nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> struct key * find_keyring_by_name ( const char * name, bool skip_perm_check ) <END_BUG> { struct key * keyring ; int bucket ; if (! name ) return ERR_PTR ( - EINVAL ) ; bucket = keyring_hash ( name ) ; read_lock ( & keyring_name_lock ) ; if ( keyring_name_hash [ bucket ]. next ) { list_for_each_entry ( keyring, & keyring_name_hash [ bucket ], name_link ) { if (! kuid_has_mapping ( current_user_ns ( ), keyring -> user -> uid ) ) continue ; if ( test_bit ( KEY_FLAG_REVOKED, & keyring -> flags ) ) continue ; if ( strcmp ( keyring -> description, name )!= 0 ) continue ;  if (! skip_perm_check && <START_BUG> key_permission ( make_key_ref ( keyring, 0 ), KEY_NEED_SEARCH ) < 0 ) <END_BUG> continue ;  if (! refcount_inc_not_zero ( & keyring -> usage ) ) continue ; keyring -> last_used_at = current_kernel_time ( ). tv_sec ; goto out ; } } keyring = ERR_PTR ( - ENOKEY ) ; out : read_unlock ( & keyring_name_lock ) ; return keyring ; }

Fix:
<S2SV_ModStart> name, bool uid_keyring <S2SV_ModEnd> ) { struct <S2SV_ModStart> ; if ( uid_keyring ) { if (! test_bit ( KEY_FLAG_UID_KEYRING, & keyring -> flags ) ) continue ; } else { if ( <S2SV_ModEnd> key_permission ( make_key_ref <S2SV_ModStart> ) continue ; }
Buggy code:
 static int daemon_msg_open_req ( uint8 ver, struct daemon_slpars * pars, uint32 plen, char * source, size_t sourcelen ) { char errbuf [ PCAP_ERRBUF_SIZE ] ; char errmsgbuf [ PCAP_ERRBUF_SIZE ] ; pcap_t * fp ; int nread ; char sendbuf [ RPCAP_NETBUF_SIZE ] ; int sendbufidx = 0 ; struct rpcap_openreply * openreply ; if ( plen > sourcelen - 1 ) { pcap_snprintf ( errmsgbuf, PCAP_ERRBUF_SIZE, "Source   string   too   long" ) ; goto error ; } nread = sock_recv ( pars -> sockctrl, source, plen, SOCK_RECEIVEALL_YES | SOCK_EOF_IS_ERROR, errbuf, PCAP_ERRBUF_SIZE ) ; if ( nread == - 1 ) { rpcapd_log ( LOGPRIO_ERROR, "Read   from   client   failed:   %s", errbuf ) ; return - 1 ; } source [ nread ] = '\\0' ; plen -= nread ; <START_BUG> if ( ( fp = pcap_open_live ( source, <END_BUG> 1500, 0, 1000, errmsgbuf ) ) == NULL ) goto error ; if ( sock_bufferize ( NULL, sizeof ( struct rpcap_header ), NULL, & sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, errmsgbuf, PCAP_ERRBUF_SIZE ) == - 1 ) goto error ; rpcap_createhdr ( ( struct rpcap_header * ) sendbuf, ver, RPCAP_MSG_OPEN_REPLY, 0, sizeof ( struct rpcap_openreply ) ) ; openreply = ( struct rpcap_openreply * ) & sendbuf [ sendbufidx ] ; if ( sock_bufferize ( NULL, sizeof ( struct rpcap_openreply ), NULL, & sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, errmsgbuf, PCAP_ERRBUF_SIZE ) == - 1 ) goto error ; memset ( openreply, 0, sizeof ( struct rpcap_openreply ) ) ; openreply -> linktype = h

Fix:
<S2SV_ModStart> ; if ( is_url ( source ) ) { pcap_snprintf ( errmsgbuf, PCAP_ERRBUF_SIZE, "Source <S2SV_blank> string <S2SV_blank> refers <S2SV_blank> to <S2SV_blank> a <S2SV_blank> remote <S2SV_blank> device" ) ; goto error ; } if (
Buggy code:
 const char * le64addr_string ( netdissect_options * ndo, const u_char * ep ) { const unsigned int len = 8 ; register u_int i ; register char * cp ; <START_BUG> register struct enamemem * tp ; <END_BUG> char buf [ BUFSIZE ] ; tp = lookup_bytestring ( ndo, ep, len ) ;  if ( tp -> e_name ) <START_BUG> <END_BUG> return ( tp -> e_name ) ;  cp = buf ; for ( i = len ; i > 0 ; -- i ) { * cp ++ = hex [ * ( ep + i - 1 ) >> 4 ] ; * cp ++ = hex [ * ( ep + i - 1 ) & 0xf ] ; * cp ++ = ':' ; } cp -- ; * cp = '\\0' ; <START_BUG> tp -> e_name = strdup ( buf ) ; <END_BUG>  if ( tp -> e_name == NULL ) <START_BUG> ( * ndo -> ndo_error ) ( ndo, "le64addr_string:   strdup(buf)" ) ; <END_BUG> return ( tp -> e_name ) ;  }

Fix:
<S2SV_ModStart> ; register struct bsnamemem <S2SV_ModEnd> * tp ; <S2SV_ModStart> ( tp -> bs_name <S2SV_ModEnd> ) return ( <S2SV_ModStart> ( tp -> bs_name <S2SV_ModEnd> ) ; cp <S2SV_ModStart> ; tp -> bs_name <S2SV_ModEnd> = strdup ( <S2SV_ModStart> ( tp -> bs_name <S2SV_ModEnd> == NULL ) <S2SV_ModStart> ( tp -> bs_name <S2SV_ModEnd> ) ; }
Buggy code:
 static int read_SubStreamsInfo ( struct archive_read * a, struct _7z_substream_info * ss, struct _7z_folder * f, size_t numFolders ) { const unsigned char * p ; uint64_t * usizes ; size_t unpack_streams ; int type ; unsigned i ; uint32_t numDigests ; memset ( ss, 0, sizeof ( * ss ) ) ; for ( i = 0 ; i < numFolders ; i ++ ) f [ i ]. numUnpackStreams = 1 ; if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; type = * p ; if ( type == kNumUnPackStream ) { unpack_streams = 0 ; for ( i = 0 ; i < numFolders ; i ++ ) { if ( parse_7zip_uint64 ( a, & ( f [ i ]. numUnpackStreams ) ) < 0 ) return ( - 1 ) ; if ( UMAX_ENTRY < f [ i ]. numUnpackStreams ) return ( - 1 ) ; <START_BUG> unpack_streams += ( size_t ) f [ i ]. numUnpackStreams ; <END_BUG> } if ( ( p = header_bytes ( a, 1 ) ) == NULL ) return ( - 1 ) ; type = * p ; } else unpack_streams = numFolders ; ss -> unpack_streams = unpack_streams ; if ( unpack_streams ) { ss -> unpackSizes = calloc ( unpack_streams, sizeof ( * ss -> unpackSizes ) ) ; ss -> digestsDefined = calloc ( unpack_streams, sizeof ( * ss -> digestsDefined ) ) ; ss -> digests = calloc ( unpack_streams, sizeof ( * ss -> digests ) ) ; if ( ss -> unpackSizes == NULL || ss -> digestsDefined == NULL || ss -> digests == NULL ) return ( - 1 ) ; } usizes = ss -> unpackSizes ; for ( i = 0 ; i < numFolders ; i ++ ) { unsigned pack ; uint64_t sum ; if ( f [ i ]. numUnpackStreams == 0 ) continue ; sum = 0 ; if ( type == kSize ) { for ( pack = 1 ; pack < f [ i ]. numUnpackStreams ; pack ++ ) { if ( parse_7zip_uint64 ( a, usizes ) < 0 ) return (

