nus-yam/ex-repair huggingface dataset:
Buggy code:
 int user_update ( struct key * key, struct key_preparsed_payload * prep ) { struct user_key_payload * upayload, * zap ; size_t datalen = prep -> datalen ; int ret ; ret = - EINVAL ; if ( datalen <= 0 || datalen > 32767 ||! prep -> data ) goto error ; ret = - ENOMEM ; upayload = kmalloc ( sizeof ( * upayload ) + datalen, GFP_KERNEL ) ; if (! upayload ) goto error ; upayload -> datalen = datalen ; memcpy ( upayload -> data, prep -> data, datalen ) ; zap = upayload ; ret = key_payload_reserve ( key, datalen ) ; if ( ret == 0 ) { <START_BUG> zap = key -> payload. data [ 0 ] ; <END_BUG>  rcu_assign_keypointer ( key, upayload ) ; <START_BUG> key -> expiry = 0 ; } if ( zap ) kfree_rcu ( zap, rcu ) ; error : return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { if (! test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) <S2SV_ModStart> 0 ] ; else zap = NULL ;
Buggy code:
 void vp8_encode_frame ( VP8_COMP * cpi ) { int mb_row ; MACROBLOCK * const x = & cpi -> mb ; VP8_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; TOKENEXTRA * tp = cpi -> tok ; int segment_counts [ MAX_MB_SEGMENTS ] ; int totalrate ; # if CONFIG_REALTIME_ONLY & CONFIG_ONTHEFLY_BITPACKING BOOL_CODER * bc = & cpi -> bc [ 1 ] ; const int num_part = ( 1 << cm -> multi_token_partition ) ; # endif <START_BUG> vpx_memset ( segment_counts, 0, sizeof ( segment_counts ) ) ; <END_BUG> totalrate = 0 ; if ( cpi -> compressor_speed == 2 ) { if ( cpi -> oxcf. cpu_used < 0 ) cpi -> Speed = - ( cpi -> oxcf. cpu_used ) ; else vp8_auto_select_speed ( cpi ) ; } if (! cm -> use_bilinear_mc_filter ) { xd -> subpixel_predict = vp8_sixtap_predict4x4 ; xd -> subpixel_predict8x4 = vp8_sixtap_predict8x4 ; xd -> subpixel_predict8x8 = vp8_sixtap_predict8x8 ; xd -> subpixel_predict16x16 = vp8_sixtap_predict16x16 ; } else { xd -> subpixel_predict = vp8_bilinear_predict4x4 ; xd -> subpixel_predict8x4 = vp8_bilinear_predict8x4 ; xd -> subpixel_predict8x8 = vp8_bilinear_predict8x8 ; xd -> subpixel_predict16x16 = vp8_bilinear_predict16x16 ; } cpi -> mb. skip_true_count = 0 ; cpi -> tok_count = 0 ; # if 0 cpi -> frame_distortion = 0 ; cpi -> last_mb_distortion = 0 ; # endif xd -> mode_info_context = cm -> mi ; vp8_zero ( cpi -> mb. MVcount ) ; vp8

Fix:
<S2SV_ModStart> ; # endif memset <S2SV_ModEnd> ( segment_counts, <S2SV_ModStart> int i ; memset <S2SV_ModEnd> ( xd ->
Buggy code:
 static int codeCompare ( Parse * pParse, Expr * pLeft, Expr * pRight, int opcode, int in1, int in2, int dest, int jumpIfNull, int isCommuted ) { int p5 ; int addr ; <START_BUG> CollSeq * p4 ; <END_BUG> if ( isCommuted ) { p4 = sqlite3BinaryCompareCollSeq ( pParse, pRight, pLeft ) ; } else { p4 = sqlite3BinaryCompareCollSeq ( pParse, pLeft, pRight ) ; } p5 = binaryCompareP5 ( pLeft, pRight, jumpIfNull ) ; addr = sqlite3VdbeAddOp4 ( pParse -> pVdbe, opcode, in2, dest, in1, ( void * ) p4, P4_COLLSEQ ) ; sqlite3VdbeChangeP5 ( pParse -> pVdbe, ( u8 ) p5 ) ; return addr ; }

Fix:
<S2SV_ModStart> CollSeq * p4 ; if ( pParse -> nErr ) return 0
Buggy code:
 SQLITE_PRIVATE void sqlite3VtabBeginParse ( Parse * pParse, Token * pName1, Token * pName2, Token * pModuleName, int ifNotExists ) { Table * pTable ; sqlite3 * db ; sqlite3StartTable ( pParse, pName1, pName2, 0, 0, 1, ifNotExists ) ; pTable = pParse -> pNewTable ; if ( pTable == 0 ) return ; assert ( 0 == pTable -> pIndex ) ; db = pParse -> db ; assert ( pTable -> nModuleArg == 0 ) ; <START_BUG> addModuleArgument ( db, pTable, sqlite3NameFromToken ( db, pModuleName ) ) ; <END_BUG>  addModuleArgument ( db, pTable, 0 ) ; <START_BUG> <END_BUG> addModuleArgument ( db, pTable, sqlite3DbStrDup ( db, pTable -> zName ) ) ;  assert ( ( pParse -> sNameToken. z == pName2 -> z && pName2 -> z!= 0 ) || ( pParse -> sNameToken. z == pName1 -> z && pName2 -> z == 0 ) ) ; pParse -> sNameToken. n = ( int ) ( & pModuleName -> z [ pModuleName -> n ] - pParse -> sNameToken. z ) ; # ifndef SQLITE_OMIT_AUTHORIZATION if ( pTable -> azModuleArg ) { int iDb = sqlite3SchemaToIndex ( db, pTable -> pSchema ) ; assert ( iDb >= 0 ) ; sqlite3AuthCheck ( pParse, SQLITE_CREATE_VTABLE, pTable -> zName, pTable -> azModuleArg [ 0 ], pParse -> db -> aDb [ iDb ]. zDbSName ) ; } # endif }

Fix:
<S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pTable, <S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pTable, <S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pTable,
Buggy code:
 static void snd_timer_check_master ( struct snd_timer_instance * master ) { struct snd_timer_instance * slave, * tmp ; list_for_each_entry_safe ( slave, tmp, & snd_timer_slave_list, open_list ) { if ( slave -> slave_class == master -> slave_class && slave -> slave_id == master -> slave_id ) { list_move_tail ( & slave -> open_list, & master -> slave_list_head ) ; spin_lock_irq ( & slave_active_lock ) ; <START_BUG> slave -> master = master ; <END_BUG> slave -> timer = master -> timer ; if ( slave -> flags & SNDRV_TIMER_IFLG_RUNNING ) list_add_tail ( & slave -> active_list, & master -> slave_active_head ) ;  spin_unlock_irq ( & slave_active_lock ) ; <START_BUG> } } }<END_BUG>

Fix:
<S2SV_ModStart> slave_active_lock ) ; spin_lock ( & master -> timer -> lock ) ; <S2SV_ModStart> slave_active_head ) ; spin_unlock ( & master -> timer -> lock ) ;
Buggy code:
 void vp9_rc_postencode_update ( VP9_COMP * cpi, uint64_t bytes_used ) { <START_BUG> VP9_COMMON * const cm = & cpi -> common ; <END_BUG>  const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <START_BUG> RATE_CONTROL * const rc = & cpi -> rc ; <END_BUG> cm -> last_frame_type = cm -> frame_type ;  rc -> projected_frame_size = ( int ) ( bytes_used << 3 ) ; vp9_rc_update_rate_correction_factors ( <START_BUG> cpi, ( cpi -> sf. recode_loop >= ALLOW_RECODE_KFARFGF || <END_BUG> oxcf -> end_usage == USAGE_STREAM_FROM_SERVER )? 2 : 0 ) ; if ( cm -> frame_type == KEY_FRAME ) {  rc -> last_q [ KEY_FRAME ] = cm -> base_qindex ; <START_BUG> rc -> avg_frame_qindex [ KEY_FRAME ] = ROUND_POWER_OF_TWO ( <END_BUG> 3 * rc -> avg_frame_qindex [ KEY_FRAME ] + cm -> base_qindex, 2 ) ;  <START_BUG> } else if (! rc -> is_src_frame_alt_ref && <END_BUG>  ( cpi -> refresh_golden_frame || cpi -> refresh_alt_ref_frame ) && <START_BUG> <END_BUG>! ( cpi -> use_svc && oxcf -> end_usage == USAGE_STREAM_FROM_SERVER ) ) {  <START_BUG> rc -> last_q [ 2 ] = cm -> base_qindex ; <END_BUG>  rc -> avg_frame_qindex [ 2 ] = ROUND_POWER_OF_TWO ( <START_BUG> <END_BUG> 3 * rc -> avg_frame_qindex [ 2 ] + cm -> base_qindex, 2 ) ;  } else { rc -> last_q [ INTER_FRAME ] = cm -> base_qindex ; rc -> avg_frame_qindex [ INTER_FRAME ] = ROUND_POWER_OF_TWO ( 3 * rc -> avg_frame_qindex [ INTER_FRAME ] + cm -> base_qindex, 2 ) ; rc -> ni_frames ++ ; <START_BUG> rc -> tot_q += vp9_convert_qindex_to_q ( cm -><END_BUG>

