nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int <START_BUG> mptctl_eventenable ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_eventenable __user * uarg = ( void __user * ) arg ;  struct mpt_ioctl_eventenable karg ; <START_BUG> MPT_ADAPTER * ioc ; int iocnum ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_eventenable ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_eventenable   -   " "Unable   to   read   in   mpt_ioctl_eventenable   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; <END_BUG> return - EFAULT ;  } if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_eventenable()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_eventenable   called.\\n", ioc -> name ) ) ; if ( ioc -> events == NULL ) { int sz = MPTCTL_EVENT_LOG_SIZE * sizeof ( MPT_IOCTL_EVENTS ) ; ioc -> events = kzalloc ( sz, GFP_KERNEL ) ; if (! ioc -> events ) { printk ( MYIOC_s_ERR_FMT ":   ERROR   -   Insufficient   memory   to   add   adapter!\\n", ioc -> name ) ; return - ENOMEM ; } ioc -> alloc_total += sz ; ioc -> eventContext = 0 ; } ioc -> eventTypes = karg. eventTypes ; return 0 ; }

Fix:
<S2SV_ModStart> int mptctl_eventenable ( MPT_ADAPTER * ioc, <S2SV_ModStart> struct mpt_ioctl_eventenable karg <S2SV_ModEnd> ; if ( <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; } dctlprintk
Buggy code:
 static int hash_accept ( struct socket * sock, struct socket * newsock, int flags ) { struct sock * sk = sock -> sk ; struct alg_sock * ask = alg_sk ( sk ) ; struct hash_ctx * ctx = ask -> private ; struct ahash_request * req = & ctx -> req ; char state [ crypto_ahash_statesize ( crypto_ahash_reqtfm ( req ) ) ] ; struct sock * sk2 ; struct alg_sock * ask2 ; struct hash_ctx * ctx2 ; <START_BUG> int err ; <END_BUG>  err = crypto_ahash_export ( req, state ) ; <START_BUG> if ( err ) return err ; err = af_alg_accept ( ask -> parent, newsock ) ; if ( err ) return err ; sk2 = newsock -> sk ; ask2 = alg_sk ( sk2 ) ; ctx2 = ask2 -> private ; <END_BUG> ctx2 -> more = 1 ;  err = crypto_ahash_import ( & ctx2 -> req, state ) ; if ( err ) { sock_orphan ( sk2 ) ; sock_put ( sk2 ) ; } return err ; }

Fix:
<S2SV_ModStart> * ctx2 ; bool more ; <S2SV_ModStart> int err ; lock_sock ( sk ) ; more = ctx -> more ; err = more? <S2SV_ModEnd> crypto_ahash_export ( req <S2SV_ModStart>, state ) : 0 ; release_sock ( sk ) <S2SV_ModStart> -> more = more ; if (! more ) return err <S2SV_ModEnd> ; err =
Buggy code:
 int btrfs_scrub_dev ( struct btrfs_fs_info * fs_info, u64 devid, u64 start, u64 end, struct btrfs_scrub_progress * progress, int readonly, int is_dev_replace ) { struct scrub_ctx * sctx ; int ret ; struct btrfs_device * dev ; unsigned int nofs_flag ; if ( btrfs_fs_closing ( fs_info ) ) return - EINVAL ; if ( fs_info -> nodesize > BTRFS_STRIPE_LEN ) { btrfs_err ( fs_info, "scrub:   size   assumption   nodesize   <=   BTRFS_STRIPE_LEN   (%d   <=   %d)   fails", fs_info -> nodesize, BTRFS_STRIPE_LEN ) ; return - EINVAL ; } if ( fs_info -> sectorsize!= PAGE_SIZE ) { btrfs_err_rl ( fs_info, "scrub:   size   assumption   sectorsize  !=   PAGE_SIZE   (%d  !=   %lu)   fails", fs_info -> sectorsize, PAGE_SIZE ) ; return - EINVAL ; } if ( fs_info -> nodesize > PAGE_SIZE * SCRUB_MAX_PAGES_PER_BLOCK || fs_info -> sectorsize > PAGE_SIZE * SCRUB_MAX_PAGES_PER_BLOCK ) { btrfs_err ( fs_info, "scrub:   size   assumption   nodesize   and   sectorsize   <=   SCRUB_MAX_PAGES_PER_BLOCK   (%d   <=   %d   &&   %d   <=   %d)   fails", fs_info -> nodesize, SCRUB_MAX_PAGES_PER_BLOCK, fs_info -> sectorsize, SCRUB_MAX_PAGES_PER_BLOCK ) ; return - EINVAL ; } sctx = scrub_setup_ctx ( fs_info, is_dev_replace ) ; if ( IS_ERR ( sctx ) ) return PTR_ERR ( sctx ) ; mutex_lock ( & fs_info -> fs

Fix:
<S2SV_ModStart> NULL, NULL, true
Buggy code:
 static vpx_codec_err_t ctrl_get_frame_corrupted ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctrl_id, va_list args ) { <END_BUG> int * corrupted = va_arg ( args, int * ) ; if ( corrupted ) {  if ( ctx -> pbi ) <START_BUG> <END_BUG> * corrupted = ctx -> pbi -> common. frame_to_show -> corrupted ;  else return VPX_CODEC_ERROR ; return VPX_CODEC_OK ; } else { <START_BUG> return VPX_CODEC_INVALID_PARAM ; <END_BUG> }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> ( ctx -> frame_workers ) { VPxWorker * const worker = ctx -> frame_workers ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; RefCntBuffer * const frame_bufs = frame_worker_data -> pbi -> common. buffer_pool -> frame_bufs ; if ( frame_worker_data <S2SV_ModEnd> -> pbi -> <S2SV_ModStart> common. frame_to_show == NULL ) return VPX_CODEC_ERROR ; if ( ctx -> last_show_frame >= 0 ) * corrupted = frame_bufs [ ctx -> last_show_frame ]. buf. corrupted <S2SV_ModEnd> ; return VPX_CODEC_OK <S2SV_ModStart> else { return VPX_CODEC_ERROR <S2SV_ModEnd> ; } } <S2SV_ModStart> ; } } return VPX_CODEC_INVALID_PARAM ; }
Buggy code:
 static void dhcp6opt_print ( netdissect_options * ndo, const u_char * cp, const u_char * ep ) { const struct dhcp6opt * dh6o ; const u_char * tp ; size_t i ; uint16_t opttype ; size_t optlen ; uint8_t auth_proto ; u_int authinfolen, authrealmlen ; int remain_len ; int label_len ; uint16_t subopt_code ; uint16_t subopt_len ; if ( cp == ep ) return ; while ( cp < ep ) { if ( ep < cp + sizeof ( * dh6o ) ) goto trunc ; dh6o = ( const struct dhcp6opt * ) cp ; ND_TCHECK ( * dh6o ) ; optlen = EXTRACT_16BITS ( & dh6o -> dh6opt_len ) ; if ( ep < cp + sizeof ( * dh6o ) + optlen ) goto trunc ; opttype = EXTRACT_16BITS ( & dh6o -> dh6opt_type ) ; ND_PRINT ( ( ndo, "   (%s", tok2str ( dh6opt_str, "opt_%u", opttype ) ) ) ; ND_TCHECK2 ( * ( cp + sizeof ( * dh6o ) ), optlen ) ; switch ( opttype ) { case DH6OPT_CLIENTID : case DH6OPT_SERVERID : if ( optlen < 2 ) { ND_PRINT ( ( ndo, "  ?)" ) ) ; break ; } tp = ( const u_char * ) ( dh6o + 1 ) ; switch ( EXTRACT_16BITS ( tp ) ) { case 1 : if ( optlen >= 2 + 6 ) { ND_PRINT ( ( ndo, "   hwaddr//time   type   %u   time   %u   ", EXTRACT_16BITS ( & tp [ 2 ] ), EXTRACT_32BITS ( & tp [ 4 ] ) ) ) ; for ( i = 8 ; i < optlen ; i ++ ) ND_PRINT ( ( ndo, "%02x", tp [ i ] ) ) ; ND_PRINT ( ( ndo, ")" ) ) ; } else { ND_PRINT ( ( ndo, "  

