nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void parse_global_config ( struct VpxEncoderConfig * global, char * * argv ) { char * * argi, * * argj ; struct arg arg ; <START_BUG> memset ( global, 0, sizeof ( * global ) ) ; <END_BUG>  global -> codec = get_vpx_encoder_by_index ( 0 ) ; <START_BUG> global -> passes = 0 ; global -> use_i420 = 1 ; global -> deadline = VPX_DL_GOOD_QUALITY ; for ( argi = argj = argv ; ( * argj = * argi ) ; argi += arg. argv_step ) { arg. argv_step = 1 ; if ( arg_match ( & arg, & codecarg, argi ) ) { global -> codec = get_vpx_encoder_by_name ( arg. val ) ; if (! global -> codec ) die ( "Error:   Unrecognized   argument   (%s)   to   --codec\\n", arg. val ) ; } else if ( arg_match ( & arg, & passes, argi ) ) { global -> passes = arg_parse_uint ( & arg ) ; if ( global -> passes < 1 || global -> passes > 2 ) die ( "Error:   Invalid   number   of   passes   (%d)\\n", global -> passes ) ; } else if ( arg_match ( & arg, & pass_arg, argi ) ) { global -> pass = arg_parse_uint ( & arg ) ; if ( global -> pass < 1 || global -> pass > 2 ) die ( "Error:   Invalid   pass   selected   (%d)\\n", global -> pass ) ; } else if ( arg_match ( & arg, & usage, argi ) ) global -> usage = arg_parse_uint ( & arg ) ; else if ( arg_match ( & arg, & deadline, argi ) ) global -> deadline = arg_parse_uint ( & arg ) ; else if ( arg_match ( & arg, & best_dl, argi ) ) global -> deadline = VPX_DL_BEST_QUALITY ; else if ( arg_match ( & arg, & good_dl, argi ) ) global -> deadline = VPX_DL_GOOD_QUALITY ; else if ( arg_match ( & arg, &<END_BUG>

Fix:
<S2SV_ModStart> arg arg ; const int num_encoder = get_vpx_encoder_count ( ) ; if ( num_encoder < 1 ) die ( "Error: <S2SV_blank> no <S2SV_blank> valid <S2SV_blank> encoder <S2SV_blank> available\\n" ) ; <S2SV_ModStart> = get_vpx_encoder_by_index ( num_encoder - 1 ) ; global -> passes = 0 ; global -> color_type = I420 <S2SV_ModEnd> ; global -> <S2SV_ModStart> ) global -> color_type = YV12 ; else if ( arg_match ( & arg, & use_i420, argi ) ) global -> color_type = I420 ; else if ( arg_match ( & arg, & use_i422, argi ) ) global -> color_type = I422 ; else if ( arg_match ( & arg, & use_i444, argi ) ) global -> color_type = I444 ; else if ( arg_match ( & arg, & use_i440, argi ) ) global -> color_type = I440 <S2SV_ModEnd> ; else if <S2SV_ModStart> 1 ; else <S2SV_ModEnd> argj ++ ; <S2SV_ModStart> # if CONFIG_VP9_ENCODER || CONFIG_VP10_ENCODER
Buggy code:
 void isakmp_rfc3948_print ( netdissect_options * ndo, const u_char * bp, u_int length, const u_char * bp2 ) { <START_BUG> if ( length == 1 && bp [ 0 ] == 0xff ) { <END_BUG> ND_PRINT ( ( ndo, "isakmp-nat-keep-alive" ) ) ; return ; } if ( length < 4 ) { goto trunc ;  } <START_BUG> if ( bp [ 0 ] == 0 && bp [ 1 ] == 0 && bp [ 2 ] == 0 && bp [ 3 ] == 0 ) { ND_PRINT ( ( ndo, "NONESP-encap:   " ) ) ; isakmp_print ( ndo, bp + 4, length - 4, bp2 ) ; return ; } { int nh, enh, padlen ; int advance ; ND_PRINT ( ( ndo, "UDP-encap:   " ) ) ; advance = esp_print ( ndo, bp, length, bp2, & enh, & padlen ) ; if ( advance <= 0 ) return ; bp += advance ; length -= advance + padlen ; nh = enh & 0xff ; ip_print_inner ( ndo, bp, length, nh, bp2 ) ; return ; } trunc : ND_PRINT ( ( ndo, "[|isakmp]" ) ) ; return ; }<END_BUG>

Fix:
<S2SV_ModStart> bp2 ) { ND_TCHECK ( bp [ 0 ] ) ; <S2SV_ModStart> trunc ; } ND_TCHECK ( bp [ 3 ] ) ;
Buggy code:
 int CLASS parse_tiff_ifd ( int base ) { unsigned entries, tag, type, len, plen = 16, save ; int ifd, use_cm = 0, cfa, i, j, c, ima_len = 0 ; char * cbuf, * cp ; uchar cfa_pat [ 16 ], cfa_pc [ ] = { 0, 1, 2, 3 }, tab [ 256 ] ; double fm [ 3 ] [ 4 ], cc [ 4 ] [ 4 ], cm [ 4 ] [ 3 ], cam_xyz [ 4 ] [ 3 ], num ; double ab [ ] = { 1, 1, 1, 1 }, asn [ ] = { 0, 0, 0, 0 }, xyz [ ] = { 1, 1, 1 } ; unsigned sony_curve [ ] = { 0, 0, 0, 0, 0, 4095 } ; unsigned * buf, sony_offset = 0, sony_length = 0, sony_key = 0 ; struct jhead jh ; int pana_raw = 0 ; # ifndef LIBRAW_LIBRARY_BUILD FILE * sfp ; # endif if ( tiff_nifds >= sizeof tiff_ifd // sizeof tiff_ifd [ 0 ] ) return 1 ; ifd = tiff_nifds ++ ; for ( j = 0 ; j < 4 ; j ++ ) for ( i = 0 ; i < 4 ; i ++ ) cc [ j ] [ i ] = i == j ; entries = get2 ( ) ; if ( entries > 512 ) return 1 ; # ifdef LIBRAW_LIBRARY_BUILD INT64 fsize = ifp -> size ( ) ; # endif while ( entries -- ) { tiff_get ( base, & tag, & type, & len, & save ) ; # ifdef LIBRAW_LIBRARY_BUILD INT64 savepos = ftell ( ifp ) ; if ( len > 8 && len + savepos > fsize * 2 ) continue ; if ( callbacks. exif_cb ) { callbacks. exif_cb ( callbacks. exifparser_data, tag | ( pana_raw? 0x30000 : 0 ), type, len, order, ifp ) ; fseek ( ifp, savepos, SEEK_SET ) ; } # endif # ifdef LIB

Fix:
<S2SV_ModStart> ifd ++ ; # ifdef LIBRAW_LIBRARY_BUILD if ( ifd >= sizeof tiff_ifd // sizeof tiff_ifd [ 0 ] ) throw LIBRAW_EXCEPTION_IO_CORRUPT ; # endif <S2SV_ModStart> if ( len < 1 || len
Buggy code:
 <START_BUG> static char * print_array ( cJSON * item, int depth, int fmt ) <END_BUG> { char * * entries ; char * out = 0, * ptr, * ret ; int len = 5 ; cJSON * child = item -> child ; int numentries = 0, i = 0, fail = 0 ;  while ( child ) { <START_BUG> ++ numentries ; child = child -> next ; <END_BUG> }  <START_BUG> if (! ( entries = ( char * * ) cJSON_malloc ( numentries * sizeof ( char * ) ) ) ) <END_BUG> return 0 ; memset ( entries, 0, numentries * sizeof ( char * ) ) ; child = item -> child ;  while ( child &&! fail ) { <START_BUG> <END_BUG> ret = print_value ( child, depth + 1, fmt ) ;  entries [ i ++ ] = ret ; if ( ret ) len += strlen ( ret ) + 2 + ( fmt? 1 : 0 ) ; else fail = 1 ; child = child -> next ; } <START_BUG> if (! fail ) { <END_BUG> out = ( char * ) cJSON_malloc ( len ) ; if (! out ) fail = 1 ;  } <START_BUG> if ( fail ) { <END_BUG> for ( i = 0 ; i < numentries ; ++ i )  if ( entries [ i ] ) cJSON_free ( entries [ i ] ) ; cJSON_free ( entries ) ; return 0 ; } * out = '[' ; ptr = out + 1 ; * ptr = 0 ; <START_BUG> for ( i = 0 ; i < numentries ; ++ i ) { <END_BUG> strcpy ( ptr, entries [ i ] ) ;  ptr += strlen ( entries [ i ] ) ; <START_BUG> <END_BUG> if ( i!= numentries - 1 ) {  * ptr ++ = ',' ; if ( fmt ) * ptr ++ =' '; * ptr = 0 ; } <START_BUG> cJSON_free ( entries [ i ] ) ; <END_BUG> } cJSON_free ( entries ) ; * ptr ++ = ']' ;  * ptr ++ = 0 ; <START_BUG> return out ; }<END_BUG>

