nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int isis_print_extd_ip_reach ( netdissect_options * ndo, const uint8_t * tptr, const char * ident, uint16_t afi ) { char ident_buffer [ 20 ] ; uint8_t prefix [ sizeof ( struct in6_addr ) ] ; u_int metric, status_byte, bit_length, byte_length, sublen, processed, subtlvtype, subtlvlen ; if (! ND_TTEST2 ( * tptr, 4 ) ) return ( 0 ) ; metric = EXTRACT_32BITS ( tptr ) ; processed = 4 ; tptr += 4 ; if ( afi == AF_INET ) { if (! ND_TTEST2 ( * tptr, 1 ) ) return ( 0 ) ; status_byte = * ( tptr ++ ) ; bit_length = status_byte & 0x3f ; if ( bit_length > 32 ) { ND_PRINT ( ( ndo, "%sIPv4   prefix:   bad   bit   length   %u", ident, bit_length ) ) ; return ( 0 ) ; } processed ++ ; } else if ( afi == AF_INET6 ) { <START_BUG> if (! ND_TTEST2 ( * tptr, 1 ) ) <END_BUG> return ( 0 ) ; status_byte = * ( tptr ++ ) ; bit_length = * ( tptr ++ ) ; if ( bit_length > 128 ) { ND_PRINT ( ( ndo, "%sIPv6   prefix:   bad   bit   length   %u", ident, bit_length ) ) ; return ( 0 ) ; } processed += 2 ; } else return ( 0 ) ; byte_length = ( bit_length + 7 ) // 8 ; if (! ND_TTEST2 ( * tptr, byte_length ) ) return ( 0 ) ; memset ( prefix, 0, sizeof prefix ) ; memcpy ( prefix, tptr, byte_length ) ; tptr += byte_length ; processed += byte_length ; if ( afi == AF_INET ) ND_PRINT ( ( ndo, "%sIPv4   prefix:   %15s//%u", ident, ipaddr_string ( ndo, prefix ), bit_length ) ) ; else if ( afi

Fix:
<S2SV_ModStart> * tptr, 2 <S2SV_ModEnd> ) ) return
Buggy code:
 <START_BUG> static struct ip_options * ip_options_get_alloc ( const int optlen ) <END_BUG> {  return kzalloc ( sizeof ( struct ip_options ) + ( ( optlen + 3 ) & ~ 3 ), <START_BUG> GFP_KERNEL ) ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> static struct ip_options_rcu <S2SV_ModEnd> * ip_options_get_alloc ( <S2SV_ModStart> sizeof ( struct ip_options_rcu <S2SV_ModEnd> ) + (
Buggy code:
 static grub_err_t read_foo ( struct grub_disk * disk, grub_disk_addr_t sector, grub_size_t size, char * buf ) { <START_BUG> if ( disk!= NULL ) { <END_BUG>  const int blocksize = 512 ; <START_BUG> int ret ; RIOBind * iob = disk -> data ; <END_BUG> if ( bio ) iob = bio ;  <START_BUG> ret = iob -> read_at ( iob -> io, delta + ( blocksize * sector ), <END_BUG>  ( ut8 * ) buf, size * blocksize ) ; <START_BUG> <END_BUG> if ( ret == - 1 )  return 1 ; <START_BUG> } else eprintf ( "oops.   no   disk\\n" ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> { if (! disk ) { eprintf ( "oops. <S2SV_blank> no <S2SV_blank> disk\\n" ) ; return 1 ; } <S2SV_ModEnd> const int blocksize <S2SV_ModStart> blocksize = 512 <S2SV_ModEnd> ; RIOBind * <S2SV_ModStart> ( bio ) { <S2SV_ModStart> = bio ; } if ( <S2SV_ModEnd> iob -> read_at <S2SV_ModStart> * blocksize ) <S2SV_ModEnd> == - 1 <S2SV_ModStart> - 1 ) { <S2SV_ModStart> 1 ; } <S2SV_ModEnd> return 0 ;
Buggy code:
 int vp9_rc_pick_q_and_bounds ( const VP9_COMP * cpi, int * bottom_index, int * top_index ) { int q ; <START_BUG> if ( cpi -> pass == 0 ) { <END_BUG>  if ( cpi -> oxcf. end_usage == USAGE_STREAM_FROM_SERVER ) <START_BUG> q = rc_pick_q_and_bounds_one_pass_cbr ( cpi, bottom_index, top_index ) ; else q = rc_pick_q_and_bounds_one_pass_vbr ( cpi, bottom_index, top_index ) ; } else { q = rc_pick_q_and_bounds_two_pass ( cpi, bottom_index, top_index ) ; } if ( cpi -> sf. use_nonrd_pick_mode ) { <END_BUG> if ( q == 0 )  q ++ ; if ( cpi -> sf. force_frame_boost == 1 ) q -= cpi -> sf. max_delta_qindex ; if ( q < * bottom_index ) * bottom_index = q ; else if ( q > * top_index ) * top_index = q ; } return q ; }

Fix:
<S2SV_ModStart> ( cpi -> oxcf. <S2SV_ModStart> -> oxcf. rc_mode == VPX_CBR <S2SV_ModEnd> ) q = <S2SV_ModStart> { if ( <S2SV_ModEnd> cpi -> sf
Buggy code:
 static gboolean comics_check_decompress_command ( gchar * mime_type, ComicsDocument * comics_document, GError * * error ) { gboolean success ; gchar * std_out, * std_err ; gint retval ; GError * err = NULL ; if ( g_content_type_is_a ( mime_type, "application//x-cbr" ) || g_content_type_is_a ( mime_type, "application//x-rar" ) ) { comics_document -> selected_command = g_find_program_in_path ( "unrar" ) ; if ( comics_document -> selected_command ) { success = g_spawn_command_line_sync ( comics_document -> selected_command, & std_out, & std_err, & retval, & err ) ; if (! success ) { g_propagate_error ( error, err ) ; g_error_free ( err ) ; return FALSE ; } else if ( WIFEXITED ( retval ) ) { if ( g_strrstr ( std_out, "freeware" )!= NULL ) comics_document -> command_usage = RARLABS ; else comics_document -> command_usage = GNAUNRAR ; g_free ( std_out ) ; g_free ( std_err ) ; return TRUE ; } } comics_document -> selected_command = g_find_program_in_path ( "unrar-free" ) ; if ( comics_document -> selected_command ) { comics_document -> command_usage = GNAUNRAR ; return TRUE ; } <START_BUG> comics_document -> selected_command = <END_BUG> g_find_program_in_path ( "bsdtar" ) ; if ( comics_document -> selected_command ) { comics_document -> command_usage = TAR ; return TRUE ; } } else if ( g_content_type_is_a ( mime_type, "application//x-cbz" ) || g_content_type_is_a ( mime_type, "application//zip" ) ) { comics_document -> selected_command = g_find_program_in_path ( "unzip" ) ; comics_document -> alternative

Fix:
<S2SV_ModStart> TRUE ; } <S2SV_ModEnd> } else if <S2SV_ModStart> TRUE ; } <S2SV_ModEnd> } else if <S2SV_ModStart> TRUE ; } } else <S2SV_ModEnd> { g_set_error (
Buggy code:
 long follow_hugetlb_page ( struct mm_struct * mm, struct vm_area_struct * vma, struct page * * pages, struct vm_area_struct * * vmas, unsigned long * position, unsigned long * nr_pages, long i, unsigned int flags, int * nonblocking ) { unsigned long pfn_offset ; unsigned long vaddr = * position ; unsigned long remainder = * nr_pages ; struct hstate * h = hstate_vma ( vma ) ; int err = - EFAULT ; while ( vaddr < vma -> vm_end && remainder ) { pte_t * pte ; spinlock_t * ptl = NULL ; int absent ; struct page * page ; if ( fatal_signal_pending ( current ) ) { remainder = 0 ; break ; } pte = huge_pte_offset ( mm, vaddr & huge_page_mask ( h ), huge_page_size ( h ) ) ; if ( pte ) ptl = huge_pte_lock ( h, mm, pte ) ; absent =! pte || huge_pte_none ( huge_ptep_get ( pte ) ) ; if ( absent && ( flags & FOLL_DUMP ) &&! hugetlbfs_pagecache_present ( h, vma, vaddr ) ) { if ( pte ) spin_unlock ( ptl ) ; remainder = 0 ; break ; } if ( absent || is_swap_pte ( huge_ptep_get ( pte ) ) || ( ( flags & FOLL_WRITE ) &&! huge_pte_write ( huge_ptep_get ( pte ) ) ) ) { vm_fault_t ret ; unsigned int fault_flags = 0 ; if ( pte ) spin_unlock ( ptl ) ; if ( flags & FOLL_WRITE ) fault_flags |= FAULT_FLAG_WRITE ; if ( nonblocking ) fault_flags |= FAULT_FLAG_ALLOW_RETRY ; if ( flags & FOLL_NOWAIT ) fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT ; if ( flags & FOLL_TRIED ) { VM_WARN_ON_ONCE ( fault_flags & FAULT_FLAG