Fix:
<S2SV_ModStart> 1 ) ; if ( unpack_streams > SIZE_MAX - UMAX_ENTRY ) { return ( - 1 ) ; }
Buggy code:
 static int simulate_llsc ( struct pt_regs * regs, unsigned int opcode ) { if ( ( opcode & OPCODE ) == LL ) { perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, <START_BUG> 1, 0, regs, 0 ) ; <END_BUG> return simulate_ll ( regs, opcode ) ; } if ( ( opcode & OPCODE ) == SC ) { perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS,  1, 0, regs, 0 ) ; <START_BUG> return simulate_sc ( regs, opcode ) ; } return - 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs, <S2SV_ModStart>, 1, <S2SV_ModEnd> regs, 0
Buggy code:
 static int get_cox ( Jpeg2000DecoderContext * s, Jpeg2000CodingStyle * c ) { uint8_t byte ; if ( bytestream2_get_bytes_left ( & s -> g ) < 5 ) return AVERROR_INVALIDDATA ; c -> nreslevels = bytestream2_get_byteu ( & s -> g ) + 1 ; if ( c -> nreslevels >= JPEG2000_MAX_RESLEVELS ) { av_log ( s -> avctx, AV_LOG_ERROR, "nreslevels   %d   is   invalid\\n", c -> nreslevels ) ; return AVERROR_INVALIDDATA ; } <START_BUG> if ( c -> nreslevels < s -> reduction_factor ) <END_BUG>  c -> nreslevels2decode = 1 ; <START_BUG> else c -> nreslevels2decode = c -> nreslevels - s -> reduction_factor ; c -> log2_cblk_width = ( bytestream2_get_byteu ( & s -> g ) & 15 ) + 2 ; c -> log2_cblk_height = ( bytestream2_get_byteu ( & s -> g ) & 15 ) + 2 ; if ( c -> log2_cblk_width > 10 || c -> log2_cblk_height > 10 || c -> log2_cblk_width + c -> log2_cblk_height > 12 ) { av_log ( s -> avctx, AV_LOG_ERROR, "cblk   size   invalid\\n" ) ; return AVERROR_INVALIDDATA ; } if ( c -> log2_cblk_width > 6 || c -> log2_cblk_height > 6 ) { avpriv_request_sample ( s -> avctx, "cblk   size   >   64" ) ; return AVERROR_PATCHWELCOME ; } c -> cblk_style = bytestream2_get_byteu ( & s -> g ) ; if ( c -> cblk_style!= 0 ) { av_log ( s -> avctx, AV_LOG_WARNING, "extra   cblk   styles   %X\\n", c -> cblk_style ) ; } c -> transform = bytestream2_get_<END_BUG>

Fix:
<S2SV_ModStart> c -> nreslevels <= <S2SV_ModEnd> s -> reduction_factor <S2SV_ModStart> -> reduction_factor ) { av_log ( s -> avctx, AV_LOG_ERROR, "reduction_factor <S2SV_blank> too <S2SV_blank> large <S2SV_blank> for <S2SV_blank> this <S2SV_blank> bitstream, <S2SV_blank> max <S2SV_blank> is <S2SV_blank> %d\\n", c -> nreslevels - 1 ) ; s -> reduction_factor = c -> nreslevels - 1 ; return AVERROR ( EINVAL ) ; } <S2SV_ModEnd> c -> nreslevels2decode
Buggy code:
 static int choose_volume ( struct archive_read * a, struct iso9660 * iso9660 ) { struct file_info * file ; int64_t skipsize ; struct vd * vd ; const void * block ; char seenJoliet ; vd = & ( iso9660 -> primary ) ; if (! iso9660 -> opt_support_joliet ) iso9660 -> seenJoliet = 0 ; if ( iso9660 -> seenJoliet && vd -> location > iso9660 -> joliet. location ) vd = & ( iso9660 -> joliet ) ; <START_BUG> skipsize = LOGICAL_BLOCK_SIZE * vd -> location ; <END_BUG> skipsize = __archive_read_consume ( a, skipsize ) ; if ( skipsize < 0 ) return ( ( int ) skipsize ) ; iso9660 -> current_position = skipsize ; block = __archive_read_ahead ( a, vd -> size, NULL ) ; if ( block == NULL ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, "Failed   to   read   full   block   when   scanning   " "ISO9660   directory   list" ) ; return ( ARCHIVE_FATAL ) ; } seenJoliet = iso9660 -> seenJoliet ; iso9660 -> seenJoliet = 0 ; file = parse_file_info ( a, NULL, block ) ; if ( file == NULL ) return ( ARCHIVE_FATAL ) ; iso9660 -> seenJoliet = seenJoliet ; if ( vd == & ( iso9660 -> primary ) && iso9660 -> seenRockridge && iso9660 -> seenJoliet ) iso9660 -> seenJoliet = 0 ; if ( vd == & ( iso9660 -> primary ) &&! iso9660 -> seenRockridge && iso9660 -> seenJoliet ) { vd = & ( iso9660 -> joliet ) ;  skipsize = LOGICAL_BLOCK_SIZE * vd -> location ; <START_BUG> skipsize -= iso9660 -> current_position ; skipsize = __archive_read_consume ( a, skipsize ) ; if ( skipsize < 0 ) return ( ( int ) skipsize ) ; iso9660 -> current_position += skipsize ; block = __archive_read_ahead<END_BUG>

Fix:
<S2SV_ModStart> = LOGICAL_BLOCK_SIZE * ( int64_t ) <S2SV_ModStart> = LOGICAL_BLOCK_SIZE * ( int64_t )
Buggy code:
 static int trusted_update ( struct key * key, struct key_preparsed_payload * prep ) { <START_BUG> struct trusted_key_payload * p = key -> payload. data [ 0 ] ; <END_BUG>  struct trusted_key_payload * new_p ; <START_BUG> struct trusted_key_options * new_o ; size_t datalen = prep -> datalen ; char * datablob ; int ret = 0 ; if (! p -> migratable ) return - EPERM ; if ( datalen <= 0 || datalen > 32767 ||! prep -> data ) return - EINVAL ; datablob = kmalloc ( datalen + 1, GFP_KERNEL ) ; if (! datablob ) return - ENOMEM ; new_o = trusted_options_alloc ( ) ; if (! new_o ) { ret = - ENOMEM ; goto out ; } new_p = trusted_payload_alloc ( key ) ; if (! new_p ) { ret = - ENOMEM ; goto out ; } memcpy ( datablob, prep -> data, datalen ) ; datablob [ datalen ] = '\\0' ; ret = datablob_parse ( datablob, new_p, new_o ) ; if ( ret!= Opt_update ) { ret = - EINVAL ; kfree ( new_p ) ; goto out ; } if (! new_o -> keyhandle ) { ret = - EINVAL ; kfree ( new_p ) ; goto out ; } new_p -> migratable = p -> migratable ; new_p -> key_len = p -> key_len ; memcpy ( new_p -> key, p -> key, p -> key_len ) ; dump_payload ( p ) ; dump_payload ( new_p ) ; ret = key_seal ( new_p, new_o ) ; if ( ret < 0 ) { pr_info ( "trusted_key:   key_seal   failed   (%d)\\n", ret ) ; kfree ( new_p ) ; goto out ; } if ( new_o -> pcrlock ) { ret = pcrlock ( new_o -> pcrlock ) ; if ( ret < 0 ) { pr_info ( "trusted_key:   pcrlock   failed   (%d)\\n", ret ) ; kfree (<END_BUG>

Fix:
<S2SV_ModStart> struct trusted_key_payload * p ; struct trusted_key_payload * new_p ; struct trusted_key_options * new_o ; size_t datalen = prep -> datalen ; char * datablob ; int ret = 0 ; if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) return - ENOKEY ; <S2SV_ModStart> 0 ] ; <S2SV_ModEnd> if (!
Buggy code:
 generic_ret * purgekeys_2_svc ( purgekeys_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg, * funcname ; <START_BUG> gss_buffer_desc client_name, service_name ; <END_BUG> OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; funcname = "kadm5_purgekeys" ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if (! cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) && ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_MODIFY, arg -> princ, NULL ) ) ) { ret. code = KADM5_AUTH_MODIFY ; log_unauth ( funcname, prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_purgekeys ( ( void * ) handle, arg -> princ, arg -> keepkvno ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( funcname, prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; } free

