nus-yam/ex-repair huggingface dataset:
Buggy code:
 void bit_write_MC ( Bit_Chain * dat, BITCODE_MC val ) { int i, j ; int negative = 0 ; unsigned char byte [ 5 ] ; BITCODE_UMC mask = 0x0000007f ; BITCODE_UMC value = ( BITCODE_UMC ) val ; if ( val < 0 ) { negative = 1 ; value = ( BITCODE_UMC ) - val ; } for ( i = 4, j = 0 ; i >= 0 ; i --, j += 7 ) { byte [ i ] = ( unsigned char ) ( ( value & mask ) >> j ) ; byte [ i ] |= 0x80 ; mask = mask << 7 ; } for ( i = 0 ; i < 4 ; i ++ ) if ( byte [ i ] & 0x7f ) break ; <START_BUG> if ( byte [ i ] & 0x40 ) <END_BUG> i -- ; byte [ i ] &= 0x7f ; if ( negative ) byte [ i ] |= 0x40 ; for ( j = 4 ; j >= i ; j -- ) bit_write_RC ( dat, byte [ j ] ) ; }

Fix:
<S2SV_ModStart> ] & 0x40 && i > 0
Buggy code:
 static void ifb_setup ( struct net_device * dev ) { dev -> destructor = free_netdev ; dev -> netdev_ops = & ifb_netdev_ops ; ether_setup ( dev ) ; dev -> tx_queue_len = TX_Q_LIMIT ; dev -> features |= IFB_FEATURES ; dev -> vlan_features |= IFB_FEATURES ; dev -> flags |= IFF_NOARP ; dev -> flags &= ~ IFF_MULTICAST ; <START_BUG> dev -> priv_flags &= ~ IFF_XMIT_DST_RELEASE ; <END_BUG> random_ether_addr ( dev -> dev_addr ) ; }

Fix:
<S2SV_ModStart> priv_flags &= ~ ( IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING ) <S2SV_ModEnd> ; random_ether_addr (
Buggy code:
 <START_BUG> static void nfs4_return_incompatible_delegation ( struct inode * inode, mode_t open_flags ) <END_BUG> { struct nfs_delegation * delegation ; rcu_read_lock ( ) ; delegation = rcu_dereference ( NFS_I ( inode ) -> delegation ) ;  if ( delegation == NULL || ( delegation -> type & open_flags ) == open_flags ) { <START_BUG> rcu_read_unlock ( ) ; return ; } rcu_read_unlock ( ) ; nfs_inode_return_delegation ( inode ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * inode, fmode_t fmode <S2SV_ModEnd> ) { struct <S2SV_ModStart> -> type & fmode ) == fmode <S2SV_ModEnd> ) { rcu_read_unlock
Buggy code:
 int hugetlb_mcopy_atomic_pte ( struct mm_struct * dst_mm, pte_t * dst_pte, struct vm_area_struct * dst_vma, unsigned long dst_addr, unsigned long src_addr, struct page * * pagep ) { <START_BUG> int vm_shared = dst_vma -> vm_flags & VM_SHARED ; <END_BUG> struct hstate * h = hstate_vma ( dst_vma ) ; pte_t _dst_pte ; spinlock_t * ptl ; int ret ; struct page * page ; if (! * pagep ) { ret = - ENOMEM ; page = alloc_huge_page ( dst_vma, dst_addr, 0 ) ; if ( IS_ERR ( page ) ) goto out ; ret = copy_huge_page_from_user ( page, ( const void __user * ) src_addr, pages_per_huge_page ( h ), false ) ; if ( unlikely ( ret ) ) { ret = - EFAULT ; * pagep = page ; goto out ; } } else { page = * pagep ; * pagep = NULL ; } __SetPageUptodate ( page ) ; set_page_huge_active ( page ) ;  if ( vm_shared ) { <START_BUG> <END_BUG> struct address_space * mapping = dst_vma -> vm_file -> f_mapping ;  pgoff_t idx = vma_hugecache_offset ( h, dst_vma, dst_addr ) ; ret = huge_add_to_page_cache ( page, mapping, idx ) ; if ( ret ) goto out_release_nounlock ; } ptl = huge_pte_lockptr ( h, dst_mm, dst_pte ) ; <START_BUG> spin_lock ( ptl ) ; <END_BUG> ret = - EEXIST ; if (! huge_pte_none ( huge_ptep_get ( dst_pte ) ) ) goto out_release_unlock ; if ( vm_shared ) { page_dup_rmap ( page, true ) ; } else { ClearPagePrivate ( page ) ; hugepage_add_new_anon_rmap ( page, dst_vma, dst_addr ) ; } _dst_pt

Fix:
<S2SV_ModStart> pagep ) { struct address_space * mapping ; pgoff_t idx ; unsigned long size ; <S2SV_ModStart> page ) ; mapping = dst_vma -> vm_file -> f_mapping ; idx = vma_hugecache_offset ( h, dst_vma, dst_addr ) ; <S2SV_ModStart> vm_shared ) { size = i_size_read ( mapping -> host ) >> huge_page_shift ( h ) ; ret = - EFAULT ; if ( idx >= size ) goto out_release_nounlock <S2SV_ModEnd> ; ret = <S2SV_ModStart> ( ptl ) ; size = i_size_read ( mapping -> host ) >> huge_page_shift ( h ) ; ret = - EFAULT ; if ( idx >= size ) goto out_release_unlock
Buggy code:
 int dwg_encode_add_object ( Dwg_Object * restrict obj, Bit_Chain * restrict dat, unsigned long address ) { int error = 0 ; unsigned long oldpos ; unsigned long end_address = address + obj -> size ; oldpos = bit_position ( dat ) ; assert ( address ) ; dat -> byte = address ; dat -> bit = 0 ; LOG_INFO ( "Object   number:   %lu", ( unsigned long ) obj -> index ) ; if ( obj -> size > 0x100000 ) { LOG_ERROR ( "Object   size   %u   overflow", obj -> size ) ; return DWG_ERR_VALUEOUTOFBOUNDS ; } while ( dat -> byte + obj -> size >= dat -> size ) bit_chain_alloc ( dat ) ; bit_write_MS ( dat, obj -> size ) ; obj -> address = dat -> byte ; PRE ( R_2010 ) { bit_write_BS ( dat, obj -> type ) ; LOG_INFO ( ",   Size:   %d   [MS],   Type:   %d   [BS]\\n", obj -> size, obj -> type ) } LATER_VERSIONS { if (! obj -> handlestream_size && obj -> bitsize ) obj -> handlestream_size = obj -> size * 8 - obj -> bitsize ; bit_write_UMC ( dat, obj -> handlestream_size ) ; obj -> address = dat -> byte ; bit_write_BOT ( dat, obj -> type ) ; LOG_INFO ( ",   Size:   %d   [MS],   Hdlsize:   %lu   [UMC],   Type:   %d   [BOT]\\n", obj -> size, ( unsigned long ) obj -> handlestream_size, obj -> type ) } switch ( obj -> type ) { case DWG_TYPE_TEXT : error = dwg_encode_TEXT ( dat, obj ) ; break ; case DWG_TYPE_ATTRIB : error = dwg_encode_ATTRIB ( dat, obj ) ; break ; case DWG_TYPE_ATTDEF : error = dwg_encode_ATTDEF ( dat, obj ) ; break ; case DWG_TYPE_BLOCK : error = dwg_encode_BLOCK ( dat, obj ) ;

