nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void tcp_illinois_info ( struct sock * sk, u32 ext, struct sk_buff * skb ) { const struct illinois * ca = inet_csk_ca ( sk ) ; if ( ext & ( 1 << ( INET_DIAG_VEGASINFO - 1 ) ) ) { struct tcpvegas_info info = {. tcpv_enabled = 1,. tcpv_rttcnt = ca -> cnt_rtt,. tcpv_minrtt = ca -> base_rtt, } ; <START_BUG> u64 t = ca -> sum_rtt ; <END_BUG>  do_div ( t, ca -> cnt_rtt ) ; <START_BUG> <END_BUG> info. tcpv_rtt = t ;  nla_put ( skb, INET_DIAG_VEGASINFO, sizeof ( info ), & info ) ; } }

Fix:
<S2SV_ModStart>, } ; if ( info. tcpv_rttcnt > 0 ) { <S2SV_ModStart> ( t, info. tcpv_rttcnt <S2SV_ModEnd> ) ; info <S2SV_ModStart> = t ; }
Buggy code:
 static int tomoyo_mount_acl ( struct tomoyo_request_info * r, char * dev_name, struct path * dir, char * type, unsigned long flags ) { struct path path ; struct file_system_type * fstype = NULL ; const char * requested_type = NULL ; const char * requested_dir_name = NULL ; const char * requested_dev_name = NULL ; struct tomoyo_path_info rtype ; struct tomoyo_path_info rdev ; struct tomoyo_path_info rdir ; int need_dev = 0 ; int error = - ENOMEM ; requested_type = tomoyo_encode ( type ) ; if (! requested_type ) goto out ; rtype. name = requested_type ; tomoyo_fill_path_info ( & rtype ) ; requested_dir_name = tomoyo_realpath_from_path ( dir ) ; if (! requested_dir_name ) { error = - ENOMEM ; goto out ; } rdir. name = requested_dir_name ; tomoyo_fill_path_info ( & rdir ) ; if (! strcmp ( type, TOMOYO_MOUNT_REMOUNT_KEYWORD ) ) { } else if (! strcmp ( type, TOMOYO_MOUNT_MAKE_UNBINDABLE_KEYWORD ) ||! strcmp ( type, TOMOYO_MOUNT_MAKE_PRIVATE_KEYWORD ) ||! strcmp ( type, TOMOYO_MOUNT_MAKE_SLAVE_KEYWORD ) ||! strcmp ( type, TOMOYO_MOUNT_MAKE_SHARED_KEYWORD ) ) { } else if (! strcmp ( type, TOMOYO_MOUNT_BIND_KEYWORD ) ||! strcmp ( type, TOMOYO_MOUNT_MOVE_KEYWORD ) ) { need_dev = - 1 ; } else { fstype = get_fs_type ( type ) ; if (! fstype ) { error = - ENODEV ; goto out ; } if ( fstype -> fs_flags & FS_REQUIRES_DEV ) need_dev = 1 ; } if ( need_dev ) { <START_BUG> if ( kern_path ( dev_name, LOOKUP_FOLLOW, &<END_BUG>

Fix:
<S2SV_ModStart> { if (! dev_name ||
Buggy code:
 <START_BUG> int16_t vp9_dc_quant ( int qindex, int delta ) { <END_BUG> return dc_qlookup [ clamp ( qindex + delta, 0, MAXQ ) ] ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, int delta, vpx_bit_depth_t bit_depth ) { # if CONFIG_VP9_HIGHBITDEPTH switch ( bit_depth ) { case VPX_BITS_8 : <S2SV_ModEnd> return dc_qlookup [ <S2SV_ModStart> ) ] ; case VPX_BITS_10 : return dc_qlookup_10 [ clamp ( qindex + delta, 0, MAXQ ) ] ; case VPX_BITS_12 : return dc_qlookup_12 [ clamp ( qindex + delta, 0, MAXQ ) ] ; default : assert ( 0 && "bit_depth <S2SV_blank> should <S2SV_blank> be <S2SV_blank> VPX_BITS_8, <S2SV_blank> VPX_BITS_10 <S2SV_blank> or <S2SV_blank> VPX_BITS_12" ) ; return - 1 ; } # else ( void ) bit_depth ; return dc_qlookup [ clamp ( qindex + delta, 0, MAXQ ) ] ; # endif
Buggy code:
 static int vsock_stream_recvmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk ; struct vsock_sock * vsk ; int err ; size_t target ; ssize_t copied ; long timeout ; struct vsock_transport_recv_notify_data recv_data ; DEFINE_WAIT ( wait ) ; sk = sock -> sk ; vsk = vsock_sk ( sk ) ; err = 0 ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> lock_sock ( sk ) ; if ( sk -> sk_state!= SS_CONNECTED ) { if ( sock_flag ( sk, SOCK_DONE ) ) err = 0 ; else err = - ENOTCONN ; goto out ; } if ( flags & MSG_OOB ) { err = - EOPNOTSUPP ; goto out ; } if ( sk -> sk_shutdown & RCV_SHUTDOWN ) { err = 0 ; goto out ; } if (! len ) { err = 0 ; goto out ; } target = sock_rcvlowat ( sk, flags & MSG_WAITALL, len ) ; if ( target >= transport -> stream_rcvhiwat ( vsk ) ) { err = - ENOMEM ; goto out ; } timeout = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; copied = 0 ; err = transport -> notify_recv_init ( vsk, target, & recv_data ) ; if ( err < 0 ) goto out ; prepare_to_wait ( sk_sleep ( sk ), & wait, TASK_INTERRUPTIBLE ) ; while ( 1 ) { s64 ready = vsock_stream_has_data ( vsk ) ; if ( ready < 0 ) { err = - ENOMEM ; goto out_wait ; } else if ( ready > 0 ) { ssize_t read ; err = transport -> notify_recv_pre_dequeue ( vsk, target, & recv_data ) ; if ( err < 0 ) break ; read = transport -> stream_dequeue ( vsk, msg -> msg_iov, len - copied, flags ) ; if ( read < 0 ) { err = - ENOMEM ; break ; } copied += read ; err = transport -> notify_recv_post

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> lock_sock ( sk
Buggy code:
 static vpx_image_t * decoder_get_frame ( vpx_codec_alg_priv_t * ctx, vpx_codec_iter_t * iter ) { vpx_image_t * img = NULL ; <START_BUG> if ( ctx -> img_avail ) { <END_BUG>  if (! ( * iter ) ) { <START_BUG> img = & ctx -> img ; * iter = img ; } } ctx -> img_avail = 0 ; return img ; }<END_BUG>

Fix:
<S2SV_ModStart> ( ctx -> frame_parallel_decode && ctx -> available_threads > 0 &&! ctx -> flushed ) { return NULL ; } if ( ctx -> num_cache_frames > 0 ) { release_last_output_frame ( ctx ) ; ctx -> last_show_frame = ctx -> frame_cache [ ctx -> frame_cache_read ]. fb_idx ; if ( ctx -> need_resync ) return NULL ; img = & ctx -> frame_cache [ ctx -> frame_cache_read ]. img ; ctx -> frame_cache_read = ( ctx -> frame_cache_read + 1 ) % FRAME_CACHE_SIZE ; -- ctx -> num_cache_frames ; return img ; } if <S2SV_ModEnd> ( * iter <S2SV_ModStart> ( * iter == NULL && ctx -> frame_workers!= NULL ) { do { YV12_BUFFER_CONFIG sd ; vp9_ppflags_t flags = { 0, 0, 0 } ; const VPxWorkerInterface * const winterface = vpx_get_worker_interface ( ) ; VPxWorker * const worker = & ctx -> frame_workers [ ctx -> next_output_worker_id ] ; FrameWorkerData * const frame_worker_
Buggy code:
 static void update_image_md5 ( const vpx_image_t * img, const int planes [ 3 ], MD5Context * md5 ) { int i, y ; for ( i = 0 ; i < 3 ; ++ i ) { const int plane = planes [ i ] ; const unsigned char * buf = img -> planes [ plane ] ; const int stride = img -> stride [ plane ] ; <START_BUG> const int w = vpx_img_plane_width ( img, plane ) ; <END_BUG> const int h = vpx_img_plane_height ( img, plane ) ; for ( y = 0 ; y < h ; ++ y ) { MD5Update ( md5, buf, w ) ; buf += stride ; } } }