Fix:
<S2SV_ModStart> ) ) ; if ( unlikely ( page_count ( page ) <= 0 ) ) { if ( pages ) { spin_unlock ( ptl ) ; remainder = 0 ; err = - ENOMEM ; break ; } }
Buggy code:
 PHP_FUNCTION ( imagegammacorrect ) { zval * IM ; gdImagePtr im ; int i ; double input, output ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "rdd", & IM, & input, & output ) == FAILURE ) { return ; } <START_BUG> ZEND_FETCH_RESOURCE ( im, gdImagePtr, & IM, - 1, "Image", le_gd ) ; <END_BUG> if ( gdImageTrueColor ( im ) ) { int x, y, c ; for ( y = 0 ; y < gdImageSY ( im ) ; y ++ ) { for ( x = 0 ; x < gdImageSX ( im ) ; x ++ ) { c = gdImageGetPixel ( im, x, y ) ; gdImageSetPixel ( im, x, y, gdTrueColorAlpha ( ( int ) ( ( pow ( ( pow ( ( gdTrueColorGetRed ( c ) // 255.0 ), input ) ), 1.0 // output ) * 255 ) +.5 ), ( int ) ( ( pow ( ( pow ( ( gdTrueColorGetGreen ( c ) // 255.0 ), input ) ), 1.0 // output ) * 255 ) +.5 ), ( int ) ( ( pow ( ( pow ( ( gdTrueColorGetBlue ( c ) // 255.0 ), input ) ), 1.0 // output ) * 255 ) +.5 ), gdTrueColorGetAlpha ( c ) ) ) ; } } RETURN_TRUE ; } for ( i = 0 ; i < gdImageColorsTotal ( im ) ; i ++ ) { im -> red [ i ] = ( int ) ( ( pow ( ( pow ( ( im -> red [ i ] // 255.0 ), input ) ), 1.0 // output ) * 255 ) +.5 ) ; im -> green [ i ] = ( int ) ( ( pow ( ( pow ( ( im -> green [ i ] // 255.0 ), input ) ), 1.0 // output ) * 255 ) +.5 ) ; im -> blue [ i ] = ( int ) ( ( pow ( ( pow ( ( im -> blue [ i ] // 255.0 ), input ) ), 1.0 // output ) * 255 ) +.5 ) ; } RETURN_

Fix:
<S2SV_ModStart> return ; } if ( input <= 0.0 || output <= 0.0 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Gamma <S2SV_blank> values <S2SV_blank> should <S2SV_blank> be <S2SV_blank> positive" ) ; RETURN_FALSE ; }
Buggy code:
 static void l2tp_eth_dev_setup ( struct net_device * dev ) { ether_setup ( dev ) ; <START_BUG> dev -> netdev_ops = & l2tp_eth_netdev_ops ; <END_BUG> dev -> destructor = free_netdev ; }

Fix:
<S2SV_ModStart> ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ; dev ->
Buggy code:
 static int __ip6_datagram_connect ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct sockaddr_in6 * usin = ( struct sockaddr_in6 * ) uaddr ; struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct in6_addr * daddr, * final_p, final ; struct dst_entry * dst ; struct flowi6 fl6 ; struct ip6_flowlabel * flowlabel = NULL ; struct ipv6_txoptions * opt ; int addr_type ; int err ; if ( usin -> sin6_family == AF_INET ) { if ( __ipv6_only_sock ( sk ) ) return - EAFNOSUPPORT ; err = __ip4_datagram_connect ( sk, uaddr, addr_len ) ; goto ipv4_connected ; } if ( addr_len < SIN6_LEN_RFC2133 ) return - EINVAL ; if ( usin -> sin6_family!= AF_INET6 ) return - EAFNOSUPPORT ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; if ( np -> sndflow ) { fl6. flowlabel = usin -> sin6_flowinfo & IPV6_FLOWINFO_MASK ; if ( fl6. flowlabel & IPV6_FLOWLABEL_MASK ) { flowlabel = fl6_sock_lookup ( sk, fl6. flowlabel ) ; if (! flowlabel ) return - EINVAL ; } } addr_type = ipv6_addr_type ( & usin -> sin6_addr ) ; if ( addr_type == IPV6_ADDR_ANY ) { usin -> sin6_addr. s6_addr [ 15 ] = 0x01 ; } daddr = & usin -> sin6_addr ; if ( addr_type == IPV6_ADDR_MAPPED ) { struct sockaddr_in sin ; if ( __ipv6_only_sock ( sk ) ) { err = - ENETUNREACH ; goto out ; } sin. sin_family = AF_INET ; sin. sin_addr. s_addr = daddr -> s6_addr32 [ 3 ] ; sin. sin_port = usin ->

Fix:
<S2SV_ModStart> ) ) ; rcu_read_lock ( ) ; <S2SV_ModStart> -> opt : rcu_dereference ( <S2SV_ModStart> np -> opt ) <S2SV_ModStart>, & final ) ; rcu_read_unlock (
Buggy code:
 static int kvm_guest_time_update ( struct kvm_vcpu * v ) { unsigned long flags, this_tsc_khz ; struct kvm_vcpu_arch * vcpu = & v -> arch ; struct kvm_arch * ka = & v -> kvm -> arch ; <START_BUG> void * shared_kaddr ; <END_BUG> s64 kernel_ns, max_kernel_ns ; u64 tsc_timestamp, host_tsc ;  struct pvclock_vcpu_time_info * guest_hv_clock ; <START_BUG> u8 pvclock_flags ; bool use_master_clock ; kernel_ns = 0 ; host_tsc = 0 ; spin_lock ( & ka -> pvclock_gtod_sync_lock ) ; use_master_clock = ka -> use_master_clock ; if ( use_master_clock ) { host_tsc = ka -> master_cycle_now ; kernel_ns = ka -> master_kernel_ns ; } spin_unlock ( & ka -> pvclock_gtod_sync_lock ) ; local_irq_save ( flags ) ; this_tsc_khz = __get_cpu_var ( cpu_tsc_khz ) ; if ( unlikely ( this_tsc_khz == 0 ) ) { local_irq_restore ( flags ) ; kvm_make_request ( KVM_REQ_CLOCK_UPDATE, v ) ; return 1 ; } if (! use_master_clock ) { host_tsc = native_read_tsc ( ) ; kernel_ns = get_kernel_ns ( ) ; } tsc_timestamp = kvm_x86_ops -> read_l1_tsc ( v, host_tsc ) ; if ( vcpu -> tsc_catchup ) { u64 tsc = compute_guest_tsc ( v, kernel_ns ) ; if ( tsc > tsc_timestamp ) { adjust_tsc_offset_guest ( v, tsc - tsc_timestamp ) ; tsc_timestamp = tsc ; } } local_irq_restore ( flags ) ; <END_BUG> if (! vcpu -> time_page )  return 0 ; max_kernel_ns = 0 ; if ( vcpu -> hv_clock. t