Fix:
<S2SV_ModStart>, int fmt, printbuffer * p <S2SV_ModStart> = 0 ; size_t tmplen = 0 ; <S2SV_ModStart> ( child ) numentries ++, <S2SV_ModEnd> child = child <S2SV_ModStart> -> next ; if (! numentries ) { if ( p ) out = ensure ( p, 3 ) ; else out = ( char <S2SV_ModEnd> * ) cJSON_malloc <S2SV_ModStart> ) cJSON_malloc ( 3 ) ; if ( out ) strcpy ( out, "[]" ) ; return out ; } if ( p ) { i = p -> offset ; ptr = ensure ( p, 1 ) ; if (! ptr ) return 0 ; * ptr = '[' ; p -> offset ++ <S2SV_ModEnd> ; child = <S2SV_ModStart>! fail ) { <S2SV_ModEnd> print_value ( child <S2SV_ModStart> 1, fmt, p ) ; p -> offset = update ( p ) ; if ( child -> next ) { len = fmt? 2 : 1 ; ptr = ensure ( p, len + 1 ) ; if (! ptr ) return 0 ; * ptr ++ = ',' ; if ( fmt ) * ptr ++ ='<S2SV_blank>'; * ptr = 0 ; p -> offset += len ; } child = child -> next ; } ptr = ensure ( p, 2 ) ; if (! ptr ) return
Buggy code:
 apr_status_t modsecurity_tx_init ( modsec_rec * msr ) { const char * s = NULL ; const apr_array_header_t * arr ; char * semicolon = NULL ; char * comma = NULL ; apr_table_entry_t * te ; int i ; apr_pool_cleanup_register ( msr -> mp, msr, modsecurity_tx_cleanup, apr_pool_cleanup_null ) ; msr -> request_content_length = - 1 ; s = apr_table_get ( msr -> request_headers, "Content-Length" ) ; if ( s!= NULL ) { msr -> request_content_length = strtol ( s, NULL, 10 ) ; } msr -> reqbody_chunked = 0 ; msr -> reqbody_should_exist = 0 ; if ( msr -> request_content_length == - 1 ) { char * transfer_encoding = ( char * ) apr_table_get ( msr -> request_headers, "Transfer-Encoding" ) ; <START_BUG> if ( ( transfer_encoding!= NULL ) && ( strstr ( transfer_encoding, "chunked" )!= NULL ) ) { <END_BUG> msr -> reqbody_should_exist = 1 ; msr -> reqbody_chunked = 1 ; } } else { msr -> reqbody_should_exist = 1 ; } msr -> request_content_type = NULL ; s = apr_table_get ( msr -> request_headers, "Content-Type" ) ; if ( s!= NULL ) msr -> request_content_type = s ; if ( ( msr -> request_content_type!= NULL ) && ( strncasecmp ( msr -> request_content_type, "application//x-www-form-urlencoded", 33 ) == 0 ) ) { msr -> msc_reqbody_storage = MSC_REQBODY_MEMORY ; msr -> msc_reqbody_spilltodisk = 0 ; msr -> msc_reqbody_processor = "URLENCODED" ; } else { if ( ( msr -> request_content_length!= - 1 ) && ( msr -> request_content_length > msr -> txcfg -> reqbody_inmemory_limit ) ) { msr -> msc_req

Fix:
<S2SV_ModStart> ) && ( m_strcasestr <S2SV_ModEnd> ( transfer_encoding,
Buggy code:
 void bnep_net_setup ( struct net_device * dev ) { memset ( dev -> broadcast, 0xff, ETH_ALEN ) ; dev -> addr_len = ETH_ALEN ; ether_setup ( dev ) ; <START_BUG> dev -> netdev_ops = & bnep_netdev_ops ; <END_BUG> dev -> watchdog_timeo = HZ * 2 ; }

Fix:
<S2SV_ModStart> ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ; dev ->
Buggy code:
 static void zero_stats ( FIRSTPASS_STATS * section ) { <START_BUG> section -> frame = 0.0 ; <END_BUG> section -> intra_error = 0.0 ; section -> coded_error = 0.0 ;  section -> sr_coded_error = 0.0 ; <START_BUG> section -> ssim_weighted_pred_err = 0.0 ; section -> pcnt_inter = 0.0 ; section -> pcnt_motion = 0.0 ; section -> pcnt_second_ref = 0.0 ; <END_BUG> section -> pcnt_neutral = 0.0 ;  section -> MVr = 0.0 ; section -> mvr_abs = 0.0 ; section -> MVc = 0.0 ; section -> mvc_abs = 0.0 ; section -> MVrv = 0.0 ; section -> MVcv = 0.0 ; section -> mv_in_out_count = 0.0 ; section -> new_mv_count = 0.0 ; section -> count = 0.0 ; section -> duration = 1.0 ; section -> spatial_layer_id = 0 ; }

Fix:
<S2SV_ModStart> section -> frame = 0.0 ; section -> weight <S2SV_ModStart> section -> sr_coded_error <S2SV_ModEnd> = 0.0 ; <S2SV_ModStart> section -> pcnt_neutral = 0.0 ; section -> intra_skip_pct = 0.0 ; section -> inactive_zone_rows = 0.0 ; section -> inactive_zone_cols
Buggy code:
 static int hwsim_new_radio_nl ( struct sk_buff * msg, struct genl_info * info ) { struct hwsim_new_radio_params param = { 0 } ; const char * hwname = NULL ; int ret ; param. reg_strict = info -> attrs [ HWSIM_ATTR_REG_STRICT_REG ] ; param. p2p_device = info -> attrs [ HWSIM_ATTR_SUPPORT_P2P_DEVICE ] ; param. channels = channels ; param. destroy_on_close = info -> attrs [ HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE ] ; if ( info -> attrs [ HWSIM_ATTR_CHANNELS ] ) param. channels = nla_get_u32 ( info -> attrs [ HWSIM_ATTR_CHANNELS ] ) ; if ( info -> attrs [ HWSIM_ATTR_NO_VIF ] ) param. no_vif = true ; if ( info -> attrs [ HWSIM_ATTR_RADIO_NAME ] ) { hwname = kasprintf ( GFP_KERNEL, "%.*s", nla_len ( info -> attrs [ HWSIM_ATTR_RADIO_NAME ] ), ( char * ) nla_data ( info -> attrs [ HWSIM_ATTR_RADIO_NAME ] ) ) ; if (! hwname ) return - ENOMEM ; param. hwname = hwname ; } if ( info -> attrs [ HWSIM_ATTR_USE_CHANCTX ] ) param. use_chanctx = true ; else param. use_chanctx = ( param. channels > 1 ) ; if ( info -> attrs [ HWSIM_ATTR_REG_HINT_ALPHA2 ] ) param. reg_alpha2 = nla_data ( info -> attrs [ HWSIM_ATTR_REG_HINT_ALPHA2 ] ) ; if ( info -> attrs [ HWSIM_ATTR_REG_CUSTOM_REG ] ) { u32 idx = nla_get_u32 ( info -> attrs [ HWSIM_ATTR_REG_CUSTOM_REG ] ) ; <START_BUG> if ( idx >= ARRAY_SIZE ( hwsim_world_regdom_custom ) ) <END_BUG> return -

