nus-yam/ex-repair huggingface dataset:
Buggy code:
 size_t _dl_dst_count ( const char * name, int is_path ) { <START_BUG> size_t cnt = 0 ; <END_BUG> do { size_t len = 1 ;  if ( ( ( (! __libc_enable_secure <START_BUG> <END_BUG> && strncmp ( & name [ 1 ], "ORIGIN", 6 ) == 0 && ( len = 7 )!= 0 )  || ( strncmp ( & name [ 1 ], "PLATFORM", 8 ) == 0 && ( len = 9 )!= 0 ) ) && ( name [ len ] == '\\0' || name [ len ] == '//' || ( is_path && name [ len ] == ':' ) ) ) || ( name [ 1 ] == '{' && ( (! __libc_enable_secure <START_BUG> && strncmp ( & name [ 2 ], "ORIGIN}", 7 ) == 0 && ( len = 9 )!= 0 ) <END_BUG> || ( strncmp ( & name [ 2 ], "PLATFORM}", 9 ) == 0 && ( len = 11 )!= 0 ) ) ) ) ++ cnt ; name = strchr ( name + len, '$' ) ; } while ( name!= NULL ) ; return cnt ; }

Fix:
<S2SV_ModStart> is_path ) { const char * const start = name ; <S2SV_ModStart> ( ( ( strncmp ( & name [ 1 ], "ORIGIN}", 6 ) == 0 && (! __libc_enable_secure || ( ( name [ 7 ] == '\\0' || ( is_path && name [ 7 ] == ':' ) ) && ( name == start || ( is_path && name [ - 1 ] == ':' ) ) ) ) && ( len = 7 )!= 0 ) || ( <S2SV_ModEnd> strncmp ( & <S2SV_ModStart> 1 ], "PLATFORM}", 8 ) == 0 && ( len = 9 )!= 0 ) ) && ( name [ len ] == '\\0' || name [ len ] == '//' || ( is_path && name [ len ] == ':' ) ) ) || ( name [ 1 ] == '{' && ( ( strncmp ( & name [ 2 ], "ORIGIN}", 7 ) == 0 && <S2SV_ModEnd> (! __libc_enable_secure <S2SV_ModStart> (! __libc_enable_secure || ( ( name [ 9 ] == '\\0' || ( is_path && name [ 9 ] == ':' ) ) && ( name == start || ( is_path && name [
Buggy code:
 static int rd_pick_intra4x4block ( MACROBLOCK * x, BLOCK * be, BLOCKD * b, B_PREDICTION_MODE * best_mode, const int * bmode_costs, ENTROPY_CONTEXT * a, ENTROPY_CONTEXT * l, int * bestrate, int * bestratey, int * bestdistortion ) { B_PREDICTION_MODE mode ; int best_rd = INT_MAX ; int rate = 0 ; int distortion ; ENTROPY_CONTEXT ta = * a, tempa = * a ; ENTROPY_CONTEXT tl = * l, templ = * l ; <START_BUG> DECLARE_ALIGNED_ARRAY ( 16, unsigned char, best_predictor, 16 * 4 ) ; <END_BUG>  DECLARE_ALIGNED_ARRAY ( 16, short, best_dqcoeff, 16 ) ; <START_BUG> int dst_stride = x -> e_mbd. dst. y_stride ; unsigned char * dst = x -> e_mbd. dst. y_buffer + b -> offset ; unsigned char * Above = dst - dst_stride ; unsigned char * yleft = dst - 1 ; unsigned char top_left = Above [ - 1 ] ; for ( mode = B_DC_PRED ; mode <= B_HU_PRED ; mode ++ ) { int this_rd ; int ratey ; rate = bmode_costs [ mode ] ; vp8_intra4x4_predict ( Above, yleft, dst_stride, mode, b -> predictor, 16, top_left ) ; vp8_subtract_b ( be, b, 16 ) ; x -> short_fdct4x4 ( be -> src_diff, be -> coeff, 32 ) ; x -> quantize_b ( be, b ) ; tempa = ta ; templ = tl ; ratey = cost_coeffs ( x, b, PLANE_TYPE_Y_WITH_DC, & tempa, & templ ) ; rate += ratey ; distortion = vp8_block_error ( be -> coeff, b -> dqcoeff ) >> 2 ; this_rd = RDCOST ( x -> rdmult, x -> rddiv, rate, distortion ) ; if ( this_rd < best_rd ) { * bestr<END_BUG>

Fix:
<S2SV_ModStart> * l ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> char, best_predictor [ <S2SV_ModEnd> 16 * 4 <S2SV_ModStart> 16 * 4 ] ) ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> short, best_dqcoeff [ 16 ] <S2SV_ModEnd> ) ; int <S2SV_ModStart> predictor ) ; memcpy <S2SV_ModEnd> ( best_dqcoeff,
Buggy code:
 interval * PGTYPESinterval_from_asc ( char * str, char * * endptr ) { interval * result = NULL ; fsec_t fsec ; struct tm tt, * tm = & tt ; int dtype ; int nf ; char * field [ MAXDATEFIELDS ] ; int ftype [ MAXDATEFIELDS ] ; char lowstr [ MAXDATELEN + MAXDATEFIELDS ] ; char * realptr ; char * * ptr = ( endptr!= NULL )? endptr : & realptr ; tm -> tm_year = 0 ; tm -> tm_mon = 0 ; tm -> tm_mday = 0 ; tm -> tm_hour = 0 ; tm -> tm_min = 0 ; tm -> tm_sec = 0 ; fsec = 0 ; <START_BUG> if ( strlen ( str ) >= sizeof ( lowstr ) ) <END_BUG> { errno = PGTYPES_INTVL_BAD_INTERVAL ;  return NULL ; <START_BUG> } if ( ParseDateTime ( str, lowstr, field, ftype, & nf, ptr )!= 0 || ( DecodeInterval ( field, ftype, nf, & dtype, tm, & fsec )!= 0 && DecodeISO8601Interval ( str, & dtype, tm, & fsec )!= 0 ) ) { errno = PGTYPES_INTVL_BAD_INTERVAL ; <END_BUG> return NULL ;  } result = ( interval * ) pgtypes_alloc ( sizeof ( interval ) ) ; if (! result ) return NULL ; if ( dtype!= DTK_DELTA ) { errno = PGTYPES_INTVL_BAD_INTERVAL ; free ( result ) ; return NULL ; } <START_BUG> if ( tm2interval ( tm, fsec, result )!= 0 ) <END_BUG> { errno = PGTYPES_INTVL_BAD_INTERVAL ; free ( result ) ; return NULL ; } errno = 0 ; return result ; }

Fix:
<S2SV_ModStart> ( str ) > MAXDATELEN ) { errno = PGTYPES_INTVL_BAD_INTERVAL ; return NULL ; } if ( ParseDateTime ( str, lowstr, field, ftype, & nf, ptr )!= 0 || ( DecodeInterval ( field, ftype, nf, & dtype, tm, & fsec )!= 0 && DecodeISO8601Interval ( str, & dtype, tm, & fsec )!= 0 ) ) { errno = PGTYPES_INTVL_BAD_INTERVAL ; return NULL ; } result = ( interval * ) pgtypes_alloc ( sizeof ( interval ) ) ; if (! result ) return NULL ; if ( dtype!= DTK_DELTA <S2SV_ModEnd> ) { errno <S2SV_ModStart> = PGTYPES_INTVL_BAD_INTERVAL ; free ( result ) ; return NULL ; } if ( tm2interval ( tm, fsec, result )!= 0 <S2SV_ModEnd> ) { errno <S2SV_ModStart> = PGTYPES_INTVL_BAD_INTERVAL ; <S2SV_ModEnd> free ( result <S2SV_ModStart> NULL ; } <S2SV_ModEnd> errno = 0
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8_get_last_ref_updates ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctrl_id, va_list args ) { int * update_info = va_arg ( args, int * ) ; if ( update_info &&! ctx -> yv12_frame_buffers. use_frame_threads ) { VP8D_COMP * pbi = ( VP8D_COMP * ) ctx -> yv12_frame_buffers. pbi [ 0 ] ; * update_info = pbi -> common. refresh_alt_ref_frame * ( int ) VP8_ALTR_FRAME + pbi -> common. refresh_golden_frame * ( int ) VP8_GOLD_FRAME + pbi -> common. refresh_last_frame * ( int ) VP8_LAST_FRAME ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 date PGTYPESdate_from_asc ( char * str, char * * endptr ) { date dDate ; fsec_t fsec ; struct tm tt, * tm = & tt ; int dtype ; int nf ; char * field [ MAXDATEFIELDS ] ; int ftype [ MAXDATEFIELDS ] ; <START_BUG> char lowstr [ MAXDATELEN + 1 ] ; <END_BUG> char * realptr ; char * * ptr = ( endptr!= NULL )? endptr : & realptr ; bool EuroDates = FALSE ; errno = 0 ;  if ( strlen ( str ) >= sizeof ( lowstr ) ) <START_BUG> { errno = PGTYPES_DATE_BAD_DATE ; return INT_MIN ; } if ( ParseDateTime ( str, lowstr, field, ftype, & nf, ptr )!= 0 || DecodeDateTime ( field, ftype, nf, & dtype, tm, & fsec, EuroDates )!= 0 ) { errno = PGTYPES_DATE_BAD_DATE ; return INT_MIN ; } switch ( dtype ) { case DTK_DATE : break ; case DTK_EPOCH : if ( GetEpochTime ( tm ) < 0 ) { errno = PGTYPES_DATE_BAD_DATE ; return INT_MIN ; } break ; default : errno = PGTYPES_DATE_BAD_DATE ; return INT_MIN ; } dDate = ( date2j ( tm -> tm_year, tm -> tm_mon, tm -> tm_mday ) - date2j ( 2000, 1, 1 ) ) ; return dDate ; }<END_BUG>

