nus-yam/ex-repair huggingface dataset:
Buggy code:
 int ff_amf_get_field_value ( const uint8_t * data, const uint8_t * data_end, const uint8_t * name, uint8_t * dst, int dst_size ) { <START_BUG> int namelen = strlen ( name ) ; <END_BUG> int len ; while ( * data!= AMF_DATA_TYPE_OBJECT && data < data_end ) { len = ff_amf_tag_size ( data, data_end ) ;  if ( len < 0 ) <START_BUG> len = data_end - data ; data += len ; } if ( data_end - data < 3 ) return - 1 ; <END_BUG> data ++ ;  for ( ; ; ) { int size = bytestream_get_be16 ( & data ) ; <START_BUG> if (! size ) <END_BUG> break ; if ( size < 0 || size >= data_end - data ) return - 1 ; data += size ;  if ( size == namelen &&! memcmp ( data - size, name, namelen ) ) { <START_BUG> switch ( * data ++ ) { case AMF_DATA_TYPE_NUMBER : <END_BUG> snprintf ( dst, dst_size, "%g", av_int2double ( AV_RB64 ( data ) ) ) ;  break ; case AMF_DATA_TYPE_BOOL : snprintf ( dst, dst_size, "%s", * data? "true" : "false" ) ; break ; case AMF_DATA_TYPE_STRING : len = bytestream_get_be16 ( & data ) ; av_strlcpy ( dst, data, FFMIN ( len + 1, dst_size ) ) ; break ; default : return - 1 ; } return 0 ; } len = ff_amf_tag_size ( data, data_end ) ; if ( len < 0 || len >= data_end - data ) return - 1 ; data += len ; } return - 1 ; }

Fix:
<S2SV_ModStart> dst_size ) { GetByteContext gb <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; if ( data >= data_end <S2SV_ModEnd> ) return - <S2SV_ModStart> - 1 ; bytestream2_init ( & gb, data, data_end - <S2SV_ModEnd> data ) ; <S2SV_ModStart> data ) ; return amf_get_field_value2 ( & gb <S2SV_ModEnd>, name, <S2SV_ModStart>, name, <S2SV_ModEnd> dst, dst_size <S2SV_ModStart> dst, dst_size ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 enum auth_stat gssrpc__svcauth_gss ( struct svc_req * rqst, struct rpc_msg * msg, bool_t * no_dispatch ) { enum auth_stat retstat ; XDR xdrs ; SVCAUTH * auth ; struct svc_rpc_gss_data * gd ; struct rpc_gss_cred * gc ; struct rpc_gss_init_res gr ; int call_stat, offset ; OM_uint32 min_stat ; log_debug ( "in   svcauth_gss()" ) ; rqst -> rq_xprt -> xp_verf = gssrpc__null_auth ; if ( rqst -> rq_xprt -> xp_auth == NULL || rqst -> rq_xprt -> xp_auth == & svc_auth_none ) { if ( ( auth = calloc ( sizeof ( * auth ), 1 ) ) == NULL ) { fprintf ( stderr, "svcauth_gss:   out_of_memory\\n" ) ; return ( AUTH_FAILED ) ; } if ( ( gd = calloc ( sizeof ( * gd ), 1 ) ) == NULL ) { fprintf ( stderr, "svcauth_gss:   out_of_memory\\n" ) ; return ( AUTH_FAILED ) ; } auth -> svc_ah_ops = & svc_auth_gss_ops ; SVCAUTH_PRIVATE ( auth ) = gd ; rqst -> rq_xprt -> xp_auth = auth ; } else gd = SVCAUTH_PRIVATE ( rqst -> rq_xprt -> xp_auth ) ; log_debug ( "xp_auth=%p,   gd=%p", rqst -> rq_xprt -> xp_auth, gd ) ; if ( rqst -> rq_cred. oa_length <= 0 ) return ( AUTH_BADCRED ) ; gc = ( struct rpc_gss_cred * ) rqst -> rq_clntcred ; memset ( gc, 0, sizeof ( * gc ) ) ; log_debug ( "calling   xdrmem_create()" ) ; log_debug ( "oa_base=%p,   oa_length=%u", rqst -> rq_cred. oa_base, rqst -> rq_cred. oa_length ) ; xdr

Fix:
<S2SV_ModStart> gr_token ) ; <S2SV_ModEnd> ret_freegc ( AUTH_FAILED <S2SV_ModStart> gd -> checksum <S2SV_ModEnd> ) ; if
Buggy code:
 static enum ofperr decode_bundle ( bool load, const struct nx_action_bundle * nab, const struct vl_mff_map * vl_mff_map, uint64_t * tlv_bitmap, struct ofpbuf * ofpacts ) { static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT ( 1, 5 ) ; struct ofpact_bundle * bundle ; uint32_t slave_type ; size_t slaves_size, i ; enum ofperr error ; bundle = ofpact_put_BUNDLE ( ofpacts ) ; bundle -> n_slaves = ntohs ( nab -> n_slaves ) ; bundle -> basis = ntohs ( nab -> basis ) ; bundle -> fields = ntohs ( nab -> fields ) ; bundle -> algorithm = ntohs ( nab -> algorithm ) ; slave_type = ntohl ( nab -> slave_type ) ; slaves_size = ntohs ( nab -> len ) - sizeof * nab ; error = OFPERR_OFPBAC_BAD_ARGUMENT ; if (! flow_hash_fields_valid ( bundle -> fields ) ) { VLOG_WARN_RL ( & rl, "unsupported   fields   %d", ( int ) bundle -> fields ) ; } else if ( bundle -> n_slaves > BUNDLE_MAX_SLAVES ) { VLOG_WARN_RL ( & rl, "too   many   slaves" ) ; } else if ( bundle -> algorithm!= NX_BD_ALG_HRW && bundle -> algorithm!= NX_BD_ALG_ACTIVE_BACKUP ) { VLOG_WARN_RL ( & rl, "unsupported   algorithm   %d", ( int ) bundle -> algorithm ) ; } else if ( slave_type!= mf_nxm_header ( MFF_IN_PORT ) ) { VLOG_WARN_RL ( & rl, "unsupported   slave   type   %" PRIu16, slave_type ) ; } else { error = 0 ; } if (! is_all_zeros ( nab -> zero, sizeof nab -> zero ) ) { VLOG_WARN_RL ( & rl, "reserved   field   is   nonzero" ) ; error = OFPERR_OF

Fix:
<S2SV_ModStart> OFPERR_OFPBAC_BAD_LEN ; } else { <S2SV_ModStart> header ; } }
Buggy code:
 void comps_objmrtree_unite ( COMPS_ObjMRTree * rt1, COMPS_ObjMRTree * rt2 ) { COMPS_HSList * tmplist, * tmp_subnodes ; COMPS_HSListItem * it ; COMPS_ObjListIt * it2 ; struct Pair { COMPS_HSList * subnodes ; char * key ; <START_BUG> char added ; <END_BUG> } * pair, * parent_pair ; pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = rt2 -> subnodes ; pair -> key = NULL ; tmplist = comps_hslist_create ( ) ; comps_hslist_init ( tmplist, NULL, NULL, & free ) ; comps_hslist_append ( tmplist, pair, 0 ) ; while ( tmplist -> first!= NULL ) { it = tmplist -> first ; comps_hslist_remove ( tmplist, tmplist -> first ) ; tmp_subnodes = ( ( struct Pair * ) it -> data ) -> subnodes ; parent_pair = ( struct Pair * ) it -> data ; free ( it ) ;  pair -> added = 0 ; <START_BUG> for ( it = tmp_subnodes -> first ; it!= NULL ; it = it -> next ) { pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = ( ( COMPS_ObjMRTreeData * ) it -> data ) -> subnodes ; if ( parent_pair -> key!= NULL ) { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_ObjMRTreeData * ) it -> data ) -> key ) + strlen ( parent_pair -> key ) + 1 ) ) ; memcpy ( pair -> key, parent_pair -> key, sizeof ( char ) * strlen ( parent_pair -> key ) ) ; memcpy ( pair -> key + strlen ( parent_pair -> key ), ( ( COMPS_ObjMRTreeData * ) it -> data ) -> key, sizeof ( char ) * ( strlen ( ( ( COMPS_ObjMRTreeData * ) it -> data ) -> key ) + 1 ) ) ; } else { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_ObjMRTreeData * ) it -> data ) -> key ) + 1 ) ) ; memcpy ( pair -> key<END_BUG>

