nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void <START_BUG> sraSpanInsertBefore ( sraSpan * newspan, sraSpan * before ) { <END_BUG> newspan -> _next = before ; newspan -> _prev = before -> _prev ; before -> _prev -> _next = newspan ; before -> _prev = newspan ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, sraSpan * before ) { if ( newspan && <S2SV_ModStart> newspan ; } }
Buggy code:
 int main ( int argc, char * argv [ ] ) { <START_BUG> libettercap_init ( ) ; <END_BUG> ef_globals_alloc ( ) ; select_text_interface ( ) ; libettercap_ui_init ( ) ; fprintf ( stdout, "\\n" EC_COLOR_BOLD "%s   %s" EC_COLOR_END "   copyright   %s   %s\\n\\n", PROGRAM, EC_VERSION, EC_COPYRIGHT, EC_AUTHORS ) ; EF_GBL -> lineno = 1 ; parse_options ( argc, argv ) ; if ( EF_GBL_OPTIONS -> source_file ) { yyin = fopen ( EF_GBL_OPTIONS -> source_file, "r" ) ; if ( yyin == NULL ) FATAL_ERROR ( "Input   file   not   found  !" ) ; } else { FATAL_ERROR ( "No   source   file." ) ; } setbuf ( yyin, NULL ) ; setbuf ( stdout, NULL ) ; setbuf ( stderr, NULL ) ; load_tables ( ) ; load_constants ( ) ; fprintf ( stdout, "\\n   Parsing   source   file   \\\'%s\\\'   ", EF_GBL_OPTIONS -> source_file ) ; fflush ( stdout ) ; ef_debug ( 1, "\\n" ) ; if ( yyparse ( ) == 0 ) fprintf ( stdout, "   done.\\n\\n" ) ; else fprintf ( stdout, "\\n\\nThe   script   contains   errors...\\n\\n" ) ;  if ( write_output ( )!= E_SUCCESS ) <START_BUG> FATAL_ERROR ( "Cannot   write   output   file   (%s)", EF_GBL_OPTIONS -> output_file ) ; ef_globals_free ( ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ] ) { int ret_value = 0 ; <S2SV_ModStart> "\\n\\nThe <S2SV_blank> script <S2SV_blank> contains <S2SV_blank> errors...\\n\\n" ) ; ret_value = <S2SV_ModEnd> write_output ( ) <S2SV_ModStart> write_output ( ) ; if ( ret_value == - E_NOTHANDLED ) FATAL_ERROR ( "Cannot <S2SV_blank> write <S2SV_blank> output <S2SV_blank> file <S2SV_blank> (%s): <S2SV_blank> the <S2SV_blank> filter <S2SV_blank> is <S2SV_blank> not <S2SV_blank> correctly <S2SV_blank> handled.", EF_GBL_OPTIONS -> output_file ) ; else if ( ret_value == - E_INVALID ) FATAL_ERROR ( "Cannot <S2SV_blank> write <S2SV_blank> output <S2SV_blank> file <S2SV_blank> (%s): <S2SV_blank> the <S2SV_blank> filter <S2SV_blank> format <S2SV_blank> is <S2SV_blank> not <S2SV_blank> correct. <S2SV_blank> " <S2SV_ModEnd>, EF_GBL_OPTIONS ->
Buggy code:
 static void tg3_read_vpd ( struct tg3 * tp ) { u8 * vpd_data ; unsigned int block_end, rosize, len ; u32 vpdlen ; int j, i = 0 ; vpd_data = ( u8 * ) tg3_vpd_readblock ( tp, & vpdlen ) ; if (! vpd_data ) goto out_no_vpd ; i = pci_vpd_find_tag ( vpd_data, 0, vpdlen, PCI_VPD_LRDT_RO_DATA ) ; if ( i < 0 ) goto out_not_found ; rosize = pci_vpd_lrdt_size ( & vpd_data [ i ] ) ; block_end = i + PCI_VPD_LRDT_TAG_SIZE + rosize ; i += PCI_VPD_LRDT_TAG_SIZE ; if ( block_end > vpdlen ) goto out_not_found ; j = pci_vpd_find_info_keyword ( vpd_data, i, rosize, PCI_VPD_RO_KEYWORD_MFR_ID ) ; if ( j > 0 ) { len = pci_vpd_info_field_size ( & vpd_data [ j ] ) ; j += PCI_VPD_INFO_FLD_HDR_SIZE ; if ( j + len > block_end || len!= 4 || memcmp ( & vpd_data [ j ], "1028", 4 ) ) goto partno ; j = pci_vpd_find_info_keyword ( vpd_data, i, rosize, PCI_VPD_RO_KEYWORD_VENDOR0 ) ; if ( j < 0 ) goto partno ; len = pci_vpd_info_field_size ( & vpd_data [ j ] ) ; j += PCI_VPD_INFO_FLD_HDR_SIZE ; if ( j + len > block_end ) goto partno ; <START_BUG> memcpy ( tp -> fw_ver, & vpd_data [ j ], len ) ; <END_BUG>  strncat ( tp -> fw_ver, "   bc   ", vpdlen - len - 1 ) ; <START_BUG> } partno<END_BUG>

Fix:
<S2SV_ModStart> goto partno ; if ( len >= sizeof <S2SV_ModEnd> ( tp -> <S2SV_ModStart> tp -> fw_ver ) ) len = sizeof <S2SV_ModEnd> ( tp -> <S2SV_ModStart> tp -> fw_ver ) - 1 ; memset ( tp -> fw_ver, 0, sizeof ( tp -> fw_ver ) ) ; snprintf ( tp -> fw_ver, sizeof ( tp -> fw_ver ), "%.*s <S2SV_blank> bc <S2SV_blank> ", len, & vpd_data [ j ] <S2SV_ModEnd> ) ; }
Buggy code:
 static void pipe_advance ( struct iov_iter * i, size_t size ) { struct pipe_inode_info * pipe = i -> pipe ; <START_BUG> struct pipe_buffer * buf ; <END_BUG> int idx = i -> idx ; size_t off = i -> iov_offset, orig_sz ; if ( unlikely ( i -> count < size ) ) size = i -> count ;  orig_sz = size ; <START_BUG> if ( size ) { <END_BUG> if ( off )  <START_BUG> size += off - pipe -> bufs [ idx ]. offset ; <END_BUG> while ( 1 ) { buf = & pipe -> bufs [ idx ] ;  if ( size <= buf -> len ) <START_BUG> break ; <END_BUG> size -= buf -> len ;  idx = next_idx ( idx, pipe ) ; } <START_BUG> buf -> len = size ; <END_BUG> i -> idx = idx ;  off = i -> iov_offset = buf -> offset + size ; <START_BUG> } if ( off ) idx = next_idx ( idx, pipe ) ; if ( pipe -> nrbufs ) { int unused = ( pipe -> curbuf + pipe -> nrbufs ) & ( pipe -> buffers - 1 ) ; while ( idx!= unused ) { pipe_buf_release ( pipe, & pipe -> bufs [ idx ] ) ; idx = next_idx ( idx, pipe ) ; pipe -> nrbufs -- ; } } <END_BUG> i -> count -= orig_sz ;  }