Fix:
<S2SV_ModStart> -> arch ; <S2SV_ModEnd> s64 kernel_ns, <S2SV_ModStart> ; struct pvclock_vcpu_time_info <S2SV_ModEnd> guest_hv_clock ; u8 <S2SV_ModStart>! vcpu -> pv_time_enabled <S2SV_ModEnd> ) return 0 <S2SV_ModStart> += 2 ; if ( unlikely ( kvm_read_guest_cached ( v -> kvm, & vcpu -> pv_time, & guest_hv_clock, sizeof ( guest_hv_clock ) ) ) ) return 0 <S2SV_ModEnd> ; pvclock_flags = <S2SV_ModStart> = ( guest_hv_clock. <S2SV_ModEnd> flags & PVCLOCK_GUEST_STOPPED <S2SV_ModStart> = pvclock_flags ; kvm_write_guest_cached ( v -> kvm, & vcpu -> pv_time, <S2SV_ModEnd> & vcpu -> <S2SV_ModStart> ) ) ; <S2SV_ModEnd> return 0 ;
Buggy code:
 void vp9_update_layer_context_change_config ( VP9_COMP * const cpi, const int target_bandwidth ) { SVC * const svc = & cpi -> svc ; <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG> const RATE_CONTROL * const rc = & cpi -> rc ;  int layer ; <START_BUG> int layer_end ; float bitrate_alloc = 1.0 ; <END_BUG> if ( svc -> number_temporal_layers > 1 ) {  layer_end = svc -> number_temporal_layers ; } else { layer_end = svc -> number_spatial_layers ; } for ( layer = 0 ; layer < layer_end ; ++ layer ) { LAYER_CONTEXT * const lc = & svc -> layer_context [ layer ] ; <START_BUG> RATE_CONTROL * const lrc = & lc -> rc ; <END_BUG>  if ( svc -> number_temporal_layers > 1 ) { <START_BUG> lc -> target_bandwidth = oxcf -> ts_target_bitrate [ layer ] * 1000 ; } else { lc -> target_bandwidth = oxcf -> ss_target_bitrate [ layer ] * 1000 ; } bitrate_alloc = ( float ) lc -> target_bandwidth // target_bandwidth ; lc -> starting_buffer_level = ( int64_t ) ( oxcf -> starting_buffer_level * bitrate_alloc ) ; lc -> optimal_buffer_level = ( int64_t ) ( oxcf -> optimal_buffer_level * bitrate_alloc ) ; lc -> maximum_buffer_size = ( int64_t ) ( oxcf -> maximum_buffer_size * bitrate_alloc ) ; lrc -> bits_off_target = MIN ( lrc -> bits_off_target, lc -> maximum_buffer_size ) ; lrc -> buffer_level = MIN ( lrc -> buffer_level, lc -> maximum_buffer_size ) ; if ( svc -> number_temporal_layers > 1 ) { <END_BUG> lc -> framerate = oxcf -> framerate // oxcf -> ts_rate_decimator [ layer ] ;  } else { <START_BUG> lc -> framerate = oxcf -> framerate ; <END_BUG> }  lrc -> av_per_frame_bandwidth = ( int ) ( lc -> target_bandwidth //

Fix:
<S2SV_ModStart> svc ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> rc ; int sl, tl, layer = 0, spatial_layer_target ; float bitrate_alloc = 1.0 ; if ( svc -> temporal_layering_mode!= VP9E_TEMPORAL_LAYERING_MODE_NOLAYERING ) { for ( sl = 0 ; sl < oxcf -> ss_number_layers ; ++ sl ) { spatial_layer_target = 0 ; for ( tl = 0 ; tl < oxcf -> ts_number_layers ; ++ tl ) { layer = LAYER_IDS_TO_IDX ( sl, tl, oxcf -> ts_number_layers ) ; svc -> layer_context [ layer ]. target_bandwidth = oxcf -> layer_target_bitrate [ layer ] ; } layer = LAYER_IDS_TO_IDX ( sl, ( ( oxcf -> ts_number_layers - 1 ) < 0? 0 : ( oxcf -> ts_number_layers - 1 ) ), oxcf -> ts_number_layers ) ; spatial_layer_target = svc -> layer_context [ layer ].
Buggy code:
 static ssize_t _hostsock_readv ( oe_fd_t * desc, const struct oe_iovec * iov, int iovcnt ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( desc ) ; void * buf = NULL ; size_t buf_size = 0 ; <START_BUG> if (! sock || (! iov && iovcnt ) || iovcnt < 0 || iovcnt > OE_IOV_MAX ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( iov, iovcnt, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_recvv_ocall ( & ret, sock -> host_fd, buf, iovcnt, buf_size )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> if ( ret > 0 ) <END_BUG> { if ( oe_iov_sync ( iov, iovcnt, buf, buf_size )!= 0 ) OE_RAISE_ERRNO ( OE_EINVAL ) ; } done : if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> = 0 ; size_t data_size = 0 ; <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> ( ret > ( ssize_t ) ( data_size ) ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; } if ( ret >
Buggy code:
 static int iwch_l2t_send ( struct t3cdev * tdev, struct sk_buff * skb, struct l2t_entry * l2e ) { int error = 0 ; struct cxio_rdev * rdev ; rdev = ( struct cxio_rdev * ) tdev -> ulp ; if ( cxio_fatal_error ( rdev ) ) { kfree_skb ( skb ) ; return - EIO ; } error = l2t_send ( tdev, skb, l2e ) ; if ( error < 0 ) kfree_skb ( skb ) ; <START_BUG> return error ; <END_BUG> }

Fix:
<S2SV_ModStart> ; return error < 0? error : 0
Buggy code:
 static int kvm_ioctl_create_device ( struct kvm * kvm, struct kvm_create_device * cd ) { struct kvm_device_ops * ops = NULL ; struct kvm_device * dev ; bool test = cd -> flags & KVM_CREATE_DEVICE_TEST ; int ret ; if ( cd -> type >= ARRAY_SIZE ( kvm_device_ops_table ) ) return - ENODEV ; ops = kvm_device_ops_table [ cd -> type ] ; if ( ops == NULL ) return - ENODEV ; if ( test ) return 0 ; dev = kzalloc ( sizeof ( * dev ), GFP_KERNEL ) ; if (! dev ) return - ENOMEM ; dev -> ops = ops ; dev -> kvm = kvm ; mutex_lock ( & kvm -> lock ) ; ret = ops -> create ( dev, cd -> type ) ; if ( ret < 0 ) { mutex_unlock ( & kvm -> lock ) ; kfree ( dev ) ; return ret ; } list_add ( & dev -> vm_node, & kvm -> devices ) ; mutex_unlock ( & kvm -> lock ) ; if ( ops -> init ) ops -> init ( dev ) ; ret = anon_inode_getfd ( ops -> name, & kvm_device_fops, dev, O_RDWR | O_CLOEXEC ) ; if ( ret < 0 ) { <START_BUG> ops -> destroy ( dev ) ; <END_BUG> mutex_lock ( & kvm -> lock ) ; list_del ( & dev -> vm_node ) ; mutex_unlock ( & kvm -> lock ) ; return ret ; } kvm_get_kvm ( kvm ) ; cd -> fd = ret ; return 0 ; }

Fix:
<S2SV_ModStart> 0 ) { mutex_lock ( & kvm -> lock ) ; list_del ( & dev -> vm_node ) ; mutex_unlock ( & kvm -> lock ) ; <S2SV_ModStart> destroy ( dev <S2SV_ModEnd> ) ; return
Buggy code:
 BOOL rdp_read_share_control_header ( wStream * s, UINT16 * length, UINT16 * type, UINT16 * channel_id ) { <START_BUG> if ( Stream_GetRemainingLength ( s ) < 2 ) <END_BUG> return FALSE ;  Stream_Read_UINT16 ( s, * length ) ; <START_BUG> <END_BUG> if ( * length == 0x8000 )  { <START_BUG> rdp_read_flow_control_pdu ( s, type ) ; <END_BUG> * channel_id = 0 ; * length = 8 ; return TRUE ; }  if ( ( ( size_t ) * length - 2 ) > Stream_GetRemainingLength ( s ) ) <START_BUG> return FALSE ; Stream_Read_UINT16 ( s, * type ) ; * type &= 0x0F ; <END_BUG> if ( * length > 4 )  Stream_Read_UINT16 ( s, * channel_id ) ; else * channel_id = 0 ; return TRUE ; }

