nus-yam/ex-repair huggingface dataset:
Buggy code:
 void handle_stdfmna ( struct pt_regs * regs, unsigned long sfar, unsigned long sfsr ) { unsigned long pc = regs -> tpc ; unsigned long tstate = regs -> tstate ; u32 insn ; u64 value ; u8 freg ; int flag ; struct fpustate * f = FPUSTATE ; if ( tstate & TSTATE_PRIV ) die_if_kernel ( "stdfmna   from   kernel", regs ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, sfar ) ; <END_BUG> if ( test_thread_flag ( TIF_32BIT ) ) pc = ( u32 ) pc ; if ( get_user ( insn, ( u32 __user * ) pc )!= - EFAULT ) { int asi = decode_asi ( insn, regs ) ; freg = ( ( insn >> 25 ) & 0x1e ) | ( ( insn >> 20 ) & 0x20 ) ; value = 0 ; flag = ( freg < 32 )? FPRS_DL : FPRS_DU ; if ( ( asi > ASI_SNFL ) || ( asi < ASI_P ) ) goto daex ; save_and_clear_fpu ( ) ; if ( current_thread_info ( ) -> fpsaved [ 0 ] & flag ) value = * ( u64 * ) & f -> regs [ freg ] ; switch ( asi ) { case ASI_P : case ASI_S : break ; case ASI_PL : case ASI_SL : value = __swab64p ( & value ) ; break ; default : goto daex ; } if ( put_user ( value >> 32, ( u32 __user * ) sfar ) || __put_user ( ( u32 ) value, ( u32 __user * ) ( sfar + 4 ) ) ) goto daex ; } else { daex : if ( tlb_type == hypervisor ) sun4v_data_access_exception ( regs, sfar, sfsr ) ; else spitfire_data_access_exception ( regs, sfsr, sfar ) ; return ; } advance ( regs ) ; }

Fix:
<S2SV_ModStart> PERF_COUNT_SW_ALIGNMENT_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 void vp8_yv12_copy_frame_c ( const YV12_BUFFER_CONFIG * src_ybc, YV12_BUFFER_CONFIG * dst_ybc ) { int row ; const uint8_t * src = src_ybc -> y_buffer ; uint8_t * dst = dst_ybc -> y_buffer ; # if 0 assert ( src_ybc -> y_width == dst_ybc -> y_width ) ; assert ( src_ybc -> y_height == dst_ybc -> y_height ) ; # endif <START_BUG> for ( row = 0 ; row < src_ybc -> y_height ; ++ row ) { <END_BUG>  vpx_memcpy ( dst, src, src_ybc -> y_width ) ; <START_BUG> src += src_ybc -> y_stride ; dst += dst_ybc -> y_stride ; } src = src_ybc -> u_buffer ; dst = dst_ybc -> u_buffer ; for ( row = 0 ; row < src_ybc -> uv_height ; ++ row ) { <END_BUG> vpx_memcpy ( dst, src, src_ybc -> uv_width ) ;  src += src_ybc -> uv_stride ; dst += dst_ybc -> uv_stride ; } src = src_ybc -> v_buffer ; dst = dst_ybc -> v_buffer ; for ( row = 0 ; row < src_ybc -> uv_height ; ++ row ) { <START_BUG> vpx_memcpy ( dst, src, src_ybc -> uv_width ) ; <END_BUG> src += src_ybc -> uv_stride ; dst += dst_ybc -> uv_stride ; } vp8_yv12_extend_frame_borders_c ( dst_ybc ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ; # endif # if CONFIG_VP9_HIGHBITDEPTH if ( src_ybc -> flags & YV12_FLAG_HIGHBITDEPTH ) { assert ( dst_ybc -> flags & YV12_FLAG_HIGHBITDEPTH ) ; <S2SV_ModStart> row ) { memcpy_short_addr <S2SV_ModEnd> ( dst, <S2SV_ModStart> row ) { memcpy_short_addr <S2SV_ModEnd> ( dst, <S2SV_ModStart> row ) { memcpy_short_addr <S2SV_ModEnd> ( dst, <S2SV_ModStart> dst_ybc ) ; return ; } else { assert (! ( dst_ybc -> flags & YV12_FLAG_HIGHBITDEPTH ) ) ; } # endif for ( row = 0 ; row < src_ybc -> y_height ; ++ row ) { memcpy ( dst, src, src_ybc -> y_width ) ; src += src_ybc -> y_stride ; dst += dst_ybc -> y_stride ; } src = src_ybc -> u_buffer ; dst = dst_ybc -> u_buffer ; for ( row = 0 ; row < src_ybc -> uv_height ; ++ row ) { memcpy ( dst, src, src_ybc
Buggy code:
 static void scsi_write_complete ( void * opaque, int ret ) { SCSIDiskReq * r = ( SCSIDiskReq * ) opaque ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, r -> req. dev ) ; <START_BUG> uint32_t len ; <END_BUG> uint32_t n ; if ( r -> req. aiocb!= NULL ) { r -> req. aiocb = NULL ; bdrv_acct_done ( s -> bs, & r -> acct ) ; } if ( ret ) { if ( scsi_handle_rw_error ( r, - ret, SCSI_REQ_STATUS_RETRY_WRITE ) ) { return ; } }  n = r -> iov. iov_len // 512 ; <START_BUG> r -> sector += n ; r -> sector_count -= n ; if ( r -> sector_count == 0 ) { scsi_req_complete ( & r -> req, GOOD ) ; } else { <END_BUG> len = r -> sector_count * 512 ;  if ( len > SCSI_DMA_BUF_SIZE ) { len = SCSI_DMA_BUF_SIZE ; } r -> iov. iov_len = len ; <START_BUG> DPRINTF ( "Write   complete   tag=0x%x   more=%d\\n", r -> req. tag, len ) ; <END_BUG>  scsi_req_data ( & r -> req, len ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> ) ; uint32_t <S2SV_ModEnd> n ; if <S2SV_ModStart> = r -> qiov. size <S2SV_ModEnd> // 512 ; <S2SV_ModStart> } else { scsi_init_iovec ( r ) <S2SV_ModEnd> ; DPRINTF ( <S2SV_ModStart>. tag, r -> qiov. size <S2SV_ModEnd> ) ; scsi_req_data <S2SV_ModStart> -> req, r -> qiov. size <S2SV_ModEnd> ) ; }
Buggy code:
 static int jas_iccgetuint32 ( jas_stream_t * in, jas_iccuint32_t * val ) { <START_BUG> ulonglong tmp ; <END_BUG> if ( jas_iccgetuint ( in, 4, & tmp ) ) return - 1 ; * val = tmp ; return 0 ; }

Fix:
<S2SV_ModStart> val ) { jas_ulonglong <S2SV_ModEnd> tmp ; if
Buggy code:
 SYSCALL_DEFINE1 ( inotify_init1, int, flags ) { <START_BUG> struct fsnotify_group * group ; <END_BUG> struct user_struct * user ; int ret ; BUILD_BUG_ON ( IN_CLOEXEC!= O_CLOEXEC ) ; BUILD_BUG_ON ( IN_NONBLOCK!= O_NONBLOCK ) ; if ( flags & ~ ( IN_CLOEXEC | IN_NONBLOCK ) ) return - EINVAL ;  user = get_current_user ( ) ; <START_BUG> if ( unlikely ( atomic_read ( & user -> inotify_devs ) >= inotify_max_user_instances ) ) { ret = - EMFILE ; goto out_free_uid ; } <END_BUG> group = inotify_new_group ( user, inotify_max_queued_events ) ;  <START_BUG> if ( IS_ERR ( group ) ) { <END_BUG>  ret = PTR_ERR ( group ) ; <START_BUG> goto out_free_uid ; } atomic_inc ( & user -> inotify_devs ) ; ret = anon_inode_getfd ( "inotify", & inotify_fops, group, O_RDONLY | flags ) ; <END_BUG> if ( ret >= 0 )  return ret ; <START_BUG> fsnotify_put_group ( group ) ; <END_BUG> atomic_dec ( & user -> inotify_devs ) ; out_free_uid : free_uid ( user ) ; return ret ; }

