nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int ext4_fill_flex_info ( struct super_block * sb ) { struct ext4_sb_info * sbi = EXT4_SB ( sb ) ; struct ext4_group_desc * gdp = NULL ; ext4_group_t flex_group_count ; ext4_group_t flex_group ; <START_BUG> int groups_per_flex = 0 ; <END_BUG> size_t size ; int i ; sbi -> s_log_groups_per_flex = sbi -> s_es -> s_log_groups_per_flex ;  groups_per_flex = 1 << sbi -> s_log_groups_per_flex ; <START_BUG> <END_BUG> if ( groups_per_flex < 2 ) {  sbi -> s_log_groups_per_flex = 0 ; return 1 ; } flex_group_count = ( ( sbi -> s_groups_count + groups_per_flex - 1 ) + ( ( le16_to_cpu ( sbi -> s_es -> s_reserved_gdt_blocks ) + 1 ) << EXT4_DESC_PER_BLOCK_BITS ( sb ) ) ) // groups_per_flex ; size = flex_group_count * sizeof ( struct flex_groups ) ; sbi -> s_flex_groups = ext4_kvzalloc ( size, GFP_KERNEL ) ; if ( sbi -> s_flex_groups == NULL ) { ext4_msg ( sb, KERN_ERR, "not   enough   memory   for   %u   flex   groups", flex_group_count ) ; goto failed ; } for ( i = 0 ; i < sbi -> s_groups_count ; i ++ ) { gdp = ext4_get_group_desc ( sb, i, NULL ) ; flex_group = ext4_flex_group ( sbi, i ) ; atomic_add ( ext4_free_inodes_count ( sb, gdp ), & sbi -> s_flex_groups [ flex_group ]. free_inodes ) ; atomic_add ( ext4_free_group_clusters ( sb, gdp ), & sbi -> s_flex_groups [ flex_group ]. free_clusters ) ; atomic_add ( ext4_used_dirs_count ( sb, gdp

Fix:
<S2SV_ModStart> ext4_group_t flex_group ; unsigned <S2SV_ModStart> -> s_log_groups_per_flex ; if ( sbi -> s_log_groups_per_flex < 1 || sbi -> s_log_groups_per_flex > 31 ) { sbi -> s_log_groups_per_flex = 0 ; return 1 ; } <S2SV_ModStart> -> s_log_groups_per_flex ; <S2SV_ModEnd> flex_group_count = (
Buggy code:
 static krb5_error_code process_db_args ( krb5_context context, char * * db_args, xargs_t * xargs, OPERATION optype ) { int i = 0 ; krb5_error_code st = 0 ; char * arg = NULL, * arg_val = NULL ; char * * dptr = NULL ; unsigned int arg_val_len = 0 ; if ( db_args ) { for ( i = 0 ; db_args [ i ] ; ++ i ) { arg = strtok_r ( db_args [ i ], "=", & arg_val ) ; <START_BUG> if ( strcmp ( arg, TKTPOLICY_ARG ) == 0 ) { <END_BUG> dptr = & xargs -> tktpolicydn ; } else { if ( strcmp ( arg, USERDN_ARG ) == 0 ) { if ( optype == MODIFY_PRINCIPAL || xargs -> dn!= NULL || xargs -> containerdn!= NULL || xargs -> linkdn!= NULL ) { st = EINVAL ; k5_setmsg ( context, st, _ ( "%s   option   not   supported" ), arg ) ; goto cleanup ; } dptr = & xargs -> dn ; } else if ( strcmp ( arg, CONTAINERDN_ARG ) == 0 ) { if ( optype == MODIFY_PRINCIPAL || xargs -> dn!= NULL || xargs -> containerdn!= NULL ) { st = EINVAL ; k5_setmsg ( context, st, _ ( "%s   option   not   supported" ), arg ) ; goto cleanup ; } dptr = & xargs -> containerdn ; } else if ( strcmp ( arg, LINKDN_ARG ) == 0 ) { if ( xargs -> dn!= NULL || xargs -> linkdn!= NULL ) { st = EINVAL ; k5_setmsg ( context, st, _ ( "%s   option   not   supported" ), arg ) ; goto cleanup ; } dptr = & xargs -> linkdn ; } else { st = EINVAL ; k5_setmsg ( context, st, _ ( "unknown   option:   %s" ), arg ) ; goto cleanup ; } xargs -> dn_from_kbd = TRUE ; if ( arg_val == NULL || strlen ( arg_val ) ==

Fix:
<S2SV_ModStart> arg_val ) ; arg = ( arg!= NULL )? arg : "" ;
Buggy code:
 static int rose_parse_national ( unsigned char * p, struct rose_facilities_struct * facilities, int len ) { unsigned char * pt ; unsigned char l, lg, n = 0 ; int fac_national_digis_received = 0 ; do { switch ( * p & 0xC0 ) { case 0x00 : p += 2 ; n += 2 ; len -= 2 ; break ; case 0x40 : if ( * p == FAC_NATIONAL_RAND ) facilities -> rand = ( ( p [ 1 ] << 8 ) & 0xFF00 ) + ( ( p [ 2 ] << 0 ) & 0x00FF ) ; p += 3 ; n += 3 ; len -= 3 ; break ; case 0x80 : p += 4 ; n += 4 ; len -= 4 ; break ; case 0xC0 : l = p [ 1 ] ; if ( * p == FAC_NATIONAL_DEST_DIGI ) { if (! fac_national_digis_received ) { memcpy ( & facilities -> source_digis [ 0 ], p + 2, AX25_ADDR_LEN ) ; facilities -> source_ndigis = 1 ; } } else if ( * p == FAC_NATIONAL_SRC_DIGI ) { if (! fac_national_digis_received ) { memcpy ( & facilities -> dest_digis [ 0 ], p + 2, AX25_ADDR_LEN ) ; facilities -> dest_ndigis = 1 ; } } else if ( * p == FAC_NATIONAL_FAIL_CALL ) { memcpy ( & facilities -> fail_call, p + 2, AX25_ADDR_LEN ) ; } else if ( * p == FAC_NATIONAL_FAIL_ADD ) { memcpy ( & facilities -> fail_addr, p + 3, ROSE_ADDR_LEN ) ; } else if ( * p == FAC_NATIONAL_DIGIS ) { fac_national_digis_received = 1 ; facilities -> source_ndigis = 0 ; facilities -> dest_ndigis = 0 ; for ( pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_

Fix:
<S2SV_ModStart> & AX25_HBIT ) { if ( facilities -> dest_ndigis >= ROSE_MAX_DIGIS ) return - 1 ; <S2SV_ModStart> AX25_ADDR_LEN ) ; } else { if ( facilities -> source_ndigis >= ROSE_MAX_DIGIS ) return - 1 ; <S2SV_ModEnd> memcpy ( & <S2SV_ModStart> AX25_ADDR_LEN ) ; }
Buggy code:
 SQLRETURN SQLSetDescField ( SQLHDESC descriptor_handle, SQLSMALLINT rec_number, SQLSMALLINT field_identifier, SQLPOINTER value, SQLINTEGER buffer_length ) { DMHDESC descriptor = ( DMHDESC ) descriptor_handle ; SQLRETURN ret ; SQLCHAR s1 [ 100 + LOG_MESSAGE_LEN ] ; int isStrField = 0 ; if (! __validate_desc ( descriptor ) ) { dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, "Error:   SQL_INVALID_HANDLE" ) ; return SQL_INVALID_HANDLE ; } function_entry ( descriptor ) ; if ( log_info. log_flag ) { <START_BUG> sprintf ( descriptor -> msg, "\\n\\t\\tEntry:\\\n   \\n\\t\\t\\tDescriptor   =   %p\\\n   \\n\\t\\t\\tRec   Number   =   %d\\\n   \\n\\t\\t\\tField   Ident   =   %s\\\n   \\n\\t\\t\\tValue   =   %p\\\n   \\n\\t\\t\\tBuffer   Length   =   %d", <END_BUG> descriptor, rec_number, __desc_attr_as_string ( s1, field_identifier ), value, ( int ) buffer_length ) ; dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, descriptor -> msg ) ; } thread_protect ( SQL_HANDLE_DESC, descriptor ) ; if ( descriptor -> connection -> state < STATE_C4 ) { dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, "Error:   HY010" ) ; __post_internal_error ( & descriptor -> error, ERROR_HY010, NULL, descriptor -> connection -> environment -> requested_version ) ; return function_return_nodrv ( SQL_HANDLE_DESC, descriptor, SQL_ERROR ) ; } if ( __check_stmt_from_desc ( descriptor, STATE_S8 ) || __check_stmt_from_desc ( descriptor, STATE_S9 ) || __check_stmt_from_desc ( descriptor, STATE_S10 ) || __check_stmt_from_desc ( descriptor, STATE_S11 ) || __

