nus-yam/ex-repair huggingface dataset:
Program: CWE-787
Project: CVE-2016-6870
Buggy source:
None

Fixed version (ground truth):
<?hh // strict
// Copyright 2004-present Facebook. All Rights Reserved.

$var0 = null;
$var3 = "\x00";
$var3 = mb_detect_encoding($var0,$var3);
Program: CWE-787
Project: CVE-2016-7127
Buggy source:
None

Fixed version (ground truth):
--TEST--
Bug #72730: imagegammacorrect allows arbitrary write access
--SKIPIF--
<?php 
if (!function_exists("imagecreatetruecolor")) die("skip");
?>
--FILE--
<?php
$img =  imagecreatetruecolor(1, 1);
imagegammacorrect($img, -1, 1337);
?>
DONE
--EXPECTF--
Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
DONE
Program: CWE-787
Project: CVE-2018-14681
Buggy source:
None

Fixed version (ground truth):
#!/usr/bin/perl -w
use strict;
my $name = '123456789';
for my $file (0 .. 9) {
    for my $ext (0 .. 4) {
	open my $fh, '>', "f$file$ext.kwj";
        my $offset = 14  + $file + $ext;
	my $flags  = ($file > 0 ? 8 : 0) | ($ext > 0 ? 16 : 0);
	print $fh pack 'A4Vvvv', 'KWAJ', 0xD127F088, 0, $offset, $flags;
	print $fh substr $name, 0, $file if $file > 0;
	print $fh "\0" if $file > 0 && $file < 9;
	print $fh substr $name, 0, $ext if $ext > 0;
	print $fh "\0" if $ext > 0 && $ext < 4;
        print $fh "\xFF";
	close $fh;
    }
}
Program: CWE-787
Project: CVE-2018-6345
Buggy source:
None

Fixed version (ground truth):
<?php
  $READ_LENGTH = 0x1000; // choose leak size
// construct fake iptc header for controlled read
$iptc_hdr =
  "\x1c\x01" . // magic
  "\x00\x80" . // dataset, recnum
  "\x00" .     // padding
  pack("N", $READ_LENGTH);
// spray a bit so it's near the broken string
$holder = [];
for($i = 0; $i < 100; $i++)
  $holder[] = str_pad($iptc_hdr, 96);
// trigger bug to create string with len=-1
$badstr = number_format(0,0x7fffffff);
var_dump($badstr);
// leak memory :)
$tmp = iptcparse($badstr);
var_dump($tmp);
?>
Program: CWE-787
Project: CVE-2019-14934
Buggy source:
/******************************************************************************
 * main.h 
 *
 * pdfresurrect - PDF history extraction tool
 *
 * Copyright (C) 2008, 2009, 2010, 2012, 2019 Matt Davis (enferex).
 *
 * Special thanks to all of the contributors:  See AUTHORS.
 *
 * Special thanks to 757labs (757 crew), they are a great group
 * of people to hack on projects and brainstorm with.
 *
 * main.h is part of pdfresurrect.
 * pdfresurrect is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * pdfresurrect is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with pdfresurrect.  If not, see <http://www.gnu.org/licenses/>.
 *****************************************************************************/

#ifndef MAIN_H_INCLUDE
#define MAIN_H_INCLUDE

#include <stdio.h>


#define EXEC_NAME "pdfresurrect"
#define VER_MAJOR "0"
#define VER_MINOR "18b"
#define VER       VER_MAJOR"."VER_MINOR 


#define TAG "[pdfresurrect]"
#define ERR(...) {fprintf(stderr, TAG" -- Error -- " __VA_ARGS__);}


#endif /* MAIN_H_INCLUDE */


Fixed version (ground truth):
/******************************************************************************
 * main.h 
 *
 * pdfresurrect - PDF history extraction tool
 *
 * Copyright (C) 2008, 2009, 2010, 2012, 2019 Matt Davis (enferex).
 *
 * Special thanks to all of the contributors:  See AUTHORS.
 *
 * Special thanks to 757labs (757 crew), they are a great group
 * of people to hack on projects and brainstorm with.
 *
 * main.h is part of pdfresurrect.
 * pdfresurrect is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * pdfresurrect is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with pdfresurrect.  If not, see <http://www.gnu.org/licenses/>.
 *****************************************************************************/

#ifndef MAIN_H_INCLUDE
#define MAIN_H_INCLUDE

#include <stdio.h>


#define EXEC_NAME "pdfresurrect"
#define VER_MAJOR "0"
#define VER_MINOR "18b"
#define VER       VER_MAJOR"."VER_MINOR 


#define TAG "[pdfresurrect]"
#define ERR(...) {fprintf(stderr, TAG" -- Error -- " __VA_ARGS__);}

/* Returns a zero'd buffer of 'size' bytes or exits in failure. */
extern void *safe_calloc(size_t bytes);

#endif /* MAIN_H_INCLUDE */
Program: CWE-787
Project: CVE-2019-15694
Buggy source:
/* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
 * 
 * This is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this software; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
 * USA.
 */
#ifndef __RFB_PASSWORD_H__
#define __RFB_PASSWORD_H__

#include <rfb/util.h>

namespace rfb {

  class ObfuscatedPasswd;

  class PlainPasswd : public CharArray {
  public:
    PlainPasswd();
    PlainPasswd(char* pwd);
    PlainPasswd(int len);
    PlainPasswd(const ObfuscatedPasswd& obfPwd);
    ~PlainPasswd();
    void replaceBuf(char* b);
  };

  class ObfuscatedPasswd : public CharArray {
  public:
    ObfuscatedPasswd();
    ObfuscatedPasswd(int l);
    ObfuscatedPasswd(const PlainPasswd& plainPwd);
    ~ObfuscatedPasswd();
    int length;
  };