Fix:
<S2SV_ModStart>, plane ) * ( ( img -> fmt & VPX_IMG_FMT_HIGHBITDEPTH )? 2 : 1 )
Buggy code:
 static void <START_BUG> l2tp_framing_cap_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint32_t * ptr = ( const uint32_t * ) dat ; <START_BUG> if ( EXTRACT_32BITS ( ptr ) & L2TP_FRAMING_CAP_ASYNC_MASK ) { ND_PRINT ( ( ndo, "A" ) ) ; } if ( EXTRACT_32BITS ( ptr ) & L2TP_FRAMING_CAP_SYNC_MASK ) { ND_PRINT ( ( ndo, "S" ) ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 void vp9_tile_init ( TileInfo * tile, const VP9_COMMON * cm, int row, int col ) { <START_BUG> tile -> mi_row_start = get_tile_offset ( row, cm -> mi_rows, cm -> log2_tile_rows ) ; <END_BUG> tile -> mi_row_end = get_tile_offset ( row + 1, cm -> mi_rows, cm -> log2_tile_rows ) ; tile -> mi_col_start = get_tile_offset ( col, cm -> mi_cols, cm -> log2_tile_cols ) ; tile -> mi_col_end = get_tile_offset ( col + 1, cm -> mi_cols, cm -> log2_tile_cols ) ; }

Fix:
<S2SV_ModStart> col ) { vp9_tile_set_row ( tile, cm, row ) ; vp9_tile_set_col ( tile, cm, col <S2SV_ModEnd> ) ; }
Buggy code:
 static int encrypted_update ( struct key * key, struct key_preparsed_payload * prep ) { struct encrypted_key_payload * epayload = key -> payload. data [ 0 ] ; struct encrypted_key_payload * new_epayload ; char * buf ; char * new_master_desc = NULL ; const char * format = NULL ; size_t datalen = prep -> datalen ; <START_BUG> int ret = 0 ; <END_BUG> if ( datalen <= 0 || datalen > 32767 ||! prep -> data ) return - EINVAL ; buf = kmalloc ( datalen + 1, GFP_KERNEL ) ; if (! buf ) return - ENOMEM ; buf [ datalen ] = 0 ; memcpy ( buf, prep -> data, datalen ) ; ret = datablob_parse ( buf, & format, & new_master_desc, NULL, NULL ) ; if ( ret < 0 ) goto out ; ret = valid_master_desc ( new_master_desc, epayload -> master_desc ) ; if ( ret < 0 ) goto out ; new_epayload = encrypted_key_alloc ( key, epayload -> format, new_master_desc, epayload -> datalen ) ; if ( IS_ERR ( new_epayload ) ) { ret = PTR_ERR ( new_epayload ) ; goto out ; } __ekey_init ( new_epayload, epayload -> format, new_master_desc, epayload -> datalen ) ; memcpy ( new_epayload -> iv, epayload -> iv, ivsize ) ; memcpy ( new_epayload -> payload_data, epayload -> payload_data, epayload -> payload_datalen ) ; rcu_assign_keypointer ( key, new_epayload ) ; call_rcu ( & epayload -> rcu, encrypted_rcu_free ) ; out : kfree ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> ret = 0 ; if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) return - ENOKEY
Buggy code:
 int hugetlb_reserve_pages ( struct inode * inode, long from, long to, struct vm_area_struct * vma, vm_flags_t vm_flags ) { long ret, chg ; struct hstate * h = hstate_inode ( inode ) ; struct hugepage_subpool * spool = subpool_inode ( inode ) ; if ( vm_flags & VM_NORESERVE ) return 0 ; if (! vma || vma -> vm_flags & VM_MAYSHARE ) chg = region_chg ( & inode -> i_mapping -> private_list, from, to ) ; else { struct resv_map * resv_map = resv_map_alloc ( ) ; if (! resv_map ) return - ENOMEM ; chg = to - from ; set_vma_resv_map ( vma, resv_map ) ; set_vma_resv_flags ( vma, HPAGE_RESV_OWNER ) ; } if ( chg < 0 ) <START_BUG> return chg ; <END_BUG> if ( hugepage_subpool_get_pages ( spool, chg ) )  return - ENOSPC ; <START_BUG> <END_BUG> ret = hugetlb_acct_memory ( h, chg ) ;  if ( ret < 0 ) { hugepage_subpool_put_pages ( spool, chg ) ; <START_BUG> return ret ; <END_BUG> } if (! vma || vma -> vm_flags & VM_MAYSHARE ) region_add ( & inode -> i_mapping -> private_list, from, to ) ; return 0 ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> < 0 ) { ret = chg ; goto out_err ; } <S2SV_ModEnd> if ( hugepage_subpool_get_pages <S2SV_ModStart> chg ) ) { ret = <S2SV_ModEnd> - ENOSPC ; <S2SV_ModStart> - ENOSPC ; goto out_err ; } <S2SV_ModStart> chg ) ; goto out_err <S2SV_ModEnd> ; } if <S2SV_ModStart> return 0 ; out_err : resv_map_put ( vma ) ; return ret ;
Buggy code:
 static struct sock * tcp_v6_syn_recv_sock ( const struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst, struct request_sock * req_unhash, bool * own_req ) { struct inet_request_sock * ireq ; struct ipv6_pinfo * newnp ; <START_BUG> const struct ipv6_pinfo * np = inet6_sk ( sk ) ; <END_BUG> struct tcp6_sock * newtcp6sk ; struct inet_sock * newinet ; struct tcp_sock * newtp ; struct sock * newsk ; # ifdef CONFIG_TCP_MD5SIG struct tcp_md5sig_key * key ; # endif struct flowi6 fl6 ; if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = tcp_v4_syn_recv_sock ( sk, skb, req, dst, req_unhash, own_req ) ; if (! newsk ) return NULL ; newtcp6sk = ( struct tcp6_sock * ) newsk ; inet_sk ( newsk ) -> pinet6 = & newtcp6sk -> inet6 ; newinet = inet_sk ( newsk ) ; newnp = inet6_sk ( newsk ) ; newtp = tcp_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; newnp -> saddr = newsk -> sk_v6_rcv_saddr ; inet_csk ( newsk ) -> icsk_af_ops = & ipv6_mapped ; newsk -> sk_backlog_rcv = tcp_v4_do_rcv ; # ifdef CONFIG_TCP_MD5SIG newtp -> af_specific = & tcp_sock_ipv6_mapped_specific ; # endif newnp -> ipv6_ac_list = NULL ; newnp -> ipv6_fl_list = NULL ; newnp -> pktoptions = NULL ; newnp -> opt = NULL ; newnp -> mcast_oif = tcp_v6_iif ( skb ) ; newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; newnp -> rcv_flowinfo = ip6_flow

