nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static int __perf_event_overflow ( struct perf_event * event, int nmi, <END_BUG> int throttle, struct perf_sample_data * data, struct pt_regs * regs ) { int events = atomic_read ( & event -> event_limit ) ; struct hw_perf_event * hwc = & event -> hw ; int ret = 0 ; if ( unlikely (! is_sampling_event ( event ) ) ) return 0 ; if ( unlikely ( hwc -> interrupts >= max_samples_per_tick ) ) { if ( throttle ) { hwc -> interrupts = MAX_INTERRUPTS ; perf_log_throttle ( event, 0 ) ; ret = 1 ; } } else hwc -> interrupts ++ ; if ( event -> attr. freq ) { u64 now = perf_clock ( ) ; s64 delta = now - hwc -> freq_time_stamp ; hwc -> freq_time_stamp = now ; if ( delta > 0 && delta < 2 * TICK_NSEC ) perf_adjust_period ( event, delta, hwc -> last_period ) ; } event -> pending_kill = POLL_IN ; if ( events && atomic_dec_and_test ( & event -> event_limit ) ) { ret = 1 ; event -> pending_kill = POLL_HUP ;  if ( nmi ) { <START_BUG> event -> pending_disable = 1 ; irq_work_queue ( & event -> pending ) ; <END_BUG> } else  perf_event_disable ( event ) ; } if ( event -> overflow_handler ) event -> overflow_handler ( event, nmi, data, regs ) ; else <START_BUG> perf_event_output ( event, nmi, data, regs ) ; <END_BUG> if ( event -> fasync && event -> pending_kill ) {  if ( nmi ) { <START_BUG> event -> pending_wakeup = 1 ; <END_BUG> irq_work_queue ( & event -> pending ) ;  } else perf_event_wakeup ( event ) ; } return ret ; }

Fix:
<S2SV_ModStart> perf_event * event <S2SV_ModEnd>, int throttle <S2SV_ModStart> = POLL_HUP ; <S2SV_ModEnd> event -> pending_disable <S2SV_ModStart> ) ; } if ( event -> overflow_handler ) event -> overflow_handler ( event, data, regs ) ; else <S2SV_ModEnd> perf_event_output ( event <S2SV_ModStart> perf_event_output ( event <S2SV_ModEnd>, data, <S2SV_ModStart> pending_kill ) { <S2SV_ModEnd> event -> pending_wakeup <S2SV_ModStart> event -> pending <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> void vp9_update_mv_count ( VP9_COMMON * cm, const MACROBLOCKD * xd ) { <END_BUG> const MODE_INFO * mi = xd -> mi [ 0 ] ;  const MB_MODE_INFO * const mbmi = & mi -> mbmi ; <START_BUG> if ( mbmi -> sb_type < BLOCK_8X8 ) { const int num_4x4_w = num_4x4_blocks_wide_lookup [ mbmi -> sb_type ] ; const int num_4x4_h = num_4x4_blocks_high_lookup [ mbmi -> sb_type ] ; int idx, idy ; for ( idy = 0 ; idy < 2 ; idy += num_4x4_h ) { for ( idx = 0 ; idx < 2 ; idx += num_4x4_w ) { const int i = idy * 2 + idx ; if ( mi -> bmi [ i ]. as_mode == NEWMV ) <END_BUG> inc_mvs ( mbmi, mi -> bmi [ i ]. as_mv, & cm -> counts. mv ) ;  } } } else { if ( mbmi -> mode == NEWMV ) <START_BUG> inc_mvs ( mbmi, mbmi -> mv, & cm -> counts. mv ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> void vp9_update_mv_count ( ThreadData * td ) { <S2SV_ModEnd> const MACROBLOCKD * <S2SV_ModStart> MACROBLOCKD * xd = & td -> mb. e_mbd ; <S2SV_ModEnd> const MODE_INFO * <S2SV_ModStart> mi -> mbmi ; const MB_MODE_INFO_EXT * mbmi_ext = td -> mb. mbmi_ext <S2SV_ModStart> ( mbmi, mbmi_ext, <S2SV_ModStart> as_mv, & td -> counts -> <S2SV_ModEnd> mv ) ; <S2SV_ModStart> ( mbmi, mbmi_ext, <S2SV_ModStart> mv, & td -> counts -> <S2SV_ModEnd> mv ) ;
Buggy code:
 bool recovery_cipher_abort ( void ) <START_BUG> { <END_BUG> if ( awaiting_character ) { awaiting_character = false ; return true ; } return false ; }

Fix:
<S2SV_ModStart> void ) { recovery_started = false ;
Buggy code:
 <START_BUG> void ntlm_write_message_header ( wStream * s, NTLM_MESSAGE_HEADER * header ) <END_BUG> { Stream_Write ( s, header -> Signature, sizeof ( NTLM_SIGNATURE ) ) ; Stream_Write_UINT32 ( s, header -> MessageType ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static int rfcomm_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct rfcomm_dlc * d = rfcomm_pi ( sk ) -> dlc ; int len ; if ( test_and_clear_bit ( RFCOMM_DEFER_SETUP, & d -> flags ) ) { <START_BUG> rfcomm_dlc_accept ( d ) ; <END_BUG> return 0 ; } len = bt_sock_stream_recvmsg ( iocb, sock, msg, size, flags ) ; lock_sock ( sk ) ; if (! ( flags & MSG_PEEK ) && len > 0 ) atomic_sub ( len, & sk -> sk_rmem_alloc ) ; if ( atomic_read ( & sk -> sk_rmem_alloc ) <= ( sk -> sk_rcvbuf >> 2 ) ) rfcomm_dlc_unthrottle ( rfcomm_pi ( sk ) -> dlc ) ; release_sock ( sk ) ; return len ; }

Fix:
<S2SV_ModStart> ( d ) ; msg -> msg_namelen = 0
Buggy code:
 int ipc_addid ( struct ipc_ids * ids, struct kern_ipc_perm * new, int size ) { kuid_t euid ; kgid_t egid ; int id ; int next_id = ids -> next_id ; if ( size > IPCMNI ) size = IPCMNI ; if ( ids -> in_use >= size ) return - ENOSPC ; idr_preload ( GFP_KERNEL ) ; spin_lock_init ( & new -> lock ) ; new -> deleted = false ; rcu_read_lock ( ) ; spin_lock ( & new -> lock ) ; <START_BUG> id = idr_alloc ( & ids -> ipcs_idr, new, <END_BUG> ( next_id < 0 )? 0 : ipcid_to_idx ( next_id ), 0, GFP_NOWAIT ) ; idr_preload_end ( ) ; if ( id < 0 ) { spin_unlock ( & new -> lock ) ; rcu_read_unlock ( ) ; return id ; } ids -> in_use ++ ;  current_euid_egid ( & euid, & egid ) ; <START_BUG> new -> cuid = new -> uid = euid ; new -> gid = new -> cgid = egid ; if ( next_id < 0 ) { new -> seq = ids -> seq ++ ; if ( ids -> seq > IPCID_SEQ_MAX ) ids -> seq = 0 ; } else { new -> seq = ipcid_to_seqx ( next_id ) ; ids -> next_id = - 1 ; } new -> id = ipc_buildid ( id, new -> seq ) ; return id ; }<END_BUG>

Fix:
<S2SV_ModStart> lock ) ; current_euid_egid ( & euid, & egid ) ; new -> cuid = new -> uid = euid ; new -> gid = new -> cgid = egid ; <S2SV_ModStart> in_use ++ ; <S2SV_ModEnd> if ( next_id
Buggy code:
 static int ghash_update ( struct shash_desc * desc, const u8 * src, unsigned int srclen ) { struct ghash_desc_ctx * dctx = shash_desc_ctx ( desc ) ; struct ghash_ctx * ctx = crypto_shash_ctx ( desc -> tfm ) ; u8 * dst = dctx -> buffer ; <START_BUG> if ( dctx -> bytes ) { <END_BUG> int n = min ( srclen, dctx -> bytes ) ; u8 * pos = dst + ( GHASH_BLOCK_SIZE - dctx -> bytes ) ; dctx -> bytes -= n ; srclen -= n ; while ( n -- ) * pos ++ ^= * src ++ ; if (! dctx -> bytes ) gf128mul_4k_lle ( ( be128 * ) dst, ctx -> gf128 ) ; } while ( srclen >= GHASH_BLOCK_SIZE ) { crypto_xor ( dst, src, GHASH_BLOCK_SIZE ) ; gf128mul_4k_lle ( ( be128 * ) dst, ctx -> gf128 ) ; src += GHASH_BLOCK_SIZE ; srclen -= GHASH_BLOCK_SIZE ; } if ( srclen ) { dctx -> bytes = GHASH_BLOCK_SIZE - srclen ; while ( srclen -- ) * dst ++ ^= * src ++ ; } return 0 ; }

