nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int init_nss_hash ( struct crypto_instance * instance ) { PK11SlotInfo * hash_slot = NULL ; SECItem hash_param ; if (! hash_to_nss [ instance -> crypto_hash_type ] ) { return 0 ; } hash_param. type = siBuffer ; <START_BUG> hash_param. data = 0 ; <END_BUG>  hash_param. len = 0 ; <START_BUG> hash_slot = PK11_GetBestSlot ( hash_to_nss [ instance -> crypto_hash_type ], NULL ) ; if ( hash_slot == NULL ) { log_printf ( instance -> log_level_security, "Unable   to   find   security   slot   (err   %d)", PR_GetError ( ) ) ; return - 1 ; } instance -> nss_sym_key_sign = PK11_ImportSymKey ( hash_slot, hash_to_nss [ instance -> crypto_hash_type ], PK11_OriginUnwrap, CKA_SIGN, & hash_param, NULL ) ; if ( instance -> nss_sym_key_sign == NULL ) { log_printf ( instance -> log_level_security, "Failure   to   import   key   into   NSS   (err   %d)", PR_GetError ( ) ) ; return - 1 ; } PK11_FreeSlot ( hash_slot ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart>. data = instance -> private_key <S2SV_ModEnd> ; hash_param. <S2SV_ModStart>. len = instance -> private_key_len <S2SV_ModEnd> ; hash_slot =
Buggy code:
 static uint16_t transmit_data ( serial_data_type_t type, uint8_t * data, uint16_t length ) { assert ( data!= NULL ) ; assert ( length > 0 ) ; if ( type < DATA_TYPE_COMMAND || type > DATA_TYPE_SCO ) { LOG_ERROR ( "%s   invalid   data   type:   %d", __func__, type ) ; return 0 ; } -- data ; uint8_t previous_byte = * data ; * ( data ) = type ; ++ length ; uint16_t transmitted_length = 0 ; while ( length > 0 ) { <START_BUG> ssize_t ret = write ( uart_fd, data + transmitted_length, length ) ; <END_BUG> switch ( ret ) { case - 1 : LOG_ERROR ( "In   %s,   error   writing   to   the   uart   serial   port:   %s", __func__, strerror ( errno ) ) ; goto done ; case 0 : goto done ; default : transmitted_length += ret ; length -= ret ; break ; } } done : ; * ( data ) = previous_byte ; if ( transmitted_length > 0 ) -- transmitted_length ; return transmitted_length ; }

Fix:
<S2SV_ModStart> ssize_t ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> transmitted_length, length )
Buggy code:
 void vrrp_print_stats ( void ) { <START_BUG> FILE * file ; <END_BUG>  file = fopen ( stats_file, "w" ) ; <START_BUG> if (! file ) { log_message ( LOG_INFO, "Can\'t   open   %s   (%d:   %s)", stats_file, errno, strerror ( errno ) ) ; return ; } list l = vrrp_data -> vrrp ; element e ; vrrp_t * vrrp ; <END_BUG> for ( e = LIST_HEAD ( l ) ; e ; ELEMENT_NEXT ( e ) ) {  vrrp = ELEMENT_DATA ( e ) ; fprintf ( file, "VRRP   Instance:   %s\\n", vrrp -> iname ) ; fprintf ( file, "     Advertisements:\\n" ) ; fprintf ( file, "         Received:   %" PRIu64 "\\n", vrrp -> stats -> advert_rcvd ) ; fprintf ( file, "         Sent:   %d\\n", vrrp -> stats -> advert_sent ) ; fprintf ( file, "     Became   master:   %d\\n", vrrp -> stats -> become_master ) ; fprintf ( file, "     Released   master:   %d\\n", vrrp -> stats -> release_master ) ; fprintf ( file, "     Packet   Errors:\\n" ) ; fprintf ( file, "         Length:   %" PRIu64 "\\n", vrrp -> stats -> packet_len_err ) ; fprintf ( file, "         TTL:   %" PRIu64 "\\n", vrrp -> stats -> ip_ttl_err ) ; fprintf ( file, "         Invalid   Type:   %" PRIu64 "\\n", vrrp -> stats -> invalid_type_rcvd ) ; fprintf ( file, "         Advertisement   Interval:   %" PRIu64 "\\n", vrrp -> stats -> advert_interval_err ) ; fprintf ( file, "         Address   List:   %" PRIu64 "\\n", vrrp -> stats -> addr_list_err ) ;

Fix:
<S2SV_ModStart> FILE * file = fopen_safe <S2SV_ModEnd> ( stats_file, <S2SV_ModStart>, "w" ) <S2SV_ModEnd> ; element e <S2SV_ModStart> * vrrp ; if (! file ) { log_message ( LOG_INFO, "Can\'t <S2SV_blank> open <S2SV_blank> %s <S2SV_blank> (%d: <S2SV_blank> %s)", stats_file, errno, strerror ( errno ) ) ; return ; } LIST_FOREACH ( vrrp_data -> vrrp, vrrp, e ) { <S2SV_ModEnd> fprintf ( file
Buggy code:
 static void snd_usb_mixer_free ( struct usb_mixer_interface * mixer ) <START_BUG> { <END_BUG> kfree ( mixer -> id_elems ) ; if ( mixer -> urb ) { kfree ( mixer -> urb -> transfer_buffer ) ; usb_free_urb ( mixer -> urb ) ; } usb_free_urb ( mixer -> rc_urb ) ; kfree ( mixer -> rc_setup_packet ) ; kfree ( mixer ) ; }

Fix:
<S2SV_ModStart> mixer ) { snd_usb_mixer_disconnect ( mixer ) ;
Buggy code:
 static int sd_isoc_init ( struct gspca_dev * gspca_dev ) <START_BUG> { <END_BUG> struct usb_host_interface * alt ; int max_packet_size ; switch ( gspca_dev -> pixfmt. width ) { case 160 : max_packet_size = 450 ; break ; case 176 : max_packet_size = 600 ; break ; default : max_packet_size = 1022 ; break ; }  alt = & gspca_dev -> dev -> actconfig -> intf_cache [ 0 ] -> altsetting [ 1 ] ; <START_BUG> alt -> endpoint [ 0 ]. desc. wMaxPacketSize = cpu_to_le16 ( max_packet_size ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> gspca_dev ) { struct usb_interface_cache * intfc ; <S2SV_ModStart> break ; } intfc = <S2SV_ModEnd> gspca_dev -> dev <S2SV_ModStart> [ 0 ] ; if ( intfc -> num_altsetting < 2 ) return - ENODEV ; alt = & intfc <S2SV_ModStart> [ 1 ] ; if ( alt -> desc. bNumEndpoints < 1 ) return - ENODEV
Buggy code:
 int migrate_page_move_mapping ( struct address_space * mapping, struct page * newpage, struct page * page, struct buffer_head * head, enum migrate_mode mode, int extra_count ) { <START_BUG> int expected_count = 1 + extra_count ; <END_BUG> void * * pslot ; if (! mapping ) { if ( page_count ( page )!= expected_count ) return - EAGAIN ; set_page_memcg ( newpage, page_memcg ( page ) ) ; newpage -> index = page -> index ; newpage -> mapping = page -> mapping ; if ( PageSwapBacked ( page ) ) SetPageSwapBacked ( newpage ) ; return MIGRATEPAGE_SUCCESS ;  } <START_BUG> spin_lock_irq ( & mapping -> tree_lock ) ; pslot = radix_tree_lookup_slot ( & mapping -> page_tree, page_index ( page ) ) ; expected_count += 1 + page_has_private ( page ) ; if ( page_count ( page )!= expected_count || radix_tree_deref_slot_protected ( pslot, & mapping -> tree_lock )!= page ) { spin_unlock_irq ( & mapping -> tree_lock ) ; return - EAGAIN ; } if (! page_freeze_refs ( page, expected_count ) ) { spin_unlock_irq ( & mapping -> tree_lock ) ; return - EAGAIN ; } if ( mode == MIGRATE_ASYNC && head &&! buffer_migrate_lock_buffers ( head, mode ) ) { page_unfreeze_refs ( page, expected_count ) ; spin_unlock_irq ( & mapping -> tree_lock ) ; return - EAGAIN ; } set_page_memcg ( newpage, page_memcg ( page ) ) ; newpage -> index = page -> index ; newpage -> mapping = page -> mapping ; if ( PageSwapBacked ( page ) ) SetPageSwapBacked ( newpage ) ; get_page ( newpage ) ; if ( PageSwapCache ( page ) ) { SetPageSwapCache ( newpage ) ; set_page_private ( newpage, page_private ( page ) ) ; } <END_BUG> radix_tree_replace_slot ( pslot, newpage ) ;  page_unfreeze_refs ( page