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 void free_pipe_info ( struct pipe_inode_info * pipe ) { <START_BUG> int i ; <END_BUG> for ( i = 0 ; i < pipe -> buffers ; i ++ ) { struct pipe_buffer * buf = pipe -> bufs + i ; if ( buf -> ops ) buf -> ops -> release ( pipe, buf ) ; } if ( pipe -> tmp_page ) __free_page ( pipe -> tmp_page ) ; kfree ( pipe -> bufs ) ; kfree ( pipe ) ; }

Fix:
<S2SV_ModStart> { int i ; account_pipe_buffers ( pipe, pipe -> buffers, 0 ) ; free_uid ( pipe -> user )
Buggy code:
 static int a2dp_command ( struct a2dp_stream_common * common, char cmd ) { char ack ; DEBUG ( "A2DP   COMMAND   %s", dump_a2dp_ctrl_event ( cmd ) ) ; <START_BUG> if ( send ( common -> ctrl_fd, & cmd, 1, MSG_NOSIGNAL ) == - 1 ) <END_BUG> { ERROR ( "cmd   failed   (%s)", strerror ( errno ) ) ; skt_disconnect ( common -> ctrl_fd ) ; common -> ctrl_fd = AUDIO_SKT_DISCONNECTED ; return - 1 ; } if ( a2dp_ctrl_receive ( common, & ack, 1 ) < 0 ) return - 1 ; DEBUG ( "A2DP   COMMAND   %s   DONE   STATUS   %d", dump_a2dp_ctrl_event ( cmd ), ack ) ; if ( ack == A2DP_CTRL_ACK_INCALL_FAILURE ) return ack ; if ( ack!= A2DP_CTRL_ACK_SUCCESS ) return - 1 ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> 1, MSG_NOSIGNAL )
Buggy code:
 int _mkp_stage_30 ( struct plugin * p, struct client_session * cs, struct session_request * sr ) { mk_ptr_t referer ; ( void ) p ; ( void ) cs ; PLUGIN_TRACE ( "[FD   %i]   Mandril   validating   URL", cs -> socket ) ; <START_BUG> if ( mk_security_check_url ( sr -> uri ) < 0 ) { <END_BUG> PLUGIN_TRACE ( "[FD   %i]   Close   connection,   blocked   URL", cs -> socket ) ; mk_api -> header_set_http_status ( sr, MK_CLIENT_FORBIDDEN ) ; return MK_PLUGIN_RET_CLOSE_CONX ; } PLUGIN_TRACE ( "[FD   %d]   Mandril   validating   hotlinking", cs -> socket ) ; referer = mk_api -> header_get ( & sr -> headers_toc, "Referer", strlen ( "Referer" ) ) ; if ( mk_security_check_hotlink ( sr -> uri_processed, sr -> host, referer ) < 0 ) { PLUGIN_TRACE ( "[FD   %i]   Close   connection,   deny   hotlinking.", cs -> socket ) ; mk_api -> header_set_http_status ( sr, MK_CLIENT_FORBIDDEN ) ; return MK_PLUGIN_RET_CLOSE_CONX ; } return MK_PLUGIN_RET_NOT_ME ; }

Fix:
<S2SV_ModStart> ( sr -> uri_processed <S2SV_ModEnd> ) < 0
Buggy code:
 void handle_lddfmna ( struct pt_regs * regs, unsigned long sfar, unsigned long sfsr ) { unsigned long pc = regs -> tpc ; unsigned long tstate = regs -> tstate ; u32 insn ; u64 value ; u8 freg ; int flag ; struct fpustate * f = FPUSTATE ; if ( tstate & TSTATE_PRIV ) die_if_kernel ( "lddfmna   from   kernel", regs ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, sfar ) ; <END_BUG> if ( test_thread_flag ( TIF_32BIT ) ) pc = ( u32 ) pc ; if ( get_user ( insn, ( u32 __user * ) pc )!= - EFAULT ) { int asi = decode_asi ( insn, regs ) ; u32 first, second ; int err ; if ( ( asi > ASI_SNFL ) || ( asi < ASI_P ) ) goto daex ; first = second = 0 ; err = get_user ( first, ( u32 __user * ) sfar ) ; if (! err ) err = get_user ( second, ( u32 __user * ) ( sfar + 4 ) ) ; if ( err ) { if (! ( asi & 0x2 ) ) goto daex ; first = second = 0 ; } save_and_clear_fpu ( ) ; freg = ( ( insn >> 25 ) & 0x1e ) | ( ( insn >> 20 ) & 0x20 ) ; value = ( ( ( u64 ) first ) << 32 ) | second ; if ( asi & 0x8 ) value = __swab64p ( & value ) ; flag = ( freg < 32 )? FPRS_DL : FPRS_DU ; if (! ( current_thread_info ( ) -> fpsaved [ 0 ] & FPRS_FEF ) ) { current_thread_info ( ) -> fpsaved [ 0 ] = FPRS_FEF ; current_thread_info ( ) -> gsr [ 0 ] = 0 ; } if (! ( current_thread_info ( ) -> fpsaved [ 0 ] & flag ) ) { if ( freg < 32 ) memset (

Fix:
<S2SV_ModStart> PERF_COUNT_SW_ALIGNMENT_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 static int pad_pkcs2 ( bn_t m, int * p_len, int m_len, int k_len, int operation ) { uint8_t pad, h1 [ RLC_MD_LEN ], h2 [ RLC_MD_LEN ] ; uint8_t * mask = RLC_ALLOCA ( uint8_t, k_len ) ; <START_BUG> int result = RLC_OK ; <END_BUG> bn_t t ; bn_null ( t ) ; RLC_TRY { bn_new ( t ) ; switch ( operation ) { case RSA_ENC : md_map ( h1, NULL, 0 ) ; bn_read_bin ( m, h1, RLC_MD_LEN ) ; * p_len = k_len - 2 * RLC_MD_LEN - 2 - m_len ; bn_lsh ( m, m, * p_len * 8 ) ; bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, 0x01 ) ; bn_lsh ( m, m, m_len * 8 ) ;  break ; <START_BUG> case RSA_ENC_FIN : rand_bytes ( h1, RLC_MD_LEN ) ; md_mgf ( mask, k_len - RLC_MD_LEN - 1, h1, RLC_MD_LEN ) ; bn_read_bin ( t, mask, k_len - RLC_MD_LEN - 1 ) ; for ( int i = 0 ; i < t -> used ; i ++ ) { m -> dp [ i ] ^= t -> dp [ i ] ; } bn_write_bin ( mask, k_len - RLC_MD_LEN - 1, m ) ; md_mgf ( h2, RLC_MD_LEN, mask, k_len - RLC_MD_LEN - 1 ) ; for ( int i = 0 ; i < RLC_MD_LEN ; i ++ ) { h1 [ i ] ^= h2 [ i ] ; } bn_read_bin ( t, h1, RLC_MD_LEN ) ; bn_lsh ( t, t, 8 * ( k_len - RLC_MD_LEN - 1 ) ) ; bn_add ( t, t, m ) ; bn_<END_BUG>

