nus-yam/ex-repair huggingface dataset:
Buggy code:
 int hfsplus_rename_cat ( u32 cnid, struct inode * src_dir, struct qstr * src_name, struct inode * dst_dir, struct qstr * dst_name ) { struct super_block * sb = src_dir -> i_sb ; struct hfs_find_data src_fd, dst_fd ; hfsplus_cat_entry entry ; int entry_size, type ; int err ; dprint ( DBG_CAT_MOD, "rename_cat:   %u   -   %lu,%s   -   %lu,%s\\n", cnid, src_dir -> i_ino, src_name -> name, dst_dir -> i_ino, dst_name -> name ) ; err = hfs_find_init ( HFSPLUS_SB ( sb ) -> cat_tree, & src_fd ) ; if ( err ) return err ; dst_fd = src_fd ; hfsplus_cat_build_key ( sb, src_fd. search_key, src_dir -> i_ino, src_name ) ; err = hfs_brec_find ( & src_fd ) ; if ( err ) goto out ; <START_BUG> hfs_bnode_read ( src_fd. bnode, & entry, src_fd. entryoffset, <END_BUG> src_fd. entrylength ) ; hfsplus_cat_build_key ( sb, dst_fd. search_key, dst_dir -> i_ino, dst_name ) ; err = hfs_brec_find ( & dst_fd ) ; if ( err!= - ENOENT ) { if (! err ) err = - EEXIST ; goto out ; } err = hfs_brec_insert ( & dst_fd, & entry, src_fd. entrylength ) ; if ( err ) goto out ; dst_dir -> i_size ++ ; dst_dir -> i_mtime = dst_dir -> i_ctime = CURRENT_TIME_SEC ; hfsplus_cat_build_key ( sb, src_fd. search_key, src_dir -> i_ino, src_name ) ; err = hfs_brec_find ( & src_fd ) ; if ( err ) goto out ; err = hfs_brec_remove ( & src_fd ) ;

Fix:
<S2SV_ModStart> goto out ; if ( src_fd. entrylength > sizeof ( entry ) || src_fd. entrylength < 0 ) { err = - EIO ; goto out ; }
Buggy code:
 int main ( int argc, char * argv [ ] ) { int i, fails_count = 0 ; CU_pSuite cryptoUtilsTestSuite, parserTestSuite ; CU_pSuite * suites [ ] = { & cryptoUtilsTestSuite, & parserTestSuite, NULL } ; if ( argc > 1 ) { if ( argv [ 1 ] [ 0 ] == '-' ) { if ( strcmp ( argv [ 1 ], "-verbose" ) == 0 ) { verbose = 1 ; } else { printf ( "Usage:\\n   %s   [-verbose]   to   enable   extensive   logging\\n", argv [ 0 ] ) ; return 1 ; } } else { printf ( "Usage:\\n   %s   [-verbose]   to   enable   extensive   logging\\n", argv [ 0 ] ) ; return 1 ; } } # ifdef HAVE_LIBXML2 xmlInitParser ( ) ; # endif if ( CUE_SUCCESS!= CU_initialize_registry ( ) ) { return CU_get_error ( ) ; } cryptoUtilsTestSuite = CU_add_suite ( "Bzrtp   Crypto   Utils", NULL, NULL ) ; CU_add_test ( cryptoUtilsTestSuite, "zrtpKDF", test_zrtpKDF ) ; CU_add_test ( cryptoUtilsTestSuite, "CRC32", test_CRC32 ) ; CU_add_test ( cryptoUtilsTestSuite, "algo   agreement", test_algoAgreement ) ; CU_add_test ( cryptoUtilsTestSuite, "context   algo   setter   and   getter", test_algoSetterGetter ) ; CU_add_test ( cryptoUtilsTestSuite, "adding   mandatory   crypto   algorithms   if   needed", test_addMandatoryCryptoTypesIfNeeded ) ; parserTestSuite = CU_add_suite ( "Bzrtp   ZRTP   Packet   Parser", NULL, NULL ) ; CU_add_test ( parserTestSuite, "Parse", test_parser ) ; <START_BUG> CU_add_test ( parserTestSuite, "Parse   Exchange", test_parserComplete ) ; <END_BUG> CU_add_test ( parserTestSuite, "State   machine", test_stateMachine ) ; for ( i = 0 ; suites [ i ] ; i ++ ) { CU_basic_run_suite

Fix:
<S2SV_ModStart> ( parserTestSuite, "Parse <S2SV_blank> hvi <S2SV_blank> check <S2SV_blank> fail", test_parser_hvi ) ; CU_add_test ( parserTestSuite,
Buggy code:
 int PyParser_AddToken ( parser_state * ps, int type, char * str, int lineno, int col_offset, int end_lineno, int end_col_offset, int * expected_ret ) { int ilabel ; int err ; D ( printf ( "Token   %s//\'%s\'  ...   ", _PyParser_TokenNames [ type ], str ) ) ; ilabel = classify ( ps, type, str ) ; if ( ilabel < 0 ) return E_SYNTAX ; for ( ; ; ) { dfa * d = ps -> p_stack. s_top -> s_dfa ; state * s = & d -> d_state [ ps -> p_stack. s_top -> s_state ] ; D ( printf ( "   DFA   \'%s\',   state   %d:", d -> d_name, ps -> p_stack. s_top -> s_state ) ) ; if ( s -> s_lower <= ilabel && ilabel < s -> s_upper ) { int x = s -> s_accel [ ilabel - s -> s_lower ] ; if ( x!= - 1 ) { if ( x & ( 1 << 7 ) ) { int nt = ( x >> 8 ) + NT_OFFSET ; int arrow = x & ( ( 1 << 7 ) - 1 ) ; <START_BUG> dfa * d1 = PyGrammar_FindDFA ( <END_BUG> ps -> p_grammar, nt ) ; if ( ( err = push ( & ps -> p_stack, nt, d1, arrow, lineno, col_offset, end_lineno, end_col_offset ) ) > 0 ) { D ( printf ( "   MemError:   push\\n" ) ) ; return err ; }  D ( printf ( "   Push  ...\\n" ) ) ; <START_BUG> continue ; } if ( ( err = shift ( & ps -> p_stack, type, str, x, lineno, col_offset, end_lineno, end_col_offset ) ) > 0 ) { D ( printf ( "   MemError:   shift.\\n" ) ) ; return err ; } D ( printf ( "   Shift.\\n" ) ) ; while ( s = & d -> d_state [ ps -> p_stack. s_top -> s_state ], s -> s_<END_BUG>

Fix:
<S2SV_ModStart> dfa * d1 ; if ( nt == func_body_suite &&! ( ps -> p_flags & PyCF_TYPE_COMMENTS ) ) { D ( printf ( " <S2SV_blank> [switch <S2SV_blank> func_body_suite <S2SV_blank> to <S2SV_blank> suite]" ) ) ; nt = suite ; } d1 <S2SV_ModStart> ( printf ( " <S2SV_blank> Push <S2SV_blank> \'%s\'\\n", d1 -> d_name <S2SV_ModEnd> ) ) ;
Buggy code:
 static int atusb_get_and_show_revision ( struct atusb * atusb ) { struct usb_device * usb_dev = atusb -> usb_dev ; <START_BUG> unsigned char buffer [ 3 ] ; <END_BUG> int ret ; ret = atusb_control_msg ( atusb, usb_rcvctrlpipe ( usb_dev, 0 ), ATUSB_ID, ATUSB_REQ_FROM_DEV, 0, 0, buffer, 3, 1000 ) ; if ( ret >= 0 ) { atusb -> fw_ver_maj = buffer [ 0 ] ; atusb -> fw_ver_min = buffer [ 1 ] ; atusb -> fw_hw_type = buffer [ 2 ] ; dev_info ( & usb_dev -> dev, "Firmware:   major:   %u,   minor:   %u,   hardware   type:   %u\\n", atusb -> fw_ver_maj, atusb -> fw_ver_min, atusb -> fw_hw_type ) ; } if ( atusb -> fw_ver_maj == 0 && atusb -> fw_ver_min < 2 ) { dev_info ( & usb_dev -> dev, "Firmware   version   (%u.%u)   predates   our   first   public   release.", atusb -> fw_ver_maj, atusb -> fw_ver_min ) ; dev_info ( & usb_dev -> dev, "Please   update   to   version   0.2   or   newer" ) ; }  return ret ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ; unsigned char * buffer ; int ret ; buffer = kmalloc ( 3, GFP_KERNEL ) ; if (! buffer ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart> ) ; } kfree ( buffer ) ;
Buggy code:
 asmlinkage long sys_oabi_fcntl64 ( unsigned int fd, unsigned int cmd, unsigned long arg ) { <START_BUG> struct oabi_flock64 user ; <END_BUG> struct flock64 kernel ; mm_segment_t fs = USER_DS ; unsigned long local_arg = arg ; int ret ; switch ( cmd ) { case F_OFD_GETLK : case F_OFD_SETLK : case F_OFD_SETLKW : case F_GETLK64 : case F_SETLK64 : case F_SETLKW64 :  if ( copy_from_user ( & user, ( struct oabi_flock64 __user * ) arg, <START_BUG> sizeof ( user ) ) ) return - EFAULT ; kernel. l_type = user. l_type ; kernel. l_whence = user. l_whence ; kernel. l_start = user. l_start ; kernel. l_len = user. l_len ; kernel. l_pid = user. l_pid ; local_arg = ( unsigned long ) & kernel ; fs = get_fs ( ) ; set_fs ( KERNEL_DS ) ; } <END_BUG> ret = sys_fcntl64 ( fd, cmd, local_arg ) ;  switch ( cmd ) { case F_GETLK64 : if (! ret ) { user. l_type = kernel. l_type ; user. l_whence = kernel. l_whence ; user. l_start = kernel. l_start ; user. l_len = kernel. l_len ; user. l_pid = kernel. l_pid ; if ( copy_to_user ( ( struct oabi_flock64 __user * ) arg, & user, sizeof ( user ) ) ) ret = - EFAULT ; } case F_SETLK64 : case F_SETLKW64 : set_fs ( fs ) ; } <START_BUG> return ret ; <END_BUG> }