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> is_entity ) error <S2SV_ModStart> ) error = dwg_encode_UNKNOWN_ENT ( dat, obj ) ; else error = <S2SV_ModStart> obj ) ; <S2SV_ModEnd> } } if
Buggy code:
 int yr_execute_code ( YR_RULES * rules, YR_SCAN_CONTEXT * context, int timeout, time_t start_time ) { int64_t mem [ MEM_SIZE ] ; int32_t sp = 0 ; uint8_t * ip = rules -> code_start ; YR_VALUE args [ MAX_FUNCTION_ARGS ] ; YR_VALUE * stack ; YR_VALUE r1 ; YR_VALUE r2 ; YR_VALUE r3 ; # ifdef PROFILING_ENABLED YR_RULE * current_rule = NULL ; # endif YR_RULE * rule ; YR_MATCH * match ; YR_OBJECT_FUNCTION * function ; <START_BUG> char * identifier ; <END_BUG> char * args_fmt ; int i ; int found ; int count ; int result = ERROR_SUCCESS ; int stop = FALSE ; int cycle = 0 ; int tidx = context -> tidx ; int stack_size ; # ifdef PROFILING_ENABLED clock_t start = clock ( ) ; # endif yr_get_configuration ( YR_CONFIG_STACK_SIZE, ( void * ) & stack_size ) ; stack = ( YR_VALUE * ) yr_malloc ( stack_size * sizeof ( YR_VALUE ) ) ; if ( stack == NULL )  return ERROR_INSUFFICIENT_MEMORY ; <START_BUG> while (! stop ) { switch ( * ip ) { case OP_NOP : break ; case OP_HALT : assert ( sp == 0 ) ; stop = TRUE ; break ; case OP_PUSH : r1. i = * ( uint64_t * ) ( ip + 1 ) ; ip += sizeof ( uint64_t ) ; push ( r1 ) ; break ; case OP_POP : pop ( r1 ) ; break ; case OP_CLEAR_M : r1. i = * ( uint64_t * ) ( ip + 1 ) ; ip += sizeof ( uint64_t ) ; mem [ r1. i ] = 0 ; break ; case OP_ADD_M : r1. i = * ( uint64_t * ) ( ip + 1 ) ; ip += sizeof ( uint64_t ) ; pop ( r2 ) ; if (! is_undef ( r2 ) ) mem [ r1. i ] += r2. i<END_BUG>

Fix:
<S2SV_ModStart> * function ; YR_OBJECT * * obj_ptr ; YR_ARENA * obj_arena ; <S2SV_ModStart> ) return ERROR_INSUFFICIENT_MEMORY ; FAIL_ON_ERROR_WITH_CLEANUP ( yr_arena_create ( 1024, 0, & obj_arena ), yr_free ( stack ) ) <S2SV_ModStart> ; # endif assert ( sp == 0 ) ; <S2SV_ModStart> == ERROR_SUCCESS ) result = yr_object_copy ( function -> return_obj, & <S2SV_ModEnd> r1. o <S2SV_ModStart> r1. o ) ; if ( result == ERROR_SUCCESS ) result = yr_arena_write_data ( obj_arena, & r1. o, sizeof ( r1. o ), NULL ) ; stop = ( result!= ERROR_SUCCESS ) ; push ( r1 ) ; <S2SV_ModEnd> break ; case <S2SV_ModStart> ++ ; } obj_ptr = ( YR_OBJECT * * ) yr_arena_base_address ( obj_arena ) ; while ( obj_ptr!= NULL ) { yr_object_destroy ( * obj_ptr ) ; obj_ptr = ( YR_OBJECT * * ) yr_arena_next_address (
Buggy code:
 static uint16_t http_dissect_hdrs ( struct worker * w, struct http * hp, int fd, char * p, const struct http_conn * htc ) { char * q, * r ; txt t = htc -> rxbuf ; if ( * p == '\\r' ) p ++ ; hp -> nhd = HTTP_HDR_FIRST ; hp -> conds = 0 ; r = NULL ; for ( ; p < t. e ; p = r ) { q = r = p ; while ( r < t. e ) { <START_BUG> if (! vct_iscrlf ( * r ) ) { <END_BUG> r ++ ; continue ; } q = r ; assert ( r < t. e ) ; r += vct_skipcrlf ( r ) ; if ( r >= t. e ) break ; if (! vct_issp ( * r ) ) break ; while ( vct_islws ( * q ) ) * q ++ =' '; } if ( q - p > htc -> maxhdr ) { VSC_C_main -> losthdr ++ ; WSL ( w, SLT_LostHeader, fd, "%.*s", q - p > 20? 20 : q - p, p ) ; return ( 413 ) ; } if ( p == q ) break ; if ( ( p [ 0 ] == 'i' || p [ 0 ] == 'I' ) && ( p [ 1 ] == 'f' || p [ 1 ] == 'F' ) && p [ 2 ] == '-' ) hp -> conds = 1 ; while ( q > p && vct_issp ( q [ - 1 ] ) ) q -- ; * q = '\\0' ; if ( hp -> nhd < hp -> shd ) { hp -> hdf [ hp -> nhd ] = 0 ; hp -> hd [ hp -> nhd ]. b = p ; hp -> hd [ hp -> nhd ]. e = q ; WSLH ( w, fd, hp, hp -> nhd ) ; hp -> nhd ++ ; } else { VSC_C_main -> losthdr ++ ; WSL ( w, SLT_LostHeader, fd, "%.*s", q - p > 20? 20 : q - p, p ) ; return ( 413 ) ; } } return ( 0 ) ;

Fix:
<S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> r ) )
Buggy code:
 int main ( int argc, char * argv [ ] ) { <START_BUG> char * p, * q, * r ; <END_BUG> Clp_Parser * clp = Clp_NewParser ( argc, ( const char * const * ) argv, sizeof ( options ) // sizeof ( options [ 0 ] ), options ) ; program_name = Clp_ProgramName ( clp ) ; while ( 1 ) { int opt = Clp_Next ( clp ) ; switch ( opt ) { case BLOCK_LEN_OPT : blocklen = clp -> val. i ; break ; output_file : case OUTPUT_OPT : if ( ofp ) fatal_error ( "output   file   already   specified" ) ; if ( strcmp ( clp -> vstr, "-" ) == 0 ) ofp = stdout ; else if (! ( ofp = fopen ( clp -> vstr, "w" ) ) ) fatal_error ( "%s:   %s", clp -> vstr, strerror ( errno ) ) ; break ; case PFB_OPT : pfb = 1 ; break ; case PFA_OPT : pfb = 0 ; break ; case HELP_OPT : usage ( ) ; exit ( 0 ) ; break ; case VERSION_OPT : printf ( "t1asm   (LCDF   t1utils)   %s\\n", VERSION ) ;  printf ( "Copyright   (C)   1992-2010   I.   Lee   Hetherington,   Eddie   Kohler   et   al.\\n\\\n   This   is   free   software;   see   the   source   for   copying   conditions.\\n\\\n   There   is   NO   warranty,   not   even   for   merchantability   or   fitness   for   a\\n\\\n   particular   purpose.\\n" ) ; <START_BUG> exit ( 0 ) ; break ; case Clp_NotOption : if ( ifp && ofp ) fatal_error ( "too   many   arguments" ) ; else if ( ifp ) goto output_file ; if ( strcmp ( clp -> vstr, "-" ) == 0 ) ifp = stdin ; else if (! ( ifp = fopen ( clp -> vstr, "r" ) ) ) fatal_error ( "%<END_BUG>