Fix:
<S2SV_ModStart> extra_count ) { struct zone * oldzone, * newzone ; int dirty ; <S2SV_ModStart> MIGRATEPAGE_SUCCESS ; } oldzone = page_zone ( page ) ; newzone = page_zone ( newpage ) ; <S2SV_ModStart> ) ; } dirty = PageDirty ( page ) ; if ( dirty ) { ClearPageDirty ( page ) ; SetPageDirty ( newpage ) ; } <S2SV_ModStart> 1 ) ; spin_unlock ( & mapping -> tree_lock ) ; if ( newzone!= oldzone ) { __dec_zone_state ( oldzone <S2SV_ModEnd>, NR_FILE_PAGES ) <S2SV_ModStart> NR_FILE_PAGES ) ; __inc_zone_state ( newzone <S2SV_ModEnd>, NR_FILE_PAGES ) <S2SV_ModStart> ; if ( PageSwapBacked ( page ) && <S2SV_ModStart> ( page ) ) { __dec_zone_state ( oldzone, NR_SHMEM ) ; __inc_zone_state ( newzone, NR_SHMEM ) ; } if ( dirty && mapping_cap_account_dirty ( mapping ) ) { __dec_zone_state ( oldzone, NR_FILE_DIRTY ) ; __inc_zone_state ( newzone, N
Buggy code:
 pcap_t * pcap_ng_check_header ( const uint8_t * magic, FILE * fp, u_int precision, char * errbuf, int * err ) { bpf_u_int32 magic_int ; size_t amt_read ; bpf_u_int32 total_length ; bpf_u_int32 byte_order_magic ; struct block_header * bhdrp ; struct section_header_block * shbp ; pcap_t * p ; int swapped = 0 ; struct pcap_ng_sf * ps ; int status ; struct block_cursor cursor ; struct interface_description_block * idbp ; * err = 0 ; memcpy ( & magic_int, magic, sizeof ( magic_int ) ) ; if ( magic_int!= BT_SHB ) { return ( NULL ) ; } amt_read = fread ( & total_length, 1, sizeof ( total_length ), fp ) ; if ( amt_read < sizeof ( total_length ) ) { if ( ferror ( fp ) ) { pcap_fmt_errmsg_for_errno ( errbuf, PCAP_ERRBUF_SIZE, errno, "error   reading   dump   file" ) ; * err = 1 ; return ( NULL ) ; } return ( NULL ) ; } amt_read = fread ( & byte_order_magic, 1, sizeof ( byte_order_magic ), fp ) ; if ( amt_read < sizeof ( byte_order_magic ) ) { if ( ferror ( fp ) ) { pcap_fmt_errmsg_for_errno ( errbuf, PCAP_ERRBUF_SIZE, errno, "error   reading   dump   file" ) ; * err = 1 ; return ( NULL ) ; } return ( NULL ) ; } if ( byte_order_magic!= BYTE_ORDER_MAGIC ) { byte_order_magic = SWAPLONG ( byte_order_magic ) ; if ( byte_order_magic!= BYTE_ORDER_MAGIC ) { return ( NULL ) ; } swapped = 1 ; total_length = SWAPLONG ( total_length ) ; } <START_BUG> if ( total_length < sizeof ( * bhdrp ) + sizeof ( * shbp ) + sizeof ( struct block_trailer ) ) { <END_BUG> pcap_snprintf ( errbuf

Fix:
<S2SV_ModStart> struct block_trailer ) || ( total_length > BT_SHB_INSANE_MAX ) <S2SV_ModStart>, PCAP_ERRBUF_SIZE, "Section <S2SV_blank> Header <S2SV_blank> Block <S2SV_blank> in <S2SV_blank> pcapng <S2SV_blank> dump <S2SV_blank> file <S2SV_blank> has <S2SV_blank> invalid <S2SV_blank> length <S2SV_blank> %" PRIsize " <S2SV_blank> < <S2SV_blank> _%lu_ <S2SV_blank> < <S2SV_blank> %lu <S2SV_blank> (BT_SHB_INSANE_MAX)" <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> struct block_trailer ), total_length, BT_SHB_INSANE_MAX <S2SV_ModEnd> ) ; *
Buggy code:
 int xfs_attr_rmtval_set ( struct xfs_da_args * args ) { struct xfs_inode * dp = args -> dp ; struct xfs_mount * mp = dp -> i_mount ; struct xfs_bmbt_irec map ; xfs_dablk_t lblkno ; xfs_fileoff_t lfileoff = 0 ; __uint8_t * src = args -> value ; int blkcnt ; int valuelen ; int nmap ; int error ; int offset = 0 ; trace_xfs_attr_rmtval_set ( args ) ; <START_BUG> blkcnt = xfs_attr3_rmt_blocks ( mp, args -> valuelen ) ; <END_BUG> error = xfs_bmap_first_unused ( args -> trans, args -> dp, blkcnt, & lfileoff, XFS_ATTR_FORK ) ; if ( error ) return error ; args -> rmtblkno = lblkno = ( xfs_dablk_t ) lfileoff ; args -> rmtblkcnt = blkcnt ; while ( blkcnt > 0 ) { int committed ; xfs_bmap_init ( args -> flist, args -> firstblock ) ; nmap = 1 ; error = xfs_bmapi_write ( args -> trans, dp, ( xfs_fileoff_t ) lblkno, blkcnt, XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA, args -> firstblock, args -> total, & map, & nmap, args -> flist ) ; if (! error ) { error = xfs_bmap_finish ( & args -> trans, args -> flist, & committed ) ; } if ( error ) { ASSERT ( committed ) ; args -> trans = NULL ; xfs_bmap_cancel ( args -> flist ) ; return ( error ) ; } if ( committed ) xfs_trans_ijoin ( args -> trans, dp, 0 ) ; ASSERT ( nmap == 1 ) ; ASSERT ( ( map. br_startblock!= DELAYSTARTBLOCK ) && ( map. br_startblock!= HOLESTARTBLOCK ) ) ; lblkno += map. br_blockcount ; blkcnt -= map. br_blockcount ; error =

Fix:
<S2SV_ModStart>, args -> rmtvaluelen <S2SV_ModEnd> ) ; error <S2SV_ModStart> = args -> rmtvaluelen <S2SV_ModEnd> ; while (
Buggy code:
 int lldp_decode ( struct lldpd * cfg, char * frame, int s, struct lldpd_hardware * hardware, struct lldpd_chassis * * newchassis, struct lldpd_port * * newport ) { struct lldpd_chassis * chassis ; struct lldpd_port * port ; const char lldpaddr [ ] = LLDP_MULTICAST_ADDR ; const char dot1 [ ] = LLDP_TLV_ORG_DOT1 ; const char dot3 [ ] = LLDP_TLV_ORG_DOT3 ; const char med [ ] = LLDP_TLV_ORG_MED ; const char dcbx [ ] = LLDP_TLV_ORG_DCBX ; unsigned char orgid [ 3 ] ; int length, gotend = 0, ttl_received = 0 ; int tlv_size, tlv_type, tlv_subtype ; u_int8_t * pos, * tlv ; char * b ; # ifdef ENABLE_DOT1 struct lldpd_vlan * vlan = NULL ; int vlan_len ; struct lldpd_ppvid * ppvid ; struct lldpd_pi * pi = NULL ; # endif struct lldpd_mgmt * mgmt ; int af ; u_int8_t addr_str_length, addr_str_buffer [ 32 ] ; u_int8_t addr_family, addr_length, * addr_ptr, iface_subtype ; u_int32_t iface_number, iface ; # ifdef ENABLE_CUSTOM struct lldpd_custom * custom = NULL ; # endif log_debug ( "lldp", "receive   LLDP   PDU   on   %s", hardware -> h_ifname ) ; if ( ( chassis = calloc ( 1, sizeof ( struct lldpd_chassis ) ) ) == NULL ) { log_warn ( "lldp", "failed   to   allocate   remote   chassis" ) ; return - 1 ; } TAILQ_INIT ( & chassis -> c_mgmt ) ; if ( ( port = calloc ( 1, sizeof ( struct lldpd_port ) ) ) == NULL ) { log_warn ( "lldp", "failed   to   allocate   remote   port" ) ; free ( ch

