nus-yam/ex-repair huggingface dataset:
Buggy code:
 int obj2ast_alias ( PyObject * obj, alias_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; identifier name ; identifier asname ; <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_name ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_name ) ; <START_BUG> if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_identifier ( tmp, & name, arena ) ;  if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <START_BUG> } else { <END_BUG> PyErr_SetString ( PyExc_TypeError, "required   field   \\"name\\"   missing   from   alias" ) ; return 1 ; } if ( exists_not_none ( obj, & PyId_asname ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_asname ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_identifier ( tmp, & asname, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { asname = NULL ; } * out = alias ( name, asname, arena ) ; return 0 ; failed : Py_XDECREF ( tmp ) ; return 1 ; }

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_name, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"name\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> alias" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; res = obj2ast_identifier ( tmp, & name, arena ) ; if ( res!= 0 <S2SV_ModEnd> ) goto failed <S2SV_ModStart> goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id ( obj, & PyId_asname, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; asname = NULL ; } else { int res ; <S2SV_ModStart> tmp, & asname <S2SV_ModEnd>, arena ) <S2SV_ModStart> ) ; } <S2SV_ModEnd> * out =
Buggy code:
 error_t udpReceiveDatagram ( Socket * socket, SocketMsg * message, uint_t flags ) { error_t error ; SocketQueueItem * queueItem ; if ( ( flags & SOCKET_FLAG_DONT_WAIT ) == 0 ) { if ( socket -> receiveQueue == NULL ) { socket -> eventMask = SOCKET_EVENT_RX_READY ; osResetEvent ( & socket -> event ) ; osReleaseMutex ( & netMutex ) ; osWaitForEvent ( & socket -> event, socket -> timeout ) ; osAcquireMutex ( & netMutex ) ; } } if ( socket -> receiveQueue!= NULL ) { queueItem = socket -> receiveQueue ; message -> length = netBufferRead ( message -> data, queueItem -> buffer, queueItem -> offset, message -> size ) ; <START_BUG> message -> srcIpAddr = queueItem -> srcIpAddr ; <END_BUG> message -> srcPort = queueItem -> srcPort ; message -> destIpAddr = queueItem -> destIpAddr ; message -> ttl = queueItem -> ancillary. ttl ; # if ( ETH_SUPPORT == ENABLED ) message -> srcMacAddr = queueItem -> ancillary. srcMacAddr ; message -> destMacAddr = queueItem -> ancillary. destMacAddr ; # endif # if ( ETH_PORT_TAGGING_SUPPORT == ENABLED ) message -> switchPort = queueItem -> ancillary. port ; # endif # if ( ETH_TIMESTAMP_SUPPORT == ENABLED ) message -> timestamp = queueItem -> ancillary. timestamp ; # endif if ( ( flags & SOCKET_FLAG_PEEK ) == 0 ) { socket -> receiveQueue = queueItem -> next ; netBufferFree ( queueItem -> buffer ) ; } udpUpdateEvents ( socket ) ; error = NO_ERROR ; } else { message -> length = 0 ; error = ERROR_TIMEOUT ; } return error ; }

Fix:
<S2SV_ModStart> ; message -> interface = queueItem -> interface ; message ->
Buggy code:
 static int my_login ( pTHX_ SV * dbh, imp_dbh_t * imp_dbh ) { SV * sv ; HV * hv ; char * dbname ; char * host ; char * port ; char * user ; char * password ; char * mysql_socket ; <START_BUG> int result ; <END_BUG> D_imp_xxh ( dbh ) ; # define TAKE_IMP_DATA_VERSION 1 # if TAKE_IMP_DATA_VERSION if ( DBIc_has ( imp_dbh, DBIcf_IMPSET ) ) { if ( DBIc_has ( imp_dbh, DBIcf_ACTIVE ) ) { if ( DBIc_TRACE_LEVEL ( imp_xxh ) >= 2 ) PerlIO_printf ( DBIc_LOGPIO ( imp_xxh ), "my_login   skip   connect\\n" ) ; ++ DBIc_ACTIVE_KIDS ( DBIc_PARENT_COM ( imp_dbh ) ) ; return TRUE ; } if ( DBIc_TRACE_LEVEL ( imp_xxh ) >= 2 ) PerlIO_printf ( DBIc_LOGPIO ( imp_xxh ), "my_login   IMPSET   but   not   ACTIVE   so   connect   not   skipped\\n" ) ; } # endif sv = DBIc_IMP_DATA ( imp_dbh ) ; if (! sv ||! SvROK ( sv ) ) return FALSE ; hv = ( HV * ) SvRV ( sv ) ; if ( SvTYPE ( hv )!= SVt_PVHV ) return FALSE ; host = safe_hv_fetch ( aTHX_ hv, "host", 4 ) ; port = safe_hv_fetch ( aTHX_ hv, "port", 4 ) ; user = safe_hv_fetch ( aTHX_ hv, "user", 4 ) ; password = safe_hv_fetch ( aTHX_ hv, "password", 8 ) ; dbname = safe_hv_fetch ( aTHX_ hv, "database", 8 ) ; mysql_socket = safe_hv_fetch ( aTHX_ hv, "mysql_socket", 12 ) ; if ( DB

Fix:
<S2SV_ModStart> ; int result ; int fresh = 0 <S2SV_ModStart> pmysql ) { fresh = 1 ; <S2SV_ModStart> ; if ( fresh && <S2SV_ModStart>! result ) { do_error ( dbh, mysql_errno ( imp_dbh -> pmysql ), mysql_error ( imp_dbh -> pmysql ), mysql_sqlstate ( imp_dbh -> pmysql ) ) ; <S2SV_ModStart> pmysql ) ; imp_dbh -> pmysql = NULL ; }
Buggy code:
 int vp8_regulate_q ( VP8_COMP * cpi, int target_bits_per_frame ) { <START_BUG> int Q = cpi -> active_worst_quality ; <END_BUG> cpi -> mb. zbin_over_quant = 0 ; if ( cpi -> oxcf. fixed_q >= 0 ) { Q = cpi -> oxcf. fixed_q ; if ( cpi -> common. frame_type == KEY_FRAME ) { Q = cpi -> oxcf. key_q ; } else if ( cpi -> oxcf. number_of_layers == 1 && cpi -> common. refresh_alt_ref_frame ) { Q = cpi -> oxcf. alt_q ; } else if ( cpi -> oxcf. number_of_layers == 1 && cpi -> common. refresh_golden_frame ) { Q = cpi -> oxcf. gold_q ; } } else { int i ; int last_error = INT_MAX ; int target_bits_per_mb ; int bits_per_mb_at_this_q ; double correction_factor ; if ( cpi -> common. frame_type == KEY_FRAME ) correction_factor = cpi -> key_frame_rate_correction_factor ; else { if ( cpi -> oxcf. number_of_layers == 1 && ( cpi -> common. refresh_alt_ref_frame || cpi -> common. refresh_golden_frame ) ) correction_factor = cpi -> gf_rate_correction_factor ; else correction_factor = cpi -> rate_correction_factor ; } if ( target_bits_per_frame >= ( INT_MAX >> BPER_MB_NORMBITS ) ) target_bits_per_mb = ( target_bits_per_frame // cpi -> common. MBs ) << BPER_MB_NORMBITS ; else target_bits_per_mb = ( target_bits_per_frame << BPER_MB_NORMBITS ) // cpi -> common. MBs ; i = cpi -> active_best_quality ; do { bits_per_mb_at_this_q = ( int ) (.5 + correction_factor * vp8_bits_per_mb [ cpi -> common.