Fix:
<S2SV_ModStart> bytes_used ) { const <S2SV_ModStart> common ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> -> rc ; const int qindex = cm -> base_qindex ; if ( cpi -> oxcf. aq_mode == CYCLIC_REFRESH_AQ && cm -> seg. enabled ) { vp9_cyclic_refresh_postencode ( cpi ) ; } <S2SV_ModEnd> rc -> projected_frame_size <S2SV_ModStart> ; vp9_rc_update_rate_correction_factors ( cpi <S2SV_ModEnd> ) ; if <S2SV_ModStart> KEY_FRAME ] = qindex <S2SV_ModEnd> ; rc -> <S2SV_ModStart> KEY_FRAME ] + qindex <S2SV_ModEnd>, 2 ) <S2SV_ModStart> 2 ) ; if ( cpi -> use_svc ) { int i = 0 ; SVC * svc = & cpi -> svc ; for ( i = 0 ; i < svc -> number_temporal_layers ; ++ i ) { const int layer = LAYER_IDS_TO_IDX ( svc -> spatial_layer_id, i, svc -> number_temporal_layers ) ; LAYER_CONTEXT * lc = & svc -> layer_context [ layer ] ; RATE_CONTROL * lrc = & lc -> rc ; lrc
Buggy code:
 void vp9_init_layer_context ( VP9_COMP * const cpi ) { SVC * const svc = & cpi -> svc ; <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG>  int layer ; <START_BUG> int layer_end ; svc -> spatial_layer_id = 0 ; svc -> temporal_layer_id = 0 ; <END_BUG> if ( svc -> number_temporal_layers > 1 ) {  layer_end = svc -> number_temporal_layers ; } else { layer_end = svc -> number_spatial_layers ; } for ( layer = 0 ; layer < layer_end ; ++ layer ) { <START_BUG> LAYER_CONTEXT * const lc = & svc -> layer_context [ layer ] ; <END_BUG> RATE_CONTROL * const lrc = & lc -> rc ; lc -> current_video_frame_in_layer = 0 ; lrc -> avg_frame_qindex [ INTER_FRAME ] = oxcf -> worst_allowed_q ; lrc -> ni_av_qi = oxcf -> worst_allowed_q ; lrc -> total_actual_bits = 0 ; lrc -> total_target_vs_actual = 0 ; lrc -> ni_tot_qi = 0 ; lrc -> tot_q = 0.0 ; lrc -> avg_q = 0.0 ; lrc -> ni_frames = 0 ; lrc -> decimation_count = 0 ; lrc -> decimation_factor = 0 ; lrc -> rate_correction_factor = 1.0 ; lrc -> key_frame_rate_correction_factor = 1.0 ; if ( svc -> number_temporal_layers > 1 ) { lc -> target_bandwidth = oxcf -> ts_target_bitrate [ layer ] * 1000 ; lrc -> last_q [ INTER_FRAME ] = oxcf -> worst_allowed_q ; } else { lc -> target_bandwidth = oxcf -> ss_target_bitrate [ layer ] * 1000 ; lrc -> last_q [ 0 ] = oxcf -> best_allowed_q ; lrc -> last_q [ 1 ] = oxcf -> best_allowed_q ; lrc -> last_q [ 2 ] = oxcf -> best_allowed_q ; } lrc -> buffer_level =

Fix:
<S2SV_ModStart> svc ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> oxcf ; int sl, tl ; int alt_ref_idx = svc -> number_spatial_layers ; svc -> spatial_layer_id = 0 ; svc -> temporal_layer_id = 0 ; if ( cpi -> oxcf. error_resilient_mode == 0 && cpi -> oxcf. pass == 2 ) { if ( vpx_realloc_frame_buffer ( & cpi -> svc. empty_frame. img, SMALL_FRAME_WIDTH, SMALL_FRAME_HEIGHT, cpi -> common. subsampling_x, cpi -> common. subsampling_y, # if CONFIG_VP9_HIGHBITDEPTH cpi -> common. use_highbitdepth, # endif VP9_ENC_BORDER_IN_PIXELS, cpi -> common. byte_alignment, NULL, NULL, NULL ) ) vpx_internal_error ( & cpi -> common. error, VPX_CODEC_MEM_ERROR, "Failed <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> empty <S2SV_blank> frame <S2SV_blank> for <S2SV_blank> multiple <S2SV_blank> frame <S2SV_blank> " "contexts" ) ; memset ( cp
Buggy code:
 void ping_unhash ( struct sock * sk ) { struct inet_sock * isk = inet_sk ( sk ) ; pr_debug ( "ping_unhash(isk=%p,isk->num=%u)\\n", isk, isk -> inet_num ) ; <START_BUG> if ( sk_hashed ( sk ) ) { <END_BUG>  write_lock_bh ( & ping_table. lock ) ; <START_BUG> hlist_nulls_del ( & sk -> sk_nulls_node ) ; sk_nulls_node_init ( & sk -> sk_nulls_node ) ; sock_put ( sk ) ; isk -> inet_num = 0 ; isk -> inet_sport = 0 ; sock_prot_inuse_add ( sock_net ( sk ), sk -> sk_prot, - 1 ) ; <END_BUG> write_unlock_bh ( & ping_table. lock ) ;  } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> inet_num ) ; write_lock_bh ( & ping_table. lock ) ; <S2SV_ModStart> ) ) { <S2SV_ModEnd> hlist_nulls_del ( & <S2SV_ModStart> 1 ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int vp8_skip_fractional_mv_step ( MACROBLOCK * mb, BLOCK * b, BLOCKD * d, int_mv * bestmv, int_mv * ref_mv, int error_per_bit, const vp8_variance_fn_ptr_t * vfp, int * mvcost [ 2 ], int * distortion, unsigned int * sse ) { ( void ) b ; ( void ) d ; ( void ) ref_mv ; ( void ) error_per_bit ; ( void ) vfp ; <START_BUG> ( void ) mvcost ; <END_BUG> ( void ) distortion ; ( void ) sse ; bestmv -> as_mv. row <<= 3 ; bestmv -> as_mv. col <<= 3 ; return 0 ; }

Fix:
<S2SV_ModStart> ( void ) mb ; ( void )
Buggy code:
 static int uvesafb_setcmap ( struct fb_cmap * cmap, struct fb_info * info ) { struct uvesafb_pal_entry * entries ; int shift = 16 - dac_width ; int i, err = 0 ; if ( info -> var. bits_per_pixel == 8 ) { if ( cmap -> start + cmap -> len > info -> cmap. start + info -> cmap. len || cmap -> start < info -> cmap. start ) return - EINVAL ; <START_BUG> entries = kmalloc ( sizeof ( * entries ) * cmap -> len, GFP_KERNEL ) ; <END_BUG> if (! entries ) return - ENOMEM ; for ( i = 0 ; i < cmap -> len ; i ++ ) { entries [ i ]. red = cmap -> red [ i ] >> shift ; entries [ i ]. green = cmap -> green [ i ] >> shift ; entries [ i ]. blue = cmap -> blue [ i ] >> shift ; entries [ i ]. pad = 0 ; } err = uvesafb_setpalette ( entries, cmap -> len, cmap -> start, info ) ; kfree ( entries ) ; } else { for ( i = 0 ; i < cmap -> len ; i ++ ) { err |= uvesafb_setcolreg ( cmap -> start + i, cmap -> red [ i ], cmap -> green [ i ], cmap -> blue [ i ], 0, info ) ; } } return err ; }