Fix:
<S2SV_ModStart> fsnotify_group * group <S2SV_ModEnd> ; int ret <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> group = inotify_new_group <S2SV_ModStart> = inotify_new_group ( <S2SV_ModEnd> inotify_max_queued_events ) ; <S2SV_ModStart> group ) ) return <S2SV_ModEnd> PTR_ERR ( group <S2SV_ModStart> PTR_ERR ( group <S2SV_ModEnd> ) ; ret <S2SV_ModStart> if ( ret < 0 ) <S2SV_ModEnd> fsnotify_put_group ( group <S2SV_ModStart> fsnotify_put_group ( group <S2SV_ModEnd> ) ; return
Buggy code:
 int ssl3_get_key_exchange ( SSL * s ) { # ifndef OPENSSL_NO_RSA unsigned char * q, md_buf [ EVP_MAX_MD_SIZE * 2 ] ; # endif EVP_MD_CTX md_ctx ; unsigned char * param, * p ; int al, j, ok ; long i, param_len, n, alg_k, alg_a ; EVP_PKEY * pkey = NULL ; const EVP_MD * md = NULL ; # ifndef OPENSSL_NO_RSA RSA * rsa = NULL ; # endif # ifndef OPENSSL_NO_DH DH * dh = NULL ; # endif # ifndef OPENSSL_NO_ECDH EC_KEY * ecdh = NULL ; BN_CTX * bn_ctx = NULL ; EC_POINT * srvr_ecpoint = NULL ; int curve_nid = 0 ; int encoded_pt_len = 0 ; # endif <START_BUG> n = s -> method -> ssl_get_message ( s, <END_BUG> SSL3_ST_CR_KEY_EXCH_A, SSL3_ST_CR_KEY_EXCH_B, - 1, s -> max_cert_list, & ok ) ;  if (! ok ) return ( ( int ) n ) ; <START_BUG> if ( s -> s3 -> tmp. message_type!= SSL3_MT_SERVER_KEY_EXCHANGE ) { <END_BUG> # ifndef OPENSSL_NO_PSK  <START_BUG> if ( s -> s3 -> tmp. new_cipher -> algorithm_mkey & SSL_kPSK ) <END_BUG> { s -> session -> sess_cert = ssl_sess_cert_new ( ) ; if ( s -> ctx -> psk_identity_hint ) OPENSSL_free ( s -> ctx -> psk_identity_hint ) ; s -> ctx -> psk_identity_hint = NULL ; } # endif s -> s3 -> tmp. reuse_message = 1 ; return ( 1 ) ; } param = p = ( unsigned char * ) s -> init_msg ; if ( s -> session -> sess_cert!= NULL ) { # ifndef OPENSSL_NO_RSA if ( s -> session -> sess_cert -> peer_rsa_tmp!= NULL ) { RSA_free ( s -> session -> sess_cert -> peer_rsa

Fix:
<S2SV_ModStart> ; # endif EVP_MD_CTX_init ( & md_ctx ) ; <S2SV_ModStart> ) n ) ; alg_k = s -> s3 -> tmp. new_cipher -> algorithm_mkey <S2SV_ModStart> SSL3_MT_SERVER_KEY_EXCHANGE ) { if ( alg_k & ( SSL_kDHE | SSL_kECDHE ) ) { SSLerr ( SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE ) ; al = SSL_AD_UNEXPECTED_MESSAGE ; goto f_err ; } <S2SV_ModStart> OPENSSL_NO_PSK if ( alg_k & SSL_kPSK ) { s -> session -> sess_cert = ssl_sess_cert_new ( ) ; if ( s -> ctx -> psk_identity_hint ) OPENSSL_free ( s -> ctx -> psk_identity_hint ) ; s -> ctx -> psk_identity_hint = NULL ; } # endif s -> s3 -> tmp. reuse_message = 1 ; return ( 1 ) ; } param = p = ( unsigned char * ) s -> init_msg ; if ( s -> session -> sess_cert!= NULL
Buggy code:
 void rose_write_internal ( struct sock * sk, int frametype ) { struct rose_sock * rose = rose_sk ( sk ) ; struct sk_buff * skb ; unsigned char * dptr ; unsigned char lci1, lci2 ; char buffer [ 100 ] ; int len, faclen = 0 ; len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1 ; switch ( frametype ) { case ROSE_CALL_REQUEST : len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN ; faclen = rose_create_facilities ( buffer, rose ) ; len += faclen ; break ; case ROSE_CALL_ACCEPTED : case ROSE_CLEAR_REQUEST : case ROSE_RESET_REQUEST : len += 2 ; break ; } if ( ( skb = alloc_skb ( len, GFP_ATOMIC ) ) == NULL ) return ; skb_reserve ( skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1 ) ; dptr = skb_put ( skb, skb_tailroom ( skb ) ) ; lci1 = ( rose -> lci >> 8 ) & 0x0F ; lci2 = ( rose -> lci >> 0 ) & 0xFF ; switch ( frametype ) { case ROSE_CALL_REQUEST : * dptr ++ = ROSE_GFI | lci1 ; * dptr ++ = lci2 ; * dptr ++ = frametype ; <START_BUG> * dptr ++ = 0xAA ; <END_BUG> memcpy ( dptr, & rose -> dest_addr, ROSE_ADDR_LEN ) ; dptr += ROSE_ADDR_LEN ; memcpy ( dptr, & rose -> source_addr, ROSE_ADDR_LEN ) ; dptr += ROSE_ADDR_LEN ; memcpy ( dptr, buffer, faclen ) ; dptr += faclen ; break ; case ROSE_CALL_ACCEPTED : * dptr ++ = ROSE_GFI | lci1 ; * dptr ++ = lci2 ; * dptr ++ = frametype ; * dptr ++ = 0x00 ; *

Fix:
<S2SV_ModStart> dptr ++ = ROSE_CALL_REQ_ADDR_LEN_VAL <S2SV_ModEnd> ; memcpy (
Buggy code:
 char * Util_monitId ( char * idfile ) { <START_BUG> FILE * file = NULL ; <END_BUG> ASSERT ( idfile ) ; if (! File_exist ( idfile ) ) {  md5_context_t ctx ; <START_BUG> char buf [ STRLEN ] ; MD_T digest ; file = fopen ( idfile, "w" ) ; if (! file ) { LogError ( "Error   opening   the   idfile   \'%s\'   --   %s\\n", idfile, STRERROR ) ; return NULL ; } <END_BUG> snprintf ( buf, STRLEN, "%lu%d%lu", ( unsigned long ) Time_now ( ), getpid ( ), random ( ) ) ;  md5_init ( & ctx ) ; md5_append ( & ctx, ( const md5_byte_t * ) buf, STRLEN - 1 ) ; md5_finish ( & ctx, ( md5_byte_t * ) digest ) ; Util_digest2Bytes ( ( unsigned char * ) digest, 16, Run. id ) ; <START_BUG> fprintf ( file, "%s", Run. id ) ; <END_BUG> LogInfo ( "   New   Monit   id:   %s\\n   Stored   in   \'%s\'\\n", Run. id, idfile ) ; } else { if (! File_isFile ( idfile ) ) { LogError ( "idfile   \'%s\'   is   not   a   regular   file\\n", idfile ) ; return NULL ; } if ( ( file = fopen ( idfile, "r" ) ) == ( FILE * ) NULL ) { LogError ( "Error   opening   the   idfile   \'%s\'   --   %s\\n", idfile, STRERROR ) ; return NULL ; } if ( fscanf ( file, "%64s", Run. id )!= 1 ) { LogError ( "Error   reading   id   from   file   \'%s\'\\n", idfile ) ; if ( fclose ( file ) ) LogError ( "Error   closing   file   \'%s\'   --   %s\\n", idfile, STRERROR ) ; return NULL ; } } if ( fclose ( file ) ) LogError ( "Error   closing   file   \'%s

