nus-yam/ex-repair huggingface dataset:
Buggy code:
 static OM_uint32 acc_ctx_cont ( OM_uint32 * minstat, gss_buffer_t buf, gss_ctx_id_t * ctx, gss_buffer_t * responseToken, gss_buffer_t * mechListMIC, OM_uint32 * negState, send_token_flag * return_token ) { OM_uint32 ret, tmpmin ; gss_OID supportedMech ; spnego_gss_ctx_id_t sc ; unsigned int len ; unsigned char * ptr, * bufstart ; sc = ( spnego_gss_ctx_id_t ) * ctx ; ret = GSS_S_DEFECTIVE_TOKEN ; * negState = REJECT ; * minstat = 0 ; supportedMech = GSS_C_NO_OID ; * return_token = ERROR_TOKEN_SEND ; * responseToken = * mechListMIC = GSS_C_NO_BUFFER ; ptr = bufstart = buf -> value ; # define REMAIN ( buf -> length - ( ptr - bufstart ) ) <START_BUG> if ( REMAIN > INT_MAX ) <END_BUG> return GSS_S_DEFECTIVE_TOKEN ; if ( * ptr == HEADER_ID ) { ret = g_verify_token_header ( gss_mech_spnego, & len, & ptr, 0, REMAIN ) ; if ( ret ) { * minstat = ret ; return GSS_S_DEFECTIVE_TOKEN ; } } if ( * ptr!= ( CONTEXT | 0x01 ) ) { return GSS_S_DEFECTIVE_TOKEN ; } ret = get_negTokenResp ( minstat, ptr, REMAIN, negState, & supportedMech, responseToken, mechListMIC ) ; if ( ret!= GSS_S_COMPLETE ) goto cleanup ; if ( * responseToken == GSS_C_NO_BUFFER && * mechListMIC == GSS_C_NO_BUFFER ) { ret = GSS_S_DEFECTIVE_TOKEN ; goto cleanup ; } if ( supportedMech!= GSS_C_NO_OID ) { ret = GSS_S_DEFECTIVE_TOKEN ; goto cleanup ; } sc -> firstpass = 0 ; * negState = ACCEPT_INCOMPLETE ; * return_token = CONT_TOKEN_SEND ; cleanup : if ( supportedMech!= GSS

Fix:
<S2SV_ModStart> if ( REMAIN == 0 || REMAIN
Buggy code:
 <START_BUG> static void encode_b_rt ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> TOKENEXTRA * * tp, int mi_row, int mi_col,  int output_enabled, BLOCK_SIZE bsize ) { <START_BUG> <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  <START_BUG> if ( bsize < BLOCK_8X8 ) { <END_BUG> if ( x -> ab_index > 0 ) return ; }  set_offsets ( cpi, tile, mi_row, mi_col, bsize ) ; <START_BUG> <END_BUG> update_state_rt ( cpi, get_block_context ( x, bsize ), mi_row, mi_col, bsize ) ;  <START_BUG> encode_superblock ( cpi, tp, output_enabled, mi_row, mi_col, bsize ) ; <END_BUG>  update_stats ( cpi ) ; <START_BUG> ( * tp ) -> token = EOSB_TOKEN ; ( * tp ) ++ ; }<END_BUG>

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, <S2SV_ModStart>, BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> -> mb ; <S2SV_ModEnd> set_offsets ( cpi <S2SV_ModStart> cpi, tile, x <S2SV_ModStart> ( cpi, td, ctx <S2SV_ModEnd>, mi_row, <S2SV_ModStart> bsize ) ; # if CONFIG_VP9_TEMPORAL_DENOISING if ( cpi -> oxcf. noise_sensitivity > 0 && output_enabled && cpi -> common. frame_type!= KEY_FRAME ) { vp9_denoiser_denoise ( & cpi -> denoiser, x, mi_row, mi_col, MAX ( BLOCK_8X8, bsize ), ctx ) ; } # endif <S2SV_ModStart> encode_superblock ( cpi, td <S2SV_ModStart> mi_col, bsize, ctx <S2SV_ModStart> ; update_stats ( & cpi -> common, td <S2SV_ModEnd> ) ; (
Buggy code:
 IHEVCD_ERROR_T ihevcd_mv_buf_mgr_add_bufs ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 i ; WORD32 max_dpb_size ; WORD32 mv_bank_size_allocated ; WORD32 pic_mv_bank_size ; sps_t * ps_sps ; UWORD8 * pu1_buf ; mv_buf_t * ps_mv_buf ; ps_sps = ps_codec -> s_parse. ps_sps ; max_dpb_size = ps_sps -> ai1_sps_max_dec_pic_buffering [ ps_sps -> i1_sps_max_sub_layers - 1 ] ; max_dpb_size ++ ; <START_BUG> pu1_buf = ( UWORD8 * ) ps_codec -> pv_mv_bank_buf_base ; <END_BUG> ps_mv_buf = ( mv_buf_t * ) pu1_buf ; pu1_buf += max_dpb_size * sizeof ( mv_buf_t ) ; ps_codec -> ps_mv_buf = ps_mv_buf ; mv_bank_size_allocated = ps_codec -> i4_total_mv_bank_size - max_dpb_size * sizeof ( mv_buf_t ) ; pic_mv_bank_size = ihevcd_get_pic_mv_bank_size ( ALIGN64 ( ps_sps -> i2_pic_width_in_luma_samples ) * ALIGN64 ( ps_sps -> i2_pic_height_in_luma_samples ) ) ; for ( i = 0 ; i < max_dpb_size ; i ++ ) { WORD32 buf_ret ; WORD32 num_pu ; WORD32 num_ctb ; WORD32 pic_size ; pic_size = ALIGN64 ( ps_sps -> i2_pic_width_in_luma_samples ) * ALIGN64 ( ps_sps -> i2_pic_height_in_luma_samples ) ; num_pu = pic_size // ( MIN_PU_SIZE * MIN_PU_

Fix:
<S2SV_ModStart> max_dpb_size ++ ; ps_codec -> i4_max_dpb_size = max_dpb_size ;
Buggy code:
 static int setup_dev_console ( const struct lxc_rootfs * rootfs, const struct lxc_console * console ) { char path [ MAXPATHLEN ] ; struct stat s ; int ret ; ret = snprintf ( path, sizeof ( path ), "%s//dev//console", rootfs -> mount ) ; if ( ret >= sizeof ( path ) ) { ERROR ( "console   path   too   long" ) ; return - 1 ; } if ( access ( path, F_OK ) ) { WARN ( "rootfs   specified   but   no   console   found   at   \'%s\'", path ) ; return 0 ; } if ( console -> master < 0 ) { INFO ( "no   console" ) ; return 0 ; } if ( stat ( path, & s ) ) { SYSERROR ( "failed   to   stat   \'%s\'", path ) ; return - 1 ; } if ( chmod ( console -> name, s. st_mode ) ) { SYSERROR ( "failed   to   set   mode   \'0%o\'   to   \'%s\'", s. st_mode, console -> name ) ; return - 1 ; } <START_BUG> if ( mount ( console -> name, path, "none", MS_BIND, 0 ) ) { <END_BUG> ERROR ( "failed   to   mount   \'%s\'   on   \'%s\'", console -> name, path ) ; return - 1 ; } INFO ( "console   has   been   setup" ) ; return 0 ; }

Fix:
<S2SV_ModStart> } if ( safe_mount ( console -> name, path, "none", MS_BIND, 0, rootfs -> mount <S2SV_ModEnd> ) ) {
Buggy code:
 static unsigned int seedsize ( struct crypto_alg * alg ) { struct rng_alg * ralg = container_of ( alg, struct rng_alg, base ) ; <START_BUG> return alg -> cra_rng. rng_make_random? <END_BUG> alg -> cra_rng. seedsize : ralg -> seedsize ; }

