nus-yam/ex-repair huggingface dataset:
Buggy code:
 int obj2ast_withitem ( PyObject * obj, withitem_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; expr_ty context_expr ; expr_ty optional_vars ; <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_context_expr ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_context_expr ) ; <START_BUG> if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_expr ( tmp, & context_expr, arena ) ;  if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <START_BUG> } else { <END_BUG> PyErr_SetString ( PyExc_TypeError, "required   field   \\"context_expr\\"   missing   from   withitem" ) ; return 1 ; } if ( exists_not_none ( obj, & PyId_optional_vars ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_optional_vars ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_expr ( tmp, & optional_vars, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { optional_vars = NULL ; } * out = withitem ( context_expr, optional_vars, arena ) ; return 0 ; failed : Py_XDECREF ( tmp ) ; return 1 ; }

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_context_expr, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"context_expr\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> withitem" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; res = obj2ast_expr ( tmp, & context_expr, arena ) ; if ( res!= 0 <S2SV_ModEnd> ) goto failed <S2SV_ModStart> goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id ( obj, & PyId_optional_vars, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; optional_vars = NULL ; } else { int res ; <S2SV_ModStart> tmp, & optional_vars <S2SV_ModEnd>, arena ) <S2SV_ModStart> ) ; } <S2SV_ModEnd> * out =
Buggy code:
 static int save_dev ( blkid_dev dev, FILE * file ) { struct list_head * p ; if (! dev || dev -> bid_name [ 0 ]!= '//' ) return 0 ; DBG ( SAVE, ul_debug ( "device   %s,   type   %s", dev -> bid_name, dev -> bid_type? dev -> bid_type : "(null)" ) ) ; fprintf ( file, "<device   DEVNO=\\"0x%04lx\\"   TIME=\\"%ld.%ld\\"", ( unsigned long ) dev -> bid_devno, ( long ) dev -> bid_time, ( long ) dev -> bid_utime ) ; if ( dev -> bid_pri ) fprintf ( file, "   PRI=\\"%d\\"", dev -> bid_pri ) ; list_for_each ( p, & dev -> bid_tags ) { blkid_tag tag = list_entry ( p, struct blkid_struct_tag, bit_tags ) ; <START_BUG> fprintf ( file, "   %s=\\"%s\\"", tag -> bit_name, tag -> bit_val ) ; <END_BUG> } fprintf ( file, ">%s<//device>\\n", dev -> bid_name ) ; return 0 ; }

Fix:
<S2SV_ModStart> bit_tags ) ; fputc ('<S2SV_blank> ', file ) ; fputs ( <S2SV_ModEnd> tag -> bit_name <S2SV_ModStart> -> bit_name, file ) ; fputc ( '=', file ) ; save_quoted ( <S2SV_ModStart> tag -> bit_val, file
Buggy code:
 SPL_METHOD ( Array, unserialize ) { spl_array_object * intern = ( spl_array_object * ) zend_object_store_get_object ( getThis ( ) TSRMLS_CC ) ; char * buf ; int buf_len ; const unsigned char * p, * s ; php_unserialize_data_t var_hash ; zval * pmembers, * pflags = NULL ; HashTable * aht ; long flags ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "s", & buf, & buf_len ) == FAILURE ) { return ; } if ( buf_len == 0 ) { return ; } aht = spl_array_get_hash_table ( intern, 0 TSRMLS_CC ) ; if ( aht -> nApplyCount > 0 ) { zend_error ( E_WARNING, "Modification   of   ArrayObject   during   sorting   is   prohibited" ) ; return ; } s = p = ( const unsigned char * ) buf ; PHP_VAR_UNSERIALIZE_INIT ( var_hash ) ; if ( * p!= 'x' || * ++ p!= ':' ) { goto outexcept ; } ++ p ; ALLOC_INIT_ZVAL ( pflags ) ; if (! php_var_unserialize ( & pflags, & p, s + buf_len, & var_hash TSRMLS_CC ) || Z_TYPE_P ( pflags )!= IS_LONG ) { goto outexcept ; } var_push_dtor ( & var_hash, & pflags ) ; -- p ; flags = Z_LVAL_P ( pflags ) ; if ( * p!= ';' ) { goto outexcept ; } ++ p ; if ( * p!='m' ) { if ( * p!= 'a' && * p!= 'O' && * p!= 'C' && * p!= 'r' ) { goto outexcept ; } intern -> ar_flags &= ~ SPL_ARRAY_CLONE_MASK ; intern -> ar_flags |= flags & SPL_ARRAY_CLONE_MASK ; zval_ptr_dtor ( & intern -> array ) ; ALLOC_INIT_ZVAL ( intern -> array ) ; <START_BUG> if (! php_var_unserialize ( & intern<END_BUG>

Fix:
<S2SV_ModStart> var_hash TSRMLS_CC ) || ( Z_TYPE_P ( intern -> array )!= IS_ARRAY && Z_TYPE_P ( intern -> array )!= IS_OBJECT ) ) { zval_ptr_dtor ( & intern -> array ) ; <S2SV_ModEnd> goto outexcept ;
Buggy code:
 jpc_ms_t * jpc_getms ( jas_stream_t * in, jpc_cstate_t * cstate ) { jpc_ms_t * ms ; jpc_mstabent_t * mstabent ; jas_stream_t * tmpstream ; if (! ( ms = jpc_ms_create ( 0 ) ) ) { return 0 ; } if ( jpc_getuint16 ( in, & ms -> id ) || ms -> id < JPC_MS_MIN || ms -> id > JPC_MS_MAX ) { jpc_ms_destroy ( ms ) ; return 0 ; } mstabent = jpc_mstab_lookup ( ms -> id ) ; ms -> ops = & mstabent -> ops ; if ( JPC_MS_HASPARMS ( ms -> id ) ) { if ( jpc_getuint16 ( in, & ms -> len ) || ms -> len < 3 ) { jpc_ms_destroy ( ms ) ; return 0 ; } ms -> len -= 2 ; if (! ( tmpstream = jas_stream_memopen ( 0, 0 ) ) ) { jpc_ms_destroy ( ms ) ; return 0 ; } if ( jas_stream_copy ( tmpstream, in, ms -> len ) || jas_stream_seek ( tmpstream, 0, SEEK_SET ) < 0 ) { jas_stream_close ( tmpstream ) ; jpc_ms_destroy ( ms ) ; return 0 ; } if ( ( * ms -> ops -> getparms ) ( ms, cstate, tmpstream ) ) { ms -> ops = 0 ; jpc_ms_destroy ( ms ) ; jas_stream_close ( tmpstream ) ; return 0 ; } if ( jas_getdbglevel ( ) > 0 ) { jpc_ms_dump ( ms, stderr ) ; } <START_BUG> if ( JAS_CAST ( ulong, jas_stream_tell ( tmpstream ) )!= ms -> len ) { <END_BUG> jas_eprintf ( "warning:   trailing   garbage   in   marker   segment   (%ld   bytes)\\n", ms -> len - jas_stream_tell ( tmpstream ) ) ; } jas_stream_close ( tmpstream ) ; } else

Fix:
<S2SV_ModStart> ( JAS_CAST ( jas_ulong <S2SV_ModEnd>, jas_stream_tell (
Buggy code:
 long fuse_do_ioctl ( struct file * file, unsigned int cmd, unsigned long arg, unsigned int flags ) { struct fuse_file * ff = file -> private_data ; struct fuse_conn * fc = ff -> fc ; struct fuse_ioctl_in inarg = {. fh = ff -> fh,. cmd = cmd,. arg = arg,. flags = flags } ; struct fuse_ioctl_out outarg ; struct fuse_req * req = NULL ; struct page * * pages = NULL ; struct page * iov_page = NULL ; struct iovec * in_iov = NULL, * out_iov = NULL ; unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages ; size_t in_size, out_size, transferred ; int err ; BUILD_BUG_ON ( sizeof ( struct iovec ) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE ) ; err = - ENOMEM ; pages = kzalloc ( sizeof ( pages [ 0 ] ) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL ) ; iov_page = alloc_page ( GFP_KERNEL ) ; if (! pages ||! iov_page ) goto out ; if (! ( flags & FUSE_IOCTL_UNRESTRICTED ) ) { struct iovec * iov = page_address ( iov_page ) ; iov -> iov_base = ( void __user * ) arg ; iov -> iov_len = _IOC_SIZE ( cmd ) ; if ( _IOC_DIR ( cmd ) & _IOC_WRITE ) { in_iov = iov ; in_iovs = 1 ; } if ( _IOC_DIR ( cmd ) & _IOC_READ ) { out_iov = iov ; out_iovs = 1 ; } } retry : inarg. in_size = in_size = iov_length ( in_iov, in_iovs ) ; inarg. out_size = out_size = iov_length ( out_iov, out_iovs ) ; out_size = max_t ( size_t, out_size, PAGE_