Fix:
<S2SV_ModStart> -> msg, "\\n\\t\\tEntry:\\\n\\n\\t\\t\\tDescriptor <S2SV_blank> = <S2SV_blank> %p\\\n\\n\\t\\t\\tRec <S2SV_blank> Number <S2SV_blank> = <S2SV_blank> %d\\\n\\n\\t\\t\\tField <S2SV_blank> Ident <S2SV_blank> = <S2SV_blank> %s\\\n\\n\\t\\t\\tValue <S2SV_blank> = <S2SV_blank> %p\\\n\\n\\t\\t\\tBuffer <S2SV_blank> Length <S2SV_blank> = <S2SV_blank> %d" <S2SV_ModEnd>, descriptor, <S2SV_ModStart> SQL_DESC_COUNT && ( intptr_t <S2SV_ModEnd> ) value < <S2SV_ModStart> == SQL_DESC_PARAMETER_TYPE && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_INPUT && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_OUTPUT && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_INPUT_OUTPUT && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_INPUT_OUTPUT_STREAM && ( intptr_t )
Buggy code:
 static int mwifiex_update_vs_ie ( const u8 * ies, int ies_len, struct mwifiex_ie * * ie_ptr, u16 mask, unsigned int oui, u8 oui_type ) { struct ieee_types_header * vs_ie ; struct mwifiex_ie * ie = * ie_ptr ; const u8 * vendor_ie ; vendor_ie = cfg80211_find_vendor_ie ( oui, oui_type, ies, ies_len ) ; if ( vendor_ie ) { if (! * ie_ptr ) { * ie_ptr = kzalloc ( sizeof ( struct mwifiex_ie ), GFP_KERNEL ) ; if (! * ie_ptr ) return - ENOMEM ; ie = * ie_ptr ; } vs_ie = ( struct ieee_types_header * ) vendor_ie ; <START_BUG> memcpy ( ie -> ie_buffer + le16_to_cpu ( ie -> ie_length ), <END_BUG> vs_ie, vs_ie -> len + 2 ) ; le16_unaligned_add_cpu ( & ie -> ie_length, vs_ie -> len + 2 ) ; ie -> mgmt_subtype_mask = cpu_to_le16 ( mask ) ; ie -> ie_index = cpu_to_le16 ( MWIFIEX_AUTO_IDX_MASK ) ; } * ie_ptr = ie ; return 0 ; }

Fix:
<S2SV_ModStart> ) vendor_ie ; if ( le16_to_cpu ( ie -> ie_length ) + vs_ie -> len + 2 > IEEE_MAX_IE_SIZE ) return - EINVAL ;
Buggy code:
 static int snd_timer_start_slave ( struct snd_timer_instance * timeri ) { unsigned long flags ; spin_lock_irqsave ( & slave_active_lock, flags ) ; timeri -> flags |= SNDRV_TIMER_IFLG_RUNNING ; <START_BUG> if ( timeri -> master ) <END_BUG> list_add_tail ( & timeri -> active_list, & timeri -> master -> slave_active_head ) ;  spin_unlock_irqrestore ( & slave_active_lock, flags ) ; <START_BUG> return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> timeri -> master && timeri -> timer ) { spin_lock ( & timeri -> timer -> lock ) ; <S2SV_ModEnd> list_add_tail ( & <S2SV_ModStart> slave_active_head ) ; spin_unlock ( & timeri -> timer -> lock ) ; }
Buggy code:
 int input_set_keycode ( struct input_dev * dev, const struct input_keymap_entry * ke ) { unsigned long flags ; unsigned int old_keycode ; int retval ; if ( ke -> keycode > KEY_MAX ) return - EINVAL ; spin_lock_irqsave ( & dev -> event_lock, flags ) ; retval = dev -> setkeycode ( dev, ke, & old_keycode ) ; if ( retval ) goto out ; __clear_bit ( KEY_RESERVED, dev -> keybit ) ; <START_BUG> if ( test_bit ( EV_KEY, dev -> evbit ) && <END_BUG>! is_event_supported ( old_keycode, dev -> keybit, KEY_MAX ) && __test_and_clear_bit ( old_keycode, dev -> key ) ) { struct input_value vals [ ] = { { EV_KEY, old_keycode, 0 }, input_value_sync } ; input_pass_values ( dev, vals, ARRAY_SIZE ( vals ) ) ; } out : spin_unlock_irqrestore ( & dev -> event_lock, flags ) ; return retval ; }

Fix:
<S2SV_ModStart> keybit ) ; if ( old_keycode > KEY_MAX ) { dev_warn ( dev -> dev. parent? : & dev -> dev, "%s: <S2SV_blank> got <S2SV_blank> too <S2SV_blank> big <S2SV_blank> old <S2SV_blank> keycode <S2SV_blank> %#x\\n", __func__, old_keycode ) ; } else
Buggy code:
 int nfssvc_decode_readdirargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd_readdirargs * args ) { p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; args -> cookie = ntohl ( * p ++ ) ; args -> count = ntohl ( * p ++ ) ; args -> count = min_t ( u32, args -> count, PAGE_SIZE ) ; <START_BUG> args -> buffer = page_address ( * ( rqstp -> rq_next_page ++ ) ) ; <END_BUG>  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> PAGE_SIZE ) ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 ; <S2SV_ModStart> ) ; return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 BOOL security_decrypt ( BYTE * data, int length, rdpRdp * rdp ) <START_BUG> { <END_BUG> if ( rdp -> decrypt_use_count >= 4096 ) { security_key_update ( rdp -> decrypt_key, rdp -> decrypt_update_key, rdp -> rc4_key_len ) ; crypto_rc4_free ( rdp -> rc4_decrypt_key ) ; rdp -> rc4_decrypt_key = crypto_rc4_init ( rdp -> decrypt_key, rdp -> rc4_key_len ) ; rdp -> decrypt_use_count = 0 ; } crypto_rc4 ( rdp -> rc4_decrypt_key, length, data, data ) ; rdp -> decrypt_use_count += 1 ; rdp -> decrypt_checksum_use_count ++ ; return TRUE ; }

Fix:
<S2SV_ModStart> rdp ) { if ( rdp -> rc4_decrypt_key == NULL ) return FALSE ;
Buggy code:
 static int parse_device ( dev_t * pdev, struct archive * a, char * val ) { # define MAX_PACK_ARGS 3 unsigned long numbers [ MAX_PACK_ARGS ] ; char * p, * dev ; int argc ; pack_t * pack ; dev_t result ; const char * error = NULL ; memset ( pdev, 0, sizeof ( * pdev ) ) ; if ( ( dev = strchr ( val, ',' ) )!= NULL ) { * dev ++ = '\\0' ; if ( ( pack = pack_find ( val ) ) == NULL ) { archive_set_error ( a, ARCHIVE_ERRNO_FILE_FORMAT, "Unknown   format   `%s\'", val ) ; return ARCHIVE_WARN ; } argc = 0 ; while ( ( p = la_strsep ( & dev, "," ) )!= NULL ) { if ( * p == '\\0' ) { archive_set_error ( a, ARCHIVE_ERRNO_FILE_FORMAT, "Missing   number" ) ; return ARCHIVE_WARN ; } <START_BUG> numbers [ argc ++ ] = ( unsigned long ) mtree_atol ( & p ) ; <END_BUG>  if ( argc > MAX_PACK_ARGS ) { <START_BUG> archive_set_error ( a, ARCHIVE_ERRNO_FILE_FORMAT, "Too   many   arguments" ) ; return ARCHIVE_WARN ; } } if ( argc < 2 ) { archive_set_error ( a, ARCHIVE_ERRNO_FILE_FORMAT, "Not   enough   arguments" ) ; return ARCHIVE_WARN ; } result = ( * pack ) ( argc, numbers, & error ) ; if ( error!= NULL ) { archive_set_error ( a, ARCHIVE_ERRNO_FILE_FORMAT, "%s", error ) ; return ARCHIVE_WARN ; } } else { result = ( dev_t ) mtree_atol ( & val ) ; } * pdev = result ; return ARCHIVE_OK ; # undef MAX_PACK_ARGS }<END_BUG>

