nus-yam/ex-repair huggingface dataset:
Buggy code:
 void build_ntlmssp_negotiate_blob ( unsigned char * pbuffer, struct cifs_ses * ses ) { NEGOTIATE_MESSAGE * sec_blob = ( NEGOTIATE_MESSAGE * ) pbuffer ; __u32 flags ; memset ( pbuffer, 0, sizeof ( NEGOTIATE_MESSAGE ) ) ; memcpy ( sec_blob -> Signature, NTLMSSP_SIGNATURE, 8 ) ; sec_blob -> MessageType = NtLmNegotiate ; flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | <START_BUG> NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC ; <END_BUG>  if ( ses -> server -> sign ) { <START_BUG> flags |= NTLMSSP_NEGOTIATE_SIGN ; if (! ses -> server -> session_estab || ses -> ntlmssp -> sesskey_per_smbsess ) flags |= NTLMSSP_NEGOTIATE_KEY_XCH ; <END_BUG> }  sec_blob -> NegotiateFlags = cpu_to_le32 ( flags ) ; sec_blob -> WorkstationName. BufferOffset = 0 ; sec_blob -> WorkstationName. Length = 0 ; sec_blob -> WorkstationName. MaximumLength = 0 ; sec_blob -> DomainName. BufferOffset = 0 ; sec_blob -> DomainName. Length = 0 ; sec_blob -> DomainName. MaximumLength = 0 ; }

Fix:
<S2SV_ModStart> NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | NTLMSSP_NEGOTIATE_SEAL <S2SV_ModStart> -> sign ) <S2SV_ModEnd> flags |= NTLMSSP_NEGOTIATE_SIGN <S2SV_ModStart> |= NTLMSSP_NEGOTIATE_KEY_XCH ; <S2SV_ModEnd> sec_blob -> NegotiateFlags
Buggy code:
 int set_interface_var ( const char * iface, const char * var, const char * name, uint32_t val ) { FILE * fp ; char spath [ 64 + IFNAMSIZ ] ; <START_BUG> if ( snprintf ( spath, sizeof ( spath ), var, iface ) >= sizeof ( spath ) ) <END_BUG> return - 1 ; if ( access ( spath, F_OK )!= 0 ) return - 1 ; fp = fopen ( spath, "w" ) ; if (! fp ) { if ( name ) flog ( LOG_ERR, "failed   to   set   %s   (%u)   for   %s:   %s", name, val, iface, strerror ( errno ) ) ; return - 1 ; } fprintf ( fp, "%u", val ) ; fclose ( fp ) ; return 0 ; }

Fix:
<S2SV_ModStart> sizeof ( spath ) ) return - 1 ; if ( strstr ( name, ".." ) || strchr ( name, '//'
Buggy code:
 static noinline void key_gc_unused_keys ( struct list_head * keys ) { while (! list_empty ( keys ) ) { struct key * key = list_entry ( keys -> next, struct key, graveyard_link ) ; list_del ( & key -> graveyard_link ) ; kdebug ( "-   %u", key -> serial ) ; key_check ( key ) ; <START_BUG> if ( key -> type -> destroy ) <END_BUG> key -> type -> destroy ( key ) ; security_key_free ( key ) ; if ( test_bit ( KEY_FLAG_IN_QUOTA, & key -> flags ) ) { spin_lock ( & key -> user -> lock ) ; key -> user -> qnkeys -- ; key -> user -> qnbytes -= key -> quotalen ; spin_unlock ( & key -> user -> lock ) ; } atomic_dec ( & key -> user -> nkeys ) ; if ( test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ) atomic_dec ( & key -> user -> nikeys ) ; key_user_put ( key -> user ) ; kfree ( key -> description ) ; # ifdef KEY_DEBUGGING key -> magic = KEY_DEBUG_MAGIC_X ; # endif kmem_cache_free ( key_jar, key ) ; } }

Fix:
<S2SV_ModStart> ; if ( test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) &&! test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) &&
Buggy code:
 l_int32 main ( int argc, char * * argv ) { L_DEWARP * dew1, * dew2 ; L_DEWARPA * dewa ; PIX * pixs, * pixn, * pixg, * pixb, * pixd, * pixt1, * pixt2 ; PIX * pixs2, * pixn2, * pixg2, * pixb2, * pixd2 ; setLeptDebugOK ( 1 ) ; lept_mkdir ( "lept//model" ) ; <START_BUG> pixs = pixRead ( "cat.035.jpg" ) ; <END_BUG> pixn = pixBackgroundNormSimple ( pixs, NULL, NULL ) ; pixg = pixConvertRGBToGray ( pixn, 0.5, 0.3, 0.2 ) ; pixb = pixThresholdToBinary ( pixg, 130 ) ; dewa = dewarpaCreate ( 2, 30, 1, 10, 30 ) ; dewarpaUseBothArrays ( dewa, 1 ) ; dew1 = dewarpCreate ( pixb, 35 ) ; dewarpaInsertDewarp ( dewa, dew1 ) ; dewarpBuildPageModel ( dew1, "//tmp//lept//model//dewarp_model1.pdf" ) ; dewarpaApplyDisparity ( dewa, 35, pixg, 200, 0, 0, & pixd, "//tmp//lept//model//dewarp_apply1.pdf" ) ; lept_rmdir ( "lept//dewtest" ) ; lept_mkdir ( "lept//dewtest" ) ; pixWrite ( "//tmp//lept//dewtest//001.jpg", pixs, IFF_JFIF_JPEG ) ; pixWrite ( "//tmp//lept//dewtest//002.jpg", pixn, IFF_JFIF_JPEG ) ; pixWrite ( "//tmp//lept//dewtest//003.jpg", pixg, IFF_JFIF_JPEG ) ; pixWrite ( "//tmp//lept//dewtest//004.png", pixb, IFF_TIFF_G4 ) ; pixWrite ( "//tmp//lept//

Fix:
<S2SV_ModStart> "lept//model" ) ; lept_rmdir ( "lept//dewmod" ) ; lept_mkdir ( "lept//dewmod" ) ; <S2SV_ModStart> lept_stderr ( "pdf <S2SV_blank> file <S2SV_blank> made: <S2SV_blank> //tmp//lept//model//dewarptest1.pdf\\n" <S2SV_ModEnd> ) ; pixDestroy
Buggy code:
 <START_BUG> void * H264SwDecMalloc ( u32 size ) <END_BUG> { # if defined ( CHECK_MEMORY_USAGE ) static u32 numBytes = 0 ;  numBytes += size ; <START_BUG> DEBUG ( ( "Allocated   %d   bytes,   total   %d\\n", size, numBytes ) ) ; # endif <END_BUG> return malloc ( size ) ;  }