Fix:
<S2SV_ModStart> ) ; return <S2SV_ModEnd> ralg -> seedsize
Buggy code:
 char * enl_ipc_get ( const char * msg_data ) { static char * message = NULL ; <START_BUG> static unsigned short len = 0 ; <END_BUG> char buff [ 13 ], * ret_msg = NULL ; register unsigned char i ; unsigned char blen ; if ( msg_data == IPC_TIMEOUT ) { return ( IPC_TIMEOUT ) ; } for ( i = 0 ; i < 12 ; i ++ ) { buff [ i ] = msg_data [ i ] ; } buff [ 12 ] = 0 ; blen = strlen ( buff ) ; if ( message!= NULL ) { len += blen ; message = ( char * ) erealloc ( message, len + 1 ) ; strcat ( message, buff ) ; } else { len = blen ; message = ( char * ) emalloc ( len + 1 ) ; strcpy ( message, buff ) ; } if ( blen < 12 ) { ret_msg = message ; message = NULL ; D ( ( "Received   complete   reply:     \\"%s\\"\\n", ret_msg ) ) ; } return ( ret_msg ) ; }

Fix:
<S2SV_ModStart> NULL ; static size_t <S2SV_ModEnd> len = 0
Buggy code:
 <START_BUG> void vp9_encode_mv ( VP9_COMP * cpi, vp9_writer * w, <END_BUG> const MV * mv, const MV * ref, const nmv_context * mvctx, int usehp ) { const MV diff = { mv -> row - ref -> row, mv -> col - ref -> col } ; const MV_JOINT_TYPE j = vp9_get_mv_joint ( & diff ) ; usehp = usehp && vp9_use_mv_hp ( ref ) ; vp9_write_token ( w, vp9_mv_joint_tree, mvctx -> joints, & mv_joint_encodings [ j ] ) ; if ( mv_joint_vertical ( j ) ) encode_mv_component ( w, diff. row, & mvctx -> comps [ 0 ], usehp ) ; if ( mv_joint_horizontal ( j ) ) encode_mv_component ( w, diff. col, & mvctx -> comps [ 1 ], usehp ) ;  if (! cpi -> dummy_packing && cpi -> sf. auto_mv_step_size ) { <START_BUG> unsigned int maxv = MAX ( abs ( mv -> row ), abs ( mv -> col ) ) >> 3 ; cpi -> max_mv_magnitude = MAX ( maxv, cpi -> max_mv_magnitude ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> * cpi, vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> ; if ( <S2SV_ModEnd> cpi -> sf <S2SV_ModStart> cpi -> sf. mv
Buggy code:
 static struct usmStateReference * usm_malloc_usmStateReference ( void ) { <START_BUG> struct usmStateReference * retval = ( struct usmStateReference * ) <END_BUG> calloc ( 1, sizeof ( struct usmStateReference ) ) ;  return retval ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> usmStateReference * retval ; retval = <S2SV_ModEnd> calloc ( 1 <S2SV_ModStart> ) ) ; if ( retval ) retval -> refcnt = 1 ;
Buggy code:
 void bpf_jit_compile ( struct sk_filter * fp ) { u8 temp [ 64 ] ; u8 * prog ; unsigned int proglen, oldproglen = 0 ; int ilen, i ; int t_offset, f_offset ; u8 t_op, f_op, seen = 0, pass ; u8 * image = NULL ; u8 * func ; int pc_ret0 = - 1 ; unsigned int cleanup_addr ; unsigned int * addrs ; const struct sock_filter * filter = fp -> insns ; int flen = fp -> len ; if (! bpf_jit_enable ) return ; addrs = kmalloc ( flen * sizeof ( * addrs ), GFP_KERNEL ) ; if ( addrs == NULL ) return ; for ( proglen = 0, i = 0 ; i < flen ; i ++ ) { proglen += 64 ; addrs [ i ] = proglen ; } cleanup_addr = proglen ; for ( pass = 0 ; pass < 10 ; pass ++ ) { proglen = 0 ; prog = temp ; if ( seen ) { EMIT4 ( 0x55, 0x48, 0x89, 0xe5 ) ; EMIT4 ( 0x48, 0x83, 0xec, 96 ) ; if ( seen & ( SEEN_XREG | SEEN_DATAREF ) ) EMIT4 ( 0x48, 0x89, 0x5d, 0xf8 ) ; if ( seen & SEEN_XREG ) CLEAR_X ( ) ; if ( seen & SEEN_DATAREF ) { if ( offsetof ( struct sk_buff, len ) <= 127 ) EMIT4 ( 0x44, 0x8b, 0x4f, offsetof ( struct sk_buff, len ) ) ; else { EMIT3 ( 0x44, 0x8b, 0x8f ) ; EMIT ( offsetof ( struct sk_buff, len ), 4 ) ; } if ( is_imm8 ( offsetof ( struct sk_buff, data_len ) ) ) EMIT4 ( 0x44, 0x2b, 0x4f, offsetof ( struct sk_buff, data_len ) ) ; else { EMIT3 ( 0x44, 0x2b, 0x8f ) ; EMIT

Fix:
<S2SV_ModStart> ]. jf && f_offset <S2SV_ModStart>? 2 : 5 <S2SV_ModEnd> ; EMIT_COND_JMP (
Buggy code:
 static void _sx_sasl_client_process ( sx_t s, sx_plugin_t p, Gsasl_session * sd, const char * mech, const char * in, int inlen ) { _sx_sasl_t ctx = ( _sx_sasl_t ) p -> private ; _sx_sasl_sess_t sctx = NULL ; char * buf = NULL, * out = NULL, * realm = NULL, * * ext_id ; char hostname [ 256 ] ; int ret ; # ifdef HAVE_SSL int i ; # endif size_t buflen, outlen ; assert ( ctx ) ; assert ( ctx -> cb ) ; if ( mech!= NULL ) { _sx_debug ( ZONE, "auth   request   from   client   (mechanism=%s)", mech ) ; <START_BUG> if (! gsasl_server_support_p ( ctx -> gsasl_ctx, mech ) ) { <END_BUG> _sx_debug ( ZONE, "client   requested   mechanism   (%s)   that   we   didn\'t   offer", mech ) ; _sx_nad_write ( s, _sx_sasl_failure ( s, _sasl_err_INVALID_MECHANISM, NULL ), 0 ) ; return ; } ret = gsasl_server_start ( ctx -> gsasl_ctx, mech, & sd ) ; if ( ret!= GSASL_OK ) { _sx_debug ( ZONE, "gsasl_server_start   failed,   no   sasl   for   this   conn;   (%d):   %s", ret, gsasl_strerror ( ret ) ) ; _sx_nad_write ( s, _sx_sasl_failure ( s, _sasl_err_TEMPORARY_FAILURE, gsasl_strerror ( ret ) ), 0 ) ; return ; } ( ctx -> cb ) ( sx_sasl_cb_GET_REALM, NULL, ( void * * ) & realm, s, ctx -> cbarg ) ; sctx = gsasl_session_hook_get ( sd ) ; if ( sctx!= NULL ) free ( sctx ) ; sctx = ( _sx_sasl_

Fix:
<S2SV_ModStart>, mech ) || ( ctx -> cb ) ( sx_sasl_cb_CHECK_MECH, ( void * ) mech, NULL, s, ctx -> cbarg )!= sx_sasl_ret_OK
Buggy code:
 int dtls1_get_record ( SSL * s ) { int ssl_major, ssl_minor ; int i, n ; SSL3_RECORD * rr ; unsigned char * p = NULL ; unsigned short version ; DTLS1_BITMAP * bitmap ; unsigned int is_next_epoch ; rr = & ( s -> s3 -> rrec ) ; dtls1_process_buffered_records ( s ) ; if ( dtls1_get_processed_record ( s ) ) return 1 ; again : if ( ( s -> rstate!= SSL_ST_READ_BODY ) || ( s -> packet_length < DTLS1_RT_HEADER_LENGTH ) ) { n = ssl3_read_n ( s, DTLS1_RT_HEADER_LENGTH, s -> s3 -> rbuf. len, 0 ) ; if ( n <= 0 ) return ( n ) ; if ( s -> packet_length!= DTLS1_RT_HEADER_LENGTH ) { s -> packet_length = 0 ; goto again ; } s -> rstate = SSL_ST_READ_BODY ; p = s -> packet ; if ( s -> msg_callback ) s -> msg_callback ( 0, 0, SSL3_RT_HEADER, p, DTLS1_RT_HEADER_LENGTH, s, s -> msg_callback_arg ) ; rr -> type = * ( p ++ ) ; ssl_major = * ( p ++ ) ; ssl_minor = * ( p ++ ) ; version = ( ssl_major << 8 ) | ssl_minor ; n2s ( p, rr -> epoch ) ; memcpy ( & ( s -> s3 -> read_sequence [ 2 ] ), p, 6 ) ; p += 6 ; n2s ( p, rr -> length ) ; if (! s -> first_packet ) { if ( version!= s -> version ) { rr -> length = 0 ; s -> packet_length = 0 ; goto again ; } } if ( ( version & 0xff00 )!= ( s -> version & 0xff00 ) ) { rr -> length = 0 ; s -> packet_length = 0 ; goto again ; } if ( rr -> length > SSL3_RT_MAX_ENCRYPTED_LENGTH ) { rr -> length = 0 ; s -> packet_length = 0 ; goto again ; } } if ( rr -> length > s ->