Fix:
<S2SV_ModStart> ARCHIVE_WARN ; } if ( argc >= MAX_PACK_ARGS ) { archive_set_error ( a, ARCHIVE_ERRNO_FILE_FORMAT, "Too <S2SV_blank> many <S2SV_blank> arguments" ) ; return ARCHIVE_WARN ; } <S2SV_ModStart> p ) ; <S2SV_ModEnd> } if (
Buggy code:
 void uverbs_user_mmap_disassociate ( struct ib_uverbs_file * ufile ) { struct rdma_umap_priv * priv, * next_priv ; lockdep_assert_held ( & ufile -> hw_destroy_rwsem ) ; while ( 1 ) { struct mm_struct * mm = NULL ; mutex_lock ( & ufile -> umap_lock ) ; while (! list_empty ( & ufile -> umaps ) ) { int ret ; priv = list_first_entry ( & ufile -> umaps, struct rdma_umap_priv, list ) ; mm = priv -> vma -> vm_mm ; ret = mmget_not_zero ( mm ) ; if (! ret ) { list_del_init ( & priv -> list ) ; mm = NULL ; continue ; } break ; } mutex_unlock ( & ufile -> umap_lock ) ; if (! mm ) return ; <START_BUG> down_write ( & mm -> mmap_sem ) ; <END_BUG> mutex_lock ( & ufile -> umap_lock ) ; list_for_each_entry_safe ( priv, next_priv, & ufile -> umaps, list ) { struct vm_area_struct * vma = priv -> vma ; if ( vma -> vm_mm!= mm ) continue ; list_del_init ( & priv -> list ) ; zap_vma_ptes ( vma, vma -> vm_start, vma -> vm_end - vma -> vm_start ) ; vma -> vm_flags &= ~ ( VM_SHARED | VM_MAYSHARE ) ; } mutex_unlock ( & ufile -> umap_lock ) ;  up_write ( & mm -> mmap_sem ) ; <START_BUG> mmput ( mm ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> -> mmap_sem ) ; if (! mmget_still_valid ( mm ) ) goto skip_mm <S2SV_ModStart> umap_lock ) ; skip_mm :
Buggy code:
 char * url_decode_r ( char * to, char * url, size_t size ) { char * s = url, * d = to, * e = & to [ size - 1 ] ; while ( * s && d < e ) { if ( unlikely ( * s == '%' ) ) { if ( likely ( s [ 1 ] && s [ 2 ] ) ) { <START_BUG> * d ++ = from_hex ( s [ 1 ] ) << 4 | from_hex ( s [ 2 ] ) ; <END_BUG> s += 2 ; } } else if ( unlikely ( * s == '+' ) ) * d ++ =' '; else * d ++ = * s ; s ++ ; } * d = '\\0' ; return to ; }

Fix:
<S2SV_ModStart> ) ) { char t <S2SV_ModEnd> = from_hex ( <S2SV_ModStart> [ 2 ] ) ; * d ++ = ( char ) ( ( isprint ( t ) )? t :'<S2SV_blank> '
Buggy code:
 static Image * ReadYCBCRImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { const unsigned char * pixels ; Image * canvas_image, * image ; MagickBooleanType status ; MagickOffsetType scene ; QuantumInfo * quantum_info ; QuantumType quantum_type ; register const Quantum * p ; register ssize_t i, x ; register Quantum * q ; size_t length ; ssize_t count, y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( OptionError, "MustSpecifyImageSize" ) ; status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; SetImageColorspace ( image, YCbCrColorspace, exception ) ; if ( image_info -> interlace!= PartitionInterlace ) { status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } if ( DiscardBlobBytes ( image, image -> offset ) == MagickFalse ) ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; } canvas_image = CloneImage ( image, image -> extract_info. width, 1, MagickFalse, exception ) ; ( void ) SetImageVirtualPixelMethod ( canvas_image, BlackVirtualPixelMethod, exception ) ; quantum_info = AcquireQuantumInfo ( image_info, canvas_image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; quantum_type = RGBQuantum ;

Fix:
<S2SV_ModStart> DestroyQuantumInfo ( quantum_info ) ; canvas_image = DestroyImage ( canvas_image
Buggy code:
 error_t httpClientParseHeaderField ( HttpClientContext * context, char_t * line, size_t length ) { error_t error ; char_t * name ; size_t nameLen ; char_t * value ; size_t valueLen ; char_t * separator ; line [ length ] = '\\0' ; TRACE_DEBUG ( "%s\\r\\n", line ) ; error = httpCheckCharset ( line, length, HTTP_CHARSET_TEXT ) ; if ( error ) return error ; if ( line [ 0 ] ==' '|| line [ 0 ] == '\\t' ) { if ( context -> bufferPos == 0 ) return ERROR_INVALID_SYNTAX ; value = strTrimWhitespace ( line ) ; valueLen = osStrlen ( value ) ; if ( valueLen > 0 ) { context -> buffer [ context -> bufferPos - 1 ] =' '; osMemmove ( context -> buffer + context -> bufferPos, value, valueLen + 1 ) ; context -> bufferLen = context -> bufferPos + valueLen + 1 ; } } else { <START_BUG> separator = strchr ( line, ':' ) ; <END_BUG> if ( separator == NULL ) return ERROR_INVALID_SYNTAX ; * separator = '\\0' ; name = strTrimWhitespace ( line ) ; value = strTrimWhitespace ( separator + 1 ) ; nameLen = osStrlen ( name ) ; valueLen = osStrlen ( value ) ; if ( nameLen == 0 ) return ERROR_INVALID_SYNTAX ; if (! osStrcasecmp ( name, "Connection" ) ) { httpClientParseConnectionField ( context, value ) ; } else if (! osStrcasecmp ( name, "Transfer-Encoding" ) ) { httpClientParseTransferEncodingField ( context, value ) ; } else if (! osStrcasecmp ( name, "Content-Length" ) ) { httpClientParseContentLengthField ( context, value ) ; } # if ( HTTP_CLIENT_AUTH_SUPPORT == ENABLED ) else if (! osStrcasecmp ( name, "WWW-Authenticate" ) ) { httpClientParseWwwAuthenticateField ( context, value ) ; } # endif else { } osMemmove ( context -> buffer + context -> bufferPos, name, nameLen + 1 ) ; osMemmove ( context -> buffer + context -> bufferPos + nameLen + 1, value, valueLen + 1 ) ; context -> bufferLen =

Fix:
<S2SV_ModStart> { separator = osStrchr <S2SV_ModEnd> ( line,
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 char magick [ 12 ] ; Image * image ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; Quantum index ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, number_planes, number_planes_filled, one, pixel_info_length ; ssize_t count, offset, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { image -> page. x = ReadBlobLSBShort ( image ) ; image -> page. y = ReadBlobLSBShort ( image ) ; image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> alpha_trait = flags & 0x04? BlendPixelTrait : Undefined