Fix:
<S2SV_ModStart> * key ; <S2SV_ModEnd> } * pair <S2SV_ModStart> it ) ; <S2SV_ModEnd> for ( it
Buggy code:
 int ParseRiffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int is_rf64 =! strncmp ( fourcc, "RF64", 4 ), got_ds64 = 0 ; int64_t total_samples = 0, infilesize ; RiffChunkHeader riff_chunk_header ; ChunkHeader chunk_header ; WaveHeader WaveHeader ; DS64Chunk ds64_chunk ; uint32_t bcount ; CLEAR ( WaveHeader ) ; CLEAR ( ds64_chunk ) ; infilesize = DoGetFileSize ( infile ) ; if (! is_rf64 && infilesize >= 4294967296LL &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) ) { error_line ( "can\'t   handle  .WAV   files   larger   than   4   GB   (non-standard)!" ) ; return WAVPACK_SOFT_ERROR ; } memcpy ( & riff_chunk_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & riff_chunk_header ) + 4, sizeof ( RiffChunkHeader ) - 4, & bcount ) || bcount!= sizeof ( RiffChunkHeader ) - 4 || strncmp ( riff_chunk_header. formType, "WAVE", 4 ) ) ) { error_line ( "%s   is   not   a   valid  .WAV   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & riff_chunk_header, sizeof ( RiffChunkHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } while ( 1 ) { if (! DoReadFile ( infile, & chunk_header, sizeof ( ChunkHeader ), & bcount ) || bcount!= sizeof ( ChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .WAV   file!", infilename ) ; return WAVPACK

Fix:
<S2SV_ModStart> char * buff ; if ( bytes_to_copy < 0 || bytes_to_copy > 4194304 ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.WAV <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } buff
Buggy code:
 static int sanitize_ptr_alu ( struct bpf_verifier_env * env, struct bpf_insn * insn, const struct bpf_reg_state * ptr_reg, const struct bpf_reg_state * off_reg, struct bpf_reg_state * dst_reg, struct bpf_insn_aux_data * tmp_aux, const bool commit_window ) { struct bpf_insn_aux_data * aux = commit_window? cur_aux ( env ) : tmp_aux ; struct bpf_verifier_state * vstate = env -> cur_state ; <START_BUG> bool off_is_neg = off_reg -> smin_value < 0 ; <END_BUG> bool ptr_is_dst_reg = ptr_reg == dst_reg ; u8 opcode = BPF_OP ( insn -> code ) ; u32 alu_state, alu_limit ; struct bpf_reg_state tmp ; bool ret ; int err ; if ( can_skip_alu_sanitation ( env, insn ) ) return 0 ; if ( vstate -> speculative ) goto do_sim ; err = retrieve_ptr_limit ( ptr_reg, off_reg, & alu_limit, opcode ) ; if ( err < 0 ) return err ; if ( commit_window ) { alu_state = tmp_aux -> alu_state ; alu_limit = abs ( tmp_aux -> alu_limit - alu_limit ) ; } else {  alu_state = off_is_neg? BPF_ALU_NEG_VALUE : 0 ; <START_BUG> alu_state |= ptr_is_dst_reg? BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST ; } err = update_alu_sanitation_state ( aux, alu_state, alu_limit ) ; if ( err < 0 ) return err ; do_sim : if ( commit_window ) return 0 ; if (! ptr_is_dst_reg ) { tmp = * dst_reg ; * dst_reg = * ptr_reg ; } ret = push_stack ( env, env -> insn_idx + 1, env -> insn_idx, true ) ; if (! ptr_is_dst_reg && ret ) * dst_<END_BUG>

Fix:
<S2SV_ModStart> cur_state ; bool off_is_imm = tnum_is_const ( off_reg -> var_off ) ; bool <S2SV_ModStart> off_is_neg? BPF_ALU_NEG_VALUE : 0 ; alu_state |= off_is_imm? BPF_ALU_IMMEDIATE
Buggy code:
 static void txfm_rd_in_plane ( MACROBLOCK * x, int * rate, int64_t * distortion, int * skippable, int64_t * sse, int64_t ref_best_rd, int plane, BLOCK_SIZE bsize, TX_SIZE tx_size, int use_fast_coef_casting ) { MACROBLOCKD * const xd = & x -> e_mbd ; const struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <START_BUG> struct rdcost_block_args args = { 0 } ; <END_BUG> args. x = x ; args. best_rd = ref_best_rd ;  args. use_fast_coef_costing = use_fast_coef_casting ; <START_BUG> if ( plane == 0 ) xd -> mi [ 0 ] -> mbmi. tx_size = tx_size ; vp9_get_entropy_contexts ( bsize, tx_size, pd, args. t_above, args. t_left ) ; args. so = get_scan ( xd, tx_size, pd -> plane_type, 0 ) ; vp9_foreach_transformed_block_in_plane ( xd, bsize, plane, block_rd_txfm, & args ) ; <END_BUG> if ( args. skip ) {  * rate = INT_MAX ; * distortion = INT64_MAX ; * sse = INT64_MAX ; * skippable = 0 ; } else { * distortion = args. this_dist ; * rate = args. this_rate ; * sse = args. this_sse ; <START_BUG> * skippable = vp9_is_skippable_in_plane ( x, bsize, plane ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> struct rdcost_block_args args ; vp9_zero ( args ) <S2SV_ModEnd> ; args. <S2SV_ModStart> use_fast_coef_costing = use_fast_coef_casting ; args. skippable = 1 <S2SV_ModStart> ( args. exit_early <S2SV_ModEnd> ) { * <S2SV_ModStart> * skippable = args. skippable <S2SV_ModEnd> ; } }
Buggy code:
 l_int32 gplotGenCommandFile ( GPLOT * gplot ) { <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> char * cmdstr, * plottitle, * dataname ; l_int32 i, plotstyle, nplots ; FILE * fp ; PROCNAME ( "gplotGenCommandFile" ) ; if (! gplot ) return ERROR_INT ( "gplot   not   defined", procName, 1 ) ; sarrayClear ( gplot -> cmddata ) ; if ( gplot -> title ) {  snprintf ( buf, L_BUF_SIZE, "set   title   \'%s\'", gplot -> title ) ; <START_BUG> sarrayAddString ( gplot -> cmddata, buf, L_COPY ) ; } if ( gplot -> xlabel ) { <END_BUG> snprintf ( buf, L_BUF_SIZE, "set   xlabel   \'%s\'", gplot -> xlabel ) ;  sarrayAddString ( gplot -> cmddata, buf, L_COPY ) ; } if ( gplot -> ylabel ) { <START_BUG> snprintf ( buf, L_BUF_SIZE, "set   ylabel   \'%s\'", gplot -> ylabel ) ; <END_BUG> sarrayAddString ( gplot -> cmddata, buf, L_COPY ) ; } if ( gplot -> outformat == GPLOT_PNG ) {  snprintf ( buf, L_BUF_SIZE, "set   terminal   png;   set   output   \'%s\'", <START_BUG> gplot -> outname ) ; } else if ( gplot -> outformat == GPLOT_PS ) { <END_BUG> snprintf ( buf, L_BUF_SIZE, "set   terminal   postscript;   set   output   \'%s\'",  gplot -> outname ) ; } else if ( gplot -> outformat == GPLOT_EPS ) { <START_BUG> snprintf ( buf, L_BUF_SIZE, <END_BUG> "set   terminal   postscript   eps;   set   output   \'%s\'", gplot -> outname ) ; } else if ( gplot -> outformat == GPLOT_LATEX ) {  snprintf ( buf, L_BUF_SIZE, "set   terminal   latex;   set   output   \'%s

