nus-yam/ex-repair huggingface dataset:
Buggy code:
 SECURITY_STATUS ntlm_read_AuthenticateMessage ( NTLM_CONTEXT * context, PSecBuffer buffer ) { <START_BUG> wStream * s ; <END_BUG> size_t length ;  UINT32 flags ; <START_BUG> <END_BUG> NTLM_AV_PAIR * AvFlags ;  UINT32 PayloadBufferOffset ; NTLM_AUTHENTICATE_MESSAGE * message ; SSPI_CREDENTIALS * credentials = context -> credentials ; <START_BUG> flags = 0 ; <END_BUG> AvFlags = NULL ; message = & context -> AUTHENTICATE_MESSAGE ; ZeroMemory ( message, sizeof ( NTLM_AUTHENTICATE_MESSAGE ) ) ; s = Stream_New ( ( BYTE * ) buffer -> pvBuffer, buffer -> cbBuffer ) ; if (! s ) return SEC_E_INTERNAL_ERROR ; if ( ntlm_read_message_header ( s, ( NTLM_MESSAGE_HEADER * ) message ) < 0 )  { <START_BUG> Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( message -> MessageType!= MESSAGE_TYPE_AUTHENTICATE ) <END_BUG> {  Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> LmChallengeResponse ) ) < 0 ) <START_BUG> { <END_BUG> Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> NtChallengeResponse ) ) < 0 )  { <START_BUG> Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> DomainName ) ) < 0 ) <END_BUG> {  Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> UserName ) ) < 0 ) <START_BUG> { <END_BUG> Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> Workstation ) ) < 0 )  { <START_BUG> Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> EncryptedRandom<END_BUG>

Fix:
<S2SV_ModStart> buffer ) { SECURITY_STATUS status = SEC_E_INVALID_TOKEN ; <S2SV_ModStart> ; UINT32 flags = 0 <S2SV_ModStart> NTLM_AV_PAIR * AvFlags = NULL <S2SV_ModStart> -> credentials ; <S2SV_ModEnd> message = & <S2SV_ModStart> < 0 ) goto fail ; <S2SV_ModEnd> if ( message <S2SV_ModStart>!= MESSAGE_TYPE_AUTHENTICATE ) goto fail ; <S2SV_ModEnd> if ( ntlm_read_message_fields <S2SV_ModStart> < 0 ) goto fail ; <S2SV_ModEnd> if ( ntlm_read_message_fields <S2SV_ModStart> < 0 ) goto fail ; <S2SV_ModEnd> if ( ntlm_read_message_fields <S2SV_ModStart> < 0 ) goto fail ; <S2SV_ModEnd> if ( ntlm_read_message_fields <S2SV_ModStart> < 0 ) goto fail ; <S2SV_ModEnd> if ( ntlm_read_message_fields <S2SV_ModStart> < 0 ) goto fail ; <S2SV_ModEnd> if ( ntlm_read_message_fields <S2SV_ModStart> < 0 ) goto fail ; if ( Stream_GetRemainingLength ( s ) < 4 ) goto fail ; <S2SV_ModEnd> Stream_Read_UINT32 ( s <S2SV_ModStart> Len ) ) goto fail ; if ( message -> NegotiateFlags & NTLMSSP_NEGOTIATE_VERSION ) { if ( ntlm_read_version_info ( s,
Buggy code:
 static int nl80211_start_sched_scan ( struct sk_buff * skb, struct genl_info * info ) { struct cfg80211_sched_scan_request * request ; struct cfg80211_registered_device * rdev = info -> user_ptr [ 0 ] ; struct net_device * dev = info -> user_ptr [ 1 ] ; struct nlattr * attr ; struct wiphy * wiphy ; int err, tmp, n_ssids = 0, n_channels, i ; u32 interval ; enum ieee80211_band band ; size_t ie_len ; if (! ( rdev -> wiphy. flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN ) ||! rdev -> ops -> sched_scan_start ) return - EOPNOTSUPP ; if (! is_valid_ie_attr ( info -> attrs [ NL80211_ATTR_IE ] ) ) return - EINVAL ; if ( rdev -> sched_scan_req ) return - EINPROGRESS ; if (! info -> attrs [ NL80211_ATTR_SCHED_SCAN_INTERVAL ] ) return - EINVAL ; interval = nla_get_u32 ( info -> attrs [ NL80211_ATTR_SCHED_SCAN_INTERVAL ] ) ; if ( interval == 0 ) return - EINVAL ; wiphy = & rdev -> wiphy ; if ( info -> attrs [ NL80211_ATTR_SCAN_FREQUENCIES ] ) { n_channels = validate_scan_freqs ( info -> attrs [ NL80211_ATTR_SCAN_FREQUENCIES ] ) ; if (! n_channels ) return - EINVAL ; } else { n_channels = 0 ; for ( band = 0 ; band < IEEE80211_NUM_BANDS ; band ++ ) if ( wiphy -> bands [ band ] ) n_channels += wiphy -> bands [ band ] -> n_channels ; } if ( info -> attrs [ NL80211_ATTR_SCAN_SSIDS ] ) nla_for_each_nested ( attr, info -> attrs [ NL80211_ATTR_SCAN_SSIDS ], tmp ) n_ssids ++ ; if ( n_