Fix:
<S2SV_ModStart> + in_iovs ; err = fuse_verify_ioctl_iov ( in_iov, in_iovs ) ; if ( err ) goto out ; err = fuse_verify_ioctl_iov ( out_iov, out_iovs ) ; if ( err ) goto out ;
Buggy code:
 static int get_endpoints ( struct usbtest_dev * dev, struct usb_interface * intf ) { int tmp ; struct usb_host_interface * alt ; struct usb_host_endpoint * in, * out ; struct usb_host_endpoint * iso_in, * iso_out ; struct usb_host_endpoint * int_in, * int_out ; struct usb_device * udev ; for ( tmp = 0 ; tmp < intf -> num_altsetting ; tmp ++ ) { unsigned ep ; in = out = NULL ; iso_in = iso_out = NULL ; int_in = int_out = NULL ; alt = intf -> altsetting + tmp ; if ( override_alt >= 0 && override_alt!= alt -> desc. bAlternateSetting ) continue ; for ( ep = 0 ; ep < alt -> desc. bNumEndpoints ; ep ++ ) { struct usb_host_endpoint * e ; int edi ; e = alt -> endpoint + ep ; edi = usb_endpoint_dir_in ( & e -> desc ) ; switch ( usb_endpoint_type ( & e -> desc ) ) { case USB_ENDPOINT_XFER_BULK : endpoint_update ( edi, & in, & out, e ) ; continue ; case USB_ENDPOINT_XFER_INT : if ( dev -> info -> intr ) endpoint_update ( edi, & int_in, & int_out, e ) ; continue ; case USB_ENDPOINT_XFER_ISOC : if ( dev -> info -> iso ) endpoint_update ( edi, & iso_in, & iso_out, e ) ; default : continue ; } } if ( ( in && out ) || iso_in || iso_out || int_in || int_out ) goto found ; } return - EINVAL ; found : udev = testdev_to_usbdev ( dev ) ; dev -> info -> alt = alt -> desc. bAlternateSetting ; if ( alt -> desc. bAlternateSetting!= 0 ) { tmp = usb_set_interface ( udev, alt -> desc. bInterfaceNumber, alt -> desc. bAlternateSetting ) ; if ( tmp < 0 ) return tmp ; } <START_BUG> if ( in ) { <END_BUG> dev -> in_pipe = usb_rcvbulkpipe ( udev, in -> desc. bEndpointAddress & USB_

Fix:
<S2SV_ModStart> ( in ) <S2SV_ModEnd> dev -> in_pipe <S2SV_ModStart> USB_ENDPOINT_NUMBER_MASK ) ; if ( out ) <S2SV_ModStart> USB_ENDPOINT_NUMBER_MASK ) ; <S2SV_ModEnd> if ( iso_in
Buggy code:
 static av_always_inline int vp78_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt, int is_vp7 ) { VP8Context * s = avctx -> priv_data ; int ret, i, referenced, num_jobs ; enum AVDiscard skip_thresh ; <START_BUG> VP8Frame * av_uninit ( curframe ), * prev_frame ; <END_BUG> if ( is_vp7 ) ret = vp7_decode_frame_header ( s, avpkt -> data, avpkt -> size ) ; else ret = vp8_decode_frame_header ( s, avpkt -> data, avpkt -> size ) ; if ( ret < 0 ) goto err ; prev_frame = s -> framep [ VP56_FRAME_CURRENT ] ; referenced = s -> update_last || s -> update_golden == VP56_FRAME_CURRENT || s -> update_altref == VP56_FRAME_CURRENT ; skip_thresh =! referenced? AVDISCARD_NONREF :! s -> keyframe? AVDISCARD_NONKEY : AVDISCARD_ALL ; if ( avctx -> skip_frame >= skip_thresh ) { s -> invisible = 1 ; memcpy ( & s -> next_framep [ 0 ], & s -> framep [ 0 ], sizeof ( s -> framep [ 0 ] ) * 4 ) ; goto skip_decode ; } s -> deblock_filter = s -> filter. level && avctx -> skip_loop_filter < skip_thresh ; for ( i = 0 ; i < 5 ; i ++ ) if ( s -> frames [ i ]. tf. f -> data [ 0 ] && & s -> frames [ i ]!= prev_frame && & s -> frames [ i ]!= s -> framep [ VP56_FRAME_PREVIOUS ] && & s -> frames [ i ]!= s -> framep [ VP56_FRAME_GOLDEN ] && & s -> frames [ i ]!= s -> framep [ VP56_FRAME_GOLDEN2 ] ) vp8_release_frame ( s, & s -> frames [ i ] ) ; curframe = s -> framep [ VP56_FRAME_CURRENT ] = vp8_find_free_

Fix:
<S2SV_ModStart>, * prev_frame ; av_assert0 ( avctx -> pix_fmt == AV_PIX_FMT_YUVA420P || avctx -> pix_fmt == AV_PIX_FMT_YUV420P )
Buggy code:
 static void init_once ( void * foo ) { struct ext4_inode_info * ei = ( struct ext4_inode_info * ) foo ; INIT_LIST_HEAD ( & ei -> i_orphan ) ; init_rwsem ( & ei -> xattr_sem ) ; init_rwsem ( & ei -> i_data_sem ) ; <START_BUG> inode_init_once ( & ei -> vfs_inode ) ; <END_BUG> }

Fix:
<S2SV_ModStart> i_data_sem ) ; init_rwsem ( & ei -> i_mmap_sem ) ;
Buggy code:
 static int closeVirtualHostDirective ( MaState * state, cchar * key, cchar * value ) { HttpEndpoint * endpoint ; char * address, * ip, * addresses, * tok ; int port ; if ( state -> enabled ) { if ( state -> endpoints && * state -> endpoints ) { <START_BUG> addresses = state -> endpoints ; <END_BUG>  while ( ( address = stok ( addresses, "   \\t,", & tok ) )!= 0 ) { <START_BUG> addresses = 0 ; mprParseSocketAddress ( address, & ip, & port, NULL, - 1 ) ; if ( ( endpoint = httpLookupEndpoint ( ip, port ) ) == 0 ) { mprLog ( "error   appweb   config", 0, "Cannot   find   listen   directive   for   virtual   host   %s", address ) ; return MPR_ERR_BAD_SYNTAX ; } else { httpAddHostToEndpoint ( endpoint, state -> host ) ; } } } else { httpAddHostToEndpoints ( state -> host ) ; } } closeDirective ( state, key, value ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> endpoints ) { for ( addresses = sclone ( <S2SV_ModEnd> state -> endpoints <S2SV_ModStart> state -> endpoints ) ; <S2SV_ModEnd> ( address = <S2SV_ModStart> )!= 0 ; addresses = tok ) { <S2SV_ModEnd> mprParseSocketAddress ( address
Buggy code:
 void mwifiex_set_wmm_params ( struct mwifiex_private * priv, struct mwifiex_uap_bss_param * bss_cfg, struct cfg80211_ap_settings * params ) { const u8 * vendor_ie ; const u8 * wmm_ie ; u8 wmm_oui [ ] = { 0x00, 0x50, 0xf2, 0x02 } ; vendor_ie = cfg80211_find_vendor_ie ( WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WMM, params -> beacon. tail, params -> beacon. tail_len ) ; if ( vendor_ie ) { wmm_ie = vendor_ie ; <START_BUG> memcpy ( & bss_cfg -> wmm_info, wmm_ie + <END_BUG>  sizeof ( struct ieee_types_header ), * ( wmm_ie + 1 ) ) ; <START_BUG> priv -> wmm_enabled = 1 ; } else { memset ( & bss_cfg -> wmm_info, 0, sizeof ( bss_cfg -> wmm_info ) ) ; memcpy ( & bss_cfg -> wmm_info. oui, wmm_oui, sizeof ( wmm_oui ) ) ; bss_cfg -> wmm_info. subtype = MWIFIEX_WMM_SUBTYPE ; bss_cfg -> wmm_info. version = MWIFIEX_WMM_VERSION ; priv -> wmm_enabled = 0 ; } bss_cfg -> qos_info = 0x00 ; return ; }<END_BUG>