Fix:
<S2SV_ModStart> arg ) { <S2SV_ModEnd> switch ( cmd <S2SV_ModStart> case F_SETLKW64 : return do_locks ( fd, cmd, arg ) ; default : return <S2SV_ModEnd> sys_fcntl64 ( fd <S2SV_ModStart>, cmd, arg <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 void dhcpClientProcessMessage ( NetInterface * interface, const IpPseudoHeader * pseudoHeader, const UdpHeader * udpHeader, const NetBuffer * buffer, size_t offset, const NetRxAncillary * ancillary, void * param ) { size_t length ; DhcpClientContext * context ; DhcpMessage * message ; DhcpOption * option ; context = ( DhcpClientContext * ) param ; length = netBufferGetLength ( buffer ) - offset ; <START_BUG> if ( length < sizeof ( DhcpMessage ) ) <END_BUG> return ; if ( length > DHCP_MAX_MSG_SIZE ) return ; message = netBufferAt ( buffer, offset ) ; if ( message == NULL ) return ; TRACE_DEBUG ( "\\r\\n%s:   DHCP   message   received   (%" PRIuSIZE "   bytes)...\\r\\n", formatSystemTime ( osGetSystemTime ( ), NULL ), length ) ; dhcpDumpMessage ( message, length ) ; if ( message -> op!= DHCP_OPCODE_BOOTREPLY ) return ; if ( message -> htype!= DHCP_HARDWARE_TYPE_ETH ) return ; if ( message -> hlen!= sizeof ( MacAddr ) ) return ; if ( message -> magicCookie!= HTONL ( DHCP_MAGIC_COOKIE ) ) return ; option = dhcpGetOption ( message, length, DHCP_OPT_DHCP_MESSAGE_TYPE ) ; if ( option == NULL || option -> length!= 1 ) return ; switch ( option -> value [ 0 ] ) { case DHCP_MESSAGE_TYPE_OFFER : dhcpClientParseOffer ( context, message, length ) ; break ; case DHCP_MESSAGE_TYPE_ACK : dhcpClientParseAck ( context, message, length ) ; break ; case DHCP_MESSAGE_TYPE_NAK : dhcpClientParseNak ( context, message, length ) ; break ; default : break ; } }

Fix:
<S2SV_ModStart> ( DhcpMessage ) || <S2SV_ModEnd> length > DHCP_MAX_MSG_SIZE
Buggy code:
 static int tcp_v6_do_rcv ( struct sock * sk, struct sk_buff * skb ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct tcp_sock * tp ; struct sk_buff * opt_skb = NULL ; if ( skb -> protocol == htons ( ETH_P_IP ) ) return tcp_v4_do_rcv ( sk, skb ) ; <START_BUG> if ( sk_filter ( sk, skb ) ) <END_BUG> goto discard ; if ( np -> rxopt. all ) opt_skb = skb_clone ( skb, sk_gfp_mask ( sk, GFP_ATOMIC ) ) ; if ( sk -> sk_state == TCP_ESTABLISHED ) { struct dst_entry * dst = sk -> sk_rx_dst ; sock_rps_save_rxhash ( sk, skb ) ; sk_mark_napi_id ( sk, skb ) ; if ( dst ) { if ( inet_sk ( sk ) -> rx_dst_ifindex!= skb -> skb_iif || dst -> ops -> check ( dst, np -> rx_dst_cookie ) == NULL ) { dst_release ( dst ) ; sk -> sk_rx_dst = NULL ; } } tcp_rcv_established ( sk, skb, tcp_hdr ( skb ), skb -> len ) ; if ( opt_skb ) goto ipv6_pktoptions ; return 0 ; } if ( tcp_checksum_complete ( skb ) ) goto csum_err ; if ( sk -> sk_state == TCP_LISTEN ) { struct sock * nsk = tcp_v6_cookie_check ( sk, skb ) ; if (! nsk ) goto discard ; if ( nsk!= sk ) { sock_rps_save_rxhash ( nsk, skb ) ; sk_mark_napi_id ( nsk, skb ) ; if ( tcp_child_process ( sk, nsk, skb ) ) goto reset ; if ( opt_skb ) __kfree_skb ( opt_skb ) ; return 0 ; } } else sock_rps_save_rxhash ( sk, skb ) ; if ( tcp_rcv_

Fix:
<S2SV_ModStart> ; if ( tcp_filter <S2SV_ModEnd> ( sk,
Buggy code:
 int imap_subscribe ( char * path, bool subscribe ) { struct ImapData * idata = NULL ; char buf [ LONG_STRING ] ; char mbox [ LONG_STRING ] ; char errstr [ STRING ] ; struct Buffer err, token ; struct ImapMbox mx ; <START_BUG> if (! mx_is_imap ( path ) || imap_parse_path ( path, & mx ) ||! mx. mbox ) <END_BUG> { mutt_error ( _ ( "Bad   mailbox   name" ) ) ; return - 1 ; } idata = imap_conn_find ( & ( mx. account ), 0 ) ; if (! idata ) goto fail ; imap_fix_path ( idata, mx. mbox, buf, sizeof ( buf ) ) ; if (! * buf ) mutt_str_strfcpy ( buf, "INBOX", sizeof ( buf ) ) ; if ( ImapCheckSubscribed ) { mutt_buffer_init ( & token ) ; mutt_buffer_init ( & err ) ; err. data = errstr ; err. dsize = sizeof ( errstr ) ;  snprintf ( mbox, sizeof ( mbox ), "%smailboxes   \\"%s\\"", subscribe? "" : "un", path ) ; <START_BUG> if ( mutt_parse_rc_line ( mbox, & token, & err ) ) mutt_debug ( 1, "Error   adding   subscribed   mailbox:   %s\\n", errstr ) ; FREE ( & token. data ) ; } if ( subscribe ) mutt_message ( _ ( "Subscribing   to   %s..." ), buf ) ; else mutt_message ( _ ( "Unsubscribing   from   %s..." ), buf ) ; imap_munge_mbox_name ( idata, mbox, sizeof ( mbox ), buf ) ; snprintf ( buf, sizeof ( buf ), "%sSUBSCRIBE   %s", subscribe? "" : "UN", mbox ) ; if ( imap_exec ( idata, buf, 0 ) < 0 ) goto fail ; imap_unmunge_mbox_name ( idata, mx. mbox ) ; if ( subscribe ) mutt_message ( _ ( "Subscribed   to   %s" ), mx. mbox )<END_BUG>