Fix:
<S2SV_ModStart>, * q <S2SV_ModEnd> ; Clp_Parser * <S2SV_ModStart> ; printf ( "Copyright <S2SV_blank> (C) <S2SV_blank> 1992-2010 <S2SV_blank> I. <S2SV_blank> Lee <S2SV_blank> Hetherington, <S2SV_blank> Eddie <S2SV_blank> Kohler <S2SV_blank> et <S2SV_blank> al.\\n\\\nThis <S2SV_blank> is <S2SV_blank> free <S2SV_blank> software; <S2SV_blank> see <S2SV_blank> the <S2SV_blank> source <S2SV_blank> for <S2SV_blank> copying <S2SV_blank> conditions.\\n\\\nThere <S2SV_blank> is <S2SV_blank> NO <S2SV_blank> warranty, <S2SV_blank> not <S2SV_blank> even <S2SV_blank> for <S2SV_blank> merchantability <S2SV_blank> or <S2SV_blank> fitness <S2SV_blank> for <S2SV_blank> a\\n\\\nparticular <S2SV_blank> purpose.\\n" <S2SV_ModEnd> ) ; exit <S2SV_ModStart> && isspace ( ( unsigned char ) <S2SV_ModStart> ; isspace ( ( unsigned char ) <S2SV_ModStart> 0 ) { set_lenIV ( line <S2SV_ModEnd> ) ; } <S2SV_ModStart> "string <S2SV_blank> currentfile" ) ) ) { set_cs_start ( line ) <S2SV_ModEnd> ; } } <S2SV_ModStart> && isdigit ( ( unsigned char ) <S2SV_ModStart> && isdigit ( ( unsigned char ) <S2SV_ModStart> ; isspace ( ( unsigned char )
Buggy code:
 static int inet_sk_reselect_saddr ( struct sock * sk ) { struct inet_sock * inet = inet_sk ( sk ) ; __be32 old_saddr = inet -> inet_saddr ; __be32 daddr = inet -> inet_daddr ; struct flowi4 fl4 ; struct rtable * rt ; __be32 new_saddr ; <START_BUG> if ( inet -> opt && inet -> opt -> srr ) <END_BUG> daddr = inet -> opt -> faddr ; rt = ip_route_connect ( & fl4, daddr, 0, RT_CONN_FLAGS ( sk ), sk -> sk_bound_dev_if, sk -> sk_protocol, inet -> inet_sport, inet -> inet_dport, sk, false ) ; if ( IS_ERR ( rt ) ) return PTR_ERR ( rt ) ; sk_setup_caps ( sk, & rt -> dst ) ; new_saddr = rt -> rt_src ; if ( new_saddr == old_saddr ) return 0 ; if ( sysctl_ip_dynaddr > 1 ) { printk ( KERN_INFO "%s():   shifting   inet->saddr   from   %pI4   to   %pI4\\n", __func__, & old_saddr, & new_saddr ) ; } inet -> inet_saddr = inet -> inet_rcv_saddr = new_saddr ; __sk_prot_rehash ( sk ) ; return 0 ; }

Fix:
<S2SV_ModStart> __be32 new_saddr ; struct ip_options_rcu * inet_opt ; inet_opt = rcu_dereference_protected ( inet -> inet_opt, sock_owned_by_user ( sk ) ) ; if ( inet_opt && inet_opt -> opt. srr ) daddr = inet_opt -> opt. <S2SV_ModEnd> faddr ; rt
Buggy code:
 int vfs_rename ( struct inode * old_dir, struct dentry * old_dentry, struct inode * new_dir, struct dentry * new_dentry, struct inode * * delegated_inode, unsigned int flags ) { int error ; bool is_dir = d_is_dir ( old_dentry ) ; <START_BUG> const unsigned char * old_name ; <END_BUG> struct inode * source = old_dentry -> d_inode ; struct inode * target = new_dentry -> d_inode ; bool new_is_dir = false ; unsigned max_links = new_dir -> i_sb -> s_max_links ;  if ( source == target ) <START_BUG> return 0 ; error = may_delete ( old_dir, old_dentry, is_dir ) ; if ( error ) return error ; if (! target ) { error = may_create ( new_dir, new_dentry ) ; } else { new_is_dir = d_is_dir ( new_dentry ) ; if (! ( flags & RENAME_EXCHANGE ) ) error = may_delete ( new_dir, new_dentry, is_dir ) ; else error = may_delete ( new_dir, new_dentry, new_is_dir ) ; } if ( error ) return error ; if (! old_dir -> i_op -> rename ) return - EPERM ; if ( new_dir!= old_dir ) { if ( is_dir ) { error = inode_permission ( source, MAY_WRITE ) ; if ( error ) return error ; } if ( ( flags & RENAME_EXCHANGE ) && new_is_dir ) { error = inode_permission ( target, MAY_WRITE ) ; if ( error ) return error ; } } error = security_inode_rename ( old_dir, old_dentry, new_dir, new_dentry, flags ) ; if ( error ) return error ; <END_BUG> old_name = fsnotify_oldname_init ( old_dentry -> d_name. name ) ;  dget ( new_dentry ) ; if (! is_dir || ( flags & RENAME_EXCHANGE ) ) lock_two_nondirectories ( source, target ) ; else if ( target ) inode_lock ( target ) ; error = - EBU

Fix:
<S2SV_ModStart> old_dentry ) ; <S2SV_ModEnd> struct inode * <S2SV_ModStart> -> s_max_links ; struct name_snapshot old_name ; <S2SV_ModStart> return error ; take_dentry_name_snapshot ( & old_name, old_dentry ) ; dget ( new_dentry ) ; if (! is_dir || ( flags & RENAME_EXCHANGE ) ) lock_two_nondirectories ( source, target ) ; else if ( target ) inode_lock ( target ) ; error = - EBUSY ; if ( is_local_mountpoint ( old_dentry ) || is_local_mountpoint ( new_dentry ) ) goto out ; if ( max_links && new_dir!= old_dir ) { error = - EMLINK ; if ( is_dir &&! new_is_dir && new_dir -> i_nlink >= max_links ) goto out ; if ( ( flags & RENAME_EXCHANGE ) &&! is_dir && new_is_dir && old_dir -> i_nlink >= max_links ) goto out ; } if ( is_dir &&! ( flags & RENAME_EXCHANGE ) && target ) shrink_d
Buggy code:
 int copy_thread ( unsigned long clone_flags, unsigned long stack_start, unsigned long stk_sz, struct task_struct * p ) { struct thread_info * thread = task_thread_info ( p ) ; struct pt_regs * childregs = task_pt_regs ( p ) ; memset ( & thread -> cpu_context, 0, sizeof ( struct cpu_context_save ) ) ; if ( likely (! ( p -> flags & PF_KTHREAD ) ) ) { * childregs = * current_pt_regs ( ) ; childregs -> ARM_r0 = 0 ; if ( stack_start ) childregs -> ARM_sp = stack_start ; } else { memset ( childregs, 0, sizeof ( struct pt_regs ) ) ; thread -> cpu_context. r4 = stk_sz ; thread -> cpu_context. r5 = stack_start ; childregs -> ARM_cpsr = SVC_MODE ; } thread -> cpu_context. pc = ( unsigned long ) ret_from_fork ; thread -> cpu_context. sp = ( unsigned long ) childregs ; clear_ptrace_hw_breakpoint ( p ) ; if ( clone_flags & CLONE_SETTLS ) <START_BUG> thread -> tp_value = childregs -> ARM_r3 ; <END_BUG> thread_notify ( THREAD_NOTIFY_COPY, thread ) ; return 0 ; }

