nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int hci_uart_set_proto ( struct hci_uart * hu, int id ) { const struct hci_uart_proto * p ; int err ; p = hci_uart_get_proto ( id ) ; if (! p ) return - EPROTONOSUPPORT ; hu -> proto = p ; <START_BUG> set_bit ( HCI_UART_PROTO_READY, & hu -> flags ) ; <END_BUG> err = hci_uart_register_dev ( hu ) ; if ( err ) {  clear_bit ( HCI_UART_PROTO_READY, & hu -> flags ) ; <START_BUG> <END_BUG> return err ;  } return 0 ; }

Fix:
<S2SV_ModStart> = p ; <S2SV_ModEnd> err = hci_uart_register_dev <S2SV_ModStart> err ) { return err ; } set_bit <S2SV_ModEnd> ( HCI_UART_PROTO_READY, <S2SV_ModStart> ) ; return <S2SV_ModEnd> 0 ; }
Buggy code:
 u_int ieee802_15_4_if_print ( netdissect_options * ndo, const struct pcap_pkthdr * h, const u_char * p ) { u_int caplen = h -> caplen ; u_int hdrlen ; uint16_t fc ; uint8_t seq ; uint16_t panid = 0 ; if ( caplen < 3 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return caplen ; } hdrlen = 3 ; fc = EXTRACT_LE_16BITS ( p ) ; seq = EXTRACT_LE_8BITS ( p + 2 ) ; p += 3 ; caplen -= 3 ; ND_PRINT ( ( ndo, "IEEE   802.15.4   %s   packet   ", ftypes [ FC_FRAME_TYPE ( fc ) ] ) ) ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "seq   %02x   ", seq ) ) ; switch ( FC_DEST_ADDRESSING_MODE ( fc ) ) { case FC_ADDRESSING_MODE_NONE : if ( fc & FC_PAN_ID_COMPRESSION ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen ; } if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "none   " ) ) ; break ; case FC_ADDRESSING_MODE_RESERVED : if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "reserved   destination   addressing   mode" ) ) ; return hdrlen ; case FC_ADDRESSING_MODE_SHORT : if ( caplen < 2 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen ; } panid = EXTRACT_LE_16BITS ( p ) ; p += 2 ; caplen -= 2 ; hdrlen += 2 ; if ( caplen < 2 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen ; } if ( ndo -> ndo_vflag ) <START_BUG> ND_PRINT ( (<END_BUG>

Fix:
<S2SV_ModStart> EXTRACT_LE_16BITS ( p <S2SV_ModEnd> ) ) )
Buggy code:
 void pgm_print ( netdissect_options * ndo, register const u_char * bp, register u_int length, register const u_char * bp2 ) { register const struct pgm_header * pgm ; register const struct ip * ip ; register char ch ; uint16_t sport, dport ; u_int nla_afnum ; char nla_buf [ INET6_ADDRSTRLEN ] ; register const struct ip6_hdr * ip6 ; uint8_t opt_type, opt_len ; uint32_t seq, opts_len, len, offset ; pgm = ( const struct pgm_header * ) bp ; ip = ( const struct ip * ) bp2 ; if ( IP_V ( ip ) == 6 ) ip6 = ( const struct ip6_hdr * ) bp2 ; else ip6 = NULL ; ch = '\\0' ; if (! ND_TTEST ( pgm -> pgm_dport ) ) { if ( ip6 ) { ND_PRINT ( ( ndo, "%s   >   %s:   [|pgm]", ip6addr_string ( ndo, & ip6 -> ip6_src ), ip6addr_string ( ndo, & ip6 -> ip6_dst ) ) ) ; return ; } else { ND_PRINT ( ( ndo, "%s   >   %s:   [|pgm]", ipaddr_string ( ndo, & ip -> ip_src ), ipaddr_string ( ndo, & ip -> ip_dst ) ) ) ; return ; } } sport = EXTRACT_16BITS ( & pgm -> pgm_sport ) ; dport = EXTRACT_16BITS ( & pgm -> pgm_dport ) ; if ( ip6 ) { if ( ip6 -> ip6_nxt == IPPROTO_PGM ) { ND_PRINT ( ( ndo, "%s.%s   >   %s.%s:   ", ip6addr_string ( ndo, & ip6 -> ip6_src ), tcpport_string ( ndo, sport ), ip6addr_string ( ndo, & ip6 -> ip6_dst ), tcpport_string ( ndo, dport ) ) ) ; } else

Fix:
<S2SV_ModStart> return ; } if (! ND_TTEST2 ( * bp, 2 ) ) { ND_PRINT ( ( ndo, " <S2SV_blank> [|OPT]" ) ) ; return ; }
Buggy code:
 static int get_registers ( pegasus_t * pegasus, __u16 indx, __u16 size, void * data ) { <START_BUG> int ret ; <END_BUG> ret = usb_control_msg ( pegasus -> usb, usb_rcvctrlpipe ( pegasus -> usb, 0 ), PEGASUS_REQ_GET_REGS, PEGASUS_REQT_READ, 0,  indx, data, size, 1000 ) ; <START_BUG> if ( ret < 0 ) netif_dbg ( pegasus, drv, pegasus -> net, "%s   returned   %d\\n", __func__, ret ) ; <END_BUG> return ret ;  }

Fix:
<S2SV_ModStart> data ) { u8 * buf ; int ret ; buf = kmalloc ( size, GFP_NOIO ) ; if (! buf ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart>, indx, buf <S2SV_ModEnd>, size, <S2SV_ModStart> ret ) ; else if ( ret <= size ) memcpy ( data, buf, ret ) ; kfree ( buf ) ;
Buggy code:
 static void addArgumentToVtab ( Parse * pParse ) { if ( pParse -> sArg. z && pParse -> pNewTable ) { const char * z = ( const char * ) pParse -> sArg. z ; int n = pParse -> sArg. n ; sqlite3 * db = pParse -> db ; <START_BUG> addModuleArgument ( db, pParse -> pNewTable, sqlite3DbStrNDup ( db, z, n ) ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pParse ->
Buggy code:
 static int cypress_generic_port_probe ( struct usb_serial_port * port ) { struct usb_serial * serial = port -> serial ; struct cypress_private * priv ; <START_BUG> priv = kzalloc ( sizeof ( struct cypress_private ), GFP_KERNEL ) ; <END_BUG> if (! priv ) return - ENOMEM ; priv -> comm_is_ok =! 0 ; spin_lock_init ( & priv -> lock ) ; if ( kfifo_alloc ( & priv -> write_fifo, CYPRESS_BUF_SIZE, GFP_KERNEL ) ) { kfree ( priv ) ; return - ENOMEM ; } if (! is_frwd ( serial -> dev ) ) usb_reset_configuration ( serial -> dev ) ; priv -> cmd_ctrl = 0 ; priv -> line_control = 0 ; priv -> termios_initialized = 0 ; priv -> rx_flags = 0 ; if ( port -> interrupt_out_size > 9 ) priv -> pkt_fmt = packet_format_1 ; else priv -> pkt_fmt = packet_format_2 ; if ( interval > 0 ) { priv -> write_urb_interval = interval ; priv -> read_urb_interval = interval ; dev_dbg ( & port -> dev, "%s   -   read   &   write   intervals   forced   to   %d\\n", __func__, interval ) ; } else { priv -> write_urb_interval = port -> interrupt_out_urb -> interval ; priv -> read_urb_interval = port -> interrupt_in_urb -> interval ; dev_dbg ( & port -> dev, "%s   -   intervals:   read=%d   write=%d\\n", __func__, priv -> read_urb_interval, priv -> write_urb_interval ) ; } usb_set_serial_port_data ( port, priv ) ; port -> port. drain_delay = 256 ; return 0 ; }