Fix:
<S2SV_ModStart> -> pipe ; <S2SV_ModEnd> if ( unlikely <S2SV_ModStart> -> count ; <S2SV_ModEnd> if ( size <S2SV_ModStart> size ) { struct pipe_buffer * buf ; size_t off = i -> iov_offset, left = size ; int idx = i -> idx ; <S2SV_ModStart> ( off ) left <S2SV_ModEnd> += off - <S2SV_ModStart> ; if ( left <S2SV_ModEnd> <= buf -> <S2SV_ModStart> ) break ; left <S2SV_ModEnd> -= buf -> <S2SV_ModStart> ) ; } <S2SV_ModEnd> i -> idx <S2SV_ModStart> = idx ; <S2SV_ModEnd> i -> iov_offset <S2SV_ModStart> -> offset + left ; <S2SV_ModEnd> } i -> <S2SV_ModStart> -> count -= size ; pipe_truncate ( i ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int dnxhd_find_frame_end ( DNXHDParserContext * dctx, const uint8_t * buf, int buf_size ) { ParseContext * pc = & dctx -> pc ; uint64_t state = pc -> state64 ; int pic_found = pc -> frame_start_found ; int i = 0 ; if (! pic_found ) { for ( i = 0 ; i < buf_size ; i ++ ) { state = ( state << 8 ) | buf [ i ] ; if ( ff_dnxhd_check_header_prefix ( state & 0xffffffffff00LL )!= 0 ) { i ++ ; pic_found = 1 ; dctx -> cur_byte = 0 ; dctx -> remaining = 0 ; break ; } } } if ( pic_found &&! dctx -> remaining ) { if (! buf_size ) return 0 ; for ( ; i < buf_size ; i ++ ) { dctx -> cur_byte ++ ; state = ( state << 8 ) | buf [ i ] ; if ( dctx -> cur_byte == 24 ) { dctx -> h = ( state >> 32 ) & 0xFFFF ; } else if ( dctx -> cur_byte == 26 ) { dctx -> w = ( state >> 32 ) & 0xFFFF ; } else if ( dctx -> cur_byte == 42 ) { int cid = ( state >> 32 ) & 0xFFFFFFFF ; <START_BUG> if ( cid <= 0 ) <END_BUG> continue ;  dctx -> remaining = avpriv_dnxhd_get_frame_size ( cid ) ; <START_BUG> <END_BUG> if ( dctx -> remaining <= 0 ) {  <START_BUG> dctx -> remaining = ff_dnxhd_get_hr_frame_size ( cid, dctx -> w, dctx -> h ) ; <END_BUG>  if ( dctx -> remaining <= 0 ) <START_BUG> <END_BUG> return dctx -> remaining ;  } if ( buf_size - i + 47 >= dctx -> remaining ) { int remaining = dctx -> remaining ; pc -> frame_start_found = 0 ; pc -> state64 = - 1 ; dctx -> cur_byte = 0 ; dctx -> remaining = 0 ; return remaining ; } else { dctx -> remaining -= buf_size ; } } } } else if ( pic_found ) { if ( dctx -> remaining > buf_size ) { dctx

Fix:
<S2SV_ModStart> & 0xFFFFFFFF ; int remaining ; <S2SV_ModStart> ) continue ; <S2SV_ModEnd> remaining = avpriv_dnxhd_get_frame_size <S2SV_ModStart> ; if ( <S2SV_ModEnd> remaining <= 0 <S2SV_ModStart> 0 ) { <S2SV_ModEnd> remaining = ff_dnxhd_get_hr_frame_size <S2SV_ModStart> ; if ( <S2SV_ModEnd> remaining <= 0 <S2SV_ModStart> <= 0 ) continue ; } dctx -> remaining = remaining ; <S2SV_ModEnd> if ( buf_size
Buggy code:
 void edge_sparse_csr_reader_double ( const char * i_csr_file_in, unsigned int * * o_row_idx, unsigned int * * o_column_idx, double * * o_values, unsigned int * o_row_count, unsigned int * o_column_count, unsigned int * o_element_count ) { FILE * l_csr_file_handle ; const unsigned int l_line_length = 512 ; char l_line [ 512 + 1 ] ; unsigned int l_header_read = 0 ; unsigned int * l_row_idx_id = NULL ; unsigned int l_i = 0 ; l_csr_file_handle = fopen ( i_csr_file_in, "r" ) ; if ( l_csr_file_handle == NULL ) { fprintf ( stderr, "cannot   open   CSR   file!\\n" ) ; return ; } while ( fgets ( l_line, l_line_length, l_csr_file_handle )!= NULL ) { if ( strlen ( l_line ) == l_line_length ) { fprintf ( stderr, "could   not   read   file   length!\\n" ) ; return ; } if ( l_line [ 0 ] == '%' ) { continue ; } else { if ( l_header_read == 0 ) { <START_BUG> if ( sscanf ( l_line, "%u   %u   %u", o_row_count, o_column_count, o_element_count ) == 3 ) { <END_BUG> * o_column_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_element_count ) ) ; * o_row_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_row_count + 1 ) ) ; * o_values = ( double * ) malloc ( sizeof ( double ) * ( * o_element_count ) ) ; l_row_idx_id = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_row_count ) ) ; if ( ( * o_row_idx == NULL ) || ( * o_column_idx == NULL ) || ( * o_values == NULL ) || ( l_row_idx_id == NULL ) ) { f

Fix:
<S2SV_ModStart> { if ( 3 == <S2SV_ModStart>, o_element_count ) && 0!= * o_row_count && 0!= * o_column_count && 0!= * o_element_count ) <S2SV_ModEnd> { * o_column_idx
Buggy code:
 static ssize_t _hostsock_writev ( oe_fd_t * desc, const struct oe_iovec * iov, int iovcnt ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( desc ) ; void * buf = NULL ; <START_BUG> size_t buf_size = 0 ; <END_BUG> if (! sock ||! iov || iovcnt < 0 || iovcnt > OE_IOV_MAX ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( iov, iovcnt, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_sendv_ocall ( & ret, sock -> host_fd, buf, iovcnt, buf_size )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> done : <END_BUG> if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> ; size_t buf_size = 0 ; size_t data_size <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> ) ; } if ( ret > ( ssize_t ) data_size ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 int psf_binheader_readf ( SF_PRIVATE * psf, char const * format,... ) { va_list argptr ; sf_count_t * countptr, countdata ; unsigned char * ucptr, sixteen_bytes [ 16 ] ; unsigned int * intptr, intdata ; unsigned short * shortptr ; char * charptr ; float * floatptr ; double * doubleptr ; char c ; <START_BUG> int byte_count = 0, count ; <END_BUG> if (! format ) return psf_ftell ( psf ) ; va_start ( argptr, format ) ; while ( ( c = * format ++ ) )  { switch ( c ) <START_BUG> { case 'e' : psf -> rwf_endian = SF_ENDIAN_LITTLE ; break ; case 'E' : psf -> rwf_endian = SF_ENDIAN_BIG ; break ; case'm' : intptr = va_arg ( argptr, unsigned int * ) ; <END_BUG> ucptr = ( unsigned char * ) intptr ;  byte_count += header_read ( psf, ucptr, sizeof ( int ) ) ; * intptr = GET_MARKER ( ucptr ) ; break ; case 'h' : <START_BUG> intptr = va_arg ( argptr, unsigned int * ) ; <END_BUG> ucptr = ( unsigned char * ) intptr ; byte_count += header_read ( psf, sixteen_bytes, sizeof ( sixteen_bytes ) ) ; { int k ; intdata = 0 ; for ( k = 0 ; k < 16 ; k ++ ) intdata ^= sixteen_bytes [ k ] << k ; } * intptr = intdata ; break ; case '1' : charptr = va_arg ( argptr, char * ) ; * charptr = 0 ; byte_count += header_read ( psf, charptr, sizeof ( char ) ) ; break ; case '2' : shortptr = va_arg ( argptr, unsigned short * ) ; * shortptr = 0 ; ucptr = ( unsigned char * ) shortptr ; byte_count += header_read ( psf, ucptr, sizeof ( short ) ) ; if ( psf -> rwf_endian == SF_ENDIAN_BIG ) * shortptr = GET_BE_SHORT ( ucptr ) ; else * shortptr = GET_LE_SHORT ( u