Fix:
<S2SV_ModStart> case DH6OPT_RECONF_MSG : if ( optlen!= 1 ) { ND_PRINT ( ( ndo, " <S2SV_blank>?)" ) ) ; break ; }
Buggy code:
 static void multiframe_quality_enhance_block ( int blksize, int qcurr, int qprev, unsigned char * y, unsigned char * u, unsigned char * v, int y_stride, int uv_stride, unsigned char * yd, unsigned char * ud, unsigned char * vd, int yd_stride, int uvd_stride ) { static const unsigned char VP8_ZEROS [ 16 ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 } ; int uvblksize = blksize >> 1 ; int qdiff = qcurr - qprev ; int i ; unsigned char * up ; unsigned char * udp ; unsigned char * vp ; unsigned char * vdp ; unsigned int act, actd, sad, usad, vsad, sse, thr, thrsq, actrisk ; if ( blksize == 16 ) { <START_BUG> actd = ( vp8_variance16x16 ( yd, yd_stride, VP8_ZEROS, 0, & sse ) + 128 ) >> 8 ; <END_BUG>  act = ( vp8_variance16x16 ( y, y_stride, VP8_ZEROS, 0, & sse ) + 128 ) >> 8 ; <START_BUG> # ifdef USE_SSD <END_BUG> sad = ( vp8_variance16x16 ( y, y_stride, yd, yd_stride, & sse ) ) ;  sad = ( sse + 128 ) >> 8 ; usad = ( vp8_variance8x8 ( u, uv_stride, ud, uvd_stride, & sse ) ) ; usad = ( sse + 32 ) >> 6 ; <START_BUG> vsad = ( vp8_variance8x8 ( v, uv_stride, vd, uvd_stride, & sse ) ) ; <END_BUG> vsad = ( sse + 32 ) >> 6 ; # else sad = ( vp8_sad16x16 ( y, y_stride, yd, yd_stride, UINT_MAX ) + 128 ) >> 8 ; usad = ( vp8_sad8x8 ( u, uv_stride, ud, uvd_stride, UINT_MAX ) + 32 ) >> 6 ; vsad = ( vp8_sad

Fix:
<S2SV_ModStart> actd = ( vpx_variance16x16 <S2SV_ModEnd> ( yd, <S2SV_ModStart> act = ( vpx_variance16x16 <S2SV_ModEnd> ( y, <S2SV_ModStart> # ifdef USE_SSD vpx_variance16x16 ( y, y_stride, yd, yd_stride, & sse ) ; <S2SV_ModStart> sad = ( sse + 128 ) >> 8 ; vpx_variance8x8 ( u, uv_stride, ud, uvd_stride, & sse ) ; usad = ( sse + 32 ) >> 6 ; vpx_variance8x8 ( v, uv_stride, vd, uvd_stride, & sse ) ; vsad = ( sse + 32 ) >> 6 ; # else sad = ( vpx_sad16x16 <S2SV_ModEnd> ( y, <S2SV_ModStart> yd, yd_stride ) + 128 ) >> 8 ; usad = ( vpx_sad8x8 ( u, uv_stride, ud, uvd_stride ) + 32 ) >> 6 ; vsad = ( vpx_sad8x8 ( v, uv_stride, vd, uvd_stride ) + 32 ) >> 6 ; # endif } else { actd
Buggy code:
 void bn_mul_comba8 ( BN_ULONG * r, BN_ULONG * a, BN_ULONG * b ) { <START_BUG> BN_ULONG t1, t2 ; <END_BUG> BN_ULONG c1, c2, c3 ; c1 = 0 ; c2 = 0 ; c3 = 0 ; mul_add_c ( a [ 0 ], b [ 0 ], c1, c2, c3 ) ; r [ 0 ] = c1 ; c1 = 0 ; mul_add_c ( a [ 0 ], b [ 1 ], c2, c3, c1 ) ; mul_add_c ( a [ 1 ], b [ 0 ], c2, c3, c1 ) ; r [ 1 ] = c2 ; c2 = 0 ; mul_add_c ( a [ 2 ], b [ 0 ], c3, c1, c2 ) ; mul_add_c ( a [ 1 ], b [ 1 ], c3, c1, c2 ) ; mul_add_c ( a [ 0 ], b [ 2 ], c3, c1, c2 ) ; r [ 2 ] = c3 ; c3 = 0 ; mul_add_c ( a [ 0 ], b [ 3 ], c1, c2, c3 ) ; mul_add_c ( a [ 1 ], b [ 2 ], c1, c2, c3 ) ; mul_add_c ( a [ 2 ], b [ 1 ], c1, c2, c3 ) ; mul_add_c ( a [ 3 ], b [ 0 ], c1, c2, c3 ) ; r [ 3 ] = c1 ; c1 = 0 ; mul_add_c ( a [ 4 ], b [ 0 ], c2, c3, c1 ) ; mul_add_c ( a [ 3 ], b [ 1 ], c2, c3, c1 ) ; mul_add_c ( a [ 2 ], b [ 2 ], c2, c3, c1 ) ; mul_add_c ( a [ 1 ], b [ 3 ], c2, c3, c1 ) ; mul_add_c ( a [ 0 ], b [ 4 ]

Fix:
<S2SV_ModStart> ) { BN_ULONG <S2SV_ModEnd> c1, c2
Buggy code:
 static int acm_probe ( struct usb_interface * intf, const struct usb_device_id * id ) { struct usb_cdc_union_desc * union_header = NULL ; struct usb_cdc_country_functional_desc * cfd = NULL ; unsigned char * buffer = intf -> altsetting -> extra ; int buflen = intf -> altsetting -> extralen ; struct usb_interface * control_interface ; struct usb_interface * data_interface ; struct usb_endpoint_descriptor * epctrl = NULL ; struct usb_endpoint_descriptor * epread = NULL ; struct usb_endpoint_descriptor * epwrite = NULL ; struct usb_device * usb_dev = interface_to_usbdev ( intf ) ; struct acm * acm ; int minor ; int ctrlsize, readsize ; u8 * buf ; u8 ac_management_function = 0 ; u8 call_management_function = 0 ; int call_interface_num = - 1 ; int data_interface_num = - 1 ; unsigned long quirks ; int num_rx_buf ; int i ; unsigned int elength = 0 ; int combined_interfaces = 0 ; struct device * tty_dev ; int rv = - ENOMEM ; quirks = ( unsigned long ) id -> driver_info ; if ( quirks == IGNORE_DEVICE ) return - ENODEV ; num_rx_buf = ( quirks == SINGLE_RX_URB )? 1 : ACM_NR ; if ( quirks == NO_UNION_NORMAL ) { data_interface = usb_ifnum_to_if ( usb_dev, 1 ) ; <START_BUG> control_interface = usb_ifnum_to_if ( usb_dev, 0 ) ; <END_BUG> goto skip_normal_probe ; } if (! buffer ) { dev_err ( & intf -> dev, "Weird   descriptor   references\\n" ) ; return - EINVAL ; } if (! buflen ) { if ( intf -> cur_altsetting -> endpoint && intf -> cur_altsetting -> endpoint -> extralen && intf -> cur_altsetting -> endpoint -> extra ) { dev_dbg ( & intf -> dev, "Seeking   extra   descriptors   on   endpoint\\n" ) ; buflen = intf -> cur_altsetting -> endpoint -> extralen ; buffer = intf -> cur