Fix:
<S2SV_ModStart> thread -> tp_value [ 0 ] <S2SV_ModStart> childregs -> ARM_r3 ; thread -> tp_value [ 1 ] = get_tpuser ( )
Buggy code:
 static int pppoe_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t total_len, int flags ) { struct sock * sk = sock -> sk ; struct sk_buff * skb ; int error = 0 ; if ( sk -> sk_state & PPPOX_BOUND ) { error = - EIO ; goto end ; } skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & error ) ; if ( error < 0 ) goto end ; <START_BUG> m -> msg_namelen = 0 ; <END_BUG> if ( skb ) { total_len = min_t ( size_t, total_len, skb -> len ) ; error = skb_copy_datagram_iovec ( skb, 0, m -> msg_iov, total_len ) ; if ( error == 0 ) { consume_skb ( skb ) ; return total_len ; } } kfree_skb ( skb ) ; end : return error ; }

Fix:
<S2SV_ModStart> goto end ; <S2SV_ModEnd> if ( skb
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; PixelPacket * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; size_t Unknown6 ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; <START_BUG> logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; <END_BUG> image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image2 ; goto END_OF_READING ;

Fix:
<S2SV_ModStart>, "enter" ) ; quantum_info = ( QuantumInfo * ) NULL <S2SV_ModStart> BImgBuff ) ; if ( quantum_info!= ( QuantumInfo * ) NULL )
Buggy code:
 static int rc_pick_q_and_bounds_one_pass_vbr ( const VP9_COMP * cpi, int * bottom_index, int * top_index ) { const VP9_COMMON * const cm = & cpi -> common ; const RATE_CONTROL * const rc = & cpi -> rc ; <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG>  int active_best_quality ; <START_BUG> int active_worst_quality = calc_active_worst_quality_one_pass_vbr ( cpi ) ; int q ; <END_BUG> if ( frame_is_intra_only ( cm ) ) {  <START_BUG> active_best_quality = rc -> best_quality ; <END_BUG> # if! CONFIG_MULTIPLE_ARF if ( rc -> this_key_frame_forced ) { int qindex = rc -> last_boosted_qindex ;  double last_boosted_q = vp9_convert_qindex_to_q ( qindex ) ; <START_BUG> int delta_qindex = vp9_compute_qdelta ( rc, last_boosted_q, <END_BUG> last_boosted_q * 0.75 ) ;  active_best_quality = MAX ( qindex + delta_qindex, rc -> best_quality ) ; <START_BUG> } else if ( cm -> current_video_frame > 0 ) { <END_BUG> double q_adj_factor = 1.0 ; double q_val ;  active_best_quality = get_active_quality ( rc -> avg_frame_qindex [ KEY_FRAME ], <START_BUG> <END_BUG> rc -> kf_boost,  kf_low, kf_high, kf_low_motion_minq, kf_high_motion_minq ) ; if ( ( cm -> width * cm -> height ) <= ( 352 * 288 ) ) { q_adj_factor -= 0.25 ; } <START_BUG> q_val = vp9_convert_qindex_to_q ( active_best_quality ) ; <END_BUG> active_best_quality += vp9_compute_qdelta ( rc, q_val,  q_val * q_adj_factor ) ; <START_BUG> } # else double current_q ; current_q = vp9_convert_qindex_to_q ( active<END_BUG>

Fix:
<S2SV_ModStart> rc ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> -> oxcf ; const int cq_level = get_active_cq_level ( rc, oxcf ) ; <S2SV_ModStart> int q ; int * inter_minq ; ASSIGN_MINQ_TABLE ( cm -> bit_depth, inter_minq ) ; <S2SV_ModStart> ) ) { <S2SV_ModEnd> if ( rc <S2SV_ModStart> vp9_convert_qindex_to_q ( qindex, cm -> bit_depth <S2SV_ModStart> last_boosted_q * 0.75, cm -> bit_depth <S2SV_ModStart> ; } else <S2SV_ModEnd> { double q_adj_factor <S2SV_ModStart> ; active_best_quality = get_kf_active_quality ( rc, <S2SV_ModEnd> rc -> avg_frame_qindex <S2SV_ModStart> KEY_FRAME ], cm -> bit_depth <S2SV_ModEnd> ) ; if <S2SV_ModStart> vp9_convert_qindex_to_q ( active_best_quality, cm -> bit_depth <S2SV_ModStart> q_val * q_adj_factor, cm -> bit_depth ) ; } <S2SV_ModEnd> } else if <S2SV_ModStart> ( oxcf -> rc_mode == VPX_CQ <S2SV_ModEnd> ) { if <S2SV_ModStart> ( q < cq_level ) q = c
Buggy code:
 static int cfm_network_addr_print ( netdissect_options * ndo, <START_BUG> register const u_char * tptr ) <END_BUG> { u_int network_addr_type ;  u_int hexdump = FALSE ; <START_BUG> network_addr_type = * tptr ; ND_PRINT ( ( ndo, "\\n\\t     Network   Address   Type   %s   (%u)", tok2str ( af_values, "Unknown", network_addr_type ), network_addr_type ) ) ; switch ( network_addr_type ) { case AFNUM_INET : <END_BUG> ND_PRINT ( ( ndo, ",   %s", ipaddr_string ( ndo, tptr + 1 ) ) ) ;  break ; case AFNUM_INET6 : <START_BUG> ND_PRINT ( ( ndo, ",   %s", ip6addr_string ( ndo, tptr + 1 ) ) ) ; <END_BUG> break ; default : hexdump = TRUE ; break ; } return hexdump ; }

Fix:
<S2SV_ModStart> u_char * tptr, const u_int length ) { u_int network_addr_type ; u_int <S2SV_ModEnd> hexdump = FALSE <S2SV_ModStart> = FALSE ; if ( length < 1 ) { ND_PRINT ( ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> Network <S2SV_blank> Address <S2SV_blank> Type <S2SV_blank> (invalid, <S2SV_blank> no <S2SV_blank> data" ) ) ; return hexdump ; } <S2SV_ModStart> case AFNUM_INET : if ( length!= 1 + 4 ) { ND_PRINT ( ( ndo, "(invalid <S2SV_blank> IPv4 <S2SV_blank> address <S2SV_blank> length <S2SV_blank> %u)", length - 1 ) ) ; hexdump = TRUE ; break ; } <S2SV_ModStart> case AFNUM_INET6 : if ( length!= 1 + 16 ) { ND_PRINT ( ( ndo, "(invalid <S2SV_blank> IPv6 <S2SV_blank> address <S2SV_blank> length <S2SV_blank> %u)", length - 1 ) ) ; hexdump = TRUE ; break ; }
Buggy code:
 static int dalvik_disassemble ( RAsm * a, RAsmOp * op, const ut8 * buf, int len ) { int vA, vB, vC, payload = 0, i = ( int ) buf [ 0 ] ; int size = dalvik_opcodes [ i ]. len ; char str [ 1024 ], * strasm ; ut64 offset ; const char * flag_str ; op -> buf_asm [ 0 ] = 0 ; if ( buf [ 0 ] == 0x00 ) { switch ( buf [ 1 ] ) { case 0x01 : { unsigned short array_size = buf [ 2 ] | ( buf [ 3 ] << 8 ) ; int first_key = buf [ 4 ] | ( buf [ 5 ] << 8 ) | ( buf [ 6 ] << 16 ) | ( buf [ 7 ] << 24 ) ; <START_BUG> sprintf ( op -> buf_asm, "packed-switch-payload   %d,   %d", array_size, first_key ) ; <END_BUG> size = 8 ; payload = 2 * ( array_size * 2 ) ; len = 0 ; } break ; case 0x02 : { unsigned short array_size = buf [ 2 ] | ( buf [ 3 ] << 8 ) ;  sprintf ( op -> buf_asm, "sparse-switch-payload   %d", array_size ) ; <START_BUG> size = 4 ; payload = 2 * ( array_size * 4 ) ; len = 0 ; } break ; case 0x03 : if ( len > 7 ) { unsigned short elem_width = buf [ 2 ] | ( buf [ 3 ] << 8 ) ; unsigned int array_size = buf [ 4 ] | ( buf [ 5 ] << 8 ) | ( buf [ 6 ] << 16 ) | ( buf [ 7 ] << 24 ) ; snprintf ( op -> buf_asm, sizeof ( op -> buf_asm ), "fill-array-data-payload   %d,   %d", elem_width, array_size ) ; payload = 2 * ( ( array_size * elem_width + 1 ) // 2 ) ; } size = 8 ; len = 0 ; break ; default : break ; } } strasm = NULL ; if ( size <= len ) { strncpy ( op -> buf_asm, dalvik_opcodes [ i ]<END_BUG>