Fix:
<S2SV_ModStart> tmp ) { request -> ssids [ i ]. ssid_len = nla_len ( attr ) ; <S2SV_ModStart> ) ) ; <S2SV_ModEnd> i ++ ;
Buggy code:
 G_DEFINE_TYPE ( GsmXsmpServer, gsm_xsmp_server, G_TYPE_OBJECT ) typedef struct { GsmXsmpServer * server ; IceListenObj listener ; } GsmIceConnectionData ; <START_BUG> static gboolean <END_BUG> accept_ice_connection ( GIOChannel * source, GIOCondition condition, GsmIceConnectionData * data ) { IceListenObj listener ; IceConn ice_conn ; IceAcceptStatus status ; GsmClient * client ; GsmXsmpServer * server ; listener = data -> listener ; server = data -> server ; g_debug ( "GsmXsmpServer:   accept_ice_connection()" ) ; ice_conn = IceAcceptConnection ( listener, & status ) ; if ( status!= IceAcceptSuccess ) { g_debug ( "GsmXsmpServer:   IceAcceptConnection   returned   %d", status ) ; return TRUE ; } client = gsm_xsmp_client_new ( ice_conn ) ;  ice_conn -> context = client ; <START_BUG> gsm_store_add ( server -> priv -> client_store, gsm_client_peek_id ( client ), G_OBJECT ( client ) ) ; g_object_unref ( client ) ; return TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> } GsmIceConnectionData ; typedef struct { guint watch_id ; guint protocol_timeout ; } GsmIceConnectionWatch ; static void disconnect_ice_connection ( IceConn ice_conn ) { IceSetShutdownNegotiation ( ice_conn, FALSE ) ; IceCloseConnection <S2SV_ModEnd> ( ice_conn ) <S2SV_ModStart> ice_conn ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void sum_intra_stats ( FRAME_COUNTS * counts, const MODE_INFO * mi ) { <START_BUG> const MB_PREDICTION_MODE y_mode = mi -> mbmi. mode ; <END_BUG>  const MB_PREDICTION_MODE uv_mode = mi -> mbmi. uv_mode ; <START_BUG> const BLOCK_SIZE bsize = mi -> mbmi. sb_type ; if ( bsize < BLOCK_8X8 ) { int idx, idy ; const int num_4x4_w = num_4x4_blocks_wide_lookup [ bsize ] ; const int num_4x4_h = num_4x4_blocks_high_lookup [ bsize ] ; for ( idy = 0 ; idy < 2 ; idy += num_4x4_h ) for ( idx = 0 ; idx < 2 ; idx += num_4x4_w ) ++ counts -> y_mode [ 0 ] [ mi -> bmi [ idy * 2 + idx ]. as_mode ] ; } else { ++ counts -> y_mode [ size_group_lookup [ bsize ] ] [ y_mode ] ; } ++ counts -> uv_mode [ y_mode ] [ uv_mode ] ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { const PREDICTION_MODE <S2SV_ModEnd> y_mode = mi <S2SV_ModStart> mode ; const PREDICTION_MODE <S2SV_ModEnd> uv_mode = mi
Buggy code:
 Id repodata_schema2id ( Repodata * data, Id * schema, int create ) { int h, len, i ; Id * sp, cid ; Id * schematahash ; if (! * schema ) return 0 ; if ( ( schematahash = data -> schematahash ) == 0 ) { data -> schematahash = schematahash = solv_calloc ( 256, sizeof ( Id ) ) ; for ( i = 1 ; i < data -> nschemata ; i ++ ) { for ( sp = data -> schemadata + data -> schemata [ i ], h = 0 ; * sp ; ) h = h * 7 + * sp ++ ; h &= 255 ; schematahash [ h ] = i ; } data -> schemadata = solv_extend_resize ( data -> schemadata, data -> schemadatalen, sizeof ( Id ), SCHEMATADATA_BLOCK ) ; data -> schemata = solv_extend_resize ( data -> schemata, data -> nschemata, sizeof ( Id ), SCHEMATA_BLOCK ) ; } for ( sp = schema, len = 0, h = 0 ; * sp ; len ++ ) h = h * 7 + * sp ++ ; h &= 255 ; len ++ ; cid = schematahash [ h ] ; if ( cid ) { <START_BUG> if (! memcmp ( data -> schemadata + data -> schemata [ cid ], schema, len * sizeof ( Id ) ) ) <END_BUG> return cid ; for ( cid = 1 ; cid < data -> nschemata ; cid ++ )  if (! memcmp ( data -> schemadata + data -> schemata [ cid ], schema, len * sizeof ( Id ) ) ) <START_BUG> return cid ; } if (! create ) return 0 ; data -> schemadata = solv_extend ( data -> schemadata, data -> schemadatalen, len, sizeof ( Id ), SCHEMATADATA_BLOCK ) ; data -> schemata = solv_extend ( data -> schemata, data -> nschemata, 1, sizeof ( Id ), SCHEMATA_BLOCK ) ; memcpy ( data -> schemadata + data -> schemadatalen, schema, len * sizeof ( Id ) ) ; data -> schemata [ data -> nschemata ] = data -> schemadatalen ; data -> schemadatal<END_BUG>

Fix:
<S2SV_ModStart> { if ( ( data -> schemata [ cid ] + len <= data -> schemadatalen ) && <S2SV_ModStart> ) if ( ( data -> schemata [ cid ] + len <= data -> schemadatalen ) &&
Buggy code:
 static INLINE void mi_buf_shift ( MACROBLOCK * x, int i ) { MB_MODE_INFO * const mbmi = & x -> e_mbd. mi [ 0 ] -> mbmi ; struct macroblock_plane * const p = & x -> plane [ 0 ] ; struct macroblockd_plane * const pd = & x -> e_mbd. plane [ 0 ] ; <START_BUG> p -> src. buf = & p -> src. buf [ raster_block_offset ( BLOCK_8X8, i, p -> src. stride ) ] ; <END_BUG> assert ( ( ( intptr_t ) pd -> pre [ 0 ]. buf & 0x7 ) == 0 ) ;  pd -> pre [ 0 ]. buf = & pd -> pre [ 0 ]. buf [ raster_block_offset ( BLOCK_8X8, i, <START_BUG> pd -> pre [ 0 ]. stride ) ] ; if ( has_second_ref ( mbmi ) ) <END_BUG> pd -> pre [ 1 ]. buf = & pd -> pre [ 1 ]. buf [ raster_block_offset ( BLOCK_8X8, i,  pd -> pre [ 1 ]. stride ) ] ; }

Fix:
<S2SV_ModStart>. buf [ vp9_raster_block_offset <S2SV_ModEnd> ( BLOCK_8X8, <S2SV_ModStart>. buf [ vp9_raster_block_offset <S2SV_ModEnd> ( BLOCK_8X8, <S2SV_ModStart>. buf [ vp9_raster_block_offset <S2SV_ModEnd> ( BLOCK_8X8,
Buggy code:
 void imap_quote_string ( char * dest, size_t dlen, const char * src, bool quote_backtick ) { const char * quote = "`\\"\\\\" ; if (! quote_backtick ) quote ++ ; char * pt = dest ; const char * s = src ; * pt ++ = \'"\' ; <START_BUG> dlen -= 2 ; <END_BUG> for ( ; * s && dlen ; s ++ ) { if ( strchr ( quote, * s ) ) { if ( dlen < 2 ) break ; dlen -= 2 ; * pt ++ = '\\\\' ; * pt ++ = * s ; } else { * pt ++ = * s ; dlen -- ; } } * pt ++ = \'"\' ; * pt = '\\0' ; }

Fix:
<S2SV_ModStart> ; dlen -= 3 <S2SV_ModEnd> ; for (
Buggy code:
 void WT_VoiceGain ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_I32 * pMixBuffer ; EAS_PCM * pInputBuffer ; EAS_I32 gain ; EAS_I32 gainIncrement ; EAS_I32 tmp0 ; EAS_I32 tmp1 ; EAS_I32 tmp2 ; EAS_I32 numSamples ; # if ( NUM_OUTPUT_CHANNELS == 2 ) EAS_I32 gainLeft, gainRight ; # endif <START_BUG> numSamples = pWTIntFrame -> numSamples ; <END_BUG> pMixBuffer = pWTIntFrame -> pMixBuffer ; pInputBuffer = pWTIntFrame -> pAudioBuffer ; gainIncrement = ( pWTIntFrame -> frame. gainTarget - pWTIntFrame -> prevGain ) << ( 16 - SYNTH_UPDATE_PERIOD_IN_BITS ) ; if ( gainIncrement < 0 ) gainIncrement ++ ; gain = pWTIntFrame -> prevGain << 16 ; # if ( NUM_OUTPUT_CHANNELS == 2 ) gainLeft = pWTVoice -> gainLeft ; gainRight = pWTVoice -> gainRight ; # endif while ( numSamples -- ) { tmp0 = * pInputBuffer ++ ; gain += gainIncrement ; tmp2 = gain >> 16 ; tmp2 *= tmp0 ; # if ( NUM_OUTPUT_CHANNELS == 2 ) tmp2 = tmp2 >> 14 ; tmp1 = * pMixBuffer ; tmp0 = tmp2 * gainLeft ; tmp0 = tmp0 >> NUM_MIXER_GUARD_BITS ; tmp1 += tmp0 ; * pMixBuffer ++ = tmp1 ; tmp1 = * pMixBuffer ; tmp0 = tmp2 * gainRight ; tmp0 = tmp0 >> NUM_MIXER_GUARD_BITS ; tmp1 += tmp0 ; * pMixBuffer ++ = tmp1 ; # else tmp1 = * pMixBuffer ; tmp2 = tmp2 >> ( NUM_MIXER_GUARD_BITS - 1 ) ; tmp1 += tmp2 ; * pMixBuffer ++ = tmp1 ; # endif } }