Fix:
<S2SV_ModStart> = vendor_ie ; if ( <S2SV_ModEnd> * ( wmm_ie <S2SV_ModStart> + 1 ) > sizeof ( struct mwifiex_types_wmm_info ) ) return ; memcpy ( & bss_cfg -> wmm_info, wmm_ie + sizeof ( struct ieee_types_header ), * ( wmm_ie + 1 )
Buggy code:
 static ssize_t hfi1_file_write ( struct file * fp, const char __user * data, size_t count, loff_t * offset ) { const struct hfi1_cmd __user * ucmd ; struct hfi1_filedata * fd = fp -> private_data ; struct hfi1_ctxtdata * uctxt = fd -> uctxt ; struct hfi1_cmd cmd ; struct hfi1_user_info uinfo ; struct hfi1_tid_info tinfo ; unsigned long addr ; ssize_t consumed = 0, copy = 0, ret = 0 ; void * dest = NULL ; __u64 user_val = 0 ; int uctxt_required = 1 ; int must_be_root = 0 ; <START_BUG> if ( count < sizeof ( cmd ) ) { <END_BUG> ret = - EINVAL ; goto bail ; } ucmd = ( const struct hfi1_cmd __user * ) data ; if ( copy_from_user ( & cmd, ucmd, sizeof ( cmd ) ) ) { ret = - EFAULT ; goto bail ; } consumed = sizeof ( cmd ) ; switch ( cmd. type ) { case HFI1_CMD_ASSIGN_CTXT : uctxt_required = 0 ; copy = sizeof ( uinfo ) ; dest = & uinfo ; break ; case HFI1_CMD_SDMA_STATUS_UPD : case HFI1_CMD_CREDIT_UPD : copy = 0 ; break ; case HFI1_CMD_TID_UPDATE : case HFI1_CMD_TID_FREE : case HFI1_CMD_TID_INVAL_READ : copy = sizeof ( tinfo ) ; dest = & tinfo ; break ; case HFI1_CMD_USER_INFO : case HFI1_CMD_RECV_CTRL : case HFI1_CMD_POLL_TYPE : case HFI1_CMD_ACK_EVENT : case HFI1_CMD_CTXT_INFO : case HFI1_CMD_SET_PKEY : case HFI1_CMD_CTXT_RESET : copy = 0 ; user_val = cmd. addr ; break ; case HFI1_CMD_EP_INFO : case HFI1_CMD_EP_ERASE_CHIP : case HFI1_CMD_EP

Fix:
<S2SV_ModStart> ; if ( WARN_ON_ONCE (! ib_safe_file_access ( fp ) ) ) return - EACCES ; if (
Buggy code:
 void inet_sock_destruct ( struct sock * sk ) { struct inet_sock * inet = inet_sk ( sk ) ; __skb_queue_purge ( & sk -> sk_receive_queue ) ; __skb_queue_purge ( & sk -> sk_error_queue ) ; sk_mem_reclaim ( sk ) ; if ( sk -> sk_type == SOCK_STREAM && sk -> sk_state!= TCP_CLOSE ) { pr_err ( "Attempt   to   release   TCP   socket   in   state   %d   %p\\n", sk -> sk_state, sk ) ; return ; } if (! sock_flag ( sk, SOCK_DEAD ) ) { pr_err ( "Attempt   to   release   alive   inet   socket   %p\\n", sk ) ; return ; } WARN_ON ( atomic_read ( & sk -> sk_rmem_alloc ) ) ; WARN_ON ( atomic_read ( & sk -> sk_wmem_alloc ) ) ; WARN_ON ( sk -> sk_wmem_queued ) ; WARN_ON ( sk -> sk_forward_alloc ) ; <START_BUG> kfree ( inet -> opt ) ; <END_BUG> dst_release ( rcu_dereference_check ( sk -> sk_dst_cache, 1 ) ) ; sk_refcnt_debug_dec ( sk ) ; }

Fix:
<S2SV_ModStart> ; kfree ( rcu_dereference_protected ( inet -> inet_opt, 1 ) <S2SV_ModEnd> ) ; dst_release
Buggy code:
 int jp2_box_put ( jp2_box_t * box, jas_stream_t * out ) { jas_stream_t * tmpstream ; bool extlen ; bool dataflag ; tmpstream = 0 ; dataflag =! ( box -> info -> flags & ( JP2_BOX_SUPER | JP2_BOX_NODATA ) ) ; if ( dataflag ) { if (! ( tmpstream = jas_stream_memopen ( 0, 0 ) ) ) { goto error ; } if ( box -> ops -> putdata ) { if ( ( * box -> ops -> putdata ) ( box, tmpstream ) ) { goto error ; } } box -> len = jas_stream_tell ( tmpstream ) + JP2_BOX_HDRLEN ( false ) ; jas_stream_rewind ( tmpstream ) ; } extlen = ( box -> len >= ( ( ( uint_fast64_t ) 1 ) << 32 ) )!= 0 ; if ( jp2_putuint32 ( out, extlen? 1 : box -> len ) ) { goto error ; } if ( jp2_putuint32 ( out, box -> type ) ) { goto error ; } if ( extlen ) { if ( jp2_putuint64 ( out, box -> len ) ) { goto error ; } } if ( dataflag ) { <START_BUG> if ( jas_stream_copy ( out, tmpstream, box -> len - JP2_BOX_HDRLEN ( false ) ) ) { <END_BUG> goto error ; } jas_stream_close ( tmpstream ) ; } return 0 ; error : if ( tmpstream ) { jas_stream_close ( tmpstream ) ; } return - 1 ; }

Fix:
<S2SV_ModStart> ) ) { jas_eprintf ( "cannot <S2SV_blank> copy <S2SV_blank> box <S2SV_blank> data\\n" ) ;
Buggy code:
 static krb5_error_code split_der ( asn1buf * buf, uint8_t * const * der, size_t len, taginfo * tag_out ) { krb5_error_code ret ; const uint8_t * contents, * remainder ; size_t clen, rlen ; <START_BUG> ret = get_tag ( * der, len, tag_out, & contents, & clen, & remainder, & rlen ) ; <END_BUG> if ( ret ) return ret ; if ( rlen!= 0 ) return ASN1_BAD_LENGTH ; insert_bytes ( buf, contents, clen ) ; return 0 ; }

Fix:
<S2SV_ModStart>, & rlen, 0
Buggy code:
 static int get_prediction_error ( BLOCK * be, BLOCKD * b ) { unsigned char * sptr ; unsigned char * dptr ; sptr = ( * ( be -> base_src ) + be -> src ) ; dptr = b -> predictor ; <START_BUG> return vp8_get4x4sse_cs ( sptr, be -> src_stride, dptr, 16 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> predictor ; return vpx_get4x4sse_cs <S2SV_ModEnd> ( sptr,
Buggy code:
 void hugetlb_unreserve_pages ( struct inode * inode, long offset, long freed ) { struct hstate * h = hstate_inode ( inode ) ; long chg = region_truncate ( & inode -> i_mapping -> private_list, offset ) ; <START_BUG> spin_lock ( & inode -> i_lock ) ; <END_BUG> inode -> i_blocks -= ( blocks_per_huge_page ( h ) * freed ) ; spin_unlock ( & inode -> i_lock ) ;  hugetlb_put_quota ( inode -> i_mapping, ( chg - freed ) ) ; <START_BUG> hugetlb_acct_memory ( h, - ( chg - freed ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> offset ) ; struct hugepage_subpool * spool = subpool_inode ( inode ) ; <S2SV_ModStart> i_lock ) ; hugepage_subpool_put_pages ( spool <S2SV_ModEnd>, ( chg
Buggy code:
 static void parse_hid_report_descriptor ( struct gtco * device, char * report, int length ) { struct device * ddev = & device -> intf -> dev ; int x, i = 0 ; __u8 prefix ; __u8 size ; __u8 tag ; __u8 type ; __u8 data = 0 ; __u16 data16 = 0 ; __u32 data32 = 0 ; int inputnum = 0 ; __u32 usage = 0 ; __u32 globalval [ TAG_GLOB_MAX ] ; __u32 oldval [ TAG_GLOB_MAX ] ; char maintype = 'x' ; char globtype [ 12 ] ; int indent = 0 ; char indentstr [ 10 ] = "" ; dev_dbg ( ddev, "======>>>>>>PARSE<<<<<<======\\n" ) ; while ( i < length ) { <START_BUG> prefix = report [ i ] ; <END_BUG> i ++ ; size = PREF_SIZE ( prefix ) ; switch ( size ) { case 1 : data = report [ i ] ; break ; case 2 : data16 = get_unaligned_le16 ( & report [ i ] ) ; break ;  case 3 : <START_BUG> size = 4 ; data32 = get_unaligned_le32 ( & report [ i ] ) ; break ; } i += size ; tag = PREF_TAG ( prefix ) ; type = PREF_TYPE ( prefix ) ; switch ( type ) { case TYPE_MAIN : strcpy ( globtype, "" ) ; switch ( tag ) { case TAG_MAIN_INPUT : maintype = 'I' ; if ( data == 2 ) strcpy ( globtype, "Variable" ) ; else if ( data == 3 ) strcpy ( globtype, "Var|Const" ) ; dev_dbg ( ddev, ":::::   Saving   Report:   %d   input   #%d   Max:   0x%X(%d)   Min:0x%X(%d)   of   %d   bits\\n", globalval [ TAG_GLOB_REPORT_ID ], inputnum, globalval [ TAG_GLOB_LOG_MAX ], globalval [ TAG_GLOB_LOG_MAX ], globalval [ TAG_GLOB_LOG_MIN ], globalval [ TAG_GLOB_LOG<END_BUG>

