nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int mov_write_audio_tag ( AVFormatContext * s, AVIOContext * pb, MOVMuxContext * mov, MOVTrack * track ) { int64_t pos = avio_tell ( pb ) ; int version = 0 ; uint32_t tag = track -> tag ; if ( track -> mode == MODE_MOV ) { <START_BUG> if ( track -> timescale > UINT16_MAX ) { <END_BUG> if ( mov_get_lpcm_flags ( track -> par -> codec_id ) ) tag = AV_RL32 ( "lpcm" ) ; version = 2 ; } else if ( track -> audio_vbr || mov_pcm_le_gt16 ( track -> par -> codec_id ) || mov_pcm_be_gt16 ( track -> par -> codec_id ) || track -> par -> codec_id == AV_CODEC_ID_ADPCM_MS || track -> par -> codec_id == AV_CODEC_ID_ADPCM_IMA_WAV || track -> par -> codec_id == AV_CODEC_ID_QDM2 ) { version = 1 ; } } avio_wb32 ( pb, 0 ) ; if ( mov -> encryption_scheme!= MOV_ENC_NONE ) { ffio_wfourcc ( pb, "enca" ) ; } else { avio_wl32 ( pb, tag ) ; } avio_wb32 ( pb, 0 ) ; avio_wb16 ( pb, 0 ) ; avio_wb16 ( pb, 1 ) ; avio_wb16 ( pb, version ) ; avio_wb16 ( pb, 0 ) ; avio_wb32 ( pb, 0 ) ; if ( version == 2 ) { avio_wb16 ( pb, 3 ) ; avio_wb16 ( pb, 16 ) ; avio_wb16 ( pb, 0xfffe ) ; avio_wb16 ( pb, 0 ) ; avio_wb32 ( pb, 0x00010000 ) ; avio_wb32 ( pb, 72 ) ; avio_wb64 ( pb, av_double2int ( track -> par -> sample_rate ) ) ; avio_wb32 ( pb,

Fix:
<S2SV_ModStart> timescale > UINT16_MAX ||! track -> par -> channels
Buggy code:
 <START_BUG> static void encode_segmentation ( VP9_COMP * cpi, <END_BUG> struct vp9_write_bit_buffer * wb ) { int i, j ;  struct segmentation * seg = & cpi -> common. seg ; <START_BUG> vp9_wb_write_bit ( wb, seg -> enabled ) ; if (! seg -> enabled ) return ; <END_BUG> vp9_wb_write_bit ( wb, seg -> update_map ) ;  if ( seg -> update_map ) { <START_BUG> vp9_choose_segmap_coding_method ( cpi ) ; <END_BUG> for ( i = 0 ; i < SEG_TREE_PROBS ; i ++ ) { const int prob = seg -> tree_probs [ i ] ; const int update = prob!= MAX_PROB ;  vp9_wb_write_bit ( wb, update ) ; <START_BUG> if ( update ) vp9_wb_write_literal ( wb, prob, 8 ) ; } <END_BUG> vp9_wb_write_bit ( wb, seg -> temporal_update ) ;  if ( seg -> temporal_update ) { for ( i = 0 ; i < PREDICTION_PROBS ; i ++ ) { const int prob = seg -> pred_probs [ i ] ; const int update = prob!= MAX_PROB ; <START_BUG> vp9_wb_write_bit ( wb, update ) ; <END_BUG> if ( update ) vp9_wb_write_literal ( wb, prob, 8 ) ; } } }  vp9_wb_write_bit ( wb, seg -> update_data ) ; <START_BUG> if ( seg -> update_data ) { <END_BUG> vp9_wb_write_bit ( wb, seg -> abs_delta ) ;  for ( i = 0 ; i < MAX_SEGMENTS ; i ++ ) { for ( j = 0 ; j < SEG_LVL_MAX ; j ++ ) { <START_BUG> const int active = vp9_segfeature_active ( seg, i, j ) ; <END_BUG> vp9_wb_write_bit ( wb, active ) ; if ( active ) {  const int data = vp9_get_segdata ( seg, i, j ) ; <START_BUG> const int data_max = vp9_seg_feature_data_max ( j ) ; if ( vp9_is_segfeature_signed ( j ) ) { encode_unsigned_max ( wb, abs<END_BUG>

Fix:
<S2SV_ModStart> void encode_segmentation ( VP9_COMMON * cm, MACROBLOCKD * xd, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart>, j ; const <S2SV_ModStart> seg = & cm -> seg ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> ) return ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> { vp9_choose_segmap_coding_method ( cm, xd <S2SV_ModEnd> ) ; for <S2SV_ModStart>!= MAX_PROB ; vpx_wb_write_bit ( wb, update ) ; if ( update ) vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> ) ; } vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart>!= MAX_PROB ; vpx_wb_write_bit ( wb, update ) ; if ( update ) vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> } } } vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> update_data ) { vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> int active = segfeature_active ( seg, i, j ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> int
Buggy code:
 static int dn_create ( struct net * net, struct socket * sock, int protocol, int kern ) { <START_BUG> struct sock * sk ; <END_BUG> if (! net_eq ( net, & init_net ) ) return - EAFNOSUPPORT ; switch ( sock -> type ) { case SOCK_SEQPACKET : if ( protocol!= DNPROTO_NSP ) return - EPROTONOSUPPORT ; break ; case SOCK_STREAM : break ; default : return - ESOCKTNOSUPPORT ; } if ( ( sk = dn_alloc_sock ( net, sock, GFP_KERNEL, kern ) ) == NULL ) return - ENOBUFS ; sk -> sk_protocol = protocol ; return 0 ; }

Fix:
<S2SV_ModStart> sock * sk ; if ( protocol < 0 || protocol > SK_PROTOCOL_MAX ) return - EINVAL
Buggy code:
 static int jpc_dec_tileinit ( jpc_dec_t * dec, jpc_dec_tile_t * tile ) { jpc_dec_tcomp_t * tcomp ; int compno ; int rlvlno ; jpc_dec_rlvl_t * rlvl ; jpc_dec_band_t * band ; jpc_dec_prc_t * prc ; int bndno ; jpc_tsfb_band_t * bnd ; int bandno ; jpc_dec_ccp_t * ccp ; int prccnt ; jpc_dec_cblk_t * cblk ; int cblkcnt ; uint_fast32_t tlprcxstart ; uint_fast32_t tlprcystart ; uint_fast32_t brprcxend ; uint_fast32_t brprcyend ; uint_fast32_t tlcbgxstart ; uint_fast32_t tlcbgystart ; uint_fast32_t brcbgxend ; uint_fast32_t brcbgyend ; uint_fast32_t cbgxstart ; uint_fast32_t cbgystart ; uint_fast32_t cbgxend ; uint_fast32_t cbgyend ; uint_fast32_t tlcblkxstart ; uint_fast32_t tlcblkystart ; uint_fast32_t brcblkxend ; uint_fast32_t brcblkyend ; uint_fast32_t cblkxstart ; uint_fast32_t cblkystart ; uint_fast32_t cblkxend ; uint_fast32_t cblkyend ; uint_fast32_t tmpxstart ; uint_fast32_t tmpystart ; uint_fast32_t tmpxend ; uint_fast32_t tmpyend ; jpc_dec_cp_t * cp ; <START_BUG> jpc_tsfb_band_t bnds [ 64 ] ; <END_BUG> jpc_pchg_t * pchg ; int pchgno ; jpc_dec_cmpt_t * cmpt ; cp = tile -> cp ; tile -> realmode = 0 ; if ( cp -> mct