Fix:
<S2SV_ModStart> -> active_worst_quality ; if ( cpi -> force_maxqp == 1 ) { cpi -> active_worst_quality = cpi -> worst_quality ; return cpi -> worst_quality ; }
Buggy code:
 error_t rawSocketReceiveEthPacket ( Socket * socket, SocketMsg * message, uint_t flags ) { error_t error ; SocketQueueItem * queueItem ; if ( ( flags & SOCKET_FLAG_DONT_WAIT ) == 0 ) { if ( socket -> receiveQueue == NULL ) { socket -> eventMask = SOCKET_EVENT_RX_READY ; osResetEvent ( & socket -> event ) ; osReleaseMutex ( & netMutex ) ; osWaitForEvent ( & socket -> event, socket -> timeout ) ; osAcquireMutex ( & netMutex ) ; } } if ( socket -> receiveQueue!= NULL ) { queueItem = socket -> receiveQueue ; message -> length = netBufferRead ( message -> data, queueItem -> buffer, queueItem -> offset, message -> size ) ; <START_BUG> # if ( ETH_SUPPORT == ENABLED ) <END_BUG> message -> srcMacAddr = queueItem -> ancillary. srcMacAddr ; message -> destMacAddr = queueItem -> ancillary. destMacAddr ; # endif # if ( ETH_PORT_TAGGING_SUPPORT == ENABLED ) message -> switchPort = queueItem -> ancillary. port ; # endif # if ( ETH_TIMESTAMP_SUPPORT == ENABLED ) message -> timestamp = queueItem -> ancillary. timestamp ; # endif if ( ( flags & SOCKET_FLAG_PEEK ) == 0 ) { socket -> receiveQueue = queueItem -> next ; netBufferFree ( queueItem -> buffer ) ; } rawSocketUpdateEvents ( socket ) ; error = NO_ERROR ; } else { message -> length = 0 ; error = ERROR_TIMEOUT ; } return error ; }

Fix:
<S2SV_ModStart> size ) ; message -> interface = queueItem -> interface ;
Buggy code:
 int insn_get_code_seg_params ( struct pt_regs * regs ) { <START_BUG> struct desc_struct * desc ; <END_BUG> short sel ; if ( v8086_mode ( regs ) ) return INSN_CODE_SEG_PARAMS ( 2, 2 ) ; sel = get_segment_selector ( regs, INAT_SEG_REG_CS ) ; if ( sel < 0 ) return sel ;  desc = get_desc ( sel ) ; <START_BUG> <END_BUG> if (! desc )  return - EINVAL ; <START_BUG> if (! ( desc -> type & BIT ( 3 ) ) ) <END_BUG> return - EINVAL ;  switch ( ( desc -> l << 1 ) | desc -> d ) { <START_BUG> case 0 : return INSN_CODE_SEG_PARAMS ( 2, 2 ) ; case 1 : return INSN_CODE_SEG_PARAMS ( 4, 4 ) ; case 2 : return INSN_CODE_SEG_PARAMS ( 4, 8 ) ; case 3 : default : return - EINVAL ; } }<END_BUG>

Fix:
<S2SV_ModStart> { struct desc_struct <S2SV_ModEnd> desc ; short <S2SV_ModStart> return sel ; <S2SV_ModEnd> if (! <S2SV_ModStart> if (! get_desc ( & desc, sel ) <S2SV_ModEnd> ) return - <S2SV_ModStart>! ( desc. <S2SV_ModEnd> type & BIT <S2SV_ModStart> ( ( desc. <S2SV_ModEnd> l << 1 <S2SV_ModStart> ) | desc. <S2SV_ModEnd> d ) {
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; ps_dec -> process_called = 1 ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code

Fix:
<S2SV_ModStart> -> u4_first_slice_in_pic = 1 <S2SV_ModEnd> ; ps_dec ->
Buggy code:
 static int <START_BUG> mptctl_replace_fw ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_replace_fw __user * uarg = ( void __user * ) arg ; struct mpt_ioctl_replace_fw karg ;  MPT_ADAPTER * ioc ; <START_BUG> int iocnum ; int newFwSize ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_replace_fw ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_replace_fw   -   " "Unable   to   read   in   mpt_ioctl_replace_fw   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; <END_BUG> return - EFAULT ;  } if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_replace_fw()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_replace_fw   called.\\n", ioc -> name ) ) ; if ( ioc -> cached_fw == NULL ) return 0 ; mpt_free_fw_memory ( ioc ) ; newFwSize = ALIGN ( karg. newImageSize, 4 ) ; mpt_alloc_fw_memory ( ioc, newFwSize ) ; if ( ioc -> cached_fw == NULL ) return - ENOMEM ; if ( copy_from_user ( ioc -> cached_fw, uarg -> newImage, newFwSize ) ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_replace_fw   -   " "Unable   to   read   in   mpt_ioctl_replace_fw   image   " "@   %p\\n", ioc -> name, __FILE__, __LINE__, uarg ) ; mpt_free_fw_memory

Fix:
<S2SV_ModStart> int mptctl_replace_fw ( MPT_ADAPTER * ioc, <S2SV_ModStart> mpt_ioctl_replace_fw karg ; <S2SV_ModEnd> int newFwSize ; <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; } dctlprintk
Buggy code:
 static inline int l2cap_config_req ( struct l2cap_conn * conn, struct l2cap_cmd_hdr * cmd, u16 cmd_len, u8 * data ) { struct l2cap_conf_req * req = ( struct l2cap_conf_req * ) data ; u16 dcid, flags ; u8 rsp [ 64 ] ; struct sock * sk ; int len ; dcid = __le16_to_cpu ( req -> dcid ) ; flags = __le16_to_cpu ( req -> flags ) ; BT_DBG ( "dcid   0x%4.4x   flags   0x%2.2x", dcid, flags ) ; sk = l2cap_get_chan_by_scid ( & conn -> chan_list, dcid ) ; if (! sk ) return - ENOENT ; if ( sk -> sk_state == BT_DISCONN ) goto unlock ; len = cmd_len - sizeof ( * req ) ; if ( l2cap_pi ( sk ) -> conf_len + len > sizeof ( l2cap_pi ( sk ) -> conf_req ) ) { l2cap_send_cmd ( conn, cmd -> ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp ( sk, rsp, L2CAP_CONF_REJECT, flags ), rsp ) ; goto unlock ; } memcpy ( l2cap_pi ( sk ) -> conf_req + l2cap_pi ( sk ) -> conf_len, req -> data, len ) ; l2cap_pi ( sk ) -> conf_len += len ; if ( flags & 0x0001 ) { l2cap_send_cmd ( conn, cmd -> ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp ( sk, rsp, L2CAP_CONF_SUCCESS, 0x0001 ), rsp ) ; goto unlock ; } len = l2cap_parse_conf_req ( sk, rsp ) ; <START_BUG> if ( len < 0 ) <END_BUG> goto unlock ;  l2cap_send_cmd ( conn, cmd -> ident, L2CAP_CONF_RSP, len, rsp ) ; <START_BUG> l2cap_pi ( sk ) -> conf_len = 0 ; if<END_BUG>

