nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int propagate_one ( struct mount * m ) { struct mount * child ; int type ; if ( IS_MNT_NEW ( m ) ) return 0 ; if (! is_subdir ( mp -> m_dentry, m -> mnt. mnt_root ) ) return 0 ; if ( peers ( m, last_dest ) ) { type = CL_MAKE_SHARED ; } else { <START_BUG> struct mount * n, * p ; <END_BUG> for ( n = m ; ; n = p ) { p = n -> mnt_master ;  if ( p == dest_master || IS_MNT_MARKED ( p ) ) { <START_BUG> while ( last_dest -> mnt_master!= p ) { last_source = last_source -> mnt_master ; last_dest = last_source -> mnt_parent ; } if (! peers ( n, last_dest ) ) { last_source = last_source -> mnt_master ; last_dest = last_source -> mnt_parent ; } break ; } } type = CL_SLAVE ; if ( IS_MNT_SHARED ( m ) ) type |= CL_MAKE_SHARED ; } if ( m -> mnt_ns -> user_ns!= user_ns ) type |= CL_UNPRIVILEGED ; child = copy_tree ( last_source, last_source -> mnt. mnt_root, type ) ; if ( IS_ERR ( child ) ) return PTR_ERR ( child ) ; child -> mnt. mnt_flags &= ~ MNT_LOCKED ; mnt_set_mountpoint ( m, mp, child ) ; last_dest = m ; last_source = child ; if ( m -> mnt_master!= dest_master ) { read_seqlock_excl ( & mount_lock ) ; SET_MNT_MARK ( m -> mnt_master ) ; read_sequnlock_excl ( & mount_lock ) ; } hlist_add_head ( & child -> mnt_hash, list ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart>, * p ; bool done <S2SV_ModStart> p ) ) break ; } do { struct mount * parent = last_source -> mnt_parent ; if ( last_source == first_source ) break ; done = parent -> mnt_master == p ; if ( done && peers ( n, parent ) ) break ; last_source = last_source -> mnt_master ; } while (! done ) ; <S2SV_ModEnd> type = CL_SLAVE
Buggy code:
 static int encode_open_downgrade ( struct xdr_stream * xdr, const struct nfs_closeargs * arg ) { __be32 * p ; RESERVE_SPACE ( 4 + NFS4_STATEID_SIZE + 4 ) ; WRITE32 ( OP_OPEN_DOWNGRADE ) ; WRITEMEM ( arg -> stateid -> data, NFS4_STATEID_SIZE ) ; WRITE32 ( arg -> seqid -> sequence -> counter ) ; <START_BUG> encode_share_access ( xdr, arg -> open_flags ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart>, arg -> fmode <S2SV_ModEnd> ) ; return
Buggy code:
 void pin_remove ( struct fs_pin * pin ) { spin_lock ( & pin_lock ) ; <START_BUG> hlist_del ( & pin -> m_list ) ; <END_BUG>  hlist_del ( & pin -> s_list ) ; <START_BUG> spin_unlock ( & pin_lock ) ; spin_lock_irq ( & pin -> wait. lock ) ; pin -> done = 1 ; wake_up_locked ( & pin -> wait ) ; spin_unlock_irq ( & pin -> wait. lock ) ; }<END_BUG>

Fix:
<S2SV_ModStart> pin_lock ) ; hlist_del_init <S2SV_ModEnd> ( & pin <S2SV_ModStart> m_list ) ; hlist_del_init <S2SV_ModEnd> ( & pin
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_slice_header ( codec_t * ps_codec, nal_header_t * ps_nal ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; <START_BUG> WORD32 i ; <END_BUG> WORD32 sps_id ; pps_t * ps_pps ; sps_t * ps_sps ; slice_header_t * ps_slice_hdr ; WORD32 disable_deblocking_filter_flag ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; WORD32 idr_pic_flag ; WORD32 pps_id ; WORD32 first_slice_in_pic_flag ; WORD32 no_output_of_prior_pics_flag = 0 ; WORD8 i1_nal_unit_type = ps_nal -> i1_nal_unit_type ; WORD32 num_poc_total_curr = 0 ; WORD32 slice_address ; if ( ps_codec -> i4_slice_error == 1 ) return ret ; idr_pic_flag = ( NAL_IDR_W_LP == i1_nal_unit_type ) || ( NAL_IDR_N_LP == i1_nal_unit_type ) ; BITS_PARSE ( "first_slice_in_pic_flag", first_slice_in_pic_flag, ps_bitstrm, 1 ) ; if ( ( NAL_BLA_W_LP <= i1_nal_unit_type ) && ( NAL_RSV_RAP_VCL23 >= i1_nal_unit_type ) ) { BITS_PARSE ( "no_output_of_prior_pics_flag", no_output_of_prior_pics_flag, ps_bitstrm, 1 ) ; } UEV_PARSE ( "pic_parameter_set_id", pps_id, ps_bitstrm ) ; pps_id = CLIP3 ( pps_id, 0, MAX_PPS_CNT - 2 ) ; ps_pps = ps_codec -> s_

Fix:
<S2SV_ModStart> ; WORD32 i, j <S2SV_ModStart> ; for ( j = 0 ; j < ps_codec -> i4_max_dpb_size ; j <S2SV_ModEnd> ++ ) { <S2SV_ModStart> -> pv_mv_buf_mgr, j <S2SV_ModEnd>, BUF_MGR_REF )
Buggy code:
 static int skt_write ( int fd, const void * p, size_t len ) { int sent ; struct pollfd pfd ; FNLOG ( ) ; pfd. fd = fd ; pfd. events = POLLOUT ; <START_BUG> if ( poll ( & pfd, 1, 500 ) == 0 ) <END_BUG> return 0 ; ts_log ( "skt_write", len, NULL ) ;  if ( ( sent = send ( fd, p, len, MSG_NOSIGNAL ) ) == - 1 ) <START_BUG> { ERROR ( "write   failed   with   errno=%d\\n", errno ) ; return - 1 ; } return sent ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> 1, 500 ) <S2SV_ModStart> ( sent = TEMP_FAILURE_RETRY ( <S2SV_ModStart> len, MSG_NOSIGNAL )
Buggy code:
 static int trusted_update ( struct key * key, struct key_preparsed_payload * prep ) { struct trusted_key_payload * p ; struct trusted_key_payload * new_p ; struct trusted_key_options * new_o ; size_t datalen = prep -> datalen ; char * datablob ; int ret = 0 ; <START_BUG> if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) <END_BUG> return - ENOKEY ; p = key -> payload. data [ 0 ] ; if (! p -> migratable ) return - EPERM ; if ( datalen <= 0 || datalen > 32767 ||! prep -> data ) return - EINVAL ; datablob = kmalloc ( datalen + 1, GFP_KERNEL ) ; if (! datablob ) return - ENOMEM ; new_o = trusted_options_alloc ( ) ; if (! new_o ) { ret = - ENOMEM ; goto out ; } new_p = trusted_payload_alloc ( key ) ; if (! new_p ) { ret = - ENOMEM ; goto out ; } memcpy ( datablob, prep -> data, datalen ) ; datablob [ datalen ] = '\\0' ; ret = datablob_parse ( datablob, new_p, new_o ) ; if ( ret!= Opt_update ) { ret = - EINVAL ; kzfree ( new_p ) ; goto out ; } if (! new_o -> keyhandle ) { ret = - EINVAL ; kzfree ( new_p ) ; goto out ; } new_p -> migratable = p -> migratable ; new_p -> key_len = p -> key_len ; memcpy ( new_p -> key, p -> key, p -> key_len ) ; dump_payload ( p ) ; dump_payload ( new_p ) ; ret = key_seal ( new_p, new_o ) ; if ( ret < 0 ) { pr_info ( "trusted_key:   key_seal   failed   (%d)\\n", ret ) ; kzfree ( new_p ) ; goto out ; } if ( new_o -> pcrlock ) { ret = pcrlock ( new_o -> pcrlock ) ; if ( ret < 0 ) { pr