Fix:
<S2SV_ModStart> hwsim_world_regdom_custom ) ) { kfree ( hwname ) ; <S2SV_ModStart> - EINVAL ; }
Buggy code:
 static void ChopUpSingleUncompressedStrip ( TIFF * tif ) { register TIFFDirectory * td = & tif -> tif_dir ; uint64 bytecount ; uint64 offset ; uint32 rowblock ; uint64 rowblockbytes ; uint64 stripbytes ; uint32 strip ; <START_BUG> uint64 nstrips64 ; <END_BUG> uint32 nstrips32 ; uint32 rowsperstrip ; uint64 * newcounts ; uint64 * newoffsets ; bytecount = td -> td_stripbytecount [ 0 ] ; offset = td -> td_stripoffset [ 0 ] ; assert ( td -> td_planarconfig == PLANARCONFIG_CONTIG ) ; if ( ( td -> td_photometric == PHOTOMETRIC_YCBCR ) && (! isUpSampled ( tif ) ) ) rowblock = td -> td_ycbcrsubsampling [ 1 ] ; else rowblock = 1 ; rowblockbytes = TIFFVTileSize64 ( tif, rowblock ) ; if ( rowblockbytes > STRIP_SIZE_DEFAULT ) { stripbytes = rowblockbytes ; rowsperstrip = rowblock ; } else if ( rowblockbytes > 0 ) { uint32 rowblocksperstrip ; rowblocksperstrip = ( uint32 ) ( STRIP_SIZE_DEFAULT // rowblockbytes ) ; rowsperstrip = rowblocksperstrip * rowblock ; stripbytes = rowblocksperstrip * rowblockbytes ; } else return ; if ( rowsperstrip >= td -> td_rowsperstrip ) return ;  nstrips64 = TIFFhowmany_64 ( bytecount, stripbytes ) ; <START_BUG> <END_BUG> if ( ( nstrips64 == 0 ) || ( nstrips64 > 0xFFFFFFFF ) )  return ; nstrips32 = ( uint32 ) nstrips64 ; <START_BUG> newcounts = ( uint64 * ) _TIFFCheckMalloc ( tif, nstrips32, sizeof ( uint64 ), <END_BUG> "for   chopped   \\"StripByteCounts\\"   array" ) ;  newoffsets = ( uint64 * ) _TIFFCheckMalloc ( tif, nstrips32, sizeof ( uint64 ), <START_BUG> "for   chopped   \\"StripOffsets\\"   array" ) ; if ( newcounts == NULL || newoffsets == NULL ) { if<END_BUG>

Fix:
<S2SV_ModStart> uint32 strip ; uint32 nstrips <S2SV_ModEnd> ; uint32 rowsperstrip <S2SV_ModStart> ) return ; nstrips = TIFFhowmany_32 ( td -> td_imagelength, rowsperstrip ) ; if ( nstrips <S2SV_ModEnd> == 0 ) <S2SV_ModStart> == 0 ) return ; <S2SV_ModEnd> newcounts = ( <S2SV_ModStart> ( tif, nstrips <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> ( tif, nstrips <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> ; strip < nstrips <S2SV_ModEnd> ; strip ++ <S2SV_ModStart> strip ] = stripbytes? offset : 0 <S2SV_ModEnd> ; offset += <S2SV_ModStart> -> td_nstrips = nstrips <S2SV_ModEnd> ; TIFFSetField (
Buggy code:
 void vp8_dequant_idct_add_uv_block_mmx ( short * q, short * dq, unsigned char * dstu, unsigned char * dstv, int stride, char * eobs ) { int i ; for ( i = 0 ; i < 2 ; i ++ ) { if ( eobs [ 0 ] > 1 ) vp8_dequant_idct_add_mmx ( q, dq, dstu, stride ) ; else if ( eobs [ 0 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 0 ] * dq [ 0 ], dstu, stride, dstu, stride ) ; <START_BUG> vpx_memset ( q, 0, 2 * sizeof ( q [ 0 ] ) ) ; <END_BUG> } if ( eobs [ 1 ] > 1 ) vp8_dequant_idct_add_mmx ( q + 16, dq, dstu + 4, stride ) ; else if ( eobs [ 1 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 16 ] * dq [ 0 ], dstu + 4, stride, dstu + 4, stride ) ;  vpx_memset ( q + 16, 0, 2 * sizeof ( q [ 0 ] ) ) ; <START_BUG> } q += 32 ; dstu += 4 * stride ; eobs += 2 ; } for ( i = 0 ; i < 2 ; i ++ ) { if ( eobs [ 0 ] > 1 ) vp8_dequant_idct_add_mmx ( q, dq, dstv, stride ) ; else if ( eobs [ 0 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 0 ] * dq [ 0 ], dstv, stride, dstv, stride ) ; <END_BUG> vpx_memset ( q, 0, 2 * sizeof ( q [ 0 ] ) ) ;  } if ( eobs [ 1 ] > 1 ) vp8_dequant_idct_add_mmx ( q + 16, dq, dstv + 4, stride ) ; else if ( eobs [ 1 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 16 ] * dq [ 0 ], dstv + 4, stride,

Fix:
<S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q, <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q + <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q, <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q +
Buggy code:
 static int do_fault ( struct mm_struct * mm, struct vm_area_struct * vma, unsigned long address, pte_t * page_table, pmd_t * pmd, unsigned int flags, pte_t orig_pte ) { pgoff_t pgoff = ( ( ( address & PAGE_MASK ) - vma -> vm_start ) >> PAGE_SHIFT ) + vma -> vm_pgoff ; <START_BUG> pte_unmap ( page_table ) ; <END_BUG> if (! ( flags & FAULT_FLAG_WRITE ) ) return do_read_fault ( mm, vma, address, pmd, pgoff, flags, orig_pte ) ; if (! ( vma -> vm_flags & VM_SHARED ) ) return do_cow_fault ( mm, vma, address, pmd, pgoff, flags, orig_pte ) ; return do_shared_fault ( mm, vma, address, pmd, pgoff, flags, orig_pte ) ; }

Fix:
<S2SV_ModStart> ( page_table ) ; if (! vma -> vm_ops -> fault ) return VM_FAULT_SIGBUS
Buggy code:
 BOOL update_recv ( rdpUpdate * update, wStream * s ) { BOOL rc = FALSE ; UINT16 updateType ; rdpContext * context = update -> context ; if ( Stream_GetRemainingLength ( s ) < 2 ) { WLog_ERR ( TAG, "Stream_GetRemainingLength(s)   <   2" ) ; return FALSE ; } Stream_Read_UINT16 ( s, updateType ) ; WLog_Print ( update -> log, WLOG_TRACE, "%s   Update   Data   PDU", UPDATE_TYPE_STRINGS [ updateType ] ) ; if (! update_begin_paint ( update ) ) goto fail ; switch ( updateType ) { case UPDATE_TYPE_ORDERS : rc = update_recv_orders ( update, s ) ; break ; case UPDATE_TYPE_BITMAP : { BITMAP_UPDATE * bitmap_update = update_read_bitmap_update ( update, s ) ; if (! bitmap_update ) { WLog_ERR ( TAG, "UPDATE_TYPE_BITMAP   -   update_read_bitmap_update()   failed" ) ; goto fail ; } rc = IFCALLRESULT ( FALSE, update -> BitmapUpdate, context, bitmap_update ) ; free_bitmap_update ( update -> context, bitmap_update ) ; } break ; case UPDATE_TYPE_PALETTE : { PALETTE_UPDATE * palette_update = update_read_palette ( update, s ) ; if (! palette_update ) { WLog_ERR ( TAG, "UPDATE_TYPE_PALETTE   -   update_read_palette()   failed" ) ; goto fail ; } rc = IFCALLRESULT ( FALSE, update -> Palette, context, palette_update ) ; free_palette_update ( context, palette_update ) ; } break ; case UPDATE_TYPE_SYNCHRONIZE : <START_BUG> update_read_synchronize ( update, s ) ; <END_BUG> rc = IFCALLRESULT ( TRUE, update -> Synchronize, context ) ; break ; default : break ; } fail : if (! update_end_paint ( update ) ) rc = FALSE ; if (! rc ) { WLog_ERR ( TAG, "UPDATE_TYPE   %s   [%" PRIu16 "]   failed", update_type_to_string ( update