Fix:
<S2SV_ModStart>, 0 ) ; if (! data_interface ||! control_interface ) return - ENODEV
Buggy code:
 static void <START_BUG> l2tp_accm_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> { const uint16_t * ptr = ( const uint16_t * ) dat ; uint16_t val_h, val_l ;  ptr ++ ; <START_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "send=%08x   ", ( val_h << 16 ) + val_l ) ) ; <END_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ;  val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "recv=%08x   ", ( val_h << 16 ) + val_l ) ) ; }

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart>, val_l ; if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } ptr ++ ; length -= 2 ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; length -= 2 ; val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; length -= 2 <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> ) ) ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 static struct key * construct_key_and_link ( struct keyring_search_context * ctx, const char * callout_info, size_t callout_len, void * aux, struct key * dest_keyring, unsigned long flags ) { struct key_user * user ; struct key * key ; int ret ; kenter ( "" ) ; if ( ctx -> index_key. type == & key_type_keyring ) return ERR_PTR ( - EPERM ) ; <START_BUG> user = key_user_lookup ( current_fsuid ( ) ) ; <END_BUG> if (! user )  return ERR_PTR ( - ENOMEM ) ; <START_BUG> construct_get_dest_keyring ( & dest_keyring ) ; ret = construct_alloc_key ( ctx, dest_keyring, flags, user, & key ) ; key_user_put ( user ) ; if ( ret == 0 ) { ret = construct_key ( key, callout_info, callout_len, aux, dest_keyring ) ; if ( ret < 0 ) { kdebug ( "cons   failed" ) ; goto construction_failed ; } } else if ( ret == - EINPROGRESS ) { ret = 0 ; } else { <END_BUG> goto couldnt_alloc_key ;  } key_put ( dest_keyring ) ; kleave ( "   =   key   %d", key_serial ( key ) ) ; return key ; construction_failed : key_negate_and_link ( key, key_negative_timeout, NULL, NULL ) ; key_put ( key ) ; <START_BUG> couldnt_alloc_key : <END_BUG>  key_put ( dest_keyring ) ; <START_BUG> kleave ( "   =   %d", ret ) ; return ERR_PTR ( ret ) ; }<END_BUG>

Fix:
<S2SV_ModStart> EPERM ) ; ret = construct_get_dest_keyring ( & dest_keyring ) ; if ( ret ) goto error ; <S2SV_ModStart>! user ) { ret = - ENOMEM ; goto error_put_dest_keyring ; } <S2SV_ModEnd> ret = construct_alloc_key <S2SV_ModStart> else { goto error_put_dest_keyring <S2SV_ModEnd> ; } key_put <S2SV_ModStart> key ) ; error_put_dest_keyring <S2SV_ModEnd> : key_put ( <S2SV_ModStart> dest_keyring ) ; error :
Buggy code:
 WORD32 ih264d_read_mmco_commands ( struct _DecStruct * ps_dec ) { dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; dpb_commands_t * ps_dpb_cmds = ps_dec -> ps_dpb_cmds ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; WORD32 j ; UWORD8 u1_buf_mode ; struct MMCParams * ps_mmc_params ; UWORD32 * pu4_bitstrm_buf = ps_dec -> ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD32 u4_bit_ofst = ps_dec -> ps_bitstrm -> u4_ofst ; ps_slice -> u1_mmco_equalto5 = 0 ; { if ( ps_dec -> u1_nal_unit_type == IDR_SLICE_NAL ) { ps_slice -> u1_no_output_of_prior_pics_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; COPYTHECONTEXT ( "SH:   no_output_of_prior_pics_flag", ps_slice -> u1_no_output_of_prior_pics_flag ) ; ps_slice -> u1_long_term_reference_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; COPYTHECONTEXT ( "SH:   long_term_reference_flag", ps_slice -> u1_long_term_reference_flag ) ; ps_dpb_cmds -> u1_idr_pic = 1 ; ps_dpb_cmds -> u1_no_output_of_prior_pics_flag = ps_slice -> u1_no_output_of_prior_pics_flag ; ps_dpb_cmds -> u1_long_term_reference_flag = ps_slice -> u1_long_term_reference_flag ; } else { u1_buf_mode = ih264d_get_bit_h264

Fix:
<S2SV_ModStart> END_OF_MMCO ) { if ( j >= MAX_REF_BUFS ) { ALOGE ( "b//25818142" ) ; android_errorWriteLog ( 0x534e4554, "25818142" ) ; ps_dpb_cmds -> u1_num_of_commands = 0 ; return - 1 ; }
Buggy code:
 void fput ( struct file * file ) { if ( atomic_long_dec_and_test ( & file -> f_count ) ) { <START_BUG> struct task_struct * task = current ; <END_BUG> file_sb_list_del ( file ) ; if ( likely (! in_interrupt ( ) &&! ( task -> flags & PF_KTHREAD ) ) ) { init_task_work ( & file -> f_u. fu_rcuhead, ____fput ) ; if (! task_work_add ( task, & file -> f_u. fu_rcuhead, true ) ) return ; } if ( llist_add ( & file -> f_u. fu_llist, & delayed_fput_list ) ) schedule_work ( & delayed_fput_work ) ; } }