Fix:
<S2SV_ModStart> report [ i ++ ] ; size = ( 1U << PREF_SIZE ( prefix ) ) >> 1 ; if ( i + size > length ) { dev_err ( ddev, "Not <S2SV_blank> enough <S2SV_blank> data <S2SV_blank> (need <S2SV_blank> %d, <S2SV_blank> have <S2SV_blank> %d)\\n", i + size, length ) ; break ; } <S2SV_ModEnd> switch ( size <S2SV_ModStart> break ; case 4 : <S2SV_ModEnd> data32 = get_unaligned_le32
Buggy code:
 static int hidp_setup_hid ( struct hidp_session * session, struct hidp_connadd_req * req ) { struct hid_device * hid ; int err ; session -> rd_data = kzalloc ( req -> rd_size, GFP_KERNEL ) ; if (! session -> rd_data ) return - ENOMEM ; if ( copy_from_user ( session -> rd_data, req -> rd_data, req -> rd_size ) ) { err = - EFAULT ; goto fault ; } session -> rd_size = req -> rd_size ; hid = hid_allocate_device ( ) ; if ( IS_ERR ( hid ) ) { err = PTR_ERR ( hid ) ; goto fault ; } session -> hid = hid ; hid -> driver_data = session ; hid -> bus = BUS_BLUETOOTH ; hid -> vendor = req -> vendor ; hid -> product = req -> product ; hid -> version = req -> version ; hid -> country = req -> country ; <START_BUG> strncpy ( hid -> name, req -> name, 128 ) ; <END_BUG> snprintf ( hid -> phys, sizeof ( hid -> phys ), "%pMR", & bt_sk ( session -> ctrl_sock -> sk ) -> src ) ; snprintf ( hid -> uniq, sizeof ( hid -> uniq ), "%pMR", & bt_sk ( session -> ctrl_sock -> sk ) -> dst ) ; hid -> dev. parent = & session -> conn -> dev ; hid -> ll_driver = & hidp_hid_driver ; hid -> hid_get_raw_report = hidp_get_raw_report ; hid -> hid_output_raw_report = hidp_output_raw_report ; if ( hid_ignore ( hid ) ) { hid_destroy_device ( session -> hid ) ; session -> hid = NULL ; return - ENODEV ; } return 0 ; fault : kfree ( session -> rd_data ) ; session -> rd_data = NULL ; return err ; }

Fix:
<S2SV_ModStart> -> name, sizeof ( req -> name ) - 1 <S2SV_ModEnd> ) ; snprintf
Buggy code:
 static __init int hardware_setup ( void ) { int r = - ENOMEM, i, msr ; rdmsrl_safe ( MSR_EFER, & host_efer ) ; for ( i = 0 ; i < ARRAY_SIZE ( vmx_msr_index ) ; ++ i ) kvm_define_shared_msr ( i, vmx_msr_index [ i ] ) ; vmx_io_bitmap_a = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_io_bitmap_a ) return r ; vmx_io_bitmap_b = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_io_bitmap_b ) goto out ; vmx_msr_bitmap_legacy = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_msr_bitmap_legacy ) goto out1 ; vmx_msr_bitmap_legacy_x2apic = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_msr_bitmap_legacy_x2apic ) goto out2 ; vmx_msr_bitmap_longmode = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_msr_bitmap_longmode ) goto out3 ; vmx_msr_bitmap_longmode_x2apic = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_msr_bitmap_longmode_x2apic ) goto out4 ; if ( nested ) { vmx_msr_bitmap_nested = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_msr_bitmap_nested ) goto out5 ; } vmx_vmread_bitmap = ( unsigned long * ) __get_free_page ( GFP_KERNEL ) ; if (! vmx_vmread_bitmap ) goto out6 ; vmx_vm

Fix:
<S2SV_ModStart> vmx_vpid_bitmap ) ; <S2SV_ModEnd> for ( msr <S2SV_ModStart> 0x83f ) ; <S2SV_ModEnd> if ( enable_ept
Buggy code:
 WORD32 ih264d_start_of_pic ( dec_struct_t * ps_dec, WORD32 i4_poc, pocstruct_t * ps_temp_poc, UWORD16 u2_frame_num, dec_pic_params_t * ps_pps ) { pocstruct_t * ps_prev_poc = & ps_dec -> s_cur_pic_poc ; pocstruct_t * ps_cur_poc = ps_temp_poc ; pic_buffer_t * pic_buf ; ivd_video_decode_op_t * ps_dec_output = ( ivd_video_decode_op_t * ) ps_dec -> pv_dec_out ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; dec_seq_params_t * ps_seq = ps_pps -> ps_sps ; UWORD8 u1_bottom_field_flag = ps_cur_slice -> u1_bottom_field_flag ; UWORD8 u1_field_pic_flag = ps_cur_slice -> u1_field_pic_flag ; high_profile_tools_t s_high_profile ; WORD32 ret ; H264_MUTEX_LOCK ( & ps_dec -> process_disp_mutex ) ; ps_prev_poc -> i4_pic_order_cnt_lsb = ps_cur_poc -> i4_pic_order_cnt_lsb ; ps_prev_poc -> i4_pic_order_cnt_msb = ps_cur_poc -> i4_pic_order_cnt_msb ; ps_prev_poc -> i4_delta_pic_order_cnt_bottom = ps_cur_poc -> i4_delta_pic_order_cnt_bottom ; ps_prev_poc -> i4_delta_pic_order_cnt [ 0 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 0 ] ; ps_prev_poc -> i4_delta_pic_order_cnt [ 1 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 1 ] ; ps_prev_