Fix:
<S2SV_ModStart> [ MAXDATELEN + MAXDATEFIELDS <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( str ) > MAXDATELEN <S2SV_ModEnd> ) { errno
Buggy code:
 static ssize_t environ_read ( struct file * file, char __user * buf, size_t count, loff_t * ppos ) { char * page ; unsigned long src = * ppos ; int ret = 0 ; struct mm_struct * mm = file -> private_data ; unsigned long env_start, env_end ; <START_BUG> if (! mm ) <END_BUG> return 0 ; page = ( char * ) __get_free_page ( GFP_TEMPORARY ) ; if (! page ) return - ENOMEM ; ret = 0 ; if (! atomic_inc_not_zero ( & mm -> mm_users ) ) goto free ; down_read ( & mm -> mmap_sem ) ; env_start = mm -> env_start ; env_end = mm -> env_end ; up_read ( & mm -> mmap_sem ) ; while ( count > 0 ) { size_t this_len, max_len ; int retval ; if ( src >= ( env_end - env_start ) ) break ; this_len = env_end - ( env_start + src ) ; max_len = min_t ( size_t, PAGE_SIZE, count ) ; this_len = min ( max_len, this_len ) ; retval = access_remote_vm ( mm, ( env_start + src ), page, this_len, 0 ) ; if ( retval <= 0 ) { ret = retval ; break ; } if ( copy_to_user ( buf, page, retval ) ) { ret = - EFAULT ; break ; } ret += retval ; src += retval ; buf += retval ; count -= retval ; } * ppos = src ; mmput ( mm ) ; free : free_page ( ( unsigned long ) page ) ; return ret ; }

Fix:
<S2SV_ModStart> (! mm ||! mm -> env_end
Buggy code:
 static int _FVMenuClose ( FontView * fv ) { int i ; SplineFont * sf = fv -> b. cidmaster? fv -> b. cidmaster : fv -> b. sf ; if (! SFCloseAllInstrs ( fv -> b. sf ) ) return ( false ) ; <START_BUG> if ( fv -> b. nextsame!= NULL || fv -> b. sf -> fv!= & fv -> b ) { <END_BUG> } else if ( SFAnyChanged ( sf ) ) { i = AskChanged ( fv -> b. sf ) ; if ( i == 2 ) return ( false ) ; if ( i == 0 &&! _FVMenuSave ( fv ) ) return ( false ) ; else SFClearAutoSave ( sf ) ; } _FVCloseWindows ( fv ) ; if ( sf -> filename!= NULL ) RecentFilesRemember ( sf -> filename ) ; else if ( sf -> origname!= NULL ) RecentFilesRemember ( sf -> origname ) ; GDrawDestroyWindow ( fv -> gw ) ; return ( true ) ; }

Fix:
<S2SV_ModStart> b ) { } else if ( warn_script_unsaved && fv -> script_unsaved && AskScriptChanged ( ) == 2 ) { return false ;
Buggy code:
 <START_BUG> void imap_quote_string ( char * dest, size_t dlen, const char * src ) <END_BUG> { static const char quote [ ] = "\\"\\\\" ; char * pt = dest ; const char * s = src ; * pt ++ = \'"\' ; dlen -= 2 ; for ( ; * s && dlen ; s ++ ) { if ( strchr ( quote, * s ) ) { dlen -= 2 ; if ( dlen == 0 ) break ; * pt ++ = '\\\\' ; * pt ++ = * s ; } else { * pt ++ = * s ; dlen -- ; } } * pt ++ = \'"\' ; * pt = '\\0' ; }

Fix:
<S2SV_ModStart> char * src, bool quote_backtick ) { const char * quote = "`\\"\\\\" ; if (! quote_backtick ) quote ++ <S2SV_ModEnd> ; char *
Buggy code:
 static int try_smi_init ( struct smi_info * new_smi ) { int rv = 0 ; int i ; char * init_name = NULL ; pr_info ( "Trying   %s-specified   %s   state   machine   at   %s   address   0x%lx,   slave   address   0x%x,   irq   %d\\n", ipmi_addr_src_to_str ( new_smi -> io. addr_source ), si_to_str [ new_smi -> io. si_type ], addr_space_to_str [ new_smi -> io. addr_type ], new_smi -> io. addr_data, new_smi -> io. slave_addr, new_smi -> io. irq ) ; switch ( new_smi -> io. si_type ) { case SI_KCS : new_smi -> handlers = & kcs_smi_handlers ; break ; case SI_SMIC : new_smi -> handlers = & smic_smi_handlers ; break ; case SI_BT : new_smi -> handlers = & bt_smi_handlers ; break ; default : rv = - EIO ; goto out_err ; } new_smi -> si_num = smi_num ; if (! new_smi -> io. dev ) { init_name = kasprintf ( GFP_KERNEL, "ipmi_si.%d", new_smi -> si_num ) ; new_smi -> pdev = platform_device_alloc ( "ipmi_si", new_smi -> si_num ) ; if (! new_smi -> pdev ) { pr_err ( "Unable   to   allocate   platform   device\\n" ) ; rv = - ENOMEM ; goto out_err ; } new_smi -> io. dev = & new_smi -> pdev -> dev ; new_smi -> io. dev -> driver = & ipmi_platform_driver. driver ; new_smi -> io. dev -> init_name = init_name ; } new_smi -> si_sm = kmalloc ( new_smi -> handlers -> size ( ), GFP_KERNEL

Fix:
<S2SV_ModStart> ; out_err : if ( rv && new_smi -> io. io_cleanup ) { new_smi -> io. io_cleanup ( & new_smi -> io ) ; new_smi -> io. io_cleanup = NULL ; }
Buggy code:
 xmlChar * xmlStringLenDecodeEntities ( xmlParserCtxtPtr ctxt, const xmlChar * str, int len, int what, xmlChar end, xmlChar end2, xmlChar end3 ) { xmlChar * buffer = NULL ; int buffer_size = 0 ; xmlChar * current = NULL ; xmlChar * rep = NULL ; const xmlChar * last ; xmlEntityPtr ent ; int c, l ; int nbchars = 0 ; if ( ( ctxt == NULL ) || ( str == NULL ) || ( len < 0 ) ) return ( NULL ) ; last = str + len ; if ( ( ( ctxt -> depth > 40 ) && ( ( ctxt -> options & XML_PARSE_HUGE ) == 0 ) ) || ( ctxt -> depth > 1024 ) ) { xmlFatalErr ( ctxt, XML_ERR_ENTITY_LOOP, NULL ) ; return ( NULL ) ; } buffer_size = XML_PARSER_BIG_BUFFER_SIZE ; buffer = ( xmlChar * ) xmlMallocAtomic ( buffer_size * sizeof ( xmlChar ) ) ; if ( buffer == NULL ) goto mem_error ; if ( str < last ) c = CUR_SCHAR ( str, l ) ; else c = 0 ; while ( ( c!= 0 ) && ( c!= end ) && ( c!= end2 ) && ( c!= end3 ) ) { if ( c == 0 ) break ; if ( ( c == '&' ) && ( str [ 1 ] == '#' ) ) { int val = xmlParseStringCharRef ( ctxt, & str ) ; if ( val!= 0 ) { COPY_BUF ( 0, buffer, nbchars, val ) ; } if ( nbchars > buffer_size - XML_PARSER_BUFFER_SIZE ) { growBuffer ( buffer, XML_PARSER_BUFFER_SIZE ) ; } } else if ( ( c == '&' ) && ( what & XML_SUBSTITUTE_REF ) ) { if ( xmlParserDebugEntities ) xmlGenericError ( xmlGenericErrorContext, "String   decoding   Entity   Reference:   %.30s\\n", str ) ; ent = xmlParseStringEntityRef ( ctxt, & str ) ; if ( ( ctxt -> lastError. code == XML_ERR_ENTITY_LOOP ) || ( ctxt -> lastError. code == XML_ERR_INTERNAL_ERROR ) ) goto int_error ; if ( ent!= NULL ) ctxt -> nb

