTP_PARSE_INVALID) {
					prsr->http_minor = -1;
					prsr->http_major = -1;
					state = sw_start;
				} else {

					state = skip_status_line;
				}
				break;
			}
			if (ch == '\0')
				return HTTP_PARSE_INVALID;
			break;

		case sw_space_before_value:
			switch (ch) {
			case ' ':
				break;
			case CR:
				prsr->hdr_value_start = p;
				prsr->hdr_value_end = p;
				state = sw_almost_done;
				break;
			case LF:
				prsr->hdr_value_start = p;
				prsr->hdr_value_end = p;
				goto done;
			case '\0':
				return HTTP_PARSE_INVALID;
			default:
				prsr->hdr_value_start = p;
				state = sw_value;
				break;
			}
			break;

		case sw_value:
			switch (ch) {
			case ' ':
				prsr->hdr_value_end = p;
				state = sw_space_after_value;
				break;
			case CR:
				prsr->hdr_value_end = p;
				state = sw_almost_done;
				break;
			case LF:
				prsr->hdr_value_end = p;
				goto done;
			case '\0':
				return HTTP_PARSE_INVALID;
			}
			break;

		case sw_space_after_value:
			switch (ch) {
			case ' ':
				break;
			case CR:
				state = sw_almost_done;
				break;
			case LF:
				goto done;
			case '\0':
				return HTTP_PARSE_INVALID;
			default:
				state = sw_value;
				break;
			}
			break;

		case sw_almost_done:
			switch (ch) {
			case LF:
				goto done;
			case CR:
				break;
			default:
				return HTTP_PARSE_INVALID;
			}
			break;

		case sw_header_almost_done:
			if (ch == LF)
				goto header_done;
			else
				return HTTP_PARSE_INVALID;
		}
	}

skipped_status:
	*bufp = p + 1;
	return HTTP_PARSE_CONTINUE;

done:
	*bufp = p + 1;
	return HTTP_PARSE_OK;

header_done:
	*bufp = p + 1;
	return HTTP_PARSE_DONE;
}

Input: {'prsr': '{hdr_value_start: 0x7fffffffdea0 "\\220\\337\\377\\377\\377\\177", hdr_value_end: 0x279934 <ExecuteCallback()+292> "\\306\\005\\335l\\n", http_major: -8240, http_minor: 32767, hdr_name: 0x7ffff7ae31b0 "A", hdr_name_idx: 13204208}', 'bufp': 'error', 'end_buf': '0xca05c0 ""', 'max_hname_len': '32767'}

Output: {'type': 'int', 'value': '0'}


static int append_comment(struct libmnt_table *tb,
			  struct libmnt_fs *fs,
			  const char *comm,
			  int eof)
{
	int rc, intro = mnt_table_get_nents(tb) == 0;

	if (intro && is_terminated_by_blank(mnt_table_get_intro_comment(tb)))
		intro = 0;

	DBG(TAB, ul_debugobj(tb, "appending %s comment",
			intro ? "intro" :
			eof ? "trailing" : "fs"));
	if (intro)
		rc = mnt_table_append_intro_comment(tb, comm);
	else if (eof) {
		rc = mnt_table_set_trailing_comment(tb,
				mnt_fs_get_comment(fs));
		if (!rc)
			rc = mnt_table_append_trailing_comment(tb, comm);
		if (!rc)
			rc = mnt_fs_set_comment(fs, NULL);
	} else
		rc = mnt_fs_append_comment(fs, comm);
	return rc;
}

Input: {'tb': 'error', 'fs': '{ents: {next: error, prev: NULL}, tab: NULL, refcount: 0, opts_age: 0, optlist: error, id: 1647719989, parent: 892875106, devno: 13624, bindsrc: NULL, source: 0x660 <error: Cannot access memory at address 0x660>, tagname: 0x50 <error: Cannot access memory at address 0x50>, tagval: 0x1056d30 "AV", root: 0x3239316235322f65 <error: Cannot access memory at address 0x3239316235322f65>, target: 0x3665626536383334 <error: Cannot access memory at address 0x3665626536383334>, fstype: 0x3837653732643961 <error: Cannot access memory at address 0x3837653732643961>, optstr: 0x3232336236396435 <error: Cannot access memory at address 0x3232336236396435>, vfs_optstr: 0x111 <error: Cannot access memory at address 0x111>, opt_fields: 0x236800002361 <error: Cannot access memory at address 0x236800002361>, fs_optstr: 0x563800005630 <error: Cannot access memory at address 0x563800005630>, user_optstr: 0x564900005641 <error: Cannot access memory at address 0x564900005641>, attrs: 0xe828000088e0 <error: Cannot access memory at address 0xe828000088e0>, freq: 59456, passno: 59464, swaptype: 0x1650000002a8 <error: Cannot access memory at address 0x1650000002a8>, size: 24842090845816, usedsize: 24979529799336, priority: 7160, flags: 7192, tid: 7201, comment: 0x1c4100001c38 <error: Cannot access memory at address 0x1c4100001c38>, userdata: VOID}', 'comm': '0x1056ca0 "#\\n"', 'eof': '32767'}

Output: {'type': 'int', 'value': '0'}


static int
yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg,
                yytype_int16 *yyssp, int yytoken)
{
  YYSIZE_T yysize0 = yytnamerr (YY_NULLPTR, yytname[yytoken]);
  YYSIZE_T yysize = yysize0;
  enum { YYERROR_VERBOSE_ARGS_MAXIMUM = 5 };

  const char *yyformat = YY_NULLPTR;

  char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM];

  int yycount = 0;

  if (yytoken != YYEMPTY)
    {
      int yyn = yypact[*yyssp];
      yyarg[yycount++] = yytname[yytoken];
      if (!yypact_value_is_default (yyn))
        {

          int yyxbegin = yyn < 0 ? -yyn : 0;

          int yychecklim = YYLAST - yyn + 1;
          int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
          int yyx;

          for (yyx = yyxbegin; yyx < yyxend; ++yyx)
            if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR
                && !yytable_value_is_error (yytable[yyx + yyn]))
              {
                if (yycount == YYERROR_VERBOSE_ARGS_MAXIMUM)
                  {
                    yycount = 1;
                    yysize = yysize0;
                    break;
                  }
                yyarg[yycount++] = yytname[yyx];
                {
                  YYSIZE_T yysize1 = yysize + yytnamerr (YY_NULLPTR, yytname[yyx]);
                  if (! (yysize <= yysize1
                         && yysize1 <= YYSTACK_ALLOC_MAXIMUM))
                    return 2;
                  yysize = yysize1;
                }
              }
        }
    }

  switch (yycount)
    {
# define YYCASE_(N, S)                      \
      case N:                               \
        yyformat = S;                       \
      break
    default:
      YYCASE_(0, YY_("syntax error"));
      YYCASE_(1, YY_("syntax error, unexpected %s"));
      YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s"));
      YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s"));
      YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s"));
      YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s"));
# undef YYCASE_
    }

  {
    YYSIZE_T yysize1 = yysize + yystrlen (yyformat);
    if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM))
      return 2;
    yysize = yysize1;
  }

  if (*yymsg_alloc < yysize)
    {
      *yymsg_alloc = 2 * yysize;
      if (! (yysize <= *yymsg_alloc
             && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM))
        *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM;
      return 1;
    }

  {
    char *yyp = *yymsg;
    int yyi = 0;
    while ((*yyp = *yyformat) != '\0')
      if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount)
        {
          yyp += yytnamerr (yyp, yyarg[yyi++]);
          yyformat += 2;
        }
      else
        {
          yyp++;
          yyformat++;
        }
  }
  return 0;
}

Input: {'yymsg_alloc': '0', 'yymsg': '0x7fffffffde20 "\\240\\020\\032\\001"', 'yyssp': 'error', 'yytoken': '0'}

{'yytoken': {'type': 'int', 'value': '0'}}

Output: {'type': 'unsigned long', 'value': '4'}


int stun_is_response_str(const uint8_t *buf, size_t len) {
  if (is_channel_msg_str(buf, len)) {
    return 0;
  }
  if (IS_STUN_SUCCESS_RESP(stun_get_msg_type_str(buf, len))) {
    return 1;
  }
  if (IS_STUN_ERR_RESP(stun_get_msg_type_str(buf, len))) {
    return 1;
  }
  return 0;
}

Input: {'buf': '0x7ffffffede10 "p\\336\\377\\377\\377\\177"', 'len': '4294967316'}

Output: {'type': 'int', 'value': '0'}


int stun_is_success_response_str(const uint8_t *buf, size_t len) {
  if (is_channel_msg_str(buf, len)) {
    return 0;
  }
  return IS_STUN_SUCCESS_RESP(stun_get_msg_type_str(buf, len));
}