Fix:
<S2SV_ModStart> jpc_tsfb_band_t bnds [ JPC_MAXBANDS <S2SV_ModEnd> ] ; jpc_pchg_t
Buggy code:
 PyObject * ast2obj_mod ( void * _o ) { mod_ty o = ( mod_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { Py_RETURN_NONE ; } switch ( o -> kind ) { case Module_kind : result = PyType_GenericNew ( Module_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. Module. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <START_BUG> break ; <END_BUG> case Interactive_kind : result = PyType_GenericNew ( Interactive_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. Interactive. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case Expression_kind : result = PyType_GenericNew ( Expression_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_expr ( o -> v. Expression. body ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ;  case Suite_kind : <START_BUG> result = PyType_GenericNew ( Suite_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. Suite. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; } return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> value ) ; value = ast2obj_list ( o -> v. Module. type_ignores, ast2obj_type_ignore ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_ignores, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <S2SV_ModStart> break ; case FunctionType_kind : result = PyType_GenericNew ( FunctionType_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. FunctionType. argtypes, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_argtypes, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> v. FunctionType. returns ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_returns, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case
Buggy code:
 int main ( int argc, char * * argv ) { int fd = xopen ( "//dev//null", O_RDWR ) ; while ( fd < 2 ) fd = xdup ( fd ) ; if ( fd > 2 ) close ( fd ) ; int err = 1 ; logmode = LOGMODE_JOURNAL ; load_abrt_conf ( ) ; bool setting_MakeCompatCore ; bool setting_SaveBinaryImage ; bool setting_SaveFullCore ; bool setting_CreateCoreBacktrace ; bool setting_SaveContainerizedPackageData ; bool setting_StandaloneHook ; { map_string_t * settings = new_map_string ( ) ; load_abrt_plugin_conf_file ( "CCpp.conf", settings ) ; const char * value ; value = get_map_string_item_or_NULL ( settings, "MakeCompatCore" ) ; setting_MakeCompatCore = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "SaveBinaryImage" ) ; setting_SaveBinaryImage = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "SaveFullCore" ) ; setting_SaveFullCore = value? string_to_bool ( value ) : true ; value = get_map_string_item_or_NULL ( settings, "CreateCoreBacktrace" ) ; setting_CreateCoreBacktrace = value? string_to_bool ( value ) : true ; value = get_map_string_item_or_NULL ( settings, "SaveContainerizedPackageData" ) ; setting_SaveContainerizedPackageData = value && string_to_bool ( value ) ; if (! g_settings_explorechroots ) { if ( setting_SaveContainerizedPackageData ) log_warning ( "Ignoring   SaveContainerizedPackageData   because   ExploreChroots   is   disabled" ) ; setting_SaveContainerizedPackageData = false ; } value = get_map_string_item_or_NULL ( settings, "StandaloneHook" ) ; setting_StandaloneHook = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "VerboseLog" ) ; if ( value )

Fix:
<S2SV_ModStart> path ) ; unlink ( path ) ; <S2SV_ModStart> | O_CREAT | O_EXCL <S2SV_ModEnd>, 0600 )
Buggy code:
 int rpc_type_of_NPPVariable ( int variable ) { int type ; switch ( variable ) { case NPPVpluginNameString : case NPPVpluginDescriptionString : <START_BUG> case NPPVformValue : <END_BUG> type = RPC_TYPE_STRING ; break ; case NPPVpluginWindowSize : case NPPVpluginTimerInterval : type = RPC_TYPE_INT32 ; break ; case NPPVpluginNeedsXEmbed : case NPPVpluginWindowBool : case NPPVpluginTransparentBool : case NPPVjavascriptPushCallerBool : case NPPVpluginKeepLibraryInMemory :  type = RPC_TYPE_BOOLEAN ; <START_BUG> break ; case NPPVpluginScriptableNPObject : type = RPC_TYPE_NP_OBJECT ; break ; default : type = RPC_ERROR_GENERIC ; break ; } return type ; }<END_BUG>

Fix:
<S2SV_ModStart> : case NPPVformValue : case NPPVpluginNativeAccessibleAtkPlugId <S2SV_ModStart> case NPPVpluginKeepLibraryInMemory : case NPPVpluginUrlRequestsDisplayedBool : case NPPVpluginWantsAllNetworkStreams : case NPPVpluginCancelSrcStream : case NPPVSupportsAdvancedKeyHandling :
Buggy code:
 struct _mdi * _WM_ParseNewHmp ( uint8_t * hmp_data, uint32_t hmp_size ) { uint8_t is_hmp2 = 0 ; uint32_t zero_cnt = 0 ; uint32_t i = 0 ; uint32_t hmp_file_length = 0 ; uint32_t hmp_chunks = 0 ; uint32_t hmp_divisions = 0 ; uint32_t hmp_unknown = 0 ; uint32_t hmp_bpm = 0 ; uint32_t hmp_song_time = 0 ; struct _mdi * hmp_mdi ; uint8_t * * hmp_chunk ; uint32_t * chunk_length ; uint32_t * chunk_ofs ; uint32_t * chunk_delta ; uint8_t * chunk_end ; uint32_t chunk_num = 0 ; uint32_t hmp_track = 0 ; uint32_t smallest_delta = 0 ; uint32_t subtract_delta = 0 ; uint32_t end_of_chunks = 0 ; uint32_t var_len_shift = 0 ; float tempo_f = 500000.0 ; float samples_per_delta_f = 0.0 ; uint32_t sample_count = 0 ; float sample_count_f = 0 ; float sample_remainder = 0 ; if ( memcmp ( hmp_data, "HMIMIDIP", 8 ) ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_HMP, NULL, 0 ) ; return NULL ; } hmp_data += 8 ; hmp_size -= 8 ; if (! memcmp ( hmp_data, "013195", 6 ) ) { hmp_data += 6 ; hmp_size -= 6 ; is_hmp2 = 1 ; } if ( is_hmp2 ) { zero_cnt = 18 ; } else { zero_cnt = 24 ; } for ( i = 0 ; i < zero_cnt ; i ++ ) { if ( hmp_data [ i ]!= 0 ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_HMP, NULL,

Fix:
<S2SV_ModStart> ] + chunk_length [ i ] ; chunk_length [ i ] -= chunk_ofs <S2SV_ModStart> += 3 ; chunk_length [ i ] -= 3 ; <S2SV_ModStart> hmp_mdi, hmp_chunk [ i ], chunk_length <S2SV_ModStart> ] = 1 ; chunk_length [ i ] -= 3 <S2SV_ModStart> += setup_ret ; chunk_length [ i ] -= setup_ret ; <S2SV_ModStart> ; if ( chunk_length [ i ] && <S2SV_ModStart> { do { if (! chunk_length [ i ] ) break ; <S2SV_ModStart> ] ++ ; chunk_length [ i ] -- ; <S2SV_ModStart> ) ; } if (! chunk_length [ i ] ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_HMP, "file <S2SV_blank> too <S2SV_blank> short", 0 ) ; goto _hmp_end ; } <S2SV_ModStart> i ] ++ ; chunk_length [ i ] --
Buggy code:
 static inline int ldsem_cmpxchg ( long * old, long new, struct ld_semaphore * sem ) { <START_BUG> long tmp = * old ; <END_BUG> * old = atomic_long_cmpxchg ( & sem -> count, * old, new ) ;  return * old == tmp ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> long tmp = <S2SV_ModEnd> atomic_long_cmpxchg ( & <S2SV_ModStart> new ) ; if ( tmp == * old ) { * old = new ; return 1 ; } else { * old = tmp ; return 0 ; } <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 bool_t auth_gssapi_unwrap_data ( OM_uint32 * major, OM_uint32 * minor, gss_ctx_id_t context, uint32_t seq_num, XDR * in_xdrs, bool_t ( * xdr_func ) ( ), caddr_t xdr_ptr ) { gss_buffer_desc in_buf, out_buf ; XDR temp_xdrs ; uint32_t verf_seq_num ; int conf, qop ; unsigned int length ; PRINTF ( ( "gssapi_unwrap_data:   starting\\n" ) ) ; * major = GSS_S_COMPLETE ; * minor = 0 ; in_buf. value = NULL ; out_buf. value = NULL ; if (! xdr_bytes ( in_xdrs, ( char * * ) & in_buf. value, & length, ( unsigned int ) - 1 ) ) { PRINTF ( ( "gssapi_unwrap_data:   deserializing   encrypted   data   failed\\n" ) ) ; temp_xdrs. x_op = XDR_FREE ; ( void ) xdr_bytes ( & temp_xdrs, ( char * * ) & in_buf. value, & length, ( unsigned int ) - 1 ) ; return FALSE ; } in_buf. length = length ; * major = gss_unseal ( minor, context, & in_buf, & out_buf, & conf, & qop ) ; free ( in_buf. value ) ; if ( * major!= GSS_S_COMPLETE ) return FALSE ; PRINTF ( ( "gssapi_unwrap_data:   %llu   bytes   data,   %llu   bytes   sealed\\n", ( unsigned long long ) out_buf. length, ( unsigned long long ) in_buf. length ) ) ; xdrmem_create ( & temp_xdrs, out_buf. value, out_buf. length, XDR_DECODE ) ; if (! xdr_u_int32 ( & temp_xdrs, & verf_seq_num ) ) { PRINTF ( ( "gssapi_unwrap_data:   deserializing   verf

