nus-yam/ex-repair huggingface dataset:
Buggy code:
 int handle ( int s, unsigned char * data, int len, struct sockaddr_in * s_in ) { char buf [ 2048 ] ; unsigned short * cmd = ( unsigned short * ) buf ; int plen ; struct in_addr * addr = & s_in -> sin_addr ; unsigned short * pid = ( unsigned short * ) data ; if ( len == S_HELLO_LEN && memcmp ( data, "sorbo", 5 ) == 0 ) { unsigned short * id = ( unsigned short * ) ( data + 5 ) ; int x = 2 + 4 + 2 ; * cmd = htons ( S_CMD_INET_CHECK ) ; memcpy ( cmd + 1, addr, 4 ) ; memcpy ( cmd + 1 + 2, id, 2 ) ; printf ( "Inet   check   by   %s   %d\\n", inet_ntoa ( * addr ), ntohs ( * id ) ) ; if ( send ( s, buf, x, 0 )!= x ) return 1 ; return 0 ; } * cmd ++ = htons ( S_CMD_PACKET ) ; * cmd ++ = * pid ; plen = len - 2 ; <START_BUG> last_id = ntohs ( * pid ) ; <END_BUG> if ( last_id > 20000 ) wrap = 1 ; if ( wrap && last_id < 100 ) { wrap = 0 ; memset ( ids, 0, sizeof ( ids ) ) ; } printf ( "Got   packet   %d   %d", last_id, plen ) ; if ( is_dup ( last_id ) ) { printf ( "   (DUP)\\n" ) ; return 0 ; } printf ( "\\n" ) ; * cmd ++ = htons ( plen ) ; memcpy ( cmd, data + 2, plen ) ; plen += 2 + 2 + 2 ; assert ( plen <= ( int ) sizeof ( buf ) ) ; if ( send ( s, buf, plen, 0 )!= plen ) return 1 ; return 0 ; }

Fix:
<S2SV_ModStart> - 2 ; if ( plen < 0 ) return 0 ;
Buggy code:
 static ssize_t _archive_write_data ( struct archive * _a, const void * buff, size_t s ) { struct archive_write * a = ( struct archive_write * ) _a ; <START_BUG> archive_check_magic ( & a -> archive, ARCHIVE_WRITE_MAGIC, <END_BUG>  ARCHIVE_STATE_DATA, "archive_write_data" ) ; <START_BUG> archive_clear_error ( & a -> archive ) ; return ( ( a -> format_write_data ) ( a, buff, s ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) _a ; const size_t max_write = INT_MAX ; <S2SV_ModStart>, "archive_write_data" ) ; if ( s > max_write ) s = max_write
Buggy code:
 <START_BUG> void generate_filename ( const char * pattern, char * out, size_t q_len, <END_BUG> unsigned int d_w, unsigned int d_h, unsigned int frame_in ) { const char * p = pattern ; char * q = out ; do { char * next_pat = strchr ( p, '%' ) ; if ( p == next_pat ) { size_t pat_len ; q [ q_len - 1 ] = '\\0' ; switch ( p [ 1 ] ) { case 'w' : snprintf ( q, q_len - 1, "%d", d_w ) ; break ; case 'h' : snprintf ( q, q_len - 1, "%d", d_h ) ; break ; case '1' : snprintf ( q, q_len - 1, "%d", frame_in ) ; break ; case '2' : snprintf ( q, q_len - 1, "%02d", frame_in ) ; break ; case '3' : snprintf ( q, q_len - 1, "%03d", frame_in ) ; break ; case '4' : snprintf ( q, q_len - 1, "%04d", frame_in ) ; break ; case '5' : snprintf ( q, q_len - 1, "%05d", frame_in ) ; break ; case '6' : snprintf ( q, q_len - 1, "%06d", frame_in ) ; break ; case '7' : snprintf ( q, q_len - 1, "%07d", frame_in ) ; break ; case '8' : snprintf ( q, q_len - 1, "%08d", frame_in ) ; break ; case '9' : snprintf ( q, q_len - 1, "%09d", frame_in ) ; break ; default : die ( "Unrecognized   pattern   %%%c\\n", p [ 1 ] ) ;  } <START_BUG> pat_len = strlen ( q ) ; if ( pat_len >= q_len - 1 ) die ( "Output   filename   too   long.\\n" ) ; q += pat_len ; p += 2 ; q_len -= pat_len ; } else { size_t copy_len ; if (!<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> ] ) ; break ;
Buggy code:
 static int read_Header ( struct archive_read * a, struct _7z_header_info * h, int check_header_id ) { struct _7zip * zip = ( struct _7zip * ) a -> format -> data ; const unsigned char * p ; struct _7z_folder * folders ; struct _7z_stream_info * si = & ( zip -> si ) ; struct _7zip_entry * entries ; uint32_t folderIndex, indexInFolder ; unsigned i ; int eindex, empty_streams, sindex ; if ( check_header_id ) { if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; if ( * p!= kHeader ) return ( - 1 ) ; } if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; if ( * p == kArchiveProperties ) { for ( ; ; ) { uint64_t size ; if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; if ( * p == 0 ) break ; if ( parse_7zip_uint64 ( a, & size ) < 0 ) return ( - 1 ) ; } if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; } if ( * p == kMainStreamsInfo ) { if ( read_StreamsInfo ( a, & ( zip -> si ) ) < 0 ) return ( - 1 ) ; if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; } if ( * p == kEnd ) return ( 0 ) ; if ( * p!= kFilesInfo ) return ( - 1 ) ; if ( parse_7zip_uint64 ( a, & ( zip -> numFiles ) ) < 0 ) return ( - 1 ) ; if ( UMAX_ENTRY < zip -> numFiles ) return ( - 1 ) ; zip -> entries = calloc ( ( size_t ) zip -> numFiles, sizeof ( * zip -> entries ) ) ; if ( zip -> entries == NULL ) return ( - 1 ) ; entries = zip -> entries ; empty_streams = 0 ; for ( ; ; ) { int type ; uint64_t size ; size_t ll ; if ( ( p = header_

Fix:
<S2SV_ModStart> case kEmptyStream : if ( h -> emptyStreamBools!= NULL ) return ( - 1 ) ; <S2SV_ModStart> break ; } if ( h -> emptyFileBools!= NULL ) return ( - 1 ) ; <S2SV_ModStart> break ; } if ( h -> antiBools!= NULL ) return ( - 1 ) ; <S2SV_ModStart> numFiles * 4 ) return ( - 1 ) ; if ( zip -> entry_names!= NULL <S2SV_ModStart> * p ; if ( h -> attrBools!= NULL ) return ( - 1 ) ;
Buggy code:
 static Image * ReadCUTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowCUTReaderException ( severity, tag ) { if ( palette!= NULL ) palette = DestroyImage ( palette ) ; if ( clone_info!= NULL ) clone_info = DestroyImageInfo ( clone_info ) ; ThrowReaderException ( severity, tag ) ; } <END_BUG> Image * image, * palette ; ImageInfo * clone_info ; MagickBooleanType status ; MagickOffsetType offset ; size_t EncodedByte ; unsigned char RunCount, RunValue, RunCountMasked ; CUTHeader Header ; CUTPalHeader PalHeader ; ssize_t depth ; ssize_t i, j ; ssize_t ldblk ; unsigned char * BImgBuff = NULL, * ptrB ; PixelPacket * q ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } palette = NULL ; clone_info = NULL ; Header. Width = ReadBlobLSBShort ( image ) ; Header. Height = ReadBlobLSBShort ( image ) ; Header. Reserved = ReadBlobLSBShort ( image ) ; if ( Header. Width == 0 || Header. Height == 0 || Header. Reserved!= 0 ) CUT_KO : ThrowCUTReaderException ( CorruptImageError, "ImproperImageHeader" ) ; EncodedByte = ReadBlobLSBShort ( image ) ; RunCount = ( unsigned char ) ReadBlobByte ( image ) ; RunCountMasked = RunCount & 0x7F ; ldblk = 0 ; while ( ( int ) RunCountMasked!= 0 ) { i = 1 ; if ( ( int ) RunCount < 0x80 ) i = ( ssize