Fix:
<S2SV_ModStart> < 0 ) { struct l2cap_disconn_req req ; req. dcid = cpu_to_le16 ( l2cap_pi ( sk ) -> dcid ) ; req. scid = cpu_to_le16 ( l2cap_pi ( sk ) -> scid ) ; l2cap_send_cmd ( conn, l2cap_get_ident ( conn ), L2CAP_DISCONN_REQ, sizeof ( req ), & req ) ; <S2SV_ModStart> goto unlock ; } <S2SV_ModStart>, rsp ) ; l2cap_pi ( sk ) -> num_conf_rsp ++ <S2SV_ModStart> buf ) ; l2cap_pi ( sk ) -> num_conf_req ++ ;
Buggy code:
 static int cac_get_serial_nr_from_CUID ( sc_card_t * card, sc_serial_number_t * serial ) { cac_private_data_t * priv = CAC_DATA ( card ) ; SC_FUNC_CALLED ( card -> ctx, SC_LOG_DEBUG_NORMAL ) ; if ( card -> serialnr. len ) { * serial = card -> serialnr ; SC_FUNC_RETURN ( card -> ctx, SC_LOG_DEBUG_NORMAL, SC_SUCCESS ) ; } if ( priv -> cac_id_len ) { serial -> len = MIN ( priv -> cac_id_len, SC_MAX_SERIALNR ) ; <START_BUG> memcpy ( serial -> value, priv -> cac_id, priv -> cac_id_len ) ; <END_BUG> SC_FUNC_RETURN ( card -> ctx, SC_LOG_DEBUG_NORMAL, SC_SUCCESS ) ; } SC_FUNC_RETURN ( card -> ctx, SC_LOG_DEBUG_NORMAL, SC_ERROR_FILE_NOT_FOUND ) ; }

Fix:
<S2SV_ModStart> -> cac_id, serial -> len <S2SV_ModEnd> ) ; SC_FUNC_RETURN
Buggy code:
 tmsize_t TIFFReadEncodedStrip ( TIFF * tif, uint32 strip, void * buf, tmsize_t size ) { static const char module [ ] = "TIFFReadEncodedStrip" ; TIFFDirectory * td = & tif -> tif_dir ; uint32 rowsperstrip ; uint32 stripsperplane ; uint32 stripinplane ; uint16 plane ; uint32 rows ; tmsize_t stripsize ; if (! TIFFCheckRead ( tif, 0 ) ) return ( ( tmsize_t ) ( - 1 ) ) ; if ( strip >= td -> td_nstrips ) { TIFFErrorExt ( tif -> tif_clientdata, module, "%lu:   Strip   out   of   range,   max   %lu", ( unsigned long ) strip, ( unsigned long ) td -> td_nstrips ) ; return ( ( tmsize_t ) ( - 1 ) ) ; } rowsperstrip = td -> td_rowsperstrip ; if ( rowsperstrip > td -> td_imagelength ) rowsperstrip = td -> td_imagelength ; <START_BUG> stripsperplane = ( ( td -> td_imagelength + rowsperstrip - 1 ) // rowsperstrip ) ; <END_BUG> stripinplane = ( strip % stripsperplane ) ; plane = ( uint16 ) ( strip // stripsperplane ) ; rows = td -> td_imagelength - stripinplane * rowsperstrip ; if ( rows > rowsperstrip ) rows = rowsperstrip ; stripsize = TIFFVStripSize ( tif, rows ) ; if ( stripsize == 0 ) return ( ( tmsize_t ) ( - 1 ) ) ; if ( td -> td_compression == COMPRESSION_NONE && size!= ( tmsize_t ) ( - 1 ) && size >= stripsize &&! isMapped ( tif ) && ( ( tif -> tif_flags & TIFF_NOREADRAW ) == 0 ) ) { if ( TIFFReadRawStrip1 ( tif, strip, buf, stripsize, module )!= stripsize ) return ( ( tmsize_t ) ( - 1 ) ) ; if (! isFillOrder ( tif, td -> td_fillorder ) && ( tif -> tif_flags &

Fix:
<S2SV_ModStart> ; stripsperplane = TIFFhowmany_32_maxuint_compat <S2SV_ModEnd> ( td -> <S2SV_ModStart> td -> td_imagelength, <S2SV_ModEnd> rowsperstrip ) ;
Buggy code:
 struct bpf_prog * bpf_prog_get ( u32 ufd ) { struct fd f = fdget ( ufd ) ; struct bpf_prog * prog ; prog = __bpf_prog_get ( f ) ; if ( IS_ERR ( prog ) ) return prog ; <START_BUG> atomic_inc ( & prog -> aux -> refcnt ) ; <END_BUG> fdput ( f ) ; return prog ; }

Fix:
<S2SV_ModStart> return prog ; prog = bpf_prog_inc ( prog <S2SV_ModEnd> ) ; fdput
Buggy code:
 static inline signed short ReadPropertyMSBShort ( const unsigned char * * p, size_t * length ) { union { unsigned short unsigned_value ; signed short signed_value ; } quantum ; int c ; register ssize_t i ; unsigned char buffer [ 2 ] ; unsigned short value ; if ( * length < 2 ) return ( ( unsigned short ) ~ 0 ) ; for ( i = 0 ; i < 2 ; i ++ ) { c = ( int ) ( * ( * p ) ++ ) ; ( * length ) -- ; buffer [ i ] = ( unsigned char ) c ; } <START_BUG> value = ( unsigned short ) ( buffer [ 0 ] << 8 ) ; <END_BUG>  value |= buffer [ 1 ] ; <START_BUG> <END_BUG> quantum. unsigned_value = ( value & 0xffff ) ;  return ( quantum. signed_value ) ; }

Fix:
<S2SV_ModStart> unsigned short ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> ] << 8 <S2SV_ModEnd> ; value |= <S2SV_ModStart> ; value |= ( unsigned short ) <S2SV_ModStart>. unsigned_value = <S2SV_ModEnd> value & 0xffff <S2SV_ModStart> value & 0xffff <S2SV_ModEnd> ; return (
Buggy code:
 int blk_init_allocated_queue ( struct request_queue * q ) { WARN_ON_ONCE ( q -> mq_ops ) ; q -> fq = blk_alloc_flush_queue ( q, NUMA_NO_NODE, q -> cmd_size ) ; if (! q -> fq ) return - ENOMEM ; if ( q -> init_rq_fn && q -> init_rq_fn ( q, q -> fq -> flush_rq, GFP_KERNEL ) ) goto out_free_flush_queue ; if ( blk_init_rl ( & q -> root_rl, q, GFP_KERNEL ) ) goto out_exit_flush_rq ; INIT_WORK ( & q -> timeout_work, blk_timeout_work ) ; q -> queue_flags |= QUEUE_FLAG_DEFAULT ; blk_queue_make_request ( q, blk_queue_bio ) ; q -> sg_reserved_size = INT_MAX ; if ( elevator_init ( q ) ) goto out_exit_flush_rq ; return 0 ; out_exit_flush_rq : if ( q -> exit_rq_fn ) q -> exit_rq_fn ( q, q -> fq -> flush_rq ) ; out_free_flush_queue : blk_free_flush_queue ( q -> fq ) ; <START_BUG> return - ENOMEM ; <END_BUG> }