Fix:
<S2SV_ModStart> ( u32 size, u32 num ) { if ( size > UINT32_MAX // num ) { return NULL ; } <S2SV_ModEnd> # if defined <S2SV_ModStart> numBytes += size * num <S2SV_ModStart> malloc ( size * num
Buggy code:
 static int futex_wait_requeue_pi ( u32 __user * uaddr, unsigned int flags, u32 val, ktime_t * abs_time, u32 bitset, u32 __user * uaddr2 ) { struct hrtimer_sleeper timeout, * to = NULL ; struct rt_mutex_waiter rt_waiter ; struct rt_mutex * pi_mutex = NULL ; struct futex_hash_bucket * hb ; union futex_key key2 = FUTEX_KEY_INIT ; struct futex_q q = futex_q_init ; int res, ret ; if ( uaddr == uaddr2 ) return - EINVAL ; if (! bitset ) return - EINVAL ; if ( abs_time ) { to = & timeout ; hrtimer_init_on_stack ( & to -> timer, ( flags & FLAGS_CLOCKRT )? CLOCK_REALTIME : CLOCK_MONOTONIC, HRTIMER_MODE_ABS ) ; hrtimer_init_sleeper ( to, current ) ; hrtimer_set_expires_range_ns ( & to -> timer, * abs_time, current -> timer_slack_ns ) ; } debug_rt_mutex_init_waiter ( & rt_waiter ) ; RB_CLEAR_NODE ( & rt_waiter. pi_tree_entry ) ; RB_CLEAR_NODE ( & rt_waiter. tree_entry ) ; rt_waiter. task = NULL ; ret = get_futex_key ( uaddr2, flags & FLAGS_SHARED, & key2, VERIFY_WRITE ) ; if ( unlikely ( ret!= 0 ) ) goto out ; q. bitset = bitset ; q. rt_waiter = & rt_waiter ; q. requeue_pi_key = & key2 ; ret = futex_wait_setup ( uaddr, val, flags, & q, & hb ) ; if ( ret ) goto out_key2 ; <START_BUG> futex_wait_queue_me ( hb, & q, to ) ; <END_BUG> spin_lock ( & hb -> lock ) ; ret = handle_early_requeue_pi_wakeup ( hb, & q, & key2, to ) ; spin_unlock (

Fix:
<S2SV_ModStart> goto out_key2 ; if ( match_futex ( & q. key, & key2 ) ) { ret = - EINVAL ; goto out_put_keys ; }
Buggy code:
 static int f2fs_set_data_page_dirty ( struct page * page ) { <START_BUG> struct address_space * mapping = page -> mapping ; <END_BUG>  struct inode * inode = mapping -> host ; <START_BUG> trace_f2fs_set_page_dirty ( page, DATA ) ; if (! PageUptodate ( page ) ) <END_BUG> SetPageUptodate ( page ) ;  if ( f2fs_is_atomic_file ( inode ) &&! f2fs_is_commit_atomic_write ( inode ) ) { if (! IS_ATOMIC_WRITTEN_PAGE ( page ) ) { f2fs_register_inmem_page ( inode, page ) ; return 1 ; } return 0 ; } if (! PageDirty ( page ) ) { __set_page_dirty_nobuffers ( page ) ; f2fs_update_dirty_page ( inode, page ) ; return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> ) { struct <S2SV_ModEnd> inode * inode <S2SV_ModStart> * inode = page_file_mapping ( page ) <S2SV_ModEnd> -> host ; <S2SV_ModStart> ) ) SetPageUptodate ( page ) ; if ( PageSwapCache ( page ) ) return __set_page_dirty_nobuffers
Buggy code:
 void vp8_pick_inter_mode ( VP8_COMP * cpi, MACROBLOCK * x, int recon_yoffset, int recon_uvoffset, int * returnrate, int * returndistortion, int * returnintra, int mb_row, int mb_col ) { BLOCK * b = & x -> block [ 0 ] ; BLOCKD * d = & x -> e_mbd. block [ 0 ] ; MACROBLOCKD * xd = & x -> e_mbd ; MB_MODE_INFO best_mbmode ; int_mv best_ref_mv_sb [ 2 ] ; int_mv mode_mv_sb [ 2 ] [ MB_MODE_COUNT ] ; int_mv best_ref_mv ; int_mv * mode_mv ; MB_PREDICTION_MODE this_mode ; int num00 ; int mdcounts [ 4 ] ; int best_rd = INT_MAX ; int rd_adjustment = 100 ; int best_intra_rd = INT_MAX ; int mode_index ; int rate ; int rate2 ; int distortion2 ; int bestsme = INT_MAX ; int best_mode_index = 0 ; <START_BUG> unsigned int sse = INT_MAX, best_rd_sse = INT_MAX ; <END_BUG> # if CONFIG_TEMPORAL_DENOISING  unsigned int zero_mv_sse = INT_MAX, best_sse = INT_MAX ; <START_BUG> # endif <END_BUG> int sf_improved_mv_pred = cpi -> sf. improved_mv_pred ;  int_mv mvp ; int near_sadidx [ 8 ] = { 0, 1, 2, 3, 4, 5, 6, 7 } ; int saddone = 0 ; int sr = 0 ; unsigned char * plane [ 4 ] [ 3 ] ; int ref_frame_map [ 4 ] ; int sign_bias = 0 ; <START_BUG> # if CONFIG_MULTI_RES_ENCODING <END_BUG> int dissim = INT_MAX ; int parent_ref_frame = 0 ;  int parent_ref_valid = cpi -> oxcf. mr_encoder_id && cpi -> mr_low_res_mv_avail ; <START_BUG> int_mv parent_ref_mv ; MB_PREDICTION_MODE parent_mode = 0 ; if ( parent_ref_<END_BUG>

Fix:
<S2SV_ModStart> int sse = UINT_MAX <S2SV_ModEnd>, best_rd_sse = <S2SV_ModStart>, best_rd_sse = UINT_MAX <S2SV_ModEnd> ; # if <S2SV_ModStart> int zero_mv_sse = UINT_MAX <S2SV_ModEnd>, best_sse = <S2SV_ModStart>, best_sse = UINT_MAX <S2SV_ModEnd> ; # endif <S2SV_ModStart>. improved_mv_pred ; # if CONFIG_MULTI_RES_ENCODING int dissim = INT_MAX ; int parent_ref_frame = 0 ; int_mv parent_ref_mv ; MB_PREDICTION_MODE parent_mode = 0 ; int parent_ref_valid = 0 ; # endif <S2SV_ModStart> = 0 ; int dot_artifact_candidate = 0 ; get_predictor_pointers ( cpi, plane, recon_yoffset, recon_uvoffset ) ; if ( cpi -> ref_frame_flags & VP8_LAST_FRAME ) { unsigned char * target_y = x -> src. y_buffer ; unsigned char * target_u = x -> block [ 16 ]. src + * x -> block [ 16 ]. base_src ; unsigned char * target_v = x -> block [ 20 ]. src + * x -> block [
Buggy code:
 int cap_bprm_set_creds ( struct linux_binprm * bprm ) { const struct cred * old = current_cred ( ) ; struct cred * new = bprm -> cred ; bool effective, has_cap = false ; int ret ; effective = false ; ret = get_file_caps ( bprm, & effective, & has_cap ) ; if ( ret < 0 ) return ret ; if (! issecure ( SECURE_NOROOT ) ) { if ( has_cap && new -> uid!= 0 && new -> euid == 0 ) { warn_setuid_and_fcaps_mixed ( bprm -> filename ) ; goto skip ; } if ( new -> euid == 0 || new -> uid == 0 ) { new -> cap_permitted = cap_combine ( old -> cap_bset, old -> cap_inheritable ) ; } if ( new -> euid == 0 ) effective = true ; } skip : <START_BUG> if ( ( new -> euid!= old -> uid || <END_BUG> new -> egid!= old -> gid ||! cap_issubset ( new -> cap_permitted, old -> cap_permitted ) ) && bprm -> unsafe & ~ LSM_UNSAFE_PTRACE_CAP ) { if (! capable ( CAP_SETUID ) ) { new -> euid = new -> uid ; new -> egid = new -> gid ; } new -> cap_permitted = cap_intersect ( new -> cap_permitted, old -> cap_permitted ) ; } new -> suid = new -> fsuid = new -> euid ; new -> sgid = new -> fsgid = new -> egid ; if ( effective ) new -> cap_effective = new -> cap_permitted ; else cap_clear ( new -> cap_effective ) ; bprm -> cap_effective = effective ; if (! cap_isclear ( new -> cap_effective ) ) { if (! cap_issubset ( CAP_FULL_SET, new -> cap_effective ) || new -> euid!= 0 || new -> uid!= 0 || issecure ( SECURE_NOROOT ) ) { ret = audit_log_bprm_fcaps ( bprm, new, old ) ; if ( ret < 0 ) return ret ; } } new -> securebits &= ~