Fix:
<S2SV_ModStart> * priv ; if (! port -> interrupt_out_urb ||! port -> interrupt_in_urb ) { dev_err ( & port -> dev, "required <S2SV_blank> endpoint <S2SV_blank> is <S2SV_blank> missing\\n" ) ; return - ENODEV ; }
Buggy code:
 static void * __ns_get_path ( struct path * path, struct ns_common * ns ) { struct vfsmount * mnt = nsfs_mnt ; struct qstr qname = {. name = "", } ; struct dentry * dentry ; struct inode * inode ; unsigned long d ; rcu_read_lock ( ) ; d = atomic_long_read ( & ns -> stashed ) ; if (! d ) goto slow ; dentry = ( struct dentry * ) d ; if (! lockref_get_not_dead ( & dentry -> d_lockref ) ) goto slow ; rcu_read_unlock ( ) ; ns -> ops -> put ( ns ) ; got_it : path -> mnt = mntget ( mnt ) ; path -> dentry = dentry ; return NULL ; slow : rcu_read_unlock ( ) ; inode = new_inode_pseudo ( mnt -> mnt_sb ) ; if (! inode ) { ns -> ops -> put ( ns ) ; return ERR_PTR ( - ENOMEM ) ; } inode -> i_ino = ns -> inum ; inode -> i_mtime = inode -> i_atime = inode -> i_ctime = current_time ( inode ) ; inode -> i_flags |= S_IMMUTABLE ; inode -> i_mode = S_IFREG | S_IRUGO ; inode -> i_fop = & ns_file_operations ; inode -> i_private = ns ; dentry = d_alloc_pseudo ( mnt -> mnt_sb, & qname ) ; if (! dentry ) { iput ( inode ) ; return ERR_PTR ( - ENOMEM ) ; } d_instantiate ( dentry, inode ) ; <START_BUG> dentry -> d_fsdata = ( void * ) ns -> ops ; <END_BUG> d = atomic_long_cmpxchg ( & ns -> stashed, 0, ( unsigned long ) dentry ) ; if ( d ) { d_delete ( dentry ) ; dput ( dentry ) ; cpu_relax ( ) ; return ERR_PTR ( - EAGAIN ) ; } goto got_it ; }

Fix:
<S2SV_ModStart> ; dentry -> d_flags |= DCACHE_RCUACCESS ; dentry ->
Buggy code:
 <START_BUG> static void read_mv_probs ( nmv_context * ctx, int allow_hp, vp9_reader * r ) { <END_BUG> int i, j ; update_mv_probs ( ctx -> joints, MV_JOINTS - 1, r ) ; for ( i = 0 ; i < 2 ; ++ i ) { nmv_component * const comp_ctx = & ctx -> comps [ i ] ; update_mv_probs ( & comp_ctx -> sign, 1, r ) ; update_mv_probs ( comp_ctx -> classes, MV_CLASSES - 1, r ) ; update_mv_probs ( comp_ctx -> class0, CLASS0_SIZE - 1, r ) ; update_mv_probs ( comp_ctx -> bits, MV_OFFSET_BITS, r ) ; } for ( i = 0 ; i < 2 ; ++ i ) { nmv_component * const comp_ctx = & ctx -> comps [ i ] ; for ( j = 0 ; j < CLASS0_SIZE ; ++ j ) update_mv_probs ( comp_ctx -> class0_fp [ j ], MV_FP_SIZE - 1, r ) ; update_mv_probs ( comp_ctx -> fp, 3, r ) ; } if ( allow_hp ) { for ( i = 0 ; i < 2 ; ++ i ) { nmv_component * const comp_ctx = & ctx -> comps [ i ] ; update_mv_probs ( & comp_ctx -> class0_hp, 1, r ) ; update_mv_probs ( & comp_ctx -> hp, 1, r ) ; } } }

Fix:
<S2SV_ModStart> int allow_hp, vpx_reader <S2SV_ModEnd> * r )
Buggy code:
 static int rose_parse_ccitt ( unsigned char * p, struct rose_facilities_struct * facilities, int len ) { unsigned char l, n = 0 ; char callsign [ 11 ] ; do { switch ( * p & 0xC0 ) { case 0x00 : p += 2 ; n += 2 ; len -= 2 ; break ; case 0x40 : p += 3 ; n += 3 ; len -= 3 ; break ; case 0x80 : p += 4 ; n += 4 ; len -= 4 ; break ; case 0xC0 : l = p [ 1 ] ; <START_BUG> if ( * p == FAC_CCITT_DEST_NSAP ) { <END_BUG> memcpy ( & facilities -> source_addr, p + 7, ROSE_ADDR_LEN ) ; memcpy ( callsign, p + 12, l - 10 ) ; callsign [ l - 10 ] = '\\0' ; asc2ax ( & facilities -> source_call, callsign ) ; } if ( * p == FAC_CCITT_SRC_NSAP ) { memcpy ( & facilities -> dest_addr, p + 7, ROSE_ADDR_LEN ) ; memcpy ( callsign, p + 12, l - 10 ) ; callsign [ l - 10 ] = '\\0' ; asc2ax ( & facilities -> dest_call, callsign ) ; } p += l + 2 ; n += l + 2 ; len -= l + 2 ; break ; } } while ( * p!= 0x00 && len > 0 ) ; return n ; }

Fix:
<S2SV_ModStart> ; if ( l < 10 || l > 20 ) return - 1 ; if (
Buggy code:
 int socket_create ( uint16_t port ) { int sfd = - 1 ; int yes = 1 ; # ifdef WIN32 WSADATA wsa_data ; if (! wsa_init ) { if ( WSAStartup ( MAKEWORD ( 2, 2 ), & wsa_data )!= ERROR_SUCCESS ) { fprintf ( stderr, "WSAStartup   failed!\\n" ) ; ExitProcess ( - 1 ) ; } wsa_init = 1 ; } # endif struct sockaddr_in saddr ; if ( 0 > ( sfd = socket ( PF_INET, SOCK_STREAM, IPPROTO_TCP ) ) ) { perror ( "socket()" ) ; return - 1 ; } if ( setsockopt ( sfd, SOL_SOCKET, SO_REUSEADDR, ( void * ) & yes, sizeof ( int ) ) == - 1 ) { perror ( "setsockopt()" ) ; socket_close ( sfd ) ; return - 1 ; } # ifdef SO_NOSIGPIPE if ( setsockopt ( sfd, SOL_SOCKET, SO_NOSIGPIPE, ( void * ) & yes, sizeof ( int ) ) == - 1 ) { perror ( "setsockopt()" ) ; socket_close ( sfd ) ; return - 1 ; } # endif memset ( ( void * ) & saddr, 0, sizeof ( saddr ) ) ; saddr. sin_family = AF_INET ; <START_BUG> saddr. sin_addr. s_addr = htonl ( INADDR_ANY ) ; <END_BUG> saddr. sin_port = htons ( port ) ; if ( 0 > bind ( sfd, ( struct sockaddr * ) & saddr, sizeof ( saddr ) ) ) { perror ( "bind()" ) ; socket_close ( sfd ) ; return - 1 ; } if ( listen ( sfd, 1 ) == - 1 ) { perror ( "listen()" ) ; socket_close ( sfd ) ; return - 1 ; } return sfd ; }

Fix:
<S2SV_ModStart> = htonl ( INADDR_LOOPBACK <S2SV_ModEnd> ) ; saddr
Buggy code:
 int snd_ctl_add ( struct snd_card * card, struct snd_kcontrol * kcontrol ) { struct snd_ctl_elem_id id ; unsigned int idx ; <START_BUG> int err = - EINVAL ; <END_BUG> if (! kcontrol ) return err ; if ( snd_BUG_ON (! card ||! kcontrol -> info ) ) goto error ; id = kcontrol -> id ; down_write ( & card -> controls_rwsem ) ; if ( snd_ctl_find_id ( card, & id ) ) { up_write ( & card -> controls_rwsem ) ; dev_err ( card -> dev, "control   %i:%i:%i:%s:%i   is   already   present\\n", id. iface, id. device, id. subdevice, id. name, id. index ) ; err = - EBUSY ; goto error ; } if ( snd_ctl_find_hole ( card, kcontrol -> count ) < 0 ) { up_write ( & card -> controls_rwsem ) ; err = - ENOMEM ; goto error ; } list_add_tail ( & kcontrol -> list, & card -> controls ) ; card -> controls_count += kcontrol -> count ; kcontrol -> id. numid = card -> last_numid + 1 ; card -> last_numid += kcontrol -> count ;  up_write ( & card -> controls_rwsem ) ; <START_BUG> <END_BUG> for ( idx = 0 ; idx < kcontrol -> count ; idx ++, id. index ++, id. numid ++ )  snd_ctl_notify ( card, SNDRV_CTL_EVENT_MASK_ADD, & id ) ; return 0 ; error : snd_ctl_free_one ( kcontrol ) ; return err ; }

