nus-yam/ex-repair huggingface dataset:
Buggy code:
 void sink ( int argc, char * * argv ) { static BUF buffer ; struct stat stb ; enum { YES, NO, DISPLAYED } wrerr ; BUF * bp ; off_t i ; size_t j, count ; int amt, exists, first, ofd ; mode_t mode, omode, mask ; off_t size, statbytes ; unsigned long long ull ; int setimes, targisdir, wrerrno = 0 ; char ch, * cp, * np, * targ, * why, * vect [ 1 ], buf [ 2048 ], visbuf [ 2048 ] ; struct timeval tv [ 2 ] ; # define atime tv [ 0 ] # define mtime tv [ 1 ] # define SCREWUP ( str ) { why = str ; goto screwup ; } if ( TYPE_OVERFLOW ( time_t, 0 ) || TYPE_OVERFLOW ( off_t, 0 ) ) SCREWUP ( "Unexpected   off_t//time_t   size" ) ; setimes = targisdir = 0 ; mask = umask ( 0 ) ; if (! pflag ) ( void ) umask ( mask ) ; if ( argc!= 1 ) { run_err ( "ambiguous   target" ) ; exit ( 1 ) ; } targ = * argv ; if ( targetshouldbedirectory ) verifydir ( targ ) ; ( void ) atomicio ( vwrite, remout, "", 1 ) ; if ( stat ( targ, & stb ) == 0 && S_ISDIR ( stb. st_mode ) ) targisdir = 1 ; for ( first = 1 ; ; first = 0 ) { cp = buf ; if ( atomicio ( read, remin, cp, 1 )!= 1 ) return ; if ( * cp ++ == '\\n' ) SCREWUP ( "unexpected   <newline>" ) ; do { if ( atomicio ( read, remin, & ch, sizeof ( ch ) )!= sizeof ( ch ) ) SCREWUP ( "lost   connection" ) ; * cp ++ = ch ; } while ( cp < & buf [ sizeof ( buf ) - 1 ] && ch!= '\\n' ) ; * cp = 0 ; if ( verbose_mode ) fmprintf ( stderr, "Sink:   %s", buf ) ; if ( buf [ 0 ] == '\\

Fix:
<S2SV_ModStart> ; if ( * cp == '\\0' || <S2SV_ModEnd> strchr ( cp <S2SV_ModStart> )!= NULL || <S2SV_ModEnd> strcmp ( cp <S2SV_ModStart> ( cp, "." ) == 0 || strcmp ( cp, <S2SV_ModStart> ) == 0 <S2SV_ModEnd> ) { run_err
Buggy code:
 static void * my_malloc ( size_t size ) { <START_BUG> malloc_called += 1 ; <END_BUG> return malloc ( size ) ; }

Fix:
<S2SV_ModStart> ) { malloc_called = <S2SV_ModEnd> 1 ; return
Buggy code:
 static Image * ReadCAPTIONImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char * caption, geometry [ MaxTextExtent ], * property, * text ; const char * gravity, * option ; DrawInfo * draw_info ; Image * image ; MagickBooleanType split, status ; register ssize_t i ; size_t height, width ; TypeMetric metrics ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; ( void ) ResetImagePage ( image, "0x0+0+0" ) ; option = GetImageOption ( image_info, "filename" ) ; if ( option == ( const char * ) NULL ) property = InterpretImageProperties ( image_info, image, image_info -> filename ) ; else if ( LocaleNCompare ( option, "caption:", 8 ) == 0 ) property = InterpretImageProperties ( image_info, image, option + 8 ) ; else property = InterpretImageProperties ( image_info, image, option ) ; ( void ) SetImageProperty ( image, "caption", property ) ; property = DestroyString ( property ) ; caption = ConstantString ( GetImageProperty ( image, "caption" ) ) ; draw_info = CloneDrawInfo ( image_info, ( DrawInfo * ) NULL ) ; ( void ) CloneString ( & draw_info -> text, caption ) ; gravity = GetImageOption ( image_info, "gravity" ) ; if ( gravity!= ( char * ) NULL ) draw_info -> gravity = ( GravityType ) ParseCommandOption ( MagickGravityOptions, MagickFalse, gravity ) ; split = MagickFalse ; status = MagickTrue ; if ( image -> columns == 0 ) { text = AcquireString ( caption ) ; i = FormatMagickCaption ( image, draw_info, split, & metrics, & text ) ; ( void ) CloneString ( & draw_info -> text, text ) ; text = Destroy

Fix:
<S2SV_ModStart> 0.0 ) ; ( void ) CloneString ( & <S2SV_ModStart> draw_info -> geometry, <S2SV_ModEnd> geometry ) ;
Buggy code:
 void ff_jpeg2000_cleanup ( Jpeg2000Component * comp, Jpeg2000CodingStyle * codsty ) { int reslevelno, bandno, precno ; for ( reslevelno = 0 ; comp -> reslevel && reslevelno < codsty -> nreslevels ; reslevelno ++ ) { Jpeg2000ResLevel * reslevel = comp -> reslevel + reslevelno ; for ( bandno = 0 ; bandno < reslevel -> nbands ; bandno ++ ) { Jpeg2000Band * band = reslevel -> band + bandno ; for ( precno = 0 ; precno < reslevel -> num_precincts_x * reslevel -> num_precincts_y ; precno ++ ) { <START_BUG> Jpeg2000Prec * prec = band -> prec + precno ; <END_BUG> av_freep ( & prec -> zerobits ) ; av_freep ( & prec -> cblkincl ) ; av_freep ( & prec -> cblk ) ; }  av_freep ( & band -> prec ) ; <START_BUG> } av_freep ( & reslevel -> band ) ; } ff_dwt_destroy ( & comp -> dwt ) ; av_freep ( & comp -> reslevel ) ; av_freep ( & comp -> i_data ) ; av_freep ( & comp -> f_data ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ++ ) { if ( band -> prec ) { <S2SV_ModStart> ) ; } }
Buggy code:
 <START_BUG> int perf_event_overflow ( struct perf_event * event, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) {  return __perf_event_overflow ( event, nmi, 1, data, regs ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> perf_event * event <S2SV_ModEnd>, struct perf_sample_data <S2SV_ModStart> ( event, <S2SV_ModEnd> 1, data
Buggy code:
 int hsr_dev_finalize ( struct net_device * hsr_dev, struct net_device * slave [ 2 ], unsigned char multicast_spec, u8 protocol_version ) { struct hsr_priv * hsr ; struct hsr_port * port ; int res ; hsr = netdev_priv ( hsr_dev ) ; INIT_LIST_HEAD ( & hsr -> ports ) ; INIT_LIST_HEAD ( & hsr -> node_db ) ; INIT_LIST_HEAD ( & hsr -> self_node_db ) ; ether_addr_copy ( hsr_dev -> dev_addr, slave [ 0 ] -> dev_addr ) ; res = hsr_create_self_node ( & hsr -> self_node_db, hsr_dev -> dev_addr, slave [ 1 ] -> dev_addr ) ; if ( res < 0 ) return res ; spin_lock_init ( & hsr -> seqnr_lock ) ; hsr -> sequence_nr = HSR_SEQNR_START ; hsr -> sup_sequence_nr = HSR_SUP_SEQNR_START ; timer_setup ( & hsr -> announce_timer, hsr_announce, 0 ) ; timer_setup ( & hsr -> prune_timer, hsr_prune_nodes, 0 ) ; ether_addr_copy ( hsr -> sup_multicast_addr, def_multicast_addr ) ; hsr -> sup_multicast_addr [ ETH_ALEN - 1 ] = multicast_spec ; hsr -> protVersion = protocol_version ; netif_carrier_off ( hsr_dev ) ; res = hsr_add_port ( hsr, hsr_dev, HSR_PT_MASTER ) ; if ( res ) <START_BUG> return res ; <END_BUG> res = register_netdevice ( hsr_dev ) ; if ( res ) goto fail ; res = hsr_add_port ( hsr, slave [ 0 ], HSR_PT_SLAVE_A ) ; if ( res ) goto fail ; res = hsr_add_port ( hsr, slave [ 1 ], HSR_PT_SLAVE_B ) ; if ( res ) goto fail ; mod_timer ( & hsr -> prune_timer, jiffies + mse

