nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int jpc_pi_nextcprl ( register jpc_pi_t * pi ) { int rlvlno ; jpc_pirlvl_t * pirlvl ; jpc_pchg_t * pchg ; int prchind ; int prcvind ; int * prclyrno ; uint_fast32_t trx0 ; uint_fast32_t try0 ; uint_fast32_t r ; uint_fast32_t rpx ; uint_fast32_t rpy ; pchg = pi -> pchg ; if (! pi -> prgvolfirst ) { goto skip ; } else { pi -> prgvolfirst = 0 ; } for ( pi -> compno = pchg -> compnostart, pi -> picomp = & pi -> picomps [ pi -> compno ] ; pi -> compno < JAS_CAST ( int, pchg -> compnoend ) && pi -> compno < pi -> numcomps ; ++ pi -> compno, ++ pi -> picomp ) { pirlvl = pi -> picomp -> pirlvls ; <START_BUG> pi -> xstep = pi -> picomp -> hsamp * ( 1 << ( pirlvl -> prcwidthexpn + <END_BUG> pi -> picomp -> numrlvls - 1 ) ) ;  pi -> ystep = pi -> picomp -> vsamp * ( 1 << ( pirlvl -> prcheightexpn + <START_BUG> pi -> picomp -> numrlvls - 1 ) ) ; for ( rlvlno = 1, pirlvl = & pi -> picomp -> pirlvls [ 1 ] ; rlvlno < pi -> picomp -> numrlvls ; ++ rlvlno, ++ pirlvl ) { <END_BUG> pi -> xstep = JAS_MIN ( pi -> xstep, pi -> picomp -> hsamp * ( 1 <<  ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls - rlvlno - 1 ) ) ) ; <START_BUG> pi -> ystep = JAS_MIN ( pi -> ystep, pi -> picomp -> vsamp * ( 1 << <END_BUG> ( pirlvl -> prcheightexpn + pi -> picomp -> numrlvls - rlvlno - 1 ) ) ) ; } for ( pi -> y = pi

Fix:
<S2SV_ModStart> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << <S2SV_ModEnd> ( pirlvl -> <S2SV_ModStart> vsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << <S2SV_ModEnd> ( pirlvl -> <S2SV_ModStart> -> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << <S2SV_ModEnd> ( pirlvl -> <S2SV_ModStart> -> vsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << <S2SV_ModEnd> ( pirlvl ->
Buggy code:
 <START_BUG> void ntlm_free_message_fields_buffer ( NTLM_MESSAGE_FIELDS * fields ) <END_BUG> { if ( fields ) { if ( fields -> Buffer ) { free ( fields -> Buffer ) ; fields -> Len = 0 ; fields -> MaxLen = 0 ; fields -> Buffer = NULL ; fields -> BufferOffset = 0 ; } } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 void iperf_on_connect ( struct iperf_test * test ) { time_t now_secs ; const char * rfc1123_fmt = "%a,   %d   %b   %Y   %H:%M:%S   GMT" ; char now_str [ 100 ] ; char ipr [ INET6_ADDRSTRLEN ] ; int port ; struct sockaddr_storage sa ; struct sockaddr_in * sa_inP ; struct sockaddr_in6 * sa_in6P ; socklen_t len ; int opt ; now_secs = time ( ( time_t * ) 0 ) ; ( void ) strftime ( now_str, sizeof ( now_str ), rfc1123_fmt, gmtime ( & now_secs ) ) ; if ( test -> json_output ) cJSON_AddItemToObject ( test -> json_start, "timestamp", iperf_json_printf ( "time:   %s     timesecs:   %d", now_str, ( int64_t ) now_secs ) ) ; else if ( test -> verbose ) iprintf ( test, report_time, now_str ) ; if ( test -> role == 'c' ) { if ( test -> json_output ) cJSON_AddItemToObject ( test -> json_start, "connecting_to", iperf_json_printf ( "host:   %s     port:   %d", test -> server_hostname, ( int64_t ) test -> server_port ) ) ; else { iprintf ( test, report_connecting, test -> server_hostname, test -> server_port ) ; if ( test -> reverse ) iprintf ( test, report_reverse, test -> server_hostname ) ; } } else { len = sizeof ( sa ) ; getpeername ( test -> ctrl_sck, ( struct sockaddr * ) & sa, & len ) ; if ( getsockdomain ( test -> ctrl_sck ) == AF_INET ) { sa_inP = ( struct sockaddr_in * ) & sa ; inet_ntop ( AF_INET, & sa_inP -> sin_addr, ipr, sizeof ( ipr ) ) ; port = ntohs ( sa_inP -> sin_port ) ; } else { sa_in6P = ( struct sock

Fix:
<S2SV_ModStart> -> mss ) cJSON_AddNumberToObject <S2SV_ModEnd> ( test -> <S2SV_ModStart> len ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( test ->
Buggy code:
 jas_image_t * jas_image_create0 ( ) { jas_image_t * image ; if (! ( image = jas_malloc ( sizeof ( jas_image_t ) ) ) ) { return 0 ; } image -> tlx_ = 0 ; image -> tly_ = 0 ; image -> brx_ = 0 ; image -> bry_ = 0 ; image -> clrspc_ = JAS_CLRSPC_UNKNOWN ; image -> numcmpts_ = 0 ; image -> maxcmpts_ = 0 ; image -> cmpts_ = 0 ; <START_BUG> image -> inmem_ = true ; <END_BUG> image -> cmprof_ = 0 ; return image ; }

Fix:
<S2SV_ModStart> ; image -> <S2SV_ModEnd> cmprof_ = 0
Buggy code:
 static void perf_swevent_event ( struct perf_event * event, u64 nr, <START_BUG> int nmi, struct perf_sample_data * data, <END_BUG> struct pt_regs * regs ) { struct hw_perf_event * hwc = & event -> hw ; local64_add ( nr, & event -> count ) ; if (! regs ) return ; if (! is_sampling_event ( event ) ) return ; if ( nr == 1 && hwc -> sample_period == 1 &&! event -> attr. freq )  return perf_swevent_overflow ( event, 1, nmi, data, regs ) ; <START_BUG> if ( local64_add_negative ( nr, & hwc -> period_left ) ) return ; <END_BUG> perf_swevent_overflow ( event, 0, nmi, data, regs ) ;  }

Fix:
<S2SV_ModStart> u64 nr, <S2SV_ModEnd> struct perf_sample_data * <S2SV_ModStart>, 1, <S2SV_ModEnd> data, regs <S2SV_ModStart>, 0, <S2SV_ModEnd> data, regs
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_

Fix:
<S2SV_ModStart> u4_first_slice_in_pic = 2 ; ps_dec -> u1_first_pb_nal_in_pic = 1
Buggy code:
 error_t rawSocketProcessIpPacket ( NetInterface * interface, IpPseudoHeader * pseudoHeader, const NetBuffer * buffer, size_t offset, NetRxAncillary * ancillary ) { uint_t i ; size_t length ; Socket * socket ; SocketQueueItem * queueItem ; NetBuffer * p ; length = netBufferGetLength ( buffer ) - offset ; for ( i = 0 ; i < SOCKET_MAX_COUNT ; i ++ ) { socket = socketTable + i ; if ( socket -> type!= SOCKET_TYPE_RAW_IP ) continue ; if ( socket -> interface && socket -> interface!= interface ) continue ; # if ( IPV4_SUPPORT == ENABLED ) if ( pseudoHeader -> length == sizeof ( Ipv4PseudoHeader ) ) { if ( socket -> protocol!= pseudoHeader -> ipv4Data. protocol ) continue ; if ( socket -> localIpAddr. length!= 0 ) { if ( socket -> localIpAddr. length!= sizeof ( Ipv4Addr ) ) continue ; if ( socket -> localIpAddr. ipv4Addr!= pseudoHeader -> ipv4Data. destAddr ) continue ; } if ( socket -> remoteIpAddr. length!= 0 ) { if ( socket -> remoteIpAddr. length!= sizeof ( Ipv4Addr ) ) continue ; if ( socket -> remoteIpAddr. ipv4Addr!= pseudoHeader -> ipv4Data. srcAddr ) continue ; } } else # endif # if ( IPV6_SUPPORT == ENABLED ) if ( pseudoHeader -> length == sizeof ( Ipv6PseudoHeader ) ) { if ( socket -> protocol!= pseudoHeader -> ipv6Data. nextHeader ) continue ; if ( socket -> localIpAddr. length!= 0 ) { if ( socket -> localIpAddr. length!= sizeof ( Ipv6Addr ) ) continue ; if (! ipv6CompAddr ( & socket -> localIpAddr. ipv6Addr, & pseudoHeader -> ipv6Data. destAddr ) ) continue ; } if ( socket -> remoteIpAddr. length!= 0 ) { if ( socket -> remoteIpAddr. length!= sizeof ( Ipv6Addr ) ) continue ; if (! ipv6CompAddr ( & socket -> remoteIpAddr. ipv6Addr, & pseudoHeader -> ipv6Data. srcAddr ) ) continue ; } } else # endif { continue ; } break ; } if ( i >= SOCKET_MAX_COUNT