Fix:
<S2SV_ModStart> case UPDATE_TYPE_SYNCHRONIZE : if (! <S2SV_ModStart>, s ) ) goto fail
Buggy code:
 <START_BUG> void ntlm_write_message_fields_buffer ( wStream * s, NTLM_MESSAGE_FIELDS * fields ) <END_BUG> { if ( fields -> Len > 0 ) { Stream_SetPosition ( s, fields -> BufferOffset ) ; Stream_Write ( s, fields -> Buffer, fields -> Len ) ; } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 int wc_SignatureGenerate ( enum wc_HashType hash_type, enum wc_SignatureType sig_type, const byte * data, word32 data_len, byte * sig, word32 * sig_len, const void * key, word32 key_len, WC_RNG * rng ) { <START_BUG> int ret ; <END_BUG> word32 hash_len, hash_enc_len ; # ifdef WOLFSSL_SMALL_STACK byte * hash_data ; # else byte hash_data [ MAX_DER_DIGEST_SZ ] ; # endif if ( data == NULL || data_len <= 0 || sig == NULL || sig_len == NULL || * sig_len <= 0 || key == NULL || key_len <= 0 ) { return BAD_FUNC_ARG ; } if ( ( int ) * sig_len < wc_SignatureGetSize ( sig_type, key, key_len ) ) { WOLFSSL_MSG ( "wc_SignatureGenerate:   Invalid   sig   type//len" ) ; return BAD_FUNC_ARG ; } ret = wc_HashGetDigestSize ( hash_type ) ; if ( ret < 0 ) { WOLFSSL_MSG ( "wc_SignatureGenerate:   Invalid   hash   type//len" ) ; return ret ; } hash_enc_len = hash_len = ret ; # if! defined ( NO_RSA ) &&! defined ( WOLFSSL_RSA_PUBLIC_ONLY ) if ( sig_type == WC_SIGNATURE_TYPE_RSA_W_ENC ) { hash_enc_len += MAX_DER_DIGEST_ASN_SZ ; } # endif # ifdef WOLFSSL_SMALL_STACK hash_data = ( byte * ) XMALLOC ( hash_enc_len, NULL, DYNAMIC_TYPE_TMP_BUFFER ) ; if ( hash_data == NULL ) { return MEMORY_E ; } # endif  ret = wc_Hash ( hash_type, data, data_len, hash_data, hash_len ) ; <START_BUG> if ( ret == 0 ) { if ( sig_type == WC_SIGNATURE_TYPE_RSA_W_ENC ) { # if defined ( NO_RSA ) || defined ( NO_ASN ) || defined ( WOLFSSL_RSA_PUBLIC_ONLY ) ret = SIG_TYPE_E ;<END_BUG>

Fix:
<S2SV_ModStart> rng ) { return wc_SignatureGenerate_ex ( hash_type, sig_type <S2SV_ModEnd>, data, <S2SV_ModStart>, data_len, sig, <S2SV_ModEnd> sig_len, key <S2SV_ModStart> key_len, rng, 1 <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static uint8_t excluded_channels ( bitfile * ld, drc_info * drc ) { uint8_t i, n = 0 ; uint8_t num_excl_chan = 7 ; for ( i = 0 ; i < 7 ; i ++ ) { drc -> exclude_mask [ i ] = faad_get1bit ( ld DEBUGVAR ( 1, 103, "excluded_channels():   exclude_mask" ) ) ; } n ++ ; while ( ( drc -> additional_excluded_chns [ n - 1 ] = faad_get1bit ( ld DEBUGVAR ( 1, 104, "excluded_channels():   additional_excluded_chns" ) ) ) == 1 ) { <START_BUG> for ( i = num_excl_chan ; i < num_excl_chan + 7 ; i ++ ) <END_BUG> { drc -> exclude_mask [ i ] = faad_get1bit ( ld DEBUGVAR ( 1, 105, "excluded_channels():   exclude_mask" ) ) ; } n ++ ; num_excl_chan += 7 ; } return n ; }

Fix:
<S2SV_ModStart> 1 ) { if ( i >= MAX_CHANNELS - num_excl_chan - 7 ) return n ;
Buggy code:
 int udpv6_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct sk_buff * skb ; unsigned int ulen, copied ; int peeked, off = 0 ; int err ; int is_udplite = IS_UDPLITE ( sk ) ; int is_udp4 ; <START_BUG> bool slow ; <END_BUG> if ( addr_len ) * addr_len = sizeof ( struct sockaddr_in6 ) ; if ( flags & MSG_ERRQUEUE ) return ipv6_recv_error ( sk, msg, len ) ; if ( np -> rxpmtu && np -> rxopt. bits. rxpmtu ) return ipv6_recv_rxpmtu ( sk, msg, len ) ; try_again : skb = __skb_recv_datagram ( sk, flags | ( noblock? MSG_DONTWAIT : 0 ), & peeked, & off, & err ) ; if (! skb ) goto out ; ulen = skb -> len - sizeof ( struct udphdr ) ; copied = len ; if ( copied > ulen ) copied = ulen ; else if ( copied < ulen ) msg -> msg_flags |= MSG_TRUNC ; is_udp4 = ( skb -> protocol == htons ( ETH_P_IP ) ) ; if ( copied < ulen || UDP_SKB_CB ( skb ) -> partial_cov ) { if ( udp_lib_checksum_complete ( skb ) ) goto csum_copy_err ; } if ( skb_csum_unnecessary ( skb ) ) err = skb_copy_datagram_iovec ( skb, sizeof ( struct udphdr ), msg -> msg_iov, copied ) ; else { err = skb_copy_and_csum_datagram_iovec ( skb, sizeof ( struct udphdr ), msg -> msg_iov ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( unlikely ( err ) )

Fix:
<S2SV_ModStart> ; bool slow <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ; } * addr_len = sizeof ( * sin6 ) ;
Buggy code:
 static int check_dual_ref_flags ( VP9_COMP * cpi ) { const int ref_flags = cpi -> ref_frame_flags ; <START_BUG> if ( vp9_segfeature_active ( & cpi -> common. seg, 1, SEG_LVL_REF_FRAME ) ) { <END_BUG> return 0 ; } else { return (!! ( ref_flags & VP9_GOLD_FLAG ) +!! ( ref_flags & VP9_LAST_FLAG ) +!! ( ref_flags & VP9_ALT_FLAG ) ) >= 2 ; } }

Fix:
<S2SV_ModStart> ; if ( segfeature_active <S2SV_ModEnd> ( & cpi
Buggy code:
 static void exif_mnote_data_olympus_load ( ExifMnoteData * en, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataOlympus * n = ( ExifMnoteDataOlympus * ) en ; ExifShort c ; size_t i, tcount, o, o2, datao = 6, base = 0 ; if (! n ||! buf ||! buf_size ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataOlympus", "Short   MakerNote" ) ; return ; } o2 = 6 + n -> offset ; if ( CHECKOVERFLOW ( o2, buf_size, 10 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataOlympus", "Short   MakerNote" ) ; return ; } n -> version = exif_mnote_data_olympus_identify_variant ( buf + o2, buf_size - o2 ) ; switch ( n -> version ) { case olympusV1 : case sanyoV1 : case epsonV1 : exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus", "Parsing   Olympus//Sanyo//Epson   maker   note   v1..." ) ; if ( buf [ o2 + 6 ] == 1 ) n -> order = EXIF_BYTE_ORDER_INTEL ; else if ( buf [ o2 + 6 + 1 ] == 1 ) n -> order = EXIF_BYTE_ORDER_MOTOROLA ; o2 += 8 ; c = exif_get_short ( buf + o2, n -> order ) ; if ( (! ( c & 0xFF ) ) && ( c > 0x500 ) ) { if ( n -> order == EXIF_BYTE_ORDER_INTEL ) { n -> order = EXIF_BYTE_ORDER_MOTOROLA ; } else { n -> order = EXIF_BYTE_ORDER_INTEL ; } } break ; case olympusV2 : datao = o2