Fix:
<S2SV_ModStart> channel_id ) { UINT16 len ; <S2SV_ModStart> ( s, len ) ; * length = len <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; if ( len <S2SV_ModEnd> == 0x8000 ) <S2SV_ModStart> 0x8000 ) { if (! <S2SV_ModStart>, type ) ) return FALSE <S2SV_ModStart> if ( ( len < 4 ) || ( ( len <S2SV_ModEnd> - 2 ) <S2SV_ModStart> Stream_GetRemainingLength ( s ) <S2SV_ModStart> ; if ( len <S2SV_ModEnd> > 4 )
Buggy code:
 static int int_x509_param_set_hosts ( X509_VERIFY_PARAM_ID * id, int mode, const char * name, size_t namelen ) { char * copy ; <START_BUG> if ( name && memchr ( name, '\\0', namelen ) ) <END_BUG> return 0 ; if ( mode == SET_HOST && id -> hosts ) { string_stack_free ( id -> hosts ) ; id -> hosts = NULL ; } if ( name == NULL || namelen == 0 ) return 1 ; copy = strndup ( name, namelen ) ; if ( copy == NULL ) return 0 ; if ( id -> hosts == NULL && ( id -> hosts = sk_OPENSSL_STRING_new_null ( ) ) == NULL ) { free ( copy ) ; return 0 ; } if (! sk_OPENSSL_STRING_push ( id -> hosts, copy ) ) { free ( copy ) ; if ( sk_OPENSSL_STRING_num ( id -> hosts ) == 0 ) { sk_OPENSSL_STRING_free ( id -> hosts ) ; id -> hosts = NULL ; } return 0 ; } return 1 ; }

Fix:
<S2SV_ModStart> if ( name!= NULL && namelen == 0 ) namelen = strlen ( name ) ; if ( name
Buggy code:
 int cJSON_GetArraySize ( cJSON * array ) { cJSON * c = array -> child ; int i = 0 ; <START_BUG> while ( c ) { <END_BUG> ++ i ; c = c -> next ;  } <START_BUG> return i ; }<END_BUG>

Fix:
<S2SV_ModStart> ( c ) i ++, <S2SV_ModEnd> c = c <S2SV_ModStart> -> next ; <S2SV_ModEnd> return i ;
Buggy code:
 int frag6_print ( netdissect_options * ndo, register const u_char * bp, register const u_char * bp2 ) { register const struct ip6_frag * dp ; register const struct ip6_hdr * ip6 ; dp = ( const struct ip6_frag * ) bp ; ip6 = ( const struct ip6_hdr * ) bp2 ; <START_BUG> ND_TCHECK ( dp -> ip6f_offlg ) ; <END_BUG> if ( ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, "frag   (0x%08x:%d|%ld)", EXTRACT_32BITS ( & dp -> ip6f_ident ), EXTRACT_16BITS ( & dp -> ip6f_offlg ) & IP6F_OFF_MASK, sizeof ( struct ip6_hdr ) + EXTRACT_16BITS ( & ip6 -> ip6_plen ) - ( long ) ( bp - bp2 ) - sizeof ( struct ip6_frag ) ) ) ; } else { ND_PRINT ( ( ndo, "frag   (%d|%ld)", EXTRACT_16BITS ( & dp -> ip6f_offlg ) & IP6F_OFF_MASK, sizeof ( struct ip6_hdr ) + EXTRACT_16BITS ( & ip6 -> ip6_plen ) - ( long ) ( bp - bp2 ) - sizeof ( struct ip6_frag ) ) ) ; } if ( ( EXTRACT_16BITS ( & dp -> ip6f_offlg ) & IP6F_OFF_MASK )!= 0 ) return - 1 ; else { ND_PRINT ( ( ndo, "   " ) ) ; return sizeof ( struct ip6_frag ) ; } trunc : ND_PRINT ( ( ndo, "[|frag]" ) ) ; return - 1 ; }

Fix:
<S2SV_ModStart> ; ND_TCHECK ( * dp <S2SV_ModEnd> ) ; if
Buggy code:
 void vp9_print_modes_and_motion_vectors ( VP9_COMMON * cm, const char * file ) { int mi_row ; int mi_col ; <START_BUG> int mi_index = 0 ; <END_BUG> FILE * mvs = fopen ( file, "a" ) ;  MODE_INFO * * mi_8x8 = cm -> mi_grid_visible ; <START_BUG> int rows = cm -> mi_rows ; int cols = cm -> mi_cols ; print_mi_data ( cm, mvs, "Partitions:", offsetof ( MB_MODE_INFO, sb_type ) ) ; print_mi_data ( cm, mvs, "Modes:", offsetof ( MB_MODE_INFO, mode ) ) ; <END_BUG> print_mi_data ( cm, mvs, "Skips:", offsetof ( MB_MODE_INFO, skip ) ) ;  print_mi_data ( cm, mvs, "Ref   frame:", offsetof ( MB_MODE_INFO, ref_frame [ 0 ] ) ) ; print_mi_data ( cm, mvs, "Transform:", offsetof ( MB_MODE_INFO, tx_size ) ) ; print_mi_data ( cm, mvs, "UV   Modes:", offsetof ( MB_MODE_INFO, uv_mode ) ) ; log_frame_info ( cm, "Vectors   ", mvs ) ; for ( mi_row = 0 ; mi_row < rows ; mi_row ++ ) { <START_BUG> fprintf ( mvs, "V   " ) ; <END_BUG> for ( mi_col = 0 ; mi_col < cols ; mi_col ++ ) {  fprintf ( mvs, "%4d:%4d   ", mi_8x8 [ mi_index ] -> mbmi. mv [ 0 ]. as_mv. row, <START_BUG> mi_8x8 [ mi_index ] -> mbmi. mv [ 0 ]. as_mv. col ) ; mi_index ++ ; } fprintf ( mvs, "\\n" ) ; <END_BUG> mi_index += 8 ;  } fprintf ( mvs, "\\n" ) ; <START_BUG> fclose ( mvs ) ; <END_BUG> }

Fix:
<S2SV_ModStart> int mi_col ; <S2SV_ModEnd> FILE * mvs <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd> = cm -> <S2SV_ModStart>, mvs, "Ref <S2SV_blank> frame:", offsetof ( MB_MODE_INFO, ref_frame [ 0 ] ) ) ; print_mi_data ( cm, mvs, "Transform:", offsetof ( MB_MODE_INFO, tx_size ) ) ; print_mi_data ( cm, mvs, "UV <S2SV_blank> Modes:", offsetof ( MB_MODE_INFO, uv_mode ) ) ; log_frame_info ( cm, "Skips:" <S2SV_ModEnd>, mvs ) <S2SV_ModStart> ( mvs, "S <S2SV_blank> " <S2SV_ModEnd> ) ; for <S2SV_ModStart> ( mvs, "%2d <S2SV_blank> ", mi [ 0 <S2SV_ModEnd> ] -> mbmi <S2SV_ModStart> -> mbmi. skip ) ; mi <S2SV_ModEnd> ++ ; } <S2SV_ModStart> "\\n" ) ; mi <S2SV_ModEnd> += 8 ; <S2SV_ModStart> "\\n" ) ; log_frame_info ( cm, "Vectors <S2SV_blank> ", mvs ) ; mi = cm -> mi_grid_visible ; for ( mi_row = 0 ; mi_row < rows ; mi_row ++ ) { fprintf ( mvs, "V <S2SV_blank> " ) ;
Buggy code:
 static void setup_test_dir ( char * tmp_dir, const char * files,... ) { va_list ap ; assert_se ( mkdtemp ( tmp_dir )!= NULL ) ; va_start ( ap, files ) ; while ( files!= NULL ) { _cleanup_free_ char * path = strappend ( tmp_dir, files ) ; <START_BUG> assert_se ( touch_file ( path, true, USEC_INFINITY, UID_INVALID, GID_INVALID, 0 ) == 0 ) ; <END_BUG> files = va_arg ( ap, const char * ) ; } va_end ( ap ) ; }