Fix:
<S2SV_ModStart> ( res ) goto err_add_port <S2SV_ModEnd> ; res = <S2SV_ModStart> port ) ; err_add_port : hsr_del_node ( & hsr -> self_node_db ) ;
Buggy code:
 static int do_setxattr ( struct btrfs_trans_handle * trans, struct inode * inode, const char * name, const void * value, size_t size, int flags ) { <START_BUG> struct btrfs_dir_item * di ; <END_BUG> struct btrfs_root * root = BTRFS_I ( inode ) -> root ; struct btrfs_path * path ; size_t name_len = strlen ( name ) ; int ret = 0 ; if ( name_len + size > BTRFS_MAX_XATTR_SIZE ( root ) ) return - ENOSPC ; path = btrfs_alloc_path ( ) ; if (! path ) return - ENOMEM ;  if ( flags & XATTR_REPLACE ) { <START_BUG> <END_BUG> di = btrfs_lookup_xattr ( trans, root, path, btrfs_ino ( inode ), name,  name_len, - 1 ) ; if ( IS_ERR ( di ) ) { ret = PTR_ERR ( di ) ; goto out ; <START_BUG> } else if (! di ) { <END_BUG> ret = - ENODATA ; goto out ; }  ret = btrfs_delete_one_dir_name ( trans, root, path, di ) ; <START_BUG> if ( ret ) goto out ; <END_BUG> btrfs_release_path ( path ) ;  if (! value ) goto out ; <START_BUG> } else { <END_BUG> di = btrfs_lookup_xattr ( NULL, root, path, btrfs_ino ( inode ), name, name_len, 0 ) ; if ( IS_ERR ( di ) ) { ret = PTR_ERR ( di ) ; goto out ; } if (! di &&! value ) goto out ; btrfs_release_path ( path ) ; } again : ret = btrfs_insert_xattr_item ( trans, root, path, btrfs_ino ( inode ), name, name_len, value, size ) ; if ( ret == - EOVERFLOW ) ret = - EEXIST ; if ( ret == - EEXIST ) {  if ( flags & XATTR_CREATE ) <START_BUG> goto out ; <END_BUG> btrfs_release_path ( path ) ;  di = btrfs_lookup_xattr ( trans, root, path, btrfs_ino ( inode ),

Fix:
<S2SV_ModStart> btrfs_dir_item * di = NULL <S2SV_ModStart> - ENOMEM ; path -> skip_release_on_error = 1 ; if (! value ) { di = btrfs_lookup_xattr ( trans, root, path, btrfs_ino ( inode ), name, name_len, - 1 ) ; if (! di && <S2SV_ModEnd> ( flags & <S2SV_ModStart> & XATTR_REPLACE ) ) ret = - ENODATA ; else if ( di ) ret = btrfs_delete_one_dir_name <S2SV_ModEnd> ( trans, <S2SV_ModStart>, path, <S2SV_ModEnd> di ) ; <S2SV_ModStart> out ; } if ( flags & XATTR_REPLACE ) { ASSERT ( mutex_is_locked ( & inode -> i_mutex ) ) ; di = btrfs_lookup_xattr ( NULL, root, path, btrfs_ino ( inode ), name, name_len, 0 ) ; <S2SV_ModEnd> if (! <S2SV_ModStart> out ; } btrfs_release_path ( path ) ; di = NULL ; } ret = btrfs_insert_xattr_item <S2SV_ModEnd> ( trans, <S2SV_ModStart>, path, btrfs_ino ( inode ), name, name_len, value, size
Buggy code:
 int main ( int argc, char * * argv ) { l_int32 w, h ; PIX * pixs, * pixg, * pixim, * pixgm, * pixmi, * pix1, * pix2 ; PIX * pixmr, * pixmg, * pixmb, * pixmri, * pixmgi, * pixmbi ; <START_BUG> PIXA * pixa ; <END_BUG> L_REGPARAMS * rp ; if ( regTestSetup ( argc, argv, & rp ) ) return 1 ; lept_mkdir ( "lept//adapt" ) ; pixs = pixRead ( "wet-day.jpg" ) ; pixa = pixaCreate ( 0 ) ; pixg = pixConvertRGBToGray ( pixs, 0.33, 0.34, 0.33 ) ; pixaAddPix ( pixa, pixs, L_INSERT ) ; pixaAddPix ( pixa, pixg, L_INSERT ) ; pixGetDimensions ( pixs, & w, & h, NULL ) ; startTimer ( ) ; pixim = pixCreate ( w, h, 1 ) ; pixRasterop ( pixim, XS, YS, WS, HS, PIX_SET, NULL, 0, 0 ) ; pixGetBackgroundGrayMap ( pixg, pixim, SIZE_X, SIZE_Y, BINTHRESH, MINCOUNT, & pixgm ) ; fprintf ( stderr, "Time   for   gray   adaptmap   gen:   %7.3f\\n", stopTimer ( ) ) ; regTestWritePixAndCheck ( rp, pixgm, IFF_PNG ) ; pixaAddPix ( pixa, pixgm, L_INSERT ) ; startTimer ( ) ; pixmi = pixGetInvBackgroundMap ( pixgm, BGVAL, SMOOTH_X, SMOOTH_Y ) ; fprintf ( stderr, "Time   for   gray   inv   map   generation:   %7.3f\\n", stopTimer ( ) ) ; regTestWritePixAndCheck ( rp, pixmi, IFF_PNG ) ; pixaAddPix ( pixa, pixmi, L_INSERT ) ; startTimer ( ) ; pix1 = pixApplyInvBackgroundGrayMap ( pixg, pixmi, SIZE_X, SIZE_Y ) ; fprintf ( stderr