Fix:
<S2SV_ModStart> fq ) ; q -> fq = NULL ;
Buggy code:
 generic_ret * delete_principal_2_svc ( dprinc_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_DELETE, arg -> princ, NULL ) ) { ret. code = KADM5_AUTH_DELETE ; log_unauth ( "kadm5_delete_principal", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_delete_principal ( ( void * ) handle, arg -> princ ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_delete_principal", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; } free ( prime_arg ) ;  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_release_buffer ( & minor_stat,<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static struct mm_struct * mm_init ( struct mm_struct * mm, struct task_struct * p, struct user_namespace * user_ns ) { mm -> mmap = NULL ; mm -> mm_rb = RB_ROOT ; mm -> vmacache_seqnum = 0 ; atomic_set ( & mm -> mm_users, 1 ) ; atomic_set ( & mm -> mm_count, 1 ) ; init_rwsem ( & mm -> mmap_sem ) ; INIT_LIST_HEAD ( & mm -> mmlist ) ; mm -> core_state = NULL ; atomic_long_set ( & mm -> nr_ptes, 0 ) ; mm_nr_pmds_init ( mm ) ; mm -> map_count = 0 ; mm -> locked_vm = 0 ; mm -> pinned_vm = 0 ; memset ( & mm -> rss_stat, 0, sizeof ( mm -> rss_stat ) ) ; spin_lock_init ( & mm -> page_table_lock ) ; mm_init_cpumask ( mm ) ; mm_init_aio ( mm ) ; mm_init_owner ( mm, p ) ; <START_BUG> mmu_notifier_mm_init ( mm ) ; <END_BUG> init_tlb_flush_pending ( mm ) ; # if defined ( CONFIG_TRANSPARENT_HUGEPAGE ) &&! USE_SPLIT_PMD_PTLOCKS mm -> pmd_huge_pte = NULL ; # endif if ( current -> mm ) { mm -> flags = current -> mm -> flags & MMF_INIT_MASK ; mm -> def_flags = current -> mm -> def_flags & VM_INIT_DEF_MASK ; } else { mm -> flags = default_dump_filter ; mm -> def_flags = 0 ; } if ( mm_alloc_pgd ( mm ) ) goto fail_nopgd ; if ( init_new_context ( p, mm ) ) goto fail_nocontext ; mm -> user_ns = get_user_ns ( user_ns ) ; return mm ; fail_nocontext : mm_free_pgd ( mm ) ; fail_nopgd : free_mm ( mm ) ; return NULL ; }

Fix:
<S2SV_ModStart> p ) ; RCU_INIT_POINTER ( mm -> exe_file, NULL ) ;
Buggy code:
 static ssize_t in_read ( struct audio_stream_in * stream, void * buffer, size_t bytes ) { struct a2dp_stream_in * in = ( struct a2dp_stream_in * ) stream ; int read ; DEBUG ( "read   %zu   bytes,   state:   %d", bytes, in -> common. state ) ; if ( in -> common. state == AUDIO_A2DP_STATE_SUSPENDED ) { DEBUG ( "stream   suspended" ) ; return - 1 ; } if ( ( in -> common. state == AUDIO_A2DP_STATE_STOPPED ) || ( in -> common. state == AUDIO_A2DP_STATE_STANDBY ) ) { pthread_mutex_lock ( & in -> common. lock ) ; if ( start_audio_datapath ( & in -> common ) < 0 ) { int us_delay = calc_audiotime ( in -> common. cfg, bytes ) ; DEBUG ( "emulate   a2dp   read   delay   (%d   us)", us_delay ) ; <START_BUG> usleep ( us_delay ) ; <END_BUG> pthread_mutex_unlock ( & in -> common. lock ) ; return - 1 ; } pthread_mutex_unlock ( & in -> common. lock ) ; } else if ( in -> common. state!= AUDIO_A2DP_STATE_STARTED ) { ERROR ( "stream   not   in   stopped   or   standby" ) ; return - 1 ; } read = skt_read ( in -> common. audio_fd, buffer, bytes ) ; if ( read == - 1 ) { skt_disconnect ( in -> common. audio_fd ) ; in -> common. audio_fd = AUDIO_SKT_DISCONNECTED ; in -> common. state = AUDIO_A2DP_STATE_STOPPED ; } else if ( read == 0 ) { DEBUG ( "read   time   out   -   return   zeros" ) ; memset ( buffer, 0, bytes ) ; read = bytes ; } DEBUG ( "read   %d   bytes   out   of   %zu   bytes", read, bytes ) ; return read ; }

Fix:
<S2SV_ModStart> us_delay ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( us_delay )
Buggy code:
 int cib_remote_perform_op ( cib_t * cib, const char * op, const char * host, const char * section, xmlNode * data, xmlNode * * output_data, int call_options, const char * name ) { int rc = pcmk_ok ; <START_BUG> xmlNode * op_msg = NULL ; <END_BUG> xmlNode * op_reply = NULL ; cib_remote_opaque_t * private = cib -> variant_opaque ;  if ( sync_timer == NULL ) { <START_BUG> sync_timer = calloc ( 1, sizeof ( struct timer_rec_s ) ) ; } if ( cib -> state == cib_disconnected ) { return - ENOTCONN ; } if ( output_data!= NULL ) { * output_data = NULL ; } if ( op == NULL ) { crm_err ( "No   operation   specified" ) ; return - EINVAL ; } cib -> call_id ++ ; if ( cib -> call_id < 1 ) { cib -> call_id = 1 ; } op_msg = cib_create_op ( cib -> call_id, private -> callback. token, op, host, section, data, call_options, NULL ) ; if ( op_msg == NULL ) { return - EPROTO ; } crm_trace ( "Sending   %s   message   to   CIB   service", op ) ; <END_BUG> crm_send_remote_msg ( private -> command. session, op_msg, private -> command. encrypted ) ;  free_xml ( op_msg ) ; if ( ( call_options & cib_discard_reply ) ) { crm_trace ( "Discarding   reply" ) ; return pcmk_ok ; } else if (! ( call_options & cib_sync_call ) ) { return cib -> call_id ; } crm_trace ( "Waiting   for   a   syncronous   reply" ) ; <START_BUG> if ( cib -> call_timeout > 0 ) { <END_BUG> timer_expired = FALSE ; sync_timer -> call_id = cib -> call_id ; sync_timer -> timeout = cib -> call_timeout * 1000 ; sync_timer -> ref = g_timeout_add ( sync_timer -> timeout, cib_timeout_handler

Fix:
<S2SV_ModStart> = pcmk_ok ; int disconnected = 0 ; int remaining_time = 0 ; time_t start_time ; <S2SV_ModStart> -> variant_opaque ; <S2SV_ModEnd> if ( cib <S2SV_ModStart> op ) ; if (! ( call_options & cib_sync_call ) ) { <S2SV_ModStart> ( private -> callback. session, op_msg, private -> command. encrypted ) ; } else { crm_send_remote_msg ( private -> command. <S2SV_ModEnd> session, op_msg <S2SV_ModStart> encrypted ) ; } <S2SV_ModStart> "Waiting <S2SV_blank> for <S2SV_blank> a <S2SV_blank> syncronous <S2SV_blank> reply" ) ; start_time = time ( NULL ) ; remaining_time = <S2SV_ModEnd> cib -> call_timeout <S2SV_ModStart> cib -> call_timeout? cib -> call_timeout : 60 ; while ( remaining_time > 0 &&! disconnected <S2SV_ModEnd> ) { int <S2SV_ModStart> -> call_id ; <S2SV_ModEnd> crm_recv_remote_msg ( private <S2SV_ModStart>. session, & <S2SV_ModStart> -> command. recv_buf, private -> command. encrypted, remaining_time * 1000, & disconnected ) ; op_reply = crm_parse_remote_buffer ( & private -> command. recv_buf ) ; if (! op_reply <S2SV_ModEnd> ) { break <S2SV_ModStart>, &
Buggy code:
 static void down2_symodd ( const uint8_t * const input, int length, uint8_t * output ) { <START_BUG> static const int16_t * filter = vp9_down2_symodd_half_filter ; <END_BUG> const int filter_len_half = sizeof ( vp9_down2_symodd_half_filter ) // 2 ; int i, j ; uint8_t * optr = output ; int l1 = filter_len_half - 1 ; int l2 = ( length - filter_len_half + 1 ) ; l1 += ( l1 & 1 ) ; l2 += ( l2 & 1 ) ; if ( l1 > l2 ) { for ( i = 0 ; i < length ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) + input [ i ] * filter [ 0 ] ; for ( j = 1 ; j < filter_len_half ; ++ j ) { sum += ( input [ ( i - j < 0? 0 : i - j ) ] + input [ ( i + j >= length? length - 1 : i + j ) ] ) * filter [ j ] ; } sum >>= FILTER_BITS ; * optr ++ = clip_pixel ( sum ) ; } } else { for ( i = 0 ; i < l1 ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) + input [ i ] * filter [ 0 ] ; for ( j = 1 ; j < filter_len_half ; ++ j ) { sum += ( input [ ( i - j < 0? 0 : i - j ) ] + input [ i + j ] ) * filter [ j ] ; } sum >>= FILTER_BITS ; * optr ++ = clip_pixel ( sum ) ; } for ( ; i < l2 ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) + input [ i ] * filter [ 0 ] ; for ( j = 1 ; j < filter_len_half ; ++ j ) { sum += ( input [ i - j ] + input [ i + j ] ) * filter [ j ] ; } sum >>= FILTER_BITS ; * optr ++ = clip_pixel ( sum ) ; } for ( ; i < length ; i += 2 ) { int sum = (