Fix:
<S2SV_ModStart> = 0 ; ps_dec -> pu4_wt_ofsts = ps_dec -> pu4_wts_ofsts_mat ;
Buggy code:
 static ssize_t parse8BIM ( Image * ifile, Image * ofile ) { char brkused, quoted, * line, * token, * newstr, * name ; int state, next ; unsigned char dataset ; unsigned int recnum ; int inputlen = MagickPathExtent ; MagickOffsetType savedpos, currentpos ; ssize_t savedolen = 0L, outputlen = 0L ; TokenInfo * token_info ; dataset = 0 ; recnum = 0 ; line = ( char * ) AcquireQuantumMemory ( ( size_t ) inputlen, sizeof ( * line ) ) ; if ( line == ( char * ) NULL ) return ( - 1 ) ; newstr = name = token = ( char * ) NULL ; savedpos = 0 ; token_info = AcquireTokenInfo ( ) ; while ( super_fgets ( & line, & inputlen, ifile )!= NULL ) { state = 0 ; next = 0 ; token = ( char * ) AcquireQuantumMemory ( ( size_t ) inputlen, sizeof ( * token ) ) ; if ( token == ( char * ) NULL ) break ; newstr = ( char * ) AcquireQuantumMemory ( ( size_t ) inputlen, sizeof ( * newstr ) ) ; if ( newstr == ( char * ) NULL ) break ; while ( Tokenizer ( token_info, 0, token, ( size_t ) inputlen, line, "", "=", "\\"", 0, & brkused, & next, & quoted ) == 0 ) { if ( state == 0 ) { int state, next ; char brkused, quoted ; state = 0 ; next = 0 ; while ( Tokenizer ( token_info, 0, newstr, ( size_t ) inputlen, token, "", "#", "", 0, & brkused, & next, & quoted ) == 0 ) { switch ( state ) { case 0 : if ( strcmp ( newstr, "8BIM" ) == 0 ) dataset = 255 ; else dataset = ( unsigned char ) StringToLong ( newstr ) ; break ; case 1 : recnum = ( unsigned int ) StringToUnsignedLong ( newstr ) ; break ; case 2 : name = ( char * ) AcquireQuantumMemory ( strlen ( newstr ) + MagickPathExtent, sizeof ( * name ) ) ; if ( name ) (

Fix:
<S2SV_ModStart> ( len -- > 0 <S2SV_ModStart> ( len -- > 0
Buggy code:
 static gdImagePtr gdImageScaleTwoPass ( const gdImagePtr src, const unsigned int new_width, const unsigned int new_height ) { const unsigned int src_width = src -> sx ; const unsigned int src_height = src -> sy ; gdImagePtr tmp_im = NULL ; gdImagePtr dst = NULL ; if ( src_width == new_width && src_height == new_height ) { return gdImageClone ( src ) ; } if (! src -> trueColor ) { gdImagePaletteToTrueColor ( src ) ; } if ( src_width == new_width ) { tmp_im = src ; } else { tmp_im = gdImageCreateTrueColor ( new_width, src_height ) ; if ( tmp_im == NULL ) { return NULL ; } gdImageSetInterpolationMethod ( tmp_im, src -> interpolation_id ) ; _gdScalePass ( src, src_width, tmp_im, new_width, src_height, HORIZONTAL ) ; } if ( src_height == new_height ) { assert ( tmp_im!= src ) ; return tmp_im ; } dst = gdImageCreateTrueColor ( new_width, new_height ) ; if ( dst!= NULL ) { gdImageSetInterpolationMethod ( dst, src -> interpolation_id ) ; _gdScalePass ( tmp_im, src_height, dst, new_height, new_width, VERTICAL ) ; } if ( src!= tmp_im ) { <START_BUG> gdFree ( tmp_im ) ; <END_BUG> } return dst ; }

Fix:
<S2SV_ModStart> tmp_im ) { gdImageDestroy <S2SV_ModEnd> ( tmp_im )
Buggy code:
 static vpx_codec_err_t set_vp8e_config ( VP8_CONFIG * oxcf, vpx_codec_enc_cfg_t cfg, struct vp8_extracfg vp8_cfg, vpx_codec_priv_enc_mr_cfg_t * mr_cfg ) { oxcf -> multi_threaded = cfg. g_threads ; oxcf -> Version = cfg. g_profile ; oxcf -> Width = cfg. g_w ; oxcf -> Height = cfg. g_h ; oxcf -> timebase = cfg. g_timebase ; oxcf -> error_resilient_mode = cfg. g_error_resilient ; switch ( cfg. g_pass ) { case VPX_RC_ONE_PASS : oxcf -> Mode = MODE_BESTQUALITY ; break ; case VPX_RC_FIRST_PASS : oxcf -> Mode = MODE_FIRSTPASS ; break ; case VPX_RC_LAST_PASS : oxcf -> Mode = MODE_SECONDPASS_BEST ; break ; } if ( cfg. g_pass == VPX_RC_FIRST_PASS || cfg. g_pass == VPX_RC_ONE_PASS ) { oxcf -> allow_lag = 0 ; oxcf -> lag_in_frames = 0 ; } else { oxcf -> allow_lag = ( cfg. g_lag_in_frames ) > 0 ; oxcf -> lag_in_frames = cfg. g_lag_in_frames ; } oxcf -> allow_df = ( cfg. rc_dropframe_thresh > 0 ) ; oxcf -> drop_frames_water_mark = cfg. rc_dropframe_thresh ; oxcf -> allow_spatial_resampling = cfg. rc_resize_allowed ; oxcf -> resample_up_water_mark = cfg. rc_resize_up_thresh ; oxcf -> resample_down_water_mark = cfg. rc_resize_down_thresh ; if ( cfg. rc_end_usage == VPX_VBR ) { oxcf -> end_usage = USAGE_LOCAL_FILE_PLAYBACK ; } else if ( cfg. rc_end_usage ==

Fix:
<S2SV_ModStart> ; } # else ( void ) mr_cfg ; # <S2SV_ModStart> vp8_cfg. tuning ; oxcf -> screen_content_mode = vp8_cfg. screen_content_mode
Buggy code:
 static unsigned long vp8_priv_sz ( const vpx_codec_dec_cfg_t * si, vpx_codec_flags_t flags ) { ( void ) si ; <START_BUG> return sizeof ( vpx_codec_alg_priv_t ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) si ; ( void ) flags ;
Buggy code:
 GPLOT * gplotRead ( const char * filename ) { <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> char * rootname, * title, * xlabel, * ylabel, * ignores ; l_int32 outformat, ret, version, ignore ; FILE * fp ; GPLOT * gplot ; PROCNAME ( "gplotRead" ) ; if (! filename ) return ( GPLOT * ) ERROR_PTR ( "filename   not   defined", procName, NULL ) ; if ( ( fp = fopenReadStream ( filename ) ) == NULL ) return ( GPLOT * ) ERROR_PTR ( "stream   not   opened", procName, NULL ) ; ret = fscanf ( fp, "Gplot   Version   %d\\n", & version ) ; if ( ret!= 1 ) { fclose ( fp ) ; return ( GPLOT * ) ERROR_PTR ( "not   a   gplot   file", procName, NULL ) ; } if ( version!= GPLOT_VERSION_NUMBER ) { fclose ( fp ) ; return ( GPLOT * ) ERROR_PTR ( "invalid   gplot   version", procName, NULL ) ; }  ignore = fscanf ( fp, "Rootname:   %s\\n", buf ) ; <START_BUG> rootname = stringNew ( buf ) ; ignore = fscanf ( fp, "Output   format:   %d\\n", & outformat ) ; <END_BUG> ignores = fgets ( buf, L_BUF_SIZE, fp ) ;  title = stringNew ( buf + 7 ) ; title [ strlen ( title ) - 1 ] = '\\0' ; <START_BUG> ignores = fgets ( buf, L_BUF_SIZE, fp ) ; <END_BUG> xlabel = stringNew ( buf + 14 ) ; xlabel [ strlen ( xlabel ) - 1 ] = '\\0' ;  ignores = fgets ( buf, L_BUF_SIZE, fp ) ; <START_BUG> ylabel = stringNew ( buf + 14 ) ; ylabel [ strlen ( ylabel ) - 1 ] = '\\0' ; gplot = gplotCreate ( rootname, outformat, title, xlabel, ylabel ) ; LEPT_FREE ( rootname ) ; LEPT_FREE ( title ) ; LEPT_FREE ( xlabel ) ; LEPT_FREE ( ylabel ) ; if (!<END_BUG>