Fix:
<S2SV_ModStart> : if (! cap_issubset ( new -> cap_permitted, old -> cap_permitted ) ) bprm -> per_clear |= PER_CLEAR_ON_SETID ; if (
Buggy code:
 static ssize_t __nfs4_get_acl_uncached ( struct inode * inode, void * buf, size_t buflen ) { struct page * pages [ NFS4ACL_MAXPAGES ] = { NULL, } ; struct nfs_getaclargs args = {. fh = NFS_FH ( inode ),. acl_pages = pages,. acl_len = buflen, } ; struct nfs_getaclres res = {. acl_len = buflen, } ; struct rpc_message msg = {. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_GETACL ],. rpc_argp = & args,. rpc_resp = & res, } ; unsigned int npages = DIV_ROUND_UP ( buflen, PAGE_SIZE ) ; int ret = - ENOMEM, i ; if ( npages == 0 ) npages = 1 ; if ( npages > ARRAY_SIZE ( pages ) ) return - ERANGE ; for ( i = 0 ; i < npages ; i ++ ) { pages [ i ] = alloc_page ( GFP_KERNEL ) ; if (! pages [ i ] ) goto out_free ; } res. acl_scratch = alloc_page ( GFP_KERNEL ) ; if (! res. acl_scratch ) goto out_free ; args. acl_len = npages * PAGE_SIZE ; args. acl_pgbase = 0 ; dprintk ( "%s     buf   %p   buflen   %zu   npages   %d   args.acl_len   %zu\\n", __func__, buf, buflen, npages, args. acl_len ) ; ret = nfs4_call_sync ( NFS_SERVER ( inode ) -> client, NFS_SERVER ( inode ), & msg, & args. seq_args, & res. seq_res, 0 ) ; if ( ret ) goto out_free ; if ( res. acl_flags & NFS4_ACL_TRUNC ) { if ( buf == NULL ) goto out_ok ; ret = - ERANGE ; goto out_free ; } nfs4_write_cached_acl ( inode, pages, res. acl_data_offset, res. acl_len ) ; <START_BUG> if<END_BUG>

Fix:
<S2SV_ModStart> ( buf ) { if ( res. acl_len > buflen ) { ret = - ERANGE ; goto out_free ; } <S2SV_ModStart> acl_len ) ; }
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_get_reference ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_ref_frame_t * data = va_arg ( args, vpx_ref_frame_t * ) ; if ( data ) { vpx_ref_frame_t * frame = ( vpx_ref_frame_t * ) data ; YV12_BUFFER_CONFIG sd ; image2yuvconfig ( & frame -> img, & sd ) ; vp8_get_reference ( ctx -> cpi, frame -> frame_type, & sd ) ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static int hci_sock_getsockopt ( struct socket * sock, int level, int optname, char __user * optval, int __user * optlen ) { struct hci_ufilter uf ; struct sock * sk = sock -> sk ; int len, opt, err = 0 ; BT_DBG ( "sk   %p,   opt   %d", sk, optname ) ; if ( get_user ( len, optlen ) ) return - EFAULT ; lock_sock ( sk ) ; if ( hci_pi ( sk ) -> channel!= HCI_CHANNEL_RAW ) { err = - EINVAL ; goto done ; } switch ( optname ) { case HCI_DATA_DIR : if ( hci_pi ( sk ) -> cmsg_mask & HCI_CMSG_DIR ) opt = 1 ; else opt = 0 ; if ( put_user ( opt, optval ) ) err = - EFAULT ; break ; case HCI_TIME_STAMP : if ( hci_pi ( sk ) -> cmsg_mask & HCI_CMSG_TSTAMP ) opt = 1 ; else opt = 0 ; if ( put_user ( opt, optval ) ) err = - EFAULT ; break ; case HCI_FILTER : { <START_BUG> struct hci_filter * f = & hci_pi ( sk ) -> filter ; <END_BUG> uf. type_mask = f -> type_mask ; uf. opcode = f -> opcode ; uf. event_mask [ 0 ] = * ( ( u32 * ) f -> event_mask + 0 ) ; uf. event_mask [ 1 ] = * ( ( u32 * ) f -> event_mask + 1 ) ; } len = min_t ( unsigned int, len, sizeof ( uf ) ) ; if ( copy_to_user ( optval, & uf, len ) ) err = - EFAULT ; break ; default : err = - ENOPROTOOPT ; break ; } done : release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> ) -> filter ; memset ( & uf, 0, sizeof ( uf ) )
Buggy code:
 int y4m_write_file_header ( char * buf, size_t len, int width, int height, const struct VpxRational * framerate, <START_BUG> vpx_img_fmt_t fmt ) { <END_BUG>  const char * const color = fmt == VPX_IMG_FMT_444A? "C444alpha\\n" : <START_BUG> fmt == VPX_IMG_FMT_I444? "C444\\n" : fmt == VPX_IMG_FMT_I422? "C422\\n" : <END_BUG> "C420jpeg\\n" ;  return snprintf ( buf, len, "YUV4MPEG2   W%u   H%u   F%u:%u   I%c   %s", width, height, framerate -> numerator, framerate -> denominator, 'p', color ) ; }