Fix:
<S2SV_ModStart> ImapMbox mx ; size_t len = 0 ; <S2SV_ModStart> errstr ) ; len = <S2SV_ModStart> mbox ), "%smailboxes <S2SV_blank> " <S2SV_ModEnd>, subscribe? <S2SV_ModStart> "" : "un" ) ; imap_quote_string ( mbox + len, sizeof ( mbox ) - len, path, true <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> static void xen_netbk_idx_release ( struct xen_netbk * netbk, u16 pending_idx ) <END_BUG> { struct xenvif * vif ; struct pending_tx_info * pending_tx_info ; pending_ring_idx_t index ; if ( netbk -> mmap_pages [ pending_idx ] == NULL ) return ; pending_tx_info = & netbk -> pending_tx_info [ pending_idx ] ; vif = pending_tx_info -> vif ;  make_tx_response ( vif, & pending_tx_info -> req, XEN_NETIF_RSP_OKAY ) ; <START_BUG> index = pending_index ( netbk -> pending_prod ++ ) ; netbk -> pending_ring [ index ] = pending_idx ; xenvif_put ( vif ) ; netbk -> mmap_pages [ pending_idx ] -> mapping = 0 ; put_page ( netbk -> mmap_pages [ pending_idx ] ) ; netbk -> mmap_pages [ pending_idx ] = NULL ; }<END_BUG>

Fix:
<S2SV_ModStart>, u16 pending_idx, u8 status <S2SV_ModStart> -> req, status <S2SV_ModEnd> ) ; index
Buggy code:
 static void umount_tree ( struct mount * mnt, enum umount_tree_flags how ) { LIST_HEAD ( tmp_list ) ; struct mount * p ; if ( how & UMOUNT_PROPAGATE ) propagate_mount_unlock ( mnt ) ; for ( p = mnt ; p ; p = next_mnt ( p, mnt ) ) { p -> mnt. mnt_flags |= MNT_UMOUNT ; list_move ( & p -> mnt_list, & tmp_list ) ; } list_for_each_entry ( p, & tmp_list, mnt_list ) { list_del_init ( & p -> mnt_child ) ; } if ( how & UMOUNT_PROPAGATE ) propagate_umount ( & tmp_list ) ; while (! list_empty ( & tmp_list ) ) { <START_BUG> p = list_first_entry ( & tmp_list, struct mount, mnt_list ) ; <END_BUG> list_del_init ( & p -> mnt_expire ) ; list_del_init ( & p -> mnt_list ) ; __touch_mnt_namespace ( p -> mnt_ns ) ; p -> mnt_ns = NULL ; if ( how & UMOUNT_SYNC ) p -> mnt. mnt_flags |= MNT_SYNC_UMOUNT ;  pin_insert_group ( & p -> mnt_umount, & p -> mnt_parent -> mnt, & unmounted ) ; <START_BUG> if ( mnt_has_parent ( p ) ) { mnt_add_count ( p -> mnt_parent, - 1 ) ; <END_BUG> umount_mnt ( p ) ;  } <START_BUG> change_mnt_propagation ( p, MS_PRIVATE ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> ) ) { bool disconnect ; <S2SV_ModStart> |= MNT_SYNC_UMOUNT ; disconnect =! IS_MNT_LOCKED_AND_LAZY ( p ) ; <S2SV_ModStart> -> mnt, disconnect? & unmounted : NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart> 1 ) ; if (! disconnect ) { list_add_tail ( & p -> mnt_child, & p -> mnt_parent -> mnt_mounts ) ; } else { <S2SV_ModStart> ) ; } }
Buggy code:
 int __kvm_set_memory_region ( struct kvm * kvm, struct kvm_userspace_memory_region * mem, int user_alloc ) { int r ; gfn_t base_gfn ; unsigned long npages ; unsigned long i ; struct kvm_memory_slot * memslot ; struct kvm_memory_slot old, new ; struct kvm_memslots * slots, * old_memslots ; r = - EINVAL ; if ( mem -> memory_size & ( PAGE_SIZE - 1 ) ) goto out ; if ( mem -> guest_phys_addr & ( PAGE_SIZE - 1 ) ) goto out ; if ( user_alloc && ( ( mem -> userspace_addr & ( PAGE_SIZE - 1 ) ) ||! access_ok ( VERIFY_WRITE, ( void __user * ) ( unsigned long ) mem -> userspace_addr, mem -> memory_size ) ) ) goto out ; if ( mem -> slot >= KVM_MEM_SLOTS_NUM ) goto out ; if ( mem -> guest_phys_addr + mem -> memory_size < mem -> guest_phys_addr ) goto out ; memslot = id_to_memslot ( kvm -> memslots, mem -> slot ) ; base_gfn = mem -> guest_phys_addr >> PAGE_SHIFT ; npages = mem -> memory_size >> PAGE_SHIFT ; r = - EINVAL ; if ( npages > KVM_MEM_MAX_NR_PAGES ) goto out ; if (! npages ) mem -> flags &= ~ KVM_MEM_LOG_DIRTY_PAGES ; new = old = * memslot ; new. id = mem -> slot ; new. base_gfn = base_gfn ; new. npages = npages ; new. flags = mem -> flags ; r = - EINVAL ; if ( npages && old. npages && npages!= old. npages ) goto out_free ; r = - EEXIST ; for ( i = 0 ; i < KVM_MEMORY_SLOTS ; ++ i ) { struct kvm_memory_slot * s = & kvm -> memslots -> memslots [ i ] ; if ( s == memslot ||! s -> npages ) continue ; if (! ( ( base_gfn

Fix:
<S2SV_ModStart> out_free ; } else kvm_iommu_unmap_pages ( kvm, & old ) ;
Buggy code:
 int xfs_attr3_leaf_getvalue ( struct xfs_buf * bp, struct xfs_da_args * args ) { struct xfs_attr_leafblock * leaf ; struct xfs_attr3_icleaf_hdr ichdr ; struct xfs_attr_leaf_entry * entry ; struct xfs_attr_leaf_name_local * name_loc ; struct xfs_attr_leaf_name_remote * name_rmt ; int valuelen ; leaf = bp -> b_addr ; xfs_attr3_leaf_hdr_from_disk ( & ichdr, leaf ) ; ASSERT ( ichdr. count < XFS_LBSIZE ( args -> dp -> i_mount ) // 8 ) ; ASSERT ( args -> index < ichdr. count ) ; entry = & xfs_attr3_leaf_entryp ( leaf ) [ args -> index ] ; if ( entry -> flags & XFS_ATTR_LOCAL ) { name_loc = xfs_attr3_leaf_name_local ( leaf, args -> index ) ; ASSERT ( name_loc -> namelen == args -> namelen ) ; ASSERT ( memcmp ( args -> name, name_loc -> nameval, args -> namelen ) == 0 ) ; valuelen = be16_to_cpu ( name_loc -> valuelen ) ; if ( args -> flags & ATTR_KERNOVAL ) { args -> valuelen = valuelen ; return 0 ; } if ( args -> valuelen < valuelen ) { args -> valuelen = valuelen ; return XFS_ERROR ( ERANGE ) ; } args -> valuelen = valuelen ; memcpy ( args -> value, & name_loc -> nameval [ args -> namelen ], valuelen ) ; } else { name_rmt = xfs_attr3_leaf_name_remote ( leaf, args -> index ) ; ASSERT ( name_rmt -> namelen == args -> namelen ) ; ASSERT ( memcmp ( args -> name, name_rmt -> name, args -> namelen ) == 0 ) ; <START_BUG> valuelen = be32_to_cpu ( name_rmt -> valuelen ) ; <END_BUG> args -> rmtblkno = be

Fix:
<S2SV_ModStart> 0 ) ; args -> rmtvaluelen <S2SV_ModEnd> = be32_to_cpu ( <S2SV_ModStart> -> i_mount, args -> rmtvaluelen <S2SV_ModEnd> ) ; if <S2SV_ModStart> -> valuelen = args -> rmtvaluelen <S2SV_ModEnd> ; return 0 <S2SV_ModStart> -> valuelen < args -> rmtvaluelen ) { args -> valuelen = args -> rmtvaluelen <S2SV_ModEnd> ; return XFS_ERROR <S2SV_ModStart> -> valuelen = args -> rmtvaluelen <S2SV_ModEnd> ; } return
Buggy code:
 static int zipfileUpdate ( sqlite3_vtab * pVtab, int nVal, sqlite3_value * * apVal, sqlite_int64 * pRowid ) { ZipfileTab * pTab = ( ZipfileTab * ) pVtab ; int rc = SQLITE_OK ; ZipfileEntry * pNew = 0 ; u32 mode = 0 ; u32 mTime = 0 ; i64 sz = 0 ; const char * zPath = 0 ; int nPath = 0 ; const u8 * pData = 0 ; int nData = 0 ; int iMethod = 0 ; u8 * pFree = 0 ; char * zFree = 0 ; ZipfileEntry * pOld = 0 ; ZipfileEntry * pOld2 = 0 ; int bUpdate = 0 ; int bIsDir = 0 ; u32 iCrc32 = 0 ; if ( pTab -> pWriteFd == 0 ) { rc = zipfileBegin ( pVtab ) ; if ( rc!= SQLITE_OK ) return rc ; } if ( sqlite3_value_type ( apVal [ 0 ] )!= SQLITE_NULL ) { const char * zDelete = ( const char * ) sqlite3_value_text ( apVal [ 0 ] ) ; int nDelete = ( int ) strlen ( zDelete ) ; if ( nVal > 1 ) { const char * zUpdate = ( const char * ) sqlite3_value_text ( apVal [ 1 ] ) ; if ( zUpdate && zipfileComparePath ( zUpdate, zDelete, nDelete )!= 0 ) { bUpdate = 1 ; } } for ( pOld = pTab -> pFirstEntry ; 1 ; pOld = pOld -> pNext ) { if ( zipfileComparePath ( pOld -> cds. zFile, zDelete, nDelete ) == 0 ) { break ; } assert ( pOld -> pNext ) ; } } if ( nVal > 1 ) { if ( sqlite3_value_type ( apVal [ 5 ] )!= SQLITE_NULL ) { zipfileTableErr ( pTab, "sz   must   be   NULL" ) ; rc = SQLITE_CONSTRAINT ; } if ( sqlite3_value_type ( apVal [ 6 ] )!= SQLITE_NULL ) { zipfileTableErr ( pTab, "rawdata   must   be   NULL" ) ; rc = SQLITE_CONSTRAINT ; } if