Fix:
<S2SV_ModStart> pixel_info ) ; ( void ) ResetMagickMemory ( pixels, 0, pixel_info_length ) ;
Buggy code:
 static int jpc_pi_nextrpcl ( register jpc_pi_t * pi ) { int rlvlno ; jpc_pirlvl_t * pirlvl ; jpc_pchg_t * pchg ; int prchind ; int prcvind ; int * prclyrno ; int compno ; jpc_picomp_t * picomp ; int xstep ; int ystep ; uint_fast32_t r ; uint_fast32_t rpx ; uint_fast32_t rpy ; uint_fast32_t trx0 ; uint_fast32_t try0 ; pchg = pi -> pchg ; if (! pi -> prgvolfirst ) { goto skip ; } else { pi -> xstep = 0 ; pi -> ystep = 0 ; for ( compno = 0, picomp = pi -> picomps ; compno < pi -> numcomps ; ++ compno, ++ picomp ) { for ( rlvlno = 0, pirlvl = picomp -> pirlvls ; rlvlno < picomp -> numrlvls ; ++ rlvlno, ++ pirlvl ) { <START_BUG> if ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls > <END_BUG> JAS_UINTFAST32_NUMBITS - 2 ||  pirlvl -> prcheightexpn + pi -> picomp -> numrlvls > <START_BUG> JAS_UINTFAST32_NUMBITS - 2 ) { return - 1 ; } xstep = picomp -> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << ( pirlvl -> prcwidthexpn + picomp -> numrlvls - rlvlno - 1 ) ) ; ystep = picomp -> vsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << ( pirlvl -> prcheightexpn + picomp -> numrlvls - rlvlno - 1 ) ) ; pi -> xstep = (! pi -> xstep )? xstep : JAS_MIN ( pi -> xstep, xstep ) ; pi -> ystep = (! pi -> ystep )? ystep : JAS_MIN ( pi -> ystep, ystep ) ; } } pi -> pr<END_BUG>

Fix:
<S2SV_ModStart> -> prcwidthexpn + <S2SV_ModEnd> picomp -> numrlvls <S2SV_ModStart> -> prcheightexpn + <S2SV_ModEnd> picomp -> numrlvls
Buggy code:
 <START_BUG> static char * mongo_data_append ( char * start, const void * data, int len ) { <END_BUG> memcpy ( start, data, len ) ; return start + len ; }

Fix:
<S2SV_ModStart> * data, size_t <S2SV_ModEnd> len ) {
Buggy code:
 static struct phy * serdes_simple_xlate ( struct device * dev, struct of_phandle_args * args ) { struct serdes_ctrl * ctrl = dev_get_drvdata ( dev ) ; unsigned int port, idx, i ; if ( args -> args_count!= 2 ) return ERR_PTR ( - EINVAL ) ; port = args -> args [ 0 ] ; idx = args -> args [ 1 ] ; <START_BUG> for ( i = 0 ; i <= SERDES_MAX ; i ++ ) { <END_BUG> struct serdes_macro * macro = phy_get_drvdata ( ctrl -> phys [ i ] ) ; if ( idx!= macro -> idx ) continue ; if ( idx!= SERDES6G ( 0 ) && macro -> port >= 0 ) return ERR_PTR ( - EBUSY ) ; macro -> port = port ; return ctrl -> phys [ i ] ; } return ERR_PTR ( - ENODEV ) ; }

Fix:
<S2SV_ModStart> 0 ; i < <S2SV_ModEnd> SERDES_MAX ; i
Buggy code:
 void pid_ns_release_proc ( struct pid_namespace * ns ) { <START_BUG> mntput ( ns -> proc_mnt ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ns ) { kern_unmount <S2SV_ModEnd> ( ns ->
Buggy code:
 void pango_glyph_string_set_size ( PangoGlyphString * string, gint new_len ) { g_return_if_fail ( new_len >= 0 ) ; while ( new_len > string -> space ) { if ( string -> space == 0 ) <START_BUG> string -> space = 1 ; <END_BUG> else  string -> space *= 2 ; <START_BUG> <END_BUG> if ( string -> space < 0 )  { g_warning ( "glyph   string   length   overflows   maximum   integer   size,   truncated" ) ; <START_BUG> new_len = string -> space = G_MAXINT - 8 ; <END_BUG> } } string -> glyphs = g_realloc ( string -> glyphs, string -> space * sizeof ( PangoGlyphInfo ) ) ; string -> log_clusters = g_realloc ( string -> log_clusters, string -> space * sizeof ( gint ) ) ; string -> num_glyphs = new_len ; }

Fix:
<S2SV_ModStart> == 0 ) { <S2SV_ModStart> -> space = 4 ; } else { const guint max_space = MIN ( G_MAXINT, G_MAXSIZE // MAX ( sizeof ( PangoGlyphInfo ), sizeof ( gint ) ) ) ; guint more_space = ( guint ) <S2SV_ModEnd> string -> space <S2SV_ModStart> string -> space * <S2SV_ModEnd> 2 ; if <S2SV_ModStart> ; if ( more_space > max_space ) { more_space = max_space ; if ( ( guint ) new_len > max_space ) { g_error ( "%s: <S2SV_blank> failed <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> glyph <S2SV_blank> string <S2SV_blank> of <S2SV_blank> length <S2SV_blank> %i\\n", G_STRLOC, new_len ) ; } } <S2SV_ModEnd> string -> space <S2SV_ModStart> -> space = more_space <S2SV_ModEnd> ; } }
Buggy code:
 DECLAREcpFunc ( cpDecodedStrips ) { tsize_t stripsize = TIFFStripSize ( in ) ; tdata_t buf = _TIFFmalloc ( stripsize ) ; ( void ) imagewidth ; ( void ) spp ; if ( buf ) { tstrip_t s, ns = TIFFNumberOfStrips ( in ) ; uint32 row = 0 ; _TIFFmemset ( buf, 0, stripsize ) ; <START_BUG> for ( s = 0 ; s < ns ; s ++ ) { <END_BUG> tsize_t cc = ( row + rowsperstrip > imagelength )? TIFFVStripSize ( in, imagelength - row ) : stripsize ; if ( TIFFReadEncodedStrip ( in, s, buf, cc ) < 0 &&! ignore ) { TIFFError ( TIFFFileName ( in ), "Error,   can\'t   read   strip   %lu", ( unsigned long ) s ) ; goto bad ; } if ( TIFFWriteEncodedStrip ( out, s, buf, cc ) < 0 ) { TIFFError ( TIFFFileName ( out ), "Error,   can\'t   write   strip   %lu", ( unsigned long ) s ) ; goto bad ; } row += rowsperstrip ; } _TIFFfree ( buf ) ; return 1 ; } else { TIFFError ( TIFFFileName ( in ), "Error,   can\'t   allocate   memory   buffer   of   size   %lu   " "to   read   strips", ( unsigned long ) stripsize ) ; return 0 ; } bad : _TIFFfree ( buf ) ; return 0 ; }

Fix:
<S2SV_ModStart> s < ns && row < imagelength
Buggy code:
 static int flashsv_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt ) { int buf_size = avpkt -> size ; FlashSVContext * s = avctx -> priv_data ; int h_blocks, v_blocks, h_part, v_part, i, j, ret ; GetBitContext gb ; int last_blockwidth = s -> block_width ; int last_blockheight = s -> block_height ; if ( buf_size == 0 ) return 0 ; if ( buf_size < 4 ) return - 1 ; init_get_bits ( & gb, avpkt -> data, buf_size * 8 ) ; s -> block_width = 16 * ( get_bits ( & gb, 4 ) + 1 ) ; s -> image_width = get_bits ( & gb, 12 ) ; s -> block_height = 16 * ( get_bits ( & gb, 4 ) + 1 ) ; s -> image_height = get_bits ( & gb, 12 ) ; if ( last_blockwidth!= s -> block_width || last_blockheight!= s -> block_height ) av_freep ( & s -> blocks ) ; if ( s -> ver == 2 ) { skip_bits ( & gb, 6 ) ; if ( get_bits1 ( & gb ) ) { avpriv_request_sample ( avctx, "iframe" ) ; return AVERROR_PATCHWELCOME ; } if ( get_bits1 ( & gb ) ) { avpriv_request_sample ( avctx, "Custom   palette" ) ; return AVERROR_PATCHWELCOME ; } } h_blocks = s -> image_width // s -> block_width ; h_part = s -> image_width % s -> block_width ; v_blocks = s -> image_height // s -> block_height ; v_part = s -> image_height % s -> block_height ; if ( s -> block_size < s -> block_width * s -> block_height ) { int tmpblock_size = 3 * s -> block_width * s -> block_height ; s -> tmpblock = av_realloc ( s -> tmpblock, tmpblock_size ) ; if (! s -> tmpblock ) { av_log (