Fix:
<S2SV_ModStart> 0, count = 0 <S2SV_ModStart> ) ) { if ( psf -> header. indx + 16 >= psf -> header. len && psf_bump_header_allocation ( psf, 16 ) ) return count ; <S2SV_ModStart> * ) ; * intptr = 0 ; <S2SV_ModStart> int * ) ; * intptr = 0 <S2SV_ModStart> size_t ) ; memset ( charptr, 0, count ) ; byte_count += header_read ( psf, charptr, count ) ; break ; case 'G' : charptr = va_arg ( argptr, char * ) ; count = va_arg ( argptr, size_t ) ; memset ( charptr, 0, count ) ; if ( psf -> header. indx + count >= psf -> header. len && psf_bump_header_allocation ( psf, count ) ) return 0 ; byte_count += header_gets <S2SV_ModEnd> ( psf, <S2SV_ModStart> break ; case 'z' : psf_log_printf ( psf, "Format <S2SV_blank> conversion <S2SV_blank> \'z\' <S2SV_blank> not <S2SV_blank> implemented <S2SV_blank> yet.\\n" ) ; break ; case 'p' : <S2SV_ModEnd> count = va_arg <S2SV_ModStart> size_t ) ; header_seek ( psf, count, SEEK_SET ) ;
Buggy code:
 static node * parsetok ( struct tok_state * tok, grammar * g, int start, perrdetail * err_ret, int * flags ) { parser_state * ps ; node * n ; int started = 0 ; growable_int_array type_ignores ; if (! growable_int_array_init ( & type_ignores, 10 ) ) { err_ret -> error = E_NOMEM ; Ta3Tokenizer_Free ( tok ) ; return NULL ; } if ( ( ps = Ta3Parser_New ( g, start ) ) == NULL ) { err_ret -> error = E_NOMEM ; Ta3Tokenizer_Free ( tok ) ; return NULL ; } # ifdef PY_PARSER_REQUIRES_FUTURE_KEYWORD if ( * flags & PyPARSE_BARRY_AS_BDFL ) ps -> p_flags |= CO_FUTURE_BARRY_AS_BDFL ; # endif for ( ; ; ) { char * a, * b ; int type ; size_t len ; char * str ; int col_offset ; type = Ta3Tokenizer_Get ( tok, & a, & b ) ; if ( type == ERRORTOKEN ) { err_ret -> error = tok -> done ; break ; } if ( type == ENDMARKER && started ) { type = NEWLINE ; started = 0 ; if ( tok -> indent &&! ( * flags & PyPARSE_DONT_IMPLY_DEDENT ) ) { tok -> pendin = - tok -> indent ; tok -> indent = 0 ; } } else started = 1 ; <START_BUG> len = b - a ; <END_BUG> str = ( char * ) PyObject_MALLOC ( len + 1 ) ; if ( str == NULL ) { err_ret -> error = E_NOMEM ; break ; } if ( len > 0 ) strncpy ( str, a, len ) ; str [ len ] = '\\0' ; # ifdef PY_PARSER_REQUIRES_FUTURE_KEYWORD if ( type == NOTEQUAL ) { if (! ( ps -> p_flags & CO_FUTURE_BARRY_AS_BDFL ) && strcmp ( str, "!=" ) ) { PyObject_FREE ( str ) ; err_ret -> error = E_SYNTAX ; break ; } else if ( ( ps -> p_

Fix:
<S2SV_ModStart> ; len = ( a!= NULL && b!= NULL )? <S2SV_ModStart> b - a : 0 <S2SV_ModStart> ; err_ret -> expected = NOTEQUAL <S2SV_ModEnd> ; err_ret -> <S2SV_ModStart> if ( a!= NULL && a <S2SV_ModStart> -> line_start ) { <S2SV_ModStart> int ) ; } else { <S2SV_ModEnd> col_offset = - <S2SV_ModStart> - 1 ; }
Buggy code:
 <START_BUG> static INLINE void read_mv ( vp9_reader * r, MV * mv, const MV * ref, <END_BUG> const nmv_context * ctx, nmv_context_counts * counts, int allow_hp ) { const MV_JOINT_TYPE joint_type =  ( MV_JOINT_TYPE ) vp9_read_tree ( r, vp9_mv_joint_tree, ctx -> joints ) ; <START_BUG> const int use_hp = allow_hp && vp9_use_mv_hp ( ref ) ; MV diff = { 0, 0 } ; if ( mv_joint_vertical ( joint_type ) ) diff. row = read_mv_component ( r, & ctx -> comps [ 0 ], use_hp ) ; if ( mv_joint_horizontal ( joint_type ) ) diff. col = read_mv_component ( r, & ctx -> comps [ 1 ], use_hp ) ; vp9_inc_mv ( & diff, counts ) ; mv -> row = ref -> row + diff. row ; mv -> col = ref -> col + diff. col ; }<END_BUG>

Fix:
<S2SV_ModStart> void read_mv ( vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> ( MV_JOINT_TYPE ) vpx_read_tree <S2SV_ModEnd> ( r,
Buggy code:
 static int asn1_find_indefinite_length ( const unsigned char * data, size_t datalen, size_t * _dp, size_t * _len, const char * * _errmsg ) { unsigned char tag, tmp ; size_t dp = * _dp, len, n ; int indef_level = 1 ; next_tag : if ( unlikely ( datalen - dp < 2 ) ) { if ( datalen == dp ) goto missing_eoc ; goto data_overrun_error ; } tag = data [ dp ++ ] ; <START_BUG> if ( tag == 0 ) { <END_BUG> if ( data [ dp ++ ]!= 0 ) goto invalid_eoc ; if ( -- indef_level <= 0 ) { * _len = dp - * _dp ; * _dp = dp ; return 0 ; } goto next_tag ; } if ( unlikely ( ( tag & 0x1f ) == ASN1_LONG_TAG ) ) { do { if ( unlikely ( datalen - dp < 2 ) ) goto data_overrun_error ; tmp = data [ dp ++ ] ; } while ( tmp & 0x80 ) ; } len = data [ dp ++ ] ;  if ( len <= 0x7f ) { <START_BUG> dp += len ; goto next_tag ; } if ( unlikely ( len == ASN1_INDEFINITE_LENGTH ) ) { if ( unlikely ( ( tag & ASN1_CONS_BIT ) == ASN1_PRIM << 5 ) ) goto indefinite_len_primitive ; indef_level ++ ; goto next_tag ; } n = len - 0x80 ; <END_BUG> if ( unlikely ( n > sizeof ( size_t ) - 1 ) )  goto length_too_long ; if ( unlikely ( n > datalen - dp ) ) goto data_overrun_error ; <START_BUG> for ( len = 0 ; n > 0 ; n -- ) { <END_BUG> len <<= 8 ; len |= data [ dp ++ ] ; }  dp += len ; <START_BUG> goto next_tag ; length_too_long : * _errmsg = "Unsupported   length" ; goto error ; indefinite_len_primitive : * _errmsg = "Indefinite   len   primitive   not   permitted" ; goto error ; invalid_eoc : * _errmsg = "Invalid   length   EOC"<END_BUG>

Fix:
<S2SV_ModStart> ( tag == ASN1_EOC <S2SV_ModEnd> ) { if <S2SV_ModStart> <= 0x7f ) goto check_length ; <S2SV_ModEnd> if ( unlikely <S2SV_ModStart> > sizeof ( len <S2SV_ModEnd> ) - 1 <S2SV_ModStart> goto data_overrun_error ; len = 0 ; for ( <S2SV_ModEnd> ; n > <S2SV_ModStart> ] ; } check_length : if ( len > datalen - dp ) goto data_overrun_error ;
Buggy code:
 TcpOption * tcpGetOption ( TcpHeader * segment, uint8_t kind ) { <START_BUG> size_t length ; <END_BUG> uint_t i ; TcpOption * option ;  if ( segment -> dataOffset < 5 ) <START_BUG> return NULL ; <END_BUG> length = segment -> dataOffset * 4 - sizeof ( TcpHeader ) ;  i = 0 ; while ( i < length ) { option = ( TcpOption * ) ( segment -> options + i ) ; <START_BUG> if ( option -> kind == TCP_OPTION_NOP ) <END_BUG> { i ++ ;  continue ; <START_BUG> } if ( option -> kind == TCP_OPTION_END ) break ; <END_BUG> if ( ( i + 1 ) >= length || ( i + option -> length ) > length )  break ; if ( option -> kind == kind ) return option ; i += option -> length ; } <START_BUG> return NULL ; <END_BUG> }