Fix:
<S2SV_ModStart> zFree ; nPath = ( int ) strlen ( zPath ) <S2SV_ModEnd> ; } }
Buggy code:
 static long ioctl_file_dedupe_range ( struct file * file, void __user * arg ) { struct file_dedupe_range __user * argp = arg ; struct file_dedupe_range * same = NULL ; int ret ; unsigned long size ; u16 count ; if ( get_user ( count, & argp -> dest_count ) ) { ret = - EFAULT ; goto out ; } size = offsetof ( struct file_dedupe_range __user, info [ count ] ) ; same = memdup_user ( argp, size ) ; if ( IS_ERR ( same ) ) { ret = PTR_ERR ( same ) ; same = NULL ; goto out ; } <START_BUG> ret = vfs_dedupe_file_range ( file, same ) ; <END_BUG> if ( ret ) goto out ; ret = copy_to_user ( argp, same, size ) ; if ( ret ) ret = - EFAULT ; out : kfree ( same ) ; return ret ; }

Fix:
<S2SV_ModStart> out ; } same -> dest_count = count ;
Buggy code:
 void vp9_init_second_pass ( VP9_COMP * cpi ) { SVC * const svc = & cpi -> svc ; <START_BUG> FIRSTPASS_STATS this_frame ; <END_BUG> const FIRSTPASS_STATS * start_pos ; struct twopass_rc * twopass = & cpi -> twopass ; const VP9_CONFIG * const oxcf = & cpi -> oxcf ;  const int is_spatial_svc = ( svc -> number_spatial_layers > 1 ) && <START_BUG> <END_BUG> ( svc -> number_temporal_layers == 1 ) ;  <START_BUG> double frame_rate ; <END_BUG> if ( is_spatial_svc ) {  twopass = & svc -> layer_context [ svc -> spatial_layer_id ]. twopass ; <START_BUG> } zero_stats ( & twopass -> total_stats ) ; zero_stats ( & twopass -> total_left_stats ) ; if (! twopass -> stats_in_end ) return ; <END_BUG> twopass -> total_stats = * twopass -> stats_in_end ;  <START_BUG> twopass -> total_left_stats = twopass -> total_stats ; <END_BUG>  frame_rate = 10000000.0 * twopass -> total_stats. count // <START_BUG> twopass -> total_stats. duration ; <END_BUG> if ( is_spatial_svc ) {  vp9_update_spatial_layer_framerate ( cpi, frame_rate ) ; twopass -> bits_left = <START_BUG> ( int64_t ) ( twopass -> total_stats. duration * <END_BUG> svc -> layer_context [ svc -> spatial_layer_id ]. target_bandwidth // 10000000.0 ) ; } else { vp9_new_framerate ( cpi, frame_rate ) ;  twopass -> bits_left = ( int64_t ) ( twopass -> total_stats. duration * <START_BUG> oxcf -> target_bandwidth // 10000000.0 ) ; } <END_BUG> cpi -> output_framerate = oxcf -> framerate ;  if (! is_spatial_svc ) { twopass -> kf_intra_err_min = KF_MB_INTRA_MIN * cpi -> common. MBs ; twopass -> gf_intra

Fix:
<S2SV_ModStart> -> svc ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> ; const int is_two_pass_svc <S2SV_ModEnd> = ( svc <S2SV_ModStart> > 1 ) || <S2SV_ModEnd> ( svc -> <S2SV_ModStart> svc -> number_temporal_layers > <S2SV_ModEnd> 1 ) ; <S2SV_ModStart> 1 ) ; TWO_PASS * const twopass = is_two_pass_svc? <S2SV_ModEnd> & svc -> <S2SV_ModStart> ]. twopass : & cpi -> twopass ; double frame_rate ; FIRSTPASS_STATS * stats ; <S2SV_ModEnd> zero_stats ( & <S2SV_ModStart> ) return ; stats = & <S2SV_ModStart> twopass -> total_stats ; * stats <S2SV_ModStart> -> total_left_stats = * stats <S2SV_ModEnd> ; frame_rate = <S2SV_ModStart> = 10000000.0 * stats -> count // stats -> <S2SV_ModEnd> duration ; if <S2SV_ModStart> ; if ( is_two_pass_svc <S2SV_ModEnd> ) { vp9_update_spatial_layer_framerate <S2SV_ModStart> int64_t ) ( stats -> <S2SV_ModEnd> duration * svc <S2SV_ModStart> int64_t ) ( stats -> <S2SV_ModEnd> duration * oxcf <S2SV_ModStart> ) ; } <S2SV_ModEnd> twopass -> sr_update_lag <S2SV_ModStart> 1 ; { const double avg_error = stats -> coded_error // DOUBLE_DIVIDE_
Buggy code:
 static int bmp_getint32 ( jas_stream_t * in, int_fast32_t * val ) { int n ; uint_fast32_t v ; int c ; for ( n = 4, v = 0 ; ; ) { if ( ( c = jas_stream_getc ( in ) ) == EOF ) { return - 1 ; } <START_BUG> v |= ( c << 24 ) ; <END_BUG> if ( -- n <= 0 ) { break ; } v >>= 8 ; } if ( val ) { * val = v ; } return 0 ; }

Fix:
<S2SV_ModStart> v |= ( JAS_CAST ( uint_fast32_t, c ) <S2SV_ModEnd> << 24 )
Buggy code:
 void uwbd_start ( struct uwb_rc * rc ) { <START_BUG> rc -> uwbd. task = kthread_run ( uwbd, rc, "uwbd" ) ; <END_BUG>  if ( rc -> uwbd. task == NULL ) <START_BUG> printk ( KERN_ERR "UWB:   Cannot   start   management   daemon;   " "UWB   won\'t   work\\n" ) ; <END_BUG> else  rc -> uwbd. pid = rc -> uwbd. task -> pid ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> rc ) { struct task_struct * <S2SV_ModEnd> task = kthread_run <S2SV_ModStart> ; if ( IS_ERR ( task ) ) { <S2SV_ModStart> uwbd. task = NULL ; <S2SV_ModEnd> printk ( KERN_ERR <S2SV_ModStart> "UWB <S2SV_blank> won\'t <S2SV_blank> work\\n" ) ; } else { rc -> uwbd. task = task ; <S2SV_ModEnd> rc -> uwbd <S2SV_ModStart> pid ; } }
Buggy code:
 static enum rules_token lex ( struct scanner * s, union lvalue * val ) { skip_more_whitespace_and_comments : while ( is_space ( peek ( s ) ) ) if ( next ( s ) == '\\n' ) return TOK_END_OF_LINE ; if ( chr ( s, '#' ) ) { skip_to_eol ( s ) ; goto skip_more_whitespace_and_comments ; } if ( eof ( s ) ) return TOK_END_OF_FILE ; s -> token_line = s -> line ; s -> token_column = s -> column ; s -> buf_pos = 0 ; if ( chr ( s, '<' ) ) { <START_BUG> while ( peek ( s )!= '>' &&! eol ( s ) ) <END_BUG> buf_append ( s, next ( s ) ) ; if (! chr ( s, '>' ) ) { scanner_err ( s, "unterminated   keysym   literal" ) ; return TOK_ERROR ; } if (! buf_append ( s, '\\0' ) ) { scanner_err ( s, "keysym   literal   is   too   long" ) ; return TOK_ERROR ; } val -> string. str = s -> buf ; val -> string. len = s -> buf_pos ; return TOK_LHS_KEYSYM ; } if ( chr ( s, ':' ) ) return TOK_COLON ; if ( chr ( s, '!' ) ) return TOK_BANG ; if ( chr ( s, '~' ) ) return TOK_TILDE ; if ( chr ( s, \'\\"\' ) ) { while (! eof ( s ) &&! eol ( s ) && peek ( s )!= \'\\"\' ) { if ( chr ( s, '\\\\' ) ) { uint8_t o ; if ( chr ( s, '\\\\' ) ) { buf_append ( s, '\\\\' ) ; } else if ( chr ( s, \'"\' ) ) { buf_append ( s, \'"\' ) ; } else if ( chr ( s, 'x' ) || chr ( s, 'X' ) ) { if ( hex ( s, & o ) ) buf_append ( s, ( char ) o ) ; else scanner_warn ( s, "illegal   hexadecimal   escape   sequence   in   string   literal" ) ; } else