Input: {'buf': '0x7ffffffede64 ";\\024"', 'len': '20'}

Output: {'type': 'int', 'value': '0'}


int stun_is_binding_response_str(const uint8_t *buf, size_t len) {
  if (stun_is_command_message_str(buf, len) && (stun_get_method_str(buf, len) == STUN_METHOD_BINDING)) {
    if (stun_is_response_str(buf, len)) {
      return 1;
    }
  }
  return 0;
}

Input: {'buf': '0x7ffffffede64 "!\\001"', 'len': '20'}

Output: {'type': 'int', 'value': '1'}


int stun_is_command_message_full_check_str(const uint8_t *buf, size_t blen, int must_check_fingerprint,
                                           int *fingerprint_present) {
  if (!stun_is_command_message_str(buf, blen)) {
    return 0;
  }
  stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, blen, STUN_ATTRIBUTE_FINGERPRINT);
  if (!sar) {
    if (fingerprint_present) {
      *fingerprint_present = 0;
    }
    if (stun_get_method_str(buf, blen) == STUN_METHOD_BINDING) {
      return 1;
    }
    return !must_check_fingerprint;
  }
  if (stun_attr_get_len(sar) != 4) {
    return 0;
  }
  const uint32_t *fingerprint = (const uint32_t *)stun_attr_get_value(sar);
  if (!fingerprint) {
    return !must_check_fingerprint;
  }
  uint32_t crc32len = (uint32_t)((((const uint8_t *)fingerprint) - buf) - 4);
  int ret = (*fingerprint == nswap32(ns_crc32(buf, crc32len) ^ ((uint32_t)0x5354554e)));
  if (ret && fingerprint_present) {
    *fingerprint_present = ret;
  }
  return ret;
}

Input: {'buf': 'NULL', 'blen': '17733578432009581568', 'must_check_fingerprint': '0', 'fingerprint_present': '0'}

Output: {'type': 'int', 'value': '1'}


stun_attr_ref stun_attr_get_first_str(const uint8_t *buf, size_t len) {

  int bufLen = stun_get_command_message_len_str(buf, len);
  if (bufLen > STUN_HEADER_LENGTH) {
    stun_attr_ref attr = (stun_attr_ref)(buf + STUN_HEADER_LENGTH);
    return stun_attr_check_valid(attr, bufLen - STUN_HEADER_LENGTH);
  }

  return NULL;
}

Input: {'buf': '0xd68 <error: Cannot access memory at address 0xd68>', 'len': '4983620'}

Output: {'type': 'int', 'value': '60'}


static stun_attr_ref stun_attr_check_valid(stun_attr_ref attr, size_t remaining) {

  if (remaining >= 4) {

    size_t attrlen = stun_attr_get_len(attr);
    remaining -= 4;

    uint16_t rem4 = ((uint16_t)attrlen) & 0x0003;
    if (rem4) {
      attrlen = attrlen + 4 - (int)rem4;
    }

    if (attrlen <= remaining) {
      return attr;
    }
  }

  return NULL;
}

Input: {'attr': '0xed11b0', 'remaining': '60'}

{'remaining': {'type': 'size_t', 'value': '60'}}

Output: {'type': 'int', 'value': '0'}


stun_attr_ref stun_attr_get_next_str(const uint8_t *buf, size_t len, stun_attr_ref prev) {

  if (!prev) {
    return stun_attr_get_first_str(buf, len);
  } else {
    const uint8_t *end = buf + stun_get_command_message_len_str(buf, len);
    int attrlen = stun_attr_get_len(prev);
    uint16_t rem4 = ((uint16_t)attrlen) & 0x0003;
    if (rem4) {
      attrlen = attrlen + 4 - (int)rem4;
    }

    if (attrlen < end - (const uint8_t *)prev - 4) {
      const uint8_t *attr_end = (const uint8_t *)prev + 4 + attrlen;
      return stun_attr_check_valid(attr_end, end - attr_end);
    }
    return NULL;
  }
}

Input: {'buf': '0xed11c4 ""', 'len': '140737488346272', 'prev': '0xed11c4'}

Output: {'type': 'int', 'value': '60'}


int stun_check_message_integrity_str(turn_credential_type ct, uint8_t *buf, size_t len, const uint8_t *uname,
                                     const uint8_t *realm, const uint8_t *upwd, SHATYPE shatype) {
  hmackey_t key;
  password_t pwd;

  if (ct == TURN_CREDENTIALS_SHORT_TERM) {
    strncpy((char *)pwd, (const char *)upwd, sizeof(password_t) - 1);
    pwd[sizeof(password_t) - 1] = 0;
  } else if (stun_produce_integrity_key_str(uname, realm, upwd, key, shatype) < 0) {
    return -1;
  }

  return stun_check_message_integrity_by_key_str(ct, buf, len, key, pwd, shatype);
}

Input: {'ct': '4294958648', 'buf': '0xed11b0 ""', 'len': '60', 'uname': '0x10052a1a0 <error: Cannot access memory at address 0x10052a1a0>', 'realm': 'NULL', 'upwd': 'NULL', 'shatype': 'SHATYPE_DEFAULT'}

Output: {'type': 'int', 'value': '-1'}


extern int
onig_initialize(OnigEncoding encodings[], int n)
{
  int i;
  int r;

  if (onig_inited != 0)
    return 0;

  onigenc_init();

  onig_inited = 1;

  for (i = 0; i < n; i++) {
    OnigEncoding enc = encodings[i];
    r = onig_initialize_encoding(enc);
    if (r != 0)
      return r;
  }

  return ONIG_NORMAL;
}

Input: {'encodings[]': 'NULL', 'n': '32767'}

Output: {'type': 'int', 'value': '0'}


extern int
onig_set_callout_of_name(OnigEncoding enc, OnigCalloutType callout_type,
                         UChar* name, UChar* name_end, int in,
                         OnigCalloutFunc start_func,
                         OnigCalloutFunc end_func,
                         int arg_num, unsigned int arg_types[],
                         int opt_arg_num, OnigValue opt_defaults[])
{
  int r;
  int i;
  int j;
  int id;
  int is_not_single;
  CalloutNameEntry* e;
  CalloutNameListEntry* fe;

  if (callout_type != ONIG_CALLOUT_TYPE_SINGLE)
    return ONIGERR_INVALID_ARGUMENT;

  if (arg_num < 0 || arg_num > ONIG_CALLOUT_MAX_ARGS_NUM)
    return ONIGERR_INVALID_CALLOUT_ARG;

  if (opt_arg_num < 0 || opt_arg_num > arg_num)
    return ONIGERR_INVALID_CALLOUT_ARG;

  if (start_func == 0 && end_func == 0)
    return ONIGERR_INVALID_CALLOUT_ARG;

  if ((in & ONIG_CALLOUT_IN_PROGRESS) == 0 && (in & ONIG_CALLOUT_IN_RETRACTION) == 0)
    return ONIGERR_INVALID_CALLOUT_ARG;

  for (i = 0; i < arg_num; i++) {
    unsigned int t = arg_types[i];
    if (t == ONIG_TYPE_VOID)
      return ONIGERR_INVALID_CALLOUT_ARG;
    else {
      if (i >= arg_num - opt_arg_num) {
        if (t != ONIG_TYPE_LONG && t != ONIG_TYPE_CHAR && t != ONIG_TYPE_STRING &&
            t != ONIG_TYPE_TAG)
          return ONIGERR_INVALID_CALLOUT_ARG;
      }
      else {
        if (t != ONIG_TYPE_LONG) {
          t = t & ~ONIG_TYPE_LONG;
          if (t != ONIG_TYPE_CHAR && t != ONIG_TYPE_STRING && t != ONIG_TYPE_TAG)
            return ONIGERR_INVALID_CALLOUT_ARG;
        }
      }
    }
  }

  if (! is_allowed_callout_name(enc, name, name_end)) {
    return ONIGERR_INVALID_CALLOUT_NAME;
  }

  is_not_single = (callout_type != ONIG_CALLOUT_TYPE_SINGLE);
  id = callout_name_entry(&e, enc, is_not_single, name, name_end);
  if (id < 0) return id;

  r = ONIG_NORMAL;
  if (IS_NULL(GlobalCalloutNameList)) {
    r = make_callout_func_list(&GlobalCalloutNameList, 10);
    if (r != ONIG_NORMAL) return r;
  }

  while (id >= GlobalCalloutNameList->n) {
    int rid;
    r = callout_func_list_add(GlobalCalloutNameList, &rid);
    if (r != ONIG_NORMAL) return r;
  }

  fe = GlobalCalloutNameList->v + id;
  fe->type         = callout_type;
  fe->in           = in;
  fe->start_func   = start_func;
  fe->end_func     = end_func;
  fe->arg_num      = arg_num;
  fe->opt_arg_num  = opt_arg_num;
  fe->name         = e->name;

  for (i = 0; i < arg_num; i++) {
    fe->arg_types[i] = arg_types[i];
  }
  for (i = arg_num - opt_arg_num, j = 0; i < arg_num; i++, j++) {
    if (IS_NULL(opt_defaults)) return ONIGERR_INVALID_ARGUMENT;
    if (fe->arg_types[i] == ONIG_TYPE_STRING) {
      OnigValue* val;
      UChar* ds;

      val = opt_defaults + j;
      ds = onigenc_strdup(enc, val->s.start, val->s.end);
      CHECK_NULL_RETURN_MEMERR(ds);

      fe->opt_defaults[i].s.start = ds;
      fe->opt_defaults[i].s.end   = ds + (val->s.end - val->s.start);
    }
    else {
      fe->opt_defaults[i] = opt_defaults[j];
    }
  }

  r = id;
  return r;
}

Input: {'enc': '0x5dc019', 'callout_type': 'ONIG_CALLOUT_TYPE_SINGLE', 'name': '0x7ffff7e215c0 <_IO_2_1_stderr_> "\\207(\\255\\373"', 'name_end': '0x1ffffdd80 <error: Cannot access memory at address 0x1ffffdd80>', 'in': '32767', 'start_func': '0x5dc019', 'end_func': '0x656818 <OnigEncodingASCII>', 'arg_num': '0', 'arg_types[]': 'NULL', 'opt_arg_num': '0', 'opt_defaults[]': 'NULL'}