Fix:
<S2SV_ModStart> ; entries = kmalloc_array ( cmap -> len, <S2SV_ModEnd> sizeof ( * <S2SV_ModStart> * entries ), <S2SV_ModEnd> GFP_KERNEL ) ;
Buggy code:
 static int do_dentry_open ( struct file * f, int ( * open ) ( struct inode *, struct file * ), const struct cred * cred ) { static const struct file_operations empty_fops = { } ; struct inode * inode ; int error ; f -> f_mode = OPEN_FMODE ( f -> f_flags ) | FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE ; if ( unlikely ( f -> f_flags & O_PATH ) ) f -> f_mode = FMODE_PATH ; path_get ( & f -> f_path ) ; inode = f -> f_inode = f -> f_path. dentry -> d_inode ; if ( f -> f_mode & FMODE_WRITE ) { error = __get_file_write_access ( inode, f -> f_path. mnt ) ; if ( error ) goto cleanup_file ; if (! special_file ( inode -> i_mode ) ) file_take_write ( f ) ; } f -> f_mapping = inode -> i_mapping ; <START_BUG> file_sb_list_add ( f, inode -> i_sb ) ; <END_BUG> if ( unlikely ( f -> f_mode & FMODE_PATH ) ) { f -> f_op = & empty_fops ; return 0 ; } f -> f_op = fops_get ( inode -> i_fop ) ; if ( unlikely ( WARN_ON (! f -> f_op ) ) ) { error = - ENODEV ; goto cleanup_all ; } error = security_file_open ( f, cred ) ; if ( error ) goto cleanup_all ; error = break_lease ( inode, f -> f_flags ) ; if ( error ) goto cleanup_all ; if (! open ) open = f -> f_op -> open ; if ( open ) { error = open ( inode, f ) ; if ( error ) goto cleanup_all ; } if ( ( f -> f_mode & ( FMODE_READ | FMODE_WRITE ) ) == FMODE_READ ) i_readcount_inc ( inode ) ; f -> f_flags &= ~ ( O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC ) ; file_ra_state_init ( & f -> f_ra

Fix:
<S2SV_ModStart> -> i_mapping ; <S2SV_ModEnd> if ( unlikely <S2SV_ModStart> f_op ) ; <S2SV_ModEnd> if ( f
Buggy code:
 voidpf # endif png_zalloc ( voidpf png_ptr, uInt items, uInt size ) { png_voidp ptr ; <START_BUG> png_structp p = ( png_structp ) png_ptr ; <END_BUG>  png_uint_32 save_flags = p -> flags ; <START_BUG> png_uint_32 num_bytes ; if ( png_ptr == NULL ) return ( NULL ) ; if ( items > PNG_UINT_32_MAX // size ) { png_warning ( p, "Potential   overflow   in   png_zalloc()" ) ; return ( NULL ) ; } num_bytes = ( png_uint_32 ) items * size ; p -> flags |= PNG_FLAG_MALLOC_NULL_MEM_OK ; ptr = ( png_voidp ) png_malloc ( ( png_structp ) png_ptr, num_bytes ) ; p -> flags = save_flags ; # if defined ( PNG_1_0_X ) &&! defined ( PNG_NO_ZALLOC_ZERO ) if ( ptr == NULL ) return ( ( voidpf ) ptr ) ; if ( num_bytes > ( png_uint_32 ) 0x8000L ) { png_memset ( ptr, 0, ( png_size_t ) 0x8000L ) ; png_memset ( ( png_bytep ) ptr + ( png_size_t ) 0x8000L, 0, ( png_size_t ) ( num_bytes - ( png_uint_32 ) 0x8000L ) ) ; } else { png_memset ( ptr, 0, ( png_size_t ) num_bytes ) ; } # endif return ( ( voidpf ) ptr ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; png_structp p ; png_uint_32 save_flags ; png_uint_32 num_bytes ; if ( png_ptr == NULL ) return ( NULL ) ; p <S2SV_ModStart> ) png_ptr ; <S2SV_ModEnd> save_flags = p <S2SV_ModStart> p -> flags <S2SV_ModEnd> ; if (
Buggy code:
 static void check_preempt_curr ( struct rq * rq, struct task_struct * p, int flags ) { const struct sched_class * class ; if ( p -> sched_class == rq -> curr -> sched_class ) { rq -> curr -> sched_class -> check_preempt_curr ( rq, p, flags ) ; } else { for_each_class ( class ) { if ( class == rq -> curr -> sched_class ) break ; if ( class == p -> sched_class ) { resched_task ( rq -> curr ) ; break ; } } } <START_BUG> if ( test_tsk_need_resched ( rq -> curr ) ) <END_BUG> rq -> skip_clock_update = 1 ; }

Fix:
<S2SV_ModStart> } if ( rq -> curr -> se. on_rq &&
Buggy code:
 static int growVTrans ( sqlite3 * db ) { const int ARRAY_INCR = 5 ; if ( ( db -> nVTrans % ARRAY_INCR ) == 0 ) { VTable * * aVTrans ; <START_BUG> int nBytes = sizeof ( sqlite3_vtab * ) * ( db -> nVTrans + ARRAY_INCR ) ; <END_BUG> aVTrans = sqlite3DbRealloc ( db, ( void * ) db -> aVTrans, nBytes ) ; if (! aVTrans ) { return SQLITE_NOMEM_BKPT ; } memset ( & aVTrans [ db -> nVTrans ], 0, sizeof ( sqlite3_vtab * ) * ARRAY_INCR ) ; db -> aVTrans = aVTrans ; } return SQLITE_OK ; }

Fix:
<S2SV_ModStart> * aVTrans ; sqlite3_int64 <S2SV_ModEnd> nBytes = sizeof <S2SV_ModStart> ) * ( ( sqlite3_int64 )
Buggy code:
 <START_BUG> int vp9_decode_frame ( VP9Decoder * pbi, <END_BUG> const uint8_t * data, const uint8_t * data_end, const uint8_t * * p_data_end ) { VP9_COMMON * const cm = & pbi -> common ; MACROBLOCKD * const xd = & pbi -> mb ; struct vp9_read_bit_buffer rb = { data, data_end, 0, cm, error_handler } ;  const size_t first_partition_size = read_uncompressed_header ( pbi, & rb ) ; <START_BUG> const int keyframe = cm -> frame_type == KEY_FRAME ; const int tile_rows = 1 << cm -> log2_tile_rows ; const int tile_cols = 1 << cm -> log2_tile_cols ; YV12_BUFFER_CONFIG * const new_fb = get_frame_new_buffer ( cm ) ; xd -> cur_buf = new_fb ; if (! first_partition_size ) { <END_BUG> * p_data_end = data + 1 ;  return 0 ; } if (! pbi -> decoded_key_frame &&! keyframe ) return - 1 ; data += vp9_rb_bytes_read ( & rb ) ; if (! read_is_valid ( data, first_partition_size, data_end ) ) vpx_internal_error ( & cm -> error, VPX_CODEC_CORRUPT_FRAME, "Truncated   packet   or   corrupt   header   length" ) ; <START_BUG> pbi -> do_loopfilter_inline = <END_BUG>  ( cm -> log2_tile_rows | cm -> log2_tile_cols ) == 0 && cm -> lf. filter_level ; <START_BUG> if ( pbi -> do_loopfilter_inline && pbi -> lf_worker. data1 == NULL ) { CHECK_MEM_ERROR ( cm, pbi -> lf_worker. data1, vpx_memalign ( 32, sizeof ( LFWorkerData ) ) ) ; pbi -> lf_worker. hook = ( VP9WorkerHook ) vp9_loop_filter_worker ; <END_BUG> if ( pbi -> oxcf. max_threads > 1 &&! vp9_worker_reset ( & pbi -> lf_worker ) ) {  vpx

