nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void bgp_packet_mpattr_tea ( struct bgp * bgp, struct peer * peer, struct stream * s, struct attr * attr, uint8_t attrtype ) { unsigned int attrlenfield = 0 ; unsigned int attrhdrlen = 0 ; struct bgp_attr_encap_subtlv * subtlvs ; struct bgp_attr_encap_subtlv * st ; const char * attrname ; if (! attr || ( attrtype == BGP_ATTR_ENCAP && (! attr -> encap_tunneltype || attr -> encap_tunneltype == BGP_ENCAP_TYPE_MPLS ) ) ) return ; switch ( attrtype ) { case BGP_ATTR_ENCAP : attrname = "Tunnel   Encap" ; subtlvs = attr -> encap_subtlvs ; if ( subtlvs == NULL ) return ; attrlenfield = 2 + 2 ; attrhdrlen = 1 + 1 ; break ; <START_BUG> # if ENABLE_BGP_VNC <END_BUG> case BGP_ATTR_VNC : attrname = "VNC" ; subtlvs = attr -> vnc_subtlvs ; if ( subtlvs == NULL ) return ; attrlenfield = 0 ; attrhdrlen = 2 + 2 ; break ; # endif default : assert ( 0 ) ; } for ( st = subtlvs ; st ; st = st -> next ) { attrlenfield += ( attrhdrlen + st -> length ) ; } if ( attrlenfield > 0xffff ) { zlog_info ( "%s   attribute   is   too   long   (length=%d),   can\'t   send   it", attrname, attrlenfield ) ; return ; } if ( attrlenfield > 0xff ) { stream_putc ( s, BGP_ATTR_FLAG_TRANS | BGP_ATTR_FLAG_OPTIONAL | BGP_ATTR_FLAG_EXTLEN ) ; stream_putc ( s, attrtype ) ; stream_putw ( s, attrlenfield & 0xffff ) ; } else { stream_putc ( s, BGP_ATTR_FLAG_TRANS | BGP_ATTR_FLAG_OPTIONAL ) ; stream_putc ( s, attrtype ) ; stream_putc ( s, attrlenfield & 0xff ) ; } if ( attrtype

Fix:
<S2SV_ModStart> ; # if ENABLE_BGP_VNC_ATTR <S2SV_ModEnd> case BGP_ATTR_VNC :
Buggy code:
 static int calc_iframe_target_size_one_pass_vbr ( const VP9_COMP * const cpi ) { static const int kf_ratio = 25 ; const RATE_CONTROL * rc = & cpi -> rc ; <START_BUG> int target = rc -> av_per_frame_bandwidth * kf_ratio ; <END_BUG> return vp9_rc_clamp_iframe_target_size ( cpi, target ) ; }

Fix:
<S2SV_ModStart> -> rc ; const <S2SV_ModStart> = rc -> avg_frame_bandwidth <S2SV_ModEnd> * kf_ratio ;
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char * pixels ; unsigned long ls

Fix:
<S2SV_ModStart> ) AcquireQuantumMemory ( MagickMax ( number_pixels, max_packets ), <S2SV_ModEnd> bytes_per_pixel * sizeof
Buggy code:
 void xgroupCommand ( client * c ) { const char * help [ ] = { "CREATE             <key>   <groupname>   <id   or   $>     --   Create   a   new   consumer   group.", "SETID               <key>   <groupname>   <id   or   $>     --   Set   the   current   group   ID.", "DELGROUP         <key>   <groupname>                         --   Remove   the   specified   group.", "DELCONSUMER   <key>   <groupname>   <consumer>   --   Remove   the   specified   conusmer.", "HELP                                                                           --   Prints   this   help.", NULL } ; stream * s = NULL ; sds grpname = NULL ; streamCG * cg = NULL ; char * opt = c -> argv [ 1 ] -> ptr ; if ( c -> argc >= 4 ) { robj * o = lookupKeyWriteOrReply ( c, c -> argv [ 2 ], shared. nokeyerr ) ; <START_BUG> if ( o == NULL ) return ; <END_BUG> s = o -> ptr ; grpname = c -> argv [ 3 ] -> ptr ; if ( ( cg = streamLookupCG ( s, grpname ) ) == NULL && (! strcasecmp ( opt, "SETID" ) ||! strcasecmp ( opt, "DELCONSUMER" ) ) ) { addReplyErrorFormat ( c, "-NOGROUP   No   such   consumer   group   \'%s\'   " "for   key   name   \'%s\'", ( char * ) grpname, ( char * ) c -> argv [ 2 ] -> ptr ) ; return ; } } if (! strcasecmp ( opt, "CREATE" ) && c -> argc == 5 ) { streamID id ; if (! strcmp ( c -> argv [ 4 ] -> ptr, "$" ) ) { id = s -> last_id ; } else if ( streamParseIDOrReply ( c, c -> argv [ 4 ], & id, 0 )!= C_OK ) { return ;