Fix:
<S2SV_ModStart> int result = RLC_ERR <S2SV_ModEnd> ; bn_t t <S2SV_ModStart> 8 ) ; result = RLC_OK ; <S2SV_ModStart> t ) ; result = RLC_OK ; <S2SV_ModStart> ; if ( <S2SV_ModEnd> bn_is_zero ( t <S2SV_ModStart> ) ) { <S2SV_ModEnd> m_len -= RLC_MD_LEN <S2SV_ModStart> [ i ] ^ <S2SV_ModEnd> h2 [ i <S2SV_ModStart> ] ; } bn_mod_2b ( m, m, 8 * m_len ) ; * p_len = bn_size_bin ( m ) ; ( * p_len ) -- ; bn_rsh ( t, m, * p_len * 8 ) ; if ( pad == 0 && bn_cmp_dig ( t, 1 ) == RLC_EQ ) { result = RLC_OK <S2SV_ModEnd> ; } bn_mod_2b <S2SV_ModStart>, m, * p_len * 8 ) ; * p_len = k_len - * p_len ; } <S2SV_ModEnd> break ; case <S2SV_ModStart> 8 ) ; result = RLC_OK ; <S2SV_ModStart> ) ; } result = RLC_OK ; <S2SV_ModStart> 8 ) ; pad = ( uint8_t ) t -> dp [ 0 ] ; if ( pad == RSA_PSS ) {
Buggy code:
 static void Sp_replace_regexp ( js_State * J ) { js_Regexp * re ; const char * source, * s, * r ; js_Buffer * sb = NULL ; int n, x ; Resub m ; source = checkstring ( J, 0 ) ; re = js_toregexp ( J, 1 ) ; <START_BUG> if ( js_regexec ( re -> prog, source, & m, 0 ) ) { <END_BUG> js_copy ( J, 0 ) ; return ; } re -> last = 0 ; loop : s = m. sub [ 0 ]. sp ; n = m. sub [ 0 ]. ep - m. sub [ 0 ]. sp ; if ( js_iscallable ( J, 2 ) ) { js_copy ( J, 2 ) ; js_pushundefined ( J ) ; for ( x = 0 ; m. sub [ x ]. sp ; ++ x ) js_pushlstring ( J, m. sub [ x ]. sp, m. sub [ x ]. ep - m. sub [ x ]. sp ) ; js_pushnumber ( J, s - source ) ; js_copy ( J, 0 ) ; js_call ( J, 2 + x ) ; r = js_tostring ( J, - 1 ) ; js_putm ( J, & sb, source, s ) ; js_puts ( J, & sb, r ) ; js_pop ( J, 1 ) ; } else { r = js_tostring ( J, 2 ) ; js_putm ( J, & sb, source, s ) ; while ( * r ) { if ( * r == '$' ) { switch ( * ( ++ r ) ) { case 0 : -- r ; case '$' : js_putc ( J, & sb, '$' ) ; break ; case '`' : js_putm ( J, & sb, source, s ) ; break ; case '\\'' : js_puts ( J, & sb, s + n ) ; break ; case '&' : js_putm ( J, & sb, s, s + n ) ; break ; case '0' : case '1' : case '2' : case '3' : case '4' : case '5' : case '6' : case '7' : case '8' : case '9' : x = * r -

Fix:
<S2SV_ModStart> ; if ( js_doregexec ( J, <S2SV_ModEnd> re -> prog <S2SV_ModStart> if (! js_doregexec ( J, <S2SV_ModEnd> re -> prog
Buggy code:
 <START_BUG> static void choose_partitioning ( VP9_COMP * cpi, <END_BUG> const TileInfo * const tile,  int mi_row, int mi_col ) { <START_BUG> VP9_COMMON * const cm = & cpi -> common ; <END_BUG> MACROBLOCK * x = & cpi -> mb ;  <START_BUG> MACROBLOCKD * xd = & cpi -> mb. e_mbd ; <END_BUG>  int i, j, k ; <START_BUG> <END_BUG> v64x64 vt ;  uint8_t * s ; const uint8_t * d ; int sp ; int dp ; int pixels_wide = 64, pixels_high = 64 ; <START_BUG> int_mv nearest_mv, near_mv ; <END_BUG> const YV12_BUFFER_CONFIG * yv12 = get_ref_frame_buffer ( cpi, LAST_FRAME ) ;  const struct scale_factors * const sf = & cm -> frame_refs [ LAST_FRAME - 1 ]. sf ; <START_BUG> vp9_zero ( vt ) ; <END_BUG> set_offsets ( cpi, tile, mi_row, mi_col, BLOCK_64X64 ) ;  <START_BUG> if ( xd -> mb_to_right_edge < 0 ) <END_BUG> pixels_wide += ( xd -> mb_to_right_edge >> 3 ) ; if ( xd -> mb_to_bottom_edge < 0 ) pixels_high += ( xd -> mb_to_bottom_edge >> 3 ) ; s = x -> plane [ 0 ]. src. buf ; sp = x -> plane [ 0 ]. src. stride ; if ( cm -> frame_type!= KEY_FRAME ) {  vp9_setup_pre_planes ( xd, 0, yv12, mi_row, mi_col, sf ) ; <START_BUG> xd -> mi [ 0 ] -> mbmi. ref_frame [ 0 ] = LAST_FRAME ; xd -> mi [ 0 ] -> mbmi. sb_type = BLOCK_64X64 ; vp9_find_best_ref_mvs ( xd, cm -> allow_high_precision_mv, xd -> mi [ 0 ] -> mbmi. ref_mvs [ LAST_FRAME ], & nearest_mv, & near_mv ) ; xd -> mi [ 0 ] -> mbmi. mv [ 0 ] = nearest_mv ; vp9_build_inter_predictors_sby ( xd<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> choose_partitioning ( VP9_COMP <S2SV_ModStart> const tile, <S2SV_ModEnd> MACROBLOCK * x <S2SV_ModStart> MACROBLOCK * x, int mi_row, int mi_col ) { VP9_COMMON * const cm = & cpi -> common <S2SV_ModEnd> ; MACROBLOCKD * <S2SV_ModStart> xd = & x -> <S2SV_ModEnd> e_mbd ; int <S2SV_ModStart> j, k, m <S2SV_ModStart> ; v64x64 vt ; v16x16 vt2 [ 16 ] ; int force_split [ 21 ] <S2SV_ModStart> = 64 ; int64_t thresholds [ 4 ] = { cpi -> vbp_thresholds [ 0 ], cpi -> vbp_thresholds [ 1 ], cpi -> vbp_thresholds [ 2 ], cpi -> vbp_thresholds [ 3 ] } ; const int is_key_frame = ( cm -> frame_type == KEY_FRAME ) ; const int use_4x4_partition = is_key_frame ; const int low_res = ( cm -> width <= 352 && cm -> height <= 288 ) ; int variance4x4downsample [ 16 ] ;
Buggy code:
 static vpx_codec_err_t image2yuvconfig ( const vpx_image_t * img, YV12_BUFFER_CONFIG * yv12 ) { <START_BUG> vpx_codec_err_t res = VPX_CODEC_OK ; <END_BUG> yv12 -> y_buffer = img -> planes [ VPX_PLANE_Y ] ; yv12 -> u_buffer = img -> planes [ VPX_PLANE_U ] ; yv12 -> v_buffer = img -> planes [ VPX_PLANE_V ] ;  yv12 -> y_crop_width = img -> d_w ; <START_BUG> yv12 -> y_crop_height = img -> d_h ; yv12 -> y_width = img -> d_w ; yv12 -> y_height = img -> d_h ; yv12 -> uv_width = yv12 -> y_width // 2 ; <END_BUG> yv12 -> uv_height = yv12 -> y_height // 2 ;  yv12 -> y_stride = img -> stride [ VPX_PLANE_Y ] ; yv12 -> uv_stride = img -> stride [ VPX_PLANE_U ] ; yv12 -> border = ( img -> stride [ VPX_PLANE_Y ] - img -> d_w ) // 2 ; return res ; }