Fix:
<S2SV_ModStart>, tag ) \\\n{ <S2SV_ModEnd> if ( palette <S2SV_ModStart> tag ) ; \\\n} <S2SV_ModEnd> Image * image <S2SV_ModStart> goto NoMemory ; ( void ) memset ( BImgBuff, 0, ( size_t ) ldblk * sizeof ( * BImgBuff ) ) ;
Buggy code:
 static int unix_getpw ( UNUSED void * instance, REQUEST * request, VALUE_PAIR * * vp_list ) { const char * name ; const char * encrypted_pass ; # ifdef HAVE_GETSPNAM struct spwd * spwd = NULL ; # endif # ifdef OSFC2 struct pr_passwd * pr_pw ; # else struct passwd * pwd ; # endif # ifdef HAVE_GETUSERSHELL char * shell ; # endif VALUE_PAIR * vp ; if (! request -> username ) { return RLM_MODULE_NOOP ; } name = ( char * ) request -> username -> vp_strvalue ; encrypted_pass = NULL ; # ifdef OSFC2 if ( ( pr_pw = getprpwnam ( name ) ) == NULL ) return RLM_MODULE_NOTFOUND ; encrypted_pass = pr_pw -> ufld. fd_encrypt ; if ( pr_pw -> uflg. fg_lock!= 1 ) { radlog ( L_AUTH, "rlm_unix:   [%s]:   account   locked", name ) ; return RLM_MODULE_USERLOCK ; } # else if ( ( pwd = getpwnam ( name ) ) == NULL ) { return RLM_MODULE_NOTFOUND ; } encrypted_pass = pwd -> pw_passwd ; # endif # ifdef HAVE_GETSPNAM if ( ( encrypted_pass == NULL ) || ( strlen ( encrypted_pass ) < 10 ) ) { if ( ( spwd = getspnam ( name ) ) == NULL ) { return RLM_MODULE_NOTFOUND ; } encrypted_pass = spwd -> sp_pwdp ; } # endif # ifndef OSFC2 # ifdef DENY_SHELL if ( strcmp ( pwd -> pw_shell, DENY_SHELL ) == 0 ) { radlog_request ( L_AUTH, 0, request, "rlm_unix:   [%s]:   invalid   shell", name ) ; return RLM_MODULE_REJECT ; } # endif # ifdef HAVE_GETUSERSHELL while ( ( shell = getusershell ( ) )!= NULL ) { if ( strcmp ( shell, pwd -> pw_shell ) == 0 || strcmp ( shell, "//RADIUSD//ANY//SHELL" ) == 0 ) { break ; }

Fix:
<S2SV_ModStart> && spwd -> sp_lstchg > 0 && spwd -> sp_max >= <S2SV_ModEnd> 0 && ( <S2SV_ModStart> 86400 ) > ( spwd -> sp_lstchg + spwd -> sp_max ) ) { radlog_request ( L_AUTH, 0, request, "[%s]: <S2SV_blank> password <S2SV_blank> has <S2SV_blank> expired", name ) ; return RLM_MODULE_REJECT ; } if ( spwd && <S2SV_ModStart> spwd -> sp_expire > 0 && ( request -> timestamp // 86400 ) > spwd -> sp_expire <S2SV_ModStart>, request, "[%s]: <S2SV_blank> account <S2SV_blank> has <S2SV_blank> expired" <S2SV_ModEnd>, name )
Buggy code:
 <START_BUG> static void sample_hbp_handler ( struct perf_event * bp, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) { printk ( KERN_INFO "%s   value   is   changed\\n", ksym_name ) ; dump_stack ( ) ; printk ( KERN_INFO "Dump   stack   from   sample_hbp_handler\\n" ) ; }

Fix:
<S2SV_ModStart> perf_event * bp <S2SV_ModEnd>, struct perf_sample_data
Buggy code:
 int vp8_get_compressed_data ( VP8_COMP * cpi, unsigned int * frame_flags, unsigned long * size, unsigned char * dest, unsigned char * dest_end, int64_t * time_stamp, int64_t * time_end, int flush ) { <START_BUG> # if HAVE_NEON <END_BUG> int64_t store_reg [ 8 ] ; # endif VP8_COMMON * cm ; struct vpx_usec_timer tsctimer ; struct vpx_usec_timer ticktimer ; struct vpx_usec_timer cmptimer ; YV12_BUFFER_CONFIG * force_src_buffer = NULL ; if (! cpi ) return - 1 ; cm = & cpi -> common ; if ( setjmp ( cpi -> common. error. jmp ) ) { cpi -> common. error. setjmp = 0 ;  return VPX_CODEC_CORRUPT_FRAME ; <START_BUG> } cpi -> common. error. setjmp = 1 ; <END_BUG> # if HAVE_NEON  # if CONFIG_RUNTIME_CPU_DETECT if ( cm -> cpu_caps & HAS_NEON ) # endif { vp8_push_neon ( store_reg ) ; } # endif vpx_usec_timer_start ( & cmptimer ) ; cpi -> source = NULL ; # if! ( CONFIG_REALTIME_ONLY ) if ( cpi -> oxcf. error_resilient_mode == 0 && cpi -> oxcf. play_alternate && cpi -> source_alt_ref_pending ) { if ( ( cpi -> source = vp8_lookahead_peek ( cpi -> lookahead, cpi -> frames_till_gf_update_due, PEEK_FORWARD ) ) ) { cpi -> alt_ref_source = cpi -> source ; if ( cpi -> oxcf. arnr_max_frames > 0 ) { vp8_temporal_filter_prepare_c ( cpi, cpi -> frames_till_gf_update_due ) ; force_src_buffer = & cpi -> alt_ref_buffer ; } cpi -> frames_till_alt_ref_frame = cpi -> frames_till_gf_update

Fix:
<S2SV_ModStart> flush ) { <S2SV_ModEnd> VP8_COMMON * cm <S2SV_ModStart> = 0 ; vp8_clear_system_state ( ) ; <S2SV_ModStart> = 1 ; <S2SV_ModEnd> vpx_usec_timer_start ( & <S2SV_ModStart> } # endif <S2SV_ModEnd> return - 1 <S2SV_ModStart> avg_duration ; } # if CONFIG_MULTI_RES_ENCODING if ( cpi -> oxcf. mr_total_resolutions > 1 ) { LOWER_RES_FRAME_INFO * low_res_frame_info = ( LOWER_RES_FRAME_INFO * ) cpi -> oxcf. mr_low_res_mode_info ; if ( cpi -> oxcf. mr_encoder_id ) { cpi -> ref_framerate = low_res_frame_info -> low_res_framerate ; } else { low_res_frame_info -> low_res_framerate = cpi -> ref_framerate ; } } # endif <S2SV_ModStart> oxcf. number_of_layers && i < VPX_TS_MAX_LAYERS ; ++ i <S2SV_ModEnd> ) { LAYER_CONTEXT <S2SV_ModStart> cpi ) ; if ( cpi -> temporal_layer_id >= 0 ) { layer =
Buggy code:
 static struct sock * dccp_v6_request_recv_sock ( const struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst, struct request_sock * req_unhash, bool * own_req ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; struct ipv6_pinfo * newnp ; <START_BUG> const struct ipv6_pinfo * np = inet6_sk ( sk ) ; <END_BUG> struct inet_sock * newinet ; struct dccp6_sock * newdp6 ; struct sock * newsk ; if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = dccp_v4_request_recv_sock ( sk, skb, req, dst, req_unhash, own_req ) ; if ( newsk == NULL ) return NULL ; newdp6 = ( struct dccp6_sock * ) newsk ; newinet = inet_sk ( newsk ) ; newinet -> pinet6 = & newdp6 -> inet6 ; newnp = inet6_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; newnp -> saddr = newsk -> sk_v6_rcv_saddr ; inet_csk ( newsk ) -> icsk_af_ops = & dccp_ipv6_mapped ; newsk -> sk_backlog_rcv = dccp_v4_do_rcv ; newnp -> pktoptions = NULL ; newnp -> opt = NULL ; newnp -> mcast_oif = inet6_iif ( skb ) ; newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; dccp_sync_mss ( newsk, inet_csk ( newsk ) -> icsk_pmtu_cookie ) ; return newsk ; } if ( sk_acceptq_is_full ( sk ) ) goto out_overflow ; if (! dst ) { struct flowi6 fl6 ; dst = inet6_csk_route_req ( sk, & fl6, req, IPPROTO_DCCP ) ; if (! dst ) goto out