Fix:
<S2SV_ModStart>, vpx_img_fmt_t fmt, unsigned int bit_depth <S2SV_ModStart> const char * color ; switch ( bit_depth ) { case 8 : <S2SV_ModEnd> color = fmt <S2SV_ModStart> : "C420jpeg\\n" ; break ; case 9 : color = fmt == VPX_IMG_FMT_I44416? "C444p9 <S2SV_blank> XYSCSS=444P9\\n" : fmt == VPX_IMG_FMT_I42216? "C422p9 <S2SV_blank> XYSCSS=422P9\\n" : "C420p9 <S2SV_blank> XYSCSS=420P9\\n" ; break ; case 10 : color = fmt == VPX_IMG_FMT_I44416? "C444p10 <S2SV_blank> XYSCSS=444P10\\n" : fmt == VPX_IMG_FMT_I42216? "C422p10 <S2SV_blank> XYSCSS=422P10\\n" : "C420p10 <S2SV_blank> XYSCSS=420P10\\n" ; break ; case 12 : color = fmt == V
Buggy code:
 void ndpi_search_openvpn ( struct ndpi_detection_module_struct * ndpi_struct, struct ndpi_flow_struct * flow ) { struct ndpi_packet_struct * packet = & flow -> packet ; const u_int8_t * ovpn_payload = packet -> payload ; const u_int8_t * session_remote ; u_int8_t opcode ; u_int8_t alen ; int8_t hmac_size ; int8_t failed = 0 ; <START_BUG> if ( packet -> payload_packet_len >= 40 ) { <END_BUG> if ( packet -> tcp!= NULL )  ovpn_payload += 2 ; <START_BUG> opcode = ovpn_payload [ 0 ] & P_OPCODE_MASK ; if ( packet -> udp ) { # ifdef DEBUG printf ( "[packet_id:   %u][opcode:   %u][Packet   ID:   %d][%u   <->   %u][len:   %u]\\n", flow -> num_processed_pkts, opcode, check_pkid_and_detect_hmac_size ( ovpn_payload ), <END_BUG> htons ( packet -> udp -> source ), htons ( packet -> udp -> dest ), packet -> payload_packet_len ) ;  # endif if ( ( flow -> num_processed_pkts == 1 ) && ( <START_BUG> ( ( packet -> payload_packet_len == 112 ) <END_BUG> && ( ( opcode == 168 ) || ( opcode == 192 ) ) )  || ( ( packet -> payload_packet_len == 80 ) <START_BUG> && ( ( opcode == 184 ) || ( opcode == 88 ) || ( opcode == 160 ) || ( opcode == 168 ) || ( opcode == 200 ) ) ) ) ) { NDPI_LOG_INFO ( ndpi_struct, "found   openvpn\\n" ) ; ndpi_set_detected_protocol ( ndpi_struct, flow, NDPI_PROTOCOL_OPENVPN, NDPI_PROTOCOL_UNKNOWN ) ; return ; } } if ( flow -> ovpn_counter < P_HARD_RESET_CLIENT_MAX_COUNT && ( opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || opcode == P_CONTROL_HARD_RESET_CLIENT_V2 ) ) {<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; int16_t ovpn_payload_len = <S2SV_ModEnd> packet -> payload_packet_len <S2SV_ModStart> packet -> payload_packet_len ; if ( ovpn_payload_len <S2SV_ModStart> ovpn_payload += 2, ovpn_payload_len -= 2 ; <S2SV_ModStart> dest ), ovpn_payload_len <S2SV_ModEnd> ) ; # <S2SV_ModStart> ( ( ( ovpn_payload_len <S2SV_ModEnd> == 112 ) <S2SV_ModStart> || ( ( ovpn_payload_len <S2SV_ModEnd> == 80 ) <S2SV_ModStart> 0 ) { u_int16_t offset = P_PACKET_ID_ARRAY_LEN_OFFSET ( hmac_size ) ; <S2SV_ModStart> = ovpn_payload [ offset <S2SV_ModEnd> ] ; if <S2SV_ModStart> 0 ) { offset += <S2SV_ModEnd> 1 + alen <S2SV_ModStart> ; if ( ( offset + 8 ) <= ovpn_payload_len ) { session_remote = & ovpn_payload [ offset ] ; if ( <S2SV_ModStart> 1 ; } } else failed = 1 ;
Buggy code:
 Image * AutoResizeImage ( const Image * image, const char * option, MagickOffsetType * count, ExceptionInfo * exception ) { # define MAX_SIZES 16 char * q ; const char * p ; Image * resized, * images ; register ssize_t i ; size_t sizes [ MAX_SIZES ] = { 256, 192, 128, 96, 64, 48, 40, 32, 24, 16 } ; images = NULL ; * count = 0 ; i = 0 ; p = option ; while ( * p!= '\\0' && i < MAX_SIZES ) { size_t size ; while ( ( isspace ( ( int ) ( ( unsigned char ) * p ) )!= 0 ) ) p ++ ; size = ( size_t ) strtol ( p, & q, 10 ) ; <START_BUG> if ( p == q || size < 16 || size > 256 ) <END_BUG> return ( ( Image * ) NULL ) ; p = q ; sizes [ i ++ ] = size ; while ( ( isspace ( ( int ) ( ( unsigned char ) * p ) )!= 0 ) || ( * p == ',' ) ) p ++ ; } if ( i == 0 ) i = 10 ; * count = i ; for ( i = 0 ; i < * count ; i ++ ) { resized = ResizeImage ( image, sizes [ i ], sizes [ i ], image -> filter, exception ) ; if ( resized == ( Image * ) NULL ) return ( DestroyImageList ( images ) ) ; if ( images == ( Image * ) NULL ) images = resized ; else AppendImageToList ( & images, resized ) ; } return ( images ) ; }

Fix:
<S2SV_ModStart> ; if ( ( <S2SV_ModStart> p == q ) || ( <S2SV_ModEnd> size < 16 <S2SV_ModStart> size < 16 ) || ( <S2SV_ModEnd> size > 256 <S2SV_ModStart> size > 256 )
Buggy code:
 int ImagingPcxDecode ( Imaging im, ImagingCodecState state, UINT8 * buf, Py_ssize_t bytes ) { UINT8 n ; UINT8 * ptr ; <START_BUG> if ( strcmp ( im -> mode, "1" ) == 0 && state -> xsize > state -> bytes * 8 ) { <END_BUG> state -> errcode = IMAGING_CODEC_OVERRUN ; return - 1 ;  } else if ( strcmp ( im -> mode, "P" ) == 0 && state -> xsize > state -> bytes ) { <START_BUG> state -> errcode = IMAGING_CODEC_OVERRUN ; return - 1 ; } <END_BUG> ptr = buf ;  for ( ; ; ) { if ( bytes < 1 ) return ptr - buf ; if ( ( * ptr & 0xC0 ) == 0xC0 ) { if ( bytes < 2 ) return ptr - buf ; n = ptr [ 0 ] & 0x3F ; while ( n > 0 ) { if ( state -> x >= state -> bytes ) { state -> errcode = IMAGING_CODEC_OVERRUN ; break ; } state -> buffer [ state -> x ++ ] = ptr [ 1 ] ; n -- ; } ptr += 2 ; bytes -= 2 ; } else { state -> buffer [ state -> x ++ ] = ptr [ 0 ] ; ptr ++ ; bytes -- ; } if ( state -> x >= state -> bytes ) { if ( state -> bytes % state -> xsize && state -> bytes > state -> xsize ) { int bands = state -> bytes // state -> xsize ; int stride = state -> bytes // bands ; int i ; for ( i = 1 ; i < bands ; i ++ ) { memmove ( & state -> buffer [ i * state -> xsize ], & state -> buffer [ i * stride ], state -> xsize ) ; } } state -> shuffle ( ( UINT8 * ) im -> image [ state -> y + state -> yoff ] + state -> xoff * im -> pixelsize, state -> buffer, state -> xsize ) ; state -> x = 0 ; if ( ++ state -> y >= state -> ysize ) { return - 1 ; } } } }