Fix:
<S2SV_ModStart> 8 ) ; if ( s -> diff_start + s -> diff_height > cur_blk_height ) { av_log ( avctx, AV_LOG_ERROR, "Block <S2SV_blank> parameters <S2SV_blank> invalid\\n" ) ; return AVERROR_INVALIDDATA ; }
Buggy code:
 static int dccp_packet ( struct nf_conn * ct, const struct sk_buff * skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, u_int8_t pf, unsigned int hooknum, unsigned int * timeouts ) { struct net * net = nf_ct_net ( ct ) ; enum ip_conntrack_dir dir = CTINFO2DIR ( ctinfo ) ; struct dccp_hdr _dh, * dh ; u_int8_t type, old_state, new_state ; enum ct_dccp_roles role ; <START_BUG> dh = skb_header_pointer ( skb, dataoff, sizeof ( _dh ), & dh ) ; <END_BUG> BUG_ON ( dh == NULL ) ; type = dh -> dccph_type ; if ( type == DCCP_PKT_RESET &&! test_bit ( IPS_SEEN_REPLY_BIT, & ct -> status ) ) { nf_ct_kill_acct ( ct, ctinfo, skb ) ; return NF_ACCEPT ; } spin_lock_bh ( & ct -> lock ) ; role = ct -> proto. dccp. role [ dir ] ; old_state = ct -> proto. dccp. state ; new_state = dccp_state_table [ role ] [ type ] [ old_state ] ; switch ( new_state ) { case CT_DCCP_REQUEST : if ( old_state == CT_DCCP_TIMEWAIT && role == CT_DCCP_ROLE_SERVER ) { ct -> proto. dccp. role [ dir ] = CT_DCCP_ROLE_CLIENT ; ct -> proto. dccp. role [! dir ] = CT_DCCP_ROLE_SERVER ; } break ; case CT_DCCP_RESPOND : if ( old_state == CT_DCCP_REQUEST ) ct -> proto. dccp. handshake_seq = dccp_hdr_seq ( dh ) ; break ; case CT_DCCP_PARTOPEN : if ( old_state == CT_DCCP_RESPOND && type == DCCP_PKT_ACK && dccp_ack_seq ( dh ) == ct -> proto. dccp. handshake_seq ) set_bit ( IPS_ASSURED_BIT

Fix:
<S2SV_ModStart> ), & _dh <S2SV_ModEnd> ) ; BUG_ON
Buggy code:
 <START_BUG> static void evtchn_fifo_handle_events ( unsigned cpu ) <END_BUG> {  __evtchn_fifo_handle_events ( cpu, false ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( unsigned cpu, struct evtchn_loop_ctrl * ctrl <S2SV_ModStart> ( cpu, ctrl <S2SV_ModEnd> ) ; }
Buggy code:
 static int decode_level3_header ( LHAFileHeader * * header, LHAInputStream * stream ) { unsigned int header_len ; if ( lha_decode_uint16 ( & RAW_DATA ( header, 0 ) )!= 4 ) { return 0 ; } if (! extend_raw_data ( header, stream, LEVEL_3_HEADER_LEN - RAW_DATA_LEN ( header ) ) ) { return 0 ; } header_len = lha_decode_uint32 ( & RAW_DATA ( header, 24 ) ) ; <START_BUG> if ( header_len > LEVEL_3_MAX_HEADER_LEN ) { <END_BUG> return 0 ; } if (! extend_raw_data ( header, stream, header_len - RAW_DATA_LEN ( header ) ) ) { return 0 ; } memcpy ( ( * header ) -> compress_method, & RAW_DATA ( header, 2 ), 5 ) ; ( * header ) -> compress_method [ 5 ] = '\\0' ; ( * header ) -> compressed_length = lha_decode_uint32 ( & RAW_DATA ( header, 7 ) ) ; ( * header ) -> length = lha_decode_uint32 ( & RAW_DATA ( header, 11 ) ) ; ( * header ) -> timestamp = lha_decode_uint32 ( & RAW_DATA ( header, 15 ) ) ; ( * header ) -> crc = lha_decode_uint16 ( & RAW_DATA ( header, 21 ) ) ; ( * header ) -> os_type = RAW_DATA ( header, 23 ) ; if (! decode_extended_headers ( header, 28 ) ) { return 0 ; } return 1 ; }

Fix:
<S2SV_ModStart> header_len > LEVEL_3_MAX_HEADER_LEN || header_len < RAW_DATA_LEN ( header )
Buggy code:
 static int rt_fill_info ( struct net * net, __be32 dst, __be32 src, struct flowi4 * fl4, struct sk_buff * skb, u32 portid, u32 seq, int event, int nowait, unsigned int flags ) { struct rtable * rt = skb_rtable ( skb ) ; struct rtmsg * r ; struct nlmsghdr * nlh ; unsigned long expires = 0 ; u32 error ; u32 metrics [ RTAX_MAX ] ; nlh = nlmsg_put ( skb, portid, seq, event, sizeof ( * r ), flags ) ; if ( nlh == NULL ) return - EMSGSIZE ; r = nlmsg_data ( nlh ) ; r -> rtm_family = AF_INET ; r -> rtm_dst_len = 32 ; r -> rtm_src_len = 0 ; r -> rtm_tos = fl4 -> flowi4_tos ; r -> rtm_table = RT_TABLE_MAIN ; if ( nla_put_u32 ( skb, RTA_TABLE, RT_TABLE_MAIN ) ) goto nla_put_failure ; r -> rtm_type = rt -> rt_type ; r -> rtm_scope = RT_SCOPE_UNIVERSE ; r -> rtm_protocol = RTPROT_UNSPEC ; r -> rtm_flags = ( rt -> rt_flags & ~ 0xFFFF ) | RTM_F_CLONED ; if ( rt -> rt_flags & RTCF_NOTIFY ) <START_BUG> r -> rtm_flags |= RTM_F_NOTIFY ; <END_BUG> if ( nla_put_be32 ( skb, RTA_DST, dst ) ) goto nla_put_failure ; if ( src ) { r -> rtm_src_len = 32 ; if ( nla_put_be32 ( skb, RTA_SRC, src ) ) goto nla_put_failure ; } if ( rt -> dst. dev && nla_put_u32 ( skb, RTA_OIF, rt -> dst. dev -> ifindex ) ) goto nla_put_failure ; # ifdef CONFIG_IP_ROUTE_CLASSID if ( rt -> dst. tclassid && nla_put_u32 ( skb

Fix:
<S2SV_ModStart> rtm_flags |= RTM_F_NOTIFY ; if ( IPCB ( skb ) -> flags & IPSKB_DOREDIRECT ) r -> rtm_flags |= RTCF_DOREDIRECT
Buggy code:
 static void vmx_complete_atomic_exit ( struct vcpu_vmx * vmx ) { u32 exit_intr_info ; if (! ( vmx -> exit_reason == EXIT_REASON_MCE_DURING_VMENTRY || vmx -> exit_reason == EXIT_REASON_EXCEPTION_NMI ) ) return ; vmx -> exit_intr_info = vmcs_read32 ( VM_EXIT_INTR_INFO ) ; exit_intr_info = vmx -> exit_intr_info ; if ( is_machine_check ( exit_intr_info ) ) kvm_machine_check ( ) ; <START_BUG> if ( ( exit_intr_info & INTR_INFO_INTR_TYPE_MASK ) == INTR_TYPE_NMI_INTR && <END_BUG> ( exit_intr_info & INTR_INFO_VALID_MASK ) ) { kvm_before_handle_nmi ( & vmx -> vcpu ) ; asm ( "int   $2" ) ; kvm_after_handle_nmi ( & vmx -> vcpu ) ; } }

