nus-yam/ex-repair huggingface dataset:
Buggy code:
 int bad_format_imginfo ( char * fmt ) { <START_BUG> char * ptr ; <END_BUG> int n = 0 ; ptr = fmt ; while ( * ptr!= '\\0' ) if ( * ptr ++ == '%' ) { if ( * ptr == '\\0' ) return 1 ; if ( * ptr == '%' ) ptr ++ ; else if ( * ptr =='s' || * ptr == 'S' ) { n = 1 ; ptr ++ ; } else { if ( * ptr ==' ') ptr ++ ; while ( * ptr >= '0' && * ptr <= '9' ) ptr ++ ; if ( * ptr ++!= 'l' ) return 1 ; if ( * ptr == 'u' ) ptr ++ ; else return 1 ; n ++ ; } } return ( n!= 3 ) ; }

Fix:
<S2SV_ModStart> fmt ) { return bad_format_check ( "^" SAFE_STRING "%s" SAFE_STRING "%lu" SAFE_STRING "%lu" SAFE_STRING "$", fmt <S2SV_ModEnd> ) ; }
Buggy code:
 void * vpx_calloc ( size_t num, size_t size ) { void * x ; x = vpx_memalign ( DEFAULT_ALIGNMENT, num * size ) ; if ( x ) <START_BUG> VPX_MEMSET_L ( x, 0, num * size ) ; <END_BUG> return x ; }

Fix:
<S2SV_ModStart> ( x ) memset <S2SV_ModEnd> ( x,
Buggy code:
 static int send_parameters ( struct iperf_test * test ) { int r = 0 ; cJSON * j ; j = cJSON_CreateObject ( ) ; if ( j == NULL ) { i_errno = IESENDPARAMS ; r = - 1 ; } else { if ( test -> protocol -> id == Ptcp ) cJSON_AddTrueToObject ( j, "tcp" ) ; else if ( test -> protocol -> id == Pudp ) cJSON_AddTrueToObject ( j, "udp" ) ; <START_BUG> cJSON_AddIntToObject ( j, "omit", test -> omit ) ; <END_BUG> if ( test -> server_affinity!= - 1 )  cJSON_AddIntToObject ( j, "server_affinity", test -> server_affinity ) ; <START_BUG> if ( test -> duration ) cJSON_AddIntToObject ( j, "time", test -> duration ) ; if ( test -> settings -> bytes ) cJSON_AddIntToObject ( j, "num", test -> settings -> bytes ) ; if ( test -> settings -> blocks ) cJSON_AddIntToObject ( j, "blockcount", test -> settings -> blocks ) ; if ( test -> settings -> mss ) cJSON_AddIntToObject ( j, "MSS", test -> settings -> mss ) ; if ( test -> no_delay ) cJSON_AddTrueToObject ( j, "nodelay" ) ; cJSON_AddIntToObject ( j, "parallel", test -> num_streams ) ; if ( test -> reverse ) cJSON_AddTrueToObject ( j, "reverse" ) ; if ( test -> settings -> socket_bufsize ) cJSON_AddIntToObject ( j, "window", test -> settings -> socket_bufsize ) ; if ( test -> settings -> blksize ) cJSON_AddIntToObject ( j, "len", test -> settings -> blksize ) ; if ( test -> settings -> rate ) cJSON_AddIntToObject ( j, "bandwidth", test -> settings -> rate ) ; if ( test -> settings -> burst ) cJSON_AddIntToObject ( j, "burst", test -> settings -> burst ) ; if ( test -> settings -> tos ) cJSON_AddIntToObject ( j, "TOS", test -> settings -> tos ) ; if ( test -> settings -> flowlabel ) c<END_BUG>

Fix:
<S2SV_ModStart> "udp" ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j, <S2SV_ModStart> - 1 ) cJSON_AddNumberToObject ( j, "server_affinity", test -> server_affinity ) ; if ( test -> duration ) cJSON_AddNumberToObject ( j, "time", test -> duration ) ; if ( test -> settings -> bytes ) cJSON_AddNumberToObject ( j, "num", test -> settings -> bytes ) ; if ( test -> settings -> blocks ) cJSON_AddNumberToObject ( j, "blockcount", test -> settings -> blocks ) ; if ( test -> settings -> mss ) cJSON_AddNumberToObject ( j, "MSS", test -> settings -> mss ) ; if ( test -> no_delay ) cJSON_AddTrueToObject ( j, "nodelay" ) ; cJSON_AddNumberToObject ( j, "parallel", test -> num_streams ) ; if ( test -> reverse ) cJSON_AddTrueToObject ( j, "reverse" ) ; if ( test -> settings -> socket_bufsize ) cJSON_AddNumberToObject ( j, "window", test -> settings -> socket_bufsize ) ;
Buggy code:
 static int udf_readdir ( struct file * file, struct dir_context * ctx ) { struct inode * dir = file_inode ( file ) ; struct udf_inode_info * iinfo = UDF_I ( dir ) ; struct udf_fileident_bh fibh = {. sbh = NULL,. ebh = NULL } ; struct fileIdentDesc * fi = NULL ; struct fileIdentDesc cfi ; int block, iblock ; loff_t nf_pos ; int flen ; unsigned char * fname = NULL ; unsigned char * nameptr ; uint16_t liu ; uint8_t lfi ; loff_t size = udf_ext0_offset ( dir ) + dir -> i_size ; struct buffer_head * tmp, * bha [ 16 ] ; struct kernel_lb_addr eloc ; uint32_t elen ; sector_t offset ; int i, num, ret = 0 ; struct extent_position epos = { NULL, 0, { 0, 0 } } ; if ( ctx -> pos == 0 ) { if (! dir_emit_dot ( file, ctx ) ) return 0 ; ctx -> pos = 1 ; } nf_pos = ( ctx -> pos - 1 ) << 2 ; if ( nf_pos >= size ) goto out ; fname = kmalloc ( UDF_NAME_LEN, GFP_NOFS ) ; if (! fname ) { ret = - ENOMEM ; goto out ; } if ( nf_pos == 0 ) nf_pos = udf_ext0_offset ( dir ) ; fibh. soffset = fibh. eoffset = nf_pos & ( dir -> i_sb -> s_blocksize - 1 ) ; if ( iinfo -> i_alloc_type!= ICBTAG_FLAG_AD_IN_ICB ) { if ( inode_bmap ( dir, nf_pos >> dir -> i_sb -> s_blocksize_bits, & epos, & eloc, & elen, & offset )!= ( EXT_RECORDED_ALLOCATED >> 30 ) ) { ret = - ENOENT ; goto out ; } block = udf_get_lb_pblock ( dir -> i_sb, & eloc, offset ) ; if ( ( ++ offset << dir -> i_sb -> s_blocksize_bits ) < el

Fix:
<S2SV_ModStart>, nameptr, lfi, fname, UDF_NAME_LEN <S2SV_ModEnd> ) ; if
Buggy code:
 int git_delta_apply ( void * * out, size_t * out_len, const unsigned char * base, size_t base_len, const unsigned char * delta, size_t delta_len ) { const unsigned char * delta_end = delta + delta_len ; size_t base_sz, res_sz, alloc_sz ; unsigned char * res_dp ; * out = NULL ; * out_len = 0 ; if ( ( hdr_sz ( & base_sz, & delta, delta_end ) < 0 ) || ( base_sz!= base_len ) ) { giterr_set ( GITERR_INVALID, "failed   to   apply   delta:   base   size   does   not   match   given   data" ) ; return - 1 ; } if ( hdr_sz ( & res_sz, & delta, delta_end ) < 0 ) { giterr_set ( GITERR_INVALID, "failed   to   apply   delta:   base   size   does   not   match   given   data" ) ; return - 1 ; } GITERR_CHECK_ALLOC_ADD ( & alloc_sz, res_sz, 1 ) ; res_dp = git__malloc ( alloc_sz ) ; GITERR_CHECK_ALLOC ( res_dp ) ; res_dp [ res_sz ] = '\\0' ; * out = res_dp ; * out_len = res_sz ; while ( delta < delta_end ) { unsigned char cmd = * delta ++ ; if ( cmd & 0x80 ) { <START_BUG> size_t off = 0, len = 0 ; <END_BUG> # define ADD_DELTA ( o, shift ) { if ( delta < delta_end ) ( o ) |= ( ( unsigned ) * delta ++ << shift ) ; else goto fail ; } if ( cmd & 0x01 ) ADD_DELTA ( off, 0UL ) ; if ( cmd & 0x02 ) ADD_DELTA ( off, 8UL ) ; if ( cmd & 0x04 ) ADD_DELTA ( off, 16UL ) ; if ( cmd & 0x08 ) ADD_DELTA ( off, 24UL ) ; if ( cmd & 0x10 ) ADD_DELTA ( len, 0UL ) ; if ( cmd & 0x20 ) ADD_DELTA ( len, 8UL