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> title <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> xlabel <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> ylabel <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> terminal <S2SV_blank> png; <S2SV_blank> set <S2SV_blank> output <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> terminal <S2SV_blank> postscript; <S2SV_blank> set <S2SV_blank> output <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> terminal <S2SV_blank> postscript <S2SV_blank> eps; <S2SV_blank> set <S2SV_blank> output <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> terminal <S2SV_blank> latex; <S2SV_blank> set <S2SV_blank> output <S2SV_blank> \'%s\'", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> logscale <S2SV_blank> x" ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "set <S2SV_blank> logscale <S2SV_blank> y" ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "plot <S2SV_blank> \'
Buggy code:
 static int iscsi_add_notunderstood_response ( char * key, char * value, struct iscsi_param_list * param_list ) { struct iscsi_extra_response * extra_response ; if ( strlen ( value ) > VALUE_MAXLEN ) { pr_err ( "Value   for   notunderstood   key   \\"%s\\"   exceeds   %d," "   protocol   error.\\n", key, VALUE_MAXLEN ) ; return - 1 ; } extra_response = kzalloc ( sizeof ( struct iscsi_extra_response ), GFP_KERNEL ) ; if (! extra_response ) { pr_err ( "Unable   to   allocate   memory   for" "   struct   iscsi_extra_response.\\n" ) ; return - 1 ; } INIT_LIST_HEAD ( & extra_response -> er_list ) ; <START_BUG> strncpy ( extra_response -> key, key, strlen ( key ) + 1 ) ; <END_BUG> strncpy ( extra_response -> value, NOTUNDERSTOOD,  strlen ( NOTUNDERSTOOD ) + 1 ) ; <START_BUG> list_add_tail ( & extra_response -> er_list, & param_list -> extra_response_list ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> er_list ) ; strlcpy <S2SV_ModEnd> ( extra_response -> <S2SV_ModStart>, key, sizeof ( extra_response -> key ) ) ; strlcpy <S2SV_ModEnd> ( extra_response -> <S2SV_ModStart>, NOTUNDERSTOOD, sizeof ( extra_response -> value ) <S2SV_ModEnd> ) ; list_add_tail
Buggy code:
 static int l2tp_ip_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; size_t copied = 0 ; int err = - EOPNOTSUPP ; struct sockaddr_in * sin = ( struct sockaddr_in * ) msg -> msg_name ; struct sk_buff * skb ; if ( flags & MSG_OOB ) <START_BUG> goto out ; <END_BUG> if ( addr_len ) * addr_len = sizeof ( * sin ) ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto done ; sock_recv_timestamp ( msg, sk, skb ) ; if ( sin ) { sin -> sin_family = AF_INET ; sin -> sin_addr. s_addr = ip_hdr ( skb ) -> saddr ; sin -> sin_port = 0 ; memset ( & sin -> sin_zero, 0, sizeof ( sin -> sin_zero ) ) ;  } <START_BUG> if ( inet -> cmsg_flags ) ip_cmsg_recv ( msg, skb ) ; if ( flags & MSG_TRUNC ) copied = skb -> len ; done : skb_free_datagram ( sk, skb ) ; out : return err? err : copied ; }<END_BUG>

Fix:
<S2SV_ModStart> ) goto out <S2SV_ModEnd> ; skb = <S2SV_ModStart> ) ) ; * addr_len = sizeof ( * sin ) ;
Buggy code:
 static int l2cap_sock_getname ( struct socket * sock, struct sockaddr * addr, int * len, int peer ) { struct sockaddr_l2 * la = ( struct sockaddr_l2 * ) addr ; struct sock * sk = sock -> sk ; struct l2cap_chan * chan = l2cap_pi ( sk ) -> chan ; <START_BUG> BT_DBG ( "sock   %p,   sk   %p", sock, sk ) ; <END_BUG> addr -> sa_family = AF_BLUETOOTH ; * len = sizeof ( struct sockaddr_l2 ) ; if ( peer ) { la -> l2_psm = chan -> psm ; bacpy ( & la -> l2_bdaddr, & bt_sk ( sk ) -> dst ) ; la -> l2_cid = cpu_to_le16 ( chan -> dcid ) ; } else { la -> l2_psm = chan -> sport ; bacpy ( & la -> l2_bdaddr, & bt_sk ( sk ) -> src ) ; la -> l2_cid = cpu_to_le16 ( chan -> scid ) ; } return 0 ; }

Fix:
<S2SV_ModStart> sock, sk ) ; memset ( la, 0, sizeof ( struct sockaddr_l2 )
Buggy code:
 static void update_exception_bitmap ( struct kvm_vcpu * vcpu ) { u32 eb ; eb = ( 1u << PF_VECTOR ) | ( 1u << UD_VECTOR ) | ( 1u << MC_VECTOR ) | <START_BUG> ( 1u << NM_VECTOR ) | ( 1u << DB_VECTOR ) ; <END_BUG> if ( ( vcpu -> guest_debug & ( KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP ) ) == ( KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP ) ) eb |= 1u << BP_VECTOR ; if ( to_vmx ( vcpu ) -> rmode. vm86_active ) eb = ~ 0 ; if ( enable_ept ) eb &= ~ ( 1u << PF_VECTOR ) ; if ( vcpu -> fpu_active ) eb &= ~ ( 1u << NM_VECTOR ) ; if ( is_guest_mode ( vcpu ) ) eb |= get_vmcs12 ( vcpu ) -> exception_bitmap ; vmcs_write32 ( EXCEPTION_BITMAP, eb ) ; }

Fix:
<S2SV_ModStart> 1u << DB_VECTOR ) | ( 1u << AC_VECTOR
Buggy code:
 static int get_task_ioprio ( struct task_struct * p ) { int ret ; ret = security_task_getioprio ( p ) ; if ( ret ) goto out ; ret = IOPRIO_PRIO_VALUE ( IOPRIO_CLASS_NONE, IOPRIO_NORM ) ; <START_BUG> if ( p -> io_context ) <END_BUG> ret = p -> io_context -> ioprio ;  out : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> IOPRIO_NORM ) ; task_lock ( p ) ; <S2SV_ModStart> -> ioprio ; task_unlock ( p ) ;
Buggy code:
 static int adjust_ptr_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, const struct bpf_reg_state * ptr_reg, const struct bpf_reg_state * off_reg ) { struct bpf_verifier_state * vstate = env -> cur_state ; struct bpf_func_state * state = vstate -> frame [ vstate -> curframe ] ; struct bpf_reg_state * regs = state -> regs, * dst_reg ; bool known = tnum_is_const ( off_reg -> var_off ) ; s64 smin_val = off_reg -> smin_value, smax_val = off_reg -> smax_value, smin_ptr = ptr_reg -> smin_value, smax_ptr = ptr_reg -> smax_value ; u64 umin_val = off_reg -> umin_value, umax_val = off_reg -> umax_value, umin_ptr = ptr_reg -> umin_value, umax_ptr = ptr_reg -> umax_value ; u32 dst = insn -> dst_reg, src = insn -> src_reg ; <START_BUG> u8 opcode = BPF_OP ( insn -> code ) ; <END_BUG> dst_reg = & regs [ dst ] ; if ( ( known && ( smin_val!= smax_val || umin_val!= umax_val ) ) || smin_val > smax_val || umin_val > umax_val ) { __mark_reg_unknown ( dst_reg ) ; return 0 ; } if ( BPF_CLASS ( insn -> code )!= BPF_ALU64 ) { verbose ( env, "R%d   32-bit   pointer   arithmetic   prohibited\\n", dst ) ; return - EACCES ; } switch ( ptr_reg -> type ) { case PTR_TO_MAP_VALUE_OR_NULL : verbose ( env, "R%d   pointer   arithmetic   on   %s   prohibited,   null-check   it   first\\n", dst, reg_type_str [ ptr_reg -> type ] ) ; return - EACCES ; case CONST_PTR_TO_MAP : case PTR