Fix:
<S2SV_ModStart> = PEEK_UINT8 ; if ( addr_str_length > sizeof ( addr_str_buffer ) ) { log_warnx ( "lldp", "too <S2SV_blank> large <S2SV_blank> management <S2SV_blank> address <S2SV_blank> on <S2SV_blank> %s", hardware -> h_ifname ) ; goto malformed ; } <S2SV_ModStart> : CHECK_TLV_SIZE ( 1 + ( int ) sizeof ( orgid ) <S2SV_ModEnd>, "Organisational" )
Buggy code:
 void vp8_build_intra_predictors_mby_s_c ( MACROBLOCKD * x, unsigned char * yabove_row, unsigned char * yleft, int left_stride, unsigned char * ypred_ptr, int y_stride ) { unsigned char yleft_col [ 16 ] ; unsigned char ytop_left = yabove_row [ - 1 ] ; int r, c, i ; for ( i = 0 ; i < 16 ; i ++ ) { yleft_col [ i ] = yleft [ i * left_stride ] ; } switch ( x -> mode_info_context -> mbmi. mode ) { case DC_PRED : { int expected_dc ; int shift ; int average = 0 ; if ( x -> up_available || x -> left_available ) { if ( x -> up_available ) { for ( i = 0 ; i < 16 ; i ++ ) { average += yabove_row [ i ] ; } } if ( x -> left_available ) { for ( i = 0 ; i < 16 ; i ++ ) { average += yleft_col [ i ] ; } } shift = 3 + x -> up_available + x -> left_available ; expected_dc = ( average + ( 1 << ( shift - 1 ) ) ) >> shift ; } else { expected_dc = 128 ; } for ( r = 0 ; r < 16 ; r ++ ) { <START_BUG> vpx_memset ( ypred_ptr, expected_dc, 16 ) ; <END_BUG> ypred_ptr += y_stride ; } } break ; case V_PRED : { for ( r = 0 ; r < 16 ; r ++ ) { ( ( int * ) ypred_ptr ) [ 0 ] = ( ( int * ) yabove_row ) [ 0 ] ; ( ( int * ) ypred_ptr ) [ 1 ] = ( ( int * ) yabove_row ) [ 1 ] ; ( ( int * ) ypred_ptr ) [ 2 ] = ( ( int * ) yabove_row ) [ 2 ] ; ( ( int * ) ypred_ptr ) [ 3 ] = ( ( int * ) yabove_row ) [ 3 ] ; ypred_ptr += y_stride ; } } break ; case H_PRED : { for ( r = 0 ; r < 16 ; r ++ ) {

Fix:
<S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( ypred_ptr, <S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( ypred_ptr,
Buggy code:
 static int splice_pipe_to_pipe ( struct pipe_inode_info * ipipe, struct pipe_inode_info * opipe, size_t len, unsigned int flags ) { struct pipe_buffer * ibuf, * obuf ; int ret = 0, nbuf ; bool input_wakeup = false ; retry : ret = ipipe_prep ( ipipe, flags ) ; if ( ret ) return ret ; ret = opipe_prep ( opipe, flags ) ; if ( ret ) return ret ; pipe_double_lock ( ipipe, opipe ) ; do { if (! opipe -> readers ) { send_sig ( SIGPIPE, current, 0 ) ; if (! ret ) ret = - EPIPE ; break ; } if (! ipipe -> nrbufs &&! ipipe -> writers ) break ; if (! ipipe -> nrbufs || opipe -> nrbufs >= opipe -> buffers ) { if ( ret ) break ; if ( flags & SPLICE_F_NONBLOCK ) { ret = - EAGAIN ; break ; } pipe_unlock ( ipipe ) ; pipe_unlock ( opipe ) ; goto retry ; } ibuf = ipipe -> bufs + ipipe -> curbuf ; nbuf = ( opipe -> curbuf + opipe -> nrbufs ) & ( opipe -> buffers - 1 ) ; obuf = opipe -> bufs + nbuf ; if ( len >= ibuf -> len ) { * obuf = * ibuf ; ibuf -> ops = NULL ; opipe -> nrbufs ++ ; ipipe -> curbuf = ( ipipe -> curbuf + 1 ) & ( ipipe -> buffers - 1 ) ; ipipe -> nrbufs -- ; input_wakeup = true ; } else { <START_BUG> pipe_buf_get ( ipipe, ibuf ) ; <END_BUG> * obuf = * ibuf ; obuf -> flags &= ~ PIPE_BUF_FLAG_GIFT ; obuf -> len = len ; opipe -> nrbufs ++ ; ibuf -> offset += obuf -> len ; ibuf -> len -= obuf -> len ; } ret += obuf -> len ; len -= obuf -> len ; } while ( len ) ; pipe_unlock ( ipipe ) ; pipe_unlock ( opipe ) ; if ( ret > 0 ) wakeup_

Fix:
<S2SV_ModStart> } else { if (! <S2SV_ModStart>, ibuf ) ) { if ( ret == 0 ) ret = - EFAULT ; break ; } <S2SV_ModEnd> * obuf =
Buggy code:
 struct crypto_template * crypto_lookup_template ( const char * name ) { <START_BUG> return try_then_request_module ( __crypto_lookup_template ( name ), "%s", <END_BUG> name ) ; }

Fix:
<S2SV_ModStart> name ), "crypto-%s" <S2SV_ModEnd>, name )
Buggy code:
 xfs_buf_t * _xfs_buf_find ( struct xfs_buftarg * btp, struct xfs_buf_map * map, int nmaps, xfs_buf_flags_t flags, xfs_buf_t * new_bp ) { size_t numbytes ; struct xfs_perag * pag ; struct rb_node * * rbp ; struct rb_node * parent ; xfs_buf_t * bp ; <START_BUG> xfs_daddr_t blkno = map [ 0 ]. bm_bn ; <END_BUG> int numblks = 0 ; int i ; for ( i = 0 ; i < nmaps ; i ++ ) numblks += map [ i ]. bm_len ; numbytes = BBTOB ( numblks ) ; ASSERT (! ( numbytes < ( 1 << btp -> bt_sshift ) ) ) ; ASSERT (! ( BBTOB ( blkno ) & ( xfs_off_t ) btp -> bt_smask ) ) ;  pag = xfs_perag_get ( btp -> bt_mount, <START_BUG> xfs_daddr_to_agno ( btp -> bt_mount, blkno ) ) ; spin_lock ( & pag -> pag_buf_lock ) ; rbp = & pag -> pag_buf_tree. rb_node ; parent = NULL ; bp = NULL ; while ( * rbp ) { parent = * rbp ; bp = rb_entry ( parent, struct xfs_buf, b_rbnode ) ; if ( blkno < bp -> b_bn ) rbp = & ( * rbp ) -> rb_left ; else if ( blkno > bp -> b_bn ) rbp = & ( * rbp ) -> rb_right ; else { if ( bp -> b_length!= numblks ) { ASSERT ( bp -> b_flags & XBF_STALE ) ; rbp = & ( * rbp ) -> rb_right ; continue ; } atomic_inc ( & bp -> b_hold ) ; goto found ; } } if ( new_bp ) { rb_link_node ( & new_bp -> b_rbnode, parent, rbp ) ; rb_insert_color ( & new_bp -> b_rbnode, & pag -> pag_buf<END_BUG>