Fix:
<S2SV_ModStart> int idx ; unsigned int count ; <S2SV_ModStart> -> count ; count = kcontrol -> count ; <S2SV_ModStart> ; idx < <S2SV_ModEnd> count ; idx
Buggy code:
 <START_BUG> void vp9_model_to_full_probs ( const vp9_prob * model, vp9_prob * full ) { <END_BUG> if ( full!= model )  vpx_memcpy ( full, model, sizeof ( vp9_prob ) * UNCONSTRAINED_NODES ) ; <START_BUG> extend_to_full_distribution ( & full [ UNCONSTRAINED_NODES ], model [ PIVOT_NODE ] ) ; }<END_BUG>

Fix:
<S2SV_ModStart> vp9_model_to_full_probs ( const vpx_prob <S2SV_ModEnd> * model, <S2SV_ModStart> * model, vpx_prob <S2SV_ModEnd> * full ) <S2SV_ModStart>!= model ) memcpy <S2SV_ModEnd> ( full, <S2SV_ModStart>, sizeof ( vpx_prob <S2SV_ModEnd> ) * UNCONSTRAINED_NODES
Buggy code:
 <START_BUG> static void encode_unsigned_max ( struct vp9_write_bit_buffer * wb, <END_BUG> int data, int max ) {  vp9_wb_write_literal ( wb, data, get_unsigned_bits ( max ) ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> encode_unsigned_max ( struct vpx_write_bit_buffer <S2SV_ModEnd> * wb, <S2SV_ModStart> max ) { vpx_wb_write_literal <S2SV_ModEnd> ( wb,
Buggy code:
 void __skb_tstamp_tx ( struct sk_buff * orig_skb, struct skb_shared_hwtstamps * hwtstamps, struct sock * sk, int tstype ) { struct sk_buff * skb ; <START_BUG> bool tsonly ; <END_BUG> if (! sk ) return ; tsonly = sk -> sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY ; if (! skb_may_tx_timestamp ( sk, tsonly ) ) return ; if ( tsonly ) { # ifdef CONFIG_INET if ( ( sk -> sk_tsflags & SOF_TIMESTAMPING_OPT_STATS ) && sk -> sk_protocol == IPPROTO_TCP &&  sk -> sk_type == SOCK_STREAM ) <START_BUG> skb = tcp_get_timestamping_opt_stats ( sk ) ; <END_BUG> else  # endif skb = alloc_skb ( 0, GFP_ATOMIC ) ; } else { skb = skb_clone ( orig_skb, GFP_ATOMIC ) ; } if (! skb ) return ; if ( tsonly ) { skb_shinfo ( skb ) -> tx_flags = skb_shinfo ( orig_skb ) -> tx_flags ; skb_shinfo ( skb ) -> tskey = skb_shinfo ( orig_skb ) -> tskey ; } if ( hwtstamps ) * skb_hwtstamps ( skb ) = * hwtstamps ; else skb -> tstamp = ktime_get_real ( ) ; <START_BUG> __skb_complete_tx_timestamp ( skb, sk, tstype ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ; bool tsonly, opt_stats = false <S2SV_ModStart> == SOCK_STREAM ) { <S2SV_ModStart> sk ) ; opt_stats = true ; } <S2SV_ModStart> sk, tstype, opt_stats
Buggy code:
 static int fixup_bpf_calls ( struct bpf_verifier_env * env ) { struct bpf_prog * prog = env -> prog ; struct bpf_insn * insn = prog -> insnsi ; const struct bpf_func_proto * fn ; const int insn_cnt = prog -> len ; const struct bpf_map_ops * ops ; struct bpf_insn_aux_data * aux ; struct bpf_insn insn_buf [ 16 ] ; struct bpf_prog * new_prog ; struct bpf_map * map_ptr ; int i, cnt, delta = 0 ; for ( i = 0 ; i < insn_cnt ; i ++, insn ++ ) { if ( insn -> code == ( BPF_ALU64 | BPF_MOD | BPF_X ) || insn -> code == ( BPF_ALU64 | BPF_DIV | BPF_X ) || insn -> code == ( BPF_ALU | BPF_MOD | BPF_X ) || insn -> code == ( BPF_ALU | BPF_DIV | BPF_X ) ) { bool is64 = BPF_CLASS ( insn -> code ) == BPF_ALU64 ; struct bpf_insn mask_and_div [ ] = { BPF_MOV32_REG ( insn -> src_reg, insn -> src_reg ), BPF_JMP_IMM ( BPF_JNE, insn -> src_reg, 0, 2 ), BPF_ALU32_REG ( BPF_XOR, insn -> dst_reg, insn -> dst_reg ), BPF_JMP_IMM ( BPF_JA, 0, 0, 1 ), * insn, } ; struct bpf_insn mask_and_mod [ ] = { BPF_MOV32_REG ( insn -> src_reg, insn -> src_reg ), BPF_JMP_IMM ( BPF_JEQ, insn -> src_reg, 0, 1 ), * insn, } ; struct bpf_insn * patchlet ; if ( insn -> code == ( BPF_ALU64 | BPF_DIV | BPF_X ) || insn -> code == ( BPF_ALU | BPF_DIV | B

Fix:
<S2SV_ModStart> insn -> code == ( BPF_ALU64 | BPF_ADD | BPF_X ) || insn -> code == ( BPF_ALU64 | BPF_SUB | BPF_X ) ) { const u8 code_add = BPF_ALU64 | BPF_ADD | BPF_X ; const u8 code_sub = BPF_ALU64 | BPF_SUB | BPF_X ; struct bpf_insn insn_buf [ 16 ] ; struct bpf_insn * patch = & insn_buf [ 0 ] ; bool issrc, isneg ; u32 off_reg <S2SV_ModEnd> ; aux = <S2SV_ModStart> if (! aux -> alu_state <S2SV_ModEnd> ) continue ; <S2SV_ModStart> ) continue ; isneg = aux -> alu_state & BPF_ALU_NEG_VALUE ; issrc = ( aux -> alu_state & BPF_ALU_SANITIZE ) == BPF_ALU_SANITIZE_SRC ; off_reg = issrc? insn -> src_reg : insn -> dst_reg ; if ( isneg ) * patch ++ = BPF_ALU64_IMM (
Buggy code:
 static int pppol2tp_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int err ; struct sk_buff * skb ; struct sock * sk = sock -> sk ; err = - EIO ; if ( sk -> sk_state & PPPOX_BOUND ) <START_BUG> goto end ; <END_BUG> msg -> msg_namelen = 0 ; err = 0 ; skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & err ) ; if (! skb ) goto end ; if ( len > skb -> len ) len = skb -> len ; else if ( len < skb -> len ) msg -> msg_flags |= MSG_TRUNC ; err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, len ) ; if ( likely ( err == 0 ) ) err = len ; kfree_skb ( skb ) ; end : return err ; }