Fix:
<S2SV_ModStart> ; if (! ctx -> gf128 ) return - ENOKEY ; if (
Buggy code:
 void xmlParseElement ( xmlParserCtxtPtr ctxt ) { const xmlChar * name ; const xmlChar * prefix = NULL ; const xmlChar * URI = NULL ; xmlParserNodeInfo node_info ; int line, tlen ; xmlNodePtr ret ; int nsNr = ctxt -> nsNr ; if ( ( ( unsigned int ) ctxt -> nameNr > xmlParserMaxDepth ) && ( ( ctxt -> options & XML_PARSE_HUGE ) == 0 ) ) { xmlFatalErrMsgInt ( ctxt, XML_ERR_INTERNAL_ERROR, "Excessive   depth   in   document:   %d   use   XML_PARSE_HUGE   option\\n", xmlParserMaxDepth ) ; ctxt -> instate = XML_PARSER_EOF ; return ; } if ( ctxt -> record_info ) { node_info. begin_pos = ctxt -> input -> consumed + ( CUR_PTR - ctxt -> input -> base ) ; node_info. begin_line = ctxt -> input -> line ; } if ( ctxt -> spaceNr == 0 ) spacePush ( ctxt, - 1 ) ; else if ( * ctxt -> space == - 2 ) spacePush ( ctxt, - 1 ) ; else spacePush ( ctxt, * ctxt -> space ) ; line = ctxt -> input -> line ; # ifdef LIBXML_SAX1_ENABLED if ( ctxt -> sax2 ) # endif name = xmlParseStartTag2 ( ctxt, & prefix, & URI, & tlen ) ; # ifdef LIBXML_SAX1_ENABLED else name = xmlParseStartTag ( ctxt ) ; # endif <START_BUG> if ( name == NULL ) { <END_BUG> spacePop ( ctxt ) ; return ; } namePush ( ctxt, name ) ; ret = ctxt -> node ; # ifdef LIBXML_VALID_ENABLED if ( ctxt -> validate && ctxt -> wellFormed && ctxt -> myDoc && ctxt -> node && ( ctxt -> node == ctxt -> myDoc -> children ) ) ctxt -> valid &= xmlValidateRoot ( & ctxt -> vctxt, ctxt -> myDoc ) ; # endif if ( ( RAW == '//' ) && ( NXT ( 1 ) == '>' ) ) { SKIP ( 2 ) ; if ( ctxt -> sax2 ) { if ( ( ctxt -> sax!= NULL ) && ( ctxt -> sax -> endElementNs!= NULL ) && (! ctxt -> disableSAX ) ) ctxt -> sax -> endElementNs ( ctxt -> userData,

Fix:
<S2SV_ModStart> endif if ( ctxt -> instate == XML_PARSER_EOF ) return ; if (
Buggy code:
 static int chmd_read_headers ( struct mspack_system * sys, struct mspack_file * fh, struct mschmd_header * chm, int entire ) { unsigned int section, name_len, x, errors, num_chunks ; unsigned char buf [ 0x54 ], * chunk = NULL, * name, * p, * end ; struct mschmd_file * fi, * link = NULL ; off_t offset, length ; int num_entries ; chm -> files = NULL ; chm -> sysfiles = NULL ; chm -> chunk_cache = NULL ; chm -> sec0. base. chm = chm ; chm -> sec0. base. id = 0 ; chm -> sec1. base. chm = chm ; chm -> sec1. base. id = 1 ; chm -> sec1. content = NULL ; chm -> sec1. control = NULL ; chm -> sec1. spaninfo = NULL ; chm -> sec1. rtable = NULL ; if ( sys -> read ( fh, & buf [ 0 ], chmhead_SIZEOF )!= chmhead_SIZEOF ) { return MSPACK_ERR_READ ; } if ( EndGetI32 ( & buf [ chmhead_Signature ] )!= 0x46535449 ) { return MSPACK_ERR_SIGNATURE ; } if ( memcmp ( & buf [ chmhead_GUID1 ], & guids [ 0 ], 32L )!= 0 ) { D ( ( "incorrect   GUIDs" ) ) return MSPACK_ERR_SIGNATURE ; } chm -> version = EndGetI32 ( & buf [ chmhead_Version ] ) ; chm -> timestamp = EndGetM32 ( & buf [ chmhead_Timestamp ] ) ; chm -> language = EndGetI32 ( & buf [ chmhead_LanguageID ] ) ; if ( chm -> version > 3 ) { sys -> message ( fh, "WARNING;   CHM   version   >   3" ) ; } if ( sys -> read ( fh, & buf [ 0 ], chmhst3_SIZEOF )!= chmhst3_SIZEOF ) { return MSPACK_ERR_READ ; } if ( read_off64 ( & offset, & buf [ chmhst_OffsetHS0 ]

Fix:
<S2SV_ModStart> { if ( name_len == 40 && memcmp ( name, content_name, 40 <S2SV_ModEnd> ) == 0 <S2SV_ModStart> 0 ) { chm -> sec1. content = fi ; } else if ( name_len == 44 && memcmp ( name, control_name, 44 <S2SV_ModEnd> ) == 0 <S2SV_ModStart> -> sec1. control <S2SV_ModEnd> = fi ; <S2SV_ModStart> else if ( name_len == 41 && memcmp ( name, spaninfo_name, 41 <S2SV_ModEnd> ) == 0 <S2SV_ModStart> -> sec1. spaninfo <S2SV_ModEnd> = fi ; <S2SV_ModStart> else if ( name_len == 105 && memcmp ( name, rtable_name, 105 <S2SV_ModEnd> ) == 0 <S2SV_ModStart> -> sec1. <S2SV_ModEnd> rtable = fi <S2SV_ModStart> = fi ; <S2SV_ModEnd> } fi ->
Buggy code:
 static int kill_something_info ( int sig, struct siginfo * info, pid_t pid ) { int ret ; if ( pid > 0 ) { rcu_read_lock ( ) ; ret = kill_pid_info ( sig, info, find_vpid ( pid ) ) ; rcu_read_unlock ( ) ; return ret ; <START_BUG> } <END_BUG> read_lock ( & tasklist_lock ) ; if ( pid!= - 1 ) { ret = __kill_pgrp_info ( sig, info, pid? find_vpid ( - pid ) : task_pgrp ( current ) ) ; } else { int retval = 0, count = 0 ; struct task_struct * p ; for_each_process ( p ) { if ( task_pid_vnr ( p ) > 1 &&! same_thread_group ( p, current ) ) { int err = group_send_sig_info ( sig, info, p ) ; ++ count ; if ( err!= - EPERM ) retval = err ; } } ret = count? retval : - ESRCH ; } read_unlock ( & tasklist_lock ) ; return ret ; }