}
#endif


Fixed version (ground truth):
/* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
 * 
 * This is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this software; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
 * USA.
 */
#ifndef __RFB_PASSWORD_H__
#define __RFB_PASSWORD_H__

#include <rfb/util.h>

namespace rfb {

  class ObfuscatedPasswd;

  class PlainPasswd : public CharArray {
  public:
    PlainPasswd();
    PlainPasswd(char* pwd);
    PlainPasswd(size_t len);
    PlainPasswd(const ObfuscatedPasswd& obfPwd);
    ~PlainPasswd();
    void replaceBuf(char* b);
  };

  class ObfuscatedPasswd : public CharArray {
  public:
    ObfuscatedPasswd();
    ObfuscatedPasswd(size_t l);
    ObfuscatedPasswd(const PlainPasswd& plainPwd);
    ~ObfuscatedPasswd();
    size_t length;
  };

}
#endif
Program: CWE-787
Project: CVE-2019-3570
Buggy source:
/*-
 * Copyright 2005,2007,2009 Colin Percival
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: src/lib/libmd/sha256.h,v 1.2 2006/01/17 15:35:56 phk Exp $
 */

#ifndef _SHA256_H_
#define _SHA256_H_

#include <sys/types.h>

#include <stdint.h>

struct SHA256_CTX {
  uint32_t state[8];
  uint32_t count[2];
  unsigned char buf[64];
};

struct HMAC_SHA256_CTX {
  SHA256_CTX ictx;
  SHA256_CTX octx;
};

void  SHA256_Init(struct SHA256_CTX *);
void  scrypt_SHA256_Update(struct SHA256_CTX *, const void *, size_t);
void  scrypt_SHA256_Final(unsigned char [32], struct SHA256_CTX *);
void  HMAC_SHA256_Init(struct HMAC_SHA256_CTX *, const void *, size_t);
void  HMAC_SHA256_Update(struct HMAC_SHA256_CTX *, const void *, size_t);
void  HMAC_SHA256_Final(unsigned char [32], struct HMAC_SHA256_CTX *);

/**
 * PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
 * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
 * write the output to buf.  The value dkLen must be at most 32 * (2^32 - 1).
 */
void  PBKDF2_SHA256(const uint8_t *, size_t, const uint8_t *, size_t,
    uint64_t, uint8_t *, size_t);

#endif /* !_SHA256_H_ */


Fixed version (ground truth):
None
Program: CWE-787
Project: CVE-2020-1896
Buggy source:
/**
 * Copyright (c) Facebook, Inc. and its affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

//RUN: %hermes -O -target=HBC %s | %FileCheck --match-full-lines %s

function func() {
    print(arguments.length);
}

try {
    var a = []
    a[8*1024*1024] = 100;
    func.apply(null, a);
} catch(e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}

var x = [];
x.length = 4294967295;

for (var i = 0; i < 20; i++) {
    x[i] = i;
}
try {
  func.apply(99, x);
} catch (e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}


Fixed version (ground truth):
/**
 * Copyright (c) Facebook, Inc. and its affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

//RUN: %hermes -O -target=HBC %s | %FileCheck --match-full-lines %s

function func() {
    print(arguments.length);
}

try {
    var a = []
    a[8*1024*1024] = 100;
    func.apply(null, a);
} catch(e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}

var x = [];
x.length = 4294967295;

for (var i = 0; i < 20; i++) {
    x[i] = i;
}
try {
  func.apply(99, x);
} catch (e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}

try {
  v0 = [1.1];
  function v1() {
    v1(...v0);
  }
  v1();
} catch (e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}
Program: CWE-787
Project: CVE-2020-1912
Buggy source:
None

Fixed version (ground truth):
/**
 * Copyright (c) Facebook, Inc. and its affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -lazy %s | %FileCheck %s --match-full-lines

// Make sure we can correctly resolve scopes through lazily compiled
// functions in lazily compiled generators.
function f() {
  var f_var = 10;
  function* g() {
    var g_var = 32;
    function h() {
      /* Some text to pad out the function so that it won't be eagerly compiled
       * for being too short. Lorem ipsum dolor sit amet, consectetur adipiscing
       * elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.
       */
      return f_var + g_var;
    }
    yield h();
  }
  return g().next().value;
}
// CHECK: 42
print(f());
Program: CWE-787
Project: CVE-2020-20740
Buggy source:
Matt Davis (enferex): Original pdfresurrect, modified man page

Francois Marier: Original man page, modified Makefile.in
                 and modified configure.ac, potential security bug identifying
                 (e.g., bad code detection).

David Binderman: Finding a bug and offering a correction suggestion

Ryan Schmidt: MacPorts Makefile work

xambroz: Suggestions and Makefile enhancement.

j0lamma: Identified a bug that can cause a corrupted buffer.

capcorpscert0188, LeeSunWoo, ParkInChul: Identified a bug that can cause
                                         a corrupted buffer.

rtfingc: Reported bugs regarding memory corruption and a leak.

rwhitworth: Reported and helped isolate bugs. Created initial .gitignore.

carter-yagemann: Reported and helped isolate a memory issue.

rootup: Reporting and helped isolate a memory issue.

ZanderChang: Reported and identified bad code in kid page loading.