Fix:
<S2SV_ModStart> task = current <S2SV_ModEnd> ; if (
Buggy code:
 static void ppp_hdlc ( netdissect_options * ndo, const u_char * p, int length ) { <START_BUG> u_char * b, * s, * t, c ; <END_BUG> int i, proto ; const void * se ; if ( length <= 0 ) return ;  b = ( uint8_t * ) malloc ( length ) ; <START_BUG> if ( b == NULL ) return ; <END_BUG> for ( s = ( u_char * ) p, t = b, i = length ; i > 0 ; i -- ) {  c = * s ++ ; if ( c == 0x7d ) { <START_BUG> if ( i > 1 ) { <END_BUG> i -- ;  c = * s ++ ^ 0x20 ; <START_BUG> } else continue ; } * t ++ = c ; } se = ndo -> ndo_snapend ; ndo -> ndo_snapend = t ; length = t - b ; if ( length < 1 ) goto trunc ; proto = * b ; switch ( proto ) { case PPP_IP : ip_print ( ndo, b + 1, length - 1 ) ; goto cleanup ; case PPP_IPV6 : ip6_print ( ndo, b + 1, length - 1 ) ; goto cleanup ; default : break ; } if ( length < 2 ) goto trunc ; proto = EXTRACT_16BITS ( b ) ; switch ( proto ) { case ( PPP_ADDRESS << 8 | PPP_CONTROL ) : if ( length < 4 ) goto trunc ; proto = EXTRACT_16BITS ( b + 2 ) ; handle_ppp ( ndo, proto, b + 4, length - 4 ) ; break ; default : handle_ppp ( ndo, proto, b + 2, length - 2 ) ; break ; } cleanup : ndo -> ndo_snapend = se ; free ( b ) ; return ; trunc : ndo -> ndo_snapend = se ; free ( b ) ; ND_PRINT ( ( ndo, "[|ppp]" ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> b, * <S2SV_ModEnd> t, c <S2SV_ModStart> t, c ; const u_char * s <S2SV_ModStart> b = ( u_char <S2SV_ModEnd> * ) malloc <S2SV_ModStart> ( s = <S2SV_ModEnd> p, t <S2SV_ModStart> i > 0 && ND_TTEST ( * s ) <S2SV_ModStart> if ( i <= 1 ||! ND_TTEST ( * s ) ) break ; <S2SV_ModEnd> i -- ; <S2SV_ModStart> ++ ^ 0x20 <S2SV_ModEnd> ; } *
Buggy code:
 static long gfs2_fallocate ( struct file * file, int mode, loff_t offset, loff_t len ) { struct inode * inode = file -> f_path. dentry -> d_inode ; struct gfs2_sbd * sdp = GFS2_SB ( inode ) ; struct gfs2_inode * ip = GFS2_I ( inode ) ; unsigned int data_blocks = 0, ind_blocks = 0, rblocks ; loff_t bytes, max_bytes ; struct gfs2_alloc * al ; int error ; loff_t bsize_mask = ~ ( ( loff_t ) sdp -> sd_sb. sb_bsize - 1 ) ; loff_t next = ( offset + len - 1 ) >> sdp -> sd_sb. sb_bsize_shift ; <START_BUG> next = ( next + 1 ) << sdp -> sd_sb. sb_bsize_shift ; <END_BUG> if ( mode & ~ FALLOC_FL_KEEP_SIZE ) return - EOPNOTSUPP ; offset &= bsize_mask ; len = next - offset ; bytes = sdp -> sd_max_rg_data * sdp -> sd_sb. sb_bsize // 2 ; if (! bytes ) bytes = UINT_MAX ; bytes &= bsize_mask ; if ( bytes == 0 ) bytes = sdp -> sd_sb. sb_bsize ; gfs2_holder_init ( ip -> i_gl, LM_ST_EXCLUSIVE, 0, & ip -> i_gh ) ; error = gfs2_glock_nq ( & ip -> i_gh ) ; if ( unlikely ( error ) ) goto out_uninit ; if (! gfs2_write_alloc_required ( ip, offset, len ) ) goto out_unlock ; while ( len > 0 ) { if ( len < bytes ) bytes = len ; al = gfs2_alloc_get ( ip ) ; if (! al ) { error = - ENOMEM ; goto out_unlock ; } error = gfs2_quota_lock_check ( ip ) ; if ( error ) goto out_alloc_put ; retry : gfs2_write_calc_reserv ( ip, bytes, & data_blocks, & ind_blocks ) ; al -> al_requested =

Fix:
<S2SV_ModStart>. sb_bsize_shift ; loff_t max_chunk_size = UINT_MAX & bsize_mask ; <S2SV_ModStart> ( ip, ( len > max_chunk_size )? max_chunk_size : len, <S2SV_ModEnd> & max_bytes,
Buggy code:
 static RD_BOOL seamless_process_line ( const char * line, void * data ) { UNUSED ( data ) ; char * p, * l ; char * tok1, * tok3, * tok4, * tok5, * tok6, * tok7, * tok8 ; unsigned long id, flags ; char * endptr ; l = xstrdup ( line ) ; p = l ; logger ( Core, Debug, "seamless_process_line(),   got   \'%s\'", p ) ; tok1 = seamless_get_token ( & p ) ; ( void ) seamless_get_token ( & p ) ; tok3 = seamless_get_token ( & p ) ; tok4 = seamless_get_token ( & p ) ; tok5 = seamless_get_token ( & p ) ; tok6 = seamless_get_token ( & p ) ; tok7 = seamless_get_token ( & p ) ; tok8 = seamless_get_token ( & p ) ; if (! strcmp ( "CREATE", tok1 ) ) { unsigned long group, parent ; if (! tok6 ) return False ; id = strtoul ( tok3, & endptr, 0 ) ; if ( * endptr ) return False ; group = strtoul ( tok4, & endptr, 0 ) ; if ( * endptr ) return False ; parent = strtoul ( tok5, & endptr, 0 ) ; if ( * endptr ) return False ; flags = strtoul ( tok6, & endptr, 0 ) ; if ( * endptr ) return False ; ui_seamless_create_window ( id, group, parent, flags ) ; } else if (! strcmp ( "DESTROY", tok1 ) ) { if (! tok4 ) return False ; id = strtoul ( tok3, & endptr, 0 ) ; if ( * endptr ) return False ; flags = strtoul ( tok4, & endptr, 0 ) ; if ( * endptr ) return False ; ui_seamless_destroy_window ( id, flags ) ; } else if (! strcmp ( "DESTROYGRP", tok1 ) ) { if (! tok4 ) return False ;

Fix:
<S2SV_ModStart> len ++ ; if ( ( size_t ) len >= sizeof ( icon_buf ) ) { logger ( Protocol, Warning, "seamless_process_line(), <S2SV_blank> icon <S2SV_blank> data <S2SV_blank> would <S2SV_blank> overrun <S2SV_blank> icon_buf" ) ; break ; }
Buggy code:
 <START_BUG> static void update_coef_probs_common ( vp9_writer * const bc, VP9_COMP * cpi, <END_BUG> TX_SIZE tx_size,  vp9_coeff_stats * frame_branch_ct ) { <START_BUG> vp9_coeff_probs_model * new_frame_coef_probs = cpi -> frame_coef_probs [ tx_size ] ; vp9_coeff_probs_model * old_frame_coef_probs = <END_BUG> cpi -> common. fc. coef_probs [ tx_size ] ;  const vp9_prob upd = DIFF_UPDATE_PROB ; const int entropy_nodes_update = UNCONSTRAINED_NODES ; int i, j, k, l, t ; switch ( cpi -> sf. use_fast_coef_updates ) { case TWO_LOOP : { int savings = 0 ; int update [ 2 ] = { 0, 0 } ; for ( i = 0 ; i < PLANE_TYPES ; ++ i ) { for ( j = 0 ; j < REF_TYPES ; ++ j ) { for ( k = 0 ; k < COEF_BANDS ; ++ k ) { for ( l = 0 ; l < BAND_COEFF_CONTEXTS ( k ) ; ++ l ) { for ( t = 0 ; t < entropy_nodes_update ; ++ t ) { <START_BUG> vp9_prob newp = new_frame_coef_probs [ i ] [ j ] [ k ] [ l ] [ t ] ; <END_BUG>  const vp9_prob oldp = old_frame_coef_probs [ i ] [ j ] [ k ] [ l ] [ t ] ; <START_BUG> int s ; int u = 0 ; if ( t == PIVOT_NODE ) s = vp9_prob_diff_update_savings_search_model ( frame_branch_ct [ i ] [ j ] [ k ] [ l ] [ 0 ], <END_BUG> old_frame_coef_probs [ i ] [ j ] [ k ] [ l ], & newp, upd ) ;  else s = vp9_prob_diff_update_savings_search ( frame_branch_ct [ i ] [ j ] [ k ] [ l ] [ t ], oldp, & newp, upd ) ; if ( s > 0 && newp!= old