Fix:
<S2SV_ModStart> ; queueItem -> interface = interface ; queueItem ->
Buggy code:
 static void close_output_file ( struct stream_state * stream, unsigned int fourcc ) { const struct vpx_codec_enc_cfg * const cfg = & stream -> config. cfg ; if ( cfg -> g_pass == VPX_RC_FIRST_PASS ) return ; # if CONFIG_WEBM_IO if ( stream -> config. write_webm ) { <START_BUG> write_webm_file_footer ( & stream -> ebml, stream -> hash ) ; <END_BUG> free ( stream -> ebml. cue_list ) ; stream -> ebml. cue_list = NULL ; } # endif if (! stream -> config. write_webm ) { if (! fseek ( stream -> file, 0, SEEK_SET ) ) ivf_write_file_header ( stream -> file, & stream -> config. cfg, fourcc, stream -> frames_out ) ; } fclose ( stream -> file ) ; }

Fix:
<S2SV_ModStart> stream -> ebml ) <S2SV_ModEnd> ; } #
Buggy code:
 static int32_t scsi_send_command ( SCSIRequest * req, uint8_t * buf ) { SCSIDiskReq * r = DO_UPCAST ( SCSIDiskReq, req, req ) ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, req -> dev ) ; int32_t len ; uint8_t command ; <START_BUG> uint8_t * outbuf ; <END_BUG> int rc ;  command = buf [ 0 ] ; <START_BUG> outbuf = ( uint8_t * ) r -> iov. iov_base ; DPRINTF ( "Command:   lun=%d   tag=0x%x   data=0x%02x", req -> lun, req -> tag, buf [ 0 ] ) ; # ifdef DEBUG_SCSI { int i ; for ( i = 1 ; i < r -> req. cmd. len ; i ++ ) { printf ( "   0x%02x", buf [ i ] ) ; } printf ( "\\n" ) ; } # endif switch ( command ) { case TEST_UNIT_READY : case INQUIRY : case MODE_SENSE : case MODE_SENSE_10 : case RESERVE : case RESERVE_10 : case RELEASE : case RELEASE_10 : case START_STOP : case ALLOW_MEDIUM_REMOVAL : case READ_CAPACITY_10 : case READ_TOC : case GET_CONFIGURATION : case SERVICE_ACTION_IN_16 : case VERIFY_10 : <END_BUG> rc = scsi_disk_emulate_command ( r, outbuf ) ;  if ( rc < 0 ) { return 0 ; } r -> iov. iov_len = rc ; break ; case SYNCHRONIZE_CACHE : bdrv_acct_start ( s -> bs, & r -> acct, 0, BDRV_ACCT_FLUSH ) ; r -> req. aiocb = bdrv_aio_flush ( s -> bs, scsi_flush_complete, r ) ; if ( r -> req. aiocb == NULL ) { scsi_flush_complete ( r, - EIO ) ; } return 0 ; case READ_6 : case READ_10 : case READ_12 : case READ_16 : len = r

Fix:
<S2SV_ModStart> uint8_t command ; <S2SV_ModEnd> int rc ; <S2SV_ModStart> [ 0 ] <S2SV_ModEnd> ; DPRINTF ( <S2SV_ModStart> scsi_disk_emulate_command ( r <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> static int t220_frontend_attach ( struct dvb_usb_adapter * d ) <END_BUG> { u8 obuf [ 3 ] = { 0xe, 0x87, 0 } ; u8 ibuf [ ] = { 0 } ;  if ( dvb_usb_generic_rw ( d -> dev, obuf, 3, ibuf, 1, 0 ) < 0 ) <START_BUG> err ( "command   0x0e   transfer   failed." ) ; <END_BUG> obuf [ 0 ] = 0xe ;  <START_BUG> obuf [ 1 ] = 0x86 ; <END_BUG>  obuf [ 2 ] = 1 ; <START_BUG> <END_BUG> if ( dvb_usb_generic_rw ( d -> dev, obuf, 3, ibuf, 1, 0 ) < 0 )  err ( "command   0x0e   transfer   failed." ) ; <START_BUG> obuf [ 0 ] = 0xe ; <END_BUG>  obuf [ 1 ] = 0x80 ; <START_BUG> <END_BUG> obuf [ 2 ] = 0 ;  <START_BUG> if ( dvb_usb_generic_rw ( d -> dev, obuf, 3, ibuf, 1, 0 ) < 0 ) <END_BUG> err ( "command   0x0e   transfer   failed." ) ;  msleep ( 50 ) ; <START_BUG> obuf [ 0 ] = 0xe ; obuf [ 1 ] = 0x80 ; obuf [ 2 ] = 1 ; <END_BUG> if ( dvb_usb_generic_rw ( d -> dev, obuf, 3, ibuf, 1, 0 ) < 0 )  <START_BUG> err ( "command   0x0e   transfer   failed." ) ; <END_BUG> obuf [ 0 ] = 0x51 ; if ( dvb_usb_generic_rw ( d -> dev, obuf, 1, ibuf, 1, 0 ) < 0 ) err ( "command   0x51   transfer   failed." ) ;  d -> fe_adap [ 0 ]. fe = dvb_attach ( cxd2820r_attach, & cxd2820r_config, <START_BUG> <END_BUG> & d -> dev -> i2c_adap, NULL ) ;  <START_BUG> if ( d -> fe_adap [ 0 ]. fe!= NULL ) { <END_BUG>  if ( dvb_attach ( tda18271_attach, d -> fe_adap [ 0 ]. fe, 0x60,

Fix:
<S2SV_ModStart> struct dvb_usb_adapter * adap ) { struct dvb_usb_device * d = adap -> dev ; struct dw2102_state * state = d -> priv ; mutex_lock ( & d -> data_mutex ) ; state -> data [ 0 ] = 0xe ; state -> data [ 1 ] = 0x87 ; state -> data [ 2 ] = 0x0 ; if ( dvb_usb_generic_rw ( d, state -> data, 3, state -> data, 1, 0 ) < 0 ) err ( "command <S2SV_blank> 0x0e <S2SV_blank> transfer <S2SV_blank> failed." ) ; state -> data [ 0 ] = 0xe ; state -> data [ 1 ] = 0x86 ; state -> data [ 2 ] = 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> dvb_usb_generic_rw ( d, state -> data <S2SV_ModEnd>, 3, <S2SV_ModStart>, 3, state -> data <S2SV_ModEnd>, 1, <S2SV_ModStart> "command <S2SV_blank> 0x0e <S2SV_blank> transfer <S2SV_blank> failed." ) ; state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = 0xe ; state -> data [ 1 ] = 0x80 ; state -> data <S2SV_ModEnd> [ 2 ] <S2SV_ModStart> 2 ] = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> dvb_usb_
Buggy code:
 static int netlink_recvmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock_iocb * siocb = kiocb_to_siocb ( kiocb ) ; struct scm_cookie scm ; struct sock * sk = sock -> sk ; struct netlink_sock * nlk = nlk_sk ( sk ) ; int noblock = flags & MSG_DONTWAIT ; size_t copied ; struct sk_buff * skb, * data_skb ; int err, ret ; if ( flags & MSG_OOB ) return - EOPNOTSUPP ; copied = 0 ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if ( skb == NULL ) goto out ; data_skb = skb ; # ifdef CONFIG_COMPAT_NETLINK_MESSAGES if ( unlikely ( skb_shinfo ( skb ) -> frag_list ) ) { if ( flags & MSG_CMSG_COMPAT ) data_skb = skb_shinfo ( skb ) -> frag_list ; } # endif <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> copied = data_skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } skb_reset_transport_header ( data_skb ) ; err = skb_copy_datagram_iovec ( data_skb, 0, msg -> msg_iov, copied ) ; if ( msg -> msg_name ) { struct sockaddr_nl * addr = ( struct sockaddr_nl * ) msg -> msg_name ; addr -> nl_family = AF_NETLINK ; addr -> nl_pad = 0 ; addr -> nl_pid = NETLINK_CB ( skb ). portid ; addr -> nl_groups = netlink_group_mask ( NETLINK_CB ( skb ). dst_group ) ; msg -> msg_namelen = sizeof ( * addr ) ; } if ( nlk -> flags & NETLINK_RECV_PKTINFO ) netlink_cmsg_recv_pktinfo ( msg, skb ) ; if ( NULL == siocb -> scm ) { memset ( & scm