Fix:
<S2SV_ModStart> ( sk ) ; struct ipv6_txoptions * opt <S2SV_ModStart> -> hop_limit ; opt = rcu_dereference <S2SV_ModEnd> ( np -> <S2SV_ModStart> np -> opt ) ; if ( opt ) { <S2SV_ModEnd> opt = ipv6_dup_options <S2SV_ModStart> ( newsk, opt ) ; RCU_INIT_POINTER ( newnp -> opt, opt ) ; } <S2SV_ModEnd> inet_csk ( newsk <S2SV_ModStart> ; if ( opt <S2SV_ModEnd> ) inet_csk ( <S2SV_ModStart> -> icsk_ext_hdr_len = <S2SV_ModEnd> opt -> opt_nflen <S2SV_ModStart> -> opt_nflen + <S2SV_ModEnd> opt -> opt_flen <S2SV_ModStart> opt -> opt_flen <S2SV_ModEnd> ; dccp_sync_mss (
Buggy code:
 MagickExport void * AcquireAlignedMemory ( const size_t count, const size_t quantum ) { # define AlignedExtent ( size, alignment ) ( ( ( size ) + ( ( alignment ) - 1 ) ) & ~ ( ( alignment ) - 1 ) ) size_t alignment, extent, size ; void * memory ; <START_BUG> if ( CheckMemoryOverflow ( count, quantum )!= MagickFalse ) <END_BUG> return ( ( void * ) NULL ) ; memory = NULL ; alignment = CACHE_LINE_SIZE ; size = count * quantum ; extent = AlignedExtent ( size, alignment ) ; if ( ( size == 0 ) || ( alignment < sizeof ( void * ) ) || ( extent < size ) ) return ( ( void * ) NULL ) ; # if defined ( MAGICKCORE_HAVE_POSIX_MEMALIGN ) if ( posix_memalign ( & memory, alignment, extent )!= 0 ) memory = NULL ; # elif defined ( MAGICKCORE_HAVE__ALIGNED_MALLOC ) memory = _aligned_malloc ( extent, alignment ) ; # else { void * p ; extent = ( size + alignment - 1 ) + sizeof ( void * ) ; if ( extent > size ) { p = malloc ( extent ) ; if ( p!= NULL ) { memory = ( void * ) AlignedExtent ( ( size_t ) p + sizeof ( void * ), alignment ) ; * ( ( void * * ) memory - 1 ) = p ; } } } # endif return ( memory ) ; }

Fix:
<S2SV_ModStart> ; if ( HeapOverflowSanityCheck <S2SV_ModEnd> ( count,
Buggy code:
 static gboolean _handle_carbons ( xmpp_stanza_t * const stanza ) { xmpp_stanza_t * carbons = xmpp_stanza_get_child_by_ns ( stanza, STANZA_NS_CARBONS ) ; if (! carbons ) { return FALSE ; } const char * name = xmpp_stanza_get_name ( carbons ) ; if (! name ) { log_error ( "Unable   to   retrieve   stanza   name   for   Carbon" ) ; return TRUE ; } if ( g_strcmp0 ( name, "private" ) == 0 ) { log_info ( "Carbon   received   with   private   element." ) ; return FALSE ; } if ( ( g_strcmp0 ( name, "received" )!= 0 ) && ( g_strcmp0 ( name, "sent" )!= 0 ) ) { log_warning ( "Carbon   received   with   unrecognised   stanza   name:   %s", name ) ; return TRUE ; } xmpp_stanza_t * forwarded = xmpp_stanza_get_child_by_ns ( carbons, STANZA_NS_FORWARD ) ; if (! forwarded ) { log_warning ( "Carbon   received   with   no   forwarded   element" ) ; return TRUE ; } xmpp_stanza_t * message = xmpp_stanza_get_child_by_name ( forwarded, STANZA_NAME_MESSAGE ) ; if (! message ) { log_warning ( "Carbon   received   with   no   message   element" ) ; return TRUE ; } char * message_txt = xmpp_message_get_body ( message ) ; if (! message_txt ) { log_warning ( "Carbon   received   with   no   message." ) ; return TRUE ; } <START_BUG> const gchar * to = xmpp_stanza_get_to ( message ) ; <END_BUG> const gchar * from = xmpp_stanza_get_from ( message ) ; if (! to ) to = from ; Jid * jid_from = jid_create ( from ) ;  Jid * jid_to = jid_create ( to ) ; <START_BUG> Jid * my<END_BUG>

Fix:
<S2SV_ModStart> TRUE ; } Jid * my_jid = jid_create ( connection_get_fulljid ( ) ) ; const char * const stanza_from = xmpp_stanza_get_from ( stanza ) ; Jid * msg_jid = jid_create ( stanza_from ) ; if ( g_strcmp0 ( my_jid -> barejid, msg_jid -> barejid )!= 0 ) { log_warning ( "Invalid <S2SV_blank> carbon <S2SV_blank> received, <S2SV_blank> from: <S2SV_blank> %s", stanza_from ) ; return TRUE ; } <S2SV_ModStart> jid_create ( to <S2SV_ModEnd> ) ; char
Buggy code:
 unsigned int X509v3_addr_get_afi ( const IPAddressFamily * f ) { <START_BUG> return ( ( f!= NULL && <END_BUG>  f -> addressFamily!= NULL && f -> addressFamily -> data!= NULL ) <START_BUG> <END_BUG>? ( ( f -> addressFamily -> data [ 0 ] << 8 ) | ( f -> addressFamily -> data [ 1 ] ) )  : 0 ) ; }

