nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static int nfs4_open_recover_helper ( struct nfs4_opendata * opendata, mode_t openflags, struct nfs4_state * * res ) <END_BUG> { struct nfs4_state * newstate ; int ret ;  opendata -> o_arg. open_flags = openflags ; <START_BUG> memset ( & opendata -> o_res, 0, sizeof ( opendata -> o_res ) ) ; memset ( & opendata -> c_res, 0, sizeof ( opendata -> c_res ) ) ; nfs4_init_opendata_res ( opendata ) ; ret = _nfs4_proc_open ( opendata ) ; if ( ret!= 0 ) return ret ; newstate = nfs4_opendata_to_nfs4_state ( opendata ) ; if ( IS_ERR ( newstate ) ) return PTR_ERR ( newstate ) ; <END_BUG> nfs4_close_state ( & opendata -> path, newstate, openflags ) ;  * res = newstate ; return 0 ; }

Fix:
<S2SV_ModStart> * opendata, fmode_t fmode <S2SV_ModEnd>, struct nfs4_state <S2SV_ModStart>. open_flags = 0 ; opendata -> o_arg. fmode = fmode <S2SV_ModEnd> ; memset ( <S2SV_ModStart>, newstate, fmode <S2SV_ModEnd> ) ; *
Buggy code:
 int send_event ( int fd, uint16_t type, uint16_t code, int32_t value ) { struct uinput_event event ; BTIF_TRACE_DEBUG ( "%s   type:%u   code:%u   value:%d", __FUNCTION__, type, code, value ) ; memset ( & event, 0, sizeof ( event ) ) ; event. type = type ; event. code = code ; event. value = value ; <START_BUG> return write ( fd, & event, sizeof ( event ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> value ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart> event ) ) )
Buggy code:
 int ext4_page_mkwrite ( struct vm_area_struct * vma, struct vm_fault * vmf ) { struct page * page = vmf -> page ; loff_t size ; unsigned long len ; int ret ; struct file * file = vma -> vm_file ; struct inode * inode = file_inode ( file ) ; struct address_space * mapping = inode -> i_mapping ; handle_t * handle ; get_block_t * get_block ; int retries = 0 ; sb_start_pagefault ( inode -> i_sb ) ; <START_BUG> file_update_time ( vma -> vm_file ) ; <END_BUG> if ( test_opt ( inode -> i_sb, DELALLOC ) &&! ext4_should_journal_data ( inode ) &&! ext4_nonda_switch ( inode -> i_sb ) ) { do { ret = block_page_mkwrite ( vma, vmf, ext4_da_get_block_prep ) ; } while ( ret == - ENOSPC && ext4_should_retry_alloc ( inode -> i_sb, & retries ) ) ; goto out_ret ; } lock_page ( page ) ; size = i_size_read ( inode ) ; if ( page -> mapping!= mapping || page_offset ( page ) > size ) { unlock_page ( page ) ; ret = VM_FAULT_NOPAGE ; goto out ; } if ( page -> index == size >> PAGE_CACHE_SHIFT ) len = size & ~ PAGE_CACHE_MASK ; else len = PAGE_CACHE_SIZE ; if ( page_has_buffers ( page ) ) { if (! ext4_walk_page_buffers ( NULL, page_buffers ( page ), 0, len, NULL, ext4_bh_unmapped ) ) { wait_for_stable_page ( page ) ; ret = VM_FAULT_LOCKED ; goto out ; } } unlock_page ( page ) ; if ( ext4_should_dioread_nolock ( inode ) ) get_block = ext4_get_block_write ; else get_block = ext4_get_block ; retry_alloc : handle = ext4_journal_start ( inode, EXT4_HT_WRITE_PAGE, ext4_writepage_trans_blocks ( inode )

Fix:
<S2SV_ModStart> vma -> vm_file ) ; down_read ( & EXT4_I ( inode ) -> i_mmap_sem <S2SV_ModStart> ; out : up_read ( & EXT4_I ( inode ) -> i_mmap_sem ) ;
Buggy code:
 int ParseDsdiffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t infilesize, total_samples ; DFFFileHeader dff_file_header ; DFFChunkHeader dff_chunk_header ; uint32_t bcount ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & dff_file_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & dff_file_header ) + 4, sizeof ( DFFFileHeader ) - 4, & bcount ) || bcount!= sizeof ( DFFFileHeader ) - 4 ) || strncmp ( dff_file_header. formType, "DSD   ", 4 ) ) { error_line ( "%s   is   not   a   valid  .DFF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & dff_file_header, sizeof ( DFFFileHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackBigEndianToNative ( & dff_file_header, DFFFileHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && dff_file_header. ckDataSize && dff_file_header. ckDataSize + 1 && dff_file_header. ckDataSize + 12!= infilesize ) { error_line ( "%s   is   not   a   valid  .DFF   file   (by   total   size)!", infilename ) ; return WAVPACK_SOFT_ERROR ; } if ( debug_logging_mode ) error_line ( "file   header   indicated   length   =   %lld", dff_file_header. ckDataSize ) ; # endif while ( 1 ) { if (! DoReadFile ( infile, & dff_chunk_header, sizeof ( DFFChunkHeader ), & bcount )

Fix:
<S2SV_ModStart> ; uint16_t numChannels = 0 <S2SV_ModStart> numChannels < 1 || numChannels > 256 <S2SV_ModStart> ) ) { if (! config -> num_channels ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.DFF <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; }
Buggy code:
 static long ext4_zero_range ( struct file * file, loff_t offset, loff_t len, int mode ) { struct inode * inode = file_inode ( file ) ; handle_t * handle = NULL ; unsigned int max_blocks ; loff_t new_size = 0 ; int ret = 0 ; int flags ; int credits ; int partial_begin, partial_end ; loff_t start, end ; ext4_lblk_t lblk ; <START_BUG> struct address_space * mapping = inode -> i_mapping ; <END_BUG> unsigned int blkbits = inode -> i_blkbits ; trace_ext4_zero_range ( inode, offset, len, mode ) ; if (! S_ISREG ( inode -> i_mode ) ) return - EINVAL ; if ( ext4_should_journal_data ( inode ) ) { ret = ext4_force_commit ( inode -> i_sb ) ; if ( ret ) return ret ; }  if ( mapping -> nrpages && mapping_tagged ( mapping, PAGECACHE_TAG_DIRTY ) ) { <START_BUG> ret = filemap_write_and_wait_range ( mapping, offset, offset + len - 1 ) ; if ( ret ) return ret ; } start = round_up ( offset, 1 << blkbits ) ; end = round_down ( ( offset + len ), 1 << blkbits ) ; if ( start < offset || end > offset + len ) return - EINVAL ; partial_begin = offset & ( ( 1 << blkbits ) - 1 ) ; partial_end = ( offset + len ) & ( ( 1 << blkbits ) - 1 ) ; lblk = start >> blkbits ; max_blocks = ( end >> blkbits ) ; if ( max_blocks < lblk ) max_blocks = 0 ; else max_blocks -= lblk ; mutex_lock ( & inode -> i_mutex ) ; if (! ( ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) ) { ret = - EOPNOTSUPP ; goto out_mutex ; } if (! ( mode & FALLOC_FL_KEEP_SIZE ) && offset + len > i_size_read ( inode ) ) { new_size = offset + len ; ret = inode_newsize_ok ( inode<END_BUG>