Fix:
<S2SV_ModStart> ret ; } if ( pid == INT_MIN ) return - ESRCH ;
Buggy code:
 void comps_rtree_unite ( COMPS_RTree * rt1, COMPS_RTree * rt2 ) { COMPS_HSList * tmplist, * tmp_subnodes ; COMPS_HSListItem * it ; struct Pair { COMPS_HSList * subnodes ; char * key ; <START_BUG> char added ; <END_BUG> } * pair, * parent_pair ; pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = rt2 -> subnodes ; pair -> key = NULL ; tmplist = comps_hslist_create ( ) ; comps_hslist_init ( tmplist, NULL, NULL, & free ) ; comps_hslist_append ( tmplist, pair, 0 ) ; while ( tmplist -> first!= NULL ) { it = tmplist -> first ; comps_hslist_remove ( tmplist, tmplist -> first ) ; tmp_subnodes = ( ( struct Pair * ) it -> data ) -> subnodes ; parent_pair = ( struct Pair * ) it -> data ; free ( it ) ; for ( it = tmp_subnodes -> first ; it!= NULL ; it = it -> next ) { pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = ( ( COMPS_RTreeData * ) it -> data ) -> subnodes ; if ( parent_pair -> key!= NULL ) { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_RTreeData * ) it -> data ) -> key ) + strlen ( parent_pair -> key ) + 1 ) ) ; memcpy ( pair -> key, parent_pair -> key, sizeof ( char ) * strlen ( parent_pair -> key ) ) ; memcpy ( pair -> key + strlen ( parent_pair -> key ), ( ( COMPS_RTreeData * ) it -> data ) -> key, sizeof ( char ) * ( strlen ( ( ( COMPS_RTreeData * ) it -> data ) -> key ) + 1 ) ) ; } else { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_RTreeData * ) it -> data ) -> key ) + 1 ) ) ; memcpy ( pair -> key, ( ( COMPS_RTreeData * ) it -> data ) -> key, sizeof ( char ) * ( strlen (

Fix:
<S2SV_ModStart> * key ; <S2SV_ModEnd> } * pair
Buggy code:
 int validate_camera_metadata_structure ( const camera_metadata_t * metadata, const size_t * expected_size ) { if ( metadata == NULL ) { ALOGE ( "%s:   metadata   is   null!", __FUNCTION__ ) ; return ERROR ; } { static const struct { const char * name ; size_t alignment ; } alignments [ ] = { {. name = "camera_metadata",. alignment = METADATA_ALIGNMENT }, {. name = "camera_metadata_buffer_entry",. alignment = ENTRY_ALIGNMENT }, {. name = "camera_metadata_data",. alignment = DATA_ALIGNMENT }, } ; for ( size_t i = 0 ; i < sizeof ( alignments ) // sizeof ( alignments [ 0 ] ) ; ++ i ) { uintptr_t aligned_ptr = ALIGN_TO ( metadata, alignments [ i ]. alignment ) ; if ( ( uintptr_t ) metadata!= aligned_ptr ) { ALOGE ( "%s:   Metadata   pointer   is   not   aligned   (actual   %p,   " "expected   %p)   to   type   %s", __FUNCTION__, metadata, ( void * ) aligned_ptr, alignments [ i ]. name ) ; return ERROR ; } } } if ( expected_size!= NULL && metadata -> size > * expected_size ) { ALOGE ( "%s:   Metadata   size   (%" PRIu32 ")   should   be   <=   expected   size   (%zu)", __FUNCTION__, metadata -> size, * expected_size ) ; return ERROR ; } if ( metadata -> entry_count > metadata -> entry_capacity ) { ALOGE ( "%s:   Entry   count   (%" PRIu32 ")   should   be   <=   entry   capacity   " "(%" PRIu32 ")", __FUNCTION__, metadata -> entry_count, metadata -> entry_capacity ) ; return ERROR ; } const metadata_uptrdiff_t entries_end = metadata -> entries_start + metadata -> entry_capacity ; if ( entries_end < metadata -> entries_start || entries_end > metadata -> data_start ) { ALOGE ( "%s:   Entry   start   +   capacity   (%" PRIu32 ")   should   be   <=   data   start   " "(%"

Fix:
<S2SV_ModStart> } size_t data_size ; if ( validate_and_calculate_camera_metadata_entry_data_size ( & data_size, <S2SV_ModEnd> entry. type <S2SV_ModStart>. count )!= OK ) { ALOGE ( "%s: <S2SV_blank> Entry <S2SV_blank> data <S2SV_blank> size <S2SV_blank> is <S2SV_blank> invalid. <S2SV_blank> type: <S2SV_blank> %u <S2SV_blank> count: <S2SV_blank> %u", __FUNCTION__, entry. type, entry. count ) ; return ERROR ; } <S2SV_ModEnd> if ( data_size
Buggy code:
 <START_BUG> static double get_prediction_decay_rate ( const VP9_COMMON * cm, <END_BUG> const FIRSTPASS_STATS * next_frame ) {  const double mb_sr_err_diff = ( next_frame -> sr_coded_error - <START_BUG> next_frame -> coded_error ) // cm -> MBs ; <END_BUG> const double second_ref_decay = mb_sr_err_diff <= 512.0  <START_BUG>? fclamp ( pow ( 1.0 - ( mb_sr_err_diff // 512.0 ), 0.5 ), 0.85, 1.0 ) <END_BUG> : 0.85 ; return MIN ( second_ref_decay, next_frame -> pcnt_inter ) ; }

Fix:
<S2SV_ModStart> get_prediction_decay_rate ( const VP9_COMP * cpi <S2SV_ModEnd>, const FIRSTPASS_STATS <S2SV_ModStart> { const double sr_decay_rate = get_sr_decay_rate ( cpi, next_frame ) <S2SV_ModEnd> ; const double <S2SV_ModStart> ; const double zero_motion_factor = ( 0.95 * pow ( ( next_frame -> pcnt_inter - next_frame -> pcnt_motion ), ZM_POWER_FACTOR ) ) ; return MAX ( zero_motion_factor, ( sr_decay_rate + ( <S2SV_ModEnd> ( 1.0 - <S2SV_ModStart> ( 1.0 - sr_decay_rate ) * zero_motion_factor ) ) <S2SV_ModEnd> ) ; }
Buggy code:
 static Image * ReadBMPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { BMPInfo bmp_info ; Image * image ; MagickBooleanType status ; MagickOffsetType offset, start_position ; MemoryInfo * pixel_info ; Quantum index ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bit, bytes_per_line, length ; ssize_t count, y ; unsigned char magick [ 12 ], * pixels ; unsigned int blue, green, offset_bits, red ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) memset ( & bmp_info, 0, sizeof ( bmp_info ) ) ; bmp_info. ba_offset = 0 ; start_position = 0 ; offset_bits = 0 ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { PixelInfo quantum_bits ; PixelPacket shift ; start_position = TellBlob ( image ) - 2 ; bmp_info. ba_offset = 0 ; while ( LocaleNCompare ( ( char * ) magick, "BA", 2 ) == 0 ) { bmp_info. file_size = ReadBlobLSBLong ( image ) ; bmp_info. ba_offset = ReadBlobLSBLong ( image ) ; bmp_info. offset_bits = ReadBlobLSBLong ( image ) ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) break ; } if ( image -> debug!=

Fix:
<S2SV_ModStart> ; if ( ( MagickSizeType ) <S2SV_ModStart> ) break ; offset = ( MagickOffsetType ) <S2SV_ModEnd> bmp_info. ba_offset <S2SV_ModStart> bmp_info. ba_offset ; if ( offset <S2SV_ModStart>!= 0 ) if ( <S2SV_ModEnd> ( offset < <S2SV_ModStart> ( offset < TellBlob ( image ) ) || ( SeekBlob ( image, offset, SEEK_SET )!= offset ) <S2SV_ModEnd> ) ThrowReaderException ( <S2SV_ModStart> "ImproperImageHeader" ) ; * magick = '\\0' ; <S2SV_ModEnd> count = ReadBlob
Buggy code:
 static int v9fs_xattr_set_acl ( const struct xattr_handler * handler, struct dentry * dentry, struct inode * inode, const char * name, const void * value, size_t size, int flags ) { int retval ; struct posix_acl * acl ; struct v9fs_session_info * v9ses ; v9ses = v9fs_dentry2v9ses ( dentry ) ; if ( ( v9ses -> flags & V9FS_ACCESS_MASK )!= V9FS_ACCESS_CLIENT ) return v9fs_xattr_set ( dentry, handler -> name, value, size, flags ) ; if ( S_ISLNK ( inode -> i_mode ) ) return - EOPNOTSUPP ; if (! inode_owner_or_capable ( inode ) ) return - EPERM ; if ( value ) { acl = posix_acl_from_xattr ( & init_user_ns, value, size ) ; if ( IS_ERR ( acl ) ) return PTR_ERR ( acl ) ; else if ( acl ) { retval = posix_acl_valid ( inode -> i_sb -> s_user_ns, acl ) ; if ( retval ) goto err_out ; } } else acl = NULL ; switch ( handler -> flags ) { case ACL_TYPE_ACCESS : if ( acl ) { <START_BUG> umode_t mode = inode -> i_mode ; <END_BUG> retval = posix_acl_equiv_mode ( acl, & mode ) ; if ( retval < 0 ) goto err_out ;  else { <START_BUG> struct iattr iattr ; if ( retval == 0 ) { acl = NULL ; value = NULL ; size = 0 ; } iattr. ia_mode = ( ( mode & S_IALLUGO ) | ( inode -> i_mode & ~ S_IALLUGO ) ) ; iattr. ia_valid = ATTR_MODE ; v9fs_vfs_setattr_dotl ( dentry, & iattr ) ; <END_BUG> }  } break ; case ACL_TYPE_DEFAULT : if (! S_ISDIR ( inode -> i_mode ) ) { retval = acl? - EINVAL : 0 ; goto err_out ; } break ; default : BUG ( ) ; } retval = v9fs_xattr_