Fix:
<S2SV_ModStart> -> code ) ; int ret <S2SV_ModStart> case BPF_ADD : ret = sanitize_ptr_alu ( env, insn, ptr_reg, dst_reg, smin_val < 0 ) ; if ( ret < 0 ) { verbose ( env, "R%d <S2SV_blank> tried <S2SV_blank> to <S2SV_blank> add <S2SV_blank> from <S2SV_blank> different <S2SV_blank> maps <S2SV_blank> or <S2SV_blank> paths\\n", dst ) ; return ret ; } <S2SV_ModStart> case BPF_SUB : ret = sanitize_ptr_alu ( env, insn, ptr_reg, dst_reg, smin_val < 0 ) ; if ( ret < 0 ) { verbose ( env, "R%d <S2SV_blank> tried <S2SV_blank> to <S2SV_blank> sub <S2SV_blank> from <S2SV_blank> different <S2SV_blank> maps <S2SV_blank> or <S2SV_blank> paths\\n", dst ) ; return ret ; }
Buggy code:
 static int64_t rd_pick_intra_sby_mode ( VP9_COMP * cpi, MACROBLOCK * x, int * rate, int * rate_tokenonly, int64_t * distortion, int * skippable, BLOCK_SIZE bsize, <START_BUG> int64_t tx_cache [ TX_MODES ], <END_BUG> int64_t best_rd ) {  MB_PREDICTION_MODE mode ; <START_BUG> MB_PREDICTION_MODE mode_selected = DC_PRED ; MACROBLOCKD * const xd = & x -> e_mbd ; MODE_INFO * const mic = xd -> mi [ 0 ] ; int this_rate, this_rate_tokenonly, s ; int64_t this_distortion, this_rd ; TX_SIZE best_tx = TX_4X4 ; <END_BUG> int i ;  int * bmode_costs = x -> mbmode_cost ; if ( cpi -> sf. tx_size_search_method == USE_FULL_RD ) for ( i = 0 ; i < TX_MODES ; i ++ ) tx_cache [ i ] = INT64_MAX ; for ( mode = DC_PRED ; mode <= TM_PRED ; mode ++ ) { int64_t local_tx_cache [ TX_MODES ] ; MODE_INFO * above_mi = xd -> mi [ - xd -> mi_stride ] ; MODE_INFO * left_mi = xd -> left_available? xd -> mi [ - 1 ] : NULL ; if (! ( cpi -> sf. intra_y_mode_mask [ max_txsize_lookup [ bsize ] ] & ( 1 << mode ) ) ) continue ; if ( cpi -> common. frame_type == KEY_FRAME ) { const MB_PREDICTION_MODE A = vp9_above_block_mode ( mic, above_mi, 0 ) ; const MB_PREDICTION_MODE L = vp9_left_block_mode ( mic, left_mi, 0 ) ; bmode_costs = x -> y_mode_costs [ A ] [ L ] ; <START_BUG> } <END_BUG> mic -> mbmi. mode = mode ;  intra_super_block_yrd ( cpi, x, & this_rate_tokenonly, & this

Fix:
<S2SV_ModStart> bsize, int64_t <S2SV_ModEnd> best_rd ) { <S2SV_ModStart> best_rd ) { PREDICTION_MODE mode ; PREDICTION_MODE <S2SV_ModEnd> mode_selected = DC_PRED <S2SV_ModStart> TX_4X4 ; int * bmode_costs ; const MODE_INFO * above_mi = xd -> above_mi ; const MODE_INFO * left_mi = xd -> left_mi ; const PREDICTION_MODE A = vp9_above_block_mode ( mic, above_mi, 0 ) ; const PREDICTION_MODE L = vp9_left_block_mode ( mic, left_mi, 0 ) ; bmode_costs = cpi <S2SV_ModEnd> -> y_mode_costs [ <S2SV_ModStart> L ] ; memset ( x -> skip_txfm, SKIP_TXFM_NONE, sizeof ( x -> skip_txfm ) ) ; for ( mode = DC_PRED ; mode <= TM_PRED ; mode ++ ) { if ( cpi -> sf. use_nonrd_pick_mode ) { if ( conditional_skipintra ( mode, mode_selected ) ) continue ; if ( * skippable ) break ; <S2SV_ModStart> =
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * frame ) { AVFilterContext * ctx = inlink -> dst ; FieldOrderContext * s = ctx -> priv ; AVFilterLink * outlink = ctx -> outputs [ 0 ] ; int h, plane, line_step, line_size, line ; uint8_t * data ; if (! frame -> interlaced_frame || frame -> top_field_first == s -> dst_tff ) return ff_filter_frame ( outlink, frame ) ; av_dlog ( ctx, "picture   will   move   %s   one   line\\n", s -> dst_tff? "up" : "down" ) ; h = frame -> height ; <START_BUG> for ( plane = 0 ; plane < 4 && frame -> data [ plane ] ; plane ++ ) { <END_BUG> line_step = frame -> linesize [ plane ] ; line_size = s -> line_size [ plane ] ; data = frame -> data [ plane ] ; if ( s -> dst_tff ) { for ( line = 0 ; line < h ; line ++ ) { if ( 1 + line < frame -> height ) { memcpy ( data, data + line_step, line_size ) ; } else { memcpy ( data, data - line_step - line_step, line_size ) ; } data += line_step ; } } else { data += ( h - 1 ) * line_step ; for ( line = h - 1 ; line >= 0 ; line -- ) { if ( line > 0 ) { memcpy ( data, data - line_step, line_size ) ; } else { memcpy ( data, data + line_step + line_step, line_size ) ; } data -= line_step ; } } } frame -> top_field_first = s -> dst_tff ; return ff_filter_frame ( outlink, frame ) ; }

Fix:
<S2SV_ModStart> [ plane ] && frame -> linesize [ plane ]
Buggy code:
 static krb5_error_code decode_atype ( const taginfo * t, const uint8_t * asn1, size_t len, const struct atype_info * a, void * val ) { krb5_error_code ret ; switch ( a -> type ) { case atype_fn : { const struct fn_info * fn = a -> tinfo ; assert ( fn -> dec!= NULL ) ; return fn -> dec ( t, asn1, len, val ) ; } case atype_sequence : return decode_sequence ( asn1, len, a -> tinfo, val ) ; case atype_ptr : { const struct ptr_info * ptrinfo = a -> tinfo ; void * ptr = LOADPTR ( val, ptrinfo ) ; assert ( ptrinfo -> basetype!= NULL ) ; if ( ptr!= NULL ) { return decode_atype ( t, asn1, len, ptrinfo -> basetype, ptr ) ; } else { ret = decode_atype_to_ptr ( t, asn1, len, ptrinfo -> basetype, & ptr ) ; if ( ret ) return ret ; STOREPTR ( ptr, ptrinfo, val ) ; break ; } } case atype_offset : { const struct offset_info * off = a -> tinfo ; assert ( off -> basetype!= NULL ) ; return decode_atype ( t, asn1, len, off -> basetype, ( char * ) val + off -> dataoff ) ; } case atype_optional : { const struct optional_info * opt = a -> tinfo ; return decode_atype ( t, asn1, len, opt -> basetype, val ) ; } case atype_counted : { const struct counted_info * counted = a -> tinfo ; void * dataptr = ( char * ) val + counted -> dataoff ; size_t count ; assert ( counted -> basetype!= NULL ) ; ret = decode_cntype ( t, asn1, len, counted -> basetype, dataptr, & count ) ; if ( ret ) return ret ; return store_count ( count, counted, val ) ; } case atype_tagged_thing : { const struct tagged_info * tag = a -> tinfo ; taginfo inner_tag ; const taginfo * tp = t ; const uint8_t * rem ; size_t rlen ; if (! tag -> implicit