Fix:
<S2SV_ModStart> 24 ) ; snprintf <S2SV_ModEnd> ( op -> <S2SV_ModStart> -> buf_asm, sizeof ( op -> buf_asm ), <S2SV_ModStart> 8 ) ; snprintf <S2SV_ModEnd> ( op -> <S2SV_ModStart> op -> buf_asm, sizeof ( op -> buf_asm ) <S2SV_ModStart> >> 4 ; snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i, <S2SV_blank> v%i", <S2SV_ModStart> 2 ] ; snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i, <S2SV_blank> v%i", <S2SV_ModStart> 4 ] ; snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i, <S2SV_blank> v%i", <S2SV_ModStart> 1 ] ; snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i", <S2SV_ModStart> >> 4 ; snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i, <S2SV_blank> %#x", <S2SV_ModStart> 2 ] ; snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i, <S2SV_blank> %#04hx", <S2SV_ModStart> # undef llint snprintf ( str, sizeof ( str ) <S2SV_ModEnd>, " <S2SV_blank> v%i:v%i, <S2SV_blank> 0x%" PFMT64x <S2SV_ModStart> 3 ] ; snprintf ( str,
Buggy code:
 static void dma_rx ( struct b43_dmaring * ring, int * slot ) { const struct b43_dma_ops * ops = ring -> ops ; struct b43_dmadesc_generic * desc ; struct b43_dmadesc_meta * meta ; struct b43_rxhdr_fw4 * rxhdr ; struct sk_buff * skb ; u16 len ; int err ; dma_addr_t dmaaddr ; desc = ops -> idx2desc ( ring, * slot, & meta ) ; sync_descbuffer_for_cpu ( ring, meta -> dmaaddr, ring -> rx_buffersize ) ; skb = meta -> skb ; rxhdr = ( struct b43_rxhdr_fw4 * ) skb -> data ; len = le16_to_cpu ( rxhdr -> frame_len ) ; if ( len == 0 ) { int i = 0 ; do { udelay ( 2 ) ; barrier ( ) ; len = le16_to_cpu ( rxhdr -> frame_len ) ; } while ( len == 0 && i ++ < 5 ) ; if ( unlikely ( len == 0 ) ) { dmaaddr = meta -> dmaaddr ; goto drop_recycle_buffer ; } } if ( unlikely ( b43_rx_buffer_is_poisoned ( ring, skb ) ) ) { b43dbg ( ring -> dev -> wl, "DMA   RX:   Dropping   poisoned   buffer.\\n" ) ; dmaaddr = meta -> dmaaddr ; goto drop_recycle_buffer ; } <START_BUG> if ( unlikely ( len > ring -> rx_buffersize ) ) { <END_BUG> int cnt = 0 ; s32 tmp = len ; while ( 1 ) { desc = ops -> idx2desc ( ring, * slot, & meta ) ; b43_poison_rx_buffer ( ring, meta -> skb ) ; sync_descbuffer_for_device ( ring, meta -> dmaaddr, ring -> rx_buffersize ) ; * slot = next_slot ( ring, * slot ) ; cnt ++ ; tmp -= ring -> rx_buffersize ; if ( tmp <= 0 ) break ; } b43err ( ring -> dev -> wl, "DMA   RX   buffer   too   small   " "(len:   %u,

Fix:
<S2SV_ModStart> unlikely ( len + ring -> frameoffset
Buggy code:
 void vp8_cal_sad ( VP8_COMP * cpi, MACROBLOCKD * xd, MACROBLOCK * x, int recon_yoffset, int near_sadidx [ ] ) { int near_sad [ 8 ] = { 0 } ; BLOCK * b = & x -> block [ 0 ] ; unsigned char * src_y_ptr = * ( b -> base_src ) ; if ( xd -> mb_to_top_edge == 0 && xd -> mb_to_left_edge == 0 ) { near_sad [ 0 ] = near_sad [ 1 ] = near_sad [ 2 ] = INT_MAX ; } else if ( xd -> mb_to_top_edge == 0 ) { near_sad [ 0 ] = near_sad [ 2 ] = INT_MAX ; <START_BUG> near_sad [ 1 ] = cpi -> fn_ptr [ BLOCK_16X16 ]. sdf ( src_y_ptr, b -> src_stride, xd -> dst. y_buffer - 16, xd -> dst. y_stride, UINT_MAX ) ; <END_BUG> } else if ( xd -> mb_to_left_edge == 0 ) { near_sad [ 1 ] = near_sad [ 2 ] = INT_MAX ;  near_sad [ 0 ] = cpi -> fn_ptr [ BLOCK_16X16 ]. sdf ( src_y_ptr, b -> src_stride, xd -> dst. y_buffer - xd -> dst. y_stride * 16, xd -> dst. y_stride, UINT_MAX ) ; <START_BUG> } else { <END_BUG> near_sad [ 0 ] = cpi -> fn_ptr [ BLOCK_16X16 ]. sdf ( src_y_ptr, b -> src_stride, xd -> dst. y_buffer - xd -> dst. y_stride * 16, xd -> dst. y_stride, UINT_MAX ) ;  <START_BUG> near_sad [ 1 ] = cpi -> fn_ptr [ BLOCK_16X16 ]. sdf ( src_y_ptr, b -> src_stride, xd -> dst. y_buffer - 16, xd -> dst. y_stride, UINT_MAX ) ; <END_BUG>  near_sad [ 2 ] = cpi -> fn_ptr [ BLOCK_16X16 ]. sdf

Fix:
<S2SV_ModStart> dst. y_stride <S2SV_ModEnd> ) ; } <S2SV_ModStart> dst. y_stride <S2SV_ModEnd> ) ; } <S2SV_ModStart> dst. y_stride <S2SV_ModEnd> ) ; near_sad <S2SV_ModStart> dst. y_stride <S2SV_ModEnd> ) ; near_sad <S2SV_ModStart> dst. y_stride <S2SV_ModEnd> ) ; } <S2SV_ModStart> 16, pre_y_stride <S2SV_ModEnd> ) ; if <S2SV_ModStart> 16, pre_y_stride <S2SV_ModEnd> ) ; near_sad <S2SV_ModStart> pre_y_buffer, pre_y_stride <S2SV_ModEnd> ) ; if <S2SV_ModStart> 16, pre_y_stride <S2SV_ModEnd> ) ; if <S2SV_ModStart> 16, pre_y_stride <S2SV_ModEnd> ) ; }
Buggy code:
 int get_rock_ridge_filename ( struct iso_directory_record * de, char * retname, struct inode * inode ) { struct rock_state rs ; struct rock_ridge * rr ; int sig ; int retnamlen = 0 ; int truncate = 0 ; int ret = 0 ; <START_BUG> if (! ISOFS_SB ( inode -> i_sb ) -> s_rock ) <END_BUG> return 0 ; * retname = 0 ; init_rock_state ( & rs, inode ) ; setup_rock_ridge ( de, inode, & rs ) ; repeat : while ( rs. len > 2 ) { rr = ( struct rock_ridge * ) rs. chr ; if ( rr -> len < 3 ) goto out ; sig = isonum_721 ( rs. chr ) ; if ( rock_check_overflow ( & rs, sig ) ) goto eio ; rs. chr += rr -> len ; rs. len -= rr -> len ; if ( rs. len < 0 ) goto out ; switch ( sig ) { case SIG ( 'R', 'R' ) : if ( ( rr -> u. RR. flags [ 0 ] & RR_NM ) == 0 ) goto out ; break ; case SIG ( 'S', 'P' ) : if ( check_sp ( rr, inode ) ) goto out ; break ; case SIG ( 'C', 'E' ) : rs. cont_extent = isonum_733 ( rr -> u. CE. extent ) ; rs. cont_offset = isonum_733 ( rr -> u. CE. offset ) ; rs. cont_size = isonum_733 ( rr -> u. CE. size ) ; break ; case SIG ( 'N', 'M' ) : if ( truncate ) break ; if ( rr -> len < 5 ) break ; if ( rr -> u. NM. flags & 6 ) break ; if ( rr -> u. NM. flags & ~ 1 ) { printk ( "Unsupported   NM   flag   settings   (%d)\\n", rr -> u. NM. flags ) ; break ; }  if ( ( strlen ( retname ) + rr -> len - 5 ) >= 254 ) { <START_BUG> truncate = 1 ; break ; } <END_BUG> strncat ( retname, rr -> u. NM. name, rr -> len - 5 )