Fix:
<S2SV_ModStart> len = 0, end <S2SV_ModStart> ADD_DELTA if ( GIT_ADD_SIZET_OVERFLOW ( & end, off, len ) || base_len < end <S2SV_ModEnd> || res_sz <
Buggy code:
 int usb_get_bos_descriptor ( struct usb_device * dev ) { struct device * ddev = & dev -> dev ; struct usb_bos_descriptor * bos ; struct usb_dev_cap_header * cap ; unsigned char * buffer ; int length, total_len, num, i ; int ret ; bos = kzalloc ( sizeof ( struct usb_bos_descriptor ), GFP_KERNEL ) ; if (! bos ) return - ENOMEM ; ret = usb_get_descriptor ( dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE ) ; if ( ret < USB_DT_BOS_SIZE ) { dev_err ( ddev, "unable   to   get   BOS   descriptor\\n" ) ; if ( ret >= 0 ) ret = - ENOMSG ; kfree ( bos ) ; return ret ; } length = bos -> bLength ; total_len = le16_to_cpu ( bos -> wTotalLength ) ; num = bos -> bNumDeviceCaps ; kfree ( bos ) ; if ( total_len < length ) return - EINVAL ; dev -> bos = kzalloc ( sizeof ( struct usb_host_bos ), GFP_KERNEL ) ; if (! dev -> bos ) return - ENOMEM ; buffer = kzalloc ( total_len, GFP_KERNEL ) ; if (! buffer ) { ret = - ENOMEM ; goto err ; } dev -> bos -> desc = ( struct usb_bos_descriptor * ) buffer ; ret = usb_get_descriptor ( dev, USB_DT_BOS, 0, buffer, total_len ) ; if ( ret < total_len ) { dev_err ( ddev, "unable   to   get   BOS   descriptor   set\\n" ) ; if ( ret >= 0 ) ret = - ENOMSG ; goto err ; } total_len -= length ; for ( i = 0 ; i < num ; i ++ ) { buffer += length ; cap = ( struct usb_dev_cap_header * ) buffer ; <START_BUG> length = cap -> bLength ; <END_BUG> if ( total_len < length ) break ; total_len -= length ; if ( cap -> bDescriptorType!= USB_DT_DEVICE_CAPABILITY ) { dev_warn ( ddev, "

Fix:
<S2SV_ModStart> ) buffer ; if ( total_len < sizeof ( * cap ) || total_len < <S2SV_ModEnd> cap -> bLength <S2SV_ModStart> cap -> bLength ) { dev -> bos -> desc -> bNumDeviceCaps = i ; break ; } length = cap -> bLength <S2SV_ModEnd> ; total_len -=
Buggy code:
 static vpx_codec_err_t vp8_destroy ( vpx_codec_alg_priv_t * ctx ) { <START_BUG> int i ; <END_BUG> vp8_remove_decoder_instances ( & ctx -> yv12_frame_buffers ) ;  for ( i = NELEMENTS ( ctx -> mmaps ) - 1 ; i >= 0 ; i -- ) <START_BUG> { if ( ctx -> mmaps [ i ]. dtor ) ctx -> mmaps [ i ]. dtor ( & ctx -> mmaps [ i ] ) ; } return VPX_CODEC_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> ctx ) { <S2SV_ModEnd> vp8_remove_decoder_instances ( & <S2SV_ModStart> yv12_frame_buffers ) ; vpx_free ( ctx ) ; <S2SV_ModEnd> return VPX_CODEC_OK ;
Buggy code:
 static void call_bind_status ( struct rpc_task * task ) { int status = - EIO ; if ( task -> tk_status >= 0 ) { dprint_status ( task ) ; task -> tk_status = 0 ; task -> tk_action = call_connect ; return ; } switch ( task -> tk_status ) { case - ENOMEM : dprintk ( "RPC:   %5u   rpcbind   out   of   memory\\n", task -> tk_pid ) ; rpc_delay ( task, HZ >> 2 ) ; goto retry_timeout ; case - EACCES : dprintk ( "RPC:   %5u   remote   rpcbind:   RPC   program//version   " "unavailable\\n", task -> tk_pid ) ; if ( task -> tk_msg. rpc_proc -> p_proc == 0 ) { status = - EOPNOTSUPP ; break ; } <START_BUG> rpc_delay ( task, 3 * HZ ) ; <END_BUG> goto retry_timeout ; case - ETIMEDOUT : dprintk ( "RPC:   %5u   rpcbind   request   timed   out\\n", task -> tk_pid ) ; goto retry_timeout ; case - EPFNOSUPPORT : dprintk ( "RPC:   %5u   unrecognized   remote   rpcbind   service\\n", task -> tk_pid ) ; break ; case - EPROTONOSUPPORT : dprintk ( "RPC:   %5u   remote   rpcbind   version   unavailable,   retrying\\n", task -> tk_pid ) ; task -> tk_status = 0 ; task -> tk_action = call_bind ; return ; case - ECONNREFUSED : case - ECONNRESET : case - ENOTCONN : case - EHOSTDOWN : case - EHOSTUNREACH : case - ENETUNREACH : case - EPIPE : dprintk ( "RPC:   %5u   remote   rpcbind   unreachable:   %d\\n", task -> tk_pid, task -> tk_status ) ; if (! RPC_IS_SOFTCONN ( task ) ) { rpc_delay ( task, 5 * HZ ) ; goto retry_timeout ; } status = task -> tk_status ; break ; default : dprintk

Fix:
<S2SV_ModStart> break ; } if ( task -> tk_rebind_retry == 0 ) break ; task -> tk_rebind_retry -- ;
Buggy code:
 static void bgp_capabilities_print ( netdissect_options * ndo, const u_char * opt, int caps_len ) { int cap_type, cap_len, tcap_len, cap_offset ; int i = 0 ; while ( i < caps_len ) { ND_TCHECK2 ( opt [ i ], BGP_CAP_HEADER_SIZE ) ; cap_type = opt [ i ] ; cap_len = opt [ i + 1 ] ; tcap_len = cap_len ; ND_PRINT ( ( ndo, "\\n\\t             %s   (%u),   length:   %u", tok2str ( bgp_capcode_values, "Unknown", cap_type ), cap_type, cap_len ) ) ; ND_TCHECK2 ( opt [ i + 2 ], cap_len ) ; switch ( cap_type ) { case BGP_CAPCODE_MP : ND_PRINT ( ( ndo, "\\n\\t\\tAFI   %s   (%u),   SAFI   %s   (%u)", tok2str ( af_values, "Unknown", EXTRACT_16BITS ( opt + i + 2 ) ), EXTRACT_16BITS ( opt + i + 2 ), tok2str ( bgp_safi_values, "Unknown", opt [ i + 5 ] ), opt [ i + 5 ] ) ) ; break ; <START_BUG> case BGP_CAPCODE_RESTART : <END_BUG> ND_PRINT ( ( ndo, "\\n\\t\\tRestart   Flags:   [%s],   Restart   Time   %us", ( ( opt [ i + 2 ] ) & 0x80 )? "R" : "none", EXTRACT_16BITS ( opt + i + 2 ) & 0xfff ) ) ; tcap_len -= 2 ; cap_offset = 4 ; while ( tcap_len >= 4 ) { ND_PRINT ( ( ndo, "\\n\\t\\t     AFI   %s   (%u),   SAFI   %s   (%u),   Forwarding   state   preserved:   %s", tok2str ( af_values, "Unknown", EXTRACT_16BITS ( opt + i + cap_offset ) ), EXTRACT_16