Fix:
<S2SV_ModStart> yv12 ) { const int y_w = img -> d_w ; const int y_h = img -> d_h ; const int uv_w = ( img -> d_w + 1 ) // 2 ; const int uv_h = ( img -> d_h + 1 ) // 2 ; <S2SV_ModStart> -> y_crop_width = y_w ; yv12 -> y_crop_height = y_h ; yv12 -> y_width = y_w ; yv12 -> y_height = y_h ; yv12 -> uv_crop_width = uv_w ; yv12 -> uv_crop_height = uv_h ; yv12 -> uv_width = uv_w ; yv12 -> uv_height = uv_h ; yv12 -> y_stride = img -> stride [ VPX_PLANE_Y ] ; yv12 -> uv_stride = img -> stride [ VPX_PLANE_U ] ; yv12 -> border = ( img -> stride [ VPX_PLANE_Y ] - <S2SV_ModStart> img -> d_w ) <S2SV_ModEnd> // 2 ; <S2SV_ModStart> // 2 ; <S2SV_ModEnd> return res
Buggy code:
 long FS_FOpenFileRead ( const char * filename, fileHandle_t * file, qboolean uniqueFILE ) { searchpath_t * search ; long len ; <START_BUG> if (! fs_searchpaths ) <END_BUG> Com_Error ( ERR_FATAL, "Filesystem   call   made   without   initialization" ) ;  for ( search = fs_searchpaths ; search ; search = search -> next ) <START_BUG> <END_BUG> {  len = FS_FOpenFileReadDir ( filename, search, file, uniqueFILE, qfalse ) ; if ( file == NULL ) { if ( len > 0 ) return len ; } else { if ( len >= 0 && * file ) return len ; } } # ifdef FS_MISSING if ( missingFiles ) fprintf ( missingFiles, "%s\\n", filename ) ; # endif if ( file ) { * file = 0 ; return - 1 ; } else { return 0 ; } }

Fix:
<S2SV_ModStart> long len ; qboolean isLocalConfig ; <S2SV_ModStart> "Filesystem <S2SV_blank> call <S2SV_blank> made <S2SV_blank> without <S2SV_blank> initialization" ) ; isLocalConfig =! strcmp ( filename, "autoexec.cfg" ) ||! strcmp ( filename, Q3CONFIG_CFG ) ; <S2SV_ModStart> next ) { if ( isLocalConfig && search -> pack ) continue ;
Buggy code:
 static const u_char * ikev2_auth_print ( netdissect_options * ndo, u_char tpay, const struct isakmp_gen * ext, u_int item_len _U_, const u_char * ep, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { struct ikev2_auth a ; const char * v2_auth [ ] = { "invalid", "rsasig", "shared-secret", "dsssig" } ; const u_char * authdata = ( const u_char * ) ext + sizeof ( a ) ; unsigned int len ; ND_TCHECK ( * ext ) ; UNALIGNED_MEMCPY ( & a, ext, sizeof ( a ) ) ; ikev2_pay_print ( ndo, NPSTR ( tpay ), a. h. critical ) ; len = ntohs ( a. h. len ) ; <START_BUG> ND_PRINT ( ( ndo, "   len=%d   method=%s", len - 4, <END_BUG> STR_OR_ID ( a. auth_method, v2_auth ) ) ) ;  if ( 1 < ndo -> ndo_vflag && 4 < len ) { <START_BUG> ND_PRINT ( ( ndo, "   authdata=(" ) ) ; if (! rawprint ( ndo, ( const uint8_t * ) authdata, len - sizeof ( a ) ) ) goto trunc ; ND_PRINT ( ( ndo, ")   " ) ) ; <END_BUG> } else if ( ndo -> ndo_vflag && 4 < len ) {  if (! ike_show_somedata ( ndo, authdata, ep ) ) goto trunc ; } <START_BUG> return ( const u_char * ) ext + len ; <END_BUG> trunc : ND_PRINT ( ( ndo, "   [|%s]", NPSTR ( tpay ) ) ) ; return NULL ; }

Fix:
<S2SV_ModStart> ( ndo, " <S2SV_blank> len=%u <S2SV_blank> method=%s" <S2SV_ModEnd>, len - <S2SV_ModStart> ; if ( len > 4 ) { if ( <S2SV_ModEnd> ndo -> ndo_vflag <S2SV_ModStart> ndo -> ndo_vflag > 1 <S2SV_ModEnd> ) { ND_PRINT <S2SV_ModStart> ndo -> ndo_vflag <S2SV_ModEnd> ) { if <S2SV_ModStart> trunc ; } }
Buggy code:
 static int archive_read_format_zip_cleanup ( struct archive_read * a ) { struct zip * zip ; struct zip_entry * zip_entry, * next_zip_entry ; zip = ( struct zip * ) ( a -> format -> data ) ; # ifdef HAVE_ZLIB_H if ( zip -> stream_valid ) inflateEnd ( & zip -> stream ) ; # endif <START_BUG> # if HAVA_LZMA_H && HAVE_LIBLZMA <END_BUG> if ( zip -> zipx_lzma_valid ) { lzma_end ( & zip -> zipx_lzma_stream ) ; } # endif # ifdef HAVE_BZLIB_H if ( zip -> bzstream_valid ) { BZ2_bzDecompressEnd ( & zip -> bzstream ) ; } # endif free ( zip -> uncompressed_buffer ) ; if ( zip -> ppmd8_valid ) __archive_ppmd8_functions. Ppmd8_Free ( & zip -> ppmd8 ) ; if ( zip -> zip_entries ) { zip_entry = zip -> zip_entries ; while ( zip_entry!= NULL ) { next_zip_entry = zip_entry -> next ; archive_string_free ( & zip_entry -> rsrcname ) ; free ( zip_entry ) ; zip_entry = next_zip_entry ; } } free ( zip -> decrypted_buffer ) ; if ( zip -> cctx_valid ) archive_decrypto_aes_ctr_release ( & zip -> cctx ) ; if ( zip -> hctx_valid ) archive_hmac_sha1_cleanup ( & zip -> hctx ) ; free ( zip -> iv ) ; free ( zip -> erd ) ; free ( zip -> v_data ) ; archive_string_free ( & zip -> format_name ) ; free ( zip ) ; ( a -> format -> data ) = NULL ; return ( ARCHIVE_OK ) ; }

Fix:
<S2SV_ModStart> endif # if HAVE_LZMA_H <S2SV_ModEnd> && HAVE_LIBLZMA if
Buggy code:
 static Image * ReadLABELImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char geometry [ MaxTextExtent ], * property ; const char * label ; DrawInfo * draw_info ; Image * image ; MagickBooleanType status ; TypeMetric metrics ; size_t height, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; ( void ) ResetImagePage ( image, "0x0+0+0" ) ; property = InterpretImageProperties ( image_info, image, image_info -> filename ) ; ( void ) SetImageProperty ( image, "label", property ) ; property = DestroyString ( property ) ; label = GetImageProperty ( image, "label" ) ; draw_info = CloneDrawInfo ( image_info, ( DrawInfo * ) NULL ) ; draw_info -> text = ConstantString ( label ) ; metrics. width = 0 ; metrics. ascent = 0.0 ; status = GetMultilineTypeMetrics ( image, draw_info, & metrics ) ; if ( ( image -> columns == 0 ) && ( image -> rows == 0 ) ) { image -> columns = ( size_t ) floor ( metrics. width + draw_info -> stroke_width + 0.5 ) ; image -> rows = ( size_t ) floor ( metrics. height + draw_info -> stroke_width + 0.5 ) ; } else if ( ( strlen ( label ) > 0 ) && ( ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) || ( fabs ( image_info -> pointsize ) < MagickEpsilon ) ) ) { double high, low ; for ( ; ; draw_info -> pointsize *= 2.0 ) { ( void ) FormatLocaleString ( geometry, MaxTextExtent, "%+g%+g", - metrics. bounds. x1, metrics. ascent ) ; if ( draw_info -> gravity == UndefinedGravity ) ( void )