Fix:
<S2SV_ModStart> = 0 ; char * p ; int len ; <S2SV_ModStart> break ; } len = <S2SV_ModEnd> rr -> len <S2SV_ModStart> len - 5 ; if ( retnamlen + len <S2SV_ModEnd> >= 254 ) <S2SV_ModStart> break ; } p = memchr ( rr -> u. NM. name, '\\0', len ) ; if ( unlikely ( p ) ) len = p - rr -> u. NM. name ; memcpy ( retname + retnamlen <S2SV_ModEnd>, rr -> <S2SV_ModStart>. name, len <S2SV_ModEnd> ) ; retnamlen <S2SV_ModStart> ; retnamlen += len ; retname [ retnamlen ] = '\\0' <S2SV_ModEnd> ; break ;
Buggy code:
 const char * util_acl_to_str ( const sc_acl_entry_t * e ) { static char line [ 80 ], buf [ 20 ] ; unsigned int acl ; if ( e == NULL ) return "N//A" ; line [ 0 ] = 0 ; while ( e!= NULL ) { acl = e -> method ; switch ( acl ) { case SC_AC_UNKNOWN : return "N//A" ; case SC_AC_NEVER : return "NEVR" ; case SC_AC_NONE : return "NONE" ; case SC_AC_CHV : strcpy ( buf, "CHV" ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "%d", e -> key_ref ) ; break ; case SC_AC_TERM : strcpy ( buf, "TERM" ) ; break ; case SC_AC_PRO : strcpy ( buf, "PROT" ) ; break ; case SC_AC_AUT : strcpy ( buf, "AUTH" ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 4, "%d", e -> key_ref ) ; break ; case SC_AC_SEN : strcpy ( buf, "Sec.Env.   " ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "#%d", e -> key_ref ) ; break ; case SC_AC_SCB : strcpy ( buf, "Sec.ControlByte   " ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "Ox%X", e -> key_ref ) ; break ; case SC_AC_IDA : strcpy ( buf, "PKCS#15   AuthID   " ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "#%d", e -> key_ref ) ; break ; default : strcpy ( buf, "????" ) ; break ; } <START_BUG> strcat ( line, buf ) ; <END_BUG>  strcat ( line, "   " ) ; <START_BUG> e = e -> next ; } <END_BUG>

Fix:
<S2SV_ModStart> break ; } strncat ( line, buf, sizeof line ) ; strncat <S2SV_ModEnd> ( line, <S2SV_ModStart> line, " <S2SV_blank> ", sizeof line <S2SV_ModStart> } line [ ( sizeof <S2SV_ModEnd> line ) - <S2SV_ModStart> 1 ] = '\\0' ; line [ strlen ( line ) - 1 ] =
Buggy code:
 static Sdb * store_versioninfo_gnu_verdef ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { const char * section_name = "" ; const char * link_section_name = "" ; char * end = NULL ; Elf_ ( Shdr ) * link_shdr = NULL ; ut8 dfs [ sizeof ( Elf_ ( Verdef ) ) ] = { 0 } ; Sdb * sdb ; int cnt, i ; if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return false ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; if ( ( int ) shdr -> sh_size < 1 ) { return false ; } Elf_ ( Verdef ) * defs = calloc ( shdr -> sh_size, sizeof ( char ) ) ; if (! defs ) { return false ; } if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( link_shdr && bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! defs ) { bprintf ( "Warning:   Cannot   allocate   memory   (Check   Elf_(Verdef))\\n" ) ; return NULL ; } sdb = sdb_new0 ( ) ; end = ( char * ) defs + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link, 0 ) ; sdb_set ( sdb, "link_section_name", link_

Fix:
<S2SV_ModStart> + i ; size_t vstart_off = i ; <S2SV_ModStart> < 1 || shdr -> sh_size - vstart_off < vdaux <S2SV_ModEnd> ) { sdb_free <S2SV_ModStart> ; } vstart += vdaux ; vstart_off <S2SV_ModStart>. vda_next ; vstart_off += aux. vda_next ;
Buggy code:
 <START_BUG> jas_matrix_t * jas_seq2d_create ( int xstart, int ystart, int xend, int yend ) <END_BUG> { jas_matrix_t * matrix ; assert ( xstart <= xend && ystart <= yend ) ; if (! ( matrix = jas_matrix_create ( yend - ystart, xend - xstart ) ) ) { return 0 ; } matrix -> xstart_ = xstart ; matrix -> ystart_ = ystart ; matrix -> xend_ = xend ; matrix -> yend_ = yend ; return matrix ; }

Fix:
<S2SV_ModStart> * jas_seq2d_create ( jas_matind_t xstart, jas_matind_t ystart, jas_matind_t xend, jas_matind_t <S2SV_ModEnd> yend ) {
Buggy code:
 static void cmd_parse_status ( struct ImapData * idata, char * s ) { char * value = NULL ; struct Buffy * inc = NULL ; struct ImapMbox mx ; struct ImapStatus * status = NULL ; unsigned int olduv, oldun ; unsigned int litlen ; short new = 0 ; short new_msg_count = 0 ; char * mailbox = imap_next_word ( s ) ; if ( imap_get_literal_count ( mailbox, & litlen ) == 0 ) { if ( imap_cmd_step ( idata )!= IMAP_CMD_CONTINUE ) { <START_BUG> idata -> status = IMAP_FATAL ; <END_BUG> return ; } mailbox = idata -> buf ; s = mailbox + litlen ; * s = '\\0' ; s ++ ; SKIPWS ( s ) ; } else { s = imap_next_word ( mailbox ) ; * ( s - 1 ) = '\\0' ; imap_unmunge_mbox_name ( idata, mailbox ) ; } status = imap_mboxcache_get ( idata, mailbox, 1 ) ; olduv = status -> uidvalidity ; oldun = status -> uidnext ; if ( * s ++!= '(' ) { mutt_debug ( 1, "Error   parsing   STATUS\\n" ) ; return ; } while ( * s && * s!= ')' ) { value = imap_next_word ( s ) ; errno = 0 ; const unsigned long ulcount = strtoul ( value, & value, 10 ) ; if ( ( ( errno == ERANGE ) && ( ulcount == ULONG_MAX ) ) || ( ( unsigned int ) ulcount!= ulcount ) ) { mutt_debug ( 1, "Error   parsing   STATUS   number\\n" ) ; return ; } const unsigned int count = ( unsigned int ) ulcount ; if ( mutt_str_strncmp ( "MESSAGES", s, 8 ) == 0 ) { status -> messages = count ; new_msg_count = 1 ; } else if ( mutt_str_strncmp ( "RECENT", s, 6 ) == 0 ) status -> recent = count ; else if ( mutt_str_strncmp ( "UIDNEXT", s, 7 ) == 0 ) status -> uidnext = count ; else if ( mutt_str_