Fix:
<S2SV_ModStart> ; if ( is_nmi ( exit_intr_info <S2SV_ModEnd> ) ) {
Buggy code:
 static int handle_exception ( struct kvm_vcpu * vcpu ) { struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; struct kvm_run * kvm_run = vcpu -> run ; u32 intr_info, ex_no, error_code ; unsigned long cr2, rip, dr6 ; u32 vect_info ; enum emulation_result er ; vect_info = vmx -> idt_vectoring_info ; intr_info = vmx -> exit_intr_info ; if ( is_machine_check ( intr_info ) ) return handle_machine_check ( vcpu ) ; <START_BUG> if ( ( intr_info & INTR_INFO_INTR_TYPE_MASK ) == INTR_TYPE_NMI_INTR ) <END_BUG> return 1 ; if ( is_no_device ( intr_info ) ) { vmx_fpu_activate ( vcpu ) ; return 1 ; } if ( is_invalid_opcode ( intr_info ) ) { if ( is_guest_mode ( vcpu ) ) { kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 1 ; } er = emulate_instruction ( vcpu, EMULTYPE_TRAP_UD ) ; if ( er!= EMULATE_DONE ) kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 1 ; } error_code = 0 ; if ( intr_info & INTR_INFO_DELIVER_CODE_MASK ) error_code = vmcs_read32 ( VM_EXIT_INTR_ERROR_CODE ) ; if ( ( vect_info & VECTORING_INFO_VALID_MASK ) &&! ( is_page_fault ( intr_info ) &&! ( error_code & PFERR_RSVD_MASK ) ) ) { vcpu -> run -> exit_reason = KVM_EXIT_INTERNAL_ERROR ; vcpu -> run -> internal. suberror = KVM_INTERNAL_ERROR_SIMUL_EX ; vcpu -> run -> internal. ndata = 3 ; vcpu -> run -> internal. data [ 0 ] = vect_info ; vcpu -> run -> internal. data [ 1 ] = intr_info ; vcpu -> run -> internal. data [ 2 ] = error_code

Fix:
<S2SV_ModStart> ; if ( is_nmi ( intr_info ) <S2SV_ModEnd> ) return 1
Buggy code:
 int zfs_fastaccesschk_execute ( znode_t * zdp, cred_t * cr ) { <START_BUG> boolean_t owner = B_FALSE ; <END_BUG> boolean_t groupmbr = B_FALSE ; boolean_t is_attr ; uid_t uid = crgetuid ( cr ) ; if ( zdp -> z_pflags & ZFS_AV_QUARANTINED ) return ( 1 ) ; is_attr = ( ( zdp -> z_pflags & ZFS_XATTR ) && ( ZTOV ( zdp ) -> v_type == VDIR ) ) ; if ( is_attr ) return ( 1 ) ; if ( zdp -> z_pflags & ZFS_NO_EXECS_DENIED ) return ( 0 ) ;  mutex_enter ( & zdp -> z_acl_lock ) ; <START_BUG> if ( FUID_INDEX ( zdp -> z_uid )!= 0 || FUID_INDEX ( zdp -> z_gid )!= 0 ) { goto out_slow ; } if ( uid == zdp -> z_uid ) { owner = B_TRUE ; if ( zdp -> z_mode & S_IXUSR ) { goto out ; } else { goto out_slow ; } } if ( groupmember ( zdp -> z_gid, cr ) ) { groupmbr = B_TRUE ; if ( zdp -> z_mode & S_IXGRP ) { goto out ; } else { goto out_slow ; } } if (! owner &&! groupmbr ) { if ( zdp -> z_mode & S_IXOTH ) { goto out ; } } out : mutex_exit ( & zdp -> z_acl_lock ) ; return ( 0 ) ; out_slow : mutex_exit ( & zdp -> z_acl_lock ) ; return ( 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { boolean_t is_attr <S2SV_ModEnd> ; if ( <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> return ( 1
Buggy code:
 static BOOL gdi_Bitmap_Decompress ( rdpContext * context, rdpBitmap * bitmap, const BYTE * pSrcData, UINT32 DstWidth, UINT32 DstHeight, UINT32 bpp, UINT32 length, BOOL compressed, UINT32 codecId ) { UINT32 SrcSize = length ; rdpGdi * gdi = context -> gdi ; <START_BUG> bitmap -> compressed = FALSE ; <END_BUG> bitmap -> format = gdi -> dstFormat ;  bitmap -> length = DstWidth * DstHeight * GetBytesPerPixel ( bitmap -> format ) ; <START_BUG> bitmap -> data = ( BYTE * ) _aligned_malloc ( bitmap -> length, 16 ) ; if (! bitmap -> data ) return FALSE ; if ( compressed ) { if ( bpp < 32 ) { if (! interleaved_decompress ( context -> codecs -> interleaved, pSrcData, SrcSize, DstWidth, DstHeight, bpp, bitmap -> data, bitmap -> format, 0, 0, 0, DstWidth, DstHeight, & gdi -> palette ) ) return FALSE ; } else { if (! planar_decompress ( context -> codecs -> planar, pSrcData, SrcSize, DstWidth, DstHeight, bitmap -> data, bitmap -> format, 0, 0, 0, DstWidth, DstHeight, TRUE ) ) return FALSE ; } } else { const UINT32 SrcFormat = gdi_get_pixel_format ( bpp ) ; const size_t sbpp = GetBytesPerPixel ( SrcFormat ) ; const size_t dbpp = GetBytesPerPixel ( bitmap -> format ) ; if ( ( sbpp == 0 ) || ( dbpp == 0 ) ) return FALSE ; else { const size_t dstSize = SrcSize * dbpp // sbpp ; if ( dstSize < bitmap -> length ) return FALSE ; } if (! freerdp_image_copy ( bitmap -> data, bitmap -> format, 0, 0, 0, DstWidth, DstHeight, pSrcData, SrcFormat, 0, 0, 0, & gdi -> palette, FREERDP_FLIP_VERTICAL ) ) return FALSE ; } return TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> -> gdi ; UINT32 size = DstWidth * DstHeight ; <S2SV_ModStart> -> dstFormat ; if ( ( GetBytesPerPixel ( bitmap -> format ) == 0 ) || ( DstWidth == 0 ) || ( DstHeight == 0 ) || ( DstWidth > UINT32_MAX // DstHeight ) || ( size > ( UINT32_MAX // GetBytesPerPixel ( bitmap -> format ) ) ) ) return FALSE ; size *= GetBytesPerPixel ( bitmap -> format ) ; <S2SV_ModStart> -> length = size <S2SV_ModEnd> ; bitmap ->
Buggy code:
 static int powermate_probe ( struct usb_interface * intf, const struct usb_device_id * id ) { struct usb_device * udev = interface_to_usbdev ( intf ) ; struct usb_host_interface * interface ; struct usb_endpoint_descriptor * endpoint ; struct powermate_device * pm ; struct input_dev * input_dev ; int pipe, maxp ; int error = - ENOMEM ; <START_BUG> interface = intf -> cur_altsetting ; <END_BUG> endpoint = & interface -> endpoint [ 0 ]. desc ; if (! usb_endpoint_is_int_in ( endpoint ) ) return - EIO ; usb_control_msg ( udev, usb_sndctrlpipe ( udev, 0 ), 0x0a, USB_TYPE_CLASS | USB_RECIP_INTERFACE, 0, interface -> desc. bInterfaceNumber, NULL, 0, USB_CTRL_SET_TIMEOUT ) ; pm = kzalloc ( sizeof ( struct powermate_device ), GFP_KERNEL ) ; input_dev = input_allocate_device ( ) ; if (! pm ||! input_dev ) goto fail1 ; if ( powermate_alloc_buffers ( udev, pm ) ) goto fail2 ; pm -> irq = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! pm -> irq ) goto fail2 ; pm -> config = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! pm -> config ) goto fail3 ; pm -> udev = udev ; pm -> intf = intf ; pm -> input = input_dev ; usb_make_path ( udev, pm -> phys, sizeof ( pm -> phys ) ) ; strlcat ( pm -> phys, "//input0", sizeof ( pm -> phys ) ) ; spin_lock_init ( & pm -> lock ) ; switch ( le16_to_cpu ( udev -> descriptor. idProduct ) ) { case POWERMATE_PRODUCT_NEW : input_dev -> name = pm_name_powermate ; break ; case POWERMATE_PRODUCT_OLD : input_dev -> name = pm_name_soundknob ; break ; default : input_dev -> name = pm_name_soundknob ; printk