Fix:
<S2SV_ModStart> acl ) { struct iattr iattr ; retval = posix_acl_update_mode ( inode, & iattr. ia_mode, & acl ) ; if ( retval <S2SV_ModEnd> ) goto err_out <S2SV_ModStart> goto err_out ; if (! acl ) { value = NULL ; size = 0 ; } <S2SV_ModEnd> iattr. ia_valid <S2SV_ModStart> iattr ) ; <S2SV_ModEnd> } break ;
Buggy code:
 static UINT serial_process_irp_create ( SERIAL_DEVICE * serial, IRP * irp ) { DWORD DesiredAccess ; DWORD SharedAccess ; DWORD CreateDisposition ; UINT32 PathLength ; if ( Stream_GetRemainingLength ( irp -> input ) < 32 ) return ERROR_INVALID_DATA ; Stream_Read_UINT32 ( irp -> input, DesiredAccess ) ; Stream_Seek_UINT64 ( irp -> input ) ; Stream_Seek_UINT32 ( irp -> input ) ; Stream_Read_UINT32 ( irp -> input, SharedAccess ) ; Stream_Read_UINT32 ( irp -> input, CreateDisposition ) ; Stream_Seek_UINT32 ( irp -> input ) ; Stream_Read_UINT32 ( irp -> input, PathLength ) ; <START_BUG> if ( Stream_GetRemainingLength ( irp -> input ) < PathLength ) <END_BUG>  return ERROR_INVALID_DATA ; <START_BUG> Stream_Seek ( irp -> input, PathLength ) ; assert ( PathLength == 0 ) ; # ifndef _WIN32 WLog_Print ( serial -> log, WLOG_DEBUG, "DesiredAccess:   0x%" PRIX32 ",   SharedAccess:   0x%" PRIX32 ",   CreateDisposition:   0x%" PRIX32 "", DesiredAccess, SharedAccess, CreateDisposition ) ; DesiredAccess = GENERIC_READ | GENERIC_WRITE ; SharedAccess = 0 ; CreateDisposition = OPEN_EXISTING ; # endif serial -> hComm = CreateFile ( serial -> device. name, DesiredAccess, SharedAccess, NULL, CreateDisposition, 0, NULL ) ; if (! serial -> hComm || ( serial -> hComm == INVALID_HANDLE_VALUE ) ) { WLog_Print ( serial -> log, WLOG_WARN, "CreateFile   failure:   %s   last-error:   0x%08" PRIX32 "", serial -> device. name, GetLastError ( ) ) ; irp -> IoStatus = STATUS_UNSUCCESSFUL ; goto error_handle ; } _comm_setServerSerialDriver ( serial -> hComm, serial -> ServerSerialDriverId ) ; _comm_set_permissive ( serial -> hComm, serial -> permissive ) ; assert ( irp -> FileId == 0 ) ; irp -> FileId = irp -><END_BUG>

Fix:
<S2SV_ModStart> ; if (! Stream_SafeSeek ( irp -> input, PathLength ) <S2SV_ModEnd> ) return ERROR_INVALID_DATA <S2SV_ModStart> ) return ERROR_INVALID_DATA <S2SV_ModEnd> ; assert (
Buggy code:
 void ksz8851EventHandler ( NetInterface * interface ) { uint16_t status ; uint_t frameCount ; <START_BUG> status = ksz8851ReadReg ( interface, KSZ8851_REG_ISR ) ; <END_BUG> if ( ( status & ISR_LCIS )!= 0 ) {  ksz8851WriteReg ( interface, KSZ8851_REG_ISR, ISR_LCIS ) ; <START_BUG> <END_BUG> status = ksz8851ReadReg ( interface, KSZ8851_REG_P1SR ) ;  if ( ( status & P1SR_LINK_GOOD )!= 0 ) { if ( ( status & P1SR_OPERATION_SPEED )!= 0 ) { interface -> linkSpeed = NIC_LINK_SPEED_100MBPS ; } else { interface -> linkSpeed = NIC_LINK_SPEED_10MBPS ; } <START_BUG> if ( ( status & P1SR_OPERATION_DUPLEX )!= 0 ) <END_BUG> { interface -> duplexMode = NIC_FULL_DUPLEX_MODE ; } else { interface -> duplexMode = NIC_HALF_DUPLEX_MODE ; } interface -> linkState = TRUE ; } else { interface -> linkState = FALSE ; } nicNotifyLinkChange ( interface ) ; }  if ( ( status & ISR_RXIS )!= 0 ) <START_BUG> { <END_BUG> ksz8851WriteReg ( interface, KSZ8851_REG_ISR, ISR_RXIS ) ;  <START_BUG> frameCount = MSB ( ksz8851ReadReg ( interface, KSZ8851_REG_RXFCTR ) ) ; <END_BUG> while ( frameCount > 0 ) { ksz8851ReceivePacket ( interface ) ; frameCount -- ; } }  ksz8851SetBit ( interface, KSZ8851_REG_IER, IER_LCIE | IER_RXIE ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( interface, KSZ8851_ISR ) ; if ( ( status & KSZ8851_ISR_LCIS <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, KSZ8851_ISR, KSZ8851_ISR_LCIS <S2SV_ModEnd> ) ; status <S2SV_ModStart> ( interface, KSZ8851_P1SR ) ; if ( ( status & KSZ8851_P1SR_LINK_GOOD )!= 0 ) { if ( ( status & KSZ8851_P1SR_OPERATION_SPEED <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( status & KSZ8851_P1SR_OPERATION_DUPLEX <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( status & KSZ8851_ISR_RXIS <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, KSZ8851_ISR, KSZ8851_ISR_RXIS <S2SV_ModEnd> ) ; frameCount <S2SV_ModStart> ( interface, KSZ8851_RXFCTR <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, KSZ8851_IER, KSZ8851_IER_LCIE | KSZ8851_IER_RXIE <S2SV_ModEnd> ) ; }
Buggy code:
 void ndpi_parse_packet_line_info ( struct ndpi_detection_module_struct * ndpi_str, struct ndpi_flow_struct * flow ) { u_int32_t a ; struct ndpi_packet_struct * packet = & flow -> packet ; if ( ( packet -> payload_packet_len < 3 ) || ( packet -> payload == NULL ) ) return ; if ( packet -> packet_lines_parsed_complete!= 0 ) return ; packet -> packet_lines_parsed_complete = 1 ; ndpi_reset_packet_line_info ( packet ) ; packet -> line [ packet -> parsed_lines ]. ptr = packet -> payload ; packet -> line [ packet -> parsed_lines ]. len = 0 ; for ( a = 0 ; ( a < packet -> payload_packet_len ) && ( packet -> parsed_lines < NDPI_MAX_PARSE_LINES_PER_PACKET ) ; a ++ ) { if ( ( a + 1 ) >= packet -> payload_packet_len ) return ; if ( get_u_int16_t ( packet -> payload, a ) == ntohs ( 0x0d0a ) ) { if ( ( ( a + 3 ) <= packet -> payload_packet_len ) && ( get_u_int16_t ( packet -> payload, a + 2 ) == ntohs ( 0x0d0a ) ) ) { int diff ; u_int32_t a1 = a + 4 ; <START_BUG> diff = ndpi_min ( packet -> payload_packet_len - a1, sizeof ( flow -> initial_binary_bytes ) ) ; <END_BUG>  if ( diff > 0 ) { <START_BUG> memcpy ( & flow -> initial_binary_bytes, & packet -> payload [ a1 ], diff ) ; flow -> initial_binary_bytes_len = diff ; } } packet -> line [ packet -> parsed_lines ]. len = ( u_int16_t ) ( ( ( unsigned long ) & packet -> payload [ a ] ) - ( ( unsigned long ) packet -> line [ packet -> parsed_lines ]. ptr ) ) ; if ( packet -> parsed_lines == 0 && packet -> line [ 0 ]. len >= NDPI_STATICSTRING_LEN ( "HTTP//1.X   200   " ) && strncasecmp ( ( const char * )<END_BUG>