Fix:
<S2SV_ModStart> status = IMAP_FATAL ; return ; } if ( strlen ( idata -> buf ) < litlen ) { mutt_debug ( 1, "Error <S2SV_blank> parsing <S2SV_blank> STATUS <S2SV_blank> mailbox\\n" )
Buggy code:
 UWORD32 ihevcd_cabac_decode_bypass_bins_egk ( cab_ctxt_t * ps_cabac, bitstrm_t * ps_bitstrm, WORD32 k ) { UWORD32 u4_sym ; WORD32 numones ; WORD32 bin ; ASSERT ( ( k >= 0 ) ) ; numones = k ; bin = 1 ; u4_sym = 0 ; <START_BUG> while ( bin ) <END_BUG> { IHEVCD_CABAC_DECODE_BYPASS_BIN ( bin, ps_cabac, ps_bitstrm ) ; u4_sym += bin << numones ++ ; }  numones -= 1 ; <START_BUG> numones = CLIP3 ( numones, 0, 16 ) ; if ( numones ) { UWORD32 u4_suffix ; IHEVCD_CABAC_DECODE_BYPASS_BINS ( u4_suffix, ps_cabac, ps_bitstrm, numones ) ; u4_sym += u4_suffix ; } return ( u4_sym ) ; }<END_BUG>

Fix:
<S2SV_ModStart> while ( bin && ( numones <= 16 ) <S2SV_ModStart> numones -= 1 <S2SV_ModEnd> ; if (
Buggy code:
 char * cJSON_Print ( cJSON * item ) { <START_BUG> return print_value ( item, 0, 1 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> 0, 1, 0
Buggy code:
 <START_BUG> static void fdct4 ( const int16_t * input, int16_t * output ) { <END_BUG>  int16_t step [ 4 ] ; <START_BUG> <END_BUG> int temp1, temp2 ;  step [ 0 ] = input [ 0 ] + input [ 3 ] ; step [ 1 ] = input [ 1 ] + input [ 2 ] ; step [ 2 ] = input [ 1 ] - input [ 2 ] ; step [ 3 ] = input [ 0 ] - input [ 3 ] ; temp1 = ( step [ 0 ] + step [ 1 ] ) * cospi_16_64 ; temp2 = ( step [ 0 ] - step [ 1 ] ) * cospi_16_64 ; <START_BUG> output [ 0 ] = fdct_round_shift ( temp1 ) ; <END_BUG> output [ 2 ] = fdct_round_shift ( temp2 ) ; temp1 = step [ 2 ] * cospi_24_64 + step [ 3 ] * cospi_8_64 ; temp2 = - step [ 2 ] * cospi_8_64 + step [ 3 ] * cospi_24_64 ;  output [ 1 ] = fdct_round_shift ( temp1 ) ; <START_BUG> output [ 3 ] = fdct_round_shift ( temp2 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> fdct4 ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output ) <S2SV_ModStart> output ) { tran_high_t <S2SV_ModEnd> step [ 4 <S2SV_ModStart> 4 ] ; tran_high_t <S2SV_ModEnd> temp1, temp2 <S2SV_ModStart> 0 ] = ( tran_low_t ) fdct_round_shift ( temp1 ) ; output [ 2 ] = ( tran_low_t ) <S2SV_ModEnd> fdct_round_shift ( temp2 <S2SV_ModStart> 1 ] = ( tran_low_t ) fdct_round_shift ( temp1 ) ; output [ 3 ] = ( tran_low_t ) <S2SV_ModEnd> fdct_round_shift ( temp2
Buggy code:
 void * sspi_SecureHandleGetLowerPointer ( SecHandle * handle ) { void * pointer ; <START_BUG> if (! handle ) <END_BUG> return NULL ; pointer = ( void * ) ~ ( ( size_t ) handle -> dwLower ) ; return pointer ; }

Fix:
<S2SV_ModStart> (! handle ||! SecIsValidHandle ( handle )
Buggy code:
 static vpx_codec_err_t vp8e_mr_alloc_mem ( const vpx_codec_enc_cfg_t * cfg, void * * mem_loc ) { vpx_codec_err_t res = 0 ; # if CONFIG_MULTI_RES_ENCODING LOWER_RES_FRAME_INFO * shared_mem_loc ; int mb_rows = ( ( cfg -> g_w + 15 ) >> 4 ) ; int mb_cols = ( ( cfg -> g_h + 15 ) >> 4 ) ; shared_mem_loc = calloc ( 1, sizeof ( LOWER_RES_FRAME_INFO ) ) ; if (! shared_mem_loc ) { res = VPX_CODEC_MEM_ERROR ; } shared_mem_loc -> mb_info = calloc ( mb_rows * mb_cols, sizeof ( LOWER_RES_MB_INFO ) ) ; if (! ( shared_mem_loc -> mb_info ) ) { res = VPX_CODEC_MEM_ERROR ; } else { * mem_loc = ( void * ) shared_mem_loc ; res = VPX_CODEC_OK ; } <START_BUG> # endif <END_BUG> return res ; }

Fix:
<S2SV_ModStart> ; } # else ( void ) cfg ; ( void ) mem_loc ; #
Buggy code:
 int jas_stream_pad ( jas_stream_t * stream, int n, int c ) { <START_BUG> int m ; <END_BUG> m = n ; for ( m = n ; m > 0 ; -- m ) { if ( jas_stream_putc ( stream, c ) == EOF ) return n - m ; } return n ; }

Fix:
<S2SV_ModStart> int m ; if ( n < 0 ) { jas_deprecated ( "negative <S2SV_blank> count <S2SV_blank> for <S2SV_blank> jas_stream_pad" ) ; }
Buggy code:
 <START_BUG> static void choose_intra_uv_mode ( VP9_COMP * cpi, PICK_MODE_CONTEXT * ctx, <END_BUG> BLOCK_SIZE bsize, TX_SIZE max_tx_size, int * rate_uv, int * rate_uv_tokenonly, int64_t * dist_uv, int * skip_uv,  MB_PREDICTION_MODE * mode_uv ) { <START_BUG> <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  if ( cpi -> sf. use_uv_intra_rd_estimate ) { rd_sbuv_dcpred ( cpi, x, rate_uv, rate_uv_tokenonly, dist_uv, skip_uv, bsize < BLOCK_8X8? BLOCK_8X8 : bsize ) ; } else { rd_pick_intra_sbuv_mode ( cpi, x, ctx, rate_uv, rate_uv_tokenonly, dist_uv, skip_uv, bsize < BLOCK_8X8? BLOCK_8X8 : bsize, max_tx_size ) ; } * mode_uv = x -> e_mbd. mi [ 0 ] -> mbmi. uv_mode ; }