Fix:
<S2SV_ModStart> f ) { if ( f == NULL || <S2SV_ModEnd> f -> addressFamily <S2SV_ModStart> f -> addressFamily == NULL || <S2SV_ModEnd> f -> addressFamily <S2SV_ModStart> addressFamily -> data == NULL || f -> addressFamily -> length < 2 ) return 0 ; return <S2SV_ModEnd> ( f -> <S2SV_ModStart> 8 ) | <S2SV_ModEnd> f -> addressFamily <S2SV_ModStart> [ 1 ] <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int userfaultfd_register ( struct userfaultfd_ctx * ctx, unsigned long arg ) { struct mm_struct * mm = ctx -> mm ; struct vm_area_struct * vma, * prev, * cur ; int ret ; struct uffdio_register uffdio_register ; struct uffdio_register __user * user_uffdio_register ; unsigned long vm_flags, new_flags ; bool found ; bool basic_ioctls ; unsigned long start, end, vma_end ; user_uffdio_register = ( struct uffdio_register __user * ) arg ; ret = - EFAULT ; if ( copy_from_user ( & uffdio_register, user_uffdio_register, sizeof ( uffdio_register ) - sizeof ( __u64 ) ) ) goto out ; ret = - EINVAL ; if (! uffdio_register. mode ) goto out ; if ( uffdio_register. mode & ~ ( UFFDIO_REGISTER_MODE_MISSING | UFFDIO_REGISTER_MODE_WP ) ) goto out ; vm_flags = 0 ; if ( uffdio_register. mode & UFFDIO_REGISTER_MODE_MISSING ) vm_flags |= VM_UFFD_MISSING ; if ( uffdio_register. mode & UFFDIO_REGISTER_MODE_WP ) { vm_flags |= VM_UFFD_WP ; ret = - EINVAL ; goto out ; } ret = validate_range ( mm, uffdio_register. range. start, uffdio_register. range. len ) ; if ( ret ) goto out ; start = uffdio_register. range. start ; end = start + uffdio_register. range. len ; ret = - ENOMEM ; if (! mmget_not_zero ( mm ) ) goto out ; down_write ( & mm -> mmap_sem ) ; vma = find_vma_prev ( mm, start, & prev ) ; if (! vma ) goto out_unlock ; ret = - EINVAL ; if ( vma -> vm_start >= end ) goto out_unlock ; if ( is_vm_hugetlb_page ( vma ) ) {

Fix:
<S2SV_ModStart> goto out_unlock ; ret = - EPERM ; if ( unlikely (! ( cur -> vm_flags & VM_MAYWRITE ) ) ) goto out_unlock ; <S2SV_ModStart> ctx!= ctx ) ; WARN_ON (! ( vma -> vm_flags & VM_MAYWRITE )
Buggy code:
 static void <START_BUG> build_config ( char * prefix, struct server * server ) <END_BUG> { char * path = NULL ; int path_size = strlen ( prefix ) + strlen ( server -> port ) + 20 ; path = ss_malloc ( path_size ) ; snprintf ( path, path_size, "%s//.shadowsocks_%s.conf", prefix, server -> port ) ; FILE * f = fopen ( path, "w+" ) ; if ( f == NULL ) { if ( verbose ) { LOGE ( "unable   to   open   config   file" ) ; } ss_free ( path ) ; return ; } fprintf ( f, "{\\n" ) ; fprintf ( f, "\\"server_port\\":%d,\\n", atoi ( server -> port ) ) ;  fprintf ( f, "\\"password\\":\\"%s\\"", server -> password ) ; <START_BUG> if ( server -> fast_open [ 0 ] ) fprintf ( f, ",\\n\\"fast_open\\":   %s", server -> fast_open ) ; if ( server -> mode ) fprintf ( f, ",\\n\\"mode\\":\\"%s\\"", server -> mode ) ; <END_BUG> if ( server -> method ) fprintf ( f, ",\\n\\"method\\":\\"%s\\"", server -> method ) ;  if ( server -> plugin ) fprintf ( f, ",\\n\\"plugin\\":\\"%s\\"", server -> plugin ) ; if ( server -> plugin_opts ) fprintf ( f, ",\\n\\"plugin_opts\\":\\"%s\\"", server -> plugin_opts ) ; fprintf ( f, "\\n}\\n" ) ; fclose ( f ) ; ss_free ( path ) ; }

Fix:
<S2SV_ModStart> prefix, struct manager_ctx * manager, struct <S2SV_ModStart> server -> password ) ; if ( server -> method ) fprintf ( f, ",\\n\\"method\\":\\"%s\\"", server -> method ) ; else if ( manager -> method ) fprintf ( f, ",\\n\\"method\\":\\"%s\\"", manager -> method <S2SV_ModStart> ( server -> <S2SV_ModEnd> plugin ) fprintf
Buggy code:
 static int process_line ( URLContext * h, char * line, int line_count, int * new_location ) { HTTPContext * s = h -> priv_data ; const char * auto_method = h -> flags & AVIO_FLAG_READ? "POST" : "GET" ; char * tag, * p, * end, * method, * resource, * version ; int ret ; if ( line [ 0 ] == '\\0' ) { s -> end_header = 1 ; return 0 ; } p = line ; if ( line_count == 0 ) { if ( s -> is_connected_server ) { method = p ; while ( * p &&! av_isspace ( * p ) ) p ++ ; * ( p ++ ) = '\\0' ; av_log ( h, AV_LOG_TRACE, "Received   method:   %s\\n", method ) ; if ( s -> method ) { if ( av_strcasecmp ( s -> method, method ) ) { av_log ( h, AV_LOG_ERROR, "Received   and   expected   HTTP   method   do   not   match.   (%s   expected,   %s   received)\\n", s -> method, method ) ; return ff_http_averror ( 400, AVERROR ( EIO ) ) ; } } else { av_log ( h, AV_LOG_TRACE, "Autodetected   %s   HTTP   method\\n", auto_method ) ; if ( av_strcasecmp ( auto_method, method ) ) { av_log ( h, AV_LOG_ERROR, "Received   and   autodetected   HTTP   method   did   not   match   " "(%s   autodetected   %s   received)\\n", auto_method, method ) ; return ff_http_averror ( 400, AVERROR ( EIO ) ) ; } if (! ( s -> method = av_strdup ( method ) ) ) return AVERROR ( ENOMEM ) ; } while ( av_isspace ( * p ) ) p ++ ; resource = p ; while (! av_isspace ( * p ) ) p ++ ; * ( p ++ ) = '\\0' ; av_log ( h, AV_LOG_TRACE, "Requested   resource:   %

Fix:
<S2SV_ModStart> -> filesize == UINT64_MAX <S2SV_ModEnd> ) { s <S2SV_ModStart> -> filesize = strtoull <S2SV_ModEnd> ( p, <S2SV_ModStart> -> filesize = UINT64_MAX ; s -> chunksize = 0 ; } else if (! av_strcasecmp ( tag, "WWW-Authenticate" ) ) { ff_http_auth_handle_header ( & s -> auth_state, tag, p ) ; } else if (! av_strcasecmp ( tag, "Authentication-Info" ) ) { ff_http_auth_handle_header ( & s -> auth_state, tag, p ) ; } else if (! av_strcasecmp ( tag, "Proxy-Authenticate" ) ) { ff_http_auth_handle_header ( & s -> proxy_auth_state, tag, p ) ; } else if (! av_strcasecmp ( tag, "Connection" ) ) { if (! strcmp ( p, "close" ) ) s -> willclose = 1 ; } else if (! av_strcasecmp ( tag, "Server" ) ) { if (! av_strcasecmp ( p, "AkamaiGHost" ) ) { s -> is_akamai = 1 ; }
Buggy code:
 static long pmcraid_ioctl_passthrough ( struct pmcraid_instance * pinstance, unsigned int ioctl_cmd, unsigned int buflen, unsigned long arg ) { struct pmcraid_passthrough_ioctl_buffer * buffer ; struct pmcraid_ioarcb * ioarcb ; struct pmcraid_cmd * cmd ; struct pmcraid_cmd * cancel_cmd ; unsigned long request_buffer ; unsigned long request_offset ; unsigned long lock_flags ; void * ioasa ; u32 ioasc ; int request_size ; int buffer_size ; u8 access, direction ; int rc = 0 ; if ( pinstance -> ioa_reset_in_progress ) { rc = wait_event_interruptible_timeout ( pinstance -> reset_wait_q,! pinstance -> ioa_reset_in_progress, msecs_to_jiffies ( 10000 ) ) ; if (! rc ) return - ETIMEDOUT ; else if ( rc < 0 ) return - ERESTARTSYS ; } if ( pinstance -> ioa_state!= IOA_STATE_OPERATIONAL ) { pmcraid_err ( "IOA   is   not   operational\\n" ) ; return - ENOTTY ; } buffer_size = sizeof ( struct pmcraid_passthrough_ioctl_buffer ) ; buffer = kmalloc ( buffer_size, GFP_KERNEL ) ; if (! buffer ) { pmcraid_err ( "no   memory   for   passthrough   buffer\\n" ) ; return - ENOMEM ; } request_offset = offsetof ( struct pmcraid_passthrough_ioctl_buffer, request_buffer ) ; request_buffer = arg + request_offset ; rc = __copy_from_user ( buffer, ( struct pmcraid_passthrough_ioctl_buffer * ) arg, sizeof ( struct pmcraid_passthrough_ioctl_buffer ) ) ; ioasa = ( void * ) ( arg + offsetof ( struct pmcraid_passthrough_ioctl_buffer, ioasa ) ) ; if ( rc ) { pmcraid_err ( "ioctl:   can\'t   copy   passthrough   buffer\\n" )

