nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static int fsmVerify ( const char * path, rpmfi fi ) <END_BUG> { int rc ; int saveerrno = errno ; struct stat dsb ; mode_t mode = rpmfiFMode ( fi ) ; rc = fsmStat ( path, 1, & dsb ) ; if ( rc ) return rc ; if ( S_ISREG ( mode ) ) { char * rmpath = rstrscat ( NULL, path, "-RPMDELETE", NULL ) ; rc = fsmRename ( path, rmpath ) ; if (! rc ) ( void ) fsmUnlink ( rmpath ) ; else rc = RPMERR_UNLINK_FAILED ; free ( rmpath ) ; return ( rc? rc : RPMERR_ENOENT ) ; } else if ( S_ISDIR ( mode ) ) { if ( S_ISDIR ( dsb. st_mode ) ) return 0 ; if ( S_ISLNK ( dsb. st_mode ) ) {  rc = fsmStat ( path, 0, & dsb ) ; <START_BUG> if ( rc == RPMERR_ENOENT ) rc = 0 ; if ( rc ) return rc ; errno = saveerrno ; <END_BUG> if ( S_ISDIR ( dsb. st_mode ) ) return 0 ;  } } else if ( S_ISLNK ( mode ) ) { if ( S_ISLNK ( dsb. st_mode ) ) { char buf [ 8 * BUFSIZ ] ; size_t len ; rc = fsmReadLink ( path, buf, 8 * BUFSIZ, & len ) ; errno = saveerrno ; if ( rc ) return rc ; if ( rstreq ( rpmfiFLink ( fi ), buf ) ) return 0 ; } } else if ( S_ISFIFO ( mode ) ) { if ( S_ISFIFO ( dsb. st_mode ) ) return 0 ; } else if ( S_ISCHR ( mode ) || S_ISBLK ( mode ) ) { if ( ( S_ISCHR ( dsb. st_mode ) || S_ISBLK ( dsb. st_mode ) ) && ( dsb. st_rdev == rpmfiFRdev ( fi ) ) ) return 0 ; } else if ( S_ISSOCK ( mode ) ) { if ( S_ISSOCK (

Fix:
<S2SV_ModStart>, rpmfi fi, const struct stat * fsb <S2SV_ModStart> ) ) { uid_t luid = dsb. st_uid ; <S2SV_ModStart>. st_mode ) && ( luid == 0 || luid == fsb -> st_uid ) ) <S2SV_ModEnd> return 0 ;
Buggy code:
 static int telnet_parse ( netdissect_options * ndo, const u_char * sp, u_int length, int print ) { int i, x ; u_int c ; const u_char * osp, * p ; # define FETCH ( c, sp, length ) do { if ( length < 1 ) goto pktend ; ND_TCHECK ( * sp ) ; c = * sp ++ ; length -- ; } while ( 0 ) osp = sp ; FETCH ( c, sp, length ) ; if ( c!= IAC ) goto pktend ; FETCH ( c, sp, length ) ; if ( c == IAC ) { if ( print ) ND_PRINT ( ( ndo, "IAC   IAC" ) ) ; goto done ; } i = c - TELCMD_FIRST ; if ( i < 0 || i > IAC - TELCMD_FIRST ) goto pktend ; switch ( c ) { case DONT : case DO : case WONT : case WILL : case SB : FETCH ( x, sp, length ) ; if ( x >= 0 && x < NTELOPTS ) { if ( print ) ND_PRINT ( ( ndo, "%s   %s", telcmds [ i ], telopts [ x ] ) ) ; } else { if ( print ) ND_PRINT ( ( ndo, "%s   %#x", telcmds [ i ], x ) ) ; } if ( c!= SB ) break ; p = sp ; while ( length > ( u_int ) ( p + 1 - sp ) ) { ND_TCHECK2 ( * p, 2 ) ; if ( p [ 0 ] == IAC && p [ 1 ] == SE ) break ; p ++ ; } <START_BUG> if ( * p!= IAC ) <END_BUG> goto pktend ; switch ( x ) { case TELOPT_AUTHENTICATION : if ( p <= sp ) break ; FETCH ( c, sp, length ) ; if ( print ) ND_PRINT ( ( ndo, "   %s", STR_OR_ID ( c, authcmd ) ) ) ; if ( p <= sp ) break ; FETCH ( c, sp, length ) ; if ( print ) ND_PRINT ( ( ndo, "   %s", STR_OR_ID ( c, authtype ) )

Fix:
<S2SV_ModStart> ++ ; } ND_TCHECK ( * p ) ;
Buggy code:
 static void ssdp_recv ( int sd ) { ssize_t len ; struct sockaddr sa ; socklen_t salen ; <START_BUG> char buf [ MAX_PKT_SIZE ] ; <END_BUG> memset ( buf, 0, sizeof ( buf ) ) ;  len = recvfrom ( sd, buf, sizeof ( buf ), MSG_DONTWAIT, & sa, & salen ) ; <START_BUG> if ( len > 0 ) { <END_BUG> buf [ len ] = 0 ;  if ( sa. sa_family!= AF_INET ) return ; if ( strstr ( buf, "M-SEARCH   *" ) ) { size_t i ; char * ptr, * type ; struct ifsock * ifs ; struct sockaddr_in * sin = ( struct sockaddr_in * ) & sa ; ifs = find_outbound ( & sa ) ; if (! ifs ) { logit ( LOG_DEBUG, "No   matching   socket   for   client   %s", inet_ntoa ( sin -> sin_addr ) ) ; return ; } logit ( LOG_DEBUG, "Matching   socket   for   client   %s", inet_ntoa ( sin -> sin_addr ) ) ; type = strcasestr ( buf, "\\r\\nST:" ) ; if (! type ) { logit ( LOG_DEBUG, "No   Search   Type   (ST:)   found   in   M-SEARCH   *,   assuming   " SSDP_ST_ALL ) ; type = SSDP_ST_ALL ; send_message ( ifs, type, & sa ) ; return ; } type = strchr ( type, ':' ) ; if (! type ) return ; type ++ ; while ( isspace ( * type ) ) type ++ ; ptr = strstr ( type, "\\r\\n" ) ; if (! ptr ) return ; * ptr = 0 ; for ( i = 0 ; supported_types [ i ] ; i ++ ) { if (! strcmp ( supported_types [ i ], type ) ) { logit ( LOG_DEBUG, "M-SEARCH   *   ST:   %s   from   %s   port   %d", type, inet_ntoa ( sin -> sin_addr ), ntohs ( sin -> sin_port ) ) ; send_message ( ifs, type, & sa

Fix:
<S2SV_ModStart> buf [ MAX_PKT_SIZE + 1 <S2SV_ModStart> ( buf ) - 1 <S2SV_ModStart> 0 ) { <S2SV_ModEnd> if ( sa
Buggy code:
 tsize_t t2p_readwrite_pdf_image_tile ( T2P * t2p, TIFF * input, TIFF * output, ttile_t tile ) { uint16 edge = 0 ; tsize_t written = 0 ; unsigned char * buffer = NULL ; tsize_t bufferoffset = 0 ; unsigned char * samplebuffer = NULL ; tsize_t samplebufferoffset = 0 ; tsize_t read = 0 ; uint16 i = 0 ; ttile_t tilecount = 0 ; ttile_t septilecount = 0 ; tsize_t septilesize = 0 ; # ifdef JPEG_SUPPORT unsigned char * jpt ; float * xfloatp ; uint32 xuint32 = 0 ; # endif if ( t2p -> t2p_error!= T2P_ERR_OK ) return ( 0 ) ; edge |= t2p_tile_is_right_edge ( t2p -> tiff_tiles [ t2p -> pdf_page ], tile ) ; edge |= t2p_tile_is_bottom_edge ( t2p -> tiff_tiles [ t2p -> pdf_page ], tile ) ; if ( ( t2p -> pdf_transcode == T2P_TRANSCODE_RAW ) && ( ( edge == 0 ) # if defined ( JPEG_SUPPORT ) || defined ( OJPEG_SUPPORT ) || ( t2p -> pdf_compression == T2P_COMPRESS_JPEG ) # endif ) ) { # ifdef CCITT_SUPPORT if ( t2p -> pdf_compression == T2P_COMPRESS_G4 ) { buffer = ( unsigned char * ) _TIFFmalloc ( t2p -> tiff_datasize ) ; if ( buffer == NULL ) { TIFFError ( TIFF2PDF_MODULE, "Can\'t   allocate   %lu   bytes   of   memory   " "for   t2p_readwrite_pdf_image_tile,   %s", ( unsigned long ) t2p -> tiff_datasize, TIFFFileName ( input ) ) ; t2p -> t2p_error = T2P_ERR_ERROR ; return ( 0 ) ; } TIFFReadRawTile ( input, tile, ( tdata_t ) buffer, t2p -> tiff_datasize