Fix:
<S2SV_ModStart> ; if ( key_is_negative ( key <S2SV_ModEnd> ) ) return
Buggy code:
 static int snd_timer_user_release ( struct inode * inode, struct file * file ) { struct snd_timer_user * tu ; if ( file -> private_data ) { tu = file -> private_data ; file -> private_data = NULL ; <START_BUG> if ( tu -> timeri ) <END_BUG>  snd_timer_close ( tu -> timeri ) ; <START_BUG> kfree ( tu -> queue ) ; kfree ( tu -> tqueue ) ; kfree ( tu ) ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> = NULL ; mutex_lock ( & tu -> ioctl_lock ) ; <S2SV_ModStart> tu -> timeri ) ; mutex_unlock ( & tu -> ioctl_lock
Buggy code:
 bgp_size_t bgp_packet_attribute ( struct bgp * bgp, struct peer * peer, struct stream * s, struct attr * attr, struct bpacket_attr_vec_arr * vecarr, struct prefix * p, afi_t afi, safi_t safi, struct peer * from, struct prefix_rd * prd, mpls_label_t * label, uint32_t num_labels, int addpath_encode, uint32_t addpath_tx_id ) { size_t cp ; size_t aspath_sizep ; struct aspath * aspath ; int send_as4_path = 0 ; int send_as4_aggregator = 0 ; int use32bit = ( CHECK_FLAG ( peer -> cap, PEER_CAP_AS4_RCV ) )? 1 : 0 ; if (! bgp ) bgp = peer -> bgp ; cp = stream_get_endp ( s ) ; if ( p &&! ( ( afi == AFI_IP && safi == SAFI_UNICAST ) &&! peer_cap_enhe ( peer, afi, safi ) ) ) { size_t mpattrlen_pos = 0 ; mpattrlen_pos = bgp_packet_mpattr_start ( s, peer, afi, safi, vecarr, attr ) ; bgp_packet_mpattr_prefix ( s, afi, safi, p, prd, label, num_labels, addpath_encode, addpath_tx_id, attr ) ; bgp_packet_mpattr_end ( s, mpattrlen_pos ) ; } stream_putc ( s, BGP_ATTR_FLAG_TRANS ) ; stream_putc ( s, BGP_ATTR_ORIGIN ) ; stream_putc ( s, 1 ) ; stream_putc ( s, attr -> origin ) ; if ( peer -> sort == BGP_PEER_EBGP && (! CHECK_FLAG ( peer -> af_flags [ afi ] [ safi ], PEER_FLAG_AS_PATH_UNCHANGED ) || attr -> aspath -> segments == NULL ) && (! CHECK_FLAG ( peer -> af_flags [ afi ] [ safi ], PEER_FLAG_RSERVER_CLIENT ) ) ) { aspath = aspath_dup

Fix:
<S2SV_ModStart> ; # if ENABLE_BGP_VNC_ATTR <S2SV_ModEnd> bgp_packet_mpattr_tea ( bgp
Buggy code:
 void vp9_loop_filter_frame_init ( VP9_COMMON * cm, int default_filt_lvl ) { int seg_id ; const int scale = 1 << ( default_filt_lvl >> 5 ) ; loop_filter_info_n * const lfi = & cm -> lf_info ; struct loopfilter * const lf = & cm -> lf ; const struct segmentation * const seg = & cm -> seg ; if ( lf -> last_sharpness_level!= lf -> sharpness_level ) { update_sharpness ( lfi, lf -> sharpness_level ) ; lf -> last_sharpness_level = lf -> sharpness_level ; } for ( seg_id = 0 ; seg_id < MAX_SEGMENTS ; seg_id ++ ) { int lvl_seg = default_filt_lvl ; <START_BUG> if ( vp9_segfeature_active ( seg, seg_id, SEG_LVL_ALT_LF ) ) { <END_BUG>  const int data = vp9_get_segdata ( seg, seg_id, SEG_LVL_ALT_LF ) ; <START_BUG> lvl_seg = clamp ( seg -> abs_delta == SEGMENT_ABSDATA? data : default_filt_lvl + data, 0, MAX_LOOP_FILTER ) ; } if (! lf -> mode_ref_delta_enabled ) { <END_BUG> vpx_memset ( lfi -> lvl [ seg_id ], lvl_seg, sizeof ( lfi -> lvl [ seg_id ] ) ) ;  } else { int ref, mode ; const int intra_lvl = lvl_seg + lf -> ref_deltas [ INTRA_FRAME ] * scale ; lfi -> lvl [ seg_id ] [ INTRA_FRAME ] [ 0 ] = clamp ( intra_lvl, 0, MAX_LOOP_FILTER ) ; for ( ref = LAST_FRAME ; ref < MAX_REF_FRAMES ; ++ ref ) { for ( mode = 0 ; mode < MAX_MODE_LF_DELTAS ; ++ mode ) { const int inter_lvl = lvl_seg + lf -> ref_deltas [ ref ] * scale + lf -> mode_deltas [ mode ] * scale ; lfi -> lvl [ seg_id ] [ ref ] [ mode ] = clamp ( inter_lvl, 0, MAX

Fix:
<S2SV_ModStart> ; if ( segfeature_active <S2SV_ModEnd> ( seg, <S2SV_ModStart> int data = get_segdata <S2SV_ModEnd> ( seg, <S2SV_ModStart> mode_ref_delta_enabled ) { memset <S2SV_ModEnd> ( lfi ->
Buggy code:
 void big_key_describe ( const struct key * key, struct seq_file * m ) { size_t datalen = ( size_t ) key -> payload. data [ big_key_len ] ; seq_puts ( m, key -> description ) ; <START_BUG> if ( key_is_instantiated ( key ) ) <END_BUG> seq_printf ( m, ":   %zu   [%s]", datalen, datalen > BIG_KEY_FILE_THRESHOLD? "file" : "buff" ) ; }

Fix:
<S2SV_ModStart> ; if ( key_is_positive <S2SV_ModEnd> ( key )
Buggy code:
 static void host_callback ( void * arg, int status, int timeouts, unsigned char * abuf, int alen ) { struct host_query * hquery = ( struct host_query * ) arg ; int addinfostatus = ARES_SUCCESS ; hquery -> timeouts += timeouts ; hquery -> remaining -- ; if ( status == ARES_SUCCESS ) { addinfostatus = ares__parse_into_addrinfo ( abuf, alen, hquery -> ai ) ; } else if ( status == ARES_EDESTRUCTION ) { end_hquery ( hquery, status ) ; <START_BUG> } <END_BUG> if (! hquery -> remaining ) { if ( addinfostatus!= ARES_SUCCESS ) { end_hquery ( hquery, addinfostatus ) ; } else if ( hquery -> ai -> nodes ) { end_hquery ( hquery, ARES_SUCCESS ) ; } else if ( status == ARES_ENOTFOUND ) { next_lookup ( hquery, status ) ; } else { end_hquery ( hquery, status ) ; } } }

Fix:
<S2SV_ModStart> status ) ; return ;
Buggy code:
 void CLASS xtrans_interpolate ( int passes ) { int c, d, f, g, h, i, v, ng, row, col, top, left, mrow, mcol ; # ifdef LIBRAW_LIBRARY_BUILD int cstat [ 4 ] = { 0, 0, 0, 0 } ; # endif int val, ndir, pass, hm [ 8 ], avg [ 4 ], color [ 3 ] [ 8 ] ; static const short orth [ 12 ] = { 1, 0, 0, 1, - 1, 0, 0, - 1, 1, 0, 0, 1 }, patt [ 2 ] [ 16 ] = { { 0, 1, 0, - 1, 2, 0, - 1, 0, 1, 1, 1, - 1, 0, 0, 0, 0 }, { 0, 1, 0, - 2, 1, 0, - 2, 0, 1, 1, - 2, - 2, 1, - 1, - 1, 1 } }, dir [ 4 ] = { 1, TS, TS + 1, TS - 1 } ; short allhex [ 3 ] [ 3 ] [ 2 ] [ 8 ], * hex ; ushort min, max, sgrow, sgcol ; ushort ( * rgb ) [ TS ] [ TS ] [ 3 ], ( * rix ) [ 3 ], ( * pix ) [ 4 ] ; short ( * lab ) [ TS ] [ 3 ], ( * lix ) [ 3 ] ; float ( * drv ) [ TS ] [ TS ], diff [ 6 ], tr ; char ( * homo ) [ TS ] [ TS ], * buffer ; # ifdef DCRAW_VERBOSE if ( verbose ) fprintf ( stderr, _ ( "%d-pass   X-Trans   interpolation...\\n" ), passes ) ; # endif # ifdef LIBRAW_LIBRARY_BUILD <START_BUG> for ( row = 0 ; row < 6 ; row ++ ) <END_BUG> for ( col = 0 ; col < 6 ; col ++ ) cstat [ fcol ( row, col ) ] ++ ; if ( cstat [ 0 ] < 6 || cstat [ 0 ] > 10 || cstat [ 1 ] < 16 || cstat [ 1 ] > 24 || cstat [ 2 ] < 6 || cstat [ 2 ] > 10 || cstat [ 3