Fix:
<S2SV_ModStart> o == NULL || checkType ( c, o, OBJ_STREAM )
Buggy code:
 static int csnmp_read_table ( host_definition_t * host, data_definition_t * data ) { struct snmp_pdu * req ; struct snmp_pdu * res = NULL ; struct variable_list * vb ; const data_set_t * ds ; size_t oid_list_len = data -> values_len + 1 ; oid_t oid_list [ oid_list_len ] ; _Bool oid_list_todo [ oid_list_len ] ; int status ; size_t i ; csnmp_list_instances_t * instance_list_head ; csnmp_list_instances_t * instance_list_tail ; csnmp_table_values_t * * value_list_head ; csnmp_table_values_t * * value_list_tail ; DEBUG ( "snmp   plugin:   csnmp_read_table   (host   =   %s,   data   =   %s)", host -> name, data -> name ) ; if ( host -> sess_handle == NULL ) { DEBUG ( "snmp   plugin:   csnmp_read_table:   host->sess_handle   ==   NULL" ) ; return ( - 1 ) ; } ds = plugin_get_ds ( data -> type ) ; if (! ds ) { ERROR ( "snmp   plugin:   DataSet   `%s\'   not   defined.", data -> type ) ; return ( - 1 ) ; } if ( ds -> ds_num!= data -> values_len ) { ERROR ( "snmp   plugin:   DataSet   `%s\'   requires   %zu   values,   but   config   talks   " "about   %zu", data -> type, ds -> ds_num, data -> values_len ) ; return ( - 1 ) ; } assert ( data -> values_len > 0 ) ; memcpy ( oid_list, data -> values, data -> values_len * sizeof ( oid_t ) ) ; if ( data -> instance. oid. oid_len > 0 ) memcpy ( oid_list + data -> values_len, & data -> instance. oid, sizeof ( oid_t ) ) ; else oid_list_len -- ; for ( i = 0 ; i < oid_list_len ; i ++

Fix:
<S2SV_ModStart> DEBUG ( "snmp <S2SV_blank> plugin: <S2SV_blank> all <S2SV_blank> variables <S2SV_blank> have <S2SV_blank> left <S2SV_blank> their <S2SV_blank> subtree" ) ; snmp_free_pdu ( req <S2SV_ModStart> = NULL ; <S2SV_ModEnd> sfree ( errstr <S2SV_ModStart> ; if ( <S2SV_ModEnd> status == 0
Buggy code:
 static void yuvconfig2image ( vpx_image_t * img, const YV12_BUFFER_CONFIG * yv12, void * user_priv ) { img -> fmt = VPX_IMG_FMT_I420 ; img -> w = yv12 -> y_stride ; img -> h = ( yv12 -> y_height + 2 * VP8BORDERINPIXELS + 15 ) & ~ 15 ; img -> d_w = yv12 -> y_width ; img -> d_h = yv12 -> y_height ; img -> x_chroma_shift = 1 ; img -> y_chroma_shift = 1 ; img -> planes [ VPX_PLANE_Y ] = yv12 -> y_buffer ; img -> planes [ VPX_PLANE_U ] = yv12 -> u_buffer ; img -> planes [ VPX_PLANE_V ] = yv12 -> v_buffer ; img -> planes [ VPX_PLANE_ALPHA ] = NULL ; img -> stride [ VPX_PLANE_Y ] = yv12 -> y_stride ; img -> stride [ VPX_PLANE_U ] = yv12 -> uv_stride ; img -> stride [ VPX_PLANE_V ] = yv12 -> uv_stride ; img -> stride [ VPX_PLANE_ALPHA ] = yv12 -> y_stride ; <START_BUG> img -> bps = 12 ; <END_BUG> img -> user_priv = user_priv ; img -> img_data = yv12 -> buffer_alloc ; img -> img_data_owner = 0 ; img -> self_allocd = 0 ; }

