nus-yam/ex-repair huggingface dataset:
Buggy code:
 static double get_prediction_decay_rate ( VP8_COMP * cpi, FIRSTPASS_STATS * next_frame ) { double prediction_decay_rate ; double motion_decay ; <START_BUG> double motion_pct = next_frame -> pcnt_motion ; <END_BUG> prediction_decay_rate = next_frame -> pcnt_inter ; motion_decay = ( 1.0 - ( motion_pct // 20.0 ) ) ; if ( motion_decay < prediction_decay_rate ) prediction_decay_rate = motion_decay ; { double this_mv_rabs ; double this_mv_cabs ; double distance_factor ; this_mv_rabs = fabs ( next_frame -> mvr_abs * motion_pct ) ; this_mv_cabs = fabs ( next_frame -> mvc_abs * motion_pct ) ; distance_factor = sqrt ( ( this_mv_rabs * this_mv_rabs ) + ( this_mv_cabs * this_mv_cabs ) ) // 250.0 ; distance_factor = ( ( distance_factor > 1.0 )? 0.0 : ( 1.0 - distance_factor ) ) ; if ( distance_factor < prediction_decay_rate ) prediction_decay_rate = distance_factor ; } return prediction_decay_rate ; }

Fix:
<S2SV_ModStart> next_frame -> pcnt_motion ; ( void ) cpi
Buggy code:
 void vpx_scale_frame ( YV12_BUFFER_CONFIG * src, YV12_BUFFER_CONFIG * dst, unsigned char * temp_area, unsigned char temp_height, unsigned int hscale, unsigned int hratio, unsigned int vscale, unsigned int vratio, unsigned int interlaced ) { int i ; int dw = ( hscale - 1 + src -> y_width * hratio ) // hscale ; int dh = ( vscale - 1 + src -> y_height * vratio ) // vscale ; Scale2D ( ( unsigned char * ) src -> y_buffer, src -> y_stride, src -> y_width, src -> y_height, ( unsigned char * ) dst -> y_buffer, dst -> y_stride, dw, dh, temp_area, temp_height, hscale, hratio, vscale, vratio, interlaced ) ; if ( dw < ( int ) dst -> y_width ) for ( i = 0 ; i < dh ; i ++ ) <START_BUG> vpx_memset ( dst -> y_buffer + i * dst -> y_stride + dw - 1, dst -> y_buffer [ i * dst -> y_stride + dw - 2 ], dst -> y_width - dw + 1 ) ; <END_BUG> if ( dh < ( int ) dst -> y_height ) for ( i = dh - 1 ; i < ( int ) dst -> y_height ; i ++ )  vpx_memcpy ( dst -> y_buffer + i * dst -> y_stride, dst -> y_buffer + ( dh - 2 ) * dst -> y_stride, dst -> y_width + 1 ) ; <START_BUG> Scale2D ( ( unsigned char * ) src -> u_buffer, src -> uv_stride, src -> uv_width, src -> uv_height, ( unsigned char * ) dst -> u_buffer, dst -> uv_stride, dw // 2, dh // 2, temp_area, temp_height, hscale, hratio, vscale, vratio, interlaced ) ; if ( dw // 2 < ( int ) dst -> uv_width ) for ( i = 0 ; i < dst -> uv_height ; i ++ ) <END_BUG> vpx_memset ( dst -> u_buffer + i * dst -> uv_stride + dw // 2 - 1,

Fix:
<S2SV_ModStart> i ++ ) memset <S2SV_ModEnd> ( dst -> <S2SV_ModStart> i ++ ) memcpy <S2SV_ModEnd> ( dst -> <S2SV_ModStart> i ++ ) memset <S2SV_ModEnd> ( dst -> <S2SV_ModStart> i ++ ) memcpy <S2SV_ModEnd> ( dst -> <S2SV_ModStart> i ++ ) memset <S2SV_ModEnd> ( dst -> <S2SV_ModStart> i ++ ) memcpy <S2SV_ModEnd> ( dst ->
Buggy code:
 static int kvm_ioctl_create_device ( struct kvm * kvm, struct kvm_create_device * cd ) { struct kvm_device_ops * ops = NULL ; struct kvm_device * dev ; bool test = cd -> flags & KVM_CREATE_DEVICE_TEST ; int ret ; if ( cd -> type >= ARRAY_SIZE ( kvm_device_ops_table ) ) return - ENODEV ; ops = kvm_device_ops_table [ cd -> type ] ; if ( ops == NULL ) return - ENODEV ; if ( test ) return 0 ; dev = kzalloc ( sizeof ( * dev ), GFP_KERNEL ) ; if (! dev ) return - ENOMEM ; dev -> ops = ops ; dev -> kvm = kvm ; mutex_lock ( & kvm -> lock ) ; ret = ops -> create ( dev, cd -> type ) ; if ( ret < 0 ) { mutex_unlock ( & kvm -> lock ) ; kfree ( dev ) ; return ret ; } list_add ( & dev -> vm_node, & kvm -> devices ) ; mutex_unlock ( & kvm -> lock ) ; if ( ops -> init ) ops -> init ( dev ) ; <START_BUG> ret = anon_inode_getfd ( ops -> name, & kvm_device_fops, dev, O_RDWR | O_CLOEXEC ) ; <END_BUG> if ( ret < 0 ) {  mutex_lock ( & kvm -> lock ) ; <START_BUG> list_del ( & dev -> vm_node ) ; mutex_unlock ( & kvm -> lock ) ; ops -> destroy ( dev ) ; return ret ; } <END_BUG> kvm_get_kvm ( kvm ) ;  cd -> fd = ret ; return 0 ; }

Fix:
<S2SV_ModStart> dev ) ; kvm_get_kvm ( kvm ) ; <S2SV_ModStart> 0 ) { kvm_put_kvm ( kvm ) ; <S2SV_ModStart> ret ; } <S2SV_ModEnd> cd -> fd
Buggy code:
 static int64_t encode_inter_mb_segment ( VP9_COMP * cpi, MACROBLOCK * x, int64_t best_yrd, int i, int * labelyrate, int64_t * distortion, int64_t * sse, ENTROPY_CONTEXT * ta, ENTROPY_CONTEXT * tl, int mi_row, int mi_col ) { int k ; MACROBLOCKD * xd = & x -> e_mbd ; struct macroblockd_plane * const pd = & xd -> plane [ 0 ] ; struct macroblock_plane * const p = & x -> plane [ 0 ] ; MODE_INFO * const mi = xd -> mi [ 0 ] ; const BLOCK_SIZE plane_bsize = get_plane_block_size ( mi -> mbmi. sb_type, pd ) ; const int width = 4 * num_4x4_blocks_wide_lookup [ plane_bsize ] ; const int height = 4 * num_4x4_blocks_high_lookup [ plane_bsize ] ; int idx, idy ; <START_BUG> const uint8_t * const src = & p -> src. buf [ raster_block_offset ( BLOCK_8X8, i, <END_BUG> p -> src. stride ) ] ;  uint8_t * const dst = & pd -> dst. buf [ raster_block_offset ( BLOCK_8X8, i, <START_BUG> pd -> dst. stride ) ] ; int64_t thisdistortion = 0, thissse = 0 ; int thisrate = 0, ref ; const scan_order * so = & vp9_default_scan_orders [ TX_4X4 ] ; const int is_compound = has_second_ref ( & mi -> mbmi ) ; <END_BUG> const InterpKernel * kernel = vp9_get_interp_kernel ( mi -> mbmi. interp_filter ) ;  for ( ref = 0 ; ref < 1 + is_compound ; ++ ref ) { <START_BUG> const uint8_t * pre = & pd -> pre [ ref ]. buf [ raster_block_offset ( BLOCK_8X8, i, <END_BUG> pd -> pre [ ref ]. stride ) ] ;  vp9_build_inter_predictor ( pre, pd -> pre [ ref ]. stride, <START_BUG> dst, pd -> dst. stride,<END_BUG>