Fix:
<S2SV_ModStart> ( sk ) ; struct ipv6_txoptions * opt <S2SV_ModStart> ) ) ; opt = rcu_dereference <S2SV_ModEnd> ( np -> <S2SV_ModStart> -> opt ) ; if ( opt ) { <S2SV_ModEnd> opt = ipv6_dup_options <S2SV_ModStart> ( newsk, opt ) ; RCU_INIT_POINTER ( newnp -> opt, opt ) ; } <S2SV_ModEnd> inet_csk ( newsk <S2SV_ModStart> ; if ( <S2SV_ModEnd> opt ) inet_csk <S2SV_ModStart> -> icsk_ext_hdr_len = <S2SV_ModEnd> opt -> opt_nflen <S2SV_ModStart> -> opt_nflen + <S2SV_ModEnd> opt -> opt_flen <S2SV_ModStart> opt -> opt_flen <S2SV_ModEnd> ; tcp_ca_openreq_child (
Buggy code:
 static int xfrm6_tunnel_rcv ( struct sk_buff * skb ) { struct ipv6hdr * iph = ipv6_hdr ( skb ) ; __be32 spi ; spi = xfrm6_tunnel_spi_lookup ( ( xfrm_address_t * ) & iph -> saddr ) ; <START_BUG> return xfrm6_rcv_spi ( skb, spi ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, spi ) > 0? : 0
Buggy code:
 int upnp_redirect ( const char * rhost, unsigned short eport, const char * iaddr, unsigned short iport, const char * protocol, const char * desc, unsigned int leaseduration ) { int proto, r ; char iaddr_old [ 32 ] ; char rhost_old [ 32 ] ; unsigned short iport_old ; struct in_addr address ; unsigned int timestamp ; proto = proto_atoi ( protocol ) ; if ( inet_aton ( iaddr, & address ) <= 0 ) { syslog ( LOG_ERR, "inet_aton(%s)   FAILED", iaddr ) ; return - 1 ; } if (! check_upnp_rule_against_permissions ( upnppermlist, num_upnpperm, eport, address, iport ) ) { syslog ( LOG_INFO, "redirection   permission   check   failed   for   " "%hu->%s:%hu   %s", eport, iaddr, iport, protocol ) ; return - 3 ; } <START_BUG> rhost_old [ 0 ] = '\\0' ; <END_BUG> r = get_redirect_rule ( ext_if_name, eport, proto, iaddr_old, sizeof ( iaddr_old ), & iport_old, 0, 0, rhost_old, sizeof ( rhost_old ), & timestamp, 0, 0 ) ; if ( r == 0 ) { if ( strcmp ( iaddr, iaddr_old ) == 0 && ( ( rhost == NULL && rhost_old [ 0 ] == '\\0' ) || ( rhost && ( strcmp ( rhost, "*" ) == 0 ) && rhost_old [ 0 ] == '\\0' ) || ( rhost && ( strcmp ( rhost, rhost_old ) == 0 ) ) ) ) { syslog ( LOG_INFO, "updating   existing   port   mapping   %hu   %s   (rhost   \'%s\')   =>   %s:%hu", eport, protocol, rhost_old, iaddr_old, iport_old ) ; timestamp = ( leaseduration > 0 )? upnp_time ( ) + leaseduration : 0 ; if ( iport!= iport_old ) { r = update_portmapping ( ext_if_name, eport, proto

Fix:
<S2SV_ModStart> 3 ; } if ( desc == NULL ) desc = "" ;
Buggy code:
 static rfbBool rfbSetClientColourMapBGR233 ( rfbClientPtr cl ) { <START_BUG> char buf [ sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2 ] ; <END_BUG>  rfbSetColourMapEntriesMsg * scme = ( rfbSetColourMapEntriesMsg * ) buf ; <START_BUG> <END_BUG> uint16_t * rgb = ( uint16_t * ) ( & buf [ sz_rfbSetColourMapEntriesMsg ] ) ;  int i, len ; int r, g, b ; if ( cl -> format. bitsPerPixel!= 8 ) { rfbErr ( "%s:   client   not   8   bits   per   pixel\\n", "rfbSetClientColourMapBGR233" ) ; rfbCloseClient ( cl ) ; return FALSE ; } scme -> type = rfbSetColourMapEntries ; scme -> firstColour = Swap16IfLE ( 0 ) ; scme -> nColours = Swap16IfLE ( 256 ) ; len = sz_rfbSetColourMapEntriesMsg ; i = 0 ; for ( b = 0 ; b < 4 ; b ++ ) { for ( g = 0 ; g < 8 ; g ++ ) { for ( r = 0 ; r < 8 ; r ++ ) { rgb [ i ++ ] = Swap16IfLE ( r * 65535 // 7 ) ; rgb [ i ++ ] = Swap16IfLE ( g * 65535 // 7 ) ; rgb [ i ++ ] = Swap16IfLE ( b * 65535 // 3 ) ; } } } len += 256 * 3 * 2 ; <START_BUG> if ( rfbWriteExact ( cl, buf, len ) < 0 ) { <END_BUG> rfbLogPerror ( "rfbSetClientColourMapBGR233:   write" ) ; rfbCloseClient ( cl ) ; return FALSE ; } return TRUE ; }

Fix:
<S2SV_ModStart> cl ) { union { char bytes <S2SV_ModEnd> [ sz_rfbSetColourMapEntriesMsg + <S2SV_ModStart> ] ; rfbSetColourMapEntriesMsg msg ; } buf ; rfbSetColourMapEntriesMsg * scme = & buf. msg <S2SV_ModEnd> ; uint16_t * <S2SV_ModStart> ( & buf. bytes <S2SV_ModStart> cl, buf. bytes
Buggy code:
 static int process_plane ( uint8 * in, int width, int height, uint8 * out, int size ) { UNUSED ( size ) ; int indexw ; int indexh ; int code ; int collen ; int replen ; int color ; int x ; int revcode ; uint8 * last_line ; uint8 * this_line ; uint8 * org_in ; uint8 * org_out ; org_in = in ; org_out = out ; last_line = 0 ; indexh = 0 ; while ( indexh < height ) { out = ( org_out + width * height * 4 ) - ( ( indexh + 1 ) * width * 4 ) ; color = 0 ; this_line = out ; indexw = 0 ; if ( last_line == 0 ) { while ( indexw < width ) { code = CVAL ( in ) ; replen = code & 0xf ; collen = ( code >> 4 ) & 0xf ; revcode = ( replen << 4 ) | collen ; if ( ( revcode <= 47 ) && ( revcode >= 16 ) ) { replen = revcode ; collen = 0 ; } <START_BUG> while ( collen > 0 ) <END_BUG> { color = CVAL ( in ) ; * out = color ; out += 4 ; indexw ++ ; collen -- ; }  while ( replen > 0 ) <START_BUG> { * out = color ; out += 4 ; indexw ++ ; replen -- ; } } } else { while ( indexw < width ) { code = CVAL ( in ) ; replen = code & 0xf ; collen = ( code >> 4 ) & 0xf ; revcode = ( replen << 4 ) | collen ; if ( ( revcode <= 47 ) && ( revcode >= 16 ) ) { replen = revcode ; collen = 0 ; } <END_BUG> while ( collen > 0 )  { x = CVAL ( in ) ; if ( x & 1 ) { x = x >> 1 ; x = x + 1 ; color = - x ; } else { x = x >> 1 ; color = x ; } x = last_line [ indexw * 4 ] + color ; * out = x ; out += 4 ; indexw ++ ; collen -- ; } <START_BUG> while ( replen > 0 ) <END_BUG> { x = last_line [ indexw * 4 ] + color

Fix:
<S2SV_ModStart> } while ( indexw < width && <S2SV_ModStart> } while ( indexw < width && <S2SV_ModStart> } while ( indexw < width && <S2SV_ModStart> } while ( indexw < width &&
Buggy code:
 static int archive_read_format_rar_read_data ( struct archive_read * a, const void * * buff, size_t * size, int64_t * offset ) { struct rar * rar = ( struct rar * ) ( a -> format -> data ) ; int ret ; if ( rar -> has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW ) { rar -> has_encrypted_entries = 0 ; } if ( rar -> bytes_unconsumed > 0 ) { __archive_read_consume ( a, rar -> bytes_unconsumed ) ; rar -> bytes_unconsumed = 0 ; } * buff = NULL ; if ( rar -> entry_eof || rar -> offset_seek >= rar -> unp_size ) { * size = 0 ; * offset = rar -> offset ; if ( * offset < rar -> unp_size ) * offset = rar -> unp_size ; return ( ARCHIVE_EOF ) ; } switch ( rar -> compression_method ) { case COMPRESS_METHOD_STORE : ret = read_data_stored ( a, buff, size, offset ) ; break ; case COMPRESS_METHOD_FASTEST : case COMPRESS_METHOD_FAST : case COMPRESS_METHOD_NORMAL : case COMPRESS_METHOD_GOOD : case COMPRESS_METHOD_BEST : ret = read_data_compressed ( a, buff, size, offset ) ; <START_BUG> if ( ret!= ARCHIVE_OK && ret!= ARCHIVE_WARN ) <END_BUG> __archive_ppmd7_functions. Ppmd7_Free ( & rar -> ppmd7_context ) ;  break ; <START_BUG> default : archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Unsupported   compression   method   for   RAR   file." ) ; ret = ARCHIVE_FATAL ; break ; } return ( ret ) ; }<END_BUG>