Fix:
<S2SV_ModStart> out_free_buffer ; } } else if ( request_size < 0 ) { rc = - EINVAL ; goto out_free_buffer ;
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowDCMException ( exception, message ) { if ( data!= ( unsigned char * ) NULL ) data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; if ( stream_info!= ( DCMStreamInfo * ) NULL ) stream_info = ( DCMStreamInfo * ) RelinquishMagickMemory ( stream_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char explicit_vr [ MagickPathExtent ], implicit_vr [ MagickPathExtent ], magick [ MagickPathExtent ], photometric [ MagickPathExtent ] ; DCMInfo info ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, * redmap ; MagickBooleanType explicit_file, explicit_retry, sequence, use_explicit ; MagickOffsetType offset ; register unsigned char * p ; register ssize_t i ; size_t colors, height, length, number_scenes, quantum, status, width ; ssize_t count, scene ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 8UL ; image -> endian = LSBEndian ; data = ( unsigned char * ) NULL ; stream_info = ( DCMStreamInfo * ) AcquireMagickMemory ( sizeof ( * stream_info ) ) ; if ( stream_info == ( DCMStreamInfo * ) NULL ) ThrowDCMException ( ResourceLimitError, "MemoryAllocationFailed" ) ;

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( data <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char explicit_vr [ <S2SV_ModStart> image ) ) ThrowDCMException <S2SV_ModEnd> ( CorruptImageError,
Buggy code:
 int vp8_full_search_sadx8 ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int sad_per_bit, int distance, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; int what_stride = b -> src_stride ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; unsigned char * in_what ; int in_what_stride = pre_stride ; int mv_stride = pre_stride ; unsigned char * bestaddress ; int_mv * best_mv = & d -> bmi. mv ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int r, c ; unsigned char * check_here ; int ref_row = ref_mv -> as_mv. row ; int ref_col = ref_mv -> as_mv. col ; int row_min = ref_row - distance ; int row_max = ref_row + distance ; int col_min = ref_col - distance ; int col_max = ref_col + distance ; <START_BUG> DECLARE_ALIGNED_ARRAY ( 16, unsigned short, sad_array8, 8 ) ; <END_BUG> unsigned int sad_array [ 3 ] ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; in_what = base_pre + d -> offset ; bestaddress = in_what + ( ref_row * pre_stride ) + ref_col ; best_mv -> as_mv. row = ref_row ; best_mv -> as_mv. col = ref_col ; bestsad = fn_ptr

Fix:
<S2SV_ModStart> + distance ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> 16, unsigned int, sad_array8 [ 8 ] <S2SV_ModEnd> ) ; unsigned <S2SV_ModStart> bestaddress, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; if
Buggy code:
 void __fput_sync ( struct file * file ) { if ( atomic_long_dec_and_test ( & file -> f_count ) ) { struct task_struct * task = current ; <START_BUG> file_sb_list_del ( file ) ; <END_BUG> BUG_ON (! ( task -> flags & PF_KTHREAD ) ) ; __fput ( file ) ; } }

Fix:
<S2SV_ModStart> = current ; <S2SV_ModEnd> BUG_ON (!
Buggy code:
 static int netlbl_cipsov4_add_common ( struct genl_info * info, struct cipso_v4_doi * doi_def ) { struct nlattr * nla ; int nla_rem ; u32 iter = 0 ; doi_def -> doi = nla_get_u32 ( info -> attrs [ NLBL_CIPSOV4_A_DOI ] ) ; if ( nla_validate_nested ( info -> attrs [ NLBL_CIPSOV4_A_TAGLST ], NLBL_CIPSOV4_A_MAX, netlbl_cipsov4_genl_policy )!= 0 ) return - EINVAL ; nla_for_each_nested ( nla, info -> attrs [ NLBL_CIPSOV4_A_TAGLST ], nla_rem ) if ( nla -> nla_type == NLBL_CIPSOV4_A_TAG ) { <START_BUG> if ( iter > CIPSO_V4_TAG_MAXCNT ) <END_BUG> return - EINVAL ; doi_def -> tags [ iter ++ ] = nla_get_u8 ( nla ) ; }  if ( iter < CIPSO_V4_TAG_MAXCNT ) <START_BUG> <END_BUG> doi_def -> tags [ iter ] = CIPSO_V4_TAG_INVALID ;  return 0 ; }

Fix:
<S2SV_ModStart> if ( iter >= <S2SV_ModEnd> CIPSO_V4_TAG_MAXCNT ) return <S2SV_ModStart> ) ; } while <S2SV_ModEnd> ( iter < <S2SV_ModStart> tags [ iter ++
Buggy code:
 void ion_free ( struct ion_client * client, struct ion_handle * handle ) { <START_BUG> bool valid_handle ; <END_BUG> BUG_ON ( client!= handle -> client ) ; mutex_lock ( & client -> lock ) ;  valid_handle = ion_handle_validate ( client, handle ) ; <START_BUG> if (! valid_handle ) { WARN ( 1, "%s:   invalid   handle   passed   to   free.\\n", __func__ ) ; mutex_unlock ( & client -> lock ) ; <END_BUG> return ;  } mutex_unlock ( & client -> lock ) ; ion_handle_put ( handle ) ; }

Fix:
<S2SV_ModStart> handle ) { <S2SV_ModEnd> BUG_ON ( client <S2SV_ModStart> lock ) ; ion_free_nolock <S2SV_ModEnd> ( client, <S2SV_ModStart> client, handle <S2SV_ModEnd> ) ; mutex_unlock <S2SV_ModStart> lock ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_p_b_slice ( dec_state_t * ps_dec ) { WORD16 * pi2_vld_out ; UWORD32 i ; yuv_buf_t * ps_cur_frm_buf = & ps_dec -> s_cur_frm_buf ; UWORD32 u4_frm_offset = 0 ; const dec_mb_params_t * ps_dec_mb_params ; IMPEG2D_ERROR_CODES_T e_error = ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE ; pi2_vld_out = ps_dec -> ai2_vld_buf ; memset ( ps_dec -> ai2_pred_mv, 0, sizeof ( ps_dec -> ai2_pred_mv ) ) ; ps_dec -> u2_prev_intra_mb = 0 ; ps_dec -> u2_first_mb = 1 ; ps_dec -> u2_picture_width = ps_dec -> u2_frame_width ; if ( ps_dec -> u2_picture_structure!= FRAME_PICTURE ) { ps_dec -> u2_picture_width <<= 1 ; if ( ps_dec -> u2_picture_structure == BOTTOM_FIELD ) { u4_frm_offset = ps_dec -> u2_frame_width ; } } do { UWORD32 u4_x_offset, u4_y_offset ; WORD32 ret ; UWORD32 u4_x_dst_offset = 0 ; UWORD32 u4_y_dst_offset = 0 ; UWORD8 * pu1_out_p ; UWORD8 * pu1_pred ; WORD32 u4_pred_strd ; IMPEG2D_TRACE_MB_START ( ps_dec -> u2_mb_x, ps_dec -> u2_mb_y ) ; if ( ps_dec -> e_pic_type == B_PIC ) ret = impeg2d_dec_pnb_mb_params ( ps_dec ) ; else ret = impeg2d_dec_p_mb_params ( ps_dec ) ; if ( ret ) <START_BUG> return IMPEG2D_MB_TEX_DE<END_BUG>