Fix:
<S2SV_ModStart> idfile ) { ASSERT ( idfile ) ; <S2SV_ModStart> file = NULL <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) { <S2SV_ModEnd> file = fopen <S2SV_ModStart> NULL ; } <S2SV_ModEnd> fprintf ( file <S2SV_ModStart>, "%s", Util_getToken ( Run. id ) <S2SV_ModEnd> ) ; LogInfo
Buggy code:
 static int aes_gcm_ctrl ( EVP_CIPHER_CTX * c, int type, int arg, void * ptr ) { EVP_AES_GCM_CTX * gctx = EVP_C_DATA ( EVP_AES_GCM_CTX, c ) ; switch ( type ) { case EVP_CTRL_INIT : gctx -> key_set = 0 ; gctx -> iv_set = 0 ; gctx -> ivlen = EVP_CIPHER_CTX_iv_length ( c ) ; gctx -> iv = EVP_CIPHER_CTX_iv_noconst ( c ) ; gctx -> taglen = - 1 ; gctx -> iv_gen = 0 ; gctx -> tls_aad_len = - 1 ; return 1 ; case EVP_CTRL_AEAD_SET_IVLEN : if ( arg <= 0 ) return 0 ; if ( ( arg > EVP_MAX_IV_LENGTH ) && ( arg > gctx -> ivlen ) ) { if ( gctx -> iv!= EVP_CIPHER_CTX_iv_noconst ( c ) ) OPENSSL_free ( gctx -> iv ) ; gctx -> iv = OPENSSL_malloc ( arg ) ; if ( gctx -> iv == NULL ) return 0 ; } gctx -> ivlen = arg ; return 1 ; case EVP_CTRL_AEAD_SET_TAG : if ( arg <= 0 || arg > 16 || EVP_CIPHER_CTX_encrypting ( c ) ) return 0 ; memcpy ( EVP_CIPHER_CTX_buf_noconst ( c ), ptr, arg ) ; gctx -> taglen = arg ; return 1 ; case EVP_CTRL_AEAD_GET_TAG : if ( arg <= 0 || arg > 16 ||! EVP_CIPHER_CTX_encrypting ( c ) || gctx -> taglen < 0 ) return 0 ; memcpy ( ptr, EVP_CIPHER_CTX_buf_noconst ( c ), arg ) ; return 1 ; case EVP_CTRL_GCM_SET_IV_FIXED : if ( arg == - 1 ) { memcpy ( gctx -> iv, ptr, g

Fix:
<S2SV_ModStart> 1 ] ; if ( len < EVP_GCM_TLS_EXPLICIT_IV_LEN ) return 0 ; <S2SV_ModStart> c ) ) { if ( len < EVP_GCM_TLS_TAG_LEN ) return 0 ; <S2SV_ModStart> -= EVP_GCM_TLS_TAG_LEN ; }
Buggy code:
 void vp8_dequant_idct_add_uv_block_c ( short * q, short * dq, unsigned char * dstu, unsigned char * dstv, int stride, char * eobs ) { int i, j ; for ( i = 0 ; i < 2 ; i ++ ) { for ( j = 0 ; j < 2 ; j ++ ) { if ( * eobs ++ > 1 ) vp8_dequant_idct_add_c ( q, dq, dstu, stride ) ; else { vp8_dc_only_idct_add_c ( q [ 0 ] * dq [ 0 ], dstu, stride, dstu, stride ) ; <START_BUG> vpx_memset ( q, 0, 2 * sizeof ( q [ 0 ] ) ) ; <END_BUG> } q += 16 ; dstu += 4 ; } dstu += 4 * stride - 8 ; } for ( i = 0 ; i < 2 ; i ++ ) { for ( j = 0 ; j < 2 ; j ++ ) { if ( * eobs ++ > 1 ) vp8_dequant_idct_add_c ( q, dq, dstv, stride ) ; else { vp8_dc_only_idct_add_c ( q [ 0 ] * dq [ 0 ], dstv, stride, dstv, stride ) ;  vpx_memset ( q, 0, 2 * sizeof ( q [ 0 ] ) ) ; <START_BUG> } q += 16 ; dstv += 4 ; } dstv += 4 * stride - 8 ; } }<END_BUG>

Fix:
<S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q, <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q,
Buggy code:
 evtchn_port_t evtchn_from_irq ( unsigned irq ) { <START_BUG> if ( WARN ( irq >= nr_irqs, "Invalid   irq   %d!\\n", irq ) ) <END_BUG> return 0 ;  return info_for_irq ( irq ) -> evtchn ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> irq ) { const struct irq_info * info = NULL ; if ( likely ( irq < nr_irqs ) ) info = info_for_irq ( irq ) ; if (! info <S2SV_ModEnd> ) return 0 <S2SV_ModStart> 0 ; return info <S2SV_ModEnd> -> evtchn ;
Buggy code:
 int validate_camera_metadata_structure ( const camera_metadata_t * metadata, const size_t * expected_size ) { if ( metadata == NULL ) { ALOGE ( "%s:   metadata   is   null!", __FUNCTION__ ) ; return ERROR ; } { static const struct { const char * name ; size_t alignment ; } alignments [ ] = { {. name = "camera_metadata",. alignment = METADATA_ALIGNMENT }, {. name = "camera_metadata_buffer_entry",. alignment = ENTRY_ALIGNMENT }, {. name = "camera_metadata_data",. alignment = DATA_ALIGNMENT }, } ; for ( size_t i = 0 ; i < sizeof ( alignments ) // sizeof ( alignments [ 0 ] ) ; ++ i ) { uintptr_t aligned_ptr = ALIGN_TO ( metadata, alignments [ i ]. alignment ) ; if ( ( uintptr_t ) metadata!= aligned_ptr ) { ALOGE ( "%s:   Metadata   pointer   is   not   aligned   (actual   %p,   " "expected   %p)   to   type   %s", __FUNCTION__, metadata, ( void * ) aligned_ptr, alignments [ i ]. name ) ; return ERROR ; } } } if ( expected_size!= NULL && metadata -> size > * expected_size ) { ALOGE ( "%s:   Metadata   size   (%" PRIu32 ")   should   be   <=   expected   size   (%zu)", __FUNCTION__, metadata -> size, * expected_size ) ; return ERROR ; } if ( metadata -> entry_count > metadata -> entry_capacity ) { ALOGE ( "%s:   Entry   count   (%" PRIu32 ")   should   be   <=   entry   capacity   " "(%" PRIu32 ")", __FUNCTION__, metadata -> entry_count, metadata -> entry_capacity ) ; return ERROR ; } <START_BUG> const metadata_uptrdiff_t entries_end = <END_BUG> metadata -> entries_start + metadata -> entry_capacity ; if ( entries_end < metadata -> entries_start || entries_end > metadata -> data_start ) { ALOGE ( "%s:   Entry   start   +   capacity   (%" PRIu32 ")   should   be   <=   data   start   "

Fix:
<S2SV_ModStart> ERROR ; } if ( metadata -> data_count > metadata -> data_capacity ) { ALOGE ( "%s: <S2SV_blank> Data <S2SV_blank> count <S2SV_blank> (%" PRIu32 ") <S2SV_blank> should <S2SV_blank> be <S2SV_blank> <= <S2SV_blank> data <S2SV_blank> capacity <S2SV_blank> " "(%" PRIu32 ")", __FUNCTION__, metadata -> data_count, metadata -> data_capacity ) ; android_errorWriteLog ( SN_EVENT_LOG_ID, "30591838" ) ; return ERROR ; }
Buggy code:
 enum_func_status php_mysqlnd_rowp_read_text_protocol_aux ( MYSQLND_MEMORY_POOL_CHUNK * row_buffer, zval * * fields, unsigned int field_count, const MYSQLND_FIELD * fields_metadata, zend_bool as_int_or_float, zend_bool copy_data, MYSQLND_STATS * stats TSRMLS_DC ) { unsigned int i ; zend_bool last_field_was_string = FALSE ; zval * * current_field, * * end_field, * * start_field ; zend_uchar * p = row_buffer -> ptr ; size_t data_size = row_buffer -> app ; zend_uchar * bit_area = ( zend_uchar * ) row_buffer -> ptr + data_size + 1 ; <START_BUG> DBG_ENTER ( "php_mysqlnd_rowp_read_text_protocol_aux" ) ; <END_BUG> if (! fields ) { DBG_RETURN ( FAIL ) ; } end_field = ( start_field = fields ) + field_count ; for ( i = 0, current_field = start_field ; current_field < end_field ; current_field ++, i ++ ) { DBG_INF ( "Directly   creating   zval" ) ; MAKE_STD_ZVAL ( * current_field ) ; if (! * current_field ) { DBG_RETURN ( FAIL ) ; } } for ( i = 0, current_field = start_field ; current_field < end_field ; current_field ++, i ++ ) { zend_uchar * this_field_len_pos = p ;  unsigned long len = php_mysqlnd_net_field_length ( & p ) ; <START_BUG> if ( copy_data == FALSE && current_field > start_field && last_field_was_string ) { * this_field_len_pos = '\\0' ; } if ( len == MYSQLND_NULL_LENGTH ) { ZVAL_NULL ( * current_field ) ; last_field_was_string = FALSE ; } else { # if defined ( MYSQLND_STRING_TO_INT_CONVERSION ) struct st_mysqlnd_perm_bind perm_bind = mysqlnd_ps_fetch_functions [ fields_metadata [ i ]. type ]<END_BUG>