Fixed version (ground truth):
Matt Davis (enferex): Original pdfresurrect, modified man page

Francois Marier: Original man page, modified Makefile.in
                 and modified configure.ac, potential security bug identifying
                 (e.g., bad code detection).

David Binderman: Finding a bug and offering a correction suggestion

Ryan Schmidt: MacPorts Makefile work

xambroz: Suggestions and Makefile enhancement.

j0lamma: Identified a bug that can cause a corrupted buffer.

capcorpscert0188, LeeSunWoo, ParkInChul: Identified a bug that can cause
                                         a corrupted buffer.

rtfingc: Reported bugs regarding memory corruption and a leak.

rwhitworth: Reported and helped isolate bugs. Created initial .gitignore.

carter-yagemann: Reported and helped isolate a memory issue.

rootup: Reporting and helped isolate a memory issue.

ZanderChang: Reported and identified bad code in kid page loading.

yifengchen-cc: Reported a header parsing bug.
Program: CWE-787
Project: CVE-2021-36977
Buggy source:
id: OSV-2021-440
summary: Heap-buffer-overflow in H5MM_memcpy
details: |
  OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265

  Crash type: Heap-buffer-overflow WRITE 4
  Crash state:
  H5MM_memcpy
  H5MM_malloc
  H5C_load_entry
modified: '2021-06-21T06:56:28.151210Z'
published: '2021-02-24T00:00:05.141282Z'
references:
- type: REPORT
  url: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265
affected:
- package:
    name: matio
    ecosystem: OSS-Fuzz
  ranges:
  - type: GIT
    repo: git://git.code.sf.net/p/matio/matio
    events:
    - introduced: 1ce8f2d1845ecdde19a35605cabdbb884776d52d
  versions:
  - v1.5.20
  - v1.5.21
  ecosystem_specific:
    severity: HIGH


Fixed version (ground truth):
id: OSV-2021-440
summary: Heap-buffer-overflow in H5MM_memcpy
details: |
  OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265

  Crash type: Heap-buffer-overflow WRITE 4
  Crash state:
  H5MM_memcpy
  H5MM_malloc
  H5C_load_entry
modified: '2021-06-21T06:56:28.151210Z'
published: '2021-02-24T00:00:05.141282Z'
references:
- type: REPORT
  url: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265
affected:
- package:
    name: matio
    ecosystem: OSS-Fuzz
  ranges:
  - type: GIT
    repo: git://git.code.sf.net/p/matio/matio
    events:
    - introduced: 1ce8f2d1845ecdde19a35605cabdbb884776d52d
    - fixed: cddcdad17864c4b95ead23581047b41636f180a3
  versions:
  - v1.5.20
  - v1.5.21
  ecosystem_specific:
    severity: HIGH
Program: CWE-787
Project: CVE-2021-37232
Buggy source:
None

Fixed version (ground truth):
#!/bin/bash
set -xe
./AtomicParsley ./tests/issue-32.mp4 -T 1 -t +
Program: CWE-787
Project: CVE-2021-43814
Buggy source:
NAME=ELF: negative vnext crash
FILE=bins/elf/analysis/6921737e-08e3-11e6-998c-a8ddd566ab1c.jpg
CMDS=q!
EXPECT=<<EOF
EOF
RUN

NAME=pseudo-crash
FILE==
CMDS=e asm.pseudo=1; e asm.arch=x86; e asm.bits=64; wx 7299; pdj 1
EXPECT=<<EOF
[{"offset":0,"esil":"cf,?{,18446744073709551515,rip,=,}","refptr":false,"fcn_addr":0,"fcn_last":0,"size":2,"opcode":"if (((unsigned) var) < 0) goto 0xffffffffffffff9b","disasm":"jb 0xffffffffffffff9b","bytes":"7299","family":"cpu","type":"cjmp","reloc":false,"type_num":2147483649,"type2_num":0,"jump":-101,"fail":2}]
EOF
RUN

NAME=ELF: ld-uclibc
FILE=bins/elf/ld-uClibc-0.9.33.2.so
CMDS=<<EOF
ii
iij
EOF
EXPECT=<<EOF
nth vaddr bind type lib name 
-----------------------------
[]
EOF
RUN


Fixed version (ground truth):
NAME=ELF: negative vnext crash
FILE=bins/elf/analysis/6921737e-08e3-11e6-998c-a8ddd566ab1c.jpg
CMDS=q!
EXPECT=<<EOF
EOF
RUN

NAME=pseudo-crash
FILE==
CMDS=e asm.pseudo=1; e asm.arch=x86; e asm.bits=64; wx 7299; pdj 1
EXPECT=<<EOF
[{"offset":0,"esil":"cf,?{,18446744073709551515,rip,=,}","refptr":false,"fcn_addr":0,"fcn_last":0,"size":2,"opcode":"if (((unsigned) var) < 0) goto 0xffffffffffffff9b","disasm":"jb 0xffffffffffffff9b","bytes":"7299","family":"cpu","type":"cjmp","reloc":false,"type_num":2147483649,"type2_num":0,"jump":-101,"fail":2}]
EOF
RUN

NAME=ELF: ld-uclibc
FILE=bins/elf/ld-uClibc-0.9.33.2.so
CMDS=<<EOF
ii
iij
EOF
EXPECT=<<EOF
nth vaddr bind type lib name 
-----------------------------
[]
EOF
RUN