Fix:
<S2SV_ModStart> # ifdef LIBRAW_LIBRARY_BUILD if ( width < TS || height < TS ) throw LIBRAW_EXCEPTION_IO_CORRUPT ; <S2SV_ModStart> throw LIBRAW_EXCEPTION_IO_CORRUPT ; for ( int i = 0 ; i < 3 ; i ++ ) for ( int j = 0 ; j < 3 ; j ++ ) for ( int k = 0 ; k < 2 ; k ++ ) for ( int l = 0 ; l < 8 ; l ++ ) allhex [ i ] [ j ] [ k ] [ l ] = 32700 ; <S2SV_ModStart> 6 ) ) ; int minv = 0, maxv = 0, minh = 0, maxh = 0 <S2SV_ModStart> 1 ] ; minv = MIN ( v, minv ) ; maxv = MAX ( v, maxv ) ; minh = MIN ( v, minh ) ; maxh = MAX ( v, maxh ) ; <S2SV_ModStart> ; } } # ifdef LIBRAW_LIBRARY_BUILD for ( int i = 0 ; i < 3 ; i ++ ) for ( int j = 0 ; j < 3 ; j ++ ) for ( int k = 0 ; k < 2 ; k ++ ) for ( int l =
Buggy code:
 static OPJ_BOOL opj_j2k_write_first_tile_part ( opj_j2k_t * p_j2k, OPJ_BYTE * p_data, OPJ_UINT32 * p_data_written, OPJ_UINT32 p_total_data_size, opj_stream_private_t * p_stream, struct opj_event_mgr * p_manager ) { OPJ_UINT32 l_nb_bytes_written = 0 ; OPJ_UINT32 l_current_nb_bytes_written ; OPJ_BYTE * l_begin_data = 00 ; opj_tcd_t * l_tcd = 00 ; opj_cp_t * l_cp = 00 ; l_tcd = p_j2k -> m_tcd ; l_cp = & ( p_j2k -> m_cp ) ; l_tcd -> cur_pino = 0 ; p_j2k -> m_specific_param. m_encoder. m_current_poc_tile_part_number = 0 ; l_current_nb_bytes_written = 0 ; l_begin_data = p_data ; <START_BUG> if (! opj_j2k_write_sot ( p_j2k, p_data, & l_current_nb_bytes_written, p_stream, <END_BUG> p_manager ) ) { return OPJ_FALSE ; } l_nb_bytes_written += l_current_nb_bytes_written ; p_data += l_current_nb_bytes_written ; p_total_data_size -= l_current_nb_bytes_written ; if (! OPJ_IS_CINEMA ( l_cp -> rsiz ) ) { # if 0 for ( compno = 1 ; compno < p_j2k -> m_private_image -> numcomps ; compno ++ ) { l_current_nb_bytes_written = 0 ; opj_j2k_write_coc_in_memory ( p_j2k, compno, p_data, & l_current_nb_bytes_written, p_manager ) ; l_nb_bytes_written += l_current_nb_bytes_written ; p_data += l_current_

Fix:
<S2SV_ModStart>, p_data, p_total_data_size,
Buggy code:
 static MagickBooleanType EncodeImage ( const ImageInfo * image_info, Image * image, const size_t data_size ) { # define MaxCode ( number_bits ) ( ( one << ( number_bits ) ) - 1 ) # define MaxHashTable 5003 # define MaxGIFBits 12UL # define MaxGIFTable ( 1UL << MaxGIFBits ) <START_BUG> # define GIFOutputCode ( code ) { if ( bits > 0 ) datum |= ( size_t ) ( code ) << bits ; else datum = ( size_t ) ( code ) ; bits += number_bits ; while ( bits >= 8 ) { packet [ length ++ ] = ( unsigned char ) ( datum & 0xff ) ; if ( length >= 254 ) { ( void ) WriteBlobByte ( image, ( unsigned char ) length ) ; ( void ) WriteBlob ( image, length, packet ) ; length = 0 ; } datum >>= 8 ; bits -= 8 ; } if ( free_code > max_code ) { number_bits ++ ; if ( number_bits == MaxGIFBits ) max_code = MaxGIFTable ; else max_code = MaxCode ( number_bits ) ; } } <END_BUG> IndexPacket index ; short * hash_code, * hash_prefix, waiting_code ; size_t bits, clear_code, datum, end_of_information_code, free_code, length, max_code, next_pixel, number_bits, one, pass ; ssize_t displacement, offset, k, y ; unsigned char * packet, * hash_suffix ; assert ( image!= ( Image * ) NULL ) ; one = 1 ; packet = ( unsigned char * ) AcquireQuantumMemory ( 256, sizeof ( * packet ) ) ; hash_code = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_code ) ) ; hash_prefix = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_prefix ) ) ; hash_suffix = ( unsigned char * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_suffix ) ) ; if ( ( packet == ( unsigned char * ) NULL ) || ( hash_code == ( short * ) NULL ) || ( hash_prefix == ( short * ) NULL ) || ( hash_suffix == ( unsigned char * ) NULL ) ) { if ( packet

Fix:
<S2SV_ModStart> ( code ) \\\n{ <S2SV_ModEnd> if ( bits <S2SV_ModStart> ) ; } \\\n} <S2SV_ModEnd> IndexPacket index ; <S2SV_ModStart> ++ ) { next_pixel = MagickFalse ; displacement = 1 ; <S2SV_ModStart> -= MaxHashTable ; if ( k < 0 ) continue <S2SV_ModEnd> ; if (
Buggy code:
 static inline void handle_socket_receive_unknown ( fastd_socket_t * sock, const fastd_peer_address_t * local_addr, const fastd_peer_address_t * remote_addr, fastd_buffer_t * buffer ) { const uint8_t * packet_type = buffer -> data ; switch ( * packet_type ) { case PACKET_DATA : fastd_buffer_free ( buffer ) ; if (! backoff_unknown ( remote_addr ) ) { pr_debug ( "unexpectedly   received   payload   data   from   unknown   address   %I", remote_addr ) ; conf. protocol -> handshake_init ( sock, local_addr, remote_addr, NULL ) ; } break ; case PACKET_HANDSHAKE : fastd_handshake_handle ( sock, local_addr, remote_addr, NULL, buffer ) ; <START_BUG> } <END_BUG> }

Fix:
<S2SV_ModStart> buffer ) ; break ; default : fastd_buffer_free ( buffer ) ; pr_debug ( "received <S2SV_blank> packet <S2SV_blank> with <S2SV_blank> invalid <S2SV_blank> type <S2SV_blank> from <S2SV_blank> unknown <S2SV_blank> address <S2SV_blank> %I", remote_addr ) ;
Buggy code:
 static vpx_codec_err_t validate_config ( vpx_codec_alg_priv_t * ctx, const vpx_codec_enc_cfg_t * cfg, const struct vp9_extracfg * extra_cfg ) { RANGE_CHECK ( cfg, g_w, 1, 65535 ) ; RANGE_CHECK ( cfg, g_h, 1, 65535 ) ; RANGE_CHECK ( cfg, g_timebase. den, 1, 1000000000 ) ; RANGE_CHECK ( cfg, g_timebase. num, 1, cfg -> g_timebase. den ) ; RANGE_CHECK_HI ( cfg, g_profile, 3 ) ; RANGE_CHECK_HI ( cfg, rc_max_quantizer, 63 ) ; RANGE_CHECK_HI ( cfg, rc_min_quantizer, cfg -> rc_max_quantizer ) ; RANGE_CHECK_BOOL ( extra_cfg, lossless ) ; RANGE_CHECK ( extra_cfg, aq_mode, 0, AQ_MODE_COUNT - 1 ) ; RANGE_CHECK ( extra_cfg, frame_periodic_boost, 0, 1 ) ; RANGE_CHECK_HI ( cfg, g_threads, 64 ) ; RANGE_CHECK_HI ( cfg, g_lag_in_frames, MAX_LAG_BUFFERS ) ; RANGE_CHECK ( cfg, rc_end_usage, VPX_VBR, VPX_Q ) ; <START_BUG> RANGE_CHECK_HI ( cfg, rc_undershoot_pct, 1000 ) ; <END_BUG>  RANGE_CHECK_HI ( cfg, rc_overshoot_pct, 1000 ) ; <START_BUG> RANGE_CHECK_HI ( cfg, rc_2pass_vbr_bias_pct, 100 ) ; RANGE_CHECK ( cfg, kf_mode, VPX_KF_DISABLED, VPX_KF_AUTO ) ; RANGE_CHECK_BOOL ( cfg, rc_resize_allowed ) ; RANGE_CHECK_HI ( cfg, rc_dropframe_thresh, 100 ) ; RANGE_CHECK_HI ( cfg, rc_resize_up_thresh, 100 ) ; RANGE_CHECK_HI ( cfg, rc_resize_down_thresh, 100 ) ; RANGE_CHECK ( cfg, g_pass, VP<END_BUG>

