nus-yam/ex-repair huggingface dataset:
Buggy code:
 int main ( int argc, char * * argv ) { char * filein, * str, * tempfile, * prestring, * outprotos, * protostr ; const char * spacestr = "   " ; <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> l_uint8 * allheaders ; l_int32 i, maxindex, in_line, nflags, protos_added, firstfile, len, ret ; size_t nbytes ; L_BYTEA * ba, * ba2 ; SARRAY * sa, * safirst ; static char mainName [ ] = "xtractprotos" ; if ( argc == 1 ) { fprintf ( stderr, "xtractprotos   [-prestring=<string>]   [-protos=<where>]   " "[list   of   C   files]\\n" "where   the   prestring   is   prepended   to   each   prototype,   and   \\n" "protos   can   be   either   \'inline\'   or   the   name   of   an   output   " "prototype   file\\n" ) ; return 1 ; } prestring = outprotos = NULL ; in_line = FALSE ; nflags = 0 ; maxindex = L_MIN ( 3, argc ) ; for ( i = 1 ; i < maxindex ; i ++ ) { if ( argv [ i ] [ 0 ] == '-' ) { if (! strncmp ( argv [ i ], "-prestring", 10 ) ) { nflags ++ ;  ret = sscanf ( argv [ i ] + 1, "prestring=%s", buf ) ; <START_BUG> if ( ret!= 1 ) { fprintf ( stderr, "parse   failure   for   prestring\\n" ) ; return 1 ; } <END_BUG> if ( ( len = strlen ( buf ) ) > L_BUF_SIZE - 3 ) {  L_WARNING ( "prestring   too   large;   omitting!\\n", mainName ) ; } else { buf [ len ] =' '; buf [ len + 1 ] = '\\0' ; prestring = stringNew ( buf ) ; } } else if (! strncmp ( argv [ i ], "-protos", 7 ) ) { nflags ++ ; <START_BUG> ret = sscanf ( argv<END_BUG>

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; l_uint8 <S2SV_ModStart> + 1, "prestring=%490s" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ) ) > L_BUFSIZE <S2SV_ModEnd> - 3 ) <S2SV_ModStart> + 1, "protos=%490s" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, " <S2SV_blank> * <S2SV_blank> <S2SV_blank> These <S2SV_blank> prototypes <S2SV_blank> were <S2SV_blank> autogen\'d <S2SV_blank> by <S2SV_blank> xtractprotos, <S2SV_blank> v. <S2SV_blank> %s", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "cpp <S2SV_blank> -ansi <S2SV_blank> -DNO_PROTOS <S2SV_blank> %s <S2SV_blank> %s",
Buggy code:
 static int futex_wait_requeue_pi ( u32 __user * uaddr, unsigned int flags, u32 val, ktime_t * abs_time, u32 bitset, u32 __user * uaddr2 ) { struct hrtimer_sleeper timeout, * to = NULL ; struct rt_mutex_waiter rt_waiter ; struct rt_mutex * pi_mutex = NULL ; struct futex_hash_bucket * hb ; union futex_key key2 = FUTEX_KEY_INIT ; struct futex_q q = futex_q_init ; int res, ret ; if ( uaddr == uaddr2 ) return - EINVAL ; if (! bitset ) return - EINVAL ; if ( abs_time ) { to = & timeout ; hrtimer_init_on_stack ( & to -> timer, ( flags & FLAGS_CLOCKRT )? CLOCK_REALTIME : CLOCK_MONOTONIC, HRTIMER_MODE_ABS ) ; hrtimer_init_sleeper ( to, current ) ; hrtimer_set_expires_range_ns ( & to -> timer, * abs_time, current -> timer_slack_ns ) ; } debug_rt_mutex_init_waiter ( & rt_waiter ) ; RB_CLEAR_NODE ( & rt_waiter. pi_tree_entry ) ; RB_CLEAR_NODE ( & rt_waiter. tree_entry ) ; rt_waiter. task = NULL ; ret = get_futex_key ( uaddr2, flags & FLAGS_SHARED, & key2, VERIFY_WRITE ) ; if ( unlikely ( ret!= 0 ) ) goto out ; q. bitset = bitset ; q. rt_waiter = & rt_waiter ; q. requeue_pi_key = & key2 ; ret = futex_wait_setup ( uaddr, val, flags, & q, & hb ) ; if ( ret ) goto out_key2 ; <START_BUG> futex_wait_queue_me ( hb, & q, to ) ; <END_BUG> spin_lock ( & hb -> lock ) ; ret = handle_early_requeue_pi_wakeup ( hb, & q, & key2, to ) ; spin_unlock

Fix:
<S2SV_ModStart> goto out_key2 ; if ( match_futex ( & q. key, & key2 ) ) { ret = - EINVAL ; goto out_put_keys ; }
Buggy code:
 static vpx_codec_err_t ctrl_set_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> vpx_ref_frame_t * const frame = va_arg ( args, vpx_ref_frame_t * ) ; if ( frame!= NULL ) { YV12_BUFFER_CONFIG sd ; image2yuvconfig ( & frame -> img, & sd ) ; vp9_set_reference_enc ( ctx -> cpi, ref_frame_to_vp9_reframe ( frame -> frame_type ), & sd ) ; return VPX_CODEC_OK ; } else { return VPX_CODEC_INVALID_PARAM ; } }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )
Buggy code:
 static inline int process_nested_data ( UNSERIALIZE_PARAMETER, HashTable * ht, long elements, int objprops ) { while ( elements -- > 0 ) { zval * key, * data, * * old_data ; ALLOC_INIT_ZVAL ( key ) ; if (! php_var_unserialize ( & key, p, max, NULL TSRMLS_CC ) ) { zval_dtor ( key ) ; FREE_ZVAL ( key ) ; return 0 ; } if ( Z_TYPE_P ( key )!= IS_LONG && Z_TYPE_P ( key )!= IS_STRING ) { zval_dtor ( key ) ; FREE_ZVAL ( key ) ; return 0 ; } ALLOC_INIT_ZVAL ( data ) ; if (! php_var_unserialize ( & data, p, max, var_hash TSRMLS_CC ) ) { zval_dtor ( key ) ; FREE_ZVAL ( key ) ; zval_dtor ( data ) ; FREE_ZVAL ( data ) ; return 0 ; } if (! objprops ) { switch ( Z_TYPE_P ( key ) ) { case IS_LONG : if ( zend_hash_index_find ( ht, Z_LVAL_P ( key ), ( void * * ) & old_data ) == SUCCESS ) { var_push_dtor ( var_hash, old_data ) ; } zend_hash_index_update ( ht, Z_LVAL_P ( key ), & data, sizeof ( data ), NULL ) ; break ; case IS_STRING : if ( zend_symtable_find ( ht, Z_STRVAL_P ( key ), Z_STRLEN_P ( key ) + 1, ( void * * ) & old_data ) == SUCCESS ) { var_push_dtor ( var_hash, old_data ) ; } zend_symtable_update ( ht, Z_STRVAL_P ( key ), Z_STRLEN_P ( key ) + 1, & data, sizeof ( data ), NULL ) ; break ; } } else { convert_to_string ( key ) ; <START_BUG> if ( zend_symtable_find ( ht, Z_STRVAL_P ( key ), Z_STR<END_BUG>

Fix:
<S2SV_ModStart> ; if ( zend_hash_find <S2SV_ModEnd> ( ht,
Buggy code:
 static bool dump_fd_info ( const char * dest_filename, char * source_filename, int source_base_ofs, uid_t uid, gid_t gid ) { <START_BUG> FILE * fp = fopen ( dest_filename, "w" ) ; <END_BUG> if (! fp ) return false ; unsigned fd = 0 ; while ( fd <= 99999 ) { sprintf ( source_filename + source_base_ofs, "fd//%u", fd ) ; char * name = malloc_readlink ( source_filename ) ; if (! name ) break ; fprintf ( fp, "%u:%s\\n", fd, name ) ; free ( name ) ; sprintf ( source_filename + source_base_ofs, "fdinfo//%u", fd ) ; fd ++ ; FILE * in = fopen ( source_filename, "r" ) ; if (! in ) continue ; char buf [ 128 ] ; while ( fgets ( buf, sizeof ( buf ) - 1, in ) ) { char * eol = strchrnul ( buf, '\\n' ) ; eol [ 0 ] = '\\n' ; eol [ 1 ] = '\\0' ; fputs ( buf, fp ) ; } fclose ( in ) ; } const int dest_fd = fileno ( fp ) ; if ( fchown ( dest_fd, uid, gid ) < 0 ) { perror_msg ( "Can\'t   change   \'%s\'   ownership   to   %lu:%lu", dest_filename, ( long ) uid, ( long ) gid ) ; fclose ( fp ) ; unlink ( dest_filename ) ; return false ; } fclose ( fp ) ; return true ; }