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> void vp9_decode_frame ( VP9Decoder * pbi, const uint8_t * data, const uint8_t * data_end, const uint8_t * * p_data_end ) { VP9_COMMON * const cm = & pbi -> common ; MACROBLOCKD * const xd = & pbi -> mb ; struct vpx_read_bit_buffer rb ; int context_updated = 0 ; uint8_t clear_data [ MAX_VP9_HEADER_SIZE ] <S2SV_ModEnd> ; const size_t <S2SV_ModStart> ( pbi, init_read_bit_buffer ( pbi, & rb, data, data_end, clear_data ) ) <S2SV_ModEnd> ; const int <S2SV_ModStart> = data + ( cm -> profile <= PROFILE_2? 1 : 2 ) ; return ; } data += vpx_rb_bytes_read <S2SV_ModEnd> ( & rb <S2SV_ModStart> "Truncated <S2SV_blank> packet <S2SV_blank> or <S2SV_blank> corrupt <S2SV_blank> header <S2SV_blank> length" ) ; cm -> use_prev_frame_mvs =! cm -> error_resilient_mode && cm -> width ==
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_set_previewpp ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { # if CONFIG_POSTPROC  vp8_postproc_cfg_t * data = va_arg ( args, vp8_postproc_cfg_t * ) ; <START_BUG> ( void ) ctr_id ; if ( data ) { ctx -> preview_ppcfg = * ( ( vp8_postproc_cfg_t * ) data ) ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; # else ( void ) ctx ; <END_BUG> ( void ) ctr_id ;  ( void ) args ; return VPX_CODEC_INCAPABLE ; # endif }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args <S2SV_ModStart> vp8_postproc_cfg_t * ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( void ) <S2SV_ModEnd> args ; return
Buggy code:
 static struct nfs4_state * nfs4_try_open_cached ( struct nfs4_opendata * opendata ) { struct nfs4_state * state = opendata -> state ; struct nfs_inode * nfsi = NFS_I ( state -> inode ) ; struct nfs_delegation * delegation ; <START_BUG> int open_mode = opendata -> o_arg. open_flags & ( FMODE_READ | FMODE_WRITE | O_EXCL ) ; <END_BUG> nfs4_stateid stateid ; int ret = - EAGAIN ; for ( ; ; ) {  if ( can_open_cached ( state, open_mode ) ) { <START_BUG> spin_lock ( & state -> owner -> so_lock ) ; <END_BUG> if ( can_open_cached ( state, open_mode ) ) {  <START_BUG> update_open_stateflags ( state, open_mode ) ; <END_BUG> spin_unlock ( & state -> owner -> so_lock ) ; goto out_return_state ; } spin_unlock ( & state -> owner -> so_lock ) ; } rcu_read_lock ( ) ; delegation = rcu_dereference ( nfsi -> delegation ) ; if ( delegation == NULL || ! can_open_delegated ( delegation, open_mode ) ) { <START_BUG> rcu_read_unlock ( ) ; break ; } memcpy ( stateid. data, delegation -> stateid. data, sizeof ( stateid. data ) ) ; rcu_read_unlock ( ) ; ret = nfs_may_open ( state -> inode, state -> owner -> so_cred, open_mode ) ; if ( ret!= 0 ) goto out ; ret = - EAGAIN ; <END_BUG> if ( update_open_stateid ( state, NULL, & stateid, open_mode ) )  goto out_return_state ; } out : return ERR_PTR ( ret ) ; out_return_state : atomic_inc ( & state -> count ) ; return state ; }

Fix:
<S2SV_ModStart>. open_flags & O_EXCL ; fmode_t fmode = opendata -> o_arg. fmode <S2SV_ModEnd> ; nfs4_stateid stateid <S2SV_ModStart> ( state, fmode, <S2SV_ModStart> ( state, fmode, <S2SV_ModStart> ( state, fmode <S2SV_ModEnd> ) ; spin_unlock <S2SV_ModStart> ( delegation, fmode <S2SV_ModEnd> ) ) { <S2SV_ModStart> & stateid, fmode <S2SV_ModEnd> ) ) goto
Buggy code:
 static int __ipmi_bmc_register ( struct ipmi_smi * intf, struct ipmi_device_id * id, bool guid_set, guid_t * guid, int intf_num ) { int rv ; struct bmc_device * bmc ; struct bmc_device * old_bmc ; intf -> in_bmc_register = true ; mutex_unlock ( & intf -> bmc_reg_mutex ) ; mutex_lock ( & ipmidriver_mutex ) ; if ( guid_set ) old_bmc = ipmi_find_bmc_guid ( & ipmidriver. driver, guid ) ; else old_bmc = ipmi_find_bmc_prod_dev_id ( & ipmidriver. driver, id -> product_id, id -> device_id ) ; if ( old_bmc ) { bmc = old_bmc ; intf -> bmc = old_bmc ; mutex_lock ( & bmc -> dyn_mutex ) ; list_add_tail ( & intf -> bmc_link, & bmc -> intfs ) ; mutex_unlock ( & bmc -> dyn_mutex ) ; dev_info ( intf -> si_dev, "interfacing   existing   BMC   (man_id:   0x%6.6x,   prod_id:   0x%4.4x,   dev_id:   0x%2.2x)\\n", bmc -> id. manufacturer_id, bmc -> id. product_id, bmc -> id. device_id ) ; } else { bmc = kzalloc ( sizeof ( * bmc ), GFP_KERNEL ) ; if (! bmc ) { rv = - ENOMEM ; goto out ; } INIT_LIST_HEAD ( & bmc -> intfs ) ; mutex_init ( & bmc -> dyn_mutex ) ; INIT_WORK ( & bmc -> remove_work, cleanup_bmc_work ) ; bmc -> id = * id ; bmc -> dyn_id_set = 1 ; bmc -> dyn_guid_set = guid_set ; bmc -> guid = * guid ; bmc -> dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY ; bmc -> p

Fix:
<S2SV_ModStart> < 0 ) { kfree ( bmc ) ; <S2SV_ModStart> goto out ; }
Buggy code:
 void Strgrow ( Str x ) { char * old = x -> ptr ; int newlen ; <START_BUG> newlen = x -> length * 6 // 5 ; <END_BUG>  if ( newlen == x -> length ) <START_BUG> newlen += 2 ; x -> ptr = GC_MALLOC_ATOMIC ( newlen ) ; x -> area_size = newlen ; bcopy ( ( void * ) old, ( void * ) x -> ptr, x -> length ) ; GC_free ( old ) ; }<END_BUG>

Fix:
<S2SV_ModStart> = x -> area_size <S2SV_ModEnd> * 6 // <S2SV_ModStart> == x -> area_size <S2SV_ModEnd> ) newlen +=
Buggy code:
 static inline void header_put_byte ( SF_PRIVATE * psf, char x ) <START_BUG> { if ( psf -> headindex < SIGNED_SIZEOF ( psf -> header ) - 1 ) <END_BUG>  psf -> header [ psf -> headindex ++ ] = x ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> x ) { <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. ptr [ <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. indx <S2SV_ModEnd> ++ ] =
Buggy code:
 void vp9_init_mv_probs ( VP9_COMMON * cm ) { <START_BUG> cm -> fc. nmvc = default_nmv_context ; <END_BUG> }