Output: {'type': 'int', 'value': '1'}


static int
st_insert_callout_name_table(hash_table_type table,
                             OnigEncoding enc, int type,
                             UChar* str_key, UChar* end_key,
                             hash_data_type value)
{
  st_callout_name_key* key;
  int result;

  key = (st_callout_name_key* )xmalloc(sizeof(st_callout_name_key));
  CHECK_NULL_RETURN_MEMERR(key);

  key->enc  = enc;
  key->type = type;
  key->s    = str_key;
  key->end  = end_key;
  result = onig_st_insert(table, (st_data_t )key, value);
  if (result) {
    xfree(key);
  }
  return result;
}

Input: {'table': '0x656818 <OnigEncodingASCII>', 'enc': '0x5dc019', 'type': '0', 'str_key': '0x400000001 <error: Cannot access memory at address 0x400000001>', 'end_key': '0x10065b000 <error: Cannot access memory at address 0x10065b000>', 'value': '17183584'}

Output: {'type': 'int', 'value': '0'}


extern int
onig_st_lookup_callout_name_table(hash_table_type table,
                                  OnigEncoding enc,
                                  int type,
                                  const UChar* str_key,
                                  const UChar* end_key,
                                  hash_data_type *value)
{
  st_callout_name_key key;

  key.enc  = enc;
  key.type = type;
  key.s    = (UChar* )str_key;
  key.end  = (UChar* )end_key;

  return onig_st_lookup(table, (st_data_t )(&key), value);
}

Input: {'table': '0x7ffff7ccc5f3', 'enc': '0x1054d70', 'type': '0', 'str_key': '0x7fffffffd5e0 "\\200\\326\\377\\377\\377\\177"', 'end_key': '0xffffd5e0 <error: Cannot access memory at address 0xffffd5e0>', 'value': '6587104'}

Output: {'type': 'int', 'value': '0'}


static int
prs_branch(Node** top, PToken* tok, int term, UChar** src, UChar* end,
           ParseEnv* env, int group_head)
{
  int r;
  Node *node, **headp;

  *top = NULL;
  INC_PARSE_DEPTH(env->parse_depth);

  r = prs_exp(&node, tok, term, src, end, env, group_head);
  if (r < 0) {
    onig_node_free(node);
    return r;
  }

  if (r == TK_EOT || r == term || r == TK_ALT) {
    *top = node;
  }
  else {
    *top = node_new_list(node, NULL);
    if (IS_NULL(*top)) {
    mem_err:
      onig_node_free(node);
      return ONIGERR_MEMORY;
    }

    headp = &(ND_CDR(*top));
    while (r != TK_EOT && r != term && r != TK_ALT) {
      r = prs_exp(&node, tok, term, src, end, env, FALSE);
      if (r < 0) {
        onig_node_free(node);
        return r;
      }

      if (ND_TYPE(node) == ND_LIST) {
        *headp = node;
        while (IS_NOT_NULL(ND_CDR(node))) node = ND_CDR(node);
        headp = &(ND_CDR(node));
      }
      else {
        *headp = node_new_list(node, NULL);
        if (IS_NULL(*headp)) goto mem_err;
        headp = &(ND_CDR(*headp));
      }
    }
  }

  DEC_PARSE_DEPTH(env->parse_depth);
  return r;
}

Input: {'top': 'NULL', 'tok': 'error', 'term': '1', 'src': 'error', 'end': '0x1100000002 <error: Cannot access memory at address 0x1100000002>', 'env': 'error', 'group_head': '2'}

Output: {'type': 'int', 'value': '0'}


static int
prs_alts(Node** top, PToken* tok, int term, UChar** src, UChar* end,
         ParseEnv* env, int group_head)
{
  int r;
  Node *node, **headp;
  OnigOptionType save_options;

  *top = NULL;
  INC_PARSE_DEPTH(env->parse_depth);
  save_options = env->options;

  r = prs_branch(&node, tok, term, src, end, env, group_head);
  if (r < 0) {
    onig_node_free(node);
    return r;
  }

  if (r == term) {
    *top = node;
  }
  else if (r == TK_ALT) {
    *top  = onig_node_new_alt(node, NULL);
    if (IS_NULL(*top)) {
      onig_node_free(node);
      return ONIGERR_MEMORY;
    }

    headp = &(ND_CDR(*top));
    while (r == TK_ALT) {
      r = fetch_token(tok, src, end, env);
      if (r < 0) return r;
      r = prs_branch(&node, tok, term, src, end, env, FALSE);
      if (r < 0) {
        onig_node_free(node);
        return r;
      }
      *headp = onig_node_new_alt(node, NULL);
      if (IS_NULL(*headp)) {
        onig_node_free(node);
        onig_node_free(*top);
        *top = NULL_NODE;
        return ONIGERR_MEMORY;
      }

      headp = &(ND_CDR(*headp));
    }

    if (tok->type != (enum TokenSyms )term)
      goto err;
  }
  else {
    onig_node_free(node);
  err:
    if (term == TK_SUBEXP_CLOSE)
      return ONIGERR_END_PATTERN_WITH_UNMATCHED_PARENTHESIS;
    else
      return ONIGERR_PARSER_BUG;
  }