Fix:
<S2SV_ModStart>, rc_undershoot_pct, 100 <S2SV_ModEnd> ) ; RANGE_CHECK_HI <S2SV_ModStart>, rc_overshoot_pct, 100 <S2SV_ModEnd> ) ; RANGE_CHECK_HI <S2SV_ModStart> ; RANGE_CHECK ( extra_cfg, min_gf_interval, 0, ( MAX_LAG_BUFFERS - 1 ) ) ; RANGE_CHECK ( extra_cfg, max_gf_interval, 0, ( MAX_LAG_BUFFERS - 1 ) ) ; if ( extra_cfg -> max_gf_interval > 0 ) { RANGE_CHECK ( extra_cfg, max_gf_interval, 2, ( MAX_LAG_BUFFERS - 1 ) ) ; } if ( extra_cfg -> min_gf_interval > 0 && extra_cfg -> max_gf_interval > 0 ) { RANGE_CHECK ( extra_cfg, max_gf_interval, extra_cfg -> min_gf_interval, ( MAX_LAG_BUFFERS - 1 ) ) ; } if ( cfg -> rc_resize_allowed == 1 ) { RANGE_CHECK ( cfg, rc_scaled_width, 0, cfg -> g_w ) ; R
Buggy code:
 static struct kioctx * ioctx_alloc ( unsigned nr_events ) { struct mm_struct * mm = current -> mm ; struct kioctx * ctx ; int err = - ENOMEM ; nr_events = max ( nr_events, num_possible_cpus ( ) * 4 ) ; nr_events *= 2 ; if ( ( nr_events > ( 0x10000000U // sizeof ( struct io_event ) ) ) || ( nr_events > ( 0x10000000U // sizeof ( struct kiocb ) ) ) ) { pr_debug ( "ENOMEM:   nr_events   too   high\\n" ) ; return ERR_PTR ( - EINVAL ) ; } if (! nr_events || ( unsigned long ) nr_events > ( aio_max_nr * 2UL ) ) return ERR_PTR ( - EAGAIN ) ; ctx = kmem_cache_zalloc ( kioctx_cachep, GFP_KERNEL ) ; if (! ctx ) return ERR_PTR ( - ENOMEM ) ; ctx -> max_reqs = nr_events ; if ( percpu_ref_init ( & ctx -> users, free_ioctx_users ) ) goto err ; if ( percpu_ref_init ( & ctx -> reqs, free_ioctx_reqs ) ) goto err ; spin_lock_init ( & ctx -> ctx_lock ) ; spin_lock_init ( & ctx -> completion_lock ) ; mutex_init ( & ctx -> ring_lock ) ; init_waitqueue_head ( & ctx -> wait ) ; INIT_LIST_HEAD ( & ctx -> active_reqs ) ; ctx -> cpu = alloc_percpu ( struct kioctx_cpu ) ; if (! ctx -> cpu ) goto err ; if ( aio_setup_ring ( ctx ) < 0 ) goto err ; atomic_set ( & ctx -> reqs_available, ctx -> nr_events - 1 ) ; ctx -> req_batch = ( ctx -> nr_events - 1 ) // ( num_possible_cpus ( ) * 4 ) ; if ( ctx -> req_batch < 1 ) ctx -> req_batch = 1 ; spin_lock ( & aio_nr_lock ) ; if ( aio_nr + nr_events > ( aio_max_nr * 2UL ) || aio_nr + nr_

Fix:
<S2SV_ModStart> ; err : <S2SV_ModEnd> free_percpu ( ctx
Buggy code:
 int im_vips2dz ( IMAGE * in, const char * filename ) { char * p, * q ; char name [ FILENAME_MAX ] ; char mode [ FILENAME_MAX ] ; char buf [ FILENAME_MAX ] ; int i ; VipsForeignDzLayout layout = VIPS_FOREIGN_DZ_LAYOUT_DZ ; char * suffix = ".jpeg" ; int overlap = 0 ; int tile_size = 256 ; VipsForeignDzDepth depth = VIPS_FOREIGN_DZ_DEPTH_ONEPIXEL ; gboolean centre = FALSE ; VipsAngle angle = VIPS_ANGLE_D0 ; im_strncpy ( name, filename, FILENAME_MAX ) ; if ( ( p = strchr ( name, ':' ) ) ) { * p = '\\0' ; im_strncpy ( mode, p + 1, FILENAME_MAX ) ; } <START_BUG> strcpy ( buf, mode ) ; <END_BUG> p = & buf [ 0 ] ; if ( ( q = im_getnextoption ( & p ) ) ) { if ( ( i = vips_enum_from_nick ( "im_vips2dz", VIPS_TYPE_FOREIGN_DZ_LAYOUT, q ) ) < 0 ) return ( - 1 ) ; layout = i ; } if ( ( q = im_getnextoption ( & p ) ) ) suffix = g_strdup ( q ) ; if ( ( q = im_getnextoption ( & p ) ) ) overlap = atoi ( q ) ; if ( ( q = im_getnextoption ( & p ) ) ) tile_size = atoi ( q ) ; if ( ( q = im_getnextoption ( & p ) ) ) { if ( ( i = vips_enum_from_nick ( "im_vips2dz", VIPS_TYPE_FOREIGN_DZ_DEPTH, q ) ) < 0 ) return ( - 1 ) ; depth = i ; } if ( ( q = im_getnextoption ( & p ) ) ) { if ( im_isprefix ( "cen", q ) ) centre = TRUE ; } if ( ( q = im_getnextoption ( & p ) ) ) { if ( ( i = vips_

Fix:
<S2SV_ModStart> ) ; } else strcpy ( mode, "" ) ;
Buggy code:
 static long bcm_char_ioctl ( struct file * filp, UINT cmd, ULONG arg ) { struct bcm_tarang_data * pTarang = filp -> private_data ; void __user * argp = ( void __user * ) arg ; struct bcm_mini_adapter * Adapter = pTarang -> Adapter ; INT Status = STATUS_FAILURE ; int timeout = 0 ; struct bcm_ioctl_buffer IoBuffer ; int bytes ; BCM_DEBUG_PRINT ( Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Parameters   Passed   to   control   IOCTL   cmd=0x%X   arg=0x%lX", cmd, arg ) ; if ( _IOC_TYPE ( cmd )!= BCM_IOCTL ) return - EFAULT ; if ( _IOC_DIR ( cmd ) & _IOC_READ ) Status =! access_ok ( VERIFY_WRITE, argp, _IOC_SIZE ( cmd ) ) ; else if ( _IOC_DIR ( cmd ) & _IOC_WRITE ) Status =! access_ok ( VERIFY_READ, argp, _IOC_SIZE ( cmd ) ) ; else if ( _IOC_NONE == ( _IOC_DIR ( cmd ) & _IOC_NONE ) ) Status = STATUS_SUCCESS ; if ( Status ) return - EFAULT ; if ( Adapter -> device_removed ) return - EFAULT ; if ( FALSE == Adapter -> fw_download_done ) { switch ( cmd ) { case IOCTL_MAC_ADDR_REQ : case IOCTL_LINK_REQ : case IOCTL_CM_REQUEST : case IOCTL_SS_INFO_REQ : case IOCTL_SEND_CONTROL_MESSAGE : case IOCTL_IDLE_REQ : case IOCTL_BCM_GPIO_SET_REQUEST : case IOCTL_BCM_GPIO_STATUS_REQUEST : return - EACCES ; default : break ; } } Status = vendorextnIoctl ( Adapter, cmd, arg ) ; if ( Status!= CONTINUE_COMMON_PATH ) return Status ; switch ( cmd ) { case IOCTL_BCM_REGISTER_READ_PRIVATE : { struct bcm