Fix:
<S2SV_ModStart>, GID_INVALID, MODE_INVALID <S2SV_ModEnd> ) == 0
Buggy code:
 static int decode_studio_vop_header ( Mpeg4DecContext * ctx, GetBitContext * gb ) { MpegEncContext * s = & ctx -> m ; if ( get_bits_left ( gb ) <= 32 ) return 0 ; s -> partitioned_frame = 0 ; <START_BUG> s -> decode_mb = mpeg4_decode_studio_mb ; <END_BUG> decode_smpte_tc ( ctx, gb ) ; skip_bits ( gb, 10 ) ; skip_bits ( gb, 2 ) ; s -> pict_type = get_bits ( gb, 2 ) + AV_PICTURE_TYPE_I ; if ( get_bits1 ( gb ) ) { skip_bits1 ( gb ) ; skip_bits1 ( gb ) ; s -> progressive_frame = get_bits1 ( gb ) ^ 1 ; } if ( s -> pict_type == AV_PICTURE_TYPE_I ) { if ( get_bits1 ( gb ) ) reset_studio_dc_predictors ( s ) ; } if ( ctx -> shape!= BIN_ONLY_SHAPE ) { s -> alternate_scan = get_bits1 ( gb ) ; s -> frame_pred_frame_dct = get_bits1 ( gb ) ; s -> dct_precision = get_bits ( gb, 2 ) ; s -> intra_dc_precision = get_bits ( gb, 2 ) ; s -> q_scale_type = get_bits1 ( gb ) ; } if ( s -> alternate_scan ) { ff_init_scantable ( s -> idsp. idct_permutation, & s -> inter_scantable, ff_alternate_vertical_scan ) ; ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_scantable, ff_alternate_vertical_scan ) ; ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_h_scantable, ff_alternate_vertical_scan ) ; ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_v_scantable, ff_alternate_vertical_scan ) ; } else { ff_init_scantable ( s

Fix:
<S2SV_ModStart> ; s -> interlaced_dct = 0 ; s ->
Buggy code:
 int arch_dup_task_struct ( struct task_struct * dst, struct task_struct * src ) { flush_fp_to_thread ( src ) ; flush_altivec_to_thread ( src ) ; flush_vsx_to_thread ( src ) ; flush_spe_to_thread ( src ) ; <START_BUG> * dst = * src ; <END_BUG> clear_task_ebb ( dst ) ; return 0 ; }

Fix:
<S2SV_ModStart> src ) ; __switch_to_tm ( src ) ; tm_recheckpoint_new_task ( src ) ;
Buggy code:
 <START_BUG> static int ecryptfs_parse_options ( struct ecryptfs_sb_info * sbi, char * options ) <END_BUG> { char * p ; int rc = 0 ; int sig_set = 0 ; int cipher_name_set = 0 ; int fn_cipher_name_set = 0 ; int cipher_key_bytes ; int cipher_key_bytes_set = 0 ; int fn_cipher_key_bytes ; int fn_cipher_key_bytes_set = 0 ; struct ecryptfs_mount_crypt_stat * mount_crypt_stat = & sbi -> mount_crypt_stat ; substring_t args [ MAX_OPT_ARGS ] ; int token ; char * sig_src ; char * cipher_name_dst ; char * cipher_name_src ; char * fn_cipher_name_dst ; char * fn_cipher_name_src ; char * fnek_dst ; char * fnek_src ; char * cipher_key_bytes_src ; char * fn_cipher_key_bytes_src ;  if (! options ) { <START_BUG> rc = - EINVAL ; goto out ; } ecryptfs_init_mount_crypt_stat ( mount_crypt_stat ) ; while ( ( p = strsep ( & options, "," ) )!= NULL ) { if (! * p ) continue ; token = match_token ( p, tokens, args ) ; switch ( token ) { case ecryptfs_opt_sig : case ecryptfs_opt_ecryptfs_sig : sig_src = args [ 0 ]. from ; rc = ecryptfs_add_global_auth_tok ( mount_crypt_stat, sig_src, 0 ) ; if ( rc ) { printk ( KERN_ERR "Error   attempting   to   register   " "global   sig;   rc   =   [%d]\\n", rc ) ; goto out ; } sig_set = 1 ; break ; case ecryptfs_opt_cipher : case ecryptfs_opt_ecryptfs_cipher : cipher_name_src = args [ 0 ]. from ; cipher_name_dst = mount_crypt_stat -> global_default_cipher_name ; strncpy ( cipher_name_dst, cipher_name_src, ECRYPTFS_MAX_CIPHER_NAME_<END_BUG>

Fix:
<S2SV_ModStart> char * options, uid_t * check_ruid <S2SV_ModStart> * fn_cipher_key_bytes_src ; * check_ruid = 0 ; <S2SV_ModStart> break ; case ecryptfs_opt_check_dev_ruid : * check_ruid = 1 ; break ; case
Buggy code:
 static OPJ_BOOL opj_j2k_write_sod ( opj_j2k_t * p_j2k, opj_tcd_t * p_tile_coder, OPJ_BYTE * p_data, OPJ_UINT32 * p_data_written, OPJ_UINT32 p_total_data_size, const opj_stream_private_t * p_stream, opj_event_mgr_t * p_manager ) { opj_codestream_info_t * l_cstr_info = 00 ; OPJ_UINT32 l_remaining_data ; assert ( p_j2k!= 00 ) ; assert ( p_manager!= 00 ) ; assert ( p_stream!= 00 ) ; OPJ_UNUSED ( p_stream ) ; <START_BUG> opj_write_bytes ( p_data, J2K_MS_SOD, <END_BUG> 2 ) ; p_data += 2 ; l_remaining_data = p_total_data_size - 4 ; p_tile_coder -> tp_num = p_j2k -> m_specific_param. m_encoder. m_current_poc_tile_part_number ; p_tile_coder -> cur_tp_num = p_j2k -> m_specific_param. m_encoder. m_current_tile_part_number ; # ifdef USE_JPWL assert ( 0 && "TODO" ) ; # endif if ( p_j2k -> m_specific_param. m_encoder. m_current_tile_part_number == 0 ) { p_tile_coder -> tcd_image -> tiles -> packno = 0 ; if ( l_cstr_info ) { l_cstr_info -> packno = 0 ; } } * p_data_written = 0 ; if (! opj_tcd_encode_tile ( p_tile_coder, p_j2k -> m_current_tile_number, p_data, p_data_written, l_remaining_data, l_cstr_info, p_manager ) ) { opj_event_msg ( p_manager, EVT_ERROR, "Cannot   encode   tile\\n" ) ; return OPJ_FALSE ; } * p_data_written

Fix:
<S2SV_ModStart> p_stream ) ; if ( p_total_data_size < 4 ) { opj_event_msg ( p_manager, EVT_ERROR, "Not <S2SV_blank> enough <S2SV_blank> bytes <S2SV_blank> in <S2SV_blank> output <S2SV_blank> buffer <S2SV_blank> to <S2SV_blank> write <S2SV_blank> SOD <S2SV_blank> marker\\n" ) ; return OPJ_FALSE ; }
Buggy code:
 <START_BUG> static void fadst8 ( const int16_t * input, int16_t * output ) { <END_BUG>  int s0, s1, s2, s3, s4, s5, s6, s7 ; <START_BUG> int x0 = input [ 7 ] ; <END_BUG> int x1 = input [ 0 ] ;  <START_BUG> int x2 = input [ 5 ] ; <END_BUG>  int x3 = input [ 2 ] ; <START_BUG> <END_BUG> int x4 = input [ 3 ] ;  <START_BUG> int x5 = input [ 4 ] ; <END_BUG>  int x6 = input [ 1 ] ; <START_BUG> <END_BUG> int x7 = input [ 6 ] ;  s0 = cospi_2_64 * x0 + cospi_30_64 * x1 ; s1 = cospi_30_64 * x0 - cospi_2_64 * x1 ; s2 = cospi_10_64 * x2 + cospi_22_64 * x3 ; s3 = cospi_22_64 * x2 - cospi_10_64 * x3 ; s4 = cospi_18_64 * x4 + cospi_14_64 * x5 ; s5 = cospi_14_64 * x4 - cospi_18_64 * x5 ; s6 = cospi_26_64 * x6 + cospi_6_64 * x7 ; s7 = cospi_6_64 * x6 - cospi_26_64 * x7 ; x0 = fdct_round_shift ( s0 + s4 ) ; x1 = fdct_round_shift ( s1 + s5 ) ; x2 = fdct_round_shift ( s2 + s6 ) ; x3 = fdct_round_shift ( s3 + s7 ) ; x4 = fdct_round_shift ( s0 - s4 ) ; x5 = fdct_round_shift ( s1 - s5 ) ; x6 = fdct_round_shift ( s2 - s6 ) ; x7 = fdct_round_shift ( s3 - s7 ) ; s0 = x0 ; s1 = x1 ; s2 = x2 ; s3 = x3 ; s4 = cospi_8_64 * x4 + cospi_24_64 * x5 ; s