Fix:
<S2SV_ModStart> ; if ( ( state -> xsize * state -> bits + 7 ) // 8 <S2SV_ModEnd> > state -> <S2SV_ModStart> state -> bytes <S2SV_ModEnd> ) { state <S2SV_ModStart> 1 ; } ptr = buf ; for ( ; ; ) { if ( bytes < 1 ) return ptr - buf ; if ( ( * ptr & 0xC0 ) == 0xC0 ) { if ( bytes < 2 ) return ptr - buf ; n = ptr [ 0 ] & 0x3F ; while ( n > 0 ) { if ( state -> x >= state -> bytes ) { state -> errcode = IMAGING_CODEC_OVERRUN ; break ; } state -> buffer [ state -> x ++ ] = ptr [ 1 ] ; n -- ; } ptr += 2 ; bytes -= 2 ; } else { state -> buffer [ state -> x ++ ] = ptr [ 0 ] ; ptr ++ ; bytes -- ; } if ( state -> x >= state -> bytes ) { if ( state -> bytes % state -> xsize && state -> bytes > state -> xsize ) { int bands = state -> bytes // state -> xsize ; int stride = state -> bytes // bands ; int i ; for ( i = 1 ; i < bands ; i ++ ) { memmove (
Buggy code:
 <START_BUG> int jas_matrix_resize ( jas_matrix_t * matrix, int numrows, int numcols ) <END_BUG> {  int size ; <START_BUG> int i ; size = numrows * numcols ; if ( size > matrix -> datasize_ || numrows > matrix -> maxrows_ ) { return - 1 ; } matrix -> numrows_ = numrows ; matrix -> numcols_ = numcols ; for ( i = 0 ; i < numrows ; ++ i ) { matrix -> rows_ [ i ] = & matrix -> data_ [ numcols * i ] ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> * matrix, jas_matind_t numrows, jas_matind_t <S2SV_ModEnd> numcols ) { <S2SV_ModStart> numcols ) { jas_matind_t size ; jas_matind_t <S2SV_ModEnd> i ; size
Buggy code:
 error_t enc624j600SendPacket ( NetInterface * interface, const NetBuffer * buffer, size_t offset, NetTxAncillary * ancillary ) { size_t length ; length = netBufferGetLength ( buffer ) - offset ; if ( length > 1536 ) { osSetEvent ( & interface -> nicTxEvent ) ; return ERROR_INVALID_LENGTH ; } if (! interface -> linkState ) { osSetEvent ( & interface -> nicTxEvent ) ; return NO_ERROR ; } <START_BUG> if ( enc624j600ReadReg ( interface, ENC624J600_REG_ECON1 ) & ECON1_TXRTS ) <END_BUG> { return ERROR_FAILURE ; }  enc624j600WriteReg ( interface, ENC624J600_REG_EGPWRPT, ENC624J600_TX_BUFFER_START ) ; <START_BUG> enc624j600WriteBuffer ( interface, ENC624J600_CMD_WGPDATA, buffer, offset ) ; <END_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_ETXST, ENC624J600_TX_BUFFER_START ) ;  <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_ETXLEN, length ) ; <END_BUG>  enc624j600ClearBit ( interface, ENC624J600_REG_EIR, EIR_TXIF | EIR_TXABTIF ) ; <START_BUG> <END_BUG> enc624j600SetBit ( interface, ENC624J600_REG_ECON1, ECON1_TXRTS ) ;  return NO_ERROR ; }

Fix:
<S2SV_ModStart> ( interface, ENC624J600_ECON1 ) & ENC624J600_ECON1_TXRTS <S2SV_ModEnd> ) { return <S2SV_ModStart> ( interface, ENC624J600_EGPWRPT <S2SV_ModEnd>, ENC624J600_TX_BUFFER_START ) <S2SV_ModStart> ( interface, ENC624J600_ETXST <S2SV_ModEnd>, ENC624J600_TX_BUFFER_START ) <S2SV_ModStart> ( interface, ENC624J600_ETXLEN <S2SV_ModEnd>, length ) <S2SV_ModStart> ( interface, ENC624J600_EIR, ENC624J600_EIR_TXIF | ENC624J600_EIR_TXABTIF <S2SV_ModEnd> ) ; enc624j600SetBit <S2SV_ModStart> ( interface, ENC624J600_ECON1, ENC624J600_ECON1_TXRTS <S2SV_ModEnd> ) ; return
Buggy code:
 static int lxc_mount_auto_mounts ( struct lxc_conf * conf, int flags, struct lxc_handler * handler ) { int r ; size_t i ; static struct { int match_mask ; int match_flag ; const char * source ; const char * destination ; const char * fstype ; unsigned long flags ; const char * options ; } default_mounts [ ] = { { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc", "%r//proc", "proc", MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL }, <START_BUG> { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r//proc//sys//net", "%r//proc//net", NULL, MS_BIND, NULL }, <END_BUG> { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r//proc//sys", "%r//proc//sys", NULL, MS_BIND, NULL }, { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r//proc//sys", NULL, MS_REMOUNT | MS_BIND | MS_RDONLY, NULL },  { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r//proc//net", "%r//proc//sys//net", NULL, MS_MOVE, NULL }, <START_BUG> { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r//proc//sysrq-trigger", "%r//proc//sysrq-trigger", NULL, MS_BIND, NULL }, { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL, "%r//proc//sysrq-trigger", NULL, MS_REMOUNT | MS_BIND | MS_RDONLY, NULL }, { LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW, "proc", "%r//proc",<END_BUG>

Fix:
<S2SV_ModStart>, "%r//proc//sys//net", "%r//proc//tty" <S2SV_ModEnd>, NULL, <S2SV_ModStart>, LXC_AUTO_PROC_MIXED, "%r//proc//tty" <S2SV_ModEnd>, "%r//proc//sys//net", <S2SV_ModStart> ; r = safe_mount ( source, destination, default_mounts [ i ]. fstype, mflags, default_mounts [ i ]. options, conf -> rootfs. path? conf -> rootfs. mount : NULL <S2SV_ModEnd> ) ; saved_errno
Buggy code:
 static Image * ReadPALMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; MagickOffsetType totalOffset, seekNextDepth ; PixelInfo transpix ; Quantum index ; register ssize_t i, x ; register Quantum * q ; size_t bytes_per_row, flags, bits_per_pixel, version, nextDepthOffset, transparentIndex, compressionType, byte, mask, redbits, greenbits, bluebits, one, pad, size, bit ; ssize_t count, y ; unsigned char <START_BUG> * lastrow, <END_BUG> * one_row, * ptr ; unsigned short color16 ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { ( void ) DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } totalOffset = 0 ; do { image -> columns = ReadBlobMSBShort ( image ) ; image -> rows = ReadBlobMSBShort ( image ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( CorruptImageError, "NegativeOrZeroImageSize" ) ; status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; bytes_per_row = ReadBlobMSBShort ( image ) ; flags = ReadBlobMSBShort ( image ) ; bits_per_pixel = ( size_t ) ReadBlobByte ( image ) ; if ( ( bits_per_pixel!= 1 ) && ( bits_per_pixel!= 2 ) && ( bits_per

Fix:
<S2SV_ModStart> unsigned char * last_row <S2SV_ModEnd>, * one_row <S2SV_ModStart> "MemoryAllocationFailed" ) ; last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> PALM_COMPRESSION_SCANLINE ) { last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> sizeof ( * last_row ) ) ; if ( last_row <S2SV_ModEnd> == ( unsigned <S2SV_ModStart> bit ] = last_row <S2SV_ModEnd> [ i + <S2SV_ModStart> ) CopyMagickMemory ( last_row <S2SV_ModEnd>, one_row, <S2SV_ModStart> == PALM_COMPRESSION_SCANLINE ) last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> ) RelinquishMagickMemory ( last_row <S2SV_ModEnd> ) ; ThrowReaderException <S2SV_ModStart> == PALM_COMPRESSION_SCANLINE ) last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> ) RelinquishMagickMemory ( last_row <S2SV_ModEnd> ) ; ThrowReaderException <S2SV_ModStart> == PALM_COMPRESSION_SCANLINE ) last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> ) RelinquishMagickMemory ( last_row <S2SV_ModEnd> ) ; if
Buggy code:
 void nw_cache_free ( nw_cache * cache, void * obj ) { if ( cache -> free < cache -> free_total ) { cache -> free_arr [ cache -> free ++ ] = obj ; <START_BUG> } else { <END_BUG> uint32_t new_free_total = cache -> free_total * 2 ; void * new_arr = realloc ( cache -> free_arr, new_free_total * sizeof ( void * ) ) ; if ( new_arr ) { cache -> free_total = new_free_total ; cache -> free_arr = new_arr ; cache -> free_arr [ cache -> free ++ ] = obj ; } else { free ( obj ) ; }  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ; } else if ( cache -> free_total < NW_CACHE_MAX_SIZE ) <S2SV_ModStart> ; } } else { free ( obj ) ; }
Buggy code:
 int dccp_v4_connect ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { const struct sockaddr_in * usin = ( struct sockaddr_in * ) uaddr ; struct inet_sock * inet = inet_sk ( sk ) ; struct dccp_sock * dp = dccp_sk ( sk ) ; __be16 orig_sport, orig_dport ; __be32 daddr, nexthop ; struct flowi4 fl4 ; struct rtable * rt ; <START_BUG> int err ; <END_BUG> dp -> dccps_role = DCCP_ROLE_CLIENT ; if ( addr_len < sizeof ( struct sockaddr_in ) ) return - EINVAL ; if ( usin -> sin_family!= AF_INET ) return - EAFNOSUPPORT ; nexthop = daddr = usin -> sin_addr. s_addr ;  if ( inet -> opt!= NULL && inet -> opt -> srr ) { <START_BUG> if ( daddr == 0 ) return - EINVAL ; <END_BUG> nexthop = inet -> opt -> faddr ;  } orig_sport = inet -> inet_sport ; orig_dport = usin -> sin_port ; rt = ip_route_connect ( & fl4, nexthop, inet -> inet_saddr, RT_CONN_FLAGS ( sk ), sk -> sk_bound_dev_if, IPPROTO_DCCP, orig_sport, orig_dport, sk, true ) ; if ( IS_ERR ( rt ) ) return PTR_ERR ( rt ) ; if ( rt -> rt_flags & ( RTCF_MULTICAST | RTCF_BROADCAST ) ) { ip_rt_put ( rt ) ; return - ENETUNREACH ; } <START_BUG> if ( inet -> opt == NULL ||! inet -> opt -> srr ) <END_BUG> daddr = rt -> rt_dst ; if ( inet -> inet_saddr == 0 ) inet -> inet_saddr = rt -> rt_src ; inet -> inet_rcv_saddr = inet -> inet_saddr ; inet -> inet_dport = usin -> sin_port ; inet -> inet_daddr = daddr ; inet_csk ( sk ) -> icsk_ext_hdr_len = 0 ;  if ( inet -> opt