Fix:
<S2SV_ModStart> "Called <S2SV_blank> IOCTL_BCM_GET_DEVICE_DRIVER_INFO\\n" ) ; memset ( & DevInfo, 0, sizeof ( DevInfo ) ) ;
Buggy code:
 static void * listen_loop ( void * x ) { int optval = 1 ; struct pollfd pa [ 100 ] ; struct pollfd * p ; struct _agooErr err = AGOO_ERR_INIT ; struct sockaddr_in client_addr ; int client_sock ; int pcnt = 0 ; socklen_t alen = 0 ; agooCon con ; int i ; uint64_t cnt = 0 ; agooBind b ; for ( b = agoo_server. binds, p = pa ; NULL!= b ; b = b -> next, p ++, pcnt ++ ) { p -> fd = b -> fd ; p -> events = POLLIN ; p -> revents = 0 ; } memset ( & client_addr, 0, sizeof ( client_addr ) ) ; atomic_fetch_add ( & agoo_server. running, 1 ) ; while ( agoo_server. active ) { if ( 0 > ( i = poll ( pa, pcnt, 200 ) ) ) { if ( EAGAIN == errno ) { continue ; } agoo_log_cat ( & agoo_error_cat, "Server   polling   error.   %s.", strerror ( errno ) ) ; break ; } if ( 0 == i ) { continue ; } for ( b = agoo_server. binds, p = pa ; NULL!= b ; b = b -> next, p ++ ) { if ( 0!= ( p -> revents & POLLIN ) ) { if ( 0 > ( client_sock = accept ( p -> fd, ( struct sockaddr * ) & client_addr, & alen ) ) ) { agoo_log_cat ( & agoo_error_cat, "Server   with   pid   %d   accept   connection   failed.   %s.", getpid ( ), strerror ( errno ) ) ; } else if ( NULL == ( con = agoo_con_create ( & err, client_sock, ++ cnt, b ) ) ) { agoo_log_cat ( & agoo_error_cat, "Server   with   pid   %d   accept   connection   failed.   %s.", getpid ( ), err. msg ) ; close ( client_sock ) ; cnt -- ; agoo_err_clear ( & err ) ; } else {

Fix:
<S2SV_ModStart> & agoo_con_cat, "Server <S2SV_blank> with <S2SV_blank> pid <S2SV_blank> %d <S2SV_blank> accepted <S2SV_blank> connection <S2SV_blank> %llu <S2SV_blank> on <S2SV_blank> %s <S2SV_blank> [%d] <S2SV_blank> from <S2SV_blank> %s" <S2SV_ModEnd>, getpid ( <S2SV_ModStart> con -> sock, con -> remote
Buggy code:
 static ssize_t aio_setup_iocb ( struct kiocb * kiocb, bool compat ) { struct file * file = kiocb -> ki_filp ; ssize_t ret = 0 ; switch ( kiocb -> ki_opcode ) { case IOCB_CMD_PREAD : ret = - EBADF ; if ( unlikely (! ( file -> f_mode & FMODE_READ ) ) ) break ; ret = - EFAULT ; if ( unlikely (! access_ok ( VERIFY_WRITE, kiocb -> ki_buf, kiocb -> ki_left ) ) ) break ; <START_BUG> ret = security_file_permission ( file, MAY_READ ) ; <END_BUG> if ( unlikely ( ret ) ) break ; ret = aio_setup_single_vector ( kiocb ) ; if ( ret ) break ; ret = - EINVAL ; if ( file -> f_op -> aio_read ) kiocb -> ki_retry = aio_rw_vect_retry ; break ; case IOCB_CMD_PWRITE : ret = - EBADF ; if ( unlikely (! ( file -> f_mode & FMODE_WRITE ) ) ) break ; ret = - EFAULT ; if ( unlikely (! access_ok ( VERIFY_READ, kiocb -> ki_buf, kiocb -> ki_left ) ) ) break ;  ret = security_file_permission ( file, MAY_WRITE ) ; <START_BUG> if ( unlikely ( ret ) ) break ; ret = aio_setup_single_vector ( kiocb ) ; if ( ret ) break ; ret = - EINVAL ; if ( file -> f_op -> aio_write ) kiocb -> ki_retry = aio_rw_vect_retry ; break ; case IOCB_CMD_PREADV : ret = - EBADF ; if ( unlikely (! ( file -> f_mode & FMODE_READ ) ) ) break ; <END_BUG> ret = security_file_permission ( file, MAY_READ ) ;  if ( unlikely ( ret ) ) break ; ret = aio_setup_vectored_rw ( READ, kiocb, compat ) ; if ( ret ) break ; ret = - EINVAL ; if ( file -> f_op -> aio_read ) kiocb -> ki_retry = aio_rw_

Fix:
<S2SV_ModStart> ; ret = aio_setup_single_vector ( READ, file, <S2SV_ModEnd> kiocb ) ; <S2SV_ModStart> ; ret = aio_setup_single_vector ( WRITE, file, <S2SV_ModEnd> kiocb ) ; <S2SV_ModStart> ; ret = <S2SV_ModEnd> aio_setup_vectored_rw ( READ <S2SV_ModStart> ; ret = <S2SV_ModEnd> aio_setup_vectored_rw ( WRITE
Buggy code:
 VTerm * vterm_new_with_allocator ( int rows, int cols, VTermAllocatorFunctions * funcs, void * allocdata ) { VTerm * vt = ( * funcs -> malloc ) ( sizeof ( VTerm ), allocdata ) ; <START_BUG> vt -> allocator = funcs ; <END_BUG> vt -> allocdata = allocdata ; vt -> rows = rows ; vt -> cols = cols ; vt -> parser. state = NORMAL ; vt -> parser. callbacks = NULL ; vt -> parser. cbdata = NULL ; vt -> parser. strbuffer_len = 500 ; vt -> parser. strbuffer_cur = 0 ; vt -> parser. strbuffer = vterm_allocator_malloc ( vt, vt -> parser. strbuffer_len ) ;  vt -> outbuffer_len = 200 ; <START_BUG> vt -> outbuffer_cur = 0 ; <END_BUG> vt -> outbuffer = vterm_allocator_malloc ( vt, vt -> outbuffer_len ) ;  return vt ; }

Fix:
<S2SV_ModStart> allocdata ) ; if ( vt == NULL ) return NULL ; <S2SV_ModStart> strbuffer_len ) ; if ( vt -> parser. strbuffer == NULL ) { vterm_allocator_free ( vt, vt ) ; return NULL ; } <S2SV_ModStart> outbuffer_len ) ; if ( vt -> outbuffer == NULL ) { vterm_allocator_free ( vt, vt -> parser. strbuffer ) ; vterm_allocator_free ( vt, vt ) ; return NULL ; }
Buggy code:
 void vp8_yv12_extend_frame_borders_c ( YV12_BUFFER_CONFIG * ybf ) { <START_BUG> assert ( ybf -> y_height - ybf -> y_crop_height < 16 ) ; <END_BUG> assert ( ybf -> y_width - ybf -> y_crop_width < 16 ) ; assert ( ybf -> y_height - ybf -> y_crop_height >= 0 ) ; assert ( ybf -> y_width - ybf -> y_crop_width >= 0 ) ;  extend_plane ( ybf -> y_buffer, ybf -> y_stride, <START_BUG> ybf -> y_crop_width, ybf -> y_crop_height, ybf -> border, ybf -> border, ybf -> border + ybf -> y_height - ybf -> y_crop_height, ybf -> border + ybf -> y_width - ybf -> y_crop_width ) ; extend_plane ( ybf -> u_buffer, ybf -> uv_stride, <END_BUG> ( ybf -> y_crop_width + 1 ) // 2, ( ybf -> y_crop_height + 1 ) // 2,  ybf -> border // 2, ybf -> border // 2, ( ybf -> border + ybf -> y_height - ybf -> y_crop_height + 1 ) // 2, ( ybf -> border + ybf -> y_width - ybf -> y_crop_width + 1 ) // 2 ) ; extend_plane ( ybf -> v_buffer, ybf -> uv_stride, <START_BUG> ( ybf -> y_crop_width + 1 ) // 2, ( ybf -> y_crop_height + 1 ) // 2, <END_BUG> ybf -> border // 2, ybf -> border // 2, ( ybf -> border + ybf -> y_height - ybf -> y_crop_height + 1 ) // 2, ( ybf -> border + ybf -> y_width - ybf -> y_crop_width + 1 ) // 2 ) ; }