Fix:
<S2SV_ModStart>!= ARCHIVE_WARN ) { <S2SV_ModStart> ppmd7_context ) ; rar -> start_new_table = 1 ; }
Buggy code:
 static Image * ReadTXTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char colorspace [ MagickPathExtent ], text [ MagickPathExtent ] ; Image * image ; long x_offset, y_offset ; PixelInfo pixel ; MagickBooleanType status ; QuantumAny range ; register ssize_t i, x ; register Quantum * q ; ssize_t count, type, y ; unsigned long depth, height, max_value, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( text, 0, sizeof ( text ) ) ; ( void ) ReadBlobString ( image, text ) ; if ( LocaleNCompare ( ( char * ) text, MagickID, strlen ( MagickID ) )!= 0 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { width = 0 ; height = 0 ; max_value = 0 ; * colorspace = '\\0' ; count = ( ssize_t ) sscanf ( text + 32, "%lu,%lu,%lu,%s", & width, & height, & max_value, colorspace ) ; if ( ( count!= 4 ) || ( width == 0 ) || ( height == 0 ) || ( max_value == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; image -> columns = width ; image -> rows = height ; for ( depth = 1 ; ( GetQuantumRange ( depth ) + 1 ) < max_value ; depth ++ ) ; image -> depth = depth ; status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if

Fix:
<S2SV_ModStart> ; } } if ( EOFBlob ( image )!= MagickFalse ) { ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; break ; }
Buggy code:
 static int StreamTcpPacketStateSynSent ( ThreadVars * tv, Packet * p, StreamTcpThread * stt, TcpSession * ssn, PacketQueue * pq ) { if ( ssn == NULL ) return - 1 ; SCLogDebug ( "ssn   %p:   pkt   received:   %s", ssn, PKT_IS_TOCLIENT ( p )? "toclient" : "toserver" ) ; <START_BUG> if ( p -> tcph -> th_flags & TH_RST ) { <END_BUG> if (! StreamTcpValidateRst ( ssn, p ) ) return - 1 ; if ( PKT_IS_TOSERVER ( p ) ) { if ( SEQ_EQ ( TCP_GET_SEQ ( p ), ssn -> client. isn ) && SEQ_EQ ( TCP_GET_WINDOW ( p ), 0 ) && SEQ_EQ ( TCP_GET_ACK ( p ), ( ssn -> client. isn + 1 ) ) ) { SCLogDebug ( "ssn->server.flags   |=   STREAMTCP_STREAM_FLAG_RST_RECV" ) ; ssn -> server. flags |= STREAMTCP_STREAM_FLAG_RST_RECV ; StreamTcpPacketSetState ( p, ssn, TCP_CLOSED ) ; SCLogDebug ( "ssn   %p:   Reset   received   and   state   changed   to   " "TCP_CLOSED", ssn ) ; } } else { ssn -> client. flags |= STREAMTCP_STREAM_FLAG_RST_RECV ; SCLogDebug ( "ssn->client.flags   |=   STREAMTCP_STREAM_FLAG_RST_RECV" ) ; StreamTcpPacketSetState ( p, ssn, TCP_CLOSED ) ; SCLogDebug ( "ssn   %p:   Reset   received   and   state   changed   to   " "TCP_CLOSED", ssn ) ; } } else if ( p -> tcph -> th_flags & TH_FIN ) { } else if ( ( p -> tcph -> th_flags & ( TH_SYN | TH_ACK ) ) == ( TH_SYN | TH_ACK ) ) { if ( ( ssn -> flags & STREAMTCP_FLAG_4WHS ) && PKT_IS_TOSERVER ( p ) ) { SCLogDebug

Fix:
<S2SV_ModStart> ; if ( StateSynSentValidateTimestamp ( ssn, p ) == false ) return - 1 ; if (
Buggy code:
 <START_BUG> static void update_open_stateflags ( struct nfs4_state * state, mode_t open_flags ) <END_BUG> {  switch ( open_flags ) { <START_BUG> case FMODE_WRITE : state -> n_wronly ++ ; break ; case FMODE_READ : state -> n_rdonly ++ ; break ; case FMODE_READ | FMODE_WRITE : state -> n_rdwr ++ ; } <END_BUG> nfs4_state_set_mode_locked ( state, state -> state | open_flags ) ;  }

Fix:
<S2SV_ModStart> * state, fmode_t fmode <S2SV_ModEnd> ) { switch <S2SV_ModStart> { switch ( fmode <S2SV_ModEnd> ) { case <S2SV_ModStart> -> state | fmode <S2SV_ModEnd> ) ; }
Buggy code:
 void * <START_BUG> xmalloc ( size_t size ) <END_BUG>  { <START_BUG> <END_BUG> void * ptr = malloc ( size ) ;  if (! ptr && ( size!= 0 ) ) { perror ( "xmalloc:   Memory   allocation   failure" ) ; abort ( ) ; } return ptr ; }

Fix:
<S2SV_ModStart> xmalloc ( size_t num, size_t <S2SV_ModStart> size ) { size_t res ; if ( check_mul_overflow ( num, size, & res ) ) abort ( ) ; <S2SV_ModStart> = malloc ( res <S2SV_ModEnd> ) ; if
Buggy code:
 static int <START_BUG> l_strnstart ( const char * tstr1, u_int tl1, const char * str2, u_int l2 ) <END_BUG>  { <START_BUG> if ( tl1 > l2 ) return 0 ; return ( strncmp ( tstr1, str2, tl1 ) == 0? 1 : 0 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> int l_strnstart ( netdissect_options * ndo, <S2SV_ModStart> l2 ) { if (! ND_TTEST2 ( * str2, tl1 ) ) { return 0 ; }
Buggy code:
 vpx_image_t * vpx_codec_get_frame ( vpx_codec_ctx_t * ctx, vpx_codec_iter_t * iter ) { vpx_image_t * img ; if (! ctx ||! iter ||! ctx -> iface ||! ctx -> priv ) img = NULL ; else <START_BUG> img = ctx -> iface -> dec. get_frame ( ctx -> priv -> alg_priv, iter ) ; <END_BUG> return img ; }

Fix:
<S2SV_ModStart>. get_frame ( get_alg_priv ( ctx ) <S2SV_ModEnd>, iter )
Buggy code:
 static unsigned int ipv6_defrag ( void * priv, struct sk_buff * skb, const struct nf_hook_state * state ) { int err ; # if IS_ENABLED ( CONFIG_NF_CONNTRACK ) if ( skb -> nfct &&! nf_ct_is_template ( ( struct nf_conn * ) skb -> nfct ) ) return NF_ACCEPT ; # endif err = nf_ct_frag6_gather ( state -> net, skb, nf_ct6_defrag_user ( state -> hook, skb ) ) ; if ( err == - EINPROGRESS ) return NF_STOLEN ; <START_BUG> return NF_ACCEPT ; <END_BUG> }

Fix:
<S2SV_ModStart> NF_STOLEN ; return err == 0? NF_ACCEPT : NF_DROP <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static void estimate_missing_mvs ( MB_OVERLAP * overlaps, MODE_INFO * mi, MODE_INFO * prev_mi, int mb_rows, int mb_cols, unsigned int first_corrupt ) { int mb_row, mb_col ; <START_BUG> vpx_memset ( overlaps, 0, sizeof ( MB_OVERLAP ) * mb_rows * mb_cols ) ; <END_BUG> for ( mb_row = 0 ; mb_row < mb_rows ; ++ mb_row ) { for ( mb_col = 0 ; mb_col < mb_cols ; ++ mb_col ) { if ( prev_mi -> mbmi. ref_frame == LAST_FRAME ) { calc_prev_mb_overlaps ( overlaps, prev_mi, mb_row, mb_col, mb_rows, mb_cols ) ; } ++ prev_mi ; } ++ prev_mi ; } mb_row = first_corrupt // mb_cols ; mb_col = first_corrupt - mb_row * mb_cols ; mi += mb_row * ( mb_cols + 1 ) + mb_col ; for ( ; mb_row < mb_rows ; ++ mb_row ) { int mb_to_top_edge = - ( ( mb_row * 16 ) ) << 3 ; int mb_to_bottom_edge = ( ( mb_rows - 1 - mb_row ) * 16 ) << 3 ; for ( ; mb_col < mb_cols ; ++ mb_col ) { int mb_to_left_edge = - ( ( mb_col * 16 ) << 3 ) ; int mb_to_right_edge = ( ( mb_cols - 1 - mb_col ) * 16 ) << 3 ; const B_OVERLAP * block_overlaps = overlaps [ mb_row * mb_cols + mb_col ]. overlaps ; mi -> mbmi. ref_frame = LAST_FRAME ; mi -> mbmi. mode = SPLITMV ; mi -> mbmi. uv_mode = DC_PRED ; mi -> mbmi. partitioning = 3 ; mi -> mbmi. segment_id = 0 ; estimate_mb_mvs ( block_overlaps, mi, mb_to_left_edge, mb_to_right_edge, mb_to_top_edge, mb_to_