Fix:
<S2SV_ModStart> ; int err ; struct ip_options_rcu * inet_opt <S2SV_ModStart>. s_addr ; inet_opt = rcu_dereference_protected ( inet -> inet_opt, sock_owned_by_user ( sk ) ) ; if ( inet_opt <S2SV_ModEnd>!= NULL && <S2SV_ModStart>!= NULL && inet_opt -> opt. <S2SV_ModEnd> srr ) { <S2SV_ModStart> ; nexthop = inet_opt -> opt. <S2SV_ModEnd> faddr ; } <S2SV_ModStart> } if ( inet_opt <S2SV_ModEnd> == NULL || <S2SV_ModStart> NULL ||! inet_opt -> opt. <S2SV_ModEnd> srr ) daddr <S2SV_ModStart> ; if ( inet_opt ) inet_csk ( sk ) -> icsk_ext_hdr_len = inet_opt -> opt. <S2SV_ModEnd> optlen ; dccp_set_state
Buggy code:
 generic_ret * create_principal_2_svc ( cprinc_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, service_name ; <END_BUG> OM_uint32 minor_stat ; kadm5_server_handle_t handle ; restriction_t * rp ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> rec. principal, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_ADD, arg -> rec. principal, & rp ) || kadm5int_acl_impose_restrictions ( handle -> context, & arg -> rec, & arg -> mask, rp ) ) { ret. code = KADM5_AUTH_ADD ; log_unauth ( "kadm5_create_principal", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_create_principal ( ( void * ) handle, & arg -> rec, arg -> mask, arg -> passwd ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_create_principal", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message (

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static const char * lua_authz_parse ( cmd_parms * cmd, const char * require_line, const void * * parsed_require_line ) { const char * provider_name ; <START_BUG> lua_authz_provider_spec * spec ; <END_BUG> apr_pool_userdata_get ( ( void * * ) & provider_name, AUTHZ_PROVIDER_NAME_NOTE, cmd -> temp_pool ) ; ap_assert ( provider_name!= NULL ) ; spec = apr_hash_get ( lua_authz_providers, provider_name, APR_HASH_KEY_STRING ) ; ap_assert ( spec!= NULL ) ;  if ( require_line && * require_line ) { <START_BUG> const char * arg ; <END_BUG> spec -> args = apr_array_make ( cmd -> pool, 2, sizeof ( const char * ) ) ;  while ( ( arg = ap_getword_conf ( cmd -> pool, & require_line ) ) && * arg ) { <START_BUG> APR_ARRAY_PUSH ( spec -> args, const char * ) = arg ; <END_BUG> } }  * parsed_require_line = spec ; <START_BUG> return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> lua_authz_provider_spec * spec ; lua_authz_provider_func * func = apr_pcalloc ( cmd -> pool, sizeof ( lua_authz_provider_func ) ) <S2SV_ModStart> NULL ) ; func -> spec = spec ; <S2SV_ModStart> * arg ; func <S2SV_ModEnd> -> args = <S2SV_ModStart> { APR_ARRAY_PUSH ( func <S2SV_ModEnd> -> args, <S2SV_ModStart> * parsed_require_line = func <S2SV_ModEnd> ; return NULL
Buggy code:
 static int hci_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; struct sk_buff * skb ; int copied, err ; BT_DBG ( "sock   %p,   sk   %p", sock, sk ) ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; if ( sk -> sk_state == BT_CLOSED ) return 0 ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) return err ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } skb_reset_transport_header ( skb ) ; err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; switch ( hci_pi ( sk ) -> channel ) { case HCI_CHANNEL_RAW : hci_sock_cmsg ( sk, msg, skb ) ; break ; case HCI_CHANNEL_USER : case HCI_CHANNEL_CONTROL : case HCI_CHANNEL_MONITOR : sock_recv_timestamp ( msg, sk, skb ) ; break ; } skb_free_datagram ( sk, skb ) ; return err? : copied ; }

Fix:
<S2SV_ModStart> return err ; <S2SV_ModEnd> copied = skb
Buggy code:
 static void test_bson_validate ( void ) { char filename [ 64 ] ; size_t offset ; bson_t * b ; int i ; bson_error_t error ; for ( i = 1 ; i <= 38 ; i ++ ) { bson_snprintf ( filename, sizeof filename, "test%u.bson", i ) ; b = get_bson ( filename ) ; BSON_ASSERT ( bson_validate ( b, BSON_VALIDATE_NONE, & offset ) ) ; bson_destroy ( b ) ; } b = get_bson ( "codewscope.bson" ) ; BSON_ASSERT ( bson_validate ( b, BSON_VALIDATE_NONE, & offset ) ) ; bson_destroy ( b ) ; b = get_bson ( "empty_key.bson" ) ; BSON_ASSERT ( bson_validate ( b, BSON_VALIDATE_NONE | BSON_VALIDATE_UTF8 | BSON_VALIDATE_DOLLAR_KEYS | BSON_VALIDATE_DOT_KEYS, & offset ) ) ; bson_destroy ( b ) ; # define VALIDATE_TEST ( _filename, _flags, _offset, _flag, _msg ) b = get_bson ( _filename ) ; BSON_ASSERT (! bson_validate ( b, _flags, & offset ) ) ; ASSERT_CMPSIZE_T ( offset, ==, ( size_t ) _offset ) ; BSON_ASSERT (! bson_validate_with_error ( b, _flags, & error ) ) ; ASSERT_ERROR_CONTAINS ( error, BSON_ERROR_INVALID, _flag, _msg ) ; bson_destroy ( b ) VALIDATE_TEST ( "overflow2.bson", BSON_VALIDATE_NONE, 9, BSON_VALIDATE_NONE, "corrupt   BSON" ) ; VALIDATE_TEST ( "trailingnull.bson", BSON_VALIDATE_NONE, 14, BSON_VALIDATE_NONE, "corrupt   BSON" ) ; VALIDATE_TEST ( "dollarquery.bson", BSON_VALIDATE_DOLLAR_KEYS | BSON_VALIDATE_DOT_KEYS, 4, BSON_VALIDATE_DOLLAR_KEYS, "keys   cannot   begin   with   \\"$\\":   \\"$query\\"" ) ; VALIDATE_TEST ( "dotquery.