Fix:
<S2SV_ModStart> PIXA * pixa, * pixa2 <S2SV_ModStart> pixim ) ; pixa2 = pixaCreate ( 3 ) ; pix1 = pixRead ( "weasel8.png" ) ; pixGammaTRC ( pix1, pix1, 1.0, 0, 270 ) ; pixaAddPix ( pixa2, pix1, L_COPY ) ; pixGetDimensions ( pix1, & w, & h, NULL ) ; pixRasterop ( pix1, 0, 0, 5, h, PIX_SET, NULL, 0, 0 ) ; pixRasterop ( pix1 <S2SV_ModEnd>, 20, <S2SV_ModStart>, 20, 0, 2, h, PIX_SET, NULL, 0, 0 ) ; pixRasterop ( pix1, 40, 0, 3, h, PIX_SET, NULL, 0, 0 ) ; pixRasterop ( pix1, 0, 0, w, 3, PIX_SET, NULL, 0, 0 ) ; pixRasterop ( pix1, 0, 15, w, 3, PIX_SET, NULL, 0, 0 ) ; pixRasterop ( pix1, 0, 35, w, 2, PIX_
Buggy code:
 static struct sock * sctp_v6_create_accept_sk ( struct sock * sk, struct sctp_association * asoc, bool kern ) { struct sock * newsk ; struct ipv6_pinfo * newnp, * np = inet6_sk ( sk ) ; struct sctp6_sock * newsctp6sk ; struct ipv6_txoptions * opt ; newsk = sk_alloc ( sock_net ( sk ), PF_INET6, GFP_KERNEL, sk -> sk_prot, kern ) ; if (! newsk ) goto out ; sock_init_data ( NULL, newsk ) ; sctp_copy_sock ( newsk, sk, asoc ) ; sock_reset_flag ( sk, SOCK_ZAPPED ) ; newsctp6sk = ( struct sctp6_sock * ) newsk ; inet_sk ( newsk ) -> pinet6 = & newsctp6sk -> inet6 ; sctp_sk ( newsk ) -> v4mapped = sctp_sk ( sk ) -> v4mapped ; newnp = inet6_sk ( newsk ) ; <START_BUG> memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; <END_BUG> rcu_read_lock ( ) ; opt = rcu_dereference ( np -> opt ) ; if ( opt ) opt = ipv6_dup_options ( newsk, opt ) ; RCU_INIT_POINTER ( newnp -> opt, opt ) ; rcu_read_unlock ( ) ; sctp_v6_to_sk_daddr ( & asoc -> peer. primary_addr, newsk ) ; newsk -> sk_v6_rcv_saddr = sk -> sk_v6_rcv_saddr ; sk_refcnt_debug_inc ( newsk ) ; if ( newsk -> sk_prot -> init ( newsk ) ) { sk_common_release ( newsk ) ; newsk = NULL ; } out : return newsk ; }

Fix:
<S2SV_ModStart> ipv6_pinfo ) ) ; newnp -> ipv6_mc_list = NULL ; newnp -> ipv6_ac_list = NULL ; newnp -> ipv6_fl_list = NULL
Buggy code:
 static const u_char * ikev1_id_print ( netdissect_options * ndo, u_char tpay _U_, const struct isakmp_gen * ext, u_int item_len, const u_char * ep _U_, uint32_t phase, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { # define USE_IPSECDOI_IN_PHASE1 1 const struct ikev1_pl_id * p ; struct ikev1_pl_id id ; static const char * idtypestr [ ] = { "IPv4", "IPv4net", "IPv6", "IPv6net", } ; static const char * ipsecidtypestr [ ] = { NULL, "IPv4", "FQDN", "user   FQDN", "IPv4net", "IPv6", "IPv6net", "IPv4range", "IPv6range", "ASN1   DN", "ASN1   GN", "keyid", } ; int len ; const u_char * data ; ND_PRINT ( ( ndo, "%s:", NPSTR ( ISAKMP_NPTYPE_ID ) ) ) ; p = ( const struct ikev1_pl_id * ) ext ; ND_TCHECK ( * p ) ; UNALIGNED_MEMCPY ( & id, ext, sizeof ( id ) ) ; if ( sizeof ( * p ) < item_len ) { data = ( const u_char * ) ( p + 1 ) ; len = item_len - sizeof ( * p ) ; } else { data = NULL ; len = 0 ; } # if 0 ND_PRINT ( ( ndo, "   [phase=%d   doi=%d   proto=%d]", phase, doi, proto ) ) ; # endif switch ( phase ) { # ifndef USE_IPSECDOI_IN_PHASE1 case 1 : # endif default : ND_PRINT ( ( ndo, "   idtype=%s", STR_OR_ID ( id. d. id_type, idtypestr ) ) ) ; ND_PRINT ( ( ndo, "   doi_data=%u"

Fix:
<S2SV_ModStart> ( len < 32 ) ND_PRINT ( ( ndo, " <S2SV_blank> len=%d <S2SV_blank> [bad: <S2SV_blank> < <S2SV_blank> 32]" <S2SV_ModEnd>, len )
Buggy code:
 static long _syscall ( long num, long arg1, long arg2, long arg3, long arg4, long arg5, long arg6 ) { long ret = - 1 ; oe_errno = 0 ; switch ( num ) { # if defined ( OE_SYS_creat ) case OE_SYS_creat : { const char * pathname = ( const char * ) arg1 ; oe_mode_t mode = ( oe_mode_t ) arg2 ; int flags = ( OE_O_CREAT | OE_O_WRONLY | OE_O_TRUNC ) ; ret = oe_open ( pathname, flags, mode ) ; if ( oe_errno == OE_ENOENT ) { oe_errno = OE_ENOSYS ; goto done ; } goto done ; } # endif # if defined ( OE_SYS_open ) case OE_SYS_open : { const char * pathname = ( const char * ) arg1 ; int flags = ( int ) arg2 ; uint32_t mode = ( uint32_t ) arg3 ; ret = oe_open ( pathname, flags, mode ) ; if ( ret < 0 && oe_errno == OE_ENOENT ) goto done ; goto done ; } # endif case OE_SYS_openat : { int dirfd = ( int ) arg1 ; const char * pathname = ( const char * ) arg2 ; int flags = ( int ) arg3 ; uint32_t mode = ( uint32_t ) arg4 ; if ( dirfd!= OE_AT_FDCWD ) { oe_errno = OE_EBADF ; goto done ; } ret = oe_open ( pathname, flags, mode ) ; if ( ret < 0 && oe_errno == OE_ENOENT ) goto done ; goto done ; } case OE_SYS_lseek : { int fd = ( int ) arg1 ; ssize_t off = ( ssize_t ) arg2 ; int whence = ( int ) arg3 ; ret = oe_lseek ( fd, off, whence ) ; goto done ; } case OE_SYS_pread64 : { const int fd = ( int ) arg1 ; void * const buf = ( void * ) arg2 ;

Fix:
<S2SV_ModStart> ) arg4 ; <S2SV_ModEnd> struct oe_sockaddr * <S2SV_ModStart> * dest_add = ( <S2SV_ModEnd> struct oe_sockaddr *
Buggy code:
 int sqlite3ExprCodeTarget ( Parse * pParse, Expr * pExpr, int target ) { Vdbe * v = pParse -> pVdbe ; int op ; int inReg = target ; int regFree1 = 0 ; int regFree2 = 0 ; int r1, r2 ; Expr tempX ; int p5 = 0 ; assert ( target > 0 && target <= pParse -> nMem ) ; if ( v == 0 ) { assert ( pParse -> db -> mallocFailed ) ; return 0 ; } expr_code_doover : if ( pExpr == 0 ) { op = TK_NULL ; } else { op = pExpr -> op ; } switch ( op ) { case TK_AGG_COLUMN : { AggInfo * pAggInfo = pExpr -> pAggInfo ; struct AggInfo_col * pCol = & pAggInfo -> aCol [ pExpr -> iAgg ] ; if (! pAggInfo -> directMode ) { assert ( pCol -> iMem > 0 ) ; return pCol -> iMem ; } else if ( pAggInfo -> useSortingIdx ) { sqlite3VdbeAddOp3 ( v, OP_Column, pAggInfo -> sortingIdxPTab, pCol -> iSorterColumn, target ) ; return target ; } } case TK_COLUMN : { int iTab = pExpr -> iTable ; if ( ExprHasProperty ( pExpr, EP_FixedCol ) ) { int iReg = sqlite3ExprCodeTarget ( pParse, pExpr -> pLeft, target ) ; <START_BUG> int aff = sqlite3TableColumnAffinity ( pExpr -> y. pTab, pExpr -> iColumn ) ; <END_BUG> if ( aff > SQLITE_AFF_BLOB ) { static const char zAff [ ] = "B\\000C\\000D\\000E" ; assert ( SQLITE_AFF_BLOB == 'A' ) ; assert ( SQLITE_AFF_TEXT == 'B' ) ; if ( iReg!= target ) { sqlite3VdbeAddOp2 ( v, OP_SCopy, iReg, target ) ; iReg = target ; } sqlite3VdbeAddOp4 ( v, OP_Affinity, iReg, 1, 0, & zAff [ ( aff - 'B' ) * 2 ], P4_STATIC )