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( fp, "Rootname: <S2SV_blank> %511s\\n" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( fp, "Commandfile <S2SV_blank> name: <S2SV_blank> %511s\\n" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ( fp, "Output <S2SV_blank> file <S2SV_blank> name: <S2SV_blank> %511s\\n" <S2SV_ModEnd>, buf )
Buggy code:
 static int sh_op ( RAnal * anal, RAnalOp * op, ut64 addr, const ut8 * data, int len ) { ut8 op_MSB, op_LSB ; int ret ; <START_BUG> if (! data ) <END_BUG>  return 0 ; <START_BUG> memset ( op, '\\0', sizeof ( RAnalOp ) ) ; op -> addr = addr ; op -> type = R_ANAL_OP_TYPE_UNK ; op -> jump = op -> fail = - 1 ; op -> ptr = op -> val = - 1 ; op -> size = 2 ; op_MSB = anal -> big_endian? data [ 0 ] : data [ 1 ] ; op_LSB = anal -> big_endian? data [ 1 ] : data [ 0 ] ; ret = first_nibble_decode [ ( op_MSB >> 4 ) & 0x0F ] ( anal, op, ( ut16 ) ( op_MSB << 8 | op_LSB ) ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> (! data || len < 2 ) { <S2SV_ModEnd> return 0 ; <S2SV_ModStart> return 0 ; }
Buggy code:
 static int newkeys_from_blob ( struct sshbuf * m, struct ssh * ssh, int mode ) { struct sshbuf * b = NULL ; struct sshcomp * comp ; struct sshenc * enc ; struct sshmac * mac ; struct newkeys * newkey = NULL ; size_t keylen, ivlen, maclen ; int r ; if ( ( newkey = calloc ( 1, sizeof ( * newkey ) ) ) == NULL ) { r = SSH_ERR_ALLOC_FAIL ; goto out ; } if ( ( r = sshbuf_froms ( m, & b ) )!= 0 ) goto out ; # ifdef DEBUG_PK sshbuf_dump ( b, stderr ) ; # endif enc = & newkey -> enc ; mac = & newkey -> mac ; comp = & newkey -> comp ; if ( ( r = sshbuf_get_cstring ( b, & enc -> name, NULL ) )!= 0 || ( r = sshbuf_get ( b, & enc -> cipher, sizeof ( enc -> cipher ) ) )!= 0 || ( r = sshbuf_get_u32 ( b, ( u_int * ) & enc -> enabled ) )!= 0 || ( r = sshbuf_get_u32 ( b, & enc -> block_size ) )!= 0 || ( r = sshbuf_get_string ( b, & enc -> key, & keylen ) )!= 0 || ( r = sshbuf_get_string ( b, & enc -> iv, & ivlen ) )!= 0 ) goto out ; if ( cipher_authlen ( enc -> cipher ) == 0 ) { if ( ( r = sshbuf_get_cstring ( b, & mac -> name, NULL ) )!= 0 ) goto out ; if ( ( r = mac_setup ( mac, mac -> name ) )!= 0 ) goto out ; if ( ( r = sshbuf_get_u32 ( b, ( u_int * ) & mac -> enabled ) )!= 0 || ( r = sshbuf_get_string ( b, & mac -> key, & maclen ) )!= 0 ) goto out ; if ( maclen > mac -> key_len ) { r = SSH_ERR_INVALID_FORMAT ; goto out ; } mac -> key_len = maclen ; } <START_BUG> if ( ( r = sshbuf<END_BUG>

Fix:
<S2SV_ModStart> comp -> type <S2SV_ModEnd> ) )!=
Buggy code:
 static void preinit_thread ( lua_State * L, global_State * g ) { G ( L ) = g ; L -> stack = NULL ; L -> ci = NULL ; L -> nci = 0 ; L -> stacksize = 0 ; L -> twups = L ; L -> errorJmp = NULL ; L -> hook = NULL ; L -> hookmask = 0 ; L -> basehookcount = 0 ; L -> allowhook = 1 ; resethookcount ( L ) ; L -> openupval = NULL ; L -> status = LUA_OK ; L -> errfunc = 0 ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> = 0 ; L -> oldpc = 0 ;
Buggy code:
 static int adjust_scalar_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, struct bpf_reg_state * dst_reg, struct bpf_reg_state src_reg ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; bool src_known, dst_known ; s64 smin_val, smax_val ; u64 umin_val, umax_val ; <START_BUG> u64 insn_bitness = ( BPF_CLASS ( insn -> code ) == BPF_ALU64 )? 64 : 32 ; <END_BUG> if ( insn_bitness == 32 ) { coerce_reg_to_size ( dst_reg, 4 ) ; coerce_reg_to_size ( & src_reg, 4 ) ; } smin_val = src_reg. smin_value ; smax_val = src_reg. smax_value ; umin_val = src_reg. umin_value ; umax_val = src_reg. umax_value ; src_known = tnum_is_const ( src_reg. var_off ) ; dst_known = tnum_is_const ( dst_reg -> var_off ) ; if ( ( src_known && ( smin_val!= smax_val || umin_val!= umax_val ) ) || smin_val > smax_val || umin_val > umax_val ) { __mark_reg_unknown ( dst_reg ) ; return 0 ; } if (! src_known && opcode!= BPF_ADD && opcode!= BPF_SUB && opcode!= BPF_AND ) { __mark_reg_unknown ( dst_reg ) ; return 0 ; } switch ( opcode ) { case BPF_ADD :  if ( signed_add_overflows ( dst_reg -> smin_value, smin_val ) || <START_BUG> signed_add_overflows ( dst_reg -> smax_value, smax_val ) ) { dst_reg -> smin_value = S64_MIN ; dst_reg -> smax_value = S64_MAX ; } else { dst_reg -> smin_value += smin_val<END_BUG>

Fix:
<S2SV_ModStart> 64 : 32 ; u32 dst = insn -> dst_reg ; int ret <S2SV_ModStart> case BPF_ADD : ret = sanitize_val_alu ( env, insn ) ; if ( ret < 0 ) { verbose ( env, "R%d <S2SV_blank> tried <S2SV_blank> to <S2SV_blank> add <S2SV_blank> from <S2SV_blank> different <S2SV_blank> pointers <S2SV_blank> or <S2SV_blank> scalars\\n", dst ) ; return ret ; } <S2SV_ModStart> case BPF_SUB : ret = sanitize_val_alu ( env, insn ) ; if ( ret < 0 ) { verbose ( env, "R%d <S2SV_blank> tried <S2SV_blank> to <S2SV_blank> sub <S2SV_blank> from <S2SV_blank> different <S2SV_blank> pointers <S2SV_blank> or <S2SV_blank> scalars\\n", dst ) ; return ret ; }
Buggy code:
 static void put_ucounts ( struct ucounts * ucounts ) { unsigned long flags ; <START_BUG> if ( atomic_dec_and_test ( & ucounts -> count ) ) { <END_BUG> spin_lock_irqsave ( & ucounts_lock, flags ) ;  hlist_del_init ( & ucounts -> node ) ; <START_BUG> spin_unlock_irqrestore ( & ucounts_lock, flags ) ; kfree ( ucounts ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> long flags ; <S2SV_ModEnd> spin_lock_irqsave ( & <S2SV_ModStart> flags ) ; ucounts -> count -= 1 ; if (! ucounts -> count ) <S2SV_ModStart> -> node ) ; else ucounts = NULL <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int l2cap_parse_conf_req ( struct sock * sk, void * data ) { struct l2cap_pinfo * pi = l2cap_pi ( sk ) ; struct l2cap_conf_rsp * rsp = data ; void * ptr = rsp -> data ; void * req = pi -> conf_req ; int len = pi -> conf_len ; int type, hint, olen ; unsigned long val ; struct l2cap_conf_rfc rfc = {. mode = L2CAP_MODE_BASIC } ; u16 mtu = L2CAP_DEFAULT_MTU ; u16 result = L2CAP_CONF_SUCCESS ; BT_DBG ( "sk   %p", sk ) ; while ( len >= L2CAP_CONF_OPT_SIZE ) { len -= l2cap_get_conf_opt ( & req, & type, & olen, & val ) ; hint = type & L2CAP_CONF_HINT ; type &= L2CAP_CONF_MASK ; switch ( type ) { case L2CAP_CONF_MTU : mtu = val ; break ; case L2CAP_CONF_FLUSH_TO : pi -> flush_to = val ; break ; case L2CAP_CONF_QOS : break ; case L2CAP_CONF_RFC : if ( olen == sizeof ( rfc ) ) memcpy ( & rfc, ( void * ) val, olen ) ; break ; default : if ( hint ) break ; result = L2CAP_CONF_UNKNOWN ; * ( ( u8 * ) ptr ++ ) = type ; break ; } } <START_BUG> if ( result == L2CAP_CONF_SUCCESS ) { <END_BUG>  if ( rfc. mode == L2CAP_MODE_BASIC ) { <START_BUG> <END_BUG> if ( mtu < pi -> omtu )  result = L2CAP_CONF_UNACCEPT ; <START_BUG> else { <END_BUG> pi -> omtu = mtu ; pi -> conf_state |= L2CAP_CONF_OUTPUT_DONE ;  } <START_BUG> l2cap_add_conf_opt ( & ptr, L2CAP_CONF_MTU, 2, pi -> omtu ) ; } else { result = L2CAP_CONF_UNACCEPT ; memset ( & rfc, 0, sizeof ( rfc ) ) ; rfc. mode = L2<END_BUG>