Fix:
<S2SV_ModStart> if ( n <S2SV_ModEnd>!= i )
Buggy code:
 int user_update ( struct key * key, struct key_preparsed_payload * prep ) { struct user_key_payload * zap = NULL ; int ret ; ret = key_payload_reserve ( key, prep -> datalen ) ; if ( ret < 0 ) return ret ; key -> expiry = prep -> expiry ; <START_BUG> if (! test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) <END_BUG> zap = dereference_key_locked ( key ) ; rcu_assign_keypointer ( key, prep -> payload. data [ 0 ] ) ; prep -> payload. data [ 0 ] = NULL ; if ( zap ) call_rcu ( & zap -> rcu, user_free_payload_rcu ) ; return ret ; }

Fix:
<S2SV_ModStart> ; if ( key_is_positive ( key <S2SV_ModEnd> ) ) zap
Buggy code:
 static int decode_dds1 ( GetByteContext * gb, uint8_t * frame, int width, int height ) { const uint8_t * frame_start = frame ; const uint8_t * frame_end = frame + width * height ; int mask = 0x10000, bitbuf = 0 ; int i, v, offset, count, segments ; segments = bytestream2_get_le16 ( gb ) ; while ( segments -- ) { if ( bytestream2_get_bytes_left ( gb ) < 2 ) return AVERROR_INVALIDDATA ; if ( mask == 0x10000 ) { bitbuf = bytestream2_get_le16u ( gb ) ; mask = 1 ; } if ( bitbuf & mask ) { v = bytestream2_get_le16 ( gb ) ; offset = ( v & 0x1FFF ) << 2 ; count = ( ( v >> 13 ) + 2 ) << 1 ; if ( frame - frame_start < offset || frame_end - frame < count * 2 + width ) return AVERROR_INVALIDDATA ; for ( i = 0 ; i < count ; i ++ ) { frame [ 0 ] = frame [ 1 ] = frame [ width ] = frame [ width + 1 ] = frame [ - offset ] ; frame += 2 ; } } else if ( bitbuf & ( mask << 1 ) ) { v = bytestream2_get_le16 ( gb ) * 2 ; if ( frame - frame_end < v ) return AVERROR_INVALIDDATA ; frame += v ; } else { <START_BUG> if ( frame_end - frame < width + 3 ) <END_BUG> return AVERROR_INVALIDDATA ; frame [ 0 ] = frame [ 1 ] = frame [ width ] = frame [ width + 1 ] = bytestream2_get_byte ( gb ) ; frame += 2 ; frame [ 0 ] = frame [ 1 ] = frame [ width ] = frame [ width + 1 ] = bytestream2_get_byte ( gb ) ; frame += 2 ; } mask <<= 2 ; } return 0 ; }

Fix:
<S2SV_ModStart> < width + 4 <S2SV_ModEnd> ) return AVERROR_INVALIDDATA
Buggy code:
 static bool handle_client_startup ( PgSocket * client, PktHdr * pkt ) { const char * passwd ; const uint8_t * key ; bool ok ; SBuf * sbuf = & client -> sbuf ; if ( incomplete_pkt ( pkt ) ) { disconnect_client ( client, true, "client   sent   partial   pkt   in   startup   phase" ) ; return false ; } if ( client -> wait_for_welcome ) { if ( finish_client_login ( client ) ) { sbuf_prepare_skip ( sbuf, pkt -> len ) ; return true ; } else return false ; } switch ( pkt -> type ) { case PKT_SSLREQ : slog_noise ( client, "C:   req   SSL" ) ; slog_noise ( client, "P:   nak" ) ; if (! sbuf_answer ( & client -> sbuf, "N", 1 ) ) { disconnect_client ( client, false, "failed   to   nak   SSL" ) ; return false ; } break ; case PKT_STARTUP_V2 : disconnect_client ( client, true, "Old   V2   protocol   not   supported" ) ; return false ; case PKT_STARTUP : if ( client -> pool ) { disconnect_client ( client, true, "client   re-sent   startup   pkt" ) ; return false ; } if (! decide_startup_pool ( client, pkt ) ) return false ; if ( client -> pool -> db -> admin ) { if (! admin_pre_login ( client ) ) return false ; } if ( cf_auth_type <= AUTH_TRUST || client -> own_user ) { if (! finish_client_login ( client ) ) return false ; } else { if (! send_client_authreq ( client ) ) { disconnect_client ( client, false, "failed   to   send   auth   req" ) ; return false ; } } break ; case 'p' : <START_BUG> if ( cf_auth_type <= AUTH_TRUST ) { <END_BUG> disconnect_client ( client, true, "unrequested   passwd   pkt" ) ; return false ; } ok = mbuf_get_string ( & pkt -> data, & passwd ) ; if ( ok && check_client_passwd ( client,

Fix:
<S2SV_ModStart> : if (! client -> auth_user ) { disconnect_client ( client, true, "client <S2SV_blank> password <S2SV_blank> pkt <S2SV_blank> before <S2SV_blank> startup <S2SV_blank> packet" ) ; return false ; } if (
Buggy code:
 static inline int xfrm_replay_verify_len ( struct xfrm_replay_state_esn * replay_esn, struct nlattr * rp ) { struct xfrm_replay_state_esn * up ; <START_BUG> if (! replay_esn ||! rp ) <END_BUG> return 0 ; up = nla_data ( rp ) ;  if ( xfrm_replay_state_esn_len ( replay_esn )!= <START_BUG> <END_BUG> xfrm_replay_state_esn_len ( up ) )  return - EINVAL ; return 0 ; }

Fix:
<S2SV_ModStart> * up ; int ulen ; <S2SV_ModStart> rp ) ; ulen = xfrm_replay_state_esn_len ( up ) ; if ( nla_len ( rp ) < ulen || <S2SV_ModEnd> xfrm_replay_state_esn_len ( replay_esn <S2SV_ModStart> replay_esn )!= ulen <S2SV_ModEnd> ) return -
Buggy code:
 static int handle_keywordonly_args ( struct compiling * c, const node * n, int start, asdl_seq * kwonlyargs, asdl_seq * kwdefaults ) { PyObject * argname ; node * ch ; expr_ty expression, annotation ; arg_ty arg ; int i = start ; int j = 0 ; if ( kwonlyargs == NULL ) { ast_error ( c, CHILD ( n, start ), "named   arguments   must   follow   bare   *" ) ; return - 1 ; } assert ( kwdefaults!= NULL ) ; while ( i < NCH ( n ) ) { ch = CHILD ( n, i ) ; switch ( TYPE ( ch ) ) { case vfpdef : case tfpdef : if ( i + 1 < NCH ( n ) && TYPE ( CHILD ( n, i + 1 ) ) == EQUAL ) { expression = ast_for_expr ( c, CHILD ( n, i + 2 ) ) ; if (! expression ) goto error ; asdl_seq_SET ( kwdefaults, j, expression ) ; i += 2 ; } else { asdl_seq_SET ( kwdefaults, j, NULL ) ; } if ( NCH ( ch ) == 3 ) { annotation = ast_for_expr ( c, CHILD ( ch, 2 ) ) ; if (! annotation ) goto error ; } else { annotation = NULL ; } ch = CHILD ( ch, 0 ) ; argname = NEW_IDENTIFIER ( ch ) ; if (! argname ) goto error ; if ( forbidden_name ( c, argname, ch, 0 ) ) goto error ; <START_BUG> arg = arg ( argname, annotation, LINENO ( ch ), ch -> n_col_offset, <END_BUG> ch -> n_end_lineno, ch -> n_end_col_offset, c -> c_arena ) ; if (! arg ) goto error ; asdl_seq_SET ( kwonlyargs, j ++, arg ) ;  i += 2 ; <START_BUG> break ; case DOUBLESTAR : return i ; default : ast_error ( c, ch, "unexpected   node" ) ; goto error ; } } return i ; error : return - 1 ; }<END_BUG>