Fix:
<S2SV_ModStart> return IMPEG2D_MB_TEX_DECODE_ERR ; if ( 0 >= ps_dec -> u2_num_mbs_left ) { break ; }
Buggy code:
 static int get_core_reg ( struct kvm_vcpu * vcpu, const struct kvm_one_reg * reg ) { __u32 __user * uaddr = ( __u32 __user * ) ( unsigned long ) reg -> addr ; struct kvm_regs * regs = vcpu_gp_regs ( vcpu ) ; int nr_regs = sizeof ( * regs ) // sizeof ( __u32 ) ; u32 off ; off = core_reg_offset_from_id ( reg -> id ) ; if ( off >= nr_regs || ( off + ( KVM_REG_SIZE ( reg -> id ) // sizeof ( __u32 ) ) ) >= nr_regs ) return - ENOENT ; <START_BUG> if ( copy_to_user ( uaddr, ( ( u32 * ) regs ) + off, KVM_REG_SIZE ( reg -> id ) ) ) <END_BUG> return - EFAULT ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( validate_core_offset ( reg ) ) return - EINVAL ; if (
Buggy code:
 static const u_char * ikev1_attrmap_print ( netdissect_options * ndo, <START_BUG> const u_char * p, const u_char * ep, <END_BUG> const struct attrmap * map, size_t nmap ) { int totlen ; uint32_t t, v ;  if ( p [ 0 ] & 0x80 ) <START_BUG> totlen = 4 ; <END_BUG> else  totlen = 4 + EXTRACT_16BITS ( & p [ 2 ] ) ; <START_BUG> if ( ep < p + totlen ) { <END_BUG> ND_PRINT ( ( ndo, "[|attr]" ) ) ;  return ep + 1 ; <START_BUG> <END_BUG> }  ND_PRINT ( ( ndo, "(" ) ) ; t = EXTRACT_16BITS ( & p [ 0 ] ) & 0x7fff ; if ( map && t < nmap && map [ t ]. type ) ND_PRINT ( ( ndo, "type=%s   ", map [ t ]. type ) ) ; else ND_PRINT ( ( ndo, "type=#%d   ", t ) ) ; if ( p [ 0 ] & 0x80 ) { <START_BUG> ND_PRINT ( ( ndo, "value=" ) ) ; <END_BUG> v = EXTRACT_16BITS ( & p [ 2 ] ) ; if ( map && t < nmap && v < map [ t ]. nvalue && map [ t ]. value [ v ] ) ND_PRINT ( ( ndo, "%s", map [ t ]. value [ v ] ) ) ; else  rawprint ( ndo, ( const uint8_t * ) & p [ 2 ], 2 ) ; <START_BUG> } else { <END_BUG> ND_PRINT ( ( ndo, "len=%d   value=", EXTRACT_16BITS ( & p [ 2 ] ) ) ) ;  <START_BUG> rawprint ( ndo, ( const uint8_t * ) & p [ 4 ], EXTRACT_16BITS ( & p [ 2 ] ) ) ; <END_BUG> } ND_PRINT ( ( ndo, ")" ) ) ;  return p + totlen ; <START_BUG> <END_BUG> } 

Fix:
<S2SV_ModStart> const u_char * ep2 <S2SV_ModEnd>, const struct <S2SV_ModStart>, v ; ND_TCHECK ( p [ 0 ] ) ; <S2SV_ModStart> 4 ; else { ND_TCHECK_16BITS ( & p [ 2 ] ) ; <S2SV_ModStart> ] ) ; } if ( ep2 <S2SV_ModEnd> < p + <S2SV_ModStart> ) ; return ep2 <S2SV_ModEnd> + 1 ; <S2SV_ModStart> 1 ; } ND_TCHECK_16BITS ( & p [ 0 ] ) ; <S2SV_ModStart>, "value=" ) ) ; ND_TCHECK_16BITS ( & p [ 2 ] <S2SV_ModStart> ) ; else { if (! <S2SV_ModStart>, 2 ) ) { ND_PRINT ( ( ndo, ")" ) ) ; goto trunc ; } } <S2SV_ModEnd> } else { <S2SV_ModStart>, "len=%d <S2SV_blank> value=", totlen - 4 ) ) ; if (! <S2SV_ModEnd> rawprint ( ndo <S2SV_ModStart> 4 ], totlen - 4 ) ) { <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ) ) ; goto trunc ; } } ND_PRINT ( ( ndo, ")" ) ) ; <S2SV_ModStart> + totlen ; trunc : return NULL ;
Buggy code:
 static int check_ptr_alignment ( struct bpf_verifier_env * env, const struct bpf_reg_state * reg, int off, int size ) { bool strict = env -> strict_alignment ; const char * pointer_desc = "" ; switch ( reg -> type ) { case PTR_TO_PACKET : case PTR_TO_PACKET_META : return check_pkt_ptr_alignment ( env, reg, off, size, strict ) ; case PTR_TO_MAP_VALUE : pointer_desc = "value   " ; break ; case PTR_TO_CTX : pointer_desc = "context   " ; break ; case PTR_TO_STACK : pointer_desc = "stack   " ; <START_BUG> break ; <END_BUG> default : break ; } return check_generic_ptr_alignment ( env, reg, pointer_desc, off, size, strict ) ; }

Fix:
<S2SV_ModStart> = "stack <S2SV_blank> " ; strict = true ;
Buggy code:
 int <START_BUG> rad_get_vendor_attr ( u_int32_t * vendor, const void * * data, size_t * len ) <END_BUG> { struct vendor_attribute * attr ;  attr = ( struct vendor_attribute * ) * data ; <START_BUG> <END_BUG> * vendor = ntohl ( attr -> vendor_value ) ;  * data = attr -> attrib_data ; * len = attr -> attrib_len - 2 ; <START_BUG> return ( attr -> attrib_type ) ; <END_BUG> }

Fix:
<S2SV_ModStart> u_int32_t * vendor, unsigned char * type <S2SV_ModStart> size_t * len, const void * raw, size_t raw_len <S2SV_ModStart> * attr ; if ( raw_len < sizeof ( struct vendor_attribute ) ) { return - 1 ; } <S2SV_ModStart> vendor_attribute * ) raw <S2SV_ModEnd> ; * vendor <S2SV_ModStart> -> vendor_value ) ; * type = attr -> attrib_type <S2SV_ModStart> - 2 ; if ( ( attr -> attrib_len + 4 ) > raw_len ) { return - 1 ; }
Buggy code:
 static int spk_ttyio_ldisc_open ( struct tty_struct * tty ) { struct spk_ldisc_data * ldisc_data ; if (! tty -> ops -> write ) return - EOPNOTSUPP ; <START_BUG> speakup_tty = tty ; <END_BUG> ldisc_data = kmalloc ( sizeof ( * ldisc_data ), GFP_KERNEL ) ;  if (! ldisc_data ) <START_BUG> <END_BUG> return - ENOMEM ;  init_completion ( & ldisc_data -> completion ) ; ldisc_data -> buf_free = true ; speakup_tty -> disc_data = ldisc_data ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> - EOPNOTSUPP ; mutex_lock ( & speakup_tty_mutex ) ; if ( speakup_tty ) { mutex_unlock ( & speakup_tty_mutex ) ; return - EBUSY ; } <S2SV_ModStart>! ldisc_data ) { speakup_tty = NULL ; mutex_unlock ( & speakup_tty_mutex ) ; <S2SV_ModStart> - ENOMEM ; } <S2SV_ModStart> = ldisc_data ; mutex_unlock ( & speakup_tty_mutex ) ;
Buggy code:
 WORD32 ih264d_mark_err_slice_skip ( dec_struct_t * ps_dec, WORD32 num_mb_skip, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num, pocstruct_t * ps_cur_poc, WORD32 prev_slice_err ) { WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2 ; UWORD32 u1_mb_idx = ps_dec -> u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end ; UWORD32 u1_tfr_n_mb ; UWORD32 u1_decode_nmb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD16 u2_total_mbs_coded ; UWORD32 u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; parse_part_params_t * ps_part_info ; WORD32 ret ; <START_BUG> if ( ps_dec -> ps_dec_err_status -> u1_err_flag & REJECT_CUR_PIC ) <END_BUG> { ih264d_err_pic_dispbuf_mgr ( ps_