Fix:
<S2SV_ModStart> } # endif <S2SV_ModEnd> copied = data_skb
Buggy code:
 static ssize_t qrtr_tun_write_iter ( struct kiocb * iocb, struct iov_iter * from ) { struct file * filp = iocb -> ki_filp ; struct qrtr_tun * tun = filp -> private_data ; size_t len = iov_iter_count ( from ) ; ssize_t ret ; void * kbuf ; kbuf = kzalloc ( len, GFP_KERNEL ) ; if (! kbuf ) return - ENOMEM ; <START_BUG> if (! copy_from_iter_full ( kbuf, len, from ) ) <END_BUG>  return - EFAULT ; <START_BUG> ret = qrtr_endpoint_post ( & tun -> ep, kbuf, len ) ; <END_BUG> return ret < 0? ret : len ;  }

Fix:
<S2SV_ModStart> from ) ) { kfree ( kbuf ) ; <S2SV_ModStart> - EFAULT ; } <S2SV_ModStart> len ) ; kfree ( kbuf ) ;
Buggy code:
 static size_t encode_tiles ( VP9_COMP * cpi, uint8_t * data_ptr ) { VP9_COMMON * const cm = & cpi -> common ; <START_BUG> vp9_writer residual_bc ; <END_BUG> int tile_row, tile_col ;  TOKENEXTRA * tok [ 4 ] [ 1 << 6 ], * tok_end ; <START_BUG> size_t total_size = 0 ; const int tile_cols = 1 << cm -> log2_tile_cols ; const int tile_rows = 1 << cm -> log2_tile_rows ; <END_BUG> vpx_memset ( cm -> above_seg_context, 0, sizeof ( * cm -> above_seg_context ) *  mi_cols_aligned_to_sb ( cm -> mi_cols ) ) ; <START_BUG> tok [ 0 ] [ 0 ] = cpi -> tok ; <END_BUG> for ( tile_row = 0 ; tile_row < tile_rows ; tile_row ++ ) { if ( tile_row ) tok [ tile_row ] [ 0 ] = tok [ tile_row - 1 ] [ tile_cols - 1 ] + cpi -> tok_count [ tile_row - 1 ] [ tile_cols - 1 ] ; for ( tile_col = 1 ; tile_col < tile_cols ; tile_col ++ ) tok [ tile_row ] [ tile_col ] = tok [ tile_row ] [ tile_col - 1 ] + cpi -> tok_count [ tile_row ] [ tile_col - 1 ] ; } for ( tile_row = 0 ; tile_row < tile_rows ; tile_row ++ ) { for ( tile_col = 0 ; tile_col < tile_cols ; tile_col ++ ) { TileInfo tile ; vp9_tile_init ( & tile, cm, tile_row, tile_col ) ;  tok_end = tok [ tile_row ] [ tile_col ] + cpi -> tok_count [ tile_row ] [ tile_col ] ; <START_BUG> if ( tile_col < tile_cols - 1 || tile_row < tile_rows - 1 ) <END_BUG> vp9_start_encode ( & residual_bc, data_ptr + total_size + 4 ) ;  else <START_BUG> vp9_start_encode ( & residual_bc, data_ptr + total_size ) ; <END_BUG> 

Fix:
<S2SV_ModStart> -> common ; vpx_writer <S2SV_ModEnd> residual_bc ; int <S2SV_ModStart> tile_col ; TOKENEXTRA <S2SV_ModEnd> * tok_end ; <S2SV_ModStart> -> log2_tile_rows ; memset <S2SV_ModEnd> ( cm -> <S2SV_ModStart> ) ) ; for ( tile_row = 0 ; tile_row < tile_rows ; tile_row ++ ) { for ( tile_col = 0 ; tile_col < tile_cols ; tile_col ++ ) { int tile_idx = tile_row * tile_cols + tile_col ; TOKENEXTRA * tok = cpi -> tile_tok [ tile_row ] [ tile_col ] <S2SV_ModEnd> ; tok_end = <S2SV_ModStart> ; tok_end = cpi -> tile_tok [ tile_row ] [ tile_col ] + <S2SV_ModEnd> cpi -> tok_count <S2SV_ModStart> - 1 ) vpx_start_encode <S2SV_ModEnd> ( & residual_bc <S2SV_ModStart> ) ; else vpx_start_encode <S2SV_ModEnd> ( & residual_bc <S2SV_ModStart> cpi, & cpi -> tile_data [ tile_idx ]. tile_info, <S2SV_ModEnd> & residual_bc, <S2SV_ModStart>, & tok <S2SV_ModEnd>, tok_end ) <S2SV_ModStart> assert ( tok <S2SV_ModEnd> == tok_end ) <S2SV_ModStart> tok_end ) ; vpx_stop
Buggy code:
 static int vivid_fb_ioctl ( struct fb_info * info, unsigned cmd, unsigned long arg ) { struct vivid_dev * dev = ( struct vivid_dev * ) info -> par ; switch ( cmd ) { case FBIOGET_VBLANK : { <START_BUG> struct fb_vblank vblank ; <END_BUG> vblank. flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT | FB_VBLANK_HAVE_VSYNC ; vblank. count = 0 ; vblank. vcount = 0 ; vblank. hcount = 0 ; if ( copy_to_user ( ( void __user * ) arg, & vblank, sizeof ( vblank ) ) ) return - EFAULT ; return 0 ; } default : dprintk ( dev, 1, "Unknown   ioctl   %08x\\n", cmd ) ; return - EINVAL ; } return 0 ; }

Fix:
<S2SV_ModStart> struct fb_vblank vblank ; memset ( & vblank, 0, sizeof ( vblank ) )
Buggy code:
 static int connection_edge_process_relay_cell ( cell_t * cell, circuit_t * circ, edge_connection_t * conn, crypt_path_t * layer_hint ) { static int num_seen = 0 ; relay_header_t rh ; unsigned domain = layer_hint? LD_APP : LD_EXIT ; int reason ; int optimistic_data = 0 ; tor_assert ( cell ) ; tor_assert ( circ ) ; relay_header_unpack ( & rh, cell -> payload ) ; num_seen ++ ; log_debug ( domain, "Now   seen   %d   relay   cells   here   (command   %d,   stream   %d).", num_seen, rh. command, rh. stream_id ) ; if ( rh. length > RELAY_PAYLOAD_SIZE ) { log_fn ( LOG_PROTOCOL_WARN, LD_PROTOCOL, "Relay   cell   length   field   too   long.   Closing   circuit." ) ; return - END_CIRC_REASON_TORPROTOCOL ; } if ( rh. stream_id == 0 ) { switch ( rh. command ) { case RELAY_COMMAND_BEGIN : case RELAY_COMMAND_CONNECTED : case RELAY_COMMAND_DATA : case RELAY_COMMAND_END : case RELAY_COMMAND_RESOLVE : case RELAY_COMMAND_RESOLVED : case RELAY_COMMAND_BEGIN_DIR : log_fn ( LOG_PROTOCOL_WARN, LD_PROTOCOL, "Relay   command   %d   with   zero   " "stream_id.   Dropping.", ( int ) rh. command ) ; return 0 ; default : ; } } if ( conn &&! connection_state_is_open ( TO_CONN ( conn ) ) ) { if ( conn -> base_. type == CONN_TYPE_EXIT && ( conn -> base_. state == EXIT_CONN_STATE_CONNECTING || conn -> base_. state == EXIT_CONN_STATE_RESOLVING ) && rh. command == RELAY_COMMAND_DATA ) { optimistic_data = 1 ; } else { return connection_edge_process_relay_cell_not_open ( & rh, cell, circ, conn, layer_hint ) ; } } switch ( rh. command ) { case RELAY_COMMAND_DROP : return