Fix:
<S2SV_ModStart> ybf ) { const int uv_border = ybf -> border // 2 ; assert ( ybf -> border % 2 == 0 ) ; <S2SV_ModStart> 0 ) ; # if CONFIG_VP9_HIGHBITDEPTH if ( ybf -> flags & YV12_FLAG_HIGHBITDEPTH ) { extend_plane_high ( ybf -> y_buffer, ybf -> y_stride, ybf -> y_crop_width, ybf -> y_crop_height, ybf -> border, ybf -> border, ybf -> border + ybf -> y_height - ybf -> y_crop_height, ybf -> border + ybf -> y_width - ybf -> y_crop_width ) ; extend_plane_high ( ybf -> u_buffer, ybf -> uv_stride, ybf -> uv_crop_width, ybf -> uv_crop_height, uv_border, uv_border, uv_border + ybf -> uv_height - ybf -> uv_crop_height, uv_border + ybf -> uv_width - ybf -> uv_crop_width ) ; extend_plane_high ( ybf -> v_buffer, y
Buggy code:
 static int llc_ui_getname ( struct socket * sock, struct sockaddr * uaddr, int * uaddrlen, int peer ) { struct sockaddr_llc sllc ; struct sock * sk = sock -> sk ; struct llc_sock * llc = llc_sk ( sk ) ; <START_BUG> int rc = 0 ; <END_BUG> memset ( & sllc, 0, sizeof ( sllc ) ) ; lock_sock ( sk ) ; if ( sock_flag ( sk, SOCK_ZAPPED ) ) goto out ;  * uaddrlen = sizeof ( sllc ) ; <START_BUG> memset ( uaddr, 0, * uaddrlen ) ; if ( peer ) { rc = - ENOTCONN ; if ( sk -> sk_state!= TCP_ESTABLISHED ) goto out ; if ( llc -> dev ) sllc. sllc_arphrd = llc -> dev -> type ; sllc. sllc_sap = llc -> daddr. lsap ; memcpy ( & sllc. sllc_mac, & llc -> daddr. mac, IFHWADDRLEN ) ; } else { rc = - EINVAL ; if (! llc -> sap ) goto out ; sllc. sllc_sap = llc -> sap -> laddr. lsap ; if ( llc -> dev ) { sllc. sllc_arphrd = llc -> dev -> type ; memcpy ( & sllc. sllc_mac, llc -> dev -> dev_addr, IFHWADDRLEN ) ; } } rc = 0 ; sllc. sllc_family = AF_LLC ; memcpy ( uaddr, & sllc, sizeof ( sllc ) ) ; out : release_sock ( sk ) ; return rc ; }<END_BUG>

Fix:
<S2SV_ModStart> int rc = - EBADF ; memset ( & sllc, 0 <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> sizeof ( sllc <S2SV_ModEnd> ) ; if
Buggy code:
 void process_pfa ( FILE * ifp, const char * ifp_filename, struct font_reader * fr ) { char buffer [ LINESIZE ] ; int c = 0 ; int blocktyp = PFA_ASCII ; char saved_orphan = 0 ; ( void ) ifp_filename ; while ( c!= EOF ) { char * line = buffer, * last = buffer ; int crlf = 0 ; c = getc ( ifp ) ; while ( c!= EOF && c!= '\\r' && c!= '\\n' && last < buffer + LINESIZE - 1 ) { * last ++ = c ; c = getc ( ifp ) ; } if ( last == buffer + LINESIZE - 1 ) ungetc ( c, ifp ) ; else if ( c == '\\r' && blocktyp!= PFA_BINARY ) { c = getc ( ifp ) ; if ( c!= '\\n' ) ungetc ( c, ifp ), crlf = 1 ; else crlf = 2 ; * last ++ = '\\n' ; } else if ( c!= EOF ) * last ++ = c ; * last = 0 ; if ( blocktyp == PFA_ASCII ) { <START_BUG> if ( strncmp ( line, "currentfile   eexec", 17 ) == 0 && isspace ( line [ 17 ] ) ) { <END_BUG> char saved_p ;  for ( line += 18 ; isspace ( * line ) ; line ++ ) <START_BUG> ; saved_p = * line ; * line = 0 ; fr -> output_ascii ( buffer, line - buffer ) ; * line = saved_p ; blocktyp = PFA_EEXEC_TEST ; if (! * line ) continue ; } else { fr -> output_ascii ( line, last - line ) ; continue ; } } if ( blocktyp == PFA_EEXEC_TEST ) { <END_BUG> for ( ; line < last && isspace ( * line ) ; line ++ )  ; if ( line == last ) continue ; <START_BUG> else if ( last >= line + 4 && isxdigit ( line [ 0 ] ) && isxdigit ( line [ 1 ] ) <END_BUG>  && isxdigit ( line [ 2 ] ) && isxdigit ( line [ 3 ] ) ) <START_BUG> blocktyp = PFA_HEX ; else blocktyp = PFA_BINARY ; memmove ( buffer, line, last -<END_BUG>

Fix:
<S2SV_ModStart> && isspace ( ( unsigned char ) <S2SV_ModStart> ; isspace ( ( unsigned char ) <S2SV_ModStart> && isspace ( ( unsigned char ) <S2SV_ModStart> && isxdigit ( ( unsigned char ) <S2SV_ModStart> && isxdigit ( ( unsigned char ) <S2SV_ModStart> && isxdigit ( ( unsigned char ) <S2SV_ModStart> && isxdigit ( ( unsigned char )
Buggy code:
 static krb5_error_code build_principal_va ( krb5_context context, krb5_principal princ, unsigned int rlen, const char * realm, va_list ap ) { krb5_error_code retval = 0 ; char * r = NULL ; krb5_data * data = NULL ; krb5_int32 count = 0 ; krb5_int32 size = 2 ; char * component = NULL ; data = malloc ( size * sizeof ( krb5_data ) ) ; if (! data ) { retval = ENOMEM ; } <START_BUG> if (! retval ) { <END_BUG> r = strdup ( realm ) ; if (! r ) { retval = ENOMEM ; } } while (! retval && ( component = va_arg ( ap, char * ) ) ) { if ( count == size ) { krb5_data * new_data = NULL ; size *= 2 ; new_data = realloc ( data, size * sizeof ( krb5_data ) ) ; if ( new_data ) { data = new_data ; } else { retval = ENOMEM ; } } if (! retval ) { data [ count ]. length = strlen ( component ) ; data [ count ]. data = strdup ( component ) ; if (! data [ count ]. data ) { retval = ENOMEM ; } count ++ ; } } if (! retval ) { princ -> type = KRB5_NT_UNKNOWN ; princ -> magic = KV5M_PRINCIPAL ; princ -> realm = make_data ( r, rlen ) ; princ -> data = data ; princ -> length = count ; r = NULL ; data = NULL ; } if ( data ) { while ( -- count >= 0 ) { free ( data [ count ]. data ) ; } free ( data ) ; } free ( r ) ; return retval ; }

Fix:
<S2SV_ModStart>! retval ) r = k5memdup0 ( realm, rlen, & retval ) ; <S2SV_ModEnd> while (!
Buggy code:
 static void load_xref_from_plaintext ( FILE * fp, xref_t * xref ) { int i, buf_idx, obj_id, added_entries ; char c, buf [ 32 ] = { 0 } ; long start, pos ; start = ftell ( fp ) ; pos = xref -> end ; fseek ( fp, pos, SEEK_SET ) ; while ( ftell ( fp )!= 0 ) if ( SAFE_F ( fp, ( fgetc ( fp ) == '//' && fgetc ( fp ) == 'S' ) ) ) break ; else SAFE_E ( fseek ( fp, -- pos, SEEK_SET ), 0, "Failed   seek   to   xref   //Size.\\n" ) ; SAFE_E ( fread ( buf, 1, 21, fp ), 21, "Failed   to   load   entry   Size   string.\\n" ) ; xref -> n_entries = atoi ( buf + strlen ( "ize   " ) ) ; <START_BUG> xref -> entries = calloc ( 1, xref -> n_entries * sizeof ( struct _xref_entry ) ) ; <END_BUG> obj_id = 0 ; fseek ( fp, xref -> start + strlen ( "xref" ), SEEK_SET ) ; added_entries = 0 ; for ( i = 0 ; i < xref -> n_entries ; i ++ ) { c = fgetc ( fp ) ; while ( c == '\\n' || c == '\\r' ) c = fgetc ( fp ) ; buf_idx = 0 ; while ( c!= '\\n' && c!= '\\r' &&! feof ( fp ) &&! ferror ( fp ) && buf_idx < sizeof ( buf ) ) { buf [ buf_idx ++ ] = c ; c = fgetc ( fp ) ; } if ( buf_idx >= sizeof ( buf ) ) { ERR ( "Failed   to   locate   newline   character.   " "This   might   be   a   corrupt   PDF.\\n" ) ; exit ( EXIT_FAILURE ) ; } buf [ buf_idx ] = '\\0' ; if ( strchr ( buf, 't' ) ) break ; if ( strlen ( buf ) > 17 ) { xref -> entries [ i ]. obj_id = obj_id ++ ; xref -> entries [ i ]. offset