Fix:
<S2SV_ModStart> if ( count > <S2SV_ModEnd> 4 ) {
Buggy code:
 static int privsep_preauth ( Authctxt * authctxt ) { int status, r ; pid_t pid ; struct ssh_sandbox * box = NULL ; pmonitor = monitor_init ( ) ; pmonitor -> m_pkex = & active_state -> kex ; if ( use_privsep == PRIVSEP_ON ) box = ssh_sandbox_init ( ) ; pid = fork ( ) ; if ( pid == - 1 ) { fatal ( "fork   of   unprivileged   child   failed" ) ; } else if ( pid!= 0 ) { debug2 ( "Network   child   is   on   pid   %ld", ( long ) pid ) ; pmonitor -> m_pid = pid ; if ( have_agent ) { r = ssh_get_authentication_socket ( & auth_sock ) ; if ( r!= 0 ) { error ( "Could   not   get   agent   socket:   %s", ssh_err ( r ) ) ; have_agent = 0 ; } } if ( box!= NULL ) ssh_sandbox_parent_preauth ( box, pid ) ; monitor_child_preauth ( authctxt, pmonitor ) ; <START_BUG> monitor_sync ( pmonitor ) ; <END_BUG> while ( waitpid ( pid, & status, 0 ) < 0 ) { if ( errno == EINTR ) continue ; pmonitor -> m_pid = - 1 ; fatal ( "%s:   waitpid:   %s", __func__, strerror ( errno ) ) ; } privsep_is_preauth = 0 ; pmonitor -> m_pid = - 1 ; if ( WIFEXITED ( status ) ) { if ( WEXITSTATUS ( status )!= 0 ) fatal ( "%s:   preauth   child   exited   with   status   %d", __func__, WEXITSTATUS ( status ) ) ; } else if ( WIFSIGNALED ( status ) ) fatal ( "%s:   preauth   child   terminated   by   signal   %d", __func__, WTERMSIG ( status ) ) ; if ( box!= NULL ) ssh_sandbox_parent_finish ( box ) ; return 1 ; } else { close ( pmonitor -> m_sendfd ) ; close ( pmonitor -> m_log_recvfd ) ; set_log_handler ( mm_log_handler,

Fix:
<S2SV_ModStart> pmonitor ) ; <S2SV_ModEnd> while ( waitpid
Buggy code:
 int vp8_diamond_search_sadx4 ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int_mv * best_mv, int search_param, int sad_per_bit, int * num00, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { int i, j, step ; unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; int what_stride = b -> src_stride ; unsigned char * in_what ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; unsigned char * best_address ; int tot_steps ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int best_site = 0 ; int last_site = 0 ; int ref_row ; int ref_col ; int this_row_offset ; int this_col_offset ; search_site * ss ; unsigned char * check_here ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; vp8_clamp_mv ( ref_mv, x -> mv_col_min, x -> mv_col_max, x -> mv_row_min, x -> mv_row_max ) ; ref_row = ref_mv -> as_mv. row ; ref_col = ref_mv -> as_mv. col ; * num00 = 0 ; best_mv -> as_mv. row = ref_row ; best_mv -> as_mv. col = ref_col ; in_what = ( unsigned char * ) ( base_pre + d -> offset + ( ref_row * pre_stride

Fix:
<S2SV_ModStart> in_what, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; if
Buggy code:
 chrand_ret * chrand_principal_2_svc ( chrand_arg * arg, struct svc_req * rqstp ) { static chrand_ret ret ; krb5_keyblock * k ; int nkeys ; char * prime_arg, * funcname ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_chrand_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; funcname = "kadm5_randkey_principal" ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) ) { ret. code = randkey_principal_wrapper_3 ( ( void * ) handle, arg -> princ, FALSE, 0, NULL, & k, & nkeys ) ; } else if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_CHANGEPW, arg -> princ, NULL ) ) { ret. code = kadm5_randkey_principal ( ( void * ) handle, arg -> princ, & k, & nkeys ) ; } else { log_unauth ( funcname, prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_CHANGEPW ; } if ( ret. code == KADM5_OK ) { ret

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 u32 h264bsdInit ( storage_t * pStorage, u32 noOutputReordering ) { u32 size ; ASSERT ( pStorage ) ; h264bsdInitStorage ( pStorage ) ; size = ( sizeof ( macroblockLayer_t ) + 63 ) & ~ 0x3F ; <START_BUG> pStorage -> mbLayer = ( macroblockLayer_t * ) H264SwDecMalloc ( size ) ; <END_BUG> if (! pStorage -> mbLayer ) return HANTRO_NOK ; if ( noOutputReordering ) pStorage -> noReordering = HANTRO_TRUE ; return HANTRO_OK ; }

Fix:
<S2SV_ModStart> H264SwDecMalloc ( size, 1
Buggy code:
 void enc28j60SelectBank ( NetInterface * interface, uint16_t address ) { uint16_t bank ; Enc28j60Context * context ; context = ( Enc28j60Context * ) interface -> nicContext ; bank = address & REG_BANK_MASK ; if ( bank!= context -> currentBank ) { <START_BUG> switch ( bank ) <END_BUG> { case BANK_0 :  enc28j60ClearBit ( interface, ENC28J60_REG_ECON1, ECON1_BSEL1 | ECON1_BSEL0 ) ; <START_BUG> break ; case BANK_1 : <END_BUG> enc28j60SetBit ( interface, ENC28J60_REG_ECON1, ECON1_BSEL0 ) ;  <START_BUG> enc28j60ClearBit ( interface, ENC28J60_REG_ECON1, ECON1_BSEL1 ) ; <END_BUG> break ; case BANK_2 :  enc28j60ClearBit ( interface, ENC28J60_REG_ECON1, ECON1_BSEL0 ) ; <START_BUG> <END_BUG> enc28j60SetBit ( interface, ENC28J60_REG_ECON1, ECON1_BSEL1 ) ;  break ; case BANK_3 : <START_BUG> enc28j60SetBit ( interface, ENC28J60_REG_ECON1, ECON1_BSEL1 | ECON1_BSEL0 ) ; <END_BUG> break ; default : break ; } context -> currentBank = bank ; } }

Fix:
<S2SV_ModStart> currentBank ) { if ( bank == BANK_0 ) { <S2SV_ModEnd> enc28j60ClearBit ( interface <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_BSEL1 | ENC28J60_ECON1_BSEL0 ) ; } else if ( bank == BANK_1 ) { <S2SV_ModEnd> enc28j60SetBit ( interface <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_BSEL0 <S2SV_ModEnd> ) ; enc28j60ClearBit <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_BSEL1 ) ; } else if ( bank == BANK_2 ) { <S2SV_ModEnd> enc28j60ClearBit ( interface <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_BSEL0 <S2SV_ModEnd> ) ; enc28j60SetBit <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_BSEL1 ) ; } else { <S2SV_ModEnd> enc28j60Set
Buggy code:
 error_t enc624j600SoftReset ( NetInterface * interface ) { do { <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_EUDAST, 0x1234 ) ; <END_BUG>  } while ( enc624j600ReadReg ( interface, ENC624J600_REG_EUDAST )!= 0x1234 ) ; <START_BUG> <END_BUG> while ( ( enc624j600ReadReg ( interface, ENC624J600_REG_ESTAT ) & ESTAT_CLKRDY ) == 0 )  { } <START_BUG> enc624j600SetBit ( interface, ENC624J600_REG_ECON2, ECON2_ETHRST ) ; <END_BUG> sleep ( 1 ) ;  if ( enc624j600ReadReg ( interface, ENC624J600_REG_EUDAST )!= 0x0000 ) <START_BUG> { return ERROR_FAILURE ; } sleep ( 1 ) ; return NO_ERROR ; }<END_BUG>