Fix:
<S2SV_ModStart>, & rlen, 0
Buggy code:
 static int crypto_report_one ( struct crypto_alg * alg, struct crypto_user_alg * ualg, struct sk_buff * skb ) { <START_BUG> strlcpy ( ualg -> cru_name, alg -> cra_name, sizeof ( ualg -> cru_name ) ) ; <END_BUG>  strlcpy ( ualg -> cru_driver_name, alg -> cra_driver_name, <START_BUG> sizeof ( ualg -> cru_driver_name ) ) ; <END_BUG> strlcpy ( ualg -> cru_module_name, module_name ( alg -> cra_module ),  sizeof ( ualg -> cru_module_name ) ) ; ualg -> cru_type = 0 ; ualg -> cru_mask = 0 ; ualg -> cru_flags = alg -> cra_flags ; ualg -> cru_refcnt = refcount_read ( & alg -> cra_refcnt ) ; if ( nla_put_u32 ( skb, CRYPTOCFGA_PRIORITY_VAL, alg -> cra_priority ) ) goto nla_put_failure ; if ( alg -> cra_flags & CRYPTO_ALG_LARVAL ) { struct crypto_report_larval rl ; <START_BUG> strlcpy ( rl. type, "larval", sizeof ( rl. type ) ) ; <END_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_LARVAL, sizeof ( struct crypto_report_larval ), & rl ) ) goto nla_put_failure ; goto out ; } if ( alg -> cra_type && alg -> cra_type -> report ) { if ( alg -> cra_type -> report ( skb, alg ) ) goto nla_put_failure ; goto out ; } switch ( alg -> cra_flags & ( CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_LARVAL ) ) { case CRYPTO_ALG_TYPE_CIPHER : if ( crypto_report_cipher ( skb, alg ) ) goto nla_put_failure ; break ; case CRYPTO_ALG_TYPE_COMPRESS : if ( crypto_report_comp ( skb, alg ) ) goto nla_put_failure ; break ; case CRYPTO_ALG

Fix:
<S2SV_ModStart> skb ) { strncpy <S2SV_ModEnd> ( ualg -> <S2SV_ModStart> ) ) ; strncpy <S2SV_ModEnd> ( ualg -> <S2SV_ModStart> ) ) ; strncpy <S2SV_ModEnd> ( ualg -> <S2SV_ModStart> crypto_report_larval rl ; strncpy <S2SV_ModEnd> ( rl.
Buggy code:
 static int cypress_open ( struct tty_struct * tty, struct usb_serial_port * port ) { struct cypress_private * priv = usb_get_serial_port_data ( port ) ; struct usb_serial * serial = port -> serial ; unsigned long flags ; int result = 0 ; if (! priv -> comm_is_ok ) return - EIO ; usb_clear_halt ( serial -> dev, 0x81 ) ; usb_clear_halt ( serial -> dev, 0x02 ) ; spin_lock_irqsave ( & priv -> lock, flags ) ; priv -> bytes_in = 0 ; priv -> bytes_out = 0 ; priv -> cmd_count = 0 ; priv -> rx_flags = 0 ; spin_unlock_irqrestore ( & priv -> lock, flags ) ; cypress_send ( port ) ; if ( tty ) cypress_set_termios ( tty, port, & priv -> tmp_termios ) ; <START_BUG> if (! port -> interrupt_in_urb ) { <END_BUG> dev_err ( & port -> dev, "%s   -   interrupt_in_urb   is   empty!\\n", __func__ ) ; return - 1 ; } usb_fill_int_urb ( port -> interrupt_in_urb, serial -> dev, usb_rcvintpipe ( serial -> dev, port -> interrupt_in_endpointAddress ), port -> interrupt_in_urb -> transfer_buffer, port -> interrupt_in_urb -> transfer_buffer_length, cypress_read_int_callback, port, priv -> read_urb_interval ) ; result = usb_submit_urb ( port -> interrupt_in_urb, GFP_KERNEL ) ; if ( result ) { dev_err ( & port -> dev, "%s   -   failed   submitting   read   urb,   error   %d\\n", __func__, result ) ; cypress_set_dead ( port ) ; } return result ; }

Fix:
<S2SV_ModStart> tmp_termios ) ; <S2SV_ModEnd> usb_fill_int_urb ( port
Buggy code:
 static void kvmclock_reset ( struct kvm_vcpu * vcpu ) { <START_BUG> if ( vcpu -> arch. time_page ) { <END_BUG> kvm_release_page_dirty ( vcpu -> arch. time_page ) ; vcpu -> arch. time_page = NULL ; } }

Fix:
<S2SV_ModStart> vcpu ) { <S2SV_ModEnd> vcpu -> arch <S2SV_ModStart> -> arch. pv_time_enabled = false ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 WORD32 ih264d_parse_islice_data_cavlc ( dec_struct_t * ps_dec, dec_slice_params_t * ps_slice, UWORD16 u2_first_mb_in_slice ) { UWORD8 uc_more_data_flag ; UWORD8 u1_num_mbs, u1_mb_idx ; dec_mb_info_t * ps_cur_mb_info ; deblk_mb_t * ps_cur_deblk_mb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD16 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; WORD16 i2_cur_mb_addr ; UWORD8 u1_mbaff ; UWORD8 u1_num_mbs_next, u1_end_of_row, u1_tfr_n_mb ; WORD32 ret = OK ; ps_dec -> u1_qp = ps_slice -> u1_slice_qp ; ih264d_update_qp ( ps_dec, 0 ) ; u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; u1_mb_idx = ps_dec -> u1_mb_idx ; u1_num_mbs = u1_mb_idx ; uc_more_data_flag = 1 ; i2_cur_mb_addr = u2_first_mb_in_slice << u1_mbaff ; do { UWORD8 u1_mb_type ; ps_dec -> pv_prev_mb_parse_tu_coeff_data = ps_dec -> pv_parse_tu_coeff_data ; if ( i2_cur_mb_addr > ps_dec -> ps_cur_sps -> u2_max_mb_addr ) { ret = ERROR_MB_ADDRESS_T ; break ; } ps_cur_mb_info = ps

Fix:
<S2SV_ModStart> u1_num_mbs ++ ; <S2SV_ModEnd> u1_num_mbs_next = i2_pic_wdin_mbs <S2SV_ModStart> ) ; } ps_dec -> u2_total_mbs_coded += u1_num_mbs ;
Buggy code:
 void WT_VoiceGain ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_I32 * pMixBuffer ; EAS_PCM * pInputBuffer ; EAS_I32 gain ; EAS_I32 gainIncrement ; EAS_I32 tmp0 ; EAS_I32 tmp1 ; EAS_I32 tmp2 ; EAS_I32 numSamples ; # if ( NUM_OUTPUT_CHANNELS == 2 ) EAS_I32 gainLeft, gainRight ; # endif numSamples = pWTIntFrame -> numSamples ; if ( numSamples <= 0 ) { <START_BUG> ALOGE ( "b//26366256" ) ; <END_BUG> return ; } pMixBuffer = pWTIntFrame -> pMixBuffer ; pInputBuffer = pWTIntFrame -> pAudioBuffer ; gainIncrement = ( pWTIntFrame -> frame. gainTarget - pWTIntFrame -> prevGain ) << ( 16 - SYNTH_UPDATE_PERIOD_IN_BITS ) ; if ( gainIncrement < 0 ) gainIncrement ++ ; gain = pWTIntFrame -> prevGain << 16 ; # if ( NUM_OUTPUT_CHANNELS == 2 ) gainLeft = pWTVoice -> gainLeft ; gainRight = pWTVoice -> gainRight ; # endif while ( numSamples -- ) { tmp0 = * pInputBuffer ++ ; gain += gainIncrement ; tmp2 = gain >> 16 ; tmp2 *= tmp0 ; # if ( NUM_OUTPUT_CHANNELS == 2 ) tmp2 = tmp2 >> 14 ; tmp1 = * pMixBuffer ; tmp0 = tmp2 * gainLeft ; tmp0 = tmp0 >> NUM_MIXER_GUARD_BITS ; tmp1 += tmp0 ; * pMixBuffer ++ = tmp1 ; tmp1 = * pMixBuffer ; tmp0 = tmp2 * gainRight ; tmp0 = tmp0 >> NUM_MIXER_GUARD_BITS ; tmp1 += tmp0 ; * pMixBuffer ++ = tmp1 ; # else tmp1 = * pMixBuffer ; tmp2 = tmp2 >> ( NUM_MIXER_GUARD_BITS - 1 ) ; tmp1 += tmp2 ; * pMixBuffer ++ = tmp1 ; # endif } }