Fix:
<S2SV_ModStart> case BGP_CAPCODE_RESTART : ND_TCHECK_16BITS ( opt + i + 2 ) ;
Buggy code:
 void vp9_update_spatial_layer_framerate ( VP9_COMP * const cpi, double framerate ) { <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG>  LAYER_CONTEXT * const lc = get_layer_context ( & cpi -> svc ) ; <START_BUG> RATE_CONTROL * const lrc = & lc -> rc ; lc -> framerate = framerate ; <END_BUG> lrc -> av_per_frame_bandwidth = ( int ) ( lc -> target_bandwidth // lc -> framerate ) ;  <START_BUG> lrc -> min_frame_bandwidth = ( int ) ( lrc -> av_per_frame_bandwidth * <END_BUG> oxcf -> two_pass_vbrmin_section // 100 ) ;  lrc -> max_frame_bandwidth = ( int ) ( ( ( int64_t ) lrc -> av_per_frame_bandwidth * <START_BUG> oxcf -> two_pass_vbrmax_section ) // 100 ) ; <END_BUG> lrc -> max_gf_interval = 16 ;  lrc -> static_scene_max_gf_interval = cpi -> key_frame_frequency >> 1 ; if ( oxcf -> play_alternate && oxcf -> lag_in_frames ) { if ( lrc -> max_gf_interval > oxcf -> lag_in_frames - 1 ) lrc -> max_gf_interval = oxcf -> lag_in_frames - 1 ; if ( lrc -> static_scene_max_gf_interval > oxcf -> lag_in_frames - 1 ) lrc -> static_scene_max_gf_interval = oxcf -> lag_in_frames - 1 ; } if ( lrc -> max_gf_interval > lrc -> static_scene_max_gf_interval ) lrc -> max_gf_interval = lrc -> static_scene_max_gf_interval ; }

Fix:
<S2SV_ModStart> ) { const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> = get_layer_context ( cpi <S2SV_ModEnd> ) ; RATE_CONTROL <S2SV_ModStart> ; lrc -> avg_frame_bandwidth <S2SV_ModEnd> = ( int <S2SV_ModStart> ( lrc -> avg_frame_bandwidth <S2SV_ModEnd> * oxcf -> <S2SV_ModStart> ) lrc -> avg_frame_bandwidth <S2SV_ModEnd> * oxcf -> <S2SV_ModStart> 100 ) ; vp9_rc_set_gf_interval_range ( cpi, lrc ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int lxc_attach ( const char * name, const char * lxcpath, lxc_attach_exec_t exec_function, void * exec_payload, lxc_attach_options_t * options, pid_t * attached_process ) { int ret, status ; pid_t init_pid, pid, attached_pid, expected ; struct lxc_proc_context_info * init_ctx ; char * cwd ; char * new_cwd ; int ipc_sockets [ 2 ] ; <START_BUG> signed long personality ; <END_BUG> if (! options ) options = & attach_static_default_options ; init_pid = lxc_cmd_get_init_pid ( name, lxcpath ) ; if ( init_pid < 0 ) { ERROR ( "failed   to   get   the   init   pid" ) ; return - 1 ; } init_ctx = lxc_proc_get_context_info ( init_pid ) ; if (! init_ctx ) { ERROR ( "failed   to   get   context   of   the   init   process,   pid   =   %ld", ( long ) init_pid ) ; return - 1 ; } personality = get_personality ( name, lxcpath ) ; if ( init_ctx -> personality < 0 ) { ERROR ( "Failed   to   get   personality   of   the   container" ) ; lxc_proc_put_context_info ( init_ctx ) ; return - 1 ; } init_ctx -> personality = personality ; if (! fetch_seccomp ( name, lxcpath, init_ctx, options ) ) WARN ( "Failed   to   get   seccomp   policy" ) ; cwd = getcwd ( NULL, 0 ) ; if ( options -> namespaces == - 1 ) { options -> namespaces = lxc_cmd_get_clone_flags ( name, lxcpath ) ; if ( options -> namespaces == - 1 ) { ERROR ( "failed   to   automatically   determine   the   " "namespaces   which   the   container   unshared" ) ; free ( cwd ) ; lxc_proc_put_context_info ( init_ctx ) ; return - 1 ; } } ret = socketpair ( PF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets ) ; if

Fix:
<S2SV_ModStart> 2 ] ; int procfd ; <S2SV_ModStart> ) ; } procfd = open ( "//proc", O_DIRECTORY | O_RDONLY ) ; if ( procfd < 0 ) { SYSERROR ( "Unable <S2SV_blank> to <S2SV_blank> open <S2SV_blank> //proc" ) ; shutdown ( ipc_sockets [ 1 ], SHUT_RDWR ) ; rexit ( - 1 ) ; } <S2SV_ModStart> exec_payload = exec_payload,. procfd = procfd
Buggy code:
 static int nfp_flower_spawn_vnic_reprs ( struct nfp_app * app, enum nfp_flower_cmsg_port_vnic_type vnic_type, enum nfp_repr_type repr_type, unsigned int cnt ) { u8 nfp_pcie = nfp_cppcore_pcie_unit ( app -> pf -> cpp ) ; struct nfp_flower_priv * priv = app -> priv ; atomic_t * replies = & priv -> reify_replies ; struct nfp_flower_repr_priv * repr_priv ; enum nfp_port_type port_type ; struct nfp_repr * nfp_repr ; struct nfp_reprs * reprs ; int i, err, reify_cnt ; const u8 queue = 0 ; port_type = repr_type == NFP_REPR_TYPE_PF? NFP_PORT_PF_PORT : NFP_PORT_VF_PORT ; reprs = nfp_reprs_alloc ( cnt ) ; if (! reprs ) return - ENOMEM ; for ( i = 0 ; i < cnt ; i ++ ) { struct net_device * repr ; struct nfp_port * port ; u32 port_id ; repr = nfp_repr_alloc ( app ) ; if (! repr ) { err = - ENOMEM ; goto err_reprs_clean ; } repr_priv = kzalloc ( sizeof ( * repr_priv ), GFP_KERNEL ) ; if (! repr_priv ) { err = - ENOMEM ; <START_BUG> goto err_reprs_clean ; <END_BUG> } nfp_repr = netdev_priv ( repr ) ; nfp_repr -> app_priv = repr_priv ; repr_priv -> nfp_repr = nfp_repr ; WARN_ON ( repr_type == NFP_REPR_TYPE_PF && i ) ; port = nfp_port_alloc ( app, port_type, repr ) ; if ( IS_ERR ( port ) ) { err = PTR_ERR ( port ) ;  nfp_repr_free ( repr ) ; <START_BUG> goto err_reprs_clean ; } if ( repr_type == NFP_REPR_TYPE_PF ) { port -> pf_<END_BUG>