Fix:
<S2SV_ModStart> ( interface, ENC624J600_EUDAST <S2SV_ModEnd>, 0x1234 ) <S2SV_ModStart> ( interface, ENC624J600_EUDAST <S2SV_ModEnd> )!= 0x1234 <S2SV_ModStart> ( interface, ENC624J600_ESTAT ) & ENC624J600_ESTAT_CLKRDY <S2SV_ModEnd> ) == 0 <S2SV_ModStart> ( interface, ENC624J600_ECON2, ENC624J600_ECON2_ETHRST <S2SV_ModEnd> ) ; sleep <S2SV_ModStart> ( interface, ENC624J600_EUDAST <S2SV_ModEnd> )!= 0x0000
Buggy code:
 <START_BUG> static void save_context ( VP9_COMP * cpi, int mi_row, int mi_col, <END_BUG> ENTROPY_CONTEXT a [ 16 * MAX_MB_PLANE ], ENTROPY_CONTEXT l [ 16 * MAX_MB_PLANE ], PARTITION_CONTEXT sa [ 8 ], PARTITION_CONTEXT sl [ 8 ], BLOCK_SIZE bsize ) {  const MACROBLOCK * const x = & cpi -> mb ; <START_BUG> const MACROBLOCKD * const xd = & x -> e_mbd ; int p ; const int num_4x4_blocks_wide = num_4x4_blocks_wide_lookup [ bsize ] ; const int num_4x4_blocks_high = num_4x4_blocks_high_lookup [ bsize ] ; int mi_width = num_8x8_blocks_wide_lookup [ bsize ] ; int mi_height = num_8x8_blocks_high_lookup [ bsize ] ; for ( p = 0 ; p < MAX_MB_PLANE ; ++ p ) { <END_BUG> vpx_memcpy (  a + num_4x4_blocks_wide * p, xd -> above_context [ p ] + ( mi_col * 2 >> xd -> plane [ p ]. subsampling_x ), ( sizeof ( ENTROPY_CONTEXT ) * num_4x4_blocks_wide ) >> xd -> plane [ p ]. subsampling_x ) ; <START_BUG> vpx_memcpy ( <END_BUG> l + num_4x4_blocks_high * p, xd -> left_context [ p ] + ( ( mi_row & MI_MASK ) * 2 >> xd -> plane [ p ]. subsampling_y ), ( sizeof ( ENTROPY_CONTEXT ) * num_4x4_blocks_high ) >> xd -> plane [ p ]. subsampling_y ) ; }  vpx_memcpy ( sa, xd -> above_seg_context + mi_col, <START_BUG> sizeof ( * xd -> above_seg_context ) * mi_width ) ; <END_BUG> vpx_memcpy ( sl, xd -> left_seg_context + ( mi_row & MI_MASK ),  sizeof ( xd -> left_seg_context [ 0 ] ) *

Fix:
<S2SV_ModStart> void save_context ( MACROBLOCK * const x <S2SV_ModEnd>, int mi_row <S2SV_ModStart> ) { const <S2SV_ModEnd> MACROBLOCKD * const <S2SV_ModStart> p ) { memcpy <S2SV_ModEnd> ( a + <S2SV_ModStart> subsampling_x ) ; memcpy <S2SV_ModEnd> ( l + <S2SV_ModStart> ) ; } memcpy <S2SV_ModEnd> ( sa, <S2SV_ModStart> mi_width ) ; memcpy <S2SV_ModEnd> ( sl,
Buggy code:
 <START_BUG> int rose_parse_facilities ( unsigned char * p, <END_BUG> struct rose_facilities_struct * facilities ) { int facilities_len, len ; facilities_len = * p ++ ;  if ( facilities_len == 0 ) <START_BUG> return 0 ; <END_BUG> while ( facilities_len > 0 ) {  if ( * p == 0x00 ) { facilities_len -- ; p ++ ; switch ( * p ) { case FAC_NATIONAL : len = rose_parse_national ( p + 1, facilities, facilities_len - 1 ) ; <START_BUG> if ( len < 0 ) <END_BUG> return 0 ; facilities_len -= len + 1 ; p += len + 1 ; break ; case FAC_CCITT : len = rose_parse_ccitt ( p + 1, facilities, facilities_len - 1 ) ;  if ( len < 0 ) <START_BUG> return 0 ; facilities_len -= len + 1 ; p += len + 1 ; <END_BUG> break ;  default : printk ( KERN_DEBUG "ROSE:   rose_parse_facilities   -   unknown   facilities   family   %02X\\n", * p ) ; facilities_len -- ; p ++ ; break ; } } else break ; } return 1 ; }

Fix:
<S2SV_ModStart> char * p, unsigned packet_len <S2SV_ModStart> facilities_len == 0 || ( unsigned ) facilities_len > packet_len <S2SV_ModStart> while ( facilities_len >= 3 && <S2SV_ModEnd> * p == <S2SV_ModStart> 1 ) ; <S2SV_ModEnd> break ; case <S2SV_ModStart> 1 ) ; break ; default : printk ( KERN_DEBUG "ROSE: <S2SV_blank> rose_parse_facilities <S2SV_blank> - <S2SV_blank> unknown <S2SV_blank> facilities <S2SV_blank> family <S2SV_blank> %02X\\n", * p ) ; len = 1 ; break ; } <S2SV_ModStart> len < 0 ) return 0 ; if ( WARN_ON ( len >= facilities_len ) <S2SV_ModStart> + 1 ; } return facilities_len == 0 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 uint32 TIFFNumberOfStrips ( TIFF * tif ) { TIFFDirectory * td = & tif -> tif_dir ; <START_BUG> uint32 nstrips ; <END_BUG> if ( td -> td_nstrips ) return td -> td_nstrips ; nstrips = ( td -> td_rowsperstrip == ( uint32 ) - 1? 1 : TIFFhowmany_32 ( td -> td_imagelength, td -> td_rowsperstrip ) ) ; if ( td -> td_planarconfig == PLANARCONFIG_SEPARATE ) nstrips = _TIFFMultiply32 ( tif, nstrips, ( uint32 ) td -> td_samplesperpixel, "TIFFNumberOfStrips" ) ; return ( nstrips ) ; }

Fix:
<S2SV_ModStart> ; uint32 nstrips <S2SV_ModEnd> ; nstrips =
Buggy code:
 void test_base64_decode ( void ) { char buffer [ 16 ] ; <START_BUG> int len = mutt_b64_decode ( buffer, encoded ) ; <END_BUG> if (! TEST_CHECK ( len == sizeof ( clear ) - 1 ) ) { TEST_MSG ( "Expected:   %zu", sizeof ( clear ) - 1 ) ; TEST_MSG ( "Actual     :   %zu", len ) ; } buffer [ len ] = '\\0' ; if (! TEST_CHECK ( strcmp ( buffer, clear ) == 0 ) ) { TEST_MSG ( "Expected:   %s", clear ) ; TEST_MSG ( "Actual     :   %s", buffer ) ; } }