Fix:
<S2SV_ModStart> ) goto end <S2SV_ModEnd> ; err =
Buggy code:
 static void vhost_net_ubuf_put_and_wait ( struct vhost_net_ubuf_ref * ubufs ) { kref_put ( & ubufs -> kref, vhost_net_zerocopy_done_signal ) ; wait_event ( ubufs -> wait,! atomic_read ( & ubufs -> kref. refcount ) ) ; <START_BUG> kfree ( ubufs ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static ssize_t ib_uverbs_write ( struct file * filp, const char __user * buf, size_t count, loff_t * pos ) { struct ib_uverbs_file * file = filp -> private_data ; struct ib_device * ib_dev ; struct ib_uverbs_cmd_hdr hdr ; __u32 command ; __u32 flags ; int srcu_key ; ssize_t ret ; <START_BUG> if ( count < sizeof hdr ) <END_BUG> return - EINVAL ; if ( copy_from_user ( & hdr, buf, sizeof hdr ) ) return - EFAULT ; srcu_key = srcu_read_lock ( & file -> device -> disassociate_srcu ) ; ib_dev = srcu_dereference ( file -> device -> ib_dev, & file -> device -> disassociate_srcu ) ; if (! ib_dev ) { ret = - EIO ; goto out ; } if ( hdr. command & ~ ( __u32 ) ( IB_USER_VERBS_CMD_FLAGS_MASK | IB_USER_VERBS_CMD_COMMAND_MASK ) ) { ret = - EINVAL ; goto out ; } command = hdr. command & IB_USER_VERBS_CMD_COMMAND_MASK ; if ( verify_command_mask ( ib_dev, command ) ) { ret = - EOPNOTSUPP ; goto out ; } if (! file -> ucontext && command!= IB_USER_VERBS_CMD_GET_CONTEXT ) { ret = - EINVAL ; goto out ; } flags = ( hdr. command & IB_USER_VERBS_CMD_FLAGS_MASK ) >> IB_USER_VERBS_CMD_FLAGS_SHIFT ; if (! flags ) { if ( command >= ARRAY_SIZE ( uverbs_cmd_table ) ||! uverbs_cmd_table [ command ] ) { ret = - EINVAL ; goto out ; } if ( hdr. in_words * 4!= count ) { ret = - EINVAL ; goto out ; } ret = uverbs_cmd_table [ command ] ( file, ib_dev, buf + sizeof ( hdr ), hdr. in_words * 4, hdr. out_words * 4 ) ; } else if ( flags == IB_USER_VERBS_

Fix:
<S2SV_ModStart> ; if ( WARN_ON_ONCE (! ib_safe_file_access ( filp ) ) ) return - EACCES ; if (
Buggy code:
 int btsock_thread_wakeup ( int h ) { if ( h < 0 || h >= MAX_THREAD ) { APPL_TRACE_ERROR ( "invalid   bt   thread   handle:%d", h ) ; return FALSE ; } if ( ts [ h ]. cmd_fdw == - 1 ) { APPL_TRACE_ERROR ( "thread   handle:%d,   cmd   socket   is   not   created", h ) ; return FALSE ; } sock_cmd_t cmd = { CMD_WAKEUP, 0, 0, 0, 0 } ; <START_BUG> return send ( ts [ h ]. cmd_fdw, & cmd, sizeof ( cmd ), 0 ) == sizeof ( cmd ) ; <END_BUG> }

Fix:
<S2SV_ModStart> } ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 ssize_t socket_write ( const socket_t * socket, const void * buf, size_t count ) { assert ( socket!= NULL ) ; assert ( buf!= NULL ) ; <START_BUG> return send ( socket -> fd, buf, count, MSG_DONTWAIT ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, MSG_DONTWAIT ) )
Buggy code:
 <START_BUG> void vp9_iht8x8_64_add_c ( const int16_t * input, uint8_t * dest, int stride, <END_BUG> int tx_type ) { int i, j ;  int16_t out [ 8 * 8 ] ; <START_BUG> <END_BUG> int16_t * outptr = out ;  <START_BUG> int16_t temp_in [ 8 ], temp_out [ 8 ] ; <END_BUG> const transform_2d ht = IHT_8 [ tx_type ] ; for ( i = 0 ; i < 8 ; ++ i ) { ht. rows ( input, outptr ) ; input += 8 ; outptr += 8 ; } for ( i = 0 ; i < 8 ; ++ i ) { for ( j = 0 ; j < 8 ; ++ j ) temp_in [ j ] = out [ j * 8 + i ] ; ht. cols ( temp_in, temp_out ) ;  for ( j = 0 ; j < 8 ; ++ j ) <START_BUG> <END_BUG> dest [ j * stride + i ] = clip_pixel ( ROUND_POWER_OF_TWO ( temp_out [ j ], 5 )  <START_BUG> + dest [ j * stride + i ] ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> vp9_iht8x8_64_add_c ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart>, j ; tran_low_t <S2SV_ModEnd> out [ 8 <S2SV_ModStart> 8 ] ; tran_low_t <S2SV_ModEnd> * outptr = <S2SV_ModStart> = out ; tran_low_t <S2SV_ModEnd> temp_in [ 8 <S2SV_ModStart> ++ j ) { <S2SV_ModStart> i ] = clip_pixel_add ( <S2SV_ModEnd> dest [ j <S2SV_ModStart> + i ], ROUND_POWER_OF_TWO ( temp_out [ j ], 5 ) ) ; } <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 error_t icecastClientConnect ( IcecastClientContext * context ) { error_t error ; size_t length ; uint16_t serverPort ; IpAddr serverIpAddr ; NetInterface * interface ; interface = context -> settings. interface ; if ( osStrcmp ( interface -> proxyName, "" ) ) { const char_t requestTemplate [ ] = "GET   http:////%s:%" PRIu16 "%s   HTTP//1.1\\r\\n" "Host:   %s:%" PRIu16 "\\r\\n" "User-agent:   UserAgent\\r\\n" "Icy-MetaData:   1\\r\\n" "Connection:   close\\r\\n" "\\r\\n" ; length = osSprintf ( context -> buffer, requestTemplate, context -> settings. serverName, context -> settings. serverPort, context -> settings. resource, context -> settings. serverName, context -> settings. serverPort ) ; error = getHostByName ( interface, interface -> proxyName, & serverIpAddr, 0 ) ; if ( error ) return error ; serverPort = interface -> proxyPort ; } else { const char_t requestTemplate [ ] = "GET   %s   HTTP//1.1\\r\\n" "Host:   %s\\r\\n" "User-agent:   UserAgent\\r\\n" "Icy-MetaData:   1\\r\\n" "Connection:   close\\r\\n" "\\r\\n" ; length = osSprintf ( context -> buffer, requestTemplate, context -> settings. resource, context -> settings. serverName ) ; error = getHostByName ( interface, context -> settings. serverName, & serverIpAddr, 0 ) ; if ( error ) return error ; serverPort = context -> settings. serverPort ; } context -> socket = socketOpen ( SOCKET_TYPE_STREAM, SOCKET_IP_PROTO_TCP ) ; if ( context -> socket == NULL ) return ERROR_OUT_OF_RESOURCES ; do { error = socketBindToInterface ( context -> socket, interface ) ; if ( error ) break ; error = socketSetTimeout ( context -> socket, ICECAST_CLIENT_TIMEOUT ) ; if ( error ) break ; error = socketConnect ( context -> socket, & serverIpAddr, serverPort ) ; if ( error ) break ; TRACE_DEBUG ( context -> buffer )

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( context ->
Buggy code:
 jas_image_t * jp2_decode ( jas_stream_t * in, char * optstr ) { jp2_box_t * box ; int found ; jas_image_t * image ; jp2_dec_t * dec ; bool samedtype ; int dtype ; unsigned int i ; jp2_cmap_t * cmapd ; jp2_pclr_t * pclrd ; jp2_cdef_t * cdefd ; unsigned int channo ; int newcmptno ; int_fast32_t * lutents ; # if 0 jp2_cdefchan_t * cdefent ; int cmptno ; # endif jp2_cmapent_t * cmapent ; jas_icchdr_t icchdr ; jas_iccprof_t * iccprof ; dec = 0 ; box = 0 ; image = 0 ; if (! ( dec = jp2_dec_create ( ) ) ) { goto error ; } if (! ( box = jp2_box_get ( in ) ) ) { jas_eprintf ( "error:   cannot   get   box\\n" ) ; goto error ; } if ( box -> type!= JP2_BOX_JP ) { jas_eprintf ( "error:   expecting   signature   box\\n" ) ; goto error ; } if ( box -> data. jp. magic!= JP2_JP_MAGIC ) { jas_eprintf ( "incorrect   magic   number\\n" ) ; goto error ; } jp2_box_destroy ( box ) ; box = 0 ; if (! ( box = jp2_box_get ( in ) ) ) { goto error ; } if ( box -> type!= JP2_BOX_FTYP ) { jas_eprintf ( "expecting   file   type   box\\n" ) ; goto error ; } jp2_box_destroy ( box ) ; box = 0 ; found = 0 ; while ( ( box = jp2_box_get ( in ) ) ) { if ( jas_getdbglevel ( ) >= 1 ) { jas_eprintf ( "got   box   type   %s\\n", box -> info -> name ) ; } switch ( box -> type ) { case JP2