Fix:
<S2SV_ModStart> ( dest_filename, "wx" <S2SV_ModEnd> ) ; if
Buggy code:
 static krb5_error_code find_alternate_tgs ( kdc_realm_t * kdc_active_realm, krb5_principal princ, krb5_db_entry * * server_ptr, const char * * status ) { krb5_error_code retval ; krb5_principal * plist = NULL, * pl2 ; krb5_data tmp ; krb5_db_entry * server = NULL ; * server_ptr = NULL ; assert ( is_cross_tgs_principal ( princ ) ) ; if ( ( retval = krb5_walk_realm_tree ( kdc_context, krb5_princ_realm ( kdc_context, princ ), krb5_princ_component ( kdc_context, princ, 1 ), & plist, KRB5_REALM_BRANCH_CHAR ) ) ) { goto cleanup ; } for ( pl2 = plist ; * pl2 ; pl2 ++ ) ; while ( -- pl2 > plist ) { tmp = * krb5_princ_realm ( kdc_context, * pl2 ) ; krb5_princ_set_realm ( kdc_context, * pl2, krb5_princ_realm ( kdc_context, tgs_server ) ) ; retval = db_get_svc_princ ( kdc_context, * pl2, 0, & server, status ) ; krb5_princ_set_realm ( kdc_context, * pl2, & tmp ) ; if ( retval == KRB5_KDB_NOENTRY ) continue ; else if ( retval ) goto cleanup ; log_tgs_alt_tgt ( kdc_context, server -> princ ) ; * server_ptr = server ; server = NULL ; goto cleanup ; } cleanup : <START_BUG> if ( retval!= 0 ) <END_BUG> * status = "UNKNOWN_SERVER" ; krb5_free_realm_tree ( kdc_context, plist ) ; krb5_db_free_principal ( kdc_context, server ) ; return retval ; }

Fix:
<S2SV_ModStart> if ( retval == 0 && server_ptr == NULL ) retval = KRB5_KDB_NOENTRY ; if ( retval
Buggy code:
 static int translate_desc ( struct vhost_dev * dev, u64 addr, u32 len, struct iovec iov [ ], int iov_size ) { const struct vhost_memory_region * reg ; struct vhost_memory * mem ; struct iovec * _iov ; u64 s = 0 ; int ret = 0 ; rcu_read_lock ( ) ; mem = rcu_dereference ( dev -> memory ) ; while ( ( u64 ) len > s ) { u64 size ; if ( unlikely ( ret >= iov_size ) ) { ret = - ENOBUFS ; break ; } reg = find_region ( mem, addr, len ) ; if ( unlikely (! reg ) ) { ret = - EFAULT ; break ; } _iov = iov + ret ; size = reg -> memory_size - addr + reg -> guest_phys_addr ; <START_BUG> _iov -> iov_len = min ( ( u64 ) len, size ) ; <END_BUG> _iov -> iov_base = ( void __user * ) ( unsigned long ) ( reg -> userspace_addr + addr - reg -> guest_phys_addr ) ; s += size ; addr += size ; ++ ret ; } rcu_read_unlock ( ) ; return ret ; }

Fix:
<S2SV_ModStart> u64 ) len - s
Buggy code:
 static void write_interp_filter ( INTERP_FILTER filter, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG> const int filter_to_literal [ ] = { 1, 0, 2, 3 } ;  vp9_wb_write_bit ( wb, filter == SWITCHABLE ) ; <START_BUG> if ( filter!= SWITCHABLE ) <END_BUG> vp9_wb_write_literal ( wb, filter_to_literal [ filter ], 2 ) ;  }

Fix:
<S2SV_ModStart> filter, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> 3 } ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart>!= SWITCHABLE ) vpx_wb_write_literal <S2SV_ModEnd> ( wb,
Buggy code:
 static int mem_read ( jas_stream_obj_t * obj, char * buf, int cnt ) { <START_BUG> int n ; <END_BUG> assert ( cnt >= 0 ) ; assert ( buf ) ; JAS_DBGLOG ( 100, ( "mem_read(%p,   %p,   %d)\\n", obj, buf, cnt ) ) ; jas_stream_memobj_t * m = ( jas_stream_memobj_t * ) obj ; n = m -> len_ - m -> pos_ ; cnt = JAS_MIN ( n, cnt ) ; memcpy ( buf, & m -> buf_ [ m -> pos_ ], cnt ) ; m -> pos_ += cnt ; return cnt ; }

Fix:
<S2SV_ModStart> cnt ) { ssize_t <S2SV_ModEnd> n ; assert
Buggy code:
 static ssize_t next_line ( struct archive_read * a, const char * * b, ssize_t * avail, ssize_t * ravail, ssize_t * nl ) { ssize_t len ; int quit ; quit = 0 ; if ( * avail == 0 ) { * nl = 0 ; len = 0 ; } else len = get_line_size ( * b, * avail, nl ) ; while ( * nl == 0 && len == * avail &&! quit ) { ssize_t diff = * ravail - * avail ; size_t nbytes_req = ( * ravail + 1023 ) & ~ 1023U ; ssize_t tested ; if ( nbytes_req < ( size_t ) * ravail + 160 ) nbytes_req <<= 1 ; * b = __archive_read_ahead ( a, nbytes_req, avail ) ; if ( * b == NULL ) { if ( * ravail >= * avail ) return ( 0 ) ; * b = __archive_read_ahead ( a, * avail, avail ) ; quit = 1 ; } * ravail = * avail ; * b += diff ; * avail -= diff ; tested = len ; <START_BUG> len = get_line_size ( * b, * avail, nl ) ; <END_BUG> if ( len >= 0 ) len += tested ; } return ( len ) ; }

Fix:
<S2SV_ModStart> ( * b + len, * avail - len <S2SV_ModEnd>, nl )
Buggy code:
 NOEXPORT char * parse_service_option ( CMD cmd, SERVICE_OPTIONS * * section_ptr, char * opt, char * arg ) { SERVICE_OPTIONS * section ; int endpoints = 0 ; # ifndef USE_WIN32 struct group * gr ; struct passwd * pw ; # endif section = section_ptr? * section_ptr : NULL ; if ( cmd == CMD_SET_DEFAULTS || cmd == CMD_SET_COPY ) { section -> ref = 1 ; <START_BUG> } else if ( cmd == CMD_FREE ) { <END_BUG>  if ( section == & service_options || section == & new_service_options ) <START_BUG> <END_BUG> s_log ( LOG_DEBUG, "Deallocating   section   defaults" ) ;  else s_log ( LOG_DEBUG, "Deallocating   section   [%s]", section -> servname ) ; } else if ( cmd == CMD_PRINT_DEFAULTS || cmd == CMD_PRINT_HELP ) { s_log ( LOG_NOTICE, "   " ) ; s_log ( LOG_NOTICE, "Service-level   options:" ) ; } switch ( cmd ) { case CMD_SET_DEFAULTS : addrlist_clear ( & section -> local_addr, 1 ) ; section -> local_fd = NULL ; break ; case CMD_SET_COPY : addrlist_clear ( & section -> local_addr, 1 ) ; section -> local_fd = NULL ; name_list_dup ( & section -> local_addr. names, new_service_options. local_addr. names ) ; break ; case CMD_FREE : name_list_free ( section -> local_addr. names ) ; str_free ( section -> local_addr. addr ) ; str_free ( section -> local_fd ) ; break ; case CMD_SET_VALUE : if ( strcasecmp ( opt, "accept" ) ) break ; section -> option. accept = 1 ; name_list_append ( & section -> local_addr. names, arg ) ; return NULL ; case CMD_INITIALIZE : if ( section -> local_addr. names ) { unsigned i ; if (! addrlist_resolve ( & section -> local_addr ) ) return "Cannot   resolve   accept   target" ; section -> local_fd = str_alloc_detached ( section -> local_addr. num * sizeof ( SOCKET ) ) ; for ( i =