Fix:
<S2SV_ModStart> ]. bm_bn ; xfs_daddr_t eofs <S2SV_ModStart> ) ) ; eofs = XFS_FSB_TO_BB ( btp -> bt_mount, btp -> bt_mount -> m_sb. sb_dblocks ) ; if ( blkno >= eofs ) { xfs_alert ( btp -> bt_mount, "%s: <S2SV_blank> Block <S2SV_blank> out <S2SV_blank> of <S2SV_blank> range: <S2SV_blank> block <S2SV_blank> 0x%llx, <S2SV_blank> EOFS <S2SV_blank> 0x%llx <S2SV_blank> ", __func__, blkno, eofs ) ; return NULL ; }
Buggy code:
 static int smtp_open ( struct Connection * conn, bool esmtp ) { int rc ; if ( mutt_socket_open ( conn ) ) return - 1 ; rc = smtp_get_resp ( conn ) ; if ( rc!= 0 ) return rc ; rc = smtp_helo ( conn, esmtp ) ; if ( rc!= 0 ) return rc ; # ifdef USE_SSL enum QuadOption ans = MUTT_NO ; if ( conn -> ssf ) ans = MUTT_NO ; else if ( C_SslForceTls ) ans = MUTT_YES ; else if ( ( Capabilities & SMTP_CAP_STARTTLS ) && ( ( ans = query_quadoption ( C_SslStarttls, _ ( "Secure   connection   with   TLS?" ) ) ) == MUTT_ABORT ) ) { return - 1 ; } if ( ans == MUTT_YES ) { if ( mutt_socket_send ( conn, "STARTTLS\\r\\n" ) < 0 ) return SMTP_ERR_WRITE ; <START_BUG> rc = smtp_get_resp ( conn ) ; <END_BUG> if ( rc!= 0 ) return rc ; if ( mutt_ssl_starttls ( conn ) ) { mutt_error ( _ ( "Could   not   negotiate   TLS   connection" ) ) ; return - 1 ; } rc = smtp_helo ( conn, esmtp ) ; if ( rc!= 0 ) return rc ; } # endif if ( conn -> account. flags & MUTT_ACCT_USER ) { if (! ( Capabilities & SMTP_CAP_AUTH ) ) { mutt_error ( _ ( "SMTP   server   does   not   support   authentication" ) ) ; return - 1 ; } return smtp_auth ( conn ) ; } return 0 ; }

Fix:
<S2SV_ModStart> rc = smtp_get_resp ( conn ) ; mutt_socket_empty
Buggy code:
 static GF_Err av1dmx_parse_flush_sample ( GF_Filter * filter, GF_AV1DmxCtx * ctx ) { u32 pck_size ; GF_FilterPacket * pck ; <START_BUG> u8 * output ; <END_BUG> gf_bs_get_content_no_truncate ( ctx -> state. bs, & ctx -> state. frame_obus, & pck_size, & ctx -> state. frame_obus_alloc ) ; if (! pck_size ) { GF_LOG ( GF_LOG_DEBUG, GF_LOG_CONTAINER, ( "[AV1Dmx]   no   frame   OBU,   skipping   OBU\\n" ) ) ; return GF_OK ; } pck = gf_filter_pck_new_alloc ( ctx -> opid, pck_size, & output ) ; if ( ctx -> src_pck ) gf_filter_pck_merge_properties ( ctx -> src_pck, pck ) ; gf_filter_pck_set_cts ( pck, ctx -> cts ) ; gf_filter_pck_set_sap ( pck, ctx -> state. frame_state. key_frame? GF_FILTER_SAP_1 : 0 ) ; memcpy ( output, ctx -> state. frame_obus, pck_size ) ; if ( ctx -> deps ) { u8 flags = 0 ; flags = ( ctx -> state. frame_state. key_frame )? 2 : 1 ; flags <<= 2 ; flags |= ctx -> state. frame_state. refresh_frame_flags? 1 : 2 ; flags <<= 2 ; gf_filter_pck_set_dependency_flags ( pck, flags ) ; } gf_filter_pck_send ( pck ) ; av1dmx_update_cts ( ctx ) ; gf_av1_reset_state ( & ctx -> state, GF_FALSE ) ; return GF_OK ; }

Fix:
<S2SV_ModStart> u8 * output ; if (! ctx -> opid ) return GF_NON_COMPLIANT_BITSTREAM
Buggy code:
 static void zend_throw_or_error ( int fetch_type, zend_class_entry * exception_ce, const char * format,... ) { va_list va ; char * message = NULL ; va_start ( va, format ) ; zend_vspprintf ( & message, 0, format, va ) ; if ( fetch_type & ZEND_FETCH_CLASS_EXCEPTION ) { <START_BUG> zend_throw_error ( exception_ce, message ) ; <END_BUG> } else { zend_error ( E_ERROR, "%s", message ) ; } efree ( message ) ; va_end ( va ) ; }

Fix:
<S2SV_ModStart> ( exception_ce, "%s",
Buggy code:
 int sctp_do_peeloff ( struct sock * sk, sctp_assoc_t id, struct socket * * sockp ) { struct sctp_association * asoc = sctp_id2assoc ( sk, id ) ; struct sctp_sock * sp = sctp_sk ( sk ) ; struct socket * sock ; int err = 0 ; if (! asoc ) <START_BUG> return - EINVAL ; <END_BUG> if (! sctp_style ( sk, UDP ) ) return - EINVAL ; err = sock_create ( sk -> sk_family, SOCK_SEQPACKET, IPPROTO_SCTP, & sock ) ; if ( err < 0 ) return err ; sctp_copy_sock ( sock -> sk, sk, asoc ) ; sp -> pf -> to_sk_daddr ( & asoc -> peer. primary_addr, sk ) ; sctp_sock_migrate ( sk, sock -> sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH ) ; * sockp = sock ; return err ; }

Fix:
<S2SV_ModStart> return - EINVAL ; if ( waitqueue_active ( & asoc -> wait ) ) return - EBUSY
Buggy code:
 static int decode_trns_chunk ( AVCodecContext * avctx, PNGDecContext * s, uint32_t length ) { <START_BUG> int v, i ; <END_BUG> if ( s -> color_type == PNG_COLOR_TYPE_PALETTE ) { if ( length > 256 ||! ( s -> state & PNG_PLTE ) ) return AVERROR_INVALIDDATA ; for ( i = 0 ; i < length ; i ++ ) { v = bytestream2_get_byte ( & s -> gb ) ; s -> palette [ i ] = ( s -> palette [ i ] & 0x00ffffff ) | ( v << 24 ) ; } } else if ( s -> color_type == PNG_COLOR_TYPE_GRAY || s -> color_type == PNG_COLOR_TYPE_RGB ) { if ( ( s -> color_type == PNG_COLOR_TYPE_GRAY && length!= 2 ) ||  ( s -> color_type == PNG_COLOR_TYPE_RGB && length!= 6 ) ) <START_BUG> return AVERROR_INVALIDDATA ; for ( i = 0 ; i < length // 2 ; i ++ ) { v = av_mod_uintp2 ( bytestream2_get_be16 ( & s -> gb ), s -> bit_depth ) ; if ( s -> bit_depth > 8 ) AV_WB16 ( & s -> transparent_color_be [ 2 * i ], v ) ; else s -> transparent_color_be [ i ] = v ; } } else { return AVERROR_INVALIDDATA ; } bytestream2_skip ( & s -> gb, 4 ) ; s -> has_trns = 1 ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart>, i ; if (! ( s -> state & PNG_IHDR ) ) { av_log ( avctx, AV_LOG_ERROR, "trns <S2SV_blank> before <S2SV_blank> IHDR\\n" ) ; return AVERROR_INVALIDDATA ; } if ( s -> state & PNG_IDAT ) { av_log ( avctx, AV_LOG_ERROR, "trns <S2SV_blank> after <S2SV_blank> IDAT\\n" ) ; return AVERROR_INVALIDDATA ; } <S2SV_ModStart>!= 6 ) || s -> bit_depth == 1
Buggy code:
 static void usage ( const char * prog ) { fprintf ( stderr, "Usage:   %s   [OPTION...]\\n", prog ) ; fprintf ( stderr, "     -f,   --use-file=FILE                     Use   the   specified   configuration   file\\n" ) ; # if defined _WITH_VRRP_ && defined _WITH_LVS_ fprintf ( stderr, "     -P,   --vrrp                                       Only   run   with   VRRP   subsystem\\n" ) ; fprintf ( stderr, "     -C,   --check                                     Only   run   with   Health-checker   subsystem\\n" ) ; # endif # ifdef _WITH_BFD_ fprintf ( stderr, "     -B,   --no_bfd                                   Don\'t   run   BFD   subsystem\\n" ) ; # endif fprintf ( stderr, "             --all                                         Force   all   child   processes   to   run,   even   if   have   no   configuration\\n" ) ; fprintf ( stderr, "     -l,   --log-console                         Log   messages   to   local   console\\n" ) ; fprintf ( stderr, "     -D,   --log-detail                           Detailed   log   messages\\n" ) ; fprintf ( stderr, "     -S,   --log-facility=[0-7]           Set   syslog   facility   to   LOG_LOCAL[0-7]\\n" ) ; fprintf ( stderr, "     -g,   --log-file=FILE                     Also   log   to   FILE   (default   //tmp//keepalived.log)\\n" ) ; fprintf