Fix:
<S2SV_ModStart> ( s ) &&! eof ( s )
Buggy code:
 int l2tp_packet_send ( int sock, struct l2tp_packet_t * pack ) { <START_BUG> uint8_t * buf = mempool_alloc ( buf_pool ) ; <END_BUG> struct l2tp_avp_t * avp ; struct l2tp_attr_t * attr ;  uint8_t * ptr ; <START_BUG> <END_BUG> int n ;  int len = sizeof ( pack -> hdr ) ; if (! buf ) { log_emerg ( "l2tp:   out   of   memory\\n" ) ; return - 1 ; } memset ( buf, 0, L2TP_MAX_PACKET_SIZE ) ; <START_BUG> ptr = buf + sizeof ( pack -> hdr ) ; <END_BUG> list_for_each_entry ( attr, & pack -> attrs, entry ) { if ( len + sizeof ( * avp ) + attr -> length >= L2TP_MAX_PACKET_SIZE ) { log_error ( "l2tp:   cann\'t   send   packet   (exceeds   maximum   size)\\n" ) ; mempool_free ( buf ) ; return - 1 ; } avp = ( struct l2tp_avp_t * ) ptr ; avp -> type = htons ( attr -> attr -> id ) ;  avp -> M = attr -> M ; <START_BUG> avp -> H = attr -> H ; <END_BUG> avp -> length = sizeof ( * avp ) + attr -> length ;  * ( uint16_t * ) ptr = htons ( * ( uint16_t * ) ptr ) ; if ( attr -> H ) memcpy ( avp -> val, attr -> val. octets, attr -> length ) ; else switch ( attr -> attr -> type ) { case ATTR_TYPE_INT16 : * ( int16_t * ) avp -> val = htons ( attr -> val. int16 ) ; break ; case ATTR_TYPE_INT32 : * ( int32_t * ) avp -> val = htonl ( attr -> val. int32 ) ; break ; case ATTR_TYPE_INT64 : * ( uint64_t * ) avp -> val = htobe64 ( attr -> val. uint64 ) ; break ; case ATTR_TYPE_STRING : case ATTR_TYPE_OCTETS : memcpy ( av

Fix:
<S2SV_ModStart> pack ) { struct l2tp_hdr_t * hdr <S2SV_ModEnd> ; struct l2tp_avp_t <S2SV_ModStart> ; uint8_t * buf, * <S2SV_ModStart> ; int n, len ; buf = mempool_alloc ( buf_pool <S2SV_ModEnd> ) ; if <S2SV_ModStart> L2TP_MAX_PACKET_SIZE ) ; hdr = ( struct l2tp_hdr_t * ) buf ; ptr = ( uint8_t * ) ( hdr + 1 ) ; len = <S2SV_ModEnd> sizeof ( pack <S2SV_ModStart> ; avp -> flags = htons ( ( attr -> M? L2TP_AVP_FLAG_M : 0 ) | ( attr -> H? L2TP_AVP_FLAG_H : 0 ) | ( ( <S2SV_ModEnd> sizeof ( * <S2SV_ModStart> attr -> length ) & L2TP_AVP_LEN_MASK ) <S2SV_ModEnd> ) ; if <S2SV_ModStart> ) ) ; hdr -> flags = htons ( pack -> hdr. flags ) ; <S2SV_ModStart>, buf, len <S2SV_ModEnd>, 0, <S2SV_ModStart> ( n!= len <S2SV_ModEnd> ) { if <S2SV_ModStart>, n, len <S2SV_ModEnd> ) ; }
Buggy code:
 static int amd_gpio_remove ( struct platform_device * pdev ) { struct amd_gpio * gpio_dev ; gpio_dev = platform_get_drvdata ( pdev ) ; gpiochip_remove ( & gpio_dev -> gc ) ; <START_BUG> pinctrl_unregister ( gpio_dev -> pctrl ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> gc ) ; <S2SV_ModEnd> return 0 ;
Buggy code:
 static int opmov ( RAsm * a, ut8 * data, const Opcode * op ) { int l = 0 ; st64 offset = 0 ; int mod = 0 ; int base = 0 ; int rex = 0 ; ut64 immediate = 0 ; if ( op -> operands [ 1 ]. type & OT_CONSTANT ) { if (! op -> operands [ 1 ]. is_good_flag ) { return - 1 ; } if ( op -> operands [ 1 ]. immediate == - 1 ) { return - 1 ; } immediate = op -> operands [ 1 ]. immediate * op -> operands [ 1 ]. sign ; if ( op -> operands [ 0 ]. type & OT_GPREG &&! ( op -> operands [ 0 ]. type & OT_MEMORY ) ) { if ( a -> bits == 64 && ( ( op -> operands [ 0 ]. type & OT_QWORD ) | ( op -> operands [ 1 ]. type & OT_QWORD ) ) ) { if (! ( op -> operands [ 1 ]. type & OT_CONSTANT ) && op -> operands [ 1 ]. extended ) { data [ l ++ ] = 0x49 ; } else { data [ l ++ ] = 0x48 ; } } else if ( op -> operands [ 0 ]. extended ) { data [ l ++ ] = 0x41 ; } if ( op -> operands [ 0 ]. type & OT_WORD ) { if ( a -> bits > 16 ) { data [ l ++ ] = 0x66 ; } } if ( op -> operands [ 0 ]. type & OT_BYTE ) { data [ l ++ ] = 0xb0 | op -> operands [ 0 ]. reg ; data [ l ++ ] = immediate ; } else { if ( a -> bits == 64 && ( ( op -> operands [ 0 ]. type & OT_QWORD ) | ( op -> operands [ 1 ]. type & OT_QWORD ) ) && immediate < UT32_MAX ) { data [ l ++ ] = 0xc7 ; data [ l ++ ] = 0xc0 | op -> operands [ 0 ]. reg ; } else { data [ l ++ ] = 0xb8 | op -> operands [ 0 ]. reg ; } data [ l ++ ] = immediate ; data [ l ++ ] = immediate >> 8 ; if (! ( op -> operands [ 0 ]. type & OT_WORD