Fix:
<S2SV_ModStart>, annotation, NULL, <S2SV_ModStart> ; i += 1 ; if ( TYPE ( CHILD ( n, i ) ) == COMMA ) i += 1 ; break ; case TYPE_COMMENT : arg -> type_comment = NEW_TYPE_COMMENT ( ch ) ; if (! arg -> type_comment ) goto error ; i += 1 <S2SV_ModEnd> ; break ;
Buggy code:
 static int link_pipe ( struct pipe_inode_info * ipipe, struct pipe_inode_info * opipe, size_t len, unsigned int flags ) { struct pipe_buffer * ibuf, * obuf ; int ret = 0, i = 0, nbuf ; pipe_double_lock ( ipipe, opipe ) ; do { if (! opipe -> readers ) { send_sig ( SIGPIPE, current, 0 ) ; if (! ret ) ret = - EPIPE ; break ; } if ( i >= ipipe -> nrbufs || opipe -> nrbufs >= opipe -> buffers ) break ; ibuf = ipipe -> bufs + ( ( ipipe -> curbuf + i ) & ( ipipe -> buffers - 1 ) ) ; nbuf = ( opipe -> curbuf + opipe -> nrbufs ) & ( opipe -> buffers - 1 ) ; <START_BUG> pipe_buf_get ( ipipe, ibuf ) ; <END_BUG> obuf = opipe -> bufs + nbuf ; * obuf = * ibuf ; obuf -> flags &= ~ PIPE_BUF_FLAG_GIFT ; if ( obuf -> len > len ) obuf -> len = len ; opipe -> nrbufs ++ ; ret += obuf -> len ; len -= obuf -> len ; i ++ ; } while ( len ) ; if (! ret && ipipe -> waiting_writers && ( flags & SPLICE_F_NONBLOCK ) ) ret = - EAGAIN ; pipe_unlock ( ipipe ) ; pipe_unlock ( opipe ) ; if ( ret > 0 ) wakeup_pipe_readers ( opipe ) ; return ret ; }

Fix:
<S2SV_ModStart> 1 ) ; if (! <S2SV_ModStart>, ibuf ) ) { if ( ret == 0 ) ret = - EFAULT ; break ; } <S2SV_ModEnd> obuf = opipe
Buggy code:
 void MoveTo ( double x1, double y1 ) { <START_BUG> outpos += <END_BUG> sprintf ( outpos, "\\n   %12.3f   %12.3f   m", x1, y1 ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> y1 ) { sprintf ( outputbuffer <S2SV_ModEnd>, "\\n <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> m", <S2SV_ModStart> y1 ) ; sendClean ( outputbuffer ) ;
Buggy code:
 static __u8 * sp_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { <START_BUG> if ( * rsize >= 107 && rdesc [ 104 ] == 0x26 && rdesc [ 105 ] == 0x80 && <END_BUG> rdesc [ 106 ] == 0x03 ) { hid_info ( hdev, "fixing   up   Sunplus   Wireless   Desktop   report   descriptor\\n" ) ; rdesc [ 105 ] = rdesc [ 110 ] = 0x03 ; rdesc [ 106 ] = rdesc [ 111 ] = 0x21 ; } return rdesc ; }

Fix:
<S2SV_ModStart> * rsize >= 112 <S2SV_ModEnd> && rdesc [
Buggy code:
 void gf_isom_cenc_get_default_info_internal ( GF_TrackBox * trak, u32 sampleDescriptionIndex, u32 * container_type, Bool * default_IsEncrypted, u8 * crypt_byte_block, u8 * skip_byte_block, const u8 * * key_info, u32 * key_info_size ) { GF_ProtectionSchemeInfoBox * sinf ; if ( default_IsEncrypted ) * default_IsEncrypted = GF_FALSE ; if ( crypt_byte_block ) * crypt_byte_block = 0 ; if ( skip_byte_block ) * skip_byte_block = 0 ; if ( container_type ) * container_type = 0 ; if ( key_info ) * key_info = NULL ; if ( key_info_size ) * key_info_size = 0 ; sinf = isom_get_sinf_entry ( trak, sampleDescriptionIndex, GF_ISOM_CENC_SCHEME, NULL ) ; if (! sinf ) sinf = isom_get_sinf_entry ( trak, sampleDescriptionIndex, GF_ISOM_CBC_SCHEME, NULL ) ; if (! sinf ) sinf = isom_get_sinf_entry ( trak, sampleDescriptionIndex, GF_ISOM_CENS_SCHEME, NULL ) ; if (! sinf ) sinf = isom_get_sinf_entry ( trak, sampleDescriptionIndex, GF_ISOM_CBCS_SCHEME, NULL ) ; if (! sinf ) sinf = isom_get_sinf_entry ( trak, sampleDescriptionIndex, GF_ISOM_PIFF_SCHEME, NULL ) ; if (! sinf ) { u32 i, nb_stsd = gf_list_count ( trak -> Media -> information -> sampleTable -> SampleDescription -> child_boxes ) ; for ( i = 0 ; i < nb_stsd ; i ++ ) { GF_ProtectionSchemeInfoBox * a_sinf ; GF_SampleEntryBox * sentry = NULL ; if ( i + 1 == sampleDescriptionIndex ) continue ; sentry = gf_list_get ( trak -> Media -> information -> sampleTable -> SampleDescription -> child_boxes, i ) ; a_

Fix:
<S2SV_ModStart> ; if ( seig_entry &&
Buggy code:
 static int pptp_bind ( struct socket * sock, struct sockaddr * uservaddr, int sockaddr_len ) { struct sock * sk = sock -> sk ; struct sockaddr_pppox * sp = ( struct sockaddr_pppox * ) uservaddr ; struct pppox_sock * po = pppox_sk ( sk ) ; struct pptp_opt * opt = & po -> proto. pptp ; int error = 0 ; <START_BUG> lock_sock ( sk ) ; <END_BUG> opt -> src_addr = sp -> sa_addr. pptp ; if ( add_chan ( po ) ) error = - EBUSY ; release_sock ( sk ) ; return error ; }

Fix:
<S2SV_ModStart> = 0 ; if ( sockaddr_len < sizeof ( struct sockaddr_pppox ) ) return - EINVAL ;
Buggy code:
 static int l2tp_ip_sendmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len ) { struct sk_buff * skb ; int rc ; struct l2tp_ip_sock * lsa = l2tp_ip_sk ( sk ) ; <START_BUG> struct inet_sock * inet = inet_sk ( sk ) ; <END_BUG> struct ip_options * opt = inet -> opt ; struct rtable * rt = NULL ; int connected = 0 ; __be32 daddr ; if ( sock_flag ( sk, SOCK_DEAD ) ) return - ENOTCONN ; if ( msg -> msg_name ) { struct sockaddr_l2tpip * lip = ( struct sockaddr_l2tpip * ) msg -> msg_name ; if ( msg -> msg_namelen < sizeof ( * lip ) ) return - EINVAL ; if ( lip -> l2tp_family!= AF_INET ) { if ( lip -> l2tp_family!= AF_UNSPEC ) return - EAFNOSUPPORT ; } daddr = lip -> l2tp_addr. s_addr ; } else { if ( sk -> sk_state!= TCP_ESTABLISHED ) return - EDESTADDRREQ ; daddr = inet -> inet_daddr ; connected = 1 ; } rc = - ENOMEM ; skb = sock_wmalloc ( sk, 2 + NET_SKB_PAD + sizeof ( struct iphdr ) + 4 + len, 0, GFP_KERNEL ) ; if (! skb ) goto error ; skb_reserve ( skb, 2 + NET_SKB_PAD ) ; skb_reset_network_header ( skb ) ; skb_reserve ( skb, sizeof ( struct iphdr ) ) ; skb_reset_transport_header ( skb ) ; * ( ( __be32 * ) skb_put ( skb, 4 ) ) = 0 ; rc = memcpy_fromiovec ( skb_put ( skb, len ), msg -> msg_iov, len ) ; if ( rc < 0 ) { kfree_skb ( skb ) ; goto error ; } if ( connected ) rt = ( struct rtable * ) __sk_