Fix:
<S2SV_ModStart> "corrupt <S2SV_blank> BSON" ) ; VALIDATE_TEST ( "test59.bson", BSON_VALIDATE_NONE, 9, BSON_VALIDATE_NONE, "corrupt <S2SV_blank> BSON" ) ;
Buggy code:
 static char * lxclock_name ( const char * p, const char * n ) { int ret ; int len ; char * dest ; char * rundir ; <START_BUG> len = strlen ( "//lock//lxc//" ) + strlen ( n ) + strlen ( p ) + 3 ; <END_BUG> rundir = get_rundir ( ) ; if (! rundir ) return NULL ; len += strlen ( rundir ) ; if ( ( dest = malloc ( len ) ) == NULL ) { free ( rundir ) ; return NULL ; }  ret = snprintf ( dest, len, "%s//lock//lxc//%s", rundir, p ) ; <START_BUG> if ( ret < 0 || ret >= len ) { free ( dest ) ; free ( rundir ) ; return NULL ; } ret = mkdir_p ( dest, 0755 ) ; if ( ret < 0 ) { <END_BUG> int l2 = 22 + strlen ( n ) + strlen ( p ) ;  if ( l2 > len ) { char * d ; d = realloc ( dest, l2 ) ; if (! d ) { free ( dest ) ; free ( rundir ) ; return NULL ; } len = l2 ; dest = d ; } ret = snprintf ( dest, len, "//tmp//%d//lxc%s", geteuid ( ), p ) ; if ( ret < 0 || ret >= len ) { free ( dest ) ; <START_BUG> free ( rundir ) ; <END_BUG> return NULL ; } ret = mkdir_p ( dest, 0755 ) ; if ( ret < 0 ) { free ( dest ) ; free ( rundir ) ; return NULL ; } ret = snprintf ( dest, len, "//tmp//%d//lxc%s//.%s", geteuid ( ), p, n ) ; } else ret = snprintf ( dest, len, "%s//lock//lxc//%s//.%s", rundir, p, n ) ; free ( rundir ) ; if ( ret < 0 || ret >= len ) { free ( dest ) ; return NULL ; } return dest ; }

Fix:
<S2SV_ModStart> = strlen ( "//lxc//lock//" <S2SV_ModEnd> ) + strlen <S2SV_ModStart>, len, "%s//lxc//lock//%s" <S2SV_ModEnd>, rundir, <S2SV_ModStart> 0 ) { free ( dest ) ; free ( rundir ) ; return NULL ; } ret = snprintf ( dest, len, "%s//lxc//lock//%s//.%s", rundir, p, n ) ; free ( rundir <S2SV_ModEnd> ) ; if <S2SV_ModStart> dest ) ; <S2SV_ModEnd> return NULL ;
Buggy code:
 static int load_state_from_tss32 ( struct x86_emulate_ctxt * ctxt, struct tss_segment_32 * tss ) { int ret ; u8 cpl ; if ( ctxt -> ops -> set_cr ( ctxt, 3, tss -> cr3 ) ) return emulate_gp ( ctxt, 0 ) ; ctxt -> _eip = tss -> eip ; ctxt -> eflags = tss -> eflags | 2 ; * reg_write ( ctxt, VCPU_REGS_RAX ) = tss -> eax ; * reg_write ( ctxt, VCPU_REGS_RCX ) = tss -> ecx ; * reg_write ( ctxt, VCPU_REGS_RDX ) = tss -> edx ; * reg_write ( ctxt, VCPU_REGS_RBX ) = tss -> ebx ; * reg_write ( ctxt, VCPU_REGS_RSP ) = tss -> esp ; * reg_write ( ctxt, VCPU_REGS_RBP ) = tss -> ebp ; * reg_write ( ctxt, VCPU_REGS_RSI ) = tss -> esi ; * reg_write ( ctxt, VCPU_REGS_RDI ) = tss -> edi ; set_segment_selector ( ctxt, tss -> ldt_selector, VCPU_SREG_LDTR ) ; set_segment_selector ( ctxt, tss -> es, VCPU_SREG_ES ) ; set_segment_selector ( ctxt, tss -> cs, VCPU_SREG_CS ) ; set_segment_selector ( ctxt, tss -> ss, VCPU_SREG_SS ) ; set_segment_selector ( ctxt, tss -> ds, VCPU_SREG_DS ) ; set_segment_selector ( ctxt, tss -> fs, VCPU_SREG_FS ) ; set_segment_selector ( ctxt, tss -> gs, VCPU_SREG_GS ) ; if ( ctxt -> eflags & X86_EFLAGS_VM ) { ctxt -> mode = X86EMUL_MODE_VM86 ; cpl = 3 ; } else { ctxt -> mode = X86EMUL_MODE_PROT32 ; cpl = tss -> cs & 3 ; } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, VCPU_SREG_LDTR, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if
Buggy code:
 WORD32 ihevcd_parse_transform_tree ( codec_t * ps_codec, WORD32 x0, WORD32 y0, WORD32 cu_x_base, WORD32 cu_y_base, WORD32 log2_trafo_size, WORD32 trafo_depth, WORD32 blk_idx, WORD32 intra_pred_mode ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; sps_t * ps_sps ; pps_t * ps_pps ; WORD32 value ; WORD32 x1, y1 ; WORD32 max_trafo_depth ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; WORD32 intra_split_flag ; WORD32 split_transform_flag ; WORD32 ctxt_idx ; cab_ctxt_t * ps_cabac = & ps_codec -> s_parse. s_cabac ; max_trafo_depth = ps_codec -> s_parse. s_cu. i4_max_trafo_depth ; ps_sps = ps_codec -> s_parse. ps_sps ; ps_pps = ps_codec -> s_parse. ps_pps ; intra_split_flag = ps_codec -> s_parse. s_cu. i4_intra_split_flag ; { split_transform_flag = 0 ; if ( ( log2_trafo_size <= ps_sps -> i1_log2_max_transform_block_size ) && ( log2_trafo_size > ps_sps -> i1_log2_min_transform_block_size ) && ( trafo_depth < max_trafo_depth ) &&! ( intra_split_flag && ( trafo_depth == 0 ) ) ) { ctxt_idx = IHEVC_CAB_SPLIT_TFM + ( 5 - log2_trafo_size ) ; TRACE_CABAC_CTXT ( "split_transform_flag", ps_cabac -> u4_range, ctxt_idx ) ; split_transform_flag = ihevcd_cabac_decode_bin ( ps_c

Fix:
<S2SV_ModStart> cu_qp_delta_abs ; } if ( cu_qp_delta_abs < MIN_CU_QP_DELTA_ABS ( ps_sps -> i1_bit_depth_luma_minus8 ) || cu_qp_delta_abs > MAX_CU_QP_DELTA_ABS ( ps_sps -> i1_bit_depth_luma_minus8 ) ) { return IHEVCD_INVALID_PARAMETER ; }
Buggy code:
 void mp_encode_lua_table_as_array ( lua_State * L, mp_buf * buf, int level ) { # if LUA_VERSION_NUM < 502 size_t len = lua_objlen ( L, - 1 ), j ; # else size_t len = lua_rawlen ( L, - 1 ), j ; # endif mp_encode_array ( L, buf, len ) ; <START_BUG> for ( j = 1 ; j <= len ; j ++ ) { <END_BUG> lua_pushnumber ( L, j ) ; lua_gettable ( L, - 2 ) ; mp_encode_lua_type ( L, buf, level + 1 ) ; } }