Fix:
<S2SV_ModStart> void update_coef_probs_common ( vpx_writer <S2SV_ModEnd> * const bc <S2SV_ModStart> vp9_coeff_stats * frame_branch_ct, vp9_coeff_probs_model * new_coef_probs ) { vp9_coeff_probs_model * old_coef_probs = <S2SV_ModEnd> cpi -> common <S2SV_ModStart> common. fc -> coef_probs [ tx_size ] ; const vpx_prob upd = DIFF_UPDATE_PROB ; const int entropy_nodes_update = UNCONSTRAINED_NODES ; int i, j, k, l, t ; int stepsize = cpi -> sf. coeff_prob_appx_step <S2SV_ModEnd> ; switch ( <S2SV_ModStart> t ) { vpx_prob newp = new_coef_probs <S2SV_ModEnd> [ i ] <S2SV_ModStart> ] ; const vpx_prob oldp = old_coef_probs <S2SV_ModEnd> [ i ] <S2SV_ModStart> 0 ], old_coef_probs <S2SV_ModEnd> [ i ] <S2SV_ModStart> newp, upd, stepsize <S2SV_ModStart> 0 ) { vpx_write_bit <S2SV_ModEnd> ( bc, <S2SV_ModStart> return ; } vpx_write_bit <S2SV_ModEnd> ( bc, <S2SV_ModStart> t ) { vpx_prob newp = new_coef_probs [ i ]
Buggy code:
 static long media_device_enum_entities ( struct media_device * mdev, struct media_entity_desc __user * uent ) { struct media_entity * ent ; struct media_entity_desc u_ent ; <START_BUG> if ( copy_from_user ( & u_ent. id, & uent -> id, sizeof ( u_ent. id ) ) ) <END_BUG> return - EFAULT ; ent = find_entity ( mdev, u_ent. id ) ; if ( ent == NULL ) return - EINVAL ; u_ent. id = ent -> id ; if ( ent -> name ) { strncpy ( u_ent. name, ent -> name, sizeof ( u_ent. name ) ) ; u_ent. name [ sizeof ( u_ent. name ) - 1 ] = '\\0' ; } else { memset ( u_ent. name, 0, sizeof ( u_ent. name ) ) ; } u_ent. type = ent -> type ; u_ent. revision = ent -> revision ; u_ent. flags = ent -> flags ; u_ent. group_id = ent -> group_id ; u_ent. pads = ent -> num_pads ; u_ent. links = ent -> num_links - ent -> num_backlinks ; memcpy ( & u_ent. raw, & ent -> info, sizeof ( ent -> info ) ) ; if ( copy_to_user ( uent, & u_ent, sizeof ( u_ent ) ) ) return - EFAULT ; return 0 ; }

Fix:
<S2SV_ModStart> media_entity_desc u_ent ; memset ( & u_ent, 0, sizeof ( u_ent ) ) ;
Buggy code:
 <START_BUG> static MB_PREDICTION_MODE read_intra_mode_y ( VP9_COMMON * cm, vp9_reader * r, <END_BUG> int size_group ) {  const MB_PREDICTION_MODE y_mode = read_intra_mode ( r, <START_BUG> <END_BUG> cm -> fc. y_mode_prob [ size_group ] ) ;  <START_BUG> if (! cm -> frame_parallel_decoding_mode ) <END_BUG> ++ cm -> counts. y_mode [ size_group ] [ y_mode ] ; return y_mode ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static PREDICTION_MODE <S2SV_ModEnd> read_intra_mode_y ( VP9_COMMON <S2SV_ModStart> * cm, MACROBLOCKD * xd, vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> ) { const PREDICTION_MODE <S2SV_ModEnd> y_mode = read_intra_mode <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> y_mode_prob [ size_group <S2SV_ModStart> ] ) ; FRAME_COUNTS * counts = xd -> counts ; if ( counts ) ++ counts -> <S2SV_ModEnd> y_mode [ size_group
Buggy code:
 void CleanupOutput ( char * str ) { char * s, * t ; int period = 0 ; s = t = str ; <START_BUG> while ( * s && * s!= '}' ) { <END_BUG>  if ( * s == '\\n' ) * s =' '; <START_BUG> <END_BUG> if ( ( * s ==' '|| * s == '\\n' ) && ( s [ 1 ] ==' '|| s [ 1 ] == '\\n' ) ) s ++ ;  else * t ++ = * s ++ ; } while ( * s ) * t ++ = * s ++ ; * t = 0 ; s = t = str ; while ( * s ) { if ( * s == '.' ) { period = 1 ; * t ++ = * s ++ ; } else if ( * s == '-' && s [ 1 ] == '0' && s [ 2 ] ==' ') { s ++ ; } else if ( * s <= '9' && * s >= '0' ) { * t ++ = * s ++ ; } else if ( * s == '\\n' && ( t > str && t [ - 1 ] == '\\n' ) ) { s ++ ; } else if ( period ) { while ( t > str && t [ - 1 ] == '0' ) t -- ; if ( t > str && t [ - 1 ] == '.' ) t -- ; while ( * s ==' '&& s [ 1 ] ==' ') s ++ ; period = 0 ; * t ++ = * s ++ ; } else if ( * s ==' '&& s [ 1 ] ==' ') s ++ ; else { period = 0 ; * t ++ = * s ++ ; } } * t = 0 ; s = t = str ; while ( * s ) { if ( * s == '-' && s [ 1 ] == '0' && s [ 2 ] ==' ') { s ++ ; } else * t ++ = * s ++ ; } * t = 0 ; }

Fix:
<S2SV_ModStart> ( * s <S2SV_ModEnd> ) { if <S2SV_ModStart> == '\\n' ) { <S2SV_ModStart> ='<S2SV_blank>'; } if ( ( * s =='<S2SV_blank>') && ( s [ 1 ] <S2SV_ModEnd> =='<S2SV_blank>'|| <S2SV_ModStart> =='<S2SV_blank>'|| s [ 1 ] == '\\n' || s [ 1 ] == 0 ) ) { s ++ ; } else { * t ++ = * s ++ ; } } * t = 0 ; s = t = str ; while ( * s ) { if ( * s == '.' ) { period = 1 ; * t ++ = * s ++ ; } else if ( isdigit ( * s ) ) { * t ++ = * s ++ ; } else if ( period ) { while ( t > str && t [ - 1 ] == '0' ) { t -- ; } if ( t > str && t [ - 1 ] == '.' ) { t -- ; if ( t > str &&! isdigit ( t [ - 1 ] ) ) { * t ++ = '0' ; } } period = 0 ; * t ++ = * s ++ ; } else { period = 0 ; * t ++ = * s ++ ; } } * t = 0 ; s = t = str ; while
Buggy code:
 static int flv_write_packet ( AVFormatContext * s, AVPacket * pkt ) { AVIOContext * pb = s -> pb ; AVCodecParameters * par = s -> streams [ pkt -> stream_index ] -> codecpar ; FLVContext * flv = s -> priv_data ; FLVStreamContext * sc = s -> streams [ pkt -> stream_index ] -> priv_data ; unsigned ts ; int size = pkt -> size ; uint8_t * data = NULL ; int flags = - 1, flags_size, ret ; <START_BUG> int64_t cur_offset = avio_tell ( pb ) ; <END_BUG> if ( par -> codec_id == AV_CODEC_ID_VP6F || par -> codec_id == AV_CODEC_ID_VP6A || par -> codec_id == AV_CODEC_ID_VP6 || par -> codec_id == AV_CODEC_ID_AAC ) flags_size = 2 ; else if ( par -> codec_id == AV_CODEC_ID_H264 || par -> codec_id == AV_CODEC_ID_MPEG4 ) flags_size = 5 ; else flags_size = 1 ; if ( par -> codec_id == AV_CODEC_ID_AAC || par -> codec_id == AV_CODEC_ID_H264 || par -> codec_id == AV_CODEC_ID_MPEG4 ) { int side_size = 0 ; uint8_t * side = av_packet_get_side_data ( pkt, AV_PKT_DATA_NEW_EXTRADATA, & side_size ) ; if ( side && side_size > 0 && ( side_size!= par -> extradata_size || memcmp ( side, par -> extradata, side_size ) ) ) { av_free ( par -> extradata ) ; par -> extradata = av_mallocz ( side_size + AV_INPUT_BUFFER_PADDING_SIZE ) ; if (! par -> extradata ) { par -> extradata_size = 0 ; return AVERROR ( ENOMEM ) ; } memcpy ( par -> extradata, side, side_size ) ; par -> extradata_size = side_size ; flv_write_codec_header