Fix:
<S2SV_ModStart> ( sk ) <S2SV_ModEnd> ; struct rtable <S2SV_ModStart> NULL ) { struct ip_options_rcu * inet_opt ; inet_opt = rcu_dereference_protected ( inet -> inet_opt, sock_owned_by_user ( sk ) ) ; if ( inet_opt && inet_opt -> opt. srr ) daddr = inet_opt -> opt. <S2SV_ModEnd> faddr ; rt
Buggy code:
 int crypto_rng_reset ( struct crypto_rng * tfm, const u8 * seed, unsigned int slen ) { u8 * buf = NULL ; int err ; if (! seed && slen ) { buf = kmalloc ( slen, GFP_KERNEL ) ; if (! buf ) return - ENOMEM ; get_random_bytes ( buf, slen ) ; seed = buf ; } <START_BUG> err = tfm -> seed ( tfm, seed, slen ) ; <END_BUG> kfree ( buf ) ; return err ; }

Fix:
<S2SV_ModStart> } err = crypto_rng_alg ( tfm ) <S2SV_ModEnd> -> seed (
Buggy code:
 int tcp_rcv_state_process ( struct sock * sk, struct sk_buff * skb, const struct tcphdr * th, unsigned int len ) { struct tcp_sock * tp = tcp_sk ( sk ) ; struct inet_connection_sock * icsk = inet_csk ( sk ) ; int queued = 0 ; int res ; tp -> rx_opt. saw_tstamp = 0 ; switch ( sk -> sk_state ) { case TCP_CLOSE : goto discard ; case TCP_LISTEN : if ( th -> ack ) return 1 ; if ( th -> rst ) goto discard ; if ( th -> syn ) { <START_BUG> if ( icsk -> icsk_af_ops -> conn_request ( sk, skb ) < 0 ) <END_BUG> return 1 ; kfree_skb ( skb ) ; return 0 ; } goto discard ; case TCP_SYN_SENT : queued = tcp_rcv_synsent_state_process ( sk, skb, th, len ) ; if ( queued >= 0 ) return queued ; tcp_urg ( sk, skb, th ) ; __kfree_skb ( skb ) ; tcp_data_snd_check ( sk ) ; return 0 ; } res = tcp_validate_incoming ( sk, skb, th, 0 ) ; if ( res <= 0 ) return - res ; if ( th -> ack ) { int acceptable = tcp_ack ( sk, skb, FLAG_SLOWPATH ) > 0 ; switch ( sk -> sk_state ) { case TCP_SYN_RECV : if ( acceptable ) { tp -> copied_seq = tp -> rcv_nxt ; smp_mb ( ) ; tcp_set_state ( sk, TCP_ESTABLISHED ) ; sk -> sk_state_change ( sk ) ; if ( sk -> sk_socket ) sk_wake_async ( sk, SOCK_WAKE_IO, POLL_OUT ) ; tp -> snd_una = TCP_SKB_CB ( skb ) -> ack_seq ; tp -> snd_wnd = ntohs ( th -> window ) << tp -> rx_opt. snd_wscale ; tcp_init_wl ( tp, TCP_SKB_CB ( skb ) -> seq ) ; if ( tp -> rx_opt. tstamp_

Fix:
<S2SV_ModStart> { if ( th -> fin ) goto discard ; if (
Buggy code:
 PyObject * ast2obj_slice ( void * _o ) { slice_ty o = ( slice_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } switch ( o -> kind ) { case Slice_kind : result = PyType_GenericNew ( Slice_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_expr ( o -> v. Slice. lower ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_lower, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> v. Slice. upper ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_upper, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> v. Slice. step ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_step, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case ExtSlice_kind : result = PyType_GenericNew ( ExtSlice_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. ExtSlice. dims, ast2obj_slice ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_dims, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case Index_kind : result = PyType_GenericNew ( Index_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_expr ( o -> v. Index. value ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_value, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; } return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } switch
Buggy code:
 static int futex_wait ( u32 __user * uaddr, int fshared, u32 val, ktime_t * abs_time, u32 bitset, int clockrt ) { struct hrtimer_sleeper timeout, * to = NULL ; struct restart_block * restart ; struct futex_hash_bucket * hb ; struct futex_q q ; int ret ; if (! bitset ) return - EINVAL ; q. pi_state = NULL ; q. bitset = bitset ; q. rt_waiter = NULL ; q. requeue_pi_key = NULL ; if ( abs_time ) { to = & timeout ; hrtimer_init_on_stack ( & to -> timer, clockrt? CLOCK_REALTIME : CLOCK_MONOTONIC, HRTIMER_MODE_ABS ) ; hrtimer_init_sleeper ( to, current ) ; hrtimer_set_expires_range_ns ( & to -> timer, * abs_time, current -> timer_slack_ns ) ; } retry : ret = futex_wait_setup ( uaddr, val, fshared, & q, & hb ) ; if ( ret ) goto out ; futex_wait_queue_me ( hb, & q, to ) ; ret = 0 ; if (! unqueue_me ( & q ) ) <START_BUG> goto out_put_key ; <END_BUG> ret = - ETIMEDOUT ; if ( to &&! to -> task )  goto out_put_key ; <START_BUG> <END_BUG> if (! signal_pending ( current ) ) {  put_futex_key ( fshared, & q. key ) ; goto retry ; <START_BUG> } <END_BUG> ret = - ERESTARTSYS ; if (! abs_time )  goto out_put_key ; <START_BUG> restart = & current_thread_info ( ) -> restart_block ; restart -> fn = futex_wait_restart ; restart -> futex. uaddr = ( u32 * ) uaddr ; restart -> futex. val = val ; restart -> futex. time = abs_time -> tv64 ; restart -> futex. bitset = bitset ; restart -> futex. flags = FLAGS_HAS_TIMEOUT ; if ( fshared ) restart -> futex. flags |= FLAGS_SHARED ; if ( clockrt ) restart -> futex<END_BUG>

Fix:
<S2SV_ModStart> ) ) goto out <S2SV_ModEnd> ; ret = <S2SV_ModStart> task ) goto out <S2SV_ModEnd> ; if ( <S2SV_ModStart> current ) ) <S2SV_ModEnd> goto retry ; <S2SV_ModStart> goto retry ; <S2SV_ModEnd> ret = - <S2SV_ModStart> abs_time ) goto out <S2SV_ModEnd> ; restart = <S2SV_ModStart> - ERESTART_RESTARTBLOCK ; <S2SV_ModEnd> out : if
Buggy code:
 <START_BUG> int vp9_loop_filter_worker ( void * arg1, void * arg2 ) { <END_BUG>  LFWorkerData * const lf_data = ( LFWorkerData * ) arg1 ; <START_BUG> <END_BUG> ( void ) arg2 ;  <START_BUG> vp9_loop_filter_rows ( lf_data -> frame_buffer, lf_data -> cm, & lf_data -> xd, <END_BUG> lf_data -> start, lf_data -> stop, lf_data -> y_only ) ; return 1 ; }

Fix:
<S2SV_ModStart> int vp9_loop_filter_worker ( <S2SV_ModEnd> LFWorkerData * const <S2SV_ModStart> * const lf_data, void * unused ) { <S2SV_ModEnd> ( void ) <S2SV_ModStart> ( void ) unused <S2SV_ModEnd> ; vp9_loop_filter_rows ( <S2SV_ModStart> -> cm, lf_data -> planes <S2SV_ModEnd>, lf_data ->
Buggy code:
 fm_mgr_config_errno_t fm_mgr_config_init ( OUT p_fm_config_conx_hdlt * p_hdl, IN int instance, OPTIONAL IN char * rem_address, OPTIONAL IN char * community ) { fm_config_conx_hdl * hdl ; fm_mgr_config_errno_t res = FM_CONF_OK ; if ( ( hdl = calloc ( 1, sizeof ( fm_config_conx_hdl ) ) ) == NULL ) { res = FM_CONF_NO_MEM ; goto cleanup ; } hdl -> instance = instance ; * p_hdl = hdl ; if (! rem_address || ( strcmp ( rem_address, "localhost" ) == 0 ) ) { if ( fm_mgr_config_mgr_connect ( hdl, FM_MGR_SM ) == FM_CONF_INIT_ERR ) { res = FM_CONF_INIT_ERR ; goto cleanup ; } if ( fm_mgr_config_mgr_connect ( hdl, FM_MGR_PM ) == FM_CONF_INIT_ERR ) { res = FM_CONF_INIT_ERR ; goto cleanup ; } if ( fm_mgr_config_mgr_connect ( hdl, FM_MGR_FE ) == FM_CONF_INIT_ERR ) { res = FM_CONF_INIT_ERR ; goto cleanup ; } } <START_BUG> return res ; <END_BUG> cleanup : if ( hdl ) { free ( hdl ) ; hdl = NULL ; } return res ; }