Fix:
<S2SV_ModStart>. buf [ vp9_raster_block_offset <S2SV_ModEnd> ( BLOCK_8X8, <S2SV_ModStart>. buf [ vp9_raster_block_offset <S2SV_ModEnd> ( BLOCK_8X8, <S2SV_ModStart> * kernel = vp9_filter_kernels [ <S2SV_ModEnd> mi -> mbmi <S2SV_ModStart> mbmi. interp_filter ] <S2SV_ModEnd> ; for ( <S2SV_ModStart>. buf [ vp9_raster_block_offset <S2SV_ModEnd> ( BLOCK_8X8, <S2SV_ModStart> ) ] ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { vp9_highbd_build_inter_predictor <S2SV_ModEnd> ( pre, <S2SV_ModStart>, height, ref, <S2SV_ModEnd> kernel, MV_PRECISION_Q3 <S2SV_ModStart> // 2 ), xd -> bd <S2SV_ModStart> ) ; } else { vp9_build_inter_predictor ( pre, pd -> pre [ ref ]. stride, dst, pd -> dst. stride, & mi -> bmi [ i ]. as_mv [ ref ]. as_mv, & xd -> block_refs [ ref ] -> sf, width, height, ref, kernel, MV_PRECISION_Q3, mi_col * MI_
Buggy code:
 void xsltGenerateIdFunction ( xmlXPathParserContextPtr ctxt, int nargs ) { <START_BUG> xmlNodePtr cur = NULL ; <END_BUG> long val ; xmlChar str [ 30 ] ; xmlDocPtr doc ; if ( nargs == 0 ) { cur = ctxt -> context -> node ; } else if ( nargs == 1 ) {  xmlXPathObjectPtr obj ; <START_BUG> xmlNodeSetPtr nodelist ; int i, ret ; if ( ( ctxt -> value == NULL ) || ( ctxt -> value -> type!= XPATH_NODESET ) ) { ctxt -> error = XPATH_INVALID_TYPE ; xsltTransformError ( xsltXPathGetTransformContext ( ctxt ), NULL, NULL, "generate-id()   :   invalid   arg   expecting   a   node-set\\n" ) ; return ; } obj = valuePop ( ctxt ) ; nodelist = obj -> nodesetval ; if ( ( nodelist == NULL ) || ( nodelist -> nodeNr <= 0 ) ) { xmlXPathFreeObject ( obj ) ; valuePush ( ctxt, xmlXPathNewCString ( "" ) ) ; return ; } cur = nodelist -> nodeTab [ 0 ] ; for ( i = 1 ; i < nodelist -> nodeNr ; i ++ ) { ret = xmlXPathCmpNodes ( cur, nodelist -> nodeTab [ i ] ) ; if ( ret == - 1 ) cur = nodelist -> nodeTab [ i ] ; } <END_BUG> xmlXPathFreeObject ( obj ) ;  } else { xsltTransformError ( xsltXPathGetTransformContext ( ctxt ), NULL, NULL, "generate-id()   :   invalid   number   of   args   %d\\n", nargs ) ; ctxt -> error = XPATH_INVALID_ARITY ; return ; } if ( cur -> type!= XML_NAMESPACE_DECL ) doc = cur -> doc ; else { xmlNsPtr ns = ( xmlNsPtr ) cur ; if ( ns -> context!= NULL ) doc = ns -> context ; else doc = ctxt -> context -> doc ; } <START_BUG> val = ( long ) ( ( char * ) cur - ( char * ) doc ) ; <END_BUG> if ( val >= 0 ) { sprintf ( ( char * ) str, "idp%ld", val ) ; } else { sprintf ( ( char * ) str, "idm%ld", - val ) ; } valuePush ( ctxt, xmlXPathNewString ( str ) ) ; }

Fix:
<S2SV_ModStart> { xmlNodePtr cur = NULL ; xmlXPathObjectPtr obj <S2SV_ModStart> 1 ) { <S2SV_ModEnd> xmlNodeSetPtr nodelist ; <S2SV_ModStart> ] ; } <S2SV_ModEnd> } else { <S2SV_ModStart> doc ; } if ( obj ) xmlXPathFreeObject ( obj ) ;
Buggy code:
 static inline int xfrm_replay_verify_len ( struct xfrm_replay_state_esn * replay_esn, struct nlattr * rp ) { struct xfrm_replay_state_esn * up ; int ulen ; if (! replay_esn ||! rp ) return 0 ; up = nla_data ( rp ) ; ulen = xfrm_replay_state_esn_len ( up ) ; if ( nla_len ( rp ) < ulen || xfrm_replay_state_esn_len ( replay_esn )!= ulen ) return - EINVAL ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> - EINVAL ; if ( up -> replay_window > up -> bmp_len * sizeof ( __u32 ) * 8 ) return - EINVAL ;
Buggy code:
 static double calc_correction_factor ( double err_per_mb, double err_divisor, double pt_low, double pt_high, <START_BUG> int q ) { <END_BUG> const double error_term = err_per_mb // err_divisor ;  const double power_term = MIN ( vp9_convert_qindex_to_q ( q ) * 0.0125 + pt_low, <START_BUG> pt_high ) ; if ( power_term < 1.0 ) assert ( error_term >= 0.0 ) ; return fclamp ( pow ( error_term, power_term ), 0.05, 5.0 ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, int q, vpx_bit_depth_t bit_depth <S2SV_ModStart> vp9_convert_qindex_to_q ( q, bit_depth ) * 0.01 <S2SV_ModEnd> + pt_low,
Buggy code:
 static int ext4_ext_convert_to_initialized ( handle_t * handle, struct inode * inode, struct ext4_map_blocks * map, struct ext4_ext_path * path ) { <START_BUG> struct ext4_extent * ex, newex, orig_ex ; <END_BUG>  struct ext4_extent * ex1 = NULL ; <START_BUG> struct ext4_extent * ex2 = NULL ; struct ext4_extent * ex3 = NULL ; struct ext4_extent_header * eh ; ext4_lblk_t ee_block, eof_block ; unsigned int allocated, ee_len, depth ; <END_BUG> ext4_fsblk_t newblock ;  int err = 0 ; <START_BUG> int ret = 0 ; <END_BUG> int may_zeroout ; ext_debug ( "ext4_ext_convert_to_initialized:   inode   %lu,   logical" "block   %llu,   max_blocks   %u\\n", inode -> i_ino, ( unsigned long long ) map -> m_lblk, map -> m_len ) ; eof_block = ( inode -> i_size + inode -> i_sb -> s_blocksize - 1 ) >> inode -> i_sb -> s_blocksize_bits ; if ( eof_block < map -> m_lblk + map -> m_len ) eof_block = map -> m_lblk + map -> m_len ; depth = ext_depth ( inode ) ;  eh = path [ depth ]. p_hdr ; <START_BUG> ex = path [ depth ]. p_ext ; ee_block = le32_to_cpu ( ex -> ee_block ) ; ee_len = ext4_ext_get_actual_len ( ex ) ; allocated = ee_len - ( map -> m_lblk - ee_block ) ; <END_BUG> newblock = map -> m_lblk - ee_block + ext4_ext_pblock ( ex ) ;  ex2 = ex ; orig_ex. ee_block = ex -> ee_block ; orig_ex. ee_len = cpu_to_le16 ( ee_len ) ; ext4_ext_store_pblock ( & orig_ex, ext4_ext_pblock ( ex ) ) ; <START_BUG> may_zeroout = ee_block + ee_len <= eof_block ;<END_BUG>

Fix:
<S2SV_ModStart> ) { struct ext4_map_blocks split_map ; struct ext4_extent zero_ex <S2SV_ModEnd> ; struct ext4_extent <S2SV_ModStart> struct ext4_extent * ex <S2SV_ModEnd> ; ext4_lblk_t ee_block <S2SV_ModStart>, depth ; <S2SV_ModEnd> int err = <S2SV_ModStart> 0 ; int split_flag = 0 <S2SV_ModEnd> ; ext_debug ( <S2SV_ModStart> inode ) ; ex <S2SV_ModEnd> = path [ <S2SV_ModStart> depth ]. <S2SV_ModEnd> p_ext ; ee_block <S2SV_ModStart> ee_block ) ; WARN_ON ( map -> m_lblk < ee_block ) ; split_flag |= <S2SV_ModEnd> ee_block + ee_len <S2SV_ModStart> ee_len <= eof_block? EXT4_EXT_MAY_ZEROOUT : 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> * EXT4_EXT_ZERO_LEN && ( EXT4_EXT_MAY_ZEROOUT & split_flag ) <S2SV_ModEnd> ) { err <S2SV_ModStart> ( inode, ex <S2SV_ModEnd> ) ; if <S2SV_ModStart> err ) goto out ; err = ext4_ext_get_access ( handle, inode, path + depth ) ; if ( err ) goto out ; ext4_ext_mark_initialized ( ex ) ; ext4_ext_try_to_merge ( inode, path, ex
Buggy code:
 int vp9_is_skippable_in_plane ( MACROBLOCK * x, BLOCK_SIZE bsize, int plane ) { int result = 1 ; <START_BUG> struct is_skippable_args args = { x, & result } ; <END_BUG> vp9_foreach_transformed_block_in_plane ( & x -> e_mbd, bsize, plane, is_skippable, & args ) ; return result ; }