Fix:
<S2SV_ModStart> * cpi, MACROBLOCK * const x, <S2SV_ModStart> * skip_uv, PREDICTION_MODE <S2SV_ModEnd> * mode_uv ) <S2SV_ModStart> mode_uv ) { <S2SV_ModEnd> if ( cpi
Buggy code:
 static int attach_child_main ( void * data ) { struct attach_clone_payload * payload = ( struct attach_clone_payload * ) data ; int ipc_socket = payload -> ipc_socket ; <START_BUG> int procfd = payload -> procfd ; <END_BUG> lxc_attach_options_t * options = payload -> options ; struct lxc_proc_context_info * init_ctx = payload -> init_ctx ; # if HAVE_SYS_PERSONALITY_H long new_personality ; # endif int ret ; int status ; int expected ; long flags ; int fd ;  uid_t new_uid ; <START_BUG> gid_t new_gid ; expected = 0 ; status = - 1 ; ret = lxc_read_nointr_expect ( ipc_socket, & status, sizeof ( status ), & expected ) ; if ( ret <= 0 ) { <END_BUG> ERROR ( "error   using   IPC   to   receive   notification   from   initial   process   (0)" ) ;  shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } if (! ( options -> namespaces & CLONE_NEWNS ) && ( options -> attach_flags & LXC_ATTACH_REMOUNT_PROC_SYS ) ) { ret = lxc_attach_remount_sys_proc ( ) ; if ( ret < 0 ) { shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } } # if HAVE_SYS_PERSONALITY_H if ( options -> personality < 0 ) new_personality = init_ctx -> personality ; else new_personality = options -> personality ; if ( options -> attach_flags & LXC_ATTACH_SET_PERSONALITY ) { ret = personality ( new_personality ) ; if ( ret < 0 ) { SYSERROR ( "could   not   ensure   correct   architecture" ) ; shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } } # endif if ( options -> attach_flags & LXC_ATTACH_DROP_CAPABILITIES ) { ret = lxc_attach_drop_privs ( init_ctx ) ; if ( ret < 0 ) { ERROR

Fix:
<S2SV_ModStart> -> ipc_socket ; <S2SV_ModEnd> lxc_attach_options_t * options <S2SV_ModStart> int fd ; int lsm_labelfd ; <S2SV_ModStart> { ERROR ( "Error <S2SV_blank> using <S2SV_blank> IPC <S2SV_blank> to <S2SV_blank> receive <S2SV_blank> notification <S2SV_blank> from <S2SV_blank> initial <S2SV_blank> process <S2SV_blank> (0): <S2SV_blank> %s.", strerror ( errno ) <S2SV_ModEnd> ) ; shutdown <S2SV_ModStart> { ERROR ( "Error <S2SV_blank> using <S2SV_blank> IPC <S2SV_blank> to <S2SV_blank> notify <S2SV_blank> initial <S2SV_blank> process <S2SV_blank> for <S2SV_blank> initialization <S2SV_blank> (1): <S2SV_blank> %s.", strerror ( errno ) <S2SV_ModEnd> ) ; shutdown <S2SV_ModStart> { ERROR ( "Error <S2SV_blank> using <S2SV_blank> IPC <S2SV_blank> to <S2SV_blank> receive <S2SV_blank> message <S2SV_blank> from <S2SV_blank> initial <S2SV_blank> process <S2SV_blank> " "that <S2SV_blank> it <S2SV_blank> is <S2SV_blank> done <S2SV_blank> pre-initializing <S2SV_blank> (2): <S2SV_blank> %s", strerror ( errno ) ) ; shutdown ( ipc_socket, SHUT_RDWR ) ; rexit ( - 1 ) ; } <S2SV_ModEnd> if ( ( <S2SV_ModStart> "privileges." ) ; shutdown ( ipc_socket, SHUT_RDWR ) ; <S2SV_ModStart> ( "PR_SET_NO_NEW_PRIVS <S2SV_blank> is <S2SV_blank> set. <S2SV_blank> Process <S2SV_blank> cannot <S2SV_blank> use <S2SV_blank> execve() <S2SV_blank> " "gainable <S2SV_blank> privileges." ) ; } status
Buggy code:
 <START_BUG> NOEXPORT char * parse_global_option ( CMD cmd, char * opt, char * arg ) { <END_BUG> void * tmp ; if ( cmd == CMD_PRINT_DEFAULTS || cmd == CMD_PRINT_HELP ) { s_log ( LOG_NOTICE, "   " ) ; s_log ( LOG_NOTICE, "Global   options:" ) ; } # ifdef HAVE_CHROOT switch ( cmd ) { case CMD_SET_DEFAULTS :  new_global_options. chroot_dir = NULL ; <START_BUG> break ; case CMD_SET_COPY : break ; case CMD_FREE : <END_BUG> tmp = global_options. chroot_dir ;  global_options. chroot_dir = NULL ; str_free ( tmp ) ; break ; case CMD_SET_VALUE : if ( strcasecmp ( opt, "chroot" ) ) break ; <START_BUG> new_global_options. chroot_dir = str_dup ( arg ) ; <END_BUG> return NULL ; case CMD_INITIALIZE : break ; case CMD_PRINT_DEFAULTS : break ; case CMD_PRINT_HELP : s_log ( LOG_NOTICE, "%-22s   =   directory   to   chroot   stunnel   process", "chroot" ) ; break ; } # endif # ifndef OPENSSL_NO_COMP switch ( cmd ) { case CMD_SET_DEFAULTS :  new_global_options. compression = COMP_NONE ; <START_BUG> break ; case CMD_SET_COPY : break ; case CMD_FREE : break ; case CMD_SET_VALUE : if ( strcasecmp ( opt, "compression" ) ) break ; # if OPENSSL_VERSION_NUMBER < 0x10100000L if ( OpenSSL_version_num ( ) < 0x00908051L ) return "Compression   unsupported   due   to   a   memory   leak" ; # endif if (! strcasecmp ( arg, "deflate" ) ) <END_BUG> new_global_options. compression = COMP_DEFLATE ;  else if (! strcasecmp ( arg, "zlib" ) ) <START_BUG> new_global_options. compression = COMP_ZLIB ; <END_BUG> else return "Specified   compression   type   is   not   available" ; return NULL ; case CMD_INITIALIZE : break ; case CMD_PRINT_DEFAULTS : break ; case CMD_PRINT_HELP : s_log ( LOG_NOTICE,

Fix:
<S2SV_ModStart> ( CMD cmd, GLOBAL_OPTIONS * options <S2SV_ModStart> case CMD_SET_DEFAULTS : options -> <S2SV_ModEnd> chroot_dir = NULL <S2SV_ModStart> : tmp = options -> chroot_dir ; options -> <S2SV_ModEnd> chroot_dir = NULL <S2SV_ModStart> ) break ; options -> <S2SV_ModEnd> chroot_dir = str_dup <S2SV_ModStart> case CMD_SET_DEFAULTS : options -> <S2SV_ModEnd> compression = COMP_NONE <S2SV_ModStart> "deflate" ) ) options -> <S2SV_ModEnd> compression = COMP_DEFLATE <S2SV_ModStart> "zlib" ) ) options -> <S2SV_ModEnd> compression = COMP_ZLIB <S2SV_ModStart> # ifdef EGD_SOCKET options -> <S2SV_ModEnd> egd_sock = EGD_SOCKET <S2SV_ModStart> ; # else options -> <S2SV_ModEnd> egd_sock = NULL <S2SV_ModStart> : tmp = options -> egd_sock ; options -> <S2SV_ModEnd> egd_sock = NULL <S2SV_ModStart> ) break ; options -> <S2SV_ModEnd> egd_sock = str_dup <S2SV_ModStart> # ifdef USE_FIPS options -> <S2SV_ModEnd> option. fips <S2SV_ModStart>. fips = FIPS_mode ( )? 1 : <S2SV_ModStart> ) break ; if (! strcasecmp ( arg, "yes" ) ) { <S2SV_ModStart> # ifdef USE_FIPS options -> <S2SV_ModEnd> option. fips <S2SV_ModStart> = 1 ; # else return "FIPS <S2SV_blank> support