Fix:
<S2SV_ModStart> ; img -> bit_depth = 8 ; img ->
Buggy code:
 static void sunkbd_reinit ( struct work_struct * work ) { struct sunkbd * sunkbd = container_of ( work, struct sunkbd, tq ) ; <START_BUG> wait_event_interruptible_timeout ( sunkbd -> wait, sunkbd -> reset >= 0, HZ ) ; <END_BUG>  serio_write ( sunkbd -> serio, SUNKBD_CMD_SETLED ) ; <START_BUG> serio_write ( sunkbd -> serio, (!! test_bit ( LED_CAPSL, sunkbd -> dev -> led ) << 3 ) | (!! test_bit ( LED_SCROLLL, sunkbd -> dev -> led ) << 2 ) | (!! test_bit ( LED_COMPOSE, sunkbd -> dev -> led ) << 1 ) |!! test_bit ( LED_NUML, sunkbd -> dev -> led ) ) ; serio_write ( sunkbd -> serio, SUNKBD_CMD_NOCLICK -!! test_bit ( SND_CLICK, sunkbd -> dev -> snd ) ) ; serio_write ( sunkbd -> serio, SUNKBD_CMD_BELLOFF -!! test_bit ( SND_BELL, sunkbd -> dev -> snd ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> reset >= 0 ||! sunkbd -> enabled <S2SV_ModStart> HZ ) ; if <S2SV_ModEnd> ( sunkbd -> <S2SV_ModStart> ( sunkbd -> reset >= 0 && sunkbd -> enabled ) sunkbd_set_leds_beeps ( sunkbd <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> void vp9_diff_update_prob ( vp9_reader * r, vp9_prob * p ) { <END_BUG>  if ( vp9_read ( r, DIFF_UPDATE_PROB ) ) { <START_BUG> const int delp = decode_term_subexp ( r ) ; <END_BUG> * p = ( vp9_prob ) inv_remap_prob ( delp, * p ) ;  } }

Fix:
<S2SV_ModStart> void vp9_diff_update_prob ( vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> * r, vpx_prob <S2SV_ModEnd> * p ) <S2SV_ModStart> { if ( vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> p = ( vpx_prob <S2SV_ModEnd> ) inv_remap_prob (
Buggy code:
 static int cuse_channel_release ( struct inode * inode, struct file * file ) { struct fuse_dev * fud = file -> private_data ; struct cuse_conn * cc = fc_to_cc ( fud -> fc ) ; int rc ; mutex_lock ( & cuse_lock ) ; list_del_init ( & cc -> list ) ; mutex_unlock ( & cuse_lock ) ; if ( cc -> dev ) device_unregister ( cc -> dev ) ; if ( cc -> cdev ) { unregister_chrdev_region ( cc -> cdev -> dev, 1 ) ; cdev_del ( cc -> cdev ) ; } <START_BUG> rc = fuse_dev_release ( inode, file ) ; <END_BUG> return rc ; }

Fix:
<S2SV_ModStart> ) ; } fuse_conn_put ( & cc -> fc ) ;
Buggy code:
 int stats_open_file ( stats_io_t * stats, const char * fpf, int pass ) { int res ; stats -> pass = pass ; if ( pass == 0 ) { stats -> file = fopen ( fpf, "wb" ) ; stats -> buf. sz = 0 ; stats -> buf. buf = NULL ; res = ( stats -> file!= NULL ) ; } else { # if USE_POSIX_MMAP struct stat stat_buf ; int fd ; fd = open ( fpf, O_RDONLY ) ; stats -> file = fdopen ( fd, "rb" ) ; fstat ( fd, & stat_buf ) ; stats -> buf. sz = stat_buf. st_size ; stats -> buf. buf = mmap ( NULL, stats -> buf. sz, PROT_READ, MAP_PRIVATE, fd, 0 ) ; res = ( stats -> buf. buf!= NULL ) ; # else size_t nbytes ; stats -> file = fopen ( fpf, "rb" ) ; <START_BUG> if ( fseek ( stats -> file, 0, SEEK_END ) ) <END_BUG> fatal ( "First-pass   stats   file   must   be   seekable!" ) ; stats -> buf. sz = stats -> buf_alloc_sz = ftell ( stats -> file ) ; rewind ( stats -> file ) ; stats -> buf. buf = malloc ( stats -> buf_alloc_sz ) ; if (! stats -> buf. buf ) fatal ( "Failed   to   allocate   first-pass   stats   buffer   (%lu   bytes)", ( unsigned int ) stats -> buf_alloc_sz ) ; nbytes = fread ( stats -> buf. buf, 1, stats -> buf. sz, stats -> file ) ; res = ( nbytes == stats -> buf. sz ) ; # endif } return res ; }

