nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static SvcInternal * get_svc_internal ( SvcContext * svc_ctx ) { <END_BUG> if ( svc_ctx == NULL ) return NULL ; if ( svc_ctx -> internal == NULL ) {  SvcInternal * const si = ( SvcInternal * ) malloc ( sizeof ( * si ) ) ; <START_BUG> if ( si!= NULL ) { memset ( si, 0, sizeof ( * si ) ) ; } svc_ctx -> internal = si ; } <END_BUG> return ( SvcInternal * ) svc_ctx -> internal ;  }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static SvcInternal_t <S2SV_ModEnd> * get_svc_internal ( <S2SV_ModStart> NULL ) { SvcInternal_t <S2SV_ModEnd> * const si <S2SV_ModStart> si = ( SvcInternal_t <S2SV_ModEnd> * ) malloc <S2SV_ModStart> } return ( SvcInternal_t <S2SV_ModEnd> * ) svc_ctx
Buggy code:
 static int <START_BUG> validate_event ( struct pmu_hw_events * hw_events, <END_BUG> struct perf_event * event ) {  struct arm_pmu * armpmu = to_arm_pmu ( event -> pmu ) ; <START_BUG> struct hw_perf_event fake_event = event -> hw ; struct pmu * leader_pmu = event -> group_leader -> pmu ; if ( is_software_event ( event ) ) return 1 ; <END_BUG> if ( event -> pmu!= leader_pmu || event -> state < PERF_EVENT_STATE_OFF )  return 1 ; if ( event -> state == PERF_EVENT_STATE_OFF &&! event -> attr. enable_on_exec ) return 1 ; <START_BUG> return armpmu -> get_event_idx ( hw_events, & fake_event ) >= 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> int validate_event ( struct pmu * pmu, <S2SV_ModStart> arm_pmu * armpmu <S2SV_ModEnd> ; struct hw_perf_event <S2SV_ModStart> -> pmu!= pmu ) return 0 ; if ( event -> pmu!= <S2SV_ModStart> return 1 ; armpmu = to_arm_pmu ( event -> pmu ) ;
Buggy code:
 <START_BUG> jas_matrix_t * jas_matrix_create ( int numrows, int numcols ) <END_BUG> { jas_matrix_t * matrix ;  int i ; <START_BUG> size_t size ; matrix = 0 ; if ( numrows < 0 || numcols < 0 ) { goto error ; } if (! ( matrix = jas_malloc ( sizeof ( jas_matrix_t ) ) ) ) { goto error ; } matrix -> flags_ = 0 ; matrix -> numrows_ = numrows ; matrix -> numcols_ = numcols ; matrix -> rows_ = 0 ; matrix -> maxrows_ = numrows ; matrix -> data_ = 0 ; matrix -> datasize_ = 0 ; if (! jas_safe_size_mul ( numrows, numcols, & size ) ) { goto error ; } matrix -> datasize_ = size ; if ( matrix -> maxrows_ > 0 ) { if (! ( matrix -> rows_ = jas_alloc2 ( matrix -> maxrows_, sizeof ( jas_seqent_t * ) ) ) ) { goto error ; } } if ( matrix -> datasize_ > 0 ) { if (! ( matrix -> data_ = jas_alloc2 ( matrix -> datasize_, sizeof ( jas_seqent_t ) ) ) ) { goto error ; } } for ( i = 0 ; i < numrows ; ++ i ) { matrix -> rows_ [ i ] = & matrix -> data_ [ i * matrix -> numcols_ ] ; } for ( i = 0 ; i < matrix -> datasize_ ; ++ i ) { matrix -> data_ [ i ] = 0 ; } matrix -> xstart_ = 0 ; matrix -> ystart_ = 0 ; matrix -> xend_ = matrix -> numcols_ ; matrix -> yend_ = matrix -> numrows_ ; return matrix ; error : if ( matrix ) { jas_matrix_destroy ( matrix ) ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> * jas_matrix_create ( jas_matind_t numrows, jas_matind_t <S2SV_ModEnd> numcols ) { <S2SV_ModStart> * matrix ; jas_matind_t <S2SV_ModEnd> i ; size_t
Buggy code:
 static void listdir ( unsigned int depth, int f, void * const tls_fd, const char * name ) { PureFileInfo * dir ; char * names ; PureFileInfo * s ; <START_BUG> PureFileInfo * r ; <END_BUG> int d ; if ( depth >= max_ls_depth || matches >= max_ls_files ) { return ; } if ( ( dir = sreaddir ( & names ) ) == NULL ) { addreply ( 226, MSG_CANT_READ_FILE, name ) ; return ; } s = dir ; while ( s -> name_offset!= ( size_t ) - 1 ) { d = 0 ; if ( FI_NAME ( s ) [ 0 ]!= '.' ) { d = listfile ( s, NULL ) ; } else if ( opt_a ) { if ( FI_NAME ( s ) [ 1 ] == 0 || ( FI_NAME ( s ) [ 1 ] == '.' && FI_NAME ( s ) [ 2 ] == 0 ) ) { listfile ( s, NULL ) ; } else { d = listfile ( s, NULL ) ; } } if (! d ) { s -> name_offset = ( size_t ) - 1 ; } s ++ ; } outputfiles ( f, tls_fd ) ; r = dir ;  while ( opt_R && r!= s ) { <START_BUG> if ( r -> name_offset!= ( size_t ) - 1 &&! chdir ( FI_NAME ( r ) ) ) { <END_BUG> char * alloca_subdir ;  const size_t sizeof_subdir = PATH_MAX + 1U ; if ( ( alloca_subdir = ALLOCA ( sizeof_subdir ) ) == NULL ) { goto toomany ; } if ( SNCHECK ( snprintf ( alloca_subdir, sizeof_subdir, "%s//%s", name, FI_NAME ( r ) ), sizeof_subdir ) ) { goto nolist ; } wrstr ( f, tls_fd, "\\r\\n\\r\\n" ) ; wrstr ( f, tls_fd, alloca_subdir ) ; wrstr ( f, tls_fd, ":\\r\\n\\r\\n" ) ; listdir ( depth + 1U, f, tls_fd, alloca_subdir ) ; nolist : <START_BUG> ALLOCA_FREE ( alloca_subdir )<END_BUG>

Fix:
<S2SV_ModStart> PureFileInfo * r ; char * alloca_subdir ; size_t sizeof_subdir <S2SV_ModStart> = dir ; sizeof_subdir = PATH_MAX + 1U ; if ( ( alloca_subdir = ALLOCA ( sizeof_subdir ) ) == NULL ) { goto toomany ; } <S2SV_ModStart> ) ) { <S2SV_ModEnd> if ( SNCHECK <S2SV_ModStart> ; nolist : <S2SV_ModEnd> if ( matches <S2SV_ModStart> } toomany : ALLOCA_FREE ( alloca_subdir ) ;
Buggy code:
 static Image * ReadCUTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * palette ; ImageInfo * clone_info ; MagickBooleanType status ; MagickOffsetType offset ; size_t EncodedByte ; unsigned char RunCount, RunValue, RunCountMasked ; CUTHeader Header ; CUTPalHeader PalHeader ; ssize_t depth ; ssize_t i, j ; ssize_t ldblk ; unsigned char * BImgBuff = NULL, * ptrB ; PixelPacket * q ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } palette = NULL ; clone_info = NULL ; Header. Width = ReadBlobLSBShort ( image ) ; Header. Height = ReadBlobLSBShort ( image ) ; Header. Reserved = ReadBlobLSBShort ( image ) ; if ( Header. Width == 0 || Header. Height == 0 || Header. Reserved!= 0 ) CUT_KO : ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; EncodedByte = ReadBlobLSBShort ( image ) ; RunCount = ( unsigned char ) ReadBlobByte ( image ) ; RunCountMasked = RunCount & 0x7F ; ldblk = 0 ; while ( ( int ) RunCountMasked!= 0 ) { i = 1 ; if ( ( int ) RunCount < 0x80 ) i = ( ssize_t ) RunCountMasked ; offset = SeekBlob ( image, TellBlob ( image ) + i, SEEK_SET ) ; if ( offset < 0 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( EOFBlob ( image )!= MagickFalse ) goto C