Fix:
<S2SV_ModStart>, mb_col ; memset <S2SV_ModEnd> ( overlaps,
Buggy code:
 void vp9_cyclic_refresh_free ( CYCLIC_REFRESH * cr ) { vpx_free ( cr -> map ) ; <START_BUG> vpx_free ( cr ) ; <END_BUG> }

Fix:
<S2SV_ModStart> vpx_free ( cr -> last_coded_q_map ) ; vpx_free ( cr
Buggy code:
 int bta_co_rfc_data_outgoing_size ( void * user_data, int * size ) { pthread_mutex_lock ( & slot_lock ) ; uint32_t id = ( uintptr_t ) user_data ; int ret = false ; * size = 0 ; rfc_slot_t * slot = find_rfc_slot_by_id ( id ) ; if (! slot ) goto out ; <START_BUG> if ( ioctl ( slot -> fd, FIONREAD, size ) == 0 ) { <END_BUG> ret = true ; } else { LOG_ERROR ( "%s   unable   to   determine   bytes   remaining   to   be   read   on   fd   %d:   %s", __func__, slot -> fd, strerror ( errno ) ) ; cleanup_rfc_slot ( slot ) ; } out : ; pthread_mutex_unlock ( & slot_lock ) ; return ret ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> FIONREAD, size )
Buggy code:
 static int ceph_x_decrypt ( struct ceph_crypto_key * secret, <START_BUG> void * * p, void * end, void * obuf, size_t olen ) <END_BUG> { struct ceph_x_encrypt_header head ; size_t head_len = sizeof ( head ) ; int len, ret ; len = ceph_decode_32 ( p ) ; if ( * p + len > end ) return - EINVAL ; dout ( "ceph_x_decrypt   len   %d\\n", len ) ;  ret = ceph_decrypt2 ( secret, & head, & head_len, obuf, & olen, <START_BUG> * p, len ) ; if ( ret ) return ret ; if ( head. struct_v!= 1 || le64_to_cpu ( head. magic )!= CEPHX_ENC_MAGIC ) return - EPERM ; * p += len ; return olen ; }<END_BUG>

Fix:
<S2SV_ModStart> end, void * <S2SV_ModStart> len ) ; if ( * obuf == NULL ) { * obuf = kmalloc ( len, GFP_NOFS ) ; if (! * obuf ) return - ENOMEM ; olen = len ; } <S2SV_ModStart> & head_len, *
Buggy code:
 <START_BUG> static int match ( Reinst * pc, const char * sp, const char * bol, int flags, Resub * out ) <END_BUG> { Resub scratch ;  int i ; <START_BUG> Rune c ; <END_BUG> for ( ; ; ) {  switch ( pc -> opcode ) { case I_END : <START_BUG> return 1 ; <END_BUG> case I_JUMP : pc = pc -> x ; break ; case I_SPLIT : scratch = * out ;  if ( match ( pc -> x, sp, bol, flags, & scratch ) ) { <START_BUG> * out = scratch ; <END_BUG> return 1 ;  } pc = pc -> y ; break ; case I_PLA : <START_BUG> if (! match ( pc -> x, sp, bol, flags, out ) ) <END_BUG> return 0 ; pc = pc -> y ; break ; case I_NLA : scratch = * out ;  if ( match ( pc -> x, sp, bol, flags, & scratch ) ) <START_BUG> return 0 ; pc = pc -> y ; break ; case I_ANYNL : sp += chartorune ( & c, sp ) ; if ( c == 0 ) <END_BUG> return 0 ;  pc = pc + 1 ; break ; case I_ANY : sp += chartorune ( & c, sp ) ; if ( c == 0 ) <START_BUG> return 0 ; <END_BUG> if ( isnewline ( c ) )  return 0 ; <START_BUG> pc = pc + 1 ; break ; case I_CHAR : sp += chartorune ( & c, sp ) ; if ( c == 0 ) <END_BUG> return 0 ;  if ( flags & REG_ICASE ) c = canon ( c ) ; if ( c!= pc -> c ) <START_BUG> return 0 ; <END_BUG> pc = pc + 1 ; break ; case I_CCLASS : sp += chartorune ( & c, sp ) ; if ( c == 0 )  return 0 ; <START_BUG> if ( flags & REG_ICASE ) { if (! incclasscanon ( pc -> cc, canon ( c ) ) ) <END_BUG> return 0 ;  } else { if (! incclass ( pc -> cc, c ) ) <START_BUG> return 0 ; <END_BUG> } pc = pc + 1 ; break ; case I_NCCLASS : sp += chartorune ( & c, sp ) ; if ( c == 0 )  return 0 ; <START_BUG> if ( flags & REG_ICASE ) { if ( incclasscanon ( pc -> cc,<END_BUG>

Fix:
<S2SV_ModStart> Resub * out, int depth <S2SV_ModStart> scratch ; int result ; int <S2SV_ModStart> Rune c ; if ( depth > MAXREC ) return - 1 ; <S2SV_ModStart> I_END : return 0 <S2SV_ModEnd> ; case I_JUMP <S2SV_ModStart> * out ; result = <S2SV_ModEnd> match ( pc <S2SV_ModStart>, & scratch, depth + 1 ) ; if ( result == - 1 ) return - 1 ; if ( result == 0 <S2SV_ModEnd> ) { * <S2SV_ModStart> scratch ; return 0 <S2SV_ModEnd> ; } pc <S2SV_ModStart> case I_PLA : result = <S2SV_ModEnd> match ( pc <S2SV_ModStart> flags, out, depth + 1 ) ; if ( result == - 1 ) return - 1 ; if ( result == 1 ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> * out ; result = <S2SV_ModEnd> match ( pc <S2SV_ModStart>, & scratch, depth + 1 ) ; if ( result == - 1 ) return - 1 ; if ( result == 0 ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> c ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) return 1 <S2SV_ModEnd> ; } else <S2SV_ModStart> ) ) return 1 <S2SV_ModEnd> ;
Buggy code:
 static ssize_t out_write ( struct audio_stream_out * stream, const void * buffer, size_t bytes ) { struct a2dp_stream_out * out = ( struct a2dp_stream_out * ) stream ; int sent ; DEBUG ( "write   %zu   bytes   (fd   %d)", bytes, out -> common. audio_fd ) ; pthread_mutex_lock ( & out -> common. lock ) ; if ( out -> common. state == AUDIO_A2DP_STATE_SUSPENDED ) { DEBUG ( "stream   suspended" ) ; pthread_mutex_unlock ( & out -> common. lock ) ; return - 1 ; } if ( ( out -> common. state == AUDIO_A2DP_STATE_STOPPED ) || ( out -> common. state == AUDIO_A2DP_STATE_STANDBY ) ) { if ( start_audio_datapath ( & out -> common ) < 0 ) { int us_delay = calc_audiotime ( out -> common. cfg, bytes ) ; DEBUG ( "emulate   a2dp   write   delay   (%d   us)", us_delay ) ; <START_BUG> usleep ( us_delay ) ; <END_BUG> pthread_mutex_unlock ( & out -> common. lock ) ; return - 1 ; } } else if ( out -> common. state!= AUDIO_A2DP_STATE_STARTED ) { ERROR ( "stream   not   in   stopped   or   standby" ) ; pthread_mutex_unlock ( & out -> common. lock ) ; return - 1 ; } pthread_mutex_unlock ( & out -> common. lock ) ; sent = skt_write ( out -> common. audio_fd, buffer, bytes ) ; if ( sent == - 1 ) { skt_disconnect ( out -> common. audio_fd ) ; out -> common. audio_fd = AUDIO_SKT_DISCONNECTED ; if ( out -> common. state!= AUDIO_A2DP_STATE_SUSPENDED ) out -> common. state = AUDIO_A2DP_STATE_STOPPED ; else ERROR ( "write   failed   :   stream   suspended,   avoid   resetting   state" ) ; } else { const size_t