Fix:
<S2SV_ModStart> ALOGE ( "b//26366256" ) ; android_errorWriteLog ( 0x534e4554, "26366256"
Buggy code:
 static int sctp_init_sock ( struct sock * sk ) { struct net * net = sock_net ( sk ) ; struct sctp_sock * sp ; pr_debug ( "%s:   sk:%p\\n", __func__, sk ) ; sp = sctp_sk ( sk ) ; switch ( sk -> sk_type ) { case SOCK_SEQPACKET : sp -> type = SCTP_SOCKET_UDP ; break ; case SOCK_STREAM : sp -> type = SCTP_SOCKET_TCP ; break ; default : return - ESOCKTNOSUPPORT ; } sp -> default_stream = 0 ; sp -> default_ppid = 0 ; sp -> default_flags = 0 ; sp -> default_context = 0 ; sp -> default_timetolive = 0 ; sp -> default_rcv_context = 0 ; sp -> max_burst = net -> sctp. max_burst ; sp -> sctp_hmac_alg = net -> sctp. sctp_hmac_alg ; sp -> initmsg. sinit_num_ostreams = sctp_max_outstreams ; sp -> initmsg. sinit_max_instreams = sctp_max_instreams ; sp -> initmsg. sinit_max_attempts = net -> sctp. max_retrans_init ; sp -> initmsg. sinit_max_init_timeo = net -> sctp. rto_max ; sp -> rtoinfo. srto_initial = net -> sctp. rto_initial ; sp -> rtoinfo. srto_max = net -> sctp. rto_max ; sp -> rtoinfo. srto_min = net -> sctp. rto_min ; sp -> assocparams. sasoc_asocmaxrxt = net -> sctp. max_retrans_association ; sp -> assocparams. sasoc_number_peer_destinations = 0 ; sp -> assocparams. sasoc_peer_rwnd = 0 ; sp -> assocparams. sasoc_local_rwnd = 0 ; sp -> assocparams. sasoc_cookie_life = net -> sctp. valid_cookie_life ; memset ( & sp -> subscribe, 0, sizeof ( struct sctp_event_subscribe ) ) ; sp -> hbinterval = net -> sct

Fix:
<S2SV_ModStart> default_auto_asconf ) { spin_lock ( & sock_net ( sk ) -> sctp. addr_wq_lock ) ; <S2SV_ModStart> do_auto_asconf = 1 ; spin_unlock ( & sock_net ( sk ) -> sctp. addr_wq_lock ) <S2SV_ModStart> ; } else { <S2SV_ModStart> = 0 ; }
Buggy code:
 TEE_Result tee_mmu_check_access_rights ( const struct user_ta_ctx * utc, uint32_t flags, uaddr_t uaddr, size_t len ) { uaddr_t a ; <START_BUG> size_t addr_incr = MIN ( CORE_MMU_USER_CODE_SIZE, <END_BUG> CORE_MMU_USER_PARAM_SIZE ) ;  if ( ADD_OVERFLOW ( uaddr, len, & a ) ) <START_BUG> return TEE_ERROR_ACCESS_DENIED ; if ( ( flags & TEE_MEMORY_ACCESS_NONSECURE ) && ( flags & TEE_MEMORY_ACCESS_SECURE ) ) return TEE_ERROR_ACCESS_DENIED ; if (! ( flags & TEE_MEMORY_ACCESS_ANY_OWNER ) &&! tee_mmu_is_vbuf_inside_ta_private ( utc, ( void * ) uaddr, len ) ) return TEE_ERROR_ACCESS_DENIED ; <END_BUG> for ( a = uaddr ; a < ( uaddr + len ) ; a += addr_incr ) {  uint32_t attr ; TEE_Result res ; res = tee_mmu_user_va2pa_attr ( utc, ( void * ) a, NULL, & attr ) ; if ( res!= TEE_SUCCESS ) return res ; if ( ( flags & TEE_MEMORY_ACCESS_NONSECURE ) && ( attr & TEE_MATTR_SECURE ) ) return TEE_ERROR_ACCESS_DENIED ; if ( ( flags & TEE_MEMORY_ACCESS_SECURE ) &&! ( attr & TEE_MATTR_SECURE ) ) return TEE_ERROR_ACCESS_DENIED ; if ( ( flags & TEE_MEMORY_ACCESS_WRITE ) &&! ( attr & TEE_MATTR_UW ) ) return TEE_ERROR_ACCESS_DENIED ; if ( ( flags & TEE_MEMORY_ACCESS_READ ) &&! ( attr & TEE_MATTR_UR ) ) return TEE_ERROR_ACCESS_DENIED ; } return TEE_SUCCESS ; }

Fix:
<S2SV_ModStart> uaddr_t a ; uaddr_t end_addr = 0 ; <S2SV_ModStart> len, & end_addr <S2SV_ModEnd> ) ) return <S2SV_ModStart> ( a = ROUNDDOWN ( uaddr, addr_incr ) <S2SV_ModEnd> ; a < <S2SV_ModStart> ; a < end_addr <S2SV_ModEnd> ; a +=
Buggy code:
 NOEXPORT void transfer ( CLI * c ) { int timeout ; int pending ; # if OPENSSL_VERSION_NUMBER >= 0x10100000L int has_pending = 0, prev_has_pending ; # endif <START_BUG> int watchdog = 0 ; <END_BUG> ssize_t num ; int err ; int sock_open_rd = 1, sock_open_wr = 1 ; int shutdown_wants_read = 0, shutdown_wants_write = 0 ; int read_wants_read = 0, read_wants_write = 0 ; int write_wants_read = 0, write_wants_write = 0 ; int sock_can_rd, sock_can_wr, ssl_can_rd, ssl_can_wr ; # ifdef USE_WIN32 unsigned long bytes ; # else int bytes ; # endif c -> sock_ptr = c -> ssl_ptr = 0 ; do { read_wants_read |=! ( SSL_get_shutdown ( c -> ssl ) & SSL_RECEIVED_SHUTDOWN ) && c -> ssl_ptr < BUFFSIZE &&! read_wants_write ; write_wants_write |=! ( SSL_get_shutdown ( c -> ssl ) & SSL_SENT_SHUTDOWN ) && c -> sock_ptr &&! write_wants_read ; s_poll_init ( c -> fds, 0 ) ; if ( sock_open_rd ) s_poll_add ( c -> fds, c -> sock_rfd -> fd, c -> sock_ptr < BUFFSIZE, 0 ) ; if ( sock_open_wr ) s_poll_add ( c -> fds, c -> sock_wfd -> fd, 0, c -> ssl_ptr > 0 ) ; if ( SSL_get_shutdown ( c -> ssl )!= ( SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN ) ) { s_poll_add ( c -> fds, c -> ssl_rfd -> fd, read_wants_read || write_wants_read || shutdown_wants_read, 0 ) ; s_poll_add ( c -> fds, c -> ssl_wfd -> fd, 0, read_wants_write || write_wants_write || shutdown_wants_write ) ; }