Fix:
<S2SV_ModStart> ; int aff ; if ( pExpr -> y. pTab ) { aff <S2SV_ModStart> iColumn ) ; } else { aff = pExpr -> affExpr ; }
Buggy code:
 ssize_t cdf_read_short_sector ( const cdf_stream_t * sst, void * buf, size_t offs, size_t len, const cdf_header_t * h, cdf_secid_t id ) { <START_BUG> assert ( ( size_t ) CDF_SHORT_SEC_SIZE ( h ) == len ) ; <END_BUG> ( void ) memcpy ( ( ( char * ) buf ) + offs,  ( ( const char * ) sst -> sst_tab ) + CDF_SHORT_SEC_POS ( h, id ), len ) ; <START_BUG> return len ; }<END_BUG>

Fix:
<S2SV_ModStart> id ) { size_t ss = <S2SV_ModEnd> CDF_SHORT_SEC_SIZE ( h <S2SV_ModStart> ( h ) ; size_t pos = CDF_SHORT_SEC_POS ( h, id ) ; assert ( ss <S2SV_ModStart> len ) ; if ( sst -> sst_len < ( size_t ) id ) { DPRINTF ( ( "bad <S2SV_blank> sector <S2SV_blank> id <S2SV_blank> %d <S2SV_blank> > <S2SV_blank> %d\\n", id, sst -> sst_len ) ) ; return - 1 ; } <S2SV_ModStart> sst_tab ) + pos <S2SV_ModEnd>, len )
Buggy code:
 static int command_write ( struct pci_dev * dev, int offset, u16 value, void * data ) { struct xen_pcibk_dev_data * dev_data ; int err ; <START_BUG> dev_data = pci_get_drvdata ( dev ) ; <END_BUG> if (! pci_is_enabled ( dev ) && is_enable_cmd ( value ) ) { if ( unlikely ( verbose_request ) ) printk ( KERN_DEBUG DRV_NAME ":   %s:   enable\\n", pci_name ( dev ) ) ; err = pci_enable_device ( dev ) ; if ( err ) return err ; if ( dev_data ) dev_data -> enable_intx = 1 ; } else if ( pci_is_enabled ( dev ) &&! is_enable_cmd ( value ) ) { if ( unlikely ( verbose_request ) ) printk ( KERN_DEBUG DRV_NAME ":   %s:   disable\\n", pci_name ( dev ) ) ; pci_disable_device ( dev ) ; if ( dev_data ) dev_data -> enable_intx = 0 ; } if (! dev -> is_busmaster && is_master_cmd ( value ) ) { if ( unlikely ( verbose_request ) ) printk ( KERN_DEBUG DRV_NAME ":   %s:   set   bus   master\\n", pci_name ( dev ) ) ; pci_set_master ( dev ) ; } if ( value & PCI_COMMAND_INVALIDATE ) { if ( unlikely ( verbose_request ) ) printk ( KERN_DEBUG DRV_NAME ":   %s:   enable   memory-write-invalidate\\n", pci_name ( dev ) ) ; err = pci_set_mwi ( dev ) ; if ( err ) { pr_warn ( "%s:   cannot   enable   memory-write-invalidate   (%d)\\n", pci_name ( dev ), err ) ; value &= ~ PCI_COMMAND_INVALIDATE ; } }  return pci_write_config_word ( dev, offset, value ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> int err ; u16 val ; struct pci_cmd_info * cmd = data ; <S2SV_ModStart> ; } } cmd -> val = value ; if (! permissive && (! dev_data ||! dev_data -> permissive ) ) return 0 ; err = pci_read_config_word ( dev, offset, & val ) ; if ( err || val == value ) return err ; value &= PCI_COMMAND_GUEST ; value |= val & ~ PCI_COMMAND_GUEST ;
Buggy code:
 <START_BUG> static MB_PREDICTION_MODE read_inter_mode ( VP9_COMMON * cm, vp9_reader * r, <END_BUG> int ctx ) {  const int mode = vp9_read_tree ( r, vp9_inter_mode_tree, <START_BUG> <END_BUG> cm -> fc. inter_mode_probs [ ctx ] ) ;  <START_BUG> if (! cm -> frame_parallel_decoding_mode ) <END_BUG> ++ cm -> counts. inter_mode [ ctx ] [ mode ] ; return NEARESTMV + mode ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static PREDICTION_MODE <S2SV_ModEnd> read_inter_mode ( VP9_COMMON <S2SV_ModStart> * cm, MACROBLOCKD * xd, vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> int mode = vpx_read_tree <S2SV_ModEnd> ( r, <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> inter_mode_probs [ ctx <S2SV_ModStart> ] ) ; FRAME_COUNTS * counts = xd -> counts ; if ( counts ) ++ counts -> <S2SV_ModEnd> inter_mode [ ctx
Buggy code:
 static int MP4_ReadBox_String ( stream_t * p_stream, MP4_Box_t * p_box ) { <START_BUG> MP4_READBOX_ENTER ( MP4_Box_data_string_t ) ; <END_BUG> p_box -> data. p_string -> psz_text = malloc ( p_box -> i_size + 1 - 8 ) ; if ( p_box -> data. p_string -> psz_text == NULL ) MP4_READBOX_EXIT ( 0 ) ; memcpy ( p_box -> data. p_string -> psz_text, p_peek, p_box -> i_size - 8 ) ; p_box -> data. p_string -> psz_text [ p_box -> i_size - 8 ] = '\\0' ; # ifdef MP4_VERBOSE msg_Dbg ( p_stream, "read   box:   \\"%4.4s\\"   text=`%s\'", ( char * ) & p_box -> i_type, p_box -> data. p_string -> psz_text ) ; # endif MP4_READBOX_EXIT ( 1 ) ; }

Fix:
<S2SV_ModStart> MP4_READBOX_ENTER ( MP4_Box_data_string_t ) ; if ( p_box -> i_size < 8 || p_box -> i_size > SIZE_MAX ) MP4_READBOX_EXIT ( 0
Buggy code:
 int x86_decode_insn ( struct x86_emulate_ctxt * ctxt, void * insn, int insn_len ) { int rc = X86EMUL_CONTINUE ; int mode = ctxt -> mode ; int def_op_bytes, def_ad_bytes, goffset, simd_prefix ; bool op_prefix = false ; bool has_seg_override = false ; struct opcode opcode ; ctxt -> memop. type = OP_NONE ; ctxt -> memopp = NULL ; ctxt -> _eip = ctxt -> eip ; ctxt -> fetch. ptr = ctxt -> fetch. data ; ctxt -> fetch. end = ctxt -> fetch. data + insn_len ; ctxt -> opcode_len = 1 ; if ( insn_len > 0 ) memcpy ( ctxt -> fetch. data, insn, insn_len ) ; else { rc = __do_insn_fetch_bytes ( ctxt, 1 ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; } switch ( mode ) { case X86EMUL_MODE_REAL : case X86EMUL_MODE_VM86 : case X86EMUL_MODE_PROT16 : def_op_bytes = def_ad_bytes = 2 ; break ; case X86EMUL_MODE_PROT32 : def_op_bytes = def_ad_bytes = 4 ; break ; # ifdef CONFIG_X86_64 case X86EMUL_MODE_PROT64 : def_op_bytes = 4 ; def_ad_bytes = 8 ; break ; # endif default : return EMULATION_FAILED ; } ctxt -> op_bytes = def_op_bytes ; ctxt -> ad_bytes = def_ad_bytes ; for ( ; ; ) { switch ( ctxt -> b = insn_fetch ( u8, ctxt ) ) { case 0x66 : op_prefix = true ; ctxt -> op_bytes = def_op_bytes ^ 6 ; break ; case 0x67 : if ( mode == X86EMUL_MODE_PROT64 ) ctxt -> ad_bytes = def_ad_bytes ^ 12 ; else ctxt -> ad_bytes = def_ad_bytes ^ 6 ; break ; case 0x26 : case 0x2e : case 0x36 : case 0x3e : has_seg_override = true ; ctxt ->