Fix:
<S2SV_ModStart> command == RELAY_COMMAND_BEGIN_DIR && circ -> purpose!= CIRCUIT_PURPOSE_S_REND_JOINED
Buggy code:
 static int do_ip_setsockopt ( struct sock * sk, int level, int optname, char __user * optval, unsigned int optlen ) { struct inet_sock * inet = inet_sk ( sk ) ; int val = 0, err ; if ( ( ( 1 << optname ) & ( ( 1 << IP_PKTINFO ) | ( 1 << IP_RECVTTL ) | ( 1 << IP_RECVOPTS ) | ( 1 << IP_RECVTOS ) | ( 1 << IP_RETOPTS ) | ( 1 << IP_TOS ) | ( 1 << IP_TTL ) | ( 1 << IP_HDRINCL ) | ( 1 << IP_MTU_DISCOVER ) | ( 1 << IP_RECVERR ) | ( 1 << IP_ROUTER_ALERT ) | ( 1 << IP_FREEBIND ) | ( 1 << IP_PASSSEC ) | ( 1 << IP_TRANSPARENT ) | ( 1 << IP_MINTTL ) | ( 1 << IP_NODEFRAG ) ) ) || optname == IP_MULTICAST_TTL || optname == IP_MULTICAST_ALL || optname == IP_MULTICAST_LOOP || optname == IP_RECVORIGDSTADDR ) { if ( optlen >= sizeof ( int ) ) { if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; } else if ( optlen >= sizeof ( char ) ) { unsigned char ucval ; if ( get_user ( ucval, ( unsigned char __user * ) optval ) ) return - EFAULT ; val = ( int ) ucval ; } } if ( ip_mroute_opt ( optname ) ) return ip_mroute_setsockopt ( sk, optname, optval, optlen ) ; err = 0 ; lock_sock ( sk ) ; switch ( optname ) { case IP_OPTIONS : { <START_BUG> struct ip_options * opt = NULL ; <END_BUG> if ( optlen > 40 ) goto e_inval ; err = ip_options_get_from_user ( sock_net ( sk ), & opt, optval, optlen ) ; if ( err )  break ; <START_BUG> if ( inet -> is_icsk ) { struct inet_connection_sock * icsk<END_BUG>

Fix:
<S2SV_ModStart> : { struct ip_options_rcu * old, <S2SV_ModEnd> * opt = <S2SV_ModStart> err ) break ; old = rcu_dereference_protected ( inet -> inet_opt, sock_owned_by_user ( sk ) ) <S2SV_ModStart> endif if ( old <S2SV_ModEnd> ) icsk -> <S2SV_ModStart> -> icsk_ext_hdr_len -= old -> opt. <S2SV_ModEnd> optlen ; if <S2SV_ModStart> += opt -> opt. <S2SV_ModStart> # endif } rcu_assign_pointer ( inet -> inet_opt, opt ) ; if ( old ) call_rcu ( & old -> rcu, opt_kfree_rcu <S2SV_ModEnd> ) ; break
Buggy code:
 int ext4_orphan_add ( handle_t * handle, struct inode * inode ) { struct super_block * sb = inode -> i_sb ; struct ext4_iloc iloc ; int err = 0, rc ; <START_BUG> if (! ext4_handle_valid ( handle ) ) <END_BUG> return 0 ; mutex_lock ( & EXT4_SB ( sb ) -> s_orphan_lock ) ; if (! list_empty ( & EXT4_I ( inode ) -> i_orphan ) ) goto out_unlock ; J_ASSERT ( ( S_ISREG ( inode -> i_mode ) || S_ISDIR ( inode -> i_mode ) || S_ISLNK ( inode -> i_mode ) ) || inode -> i_nlink == 0 ) ; BUFFER_TRACE ( EXT4_SB ( sb ) -> s_sbh, "get_write_access" ) ; err = ext4_journal_get_write_access ( handle, EXT4_SB ( sb ) -> s_sbh ) ; if ( err ) goto out_unlock ; err = ext4_reserve_inode_write ( handle, inode, & iloc ) ; if ( err ) goto out_unlock ; if ( NEXT_ORPHAN ( inode ) && NEXT_ORPHAN ( inode ) <= ( le32_to_cpu ( EXT4_SB ( sb ) -> s_es -> s_inodes_count ) ) ) goto mem_insert ; NEXT_ORPHAN ( inode ) = le32_to_cpu ( EXT4_SB ( sb ) -> s_es -> s_last_orphan ) ; EXT4_SB ( sb ) -> s_es -> s_last_orphan = cpu_to_le32 ( inode -> i_ino ) ; err = ext4_handle_dirty_super ( handle, sb ) ; rc = ext4_mark_iloc_dirty ( handle, inode, & iloc ) ; if (! err ) err = rc ; mem_insert : if (! err ) list_add ( & EXT4_I ( inode ) -> i_orphan, & EXT4_SB ( sb ) -> s_orphan ) ; jbd_debug ( 4, "superblock   will   point   to   %lu\\n", inode -> i_ino ) ; jbd

Fix:
<S2SV_ModStart> if (! EXT4_SB ( sb ) -> s_journal <S2SV_ModEnd> ) return 0
Buggy code:
 <START_BUG> struct nfs_open_context * nfs_find_open_context ( struct inode * inode, struct rpc_cred * cred, int mode ) <END_BUG> { struct nfs_inode * nfsi = NFS_I ( inode ) ; struct nfs_open_context * pos, * ctx = NULL ; spin_lock ( & inode -> i_lock ) ; list_for_each_entry ( pos, & nfsi -> open_files, list ) { if ( cred!= NULL && pos -> cred!= cred ) continue ; if ( ( pos -> mode & mode ) == mode ) { ctx = get_nfs_open_context ( pos ) ; break ; } } spin_unlock ( & inode -> i_lock ) ; return ctx ; }

Fix:
<S2SV_ModStart> * cred, fmode_t <S2SV_ModEnd> mode ) {
Buggy code:
 <START_BUG> static MagickPixelPacket * * AcquirePixelThreadSet ( const Image * image ) <END_BUG> { MagickPixelPacket * * pixels ; register ssize_t i, j ; size_t  number_threads ; <START_BUG> number_threads = ( size_t ) GetMagickResourceLimit ( ThreadResource ) ; pixels = ( MagickPixelPacket * * ) AcquireQuantumMemory ( number_threads, sizeof ( * pixels ) ) ; if ( pixels == ( MagickPixelPacket * * ) NULL ) return ( ( MagickPixelPacket * * ) NULL ) ; ( void ) memset ( pixels, 0, number_threads * sizeof ( * pixels ) ) ; <END_BUG> for ( i = 0 ; i < ( ssize_t ) number_threads ; i ++ )  { <START_BUG> pixels [ i ] = ( MagickPixelPacket * ) AcquireQuantumMemory ( image -> columns, <END_BUG> sizeof ( * * pixels ) ) ; if ( pixels [ i ] == ( MagickPixelPacket * ) NULL ) return ( DestroyPixelThreadSet ( pixels ) ) ;  for ( j = 0 ; j < ( ssize_t ) image -> columns ; j ++ ) <START_BUG> <END_BUG> GetMagickPixelPacket ( image, & pixels [ i ] [ j ] ) ;  } return ( pixels ) ; }