Fix:
<S2SV_ModStart> 0.0 ) ; ( void ) CloneString ( & <S2SV_ModStart> draw_info -> geometry, <S2SV_ModEnd> geometry ) ;
Buggy code:
 TEE_Result syscall_obj_generate_key ( unsigned long obj, unsigned long key_size, const struct utee_attribute * usr_params, unsigned long param_count ) { TEE_Result res ; struct tee_ta_session * sess ; const struct tee_cryp_obj_type_props * type_props ; struct tee_obj * o ; struct tee_cryp_obj_secret * key ; size_t byte_size ; TEE_Attribute * params = NULL ; res = tee_ta_get_current_session ( & sess ) ; if ( res!= TEE_SUCCESS ) return res ; res = tee_obj_get ( to_user_ta_ctx ( sess -> ctx ), tee_svc_uref_to_vaddr ( obj ), & o ) ; if ( res!= TEE_SUCCESS ) return res ; if ( ( o -> info. handleFlags & TEE_HANDLE_FLAG_PERSISTENT )!= 0 ) return TEE_ERROR_BAD_STATE ; if ( ( o -> info. handleFlags & TEE_HANDLE_FLAG_INITIALIZED )!= 0 ) return TEE_ERROR_BAD_STATE ; type_props = tee_svc_find_type_props ( o -> info. objectType ) ; if (! type_props ) return TEE_ERROR_NOT_SUPPORTED ; if ( key_size % type_props -> quanta!= 0 ) return TEE_ERROR_NOT_SUPPORTED ; if ( key_size < type_props -> min_size ) return TEE_ERROR_NOT_SUPPORTED ; if ( key_size > type_props -> max_size ) return TEE_ERROR_NOT_SUPPORTED ; <START_BUG> params = malloc ( sizeof ( TEE_Attribute ) * param_count ) ; <END_BUG> if (! params ) return TEE_ERROR_OUT_OF_MEMORY ; res = copy_in_attrs ( to_user_ta_ctx ( sess -> ctx ), usr_params, param_count, params ) ; if ( res!= TEE_SUCCESS ) goto out ; res = tee_svc_cryp_check_attr ( ATTR_USAGE_GENERATE_KEY, type_props, params, param_count ) ; if ( res!= TEE_SUCCESS ) goto out ; switch ( o -> info.

Fix:
<S2SV_ModStart> return TEE_ERROR_NOT_SUPPORTED ; size_t alloc_size = 0 ; if ( MUL_OVERFLOW ( sizeof ( TEE_Attribute ), param_count, & alloc_size ) ) return TEE_ERROR_OVERFLOW ; <S2SV_ModStart> = malloc ( alloc_size <S2SV_ModEnd> ) ; if
Buggy code:
 RD_BOOL cssp_read_tsrequest ( STREAM token, STREAM pubkey ) { STREAM s ; int length ; int tagval ; <START_BUG> s = tcp_recv ( NULL, 4 ) ; <END_BUG> if ( s == NULL ) return False ; if ( s -> p [ 0 ]!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) { logger ( Protocol, Error, "cssp_read_tsrequest(),   expected   BER_TAG_SEQUENCE|BER_TAG_CONSTRUCTED,   got   %x", s -> p [ 0 ] ) ; return False ; } if ( s -> p [ 1 ] < 0x80 ) length = s -> p [ 1 ] - 2 ; else if ( s -> p [ 1 ] == 0x81 ) length = s -> p [ 2 ] - 1 ; else if ( s -> p [ 1 ] == 0x82 ) length = ( s -> p [ 2 ] << 8 ) | s -> p [ 3 ] ; else return False ; s = tcp_recv ( s, length ) ;  if (! ber_in_header ( s, & tagval, & length ) || <START_BUG> tagval!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_CTXT_SPECIFIC | BER_TAG_CONSTRUCTED | 0 ) ) return False ; <END_BUG> in_uint8s ( s, length ) ;  if ( token ) { if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_CTXT_SPECIFIC | BER_TAG_CONSTRUCTED | 1 ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_CTXT_SPECIFIC | BER_

Fix:
<S2SV_ModStart> int tagval ; struct stream packet ; <S2SV_ModStart> length ) ; packet = * s ; <S2SV_ModStart> return False ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "cssp_read_tsrequest(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> version <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } <S2SV_ModStart> return False ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "cssp_read_tsrequest(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> token <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } s_realloc ( token, length ) ; s_reset ( token ) <S2SV_ModEnd> ; out_uint8p (
Buggy code:
 SQLWCHAR * _single_string_alloc_and_expand ( LPCSTR in ) { SQLWCHAR * chr ; int len = 0 ; if (! in ) { <START_BUG> return in ; <END_BUG> } while ( in [ len ]!= 0 ) { len ++ ; } chr = malloc ( sizeof ( SQLWCHAR ) * ( len + 1 ) ) ; len = 0 ; while ( in [ len ]!= 0 ) { chr [ len ] = in [ len ] ; len ++ ; } chr [ len ++ ] = 0 ; return chr ; }

Fix:
<S2SV_ModStart> ) { return NULL <S2SV_ModEnd> ; } while
Buggy code:
 void options_defaults ( ) { SERVICE_OPTIONS * service ; memset ( & new_global_options, 0, sizeof ( GLOBAL_OPTIONS ) ) ; memset ( & new_service_options, 0, sizeof ( SERVICE_OPTIONS ) ) ; new_service_options. next = NULL ; <START_BUG> parse_global_option ( CMD_SET_DEFAULTS, NULL, NULL ) ; <END_BUG> service = & new_service_options ; parse_service_option ( CMD_SET_DEFAULTS, & service, NULL, NULL ) ; }

Fix:
<S2SV_ModStart> ( CMD_SET_DEFAULTS, & new_global_options,
Buggy code:
 static ssize_t driver_override_show ( struct device * dev, struct device_attribute * attr, char * buf ) { struct platform_device * pdev = to_platform_device ( dev ) ; <START_BUG> return sprintf ( buf, "%s\\n", pdev -> driver_override ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> dev ) ; ssize_t len ; device_lock ( dev ) ; len = <S2SV_ModEnd> sprintf ( buf <S2SV_ModStart> driver_override ) ; device_unlock ( dev ) ; return len ;
Buggy code:
 static plist_t parse_bin_node ( struct bplist_data * bplist, const char * * object ) { uint16_t type = 0 ; uint64_t size = 0 ; if (! object ) return NULL ; type = ( * * object ) & BPLIST_MASK ; size = ( * * object ) & BPLIST_FILL ; ( * object ) ++ ; if ( size == BPLIST_FILL ) { switch ( type ) { case BPLIST_DATA : case BPLIST_STRING : case BPLIST_UNICODE : case BPLIST_ARRAY : case BPLIST_SET : case BPLIST_DICT : { uint16_t next_size = * * object & BPLIST_FILL ; if ( ( * * object & BPLIST_MASK )!= BPLIST_UINT ) { PLIST_BIN_ERR ( "%s:   invalid   size   node   type   for   node   type   0x%02x:   found   0x%02x,   expected   0x%02x\\n", __func__, type, * * object & BPLIST_MASK, BPLIST_UINT ) ; return NULL ; } ( * object ) ++ ; next_size = 1 << next_size ; if ( * object + next_size > bplist -> offset_table ) { PLIST_BIN_ERR ( "%s:   size   node   data   bytes   for   node   type   0x%02x   point   outside   of   valid   range\\n", __func__, type ) ; return NULL ; } size = UINT_TO_HOST ( * object, next_size ) ; ( * object ) += next_size ; break ; } default : break ; } } switch ( type ) { case BPLIST_NULL : switch ( size ) { case BPLIST_TRUE : { plist_data_t data = plist_new_plist_data ( ) ; data -> type = PLIST_BOOLEAN ; data -> boolval = TRUE ; data -> length = 1 ; return node_create ( NULL, data ) ; } case BPLIST_FALSE : { plist_data_t data = plist_new_plist_data ( ) ; data -> type = PLIST_BOOLEAN ; data -> boolval = FALSE ; data -> length