Fix:
<S2SV_ModStart> " <S2SV_blank> <S2SV_blank> -G, <S2SV_blank> --no-syslog <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> Don\'t <S2SV_blank> log <S2SV_blank> via <S2SV_blank> syslog\\n" ) ; fprintf ( stderr, " <S2SV_blank> <S2SV_blank> -u, <S2SV_blank> --umask=MASK <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> umask <S2SV_blank> for <S2SV_blank> file <S2SV_blank> creation <S2SV_blank> (in <S2SV_blank> numeric <S2SV_blank> form)\\n" ) ;
Buggy code:
 static int __sys_sendmsg ( struct socket * sock, struct msghdr __user * msg, struct msghdr * msg_sys, unsigned flags, struct used_address * used_address ) { struct compat_msghdr __user * msg_compat = ( struct compat_msghdr __user * ) msg ; struct sockaddr_storage address ; struct iovec iovstack [ UIO_FASTIOV ], * iov = iovstack ; unsigned char ctl [ sizeof ( struct cmsghdr ) + 20 ] __attribute__ ( ( aligned ( sizeof ( __kernel_size_t ) ) ) ) ; unsigned char * ctl_buf = ctl ; int err, ctl_len, iov_size, total_len ; err = - EFAULT ; if ( MSG_CMSG_COMPAT & flags ) { if ( get_compat_msghdr ( msg_sys, msg_compat ) ) return - EFAULT ; } else if ( copy_from_user ( msg_sys, msg, sizeof ( struct msghdr ) ) ) return - EFAULT ; err = - EMSGSIZE ; if ( msg_sys -> msg_iovlen > UIO_MAXIOV ) goto out ; err = - ENOMEM ; iov_size = msg_sys -> msg_iovlen * sizeof ( struct iovec ) ; if ( msg_sys -> msg_iovlen > UIO_FASTIOV ) { iov = sock_kmalloc ( sock -> sk, iov_size, GFP_KERNEL ) ; if (! iov ) goto out ; } if ( MSG_CMSG_COMPAT & flags ) { err = verify_compat_iovec ( msg_sys, iov, ( struct sockaddr * ) & address, VERIFY_READ ) ; } else err = verify_iovec ( msg_sys, iov, ( struct sockaddr * ) & address, VERIFY_READ ) ; if ( err < 0 ) goto out_freeiov ; total_len = err ; err = - ENOBUFS ; if ( msg_sys -> msg_controllen > INT_MAX ) goto out_freeiov ; ctl_len = msg_sys -> msg_controllen ; if ( ( MSG_CMSG_COMPAT & flags ) && ctl_len ) { err = cmsghdr_from_user_

Fix:
<S2SV_ModStart> ( used_address && msg_sys -> msg_name && <S2SV_ModStart> -> name, msg_sys <S2SV_ModEnd> -> msg_name, <S2SV_ModStart> -> msg_namelen ; if ( msg_sys -> msg_name ) <S2SV_ModStart> -> name, msg_sys <S2SV_ModEnd> -> msg_name,
Buggy code:
 const char * WinPKIErrorString ( void ) { static char error_string [ 64 ] ; DWORD error_code = GetLastError ( ) ; <START_BUG> if ( ( error_code >> 16 )!= 0x8009 ) <END_BUG> return WindowsErrorString ( ) ; switch ( error_code ) { case NTE_BAD_UID : return "Bad   UID." ; case CRYPT_E_MSG_ERROR : return "An   error   occurred   while   performing   an   operation   on   a   cryptographic   message." ; case CRYPT_E_UNKNOWN_ALGO : return "Unknown   cryptographic   algorithm." ; case CRYPT_E_INVALID_MSG_TYPE : return "Invalid   cryptographic   message   type." ; case CRYPT_E_HASH_VALUE : return "The   hash   value   is   not   correct" ; case CRYPT_E_ISSUER_SERIALNUMBER : return "Invalid   issuer   and//or   serial   number." ; case CRYPT_E_BAD_LEN : return "The   length   specified   for   the   output   data   was   insufficient." ; case CRYPT_E_BAD_ENCODE : return "An   error   occurred   during   encode   or   decode   operation." ; case CRYPT_E_FILE_ERROR : return "An   error   occurred   while   reading   or   writing   to   a   file." ; case CRYPT_E_NOT_FOUND : return "Cannot   find   object   or   property." ; case CRYPT_E_EXISTS : return "The   object   or   property   already   exists." ; case CRYPT_E_NO_PROVIDER : return "No   provider   was   specified   for   the   store   or   object." ; case CRYPT_E_DELETED_PREV : return "The   previous   certificate   or   CRL   context   was   deleted." ; case CRYPT_E_NO_MATCH : return "Cannot   find   the   requested   object." ; case CRYPT_E_UNEXPECTED_MSG_TYPE : case CRYPT_E_NO_KEY_PROPERTY : case CRYPT_E_NO_DECRYPT_CERT : return "Private   key   or   certificate   issue" ; case CRYPT_E_BAD_MSG : return "Not   a   cryptographic   message." ; case CRYPT_E_

Fix:
<S2SV_ModStart> if ( ( ( <S2SV_ModStart>!= 0x8009 ) && ( ( error_code >> 16 )!= 0x800B ) ) <S2SV_ModStart> : return "None <S2SV_blank> of <S2SV_blank> the <S2SV_blank> signers <S2SV_blank> of <S2SV_blank> the <S2SV_blank> cryptographic <S2SV_blank> message <S2SV_blank> or <S2SV_blank> certificate <S2SV_blank> trust <S2SV_blank> list <S2SV_blank> is <S2SV_blank> trusted." ; case CERT_E_UNTRUSTEDROOT : return "The <S2SV_blank> root <S2SV_blank> certificate <S2SV_blank> is <S2SV_blank> not <S2SV_blank> trusted." ; case TRUST_E_NOSIGNATURE : return "Not <S2SV_blank> digitally <S2SV_blank> signed." ; case TRUST_E_EXPLICIT_DISTRUST : return "One <S2SV_blank> of <S2SV_blank> the <S2SV_blank> certificates <S2SV_blank> used <S2SV_blank> was <S2SV_blank> marked <S2SV_blank> as <S2SV_blank> untrusted <S2SV_blank> by <S2SV_blank> the <S2SV_blank> user."
Buggy code:
 static int em_ret_far ( struct x86_emulate_ctxt * ctxt ) { int rc ; <START_BUG> unsigned long cs ; <END_BUG> int cpl = ctxt -> ops -> cpl ( ctxt ) ;  rc = emulate_pop ( ctxt, & ctxt -> _eip, ctxt -> op_bytes ) ; <START_BUG> if ( rc!= X86EMUL_CONTINUE ) <END_BUG> return rc ;  if ( ctxt -> op_bytes == 4 ) ctxt -> _eip = ( u32 ) ctxt -> _eip ; rc = emulate_pop ( ctxt, & cs, ctxt -> op_bytes ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; if ( ctxt -> mode >= X86EMUL_MODE_PROT16 && ( cs & 3 ) > cpl ) return X86EMUL_UNHANDLEABLE ; <START_BUG> rc = load_segment_descriptor ( ctxt, ( u16 ) cs, VCPU_SREG_CS ) ; <END_BUG> return rc ; }