Fix:
<S2SV_ModStart> [ 0 ] % 6 <S2SV_ModStart> = 0x8b ; data [ l ++ ] = ( ( ( ut32 ) op -> operands [ 0 ]. reg ) << 3 ) | 0x5 ; data [ l ++ ] = offset ; data [ l ++ ] = offset >> 8 ; data [ l ++ ] = offset >> 16 ; data [ l ++ ] = offset >> 24 ; return l ; } if ( a -> bits == 64 ) { if ( op -> operands [ 0 ]. type & OT_QWORD ) { if (! ( op -> operands [ 1 ]. type & OT_QWORD ) ) { if ( op -> operands [ 1 ]. regs [ 0 ]!= - 1 ) { data [ l ++ ] = 0x67 ; } data [ l ++ ] = 0x48 ; } } else if ( op -> operands [ 1 ]. type & OT_DWORD ) { data [ l ++ ] = 0x44 ; } else if (! ( op -> operands [ 1 ]. type & OT_QWORD ) ) { data [ l ++ ] = 0x67 ; } if ( op -> operands [ 1 ]. type & OT_QWORD && op -> operands [ 0 ]
Buggy code:
 static int flattenSubquery ( Parse * pParse, Select * p, int iFrom, int isAgg ) { const char * zSavedAuthContext = pParse -> zAuthContext ; Select * pParent ; Select * pSub ; Select * pSub1 ; SrcList * pSrc ; SrcList * pSubSrc ; int iParent ; int iNewParent = - 1 ; int isLeftJoin = 0 ; int i ; Expr * pWhere ; struct SrcList_item * pSubitem ; sqlite3 * db = pParse -> db ; assert ( p!= 0 ) ; assert ( p -> pPrior == 0 ) ; if ( OptimizationDisabled ( db, SQLITE_QueryFlattener ) ) return 0 ; pSrc = p -> pSrc ; assert ( pSrc && iFrom >= 0 && iFrom < pSrc -> nSrc ) ; pSubitem = & pSrc -> a [ iFrom ] ; iParent = pSubitem -> iCursor ; pSub = pSubitem -> pSelect ; assert ( pSub!= 0 ) ; # ifndef SQLITE_OMIT_WINDOWFUNC if ( p -> pWin || pSub -> pWin ) return 0 ; # endif pSubSrc = pSub -> pSrc ; assert ( pSubSrc ) ; if ( pSub -> pLimit && p -> pLimit ) return 0 ; if ( pSub -> pLimit && pSub -> pLimit -> pRight ) return 0 ; if ( ( p -> selFlags & SF_Compound )!= 0 && pSub -> pLimit ) { return 0 ; } if ( pSubSrc -> nSrc == 0 ) return 0 ; if ( pSub -> selFlags & SF_Distinct ) return 0 ; if ( pSub -> pLimit && ( pSrc -> nSrc > 1 || isAgg ) ) { return 0 ; } if ( p -> pOrderBy && pSub -> pOrderBy ) { return 0 ; } if ( isAgg && pSub -> pOrderBy ) return 0 ; if ( pSub -> pLimit && p -> pWhere ) return 0 ; if ( pSub -> pLimit && ( p -> selFlags & SF_Distinct )!= 0 ) { return 0 ; } if ( pSub -> selFlags & ( SF_Recursive ) ) { return 0 ; } if ( ( pSubitem -> fg. jointype & JT_OUTER )!= 0 ) { isLeftJoin

Fix:
<S2SV_ModStart>. pTab ) || ( p -> selFlags & SF_Distinct )!= 0
Buggy code:
 static inline LineContribType * _gdContributionsCalc ( unsigned int line_size, unsigned int src_size, double scale_d, const interpolation_method pFilter ) { double width_d ; double scale_f_d = 1.0 ; const double filter_width_d = DEFAULT_BOX_RADIUS ; int windows_size ; unsigned int u ; LineContribType * res ; if ( scale_d < 1.0 ) { width_d = filter_width_d // scale_d ; scale_f_d = scale_d ; } else { width_d = filter_width_d ; } windows_size = 2 * ( int ) ceil ( width_d ) + 1 ; res = _gdContributionsAlloc ( line_size, windows_size ) ; for ( u = 0 ; u < line_size ; u ++ ) { const double dCenter = ( double ) u // scale_d ; register int iLeft = MAX ( 0, ( int ) floor ( dCenter - width_d ) ) ; int iRight = MIN ( ( int ) ceil ( dCenter + width_d ), ( int ) src_size - 1 ) ; double dTotalWeight = 0.0 ; <START_BUG> int iSrc ; <END_BUG> res -> ContribRow [ u ]. Left = iLeft ; res -> ContribRow [ u ]. Right = iRight ; if ( iRight - iLeft + 1 > windows_size ) { if ( iLeft < ( ( int ) src_size - 1 // 2 ) ) { iLeft ++ ; } else { iRight -- ; } }  for ( iSrc = iLeft ; iSrc <= iRight ; iSrc ++ ) { <START_BUG> <END_BUG> dTotalWeight += ( res -> ContribRow [ u ]. Weights [ iSrc - iLeft ] = scale_f_d * ( * pFilter ) ( scale_f_d * ( dCenter - ( double ) iSrc ) ) ) ;  } if ( dTotalWeight < 0.0 ) { _gdContributionsFree ( res ) ; return NULL ; } if ( dTotalWeight > 0.0 ) { for ( iSrc = iLeft ; iSrc <= iRight ; iSrc ++ ) { res -> ContribRow [ u ]. Weights [ iSrc - iLeft ] //= dTotalWeight ; } } } return res ; }

Fix:
<S2SV_ModStart> ; int iSrc <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; } } <S2SV_ModEnd> res -> ContribRow <S2SV_ModStart> u ]. Left = iLeft ; res -> ContribRow [ u ]. Right = iRight ; for ( iSrc = iLeft ; iSrc <= iRight ; iSrc ++ ) { dTotalWeight += ( res -> ContribRow [ u ].
Buggy code:
 GPLOT * gplotCreate ( const char * rootname, l_int32 outformat, const char * title, const char * xlabel, const char * ylabel ) { char * newroot ; <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> l_int32 badchar ; GPLOT * gplot ; PROCNAME ( "gplotCreate" ) ; if (! rootname ) return ( GPLOT * ) ERROR_PTR ( "rootname   not   defined", procName, NULL ) ; if ( outformat!= GPLOT_PNG && outformat!= GPLOT_PS && outformat!= GPLOT_EPS && outformat!= GPLOT_LATEX ) return ( GPLOT * ) ERROR_PTR ( "outformat   invalid", procName, NULL ) ; stringCheckForChars ( rootname, "`;&|><\\"?*", & badchar ) ; if ( badchar ) return ( GPLOT * ) ERROR_PTR ( "invalid   rootname", procName, NULL ) ; if ( ( gplot = ( GPLOT * ) LEPT_CALLOC ( 1, sizeof ( GPLOT ) ) ) == NULL ) return ( GPLOT * ) ERROR_PTR ( "gplot   not   made", procName, NULL ) ; gplot -> cmddata = sarrayCreate ( 0 ) ; gplot -> datanames = sarrayCreate ( 0 ) ; gplot -> plotdata = sarrayCreate ( 0 ) ; gplot -> plottitles = sarrayCreate ( 0 ) ; gplot -> plotstyles = numaCreate ( 0 ) ; newroot = genPathname ( rootname, NULL ) ; gplot -> rootname = newroot ; gplot -> outformat = outformat ;  snprintf ( buf, L_BUF_SIZE, "%s.cmd", rootname ) ; <START_BUG> gplot -> cmdname = stringNew ( buf ) ; if ( outformat == GPLOT_PNG ) <END_BUG> snprintf ( buf, L_BUF_SIZE, "%s.png", newroot ) ;  else if ( outformat == GPLOT_PS ) <START_BUG> snprintf ( buf, L_BUF_SIZE, "%s.ps", newroot ) ; <END_BUG> else if ( outformat == GPLOT_EPS

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; l_int32 <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.cmd", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.png", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.ps", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.eps", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.tex",
Buggy code:
 static void send_ssi_file ( struct mg_connection * conn, const char * path, struct mg_file * filep, int include_level ) { char buf [ MG_BUF_LEN ] ; int ch, offset, len, in_tag, in_ssi_tag ; if ( include_level > 10 ) { mg_cry_internal ( conn, "SSI   #include   level   is   too   deep   (%s)", path ) ; return ; } in_tag = in_ssi_tag = len = offset = 0 ; while ( ( ch = mg_fgetc ( filep, offset ++ ) )!= EOF ) { if ( in_tag ) { if ( ch == '>' ) { buf [ len ++ ] = '>' ; if ( in_ssi_tag ) { buf [ len ] = 0 ; <START_BUG> if (! memcmp ( buf + 5, "include", 7 ) ) { <END_BUG> do_ssi_include ( conn, path, buf + 12, include_level + 1 ) ; # if! defined ( NO_POPEN )  } else if (! memcmp ( buf + 5, "exec", 4 ) ) { <START_BUG> do_ssi_exec ( conn, buf + 9 ) ; # endif } else { mg_cry_internal ( conn, "%s:   unknown   SSI   " "command:   \\"%s\\"", path, buf ) ; } len = 0 ; in_ssi_tag = in_tag = 0 ; } else { ( void ) mg_write ( conn, buf, ( size_t ) len ) ; len = 0 ; in_tag = 0 ; } } else { buf [ len ++ ] = ( char ) ( ch & 0xff ) ; if ( ( len == 5 ) &&! memcmp ( buf, "<!--#", 5 ) ) { in_ssi_tag = 1 ; } if ( ( len + 2 ) > ( int ) sizeof ( buf ) ) { mg_cry_internal ( conn, "%s:   tag   is   too   large", path ) ; return ; } } } else { if ( ch == '<' ) { in_tag = 1 ; if ( len > 0 ) { ( void ) mg_write ( conn, buf, ( size_t ) len ) ; } len =<END_BUG>