Fix:
<S2SV_ModStart> ctxt -> rip_relative && likely ( ctxt -> memopp )
Buggy code:
 int amqp_handle_input ( amqp_connection_state_t state, amqp_bytes_t received_data, amqp_frame_t * decoded_frame ) { size_t bytes_consumed ; void * raw_frame ; decoded_frame -> frame_type = 0 ; if ( received_data. len == 0 ) { return AMQP_STATUS_OK ; } if ( state -> state == CONNECTION_STATE_IDLE ) { state -> state = CONNECTION_STATE_HEADER ; } bytes_consumed = consume_data ( state, & received_data ) ; if ( state -> inbound_offset < state -> target_size ) { return ( int ) bytes_consumed ; } raw_frame = state -> inbound_buffer. bytes ; switch ( state -> state ) { case CONNECTION_STATE_INITIAL : if ( memcmp ( raw_frame, "AMQP", 4 ) == 0 ) { decoded_frame -> frame_type = AMQP_PSEUDOFRAME_PROTOCOL_HEADER ; decoded_frame -> channel = 0 ; decoded_frame -> payload. protocol_header. transport_high = amqp_d8 ( amqp_offset ( raw_frame, 4 ) ) ; decoded_frame -> payload. protocol_header. transport_low = amqp_d8 ( amqp_offset ( raw_frame, 5 ) ) ; decoded_frame -> payload. protocol_header. protocol_version_major = amqp_d8 ( amqp_offset ( raw_frame, 6 ) ) ; decoded_frame -> payload. protocol_header. protocol_version_minor = amqp_d8 ( amqp_offset ( raw_frame, 7 ) ) ; return_to_idle ( state ) ; return ( int ) bytes_consumed ; } case CONNECTION_STATE_HEADER : { amqp_channel_t channel ; amqp_pool_t * channel_pool ; <START_BUG> channel = amqp_d16 ( amqp_offset ( raw_frame, 1 ) ) ; <END_BUG>  state -> target_size = <START_BUG> <END_BUG> amqp_d32 ( amqp_offset ( raw_frame, 3 ) ) + HEADER_SIZE + FOOTER_SIZE ;  if ( ( size_t ) state -> frame_max < state -> target_size ) { return AMQP_STATUS_BAD_AMQP_DATA ; } channel_pool = amqp_get_or_create_channel_pool ( state, channel ) ; if ( NULL

Fix:
<S2SV_ModStart> * channel_pool ; uint32_t frame_size ; <S2SV_ModStart> ) ) ; frame_size = amqp_d32 ( amqp_offset ( raw_frame, 3 ) ) ; if ( frame_size >= INT32_MAX ) { return AMQP_STATUS_BAD_AMQP_DATA ; } <S2SV_ModStart> -> target_size = frame_size <S2SV_ModEnd> + HEADER_SIZE +
Buggy code:
 <START_BUG> static int jas_iccputsint ( jas_stream_t * out, int n, longlong val ) <END_BUG> {  ulonglong tmp ; <START_BUG> tmp = ( val < 0 )? ( abort ( ), 0 ) : val ; return jas_iccputuint ( out, n, tmp ) ; }<END_BUG>

Fix:
<S2SV_ModStart> int n, jas_longlong <S2SV_ModEnd> val ) { <S2SV_ModStart> val ) { jas_ulonglong <S2SV_ModEnd> tmp ; tmp
Buggy code:
 generic_ret * delete_policy_2_svc ( dpol_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } prime_arg = arg -> name ; if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_DELETE, NULL, NULL ) ) { log_unauth ( "kadm5_delete_policy", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_DELETE ; } else { ret. code = kadm5_delete_policy ( ( void * ) handle, arg -> name ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_delete_policy", ( ( prime_arg == NULL )? "(null)" : prime_arg ), errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; }  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_release_buffer ( & minor_stat, & service_name ) ; exit_func : free_server_handle ( handle ) ; return & ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static int dbConnect ( char * host, char * user, char * passwd ) { DBUG_ENTER ( "dbConnect" ) ; if ( verbose ) { fprintf ( stderr, "#   Connecting   to   %s...\\n", host? host : "localhost" ) ; } mysql_init ( & mysql_connection ) ; if ( opt_compress ) mysql_options ( & mysql_connection, MYSQL_OPT_COMPRESS, NullS ) ; <START_BUG> # ifdef HAVE_OPENSSL <END_BUG> if ( opt_use_ssl ) { mysql_ssl_set ( & mysql_connection, opt_ssl_key, opt_ssl_cert, opt_ssl_ca, opt_ssl_capath, opt_ssl_cipher ) ; mysql_options ( & mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl ) ; mysql_options ( & mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath ) ; } # endif if ( opt_protocol ) mysql_options ( & mysql_connection, MYSQL_OPT_PROTOCOL, ( char * ) & opt_protocol ) ; if ( opt_bind_addr ) mysql_options ( & mysql_connection, MYSQL_OPT_BIND, opt_bind_addr ) ; # if defined ( _WIN32 ) &&! defined ( EMBEDDED_LIBRARY ) if ( shared_memory_base_name ) mysql_options ( & mysql_connection, MYSQL_SHARED_MEMORY_BASE_NAME, shared_memory_base_name ) ; # endif if ( opt_plugin_dir && * opt_plugin_dir ) mysql_options ( & mysql_connection, MYSQL_PLUGIN_DIR, opt_plugin_dir ) ; if ( opt_default_auth && * opt_default_auth ) mysql_options ( & mysql_connection, MYSQL_DEFAULT_AUTH, opt_default_auth ) ; mysql_options ( & mysql_connection, MYSQL_SET_CHARSET_NAME, default_charset ) ; mysql_options ( & mysql_connection, MYSQL_OPT_CONNECT_ATTR_RESET, 0 ) ; mysql_options4 ( & mysql_connection, MYSQL_OPT_CONNECT_ATTR_ADD, "program_name", "mysqlcheck" ) ; if (! ( sock = mysql_real_connect ( & mysql_connection, host

Fix:
<S2SV_ModStart> NullS ) ; SSL_SET_OPTIONS ( & mysql_connection ) ; <S2SV_ModEnd> if ( opt_protocol
Buggy code:
 error_t nicSendPacket ( NetInterface * interface, const NetBuffer * buffer, size_t offset, NetTxAncillary * ancillary ) { error_t error ; <START_BUG> bool_t status ; <END_BUG> netContext. entropy += netGetSystemTickCount ( ) ;  # if ( TRACE_LEVEL >= TRACE_LEVEL_DEBUG ) <START_BUG> size_t length = netBufferGetLength ( buffer ) - offset ; TRACE_DEBUG ( "Sending   packet   (%" PRIuSIZE "   bytes)...\\r\\n", length ) ; TRACE_DEBUG_NET_BUFFER ( "     ", buffer, offset, length ) ; # endif if ( interface -> configured && interface -> nicDriver!= NULL ) { if ( interface -> nicDriver -> type == NIC_TYPE_LOOPBACK ) { status = TRUE ; } else { status = osWaitForEvent ( & interface -> nicTxEvent, NIC_MAX_BLOCKING_TIME ) ; } if ( status ) { interface -> nicDriver -> disableIrq ( interface ) ; error = interface -> nicDriver -> sendPacket ( interface, buffer, offset, ancillary ) ; if ( interface -> configured ) { interface -> nicDriver -> enableIrq ( interface ) ; } } else { error = NO_ERROR ; } } else { error = ERROR_INVALID_INTERFACE ; } return error ; }<END_BUG>