Fix:
<S2SV_ModStart> buffer, encoded, sizeof ( buffer )
Buggy code:
 <START_BUG> static void nsc_rle_decode ( BYTE * in, BYTE * out, UINT32 originalSize ) <END_BUG> { UINT32 len ; UINT32 left ; BYTE value ; left = originalSize ; while ( left > 4 ) { value = * in ++ ; if ( left == 5 ) {  * out ++ = value ; <START_BUG> left -- ; } else if ( value == * in ) { in ++ ; if ( * in < 0xFF ) { len = ( UINT32 ) * in ++ ; len += 2 ; } else { in ++ ; len = * ( ( UINT32 * ) in ) ; in += 4 ; } <END_BUG> FillMemory ( out, len, value ) ;  out += len ; left -= len ; } else { <START_BUG> * out ++ = value ; <END_BUG> left -- ; } } * ( ( UINT32 * ) out ) = * ( ( UINT32 * ) in ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> nsc_rle_decode ( BYTE <S2SV_ModStart> BYTE * out, UINT32 outSize <S2SV_ModStart> 5 ) { if ( outSize < 1 ) return FALSE ; outSize -- ; <S2SV_ModStart> 4 ; } if ( outSize < len ) return FALSE ; outSize -= len ; <S2SV_ModStart> } else { if ( outSize < 1 ) return FALSE ; outSize -- ; * out ++ = value ; left -- ; } } if ( ( outSize < 4 ) || ( left < 4 ) ) return FALSE ; memcpy ( out, in, 4 ) ; return TRUE <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8_get_last_ref_frame ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctrl_id, va_list args ) { int * ref_info = va_arg ( args, int * ) ; if ( ref_info &&! ctx -> yv12_frame_buffers. use_frame_threads ) { VP8D_COMP * pbi = ( VP8D_COMP * ) ctx -> yv12_frame_buffers. pbi [ 0 ] ; VP8_COMMON * oci = & pbi -> common ; * ref_info = ( vp8dx_references_buffer ( oci, ALTREF_FRAME )? VP8_ALTR_FRAME : 0 ) | ( vp8dx_references_buffer ( oci, GOLDEN_FRAME )? VP8_GOLD_FRAME : 0 ) | ( vp8dx_references_buffer ( oci, LAST_FRAME )? VP8_LAST_FRAME : 0 ) ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static void n_tty_set_termios ( struct tty_struct * tty, struct ktermios * old ) { struct n_tty_data * ldata = tty -> disc_data ; <START_BUG> if (! old || ( old -> c_lflag ^ tty -> termios. c_lflag ) & ICANON ) { <END_BUG> bitmap_zero ( ldata -> read_flags, N_TTY_BUF_SIZE ) ; ldata -> line_start = ldata -> read_tail ; if (! L_ICANON ( tty ) ||! read_cnt ( ldata ) ) { ldata -> canon_head = ldata -> read_tail ; ldata -> push = 0 ; } else { set_bit ( ( ldata -> read_head - 1 ) & ( N_TTY_BUF_SIZE - 1 ), ldata -> read_flags ) ; ldata -> canon_head = ldata -> read_head ; ldata -> push = 1 ; } ldata -> commit_head = ldata -> read_head ; ldata -> erasing = 0 ; ldata -> lnext = 0 ; } ldata -> icanon = ( L_ICANON ( tty )!= 0 ) ; if ( I_ISTRIP ( tty ) || I_IUCLC ( tty ) || I_IGNCR ( tty ) || I_ICRNL ( tty ) || I_INLCR ( tty ) || L_ICANON ( tty ) || I_IXON ( tty ) || L_ISIG ( tty ) || L_ECHO ( tty ) || I_PARMRK ( tty ) ) { bitmap_zero ( ldata -> char_map, 256 ) ; if ( I_IGNCR ( tty ) || I_ICRNL ( tty ) ) set_bit ( '\\r', ldata -> char_map ) ; if ( I_INLCR ( tty ) ) set_bit ( '\\n', ldata -> char_map ) ; if ( L_ICANON ( tty ) ) { set_bit ( ERASE_CHAR ( tty ), ldata -> char_map ) ; set_bit ( KILL_CHAR ( tty ), ldata -> char_map ) ; set_bit ( EOF_CHAR ( tty ), ldata -> char_map ) ; set_bit

Fix:
<S2SV_ModStart> c_lflag ) & ( ICANON | EXTPROC ) <S2SV_ModEnd> ) { bitmap_zero
Buggy code:
 char * parse_tags ( ASS_Renderer * render_priv, char * p, char * end, double pwr ) { for ( char * q ; p < end ; p = q ) { while ( * p!= '\\\\' && p!= end ) ++ p ; if ( * p!= '\\\\' ) break ; ++ p ; if ( p!= end ) skip_spaces ( & p ) ; q = p ; while ( * q!= '(' && * q!= '\\\\' && q!= end ) ++ q ; if ( q == p ) continue ; char * name_end = q ; struct arg args [ MAX_VALID_NARGS + 1 ] ; int nargs = 0 ; for ( int i = 0 ; i <= MAX_VALID_NARGS ; ++ i ) args [ i ]. start = args [ i ]. end = "" ; if ( * q == '(' ) { ++ q ; while ( 1 ) { if ( q!= end ) skip_spaces ( & q ) ; char * r = q ; while ( * r!= ',' && * r!= '\\\\' && * r!= ')' && r!= end ) ++ r ; if ( * r == ',' ) { push_arg ( args, & nargs, q, r ) ; q = r + 1 ; } else { while ( * r!= ')' && r!= end ) ++ r ; push_arg ( args, & nargs, q, r ) ; q = r ; if ( q!= end ) ++ q ; break ; } } } # define tag ( name ) ( mystrcmp ( & p, ( name ) ) && ( push_arg ( args, & nargs, p, name_end ), 1 ) ) # define complex_tag ( name ) mystrcmp ( & p, ( name ) ) if ( tag ( "xbord" ) ) { double val ; if ( nargs ) { val = argtod ( * args ) ; val = render_priv -> state. border_x * ( 1 - pwr ) + val * pwr ; val = ( val < 0 )? 0 : val ; } else val = render_priv -> state. style -> Outline ; render_priv -> state. border_x = val ; } else if ( tag ( "ybord" ) ) { double val ; if ( nargs ) { val = argtod ( * args ) ; val = render_priv -> state. border_y

Fix:
<S2SV_ModStart>. start ; if ( args [ cnt ]. end < end ) { <S2SV_ModStart> k ) ; } else { assert ( q == end ) ; pwr = k ; q = p ; }
Buggy code:
 key_ref_t lookup_user_key ( key_serial_t id, unsigned long lflags, key_perm_t perm ) { struct keyring_search_context ctx = {. match_data. cmp = lookup_user_key_possessed,. match_data. lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,. flags = KEYRING_SEARCH_NO_STATE_CHECK, } ; struct request_key_auth * rka ; struct key * key ; key_ref_t key_ref, skey_ref ; int ret ; try_again : ctx. cred = get_current_cred ( ) ; key_ref = ERR_PTR ( - ENOKEY ) ; switch ( id ) { case KEY_SPEC_THREAD_KEYRING : if (! ctx. cred -> thread_keyring ) { if (! ( lflags & KEY_LOOKUP_CREATE ) ) goto error ; ret = install_thread_keyring ( ) ; if ( ret < 0 ) { key_ref = ERR_PTR ( ret ) ; goto error ; } goto reget_creds ; } key = ctx. cred -> thread_keyring ; __key_get ( key ) ; key_ref = make_key_ref ( key, 1 ) ; break ; case KEY_SPEC_PROCESS_KEYRING : if (! ctx. cred -> process_keyring ) { if (! ( lflags & KEY_LOOKUP_CREATE ) ) goto error ; ret = install_process_keyring ( ) ; if ( ret < 0 ) { key_ref = ERR_PTR ( ret ) ; goto error ; } goto reget_creds ; } key = ctx. cred -> process_keyring ; __key_get ( key ) ; key_ref = make_key_ref ( key, 1 ) ; break ; case KEY_SPEC_SESSION_KEYRING : if (! ctx. cred -> session_keyring ) { ret = install_user_keyrings ( ) ; if ( ret < 0 ) goto error ; if ( lflags & KEY_LOOKUP_CREATE ) ret = join_session_keyring ( NULL ) ; else ret = install_session_keyring ( ctx. cred -> user -> session_keyring ) ; if ( ret < 0 ) goto error ; goto reget_creds ;