Fix:
<S2SV_ModStart> const Image * images ) { const Image * next ; <S2SV_ModEnd> MagickPixelPacket * * <S2SV_ModStart> j ; size_t columns, <S2SV_ModStart> ) ) ; columns = images -> columns ; for ( next = images ; next!= ( Image * ) NULL ; next = next -> next ) columns = MagickMax ( next -> columns, columns ) ; for ( <S2SV_ModEnd> i = 0 <S2SV_ModStart> ) AcquireQuantumMemory ( <S2SV_ModEnd> columns, sizeof <S2SV_ModStart> ( ssize_t ) <S2SV_ModEnd> columns ; j <S2SV_ModStart> ) GetMagickPixelPacket ( images <S2SV_ModEnd>, & pixels
Buggy code:
 static int list_dbs ( MYSQL * mysql, const char * wild ) { const char * header ; uint length, counter = 0 ; ulong rowcount = 0L ; char tables [ NAME_LEN + 1 ], rows [ NAME_LEN + 1 ] ; <START_BUG> char query [ 255 ] ; <END_BUG> MYSQL_FIELD * field ; MYSQL_RES * result ; MYSQL_ROW row = NULL, rrow ; if (! ( result = mysql_list_dbs ( mysql, wild ) ) ) { fprintf ( stderr, "%s:   Cannot   list   databases:   %s\\n", my_progname, mysql_error ( mysql ) ) ; return 1 ; } if ( wild && mysql_num_rows ( result ) == 1 ) { row = mysql_fetch_row ( result ) ; if (! my_strcasecmp ( & my_charset_latin1, row [ 0 ], wild ) ) { mysql_free_result ( result ) ; if ( opt_status ) return list_table_status ( mysql, wild, NULL ) ; else return list_tables ( mysql, wild, NULL ) ; } } if ( wild ) printf ( "Wildcard:   %s\\n", wild ) ; header = "Databases" ; length = ( uint ) strlen ( header ) ; field = mysql_fetch_field ( result ) ; if ( length < field -> max_length ) length = field -> max_length ; if (! opt_verbose ) print_header ( header, length, NullS ) ; else if ( opt_verbose == 1 ) print_header ( header, length, "Tables", 6, NullS ) ; else print_header ( header, length, "Tables", 6, "Total   Rows", 12, NullS ) ; while ( row || ( row = mysql_fetch_row ( result ) ) ) { counter ++ ; if ( opt_verbose ) { if (! ( mysql_select_db ( mysql, row [ 0 ] ) ) ) { MYSQL_RES * tresult = mysql_list_tables ( mysql, ( char * ) NULL ) ; if ( mysql_affected_rows ( mysql ) > 0 ) { sprintf ( tables, "%6lu", ( ulong ) mysql_affected_rows ( mysql ) ) ; rowcount = 0 ; if ( opt_verbose > 1 ) { MYSQL_ROW trow ; while

Fix:
<S2SV_ModStart> char query [ NAME_LEN + 100 <S2SV_ModEnd> ] ; MYSQL_FIELD <S2SV_ModStart> ) ) { my_snprintf <S2SV_ModEnd> ( query, <S2SV_ModStart> ( query, sizeof ( query ),
Buggy code:
 static void WritePixels ( struct ngiflib_img * i, struct ngiflib_decode_context * context, const u8 * pixels, u16 n ) { u16 tocopy ; struct ngiflib_gif * p = i -> parent ; while ( n > 0 ) { tocopy = ( context -> Xtogo < n )? context -> Xtogo : n ; if (! i -> gce. transparent_flag ) { # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif ngiflib_memcpy ( context -> frbuff_p. p8, pixels, tocopy ) ; pixels += tocopy ; context -> frbuff_p. p8 += tocopy ; # ifndef NGIFLIB_INDEXED_ONLY } else { int j ; for ( j = ( int ) tocopy ; j > 0 ; j -- ) { * ( context -> frbuff_p. p32 ++ ) = GifIndexToTrueColor ( i -> palette, * pixels ++ ) ; } } # endif } else { int j ; # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif for ( j = ( int ) tocopy ; j > 0 ; j -- ) { if ( * pixels!= i -> gce. transparent_color ) * context -> frbuff_p. p8 = * pixels ; pixels ++ ; context -> frbuff_p. p8 ++ ; } # ifndef NGIFLIB_INDEXED_ONLY } else { for ( j = ( int ) tocopy ; j > 0 ; j -- ) { if ( * pixels!= i -> gce. transparent_color ) { * context -> frbuff_p. p32 = GifIndexToTrueColor ( i -> palette, * pixels ) ; } pixels ++ ; context -> frbuff_p. p32 ++ ; } } # endif } context -> Xtogo -= tocopy ; if ( context -> Xtogo == 0 ) { # ifdef NGIFLIB_ENABLE_CALLBACKS if ( p -> line_cb ) p -> line_cb ( p, context -> line_p, context -> curY ) ; # endif context -> Xtogo = i

Fix:
<S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 4 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> ; break ; } while ( context -> pass > 0 && context -> pass < 4 && context -> curY >= p -> height ) { switch ( ++ context -> pass ) { case 2 : context -> curY = i -> posY + 4 ; break ; case 3 : context -> curY = i -> posY + 2 ; break ; case 4 : context -> curY = i -> posY + 1 ; break ; }
Buggy code:
 error_t dm9000UpdateMacAddrFilter ( NetInterface * interface ) { uint_t i ; uint_t k ; uint32_t crc ; uint8_t hashTable [ 8 ] ; MacFilterEntry * entry ; TRACE_DEBUG ( "Updating   MAC   filter...\\r\\n" ) ; osMemset ( hashTable, 0, sizeof ( hashTable ) ) ; hashTable [ 7 ] = 0x80 ; for ( i = 0 ; i < MAC_ADDR_FILTER_SIZE ; i ++ ) { entry = & interface -> macAddrFilter [ i ] ; if ( entry -> refCount > 0 ) { crc = dm9000CalcCrc ( & entry -> addr, sizeof ( MacAddr ) ) ; k = crc & 0x3F ; hashTable [ k // 8 ] |= ( 1 << ( k % 8 ) ) ; } } for ( i = 0 ; i < 8 ; i ++ ) { <START_BUG> dm9000WriteReg ( DM9000_REG_MAR0 + i, hashTable [ i ] ) ; <END_BUG> } TRACE_DEBUG ( "     MAR   =   %02" PRIX8 "   %02" PRIX8 "   %02" PRIX8 "   %02" PRIX8 "   " "%02" PRIX8 "   %02" PRIX8 "   %02" PRIX8 "   %02" PRIX8 "\\r\\n",  dm9000ReadReg ( DM9000_REG_MAR0 ), dm9000ReadReg ( DM9000_REG_MAR1 ), <START_BUG> dm9000ReadReg ( DM9000_REG_MAR2 ), dm9000ReadReg ( DM9000_REG_MAR3 ), dm9000ReadReg ( DM9000_REG_MAR4 ), dm9000ReadReg ( DM9000_REG_MAR5 ), dm9000ReadReg ( DM9000_REG_MAR6 ), dm9000ReadReg ( DM9000_REG_MAR7 ) ) ; return NO_ERROR ; }<END_BUG>

Fix:
<S2SV_ModStart> { dm9000WriteReg ( DM9000_MAR0 <S2SV_ModEnd> + i, <S2SV_ModStart>, dm9000ReadReg ( DM9000_MAR0 ), dm9000ReadReg ( DM9000_MAR1 ), dm9000ReadReg ( DM9000_MAR2 ), dm9000ReadReg ( DM9000_MAR3 ), dm9000ReadReg ( DM9000_MAR4 ), dm9000ReadReg ( DM9000_MAR5 ), dm9000ReadReg ( DM9000_MAR6 ), dm9000ReadReg ( DM9000_MAR7 <S2SV_ModEnd> ) ) ;
Buggy code:
 void eval_js ( WebKitWebView * web_view, gchar * script, GString * result ) { WebKitWebFrame * frame ; JSGlobalContextRef context ; <START_BUG> JSObjectRef globalobject ; <END_BUG> JSStringRef var_name ; JSStringRef js_script ; JSValueRef js_result ; JSStringRef js_result_string ; size_t js_result_size ; js_init ( ) ; frame = webkit_web_view_get_main_frame ( WEBKIT_WEB_VIEW ( web_view ) ) ; context = webkit_web_frame_get_global_context ( frame ) ;  globalobject = JSContextGetGlobalObject ( context ) ; <START_BUG> var_name = JSStringCreateWithUTF8CString ( "Uzbl" ) ; JSObjectSetProperty ( context, globalobject, var_name, JSObjectMake ( context, uzbl. js. classref, NULL ), kJSClassAttributeNone, NULL ) ; js_script = JSStringCreateWithUTF8CString ( script ) ; js_result = JSEvaluateScript ( context, js_script, globalobject, NULL, 0, NULL ) ; if ( js_result &&! JSValueIsUndefined ( context, js_result ) ) { js_result_string = JSValueToStringCopy ( context, js_result, NULL ) ; js_result_size = JSStringGetMaximumUTF8CStringSize ( js_result_string ) ; if ( js_result_size ) { char js_result_utf8 [ js_result_size ] ; JSStringGetUTF8CString ( js_result_string, js_result_utf8, js_result_size ) ; g_string_assign ( result, js_result_utf8 ) ; } JSStringRelease ( js_result_string ) ; } <END_BUG> JSObjectDeleteProperty ( context, globalobject, var_name, NULL ) ;  JSStringRelease ( var_name ) ; JSStringRelease ( js_script ) ; }