Fix:
<S2SV_ModStart> = { x -> plane [ plane ]. eobs
Buggy code:
 void sctp_assoc_update ( struct sctp_association * asoc, struct sctp_association * new ) { struct sctp_transport * trans ; struct list_head * pos, * temp ; asoc -> c = new -> c ; asoc -> peer. rwnd = new -> peer. rwnd ; asoc -> peer. sack_needed = new -> peer. sack_needed ; asoc -> peer. auth_capable = new -> peer. auth_capable ; asoc -> peer. i = new -> peer. i ; sctp_tsnmap_init ( & asoc -> peer. tsn_map, SCTP_TSN_MAP_INITIAL, asoc -> peer. i. initial_tsn, GFP_ATOMIC ) ; list_for_each_safe ( pos, temp, & asoc -> peer. transport_addr_list ) { trans = list_entry ( pos, struct sctp_transport, transports ) ; if (! sctp_assoc_lookup_paddr ( new, & trans -> ipaddr ) ) { sctp_assoc_rm_peer ( asoc, trans ) ; continue ; } if ( asoc -> state >= SCTP_STATE_ESTABLISHED ) sctp_transport_reset ( trans ) ; } if ( asoc -> state >= SCTP_STATE_ESTABLISHED ) { asoc -> next_tsn = new -> next_tsn ; asoc -> ctsn_ack_point = new -> ctsn_ack_point ; asoc -> adv_peer_ack_point = new -> adv_peer_ack_point ; sctp_ssnmap_clear ( asoc -> ssnmap ) ; sctp_ulpq_flush ( & asoc -> ulpq ) ; asoc -> overall_error_count = 0 ; } else { list_for_each_entry ( trans, & new -> peer. transport_addr_list, transports ) { if (! sctp_assoc_lookup_paddr ( asoc, & trans -> ipaddr ) ) sctp_assoc_add_peer ( asoc, & trans -> ipaddr, GFP_ATOMIC, trans -> state ) ; } asoc -> ctsn_ack_point = asoc -> next_tsn - 1 ; asoc ->

Fix:
<S2SV_ModStart> = NULL ; <S2SV_ModEnd> sctp_auth_asoc_init_active_key ( asoc
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { unsigned x, y ; AVFilterContext * ctx = inlink -> dst ; VignetteContext * s = ctx -> priv ; AVFilterLink * outlink = inlink -> dst -> outputs [ 0 ] ; AVFrame * out ; out = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; if ( s -> eval_mode == EVAL_MODE_FRAME ) update_context ( s, inlink, in ) ; if ( s -> desc -> flags & AV_PIX_FMT_FLAG_RGB ) { uint8_t * dst = out -> data [ 0 ] ; const uint8_t * src = in -> data [ 0 ] ; const float * fmap = s -> fmap ; const int dst_linesize = out -> linesize [ 0 ] ; const int src_linesize = in -> linesize [ 0 ] ; const int fmap_linesize = s -> fmap_linesize ; for ( y = 0 ; y < inlink -> h ; y ++ ) { uint8_t * dstp = dst ; const uint8_t * srcp = src ; for ( x = 0 ; x < inlink -> w ; x ++, dstp += 3, srcp += 3 ) { const float f = fmap [ x ] ; dstp [ 0 ] = av_clip_uint8 ( srcp [ 0 ] * f + get_dither_value ( s ) ) ; dstp [ 1 ] = av_clip_uint8 ( srcp [ 1 ] * f + get_dither_value ( s ) ) ; dstp [ 2 ] = av_clip_uint8 ( srcp [ 2 ] * f + get_dither_value ( s ) ) ; } dst += dst_linesize ; src += src_linesize ; fmap += fmap_linesize ; } } else { int plane ; <START_BUG> for ( plane = 0 ; plane < 4 && in -> data [ plane ] ; plane ++ ) { <END_BUG> uint8_t * dst = out -> data [ plane ] ; const uint8

Fix:
<S2SV_ModStart> in -> data [ plane ] && in -> linesize
Buggy code:
 static enum gro_result dev_gro_receive ( struct napi_struct * napi, struct sk_buff * skb ) { struct sk_buff * * pp = NULL ; struct packet_offload * ptype ; __be16 type = skb -> protocol ; struct list_head * head = & offload_base ; int same_flow ; enum gro_result ret ; int grow ; if (! ( skb -> dev -> features & NETIF_F_GRO ) ) goto normal ; if ( skb_is_gso ( skb ) || skb_has_frag_list ( skb ) || skb -> csum_bad ) goto normal ; gro_list_prepare ( napi, skb ) ; rcu_read_lock ( ) ; list_for_each_entry_rcu ( ptype, head, list ) { if ( ptype -> type!= type ||! ptype -> callbacks. gro_receive ) continue ; skb_set_network_header ( skb, skb_gro_offset ( skb ) ) ; skb_reset_mac_len ( skb ) ; NAPI_GRO_CB ( skb ) -> same_flow = 0 ; NAPI_GRO_CB ( skb ) -> flush = 0 ; NAPI_GRO_CB ( skb ) -> free = 0 ; <START_BUG> NAPI_GRO_CB ( skb ) -> udp_mark = 0 ; <END_BUG> NAPI_GRO_CB ( skb ) -> gro_remcsum_start = 0 ; switch ( skb -> ip_summed ) { case CHECKSUM_COMPLETE : NAPI_GRO_CB ( skb ) -> csum = skb -> csum ; NAPI_GRO_CB ( skb ) -> csum_valid = 1 ; NAPI_GRO_CB ( skb ) -> csum_cnt = 0 ; break ; case CHECKSUM_UNNECESSARY : NAPI_GRO_CB ( skb ) -> csum_cnt = skb -> csum_level + 1 ; NAPI_GRO_CB ( skb ) -> csum_valid = 0 ; break ; default : NAPI_GRO_CB ( skb ) -> csum_cnt = 0 ; NAPI_GRO_CB ( skb ) ->

Fix:
<S2SV_ModStart> skb ) -> encap_mark <S2SV_ModEnd> = 0 ;
Buggy code:
 error_t coapClientSetTxBlockSize ( CoapClientRequest * request, uint_t blockSize ) { if ( request == NULL ) return ERROR_INVALID_PARAMETER ; osAcquireMutex ( & request -> context -> mutex ) ; if ( blockSize == 16 ) <START_BUG> request -> txBlockSzx = COAP_BLOCK_SIZE_16 ; <END_BUG>  else if ( blockSize == 32 ) <START_BUG> <END_BUG> request -> txBlockSzx = COAP_BLOCK_SIZE_32 ;  <START_BUG> else if ( blockSize == 64 ) <END_BUG>  request -> txBlockSzx = COAP_BLOCK_SIZE_64 ; <START_BUG> <END_BUG> else if ( blockSize == 128 )  <START_BUG> request -> txBlockSzx = COAP_BLOCK_SIZE_128 ; <END_BUG>  else if ( blockSize == 256 ) <START_BUG> <END_BUG> request -> txBlockSzx = COAP_BLOCK_SIZE_256 ;  <START_BUG> else if ( blockSize == 512 ) <END_BUG>  request -> txBlockSzx = COAP_BLOCK_SIZE_512 ; <START_BUG> <END_BUG> else  <START_BUG> request -> txBlockSzx = COAP_BLOCK_SIZE_1024 ; <END_BUG> if ( request -> txBlockSzx > coapClientGetMaxBlockSize ( ) )  request -> txBlockSzx = coapClientGetMaxBlockSize ( ) ; <START_BUG> osReleaseMutex ( & request -> context -> mutex ) ; return NO_ERROR ; }<END_BUG>