Fix:
<S2SV_ModStart> ; } } cleanup : <S2SV_ModEnd> return res ;
Buggy code:
 static int copy_to_user_auth ( struct xfrm_algo_auth * auth, struct sk_buff * skb ) { struct xfrm_algo * algo ; struct nlattr * nla ; nla = nla_reserve ( skb, XFRMA_ALG_AUTH, sizeof ( * algo ) + ( auth -> alg_key_len + 7 ) // 8 ) ; if (! nla ) return - EMSGSIZE ; algo = nla_data ( nla ) ; <START_BUG> strcpy ( algo -> alg_name, auth -> alg_name ) ; <END_BUG> memcpy ( algo -> alg_key, auth -> alg_key, ( auth -> alg_key_len + 7 ) // 8 ) ; algo -> alg_key_len = auth -> alg_key_len ; return 0 ; }

Fix:
<S2SV_ModStart> nla ) ; strncpy <S2SV_ModEnd> ( algo -> <S2SV_ModStart> auth -> alg_name, sizeof ( algo -> alg_name )
Buggy code:
 static struct page * follow_pmd_mask ( struct vm_area_struct * vma, unsigned long address, pud_t * pudp, unsigned int flags, struct follow_page_context * ctx ) { pmd_t * pmd, pmdval ; spinlock_t * ptl ; struct page * page ; struct mm_struct * mm = vma -> vm_mm ; pmd = pmd_offset ( pudp, address ) ; pmdval = READ_ONCE ( * pmd ) ; if ( pmd_none ( pmdval ) ) return no_page_table ( vma, flags ) ; if ( pmd_huge ( pmdval ) && vma -> vm_flags & VM_HUGETLB ) { page = follow_huge_pmd ( mm, address, pmd, flags ) ; if ( page ) return page ; return no_page_table ( vma, flags ) ; } if ( is_hugepd ( __hugepd ( pmd_val ( pmdval ) ) ) ) { page = follow_huge_pd ( vma, address, __hugepd ( pmd_val ( pmdval ) ), flags, PMD_SHIFT ) ; if ( page ) return page ; return no_page_table ( vma, flags ) ; } retry : if (! pmd_present ( pmdval ) ) { if ( likely (! ( flags & FOLL_MIGRATION ) ) ) return no_page_table ( vma, flags ) ; VM_BUG_ON ( thp_migration_supported ( ) &&! is_pmd_migration_entry ( pmdval ) ) ; if ( is_pmd_migration_entry ( pmdval ) ) pmd_migration_entry_wait ( mm, pmd ) ; pmdval = READ_ONCE ( * pmd ) ; if ( pmd_none ( pmdval ) ) return no_page_table ( vma, flags ) ; goto retry ; } if ( pmd_devmap ( pmdval ) ) { ptl = pmd_lock ( mm, pmd ) ; page = follow_devmap_pmd ( vma, address, pmd, flags, & ctx -> pgmap ) ; spin_unlock

Fix:
<S2SV_ModStart> } else { if ( unlikely (! try_get_page ( page ) ) ) { spin_unlock ( ptl ) ; return ERR_PTR ( - ENOMEM ) ; } <S2SV_ModEnd> spin_unlock ( ptl
Buggy code:
 void __detach_mounts ( struct dentry * dentry ) { struct mountpoint * mp ; struct mount * mnt ; namespace_lock ( ) ; mp = lookup_mountpoint ( dentry ) ; if ( IS_ERR_OR_NULL ( mp ) ) goto out_unlock ; lock_mount_hash ( ) ; while (! hlist_empty ( & mp -> m_list ) ) { mnt = hlist_entry ( mp -> m_list. first, struct mount, mnt_mp_list ) ; if ( mnt -> mnt. mnt_flags & MNT_UMOUNT ) { struct mount * p, * tmp ; list_for_each_entry_safe ( p, tmp, & mnt -> mnt_mounts, mnt_child ) { hlist_add_head ( & p -> mnt_umount. s_list, & unmounted ) ; umount_mnt ( p ) ; } } <START_BUG> else umount_tree ( mnt, 0 ) ; <END_BUG> } unlock_mount_hash ( ) ; put_mountpoint ( mp ) ; out_unlock : namespace_unlock ( ) ; }

Fix:
<S2SV_ModStart> ( mnt, UMOUNT_CONNECTED <S2SV_ModEnd> ) ; }
Buggy code:
 static vpx_codec_err_t vp8_init ( vpx_codec_ctx_t * ctx, vpx_codec_priv_enc_mr_cfg_t * data ) { vpx_codec_err_t res = VPX_CODEC_OK ; <START_BUG> ( void ) data ; <END_BUG> vp8_rtcd ( ) ;  if (! ctx -> priv ) <START_BUG> { <END_BUG> vpx_codec_mmap_t mmap ;  mmap. id = vp8_mem_req_segs [ 0 ]. id ; mmap. sz = sizeof ( vpx_codec_alg_priv_t ) ; mmap. align = vp8_mem_req_segs [ 0 ]. align ; mmap. flags = vp8_mem_req_segs [ 0 ]. flags ; res = vpx_mmap_alloc ( & mmap ) ; if ( res!= VPX_CODEC_OK ) return res ; <START_BUG> vp8_init_ctx ( ctx, & mmap ) ; <END_BUG>  ctx -> priv -> alg_priv -> fragments. count = 0 ; <START_BUG> <END_BUG> ctx -> priv -> alg_priv -> fragments. enabled =  <START_BUG> ( ctx -> priv -> alg_priv -> base. init_flags & <END_BUG> VPX_CODEC_USE_INPUT_FRAGMENTS ) ;  ctx -> priv -> alg_priv -> defer_alloc = 1 ; <START_BUG> } ctx -> priv -> alg_priv -> yv12_frame_buffers. use_frame_threads = <END_BUG> ( ctx -> priv -> alg_priv -> base. init_flags &  VPX_CODEC_USE_FRAME_THREADING ) ; <START_BUG> ctx -> priv -> alg_priv -> yv12_frame_buffers. use_frame_threads = 0 ; <END_BUG>  if ( ctx -> priv -> alg_priv -> yv12_frame_buffers. use_frame_threads && <START_BUG> <END_BUG> ( ( ctx -> priv -> alg_priv -> base. init_flags &  <START_BUG> VPX_CODEC_USE_ERROR_CONCEALMENT ) <END_BUG>  || ( ctx -> priv -> alg_priv -> base. init_flags & <START_BUG> VPX_CODEC_USE_INPUT_FRAGMENTS ) ) ) { res = VPX_CODEC_INVALID_PARAM ; } return res ; }<END_BUG>