Fix:
<S2SV_ModStart> bool_t status ; # if ( TRACE_LEVEL >= TRACE_LEVEL_DEBUG ) size_t length = netBufferGetLength ( buffer ) - offset ; TRACE_DEBUG ( "Sending <S2SV_blank> packet <S2SV_blank> (%" PRIuSIZE " <S2SV_blank> bytes)...\\r\\n", length ) ; TRACE_DEBUG_NET_BUFFER ( " <S2SV_blank> <S2SV_blank> ", buffer, offset, length ) ; # endif <S2SV_ModStart> ( ) ; <S2SV_ModEnd> if ( interface
Buggy code:
 static void mark_context_stack ( mrb_state * mrb, struct mrb_context * c ) { size_t i ; <START_BUG> size_t e ; <END_BUG> if ( c -> stack == NULL ) return ; e = c -> stack - c -> stbase ; if ( c -> ci ) e += c -> ci -> nregs ; if ( c -> stbase + e > c -> stend ) e = c -> stend - c -> stbase ; for ( i = 0 ; i < e ; i ++ ) { mrb_value v = c -> stbase [ i ] ; if (! mrb_immediate_p ( v ) ) {  if ( mrb_basic_ptr ( v ) -> tt == MRB_TT_FREE ) { <START_BUG> c -> stbase [ i ] = mrb_nil_value ( ) ; } else { mrb_gc_mark ( mrb, mrb_basic_ptr ( v ) ) ; } } <END_BUG> }  }

Fix:
<S2SV_ModStart> ; size_t e ; mrb_value nil <S2SV_ModStart> ) ) { <S2SV_ModEnd> mrb_gc_mark ( mrb <S2SV_ModStart> ; } } e = c -> stend - c -> stbase ; nil = mrb_nil_value ( ) ; for ( ; i < e ; i ++ ) { c -> stbase [ i ] = nil ;
Buggy code:
 <START_BUG> static void encode_frame ( vpx_codec_ctx_t * ctx, <END_BUG> const vpx_image_t * img, vpx_codec_pts_t pts, unsigned int duration, vpx_enc_frame_flags_t flags, unsigned int deadline,  VpxVideoWriter * writer ) { <START_BUG> vpx_codec_iter_t iter = NULL ; const vpx_codec_cx_pkt_t * pkt = NULL ; const vpx_codec_err_t res = vpx_codec_encode ( ctx, img, pts, duration, flags, deadline ) ; if ( res!= VPX_CODEC_OK ) die_codec ( ctx, "Failed   to   encode   frame." ) ; <END_BUG> while ( ( pkt = vpx_codec_get_cx_data ( ctx, & iter ) )!= NULL ) {  if ( pkt -> kind == VPX_CODEC_CX_FRAME_PKT ) { const int keyframe = ( pkt -> data. frame. flags & VPX_FRAME_IS_KEY )!= 0 ; if (! vpx_video_writer_write_frame ( writer, pkt -> data. frame. buf, pkt -> data. frame. sz, pkt -> data. frame. pts ) ) die_codec ( ctx, "Failed   to   write   compressed   frame." ) ; printf ( keyframe? "K" : "." ) ; fflush ( stdout ) ; } } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> encode_frame ( vpx_codec_ctx_t <S2SV_ModStart> writer ) { int got_pkts = 0 ; <S2SV_ModStart> NULL ) { got_pkts = 1 ; <S2SV_ModStart> ; } } return got_pkts ;
Buggy code:
 static int mv_read_header ( AVFormatContext * avctx ) { MvContext * mv = avctx -> priv_data ; AVIOContext * pb = avctx -> pb ; AVStream * ast = NULL, * vst = NULL ; int version, i ; int ret ; avio_skip ( pb, 4 ) ; version = avio_rb16 ( pb ) ; if ( version == 2 ) { uint64_t timestamp ; int v ; avio_skip ( pb, 22 ) ; ast = avformat_new_stream ( avctx, NULL ) ; if (! ast ) return AVERROR ( ENOMEM ) ; vst = avformat_new_stream ( avctx, NULL ) ; if (! vst ) return AVERROR ( ENOMEM ) ; avpriv_set_pts_info ( vst, 64, 1, 15 ) ; vst -> codecpar -> codec_type = AVMEDIA_TYPE_VIDEO ; vst -> avg_frame_rate = av_inv_q ( vst -> time_base ) ; vst -> nb_frames = avio_rb32 ( pb ) ; v = avio_rb32 ( pb ) ; switch ( v ) { case 1 : vst -> codecpar -> codec_id = AV_CODEC_ID_MVC1 ; break ; case 2 : vst -> codecpar -> format = AV_PIX_FMT_ARGB ; vst -> codecpar -> codec_id = AV_CODEC_ID_RAWVIDEO ; break ; default : avpriv_request_sample ( avctx, "Video   compression   %i", v ) ; break ; } vst -> codecpar -> codec_tag = 0 ; vst -> codecpar -> width = avio_rb32 ( pb ) ; vst -> codecpar -> height = avio_rb32 ( pb ) ; avio_skip ( pb, 12 ) ; ast -> codecpar -> codec_type = AVMEDIA_TYPE_AUDIO ; ast -> nb_frames = vst -> nb_frames ; ast -> codecpar -> sample_rate = avio_rb32 ( pb ) ; if ( ast -> codecpar -> sample_rate <= 0 ) { av_log ( avctx, AV_LOG_ERROR, "Invalid   sample   rate

Fix:
<S2SV_ModStart> ( pb ) ; if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA
Buggy code:
 static mode_t set_umask ( const char * optarg ) { long umask_long ; mode_t umask_val ; char * endptr ; umask_long = strtoll ( optarg, & endptr, 0 ) ; if ( * endptr || umask_long < 0 || umask_long & ~ 0777L ) { fprintf ( stderr, "Invalid   --umask   option   %s", optarg ) ; <START_BUG> return ; <END_BUG> } umask_val = umask_long & 0777 ; umask ( umask_val ) ; umask_cmdline = true ; return umask_val ; }

Fix:
<S2SV_ModStart> ) ; return 0
Buggy code:
 static int dtls1_process_buffered_records ( SSL * s ) { pitem * item ; item = pqueue_peek ( s -> d1 -> unprocessed_rcds. q ) ; if ( item ) { if ( s -> d1 -> unprocessed_rcds. epoch!= s -> d1 -> r_epoch ) return ( 1 ) ; while ( pqueue_peek ( s -> d1 -> unprocessed_rcds. q ) ) { dtls1_get_unprocessed_record ( s ) ; if (! dtls1_process_record ( s ) ) return ( 0 ) ; <START_BUG> dtls1_buffer_record ( s, & ( s -> d1 -> processed_rcds ), <END_BUG>  s -> s3 -> rrec. seq_num ) ; <START_BUG> } } s -> d1 -> processed_rcds. epoch = s -> d1 -> r_epoch ; s -> d1 -> unprocessed_rcds. epoch = s -> d1 -> r_epoch + 1 ; return ( 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) ; if ( <S2SV_ModStart>. seq_num ) < 0 ) return - 1
Buggy code:
 <START_BUG> static mongo_message * mongo_message_create ( int len, int id, int responseTo, int op ) { <END_BUG> mongo_message * mm = ( mongo_message * ) bson_malloc ( len ) ; if (! id ) id = rand ( ) ;  mm -> head. len = len ; <START_BUG> mm -> head. id = id ; mm -> head. responseTo = responseTo ; mm -> head. op = op ; return mm ; }<END_BUG>