Fix:
<S2SV_ModStart> object + size < * object || * object + size <S2SV_ModStart> : if ( * object + size < * object || <S2SV_ModStart> size * 2 < * object || * object + size * 2 <S2SV_ModStart> object + size < * object || * object + size <S2SV_ModStart> object + size < * object || * object + size > bplist -> offset_table ) { PLIST_BIN_ERR ( "%s: <S2SV_blank> BPLIST_DICT <S2SV_blank> data <S2SV_blank> bytes <S2SV_blank> point <S2SV_blank> outside <S2SV_blank> of <S2SV_blank> valid <S2SV_blank> range\\n" <S2SV_ModEnd>, __func__ )
Buggy code:
 static int fetch_token ( OnigToken * tok, UChar * * src, UChar * end, ScanEnv * env ) { int r, num ; OnigCodePoint c ; OnigEncoding enc = env -> enc ; const OnigSyntaxType * syn = env -> syntax ; UChar * prev ; UChar * p = * src ; PFETCH_READY ; start : if ( PEND ) { tok -> type = TK_EOT ; return tok -> type ; } tok -> type = TK_STRING ; tok -> base = 0 ; tok -> backp = p ; PFETCH ( c ) ; if ( IS_MC_ESC_CODE ( c, syn ) ) { if ( PEND ) return ONIGERR_END_PATTERN_AT_ESCAPE ; tok -> backp = p ; PFETCH ( c ) ; tok -> u. c = c ; tok -> escaped = 1 ; switch ( c ) { case '*' : if (! IS_SYNTAX_OP ( syn, ONIG_SYN_OP_ESC_ASTERISK_ZERO_INF ) ) break ; tok -> type = TK_OP_REPEAT ; tok -> u. repeat. lower = 0 ; tok -> u. repeat. upper = REPEAT_INFINITE ; goto greedy_check ; break ; case '+' : if (! IS_SYNTAX_OP ( syn, ONIG_SYN_OP_ESC_PLUS_ONE_INF ) ) break ; tok -> type = TK_OP_REPEAT ; tok -> u. repeat. lower = 1 ; tok -> u. repeat. upper = REPEAT_INFINITE ; goto greedy_check ; break ; case '?' : if (! IS_SYNTAX_OP ( syn, ONIG_SYN_OP_ESC_QMARK_ZERO_ONE ) ) break ; tok -> type = TK_OP_REPEAT ; tok -> u. repeat. lower = 0 ; tok -> u. repeat. upper = 1 ; greedy_check : if (! PEND && PPEEK_IS ( '?' ) && IS_SYNTAX_OP ( syn, ONIG_SYN_OP_QMARK_NON_GREEDY ) ) { PFETCH ( c ) ; tok -> u. repeat. greedy = 0 ; tok -> u. repeat. possessive = 0

Fix:
<S2SV_ModStart> ')' ) ) { r = ONIGERR_INVALID_GROUP_NAME ; onig_scan_env_set_error_string ( env, r, p - 1, p + 1 ) ; return r ; } <S2SV_ModEnd> PINC ; name_end
Buggy code:
 static int tun_set_iff ( struct net * net, struct file * file, struct ifreq * ifr ) { struct tun_struct * tun ; struct tun_file * tfile = file -> private_data ; struct net_device * dev ; int err ; if ( tfile -> detached ) return - EINVAL ; dev = __dev_get_by_name ( net, ifr -> ifr_name ) ; if ( dev ) { if ( ifr -> ifr_flags & IFF_TUN_EXCL ) return - EBUSY ; if ( ( ifr -> ifr_flags & IFF_TUN ) && dev -> netdev_ops == & tun_netdev_ops ) tun = netdev_priv ( dev ) ; else if ( ( ifr -> ifr_flags & IFF_TAP ) && dev -> netdev_ops == & tap_netdev_ops ) tun = netdev_priv ( dev ) ; else return - EINVAL ; if (!! ( ifr -> ifr_flags & IFF_MULTI_QUEUE )!=!! ( tun -> flags & IFF_MULTI_QUEUE ) ) return - EINVAL ; if ( tun_not_capable ( tun ) ) return - EPERM ; err = security_tun_dev_open ( tun -> security ) ; if ( err < 0 ) return err ; err = tun_attach ( tun, file, ifr -> ifr_flags & IFF_NOFILTER ) ; if ( err < 0 ) return err ; if ( tun -> flags & IFF_MULTI_QUEUE && ( tun -> numqueues + tun -> numdisabled > 1 ) ) { return 0 ; } } else { char * name ; unsigned long flags = 0 ; int queues = ifr -> ifr_flags & IFF_MULTI_QUEUE? MAX_TAP_QUEUES : 1 ; if (! ns_capable ( net -> user_ns, CAP_NET_ADMIN ) ) return - EPERM ; err = security_tun_dev_create ( ) ; if ( err < 0 ) return err ; if ( ifr -> ifr_flags & IFF_TUN ) { flags |= IFF_TUN ; name = "tun%d

Fix:
<S2SV_ModStart> - ENOMEM ; err = dev_get_valid_name ( net, dev, name ) ; if ( err ) goto err_free_dev ;
Buggy code:
 int perf_cpu_time_max_percent_handler ( struct ctl_table * table, int write, void __user * buffer, size_t * lenp, loff_t * ppos ) { <START_BUG> int ret = proc_dointvec ( table, write, buffer, lenp, ppos ) ; <END_BUG> if ( ret ||! write ) return ret ; if ( sysctl_perf_cpu_time_max_percent == 100 || sysctl_perf_cpu_time_max_percent == 0 ) { printk ( KERN_WARNING "perf:   Dynamic   interrupt   throttling   disabled,   can   hang   your   system!\\n" ) ; WRITE_ONCE ( perf_sample_allowed_ns, 0 ) ; } else { update_perf_cpu_limits ( ) ; } return 0 ; }

Fix:
<S2SV_ModStart> int ret = proc_dointvec_minmax <S2SV_ModEnd> ( table,
Buggy code:
 u_int chdlc_print ( netdissect_options * ndo, register const u_char * p, u_int length ) { u_int proto ; <START_BUG> proto = EXTRACT_16BITS ( & p [ 2 ] ) ; <END_BUG> if ( ndo -> ndo_eflag ) { ND_PRINT ( ( ndo, "%s,   ethertype   %s   (0x%04x),   length   %u:   ", tok2str ( chdlc_cast_values, "0x%02x", p [ 0 ] ), tok2str ( ethertype_values, "Unknown", proto ), proto, length ) ) ; } length -= CHDLC_HDRLEN ; p += CHDLC_HDRLEN ; switch ( proto ) { case ETHERTYPE_IP : ip_print ( ndo, p, length ) ; break ; case ETHERTYPE_IPV6 : ip6_print ( ndo, p, length ) ; break ; case CHDLC_TYPE_SLARP : chdlc_slarp_print ( ndo, p, length ) ; break ; # if 0 case CHDLC_TYPE_CDP : chdlc_cdp_print ( p, length ) ; break ; # endif case ETHERTYPE_MPLS : case ETHERTYPE_MPLS_MULTI : mpls_print ( ndo, p, length ) ; break ; case ETHERTYPE_ISO :  if ( * ( p + 1 ) == 0x81 || <START_BUG> * ( p + 1 ) == 0x82 || * ( p + 1 ) == 0x83 ) isoclns_print ( ndo, p + 1, length - 1, ndo -> ndo_snapend - p - 1 ) ; else isoclns_print ( ndo, p, length, ndo -> ndo_snapend - p ) ; break ; default : if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "unknown   CHDLC   protocol   (0x%04x)", proto ) ) ; break ; } return ( CHDLC_HDRLEN ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> u_int proto ; const u_char * bp = p ; if ( length < CHDLC_HDRLEN ) goto trunc ; ND_TCHECK2 ( * p, CHDLC_HDRLEN ) ; <S2SV_ModStart> : if ( length < 2 ) goto trunc ; ND_TCHECK_16BITS ( p ) ; if ( <S2SV_ModStart> CHDLC_HDRLEN ) ; trunc : ND_PRINT ( ( ndo, "[|chdlc]" ) ) ; return ndo -> ndo_snapend - bp ;
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char explicit_vr [ MaxTextExtent ], implicit_vr [ MaxTextExtent ], magick [ MaxTextExtent ], photometric [ MaxTextExtent ] ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, index, * redmap ; MagickBooleanType explicit_file, explicit_retry, polarity, sequence, use_explicit ; MagickOffsetType offset ; Quantum * scale ; register IndexPacket * indexes ; register ssize_t i, x ; register PixelPacket * q ; register unsigned char * p ; size_t bits_allocated, bytes_per_pixel, colors, depth, height, length, mask, max_value, number_scenes, quantum, samples_per_pixel, signed_data, significant_bits, status, width, window_width ; ssize_t count, scene, window_center, y ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 8UL ; image -> endian = LSBEndian ; stream_info = ( DCMStreamInfo * ) AcquireMagickMemory ( sizeof ( * stream_info ) ) ; if ( stream_info == ( DCMStreamInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; ( void ) ResetMagickMemory ( stream_info, 0, sizeof ( * stream_info ) ) ; count = ReadBlob ( image, 128, ( unsigned char * ) magick ) ; if ( count!= 128 ) ThrowReaderException ( Corrupt