Fix:
<S2SV_ModStart> ( buffer, i +
Buggy code:
 static int dwa_uncompress ( EXRContext * s, const uint8_t * src, int compressed_size, int uncompressed_size, EXRThreadData * td ) { int64_t version, lo_usize, lo_size ; int64_t ac_size, dc_size, rle_usize, rle_csize, rle_raw_size ; int64_t ac_count, dc_count, ac_compression ; const int dc_w = td -> xsize >> 3 ; const int dc_h = td -> ysize >> 3 ; GetByteContext gb, agb ; int skip, ret ; if ( compressed_size <= 88 ) return AVERROR_INVALIDDATA ; version = AV_RL64 ( src + 0 ) ; if ( version!= 2 ) return AVERROR_INVALIDDATA ; lo_usize = AV_RL64 ( src + 8 ) ; lo_size = AV_RL64 ( src + 16 ) ; ac_size = AV_RL64 ( src + 24 ) ; dc_size = AV_RL64 ( src + 32 ) ; rle_csize = AV_RL64 ( src + 40 ) ; rle_usize = AV_RL64 ( src + 48 ) ; rle_raw_size = AV_RL64 ( src + 56 ) ; ac_count = AV_RL64 ( src + 64 ) ; dc_count = AV_RL64 ( src + 72 ) ; ac_compression = AV_RL64 ( src + 80 ) ; if ( compressed_size < 88LL + lo_size + ac_size + dc_size + rle_csize ) return AVERROR_INVALIDDATA ; bytestream2_init ( & gb, src + 88, compressed_size - 88 ) ; skip = bytestream2_get_le16 ( & gb ) ; if ( skip < 2 ) return AVERROR_INVALIDDATA ; bytestream2_skip ( & gb, skip - 2 ) ; if ( lo_size > 0 ) { if ( lo_usize > uncompressed_size ) return AVERROR_INVALIDDATA ; bytestream2_skip ( & gb, lo_size ) ; } if ( ac_size > 0 ) { unsigned long dest_len = ac_count

Fix:
<S2SV_ModStart> ) ; } <S2SV_ModEnd> { unsigned long <S2SV_ModStart> if ( dc_count!= dc_w * dc_h * 3 <S2SV_ModEnd> ) return AVERROR_INVALIDDATA
Buggy code:
 static void destroy_super ( struct super_block * s ) { int i ; list_lru_destroy ( & s -> s_dentry_lru ) ; list_lru_destroy ( & s -> s_inode_lru ) ; <START_BUG> # ifdef CONFIG_SMP <END_BUG> free_percpu ( s -> s_files ) ; # endif for ( i = 0 ; i < SB_FREEZE_LEVELS ; i ++ ) percpu_counter_destroy ( & s -> s_writers. counter [ i ] ) ; security_sb_free ( s ) ; WARN_ON (! list_empty ( & s -> s_mounts ) ) ; kfree ( s -> s_subtype ) ; kfree ( s -> s_options ) ; kfree_rcu ( s, rcu ) ; }

Fix:
<S2SV_ModStart> s_inode_lru ) ; <S2SV_ModEnd> for ( i
Buggy code:
 int options_parse ( CONF_TYPE type ) { SERVICE_OPTIONS * section ; options_defaults ( ) ; section = & new_service_options ; <START_BUG> if ( options_file ( configuration_file, type, & section ) ) <END_BUG> return 1 ;  if ( init_section ( 1, & section ) ) <START_BUG> <END_BUG> return 1 ;  s_log ( LOG_NOTICE, "Configuration   successful" ) ; return 0 ; }

Fix:
<S2SV_ModStart> & section ) || <S2SV_ModEnd> init_section ( 1 <S2SV_ModStart> section ) ) { s_log ( LOG_ERR, "Configuration <S2SV_blank> failed" ) ; options_free ( 0 ) ; <S2SV_ModStart> return 1 ; }
Buggy code:
 static int mark_source_chains ( const struct xt_table_info * newinfo, unsigned int valid_hooks, void * entry0 ) { unsigned int hook ; for ( hook = 0 ; hook < NF_INET_NUMHOOKS ; hook ++ ) { unsigned int pos = newinfo -> hook_entry [ hook ] ; struct ip6t_entry * e = ( struct ip6t_entry * ) ( entry0 + pos ) ; if (! ( valid_hooks & ( 1 << hook ) ) ) continue ; e -> counters. pcnt = pos ; for ( ; ; ) { const struct xt_standard_target * t = ( void * ) ip6t_get_target_c ( e ) ; int visited = e -> comefrom & ( 1 << hook ) ; if ( e -> comefrom & ( 1 << NF_INET_NUMHOOKS ) ) { pr_err ( "iptables:   loop   hook   %u   pos   %u   %08X.\\n", hook, pos, e -> comefrom ) ; return 0 ; } e -> comefrom |= ( ( 1 << hook ) | ( 1 << NF_INET_NUMHOOKS ) ) ; <START_BUG> if ( ( e -> target_offset == sizeof ( struct ip6t_entry ) && <END_BUG> ( strcmp ( t -> target. u. user. name, XT_STANDARD_TARGET ) == 0 ) &&  t -> verdict < 0 && <START_BUG> unconditional ( & e -> ipv6 ) ) || visited ) { unsigned int oldpos, size ; if ( ( strcmp ( t -> target. u. user. name, XT_STANDARD_TARGET ) == 0 ) && t -> verdict < - NF_MAX_VERDICT - 1 ) { duprintf ( "mark_source_chains:   bad   " "negative   verdict   (%i)\\n", t -> verdict ) ; return 0 ; } do { e -> comefrom ^= ( 1 << NF_INET_NUMHOOKS ) ; # ifdef DEBUG_IP_FIREWALL_USER if ( e -> comefrom & ( 1 << NF_INET_NUMHOOKS ) ) { duprintf ( "Back   unset   " "on   hook   %u   " "rule   %u\\n", hook, pos<END_BUG>