Fix:
<S2SV_ModStart> ext4_lblk_t lblk ; <S2SV_ModEnd> unsigned int blkbits <S2SV_ModStart> ret ; } <S2SV_ModEnd> start = round_up <S2SV_ModStart> EXT4_EX_NOCACHE ) ; ext4_inode_block_unlocked_dio ( inode ) ; inode_dio_wait ( inode ) ; down_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModStart> inode ) ; <S2SV_ModEnd> ret = ext4_alloc_file_blocks <S2SV_ModStart> flags, mode ) ; up_write ( & EXT4_I ( inode ) -> i_mmap_sem
Buggy code:
 static inline void set_socket_blocking ( int s, int blocking ) { int opts ; <START_BUG> opts = fcntl ( s, F_GETFL ) ; <END_BUG> if ( opts < 0 ) APPL_TRACE_ERROR ( "set   blocking   (%s)", strerror ( errno ) ) ; if ( blocking ) opts &= ~ O_NONBLOCK ; else opts |= O_NONBLOCK ;  if ( fcntl ( s, F_SETFL, opts ) < 0 ) <START_BUG> APPL_TRACE_ERROR ( "set   blocking   (%s)", strerror ( errno ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; opts = TEMP_FAILURE_RETRY ( <S2SV_ModStart> s, F_GETFL ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> F_SETFL, opts )
Buggy code:
 static PyObject * get_value ( PyObject * self, const char * buffer, int * position, int type, int max, PyObject * as_class, unsigned char tz_aware, unsigned char uuid_subtype ) { struct module_state * state = GETSTATE ( self ) ; PyObject * value ; PyObject * error ; switch ( type ) { case 1 : { double d ; if ( max < 8 ) { goto invalid ; } memcpy ( & d, buffer + * position, 8 ) ; value = PyFloat_FromDouble ( d ) ; if (! value ) { return NULL ; } * position += 8 ; break ; } case 2 : case 14 : { int value_length = ( ( int * ) ( buffer + * position ) ) [ 0 ] - 1 ; if ( max < value_length ) { goto invalid ; } * position += 4 ; value = PyUnicode_DecodeUTF8 ( buffer + * position, value_length, "strict" ) ; if (! value ) { return NULL ; } * position += value_length + 1 ; break ; } case 3 : { int size ; memcpy ( & size, buffer + * position, 4 ) ; if ( max < size ) { goto invalid ; } value = elements_to_dict ( self, buffer + * position + 4, size - 5, as_class, tz_aware, uuid_subtype ) ; if (! value ) { return NULL ; } if ( strcmp ( buffer + * position + 5, "$ref" ) == 0 ) { PyObject * dbref ; PyObject * collection = PyDict_GetItemString ( value, "$ref" ) ; PyObject * id = PyDict_GetItemString ( value, "$id" ) ; PyObject * database = PyDict_GetItemString ( value, "$db" ) ; Py_INCREF ( collection ) ; PyDict_DelItemString ( value, "$ref" ) ; <START_BUG> Py_INCREF ( id ) ; <END_BUG>  PyDict_DelItemString ( value, "$id" ) ; <START_BUG> if ( database == NULL ) { database = Py_None ; Py_INCREF ( database ) ; } else { Py_INCREF ( database ) ; PyDict_DelItemString ( value, "$db" ) ; } dbref = PyObject_CallFunctionObjArgs ( state -> DBRef, collection<END_BUG>

Fix:
<S2SV_ModStart> "$ref" ) ; if ( id == NULL ) { id = Py_None ; <S2SV_ModStart> id ) ; } else { Py_INCREF ( id ) ; <S2SV_ModStart> "$id" ) ; }
Buggy code:
 void vp8_denoiser_denoise_mb ( VP8_DENOISER * denoiser, MACROBLOCK * x, unsigned int best_sse, unsigned int zero_mv_sse, int recon_yoffset, <START_BUG> int recon_uvoffset ) <END_BUG> { int mv_row ; int mv_col ;  unsigned int motion_magnitude2 ; <START_BUG> MV_REFERENCE_FRAME frame = x -> best_reference_frame ; MV_REFERENCE_FRAME zero_frame = x -> best_zeromv_reference_frame ; enum vp8_denoiser_decision decision = FILTER_BLOCK ; <END_BUG> if ( zero_frame )  { YV12_BUFFER_CONFIG * src = & denoiser -> yv12_running_avg [ frame ] ; YV12_BUFFER_CONFIG * dst = & denoiser -> yv12_mc_running_avg ; YV12_BUFFER_CONFIG saved_pre, saved_dst ; MB_MODE_INFO saved_mbmi ; MACROBLOCKD * filter_xd = & x -> e_mbd ; MB_MODE_INFO * mbmi = & filter_xd -> mode_info_context -> mbmi ; <START_BUG> int sse_diff = zero_mv_sse - best_sse ; <END_BUG> saved_mbmi = * mbmi ; mbmi -> ref_frame = x -> best_reference_frame ; mbmi -> mode = x -> best_sse_inter_mode ; mbmi -> mv = x -> best_sse_mv ; mbmi -> need_to_clamp_mvs = x -> need_to_clamp_best_mvs ; mv_col = x -> best_sse_mv. as_mv. col ; mv_row = x -> best_sse_mv. as_mv. row ;  if ( frame == INTRA_FRAME || <START_BUG> <END_BUG> ( ( unsigned int ) ( mv_row * mv_row + mv_col * mv_col )  <= NOISE_MOTION_THRESHOLD && sse_diff < ( int ) SSE_DIFF_THRESHOLD ) ) { mbmi -> ref_frame = x -> best_zeromv_reference_frame ; src = & denoiser -> yv12_running_avg [ zero_frame ] ; mbmi -> mode = Z

Fix:
<S2SV_ModStart>, int recon_uvoffset, loop_filter_info_n * lfi_n, int mb_row, int mb_col, int block_index <S2SV_ModStart> ; unsigned int motion_threshold ; unsigned int motion_magnitude2 ; unsigned int sse_thresh ; int sse_diff_thresh = 0 ; int apply_spatial_loop_filter = 1 <S2SV_ModEnd> ; MV_REFERENCE_FRAME frame <S2SV_ModStart> = FILTER_BLOCK ; enum vp8_denoiser_decision decision_u = COPY_BLOCK ; enum vp8_denoiser_decision decision_v = COPY_BLOCK ; <S2SV_ModStart> mbmi ; int sse_diff = 0 ; const int zero_bias = denoiser -> denoise_pars. denoise_mv_bias ; zero_mv_sse = ( unsigned int ) ( ( int64_t ) zero_mv_sse * zero_bias // 100 ) ; <S2SV_ModStart> ; if ( ( unsigned int ) ( mv_row * mv_row + mv_col * mv_col ) <= NOISE_MOTION_THRESHOLD ) sse_diff_thresh = ( int ) SSE_DIFF_THRESHOLD ; if ( <S2SV_ModStart> == INTRA_FRAME || sse
Buggy code:
 static void usage ( void ) { PRINT_VERSION ; <START_BUG> puts ( "Copyright   (c)   2011,   Oracle   and//or   its   affiliates.   " <END_BUG> "All   rights   reserved.\\n" ) ; puts ( "Enable   or   disable   plugins." ) ; printf ( "\\nUsage:   %s   [options]   <plugin>   ENABLE|DISABLE\\n\\nOptions:\\n", my_progname ) ; my_print_help ( my_long_options ) ; puts ( "\\n" ) ; }

Fix:
<S2SV_ModStart> ; puts ( "Copyright <S2SV_blank> (c) <S2SV_blank> 2011, <S2SV_blank> 2015, <S2SV_blank> Oracle <S2SV_blank> and//or <S2SV_blank> its <S2SV_blank> affiliates. <S2SV_blank> " <S2SV_ModEnd> "All <S2SV_blank> rights <S2SV_blank> reserved.\\n" ) ;
Buggy code:
 static void single_motion_search ( VP9_COMP * cpi, MACROBLOCK * x, <START_BUG> const TileInfo * const tile, <END_BUG> BLOCK_SIZE bsize, int mi_row, int mi_col, int_mv * tmp_mv, int * rate_mv ) { MACROBLOCKD * xd = & x -> e_mbd ;  VP9_COMMON * cm = & cpi -> common ; <START_BUG> MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; <END_BUG> struct buf_2d backup_yv12 [ MAX_MB_PLANE ] = { { 0 } } ;  int bestsme = INT_MAX ; <START_BUG> int further_steps, step_param ; <END_BUG> int sadpb = x -> sadperbit16 ; MV mvp_full ; int ref = mbmi -> ref_frame [ 0 ] ;  MV ref_mv = mbmi -> ref_mvs [ ref ] [ 0 ]. as_mv ; <START_BUG> int tmp_col_min = x -> mv_col_min ; int tmp_col_max = x -> mv_col_max ; int tmp_row_min = x -> mv_row_min ; <END_BUG> int tmp_row_max = x -> mv_row_max ;  const YV12_BUFFER_CONFIG * scaled_ref_frame = vp9_get_scaled_ref_frame ( cpi, ref ) ; MV pred_mv [ 3 ] ; <START_BUG> pred_mv [ 0 ] = mbmi -> ref_mvs [ ref ] [ 0 ]. as_mv ; <END_BUG>  pred_mv [ 1 ] = mbmi -> ref_mvs [ ref ] [ 1 ]. as_mv ; <START_BUG> <END_BUG> pred_mv [ 2 ] = x -> pred_mv [ ref ]. as_mv ;  if ( scaled_ref_frame ) { int i ; for ( i = 0 ; i < MAX_MB_PLANE ; i ++ ) backup_yv12 [ i ] = xd -> plane [ i ]. pre [ 0 ] ; vp9_setup_pre_planes ( xd, 0, scaled_ref_frame, mi_row, mi_col, NULL ) ; } vp9_set_mv_search_range ( x, & ref_mv ) ; <START_BUG> if ( cp<END_BUG>