Fix:
<S2SV_ModStart> = 1 ; if ( section == & service_options ) s_log ( LOG_ERR, "INTERNAL <S2SV_blank> ERROR: <S2SV_blank> Initializing <S2SV_blank> deployed <S2SV_blank> section <S2SV_blank> defaults" ) ; else if ( section == & new_service_options ) s_log ( LOG_INFO, "Initializing <S2SV_blank> inetd <S2SV_blank> mode <S2SV_blank> configuration" ) ; else s_log ( LOG_INFO, "Initializing <S2SV_blank> service <S2SV_blank> [%s]", section -> servname ) ; <S2SV_ModStart> == & service_options ) s_log ( LOG_DEBUG, "Deallocating <S2SV_blank> deployed <S2SV_blank> section <S2SV_blank> defaults" ) ; else if ( <S2SV_ModEnd> section == & <S2SV_ModStart> ( LOG_DEBUG, "Deallocating <S2SV_blank> temporary <S2SV_blank> section <S2SV_blank> defaults" <S2SV_ModEnd> ) ; else <S2SV_ModStart> break ; } # if OPENSSL_VERSION_NUMBER >= 0x10100000L switch ( cmd ) { case CMD_SET_DEFAULTS : section -> security_level = - 1 ; break ; case CMD_SET_COPY : section -> security_level = new_service_options. security_level ; break ; case CMD_FREE : break ; case CMD_SET_VALUE : if ( strcasecmp ( opt, "securityLevel" ) ) break ; { char * tmp_str ; int
Buggy code:
 int kvm_iommu_map_pages ( struct kvm * kvm, struct kvm_memory_slot * slot ) { gfn_t gfn, end_gfn ; pfn_t pfn ; int r = 0 ; struct iommu_domain * domain = kvm -> arch. iommu_domain ; int flags ; if (! domain ) return 0 ; gfn = slot -> base_gfn ; end_gfn = gfn + slot -> npages ; flags = IOMMU_READ ; if (! ( slot -> flags & KVM_MEM_READONLY ) ) flags |= IOMMU_WRITE ; if (! kvm -> arch. iommu_noncoherent ) flags |= IOMMU_CACHE ; while ( gfn < end_gfn ) { unsigned long page_size ; if ( iommu_iova_to_phys ( domain, gfn_to_gpa ( gfn ) ) ) { gfn += 1 ; continue ; } page_size = kvm_host_page_size ( kvm, gfn ) ; while ( ( gfn + ( page_size >> PAGE_SHIFT ) ) > end_gfn ) page_size >>= 1 ; while ( ( gfn << PAGE_SHIFT ) & ( page_size - 1 ) ) page_size >>= 1 ; while ( __gfn_to_hva_memslot ( slot, gfn ) & ( page_size - 1 ) ) page_size >>= 1 ; pfn = kvm_pin_pages ( slot, gfn, page_size ) ; if ( is_error_noslot_pfn ( pfn ) ) { gfn += 1 ; continue ; } r = iommu_map ( domain, gfn_to_gpa ( gfn ), pfn_to_hpa ( pfn ), page_size, flags ) ; if ( r ) { printk ( KERN_ERR "kvm_iommu_map_address:" "iommu   failed   to   map   pfn=%llx\\n", pfn ) ; <START_BUG> goto unmap_pages ; <END_BUG> } gfn += page_size >> PAGE_SHIFT ; } return 0 ; unmap_pages :  kvm_iommu_put_pages ( kvm, slot ->

Fix:
<S2SV_ModStart> pfn ) ; kvm_unpin_pages ( kvm, pfn, page_size ) ; <S2SV_ModStart> base_gfn, gfn - slot -> base_gfn
Buggy code:
 int nfssvc_decode_readargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd_readargs * args ) { unsigned int len ; int v ; p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; args -> offset = ntohl ( * p ++ ) ; len = args -> count = ntohl ( * p ++ ) ; <START_BUG> p ++ ; <END_BUG> len = min_t ( unsigned int, len, NFSSVC_MAXBLKSIZE_V2 ) ; v = 0 ; while ( len > 0 ) { struct page * p = * ( rqstp -> rq_next_page ++ ) ; rqstp -> rq_vec [ v ]. iov_base = page_address ( p ) ; rqstp -> rq_vec [ v ]. iov_len = min_t ( unsigned int, len, PAGE_SIZE ) ; len -= rqstp -> rq_vec [ v ]. iov_len ; v ++ ; } args -> vlen = v ;  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ; p ++ ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 <S2SV_ModStart> v ; return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int test_sqr ( BIO * bp, BN_CTX * ctx ) { <START_BUG> BIGNUM a, c, d, e ; <END_BUG>  int i ; <START_BUG> BN_init ( & a ) ; BN_init ( & c ) ; BN_init ( & d ) ; BN_init ( & e ) ; for ( i = 0 ; i < num0 ; i ++ ) { <END_BUG> BN_bntest_rand ( & a, 40 + i * 10, 0, 0 ) ;  <START_BUG> a. neg = rand_neg ( ) ; <END_BUG>  BN_sqr ( & c, & a, ctx ) ; <START_BUG> if ( bp!= NULL ) { if (! results ) { <END_BUG> BN_print ( bp, & a ) ;  BIO_puts ( bp, "   *   " ) ; <START_BUG> BN_print ( bp, & a ) ; <END_BUG> BIO_puts ( bp, "   -   " ) ; }  BN_print ( bp, & c ) ; <START_BUG> BIO_puts ( bp, "\\n" ) ; } <END_BUG> BN_div ( & d, & e, & c, & a, ctx ) ;  <START_BUG> BN_sub ( & d, & d, & a ) ; <END_BUG>  if (! BN_is_zero ( & d ) ||! BN_is_zero ( & e ) ) <START_BUG> { <END_BUG> fprintf ( stderr, "Square   test   failed!\\n" ) ;  <START_BUG> return 0 ; <END_BUG> } } BN_free ( & a ) ; BN_free ( & c ) ; BN_free ( & d ) ; BN_free ( & e ) ; return ( 1 ) ; }

Fix:
<S2SV_ModStart> ) { BIGNUM * a, * c, * d, * <S2SV_ModEnd> e ; int <S2SV_ModStart> ; int i, ret = 0 ; a = BN_new ( ) ; c = BN_new ( ) ; d = BN_new ( ) ; e = BN_new ( ) ; if ( a == NULL || c == NULL || d == NULL || e == NULL ) { goto err ; } <S2SV_ModEnd> for ( i <S2SV_ModStart> { BN_bntest_rand ( <S2SV_ModEnd> a, 40 <S2SV_ModStart> ) ; a -> <S2SV_ModEnd> neg = rand_neg <S2SV_ModStart> ; BN_sqr ( c, <S2SV_ModEnd> a, ctx <S2SV_ModStart> ( bp, <S2SV_ModEnd> a ) ; <S2SV_ModStart> ( bp, <S2SV_ModEnd> a ) ; <S2SV_ModStart> ( bp, <S2SV_ModEnd> c ) ; <S2SV_ModStart> } BN_div ( d, e, c, <S2SV_ModEnd> a, ctx <S2SV_ModStart> ; BN_sub ( d, d, <S2SV_ModEnd> a ) ; <S2SV_ModStart>! BN_is_zero ( <S2SV_ModEnd> d ) || <S2SV_ModStart>! BN_is_zero ( e ) ) { fprintf ( stderr, "Square <S2SV_blank> test <S2SV_blank> failed!\\n" ) ; goto err ; } } BN_hex2bn ( & a, "80000000000000008000000000000001FFFF
Buggy code:
 void jslTokenAsString ( int token, char * str, size_t len ) { if ( token > 32 && token < 128 ) { assert ( len >= 4 ) ; str [ 0 ] = '\\'' ; str [ 1 ] = ( char ) token ; str [ 2 ] = '\\'' ; str [ 3 ] = 0 ; return ; } switch ( token ) { case LEX_EOF : strncpy ( str, "EOF", len ) ; return ; case LEX_ID : strncpy ( str, "ID", len ) ; return ; case LEX_INT : strncpy ( str, "INT", len ) ; return ; case LEX_FLOAT : strncpy ( str, "FLOAT", len ) ; return ; case LEX_STR : strncpy ( str, "STRING", len ) ; return ; case LEX_UNFINISHED_STR : strncpy ( str, "UNFINISHED   STRING", len ) ; return ; case LEX_TEMPLATE_LITERAL : strncpy ( str, "TEMPLATE   LITERAL", len ) ; return ; case LEX_UNFINISHED_TEMPLATE_LITERAL : strncpy ( str, "UNFINISHED   TEMPLATE   LITERAL", len ) ; return ; case LEX_REGEX : strncpy ( str, "REGEX", len ) ; return ; case LEX_UNFINISHED_REGEX : strncpy ( str, "UNFINISHED   REGEX", len ) ; return ; case LEX_UNFINISHED_COMMENT : strncpy ( str, "UNFINISHED   COMMENT", len ) ; return ; } if ( token >= _LEX_OPERATOR_START && token < _LEX_R_LIST_END ) { const char tokenNames [ ] = "==\\0" "===\\0" "!=\\0" "!==\\0" "<=\\0" "<<\\0" "<<=\\0" ">=\\0" ">>\\0" ">>>\\0" ">>=\\0" ">>>=\\0" "+=\\0" "-=\\0" "++\\0" "--\\0" "*=\\0" "//=\\0" "%=\\0" "&=\\0" "&&\\0" "|=\\0" "||\\0" "^=\\0" "=>\\0"