Fix:
<S2SV_ModStart> } if ( pi -> num_conf_rsp || pi -> num_conf_req ) goto done ; switch ( pi -> mode ) { case L2CAP_MODE_STREAMING : case L2CAP_MODE_ERTM : pi -> conf_state |= L2CAP_CONF_STATE2_DEVICE ; if (! l2cap_mode_supported ( pi -> mode, pi -> conn -> feat_mask ) ) return - ECONNREFUSED ; break ; default : pi -> mode = l2cap_select_mode ( rfc. mode, pi -> conn -> feat_mask ) ; break ; } done : if ( pi -> mode!= rfc. mode ) { result = L2CAP_CONF_UNACCEPT ; rfc. mode = pi -> mode ; if ( pi -> num_conf_rsp == 1 ) return - ECONNREFUSED ; l2cap_add_conf_opt ( & ptr, L2CAP_CONF_RFC, sizeof ( rfc ), ( unsigned long ) & rfc ) ; } if ( <S2SV_ModStart> { if ( mtu < L2CAP_DEFAULT_MIN_MTU ) result = L2CAP_CONF_UNACCEPT ; else { <S2SV_ModEnd> pi ->
Buggy code:
 void test_js ( void ) { GString * result = g_string_new ( "" ) ; parse_cmd_line ( "js   (\'x\'   +   345).toUpperCase()", result ) ; g_assert_cmpstr ( "X345", ==, result -> str ) ; <START_BUG> uzbl. net. useragent = "Test   useragent" ; <END_BUG> parse_cmd_line ( "js   Uzbl.run(\'print   @useragent\').toUpperCase();", result ) ; g_assert_cmpstr ( "TEST   USERAGENT", ==, result -> str ) ; g_string_free ( result, TRUE ) ; }

Fix:
<S2SV_ModStart> str ) ; <S2SV_ModEnd> g_string_free ( result
Buggy code:
 void mono_gc_init ( void ) { InitializeCriticalSection ( & handle_section ) ; InitializeCriticalSection ( & allocator_section ) ; <START_BUG> InitializeCriticalSection ( & finalizer_mutex ) ; <END_BUG> MONO_GC_REGISTER_ROOT_FIXED ( gc_handles [ HANDLE_NORMAL ]. entries ) ; MONO_GC_REGISTER_ROOT_FIXED ( gc_handles [ HANDLE_PINNED ]. entries ) ; mono_gc_base_init ( ) ; if ( mono_gc_is_disabled ( ) ) { gc_disabled = TRUE ; return ; } finalizer_event = CreateEvent ( NULL, FALSE, FALSE, NULL ) ; pending_done_event = CreateEvent ( NULL, TRUE, FALSE, NULL ) ; shutdown_event = CreateEvent ( NULL, TRUE, FALSE, NULL ) ; if ( finalizer_event == NULL || pending_done_event == NULL || shutdown_event == NULL ) { g_assert_not_reached ( ) ; } # ifdef MONO_HAS_SEMAPHORES MONO_SEM_INIT ( & finalizer_sem, 0 ) ; # endif gc_thread = mono_thread_create_internal ( mono_domain_get ( ), finalizer_thread, NULL, FALSE ) ; ves_icall_System_Threading_Thread_SetName_internal ( gc_thread, mono_string_new ( mono_domain_get ( ), "Finalizer" ) ) ; }

Fix:
<S2SV_ModStart> ( & finalizer_mutex ) ; InitializeCriticalSection ( & reference_queue_mutex
Buggy code:
 static int snd_timer_user_tselect ( struct file * file, struct snd_timer_select __user * _tselect ) { struct snd_timer_user * tu ; struct snd_timer_select tselect ; char str [ 32 ] ; int err = 0 ; tu = file -> private_data ; <START_BUG> mutex_lock ( & tu -> tread_sem ) ; <END_BUG> if ( tu -> timeri ) { snd_timer_close ( tu -> timeri ) ; tu -> timeri = NULL ; } if ( copy_from_user ( & tselect, _tselect, sizeof ( tselect ) ) ) { err = - EFAULT ; goto __err ; } sprintf ( str, "application   %i", current -> pid ) ; if ( tselect. id. dev_class!= SNDRV_TIMER_CLASS_SLAVE ) tselect. id. dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION ; err = snd_timer_open ( & tu -> timeri, str, & tselect. id, current -> pid ) ; if ( err < 0 ) goto __err ; kfree ( tu -> queue ) ; tu -> queue = NULL ; kfree ( tu -> tqueue ) ; tu -> tqueue = NULL ; if ( tu -> tread ) { tu -> tqueue = kmalloc ( tu -> queue_size * sizeof ( struct snd_timer_tread ), GFP_KERNEL ) ; if ( tu -> tqueue == NULL ) err = - ENOMEM ; } else { tu -> queue = kmalloc ( tu -> queue_size * sizeof ( struct snd_timer_read ), GFP_KERNEL ) ; if ( tu -> queue == NULL ) err = - ENOMEM ; } if ( err < 0 ) { snd_timer_close ( tu -> timeri ) ; tu -> timeri = NULL ; } else { tu -> timeri -> flags |= SNDRV_TIMER_IFLG_FAST ; tu -> timeri -> callback = tu -> tread? snd_timer_user_tinterrupt : snd_timer_user_interrupt ; tu -> timeri -> ccallback = snd_timer_user_ccallback ; tu -> timeri -> callback_data = ( void * ) tu ; } __err :  mutex_unlock ( & tu ->

Fix:
<S2SV_ModStart> -> private_data ; <S2SV_ModEnd> if ( tu <S2SV_ModStart> } __err : <S2SV_ModEnd> return err ;
Buggy code:
 void pgm_print ( netdissect_options * ndo, register const u_char * bp, register u_int length, register const u_char * bp2 ) { register const struct pgm_header * pgm ; register const struct ip * ip ; register char ch ; uint16_t sport, dport ; u_int nla_afnum ; char nla_buf [ INET6_ADDRSTRLEN ] ; register const struct ip6_hdr * ip6 ; uint8_t opt_type, opt_len ; uint32_t seq, opts_len, len, offset ; pgm = ( const struct pgm_header * ) bp ; ip = ( const struct ip * ) bp2 ; if ( IP_V ( ip ) == 6 ) ip6 = ( const struct ip6_hdr * ) bp2 ; else ip6 = NULL ; ch = '\\0' ; if (! ND_TTEST ( pgm -> pgm_dport ) ) { if ( ip6 ) { ND_PRINT ( ( ndo, "%s   >   %s:   [|pgm]", ip6addr_string ( ndo, & ip6 -> ip6_src ), ip6addr_string ( ndo, & ip6 -> ip6_dst ) ) ) ; <START_BUG> return ; <END_BUG> } else { ND_PRINT ( ( ndo, "%s   >   %s:   [|pgm]", ipaddr_string ( ndo, & ip -> ip_src ), ipaddr_string ( ndo, & ip -> ip_dst ) ) ) ;  return ; <START_BUG> } } sport = EXTRACT_16BITS ( & pgm -> pgm_sport ) ; dport = EXTRACT_16BITS ( & pgm -> pgm_dport ) ; if ( ip6 ) { if ( ip6 -> ip6_nxt == IPPROTO_PGM ) { ND_PRINT ( ( ndo, "%s.%s   >   %s.%s:   ", ip6addr_string ( ndo, & ip6 -> ip6_src ), tcpport_string ( ndo, sport ), ip6addr_string ( ndo, & ip6 -> ip6_dst ), tcpport_string ( ndo, dport ) )<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; <S2SV_ModEnd> } else { <S2SV_ModStart> ) ) ; } return ; <S2SV_ModEnd> } sport = <S2SV_ModStart> ) ) ; ND_TCHECK_16BITS ( bp ) ;
Buggy code:
 static inline void queue_unlock ( struct futex_q * q, struct futex_hash_bucket * hb ) { spin_unlock ( & hb -> lock ) ; <START_BUG> drop_futex_key_refs ( & q -> key ) ; <END_BUG> }