Fix:
<S2SV_ModStart> * mongo_message_create ( size_t <S2SV_ModEnd> len, int <S2SV_ModStart>. len = ( int )
Buggy code:
 static int calc_partial_ssl_err ( YV12_BUFFER_CONFIG * source, YV12_BUFFER_CONFIG * dest ) { int i, j ; int Total = 0 ; int srcoffset, dstoffset ; unsigned char * src = source -> y_buffer ; unsigned char * dst = dest -> y_buffer ; int linestocopy ; linestocopy = ( source -> y_height >> 4 ) // PARTIAL_FRAME_FRACTION ; linestocopy = linestocopy? linestocopy << 4 : 16 ; srcoffset = source -> y_stride * ( ( dest -> y_height >> 5 ) * 16 ) ; dstoffset = dest -> y_stride * ( ( dest -> y_height >> 5 ) * 16 ) ; src += srcoffset ; dst += dstoffset ; for ( i = 0 ; i < linestocopy ; i += 16 ) { for ( j = 0 ; j < source -> y_width ; j += 16 ) { unsigned int sse ; <START_BUG> Total += vp8_mse16x16 ( src + j, source -> y_stride, <END_BUG> dst + j, dest -> y_stride, & sse ) ; } src += 16 * source -> y_stride ; dst += 16 * dest -> y_stride ; } return Total ; }

Fix:
<S2SV_ModStart> ; Total += vpx_mse16x16 <S2SV_ModEnd> ( src +
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowDCMException ( exception, message ) { if ( info. scale!= ( Quantum * ) NULL ) info. scale = ( Quantum * ) RelinquishMagickMemory ( info. scale ) ; if ( data!= ( unsigned char * ) NULL ) data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; if ( graymap!= ( int * ) NULL ) graymap = ( int * ) RelinquishMagickMemory ( graymap ) ; if ( bluemap!= ( int * ) NULL ) bluemap = ( int * ) RelinquishMagickMemory ( bluemap ) ; if ( greenmap!= ( int * ) NULL ) greenmap = ( int * ) RelinquishMagickMemory ( greenmap ) ; if ( redmap!= ( int * ) NULL ) redmap = ( int * ) RelinquishMagickMemory ( redmap ) ; if ( stream_info -> offsets!= ( ssize_t * ) NULL ) stream_info -> offsets = ( ssize_t * ) RelinquishMagickMemory ( stream_info -> offsets ) ; if ( stream_info!= ( DCMStreamInfo * ) NULL ) stream_info = ( DCMStreamInfo * ) RelinquishMagickMemory ( stream_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char explicit_vr [ MagickPathExtent ], implicit_vr [ MagickPathExtent ], magick [ MagickPathExtent ], photometric [ MagickPathExtent ] ; DCMInfo info ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, * redmap ; MagickBooleanType explicit_file, explicit_retry, use_explicit ; MagickOffsetType offset ; register unsigned char * p ; register ssize_t i ; size_t colors, height, length, number_scenes, quantum, status, width ; ssize_t count, scene ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( info <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char explicit_vr [ <S2SV_ModStart> ; if ( length > ( size_t ) GetBlobSize ( image ) ) ThrowDCMException ( CorruptImageError, "InsufficientImageDataInFile" ) ; if (
Buggy code:
 static int sched_read_attr ( struct sched_attr __user * uattr, struct sched_attr * attr, unsigned int usize ) { int ret ; if (! access_ok ( VERIFY_WRITE, uattr, usize ) ) return - EFAULT ; if ( usize < sizeof ( * attr ) ) { unsigned char * addr ; unsigned char * end ; addr = ( void * ) attr + usize ; end = ( void * ) attr + sizeof ( * attr ) ; for ( ; addr < end ; addr ++ ) { if ( * addr ) goto err_size ; } attr -> size = usize ; } <START_BUG> ret = copy_to_user ( uattr, attr, usize ) ; <END_BUG> if ( ret ) return - EFAULT ; out : return ret ; err_size : ret = - E2BIG ; goto out ; }

Fix:
<S2SV_ModStart>, attr, attr -> size <S2SV_ModEnd> ) ; if
Buggy code:
 static int read_header ( FFV1Context * f ) { uint8_t state [ CONTEXT_SIZE ] ; int i, j, context_count = - 1 ; RangeCoder * const c = & f -> slice_context [ 0 ] -> c ; memset ( state, 128, sizeof ( state ) ) ; if ( f -> version < 2 ) { <START_BUG> int chroma_planes, chroma_h_shift, chroma_v_shift, transparency ; <END_BUG> unsigned v = get_symbol ( c, state, 0 ) ; if ( v >= 2 ) { av_log ( f -> avctx, AV_LOG_ERROR, "invalid   version   %d   in   ver01   header\\n", v ) ; return AVERROR_INVALIDDATA ; } f -> version = v ; f -> ac = f -> avctx -> coder_type = get_symbol ( c, state, 0 ) ; if ( f -> ac > 1 ) { for ( i = 1 ; i < 256 ; i ++ ) f -> state_transition [ i ] = get_symbol ( c, state, 1 ) + c -> one_state [ i ] ; }  f -> colorspace = get_symbol ( c, state, 0 ) ; <START_BUG> <END_BUG> if ( f -> version > 0 )  <START_BUG> f -> avctx -> bits_per_raw_sample = get_symbol ( c, state, 0 ) ; <END_BUG>  chroma_planes = get_rac ( c, state ) ; <START_BUG> <END_BUG> chroma_h_shift = get_symbol ( c, state, 0 ) ;  chroma_v_shift = get_symbol ( c, state, 0 ) ; transparency = get_rac ( c, state ) ; if ( f -> plane_count ) { <START_BUG> if ( chroma_planes!= f -> chroma_planes <END_BUG> || chroma_h_shift!= f -> chroma_h_shift || chroma_v_shift!= f -> chroma_v_shift || transparency!= f -> transparency ) { av_log ( f -> avctx, AV_LOG_ERROR, "Invalid   change   of   global   parameters\\n" ) ; return AVERROR_INVALIDDATA ; }  } <START_BUG> f -> chroma_planes = chroma_planes ; f -> chroma_h_shift = chroma_<END_BUG>

Fix:
<S2SV_ModStart> chroma_v_shift, transparency, colorspace, bits_per_raw_sample <S2SV_ModStart> ] ; } <S2SV_ModEnd> colorspace = get_symbol <S2SV_ModStart> 0 ) ; bits_per_raw_sample = <S2SV_ModEnd> f -> version <S2SV_ModStart> version > 0? get_symbol ( c, state, 0 ) : <S2SV_ModEnd> f -> avctx <S2SV_ModStart> avctx -> bits_per_raw_sample ; chroma_planes = get_rac ( c, state ) ; chroma_h_shift <S2SV_ModStart> 0 ) ; chroma_v_shift = get_symbol ( c, state, 0 ) ; transparency <S2SV_ModEnd> = get_rac ( <S2SV_ModStart> state ) ; <S2SV_ModEnd> if ( f <S2SV_ModStart> { if ( colorspace!= f -> colorspace || bits_per_raw_sample!= f -> avctx -> bits_per_raw_sample || <S2SV_ModStart> ; } } f -> colorspace = colorspace ; f -> avctx -> bits_per_raw_sample = bits_per_raw_sample ;
Buggy code:
 void qedi_dbg_warn ( struct qedi_dbg_ctx * qedi, const char * func, u32 line, const char * fmt,... ) { va_list va ; <START_BUG> struct va_format vaf ; <END_BUG> char nfunc [ 32 ] ; memset ( nfunc, 0, sizeof ( nfunc ) ) ; memcpy ( nfunc, func, sizeof ( nfunc ) - 1 ) ; va_start ( va, fmt ) ; vaf. fmt = fmt ; vaf. va = & va ; if (! ( qedi_dbg_log & QEDI_LOG_WARN ) ) goto ret ; if ( likely ( qedi ) && likely ( qedi -> pdev ) ) pr_warn ( "[%s]:[%s:%d]:%d:   %pV", dev_name ( & qedi -> pdev -> dev ),  nfunc, line, qedi -> host_no, & vaf ) ; <START_BUG> else <END_BUG> pr_warn ( "[0000:00:00.0]:[%s:%d]:   %pV", nfunc, line, & vaf ) ;  ret : va_end ( va ) ; }