Fix:
<S2SV_ModStart> ; JSObjectRef globalobject <S2SV_ModEnd> ; JSStringRef js_script <S2SV_ModStart> JSContextGetGlobalObject ( context <S2SV_ModEnd> ) ; js_script <S2SV_ModStart> ) ; } <S2SV_ModEnd> JSStringRelease ( js_script
Buggy code:
 <START_BUG> void fdct4_sse2 ( __m128i * in ) { <END_BUG>  const __m128i k__cospi_p16_p16 = _mm_set1_epi16 ( cospi_16_64 ) ; <START_BUG> const __m128i k__cospi_p16_m16 = pair_set_epi16 ( cospi_16_64, - cospi_16_64 ) ; const __m128i k__cospi_p08_p24 = pair_set_epi16 ( cospi_8_64, cospi_24_64 ) ; const __m128i k__cospi_p24_m08 = pair_set_epi16 ( cospi_24_64, - cospi_8_64 ) ; const __m128i k__DCT_CONST_ROUNDING = _mm_set1_epi32 ( DCT_CONST_ROUNDING ) ; __m128i u [ 4 ], v [ 4 ] ; u [ 0 ] = _mm_unpacklo_epi16 ( in [ 0 ], in [ 1 ] ) ; u [ 1 ] = _mm_unpacklo_epi16 ( in [ 3 ], in [ 2 ] ) ; v [ 0 ] = _mm_add_epi16 ( u [ 0 ], u [ 1 ] ) ; v [ 1 ] = _mm_sub_epi16 ( u [ 0 ], u [ 1 ] ) ; u [ 0 ] = _mm_madd_epi16 ( v [ 0 ], k__cospi_p16_p16 ) ; u [ 1 ] = _mm_madd_epi16 ( v [ 0 ], k__cospi_p16_m16 ) ; u [ 2 ] = _mm_madd_epi16 ( v [ 1 ], k__cospi_p08_p24 ) ; u [ 3 ] = _mm_madd_epi16 ( v [ 1 ], k__cospi_p24_m08 ) ; v [ 0 ] = _mm_add_epi32 ( u [ 0 ], k__DCT_CONST_ROUNDING ) ; v [ 1 ] = _mm_add_epi32 ( u [ 1 ], k__DCT_CONST_ROUNDING ) ; v [ 2 ] = _mm_add<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t )
Buggy code:
 void gsm_xsmp_client_connect ( GsmXSMPClient * client, SmsConn conn, unsigned long * mask_ret, SmsCallbacks * callbacks_ret ) { client -> priv -> conn = conn ; <START_BUG> if ( client -> priv -> protocol_timeout ) { <END_BUG> g_source_remove ( client -> priv -> protocol_timeout ) ; client -> priv -> protocol_timeout = 0 ; } g_debug ( "GsmXSMPClient:   Initializing   client   %s", client -> priv -> description ) ; * mask_ret = 0 ; * mask_ret |= SmsRegisterClientProcMask ; callbacks_ret -> register_client. callback = register_client_callback ; callbacks_ret -> register_client. manager_data = client ; * mask_ret |= SmsInteractRequestProcMask ; callbacks_ret -> interact_request. callback = interact_request_callback ; callbacks_ret -> interact_request. manager_data = client ; * mask_ret |= SmsInteractDoneProcMask ; callbacks_ret -> interact_done. callback = interact_done_callback ; callbacks_ret -> interact_done. manager_data = client ; * mask_ret |= SmsSaveYourselfRequestProcMask ; callbacks_ret -> save_yourself_request. callback = save_yourself_request_callback ; callbacks_ret -> save_yourself_request. manager_data = client ; * mask_ret |= SmsSaveYourselfP2RequestProcMask ; callbacks_ret -> save_yourself_phase2_request. callback = save_yourself_phase2_request_callback ; callbacks_ret -> save_yourself_phase2_request. manager_data = client ; * mask_ret |= SmsSaveYourselfDoneProcMask ; callbacks_ret -> save_yourself_done. callback = save_yourself_done_callback ; callbacks_ret -> save_yourself_done. manager_data = client ; * mask_ret |= SmsCloseConnectionProcMask ; callbacks_ret -> close_connection. callback = close_connection_callback ; callbacks_ret -> close_connection. manager_data = client ; * mask_ret |= SmsSetPropertiesProcMask ; callbacks_ret -> set_properties. callback = set_properties_callback ; callbacks_ret -> set

Fix:
<S2SV_ModStart> = conn ; <S2SV_ModEnd> g_debug ( "GsmXSMPClient: <S2SV_blank> Initializing <S2SV_blank> client <S2SV_blank> %s"
Buggy code:
 void hostap_setup_dev ( struct net_device * dev, local_info_t * local, int type ) { struct hostap_interface * iface ; iface = netdev_priv ( dev ) ; <START_BUG> ether_setup ( dev ) ; <END_BUG> if ( iface ) { iface -> wireless_data. spy_data = & iface -> spy_data ; dev -> wireless_data = & iface -> wireless_data ; } dev -> wireless_handlers = & hostap_iw_handler_def ; dev -> watchdog_timeo = TX_TIMEOUT ; switch ( type ) { case HOSTAP_INTERFACE_AP : dev -> tx_queue_len = 0 ; dev -> netdev_ops = & hostap_mgmt_netdev_ops ; dev -> type = ARPHRD_IEEE80211 ; dev -> header_ops = & hostap_80211_ops ; break ; case HOSTAP_INTERFACE_MASTER : dev -> netdev_ops = & hostap_master_ops ; break ; default : dev -> tx_queue_len = 0 ; dev -> netdev_ops = & hostap_netdev_ops ; } dev -> mtu = local -> mtu ; SET_ETHTOOL_OPS ( dev, & prism2_ethtool_ops ) ; }

Fix:
<S2SV_ModStart> ( dev ) ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING
Buggy code:
 void vp8_multiframe_quality_enhance ( VP8_COMMON * cm ) { YV12_BUFFER_CONFIG * show = cm -> frame_to_show ; YV12_BUFFER_CONFIG * dest = & cm -> post_proc_buffer ; FRAME_TYPE frame_type = cm -> frame_type ; const MODE_INFO * mode_info_context = cm -> show_frame_mi ; int mb_row ; int mb_col ; int totmap, map [ 4 ] ; int qcurr = cm -> base_qindex ; int qprev = cm -> postproc_state. last_base_qindex ; unsigned char * y_ptr, * u_ptr, * v_ptr ; unsigned char * yd_ptr, * ud_ptr, * vd_ptr ; y_ptr = show -> y_buffer ; u_ptr = show -> u_buffer ; v_ptr = show -> v_buffer ; yd_ptr = dest -> y_buffer ; ud_ptr = dest -> u_buffer ; vd_ptr = dest -> v_buffer ; for ( mb_row = 0 ; mb_row < cm -> mb_rows ; mb_row ++ ) { for ( mb_col = 0 ; mb_col < cm -> mb_cols ; mb_col ++ ) { if ( frame_type == INTER_FRAME ) totmap = qualify_inter_mb ( mode_info_context, map ) ; else totmap = ( frame_type == KEY_FRAME? 4 : 0 ) ; if ( totmap ) { if ( totmap < 4 ) { int i, j ; for ( i = 0 ; i < 2 ; ++ i ) for ( j = 0 ; j < 2 ; ++ j ) { if ( map [ i * 2 + j ] ) { multiframe_quality_enhance_block ( 8, qcurr, qprev, y_ptr + 8 * ( i * show -> y_stride + j ), u_ptr + 4 * ( i * show -> uv_stride + j ), v_ptr + 4 * ( i * show -> uv_stride + j ), show -> y_stride, show -> uv_stride, yd_ptr + 8 * ( i * dest -> y_stride + j ), ud_ptr + 4 * ( i * dest -> uv_stride +