Fix:
<S2SV_ModStart> -> entries = safe_calloc ( <S2SV_ModEnd> xref -> n_entries
Buggy code:
 uint8_t hfs_cat_traverse ( HFS_INFO * hfs, TSK_HFS_BTREE_CB a_cb, void * ptr ) { TSK_FS_INFO * fs = & ( hfs -> fs_info ) ; uint32_t cur_node ; char * node ; uint16_t nodesize ; uint8_t is_done = 0 ; tsk_error_reset ( ) ; nodesize = tsk_getu16 ( fs -> endian, hfs -> catalog_header. nodesize ) ; if ( ( node = ( char * ) tsk_malloc ( nodesize ) ) == NULL ) return 1 ; cur_node = tsk_getu32 ( fs -> endian, hfs -> catalog_header. rootNode ) ; if ( cur_node == 0 ) { if ( tsk_verbose ) tsk_fprintf ( stderr, "hfs_cat_traverse:   " "empty   extents   btree\\n" ) ; free ( node ) ; return 1 ; } if ( tsk_verbose ) tsk_fprintf ( stderr, "hfs_cat_traverse:   starting   at   " "root   node   %" PRIu32 ";   nodesize   =   %" PRIu16 "\\n", cur_node, nodesize ) ; is_done = 0 ; while ( is_done == 0 ) { TSK_OFF_T cur_off ; uint16_t num_rec ; ssize_t cnt ; hfs_btree_node * node_desc ; if ( cur_node > tsk_getu32 ( fs -> endian, hfs -> catalog_header. totalNodes ) ) { tsk_error_set_errno ( TSK_ERR_FS_GENFS ) ; tsk_error_set_errstr ( "hfs_cat_traverse:   Node   %d   too   large   for   file", cur_node ) ; free ( node ) ; return 1 ; } cur_off = cur_node * nodesize ; cnt = tsk_fs_attr_read ( hfs -> catalog_attr, cur_off, node, nodesize, 0 ) ; if ( cnt!= nodesize ) { if ( cnt >= 0 ) { tsk_error_reset ( ) ; tsk_

Fix:
<S2SV_ModStart> uint8_t retval ; int <S2SV_ModEnd> keylen ; rec_off <S2SV_ModStart> uint8_t retval ; int <S2SV_ModEnd> keylen ; rec_off
Buggy code:
 static struct net_device * _init_airo_card ( unsigned short irq, int port, int is_pcmcia, struct pci_dev * pci, struct device * dmdev ) { struct net_device * dev ; struct airo_info * ai ; int i, rc ; CapabilityRid cap_rid ; dev = alloc_netdev ( sizeof ( * ai ), "", ether_setup ) ; if (! dev ) { airo_print_err ( "", "Couldn\'t   alloc_etherdev" ) ; return NULL ; } ai = dev -> ml_priv = netdev_priv ( dev ) ; ai -> wifidev = NULL ; ai -> flags = 1 << FLAG_RADIO_DOWN ; ai -> jobs = 0 ; ai -> dev = dev ; if ( pci && ( pci -> device == 0x5000 || pci -> device == 0xa504 ) ) { airo_print_dbg ( "", "Found   an   MPI350   card" ) ; set_bit ( FLAG_MPI, & ai -> flags ) ; } spin_lock_init ( & ai -> aux_lock ) ; sema_init ( & ai -> sem, 1 ) ; ai -> config. len = 0 ; ai -> pci = pci ; init_waitqueue_head ( & ai -> thr_wait ) ; ai -> tfm = NULL ; add_airo_dev ( ai ) ; if ( airo_networks_allocate ( ai ) ) goto err_out_free ; airo_networks_initialize ( ai ) ; skb_queue_head_init ( & ai -> txq ) ; if ( test_bit ( FLAG_MPI, & ai -> flags ) ) dev -> netdev_ops = & mpi_netdev_ops ; else dev -> netdev_ops = & airo_netdev_ops ; dev -> wireless_handlers = & airo_handler_def ; ai -> wireless_data. spy_data = & ai -> spy_data ; dev -> wireless_data = & ai -> wireless_data ; dev -> irq = irq ; dev -> base_addr = port ; <START_BUG> SET_NETDEV_DEV ( dev, dmdev ) ; <END_BUG> reset_card ( dev, 1 ) ; msleep ( 400 ) ; if


Fix:
<S2SV_ModStart> = port ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ;
Buggy code:
 static int udf_load_logicalvol ( struct super_block * sb, sector_t block, struct kernel_lb_addr * fileset ) { struct logicalVolDesc * lvd ; int i, j, offset ; uint8_t type ; struct udf_sb_info * sbi = UDF_SB ( sb ) ; struct genericPartitionMap * gpm ; uint16_t ident ; struct buffer_head * bh ; <START_BUG> int ret = 0 ; <END_BUG> bh = udf_read_tagged ( sb, block, block, & ident ) ; if (! bh ) return 1 ; BUG_ON ( ident!= TAG_IDENT_LVD ) ;  lvd = ( struct logicalVolDesc * ) bh -> b_data ; <START_BUG> ret = udf_sb_alloc_partition_maps ( sb, le32_to_cpu ( lvd -> numPartitionMaps ) ) ; if ( ret ) goto out_bh ; for ( i = 0, offset = 0 ; <END_BUG> i < sbi -> s_partitions && offset < le32_to_cpu ( lvd -> mapTableLength ) ;  i ++, offset += gpm -> partitionMapLength ) { struct udf_part_map * map = & sbi -> s_partmaps [ i ] ; gpm = ( struct genericPartitionMap * ) & ( lvd -> partitionMaps [ offset ] ) ; type = gpm -> partitionMapType ; if ( type == 1 ) { struct genericPartitionMap1 * gpm1 = ( struct genericPartitionMap1 * ) gpm ; map -> s_partition_type = UDF_TYPE1_MAP15 ; map -> s_volumeseqnum = le16_to_cpu ( gpm1 -> volSeqNum ) ; map -> s_partition_num = le16_to_cpu ( gpm1 -> partitionNum ) ; map -> s_partition_func = NULL ; } else if ( type == 2 ) { struct udfPartitionMap2 * upm2 = ( struct udfPartitionMap2 * ) gpm ; if (! strncmp ( upm2 -> partIdent. ident, UDF_ID_VIRTUAL, strlen ( UDF_ID_VIRTUAL ) ) ) { u16 suf = le16_to_cpu ( ( ( __le16 * ) upm2 -> partIdent. identSuffix ) [ 0 ] ) ; if ( suf <

Fix:
<S2SV_ModStart> * bh ; unsigned int table_len ; <S2SV_ModStart> -> b_data ; table_len = le32_to_cpu ( lvd -> mapTableLength ) ; if ( sizeof ( * lvd ) + table_len > sb -> s_blocksize ) { udf_err ( sb, "error <S2SV_blank> loading <S2SV_blank> logical <S2SV_blank> volume <S2SV_blank> descriptor: <S2SV_blank> " "Partition <S2SV_blank> table <S2SV_blank> too <S2SV_blank> long <S2SV_blank> (%u <S2SV_blank> > <S2SV_blank> %lu)\\n", table_len, sb -> s_blocksize - sizeof ( * lvd ) ) ; goto out_bh ; } <S2SV_ModStart> && offset < table_len <S2SV_ModEnd> ; i ++
Buggy code:
 void mono_reflection_create_dynamic_method ( MonoReflectionDynamicMethod * mb ) { <START_BUG> ReflectionMethodBuilder rmb ; <END_BUG> MonoMethodSignature * sig ; MonoClass * klass ; GSList * l ;  int i ; <START_BUG> sig = dynamic_method_to_signature ( mb ) ; reflection_methodbuilder_from_dynamic_method ( & rmb, mb ) ; rmb. nrefs = mb -> nrefs ; rmb. refs = g_new0 ( gpointer, mb -> nrefs + 1 ) ; for ( i = 0 ; i < mb -> nrefs ; i += 2 ) { MonoClass * handle_class ; gpointer ref ; MonoObject * obj = mono_array_get ( mb -> refs, MonoObject *, i ) ; if ( strcmp ( obj -> vtable -> klass -> name, "DynamicMethod" ) == 0 ) { MonoReflectionDynamicMethod * method = ( MonoReflectionDynamicMethod * ) obj ; if ( method -> mhandle ) { ref = method -> mhandle ; } else { ref = method ; method -> referenced_by = g_slist_append ( method -> referenced_by, mb ) ; } handle_class = mono_defaults. methodhandle_class ; } else { MonoException * ex = NULL ; ref = resolve_object ( mb -> module -> image, obj, & handle_class, NULL ) ; if (! ref ) ex = mono_get_exception_type_load ( NULL, NULL ) ; else if ( mono_security_get_mode ( ) == MONO_SECURITY_MODE_CORE_CLR ) ex = mono_security_core_clr_ensure_dynamic_method_resolved_object ( ref, handle_class ) ; if ( ex ) { g_free ( rmb. refs ) ; mono_raise_exception ( ex ) ; return ; } } rmb. refs [ i ] = ref ; rmb. refs [ i + 1 ] = handle_class ; } klass = mb -> owner? mono_class_from_mono_type ( mono_reflection_type_get_handle ( ( MonoReflectionType * ) mb -> owner ) ) : mono_defaults. object_class ; <END_BUG> mb -> mhandle = reflection_methodbuilder_to_mono_method ( klass