Fix:
<S2SV_ModStart> image_info -> ping!= MagickFalse <S2SV_ModStart> goto Finish ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 error_t httpClientSetMethod ( HttpClientContext * context, const char_t * method ) { size_t m ; size_t n ; char_t * p ; if ( context == NULL || method == NULL ) return ERROR_INVALID_PARAMETER ; n = osStrlen ( method ) ; if ( n == 0 || n > HTTP_CLIENT_MAX_METHOD_LEN ) return ERROR_INVALID_LENGTH ; if ( context -> bufferLen > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_INVALID_SYNTAX ; context -> buffer [ context -> bufferLen ] = '\\0' ; <START_BUG> p = strchr ( context -> buffer,' ') ; <END_BUG> if ( p == NULL ) return ERROR_INVALID_SYNTAX ; m = p - context -> buffer ; if ( ( context -> bufferLen + n - m ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; osMemmove ( context -> buffer + n, p, context -> bufferLen + 1 - m ) ; osStrncpy ( context -> buffer, method, n ) ; context -> bufferLen = context -> bufferLen + n - m ; osStrcpy ( context -> method, method ) ; return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; p = osStrchr <S2SV_ModEnd> ( context ->
Buggy code:
 static int do_tkill ( pid_t tgid, pid_t pid, int sig ) { <START_BUG> struct siginfo info ; <END_BUG> info. si_signo = sig ; info. si_errno = 0 ; info. si_code = SI_TKILL ; info. si_pid = task_tgid_vnr ( current ) ; info. si_uid = from_kuid_munged ( current_user_ns ( ), current_uid ( ) ) ; return do_send_specific ( tgid, pid, sig, & info ) ; }

Fix:
<S2SV_ModStart> struct siginfo info = { }
Buggy code:
 static int ceph_x_proc_ticket_reply ( struct ceph_auth_client * ac, struct ceph_crypto_key * secret, void * buf, void * end ) { void * p = buf ; <START_BUG> char * dbuf ; <END_BUG> char * ticket_buf ; u8 reply_struct_v ; u32 num ;  int ret ; <START_BUG> dbuf = kmalloc ( TEMP_TICKET_BUF_LEN, GFP_NOFS ) ; if (! dbuf ) return - ENOMEM ; ret = - ENOMEM ; ticket_buf = kmalloc ( TEMP_TICKET_BUF_LEN, GFP_NOFS ) ; if (! ticket_buf ) goto out_dbuf ; ceph_decode_8_safe ( & p, end, reply_struct_v, bad ) ; if ( reply_struct_v!= 1 ) return - EINVAL ; ceph_decode_32_safe ( & p, end, num, bad ) ; dout ( "%d   tickets\\n", num ) ; while ( num -- ) { <END_BUG> ret = process_one_ticket ( ac, secret, & p, end,  dbuf, ticket_buf ) ; if ( ret ) <START_BUG> goto out ; <END_BUG> } ret = 0 ; out : kfree ( ticket_buf ) ; out_dbuf : kfree ( dbuf ) ; return ret ; bad :  ret = - EINVAL ; <START_BUG> <END_BUG> goto out ;  }

Fix:
<S2SV_ModStart> = buf ; <S2SV_ModEnd> u8 reply_struct_v ; <S2SV_ModStart> ; int ret <S2SV_ModEnd> ; ceph_decode_8_safe ( <S2SV_ModStart> p, end <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( ret ) return ret ; } return 0 <S2SV_ModEnd> ; bad : <S2SV_ModStart> ; bad : return <S2SV_ModEnd> - EINVAL ; <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; image2 = ( Image * ) NULL ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } quantum_info = ( QuantumInfo * ) NULL ; clone_info = ( ImageInfo * ) NULL ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image = ReadMATImageV4 ( image_info, image, exception ) ; if ( image == NULL ) { if ( ( image!= image2 ) && ( image2!= (

Fix:
<S2SV_ModStart> ; while ( filepos < GetBlobSize ( image ) && <S2SV_ModStart> if ( filepos > GetBlobSize ( image ) || filepos < 0 <S2SV_ModEnd> ) break ; <S2SV_ModStart> + filepos ) >= <S2SV_ModEnd> GetBlobSize ( image <S2SV_ModStart> - 1 ) ) ; ThrowReaderException ( CorruptImageError, "UnexpectedEndOfFile"
Buggy code:
 static int replace_map_fd_with_map_ptr ( struct verifier_env * env ) { struct bpf_insn * insn = env -> prog -> insnsi ; int insn_cnt = env -> prog -> len ; int i, j ; for ( i = 0 ; i < insn_cnt ; i ++, insn ++ ) { if ( BPF_CLASS ( insn -> code ) == BPF_LDX && ( BPF_MODE ( insn -> code )!= BPF_MEM || insn -> imm!= 0 ) ) { verbose ( "BPF_LDX   uses   reserved   fields\\n" ) ; return - EINVAL ; } if ( BPF_CLASS ( insn -> code ) == BPF_STX && ( ( BPF_MODE ( insn -> code )!= BPF_MEM && BPF_MODE ( insn -> code )!= BPF_XADD ) || insn -> imm!= 0 ) ) { verbose ( "BPF_STX   uses   reserved   fields\\n" ) ; return - EINVAL ; } if ( insn [ 0 ]. code == ( BPF_LD | BPF_IMM | BPF_DW ) ) { struct bpf_map * map ; struct fd f ; if ( i == insn_cnt - 1 || insn [ 1 ]. code!= 0 || insn [ 1 ]. dst_reg!= 0 || insn [ 1 ]. src_reg!= 0 || insn [ 1 ]. off!= 0 ) { verbose ( "invalid   bpf_ld_imm64   insn\\n" ) ; return - EINVAL ; } if ( insn -> src_reg == 0 ) goto next_insn ; if ( insn -> src_reg!= BPF_PSEUDO_MAP_FD ) { verbose ( "unrecognized   bpf_ld_imm64   insn\\n" ) ; return - EINVAL ; } f = fdget ( insn -> imm ) ; map = __bpf_map_get ( f ) ; if ( IS_ERR ( map ) ) { verbose ( "fd   %d   is   not   pointing   to   valid   bpf_map\\n", insn -> imm ) ; <START_BUG> fdput ( f ) ; <END_BUG> return PTR_ERR ( map ) ; } insn [ 0 ].