Fix:
<S2SV_ModStart> fadst8 ( const tran_low_t * input, tran_low_t <S2SV_ModEnd> * output ) <S2SV_ModStart> output ) { tran_high_t s0, s1, s2, s3, s4, s5, s6, s7 ; tran_high_t <S2SV_ModEnd> x0 = input <S2SV_ModStart> 7 ] ; tran_high_t <S2SV_ModEnd> x1 = input <S2SV_ModStart> 0 ] ; tran_high_t <S2SV_ModEnd> x2 = input <S2SV_ModStart> 5 ] ; tran_high_t <S2SV_ModEnd> x3 = input <S2SV_ModStart> 2 ] ; tran_high_t <S2SV_ModEnd> x4 = input <S2SV_ModStart> 3 ] ; tran_high_t <S2SV_ModEnd> x5 = input <S2SV_ModStart> 4 ] ; tran_high_t <S2SV_ModEnd> x6 = input <S2SV_ModStart> 1 ] ; tran_high_t <S2SV_ModEnd> x7 = input <S2SV_ModStart> 0 ] = ( tran_low_t ) <S2SV_ModStart> 1 ] = ( tran_low_t ) <S2SV_ModStart> 2 ] = ( tran_low_t ) <S2SV_ModStart> 3 ] = ( tran_low_t ) <S2SV_ModStart> 4 ] = ( tran_low_t ) <S2SV_ModStart> 5 ] = ( tran_low_t ) <S2SV_ModStart> 6 ] = ( tran_low_t ) <S2SV_ModStart> 7 ] = ( tran_low_t )
Buggy code:
 cJSON * cJSON_CreateString ( const char * string ) { cJSON * item = cJSON_New_Item ( ) ; if ( item ) { item -> type = cJSON_String ; item -> valuestring = cJSON_strdup ( string ) ; <START_BUG> } <END_BUG> return item ; }

Fix:
<S2SV_ModStart> string ) ; if (! item -> valuestring ) { cJSON_Delete ( item ) ; return 0 ; } } <S2SV_ModEnd> return item ;
Buggy code:
 static void <START_BUG> l2tp_msgtype_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint16_t * ptr = ( const uint16_t * ) dat ; <START_BUG> ND_PRINT ( ( ndo, "%s", tok2str ( l2tp_msgtype2str, "MSGTYPE-#%u", EXTRACT_16BITS ( ptr ) ) ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 static void adjust_branches ( struct bpf_prog * prog, int pos, int delta ) { struct bpf_insn * insn = prog -> insnsi ; int insn_cnt = prog -> len ; int i ; for ( i = 0 ; i < insn_cnt ; i ++, insn ++ ) { if ( BPF_CLASS ( insn -> code )!= BPF_JMP || BPF_OP ( insn -> code ) == BPF_CALL || BPF_OP ( insn -> code ) == BPF_EXIT ) continue ; if ( i < pos && i + insn -> off + 1 > pos ) insn -> off += delta ; <START_BUG> else if ( i > pos && i + insn -> off + 1 < pos ) <END_BUG> insn -> off -= delta ; } }

Fix:
<S2SV_ModStart> i > pos + delta <S2SV_ModStart> off + 1 <= pos + delta <S2SV_ModEnd> ) insn ->
Buggy code:
 LONG ValidateSignature ( HWND hDlg, const char * path ) { LONG r ; WINTRUST_DATA trust_data = { 0 } ; WINTRUST_FILE_INFO trust_file = { 0 } ; GUID guid_generic_verify = { 0xaac56b, 0xcd44, 0x11d0, { 0x8c, 0xc2, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee } } ; char * signature_name ; size_t i, len ; signature_name = GetSignatureName ( path ) ; if ( signature_name == NULL ) { uprintf ( "PKI:   Could   not   get   signature   name" ) ; MessageBoxExU ( hDlg, lmprintf ( MSG_284 ), lmprintf ( MSG_283 ), MB_OK | MB_ICONERROR | MB_IS_RTL, selected_langid ) ; return TRUST_E_NOSIGNATURE ; } for ( i = 0 ; i < ARRAYSIZE ( cert_name ) ; i ++ ) { len = strlen ( cert_name [ i ] ) ; if ( strncmp ( signature_name, cert_name [ i ], len ) == 0 ) { if ( ( len >= strlen ( signature_name ) ) || isspace ( signature_name [ len ] ) ) break ; } } if ( i >= ARRAYSIZE ( cert_name ) ) { uprintf ( "PKI:   Signature   \'%s\'   is   unexpected...", signature_name ) ; if ( MessageBoxExU ( hDlg, lmprintf ( MSG_285, signature_name ), lmprintf ( MSG_283 ), MB_YESNO | MB_ICONWARNING | MB_IS_RTL, selected_langid )!= IDYES ) return TRUST_E_EXPLICIT_DISTRUST ; } trust_file. cbStruct = sizeof ( trust_file ) ; trust_file. pcwszFilePath = utf8_to_wchar ( path ) ; if ( trust_file. pcwszFilePath == NULL ) { uprintf ( "PKI:   Unable   to   convert   \'%s\'   to   UTF16", path ) ; return ERROR_SEVERITY_ERROR

Fix:
<S2SV_ModStart>. dwUIChoice = WTD_UI_NONE <S2SV_ModEnd> ; trust_data. <S2SV_ModStart> pcwszFilePath ) ; switch ( r ) { case ERROR_SUCCESS : break ; case TRUST_E_NOSIGNATURE : uprintf ( "PKI: <S2SV_blank> File <S2SV_blank> does <S2SV_blank> not <S2SV_blank> appear <S2SV_blank> to <S2SV_blank> be <S2SV_blank> signed: <S2SV_blank> %s", WinPKIErrorString ( ) ) ; MessageBoxExU ( hDlg, lmprintf ( MSG_284 ), lmprintf ( MSG_283 ), MB_OK | MB_ICONERROR | MB_IS_RTL, selected_langid ) ; break ; default : uprintf ( "PKI: <S2SV_blank> Failed <S2SV_blank> to <S2SV_blank> validate <S2SV_blank> signature: <S2SV_blank> %s", WinPKIErrorString ( ) ) ; MessageBoxExU ( hDlg, lmprintf ( MSG_240 ), lmprintf ( MSG_283 ), MB_OK | MB_ICONERROR | MB_IS_RTL, selected_langid ) ; break ; }
Buggy code:
 <START_BUG> static int udp_push_pending_frames ( struct sock * sk ) <END_BUG> { struct udp_sock * up = udp_sk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct flowi4 * fl4 = & inet -> cork. fl. u. ip4 ; struct sk_buff * skb ; int err = 0 ; skb = ip_finish_skb ( sk, fl4 ) ; if (! skb ) goto out ; err = udp_send_skb ( skb, fl4 ) ; out : up -> len = 0 ; up -> pending = 0 ; return err ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> int udp_push_pending_frames (
Buggy code:
 static l_int32 findNextBorderPixel ( l_int32 w, l_int32 h, l_uint32 * data, l_int32 wpl, l_int32 px, l_int32 py, l_int32 * pqpos, l_int32 * pnpx, l_int32 * pnpy ) { l_int32 qpos, i, pos, npx, npy, val ; l_uint32 * line ; qpos = * pqpos ; for ( i = 1 ; i < 8 ; i ++ ) { pos = ( qpos + i ) % 8 ; npx = px + xpostab [ pos ] ; npy = py + ypostab [ pos ] ; <START_BUG> line = data + npy * wpl ; <END_BUG> val = GET_DATA_BIT ( line, npx ) ; if ( val ) { * pnpx = npx ; * pnpy = npy ; * pqpos = qpostab [ pos ] ; return 0 ; } } return 1 ; }