Fix:
<S2SV_ModStart> 10 ) ; espruino_snprintf ( str, len, "?[%d]", token <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> int16_t vp9_ac_quant ( int qindex, int delta ) { <END_BUG> return ac_qlookup [ clamp ( qindex + delta, 0, MAXQ ) ] ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, int delta, vpx_bit_depth_t bit_depth ) { # if CONFIG_VP9_HIGHBITDEPTH switch ( bit_depth ) { case VPX_BITS_8 : <S2SV_ModEnd> return ac_qlookup [ <S2SV_ModStart> ) ] ; case VPX_BITS_10 : return ac_qlookup_10 [ clamp ( qindex + delta, 0, MAXQ ) ] ; case VPX_BITS_12 : return ac_qlookup_12 [ clamp ( qindex + delta, 0, MAXQ ) ] ; default : assert ( 0 && "bit_depth <S2SV_blank> should <S2SV_blank> be <S2SV_blank> VPX_BITS_8, <S2SV_blank> VPX_BITS_10 <S2SV_blank> or <S2SV_blank> VPX_BITS_12" ) ; return - 1 ; } # else ( void ) bit_depth ; return ac_qlookup [ clamp ( qindex + delta, 0, MAXQ ) ] ; # endif
Buggy code:
 void zipfileStep ( sqlite3_context * pCtx, int nVal, sqlite3_value * * apVal ) { ZipfileCtx * p ; ZipfileEntry e ; sqlite3_value * pName = 0 ; sqlite3_value * pMode = 0 ; sqlite3_value * pMtime = 0 ; sqlite3_value * pData = 0 ; sqlite3_value * pMethod = 0 ; int bIsDir = 0 ; u32 mode ; int rc = SQLITE_OK ; char * zErr = 0 ; int iMethod = - 1 ; const u8 * aData = 0 ; int nData = 0 ; int szUncompressed = 0 ; u8 * aFree = 0 ; u32 iCrc32 = 0 ; char * zName = 0 ; int nName = 0 ; char * zFree = 0 ; int nByte ; memset ( & e, 0, sizeof ( e ) ) ; p = ( ZipfileCtx * ) sqlite3_aggregate_context ( pCtx, sizeof ( ZipfileCtx ) ) ; if ( p == 0 ) return ; if ( nVal!= 2 && nVal!= 4 && nVal!= 5 ) { zErr = sqlite3_mprintf ( "wrong   number   of   arguments   to   function   zipfile()" ) ; rc = SQLITE_ERROR ; goto zipfile_step_out ; } pName = apVal [ 0 ] ; if ( nVal == 2 ) { pData = apVal [ 1 ] ; } else { pMode = apVal [ 1 ] ; pMtime = apVal [ 2 ] ; pData = apVal [ 3 ] ; if ( nVal == 5 ) { pMethod = apVal [ 4 ] ; } } zName = ( char * ) sqlite3_value_text ( pName ) ; nName = sqlite3_value_bytes ( pName ) ; if ( zName == 0 ) { zErr = sqlite3_mprintf ( "first   argument   to   zipfile()   must   be   non-NULL" ) ; rc = SQLITE_ERROR ; goto zipfile_step_out ; } if ( pMethod && SQLITE_NULL!= sqlite3_value_type ( pMethod ) ) { iMethod = ( int ) sqlite3_value_int64 ( pMethod ) ; if ( iMethod!= 0 && iMethod!= 8 ) { zErr = sqlite3_

Fix:
<S2SV_ModStart> zName ) ; <S2SV_ModEnd> if ( zName <S2SV_ModStart> zipfile_step_out ; } nName = ( int ) strlen ( zName ) ;
Buggy code:
 void vp9_rc_set_frame_target ( VP9_COMP * cpi, int target ) { const VP9_COMMON * const cm = & cpi -> common ; RATE_CONTROL * const rc = & cpi -> rc ; rc -> this_frame_target = target ; <START_BUG> rc -> sb64_target_rate = ( ( int64_t ) rc -> this_frame_target * 64 * 64 ) // <END_BUG> ( cm -> width * cm -> height ) ; }

Fix:
<S2SV_ModStart> = target ; if ( cpi -> oxcf. resize_mode == RESIZE_DYNAMIC && rc -> frame_size_selector!= UNSCALED ) rc -> this_frame_target = ( int ) ( rc -> this_frame_target * rate_thresh_mult [ rc -> frame_size_selector ] ) ;
Buggy code:
 static int dissect_usb_video_control_interface_descriptor ( proto_tree * parent_tree, tvbuff_t * tvb, guint8 descriptor_len, packet_info * pinfo, usb_conv_info_t * usb_conv_info ) { video_conv_info_t * video_conv_info = NULL ; video_entity_t * entity = NULL ; proto_item * item = NULL ; proto_item * subtype_item = NULL ; proto_tree * tree = NULL ; guint8 entity_id = 0 ; guint16 terminal_type = 0 ; int offset = 0 ; guint8 subtype ; subtype = tvb_get_guint8 ( tvb, offset + 2 ) ; if ( parent_tree ) { const gchar * subtype_str ; subtype_str = val_to_str_ext ( subtype, & vc_if_descriptor_subtypes_ext, "Unknown   (0x%x)" ) ; tree = proto_tree_add_subtree_format ( parent_tree, tvb, offset, descriptor_len, ett_descriptor_video_control, & item, "VIDEO   CONTROL   INTERFACE   DESCRIPTOR   [%s]", subtype_str ) ; } dissect_usb_descriptor_header ( tree, tvb, offset, & vid_descriptor_type_vals_ext ) ; subtype_item = proto_tree_add_item ( tree, hf_usb_vid_control_ifdesc_subtype, tvb, offset + 2, 1, ENC_LITTLE_ENDIAN ) ; offset += 3 ; if ( subtype == VC_HEADER ) { guint8 num_vs_interfaces ; proto_tree_add_item ( tree, hf_usb_vid_control_ifdesc_bcdUVC, tvb, offset, 2, ENC_LITTLE_ENDIAN ) ; proto_tree_add_item ( tree, hf_usb_vid_ifdesc_wTotalLength, tvb, offset + 2, 2, ENC_LITTLE_ENDIAN ) ; proto_tree_add_item ( tree, hf_usb_vid_control_ifdesc_dwClockFrequency, tvb, offset + 4, 4, ENC_LITTLE_ENDIAN ) ; num_vs_interfaces =