Fix:
<S2SV_ModStart> WORD32 ret ; UNUSED ( u1_is_idr_slice ) ; <S2SV_ModStart> = u2_frame_num ; <S2SV_ModEnd> { WORD32 i
Buggy code:
 static void flatpak_proxy_client_finalize ( GObject * object ) { FlatpakProxyClient * client = FLATPAK_PROXY_CLIENT ( object ) ; client -> proxy -> clients = g_list_remove ( client -> proxy -> clients, client ) ; <START_BUG> g_clear_object ( & client -> proxy ) ; <END_BUG> g_hash_table_destroy ( client -> rewrite_reply ) ; g_hash_table_destroy ( client -> get_owner_reply ) ; g_hash_table_destroy ( client -> unique_id_policy ) ; free_side ( & client -> client_side ) ; free_side ( & client -> bus_side ) ; G_OBJECT_CLASS ( flatpak_proxy_client_parent_class ) -> finalize ( object ) ; }

Fix:
<S2SV_ModStart> client -> proxy ) ; g_byte_array_free ( client -> auth_buffer, TRUE
Buggy code:
 static int atl2_probe ( struct pci_dev * pdev, const struct pci_device_id * ent ) { struct net_device * netdev ; struct atl2_adapter * adapter ; static int cards_found ; unsigned long mmio_start ; int mmio_len ; int err ; cards_found = 0 ; err = pci_enable_device ( pdev ) ; if ( err ) return err ; if ( pci_set_dma_mask ( pdev, DMA_BIT_MASK ( 32 ) ) && pci_set_consistent_dma_mask ( pdev, DMA_BIT_MASK ( 32 ) ) ) { printk ( KERN_ERR "atl2:   No   usable   DMA   configuration,   aborting\\n" ) ; goto err_dma ; } err = pci_request_regions ( pdev, atl2_driver_name ) ; if ( err ) goto err_pci_reg ; pci_set_master ( pdev ) ; err = - ENOMEM ; netdev = alloc_etherdev ( sizeof ( struct atl2_adapter ) ) ; if (! netdev ) goto err_alloc_etherdev ; SET_NETDEV_DEV ( netdev, & pdev -> dev ) ; pci_set_drvdata ( pdev, netdev ) ; adapter = netdev_priv ( netdev ) ; adapter -> netdev = netdev ; adapter -> pdev = pdev ; adapter -> hw. back = adapter ; mmio_start = pci_resource_start ( pdev, 0x0 ) ; mmio_len = pci_resource_len ( pdev, 0x0 ) ; adapter -> hw. mem_rang = ( u32 ) mmio_len ; adapter -> hw. hw_addr = ioremap ( mmio_start, mmio_len ) ; if (! adapter -> hw. hw_addr ) { err = - EIO ; goto err_ioremap ; } atl2_setup_pcicmd ( pdev ) ; netdev -> netdev_ops = & atl2_netdev_ops ; netdev -> ethtool_ops = & atl2_ethtool_ops ; netdev -> watchdog_timeo = 5 * HZ

Fix:
<S2SV_ModStart> -> hw_features = <S2SV_ModEnd> NETIF_F_HW_VLAN_CTAG_RX ; netdev
Buggy code:
 static void logi_dj_recv_add_djhid_device ( struct dj_receiver_dev * djrcv_dev, struct dj_report * dj_report ) { struct hid_device * djrcv_hdev = djrcv_dev -> hdev ; struct usb_interface * intf = to_usb_interface ( djrcv_hdev -> dev. parent ) ; struct usb_device * usbdev = interface_to_usbdev ( intf ) ; struct hid_device * dj_hiddev ; struct dj_device * dj_dev ; unsigned char tmpstr [ 3 ] ; if ( dj_report -> report_params [ DEVICE_PAIRED_PARAM_SPFUNCTION ] & SPFUNCTION_DEVICE_LIST_EMPTY ) { dbg_hid ( "%s:   device   list   is   empty\\n", __func__ ) ; djrcv_dev -> querying_devices = false ; return ; } <START_BUG> if ( ( dj_report -> device_index < DJ_DEVICE_INDEX_MIN ) || <END_BUG> ( dj_report -> device_index > DJ_DEVICE_INDEX_MAX ) ) { dev_err ( & djrcv_hdev -> dev, "%s:   invalid   device   index:%d\\n", __func__, dj_report -> device_index ) ; return ; } if ( djrcv_dev -> paired_dj_devices [ dj_report -> device_index ] ) { dbg_hid ( "%s:   device   is   already   known\\n", __func__ ) ; return ; } dj_hiddev = hid_allocate_device ( ) ; if ( IS_ERR ( dj_hiddev ) ) { dev_err ( & djrcv_hdev -> dev, "%s:   hid_allocate_device   failed\\n", __func__ ) ; return ; } dj_hiddev -> ll_driver = & logi_dj_ll_driver ; dj_hiddev -> dev. parent = & djrcv_hdev -> dev ; dj_hiddev -> bus = BUS_USB ; dj_hiddev -> vendor = le16_to_cpu ( usbdev -> descriptor. idVendor ) ; dj_hiddev -> product = le16_to_cpu ( usbdev ->

Fix:
<S2SV_ModStart> } if ( <S2SV_ModEnd> djrcv_dev -> paired_dj_devices
Buggy code:
 static void uipc_flush_ch_locked ( tUIPC_CH_ID ch_id ) { char buf [ UIPC_FLUSH_BUFFER_SIZE ] ; struct pollfd pfd ; int ret ; pfd. events = POLLIN ; pfd. fd = uipc_main. ch [ ch_id ]. fd ; if ( uipc_main. ch [ ch_id ]. fd == UIPC_DISCONNECTED ) { BTIF_TRACE_EVENT ( "%s()   -   fd   disconnected.   Exiting", __FUNCTION__ ) ; return ; } while ( 1 ) { <START_BUG> ret = poll ( & pfd, 1, 1 ) ; <END_BUG> BTIF_TRACE_VERBOSE ( "%s()   -   polling   fd   %d,   revents:   0x%x,   ret   %d", __FUNCTION__, pfd. fd, pfd. revents, ret ) ; if ( pfd. revents & ( POLLERR | POLLHUP ) ) { BTIF_TRACE_EVENT ( "%s()   -   POLLERR   or   POLLHUP.   Exiting", __FUNCTION__ ) ; return ; } if ( ret <= 0 ) { BTIF_TRACE_EVENT ( "%s()   -   error   (%d).   Exiting", __FUNCTION__, ret ) ; return ; }  read ( pfd. fd, & buf, UIPC_FLUSH_BUFFER_SIZE ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> { ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> 1, 1 ) <S2SV_ModStart> return ; } TEMP_FAILURE_RETRY ( <S2SV_ModStart>, UIPC_FLUSH_BUFFER_SIZE ) )
Buggy code:
 <START_BUG> void Huff_transmit ( huff_t * huff, int ch, byte * fout ) { <END_BUG> int i ; if ( huff -> loc [ ch ] == NULL ) {  Huff_transmit ( huff, NYT, fout ) ; <START_BUG> for ( i = 7 ; i >= 0 ; i -- ) { add_bit ( ( char ) ( ( ch >> i ) & 0x1 ), fout ) ; } } else { <END_BUG> send ( huff -> loc [ ch ], NULL, fout ) ;  } }