Fix:
<S2SV_ModStart> ; unsigned long eip, cs ; u16 old_cs <S2SV_ModEnd> ; int cpl <S2SV_ModStart> ctxt ) ; struct desc_struct old_desc, new_desc ; const struct x86_emulate_ops * ops = ctxt -> ops ; if ( ctxt -> mode == X86EMUL_MODE_PROT64 ) ops -> get_segment ( ctxt, & old_cs, & old_desc, NULL, VCPU_SREG_CS ) ; <S2SV_ModStart> ctxt, & eip <S2SV_ModEnd>, ctxt -> <S2SV_ModStart> ) return rc <S2SV_ModEnd> ; rc = <S2SV_ModStart> ; rc = __load_segment_descriptor <S2SV_ModEnd> ( ctxt, <S2SV_ModStart> cs, VCPU_SREG_CS, 0, false, & new_desc ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; rc = assign_eip_far ( ctxt, eip, new_desc. l ) ; if ( rc!= X86EMUL_CONTINUE ) { WARN_ON (! ctxt -> mode!= X86EMUL_MODE_PROT64 ) ; ops -> set_segment ( ctxt, old_cs, & old_desc, 0, VCPU_SREG_CS ) ; } <S2SV_ModEnd> return rc ;
Buggy code:
 <START_BUG> void vp9_fht8x8_sse2 ( const int16_t * input, int16_t * output, <END_BUG> int stride, int tx_type ) { __m128i in [ 8 ] ; switch ( tx_type ) { case DCT_DCT :  vp9_fdct8x8_sse2 ( input, output, stride ) ; <START_BUG> break ; case ADST_DCT : load_buffer_8x8 ( input, in, stride ) ; fadst8_sse2 ( in ) ; fdct8_sse2 ( in ) ; right_shift_8x8 ( in, 1 ) ; write_buffer_8x8 ( output, in, 8 ) ; break ; case DCT_ADST : load_buffer_8x8 ( input, in, stride ) ; fdct8_sse2 ( in ) ; fadst8_sse2 ( in ) ; right_shift_8x8 ( in, 1 ) ; write_buffer_8x8 ( output, in, 8 ) ; break ; case ADST_ADST : load_buffer_8x8 ( input, in, stride ) ; fadst8_sse2 ( in ) ; fadst8_sse2 ( in ) ; right_shift_8x8 ( in, 1 ) ; write_buffer_8x8 ( output, in, 8 ) ; break ; default : assert ( 0 ) ; break ; } }<END_BUG>

Fix:
<S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> case DCT_DCT : vpx_fdct8x8_sse2 <S2SV_ModEnd> ( input,
Buggy code:
 <START_BUG> static char * create_output_name ( unsigned char * fname, unsigned char * dir, <END_BUG> int lower, int isunix, int utf8 ) { unsigned char * p, * name, c, * fe, sep, slash ; unsigned int x ; sep = ( isunix )? '//' : '\\\\' ; slash = ( isunix )? '\\\\' : '//' ; x = strlen ( ( char * ) fname ) ;  if ( utf8 ) x *= 3 ; <START_BUG> if ( dir ) x += strlen ( ( char * ) dir ) ; if (! ( name = ( unsigned char * ) malloc ( x + 2 ) ) ) { <END_BUG> fprintf ( stderr, "out   of   memory!\\n" ) ;  return NULL ; } * name = '\\0' ; if ( dir ) { strcpy ( ( char * ) name, ( char * ) dir ) ; strcat ( ( char * ) name, "//" ) ; } <START_BUG> while ( * fname == sep ) fname ++ ; <END_BUG>  p = & name [ strlen ( ( char * ) name ) ] ; <START_BUG> fe = & fname [ strlen ( ( char * ) fname ) ] ; if ( utf8 ) { do { <END_BUG> if ( fname >= fe ) {  free ( name ) ; return NULL ; } if ( ( c = * fname ++ ) < 0x80 ) x = c ; else { if ( ( c >= 0xC0 ) && ( c < 0xE0 ) ) { <START_BUG> x = ( c & 0x1F ) << 6 ; <END_BUG> x |= * fname ++ & 0x3F ; } else if ( ( c >= 0xE0 ) && ( c < 0xF0 ) ) { x = ( c & 0xF ) << 12 ; x |= ( * fname ++ & 0x3F ) << 6 ; x |= * fname ++ & 0x3F ; } else x = '?' ; } if ( x == sep ) x = '//' ; else if ( x == slash ) x = '\\\\' ; else if ( lower ) x = ( unsigned int ) tolower ( ( int ) x ) ; if ( x < 0x80 ) { * p ++ = ( unsigned char ) x ; } else if ( x < 0x800 ) { * p ++ = 0xC0 | ( x >> 6 ) ; * p ++ = 0x80 | ( x & 0x3F ) ; } else { * p

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> char * create_output_name <S2SV_ModStart> * create_output_name ( <S2SV_ModEnd> char * fname <S2SV_ModStart> char * fname ) { char * out, * p <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; if ( ( out = malloc ( strlen ( fname ) + 1 <S2SV_ModEnd> ) ) ) <S2SV_ModStart> ) ) { <S2SV_ModEnd> while ( * <S2SV_ModStart> * fname == '//' || * fname == '\\\\' <S2SV_ModEnd> ) fname ++ <S2SV_ModStart> fname ++ ; strcpy ( out, ( * fname )? fname : "x" ) ; for ( p = out ; * p ; p ++ ) <S2SV_ModEnd> { if ( <S2SV_ModStart> { if ( p [ 0 ] == '.' && p [ 1 ] == '.' && ( p [ 2 ] == '//' || p [ 2 ] == '\\\\' <S2SV_ModEnd> ) ) { <S2SV_ModStart> ) ) { p [ 0 ] = p [ 1 ] = 'x' <S2SV_ModEnd> ; } } <S2SV_ModStart> ; } } } return out <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 GF_Err abst_box_read ( GF_Box * s, GF_BitStream * bs ) { GF_AdobeBootstrapInfoBox * ptr = ( GF_AdobeBootstrapInfoBox * ) s ; int i ; u32 tmp_strsize ; <START_BUG> char * tmp_str ; <END_BUG> GF_Err e ; ISOM_DECREASE_SIZE ( ptr, 25 ) ptr -> bootstrapinfo_version = gf_bs_read_u32 ( bs ) ; ptr -> profile = gf_bs_read_int ( bs, 2 ) ; ptr -> live = gf_bs_read_int ( bs, 1 ) ; ptr -> update = gf_bs_read_int ( bs, 1 ) ; ptr -> reserved = gf_bs_read_int ( bs, 4 ) ; ptr -> time_scale = gf_bs_read_u32 ( bs ) ; ptr -> current_media_time = gf_bs_read_u64 ( bs ) ; ptr -> smpte_time_code_offset = gf_bs_read_u64 ( bs ) ; i = 0 ; if ( ptr -> size < 8 ) return GF_ISOM_INVALID_FILE ; tmp_strsize = ( u32 ) ptr -> size ; tmp_str = gf_malloc ( sizeof ( char ) * tmp_strsize ) ; if (! tmp_str ) return GF_OUT_OF_MEM ; memset ( tmp_str, 0, sizeof ( char ) * tmp_strsize ) ; while ( tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) tmp_str [ i ] = gf_bs_read_u8 ( bs ) ; tmp_strsize -- ;  if (! tmp_str [ i ] ) <START_BUG> break ; i ++ ; <END_BUG> }  if ( i ) { ptr -> movie_identifier = gf_strdup ( tmp_str ) ; } ISOM_DECREASE_SIZE ( ptr, 1 ) ptr -> server_entry_count = gf_bs_read_u8 ( bs ) ; for ( i = 0 ; i < ptr -> server_entry_count ; i ++ ) { <START_BUG> int j = 0 ; <END_BUG> tmp_strsize = ( u32 ) ptr -> size ; while ( tmp_strsize ) { ISOM_DECRE

