nus-yam/ex-repair huggingface dataset:
Buggy code:
 int luaG_traceexec ( lua_State * L, const Instruction * pc ) { CallInfo * ci = L -> ci ; lu_byte mask = L -> hookmask ; <START_BUG> int counthook ; <END_BUG> if (! ( mask & ( LUA_MASKLINE | LUA_MASKCOUNT ) ) ) { ci -> u. l. trap = 0 ; return 0 ; } pc ++ ; ci -> u. l. savedpc = pc ; counthook = ( -- L -> hookcount == 0 && ( mask & LUA_MASKCOUNT ) ) ; if ( counthook ) resethookcount ( L ) ; else if (! ( mask & LUA_MASKLINE ) ) return 1 ; if ( ci -> callstatus & CIST_HOOKYIELD ) { ci -> callstatus &= ~ CIST_HOOKYIELD ; return 1 ; } if (! isIT ( * ( ci -> u. l. savedpc - 1 ) ) ) L -> top = ci -> top ; if ( counthook ) luaD_hook ( L, LUA_HOOKCOUNT, - 1, 0, 0 ) ; if ( mask & LUA_MASKLINE ) {  const Proto * p = ci_func ( ci ) -> p ; <START_BUG> int npci = pcRel ( pc, p ) ; if ( npci == 0 || <END_BUG> pc <= L -> oldpc ||  <START_BUG> changedline ( p, pcRel ( L -> oldpc, p ), npci ) ) { <END_BUG> int newline = luaG_getfuncline ( p, npci ) ; luaD_hook ( L, LUA_HOOKLINE, newline, 0, 0 ) ; }  L -> oldpc = pc ; <START_BUG> } if ( L -> status == LUA_YIELD ) { if ( counthook ) L -> hookcount = 1 ; ci -> u. l. savedpc -- ; ci -> callstatus |= CIST_HOOKYIELD ; luaD_throw ( L, LUA_YIELD ) ; } return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> hookmask ; const Proto * p = ci_func ( ci ) -> p ; int counthook ; int oldpc = ( L -> oldpc < p -> sizecode )? L -> oldpc : 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> LUA_MASKLINE ) { <S2SV_ModEnd> int npci = <S2SV_ModStart> || pc <= invpcRel ( oldpc, p ) <S2SV_ModEnd> || changedline ( <S2SV_ModStart> ( p, oldpc <S2SV_ModEnd>, npci ) <S2SV_ModStart> -> oldpc = npci <S2SV_ModEnd> ; } if
Buggy code:
 error_t webSocketParseHeaderField ( WebSocket * webSocket, char_t * line ) { char_t * separator ; char_t * name ; char_t * value ; WebSocketHandshakeContext * handshakeContext ; handshakeContext = & webSocket -> handshakeContext ; TRACE_DEBUG ( "%s", line ) ; <START_BUG> separator = strchr ( line, ':' ) ; <END_BUG> if ( separator!= NULL ) { * separator = '\\0' ; name = strTrimWhitespace ( line ) ; value = strTrimWhitespace ( separator + 1 ) ; if (! osStrcasecmp ( name, "Upgrade" ) ) { if (! osStrcasecmp ( value, "websocket" ) ) handshakeContext -> upgradeWebSocket = TRUE ; } else if (! osStrcasecmp ( name, "Connection" ) ) { webSocketParseConnectionField ( webSocket, value ) ; } else if (! osStrcasecmp ( name, "Sec-WebSocket-Key" ) ) { if ( webSocket -> endpoint == WS_ENDPOINT_SERVER ) { strSafeCopy ( handshakeContext -> clientKey, value, WEB_SOCKET_CLIENT_KEY_SIZE + 1 ) ; } } else if (! osStrcasecmp ( name, "Sec-WebSocket-Accept" ) ) { if ( webSocket -> endpoint == WS_ENDPOINT_CLIENT ) { strSafeCopy ( handshakeContext -> serverKey, value, WEB_SOCKET_SERVER_KEY_SIZE + 1 ) ; } } # if ( WEB_SOCKET_BASIC_AUTH_SUPPORT == ENABLED || WEB_SOCKET_DIGEST_AUTH_SUPPORT == ENABLED ) else if (! osStrcasecmp ( name, "WWW-Authenticate" ) ) { webSocketParseAuthenticateField ( webSocket, value ) ; } # endif else if (! osStrcasecmp ( name, "Content-Length" ) ) { handshakeContext -> contentLength = osStrtoul ( value, NULL, 10 ) ; } } return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( line,
Buggy code:
 Datum hstore_from_arrays ( PG_FUNCTION_ARGS ) { int32 buflen ; HStore * out ; Pairs * pairs ; Datum * key_datums ; bool * key_nulls ; int key_count ; Datum * value_datums ; bool * value_nulls ; int value_count ; ArrayType * key_array ; ArrayType * value_array ; int i ; if ( PG_ARGISNULL ( 0 ) ) PG_RETURN_NULL ( ) ; key_array = PG_GETARG_ARRAYTYPE_P ( 0 ) ; Assert ( ARR_ELEMTYPE ( key_array ) == TEXTOID ) ; if ( ARR_NDIM ( key_array ) > 1 ) ereport ( ERROR, ( errcode ( ERRCODE_ARRAY_SUBSCRIPT_ERROR ), errmsg ( "wrong   number   of   array   subscripts" ) ) ) ; deconstruct_array ( key_array, TEXTOID, - 1, false, 'i', <START_BUG> & key_datums, & key_nulls, & key_count ) ; <END_BUG> if ( PG_ARGISNULL ( 1 ) ) { value_array = NULL ; value_count = key_count ; value_datums = NULL ; value_nulls = NULL ; } else { value_array = PG_GETARG_ARRAYTYPE_P ( 1 ) ; Assert ( ARR_ELEMTYPE ( value_array ) == TEXTOID ) ; if ( ARR_NDIM ( value_array ) > 1 ) ereport ( ERROR, ( errcode ( ERRCODE_ARRAY_SUBSCRIPT_ERROR ), errmsg ( "wrong   number   of   array   subscripts" ) ) ) ; if ( ( ARR_NDIM ( key_array ) > 0 || ARR_NDIM ( value_array ) > 0 ) && ( ARR_NDIM ( key_array )!= ARR_NDIM ( value_array ) || ARR_DIMS ( key_array ) [ 0 ]!= ARR_DIMS ( value_array ) [ 0 ] || ARR_LBOUND ( key_array ) [ 0 ]!= ARR_LBOUND ( value_array ) [ 0 ] ) ) ereport ( ERROR, ( errcode ( ERRCODE_ARRAY_SUBSCRIPT_ERROR ), errmsg ( "arrays   must   have   same

Fix:
<S2SV_ModStart>, & key_count ) ; if ( key_count > MaxAllocSize // sizeof ( Pairs ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> pairs <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", key_count, ( int ) ( MaxAllocSize // sizeof ( Pairs ) ) ) )
Buggy code:
 static int __fpu__restore_sig ( void __user * buf, void __user * buf_fx, int size ) { int ia32_fxstate = ( buf!= buf_fx ) ; struct task_struct * tsk = current ; struct fpu * fpu = & tsk -> thread. fpu ; int state_size = fpu_kernel_xstate_size ; u64 xfeatures = 0 ; int fx_only = 0 ; ia32_fxstate &= ( IS_ENABLED ( CONFIG_X86_32 ) || IS_ENABLED ( CONFIG_IA32_EMULATION ) ) ; if (! buf ) { fpu__clear ( fpu ) ; return 0 ; } if (! access_ok ( VERIFY_READ, buf, size ) ) return - EACCES ; fpu__activate_curr ( fpu ) ; if (! static_cpu_has ( X86_FEATURE_FPU ) ) return fpregs_soft_set ( current, NULL, 0, sizeof ( struct user_i387_ia32_struct ), NULL, buf )!= 0 ; if ( use_xsave ( ) ) { struct _fpx_sw_bytes fx_sw_user ; if ( unlikely ( check_for_xstate ( buf_fx, buf_fx, & fx_sw_user ) ) ) { state_size = sizeof ( struct fxregs_state ) ; fx_only = 1 ; trace_x86_fpu_xstate_check_failed ( fpu ) ; } else { state_size = fx_sw_user. xstate_size ; xfeatures = fx_sw_user. xfeatures ; } } if ( ia32_fxstate ) { struct fpu * fpu = & tsk -> thread. fpu ; struct user_i387_ia32_struct env ; int err = 0 ; fpu__drop ( fpu ) ; <START_BUG> if ( using_compacted_format ( ) ) <END_BUG> err = copy_user_to_xstate ( & fpu -> state. xsave, buf_fx ) ;  else <START_BUG> <END_BUG> err = __copy_from_user ( & fpu -> state. xsave, buf_fx, state_size ) ;  if ( err || __copy_from_user ( & env, buf, sizeof ( env )