Fix:
<S2SV_ModStart> * x, <S2SV_ModEnd> BLOCK_SIZE bsize, <S2SV_ModStart> -> e_mbd ; const <S2SV_ModStart> { { 0, 0 <S2SV_ModStart> INT_MAX ; int <S2SV_ModEnd> step_param ; int <S2SV_ModStart> MV ref_mv = x -> mbmi_ext <S2SV_ModEnd> -> ref_mvs [ <S2SV_ModStart> x -> mv_row_max ; int cost_list [ 5 ] <S2SV_ModStart> 0 ] = x -> mbmi_ext <S2SV_ModEnd> -> ref_mvs [ <S2SV_ModStart> 1 ] = x -> mbmi_ext <S2SV_ModEnd> -> ref_mvs [ <S2SV_ModStart> [ ref ] <S2SV_ModEnd> ; if ( <S2SV_ModStart> -> sf. mv. auto_mv_step_size && cm -> <S2SV_ModEnd> show_frame ) { <S2SV_ModStart> ( vp9_init_search_range ( <S2SV_ModEnd> x -> max_mv_context <S2SV_ModStart> -> mv_step_param ) // 2 <S2SV_ModEnd> ; } else <S2SV_ModStart> bsize < BLOCK_64X64 <S2SV_ModEnd> ) { int <S2SV_ModStart> 2 * ( b_width_log2_lookup [ BLOCK_64X64 ] <S2SV_ModEnd> - MIN ( <S2SV_ModStart> - MIN ( b_height_log2_lookup [ bsize ], b_width_log2_lookup [ bsize ] <S2SV_ModEnd> ) ) ; <S2SV_ModStart> [ bsize ] <S2SV_ModEnd> ; int tlevel <S2SV_ModStart> += 2 ;
Buggy code:
 void * sspi_SecureHandleGetUpperPointer ( SecHandle * handle ) { void * pointer ; <START_BUG> if (! handle ) <END_BUG> return NULL ; pointer = ( void * ) ~ ( ( size_t ) handle -> dwUpper ) ; return pointer ; }

Fix:
<S2SV_ModStart> (! handle ||! SecIsValidHandle ( handle )
Buggy code:
 void ftpServerProcessList ( FtpClientConnection * connection, char_t * param ) { error_t error ; uint_t perm ; if (! connection -> userLoggedIn ) { osStrcpy ( connection -> response, "530   Not   logged   in\\r\\n" ) ; return ; } while ( * param == '-' ) { while ( * param!=' '&& * param!= '\\0' ) <START_BUG> param ++ ; <END_BUG>  while ( * param ==' ') <START_BUG> <END_BUG> param ++ ;  } if ( * param == '\\0' ) { osStrcpy ( connection -> path, connection -> currentDir ) ; } else { error = ftpServerGetPath ( connection, param, connection -> path, FTP_SERVER_MAX_PATH_LEN ) ; if ( error ) { osStrcpy ( connection -> response, "501   Invalid   parameter\\r\\n" ) ; return ; } } perm = ftpServerGetFilePermissions ( connection, connection -> path ) ; if ( ( perm & FTP_FILE_PERM_READ ) == 0 ) { osStrcpy ( connection -> response, "550   Access   denied\\r\\n" ) ; return ; } connection -> dir = fsOpenDir ( connection -> path ) ; if (! connection -> dir ) { osStrcpy ( connection -> response, "550   Directory   not   found\\r\\n" ) ; return ; } if ( connection -> passiveMode ) { if ( connection -> dataChannel. state == FTP_CHANNEL_STATE_IDLE ) connection -> dataChannel. state = FTP_CHANNEL_STATE_SEND ; } else { error = ftpServerOpenDataChannel ( connection ) ; if ( error ) { fsCloseDir ( connection -> dir ) ; osStrcpy ( connection -> response, "450   Can\'t   open   data   connection\\r\\n" ) ; return ; } connection -> dataChannel. state = FTP_CHANNEL_STATE_SEND ; } connection -> bufferLength = 0 ; connection -> bufferPos = 0 ; connection -> controlChannel. state = FTP_CHANNEL_STATE_LIST ; osStrcpy ( connection -> response, "150   Opening   data   connection\\r\\n" ) ; }

Fix:
<S2SV_ModStart>!= '\\0' ) { <S2SV_ModStart> param ++ ; } <S2SV_ModStart> =='<S2SV_blank>') { <S2SV_ModStart> param ++ ; }
Buggy code:
 int xfs_attr3_leaf_list_int ( struct xfs_buf * bp, struct xfs_attr_list_context * context ) { struct attrlist_cursor_kern * cursor ; struct xfs_attr_leafblock * leaf ; struct xfs_attr3_icleaf_hdr ichdr ; struct xfs_attr_leaf_entry * entries ; struct xfs_attr_leaf_entry * entry ; int retval ; int i ; struct xfs_mount * mp = context -> dp -> i_mount ; trace_xfs_attr_list_leaf ( context ) ; leaf = bp -> b_addr ; xfs_attr3_leaf_hdr_from_disk ( mp -> m_attr_geo, & ichdr, leaf ) ; entries = xfs_attr3_leaf_entryp ( leaf ) ; cursor = context -> cursor ; cursor -> initted = 1 ; if ( context -> resynch ) { entry = & entries [ 0 ] ; for ( i = 0 ; i < ichdr. count ; entry ++, i ++ ) { if ( be32_to_cpu ( entry -> hashval ) == cursor -> hashval ) { if ( cursor -> offset == context -> dupcnt ) { context -> dupcnt = 0 ; break ; } context -> dupcnt ++ ; } else if ( be32_to_cpu ( entry -> hashval ) > cursor -> hashval ) { context -> dupcnt = 0 ; break ; } } if ( i == ichdr. count ) { trace_xfs_attr_list_notfound ( context ) ; return 0 ; } } else { entry = & entries [ 0 ] ; i = 0 ; } context -> resynch = 0 ; retval = 0 ; for ( ; i < ichdr. count ; entry ++, i ++ ) { if ( be32_to_cpu ( entry -> hashval )!= cursor -> hashval ) { cursor -> hashval = be32_to_cpu ( entry -> hashval ) ; cursor -> offset = 0 ; } if ( entry -> flags & XFS_ATTR_INCOMPLETE ) continue ; if ( entry -> flags & XFS_ATTR_LOCAL ) { xfs_attr_leaf_name_local_t * name_loc = xfs_attr3_leaf_name_local ( leaf, i ) ; retval = context

Fix:
<S2SV_ModStart> ; if (! retval ) <S2SV_ModEnd> retval = context
Buggy code:
 <START_BUG> static void encode_b ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> TOKENEXTRA * * tp, int mi_row, int mi_col,  int output_enabled, BLOCK_SIZE bsize ) { <START_BUG> <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  <START_BUG> if ( bsize < BLOCK_8X8 ) { <END_BUG> if ( x -> ab_index > 0 ) return ; }  set_offsets ( cpi, tile, mi_row, mi_col, bsize ) ; <START_BUG> <END_BUG> update_state ( cpi, get_block_context ( x, bsize ), mi_row, mi_col, bsize,  output_enabled ) ; <START_BUG> encode_superblock ( cpi, tp, output_enabled, mi_row, mi_col, bsize ) ; <END_BUG> if ( output_enabled ) {  update_stats ( cpi ) ; <START_BUG> ( * tp ) -> token = EOSB_TOKEN ; ( * tp ) ++ ; } }<END_BUG>