Fix:
<S2SV_ModStart> out_buf ) ; <S2SV_ModEnd> XDR_DESTROY ( &
Buggy code:
 MagickBooleanType sixel_decode ( unsigned char * p, unsigned char * * pixels, size_t * pwidth, size_t * pheight, unsigned char * * palette, size_t * ncolors ) { int n, i, r, g, b, sixel_vertical_mask, c ; int posision_x, posision_y ; int max_x, max_y ; int attributed_pan, attributed_pad ; int attributed_ph, attributed_pv ; int repeat_count, color_index, max_color_index = 2, background_color_index ; int param [ 10 ] ; int sixel_palet [ SIXEL_PALETTE_MAX ] ; unsigned char * imbuf, * dmbuf ; int imsx, imsy ; int dmsx, dmsy ; int y ; posision_x = posision_y = 0 ; max_x = max_y = 0 ; attributed_pan = 2 ; attributed_pad = 1 ; attributed_ph = attributed_pv = 0 ; repeat_count = 1 ; color_index = 0 ; background_color_index = 0 ; imsx = 2048 ; imsy = 2048 ; <START_BUG> imbuf = ( unsigned char * ) AcquireQuantumMemory ( imsx * imsy, 1 ) ; <END_BUG> if ( imbuf == NULL ) { return ( MagickFalse ) ; } for ( n = 0 ; n < 16 ; n ++ ) { sixel_palet [ n ] = sixel_default_color_table [ n ] ; } for ( r = 0 ; r < 6 ; r ++ ) { for ( g = 0 ; g < 6 ; g ++ ) { for ( b = 0 ; b < 6 ; b ++ ) { sixel_palet [ n ++ ] = SIXEL_RGB ( r * 51, g * 51, b * 51 ) ; } } } for ( i = 0 ; i < 24 ; i ++ ) { sixel_palet [ n ++ ] = SIXEL_RGB ( i * 11, i * 11, i * 11 ) ; } for ( ; n < SIXEL_PALETTE_MAX ; n ++ ) { sixel_palet [ n ] = SIXEL_RGB ( 255, 255, 255 ) ; }  ( void ) Reset

Fix:
<S2SV_ModStart> AcquireQuantumMemory ( imsx, imsy <S2SV_ModEnd> ) ; if <S2SV_ModStart>, background_color_index, ( size_t ) <S2SV_ModStart> AcquireQuantumMemory ( dmsx, dmsy <S2SV_ModEnd> ) ; if <S2SV_ModStart>, background_color_index, ( size_t ) <S2SV_ModStart> AcquireQuantumMemory ( dmsx, dmsy <S2SV_ModEnd> ) ; if <S2SV_ModStart>, background_color_index, ( size_t ) <S2SV_ModStart> ( imbuf + ( size_t ) <S2SV_ModStart> AcquireQuantumMemory ( dmsx, dmsy <S2SV_ModEnd> ) ) ==
Buggy code:
 <START_BUG> static void iwl_sta_ucode_activate ( struct iwl_priv * priv, u8 sta_id ) <END_BUG>  { <START_BUG> if (! ( priv -> stations [ sta_id ]. used & IWL_STA_DRIVER_ACTIVE ) ) IWL_ERR ( priv, "ACTIVATE   a   non   DRIVER   active   station   id   %u   " "addr   %pM\\n", sta_id, priv -> stations [ sta_id ]. sta. sta. addr ) ; if ( priv -> stations [ sta_id ]. used & IWL_STA_UCODE_ACTIVE ) { IWL_DEBUG_ASSOC ( priv, "STA   id   %u   addr   %pM   already   present   in   uCode   " "(according   to   driver)\\n", sta_id, priv -> stations [ sta_id ]. sta. sta. addr ) ; } else { priv -> stations [ sta_id ]. used |= IWL_STA_UCODE_ACTIVE ; IWL_DEBUG_ASSOC ( priv, "Added   STA   id   %u   addr   %pM   to   uCode\\n", sta_id, priv -> stations [ sta_id ]. sta. sta. addr ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> iwl_sta_ucode_activate ( struct <S2SV_ModStart> sta_id ) { if ( sta_id >= IWLAGN_STATION_COUNT ) { IWL_ERR ( priv, "invalid <S2SV_blank> sta_id <S2SV_blank> %u", sta_id ) ; return - EINVAL ; } <S2SV_ModStart> ) ; } return 0 ;
Buggy code:
 static OPJ_BOOL opj_j2k_write_all_tile_parts ( opj_j2k_t * p_j2k, OPJ_BYTE * p_data, OPJ_UINT32 * p_data_written, OPJ_UINT32 p_total_data_size, opj_stream_private_t * p_stream, struct opj_event_mgr * p_manager ) { OPJ_UINT32 tilepartno = 0 ; OPJ_UINT32 l_nb_bytes_written = 0 ; OPJ_UINT32 l_current_nb_bytes_written ; OPJ_UINT32 l_part_tile_size ; OPJ_UINT32 tot_num_tp ; OPJ_UINT32 pino ; OPJ_BYTE * l_begin_data ; opj_tcp_t * l_tcp = 00 ; opj_tcd_t * l_tcd = 00 ; opj_cp_t * l_cp = 00 ; l_tcd = p_j2k -> m_tcd ; l_cp = & ( p_j2k -> m_cp ) ; l_tcp = l_cp -> tcps + p_j2k -> m_current_tile_number ; tot_num_tp = opj_j2k_get_num_tp ( l_cp, 0, p_j2k -> m_current_tile_number ) ; ++ p_j2k -> m_specific_param. m_encoder. m_current_tile_part_number ; for ( tilepartno = 1 ; tilepartno < tot_num_tp ; ++ tilepartno ) { p_j2k -> m_specific_param. m_encoder. m_current_poc_tile_part_number = tilepartno ; l_current_nb_bytes_written = 0 ; l_part_tile_size = 0 ; l_begin_data = p_data ; <START_BUG> if (! opj_j2k_write_sot ( p_j2k, p_data, & l_current_nb_bytes_written, p_stream, <END_BUG> p_manager ) ) { return OPJ_FALSE ; } l_nb_bytes_written += l_current_