Fix:
<S2SV_ModStart> ; if ( stats -> file == NULL ) fatal ( "First-pass <S2SV_blank> stats <S2SV_blank> file <S2SV_blank> does <S2SV_blank> not <S2SV_blank> exist!" ) ; if (
Buggy code:
 int cg_write ( const char * path, const char * buf, size_t size, off_t offset, struct fuse_file_info * fi ) { struct fuse_context * fc = fuse_get_context ( ) ; char * localbuf = NULL ; struct cgfs_files * k = NULL ; struct file_info * f = ( struct file_info * ) fi -> fh ; bool r ; if ( f -> type!= LXC_TYPE_CGFILE ) { fprintf ( stderr, "Internal   error:   directory   cache   info   used   in   cg_write\\n" ) ; return - EIO ; } if ( offset ) return 0 ; if (! fc ) return - EIO ; localbuf = alloca ( size + 1 ) ; localbuf [ size ] = '\\0' ; memcpy ( localbuf, buf, size ) ; if ( ( k = cgfs_get_key ( f -> controller, f -> cgroup, f -> file ) ) == NULL ) { size = - EINVAL ; goto out ; } if (! fc_may_access ( fc, f -> controller, f -> cgroup, f -> file, O_WRONLY ) ) { size = - EACCES ; goto out ; } if ( strcmp ( f -> file, "tasks" ) == 0 || strcmp ( f -> file, "//tasks" ) == 0 || strcmp ( f -> file, "//cgroup.procs" ) == 0 || strcmp ( f -> file, "cgroup.procs" ) == 0 ) <START_BUG> r = do_write_pids ( fc -> pid, f -> controller, f -> cgroup, f -> file, localbuf ) ; <END_BUG> else r = cgfs_set_value ( f -> controller, f -> cgroup, f -> file, localbuf ) ; if (! r ) size = - EINVAL ; out : free_key ( k ) ; return size ; }

Fix:
<S2SV_ModStart> -> pid, fc -> uid,
Buggy code:
 void qedi_dbg_notice ( struct qedi_dbg_ctx * qedi, const char * func, u32 line, const char * fmt,... ) { va_list va ; <START_BUG> struct va_format vaf ; <END_BUG> char nfunc [ 32 ] ; memset ( nfunc, 0, sizeof ( nfunc ) ) ; memcpy ( nfunc, func, sizeof ( nfunc ) - 1 ) ; va_start ( va, fmt ) ; vaf. fmt = fmt ; vaf. va = & va ; if (! ( qedi_dbg_log & QEDI_LOG_NOTICE ) ) goto ret ; if ( likely ( qedi ) && likely ( qedi -> pdev ) ) pr_notice ( "[%s]:[%s:%d]:%d:   %pV",  dev_name ( & qedi -> pdev -> dev ), nfunc, line, <START_BUG> qedi -> host_no, & vaf ) ; else <END_BUG> pr_notice ( "[0000:00:00.0]:[%s:%d]:   %pV", nfunc, line, & vaf ) ;  ret : va_end ( va ) ; }

Fix:
<S2SV_ModStart> struct va_format vaf <S2SV_ModEnd> ; va_start ( <S2SV_ModStart> dev ), func <S2SV_ModEnd>, line, <S2SV_ModStart> ( "[0000:00:00.0]:[%s:%d]: <S2SV_blank> %pV", func <S2SV_ModEnd>, line,
Buggy code:
 SPL_METHOD ( SplFileObject, fread ) { spl_filesystem_object * intern = ( spl_filesystem_object * ) zend_object_store_get_object ( getThis ( ) TSRMLS_CC ) ; long length = 0 ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "l", & length ) == FAILURE ) { return ; } if ( length <= 0 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Length   parameter   must   be   greater   than   0" ) ; RETURN_FALSE ; } <START_BUG> Z_STRVAL_P ( return_value ) = emalloc ( length + 1 ) ; <END_BUG> Z_STRLEN_P ( return_value ) = php_stream_read ( intern -> u. file. stream, Z_STRVAL_P ( return_value ), length ) ; Z_STRVAL_P ( return_value ) [ Z_STRLEN_P ( return_value ) ] = 0 ; Z_TYPE_P ( return_value ) = IS_STRING ; }