Fix:
<S2SV_ModStart> if ( ( unconditional ( e <S2SV_ModEnd> ) && ( <S2SV_ModStart> verdict < 0 <S2SV_ModEnd> ) || visited
Buggy code:
 int ssl3_accept ( SSL * s ) { BUF_MEM * buf ; unsigned long alg_k, Time = ( unsigned long ) time ( NULL ) ; void ( * cb ) ( const SSL * ssl, int type, int val ) = NULL ; int ret = - 1 ; int new_state, state, skip = 0 ; RAND_add ( & Time, sizeof ( Time ), 0 ) ; ERR_clear_error ( ) ; clear_sys_error ( ) ; if ( s -> info_callback!= NULL ) cb = s -> info_callback ; else if ( s -> ctx -> info_callback!= NULL ) cb = s -> ctx -> info_callback ; s -> in_handshake ++ ; if (! SSL_in_init ( s ) || SSL_in_before ( s ) ) SSL_clear ( s ) ; if ( s -> cert == NULL ) { SSLerr ( SSL_F_SSL3_ACCEPT, SSL_R_NO_CERTIFICATE_SET ) ; return ( - 1 ) ; } # ifndef OPENSSL_NO_HEARTBEATS if ( s -> tlsext_hb_pending ) { s -> tlsext_hb_pending = 0 ; s -> tlsext_hb_seq ++ ; } # endif for ( ; ; ) { state = s -> state ; switch ( s -> state ) { case SSL_ST_RENEGOTIATE : s -> renegotiate = 1 ; case SSL_ST_BEFORE : case SSL_ST_ACCEPT : case SSL_ST_BEFORE | SSL_ST_ACCEPT : case SSL_ST_OK | SSL_ST_ACCEPT : s -> server = 1 ; if ( cb!= NULL ) cb ( s, SSL_CB_HANDSHAKE_START, 1 ) ; if ( ( s -> version >> 8 )!= 3 ) { SSLerr ( SSL_F_SSL3_ACCEPT, ERR_R_INTERNAL_ERROR ) ; return - 1 ; } if (! ssl_security ( s, SSL_SECOP_VERSION, 0, s -> version, NULL ) ) { SSLerr ( SSL_F_SSL3_ACCEPT, SSL_R_VERSION_TOO_LOW ) ; return - 1 ; } s -> type = SSL_ST_ACCEPT ; if ( s -> init_buf == NULL ) { if ( ( buf = BU

Fix:
<S2SV_ModStart> -> algorithm_mkey ; <S2SV_ModEnd> s -> s3 <S2SV_ModStart>. use_rsa_tmp = 0 ; if ( <S2SV_ModEnd> # ifndef OPENSSL_NO_PSK
Buggy code:
 int scsi_cmd_blk_ioctl ( struct block_device * bd, fmode_t mode, unsigned int cmd, void __user * arg ) { <START_BUG> return scsi_cmd_ioctl ( bd -> bd_disk -> queue, bd -> bd_disk, mode, cmd, arg ) ; <END_BUG> }

Fix:
<S2SV_ModStart> arg ) { int ret ; ret = scsi_verify_blk_ioctl ( bd, cmd ) ; if ( ret < 0 ) return ret ;
Buggy code:
 static long __tun_chr_ioctl ( struct file * file, unsigned int cmd, unsigned long arg, int ifreq_len ) { struct tun_file * tfile = file -> private_data ; struct tun_struct * tun ; void __user * argp = ( void __user * ) arg ; struct sock_fprog fprog ; struct ifreq ifr ; int sndbuf ; int vnet_hdr_sz ; int ret ; <START_BUG> if ( cmd == TUNSETIFF || _IOC_TYPE ( cmd ) == 0x89 ) <END_BUG> if ( copy_from_user ( & ifr, argp, ifreq_len ) )  return - EFAULT ; <START_BUG> if ( cmd == TUNGETFEATURES ) { return put_user ( IFF_TUN | IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE | IFF_VNET_HDR, ( unsigned int __user * ) argp ) ; } rtnl_lock ( ) ; tun = __tun_get ( tfile ) ; if ( cmd == TUNSETIFF &&! tun ) { ifr. ifr_name [ IFNAMSIZ - 1 ] = '\\0' ; ret = tun_set_iff ( tfile -> net, file, & ifr ) ; if ( ret ) goto unlock ; if ( copy_to_user ( argp, & ifr, ifreq_len ) ) ret = - EFAULT ; goto unlock ; } ret = - EBADFD ; if (! tun ) goto unlock ; tun_debug ( KERN_INFO, tun, "tun_chr_ioctl   cmd   %d\\n", cmd ) ; ret = 0 ; switch ( cmd ) { case TUNGETIFF : ret = tun_get_iff ( current -> nsproxy -> net_ns, tun, & ifr ) ; if ( ret ) break ; if ( copy_to_user ( argp, & ifr, ifreq_len ) ) ret = - EFAULT ; break ; case TUNSETNOCSUM : tun_debug ( KERN_INFO, tun, "ignored:   set   checksum   %s\\n", arg? "disabled" : "enabled" ) ; break ; case T<END_BUG>

Fix:
<S2SV_ModStart> == 0x89 ) { <S2SV_ModStart> return - EFAULT ; } else memset ( & ifr, 0, sizeof ( ifr ) )
Buggy code:
 static int em_grp45 ( struct x86_emulate_ctxt * ctxt ) { int rc = X86EMUL_CONTINUE ; switch ( ctxt -> modrm_reg ) { case 2 : { long int old_eip ; old_eip = ctxt -> _eip ; <START_BUG> ctxt -> _eip = ctxt -> src. val ; <END_BUG> ctxt -> src. val = old_eip ; rc = em_push ( ctxt ) ; break ; } case 4 :  ctxt -> _eip = ctxt -> src. val ; <START_BUG> break ; case 5 : rc = em_jmp_far ( ctxt ) ; break ; case 6 : rc = em_push ( ctxt ) ; break ; } return rc ; }<END_BUG>

Fix:
<S2SV_ModStart> -> _eip ; rc = assign_eip_near ( ctxt, <S2SV_ModEnd> ctxt -> src <S2SV_ModStart> src. val ) ; if ( rc!= X86EMUL_CONTINUE ) break <S2SV_ModStart> case 4 : rc = assign_eip_near ( ctxt, <S2SV_ModEnd> ctxt -> src <S2SV_ModStart> src. val )
Buggy code:
 void read_boot ( DOS_FS * fs ) { struct boot_sector b ; unsigned total_sectors ; unsigned short logical_sector_size, sectors ; <START_BUG> unsigned fat_length ; <END_BUG> unsigned total_fat_entries ; off_t data_size ; fs_read ( 0, sizeof ( b ), & b ) ; logical_sector_size = GET_UNALIGNED_W ( b. sector_size ) ; if (! logical_sector_size ) die ( "Logical   sector   size   is   zero." ) ; if ( logical_sector_size & ( SECTOR_SIZE - 1 ) ) die ( "Logical   sector   size   (%d   bytes)   is   not   a   multiple   of   the   physical   " "sector   size.", logical_sector_size ) ; fs -> cluster_size = b. cluster_size * logical_sector_size ; if (! fs -> cluster_size ) die ( "Cluster   size   is   zero." ) ; if ( b. fats!= 2 && b. fats!= 1 ) die ( "Currently,   only   1   or   2   FATs   are   supported,   not   %d.\\n", b. fats ) ; fs -> nfats = b. fats ; sectors = GET_UNALIGNED_W ( b. sectors ) ; total_sectors = sectors? sectors : le32toh ( b. total_sect ) ; if ( verbose ) printf ( "Checking   we   can   access   the   last   sector   of   the   filesystem\\n" ) ; fs_test ( ( off_t ) ( ( total_sectors & ~ 1 ) - 1 ) * logical_sector_size, logical_sector_size ) ; fat_length = le16toh ( b. fat_length )? le16toh ( b. fat_length ) : le32toh ( b. fat32_length ) ;  fs -> fat_start = ( off_t ) le16toh ( b. reserved ) * logical_sector_size ; <START_BUG> fs -> root_start = ( ( off_t ) le16toh ( b. reserved ) + b. fats<END_BUG>