Fix:
<S2SV_ModStart> -> numSamples ; if ( numSamples <= 0 ) { ALOGE ( "b//26366256" ) ; return ; }
Buggy code:
 void vp8_setup_key_frame ( VP8_COMP * cpi ) { vp8_default_coef_probs ( & cpi -> common ) ; <START_BUG> vpx_memcpy ( cpi -> common. fc. mvc, vp8_default_mv_context, sizeof ( vp8_default_mv_context ) ) ; <END_BUG> { int flag [ 2 ] = { 1, 1 } ; vp8_build_component_cost_table ( cpi -> mb. mvcost, ( const MV_CONTEXT * ) cpi -> common. fc. mvc, flag ) ; }  vpx_memcpy ( & cpi -> lfc_a, & cpi -> common. fc, sizeof ( cpi -> common. fc ) ) ; <START_BUG> <END_BUG> vpx_memcpy ( & cpi -> lfc_g, & cpi -> common. fc, sizeof ( cpi -> common. fc ) ) ;  <START_BUG> vpx_memcpy ( & cpi -> lfc_n, & cpi -> common. fc, sizeof ( cpi -> common. fc ) ) ; <END_BUG> cpi -> common. filter_level = cpi -> common. base_qindex * 3 // 8 ; if ( cpi -> auto_gold ) cpi -> frames_till_gf_update_due = cpi -> baseline_gf_interval ; else cpi -> frames_till_gf_update_due = DEFAULT_GF_INTERVAL ; cpi -> common. refresh_golden_frame = 1 ; cpi -> common. refresh_alt_ref_frame = 1 ; }

Fix:
<S2SV_ModStart> common ) ; memcpy <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) ; } memcpy <S2SV_ModEnd> ( & cpi <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & cpi <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & cpi
Buggy code:
 static int security_context_to_sid_core ( const char * scontext, u32 scontext_len, u32 * sid, u32 def_sid, gfp_t gfp_flags, int force ) { char * scontext2, * str = NULL ; struct context context ; <START_BUG> int rc = 0 ; <END_BUG> if (! ss_initialized ) { int i ; for ( i = 1 ; i < SECINITSID_NUM ; i ++ ) { if (! strcmp ( initial_sid_to_string [ i ], scontext ) ) { * sid = i ; return 0 ; } } * sid = SECINITSID_KERNEL ; return 0 ; } * sid = SECSID_NULL ; scontext2 = kmalloc ( scontext_len + 1, gfp_flags ) ; if (! scontext2 ) return - ENOMEM ; memcpy ( scontext2, scontext, scontext_len ) ; scontext2 [ scontext_len ] = 0 ; if ( force ) { rc = - ENOMEM ; str = kstrdup ( scontext2, gfp_flags ) ; if (! str ) goto out ; } read_lock ( & policy_rwlock ) ; rc = string_to_context_struct ( & policydb, & sidtab, scontext2, scontext_len, & context, def_sid ) ; if ( rc == - EINVAL && force ) { context. str = str ; context. len = scontext_len ; str = NULL ; } else if ( rc ) goto out_unlock ; rc = sidtab_context_to_sid ( & sidtab, & context, sid ) ; context_destroy ( & context ) ; out_unlock : read_unlock ( & policy_rwlock ) ; out : kfree ( scontext2 ) ; kfree ( str ) ; return rc ; }

Fix:
<S2SV_ModStart> rc = 0 ; if (! scontext_len ) return - EINVAL
Buggy code:
 static void read_conf ( FILE * conffile ) { char * buffer, * line, * val ; buffer = loadfile ( conffile ) ; for ( line = strtok ( buffer, "\\r\\n" ) ; line ; line = strtok ( NULL, "\\r\\n" ) ) { if (! strncmp ( line, "export   ", 7 ) ) continue ; val = strchr ( line, '=' ) ; if (! val ) { printf ( "invalid   configuration   line\\n" ) ; break ; } * val ++ = '\\0' ; if (! strcmp ( line, "JSON_INDENT" ) ) conf. indent = atoi ( val ) ; if (! strcmp ( line, "JSON_COMPACT" ) ) conf. compact = atoi ( val ) ; if (! strcmp ( line, "JSON_ENSURE_ASCII" ) ) conf. ensure_ascii = atoi ( val ) ; if (! strcmp ( line, "JSON_PRESERVE_ORDER" ) ) conf. preserve_order = atoi ( val ) ; if (! strcmp ( line, "JSON_SORT_KEYS" ) ) conf. sort_keys = atoi ( val ) ; if (! strcmp ( line, "STRIP" ) ) conf. strip = atoi ( val ) ; <START_BUG> } <END_BUG> free ( buffer ) ; }

Fix:
<S2SV_ModStart> val ) ; if (! strcmp ( line, "HASHSEED" ) ) { conf. have_hashseed = 1 ; conf. hashseed = atoi ( val ) ; } else { conf. have_hashseed = 0 ; }
Buggy code:
 <START_BUG> void vp9_fwht4x4_c ( const int16_t * input, int16_t * output, int stride ) { <END_BUG> int i ;  int a1, b1, c1, d1, e1 ; <START_BUG> <END_BUG> const int16_t * ip = input ;  <START_BUG> int16_t * op = output ; <END_BUG> for ( i = 0 ; i < 4 ; i ++ ) {  a1 = ip [ 0 * stride ] ; <START_BUG> b1 = ip [ 1 * stride ] ; c1 = ip [ 2 * stride ] ; <END_BUG> d1 = ip [ 3 * stride ] ;  a1 += b1 ; d1 = d1 - c1 ; e1 = ( a1 - d1 ) >> 1 ; b1 = e1 - b1 ; c1 = e1 - c1 ; a1 -= c1 ; d1 += b1 ; <START_BUG> op [ 0 ] = a1 ; <END_BUG> op [ 4 ] = c1 ;  op [ 8 ] = d1 ; <START_BUG> <END_BUG> op [ 12 ] = b1 ;  ip ++ ; op ++ ; } ip = output ; op = output ; for ( i = 0 ; i < 4 ; i ++ ) { a1 = ip [ 0 ] ; b1 = ip [ 1 ] ; c1 = ip [ 2 ] ; d1 = ip [ 3 ] ; a1 += b1 ; d1 -= c1 ; e1 = ( a1 - d1 ) >> 1 ; b1 = e1 - b1 ; c1 = e1 - c1 ; a1 -= c1 ; d1 += b1 ; <START_BUG> op [ 0 ] = a1 * UNIT_QUANT_FACTOR ; <END_BUG>  op [ 1 ] = c1 * UNIT_QUANT_FACTOR ; <START_BUG> <END_BUG> op [ 2 ] = d1 * UNIT_QUANT_FACTOR ;  <START_BUG> op [ 3 ] = b1 * UNIT_QUANT_FACTOR ; <END_BUG> ip += 4 ; op += 4 ; } }

Fix:
<S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> int i ; tran_high_t <S2SV_ModEnd> a1, b1 <S2SV_ModStart> const int16_t * ip_pass0 <S2SV_ModEnd> = input ; <S2SV_ModStart> = input ; const tran_low_t * ip = NULL ; tran_low_t <S2SV_ModEnd> * op = <S2SV_ModStart> { a1 = ip_pass0 [ 0 * stride ] ; b1 = ip_pass0 [ 1 * stride ] ; c1 = ip_pass0 <S2SV_ModEnd> [ 2 * <S2SV_ModStart> ; d1 = ip_pass0 <S2SV_ModEnd> [ 3 * <S2SV_ModStart> 0 ] = ( tran_low_t ) a1 ; op [ 4 ] = ( tran_low_t ) <S2SV_ModEnd> c1 ; op <S2SV_ModStart> 8 ] = ( tran_low_t ) <S2SV_ModStart> 12 ] = ( tran_low_t ) b1 ; ip_pass0 <S2SV_ModEnd> ++ ; op <S2SV_ModStart> 0 ] = ( tran_low_t ) ( <S2SV_ModStart> a1 * UNIT_QUANT_FACTOR ) ; op [ 1 ] = ( tran_low_t ) ( <S2SV_ModEnd> c1 * UNIT_QUANT_FACTOR <S2SV_ModStart> c1 * UNIT_QUANT_FACTOR ) <S2SV_ModStart> 2 ] = ( tran_low_t ) ( <S2SV_ModStart>
Buggy code:
 void usb_serial_console_disconnect ( struct usb_serial * serial ) { <START_BUG> if ( serial -> port [ 0 ] == usbcons_info. port ) { <END_BUG> usb_serial_console_exit ( ) ; usb_serial_put ( serial ) ; } }