Fix:
<S2SV_ModStart> intf -> cur_altsetting ; if ( interface -> desc. bNumEndpoints < 1 ) return - EINVAL
Buggy code:
 static int recv_msg ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t buf_len, int flags ) { struct sock * sk = sock -> sk ; struct tipc_port * tport = tipc_sk_port ( sk ) ; struct sk_buff * buf ; struct tipc_msg * msg ; long timeout ; unsigned int sz ; u32 err ; int res ; if ( unlikely (! buf_len ) ) return - EINVAL ; lock_sock ( sk ) ; if ( unlikely ( sock -> state == SS_UNCONNECTED ) ) { res = - ENOTCONN ; goto exit ; } <START_BUG> timeout = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; <END_BUG> restart : while ( skb_queue_empty ( & sk -> sk_receive_queue ) ) { if ( sock -> state == SS_DISCONNECTING ) { res = - ENOTCONN ; goto exit ; } if ( timeout <= 0L ) { res = timeout? timeout : - EWOULDBLOCK ; goto exit ; } release_sock ( sk ) ; timeout = wait_event_interruptible_timeout ( * sk_sleep ( sk ), tipc_rx_ready ( sock ), timeout ) ; lock_sock ( sk ) ; } buf = skb_peek ( & sk -> sk_receive_queue ) ; msg = buf_msg ( buf ) ; sz = msg_data_sz ( msg ) ; err = msg_errcode ( msg ) ; if ( (! sz ) && (! err ) ) { advance_rx_queue ( sk ) ; goto restart ; } set_orig_addr ( m, msg ) ; res = anc_data_recv ( m, msg, tport ) ; if ( res ) goto exit ; if (! err ) { if ( unlikely ( buf_len < sz ) ) { sz = buf_len ; m -> msg_flags |= MSG_TRUNC ; } res = skb_copy_datagram_iovec ( buf, msg_hdr_sz ( msg ), m -> msg_iov, sz ) ; if ( res ) goto exit ; res = sz ; } else { if ( ( sock -> state == SS_READY ) || ( ( err == TIPC_CONN_SHUTDOWN ) || m -> msg

Fix:
<S2SV_ModStart> exit ; } m -> msg_namelen = 0 ;
Buggy code:
 static void copy_xauthority ( void ) { char * src = RUN_XAUTHORITY_FILE ; char * dest ; if ( asprintf ( & dest, "%s//.Xauthority", cfg. homedir ) == - 1 ) errExit ( "asprintf" ) ; if ( is_link ( dest ) ) { fprintf ( stderr, "Error:   %s   is   a   symbolic   link\\n", dest ) ; exit ( 1 ) ; } <START_BUG> pid_t child = fork ( ) ; <END_BUG> if ( child < 0 ) errExit ( "fork" ) ; if ( child == 0 ) { drop_privs ( 0 ) ;  int rv = copy_file ( src, dest ) ; <START_BUG> if ( rv ) fprintf ( stderr, "Warning:   cannot   transfer  .Xauthority   in   private   home   directory\\n" ) ; else { fs_logger2 ( "clone", dest ) ; } _exit ( 0 ) ; } waitpid ( child, NULL, 0 ) ; <END_BUG> if ( chown ( dest, getuid ( ), getgid ( ) ) < 0 )  errExit ( "chown" ) ; <START_BUG> if ( chmod ( dest, S_IRUSR | S_IWUSR ) < 0 ) <END_BUG> errExit ( "chmod" ) ; unlink ( src ) ; }

Fix:
<S2SV_ModStart> ) ; } copy_file_as_user <S2SV_ModEnd> ( src, <S2SV_ModStart> ( src, <S2SV_ModEnd> dest, getuid <S2SV_ModStart> getgid ( ) <S2SV_ModEnd>, S_IRUSR | <S2SV_ModStart> | S_IWUSR ) ; fs_logger2 ( "clone", dest <S2SV_ModEnd> ) ; unlink
Buggy code:
 <START_BUG> static char * print_number ( cJSON * item ) <END_BUG> { char * str ; double f, f2 ; int64_t i ; str = ( char * ) cJSON_malloc ( 64 ) ; if ( str ) {  f = item -> valuefloat ; <START_BUG> i = f ; f2 = i ; <END_BUG> if ( f2 == f && item -> valueint >= LLONG_MIN && item -> valueint <= LLONG_MAX )  sprintf ( str, "%lld", ( long long ) item -> valueint ) ; else sprintf ( str, "%g", item -> valuefloat ) ; } return str ; }

Fix:
<S2SV_ModStart> cJSON * item, printbuffer * p ) { char * str = 0 ; double d <S2SV_ModEnd> = item -> <S2SV_ModStart> = item -> valuedouble ; if ( d == 0 ) { if ( p ) str = ensure ( p, 2 ) ; else str = ( char * ) cJSON_malloc ( 2 ) ; if ( str ) strcpy ( str, "0" ) ; } else if ( fabs ( ( ( double ) <S2SV_ModEnd> item -> valueint <S2SV_ModStart> item -> valueint ) - d ) <= DBL_EPSILON && d <= LLONG_MAX && d >= LLONG_MIN ) { if ( p ) str = ensure ( p, 64 ) ; else str = ( char * ) cJSON_malloc ( 64 ) ; if ( str ) sprintf ( str, "%lld", ( long long ) <S2SV_ModEnd> item -> valueint <S2SV_ModStart> item -> valueint ) ; } else { if ( p ) str = ensure ( p, 64 ) ; else str = ( char * ) cJSON_malloc ( 64 ) ; if ( str ) { if ( fpclassify ( d )!= FP_ZERO &&! isnormal ( d ) ) sprintf ( str, "null" ) ; else
Buggy code:
 void vp8_bilinear_predict8x4_neon ( unsigned char * src_ptr, int src_pixels_per_line, int xoffset, int yoffset, unsigned char * dst_ptr, int dst_pitch ) { uint8x8_t d0u8, d1u8, d2u8, d3u8, d4u8, d5u8 ; uint8x8_t d7u8, d9u8, d11u8, d22u8, d23u8, d24u8, d25u8, d26u8 ; uint8x16_t q1u8, q2u8, q3u8, q4u8, q5u8 ; uint16x8_t q1u16, q2u16, q3u16, q4u16 ; uint16x8_t q6u16, q7u16, q8u16, q9u16, q10u16 ; if ( xoffset == 0 ) { d22u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d23u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d24u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d25u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d26u8 = vld1_u8 ( src_ptr ) ; } else { q1u8 = vld1q_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; q2u8 = vld1q_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; q3u8 = vld1q_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; q4u8 = vld1q_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; q5u8 = vld1q_u8 ( src_ptr ) ; <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> = vdup_n_u8 ( <S2SV_ModEnd> bifilter4_coeff [ xoffset <S2SV_ModStart> = vdup_n_u8 ( <S2SV_ModEnd> bifilter4_coeff [ xoffset
Buggy code:
 void SetLineWidth ( double w ) { <START_BUG> outpos += <END_BUG> sprintf ( outpos, "   %12.3f   w", w ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> w ) { sprintf ( outputbuffer <S2SV_ModEnd>, " <S2SV_blank> %12.3f <S2SV_blank> w", <S2SV_ModStart> w ) ; sendClean ( outputbuffer ) ;
Buggy code:
 static int lldp_mgmt_addr_tlv_print ( netdissect_options * ndo, const u_char * pptr, u_int len ) { uint8_t mgmt_addr_len, intf_num_subtype, oid_len ; const u_char * tptr ; u_int tlen ; char * mgmt_addr ; tlen = len ; tptr = pptr ; if ( tlen < 1 ) { return 0 ; } mgmt_addr_len = * tptr ++ ; tlen -- ; if ( tlen < mgmt_addr_len ) { return 0 ; } mgmt_addr = lldp_network_addr_print ( ndo, tptr, mgmt_addr_len ) ; if ( mgmt_addr == NULL ) { return 0 ; } ND_PRINT ( ( ndo, "\\n\\t     Management   Address   length   %u,   %s", mgmt_addr_len, mgmt_addr ) ) ; tptr += mgmt_addr_len ; tlen -= mgmt_addr_len ; if ( tlen < LLDP_INTF_NUM_LEN ) { return 0 ; } intf_num_subtype = * tptr ; ND_PRINT ( ( ndo, "\\n\\t     %s   Interface   Numbering   (%u):   %u", tok2str ( lldp_intf_numb_subtype_values, "Unknown", intf_num_subtype ), intf_num_subtype, EXTRACT_32BITS ( tptr + 1 ) ) ) ; tptr += LLDP_INTF_NUM_LEN ; tlen -= LLDP_INTF_NUM_LEN ; if ( tlen ) { oid_len = * tptr ; <START_BUG> if ( tlen < oid_len ) { <END_BUG> return 0 ; } if ( oid_len ) { ND_PRINT ( ( ndo, "\\n\\t     OID   length   %u", oid_len ) ) ; safeputs ( ndo, tptr + 1, oid_len ) ; } } return 1 ; }