Fix:
<S2SV_ModStart> size_t s ; memset ( & n -> entries [ tcount ], 0, sizeof ( MnoteOlympusEntry ) ) ;
Buggy code:
 int tcp_v4_rcv ( struct sk_buff * skb ) { struct net * net = dev_net ( skb -> dev ) ; const struct iphdr * iph ; const struct tcphdr * th ; bool refcounted ; struct sock * sk ; int ret ; if ( skb -> pkt_type!= PACKET_HOST ) goto discard_it ; __TCP_INC_STATS ( net, TCP_MIB_INSEGS ) ; if (! pskb_may_pull ( skb, sizeof ( struct tcphdr ) ) ) goto discard_it ; th = ( const struct tcphdr * ) skb -> data ; if ( unlikely ( th -> doff < sizeof ( struct tcphdr ) // 4 ) ) goto bad_packet ; if (! pskb_may_pull ( skb, th -> doff * 4 ) ) goto discard_it ; if ( skb_checksum_init ( skb, IPPROTO_TCP, inet_compute_pseudo ) ) goto csum_error ; th = ( const struct tcphdr * ) skb -> data ; iph = ip_hdr ( skb ) ; memmove ( & TCP_SKB_CB ( skb ) -> header. h4, IPCB ( skb ), sizeof ( struct inet_skb_parm ) ) ; barrier ( ) ; TCP_SKB_CB ( skb ) -> seq = ntohl ( th -> seq ) ; TCP_SKB_CB ( skb ) -> end_seq = ( TCP_SKB_CB ( skb ) -> seq + th -> syn + th -> fin + skb -> len - th -> doff * 4 ) ; TCP_SKB_CB ( skb ) -> ack_seq = ntohl ( th -> ack_seq ) ; TCP_SKB_CB ( skb ) -> tcp_flags = tcp_flag_byte ( th ) ; TCP_SKB_CB ( skb ) -> tcp_tw_isn = 0 ; TCP_SKB_CB ( skb ) -> ip_dsfield = ipv4_get_dsfield ( iph ) ; TCP_SKB_CB ( skb ) -> sacked = 0 ; lookup : sk = __inet_lookup_skb ( & tcp_hashinfo, skb, __tcp_

Fix:
<S2SV_ModStart> ; if ( tcp_filter <S2SV_ModEnd> ( sk, <S2SV_ModStart> ) goto discard_and_relse ; th = ( const struct tcphdr * ) skb -> data ; iph = ip_hdr ( skb )
Buggy code:
 static void rds_tcp_kill_sock ( struct net * net ) { struct rds_tcp_connection * tc, * _tc ; LIST_HEAD ( tmp_list ) ; struct rds_tcp_net * rtn = net_generic ( net, rds_tcp_netid ) ; struct socket * lsock = rtn -> rds_tcp_listen_sock ; rtn -> rds_tcp_listen_sock = NULL ; rds_tcp_listen_stop ( lsock, & rtn -> rds_tcp_accept_w ) ; spin_lock_irq ( & rds_tcp_conn_lock ) ; list_for_each_entry_safe ( tc, _tc, & rds_tcp_conn_list, t_tcp_node ) { struct net * c_net = read_pnet ( & tc -> t_cpath -> cp_conn -> c_net ) ; <START_BUG> if ( net!= c_net ||! tc -> t_sock ) <END_BUG> continue ; if (! list_has_conn ( & tmp_list, tc -> t_cpath -> cp_conn ) ) { list_move_tail ( & tc -> t_tcp_node, & tmp_list ) ; } else { list_del ( & tc -> t_tcp_node ) ; tc -> t_tcp_node_detached = true ; } } spin_unlock_irq ( & rds_tcp_conn_lock ) ; list_for_each_entry_safe ( tc, _tc, & tmp_list, t_tcp_node ) rds_conn_destroy ( tc -> t_cpath -> cp_conn ) ; }

Fix:
<S2SV_ModStart> net!= c_net <S2SV_ModEnd> ) continue ;
Buggy code:
 static int misaligned_store ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift ) { int error ; int srcreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, address ) ; <END_BUG> srcreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; if (! access_ok ( VERIFY_WRITE, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } switch ( width_shift ) { case 1 : * ( __u16 * ) & buffer = ( __u16 ) regs -> regs [ srcreg ] ; break ; case 2 : * ( __u32 * ) & buffer = ( __u32 ) regs -> regs [ srcreg ] ; break ; case 3 : buffer = regs -> regs [ srcreg ] ; break ; default : printk ( "Unexpected   width_shift   %d   in   misaligned_store,   PC=%08lx\\n", width_shift, ( unsigned long ) regs -> pc ) ; break ; } if ( __copy_user ( ( void * ) ( int ) address, & buffer, ( 1 << width_shift ) ) > 0 ) { return - 1 ; } } else { __u64 val = regs -> regs [ srcreg ] ; switch ( width_shift ) { case 1 : misaligned_kernel_word_store ( address, val ) ; break ; case 2 : asm ( "stlo.l   %1,   0,   %0" : : "r" ( val ), "r" ( address ) ) ; asm ( "sthi.l   %1,   3,   %0" : : "r" ( val ), "r" ( address ) ) ; break ; case 3 : asm ( "stlo.q   %1,   0,   %0" : : "r" ( val ), "r" ( address ) ) ; asm ( "sthi.q   %1,

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 static Image * ReadPSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BoundingBox "BoundingBox:" # define BeginDocument "BeginDocument:" # define BeginXMPPacket "<?xpacket   begin=" # define EndXMPPacket "<?xpacket   end=" # define ICCProfile "BeginICCProfile:" # define CMYKCustomColor "CMYKCustomColor:" # define CMYKProcessColor "CMYKProcessColor:" # define DocumentMedia "DocumentMedia:" # define DocumentCustomColors "DocumentCustomColors:" # define DocumentProcessColors "DocumentProcessColors:" # define EndDocument "EndDocument:" # define HiResBoundingBox "HiResBoundingBox:" # define ImageData "ImageData:" # define PageBoundingBox "PageBoundingBox:" # define LanguageLevel "LanguageLevel:" # define PageMedia "PageMedia:" # define Pages "Pages:" # define PhotoshopProfile "BeginPhotoshop:" # define PostscriptLevel "!PS-" # define RenderPostscriptText "     Rendering   Postscript...     " # define SpotColor "+   " char command [ MaxTextExtent ], * density, filename [ MaxTextExtent ], geometry [ MaxTextExtent ], input_filename [ MaxTextExtent ], message [ MaxTextExtent ], * options, postscript_filename [ MaxTextExtent ] ; const char * option ; const DelegateInfo * delegate_info ; GeometryInfo geometry_info ; Image * image, * next, * postscript_image ; ImageInfo * read_info ; int c, file ; MagickBooleanType cmyk, fitPage, skip, status ; MagickStatusType flags ; PointInfo delta, resolution ; RectangleInfo page ; register char * p ; register ssize_t i ; SegmentInfo bounds, hires_bounds ; short int hex_digits [ 256 ] ; size_t length, priority ; ssize_t count ; StringInfo * profile ; unsigned long columns, extent, language_level, pages, rows, scene, spotcolor ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert (

Fix:
<S2SV_ModStart> length = extent ; if ( length > GetBlobSize ( image ) ) ThrowReaderException ( CorruptImageError, "InsufficientImageDataInFile" )
Buggy code:
 int cg_mkdir ( const char * path, mode_t mode ) { struct fuse_context * fc = fuse_get_context ( ) ; <START_BUG> char * fpath = NULL, * path1, * cgdir = NULL, * controller ; <END_BUG> const char * cgroup ; int ret ; if (! fc ) return - EIO ; controller = pick_controller_from_path ( fc, path ) ; if (! controller ) return - EINVAL ; cgroup = find_cgroup_in_path ( path ) ; if (! cgroup ) return - EINVAL ; get_cgdir_and_path ( cgroup, & cgdir, & fpath ) ; if (! fpath ) path1 = "//" ; else path1 = cgdir ;  if (! fc_may_access ( fc, controller, path1, NULL, O_RDWR ) ) { <START_BUG> <END_BUG> ret = - EACCES ;  goto out ; } <START_BUG> if (! caller_is_in_ancestor ( fc -> pid, controller, path1, NULL ) ) { <END_BUG> ret = - EACCES ; goto out ; } ret = cgfs_create ( controller, cgroup, fc -> uid, fc -> gid ) ; printf ( "cgfs_create   returned   %d   for   %s   %s\\n", ret, controller, cgroup ) ; out : free ( cgdir ) ;  return ret ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart>, * controller, * next = NULL <S2SV_ModStart> if (! caller_is_in_ancestor ( fc -> pid, controller, path1, & next <S2SV_ModEnd> ) ) { <S2SV_ModStart> ) ) { if ( fpath && strcmp ( next, fpath ) == 0 ) ret = - EEXIST ; else ret = - ENOENT <S2SV_ModEnd> ; goto out <S2SV_ModStart> if (! fc_may_access ( fc, controller, path1, NULL, O_RDWR ) ) { ret = - EACCES ; goto out ; } if (! <S2SV_ModStart> cgdir ) ; free ( next ) ;
Buggy code:
 int server_partial_file_request ( struct httpd * env, struct client * clt, char * path, struct stat * st, char * range_str ) { struct server_config * srv_conf = clt -> clt_srv_conf ; struct http_descriptor * resp = clt -> clt_descresp ; struct http_descriptor * desc = clt -> clt_descreq ; struct media_type * media, multipart_media ; <START_BUG> struct range * range ; <END_BUG> struct evbuffer * evb = NULL ;  size_t content_length ; <START_BUG> <END_BUG> int code = 500, fd = - 1, i, nranges, ret ;  uint32_t boundary ; char content_range [ 64 ] ; const char * errstr = NULL ; if ( desc -> http_method!= HTTP_METHOD_GET ) return server_file_request ( env, clt, path, st ) ; <START_BUG> if ( ( range = parse_range ( range_str, st -> st_size, & nranges ) ) == NULL ) { <END_BUG> code = 416 ; ( void ) snprintf ( content_range, sizeof ( content_range ), "bytes   *//%lld", st -> st_size ) ; errstr = content_range ; goto abort ; } if ( ( fd = open ( path, O_RDONLY ) ) == - 1 ) goto abort ; media = media_find_config ( env, srv_conf, path ) ;  if ( ( evb = evbuffer_new ( ) ) == NULL ) { <START_BUG> errstr = "failed   to   allocate   file   buffer" ; goto abort ; } if ( nranges == 1 ) { <END_BUG> ( void ) snprintf ( content_range, sizeof ( content_range ),  "bytes   %lld-%lld//%lld", range -> start, range -> end, st -> st_size ) ; if ( kv_add ( & resp -> http_headers, "Content-Range", content_range ) == NULL ) goto abort ; <START_BUG> content_length = range -> end - range -> start + 1 ; <END_BUG>  if ( buffer_add_range ( fd, evb, range ) == 0 ) <START_BUG> goto abort ; } else { <END_BUG> content_length = 0 ;  boundary = arc4random ( ) ; while ( nranges -- ) { if ( ( i

Fix:
<S2SV_ModStart> multipart_media ; struct range_data * r = & clt -> clt_ranges ; struct range * range <S2SV_ModEnd> ; size_t content_length <S2SV_ModStart> ; size_t content_length = 0 <S2SV_ModStart> nranges, ret <S2SV_ModEnd> ; char content_range <S2SV_ModStart> if ( ( nranges = parse_ranges ( clt, <S2SV_ModEnd> range_str, st <S2SV_ModStart> st -> st_size ) ) < 1 <S2SV_ModEnd> ) { code <S2SV_ModStart> path ) ; r -> range_media = media ; <S2SV_ModEnd> if ( nranges <S2SV_ModStart> 1 ) { range = & r -> range [ 0 ] ; <S2SV_ModStart> goto abort ; range = & r -> range [ 0 ] ; content_length += <S2SV_ModEnd> range -> end <S2SV_ModStart> + 1 ; <S2SV_ModEnd> } else { <S2SV_ModStart> } else { arc4random_buf ( & clt -> clt_boundary, sizeof ( clt -> clt_boundary ) ) ; for ( i = 0 ; i < nranges ; i ++ ) { range = & r -> range [ i ] ; if ( ( ret = snprintf ( NULL, 0, "\\r\\n--%llu\\r\\n" "Content-Type: <S2SV_blank> %s//%s\\r\\n" "Content-Range: <S2SV_blank> bytes <S2SV_blank>
Buggy code:
 static void gaussian_blur_surface ( cairo_surface_t * in, cairo_surface_t * out, gdouble sx, gdouble sy ) { <START_BUG> gboolean use_box_blur ; <END_BUG> gint width, height ; cairo_format_t in_format, out_format ; gint in_stride ; gint out_stride ; guchar * in_data, * out_data ; gint bpp ; gboolean out_has_data ; cairo_surface_flush ( in ) ; width = cairo_image_surface_get_width ( in ) ; height = cairo_image_surface_get_height ( in ) ; g_assert ( width == cairo_image_surface_get_width ( out ) && height == cairo_image_surface_get_height ( out ) ) ; in_format = cairo_image_surface_get_format ( in ) ; out_format = cairo_image_surface_get_format ( out ) ; g_assert ( in_format == out_format ) ; g_assert ( in_format == CAIRO_FORMAT_ARGB32 || in_format == CAIRO_FORMAT_A8 ) ; if ( in_format == CAIRO_FORMAT_ARGB32 ) bpp = 4 ; else if ( in_format == CAIRO_FORMAT_A8 ) bpp = 1 ; else { g_assert_not_reached ( ) ; return ; } in_stride = cairo_image_surface_get_stride ( in ) ; out_stride = cairo_image_surface_get_stride ( out ) ; in_data = cairo_image_surface_get_data ( in ) ; out_data = cairo_image_surface_get_data ( out ) ; if ( sx < 0.0 ) sx = 0.0 ; if ( sy < 0.0 )  sy = 0.0 ; <START_BUG> if ( sx < 10.0 && sy < 10.0 ) use_box_blur = FALSE ; else use_box_blur = TRUE ; if ( ( sx == 0.0 && sy == 0.0 ) || sx > 1000 || sy > 1000 ) { cairo_t * cr ; cr = cairo_create ( out ) ; cairo_set_source_surface ( cr, in, 0, 0 ) ; cairo_paint ( cr ) ;<END_BUG>

Fix:
<S2SV_ModStart> sy ) { <S2SV_ModEnd> gint width, <S2SV_ModStart> sy = 0.0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> * row2 ; gboolean use_box_blur ; if ( sx < 10.0 ) use_box_blur = FALSE ; else use_box_blur = TRUE ; <S2SV_ModStart> int x ; gboolean use_box_blur ; if ( sy < 10.0 ) use_box_blur = FALSE ; else use_box_blur = TRUE ;
Buggy code:
 static const char * parse_string ( cJSON * item, const char * str, const char * * ep ) { const char * ptr = str + 1, * end_ptr = str + 1 ; char * ptr2 ; char * out ; int len = 0 ; unsigned uc, uc2 ; if ( * str!= \'\\"\' ) { * ep = str ; return 0 ; } <START_BUG> while ( * end_ptr!= \'\\"\' && * end_ptr && ++ len ) if ( * end_ptr ++ == '\\\\' ) end_ptr ++ ; <END_BUG> out = ( char * ) cJSON_malloc ( len + 1 ) ; if (! out ) return 0 ; item -> valuestring = out ; item -> type = cJSON_String ; ptr = str + 1 ; ptr2 = out ; while ( ptr < end_ptr ) { if ( * ptr!= '\\\\' ) * ptr2 ++ = * ptr ++ ; else { ptr ++ ; switch ( * ptr ) { case 'b' : * ptr2 ++ = '\\b' ; break ; case 'f' : * ptr2 ++ = '\\f' ; break ; case 'n' : * ptr2 ++ = '\\n' ; break ; case 'r' : * ptr2 ++ = '\\r' ; break ; case 't' : * ptr2 ++ = '\\t' ; break ; case 'u' : uc = parse_hex4 ( ptr + 1 ) ; ptr += 4 ; if ( ptr >= end_ptr ) { * ep = str ; return 0 ; } if ( ( uc >= 0xDC00 && uc <= 0xDFFF ) || uc == 0 ) { * ep = str ; return 0 ; } if ( uc >= 0xD800 && uc <= 0xDBFF ) { if ( ptr + 6 > end_ptr ) { * ep = str ; return 0 ; } if ( ptr [ 1 ]!= '\\\\' || ptr [ 2 ]!= 'u' ) { * ep = str ; return 0 ; } uc2 = parse_hex4 ( ptr + 3 ) ; ptr += 6 ; if ( uc2 < 0xDC00 || uc2 > 0xDFFF ) { * ep = str ; return 0 ; } uc = 0x10000 + ( ( ( uc & 0x3FF ) << 10 ) | ( uc2 & 0x3FF ) ) ; } len = 4 ; if ( uc <