Fix:
<S2SV_ModStart>, sectors ; off_t <S2SV_ModEnd> fat_length ; unsigned <S2SV_ModStart> fat32_length ) ; if (! fat_length ) die ( "FAT <S2SV_blank> size <S2SV_blank> is <S2SV_blank> zero." ) ; <S2SV_ModStart> fs -> data_start ; if ( data_size < fs -> cluster_size ) die ( "Filesystem <S2SV_blank> has <S2SV_blank> no <S2SV_blank> space <S2SV_blank> for <S2SV_blank> any <S2SV_blank> data <S2SV_blank> clusters" )
Buggy code:
 int ff_mov_write_packet ( AVFormatContext * s, AVPacket * pkt ) { MOVMuxContext * mov = s -> priv_data ; AVIOContext * pb = s -> pb ; MOVTrack * trk = & mov -> tracks [ pkt -> stream_index ] ; AVCodecParameters * par = trk -> par ; unsigned int samples_in_chunk = 0 ; int size = pkt -> size, ret = 0 ; uint8_t * reformatted_data = NULL ; ret = check_pkt ( s, pkt ) ; if ( ret < 0 ) return ret ; if ( mov -> flags & FF_MOV_FLAG_FRAGMENT ) { int ret ; if ( mov -> moov_written || mov -> flags & FF_MOV_FLAG_EMPTY_MOOV ) { if ( mov -> frag_interleave && mov -> fragments > 0 ) { if ( trk -> entry - trk -> entries_flushed >= mov -> frag_interleave ) { if ( ( ret = mov_flush_fragment_interleaving ( s, trk ) ) < 0 ) return ret ; } } if (! trk -> mdat_buf ) { if ( ( ret = avio_open_dyn_buf ( & trk -> mdat_buf ) ) < 0 ) return ret ; } pb = trk -> mdat_buf ; } else { if (! mov -> mdat_buf ) { if ( ( ret = avio_open_dyn_buf ( & mov -> mdat_buf ) ) < 0 ) return ret ; } pb = mov -> mdat_buf ; } } if ( par -> codec_id == AV_CODEC_ID_AMR_NB ) { static const uint16_t packed_size [ 16 ] = { 13, 14, 16, 18, 20, 21, 27, 32, 6, 0, 0, 0, 0, 0, 0, 1 } ; int len = 0 ; while ( len < size && samples_in_chunk < 100 ) { len += packed_size [ ( pkt -> data [ len ] >> 3 ) & 0x0F ] ; samples_in_chunk ++ ; } if ( samples_in_chunk > 1 ) { av_log ( s, AV_LOG_ERROR, "fatal   error,   input  

Fix:
<S2SV_ModStart> ; if ( samples_in_chunk < 1 ) { av_log ( s, AV_LOG_ERROR, "fatal <S2SV_blank> error, <S2SV_blank> input <S2SV_blank> packet <S2SV_blank> contains <S2SV_blank> no <S2SV_blank> samples\\n" ) ; return AVERROR_PATCHWELCOME ; } if (
Buggy code:
 <START_BUG> void f2fs_wait_discard_bios ( struct f2fs_sb_info * sbi ) <END_BUG> { __issue_discard_cmd ( sbi, false ) ; __drop_discard_cmd ( sbi ) ;  __wait_discard_cmd ( sbi, false ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> f2fs_sb_info * sbi, bool umount <S2SV_ModStart> ( sbi,! umount <S2SV_ModEnd> ) ; }
Buggy code:
 static int PredictorEncodeRow ( TIFF * tif, uint8 * bp, tmsize_t cc, uint16 s ) { TIFFPredictorState * sp = PredictorState ( tif ) ; assert ( sp!= NULL ) ; assert ( sp -> encodepfunc!= NULL ) ; assert ( sp -> encoderow!= NULL ) ; <START_BUG> ( * sp -> encodepfunc ) ( tif, bp, cc ) ; <END_BUG> return ( * sp -> encoderow ) ( tif, bp, cc, s ) ; }

Fix:
<S2SV_ModStart> NULL ) ; if (! <S2SV_ModStart>, cc ) ) return 0
Buggy code:
 void disable_priv_mode ( ) { int e ; <START_BUG> if ( setuid ( current_user. uid ) < 0 ) <END_BUG> { e = errno ; sys_error ( _ ( "cannot   set   uid   to   %d:   effective   uid   %d" ), current_user. uid, current_user. euid ) ; # if defined ( EXIT_ON_SETUID_FAILURE ) if ( e == EAGAIN ) exit ( e ) ; # endif }  if ( setgid ( current_user. gid ) < 0 ) <START_BUG> sys_error ( _ ( "cannot   set   gid   to   %d:   effective   gid   %d" ), current_user. gid, current_user. egid ) ; current_user. euid = current_user. uid ; current_user. egid = current_user. gid ; }<END_BUG>

Fix:
<S2SV_ModStart> int e ; # if HAVE_DECL_SETRESUID if ( setresuid ( current_user. uid, current_user. uid, current_user. uid ) < 0 ) # else <S2SV_ModStart> < 0 ) # endif <S2SV_ModStart> # endif } # if HAVE_DECL_SETRESGID if ( setresgid ( current_user. gid, current_user. gid, current_user. gid ) < 0 ) # else <S2SV_ModStart> < 0 ) # endif
Buggy code:
 int ip6_find_1stfragopt ( struct sk_buff * skb, u8 * * nexthdr ) { <START_BUG> u16 offset = sizeof ( struct ipv6hdr ) ; <END_BUG> unsigned int packet_len = skb_tail_pointer ( skb ) - skb_network_header ( skb ) ; int found_rhdr = 0 ; * nexthdr = & ipv6_hdr ( skb ) -> nexthdr ; while ( offset <= packet_len ) { struct ipv6_opt_hdr * exthdr ;  switch ( * * nexthdr ) { <START_BUG> case NEXTHDR_HOP : break ; case NEXTHDR_ROUTING : found_rhdr = 1 ; break ; case NEXTHDR_DEST : # if IS_ENABLED ( CONFIG_IPV6_MIP6 ) if ( ipv6_find_tlv ( skb, offset, IPV6_TLV_HAO ) >= 0 ) break ; # endif if ( found_rhdr ) return offset ; break ; default : return offset ; } if ( offset + sizeof ( struct ipv6_opt_hdr ) > packet_len ) return - EINVAL ; exthdr = ( struct ipv6_opt_hdr * ) ( skb_network_header ( skb ) + offset ) ; <END_BUG> offset += ipv6_optlen ( exthdr ) ;  * nexthdr = & exthdr -> nexthdr ; } return - EINVAL ; }

Fix:
<S2SV_ModStart> nexthdr ) { unsigned int <S2SV_ModEnd> offset = sizeof <S2SV_ModStart> * exthdr ; unsigned int len ; <S2SV_ModStart> offset ) ; len = ipv6_optlen ( exthdr ) ; if ( len + offset >= IPV6_MAXPLEN ) return - EINVAL ; offset += len <S2SV_ModEnd> ; * nexthdr
Buggy code:
 void vpx_svc_release ( SvcContext * svc_ctx ) { <START_BUG> SvcInternal * si ; <END_BUG> if ( svc_ctx == NULL ) return ;  si = ( SvcInternal * ) svc_ctx -> internal ; <START_BUG> if ( si!= NULL ) { <END_BUG> free ( si -> buffer ) ;  if ( si -> rc_stats_buf ) { free ( si -> rc_stats_buf ) ; } free ( si ) ; svc_ctx -> internal = NULL ; } }

Fix:
<S2SV_ModStart> svc_ctx ) { SvcInternal_t <S2SV_ModEnd> * si ; <S2SV_ModStart> si = ( SvcInternal_t <S2SV_ModEnd> * ) svc_ctx <S2SV_ModStart> free ( si <S2SV_ModEnd> ) ; svc_ctx
Buggy code:
 void vp9_setup_past_independence ( VP9_COMMON * cm ) { struct loopfilter * const lf = & cm -> lf ; int i ; vp9_clearall_segfeatures ( & cm -> seg ) ; cm -> seg. abs_delta = SEGMENT_DELTADATA ; <START_BUG> if ( cm -> last_frame_seg_map ) <END_BUG>  vpx_memset ( cm -> last_frame_seg_map, 0, ( cm -> mi_rows * cm -> mi_cols ) ) ; <START_BUG> vp9_zero ( lf -> last_ref_deltas ) ; vp9_zero ( lf -> last_mode_deltas ) ; set_default_lf_deltas ( lf ) ; lf -> last_sharpness_level = - 1 ; vp9_default_coef_probs ( cm ) ; <END_BUG> vp9_init_mode_probs ( & cm -> fc ) ;  <START_BUG> vp9_init_mv_probs ( cm ) ; <END_BUG> if ( cm -> frame_type == KEY_FRAME || cm -> error_resilient_mode || cm -> reset_frame_context == 3 ) { for ( i = 0 ; i < FRAME_CONTEXTS ; ++ i )  cm -> frame_contexts [ i ] = cm -> fc ; <START_BUG> } else if ( cm -> reset_frame_context == 2 ) { <END_BUG> cm -> frame_contexts [ cm -> frame_context_idx ] = cm -> fc ;  } <START_BUG> if ( frame_is_intra_only ( cm ) ) <END_BUG>  vpx_memset ( cm -> prev_mip, 0, cm -> mi_stride * ( cm -> mi_rows + 1 ) * <START_BUG> <END_BUG> sizeof ( * cm -> prev_mip ) ) ;  vpx_memset ( cm -> mip, 0, cm -> mi_stride * ( cm -> mi_rows + 1 ) * sizeof ( * cm -> mip ) ) ; vp9_zero ( cm -> ref_frame_sign_bias ) ; cm -> frame_context_idx = 0 ; }