Fix:
<S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> nmvc = default_nmv_context
Buggy code:
 static void WritePixel ( struct ngiflib_img * i, struct ngiflib_decode_context * context, u8 v ) { struct ngiflib_gif * p = i -> parent ; if ( v!= i -> gce. transparent_color ||! i -> gce. transparent_flag ) { # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif * context -> frbuff_p. p8 = v ; # ifndef NGIFLIB_INDEXED_ONLY } else * context -> frbuff_p. p32 = GifIndexToTrueColor ( i -> palette, v ) ; # endif } if ( -- ( context -> Xtogo ) <= 0 ) { # ifdef NGIFLIB_ENABLE_CALLBACKS if ( p -> line_cb ) p -> line_cb ( p, context -> line_p, context -> curY ) ; # endif context -> Xtogo = i -> width ; switch ( context -> pass ) { case 0 : context -> curY ++ ; break ; case 1 : context -> curY += 8 ; <START_BUG> if ( context -> curY >= p -> height ) { <END_BUG> context -> pass ++ ; context -> curY = i -> posY + 4 ; } break ; case 2 : context -> curY += 8 ;  if ( context -> curY >= p -> height ) { <START_BUG> context -> pass ++ ; context -> curY = i -> posY + 2 ; } break ; case 3 : context -> curY += 4 ; <END_BUG> if ( context -> curY >= p -> height ) {  context -> pass ++ ; context -> curY = i -> posY + 1 ; } break ; case 4 : context -> curY += 2 ; <START_BUG> break ; <END_BUG> } # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif # ifdef NGIFLIB_ENABLE_CALLBACKS context -> line_p. p8 = p -> frbuff. p8 + ( u32 ) context -> curY * p -> width ; context -> frbuff_p. p8 = context -> line_p. p8 + i -> posX ; # else context -> frbuff_p. p8 = p -> frbuff. p8 + ( u

Fix:
<S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 4 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> ; break ; } while ( context -> pass > 0 && context -> pass < 4 && context -> curY >= p -> height ) { switch ( ++ context -> pass ) { case 2 : context -> curY = i -> posY + 4 ; break ; case 3 : context -> curY = i -> posY + 2 ; break ; case 4 : context -> curY = i -> posY + 1 ; break ; }
Buggy code:
 void pdf_load_pages_kids ( FILE * fp, pdf_t * pdf ) { int i, id, dummy ; char * buf, * c ; long start, sz ; start = ftell ( fp ) ; for ( i = 0 ; i < pdf -> n_xrefs ; i ++ ) { if ( pdf -> xrefs [ i ]. version && ( pdf -> xrefs [ i ]. end!= 0 ) ) { fseek ( fp, pdf -> xrefs [ i ]. start, SEEK_SET ) ; while ( SAFE_F ( fp, ( fgetc ( fp )!= 't' ) ) ) ; sz = pdf -> xrefs [ i ]. end - ftell ( fp ) ; <START_BUG> buf = malloc ( sz + 1 ) ; <END_BUG> SAFE_E ( fread ( buf, 1, sz, fp ), sz, "Failed   to   load   //Root.\\n" ) ; buf [ sz ] = '\\0' ; if (! ( c = strstr ( buf, "//Root" ) ) ) { free ( buf ) ; continue ; } id = atoi ( c + strlen ( "//Root" ) + 1 ) ; free ( buf ) ; buf = get_object ( fp, id, & pdf -> xrefs [ i ], NULL, & dummy ) ; if (! buf ||! ( c = strstr ( buf, "//Pages" ) ) ) { free ( buf ) ; continue ; } id = atoi ( c + strlen ( "//Pages" ) + 1 ) ; load_kids ( fp, id, & pdf -> xrefs [ i ] ) ; free ( buf ) ; } } fseek ( fp, start, SEEK_SET ) ; }

Fix:
<S2SV_ModStart> ; buf = safe_calloc <S2SV_ModEnd> ( sz +
Buggy code:
 Datum hstore_from_record ( PG_FUNCTION_ARGS ) { HeapTupleHeader rec ; int32 buflen ; HStore * out ; Pairs * pairs ; Oid tupType ; int32 tupTypmod ; TupleDesc tupdesc ; HeapTupleData tuple ; RecordIOData * my_extra ; int ncolumns ; int i, j ; Datum * values ; bool * nulls ; if ( PG_ARGISNULL ( 0 ) ) { Oid argtype = get_fn_expr_argtype ( fcinfo -> flinfo, 0 ) ; tupType = argtype ; tupTypmod = - 1 ; rec = NULL ; } else { rec = PG_GETARG_HEAPTUPLEHEADER ( 0 ) ; tupType = HeapTupleHeaderGetTypeId ( rec ) ; tupTypmod = HeapTupleHeaderGetTypMod ( rec ) ; } tupdesc = lookup_rowtype_tupdesc ( tupType, tupTypmod ) ; ncolumns = tupdesc -> natts ; my_extra = ( RecordIOData * ) fcinfo -> flinfo -> fn_extra ; if ( my_extra == NULL || my_extra -> ncolumns!= ncolumns ) { fcinfo -> flinfo -> fn_extra = MemoryContextAlloc ( fcinfo -> flinfo -> fn_mcxt, sizeof ( RecordIOData ) - sizeof ( ColumnIOData ) + ncolumns * sizeof ( ColumnIOData ) ) ; my_extra = ( RecordIOData * ) fcinfo -> flinfo -> fn_extra ; my_extra -> record_type = InvalidOid ; my_extra -> record_typmod = 0 ; } if ( my_extra -> record_type!= tupType || my_extra -> record_typmod!= tupTypmod ) { MemSet ( my_extra, 0, sizeof ( RecordIOData ) - sizeof ( ColumnIOData ) + ncolumns * sizeof ( ColumnIOData ) ) ; my_extra -> record_type = tupType ; my_extra -> record_typmod = tupTypmod ; my_extra -> ncolumns = ncolumns ; } <START_BUG> pairs = palloc ( ncolumns * sizeof ( Pairs ) ) ; <END_BUG> if ( rec ) { tuple. t_len = HeapTupleHeaderGetDatumLength ( rec ) ; ItemPointerSetInvalid ( & ( tuple. t_self ) ) ; tuple. t_tableOid = InvalidOid ; tuple. t_data

Fix:
<S2SV_ModStart> ncolumns ; } Assert ( ncolumns <= MaxTupleAttributeNumber ) ;
Buggy code:
 static void opl3_setup_voice ( int dev, int voice, int chn ) { <START_BUG> struct channel_info * info = <END_BUG> & synth_devs [ dev ] -> chn_info [ chn ] ; opl3_set_instr ( dev, voice, info -> pgm_num ) ; devc -> voc [ voice ]. bender = 0 ; devc -> voc [ voice ]. bender_range = info -> bender_range ; devc -> voc [ voice ]. volume = info -> controllers [ CTL_MAIN_VOLUME ] ; devc -> voc [ voice ]. panning = ( info -> controllers [ CTL_PAN ] * 2 ) - 128 ; }

Fix:
<S2SV_ModStart> channel_info * info ; if ( voice < 0 || voice >= devc -> nr_voice ) return ; if ( chn < 0 || chn > 15 ) return ; info
Buggy code:
 static int juniper_parse_header ( netdissect_options * ndo, const u_char * p, const struct pcap_pkthdr * h, struct juniper_l2info_t * l2info ) { const struct juniper_cookie_table_t * lp = juniper_cookie_table ; u_int idx, jnx_ext_len, jnx_header_len = 0 ; uint8_t tlv_type, tlv_len ; uint32_t control_word ; int tlv_value ; const u_char * tptr ; l2info -> header_len = 0 ; l2info -> cookie_len = 0 ; l2info -> proto = 0 ; l2info -> length = h -> len ; l2info -> caplen = h -> caplen ; ND_TCHECK2 ( p [ 0 ], 4 ) ; l2info -> flags = p [ 3 ] ; l2info -> direction = p [ 3 ] & JUNIPER_BPF_PKT_IN ; if ( EXTRACT_24BITS ( p )!= JUNIPER_MGC_NUMBER ) { ND_PRINT ( ( ndo, "no   magic-number   found!" ) ) ; return 0 ; } if ( ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "%3s   ", tok2str ( juniper_direction_values, "---", l2info -> direction ) ) ) ; jnx_header_len = 4 ; if ( ndo -> ndo_vflag > 1 ) ND_PRINT ( ( ndo, "\\n\\tJuniper   PCAP   Flags   [%s]", bittok2str ( jnx_flag_values, "none", l2info -> flags ) ) ) ; if ( ( l2info -> flags & JUNIPER_BPF_EXT ) == JUNIPER_BPF_EXT ) { tptr = p + jnx_header_len ; ND_TCHECK2 ( tptr [ 0 ], 2 ) ; jnx_ext_len = EXTRACT_16BITS ( tptr ) ; jnx_header_len += 2 ; tptr += 2 ; jnx_header_len += j