Fix:
<S2SV_ModStart> ++ len ) { <S2SV_ModStart> == '\\\\' ) { if ( * end_ptr == '\\0' ) { return 0 ; } end_ptr ++ ; } } <S2SV_ModEnd> out = (
Buggy code:
 void exit_io_context ( void ) { struct io_context * ioc ; task_lock ( current ) ; ioc = current -> io_context ; current -> io_context = NULL ; task_unlock ( current ) ; if ( atomic_dec_and_test ( & ioc -> nr_tasks ) ) { if ( ioc -> aic && ioc -> aic -> exit ) ioc -> aic -> exit ( ioc -> aic ) ; cfq_exit ( ioc ) ; <START_BUG> put_io_context ( ioc ) ; <END_BUG> }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ioc ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int omninet_open ( struct tty_struct * tty, struct usb_serial_port * port ) { <START_BUG> struct usb_serial * serial = port -> serial ; <END_BUG> struct usb_serial_port * wport ; wport = serial -> port [ 1 ] ; tty_port_tty_set ( & wport -> port, tty ) ; return usb_serial_generic_open ( tty, port ) ; }

Fix:
<S2SV_ModStart> port ) { <S2SV_ModEnd> return usb_serial_generic_open (
Buggy code:
 <START_BUG> void vp9_idct4x4_add ( const int16_t * input, uint8_t * dest, int stride, int eob ) { <END_BUG> if ( eob > 1 )  vp9_idct4x4_16_add ( input, dest, stride ) ; <START_BUG> else <END_BUG> vp9_idct4x4_1_add ( input, dest, stride ) ;  }

Fix:
<S2SV_ModStart> vp9_idct4x4_add ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> > 1 ) vpx_idct4x4_16_add <S2SV_ModEnd> ( input, <S2SV_ModStart> ) ; else vpx_idct4x4_1_add <S2SV_ModEnd> ( input,
Buggy code:
 static int lookupName ( Parse * pParse, const char * zDb, const char * zTab, const char * zCol, NameContext * pNC, Expr * pExpr ) { int i, j ; int cnt = 0 ; int cntTab = 0 ; int nSubquery = 0 ; sqlite3 * db = pParse -> db ; struct SrcList_item * pItem ; struct SrcList_item * pMatch = 0 ; NameContext * pTopNC = pNC ; Schema * pSchema = 0 ; int eNewExprOp = TK_COLUMN ; Table * pTab = 0 ; Column * pCol ; assert ( pNC ) ; assert ( zCol ) ; assert (! ExprHasProperty ( pExpr, EP_TokenOnly | EP_Reduced ) ) ; pExpr -> iTable = - 1 ; ExprSetVVAProperty ( pExpr, EP_NoReduce ) ; if ( zDb ) { testcase ( pNC -> ncFlags & NC_PartIdx ) ; testcase ( pNC -> ncFlags & NC_IsCheck ) ; if ( ( pNC -> ncFlags & ( NC_PartIdx | NC_IsCheck ) )!= 0 ) { zDb = 0 ; } else { for ( i = 0 ; i < db -> nDb ; i ++ ) { assert ( db -> aDb [ i ]. zDbSName ) ; if ( sqlite3StrICmp ( db -> aDb [ i ]. zDbSName, zDb ) == 0 ) { pSchema = db -> aDb [ i ]. pSchema ; break ; } } } } assert ( pNC && cnt == 0 ) ; do { ExprList * pEList ; SrcList * pSrcList = pNC -> pSrcList ; if ( pSrcList ) { for ( i = 0, pItem = pSrcList -> a ; i < pSrcList -> nSrc ; i ++, pItem ++ ) { pTab = pItem -> pTab ; assert ( pTab!= 0 && pTab -> zName!= 0 ) ; assert ( pTab -> nCol > 0 ) ; if ( pItem -> pSelect && ( pItem -> pSelect -> selFlags & SF_NestedFrom )!= 0 ) { int hit = 0 ; pEList = pItem -> pSelect -> pEList ; for ( j = 0 ;

Fix:
<S2SV_ModStart> } assert ( pExpr -> y. pTab!= 0 ) ; assert ( <S2SV_ModStart> iTable ) ; if ( pExpr -> y. pTab -> tabFlags & TF_HasGenerated ) { Column * pCol = pExpr -> y. pTab -> aCol + pExpr -> iColumn ; if ( pCol -> colFlags & COLFLAG_GENERATED ) n = BMS - 1 ; }
Buggy code:
 struct _mdi * _WM_ParseNewMidi ( uint8_t * midi_data, uint32_t midi_size ) { struct _mdi * mdi ; uint32_t tmp_val ; uint32_t midi_type ; <START_BUG> uint32_t track_size ; <END_BUG> uint8_t * * tracks ; uint32_t end_of_tracks = 0 ; uint32_t no_tracks ; uint32_t i ; uint32_t divisions = 96 ; uint32_t tempo = 500000 ; float samples_per_delta_f = 0.0 ; uint32_t sample_count = 0 ; float sample_count_f = 0.0 ; float sample_remainder = 0.0 ; uint8_t * sysex_store = NULL ; uint32_t * track_delta ; uint8_t * track_end ; uint32_t smallest_delta = 0 ; uint32_t subtract_delta = 0 ; uint8_t * running_event ; uint32_t setup_ret = 0 ; if ( midi_size < 14 ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too   short)", 0 ) ; return ( NULL ) ; } if (! memcmp ( midi_data, "RIFF", 4 ) ) { if ( midi_size < 34 ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too   short)", 0 ) ; return ( NULL ) ; } midi_data += 20 ; midi_size -= 20 ; } if ( memcmp ( midi_data, "MThd", 4 ) ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_MIDI, NULL, 0 ) ; return ( NULL ) ; } midi_data += 4 ; midi_size -= 4 ; tmp_val = * midi_data ++ << 24 ; tmp_val |= * midi_data ++ << 16 ; tmp_val |= * midi_data ++ << 8 ; tmp_val |= * midi_data ++ ; midi_size -= 4 ; if ( tmp_val!= 6 ) { _WM_

Fix:
<S2SV_ModStart> uint32_t midi_type ; uint8_t * * tracks ; uint32_t * track_size <S2SV_ModEnd> ; uint32_t end_of_tracks <S2SV_ModStart> no_tracks ) ; track_size = malloc ( sizeof ( uint32_t ) * no_tracks ) ; <S2SV_ModStart> -= 4 ; tmp_val <S2SV_ModEnd> = * midi_data <S2SV_ModStart> << 24 ; tmp_val <S2SV_ModEnd> |= * midi_data <S2SV_ModStart> << 16 ; tmp_val <S2SV_ModEnd> |= * midi_data <S2SV_ModStart> << 8 ; tmp_val <S2SV_ModEnd> |= * midi_data <S2SV_ModStart> ( midi_size < tmp_val <S2SV_ModEnd> ) { _WM_GLOBAL_ERROR <S2SV_ModStart> } if ( tmp_val <S2SV_ModEnd> < 3 ) <S2SV_ModStart> ( midi_data [ tmp_val <S2SV_ModEnd> - 3 ] <S2SV_ModStart> ( midi_data [ tmp_val <S2SV_ModEnd> - 2 ] <S2SV_ModStart> ( midi_data [ tmp_val <S2SV_ModEnd> - 1 ] <S2SV_ModStart> = midi_data ; track_size [ i ] = tmp_val ; midi_data += tmp_val <S2SV_ModEnd> ; midi_size -= <S2SV_ModStart> ; midi_size -= tmp_val <S2SV_ModEnd> ; track_end [ <S2SV_ModStart> ] ++ ; track_size [ i ]
Buggy code:
 struct sctp_chunk * sctp_assoc_lookup_asconf_ack ( const struct sctp_association * asoc, __be32 serial ) { struct sctp_chunk * ack ; list_for_each_entry ( ack, & asoc -> asconf_ack_list, transmitted_list ) { <START_BUG> if ( ack -> subh. addip_hdr -> serial == serial ) { <END_BUG> sctp_chunk_hold ( ack ) ; return ack ; } } return NULL ; }