Fix:
<S2SV_ModStart> cm -> last_frame_seg_map &&! cm -> frame_parallel_decode ) memset <S2SV_ModEnd> ( cm -> <S2SV_ModStart> cm -> last_frame_seg_map, 0, ( cm -> mi_rows * cm -> mi_cols ) ) ; if ( cm -> current_frame_seg_map ) memset ( cm -> current_frame_seg_map <S2SV_ModStart> cm ) ; init_mode_probs ( <S2SV_ModEnd> cm -> fc <S2SV_ModStart> ( cm ) ; cm -> fc -> initialized = 1 <S2SV_ModStart> i ] = * <S2SV_ModStart> frame_context_idx ] = * <S2SV_ModStart> ( cm ) && <S2SV_ModEnd> cm -> prev_mip <S2SV_ModStart> cm -> prev_mip &&! cm -> frame_parallel_decode ) memset ( cm -> prev_mip, 0, <S2SV_ModEnd> cm -> mi_stride <S2SV_ModStart> cm -> prev_mip <S2SV_ModEnd> ) ) ;
Buggy code:
 int unquoted_glob_pattern_p ( string ) register char * string ; { register int c ; char * send ; int open, bsquote ; DECLARE_MBSTATE ; open = bsquote = 0 ; send = string + strlen ( string ) ; while ( c = * string ++ ) { switch ( c ) { case '?' : case '*' : return ( 1 ) ; case '[' : open ++ ; continue ; case ']' : if ( open ) return ( 1 ) ; continue ; <START_BUG> case '+' : <END_BUG> case '@' : case '!' : if ( * string == '(' ) return ( 1 ) ; continue ; case '\\\\' : if ( * string!= '\\0' && * string!= '//' ) { bsquote = 1 ; string ++ ; continue ; }  else if ( * string == 0 ) <START_BUG> return ( 0 ) ; case CTLESC : if ( * string ++ == '\\0' ) return ( 0 ) ; } # ifdef HANDLE_MULTIBYTE string -- ; ADVANCE_CHAR_P ( string, send - string ) ; string ++ ; # else ADVANCE_CHAR_P ( string, send - string ) ; # endif } return ( ( bsquote && posix_glob_backslash )? 2 : 0 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> continue ; case '//' : if ( open ) open = 0 ; case <S2SV_ModStart> else if ( open && * string == '//' ) { string ++ ; continue ; } else if (
Buggy code:
 static int dcbnl_getperm_hwaddr ( struct net_device * netdev, struct nlmsghdr * nlh, u32 seq, struct nlattr * * tb, struct sk_buff * skb ) { u8 perm_addr [ MAX_ADDR_LEN ] ; if (! netdev -> dcbnl_ops -> getpermhwaddr ) return - EOPNOTSUPP ; <START_BUG> netdev -> dcbnl_ops -> getpermhwaddr ( netdev, perm_addr ) ; <END_BUG> return nla_put ( skb, DCB_ATTR_PERM_HWADDR, sizeof ( perm_addr ), perm_addr ) ; }

Fix:
<S2SV_ModStart> - EOPNOTSUPP ; memset ( perm_addr, 0, sizeof ( perm_addr ) ) ;
Buggy code:
 int nfs3svc_decode_readdirplusargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd3_readdirargs * args ) { int len ; u32 max_blocksize = svc_max_payload ( rqstp ) ; p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; p = xdr_decode_hyper ( p, & args -> cookie ) ; args -> verf = p ; p += 2 ; args -> dircount = ntohl ( * p ++ ) ; args -> count = ntohl ( * p ++ ) ; <START_BUG> len = args -> count = min ( args -> count, max_blocksize ) ; <END_BUG> while ( len > 0 ) { struct page * p = * ( rqstp -> rq_next_page ++ ) ; if (! args -> buffer ) args -> buffer = page_address ( p ) ; len -= PAGE_SIZE ; }  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ++ ) ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 ; <S2SV_ModStart> ; } return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static void write_profile ( BITSTREAM_PROFILE profile, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG>  assert ( profile < MAX_PROFILES ) ; <START_BUG> <END_BUG> vp9_wb_write_bit ( wb, profile & 1 ) ;  <START_BUG> vp9_wb_write_bit ( wb, profile >> 1 ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> profile, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> wb ) { switch ( profile ) { case PROFILE_0 : vpx_wb_write_literal ( wb, 0, 2 ) ; break ; case PROFILE_1 : vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> ( wb, 2, 2 ) ; break ; case PROFILE_2 : vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> ( wb, 1, 2 ) ; break ; case PROFILE_3 : vpx_wb_write_literal ( wb, 6, 3 ) ; break ; default : assert ( 0 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } }
Buggy code:
 static void * __alloc_from_pool ( size_t size, struct page * * ret_page, gfp_t flags ) { unsigned long val ; void * ptr = NULL ; if (! atomic_pool ) { WARN ( 1, "coherent   pool   not   initialised!\\n" ) ; return NULL ; } val = gen_pool_alloc ( atomic_pool, size ) ; if ( val ) { phys_addr_t phys = gen_pool_virt_to_phys ( atomic_pool, val ) ; * ret_page = phys_to_page ( phys ) ; ptr = ( void * ) val ; <START_BUG> if ( flags & __GFP_ZERO ) <END_BUG> memset ( ptr, 0, size ) ; } return ptr ; }

Fix:
<S2SV_ModStart> ) val ; <S2SV_ModEnd> memset ( ptr
Buggy code:
 int mi_repair ( MI_CHECK * param, register MI_INFO * info, <START_BUG> char * name, int rep_quick ) <END_BUG> { int error, got_error ; ha_rows start_records, new_header_length ; my_off_t del ; File new_file ; MYISAM_SHARE * share = info -> s ; char llbuff [ 22 ], llbuff2 [ 22 ] ; SORT_INFO sort_info ; MI_SORT_PARAM sort_param ; DBUG_ENTER ( "mi_repair" ) ; bzero ( ( char * ) & sort_info, sizeof ( sort_info ) ) ; bzero ( ( char * ) & sort_param, sizeof ( sort_param ) ) ; start_records = info -> state -> records ; new_header_length = ( param -> testflag & T_UNPACK )? 0L : share -> pack. header_length ; got_error = 1 ; new_file = - 1 ; sort_param. sort_info = & sort_info ; if (! ( param -> testflag & T_SILENT ) ) { printf ( "-   recovering   (with   keycache)   MyISAM-table   \'%s\'\\n", name ) ; printf ( "Data   records:   %s\\n", llstr ( info -> state -> records, llbuff ) ) ; } param -> testflag |= T_REP ; if ( info -> s -> options & ( HA_OPTION_CHECKSUM | HA_OPTION_COMPRESS_RECORD ) ) param -> testflag |= T_CALC_CHECKSUM ; DBUG_ASSERT ( param -> use_buffers < SIZE_T_MAX ) ; if (! param -> using_global_keycache ) ( void ) init_key_cache ( dflt_key_cache, param -> key_cache_block_size, param -> use_buffers, 0, 0 ) ; if ( init_io_cache ( & param -> read_cache, info -> dfile, ( uint ) param -> read_buffer_length, READ_CACHE, share -> pack. header_length, 1, MYF ( MY_WME ) ) ) { bzero ( & info -> rec_cache, sizeof ( info -> rec_cache ) ) ; goto err ; } if (! rep_

Fix:
<S2SV_ModStart>, int rep_quick, my_bool no_copy_stat <S2SV_ModStart> 0 ) { myf flags = 0 ; if ( param -> testflag & T_BACKUP_DATA ) flags |= MY_REDEL_MAKE_BACKUP ; if ( no_copy_stat ) flags |= MY_REDEL_NO_COPY_STAT ; <S2SV_ModStart>, DATA_TMP_EXT, flags <S2SV_ModEnd> ) || mi_open_datafile
Buggy code:
 void mp_encode_lua_table_as_map ( lua_State * L, mp_buf * buf, int level ) { <START_BUG> size_t len = 0 ; <END_BUG> lua_pushnil ( L ) ; while ( lua_next ( L, - 2 ) ) { lua_pop ( L, 1 ) ; len ++ ; } mp_encode_map ( L, buf, len ) ; lua_pushnil ( L ) ; while ( lua_next ( L, - 2 ) ) { lua_pushvalue ( L, - 2 ) ; mp_encode_lua_type ( L, buf, level + 1 ) ; mp_encode_lua_type ( L, buf, level + 1 ) ; } }