Fix:
<S2SV_ModStart> output ) { <S2SV_ModEnd> const int16_t *
Buggy code:
 static int add_ast_fields ( void ) { PyObject * empty_tuple, * d ; if ( PyType_Ready ( & AST_type ) < 0 ) return - 1 ; d = AST_type. tp_dict ; empty_tuple = PyTuple_New ( 0 ) ; if (! empty_tuple || <START_BUG> PyDict_SetItemString ( d, "_fields", empty_tuple ) < 0 || <END_BUG>  PyDict_SetItemString ( d, "_attributes", empty_tuple ) < 0 ) { <START_BUG> Py_XDECREF ( empty_tuple ) ; return - 1 ; } Py_DECREF ( empty_tuple ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart>! empty_tuple || _PyDict_SetItemId <S2SV_ModEnd> ( d, <S2SV_ModStart> ( d, & PyId__fields <S2SV_ModEnd>, empty_tuple ) <S2SV_ModStart> < 0 || _PyDict_SetItemId <S2SV_ModEnd> ( d, <S2SV_ModStart> ( d, & PyId__attributes <S2SV_ModEnd>, empty_tuple )
Buggy code:
 long join_session_keyring ( const char * name ) { const struct cred * old ; struct cred * new ; struct key * keyring ; long ret, serial ; new = prepare_creds ( ) ; if (! new ) return - ENOMEM ; old = current_cred ( ) ; if (! name ) { ret = install_session_keyring_to_cred ( new, NULL ) ; if ( ret < 0 ) goto error ; serial = new -> session_keyring -> serial ; ret = commit_creds ( new ) ; if ( ret == 0 ) ret = serial ; goto okay ; } mutex_lock ( & key_session_mutex ) ; keyring = find_keyring_by_name ( name, false ) ; if ( PTR_ERR ( keyring ) == - ENOKEY ) { keyring = keyring_alloc ( name, old -> uid, old -> gid, old, KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK, KEY_ALLOC_IN_QUOTA, NULL ) ; if ( IS_ERR ( keyring ) ) { ret = PTR_ERR ( keyring ) ; goto error2 ; } } else if ( IS_ERR ( keyring ) ) { ret = PTR_ERR ( keyring ) ; goto error2 ; } else if ( keyring == new -> session_keyring ) { <START_BUG> ret = 0 ; <END_BUG> goto error2 ; } ret = install_session_keyring_to_cred ( new, keyring ) ; if ( ret < 0 ) goto error2 ; commit_creds ( new ) ; mutex_unlock ( & key_session_mutex ) ; ret = keyring -> serial ; key_put ( keyring ) ; okay : return ret ; error2 : mutex_unlock ( & key_session_mutex ) ; error : abort_creds ( new ) ; return ret ; }

Fix:
<S2SV_ModStart> session_keyring ) { key_put ( keyring ) ;
Buggy code:
 static uint16_t http_splitline ( struct worker * w, int fd, struct http * hp, const struct http_conn * htc, int h1, int h2, int h3 ) { char * p, * q ; CHECK_OBJ_NOTNULL ( htc, HTTP_CONN_MAGIC ) ; CHECK_OBJ_NOTNULL ( hp, HTTP_MAGIC ) ; Tcheck ( htc -> rxbuf ) ; for ( p = htc -> rxbuf. b ; vct_islws ( * p ) ; p ++ ) continue ; q = p ; for ( ;! vct_issp ( * p ) ; p ++ ) { if ( vct_isctl ( * p ) ) return ( 400 ) ; } hp -> hd [ h1 ]. b = q ; hp -> hd [ h1 ]. e = p ; for ( ; vct_issp ( * p ) ; p ++ ) { if ( vct_isctl ( * p ) ) return ( 400 ) ; } q = p ; for ( ;! vct_islws ( * p ) ; p ++ ) { if ( vct_isctl ( * p ) ) return ( 400 ) ; } hp -> hd [ h2 ]. b = q ; hp -> hd [ h2 ]. e = p ; if (! Tlen ( hp -> hd [ h2 ] ) ) return ( 400 ) ; for ( ; vct_issp ( * p ) ; p ++ ) { if ( vct_isctl ( * p ) ) return ( 400 ) ; } q = p ; <START_BUG> if (! vct_iscrlf ( * p ) ) { <END_BUG>  for ( ;! vct_iscrlf ( * p ) ; p ++ ) <START_BUG> if (! vct_issep ( * p ) && vct_isctl ( * p ) ) return ( 400 ) ; } hp -> hd [ h3 ]. b = q ; hp -> hd [ h3 ]. e = p ; p += vct_skipcrlf ( p ) ; * hp -> hd [ h1 ]. e = '\\0' ; WSLH ( w, fd, hp, h1 ) ; * hp -> hd [ h2 ]. e = '\\0' ; WSLH ( w, fd, hp, h2 )<END_BUG>

Fix:
<S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> p ) ) <S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> p ) ;
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8_set_postproc ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { # if CONFIG_POSTPROC vp8_postproc_cfg_t * data = va_arg ( args, vp8_postproc_cfg_t * ) ; if ( data ) { ctx -> postproc_cfg_set = 1 ; ctx -> postproc_cfg = * ( ( vp8_postproc_cfg_t * ) data ) ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; # else  return VPX_CODEC_INCAPABLE ; <START_BUG> # endif }<END_BUG>