Fix:
<S2SV_ModStart> == 16 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_16 ; } <S2SV_ModStart> == 32 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_32 ; } <S2SV_ModStart> == 64 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_64 ; } <S2SV_ModStart> == 128 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_128 ; } <S2SV_ModStart> == 256 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_256 ; } <S2SV_ModStart> == 512 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_512 ; } else { <S2SV_ModEnd> request -> txBlockSzx <S2SV_ModStart> = COAP_BLOCK_SIZE_1024 ; } <S2SV_ModStart> ( ) ) { <S2SV_ModStart> ( ) ; }
Buggy code:
 static int devzvol_readdir ( struct vnode * dvp, struct uio * uiop, struct cred * cred, int * eofp, caller_context_t * ct_unused, int flags_unused ) { struct sdev_node * sdvp = VTOSDEV ( dvp ) ; char * ptr ; sdcmn_err13 ( ( "zv   readdir   of   \'%s\'   %s\'", sdvp -> sdev_path, sdvp -> sdev_name ) ) ; if ( strcmp ( sdvp -> sdev_path, ZVOL_DIR ) == 0 ) { struct vnode * vp ; rw_exit ( & sdvp -> sdev_contents ) ; ( void ) devname_lookup_func ( sdvp, "dsk", & vp, cred, devzvol_create_dir, SDEV_VATTR ) ; VN_RELE ( vp ) ; ( void ) devname_lookup_func ( sdvp, "rdsk", & vp, cred, devzvol_create_dir, SDEV_VATTR ) ; VN_RELE ( vp ) ; rw_enter ( & sdvp -> sdev_contents, RW_READER ) ; return ( devname_readdir_func ( dvp, uiop, cred, eofp, 0 ) ) ; } if ( uiop -> uio_offset == 0 ) devzvol_prunedir ( sdvp ) ; ptr = sdvp -> sdev_path + strlen ( ZVOL_DIR ) ; if ( ( strcmp ( ptr, "//dsk" ) == 0 ) || ( strcmp ( ptr, "//rdsk" ) == 0 ) ) { rw_exit ( & sdvp -> sdev_contents ) ; devzvol_create_pool_dirs ( dvp ) ; rw_enter ( & sdvp -> sdev_contents, RW_READER ) ; return ( devname_readdir_func ( dvp, uiop, cred, eofp, 0 ) ) ; } <START_BUG> ptr = strchr ( ptr + 1, '//' ) + 1 ; <END_BUG> rw_exit ( & sdvp -> sdev_contents ) ; sdev_iter_datasets ( dvp, ZFS_IOC_DATASET_LIST_NEXT, ptr ) ; rw_enter ( & sdvp ->

Fix:
<S2SV_ModStart>, '//' ) ; if ( ptr == NULL ) return ( ENOENT ) ; ptr ++ <S2SV_ModEnd> ; rw_exit (
Buggy code:
 static void tcp_cwnd_reduction ( struct sock * sk, const int prior_unsacked, int fast_rexmit, int flag ) { struct tcp_sock * tp = tcp_sk ( sk ) ; int sndcnt = 0 ; int delta = tp -> snd_ssthresh - tcp_packets_in_flight ( tp ) ; int newly_acked_sacked = prior_unsacked - ( tp -> packets_out - tp -> sacked_out ) ; <START_BUG> tp -> prr_delivered += newly_acked_sacked ; <END_BUG> if ( delta < 0 ) { u64 dividend = ( u64 ) tp -> snd_ssthresh * tp -> prr_delivered + tp -> prior_cwnd - 1 ; sndcnt = div_u64 ( dividend, tp -> prior_cwnd ) - tp -> prr_out ; } else if ( ( flag & FLAG_RETRANS_DATA_ACKED ) &&! ( flag & FLAG_LOST_RETRANS ) ) { sndcnt = min_t ( int, delta, max_t ( int, tp -> prr_delivered - tp -> prr_out, newly_acked_sacked ) + 1 ) ; } else { sndcnt = min ( delta, newly_acked_sacked ) ; } sndcnt = max ( sndcnt, ( fast_rexmit? 1 : 0 ) ) ; tp -> snd_cwnd = tcp_packets_in_flight ( tp ) + sndcnt ; }

Fix:
<S2SV_ModStart> sacked_out ) ; if ( newly_acked_sacked <= 0 || WARN_ON_ONCE (! tp -> prior_cwnd ) ) return ;
Buggy code:
 <START_BUG> static void nfs_set_open_stateid_locked ( struct nfs4_state * state, nfs4_stateid * stateid, int open_flags ) <END_BUG> { if ( test_bit ( NFS_DELEGATED_STATE, & state -> flags ) == 0 ) memcpy ( state -> stateid. data, stateid -> data, sizeof ( state -> stateid. data ) ) ; memcpy ( state -> open_stateid. data, stateid -> data, sizeof ( state -> open_stateid. data ) ) ;  switch ( open_flags ) { <START_BUG> case FMODE_READ : set_bit ( NFS_O_RDONLY_STATE, & state -> flags ) ; break ; case FMODE_WRITE : set_bit ( NFS_O_WRONLY_STATE, & state -> flags ) ; break ; case FMODE_READ | FMODE_WRITE : set_bit ( NFS_O_RDWR_STATE, & state -> flags ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> * stateid, fmode_t fmode <S2SV_ModEnd> ) { if <S2SV_ModStart> ; switch ( fmode <S2SV_ModEnd> ) { case
Buggy code:
 void rfbSendServerCutText ( rfbScreenInfoPtr rfbScreen, char * str, int len ) { rfbClientPtr cl ; rfbServerCutTextMsg sct ; rfbClientIteratorPtr iterator ; <START_BUG> iterator = rfbGetClientIterator ( rfbScreen ) ; <END_BUG> while ( ( cl = rfbClientIteratorNext ( iterator ) )!= NULL ) { sct. type = rfbServerCutText ; sct. length = Swap32IfLE ( len ) ; LOCK ( cl -> sendMutex ) ; if ( rfbWriteExact ( cl, ( char * ) & sct, sz_rfbServerCutTextMsg ) < 0 ) { rfbLogPerror ( "rfbSendServerCutText:   write" ) ; rfbCloseClient ( cl ) ; UNLOCK ( cl -> sendMutex ) ; continue ; } if ( rfbWriteExact ( cl, str, len ) < 0 ) { rfbLogPerror ( "rfbSendServerCutText:   write" ) ; rfbCloseClient ( cl ) ; } UNLOCK ( cl -> sendMutex ) ; rfbStatRecordMessageSent ( cl, rfbServerCutText, sz_rfbServerCutTextMsg + len, sz_rfbServerCutTextMsg + len ) ; } rfbReleaseClientIterator ( iterator ) ; }

Fix:
<S2SV_ModStart> rfbClientIteratorPtr iterator ; memset ( ( char * ) & sct, 0, sizeof ( sct ) ) ;
Buggy code:
 static void scsi_free_request ( SCSIRequest * req ) { SCSIDiskReq * r = DO_UPCAST ( SCSIDiskReq, req, req ) ; <START_BUG> qemu_vfree ( r -> iov. iov_base ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> req ) ; if ( r -> iov. iov_base ) { <S2SV_ModStart> ) ; } }
Buggy code:
 static int cg_open ( const char * path, struct fuse_file_info * fi ) { const char * cgroup ; char * fpath = NULL, * path1, * path2, * cgdir = NULL, * controller ; struct cgfs_files * k = NULL ; struct file_info * file_info ; struct fuse_context * fc = fuse_get_context ( ) ; int ret ; if (! fc ) return - EIO ; controller = pick_controller_from_path ( fc, path ) ; if (! controller ) return - EIO ; cgroup = find_cgroup_in_path ( path ) ; if (! cgroup ) return - EINVAL ; get_cgdir_and_path ( cgroup, & cgdir, & fpath ) ; if (! fpath ) { path1 = "//" ; path2 = cgdir ; } else { path1 = cgdir ; path2 = fpath ; } k = cgfs_get_key ( controller, path1, path2 ) ; if (! k ) { ret = - EINVAL ; goto out ; } free_key ( k ) ; <START_BUG> if (! fc_may_access ( fc, controller, path1, path2, fi -> flags ) ) { <END_BUG> ret = - EACCES ; goto out ; } file_info = malloc ( sizeof ( * file_info ) ) ; if (! file_info ) { ret = - ENOMEM ; goto out ; } file_info -> controller = must_copy_string ( controller ) ; file_info -> cgroup = must_copy_string ( path1 ) ; file_info -> file = must_copy_string ( path2 ) ; file_info -> type = LXC_TYPE_CGFILE ; file_info -> buf = NULL ; file_info -> buflen = 0 ; fi -> fh = ( unsigned long ) file_info ; ret = 0 ; out : free ( cgdir ) ; return ret ; }