Fix:
<S2SV_ModStart> mb ) { MonoReferenceQueue * queue ; MonoMethod * handle ; DynamicMethodReleaseData * release_data ; <S2SV_ModStart> int i ; if ( mono_runtime_is_shutting_down ( ) ) mono_raise_exception ( mono_get_exception_invalid_operation ( "" ) ) ; if (! ( queue = dynamic_method_queue ) ) { mono_loader_lock ( ) ; if (! ( queue = dynamic_method_queue ) ) queue = dynamic_method_queue = mono_gc_reference_queue_new ( free_dynamic_method ) ; mono_loader_unlock ( ) ; } <S2SV_ModStart> -> mhandle = handle = <S2SV_ModStart> rmb, sig ) ; release_data = g_new ( DynamicMethodReleaseData, 1 ) ; release_data -> handle = handle ; release_data -> domain = mono_object_get_domain ( ( MonoObject * ) mb ) ; if (! mono_gc_reference_queue_add ( queue, ( MonoObject * ) mb, release_data ) ) g_free ( release_data
Buggy code:
 static int rose_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; <START_BUG> struct rose_sock * rose = rose_sk ( sk ) ; <END_BUG> struct sockaddr_rose * srose = ( struct sockaddr_rose * ) msg -> msg_name ; size_t copied ; unsigned char * asmptr ; struct sk_buff * skb ; int n, er, qbit ; if ( sk -> sk_state!= TCP_ESTABLISHED ) return - ENOTCONN ; if ( ( skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & er ) ) == NULL ) return er ; qbit = ( skb -> data [ 0 ] & ROSE_Q_BIT ) == ROSE_Q_BIT ; skb_pull ( skb, ROSE_MIN_LEN ) ; if ( rose -> qbitincl ) { asmptr = skb_push ( skb, 1 ) ; * asmptr = qbit ; } skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ;  if ( srose!= NULL ) { <START_BUG> <END_BUG> memset ( srose, 0, msg -> msg_namelen ) ;  srose -> srose_family = AF_ROSE ; srose -> srose_addr = rose -> dest_addr ; srose -> srose_call = rose -> dest_call ; srose -> srose_ndigis = rose -> dest_ndigis ; if ( msg -> msg_namelen >= sizeof ( struct full_sockaddr_rose ) ) { struct full_sockaddr_rose * full_srose = ( struct full_sockaddr_rose * ) msg -> msg_name ; for ( n = 0 ; n < rose -> dest_ndigis ; n ++ )

Fix:
<S2SV_ModStart> ( sk ) <S2SV_ModEnd> ; size_t copied <S2SV_ModStart> ; if ( msg -> msg_name ) { struct sockaddr_rose * srose ; memset ( msg -> msg_name <S2SV_ModEnd>, 0, <S2SV_ModStart>, 0, sizeof ( struct full_sockaddr_rose ) ) ; srose = msg -> msg_name <S2SV_ModEnd> ; srose ->
Buggy code:
 struct resource_pool * dce112_create_resource_pool ( uint8_t num_virtual_links, struct dc * dc ) { struct dce110_resource_pool * pool = kzalloc ( sizeof ( struct dce110_resource_pool ), GFP_KERNEL ) ; if (! pool ) return NULL ; if ( construct ( num_virtual_links, dc, pool ) ) return & pool -> base ; <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> -> base ; kfree ( pool ) ;
Buggy code:
 int tls1_setup_key_block ( SSL * s ) { unsigned char * p ; const EVP_CIPHER * c ; const EVP_MD * hash ; int num ; SSL_COMP * comp ; int mac_type = NID_undef, mac_secret_size = 0 ; int ret = 0 ; if ( s -> s3 -> tmp. key_block_length!= 0 ) return ( 1 ) ; if (! ssl_cipher_get_evp ( s -> session, & c, & hash, & mac_type, & mac_secret_size, & comp, <START_BUG> SSL_USE_ETM ( s ) ) ) { <END_BUG> SSLerr ( SSL_F_TLS1_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE ) ; return ( 0 ) ; } s -> s3 -> tmp. new_sym_enc = c ; s -> s3 -> tmp. new_hash = hash ; s -> s3 -> tmp. new_mac_pkey_type = mac_type ; s -> s3 -> tmp. new_mac_secret_size = mac_secret_size ; num = EVP_CIPHER_key_length ( c ) + mac_secret_size + EVP_CIPHER_iv_length ( c ) ; num *= 2 ; ssl3_cleanup_key_block ( s ) ; if ( ( p = OPENSSL_malloc ( num ) ) == NULL ) { SSLerr ( SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE ) ; goto err ; } s -> s3 -> tmp. key_block_length = num ; s -> s3 -> tmp. key_block = p ; # ifdef SSL_DEBUG printf ( "client   random\\n" ) ; { int z ; for ( z = 0 ; z < SSL3_RANDOM_SIZE ; z ++ ) printf ( "%02X%c", s -> s3 -> client_random [ z ], ( ( z + 1 ) % 16 )?' ': '\\n' ) ; } printf ( "server   random\\n" ) ; { int z ; for ( z = 0 ; z < SSL3_RANDOM_SIZE ; z ++ ) printf ( "%02X%c",

Fix:
<S2SV_ModStart> & comp, s -> tlsext_use_etm <S2SV_ModEnd> ) ) {
Buggy code:
 void xmlParsePEReference ( xmlParserCtxtPtr ctxt ) { const xmlChar * name ; xmlEntityPtr entity = NULL ; xmlParserInputPtr input ; if ( RAW!= '%' ) return ; NEXT ; name = xmlParseName ( ctxt ) ; if ( name == NULL ) { xmlFatalErrMsg ( ctxt, XML_ERR_PEREF_NO_NAME, "PEReference:   no   name\\n" ) ; return ; } if ( xmlParserDebugEntities ) xmlGenericError ( xmlGenericErrorContext, "PEReference:   %s\\n", name ) ; if ( RAW!= ';' ) { xmlFatalErr ( ctxt, XML_ERR_PEREF_SEMICOL_MISSING, NULL ) ; return ; } NEXT ; ctxt -> nbentities ++ ; if ( ( ctxt -> sax!= NULL ) && ( ctxt -> sax -> getParameterEntity!= NULL ) ) entity = ctxt -> sax -> getParameterEntity ( ctxt -> userData, name ) ; if ( ctxt -> instate == XML_PARSER_EOF ) return ; if ( entity == NULL ) { if ( ( ctxt -> standalone == 1 ) || ( ( ctxt -> hasExternalSubset == 0 ) && ( ctxt -> hasPErefs == 0 ) ) ) { xmlFatalErrMsgStr ( ctxt, XML_ERR_UNDECLARED_ENTITY, "PEReference:   %%%s;   not   found\\n", name ) ; } else { if ( ( ctxt -> validate ) && ( ctxt -> vctxt. error!= NULL ) ) { xmlValidityError ( ctxt, XML_WAR_UNDECLARED_ENTITY, "PEReference:   %%%s;   not   found\\n", name, NULL ) ; } else xmlWarningMsg ( ctxt, XML_WAR_UNDECLARED_ENTITY, "PEReference:   %%%s;   not   found\\n", name, NULL ) ; ctxt -> valid = 0 ; } xmlParserEntityCheck ( ctxt, 0, NULL, 0 ) ; } else { if ( ( entity -> etype!= XML_INTERNAL_PARAMETER_ENTITY ) && ( entity -> etype!= XML_EXTERNAL_PARAMETER_ENTITY ) ) { xmlWarningMsg ( ctxt, XML_WAR_UNDECLARED_ENTITY, "Internal:   %%%s;   is   not   a   parameter   entity\\n", name, NULL ) ; } else { xmlChar start [ 4 ]

Fix:
<S2SV_ModStart> < 0 ) { xmlFreeInputStream ( input ) ; return ; } <S2SV_ModEnd> if ( entity