Fix:
<S2SV_ModStart> - ENOMEM ; nfp_repr_free ( repr ) ; <S2SV_ModStart> port ) ; kfree ( repr_priv ) ; <S2SV_ModStart> err ) { kfree ( repr_priv ) ;
Buggy code:
 int cdf_read_property_info ( const cdf_stream_t * sst, const cdf_header_t * h, uint32_t offs, cdf_property_info_t * * info, size_t * count, size_t * maxcount ) { const cdf_section_header_t * shp ; cdf_section_header_t sh ; const uint8_t * p, * q, * e ; int16_t s16 ; int32_t s32 ; uint32_t u32 ; int64_t s64 ; uint64_t u64 ; cdf_timestamp_t tp ; size_t i, o, o4, nelements, j ; cdf_property_info_t * inp ; if ( offs > UINT32_MAX // 4 ) { errno = EFTYPE ; goto out ; } shp = CAST ( const cdf_section_header_t *, ( const void * ) ( ( const char * ) sst -> sst_tab + offs ) ) ; if ( cdf_check_stream_offset ( sst, h, shp, sizeof ( * shp ), __LINE__ ) == - 1 ) goto out ; sh. sh_len = CDF_TOLE4 ( shp -> sh_len ) ; # define CDF_SHLEN_LIMIT ( UINT32_MAX // 8 ) if ( sh. sh_len > CDF_SHLEN_LIMIT ) { errno = EFTYPE ; goto out ; } sh. sh_properties = CDF_TOLE4 ( shp -> sh_properties ) ; # define CDF_PROP_LIMIT ( UINT32_MAX // ( 4 * sizeof ( * inp ) ) ) if ( sh. sh_properties > CDF_PROP_LIMIT ) goto out ; DPRINTF ( ( "section   len:   %u   properties   %u\\n", sh. sh_len, sh. sh_properties ) ) ; if ( * maxcount ) { if ( * maxcount > CDF_PROP_LIMIT ) goto out ; * maxcount += sh. sh_properties ; inp = CAST ( cdf_property_info_t *, realloc ( * info, * maxcount * sizeof ( * inp ) ) ) ; } else { * maxcount = sh. sh_properties ; inp = CAST ( cdf_property_info_t *, malloc ( * maxcount *

Fix:
<S2SV_ModStart> ) { size_t tail = <S2SV_ModEnd> ( i << <S2SV_ModStart> ) + 1 ; if ( cdf_check_stream_offset ( sst, h, p, tail * sizeof ( uint32_t ), __LINE__ ) == - 1 ) goto out ; size_t ofs = CDF_GETUINT32 ( p, tail
Buggy code:
 static int attach_child_main ( void * data ) { struct attach_clone_payload * payload = ( struct attach_clone_payload * ) data ; int ipc_socket = payload -> ipc_socket ; <START_BUG> lxc_attach_options_t * options = payload -> options ; <END_BUG> struct lxc_proc_context_info * init_ctx = payload -> init_ctx ; # if HAVE_SYS_PERSONALITY_H long new_personality ; # endif int ret ; int status ; int expected ; long flags ; int fd ; uid_t new_uid ; gid_t new_gid ; expected = 0 ; status = - 1 ; ret = lxc_read_nointr_expect ( ipc_socket, & status, sizeof ( status ), & expected ) ; if ( ret <= 0 ) { ERROR ( "error   using   IPC   to   receive   notification   from   initial   process   (0)" ) ; shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } if (! ( options -> namespaces & CLONE_NEWNS ) && ( options -> attach_flags & LXC_ATTACH_REMOUNT_PROC_SYS ) ) { ret = lxc_attach_remount_sys_proc ( ) ; if ( ret < 0 ) { shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } } # if HAVE_SYS_PERSONALITY_H if ( options -> personality < 0 ) new_personality = init_ctx -> personality ; else new_personality = options -> personality ; if ( options -> attach_flags & LXC_ATTACH_SET_PERSONALITY ) { ret = personality ( new_personality ) ; if ( ret < 0 ) { SYSERROR ( "could   not   ensure   correct   architecture" ) ; shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } } # endif if ( options -> attach_flags & LXC_ATTACH_DROP_CAPABILITIES ) { ret = lxc_attach_drop_privs ( init_ctx ) ; if ( ret < 0 ) { ERROR ( "could   not   drop   privileges" ) ;

Fix:
<S2SV_ModStart> -> ipc_socket ; int procfd = payload -> procfd ; <S2SV_ModStart> & LXC_ATTACH_LSM ) && init_ctx -> lsm_label <S2SV_ModStart> int on_exec ; <S2SV_ModEnd> on_exec = options <S2SV_ModStart> : 0 ; if ( lsm_set_label_at ( procfd, on_exec, <S2SV_ModEnd> init_ctx -> lsm_label <S2SV_ModStart> init_ctx -> lsm_label ) <S2SV_ModEnd> < 0 ) <S2SV_ModStart> } } } close ( procfd ) ;
Buggy code:
 static void resize_multistep ( const uint8_t * const input, int length, uint8_t * output, int olength, uint8_t * buf ) { int steps ; if ( length == olength ) { <START_BUG> memcpy ( output, input, sizeof ( uint8_t ) * length ) ; <END_BUG> return ; } steps = get_down2_steps ( length, olength ) ; if ( steps > 0 ) { int s ; uint8_t * out = NULL ; uint8_t * tmpbuf = NULL ; uint8_t * otmp, * otmp2 ; int filteredlength = length ; if (! tmpbuf ) { tmpbuf = ( uint8_t * ) malloc ( sizeof ( uint8_t ) * length ) ; otmp = tmpbuf ; } else { otmp = buf ; } otmp2 = otmp + get_down2_length ( length, 1 ) ; for ( s = 0 ; s < steps ; ++ s ) { const int proj_filteredlength = get_down2_length ( filteredlength, 1 ) ; const uint8_t * const in = ( s == 0? input : out ) ; if ( s == steps - 1 && proj_filteredlength == olength ) out = output ; else out = ( s & 1? otmp2 : otmp ) ; if ( filteredlength & 1 ) down2_symodd ( in, filteredlength, out ) ; else down2_symeven ( in, filteredlength, out ) ; filteredlength = proj_filteredlength ; } if ( filteredlength!= olength ) { interpolate ( out, filteredlength, output, olength ) ; } if ( tmpbuf ) free ( tmpbuf ) ; } else { interpolate ( input, length, output, olength ) ; } }

Fix:
<S2SV_ModStart>, sizeof ( output [ 0 ] <S2SV_ModEnd> ) * length
Buggy code:
 error_t mqttSnClientSendUnsubscribe ( MqttSnClientContext * context, const char_t * topicName ) { error_t error ; systime_t time ; uint16_t topicId ; MqttSnFlags flags ; error = NO_ERROR ; flags. all = 0 ; topicId = mqttSnClientFindPredefTopicName ( context, topicName ) ; if ( topicId!= MQTT_SN_INVALID_TOPIC_ID ) { flags. topicIdType = MQTT_SN_PREDEFINED_TOPIC_ID ; } else { <START_BUG> if ( osStrlen ( topicName ) == 2 && strchr ( topicName, '#' ) == NULL && <END_BUG>  strchr ( topicName, '+' ) == NULL ) <START_BUG> { flags. topicIdType = MQTT_SN_SHORT_TOPIC_NAME ; } else { flags. topicIdType = MQTT_SN_NORMAL_TOPIC_NAME ; } error = mqttSnFormatUnsubscribe ( & context -> message, flags, context -> msgId, topicId, topicName ) ; } if (! error ) { TRACE_INFO ( "Sending   UNSUBSCRIBE   message   (%" PRIuSIZE "   bytes)...\\r\\n", context -> message. length ) ; mqttSnDumpMessage ( context -> message. buffer, context -> message. length ) ; error = mqttSnClientSendDatagram ( context, context -> message. buffer, context -> message. length ) ; time = osGetSystemTime ( ) ; context -> retransmitStartTime = time ; context -> keepAliveTimestamp = time ; context -> state = MQTT_SN_CLIENT_STATE_SENDING_REQ ; context -> msgType = MQTT_SN_MSG_TYPE_UNSUBSCRIBE ; } return error ; }<END_BUG>

Fix:
<S2SV_ModStart> == 2 && osStrchr <S2SV_ModEnd> ( topicName, <S2SV_ModStart> == NULL && osStrchr <S2SV_ModEnd> ( topicName,
Buggy code:
 void vpx_img_free ( vpx_image_t * img ) { if ( img ) { if ( img -> img_data && img -> img_data_owner ) <START_BUG> img_buf_free ( img -> img_data ) ; <END_BUG> if ( img -> self_allocd ) free ( img ) ; } }