Fix:
<S2SV_ModStart> * const tile, ThreadData * td <S2SV_ModStart>, BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> -> mb ; <S2SV_ModEnd> set_offsets ( cpi <S2SV_ModStart> cpi, tile, x <S2SV_ModStart> ( cpi, td, ctx <S2SV_ModEnd>, mi_row, <S2SV_ModStart> encode_superblock ( cpi, td <S2SV_ModStart> mi_col, bsize, ctx <S2SV_ModStart> { update_stats ( & cpi -> common, td <S2SV_ModEnd> ) ; (
Buggy code:
 static void perf_swevent_overflow ( struct perf_event * event, u64 overflow, <START_BUG> int nmi, struct perf_sample_data * data, <END_BUG> struct pt_regs * regs ) { struct hw_perf_event * hwc = & event -> hw ; int throttle = 0 ; data -> period = event -> hw. last_period ; if (! overflow ) overflow = perf_swevent_set_period ( event ) ; if ( hwc -> interrupts == MAX_INTERRUPTS ) return ; for ( ; overflow ; overflow -- ) {  if ( __perf_event_overflow ( event, nmi, throttle, <START_BUG> data, regs ) ) { break ; } throttle = 1 ; } }<END_BUG>

Fix:
<S2SV_ModStart> u64 overflow, <S2SV_ModEnd> struct perf_sample_data * <S2SV_ModStart> ( event, <S2SV_ModEnd> throttle, data
Buggy code:
 static int cp2112_gpio_get_all ( struct gpio_chip * chip ) { struct cp2112_device * dev = gpiochip_get_data ( chip ) ; struct hid_device * hdev = dev -> hdev ; u8 * buf = dev -> in_out_buffer ; <START_BUG> unsigned long flags ; <END_BUG> int ret ;  spin_lock_irqsave ( & dev -> lock, flags ) ; <START_BUG> ret = hid_hw_raw_request ( hdev, CP2112_GPIO_GET, buf, CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT, HID_REQ_GET_REPORT ) ; if ( ret!= CP2112_GPIO_GET_LENGTH ) { hid_err ( hdev, "error   requesting   GPIO   values:   %d\\n", ret ) ; ret = ret < 0? ret : - EIO ; goto exit ; } ret = buf [ 1 ] ; exit : <END_BUG> spin_unlock_irqrestore ( & dev -> lock, flags ) ;  return ret ; }

Fix:
<S2SV_ModStart> -> in_out_buffer ; <S2SV_ModEnd> int ret ; <S2SV_ModStart> int ret ; mutex_lock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; ret <S2SV_ModStart> ; exit : mutex_unlock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; return
Buggy code:
 static int em_call ( struct x86_emulate_ctxt * ctxt ) <START_BUG> { <END_BUG> long rel = ctxt -> src. val ; ctxt -> src. val = ( unsigned long ) ctxt -> _eip ;  jmp_rel ( ctxt, rel ) ; <START_BUG> return em_push ( ctxt ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ctxt ) { int rc ; <S2SV_ModStart> -> _eip ; rc = <S2SV_ModStart>, rel ) ; if ( rc!= X86EMUL_CONTINUE ) return rc
Buggy code:
 static OPCODE_DESC * avr_op_analyze ( RAnal * anal, RAnalOp * op, ut64 addr, const ut8 * buf, int len, CPU_MODEL * cpu ) { <START_BUG> OPCODE_DESC * opcode_desc ; <END_BUG> ut16 ins = ( buf [ 1 ] << 8 ) | buf [ 0 ] ; int fail ; char * t ; memset ( op, 0, sizeof ( RAnalOp ) ) ; op -> ptr = UT64_MAX ; op -> val = UT64_MAX ; op -> jump = UT64_MAX ; r_strbuf_init ( & op -> esil ) ; for ( opcode_desc = opcodes ; opcode_desc -> handler ; opcode_desc ++ ) { if ( ( ins & opcode_desc -> mask ) == opcode_desc -> selector ) { fail = 0 ; op -> cycles = opcode_desc -> cycles ; op -> size = opcode_desc -> size ; op -> type = opcode_desc -> type ; op -> jump = UT64_MAX ; op -> fail = UT64_MAX ; op -> addr = addr ; r_strbuf_setf ( & op -> esil, "" ) ; opcode_desc -> handler ( anal, op, buf, len, & fail, cpu ) ; if ( fail ) { goto INVALID_OP ; } if ( op -> cycles <= 0 ) { opcode_desc -> cycles = 2 ; } op -> nopcode = ( op -> type == R_ANAL_OP_TYPE_UNK ) ; t = r_strbuf_get ( & op -> esil ) ; if ( t && strlen ( t ) > 1 ) { t += strlen ( t ) - 1 ; if ( * t == ',' ) { * t = '\\0' ; } } return opcode_desc ; } } if ( ( ins & 0xff00 ) == 0xff00 && ( ins & 0xf ) > 7 ) { goto INVALID_OP ; } INVALID_OP : op -> family = R_ANAL_OP_FAMILY_UNKNOWN ; op -> type = R_ANAL_OP_TYPE_UNK ; op -> addr = addr ; op -> fail = UT64_MAX ; op -> jump = UT64_MAX ; op -> ptr = UT64_MAX ; op -> val = UT64_MAX ; op -> nopcode = 1 ; op

Fix:
<S2SV_ModStart> * opcode_desc ; if ( len < 2 ) { return NULL ; }
Buggy code:
 static int read_skip ( VP9_COMMON * cm, const MACROBLOCKD * xd, <START_BUG> int segment_id, vp9_reader * r ) { <END_BUG>  if ( vp9_segfeature_active ( & cm -> seg, segment_id, SEG_LVL_SKIP ) ) { <START_BUG> return 1 ; } else { const int ctx = vp9_get_skip_context ( xd ) ; <END_BUG> const int skip = vp9_read ( r, cm -> fc. skip_probs [ ctx ] ) ;  <START_BUG> if (! cm -> frame_parallel_decoding_mode ) <END_BUG> ++ cm -> counts. skip [ ctx ] [ skip ] ; return skip ; } }

Fix:
<S2SV_ModStart> int segment_id, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> { if ( segfeature_active <S2SV_ModEnd> ( & cm <S2SV_ModStart> int skip = vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> skip_probs [ ctx <S2SV_ModStart> ] ) ; FRAME_COUNTS * counts = xd -> counts ; if ( counts ) ++ counts -> <S2SV_ModEnd> skip [ ctx
Buggy code:
 void ripng_print ( netdissect_options * ndo, const u_char * dat, unsigned int length ) { register const struct rip6 * rp = ( const struct rip6 * ) dat ; register const struct netinfo6 * ni ; <START_BUG> register u_int amt ; <END_BUG> register u_int i ; int j ; int trunc ; if ( ndo -> ndo_snapend < dat ) return ; amt = ndo -> ndo_snapend - dat ; i = min ( length, amt ) ; if ( i < ( sizeof ( struct rip6 ) - sizeof ( struct netinfo6 ) ) ) return ; i -= ( sizeof ( struct rip6 ) - sizeof ( struct netinfo6 ) ) ; switch ( rp -> rip6_cmd ) { case RIP6_REQUEST :  j = length // sizeof ( * ni ) ; <START_BUG> if ( j == 1 <END_BUG> && rp -> rip6_nets -> rip6_metric == HOPCNT_INFINITY6  && IN6_IS_ADDR_UNSPECIFIED ( & rp -> rip6_nets -> rip6_dest ) ) { ND_PRINT ( ( ndo, "   ripng-req   dump" ) ) ; break ; } <START_BUG> if ( j * sizeof ( * ni )!= length - 4 ) <END_BUG> ND_PRINT ( ( ndo, "   ripng-req   %d[%u]:", j, length ) ) ; else  ND_PRINT ( ( ndo, "   ripng-req   %d:", j ) ) ; <START_BUG> trunc = ( ( i // sizeof ( * ni ) ) * sizeof ( * ni )!= i ) ; <END_BUG> for ( ni = rp -> rip6_nets ; i >= sizeof ( * ni ) ;  <START_BUG> i -= sizeof ( * ni ), ++ ni ) { <END_BUG> if ( ndo -> ndo_vflag > 1 ) ND_PRINT ( ( ndo, "\\n\\t" ) ) ; else ND_PRINT ( ( ndo, "   " ) ) ; rip6_entry_print ( ndo, ni, 0 ) ; }  break ; <START_BUG> case RIP6_RESPONSE : <END_BUG> j = length // sizeof ( * ni ) ;  <START_BUG> if ( j * sizeof ( * ni )!= length - 4 ) <END_BUG> ND_PRINT ( ( n