Fix:
<S2SV_ModStart> ( ) ) { <S2SV_ModStart> buf_fx ) ; } else { <S2SV_ModEnd> err = __copy_from_user <S2SV_ModStart> state_size ) ; if (! err && state_size > offsetof ( struct xregs_state, header ) && fpu -> state. xsave. header. xcomp_bv ) err = - EINVAL ; }
Buggy code:
 int kvm_arch_vcpu_init ( struct kvm_vcpu * vcpu ) { struct page * page ; struct kvm * kvm ; int r ; BUG_ON ( vcpu -> kvm == NULL ) ; kvm = vcpu -> kvm ; vcpu -> arch. emulate_ctxt. ops = & emulate_ops ; if (! irqchip_in_kernel ( kvm ) || kvm_vcpu_is_bsp ( vcpu ) ) vcpu -> arch. mp_state = KVM_MP_STATE_RUNNABLE ; else vcpu -> arch. mp_state = KVM_MP_STATE_UNINITIALIZED ; page = alloc_page ( GFP_KERNEL | __GFP_ZERO ) ; if (! page ) { r = - ENOMEM ; goto fail ; } vcpu -> arch. pio_data = page_address ( page ) ; kvm_set_tsc_khz ( vcpu, max_tsc_khz ) ; r = kvm_mmu_create ( vcpu ) ; if ( r < 0 ) goto fail_free_pio_data ; if ( irqchip_in_kernel ( kvm ) ) { r = kvm_create_lapic ( vcpu ) ; if ( r < 0 ) goto fail_mmu_destroy ; } else static_key_slow_inc ( & kvm_no_apic_vcpu ) ; vcpu -> arch. mce_banks = kzalloc ( KVM_MAX_MCE_BANKS * sizeof ( u64 ) * 4, GFP_KERNEL ) ; if (! vcpu -> arch. mce_banks ) { r = - ENOMEM ; goto fail_free_lapic ; } vcpu -> arch. mcg_cap = KVM_MAX_MCE_BANKS ; if (! zalloc_cpumask_var ( & vcpu -> arch. wbinvd_dirty_mask, GFP_KERNEL ) ) goto fail_free_mce_banks ; r = fx_init ( vcpu ) ; if ( r ) goto fail_free_wbinvd_dirty_mask ; vcpu -> arch. ia32_tsc_adjust

Fix:
<S2SV_ModStart> = 0x0 ; vcpu -> arch. pv_time_enabled = false ;
Buggy code:
 int main ( int argc, char * * argv ) { int frame_cnt = 0 ; FILE * outfile = NULL ; vpx_codec_ctx_t codec ; VpxVideoReader * reader = NULL ; const VpxInterface * decoder = NULL ; const VpxVideoInfo * info = NULL ; exec_name = argv [ 0 ] ; if ( argc!= 3 ) die ( "Invalid   number   of   arguments." ) ; reader = vpx_video_reader_open ( argv [ 1 ] ) ; if (! reader ) die ( "Failed   to   open   %s   for   reading.", argv [ 1 ] ) ; if (! ( outfile = fopen ( argv [ 2 ], "wb" ) ) ) die ( "Failed   to   open   %s   for   writing.", argv [ 2 ] ) ; info = vpx_video_reader_get_info ( reader ) ; decoder = get_vpx_decoder_by_fourcc ( info -> codec_fourcc ) ; if (! decoder ) die ( "Unknown   input   codec." ) ; <START_BUG> printf ( "Using   %s\\n", vpx_codec_iface_name ( decoder -> interface ( ) ) ) ; <END_BUG>  if ( vpx_codec_dec_init ( & codec, decoder -> interface ( ), NULL, 0 ) ) <START_BUG> die_codec ( & codec, "Failed   to   initialize   decoder." ) ; while ( vpx_video_reader_read_frame ( reader ) ) { vpx_codec_iter_t iter = NULL ; vpx_image_t * img = NULL ; size_t frame_size = 0 ; const unsigned char * frame = vpx_video_reader_get_frame ( reader, & frame_size ) ; if ( vpx_codec_decode ( & codec, frame, ( unsigned int ) frame_size, NULL, 0 ) ) die_codec ( & codec, "Failed   to   decode   frame." ) ; while ( ( img = vpx_codec_get_frame ( & codec, & iter ) )!= NULL ) { vpx_img_write ( img, outfile ) ; ++ frame_cnt ; } } printf ( "Processed   %d   frames.\\n", frame_cnt ) ; if ( vpx_codec_destroy ( & codec )<END_BUG>

Fix:
<S2SV_ModStart> ( decoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart>, decoder -> codec_interface <S2SV_ModEnd> ( ),
Buggy code:
 static RList * r_bin_wasm_get_element_entries ( RBinWasmObj * bin, RBinWasmSection * sec ) { RList * ret = NULL ; RBinWasmElementEntry * ptr = NULL ; if (! ( ret = r_list_newf ( ( RListFree ) free ) ) ) { return NULL ; } ut8 * buf = bin -> buf -> buf + ( ut32 ) sec -> payload_data ; <START_BUG> ut32 len = sec -> payload_len ; <END_BUG> ut32 count = sec -> count ; ut32 i = 0, r = 0 ;  while ( i < len && r < count ) { <START_BUG> if (! ( ptr = R_NEW0 ( RBinWasmElementEntry ) ) ) { return ret ; } if (! ( consume_u32 ( buf + i, buf + len, & ptr -> index, & i ) ) ) { <END_BUG> free ( ptr ) ;  return ret ; } if (! ( consume_init_expr ( buf + i, buf + len, R_BIN_WASM_END_OF_CODE, NULL, & i ) ) ) { <START_BUG> free ( ptr ) ; <END_BUG> return ret ; } if (! ( consume_u32 ( buf + i, buf + len, & ptr -> num_elem, & i ) ) ) {  free ( ptr ) ; <START_BUG> return ret ; } ut32 j = 0 ; while ( i < len && j < ptr -> num_elem ) { ut32 e ; if (! ( consume_u32 ( buf + i, buf + len, & e, & i ) ) ) { free ( ptr ) ; return ret ; } } r_list_append ( ret, ptr ) ; r += 1 ; } return ret ; <END_BUG> } 

Fix:
<S2SV_ModStart> -> payload_data ; int buflen = bin -> buf -> length - ( ut32 ) sec -> payload_data ; <S2SV_ModStart> i < len && len < buflen <S2SV_ModStart> ) ) { goto beach <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) { goto beach <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) { goto beach <S2SV_ModEnd> ; } ut32 <S2SV_ModStart> return ret ; beach : free ( ptr ) ; return ret ;
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_set_scalemode ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_scaling_mode_t * data = va_arg ( args, vpx_scaling_mode_t * ) ; if ( data ) { int res ; vpx_scaling_mode_t scalemode = * ( vpx_scaling_mode_t * ) data ; res = vp8_set_internal_size ( ctx -> cpi, ( VPX_SCALING ) scalemode. h_scaling_mode, ( VPX_SCALING ) scalemode. v_scaling_mode ) ; if (! res ) { ctx -> next_frame_flag |= FRAMEFLAGS_KEY ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static int do_16x16_zerozero_search ( VP9_COMP * cpi, int_mv * dst_mv ) { <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; unsigned int err ;  err = vp9_sad16x16 ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, <START_BUG> <END_BUG> xd -> plane [ 0 ]. pre [ 0 ]. buf, xd -> plane [ 0 ]. pre [ 0 ]. stride,  INT_MAX ) ; dst_mv -> as_int = 0 ; return err ; }