Fix:
<S2SV_ModStart> imm ) ; <S2SV_ModEnd> return PTR_ERR (
Buggy code:
 int xfs_attr3_leaf_lookup_int ( struct xfs_buf * bp, struct xfs_da_args * args ) { struct xfs_attr_leafblock * leaf ; struct xfs_attr3_icleaf_hdr ichdr ; struct xfs_attr_leaf_entry * entry ; struct xfs_attr_leaf_entry * entries ; struct xfs_attr_leaf_name_local * name_loc ; struct xfs_attr_leaf_name_remote * name_rmt ; xfs_dahash_t hashval ; int probe ; int span ; trace_xfs_attr_leaf_lookup ( args ) ; leaf = bp -> b_addr ; xfs_attr3_leaf_hdr_from_disk ( & ichdr, leaf ) ; entries = xfs_attr3_leaf_entryp ( leaf ) ; ASSERT ( ichdr. count < XFS_LBSIZE ( args -> dp -> i_mount ) // 8 ) ; hashval = args -> hashval ; probe = span = ichdr. count // 2 ; for ( entry = & entries [ probe ] ; span > 4 ; entry = & entries [ probe ] ) { span //= 2 ; if ( be32_to_cpu ( entry -> hashval ) < hashval ) probe += span ; else if ( be32_to_cpu ( entry -> hashval ) > hashval ) probe -= span ; else break ; } ASSERT ( probe >= 0 && (! ichdr. count || probe < ichdr. count ) ) ; ASSERT ( span <= 4 || be32_to_cpu ( entry -> hashval ) == hashval ) ; while ( probe > 0 && be32_to_cpu ( entry -> hashval ) >= hashval ) { entry -- ; probe -- ; } while ( probe < ichdr. count && be32_to_cpu ( entry -> hashval ) < hashval ) { entry ++ ; probe ++ ; } if ( probe == ichdr. count || be32_to_cpu ( entry -> hashval )!= hashval ) { args -> index = probe ; return XFS_ERROR ( ENOATTR ) ; } for ( ; probe < ichdr. count && ( be32_to_cpu ( entry -> hashval ) == hashval ) ; entry ++, probe ++ )

Fix:
<S2SV_ModStart> ; args -> rmtvaluelen = be32_to_cpu ( name_rmt -> valuelen ) ; args -> rmtblkno <S2SV_ModEnd> = be32_to_cpu ( <S2SV_ModStart> ( name_rmt -> <S2SV_ModEnd> valueblk ) ; <S2SV_ModStart>, args -> rmtvaluelen <S2SV_ModEnd> ) ; return
Buggy code:
 vpx_codec_err_t vpx_codec_get_stream_info ( vpx_codec_ctx_t * ctx, vpx_codec_stream_info_t * si ) { vpx_codec_err_t res ; if (! ctx ||! si || si -> sz < sizeof ( vpx_codec_stream_info_t ) ) res = VPX_CODEC_INVALID_PARAM ; else if (! ctx -> iface ||! ctx -> priv ) res = VPX_CODEC_ERROR ; else { si -> w = 0 ; si -> h = 0 ; <START_BUG> res = ctx -> iface -> dec. get_si ( ctx -> priv -> alg_priv, si ) ; <END_BUG> } return SAVE_STATUS ( ctx, res ) ; }

Fix:
<S2SV_ModStart>. get_si ( get_alg_priv ( ctx ) <S2SV_ModEnd>, si )
Buggy code:
 static unsigned create_oops_dump_dirs ( GList * oops_list, unsigned oops_cnt ) { unsigned countdown = MAX_DUMPED_DD_COUNT ; log_notice ( "Saving   %u   oopses   as   problem   dirs", oops_cnt >= countdown? countdown : oops_cnt ) ; char * cmdline_str = xmalloc_fopen_fgetline_fclose ( "//proc//cmdline" ) ; char * fips_enabled = xmalloc_fopen_fgetline_fclose ( "//proc//sys//crypto//fips_enabled" ) ; char * proc_modules = xmalloc_open_read_close ( "//proc//modules", NULL ) ; char * suspend_stats = xmalloc_open_read_close ( "//sys//kernel//debug//suspend_stats", NULL ) ; time_t t = time ( NULL ) ; const char * iso_date = iso_date_string ( & t ) ; uid_t my_euid = ( uid_t ) - 1L ; mode_t mode = DEFAULT_DUMP_DIR_MODE | S_IROTH ; if (! world_readable_dump ) { mode = DEFAULT_DUMP_DIR_MODE ; my_euid = geteuid ( ) ; } <START_BUG> pid_t my_pid = getpid ( ) ; <END_BUG> unsigned idx = 0 ; unsigned errors = 0 ; while ( idx < oops_cnt ) { char base [ sizeof ( "oops-YYYY-MM-DD-hh:mm:ss-%lu-%lu" ) + 2 * sizeof ( long ) * 3 ] ; sprintf ( base, "oops-%s-%lu-%lu", iso_date, ( long ) my_pid, ( long ) idx ) ; char * path = concat_path_file ( debug_dumps_dir, base ) ; struct dump_dir * dd = dd_create ( path, my_euid, mode ) ; if ( dd ) { dd_create_basic_files ( dd, my_euid, NULL ) ; save_oops_data_in_dump_dir ( dd, ( char * ) g_list_nth_data ( oops_list, idx ++ ), proc_modules ) ; dd_save_text (

Fix:
<S2SV_ModStart> ) ; } if ( g_settings_privatereports ) { if ( world_readable_dump ) log ( "Not <S2SV_blank> going <S2SV_blank> to <S2SV_blank> make <S2SV_blank> dump <S2SV_blank> directories <S2SV_blank> world <S2SV_blank> readable <S2SV_blank> because <S2SV_blank> PrivateReports <S2SV_blank> is <S2SV_blank> on" ) ; mode = DEFAULT_DUMP_DIR_MODE ; my_euid = 0 ; }
Buggy code:
 PHP_FUNCTION ( imagecrop ) { zval * IM ; gdImagePtr im ; gdImagePtr im_crop ; gdRect rect ; zval * z_rect ; zval * * tmp ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "ra", & IM, & z_rect ) == FAILURE ) { return ; } ZEND_FETCH_RESOURCE ( im, gdImagePtr, & IM, - 1, "Image", le_gd ) ; if ( zend_hash_find ( HASH_OF ( z_rect ), "x", sizeof ( "x" ), ( void * * ) & tmp )!= FAILURE ) { <START_BUG> rect. x = Z_LVAL_PP ( tmp ) ; <END_BUG> } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Missing   x   position" ) ; RETURN_FALSE ; } if ( zend_hash_find ( HASH_OF ( z_rect ), "y", sizeof ( "x" ), ( void * * ) & tmp )!= FAILURE ) {  rect. y = Z_LVAL_PP ( tmp ) ; <START_BUG> } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Missing   y   position" ) ; RETURN_FALSE ; } if ( zend_hash_find ( HASH_OF ( z_rect ), "width", sizeof ( "width" ), ( void * * ) & tmp )!= FAILURE ) { <END_BUG> rect. width = Z_LVAL_PP ( tmp ) ;  } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Missing   width" ) ; RETURN_FALSE ; } if ( zend_hash_find ( HASH_OF ( z_rect ), "height", sizeof ( "height" ), ( void * * ) & tmp )!= FAILURE ) { <START_BUG> rect. height = Z_LVAL_PP ( tmp ) ; <END_BUG> } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Missing   height" ) ; RETURN_FALSE ; } im_crop = gdImageCrop ( im, & rect ) ; if ( im_crop == NULL ) { RETURN_FALSE ; } else {