Fix:
<S2SV_ModStart> uv_stride ) { memcpy <S2SV_ModEnd> ( udp, <S2SV_ModStart> 4 ) ; memcpy <S2SV_ModEnd> ( vdp,
Buggy code:
 static long madvise_remove ( struct vm_area_struct * vma, struct vm_area_struct * * prev, unsigned long start, unsigned long end ) { loff_t offset ; int error ; <START_BUG> * prev = NULL ; <END_BUG> if ( vma -> vm_flags & ( VM_LOCKED | VM_NONLINEAR | VM_HUGETLB ) ) return - EINVAL ;  if (! vma -> vm_file ||! vma -> vm_file -> f_mapping <START_BUG> <END_BUG> ||! vma -> vm_file -> f_mapping -> host ) {  return - EINVAL ; } if ( ( vma -> vm_flags & ( VM_SHARED | VM_WRITE ) )!= ( VM_SHARED | VM_WRITE ) ) return - EACCES ; offset = ( loff_t ) ( start - vma -> vm_start ) + ( ( loff_t ) vma -> vm_pgoff << PAGE_SHIFT ) ; <START_BUG> up_read ( & current -> mm -> mmap_sem ) ; <END_BUG>  error = do_fallocate ( vma -> vm_file, <START_BUG> FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, <END_BUG> offset, end - start ) ;  down_read ( & current -> mm -> mmap_sem ) ; return error ; }

Fix:
<S2SV_ModStart> int error ; struct file * f ; <S2SV_ModStart> - EINVAL ; f = vma -> vm_file ; <S2SV_ModStart> if (! f ||! f <S2SV_ModEnd> -> f_mapping || <S2SV_ModStart> f_mapping ||! f <S2SV_ModEnd> -> f_mapping -> <S2SV_ModStart> PAGE_SHIFT ) ; get_file ( f ) ; <S2SV_ModStart> = do_fallocate ( f <S2SV_ModEnd>, FALLOC_FL_PUNCH_HOLE | <S2SV_ModStart> end - start ) ; fput ( f
Buggy code:
 static rfbBool webSocketsHandshake ( rfbClientPtr cl, char * scheme ) { char * buf, * response, * line ; int n, linestart = 0, len = 0, llen, base64 = TRUE ; char prefix [ 5 ], trailer [ 17 ] ; char * path = NULL, * host = NULL, * origin = NULL, * protocol = NULL ; char * key1 = NULL, * key2 = NULL, * key3 = NULL ; char * sec_ws_origin = NULL ; char * sec_ws_key = NULL ; char sec_ws_version = 0 ; ws_ctx_t * wsctx = NULL ; buf = ( char * ) malloc ( WEBSOCKETS_MAX_HANDSHAKE_LEN ) ; if (! buf ) { rfbLogPerror ( "webSocketsHandshake:   malloc" ) ; return FALSE ; } response = ( char * ) malloc ( WEBSOCKETS_MAX_HANDSHAKE_LEN ) ; if (! response ) { free ( buf ) ; rfbLogPerror ( "webSocketsHandshake:   malloc" ) ; return FALSE ; } while ( len < WEBSOCKETS_MAX_HANDSHAKE_LEN - 1 ) { if ( ( n = rfbReadExactTimeout ( cl, buf + len, 1, WEBSOCKETS_CLIENT_SEND_WAIT_MS ) ) <= 0 ) { if ( ( n < 0 ) && ( errno == ETIMEDOUT ) ) { break ; } if ( n == 0 ) rfbLog ( "webSocketsHandshake:   client   gone\\n" ) ; else rfbLogPerror ( "webSocketsHandshake:   read" ) ; free ( response ) ; free ( buf ) ; return FALSE ; } len += 1 ; llen = len - linestart ; if ( ( ( llen >= 2 ) ) && ( buf [ len - 1 ] == '\\n' ) ) { line = buf + linestart ; if ( ( llen == 2 ) && ( strncmp ( "\\r\\n", line, 2 ) == 0 ) ) { if ( key1 && key2 ) { if ( ( n = rfbReadExact ( cl, buf + len, 8 ) ) <= 0 ) { if ( ( n < 0 ) && ( errno == ETIMEDOUT ) ) { break ; } if

Fix:
<S2SV_ModStart> = base64 ; hybiDecodeCleanup ( wsctx ) ;
Buggy code:
 int pci_emul_alloc_pbar ( struct pci_vdev * pdi, int idx, uint64_t hostbase, enum pcibar_type type, uint64_t size ) { int error ; uint64_t * baseptr, limit, addr, mask, lobits, bar ; <START_BUG> assert ( idx >= 0 && idx <= PCI_BARMAX ) ; <END_BUG> if ( ( size & ( size - 1 ) )!= 0 ) size = 1UL << flsl ( size ) ; if ( type == PCIBAR_IO ) { if ( size < 4 ) size = 4 ; } else { if ( size < 16 ) size = 16 ; } switch ( type ) { case PCIBAR_NONE : baseptr = NULL ; addr = mask = lobits = 0 ; break ; case PCIBAR_IO : baseptr = & pci_emul_iobase ; limit = PCI_EMUL_IOLIMIT ; mask = PCIM_BAR_IO_BASE ; lobits = PCIM_BAR_IO_SPACE ; break ;  case PCIBAR_MEM64 : <START_BUG> if (! skip_pci_mem64bar_workaround && ( size <= 32 * 1024 * 1024 ) ) { baseptr = & pci_emul_membase32 ; limit = PCI_EMUL_MEMLIMIT32 ; mask = PCIM_BAR_MEM_BASE ; lobits = PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_64 ; break ; } if ( size == 0x100000000UL ) baseptr = & hostbase ; else baseptr = & pci_emul_membase64 ; limit = PCI_EMUL_MEMLIMIT64 ; mask = PCIM_BAR_MEM_BASE ; lobits = PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_64 | PCIM_BAR_MEM_PREFETCH ; break ; case PCIBAR_MEM32 : baseptr = & pci_emul_membase32 ; limit = PCI_EMUL_MEMLIMIT32 ; mask = PCIM_BAR_MEM_BASE ; lobits = PCIM_BAR_MEM_SPACE | PCIM_BAR_MEM_32 ; break ; default : <END_BUG> printf ( "%s:   invalid   bar  