Fix:
<S2SV_ModStart> & cpi -> td. <S2SV_ModStart> ; err = vpx_sad16x16 <S2SV_ModEnd> ( x -> <S2SV_ModStart> ]. stride <S2SV_ModEnd> ) ; dst_mv
Buggy code:
 void eap_print ( netdissect_options * ndo, register const u_char * cp, u_int length ) { const struct eap_frame_t * eap ; const u_char * tptr ; u_int tlen, type, subtype ; int count = 0, len ; tptr = cp ; tlen = length ; eap = ( const struct eap_frame_t * ) cp ; ND_TCHECK ( * eap ) ; if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "%s   (%u)   v%u,   len   %u", tok2str ( eap_frame_type_values, "unknown", eap -> type ), eap -> type, eap -> version, EXTRACT_16BITS ( eap -> length ) ) ) ; return ; } ND_PRINT ( ( ndo, "%s   (%u)   v%u,   len   %u", tok2str ( eap_frame_type_values, "unknown", eap -> type ), eap -> type, eap -> version, EXTRACT_16BITS ( eap -> length ) ) ) ; tptr += sizeof ( const struct eap_frame_t ) ; tlen -= sizeof ( const struct eap_frame_t ) ; switch ( eap -> type ) { case EAP_FRAME_TYPE_PACKET : <START_BUG> type = * ( tptr ) ; <END_BUG> len = EXTRACT_16BITS ( tptr + 2 ) ; ND_PRINT ( ( ndo, ",   %s   (%u),   id   %u,   len   %u", tok2str ( eap_code_values, "unknown", type ), type, * ( tptr + 1 ), len ) ) ; ND_TCHECK2 ( * tptr, len ) ; if ( type <= 2 ) {  subtype = * ( tptr + 4 ) ; <START_BUG> ND_PRINT ( ( ndo, "\\n\\t\\t   Type   %s   (%u)", <END_BUG> tok2str ( eap_type_values, "unknown", * ( tptr + 4 ) ),  * ( tptr + 4 ) ) ) ; switch ( subtype ) { case EAP_TYPE

Fix:
<S2SV_ModStart> case EAP_FRAME_TYPE_PACKET : ND_TCHECK_8BITS ( tptr ) ; <S2SV_ModStart> * ( tptr ) ; ND_TCHECK_16BITS ( tptr + 2 <S2SV_ModStart> 2 ) { ND_TCHECK_8BITS ( tptr + 4 ) ; <S2SV_ModStart>, "unknown", subtype ), subtype <S2SV_ModEnd> ) ) ; <S2SV_ModStart> len ) { ND_TCHECK_8BITS ( tptr + count ) ; <S2SV_ModStart> case EAP_TYPE_TTLS : case EAP_TYPE_TLS : ND_TCHECK_8BITS ( tptr + 5 ) ; if ( subtype == EAP_TYPE_TTLS ) <S2SV_ModStart> ) ) ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ) ) { ND_TCHECK_32BITS ( tptr + 6 ) ; <S2SV_ModStart> case EAP_TYPE_FAST : ND_TCHECK_8BITS ( tptr + 5 ) ; <S2SV_ModStart> ) ) { ND_TCHECK_32BITS ( tptr + 6 ) ; <S2SV_ModStart> case EAP_TYPE_SIM : ND_TCHECK_8BITS ( tptr + 5 ) ;
Buggy code:
 static gboolean parse_toshiba_packet ( FILE_T fh, struct wtap_pkthdr * phdr, Buffer * buf, int * err, gchar * * err_info ) { union wtap_pseudo_header * pseudo_header = & phdr -> pseudo_header ; char line [ TOSHIBA_LINE_LENGTH ] ; int num_items_scanned ; <START_BUG> int pkt_len, pktnum, hr, min, sec, csec ; <END_BUG> char channel [ 10 ], direction [ 10 ] ; int i, hex_lines ; guint8 * pd ; if ( file_gets ( line, TOSHIBA_LINE_LENGTH, fh ) == NULL ) { * err = file_error ( fh, err_info ) ; if ( * err == 0 ) { * err = WTAP_ERR_SHORT_READ ; } return FALSE ; } num_items_scanned = sscanf ( line, "%9d]   %2d:%2d:%2d.%9d   %9s   %9s", & pktnum, & hr, & min, & sec, & csec, channel, direction ) ; if ( num_items_scanned!= 7 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "toshiba:   record   header   isn\'t   valid" ) ; return FALSE ; } do { if ( file_gets ( line, TOSHIBA_LINE_LENGTH, fh ) == NULL ) { * err = file_error ( fh, err_info ) ; if ( * err == 0 ) { * err = WTAP_ERR_SHORT_READ ; } return FALSE ; } line [ 16 ] = '\\0' ; } while ( strcmp ( line, "OFFSET   0001-0203" )!= 0 ) ;  num_items_scanned = sscanf ( line + 64, "LEN=%9d", & pkt_len ) ; <START_BUG> if ( num_items_scanned!= 1 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "toshiba:   OFFSET   line   doesn\'t   have   valid   LEN   item" ) ; return FALSE ; } <END_BUG> phdr -> rec_type

Fix:
<S2SV_ModStart> int num_items_scanned ; guint pkt_len ; int <S2SV_ModEnd> pktnum, hr <S2SV_ModStart> + 64, "LEN=%9u" <S2SV_ModEnd>, & pkt_len <S2SV_ModStart> FALSE ; } if ( pkt_len > WTAP_MAX_PACKET_SIZE ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup_printf ( "toshiba: <S2SV_blank> File <S2SV_blank> has <S2SV_blank> %u-byte <S2SV_blank> packet, <S2SV_blank> bigger <S2SV_blank> than <S2SV_blank> maximum <S2SV_blank> of <S2SV_blank> %u", pkt_len, WTAP_MAX_PACKET_SIZE ) ; return FALSE ; } <S2SV_ModStart> ( buf, pkt_len <S2SV_ModEnd> ) ; pd
Buggy code:
 int _fep_open_control_socket ( Fep * fep ) { struct sockaddr_un sun ; char * path ; int fd ; ssize_t sun_len ; fd = socket ( AF_UNIX, SOCK_STREAM, 0 ) ; if ( fd < 0 ) { perror ( "socket" ) ; return - 1 ; } path = create_socket_name ( "fep-XXXXXX//control" ) ; if ( strlen ( path ) + 1 >= sizeof ( sun. sun_path ) ) { fep_log ( FEP_LOG_LEVEL_WARNING, "unix   domain   socket   path   too   long:   %d   +   1   >=   %d", strlen ( path ), sizeof ( sun. sun_path ) ) ; free ( path ) ; return - 1 ; } memset ( & sun, 0, sizeof ( sun ) ) ; sun. sun_family = AF_UNIX ; <START_BUG> # ifdef __linux__ <END_BUG>  sun. sun_path [ 0 ] = '\\0' ; <START_BUG> memcpy ( sun. sun_path + 1, path, strlen ( path ) ) ; <END_BUG> sun_len = offsetof ( struct sockaddr_un, sun_path ) + strlen ( path ) + 1 ;  remove_control_socket ( path ) ; # else memcpy ( sun. sun_path, path, strlen ( path ) ) ; sun_len = sizeof ( struct sockaddr_un ) ; # endif if ( bind ( fd, ( const struct sockaddr * ) & sun, sun_len ) < 0 ) { perror ( "bind" ) ; free ( path ) ; close ( fd ) ; return - 1 ; } if ( listen ( fd, 5 ) < 0 ) { perror ( "listen" ) ; free ( path ) ; close ( fd ) ; return - 1 ; } fep -> server = fd ; fep -> control_socket_path = path ; return 0 ; }

Fix:
<S2SV_ModStart> = AF_UNIX ; memcpy ( <S2SV_ModEnd> sun. sun_path <S2SV_ModStart> sun. sun_path <S2SV_ModEnd>, path, <S2SV_ModStart> ; sun_len = sizeof <S2SV_ModEnd> ( struct sockaddr_un <S2SV_ModStart> ( struct sockaddr_un ) ; <S2SV_ModEnd> if ( bind
Buggy code:
 <START_BUG> void fadst16_sse2 ( __m128i * in0, __m128i * in1 ) { <END_BUG> fadst16_8col ( in0 ) ; fadst16_8col ( in1 ) ; array_transpose_16x16 ( in0, in1 ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 l_int32 gplotMakeOutput ( GPLOT * gplot ) { <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> char * cmdname ; l_int32 ignore ; PROCNAME ( "gplotMakeOutput" ) ; if (! gplot ) return ERROR_INT ( "gplot   not   defined", procName, 1 ) ; gplotGenCommandFile ( gplot ) ; gplotGenDataFiles ( gplot ) ; cmdname = genPathname ( gplot -> cmdname, NULL ) ; # ifndef _WIN32  snprintf ( buf, L_BUF_SIZE, "gnuplot   %s", cmdname ) ; <START_BUG> # else <END_BUG> snprintf ( buf, L_BUF_SIZE, "wgnuplot   %s", cmdname ) ;  # endif # ifndef OS_IOS ignore = system ( buf ) ; # endif LEPT_FREE ( cmdname ) ; return 0 ; }