Fix:
<S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_LONG ) { zval lval ; lval = * * tmp ; zval_copy_ctor ( & lval ) ; convert_to_long ( & lval ) ; <S2SV_ModStart>. x = Z_LVAL ( lval ) ; } else { rect. x = <S2SV_ModStart> tmp ) ; } <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_LONG ) { zval lval ; lval = * * tmp ; zval_copy_ctor ( & lval ) ; convert_to_long ( & lval ) ; <S2SV_ModStart>. y = Z_LVAL ( lval ) ; } else { rect. y = <S2SV_ModStart> tmp ) ; } <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_LONG ) { zval lval ; lval = * * tmp ; zval_copy_ctor ( & lval ) ; convert_to_long ( & lval ) ; <S2SV_ModStart>. width = Z_LVAL ( lval ) ; } else { rect. width = <S2SV_ModStart> tmp ) ; } <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )
Buggy code:
 void MSG_WriteBits ( msg_t * msg, int value, int bits ) { int i ; oldsize += bits ; <START_BUG> if ( msg -> maxsize - msg -> cursize < 4 ) { <END_BUG> msg -> overflowed = qtrue ; return ; } if ( bits == 0 || bits < - 31 || bits > 32 ) { Com_Error ( ERR_DROP, "MSG_WriteBits:   bad   bits   %i", bits ) ; } if ( bits < 0 ) { bits = - bits ; } if ( msg -> oob ) {  if ( bits == 8 ) { <START_BUG> msg -> data [ msg -> cursize ] = value ; msg -> cursize += 1 ; msg -> bit += 8 ; } else if ( bits == 16 ) { short temp = value ; CopyLittleShort ( & msg -> data [ msg -> cursize ], & temp ) ; msg -> cursize += 2 ; msg -> bit += 16 ; } else if ( bits == 32 ) { CopyLittleLong ( & msg -> data [ msg -> cursize ], & value ) ; msg -> cursize += 4 ; msg -> bit += 32 ; } else { Com_Error ( ERR_DROP, "can\'t   write   %d   bits", bits ) ; } } else { value &= ( 0xffffffff >> ( 32 - bits ) ) ; if ( bits & 7 ) { int nbits ; <END_BUG> nbits = bits & 7 ;  for ( i = 0 ; i < nbits ; i ++ ) { Huff_putBit ( ( value & 1 ), msg -> data, & msg -> bit ) ; value = ( value >> 1 ) ; } bits = bits - nbits ; } if ( bits ) { for ( i = 0 ; i < bits ; i += 8 ) { <START_BUG> Huff_offsetTransmit ( & msgHuff. compressor, ( value & 0xff ), msg -> data, & msg -> bit ) ; <END_BUG> value = ( value >> 8 ) ;  } <START_BUG> } msg -> cursize = ( msg -> bit >> 3 ) + 1 ; } }<END_BUG>

Fix:
<S2SV_ModStart> ( msg -> overflowed ) { <S2SV_ModEnd> return ; } <S2SV_ModStart> { if ( msg -> cursize + ( bits >> 3 ) > msg -> maxsize ) { msg -> overflowed = qtrue ; return ; } if ( <S2SV_ModStart> & 7 ; if ( msg -> bit + nbits > msg -> maxsize << 3 ) { msg -> overflowed = qtrue ; return ; } <S2SV_ModStart> msg -> bit, msg -> maxsize << 3 <S2SV_ModStart> 8 ) ; if ( msg -> bit > msg -> maxsize << 3 ) { msg -> overflowed = qtrue ; return ; }
Buggy code:
 PyObject * ast2obj_stmt ( void * _o ) { stmt_ty o = ( stmt_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { Py_RETURN_NONE ; } switch ( o -> kind ) { case FunctionDef_kind : result = PyType_GenericNew ( FunctionDef_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_identifier ( o -> v. FunctionDef. name ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_name, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_arguments ( o -> v. FunctionDef. args ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_args, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. FunctionDef. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. FunctionDef. decorator_list, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_decorator_list, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> v. FunctionDef. returns ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_returns, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <START_BUG> break ; <END_BUG> case AsyncFunctionDef_kind : result = PyType_GenericNew ( AsyncFunctionDef_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_identifier ( o -> v. AsyncFunctionDef. name ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_name, value ) == - 1

Fix:
<S2SV_ModStart> value ) ; value = ast2obj_string ( o -> v. FunctionDef. type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_comment, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <S2SV_ModStart> value ) ; value = ast2obj_string ( o -> v. AsyncFunctionDef. type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_comment, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <S2SV_ModStart> value ) ; value = ast2obj_string ( o -> v. Assign. type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_comment, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <S2SV_ModStart> value ) ; value = ast2obj_string ( o -> v. For. type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, &
Buggy code:
 sf_count_t psf_fwrite ( const void * ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE * psf ) { sf_count_t total = 0 ; <START_BUG> ssize_t count ; <END_BUG> if ( psf -> virtual_io ) return psf -> vio. write ( ptr, bytes * items, psf -> vio_user_data ) // bytes ; items *= bytes ; if ( items <= 0 ) return 0 ; while ( items > 0 ) { count = ( items > SENSIBLE_SIZE )? SENSIBLE_SIZE : items ; count = write ( psf -> file. filedes, ( ( const char * ) ptr ) + total, count ) ; if ( count == - 1 ) { if ( errno == EINTR ) continue ; psf_log_syserr ( psf, errno ) ; break ; } ; if ( count == 0 ) break ; total += count ; items -= count ; } ; if ( psf -> is_pipe ) psf -> pipeoffset += total ; return total // bytes ; }

Fix:
<S2SV_ModStart> ; ssize_t count ; if ( bytes == 0 || items == 0 ) return 0
Buggy code:
 static int decode_rt_routing_info ( netdissect_options * ndo, const u_char * pptr, char * buf, u_int buflen ) { uint8_t route_target [ 8 ] ; u_int plen ; <START_BUG> ND_TCHECK ( pptr [ 0 ] ) ; <END_BUG> plen = pptr [ 0 ] ; if ( 0 == plen ) { snprintf ( buf, buflen, "default   route   target" ) ; return 1 ; } if ( 32 > plen ) return - 1 ;  plen -= 32 ; <START_BUG> if ( 64 < plen ) return - 1 ; memset ( & route_target, 0, sizeof ( route_target ) ) ; <END_BUG> ND_TCHECK2 ( pptr [ 1 ], ( plen + 7 ) // 8 ) ;  <START_BUG> memcpy ( & route_target, & pptr [ 1 ], ( plen + 7 ) // 8 ) ; <END_BUG> if ( plen % 8 ) { ( ( u_char * ) & route_target ) [ ( plen + 7 ) // 8 - 1 ] &= ( ( 0xff00 >> ( plen % 8 ) ) & 0xff ) ; } snprintf ( buf, buflen, "origin   AS:   %s,   route   target   %s",  as_printf ( ndo, astostr, sizeof ( astostr ), EXTRACT_32BITS ( pptr + 1 ) ), <START_BUG> bgp_vpn_rd_print ( ndo, ( u_char * ) & route_target ) ) ; return 5 + ( plen + 7 ) // 8 ; trunc : return - 2 ; }<END_BUG>

Fix:
<S2SV_ModStart> u_int plen ; char asbuf [ sizeof ( astostr ) ] ; <S2SV_ModStart> - 1 ; ND_TCHECK_32BITS ( pptr + 1 ) ; as_printf ( ndo, asbuf, sizeof ( asbuf ), EXTRACT_32BITS ( pptr + 1 ) ) ; <S2SV_ModStart> ( pptr [ 5 <S2SV_ModEnd> ], ( <S2SV_ModStart> & pptr [ 5 <S2SV_ModEnd> ], ( <S2SV_ModStart>, "origin <S2SV_blank> AS: <S2SV_blank> %s, <S2SV_blank> route <S2SV_blank> target <S2SV_blank> %s", asbuf <S2SV_ModEnd>, bgp_vpn_rd_print (
Buggy code:
 <START_BUG> static int detect_flash ( const struct twopass_rc * twopass, int offset ) { <END_BUG>  FIRSTPASS_STATS next_frame ; <START_BUG> int flash_detected = 0 ; <END_BUG> if ( read_frame_stats ( twopass, & next_frame, offset )!= EOF ) {  <START_BUG> if ( next_frame. pcnt_second_ref > next_frame. pcnt_inter && <END_BUG>  next_frame. pcnt_second_ref >= 0.5 ) <START_BUG> flash_detected = 1 ; } return flash_detected ; }<END_BUG>