Fix:
<S2SV_ModStart> = video_conv_info ; usb_conv_info -> class_data_type = USB_CONV_VIDEO ; } else if ( usb_conv_info -> class_data_type!= USB_CONV_VIDEO ) { return descriptor_len ;
Buggy code:
 void beforeSleep ( struct aeEventLoop * eventLoop ) { REDIS_NOTUSED ( eventLoop ) ; listNode * ln ; redisClient * c ; <START_BUG> if ( server. vm_enabled && listLength ( server. io_ready_clients ) ) { <END_BUG> listIter li ; listRewind ( server. io_ready_clients, & li ) ; while ( ( ln = listNext ( & li ) ) ) { c = ln -> value ; struct redisCommand * cmd ; listDelNode ( server. io_ready_clients, ln ) ; c -> flags &= ( ~ REDIS_IO_WAIT ) ;  server. vm_blocked_clients -- ; <START_BUG> aeCreateFileEvent ( server. el, c -> fd, AE_READABLE, readQueryFromClient, c ) ; cmd = lookupCommand ( c -> argv [ 0 ] -> ptr ) ; redisAssert ( cmd!= NULL ) ; call ( c, cmd ) ; resetClient ( c ) ; if ( c -> querybuf && sdslen ( c -> querybuf ) > 0 ) processInputBuffer ( c ) ; } } while ( listLength ( server. unblocked_clients ) ) { ln = listFirst ( server. unblocked_clients ) ; redisAssert ( ln!= NULL ) ; c = ln -> value ; listDelNode ( server. unblocked_clients, ln ) ; if ( c -> querybuf && sdslen ( c -> querybuf ) > 0 ) processInputBuffer ( c ) ; } flushAppendOnlyFile ( ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ( server. ds_enabled <S2SV_ModEnd> && listLength ( <S2SV_ModStart> ; server. cache_blocked_clients <S2SV_ModEnd> -- ; aeCreateFileEvent
Buggy code:
 static struct sk_buff * udp6_ufo_fragment ( struct sk_buff * skb, netdev_features_t features ) { struct sk_buff * segs = ERR_PTR ( - EINVAL ) ; unsigned int mss ; unsigned int unfrag_ip6hlen, unfrag_len ; struct frag_hdr * fptr ; u8 * packet_start, * prevhdr ; u8 nexthdr ; u8 frag_hdr_sz = sizeof ( struct frag_hdr ) ; __wsum csum ; int tnl_hlen ; mss = skb_shinfo ( skb ) -> gso_size ; if ( unlikely ( skb -> len <= mss ) ) goto out ; if ( skb_gso_ok ( skb, features | NETIF_F_GSO_ROBUST ) ) { skb_shinfo ( skb ) -> gso_segs = DIV_ROUND_UP ( skb -> len, mss ) ; if (! skb_shinfo ( skb ) -> ip6_frag_id ) ipv6_proxy_select_ident ( dev_net ( skb -> dev ), skb ) ; segs = NULL ; goto out ; } if ( skb -> encapsulation && skb_shinfo ( skb ) -> gso_type & ( SKB_GSO_UDP_TUNNEL | SKB_GSO_UDP_TUNNEL_CSUM ) ) segs = skb_udp_tunnel_segment ( skb, features, true ) ; else { const struct ipv6hdr * ipv6h ; struct udphdr * uh ; if (! pskb_may_pull ( skb, sizeof ( struct udphdr ) ) ) goto out ; uh = udp_hdr ( skb ) ; ipv6h = ipv6_hdr ( skb ) ; uh -> check = 0 ; csum = skb_checksum ( skb, 0, skb -> len, 0 ) ; uh -> check = udp_v6_check ( skb -> len, & ipv6h -> saddr, & ipv6h -> daddr, csum ) ; if ( uh -> check == 0 ) uh -> check = CSUM_MANGLED_0 ; skb -> ip_summed = CHECK

Fix:
<S2SV_ModStart> prevhdr ) ; if ( unfrag_ip6hlen < 0 ) return ERR_PTR ( unfrag_ip6hlen ) ;
Buggy code:
 static enum count_type __read_io_type ( struct page * page ) { <START_BUG> struct address_space * mapping = page -> mapping ; <END_BUG> if ( mapping ) { struct inode * inode = mapping -> host ; struct f2fs_sb_info * sbi = F2FS_I_SB ( inode ) ; if ( inode -> i_ino == F2FS_META_INO ( sbi ) ) return F2FS_RD_META ; if ( inode -> i_ino == F2FS_NODE_INO ( sbi ) ) return F2FS_RD_NODE ; } return F2FS_RD_DATA ; }

Fix:
<S2SV_ModStart> * mapping = page_file_mapping ( page ) <S2SV_ModEnd> ; if (
Buggy code:
 CURLcode Curl_smtp_escape_eob ( struct connectdata * conn, const ssize_t nread ) { ssize_t i ; ssize_t si ; struct Curl_easy * data = conn -> data ; struct SMTP * smtp = data -> req. protop ; char * scratch = data -> state. scratch ; char * newscratch = NULL ; char * oldscratch = NULL ; size_t eob_sent ; if (! scratch || data -> set. crlf ) { oldscratch = scratch ; <START_BUG> scratch = newscratch = malloc ( 2 * data -> set. buffer_size ) ; <END_BUG> if (! newscratch ) { failf ( data, "Failed   to   alloc   scratch   buffer!" ) ; return CURLE_OUT_OF_MEMORY ; }  } <START_BUG> eob_sent = smtp -> eob ; for ( i = 0, si = 0 ; i < nread ; i ++ ) { if ( SMTP_EOB [ smtp -> eob ] == data -> req. upload_fromhere [ i ] ) { smtp -> eob ++ ; if ( 2 == smtp -> eob || SMTP_EOB_LEN == smtp -> eob ) smtp -> trailing_crlf = TRUE ; else smtp -> trailing_crlf = FALSE ; } else if ( smtp -> eob ) { memcpy ( & scratch [ si ], & SMTP_EOB [ eob_sent ], smtp -> eob - eob_sent ) ; si += smtp -> eob - eob_sent ; if ( SMTP_EOB [ 0 ] == data -> req. upload_fromhere [ i ] ) smtp -> eob = 1 ; else smtp -> eob = 0 ; eob_sent = 0 ; smtp -> trailing_crlf = FALSE ; } if ( SMTP_EOB_FIND_LEN == smtp -> eob ) { memcpy ( & scratch [ si ], & SMTP_EOB_REPL [ eob_sent ], SMTP_EOB_REPL_LEN - eob_sent ) ; si += SMTP_EOB_REPL_LEN - eob_sent ; smtp -> eob = 0 ; eob_sent = 0 ; } else if (! smtp -> eob ) scratch [ si ++ ] = data -> req. upload_fromhere<END_BUG>