Fix:
<S2SV_ModStart> char * tmp_str ; Bool zfound = GF_FALSE <S2SV_ModStart> i ] ) { zfound = GF_TRUE ; break ; } <S2SV_ModEnd> i ++ ; <S2SV_ModStart> ++ ; } if (! zfound ) return GF_ISOM_INVALID_FILE ; <S2SV_ModStart> j = 0 ; zfound = GF_FALSE <S2SV_ModStart> j ] ) { zfound = GF_TRUE ; break ; } <S2SV_ModEnd> j ++ ; <S2SV_ModStart> } if (! zfound ) return GF_ISOM_INVALID_FILE ; if ( <S2SV_ModStart> j = 0 ; zfound = GF_FALSE <S2SV_ModStart> j ] ) { zfound = GF_TRUE ; break ; } <S2SV_ModEnd> j ++ ; <S2SV_ModStart> } if (! zfound ) return GF_ISOM_INVALID_FILE ; if ( <S2SV_ModStart> -> size ; zfound = GF_FALSE ; <S2SV_ModStart> i ] ) { zfound = GF_TRUE ; break ; } <S2SV_ModEnd> i ++ ; <S2SV_ModStart> } if (! zfound ) return GF_ISOM_INVALID_FILE ; if ( <S2SV_ModStart> -> size ; zfound = GF_FALSE ; <S2SV_ModStart> i ] ) { zfound = GF_TRUE ; break ; } <S2SV_ModEnd> i ++ ; <S2SV_ModStart> ++ ; } if (!
Buggy code:
 static Image * ReadYUVImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * chroma_image, * image, * resize_image ; InterlaceType interlace ; MagickBooleanType status ; register const Quantum * chroma_pixels ; register ssize_t x ; register Quantum * q ; register unsigned char * p ; ssize_t count, horizontal_factor, vertical_factor, y ; size_t length, quantum ; unsigned char * scanline ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( OptionError, "MustSpecifyImageSize" ) ; status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; quantum = ( ssize_t ) ( image -> depth <= 8? 1 : 2 ) ; interlace = image_info -> interlace ; horizontal_factor = 2 ; vertical_factor = 2 ; if ( image_info -> sampling_factor!= ( char * ) NULL ) { GeometryInfo geometry_info ; MagickStatusType flags ; flags = ParseGeometry ( image_info -> sampling_factor, & geometry_info ) ; horizontal_factor = ( ssize_t ) geometry_info. rho ; vertical_factor = ( ssize_t ) geometry_info. sigma ; if ( ( flags & SigmaValue ) == 0 ) vertical_factor = horizontal_factor ; if ( ( horizontal_factor!= 1 ) && ( horizontal_factor!= 2 ) && ( vertical_factor!= 1 ) && ( vertical_factor!= 2 ) ) ThrowReaderException ( CorruptImageError, "UnexpectedSamplingFactor" ) ; } if ( ( interlace == UndefinedInterlace ) || ( ( interlace == NoInterlace

Fix:
<S2SV_ModStart> ) NULL ) { scanline = ( unsigned char * ) RelinquishMagickMemory ( scanline ) ; <S2SV_ModStart> "MemoryAllocationFailed" ) ; } <S2SV_ModStart> MagickFalse ) { scanline = ( unsigned char * ) RelinquishMagickMemory ( scanline ) ; <S2SV_ModStart> MagickFalse ) { scanline = ( unsigned char * ) RelinquishMagickMemory ( scanline ) ; <S2SV_ModStart> MagickFalse ) { scanline = ( unsigned char * ) RelinquishMagickMemory ( scanline ) ; <S2SV_ModStart> ) NULL ) { scanline = ( unsigned char * ) RelinquishMagickMemory ( scanline ) ; <S2SV_ModStart> "MemoryAllocationFailed" ) ; } <S2SV_ModStart> NULL ) { scanline = ( unsigned char * ) RelinquishMagickMemory ( scanline ) ;
Buggy code:
 int main ( int argc, char * argv [ ] ) { int result ; int infoOnly = 0 ; int writeToStdio = 0 ; int readFromStdin = 0 ; int object_type = LC ; int def_srate = 0 ; int downMatrix = 0 ; int format = 1 ; int outputFormat = FAAD_FMT_16BIT ; int outfile_set = 0 ; int adts_out = 0 ; int old_format = 0 ; int showHelp = 0 ; int mp4file = 0 ; int noGapless = 0 ; char * fnp ; <START_BUG> char aacFileName [ 255 ] ; <END_BUG> char audioFileName [ 255 ] ; char adtsFileName [ 255 ] ; unsigned char header [ 8 ] ; float length = 0 ; FILE * hMP4File ; # ifdef _WIN32 long begin ; # else clock_t begin ; # endif unsigned long cap = NeAACDecGetCapabilities ( ) ; progName = argv [ 0 ] ; while ( 1 ) { int c = - 1 ; int option_index = 0 ; static struct option long_options [ ] = { { "quiet", 0, 0, 'q' }, { "outfile", 0, 0, 'o' }, { "adtsout", 0, 0, 'a' }, { "oldformat", 0, 0, 't' }, { "format", 0, 0, 'f' }, { "bits", 0, 0, 'b' }, { "samplerate", 0, 0,'s' }, { "objecttype", 0, 0, 'l' }, { "downmix", 0, 0, 'd' }, { "info", 0, 0, 'i' }, { "stdio", 0, 0, 'w' }, { "stdio", 0, 0, 'g' }, { "help", 0, 0, 'h' }, { 0, 0, 0, 0 } } ; c = getopt_long ( argc, argv, "o:a:s:f:b:l:wgdhitq", long_options, & option_index ) ; if ( c == - 1 ) break ; switch ( c ) { case 'o' : if ( optarg ) { outfile_set

Fix:
<S2SV_ModStart> fnp ; char * aacFileName = NULL ; char * audioFileName = NULL ; char * adtsFileName = NULL <S2SV_ModEnd> ; unsigned char <S2SV_ModStart> = 1 ; audioFileName = ( char * ) malloc ( sizeof ( char ) * ( strlen ( optarg ) + 1 ) ) ; if ( audioFileName == NULL ) { faad_fprintf ( stderr, "Error <S2SV_blank> allocating <S2SV_blank> memory <S2SV_blank> for <S2SV_blank> audioFileName.\\n" ) ; return 1 ; } <S2SV_ModStart> = 1 ; adtsFileName = ( char * ) malloc ( sizeof ( char ) * ( strlen ( optarg ) + 1 ) ) ; if ( adtsFileName == NULL ) { faad_fprintf ( stderr, "Error <S2SV_blank> allocating <S2SV_blank> memory <S2SV_blank> for <S2SV_blank> adtsFileName.\\n" ) ; return 1 ; } <S2SV_ModStart> } # endif aacFileName = ( char * ) malloc ( sizeof ( char ) * ( strlen ( argv [ optind ] ) + 1 ) ) ; if ( aacFileName == NULL ) { faad_fprintf ( stderr, "Error <S2SV_blank> allocating <S2SV_blank> memory <S2SV_blank> for <S2SV_blank> aacFileName.\\n" ) ; return 1 ; } <S2SV_ModStart> outfile_set ) { audioFileName = ( char
Buggy code:
 int jpc_tsfb_synthesize ( jpc_tsfb_t * tsfb, jas_seq2d_t * a ) { <START_BUG> return ( tsfb -> numlvls > 0 )? jpc_tsfb_synthesize2 ( tsfb, <END_BUG> jas_seq2d_getref ( a, jas_seq2d_xstart ( a ), jas_seq2d_ystart ( a ) ), jas_seq2d_xstart ( a ), jas_seq2d_ystart ( a ), jas_seq2d_width ( a ), jas_seq2d_height ( a ), jas_seq2d_rowstep ( a ), tsfb -> numlvls - 1 ) : 0 ; }