Fix:
<S2SV_ModStart> { if ( serial -> port [ 0 ] &&
Buggy code:
 void * pvPortMalloc ( size_t xWantedSize ) { BlockLink_t * pxBlock, * pxPreviousBlock, * pxNewBlockLink ; void * pvReturn = NULL ; vTaskSuspendAll ( ) ; { if ( pxEnd == NULL ) { prvHeapInit ( ) ; } else { mtCOVERAGE_TEST_MARKER ( ) ; } if ( ( xWantedSize & xBlockAllocatedBit ) == 0 ) { <START_BUG> if ( xWantedSize > 0 ) <END_BUG> { xWantedSize += xHeapStructSize ; if ( ( xWantedSize & portBYTE_ALIGNMENT_MASK )!= 0x00 ) {  xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ; <START_BUG> configASSERT ( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) == 0 ) ; } else { <END_BUG> mtCOVERAGE_TEST_MARKER ( ) ;  } } else { mtCOVERAGE_TEST_MARKER ( ) ; } if ( ( xWantedSize > 0 ) && ( xWantedSize <= xFreeBytesRemaining ) ) { pxPreviousBlock = & xStart ; pxBlock = xStart. pxNextFreeBlock ; while ( ( pxBlock -> xBlockSize < xWantedSize ) && ( pxBlock -> pxNextFreeBlock!= NULL ) ) { pxPreviousBlock = pxBlock ; pxBlock = pxBlock -> pxNextFreeBlock ; } if ( pxBlock!= pxEnd ) { pvReturn = ( void * ) ( ( ( uint8_t * ) pxPreviousBlock -> pxNextFreeBlock ) + xHeapStructSize ) ; pxPreviousBlock -> pxNextFreeBlock = pxBlock -> pxNextFreeBlock ; if ( ( pxBlock -> xBlockSize - xWantedSize ) > heapMINIMUM_BLOCK_SIZE ) { pxNewBlockLink = ( void * ) ( ( ( uint8_t * ) pxBlock ) + xWantedSize ) ; configASSERT ( ( ( ( size_t ) pxNewBlockLink ) & portBYTE_ALIGNMENT_MASK ) == 0 ) ; pxNewBlockLink -> xBlockSize = pxBlock -> xBlockSize - xWantedSize ; pxBlock -> xBlockSize = xWantedSize ; prvInsertBlockIntoFree

Fix:
<S2SV_ModStart> { if ( ( <S2SV_ModStart> xWantedSize > 0 ) && ( ( xWantedSize + xHeapStructSize ) > xWantedSize ) <S2SV_ModStart> 0x00 ) { if ( ( xWantedSize + <S2SV_ModEnd> ( portBYTE_ALIGNMENT - <S2SV_ModStart> portBYTE_ALIGNMENT_MASK ) ) ) > xWantedSize ) { xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) <S2SV_ModStart> } else { xWantedSize = 0 ; } } else { mtCOVERAGE_TEST_MARKER ( ) ; } } else { xWantedSize = 0 <S2SV_ModEnd> ; } if
Buggy code:
 static void set_entropy_context_b ( int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * arg ) { struct tokenize_b_args * const args = arg ; <START_BUG> MACROBLOCKD * const xd = args -> xd ; <END_BUG>  struct macroblock_plane * p = & args -> cpi -> mb. plane [ plane ] ; <START_BUG> struct macroblockd_plane * pd = & xd -> plane [ plane ] ; int aoff, loff ; txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & aoff, & loff ) ; vp9_set_contexts ( xd, pd, plane_bsize, tx_size, p -> eobs [ block ] > 0, aoff, loff ) ; }<END_BUG>

Fix:
<S2SV_ModStart> = arg ; ThreadData * const td = args -> td ; MACROBLOCK * const x = & td -> mb ; <S2SV_ModStart> const xd = & x -> e_mbd <S2SV_ModEnd> ; struct macroblock_plane <S2SV_ModStart> p = & x -> <S2SV_ModEnd> plane [ plane
Buggy code:
 static int recv_stream ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t buf_len, int flags ) { struct sock * sk = sock -> sk ; struct tipc_port * tport = tipc_sk_port ( sk ) ; struct sk_buff * buf ; struct tipc_msg * msg ; long timeout ; unsigned int sz ; int sz_to_copy, target, needed ; int sz_copied = 0 ; u32 err ; int res = 0 ; if ( unlikely (! buf_len ) ) return - EINVAL ; lock_sock ( sk ) ; if ( unlikely ( ( sock -> state == SS_UNCONNECTED ) || ( sock -> state == SS_CONNECTING ) ) ) { res = - ENOTCONN ; goto exit ; <START_BUG> } <END_BUG> target = sock_rcvlowat ( sk, flags & MSG_WAITALL, buf_len ) ; timeout = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; restart : while ( skb_queue_empty ( & sk -> sk_receive_queue ) ) { if ( sock -> state == SS_DISCONNECTING ) { res = - ENOTCONN ; goto exit ; } if ( timeout <= 0L ) { res = timeout? timeout : - EWOULDBLOCK ; goto exit ; } release_sock ( sk ) ; timeout = wait_event_interruptible_timeout ( * sk_sleep ( sk ), tipc_rx_ready ( sock ), timeout ) ; lock_sock ( sk ) ; } buf = skb_peek ( & sk -> sk_receive_queue ) ; msg = buf_msg ( buf ) ; sz = msg_data_sz ( msg ) ; err = msg_errcode ( msg ) ; if ( (! sz ) && (! err ) ) { advance_rx_queue ( sk ) ; goto restart ; } if ( sz_copied == 0 ) { set_orig_addr ( m, msg ) ; res = anc_data_recv ( m, msg, tport ) ; if ( res ) goto exit ; } if (! err ) { u32 offset = ( u32 ) ( unsigned long ) ( TIPC_SKB_CB ( buf ) -> handle ) ; sz -= offset ; needed = ( buf_len - sz_

Fix:
<S2SV_ModStart> exit ; } m -> msg_namelen = 0 ;
Buggy code:
 int yr_re_match ( RE * re, const char * target ) { return yr_re_exec ( re -> code, ( uint8_t * ) target, strlen ( target ), <START_BUG> re -> flags | RE_FLAGS_SCAN, <END_BUG> NULL, NULL ) ; }