Fix:
<S2SV_ModStart> -> img_data_owner ) vpx_free <S2SV_ModEnd> ( img ->
Buggy code:
 void init_xml_schema ( ) { VALUE nokogiri = rb_define_module ( "Nokogiri" ) ; VALUE xml = rb_define_module_under ( nokogiri, "XML" ) ; VALUE klass = rb_define_class_under ( xml, "Schema", rb_cObject ) ; cNokogiriXmlSchema = klass ; <START_BUG> rb_define_singleton_method ( klass, "read_memory", read_memory, 1 ) ; <END_BUG>  rb_define_singleton_method ( klass, "from_document", from_document, 1 ) ; <START_BUG> rb_define_private_method ( klass, "validate_document", validate_document, 1 ) ; rb_define_private_method ( klass, "validate_file", validate_file, 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, read_memory, - <S2SV_ModStart>, from_document, -
Buggy code:
 WORD32 ih264d_decode_gaps_in_frame_num ( dec_struct_t * ps_dec, UWORD16 u2_frame_num ) { UWORD32 u4_next_frm_num, u4_start_frm_num ; UWORD32 u4_max_frm_num ; pocstruct_t s_tmp_poc ; WORD32 i4_poc ; dec_slice_params_t * ps_cur_slice ; dec_pic_params_t * ps_pic_params ; WORD8 i1_gap_idx ; WORD32 * i4_gaps_start_frm_num ; dpb_manager_t * ps_dpb_mgr ; WORD32 i4_frame_gaps ; WORD8 * pi1_gaps_per_seq ; WORD32 ret ; ps_cur_slice = ps_dec -> ps_cur_slice ; if ( ps_cur_slice -> u1_field_pic_flag ) { if ( ps_dec -> u2_prev_ref_frame_num == u2_frame_num ) return 0 ; } u4_next_frm_num = ps_dec -> u2_prev_ref_frame_num + 1 ; u4_max_frm_num = ps_dec -> ps_cur_sps -> u2_u4_max_pic_num_minus1 + 1 ; if ( u4_next_frm_num >= u4_max_frm_num ) { u4_next_frm_num -= u4_max_frm_num ; } if ( u4_next_frm_num == u2_frame_num ) { return ( 0 ) ; } if ( ( ps_dec -> u1_nal_unit_type == IDR_SLICE_NAL ) && ( u4_next_frm_num >= u2_frame_num ) ) { return ( 0 ) ; } u4_start_frm_num = u4_next_frm_num ; s_tmp_poc. i4_pic_order_cnt_lsb = 0 ; s_tmp_poc. i4_delta_pic_order_cnt_bottom = 0 ; s_tmp_

Fix:
<S2SV_ModStart> -> ps_cur_pps ; <S2SV_ModEnd> i4_frame_gaps = 0
Buggy code:
 static void commit_tree ( struct mount * mnt, struct mount * shadows ) { struct mount * parent = mnt -> mnt_parent ; struct mount * m ; LIST_HEAD ( head ) ; struct mnt_namespace * n = parent -> mnt_ns ; BUG_ON ( parent == mnt ) ; list_add_tail ( & head, & mnt -> mnt_list ) ; list_for_each_entry ( m, & head, mnt_list ) m -> mnt_ns = n ; list_splice ( & head, n -> list. prev ) ; <START_BUG> attach_shadowed ( mnt, parent, shadows ) ; <END_BUG> touch_mnt_namespace ( n ) ; }

Fix:
<S2SV_ModStart> prev ) ; n -> mounts += n -> pending_mounts ; n -> pending_mounts = 0 ;
Buggy code:
 static int simulate_sync ( struct pt_regs * regs, unsigned int opcode ) { if ( ( opcode & OPCODE ) == SPEC0 && ( opcode & FUNC ) == SYNC ) { perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, <START_BUG> 1, 0, regs, 0 ) ; <END_BUG> return 0 ; } return - 1 ; }

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, 0
Buggy code:
 void sock_release ( struct socket * sock ) { <START_BUG> if ( sock -> ops ) { <END_BUG> struct module * owner = sock -> ops -> owner ; sock -> ops -> release ( sock ) ; sock -> ops = NULL ; module_put ( owner ) ; }  if ( rcu_dereference_protected ( sock -> wq, 1 ) -> fasync_list ) <START_BUG> pr_err ( "%s:   fasync   list   not   empty!\\n", __func__ ) ; if (! sock -> file ) { iput ( SOCK_INODE ( sock ) ) ; return ; } sock -> file = NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> sock ) { __sock_release ( sock, NULL <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static OPJ_BOOL opj_j2k_write_mco ( opj_j2k_t * p_j2k, struct opj_stream_private * p_stream, struct opj_event_mgr * p_manager ) { OPJ_BYTE * l_current_data = 00 ; OPJ_UINT32 l_mco_size ; opj_tcp_t * l_tcp = 00 ; opj_simple_mcc_decorrelation_data_t * l_mcc_record ; OPJ_UINT32 i ; assert ( p_j2k!= 00 ) ; assert ( p_manager!= 00 ) ; assert ( p_stream!= 00 ) ; l_tcp = & ( p_j2k -> m_cp. tcps [ p_j2k -> m_current_tile_number ] ) ; <START_BUG> l_current_data = p_j2k -> m_specific_param. m_encoder. m_header_tile_data ; <END_BUG> l_mco_size = 5 + l_tcp -> m_nb_mcc_records ; if ( l_mco_size > p_j2k -> m_specific_param. m_encoder. m_header_tile_data_size ) { OPJ_BYTE * new_header_tile_data = ( OPJ_BYTE * ) opj_realloc ( p_j2k -> m_specific_param. m_encoder. m_header_tile_data, l_mco_size ) ; if (! new_header_tile_data ) { opj_free ( p_j2k -> m_specific_param. m_encoder. m_header_tile_data ) ; p_j2k -> m_specific_param. m_encoder. m_header_tile_data = NULL ; p_j2k -> m_specific_param. m_encoder. m_header_tile_data_size = 0 ; opj_event_msg ( p_manager, EVT_ERROR, "Not   enough   memory   to   write   MCO   marker\\n" ) ; return OPJ_FALSE ; } p_j2k -> m_specific_param. m_encoder. m_header_tile_data = new_header_

Fix:
<S2SV_ModStart> ] ) ; <S2SV_ModEnd> l_mco_size = 5 <S2SV_ModStart> l_mco_size ; } l_current_data = p_j2k -> m_specific_param. m_encoder. m_header_tile_data ;
Buggy code:
 static inline void x86_assign_hw_event ( struct perf_event * event, struct cpu_hw_events * cpuc, int i ) { struct hw_perf_event * hwc = & event -> hw ; hwc -> idx = cpuc -> assign [ i ] ; hwc -> last_cpu = smp_processor_id ( ) ; hwc -> last_tag = ++ cpuc -> tags [ i ] ; if ( hwc -> idx == X86_PMC_IDX_FIXED_BTS ) { hwc -> config_base = 0 ; hwc -> event_base = 0 ; } else if ( hwc -> idx >= X86_PMC_IDX_FIXED ) { hwc -> config_base = MSR_ARCH_PERFMON_FIXED_CTR_CTRL ; <START_BUG> hwc -> event_base = MSR_ARCH_PERFMON_FIXED_CTR0 ; <END_BUG> } else { hwc -> config_base = x86_pmu_config_addr ( hwc -> idx ) ; hwc -> event_base = x86_pmu_event_addr ( hwc -> idx ) ; } }

Fix:
<S2SV_ModStart> event_base = MSR_ARCH_PERFMON_FIXED_CTR0 + ( hwc -> idx - X86_PMC_IDX_FIXED )
Buggy code:
 int fit_check_format ( const void * fit, ulong size ) { int ret ; ret = fdt_check_header ( fit ) ; if ( ret ) { log_debug ( "Wrong   FIT   format:   not   a   flattened   device   tree   (err=%d)\\n", ret ) ; return - ENOEXEC ; } <START_BUG> if (! fdt_getprop ( fit, 0, FIT_DESC_PROP, NULL ) ) { <END_BUG> log_debug ( "Wrong   FIT   format:   no   description\\n" ) ; return - ENOMSG ; } if ( IMAGE_ENABLE_TIMESTAMP ) { if (! fdt_getprop ( fit, 0, FIT_TIMESTAMP_PROP, NULL ) ) { log_debug ( "Wrong   FIT   format:   no   timestamp\\n" ) ; return - ENODATA ; } } if ( fdt_path_offset ( fit, FIT_IMAGES_PATH ) < 0 ) { log_debug ( "Wrong   FIT   format:   no   images   parent   node\\n" ) ; return - ENOENT ; } return 0 ; }