Fix:
<S2SV_ModStart> -> header_len ; ND_TCHECK ( p [ 0 ] ) ; <S2SV_ModStart> case LS_COOKIE_ID : ND_TCHECK2 ( p [ 0 ], 2 ) ; <S2SV_ModStart> case LS_COOKIE_ID : ND_TCHECK2 ( p [ 0 ], 2 ) ;
Buggy code:
 static void * skcipher_bind ( const char * name, u32 type, u32 mask ) { <START_BUG> return crypto_alloc_skcipher ( name, type, mask ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> mask ) { struct skcipher_tfm * tfm ; struct crypto_skcipher * skcipher ; tfm = kzalloc ( sizeof ( * tfm ), GFP_KERNEL ) ; if (! tfm ) return ERR_PTR ( - ENOMEM ) ; skcipher = <S2SV_ModEnd> crypto_alloc_skcipher ( name <S2SV_ModStart> mask ) ; if ( IS_ERR ( skcipher ) ) { kfree ( tfm ) ; return ERR_CAST ( skcipher ) ; } tfm -> skcipher = skcipher ; return tfm ;
Buggy code:
 <START_BUG> static int conditional_skipintra ( MB_PREDICTION_MODE mode, <END_BUG> MB_PREDICTION_MODE best_intra_mode ) { if ( mode == D117_PRED && best_intra_mode!= V_PRED && best_intra_mode!= D135_PRED ) return 1 ; if ( mode == D63_PRED && best_intra_mode!= V_PRED && best_intra_mode!= D45_PRED ) return 1 ; if ( mode == D207_PRED && best_intra_mode!= H_PRED && best_intra_mode!= D45_PRED ) return 1 ; if ( mode == D153_PRED && best_intra_mode!= H_PRED && best_intra_mode!= D135_PRED ) return 1 ; return 0 ; }

Fix:
<S2SV_ModStart> int conditional_skipintra ( PREDICTION_MODE mode, PREDICTION_MODE <S2SV_ModEnd> best_intra_mode ) {
Buggy code:
 int ext4_collapse_range ( struct inode * inode, loff_t offset, loff_t len ) { struct super_block * sb = inode -> i_sb ; ext4_lblk_t punch_start, punch_stop ; handle_t * handle ; unsigned int credits ; loff_t new_size, ioffset ; int ret ; if (! ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) return - EOPNOTSUPP ; if ( offset & ( EXT4_CLUSTER_SIZE ( sb ) - 1 ) || len & ( EXT4_CLUSTER_SIZE ( sb ) - 1 ) ) return - EINVAL ; if (! S_ISREG ( inode -> i_mode ) ) return - EINVAL ; trace_ext4_collapse_range ( inode, offset, len ) ; punch_start = offset >> EXT4_BLOCK_SIZE_BITS ( sb ) ; punch_stop = ( offset + len ) >> EXT4_BLOCK_SIZE_BITS ( sb ) ; if ( ext4_should_journal_data ( inode ) ) { ret = ext4_force_commit ( inode -> i_sb ) ; if ( ret ) return ret ; } ioffset = round_down ( offset, PAGE_SIZE ) ; ret = filemap_write_and_wait_range ( inode -> i_mapping, ioffset, LLONG_MAX ) ; if ( ret ) return ret ; mutex_lock ( & inode -> i_mutex ) ; if ( offset + len >= i_size_read ( inode ) ) { ret = - EINVAL ; goto out_mutex ; } if (! ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) { ret = - EOPNOTSUPP ; goto out_mutex ; } <START_BUG> truncate_pagecache ( inode, ioffset ) ; <END_BUG>  ext4_inode_block_unlocked_dio ( inode ) ; <START_BUG> inode_dio_wait ( inode ) ; credits = ext4_writepage_trans_blocks ( inode ) ; handle = ext4_journal_start ( inode, EXT4_HT_TRUNCATE, credits ) ; if ( IS_ERR ( handle ) ) { ret = PTR_<END_BUG>

Fix:
<S2SV_ModStart> out_mutex ; } ext4_inode_block_unlocked_dio ( inode ) ; inode_dio_wait ( inode ) ; down_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModStart> ioffset ) ; <S2SV_ModEnd> credits = ext4_writepage_trans_blocks <S2SV_ModStart> ) ; goto out_mmap <S2SV_ModEnd> ; } down_write <S2SV_ModStart> handle ) ; out_mmap : up_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModEnd> ext4_inode_resume_unlocked_dio ( inode
Buggy code:
 int snd_usbmidi_create ( struct snd_card * card, struct usb_interface * iface, struct list_head * midi_list, const struct snd_usb_audio_quirk * quirk ) { struct snd_usb_midi * umidi ; struct snd_usb_midi_endpoint_info endpoints [ MIDI_MAX_ENDPOINTS ] ; int out_ports, in_ports ; int i, err ; umidi = kzalloc ( sizeof ( * umidi ), GFP_KERNEL ) ; if (! umidi ) return - ENOMEM ; umidi -> dev = interface_to_usbdev ( iface ) ; umidi -> card = card ; umidi -> iface = iface ; umidi -> quirk = quirk ; umidi -> usb_protocol_ops = & snd_usbmidi_standard_ops ; spin_lock_init ( & umidi -> disc_lock ) ; init_rwsem ( & umidi -> disc_rwsem ) ; mutex_init ( & umidi -> mutex ) ; umidi -> usb_id = USB_ID ( le16_to_cpu ( umidi -> dev -> descriptor. idVendor ), le16_to_cpu ( umidi -> dev -> descriptor. idProduct ) ) ; setup_timer ( & umidi -> error_timer, snd_usbmidi_error_timer, ( unsigned long ) umidi ) ; memset ( endpoints, 0, sizeof ( endpoints ) ) ; switch ( quirk? quirk -> type : QUIRK_MIDI_STANDARD_INTERFACE ) { case QUIRK_MIDI_STANDARD_INTERFACE : err = snd_usbmidi_get_ms_info ( umidi, endpoints ) ; if ( umidi -> usb_id == USB_ID ( 0x0763, 0x0150 ) ) umidi -> usb_protocol_ops = & snd_usbmidi_maudio_broken_running_status_ops ; break ; case QUIRK_MIDI_US122L : umidi -> usb_protocol_ops = & snd_usbmidi_122l_ops ; case QUIRK_MIDI_FIXED_ENDPOINT :

Fix:
<S2SV_ModStart> 0 ) { <S2SV_ModEnd> return err ;
Buggy code:
 static void Sp_split_regexp ( js_State * J ) { js_Regexp * re ; const char * text ; int limit, len, k ; const char * p, * a, * b, * c, * e ; Resub m ; text = checkstring ( J, 0 ) ; re = js_toregexp ( J, 1 ) ; limit = js_isdefined ( J, 2 )? js_tointeger ( J, 2 ) : 1 << 30 ; js_newarray ( J ) ; len = 0 ; e = text + strlen ( text ) ; if ( e == text ) { <START_BUG> if ( js_regexec ( re -> prog, text, & m, 0 ) ) { <END_BUG> if ( len == limit ) return ; js_pushliteral ( J, "" ) ; js_setindex ( J, - 2, 0 ) ; } return ; } p = a = text ; while ( a < e ) {  if ( js_regexec ( re -> prog, a, & m, a > text? REG_NOTBOL : 0 ) ) <START_BUG> break ; b = m. sub [ 0 ]. sp ; c = m. sub [ 0 ]. ep ; if ( b == p ) { ++ a ; continue ; } if ( len == limit ) return ; js_pushlstring ( J, p, b - p ) ; js_setindex ( J, - 2, len ++ ) ; for ( k = 1 ; k < m. nsub ; ++ k ) { if ( len == limit ) return ; js_pushlstring ( J, m. sub [ k ]. sp, m. sub [ k ]. ep - m. sub [ k ]. sp ) ; js_setindex ( J, - 2, len ++ ) ; } a = p = c ; } if ( len == limit ) return ; js_pushstring ( J, p ) ; js_setindex ( J, - 2, len ) ; }<END_BUG>