Fix:
<S2SV_ModStart> ) { size_t i ; size_t length <S2SV_ModEnd> ; TcpOption * <S2SV_ModStart> segment -> dataOffset >= ( sizeof ( TcpHeader ) // 4 ) ) { length = ( <S2SV_ModEnd> segment -> dataOffset <S2SV_ModStart> dataOffset * 4 ) <S2SV_ModStart> -> kind == TCP_OPTION_END ) { break ; } else if ( option -> kind == <S2SV_ModStart> i ++ ; } else { <S2SV_ModEnd> if ( ( <S2SV_ModStart> ) >= length ) break ; if ( option -> length < sizeof ( TcpOption ) <S2SV_ModStart> length ; } } }
Buggy code:
 static Image * ReadSUNImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define RMT_EQUAL_RGB 1 # define RMT_NONE 0 # define RMT_RAW 2 # define RT_STANDARD 1 # define RT_ENCODED 2 # define RT_FORMAT_RGB 3 typedef struct _SUNInfo { unsigned int magic, width, height, depth, length, type, maptype, maplength ; } SUNInfo ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bytes_per_line, extent, <START_BUG> length ; <END_BUG> ssize_t count, y ; SUNInfo sun_info ; unsigned char * sun_data, * sun_pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & sun_info, 0, sizeof ( sun_info ) ) ; sun_info. magic = ReadBlobMSBLong ( image ) ; do { if ( sun_info. magic!= 0x59a66a95 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; sun_info. width = ReadBlobMSBLong ( image ) ; sun_info. height = ReadBlobMSBLong ( image ) ; sun_info. depth = ReadBlobMSBLong ( image ) ; sun_info. length = ReadBlobMSBLong ( image ) ; sun_info. type = ReadBlobMSBLong ( image ) ; sun_info. maptype = ReadBlobMSBLong ( image ) ; sun_info

Fix:
<S2SV_ModStart>, extent, height, <S2SV_ModStart> "UnableToReadImageData" ) ; <S2SV_ModEnd> height = sun_info <S2SV_ModStart> "MemoryAllocationFailed" ) ; if ( sun_info. type == RT_ENCODED ) <S2SV_ModStart> sun_data ) ; <S2SV_ModEnd> p = sun_pixels
Buggy code:
 struct sk_buff * * udp_gro_receive ( struct sk_buff * * head, struct sk_buff * skb, struct udphdr * uh ) { struct udp_offload_priv * uo_priv ; struct sk_buff * p, * * pp = NULL ; struct udphdr * uh2 ; unsigned int off = skb_gro_offset ( skb ) ; int flush = 1 ; <START_BUG> if ( NAPI_GRO_CB ( skb ) -> udp_mark || <END_BUG> ( skb -> ip_summed!= CHECKSUM_PARTIAL && NAPI_GRO_CB ( skb ) -> csum_cnt == 0 &&! NAPI_GRO_CB ( skb ) -> csum_valid ) ) goto out ;  NAPI_GRO_CB ( skb ) -> udp_mark = 1 ; <START_BUG> rcu_read_lock ( ) ; uo_priv = rcu_dereference ( udp_offload_base ) ; for ( ; uo_priv!= NULL ; uo_priv = rcu_dereference ( uo_priv -> next ) ) { if ( net_eq ( read_pnet ( & uo_priv -> net ), dev_net ( skb -> dev ) ) && uo_priv -> offload -> port == uh -> dest && uo_priv -> offload -> callbacks. gro_receive ) goto unflush ; } goto out_unlock ; unflush : flush = 0 ; for ( p = * head ; p ; p = p -> next ) { if (! NAPI_GRO_CB ( p ) -> same_flow ) continue ; uh2 = ( struct udphdr * ) ( p -> data + off ) ; if ( ( * ( u32 * ) & uh -> source!= * ( u32 * ) & uh2 -> source ) || (! uh -> check ^! uh2 -> check ) ) { NAPI_GRO_CB ( p ) -> same_flow = 0 ; continue ; } } skb_gro_pull ( skb, sizeof ( struct udphdr ) ) ; skb_gro_postpull_rcsum ( skb, uh, sizeof ( struct udphdr ) ) ; NAPI_GRO_CB ( skb ) -> proto =<END_BUG>

Fix:
<S2SV_ModStart> skb ) -> encap_mark <S2SV_ModEnd> || ( skb <S2SV_ModStart> skb ) -> encap_mark <S2SV_ModEnd> = 1 ;
Buggy code:
 static int unix_stream_sendmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len ) { struct sock_iocb * siocb = kiocb_to_siocb ( kiocb ) ; struct sock * sk = sock -> sk ; struct sock * other = NULL ; int err, size ; struct sk_buff * skb ; int sent = 0 ; struct scm_cookie tmp_scm ; bool fds_sent = false ; int max_level ; if ( NULL == siocb -> scm ) siocb -> scm = & tmp_scm ; wait_for_unix_gc ( ) ; <START_BUG> err = scm_send ( sock, msg, siocb -> scm ) ; <END_BUG> if ( err < 0 ) return err ; err = - EOPNOTSUPP ; if ( msg -> msg_flags & MSG_OOB ) goto out_err ; if ( msg -> msg_namelen ) { err = sk -> sk_state == TCP_ESTABLISHED? - EISCONN : - EOPNOTSUPP ; goto out_err ; } else { err = - ENOTCONN ; other = unix_peer ( sk ) ; if (! other ) goto out_err ; } if ( sk -> sk_shutdown & SEND_SHUTDOWN ) goto pipe_err ; while ( sent < len ) { size = len - sent ; if ( size > ( ( sk -> sk_sndbuf >> 1 ) - 64 ) ) size = ( sk -> sk_sndbuf >> 1 ) - 64 ; if ( size > SKB_MAX_ALLOC ) size = SKB_MAX_ALLOC ; skb = sock_alloc_send_skb ( sk, size, msg -> msg_flags & MSG_DONTWAIT, & err ) ; if ( skb == NULL ) goto out_err ; size = min_t ( int, size, skb_tailroom ( skb ) ) ; err = unix_scm_to_skb ( siocb -> scm, skb,! fds_sent ) ; if ( err < 0 ) { kfree_skb ( skb ) ; goto out_err ; } max_level = err + 1 ; fds_sent = true ; err = memcpy_from

Fix:
<S2SV_ModStart> siocb -> scm, false
Buggy code:
 <START_BUG> static void extend_to_full_distribution ( vp9_prob * probs, vp9_prob p ) { <END_BUG>  vpx_memcpy ( probs, vp9_pareto8_full [ p = 0? 0 : p - 1 ], <START_BUG> <END_BUG> MODEL_NODES * sizeof ( vp9_prob ) ) ;  }

Fix:
<S2SV_ModStart> void extend_to_full_distribution ( vpx_prob <S2SV_ModEnd> * probs, <S2SV_ModStart> * probs, vpx_prob <S2SV_ModEnd> p ) { <S2SV_ModStart> p ) { memcpy <S2SV_ModEnd> ( probs, <S2SV_ModStart> * sizeof ( vpx_prob <S2SV_ModEnd> ) ) ;
Buggy code:
 void ip_send_reply ( struct sock * sk, struct sk_buff * skb, struct ip_reply_arg * arg, unsigned int len ) { struct inet_sock * inet = inet_sk ( sk ) ; <START_BUG> struct { <END_BUG> struct ip_options opt ; char data [ 40 ] ; } replyopts ; struct ipcm_cookie ipc ; __be32 daddr ; struct rtable * rt = skb_rtable ( skb ) ;  if ( ip_options_echo ( & replyopts. opt, skb ) ) <START_BUG> return ; daddr = ipc. addr = rt -> rt_src ; ipc. opt = NULL ; ipc. tx_flags = 0 ; <END_BUG> if ( replyopts. opt. optlen ) {  ipc. opt = & replyopts. opt ; <START_BUG> if ( ipc. opt -> srr ) <END_BUG>  daddr = replyopts. opt. faddr ; <START_BUG> } { struct flowi4 fl4 ; flowi4_init_output ( & fl4, arg -> bound_dev_if, 0, RT_TOS ( ip_hdr ( skb ) -> tos ), RT_SCOPE_UNIVERSE, sk -> sk_protocol, ip_reply_arg_flowi_flags ( arg ), daddr, rt -> rt_spec_dst, tcp_hdr ( skb ) -> source, tcp_hdr ( skb ) -> dest ) ; security_skb_classify_flow ( skb, flowi4_to_flowi ( & fl4 ) ) ; rt = ip_route_output_key ( sock_net ( sk ), & fl4 ) ; if ( IS_ERR ( rt ) ) return ; } bh_lock_sock ( sk ) ; inet -> tos = ip_hdr ( skb ) -> tos ; sk -> sk_priority = skb -> priority ; sk -> sk_protocol = ip_hdr ( skb ) -> protocol ; sk -> sk_bound_dev_if = arg -> bound_dev_if ; ip_append_data ( sk, ip_reply_glue_bits, arg -> iov -> iov_base, len, 0, & ipc, & rt, MSG_DONTWAIT ) ; if ( ( skb = skb_peek ( & sk -> sk_write_queue ) )<END_BUG>