Fix:
<S2SV_ModStart>, p_data, p_total_data_size, <S2SV_ModStart>, p_data, p_total_data_size,
Buggy code:
 static void init_syntax_once ( ) { register int c ; <START_BUG> static int done ; <END_BUG> if ( done ) return ; bzero ( re_syntax_table, sizeof re_syntax_table ) ;  for ( c = 'a' ; c <= 'z' ; c ++ ) <START_BUG> re_syntax_table [ c ] = Sword ; for ( c = 'A' ; c <= 'Z' ; c ++ ) re_syntax_table [ c ] = Sword ; for ( c = '0' ; c <= '9' ; c ++ ) re_syntax_table [ c ] = Sword ; re_syntax_table [ '_' ] = Sword ; done = 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> static int done = 0 <S2SV_ModStart> ( c = 0 ; c < CHAR_SET_SIZE ; ++ c ) if ( ISALNUM ( c ) <S2SV_ModEnd> ) re_syntax_table [
Buggy code:
 static int irda_recvmsg_dgram ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct irda_sock * self = irda_sk ( sk ) ; struct sk_buff * skb ; size_t copied ; int err ; IRDA_DEBUG ( 4, "%s()\\n", __func__ ) ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & err ) ; if (! skb ) return err ; skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { IRDA_DEBUG ( 2, "%s(),   Received   truncated   frame   (%zd   <   %zd)!\\n", __func__, copied, size ) ; copied = size ; msg -> msg_flags |= MSG_TRUNC ; } skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; skb_free_datagram ( sk, skb ) ; if ( self -> rx_flow == FLOW_STOP ) { if ( ( atomic_read ( & sk -> sk_rmem_alloc ) << 2 ) <= sk -> sk_rcvbuf ) { IRDA_DEBUG ( 2, "%s(),   Starting   IrTTP\\n", __func__ ) ; self -> rx_flow = FLOW_START ; irttp_flow_request ( self -> tsap, FLOW_START ) ; } } return copied ; }

Fix:
<S2SV_ModStart> __func__ ) ; <S2SV_ModEnd> skb = skb_recv_datagram
Buggy code:
 int rds_cmsg_atomic ( struct rds_sock * rs, struct rds_message * rm, struct cmsghdr * cmsg ) { struct page * page = NULL ; struct rds_atomic_args * args ; int ret = 0 ; if ( cmsg -> cmsg_len < CMSG_LEN ( sizeof ( struct rds_atomic_args ) ) || rm -> atomic. op_active ) return - EINVAL ; args = CMSG_DATA ( cmsg ) ; switch ( cmsg -> cmsg_type ) { case RDS_CMSG_ATOMIC_FADD : rm -> atomic. op_type = RDS_ATOMIC_TYPE_FADD ; rm -> atomic. op_m_fadd. add = args -> fadd. add ; rm -> atomic. op_m_fadd. nocarry_mask = 0 ; break ; case RDS_CMSG_MASKED_ATOMIC_FADD : rm -> atomic. op_type = RDS_ATOMIC_TYPE_FADD ; rm -> atomic. op_m_fadd. add = args -> m_fadd. add ; rm -> atomic. op_m_fadd. nocarry_mask = args -> m_fadd. nocarry_mask ; break ; case RDS_CMSG_ATOMIC_CSWP : rm -> atomic. op_type = RDS_ATOMIC_TYPE_CSWP ; rm -> atomic. op_m_cswp. compare = args -> cswp. compare ; rm -> atomic. op_m_cswp. swap = args -> cswp. swap ; rm -> atomic. op_m_cswp. compare_mask = ~ 0 ; rm -> atomic. op_m_cswp. swap_mask = ~ 0 ; break ; case RDS_CMSG_MASKED_ATOMIC_CSWP : rm -> atomic. op_type = RDS_ATOMIC_TYPE_CSWP ; rm -> atomic. op_m_cswp. compare = args -> m_cswp. compare ; rm -> atomic. op_m_cswp. swap = args -> m_cswp. swap ; rm -> atomic. op_m_cswp. compare_mask = args -> m_cswp. compare_mask ; rm -> atomic. op_m_cswp. swap_mask = args -> m_cswp.

Fix:
<S2SV_ModStart> page ) ; rm -> atomic. op_active = 0 ;
Buggy code:
 static int adjust_scalar_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, struct bpf_reg_state * dst_reg, struct bpf_reg_state src_reg ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; bool src_known, dst_known ; s64 smin_val, smax_val ; u64 umin_val, umax_val ; if ( BPF_CLASS ( insn -> code )!= BPF_ALU64 ) { coerce_reg_to_32 ( dst_reg ) ; coerce_reg_to_32 ( & src_reg ) ; } smin_val = src_reg. smin_value ; smax_val = src_reg. smax_value ; umin_val = src_reg. umin_value ; umax_val = src_reg. umax_value ; src_known = tnum_is_const ( src_reg. var_off ) ; dst_known = tnum_is_const ( dst_reg -> var_off ) ; switch ( opcode ) { case BPF_ADD : if ( signed_add_overflows ( dst_reg -> smin_value, smin_val ) || signed_add_overflows ( dst_reg -> smax_value, smax_val ) ) { dst_reg -> smin_value = S64_MIN ; dst_reg -> smax_value = S64_MAX ; } else { dst_reg -> smin_value += smin_val ; dst_reg -> smax_value += smax_val ; } if ( dst_reg -> umin_value + umin_val < umin_val || dst_reg -> umax_value + umax_val < umax_val ) { dst_reg -> umin_value = 0 ; dst_reg -> umax_value = U64_MAX ; } else { dst_reg -> umin_value += umin_val ; dst_reg -> umax_value += umax_val ; } dst_reg -> var_off = tnum_add ( dst_reg -> var_off, src_reg. var

Fix:
<S2SV_ModStart> break ; } <S2SV_ModEnd> dst_reg -> smin_value <S2SV_ModStart> = S64_MAX ; <S2SV_ModEnd> if ( src_known
Buggy code:
 <START_BUG> void vp9_first_pass ( VP9_COMP * cpi ) { <END_BUG> int mb_row, mb_col ;  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; TileInfo tile ; struct macroblock_plane * const p = x -> plane ; struct macroblockd_plane * const pd = xd -> plane ; <END_BUG> const PICK_MODE_CONTEXT * ctx = & x -> sb64_context ;  int i ; int recon_yoffset, recon_uvoffset ; <START_BUG> YV12_BUFFER_CONFIG * const lst_yv12 = get_ref_frame_buffer ( cpi, LAST_FRAME ) ; <END_BUG> YV12_BUFFER_CONFIG * gld_yv12 = get_ref_frame_buffer ( cpi, GOLDEN_FRAME ) ; YV12_BUFFER_CONFIG * const new_yv12 = get_frame_new_buffer ( cm ) ; int recon_y_stride = lst_yv12 -> y_stride ; int recon_uv_stride = lst_yv12 -> uv_stride ; int uv_mb_height = 16 >> ( lst_yv12 -> y_height > lst_yv12 -> uv_height ) ; int64_t intra_error = 0 ; int64_t coded_error = 0 ; int64_t sr_coded_error = 0 ; int sum_mvr = 0, sum_mvc = 0 ; int sum_mvr_abs = 0, sum_mvc_abs = 0 ; int64_t sum_mvrs = 0, sum_mvcs = 0 ; int mvcount = 0 ; int intercount = 0 ; int second_ref_count = 0 ;  int intrapenalty = 256 ; <START_BUG> int neutral_count = 0 ; int new_mv_count = 0 ; int sum_in_vectors = 0 ; <END_BUG> uint32_t lastmv_as_int = 0 ;  struct twopass_rc * twopass = & cpi -> twopass ; const MV zero_mv = { 0, 0 } ; <START_BUG> const YV12_BUFFER_CONFIG * first_ref_buf = lst_yv12<END_BUG>