Fix:
<S2SV_ModStart> ; if ( ( len > 12 ) && <S2SV_ModStart> else if ( ( len > 9 ) &&
Buggy code:
 int treeRead ( struct READER * reader, struct DATAOBJECT * data ) { int i, j, err, olen, elements, size, x, y, z, b, e, dy, dz, sx, sy, sz, dzy, szy ; char * input, * output ; uint8_t node_type, node_level ; uint16_t entries_used ; uint32_t size_of_chunk ; uint32_t filter_mask ; uint64_t address_of_left_sibling, address_of_right_sibling, start [ 4 ], child_pointer, key, store ; char buf [ 4 ] ; UNUSED ( node_level ) ; UNUSED ( address_of_right_sibling ) ; UNUSED ( address_of_left_sibling ) ; UNUSED ( key ) ; if ( data -> ds. dimensionality > 3 ) { log ( "TREE   dimensions   >   3" ) ; return MYSOFA_INVALID_FORMAT ; } if ( fread ( buf, 1, 4, reader -> fhd )!= 4 || strncmp ( buf, "TREE", 4 ) ) { log ( "cannot   read   signature   of   TREE\\n" ) ; return MYSOFA_INVALID_FORMAT ; } log ( "%08lX   %.4s\\n", ( uint64_t ) ftell ( reader -> fhd ) - 4, buf ) ; node_type = ( uint8_t ) fgetc ( reader -> fhd ) ; node_level = ( uint8_t ) fgetc ( reader -> fhd ) ; entries_used = ( uint16_t ) readValue ( reader, 2 ) ; if ( entries_used > 0x1000 ) return MYSOFA_UNSUPPORTED_FORMAT ; address_of_left_sibling = readValue ( reader, reader -> superblock. size_of_offsets ) ; address_of_right_sibling = readValue ( reader, reader -> superblock. size_of_offsets ) ; elements = 1 ; for ( j = 0 ; j < data -> ds. dimensionality ; j ++ ) elements *= data -> datalayout_chunk [ j ] ; dy = data -> datalayout_chunk [ 1 ] ; dz = data -> datalayout_chunk [ 2 ] ; sx = data -> ds. dimension_size [ 0 ] ; sy = data ->

Fix:
<S2SV_ModStart> 0 ] ; <S2SV_ModEnd> j = x <S2SV_ModStart> + b ; if ( j >= 0 && j < elements * size ) { <S2SV_ModStart> 0 ] ; <S2SV_ModEnd> j = ( <S2SV_ModStart> + b ; if ( j >= 0 && j < elements * size ) { <S2SV_ModStart> 0 ] ; <S2SV_ModEnd> j = ( <S2SV_ModStart> + b ; if ( j >= 0 && j < elements * size ) {
Buggy code:
 unsigned paravirt_patch_jmp ( void * insnbuf, const void * target, unsigned long addr, unsigned len ) { struct branch * b = insnbuf ; unsigned long delta = ( unsigned long ) target - ( addr + 5 ) ; <START_BUG> if ( len < 5 ) <END_BUG>  return len ; <START_BUG> b -> opcode = 0xe9 ; b -> delta = delta ; return 5 ; }<END_BUG>

Fix:
<S2SV_ModStart> < 5 ) { # ifdef CONFIG_RETPOLINE WARN_ONCE ( "Failing <S2SV_blank> to <S2SV_blank> patch <S2SV_blank> indirect <S2SV_blank> JMP <S2SV_blank> in <S2SV_blank> %ps\\n", ( void * ) addr ) ; # endif <S2SV_ModStart> return len ; }
Buggy code:
 static struct sock * unix_create1 ( struct net * net, struct socket * sock, int kern ) { struct sock * sk = NULL ; struct unix_sock * u ; atomic_long_inc ( & unix_nr_socks ) ; if ( atomic_long_read ( & unix_nr_socks ) > 2 * get_max_files ( ) ) goto out ; sk = sk_alloc ( net, PF_UNIX, GFP_KERNEL, & unix_proto, kern ) ; if (! sk ) goto out ; sock_init_data ( sock, sk ) ; lockdep_set_class ( & sk -> sk_receive_queue. lock, & af_unix_sk_receive_queue_lock_key ) ; sk -> sk_write_space = unix_write_space ; sk -> sk_max_ack_backlog = net -> unx. sysctl_max_dgram_qlen ; sk -> sk_destruct = unix_sock_destructor ; u = unix_sk ( sk ) ; u -> path. dentry = NULL ; u -> path. mnt = NULL ; spin_lock_init ( & u -> lock ) ; atomic_long_set ( & u -> inflight, 0 ) ; INIT_LIST_HEAD ( & u -> link ) ; mutex_init ( & u -> readlock ) ; init_waitqueue_head ( & u -> peer_wait ) ; <START_BUG> unix_insert_socket ( unix_sockets_unbound ( sk ), sk ) ; <END_BUG> out : if ( sk == NULL ) atomic_long_dec ( & unix_nr_socks ) ; else { local_bh_disable ( ) ; sock_prot_inuse_add ( sock_net ( sk ), sk -> sk_prot, 1 ) ; local_bh_enable ( ) ; } return sk ; }

Fix:
<S2SV_ModStart> peer_wait ) ; init_waitqueue_func_entry ( & u -> peer_wake, unix_dgram_peer_wake_relay ) ;
Buggy code:
 static int set_geometry ( unsigned int cmd, struct floppy_struct * g, int drive, int type, struct block_device * bdev ) { int cnt ; if ( g -> sect <= 0 || <START_BUG> g -> head <= 0 || <END_BUG> g -> track <= 0 || g -> track > UDP -> tracks >> STRETCH ( g ) || ( g -> stretch & ~ ( FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK ) )!= 0 ) return - EINVAL ; if ( type ) { if (! capable ( CAP_SYS_ADMIN ) ) return - EPERM ; mutex_lock ( & open_lock ) ; if ( lock_fdc ( drive ) ) { mutex_unlock ( & open_lock ) ; return - EINTR ; } floppy_type [ type ] = * g ; floppy_type [ type ]. name = "user   format" ; for ( cnt = type << 2 ; cnt < ( type << 2 ) + 4 ; cnt ++ ) floppy_sizes [ cnt ] = floppy_sizes [ cnt + 0x80 ] = floppy_type [ type ]. size + 1 ; process_fd_request ( ) ; for ( cnt = 0 ; cnt < N_DRIVE ; cnt ++ ) { struct block_device * bdev = opened_bdev [ cnt ] ; if (! bdev || ITYPE ( drive_state [ cnt ]. fd_device )!= type ) continue ; __invalidate_device ( bdev, true ) ; } mutex_unlock ( & open_lock ) ; } else { int oldStretch ; if ( lock_fdc ( drive ) ) return - EINTR ; if ( cmd!= FDDEFPRM ) { if ( poll_drive ( true, FD_RAW_NEED_DISK ) == - EINTR ) return - EINTR ; } oldStretch = g -> stretch ; user_params [ drive ] = * g ; if ( buffer_drive == drive ) SUPBOUND ( buffer_max, user_params [ drive ]. sect ) ; current_type [ drive ] = & user_params [ drive ] ; floppy_sizes [ drive ] = user_params [ drive ]. size ; if ( cmd == FDDEFPRM ) DRS

Fix:
<S2SV_ModStart> -> head <= 0 || ( unsigned char ) ( ( g -> sect << 2 ) >> FD_SIZECODE ( g ) ) ==
Buggy code:
 <START_BUG> void impeg2d_dec_pnb_mb_params ( dec_state_t * ps_dec ) <END_BUG> { stream_t * ps_stream = & ps_dec -> s_bit_stream ; UWORD16 u2_mb_addr_incr ; UWORD16 u2_total_len ; UWORD16 u2_len ; UWORD16 u2_mb_type ; UWORD32 u4_next_word ; const dec_mb_params_t * ps_dec_mb_params ; if ( impeg2d_bit_stream_nxt ( ps_stream, 1 ) == 1 ) { impeg2d_bit_stream_flush ( ps_stream, 1 ) ; } else { u2_mb_addr_incr = impeg2d_get_mb_addr_incr ( ps_stream ) ; if ( ps_dec -> u2_first_mb ) { ps_dec -> u2_mb_x = u2_mb_addr_incr - 1 ; ps_dec -> u2_mb_x = MIN ( ps_dec -> u2_mb_x, ( ps_dec -> u2_num_horiz_mb - 1 ) ) ; u2_mb_addr_incr = 1 ; ps_dec -> u2_first_mb = 0 ; } else { if ( ps_dec -> u2_is_mpeg2 && ( ( ps_dec -> u2_mb_x + u2_mb_addr_incr ) > ps_dec -> u2_num_horiz_mb ) ) { u2_mb_addr_incr = ps_dec -> u2_num_horiz_mb - ps_dec -> u2_mb_x ; } impeg2d_dec_skip_mbs ( ps_dec, ( UWORD16 ) ( u2_mb_addr_incr - 1 ) ) ; } } u4_next_word = ( UWORD16 ) impeg2d_bit_stream_nxt ( ps_stream, 16 ) ; { u2_mb_type = ps_dec -> pu2_mb_type [ BITS ( ( UWORD16 ) u4_next_word, 15, 10 ) ] ; u2_len = BITS ( u2