Fix:
<S2SV_ModStart> ( 2 * UPLOAD_BUFSIZE <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; } } DEBUGASSERT ( UPLOAD_BUFSIZE >= nread ) ;
Buggy code:
 static int fill_autodev ( const struct lxc_rootfs * rootfs ) { int ret ; char path [ MAXPATHLEN ] ; int i ; mode_t cmask ; INFO ( "Creating   initial   consoles   under   container   //dev" ) ; ret = snprintf ( path, MAXPATHLEN, "%s//dev", rootfs -> path? rootfs -> mount : "" ) ; if ( ret < 0 || ret >= MAXPATHLEN ) { ERROR ( "Error   calculating   container   //dev   location" ) ; return - 1 ; } if (! dir_exists ( path ) ) return 0 ; INFO ( "Populating   container   //dev" ) ; cmask = umask ( S_IXUSR | S_IXGRP | S_IXOTH ) ; for ( i = 0 ; i < sizeof ( lxc_devs ) // sizeof ( lxc_devs [ 0 ] ) ; i ++ ) { const struct lxc_devs * d = & lxc_devs [ i ] ; ret = snprintf ( path, MAXPATHLEN, "%s//dev//%s", rootfs -> path? rootfs -> mount : "", d -> name ) ; if ( ret < 0 || ret >= MAXPATHLEN ) return - 1 ; ret = mknod ( path, d -> mode, makedev ( d -> maj, d -> min ) ) ; if ( ret && errno!= EEXIST ) { char hostpath [ MAXPATHLEN ] ; FILE * pathfile ; ret = snprintf ( hostpath, MAXPATHLEN, "//dev//%s", d -> name ) ; if ( ret < 0 || ret >= MAXPATHLEN ) return - 1 ; pathfile = fopen ( path, "wb" ) ; if (! pathfile ) { SYSERROR ( "Failed   to   create   device   mount   target   \'%s\'", path ) ; return - 1 ; } fclose ( pathfile ) ; <START_BUG> if ( mount ( hostpath, path, 0, MS_BIND, NULL )!= 0 ) { <END_BUG> SYSERROR ( "Failed   bind   mounting   device   %s   from   host   into   container", d -> name ) ; return - 1 ; } } } umask ( cmask ) ; INFO ( "Populated   container   //dev" ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( safe_mount ( hostpath, path, 0, MS_BIND, NULL, rootfs -> path? rootfs -> mount : <S2SV_ModEnd> NULL )!=
Buggy code:
 int main ( void ) { <START_BUG> # line 52 "dt_test2.pgc" <END_BUG> date date1 ;  # line 53 "dt_test2.pgc" <START_BUG> timestamp ts1, ts2 ; <END_BUG> # line 54 "dt_test2.pgc"  char * text ; <START_BUG> # line 55 "dt_test2.pgc" <END_BUG> interval * i1 ;  # line 56 "dt_test2.pgc" <START_BUG> date * dc ; <END_BUG> # line 57 "dt_test2.pgc"  int i, j ; char * endptr ; ECPGdebug ( 1, stderr ) ; ts1 = PGTYPEStimestamp_from_asc ( "2003-12-04   17:34:29", NULL ) ; text = PGTYPEStimestamp_to_asc ( ts1 ) ; printf ( "timestamp:   %s\\n", text ) ; free ( text ) ; date1 = PGTYPESdate_from_timestamp ( ts1 ) ; dc = PGTYPESdate_new ( ) ; * dc = date1 ; text = PGTYPESdate_to_asc ( * dc ) ; printf ( "Date   of   timestamp:   %s\\n", text ) ; free ( text ) ; PGTYPESdate_free ( dc ) ; for ( i = 0 ; dates [ i ] ; i ++ ) { bool err = false ; date1 = PGTYPESdate_from_asc ( dates [ i ], & endptr ) ; if ( date1 == INT_MIN ) { err = true ; } text = PGTYPESdate_to_asc ( date1 ) ; printf ( "Date[%d]:   %s   (%c   -   %c)\\n", i, err? "-" : text, endptr? 'N' : 'Y', err? 'T' : 'F' ) ; free ( text ) ; if (! err ) { for ( j = 0 ; times [ j ] ; j ++ ) { int length = strlen ( dates [ i ] ) + 1 + strlen ( times [ j ] ) + 1 ; char * t = malloc ( length ) ; sprintf ( t, "%s   %s", dates [ i ], times [ j ] ) ; ts1 = PGTYPEStimestamp_from_asc ( t, NULL ) ; text = PGTYPEStimestamp_to

Fix:
<S2SV_ModStart> { # line 62 <S2SV_ModEnd> "dt_test2.pgc" date date1 <S2SV_ModStart> ; # line 63 <S2SV_ModEnd> "dt_test2.pgc" timestamp ts1 <S2SV_ModStart> ; # line 64 <S2SV_ModEnd> "dt_test2.pgc" char * <S2SV_ModStart> ; # line 65 <S2SV_ModEnd> "dt_test2.pgc" interval * <S2SV_ModStart> ; # line 66 <S2SV_ModEnd> "dt_test2.pgc" date * <S2SV_ModStart> ; # line 67 <S2SV_ModEnd> "dt_test2.pgc" int i
Buggy code:
 static int fsck_gitmodules_fn ( const char * var, const char * value, void * vdata ) { struct fsck_gitmodules_data * data = vdata ; const char * subsection, * key ; int subsection_len ; char * name ; if ( parse_config_key ( var, "submodule", & subsection, & subsection_len, & key ) < 0 ||! subsection ) return 0 ; name = xmemdupz ( subsection, subsection_len ) ; if ( check_submodule_name ( name ) < 0 ) data -> ret |= report ( data -> options, data -> obj, FSCK_MSG_GITMODULES_NAME, "disallowed   submodule   name:   %s", name ) ; <START_BUG> free ( name ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> name ) ; if (! strcmp ( key, "url" ) && value && looks_like_command_line_option ( value ) ) data -> ret |= report ( data -> options, data -> obj, FSCK_MSG_GITMODULES_URL, "disallowed <S2SV_blank> submodule <S2SV_blank> url: <S2SV_blank> %s", value ) ;
Buggy code:
 static int do_new_mount ( struct path * path, const char * fstype, int flags, int mnt_flags, const char * name, void * data ) { struct file_system_type * type ; struct user_namespace * user_ns = current -> nsproxy -> mnt_ns -> user_ns ; struct vfsmount * mnt ; int err ; if (! fstype ) return - EINVAL ; type = get_fs_type ( fstype ) ; if (! type ) return - ENODEV ; if ( user_ns!= & init_user_ns ) { if (! ( type -> fs_flags & FS_USERNS_MOUNT ) ) { put_filesystem ( type ) ; return - EPERM ; } if (! ( type -> fs_flags & FS_USERNS_DEV_MOUNT ) ) { flags |= MS_NODEV ; <START_BUG> mnt_flags |= MNT_NODEV ; <END_BUG> } } mnt = vfs_kern_mount ( type, flags, name, data ) ; if (! IS_ERR ( mnt ) && ( type -> fs_flags & FS_HAS_SUBTYPE ) &&! mnt -> mnt_sb -> s_subtype ) mnt = fs_set_subtype ( mnt, fstype ) ; put_filesystem ( type ) ; if ( IS_ERR ( mnt ) ) return PTR_ERR ( mnt ) ; err = do_add_mount ( real_mount ( mnt ), path, mnt_flags ) ; if ( err ) mntput ( mnt ) ; return err ; }

Fix:
<S2SV_ModStart> mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV
Buggy code:
 void pdf_get_version ( FILE * fp, pdf_t * pdf ) { <START_BUG> char * header, * c ; <END_BUG>  header = get_header ( fp ) ; <START_BUG> if ( ( c = strstr ( header, "%PDF-" ) ) && <END_BUG> ( c + strlen ( "%PDF-M.m" ) + 2 ) )  { pdf -> pdf_major_version = atoi ( c + strlen ( "%PDF-" ) ) ; pdf -> pdf_minor_version = atoi ( c + strlen ( "%PDF-M." ) ) ; } free ( header ) ; }

Fix:
<S2SV_ModStart> char * header <S2SV_ModEnd> = get_header ( <S2SV_ModStart> ( fp ) ; const char * c <S2SV_ModStart> ) && ( ( c + 6 ) [ 0 ] == '.' ) && isdigit ( ( c + 5 ) [ 0 ] ) && isdigit ( ( c + 7 ) [ 0 ] <S2SV_ModEnd> ) ) {
Buggy code:
 static int mark_source_chains ( const struct xt_table_info * newinfo, unsigned int valid_hooks, void * entry0 ) { unsigned int hook ; for ( hook = 0 ; hook < NF_ARP_NUMHOOKS ; hook ++ ) { unsigned int pos = newinfo -> hook_entry [ hook ] ; struct arpt_entry * e = ( struct arpt_entry * ) ( entry0 + pos ) ; if (! ( valid_hooks & ( 1 << hook ) ) ) continue ; e -> counters. pcnt = pos ; for ( ; ; ) { const struct xt_standard_target * t = ( void * ) arpt_get_target_c ( e ) ; int visited = e -> comefrom & ( 1 << hook ) ; if ( e -> comefrom & ( 1 << NF_ARP_NUMHOOKS ) ) { pr_notice ( "arptables:   loop   hook   %u   pos   %u   %08X.\\n", hook, pos, e -> comefrom ) ; return 0 ; } e -> comefrom |= ( ( 1 << hook ) | ( 1 << NF_ARP_NUMHOOKS ) ) ; <START_BUG> if ( ( e -> target_offset == sizeof ( struct arpt_entry ) && <END_BUG> ( strcmp ( t -> target. u. user. name, XT_STANDARD_TARGET ) == 0 ) &&  t -> verdict < 0 && unconditional ( & e -> arp ) ) || <START_BUG> visited ) { unsigned int oldpos, size ; if ( ( strcmp ( t -> target. u. user. name, XT_STANDARD_TARGET ) == 0 ) && t -> verdict < - NF_MAX_VERDICT - 1 ) { duprintf ( "mark_source_chains:   bad   " "negative   verdict   (%i)\\n", t -> verdict ) ; return 0 ; } do { e -> comefrom ^= ( 1 << NF_ARP_NUMHOOKS ) ; oldpos = pos ; pos = e -> counters. pcnt ; e -> counters. pcnt = 0 ; if ( pos == oldpos ) goto next ; e = ( struct arpt_entry * ) ( entry0 + pos ) ; } while ( oldpos == pos + e -> next_offset ) ;<END_BUG>