Fix:
<S2SV_ModStart> VP9_COMP * cpi, const struct lookahead_entry * source <S2SV_ModStart> & cpi -> td. <S2SV_ModStart> ctx = & cpi -> td. pc_root -> none <S2SV_ModEnd> ; int i <S2SV_ModStart>, recon_uvoffset ; <S2SV_ModEnd> int64_t intra_error = <S2SV_ModStart> = 0 ; const <S2SV_ModStart> int intrapenalty = INTRA_MODE_PENALTY ; double neutral_count ; int intra_skip_count = 0 ; int image_data_start_row = INVALID_ROW <S2SV_ModEnd> ; int new_mv_count <S2SV_ModStart> = 0 ; MV lastmv = { 0, 0 } ; TWO_PASS <S2SV_ModEnd> * twopass = <S2SV_ModStart> 0 } ; int recon_y_stride, recon_uv_stride, uv_mb_height ; YV12_BUFFER_CONFIG * const lst_yv12 = get_ref_frame_buffer ( cpi, LAST_FRAME ) ; YV12_BUFFER_CONFIG * gld_yv12 = get_ref_frame_buffer ( cpi, GOLDEN_FRAME ) ; YV12_BUFFER_CONFIG * const new_yv12 = get_frame_new_buffer ( cm ) ; <S2SV_ModStart>
Buggy code:
 static rsRetVal createSocket ( instanceConf_t * info, void * * sock ) { int rv ; sublist * sub ; * sock = zsocket_new ( s_context, info -> type ) ; if (! sock ) { errmsg. LogError ( 0, RS_RET_INVALID_PARAMS, "zsocket_new   failed:   %s,   for   type   %d", zmq_strerror ( errno ), info -> type ) ; return RS_RET_INVALID_PARAMS ; } DBGPRINTF ( "imzmq3:   socket   of   type   %d   created   successfully\\n", info -> type ) if ( info -> identity ) zsocket_set_identity ( * sock, info -> identity ) ; if ( info -> sndBuf > - 1 ) zsocket_set_sndbuf ( * sock, info -> sndBuf ) ; if ( info -> rcvBuf > - 1 ) zsocket_set_rcvbuf ( * sock, info -> rcvBuf ) ; if ( info -> linger > - 1 ) zsocket_set_linger ( * sock, info -> linger ) ; if ( info -> backlog > - 1 ) zsocket_set_backlog ( * sock, info -> backlog ) ; if ( info -> sndTimeout > - 1 ) zsocket_set_sndtimeo ( * sock, info -> sndTimeout ) ; if ( info -> rcvTimeout > - 1 ) zsocket_set_rcvtimeo ( * sock, info -> rcvTimeout ) ; if ( info -> maxMsgSize > - 1 ) zsocket_set_maxmsgsize ( * sock, info -> maxMsgSize ) ; if ( info -> rate > - 1 ) zsocket_set_rate ( * sock, info -> rate ) ; if ( info -> recoveryIVL > - 1 ) zsocket_set_recovery_ivl ( * sock, info -> recoveryIVL ) ; if ( info -> multicastHops > - 1 ) zsocket_set_multicast_hops ( * sock, info -> multicastHops ) ; if ( info -> reconnectIVL > - 1 ) zsocket_set_reconnect_ivl ( * sock, info -> reconnectIVL ) ; if ( info -> reconnectIVLMax > - 1 ) zsocket_set_reconnect_ivl_max ( * sock,

Fix:
<S2SV_ModStart> * sock, "%s", <S2SV_ModStart> * sock, "%s",
Buggy code:
 int midi_synth_load_patch ( int dev, int format, const char __user * addr, <START_BUG> int offs, int count, int pmgr_flag ) <END_BUG> { int orig_dev = synth_devs [ dev ] -> midi_dev ; struct sysex_info sysex ; int i ; unsigned long left, src_offs, eox_seen = 0 ; int first_byte = 1 ; int hdr_size = ( unsigned long ) & sysex. data [ 0 ] - ( unsigned long ) & sysex ; leave_sysex ( dev ) ; if (! prefix_cmd ( orig_dev, 0xf0 ) ) return 0 ; if ( format!= SYSEX_PATCH )  { <START_BUG> return - EINVAL ; <END_BUG> }  if ( count < hdr_size ) <START_BUG> { <END_BUG> return - EINVAL ;  } <START_BUG> count -= hdr_size ; <END_BUG> if ( copy_from_user ( & ( ( char * ) & sysex ) [ offs ], & ( addr ) [ offs ], hdr_size - offs ) )  return - EFAULT ; <START_BUG> if ( count < sysex. len ) <END_BUG>  { <START_BUG> sysex. len = count ; <END_BUG> }  left = sysex. len ; src_offs = 0 ; for ( i = 0 ; i < left &&! signal_pending ( current ) ; i ++ ) { unsigned char data ; if ( get_user ( data, ( unsigned char __user * ) ( addr + hdr_size + i ) ) ) return - EFAULT ; eox_seen = ( i > 0 && data & 0x80 ) ; if ( eox_seen && data!= 0xf7 ) data = 0xf7 ; if ( i == 0 ) { if ( data!= 0xf0 ) { printk ( KERN_WARNING "midi_synth:   Sysex   start   missing\\n" ) ; return - EINVAL ; } } while (! midi_devs [ orig_dev ] -> outputc ( orig_dev, ( unsigned char ) ( data & 0xff ) ) &&! signal_pending ( current ) ) schedule ( ) ; if (! first_byte && data & 0x80 ) return 0 ; first_byte = 0 ; } if (! eox_seen ) midi_outc ( orig_dev, 0xf7

Fix:
<S2SV_ModStart> * addr, <S2SV_ModEnd> int count, <S2SV_ModStart>!= SYSEX_PATCH ) <S2SV_ModEnd> return - EINVAL <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> if ( count <S2SV_ModStart> < hdr_size ) <S2SV_ModEnd> return - EINVAL <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> count -= hdr_size <S2SV_ModStart> copy_from_user ( & sysex, addr, hdr_size <S2SV_ModEnd> ) ) return <S2SV_ModStart> ; if ( ( unsigned ) count < ( unsigned ) <S2SV_ModEnd> sysex. len <S2SV_ModStart>. len ) <S2SV_ModEnd> sysex. len <S2SV_ModStart> = count ; <S2SV_ModEnd> left = sysex
Buggy code:
 int kvm_iommu_map_pages ( struct kvm * kvm, struct kvm_memory_slot * slot ) { gfn_t gfn, end_gfn ; pfn_t pfn ; int r = 0 ; struct iommu_domain * domain = kvm -> arch. iommu_domain ; int flags ; if (! domain ) return 0 ; gfn = slot -> base_gfn ; end_gfn = gfn + slot -> npages ; flags = IOMMU_READ ; if (! ( slot -> flags & KVM_MEM_READONLY ) ) flags |= IOMMU_WRITE ; if (! kvm -> arch. iommu_noncoherent ) flags |= IOMMU_CACHE ; while ( gfn < end_gfn ) { unsigned long page_size ; if ( iommu_iova_to_phys ( domain, gfn_to_gpa ( gfn ) ) ) { gfn += 1 ; continue ; } page_size = kvm_host_page_size ( kvm, gfn ) ; while ( ( gfn + ( page_size >> PAGE_SHIFT ) ) > end_gfn ) page_size >>= 1 ; while ( ( gfn << PAGE_SHIFT ) & ( page_size - 1 ) ) page_size >>= 1 ; while ( __gfn_to_hva_memslot ( slot, gfn ) & ( page_size - 1 ) ) page_size >>= 1 ; <START_BUG> pfn = kvm_pin_pages ( slot, gfn, page_size ) ; <END_BUG> if ( is_error_noslot_pfn ( pfn ) ) { gfn += 1 ; continue ; } r = iommu_map ( domain, gfn_to_gpa ( gfn ), pfn_to_hpa ( pfn ), page_size, flags ) ; if ( r ) { printk ( KERN_ERR "kvm_iommu_map_address:" "iommu   failed   to   map   pfn=%llx\\n", pfn ) ;  kvm_unpin_pages ( kvm, pfn, page_size ) ; <START_BUG> goto unmap_pages ; } gfn += page_size >> PAGE_SHIFT ; } return 0 ;<END_BUG>