Fix:
<S2SV_ModStart>!= JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts ( <S2SV_ModStart> < JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts ( <S2SV_ModStart>!= JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts ( <S2SV_ModStart> < JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts ( <S2SV_ModStart> : JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts ( <S2SV_ModStart> >= JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts ( <S2SV_ModStart> < JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_image_numcmpts (
Buggy code:
 void ieee80211_sta_ps_deliver_wakeup ( struct sta_info * sta ) { struct ieee80211_sub_if_data * sdata = sta -> sdata ; struct ieee80211_local * local = sdata -> local ; struct sk_buff_head pending ; int filtered = 0, buffered = 0, ac ; unsigned long flags ; clear_sta_flag ( sta, WLAN_STA_SP ) ; BUILD_BUG_ON ( BITS_TO_LONGS ( IEEE80211_NUM_TIDS ) > 1 ) ; sta -> driver_buffered_tids = 0 ; if (! ( local -> hw. flags & IEEE80211_HW_AP_LINK_PS ) ) drv_sta_notify ( local, sdata, STA_NOTIFY_AWAKE, & sta -> sta ) ; skb_queue_head_init ( & pending ) ; <START_BUG> for ( ac = 0 ; ac < IEEE80211_NUM_ACS ; ac ++ ) { <END_BUG> int count = skb_queue_len ( & pending ), tmp ; spin_lock_irqsave ( & sta -> tx_filtered [ ac ]. lock, flags ) ; skb_queue_splice_tail_init ( & sta -> tx_filtered [ ac ], & pending ) ; spin_unlock_irqrestore ( & sta -> tx_filtered [ ac ]. lock, flags ) ; tmp = skb_queue_len ( & pending ) ; filtered += tmp - count ; count = tmp ; spin_lock_irqsave ( & sta -> ps_tx_buf [ ac ]. lock, flags ) ; skb_queue_splice_tail_init ( & sta -> ps_tx_buf [ ac ], & pending ) ; spin_unlock_irqrestore ( & sta -> ps_tx_buf [ ac ]. lock, flags ) ; tmp = skb_queue_len ( & pending ) ; buffered += tmp - count ; }  ieee80211_add_pending_skbs_fn ( local, & pending, clear_sta_ps_flags, sta ) ; <START_BUG> if (! ieee80211_smps_is<END_BUG>

Fix:
<S2SV_ModStart> pending ) ; spin_lock ( & sta -> ps_lock ) ; <S2SV_ModStart> clear_sta_ps_flags, sta ) ; spin_unlock ( & sta -> ps_lock
Buggy code:
 <START_BUG> static void __nfs4_close ( struct path * path, struct nfs4_state * state, mode_t mode, int wait ) <END_BUG> { struct nfs4_state_owner * owner = state -> owner ; int call_close = 0 ;  int newstate ; <START_BUG> atomic_inc ( & owner -> so_count ) ; spin_lock ( & owner -> so_lock ) ; <END_BUG> switch ( mode & ( FMODE_READ | FMODE_WRITE ) ) {  case FMODE_READ : state -> n_rdonly -- ; break ; case FMODE_WRITE : state -> n_wronly -- ; break ; case FMODE_READ | FMODE_WRITE : state -> n_rdwr -- ; } newstate = FMODE_READ | FMODE_WRITE ; if ( state -> n_rdwr == 0 ) { if ( state -> n_rdonly == 0 ) { newstate &= ~ FMODE_READ ; call_close |= test_bit ( NFS_O_RDONLY_STATE, & state -> flags ) ; call_close |= test_bit ( NFS_O_RDWR_STATE, & state -> flags ) ; } if ( state -> n_wronly == 0 ) { newstate &= ~ FMODE_WRITE ; call_close |= test_bit ( NFS_O_WRONLY_STATE, & state -> flags ) ; call_close |= test_bit ( NFS_O_RDWR_STATE, & state -> flags ) ; } if ( newstate == 0 ) clear_bit ( NFS_DELEGATED_STATE, & state -> flags ) ; } nfs4_state_set_mode_locked ( state, newstate ) ; spin_unlock ( & owner -> so_lock ) ; if (! call_close ) { nfs4_put_open_state ( state ) ; nfs4_put_state_owner ( owner ) ; } else nfs4_do_close ( path, state, wait ) ; }

Fix:
<S2SV_ModStart> * state, fmode_t fmode <S2SV_ModEnd>, int wait <S2SV_ModStart> = 0 ; fmode_t <S2SV_ModEnd> newstate ; atomic_inc <S2SV_ModStart> ; switch ( fmode <S2SV_ModEnd> & ( FMODE_READ
Buggy code:
 static int ssl_verify_cert ( struct tunnel * tunnel ) { int ret = - 1 ; int cert_valid = 0 ; unsigned char digest [ SHA256LEN ] ; unsigned int len ; struct x509_digest * elem ; char digest_str [ SHA256STRLEN ], * subject, * issuer ; char * line ; int i ; X509_NAME * subj ; <START_BUG> char common_name [ FIELD_SIZE + 1 ] ; <END_BUG>  SSL_set_verify ( tunnel -> ssl_handle, SSL_VERIFY_PEER, NULL ) ; <START_BUG> X509 * cert = SSL_get_peer_certificate ( tunnel -> ssl_handle ) ; if ( cert == NULL ) { log_error ( "Unable   to   get   gateway   certificate.\\n" ) ; return 1 ; } subj = X509_get_subject_name ( cert ) ; # ifdef HAVE_X509_CHECK_HOST if ( X509_check_host ( cert, common_name, FIELD_SIZE, 0, NULL ) == 1 ) cert_valid = 1 ; # else if ( subj && X509_NAME_get_text_by_NID ( subj, NID_commonName, common_name, FIELD_SIZE ) > 0 && strncasecmp ( common_name, tunnel -> config -> gateway_host, FIELD_SIZE ) == 0 ) cert_valid = 1 ; # endif if ( cert_valid && SSL_get_verify_result ( tunnel -> ssl_handle ) == X509_V_OK ) { log_debug ( "Gateway   certificate   validation   succeeded.\\n" ) ; ret = 0 ; goto free_cert ; } log_debug ( "Gateway   certificate   validation   failed.\\n" ) ; if ( X509_digest ( cert, EVP_sha256 ( ), digest, & len ) <= 0 || len!= SHA256LEN ) { log_error ( "Could   not   compute   certificate   sha256   digest.\\n" ) ; goto free_cert ; } for ( i = 0 ; i < SHA256LEN ; i ++ ) sprintf ( & digest_str [ 2 * i ], "%02x", digest [ i ] ) ; digest_str [ SHA256STRLEN - 1 ] = '\\0' ; for ( elem = tunnel -> config -> cert_whitelist ; elem!= NULL ; elem = elem<END_BUG>