NAME=ELF/Dwarf: abbrev empty
FILE=bins/elf/dwarf_fuzzed_abbrev_empty
CMDS=<<EOF
aaa
EOF
EXPECT=
RUN
Program: CWE-787
Project: CVE-2022-27666
Buggy source:
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _NET_ESP_H
#define _NET_ESP_H

#include <linux/skbuff.h>

struct ip_esp_hdr;

static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
{
	return (struct ip_esp_hdr *)skb_transport_header(skb);
}

static inline void esp_output_fill_trailer(u8 *tail, int tfclen, int plen, __u8 proto)
{
	/* Fill padding... */
	if (tfclen) {
		memset(tail, 0, tfclen);
		tail += tfclen;
	}
	do {
		int i;
		for (i = 0; i < plen - 2; i++)
			tail[i] = i + 1;
	} while (0);
	tail[plen - 2] = plen - 2;
	tail[plen - 1] = proto;
}

struct esp_info {
	struct	ip_esp_hdr *esph;
	__be64	seqno;
	int	tfclen;
	int	tailen;
	int	plen;
	int	clen;
	int 	len;
	int 	nfrags;
	__u8	proto;
	bool	inplace;
};

int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp_input_done2(struct sk_buff *skb, int err);
int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp6_input_done2(struct sk_buff *skb, int err);
#endif


Fixed version (ground truth):
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _NET_ESP_H
#define _NET_ESP_H

#include <linux/skbuff.h>

#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)

struct ip_esp_hdr;

static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
{
	return (struct ip_esp_hdr *)skb_transport_header(skb);
}

static inline void esp_output_fill_trailer(u8 *tail, int tfclen, int plen, __u8 proto)
{
	/* Fill padding... */
	if (tfclen) {
		memset(tail, 0, tfclen);
		tail += tfclen;
	}
	do {
		int i;
		for (i = 0; i < plen - 2; i++)
			tail[i] = i + 1;
	} while (0);
	tail[plen - 2] = plen - 2;
	tail[plen - 1] = proto;
}

struct esp_info {
	struct	ip_esp_hdr *esph;
	__be64	seqno;
	int	tfclen;
	int	tailen;
	int	plen;
	int	clen;
	int 	len;
	int 	nfrags;
	__u8	proto;
	bool	inplace;
};

int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp_input_done2(struct sk_buff *skb, int err);
int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
int esp6_input_done2(struct sk_buff *skb, int err);
#endif
Program: CWE-79
Project: CVE-2012-4396
Buggy source:
<?php

$tmpl = new OCP\Template( 'user_openid', 'settings');
$identity=OCP\Config::getUserValue(OCP\USER::getUser(),'user_openid','identity','');
$tmpl->assign('identity',$identity);

OCP\Util::addscript('user_openid','settings');

return $tmpl->fetchPage();
?>

Fixed version (ground truth):
<?php

$tmpl = new OCP\Template( 'user_openid', 'settings');
$identity=OCP\Config::getUserValue(OCP\USER::getUser(),'user_openid','identity','');
$tmpl->assign('identity',htmlentities($identity));

OCP\Util::addscript('user_openid','settings');

return $tmpl->fetchPage();
?>
Program: CWE-79
Project: CVE-2012-5368
Buggy source:
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 *
 * @package PhpMyAdmin
 */
if (! defined('PHPMYADMIN')) {
    exit;
}

/**
 *
 */
if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {
    die(__("GLOBALS overwrite attempt"));
}

/**
 * Sends http headers
 */
$GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
/* Prevent against ClickJacking by allowing frames only from same origin */
if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
    header('X-Frame-Options: SAMEORIGIN');
    header("X-Content-Security-Policy: allow 'self'; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:; script-src 'self' http://www.phpmyadmin.net");
    header("X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script");
}
PMA_no_cache_header();
if (!defined('IS_TRANSFORMATION_WRAPPER')) {
    // Define the charset to be used
    header('Content-Type: text/html; charset=utf-8');
}
?>


Fixed version (ground truth):
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 *
 * @package PhpMyAdmin
 */
if (! defined('PHPMYADMIN')) {
    exit;
}

/**
 *
 */
if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {
    die(__("GLOBALS overwrite attempt"));
}

/**
 * Sends http headers
 */
$GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
/* Prevent against ClickJacking by allowing frames only from same origin */
if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
    header('X-Frame-Options: SAMEORIGIN');
    header("X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:");
    header("X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script");
}
PMA_no_cache_header();
if (!defined('IS_TRANSFORMATION_WRAPPER')) {
    // Define the charset to be used
    header('Content-Type: text/html; charset=utf-8');
}
?>
Program: CWE-79
Project: CVE-2013-0234
Buggy source:
None

Fixed version (ground truth):
None
Program: CWE-79
Project: CVE-2013-2023
Buggy source:
{
  "name": "jplayer",
  "version": "2.3.1",
  "description": "The jQuery HTML5 Audio / Video Library",
  "homepage": "http://www.jplayer.org/",
  "keywords": [
    "audio",
    "video"
  ],
  "dependencies": {
    "jquery": ">1.4.2"
  },
  "licenses": [
    {
      "type": "MIT",
      "url": "http://www.opensource.org/licenses/mit-license.php"
    },
    {
      "type" : "GPL",
      "url": "http://www.gnu.org/copyleft/gpl.html"
    }
  ],
  "repositories": [
    {
      "type": "git",
      "url": "https://github.com/happyworm/jPlayer.git"
    }
  ],
  "github": "http://github.com/happyworm/jPlayer",
  "main": "jquery.jplayer/jquery.jplayer.js"
}