Fix:
<S2SV_ModStart> if (! caller_may_see_dir ( fc -> pid, controller, path1 ) ) { ret = - ENOENT ; goto out ; } if (!
Buggy code:
 gboolean flatpak_run_add_environment_args ( FlatpakBwrap * bwrap, const char * app_info_path, FlatpakRunFlags flags, const char * app_id, FlatpakContext * context, GFile * app_id_dir, GPtrArray * previous_app_id_dirs, FlatpakExports * * exports_out, GCancellable * cancellable, GError * * error ) { g_autoptr ( GError ) my_error = NULL ; g_autoptr ( FlatpakExports ) exports = NULL ; g_autoptr ( FlatpakBwrap ) proxy_arg_bwrap = flatpak_bwrap_new ( flatpak_bwrap_empty_env ) ; gboolean has_wayland = FALSE ; gboolean allow_x11 = FALSE ; if ( ( context -> shares & FLATPAK_CONTEXT_SHARED_IPC ) == 0 ) { g_debug ( "Disallowing   ipc   access" ) ; flatpak_bwrap_add_args ( bwrap, "--unshare-ipc", NULL ) ; } if ( ( context -> shares & FLATPAK_CONTEXT_SHARED_NETWORK ) == 0 ) { g_debug ( "Disallowing   network   access" ) ; flatpak_bwrap_add_args ( bwrap, "--unshare-net", NULL ) ; } if ( context -> devices & FLATPAK_CONTEXT_DEVICE_ALL ) { flatpak_bwrap_add_args ( bwrap, "--dev-bind", "//dev", "//dev", NULL ) ; if ( g_file_test ( "//dev//shm", G_FILE_TEST_IS_DIR ) ) { if ( ( context -> devices & FLATPAK_CONTEXT_DEVICE_SHM ) == 0 ) flatpak_bwrap_add_args ( bwrap, "--tmpfs", "//dev//shm", NULL ) ; } else if ( g_file_test ( "//dev//shm", G_FILE_TEST_IS_SYMLINK ) ) { g_autofree char * link = flatpak_readlink ( "//dev//shm", NULL ) ; if ( g_str

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd>! flatpak_run_in_transient_unit (
Buggy code:
 void impeg2d_next_code ( dec_state_t * ps_dec, UWORD32 u4_start_code_val ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; impeg2d_bit_stream_flush_to_byte_boundary ( ps_stream ) ; <START_BUG> while ( ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN )!= u4_start_code_val ) <END_BUG>  && ( ps_dec -> s_bit_stream. u4_offset <= ps_dec -> s_bit_stream. u4_max_offset ) ) <START_BUG> { if ( impeg2d_bit_stream_get ( ps_stream, 8 )!= 0 ) { } } return ; }<END_BUG>

Fix:
<S2SV_ModStart>!= u4_start_code_val ) && <S2SV_ModEnd> ( ps_dec -> <S2SV_ModStart> s_bit_stream. u4_offset < <S2SV_ModEnd> ps_dec -> s_bit_stream
Buggy code:
 void * <START_BUG> checked_xmalloc ( size_t size ) <END_BUG> {  alloc_limit_assert ( "checked_xmalloc", size ) ; <START_BUG> <END_BUG> return xmalloc ( size ) ;  }

Fix:
<S2SV_ModStart> checked_xmalloc ( size_t num, size_t <S2SV_ModStart> size ) { size_t res ; if ( check_mul_overflow ( num, size, & res ) ) abort ( ) ; <S2SV_ModStart> ( "checked_xmalloc", res <S2SV_ModEnd> ) ; return <S2SV_ModStart> return xmalloc ( num,
Buggy code:
 void color_cmyk_to_rgb ( opj_image_t * image ) { float C, M, Y, K ; float sC, sM, sY, sK ; unsigned int w, h, max, i ; w = image -> comps [ 0 ]. w ; h = image -> comps [ 0 ]. h ; <START_BUG> if ( image -> numcomps < 4 ) return ; <END_BUG> max = w * h ; sC = 1.0F // ( float ) ( ( 1 << image -> comps [ 0 ]. prec ) - 1 ) ; sM = 1.0F // ( float ) ( ( 1 << image -> comps [ 1 ]. prec ) - 1 ) ; sY = 1.0F // ( float ) ( ( 1 << image -> comps [ 2 ]. prec ) - 1 ) ; sK = 1.0F // ( float ) ( ( 1 << image -> comps [ 3 ]. prec ) - 1 ) ; for ( i = 0 ; i < max ; ++ i ) { C = ( float ) ( image -> comps [ 0 ]. data [ i ] ) * sC ; M = ( float ) ( image -> comps [ 1 ]. data [ i ] ) * sM ; Y = ( float ) ( image -> comps [ 2 ]. data [ i ] ) * sY ; K = ( float ) ( image -> comps [ 3 ]. data [ i ] ) * sK ; C = 1.0F - C ; M = 1.0F - M ; Y = 1.0F - Y ; K = 1.0F - K ; image -> comps [ 0 ]. data [ i ] = ( int ) ( 255.0F * C * K ) ; image -> comps [ 1 ]. data [ i ] = ( int ) ( 255.0F * M * K ) ; image -> comps [ 2 ]. data [ i ] = ( int ) ( 255.0F * Y * K ) ; } free ( image -> comps [ 3 ]. data ) ; image -> comps [ 3 ]. data = NULL ; image -> comps [ 0 ]. prec = 8 ; image -> comps [ 1 ]. prec = 8 ; image -> comps [ 2 ]. prec = 8 ; image -> numcomps -= 1 ; image -> color_space = OPJ_CLRSPC_SRGB ; for ( i

Fix:
<S2SV_ModStart> ; if ( ( <S2SV_ModStart> < 4 ) || ( image -> comps [ 0 ]. dx!= image -> comps [ 1 ]. dx ) || ( image -> comps [ 0 ]. dx!= image -> comps [ 2 ]. dx ) || ( image -> comps [ 0 ]. dx!= image -> comps [ 3 ]. dx ) || ( image -> comps [ 0 ]. dy!= image -> comps [ 1 ]. dy ) || ( image -> comps [ 0 ]. dy!= image -> comps [ 2 ]. dy ) || ( image -> comps [ 0 ]. dy!= image -> comps [ 3 ]. dy ) ) { fprintf ( stderr, "%s:%d:color_cmyk_to_rgb\\n\\tCAN <S2SV_blank> NOT <S2SV_blank> CONVERT\\n", __FILE__, __LINE__ ) ; return ; } <S2SV_ModEnd> max = w
Buggy code:
 LIBXSMM_API_INTERN void libxsmm_sparse_csr_reader ( libxsmm_generated_code * io_generated_code, const char * i_csr_file_in, unsigned int * * o_row_idx, unsigned int * * o_column_idx, double * * o_values, unsigned int * o_row_count, unsigned int * o_column_count, unsigned int * o_element_count ) { FILE * l_csr_file_handle ; const unsigned int l_line_length = 512 ; char l_line [ 512 + 1 ] ; unsigned int l_header_read = 0 ; unsigned int * l_row_idx_id = NULL ; unsigned int l_i = 0 ; l_csr_file_handle = fopen ( i_csr_file_in, "r" ) ; if ( l_csr_file_handle == NULL ) { LIBXSMM_HANDLE_ERROR ( io_generated_code, LIBXSMM_ERR_CSR_INPUT ) ; return ; } while ( fgets ( l_line, l_line_length, l_csr_file_handle )!= NULL ) { if ( strlen ( l_line ) == l_line_length ) { free ( * o_row_idx ) ; free ( * o_column_idx ) ; free ( * o_values ) ; free ( l_row_idx_id ) ; * o_row_idx = 0 ; * o_column_idx = 0 ; * o_values = 0 ; fclose ( l_csr_file_handle ) ; LIBXSMM_HANDLE_ERROR ( io_generated_code, LIBXSMM_ERR_CSR_READ_LEN ) ; return ; } if ( l_line [ 0 ] == '%' ) { continue ; } else { if ( l_header_read == 0 ) { <START_BUG> if ( sscanf ( l_line, "%u   %u   %u", o_row_count, o_column_count, o_element_count ) == 3 ) { <END_BUG> * o_column_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_element_count ) ) ; * o_row_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * (

Fix:
<S2SV_ModStart> { if ( 3 == <S2SV_ModStart>, o_element_count ) && 0!= * o_row_count && 0!= * o_column_count && 0!= * o_element_count ) <S2SV_ModEnd> { * o_column_idx <S2SV_ModStart> return ; } LIBXSMM_ASSERT ( 0!= l_row && 0!= l_column ) ;
Buggy code:
 <START_BUG> int Downmix_Reset ( downmix_object_t * pDownmixer, bool init ) { <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> downmix_object_t * pDownmixer __unused <S2SV_ModStart>, bool init __unused
Buggy code:
 static const u_char * ikev2_ke_print ( netdissect_options * ndo, u_char tpay, const struct isakmp_gen * ext, u_int item_len _U_, const u_char * ep _U_, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { struct ikev2_ke ke ; const struct ikev2_ke * k ; k = ( const struct ikev2_ke * ) ext ; <START_BUG> ND_TCHECK ( * ext ) ; <END_BUG> UNALIGNED_MEMCPY ( & ke, ext, sizeof ( ke ) ) ; ikev2_pay_print ( ndo, NPSTR ( tpay ), ke. h. critical ) ; ND_PRINT ( ( ndo, "   len=%u   group=%s", ntohs ( ke. h. len ) - 8, STR_OR_ID ( ntohs ( ke. ke_group ), dh_p_map ) ) ) ; if ( 2 < ndo -> ndo_vflag && 8 < ntohs ( ke. h. len ) ) { ND_PRINT ( ( ndo, "   " ) ) ; if (! rawprint ( ndo, ( const uint8_t * ) ( k + 1 ), ntohs ( ke. h. len ) - 8 ) ) goto trunc ; } return ( const u_char * ) ext + ntohs ( ke. h. len ) ; trunc : ND_PRINT ( ( ndo, "   [|%s]", NPSTR ( tpay ) ) ) ; return NULL ; }