Fix:
<S2SV_ModStart> RETURN_FALSE ; } if ( length > INT_MAX ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Length <S2SV_blank> parameter <S2SV_blank> must <S2SV_blank> be <S2SV_blank> no <S2SV_blank> more <S2SV_blank> than <S2SV_blank> %d", INT_MAX ) ; RETURN_FALSE ; }
Buggy code:
 int main ( int argc, char * argv [ ] ) { int32_t ret = GPMF_OK ; GPMF_stream metadata_stream, * ms = & metadata_stream ; double metadatalength ; uint32_t * payload = NULL ; if ( argc!= 2 ) { printf ( "usage:   %s   <file_with_GPMF>\\n", argv [ 0 ] ) ; return - 1 ; } size_t mp4 = OpenMP4Source ( argv [ 1 ], MOV_GPMF_TRAK_TYPE, MOV_GPMF_TRAK_SUBTYPE ) ; <START_BUG> metadatalength = GetDuration ( mp4 ) ; <END_BUG> if ( metadatalength > 0.0 ) { uint32_t index, payloads = GetNumberPayloads ( mp4 ) ; # if 1 if ( payloads == 1 ) { uint32_t payloadsize = GetPayloadSize ( mp4, 0 ) ; payload = GetPayload ( mp4, payload, 0 ) ; if ( payload == NULL ) goto cleanup ; ret = GPMF_Init ( ms, payload, payloadsize ) ; if ( ret!= GPMF_OK ) goto cleanup ; ret = GPMF_Validate ( ms, GPMF_RECURSE_LEVELS ) ; if ( GPMF_OK!= ret ) { printf ( "Invalid   Structure\\n" ) ; goto cleanup ; } GPMF_ResetState ( ms ) ; do { PrintGPMF ( ms ) ; } while ( GPMF_OK == GPMF_Next ( ms, GPMF_RECURSE_LEVELS ) ) ; GPMF_ResetState ( ms ) ; printf ( "\\n" ) ; } # endif for ( index = 0 ; index < payloads ; index ++ ) { uint32_t payloadsize = GetPayloadSize ( mp4, index ) ;  float in = 0.0, out = 0.0 ; <START_BUG> payload = GetPayload ( mp4, payload, index ) ; if ( payload == NULL ) goto cleanup ; ret = GetPayloadTime ( mp4, index, & in, & out ) ; if ( ret!= GPMF_OK ) goto cleanup ; ret = GPMF_Init ( ms, payload, payloadsize ) ; if ( ret!= GPMF_OK ) goto cleanup ; # if 1 if ( index == 0 ) { ret = GPMF_Find<END_BUG>

Fix:
<S2SV_ModStart> MOV_GPMF_TRAK_SUBTYPE ) ; if ( mp4 == 0 ) { printf ( "error: <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> an <S2SV_blank> invalid <S2SV_blank> MP4//MOV\\n", argv [ 1 ] ) ; return - 1 ; } <S2SV_ModStart> index ) ; double <S2SV_ModEnd> in = 0.0 <S2SV_ModStart> ) ) { double in = 0.0, out = 0.0 ; <S2SV_ModStart> fourcc, GPMF_SAMPLE_RATE_PRECISE, & in, & out ) ; printf ( "%c%c%c%c <S2SV_blank> sampling <S2SV_blank> rate <S2SV_blank> = <S2SV_blank> %f <S2SV_blank> Hz <S2SV_blank> (from <S2SV_blank> %f <S2SV_blank> to <S2SV_blank> %f)\\n" <S2SV_ModEnd>, PRINTF_4CC ( <S2SV_ModStart> ), rate, in, out
Buggy code:
 static struct sock * tcp_v6_syn_recv_sock ( const struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst, struct request_sock * req_unhash, bool * own_req ) { struct inet_request_sock * ireq ; struct ipv6_pinfo * newnp ; const struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct ipv6_txoptions * opt ; struct tcp6_sock * newtcp6sk ; struct inet_sock * newinet ; struct tcp_sock * newtp ; struct sock * newsk ; # ifdef CONFIG_TCP_MD5SIG struct tcp_md5sig_key * key ; # endif struct flowi6 fl6 ; if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = tcp_v4_syn_recv_sock ( sk, skb, req, dst, req_unhash, own_req ) ; if (! newsk ) return NULL ; newtcp6sk = ( struct tcp6_sock * ) newsk ; inet_sk ( newsk ) -> pinet6 = & newtcp6sk -> inet6 ; newinet = inet_sk ( newsk ) ; newnp = inet6_sk ( newsk ) ; newtp = tcp_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; newnp -> saddr = newsk -> sk_v6_rcv_saddr ; inet_csk ( newsk ) -> icsk_af_ops = & ipv6_mapped ; newsk -> sk_backlog_rcv = tcp_v4_do_rcv ; # ifdef CONFIG_TCP_MD5SIG newtp -> af_specific = & tcp_sock_ipv6_mapped_specific ; # endif <START_BUG> newnp -> ipv6_ac_list = NULL ; <END_BUG> newnp -> ipv6_fl_list = NULL ; newnp -> pktoptions = NULL ; newnp -> opt = NULL ; newnp -> mcast_oif = tcp_v6_iif ( skb ) ; newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; newnp ->