Fix:
<S2SV_ModStart> gfn, page_size >> PAGE_SHIFT <S2SV_ModStart> pfn, page_size >> PAGE_SHIFT
Buggy code:
 static int einj_error_inject ( u32 type, u32 flags, u64 param1, u64 param2, u64 param3, u64 param4 ) { int rc ; <START_BUG> u64 base_addr, size ; <END_BUG> if ( flags && ( flags & ~ ( SETWA_FLAGS_APICID | SETWA_FLAGS_MEM | SETWA_FLAGS_PCIE_SBDF ) ) ) return - EINVAL ; if (! ( param_extension || acpi5 ) ) goto inject ; if ( type & ACPI5_VENDOR_BIT ) { if ( vendor_flags!= SETWA_FLAGS_MEM ) goto inject ; } else if (! ( type & MEM_ERROR_MASK ) &&! ( flags & SETWA_FLAGS_MEM ) ) goto inject ; base_addr = param1 & param2 ; size = ~ param2 + 1 ; if ( ( ( param2 & PAGE_MASK )!= PAGE_MASK ) || ( ( region_intersects ( base_addr, size, IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE )!= REGION_INTERSECTS ) && ( region_intersects ( base_addr, size, IORESOURCE_MEM, IORES_DESC_PERSISTENT_MEMORY )!= REGION_INTERSECTS ) ) ) return - EINVAL ; inject : mutex_lock ( & einj_mutex ) ; rc = __einj_error_inject ( type, flags, param1, param2, param3, param4 ) ; mutex_unlock ( & einj_mutex ) ; return rc ; }

Fix:
<S2SV_ModStart> base_addr, size ; if ( get_securelevel ( ) > 0 ) return - EPERM
Buggy code:
 <START_BUG> static bool do_write_pids ( pid_t tpid, const char * contrl, const char * cg, const char * file, const char * buf ) <END_BUG> { int sock [ 2 ] = { - 1, - 1 } ; pid_t qpid, cpid = - 1 ; FILE * pids_file = NULL ; bool answer = false, fail = false ; pids_file = open_pids_file ( contrl, cg ) ; if (! pids_file ) return false ; if ( socketpair ( AF_UNIX, SOCK_DGRAM, 0, sock ) < 0 ) { perror ( "socketpair" ) ; goto out ; } cpid = fork ( ) ; if ( cpid == - 1 ) goto out ; if (! cpid ) { fclose ( pids_file ) ; pid_from_ns_wrapper ( sock [ 1 ], tpid ) ; } const char * ptr = buf ; while ( sscanf ( ptr, "%d", & qpid ) == 1 ) { struct ucred cred ; char v ; if ( write ( sock [ 0 ], & qpid, sizeof ( qpid ) )!= sizeof ( qpid ) ) { fprintf ( stderr, "%s:   error   writing   pid   to   child:   %s\\n", __func__, strerror ( errno ) ) ; goto out ; } if ( recv_creds ( sock [ 0 ], & cred, & v ) ) { if ( v == '0' ) {  if ( fprintf ( pids_file, "%d", ( int ) cred. pid ) < 0 ) <START_BUG> fail = true ; } } ptr = strchr ( ptr, '\\n' ) ; if (! ptr ) break ; ptr ++ ; } qpid = - 1 ; if ( write ( sock [ 0 ], & qpid, sizeof ( qpid ) )!= sizeof ( qpid ) ) fprintf ( stderr, "Warning:   failed   to   ask   child   to   exit\\n" ) ; if (! fail ) answer = true ; out : if ( cpid!= - 1 ) wait_for_pid ( cpid ) ; if ( sock [ 0 ]!= - 1 ) { close ( sock [ 0 ] ) ; close ( sock [ 1 ] ) ; } if ( pids_file ) { if ( fclose ( pids<END_BUG>

Fix:
<S2SV_ModStart> pid_t tpid, uid_t tuid, <S2SV_ModStart> { if (! may_move_pid ( tpid, tuid, <S2SV_ModEnd> cred. pid <S2SV_ModStart>. pid ) ) { fail = true ; break ; } if ( fprintf ( pids_file, "%d", ( int ) cred. pid )
Buggy code:
 int ldbm_config_search_entry_callback ( Slapi_PBlock * pb __attribute__ ( ( unused ) ), Slapi_Entry * e, Slapi_Entry * entryAfter __attribute__ ( ( unused ) ), int * returncode, char * returntext, void * arg ) { char buf [ BUFSIZ ] ; struct berval * vals [ 2 ] ; struct berval val ; struct ldbminfo * li = ( struct ldbminfo * ) arg ; config_info * config ; int scope ; vals [ 0 ] = & val ; vals [ 1 ] = NULL ; returntext [ 0 ] = '\\0' ; PR_Lock ( li -> li_config_mutex ) ; if ( pb ) { slapi_pblock_get ( pb, SLAPI_SEARCH_SCOPE, & scope ) ; if ( scope == LDAP_SCOPE_BASE ) { char * * attrs = NULL ; slapi_pblock_get ( pb, SLAPI_SEARCH_ATTRS, & attrs ) ; if ( attrs ) { for ( size_t i = 0 ; attrs [ i ] ; i ++ ) { if ( ldbm_config_moved_attr ( attrs [ i ] ) ) { <START_BUG> slapi_pblock_set ( pb, SLAPI_PB_RESULT_TEXT, "at   least   one   required   attribute   has   been   moved   to   the   BDB   scecific   configuration   entry" ) ; <END_BUG> break ; } } } } } for ( config = ldbm_config ; config -> config_name!= NULL ; config ++ ) { if (! ( config -> config_flags & ( CONFIG_FLAG_ALWAYS_SHOW | CONFIG_FLAG_PREVIOUSLY_SET ) ) ) { continue ; } ldbm_config_get ( ( void * ) li, config, buf ) ; val. bv_val = buf ; val. bv_len = strlen ( buf ) ; slapi_entry_attr_replace ( e, config -> config_name, vals ) ; } PR_Unlock ( li -> li_config_mutex ) ; * returncode = LDAP_SUCCESS ; return SLAPI_DSE_CALLBACK_OK ; }

Fix:
<S2SV_ModStart> ( pb, SLAPI_RESULT_TEXT <S2SV_ModEnd>, "at <S2SV_blank> least <S2SV_blank> one <S2SV_blank> required <S2SV_blank> attribute <S2SV_blank> has <S2SV_blank> been <S2SV_blank> moved <S2SV_blank> to <S2SV_blank> the <S2SV_blank> BDB <S2SV_blank> scecific <S2SV_blank> configuration <S2SV_blank> entry" )
Buggy code:
 void SetDashSize ( double dashsize, double phase ) { <START_BUG> if ( dashsize ) outpos += sprintf ( outpos, "   [%12.3f]   %12.3f   d", dashsize, phase ) ; <END_BUG>  else outpos += sprintf ( outpos, "   []   0   d" ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( dashsize ) { sprintf ( outputbuffer <S2SV_ModEnd>, " <S2SV_blank> [%12.3f] <S2SV_blank> %12.3f <S2SV_blank> d", <S2SV_ModStart> phase ) ; sendClean ( outputbuffer ) ; } else send ( <S2SV_ModEnd> " <S2SV_blank> [] <S2SV_blank> 0 <S2SV_blank> d" ) ;
Buggy code:
 static int <START_BUG> ext2_xattr_cache_insert ( struct buffer_head * bh ) <END_BUG> { __u32 hash = le32_to_cpu ( HDR ( bh ) -> h_hash ) ;  struct mb_cache_entry * ce ; <START_BUG> int error ; <END_BUG> ce = mb_cache_entry_alloc ( ext2_xattr_cache, GFP_NOFS ) ;  if (! ce ) return - ENOMEM ; <START_BUG> error = mb_cache_entry_insert ( ce, bh -> b_bdev, bh -> b_blocknr, hash ) ; <END_BUG> if ( error ) {  mb_cache_entry_free ( ce ) ; <START_BUG> if ( error == - EBUSY ) { ea_bdebug ( bh, "already   in   cache   (%d   cache   entries)", atomic_read ( & ext2_xattr_cache -> c_entry_count ) ) ; error = 0 ; } <END_BUG> } else {  <START_BUG> ea_bdebug ( bh, "inserting   [%x]   (%d   cache   entries)", ( int ) hash, <END_BUG> atomic_read ( & ext2_xattr_cache -> c_entry_count ) ) ; mb_cache_entry_release ( ce ) ; } return error ; }