Fix:
<S2SV_ModStart> + 1 ; const zend_uchar * const packet_end = ( zend_uchar * ) row_buffer -> ptr + data_size ; <S2SV_ModStart> = p ; const <S2SV_ModStart> p ) ; if ( len!= MYSQLND_NULL_LENGTH && ( ( p + len ) > packet_end ) ) { php_error_docref ( NULL, E_WARNING, "Malformed <S2SV_blank> server <S2SV_blank> packet. <S2SV_blank> Field <S2SV_blank> length <S2SV_blank> pointing <S2SV_blank> " MYSQLND_SZ_T_SPEC " <S2SV_blank> bytes <S2SV_blank> after <S2SV_blank> end <S2SV_blank> of <S2SV_blank> packet", ( p + len ) - packet_end - 1 ) ; DBG_RETURN ( FAIL ) ; }
Buggy code:
 int nntp_add_group ( char * line, void * data ) { struct NntpServer * nserv = data ; struct NntpData * nntp_data = NULL ; <START_BUG> char group [ LONG_STRING ] ; <END_BUG> char desc [ HUGE_STRING ] = "" ; char mod ; anum_t first, last ; if (! nserv ||! line ) return 0 ;  if ( sscanf ( line, "%s   " ANUM "   " ANUM "   %c   %[^\\n]", group, & last, & first, & mod, desc ) < 4 ) <START_BUG> <END_BUG> return 0 ;  nntp_data = nntp_data_find ( nserv, group ) ; nntp_data -> deleted = false ; nntp_data -> first_message = first ; nntp_data -> last_message = last ; nntp_data -> allowed = ( mod == 'y' ) || ( mod =='m' ) ; mutt_str_replace ( & nntp_data -> desc, desc ) ; if ( nntp_data -> newsrc_ent || nntp_data -> last_cached ) nntp_group_unread_stat ( nntp_data ) ; else if ( nntp_data -> last_message && nntp_data -> first_message <= nntp_data -> last_message ) nntp_data -> unread = nntp_data -> last_message - nntp_data -> first_message + 1 ; else nntp_data -> unread = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> [ LONG_STRING ] = "" <S2SV_ModStart> ( line, "%1023s <S2SV_blank> " <S2SV_ModEnd> ANUM " <S2SV_blank> " ANUM <S2SV_ModStart> ANUM " <S2SV_blank> " ANUM " <S2SV_blank> %c <S2SV_blank> %8191[^\\n]" <S2SV_ModEnd>, group, <S2SV_ModStart> < 4 ) { mutt_debug ( 4, "Cannot <S2SV_blank> parse <S2SV_blank> server <S2SV_blank> line: <S2SV_blank> %s\\n", line ) ; <S2SV_ModStart> return 0 ; }
Buggy code:
 static int key_notify_policy_flush ( const struct km_event * c ) { struct sk_buff * skb_out ; struct sadb_msg * hdr ; skb_out = alloc_skb ( sizeof ( struct sadb_msg ) + 16, GFP_ATOMIC ) ; if (! skb_out ) return - ENOBUFS ; hdr = ( struct sadb_msg * ) skb_put ( skb_out, sizeof ( struct sadb_msg ) ) ; hdr -> sadb_msg_type = SADB_X_SPDFLUSH ; hdr -> sadb_msg_seq = c -> seq ; hdr -> sadb_msg_pid = c -> portid ; hdr -> sadb_msg_version = PF_KEY_V2 ; hdr -> sadb_msg_errno = ( uint8_t ) 0 ; <START_BUG> hdr -> sadb_msg_len = ( sizeof ( struct sadb_msg ) // sizeof ( uint64_t ) ) ; <END_BUG> pfkey_broadcast ( skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c -> net ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; hdr -> sadb_msg_satype = SADB_SATYPE_UNSPEC ; hdr ->
Buggy code:
 error_t ssiProcessExecCommand ( HttpConnection * connection, const char_t * tag, size_t length ) { char_t * separator ; char_t * attribute ; char_t * value ; if ( connection -> settings -> cgiCallback == NULL ) return ERROR_INVALID_TAG ; if ( length < 4 || length >= HTTP_SERVER_BUFFER_SIZE ) return ERROR_INVALID_TAG ; osMemcpy ( connection -> buffer, tag + 4, length - 4 ) ; connection -> buffer [ length - 4 ] = '\\0' ; <START_BUG> separator = strchr ( connection -> buffer, '=' ) ; <END_BUG> if (! separator ) return ERROR_INVALID_TAG ; * separator = '\\0' ; attribute = strTrimWhitespace ( connection -> buffer ) ; value = strTrimWhitespace ( separator + 1 ) ; if ( value [ 0 ] == '\\'' || value [ 0 ] == \'\\"\' ) value ++ ; length = osStrlen ( value ) ; if ( length > 0 ) { if ( value [ length - 1 ] == '\\'' || value [ length - 1 ] == \'\\"\' ) value [ length - 1 ] = '\\0' ; } if ( osStrcasecmp ( attribute, "cgi" ) && osStrcasecmp ( attribute, "cmd" ) && osStrcasecmp ( attribute, "cmd_argument" ) ) return ERROR_INVALID_TAG ; if ( osStrlen ( value ) > HTTP_SERVER_CGI_PARAM_MAX_LEN ) return ERROR_INVALID_TAG ; osStrcpy ( connection -> cgiParam, value ) ; return connection -> settings -> cgiCallback ( connection, connection -> cgiParam ) ; }

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( connection ->
Buggy code:
 static ssize_t ext4_ext_direct_IO ( int rw, struct kiocb * iocb, const struct iovec * iov, loff_t offset, unsigned long nr_segs ) { struct file * file = iocb -> ki_filp ; struct inode * inode = file -> f_mapping -> host ; ssize_t ret ; size_t count = iov_length ( iov, nr_segs ) ; loff_t final_size = offset + count ; if ( rw == WRITE && final_size <= inode -> i_size ) { iocb -> private = NULL ; EXT4_I ( inode ) -> cur_aio_dio = NULL ; if (! is_sync_kiocb ( iocb ) ) { <START_BUG> iocb -> private = ext4_init_io_end ( inode ) ; <END_BUG> if (! iocb -> private ) return - ENOMEM ; EXT4_I ( inode ) -> cur_aio_dio = iocb -> private ; } ret = blockdev_direct_IO ( rw, iocb, inode, inode -> i_sb -> s_bdev, iov, offset, nr_segs, ext4_get_block_write, ext4_end_io_dio ) ; if ( iocb -> private ) EXT4_I ( inode ) -> cur_aio_dio = NULL ; if ( ret!= - EIOCBQUEUED && ret <= 0 && iocb -> private ) { ext4_free_io_end ( iocb -> private ) ; iocb -> private = NULL ; } else if ( ret > 0 && ext4_test_inode_state ( inode, EXT4_STATE_DIO_UNWRITTEN ) ) { int err ; err = ext4_convert_unwritten_extents ( inode, offset, ret ) ; if ( err < 0 ) ret = err ; ext4_clear_inode_state ( inode, EXT4_STATE_DIO_UNWRITTEN ) ; } return ret ; } return ext4_ind_direct_IO ( rw, iocb, iov, offset, nr_segs ) ; }