Fix:
<S2SV_ModStart> struct va_format vaf <S2SV_ModEnd> ; va_start ( <S2SV_ModStart> dev ), func <S2SV_ModEnd>, line, <S2SV_ModStart> ( "[0000:00:00.0]:[%s:%d]: <S2SV_blank> %pV", func <S2SV_ModEnd>, line,
Buggy code:
 int rad_packet_recv ( int fd, struct rad_packet_t * * p, struct sockaddr_in * addr ) { struct rad_packet_t * pack ; struct rad_attr_t * attr ; struct rad_dict_attr_t * da ; struct rad_dict_vendor_t * vendor ; uint8_t * ptr ; int n, id, len, vendor_id ; socklen_t addr_len = sizeof ( * addr ) ; * p = NULL ; pack = rad_packet_alloc ( 0 ) ; if (! pack ) return 0 ; ptr = mempool_alloc ( buf_pool ) ; if ( ptr == MAP_FAILED ) { log_emerg ( "radius:packet:   out   of   memory\\n" ) ; goto out_err ; } pack -> buf = ptr ; clock_gettime ( CLOCK_MONOTONIC, & pack -> tv ) ; while ( 1 ) { if ( addr ) n = recvfrom ( fd, pack -> buf, REQ_LENGTH_MAX, 0, addr, & addr_len ) ; else n = read ( fd, pack -> buf, REQ_LENGTH_MAX ) ; if ( n < 0 ) { rad_packet_free ( pack ) ; if ( errno == EAGAIN ) return 1 ; if ( errno!= ECONNREFUSED ) log_ppp_error ( "radius:packet:read:   %s\\n", strerror ( errno ) ) ; return - 1 ; } break ; } if ( n < 20 ) { log_ppp_warn ( "radius:packet:   short   packed   received   (%i)\\n", n ) ; goto out_err ; } pack -> code = * ptr ; ptr ++ ; pack -> id = * ptr ; ptr ++ ; pack -> len = ntohs ( * ( uint16_t * ) ptr ) ; ptr += 2 ; if ( pack -> len > n ) { log_ppp_warn ( "radius:packet:   short   packet   received   %i,   expected   %i\\n", pack -> len, n ) ; goto out_err ; } ptr += 16 ; n -= 20 ; while ( n > 0 ) { id = * ptr ; ptr ++ ; len = * ptr - 2 ; ptr ++ ; if ( len < 0 ) { log

Fix:
<S2SV_ModStart> -> len ; if ( len < 0 ) { log_ppp_warn ( "radius:packet <S2SV_blank> invalid <S2SV_blank> vendor <S2SV_blank> attribute <S2SV_blank> len <S2SV_blank> received\\n" ) ; goto out_err ; } if ( 2 + len > n ) { log_ppp_warn ( "radius:packet: <S2SV_blank> too <S2SV_blank> long <S2SV_blank> vendor <S2SV_blank> attribute <S2SV_blank> received <S2SV_blank> (%i, <S2SV_blank> %i)\\n", id, len ) ; goto out_err ; }
Buggy code:
 generic_ret * chpass_principal_2_svc ( chpass_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) ) { ret. code = chpass_principal_wrapper_3 ( ( void * ) handle, arg -> princ, FALSE, 0, NULL, arg -> pass ) ; } else if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_CHANGEPW, arg -> princ, NULL ) ) { ret. code = kadm5_chpass_principal ( ( void * ) handle, arg -> princ, arg -> pass ) ; } else { log_unauth ( "kadm5_chpass_principal", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_CHANGEPW ; } if ( ret. code!= KADM5_AUTH_CHANGEPW ) { if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 <START_BUG> static void nonrd_pick_partition ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> TOKENEXTRA * * tp, int mi_row,  int mi_col, BLOCK_SIZE bsize, int * rate, <START_BUG> <END_BUG> int64_t * dist, int do_recon, int64_t best_rd ) {  VP9_COMMON * const cm = & cpi -> common ; <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; const int ms = num_8x8_blocks_wide_lookup [ bsize ] // 2 ; TOKENEXTRA * tp_orig = * tp ;  PICK_MODE_CONTEXT * ctx = get_block_context ( x, bsize ) ; <START_BUG> int i ; <END_BUG> BLOCK_SIZE subsize ;  int this_rate, sum_rate = 0, best_rate = INT_MAX ; int64_t this_dist, sum_dist = 0, best_dist = INT64_MAX ; int64_t sum_rd = 0 ; int do_split = bsize >= BLOCK_8X8 ; int do_rect = 1 ; const int force_horz_split = ( mi_row + ms >= cm -> mi_rows ) ; const int force_vert_split = ( mi_col + ms >= cm -> mi_cols ) ; const int xss = x -> e_mbd. plane [ 1 ]. subsampling_x ; const int yss = x -> e_mbd. plane [ 1 ]. subsampling_y ; int partition_none_allowed =! force_horz_split &&! force_vert_split ; int partition_horz_allowed =! force_vert_split && yss <= xss && bsize >= BLOCK_8X8 ; int partition_vert_allowed =! force_horz_split && xss <= yss && bsize >= BLOCK_8X8 ; ( void ) * tp_orig ; <START_BUG> if ( bsize < BLOCK_8X8 ) { <END_BUG> if ( x -> ab_index!= 0 ) { * rate = 0 ; * dist = 0 ; return ; } } assert ( num_8x8_blocks_wide_lookup [ bsize ] == num_

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, TileDataEnc * tile_data <S2SV_ModEnd>, TOKENEXTRA * <S2SV_ModStart> BLOCK_SIZE bsize, RD_COST * rd_cost, <S2SV_ModEnd> int do_recon, <S2SV_ModStart>, int64_t best_rd, PC_TREE * pc_tree ) { const SPEED_FEATURES * const sf = & cpi -> sf ; <S2SV_ModEnd> VP9_COMMON * const <S2SV_ModStart> -> common ; TileInfo * const tile_info = & tile_data -> tile_info ; <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> * ctx = & pc_tree -> none <S2SV_ModEnd> ; int i <S2SV_ModStart> ; BLOCK_SIZE subsize = bsize ; RD_COST this_rdc, sum_rdc, best_rdc <S2SV_ModEnd> ; int do_split <S2SV_ModStart> * tp_orig ; <S2SV_ModEnd> assert ( num_8x8_blocks_wide_lookup <S2SV_ModStart> ] ) ; vp9_rd_cost_init ( & sum_rdc ) ; vp9_rd_cost_reset ( & best_rdc ) ; best_rdc. rdcost = best_rd ; if ( sf -> <S2SV_ModEnd> auto_min_max_partition_size ) { <S2SV_ModStart>