Fix:
<S2SV_ModStart> detect_flash ( const TWO_PASS <S2SV_ModEnd> * twopass, <S2SV_ModStart> offset ) { const FIRSTPASS_STATS * const next_frame = <S2SV_ModEnd> read_frame_stats ( twopass <S2SV_ModStart> ( twopass, offset ) ; return next_frame!= NULL && next_frame -> <S2SV_ModEnd> pcnt_second_ref > next_frame <S2SV_ModStart> pcnt_second_ref > next_frame -> <S2SV_ModEnd> pcnt_inter && next_frame <S2SV_ModStart> pcnt_inter && next_frame -> <S2SV_ModEnd> pcnt_second_ref >= 0.5 <S2SV_ModStart> pcnt_second_ref >= 0.5 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 <START_BUG> void vp9_rc_update_rate_correction_factors ( VP9_COMP * cpi, int damp_var ) { <END_BUG> const VP9_COMMON * const cm = & cpi -> common ; int correction_factor = 100 ; double rate_correction_factor = get_rate_correction_factor ( cpi ) ; double adjustment_limit ; int projected_size_based_on_q = 0 ;  vp9_clear_system_state ( ) ; <START_BUG> projected_size_based_on_q = estimate_bits_at_q ( cm -> frame_type, cm -> base_qindex, cm -> MBs, <END_BUG> rate_correction_factor ) ;  <START_BUG> if ( projected_size_based_on_q > 0 ) <END_BUG> correction_factor = ( 100 * cpi -> rc. projected_frame_size ) // projected_size_based_on_q ; switch ( damp_var ) { case 0 : adjustment_limit = 0.75 ; break ; case 1 : adjustment_limit = 0.375 ; break ; case 2 : default : adjustment_limit = 0.25 ; break ; } if ( correction_factor > 102 ) { correction_factor = ( int ) ( 100 + ( ( correction_factor - 100 ) * adjustment_limit ) ) ; rate_correction_factor = ( rate_correction_factor * correction_factor ) // 100 ; if ( rate_correction_factor > MAX_BPB_FACTOR ) rate_correction_factor = MAX_BPB_FACTOR ; } else if ( correction_factor < 99 ) { correction_factor = ( int ) ( 100 - ( ( 100 - correction_factor ) * adjustment_limit ) ) ; rate_correction_factor = ( rate_correction_factor * correction_factor ) // 100 ; if ( rate_correction_factor < MIN_BPB_FACTOR ) rate_correction_factor = MIN_BPB_FACTOR ; } set_rate_correction_factor ( cpi, rate_correction_factor ) ; }

Fix:
<S2SV_ModStart> VP9_COMP * cpi <S2SV_ModEnd> ) { const <S2SV_ModStart> = 0 ; if ( cpi -> rc. is_src_frame_alt_ref ) return ; vpx_clear_system_state ( ) ; if ( cpi -> oxcf. aq_mode == CYCLIC_REFRESH_AQ && cpi -> common. seg. enabled ) { projected_size_based_on_q = vp9_cyclic_refresh_estimate_bits_at_q ( cpi, rate_correction_factor ) ; } else { projected_size_based_on_q = vp9_estimate_bits_at_q ( cpi -> common. <S2SV_ModEnd> frame_type, cm <S2SV_ModStart> MBs, rate_correction_factor, cm -> bit_depth ) ; } <S2SV_ModEnd> if ( projected_size_based_on_q <S2SV_ModStart> ( projected_size_based_on_q > FRAME_OVERHEAD_BITS ) correction_factor = ( int ) ( ( 100 * ( int64_t ) cpi -> rc. projected_frame_size ) // projected_size_based_on_q ) ; adjustment_limit = 0.25 + 0.5 * MIN (
Buggy code:
 void vp9_adapt_mv_probs ( VP9_COMMON * cm, int allow_hp ) { int i, j ; <START_BUG> nmv_context * fc = & cm -> fc. nmvc ; <END_BUG> const nmv_context * pre_fc = & cm -> frame_contexts [ cm -> frame_context_idx ]. nmvc ; const nmv_context_counts * counts = & cm -> counts. mv ;  adapt_probs ( vp9_mv_joint_tree, pre_fc -> joints, counts -> joints, fc -> joints ) ; <START_BUG> for ( i = 0 ; i < 2 ; ++ i ) { nmv_component * comp = & fc -> comps [ i ] ; const nmv_component * pre_comp = & pre_fc -> comps [ i ] ; const nmv_component_counts * c = & counts -> comps [ i ] ; <END_BUG> comp -> sign = adapt_prob ( pre_comp -> sign, c -> sign ) ;  <START_BUG> adapt_probs ( vp9_mv_class_tree, pre_comp -> classes, c -> classes, <END_BUG> comp -> classes ) ;  adapt_probs ( vp9_mv_class0_tree, pre_comp -> class0, c -> class0, comp -> class0 ) ; <START_BUG> for ( j = 0 ; j < MV_OFFSET_BITS ; ++ j ) <END_BUG> comp -> bits [ j ] = adapt_prob ( pre_comp -> bits [ j ], c -> bits [ j ] ) ;  for ( j = 0 ; j < CLASS0_SIZE ; ++ j ) <START_BUG> adapt_probs ( vp9_mv_fp_tree, pre_comp -> class0_fp [ j ], c -> class0_fp [ j ], <END_BUG> comp -> class0_fp [ j ] ) ;  adapt_probs ( vp9_mv_fp_tree, pre_comp -> fp, c -> fp, comp -> fp ) ; <START_BUG> if ( allow_hp ) { <END_BUG> comp -> class0_hp = adapt_prob ( pre_comp -> class0_hp, c -> class0_hp ) ;  <START_BUG> comp -> hp = adapt_prob ( pre_comp -> hp, c -> hp ) ; <END_BUG> } } }

Fix:
<S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> nmvc ; const <S2SV_ModStart>. mv ; vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_mv_joint_tree, <S2SV_ModStart> -> sign = mode_mv_merge_probs <S2SV_ModEnd> ( pre_comp -> <S2SV_ModStart> sign ) ; vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_mv_class_tree, <S2SV_ModStart> classes ) ; vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_mv_class0_tree, <S2SV_ModStart> j ] = mode_mv_merge_probs <S2SV_ModEnd> ( pre_comp -> <S2SV_ModStart> ++ j ) vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_mv_fp_tree, <S2SV_ModStart> ] ) ; vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_mv_fp_tree, <S2SV_ModStart> -> class0_hp = mode_mv_merge_probs <S2SV_ModEnd> ( pre_comp -> <S2SV_ModStart> -> hp = mode_mv_merge_probs <S2SV_ModEnd> ( pre_comp ->
Buggy code:
 <START_BUG> void jas_seq2d_bindsub ( jas_matrix_t * s, jas_matrix_t * s1, int xstart, <END_BUG> int ystart, int xend, int yend ) { jas_matrix_bindsub ( s, s1, ystart - s1 -> ystart_, xstart - s1 -> xstart_, yend - s1 -> ystart_ - 1, xend - s1 -> xstart_ - 1 ) ; }