Fix:
<S2SV_ModStart> ext4_init_io_end ( inode, GFP_NOFS
Buggy code:
 int ff_mpeg4_decode_picture_header ( Mpeg4DecContext * ctx, GetBitContext * gb ) { MpegEncContext * s = & ctx -> m ; unsigned startcode, v ; int ret ; int vol = 0 ; <START_BUG> align_get_bits ( gb ) ; <END_BUG> if ( s -> codec_tag == AV_RL32 ( "WV1F" ) && show_bits ( gb, 24 ) == 0x575630 ) { skip_bits ( gb, 24 ) ; if ( get_bits ( gb, 8 ) == 0xF0 ) goto end ; } startcode = 0xff ; for ( ; ; ) { if ( get_bits_count ( gb ) >= gb -> size_in_bits ) { if ( gb -> size_in_bits == 8 && ( ctx -> divx_version >= 0 || ctx -> xvid_build >= 0 ) || s -> codec_tag == AV_RL32 ( "QMP4" ) ) { av_log ( s -> avctx, AV_LOG_VERBOSE, "frame   skip   %d\\n", gb -> size_in_bits ) ; return FRAME_SKIPPED ; } else return AVERROR_INVALIDDATA ; } v = get_bits ( gb, 8 ) ; startcode = ( ( startcode << 8 ) | v ) & 0xffffffff ; if ( ( startcode & 0xFFFFFF00 )!= 0x100 ) continue ; if ( s -> avctx -> debug & FF_DEBUG_STARTCODE ) { av_log ( s -> avctx, AV_LOG_DEBUG, "startcode:   %3X   ", startcode ) ; if ( startcode <= 0x11F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Video   Object   Start" ) ; else if ( startcode <= 0x12F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Video   Object   Layer   Start" ) ; else if ( startcode <= 0x13F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Reserved" ) ; else if ( startcode <= 0x15F ) av_log ( s -> avctx, AV_LOG_DEBUG, "FGS   bp   start" ) ; else if ( startcode <= 0x1

Fix:
<S2SV_ModStart> ( gb ) ; if (! s -> studio_profile && s -> avctx -> bits_per_raw_sample!= 8 ) s -> avctx -> bits_per_raw_sample = 0
Buggy code:
 int TIFFFlushData1 ( TIFF * tif ) { if ( tif -> tif_rawcc > 0 && tif -> tif_flags & TIFF_BUF4WRITE ) { if (! isFillOrder ( tif, tif -> tif_dir. td_fillorder ) && ( tif -> tif_flags & TIFF_NOBITREV ) == 0 ) TIFFReverseBits ( ( uint8 * ) tif -> tif_rawdata, tif -> tif_rawcc ) ; if (! TIFFAppendToStrip ( tif, isTiled ( tif )? tif -> tif_curtile : tif -> tif_curstrip, tif -> tif_rawdata, tif -> tif_rawcc ) ) <START_BUG> return ( 0 ) ; <END_BUG> tif -> tif_rawcc = 0 ; tif -> tif_rawcp = tif -> tif_rawdata ; } return ( 1 ) ; }

Fix:
<S2SV_ModStart> tif_rawcc ) ) { tif -> tif_rawcc = 0 ; tif -> tif_rawcp = tif -> tif_rawdata ; <S2SV_ModStart> 0 ) ; }
Buggy code:
 OM_uint32 kg_unseal_iov ( OM_uint32 * minor_status, gss_ctx_id_t context_handle, int * conf_state, gss_qop_t * qop_state, gss_iov_buffer_desc * iov, int iov_count, int toktype ) { krb5_gss_ctx_id_rec * ctx ; OM_uint32 code ; ctx = ( krb5_gss_ctx_id_rec * ) context_handle ; <START_BUG> if (! ctx -> established ) { <END_BUG> * minor_status = KG_CTX_INCOMPLETE ; return GSS_S_NO_CONTEXT ; } if ( kg_locate_iov ( iov, iov_count, GSS_IOV_BUFFER_TYPE_STREAM )!= NULL ) { code = kg_unseal_stream_iov ( minor_status, ctx, conf_state, qop_state, iov, iov_count, toktype ) ; } else { code = kg_unseal_iov_token ( minor_status, ctx, conf_state, qop_state, iov, iov_count, toktype ) ; } return code ; }

Fix:
<S2SV_ModStart> ; if ( ctx -> terminated ||
Buggy code:
 static Image * ReadBMPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { BMPInfo bmp_info ; Image * image ; MagickBooleanType status ; MagickOffsetType offset, profile_data, profile_size, start_position ; MemoryInfo * pixel_info ; Quantum index ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bit, bytes_per_line, length ; ssize_t count, y ; unsigned char magick [ 12 ], * pixels ; unsigned int blue, green, offset_bits, red ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) memset ( & bmp_info, 0, sizeof ( bmp_info ) ) ; bmp_info. ba_offset = 0 ; start_position = 0 ; offset_bits = 0 ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { PixelInfo quantum_bits ; PixelPacket shift ; start_position = TellBlob ( image ) - 2 ; bmp_info. ba_offset = 0 ; while ( LocaleNCompare ( ( char * ) magick, "BA", 2 ) == 0 ) { bmp_info. file_size = ReadBlobLSBLong ( image ) ; bmp_info. ba_offset = ReadBlobLSBLong ( image ) ; bmp_info. offset_bits = ReadBlobLSBLong ( image ) ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) break ;

Fix:
<S2SV_ModStart> = MagickFalse ; break <S2SV_ModEnd> ; } image
Buggy code:
 static void audit_log_execve_info ( struct audit_context * context, struct audit_buffer * * ab ) { <START_BUG> int i, len ; <END_BUG> size_t len_sent = 0 ;  const char __user * p ; <START_BUG> char * buf ; p = ( const char __user * ) current -> mm -> arg_start ; <END_BUG> audit_log_format ( * ab, "argc=%d", context -> execve. argc ) ;  <START_BUG> buf = kmalloc ( MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL ) ; <END_BUG>  if (! buf ) { <START_BUG> audit_panic ( "out   of   memory   for   argv   string" ) ; return ; } <END_BUG> for ( i = 0 ; i < context -> execve. argc ; i ++ ) {  len = audit_log_single_execve_arg ( context, ab, i, & len_sent, p, buf ) ; if ( len <= 0 ) break ; p += len ; } kfree ( buf ) ; }

Fix:
<S2SV_ModStart> ab ) { long len_max ; long len_rem ; long len_full ; long len_buf ; long len_abuf ; long len_tmp ; bool require_data ; bool encode ; unsigned int iter ; unsigned int arg ; char * buf_head ; char * buf <S2SV_ModEnd> ; const char <S2SV_ModStart> char __user * <S2SV_ModEnd> p = ( <S2SV_ModStart> -> arg_start ; char abuf [ 96 ] ; WARN_ON_ONCE ( MAX_EXECVE_AUDIT_LEN > 7500 ) ; len_max = MAX_EXECVE_AUDIT_LEN ; buf_head = kmalloc ( MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL ) ; if (! buf_head ) { audit_panic ( "out <S2SV_blank> of <S2SV_blank> memory <S2SV_blank> for <S2SV_blank> argv <S2SV_blank> string" ) ; return ; } buf = buf_head ; <S2SV_ModStart> argc ) ; len_rem = len_max ; len_buf = 0 ; len_full = 0 ; require_data = true ; encode = false ; iter = 0 ; arg = 0 ; do { if ( len_full == 0 ) len_full = strnlen_user ( p, MAX
Buggy code:
 static MV_REFERENCE_FRAME get_frame_type ( const VP9_COMP * cpi ) { if ( frame_is_intra_only ( & cpi -> common ) ) return INTRA_FRAME ; else if ( cpi -> rc. is_src_frame_alt_ref && cpi -> refresh_golden_frame ) return ALTREF_FRAME ; else if ( cpi -> refresh_golden_frame || cpi -> refresh_alt_ref_frame ) <START_BUG> return LAST_FRAME ; <END_BUG> else  return GOLDEN_FRAME ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> refresh_alt_ref_frame ) return GOLDEN_FRAME <S2SV_ModEnd> ; else return <S2SV_ModStart> ; else return LAST_FRAME <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void sctp_assoc_update ( struct sctp_association * asoc, struct sctp_association * new ) { struct sctp_transport * trans ; struct list_head * pos, * temp ; asoc -> c = new -> c ; asoc -> peer. rwnd = new -> peer. rwnd ; asoc -> peer. sack_needed = new -> peer. sack_needed ; <START_BUG> asoc -> peer. i = new -> peer. i ; <END_BUG> sctp_tsnmap_init ( & asoc -> peer. tsn_map, SCTP_TSN_MAP_INITIAL, asoc -> peer. i. initial_tsn, GFP_ATOMIC ) ; list_for_each_safe ( pos, temp, & asoc -> peer. transport_addr_list ) { trans = list_entry ( pos, struct sctp_transport, transports ) ; if (! sctp_assoc_lookup_paddr ( new, & trans -> ipaddr ) ) { sctp_assoc_rm_peer ( asoc, trans ) ; continue ; } if ( asoc -> state >= SCTP_STATE_ESTABLISHED ) sctp_transport_reset ( trans ) ; } if ( asoc -> state >= SCTP_STATE_ESTABLISHED ) { asoc -> next_tsn = new -> next_tsn ; asoc -> ctsn_ack_point = new -> ctsn_ack_point ; asoc -> adv_peer_ack_point = new -> adv_peer_ack_point ; sctp_ssnmap_clear ( asoc -> ssnmap ) ; sctp_ulpq_flush ( & asoc -> ulpq ) ; asoc -> overall_error_count = 0 ; } else { list_for_each_entry ( trans, & new -> peer. transport_addr_list, transports ) { if (! sctp_assoc_lookup_paddr ( asoc, & trans -> ipaddr ) ) sctp_assoc_add_peer ( asoc, & trans -> ipaddr, GFP_ATOMIC, trans -> state ) ; } asoc -> ctsn_ack_point = asoc -> next_tsn - 1 ; asoc -> adv_peer_ack_point = asoc -> ctsn_