  env->options = save_options;
  DEC_PARSE_DEPTH(env->parse_depth);
  return r;
}

Input: {'top': 'NULL', 'tok': '{type: 17182272, code_point_continue: 0, escaped: -137625702, base_num: 32767, backp: 0x7fffffffdb38 "Ts", u: {s: 0x105e320 "", byte: 32 \' \', code: 17163040, anchor: 17163040, subtype: 17163040, repeat: {lower = 17163040, upper = 0, greedy = 17182272, possessive = 0}, backref: {num = 17163040, ref1 = 0, refs = 0x1062e40, by_name = 17182272, exist_level = 0, level = -9712}, call: {name = 0x105e320 "", name_end = 0x1062e40 "\\200.\\006\\001", gnum = 17182272, by_number = 0}, prop: {ctype = 17163040, not = 0}}}', 'term': '0', 'src': '0x4000000000007354 <error: Cannot access memory at address 0x4000000000007354>', 'end': '0x7fffffffd8e0 "\\020\\332\\377\\377\\377\\177"', 'env': '{options: 3850979413, case_fold_flag: 2888107146, enc: 0x25048801040065a5, syntax: error, cap_history: 440, backtrack_mem: 2428722432, backrefed_mem: 3850979413, pattern: 0x25048801040065a5 <error: Cannot access memory at address 0x25048801040065a5>, pattern_end: 0xf87d89480065a5ad <error: Cannot access memory at address 0xf87d89480065a5ad>, error: 0xf8458b48f0758948 <error: Cannot access memory at address 0xf8458b48f0758948>, error_end: 0xf2e66c35d00b60f <error: Cannot access memory at address 0xf2e66c35d00b60f>, reg: error, num_call: -443987883, num_mem: 283935560, num_named: -1373305718, mem_alloc: 67134885, mem_env_static: [{\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d10 <onigenc_single_byte_code_to_mbclen+16>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x65a5ae25048801\\n\', \'message\': \'Cannot access memory at address 0x65a5ae25048801\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d18 <onigenc_single_byte_code_to_mbclen+24>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x7589fc758bfc7d89\\n\', \'message\': \'Cannot access memory at address 0x7589fc758bfc7d89\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d20 <onigenc_single_byte_code_to_mbclen+32>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0xc5e800000100bff8\\n\', \'message\': \'Cannot access memory at address 0xc5e800000100bff8\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d28 <onigenc_single_byte_code_to_mbclen+40>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x70b8f8558bfff0ad\\n\', \'message\': \'Cannot access memory at address 0x70b8f8558bfff0ad\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d30 <onigenc_single_byte_code_to_mbclen+48>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x1b9fffffe\\n\', \'message\': \'Cannot access memory at address 0x1b9fffffe\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d38 <onigenc_single_byte_code_to_mbclen+56>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x420f00000100fa81\\n\', \'message\': \'Cannot access memory at address 0x420f00000100fa81\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d40 <onigenc_single_byte_code_to_mbclen+64>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x66c35d10c48348c1\\n\', \'message\': \'Cannot access memory at address 0x66c35d10c48348c1\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d48\', \'value\': {\'u\': {\'@\': \'NESTED\', \'type\': None, \'value\': "{base = {node_type = ND_STRING, status = 0, parent = 0x0, body = 0x0}, str = {node_type = ND_STRING, status = 0, parent = 0x0, s = 0x0, end = 0x0, flag = 0, buf = \'\\\\000\' <repeats 23 times>, capacity = 0}, cclass = {node_type = ND_STRING, status = 0, parent = 0x0, flags = 0, bs = {0, 0, 0, 0, 0, 0, 0, 0}, mbuf = 0x0}, quant = {node_type = ND_STRING, status = 0, parent = 0x0, body = 0x0, lower = 0, upper = 0, greedy = 0, emptiness = BODY_IS_NOT_EMPTY, head_exact = 0x0, next_head_exact = 0x0, include_referred = 0, empty_status_mem = 0}, bag = {node_type = ND_STRING, status = 0, parent = 0x0, body = 0x0, type = BAG_MEMORY, {m = {regnum = 0, called_addr = 0, entry_count = 0, called_state = 0}, o = {options = 0}, te = {Then = 0x0, Else = 0x0}}, min_len = 0, max_len = 0, min_char_len = 0, max_char_len = 0, opt_count = 0}, backref = {node_type = ND_STRING, status = 0, parent = 0x0, back_num = 0, back_static = {0, 0, 0, 0, 0, 0}, back_dynamic = 0x0, nest_level = 0}, anchor = {node_type = ND_STRING, status = 0, parent = 0x0, body = 0x0, type = 0, char_min_len = 0, char_max_len = 0, ascii_mode = 0, lead_node = 0x0}, cons = {node_type = ND_STRING, status = 0, parent = 0x0, car = 0x0, cdr = 0x0}, ctype = {node_type = ND_STRING, status = 0, parent = 0x0, ctype = 0, not = 0, ascii_mode = 0}, call = {node_type = ND_STRING, status = 0, parent = 0x0, body = 0x0, by_number = 0, called_gnum = 0, name = 0x0, name_end = 0x0, entry_count = 0}, gimmick = {node_type = ND_STRING, status = 0, parent = 0x0, type = GIMMICK_FAIL, detail_type = 0, num = 0, id = 0}}", \'@@\': \'struct\'}, \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d50 <onigenc_single_byte_code_to_mbc>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0xaf25048ae5894855\\n\', \'message\': \'Cannot access memory at address 0xaf25048ae5894855\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d58 <onigenc_single_byte_code_to_mbc+8>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x25048801040065a5\\n\', \'message\': \'Cannot access memory at address 0x25048801040065a5\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d60 <onigenc_single_byte_code_to_mbc+16>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x48fc7d890065a5af\\n\', \'message\': \'Cannot access memory at address 0x48fc7d890065a5af\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d68 <onigenc_single_byte_code_to_mbc+24>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0xff25fc458bf07589\\n\', \'message\': \'Cannot access memory at address 0xff25fc458bf07589\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d70 <onigenc_single_byte_code_to_mbc+32>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x458b48c188000000\\n\', \'message\': \'Cannot access memory at address 0x458b48c188000000\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d78 <onigenc_single_byte_code_to_mbc+40>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x1b80888f0\\n\', \'message\': \'Cannot access memory at address 0x1b80888f0\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}, {\'mem_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d80 <onigenc_single_byte_code_to_mbc+48>\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x841f0f2e66c35d\\n\', \'message\': \'Cannot access memory at address 0x841f0f2e66c35d\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'empty_repeat_node\': {\'@\': \'POINTER\', \'type\': None, \'address\': \'0x532d88\', \'value\': {\'@\': \'error\', \'error_type\': \'gdb.MemoryError\', \'stacktrace\': \'Traceback (most recent call last):\\n  File "/tracer/var_utils.py", line 72, in serialize_value_to_json\\n    if str(value) == "0x0":\\ngdb.MemoryError: Cannot access memory at address 0x401f0f00000000\\n\', \'message\': \'Cannot access memory at address 0x401f0f00000000\', \'@@\': \'struct\'}, \'@@\': \'pointer\'}, \'@@\': \'struct\'}], mem_env_dynamic: error, backref_num: 67134885, keep_num: 621053953, id_num: 6661552, save_alloc_num: -125990584, saves: error, unset_addr_list: error, parse_depth: 0, flags: 4202255}', 'group_head': '0'}

Output: {'type': 'int', 'value': '0'}


static int
exec(OnigEncoding enc, OnigOptionType options, OnigSyntaxType* syntax,
     char* apattern, char* apattern_end,
     char* adata_pattern, char* adata_pattern_end,
     char* astr, UChar* end, int backward, int sl)
{
  int r;
  regex_t* reg;
  OnigErrorInfo einfo;
  UChar* str     = (UChar* )astr;
  UChar* pattern = (UChar* )apattern;
  UChar* pattern_end = (UChar* )apattern_end;
  UChar* data_pattern = (UChar* )adata_pattern;
  UChar* data_pattern_end = (UChar* )adata_pattern_end;

  EXEC_COUNT++;
  EXEC_COUNT_INTERVAL++;

  onig_initialize(&enc, 1);
  (void)onig_set_progress_callout(progress_callout_func);
#ifdef PARSE_DEPTH_LIMIT
  onig_set_parse_depth_limit(PARSE_DEPTH_LIMIT);
#endif
  onig_set_subexp_call_max_nest_level(MAX_SUBEXP_CALL_NEST_LEVEL);
  onig_set_callback_each_match(each_match_callback_func);

  r = onig_new(&reg, pattern, pattern_end,
               (options & OPTIONS_AT_COMPILE), enc, syntax, &einfo);
  if (r != ONIG_NORMAL) {
    char s[ONIG_MAX_ERROR_MESSAGE_LEN];
    onig_error_code_to_str((UChar* )s, r, &einfo);
#ifdef STANDALONE
    fprintf(stdout, "ERROR: %s\n", s);
#endif
    onig_end();

    if (r == ONIGERR_PARSER_BUG ||
        r == ONIGERR_STACK_BUG  ||
        r == ONIGERR_UNDEFINED_BYTECODE ||
        r == ONIGERR_UNEXPECTED_BYTECODE) {
      return -2;
    }
    else
      return -1;
  }
  REGEX_SUCCESS_COUNT++;

  if (data_pattern == pattern ||
      onigenc_is_valid_mbc_string(enc, data_pattern, data_pattern_end) != 0) {
    r = search(reg, data_pattern, data_pattern_end, options, backward, sl);
    if (r == -2) return -2;
  }

  if (onigenc_is_valid_mbc_string(enc, str, end) != 0) {
    VALID_STRING_COUNT++;
    r = search(reg, str, end, options, backward, sl);
    if (r == -2) return -2;
  }

  onig_free(reg);
  onig_end();
  return 0;
}

Input: {'enc': '0x1054d70', 'options': '0', 'syntax': '{op: 1, op2: 1, behavior: 0, options: 1, meta_char_table: {esc: 2, anychar: 0, anytime: 0, zero_or_one_time: 3, one_or_more_time: 0, anychar_anytime: 4}}', 'apattern': '0x7ffff7e20b80 ""', 'apattern_end': '0x1 <error: Cannot access memory at address 0x1>', 'adata_pattern': 'NULL', 'adata_pattern_end': 'NULL', 'astr': '0x100000000 <error: Cannot access memory at address 0x100000000>', 'end': '0x5b0000006e <error: Cannot access memory at address 0x5b0000006e>', 'backward': '119', 'sl': '124'}

Output: {'type': 'int', 'value': '0'}


static int
add_op(regex_t* reg, int opcode)
{
  int r;

  r = ops_new(reg);
  if (r != ONIG_NORMAL) return r;