Fix:
<S2SV_ModStart> = depth ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; break ; }
Buggy code:
 static xfs_failaddr_t xfs_agf_verify ( struct xfs_buf * bp ) { struct xfs_mount * mp = bp -> b_mount ; struct xfs_agf * agf = XFS_BUF_TO_AGF ( bp ) ; if ( xfs_sb_version_hascrc ( & mp -> m_sb ) ) { if (! uuid_equal ( & agf -> agf_uuid, & mp -> m_sb. sb_meta_uuid ) ) return __this_address ; if (! xfs_log_check_lsn ( mp, be64_to_cpu ( XFS_BUF_TO_AGF ( bp ) -> agf_lsn ) ) ) return __this_address ; } if (! xfs_verify_magic ( bp, agf -> agf_magicnum ) ) return __this_address ; if (! ( XFS_AGF_GOOD_VERSION ( be32_to_cpu ( agf -> agf_versionnum ) ) && be32_to_cpu ( agf -> agf_freeblks ) <= be32_to_cpu ( agf -> agf_length ) && be32_to_cpu ( agf -> agf_flfirst ) < xfs_agfl_size ( mp ) && be32_to_cpu ( agf -> agf_fllast ) < xfs_agfl_size ( mp ) && <START_BUG> be32_to_cpu ( agf -> agf_flcount ) <= xfs_agfl_size ( mp ) ) ) <END_BUG> return __this_address ; if ( be32_to_cpu ( agf -> agf_levels [ XFS_BTNUM_BNO ] ) < 1 || be32_to_cpu ( agf -> agf_levels [ XFS_BTNUM_CNT ] ) < 1 || be32_to_cpu ( agf -> agf_levels [ XFS_BTNUM_BNO ] ) > XFS_BTREE_MAXLEVELS || be32_to_cpu ( agf -> agf_levels [ XFS_BTNUM_CNT ] ) > XFS_BTREE_MAXLEVELS ) return __this_address ; if ( xfs_sb

Fix:
<S2SV_ModStart> ( mp ) ) ) return __this_address ; if ( be32_to_cpu ( agf -> agf_length ) > mp -> m_sb. sb_dblocks ) return __this_address ; if ( be32_to_cpu ( agf -> agf_freeblks ) < be32_to_cpu ( agf -> agf_longest ) || be32_to_cpu ( agf -> agf_freeblks ) > be32_to_cpu ( agf -> agf_length <S2SV_ModStart> ; if ( xfs_sb_version_hasrmapbt ( & mp -> m_sb ) && be32_to_cpu ( agf -> agf_rmap_blocks ) > be32_to_cpu ( agf -> agf_length ) ) return __this_address ; if ( <S2SV_ModStart> agf_btreeblks ) > be32_to_cpu ( agf -> agf_length ) ) return __this_address ; if ( xfs_sb_version_hasreflink ( & mp -> m_sb ) && be32_to_cpu ( agf -> agf_refcount_blocks )
Buggy code:
 static int handle_pte_fault ( struct mm_struct * mm, struct vm_area_struct * vma, unsigned long address, pte_t * pte, pmd_t * pmd, unsigned int flags ) { pte_t entry ; spinlock_t * ptl ; entry = * pte ; barrier ( ) ; if (! pte_present ( entry ) ) { if ( pte_none ( entry ) ) { <START_BUG> if ( vma -> vm_ops ) { <END_BUG> if ( likely ( vma -> vm_ops -> fault ) ) return do_fault ( mm, vma, address, pte,  pmd, flags, entry ) ; <START_BUG> } return do_anonymous_page ( mm, vma, address, <END_BUG> pte, pmd, flags ) ;  } return do_swap_page ( mm, vma, address, pte, pmd, flags, entry ) ; } if ( pte_protnone ( entry ) ) return do_numa_page ( mm, vma, address, entry, pte, pmd ) ; ptl = pte_lockptr ( mm, pmd ) ; spin_lock ( ptl ) ; if ( unlikely (! pte_same ( * pte, entry ) ) ) goto unlock ; if ( flags & FAULT_FLAG_WRITE ) { if (! pte_write ( entry ) ) return do_wp_page ( mm, vma, address, pte, pmd, ptl, entry ) ; entry = pte_mkdirty ( entry ) ; } entry = pte_mkyoung ( entry ) ; if ( ptep_set_access_flags ( vma, address, pte, entry, flags & FAULT_FLAG_WRITE ) ) { update_mmu_cache ( vma, address, pte ) ; } else { if ( flags & FAULT_FLAG_WRITE ) flush_tlb_fix_spurious_fault ( vma, address ) ; } unlock : pte_unmap_unlock ( pte, ptl ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> vm_ops ) <S2SV_ModEnd> return do_fault ( <S2SV_ModStart>, pte, pmd, flags, entry ) ; <S2SV_ModEnd> return do_anonymous_page ( <S2SV_ModStart>, address, pte, pmd, <S2SV_ModEnd> flags ) ;
Buggy code:
 static OPJ_BOOL opj_j2k_write_first_tile_part ( opj_j2k_t * p_j2k, OPJ_BYTE * p_data, OPJ_UINT32 * p_data_written, OPJ_UINT32 p_total_data_size, opj_stream_private_t * p_stream, struct opj_event_mgr * p_manager ) { OPJ_UINT32 l_nb_bytes_written = 0 ; OPJ_UINT32 l_current_nb_bytes_written ; OPJ_BYTE * l_begin_data = 00 ; opj_tcd_t * l_tcd = 00 ; opj_cp_t * l_cp = 00 ; l_tcd = p_j2k -> m_tcd ; l_cp = & ( p_j2k -> m_cp ) ; l_tcd -> cur_pino = 0 ; p_j2k -> m_specific_param. m_encoder. m_current_poc_tile_part_number = 0 ; l_current_nb_bytes_written = 0 ; l_begin_data = p_data ; <START_BUG> if (! opj_j2k_write_sot ( p_j2k, p_data, & l_current_nb_bytes_written, p_stream, <END_BUG> p_manager ) ) { return OPJ_FALSE ; } l_nb_bytes_written += l_current_nb_bytes_written ; p_data += l_current_nb_bytes_written ; p_total_data_size -= l_current_nb_bytes_written ; if (! OPJ_IS_CINEMA ( l_cp -> rsiz ) ) { # if 0 for ( compno = 1 ; compno < p_j2k -> m_private_image -> numcomps ; compno ++ ) { l_current_nb_bytes_written = 0 ; opj_j2k_write_coc_in_memory ( p_j2k, compno, p_data, & l_current_nb_bytes_written, p_manager ) ; l_nb_bytes_written += l_current_nb_bytes_written ; p_data += l_current

Fix:
<S2SV_ModStart>, p_data, p_total_data_size,