Fix:
<S2SV_ModStart> target ), 0,
Buggy code:
 rrd_info_t * rrd_graph_v ( int argc, char * * argv ) { image_desc_t im ; rrd_info_t * grinfo ; char * old_locale ; rrd_graph_init ( & im ) ; old_locale = setlocale ( LC_NUMERIC, "C" ) ; rrd_graph_options ( argc, argv, & im ) ; if ( rrd_test_error ( ) ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } if ( optind >= argc ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; rrd_set_error ( "missing   filename" ) ; return NULL ; } if ( strlen ( argv [ optind ] ) >= MAXPATH ) { rrd_set_error ( "filename   (including   path)   too   long" ) ; rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } strncpy ( im. graphfile, argv [ optind ], MAXPATH - 1 ) ; im. graphfile [ MAXPATH - 1 ] = '\\0' ; if ( strcmp ( im. graphfile, "-" ) == 0 ) { im. graphfile [ 0 ] = '\\0' ; } rrd_graph_script ( argc, argv, & im, 1 ) ; setlocale ( LC_NUMERIC, old_locale ) ; if ( rrd_test_error ( ) ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } if ( graph_paint ( & im ) == - 1 ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } if ( im. imginfo ) { rrd_infoval_t info ; char * path ; char * filename ; if ( bad_format_imginfo ( im. imginfo ) ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; <START_BUG> rrd_set_error ( "bad   format   for   imginfo" ) ; <END_BUG> return NULL ; } path = strdup ( im. graphfile ) ;

Fix:
<S2SV_ModStart> im ) ; <S2SV_ModEnd> return NULL ;
Buggy code:
 static CURLcode pop3_parse_url_path ( struct connectdata * conn ) { struct pop3_conn * pop3c = & conn -> proto. pop3c ; struct SessionHandle * data = conn -> data ; const char * path = data -> state. path ; <START_BUG> pop3c -> mailbox = curl_easy_unescape ( data, path, 0, NULL ) ; <END_BUG>  if (! pop3c -> mailbox ) <START_BUG> return CURLE_OUT_OF_MEMORY ; return CURLE_OK ; }<END_BUG>

Fix:
<S2SV_ModStart>. path ; return Curl_urldecode <S2SV_ModEnd> ( data, <S2SV_ModStart>, 0, & <S2SV_ModEnd> pop3c -> mailbox <S2SV_ModStart> pop3c -> mailbox, NULL, TRUE ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 generic_ret * setkey_principal3_2_svc ( setkey3_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_SETKEY, arg -> princ, NULL ) ) { ret. code = kadm5_setkey_principal_3 ( ( void * ) handle, arg -> princ, arg -> keepold, arg -> n_ks_tuple, arg -> ks_tuple, arg -> keyblocks, arg -> n_keys ) ; } else { log_unauth ( "kadm5_setkey_principal", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_SETKEY ; } if ( ret. code!= KADM5_AUTH_SETKEY ) { if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_setkey_principal", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!=

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 int ssl_init ( void ) { # if OPENSSL_VERSION_NUMBER >= 0x10100000L OPENSSL_init_ssl ( OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_LOAD_CONFIG, NULL ) ; # else OPENSSL_config ( NULL ) ; SSL_load_error_strings ( ) ; SSL_library_init ( ) ; # endif index_ssl_cli = SSL_get_ex_new_index ( 0, "CLI   pointer", NULL, NULL, NULL ) ; index_ssl_ctx_opt = SSL_CTX_get_ex_new_index ( 0, "SERVICE_OPTIONS   pointer", NULL, NULL, NULL ) ; index_session_authenticated = SSL_SESSION_get_ex_new_index ( 0, <START_BUG> "session   authenticated", NULL, NULL, NULL ) ; <END_BUG> index_session_connect_address = SSL_SESSION_get_ex_new_index ( 0, "session   connect   address", NULL, cb_dup_addr, cb_free_addr ) ; if ( index_ssl_cli < 0 || index_ssl_ctx_opt < 0 || index_session_authenticated < 0 || index_session_connect_address < 0 ) { s_log ( LOG_ERR, "Application   specific   data   initialization   failed" ) ; return 1 ; } # ifndef OPENSSL_NO_ENGINE ENGINE_load_builtin_engines ( ) ; # endif # ifndef OPENSSL_NO_DH dh_params = get_dh2048 ( ) ; if (! dh_params ) { s_log ( LOG_ERR, "Failed   to   get   default   DH   parameters" ) ; return 1 ; } # endif return 0 ; }

Fix:
<S2SV_ModStart>, "session <S2SV_blank> authenticated", cb_new_auth <S2SV_ModEnd>, NULL,
Buggy code:
 static const u_char * ikev2_auth_print ( netdissect_options * ndo, u_char tpay, const struct isakmp_gen * ext, u_int item_len _U_, const u_char * ep, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { struct ikev2_auth a ; const char * v2_auth [ ] = { "invalid", "rsasig", "shared-secret", "dsssig" } ; const u_char * authdata = ( const u_char * ) ext + sizeof ( a ) ; unsigned int len ; <START_BUG> ND_TCHECK ( * ext ) ; <END_BUG> UNALIGNED_MEMCPY ( & a, ext, sizeof ( a ) ) ; ikev2_pay_print ( ndo, NPSTR ( tpay ), a. h. critical ) ; len = ntohs ( a. h. len ) ; ND_PRINT ( ( ndo, "   len=%u   method=%s", len - 4, STR_OR_ID ( a. auth_method, v2_auth ) ) ) ; if ( len > 4 ) { if ( ndo -> ndo_vflag > 1 ) { ND_PRINT ( ( ndo, "   authdata=(" ) ) ; if (! rawprint ( ndo, ( const uint8_t * ) authdata, len - sizeof ( a ) ) ) goto trunc ; ND_PRINT ( ( ndo, ")   " ) ) ; } else if ( ndo -> ndo_vflag ) { if (! ike_show_somedata ( ndo, authdata, ep ) ) goto trunc ; } } return ( const u_char * ) ext + len ; trunc : ND_PRINT ( ( ndo, "   [|%s]", NPSTR ( tpay ) ) ) ; return NULL ; }

Fix:
<S2SV_ModStart> int len ; ND_TCHECK2 ( * ext, sizeof ( a ) <S2SV_ModEnd> ) ; UNALIGNED_MEMCPY
Buggy code:
 <START_BUG> struct mb_cache * <END_BUG>  ext4_xattr_create_cache ( char * name ) <START_BUG> { <END_BUG> return mb_cache_create ( name, HASH_BUCKET_BITS ) ;  }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> struct mb2_cache <S2SV_ModEnd> * ext4_xattr_create_cache ( <S2SV_ModStart> * ext4_xattr_create_cache ( void <S2SV_ModEnd> ) { return <S2SV_ModStart> ) { return mb2_cache_create ( <S2SV_ModEnd> HASH_BUCKET_BITS ) ;
Buggy code:
 static int sco_sock_bind ( struct socket * sock, struct sockaddr * addr, int addr_len ) { struct sockaddr_sco * sa = ( struct sockaddr_sco * ) addr ; struct sock * sk = sock -> sk ; int err = 0 ; BT_DBG ( "sk   %p   %pMR", sk, & sa -> sco_bdaddr ) ; <START_BUG> if (! addr || addr -> sa_family!= AF_BLUETOOTH ) <END_BUG> return - EINVAL ; lock_sock ( sk ) ; if ( sk -> sk_state!= BT_OPEN ) { err = - EBADFD ; goto done ; } if ( sk -> sk_type!= SOCK_SEQPACKET ) { err = - EINVAL ; goto done ; } bacpy ( & sco_pi ( sk ) -> src, & sa -> sco_bdaddr ) ; sk -> sk_state = BT_BOUND ; done : release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> sa_family!= AF_BLUETOOTH ) return - EINVAL ; if ( addr_len < sizeof ( struct sockaddr_sco )
Buggy code:
 <START_BUG> static void show_object ( struct object * object, struct strbuf * path, <END_BUG>  const char * last, void * data ) <START_BUG> { struct bitmap * base = data ; int bitmap_pos ; bitmap_pos = bitmap_position ( object -> oid. hash ) ; <END_BUG> if ( bitmap_pos < 0 ) {  char * name = path_name ( path, last ) ; bitmap_pos = ext_index_add_object ( object, name ) ; <START_BUG> free ( name ) ; <END_BUG> } bitmap_set ( base, bitmap_pos ) ; }