Fix:
<S2SV_ModStart> { if ( js_doregexec ( J, <S2SV_ModEnd> re -> prog <S2SV_ModStart> { if ( js_doregexec ( J, <S2SV_ModEnd> re -> prog
Buggy code:
 static int tap_if_up ( const char * devname, const bt_bdaddr_t * addr ) { struct ifreq ifr ; int sk, err ; sk = socket ( AF_INET, SOCK_DGRAM, 0 ) ; if ( sk < 0 ) return - 1 ; memset ( & ifr, 0, sizeof ( ifr ) ) ; strncpy ( ifr. ifr_name, devname, IFNAMSIZ - 1 ) ; <START_BUG> err = ioctl ( sk, SIOCGIFHWADDR, & ifr ) ; <END_BUG> if ( err < 0 ) { BTIF_TRACE_ERROR ( "Could   not   get   network   hardware   for   interface:%s,   errno:%s", devname, strerror ( errno ) ) ; close ( sk ) ; return - 1 ; } strncpy ( ifr. ifr_name, devname, IFNAMSIZ - 1 ) ; memcpy ( ifr. ifr_hwaddr. sa_data, addr -> address, 6 ) ; if ( ifr. ifr_hwaddr. sa_data [ 0 ] & 0x01 ) { BTIF_TRACE_WARNING ( "Not   a   unicast   MAC   address,   force   multicast   bit   flipping" ) ; ifr. ifr_hwaddr. sa_data [ 0 ] &= ~ 0x01 ; }  err = ioctl ( sk, SIOCSIFHWADDR, ( caddr_t ) & ifr ) ; <START_BUG> if ( err < 0 ) { BTIF_TRACE_ERROR ( "Could   not   set   bt   address   for   interface:%s,   errno:%s", devname, strerror ( errno ) ) ; close ( sk ) ; return - 1 ; } memset ( & ifr, 0, sizeof ( ifr ) ) ; strncpy ( ifr. ifr_name, devname, IF_NAMESIZE - 1 ) ; ifr. ifr_flags |= IFF_UP ; ifr. ifr_flags |= IFF_MULTICAST ; <END_BUG> err = ioctl ( sk, SIOCSIFFLAGS, ( caddr_t ) & ifr ) ;  if ( err < 0 ) { BTIF_TRACE_ERROR (

Fix:
<S2SV_ModStart> ; err = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & ifr ) <S2SV_ModStart> } err = TEMP_FAILURE_RETRY ( <S2SV_ModStart> ) & ifr ) <S2SV_ModStart> ; err = TEMP_FAILURE_RETRY ( <S2SV_ModStart> & ifr ) )
Buggy code:
 bgp_attr_parse_ret_t bgp_attr_parse ( struct peer * peer, struct attr * attr, bgp_size_t size, struct bgp_nlri * mp_update, struct bgp_nlri * mp_withdraw ) { bgp_attr_parse_ret_t ret ; uint8_t flag = 0 ; uint8_t type = 0 ; bgp_size_t length ; uint8_t * startp, * endp ; uint8_t * attr_endp ; uint8_t seen [ BGP_ATTR_BITMAP_SIZE ] ; struct aspath * as4_path = NULL ; as_t as4_aggregator = 0 ; struct in_addr as4_aggregator_addr = {. s_addr = 0 } ; memset ( seen, 0, BGP_ATTR_BITMAP_SIZE ) ; endp = BGP_INPUT_PNT ( peer ) + size ; while ( BGP_INPUT_PNT ( peer ) < endp ) { if ( endp - BGP_INPUT_PNT ( peer ) < BGP_ATTR_MIN_LEN ) { flog_warn ( EC_BGP_ATTRIBUTE_TOO_SMALL, "%s:   error   BGP   attribute   length   %lu   is   smaller   than   min   len", peer -> host, ( unsigned long ) ( endp - stream_pnt ( BGP_INPUT ( peer ) ) ) ) ; bgp_notify_send ( peer, BGP_NOTIFY_UPDATE_ERR, BGP_NOTIFY_UPDATE_ATTR_LENG_ERR ) ; return BGP_ATTR_PARSE_ERROR ; } startp = BGP_INPUT_PNT ( peer ) ; flag = 0xF0 & stream_getc ( BGP_INPUT ( peer ) ) ; type = stream_getc ( BGP_INPUT ( peer ) ) ; if ( CHECK_FLAG ( flag, BGP_ATTR_FLAG_EXTLEN ) && ( ( endp - startp ) < ( BGP_ATTR_MIN_LEN + 1 ) ) ) { flog_warn ( EC_BGP_EXT_ATTRIBUTE_TOO_SMALL, "%s:   Extended   length   set,   but   just   %lu   bytes   of   attr   header", peer -> host, ( unsigned long ) ( endp - stream_pnt (

Fix:
<S2SV_ModStart> ; # if ENABLE_BGP_VNC_ATTR <S2SV_ModEnd> case BGP_ATTR_VNC :
Buggy code:
 static void detect_allow_debuggers ( int argc, char * * argv ) { int i ; for ( i = 1 ; i < argc ; i ++ ) { if ( strcmp ( argv [ i ], "--allow-debuggers" ) == 0 ) { <START_BUG> arg_allow_debuggers = 1 ; <END_BUG> break ; } if ( strcmp ( argv [ i ], "--" ) == 0 ) break ; if ( strncmp ( argv [ i ], "--", 2 )!= 0 ) break ; } }

Fix:
<S2SV_ModStart> 0 ) { struct utsname u ; int rv = uname ( & u ) ; if ( rv!= 0 ) errExit ( "uname" ) ; int major ; int minor ; if ( 2!= sscanf ( u. release, "%d.%d", & major, & minor ) ) { fprintf ( stderr, "Error: <S2SV_blank> cannot <S2SV_blank> extract <S2SV_blank> Linux <S2SV_blank> kernel <S2SV_blank> version: <S2SV_blank> %s\\n", u. version ) ; exit ( 1 ) ; } if ( major < 4 || ( major == 4 && minor < 8 ) ) { fprintf ( stderr, "Error: <S2SV_blank> --allow-debuggers <S2SV_blank> is <S2SV_blank> disabled <S2SV_blank> on <S2SV_blank> Linux <S2SV_blank> kernels <S2SV_blank> prior <S2SV_blank> to <S2SV_blank> 4.8. <S2SV_blank> " "A <S2SV_blank> bug <S2SV_blank> in <S2SV_blank> ptrace <S2SV_blank> call <S2SV_blank> allows <S2SV_blank> a <S2SV_blank> full <S2SV_blank> bypass <S2SV_blank> of <S2SV_blank> the <S2SV_blank> seccomp <S2SV_blank> filter. <S2SV_blank> " "Your <S2SV_blank> current <S2SV_blank> kernel <S2SV_blank> version <S2SV_blank> is <S2SV_blank> %d.%d.\\n", major, minor ) ; exit ( 1 ) ; }
Buggy code:
 <START_BUG> static void encode_frame ( vpx_codec_ctx_t * codec, <END_BUG> vpx_image_t * img, int frame_index,  VpxVideoWriter * writer ) { <START_BUG> vpx_codec_iter_t iter = NULL ; const vpx_codec_cx_pkt_t * pkt = NULL ; const vpx_codec_err_t res = vpx_codec_encode ( codec, img, frame_index, 1, 0, VPX_DL_GOOD_QUALITY ) ; if ( res!= VPX_CODEC_OK ) die_codec ( codec, "Failed   to   encode   frame" ) ; <END_BUG> while ( ( pkt = vpx_codec_get_cx_data ( codec, & iter ) )!= NULL ) {  if ( pkt -> kind == VPX_CODEC_CX_FRAME_PKT ) { const int keyframe = ( pkt -> data. frame. flags & VPX_FRAME_IS_KEY )!= 0 ; if (! vpx_video_writer_write_frame ( writer, pkt -> data. frame. buf, pkt -> data. frame. sz, pkt -> data. frame. pts ) ) { die_codec ( codec, "Failed   to   write   compressed   frame" ) ; } printf ( keyframe? "K" : "." ) ; fflush ( stdout ) ; } } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> encode_frame ( vpx_codec_ctx_t <S2SV_ModStart> writer ) { int got_pkts = 0 ; <S2SV_ModStart> NULL ) { got_pkts = 1 ; <S2SV_ModStart> ; } } return got_pkts ;
Buggy code:
 static Image * ReadGIFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BitSet ( byte, bit ) ( ( ( byte ) & ( bit ) ) == ( bit ) ) # define LSBFirstOrder ( x, y ) ( ( ( y ) << 8 ) | ( x ) ) Image * image, * meta_image ; int number_extensionss = 0 ; MagickBooleanType status ; RectangleInfo page ; register ssize_t i ; register unsigned char * p ; size_t delay, dispose, duration, global_colors, image_count, iterations, one ; ssize_t count, opacity ; unsigned char background, c, flag, * global_colormap, buffer [ 257 ] ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } count = ReadBlob ( image, 6, buffer ) ; if ( ( count!= 6 ) || ( ( LocaleNCompare ( ( char * ) buffer, "GIF87", 5 )!= 0 ) && ( LocaleNCompare ( ( char * ) buffer, "GIF89", 5 )!= 0 ) ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; page. width = ReadBlobLSBShort ( image ) ; page. height = ReadBlobLSBShort ( image ) ; flag = ( unsigned char ) ReadBlobByte ( image ) ; background = ( unsigned char ) ReadBlobByte ( image ) ; c = ( unsigned char ) ReadBlobByte ( image ) ; one = 1 ; global_colors = one << ( ( ( size_t ) flag & 0x07 ) + 1 ) ; global_colormap = ( unsigned char * ) AcquireQuantumMemory ( ( size_t