Fix:
<S2SV_ModStart> ) ; struct ip_options_data <S2SV_ModEnd> replyopts ; struct <S2SV_ModStart> replyopts. opt. opt <S2SV_ModStart>. opt. opt. <S2SV_ModStart> ; if ( replyopts. opt. opt. <S2SV_ModEnd> srr ) daddr <S2SV_ModStart> daddr = replyopts. opt
Buggy code:
 static int ext2_xattr_list ( struct dentry * dentry, char * buffer, size_t buffer_size ) { struct inode * inode = d_inode ( dentry ) ; struct buffer_head * bh = NULL ; struct ext2_xattr_entry * entry ; char * end ; size_t rest = buffer_size ; <START_BUG> int error ; <END_BUG> ea_idebug ( inode, "buffer=%p,   buffer_size=%ld", buffer, ( long ) buffer_size ) ; down_read ( & EXT2_I ( inode ) -> xattr_sem ) ; error = 0 ; if (! EXT2_I ( inode ) -> i_file_acl ) goto cleanup ; ea_idebug ( inode, "reading   block   %d", EXT2_I ( inode ) -> i_file_acl ) ; bh = sb_bread ( inode -> i_sb, EXT2_I ( inode ) -> i_file_acl ) ; error = - EIO ; if (! bh ) goto cleanup ; ea_bdebug ( bh, "b_count=%d,   refcount=%d", atomic_read ( & ( bh -> b_count ) ), le32_to_cpu ( HDR ( bh ) -> h_refcount ) ) ; end = bh -> b_data + bh -> b_size ; if ( HDR ( bh ) -> h_magic!= cpu_to_le32 ( EXT2_XATTR_MAGIC ) || HDR ( bh ) -> h_blocks!= cpu_to_le32 ( 1 ) ) { bad_block : ext2_error ( inode -> i_sb, "ext2_xattr_list", "inode   %ld:   bad   block   %d", inode -> i_ino, EXT2_I ( inode ) -> i_file_acl ) ; error = - EIO ; goto cleanup ; } entry = FIRST_ENTRY ( bh ) ; while (! IS_LAST_ENTRY ( entry ) ) { struct ext2_xattr_entry * next = EXT2_XATTR_NEXT ( entry ) ; if ( ( char * ) next >= end ) goto bad_block ; entry = next ; }  if ( ext2_xattr_cache_insert ( bh ) ) <START_BUG> ea_idebug ( inode,<END_BUG>

Fix:
<S2SV_ModStart> ; int error ; struct mb2_cache * ext2_mb_cache = EXT2_SB ( inode -> i_sb ) -> s_mb_cache <S2SV_ModStart> ( ext2_xattr_cache_insert ( ext2_mb_cache,
Buggy code:
 vpx_codec_err_t vpx_codec_set_frame_buffer_functions ( vpx_codec_ctx_t * ctx, vpx_get_frame_buffer_cb_fn_t cb_get, vpx_release_frame_buffer_cb_fn_t cb_release, void * cb_priv ) { vpx_codec_err_t res ; if (! ctx ||! cb_get ||! cb_release ) { res = VPX_CODEC_INVALID_PARAM ; } else if (! ctx -> iface ||! ctx -> priv ||! ( ctx -> iface -> caps & VPX_CODEC_CAP_EXTERNAL_FRAME_BUFFER ) ) { res = VPX_CODEC_ERROR ; } else { <START_BUG> res = ctx -> iface -> dec. set_fb_fn ( ctx -> priv -> alg_priv, cb_get, cb_release, <END_BUG> cb_priv ) ; } return SAVE_STATUS ( ctx, res ) ; }

Fix:
<S2SV_ModStart>. set_fb_fn ( get_alg_priv ( ctx ) <S2SV_ModEnd>, cb_get,
Buggy code:
 static int sgi_clock_set ( clockid_t clockid, struct timespec * tp ) { u64 nsec ; <START_BUG> u64 rem ; <END_BUG> nsec = rtc_time ( ) * sgi_clock_period ;  sgi_clock_offset. tv_sec = tp -> tv_sec - div_long_long_rem ( nsec, NSEC_PER_SEC, & rem ) ; <START_BUG> if ( rem <= tp -> tv_nsec ) sgi_clock_offset. tv_nsec = tp -> tv_sec - rem ; else { sgi_clock_offset. tv_nsec = tp -> tv_sec + NSEC_PER_SEC - rem ; sgi_clock_offset. tv_sec -- ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> u64 nsec ; u32 <S2SV_ModEnd> rem ; nsec <S2SV_ModStart> -> tv_sec - div_u64_rem <S2SV_ModEnd> ( nsec,
Buggy code:
 int udp_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct sockaddr_in * sin = ( struct sockaddr_in * ) msg -> msg_name ; struct sk_buff * skb ; unsigned int ulen, copied ; int peeked, off = 0 ; int err ; int is_udplite = IS_UDPLITE ( sk ) ; <START_BUG> bool slow ; <END_BUG> if ( addr_len ) * addr_len = sizeof ( * sin ) ; if ( flags & MSG_ERRQUEUE ) return ip_recv_error ( sk, msg, len ) ; try_again : skb = __skb_recv_datagram ( sk, flags | ( noblock? MSG_DONTWAIT : 0 ), & peeked, & off, & err ) ; if (! skb ) goto out ; ulen = skb -> len - sizeof ( struct udphdr ) ; copied = len ; if ( copied > ulen ) copied = ulen ; else if ( copied < ulen ) msg -> msg_flags |= MSG_TRUNC ; if ( copied < ulen || UDP_SKB_CB ( skb ) -> partial_cov ) { if ( udp_lib_checksum_complete ( skb ) ) goto csum_copy_err ; } if ( skb_csum_unnecessary ( skb ) ) err = skb_copy_datagram_iovec ( skb, sizeof ( struct udphdr ), msg -> msg_iov, copied ) ; else { err = skb_copy_and_csum_datagram_iovec ( skb, sizeof ( struct udphdr ), msg -> msg_iov ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( unlikely ( err ) ) { trace_kfree_skb ( skb, udp_recvmsg ) ; if (! peeked ) { atomic_inc ( & sk -> sk_drops ) ; UDP_INC_STATS_USER ( sock_net ( sk ), UDP_MIB_INERRORS, is_udplite ) ; } goto out

Fix:
<S2SV_ModStart> ; bool slow <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) ; * addr_len = sizeof ( * sin ) ;
Buggy code:
 static int print_lcp_config_options ( netdissect_options * ndo, const u_char * p, int length ) { int len, opt ; if ( length < 2 ) return 0 ; ND_TCHECK2 ( * p, 2 ) ; len = p [ 1 ] ; opt = p [ 0 ] ; if ( length < len ) return 0 ; if ( len < 2 ) { if ( ( opt >= LCPOPT_MIN ) && ( opt <= LCPOPT_MAX ) ) ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u   (length   bogus,   should   be   >=   2)", lcpconfopts [ opt ], opt, len ) ) ; else ND_PRINT ( ( ndo, "\\n\\tunknown   LCP   option   0x%02x", opt ) ) ; return 0 ; } if ( ( opt >= LCPOPT_MIN ) && ( opt <= LCPOPT_MAX ) ) ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u", lcpconfopts [ opt ], opt, len ) ) ; else { ND_PRINT ( ( ndo, "\\n\\tunknown   LCP   option   0x%02x", opt ) ) ; return len ; } switch ( opt ) { case LCPOPT_VEXT : if ( len < 6 ) { ND_PRINT ( ( ndo, "   (length   bogus,   should   be   >=   6)" ) ) ; return len ; } <START_BUG> ND_TCHECK2 ( * ( p + 2 ), 3 ) ; <END_BUG> ND_PRINT ( ( ndo, ":   Vendor:   %s   (%u)", tok2str ( oui_values, "Unknown", EXTRACT_24BITS ( p + 2 ) ), EXTRACT_24BITS ( p + 2 ) ) ) ; # if 0 ND_TCHECK ( p [ 5 ] ) ; ND_PRINT ( ( ndo, ",   kind:   0x%02x", p [ 5 ] ) ) ; ND_PRINT ( ( ndo, ",   Value:  