Fixed version (ground truth):
{
  "name": "jplayer",
  "version": "2.3.2",
  "description": "The jQuery HTML5 Audio / Video Library",
  "homepage": "http://www.jplayer.org/",
  "keywords": [
    "audio",
    "video"
  ],
  "dependencies": {
    "jquery": ">1.4.2"
  },
  "licenses": [
    {
      "type": "MIT",
      "url": "http://www.opensource.org/licenses/mit-license.php"
    },
    {
      "type" : "GPL",
      "url": "http://www.gnu.org/copyleft/gpl.html"
    }
  ],
  "repositories": [
    {
      "type": "git",
      "url": "https://github.com/happyworm/jPlayer.git"
    }
  ],
  "github": "http://github.com/happyworm/jPlayer",
  "main": "jquery.jplayer/jquery.jplayer.js"
}
Program: CWE-79
Project: CVE-2014-3148
Buggy source:
// -*-c++-*-
/* $Id: err.C 2838 2007-04-30 19:04:58Z max $ */

/*
 *
 * Copyright (C) 2002-2004 Maxwell Krohn (max@okcupid.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2, or (at
 * your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
 * USA
 *
 */


#include "resp.h"
#include "ahttp.h"

strbuf
http_error_t::make_body (int n, const str &si, const str &aux)
{
  strbuf b;
  str ldesc;
  const str sdesc = http_status.get_desc (n, &ldesc);
  b << "<html>\n"
    << " <head>\n"
    << "  <title>" << n << " " << sdesc << "</title>\n"
    << " </head>\n"
    << " <body>\n"
    << " <h1>Error " << n << " " << sdesc << "</h1><br><br>\n"
    ;
  if (n == HTTP_NOT_FOUND && aux) {
    b << "The file <tt>" << aux 
      << "</tt> was not found on this server.<br><br>\n\n";
  }
  b << "  <hr>\n"
    << "  <i>" << si << "</i>\n"
    << " <br>\n"
    << " </body>\n"
    << "</html>\n"
    ;
  return b;
}


Fixed version (ground truth):
// -*-c++-*-
/* $Id: err.C 2838 2007-04-30 19:04:58Z max $ */

/*
 *
 * Copyright (C) 2002-2004 Maxwell Krohn (max@okcupid.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2, or (at
 * your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
 * USA
 *
 */


#include "resp.h"
#include "ahttp.h"
#include "pescape.h"

strbuf
http_error_t::make_body (int n, const str &si, const str &aux)
{
  strbuf b;
  str ldesc;
  const str sdesc = xss_escape (http_status.get_desc (n, &ldesc));
  b << "<html>\n"
    << " <head>\n"
    << "  <title>" << n << " " << sdesc << "</title>\n"
    << " </head>\n"
    << " <body>\n"
    << " <h1>Error " << n << " " << sdesc << "</h1><br><br>\n"
    ;
  if (n == HTTP_NOT_FOUND && aux) {
    b << "The file <tt>" << xss_escape (aux)
      << "</tt> was not found on this server.<br><br>\n\n";
  }
  b << "  <hr>\n"
    << "  <i>" << xss_escape (si) << "</i>\n"
    << " <br>\n"
    << " </body>\n"
    << "</html>\n"
    ;
  return b;
}
Program: CWE-79
Project: CVE-2014-4349
Buggy source:
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 * Functionality for the navigation tree
 *
 * @package PhpMyAdmin-Navigation
 */
if (! defined('PHPMYADMIN')) {
    exit;
}

/**
 * Represents a node that is a concrete child of a database node
 *
 * @package PhpMyAdmin-Navigation
 */
abstract class Node_DatabaseChild extends Node
{
    /**
     * Returns HTML for hide button displayed infront of the database child node
     *
     * @return String HTML for hide button
     */
    public function getHtmlForControlButtons()
    {
        $ret = '';
        $cfgRelation = PMA_getRelationsParam();
        if ($cfgRelation['navwork']) {
            $db   = $this->realParent()->real_name;
            $item = $this->real_name;
            $ret  = '<span class="navItemControls">'
                . '<a href="navigation.php?'
                . PMA_URL_getCommon()
                . '&hideNavItem=true'
                . '&itemType=' . urldecode($this->getItemType())
                . '&itemName=' . urldecode($item)
                . '&dbName=' . urldecode($db) . '"'
                . ' class="hideNavItem ajax">'
                . PMA_Util::getImage('lightbulb_off.png', __('Hide'))
                . '</a></span>';
        }
        return $ret;
    }

    /**
     * Returns the type of the item reprsented by the node.
     *
     * @return string type of the item
     */
    protected abstract function getItemType();
}
?>


Fixed version (ground truth):
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 * Functionality for the navigation tree
 *
 * @package PhpMyAdmin-Navigation
 */
if (! defined('PHPMYADMIN')) {
    exit;
}

/**
 * Represents a node that is a concrete child of a database node
 *
 * @package PhpMyAdmin-Navigation
 */
abstract class Node_DatabaseChild extends Node
{
    /**
     * Returns HTML for hide button displayed infront of the database child node
     *
     * @return String HTML for hide button
     */
    public function getHtmlForControlButtons()
    {
        $ret = '';
        $cfgRelation = PMA_getRelationsParam();
        if ($cfgRelation['navwork']) {
            $db   = $this->realParent()->real_name;
            $item = $this->real_name;
            $ret  = '<span class="navItemControls">'
                . '<a href="navigation.php?'
                . PMA_URL_getCommon()
                . '&hideNavItem=true'
                . '&itemType=' . urlencode($this->getItemType())
                . '&itemName=' . urlencode($item)
                . '&dbName=' . urlencode($db) . '"'
                . ' class="hideNavItem ajax">'
                . PMA_Util::getImage('lightbulb_off.png', __('Hide'))
                . '</a></span>';
        }
        return $ret;
    }