Fix:
<S2SV_ModStart> * s1, jas_matind_t xstart, jas_matind_t ystart, jas_matind_t xend, jas_matind_t <S2SV_ModEnd> yend ) {
Buggy code:
 LPSTR tr_esc_str ( LPCSTR arg, bool format ) { <START_BUG> LPSTR tmp = NULL ; <END_BUG> size_t cs = 0, x, ds, len ; size_t s ; if ( NULL == arg ) return NULL ; s = strlen ( arg ) ; while ( ( s > 0 ) && isspace ( arg [ s - 1 ] ) ) s -- ; ds = s + 1 ; if ( s )  tmp = ( LPSTR ) realloc ( tmp, ds * sizeof ( CHAR ) ) ; <START_BUG> if ( NULL == tmp ) { fprintf ( stderr, "Could   not   allocate   string   buffer.\\n" ) ; exit ( - 2 ) ; } memset ( tmp, 0, ds * sizeof ( CHAR ) ) ; for ( x = 0 ; x < s ; x ++ ) { switch ( arg [ x ] ) { case '<' : len = format? 13 : 4 ; ds += len - 1 ; <END_BUG> tmp = ( LPSTR ) realloc ( tmp, ds * sizeof ( CHAR ) ) ;  if ( NULL == tmp ) { fprintf ( stderr, "Could   not   reallocate   string   buffer.\\n" ) ; exit ( - 3 ) ; } if ( format ) strncpy ( & tmp [ cs ], "<replaceable>", len ) ; else strncpy ( & tmp [ cs ], "&lt;", len ) ; cs += len ; break ; case '>' : len = format? 14 : 4 ; ds += len - 1 ; <START_BUG> tmp = ( LPSTR ) realloc ( tmp, ds * sizeof ( CHAR ) ) ; <END_BUG> if ( NULL == tmp ) { fprintf ( stderr, "Could   not   reallocate   string   buffer.\\n" ) ; exit ( - 4 ) ; } if ( format ) strncpy ( & tmp [ cs ], "<//replaceable>", len ) ; else strncpy ( & tmp [ cs ], "&lt;", len ) ; cs += len ; break ; case '\\'' : ds += 5 ;  tmp = ( LPSTR ) realloc ( tmp, ds * sizeof ( CHAR ) ) ; <START_BUG> if ( NULL == tmp ) { fprintf ( stderr, "Could   not   reallocate   string   buffer.\\n" ) ; exit ( - 5 ) ; } tmp [ cs ++ ] = '&' ; tmp [ cs<END_BUG>

Fix:
<S2SV_ModStart> { LPSTR tmp = NULL ; LPSTR tmp2 <S2SV_ModStart> ( s ) { tmp2 <S2SV_ModEnd> = ( LPSTR <S2SV_ModStart> ) ) ; if (! tmp2 ) free ( tmp ) ; tmp = tmp2 ; } <S2SV_ModStart> - 1 ; tmp2 <S2SV_ModEnd> = ( LPSTR <S2SV_ModStart> CHAR ) ) ; if (! tmp2 ) free ( tmp ) ; tmp = tmp2 <S2SV_ModStart> - 1 ; tmp2 <S2SV_ModEnd> = ( LPSTR <S2SV_ModStart> CHAR ) ) ; if (! tmp2 ) free ( tmp ) ; tmp = tmp2 <S2SV_ModStart> += 5 ; tmp2 <S2SV_ModEnd> = ( LPSTR <S2SV_ModStart> CHAR ) ) ; if (! tmp2 ) free ( tmp ) ; tmp = tmp2 <S2SV_ModStart> += 5 ; tmp2 <S2SV_ModEnd> = ( LPSTR <S2SV_ModStart> CHAR ) ) ; if (! tmp2 ) free ( tmp ) ; tmp = tmp2 <S2SV_ModStart> += 4 ; tmp2 <S2SV_ModEnd> = ( LPSTR <S2SV_ModStart> ; if (! tmp2 ) free ( tmp ) ; tmp = tmp2 ; if (
Buggy code:
 static int follow_dotdot_rcu ( struct nameidata * nd ) { struct inode * inode = nd -> inode ; if (! nd -> root. mnt ) set_root_rcu ( nd ) ; while ( 1 ) { if ( path_equal ( & nd -> path, & nd -> root ) ) break ; if ( nd -> path. dentry!= nd -> path. mnt -> mnt_root ) { struct dentry * old = nd -> path. dentry ; struct dentry * parent = old -> d_parent ; unsigned seq ; inode = parent -> d_inode ; seq = read_seqcount_begin ( & parent -> d_seq ) ; if ( unlikely ( read_seqcount_retry ( & old -> d_seq, nd -> seq ) ) ) return - ECHILD ; nd -> path. dentry = parent ; nd -> seq = seq ; <START_BUG> break ; <END_BUG> } else { struct mount * mnt = real_mount ( nd -> path. mnt ) ; struct mount * mparent = mnt -> mnt_parent ; struct dentry * mountpoint = mnt -> mnt_mountpoint ; struct inode * inode2 = mountpoint -> d_inode ; unsigned seq = read_seqcount_begin ( & mountpoint -> d_seq ) ; if ( unlikely ( read_seqretry ( & mount_lock, nd -> m_seq ) ) ) return - ECHILD ; if ( & mparent -> mnt == nd -> path. mnt ) break ; nd -> path. dentry = mountpoint ; nd -> path. mnt = & mparent -> mnt ; inode = inode2 ; nd -> seq = seq ; } } while ( unlikely ( d_mountpoint ( nd -> path. dentry ) ) ) { struct mount * mounted ; mounted = __lookup_mnt ( nd -> path. mnt, nd -> path. dentry ) ; if ( unlikely ( read_seqretry ( & mount_lock, nd -> m_seq ) ) ) return - ECHILD ; if (! mounted ) break ; nd -> path. mnt = & mounted -> mnt ; nd -> path. dentry = mounted -> mnt. mnt_root ; inode = nd -> path. dentry -> d_inode ; nd -> seq = read_seqcount_begin ( & nd -> path. dentry -> d_seq ) ; }

Fix:
<S2SV_ModStart> = seq ; if ( unlikely (! path_connected ( & nd -> path ) ) ) return - ENOENT ;
Buggy code:
 bool layer_resize ( int layer, int x_size, int y_size ) { int old_height ; int old_width ; struct map_tile * tile ; int tile_width ; int tile_height ; struct map_tile * tilemap ; struct map_trigger * trigger ; struct map_zone * zone ; <START_BUG> int x, y, i ; <END_BUG> old_width = s_map -> layers [ layer ]. width ; old_height = s_map -> layers [ layer ]. height ;  if (! ( tilemap = malloc ( x_size * y_size * sizeof ( struct map_tile ) ) ) ) <START_BUG> return false ; for ( x = 0 ; x < x_size ; ++ x ) { for ( y = 0 ; y < y_size ; ++ y ) { if ( x < old_width && y < old_height ) { tilemap [ x + y * x_size ] = s_map -> layers [ layer ]. tilemap [ x + y * old_width ] ; } else { tile = & tilemap [ x + y * x_size ] ; tile -> frames_left = tileset_get_delay ( s_map -> tileset, 0 ) ; tile -> tile_index = 0 ; } } } free ( s_map -> layers [ layer ]. tilemap ) ; s_map -> layers [ layer ]. tilemap = tilemap ; s_map -> layers [ layer ]. width = x_size ; s_map -> layers [ layer ]. height = y_size ; tileset_get_size ( s_map -> tileset, & tile_width, & tile_height ) ; s_map -> width = 0 ; s_map -> height = 0 ; for ( i = 0 ; i < s_map -> num_layers ; ++ i ) { if (! s_map -> layers [ i ]. is_parallax ) { s_map -> width = fmax ( s_map -> width, s_map -> layers [ i ]. width * tile_width ) ; s_map -> height = fmax ( s_map -> height, s_map -> layers [ i ]. height * tile_height ) ; } } for ( i = ( int ) vector_len ( s_map -> zones ) - 1 ; i >= 0 ; -- i ) { zone =<END_BUG>