Fix:
<S2SV_ModStart> ND_TCHECK ( * k <S2SV_ModEnd> ) ; UNALIGNED_MEMCPY
Buggy code:
 static stmt_ty ast_for_async_stmt ( struct compiling * c, const node * n ) { REQ ( n, async_stmt ) ; <START_BUG> REQ ( CHILD ( n, 0 ), ASYNC ) ; <END_BUG> switch ( TYPE ( CHILD ( n, 1 ) ) ) { case funcdef :  return ast_for_funcdef_impl ( c, CHILD ( n, 1 ), NULL, <START_BUG> <END_BUG> 1 ) ;  case with_stmt : <START_BUG> return ast_for_with_stmt ( c, CHILD ( n, 1 ), <END_BUG> 1 ) ; case for_stmt :  return ast_for_for_stmt ( c, CHILD ( n, 1 ), <START_BUG> 1 ) ; default : PyErr_Format ( PyExc_SystemError, "invalid   async   stament:   %s", STR ( CHILD ( n, 1 ) ) ) ; return NULL ; } }<END_BUG>

Fix:
<S2SV_ModStart> 0 ), NAME ) ; assert ( strcmp ( STR ( CHILD ( n, 0 ) ), "async" ) == 0 <S2SV_ModEnd> ) ; switch <S2SV_ModStart> ( c, n <S2SV_ModEnd>, NULL, <S2SV_ModStart>, NULL, true <S2SV_ModEnd> ) ; case <S2SV_ModStart> ( c, n, true <S2SV_ModEnd> ) ; case <S2SV_ModStart> ( c, n, true <S2SV_ModEnd> ) ; default
Buggy code:
 int hci_req_sync ( struct hci_dev * hdev, int ( * req ) ( struct hci_request * req, unsigned long opt ), unsigned long opt, u32 timeout, u8 * hci_status ) { int ret ; <START_BUG> if (! test_bit ( HCI_UP, & hdev -> flags ) ) <END_BUG>  return - ENETDOWN ; <START_BUG> hci_req_sync_lock ( hdev ) ; ret = __hci_req_sync ( hdev, req, opt, timeout, hci_status ) ; <END_BUG> hci_req_sync_unlock ( hdev ) ;  return ret ; }

Fix:
<S2SV_ModStart> int ret ; hci_req_sync_lock ( hdev ) ; if ( <S2SV_ModEnd> test_bit ( HCI_UP <S2SV_ModStart> flags ) ) <S2SV_ModEnd> ret = __hci_req_sync <S2SV_ModStart> hci_status ) ; else ret = - ENETDOWN ;
Buggy code:
 int imap_open_connection ( struct ImapAccountData * adata ) { if ( mutt_socket_open ( adata -> conn ) < 0 ) return - 1 ; adata -> state = IMAP_CONNECTED ; if ( imap_cmd_step ( adata )!= IMAP_RES_OK ) { imap_close_connection ( adata ) ; return - 1 ; } if ( mutt_str_startswith ( adata -> buf, "*   OK", CASE_IGNORE ) ) { if (! mutt_str_startswith ( adata -> buf, "*   OK   [CAPABILITY", CASE_IGNORE ) && check_capabilities ( adata ) ) { goto bail ; } # ifdef USE_SSL if (! adata -> conn -> ssf && ( C_SslForceTls || ( adata -> capabilities & IMAP_CAP_STARTTLS ) ) ) { enum QuadOption ans ; if ( C_SslForceTls ) ans = MUTT_YES ; else if ( ( ans = query_quadoption ( C_SslStarttls, _ ( "Secure   connection   with   TLS?" ) ) ) == MUTT_ABORT ) { goto err_close_conn ; } if ( ans == MUTT_YES ) { <START_BUG> enum ImapExecResult rc = imap_exec ( adata, "STARTTLS", IMAP_CMD_NO_FLAGS ) ; <END_BUG> if ( rc == IMAP_EXEC_FATAL ) goto bail ; if ( rc!= IMAP_EXEC_ERROR ) { if ( mutt_ssl_starttls ( adata -> conn ) ) { mutt_error ( _ ( "Could   not   negotiate   TLS   connection" ) ) ; goto err_close_conn ; } else { if ( imap_exec ( adata, "CAPABILITY", IMAP_CMD_NO_FLAGS ) ) goto bail ; } } } } if ( C_SslForceTls &&! adata -> conn -> ssf ) { mutt_error ( _ ( "Encrypted   connection   unavailable" ) ) ; goto err_close_conn ; } # endif } else if ( mutt_str_startswith ( adata -> buf, "*   PREAUTH", CASE_IGNORE ) ) { # ifdef USE_SSL if ( adata -> conn -> ssf == 0 ) { bool proceed = true ; if ( C_SslForceTls ) { proceed

Fix:
<S2SV_ModStart>, "STARTTLS", IMAP_CMD_SINGLE ) ; mutt_socket_empty ( adata -> conn <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> static void print_bpf_insn ( struct bpf_insn * insn ) <END_BUG> { u8 class = BPF_CLASS ( insn -> code ) ; if ( class == BPF_ALU || class == BPF_ALU64 ) { if ( BPF_SRC ( insn -> code ) == BPF_X ) verbose ( "(%02x)   %sr%d   %s   %sr%d\\n", insn -> code, class == BPF_ALU? "(u32)   " : "", insn -> dst_reg, bpf_alu_string [ BPF_OP ( insn -> code ) >> 4 ], class == BPF_ALU? "(u32)   " : "", insn -> src_reg ) ; else verbose ( "(%02x)   %sr%d   %s   %s%d\\n", insn -> code, class == BPF_ALU? "(u32)   " : "", insn -> dst_reg, bpf_alu_string [ BPF_OP ( insn -> code ) >> 4 ], class == BPF_ALU? "(u32)   " : "", insn -> imm ) ; } else if ( class == BPF_STX ) { if ( BPF_MODE ( insn -> code ) == BPF_MEM ) verbose ( "(%02x)   *(%s   *)(r%d   %+d)   =   r%d\\n", insn -> code, bpf_ldst_string [ BPF_SIZE ( insn -> code ) >> 3 ], insn -> dst_reg, insn -> off, insn -> src_reg ) ; else if ( BPF_MODE ( insn -> code ) == BPF_XADD ) verbose ( "(%02x)   lock   *(%s   *)(r%d   %+d)   +=   r%d\\n", insn -> code, bpf_ldst_string [ BPF_SIZE ( insn -> code ) >> 3 ], insn -> dst_reg, insn -> off, insn -> src_reg ) ; else verbose ( "BUG_%02x\\n", insn -> code ) ; } else if ( class == BPF_ST ) { if ( BPF_MODE ( insn -> code )!= BPF