Fix:
<S2SV_ModStart> watchdog = 0 <S2SV_ModEnd> ; int err <S2SV_ModStart> shutdown_wants_write ) { int <S2SV_ModStart> -> ssl, <S2SV_ModEnd> num ) ; <S2SV_ModStart> break ; case SSL_ERROR_WANT_WRITE : s_log ( LOG_DEBUG, "SSL_shutdown <S2SV_blank> returned <S2SV_blank> WANT_WRITE: <S2SV_blank> retrying" ) ; shutdown_wants_read = 0 ; shutdown_wants_write = 1 ; break ; case SSL_ERROR_WANT_READ : s_log ( LOG_DEBUG, "SSL_shutdown <S2SV_blank> returned <S2SV_blank> WANT_READ: <S2SV_blank> retrying" ) ; shutdown_wants_read = 1 ; shutdown_wants_write = 0 ; break ; case SSL_ERROR_SSL : sslerror ( "SSL_shutdown" ) ; throw_exception ( c, 1 ) ; case SSL_ERROR_ZERO_RETURN : <S2SV_ModEnd> SSL_set_shutdown ( c <S2SV_ModStart> break ; case SSL_ERROR_SYSCALL : if ( parse_socket_error ( c, "SSL_shutdown" ) ) break ; <S2SV_ModEnd> SSL_set_shutdown ( c <S2SV_ModStart> ; break ; default : s_log ( LOG_ERR, "SSL_shutdown//SSL_get_error <S2SV_blank> returned <S2SV_blank>
Buggy code:
 static MagickPixelPacket * * AcquirePixelThreadSet ( const Image * images ) { const Image * next ; MagickPixelPacket * * pixels ; register ssize_t i, j ; size_t columns, <START_BUG> number_threads ; <END_BUG>  number_threads = ( size_t ) GetMagickResourceLimit ( ThreadResource ) ; <START_BUG> <END_BUG> pixels = ( MagickPixelPacket * * ) AcquireQuantumMemory ( number_threads,  sizeof ( * pixels ) ) ; if ( pixels == ( MagickPixelPacket * * ) NULL ) return ( ( MagickPixelPacket * * ) NULL ) ; <START_BUG> ( void ) memset ( pixels, 0, number_threads * sizeof ( * pixels ) ) ; <END_BUG> columns = images -> columns ; for ( next = images ; next!= ( Image * ) NULL ; next = next -> next ) columns = MagickMax ( next -> columns, columns ) ;  for ( i = 0 ; i < ( ssize_t ) number_threads ; i ++ ) <START_BUG> { pixels [ i ] = ( MagickPixelPacket * ) AcquireQuantumMemory ( columns, sizeof ( * * pixels ) ) ; if ( pixels [ i ] == ( MagickPixelPacket * ) NULL ) return ( DestroyPixelThreadSet ( pixels ) ) ; for ( j = 0 ; j < ( ssize_t ) columns ; j ++ ) GetMagickPixelPacket ( images, & pixels [ i ] [ j ] ) ; } return ( pixels ) ; }<END_BUG>

Fix:
<S2SV_ModStart> size_t columns, rows ; rows = MagickMax ( GetImageListLength ( images ), <S2SV_ModEnd> ( size_t ) <S2SV_ModStart> ( ThreadResource ) ) <S2SV_ModStart> ) AcquireQuantumMemory ( rows, <S2SV_ModEnd> sizeof ( * <S2SV_ModStart> NULL ) ; columns = images -> columns ; for ( next = images ; next!= ( Image * ) NULL ; next = next -> next ) columns = MagickMax ( next -> columns, columns ) ; for ( i = 0 <S2SV_ModEnd> ; i < <S2SV_ModStart> ( ssize_t ) rows <S2SV_ModEnd> ; i ++
Buggy code:
 static ssize_t bat_socket_read ( struct file * file, char __user * buf, size_t count, loff_t * ppos ) { struct socket_client * socket_client = file -> private_data ; struct socket_packet * socket_packet ; size_t packet_len ; int error ; if ( ( file -> f_flags & O_NONBLOCK ) && ( socket_client -> queue_len == 0 ) ) return - EAGAIN ; if ( (! buf ) || ( count < sizeof ( struct icmp_packet ) ) ) return - EINVAL ; if (! access_ok ( VERIFY_WRITE, buf, count ) ) return - EFAULT ; error = wait_event_interruptible ( socket_client -> queue_wait, socket_client -> queue_len ) ; if ( error ) return error ; spin_lock_bh ( & socket_client -> lock ) ; socket_packet = list_first_entry ( & socket_client -> queue_list, struct socket_packet, list ) ; list_del ( & socket_packet -> list ) ; socket_client -> queue_len -- ; spin_unlock_bh ( & socket_client -> lock ) ; <START_BUG> error = copy_to_user ( buf, & socket_packet -> icmp_packet, <END_BUG>  socket_packet -> icmp_len ) ; <START_BUG> packet_len = socket_packet -> icmp_len ; kfree ( socket_packet ) ; if ( error ) return - EFAULT ; return packet_len ; }<END_BUG>

Fix:
<S2SV_ModStart> lock ) ; packet_len = min ( count, socket_packet -> icmp_len ) ; <S2SV_ModStart> -> icmp_packet, packet_len ) <S2SV_ModEnd> ; kfree (
Buggy code:
 void js_RegExp_prototype_exec ( js_State * J, js_Regexp * re, const char * text ) { <START_BUG> int i ; <END_BUG> int opts ; Resub m ; opts = 0 ; if ( re -> flags & JS_REGEXP_G ) { if ( re -> last > strlen ( text ) ) { re -> last = 0 ; js_pushnull ( J ) ; return ; } if ( re -> last > 0 ) { text += re -> last ; opts |= REG_NOTBOL ; } }  if (! js_regexec ( re -> prog, text, & m, opts ) ) { <START_BUG> js_newarray ( J ) ; js_pushstring ( J, text ) ; js_setproperty ( J, - 2, "input" ) ; js_pushnumber ( J, js_utfptrtoidx ( text, m. sub [ 0 ]. sp ) ) ; js_setproperty ( J, - 2, "index" ) ; for ( i = 0 ; i < m. nsub ; ++ i ) { js_pushlstring ( J, m. sub [ i ]. sp, m. sub [ i ]. ep - m. sub [ i ]. sp ) ; js_setindex ( J, - 2, i ) ; } if ( re -> flags & JS_REGEXP_G ) re -> last = re -> last + ( m. sub [ 0 ]. ep - text ) ; return ; } if ( re -> flags & JS_REGEXP_G ) re -> last = 0 ; js_pushnull ( J ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { int result ; int <S2SV_ModStart> ; } } result = <S2SV_ModEnd> js_regexec ( re <S2SV_ModStart>, opts ) ; if ( result < 0 ) js_error ( J, "regexec <S2SV_blank> failed" ) ; if ( result == 0
Buggy code:
 static int check_alu_op ( struct bpf_verifier_env * env, struct bpf_insn * insn ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; int err ; if ( opcode == BPF_END || opcode == BPF_NEG ) { if ( opcode == BPF_NEG ) { if ( BPF_SRC ( insn -> code )!= 0 || insn -> src_reg!= BPF_REG_0 || insn -> off!= 0 || insn -> imm!= 0 ) { verbose ( env, "BPF_NEG   uses   reserved   fields\\n" ) ; return - EINVAL ; } } else { if ( insn -> src_reg!= BPF_REG_0 || insn -> off!= 0 || ( insn -> imm!= 16 && insn -> imm!= 32 && insn -> imm!= 64 ) || BPF_CLASS ( insn -> code ) == BPF_ALU64 ) { verbose ( env, "BPF_END   uses   reserved   fields\\n" ) ; return - EINVAL ; } } err = check_reg_arg ( env, insn -> dst_reg, SRC_OP ) ; if ( err ) return err ; if ( is_pointer_value ( env, insn -> dst_reg ) ) { verbose ( env, "R%d   pointer   arithmetic   prohibited\\n", insn -> dst_reg ) ; return - EACCES ; } err = check_reg_arg ( env, insn -> dst_reg, DST_OP ) ; if ( err ) return err ; } else if ( opcode == BPF_MOV ) { if ( BPF_SRC ( insn -> code ) == BPF_X ) { if ( insn -> imm!= 0 || insn -> off!= 0 ) { verbose ( env, "BPF_MOV   uses   reserved   fields\\n" ) ; return - EINVAL ; } err = check_reg_arg ( env, insn -> src_reg, SRC_OP ) ; if ( err ) return err ; } else { if ( insn -> src_reg!= BPF_REG_0 || insn -> off!= 0 ) { verbose ( env, "BPF_MOV   uses  