Fix:
<S2SV_ModStart> * zone ; size_t tilemap_size ; <S2SV_ModStart>. height ; tilemap_size = <S2SV_ModEnd> x_size * y_size <S2SV_ModStart> struct map_tile ) ; if ( x_size == 0 || tilemap_size // x_size // sizeof ( struct map_tile )!= y_size ||! ( tilemap = malloc ( tilemap_size
Buggy code:
 static int vmx_update_pi_irte ( struct kvm * kvm, unsigned int host_irq, uint32_t guest_irq, bool set ) { struct kvm_kernel_irq_routing_entry * e ; struct kvm_irq_routing_table * irq_rt ; struct kvm_lapic_irq irq ; struct kvm_vcpu * vcpu ; struct vcpu_data vcpu_info ; <START_BUG> int idx, ret = - EINVAL ; <END_BUG> if (! kvm_arch_has_assigned_device ( kvm ) ||! irq_remapping_cap ( IRQ_POSTING_CAP ) ||! kvm_vcpu_apicv_active ( kvm -> vcpus [ 0 ] ) ) return 0 ; idx = srcu_read_lock ( & kvm -> irq_srcu ) ; irq_rt = srcu_dereference ( kvm -> irq_routing, & kvm -> irq_srcu ) ;  BUG_ON ( guest_irq >= irq_rt -> nr_rt_entries ) ; <START_BUG> <END_BUG> hlist_for_each_entry ( e, & irq_rt -> map [ guest_irq ], link ) {  if ( e -> type!= KVM_IRQ_ROUTING_MSI ) continue ; kvm_set_msi_irq ( kvm, e, & irq ) ; if (! kvm_intr_is_single_vcpu ( kvm, & irq, & vcpu ) ) { ret = irq_set_vcpu_affinity ( host_irq, NULL ) ; if ( ret < 0 ) { printk ( KERN_INFO "failed   to   back   to   remapped   mode,   irq:   %u\\n", host_irq ) ; goto out ; } continue ; } vcpu_info. pi_desc_addr = __pa ( vcpu_to_pi_desc ( vcpu ) ) ; vcpu_info. vector = irq. vector ; trace_kvm_pi_irte_update ( vcpu -> vcpu_id, host_irq, e -> gsi, vcpu_info. vector, vcpu_info.

Fix:
<S2SV_ModStart>, ret = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> irq_srcu ) ; if <S2SV_ModEnd> ( guest_irq >= <S2SV_ModStart> irq_rt -> nr_rt_entries || hlist_empty ( <S2SV_ModEnd> & irq_rt -> <S2SV_ModStart> [ guest_irq ] ) ) { pr_warn_once ( "no <S2SV_blank> route <S2SV_blank> for <S2SV_blank> guest_irq <S2SV_blank> %u//%u <S2SV_blank> (broken <S2SV_blank> user <S2SV_blank> space?)\\n", guest_irq, irq_rt -> nr_rt_entries ) ; goto out ; } hlist_for_each_entry ( e, & irq_rt -> map [ guest_irq ]
Buggy code:
 static int parse_report ( transport_smart * transport, git_push * push ) { git_pkt * pkt = NULL ; const char * line_end = NULL ; gitno_buffer * buf = & transport -> buffer ; int error, recvd ; git_buf data_pkt_buf = GIT_BUF_INIT ; for ( ; ; ) { if ( buf -> offset > 0 ) error = git_pkt_parse_line ( & pkt, buf -> data, & line_end, buf -> offset ) ; else error = GIT_EBUFS ; if ( error < 0 && error!= GIT_EBUFS ) { error = - 1 ; goto done ; } if ( error == GIT_EBUFS ) { if ( ( recvd = gitno_recv ( buf ) ) < 0 ) { error = recvd ; goto done ; } if ( recvd == 0 ) { giterr_set ( GITERR_NET, "early   EOF" ) ; error = GIT_EEOF ; goto done ; } continue ; } gitno_consume ( buf, line_end ) ; <START_BUG> error = 0 ; <END_BUG> if ( pkt == NULL ) continue ; switch ( pkt -> type ) { case GIT_PKT_DATA : error = add_push_report_sideband_pkt ( push, ( git_pkt_data * ) pkt, & data_pkt_buf ) ; break ; case GIT_PKT_ERR : giterr_set ( GITERR_NET, "report-status:   Error   reported:   %s", ( ( git_pkt_err * ) pkt ) -> error ) ; error = - 1 ; break ; case GIT_PKT_PROGRESS : if ( transport -> progress_cb ) { git_pkt_progress * p = ( git_pkt_progress * ) pkt ; error = transport -> progress_cb ( p -> data, p -> len, transport -> message_cb_payload ) ; } break ; default : error = add_push_report_pkt ( push, pkt ) ; break ; } git_pkt_free ( pkt ) ; if ( error == GIT_ITEROVER ) { error = 0 ; if ( data_pkt_buf. size > 0 ) { giterr_set ( GITERR_

Fix:
<S2SV_ModStart> error = 0 <S2SV_ModEnd> ; switch (
Buggy code:
 static int cleanup_pathname ( struct archive_write_disk * a ) { <START_BUG> char * dest, * src ; <END_BUG> char separator = '\\0' ;  dest = src = a -> name ; <START_BUG> <END_BUG> if ( * src == '\\0' ) {  <START_BUG> archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, <END_BUG> "Invalid   empty   pathname" ) ; return ( ARCHIVE_FAILED ) ; }  # if defined ( __CYGWIN__ ) <START_BUG> cleanup_pathname_win ( a ) ; # endif if ( * src == '//' ) { if ( a -> flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, "Path   is   absolute" ) ; <END_BUG> return ( ARCHIVE_FAILED ) ;  } separator = * src ++ ; } for ( ; ; ) { if ( src [ 0 ] == '\\0' ) { break ; } else if ( src [ 0 ] == '//' ) { src ++ ; continue ; } else if ( src [ 0 ] == '.' ) { if ( src [ 1 ] == '\\0' ) { break ; } else if ( src [ 1 ] == '//' ) { src += 2 ; continue ; } else if ( src [ 1 ] == '.' ) { if ( src [ 2 ] == '//' || src [ 2 ] == '\\0' ) { if ( a -> flags & ARCHIVE_EXTRACT_SECURE_NODOTDOT ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, "Path   contains   \'..\'" ) ; return ( ARCHIVE_FAILED ) ; } } } } if ( separator ) * dest ++ = '//' ; while ( * src!= '\\0' && * src!= '//' ) { * dest ++ = * src ++ ; } if ( * src == '\\0' ) break ; separator = * src ++ ; } if ( dest == a -> name ) { if ( separator ) * dest ++ = '//' ; else * dest ++ = '.' ; } * dest = '\\0' ; return ( ARCHIVE_OK ) ; }