Fix:
<S2SV_ModStart> void print_bpf_insn ( const struct bpf_verifier_env * env, const <S2SV_ModStart> ) == BPF_IMM && BPF_SIZE ( insn -> code ) == BPF_DW ) { u64 imm = ( ( u64 ) ( insn + 1 ) -> imm << 32 ) | ( u32 ) insn -> imm ; bool map_ptr = insn -> src_reg == BPF_PSEUDO_MAP_FD ; if ( map_ptr &&! env -> allow_ptr_leaks ) imm = 0 ; verbose ( "(%02x) <S2SV_blank> r%d <S2SV_blank> = <S2SV_blank> 0x%llx\\n", insn -> code, <S2SV_ModEnd> insn -> dst_reg <S2SV_ModStart> -> dst_reg, ( unsigned long long ) <S2SV_ModEnd> imm ) ;
Buggy code:
 rpmVerifyAttrs rpmfilesVerify ( rpmfiles fi, int ix, rpmVerifyAttrs omitMask ) { rpm_mode_t fmode = rpmfilesFMode ( fi, ix ) ; rpmfileAttrs fileAttrs = rpmfilesFFlags ( fi, ix ) ; rpmVerifyAttrs flags = rpmfilesVFlags ( fi, ix ) ; const char * fn = rpmfilesFN ( fi, ix ) ; struct stat sb ; rpmVerifyAttrs vfy = RPMVERIFY_NONE ; switch ( rpmfilesFState ( fi, ix ) ) { case RPMFILE_STATE_NETSHARED : case RPMFILE_STATE_NOTINSTALLED : goto exit ; break ; case RPMFILE_STATE_REPLACED : flags = RPMVERIFY_LSTATFAIL ; break ; case RPMFILE_STATE_WRONGCOLOR : flags &= ~ ( RPMVERIFY_FILEDIGEST | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | RPMVERIFY_RDEV ) ; break ; case RPMFILE_STATE_NORMAL : case RPMFILE_STATE_MISSING : break ; } if ( fn == NULL || lstat ( fn, & sb )!= 0 ) { vfy |= RPMVERIFY_LSTATFAIL ; goto exit ; } <START_BUG> if ( S_ISDIR ( fmode ) && S_ISLNK ( sb. st_mode ) && stat ( fn, & sb )!= 0 ) { <END_BUG> vfy |= RPMVERIFY_LSTATFAIL ; goto exit ; } if ( S_ISLNK ( sb. st_mode ) ) flags &= ~ ( RPMVERIFY_MODE ) ; else flags &= ~ ( RPMVERIFY_LINKTO ) ; if (! S_ISREG ( sb. st_mode ) ) flags &= ~ ( RPMVERIFY_FILEDIGEST | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | RPMVERIFY_CAPS ) ; if ( fileAttrs & RPMFILE_GHOST ) flags &= ~ ( RPMVERIFY_FILEDIGEST | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | RPMVERIFY_LINKTO ) ; flags &= ~ ( omitMask | RPMVERIFY_FAILURES ) ; if ( flags & RPMVERIFY_FILEDIGEST ) { const unsigned char * digest ; int algo ; size_t diglen ; if ( ( digest = rpmfilesFDigest (

Fix:
<S2SV_ModStart>. st_mode ) ) { struct stat dsb ; if ( stat ( fn, & dsb ) == 0 && S_ISDIR ( dsb. st_mode ) ) { uid_t fuid ; if ( sb. st_uid == 0 || ( rpmugUid ( rpmfilesFUser ( fi, ix ), & fuid ) == 0 && sb. st_uid == fuid ) ) { sb = dsb ; } } <S2SV_ModEnd> } if (
Buggy code:
 void log_flush ( LOG_MODE new_mode ) { CRYPTO_THREAD_write_lock ( stunnel_locks [ LOCK_LOG_MODE ] ) ; <START_BUG> if ( log_mode!= LOG_MODE_CONFIGURED || new_mode!= LOG_MODE_ERROR ) <END_BUG> log_mode = new_mode ; if ( new_mode!= LOG_MODE_BUFFER ) { CRYPTO_THREAD_write_lock ( stunnel_locks [ LOCK_LOG_BUFFER ] ) ; while ( head ) { struct LIST * tmp = head ; head = head -> next ; log_raw ( tmp -> opt, tmp -> level, tmp -> stamp, tmp -> id, tmp -> text ) ; str_free ( tmp ) ; } head = tail = NULL ; CRYPTO_THREAD_unlock ( stunnel_locks [ LOCK_LOG_BUFFER ] ) ; } CRYPTO_THREAD_unlock ( stunnel_locks [ LOCK_LOG_MODE ] ) ; }

Fix:
<S2SV_ModStart> ] ) ; <S2SV_ModEnd> log_mode = new_mode
Buggy code:
 int ff_mpeg4_decode_picture_header ( Mpeg4DecContext * ctx, GetBitContext * gb ) { MpegEncContext * s = & ctx -> m ; unsigned startcode, v ; int ret ; int vol = 0 ; align_get_bits ( gb ) ; if (! s -> studio_profile && s -> avctx -> bits_per_raw_sample!= 8 ) s -> avctx -> bits_per_raw_sample = 0 ; if ( s -> codec_tag == AV_RL32 ( "WV1F" ) && show_bits ( gb, 24 ) == 0x575630 ) { skip_bits ( gb, 24 ) ; if ( get_bits ( gb, 8 ) == 0xF0 ) goto end ; } startcode = 0xff ; for ( ; ; ) { if ( get_bits_count ( gb ) >= gb -> size_in_bits ) { if ( gb -> size_in_bits == 8 && ( ctx -> divx_version >= 0 || ctx -> xvid_build >= 0 ) || s -> codec_tag == AV_RL32 ( "QMP4" ) ) { av_log ( s -> avctx, AV_LOG_VERBOSE, "frame   skip   %d\\n", gb -> size_in_bits ) ; return FRAME_SKIPPED ; } else return AVERROR_INVALIDDATA ; } v = get_bits ( gb, 8 ) ; startcode = ( ( startcode << 8 ) | v ) & 0xffffffff ; if ( ( startcode & 0xFFFFFF00 )!= 0x100 ) continue ; if ( s -> avctx -> debug & FF_DEBUG_STARTCODE ) { av_log ( s -> avctx, AV_LOG_DEBUG, "startcode:   %3X   ", startcode ) ; if ( startcode <= 0x11F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Video   Object   Start" ) ; else if ( startcode <= 0x12F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Video   Object   Layer   Start" ) ; else if ( startcode <= 0x13F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Reserved" ) ; else if ( startcode <=

Fix:
<S2SV_ModStart> VOS_STARTCODE ) { int profile, level ; <S2SV_ModStart> s, gb, & profile, & level ) ; if ( <S2SV_ModEnd> profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO <S2SV_ModStart> FF_PROFILE_MPEG4_SIMPLE_STUDIO && ( <S2SV_ModEnd> level > 0 <S2SV_ModStart> > 0 && <S2SV_ModEnd> level < 9 <S2SV_ModStart> ) ; } else if ( s -> studio_profile ) { avpriv_request_sample ( s -> avctx, "Mixes <S2SV_blank> studio <S2SV_blank> and <S2SV_blank> non <S2SV_blank> studio <S2SV_blank> profile\\n" ) ; return AVERROR_PATCHWELCOME ; } s -> avctx -> profile = profile ; s -> avctx -> level = level ; <S2SV_ModStart> studio_profile ) { av_assert0 ( s -> avctx -> profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO ) ;
Buggy code:
 static stmt_ty <START_BUG> ast_for_for_stmt ( struct compiling * c, const node * n, int is_async ) <END_BUG>  { <START_BUG> asdl_seq * _target, * seq = NULL, * suite_seq ; expr_ty expression ; expr_ty target, first ; const node * node_target ; int has_type_comment ; string type_comment ; if ( is_async && c -> c_feature_version < 5 ) { ast_error ( c, n, "Async   for   loops   are   only   supported   in   Python   3.5   and   greater" ) ; return NULL ; } REQ ( n, for_stmt ) ; has_type_comment = TYPE ( CHILD ( n, 5 ) ) == TYPE_COMMENT ; if ( NCH ( n ) == 9 + has_type_comment ) { seq = ast_for_suite ( c, CHILD ( n, 8 + has_type_comment ) ) ; if (! seq ) return NULL ; } node_target = CHILD ( n, 1 ) ; _target = ast_for_exprlist ( c, node_target, Store ) ; if (! _target ) return NULL ; first = ( expr_ty ) asdl_seq_GET ( _target, 0 ) ; if ( NCH ( node_target ) == 1 ) target = first ; else target = Tuple ( _target, Store, first -> lineno, first -> col_offset, c -> c_arena ) ; expression = ast_for_testlist ( c, CHILD ( n, 3 ) ) ; if (! expression ) return NULL ; suite_seq = ast_for_suite ( c, CHILD ( n, 5 + has_type_comment ) ) ; if (! suite_seq ) return NULL ; if ( has_type_comment ) type_comment = NEW_TYPE_COMMENT ( CHILD ( n, 5 ) ) ; else type_comment = NULL ; if ( is_async ) return AsyncFor ( target, expression, suite_seq, seq, <END_BUG> type_comment, LINENO ( n ), n -> n_col_offset,  c -> c_arena ) ; else return For ( target, expression, suite_seq, seq, type_comment, LINENO ( n ), n -> n_col