Fix:
<S2SV_ModStart> * object, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name <S2SV_ModEnd>, void * <S2SV_ModStart> < 0 ) <S2SV_ModEnd> bitmap_pos = ext_index_add_object <S2SV_ModStart> name ) ; <S2SV_ModEnd> bitmap_set ( base
Buggy code:
 int orangefs_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { struct orangefs_inode_s * orangefs_inode = ORANGEFS_I ( inode ) ; int error = 0 ; void * value = NULL ; size_t size = 0 ; const char * name = NULL ; switch ( type ) { case ACL_TYPE_ACCESS : name = XATTR_NAME_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> umode_t mode = inode -> i_mode ; <END_BUG>  error = posix_acl_equiv_mode ( acl, & mode ) ; <START_BUG> if ( error < 0 ) { <END_BUG> gossip_err ( "%s:   posix_acl_equiv_mode   err:   %d\\n",  __func__, error ) ; return error ; } if ( inode -> i_mode!= mode ) SetModeFlag ( orangefs_inode ) ; inode -> i_mode = mode ; mark_inode_dirty_sync ( inode ) ; <START_BUG> if ( error == 0 ) <END_BUG> acl = NULL ; } break ; case ACL_TYPE_DEFAULT : name = XATTR_NAME_POSIX_ACL_DEFAULT ; break ; default : gossip_err ( "%s:   invalid   type   %d!\\n", __func__, type ) ; return - EINVAL ; } gossip_debug ( GOSSIP_ACL_DEBUG, "%s:   inode   %pU,   key   %s   type   %d\\n", __func__, get_khandle_from_ino ( inode ), name, type ) ; if ( acl ) { size = posix_acl_xattr_size ( acl -> a_count ) ; value = kmalloc ( size, GFP_KERNEL ) ; if (! value ) return - ENOMEM ; error = posix_acl_to_xattr ( & init_user_ns, acl, value, size ) ; if ( error < 0 ) goto out ; } gossip_debug ( GOSSIP_ACL_DEBUG, "%s:   name   %s,   value   %p,   size   %zd,   acl   %p\\n", __func__, name, value, size, acl ) ; error = orangefs_

Fix:
<S2SV_ModStart> { umode_t mode ; error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & mode <S2SV_ModStart>, & mode, & acl ) ; if ( error <S2SV_ModEnd> ) { gossip_err <S2SV_ModStart> { gossip_err ( "%s: <S2SV_blank> posix_acl_update_mode <S2SV_blank> err: <S2SV_blank> %d\\n" <S2SV_ModEnd>, __func__, <S2SV_ModStart> inode ) ; <S2SV_ModEnd> } break ;
Buggy code:
 <START_BUG> static void ip6_append_data_mtu ( int * mtu, <END_BUG> int * maxfraglen, unsigned int fragheaderlen, struct sk_buff * skb,  struct rt6_info * rt ) <START_BUG> { if (! ( rt -> dst. flags & DST_XFRM_TUNNEL ) ) { if ( skb == NULL ) { * mtu = * mtu - rt -> dst. header_len ; } else { <END_BUG> * mtu = dst_mtu ( rt -> dst. path ) ;  } * maxfraglen = ( ( * mtu - fragheaderlen ) & ~ 7 ) + fragheaderlen - sizeof ( struct frag_hdr ) ; } }

Fix:
<S2SV_ModStart> void ip6_append_data_mtu ( unsigned <S2SV_ModStart> rt6_info * rt, bool pmtuprobe <S2SV_ModStart> * mtu = min ( * mtu, pmtuprobe? rt -> dst. dev -> mtu : <S2SV_ModStart> dst. path )
Buggy code:
 uint32_t virtio_config_readw ( VirtIODevice * vdev, uint32_t addr ) { VirtioDeviceClass * k = VIRTIO_DEVICE_GET_CLASS ( vdev ) ; uint16_t val ; <START_BUG> k -> get_config ( vdev, vdev -> config ) ; <END_BUG> if ( addr > ( vdev -> config_len - sizeof ( val ) ) ) return ( uint32_t ) - 1 ; val = lduw_p ( vdev -> config + addr ) ; return val ; }

Fix:
<S2SV_ModStart> uint16_t val ; if ( addr + sizeof ( val ) > vdev -> config_len ) { return ( uint32_t ) - 1 ; } <S2SV_ModStart> -> config ) <S2SV_ModEnd> ; val =
Buggy code:
 int assoc_array_gc ( struct assoc_array * array, const struct assoc_array_ops * ops, bool ( * iterator ) ( void * object, void * iterator_data ), void * iterator_data ) { struct assoc_array_shortcut * shortcut, * new_s ; struct assoc_array_node * node, * new_n ; struct assoc_array_edit * edit ; struct assoc_array_ptr * cursor, * ptr ; struct assoc_array_ptr * new_root, * new_parent, * * new_ptr_pp ; unsigned long nr_leaves_on_tree ; int keylen, slot, nr_free, next_slot, i ; pr_devel ( "-->%s()\\n", __func__ ) ; if (! array -> root ) return 0 ; edit = kzalloc ( sizeof ( struct assoc_array_edit ), GFP_KERNEL ) ; if (! edit ) return - ENOMEM ; edit -> array = array ; edit -> ops = ops ; edit -> ops_for_excised_subtree = ops ; edit -> set [ 0 ]. ptr = & array -> root ; edit -> excised_subtree = array -> root ; new_root = new_parent = NULL ; new_ptr_pp = & new_root ; cursor = array -> root ; descend : if ( assoc_array_ptr_is_shortcut ( cursor ) ) { shortcut = assoc_array_ptr_to_shortcut ( cursor ) ; keylen = round_up ( shortcut -> skip_to_level, ASSOC_ARRAY_KEY_CHUNK_SIZE ) ; keylen >>= ASSOC_ARRAY_KEY_CHUNK_SHIFT ; new_s = kmalloc ( sizeof ( struct assoc_array_shortcut ) + keylen * sizeof ( unsigned long ), GFP_KERNEL ) ; if (! new_s ) goto enomem ; pr_devel ( "dup   shortcut   %p   ->   %p\\n", shortcut, new_s ) ; memcpy ( new_s, shortcut, ( sizeof ( struct assoc_array_shortcut ) + keylen * sizeof ( unsigned long ) ) ) ; new_s -> back_pointer = new_parent ; new_s -> parent_slot = shortcut -> parent_slot ; * new_ptr_pp = new_parent = assoc_

Fix:
<S2SV_ModStart> -> back_pointer ; if (! cursor ) goto gc_complete ; <S2SV_ModStart> BUG_ON (! cursor <S2SV_ModEnd> ) ; node
Buggy code:
 static Sdb * store_versioninfo_gnu_verdef ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { const char * section_name = "" ; const char * link_section_name = "" ; char * end = NULL ; Elf_ ( Shdr ) * link_shdr = NULL ; ut8 dfs [ sizeof ( Elf_ ( Verdef ) ) ] = { 0 } ; Sdb * sdb ; int cnt, i ; if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return false ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; if ( shdr -> sh_size < 1 ) { return false ; } Elf_ ( Verdef ) * defs = calloc ( shdr -> sh_size, sizeof ( char ) ) ; if (! defs ) { return false ; } if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( link_shdr && bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! defs ) { bprintf ( "Warning:   Cannot   allocate   memory   (Check   Elf_(Verdef))\\n" ) ; return NULL ; } sdb = sdb_new0 ( ) ; end = ( char * ) defs + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link, 0 ) ; sdb_set ( sdb, "link_section_name", link_section_name,