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "gnuplot <S2SV_blank> %s", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "wgnuplot <S2SV_blank> %s",
Buggy code:
 int vp8cx_encode_inter_macroblock ( VP8_COMP * cpi, MACROBLOCK * x, TOKENEXTRA * * t, int recon_yoffset, int recon_uvoffset, int mb_row, int mb_col ) { MACROBLOCKD * const xd = & x -> e_mbd ; int intra_error = 0 ; int rate ; int distortion ; x -> skip = 0 ; if ( xd -> segmentation_enabled ) x -> encode_breakout = cpi -> segment_encode_breakout [ xd -> mode_info_context -> mbmi. segment_id ] ; else x -> encode_breakout = cpi -> oxcf. encode_breakout ; # if CONFIG_TEMPORAL_DENOISING x -> best_reference_frame = INTRA_FRAME ; x -> best_zeromv_reference_frame = INTRA_FRAME ; x -> best_sse_inter_mode = 0 ; x -> best_sse_mv. as_int = 0 ; x -> need_to_clamp_best_mvs = 0 ; # endif if ( cpi -> sf. RD ) { int zbin_mode_boost_enabled = x -> zbin_mode_boost_enabled ; if ( cpi -> sf. use_fastquant_for_pick ) { x -> quantize_b = vp8_fast_quantize_b ; <START_BUG> x -> quantize_b_pair = vp8_fast_quantize_b_pair ; <END_BUG> x -> zbin_mode_boost_enabled = 0 ; } vp8_rd_pick_inter_mode ( cpi, x, recon_yoffset, recon_uvoffset, & rate,  & distortion, & intra_error ) ; <START_BUG> if ( cpi -> sf. improved_quant ) { <END_BUG> x -> quantize_b = vp8_regular_quantize_b ;  x -> quantize_b_pair = vp8_regular_quantize_b_pair ; } x -> zbin_mode_boost_enabled = zbin_mode_boost_enabled ; } else { vp8_pick_inter_mode ( cpi, x, recon_yoffset, recon_uvoffset, & rate, & distortion, & intra_error, mb_row,

Fix:
<S2SV_ModStart> ; x -> <S2SV_ModEnd> zbin_mode_boost_enabled = 0 <S2SV_ModStart>, & intra_error, mb_row, mb_col <S2SV_ModStart> quantize_b = vp8_regular_quantize_b <S2SV_ModEnd> ; } x
Buggy code:
 static void dump_boot ( DOS_FS * fs, struct boot_sector * b, unsigned lss ) { unsigned short sectors ; printf ( "Boot   sector   contents:\\n" ) ; if (! atari_format ) { char id [ 9 ] ; strncpy ( id, ( const char * ) b -> system_id, 8 ) ; id [ 8 ] = 0 ; printf ( "System   ID   \\"%s\\"\\n", id ) ; } else { printf ( "Serial   number   0x%x\\n", b -> system_id [ 5 ] | ( b -> system_id [ 6 ] << 8 ) | ( b -> system_id [ 7 ] << 16 ) ) ; } printf ( "Media   byte   0x%02x   (%s)\\n", b -> media, get_media_descr ( b -> media ) ) ; printf ( "%10d   bytes   per   logical   sector\\n", GET_UNALIGNED_W ( b -> sector_size ) ) ; printf ( "%10d   bytes   per   cluster\\n", fs -> cluster_size ) ; printf ( "%10d   reserved   sector%s\\n", le16toh ( b -> reserved ), le16toh ( b -> reserved ) == 1? "" : "s" ) ; printf ( "First   FAT   starts   at   byte   %llu   (sector   %llu)\\n", ( unsigned long long ) fs -> fat_start, ( unsigned long long ) fs -> fat_start // lss ) ; printf ( "%10d   FATs,   %d   bit   entries\\n", b -> fats, fs -> fat_bits ) ; <START_BUG> printf ( "%10d   bytes   per   FAT   (=   %u   sectors)\\n", fs -> fat_size, <END_BUG>  fs -> fat_size // lss ) ; <START_BUG> if (! fs -> root_cluster ) { printf ( "Root   directory   starts   at   byte   %llu   (sector   %llu)\\n", ( unsigned long long ) fs -> root_start, ( unsigned long long ) fs -> root_start // lss ) ; printf ( "%10<END_BUG>

Fix:
<S2SV_ModStart> ; printf ( "%10lld <S2SV_blank> bytes <S2SV_blank> per <S2SV_blank> FAT <S2SV_blank> (= <S2SV_blank> %llu <S2SV_blank> sectors)\\n", ( long long ) <S2SV_ModEnd> fs -> fat_size <S2SV_ModStart> -> fat_size, ( long long )
Buggy code:
 int inet6_csk_xmit ( struct sock * sk, struct sk_buff * skb, struct flowi * fl_unused ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct flowi6 fl6 ; struct dst_entry * dst ; int res ; dst = inet6_csk_route_socket ( sk, & fl6 ) ; if ( IS_ERR ( dst ) ) { sk -> sk_err_soft = - PTR_ERR ( dst ) ; sk -> sk_route_caps = 0 ; kfree_skb ( skb ) ; return PTR_ERR ( dst ) ; } rcu_read_lock ( ) ; skb_dst_set_noref ( skb, dst ) ; fl6. daddr = sk -> sk_v6_daddr ; <START_BUG> res = ip6_xmit ( sk, skb, & fl6, np -> opt, np -> tclass ) ; <END_BUG> rcu_read_unlock ( ) ; return res ; }

Fix:
<S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt )
Buggy code:
 zip_int64_t _zip_dirent_read ( zip_dirent_t * zde, zip_source_t * src, zip_buffer_t * buffer, bool local, zip_error_t * error ) { zip_uint8_t buf [ CDENTRYSIZE ] ; zip_uint16_t dostime, dosdate ; zip_uint32_t size, variable_size ; zip_uint16_t filename_len, comment_len, ef_len ; bool from_buffer = ( buffer!= NULL ) ; size = local? LENTRYSIZE : CDENTRYSIZE ; if ( buffer ) { if ( _zip_buffer_left ( buffer ) < size ) { zip_error_set ( error, ZIP_ER_NOZIP, 0 ) ; return - 1 ; } } else { if ( ( buffer = _zip_buffer_new_from_source ( src, size, buf, error ) ) == NULL ) { return - 1 ; } } if ( memcmp ( _zip_buffer_get ( buffer, 4 ), ( local? LOCAL_MAGIC : CENTRAL_MAGIC ), 4 )!= 0 ) { zip_error_set ( error, ZIP_ER_NOZIP, 0 ) ; if (! from_buffer ) { _zip_buffer_free ( buffer ) ; } return - 1 ; } _zip_dirent_init ( zde ) ; if (! local ) zde -> version_madeby = _zip_buffer_get_16 ( buffer ) ; else zde -> version_madeby = 0 ; zde -> version_needed = _zip_buffer_get_16 ( buffer ) ; zde -> bitflags = _zip_buffer_get_16 ( buffer ) ; zde -> comp_method = _zip_buffer_get_16 ( buffer ) ; dostime = _zip_buffer_get_16 ( buffer ) ; dosdate = _zip_buffer_get_16 ( buffer ) ; zde -> last_mod = _zip_d2u_time ( dostime, dosdate ) ; zde -> crc = _zip_buffer_get_32 ( buffer ) ; zde -> comp_size = _zip_buffer_get_32 ( buffer ) ; zde -> uncomp_size = _zip_buffer