Fix:
<S2SV_ModStart> ; diff = <S2SV_ModEnd> packet -> payload_packet_len <S2SV_ModStart> payload_packet_len - a1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> 0 ) { diff = ndpi_min ( diff, sizeof ( flow -> initial_binary_bytes ) ) ;
Buggy code:
 <START_BUG> void * H264SwDecMalloc ( u32 size ) { <END_BUG>  return malloc ( size ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( u32 size, u32 num ) { if ( size > UINT32_MAX // num ) { ALOGE ( "can\'t <S2SV_blank> allocate <S2SV_blank> %u <S2SV_blank> * <S2SV_blank> %u <S2SV_blank> bytes", size, num ) ; android_errorWriteLog ( 0x534e4554, "27855419" ) ; return NULL ; } <S2SV_ModEnd> return malloc ( <S2SV_ModStart> malloc ( size * num
Buggy code:
 static void process_demand_active ( STREAM s ) { uint8 type ; uint16 len_src_descriptor, len_combined_caps ; <START_BUG> rd_create_ui ( ) ; <END_BUG> in_uint32_le ( s, g_rdp_shareid ) ; in_uint16_le ( s, len_src_descriptor ) ;  in_uint16_le ( s, len_combined_caps ) ; <START_BUG> in_uint8s ( s, len_src_descriptor ) ; logger ( Protocol, Debug, "process_demand_active(),   shareid=0x%x", g_rdp_shareid ) ; rdp_process_server_caps ( s, len_combined_caps ) ; rdp_send_confirm_active ( ) ; rdp_send_synchronise ( ) ; rdp_send_control ( RDP_CTL_COOPERATE ) ; rdp_send_control ( RDP_CTL_REQUEST_CONTROL ) ; rdp_recv ( & type ) ; rdp_recv ( & type ) ; rdp_recv ( & type ) ; rdp_send_input ( 0, RDP_INPUT_SYNCHRONIZE, 0, g_numlock_sync? ui_get_numlock_state ( read_keyboard_state ( ) ) : 0, 0 ) ; if ( g_rdp_version >= RDP_V5 ) { rdp_enum_bmpcache2 ( ) ; rdp_send_fonts ( 3 ) ; } else { rdp_send_fonts ( 1 ) ; rdp_send_fonts ( 2 ) ; } rdp_recv ( & type ) ; reset_order_state ( ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, len_combined_caps ; struct stream packet = * s ; <S2SV_ModStart> len_combined_caps ) ; if (! s_check_rem ( s, len_src_descriptor ) ) { rdp_protocol_error ( "rdp_demand_active(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> source <S2SV_blank> descriptor <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 void vp9_default_coef_probs ( VP9_COMMON * cm ) { <START_BUG> vp9_copy ( cm -> fc. coef_probs [ TX_4X4 ], default_coef_probs_4x4 ) ; <END_BUG>  vp9_copy ( cm -> fc. coef_probs [ TX_8X8 ], default_coef_probs_8x8 ) ; <START_BUG> <END_BUG> vp9_copy ( cm -> fc. coef_probs [ TX_16X16 ], default_coef_probs_16x16 ) ;  <START_BUG> vp9_copy ( cm -> fc. coef_probs [ TX_32X32 ], default_coef_probs_32x32 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> coef_probs [ TX_4X4 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> coef_probs [ TX_8X8 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> coef_probs [ TX_16X16 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> coef_probs [ TX_32X32
Buggy code:
 static void box_blur_line ( gint box_width, gint even_offset, guchar * src, guchar * dest, gint len, gint bpp ) { gint i ; gint lead ; gint output ; gint trail ; <START_BUG> gint * ac ; <END_BUG> ac = g_new0 ( gint, bpp ) ; lead = 0 ; if ( box_width % 2!= 0 ) { output = lead - ( box_width - 1 ) // 2 ; trail = lead - box_width ; } else { if ( even_offset == 1 ) { output = lead + 1 - box_width // 2 ; trail = lead - box_width ; } else if ( even_offset == - 1 ) { output = lead - box_width // 2 ; trail = lead - box_width ; } else { g_assert_not_reached ( ) ; } } for ( i = 0 ; i < bpp ; i ++ ) ac [ i ] = 0 ; while ( output < len ) { guint coverage = ( lead < len? lead : len - 1 ) - ( trail >= 0? trail : - 1 ) ; # ifdef READABLE_BOXBLUR_CODE for ( i = 0 ; i < bpp ; i ++ ) { if ( lead < len ) ac [ i ] += src [ bpp * lead + i ] ; if ( trail >= 0 ) ac [ i ] -= src [ bpp * trail + i ] ; if ( output >= 0 ) dest [ bpp * output + i ] = ( ac [ i ] + ( coverage >> 1 ) ) // coverage ; } # endif if ( lead < len ) { if ( trail >= 0 ) { for ( i = 0 ; i < bpp ; i ++ ) { ac [ i ] += src [ bpp * lead + i ] ; ac [ i ] -= src [ bpp * trail + i ] ; dest [ bpp * output + i ] = ( ac [ i ] + ( coverage >> 1 ) ) // coverage ; } } else if ( output >= 0 ) { for ( i = 0 ; i < bpp ; i ++ ) { ac [ i ] += src [ bpp * lead + i ] ; dest [ bpp * output + i ] = ( ac [ i ] + ( coverage >> 1 ) ) // coverage ; } } else { for

Fix:
<S2SV_ModStart> gint * ac ; g_assert ( box_width > 0 )
Buggy code:
 static void set_default_lf_deltas ( VP8_COMP * cpi ) { cpi -> mb. e_mbd. mode_ref_lf_delta_enabled = 1 ; cpi -> mb. e_mbd. mode_ref_lf_delta_update = 1 ; <START_BUG> vpx_memset ( cpi -> mb. e_mbd. ref_lf_deltas, 0, sizeof ( cpi -> mb. e_mbd. ref_lf_deltas ) ) ; <END_BUG>  vpx_memset ( cpi -> mb. e_mbd. mode_lf_deltas, 0, sizeof ( cpi -> mb. e_mbd. mode_lf_deltas ) ) ; <START_BUG> cpi -> mb. e_mbd. ref_lf_deltas [ INTRA_FRAME ] = 2 ; cpi -> mb. e_mbd. ref_lf_deltas [ LAST_FRAME ] = 0 ; cpi -> mb. e_mbd. ref_lf_deltas [ GOLDEN_FRAME ] = - 2 ; cpi -> mb. e_mbd. ref_lf_deltas [ ALTREF_FRAME ] = - 2 ; cpi -> mb. e_mbd. mode_lf_deltas [ 0 ] = 4 ; if ( cpi -> oxcf. Mode == MODE_REALTIME ) cpi -> mb. e_mbd. mode_lf_deltas [ 1 ] = - 12 ; else cpi -> mb. e_mbd. mode_lf_deltas [ 1 ] = - 2 ; cpi -> mb. e_mbd. mode_lf_deltas [ 2 ] = 2 ; cpi -> mb. e_mbd. mode_lf_deltas [ 3 ] = 4 ; }<END_BUG>