Fix:
<S2SV_ModStart> len ) ; luaL_checkstack ( L, 1, "in <S2SV_blank> function <S2SV_blank> mp_encode_lua_table_as_array" ) ;
Buggy code:
 <START_BUG> void vp9_inc_frame_in_layer ( SVC * svc ) { <END_BUG>  LAYER_CONTEXT * const lc = ( svc -> number_temporal_layers > 1 ) <START_BUG>? & svc -> layer_context [ svc -> temporal_layer_id ] : & svc -> layer_context [ svc -> spatial_layer_id ] ; ++ lc -> current_video_frame_in_layer ; <END_BUG> } 

Fix:
<S2SV_ModStart> void vp9_inc_frame_in_layer ( VP9_COMP * const cpi <S2SV_ModEnd> ) { LAYER_CONTEXT <S2SV_ModStart> const lc = & cpi -> svc. layer_context [ cpi -> svc. spatial_layer_id * cpi -> svc. number_temporal_layers <S2SV_ModEnd> ] ; ++ <S2SV_ModStart> -> current_video_frame_in_layer ; ++ lc -> frames_from_key_frame ;
Buggy code:
 static int cg_getattr ( const char * path, struct stat * sb ) { struct timespec now ; struct fuse_context * fc = fuse_get_context ( ) ; char * cgdir = NULL ; char * fpath = NULL, * path1, * path2 ; struct cgfs_files * k = NULL ; const char * cgroup ; const char * controller = NULL ; int ret = - ENOENT ; if (! fc ) return - EIO ; memset ( sb, 0, sizeof ( struct stat ) ) ; if ( clock_gettime ( CLOCK_REALTIME, & now ) < 0 ) return - EINVAL ; sb -> st_uid = sb -> st_gid = 0 ; sb -> st_atim = sb -> st_mtim = sb -> st_ctim = now ; sb -> st_size = 0 ; if ( strcmp ( path, "//cgroup" ) == 0 ) { sb -> st_mode = S_IFDIR | 00755 ; sb -> st_nlink = 2 ; return 0 ; } controller = pick_controller_from_path ( fc, path ) ; if (! controller ) return - EIO ; cgroup = find_cgroup_in_path ( path ) ; if (! cgroup ) { sb -> st_mode = S_IFDIR | 00755 ; sb -> st_nlink = 2 ; return 0 ; } get_cgdir_and_path ( cgroup, & cgdir, & fpath ) ; if (! fpath ) { path1 = "//" ; path2 = cgdir ; } else { path1 = cgdir ; path2 = fpath ; } if ( is_child_cgroup ( controller, path1, path2 ) ) { <START_BUG> if (! caller_is_in_ancestor ( fc -> pid, controller, cgroup, NULL ) ) { <END_BUG> sb -> st_mode = S_IFDIR | 00555 ; sb -> st_nlink = 2 ; ret = 0 ; goto out ; } if (! fc_may_access ( fc, controller, cgroup, NULL, O_RDONLY ) ) { ret = - EACCES ; goto out ; } sb -> st_mode = S_IFDIR | 00755 ; k = cgfs_get_key ( controller, cgroup, "tasks" ) ; if (! k ) { sb -> st_uid = sb -> st

Fix:
<S2SV_ModStart> if (! caller_may_see_dir ( fc -> pid, controller, cgroup ) ) { ret = - ENOENT ; goto out ; } if (!
Buggy code:
 <START_BUG> static int write_skip ( const VP9_COMP * cpi, int segment_id, const MODE_INFO * mi, <END_BUG>  vp9_writer * w ) { <START_BUG> <END_BUG> const MACROBLOCKD * const xd = & cpi -> mb. e_mbd ;  if ( vp9_segfeature_active ( & cpi -> common. seg, segment_id, SEG_LVL_SKIP ) ) { return 1 ; } else { const int skip = mi -> mbmi. skip ; <START_BUG> vp9_write ( w, skip, vp9_get_skip_prob ( & cpi -> common, xd ) ) ; <END_BUG> return skip ; } }

Fix:
<S2SV_ModStart> write_skip ( const VP9_COMMON * cm, const MACROBLOCKD * xd, <S2SV_ModEnd> int segment_id, <S2SV_ModStart> * mi, vpx_writer <S2SV_ModEnd> * w ) <S2SV_ModStart> w ) { if ( segfeature_active ( & cm -> <S2SV_ModEnd> seg, segment_id <S2SV_ModStart>. skip ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart>, vp9_get_skip_prob ( cm <S2SV_ModEnd>, xd )
Buggy code:
 static MagickBooleanType DecodeImage ( Image * image, unsigned char * luma, unsigned char * chroma1, unsigned char * chroma2, ExceptionInfo * exception ) { # define IsSync ( sum ) ( ( sum & 0xffffff00UL ) == 0xfffffe00UL ) <START_BUG> # define PCDGetBits ( n ) { sum = ( sum << n ) & 0xffffffff ; bits -= n ; while ( bits <= 24 ) { if ( p >= ( buffer + 0x800 ) ) { count = ReadBlob ( image, 0x800, buffer ) ; p = buffer ; } sum |= ( ( unsigned int ) ( * p ) << ( 24 - bits ) ) ; bits += 8 ; p ++ ; } } <END_BUG> typedef struct PCDTable { unsigned int length, sequence ; MagickStatusType mask ; unsigned char key ; } PCDTable ; PCDTable * pcd_table [ 3 ] ; register ssize_t i, j ; register PCDTable * r ; register unsigned char * p, * q ; size_t bits, length, plane, pcd_length [ 3 ], row, sum ; ssize_t count, quantum ; unsigned char * buffer ; assert ( image!= ( const Image * ) NULL ) ; assert ( image -> signature == MagickCoreSignature ) ; if ( image -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image -> filename ) ; assert ( luma!= ( unsigned char * ) NULL ) ; assert ( chroma1!= ( unsigned char * ) NULL ) ; assert ( chroma2!= ( unsigned char * ) NULL ) ; buffer = ( unsigned char * ) AcquireQuantumMemory ( 0x800, sizeof ( * buffer ) ) ; if ( buffer == ( unsigned char * ) NULL ) ThrowBinaryException ( ResourceLimitError, "MemoryAllocationFailed", image -> filename ) ; sum = 0 ; bits = 32 ; p = buffer + 0x800 ; for ( i = 0 ; i < 3 ; i ++ ) { pcd_table [ i ] = ( PCDTable * ) NULL ; pcd_length [ i ] = 0 ; } for ( i = 0 ; i < ( image -> columns > 1536? 3 : 1 ) ; i ++ ) { PCDGetBits ( 8 ) ; length = (

Fix:
<S2SV_ModStart> ( n ) \\\n{ <S2SV_ModEnd> sum = ( <S2SV_ModStart> ++ ; } \\\n} <S2SV_ModEnd> typedef struct PCDTable <S2SV_ModStart> buffer ) ; for ( j = 0 ; j < i ; j ++ ) pcd_table [ j ] = ( PCDTable * ) RelinquishMagickMemory ( pcd_table [ j ] ) ; <S2SV_ModStart> RelinquishMagickMemory ( buffer ) ; for ( j = 0 ; j <= i ; j ++ ) pcd_table [ j ] = ( PCDTable * ) RelinquishMagickMemory ( pcd_table [ j ]