Fix:
<S2SV_ModStart> int ext2_xattr_cache_insert ( struct mb2_cache * cache, <S2SV_ModStart> h_hash ) ; <S2SV_ModEnd> int error ; <S2SV_ModStart> int error ; error = mb2_cache_entry_create ( cache, GFP_NOFS, hash <S2SV_ModEnd>, bh -> <S2SV_ModStart> bh -> b_blocknr <S2SV_ModEnd> ) ; if <S2SV_ModStart> error ) { <S2SV_ModEnd> if ( error <S2SV_ModStart> } } else <S2SV_ModEnd> ea_bdebug ( bh <S2SV_ModStart> ( bh, "inserting <S2SV_blank> [%x]" <S2SV_ModEnd>, ( int <S2SV_ModStart> int ) hash ) ; <S2SV_ModEnd> return error ;
Buggy code:
 <START_BUG> static void reset_fpf_position ( struct twopass_rc * p, <END_BUG> const FIRSTPASS_STATS * position ) { p -> stats_in = position ; }

Fix:
<S2SV_ModStart> void reset_fpf_position ( TWO_PASS <S2SV_ModEnd> * p,
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_sps ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; WORD32 i ; WORD32 vps_id ; WORD32 sps_max_sub_layers ; WORD32 sps_id ; WORD32 sps_temporal_id_nesting_flag ; sps_t * ps_sps ; profile_tier_lvl_info_t s_ptl ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; WORD32 ctb_log2_size_y = 0 ; BITS_PARSE ( "video_parameter_set_id", value, ps_bitstrm, 4 ) ; vps_id = value ; vps_id = CLIP3 ( vps_id, 0, MAX_VPS_CNT - 1 ) ; BITS_PARSE ( "sps_max_sub_layers_minus1", value, ps_bitstrm, 3 ) ; sps_max_sub_layers = value + 1 ; sps_max_sub_layers = CLIP3 ( sps_max_sub_layers, 1, 7 ) ; BITS_PARSE ( "sps_temporal_id_nesting_flag", value, ps_bitstrm, 1 ) ; sps_temporal_id_nesting_flag = value ; ret = ihevcd_profile_tier_level ( ps_bitstrm, & ( s_ptl ), 1, ( sps_max_sub_layers - 1 ) ) ; UEV_PARSE ( "seq_parameter_set_id", value, ps_bitstrm ) ; sps_id = value ; if ( ( sps_id >= MAX_SPS_CNT ) || ( sps_id < 0 ) ) { if ( ps_codec -> i4_sps_done ) return IHEVCD_UNSUPPORTED_SPS_ID ; else sps_id = 0 ; } ps_sps = ( ps_codec -> s_parse. ps_sps_base + MAX_

Fix:
<S2SV_ModStart> 1 ) ; if ( ( UWORD8 * ) ps_bitstrm -> pu4_buf > ps_bitstrm -> pu1_buf_max ) { return IHEVCD_INVALID_PARAMETER ; }
Buggy code:
 static ssize_t _hostsock_recvfrom ( oe_fd_t * sock_, void * buf, size_t count, int flags, <START_BUG> const struct oe_sockaddr * src_addr, <END_BUG> oe_socklen_t * addrlen ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ;  oe_socklen_t addrlen_in = 0 ; <START_BUG> oe_errno = 0 ; <END_BUG> if (! sock || ( count &&! buf ) )  OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( addrlen ) addrlen_in = * addrlen ; if ( oe_syscall_recvfrom_ocall ( & ret, sock -> host_fd, buf, count, flags, <START_BUG> ( struct oe_sockaddr * ) src_addr, <END_BUG> addrlen_in,  addrlen )!= OE_OK ) <START_BUG> { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <END_BUG> done :  return ret ; }

Fix:
<S2SV_ModStart> int flags, <S2SV_ModEnd> struct oe_sockaddr * <S2SV_ModStart> ; oe_socklen_t addrlen_in = 0 ; oe_socklen_t addrlen_out <S2SV_ModStart>! buf ) || count > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( src_addr && <S2SV_ModEnd> addrlen ) addrlen_in <S2SV_ModStart>, flags, <S2SV_ModEnd> src_addr, addrlen_in <S2SV_ModStart>, addrlen_in, & addrlen_out <S2SV_ModEnd> )!= OE_OK <S2SV_ModStart> ) ; } if ( src_addr && addrlen ) { if ( addrlen_out > sizeof ( struct oe_sockaddr_storage ) ) OE_RAISE_ERRNO ( OE_EINVAL ) ; * addrlen = addrlen_out ; } if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 static int usb_console_setup ( struct console * co, char * options ) { struct usbcons_info * info = & usbcons_info ; int baud = 9600 ; int bits = 8 ; int parity = 'n' ; int doflow = 0 ; int cflag = CREAD | HUPCL | CLOCAL ; char * s ; struct usb_serial * serial ; struct usb_serial_port * port ; int retval ; struct tty_struct * tty = NULL ; struct ktermios dummy ; if ( options ) { baud = simple_strtoul ( options, NULL, 10 ) ; s = options ; while ( * s >= '0' && * s <= '9' ) s ++ ; if ( * s ) parity = * s ++ ; if ( * s ) bits = * s ++ - '0' ; if ( * s ) doflow = ( * s ++ == 'r' ) ; } if ( baud == 0 ) baud = 9600 ; switch ( bits ) { case 7 : cflag |= CS7 ; break ; default : case 8 : cflag |= CS8 ; break ; } switch ( parity ) { case 'o' : case 'O' : cflag |= PARODD ; break ; case 'e' : case 'E' : cflag |= PARENB ; break ; } co -> cflag = cflag ; port = usb_serial_port_get_by_minor ( co -> index ) ; if ( port == NULL ) { pr_err ( "No   USB   device   connected   to   ttyUSB%i\\n", co -> index ) ; return - ENODEV ; } serial = port -> serial ; retval = usb_autopm_get_interface ( serial -> interface ) ; if ( retval ) goto error_get_interface ; tty_port_tty_set ( & port -> port, NULL ) ; info -> port = port ; ++ port -> port. count ; if (! tty_port_initialized ( & port -> port ) ) { if ( serial -> type -> set_termios ) { tty = kzalloc ( sizeof ( * tty ), GFP_KERNEL ) ; if (! tty ) { retval = - ENOMEM ; goto reset_open_count ; } kref_init ( & tty -> kref ) ; tty -> driver = usb_serial_