Fix:
<S2SV_ModStart> len ; } ND_TCHECK_24BITS ( p + 2 <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> len ; } ND_TCHECK_16BITS ( p + <S2SV_ModEnd> 2 ) ; <S2SV_ModStart> len ; } ND_TCHECK_32BITS ( p + 2 <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> len ; } ND_TCHECK_16BITS ( p + <S2SV_ModEnd> 2 ) ; <S2SV_ModStart> 0 ; } ND_TCHECK_16BITS ( p + <S2SV_ModEnd> 2 ) ; <S2SV_ModStart> 0 ; } ND_TCHECK_32BITS ( p + 2 <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> 0 ; } ND_TCHECK_16BITS ( p + <S2SV_ModEnd> 2 ) ; <S2SV_ModStart> 0 ; } ND_TCHECK_16BITS ( p + <S2SV_ModEnd> 2 ) ;
Buggy code:
 struct monitor * monitor_init ( void ) { <START_BUG> struct ssh * ssh = active_state ; <END_BUG> struct monitor * mon ; mon = xcalloc ( 1, sizeof ( * mon ) ) ; monitor_openfds ( mon, 1 ) ;  if ( options. compression ) { <START_BUG> mon -> m_zback = mm_create ( NULL, MM_MEMSIZE ) ; mon -> m_zlib = mm_create ( mon -> m_zback, 20 * MM_MEMSIZE ) ; ssh_packet_set_compress_hooks ( ssh, mon -> m_zlib, ( ssh_packet_comp_alloc_func * ) mm_zalloc, ( ssh_packet_comp_free_func * ) mm_zfree ) ; } return mon ; }<END_BUG>

Fix:
<S2SV_ModStart> void ) { <S2SV_ModEnd> struct monitor * <S2SV_ModStart> 1 ) ; <S2SV_ModEnd> return mon ;
Buggy code:
 int _yr_scan_verify_re_match ( YR_SCAN_CONTEXT * context, YR_AC_MATCH * ac_match, uint8_t * data, size_t data_size, size_t data_base, size_t offset ) { CALLBACK_ARGS callback_args ; RE_EXEC_FUNC exec ; int forward_matches = - 1 ; int backward_matches = - 1 ; int flags = 0 ; if ( STRING_IS_GREEDY_REGEXP ( ac_match -> string ) ) flags |= RE_FLAGS_GREEDY ; if ( STRING_IS_NO_CASE ( ac_match -> string ) ) flags |= RE_FLAGS_NO_CASE ; if ( STRING_IS_DOT_ALL ( ac_match -> string ) ) flags |= RE_FLAGS_DOT_ALL ; if ( STRING_IS_FAST_REGEXP ( ac_match -> string ) ) exec = yr_re_fast_exec ; else exec = yr_re_exec ; if ( STRING_IS_ASCII ( ac_match -> string ) ) { forward_matches = exec ( ac_match -> forward_code, data + offset, data_size - offset, <START_BUG> offset > 0? flags | RE_FLAGS_NOT_AT_START : flags, <END_BUG> NULL, NULL ) ; } if ( STRING_IS_WIDE ( ac_match -> string ) && forward_matches == - 1 ) { flags |= RE_FLAGS_WIDE ; forward_matches = exec ( ac_match -> forward_code, data + offset, data_size - offset,  offset > 0? flags | RE_FLAGS_NOT_AT_START : flags, <START_BUG> NULL, NULL ) ; } switch ( forward_matches ) { case - 1 : return ERROR_SUCCESS ; case - 2 : return ERROR_INSUFFICIENT_MEMORY ; case - 3 : return ERROR_TOO_MANY_MATCHES ; case - 4 : return ERROR_TOO_MANY_RE_FIBERS ; case - 5 : return ERROR_INTERNAL_FATAL_ERROR ; } if ( forward_matches == 0 && ac_match -> backward_code == NULL ) return ERROR_SUCCESS ; callback_args. string = ac_match -> string ; callback_args. context = context ; callback_args. data = data ; callback_args. data_size =<END_BUG>

Fix:
<S2SV_ModStart> offset, offset, <S2SV_ModEnd> flags, NULL <S2SV_ModStart> offset, offset, <S2SV_ModEnd> flags, NULL <S2SV_ModStart>, data + offset, data_size -
Buggy code:
 PHPAPI int php_var_unserialize ( UNSERIALIZE_PARAMETER ) { const unsigned char * cursor, * limit, * marker, * start ; zval * * rval_ref ; limit = max ; cursor = * p ; if ( YYCURSOR >= YYLIMIT ) { return 0 ; } if ( var_hash && cursor [ 0 ]!= 'R' ) { var_push ( var_hash, rval ) ; } start = cursor ; <START_BUG> # line 496 "ext//standard//var_unserializer.c" <END_BUG> { YYCTYPE yych ; static const unsigned char yybm [ ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128, 128, 128, 128, 128, 128, 128, 128, 128, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,

Fix:
<S2SV_ModStart> ; # line 501 <S2SV_ModEnd> "ext//standard//var_unserializer.c" { YYCTYPE <S2SV_ModStart> : # line 875 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { return <S2SV_ModStart> } # line 563 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy4 : <S2SV_ModStart> ; # line 869 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { php_error_docref <S2SV_ModStart> } # line 612 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy16 : <S2SV_ModStart> ; # line 717 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { size_t <S2SV_ModStart> ; if ( elements < 0 ) { efree ( class_name ) ; return 0 ; } if ( <S2SV_ModStart> } # line 795 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy25 : <S2SV_ModStart> ; # line 704 "ext//standard//var_unserializer.re" { long elements ; <S2SV_ModEnd> if (! <S2SV_ModStart> rval ) ; elements = object_common1 ( UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR ) ; if ( elements < 0 ) { return 0
Buggy code:
 static guint32 parse_wbxml_attribute_list_defined ( proto_tree * tree, tvbuff_t * tvb, guint32 offset, guint32 str_tbl, guint8 level, guint8 * codepage_attr, const wbxml_decoding * map ) { guint32 tvb_len = tvb_reported_length ( tvb ) ; <START_BUG> guint32 off = offset ; <END_BUG> guint32 len ; guint str_len ; guint32 ent ; guint32 idx ; guint8 peek ; guint8 attr_save_known = 0 ; const char * attr_save_literal = NULL ; DebugLog ( ( "parse_wbxml_attr_defined   (level   =   %u,   offset   =   %u)\\n",  level, offset ) ) ; <START_BUG> while ( off < tvb_len ) { peek = tvb_get_guint8 ( tvb, off ) ; DebugLog ( ( "ATTR:   (top   of   while)   level   =   %3u,   peek   =   0x%02X,   " "off   =   %u,   tvb_len   =   %u\\n", level, peek, off, tvb_len ) ) ; if ( ( peek & 0x3F ) < 5 ) switch ( peek ) { case 0x00 : * codepage_attr = tvb_get_guint8 ( tvb, off + 1 ) ; proto_tree_add_text ( tree, tvb, off, 2, "             |     Attr   |   A   -->%3d   " "|   SWITCH_PAGE   (Attr   code   page)         |", * codepage_attr ) ; off += 2 ; break ; case 0x01 : off ++ ; DebugLog ( ( "ATTR:   level   =   %u,   Return:   len   =   %u\\n", level, off - offset ) ) ; return ( off - offset ) ; case 0x02 : ent = tvb_get_guintvar ( tvb, off + 1, & len ) ; proto_tree_add_text ( tree, tvb, off, 1 + len, "     %3d<END_BUG>