#ifdef USE_DIRECT_THREADED_CODE
  *(reg->ocs + (reg->ops_curr - reg->ops)) = opcode;
#else
  reg->ops_curr->opcode = opcode;
#endif

  return 0;
}

Input: {'reg': '{ops: NULL, ocs: NULL, ops_curr: {opaddr: NULL}, ops_used: 37611428, ops_alloc: 0, string_pool: NULL, string_pool_end: NULL, num_mem: 0, num_repeat: 0, num_empty_check: 0, num_call: 0, capture_history: 0, push_mem_start: 0, push_mem_end: 81, stack_pop_level: 0, repeat_range_alloc: 37611552, repeat_range: {lower: 0, upper: 393218, u: {pcode: error, offset: 131073}}, enc: 0x6135633562353730, options: 1650602297, syntax: error, case_fold_flag: 1664246320, name_table: VOID, optimize: 0, threshold_len: 0, anchor: 0, anc_dist_min: 0, anc_dist_max: 81, sub_anchor: 0, exact: 0x23de870 "\\300\\350=\\002", exact_end: 0x1052010 "", map: "9a5c534c1defe271af64c7e4653c29478b\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000Q\\000\\000\\000\\000\\000\\000\\000\\300\\350=\\002\\000\\000\\000\\000\\020 \\005\\001\\000\\000\\000\\00034a42eae24f33616cd394a9c9e2f1f7176\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000Q\\000\\000\\000\\000\\000\\000\\000\\020\\351=\\002\\000\\000\\000\\000\\020 \\005\\001\\000\\000\\000\\000950be8ebb5bb5fbf5d8dea2a7eeb25145e\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000Q\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\020 \\005\\001\\000\\000\\000\\000760e086b749f9afe", map_offset: 946169145, dist_min: 959592293, dist_max: 1647339058, extp: error}', 'opcode': '0'}

Output: {'type': 'int', 'value': '0'}


static int
onig_region_resize_clear(OnigRegion* region, int n)
{
  int r;

  r = onig_region_resize(region, n);
  if (r != 0) return r;
  onig_region_clear(region);
  return 0;
}

Input: {'region': '{allocated: 17185952, num_regs: 0, beg: 1, end: 5341610, history_root: error}', 'n': '32767'}

Output: {'type': 'int', 'value': '0'}


MmsValue*
MmsValue_decodeMmsData(uint8_t* buffer, int bufPos, int bufferLength, int* endBufPos)
{
    MmsValue* value = NULL;

    int dataEndBufPos = bufferLength;

    if (bufferLength < 1)
        goto exit_with_error;

    uint8_t tag = buffer[bufPos++];

    int dataLength;

    bufPos = BerDecoder_decodeLength(buffer, &dataLength, bufPos, dataEndBufPos);

    if (bufPos < 0)
        goto exit_with_error;

    if ((tag != 0) && (dataLength == 0))
        goto exit_with_error;

    switch (tag) {

    case 0xa1:
    case 0xa2:
    {
        int elementCount = getNumberOfElements(buffer, bufPos, dataLength);

        if (elementCount < 0)
            goto exit_with_error;

        if (tag == 0xa1)
            value = MmsValue_createEmptyArray(elementCount);
        else
            value = MmsValue_createEmptyStructure(elementCount);

        int i;

        for (i = 0; i < elementCount; i++) {

            int elementLength;

            int newBufPos = BerDecoder_decodeLength(buffer, &elementLength, bufPos + 1, dataEndBufPos);

            if (newBufPos < 0)
                goto exit_with_error;

            int elementBufLength = newBufPos - bufPos + elementLength;

            MmsValue* elementValue = MmsValue_decodeMmsData(buffer, bufPos, bufPos + elementBufLength, NULL);

            if (elementValue == NULL)
                goto exit_with_error;

            MmsValue_setElement(value, i, elementValue);

            bufPos = newBufPos + elementLength;
        }

        if (value == NULL)
            goto exit_with_error;
    }

        break;

    case 0x80:
        value = MmsValue_newDataAccessError((MmsDataAccessError) BerDecoder_decodeUint32(buffer, dataLength, bufPos));
        bufPos += dataLength;
        break;

    case 0x83:
        value = MmsValue_newBoolean(BerDecoder_decodeBoolean(buffer, bufPos));
        bufPos += dataLength;
        break;

    case 0x84:
    {
        int padding = buffer[bufPos];

        if (padding > 7)
            goto exit_with_error;

        int bitStringLength = (8 * (dataLength - 1)) - padding;
        value = MmsValue_newBitString(bitStringLength);
        memcpy(value->value.bitString.buf, buffer + bufPos + 1, dataLength - 1);
        bufPos += dataLength;
    }
        break;

    case 0x85:
        if (dataLength > 8)
            goto exit_with_error;

        value = MmsValue_newInteger(dataLength * 8);
        memcpy(value->value.integer->octets, buffer + bufPos, dataLength);
        value->value.integer->size = dataLength;
        bufPos += dataLength;
        break;

    case 0x86:
        if (dataLength > 8)
            goto exit_with_error;

        value = MmsValue_newUnsigned(dataLength * 8);
        memcpy(value->value.integer->octets, buffer + bufPos, dataLength);
        value->value.integer->size = dataLength;

        bufPos += dataLength;
        break;

    case 0x87:
        if (dataLength == 9)
            value = MmsValue_newDouble(BerDecoder_decodeDouble(buffer, bufPos));
        else if (dataLength == 5)
            value = MmsValue_newFloat(BerDecoder_decodeFloat(buffer, bufPos));
        bufPos += dataLength;
        break;

    case 0x89:
        value = MmsValue_newOctetString(dataLength, dataLength);
        memcpy(value->value.octetString.buf, buffer + bufPos, dataLength);
        bufPos += dataLength;
        break;

    case 0x8a:
        value = MmsValue_newVisibleStringFromByteArray(buffer + bufPos, dataLength);
        bufPos += dataLength;
        break;

    case 0x8c:
        if (dataLength == 4)
            value = MmsValue_newBinaryTime(true);
        else if (dataLength == 6)
            value = MmsValue_newBinaryTime(false);

        if ((dataLength == 4) || (dataLength == 6))
            memcpy(value->value.binaryTime.buf, buffer + bufPos, dataLength);

        bufPos += dataLength;

        break;

    case 0x90:
        value = MmsValue_newVisibleStringFromByteArray(buffer + bufPos, dataLength);
        value->type = MMS_STRING;
        bufPos += dataLength;

        break;

    case 0x91:
        if (dataLength == 8) {
            value = MmsValue_newUtcTime(0);
            MmsValue_setUtcTimeByBuffer(value, buffer + bufPos);
            bufPos += dataLength;
        }
        else
            goto exit_with_error;

        break;

    case 0x00:
        break;

    default:
        goto exit_with_error;
    }

    if (endBufPos != NULL)
        *endBufPos = bufPos;

    return value;

exit_with_error:

    if (value != NULL)
        MmsValue_delete(value);

    return NULL;
}

Input: {'buffer': '0x7fffffffde58 "\\240~\\327"', 'bufPos': '0', 'bufferLength': '9', 'endBufPos': '1220708680'}

{'bufPos': {'type': 'int', 'value': '0'}, 'bufferLength': {'type': 'int', 'value': '9'}}

Output: {'type': 'int', 'value': '2'}


static int
getNumberOfElements(uint8_t* buffer, int bufPos, int elementLength)
{
    int elementIndex = 0;
    int elementEndBufPos = bufPos + elementLength;

    while (bufPos < elementEndBufPos) {
         uint8_t tag = buffer[bufPos++];

         bufPos = BerDecoder_decodeLength(buffer, &elementLength, bufPos, elementEndBufPos);

         if (bufPos < 0)
             goto exit_with_error;

         switch (tag) {
         case 0x80:
             break;
         case 0xa1:
             break;
         case 0xa2:
             break;
         case 0x83:
             break;
         case 0x84:
             break;
         case 0x85:
             break;
         case 0x86:
             break;
         case 0x87:
             break;
         case 0x89:
             break;
         case 0x8a:
             break;
         case 0x8c:
             break;
         case 0x91:
             break;
         case 0x00:
             break;
         default:
             goto exit_with_error;
         }

         bufPos += elementLength;

         elementIndex++;
    }

    return elementIndex;

exit_with_error:
    return -1;
}

Input: {'buffer': '0x7fffffffdddc "\\a"', 'bufPos': '1', 'elementLength': '9'}

{'bufPos': {'type': 'int', 'value': '1'}, 'elementLength': {'type': 'int', 'value': '9'}}

Output: {'type': 'int', 'value': '4'}


static int
BerDecoder_decodeLengthRecursive(uint8_t* buffer, int* length, int bufPos, int maxBufPos, int depth, int maxDepth)
{
    if (bufPos >= maxBufPos)
        return -1;

    uint8_t len1 = buffer[bufPos++];

    if (len1 & 0x80) {
        int lenLength = len1 & 0x7f;

        if (lenLength == 0) {
            *length = getIndefiniteLength(buffer, bufPos, maxBufPos, depth, maxDepth);
        }
        else {
            *length = 0;

            int i;
            for (i = 0; i < lenLength; i++) {
                if (bufPos >= maxBufPos)
                    return -1;

                if (bufPos + (*length) > maxBufPos)
                    return -1;

                *length <<= 8;
                *length += buffer[bufPos++];
            }
        }