Fix:
<S2SV_ModStart> us_delay ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( us_delay )
Buggy code:
 int touch_file ( const char * path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode ) { _cleanup_close_ int fd ; int r ; assert ( path ) ; if ( parents ) mkdir_parents ( path, 0755 ) ; fd = open ( path, O_WRONLY | O_CREAT | O_CLOEXEC | O_NOCTTY, mode > 0? mode : 0644 ) ; if ( fd < 0 ) return - errno ; <START_BUG> if ( mode > 0 ) { <END_BUG> r = fchmod ( fd, mode ) ; if ( r < 0 ) return - errno ; } if ( uid!= UID_INVALID || gid!= GID_INVALID ) { r = fchown ( fd, uid, gid ) ; if ( r < 0 ) return - errno ; } if ( stamp!= USEC_INFINITY ) { struct timespec ts [ 2 ] ; timespec_store ( & ts [ 0 ], stamp ) ; ts [ 1 ] = ts [ 0 ] ; r = futimens ( fd, ts ) ; } else r = futimens ( fd, NULL ) ; if ( r < 0 ) return - errno ; return 0 ; }

Fix:
<S2SV_ModStart> if ( mode!= MODE_INVALID <S2SV_ModEnd> ) { r
Buggy code:
 unsigned paravirt_patch_call ( void * insnbuf, const void * target, u16 tgt_clobbers, unsigned long addr, u16 site_clobbers, unsigned len ) { struct branch * b = insnbuf ; unsigned long delta = ( unsigned long ) target - ( addr + 5 ) ; <START_BUG> if ( tgt_clobbers & ~ site_clobbers ) <END_BUG> return len ;  if ( len < 5 ) <START_BUG> return len ; b -> opcode = 0xe8 ; b -> delta = delta ; BUILD_BUG_ON ( sizeof ( * b )!= 5 ) ; return 5 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( len < 5 ) { # ifdef CONFIG_RETPOLINE WARN_ONCE ( "Failing <S2SV_blank> to <S2SV_blank> patch <S2SV_blank> indirect <S2SV_blank> CALL <S2SV_blank> in <S2SV_blank> %ps\\n", ( void * ) addr ) ; # endif <S2SV_ModEnd> return len ; <S2SV_ModStart> return len ; } <S2SV_ModEnd> b -> opcode
Buggy code:
 void enc624j600WritePhyReg ( NetInterface * interface, uint8_t address, uint16_t data ) { <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_MIREGADR, MIREGADR_R8 | address ) ; <END_BUG>  enc624j600WriteReg ( interface, ENC624J600_REG_MIWR, data ) ; <START_BUG> <END_BUG> while ( ( enc624j600ReadReg ( interface, ENC624J600_REG_MISTAT ) & MISTAT_BUSY )!= 0 )  <START_BUG> { <END_BUG> } }

Fix:
<S2SV_ModStart> data ) { uint16_t status ; <S2SV_ModStart> ( interface, ENC624J600_MIREGADR, ENC624J600_MIREGADR_R12_8_DEFAULT <S2SV_ModEnd> | address ) <S2SV_ModStart> ( interface, ENC624J600_MIWR <S2SV_ModEnd>, data ) <S2SV_ModStart> data ) ; do { status = <S2SV_ModEnd> enc624j600ReadReg ( interface <S2SV_ModStart> ( interface, ENC624J600_MISTAT ) ; } while ( ( status & ENC624J600_MISTAT_BUSY <S2SV_ModEnd> )!= 0 <S2SV_ModStart>!= 0 ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static int udf_symlink_filler ( struct file * file, struct page * page ) { struct inode * inode = page -> mapping -> host ; struct buffer_head * bh = NULL ; unsigned char * symlink ; <START_BUG> int err = - EIO ; <END_BUG> unsigned char * p = kmap ( page ) ; struct udf_inode_info * iinfo ;  uint32_t pos ; <START_BUG> iinfo = UDF_I ( inode ) ; pos = udf_block_map ( inode, 0 ) ; down_read ( & iinfo -> i_data_sem ) ; if ( iinfo -> i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ) { symlink = iinfo -> i_ext. i_data + iinfo -> i_lenEAttr ; } else { bh = sb_bread ( inode -> i_sb, pos ) ; <END_BUG> if (! bh )  goto out ; symlink = bh -> b_data ; } udf_pc_to_char ( inode -> i_sb, symlink, inode -> i_size, p ) ; brelse ( bh ) ; up_read ( & iinfo -> i_data_sem ) ; SetPageUptodate ( page ) ; kunmap ( page ) ; unlock_page ( page ) ; return 0 ; <START_BUG> out : <END_BUG> up_read ( & iinfo -> i_data_sem ) ; SetPageError ( page ) ;  kunmap ( page ) ; <START_BUG> unlock_page ( page ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> ; int err <S2SV_ModEnd> ; unsigned char <S2SV_ModStart> uint32_t pos ; if ( inode -> i_size > inode -> i_sb -> s_blocksize ) { err = - ENAMETOOLONG ; goto out_unmap ; } <S2SV_ModStart>! bh ) { err = - EIO ; goto out_unlock_inode ; } <S2SV_ModEnd> symlink = bh <S2SV_ModStart> return 0 ; out_unlock_inode <S2SV_ModEnd> : up_read ( <S2SV_ModStart> page ) ; out_unmap :
Buggy code:
 static inline int accept_server_socket ( int s ) { struct sockaddr_un client_address ; socklen_t clen ; <START_BUG> int fd = accept ( s, ( struct sockaddr * ) & client_address, & clen ) ; <END_BUG> APPL_TRACE_DEBUG ( "accepted   fd:%d   for   server   fd:%d", fd, s ) ; return fd ; }

Fix:
<S2SV_ModStart> int fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & clen )
Buggy code:
 static void build_inter_predictors ( MACROBLOCKD * xd, int plane, int block, int bw, int bh, int x, int y, int w, int h, int mi_x, int mi_y ) { struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; const MODE_INFO * mi = xd -> mi [ 0 ] ; const int is_compound = has_second_ref ( & mi -> mbmi ) ; <START_BUG> const InterpKernel * kernel = vp9_get_interp_kernel ( mi -> mbmi. interp_filter ) ; <END_BUG> int ref ; for ( ref = 0 ; ref < 1 + is_compound ; ++ ref ) { const struct scale_factors * const sf = & xd -> block_refs [ ref ] -> sf ; struct buf_2d * const pre_buf = & pd -> pre [ ref ] ; struct buf_2d * const dst_buf = & pd -> dst ; uint8_t * const dst = dst_buf -> buf + dst_buf -> stride * y + x ; const MV mv = mi -> mbmi. sb_type < BLOCK_8X8 ? ( plane == 0? mi -> bmi [ block ]. as_mv [ ref ]. as_mv <START_BUG> : mi_mv_pred_q4 ( mi, ref ) ) : mi -> mbmi. mv [ ref ]. as_mv ; const MV mv_q4 = clamp_mv_to_umv_border_sb ( xd, & mv, bw, bh, pd -> subsampling_x, pd -> subsampling_y ) ; uint8_t * pre ; MV32 scaled_mv ; int xs, ys, subpel_x, subpel_y ; <END_BUG> if ( vp9_is_scaled ( sf ) ) {  pre = pre_buf -> buf + scaled_buffer_offset ( x, y, pre_buf -> stride, sf ) ; scaled_mv = vp9_scale_mv ( & mv_q4, mi_x + x, mi_y + y, sf ) ; xs = sf -> x_step_q4 ; ys = sf -> y_step_q4 ; } else { pre = pre_buf -> buf + ( y * pre_buf -> stride + x ) ; scaled_mv. row = mv_