Fix:
<S2SV_ModStart> * ni ; unsigned int length_left ; u_int j ; ND_TCHECK ( rp -> rip6_cmd <S2SV_ModEnd> ) ; switch <S2SV_ModStart> case RIP6_REQUEST : length_left = length ; if ( length_left < ( sizeof ( struct rip6 ) - sizeof ( struct netinfo6 ) ) ) goto trunc ; length_left -= ( sizeof ( struct rip6 ) - sizeof ( struct netinfo6 ) ) ; j = length_left <S2SV_ModEnd> // sizeof ( <S2SV_ModStart> j == 1 ) { ND_TCHECK ( rp -> rip6_nets ) ; if ( <S2SV_ModEnd> rp -> rip6_nets <S2SV_ModStart> break ; } } <S2SV_ModStart> ni )!= length_left ) ND_PRINT ( ( ndo, " <S2SV_blank> ripng-req <S2SV_blank> %u[%u]:", j, length <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( ndo, " <S2SV_blank> ripng-req <S2SV_blank> %u:", j ) <S2SV_ModEnd> ) ; for <S2SV_ModStart> -> rip6_nets ; length_left <S2SV_ModEnd> >= sizeof ( <S2SV_ModStart> ni ) ; length_left <S2SV_ModEnd> -= sizeof ( <S2SV_ModStart> ni ) { ND_TCHECK ( * ni ) ; <S2SV_ModStart> ) ; } if ( length_left!= 0 )
Buggy code:
 <START_BUG> static void write_ref_frames ( const VP9_COMP * cpi, vp9_writer * w ) { <END_BUG> const VP9_COMMON * const cm = & cpi -> common ; const MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; const MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ; const int is_compound = has_second_ref ( mbmi ) ; const int segment_id = mbmi -> segment_id ;  if ( vp9_segfeature_active ( & cm -> seg, segment_id, SEG_LVL_REF_FRAME ) ) { <START_BUG> <END_BUG> assert (! is_compound ) ;  assert ( mbmi -> ref_frame [ 0 ] == vp9_get_segdata ( & cm -> seg, segment_id, SEG_LVL_REF_FRAME ) ) ; } else { <START_BUG> if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) { <END_BUG> vp9_write ( w, is_compound, vp9_get_reference_mode_prob ( cm, xd ) ) ; } else { assert (! is_compound == ( cm -> reference_mode == SINGLE_REFERENCE ) ) ; } if ( is_compound ) {  vp9_write ( w, mbmi -> ref_frame [ 0 ] == GOLDEN_FRAME, <START_BUG> vp9_get_pred_prob_comp_ref_p ( cm, xd ) ) ; } else { const int bit0 = mbmi -> ref_frame [ 0 ]!= LAST_FRAME ; <END_BUG> vp9_write ( w, bit0, vp9_get_pred_prob_single_ref_p1 ( cm, xd ) ) ;  if ( bit0 ) { const int bit1 = mbmi -> ref_frame [ 0 ]!= GOLDEN_FRAME ; <START_BUG> vp9_write ( w, bit1, vp9_get_pred_prob_single_ref_p2 ( cm, xd ) ) ; <END_BUG> } } } }

Fix:
<S2SV_ModStart> write_ref_frames ( const VP9_COMMON * cm, const MACROBLOCKD * xd, vpx_writer * w ) { const MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ; const int is_compound = has_second_ref ( mbmi ) ; const int segment_id = mbmi -> segment_id ; if ( segfeature_active ( & cm -> seg, segment_id, SEG_LVL_REF_FRAME ) ) { assert (! is_compound ) ; assert ( mbmi -> ref_frame [ 0 ] == get_segdata ( & <S2SV_ModEnd> cm -> seg <S2SV_ModStart> SEG_LVL_REF_FRAME ) ) ; } else { if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) { vpx_write ( w, is_compound, vp9_get_reference_mode_prob ( cm, xd ) ) ; } else <S2SV_ModStart> (! is_compound == <S2SV_ModEnd> ( cm -> <S2SV_ModStart> -> reference_mode == <S2SV_ModEnd> SINGLE_REFERENCE ) ) <S2SV_ModStart> is_compound ) { vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart>!= LAST_FRAME ; vpx_write <S2SV_ModEnd> (
Buggy code:
 static int __poke_user ( struct task_struct * child, addr_t addr, addr_t data ) { struct user * dummy = NULL ; addr_t offset ; if ( addr < ( addr_t ) & dummy -> regs. acrs ) { if ( addr == ( addr_t ) & dummy -> regs. psw. mask ) { unsigned long mask = PSW_MASK_USER ; mask |= is_ri_task ( child )? PSW_MASK_RI : 0 ; <START_BUG> if ( ( data & ~ mask )!= PSW_USER_BITS ) <END_BUG> return - EINVAL ; if ( ( data & PSW_MASK_EA ) &&! ( data & PSW_MASK_BA ) ) return - EINVAL ; } * ( addr_t * ) ( ( addr_t ) & task_pt_regs ( child ) -> psw + addr ) = data ; } else if ( addr < ( addr_t ) ( & dummy -> regs. orig_gpr2 ) ) { offset = addr - ( addr_t ) & dummy -> regs. acrs ; # ifdef CONFIG_64BIT if ( addr == ( addr_t ) & dummy -> regs. acrs [ 15 ] ) child -> thread. acrs [ 15 ] = ( unsigned int ) ( data >> 32 ) ; else # endif * ( addr_t * ) ( ( addr_t ) & child -> thread. acrs + offset ) = data ; } else if ( addr == ( addr_t ) & dummy -> regs. orig_gpr2 ) { task_pt_regs ( child ) -> orig_gpr2 = data ; } else if ( addr < ( addr_t ) & dummy -> regs. fp_regs ) { return 0 ; } else if ( addr < ( addr_t ) ( & dummy -> regs. fp_regs + 1 ) ) { if ( addr == ( addr_t ) & dummy -> regs. fp_regs. fpc ) if ( ( unsigned int ) data!= 0 || test_fp_ctl ( data >> ( BITS_PER_LONG - 32 ) ) ) return - EINVAL ; offset = addr - ( addr_t ) & dummy -> regs. fp_regs ; * ( addr_t * ) ( ( addr_t ) & child -> thread. fp_regs