Fix:
<S2SV_ModStart> * subj ; SSL_set_verify ( tunnel -> ssl_handle, SSL_VERIFY_PEER, NULL ) ; X509 * cert = SSL_get_peer_certificate ( tunnel -> ssl_handle ) ; if ( cert == NULL ) { log_error ( "Unable <S2SV_blank> to <S2SV_blank> get <S2SV_blank> gateway <S2SV_blank> certificate.\\n" ) ; return 1 ; } subj = X509_get_subject_name ( cert ) ; # ifdef HAVE_X509_CHECK_HOST if ( X509_check_host ( cert, tunnel -> config -> gateway_host, 0, 0, NULL ) == 1 ) cert_valid = 1 ; # else <S2SV_ModStart> 1 ] ; <S2SV_ModEnd> if ( subj
Buggy code:
 static inline int btif_hl_select_wake_reset ( void ) { char sig_recv = 0 ; BTIF_TRACE_DEBUG ( "btif_hl_select_wake_reset" ) ; <START_BUG> recv ( signal_fds [ 0 ], & sig_recv, sizeof ( sig_recv ), MSG_WAITALL ) ; <END_BUG> return ( int ) sig_recv ; }

Fix:
<S2SV_ModStart> "btif_hl_select_wake_reset" ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart>, MSG_WAITALL ) )
Buggy code:
 void Con_Dump_f ( void ) { int l, x, i ; short * line ; fileHandle_t f ; int bufferlen ; char * buffer ; char filename [ MAX_QPATH ] ; if ( Cmd_Argc ( )!= 2 ) { Com_Printf ( "usage:   condump   <filename>\\n" ) ; return ; } Q_strncpyz ( filename, Cmd_Argv ( 1 ), sizeof ( filename ) ) ; <START_BUG> COM_DefaultExtension ( filename, sizeof ( filename ), ".txt" ) ; <END_BUG> f = FS_FOpenFileWrite ( filename ) ; if (! f ) { Com_Printf ( "ERROR:   couldn\'t   open   %s.\\n", filename ) ; return ; } Com_Printf ( "Dumped   console   text   to   %s.\\n", filename ) ; for ( l = con. current - con. totallines + 1 ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( x = 0 ; x < con. linewidth ; x ++ ) if ( ( line [ x ] & 0xff )!=' ') break ; if ( x!= con. linewidth ) break ; } # ifdef _WIN32 bufferlen = con. linewidth + 3 * sizeof ( char ) ; # else bufferlen = con. linewidth + 2 * sizeof ( char ) ; # endif buffer = Hunk_AllocateTempMemory ( bufferlen ) ; buffer [ bufferlen - 1 ] = 0 ; for ( ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( i = 0 ; i < con. linewidth ; i ++ ) buffer [ i ] = line [ i ] & 0xff ; for ( x = con. linewidth - 1 ; x >= 0 ; x -- ) { if ( buffer [ x ] ==' ') buffer [ x ] = 0 ; else break ; } # ifdef _WIN32 Q_strcat ( buffer, bufferlen, "\\r\\n" ) ; # else Q_strcat ( buffer, bufferlen, "\\n" ) ; # endif FS_Write ( buffer, strlen ( buffer ), f ) ; } Hunk_FreeTempMemory ( buffer )

Fix:
<S2SV_ModStart> ".txt" ) ; if (! COM_CompareExtension ( filename, ".txt" ) ) { Com_Printf ( "Con_Dump_f: <S2SV_blank> Only <S2SV_blank> the <S2SV_blank> \\".txt\\" <S2SV_blank> extension <S2SV_blank> is <S2SV_blank> supported <S2SV_blank> by <S2SV_blank> this <S2SV_blank> command!\\n" ) ; return ; }
Buggy code:
 static const struct usb_cdc_union_desc * ims_pcu_get_cdc_union_desc ( struct usb_interface * intf ) { const void * buf = intf -> altsetting -> extra ; size_t buflen = intf -> altsetting -> extralen ; struct usb_cdc_union_desc * union_desc ; if (! buf ) { dev_err ( & intf -> dev, "Missing   descriptor   data\\n" ) ; return NULL ; } if (! buflen ) { dev_err ( & intf -> dev, "Zero   length   descriptor\\n" ) ; return NULL ; } <START_BUG> while ( buflen > 0 ) { <END_BUG> union_desc = ( struct usb_cdc_union_desc * ) buf ; if ( union_desc -> bDescriptorType == USB_DT_CS_INTERFACE && union_desc -> bDescriptorSubType == USB_CDC_UNION_TYPE ) { dev_dbg ( & intf -> dev, "Found   union   header\\n" ) ;  return union_desc ; <START_BUG> } buflen -= union_desc -> bLength ; buf += union_desc -> bLength ; } dev_err ( & intf -> dev, "Missing   CDC   union   descriptor\\n" ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> while ( buflen >= sizeof ( * union_desc ) ) { union_desc = ( struct usb_cdc_union_desc * ) buf ; if ( union_desc -> bLength > buflen ) { dev_err ( & intf -> dev, "Too <S2SV_blank> large <S2SV_blank> descriptor\\n" ) ; return NULL ; } <S2SV_ModEnd> if ( union_desc <S2SV_ModStart> "Found <S2SV_blank> union <S2SV_blank> header\\n" ) ; if ( union_desc -> bLength >= sizeof ( * union_desc ) ) return union_desc ; dev_err ( & intf -> dev, "Union <S2SV_blank> descriptor <S2SV_blank> to <S2SV_blank> short <S2SV_blank> (%d <S2SV_blank> vs <S2SV_blank> %zd\\n)", union_desc -> bLength, sizeof ( * union_desc ) ) ; return NULL <S2SV_ModEnd> ; } buflen
Buggy code:
 static void php_zip_get_from ( INTERNAL_FUNCTION_PARAMETERS, int type ) { struct zip * intern ; zval * self = getThis ( ) ; struct zip_stat sb ; struct zip_file * zf ; zend_long index = - 1 ; zend_long flags = 0 ; zend_long len = 0 ; zend_string * filename ; zend_string * buffer ; int n = 0 ; if (! self ) { RETURN_FALSE ; } ZIP_FROM_OBJECT ( intern, self ) ; if ( type == 1 ) { if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ), "P|ll", & filename, & len, & flags ) == FAILURE ) { return ; } PHP_ZIP_STAT_PATH ( intern, ZSTR_VAL ( filename ), ZSTR_LEN ( filename ), flags, sb ) ; } else { if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ), "l|ll", & index, & len, & flags ) == FAILURE ) { return ; } PHP_ZIP_STAT_INDEX ( intern, index, 0, sb ) ; } if ( sb. size < 1 ) { RETURN_EMPTY_STRING ( ) ; } if ( len < 1 ) { len = sb. size ; } if ( index >= 0 ) { zf = zip_fopen_index ( intern, index, flags ) ; } else { zf = zip_fopen ( intern, ZSTR_VAL ( filename ), flags ) ; } if ( zf == NULL ) { RETURN_FALSE ; } <START_BUG> buffer = zend_string_alloc ( len, 0 ) ; <END_BUG> n = zip_fread ( zf, ZSTR_VAL ( buffer ), ZSTR_LEN ( buffer ) ) ; if ( n < 1 ) { zend_string_free ( buffer ) ; RETURN_EMPTY_STRING ( ) ; } zip_fclose ( zf ) ; ZSTR_VAL ( buffer ) [ n ] = '\\0' ; ZSTR_LEN ( buffer ) = n ; RETURN_NEW_STR ( buffer ) ; }