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args <S2SV_ModStart> ; # else ( void ) ctx ; ( void ) args ;
Buggy code:
 int main ( int argc, char * * argv ) { u8 * byteStrmStart ; u8 * byteStrm ; u32 strmLen ; u32 picSize ; H264SwDecInst decInst ; H264SwDecRet ret ; H264SwDecInput decInput ; H264SwDecOutput decOutput ; H264SwDecPicture decPicture ; H264SwDecInfo decInfo ; u32 picNumber ; FILE * finput ; FILE * foutput ; if ( argc < 2 ) { printf ( "Usage:   %s   file.h264\\n", argv [ 0 ] ) ; return - 1 ; } foutput = fopen ( "out.yuv", "wb" ) ; if ( foutput == NULL ) { printf ( "UNABLE   TO   OPEN   OUTPUT   FILE\\n" ) ; return - 1 ; } finput = fopen ( argv [ argc - 1 ], "rb" ) ; if ( finput == NULL ) { printf ( "UNABLE   TO   OPEN   INPUT   FILE\\n" ) ; return - 1 ; } fseek ( finput, 0L, SEEK_END ) ; strmLen = ( u32 ) ftell ( finput ) ; rewind ( finput ) ; <START_BUG> byteStrm = byteStrmStart = ( u8 * ) H264SwDecMalloc ( sizeof ( u8 ) * strmLen ) ; <END_BUG> if ( byteStrm == NULL ) { printf ( "UNABLE   TO   ALLOCATE   MEMORY\\n" ) ; return - 1 ; } fread ( byteStrm, sizeof ( u8 ), strmLen, finput ) ; fclose ( finput ) ; ret = H264SwDecInit ( & decInst, 0 ) ; if ( ret!= H264SWDEC_OK ) { printf ( "DECODER   INITIALIZATION   FAILED\\n" ) ; return - 1 ; } decInput. pStream = byteStrmStart ; decInput. dataLen = strmLen ; decInput. intraConcealmentMethod = 0 ; picNumber = 0 ; do { ret = H264SwDecDecode ( decInst, & decInput, & decOutput ) ; switch ( ret ) { case H264SWDEC_HDRS_RDY_BUFF_NOT_EMPTY : ret = H264SwDecGetInfo (

Fix:
<S2SV_ModStart> ( u8 ), <S2SV_ModEnd> strmLen ) ;
Buggy code:
 static int link_pipe ( struct pipe_inode_info * ipipe, struct pipe_inode_info * opipe, size_t len, unsigned int flags ) { struct pipe_buffer * ibuf, * obuf ; int ret = 0, i = 0, nbuf ; pipe_double_lock ( ipipe, opipe ) ; do { if (! opipe -> readers ) { send_sig ( SIGPIPE, current, 0 ) ; if (! ret ) ret = - EPIPE ; break ; } if ( i >= ipipe -> nrbufs || opipe -> nrbufs >= opipe -> buffers ) break ; ibuf = ipipe -> bufs + ( ( ipipe -> curbuf + i ) & ( ipipe -> buffers - 1 ) ) ; nbuf = ( opipe -> curbuf + opipe -> nrbufs ) & ( opipe -> buffers - 1 ) ; <START_BUG> pipe_buf_get ( ipipe, ibuf ) ; <END_BUG> obuf = opipe -> bufs + nbuf ; * obuf = * ibuf ; obuf -> flags &= ~ PIPE_BUF_FLAG_GIFT ; pipe_buf_mark_unmergeable ( obuf ) ; if ( obuf -> len > len ) obuf -> len = len ; opipe -> nrbufs ++ ; ret += obuf -> len ; len -= obuf -> len ; i ++ ; } while ( len ) ; if (! ret && ipipe -> waiting_writers && ( flags & SPLICE_F_NONBLOCK ) ) ret = - EAGAIN ; pipe_unlock ( ipipe ) ; pipe_unlock ( opipe ) ; if ( ret > 0 ) wakeup_pipe_readers ( opipe ) ; return ret ; }

Fix:
<S2SV_ModStart> 1 ) ; if (! <S2SV_ModStart>, ibuf ) ) { if ( ret == 0 ) ret = - EFAULT ; break ; } <S2SV_ModEnd> obuf = opipe
Buggy code:
 static void setup_namespaces ( struct lo_data * lo, struct fuse_session * se ) { <START_BUG> pid_t child ; <END_BUG> char template [ ] = "virtiofsd-XXXXXX" ; char * tmpdir ; if ( unshare ( CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET )!= 0 ) { fuse_log ( FUSE_LOG_ERR, "unshare(CLONE_NEWPID   |   CLONE_NEWNS):   %m\\n" ) ; exit ( 1 ) ; } child = fork ( ) ; if ( child < 0 ) { fuse_log ( FUSE_LOG_ERR, "fork()   failed:   %m\\n" ) ; exit ( 1 ) ; } if ( child > 0 ) { pid_t waited ; int wstatus ; setup_wait_parent_capabilities ( ) ; do { waited = waitpid ( child, & wstatus, 0 ) ; } while ( waited < 0 && errno == EINTR &&! se -> exited ) ; if ( se -> exited ) { exit ( 0 ) ; } if ( WIFEXITED ( wstatus ) ) { exit ( WEXITSTATUS ( wstatus ) ) ; } exit ( 1 ) ; } prctl ( PR_SET_PDEATHSIG, SIGTERM ) ; if ( mount ( NULL, "//", NULL, MS_REC | MS_SLAVE, NULL ) < 0 ) { fuse_log ( FUSE_LOG_ERR, "mount(//,   MS_REC|MS_SLAVE):   %m\\n" ) ; exit ( 1 ) ; } if ( mount ( "proc", "//proc", "proc", MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, NULL ) < 0 ) { fuse_log ( FUSE_LOG_ERR, "mount(//proc):   %m\\n" ) ; exit ( 1 ) ; }  tmpdir = mkdtemp ( template ) ; <START_BUG> if (! tmpdir ) { fuse_log ( FUSE_LOG_ERR, "tmpdir(%s):   %m\\n", template ) ; exit ( 1 ) ; } <END_BUG> if ( mount ( "//proc//self//fd", tmpdir, NULL, MS_BIND, NULL ) < 0 ) {  <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> { pid_t child <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ; } <S2SV_ModEnd> if ( mount <S2SV_ModStart> ( "//proc//self//fd", "//proc" <S2SV_ModEnd>, NULL, <S2SV_ModStart> ( FUSE_LOG_ERR, "mount(//proc//self//fd, <S2SV_blank> MS_BIND): <S2SV_blank> %m\\n" <S2SV_ModEnd> ) ; exit <S2SV_ModStart> = open ( "//proc" <S2SV_ModEnd>, O_PATH ) <S2SV_ModStart> ( FUSE_LOG_ERR, "open(//proc, <S2SV_blank> O_PATH): <S2SV_blank> %m\\n" ) ; exit ( 1 <S2SV_ModEnd> ) ; }
Buggy code:
 static int ext4_split_unwritten_extents ( handle_t * handle, struct inode * inode, struct ext4_map_blocks * map, struct ext4_ext_path * path, int flags ) { ext4_lblk_t eof_block ; ext4_lblk_t ee_block ; struct ext4_extent * ex ; unsigned int ee_len ; int split_flag = 0, depth ; ext_debug ( "ext4_split_unwritten_extents:   inode   %lu,   logical" "block   %llu,   max_blocks   %u\\n", inode -> i_ino, ( unsigned long long ) map -> m_lblk, map -> m_len ) ; eof_block = ( inode -> i_size + inode -> i_sb -> s_blocksize - 1 ) >> inode -> i_sb -> s_blocksize_bits ; if ( eof_block < map -> m_lblk + map -> m_len ) eof_block = map -> m_lblk + map -> m_len ; depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; ee_block = le32_to_cpu ( ex -> ee_block ) ; ee_len = ext4_ext_get_actual_len ( ex ) ; split_flag |= ee_block + ee_len <= eof_block? EXT4_EXT_MAY_ZEROOUT : 0 ; split_flag |= EXT4_EXT_MARK_UNINIT2 ; <START_BUG> flags |= EXT4_GET_BLOCKS_PRE_IO ; <END_BUG> return ext4_split_extent ( handle, inode, path, map, split_flag, flags ) ; }