Fix:
<S2SV_ModStart> off = offset, last_off <S2SV_ModStart> offset ) ) ; last_off = off <S2SV_ModStart> ; } } if ( off < last_off ) { THROW ( ReportedBoundsError ) ; } last_off = off ;
Buggy code:
 static gboolean parse_toshiba_packet ( FILE_T fh, struct wtap_pkthdr * phdr, Buffer * buf, int * err, gchar * * err_info ) { union wtap_pseudo_header * pseudo_header = & phdr -> pseudo_header ; char line [ TOSHIBA_LINE_LENGTH ] ; int num_items_scanned ; <START_BUG> guint pkt_len ; <END_BUG> int pktnum, hr, min, sec, csec ; char channel [ 10 ], direction [ 10 ] ; int i, hex_lines ; guint8 * pd ; if ( file_gets ( line, TOSHIBA_LINE_LENGTH, fh ) == NULL ) { * err = file_error ( fh, err_info ) ; if ( * err == 0 ) { * err = WTAP_ERR_SHORT_READ ; } return FALSE ; } num_items_scanned = sscanf ( line, "%9d]   %2d:%2d:%2d.%9d   %9s   %9s", & pktnum, & hr, & min, & sec, & csec, channel, direction ) ; if ( num_items_scanned!= 7 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "toshiba:   record   header   isn\'t   valid" ) ; return FALSE ; } do { if ( file_gets ( line, TOSHIBA_LINE_LENGTH, fh ) == NULL ) { * err = file_error ( fh, err_info ) ; if ( * err == 0 ) { * err = WTAP_ERR_SHORT_READ ; } return FALSE ; } line [ 16 ] = '\\0' ; } while ( strcmp ( line, "OFFSET   0001-0203" )!= 0 ) ;  num_items_scanned = sscanf ( line + 64, "LEN=%9u", & pkt_len ) ; <START_BUG> if ( num_items_scanned!= 1 ) { * err = WTAP_ERR_BAD_FILE ; <END_BUG> * err_info = g_strdup ( "toshiba:   OFFSET   line   doesn\'t   have   valid   LEN   item" ) ;  return FALSE ; } if ( pkt

Fix:
<S2SV_ModStart> int num_items_scanned ; int pkt_len, <S2SV_ModEnd> pktnum, hr <S2SV_ModStart> + 64, "LEN=%9d" <S2SV_ModEnd>, & pkt_len <S2SV_ModStart> g_strdup ( "toshiba: <S2SV_blank> OFFSET <S2SV_blank> line <S2SV_blank> doesn\'t <S2SV_blank> have <S2SV_blank> valid <S2SV_blank> LEN <S2SV_blank> item" ) ; return FALSE ; } if ( pkt_len < 0 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "toshiba: <S2SV_blank> packet <S2SV_blank> header <S2SV_blank> has <S2SV_blank> a <S2SV_blank> negative <S2SV_blank> packet <S2SV_blank> length"
Buggy code:
 static __u8 * kye_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { switch ( hdev -> product ) { case USB_DEVICE_ID_KYE_ERGO_525V : <START_BUG> if ( * rsize >= 74 && <END_BUG>  rdesc [ 61 ] == 0x05 && rdesc [ 62 ] == 0x08 && <START_BUG> rdesc [ 63 ] == 0x19 && rdesc [ 64 ] == 0x08 && rdesc [ 65 ] == 0x29 && rdesc [ 66 ] == 0x0f && rdesc [ 71 ] == 0x75 && rdesc [ 72 ] == 0x08 && rdesc [ 73 ] == 0x95 && rdesc [ 74 ] == 0x01 ) { hid_info ( hdev, "fixing   up   Kye//Genius   Ergo   Mouse   " "report   descriptor\\n" ) ; rdesc [ 62 ] = 0x09 ; rdesc [ 64 ] = 0x04 ; rdesc [ 66 ] = 0x07 ; rdesc [ 72 ] = 0x01 ; rdesc [ 74 ] = 0x08 ; } break ; case USB_DEVICE_ID_KYE_EASYPEN_I405X : if ( * rsize == EASYPEN_I405X_RDESC_ORIG_SIZE ) { rdesc = easypen_i405x_rdesc_fixed ; * rsize = sizeof ( easypen_i405x_rdesc_fixed ) ; } break ; case USB_DEVICE_ID_KYE_MOUSEPEN_I608X : if ( * rsize == MOUSEPEN_I608X_RDESC_ORIG_SIZE ) { rdesc = mousepen_i608x_rdesc_fixed ; * rsize = sizeof ( mousepen_i608x_rdesc_fixed ) ; } break ; case USB_DEVICE_ID_KYE_EASYPEN_M610X : if ( * rsize == EASYPEN_M610X_RDESC_ORIG_SIZE ) { rdesc = easypen_m610x_rdesc_fixed ; * r<END_BUG>

Fix:
<S2SV_ModStart> * rsize >= 75 && rdesc [ 61 ] == 0x05 && rdesc [ 62 ] == 0x08 && rdesc [ 63 ] == 0x19 && rdesc [ 64 ] == 0x08 && rdesc [ 65 ] == 0x29 && rdesc [ 66 ] == 0x0f && rdesc [ 71 ] == 0x75 && rdesc [ 72 ] == 0x08 && rdesc [ 73 ] == 0x95 && rdesc [ 74 ] == 0x01 ) { hid_info ( hdev, "fixing <S2SV_blank> up <S2SV_blank> Kye//Genius <S2SV_blank> Ergo <S2SV_blank> Mouse <S2SV_blank> " "report <S2SV_blank> descriptor\\n" ) ; <S2SV_ModEnd> rdesc [ 62 <S2SV_ModStart> [ 62 ] = 0x09 ; rdesc [ 64 ] = 0x04 ; rdesc [ 66 ] = 0x07 ; rdesc [ 72 ] = 0x01 ; rdesc [ 74 ] = 0x08 <S2SV_ModEnd> ; } break
Buggy code:
 static int iowarrior_probe ( struct usb_interface * interface, const struct usb_device_id * id ) { struct usb_device * udev = interface_to_usbdev ( interface ) ; struct iowarrior * dev = NULL ; struct usb_host_interface * iface_desc ; struct usb_endpoint_descriptor * endpoint ; int i ; int retval = - ENOMEM ; dev = kzalloc ( sizeof ( struct iowarrior ), GFP_KERNEL ) ; if ( dev == NULL ) { dev_err ( & interface -> dev, "Out   of   memory\\n" ) ; return retval ; } mutex_init ( & dev -> mutex ) ; atomic_set ( & dev -> intr_idx, 0 ) ; atomic_set ( & dev -> read_idx, 0 ) ; spin_lock_init ( & dev -> intr_idx_lock ) ; atomic_set ( & dev -> overflow_flag, 0 ) ; init_waitqueue_head ( & dev -> read_wait ) ; atomic_set ( & dev -> write_busy, 0 ) ; init_waitqueue_head ( & dev -> write_wait ) ; dev -> udev = udev ; dev -> interface = interface ; iface_desc = interface -> cur_altsetting ; <START_BUG> dev -> product_id = le16_to_cpu ( udev -> descriptor. idProduct ) ; <END_BUG> for ( i = 0 ; i < iface_desc -> desc. bNumEndpoints ; ++ i ) { endpoint = & iface_desc -> endpoint [ i ]. desc ; if ( usb_endpoint_is_int_in ( endpoint ) ) dev -> int_in_endpoint = endpoint ; if ( usb_endpoint_is_int_out ( endpoint ) ) dev -> int_out_endpoint = endpoint ; } dev -> report_size = usb_endpoint_maxp ( dev -> int_in_endpoint ) ; if ( ( dev -> interface -> cur_altsetting -> desc. bInterfaceNumber == 0 ) && ( dev -> product_id == USB_DEVICE_ID_CODEMERCS_IOW56 ) ) dev -> report_size = 7 ; dev -> int_in_urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! dev -> int_in_urb ) { dev_err ( & interface -> dev