    /**
     * Returns the type of the item reprsented by the node.
     *
     * @return string type of the item
     */
    protected abstract function getItemType();
}
?>
Program: CWE-79
Project: CVE-2014-9714
Buggy source:
None

Fixed version (ground truth):
string(92) "<wddxPacket version='1.0'><header/><data><string>Test for &amp;</string></data></wddxPacket>"
string(10) "Test for &"
Program: CWE-79
Project: CVE-2015-1039
Buggy source:
<h1><?php echo $this->translate('Sign In'); ?></h1>

<?php
$form = $this->loginForm;
$form->prepare();
$form->setAttribute('action', $this->url('zfcuser/login'));
$form->setAttribute('method', 'post');
?>

<?php echo $this->form()->openTag($form) ?>

    <dl class="zend_form">
        <?php echo $this->formElementErrors($form->get('identity')) ?>

        <dt><?php echo $this->formLabel($form->get('identity')) ?></dt>
        <dd><?php echo $this->formInput($form->get('identity')) ?></dd>

        <dt><?php echo $this->formLabel($form->get('credential')) ?></dt>
        <dd><?php echo $this->formInput($form->get('credential')) ?></dd>

        <?php if ($this->redirect): ?>
            <input type="hidden" name="redirect" value="<?php echo $this->escapeHtml($this->redirect) ?>" />
        <?php endif ?>

        <dd><?php echo $this->formButton($form->get('submit')) ?></dd>
    </dl>

<?php echo $this->form()->closeTag() ?>

<?php if ($this->enableRegistration) : ?>
<?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->redirect : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
<?php endif; ?>


Fixed version (ground truth):
<h1><?php echo $this->translate('Sign In'); ?></h1>

<?php
$form = $this->loginForm;
$form->prepare();
$form->setAttribute('action', $this->url('zfcuser/login'));
$form->setAttribute('method', 'post');
?>

<?php echo $this->form()->openTag($form) ?>

    <dl class="zend_form">
        <?php echo $this->formElementErrors($form->get('identity')) ?>

        <dt><?php echo $this->formLabel($form->get('identity')) ?></dt>
        <dd><?php echo $this->formInput($form->get('identity')) ?></dd>

        <dt><?php echo $this->formLabel($form->get('credential')) ?></dt>
        <dd><?php echo $this->formInput($form->get('credential')) ?></dd>

        <?php if ($this->redirect): ?>
            <input type="hidden" name="redirect" value="<?php echo $this->escapeHtml($this->redirect) ?>" />
        <?php endif ?>

        <dd><?php echo $this->formButton($form->get('submit')) ?></dd>
    </dl>

<?php echo $this->form()->closeTag() ?>

<?php if ($this->enableRegistration) : ?>
<?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->escapeUrl($this->redirect) : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
<?php endif; ?>
Program: CWE-79
Project: CVE-2015-2963
Buggy source:
en:
  errors:
    messages:
      in_between: "must be in between %{min} and %{max}"
      spoofed_media_type: "has an extension that does not match its contents"

  number:
    human:
      storage_units:
        format: "%n %u"
        units:
          byte:
            one:   "Byte"
            other: "Bytes"
          kb: "KB"
          mb: "MB"
          gb: "GB"
          tb: "TB"


Fixed version (ground truth):
en:
  errors:
    messages:
      in_between: "must be in between %{min} and %{max}"
      spoofed_media_type: "has contents that are not what they are reported to be"

  number:
    human:
      storage_units:
        format: "%n %u"
        units:
          byte:
            one:   "Byte"
            other: "Bytes"
          kb: "KB"
          mb: "MB"
          gb: "GB"
          tb: "TB"
Program: CWE-79
Project: CVE-2015-3296
Buggy source:
{
  "name": "nodebb-plugin-markdown",
  "version": "1.0.2",
  "description": "A Markdown parser for NodeBB",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/julianlam/nodebb-plugin-markdown"
  },
  "keywords": [
    "nodebb",
    "plugin",
    "markdown"
  ],
  "author": "Julian Lam <julian@designcreateplay.com>",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/julianlam/nodebb-plugin-markdown/issues"
  },
  "dependencies": {
    "remarkable": "^1.3.0"
  },
  "nbbpm": {
    "compatibility": "^0.7.0"
  }
}


Fixed version (ground truth):
{
  "name": "nodebb-plugin-markdown",
  "version": "1.0.2",
  "description": "A Markdown parser for NodeBB",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/julianlam/nodebb-plugin-markdown"
  },
  "keywords": [
    "nodebb",
    "plugin",
    "markdown"
  ],
  "author": "Julian Lam <julian@designcreateplay.com>",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/julianlam/nodebb-plugin-markdown/issues"
  },
  "dependencies": {
    "markdown-it": "^4.0.3"
  },
  "nbbpm": {
    "compatibility": "^0.7.0"
  }
}
Program: CWE-79
Project: CVE-2015-5460
Buggy source:
<%= drop_down_for('Classify Event(s)', 'icons/actions.png', 'incident') do %>
	
	<% @classifications.each do |cls| %>
		<% if cls.locked && cls.hotkey %>
			<%= drop_down_item "#{cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
		<% else %>
			<%= drop_down_item "#{cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
		<% end %>
	<% end %>
	