Fix:
<S2SV_ModStart> if ( ( unconditional ( e <S2SV_ModEnd> ) && ( <S2SV_ModStart> verdict < 0 <S2SV_ModEnd> ) || visited
Buggy code:
 int obj2ast_type_ignore ( PyObject * obj, type_ignore_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) TypeIgnore_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { int lineno ; <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_lineno ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_lineno ) ; <START_BUG> if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_int ( tmp, & lineno, arena ) ;  <START_BUG> if ( res!= 0 ) goto failed ; <END_BUG>  Py_CLEAR ( tmp ) ; <START_BUG> } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   TypeIgnore" ) ; return 1 ; } * out = TypeIgnore ( lineno, arena ) ; if ( * out == NULL ) goto failed ; return 0 ; } PyErr_Format ( PyExc_TypeError, "expected   some   sort   of   type_ignore,   but   got   %R", obj ) ; failed : Py_XDECREF ( tmp ) ; return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"lineno\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> TypeIgnore" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 <S2SV_ModEnd> ) goto failed <S2SV_ModStart> goto failed ; Py_CLEAR ( tmp ) ; } * out = TypeIgnore ( <S2SV_ModEnd> lineno, arena <S2SV_ModStart> ; if ( * out == NULL <S2SV_ModEnd> ) goto failed <S2SV_ModStart> goto failed ; <S2SV_ModEnd> return 0 ;
Buggy code:
 static void mt76_add_fragment ( struct mt76_dev * dev, struct mt76_queue * q, void * data, int len, bool more ) { struct page * page = virt_to_head_page ( data ) ; int offset = data - page_address ( page ) ; struct sk_buff * skb = q -> rx_head ; <START_BUG> offset += q -> buf_offset ; <END_BUG>  skb_add_rx_frag ( skb, skb_shinfo ( skb ) -> nr_frags, page, offset, len, <START_BUG> <END_BUG> q -> buf_size ) ;  if ( more ) return ; q -> rx_head = NULL ; dev -> drv -> rx_skb ( dev, q - dev -> q_rx, skb ) ; }

Fix:
<S2SV_ModStart> -> rx_head ; struct skb_shared_info * shinfo = skb_shinfo ( skb ) ; if ( shinfo -> nr_frags < ARRAY_SIZE ( shinfo -> frags ) ) { <S2SV_ModStart> ( skb, shinfo <S2SV_ModEnd> -> nr_frags, <S2SV_ModStart> buf_size ) ; }
Buggy code:
 krb5_error_code setup_server_realm ( krb5_principal sprinc ) { krb5_error_code kret ; kdc_realm_t * newrealm ; <START_BUG> kret = 0 ; <END_BUG> if ( kdc_numrealms > 1 ) { if (! ( newrealm = find_realm_data ( sprinc -> realm. data, ( krb5_ui_4 ) sprinc -> realm. length ) ) ) kret = ENOENT ; else kdc_active_realm = newrealm ; } else kdc_active_realm = kdc_realmlist [ 0 ] ; return ( kret ) ; }

Fix:
<S2SV_ModStart> kret = 0 ; if ( sprinc == NULL ) return NULL
Buggy code:
 static int check_cond_jmp_op ( struct bpf_verifier_env * env, struct bpf_insn * insn, int * insn_idx ) { struct bpf_verifier_state * this_branch = env -> cur_state ; struct bpf_verifier_state * other_branch ; struct bpf_reg_state * regs = this_branch -> frame [ this_branch -> curframe ] -> regs ; struct bpf_reg_state * dst_reg, * other_branch_regs ; u8 opcode = BPF_OP ( insn -> code ) ; int err ; if ( opcode > BPF_JSLE ) { verbose ( env, "invalid   BPF_JMP   opcode   %x\\n", opcode ) ; return - EINVAL ; } if ( BPF_SRC ( insn -> code ) == BPF_X ) { if ( insn -> imm!= 0 ) { verbose ( env, "BPF_JMP   uses   reserved   fields\\n" ) ; return - EINVAL ; } err = check_reg_arg ( env, insn -> src_reg, SRC_OP ) ; if ( err ) return err ; if ( is_pointer_value ( env, insn -> src_reg ) ) { verbose ( env, "R%d   pointer   comparison   prohibited\\n", insn -> src_reg ) ; return - EACCES ; } } else { if ( insn -> src_reg!= BPF_REG_0 ) { verbose ( env, "BPF_JMP   uses   reserved   fields\\n" ) ; return - EINVAL ; } } err = check_reg_arg ( env, insn -> dst_reg, SRC_OP ) ; if ( err ) return err ; dst_reg = & regs [ insn -> dst_reg ] ; if ( BPF_SRC ( insn -> code ) == BPF_K ) { int pred = is_branch_taken ( dst_reg, insn -> imm, opcode ) ; if ( pred == 1 ) { * insn_idx += insn -> off ; return 0 ; } else if ( pred == 0 ) { return 0 ; } } <START_BUG> other_branch = push_stack ( env, * insn_idx + insn -> off + 1, * insn_idx ) ; <END_BUG> if (! other_branch

Fix:
<S2SV_ModStart>, * insn_idx, false
Buggy code:
 static void pci_lintr_route ( struct pci_vdev * dev ) { struct businfo * bi ; struct intxinfo * ii ; if ( dev -> lintr. pin == 0 ) return ; bi = pci_businfo [ dev -> bus ] ; <START_BUG> assert ( bi!= NULL ) ; <END_BUG> ii = & bi -> slotinfo [ dev -> slot ]. si_intpins [ dev -> lintr. pin - 1 ] ; if ( ii -> ii_ioapic_irq == 0 ) ii -> ii_ioapic_irq = ioapic_pci_alloc_irq ( dev ) ;  assert ( ii -> ii_ioapic_irq > 0 ) ; <START_BUG> if ( ii -> ii_pirq_pin == 0 ) <END_BUG> ii -> ii_pirq_pin = pirq_alloc_pin ( dev ) ;  assert ( ii -> ii_pirq_pin > 0 ) ; dev -> lintr. ioapic_irq = ii -> ii_ioapic_irq ; dev -> lintr. pirq_pin = ii -> ii_pirq_pin ; pci_set_cfgdata8 ( dev, PCIR_INTLINE, pirq_irq ( ii -> ii_pirq_pin ) ) ; }

Fix:
<S2SV_ModStart> bus ] ; if ( bi == NULL ) { pr_err ( "%s: <S2SV_blank> pci <S2SV_blank> [%s] <S2SV_blank> has <S2SV_blank> wrong <S2SV_blank> bus <S2SV_blank> %d <S2SV_blank> info!\\n", __func__, dev -> name, dev -> bus ) ; return ; } <S2SV_ModEnd> ii = & <S2SV_ModStart> dev ) ; <S2SV_ModEnd> if ( ii <S2SV_ModStart> pirq_alloc_pin ( dev <S2SV_ModEnd> ) ; dev
Buggy code:
 static expr_ty ast_for_atom ( struct compiling * c, const node * n ) { node * ch = CHILD ( n, 0 ) ; switch ( TYPE ( ch ) ) { case NAME : { PyObject * name ; const char * s = STR ( ch ) ; size_t len = strlen ( s ) ; if ( len >= 4 && len <= 5 ) { if (! strcmp ( s, "None" ) ) return NameConstant ( Py_None, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; if (! strcmp ( s, "True" ) ) return NameConstant ( Py_True, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; if (! strcmp ( s, "False" ) ) return NameConstant ( Py_False, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } name = new_identifier ( s, c ) ; if (! name ) return NULL ; return Name ( name, Load, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } case STRING : { expr_ty str = parsestrplus ( c, n ) ; if (! str ) { const char * errtype = NULL ; if ( PyErr_ExceptionMatches ( PyExc_UnicodeError ) ) errtype = "unicode   error" ; else if ( PyErr_ExceptionMatches ( PyExc_ValueError ) ) errtype = "value   error" ; if ( errtype ) { char buf [ 128 ] ; const char * s = NULL ; PyObject * type, * value, * tback, * errstr ; PyErr_Fetch ( & type, & value, & tback ) ; errstr = PyObject_Str ( value ) ; if ( errstr ) s = PyUnicode_AsUTF8 ( errstr ) ; if ( s ) { PyOS_snprintf ( buf, sizeof ( buf ), "(%s)   %s", errtype, s ) ; } else { PyErr_Clear ( ) ; PyOS_snprintf ( buf, sizeof ( buf ), "(%s)   unknown   error", errtype ) ; } Py_XDECREF ( errstr ) ; ast_error