Fix:
<S2SV_ModStart> const node * n0, bool <S2SV_ModEnd> is_async ) { <S2SV_ModStart> is_async ) { const node * const n = is_async? CHILD ( n0, 1 ) : n0 ; <S2SV_ModStart>, LINENO ( n0 ), n0 <S2SV_ModEnd> -> n_col_offset,
Buggy code:
 static int create_qp_common ( struct mlx5_ib_dev * dev, struct ib_pd * pd, struct ib_qp_init_attr * init_attr, struct ib_udata * udata, struct mlx5_ib_qp * qp ) { struct mlx5_ib_resources * devr = & dev -> devr ; int inlen = MLX5_ST_SZ_BYTES ( create_qp_in ) ; struct mlx5_core_dev * mdev = dev -> mdev ; <START_BUG> struct mlx5_ib_create_qp_resp resp ; <END_BUG> struct mlx5_ib_cq * send_cq ; struct mlx5_ib_cq * recv_cq ; unsigned long flags ; u32 uidx = MLX5_IB_DEFAULT_UIDX ; struct mlx5_ib_create_qp ucmd ; struct mlx5_ib_qp_base * base ; int mlx5_st ; void * qpc ; u32 * in ; int err ; mutex_init ( & qp -> mutex ) ; spin_lock_init ( & qp -> sq. lock ) ; spin_lock_init ( & qp -> rq. lock ) ; mlx5_st = to_mlx5_st ( init_attr -> qp_type ) ; if ( mlx5_st < 0 ) return - EINVAL ; if ( init_attr -> rwq_ind_tbl ) { if (! udata ) return - ENOSYS ; err = create_rss_raw_qp_tir ( dev, qp, pd, init_attr, udata ) ; return err ; } if ( init_attr -> create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK ) { if (! MLX5_CAP_GEN ( mdev, block_lb_mc ) ) { mlx5_ib_dbg ( dev, "block   multicast   loopback   isn\'t   supported\\n" ) ; return - EINVAL ; } else { qp -> flags |= MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK ; } } if ( init_attr -> create_flags & ( IB_QP_CREATE_CROSS_CHANNEL | IB_QP_CREATE_MAN

Fix:
<S2SV_ModStart> struct mlx5_ib_create_qp_resp resp = { }
Buggy code:
 static void ikev2_parent_inI2outR2_continue ( struct pluto_crypto_req_cont * pcrc, struct pluto_crypto_req * r, err_t ugh ) { struct dh_continuation * dh = ( struct dh_continuation * ) pcrc ; struct msg_digest * md = dh -> md ; struct state * const st = md -> st ; stf_status e ; DBG ( DBG_CONTROLMORE, DBG_log ( "ikev2   parent   inI2outR2:   calculating   g^{xy},   sending   R2" ) ) ; if ( st == NULL ) { loglog ( RC_LOG_SERIOUS, "%s:   Request   was   disconnected   from   state", __FUNCTION__ ) ; if ( dh -> md ) release_md ( dh -> md ) ; return ; } passert ( ugh == NULL ) ; passert ( cur_state == NULL ) ; passert ( st!= NULL ) ; passert ( st -> st_suspended_md == dh -> md ) ; set_suspended ( st, NULL ) ; set_cur_state ( st ) ; st -> st_calculating = FALSE ; e = ikev2_parent_inI2outR2_tail ( pcrc, r ) ; if ( e > STF_FAIL ) { int v2_notify_num = e - STF_FAIL ; DBG_log ( "ikev2_parent_inI2outR2_tail   returned   STF_FAIL   with   %s", enum_name ( & ikev2_notify_names, v2_notify_num ) ) ; } else if ( e!= STF_OK ) { DBG_log ( "ikev2_parent_inI2outR2_tail   returned   %s", enum_name ( & stfstatus_name, e ) ) ; } if ( dh -> md!= NULL ) { complete_v2_state_transition ( & dh -> md, e ) ; if ( dh -> md ) release_md ( dh -> md ) ; } reset_globals ( ) ; <START_BUG> passert ( GLOBALS_ARE_RESET ( ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 void vp9_end_first_pass ( VP9_COMP * cpi ) { <START_BUG> if ( cpi -> use_svc && cpi -> svc. number_temporal_layers == 1 ) { <END_BUG> int i ; for ( i = 0 ; i < cpi -> svc. number_spatial_layers ; ++ i ) { output_stats ( & cpi -> svc. layer_context [ i ]. twopass. total_stats, cpi -> output_pkt_list ) ; } } else { output_stats ( & cpi -> twopass. total_stats, cpi -> output_pkt_list ) ; } }

Fix:
<S2SV_ModStart> { if ( is_two_pass_svc ( cpi ) <S2SV_ModEnd> ) { int
Buggy code:
 static krb5_error_code recvauth_common ( krb5_context context, krb5_auth_context * auth_context, krb5_pointer fd, char * appl_version, krb5_principal server, krb5_int32 flags, krb5_keytab keytab, krb5_ticket * * ticket, krb5_data * version ) { krb5_auth_context new_auth_context ; krb5_flags ap_option = 0 ; krb5_error_code retval, problem ; krb5_data inbuf ; krb5_data outbuf ; krb5_rcache rcache = 0 ; krb5_octet response ; krb5_data null_server ; <START_BUG> int need_error_free = 0 ; <END_BUG> int local_rcache = 0, local_authcon = 0 ; problem = 0 ; response = 0 ; if (! ( flags & KRB5_RECVAUTH_SKIP_VERSION ) ) { if ( ( retval = krb5_read_message ( context, fd, & inbuf ) ) ) return ( retval ) ;  if ( strcmp ( inbuf. data, sendauth_version ) ) { <START_BUG> problem = KRB5_SENDAUTH_BADAUTHVERS ; response = 1 ; } free ( inbuf. data ) ; } if ( flags & KRB5_RECVAUTH_BADAUTHVERS ) { problem = KRB5_SENDAUTH_BADAUTHVERS ; response = 1 ; } if ( ( retval = krb5_read_message ( context, fd, & inbuf ) ) ) return ( retval ) ; <END_BUG> if ( appl_version && strcmp ( inbuf. data, appl_version ) ) {  if (! problem ) { problem = KRB5_SENDAUTH_BADAPPLVERS ; response = 2 ; } } if ( version &&! problem ) * version = inbuf ; else free ( inbuf. data ) ; if ( ( krb5_net_write ( context, * ( ( int * ) fd ), ( char * ) & response, 1 ) ) < 0 ) { return ( problem ) ; } if ( problem ) return ( problem ) ; if ( ( retval = krb5_read_message ( context, fd, & inbuf ) ) ) return retval ; if ( * auth_

Fix:
<S2SV_ModStart> krb5_data null_server ; krb5_data d ; <S2SV_ModStart> retval ) ; d = make_data ( ( char * ) sendauth_version, strlen ( sendauth_version ) + 1 ) ; if (! data_eq ( inbuf, d <S2SV_ModEnd> ) ) { <S2SV_ModStart> if ( appl_version!= NULL &&! problem ) { d = make_data ( appl_version, strlen ( appl_version ) + 1 ) ; if (! data_eq ( inbuf, d ) <S2SV_ModEnd> ) { problem
Buggy code:
 void color_sycc_to_rgb ( opj_image_t * img ) { if ( img -> numcomps < 3 ) { img -> color_space = OPJ_CLRSPC_GRAY ; return ; } if ( ( img -> comps [ 0 ]. dx == 1 ) && ( img -> comps [ 1 ]. dx == 2 ) && ( img -> comps [ 2 ]. dx == 2 ) && ( img -> comps [ 0 ]. dy == 1 ) && ( img -> comps [ 1 ]. dy == 2 ) && ( img -> comps [ 2 ]. dy == 2 ) ) { sycc420_to_rgb ( img ) ; } else if ( ( img -> comps [ 0 ]. dx == 1 ) && ( img -> comps [ 1 ]. dx == 2 ) && ( img -> comps [ 2 ]. dx == 2 ) && ( img -> comps [ 0 ]. dy == 1 ) && ( img -> comps [ 1 ]. dy == 1 ) && ( img -> comps [ 2 ]. dy == 1 ) ) { sycc422_to_rgb ( img ) ; } else if ( ( img -> comps [ 0 ]. dx == 1 ) && ( img -> comps [ 1 ]. dx == 1 ) && ( img -> comps [ 2 ]. dx == 1 ) && ( img -> comps [ 0 ]. dy == 1 ) && ( img -> comps [ 1 ]. dy == 1 ) && ( img -> comps [ 2 ]. dy == 1 ) ) { sycc444_to_rgb ( img ) ; } else { fprintf ( stderr, "%s:%d:color_sycc_to_rgb\\n\\tCAN   NOT   CONVERT\\n", __FILE__, __LINE__ ) ; return ; } <START_BUG> img -> color_space = OPJ_CLRSPC_SRGB ; <END_BUG> }

Fix:
<S2SV_ModStart> return ; } <S2SV_ModEnd> } <S2SV_null> <S2SV_null>