Fix:
<S2SV_ModStart> pos ] ; if ( npx < 0 || npx >= w || npy < 0 || npy >= h ) continue ;
Buggy code:
 static int f2fs_read_single_page ( struct inode * inode, struct page * page, unsigned nr_pages, struct f2fs_map_blocks * map, struct bio * * bio_ret, sector_t * last_block_in_bio, bool is_readahead ) { struct bio * bio = * bio_ret ; const unsigned blkbits = inode -> i_blkbits ; const unsigned blocksize = 1 << blkbits ; sector_t block_in_file ; sector_t last_block ; sector_t last_block_in_file ; sector_t block_nr ; int ret = 0 ; <START_BUG> block_in_file = ( sector_t ) page -> index ; <END_BUG> last_block = block_in_file + nr_pages ; last_block_in_file = ( i_size_read ( inode ) + blocksize - 1 ) >> blkbits ; if ( last_block > last_block_in_file ) last_block = last_block_in_file ; if ( block_in_file >= last_block ) goto zero_out ; if ( ( map -> m_flags & F2FS_MAP_MAPPED ) && block_in_file > map -> m_lblk && block_in_file < ( map -> m_lblk + map -> m_len ) ) goto got_it ; map -> m_lblk = block_in_file ; map -> m_len = last_block - block_in_file ; ret = f2fs_map_blocks ( inode, map, 0, F2FS_GET_BLOCK_DEFAULT ) ; if ( ret ) goto out ; got_it : if ( ( map -> m_flags & F2FS_MAP_MAPPED ) ) { block_nr = map -> m_pblk + block_in_file - map -> m_lblk ; SetPageMappedToDisk ( page ) ;  if (! PageUptodate ( page ) &&! cleancache_get_page ( page ) ) { <START_BUG> SetPageUptodate ( page ) ; goto confused ; } if (! f2fs_is_valid_blkaddr ( F2FS_I_SB ( inode ), block_nr, DATA_GENERIC_ENHANCE_READ ) ) { ret = - EFSCORRUP<END_BUG>

Fix:
<S2SV_ModStart> ( sector_t ) page_index ( page ) <S2SV_ModEnd> ; last_block = <S2SV_ModStart> page ) && (! PageSwapCache ( page ) && <S2SV_ModStart> cleancache_get_page ( page )
Buggy code:
 static int cmd_info ( void * data, const char * input ) { RCore * core = ( RCore * ) data ; bool newline = r_config_get_i ( core -> config, "scr.interactive" ) ; RBinObject * o = r_bin_cur_object ( core -> bin ) ; RCoreFile * cf = core -> file ; int i, va = core -> io -> va || core -> io -> debug ; int mode = 0 ; int is_array = 0 ; Sdb * db ; for ( i = 0 ; input [ i ] && input [ i ]!=' '; i ++ ) ; if ( i > 0 ) { switch ( input [ i - 1 ] ) { case '*' : mode = R_CORE_BIN_RADARE ; break ; case 'j' : mode = R_CORE_BIN_JSON ; break ; case 'q' : mode = R_CORE_BIN_SIMPLE ; break ; } } if ( mode == R_CORE_BIN_JSON ) { if ( strlen ( input + 1 ) > 1 ) { is_array = 1 ; } } if ( is_array ) { r_cons_printf ( "{" ) ; } if (! * input ) { cmd_info_bin ( core, va, mode ) ; } if (! strcmp ( input, "*" ) ) { input = "I*" ; } RBinObject * obj = r_bin_cur_object ( core -> bin ) ; while ( * input ) { switch ( * input ) { case 'b' : { ut64 baddr = r_config_get_i ( core -> config, "bin.baddr" ) ; if ( input [ 1 ] ==' ') { baddr = r_num_math ( core -> num, input + 1 ) ; } r_core_bin_reload ( core, NULL, baddr ) ; r_core_block_read ( core ) ; newline = false ; } break ; case 'k' : db = o? o -> kv : NULL ; switch ( input [ 1 ] ) { case 'v' : if ( db ) { char * o = sdb_querys ( db, NULL, 0, input + 3 ) ; if ( o && * o ) { r_cons_print ( o ) ; } free ( o ) ; } break ; case '*' :

Fix:
<S2SV_ModStart> case 'l' : { RBinObject * obj = r_bin_cur_object ( core -> bin ) ; <S2SV_ModStart> 0 ) ; } <S2SV_ModStart> case 'i' : { RBinObject * obj = r_bin_cur_object ( core -> bin ) ; <S2SV_ModStart> 0 ) ; }
Buggy code:
 static char * __filterShell ( const char * arg ) { r_return_val_if_fail ( arg, NULL ) ; char * a = malloc ( strlen ( arg ) + 1 ) ; if (! a ) { return NULL ; } char * b = a ; while ( * arg ) { <START_BUG> switch ( * arg ) { <END_BUG> case '@' : case '`' : case '|' : case ';' :  case '\\n' : <START_BUG> break ; default : <END_BUG> * b ++ = * arg ;  break ; } arg ++ ; } * b = 0 ; return a ; }

Fix:
<S2SV_ModStart> arg ) { char ch = * arg ; switch ( ch <S2SV_ModEnd> ) { case <S2SV_ModStart> ';' : case '=' : case <S2SV_ModStart> b ++ = ch <S2SV_ModEnd> ; break ;
Buggy code:
 void recovery_character ( const char * character ) { <START_BUG> if (! awaiting_character ) { <END_BUG> recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_UnexpectedMessage, "Not   in   Recovery   mode" ) ; layoutHome ( ) ; return ; } if ( strlen ( mnemonic ) + 1 > MNEMONIC_BUF - 1 ) { recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_UnexpectedMessage, "Too   many   characters   attempted   during   recovery" ) ; layoutHome ( ) ; return ; } char * pos = strchr ( cipher, character [ 0 ] ) ; if ( character [ 0 ]!=' '&& pos == NULL ) { recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_SyntaxError, "Character   must   be   from   a   to   z" ) ; layoutHome ( ) ; return ; } static int uncyphered_word_count = 0 ; static bool definitely_using_cipher = false ; static CONFIDENTIAL char coded_word [ 12 ] ; static CONFIDENTIAL char decoded_word [ 12 ] ; if (! mnemonic [ 0 ] ) { uncyphered_word_count = 0 ; definitely_using_cipher = false ; memzero ( coded_word, sizeof ( coded_word ) ) ; memzero ( decoded_word, sizeof ( decoded_word ) ) ; } char decoded_character [ 2 ] = "   " ; if ( character [ 0 ]!=' ') { decoded_character [ 0 ] = english_alphabet [ ( int ) ( pos - cipher ) ] ; strlcat ( coded_word, character, sizeof ( coded_word ) ) ; strlcat ( decoded_word, decoded_character, sizeof ( decoded_word ) ) ; if ( enforce_wordlist && 4 <= strlen ( coded_word ) ) { bool maybe_not_using_cipher = attempt_auto_complete ( coded_word ) ; bool maybe_using_cipher = attempt_auto_complete ( decoded_word ) ; if (! maybe_not_using_cipher && maybe_using_cipher ) { definitely_using_cipher = true ; } else if ( maybe_not_using_cipher &&! definitely_using_cipher && MAX_UNCYPHERED_WORDS <