Fix:
<S2SV_ModStart> * kernel = vp9_filter_kernels [ <S2SV_ModEnd> mi -> mbmi <S2SV_ModStart> mbmi. interp_filter ] <S2SV_ModEnd> ; int ref <S2SV_ModStart> < BLOCK_8X8? average_split_mvs ( pd, mi, ref, block <S2SV_ModEnd> ) : mi <S2SV_ModStart>, subpel_y ; const int is_scaled = vp9_is_scaled ( sf ) ; if ( is_scaled <S2SV_ModEnd> ) { pre <S2SV_ModStart> SUBPEL_BITS ) ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { high_inter_predictor ( pre, pre_buf -> stride, dst, dst_buf -> stride, subpel_x, subpel_y, sf, w, h, ref, kernel, xs, ys, xd -> bd ) ; } else { <S2SV_ModStart> ys ) ; } # else inter_predictor ( pre, pre_buf -> stride, dst, dst_buf -> stride, subpel_x, subpel_y, sf, w, h, ref, kernel, xs, ys ) ; # endif
Buggy code:
 static void ext4_end_io_dio ( struct kiocb * iocb, loff_t offset, ssize_t size, void * private ) { ext4_io_end_t * io_end = iocb -> private ; struct workqueue_struct * wq ; <START_BUG> if (! io_end ||! size ) <END_BUG> return ; ext_debug ( "ext4_end_io_dio():   io_end   0x%p" "for   inode   %lu,   iocb   0x%p,   offset   %llu,   size   %llu\\n", iocb -> private, io_end -> inode -> i_ino, iocb, offset, size ) ; if ( io_end -> flag!= EXT4_IO_UNWRITTEN ) { ext4_free_io_end ( io_end ) ; iocb -> private = NULL ; return ; } io_end -> offset = offset ; io_end -> size = size ;  wq = EXT4_SB ( io_end -> inode -> i_sb ) -> dio_unwritten_wq ; <START_BUG> queue_work ( wq, & io_end -> work ) ; <END_BUG> list_add_tail ( & io_end -> list,  <START_BUG> & EXT4_I ( io_end -> inode ) -> i_completed_io_list ) ; <END_BUG> iocb -> private = NULL ; }

Fix:
<S2SV_ModStart> * wq ; unsigned long flags ; struct ext4_inode_info * ei ; <S2SV_ModStart> = size ; io_end -> flag = EXT4_IO_UNWRITTEN ; <S2SV_ModStart> work ) ; ei = EXT4_I ( io_end -> inode ) ; spin_lock_irqsave ( & ei -> i_completed_io_lock, flags ) ; <S2SV_ModStart> -> list, & ei -> i_completed_io_list ) ; spin_unlock_irqrestore ( & ei -> i_completed_io_lock, flags <S2SV_ModEnd> ) ; iocb
Buggy code:
 static struct pid * good_sigevent ( sigevent_t * event ) { struct task_struct * rtn = current -> group_leader ; <START_BUG> if ( ( event -> sigev_notify & SIGEV_THREAD_ID ) && <END_BUG>  (! ( rtn = find_task_by_vpid ( event -> sigev_notify_thread_id ) ) || <START_BUG> <END_BUG>! same_thread_group ( rtn, current ) ||  ( event -> sigev_notify & ~ SIGEV_THREAD_ID )!= SIGEV_SIGNAL ) ) return NULL ; <START_BUG> if ( ( ( event -> sigev_notify & ~ SIGEV_THREAD_ID )!= SIGEV_NONE ) && <END_BUG>  ( ( event -> sigev_signo <= 0 ) || ( event -> sigev_signo > SIGRTMAX ) ) ) <START_BUG> <END_BUG> return NULL ;  return task_pid ( rtn ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> -> group_leader ; switch <S2SV_ModEnd> ( event -> <S2SV_ModStart> event -> sigev_notify ) { case SIGEV_SIGNAL | SIGEV_THREAD_ID : <S2SV_ModEnd> rtn = find_task_by_vpid <S2SV_ModStart> -> sigev_notify_thread_id ) ; if (! rtn <S2SV_ModEnd> ||! same_thread_group <S2SV_ModStart>, current ) <S2SV_ModEnd> ) return NULL <S2SV_ModStart> return NULL ; case SIGEV_SIGNAL : case SIGEV_THREAD : if <S2SV_ModEnd> ( event -> <S2SV_ModStart> sigev_signo <= 0 || <S2SV_ModEnd> event -> sigev_signo <S2SV_ModStart> > SIGRTMAX ) <S2SV_ModEnd> return NULL ; <S2SV_ModStart> return NULL ; case SIGEV_NONE : <S2SV_ModStart> rtn ) ; default : return NULL ; }
Buggy code:
 static int do_misc_fixups ( struct bpf_verifier_env * env ) { struct bpf_prog * prog = env -> prog ; bool expect_blinding = bpf_jit_blinding_enabled ( prog ) ; struct bpf_insn * insn = prog -> insnsi ; const struct bpf_func_proto * fn ; const int insn_cnt = prog -> len ; const struct bpf_map_ops * ops ; struct bpf_insn_aux_data * aux ; struct bpf_insn insn_buf [ 16 ] ; struct bpf_prog * new_prog ; struct bpf_map * map_ptr ; int i, ret, cnt, delta = 0 ; for ( i = 0 ; i < insn_cnt ; i ++, insn ++ ) { if ( insn -> code == ( BPF_ALU64 | BPF_MOD | BPF_X ) || insn -> code == ( BPF_ALU64 | BPF_DIV | BPF_X ) || insn -> code == ( BPF_ALU | BPF_MOD | BPF_X ) || insn -> code == ( BPF_ALU | BPF_DIV | BPF_X ) ) { bool is64 = BPF_CLASS ( insn -> code ) == BPF_ALU64 ; bool isdiv = BPF_OP ( insn -> code ) == BPF_DIV ; struct bpf_insn * patchlet ; struct bpf_insn chk_and_div [ ] = { BPF_RAW_INSN ( ( is64? BPF_JMP : BPF_JMP32 ) | BPF_JNE | BPF_K, insn -> src_reg, 0, 2, 0 ), BPF_ALU32_REG ( BPF_XOR, insn -> dst_reg, insn -> dst_reg ), BPF_JMP_IMM ( BPF_JA, 0, 0, 1 ), * insn, } ; struct bpf_insn chk_and_mod [ ] = { BPF_RAW_INSN ( ( is64? BPF_JMP : BPF_JMP32 ) | BPF_JEQ | BPF_K, insn -> src_reg, 0, 1 + ( is64