Fix:
<S2SV_ModStart> a ) { struct archive_string error_string ; int error_number ; int rc ; archive_string_init ( & error_string ) ; rc = cleanup_pathname_fsobj ( <S2SV_ModEnd> a -> name <S2SV_ModStart> a -> name, & error_number, & error_string, a -> flags ) <S2SV_ModStart> ; if ( rc!= ARCHIVE_OK <S2SV_ModEnd> ) { archive_set_error <S2SV_ModStart> -> archive, error_number, "%s", error_string. s <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } archive_string_free ( & error_string <S2SV_ModEnd> ) ; return <S2SV_ModStart> ) ; return rc <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void vp9_adapt_mode_probs ( VP9_COMMON * cm ) { int i, j ; <START_BUG> FRAME_CONTEXT * fc = & cm -> fc ; <END_BUG> const FRAME_CONTEXT * pre_fc = & cm -> frame_contexts [ cm -> frame_context_idx ] ; const FRAME_COUNTS * counts = & cm -> counts ; for ( i = 0 ; i < INTRA_INTER_CONTEXTS ; i ++ )  fc -> intra_inter_prob [ i ] = adapt_prob ( pre_fc -> intra_inter_prob [ i ], <START_BUG> counts -> intra_inter [ i ] ) ; for ( i = 0 ; i < COMP_INTER_CONTEXTS ; i ++ ) <END_BUG> fc -> comp_inter_prob [ i ] = adapt_prob ( pre_fc -> comp_inter_prob [ i ],  counts -> comp_inter [ i ] ) ; for ( i = 0 ; i < REF_CONTEXTS ; i ++ ) <START_BUG> fc -> comp_ref_prob [ i ] = adapt_prob ( pre_fc -> comp_ref_prob [ i ], <END_BUG> counts -> comp_ref [ i ] ) ; for ( i = 0 ; i < REF_CONTEXTS ; i ++ ) for ( j = 0 ; j < 2 ; j ++ )  fc -> single_ref_prob [ i ] [ j ] = adapt_prob ( pre_fc -> single_ref_prob [ i ] [ j ], <START_BUG> counts -> single_ref [ i ] [ j ] ) ; for ( i = 0 ; i < INTER_MODE_CONTEXTS ; i ++ ) <END_BUG> adapt_probs ( vp9_inter_mode_tree, pre_fc -> inter_mode_probs [ i ],  counts -> inter_mode [ i ], fc -> inter_mode_probs [ i ] ) ; for ( i = 0 ; i < BLOCK_SIZE_GROUPS ; i ++ ) <START_BUG> adapt_probs ( vp9_intra_mode_tree, pre_fc -> y_mode_prob [ i ], <END_BUG> counts -> y_mode [ i ], fc -> y_mode_prob [ i ] ) ; for ( i = 0 ; i < INTRA_MODES ; ++ i )  adapt_probs ( vp9_intra_mode_tree, pre_fc -> uv_mode_prob [

Fix:
<S2SV_ModStart> * fc = <S2SV_ModEnd> cm -> fc <S2SV_ModStart> i ] = mode_mv_merge_probs <S2SV_ModEnd> ( pre_fc -> <S2SV_ModStart> i ] = mode_mv_merge_probs <S2SV_ModEnd> ( pre_fc -> <S2SV_ModStart> i ] = mode_mv_merge_probs <S2SV_ModEnd> ( pre_fc -> <S2SV_ModStart> j ] = mode_mv_merge_probs ( <S2SV_ModEnd> pre_fc -> single_ref_prob <S2SV_ModStart> i ++ ) vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_inter_mode_tree, <S2SV_ModStart> i ++ ) vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_intra_mode_tree, <S2SV_ModStart> ++ i ) vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_intra_mode_tree, <S2SV_ModStart> i ++ ) vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_partition_tree, <S2SV_ModStart> i ++ ) vpx_tree_merge_probs <S2SV_ModEnd> ( vp9_switchable_interp_tree, <S2SV_ModStart> j ] = mode_mv_merge_probs ( <S2SV_ModEnd> pre_fc -> tx_probs <S2SV_ModStart> j ] = mode_mv_merge_probs ( <S2SV_ModEnd> pre_fc -> tx_probs <S2SV_ModStart> j ] = mode_mv_merge_probs ( <S2SV_ModEnd> pre_fc ->
Buggy code:
 static int unix_stream_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock_iocb * siocb = kiocb_to_siocb ( iocb ) ; struct scm_cookie tmp_scm ; struct sock * sk = sock -> sk ; struct unix_sock * u = unix_sk ( sk ) ; struct sockaddr_un * sunaddr = msg -> msg_name ; int copied = 0 ; int check_creds = 0 ; int target ; int err = 0 ; long timeo ; int skip ; err = - EINVAL ; if ( sk -> sk_state!= TCP_ESTABLISHED ) goto out ; err = - EOPNOTSUPP ; if ( flags & MSG_OOB ) goto out ; target = sock_rcvlowat ( sk, flags & MSG_WAITALL, size ) ; timeo = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> if (! siocb -> scm ) { siocb -> scm = & tmp_scm ; memset ( & tmp_scm, 0, sizeof ( tmp_scm ) ) ; } err = mutex_lock_interruptible ( & u -> readlock ) ; if ( err ) { err = sock_intr_errno ( timeo ) ; goto out ; } do { int chunk ; struct sk_buff * skb, * last ; unix_state_lock ( sk ) ; last = skb = skb_peek ( & sk -> sk_receive_queue ) ; again : if ( skb == NULL ) { unix_sk ( sk ) -> recursion_level = 0 ; if ( copied >= target ) goto unlock ; err = sock_error ( sk ) ; if ( err ) goto unlock ; if ( sk -> sk_shutdown & RCV_SHUTDOWN ) goto unlock ; unix_state_unlock ( sk ) ; err = - EAGAIN ; if (! timeo ) break ; mutex_unlock ( & u -> readlock ) ; timeo = unix_stream_data_wait ( sk, timeo, last ) ; if ( signal_pending ( current ) || mutex_lock_interruptible ( & u -> readlock ) )

Fix:
<S2SV_ModStart> MSG_DONTWAIT ) ; <S2SV_ModEnd> if (!
Buggy code:
 static void subtract_stats ( FIRSTPASS_STATS * section, const FIRSTPASS_STATS * frame ) { section -> frame -= frame -> frame ; <START_BUG> section -> intra_error -= frame -> intra_error ; <END_BUG> section -> coded_error -= frame -> coded_error ; section -> sr_coded_error -= frame -> sr_coded_error ;  section -> ssim_weighted_pred_err -= frame -> ssim_weighted_pred_err ; <START_BUG> section -> pcnt_inter -= frame -> pcnt_inter ; section -> pcnt_motion -= frame -> pcnt_motion ; section -> pcnt_second_ref -= frame -> pcnt_second_ref ; <END_BUG> section -> pcnt_neutral -= frame -> pcnt_neutral ;  section -> MVr -= frame -> MVr ; section -> mvr_abs -= frame -> mvr_abs ; section -> MVc -= frame -> MVc ; section -> mvc_abs -= frame -> mvc_abs ; section -> MVrv -= frame -> MVrv ; section -> MVcv -= frame -> MVcv ; section -> mv_in_out_count -= frame -> mv_in_out_count ; section -> new_mv_count -= frame -> new_mv_count ; section -> count -= frame -> count ; section -> duration -= frame -> duration ; }

Fix:
<S2SV_ModStart> ; section -> weight -= frame -> weight ; section -> <S2SV_ModStart> ; section -> <S2SV_ModEnd> pcnt_inter -= frame <S2SV_ModStart> frame -> pcnt_neutral ; section -> intra_skip_pct -= frame -> intra_skip_pct ; section -> inactive_zone_rows -= frame -> inactive_zone_rows ; section -> inactive_zone_cols -= frame -> inactive_zone_cols