Fix:
<S2SV_ModStart> = VPX_CODEC_OK ; vpx_codec_alg_priv_t * priv = NULL ; <S2SV_ModStart> ( ) ; vpx_dsp_rtcd ( ) ; vpx_scale_rtcd ( ) ; <S2SV_ModStart> priv ) { <S2SV_ModEnd> vp8_init_ctx ( ctx <S2SV_ModStart> vp8_init_ctx ( ctx ) ; priv = ( vpx_codec_alg_priv_t * ) <S2SV_ModEnd> ctx -> priv <S2SV_ModStart> ctx -> priv ; priv <S2SV_ModEnd> -> fragments. <S2SV_ModStart> = 0 ; priv <S2SV_ModEnd> -> fragments. <S2SV_ModStart> enabled = ( priv <S2SV_ModEnd> -> base. <S2SV_ModStart> VPX_CODEC_USE_INPUT_FRAGMENTS ) ; } else { priv = ( vpx_codec_alg_priv_t * ) <S2SV_ModStart> ctx -> priv ; } priv <S2SV_ModEnd> -> yv12_frame_buffers. <S2SV_ModStart> -> priv -> <S2SV_ModEnd> init_flags & VPX_CODEC_USE_FRAME_THREADING <S2SV_ModStart> VPX_CODEC_USE_FRAME_THREADING ) ; priv <S2SV_ModEnd> -> yv12_frame_buffers. <S2SV_ModStart> ; if ( priv <S2SV_ModEnd> -> yv12_frame_buffers. <S2SV_ModStart> -> priv -> <S2SV_ModEnd> init_flags & VPX_CODEC_USE_
Buggy code:
 <START_BUG> static void filter_selectively_vert_row2 ( PLANE_TYPE plane_type, <END_BUG> uint8_t * s, int pitch, unsigned int mask_16x16_l, unsigned int mask_8x8_l, unsigned int mask_4x4_l, unsigned int mask_4x4_int_l, const loop_filter_info_n * lfi_n, const uint8_t * lfl ) {  const int mask_shift = plane_type? 4 : 8 ; <START_BUG> <END_BUG> const int mask_cutoff = plane_type? 0xf : 0xff ;  <START_BUG> const int lfl_forward = plane_type? 4 : 8 ; <END_BUG> unsigned int mask_16x16_0 = mask_16x16_l & mask_cutoff ; unsigned int mask_8x8_0 = mask_8x8_l & mask_cutoff ; unsigned int mask_4x4_0 = mask_4x4_l & mask_cutoff ; unsigned int mask_4x4_int_0 = mask_4x4_int_l & mask_cutoff ; unsigned int mask_16x16_1 = ( mask_16x16_l >> mask_shift ) & mask_cutoff ; unsigned int mask_8x8_1 = ( mask_8x8_l >> mask_shift ) & mask_cutoff ; unsigned int mask_4x4_1 = ( mask_4x4_l >> mask_shift ) & mask_cutoff ; unsigned int mask_4x4_int_1 = ( mask_4x4_int_l >> mask_shift ) & mask_cutoff ; unsigned int mask ; for ( mask = mask_16x16_0 | mask_8x8_0 | mask_4x4_0 | mask_4x4_int_0 | mask_16x16_1 | mask_8x8_1 | mask_4x4_1 | mask_4x4_int_1 ; mask ; mask >>= 1 ) { const loop_filter_thresh * lfi0 = lfi_n -> lfthr + * lfl ; const loop_filter_thresh * lfi1 = lfi_n -> lfthr + * ( lfl + lfl_forward ) ; if ( mask & 1 ) { if ( (

Fix:
<S2SV_ModStart> void filter_selectively_vert_row2 ( int subsampling_factor <S2SV_ModEnd>, uint8_t * <S2SV_ModStart> int mask_shift = subsampling_factor <S2SV_ModEnd>? 4 : <S2SV_ModStart> int mask_cutoff = subsampling_factor <S2SV_ModEnd>? 0xf : <S2SV_ModStart> int lfl_forward = subsampling_factor <S2SV_ModEnd>? 4 : <S2SV_ModStart> 1 ) { vpx_lpf_vertical_16_dual <S2SV_ModEnd> ( s, <S2SV_ModStart> 1 ) { vpx_lpf_vertical_16 <S2SV_ModEnd> ( s, <S2SV_ModStart> } else { vpx_lpf_vertical_16 <S2SV_ModEnd> ( s + <S2SV_ModStart> 1 ) { vpx_lpf_vertical_8_dual <S2SV_ModEnd> ( s, <S2SV_ModStart> 1 ) { vpx_lpf_vertical_8 <S2SV_ModEnd> ( s, <S2SV_ModStart> } else { vpx_lpf_vertical_8 <S2SV_ModEnd> ( s + <S2SV_ModStart> 1 ) { vpx_lpf_vertical_4_dual <S2SV_ModEnd> ( s, <S2SV_ModStart> 1 ) { vpx_lpf_vertical_4 <S2SV_ModEnd> ( s, <S2SV_ModStart> } else { vpx_lpf_vertical_4 <S2SV_ModEnd> ( s + <S2SV_ModStart> 1 ) { vpx_lpf_vertical_4_dual <S2SV_ModEnd> ( s + <S2SV_ModStart> 1 ) {
Buggy code:
 <START_BUG> void generic_pipe_buf_get ( struct pipe_inode_info * pipe, struct pipe_buffer * buf ) <END_BUG> {  get_page ( buf -> page ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> bool <S2SV_ModEnd> generic_pipe_buf_get ( struct <S2SV_ModStart> buf ) { return try_get_page <S2SV_ModEnd> ( buf ->
Buggy code:
 <START_BUG> static struct btrfs_dir_item * btrfs_match_dir_item_name ( struct btrfs_root * root, <END_BUG> struct btrfs_path * path, const char * name, int name_len ) { struct btrfs_dir_item * dir_item ; unsigned long name_ptr ; u32 total_len ; u32 cur = 0 ; u32 this_len ; struct extent_buffer * leaf ; leaf = path -> nodes [ 0 ] ; dir_item = btrfs_item_ptr ( leaf, path -> slots [ 0 ], struct btrfs_dir_item ) ; if ( verify_dir_item ( root, leaf, dir_item ) ) return NULL ; total_len = btrfs_item_size_nr ( leaf, path -> slots [ 0 ] ) ; while ( cur < total_len ) { this_len = sizeof ( * dir_item ) + btrfs_dir_name_len ( leaf, dir_item ) + btrfs_dir_data_len ( leaf, dir_item ) ; name_ptr = ( unsigned long ) ( dir_item + 1 ) ; if ( btrfs_dir_name_len ( leaf, dir_item ) == name_len && memcmp_extent_buffer ( leaf, name, name_ptr, name_len ) == 0 ) return dir_item ; cur += this_len ; dir_item = ( struct btrfs_dir_item * ) ( ( char * ) dir_item + this_len ) ; } return NULL ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> struct btrfs_dir_item *
Buggy code:
 void enc624j600EventHandler ( NetInterface * interface ) { error_t error ; uint16_t status ; uint16_t value ; <START_BUG> status = enc624j600ReadReg ( interface, ENC624J600_REG_EIR ) ; <END_BUG> if ( ( status & EIR_LINKIF )!= 0 ) {  enc624j600ClearBit ( interface, ENC624J600_REG_EIR, EIR_LINKIF ) ; <START_BUG> <END_BUG> value = enc624j600ReadReg ( interface, ENC624J600_REG_ESTAT ) ;  if ( ( value & ESTAT_PHYLNK )!= 0 ) { <START_BUG> value = enc624j600ReadPhyReg ( interface, ENC624J600_PHY_REG_PHSTAT3 ) ; <END_BUG> if ( ( value & PHSTAT3_SPDDPX1 )!= 0 ) { interface -> linkSpeed = NIC_LINK_SPEED_100MBPS ; } else { interface -> linkSpeed = NIC_LINK_SPEED_10MBPS ; }  if ( ( value & PHSTAT3_SPDDPX2 )!= 0 ) <START_BUG> { interface -> duplexMode = NIC_FULL_DUPLEX_MODE ; } else { interface -> duplexMode = NIC_HALF_DUPLEX_MODE ; } interface -> linkState = TRUE ; enc624j600UpdateMacConfig ( interface ) ; } else { interface -> linkState = FALSE ; } nicNotifyLinkChange ( interface ) ; } <END_BUG> if ( ( status & EIR_PKTIF )!= 0 )  { <START_BUG> enc624j600ClearBit ( interface, ENC624J600_REG_EIR, EIR_PKTIF ) ; <END_BUG> do { error = enc624j600ReceivePacket ( interface ) ; } while ( error!= ERROR_BUFFER_EMPTY ) ; }  enc624j600SetBit ( interface, ENC624J600_REG_EIE, EIE_LINKIE | EIE_PKTIE ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( interface, ENC624J600_EIR ) ; if ( ( status & ENC624J600_EIR_LINKIF <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC624J600_EIR, ENC624J600_EIR_LINKIF <S2SV_ModEnd> ) ; value <S2SV_ModStart> ( interface, ENC624J600_ESTAT ) ; if ( ( value & ENC624J600_ESTAT_PHYLNK <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC624J600_PHSTAT3 ) ; if ( ( value & ENC624J600_PHSTAT3_SPDDPX1 <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( value & ENC624J600_PHSTAT3_SPDDPX2 <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( status & ENC624J600_EIR_PKTIF <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC624J600_EIR, ENC624J600_EIR_PKTIF <S2SV_ModEnd> ) ; do <S2SV_ModStart> ( interface, ENC624J600_EIE, ENC624J600_EIE_LINKIE | ENC624J
Buggy code:
 <START_BUG> void vp9_iht16x16_256_add_c ( const int16_t * input, uint8_t * dest, int stride, <END_BUG> int tx_type ) { int i, j ;  int16_t out [ 16 * 16 ] ; <START_BUG> <END_BUG> int16_t * outptr = out ;  <START_BUG> int16_t temp_in [ 16 ], temp_out [ 16 ] ; <END_BUG> const transform_2d ht = IHT_16 [ tx_type ] ; for ( i = 0 ; i < 16 ; ++ i ) { ht. rows ( input, outptr ) ; input += 16 ; outptr += 16 ; } for ( i = 0 ; i < 16 ; ++ i ) { for ( j = 0 ; j < 16 ; ++ j ) temp_in [ j ] = out [ j * 16 + i ] ; ht. cols ( temp_in, temp_out ) ;  for ( j = 0 ; j < 16 ; ++ j ) <START_BUG> <END_BUG> dest [ j * stride + i ] = clip_pixel ( ROUND_POWER_OF_TWO ( temp_out [ j ], 6 )  <START_BUG> + dest [ j * stride + i ] ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> vp9_iht16x16_256_add_c ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart>, j ; tran_low_t <S2SV_ModEnd> out [ 16 <S2SV_ModStart> 16 ] ; tran_low_t <S2SV_ModEnd> * outptr = <S2SV_ModStart> = out ; tran_low_t <S2SV_ModEnd> temp_in [ 16 <S2SV_ModStart> ++ j ) { <S2SV_ModStart> i ] = clip_pixel_add ( <S2SV_ModEnd> dest [ j <S2SV_ModStart> + i ], ROUND_POWER_OF_TWO ( temp_out [ j ], 6 ) ) ; } <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 bool initiate_stratum ( struct pool * pool ) { bool ret = false, recvd = false, noresume = false, sockd = false ; char s [ RBUFSIZE ], * sret = NULL, * nonce1, * sessionid ; json_t * val = NULL, * res_val, * err_val ; json_error_t err ; int n2size ; resend : if (! setup_stratum_socket ( pool ) ) { applog ( LOG_INFO, "setup_stratum_socket()   on   %s   failed", get_pool_name ( pool ) ) ; sockd = false ; goto out ; } sockd = true ; if ( recvd ) { clear_sock ( pool ) ; sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   []}", swork_id ++ ) ; } else { if ( pool -> sessionid ) sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   [\\"" PACKAGE "//" VERSION "\\",   \\"%s\\"]}", swork_id ++, pool -> sessionid ) ; else sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   [\\"" PACKAGE "//" VERSION "\\"]}", swork_id ++ ) ; } if ( __stratum_send ( pool, s, strlen ( s ) )!= SEND_OK ) { applog ( LOG_DEBUG, "Failed   to   send   s   in   initiate_stratum" ) ; goto out ; } if (! socket_full ( pool, DEFAULT_SOCKWAIT ) ) { applog ( LOG_DEBUG, "Timed   out   waiting   for   response   in   initiate_stratum" ) ; goto out ; } sret = recv_line ( pool ) ; if (! sret ) goto out ; recvd = true ; val = JSON_LOADS ( sret, & err ) ; free ( sret ) ; if (! val ) { applog ( LOG_INFO, "JSON   decode   failed(%d):   %s", err. line