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> WORD32 <S2SV_ModEnd> impeg2d_dec_pnb_mb_params ( dec_state_t <S2SV_ModStart> -> s_mb_type ; if ( NULL == ps_dec_mb_params -> pf_func_mb_params ) return - 1 ; <S2SV_ModStart> -> s_mb_type ; if ( NULL == ps_dec_mb_params -> pf_func_mb_params ) return - 1 ; <S2SV_ModStart> ; } } return 0 ;
Buggy code:
 <START_BUG> int vp8_denoiser_filter_neon ( YV12_BUFFER_CONFIG * mc_running_avg, <END_BUG> YV12_BUFFER_CONFIG * running_avg, MACROBLOCK * signal, unsigned int motion_magnitude, int y_offset, int uv_offset ) { const uint8x16_t v_level1_adjustment = vdupq_n_u8 ( ( motion_magnitude <= MOTION_MAGNITUDE_THRESHOLD )? 4 : 3 ) ; const uint8x16_t v_delta_level_1_and_2 = vdupq_n_u8 ( 1 ) ; const uint8x16_t v_delta_level_2_and_3 = vdupq_n_u8 ( 2 ) ; const uint8x16_t v_level1_threshold = vdupq_n_u8 ( 4 ) ; const uint8x16_t v_level2_threshold = vdupq_n_u8 ( 8 ) ; const uint8x16_t v_level3_threshold = vdupq_n_u8 ( 16 ) ;  unsigned char * sig = signal -> thismb ; <START_BUG> int sig_stride = 16 ; unsigned char * mc_running_avg_y = mc_running_avg -> y_buffer + y_offset ; int mc_running_avg_y_stride = mc_running_avg -> y_stride ; unsigned char * running_avg_y = running_avg -> y_buffer + y_offset ; int running_avg_y_stride = running_avg -> y_stride ; int i ; int sum_diff = 0 ; <END_BUG> for ( i = 0 ; i < 16 ; ++ i ) {  <START_BUG> int8x16_t v_sum_diff = vdupq_n_s8 ( 0 ) ; <END_BUG> uint8x16_t v_running_avg_y ; const uint8x16_t v_sig = vld1q_u8 ( sig ) ; const uint8x16_t v_mc_running_avg_y = vld1q_u8 ( mc_running_avg_y ) ; const uint8x16_t v_abs_diff = vabdq_u8 ( v_sig, v_mc_running_

Fix:
<S2SV_ModStart> int vp8_denoiser_filter_neon ( unsigned char * mc_running_avg_y, int mc_running_avg_y_stride, unsigned char * running_avg_y, int running_avg_y_stride, <S2SV_ModEnd> unsigned char * <S2SV_ModStart> char * sig, int sig_stride, unsigned int motion_magnitude, int increase_denoising ) { int shift_inc = ( increase_denoising && motion_magnitude <= MOTION_MAGNITUDE_THRESHOLD )? 1 : 0 ; const uint8x16_t v_level1_adjustment = vmovq_n_u8 ( ( motion_magnitude <= MOTION_MAGNITUDE_THRESHOLD )? 4 + shift_inc : 3 ) ; const uint8x16_t v_delta_level_1_and_2 = vdupq_n_u8 ( 1 ) ; const uint8x16_t v_delta_level_2_and_3 = vdupq_n_u8 ( 2 ) ; const uint8x16_t v_level1_threshold = vmovq_n_u8 ( 4 + shift_inc
Buggy code:
 static void esis_print ( netdissect_options * ndo, const uint8_t * pptr, u_int length ) { const uint8_t * optr ; u_int li, esis_pdu_type, source_address_length, source_address_number ; const struct esis_header_t * esis_header ; if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "ES-IS" ) ) ; if ( length <= 2 ) { ND_PRINT ( ( ndo, ndo -> ndo_qflag? "bad   pkt!" : "no   header   at   all!" ) ) ; return ; } esis_header = ( const struct esis_header_t * ) pptr ; ND_TCHECK ( * esis_header ) ; li = esis_header -> length_indicator ; optr = pptr ; if ( esis_header -> nlpid!= NLPID_ESIS ) { ND_PRINT ( ( ndo, "   nlpid   0x%02x   packet   not   supported", esis_header -> nlpid ) ) ; return ; } if ( esis_header -> version!= ESIS_VERSION ) { ND_PRINT ( ( ndo, "   version   %d   packet   not   supported", esis_header -> version ) ) ; return ; } if ( li > length ) { ND_PRINT ( ( ndo, "   length   indicator(%u)   >   PDU   size   (%u)!", li, length ) ) ; return ; } if ( li < sizeof ( struct esis_header_t ) + 2 ) { ND_PRINT ( ( ndo, "   length   indicator   %u   <   min   PDU   size:", li ) ) ; while ( pptr < ndo -> ndo_snapend ) ND_PRINT ( ( ndo, "%02X", * pptr ++ ) ) ; return ; } esis_pdu_type = esis_header -> type & ESIS_PDU_TYPE_MASK ; if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "%s%s,   length   %u",

Fix:
<S2SV_ModStart> ; if ( snpal == 6 ) ND_PRINT ( ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> SNPA <S2SV_blank> (length: <S2SV_blank> %u): <S2SV_blank> %s", snpal, etheraddr_string ( ndo, snpa ) ) ) ; else ND_PRINT ( ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> SNPA <S2SV_blank> (length: <S2SV_blank> %u): <S2SV_blank> %s", snpal, linkaddr_string ( ndo, snpa, LINKADDR_OTHER, snpal ) ) ) ; if ( netal!= <S2SV_ModEnd> 0 ) ND_PRINT <S2SV_ModStart> ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> NET <S2SV_blank> (length: <S2SV_blank> %u) <S2SV_blank> %s", netal, <S2SV_ModEnd> isonsap_string ( ndo
Buggy code:
 int ssl3_get_record ( SSL * s ) { int ssl_major, ssl_minor, al ; int enc_err, n, i, ret = - 1 ; SSL3_RECORD * rr ; SSL3_BUFFER * rbuf ; SSL_SESSION * sess ; unsigned char * p ; unsigned char md [ EVP_MAX_MD_SIZE ] ; short version ; unsigned mac_size ; unsigned int num_recs = 0 ; unsigned int max_recs ; unsigned int j ; rr = RECORD_LAYER_get_rrec ( & s -> rlayer ) ; rbuf = RECORD_LAYER_get_rbuf ( & s -> rlayer ) ; max_recs = s -> max_pipelines ; if ( max_recs == 0 ) max_recs = 1 ; sess = s -> session ; do { if ( ( RECORD_LAYER_get_rstate ( & s -> rlayer )!= SSL_ST_READ_BODY ) || ( RECORD_LAYER_get_packet_length ( & s -> rlayer ) < SSL3_RT_HEADER_LENGTH ) ) { n = ssl3_read_n ( s, SSL3_RT_HEADER_LENGTH, SSL3_BUFFER_get_len ( rbuf ), 0, num_recs == 0? 1 : 0 ) ; if ( n <= 0 ) return ( n ) ; RECORD_LAYER_set_rstate ( & s -> rlayer, SSL_ST_READ_BODY ) ; p = RECORD_LAYER_get_packet ( & s -> rlayer ) ; if ( s -> server && RECORD_LAYER_is_first_record ( & s -> rlayer ) && ( p [ 0 ] & 0x80 ) && ( p [ 2 ] == SSL2_MT_CLIENT_HELLO ) ) { rr [ num_recs ]. type = SSL3_RT_HANDSHAKE ; rr [ num_recs ]. rec_version = SSL2_VERSION ; rr [ num_recs ]. length = ( ( p [ 0 ] & 0x7f ) << 8 ) | p [ 1 ] ; if ( rr [ num_recs ]. length > SSL3_BUFFER_get_len ( rbuf ) - SSL2_RT_HEADER_LENGTH ) { al = SSL_AD_RECORD_OVERFLOW ; SSLerr ( SSL_F

Fix:
<S2SV_ModStart> ; if ( SSL_READ_ETM <S2SV_ModEnd> ( s ) <S2SV_ModStart> ) && (! SSL_READ_ETM ( s ) && <S2SV_ModStart> )!= NULL <S2SV_ModEnd> ) ) {