Fix:
<S2SV_ModStart>, bar ; <S2SV_ModEnd> if ( ( <S2SV_ModStart> case PCIBAR_MEM64 : if ( idx + 1 > PCI_BARMAX ) { pr_err ( "%s: <S2SV_blank> invalid <S2SV_blank> bar <S2SV_blank> number <S2SV_blank> %d <S2SV_blank> for <S2SV_blank> MEM64 <S2SV_blank> type\\n", __func__, idx ) ; return - 1 ; } <S2SV_ModStart> ; default : pr_err <S2SV_ModEnd> ( "%s: <S2SV_blank> invalid <S2SV_blank> bar <S2SV_blank> type <S2SV_blank> %d\\n", <S2SV_ModStart> type ) ; return - 1 <S2SV_ModEnd> ; } if <S2SV_ModStart> PCIBAR_MEM64 ) { <S2SV_ModEnd> pdi -> bar
Buggy code:
 static int cg_rmdir ( const char * path ) { struct fuse_context * fc = fuse_get_context ( ) ; <START_BUG> char * fpath = NULL, * cgdir = NULL, * controller ; <END_BUG> const char * cgroup ; int ret ; if (! fc ) return - EIO ; controller = pick_controller_from_path ( fc, path ) ; if (! controller ) return - EINVAL ; cgroup = find_cgroup_in_path ( path ) ; if (! cgroup ) return - EINVAL ; get_cgdir_and_path ( cgroup, & cgdir, & fpath ) ; if (! fpath ) { ret = - EINVAL ; goto out ; }  fprintf ( stderr, "rmdir:   verifying   access   to   %s:%s   (req   path   %s)\\n", <START_BUG> controller, cgdir, path ) ; if (! fc_may_access ( fc, controller, cgdir, NULL, O_WRONLY ) ) { ret = - EACCES ; goto out ; } <END_BUG> if (! caller_is_in_ancestor ( fc -> pid, controller, cgroup, NULL ) ) {  ret = - EACCES ; goto out ; } <START_BUG> if (! cgfs_remove ( controller, cgroup ) ) { <END_BUG> ret = - EINVAL ; goto out ; } ret = 0 ; out : free ( cgdir ) ;  return ret ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart>, * controller, * next = NULL <S2SV_ModStart> out ; } <S2SV_ModEnd> if (! <S2SV_ModStart>, cgroup, & next ) ) { if (! fpath || strcmp ( next, fpath ) == 0 ) ret = - EBUSY ; else ret = - ENOENT ; goto out ; } if (! fc_may_access ( fc, controller, cgdir, NULL, O_WRONLY <S2SV_ModEnd> ) ) { <S2SV_ModStart> if (! caller_is_in_ancestor ( fc -> pid, controller, cgroup, NULL ) ) { ret = - EACCES ; goto out ; } if (! <S2SV_ModStart> cgdir ) ; free ( next ) ;
Buggy code:
 static long vfio_pci_ioctl ( void * device_data, unsigned int cmd, unsigned long arg ) { struct vfio_pci_device * vdev = device_data ; unsigned long minsz ; if ( cmd == VFIO_DEVICE_GET_INFO ) { struct vfio_device_info info ; minsz = offsetofend ( struct vfio_device_info, num_irqs ) ; if ( copy_from_user ( & info, ( void __user * ) arg, minsz ) ) return - EFAULT ; if ( info. argsz < minsz ) return - EINVAL ; info. flags = VFIO_DEVICE_FLAGS_PCI ; if ( vdev -> reset_works ) info. flags |= VFIO_DEVICE_FLAGS_RESET ; info. num_regions = VFIO_PCI_NUM_REGIONS + vdev -> num_regions ; info. num_irqs = VFIO_PCI_NUM_IRQS ; return copy_to_user ( ( void __user * ) arg, & info, minsz )? - EFAULT : 0 ; } else if ( cmd == VFIO_DEVICE_GET_REGION_INFO ) { struct pci_dev * pdev = vdev -> pdev ; struct vfio_region_info info ; struct vfio_info_cap caps = {. buf = NULL,. size = 0 } ; int i, ret ; minsz = offsetofend ( struct vfio_region_info, offset ) ; if ( copy_from_user ( & info, ( void __user * ) arg, minsz ) ) return - EFAULT ; if ( info. argsz < minsz ) return - EINVAL ; switch ( info. index ) { case VFIO_PCI_CONFIG_REGION_INDEX : info. offset = VFIO_PCI_INDEX_TO_OFFSET ( info. index ) ; info. size = pdev -> cfg_size ; info. flags = VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE ; break ; case VFIO_PCI_BAR0_REGION_INDEX... VFIO_PCI_BAR5_REGION_INDEX : info. offset = VFIO_PCI_INDEX_TO_OFFSET

Fix:
<S2SV_ModStart> vfio_irq_set hdr ; size_t size ; <S2SV_ModStart> NULL ; int max, <S2SV_ModStart> || hdr. count >= ( U32_MAX - hdr. start ) || hdr. <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> max = vfio_pci_get_irq_count <S2SV_ModStart> ; if ( <S2SV_ModEnd> hdr. start <S2SV_ModStart> count > max ) return - EINVAL ; switch ( hdr. flags & VFIO_IRQ_SET_DATA_TYPE_MASK ) { case VFIO_IRQ_SET_DATA_NONE : size = 0 ; break ; case VFIO_IRQ_SET_DATA_BOOL : size = sizeof ( uint8_t ) ; break ; case VFIO_IRQ_SET_DATA_EVENTFD : size = sizeof ( int32_t ) ; break ; default : return - EINVAL ; } if ( size ) { if ( hdr. argsz - minsz < hdr. count * size
Buggy code:
 int squidclamav_check_preview_handler ( char * preview_data, int preview_data_len, ci_request_t * req ) { ci_headers_list_t * req_header ; struct http_info httpinf ; av_req_data_t * data = ci_service_data ( req ) ; char * clientip ; struct hostent * clientname ; unsigned long ip ; char * username ; char * content_type ; ci_off_t content_length ; char * chain_ret = NULL ; char * ret = NULL ; int chkipdone = 0 ; ci_debug_printf ( 1, "DEBUG   squidclamav_check_preview_handler:   processing   preview   header.\\n" ) ; if ( preview_data_len ) ci_debug_printf ( 1, "DEBUG   squidclamav_check_preview_handler:   preview   data   size   is   %d\\n", preview_data_len ) ; if ( ( req_header = ci_http_request_headers ( req ) ) == NULL ) { ci_debug_printf ( 0, "ERROR   squidclamav_check_preview_handler:   bad   http   header,   aborting.\\n" ) ; return CI_ERROR ; } if ( ( username = ci_headers_value ( req -> request_header, "X-Authenticated-User" ) )!= NULL ) { ci_debug_printf ( 2, "DEBUG   squidclamav_check_preview_handler:   X-Authenticated-User:   %s\\n", username ) ; if ( simple_pattern_compare ( username, TRUSTUSER ) == 1 ) { ci_debug_printf ( 1, "DEBUG   squidclamav_check_preview_handler:   No   squidguard   and   antivir   check   (TRUSTUSER   match)   for   user:   %s\\n", username ) ; return CI_MOD_ALLOW204 ; } } else { username = ( char * ) malloc ( sizeof ( char ) * 2 ) ; strcpy ( username, "-" ) ; } if ( ( clientip = ci_headers_value ( req -> request_header, "X-Client-IP" ) )!= NULL ) { ci_debug_

Fix:
<S2SV_ModStart> 1 ) { char * rbuff = NULL ; <S2SV_ModStart> method ) ; rbuff = replace ( httpinf. url, "%", "%25" ) ; <S2SV_ModStart>, "%s <S2SV_blank> %s <S2SV_blank> %s <S2SV_blank> %s\\n", rbuff <S2SV_ModEnd>, clientip, <S2SV_ModStart> fflush ( sgfpw ) ; xfree ( rbuff
Buggy code:
 MagickExport void * AcquireQuantumMemory ( const size_t count, const size_t quantum ) { size_t extent ; <START_BUG> if ( CheckMemoryOverflow ( count, quantum )!= MagickFalse ) <END_BUG> return ( ( void * ) NULL ) ; extent = count * quantum ; return ( AcquireMagickMemory ( extent ) ) ; }

Fix:
<S2SV_ModStart> ; if ( HeapOverflowSanityCheck <S2SV_ModEnd> ( count,
Buggy code:
 static u64 __skb_get_nlattr ( u64 ctx, u64 A, u64 X, u64 r4, u64 r5 ) { struct sk_buff * skb = ( struct sk_buff * ) ( long ) ctx ; struct nlattr * nla ; <START_BUG> if ( skb_is_nonlinear ( skb ) ) <END_BUG> return 0 ; if ( A > skb -> len - sizeof ( struct nlattr ) ) return 0 ; nla = nla_find ( ( struct nlattr * ) & skb -> data [ A ], skb -> len - A, X ) ; if ( nla ) return ( void * ) nla - ( void * ) skb -> data ; return 0 ; }

Fix:
<S2SV_ModStart> skb_is_nonlinear ( skb ) ) return 0 ; if ( skb -> len < sizeof ( struct nlattr
Buggy code:
 static void findoprnd ( ITEM * ptr, int32 * pos ) <START_BUG> { <END_BUG> if ( ptr [ * pos ]. type == VAL || ptr [ * pos ]. type == VALTRUE ) { ptr [ * pos ]. left = 0 ; ( * pos ) ++ ; } else if ( ptr [ * pos ]. val == ( int32 ) '!' ) { ptr [ * pos ]. left = 1 ; ( * pos ) ++ ; findoprnd ( ptr, pos ) ; } else { ITEM * curitem = & ptr [ * pos ] ; int32 tmp = * pos ; ( * pos ) ++ ; findoprnd ( ptr, pos ) ; curitem -> left = * pos - tmp ; findoprnd ( ptr, pos ) ; } }

Fix:
<S2SV_ModStart> pos ) { check_stack_depth ( ) ;