Fix:
<S2SV_ModStart> ( tlen < 1U +
Buggy code:
 static void swap_block_ptr ( MACROBLOCK * x, PICK_MODE_CONTEXT * ctx, <START_BUG> int max_plane ) { <END_BUG>  struct macroblock_plane * const p = x -> plane ; <START_BUG> <END_BUG> struct macroblockd_plane * const pd = x -> e_mbd. plane ;  int i ; for ( i = 0 ; i < max_plane ; ++ i ) { <START_BUG> p [ i ]. coeff = ctx -> coeff_pbuf [ i ] [ 1 ] ; <END_BUG>  p [ i ]. qcoeff = ctx -> qcoeff_pbuf [ i ] [ 1 ] ; <START_BUG> <END_BUG> pd [ i ]. dqcoeff = ctx -> dqcoeff_pbuf [ i ] [ 1 ] ;  <START_BUG> p [ i ]. eobs = ctx -> eobs_pbuf [ i ] [ 1 ] ; <END_BUG> ctx -> coeff_pbuf [ i ] [ 1 ] = ctx -> coeff_pbuf [ i ] [ 0 ] ; ctx -> qcoeff_pbuf [ i ] [ 1 ] = ctx -> qcoeff_pbuf [ i ] [ 0 ] ; ctx -> dqcoeff_pbuf [ i ] [ 1 ] = ctx -> dqcoeff_pbuf [ i ] [ 0 ] ; ctx -> eobs_pbuf [ i ] [ 1 ] = ctx -> eobs_pbuf [ i ] [ 0 ] ; ctx -> coeff_pbuf [ i ] [ 0 ] = p [ i ]. coeff ;  ctx -> qcoeff_pbuf [ i ] [ 0 ] = p [ i ]. qcoeff ; <START_BUG> <END_BUG> ctx -> dqcoeff_pbuf [ i ] [ 0 ] = pd [ i ]. dqcoeff ;  <START_BUG> ctx -> eobs_pbuf [ i ] [ 0 ] = p [ i ]. eobs ; <END_BUG> } }

Fix:
<S2SV_ModStart> ctx, int m, int n, int min_plane, int <S2SV_ModStart> max_plane ) { int i ; for ( i = min_plane ; i < max_plane ; ++ i ) { <S2SV_ModStart> const p = & <S2SV_ModStart> x -> plane [ i ] <S2SV_ModStart> const pd = & <S2SV_ModStart> e_mbd. plane [ i ] ; p -> <S2SV_ModEnd> coeff = ctx <S2SV_ModStart> i ] [ m ] ; p -> <S2SV_ModEnd> qcoeff = ctx <S2SV_ModStart> i ] [ m <S2SV_ModEnd> ] ; pd <S2SV_ModStart> ] ; pd -> <S2SV_ModEnd> dqcoeff = ctx <S2SV_ModStart> i ] [ m ] ; p -> <S2SV_ModEnd> eobs = ctx <S2SV_ModStart> i ] [ m ] ; ctx -> coeff_pbuf [ i ] [ m ] = ctx -> coeff_pbuf [ i ] [ n ] ; ctx -> qcoeff_pbuf [ i ] [ m ] = ctx -> qcoeff_pbuf [ i ] [ n ] ; ctx -> dqcoeff_pbuf [ i ] [ m ] = ctx -> dqcoeff_pbuf [ i ] [ n ] ; ctx -> eobs_pbuf [ i ] [ m ] = ctx -> eobs_pbuf [ i ] [ n ] ; ctx -> coeff_pbuf [ i ] [ n ] =
Buggy code:
 static void add_header_value ( VALUE hh, const char * key, int klen, const char * val, int vlen ) { <START_BUG> if ( sizeof ( content_type ) - 1 == klen && 0 == strncasecmp ( key, content_type, sizeof ( content_type ) - 1 ) ) { <END_BUG>  rb_hash_aset ( hh, content_type_val, rb_str_new ( val, vlen ) ) ; <START_BUG> } else if ( sizeof ( content_length ) - 1 == klen && 0 == strncasecmp ( key, content_length, sizeof ( content_length ) - 1 ) ) { <END_BUG> rb_hash_aset ( hh, content_length_val, rb_str_new ( val, vlen ) ) ;  } else { char hkey [ 1024 ] ; char * k = hkey ; volatile VALUE sval = rb_str_new ( val, vlen ) ; <START_BUG> strcpy ( hkey, "HTTP_" ) ; <END_BUG> k = hkey + 5 ; if ( ( int ) ( sizeof ( hkey ) - 5 ) <= klen ) { klen = sizeof ( hkey ) - 6 ; } strncpy ( k, key, klen ) ; hkey [ klen + 5 ] = '\\0' ; for ( k = hkey + 5 ; '\\0'!= * k ; k ++ ) { if ( '-' == * k ) { * k = '_' ; } else { * k = toupper ( * k ) ; } }  rb_hash_aset ( hh, rb_str_new ( hkey, klen + 5 ), sval ) ; <START_BUG> <END_BUG> }  }

Fix:
<S2SV_ModStart> vlen ) { VALUE v ; <S2SV_ModStart> ) ) { if ( Qnil == ( v = rb_hash_lookup2 ( hh, content_type_val, Qnil ) ) ) { <S2SV_ModStart> ) ) ; } else { volatile VALUE a = rb_ary_new ( ) ; rb_ary_push ( a, v ) ; rb_ary_push ( a, rb_str_new ( val, vlen ) ) ; rb_hash_aset ( hh, content_type_val, a ) ; } <S2SV_ModStart> ) ) { if ( Qnil == ( v = rb_hash_lookup2 ( hh, content_length_val, Qnil ) ) ) { <S2SV_ModStart> ) ) ; } else { rb_raise ( rb_eArgError, "Multiple <S2SV_blank> Content-Length <S2SV_blank> headers." ) ; } <S2SV_ModStart> vlen ) ; volatile VALUE kval ; <S2SV_ModStart> ; } } kval = <S2SV_ModEnd> rb_str_new ( hkey <S2SV_ModStart> + 5 ) ; if ( Qnil == ( v = rb_hash_lookup2 ( hh, kval, Qnil ) ) ) { rb_hash_aset ( hh, kval <S2SV_ModStart> ) ; } else { volatile VALUE a = rb_ary_new