Fix:
<S2SV_ModStart> ) ) { <S2SV_ModEnd> return - 1
Buggy code:
 static png_size_t png_inflate ( png_structp png_ptr, const png_byte * data, png_size_t size, png_bytep output, png_size_t output_size ) { png_size_t count = 0 ; png_ptr -> zstream. next_in = ( png_bytep ) data ; png_ptr -> zstream. avail_in = size ; while ( 1 ) { int ret, avail ; png_ptr -> zstream. next_out = png_ptr -> zbuf ; png_ptr -> zstream. avail_out = png_ptr -> zbuf_size ; ret = inflate ( & png_ptr -> zstream, Z_NO_FLUSH ) ; avail = png_ptr -> zbuf_size - png_ptr -> zstream. avail_out ; if ( ( ret == Z_OK || ret == Z_STREAM_END ) && avail > 0 ) { if ( output!= 0 && output_size > count ) { <START_BUG> int copy = output_size - count ; <END_BUG>  if ( avail < copy ) copy = avail ; <START_BUG> png_memcpy ( output + count, png_ptr -> zbuf, copy ) ; } count += avail ; } if ( ret == Z_OK ) continue ; png_ptr -> zstream. avail_in = 0 ; inflateReset ( & png_ptr -> zstream ) ; if ( ret == Z_STREAM_END ) return count ; { PNG_CONST char * msg ; if ( png_ptr -> zstream. msg!= 0 ) msg = png_ptr -> zstream. msg ; else { # if defined ( PNG_STDIO_SUPPORTED ) &&! defined ( _WIN32_WCE ) char umsg [ 52 ] ; switch ( ret ) { case Z_BUF_ERROR : msg = "Buffer   error   in   compressed   datastream   in   %s   chunk" ; break ; case Z_DATA_ERROR : msg = "Data   error   in   compressed   datastream   in   %s   chunk" ; break ; default : msg = "Incomplete   compressed   datastream   in   %s   chunk" ; break ; } png_snprintf ( umsg, sizeof umsg, msg, png_ptr -> chunk_name ) ; msg = umsg ; # else msg = "Damaged  <END_BUG>

Fix:
<S2SV_ModStart> count ) { png_size_t <S2SV_ModEnd> copy = output_size <S2SV_ModStart> ; if ( ( png_size_t ) <S2SV_ModStart> ) copy = ( png_size_t )
Buggy code:
 int parse_file ( FILE * input_file, char * directory, char * body_filename, char * body_pref, int flags ) { uint32 d ; uint16 key ; Attr * attr = NULL ; File * file = NULL ; int rtf_size = 0, html_size = 0 ; MessageBody body ; memset ( & body, '\\0', sizeof ( MessageBody ) ) ; g_flags = flags ; d = geti32 ( input_file ) ; if ( d!= TNEF_SIGNATURE ) { fprintf ( stdout, "Seems   not   to   be   a   TNEF   file\\n" ) ; return 1 ; } key = geti16 ( input_file ) ; debug_print ( "TNEF   Key:   %hx\\n", key ) ; while ( data_left ( input_file ) ) { attr = read_object ( input_file ) ; if ( attr == NULL ) break ; if ( attr -> name == attATTACHRENDDATA ) { if ( file ) { file_write ( file, directory ) ; file_free ( file ) ; } else { file = CHECKED_XCALLOC ( File, 1 ) ; } } switch ( attr -> lvl_type ) { case LVL_MESSAGE : if ( attr -> name == attBODY ) { body. text_body = get_text_data ( attr ) ; } else if ( attr -> name == attMAPIPROPS ) { MAPI_Attr * * mapi_attrs = mapi_attr_read ( attr -> len, attr -> buf ) ; if ( mapi_attrs ) { int i ; for ( i = 0 ; mapi_attrs [ i ] ; i ++ ) { MAPI_Attr * a = mapi_attrs [ i ] ; <START_BUG> if ( a -> name == MAPI_BODY_HTML ) <END_BUG> { body. html_bodies = get_html_data ( a ) ; html_size = a -> num_values ; }  else if ( a -> name == MAPI_RTF_COMPRESSED ) <START_BUG> { body. rtf_bodies = get_rtf_data ( a ) ; rtf_size = a -> num_values ; } } mapi_attr_free_list ( mapi_attrs ) ; XFREE ( mapi_attrs )<END_BUG>

Fix:
<S2SV_ModStart> ( a -> type == szMAPI_BINARY && a -> <S2SV_ModStart> else if ( a -> type == szMAPI_BINARY &&
Buggy code:
 void common_timer_get ( struct k_itimer * timr, struct itimerspec64 * cur_setting ) { const struct k_clock * kc = timr -> kclock ; ktime_t now, remaining, iv ; struct timespec64 ts64 ; bool sig_none ; sig_none = timr -> it_sigev_notify == SIGEV_NONE ; iv = timr -> it_interval ; if ( iv ) { cur_setting -> it_interval = ktime_to_timespec64 ( iv ) ; } else if (! timr -> it_active ) { if (! sig_none ) return ; } kc -> clock_get ( timr -> it_clock, & ts64 ) ; now = timespec64_to_ktime ( ts64 ) ; if ( iv && ( timr -> it_requeue_pending & REQUEUE_PENDING || sig_none ) ) <START_BUG> timr -> it_overrun += ( int ) kc -> timer_forward ( timr, now ) ; <END_BUG> remaining = kc -> timer_remaining ( timr, now ) ; if ( remaining <= 0 ) { if (! sig_none ) cur_setting -> it_value. tv_nsec = 1 ; } else { cur_setting -> it_value = ktime_to_timespec64 ( remaining ) ; } }

Fix:
<S2SV_ModStart> -> it_overrun += <S2SV_ModEnd> kc -> timer_forward
Buggy code:
 static int hns_gmac_get_sset_count ( int stringset ) { <START_BUG> if ( stringset == ETH_SS_STATS ) <END_BUG> return ARRAY_SIZE ( g_gmac_stats_string ) ; return 0 ; }

Fix:
<S2SV_ModStart> stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS
Buggy code:
 void vp8_mbpost_proc_down_c ( unsigned char * dst, int pitch, int rows, int cols, int flimit ) { int r, c, i ; const short * rv3 = & vp8_rv [ 63 & rand ( ) ] ; for ( c = 0 ; c < cols ; c ++ ) { unsigned char * s = & dst [ c ] ; int sumsq = 0 ; int sum = 0 ; unsigned char d [ 16 ] ; const short * rv2 = rv3 + ( ( c * 17 ) & 127 ) ; for ( i = - 8 ; i < 0 ; i ++ ) s [ i * pitch ] = s [ 0 ] ; <START_BUG> for ( i = rows ; i < rows + 17 ; i ++ ) <END_BUG> s [ i * pitch ] = s [ ( rows - 1 ) * pitch ] ; for ( i = - 8 ; i <= 6 ; i ++ ) { sumsq += s [ i * pitch ] * s [ i * pitch ] ; sum += s [ i * pitch ] ; } for ( r = 0 ; r < rows + 8 ; r ++ ) { sumsq += s [ 7 * pitch ] * s [ 7 * pitch ] - s [ - 8 * pitch ] * s [ - 8 * pitch ] ; sum += s [ 7 * pitch ] - s [ - 8 * pitch ] ; d [ r & 15 ] = s [ 0 ] ; if ( sumsq * 15 - sum * sum < flimit ) { d [ r & 15 ] = ( rv2 [ r & 127 ] + sum + s [ 0 ] ) >> 4 ; } if ( r >= 8 ) s [ - 8 * pitch ] = d [ ( r - 8 ) & 15 ] ; s += pitch ; } } }

Fix:
<S2SV_ModStart> ( i = 0 ; i < 17 ; i ++ ) s [ ( i + rows ) <S2SV_ModEnd> * pitch ]
Buggy code:
 int cipso_v4_req_setattr ( struct request_sock * req, const struct cipso_v4_doi * doi_def, const struct netlbl_lsm_secattr * secattr ) { int ret_val = - EPERM ; unsigned char * buf = NULL ; u32 buf_len ; u32 opt_len ; <START_BUG> struct ip_options * opt = NULL ; <END_BUG> struct inet_request_sock * req_inet ; buf_len = CIPSO_V4_OPT_LEN_MAX ; buf = kmalloc ( buf_len, GFP_ATOMIC ) ; if ( buf == NULL ) { ret_val = - ENOMEM ; goto req_setattr_failure ; } ret_val = cipso_v4_genopt ( buf, buf_len, doi_def, secattr ) ; if ( ret_val < 0 ) goto req_setattr_failure ; buf_len = ret_val ; opt_len = ( buf_len + 3 ) & ~ 3 ; opt = kzalloc ( sizeof ( * opt ) + opt_len, GFP_ATOMIC ) ; if ( opt == NULL ) { ret_val = - ENOMEM ; goto req_setattr_failure ; }  memcpy ( opt -> __data, buf, buf_len ) ; <START_BUG> <END_BUG> opt -> optlen = opt_len ;  <START_BUG> opt -> cipso = sizeof ( struct iphdr ) ; <END_BUG> kfree ( buf ) ; buf = NULL ; req_inet = inet_rsk ( req ) ; opt = xchg ( & req_inet -> opt, opt ) ;  kfree ( opt ) ; <START_BUG> return 0 ; req_setattr_failure : kfree ( buf ) ; kfree ( opt ) ; return ret_val ; }<END_BUG>