Fix:
<S2SV_ModStart> endif newnp -> ipv6_mc_list = NULL ; newnp -> <S2SV_ModStart> newinet -> inet_opt = NULL ; newnp -> ipv6_mc_list
Buggy code:
 static int copy_cred ( struct svc_cred * target, struct svc_cred * source ) { <START_BUG> int ret ; <END_BUG>  ret = strdup_if_nonnull ( & target -> cr_principal, source -> cr_principal ) ; <START_BUG> <END_BUG> if ( ret )  return ret ; ret = strdup_if_nonnull ( & target -> cr_raw_principal, source -> cr_raw_principal ) ; if ( ret ) return ret ; target -> cr_flavor = source -> cr_flavor ; target -> cr_uid = source -> cr_uid ; target -> cr_gid = source -> cr_gid ; target -> cr_group_info = source -> cr_group_info ; get_group_info ( target -> cr_group_info ) ; target -> cr_gss_mech = source -> cr_gss_mech ; if ( source -> cr_gss_mech ) gss_mech_get ( source -> cr_gss_mech ) ; return 0 ; }

Fix:
<S2SV_ModStart> source ) { <S2SV_ModEnd> target -> cr_principal <S2SV_ModStart> target -> cr_principal = kstrdup ( <S2SV_ModEnd> source -> cr_principal <S2SV_ModStart> source -> cr_principal, GFP_KERNEL ) ; target -> cr_raw_principal = kstrdup ( source -> cr_raw_principal, GFP_KERNEL <S2SV_ModStart> ; if ( ( source -> cr_principal &&! target -> cr_principal ) || ( source -> cr_raw_principal &&! target -> cr_raw_principal ) ) return - ENOMEM <S2SV_ModEnd> ; target ->
Buggy code:
 static MagickBooleanType ReadPSDChannelPixels ( Image * image, const size_t channels, const size_t row, const ssize_t type, const unsigned char * pixels, ExceptionInfo * exception ) { Quantum pixel ; register const unsigned char * p ; register Quantum * q ; register ssize_t x ; size_t packet_size ; unsigned short nibble ; p = pixels ; q = GetAuthenticPixels ( image, 0, row, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) return MagickFalse ; packet_size = GetPSDPacketSize ( image ) ; for ( x = 0 ; x < ( ssize_t ) image -> columns ; x ++ ) { if ( packet_size == 1 ) pixel = ScaleCharToQuantum ( * p ++ ) ; else { p = PushShortPixel ( MSBEndian, p, & nibble ) ; pixel = ScaleShortToQuantum ( nibble ) ; } <START_BUG> switch ( type ) <END_BUG> { case - 1 : { SetPixelAlpha ( image, pixel, q ) ; break ; } case - 2 : case 0 : { SetPixelRed ( image, pixel, q ) ; if ( channels == 1 || type == - 2 ) SetPixelGray ( image, pixel, q ) ; if ( image -> storage_class == PseudoClass ) { if ( packet_size == 1 ) SetPixelIndex ( image, ScaleQuantumToChar ( pixel ), q ) ; else SetPixelIndex ( image, ScaleQuantumToShort ( pixel ), q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) ConstrainColormapIndex ( image, GetPixelIndex ( image, q ), exception ), q ) ; if ( image -> depth == 1 ) { ssize_t bit, number_bits ; number_bits = image -> columns - x ; if ( number_bits > 8 ) number_bits = 8 ; for ( bit = 0 ; bit < number_bits ; bit ++ ) {  SetPixelIndex ( image, ( ( ( unsigned char ) pixel ) & <START_BUG> <END_BUG> ( 0x01 << ( 7 - bit ) ) )!= 0? 0 : 255, q ) ;  SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) ConstrainColormapIndex ( image