Fix:
<S2SV_ModStart> len = 0 ; luaL_checkstack ( L, 3, "in <S2SV_blank> function <S2SV_blank> mp_encode_lua_table_as_map" )
Buggy code:
 static void smp_task_timedout ( struct timer_list * t ) { struct sas_task_slow * slow = from_timer ( slow, t, timer ) ; struct sas_task * task = slow -> task ; unsigned long flags ; spin_lock_irqsave ( & task -> task_state_lock, flags ) ; <START_BUG> if (! ( task -> task_state_flags & SAS_TASK_STATE_DONE ) ) <END_BUG>  task -> task_state_flags |= SAS_TASK_STATE_ABORTED ; <START_BUG> spin_unlock_irqrestore ( & task -> task_state_lock, flags ) ; complete ( & task -> slow_task -> completion ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> SAS_TASK_STATE_DONE ) ) { <S2SV_ModStart> task_state_flags |= SAS_TASK_STATE_ABORTED <S2SV_ModEnd> ; complete ( <S2SV_ModStart> ) ; } spin_unlock_irqrestore ( & task -> task_state_lock, flags ) ; }
Buggy code:
 <START_BUG> static ext4_io_end_t * ext4_init_io_end ( struct inode * inode ) <END_BUG> { ext4_io_end_t * io = NULL ;  io = kmalloc ( sizeof ( * io ), GFP_NOFS ) ; <START_BUG> if ( io ) { igrab ( inode ) ; io -> inode = inode ; io -> flag = 0 ; io -> offset = 0 ; io -> size = 0 ; <END_BUG> io -> error = 0 ;  INIT_WORK ( & io -> work, ext4_end_io_work ) ; INIT_LIST_HEAD ( & io -> list ) ; } return io ; }

Fix:
<S2SV_ModStart> inode * inode, gfp_t flags <S2SV_ModStart> io ), flags <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; io -> page = NULL <S2SV_ModEnd> ; INIT_WORK (
Buggy code:
 static int tty_open ( struct inode * inode, struct file * filp ) { struct tty_struct * tty = NULL ; int noctty, retval ; struct tty_driver * driver ; int index ; dev_t device = inode -> i_rdev ; unsigned saved_flags = filp -> f_flags ; nonseekable_open ( inode, filp ) ; retry_open : noctty = filp -> f_flags & O_NOCTTY ; index = - 1 ; retval = 0 ; mutex_lock ( & tty_mutex ) ; tty_lock ( ) ; if ( device == MKDEV ( TTYAUX_MAJOR, 0 ) ) { tty = get_current_tty ( ) ; if (! tty ) { tty_unlock ( ) ; mutex_unlock ( & tty_mutex ) ; return - ENXIO ; } driver = tty_driver_kref_get ( tty -> driver ) ; index = tty -> index ; filp -> f_flags |= O_NONBLOCK ; tty_kref_put ( tty ) ; goto got_driver ; } # ifdef CONFIG_VT if ( device == MKDEV ( TTY_MAJOR, 0 ) ) { extern struct tty_driver * console_driver ; driver = tty_driver_kref_get ( console_driver ) ; index = fg_console ; noctty = 1 ; goto got_driver ; } # endif if ( device == MKDEV ( TTYAUX_MAJOR, 1 ) ) { struct tty_driver * console_driver = console_device ( & index ) ; if ( console_driver ) { driver = tty_driver_kref_get ( console_driver ) ; if ( driver ) { filp -> f_flags |= O_NONBLOCK ; noctty = 1 ; goto got_driver ; } } tty_unlock ( ) ; mutex_unlock ( & tty_mutex ) ; return - ENODEV ; } driver = get_tty_driver ( device, & index ) ; if (! driver ) { tty_unlock ( ) ; mutex_unlock ( & tty_mutex ) ; return - ENODEV ; } got_driver : if (! tty ) { tty = tty_driver_lookup_tty ( driver, inode, index ) ; if ( IS_ERR ( tty ) ) { tty_unlock ( ) ; mutex

Fix:
<S2SV_ModStart> tty_mutex ) ; tty_driver_kref_put ( driver ) ;
Buggy code:
 static inline int btif_hl_select_wakeup ( void ) { char sig_on = btif_hl_signal_select_wakeup ; BTIF_TRACE_DEBUG ( "btif_hl_select_wakeup" ) ; <START_BUG> return send ( signal_fds [ 1 ], & sig_on, sizeof ( sig_on ), 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 static void fill_variance ( int64_t s2, int64_t s, int c, var * v ) { v -> sum_square_error = s2 ; v -> sum_error = s ; <START_BUG> v -> count = c ; <END_BUG>  if ( c > 0 ) <START_BUG> v -> variance = ( int ) ( 256 * ( v -> sum_square_error - v -> sum_error * v -> sum_error // v -> count ) // v -> count ) ; else v -> variance = 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; v -> log2_count <S2SV_ModEnd> = c ; <S2SV_ModStart> = c ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int rtp_packetize_xiph_config ( sout_stream_id_sys_t * id, const char * fmtp, int64_t i_pts ) { if ( fmtp == NULL ) return VLC_EGENERIC ; char * start = strstr ( fmtp, "configuration=" ) ; assert ( start!= NULL ) ; start += sizeof ( "configuration=" ) - 1 ; char * end = strchr ( start, ';' ) ; assert ( end!= NULL ) ; size_t len = end - start ; <START_BUG> char b64 [ len + 1 ] ; <END_BUG> memcpy ( b64, start, len ) ; b64 [ len ] = '\\0' ; int i_max = rtp_mtu ( id ) - 6 ; uint8_t * p_orig, * p_data ; int i_data ;  i_data = vlc_b64_decode_binary ( & p_orig, b64 ) ; <START_BUG> if ( i_data <= 9 ) { free ( p_orig ) ; return VLC_EGENERIC ; } p_data = p_orig + 9 ; i_data -= 9 ; int i_count = ( i_data + i_max - 1 ) // i_max ; for ( int i = 0 ; i < i_count ; i ++ ) { int i_payload = __MIN ( i_max, i_data ) ; block_t * out = block_Alloc ( 18 + i_payload ) ; unsigned fragtype, numpkts ; if ( i_count == 1 ) { fragtype = 0 ; numpkts = 1 ; } else { numpkts = 0 ; if ( i == 0 ) fragtype = 1 ; else if ( i == i_count - 1 ) fragtype = 3 ; else fragtype = 2 ; } uint32_t header = ( ( XIPH_IDENT & 0xffffff ) << 8 ) | ( fragtype << 6 ) | ( 1 << 4 ) | numpkts ; rtp_packetize_common ( id, out, 0, i_pts ) ; SetDWBE ( out -> p_buffer + 12, header ) ; SetWBE ( out -> p_buffer + 16, i_payload ) ; memcpy ( & out -> p_buffer [ 18 ], p_data, i_payload ) ;<END_BUG>

Fix:
<S2SV_ModStart> start ; char * b64 = malloc ( <S2SV_ModEnd> len + 1 <S2SV_ModStart> len + 1 ) ; if (! b64 ) return VLC_EGENERIC <S2SV_ModEnd> ; memcpy ( <S2SV_ModStart> & p_orig, b64 ) ; free (
Buggy code:
 static int smacker_decode_tree ( BitstreamContext * bc, HuffContext * hc, uint32_t prefix, int length ) { <START_BUG> if (! bitstream_read_bit ( bc ) ) { <END_BUG> if ( hc -> current >= 256 ) { av_log ( NULL, AV_LOG_ERROR, "Tree   size   exceeded!\\n" ) ; return AVERROR_INVALIDDATA ; } if ( length ) { hc -> bits [ hc -> current ] = prefix ; hc -> lengths [ hc -> current ] = length ; } else { hc -> bits [ hc -> current ] = 0 ; hc -> lengths [ hc -> current ] = 0 ; } hc -> values [ hc -> current ] = bitstream_read ( bc, 8 ) ; hc -> current ++ ; if ( hc -> maxlength < length ) hc -> maxlength = length ; return 0 ; } else { int r ; length ++ ; r = smacker_decode_tree ( bc, hc, prefix, length ) ; if ( r ) return r ; return smacker_decode_tree ( bc, hc, prefix | ( 1 << ( length - 1 ) ), length ) ; } }