Fix:
<S2SV_ModStart> pb ) ; if ( par -> codec_type == AVMEDIA_TYPE_AUDIO &&! pkt -> size ) { av_log ( s, AV_LOG_WARNING, "Empty <S2SV_blank> audio <S2SV_blank> Packet\\n" ) ; return AVERROR ( EINVAL ) ; }
Buggy code:
 int ff_jpeg2000_init_component ( Jpeg2000Component * comp, Jpeg2000CodingStyle * codsty, Jpeg2000QuantStyle * qntsty, int cbps, int dx, int dy, AVCodecContext * avctx ) { uint8_t log2_band_prec_width, log2_band_prec_height ; int reslevelno, bandno, gbandno = 0, ret, i, j ; uint32_t csize ; if ( codsty -> nreslevels2decode <= 0 ) { av_log ( avctx, AV_LOG_ERROR, "nreslevels2decode   %d   invalid   or   uninitialized\\n", codsty -> nreslevels2decode ) ; return AVERROR_INVALIDDATA ; } if ( ret = ff_jpeg2000_dwt_init ( & comp -> dwt, comp -> coord, codsty -> nreslevels2decode - 1, codsty -> transform ) ) return ret ; csize = ( comp -> coord [ 0 ] [ 1 ] - comp -> coord [ 0 ] [ 0 ] ) * ( comp -> coord [ 1 ] [ 1 ] - comp -> coord [ 1 ] [ 0 ] ) ; if ( codsty -> transform == FF_DWT97 ) { comp -> i_data = NULL ; comp -> f_data = av_malloc_array ( csize, sizeof ( * comp -> f_data ) ) ; if (! comp -> f_data ) return AVERROR ( ENOMEM ) ; } else { comp -> f_data = NULL ; comp -> i_data = av_malloc_array ( csize, sizeof ( * comp -> i_data ) ) ; if (! comp -> i_data ) return AVERROR ( ENOMEM ) ; } comp -> reslevel = av_malloc_array ( codsty -> nreslevels, sizeof ( * comp -> reslevel ) ) ; if (! comp -> reslevel ) return AVERROR ( ENOMEM ) ; for ( reslevelno = 0 ; reslevelno < codsty -> nreslevels ; reslevelno ++ ) { int declvl = codsty -> nreslevels - reslevelno ; Jpeg2000ResLevel * reslevel = comp -> reslevel + reslevelno ; for ( i = 0 ; i <

Fix:
<S2SV_ModStart> -> band = av_calloc <S2SV_ModEnd> ( reslevel -> <S2SV_ModStart> -> prec = av_calloc <S2SV_ModEnd> ( reslevel ->
Buggy code:
 int obj2ast_arg ( PyObject * obj, arg_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; identifier arg ; expr_ty annotation ; <START_BUG> int lineno ; <END_BUG> int col_offset ; int end_lineno ; int end_col_offset ; if ( _PyObject_LookupAttrId ( obj, & PyId_arg, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required   field   \\"arg\\"   missing   from   arg" ) ; return 1 ; } else { int res ; res = obj2ast_identifier ( tmp, & arg, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_annotation, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; annotation = NULL ; } else { int res ;  res = obj2ast_expr ( tmp, & annotation, arena ) ; <START_BUG> if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   arg" ) ; return 1 ; } else { int res ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_col_offset, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required   field   \\"col_offset\\"   missing   from   arg" ) ; return 1 ; } else { int res ; res = obj2ast_int ( tmp, & col_offset, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId<END_BUG>

Fix:
<S2SV_ModStart> expr_ty annotation ; string type_comment ; <S2SV_ModStart>, & annotation, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_type_comment, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; type_comment = NULL ; } else { int res ; res = obj2ast_string ( tmp, & type_comment <S2SV_ModStart>, annotation, type_comment,
Buggy code:
 int bnep_add_connection ( struct bnep_connadd_req * req, struct socket * sock ) { struct net_device * dev ; struct bnep_session * s, * ss ; u8 dst [ ETH_ALEN ], src [ ETH_ALEN ] ; int err ; BT_DBG ( "" ) ; <START_BUG> baswap ( ( void * ) dst, & l2cap_pi ( sock -> sk ) -> chan -> dst ) ; <END_BUG> baswap ( ( void * ) src, & l2cap_pi ( sock -> sk ) -> chan -> src ) ; dev = alloc_netdev ( sizeof ( struct bnep_session ), ( * req -> device )? req -> device : "bnep%d", NET_NAME_UNKNOWN, bnep_net_setup ) ; if (! dev ) return - ENOMEM ; down_write ( & bnep_session_sem ) ; ss = __bnep_get_session ( dst ) ; if ( ss && ss -> state == BT_CONNECTED ) { err = - EEXIST ; goto failed ; } s = netdev_priv ( dev ) ; memcpy ( s -> eh. h_dest, & src, ETH_ALEN ) ; memcpy ( s -> eh. h_source, & dst, ETH_ALEN ) ; memcpy ( dev -> dev_addr, s -> eh. h_dest, ETH_ALEN ) ; s -> dev = dev ; s -> sock = sock ; s -> role = req -> role ; s -> state = BT_CONNECTED ; s -> msg. msg_flags = MSG_NOSIGNAL ; # ifdef CONFIG_BT_BNEP_MC_FILTER set_bit ( bnep_mc_hash ( dev -> broadcast ), ( ulong * ) & s -> mc_filter ) ; # endif # ifdef CONFIG_BT_BNEP_PROTO_FILTER bnep_set_default_proto_filter ( s ) ; # endif SET_NETDEV_DEV ( dev, bnep_get_device ( s ) ) ; SET_NETDEV_DEVTYPE ( dev, & bnep_type ) ; err = register_netdev ( dev ) ; if ( err ) goto failed ; __bnep_link_session ( s ) ; __module_

Fix:
<S2SV_ModStart> "" ) ; if (! l2cap_is_socket ( sock ) ) return - EBADFD ;
Buggy code:
 static Image * ReadCALSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char filename [ MagickPathExtent ], header [ MagickPathExtent ], message [ MagickPathExtent ] ; FILE * file ; Image * image ; ImageInfo * read_info ; int c, unique_file ; MagickBooleanType status ; register ssize_t i ; unsigned long density, direction, height, orientation, pel_path, type, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) memset ( header, 0, sizeof ( header ) ) ; density = 0 ; direction = 0 ; orientation = 1 ; pel_path = 0 ; type = 1 ; width = 0 ; height = 0 ; for ( i = 0 ; i < 16 ; i ++ ) { if ( ReadBlob ( image, 128, ( unsigned char * ) header )!= 128 ) break ; switch ( * header ) { case 'R' : case 'r' : { if ( LocaleNCompare ( header, "rdensty:", 8 ) == 0 ) { ( void ) sscanf ( header + 8, "%lu", & density ) ; break ; } if ( LocaleNCompare ( header, "rpelcnt:", 8 ) == 0 ) { ( void ) sscanf ( header + 8, "%lu,%lu", & width, & height ) ; break ; } if ( LocaleNCompare ( header, "rorient:", 8 ) == 0 ) { ( void ) sscanf ( header + 8, "%lu,%lu", & pel_path, & direction ) ; if ( pel_path == 90 ) orientation = 5 ; else if ( p