Fix:
<S2SV_ModStart> KEY_LOOKUP_PARTIAL ) && key_read_state ( key ) == KEY_IS_UNINSTANTIATED <S2SV_ModEnd> ) goto invalid_key
Buggy code:
 static char * construct_command_line ( struct manager_ctx * manager, struct server * server ) { static char cmd [ BUF_SIZE ] ; <START_BUG> char * method = manager -> method ; <END_BUG> int i ;  build_config ( working_dir, server ) ; <START_BUG> if ( server -> method ) method = server -> method ; memset ( cmd, 0, BUF_SIZE ) ; snprintf ( cmd, BUF_SIZE, <END_BUG> "%s   -m   %s   --manager-address   %s   -f   %s//.shadowsocks_%s.pid   -c   %s//.shadowsocks_%s.conf",  <START_BUG> executable, method, manager -> manager_address, <END_BUG>  working_dir, server -> port, working_dir, server -> port ) ; <START_BUG> if ( manager -> acl!= NULL ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   --acl   %s", manager -> acl ) ; } if ( manager -> timeout!= NULL ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   -t   %s", manager -> timeout ) ; } # ifdef HAVE_SETRLIMIT if ( manager -> nofile ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   -n   %d", manager -> nofile ) ; } # endif if ( manager -> user!= NULL ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   -a   %s", manager -> user ) ; } if ( manager -> verbose ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   -v" ) ; } if ( server -> mode == NULL && manager -> mode == UDP_ONLY ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   -U" ) ; } if ( server -> mode == NULL && manager -> mode == TCP_AND_UDP ) { int len = strlen ( cmd ) ; snprintf ( cmd + len, BUF_SIZE - len, "   -u" ) ; } if ( server -> fast_<END_BUG>

Fix:
<S2SV_ModStart> BUF_SIZE ] ; int i ; int port ; port = atoi ( server -> port ) <S2SV_ModEnd> ; build_config ( <S2SV_ModStart> ( working_dir, manager, server ) <S2SV_ModEnd> ; memset ( <S2SV_ModStart>, BUF_SIZE, "%s <S2SV_blank> --manager-address <S2SV_blank> %s <S2SV_blank> -f <S2SV_blank> %s//.shadowsocks_%d.pid <S2SV_blank> -c <S2SV_blank> %s//.shadowsocks_%d.conf" <S2SV_ModEnd>, executable, <S2SV_ModStart>, executable, <S2SV_ModEnd> manager -> manager_address <S2SV_ModStart>, working_dir, <S2SV_ModEnd> port, working_dir <S2SV_ModStart>, working_dir, <S2SV_ModEnd> port ) ;
Buggy code:
 <START_BUG> int udf_get_filename ( struct super_block * sb, uint8_t * sname, uint8_t * dname, <END_BUG>  int flen ) <START_BUG> { struct ustr * filename, * unifilename ; int len = 0 ; filename = kmalloc ( sizeof ( struct ustr ), GFP_NOFS ) ; if (! filename ) return 0 ; unifilename = kmalloc ( sizeof ( struct ustr ), GFP_NOFS ) ; if (! unifilename ) goto out1 ; <END_BUG> if ( udf_build_ustr_exact ( unifilename, sname, flen ) )  goto out2 ; if ( UDF_QUERY_FLAG ( sb, UDF_FLAG_UTF8 ) ) { if (! udf_CS0toUTF8 ( filename, unifilename ) ) { udf_debug ( "Failed   in   udf_get_filename:   sname   =   %s\\n", sname ) ; goto out2 ; } } else if ( UDF_QUERY_FLAG ( sb, UDF_FLAG_NLS_MAP ) ) { if (! udf_CS0toNLS ( UDF_SB ( sb ) -> s_nls_map, filename, unifilename ) ) { udf_debug ( "Failed   in   udf_get_filename:   sname   =   %s\\n", sname ) ; goto out2 ; } } else goto out2 ; <START_BUG> len = udf_translate_to_linux ( dname, filename -> u_name, filename -> u_len, <END_BUG> unifilename -> u_name, unifilename -> u_len ) ; out2 : kfree ( unifilename ) ; out1 : kfree ( filename ) ; return len ; }

Fix:
<S2SV_ModStart> * sname, int slen, <S2SV_ModStart> * dname, int dlen <S2SV_ModEnd> ) { struct <S2SV_ModStart>, sname, slen <S2SV_ModEnd> ) ) goto <S2SV_ModStart> ( dname, dlen,
Buggy code:
 static int mark_source_chains ( const struct xt_table_info * newinfo, unsigned int valid_hooks, void * entry0 ) { unsigned int hook ; for ( hook = 0 ; hook < NF_INET_NUMHOOKS ; hook ++ ) { unsigned int pos = newinfo -> hook_entry [ hook ] ; struct ipt_entry * e = ( struct ipt_entry * ) ( entry0 + pos ) ; if (! ( valid_hooks & ( 1 << hook ) ) ) continue ; e -> counters. pcnt = pos ; for ( ; ; ) { const struct xt_standard_target * t = ( void * ) ipt_get_target_c ( e ) ; int visited = e -> comefrom & ( 1 << hook ) ; if ( e -> comefrom & ( 1 << NF_INET_NUMHOOKS ) ) { pr_err ( "iptables:   loop   hook   %u   pos   %u   %08X.\\n", hook, pos, e -> comefrom ) ; return 0 ; } e -> comefrom |= ( ( 1 << hook ) | ( 1 << NF_INET_NUMHOOKS ) ) ; <START_BUG> if ( ( e -> target_offset == sizeof ( struct ipt_entry ) && <END_BUG> ( strcmp ( t -> target. u. user. name, XT_STANDARD_TARGET ) == 0 ) &&  t -> verdict < 0 && unconditional ( & e -> ip ) ) || <START_BUG> visited ) { unsigned int oldpos, size ; if ( ( strcmp ( t -> target. u. user. name, XT_STANDARD_TARGET ) == 0 ) && t -> verdict < - NF_MAX_VERDICT - 1 ) { duprintf ( "mark_source_chains:   bad   " "negative   verdict   (%i)\\n", t -> verdict ) ; return 0 ; } do { e -> comefrom ^= ( 1 << NF_INET_NUMHOOKS ) ; # ifdef DEBUG_IP_FIREWALL_USER if ( e -> comefrom & ( 1 << NF_INET_NUMHOOKS ) ) { duprintf ( "Back   unset   " "on   hook   %u   " "rule   %u\\n", hook, pos ) ; } # endif oldpos = pos<END_BUG>

Fix:
<S2SV_ModStart> if ( ( unconditional ( e <S2SV_ModEnd> ) && ( <S2SV_ModStart> verdict < 0 <S2SV_ModEnd> ) || visited
Buggy code:
 int propagate_mnt ( struct mount * dest_mnt, struct dentry * dest_dentry, struct mount * source_mnt, struct list_head * tree_list ) { <START_BUG> struct mount * m, * child ; <END_BUG> int ret = 0 ; struct mount * prev_dest_mnt = dest_mnt ; struct mount * prev_src_mnt = source_mnt ; LIST_HEAD ( tmp_list ) ; LIST_HEAD ( umount_list ) ; for ( m = propagation_next ( dest_mnt, dest_mnt ) ; m ; m = propagation_next ( m, dest_mnt ) ) { int type ; struct mount * source ; if ( IS_MNT_NEW ( m ) ) continue ;  source = get_source ( m, prev_dest_mnt, prev_src_mnt, & type ) ; <START_BUG> child = copy_tree ( source, source -> mnt. mnt_root, type ) ; if ( IS_ERR ( child ) ) { ret = PTR_ERR ( child ) ; list_splice ( tree_list, tmp_list. prev ) ; goto out ; } if ( is_subdir ( dest_dentry, m -> mnt. mnt_root ) ) { mnt_set_mountpoint ( m, dest_dentry, child ) ; list_add_tail ( & child -> mnt_hash, tree_list ) ; } else { list_add_tail ( & child -> mnt_hash, & tmp_list ) ; } prev_dest_mnt = m ; prev_src_mnt = child ; } out : br_write_lock ( & vfsmount_lock ) ; while (! list_empty ( & tmp_list ) ) { child = list_first_entry ( & tmp_list, struct mount, mnt_hash ) ; umount_tree ( child, 0, & umount_list ) ; } br_write_unlock ( & vfsmount_lock ) ; release_mounts ( & umount_list ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { struct user_namespace * user_ns = current -> nsproxy -> mnt_ns -> user_ns ; struct <S2SV_ModStart> & type ) ; if ( m -> mnt_ns -> user_ns!= user_ns ) type |= CL_UNPRIVILEGED
Buggy code:
 static ssize_t aio_setup_vectored_rw ( int type, struct kiocb * kiocb, bool compat ) { ssize_t ret ; # ifdef CONFIG_COMPAT if ( compat ) ret = compat_rw_copy_check_uvector ( type, ( struct compat_iovec __user * ) kiocb -> ki_buf, kiocb -> ki_nbytes, 1, & kiocb -> ki_inline_vec, & kiocb -> ki_iovec, 1 ) ; else # endif ret = rw_copy_check_uvector ( type, ( struct iovec __user * ) kiocb -> ki_buf, kiocb -> ki_nbytes, 1, & kiocb -> ki_inline_vec, & kiocb -> ki_iovec, 1 ) ; if ( ret < 0 ) goto out ; <START_BUG> kiocb -> ki_nr_segs = kiocb -> ki_nbytes ; <END_BUG> kiocb -> ki_cur_seg = 0 ; kiocb -> ki_nbytes = ret ; kiocb -> ki_left = ret ; ret = 0 ; out : return ret ; }