Fix:
<S2SV_ModStart> lock ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int sctp_load_addresses_from_init ( struct sctp_tcb * stcb, struct mbuf * m, int offset, int limit, struct sockaddr * src, struct sockaddr * dst, struct sockaddr * altsa, uint16_t port ) { struct sctp_inpcb * inp ; struct sctp_nets * net, * nnet, * net_tmp ; struct sctp_paramhdr * phdr, param_buf ; struct sctp_tcb * stcb_tmp ; uint16_t ptype, plen ; struct sockaddr * sa ; uint8_t random_store [ SCTP_PARAM_BUFFER_SIZE ] ; struct sctp_auth_random * p_random = NULL ; uint16_t random_len = 0 ; uint8_t hmacs_store [ SCTP_PARAM_BUFFER_SIZE ] ; struct sctp_auth_hmac_algo * hmacs = NULL ; uint16_t hmacs_len = 0 ; uint8_t saw_asconf = 0 ; uint8_t saw_asconf_ack = 0 ; uint8_t chunks_store [ SCTP_PARAM_BUFFER_SIZE ] ; struct sctp_auth_chunk_list * chunks = NULL ; uint16_t num_chunks = 0 ; sctp_key_t * new_key ; uint32_t keylen ; int got_random = 0, got_hmacs = 0, got_chklist = 0 ; uint8_t peer_supports_ecn ; uint8_t peer_supports_prsctp ; uint8_t peer_supports_auth ; uint8_t peer_supports_asconf ; uint8_t peer_supports_asconf_ack ; uint8_t peer_supports_reconfig ; uint8_t peer_supports_nrsack ; uint8_t peer_supports_pktdrop ; uint8_t peer_supports_idata ; # ifdef INET struct sockaddr_in sin ; # endif # ifdef INET6 struct sockaddr_in6 sin6 ; # endif # ifdef INET memset ( & sin, 0, sizeof ( sin ) ) ; sin. sin_family = AF_INET ; # ifdef HAVE_SIN_LEN sin. sin_len = sizeof (

Fix:
<S2SV_ModStart> if ( plen < sizeof ( struct sctp_paramhdr ) <S2SV_ModEnd> ) { break <S2SV_ModStart> ) ; } if ( plen < sizeof ( struct sctp_asconf_addrv4_param ) ) { return ( - 101 ) ; }
Buggy code:
 static int find_best_16x16_intra ( VP9_COMP * cpi, <START_BUG> MB_PREDICTION_MODE * pbest_mode ) { <END_BUG>  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; <END_BUG> MB_PREDICTION_MODE best_mode = - 1, mode ;  unsigned int best_err = INT_MAX ; for ( mode = DC_PRED ; mode <= TM_PRED ; mode ++ ) { unsigned int err ; xd -> mi [ 0 ] -> mbmi. mode = mode ; <START_BUG> vp9_predict_intra_block ( xd, 0, 2, TX_16X16, mode, <END_BUG> x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, xd -> plane [ 0 ]. dst. buf, xd -> plane [ 0 ]. dst. stride, 0, 0, 0 ) ;  err = vp9_sad16x16 ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, <START_BUG> xd -> plane [ 0 ]. dst. buf, xd -> plane [ 0 ]. dst. stride, best_err ) ; if ( err < best_err ) { best_err = err ; best_mode = mode ; } } if ( pbest_mode ) * pbest_mode = best_mode ; return best_err ; }<END_BUG>

Fix:
<S2SV_ModStart> * cpi, PREDICTION_MODE <S2SV_ModEnd> * pbest_mode ) <S2SV_ModStart> & cpi -> td. <S2SV_ModStart> -> e_mbd ; PREDICTION_MODE <S2SV_ModEnd> best_mode = - <S2SV_ModStart> ( xd, <S2SV_ModEnd> 2, TX_16X16 <S2SV_ModStart> ; err = vpx_sad16x16 ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, xd -> plane [ 0 ]. dst. buf, xd -> plane [ 0 ]. dst. stride <S2SV_ModEnd> ) ; if
Buggy code:
 enum ImapAuthRes imap_auth_gss ( struct ImapData * idata, const char * method ) { gss_buffer_desc request_buf, send_token ; gss_buffer_t sec_token ; gss_name_t target_name ; gss_ctx_id_t context ; gss_OID mech_name ; char server_conf_flags ; gss_qop_t quality ; int cflags ; OM_uint32 maj_stat, min_stat ; char buf1 [ GSS_BUFSIZE ], buf2 [ GSS_BUFSIZE ] ; unsigned long buf_size ; int rc ; if (! mutt_bit_isset ( idata -> capabilities, AGSSAPI ) ) return IMAP_AUTH_UNAVAIL ; if ( mutt_account_getuser ( & idata -> conn -> account ) < 0 ) return IMAP_AUTH_FAILURE ; snprintf ( buf1, sizeof ( buf1 ), "imap@%s", idata -> conn -> account. host ) ; request_buf. value = buf1 ; request_buf. length = strlen ( buf1 ) ; maj_stat = gss_import_name ( & min_stat, & request_buf, gss_nt_service_name, & target_name ) ; if ( maj_stat!= GSS_S_COMPLETE ) { mutt_debug ( 2, "Couldn\'t   get   service   name   for   [%s]\\n", buf1 ) ; return IMAP_AUTH_UNAVAIL ; } else if ( DebugLevel >= 2 ) { gss_display_name ( & min_stat, target_name, & request_buf, & mech_name ) ; mutt_debug ( 2, "Using   service   name   [%s]\\n", ( char * ) request_buf. value ) ; gss_release_buffer ( & min_stat, & request_buf ) ; } sec_token = GSS_C_NO_BUFFER ; context = GSS_C_NO_CONTEXT ; maj_stat = gss_init_sec_context ( & min_stat, GSS_C_NO_CREDENTIAL, & context, target_name, GSS_C_NO_OID, GSS_C_MUTUAL_FLAG | GSS_

Fix:
<S2SV_ModStart> buf + 2, sizeof ( buf2 ) <S2SV_ModStart> buf + 2, sizeof ( buf2 )
Buggy code:
 void CLASS parse_fuji ( int offset ) { unsigned entries, tag, len, save, c ; fseek ( ifp, offset, SEEK_SET ) ; entries = get4 ( ) ; if ( entries > 255 ) return ; <START_BUG> while ( entries -- ) <END_BUG> { tag = get2 ( ) ; len = get2 ( ) ; save = ftell ( ifp ) ; if ( tag == 0x100 ) { raw_height = get2 ( ) ; raw_width = get2 ( ) ; } else if ( tag == 0x121 ) { height = get2 ( ) ; if ( ( width = get2 ( ) ) == 4284 ) width += 3 ; } else if ( tag == 0x130 ) { fuji_layout = fgetc ( ifp ) >> 7 ; fuji_width =! ( fgetc ( ifp ) & 8 ) ; } else if ( tag == 0x131 ) { filters = 9 ; FORC ( 36 ) { int q = fgetc ( ifp ) ; xtrans_abs [ 0 ] [ 35 - c ] = MAX ( 0, MIN ( q, 2 ) ) ; } } else if ( tag == 0x2ff0 ) { FORC4 cam_mul [ c ^ 1 ] = get2 ( ) ; # ifdef LIBRAW_LIBRARY_BUILD } else if ( tag == 0x9650 ) { short a = ( short ) get2 ( ) ; float b = fMAX ( 1.0f, get2 ( ) ) ; imgdata. makernotes. fuji. FujiExpoMidPointShift = a // b ; } else if ( tag == 0x2f00 ) { int nWBs = get4 ( ) ; nWBs = MIN ( nWBs, 6 ) ; for ( int wb_ind = 0 ; wb_ind < nWBs ; wb_ind ++ ) { FORC4 imgdata. color. WB_Coeffs [ LIBRAW_WBI_Custom1 + wb_ind ] [ c ^ 1 ] = get2 ( ) ; fseek ( ifp, 8, SEEK_CUR ) ; } } else if ( tag == 0x2000 ) { FORC4 imgdata. color. WB_Coeffs [ LIBRAW_WBI_Auto ] [ c ^ 1 ]

Fix:
<S2SV_ModStart> ) return ; # ifdef LIBRAW_LIBRARY_BUILD imgdata. process_warnings |= LIBRAW_WARN_PARSEFUJI_PROCESSED ; # endif