Fix:
<S2SV_ModStart>!= EOF ) if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 static void handle_data_packet ( struct mt_connection * curconn, struct mt_mactelnet_hdr * pkthdr, int data_len ) { struct mt_mactelnet_control_hdr cpkt ; struct mt_packet pdata ; unsigned char * data = pkthdr -> data ; unsigned int act_size = 0 ; int got_user_packet = 0 ; int got_pass_packet = 0 ; int got_width_packet = 0 ; int got_height_packet = 0 ; int success ; success = parse_control_packet ( data, data_len - MT_HEADER_LEN, & cpkt ) ; while ( success ) { if ( cpkt. cptype == MT_CPTYPE_BEGINAUTH ) { int plen, i ; if (! curconn -> have_pass_salt ) { for ( i = 0 ; i < 16 ; ++ i ) { curconn -> pass_salt [ i ] = rand ( ) % 256 ; } curconn -> have_pass_salt = 1 ; memset ( curconn -> trypassword, 0, sizeof ( curconn -> trypassword ) ) ; } init_packet ( & pdata, MT_PTYPE_DATA, pkthdr -> dstaddr, pkthdr -> srcaddr, pkthdr -> seskey, curconn -> outcounter ) ; plen = add_control_packet ( & pdata, MT_CPTYPE_PASSSALT, ( curconn -> pass_salt ), 16 ) ; curconn -> outcounter += plen ; send_udp ( curconn, & pdata ) ; } else if ( cpkt. cptype == MT_CPTYPE_USERNAME && curconn -> state!= STATE_ACTIVE ) { memcpy ( curconn -> username, cpkt. data, act_size = ( cpkt. length > MT_MNDP_MAX_STRING_SIZE - 1? MT_MNDP_MAX_STRING_SIZE - 1 : cpkt. length ) ) ; curconn -> username [ act_size ] = 0 ; got_user_packet = 1 ; } else if ( cpkt. cptype == MT_CPTYPE_TERM_WIDTH && cpkt. length >= 2 ) { unsigned short width ; memcpy ( & width, cpkt. data, 2 ) ; curconn -> terminal_width = le16toh

Fix:
<S2SV_ModStart> cptype == MT_CPTYPE_PASSWORD && cpkt. length == 17 <S2SV_ModStart>, _ ( "(%d) <S2SV_blank> Unhandeled <S2SV_blank> control <S2SV_blank> packet <S2SV_blank> type: <S2SV_blank> %d, <S2SV_blank> length: <S2SV_blank> %d" <S2SV_ModEnd> ), curconn <S2SV_ModStart> cpkt. cptype, cpkt. length
Buggy code:
 mod_ty string_object_to_c_ast ( const char * s, PyObject * filename, int start, PyCompilerFlags * flags, int feature_version, PyArena * arena ) { mod_ty mod ; PyCompilerFlags localflags ; perrdetail err ; int iflags = PARSER_FLAGS ( flags ) ; <START_BUG> node * n = Ta3Parser_ParseStringObject ( s, filename, <END_BUG> & _Ta3Parser_Grammar, start, & err, & iflags ) ; if ( flags == NULL ) { localflags. cf_flags = 0 ; flags = & localflags ; } if ( n ) { flags -> cf_flags |= iflags & PyCF_MASK ; mod = Ta3AST_FromNodeObject ( n, flags, filename, feature_version, arena ) ; Ta3Node_Free ( n ) ; } else { err_input ( & err ) ; mod = NULL ; } err_free ( & err ) ; return mod ; }

Fix:
<S2SV_ModStart> ; node * n ; if ( feature_version >= 7 ) iflags |= PyPARSE_ASYNC_ALWAYS ;
Buggy code:
 SYSCALL_DEFINE6 ( recvfrom, int, fd, void __user *, ubuf, size_t, size, unsigned int, flags, struct sockaddr __user *, addr, int __user *, addr_len ) { struct socket * sock ; struct iovec iov ; struct msghdr msg ; struct sockaddr_storage address ; int err, err2 ; int fput_needed ; if ( size > INT_MAX ) <START_BUG> size = INT_MAX ; <END_BUG> sock = sockfd_lookup_light ( fd, & err, & fput_needed ) ; if (! sock ) goto out ; msg. msg_control = NULL ; msg. msg_controllen = 0 ; iov. iov_len = size ; iov. iov_base = ubuf ; iov_iter_init ( & msg. msg_iter, READ, & iov, 1, size ) ; msg. msg_name = addr? ( struct sockaddr * ) & address : NULL ; msg. msg_namelen = 0 ; if ( sock -> file -> f_flags & O_NONBLOCK ) flags |= MSG_DONTWAIT ; err = sock_recvmsg ( sock, & msg, size, flags ) ; if ( err >= 0 && addr!= NULL ) { err2 = move_addr_to_user ( & address, msg. msg_namelen, addr, addr_len ) ; if ( err2 < 0 ) err = err2 ; } fput_light ( sock -> file, fput_needed ) ; out : return err ; }

Fix:
<S2SV_ModStart> size = INT_MAX ; if ( unlikely (! access_ok ( VERIFY_WRITE, ubuf, size ) ) ) return - EFAULT
Buggy code:
 int kvm_vm_ioctl_check_extension ( struct kvm * kvm, long ext ) { int r ; int hv_enabled = kvmppc_hv_ops? 1 : 0 ; if ( kvm ) { hv_enabled = is_kvmppc_hv_enabled ( kvm ) ; } switch ( ext ) { # ifdef CONFIG_BOOKE case KVM_CAP_PPC_BOOKE_SREGS : case KVM_CAP_PPC_BOOKE_WATCHDOG : case KVM_CAP_PPC_EPR : # else case KVM_CAP_PPC_SEGSTATE : case KVM_CAP_PPC_HIOR : case KVM_CAP_PPC_PAPR : # endif case KVM_CAP_PPC_UNSET_IRQ : case KVM_CAP_PPC_IRQ_LEVEL : case KVM_CAP_ENABLE_CAP : case KVM_CAP_ENABLE_CAP_VM : case KVM_CAP_ONE_REG : case KVM_CAP_IOEVENTFD : case KVM_CAP_DEVICE_CTRL : case KVM_CAP_IMMEDIATE_EXIT : r = 1 ; break ; case KVM_CAP_PPC_PAIRED_SINGLES : case KVM_CAP_PPC_OSI : case KVM_CAP_PPC_GET_PVINFO : # if defined ( CONFIG_KVM_E500V2 ) || defined ( CONFIG_KVM_E500MC ) case KVM_CAP_SW_TLB : # endif r =! hv_enabled ; break ; # ifdef CONFIG_KVM_MPIC case KVM_CAP_IRQ_MPIC : r = 1 ; break ; # endif # ifdef CONFIG_PPC_BOOK3S_64 case KVM_CAP_SPAPR_TCE : case KVM_CAP_SPAPR_TCE_64 : case KVM_CAP_SPAPR_TCE_VFIO : case KVM_CAP_PPC_RTAS : case KVM_CAP_PPC_FIXUP_HCALL : case KVM_CAP_PPC_ENABLE_HCALL : # ifdef CONFIG_KVM_XICS case KVM

Fix:
<S2SV_ModStart> CPU_FTR_TM_COMP ) && hv_enabled <S2SV_ModEnd> ; break ;
Buggy code:
 struct clock_source * dce112_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( struct dce110_clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dce112_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;
Buggy code:
 int install_thread_keyring_to_cred ( struct cred * new ) { <START_BUG> struct key * keyring ; <END_BUG> keyring = keyring_alloc ( "_tid", new -> uid, new -> gid, new, KEY_POS_ALL | KEY_USR_VIEW, KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL ) ; if ( IS_ERR ( keyring ) ) return PTR_ERR ( keyring ) ; new -> thread_keyring = keyring ; return 0 ; }