Fix:
<S2SV_ModStart> } buffer = zend_string_safe_alloc ( 1, len, 0 <S2SV_ModEnd>, 0 )
Buggy code:
 static int uhid_event ( btif_hh_device_t * p_dev ) { struct uhid_event ev ; ssize_t ret ; memset ( & ev, 0, sizeof ( ev ) ) ; if (! p_dev ) { APPL_TRACE_ERROR ( "%s:   Device   not   found", __FUNCTION__ ) return - 1 ; } <START_BUG> ret = read ( p_dev -> fd, & ev, sizeof ( ev ) ) ; <END_BUG> if ( ret == 0 ) { APPL_TRACE_ERROR ( "%s:   Read   HUP   on   uhid-cdev   %s", __FUNCTION__, strerror ( errno ) ) ; return - EFAULT ; } else if ( ret < 0 ) { APPL_TRACE_ERROR ( "%s:   Cannot   read   uhid-cdev:   %s", __FUNCTION__, strerror ( errno ) ) ; return - errno ; } else if ( ( ev. type == UHID_OUTPUT ) || ( ev. type == UHID_OUTPUT_EV ) ) { if ( ret < ( ssize_t ) sizeof ( ev ) ) { APPL_TRACE_ERROR ( "%s:   Invalid   size   read   from   uhid-dev:   %ld  !=   %lu", __FUNCTION__, ret, sizeof ( ev. type ) ) ; return - EFAULT ; } } switch ( ev. type ) { case UHID_START : APPL_TRACE_DEBUG ( "UHID_START   from   uhid-dev\\n" ) ; p_dev -> ready_for_data = TRUE ; break ; case UHID_STOP : APPL_TRACE_DEBUG ( "UHID_STOP   from   uhid-dev\\n" ) ; p_dev -> ready_for_data = FALSE ; break ; case UHID_OPEN : APPL_TRACE_DEBUG ( "UHID_OPEN   from   uhid-dev\\n" ) ; break ; case UHID_CLOSE : APPL_TRACE_DEBUG ( "UHID_CLOSE   from   uhid-dev\\n" ) ; p_dev -> ready_for_data = FALSE ; break ; case UHID_OUTPUT : if (

Fix:
<S2SV_ModStart> } ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> sizeof ( ev )
Buggy code:
 <START_BUG> static int64_t rd_pick_intra4x4block ( VP9_COMP * cpi, MACROBLOCK * x, int ib, <END_BUG> MB_PREDICTION_MODE * best_mode, const int * bmode_costs, ENTROPY_CONTEXT * a, ENTROPY_CONTEXT * l, int * bestrate, int * bestratey, int64_t * bestdistortion, BLOCK_SIZE bsize, int64_t rd_thresh ) {  MB_PREDICTION_MODE mode ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; int64_t best_rd = rd_thresh ; struct macroblock_plane * p = & x -> plane [ 0 ] ; struct macroblockd_plane * pd = & xd -> plane [ 0 ] ; const int src_stride = p -> src. stride ; const int dst_stride = pd -> dst. stride ; <END_BUG> const uint8_t * src_init = & p -> src. buf [ raster_block_offset ( BLOCK_8X8, ib,  src_stride ) ] ; <START_BUG> uint8_t * dst_init = & pd -> dst. buf [ raster_block_offset ( BLOCK_8X8, ib, <END_BUG> dst_stride ) ] ; ENTROPY_CONTEXT ta [ 2 ], tempa [ 2 ] ; ENTROPY_CONTEXT tl [ 2 ], templ [ 2 ] ; const int num_4x4_blocks_wide = num_4x4_blocks_wide_lookup [ bsize ] ; const int num_4x4_blocks_high = num_4x4_blocks_high_lookup [ bsize ] ; int idx, idy ; uint8_t best_dst [ 8 * 8 ] ;  assert ( ib < 4 ) ; <START_BUG> vpx_memcpy ( ta, a, sizeof ( ta ) ) ; <END_BUG> vpx_memcpy ( tl, l, sizeof ( tl ) ) ;  <START_BUG> xd -> mi [ 0 ] -> mbmi. tx_size = TX_4X4 ; <END_BUG> for ( mode = DC_PRED ; mode <= TM_PRED ; ++ mode ) { int64_t this_rd ; int ratey = 0 ; int64_t distortion = 0 ; int rate = bmode

Fix:
<S2SV_ModStart> x, int row, int col, PREDICTION_MODE <S2SV_ModEnd> * best_mode, <S2SV_ModStart> rd_thresh ) { PREDICTION_MODE <S2SV_ModEnd> mode ; MACROBLOCKD <S2SV_ModStart>. buf [ row * 4 * src_stride + col * 4 <S2SV_ModEnd> ] ; uint8_t <S2SV_ModStart>. buf [ row * 4 * src_stride + col * 4 <S2SV_ModEnd> ] ; ENTROPY_CONTEXT <S2SV_ModStart> 8 ] ; # if CONFIG_VP9_HIGHBITDEPTH uint16_t best_dst16 [ 8 * 8 ] ; # endif memcpy <S2SV_ModEnd> ( ta, <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( tl, <S2SV_ModStart> = TX_4X4 ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { <S2SV_ModStart> continue ; } memcpy <S2SV_ModEnd> ( tempa, <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( templ, <S2SV_ModStart> int block = ( row + idy ) <S2SV_ModEnd> * 2 + <S2SV_ModStart> * 2 + ( col + idx ) <S2SV_ModEnd> ; const uint8_t <S2SV_ModStart> const src_diff = vp9_raster_block_offset_int16 <S2SV_ModEnd> ( BLOCK_8X8, <S2SV_ModStart> src_diff ) ;
Buggy code:
 static void update_layer_buffer_level ( SVC * svc, int encoded_frame_size ) { <START_BUG> int temporal_layer = 0 ; <END_BUG> int current_temporal_layer = svc -> temporal_layer_id ;  for ( temporal_layer = current_temporal_layer + 1 ; <START_BUG> <END_BUG> temporal_layer < svc -> number_temporal_layers ; ++ temporal_layer ) {  <START_BUG> LAYER_CONTEXT * lc = & svc -> layer_context [ temporal_layer ] ; <END_BUG> RATE_CONTROL * lrc = & lc -> rc ; int bits_off_for_this_layer = ( int ) ( lc -> target_bandwidth // lc -> framerate - encoded_frame_size ) ; lrc -> bits_off_target += bits_off_for_this_layer ;  lrc -> bits_off_target = MIN ( lrc -> bits_off_target, lc -> maximum_buffer_size ) ; <START_BUG> lrc -> buffer_level = lrc -> bits_off_target ; } }<END_BUG>

Fix:
<S2SV_ModStart> ) { int i <S2SV_ModEnd> = 0 ; <S2SV_ModStart> ; for ( i <S2SV_ModEnd> = current_temporal_layer + <S2SV_ModStart> + 1 ; i <S2SV_ModEnd> < svc -> <S2SV_ModStart> number_temporal_layers ; ++ i ) { const int layer = LAYER_IDS_TO_IDX ( svc -> spatial_layer_id, i, svc -> number_temporal_layers ) ; <S2SV_ModEnd> LAYER_CONTEXT * lc <S2SV_ModStart> -> layer_context [ layer <S2SV_ModEnd> ] ; RATE_CONTROL <S2SV_ModStart> -> bits_off_target, lrc <S2SV_ModEnd> -> maximum_buffer_size )
Buggy code:
 static int fp_setreadl ( struct tok_state * tok, const char * enc ) { PyObject * readline, * io, * stream ; _Py_IDENTIFIER ( open ) ; _Py_IDENTIFIER ( readline ) ; int fd ; long pos ; fd = fileno ( tok -> fp ) ; pos = ftell ( tok -> fp ) ; if ( pos == - 1 || lseek ( fd, ( off_t ) ( pos > 0? pos - 1 : pos ), SEEK_SET ) == ( off_t ) - 1 ) { PyErr_SetFromErrnoWithFilename ( PyExc_OSError, NULL ) ; return 0 ; } io = PyImport_ImportModuleNoBlock ( "io" ) ; if ( io == NULL ) return 0 ; stream = _PyObject_CallMethodId ( io, & PyId_open, "isisOOO", fd, "r", - 1, enc, Py_None, Py_None, Py_False ) ; Py_DECREF ( io ) ; if ( stream == NULL ) return 0 ; readline = _PyObject_GetAttrId ( stream, & PyId_readline ) ; Py_DECREF ( stream ) ; if ( readline == NULL ) return 0 ; Py_XSETREF ( tok -> decoding_readline, readline ) ; if ( pos > 0 ) { <START_BUG> PyObject * bufobj = PyObject_CallObject ( readline, NULL ) ; <END_BUG> if ( bufobj == NULL ) return 0 ; Py_DECREF ( bufobj ) ; } return 1 ; }