Fix:
<S2SV_ModStart> (! awaiting_character ||! recovery_started
Buggy code:
 static void veth_setup ( struct net_device * dev ) { <START_BUG> ether_setup ( dev ) ; <END_BUG> dev -> netdev_ops = & veth_netdev_ops ; dev -> ethtool_ops = & veth_ethtool_ops ; dev -> features |= NETIF_F_LLTX ; dev -> destructor = veth_dev_free ; dev -> hw_features = NETIF_F_NO_CSUM | NETIF_F_SG | NETIF_F_RXCSUM ; }

Fix:
<S2SV_ModStart> ( dev ) ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING
Buggy code:
 static int packet_set_ring ( struct sock * sk, union tpacket_req_u * req_u, int closing, int tx_ring ) { struct pgv * pg_vec = NULL ; struct packet_sock * po = pkt_sk ( sk ) ; int was_running, order = 0 ; struct packet_ring_buffer * rb ; struct sk_buff_head * rb_queue ; __be16 num ; int err = - EINVAL ; <START_BUG> struct tpacket_req * req = & req_u -> req ; <END_BUG> if (! closing && tx_ring && ( po -> tp_version > TPACKET_V2 ) ) { net_warn_ratelimited ( "Tx-ring   is   not   supported.\\n" ) ; goto out ; } rb = tx_ring? & po -> tx_ring : & po -> rx_ring ; rb_queue = tx_ring? & sk -> sk_write_queue : & sk -> sk_receive_queue ; err = - EBUSY ; if (! closing ) { if ( atomic_read ( & po -> mapped ) ) goto out ; if ( packet_read_pending ( rb ) ) goto out ; } if ( req -> tp_block_nr ) { err = - EBUSY ; if ( unlikely ( rb -> pg_vec ) ) goto out ; switch ( po -> tp_version ) { case TPACKET_V1 : po -> tp_hdrlen = TPACKET_HDRLEN ; break ; case TPACKET_V2 : po -> tp_hdrlen = TPACKET2_HDRLEN ; break ; case TPACKET_V3 : po -> tp_hdrlen = TPACKET3_HDRLEN ; break ; } err = - EINVAL ; if ( unlikely ( ( int ) req -> tp_block_size <= 0 ) ) goto out ; if ( unlikely (! PAGE_ALIGNED ( req -> tp_block_size ) ) ) goto out ; if ( po -> tp_version >= TPACKET_V3 && ( int ) ( req -> tp_block_size - BLK_PLUS_PRIV ( req_u -> req3. tp_sizeof_priv ) ) <= 0 ) goto out ; if ( unlikely ( req -> tp_frame_size < po -> tp_

Fix:
<S2SV_ModStart> req_u -> req ; lock_sock ( sk ) <S2SV_ModStart> out ; } <S2SV_ModEnd> spin_lock ( & <S2SV_ModStart> ) ; } if ( pg_vec ) free_pg_vec ( pg_vec, order, req -> tp_block_nr ) ; out : <S2SV_ModStart> sk ) ; <S2SV_ModEnd> return err ;
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { AVFilterContext * ctx = inlink -> dst ; BoxBlurContext * s = ctx -> priv ; AVFilterLink * outlink = inlink -> dst -> outputs [ 0 ] ; AVFrame * out ; int plane ; int cw = FF_CEIL_RSHIFT ( inlink -> w, s -> hsub ), ch = FF_CEIL_RSHIFT ( in -> height, s -> vsub ) ; int w [ 4 ] = { inlink -> w, cw, cw, inlink -> w } ; int h [ 4 ] = { in -> height, ch, ch, in -> height } ; out = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; <START_BUG> for ( plane = 0 ; in -> data [ plane ] && plane < 4 ; plane ++ ) <END_BUG> hblur ( out -> data [ plane ], out -> linesize [ plane ], in -> data [ plane ], in -> linesize [ plane ], w [ plane ], h [ plane ], s -> radius [ plane ], s -> power [ plane ], s -> temp ) ;  for ( plane = 0 ; in -> data [ plane ] && plane < 4 ; plane ++ ) <START_BUG> vblur ( out -> data [ plane ], out -> linesize [ plane ], out -> data [ plane ], out -> linesize [ plane ], w [ plane ], h [ plane ], s -> radius [ plane ], s -> power [ plane ], s -> temp ) ; av_frame_free ( & in ) ; return ff_filter_frame ( outlink, out ) ; }<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> plane < 4 <S2SV_ModStart> plane < 4 && in -> data [ plane ] && in -> linesize [ plane ] <S2SV_ModStart> = 0 ; <S2SV_ModEnd> plane < 4 <S2SV_ModStart> plane < 4 && in -> data [ plane ] && in -> linesize [ plane ]
Buggy code:
 void ih264d_rest_of_residual_cav_chroma_dc_block ( UWORD32 u4_total_coeff_trail_one, dec_bit_stream_t * ps_bitstrm ) { UWORD32 u4_total_zeroes ; WORD16 i ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 u4_bitstream_offset = ps_bitstrm -> u4_ofst ; UWORD32 u4_trailing_ones = u4_total_coeff_trail_one & 0xFFFF ; UWORD32 u4_total_coeff = u4_total_coeff_trail_one >> 16 ; <START_BUG> WORD16 i2_level_arr [ 4 ] ; <END_BUG> tu_sblk4x4_coeff_data_t * ps_tu_4x4 ; WORD16 * pi2_coeff_data ; dec_struct_t * ps_dec = ( dec_struct_t * ) ps_bitstrm -> pv_codec_handle ; ps_tu_4x4 = ( tu_sblk4x4_coeff_data_t * ) ps_dec -> pv_parse_tu_coeff_data ; ps_tu_4x4 -> u2_sig_coeff_map = 0 ; pi2_coeff_data = & ps_tu_4x4 -> ai2_level [ 0 ] ; i = u4_total_coeff - 1 ; if ( u4_trailing_ones ) { UWORD32 u4_signs, u4_cnt = u4_trailing_ones ; WORD16 ( * ppi2_trlone_lkup ) [ 3 ] = ( WORD16 ( * ) [ 3 ] ) gai2_ih264d_trailing_one_level ; WORD16 * pi2_trlone_lkup ; GETBITS ( u4_signs, u4_bitstream_offset, pu4_bitstrm_buf, u4_cnt ) ; pi2_trlone_lkup = ppi2_trlone_lkup [ ( 1 << u4_cnt ) - 2 + u4_signs ] ; while ( u4_cnt -- ) i2_level

Fix:
<S2SV_ModStart> 16 ; WORD16 ai2_level_arr [ 7 ] ; WORD16 * i2_level_arr = & ai2_level_arr [ 3 <S2SV_ModEnd> ] ; tu_sblk4x4_coeff_data_t
Buggy code:
 static int php_var_unserialize_internal ( UNSERIALIZE_PARAMETER ) { const unsigned char * cursor, * limit, * marker, * start ; zval * rval_ref ; limit = max ; cursor = * p ; if ( YYCURSOR >= YYLIMIT ) { return 0 ; } if ( var_hash && ( * p ) [ 0 ]!= 'R' ) { var_push ( var_hash, rval ) ; } start = cursor ; # line 554 "ext//standard//var_unserializer.c" { YYCTYPE yych ; static const unsigned char yybm [ ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128, 128, 128, 128, 128, 128, 128, 128, 128, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,

Fix:
<S2SV_ModStart> if ( yych <= '//' ) goto yy18 ; if ( yych >= ';' <S2SV_ModEnd> ) goto yy18 <S2SV_ModStart> } # line 805 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy25 : <S2SV_ModStart> } # line 837 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy32 : <S2SV_ModStart> } # line 882 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy39 : <S2SV_ModStart> } # line 937 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy46 : <S2SV_ModStart> } # line 990 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy53 : <S2SV_ModStart> } # line 1087 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy65 : <S2SV_ModStart> } # line 1162 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy76 : <S2SV_ModStart> } # line 1215 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy83 : <S2SV_ModStart> } # line 1229 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy87 : <S2SV_ModStart> } # line 1238 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy89 : <S2SV_ModStart> } # line 1286 <S2SV_ModEnd> "ext//standard