Fix:
<S2SV_ModStart> -> peer. auth_capable = new -> peer. auth_capable ; asoc -> peer.
Buggy code:
 static enum ofperr parse_group_prop_ntr_selection_method ( struct ofpbuf * payload, enum ofp11_group_type group_type, enum ofp15_group_mod_command group_cmd, struct ofputil_group_props * gp ) { struct ntr_group_prop_selection_method * prop = payload -> data ; size_t fields_len, method_len ; enum ofperr error ; switch ( group_type ) { case OFPGT11_SELECT : break ; case OFPGT11_ALL : case OFPGT11_INDIRECT : case OFPGT11_FF : OFPPROP_LOG ( & bad_ofmsg_rl, false, "ntr   selection   method   property   is   " "only   allowed   for   select   groups" ) ; return OFPERR_OFPBPC_BAD_VALUE ; default : <START_BUG> OVS_NOT_REACHED ( ) ; <END_BUG> } switch ( group_cmd ) { case OFPGC15_ADD : case OFPGC15_MODIFY : case OFPGC15_ADD_OR_MOD : break ; case OFPGC15_DELETE : case OFPGC15_INSERT_BUCKET : case OFPGC15_REMOVE_BUCKET : OFPPROP_LOG ( & bad_ofmsg_rl, false, "ntr   selection   method   property   is   " "only   allowed   for   add   and   delete   group   modifications" ) ; return OFPERR_OFPBPC_BAD_VALUE ; default :  OVS_NOT_REACHED ( ) ; <START_BUG> } if ( payload -> size < sizeof * prop ) { OFPPROP_LOG ( & bad_ofmsg_rl, false, "ntr   selection   method   property   " "length   %u   is   not   valid", payload -> size ) ; return OFPERR_OFPBPC_BAD_LEN ; } method_len = strnlen ( prop -> selection_method, NTR_MAX_SELECTION_METHOD_LEN ) ; if ( method_len == NTR_MAX_SELECTION_METHOD_LEN ) { OFPPROP_LOG ( & bad_ofmsg_rl, false, "ntr   selection   method   is   not   null   terminated" ) ; return<END_BUG>

Fix:
<S2SV_ModStart> ; default : return OFPERR_OFPGMFC_BAD_TYPE <S2SV_ModEnd> ; } switch <S2SV_ModStart> ; default : return OFPERR_OFPGMFC_BAD_COMMAND <S2SV_ModEnd> ; } if
Buggy code:
 static int find_source_vc ( char * * ret_path, unsigned * ret_idx ) { _cleanup_free_ char * path = NULL ; int r, err = 0 ; unsigned i ; path = new ( char, sizeof ( "//dev//tty63" ) ) ; if (! path ) return log_oom ( ) ; for ( i = 1 ; i <= 63 ; i ++ ) { _cleanup_close_ int fd = - 1 ; r = verify_vc_allocation ( i ) ; if ( r < 0 ) { if (! err ) err = - r ; continue ; } sprintf ( path, "//dev//tty%u", i ) ; fd = open_terminal ( path, O_RDWR | O_CLOEXEC | O_NOCTTY ) ; if ( fd < 0 ) { if (! err ) err = - fd ; continue ; } <START_BUG> r = verify_vc_kbmode ( fd ) ; <END_BUG> if ( r < 0 ) { if (! err ) err = - r ; continue ; } * ret_idx = i ; * ret_path = TAKE_PTR ( path ) ; return TAKE_FD ( fd ) ; } return log_error_errno ( err, "No   usable   source   console   found:   %m" ) ; }

Fix:
<S2SV_ModStart> } r = vt_verify_kbmode <S2SV_ModEnd> ( fd )
Buggy code:
 void vp8_loopfilter_frame ( VP8_COMP * cpi, VP8_COMMON * cm ) { <START_BUG> const FRAME_TYPE frame_type = cm -> frame_type ; <END_BUG> if ( cm -> no_lpf ) { cm -> filter_level = 0 ; } else { struct vpx_usec_timer timer ; vp8_clear_system_state ( ) ; vpx_usec_timer_start ( & timer ) ;  if ( cpi -> sf. auto_filter == 0 ) <START_BUG> vp8cx_pick_filter_level_fast ( cpi -> Source, cpi ) ; <END_BUG> else  <START_BUG> vp8cx_pick_filter_level ( cpi -> Source, cpi ) ; <END_BUG> if ( cm -> filter_level > 0 ) { vp8cx_set_alt_lf_level ( cpi, cm -> filter_level ) ; } vpx_usec_timer_mark ( & timer ) ; cpi -> time_pick_lpf += vpx_usec_timer_elapsed ( & timer ) ; } # if CONFIG_MULTITHREAD if ( cpi -> b_multi_threaded ) sem_post ( & cpi -> h_event_end_lpf ) ; # endif  if ( cm -> filter_level > 0 ) <START_BUG> { vp8_loop_filter_frame ( cm, & cpi -> mb. e_mbd, frame_type ) ; } vp8_yv12_extend_frame_borders ( cm -> frame_to_show ) ; }<END_BUG>

Fix:
<S2SV_ModStart> -> frame_type ; int update_any_ref_buffers = 1 ; if ( cpi -> common. refresh_last_frame == 0 && cpi -> common. refresh_golden_frame == 0 && cpi -> common. refresh_alt_ref_frame == 0 ) { update_any_ref_buffers = 0 ; } <S2SV_ModStart> == 0 ) { # if CONFIG_TEMPORAL_DENOISING if ( cpi -> oxcf. noise_sensitivity && cm -> frame_type!= KEY_FRAME ) { vp8cx_pick_filter_level_fast ( & cpi -> denoiser. yv12_running_avg [ INTRA_FRAME ], cpi ) ; } else { vp8cx_pick_filter_level_fast ( <S2SV_ModEnd> cpi -> Source <S2SV_ModStart> cpi ) ; } # else vp8cx_pick_filter_level_fast ( cpi -> Source, cpi ) ; # endif } else { # if CONFIG_TEMPORAL_DENOISING if ( cpi -> oxcf. noise_sensitivity && cm -> frame_type!= KEY_FRAME ) { vp8cx
Buggy code:
 static int print_prefix ( netdissect_options * ndo, const u_char * prefix, u_int max_length ) { int plenbytes ; char buf [ sizeof ( "xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:://128" ) ] ; if ( prefix [ 0 ] >= 96 && max_length >= IPV4_MAPPED_HEADING_LEN + 1 && is_ipv4_mapped_address ( & prefix [ 1 ] ) ) { struct in_addr addr ; u_int plen ; plen = prefix [ 0 ] - 96 ; if ( 32 < plen ) return - 1 ; max_length -= 1 ; memset ( & addr, 0, sizeof ( addr ) ) ; plenbytes = ( plen + 7 ) // 8 ; if ( max_length < ( u_int ) plenbytes + IPV4_MAPPED_HEADING_LEN ) return - 3 ; memcpy ( & addr, & prefix [ 1 + IPV4_MAPPED_HEADING_LEN ], plenbytes ) ; if ( plen % 8 ) { ( ( u_char * ) & addr ) [ plenbytes - 1 ] &= ( ( 0xff00 >> ( plen % 8 ) ) & 0xff ) ; } snprintf ( buf, sizeof ( buf ), "%s//%d", ipaddr_string ( ndo, & addr ), plen ) ; plenbytes += 1 + IPV4_MAPPED_HEADING_LEN ; } else { plenbytes = decode_prefix6 ( ndo, prefix, max_length, buf, sizeof ( buf ) ) ; <START_BUG> } <END_BUG> ND_PRINT ( ( ndo, "%s", buf ) ) ; return plenbytes ; }