Fix:
<S2SV_ModStart> * bufobj = _PyObject_CallNoArg ( readline <S2SV_ModEnd> ) ; if
Buggy code:
 static Image * ReadCUTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowCUTReaderException ( severity, tag ) { if ( palette!= NULL ) palette = DestroyImage ( palette ) ; if ( clone_info!= NULL ) clone_info = DestroyImageInfo ( clone_info ) ; ThrowReaderException ( severity, tag ) ; } <END_BUG> Image * image, * palette ; ImageInfo * clone_info ; MagickBooleanType status ; MagickOffsetType offset ; size_t EncodedByte ; unsigned char RunCount, RunValue, RunCountMasked ; CUTHeader Header ; CUTPalHeader PalHeader ; ssize_t depth ; ssize_t i, j ; ssize_t ldblk ; unsigned char * BImgBuff = NULL, * ptrB ; register Quantum * q ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } palette = NULL ; clone_info = NULL ; Header. Width = ReadBlobLSBShort ( image ) ; Header. Height = ReadBlobLSBShort ( image ) ; Header. Reserved = ReadBlobLSBShort ( image ) ; if ( Header. Width == 0 || Header. Height == 0 || Header. Reserved!= 0 ) CUT_KO : ThrowCUTReaderException ( CorruptImageError, "ImproperImageHeader" ) ; EncodedByte = ReadBlobLSBShort ( image ) ; RunCount = ( unsigned char ) ReadBlobByte ( image ) ; RunCountMasked = RunCount & 0x7F ; ldblk = 0 ; while ( ( int ) RunCountMasked!= 0 ) { i = 1 ; if ( ( int ) RunCount < 0x80 ) i

Fix:
<S2SV_ModStart>, tag ) \\\n{ <S2SV_ModEnd> if ( palette <S2SV_ModStart> tag ) ; \\\n} <S2SV_ModEnd> Image * image <S2SV_ModStart> goto NoMemory ; ( void ) memset ( BImgBuff, 0, ( size_t ) ldblk * sizeof ( * BImgBuff ) ) ;
Buggy code:
 EAS_BOOL WT_CheckSampleEnd ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame, EAS_BOOL update ) { EAS_U32 endPhaseAccum ; EAS_U32 endPhaseFrac ; EAS_I32 numSamples ; EAS_BOOL done = EAS_FALSE ; endPhaseFrac = pWTVoice -> phaseFrac + ( pWTIntFrame -> frame. phaseIncrement << SYNTH_UPDATE_PERIOD_IN_BITS ) ; endPhaseAccum = pWTVoice -> phaseAccum + GET_PHASE_INT_PART ( endPhaseFrac ) ; if ( endPhaseAccum >= pWTVoice -> loopEnd ) { numSamples = ( EAS_I32 ) ( pWTVoice -> loopEnd - pWTVoice -> phaseAccum ) ; numSamples = ( EAS_I32 ) ( ( numSamples << NUM_PHASE_FRAC_BITS ) - pWTVoice -> phaseFrac ) ; if ( pWTIntFrame -> frame. phaseIncrement ) { pWTIntFrame -> numSamples = 1 + ( numSamples // pWTIntFrame -> frame. phaseIncrement ) ; } else { pWTIntFrame -> numSamples = numSamples ; } <START_BUG> done = EAS_TRUE ; <END_BUG> } if ( update ) { pWTVoice -> phaseFrac = endPhaseFrac ; pWTVoice -> phaseAccum = endPhaseAccum ; } return done ; }

Fix:
<S2SV_ModStart> numSamples ; } if ( pWTIntFrame -> numSamples < 0 ) { ALOGE ( "b//26366256" ) ; pWTIntFrame -> numSamples = 0 ; }
Buggy code:
 static void <START_BUG> l2tp_proxy_auth_type_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint16_t * ptr = ( const uint16_t * ) dat ; <START_BUG> ND_PRINT ( ( ndo, "%s", tok2str ( l2tp_authentype2str, "AuthType-#%u", EXTRACT_16BITS ( ptr ) ) ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 static int l2cap_sock_connect ( struct socket * sock, struct sockaddr * addr, int alen, int flags ) { struct sock * sk = sock -> sk ; struct sockaddr_l2 la ; int len, err = 0 ; BT_DBG ( "sk   %p", sk ) ; if (! addr || addr -> sa_family!= AF_BLUETOOTH ) return - EINVAL ; memset ( & la, 0, sizeof ( la ) ) ; len = min_t ( unsigned int, sizeof ( la ), alen ) ; memcpy ( & la, addr, len ) ; if ( la. l2_cid ) return - EINVAL ; lock_sock ( sk ) ; if ( sk -> sk_type == SOCK_SEQPACKET &&! la. l2_psm ) { err = - EINVAL ; goto done ; } switch ( l2cap_pi ( sk ) -> mode ) { case L2CAP_MODE_BASIC : break ; case L2CAP_MODE_ERTM : <START_BUG> if ( enable_ertm ) <END_BUG> break ; default : err = - ENOTSUPP ; goto done ; } switch ( sk -> sk_state ) { case BT_CONNECT : case BT_CONNECT2 : case BT_CONFIG : goto wait ; case BT_CONNECTED : goto done ; case BT_OPEN : case BT_BOUND : break ; default : err = - EBADFD ; goto done ; } bacpy ( & bt_sk ( sk ) -> dst, & la. l2_bdaddr ) ; l2cap_pi ( sk ) -> psm = la. l2_psm ; err = l2cap_do_connect ( sk ) ; if ( err ) goto done ; wait : err = bt_sock_wait_state ( sk, BT_CONNECTED, sock_sndtimeo ( sk, flags & O_NONBLOCK ) ) ; done : release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> case L2CAP_MODE_ERTM : case L2CAP_MODE_STREAMING :
Buggy code:
 rfbClientPtr rfbClientIteratorNext ( rfbClientIteratorPtr i ) <START_BUG> { <END_BUG> if ( i -> next == 0 ) { LOCK ( rfbClientListMutex ) ; i -> next = i -> screen -> clientHead ; UNLOCK ( rfbClientListMutex ) ; } else { rfbClientPtr cl = i -> next ; i -> next = i -> next -> next ; rfbDecrClientRef ( cl ) ; } # if defined ( LIBVNCSERVER_HAVE_LIBPTHREAD ) || defined ( LIBVNCSERVER_HAVE_WIN32THREADS ) if (! i -> closedToo ) while ( i -> next && i -> next -> sock < 0 ) i -> next = i -> next -> next ; if ( i -> next ) rfbIncrClientRef ( i -> next ) ; # endif return i -> next ; }

Fix:
<S2SV_ModStart> i ) { if (! i ) return NULL ;
Buggy code:
 <START_BUG> static INLINE void write_buffer_4x4 ( int16_t * output, __m128i * res ) { <END_BUG> const __m128i kOne = _mm_set1_epi16 ( 1 ) ; __m128i in01 = _mm_unpacklo_epi64 ( res [ 0 ], res [ 1 ] ) ; __m128i in23 = _mm_unpacklo_epi64 ( res [ 2 ], res [ 3 ] ) ; __m128i out01 = _mm_add_epi16 ( in01, kOne ) ; __m128i out23 = _mm_add_epi16 ( in23, kOne ) ; out01 = _mm_srai_epi16 ( out01, 2 ) ; out23 = _mm_srai_epi16 ( out23, 2 ) ;  _mm_store_si128 ( ( __m128i * ) ( output + 0 * 8 ), out01 ) ; <START_BUG> <END_BUG> _mm_store_si128 ( ( __m128i * ) ( output + 1 * 8 ), out23 ) ;  }

Fix:
<S2SV_ModStart> void write_buffer_4x4 ( tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> 2 ) ; store_output ( & out01, <S2SV_ModEnd> ( output + <S2SV_ModStart> * 8 ) ) ; store_output ( & out23, <S2SV_ModEnd> ( output + <S2SV_ModStart> * 8 ) <S2SV_ModEnd> ) ; }