Fix:
<S2SV_ModStart> { if ( sctp_chunk_pending ( ack ) ) continue ; if (
Buggy code:
 error_t coapClientReadBody ( CoapClientRequest * request, void * data, size_t size, size_t * received ) { error_t error ; size_t n ; uint32_t value ; uint32_t blockPos ; uint32_t blockSzx ; size_t payloadLen ; const uint8_t * payload ; CoapMessage * requestMsg ; CoapMessage * responseMsg ; CoapCode responseCode ; error = NO_ERROR ; * received = 0 ; while ( * received < size ) { responseMsg = coapClientGetResponseMessage ( request ) ; error = coapClientReadPayload ( responseMsg, data, size - * received, & n ) ; if ( error == NO_ERROR ) { data = ( uint8_t * ) data + n ; * received += n ; } else if ( error == ERROR_END_OF_STREAM ) { requestMsg = coapClientGetRequestMessage ( request ) ; error = coapClientGetUintOption ( requestMsg, COAP_OPT_BLOCK2, 0, & value ) ; if (! error ) { blockPos = COAP_GET_BLOCK_POS ( value ) ; blockSzx = COAP_GET_BLOCK_SZX ( value ) ; } else { blockPos = 0 ; blockSzx = request -> rxBlockSzx ; } error = coapClientGetUintOption ( responseMsg, COAP_OPT_BLOCK2, 0, & value ) ; if (! error ) { if ( COAP_GET_BLOCK_SZX ( value ) >= COAP_BLOCK_SIZE_RESERVED ) { error = ERROR_FAILURE ; break ; } if ( COAP_GET_BLOCK_POS ( value )!= blockPos ) { error = ERROR_FAILURE ; break ; } if (! COAP_GET_BLOCK_M ( value ) ) { error = ERROR_END_OF_STREAM ; break ; } error = coapClientGetPayload ( responseMsg, & payload, & payloadLen ) ; if ( error ) break ; if ( payloadLen!= COAP_GET_BLOCK_SIZE ( value ) ) { error = ERROR_FAILURE ; break ; } if ( blockSzx > COAP_GET_BLOCK_SZX ( value ) ) blockSzx = COAP_GET_BLOCK_SZX ( value ) ; block

Fix:
<S2SV_ModStart> == 0 ) { <S2SV_ModStart> = ERROR_END_OF_STREAM ; } else { <S2SV_ModEnd> error = ERROR_FAILURE <S2SV_ModStart> = ERROR_FAILURE ; }
Buggy code:
 static bool assoc_array_insert_into_terminal_node ( struct assoc_array_edit * edit, const struct assoc_array_ops * ops, const void * index_key, struct assoc_array_walk_result * result ) { struct assoc_array_shortcut * shortcut, * new_s0 ; struct assoc_array_node * node, * new_n0, * new_n1, * side ; struct assoc_array_ptr * ptr ; unsigned long dissimilarity, base_seg, blank ; size_t keylen ; bool have_meta ; int level, diff ; int slot, next_slot, free_slot, i, j ; node = result -> terminal_node. node ; level = result -> terminal_node. level ; edit -> segment_cache [ ASSOC_ARRAY_FAN_OUT ] = result -> terminal_node. slot ; pr_devel ( "-->%s()\\n", __func__ ) ; free_slot = - 1 ; for ( i = 0 ; i < ASSOC_ARRAY_FAN_OUT ; i ++ ) { ptr = node -> slots [ i ] ; if (! ptr ) { free_slot = i ; continue ; } if ( assoc_array_ptr_is_leaf ( ptr ) && ops -> compare_object ( assoc_array_ptr_to_leaf ( ptr ), index_key ) ) { pr_devel ( "replace   in   slot   %d\\n", i ) ; edit -> leaf_p = & node -> slots [ i ] ; edit -> dead_leaf = node -> slots [ i ] ; pr_devel ( "<--%s()   =   ok   [replace]\\n", __func__ ) ; return true ; } } if ( free_slot >= 0 ) { pr_devel ( "insert   in   free   slot   %d\\n", free_slot ) ; edit -> leaf_p = & node -> slots [ free_slot ] ; edit -> adjust_count_on = node ; pr_devel ( "<--%s()   =   ok   [insert]\\n", __func__ ) ; return true ; } new_n0 = kzalloc ( sizeof ( struct assoc_array_node ), GFP_KERNEL ) ; if (! new_n0 )

Fix:
<S2SV_ModStart> goto all_leaves_cluster_together ; pr_devel ( "present <S2SV_blank> leaves <S2SV_blank> cluster <S2SV_blank> but <S2SV_blank> not <S2SV_blank> new <S2SV_blank> leaf\\n" ) <S2SV_ModEnd> ; } split_node <S2SV_ModStart> return true ; <S2SV_ModEnd> all_leaves_cluster_together : pr_devel
Buggy code:
 static int evaluate_inter_mode ( unsigned int * sse, int rate2, int * distortion2, VP8_COMP * cpi, MACROBLOCK * x, int rd_adj ) { MB_PREDICTION_MODE this_mode = x -> e_mbd. mode_info_context -> mbmi. mode ; int_mv mv = x -> e_mbd. mode_info_context -> mbmi. mv ; <START_BUG> int this_rd ; <END_BUG> if ( cpi -> active_map_enabled && x -> active_ptr [ 0 ] == 0 ) { * sse = 0 ; * distortion2 = 0 ; x -> skip = 1 ; return INT_MAX ; } if ( ( this_mode!= NEWMV ) ||! ( cpi -> sf. half_pixel_search ) || cpi -> common. full_pixel == 1 ) * distortion2 = vp8_get_inter_mbpred_error ( x, & cpi -> fn_ptr [ BLOCK_16X16 ], sse, mv ) ; this_rd = RDCOST ( x -> rdmult, x -> rddiv, rate2, * distortion2 ) ;  if ( this_mode == ZEROMV ) <START_BUG> { <END_BUG> if ( ( cpi -> ref_frame_flags & VP8_LAST_FRAME &  cpi -> common. refresh_last_frame ) && x -> e_mbd. mode_info_context -> mbmi. ref_frame!= LAST_FRAME ) rd_adj = 100 ; this_rd = ( ( int64_t ) this_rd ) * rd_adj // 100 ; } check_for_encode_breakout ( * sse, x ) ; return this_rd ; }

Fix:
<S2SV_ModStart> ; int this_rd ; int denoise_aggressive = 0 <S2SV_ModStart> distortion2 ) ; # if CONFIG_TEMPORAL_DENOISING if ( cpi -> oxcf. noise_sensitivity > 0 ) { denoise_aggressive = ( cpi -> denoiser. denoiser_mode == kDenoiserOnYUVAggressive )? 1 : 0 ; } # endif if (! cpi -> oxcf. screen_content_mode && <S2SV_ModEnd> this_mode == ZEROMV <S2SV_ModStart> this_mode == ZEROMV && x -> e_mbd. mode_info_context -> mbmi. ref_frame == LAST_FRAME && ( denoise_aggressive || ( cpi -> closest_reference_frame == LAST_FRAME ) ) <S2SV_ModStart> { if ( x -> is_skin <S2SV_ModEnd> ) rd_adj =