Fix:
<S2SV_ModStart> ) ) ; if ( plenbytes < 0 ) return plenbytes ;
Buggy code:
 static int em_sysenter ( struct x86_emulate_ctxt * ctxt ) { const struct x86_emulate_ops * ops = ctxt -> ops ; struct desc_struct cs, ss ; u64 msr_data ; u16 cs_sel, ss_sel ; u64 efer = 0 ; ops -> get_msr ( ctxt, MSR_EFER, & efer ) ; if ( ctxt -> mode == X86EMUL_MODE_REAL ) return emulate_gp ( ctxt, 0 ) ; <START_BUG> if ( ( ctxt -> mode == X86EMUL_MODE_PROT32 ) && ( efer & EFER_LMA ) <END_BUG> &&! vendor_intel ( ctxt ) ) return emulate_ud ( ctxt ) ; if ( ctxt -> mode == X86EMUL_MODE_PROT64 ) return X86EMUL_UNHANDLEABLE ; setup_syscalls_segments ( ctxt, & cs, & ss ) ; ops -> get_msr ( ctxt, MSR_IA32_SYSENTER_CS, & msr_data ) ;  switch ( ctxt -> mode ) { <START_BUG> case X86EMUL_MODE_PROT32 : if ( ( msr_data & 0xfffc ) == 0x0 ) return emulate_gp ( ctxt, 0 ) ; <END_BUG> break ;  case X86EMUL_MODE_PROT64 : if ( msr_data == 0x0 ) return emulate_gp ( ctxt, 0 ) ; break ; default : break ; } ctxt -> eflags &= ~ ( EFLG_VM | EFLG_IF ) ; <START_BUG> cs_sel = ( u16 ) msr_data ; <END_BUG> cs_sel &= ~ SELECTOR_RPL_MASK ; ss_sel = cs_sel + 8 ;  ss_sel &= ~ SELECTOR_RPL_MASK ; <START_BUG> <END_BUG> if ( ctxt -> mode == X86EMUL_MODE_PROT64 || ( efer & EFER_LMA ) ) {  cs. d = 0 ; cs. l = 1 ; } ops -> set_segment ( ctxt, cs_sel, & cs, 0, VCPU_SREG_CS ) ; ops -> set_segment ( ctxt, ss_sel, & ss, 0, VCPU_SREG_SS ) ; ops -> get_msr

Fix:
<S2SV_ModStart> ctxt -> mode!= X86EMUL_MODE_PROT64 <S2SV_ModEnd> ) && ( <S2SV_ModStart> msr_data ) ; <S2SV_ModEnd> if ( ( <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> ctxt -> eflags <S2SV_ModStart> u16 ) msr_data & <S2SV_ModEnd> ~ SELECTOR_RPL_MASK ; <S2SV_ModStart> + 8 ; if <S2SV_ModEnd> ( efer & <S2SV_ModStart> efer & EFER_LMA <S2SV_ModEnd> ) { cs <S2SV_ModStart> -> _eip = ( efer & EFER_LMA )? msr_data : ( u32 ) <S2SV_ModStart> VCPU_REGS_RSP ) = ( efer & EFER_LMA )? msr_data : ( u32 )
Buggy code:
 void sink ( int argc, char * * argv ) { static BUF buffer ; struct stat stb ; enum { YES, NO, DISPLAYED } wrerr ; BUF * bp ; off_t i ; size_t j, count ; int amt, exists, first, mask, mode, ofd, omode ; off_t size, statbytes ; int setimes, targisdir, wrerrno = 0 ; char ch, * cp, * np, * targ, * why, * vect [ 1 ], buf [ 2048 ] ; struct timeval tv [ 2 ] ; # define atime tv [ 0 ] # define mtime tv [ 1 ] # define SCREWUP ( str ) do { why = str ; goto screwup ; } while ( 0 ) setimes = targisdir = 0 ; mask = umask ( 0 ) ; if (! pflag ) ( void ) umask ( mask ) ; if ( argc!= 1 ) { run_err ( "ambiguous   target" ) ; exit ( 1 ) ; } targ = * argv ; if ( targetshouldbedirectory ) verifydir ( targ ) ; ( void ) atomicio ( vwrite, remout, "", 1 ) ; if ( stat ( targ, & stb ) == 0 && S_ISDIR ( stb. st_mode ) ) targisdir = 1 ; for ( first = 1 ; ; first = 0 ) { cp = buf ; if ( atomicio ( read, remin, cp, 1 )!= 1 ) return ; if ( * cp ++ == '\\n' ) SCREWUP ( "unexpected   <newline>" ) ; do { if ( atomicio ( read, remin, & ch, sizeof ( ch ) )!= sizeof ( ch ) ) SCREWUP ( "lost   connection" ) ; * cp ++ = ch ; } while ( cp < & buf [ sizeof ( buf ) - 1 ] && ch!= '\\n' ) ; * cp = 0 ; if ( verbose_mode ) fprintf ( stderr, "Sink:   %s", buf ) ; if ( buf [ 0 ] == '\\01' || buf [ 0 ] == '\\02' ) { if ( iamremote == 0 ) ( void ) atomicio ( vwrite, STDERR_FILENO, buf + 1, strlen ( buf + 1 ) ) ; if ( buf [ 0 ] == '\\02' )

Fix:
<S2SV_ModStart> ; if ( * cp == '\\0' || <S2SV_ModEnd> strchr ( cp <S2SV_ModStart> )!= NULL || <S2SV_ModEnd> strcmp ( cp <S2SV_ModStart> ( cp, "." ) == 0 || strcmp ( cp, <S2SV_ModStart> ) == 0 <S2SV_ModEnd> ) { run_err
Buggy code:
 static Sdb * store_versioninfo_gnu_verdef ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { const char * section_name = "" ; const char * link_section_name = "" ; char * end = NULL ; Elf_ ( Shdr ) * link_shdr = NULL ; ut8 dfs [ sizeof ( Elf_ ( Verdef ) ) ] = { 0 } ; Sdb * sdb ; int cnt, i ; if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return false ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; <START_BUG> if ( shdr -> sh_size < 1 ) { <END_BUG> return false ; } Elf_ ( Verdef ) * defs = calloc ( shdr -> sh_size, sizeof ( char ) ) ; if (! defs ) { return false ; } if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( link_shdr && bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! defs ) { bprintf ( "Warning:   Cannot   allocate   memory   (Check   Elf_(Verdef))\\n" ) ; return NULL ; } sdb = sdb_new0 ( ) ; end = ( char * ) defs + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link, 0 ) ; sdb_set ( sdb, "link_section_name", link_section_