Fix:
<S2SV_ModStart> opt_len ; struct ip_options_rcu <S2SV_ModEnd> * opt = <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> ; opt -> opt. <S2SV_ModStart> ; opt -> opt. <S2SV_ModStart> opt ) ; if ( opt ) call_rcu ( & opt -> rcu, opt_kfree_rcu <S2SV_ModEnd> ) ; return
Buggy code:
 static TEE_Result tee_svc_copy_param ( struct tee_ta_session * sess, struct tee_ta_session * called_sess, struct utee_params * callee_params, struct tee_ta_param * param, void * tmp_buf_va [ TEE_NUM_PARAMS ], struct mobj * * mobj_tmp ) { size_t n ; TEE_Result res ; size_t req_mem = 0 ; size_t s ; uint8_t * dst = 0 ; bool ta_private_memref [ TEE_NUM_PARAMS ] ; struct user_ta_ctx * utc = to_user_ta_ctx ( sess -> ctx ) ; void * va ; size_t dst_offs ; if (! callee_params ) { memset ( param, 0, sizeof ( * param ) ) ; } else { res = tee_mmu_check_access_rights ( utc, TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER, ( uaddr_t ) callee_params, sizeof ( struct utee_params ) ) ; if ( res!= TEE_SUCCESS ) return res ; <START_BUG> utee_param_to_param ( param, callee_params ) ; <END_BUG> } if ( called_sess && is_pseudo_ta_ctx ( called_sess -> ctx ) ) { return TEE_SUCCESS ; } for ( n = 0 ; n < TEE_NUM_PARAMS ; n ++ ) { ta_private_memref [ n ] = false ; switch ( TEE_PARAM_TYPE_GET ( param -> types, n ) ) { case TEE_PARAM_TYPE_MEMREF_INPUT : case TEE_PARAM_TYPE_MEMREF_OUTPUT : case TEE_PARAM_TYPE_MEMREF_INOUT : va = ( void * ) param -> u [ n ]. mem. offs ; s = param -> u [ n ]. mem. size ; if (! va ) { if ( s ) return TEE_ERROR_BAD_PARAMETERS ; break ; } if ( tee_mmu_is_vbuf_inside_ta_private ( utc, va, s ) ) { s = ROUNDUP ( s, sizeof ( uint32_t ) ) ; if ( ADD_OVERFLOW ( req_mem,

Fix:
<S2SV_ModStart> return res ; res = utee_param_to_param ( utc, <S2SV_ModEnd> param, callee_params <S2SV_ModStart>, callee_params ) ; if ( res!= TEE_SUCCESS ) return res
Buggy code:
 void dev_load ( struct net * net, const char * name ) { struct net_device * dev ; <START_BUG> rcu_read_lock ( ) ; <END_BUG> dev = dev_get_by_name_rcu ( net, name ) ; rcu_read_unlock ( ) ;  if (! dev && capable ( CAP_NET_ADMIN ) ) <START_BUG> <END_BUG> request_module ( "%s", name ) ;  }

Fix:
<S2SV_ModStart> * dev ; int no_module ; <S2SV_ModStart> ( ) ; no_module =! dev ; if ( no_module <S2SV_ModEnd> && capable ( <S2SV_ModStart> CAP_NET_ADMIN ) ) no_module = request_module ( "netdev-%s", name ) ; if ( no_module && capable ( CAP_SYS_MODULE ) ) { if (! <S2SV_ModStart>, name ) ) pr_err ( "Loading <S2SV_blank> kernel <S2SV_blank> module <S2SV_blank> for <S2SV_blank> a <S2SV_blank> network <S2SV_blank> device <S2SV_blank> " "with <S2SV_blank> CAP_SYS_MODULE <S2SV_blank> (deprecated). <S2SV_blank> <S2SV_blank> Use <S2SV_blank> CAP_NET_ADMIN <S2SV_blank> and <S2SV_blank> alias <S2SV_blank> netdev-%s <S2SV_blank> " "instead\\n", name ) ; } } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int nego_recv ( rdpTransport * transport, wStream * s, void * extra ) { BYTE li ; BYTE type ; UINT16 length ; rdpNego * nego = ( rdpNego * ) extra ; if (! tpkt_read_header ( s, & length ) ) return - 1 ; if (! tpdu_read_connection_confirm ( s, & li, length ) ) return - 1 ; if ( li > 6 ) { Stream_Read_UINT8 ( s, type ) ; switch ( type ) { case TYPE_RDP_NEG_RSP : <START_BUG> nego_process_negotiation_response ( nego, s ) ; <END_BUG> WLog_DBG ( TAG, "selected_protocol:   %" PRIu32 "", nego -> SelectedProtocol ) ; if ( nego -> SelectedProtocol ) { if ( ( nego -> SelectedProtocol == PROTOCOL_HYBRID ) && (! nego -> EnabledProtocols [ PROTOCOL_HYBRID ] ) ) { nego -> state = NEGO_STATE_FAIL ; } if ( ( nego -> SelectedProtocol == PROTOCOL_SSL ) && (! nego -> EnabledProtocols [ PROTOCOL_SSL ] ) ) { nego -> state = NEGO_STATE_FAIL ; } } else if (! nego -> EnabledProtocols [ PROTOCOL_RDP ] ) { nego -> state = NEGO_STATE_FAIL ; } break ; case TYPE_RDP_NEG_FAILURE :  nego_process_negotiation_failure ( nego, s ) ; <START_BUG> break ; } } else if ( li == 6 ) { WLog_DBG ( TAG, "no   rdpNegData" ) ; if (! nego -> EnabledProtocols [ PROTOCOL_RDP ] ) nego -> state = NEGO_STATE_FAIL ; else nego -> state = NEGO_STATE_FINAL ; } else { WLog_ERR ( TAG, "invalid   negotiation   response" ) ; nego -> state = NEGO_STATE_FAIL ; } if (! tpkt_ensure_stream_consumed ( s, length ) ) return - 1 ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> case TYPE_RDP_NEG_RSP : if (! <S2SV_ModStart>, s ) ) return - 1 <S2SV_ModStart> case TYPE_RDP_NEG_FAILURE : if (! <S2SV_ModStart>, s ) ) return - 1
Buggy code:
 <START_BUG> static LAYER_CONTEXT * get_layer_context ( SVC * svc ) { <END_BUG>  return svc -> number_temporal_layers > 1? <START_BUG> & svc -> layer_context [ svc -> temporal_layer_id ] : <END_BUG> & svc -> layer_context [ svc -> spatial_layer_id ] ;  }