Fix:
<S2SV_ModStart> key * keyring ; if ( new -> thread_keyring ) return 0
Buggy code:
 PyObject * ast2obj_keyword ( void * _o ) { keyword_ty o = ( keyword_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } result = PyType_GenericNew ( keyword_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_identifier ( o -> arg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_arg, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> value ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_value, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } result
Buggy code:
 static Image * ReadSCREENSHOTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = ( Image * ) NULL ; # if defined ( MAGICKCORE_WINGDI32_DELEGATE ) { BITMAPINFO bmi ; DISPLAY_DEVICE device ; HBITMAP bitmap, bitmapOld ; HDC bitmapDC, hDC ; Image * screen ; int i ; MagickBooleanType status ; register Quantum * q ; register ssize_t x ; RGBTRIPLE * p ; ssize_t y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; i = 0 ; device. cb = sizeof ( device ) ; image = ( Image * ) NULL ; while ( EnumDisplayDevices ( NULL, i, & device, 0 ) && ++ i ) { if ( ( device. StateFlags & DISPLAY_DEVICE_ACTIVE )!= DISPLAY_DEVICE_ACTIVE ) continue ; hDC = CreateDC ( device. DeviceName, device. DeviceName, NULL, NULL ) ; if ( hDC == ( HDC ) NULL ) ThrowReaderException ( CoderError, "UnableToCreateDC" ) ; screen = AcquireImage ( image_info, exception ) ; screen -> columns = ( size_t ) GetDeviceCaps ( hDC, HORZRES ) ; screen -> rows = ( size_t ) GetDeviceCaps ( hDC, VERTRES ) ; screen -> storage_class = DirectClass ; <START_BUG> status = SetImageExtent ( screen, screen -> columns, screen -> rows, exception ) ; <END_BUG> if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ;  if ( image == ( Image * ) NULL ) <START_BUG> image = screen ; else AppendImageToList ( & image, screen ) ; bitmapDC = CreateCompatibleDC ( hDC ) ; if ( bitmapDC == ( HDC ) NULL ) { DeleteDC ( hDC ) ; ThrowReaderException ( CoderError, "UnableToCreateDC" ) ; } ( void ) ResetMagickMemory<END_BUG>

Fix:
<S2SV_ModStart> = DirectClass ; if ( image == ( Image * ) NULL ) image = screen ; else AppendImageToList ( & image, screen ) ; <S2SV_ModStart> ) ) ; <S2SV_ModEnd> bitmapDC = CreateCompatibleDC
Buggy code:
 static int skcipher_recvmsg ( struct kiocb * unused, struct socket * sock, struct msghdr * msg, size_t ignored, int flags ) { struct sock * sk = sock -> sk ; struct alg_sock * ask = alg_sk ( sk ) ; struct skcipher_ctx * ctx = ask -> private ; unsigned bs = crypto_ablkcipher_blocksize ( crypto_ablkcipher_reqtfm ( & ctx -> req ) ) ; struct skcipher_sg_list * sgl ; struct scatterlist * sg ; unsigned long iovlen ; struct iovec * iov ; int err = - EAGAIN ; int used ; long copied = 0 ; <START_BUG> lock_sock ( sk ) ; <END_BUG> for ( iov = msg -> msg_iov, iovlen = msg -> msg_iovlen ; iovlen > 0 ; iovlen --, iov ++ ) { unsigned long seglen = iov -> iov_len ; char __user * from = iov -> iov_base ; while ( seglen ) { sgl = list_first_entry ( & ctx -> tsgl, struct skcipher_sg_list, list ) ; sg = sgl -> sg ; while (! sg -> length ) sg ++ ; used = ctx -> used ; if (! used ) { err = skcipher_wait_for_data ( sk, flags ) ; if ( err ) goto unlock ; } used = min_t ( unsigned long, used, seglen ) ; used = af_alg_make_sg ( & ctx -> rsgl, from, used, 1 ) ; err = used ; if ( err < 0 ) goto unlock ; if ( ctx -> more || used < ctx -> used ) used -= used % bs ; err = - EINVAL ; if (! used ) goto free ; ablkcipher_request_set_crypt ( & ctx -> req, sg, ctx -> rsgl. sg, used, ctx -> iv ) ; err = af_alg_wait_for_completion ( ctx -> enc? crypto_ablkcipher_encrypt ( & ctx -> req ) : crypto_ablkcipher_decrypt ( & ctx -> req ), & ctx -> completion ) ; free : af_alg_free_sg ( & ctx -> rsgl ) ; if ( err ) goto unlock ; copied += used ; from

Fix:
<S2SV_ModStart> ( sk ) ; msg -> msg_namelen = 0
Buggy code:
 smb_sdrc_t smb_com_flush ( smb_request_t * sr ) { smb_ofile_t * file ; smb_llist_t * flist ; int rc ; if ( smb_flush_required == 0 ) { rc = smbsr_encode_empty_result ( sr ) ; return ( ( rc == 0 )? SDRC_SUCCESS : SDRC_ERROR ) ; } if ( sr -> smb_fid!= 0xffff ) { smbsr_lookup_file ( sr ) ; if ( sr -> fid_ofile == NULL ) { smbsr_error ( sr, NT_STATUS_INVALID_HANDLE, ERRDOS, ERRbadfid ) ; return ( SDRC_ERROR ) ; } <START_BUG> smb_flush_file ( sr, sr -> fid_ofile ) ; <END_BUG> } else { flist = & sr -> tid_tree -> t_ofile_list ; smb_llist_enter ( flist, RW_READER ) ; file = smb_llist_head ( flist ) ; while ( file ) { mutex_enter ( & file -> f_mutex ) ;  smb_flush_file ( sr, file ) ; <START_BUG> mutex_exit ( & file -> f_mutex ) ; file = smb_llist_next ( flist, file ) ; } smb_llist_exit ( flist ) ; } rc = smbsr_encode_empty_result ( sr ) ; return ( ( rc == 0 )? SDRC_SUCCESS : SDRC_ERROR ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ; } smb_ofile_flush <S2SV_ModEnd> ( sr, <S2SV_ModStart> f_mutex ) ; smb_ofile_flush <S2SV_ModEnd> ( sr,
Buggy code:
 static __u8 * pl_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { <START_BUG> if ( * rsize >= 60 && rdesc [ 39 ] == 0x2a && rdesc [ 40 ] == 0xf5 && <END_BUG> rdesc [ 41 ] == 0x00 && rdesc [ 59 ] == 0x26 && rdesc [ 60 ] == 0xf9 && rdesc [ 61 ] == 0x00 ) { hid_info ( hdev, "fixing   up   Petalynx   Maxter   Remote   report   descriptor\\n" ) ; rdesc [ 60 ] = 0xfa ; rdesc [ 40 ] = 0xfa ; } return rdesc ; }

Fix:
<S2SV_ModStart> * rsize >= 62 <S2SV_ModEnd> && rdesc [
Buggy code:
 static REFERENCE_MODE read_frame_reference_mode ( const VP9_COMMON * cm, <START_BUG> vp9_reader * r ) { <END_BUG> if ( is_compound_reference_allowed ( cm ) ) {  return vp9_read_bit ( r )? ( vp9_read_bit ( r )? REFERENCE_MODE_SELECT <START_BUG> : COMPOUND_REFERENCE ) : SINGLE_REFERENCE ; } else { return SINGLE_REFERENCE ; } }<END_BUG>

Fix:
<S2SV_ModStart> * cm, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> ) { return vpx_read_bit <S2SV_ModEnd> ( r ) <S2SV_ModStart> )? ( vpx_read_bit <S2SV_ModEnd> ( r )