Fix:
<S2SV_ModStart> dst_reg ) ; coerce_reg_to_size <S2SV_ModEnd> ( & regs <S2SV_ModStart> -> dst_reg ], 4
Buggy code:
 int main ( int argc, char * argv [ ] ) { static char buff [ 16384 ] ; struct cpio _cpio ; struct cpio * cpio ; const char * errmsg ; int uid, gid ; int opt ; cpio = & _cpio ; memset ( cpio, 0, sizeof ( * cpio ) ) ; cpio -> buff = buff ; cpio -> buff_size = sizeof ( buff ) ; # if defined ( HAVE_SIGACTION ) && defined ( SIGPIPE ) { struct sigaction sa ; sigemptyset ( & sa. sa_mask ) ; sa. sa_flags = 0 ; sa. sa_handler = SIG_IGN ; sigaction ( SIGPIPE, & sa, NULL ) ; } # endif lafe_setprogname ( * argv, "bsdcpio" ) ; # if HAVE_SETLOCALE if ( setlocale ( LC_ALL, "" ) == NULL ) lafe_warnc ( 0, "Failed   to   set   default   locale" ) ; # endif cpio -> uid_override = - 1 ; cpio -> gid_override = - 1 ; cpio -> argv = argv ; cpio -> argc = argc ; cpio -> mode = '\\0' ; cpio -> verbose = 0 ; cpio -> compress = '\\0' ; cpio -> extract_flags = ARCHIVE_EXTRACT_NO_AUTODIR ; cpio -> extract_flags |= ARCHIVE_EXTRACT_NO_OVERWRITE_NEWER ; cpio -> extract_flags |= ARCHIVE_EXTRACT_SECURE_SYMLINKS ; cpio -> extract_flags |= ARCHIVE_EXTRACT_SECURE_NODOTDOT ; <START_BUG> cpio -> extract_flags |= ARCHIVE_EXTRACT_PERM ; <END_BUG> cpio -> extract_flags |= ARCHIVE_EXTRACT_FFLAGS ; cpio -> extract_flags |= ARCHIVE_EXTRACT_ACL ; # if! defined ( _WIN32 ) &&! defined ( __CYGWIN__ ) if ( geteuid ( ) == 0 ) cpio -> extract_flags |= ARCHIVE_EXTRACT_OWNER ; # endif cpio -> bytes_per_block = 512 ; cpio -> filename = NULL ; cpio -> matching = archive_match_new ( ) ; if ( cpio -> matching

Fix:
<S2SV_ModStart> -> extract_flags |= ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS ; cpio -> extract_flags |= <S2SV_ModStart> &= ~ ARCHIVE_EXTRACT_SECURE_NODOTDOT ; cpio -> extract_flags &= ~ ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
Buggy code:
 void traverse_commit_list ( struct rev_info * revs, show_commit_fn show_commit, show_object_fn show_object, void * data ) { int i ; struct commit * commit ; struct strbuf base ; strbuf_init ( & base, PATH_MAX ) ; while ( ( commit = get_revision ( revs ) )!= NULL ) { if ( commit -> tree ) add_pending_tree ( revs, commit -> tree ) ; show_commit ( commit, data ) ; } for ( i = 0 ; i < revs -> pending. nr ; i ++ ) { struct object_array_entry * pending = revs -> pending. objects + i ; struct object * obj = pending -> item ; const char * name = pending -> name ; const char * path = pending -> path ; if ( obj -> flags & ( UNINTERESTING | SEEN ) ) continue ; if ( obj -> type == OBJ_TAG ) { obj -> flags |= SEEN ; <START_BUG> show_object ( obj, NULL, name, data ) ; <END_BUG> continue ; } if (! path ) path = "" ; if ( obj -> type == OBJ_TREE ) { process_tree ( revs, ( struct tree * ) obj, show_object, & base, path, data ) ; continue ; } if ( obj -> type == OBJ_BLOB ) { process_blob ( revs, ( struct blob * ) obj, show_object,  NULL, path, data ) ; <START_BUG> continue ; } die ( "unknown   pending   object   %s   (%s)", oid_to_hex ( & obj -> oid ), name ) ; } object_array_clear ( & revs -> pending ) ; strbuf_release ( & base ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ( obj, <S2SV_ModEnd> name, data <S2SV_ModStart>, show_object, & base <S2SV_ModEnd>, path,
Buggy code:
 int ext2_xattr_set ( struct inode * inode, int name_index, const char * name, const void * value, size_t value_len, int flags ) { struct super_block * sb = inode -> i_sb ; struct buffer_head * bh = NULL ; struct ext2_xattr_header * header = NULL ; struct ext2_xattr_entry * here, * last ; size_t name_len, free, min_offs = sb -> s_blocksize ; int not_found = 1, error ; char * end ; ea_idebug ( inode, "name=%d.%s,   value=%p,   value_len=%ld", name_index, name, value, ( long ) value_len ) ; if ( value == NULL ) value_len = 0 ; if ( name == NULL ) return - EINVAL ; name_len = strlen ( name ) ; if ( name_len > 255 || value_len > sb -> s_blocksize ) return - ERANGE ; down_write ( & EXT2_I ( inode ) -> xattr_sem ) ; if ( EXT2_I ( inode ) -> i_file_acl ) { bh = sb_bread ( sb, EXT2_I ( inode ) -> i_file_acl ) ; error = - EIO ; if (! bh ) goto cleanup ; ea_bdebug ( bh, "b_count=%d,   refcount=%d", atomic_read ( & ( bh -> b_count ) ), le32_to_cpu ( HDR ( bh ) -> h_refcount ) ) ; header = HDR ( bh ) ; end = bh -> b_data + bh -> b_size ; if ( header -> h_magic!= cpu_to_le32 ( EXT2_XATTR_MAGIC ) || header -> h_blocks!= cpu_to_le32 ( 1 ) ) { bad_block : ext2_error ( sb, "ext2_xattr_set", "inode   %ld:   bad   block   %d", inode -> i_ino, EXT2_I ( inode ) -> i_file_acl ) ; error = - EIO ; goto cleanup ; } here = FIRST_ENTRY ( bh ) ; while (! IS_LAST_ENTRY ( here ) ) { struct

Fix:
<S2SV_ModStart> header ) { <S2SV_ModEnd> lock_buffer ( bh <S2SV_ModStart> ) ) { __u32 hash = le32_to_cpu ( header -> h_hash ) ; <S2SV_ModStart> "modifying <S2SV_blank> in-place" ) ; mb2_cache_entry_delete_block ( EXT2_SB ( sb ) -> s_mb_cache, hash, bh -> b_blocknr <S2SV_ModEnd> ) ; } <S2SV_ModStart> { int offset <S2SV_ModEnd> ; unlock_buffer (
Buggy code:
 int build_segment_manager ( struct f2fs_sb_info * sbi ) { struct f2fs_super_block * raw_super = F2FS_RAW_SUPER ( sbi ) ; struct f2fs_checkpoint * ckpt = F2FS_CKPT ( sbi ) ; struct f2fs_sm_info * sm_info ; int err ; sm_info = kzalloc ( sizeof ( struct f2fs_sm_info ), GFP_KERNEL ) ; if (! sm_info ) return - ENOMEM ; sbi -> sm_info = sm_info ; sm_info -> seg0_blkaddr = le32_to_cpu ( raw_super -> segment0_blkaddr ) ; sm_info -> main_blkaddr = le32_to_cpu ( raw_super -> main_blkaddr ) ; sm_info -> segment_count = le32_to_cpu ( raw_super -> segment_count ) ; sm_info -> reserved_segments = le32_to_cpu ( ckpt -> rsvd_segment_count ) ; sm_info -> ovp_segments = le32_to_cpu ( ckpt -> overprov_segment_count ) ; sm_info -> main_segments = le32_to_cpu ( raw_super -> segment_count_main ) ; sm_info -> ssa_blkaddr = le32_to_cpu ( raw_super -> ssa_blkaddr ) ; sm_info -> rec_prefree_segments = sm_info -> main_segments * DEF_RECLAIM_PREFREE_SEGMENTS // 100 ; if ( sm_info -> rec_prefree_segments > DEF_MAX_RECLAIM_PREFREE_SEGMENTS ) sm_info -> rec_prefree_segments = DEF_MAX_RECLAIM_PREFREE_SEGMENTS ; if (! test_opt ( sbi, LFS ) ) sm_info -> ipu_policy = 1 << F2FS_IPU_FSYNC ; sm_info -> min_ipu_util = DEF_MIN_IPU_UTIL ; sm_info -> min_fsync_blocks = DEF_MIN_FSYNC_BLOCKS ; sm_info -> min_hot_blocks = DEF_MIN_HOT_BLOCK

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd>! f2fs_readonly (