Fix:
<S2SV_ModStart> goto out ; ret = rw_verify_area ( type, kiocb -> ki_filp, & kiocb -> ki_pos, ret ) ; if ( ret < 0 ) goto out ;
Buggy code:
 int tcp_read_sock ( struct sock * sk, read_descriptor_t * desc, sk_read_actor_t recv_actor ) { struct sk_buff * skb ; struct tcp_sock * tp = tcp_sk ( sk ) ; u32 seq = tp -> copied_seq ; u32 offset ; int copied = 0 ; if ( sk -> sk_state == TCP_LISTEN ) return - ENOTCONN ; while ( ( skb = tcp_recv_skb ( sk, seq, & offset ) )!= NULL ) { if ( offset < skb -> len ) { int used ; size_t len ; len = skb -> len - offset ; if ( tp -> urg_data ) { u32 urg_offset = tp -> urg_seq - seq ; if ( urg_offset < len ) len = urg_offset ; if (! len ) break ; } used = recv_actor ( desc, skb, offset, len ) ; if ( used < 0 ) { if (! copied ) copied = used ; break ; } else if ( used <= len ) { seq += used ; copied += used ; offset += used ; } skb = tcp_recv_skb ( sk, seq - 1, & offset ) ; if (! skb || ( offset + 1!= skb -> len ) ) break ; } if ( tcp_hdr ( skb ) -> fin ) { sk_eat_skb ( sk, skb, 0 ) ; ++ seq ; break ; } sk_eat_skb ( sk, skb, 0 ) ; if (! desc -> count ) break ; <START_BUG> } <END_BUG> tp -> copied_seq = seq ;  tcp_rcv_space_adjust ( sk ) ; <START_BUG> if ( copied > 0 ) tcp_cleanup_rbuf ( sk, copied ) ; return copied ; }<END_BUG>

Fix:
<S2SV_ModStart> ) break ; <S2SV_ModEnd> tp -> copied_seq <S2SV_ModStart> = seq ; } tp -> copied_seq = seq ;
Buggy code:
 static void update_golden_frame_stats ( VP8_COMP * cpi ) { VP8_COMMON * cm = & cpi -> common ; if ( cm -> refresh_golden_frame ) { if (! cpi -> auto_gold ) cpi -> frames_till_gf_update_due = DEFAULT_GF_INTERVAL ; if ( ( cpi -> pass!= 2 ) && ( cpi -> frames_till_gf_update_due > 0 ) ) { cpi -> current_gf_interval = cpi -> frames_till_gf_update_due ; if ( ( cm -> frame_type!= KEY_FRAME ) &&! cpi -> source_alt_ref_active ) { cpi -> gf_overspend_bits += ( cpi -> projected_frame_size - cpi -> inter_frame_target ) ; } cpi -> non_gf_bitrate_adjustment = cpi -> gf_overspend_bits // cpi -> frames_till_gf_update_due ; } <START_BUG> vpx_memset ( cpi -> gf_active_flags, 1, ( cm -> mb_rows * cm -> mb_cols ) ) ; <END_BUG> cpi -> gf_active_count = cm -> mb_rows * cm -> mb_cols ; cm -> refresh_golden_frame = 0 ; cpi -> frames_since_golden = 0 ; cpi -> recent_ref_frame_usage [ INTRA_FRAME ] = 1 ; cpi -> recent_ref_frame_usage [ LAST_FRAME ] = 1 ; cpi -> recent_ref_frame_usage [ GOLDEN_FRAME ] = 1 ; cpi -> recent_ref_frame_usage [ ALTREF_FRAME ] = 1 ; if ( cpi -> oxcf. fixed_q >= 0 && cpi -> oxcf. play_alternate &&! cpi -> common. refresh_alt_ref_frame ) { cpi -> source_alt_ref_pending = 1 ; cpi -> frames_till_gf_update_due = cpi -> baseline_gf_interval ; } if (! cpi -> source_alt_ref_pending ) cpi -> source_alt_ref_active = 0 ; if ( cpi ->

Fix:
<S2SV_ModStart> frames_till_gf_update_due ; } memset <S2SV_ModEnd> ( cpi ->
Buggy code:
 static void process_tree ( struct rev_info * revs, struct tree * tree, show_object_fn show, struct strbuf * base, const char * name, void * cb_data ) { struct object * obj = & tree -> object ; struct tree_desc desc ; struct name_entry entry ; enum interesting match = revs -> diffopt. pathspec. nr == 0? all_entries_interesting : entry_not_interesting ; int baselen = base -> len ; if (! revs -> tree_objects ) return ; if (! obj ) die ( "bad   tree   object" ) ; if ( obj -> flags & ( UNINTERESTING | SEEN ) ) return ; if ( parse_tree_gently ( tree, revs -> ignore_missing_links ) < 0 ) { if ( revs -> ignore_missing_links ) return ; die ( "bad   tree   object   %s", oid_to_hex ( & obj -> oid ) ) ; } obj -> flags |= SEEN ; <START_BUG> show ( obj, base, name, cb_data ) ; <END_BUG> strbuf_addstr ( base, name ) ; if ( base -> len ) strbuf_addch ( base, '//' ) ; init_tree_desc ( & desc, tree -> buffer, tree -> size ) ; while ( tree_entry ( & desc, & entry ) ) { if ( match!= all_entries_interesting ) { match = tree_entry_interesting ( & entry, base, 0, & revs -> diffopt. pathspec ) ; if ( match == all_entries_not_interesting ) break ; if ( match == entry_not_interesting ) continue ; } if ( S_ISDIR ( entry. mode ) ) process_tree ( revs, lookup_tree ( entry. sha1 ), show, base, entry. path, cb_data ) ; else if ( S_ISGITLINK ( entry. mode ) ) process_gitlink ( revs, entry. sha1, show, base, entry. path, cb_data ) ; else process_blob ( revs, lookup_blob ( entry. sha1 ), show, base, entry. path, cb_data ) ; } strbuf_setlen ( base, baselen ) ; free_tree_buffer ( tree ) ; }

Fix:
<S2SV_ModStart> |= SEEN ; strbuf_addstr ( base, name ) ; <S2SV_ModStart> obj, base -> buf, cb_data <S2SV_ModEnd> ) ; if
Buggy code:
 struct r_bin_dyldcache_lib_t * r_bin_dyldcache_extract ( struct r_bin_dyldcache_obj_t * bin, int idx, int * nlib ) { ut64 liboff, linkedit_offset ; ut64 dyld_vmbase ; ut32 addend = 0 ; struct r_bin_dyldcache_lib_t * ret = NULL ; struct dyld_cache_image_info * image_infos = NULL ; struct mach_header * mh ; ut8 * data, * cmdptr ; int cmd, libsz = 0 ; RBuffer * dbuf ; char * libname ; if (! bin ) { return NULL ; } if ( bin -> size < 1 ) { eprintf ( "Empty   file?   (%s)\\n", bin -> file? bin -> file : "(null)" ) ; return NULL ; } if ( bin -> nlibs < 0 || idx < 0 || idx >= bin -> nlibs ) { return NULL ; } * nlib = bin -> nlibs ; ret = R_NEW0 ( struct r_bin_dyldcache_lib_t ) ; if (! ret ) { <START_BUG> perror ( "malloc   (ret)" ) ; <END_BUG> return NULL ; } if ( bin -> hdr. startaddr > bin -> size ) { eprintf ( "corrupted   dyldcache" ) ; free ( ret ) ; return NULL ; } if ( bin -> hdr. startaddr > bin -> size || bin -> hdr. baseaddroff > bin -> size ) { eprintf ( "corrupted   dyldcache" ) ; free ( ret ) ; return NULL ; }  image_infos = ( struct dyld_cache_image_info * ) ( bin -> b -> buf + bin -> hdr. startaddr ) ; <START_BUG> <END_BUG> dyld_vmbase = * ( ut64 * ) ( bin -> b -> buf + bin -> hdr. baseaddroff ) ;  liboff = image_infos [ idx ]. address - dyld_vmbase ; if ( liboff > bin -> size ) { eprintf ( "Corrupted   file\\n" ) ; free ( ret ) ; return NULL ; } ret -> offset = liboff ; <START_BUG> if ( image_infos [ idx ]. pathFileOffset > bin -> size ) { <END_BUG>  eprintf (