Fix:
<S2SV_ModStart> = 1 ; memset <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( cpi ->
Buggy code:
 static int dtls1_process_record ( SSL * s ) { int i, al ; int enc_err ; SSL_SESSION * sess ; SSL3_RECORD * rr ; unsigned int mac_size ; unsigned char md [ EVP_MAX_MD_SIZE ] ; rr = & ( s -> s3 -> rrec ) ; sess = s -> session ; rr -> input = & ( s -> packet [ DTLS1_RT_HEADER_LENGTH ] ) ; if ( rr -> length > SSL3_RT_MAX_ENCRYPTED_LENGTH ) { al = SSL_AD_RECORD_OVERFLOW ; SSLerr ( SSL_F_DTLS1_PROCESS_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG ) ; goto f_err ; } rr -> data = rr -> input ; rr -> orig_len = rr -> length ; enc_err = s -> method -> ssl3_enc -> enc ( s, 0 ) ; if ( enc_err == 0 ) { rr -> length = 0 ; s -> packet_length = 0 ; goto err ; } # ifdef TLS_DEBUG printf ( "dec   %d\\n", rr -> length ) ; { unsigned int z ; for ( z = 0 ; z < rr -> length ; z ++ ) printf ( "%02X%c", rr -> data [ z ], ( ( z + 1 ) % 16 )?' ': '\\n' ) ; } printf ( "\\n" ) ; # endif if ( ( sess!= NULL ) && ( s -> enc_read_ctx!= NULL ) && ( EVP_MD_CTX_md ( s -> read_hash )!= NULL ) ) { unsigned char * mac = NULL ; unsigned char mac_tmp [ EVP_MAX_MD_SIZE ] ; mac_size = EVP_MD_CTX_size ( s -> read_hash ) ; OPENSSL_assert ( mac_size <= EVP_MAX_MD_SIZE ) ; if ( rr -> orig_len < mac_size || ( EVP_CIPHER_CTX_mode ( s -> enc_read_ctx ) == EVP_CIPH_CBC_MODE && rr -> orig_len < mac_size + 1 ) ) { al = SSL_AD_DECODE_ERROR ; SSLerr ( SSL_F_DTLS1_PROCESS

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> return ( 1
Buggy code:
 int xfs_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int error = 0 ; if (! acl ) goto set_acl ; error = - E2BIG ; if ( acl -> a_count > XFS_ACL_MAX_ENTRIES ( XFS_M ( inode -> i_sb ) ) ) return error ; if ( type == ACL_TYPE_ACCESS ) { <START_BUG> umode_t mode = inode -> i_mode ; <END_BUG>  error = posix_acl_equiv_mode ( acl, & mode ) ; <START_BUG> <END_BUG> if ( error <= 0 ) {  acl = NULL ; if ( error < 0 ) return error ; <START_BUG> } <END_BUG> error = xfs_set_mode ( inode, mode ) ; if ( error ) return error ; } set_acl : return __xfs_set_acl ( inode, type, acl ) ; }

Fix:
<S2SV_ModStart> { umode_t mode <S2SV_ModEnd> ; error = <S2SV_ModStart> ; error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & mode <S2SV_ModStart>, & mode, & acl <S2SV_ModStart> if ( error <S2SV_ModEnd> ) return error <S2SV_ModStart> return error ; <S2SV_ModEnd> error = xfs_set_mode
Buggy code:
 int f2fs_trim_fs ( struct f2fs_sb_info * sbi, struct fstrim_range * range ) { __u64 start = F2FS_BYTES_TO_BLK ( range -> start ) ; __u64 end = start + F2FS_BYTES_TO_BLK ( range -> len ) - 1 ; unsigned int start_segno, end_segno ; struct cp_control cpc ; int err = 0 ; if ( start >= MAX_BLKADDR ( sbi ) || range -> len < sbi -> blocksize ) return - EINVAL ; cpc. trimmed = 0 ; if ( end <= MAIN_BLKADDR ( sbi ) ) goto out ; if ( is_sbi_flag_set ( sbi, SBI_NEED_FSCK ) ) { f2fs_msg ( sbi -> sb, KERN_WARNING, "Found   FS   corruption,   run   fsck   to   fix." ) ; goto out ; } start_segno = ( start <= MAIN_BLKADDR ( sbi ) )? 0 : GET_SEGNO ( sbi, start ) ; end_segno = ( end >= MAX_BLKADDR ( sbi ) )? MAIN_SEGS ( sbi ) - 1 : GET_SEGNO ( sbi, end ) ; cpc. reason = CP_DISCARD ; cpc. trim_minlen = max_t ( __u64, 1, F2FS_BYTES_TO_BLK ( range -> minlen ) ) ; for ( ; start_segno <= end_segno ; start_segno = cpc. trim_end + 1 ) { cpc. trim_start = start_segno ; if ( sbi -> discard_blks == 0 ) break ; else if ( sbi -> discard_blks < BATCHED_TRIM_BLOCKS ( sbi ) ) cpc. trim_end = end_segno ; else cpc. trim_end = min_t ( unsigned int, rounddown ( start_segno + BATCHED_TRIM_SEGMENTS ( sbi ), sbi -> segs_per_sec ) - 1, end_segno ) ; mutex_lock (

Fix:
<S2SV_ModStart> f2fs_wait_discard_bios ( sbi, false
Buggy code:
 Bool rfbOptPamAuth ( void ) { SecTypeData * s ; for ( s = secTypes ; s -> name!= NULL ; s ++ ) { if ( (! strcmp ( s -> name, "unixlogin" ) || <START_BUG>! strcmp ( & s -> name [ strlen ( s -> name ) - 5 ], "plain" ) ) && s -> enabled ) <END_BUG> return TRUE ; } return FALSE ; }

Fix:
<S2SV_ModStart> "unixlogin" ) || strstr <S2SV_ModEnd> ( s -> <S2SV_ModStart> s -> name <S2SV_ModEnd>, "plain" )
Buggy code:
 <START_BUG> static void pcrypt_free ( struct crypto_instance * inst ) <END_BUG> {  struct pcrypt_instance_ctx * ctx = crypto_instance_ctx ( inst ) ; <START_BUG> crypto_drop_aead ( & ctx -> spawn ) ; kfree ( inst ) ; }<END_BUG>

Fix:
<S2SV_ModStart> pcrypt_free ( struct aead_instance <S2SV_ModEnd> * inst ) <S2SV_ModStart> * ctx = aead_instance_ctx <S2SV_ModEnd> ( inst )
Buggy code:
 static int decode_bit_string ( const u8 * inbuf, size_t inlen, void * outbuf, size_t outlen, int invert ) { const u8 * in = inbuf ; u8 * out = ( u8 * ) outbuf ; <START_BUG> int zero_bits = * in & 0x07 ; <END_BUG>  size_t octets_left = inlen - 1 ; <START_BUG> <END_BUG> int i, count = 0 ;  memset ( outbuf, 0, outlen ) ; in ++ ; if ( outlen < octets_left ) return SC_ERROR_BUFFER_TOO_SMALL ; if ( inlen < 1 ) return SC_ERROR_INVALID_ASN1_OBJECT ; while ( octets_left ) { int bits_to_go ; * out = 0 ; if ( octets_left == 1 ) bits_to_go = 8 - zero_bits ; else bits_to_go = 8 ; if ( invert ) for ( i = 0 ; i < bits_to_go ; i ++ ) { * out |= ( ( * in >> ( 7 - i ) ) & 1 ) << i ; } else { * out = * in ; } out ++ ; in ++ ; octets_left -- ; count ++ ; } return ( count * 8 ) - zero_bits ; }