	<%= drop_down_item "Unclassified<span class='shortcut'>ctrl+shift+u</span>", '#', nil, { :class => 'classification', :"data-classification-id" => 0 } %>
	
<% end %>


Fixed version (ground truth):
<%= drop_down_for('Classify Event(s)', 'icons/actions.png', 'incident') do %>
	
	<% @classifications.each do |cls| %>
		<% if cls.locked && cls.hotkey %>
			<%= drop_down_item "#{sanitize cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
		<% else %>
			<%= drop_down_item "#{sanitize cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
		<% end %>
	<% end %>
	
	<%= drop_down_item "Unclassified<span class='shortcut'>ctrl+shift+u</span>", '#', nil, { :class => 'classification', :"data-classification-id" => 0 } %>
	
<% end %>
Program: CWE-79
Project: CVE-2015-7348
Buggy source:
<?php ?>
[<?php
$pId = "-1";
if(array_key_exists( 'id',$_REQUEST)) {
	$pId=$_REQUEST['id'];
}
$pCount = "10";
if(array_key_exists( 'count',$_REQUEST)) {
	$pCount=$_REQUEST['count'];
}
if ($pId==null || $pId=="") $pId = "0";
if ($pCount==null || $pCount=="") $pCount = "10";

$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);

$max = (int)$pCount;
for ($i=1; $i<=$max; $i++) {
	$nId = $pId."_".$i;
	$nName = "tree".$nId;
	echo "{ id:'".$nId."',	name:'".$nName."'}";
	if ($i<$max) {
		echo ",";
	}
	
}
?>]

Fixed version (ground truth):
<?php ?>
[<?php
$pId = "-1";
if(array_key_exists( 'id',$_REQUEST)) {
	$pId=$_REQUEST['id'];
}
$pCount = "10";
if(array_key_exists( 'count',$_REQUEST)) {
	$pCount=$_REQUEST['count'];
}
if ($pId==null || $pId=="") $pId = "0";
if ($pCount==null || $pCount=="") $pCount = "10";

$pId = htmlspecialchars($pId);

$max = (int)$pCount;
for ($i=1; $i<=$max; $i++) {
	$nId = $pId."_".$i;
	$nName = "tree".$nId;
	echo "{ id:'".$nId."',	name:'".$nName."'}";
	if ($i<$max) {
		echo ",";
	}
	
}
?>]
Program: CWE-79
Project: CVE-2016-1143
Buggy source:
# ライブラリ
require 'sinatra'

# 開発環境用ライブラリ
if settings.development?
  require 'pry'
  require 'sinatra/reloader'
end

# クラス
require './class/vine.rb'
require './class/itunes.rb'
require './class/extract.rb'

get '/' do
  erb :index
end

# 音楽の検索
get '/music' do
  info = params["info"]
  search = Itunes.new()
  @music = search.search_musics(info)
  content_type :json
  data = { music: @music }
  data.to_json
end

# 検索ワードの決定
get '/fixed' do
  tag_pick = Extract.new()
  t = tag_pick.pickup_words(params["track"])
  @tags = t.compact
  content_type :json
  data = { artist: params["artist"],  track: params["track"], id: params["id"], tags: @tags}
  data.to_json
end

# 映像の出力
post '/result' do
  @bpm = params["bpm"]
  t = params["tags"]
  id = params["id"]

  music = Itunes.new()
  @music_url = music.search_music_by_id(id)

  t = t.gsub(" ", "")

  tags = []
  if t.index(",")
    tags = t.split(",")
  else
    tags << t
  end

  video = Vine.new()
  v = tags.map { |tag| video.search_tag(tag) }

  v.flatten!
  v = v.compact
  v.sort!
  v = v + v + v + v
  @videos = v[0, 40]

  erb :result
end

# リロードしたらトップへ
get '/result' do
  redirect '/'
end


Fixed version (ground truth):
# ライブラリ
require 'sinatra'

# 開発環境用ライブラリ
if settings.development?
  require 'pry'
  require 'sinatra/reloader'
end

# ERBテンプレートで変数を自動エスケープ
# cf. http://www.sinatrarb.com/faq.html#auto_escape_html
require 'erubis'
set :erb, :escape_html => true

# クラス
require './class/vine.rb'
require './class/itunes.rb'
require './class/extract.rb'

get '/' do
  erb :index
end

# 音楽の検索
get '/music' do
  info = params["info"]
  search = Itunes.new()
  @music = search.search_musics(info)
  content_type :json
  data = { music: @music }
  data.to_json
end

# 検索ワードの決定
get '/fixed' do
  tag_pick = Extract.new()
  t = tag_pick.pickup_words(params["track"])
  @tags = t.compact
  content_type :json
  data = { artist: params["artist"],  track: params["track"], id: params["id"], tags: @tags}
  data.to_json
end

# 映像の出力
post '/result' do
  @bpm = params["bpm"]
  t = params["tags"]
  id = params["id"]

  music = Itunes.new()
  @music_url = music.search_music_by_id(id)

  t = t.gsub(" ", "")

  tags = []
  if t.index(",")
    tags = t.split(",")
  else
    tags << t
  end

  video = Vine.new()
  v = tags.map { |tag| video.search_tag(tag) }

  v.flatten!
  v = v.compact
  v.sort!
  v = v + v + v + v
  @videos = v[0, 40]

  erb :result
end

# リロードしたらトップへ
get '/result' do
  redirect '/'
end
Program: CWE-79
Project: CVE-2016-2045
Buggy source:
CodeMirror.sqlLint = function(text, updateLinting, options, cm) {