Fix:
<S2SV_ModStart> ret ) { <S2SV_ModEnd> return NULL ; <S2SV_ModStart> NULL ; } int sz = bin -> nlibs * sizeof ( struct dyld_cache_image_info ) ; image_infos = malloc ( sz ) ; if (! image_infos ) { free ( ret ) ; return NULL ; } r_buf_read_at <S2SV_ModEnd> ( bin -> <S2SV_ModStart> bin -> b, <S2SV_ModEnd> bin -> hdr <S2SV_ModStart> hdr. startaddr, ( ut8 * ) image_infos, sz <S2SV_ModStart> ; dyld_vmbase = r_buf_read64le <S2SV_ModEnd> ( bin -> <S2SV_ModStart> bin -> b, <S2SV_ModEnd> bin -> hdr <S2SV_ModStart> = liboff ; int pfo = <S2SV_ModEnd> image_infos [ idx <S2SV_ModStart> ]. pathFileOffset ; if ( pfo < 0 || pfo <S2SV_ModStart> { eprintf ( "corrupted <S2SV_blank> file: <S2SV_blank> pathFileOffset <S2SV_blank> > <S2SV_blank> bin->size <S2SV_blank> (%d)\\n", pfo <S2SV_ModEnd> ) ; free <S2SV_ModStart> } libname = r_buf_read_string <S2SV_ModEnd> ( bin -> <S2SV_ModStart> bin -> b, pfo, 64 <S2SV_ModEnd> ) ; data
Buggy code:
 static int futex_requeue ( u32 __user * uaddr1, unsigned int flags, u32 __user * uaddr2, int nr_wake, int nr_requeue, u32 * cmpval, int requeue_pi ) { union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT ; int drop_count = 0, task_count = 0, ret ; struct futex_pi_state * pi_state = NULL ; struct futex_hash_bucket * hb1, * hb2 ; struct futex_q * this, * next ; if ( requeue_pi ) { <START_BUG> if ( refill_pi_state_cache ( ) ) <END_BUG> return - ENOMEM ; if ( nr_wake!= 1 ) return - EINVAL ; } retry : if ( pi_state!= NULL ) { free_pi_state ( pi_state ) ; pi_state = NULL ; } ret = get_futex_key ( uaddr1, flags & FLAGS_SHARED, & key1, VERIFY_READ ) ; if ( unlikely ( ret!= 0 ) ) goto out ; ret = get_futex_key ( uaddr2, flags & FLAGS_SHARED, & key2, requeue_pi? VERIFY_WRITE : VERIFY_READ ) ; if ( unlikely ( ret!= 0 ) )  goto out_put_key1 ; <START_BUG> hb1 = hash_futex ( & key1 ) ; hb2 = hash_futex ( & key2 ) ; retry_private : hb_waiters_inc ( hb2 ) ; double_lock_hb ( hb1, hb2 ) ; if ( likely ( cmpval!= NULL ) ) { u32 curval ; ret = get_futex_value_locked ( & curval, uaddr1 ) ; if ( unlikely ( ret ) ) { double_unlock_hb ( hb1, hb2 ) ; hb_waiters_dec ( hb2 ) ; ret = get_user ( curval, uaddr1 ) ; if ( ret ) goto out_put_keys ; if (! ( flags & FLAGS_SHARED ) ) goto retry_private ; put_futex_key ( & key2 ) ; put_futex_key (<END_BUG>

Fix:
<S2SV_ModStart> { if ( uaddr1 == uaddr2 ) return - EINVAL ; if ( <S2SV_ModStart> goto out_put_key1 ; if ( requeue_pi && match_futex ( & key1, & key2 ) ) { ret = - EINVAL ; goto out_put_keys ; }
Buggy code:
 static int load_script ( struct linux_binprm * bprm ) { const char * i_arg, * i_name ; char * cp ; struct file * file ; char interp [ BINPRM_BUF_SIZE ] ; int retval ; if ( ( bprm -> buf [ 0 ]!= '#' ) || ( bprm -> buf [ 1 ]!= '!' ) ) return - ENOEXEC ; allow_write_access ( bprm -> file ) ; fput ( bprm -> file ) ; bprm -> file = NULL ; bprm -> buf [ BINPRM_BUF_SIZE - 1 ] = '\\0' ; if ( ( cp = strchr ( bprm -> buf, '\\n' ) ) == NULL ) cp = bprm -> buf + BINPRM_BUF_SIZE - 1 ; * cp = '\\0' ; while ( cp > bprm -> buf ) { cp -- ; if ( ( * cp ==' ') || ( * cp == '\\t' ) ) * cp = '\\0' ; else break ; } for ( cp = bprm -> buf + 2 ; ( * cp ==' ') || ( * cp == '\\t' ) ; cp ++ ) ; if ( * cp == '\\0' ) return - ENOEXEC ; i_name = cp ; i_arg = NULL ; for ( ; * cp && ( * cp!=' ') && ( * cp!= '\\t' ) ; cp ++ ) ; while ( ( * cp ==' ') || ( * cp == '\\t' ) ) * cp ++ = '\\0' ; if ( * cp ) i_arg = cp ; strcpy ( interp, i_name ) ; retval = remove_arg_zero ( bprm ) ; if ( retval ) return retval ; retval = copy_strings_kernel ( 1, & bprm -> interp, bprm ) ; if ( retval < 0 ) return retval ; bprm -> argc ++ ; if ( i_arg ) { retval = copy_strings_kernel ( 1, & i_arg, bprm ) ; if ( retval < 0 ) return retval ; bprm -> argc ++ ; } retval = copy_strings_kernel ( 1, & i_name, bprm ) ; if ( retval ) return retval ; bprm

Fix:
<S2SV_ModStart> argc ++ ; retval = bprm_change_interp ( interp, <S2SV_ModEnd> bprm ) ; <S2SV_ModStart> return retval ; file = open_exec ( interp ) ; if ( IS_ERR ( file ) ) return PTR_ERR ( file ) ; bprm -> file = file ; retval = prepare_binprm ( bprm ) ; if ( retval < 0 ) return retval ;
Buggy code:
 <START_BUG> static u32 __ipv6_select_ident ( struct net * net, u32 hashrnd, <END_BUG> const struct in6_addr * dst, const struct in6_addr * src ) {  u32 hash, id ; <START_BUG> <END_BUG> hash = __ipv6_addr_jhash ( dst, hashrnd ) ;  <START_BUG> hash = __ipv6_addr_jhash ( src, hash ) ; <END_BUG> hash ^= net_hash_mix ( net ) ; id = ip_idents_reserve ( hash, 1 ) ; if ( unlikely (! id ) ) id = 1 << 31 ; return id ; }