Fix:
<S2SV_ModStart> outbuf ; int i, count = 0 ; int zero_bits ; size_t octets_left ; if ( outlen < octets_left ) return SC_ERROR_BUFFER_TOO_SMALL ; if ( inlen < 1 ) return SC_ERROR_INVALID_ASN1_OBJECT ; <S2SV_ModStart> & 0x07 ; <S2SV_ModEnd> octets_left = inlen <S2SV_ModStart> - 1 ; in ++ ; memset ( outbuf, 0, outlen ) ; while ( octets_left ) { int bits_to_go ; * out = 0 ; if ( octets_left == 1 ) bits_to_go = 8 - zero_bits ; else bits_to_go = 8 ; if ( invert ) for ( i = 0 ; i < bits_to_go ; i ++ ) { * out |= ( ( * in >> ( 7 - i ) ) & 1 ) << i ; } else { * out = * in ; } out ++ ; in ++ ; octets_left -- ; count ++ ; } return ( count * 8 <S2SV_ModEnd> ) - zero_bits
Buggy code:
 int phar_verify_signature ( php_stream * fp, size_t end_of_phar, php_uint32 sig_type, char * sig, int sig_len, char * fname, char * * signature, int * signature_len, char * * error ) { int read_size, len ; zend_off_t read_len ; unsigned char buf [ 1024 ] ; php_stream_rewind ( fp ) ; switch ( sig_type ) { case PHAR_SIG_OPENSSL : { # ifdef PHAR_HAVE_OPENSSL BIO * in ; EVP_PKEY * key ; EVP_MD * mdtype = ( EVP_MD * ) EVP_sha1 ( ) ; EVP_MD_CTX md_ctx ; # else int tempsig ; # endif zend_string * pubkey = NULL ; char * pfile ; php_stream * pfp ; # ifndef PHAR_HAVE_OPENSSL if (! zend_hash_str_exists ( & module_registry, "openssl", sizeof ( "openssl" ) - 1 ) ) { if ( error ) { spprintf ( error, 0, "openssl   not   loaded" ) ; } return FAILURE ; } # endif spprintf ( & pfile, 0, "%s.pubkey", fname ) ; pfp = php_stream_open_wrapper ( pfile, "rb", 0, NULL ) ; efree ( pfile ) ; if (! pfp ||! ( pubkey = php_stream_copy_to_mem ( pfp, PHP_STREAM_COPY_ALL, 0 ) ) ||! ZSTR_LEN ( pubkey ) ) { if ( pfp ) { php_stream_close ( pfp ) ; } if ( error ) { spprintf ( error, 0, "openssl   public   key   could   not   be   read" ) ; } return FAILURE ; } php_stream_close ( pfp ) ; # ifndef PHAR_HAVE_OPENSSL tempsig = sig_len ; if ( FAILURE == phar_call_openssl_signverify ( 0, fp, end_of_phar, pubkey? ZSTR_VAL ( pubkey ) : NULL, pubkey? ZSTR_LEN ( pubkey ) : 0, & sig, & tempsig ) ) { if ( pubkey ) {

Fix:
<S2SV_ModStart> PHP_SHA512_CTX context ; if ( sig_len < sizeof ( digest ) ) { if ( error ) { spprintf ( error, 0, "broken <S2SV_blank> signature" ) ; } return FAILURE ; } <S2SV_ModStart> PHP_SHA256_CTX context ; if ( sig_len < sizeof ( digest ) ) { if ( error ) { spprintf ( error, 0, "broken <S2SV_blank> signature" ) ; } return FAILURE ; } <S2SV_ModStart> PHP_SHA1_CTX context ; if ( sig_len < sizeof ( digest ) ) { if ( error ) { spprintf ( error, 0, "broken <S2SV_blank> signature" ) ; } return FAILURE ; } <S2SV_ModStart> PHP_MD5_CTX context ; if ( sig_len < sizeof ( digest <S2SV_ModEnd> ) ) { <S2SV_ModStart> FAILURE ; } PHP_MD5Init ( & context ) ; read_len = end_of_phar ; if ( read_len > sizeof ( buf ) ) { read_size = sizeof ( buf ) ; } else { read_size = ( int ) read_len ; } while ( ( len = php_stream_read ( fp, ( char * ) buf, read_size ) ) > 0 ) { PHP
Buggy code:
 static int packet_setsockopt ( struct socket * sock, int level, int optname, char __user * optval, unsigned int optlen ) { struct sock * sk = sock -> sk ; struct packet_sock * po = pkt_sk ( sk ) ; int ret ; if ( level!= SOL_PACKET ) return - ENOPROTOOPT ; switch ( optname ) { case PACKET_ADD_MEMBERSHIP : case PACKET_DROP_MEMBERSHIP : { struct packet_mreq_max mreq ; int len = optlen ; memset ( & mreq, 0, sizeof ( mreq ) ) ; if ( len < sizeof ( struct packet_mreq ) ) return - EINVAL ; if ( len > sizeof ( mreq ) ) len = sizeof ( mreq ) ; if ( copy_from_user ( & mreq, optval, len ) ) return - EFAULT ; if ( len < ( mreq. mr_alen + offsetof ( struct packet_mreq, mr_address ) ) ) return - EINVAL ; if ( optname == PACKET_ADD_MEMBERSHIP ) ret = packet_mc_add ( sk, & mreq ) ; else ret = packet_mc_drop ( sk, & mreq ) ; return ret ; } case PACKET_RX_RING : case PACKET_TX_RING : { union tpacket_req_u req_u ; int len ; switch ( po -> tp_version ) { case TPACKET_V1 : case TPACKET_V2 : len = sizeof ( req_u. req ) ; break ; case TPACKET_V3 : default : len = sizeof ( req_u. req3 ) ; break ; } if ( optlen < len ) return - EINVAL ; if ( copy_from_user ( & req_u. req, optval, len ) ) return - EFAULT ; return packet_set_ring ( sk, & req_u, 0, optname == PACKET_TX_RING ) ; } case PACKET_COPY_THRESH : { int val ; if ( optlen!= sizeof ( val ) ) return - EINVAL ; if ( copy_from_user ( & val, optval, sizeof ( val ) ) ) return - EFAULT ; pkt_sk ( sk ) -> copy_thresh = val ; return

Fix:
<S2SV_ModStart> ; if ( copy_from_user ( & val, optval, sizeof ( val ) ) ) return - EFAULT ; switch ( val ) { case TPACKET_V1 : case TPACKET_V2 : case TPACKET_V3 : break ; default : return - EINVAL ; } lock_sock ( sk ) ; if ( <S2SV_ModStart>. pg_vec ) { ret = <S2SV_ModEnd> - EBUSY ; <S2SV_ModStart> - EBUSY ; } else { <S2SV_ModEnd> po -> tp_version <S2SV_ModStart> = val ; ret = 0 ; } release_sock ( sk ) ; return ret ; <S2SV_ModEnd> } case PACKET_RESERVE
Buggy code:
 void sctp_association_free ( struct sctp_association * asoc ) { struct sock * sk = asoc -> base. sk ; struct sctp_transport * transport ; struct list_head * pos, * temp ; int i ; <START_BUG> if (! asoc -> temp ) { <END_BUG> list_del ( & asoc -> asocs ) ; if ( sctp_style ( sk, TCP ) && sctp_sstate ( sk, LISTENING ) ) sk -> sk_ack_backlog -- ; } asoc -> base. dead = true ; sctp_outq_free ( & asoc -> outqueue ) ; sctp_ulpq_free ( & asoc -> ulpq ) ; sctp_inq_free ( & asoc -> base. inqueue ) ; sctp_tsnmap_free ( & asoc -> peer. tsn_map ) ; sctp_ssnmap_free ( asoc -> ssnmap ) ; sctp_bind_addr_free ( & asoc -> base. bind_addr ) ; for ( i = SCTP_EVENT_TIMEOUT_NONE ; i < SCTP_NUM_TIMEOUT_TYPES ; ++ i ) { if ( del_timer ( & asoc -> timers [ i ] ) ) sctp_association_put ( asoc ) ; } kfree ( asoc -> peer. cookie ) ; kfree ( asoc -> peer. peer_random ) ; kfree ( asoc -> peer. peer_chunks ) ; kfree ( asoc -> peer. peer_hmacs ) ; list_for_each_safe ( pos, temp, & asoc -> peer. transport_addr_list ) { transport = list_entry ( pos, struct sctp_transport, transports ) ; list_del_rcu ( pos ) ; sctp_transport_free ( transport ) ; } asoc -> peer. transport_count = 0 ; sctp_asconf_queue_teardown ( asoc ) ; if ( asoc -> asconf_addr_del_pending!= NULL ) kfree ( asoc -> asconf_addr_del_pending ) ; sctp_auth_destroy_keys ( & asoc -> endpoint_shared_keys ) ; sctp_auth_key_put ( asoc -> asoc_shared_key ) ; sctp_association_put ( as