Fix:
<S2SV_ModStart> sh_size < 1 || shdr -> sh_size > SIZE_MAX
Buggy code:
 static int msg_parse_fetch ( struct ImapHeader * h, char * s ) { char tmp [ SHORT_STRING ] ; char * ptmp = NULL ; if (! s ) return - 1 ; while ( * s ) { SKIPWS ( s ) ; if ( mutt_str_strncasecmp ( "FLAGS", s, 5 ) == 0 ) { s = msg_parse_flags ( h, s ) ; if (! s ) return - 1 ; } else if ( mutt_str_strncasecmp ( "UID", s, 3 ) == 0 ) { s += 3 ; SKIPWS ( s ) ; if ( mutt_str_atoui ( s, & h -> data -> uid ) < 0 ) return - 1 ; s = imap_next_word ( s ) ; } else if ( mutt_str_strncasecmp ( "INTERNALDATE", s, 12 ) == 0 ) { s += 12 ; SKIPWS ( s ) ; if ( * s!= \'\\"\' ) { mutt_debug ( 1, "bogus   INTERNALDATE   entry:   %s\\n", s ) ; return - 1 ; } s ++ ; ptmp = tmp ; <START_BUG> while ( * s && * s!= \'\\"\' ) <END_BUG> * ptmp ++ = * s ++ ; if ( * s!= \'\\"\' ) return - 1 ; s ++ ; * ptmp = '\\0' ; h -> received = mutt_date_parse_imap ( tmp ) ; } else if ( mutt_str_strncasecmp ( "RFC822.SIZE", s, 11 ) == 0 ) { s += 11 ; SKIPWS ( s ) ; ptmp = tmp ;  while ( isdigit ( ( unsigned char ) * s ) ) <START_BUG> * ptmp ++ = * s ++ ; * ptmp = '\\0' ; if ( mutt_str_atol ( tmp, & h -> content_length ) < 0 ) return - 1 ; } else if ( ( mutt_str_strncasecmp ( "BODY", s, 4 ) == 0 ) || ( mutt_str_strncasecmp ( "RFC822.HEADER", s, 13 ) == 0 ) ) { return - 2 ; } else if ( * s == ')' ) s ++ ; else if ( * s ) { imap_error ( "msg_parse_<END_BUG>

Fix:
<S2SV_ModStart> * s && ( <S2SV_ModStart> s!= \'\\"\' ) && ( ptmp!= ( tmp + sizeof ( tmp ) - 1 ) ) <S2SV_ModStart> ) * s ) && ( ptmp!= ( tmp + sizeof ( tmp ) - 1 )
Buggy code:
 int sfgets ( void ) { struct pollfd pfd ; int pollret ; ssize_t readnb ; signed char seen_r = 0 ; <START_BUG> static size_t scanned ; <END_BUG> static size_t readnbd ; if ( scanned > ( size_t ) 0U ) { readnbd -= scanned ; memmove ( cmd, cmd + scanned, readnbd ) ; scanned = ( size_t ) 0U ; } pfd. fd = clientfd ; # ifdef __APPLE_CC__ pfd. events = POLLIN | POLLERR | POLLHUP ; # else pfd. events = POLLIN | POLLPRI | POLLERR | POLLHUP ; # endif while ( scanned < cmdsize ) { if ( scanned >= readnbd ) { pfd. revents = 0 ; while ( ( pollret = poll ( & pfd, 1U, idletime * 1000UL ) ) < 0 && errno == EINTR ) ; if ( pollret == 0 ) { return - 1 ; } if ( pollret <= 0 || ( pfd. revents & ( POLLERR | POLLHUP | POLLNVAL ) )!= 0 ) { return - 2 ; } if ( ( pfd. revents & ( POLLIN | POLLPRI ) ) == 0 ) { continue ; } if ( readnbd >= cmdsize ) { break ; } # ifdef WITH_TLS if ( tls_cnx!= NULL ) { while ( ( readnb = SSL_read ( tls_cnx, cmd + readnbd, cmdsize - readnbd ) ) < ( ssize_t ) 0 && errno == EINTR ) ; } else # endif { while ( ( readnb = read ( clientfd, cmd + readnbd, cmdsize - readnbd ) ) < ( ssize_t ) 0 && errno == EINTR ) ; } if ( readnb <= ( ssize_t ) 0 ) { return - 2 ; } readnbd += readnb ; if ( readnbd > cmdsize ) { return - 2 ; } } # ifdef RFC_CONFORMANT_LINES if ( seen_r!= 0 ) { # endif if ( cmd [ scanned ] == '\\n' ) { # ifndef RFC_CONFORMANT_LINES if ( seen_r!= 0

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( scanned
Buggy code:
 static int fuse_notify_inval_entry ( struct fuse_conn * fc, unsigned int size, struct fuse_copy_state * cs ) { struct fuse_notify_inval_entry_out outarg ; int err = - ENOMEM ; char * buf ; struct qstr name ; buf = kzalloc ( FUSE_NAME_MAX + 1, GFP_KERNEL ) ; if (! buf ) goto err ; err = - EINVAL ; if ( size < sizeof ( outarg ) ) goto err ; err = fuse_copy_one ( cs, & outarg, sizeof ( outarg ) ) ; if ( err ) goto err ; err = - ENAMETOOLONG ; if ( outarg. namelen > FUSE_NAME_MAX ) goto err ; <START_BUG> name. name = buf ; <END_BUG> name. len = outarg. namelen ;  err = fuse_copy_one ( cs, buf, outarg. namelen + 1 ) ; <START_BUG> if ( err ) goto err ; fuse_copy_finish ( cs ) ; buf [ outarg. namelen ] = 0 ; name. hash = full_name_hash ( name. name, name. len ) ; down_read ( & fc -> killsb ) ; err = - ENOENT ; if ( fc -> sb ) err = fuse_reverse_inval_entry ( fc -> sb, outarg. parent, & name ) ; up_read ( & fc -> killsb ) ; kfree ( buf ) ; return err ; err : kfree ( buf ) ; fuse_copy_finish ( cs ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> goto err ; err = - EINVAL ; if ( size!= sizeof ( outarg ) + <S2SV_ModEnd> outarg. namelen <S2SV_ModStart> + 1 ) goto err ; name. name = buf ; name. len = outarg. namelen ; err = fuse_copy_one ( cs, buf, outarg. namelen + 1 )
Buggy code:
 static long vbg_misc_device_ioctl ( struct file * filp, unsigned int req, unsigned long arg ) { struct vbg_session * session = filp -> private_data ; size_t returned_size, size ; struct vbg_ioctl_hdr hdr ; bool is_vmmdev_req ; int ret = 0 ; void * buf ; if ( copy_from_user ( & hdr, ( void * ) arg, sizeof ( hdr ) ) ) return - EFAULT ; if ( hdr. version!= VBG_IOCTL_HDR_VERSION ) return - EINVAL ; if ( hdr. size_in < sizeof ( hdr ) || ( hdr. size_out && hdr. size_out < sizeof ( hdr ) ) ) return - EINVAL ; size = max ( hdr. size_in, hdr. size_out ) ; if ( _IOC_SIZE ( req ) && _IOC_SIZE ( req )!= size ) return - EINVAL ; if ( size > SZ_16M ) return - E2BIG ; is_vmmdev_req = ( req & ~ IOCSIZE_MASK ) == VBG_IOCTL_VMMDEV_REQUEST ( 0 ) || req == VBG_IOCTL_VMMDEV_REQUEST_BIG ; if ( is_vmmdev_req ) buf = vbg_req_alloc ( size, VBG_IOCTL_HDR_TYPE_DEFAULT ) ; else buf = kmalloc ( size, GFP_KERNEL ) ; if (! buf ) return - ENOMEM ; <START_BUG> if ( copy_from_user ( buf, ( void * ) arg, hdr. size_in ) ) { <END_BUG> ret = - EFAULT ; goto out ; } if ( hdr. size_in < size ) memset ( buf + hdr. size_in, 0, size - hdr. size_in ) ; ret = vbg_core_ioctl ( session, req, buf ) ; if ( ret ) goto out ; returned_size = ( ( struct vbg_ioctl_hdr * ) buf ) -> size_out ; if ( returned_size > size ) { vbg_debug ( "%s:   too   much   output   data   %zu   >   %zu\\n", __func__, returned_

Fix:
<S2SV_ModStart> - ENOMEM ; * ( ( struct vbg_ioctl_hdr * ) buf ) = hdr ; <S2SV_ModStart> copy_from_user ( buf + sizeof ( hdr ) <S2SV_ModStart> * ) arg + sizeof ( hdr ), hdr. size_in - sizeof ( hdr ) <S2SV_ModEnd> ) ) {