Fix:
<S2SV_ModStart> * get_layer_context ( VP9_COMP * const cpi ) { if ( is_one_pass_cbr_svc ( cpi ) ) return & cpi -> svc. layer_context [ cpi -> svc. spatial_layer_id * cpi -> svc. number_temporal_layers + cpi -> svc. temporal_layer_id ] ; else return ( cpi -> svc. <S2SV_ModEnd> number_temporal_layers > 1 <S2SV_ModStart> number_temporal_layers > 1 && cpi -> oxcf. rc_mode == VPX_CBR )? & cpi -> svc. layer_context [ cpi -> svc. <S2SV_ModEnd> temporal_layer_id ] : <S2SV_ModStart> ] : & cpi -> svc. layer_context [ cpi -> svc. <S2SV_ModEnd> spatial_layer_id ] ;
Buggy code:
 sctp_disposition_t sctp_sf_do_asconf ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * chunk = arg ; struct sctp_chunk * asconf_ack = NULL ; struct sctp_paramhdr * err_param = NULL ; sctp_addiphdr_t * hdr ; <START_BUG> union sctp_addr_param * addr_param ; <END_BUG> __u32 serial ; int length ; if (! sctp_vtag_verify ( chunk, asoc ) ) { sctp_add_cmd_sf ( commands, SCTP_CMD_REPORT_BAD_TAG, SCTP_NULL ( ) ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; } if (! net -> sctp. addip_noauth &&! chunk -> auth ) return sctp_sf_discard_chunk ( net, ep, asoc, type, arg, commands ) ; if (! sctp_chunk_length_valid ( chunk, sizeof ( sctp_addip_chunk_t ) ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ; hdr = ( sctp_addiphdr_t * ) chunk -> skb -> data ; serial = ntohl ( hdr -> serial ) ;  addr_param = ( union sctp_addr_param * ) hdr -> params ; <START_BUG> length = ntohs ( addr_param -> p. length ) ; if ( length < sizeof ( sctp_paramhdr_t ) ) return sctp_sf_violation_paramlen ( net, ep, asoc, type, arg, ( void * ) addr_param, commands ) ; if (! sctp_verify_asconf ( asoc, <END_BUG> ( sctp_paramhdr_t * ) ( ( void * ) addr_param + length ),  ( void * ) chunk -> chunk_end, & err_param ) ) return sctp_sf_violation_paramlen ( net, ep, asoc, type, arg, ( void * ) err_param, commands

Fix:
<S2SV_ModStart> * hdr ; __u32 serial <S2SV_ModEnd> ; if ( <S2SV_ModStart> serial ) ; <S2SV_ModEnd> if (! <S2SV_ModStart> ( asoc, chunk, true, <S2SV_ModEnd> & err_param )
Buggy code:
 int ssh_packet_set_state ( struct ssh * ssh, struct sshbuf * m ) { struct session_state * state = ssh -> state ; const u_char * ssh1key, * ivin, * ivout, * keyin, * keyout, * input, * output ; size_t ssh1keylen, rlen, slen, ilen, olen ; int r ; u_int ssh1cipher = 0 ; if (! compat20 ) { if ( ( r = sshbuf_get_u32 ( m, & state -> remote_protocol_flags ) )!= 0 || ( r = sshbuf_get_u32 ( m, & ssh1cipher ) )!= 0 || ( r = sshbuf_get_string_direct ( m, & ssh1key, & ssh1keylen ) )!= 0 || ( r = sshbuf_get_string_direct ( m, & ivout, & slen ) )!= 0 || ( r = sshbuf_get_string_direct ( m, & ivin, & rlen ) )!= 0 ) return r ; if ( ssh1cipher > INT_MAX ) return SSH_ERR_KEY_UNKNOWN_CIPHER ; ssh_packet_set_encryption_key ( ssh, ssh1key, ssh1keylen, ( int ) ssh1cipher ) ; if ( cipher_get_keyiv_len ( state -> send_context )!= ( int ) slen || cipher_get_keyiv_len ( state -> receive_context )!= ( int ) rlen ) return SSH_ERR_INVALID_FORMAT ; if ( ( r = cipher_set_keyiv ( state -> send_context, ivout ) )!= 0 || ( r = cipher_set_keyiv ( state -> receive_context, ivin ) )!= 0 ) return r ; } else { if ( ( r = kex_from_blob ( m, & ssh -> kex ) )!= 0 || ( r = newkeys_from_blob ( m, ssh, MODE_OUT ) )!= 0 || ( r = newkeys_from_blob ( m, ssh, MODE_IN ) )!= 0 || ( r = sshbuf_get_u64 ( m, & state -> rekey_limit ) )!= 0 || ( r = sshbuf_get_u32 ( m, & state ->

Fix:
<S2SV_ModStart> ( r = <S2SV_ModEnd> ssh_packet_set_postauth ( ssh
Buggy code:
 int _pam_parse ( int argc, const char * * argv ) { int ctrl = 0 ; const char * current_secret = NULL ; memset ( tac_srv, 0, sizeof ( tacplus_server_t ) * TAC_PLUS_MAXSERVERS ) ; memset ( & tac_srv_addr, 0, sizeof ( struct addrinfo ) * TAC_PLUS_MAXSERVERS ) ; memset ( & tac_sock_addr, 0, sizeof ( struct sockaddr ) * TAC_PLUS_MAXSERVERS ) ; memset ( & tac_sock6_addr, 0, sizeof ( struct sockaddr_in6 ) * TAC_PLUS_MAXSERVERS ) ; tac_srv_no = 0 ; tac_service [ 0 ] = 0 ; tac_protocol [ 0 ] = 0 ; tac_prompt [ 0 ] = 0 ; tac_login [ 0 ] = 0 ; for ( ctrl = 0 ; argc -- > 0 ; ++ argv ) { if (! strcmp ( * argv, "debug" ) ) { ctrl |= PAM_TAC_DEBUG ; } else if (! strcmp ( * argv, "use_first_pass" ) ) { ctrl |= PAM_TAC_USE_FIRST_PASS ; } else if (! strcmp ( * argv, "try_first_pass" ) ) { ctrl |= PAM_TAC_TRY_FIRST_PASS ; } else if (! strncmp ( * argv, "service=", 8 ) ) { xstrcpy ( tac_service, * argv + 8, sizeof ( tac_service ) ) ; } else if (! strncmp ( * argv, "protocol=", 9 ) ) { xstrcpy ( tac_protocol, * argv + 9, sizeof ( tac_protocol ) ) ; } else if (! strncmp ( * argv, "prompt=", 7 ) ) { xstrcpy ( tac_prompt, * argv + 7, sizeof ( tac_prompt ) ) ; unsigned long chr ; for ( chr = 0 ; chr < strlen ( tac_prompt ) ; chr ++ ) { if ( tac_prompt [ chr ] == '_' ) { tac_prompt [ chr ] =' '; } } } else if (

Fix:
<S2SV_ModStart> ( LOG_DEBUG, "server[%lu] <S2SV_blank> { <S2SV_blank> addr=%s, <S2SV_blank> key=\'********\' <S2SV_blank> }" <S2SV_ModEnd>, n, <S2SV_ModStart> -> ai_addr ) <S2SV_ModEnd> ) ; }
Buggy code:
 int mp4client_main ( int argc, char * * argv ) { char c ; const char * str ; int ret_val = 0 ; u32 i, times [ 100 ], nb_times, dump_mode ; u32 simulation_time_in_ms = 0 ; u32 initial_service_id = 0 ; Bool auto_exit = GF_FALSE ; Bool logs_set = GF_FALSE ; Bool start_fs = GF_FALSE ; Bool use_rtix = GF_FALSE ; Bool pause_at_first = GF_FALSE ; Bool no_cfg_save = GF_FALSE ; Bool is_cfg_only = GF_FALSE ; Double play_from = 0 ; # ifdef GPAC_MEMORY_TRACKING GF_MemTrackerType mem_track = GF_MemTrackerNone ; # endif Double fps = GF_IMPORT_DEFAULT_FPS ; Bool fill_ar, visible, do_uncache, has_command ; char * url_arg, * out_arg, * the_cfg, * rti_file, * views, * mosaic ; FILE * logfile = NULL ; Float scale = 1 ; # ifndef WIN32 dlopen ( NULL, RTLD_NOW | RTLD_GLOBAL ) ; # endif strcpy ( the_url, "." ) ; memset ( & user, 0, sizeof ( GF_User ) ) ; dump_mode = DUMP_NONE ; fill_ar = visible = do_uncache = has_command = GF_FALSE ; url_arg = out_arg = the_cfg = rti_file = views = mosaic = NULL ; nb_times = 0 ; times [ 0 ] = 0 ; for ( i = 1 ; i < ( u32 ) argc ; i ++ ) { char * arg = argv [ i ] ; if (! strcmp ( arg, "-c" ) ||! strcmp ( arg, "-cfg" ) ) { the_cfg = argv [ i + 1 ] ; i ++ ; } else if (! strcmp ( arg, "-mem-track" ) ||! strcmp ( arg, "-mem-track-stack" ) ) { # ifdef GPAC_MEMORY_TRACKING mem_track =! strcmp ( arg, "-mem-track-stack" )? GF_MemTrackerBackTrace :