Fix:
<S2SV_ModStart> if (! list_empty ( & asoc -> asocs ) <S2SV_ModEnd> ) { list_del
Buggy code:
 int yyparse ( void * yyscanner, YR_COMPILER * compiler ) { int yychar ; YY_INITIAL_VALUE ( static YYSTYPE yyval_default ; ) YYSTYPE yylval YY_INITIAL_VALUE ( = yyval_default ) ; int yynerrs ; int yystate ; int yyerrstatus ; yytype_int16 yyssa [ YYINITDEPTH ] ; yytype_int16 * yyss ; yytype_int16 * yyssp ; YYSTYPE yyvsa [ YYINITDEPTH ] ; YYSTYPE * yyvs ; YYSTYPE * yyvsp ; YYSIZE_T yystacksize ; int yyn ; int yyresult ; int yytoken = 0 ; YYSTYPE yyval ; # if YYERROR_VERBOSE char yymsgbuf [ 128 ] ; char * yymsg = yymsgbuf ; YYSIZE_T yymsg_alloc = sizeof yymsgbuf ; # endif # define YYPOPSTACK ( N ) ( yyvsp -= ( N ), yyssp -= ( N ) ) int yylen = 0 ; yyssp = yyss = yyssa ; yyvsp = yyvs = yyvsa ; yystacksize = YYINITDEPTH ; YYDPRINTF ( ( stderr, "Starting   parse\\n" ) ) ; yystate = 0 ; yyerrstatus = 0 ; yynerrs = 0 ; yychar = YYEMPTY ; goto yysetstate ; yynewstate : yyssp ++ ; yysetstate : * yyssp = yystate ; if ( yyss + yystacksize - 1 <= yyssp ) { YYSIZE_T yysize = yyssp - yyss + 1 ; # ifdef yyoverflow { YYSTYPE * yyvs1 = yyvs ; yytype_int16 * yyss1 = yyss ; yyoverflow ( YY_ ( "memory   exhausted" ), & yyss1, yysize * sizeof ( * yyssp ), & yyvs1, yysize * sizeof ( * yyvsp ), & yystacksize ) ; yyss = yyss1 ; yyvs = yyvs1 ; } # else # ifndef YYSTACK_RELOCATE goto yyexhaustedlab ; # else if ( YYMAXDEPTH <=

Fix:
<S2SV_ModStart> 1019 "grammar.y" { compiler -> loop_depth -- ; compiler -> loop_identifier [ compiler -> loop_depth ] = NULL ; } # line 2594 "grammar.c" break ; case 63 : # line 1024 "grammar.y" { <S2SV_ModStart> } # line 2628 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> break ; case 64 : # line 1054 <S2SV_ModEnd> "grammar.y" { int <S2SV_ModStart> } # line 2667 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> break ; case 65 : # line 1089 <S2SV_ModEnd> "grammar.y" { int <S2SV_ModStart> } # line 2750 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> break ; case 66 : # line 1168 <S2SV_ModEnd> "grammar.y" { int <S2SV_ModStart> } # line 2784 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> break ; case 67 : # line 1198 <S2SV_ModEnd> "grammar.y" { int <S2SV_ModStart> } # line 2837 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 1247 <S2SV_ModEnd> "grammar.y" { yr_parser_emit <S2SV_ModStart> ( yyscanner, OP_OF <S2SV_ModEnd>, NULL ) <S2SV_ModStart> } # line 2847 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 1253 "grammar.y
Buggy code:
 static struct sk_buff * udp6_ufo_fragment ( struct sk_buff * skb, u32 features ) { struct sk_buff * segs = ERR_PTR ( - EINVAL ) ; unsigned int mss ; unsigned int unfrag_ip6hlen, unfrag_len ; struct frag_hdr * fptr ; u8 * mac_start, * prevhdr ; u8 nexthdr ; u8 frag_hdr_sz = sizeof ( struct frag_hdr ) ; int offset ; __wsum csum ; mss = skb_shinfo ( skb ) -> gso_size ; if ( unlikely ( skb -> len <= mss ) ) goto out ; if ( skb_gso_ok ( skb, features | NETIF_F_GSO_ROBUST ) ) { int type = skb_shinfo ( skb ) -> gso_type ; if ( unlikely ( type & ~ ( SKB_GSO_UDP | SKB_GSO_DODGY ) ||! ( type & ( SKB_GSO_UDP ) ) ) ) goto out ; skb_shinfo ( skb ) -> gso_segs = DIV_ROUND_UP ( skb -> len, mss ) ; segs = NULL ; goto out ; } offset = skb -> csum_start - skb_headroom ( skb ) ; csum = skb_checksum ( skb, offset, skb -> len - offset, 0 ) ; offset += skb -> csum_offset ; * ( __sum16 * ) ( skb -> data + offset ) = csum_fold ( csum ) ; skb -> ip_summed = CHECKSUM_NONE ; <START_BUG> if ( ( skb_headroom ( skb ) < frag_hdr_sz ) && <END_BUG> pskb_expand_head ( skb, frag_hdr_sz, 0, GFP_ATOMIC ) ) goto out ; unfrag_ip6hlen = ip6_find_1stfragopt ( skb, & prevhdr ) ; nexthdr = * prevhdr ; * prevhdr = NEXTHDR_FRAGMENT ; unfrag_len = skb_network_header ( skb ) - skb_mac_header ( skb ) + unfrag_ip6hlen ; mac_start = sk

Fix:
<S2SV_ModStart> if ( ( skb_mac_header <S2SV_ModEnd> ( skb ) <S2SV_ModStart> skb ) < skb -> head +
Buggy code:
 static INLINE int get_tx_eob ( const struct segmentation * seg, int segment_id, TX_SIZE tx_size ) { const int eob_max = 16 << ( tx_size << 1 ) ; <START_BUG> return vp9_segfeature_active ( seg, segment_id, SEG_LVL_SKIP )? 0 : eob_max ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return segfeature_active <S2SV_ModEnd> ( seg,
Buggy code:
 int __mdiobus_register ( struct mii_bus * bus, struct module * owner ) { struct mdio_device * mdiodev ; int i, err ; struct gpio_desc * gpiod ; if ( NULL == bus || NULL == bus -> name || NULL == bus -> read || NULL == bus -> write ) return - EINVAL ; BUG_ON ( bus -> state!= MDIOBUS_ALLOCATED && bus -> state!= MDIOBUS_UNREGISTERED ) ; bus -> owner = owner ; bus -> dev. parent = bus -> parent ; bus -> dev. class = & mdio_bus_class ; bus -> dev. groups = NULL ; dev_set_name ( & bus -> dev, "%s", bus -> id ) ; err = device_register ( & bus -> dev ) ; if ( err ) { pr_err ( "mii_bus   %s   failed   to   register\\n", bus -> id ) ; <START_BUG> put_device ( & bus -> dev ) ; <END_BUG> return - EINVAL ; } mutex_init ( & bus -> mdio_lock ) ; gpiod = devm_gpiod_get_optional ( & bus -> dev, "reset", GPIOD_OUT_LOW ) ; if ( IS_ERR ( gpiod ) ) { dev_err ( & bus -> dev, "mii_bus   %s   couldn\'t   get   reset   GPIO\\n", bus -> id ) ; device_del ( & bus -> dev ) ; return PTR_ERR ( gpiod ) ; } else if ( gpiod ) { bus -> reset_gpiod = gpiod ; gpiod_set_value_cansleep ( gpiod, 1 ) ; udelay ( bus -> reset_delay_us ) ; gpiod_set_value_cansleep ( gpiod, 0 ) ; } if ( bus -> reset ) bus -> reset ( bus ) ; for ( i = 0 ; i < PHY_MAX_ADDR ; i ++ ) { if ( ( bus -> phy_mask & ( 1 << i ) ) == 0 ) { struct phy_device * phydev ; phydev = mdiobus_scan ( bus, i ) ; if ( IS_ERR ( phydev ) && ( PTR_ERR (

Fix:
<S2SV_ModStart> id ) ; <S2SV_ModEnd> return - EINVAL