Fix:
<S2SV_ModStart> |= EXT4_EXT_MARK_UNINIT2 ; if ( flags & EXT4_GET_BLOCKS_CONVERT ) split_flag |= EXT4_EXT_DATA_VALID2 ;
Buggy code:
 static void rd_auto_partition_range ( VP9_COMP * cpi, const TileInfo * const tile, <START_BUG> int mi_row, int mi_col, <END_BUG> BLOCK_SIZE * min_block_size, BLOCK_SIZE * max_block_size ) { VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; <START_BUG> <END_BUG> MODE_INFO * * mi_8x8 = xd -> mi ;  <START_BUG> const int left_in_image = xd -> left_available && mi_8x8 [ - 1 ] ; <END_BUG> const int above_in_image = xd -> up_available &&  mi_8x8 [ - xd -> mi_stride ] ; <START_BUG> <END_BUG> MODE_INFO * * above_sb64_mi_8x8 ;  MODE_INFO * * left_sb64_mi_8x8 ; int row8x8_remaining = tile -> mi_row_end - mi_row ; <START_BUG> int col8x8_remaining = tile -> mi_col_end - mi_col ; <END_BUG> int bh, bw ; BLOCK_SIZE min_size = BLOCK_4X4 ;  BLOCK_SIZE max_size = BLOCK_64X64 ; <START_BUG> if ( left_in_image || above_in_image || cm -> frame_type!= KEY_FRAME ) { min_size = BLOCK_64X64 ; max_size = BLOCK_4X4 ; if ( cm -> frame_type!= KEY_FRAME ) { <END_BUG> MODE_INFO * * const prev_mi =  & cm -> prev_mi_grid_visible [ mi_row * xd -> mi_stride + mi_col ] ; <START_BUG> get_sb_partition_size_range ( cpi, prev_mi, & min_size, & max_size ) ; <END_BUG> } if ( left_in_image ) {  left_sb64_mi_8x8 = & mi_8x8 [ - MI_BLOCK_SIZE ] ; <START_BUG> <END_BUG> get_sb_partition_size_range ( cpi, left_sb64_mi_8x8,  & min_size, & max_size ) ; } if ( above_in_image ) { <START_BUG> above_sb64_mi_8x8 = & mi_8x<END_BUG>

Fix:
<S2SV_ModStart> const tile, MACROBLOCKD * const xd, <S2SV_ModStart> -> common ; <S2SV_ModEnd> MODE_INFO * * <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd> = xd -> <S2SV_ModStart> -> left_available && mi <S2SV_ModEnd> [ - 1 <S2SV_ModStart> -> up_available && mi <S2SV_ModEnd> [ - xd <S2SV_ModStart> mi_stride ] ; const <S2SV_ModEnd> int row8x8_remaining = <S2SV_ModStart> - mi_row ; const <S2SV_ModStart> max_size = BLOCK_64X64 ; int bs_hist [ BLOCK_SIZES ] = { 0 } <S2SV_ModStart> MODE_INFO * * <S2SV_ModEnd> prev_mi = & <S2SV_ModStart> ; get_sb_partition_size_range ( xd <S2SV_ModEnd>, prev_mi, <S2SV_ModStart>, & max_size, bs_hist <S2SV_ModStart> left_in_image ) { MODE_INFO * * left_sb64_mi = & mi <S2SV_ModEnd> [ - MI_BLOCK_SIZE <S2SV_ModStart> ; get_sb_partition_size_range ( xd, left_sb64_mi, & min_size, & max_size, bs_hist <S2SV_ModEnd> ) ; } <S2SV_ModStart> above_in_image ) { MODE_INFO * * above_sb64_mi = & mi <S2SV_ModEnd> [ - xd <S2SV_ModStart> ; get_sb_partition_size_range ( xd, above_
Buggy code:
 static int ptrace_check_attach ( struct task_struct * child, bool ignore_state ) { int ret = - ESRCH ; read_lock ( & tasklist_lock ) ; <START_BUG> if ( ( child -> ptrace & PT_PTRACED ) && child -> parent == current ) { <END_BUG>  spin_lock_irq ( & child -> sighand -> siglock ) ; <START_BUG> WARN_ON_ONCE ( task_is_stopped ( child ) ) ; <END_BUG> if ( ignore_state || ( task_is_traced ( child ) && ! ( child -> jobctl & JOBCTL_LISTENING ) ) ) <START_BUG> ret = 0 ; <END_BUG> spin_unlock_irq ( & child -> sighand -> siglock ) ; } read_unlock ( & tasklist_lock ) ;  if (! ret &&! ignore_state ) <START_BUG> <END_BUG> ret = wait_task_inactive ( child, TASK_TRACED )? 0 : - ESRCH ;  return ret ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> child -> ptrace <S2SV_ModStart> child -> ptrace <S2SV_ModEnd> && child -> <S2SV_ModStart> current ) { WARN_ON ( child -> state == __TASK_TRACED <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( ignore_state || ptrace_freeze_traced ( child <S2SV_ModEnd> ) ) ret <S2SV_ModStart> ret = 0 <S2SV_ModEnd> ; } read_unlock <S2SV_ModStart>! ignore_state ) { if (! <S2SV_ModEnd> wait_task_inactive ( child <S2SV_ModStart> ( child, __TASK_TRACED ) ) { WARN_ON ( child -> state == __TASK_TRACED ) ; ret = <S2SV_ModEnd> - ESRCH ; <S2SV_ModStart> - ESRCH ; } }
Buggy code:
 <START_BUG> static char * <END_BUG> base64_decode_string ( const char * enc ) {  if ( enc == NULL ) <START_BUG> return NULL ; <END_BUG> char * dec = g_strdup ( enc ) ;  gsize len ; <START_BUG> g_base64_decode_inplace ( dec, & len ) ; <END_BUG> dec [ len ] = '\\0' ; return dec ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static gchar <S2SV_ModEnd> * base64_decode_string ( <S2SV_ModStart> enc ) { gchar * dec ; gsize len ; <S2SV_ModStart> return NULL ; dec = ( gchar * ) g_base64_decode ( enc <S2SV_ModEnd>, & len <S2SV_ModStart> len ) ; if ( dec )
Buggy code:
 void usb_sg_cancel ( struct usb_sg_request * io ) { unsigned long flags ; int i, retval ; spin_lock_irqsave ( & io -> lock, flags ) ; <START_BUG> if ( io -> status ) { <END_BUG> spin_unlock_irqrestore ( & io -> lock, flags ) ; return ; } io -> status = - ECONNRESET ;  spin_unlock_irqrestore ( & io -> lock, flags ) ; <START_BUG> for ( i = io -> entries - 1 ; i >= 0 ; -- i ) { usb_block_urb ( io -> urbs [ i ] ) ; retval = usb_unlink_urb ( io -> urbs [ i ] ) ; if ( retval!= - EINPROGRESS && retval!= - ENODEV && retval!= - EBUSY && retval!= - EIDRM ) dev_warn ( & io -> dev -> dev, "%s,   unlink   -->   %d\\n", __func__, retval ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> io -> status || io -> count == 0 <S2SV_ModStart> - ECONNRESET ; io -> count ++ ; <S2SV_ModStart> ) ; } spin_lock_irqsave ( & io -> lock, flags ) ; io -> count -- ; if (! io -> count ) complete ( & io -> complete ) ; spin_unlock_irqrestore ( & io -> lock, flags ) ;
Buggy code:
 void vp9_encode_sb ( MACROBLOCK * x, BLOCK_SIZE bsize ) { MACROBLOCKD * const xd = & x -> e_mbd ; struct optimize_ctx ctx ; MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; struct encode_b_args arg = { x, & ctx, & mbmi -> skip } ; int plane ; <START_BUG> for ( plane = 0 ; plane < MAX_MB_PLANE ; ++ plane ) { <END_BUG> if (! x -> skip_recode ) vp9_subtract_plane ( x, bsize, plane ) ; if ( x -> optimize && (! x -> skip_recode ||! x -> skip_optimize ) ) { const struct macroblockd_plane * const pd = & xd -> plane [ plane ] ;  const TX_SIZE tx_size = plane? get_uv_tx_size ( mbmi ) : mbmi -> tx_size ; <START_BUG> vp9_get_entropy_contexts ( bsize, tx_size, pd, ctx. ta [ plane ], ctx. tl [ plane ] ) ; } vp9_foreach_transformed_block_in_plane ( xd, bsize, plane, encode_block, & arg ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> int plane ; mbmi -> skip = 1 ; if ( x -> skip ) return ; <S2SV_ModStart> get_uv_tx_size ( mbmi, pd
Buggy code:
 error_t tcpAddOption ( TcpHeader * segment, uint8_t kind, const void * value, uint8_t length ) { <START_BUG> uint_t i ; <END_BUG> size_t paddingSize ; TcpOption * option ; length += sizeof ( TcpOption ) ;  if ( ( segment -> dataOffset * 4 + length ) > TCP_MAX_HEADER_LENGTH ) <START_BUG> return ERROR_FAILURE ; <END_BUG> i = segment -> dataOffset * 4 - sizeof ( TcpHeader ) ;  paddingSize = ( length % 4 )? 4 - ( length % 4 ) : 0 ; while ( paddingSize -- ) <START_BUG> segment -> options [ i ++ ] = TCP_OPTION_NOP ; <END_BUG>  option = ( TcpOption * ) ( segment -> options + i ) ; <START_BUG> option -> kind = kind ; option -> length = length ; osMemcpy ( option -> value, value, length - sizeof ( TcpOption ) ) ; i += length ; segment -> dataOffset = ( sizeof ( TcpHeader ) + i ) // 4 ; <END_BUG> return NO_ERROR ;  }