    }
    else {
        *length = len1;
    }

    if (*length < 0)
        return -1;

    if (*length > maxBufPos)
        return -1;

    if (bufPos + (*length) > maxBufPos)
        return -1;

    return bufPos;
}

Input: {'buffer': '0x7ffff7e1c8a0 ""', 'length': 'error', 'bufPos': '0', 'maxBufPos': '14121640', 'depth': '0', 'maxDepth': '4088'}

Output: {'type': 'int', 'value': '-1'}


int symtab_insert(policydb_t * pol, uint32_t sym,
		  hashtab_key_t key, hashtab_datum_t datum,
		  uint32_t scope, uint32_t avrule_decl_id, uint32_t * value)
{
	int rc, retval = 0;
	unsigned int i;
	scope_datum_t *scope_datum;

	rc = hashtab_insert(pol->symtab[sym].table, key, datum);
	if (rc == SEPOL_OK) {

		if (value)
			*value = ++pol->symtab[sym].nprim;
	} else if (rc == SEPOL_EEXIST) {
		retval = 1;
	} else {
		return rc;
	}

	scope_datum =
	    (scope_datum_t *) hashtab_search(pol->scope[sym].table, key);
	if (scope_datum == NULL) {
		hashtab_key_t key2 = strdup((char *)key);
		if (!key2)
			return -ENOMEM;
		if ((scope_datum = malloc(sizeof(*scope_datum))) == NULL) {
			free(key2);
			return -ENOMEM;
		}
		scope_datum->scope = scope;
		scope_datum->decl_ids = NULL;
		scope_datum->decl_ids_len = 0;
		if ((rc =
		     hashtab_insert(pol->scope[sym].table, key2,
				    scope_datum)) != 0) {
			free(key2);
			free(scope_datum);
			return rc;
		}
	} else if (scope_datum->scope == SCOPE_DECL && scope == SCOPE_DECL) {

		if (sym != SYM_ROLES && sym != SYM_USERS) {
			return -2;
		}

		if (sym == SYM_ROLES) {
			role_datum_t *base_role;
			role_datum_t *cur_role = (role_datum_t *)datum;

			base_role = (role_datum_t *)
					hashtab_search(pol->symtab[sym].table,
						       key);
			assert(base_role != NULL);

			if (!((base_role->flavor == ROLE_ROLE) &&
			    (cur_role->flavor == ROLE_ROLE))) {

				return -2;
			}
		}
	} else if (scope_datum->scope == SCOPE_REQ && scope == SCOPE_DECL) {
		scope_datum->scope = SCOPE_DECL;
	}

	for (i = 0; i < scope_datum->decl_ids_len; i++) {
		if (scope_datum->decl_ids[i] == avrule_decl_id) {

			return retval;
		}
	}

	if (add_i_to_a(avrule_decl_id,
		       &scope_datum->decl_ids_len,
		       &scope_datum->decl_ids) == -1) {
		return -ENOMEM;
	}

	if (scope_datum->scope == SCOPE_DECL && scope == SCOPE_REQ) {

		uint32_t len, tmp;
		len = scope_datum->decl_ids_len;
		if (len < 2) {

			return -1;
		}
		tmp = scope_datum->decl_ids[len-2];
		scope_datum->decl_ids[len-2] = scope_datum->decl_ids[len-1];
		scope_datum->decl_ids[len-1] = tmp;
	}

	return retval;
}

Input: {'pol': 'error', 'sym': '32767', 'key': '0x9 <error: Cannot access memory at address 0x9>', 'datum': '0x6116f5', 'scope': '0', 'avrule_decl_id': '3', 'value': '6434904'}

Output: {'type': 'int', 'value': '0'}


static int read_source_policy(policydb_t *p, const uint8_t *data, size_t size)
{
	int fd, rc;
	ssize_t wr;

	fd = memfd_create("fuzz-input", MFD_CLOEXEC);
	if (fd < 0)
		return -1;

	wr = full_write(fd, data, size);
	if (wr < 0 || (size_t)wr != size) {
		close(fd);
		return -1;
	}

	fsync(fd);

	yynerrs = 0;

	yyin = fdopen(fd, "r");
	if (!yyin) {
		close(fd);
		return -1;
	}

	rewind(yyin);

	set_source_file("fuzz-input");

	id_queue = queue_create();
	if (id_queue == NULL) {
		fclose(yyin);
		yylex_destroy();
		return -1;
	}

	policydbp = p;
	mlspol = p->mls;

	init_parser(1);

	if (!setjmp(fuzzing_pre_parse_stack_state)) {
		queue_destroy(id_queue);
		fclose(yyin);
		yylex_destroy();
		return -1;
	}

	rc = yyparse();

	assert(rc || !policydb_errors);
	if (rc || policydb_errors) {
		queue_destroy(id_queue);
		fclose(yyin);
		yylex_destroy();
		return -1;
	}

	rewind(yyin);
	init_parser(2);
	set_source_file("fuzz-input");
	yyrestart(yyin);

	rc = yyparse();
	assert(rc || !policydb_errors);
	if (rc || policydb_errors) {
		queue_destroy(id_queue);
		fclose(yyin);
		yylex_destroy();
		return -1;
	}

	queue_destroy(id_queue);
	fclose(yyin);
	yylex_destroy();

	return 0;
}

Input: {'p': "{policy_type: 1, name: NULL, version: NULL, target_platform: 1, unsupported_format: 0, mls: 0, symtab: [{'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a42f0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a4340', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a4480', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '1', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a4540', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x109da90', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x109d2d0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10aaa90', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x109e4c0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}], sym_val_to_name: [{'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}], class_val_to_struct: NULL, role_val_to_struct: NULL, user_val_to_struct: NULL, type_val_to_struct: NULL, scope: [{'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a5610', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a5640', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a5780', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a5840', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10aab50', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a6c90', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a6d50', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10a6e10', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}], global: {branch_list: {decl_id: 1, enabled: 0, cond_list: NULL, avrules: NULL, role_tr_rules: NULL, role_allow_rules: NULL, range_tr_rules: NULL, required: {scope = {{node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}}, class_perms_map = 0x0, class_perms_len = 0}, declared: {scope = {{node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}}, class_perms_map = 0x0, class_perms_len = 0}, filename_trans_rules: NULL, symtab: {{table = 0x10a70f0, nprim = 0}, {table = 0x10a7120, nprim = 0}, {table = 0x10a7180, nprim = 0}, {table = 0x10a7200, nprim = 0}, {table = 0x10a7340, nprim = 0}, {table = 0x10a7400, nprim = 0}, {table = 0x10a7460, nprim = 0}, {table = 0x10a74b0, nprim = 0}}, module_name: NULL, next: NULL}, enabled: NULL, flags: 0, next: NULL}, decl_val_to_struct: NULL, te_avtab: {htable: NULL, nel: 0, nslot: 0, mask: 0}, bool_val_to_struct: NULL, te_cond_avtab: {htable: NULL, nel: 0, nslot: 0, mask: 0}, cond_list: NULL, role_tr: NULL, role_allow: NULL, ocontexts: [{'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}], genfs: NULL, range_tr: 0x10a7620, filename_trans: 0x10a75f0, filename_trans_count: 0, type_attr_map: NULL, attr_type_map: NULL, policycaps: {node: NULL, highbit: 0}, permissive_map: {node: NULL, highbit: 0}, policyvers: 33, handle_unknown: 0, process_class: 0, dir_class: 0, process_trans: 0, process_trans_dyntrans: 0}", 'data': '0x100000001 <error: Cannot access memory at address 0x100000001>', 'size': '8589924336'}

Output: {'type': 'long', 'value': '0'}


int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose)
{

	unsigned int i, j, r_policyvers;
	uint32_t buf[5], nprim;
	size_t len, nel;
	char *policydb_str;
	const struct policydb_compat_info *info;
	unsigned int policy_type, bufindex;
	ebitmap_node_t *tnode;
	int rc;

	rc = next_entry(buf, fp, sizeof(uint32_t) * 2);
	if (rc < 0)
		return POLICYDB_ERROR;
	for (i = 0; i < 2; i++)
		buf[i] = le32_to_cpu(buf[i]);

	if (buf[0] == POLICYDB_MAGIC) {
		policy_type = POLICY_KERN;
	} else if (buf[0] == POLICYDB_MOD_MAGIC) {
		policy_type = POLICY_MOD;
	} else {
		ERR(fp->handle, "policydb magic number %#08x does not "
		    "match expected magic number %#08x or %#08x",
		    buf[0], POLICYDB_MAGIC, POLICYDB_MOD_MAGIC);
		return POLICYDB_ERROR;
	}

	len = buf[1];
	if (len == 0 || len > POLICYDB_STRING_MAX_LENGTH) {
		ERR(fp->handle, "policydb string length %s ", len ? "too long" : "zero");
		return POLICYDB_ERROR;
	}