Fix:
<S2SV_ModStart> ( ( data ^ PSW_USER_BITS ) <S2SV_ModStart> ~ mask ) return - EINVAL ; if ( ( data & PSW_MASK_ASC ) == PSW_ASC_HOME <S2SV_ModEnd> ) return -
Buggy code:
 void sas_deform_port ( struct asd_sas_phy * phy, int gone ) { struct sas_ha_struct * sas_ha = phy -> ha ; struct asd_sas_port * port = phy -> port ; struct sas_internal * si = to_sas_internal ( sas_ha -> core. shost -> transportt ) ; struct domain_device * dev ; unsigned long flags ; if (! port ) return ; dev = port -> port_dev ; if ( dev ) dev -> pathways -- ; if ( port -> num_phys == 1 ) { sas_unregister_domain_devices ( port, gone ) ; <START_BUG> sas_port_delete ( port -> port ) ; <END_BUG> port -> port = NULL ; } else { sas_port_delete_phy ( port -> port, phy -> phy ) ; sas_device_set_phy ( dev, port -> port ) ; } if ( si -> dft -> lldd_port_deformed ) si -> dft -> lldd_port_deformed ( phy ) ; spin_lock_irqsave ( & sas_ha -> phy_port_lock, flags ) ; spin_lock ( & port -> phy_list_lock ) ; list_del_init ( & phy -> port_phy_el ) ; sas_phy_set_target ( phy, NULL ) ; phy -> port = NULL ; port -> num_phys -- ; port -> phy_mask &= ~ ( 1U << phy -> id ) ; if ( port -> num_phys == 0 ) { INIT_LIST_HEAD ( & port -> phy_list ) ; memset ( port -> sas_addr, 0, SAS_ADDR_SIZE ) ; memset ( port -> attached_sas_addr, 0, SAS_ADDR_SIZE ) ; port -> class = 0 ; port -> iproto = 0 ; port -> tproto = 0 ; port -> oob_mode = 0 ; port -> phy_mask = 0 ; } spin_unlock ( & port -> phy_list_lock ) ; spin_unlock_irqrestore ( & sas_ha -> phy_port_lock, flags ) ; return ; }

Fix:
<S2SV_ModStart> gone ) ; sas_destruct_devices ( port ) ;
Buggy code:
 int fit_check_format ( const void * fit, ulong size ) { int ret ; ret = fdt_check_header ( fit ) ; if ( ret ) { log_debug ( "Wrong   FIT   format:   not   a   flattened   device   tree   (err=%d)\\n", ret ) ; return - ENOEXEC ; } if ( CONFIG_IS_ENABLED ( FIT_FULL_CHECK ) ) { if ( size == IMAGE_SIZE_INVAL ) size = fdt_totalsize ( fit ) ; ret = fdt_check_full ( fit, size ) ; <START_BUG> if ( ret ) { <END_BUG> log_debug ( "FIT   check   error   %d\\n", ret ) ;  return - EINVAL ; <START_BUG> } } if (! fdt_getprop ( fit, 0, FIT_DESC_PROP, NULL ) ) { log_debug ( "Wrong   FIT   format:   no   description\\n" ) ; return - ENOMSG ; } if ( IMAGE_ENABLE_TIMESTAMP ) { if (! fdt_getprop ( fit, 0, FIT_TIMESTAMP_PROP, NULL ) ) { log_debug ( "Wrong   FIT   format:   no   timestamp\\n" ) ; return - ENODATA ; } } if ( fdt_path_offset ( fit, FIT_IMAGES_PATH ) < 0 ) { log_debug ( "Wrong   FIT   format:   no   images   parent   node\\n" ) ; return - ENOENT ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ( ret ) ret = - EINVAL ; if (! ret && CONFIG_IS_ENABLED ( FIT_SIGNATURE ) ) { ret = fdt_check_no_at ( fit, 0 ) ; if ( ret ) <S2SV_ModStart> ) ; return ret ; } } if ( ret ) { log_debug ( "FIT <S2SV_blank> check <S2SV_blank> error <S2SV_blank> %d\\n", ret ) ; return ret <S2SV_ModEnd> ; } }
Buggy code:
 struct lookahead_ctx * vp9_lookahead_init ( unsigned int width, unsigned int height, unsigned int subsampling_x, unsigned int subsampling_y, <START_BUG> unsigned int depth ) { <END_BUG> struct lookahead_ctx * ctx = NULL ; depth = clamp ( depth, 1, MAX_LAG_BUFFERS ) ; depth += MAX_PRE_FRAMES ; ctx = calloc ( 1, sizeof ( * ctx ) ) ; if ( ctx ) {  unsigned int i ; <START_BUG> ctx -> max_sz = depth ; ctx -> buf = calloc ( depth, sizeof ( * ctx -> buf ) ) ; if (! ctx -> buf ) goto bail ; for ( i = 0 ; i < depth ; i ++ ) <END_BUG> if ( vp9_alloc_frame_buffer ( & ctx -> buf [ i ]. img,  width, height, subsampling_x, subsampling_y, <START_BUG> VP9_ENC_BORDER_IN_PIXELS ) ) <END_BUG> goto bail ; } return ctx ; bail : vp9_lookahead_destroy ( ctx ) ; return NULL ; }

Fix:
<S2SV_ModStart> int subsampling_y, # if CONFIG_VP9_HIGHBITDEPTH int use_highbitdepth, # endif <S2SV_ModStart> ctx ) { const int legacy_byte_alignment = 0 ; <S2SV_ModStart> ) if ( vpx_alloc_frame_buffer <S2SV_ModEnd> ( & ctx <S2SV_ModStart>, subsampling_y, # if CONFIG_VP9_HIGHBITDEPTH use_highbitdepth, # endif VP9_ENC_BORDER_IN_PIXELS, legacy_byte_alignment <S2SV_ModEnd> ) ) goto
Buggy code:
 static u64 __skb_get_nlattr_nest ( u64 ctx, u64 A, u64 X, u64 r4, u64 r5 ) { struct sk_buff * skb = ( struct sk_buff * ) ( long ) ctx ; struct nlattr * nla ; if ( skb_is_nonlinear ( skb ) ) return 0 ; <START_BUG> if ( A > skb -> len - sizeof ( struct nlattr ) ) <END_BUG> return 0 ; nla = ( struct nlattr * ) & skb -> data [ A ] ;  if ( nla -> nla_len > A - skb -> len ) <START_BUG> return 0 ; nla = nla_find_nested ( nla, X ) ; if ( nla ) return ( void * ) nla - ( void * ) skb -> data ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( skb -> len < sizeof ( struct nlattr ) ) return 0 ; if ( <S2SV_ModStart> -> nla_len > <S2SV_ModEnd> skb -> len <S2SV_ModStart> skb -> len - A
Buggy code:
 static int copy_to_user_tmpl ( struct xfrm_policy * xp, struct sk_buff * skb ) { struct xfrm_user_tmpl vec [ XFRM_MAX_DEPTH ] ; int i ; if ( xp -> xfrm_nr == 0 ) return 0 ; for ( i = 0 ; i < xp -> xfrm_nr ; i ++ ) { struct xfrm_user_tmpl * up = & vec [ i ] ; struct xfrm_tmpl * kp = & xp -> xfrm_vec [ i ] ; <START_BUG> memcpy ( & up -> id, & kp -> id, sizeof ( up -> id ) ) ; <END_BUG> up -> family = kp -> encap_family ; memcpy ( & up -> saddr, & kp -> saddr, sizeof ( up -> saddr ) ) ; up -> reqid = kp -> reqid ; up -> mode = kp -> mode ; up -> share = kp -> share ; up -> optional = kp -> optional ; up -> aalgos = kp -> aalgos ; up -> ealgos = kp -> ealgos ; up -> calgos = kp -> calgos ; } return nla_put ( skb, XFRMA_TMPL, sizeof ( struct xfrm_user_tmpl ) * xp -> xfrm_nr, vec ) ; }

Fix:
<S2SV_ModStart> i ] ; memset ( up, 0, sizeof ( * up ) ) ;
Buggy code:
 static bool new_idmap_permitted ( const struct file * file, struct user_namespace * ns, int cap_setid, struct uid_gid_map * new_map ) { if ( ( new_map -> nr_extents == 1 ) && ( new_map -> extent [ 0 ]. count == 1 ) ) { u32 id = new_map -> extent [ 0 ]. lower_first ; if ( cap_setid == CAP_SETUID ) { kuid_t uid = make_kuid ( ns -> parent, id ) ; <START_BUG> if ( uid_eq ( uid, current_fsuid ( ) ) ) <END_BUG> return true ; } else if ( cap_setid == CAP_SETGID ) { kgid_t gid = make_kgid ( ns -> parent, id ) ;  if ( gid_eq ( gid, current_fsgid ( ) ) ) <START_BUG> return true ; } } if (! cap_valid ( cap_setid ) ) return true ; if ( ns_capable ( ns -> parent, cap_setid ) && file_ns_capable ( file, ns -> parent, cap_setid ) ) return true ; return false ; }<END_BUG>