Fix:
<S2SV_ModStart> length ) { error_t error ; size_t <S2SV_ModEnd> i ; size_t <S2SV_ModStart> + length ) <= TCP_MAX_HEADER_LENGTH ) { i = ( <S2SV_ModEnd> segment -> dataOffset <S2SV_ModStart> dataOffset * 4 ) <S2SV_ModStart> paddingSize -- ) { <S2SV_ModStart> = TCP_OPTION_NOP ; } <S2SV_ModStart> // 4 ; error = NO_ERROR ; } else { error = ERROR_FAILURE ; } return error <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 krb5_error_code krb5_ldap_put_principal ( krb5_context context, krb5_db_entry * entry, char * * db_args ) { int l = 0, kerberos_principal_object_type = 0 ; unsigned int ntrees = 0, tre = 0 ; krb5_error_code st = 0, tempst = 0 ; LDAP * ld = NULL ; LDAPMessage * result = NULL, * ent = NULL ; char * * subtreelist = NULL ; char * user = NULL, * subtree = NULL, * principal_dn = NULL ; char * * values = NULL, * strval [ 10 ] = { NULL }, errbuf [ 1024 ] ; char * filtuser = NULL ; struct berval * * bersecretkey = NULL ; LDAPMod * * mods = NULL ; krb5_boolean create_standalone_prinicipal = FALSE ; krb5_boolean krb_identity_exists = FALSE, establish_links = FALSE ; char * standalone_principal_dn = NULL ; krb5_tl_data * tl_data = NULL ; krb5_key_data * * keys = NULL ; kdb5_dal_handle * dal_handle = NULL ; krb5_ldap_context * ldap_context = NULL ; krb5_ldap_server_handle * ldap_server_handle = NULL ; osa_princ_ent_rec princ_ent = { 0 } ; xargs_t xargs = { 0 } ; char * polname = NULL ; OPERATION optype ; krb5_boolean found_entry = FALSE ; krb5_clear_error_message ( context ) ; SETUP_CONTEXT ( ) ; if ( ldap_context -> lrparams == NULL || ldap_context -> container_dn == NULL ) return EINVAL ; GET_HANDLE ( ) ; if (! is_principal_in_realm ( ldap_context, entry -> princ ) ) { st = EINVAL ; k5_setmsg ( context, st, _ ( "Principal   does   not   belong   to   the   default   realm" ) ) ; goto cleanup ; } if ( ( ( st = krb5_unparse_name ( context, entry -> princ, & user ) )!= 0 ) || ( ( st = krb5

Fix:
<S2SV_ModStart> ; if ( bersecretkey == NULL ) { st = ENOMEM ; goto cleanup ; } if ( bersecretkey [ 0 ]!= NULL ||! create_standalone_prinicipal ) { <S2SV_ModEnd> st = krb5_add_ber_mem_ldap_mod <S2SV_ModStart>, bersecretkey ) ; if ( st!= 0 ) goto cleanup ; } <S2SV_ModEnd> if (!
Buggy code:
 static long ion_ioctl ( struct file * filp, unsigned int cmd, unsigned long arg ) { struct ion_client * client = filp -> private_data ; struct ion_device * dev = client -> dev ; struct ion_handle * cleanup_handle = NULL ; int ret = 0 ; unsigned int dir ; union { struct ion_fd_data fd ; struct ion_allocation_data allocation ; struct ion_handle_data handle ; struct ion_custom_data custom ; } data ; dir = ion_ioctl_dir ( cmd ) ; if ( _IOC_SIZE ( cmd ) > sizeof ( data ) ) return - EINVAL ; if ( dir & _IOC_WRITE ) if ( copy_from_user ( & data, ( void __user * ) arg, _IOC_SIZE ( cmd ) ) ) return - EFAULT ; switch ( cmd ) { case ION_IOC_ALLOC : { struct ion_handle * handle ; handle = ion_alloc ( client, data. allocation. len, data. allocation. align, data. allocation. heap_id_mask, data. allocation. flags ) ; if ( IS_ERR ( handle ) ) return PTR_ERR ( handle ) ; data. allocation. handle = handle -> id ; cleanup_handle = handle ; break ; } case ION_IOC_FREE : { struct ion_handle * handle ; <START_BUG> handle = ion_handle_get_by_id ( client, data. handle. handle ) ; <END_BUG>  if ( IS_ERR ( handle ) ) <START_BUG> return PTR_ERR ( handle ) ; <END_BUG> ion_free ( client, handle ) ;  ion_handle_put ( handle ) ; break ; } case ION_IOC_SHARE : case ION_IOC_MAP : { struct ion_handle * handle ; handle = ion_handle_get_by_id ( client, data. handle. handle ) ; if ( IS_ERR ( handle ) ) return PTR_ERR ( handle ) ; data. fd. fd = ion_share_dma_buf_fd ( client, handle ) ; ion_handle_put ( handle ) ; if ( data. fd. fd < 0 ) ret = data. fd. fd ; break ; } case ION_IOC_IMPORT : { struct ion_handle * handle ; handle = ion_import_dma_

Fix:
<S2SV_ModStart> * handle ; mutex_lock ( & client -> lock ) ; handle = ion_handle_get_by_id_nolock <S2SV_ModEnd> ( client, <S2SV_ModStart> handle ) ) { mutex_unlock ( & client -> lock ) ; <S2SV_ModStart> handle ) ; } ion_free_nolock ( client, handle ) ; ion_handle_put_nolock ( handle ) ; mutex_unlock ( & client -> lock <S2SV_ModEnd> ) ; break