Fix:
<S2SV_ModStart> { if ( length > SMKTREE_DECODE_MAX_RECURSION ) { av_log ( NULL, AV_LOG_ERROR, "Maximum <S2SV_blank> tree <S2SV_blank> recursion <S2SV_blank> level <S2SV_blank> exceeded.\\n" ) ; return AVERROR_INVALIDDATA ; } if (
Buggy code:
 void perf_pmu_migrate_context ( struct pmu * pmu, int src_cpu, int dst_cpu ) { struct perf_event_context * src_ctx ; struct perf_event_context * dst_ctx ; struct perf_event * event, * tmp ; LIST_HEAD ( events ) ; src_ctx = & per_cpu_ptr ( pmu -> pmu_cpu_context, src_cpu ) -> ctx ; dst_ctx = & per_cpu_ptr ( pmu -> pmu_cpu_context, dst_cpu ) -> ctx ; <START_BUG> mutex_lock ( & src_ctx -> mutex ) ; <END_BUG> list_for_each_entry_safe ( event, tmp, & src_ctx -> event_list, event_entry ) { perf_remove_from_context ( event, false ) ; unaccount_event_cpu ( event, src_cpu ) ; put_ctx ( src_ctx ) ; list_add ( & event -> migrate_entry, & events ) ; }  mutex_unlock ( & src_ctx -> mutex ) ; <START_BUG> synchronize_rcu ( ) ; mutex_lock ( & dst_ctx -> mutex ) ; list_for_each_entry_safe ( event, tmp, & events, migrate_entry ) { list_del ( & event -> migrate_entry ) ; if ( event -> state >= PERF_EVENT_STATE_OFF ) event -> state = PERF_EVENT_STATE_INACTIVE ; account_event_cpu ( event, dst_cpu ) ; perf_install_in_context ( dst_ctx, event, dst_cpu ) ; get_ctx ( dst_ctx ) ; } mutex_unlock ( & dst_ctx -> mutex ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> -> ctx ; mutex_lock_double ( & src_ctx -> mutex, & dst_ctx <S2SV_ModEnd> -> mutex ) <S2SV_ModStart> ) ; } synchronize_rcu ( <S2SV_ModEnd> ) ; list_for_each_entry_safe <S2SV_ModStart> mutex ) ; mutex_unlock ( & src_ctx -> mutex ) ;
Buggy code:
 void cfm_print ( netdissect_options * ndo, register const u_char * pptr, register u_int length ) { const struct cfm_common_header_t * cfm_common_header ; const struct cfm_tlv_header_t * cfm_tlv_header ; const uint8_t * tptr, * tlv_ptr ; const uint8_t * namesp ; u_int names_data_remaining ; uint8_t md_nameformat, md_namelength ; const uint8_t * md_name ; uint8_t ma_nameformat, ma_namelength ; const uint8_t * ma_name ; u_int hexdump, tlen, cfm_tlv_len, cfm_tlv_type, ccm_interval ; union { const struct cfm_ccm_t * cfm_ccm ; const struct cfm_lbm_t * cfm_lbm ; const struct cfm_ltm_t * cfm_ltm ; const struct cfm_ltr_t * cfm_ltr ; } msg_ptr ; tptr = pptr ; cfm_common_header = ( const struct cfm_common_header_t * ) pptr ; if ( length < sizeof ( * cfm_common_header ) ) goto tooshort ; ND_TCHECK ( * cfm_common_header ) ; if ( CFM_EXTRACT_VERSION ( cfm_common_header -> mdlevel_version )!= CFM_VERSION ) { ND_PRINT ( ( ndo, "CFMv%u   not   supported,   length   %u", CFM_EXTRACT_VERSION ( cfm_common_header -> mdlevel_version ), length ) ) ; return ; } ND_PRINT ( ( ndo, "CFMv%u   %s,   MD   Level   %u,   length   %u", CFM_EXTRACT_VERSION ( cfm_common_header -> mdlevel_version ), tok2str ( cfm_opcode_values, "unknown   (%u)", cfm_common_header -> opcode ), CFM_EXTRACT_MD_LEVEL ( cfm_common_header -> mdlevel_version

Fix:
<S2SV_ModStart> ) ) ; goto next_tlv <S2SV_ModEnd> ; } chassis_id_length <S2SV_ModStart> ) ) ; goto next_tlv <S2SV_ModEnd> ; } chassis_id_type <S2SV_ModStart> ) ) ; goto next_tlv <S2SV_ModEnd> ; } switch <S2SV_ModStart> case CFM_CHASSIS_ID_MAC_ADDRESS : if ( chassis_id_length!= ETHER_ADDR_LEN ) { ND_PRINT ( ( ndo, " <S2SV_blank> (invalid <S2SV_blank> MAC <S2SV_blank> address <S2SV_blank> length)" ) ) ; hexdump = TRUE ; break ; } <S2SV_ModStart> ndo, tptr + 1, chassis_id_length <S2SV_ModStart> 0 ) { break <S2SV_ModEnd> ; } mgmt_addr_length <S2SV_ModStart> cfm_tlv_len -- ; ND_PRINT ( ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> Management <S2SV_blank> Address <S2SV_blank> Domain <S2SV_blank> Length <S2SV_blank> %u", mgmt_addr_length ) ) ; <S2SV_ModStart> ) ) ; goto next_tlv <S2SV_ModEnd> ; } cfm_tlv_len <S2SV_ModStart> cfm_tlv_len -= mgmt_addr_length ; hex_print ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> Management <S2SV_blank> Address <S2SV_blank> Domain: <S2SV_blank> ", tptr, mgmt_addr_length ) <S2SV_ModStart> ( ndo
Buggy code:
 <START_BUG> void vp9_iht16x16_add ( TX_TYPE tx_type, const int16_t * input, uint8_t * dest, <END_BUG> int stride, int eob ) { if ( tx_type == DCT_DCT ) { vp9_idct16x16_add ( input, dest, stride, eob ) ; } else { vp9_iht16x16_256_add ( input, dest, stride, tx_type ) ; } }

Fix:
<S2SV_ModStart> tx_type, const tran_low_t <S2SV_ModEnd> * input,
Buggy code:
 static char * bittok2str_internal ( register const struct tok * lp, register const char * fmt, register u_int v, const char * sep ) { <START_BUG> static char buf [ 256 ] ; <END_BUG> int buflen = 0 ; register u_int rotbit ; register u_int tokval ; const char * sepstr = "" ; while ( lp!= NULL && lp -> s!= NULL ) { tokval = lp -> v ; rotbit = 1 ; while ( rotbit!= 0 ) { if ( tokval == ( v & rotbit ) ) {  buflen += snprintf ( buf + buflen, sizeof ( buf ) - buflen, "%s%s", <START_BUG> <END_BUG> sepstr, lp -> s ) ;  sepstr = sep ; break ; } rotbit = rotbit << 1 ; } lp ++ ; } <START_BUG> if ( buflen == 0 ) <END_BUG> ( void ) snprintf ( buf, sizeof ( buf ), fmt == NULL? "#%08x" : fmt, v ) ; return ( buf ) ; }

Fix:
<S2SV_ModStart> char buf [ 1024 + 1 ] ; char * bufp = buf ; size_t space_left = sizeof ( buf ), string_size <S2SV_ModEnd> ; register u_int <S2SV_ModStart> ) ) { if ( space_left <= 1 ) return ( buf ) ; string_size = strlcpy ( bufp, sepstr, space_left ) ; if ( string_size >= space_left ) return ( buf ) ; bufp += string_size ; space_left -= string_size ; if ( space_left <= 1 ) return ( buf ) ; string_size = strlcpy ( bufp <S2SV_ModEnd>, lp -> <S2SV_ModStart> lp -> s, space_left ) ; if ( string_size >= space_left ) return ( buf ) ; bufp += string_size ; space_left -= string_size <S2SV_ModEnd> ; sepstr = <S2SV_ModStart> } if ( bufp == buf <S2SV_ModEnd> ) ( void