Fix:
<S2SV_ModStart> ( uid, file -> f_cred -> fsuid <S2SV_ModEnd> ) ) return <S2SV_ModStart> ( gid, file -> f_cred -> fsgid <S2SV_ModEnd> ) ) return
Buggy code:
 GPMF_ERR IsValidSize ( GPMF_stream * ms, uint32_t size ) { if ( ms ) { <START_BUG> int32_t nestsize = ( int32_t ) ms -> nest_size [ ms -> nest_level ] ; <END_BUG> if ( nestsize == 0 && ms -> nest_level == 0 ) nestsize = ms -> buffer_size_longs ; if ( size + 2 <= nestsize ) return GPMF_OK ; } return GPMF_ERROR_BAD_STRUCTURE ; }

Fix:
<S2SV_ModStart> ms ) { uint32_t <S2SV_ModEnd> nestsize = ( <S2SV_ModStart> nestsize = ( uint32_t <S2SV_ModEnd> ) ms ->
Buggy code:
 static INLINE void load_pred_mv ( MACROBLOCK * x, PICK_MODE_CONTEXT * ctx ) { <START_BUG> vpx_memcpy ( x -> pred_mv, ctx -> pred_mv, sizeof ( x -> pred_mv ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ctx ) { memcpy <S2SV_ModEnd> ( x ->
Buggy code:
 int main_configure ( char * arg1, char * arg2 ) { int cmdline_status ; <START_BUG> cmdline_status = options_cmdline ( arg1, arg2 ) ; <END_BUG> if ( cmdline_status )  return cmdline_status ; <START_BUG> options_apply ( ) ; str_canary_init ( ) ; log_open ( SINK_SYSLOG ) ; if ( bind_ports ( ) ) <END_BUG> return 1 ;  # ifdef HAVE_CHROOT if ( change_root ( ) ) <START_BUG> return 1 ; <END_BUG> # endif if ( drop_privileges ( 1 ) )  return 1 ; <START_BUG> if ( log_open ( SINK_OUTFILE ) ) <END_BUG> return 1 ;  # ifndef USE_FORK num_clients = 0 ; # endif log_flush ( LOG_MODE_CONFIGURED ) ; return 0 ; }

Fix:
<S2SV_ModStart> int cmdline_status ; log_flush ( LOG_MODE_BUFFER ) ; <S2SV_ModStart> ( cmdline_status ) { log_flush ( LOG_MODE_ERROR ) ; return cmdline_status ; } options_free ( 1 ) <S2SV_ModEnd> ; options_apply ( <S2SV_ModStart> ( ) ) { unbind_ports ( ) ; options_free ( 1 ) ; options_defaults ( ) ; options_apply ( ) ; log_flush ( LOG_MODE_ERROR ) ; return 1 ; } <S2SV_ModEnd> # ifdef HAVE_CHROOT <S2SV_ModStart> ( ) ) { log_flush ( LOG_MODE_ERROR ) ; return 1 ; } <S2SV_ModEnd> # endif if <S2SV_ModStart> 1 ) ) { log_flush ( LOG_MODE_ERROR ) ; return 1 ; } <S2SV_ModEnd> if ( log_open <S2SV_ModStart> SINK_OUTFILE ) ) { log_flush ( LOG_MODE_ERROR ) ; return 1 ; } <S2SV_ModEnd> # ifndef USE_FORK
Buggy code:
 <START_BUG> void ipc_rcu_getref ( void * ptr ) <END_BUG> {  container_of ( ptr, struct ipc_rcu_hdr, data ) -> refcount ++ ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> int <S2SV_ModEnd> ipc_rcu_getref ( void <S2SV_ModStart> ptr ) { return atomic_inc_not_zero ( & <S2SV_ModStart> ) -> refcount ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static inline int ip6_ufo_append_data ( struct sock * sk, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int hh_len, int fragheaderlen, int transhdrlen, int mtu, unsigned int flags, struct rt6_info * rt ) { struct sk_buff * skb ; <START_BUG> int err ; <END_BUG> if ( ( skb = skb_peek_tail ( & sk -> sk_write_queue ) ) == NULL ) {  struct frag_hdr fhdr ; <START_BUG> skb = sock_alloc_send_skb ( sk, hh_len + fragheaderlen + transhdrlen + 20, ( flags & MSG_DONTWAIT ), & err ) ; if ( skb == NULL ) return err ; skb_reserve ( skb, hh_len ) ; skb_put ( skb, fragheaderlen + transhdrlen ) ; skb_reset_network_header ( skb ) ; skb -> transport_header = skb -> network_header + fragheaderlen ; skb -> protocol = htons ( ETH_P_IPV6 ) ; <END_BUG> skb -> ip_summed = CHECKSUM_PARTIAL ;  skb -> csum = 0 ; skb_shinfo ( skb ) -> gso_size = ( mtu - fragheaderlen - sizeof ( struct frag_hdr ) ) & ~ 7 ; skb_shinfo ( skb ) -> gso_type = SKB_GSO_UDP ; ipv6_select_ident ( & fhdr, rt ) ; skb_shinfo ( skb ) -> ip6_frag_id = fhdr. identification ; <START_BUG> __skb_queue_tail ( & sk -> sk_write_queue, skb ) ; <END_BUG> } return skb_append_datato_frags ( sk, skb, getfrag, from, ( length - transhdrlen ) ) ; }

Fix:
<S2SV_ModStart> * skb ; struct frag_hdr fhdr ; <S2SV_ModStart> NULL ) { <S2SV_ModEnd> skb = sock_alloc_send_skb <S2SV_ModStart> ; skb -> csum = 0 ; __skb_queue_tail ( & sk -> sk_write_queue, skb ) ; } else if ( skb_is_gso ( skb ) ) { goto append ; } skb -> <S2SV_ModStart> ip_summed = CHECKSUM_PARTIAL <S2SV_ModEnd> ; skb_shinfo ( <S2SV_ModStart>. identification ; append : <S2SV_ModEnd> return skb_append_datato_frags (
Buggy code:
 static void process_constructors ( RBinFile * bf, RList * ret, int bits ) { RList * secs = sections ( bf ) ; RListIter * iter ; RBinSection * sec ; int i, type ; r_list_foreach ( secs, iter, sec ) { type = - 1 ; if (! strcmp ( sec -> name, ".fini_array" ) ) { type = R_BIN_ENTRY_TYPE_FINI ; } else if (! strcmp ( sec -> name, ".init_array" ) ) { type = R_BIN_ENTRY_TYPE_INIT ; } else if (! strcmp ( sec -> name, ".preinit_array" ) ) { type = R_BIN_ENTRY_TYPE_PREINIT ; } if ( type!= - 1 ) { ut8 * buf = calloc ( sec -> size, 1 ) ; if (! buf ) { continue ; } ( void ) r_buf_read_at ( bf -> buf, sec -> paddr, buf, sec -> size ) ; if ( bits == 32 ) { <START_BUG> for ( i = 0 ; i < sec -> size ; i += 4 ) { <END_BUG> ut32 addr32 = r_read_le32 ( buf + i ) ; if ( addr32 ) { RBinAddr * ba = newEntry ( sec -> paddr + i, ( ut64 ) addr32, type, bits ) ; r_list_append ( ret, ba ) ; } } } else {  for ( i = 0 ; i < sec -> size ; i += 8 ) { <START_BUG> ut64 addr64 = r_read_le64 ( buf + i ) ; if ( addr64 ) { RBinAddr * ba = newEntry ( sec -> paddr + i, addr64, type, bits ) ; r_list_append ( ret, ba ) ; } } } free ( buf ) ; } } r_list_free ( secs ) ; }<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; ( i + 3 ) <S2SV_ModEnd> < sec -> <S2SV_ModStart> = 0 ; ( i + 7 ) <S2SV_ModEnd> < sec ->
Buggy code:
 char * uwsgi_expand_path ( char * dir, int dir_len, char * ptr ) { <START_BUG> char src [ PATH_MAX + 1 ] ; <END_BUG>  memcpy ( src, dir, dir_len ) ; <START_BUG> src [ dir_len ] = 0 ; char * dst = ptr ; if (! dst ) dst = uwsgi_malloc ( PATH_MAX + 1 ) ; if (! realpath ( src, dst ) ) { uwsgi_error_realpath ( src ) ; if (! ptr ) free ( dst ) ; <END_BUG> return NULL ;  <START_BUG> } <END_BUG> return dst ; }