	policydb_str = malloc(len + 1);
	if (!policydb_str) {
		ERR(fp->handle, "unable to allocate memory for policydb "
		    "string of length %zu", len);
		return POLICYDB_ERROR;
	}
	rc = next_entry(policydb_str, fp, len);
	if (rc < 0) {
		ERR(fp->handle, "truncated policydb string identifier");
		free(policydb_str);
		return POLICYDB_ERROR;
	}
	policydb_str[len] = 0;

	if (policy_type == POLICY_KERN) {
		for (i = 0; i < POLICYDB_TARGET_SZ; i++) {
			if ((strcmp(policydb_str, policydb_target_strings[i])
				== 0)) {
				policydb_set_target_platform(p, i);
				break;
			}
		}

		if (i == POLICYDB_TARGET_SZ) {
			ERR(fp->handle, "cannot find a valid target for policy "
				"string %s", policydb_str);
			free(policydb_str);
			return POLICYDB_ERROR;
		}
	} else {
		if (strcmp(policydb_str, POLICYDB_MOD_STRING)) {
			ERR(fp->handle, "invalid string identifier %s",
				policydb_str);
			free(policydb_str);
			return POLICYDB_ERROR;
		}
	}

	free(policydb_str);
	policydb_str = NULL;

	if (policy_type == POLICY_KERN)
		nel = 4;
	else
		nel = 5;

	rc = next_entry(buf, fp, sizeof(uint32_t) * nel);
	if (rc < 0)
		return POLICYDB_ERROR;
	for (i = 0; i < nel; i++)
		buf[i] = le32_to_cpu(buf[i]);

	bufindex = 0;

	if (policy_type == POLICY_MOD) {

		policy_type = buf[bufindex];
		if (policy_type != POLICY_MOD && policy_type != POLICY_BASE) {
			ERR(fp->handle, "unknown module type: %#08x",
			    policy_type);
			return POLICYDB_ERROR;
		}
		bufindex++;
	}

	r_policyvers = buf[bufindex];
	if (policy_type == POLICY_KERN) {
		if (r_policyvers < POLICYDB_VERSION_MIN ||
		    r_policyvers > POLICYDB_VERSION_MAX) {
			ERR(fp->handle, "policydb version %d does not match "
			    "my version range %d-%d", buf[bufindex],
			    POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
			return POLICYDB_ERROR;
		}
	} else if (policy_type == POLICY_BASE || policy_type == POLICY_MOD) {
		if (r_policyvers < MOD_POLICYDB_VERSION_MIN ||
		    r_policyvers > MOD_POLICYDB_VERSION_MAX) {
			ERR(fp->handle, "policydb module version %d does "
			    "not match my version range %d-%d",
			    buf[bufindex], MOD_POLICYDB_VERSION_MIN,
			    MOD_POLICYDB_VERSION_MAX);
			return POLICYDB_ERROR;
		}
	} else {
		assert(0);
	}
	bufindex++;

	p->policy_type = policy_type;
	p->policyvers = r_policyvers;

	if (buf[bufindex] & POLICYDB_CONFIG_MLS) {
		p->mls = 1;
	} else {
		p->mls = 0;
	}

	p->handle_unknown = buf[bufindex] & POLICYDB_CONFIG_UNKNOWN_MASK;

	bufindex++;

	info = policydb_lookup_compat(r_policyvers, policy_type,
					p->target_platform);
	if (!info) {
		ERR(fp->handle, "unable to find policy compat info "
		    "for version %d", r_policyvers);
		goto bad;
	}

	if (buf[bufindex] != info->sym_num
	    || buf[bufindex + 1] != info->ocon_num) {
		ERR(fp->handle,
		    "policydb table sizes (%d,%d) do not " "match mine (%d,%d)",
		    buf[bufindex], buf[bufindex + 1], info->sym_num,
		    info->ocon_num);
		goto bad;
	}

	if (p->policy_type == POLICY_MOD) {

		if ((rc = next_entry(buf, fp, sizeof(uint32_t))) < 0) {
			goto bad;
		}
		len = le32_to_cpu(buf[0]);
		rc = str_read(&p->name, fp, len);
		if (rc < 0)
			goto bad;

		if ((rc = next_entry(buf, fp, sizeof(uint32_t))) < 0) {
			goto bad;
		}
		len = le32_to_cpu(buf[0]);
		rc = str_read(&p->version, fp, len);
		if (rc < 0)
			goto bad;
	}

	if ((p->policyvers >= POLICYDB_VERSION_POLCAP &&
	     p->policy_type == POLICY_KERN) ||
	    (p->policyvers >= MOD_POLICYDB_VERSION_POLCAP &&
	     p->policy_type == POLICY_BASE) ||
	    (p->policyvers >= MOD_POLICYDB_VERSION_POLCAP &&
	     p->policy_type == POLICY_MOD)) {
		if (ebitmap_read(&p->policycaps, fp))
			goto bad;
	}

	if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE &&
	    p->policy_type == POLICY_KERN) {
		if (ebitmap_read(&p->permissive_map, fp))
			goto bad;
	}

	for (i = 0; i < info->sym_num; i++) {
		rc = next_entry(buf, fp, sizeof(uint32_t) * 2);
		if (rc < 0)
			goto bad;
		nprim = le32_to_cpu(buf[0]);
		if (is_saturated(nprim) ||
		    exceeds_available_bytes(fp, nprim, sizeof(uint32_t) * 3))
			goto bad;
		nel = le32_to_cpu(buf[1]);
		if (nel && !nprim) {
			ERR(fp->handle, "unexpected items in symbol table with no symbol");
			goto bad;
		}
		for (j = 0; j < nel; j++) {
			if (read_f[i] (p, p->symtab[i].table, fp))
				goto bad;
		}

		p->symtab[i].nprim = nprim;
	}

	switch (p->target_platform) {
	case SEPOL_TARGET_SELINUX:
		p->process_class = policydb_string_to_security_class(p, "process");
		p->dir_class = policydb_string_to_security_class(p, "dir");
		break;
	case SEPOL_TARGET_XEN:
		p->process_class = policydb_string_to_security_class(p, "domain");
		break;
	default:
		break;
	}

	if (policy_type == POLICY_KERN) {
		if (avtab_read(&p->te_avtab, fp, r_policyvers))
			goto bad;
		if (r_policyvers >= POLICYDB_VERSION_BOOL)
			if (cond_read_list(p, &p->cond_list, fp))
				goto bad;
		if (role_trans_read(p, fp))
			goto bad;
		if (role_allow_read(&p->role_allow, fp))
			goto bad;
		if (r_policyvers >= POLICYDB_VERSION_FILENAME_TRANS &&
		    filename_trans_read(p, fp))
			goto bad;
	} else {

		avrule_block_destroy(p->global);
		p->global = NULL;
		if (avrule_block_read(p, &p->global, info->sym_num, fp) == -1) {
			goto bad;
		}
		if (p->global == NULL) {
			ERR(fp->handle, "no avrule block in policy");
			goto bad;
		}
		for (i = 0; i < info->sym_num; i++) {
			if ((rc = next_entry(buf, fp, sizeof(uint32_t))) < 0) {
				goto bad;
			}
			nel = le32_to_cpu(buf[0]);
			for (j = 0; j < nel; j++) {
				if (scope_read(p, i, fp))
					goto bad;
			}
		}

	}

	if (policydb_index_decls(fp->handle, p))
		goto bad;

	if (policydb_index_classes(p))
		goto bad;

	switch (p->target_platform) {
	case SEPOL_TARGET_SELINUX:

	case SEPOL_TARGET_XEN:
		p->process_trans = policydb_string_to_av_perm(p, p->process_class,
							      "transition");
		p->process_trans_dyntrans = p->process_trans |
			policydb_string_to_av_perm(p, p->process_class,
						   "dyntransition");
		break;
	default:
		break;
	}

	if (policydb_index_others(fp->handle, p, verbose))
		goto bad;

	if (ocontext_read(info, p, fp) == -1) {
		goto bad;
	}

	if (genfs_read(p, fp) == -1) {
		goto bad;
	}

	if ((p->policy_type == POLICY_KERN
	     && p->policyvers >= POLICYDB_VERSION_MLS)
	    || (p->policy_type == POLICY_BASE
		&& p->policyvers >= MOD_POLICYDB_VERSION_MLS
		&& p->policyvers < MOD_POLICYDB_VERSION_RANGETRANS)) {
		if (range_read(p, fp)) {
			goto bad;
		}
	}

	if (policy_type == POLICY_KERN) {
		p->type_attr_map = calloc(p->p_types.nprim, sizeof(ebitmap_t));
		p->attr_type_map = calloc(p->p_types.nprim, sizeof(ebitmap_t));
		if (!p->type_attr_map || !p->attr_type_map)
			goto bad;
		for (i = 0; i < p->p_types.nprim; i++) {
			if (r_policyvers >= POLICYDB_VERSION_AVTAB) {
				if (ebitmap_read(&p->type_attr_map[i], fp))
					goto bad;
				ebitmap_for_each_positive_bit(&p->type_attr_map[i],
							 tnode, j) {
					if (i == j)
						continue;