Fix:
<S2SV_ModStart> = 0 ; info -> port = NULL ;
Buggy code:
 bool __skb_flow_dissect ( const struct sk_buff * skb, struct flow_dissector * flow_dissector, void * target_container, void * data, __be16 proto, int nhoff, int hlen ) { struct flow_dissector_key_control * key_control ; struct flow_dissector_key_basic * key_basic ; struct flow_dissector_key_addrs * key_addrs ; struct flow_dissector_key_ports * key_ports ; struct flow_dissector_key_tags * key_tags ; struct flow_dissector_key_keyid * key_keyid ; <START_BUG> u8 ip_proto = 0 ; <END_BUG> if (! data ) { data = skb -> data ; proto = skb -> protocol ; nhoff = skb_network_offset ( skb ) ; hlen = skb_headlen ( skb ) ; } key_control = skb_flow_dissector_target ( flow_dissector, FLOW_DISSECTOR_KEY_CONTROL, target_container ) ; key_basic = skb_flow_dissector_target ( flow_dissector, FLOW_DISSECTOR_KEY_BASIC, target_container ) ; if ( skb_flow_dissector_uses_key ( flow_dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS ) ) { struct ethhdr * eth = eth_hdr ( skb ) ; struct flow_dissector_key_eth_addrs * key_eth_addrs ; key_eth_addrs = skb_flow_dissector_target ( flow_dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS, target_container ) ; memcpy ( key_eth_addrs, & eth -> h_dest, sizeof ( * key_eth_addrs ) ) ; } again : switch ( proto ) { case htons ( ETH_P_IP ) : { const struct iphdr * iph ; struct iphdr _iph ; ip : iph = __skb_header_pointer ( skb, nhoff, sizeof ( _iph ), data, hlen, & _iph ) ; if (! iph || iph -> ihl < 5 ) 

Fix:
<S2SV_ModStart> ip_proto = 0 ; bool ret = false <S2SV_ModStart> < 5 ) goto out_bad <S2SV_ModEnd> ; nhoff += <S2SV_ModStart>! iph ) goto out_bad <S2SV_ModEnd> ; ip_proto = <S2SV_ModStart>! vlan ) goto out_bad <S2SV_ModEnd> ; if ( <S2SV_ModStart>! hdr ) goto out_bad <S2SV_ModEnd> ; proto = <S2SV_ModStart> ; default : goto out_bad <S2SV_ModEnd> ; } } <S2SV_ModStart>! hdr ) goto out_bad <S2SV_ModEnd> ; if ( <S2SV_ModStart> FLOW_DISSECTOR_KEY_TIPC_ADDRS ; } goto out_good <S2SV_ModEnd> ; } case <S2SV_ModStart>! hdr ) goto out_bad <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ; } goto out_good ; } goto out_good <S2SV_ModEnd> ; } case <S2SV_ModStart> ; default : goto out_bad <S2SV_ModEnd> ; } ip_proto_again <S2SV_ModStart>! hdr ) goto out_bad <S2SV_ModEnd> ; if ( <S2SV_ModStart>! keyid ) goto out_bad <S2SV_ModEnd> ; if ( <S2SV_ModStart>! eth ) goto out_bad <S2SV_ModEnd> ; proto = <S2SV_ModStart>! opthdr ) goto out_bad <S2SV_ModEnd> ; ip_proto = <S2SV_ModStart> break ; } if ( skb_flow_dissector_uses_key ( flow_dissector, FLOW_DISSECTOR_KEY_PORTS ) ) { key_ports = skb_
Buggy code:
 void jiffies_to_timespec ( const unsigned long jiffies, struct timespec * value ) { <START_BUG> u64 nsec = ( u64 ) jiffies * TICK_NSEC ; <END_BUG>  value -> tv_sec = div_long_long_rem ( nsec, NSEC_PER_SEC, & value -> tv_nsec ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> value ) { u32 rem ; value -> tv_sec = div_u64_rem ( <S2SV_ModEnd> ( u64 ) <S2SV_ModStart> jiffies * TICK_NSEC, NSEC_PER_SEC, & rem ) <S2SV_ModStart> ; value -> tv_nsec = rem <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static unsigned int block_variance ( VP9_COMP * cpi, MACROBLOCK * x, BLOCK_SIZE bs ) { MACROBLOCKD * xd = & x -> e_mbd ; unsigned int var, sse ; int right_overflow = ( xd -> mb_to_right_edge < 0 )? ( ( - xd -> mb_to_right_edge ) >> 3 ) : 0 ; int bottom_overflow = ( xd -> mb_to_bottom_edge < 0 )? ( ( - xd -> mb_to_bottom_edge ) >> 3 ) : 0 ; if ( right_overflow || bottom_overflow ) { const int bw = 8 * num_8x8_blocks_wide_lookup [ bs ] - right_overflow ; const int bh = 8 * num_8x8_blocks_high_lookup [ bs ] - bottom_overflow ; int avg ; <START_BUG> variance ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, <END_BUG>  vp9_64_zeros, 0, bw, bh, & sse, & avg ) ; <START_BUG> <END_BUG> var = sse - ( ( ( int64_t ) avg * avg ) // ( bw * bh ) ) ;  return ( 256 * var ) // ( bw * bh ) ; } else { <START_BUG> var = cpi -> fn_ptr [ bs ]. vf ( x -> plane [ 0 ]. src. buf, <END_BUG> x -> plane [ 0 ]. src. stride,  vp9_64_zeros, 0, & sse ) ; <START_BUG> return ( 256 * var ) >> num_pels_log2_lookup [ bs ] ; } }<END_BUG>

Fix:
<S2SV_ModStart> int avg ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { aq_highbd_8_variance <S2SV_ModEnd> ( x -> <S2SV_ModStart>. stride, CONVERT_TO_BYTEPTR ( vp9_highbd_64_zeros ), 0, bw, bh, & sse, & avg ) ; sse >>= 2 * ( xd -> bd - 8 ) ; avg >>= ( xd -> bd - 8 ) ; } else { aq_variance ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, <S2SV_ModStart> avg ) ; } # else aq_variance ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, vp9_64_zeros, 0, bw, bh, & sse, & avg ) ; # endif <S2SV_ModStart> } else { # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { <S2SV_ModStart>. stride, CONVERT_TO_BYTEPTR ( vp9_highbd_64_zeros )
Buggy code:
 static long btrfs_ioctl_dev_info ( struct btrfs_fs_info * fs_info, void __user * arg ) { struct btrfs_ioctl_dev_info_args * di_args ; struct btrfs_device * dev ; int ret = 0 ; char * s_uuid = NULL ; di_args = memdup_user ( arg, sizeof ( * di_args ) ) ; if ( IS_ERR ( di_args ) ) return PTR_ERR ( di_args ) ; if (! btrfs_is_empty_uuid ( di_args -> uuid ) ) s_uuid = di_args -> uuid ; rcu_read_lock ( ) ; dev = btrfs_find_device ( fs_info -> fs_devices, di_args -> devid, s_uuid, <START_BUG> NULL ) ; <END_BUG> if (! dev ) { ret = - ENODEV ; goto out ; } di_args -> devid = dev -> devid ; di_args -> bytes_used = btrfs_device_get_bytes_used ( dev ) ; di_args -> total_bytes = btrfs_device_get_total_bytes ( dev ) ; memcpy ( di_args -> uuid, dev -> uuid, sizeof ( di_args -> uuid ) ) ; if ( dev -> name ) { strncpy ( di_args -> path, rcu_str_deref ( dev -> name ), sizeof ( di_args -> path ) - 1 ) ; di_args -> path [ sizeof ( di_args -> path ) - 1 ] = 0 ; } else { di_args -> path [ 0 ] = '\\0' ; } out : rcu_read_unlock ( ) ; if ( ret == 0 && copy_to_user ( arg, di_args, sizeof ( * di_args ) ) ) ret = - EFAULT ; kfree ( di_args ) ; return ret ; }

Fix:
<S2SV_ModStart> s_uuid, NULL, true
Buggy code:
 void free_bprm ( struct linux_binprm * bprm ) { free_arg_pages ( bprm ) ; if ( bprm -> cred ) { mutex_unlock ( & current -> signal -> cred_guard_mutex ) ; abort_creds ( bprm -> cred ) ; } <START_BUG> kfree ( bprm ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; } if ( bprm -> interp!= bprm -> filename ) kfree ( bprm -> interp ) ;