Fix:
<S2SV_ModStart> numlvls > 0 && jas_seq2d_size ( a )
Buggy code:
 static int decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt ) { PicContext * s = avctx -> priv_data ; AVFrame * frame = data ; uint32_t * palette ; int bits_per_plane, bpp, etype, esize, npal, pos_after_pal ; int i, x, y, plane, tmp, ret, val ; bytestream2_init ( & s -> g, avpkt -> data, avpkt -> size ) ; if ( bytestream2_get_bytes_left ( & s -> g ) < 11 ) return AVERROR_INVALIDDATA ; if ( bytestream2_get_le16u ( & s -> g )!= 0x1234 ) return AVERROR_INVALIDDATA ; s -> width = bytestream2_get_le16u ( & s -> g ) ; s -> height = bytestream2_get_le16u ( & s -> g ) ; bytestream2_skip ( & s -> g, 4 ) ; tmp = bytestream2_get_byteu ( & s -> g ) ; bits_per_plane = tmp & 0xF ; s -> nb_planes = ( tmp >> 4 ) + 1 ; bpp = bits_per_plane * s -> nb_planes ; if ( bits_per_plane > 8 || bpp < 1 || bpp > 32 ) { avpriv_request_sample ( avctx, "Unsupported   bit   depth" ) ; return AVERROR_PATCHWELCOME ; } if ( bytestream2_peek_byte ( & s -> g ) == 0xFF || bpp == 1 || bpp == 4 || bpp == 8 ) { bytestream2_skip ( & s -> g, 2 ) ; etype = bytestream2_get_le16 ( & s -> g ) ; esize = bytestream2_get_le16 ( & s -> g ) ; if ( bytestream2_get_bytes_left ( & s -> g ) < esize ) return AVERROR_INVALIDDATA ; } else { etype = - 1 ; esize = 0 ; } avctx -> pix_fmt = AV_PIX_FMT_PAL8 ; if ( av_

Fix:
<S2SV_ModStart> avctx -> width || <S2SV_ModEnd> s -> height
Buggy code:
 krb5_error_code krb5_ldap_put_principal ( krb5_context context, krb5_db_entry * entry, char * * db_args ) { int l = 0, kerberos_principal_object_type = 0 ; unsigned int ntrees = 0, tre = 0 ; krb5_error_code st = 0, tempst = 0 ; LDAP * ld = NULL ; LDAPMessage * result = NULL, * ent = NULL ; char * * subtreelist = NULL ; char * user = NULL, * subtree = NULL, * principal_dn = NULL ; <START_BUG> char * * values = NULL, * strval [ 10 ] = { NULL }, errbuf [ 1024 ] ; <END_BUG> char * filtuser = NULL ; struct berval * * bersecretkey = NULL ; LDAPMod * * mods = NULL ; krb5_boolean create_standalone = FALSE ;  krb5_boolean krb_identity_exists = FALSE, establish_links = FALSE ; <START_BUG> char * standalone_principal_dn = NULL ; krb5_tl_data * tl_data = NULL ; krb5_key_data * * keys = NULL ; kdb5_dal_handle * dal_handle = NULL ; krb5_ldap_context * ldap_context = NULL ; krb5_ldap_server_handle * ldap_server_handle = NULL ; osa_princ_ent_rec princ_ent = { 0 } ; xargs_t xargs = { 0 } ; char * polname = NULL ; OPERATION optype ; krb5_boolean found_entry = FALSE ; krb5_clear_error_message ( context ) ; SETUP_CONTEXT ( ) ; if ( ldap_context -> lrparams == NULL || ldap_context -> container_dn == NULL ) return EINVAL ; GET_HANDLE ( ) ; if (! is_principal_in_realm ( ldap_context, entry -> princ ) ) { st = EINVAL ; k5_setmsg ( context, st, _ ( "Principal   does   not   belong   to   the   default   realm" ) ) ; goto cleanup ; } if ( ( ( st = krb5_unparse_name ( context, entry -> princ, & user ) )!= 0 ) || ( ( st = krb5_<END_BUG>

Fix:
<S2SV_ModStart> NULL ; char <S2SV_ModEnd> * strval [ <S2SV_ModStart> FALSE ; krb5_boolean <S2SV_ModEnd> establish_links = FALSE <S2SV_ModStart> TRUE ) { if ( subtreelist == NULL ) { st = krb5_get_subtree_info ( ldap_context, & subtreelist, & ntrees ) ; if ( st ) goto cleanup ; } st = validate_xargs ( context, ldap_server_handle, & xargs, standalone_principal_dn, subtreelist, <S2SV_ModEnd> ntrees ) ; <S2SV_ModStart> ( st ) <S2SV_ModEnd> goto cleanup ;
Buggy code:
 static expr_ty ast_for_call ( struct compiling * c, const node * n, expr_ty func ) { int i, nargs, nkeywords, ngens ; asdl_seq * args ; asdl_seq * keywords ; expr_ty vararg = NULL, kwarg = NULL ; REQ ( n, arglist ) ; nargs = 0 ; nkeywords = 0 ; ngens = 0 ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { node * ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == argument ) { if ( NCH ( ch ) == 1 ) nargs ++ ; else if ( TYPE ( CHILD ( ch, 1 ) ) == comp_for ) ngens ++ ; else nkeywords ++ ; } } if ( ngens > 1 || ( ngens && ( nargs || nkeywords ) ) ) { ast_error ( n, "Generator   expression   must   be   parenthesized   " "if   not   sole   argument" ) ; return NULL ; } if ( nargs + nkeywords + ngens > 255 ) { ast_error ( n, "more   than   255   arguments" ) ; return NULL ; } args = asdl_seq_new ( nargs + ngens, c -> c_arena ) ; if (! args ) return NULL ; keywords = asdl_seq_new ( nkeywords, c -> c_arena ) ; if (! keywords ) return NULL ; nargs = 0 ; nkeywords = 0 ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { node * ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == argument ) { expr_ty e ; if ( NCH ( ch ) == 1 ) { if ( nkeywords ) { ast_error ( CHILD ( ch, 0 ), "non-keyword   arg   after   keyword   arg" ) ; return NULL ; } if ( vararg ) { ast_error ( CHILD ( ch, 0 ), "only   named   arguments   may   follow   *expression" ) ; return NULL ; } e = ast_for_expr ( c, CHILD ( ch, 0 ) ) ; if (! e ) return NULL ; asdl_seq_SET ( args, nargs ++, e ) ; } else if ( TYPE ( CHILD (

Fix:
<S2SV_ModStart> int k ; const
Buggy code:
 <START_BUG> static void <END_BUG> horDiff16 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { TIFFPredictorState * sp = PredictorState ( tif ) ; tmsize_t stride = sp -> stride ; uint16 * wp = ( uint16 * ) cp0 ; tmsize_t wc = cc // 2 ;  assert ( ( cc % ( 2 * stride ) ) == 0 ) ; <START_BUG> if ( wc > stride ) { wc -= stride ; wp += wc - 1 ; do { REPEAT4 ( stride, wp [ stride ] = ( uint16 ) ( ( ( unsigned int ) wp [ stride ] - ( unsigned int ) wp [ 0 ] ) & 0xffff ) ; wp -- ) wc -= stride ; } while ( wc > 0 ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> horDiff16 ( TIFF <S2SV_ModStart> // 2 ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> stride ) )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "horDiff8", "%s", "(cc%(2*stride))!=0" ) ; return 0 ; } <S2SV_ModEnd> if ( wc <S2SV_ModStart> ) ; } return 1 ;
Buggy code:
 struct clock_source * dce80_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( struct dce110_clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dce110_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;