Fix:
<S2SV_ModStart> } if ( CONFIG_IS_ENABLED ( FIT_FULL_CHECK ) ) { if ( size == IMAGE_SIZE_INVAL ) size = fdt_totalsize ( fit ) ; ret = fdt_check_full ( fit, size ) ; if ( ret ) { log_debug ( "FIT <S2SV_blank> check <S2SV_blank> error <S2SV_blank> %d\\n", ret ) ; return - EINVAL ; } } if (
Buggy code:
 static int resp_get_length ( netdissect_options * ndo, register const u_char * bp, int len, const u_char * * endp ) { int result ; u_char c ; int saw_digit ; int neg ; int too_large ; if ( len == 0 ) goto trunc ; ND_TCHECK ( * bp ) ; too_large = 0 ; neg = 0 ; if ( * bp == '-' ) { neg = 1 ; bp ++ ; len -- ; } result = 0 ; saw_digit = 0 ; for ( ; ; ) { if ( len == 0 ) goto trunc ; ND_TCHECK ( * bp ) ; c = * bp ; if (! ( c >= '0' && c <= '9' ) ) { <START_BUG> if (! saw_digit ) <END_BUG>  goto invalid ; <START_BUG> break ; } c -= '0' ; if ( result > ( INT_MAX // 10 ) ) { too_large = 1 ; } else { result *= 10 ; if ( result == INT_MAX && c > ( INT_MAX % 10 ) ) { too_large = 1 ; } else result += c ; } bp ++ ; len -- ; saw_digit = 1 ; } if (! saw_digit ) goto invalid ; if ( len == 0 ) goto trunc ; ND_TCHECK ( * bp ) ; <END_BUG> if ( * bp!= '\\r' )  <START_BUG> goto invalid ; <END_BUG> bp ++ ; len -- ; if ( len == 0 ) goto trunc ; ND_TCHECK ( * bp ) ;  if ( * bp!= '\\n' ) <START_BUG> <END_BUG> goto invalid ;  bp ++ ; len -- ; * endp = bp ; if ( neg ) { if ( too_large || result!= 1 ) return ( - 4 ) ; result = - 1 ; } return ( too_large? - 3 : result ) ; trunc : <START_BUG> return ( - 2 ) ; <END_BUG> invalid :  return ( - 5 ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart>! saw_digit ) { bp ++ ; <S2SV_ModStart> goto invalid ; } <S2SV_ModStart>!= '\\r' ) { bp ++ ; <S2SV_ModStart> goto invalid ; } <S2SV_ModStart>!= '\\n' ) { bp ++ ; <S2SV_ModStart> goto invalid ; } <S2SV_ModStart> ; trunc : * endp = bp ; <S2SV_ModStart> ; invalid : * endp = bp ;
Buggy code:
 static void on_response ( void * data, krb5_error_code retval, otp_response response ) { struct request_state rs = * ( struct request_state * ) data ; free ( data ) ; if ( retval == 0 && response!= otp_response_success ) retval = KRB5_PREAUTH_FAILED ; <START_BUG> rs. respond ( rs. arg, retval, NULL, NULL, NULL ) ; <END_BUG> }

Fix:
<S2SV_ModStart> = KRB5_PREAUTH_FAILED ; if ( retval == 0 ) rs. enc_tkt_reply -> flags |= TKT_FLG_PRE_AUTH ;
Buggy code:
 int ParseWave64HeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t total_samples = 0, infilesize ; Wave64ChunkHeader chunk_header ; Wave64FileHeader filehdr ; WaveHeader WaveHeader ; <START_BUG> uint32_t bcount ; <END_BUG> infilesize = DoGetFileSize ( infile ) ; memcpy ( & filehdr, fourcc, 4 ) ; if (! DoReadFile ( infile, ( ( char * ) & filehdr ) + 4, sizeof ( Wave64FileHeader ) - 4, & bcount ) || bcount!= sizeof ( Wave64FileHeader ) - 4 || memcmp ( filehdr. ckID, riff_guid, sizeof ( riff_guid ) ) || memcmp ( filehdr. formType, wave_guid, sizeof ( wave_guid ) ) ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & filehdr, sizeof ( filehdr ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackLittleEndianToNative ( & filehdr, Wave64ChunkHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && filehdr. ckSize && filehdr. ckSize + 1 && filehdr. ckSize!= infilesize ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } # endif while ( 1 ) { if (! DoReadFile ( infile, & chunk_header, sizeof ( Wave64ChunkHeader ), & bcount ) || bcount!= sizeof ( Wave64ChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_

Fix:
<S2SV_ModStart> WaveHeader WaveHeader ; int format_chunk = 0 ; <S2SV_ModStart>, format ; if ( format_chunk ++ ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.W64 <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; }
Buggy code:
 static int dex_loadcode ( RBinFile * arch, RBinDexObj * bin ) { struct r_bin_t * rbin = arch -> rbin ; int i ; int * methods = NULL ; int sym_count = 0 ; if (! bin || bin -> methods_list ) { return false ; } bin -> code_from = UT64_MAX ; bin -> code_to = 0 ; bin -> methods_list = r_list_newf ( ( RListFree ) free ) ; if (! bin -> methods_list ) { return false ; } bin -> imports_list = r_list_newf ( ( RListFree ) free ) ; if (! bin -> imports_list ) { r_list_free ( bin -> methods_list ) ; return false ; } bin -> classes_list = r_list_newf ( ( RListFree ) __r_bin_class_free ) ; if (! bin -> classes_list ) { r_list_free ( bin -> methods_list ) ; r_list_free ( bin -> imports_list ) ; return false ; } if ( bin -> header. method_size > bin -> size ) { bin -> header. method_size = 0 ; return false ; } bin -> header. method_size = R_MIN ( bin -> header. method_size, bin -> size ) ; bin -> header. class_size = R_MIN ( bin -> header. class_size, bin -> size ) ; bin -> header. strings_size = R_MIN ( bin -> header. strings_size, bin -> size ) ; if ( bin -> header. strings_size > bin -> size ) { eprintf ( "Invalid   strings   size\\n" ) ; return false ; } if ( bin -> classes ) { ut64 amount = sizeof ( int ) * bin -> header. method_size ; if ( amount > UT32_MAX || amount < bin -> header. method_size ) { return false ; } methods = calloc ( 1, amount + 1 ) ; for ( i = 0 ; i < bin -> header. class_size ; i ++ ) { char * super_name, * class_name ; struct dex_class_t * c = & bin -> classes [ i ] ; class_name = dex_class_name ( bin, c ) ; super_name =

Fix:
<S2SV_ModStart> header. types_size <S2SV_ModEnd> ) { continue
Buggy code:
 static int start_decoder ( vorb * f ) { uint8 header [ 6 ], x, y ; int len, i, j, k, max_submaps = 0 ; int longest_floorlist = 0 ; if (! start_page ( f ) ) return FALSE ; if (! ( f -> page_flag & PAGEFLAG_first_page ) ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> page_flag & PAGEFLAG_last_page ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> page_flag & PAGEFLAG_continued_packet ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> segment_count!= 1 ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> segments [ 0 ]!= 30 ) return error ( f, VORBIS_invalid_first_page ) ; if ( get8 ( f )!= VORBIS_packet_id ) return error ( f, VORBIS_invalid_first_page ) ; if (! getn ( f, header, 6 ) ) return error ( f, VORBIS_unexpected_eof ) ; if (! vorbis_validate ( header ) ) return error ( f, VORBIS_invalid_first_page ) ; if ( get32 ( f )!= 0 ) return error ( f, VORBIS_invalid_first_page ) ; f -> channels = get8 ( f ) ; if (! f -> channels ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> channels > STB_VORBIS_MAX_CHANNELS ) return error ( f, VORBIS_too_many_channels ) ; f -> sample_rate = get32 ( f ) ; if (! f -> sample_rate ) return error ( f, VORBIS_invalid_first_page ) ; get32 ( f ) ; get32 ( f ) ; get32 ( f ) ; x = get8 ( f ) ; { int log0, log1 ; log0 = x & 15 ; log1 = x >> 4 ; f -> blocksize_0 = 1 << log0 ; f -> blocksize_