Fix:
<S2SV_ModStart> ResourceLimitError, "MemoryAllocationFailed" ) ; ( void ) ResetMagickMemory ( global_colormap, 0, 3 * MagickMax ( global_colors, 256 ) * sizeof ( * global_colormap )
Buggy code:
 static void call_bind_status ( struct rpc_task * task ) { int status = - EIO ; if ( task -> tk_status >= 0 ) { dprint_status ( task ) ; task -> tk_status = 0 ; task -> tk_action = call_connect ; return ; } switch ( task -> tk_status ) { case - ENOMEM : dprintk ( "RPC:   %5u   rpcbind   out   of   memory\\n", task -> tk_pid ) ; rpc_delay ( task, HZ >> 2 ) ; goto retry_timeout ; case - EACCES : dprintk ( "RPC:   %5u   remote   rpcbind:   RPC   program//version   " "unavailable\\n", task -> tk_pid ) ; if ( task -> tk_msg. rpc_proc -> p_proc == 0 ) { status = - EOPNOTSUPP ; break ; } <START_BUG> rpc_delay ( task, 3 * HZ ) ; <END_BUG> goto retry_timeout ; case - ETIMEDOUT : dprintk ( "RPC:   %5u   rpcbind   request   timed   out\\n", task -> tk_pid ) ; goto retry_timeout ; case - EPFNOSUPPORT : dprintk ( "RPC:   %5u   unrecognized   remote   rpcbind   service\\n", task -> tk_pid ) ; break ; case - EPROTONOSUPPORT : dprintk ( "RPC:   %5u   remote   rpcbind   version   unavailable,   retrying\\n", task -> tk_pid ) ; task -> tk_status = 0 ; task -> tk_action = call_bind ; return ; case - ECONNREFUSED : case - ECONNRESET : case - ENOTCONN : case - EHOSTDOWN : case - EHOSTUNREACH : case - ENETUNREACH : case - EPIPE : dprintk ( "RPC:   %5u   remote   rpcbind   unreachable:   %d\\n", task -> tk_pid, task -> tk_status ) ; if (! RPC_IS_SOFTCONN ( task ) ) { rpc_delay ( task, 5 * HZ ) ; goto retry_timeout ; } status = task -> tk_status ; break ; default : dprintk (

Fix:
<S2SV_ModStart> break ; } if ( task -> tk_rebind_retry == 0 ) break ; task -> tk_rebind_retry -- ;
Buggy code:
 int yr_re_exec ( uint8_t * re_code, uint8_t * input_data, <START_BUG> size_t input_size, <END_BUG> int flags, RE_MATCH_CALLBACK_FUNC callback, void * callback_args ) { uint8_t * ip ; uint8_t * input ; uint8_t mask ; uint8_t value ; RE_FIBER_LIST fibers ; RE_THREAD_STORAGE * storage ; RE_FIBER * fiber ; RE_FIBER * next_fiber ; int error ; int bytes_matched ; int max_bytes_matched ; int match ; int character_size ; int input_incr ; int kill ; int action ; int result = - 1 ; # define ACTION_NONE 0 # define ACTION_CONTINUE 1 # define ACTION_KILL 2 # define ACTION_KILL_TAIL 3  # define prolog if ( bytes_matched >= max_bytes_matched ) { action = ACTION_KILL ; break ; } <START_BUG> <END_BUG> # define fail_if_error ( e ) switch ( e ) { case ERROR_INSUFFICIENT_MEMORY : return - 2 ; case ERROR_TOO_MANY_RE_FIBERS : return - 4 ; }  if ( _yr_re_alloc_storage ( & storage )!= ERROR_SUCCESS ) return - 2 ; if ( flags & RE_FLAGS_WIDE ) character_size = 2 ; else character_size = 1 ; input = input_data ; input_incr = character_size ; if ( flags & RE_FLAGS_BACKWARDS ) { <START_BUG> input -= character_size ; <END_BUG> input_incr = - input_incr ; }  max_bytes_matched = ( int ) yr_min ( input_size, RE_SCAN_LIMIT ) ; <START_BUG> max_bytes_matched = max_bytes_matched - max_bytes_matched % character_size ; bytes_matched = 0 ; error = _yr_re_fiber_create ( & storage -> fiber_pool, & fiber ) ; fail_if_error ( error ) ; fiber -> ip = re_code ; fibers. head = fiber ; fibers. tail = fiber ; error = _yr_re_fiber_sync ( & fibers, & storage -> fiber_pool, fiber<END_BUG>

Fix:
<S2SV_ModStart> input_data, size_t input_forwards_size, size_t input_backwards_size <S2SV_ModEnd>, int flags <S2SV_ModStart> # define prolog { if ( <S2SV_ModEnd> ( bytes_matched >= <S2SV_ModStart> >= max_bytes_matched ) || ( character_size == 2 && * ( input + 1 )!= 0 ) ) { action = ACTION_KILL ; break ; } <S2SV_ModEnd> } # define <S2SV_ModStart> ( e ) { <S2SV_ModStart> 4 ; } } <S2SV_ModStart> RE_FLAGS_BACKWARDS ) { max_bytes_matched = ( int ) yr_min ( input_backwards_size, RE_SCAN_LIMIT ) ; <S2SV_ModStart> input_incr ; } else { <S2SV_ModStart> ) yr_min ( input_forwards_size <S2SV_ModEnd>, RE_SCAN_LIMIT ) <S2SV_ModStart> RE_SCAN_LIMIT ) ; } <S2SV_ModStart> ; match = _yr_re_is_word_char ( input, character_size <S2SV_ModEnd> ) ; action <S2SV_ModStart> match =! _yr_re_is_word_char ( input, character_size <S2SV_ModEnd> ) ; action <S2SV_ModStart> == 0 && input_backwards_size < character_size ) { <S2SV_ModEnd> match = TRUE <S2SV_ModStart> = TRUE ; } <S2SV_ModStart> >= max_bytes_matched )