Fix:
<S2SV_ModStart> ptr ) { if ( dir_len > PATH_MAX ) { uwsgi_log ( "invalid <S2SV_blank> path <S2SV_blank> size: <S2SV_blank> %d <S2SV_blank> (max <S2SV_blank> %d)\\n", dir_len, PATH_MAX ) ; return NULL ; } char * src = uwsgi_concat2n ( <S2SV_ModEnd> dir, dir_len <S2SV_ModStart> dir, dir_len, "", 0 ) <S2SV_ModEnd> ; char * <S2SV_ModStart> dst ) ; free ( src ) ; <S2SV_ModStart> NULL ; } free ( src ) ;
Buggy code:
 static void rdpdr_process ( STREAM s ) { uint32 handle ; uint16 vmin ; uint16 component ; uint16 pakid ; <START_BUG> logger ( Protocol, Debug, "rdpdr_process()" ) ; <END_BUG> in_uint16 ( s, component ) ; in_uint16 ( s, pakid ) ; if ( component == RDPDR_CTYP_CORE ) { switch ( pakid ) { case PAKID_CORE_DEVICE_IOREQUEST : rdpdr_process_irp ( s ) ; break ; case PAKID_CORE_SERVER_ANNOUNCE : in_uint8s ( s, 2 ) ; in_uint16_le ( s, vmin ) ;  in_uint32_le ( s, g_client_id ) ; <START_BUG> if ( vmin < 0x000c ) g_client_id = 0x815ed39d ; g_epoch ++ ; # if WITH_SCARD scard_release_all_contexts ( ) ; # endif rdpdr_send_client_announce_reply ( ) ; rdpdr_send_client_name_request ( ) ; break ; case PAKID_CORE_CLIENTID_CONFIRM : rdpdr_send_client_device_list_announce ( ) ; break ; case PAKID_CORE_DEVICE_REPLY : in_uint32 ( s, handle ) ; logger ( Protocol, Debug, "rdpdr_process(),   server   connected   to   resource   %d", handle ) ; break ; case PAKID_CORE_SERVER_CAPABILITY : rdpdr_send_client_capability_response ( ) ; break ; default : logger ( Protocol, Debug, "rdpdr_process(),   pakid   0x%x   of   component   0x%x", pakid, component ) ; break ; } } else if ( component == RDPDR_CTYP_PRN ) { if ( pakid == PAKID_PRN_CACHE_DATA ) printercache_process ( s ) ; } else logger ( Protocol, Warning, "rdpdr_process(),   unhandled   component   0x%x", component ) ; }<END_BUG>

Fix:
<S2SV_ModStart> uint16 pakid ; struct stream packet = * s ; <S2SV_ModStart> g_client_id ) ; if (! s_check ( s ) ) { rdp_protocol_error ( "rdpdr_process(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> g_client_id <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> did <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 int main ( int argc, const char * * argv_ ) { int pass ; vpx_image_t raw ; <START_BUG> int frame_avail, got_data ; <END_BUG>  struct VpxInputContext input = { 0 } ; <START_BUG> struct VpxEncoderConfig global ; struct stream_state * streams = NULL ; char * * argv, * * argi ; uint64_t cx_time = 0 ; int stream_cnt = 0 ; int res = 0 ; <END_BUG> exec_name = argv_ [ 0 ] ;  if ( argc < 3 ) usage_exit ( ) ; input. framerate. numerator = 30 ; input. framerate. denominator = 1 ; <START_BUG> input. use_i420 = 1 ; <END_BUG>  input. only_i420 = 1 ; <START_BUG> argv = argv_dup ( argc - 1, argv_ + 1 ) ; <END_BUG> parse_global_config ( & global, argv ) ;  { struct stream_state * stream = NULL ; do { stream = new_stream ( & global, stream ) ; stream_cnt ++ ; if (! streams ) streams = stream ; } while ( parse_stream_params ( & global, stream, argv ) ) ; } for ( argi = argv ; * argi ; argi ++ ) if ( argi [ 0 ] [ 0 ] == '-' && argi [ 0 ] [ 1 ] ) die ( "Error:   Unrecognized   option   %s\\n", * argi ) ; FOREACH_STREAM ( check_encoder_config ( global. disable_warning_prompt, & global, & stream -> config. cfg ) ; ) ; input. filename = argv [ 0 ] ; if (! input. filename ) usage_exit ( ) ; if ( global. codec -> fourcc == VP9_FOURCC ) input. only_i420 = 0 ; for ( pass = global. pass? global. pass - 1 : 0 ; pass < global. passes ; pass ++ ) { int frames_in = 0, seen_frames = 0 ; int64_t estimated_time_left = - 1 ; int64_t average_rate = - 1 ; <START_BUG> off_t lagged_count = 0 ; <END_BUG> open_input_file ( & input ) ;  if (! input. width ||! input. height ) <START_BUG> FOREACH_STREAM ( { if ( stream -> config. cfg<END_BUG>

Fix:
<S2SV_ModStart> vpx_image_t raw ; # if CONFIG_VP9_HIGHBITDEPTH vpx_image_t raw_shift ; int allocated_raw_shift = 0 ; int use_16bit_internal = 0 ; int input_shift = 0 ; # endif <S2SV_ModStart> struct VpxInputContext input <S2SV_ModEnd> ; struct VpxEncoderConfig <S2SV_ModStart> = 0 ; memset ( & input, 0, sizeof ( input ) ) ; <S2SV_ModStart> ; input. only_i420 <S2SV_ModEnd> = 1 ; <S2SV_ModStart> ; input. bit_depth = 0 <S2SV_ModEnd> ; argv = <S2SV_ModStart> argv ) ; switch ( global. color_type ) { case I420 : input. fmt = VPX_IMG_FMT_I420 ; break ; case I422 : input. fmt = VPX_IMG_FMT_I422 ; break ; case I444 : input. fmt = VPX_IMG_FMT_I444 ; break ; case I440 : input. fmt = VPX_IMG_FMT_I440 ; break ; case YV12 : input. fmt = VPX_IMG_FMT_YV12 ; break ; }
Buggy code:
 void vp9_disable_segmentation ( struct segmentation * seg ) { seg -> enabled = 0 ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> = 0 ; seg -> update_map = 0 ; seg -> update_data = 0 ;
Buggy code:
 SYSCALL_DEFINE5 ( osf_getsysinfo, unsigned long, op, void __user *, buffer, unsigned long, nbytes, int __user *, start, void __user *, arg ) { unsigned long w ; struct percpu_struct * cpu ; switch ( op ) { case GSI_IEEE_FP_CONTROL : w = current_thread_info ( ) -> ieee_state & IEEE_SW_MASK ; w = swcr_update_status ( w, rdfpcr ( ) ) ; if ( put_user ( w, ( unsigned long __user * ) buffer ) ) return - EFAULT ; return 0 ; case GSI_IEEE_STATE_AT_SIGNAL : break ; case GSI_UACPROC : if ( nbytes < sizeof ( unsigned int ) ) return - EINVAL ; w = ( current_thread_info ( ) -> flags >> UAC_SHIFT ) & UAC_BITMASK ; if ( put_user ( w, ( unsigned int __user * ) buffer ) ) return - EFAULT ; return 1 ; case GSI_PROC_TYPE : if ( nbytes < sizeof ( unsigned long ) ) return - EINVAL ; cpu = ( struct percpu_struct * ) ( ( char * ) hwrpb + hwrpb -> processor_offset ) ; w = cpu -> type ; if ( put_user ( w, ( unsigned long __user * ) buffer ) ) return - EFAULT ; return 1 ; case GSI_GET_HWRPB : <START_BUG> if ( nbytes < sizeof ( * hwrpb ) ) <END_BUG> return - EINVAL ; if ( copy_to_user ( buffer, hwrpb, nbytes )!= 0 ) return - EFAULT ; return 1 ; default : break ; } return - EOPNOTSUPP ; }

Fix:
<S2SV_ModStart> if ( nbytes > <S2SV_ModEnd> sizeof ( *