Fix:
<S2SV_ModStart> = 0 ; i >= 0 && <S2SV_ModStart> out_error ; } if ( ( st32 ) verdef -> vd_next < 1 ) { eprintf ( "Warning: <S2SV_blank> Invalid <S2SV_blank> vd_next <S2SV_blank> in <S2SV_blank> the <S2SV_blank> ELF <S2SV_blank> version\\n" ) ; break ; }
Buggy code:
 int iscsi_decode_text_input ( u8 phase, u8 sender, char * textbuf, u32 length, struct iscsi_conn * conn ) { struct iscsi_param_list * param_list = conn -> param_list ; char * tmpbuf, * start = NULL, * end = NULL ; tmpbuf = kzalloc ( length + 1, GFP_KERNEL ) ; if (! tmpbuf ) { pr_err ( "Unable   to   allocate   memory   for   tmpbuf.\\n" ) ; return - 1 ; } memcpy ( tmpbuf, textbuf, length ) ; tmpbuf [ length ] = '\\0' ; start = tmpbuf ; end = ( start + length ) ; while ( start < end ) { char * key, * value ; struct iscsi_param * param ; if ( iscsi_extract_key_value ( start, & key, & value ) < 0 ) { kfree ( tmpbuf ) ; return - 1 ; } pr_debug ( "Got   key:   %s=%s\\n", key, value ) ; if ( phase & PHASE_SECURITY ) { if ( iscsi_check_for_auth_key ( key ) > 0 ) { <START_BUG> char * tmpptr = key + strlen ( key ) ; <END_BUG> * tmpptr = '=' ; kfree ( tmpbuf ) ; return 1 ; } } param = iscsi_check_key ( key, phase, sender, param_list ) ; if (! param ) { if ( iscsi_add_notunderstood_response ( key, value, param_list ) < 0 ) { kfree ( tmpbuf ) ; return - 1 ; } start += strlen ( key ) + strlen ( value ) + 2 ; continue ; } if ( iscsi_check_value ( param, value ) < 0 ) { kfree ( tmpbuf ) ; return - 1 ; } start += strlen ( key ) + strlen ( value ) + 2 ; if ( IS_PSTATE_PROPOSER ( param ) ) { if ( iscsi_check_proposer_state ( param, value ) < 0 ) { kfree ( tmpbuf ) ; return - 1 ; } SET_PSTATE_RESPONSE_GOT ( param ) ; } else { if ( iscsi_check_ac

Fix:
<S2SV_ModStart> 0 ) { <S2SV_ModEnd> kfree ( tmpbuf
Buggy code:
 <START_BUG> static void ptrace_triggered ( struct perf_event * bp, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) { int i ; struct thread_struct * thread = & ( current -> thread ) ; for ( i = 0 ; i < HBP_NUM ; i ++ ) { if ( thread -> ptrace_bps [ i ] == bp ) break ; } thread -> debugreg6 |= ( DR_TRAP0 << i ) ; }

Fix:
<S2SV_ModStart> perf_event * bp <S2SV_ModEnd>, struct perf_sample_data
Buggy code:
 static int string_scan_range ( RList * list, RBinFile * bf, int min, const ut64 from, const ut64 to, int type ) { ut8 tmp [ R_STRING_SCAN_BUFFER_SIZE ] ; ut64 str_start, needle = from ; int count = 0, i, rc, runes ; int str_type = R_STRING_TYPE_DETECT ; if ( type == - 1 ) { type = R_STRING_TYPE_DETECT ; } if ( from >= to ) { eprintf ( "Invalid   range   to   find   strings   0x%llx  ..   0x%llx\\n", from, to ) ; return - 1 ; } <START_BUG> ut8 * buf = calloc ( to - from, 1 ) ; <END_BUG> if (! buf ||! min ) { return - 1 ; }  r_buf_read_at ( bf -> buf, from, buf, to - from ) ; <START_BUG> while ( needle < to ) { rc = r_utf8_decode ( buf + needle - from, to - needle, NULL ) ; if (! rc ) { needle ++ ; continue ; } if ( type == R_STRING_TYPE_DETECT ) { char * w = ( char * ) buf + needle + rc - from ; <END_BUG> if ( ( to - needle ) > 5 ) {  <START_BUG> bool is_wide32 = needle + rc + 2 < to &&! w [ 0 ] &&! w [ 1 ] &&! w [ 2 ] && w [ 3 ] &&! w [ 4 ] ; <END_BUG> if ( is_wide32 ) { str_type = R_STRING_TYPE_WIDE32 ; } else { bool is_wide = needle + rc + 2 < to &&! w [ 0 ] && w [ 1 ] &&! w [ 2 ] ; str_type = is_wide? R_STRING_TYPE_WIDE : R_STRING_TYPE_ASCII ; } } else { str_type = R_STRING_TYPE_ASCII ; } } else { str_type = type ; } runes = 0 ; str_start = needle ; for ( rc = i = 0 ; i < sizeof ( tmp ) - 3 && needle < to ; i += rc ) { RRune r = { 0 } ; if ( str_type == R_STRING_TYPE_WIDE

Fix:
<S2SV_ModStart> 1 ; } int len = to - from ; <S2SV_ModStart> = calloc ( len <S2SV_ModEnd>, 1 ) <S2SV_ModStart>, buf, len <S2SV_ModEnd> ) ; while <S2SV_ModStart> ) > 5 + rc <S2SV_ModStart> bool is_wide32 = ( <S2SV_ModStart> 2 < to ) && ( <S2SV_ModEnd>! w [ <S2SV_ModStart> [ 4 ] )
Buggy code:
 static void Np_toString ( js_State * J ) { <START_BUG> char buf [ 32 ] ; <END_BUG> js_Object * self = js_toobject ( J, 0 ) ; int radix = js_isundefined ( J, 1 )? 10 : js_tointeger ( J, 1 ) ; if ( self -> type!= JS_CNUMBER ) js_typeerror ( J, "not   a   number" ) ; if ( radix == 10 ) { js_pushstring ( J, jsV_numbertostring ( J, buf, self -> u. number ) ) ; return ; } if ( radix < 2 || radix > 36 ) js_rangeerror ( J, "invalid   radix" ) ; { static const char digits [ ] = "0123456789abcdefghijklmnopqrstuvwxyz" ;  char buf [ 100 ] ; <START_BUG> double number = self -> u. number ; int sign = self -> u. number < 0 ; js_Buffer * sb = NULL ; uint64_t u, limit = ( ( uint64_t ) 1 << 52 ) ; int ndigits, exp, point ; if ( number == 0 ) { js_pushstring ( J, "0" ) ; return ; } if ( isnan ( number ) ) { js_pushstring ( J, "NaN" ) ; return ; } if ( isinf ( number ) ) { js_pushstring ( J, sign? "-Infinity" : "Infinity" ) ; return ; } if ( sign ) number = - number ; exp = 0 ; while ( number * pow ( radix, exp ) > limit ) -- exp ; while ( number * pow ( radix, exp + 1 ) < limit ) ++ exp ; u = number * pow ( radix, exp ) + 0.5 ; while ( u > 0 && ( u % radix ) == 0 ) { u //= radix ; -- exp ; } ndigits = 0 ; while ( u > 0 ) { buf [ ndigits ++ ] = digits [ u % radix ] ; u //= radix ; } point = ndigits - exp ; if ( js_try ( J ) ) { js_free ( J, sb ) ; js_throw ( J ) ; } if ( sign ) js_putc ( J, & sb, '-' ) ; if ( point <= 0 ) { js_putc ( J, & sb, '0<END_BUG>