Fix:
<S2SV_ModStart> + i ; unsigned int actual_size = f -> blocksize_1 // 2 ; unsigned int limit_r_begin = r -> begin < actual_size? r -> begin : actual_size ; unsigned int limit_r_end = r -> end < actual_size? r -> end : actual_size ; <S2SV_ModStart> int n_read = limit_r_end - limit_r_begin <S2SV_ModEnd> ; int part_read
Buggy code:
 unsigned int ipt_do_table ( struct sk_buff * skb, const struct nf_hook_state * state, struct xt_table * table ) { unsigned int hook = state -> hook ; static const char nulldevname [ IFNAMSIZ ] __attribute__ ( ( aligned ( sizeof ( long ) ) ) ) ; const struct iphdr * ip ; unsigned int verdict = NF_DROP ; const char * indev, * outdev ; const void * table_base ; struct ipt_entry * e, * * jumpstack ; unsigned int stackidx, cpu ; const struct xt_table_info * private ; struct xt_action_param acpar ; unsigned int addend ; stackidx = 0 ; ip = ip_hdr ( skb ) ; indev = state -> in? state -> in -> name : nulldevname ; outdev = state -> out? state -> out -> name : nulldevname ; acpar. fragoff = ntohs ( ip -> frag_off ) & IP_OFFSET ; acpar. thoff = ip_hdrlen ( skb ) ; acpar. hotdrop = false ; acpar. state = state ; WARN_ON (! ( table -> valid_hooks & ( 1 << hook ) ) ) ; local_bh_disable ( ) ; addend = xt_write_recseq_begin ( ) ; private = READ_ONCE ( table -> private ) ; cpu = smp_processor_id ( ) ; table_base = private -> entries ; jumpstack = ( struct ipt_entry * * ) private -> jumpstack [ cpu ] ; if ( static_key_false ( & xt_tee_enabled ) ) jumpstack += private -> stacksize * __this_cpu_read ( nf_skb_duplicated ) ; e = get_entry ( table_base, private -> hook_entry [ hook ] ) ; do { const struct xt_entry_target * t ; const struct xt_entry_match * ematch ; struct xt_counters * counter ; WARN_ON (! e ) ; if (! ip_packet_match ( ip, indev, outdev, & e -> ip, acpar. fragoff ) ) { no_match : e = ipt_next_entry ( e ) ; continue ; } xt_ematch_foreach ( ematch, e ) { acpar. match

Fix:
<S2SV_ModStart> IPT_F_GOTO ) ) { if ( unlikely ( stackidx >= private -> stacksize ) ) { verdict = NF_DROP ; break ; } <S2SV_ModStart> = e ; }
Buggy code:
 void fe_netjoin_deinit ( void ) { while ( joinservers!= NULL ) netjoin_server_remove ( joinservers -> data ) ; if ( join_tag!= - 1 ) { g_source_remove ( join_tag ) ; signal_remove ( "print   starting", ( SIGNAL_FUNC ) sig_print_starting ) ; } signal_remove ( "setup   changed", ( SIGNAL_FUNC ) read_settings ) ; <START_BUG> signal_remove ( "message   quit", ( SIGNAL_FUNC ) msg_quit ) ; <END_BUG> signal_remove ( "message   join", ( SIGNAL_FUNC ) msg_join ) ; signal_remove ( "message   irc   mode", ( SIGNAL_FUNC ) msg_mode ) ; }

Fix:
<S2SV_ModStart> ; signal_remove ( "server <S2SV_blank> disconnected", ( SIGNAL_FUNC ) sig_server_disconnected ) ; signal_remove (
Buggy code:
 static inline int btif_hl_close_select_thread ( void ) { int result = 0 ; char sig_on = btif_hl_signal_select_exit ; BTIF_TRACE_DEBUG ( "btif_hl_signal_select_exit" ) ; <START_BUG> result = send ( signal_fds [ 1 ], & sig_on, sizeof ( sig_on ), 0 ) ; <END_BUG> if ( btif_is_enabled ( ) ) { if ( select_thread_id!= - 1 ) { pthread_join ( select_thread_id, NULL ) ; select_thread_id = - 1 ; } } list_free ( soc_queue ) ; return result ; }

Fix:
<S2SV_ModStart> ; result = TEMP_FAILURE_RETRY ( <S2SV_ModStart> ), 0 )
Buggy code:
 int nfsd_mountpoint ( struct dentry * dentry, struct svc_export * exp ) { <START_BUG> if ( d_mountpoint ( dentry ) ) <END_BUG> return 1 ; if ( nfsd4_is_junction ( dentry ) ) return 1 ;  if (! ( exp -> ex_flags & NFSEXP_V4ROOT ) ) <START_BUG> return 0 ; <END_BUG> return d_inode ( dentry )!= NULL ;  }

Fix:
<S2SV_ModStart> { if (! d_inode <S2SV_ModEnd> ( dentry ) <S2SV_ModStart> ( dentry ) ) return 0 ; if ( exp -> ex_flags & NFSEXP_V4ROOT <S2SV_ModStart> ; if ( d_mountpoint ( dentry ) ) return 2 ; <S2SV_ModEnd> return 0 ; <S2SV_ModStart> return 0 ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static int jp2_pclr_getdata ( jp2_box_t * box, jas_stream_t * in ) { jp2_pclr_t * pclr = & box -> data. pclr ; int lutsize ; unsigned int i ; unsigned int j ; int_fast32_t x ; pclr -> lutdata = 0 ; <START_BUG> if ( jp2_getuint16 ( in, & pclr -> numlutents ) || <END_BUG> jp2_getuint8 ( in, & pclr -> numchans ) ) { return - 1 ; } lutsize = pclr -> numlutents * pclr -> numchans ; if (! ( pclr -> lutdata = jas_alloc2 ( lutsize, sizeof ( int_fast32_t ) ) ) ) { return - 1 ; } if (! ( pclr -> bpc = jas_alloc2 ( pclr -> numchans, sizeof ( uint_fast8_t ) ) ) ) { return - 1 ; } for ( i = 0 ; i < pclr -> numchans ; ++ i ) { if ( jp2_getuint8 ( in, & pclr -> bpc [ i ] ) ) { return - 1 ; } } for ( i = 0 ; i < pclr -> numlutents ; ++ i ) { for ( j = 0 ; j < pclr -> numchans ; ++ j ) { if ( jp2_getint ( in, ( pclr -> bpc [ j ] & 0x80 )!= 0, ( pclr -> bpc [ j ] & 0x7f ) + 1, & x ) ) { return - 1 ; } pclr -> lutdata [ i * pclr -> numchans + j ] = x ; } } return 0 ; }