    // Skipping check if text box is empty.
    if(text.trim() == "") {
        updateLinting(cm, []);
        return;
    }

    function handleResponse(json) {
        response = JSON.parse(json);

        var found = [];
        for (var idx in response) {
            found.push({
                from: CodeMirror.Pos(
                    response[idx].fromLine, response[idx].fromColumn
                ),
                to: CodeMirror.Pos(
                    response[idx].toLine, response[idx].toColumn
                ),
                message: response[idx].message,
                severity : response[idx].severity
            });
        }

        updateLinting(cm, found);
    }

    $.ajax({
        method: "POST",
        url: "lint.php",
        data: {
            sql_query: text,
            token: PMA_commonParams.get('token'),
            server: PMA_commonParams.get('server')
        },
        success: handleResponse
    });
}


Fixed version (ground truth):
CodeMirror.sqlLint = function(text, updateLinting, options, cm) {

    // Skipping check if text box is empty.
    if(text.trim() == "") {
        updateLinting(cm, []);
        return;
    }

    function handleResponse(response) {
        var found = [];
        for (var idx in response) {
            found.push({
                from: CodeMirror.Pos(
                    response[idx].fromLine, response[idx].fromColumn
                ),
                to: CodeMirror.Pos(
                    response[idx].toLine, response[idx].toColumn
                ),
                message: response[idx].message,
                severity : response[idx].severity
            });
        }

        updateLinting(cm, found);
    }

    $.ajax({
        method: "POST",
        url: "lint.php",
        dataType: 'json',
        data: {
            sql_query: text,
            token: PMA_commonParams.get('token'),
            server: PMA_commonParams.get('server')
        },
        success: handleResponse
    });
}
Program: CWE-79
Project: CVE-2016-4849
Buggy source:
{# begin {templatelocation} #}

    <ul class="uk-subnav uk-flex-right uk-margin-remove">
      <li><g:plusone href="{site_url}/article.php/{story_id}"></g:plusone></li>
      <li><a class="twitter-share-button" data-url="<?php echo COM_getCurrentURL(); ?>" href="https://twitter.com/intent/tweet?text={story_title}" data-lang="ja">Tweet</a></li>
      <li><iframe src="//www.facebook.com/plugins/like.php?href=<?php echo urlencode(COM_getCurrentURL()); ?>&amp;width=150&amp;height=20&amp;colorscheme=light&amp;layout=button_count&amp;action=like&amp;show_faces=true&amp;send=true&amp;appId={!!autotag conf:facebook_consumer_key !!}" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:150px; height:20px;" allowTransparency="true"></iframe></li>
    </ul>

<div class="article">
{formatted_article}
</div>

<div class="uk-grid uk-margin-large-top">
    <div class="uk-width-medium-1-2">
        {whats_related}
    </div>
    <div class="uk-width-medium-1-2">
        {story_options}
    </div>
</div>
<div class="uk-margin-large-top">
{trackback}
</div>
<div class="uk-margin-large-top">
{commentbar}
</div>

{# end {templatelocation} #}


Fixed version (ground truth):
{# begin {templatelocation} #}

    <ul class="uk-subnav uk-flex-right uk-margin-remove">
      <li><g:plusone href="{site_url}/article.php/{story_id}"></g:plusone></li>
      <li><a class="twitter-share-button" data-url="{site_url}/article.php/{story_id}" href="https://twitter.com/intent/tweet?text={story_title}" data-lang="ja">Tweet</a></li>
      <li><iframe src="//www.facebook.com/plugins/like.php?href={site_url}/article.php/{story_id}&amp;width=150&amp;height=20&amp;colorscheme=light&amp;layout=button_count&amp;action=like&amp;show_faces=true&amp;send=true&amp;appId={!!autotag conf:facebook_consumer_key !!}" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:150px; height:20px;" allowTransparency="true"></iframe></li>
    </ul>

<div class="article">
{formatted_article}
</div>

<div class="uk-grid uk-margin-large-top">
    <div class="uk-width-medium-1-2">
        {whats_related}
    </div>
    <div class="uk-width-medium-1-2">
        {story_options}
    </div>
</div>
<div class="uk-margin-large-top">
{trackback}
</div>
<div class="uk-margin-large-top">
{commentbar}
</div>

{# end {templatelocation} #}
Program: CWE-79
Project: CVE-2016-5833
Buggy source:
<?php
/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '4.6-alpha-37756';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 36686;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4310-20160418';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.2.4';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';


Fixed version (ground truth):
<?php
/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '4.6-alpha-37774';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 36686;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4310-20160418';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.2.4';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';
Program: CWE-79
Project: CVE-2016-5834
Buggy source:
<?php
/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '4.6-alpha-37756';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 36686;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4310-20160418';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.2.4';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';


Fixed version (ground truth):
<?php
/**
 * The WordPress version string
 *
 * @global string $wp_version
 */
$wp_version = '4.6-alpha-37774';

/**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
$wp_db_version = 36686;

/**
 * Holds the TinyMCE version
 *
 * @global string $tinymce_version
 */
$tinymce_version = '4310-20160418';

/**
 * Holds the required PHP version
 *
 * @global string $required_php_version
 */
$required_php_version = '5.2.4';

/**
 * Holds the required MySQL version
 *
 * @global string $required_mysql_version
 */
$required_mysql_version = '5.0';