Fix:
<S2SV_ModStart> idProduct ) ; if ( iface_desc -> desc. bNumEndpoints < 1 ) { dev_err ( & interface -> dev, "Invalid <S2SV_blank> number <S2SV_blank> of <S2SV_blank> endpoints\\n" ) ; retval = - EINVAL ; goto error ; }
Buggy code:
 static ssize_t bsg_write ( struct file * file, const char __user * buf, size_t count, loff_t * ppos ) { struct bsg_device * bd = file -> private_data ; ssize_t bytes_written ; int ret ; <START_BUG> dprintk ( "%s:   write   %Zd   bytes\\n", bd -> name, count ) ; <END_BUG> bsg_set_block ( bd, file ) ; bytes_written = 0 ; ret = __bsg_write ( bd, buf, count, & bytes_written, file -> f_mode & FMODE_WRITE ) ; * ppos = bytes_written ; if (! bytes_written || err_block_err ( ret ) ) bytes_written = ret ; dprintk ( "%s:   returning   %Zd\\n", bd -> name, bytes_written ) ; return bytes_written ; }

Fix:
<S2SV_ModStart>, count ) ; if ( unlikely ( segment_eq ( get_fs ( ), KERNEL_DS ) ) ) return - EINVAL
Buggy code:
 static void fwnet_receive_broadcast ( struct fw_iso_context * context, u32 cycle, size_t header_length, void * header, void * data ) { struct fwnet_device * dev ; struct fw_iso_packet packet ; __be16 * hdr_ptr ; __be32 * buf_ptr ; int retval ; u32 length ; <START_BUG> u16 source_node_id ; <END_BUG> u32 specifier_id ; u32 ver ; unsigned long offset ; unsigned long flags ; dev = data ; hdr_ptr = header ; length = be16_to_cpup ( hdr_ptr ) ; spin_lock_irqsave ( & dev -> lock, flags ) ; offset = dev -> rcv_buffer_size * dev -> broadcast_rcv_next_ptr ; buf_ptr = dev -> broadcast_rcv_buffer_ptrs [ dev -> broadcast_rcv_next_ptr ++ ] ; if ( dev -> broadcast_rcv_next_ptr == dev -> num_broadcast_rcv_ptrs ) dev -> broadcast_rcv_next_ptr = 0 ; spin_unlock_irqrestore ( & dev -> lock, flags ) ;  specifier_id = ( be32_to_cpu ( buf_ptr [ 0 ] ) & 0xffff ) << 8 <START_BUG> | ( be32_to_cpu ( buf_ptr [ 1 ] ) & 0xff000000 ) >> 24 ; ver = be32_to_cpu ( buf_ptr [ 1 ] ) & 0xffffff ; source_node_id = be32_to_cpu ( buf_ptr [ 0 ] ) >> 16 ; if ( specifier_id == IANA_SPECIFIER_ID && <END_BUG> ( ver == RFC2734_SW_VERSION  # if IS_ENABLED ( CONFIG_IPV6 ) <START_BUG> || ver == RFC3146_SW_VERSION <END_BUG> # endif  ) ) { <START_BUG> buf_ptr += 2 ; length -= IEEE1394_GASP_HDR_SIZE ; fwnet_incoming_packet ( dev, buf_ptr, length, source_node_id, context -> card -> generation, true ) ; <END_BUG> }  packet. payload_length = dev -> rcv_buffer_size ; packet. interrupt = 1 ; packet. skip = 0 ; packet. tag = 3 ; packet. sy = 0 ; packet. header_length = IEEE

Fix:
<S2SV_ModStart> u32 length ; <S2SV_ModEnd> unsigned long offset <S2SV_ModStart> flags ) ; if ( length > IEEE1394_GASP_HDR_SIZE && gasp_specifier_id ( buf_ptr ) <S2SV_ModEnd> == IANA_SPECIFIER_ID && <S2SV_ModStart> IANA_SPECIFIER_ID && ( gasp_version ( buf_ptr ) <S2SV_ModEnd> == RFC2734_SW_VERSION # <S2SV_ModStart> CONFIG_IPV6 ) || gasp_version ( buf_ptr ) <S2SV_ModEnd> == RFC3146_SW_VERSION # <S2SV_ModStart> endif ) ) fwnet_incoming_packet ( dev, buf_ptr + 2, length - IEEE1394_GASP_HDR_SIZE, gasp_source_id ( buf_ptr ) <S2SV_ModEnd>, context -> <S2SV_ModStart> true ) ; <S2SV_ModEnd> packet. payload_length
Buggy code:
 int usb_cypress_load_firmware ( struct usb_device * udev, const struct firmware * fw, int type ) { struct hexline * hx ; <START_BUG> u8 reset ; <END_BUG> int ret, pos = 0 ;  hx = kmalloc ( sizeof ( * hx ), GFP_KERNEL ) ; <START_BUG> if (! hx ) return - ENOMEM ; reset = 1 ; <END_BUG> if ( ( ret = usb_cypress_writemem ( udev, cypress [ type ]. cpu_cs_register, & reset, 1 ) )!= 1 )  err ( "could   not   stop   the   USB   controller   CPU." ) ; while ( ( ret = dvb_usb_get_hexline ( fw, hx, & pos ) ) > 0 ) { deb_fw ( "writing   to   address   0x%04x   (buffer:   0x%02x   %02x)\\n", hx -> addr, hx -> len, hx -> chk ) ; ret = usb_cypress_writemem ( udev, hx -> addr, hx -> data, hx -> len ) ; if ( ret!= hx -> len ) { err ( "error   while   transferring   firmware   (transferred   size:   %d,   block   size:   %d)", ret, hx -> len ) ; ret = - EINVAL ; break ; } } if ( ret < 0 ) { err ( "firmware   download   failed   at   %d   with   %d", pos, ret ) ; <START_BUG> kfree ( hx ) ; <END_BUG> return ret ; } if ( ret == 0 ) {  reset = 0 ; <START_BUG> <END_BUG> if ( ret || usb_cypress_writemem ( udev, cypress [ type ]. cpu_cs_register, & reset, 1 )!= 1 ) {  err ( "could   not   restart   the   USB   controller   CPU." ) ; ret = - EINVAL ; } } else ret = - EIO ; <START_BUG> kfree ( hx ) ; <END_BUG> return ret ; }

Fix:
<S2SV_ModStart> hx ; u8 * buf <S2SV_ModEnd> ; int ret <S2SV_ModStart> = 0 ; u16 cpu_cs_register = <S2SV_ModEnd> cypress [ type <S2SV_ModStart> ]. cpu_cs_register ; buf = kmalloc ( sizeof ( * hx ), GFP_KERNEL ) ; if (! buf ) return - ENOMEM ; hx = ( struct hexline * ) buf ; buf [ 0 ] = 1 ; if ( usb_cypress_writemem ( udev, cpu_cs_register, buf, 1 <S2SV_ModEnd> )!= 1 <S2SV_ModStart> ; kfree ( buf <S2SV_ModEnd> ) ; return <S2SV_ModStart> 0 ) { buf [ 0 ] = 0 ; if ( <S2SV_ModEnd> usb_cypress_writemem ( udev <S2SV_ModStart> ( udev, cpu_cs_register, buf <S2SV_ModEnd>, 1 ) <S2SV_ModStart> ; kfree ( buf <S2SV_ModEnd> ) ; return
Buggy code:
 static int udf_encode_fh ( struct inode * inode, __u32 * fh, int * lenp, struct inode * parent ) { int len = * lenp ; struct kernel_lb_addr location = UDF_I ( inode ) -> i_location ; struct fid * fid = ( struct fid * ) fh ; int type = FILEID_UDF_WITHOUT_PARENT ; if ( parent && ( len < 5 ) ) { * lenp = 5 ; return 255 ; } else if ( len < 3 ) { * lenp = 3 ; return 255 ; } * lenp = 3 ; fid -> udf. block = location. logicalBlockNum ; fid -> udf. partref = location. partitionReferenceNum ; <START_BUG> fid -> udf. generation = inode -> i_generation ; <END_BUG> if ( parent ) { location = UDF_I ( parent ) -> i_location ; fid -> udf. parent_block = location. logicalBlockNum ; fid -> udf. parent_partref = location. partitionReferenceNum ; fid -> udf. parent_generation = inode -> i_generation ; * lenp = 5 ; type = FILEID_UDF_WITH_PARENT ; } return type ; }

Fix:
<S2SV_ModStart> -> udf. parent_partref = 0 ; fid -> udf.