Fix:
<S2SV_ModStart> byte * fout, int maxoffset <S2SV_ModStart> NYT, fout, maxoffset <S2SV_ModStart> NULL, fout, maxoffset
Buggy code:
 static int clie_5_attach ( struct usb_serial * serial ) { struct usb_serial_port * port ; unsigned int pipe ; int j ; <START_BUG> if ( serial -> num_ports < 2 ) <END_BUG> return - 1 ; port = serial -> port [ 0 ] ; port -> bulk_out_endpointAddress = serial -> port [ 1 ] -> bulk_out_endpointAddress ; pipe = usb_sndbulkpipe ( serial -> dev, port -> bulk_out_endpointAddress ) ; for ( j = 0 ; j < ARRAY_SIZE ( port -> write_urbs ) ; ++ j ) port -> write_urbs [ j ] -> pipe = pipe ; return 0 ; }

Fix:
<S2SV_ModStart> ( serial -> num_bulk_out <S2SV_ModEnd> < 2 ) <S2SV_ModStart> < 2 ) { dev_err ( & serial -> interface -> dev, "missing <S2SV_blank> bulk <S2SV_blank> out <S2SV_blank> endpoints\\n" ) ; return - ENODEV ; } <S2SV_ModEnd> port = serial
Buggy code:
 struct key * key_get_instantiation_authkey ( key_serial_t target_id ) { char description [ 16 ] ; struct keyring_search_context ctx = {. index_key. type = & key_type_request_key_auth,. index_key. description = description,. cred = current_cred ( ), <START_BUG>. match_data. cmp = user_match, <END_BUG>. match_data. raw_data = description,. match_data. lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT, } ; struct key * authkey ; key_ref_t authkey_ref ; sprintf ( description, "%x", target_id ) ; authkey_ref = search_process_keyrings ( & ctx ) ; if ( IS_ERR ( authkey_ref ) ) { authkey = ERR_CAST ( authkey_ref ) ; if ( authkey == ERR_PTR ( - EAGAIN ) ) authkey = ERR_PTR ( - ENOKEY ) ; goto error ; } authkey = key_ref_to_ptr ( authkey_ref ) ; if ( test_bit ( KEY_FLAG_REVOKED, & authkey -> flags ) ) { key_put ( authkey ) ; authkey = ERR_PTR ( - EKEYREVOKED ) ; } error : return authkey ; }

Fix:
<S2SV_ModStart>. cmp = key_default_cmp <S2SV_ModEnd>,. match_data
Buggy code:
 socket_t * socket_accept ( const socket_t * socket ) { assert ( socket!= NULL ) ; <START_BUG> int fd = accept ( socket -> fd, NULL, NULL ) ; <END_BUG> if ( fd == INVALID_FD ) { LOG_ERROR ( "%s   unable   to   accept   socket:   %s", __func__, strerror ( errno ) ) ; return NULL ; } socket_t * ret = ( socket_t * ) osi_calloc ( sizeof ( socket_t ) ) ; if (! ret ) { close ( fd ) ; LOG_ERROR ( "%s   unable   to   allocate   memory   for   socket.", __func__ ) ; return NULL ; } ret -> fd = fd ; return ret ; }

Fix:
<S2SV_ModStart> int fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart> NULL, NULL )
Buggy code:
 static int read_gab2_sub ( AVFormatContext * s, AVStream * st, AVPacket * pkt ) { if ( pkt -> size >= 7 && pkt -> size < INT_MAX - AVPROBE_PADDING_SIZE &&! strcmp ( pkt -> data, "GAB2" ) && AV_RL16 ( pkt -> data + 5 ) == 2 ) { uint8_t desc [ 256 ] ; int score = AVPROBE_SCORE_EXTENSION, ret ; AVIStream * ast = st -> priv_data ; AVInputFormat * sub_demuxer ; AVRational time_base ; int size ; AVIOContext * pb = avio_alloc_context ( pkt -> data + 7, pkt -> size - 7, 0, NULL, NULL, NULL, NULL ) ; AVProbeData pd ; unsigned int desc_len = avio_rl32 ( pb ) ; if ( desc_len > pb -> buf_end - pb -> buf_ptr ) goto error ; ret = avio_get_str16le ( pb, desc_len, desc, sizeof ( desc ) ) ; avio_skip ( pb, desc_len - ret ) ; if ( * desc ) av_dict_set ( & st -> metadata, "title", desc, 0 ) ; avio_rl16 ( pb ) ; avio_rl32 ( pb ) ; size = pb -> buf_end - pb -> buf_ptr ; pd = ( AVProbeData ) {. buf = av_mallocz ( size + AVPROBE_PADDING_SIZE ),. buf_size = size } ; if (! pd. buf ) goto error ; memcpy ( pd. buf, pb -> buf_ptr, size ) ; sub_demuxer = av_probe_input_format2 ( & pd, 1, & score ) ; av_freep ( & pd. buf ) ; if (! sub_demuxer ) goto error ; <START_BUG> if (! ( ast -> sub_ctx = avformat_alloc_context ( ) ) ) <END_BUG> goto error ; ast -> sub_ctx -> pb = pb ; if ( ff_copy_whiteblacklists ( ast -> sub_ctx, s ) < 0 ) goto error ; if (! avformat_open_input ( & ast -> sub_ctx, ""

Fix:
<S2SV_ModStart> ; if ( strcmp ( sub_demuxer -> name, "srt" ) && strcmp ( sub_demuxer -> name, "ass" ) ) goto error ; if (
Buggy code:
 void * ipc_rcu_alloc ( int size ) { void * out ; if ( rcu_use_vmalloc ( size ) ) { out = vmalloc ( HDRLEN_VMALLOC + size ) ; <START_BUG> if ( out ) { <END_BUG> out += HDRLEN_VMALLOC ; container_of ( out, struct ipc_rcu_hdr, data ) -> is_vmalloc = 1 ;  container_of ( out, struct ipc_rcu_hdr, data ) -> refcount = 1 ; <START_BUG> } } else { out = kmalloc ( HDRLEN_KMALLOC + size, GFP_KERNEL ) ; <END_BUG> if ( out ) {  out += HDRLEN_KMALLOC ; container_of ( out, struct ipc_rcu_hdr, data ) -> is_vmalloc = 0 ; <START_BUG> container_of ( out, struct ipc_rcu_hdr, data ) -> refcount = 1 ; <END_BUG> } } return out ; }

Fix:
<S2SV_ModStart> ; if (! out ) goto done ; <S2SV_ModEnd> out += HDRLEN_VMALLOC <S2SV_ModStart> = 1 ; <S2SV_ModEnd> } else { <S2SV_ModStart> ; if (! out ) goto done ; <S2SV_ModEnd> out += HDRLEN_KMALLOC <S2SV_ModStart> = 0 ; } atomic_set ( & <S2SV_ModStart> ) -> refcount, 1 ) ; done : <S2SV_ModEnd> return out ;