Fix:
<S2SV_ModStart> ( c, STR ( ch ) <S2SV_ModEnd> ) ; if
Buggy code:
 stmt_ty <START_BUG> For ( expr_ty target, expr_ty iter, asdl_seq * body, asdl_seq * orelse, int <END_BUG> lineno, int col_offset, int end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; if (! target ) { PyErr_SetString ( PyExc_ValueError, "field   target   is   required   for   For" ) ; return NULL ; } if (! iter ) { PyErr_SetString ( PyExc_ValueError, "field   iter   is   required   for   For" ) ; return NULL ; } p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = For_kind ; p -> v. For. target = target ; p -> v. For. iter = iter ; p -> v. For. body = body ;  p -> v. For. orelse = orelse ; <START_BUG> p -> lineno = lineno ; p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> * orelse, string type_comment, int <S2SV_ModEnd> lineno, int <S2SV_ModStart> orelse = orelse ; p -> v. For. type_comment = type_comment
Buggy code:
 int handle_ldf_stq ( u32 insn, struct pt_regs * regs ) { unsigned long addr = compute_effective_address ( regs, insn, 0 ) ; int freg = ( ( insn >> 25 ) & 0x1e ) | ( ( insn >> 20 ) & 0x20 ) ; struct fpustate * f = FPUSTATE ; int asi = decode_asi ( insn, regs ) ; int flag = ( freg < 32 )? FPRS_DL : FPRS_DU ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> save_and_clear_fpu ( ) ; current_thread_info ( ) -> xfsr [ 0 ] &= ~ 0x1c000 ; if ( freg & 3 ) { current_thread_info ( ) -> xfsr [ 0 ] |= ( 6 << 14 ) ; do_fpother ( regs ) ; return 0 ; } if ( insn & 0x200000 ) { u64 first = 0, second = 0 ; if ( current_thread_info ( ) -> fpsaved [ 0 ] & flag ) { first = * ( u64 * ) & f -> regs [ freg ] ; second = * ( u64 * ) & f -> regs [ freg + 2 ] ; } if ( asi < 0x80 ) { do_privact ( regs ) ; return 1 ; } switch ( asi ) { case ASI_P : case ASI_S : break ; case ASI_PL : case ASI_SL : { u64 tmp = __swab64p ( & first ) ; first = __swab64p ( & second ) ; second = tmp ; break ; } default : if ( tlb_type == hypervisor ) sun4v_data_access_exception ( regs, addr, 0 ) ; else spitfire_data_access_exception ( regs, 0, addr ) ; return 1 ; } if ( put_user ( first >> 32, ( u32 __user * ) addr ) || __put_user ( ( u32 ) first, ( u32 __user * ) ( addr + 4 ) ) || __put_user ( second >> 32, ( u32 __user * ) ( addr + 8 ) ) || __put_user

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, 0
Buggy code:
 static int hybiReadAndDecode ( ws_ctx_t * wsctx, char * dst, int len, int * sockRet, int nInBuf ) { int n ; int i ; int toReturn ; int toDecode ; int bufsize ; int nextRead ; <START_BUG> unsigned char * data ; <END_BUG> uint32_t * data32 ; memcpy ( wsctx -> writePos, wsctx -> carryBuf, wsctx -> carrylen ) ; wsctx -> writePos += wsctx -> carrylen ; bufsize = wsctx -> codeBufDecode + ARRAYSIZE ( wsctx -> codeBufDecode ) - wsctx -> writePos - 1 ; ws_dbg ( "bufsize=%d\\n", bufsize ) ; if ( hybiRemaining ( wsctx ) > bufsize ) { nextRead = bufsize ; } else { nextRead = hybiRemaining ( wsctx ) ; } ws_dbg ( "calling   read   with   buf=%p   and   len=%d   (decodebuf=%p   headerLen=%d)\\n", wsctx -> writePos, nextRead, wsctx -> codeBufDecode, wsctx -> header. headerLen ) ; if ( nextRead > 0 ) { if ( - 1 == ( n = wsctx -> ctxInfo. readFunc ( wsctx -> ctxInfo. ctxPtr, wsctx -> writePos, nextRead ) ) ) { int olderrno = errno ; rfbErr ( "%s:   read;   %s", __func__, strerror ( errno ) ) ; errno = olderrno ; * sockRet = - 1 ; return WS_HYBI_STATE_ERR ; } else if ( n == 0 ) { * sockRet = 0 ; return WS_HYBI_STATE_ERR ; } else { ws_dbg ( "read   %d   bytes   from   socket;   nRead=%d\\n", n, wsctx -> nReadPayload ) ; } } else { n = 0 ; } wsctx -> nReadPayload += n ; wsctx -> writePos += n ; if ( hybiRemaining ( wsctx ) == 0 ) { wsctx -> hybiDecodeState = WS_HYBI_STATE_FRAME_COMPLETE ; } toDecode = n + wsctx -> carrylen + nInBuf ; ws_dbg ( "toDecode=%d   from   n=%

Fix:
<S2SV_ModStart> char * data <S2SV_ModEnd> ; memcpy ( <S2SV_ModStart> toDecode ) ; <S2SV_ModEnd> for ( i <S2SV_ModStart> ++ ) { uint32_t tmp ; memcpy ( & tmp, data + i * sizeof ( tmp ), sizeof ( tmp ) ) ; tmp <S2SV_ModEnd> ^= wsctx -> <S2SV_ModStart> mask. u ; memcpy ( data + i * sizeof ( tmp ), & tmp, sizeof ( tmp ) )
Buggy code:
 static int ipx_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct ipx_sock * ipxs = ipx_sk ( sk ) ; struct sockaddr_ipx * sipx = ( struct sockaddr_ipx * ) msg -> msg_name ; struct ipxhdr * ipx = NULL ; struct sk_buff * skb ; int copied, rc ; lock_sock ( sk ) ; if (! ipxs -> port ) { struct sockaddr_ipx uaddr ; uaddr. sipx_port = 0 ; uaddr. sipx_network = 0 ; # ifdef CONFIG_IPX_INTERN rc = - ENETDOWN ; if (! ipxs -> intrfc ) goto out ; memcpy ( uaddr. sipx_node, ipxs -> intrfc -> if_node, IPX_NODE_LEN ) ; # endif rc = __ipx_bind ( sock, ( struct sockaddr * ) & uaddr, sizeof ( struct sockaddr_ipx ) ) ; if ( rc ) goto out ; } rc = - ENOTCONN ; if ( sock_flag ( sk, SOCK_ZAPPED ) ) goto out ; skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & rc ) ; if (! skb ) goto out ; ipx = ipx_hdr ( skb ) ; copied = ntohs ( ipx -> ipx_pktsize ) - sizeof ( struct ipxhdr ) ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } rc = skb_copy_datagram_iovec ( skb, sizeof ( struct ipxhdr ), msg -> msg_iov, copied ) ; if ( rc ) goto out_free ; if ( skb -> tstamp. tv64 ) sk -> sk_stamp = skb -> tstamp ; <START_BUG> msg -> msg_namelen = sizeof ( * sipx ) ; <END_BUG> if ( sipx ) { sipx -> sipx_family = AF_IPX ; sipx -> sipx_port = ipx -> ipx_source. sock ; memc

Fix:
<S2SV_ModStart> -> tstamp ; if ( sipx ) { sipx -> sipx_family = AF_IPX ; sipx -> sipx_port = ipx -> ipx_source. sock ; memcpy ( sipx -> sipx_node, ipx -> ipx_source. node, IPX_NODE_LEN ) ; sipx -> sipx_network = IPX_SKB_CB ( skb ) -> ipx_source_net ; sipx -> sipx_type = ipx -> ipx_type ; sipx -> sipx_zero = 0 ; <S2SV_ModStart> * sipx ) <S2SV_ModEnd> ; } rc