Fix:
<S2SV_ModStart> issrc, isneg, isimm <S2SV_ModStart> == BPF_ALU_SANITIZE_SRC ; isimm = aux -> alu_state & BPF_ALU_IMMEDIATE ; <S2SV_ModStart> ; if ( isimm ) { <S2SV_ModEnd> * patch ++ <S2SV_ModStart> patch ++ = BPF_MOV32_IMM ( BPF_REG_AX, aux -> alu_limit ) ; } else { if ( isneg ) <S2SV_ModEnd> * patch ++ <S2SV_ModStart> patch ++ = BPF_ALU64_IMM ( BPF_MUL, off_reg, - 1 <S2SV_ModEnd> ) ; * <S2SV_ModStart> patch ++ = BPF_MOV32_IMM ( BPF_REG_AX, aux -> alu_limit <S2SV_ModEnd> ) ; * <S2SV_ModStart> = BPF_ALU64_REG ( BPF_SUB <S2SV_ModEnd>, BPF_REG_AX, <S2SV_ModStart> patch ++ = BPF_ALU64_REG ( BPF_OR <S2SV_ModEnd>, BPF_REG_AX, <S2SV_ModStart>, BPF_REG_AX, off_reg <S2SV_ModEnd> ) ; * <S2SV_ModStart> = BPF_ALU64_IMM ( BPF_NEG <S2SV_ModEnd>, BPF_REG_AX, <S2SV_ModStart>,
Buggy code:
 static PyObject * _pickle_PicklerMemoProxy_copy_impl ( PicklerMemoProxyObject * self ) { <START_BUG> Py_ssize_t i ; <END_BUG> PyMemoTable * memo ; PyObject * new_memo = PyDict_New ( ) ; if ( new_memo == NULL ) return NULL ; memo = self -> pickler -> memo ;  for ( i = 0 ; i < memo -> mt_allocated ; ++ i ) { <START_BUG> PyMemoEntry entry = memo -> mt_table [ i ] ; if ( entry. me_key!= NULL ) { int status ; PyObject * key, * value ; key = PyLong_FromVoidPtr ( entry. me_key ) ; value = Py_BuildValue ( "nO", entry. me_value, entry. me_key ) ; if ( key == NULL || value == NULL ) { Py_XDECREF ( key ) ; Py_XDECREF ( value ) ; goto error ; } status = PyDict_SetItem ( new_memo, key, value ) ; Py_DECREF ( key ) ; Py_DECREF ( value ) ; if ( status < 0 ) goto error ; } } return new_memo ; error : Py_XDECREF ( new_memo ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> self ) { <S2SV_ModEnd> PyMemoTable * memo <S2SV_ModStart> ; for ( size_t
Buggy code:
 size_t compile_tree ( struct filter_op * * fop ) { int i = 1 ; struct filter_op * array = NULL ; struct unfold_elm * ue ; <START_BUG> BUG_IF ( tree_root == NULL ) ; <END_BUG> fprintf ( stdout, "   Unfolding   the   meta-tree   " ) ; fflush ( stdout ) ; unfold_blk ( & tree_root ) ; fprintf ( stdout, "   done.\\n\\n" ) ; labels_to_offsets ( ) ; TAILQ_FOREACH ( ue, & unfolded_tree, next ) { if ( ue -> label == 0 ) { SAFE_REALLOC ( array, i * sizeof ( struct filter_op ) ) ; memcpy ( & array [ i - 1 ], & ue -> fop, sizeof ( struct filter_op ) ) ; i ++ ; } } SAFE_REALLOC ( array, i * sizeof ( struct filter_op ) ) ; array [ i - 1 ]. opcode = FOP_EXIT ; * fop = array ; return ( i ) ; }

Fix:
<S2SV_ModStart> * ue ; if <S2SV_ModEnd> ( tree_root == <S2SV_ModStart> == NULL ) return 0
Buggy code:
 static void sunkbd_enable ( struct sunkbd * sunkbd, bool enable ) { serio_pause_rx ( sunkbd -> serio ) ; sunkbd -> enabled = enable ; serio_continue_rx ( sunkbd -> serio ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> serio ) ; if (! enable ) { wake_up_interruptible ( & sunkbd -> wait ) ; cancel_work_sync ( & sunkbd -> tq ) ; }
Buggy code:
 <START_BUG> static inline bool unconditional ( const struct ip6t_ip6 * ipv6 ) <END_BUG> { static const struct ip6t_ip6 uncond ;  return memcmp ( ipv6, & uncond, sizeof ( uncond ) ) == 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( const struct ip6t_entry * e <S2SV_ModEnd> ) { static <S2SV_ModStart> uncond ; return e -> target_offset == sizeof ( struct ip6t_entry ) && memcmp ( & e -> <S2SV_ModEnd> ipv6, &
Buggy code:
 static INLINE void store_pred_mv ( MACROBLOCK * x, PICK_MODE_CONTEXT * ctx ) { <START_BUG> vpx_memcpy ( ctx -> pred_mv, x -> pred_mv, sizeof ( x -> pred_mv ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ctx ) { memcpy <S2SV_ModEnd> ( ctx ->
Buggy code:
 static void ttm_put_pages ( struct page * * pages, unsigned npages, int flags, enum ttm_caching_state cstate ) { struct ttm_page_pool * pool = ttm_get_pool ( flags, false, cstate ) ; # ifdef CONFIG_TRANSPARENT_HUGEPAGE struct ttm_page_pool * huge = ttm_get_pool ( flags, true, cstate ) ; # endif unsigned long irq_flags ; unsigned i ; if ( pool == NULL ) { i = 0 ; while ( i < npages ) { # ifdef CONFIG_TRANSPARENT_HUGEPAGE struct page * p = pages [ i ] ; # endif unsigned order = 0, j ; if (! pages [ i ] ) { ++ i ; continue ; } # ifdef CONFIG_TRANSPARENT_HUGEPAGE if (! ( flags & TTM_PAGE_FLAG_DMA32 ) && ( npages - i ) >= HPAGE_PMD_NR ) { <START_BUG> for ( j = 0 ; j < HPAGE_PMD_NR ; ++ j ) <END_BUG> if ( p ++!= pages [ i + j ] ) break ; if ( j == HPAGE_PMD_NR ) order = HPAGE_PMD_ORDER ; } # endif if ( page_count ( pages [ i ] )!= 1 ) pr_err ( "Erroneous   page   count.   Leaking   pages.\\n" ) ; __free_pages ( pages [ i ], order ) ; j = 1 << order ; while ( j ) { pages [ i ++ ] = NULL ; -- j ; } } return ; } i = 0 ; # ifdef CONFIG_TRANSPARENT_HUGEPAGE if ( huge ) { unsigned max_size, n2free ; spin_lock_irqsave ( & huge -> lock, irq_flags ) ; while ( ( npages - i ) >= HPAGE_PMD_NR ) { struct page * p = pages [ i ] ; unsigned j ; if (! p ) break ;  for ( j = 0 ; j < HPAGE_PMD_NR ; ++ j ) <START_BUG> if ( p ++!= pages [ i + j ] ) break ; if ( j!= HPAGE_PMD_N<END_BUG>

Fix:
<S2SV_ModStart> ( j = 1 <S2SV_ModEnd> ; j < <S2SV_ModStart> ( j = 1 <S2SV_ModEnd> ; j <
Buggy code:
 GF_Err latm_dmx_process ( GF_Filter * filter ) { GF_LATMDmxCtx * ctx = gf_filter_get_udta ( filter ) ; GF_FilterPacket * pck, * dst_pck ; u32 pos ; <START_BUG> u8 * data, * output ; <END_BUG>  u32 pck_size, prev_pck_size ; <START_BUG> u64 cts = GF_FILTER_NO_TS ; if ( ctx -> in_error ) return ctx -> in_error ; if (! ctx -> duration. num ) latm_dmx_check_dur ( filter, ctx ) ; if ( ctx -> opid &&! ctx -> is_playing ) return GF_OK ; pck = gf_filter_pid_get_packet ( ctx -> ipid ) ; if (! pck ) { if ( gf_filter_pid_is_eos ( ctx -> ipid ) ) { if (! ctx -> latm_buffer_size ) { if ( ctx -> opid ) gf_filter_pid_set_eos ( ctx -> opid ) ; if ( ctx -> src_pck ) gf_filter_pck_unref ( ctx -> src_pck ) ; ctx -> src_pck = NULL ; return GF_EOS ; } } else { return GF_OK ; } <END_BUG> }  <START_BUG> data = ( char * ) gf_filter_pck_get_data ( pck, & pck_size ) ; <END_BUG> if ( ctx -> timescale && pck ) { cts = gf_filter_pck_get_cts ( pck ) ; } prev_pck_size = ctx -> latm_buffer_size ; if ( pck &&! ctx -> resume_from ) { if ( ctx -> latm_buffer_size + pck_size > ctx -> latm_buffer_alloc ) { ctx -> latm_buffer_alloc = ctx -> latm_buffer_size + pck_size ; ctx -> latm_buffer = gf_realloc ( ctx -> latm_buffer, ctx -> latm_buffer_alloc ) ; } memcpy ( ctx -> latm_buffer + ctx -> latm_buffer_size, data, pck_size ) ; ctx -> latm_buffer_size

Fix:
<S2SV_ModStart> u8 * data = NULL <S2SV_ModStart> ; u32 pck_size = 0 <S2SV_ModStart> ; } } else { <S2SV_ModStart> pck_size ) ; }