					if (j >= p->p_types.nprim)
						goto bad;

					if (ebitmap_set_bit
					    (&p->attr_type_map[j], i, 1))
						goto bad;
				}
			}

			if (ebitmap_set_bit(&p->type_attr_map[i], i, 1))
				goto bad;
			if (p->type_val_to_struct[i] && p->type_val_to_struct[i]->flavor != TYPE_ATTRIB) {
				if (ebitmap_set_bit(&p->attr_type_map[i], i, 1))
					goto bad;
			}
		}
	}

	if (policydb_validate(fp->handle, p))
		goto bad;

	return POLICYDB_SUCCESS;
      bad:
	return POLICYDB_ERROR;
}

Input: {'p': "{policy_type: 0, name: NULL, version: NULL, target_platform: 0, unsupported_format: 0, mls: 0, symtab: [{'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1039c70', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x105d700', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1034fb0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '1', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x118b680', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1037430', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1030950', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1036fc0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1149630', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}], sym_val_to_name: [{'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}], class_val_to_struct: NULL, role_val_to_struct: NULL, user_val_to_struct: NULL, type_val_to_struct: NULL, scope: [{'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1037680', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x10376d0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1037810', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1037840', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x1039c30', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x103b560', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x103b620', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}, {'table': {'@': 'unknown', 'type': 'hashtab_t', 'value': '0x103b6e0', '@@': 'unknown'}, 'nprim': {'@': 'unknown', 'type': 'uint32_t', 'value': '0', '@@': 'unknown'}, '@@': 'struct'}], global: {branch_list: {decl_id: 1, enabled: 0, cond_list: NULL, avrules: NULL, role_tr_rules: NULL, role_allow_rules: NULL, range_tr_rules: NULL, required: {scope = {{node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}}, class_perms_map = 0x0, class_perms_len = 0}, declared: {scope = {{node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}, {node = 0x0, highbit = 0}}, class_perms_map = 0x0, class_perms_len = 0}, filename_trans_rules: NULL, symtab: {{table = 0x103b9c0, nprim = 0}, {table = 0x103ba10, nprim = 0}, {table = 0x103ba70, nprim = 0}, {table = 0x103baf0, nprim = 0}, {table = 0x103bc30, nprim = 0}, {table = 0x103bcf0, nprim = 0}, {table = 0x103bd50, nprim = 0}, {table = 0x103bda0, nprim = 0}}, module_name: NULL, next: NULL}, enabled: NULL, flags: 0, next: NULL}, decl_val_to_struct: NULL, te_avtab: {htable: NULL, nel: 0, nslot: 0, mask: 0}, bool_val_to_struct: NULL, te_cond_avtab: {htable: NULL, nel: 0, nslot: 0, mask: 0}, cond_list: NULL, role_tr: NULL, role_allow: NULL, ocontexts: [{'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}, {'@': 'NULL', 'type': None, '@@': 'pointer'}], genfs: NULL, range_tr: 0x103df40, filename_trans: 0x103bf00, filename_trans_count: 0, type_attr_map: NULL, attr_type_map: NULL, policycaps: {node: NULL, highbit: 0}, permissive_map: {node: NULL, highbit: 0}, policyvers: 0, handle_unknown: 0, process_class: 0, dir_class: 0, process_trans: 0, process_trans_dyntrans: 0}", 'fp': 'error', 'verbose': '32767'}

{'verbose': {'type': 'unsigned int', 'value': '32767'}}

Output: {'type': 'int', 'value': '-1'}


unsigned int luaO_codeparam (unsigned int p) {
  if (p >= (cast(lu_mem, 0x1F) << (0xF - 7 - 1)) * 100u)
    return 0xFF;
  else {
    p = (cast(l_uint32, p) * 128 + 99) / 100;
    if (p < 0x10)
      return p;
    else {
      int log = luaO_ceillog2(p + 1) - 5;
      return ((p >> log) - 0x10) | ((log + 1) << 4);
    }
  }
}

Input: {'p': '16097288'}

Output: {'type': 'int', 'value': '9'}


static ArrayCell *resizearray (lua_State *L , Table *t,
                               unsigned int oldasize,
                               unsigned int newasize) {
  size_t oldasizeb = concretesize(oldasize);
  size_t newasizeb = concretesize(newasize);
  void *a = luaM_reallocvector(L, t->array, oldasizeb, newasizeb, lu_byte);
  return cast(ArrayCell*, a);
}

Input: {'L': 'NULL', 't': '{next: {next: {next: NULL, tt: 8 \'\\b\', marked: 8 \'\\b\'}, tt: 5 \'\\005\', marked: 8 \'\\b\'}, tt: 8 \'\\b\', marked: 160 \'\\240\', flags: 64 \'@\', lsizenode: 0 \'\\000\', alimit: 0, array: [{\'gc\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x502725 <init_registry+757>\', \'@@\': \'pointer\'}, \'p\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x502725 <init_registry+757>\', \'@@\': \'pointer\'}, \'f\': {\'@\': \'unknown\', \'type\': \'lua_CFunction\', \'value\': \'0x502725 <init_registry+757>\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'5252901\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'2.5952779251051298e-317\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "37 \'%\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NULL\', \'type\': None, \'@@\': \'pointer\'}, \'p\': {\'@\': \'NULL\', \'type\': None, \'@@\': \'pointer\'}, \'f\': {\'@\': \'NULL\', \'type\': \'lua_CFunction\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'0\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'0\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "0 \'\\\\000\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x2d0\', \'@@\': \'pointer\'}, \'p\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x2d0\', \'@@\': \'pointer\'}, \'f\': {\'@\': \'unknown\', \'type\': \'lua_CFunction\', \'value\': \'0x2d0\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'720\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'3.5572726500569751e-321\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "208 \'\\\\320\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x53d5c0 <l_alloc>\', \'@@\': \'pointer\'}, \'p\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x53d5c0 <l_alloc>\', \'@@\': \'pointer\'}, \'f\': {\'@\': \'unknown\', \'type\': \'lua_CFunction\', \'value\': \'0x53d5c0 <l_alloc>\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'5494208\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'2.7144994239061435e-317\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "192 \'\\\\300\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NULL\', \'type\': None, \'@@\': \'pointer\'}, \'p\': {\'@\': \'NULL\', \'type\': None, \'@@\': \'pointer\'}, \'f\': {\'@\': \'NULL\', \'type\': \'lua_CFunction\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'0\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'0\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "0 \'\\\\000\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NULL\', \'type\': None, \'@@\': \'pointer\'}, \'p\': {\'@\': \'NULL\', \'type\': None, \'@@\': \'pointer\'}, \'f\': {\'@\': \'NULL\', \'type\': \'lua_CFunction\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'0\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'0\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "0 \'\\\\000\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x2d0\', \'@@\': \'pointer\'}, \'p\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0x2d0\', \'@@\': \'pointer\'}, \'f\': {\'@\': \'unknown\', \'type\': \'lua_CFunction\', \'value\': \'0x2d0\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'720\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'3.5572726500569751e-321\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "208 \'\\\\320\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}, {\'gc\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0xf5a008\', \'@@\': \'pointer\'}, \'p\': {\'@\': \'NESTED\', \'type\': None, \'value\': \'0xf5a008\', \'@@\': \'pointer\'}, \'f\': {\'@\': \'unknown\', \'type\': \'lua_CFunction\', \'value\': \'0xf5a008\', \'@@\': \'unknown\'}, \'i\': {\'@\': \'unknown\', \'type\': \'lua_Integer\', \'value\': \'16097288\', \'@@\': \'unknown\'}, \'n\': {\'@\': \'unknown\', \'type\': \'lua_Number\', \'value\': \'7.9531169920125479e-317\', \'@@\': \'unknown\'}, \'ub\': {\'@\': \'unknown\', \'type\': \'lu_byte\', \'value\': "8 \'\\\\b\'", \'@@\': \'unknown\'}, \'@@\': \'struct\'}], node: {u: {value_: {gc: NULL, p: NULL, f: NULL, i: 0, n: 0, ub: 0 \'\\000\'}, tt_: 16 \'\\020\', key_tt: 0 \'\\000\', next: 0, key_val: {gc: NULL, p: NULL, f: NULL, i: 0, n: 0, ub: 0 \'\\000\'}}, i_val: {value_ = {gc = 0x0, p = 0x0, f = 0x0, i = 0, n = 0, ub = 0 \'\\000\'}, tt_ = 16 \'\\020\'}}, metatable: error, gclist: {next = 0x0, tt = 8 \'\\b\', marked = 8 \'\\b\'}}', 'oldasize': '0', 'newasize': '16094544'}

{'oldasize': {'type': 'unsigned int', 'value': '0'}, 'newasize': {'type': 'unsigned int', 'value': '16094544'}}

Output: {'type': 'unsigned long', 'value': '0'}