Fix:
<S2SV_ModStart> = 0 ; pclr -> bpc = 0 ;
Buggy code:
 struct bio * bio_map_user_iov ( struct request_queue * q, const struct iov_iter * iter, gfp_t gfp_mask ) { int j ; int nr_pages = 0 ; struct page * * pages ; struct bio * bio ; int cur_page = 0 ; int ret, offset ; struct iov_iter i ; <START_BUG> struct iovec iov ; <END_BUG> iov_for_each ( iov, i, * iter ) { unsigned long uaddr = ( unsigned long ) iov. iov_base ; unsigned long len = iov. iov_len ; unsigned long end = ( uaddr + len + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; unsigned long start = uaddr >> PAGE_SHIFT ; if ( end < start ) return ERR_PTR ( - EINVAL ) ; nr_pages += end - start ; if ( uaddr & queue_dma_alignment ( q ) ) return ERR_PTR ( - EINVAL ) ; } if (! nr_pages ) return ERR_PTR ( - EINVAL ) ; bio = bio_kmalloc ( gfp_mask, nr_pages ) ; if (! bio ) return ERR_PTR ( - ENOMEM ) ; ret = - ENOMEM ; pages = kcalloc ( nr_pages, sizeof ( struct page * ), gfp_mask ) ; if (! pages ) goto out ; iov_for_each ( iov, i, * iter ) { unsigned long uaddr = ( unsigned long ) iov. iov_base ; unsigned long len = iov. iov_len ; unsigned long end = ( uaddr + len + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; unsigned long start = uaddr >> PAGE_SHIFT ; const int local_nr_pages = end - start ; const int page_limit = cur_page + local_nr_pages ; ret = get_user_pages_fast ( uaddr, local_nr_pages, ( iter -> type & WRITE )!= WRITE, & pages [ cur_page ] ) ;  if ( ret < local_nr_pages ) { <START_BUG> ret = - EFAULT ; goto out_unmap ; } offset = offset_in_page ( uaddr ) ; for ( j = cur_page ; j < page_limit ; j ++ )<END_BUG>

Fix:
<S2SV_ModStart> struct iovec iov ; struct bio_vec * bvec <S2SV_ModStart> ; if ( unlikely ( <S2SV_ModStart> < local_nr_pages ) ) { for ( j = cur_page ; j < page_limit ; j ++ ) { if (! pages [ j ] ) break ; put_page ( pages [ j ] ) ; } <S2SV_ModEnd> ret = - <S2SV_ModStart> ; out_unmap : bio_for_each_segment_all ( bvec, bio, j ) { put_page ( bvec -> bv_page <S2SV_ModEnd> ) ; }
Buggy code:
 static future_t * init ( void ) { pthread_mutex_init ( & lock, NULL ) ; config = config_new ( CONFIG_FILE_PATH ) ; if (! config ) { LOG_WARN ( LOG_TAG, "%s   unable   to   load   config   file;   attempting   to   transcode   legacy   file.", __func__ ) ; config = btif_config_transcode ( LEGACY_CONFIG_FILE_PATH ) ; if (! config ) { LOG_WARN ( LOG_TAG, "%s   unable   to   transcode   legacy   file,   starting   unconfigured.", __func__ ) ; config = config_new_empty ( ) ; if (! config ) { LOG_ERROR ( LOG_TAG, "%s   unable   to   allocate   a   config   object.", __func__ ) ; goto error ; } } if ( config_save ( config, CONFIG_FILE_PATH ) ) unlink ( LEGACY_CONFIG_FILE_PATH ) ; } <START_BUG> alarm_timer = alarm_new ( ) ; <END_BUG> if (! alarm_timer ) { LOG_ERROR ( LOG_TAG, "%s   unable   to   create   alarm.", __func__ ) ; goto error ; } return future_new_immediate ( FUTURE_SUCCESS ) ; error : ; alarm_free ( alarm_timer ) ; config_free ( config ) ; pthread_mutex_destroy ( & lock ) ; alarm_timer = NULL ; config = NULL ; return future_new_immediate ( FUTURE_FAIL ) ; }

Fix:
<S2SV_ModStart> ) ; } btif_config_devcache_cleanup ( ) ;
Buggy code:
 static void renameTableFunc ( sqlite3_context * context, int NotUsed, sqlite3_value * * argv ) { sqlite3 * db = sqlite3_context_db_handle ( context ) ; const char * zDb = ( const char * ) sqlite3_value_text ( argv [ 0 ] ) ; const char * zInput = ( const char * ) sqlite3_value_text ( argv [ 3 ] ) ; const char * zOld = ( const char * ) sqlite3_value_text ( argv [ 4 ] ) ; const char * zNew = ( const char * ) sqlite3_value_text ( argv [ 5 ] ) ; int bTemp = sqlite3_value_int ( argv [ 6 ] ) ; UNUSED_PARAMETER ( NotUsed ) ; if ( zInput && zOld && zNew ) { Parse sParse ; int rc ; int bQuote = 1 ; RenameCtx sCtx ; Walker sWalker ; # ifndef SQLITE_OMIT_AUTHORIZATION sqlite3_xauth xAuth = db -> xAuth ; db -> xAuth = 0 ; # endif sqlite3BtreeEnterAll ( db ) ; memset ( & sCtx, 0, sizeof ( RenameCtx ) ) ; sCtx. pTab = sqlite3FindTable ( db, zOld, zDb ) ; memset ( & sWalker, 0, sizeof ( Walker ) ) ; sWalker. pParse = & sParse ; sWalker. xExprCallback = renameTableExprCb ; sWalker. xSelectCallback = renameTableSelectCb ; sWalker. u. pRename = & sCtx ; rc = renameParseSql ( & sParse, zDb, 1, db, zInput, bTemp ) ; if ( rc == SQLITE_OK ) { int isLegacy = ( db -> flags & SQLITE_LegacyAlter ) ; if ( sParse. pNewTable ) { Table * pTab = sParse. pNewTable ; if ( pTab -> pSelect ) { if ( isLegacy == 0 ) { <START_BUG> NameContext sNC ; <END_BUG> memset ( & sNC, 0, sizeof ( sNC ) ) ;  sNC. pParse = & sParse ; <START_BUG> sqlite3SelectPrep ( & sParse, pTab -> pSelect, & sNC ) ; if ( sParse. nErr ) rc = sParse. rc ; sqlite3WalkSelect<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { Select * pSelect = pTab -> pSelect ; <S2SV_ModStart> = & sParse ; assert ( pSelect -> selFlags & SF_View ) ; pSelect -> selFlags &= ~ SF_View
Buggy code:
 SQLITE_PRIVATE VList * sqlite3VListAdd ( sqlite3 * db, VList * pIn, const char * zName, int nName, int iVal ) { int nInt ; char * z ; int i ; nInt = nName // 4 + 3 ; assert ( pIn == 0 || pIn [ 0 ] >= 3 ) ; if ( pIn == 0 || pIn [ 1 ] + nInt > pIn [ 0 ] ) { <START_BUG> int nAlloc = ( pIn? pIn [ 0 ] * 2 : 10 ) + nInt ; <END_BUG> VList * pOut = sqlite3DbRealloc ( db, pIn, nAlloc * sizeof ( int ) ) ; if ( pOut == 0 ) return pIn ; if ( pIn == 0 ) pOut [ 1 ] = 2 ; pIn = pOut ; pIn [ 0 ] = nAlloc ; } i = pIn [ 1 ] ; pIn [ i ] = iVal ; pIn [ i + 1 ] = nInt ; z = ( char * ) & pIn [ i + 2 ] ; pIn [ 1 ] = i + nInt ; assert ( pIn [ 1 ] <= pIn [ 0 ] ) ; memcpy ( z, zName, nName ) ; z [ nName ] = 0 ; return pIn ; }

Fix:
<S2SV_ModStart> ] ) { sqlite3_int64 <S2SV_ModEnd> nAlloc = ( <S2SV_ModStart> ( pIn? 2 * ( sqlite3_int64 ) pIn [ 0 ] <S2SV_ModEnd> : 10 )
Buggy code:
 static int check_entry_size_and_hooks ( struct ipt_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct ipt_entry )!= 0 || ( unsigned char * ) e + sizeof ( struct ipt_entry ) >= limit || ( unsigned char * ) e + e -> next_offset > limit ) { duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct ipt_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } err = check_entry ( e ) ; if ( err ) return err ; for ( h = 0 ; h < NF_INET_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { <START_BUG> pr_err ( "Underflows   must   be   unconditional   and   " <END_BUG> "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> ) ) { pr_debug <S2SV_ModEnd> ( "Underflows <S2SV_blank> must <S2SV_blank> be <S2SV_blank> unconditional <S2SV_blank> and <S2SV_blank> " "use <S2SV_blank> the <S2SV_blank> STANDARD <S2SV_blank> target <S2SV_blank> with <S2SV_blank> "