Fix:
<S2SV_ModStart> net * net <S2SV_ModEnd>, const struct <S2SV_ModStart> src ) { const struct { struct in6_addr dst ; struct in6_addr src ; } __aligned ( SIPHASH_ALIGNMENT ) combined = {. dst = * dst,. src = * src, } ; <S2SV_ModStart>, id ; if ( unlikely ( siphash_key_is_zero ( & net -> ipv4. ip_id_key ) ) ) get_random_bytes ( & net -> ipv4. ip_id_key, sizeof ( net -> ipv4. ip_id_key ) <S2SV_ModEnd> ) ; hash <S2SV_ModStart> ; hash = siphash ( & combined, sizeof ( combined ), & net -> ipv4. ip_id_key <S2SV_ModEnd> ) ; id
Buggy code:
 static ssize_t <START_BUG> pipe_write ( struct kiocb * iocb, const struct iovec * _iov, <END_BUG> unsigned long nr_segs, loff_t ppos ) { struct file * filp = iocb -> ki_filp ; struct pipe_inode_info * pipe = filp -> private_data ;  ssize_t ret ; <START_BUG> <END_BUG> int do_wakeup ;  struct iovec * iov = ( struct iovec * ) _iov ; <START_BUG> size_t total_len ; <END_BUG> ssize_t chars ;  total_len = iov_length ( iov, nr_segs ) ; <START_BUG> if ( unlikely ( total_len == 0 ) ) <END_BUG> return 0 ;  do_wakeup = 0 ; ret = 0 ; __pipe_lock ( pipe ) ; if (! pipe -> readers ) { send_sig ( SIGPIPE, current, 0 ) ; ret = - EPIPE ; goto out ; } chars = total_len & ( PAGE_SIZE - 1 ) ; if ( pipe -> nrbufs && chars!= 0 ) { int lastbuf = ( pipe -> curbuf + pipe -> nrbufs - 1 ) & ( pipe -> buffers - 1 ) ; struct pipe_buffer * buf = pipe -> bufs + lastbuf ; const struct pipe_buf_operations * ops = buf -> ops ; int offset = buf -> offset + buf -> len ; if ( ops -> can_merge && offset + chars <= PAGE_SIZE ) { <START_BUG> int error, atomic = 1 ; <END_BUG> void * addr ; error = ops -> confirm ( pipe, buf ) ; if ( error ) goto out ;  iov_fault_in_pages_read ( iov, chars ) ; <START_BUG> redo1 : if ( atomic ) addr = kmap_atomic ( buf -> page ) ; else addr = kmap ( buf -> page ) ; error = pipe_iov_copy_from_user ( offset + addr, iov, chars, atomic ) ; if ( atomic ) kunmap_atomic ( addr ) ; else kunmap ( buf -> page ) ; ret = error ; do_wakeup = 1 ; if ( error ) { if ( atomic ) { atomic = 0 ; goto redo1 ; } goto out ; <END_BUG> }  buf -> len += chars ; <START_BUG> total_len -= chars ; <END_BUG> ret = chars

Fix:
<S2SV_ModStart> * iocb, struct iov_iter * from <S2SV_ModEnd> ) { struct <S2SV_ModStart> ; ssize_t ret = 0 <S2SV_ModStart> ; int do_wakeup = 0 <S2SV_ModEnd> ; size_t total_len <S2SV_ModStart> ; size_t total_len = iov_iter_count ( from ) <S2SV_ModStart> ssize_t chars ; <S2SV_ModEnd> if ( unlikely <S2SV_ModStart> ) ) return <S2SV_ModEnd> 0 ; __pipe_lock <S2SV_ModStart> { int error <S2SV_ModEnd> = ops -> <S2SV_ModStart> goto out ; ret = copy_page_from_iter ( buf -> page, offset, chars, from ) ; if ( unlikely ( ret < chars ) ) { error = - EFAULT ; <S2SV_ModEnd> goto out ; <S2SV_ModStart> out ; } do_wakeup = 1 ; <S2SV_ModStart> += chars ; ret = chars ; if (! iov_iter_count ( from ) <S2SV_ModEnd> ) goto out <S2SV_ModStart> -> tmp_page ; int copied <S2SV_ModEnd> ; if ( <S2SV_ModStart> = 1 ; copied = copy_page_from_iter ( page, 0, PAGE_SIZE, from <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( unlikely ( copied < PAGE_SIZE && iov_iter_count ( from ) ) ) { if (! ret ) ret = - EFAULT <S2SV_ModEnd> ; break ; <S2SV_ModStart> } ret +=
Buggy code:
 stf_status ikev2parent_inI1outR1 ( struct msg_digest * md ) { struct state * st = md -> st ; lset_t policy = POLICY_IKEV2_ALLOW ; struct connection * c = find_host_connection ( & md -> iface -> ip_addr, md -> iface -> port, & md -> sender, md -> sender_port, POLICY_IKEV2_ALLOW ) ; # if 0 if ( c == NULL ) { pb_stream pre_sa_pbs = sa_pd -> pbs ; policy = preparse_isakmp_sa_body ( & pre_sa_pbs ) ; c = find_host_connection ( & md -> iface -> ip_addr, pluto_port, ( ip_address * ) NULL, md -> sender_port, policy ) ; } # endif if ( c == NULL ) { { struct connection * d ; d = find_host_connection ( & md -> iface -> ip_addr, pluto_port, ( ip_address * ) NULL, md -> sender_port, policy ) ; for ( ; d!= NULL ; d = d -> hp_next ) { if ( d -> kind == CK_GROUP ) { } else { if ( d -> kind == CK_TEMPLATE &&! ( d -> policy & POLICY_OPPO ) ) { c = d ; break ; } if ( addrinsubnet ( & md -> sender, & d -> spd. that. client ) && ( c == NULL ||! subnetinsubnet ( & c -> spd. that. client, & d -> spd. that. client ) ) ) c = d ; } } } if ( c == NULL ) { loglog ( RC_LOG_SERIOUS, "initial   parent   SA   message   received   on   %s:%u" "   but   no   connection   has   been   authorized%s%s", ip_str ( & md -> iface -> ip_addr ), ntohs ( portof ( & md -> iface -> ip_addr ) ), ( policy!= LEMPTY )? "   with   policy=" : "", ( policy!= LEMPTY )? bitnamesof ( sa_policy_bit_names, policy ) : "" ) ; return STF_FAIL + v2N_NO_PROPOS

Fix:
<S2SV_ModStart> * ke ; <S2SV_ModEnd> char fromname [ <S2SV_ModStart> ADDRTOT_BUF ) ; if (! md -> chain [ ISAKMP_NEXT_v2KE ] ) { if ( md -> chain [ ISAKMP_NEXT_v2N ] ) { libreswan_log ( "Received <S2SV_blank> Notify(%d): <S2SV_blank> %s", md -> chain [ ISAKMP_NEXT_v2N ] -> payload. v2n. isan_type, enum_name ( & ikev2_notify_names, md -> chain [ ISAKMP_NEXT_v2N ] -> payload. v2n. isan_type ) ) ; } libreswan_log ( "rejecting <S2SV_blank> I1 <S2SV_blank> from <S2SV_blank> %s:%u, <S2SV_blank> no <S2SV_blank> KE <S2SV_blank> payload <S2SV_blank> present", fromname, md -> sender_port ) ; return STF_FAIL + v2N_INVALID_KE_PAYLOAD ; } ke = & md -> chain [ ISAKMP_NEXT_v2KE ] -> payload. v2ke ; st -> st_oakley. group = lookup_group ( ke -> isak_group ) ; if ( st -> st_
Buggy code:
 static void feed_table_block_tag ( struct table * tbl, char * line, struct table_mode * mode, int indent, int cmd ) { int offset ; if ( mode -> indent_level <= 0 && indent == - 1 ) return ; if ( mode -> indent_level >= CHAR_MAX && indent == 1 ) return ; setwidth ( tbl, mode ) ; feed_table_inline_tag ( tbl, line, mode, - 1 ) ; clearcontentssize ( tbl, mode ) ; if ( indent == 1 ) { mode -> indent_level ++ ; if ( mode -> indent_level <= MAX_INDENT_LEVEL ) tbl -> indent += INDENT_INCR ; } else if ( indent == - 1 ) { mode -> indent_level -- ; if ( mode -> indent_level < MAX_INDENT_LEVEL ) tbl -> indent -= INDENT_INCR ; } <START_BUG> offset = tbl -> indent ; <END_BUG> if ( cmd == HTML_DT ) { if ( mode -> indent_level > 0 && mode -> indent_level <= MAX_INDENT_LEVEL ) offset -= INDENT_INCR ;  } <START_BUG> if ( tbl -> indent > 0 ) { check_minimum0 ( tbl, 0 ) ; addcontentssize ( tbl, offset ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> INDENT_INCR ; } if ( tbl -> indent < 0 ) tbl -> indent = 0 ; <S2SV_ModStart> -= INDENT_INCR ; if ( offset < 0 ) offset = 0 ;