Fix:
<S2SV_ModStart> * ext ; if ( strlen ( url_arg ) >= sizeof ( the_url ) ) { fprintf ( stderr, "Input <S2SV_blank> url <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long, <S2SV_blank> truncating <S2SV_blank> to <S2SV_blank> %d <S2SV_blank> chars.\\n", url_arg, ( int ) ( sizeof ( the_url ) - 1 ) ) ; strncpy ( the_url, url_arg, sizeof ( the_url ) - 1 ) ; the_url [ sizeof ( the_url ) - 1 ] = 0 ; } else { <S2SV_ModStart> url_arg ) ; } <S2SV_ModStart>! e ) { strncpy <S2SV_ModEnd> ( the_url, <S2SV_ModStart> ( sess ), sizeof ( the_url ) - 1 ) ; the_url [ sizeof ( the_cfg ) - 1 ] = 0 ; } <S2SV_ModEnd> gf_dm_sess_del ( sess <S2SV_ModStart> str ) { strncpy <S2SV_ModEnd> ( the_url, <S2SV_ModStart>, "MP4Client <S2SV_blank> " GPAC_FULL_VERSION, sizeof ( the_url ) - 1 ) ; the_url [ sizeof ( the_url ) - 1 ] = 0 <S2SV_ModEnd> ; gf_term_connect (
Buggy code:
 enum ImapAuthRes imap_auth_cram_md5 ( struct ImapData * idata, const char * method ) { char ibuf [ LONG_STRING * 2 ], obuf [ LONG_STRING ] ; unsigned char hmac_response [ MD5_DIGEST_LEN ] ; int len ; int rc ; if (! mutt_bit_isset ( idata -> capabilities, ACRAM_MD5 ) ) return IMAP_AUTH_UNAVAIL ; mutt_message ( _ ( "Authenticating   (CRAM-MD5)..." ) ) ; if ( mutt_account_getlogin ( & idata -> conn -> account ) < 0 ) return IMAP_AUTH_FAILURE ; if ( mutt_account_getpass ( & idata -> conn -> account ) < 0 ) return IMAP_AUTH_FAILURE ; imap_cmd_start ( idata, "AUTHENTICATE   CRAM-MD5" ) ; do rc = imap_cmd_step ( idata ) ; while ( rc == IMAP_CMD_CONTINUE ) ; if ( rc!= IMAP_CMD_RESPOND ) { mutt_debug ( 1, "Invalid   response   from   server:   %s\\n", ibuf ) ; goto bail ; } <START_BUG> len = mutt_b64_decode ( obuf, idata -> buf + 2 ) ; <END_BUG> if ( len == - 1 ) { mutt_debug ( 1, "Error   decoding   base64   response.\\n" ) ; goto bail ; } obuf [ len ] = '\\0' ; mutt_debug ( 2, "CRAM   challenge:   %s\\n", obuf ) ; hmac_md5 ( idata -> conn -> account. pass, obuf, hmac_response ) ; int off = snprintf ( obuf, sizeof ( obuf ), "%s   ", idata -> conn -> account. user ) ; mutt_md5_toascii ( hmac_response, obuf + off ) ; mutt_debug ( 2, "CRAM   response:   %s\\n", obuf ) ; mutt_b64_encode ( ibuf, obuf, strlen ( obuf ), sizeof ( ibuf ) - 2 ) ; mutt_str_strcat ( ibuf, sizeof ( ibuf

Fix:
<S2SV_ModStart> buf + 2, sizeof ( obuf )
Buggy code:
 int raptor_turtle_writer_get_option ( raptor_turtle_writer * turtle_writer, raptor_option option ) { int result = - 1 ; switch ( option ) { case RAPTOR_OPTION_WRITER_AUTO_INDENT : result = TURTLE_WRITER_AUTO_INDENT ( turtle_writer ) ; break ; case RAPTOR_OPTION_WRITER_INDENT_WIDTH : result = turtle_writer -> indent ; break ; case RAPTOR_OPTION_WRITER_AUTO_EMPTY : case RAPTOR_OPTION_WRITER_XML_VERSION : case RAPTOR_OPTION_WRITER_XML_DECLARATION : case RAPTOR_OPTION_SCANNING : case RAPTOR_OPTION_ALLOW_NON_NS_ATTRIBUTES : case RAPTOR_OPTION_ALLOW_OTHER_PARSETYPES : case RAPTOR_OPTION_ALLOW_BAGID : case RAPTOR_OPTION_ALLOW_RDF_TYPE_RDF_LIST : case RAPTOR_OPTION_NORMALIZE_LANGUAGE : case RAPTOR_OPTION_NON_NFC_FATAL : case RAPTOR_OPTION_WARN_OTHER_PARSETYPES : case RAPTOR_OPTION_CHECK_RDF_ID : case RAPTOR_OPTION_HTML_TAG_SOUP : case RAPTOR_OPTION_MICROFORMATS : case RAPTOR_OPTION_HTML_LINK : case RAPTOR_OPTION_WWW_TIMEOUT : case RAPTOR_OPTION_STRICT : case RAPTOR_OPTION_NO_NET : case RAPTOR_OPTION_NO_FILE : <START_BUG> case RAPTOR_OPTION_RELATIVE_URIS : <END_BUG> case RAPTOR_OPTION_RESOURCE_BORDER : case RAPTOR_OPTION_LITERAL_BORDER : case RAPTOR_OPTION_BNODE_BORDER : case RAPTOR_OPTION_RESOURCE_FILL : case RAPTOR_OPTION_LITERAL_FILL : case RAPTOR_OPTION_BNODE_FILL : case RAPTOR_OPTION_JSON_CALLBACK : case RAPTOR_OPTION_JSON_EXTRA_DATA : case RAPTOR_OPTION_RSS_TRIPLES : case RAPTOR_OPTION_ATOM_ENTRY_URI : case RAPTOR_OPTION_PREFIX

Fix:
<S2SV_ModStart> RAPTOR_OPTION_NO_FILE : case RAPTOR_OPTION_LOAD_EXTERNAL_ENTITIES : case
Buggy code:
 static EAS_RESULT Parse_wave ( SDLS_SYNTHESIZER_DATA * pDLSData, EAS_I32 pos, EAS_U16 waveIndex ) { EAS_RESULT result ; EAS_U32 temp ; EAS_I32 size ; EAS_I32 endChunk ; EAS_I32 chunkPos ; EAS_I32 wsmpPos = 0 ; EAS_I32 fmtPos = 0 ; EAS_I32 dataPos = 0 ; EAS_I32 dataSize = 0 ; S_WSMP_DATA * p ; void * pSample ; S_WSMP_DATA wsmp ; chunkPos = pos + 12 ; if ( ( result = EAS_HWFileSeek ( pDLSData -> hwInstData, pDLSData -> fileHandle, pos ) )!= EAS_SUCCESS ) return result ; if ( ( result = NextChunk ( pDLSData, & pos, & temp, & size ) )!= EAS_SUCCESS ) return result ; if ( temp!= CHUNK_WAVE ) { { } return EAS_ERROR_FILE_FORMAT ; } pos = chunkPos ; endChunk = pos + size ; while ( pos < endChunk ) { chunkPos = pos ; if ( ( result = NextChunk ( pDLSData, & pos, & temp, & size ) )!= EAS_SUCCESS ) return result ; switch ( temp ) { case CHUNK_WSMP : wsmpPos = chunkPos + 8 ; break ; case CHUNK_FMT : fmtPos = chunkPos + 8 ; break ; case CHUNK_DATA : dataPos = chunkPos + 8 ; dataSize = size ; break ; default : break ; } } <START_BUG> if ( dataSize > MAX_DLS_WAVE_SIZE ) <END_BUG> { return EAS_ERROR_SOUND_LIBRARY ; } if ( pDLSData -> pDLS == NULL ) p = & wsmp ; else p = & pDLSData -> wsmpData [ waveIndex ] ; p -> fineTune = 0 ; p -> unityNote = 60 ; p -> gain = 0 ; p -> loopStart = 0 ; p -> loopLength = 0 ; if (! fmtPos ) { { } return EAS_ERROR_UNRECOGNIZED_FORMAT ; } if (! dataPos ) { { } return EAS_ERROR_UNRECO

Fix:
<S2SV_ModStart> } if ( dataSize < 0 ||