Fix:
<S2SV_ModStart> ; if ( n2size < 1 ) <S2SV_ModEnd> { applog (
Buggy code:
 static int num_stmts ( const node * n ) { int i, l ; node * ch ; switch ( TYPE ( n ) ) { case single_input : if ( TYPE ( CHILD ( n, 0 ) ) == NEWLINE ) return 0 ; else return num_stmts ( CHILD ( n, 0 ) ) ; case file_input : l = 0 ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == stmt ) l += num_stmts ( ch ) ; } return l ; case stmt : return num_stmts ( CHILD ( n, 0 ) ) ; case compound_stmt : return 1 ; case simple_stmt : return NCH ( n ) // 2 ; case suite : <START_BUG> if ( NCH ( n ) == 1 ) <END_BUG> return num_stmts ( CHILD ( n, 0 ) ) ; else {  l = 0 ; <START_BUG> <END_BUG> for ( i = 2 ; i < ( NCH ( n ) - 1 ) ; i ++ )  l += num_stmts ( CHILD ( n, i ) ) ; return l ; } default : { char buf [ 128 ] ; sprintf ( buf, "Non-statement   found:   %d   %d", TYPE ( n ), NCH ( n ) ) ; Py_FatalError ( buf ) ; } } Py_UNREACHABLE ( ) ; }

Fix:
<S2SV_ModStart> case suite : case func_body_suite : <S2SV_ModStart> ; else { i = 2 ; l = 0 ; if ( TYPE ( CHILD ( n, 1 ) ) == TYPE_COMMENT ) i += 2 <S2SV_ModEnd> ; for ( <S2SV_ModStart> ; for ( <S2SV_ModEnd> ; i <
Buggy code:
 static void rdpsnddbg_process ( STREAM s ) { unsigned int pkglen ; static char * rest = NULL ; <START_BUG> char * buf ; <END_BUG> pkglen = s -> end - s -> p ; buf = ( char * ) xmalloc ( pkglen + 1 ) ; STRNCPY ( buf, ( char * ) s -> p, pkglen + 1 ) ; str_handle_lines ( buf, & rest, rdpsnddbg_line_handler, NULL ) ; xfree ( buf ) ; }

Fix:
<S2SV_ModStart> * buf ; if (! s_check ( s ) ) { rdp_protocol_error ( "rdpsnddbg_process(), <S2SV_blank> stream <S2SV_blank> is <S2SV_blank> in <S2SV_blank> unstable <S2SV_blank> state", s ) ; }
Buggy code:
 const char * util_acl_to_str ( const sc_acl_entry_t * e ) { static char line [ 80 ], buf [ 20 ] ; unsigned int acl ; if ( e == NULL ) return "N//A" ; line [ 0 ] = 0 ; while ( e!= NULL ) { acl = e -> method ; switch ( acl ) { case SC_AC_UNKNOWN : return "N//A" ; case SC_AC_NEVER : return "NEVR" ; case SC_AC_NONE : return "NONE" ; case SC_AC_CHV : strcpy ( buf, "CHV" ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "%d", e -> key_ref ) ; break ; case SC_AC_TERM : strcpy ( buf, "TERM" ) ; break ; case SC_AC_PRO : strcpy ( buf, "PROT" ) ; break ; case SC_AC_AUT : strcpy ( buf, "AUTH" ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 4, "%d", e -> key_ref ) ; break ; case SC_AC_SEN : strcpy ( buf, "Sec.Env.   " ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "#%d", e -> key_ref ) ; break ; case SC_AC_SCB : strcpy ( buf, "Sec.ControlByte   " ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "Ox%X", e -> key_ref ) ; break ; case SC_AC_IDA : strcpy ( buf, "PKCS#15   AuthID   " ) ; if ( e -> key_ref!= SC_AC_KEY_REF_NONE ) sprintf ( buf + 3, "#%d", e -> key_ref ) ; break ; default : strcpy ( buf, "????" ) ; break ; } <START_BUG> strcat ( line, buf ) ; <END_BUG>  strcat ( line, "   " ) ; <START_BUG> e = e -> next ; } <END_BUG> line

Fix:
<S2SV_ModStart> break ; } strncat ( line, buf, sizeof line ) ; strncat <S2SV_ModEnd> ( line, <S2SV_ModStart> line, " <S2SV_blank> ", sizeof line <S2SV_ModStart> } line [ ( sizeof <S2SV_ModEnd> line ) - <S2SV_ModStart> 1 ] = '\\0' ; line [ strlen ( line ) - 1 ] =