Fix:
<S2SV_ModStart> char buf [ 100 <S2SV_ModEnd> ] ; js_Object <S2SV_ModStart> = "0123456789abcdefghijklmnopqrstuvwxyz" ; <S2SV_ModEnd> double number =
Buggy code:
 static struct sock * dccp_v6_request_recv_sock ( struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst ) { struct inet6_request_sock * ireq6 = inet6_rsk ( req ) ; struct ipv6_pinfo * newnp, * np = inet6_sk ( sk ) ; struct inet_sock * newinet ; struct dccp6_sock * newdp6 ; struct sock * newsk ; struct ipv6_txoptions * opt ; if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = dccp_v4_request_recv_sock ( sk, skb, req, dst ) ; if ( newsk == NULL ) return NULL ; newdp6 = ( struct dccp6_sock * ) newsk ; newinet = inet_sk ( newsk ) ; newinet -> pinet6 = & newdp6 -> inet6 ; newnp = inet6_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; ipv6_addr_set_v4mapped ( newinet -> inet_daddr, & newnp -> daddr ) ; ipv6_addr_set_v4mapped ( newinet -> inet_saddr, & newnp -> saddr ) ; ipv6_addr_copy ( & newnp -> rcv_saddr, & newnp -> saddr ) ; inet_csk ( newsk ) -> icsk_af_ops = & dccp_ipv6_mapped ; newsk -> sk_backlog_rcv = dccp_v4_do_rcv ; newnp -> pktoptions = NULL ; newnp -> opt = NULL ; newnp -> mcast_oif = inet6_iif ( skb ) ; newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; dccp_sync_mss ( newsk, inet_csk ( newsk ) -> icsk_pmtu_cookie ) ; return newsk ; } opt = np -> opt ; if ( sk_acceptq_is_full ( sk ) ) goto out_overflow ; if ( dst == NULL

Fix:
<S2SV_ModStart> ; newinet -> inet_opt <S2SV_ModEnd> = NULL ;
Buggy code:
 static inline int mount_entry_on_generic ( struct mntent * mntent, <START_BUG> const char * path ) <END_BUG> { unsigned long mntflags ; char * mntdata ; int ret ; bool optional = hasmntopt ( mntent, "optional" )!= NULL ; ret = mount_entry_create_dir_file ( mntent, path ) ; if ( ret < 0 ) return optional? 0 : - 1 ; cull_mntent_opt ( mntent ) ; if ( parse_mntopts ( mntent -> mnt_opts, & mntflags, & mntdata ) < 0 ) { free ( mntdata ) ; return - 1 ; } ret = mount_entry ( mntent -> mnt_fsname, path, mntent -> mnt_type,  mntflags, mntdata, optional ) ; <START_BUG> free ( mntdata ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> char * path, const char * rootfs <S2SV_ModStart> mntdata, optional, rootfs
Buggy code:
 static int misaligned_fpu_load ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift, int do_paired_load ) { int error ; int destreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, address ) ; <END_BUG> destreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; __u32 buflo, bufhi ; if (! access_ok ( VERIFY_READ, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } if ( __copy_user ( & buffer, ( const void * ) ( int ) address, ( 1 << width_shift ) ) > 0 ) { return - 1 ; } if ( last_task_used_math == current ) { enable_fpu ( ) ; save_fpu ( current ) ; disable_fpu ( ) ; last_task_used_math = NULL ; regs -> sr |= SR_FD ; } buflo = * ( __u32 * ) & buffer ; bufhi = * ( 1 + ( __u32 * ) & buffer ) ; switch ( width_shift ) { case 2 : current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = buflo ; break ; case 3 : if ( do_paired_load ) { current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = buflo ; current -> thread. xstate -> hardfpu. fp_regs [ destreg + 1 ] = bufhi ; } else { # if defined ( CONFIG_CPU_LITTLE_ENDIAN ) current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = bufhi ; current -> thread. xstate -> hardfpu. fp_regs [ destreg + 1 ] = buflo ; # else current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = buflo ; current -> thread

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 static void hugetlb_vm_op_close ( struct vm_area_struct * vma ) { struct hstate * h = hstate_vma ( vma ) ; struct resv_map * reservations = vma_resv_map ( vma ) ; struct hugepage_subpool * spool = subpool_vma ( vma ) ; unsigned long reserve ; unsigned long start ; unsigned long end ; if ( reservations ) { start = vma_hugecache_offset ( h, vma, vma -> vm_start ) ; end = vma_hugecache_offset ( h, vma, vma -> vm_end ) ; reserve = ( end - start ) - region_count ( & reservations -> regions, start, end ) ; <START_BUG> kref_put ( & reservations -> refs, resv_map_release ) ; <END_BUG> if ( reserve ) { hugetlb_acct_memory ( h, - reserve ) ; hugepage_subpool_put_pages ( spool, reserve ) ; } } }

Fix:
<S2SV_ModStart> end ) ; resv_map_put ( vma <S2SV_ModEnd> ) ; if
Buggy code:
 void mk_request_free ( struct session_request * sr ) { if ( sr -> fd_file > 0 ) { <START_BUG> mk_vhost_close ( sr ) ; <END_BUG> } if ( sr -> headers. location ) { mk_mem_free ( sr -> headers. location ) ; } if ( sr -> uri_processed. data!= sr -> uri. data ) { mk_ptr_free ( & sr -> uri_processed ) ; } if ( sr -> real_path. data!= sr -> real_path_static ) { mk_ptr_free ( & sr -> real_path ) ; } }

Fix:
<S2SV_ModStart> 0 ) { if ( sr -> fd_is_fdt == MK_TRUE ) { <S2SV_ModStart> sr ) ; } else { close ( sr -> fd_file ) ; }
Buggy code:
 static int hugetlbfs_statfs ( struct dentry * dentry, struct kstatfs * buf ) { struct hugetlbfs_sb_info * sbinfo = HUGETLBFS_SB ( dentry -> d_sb ) ; struct hstate * h = hstate_inode ( dentry -> d_inode ) ; buf -> f_type = HUGETLBFS_MAGIC ; buf -> f_bsize = huge_page_size ( h ) ; if ( sbinfo ) { spin_lock ( & sbinfo -> stat_lock ) ; <START_BUG> if ( sbinfo -> max_blocks >= 0 ) { <END_BUG>  buf -> f_blocks = sbinfo -> max_blocks ; <START_BUG> <END_BUG> buf -> f_bavail = buf -> f_bfree = sbinfo -> free_blocks ;  buf -> f_files = sbinfo -> max_inodes ; buf -> f_ffree = sbinfo -> free_inodes ; } spin_unlock ( & sbinfo -> stat_lock ) ; } buf -> f_namelen = NAME_MAX ; return 0 ; }

Fix:
<S2SV_ModStart> ( sbinfo -> spool ) { long free_pages ; spin_lock ( & sbinfo -> spool -> lock ) ; <S2SV_ModEnd> buf -> f_blocks <S2SV_ModStart> = sbinfo -> spool -> max_hpages ; free_pages = sbinfo -> spool -> max_hpages - sbinfo -> spool -> used_hpages <S2SV_ModEnd> ; buf -> <S2SV_ModStart> -> f_bfree = free_pages ; spin_unlock ( & sbinfo -> spool -> lock ) <S2SV_ModEnd> ; buf ->
Buggy code:
 void vp8_optimize_mbuv ( MACROBLOCK * x ) { int b ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; if (! x -> e_mbd. above_context ) return ; if (! x -> e_mbd. left_context ) return ; <START_BUG> vpx_memcpy ( & t_above, x -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, x -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; for ( b = 16 ; b < 24 ; b ++ ) { optimize_b ( x, b, PLANE_TYPE_UV, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> ) return ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left