Fix:
<S2SV_ModStart> ) ; } if ( image -> depth > 1 ) { SetPSDPixel ( image, channels, type, packet_size, pixel, q, exception ) ; q += GetPixelChannels ( image ) ; } else <S2SV_ModEnd> { ssize_t bit <S2SV_ModStart> ++ ) { SetPSDPixel ( image, channels, type, packet_size <S2SV_ModEnd>, ( ( <S2SV_ModStart> 255, q, exception <S2SV_ModEnd> ) ; q <S2SV_ModStart> ++ ; } if ( x!= image -> columns ) <S2SV_ModStart> ; } } <S2SV_ModEnd> return ( SyncAuthenticPixels
Buggy code:
 static apr_status_t modsecurity_request_body_store_memory ( modsec_rec * msr, const char * data, apr_size_t length, char * * error_msg ) { * error_msg = NULL ; <START_BUG> if ( ( msr -> msc_reqbody_spilltodisk ) <END_BUG> && ( msr -> msc_reqbody_length + length > ( apr_size_t ) msr -> txcfg -> reqbody_inmemory_limit ) ) { msc_data_chunk * * chunks ; unsigned int disklen = 0 ; int i ; msr_log ( msr, 4, "Input   filter:   Request   too   large   to   store   in   memory,   switching   to   disk." ) ; msr -> msc_reqbody_storage = MSC_REQBODY_DISK ; if ( modsecurity_request_body_start_init ( msr, error_msg ) < 0 ) return - 1 ; chunks = ( msc_data_chunk * * ) msr -> msc_reqbody_chunks -> elts ; for ( i = 0 ; i < msr -> msc_reqbody_chunks -> nelts ; i ++ ) { disklen += chunks [ i ] -> length ; if ( modsecurity_request_body_store_disk ( msr, chunks [ i ] -> data, chunks [ i ] -> length, error_msg ) < 0 ) { return - 1 ; } free ( chunks [ i ] -> data ) ; chunks [ i ] -> data = NULL ; } msr -> msc_reqbody_chunks = NULL ; apr_pool_clear ( msr -> msc_reqbody_mp ) ; msr_log ( msr, 4, "Input   filter:   Wrote   %u   bytes   from   memory   to   disk.", disklen ) ; return modsecurity_request_body_store_disk ( msr, data, length, error_msg ) ; } { unsigned long int bucket_offset, bucket_left ; bucket_offset = 0 ; bucket_left = length ; while ( bucket_left > 0 ) { if ( msr -> msc_reqbody_chunk_current == NULL ) { msr -> msc_reqbody_chunk_current =

Fix:
<S2SV_ModStart> msr -> msc_reqbody_spilltodisk ) && ( msr -> txcfg -> reqbody_buffering!= REQUEST_BODY_FORCEBUF_ON
Buggy code:
 bt_status_t btif_dm_pin_reply ( const bt_bdaddr_t * bd_addr, uint8_t accept, uint8_t pin_len, bt_pin_code_t * pin_code ) { BTIF_TRACE_EVENT ( "%s:   accept=%d", __FUNCTION__, accept ) ; <START_BUG> if ( pin_code == NULL ) <END_BUG> return BT_STATUS_FAIL ; # if ( defined ( BLE_INCLUDED ) && ( BLE_INCLUDED == TRUE ) ) if ( pairing_cb. is_le_only ) { int i ; UINT32 passkey = 0 ; int multi [ ] = { 100000, 10000, 1000, 100, 10, 1 } ; BD_ADDR remote_bd_addr ; bdcpy ( remote_bd_addr, bd_addr -> address ) ; for ( i = 0 ; i < 6 ; i ++ ) { passkey += ( multi [ i ] * ( pin_code -> pin [ i ] - '0' ) ) ; } BTIF_TRACE_DEBUG ( "btif_dm_pin_reply:   passkey:   %d", passkey ) ; BTA_DmBlePasskeyReply ( remote_bd_addr, accept, passkey ) ; } else { BTA_DmPinReply ( ( UINT8 * ) bd_addr -> address, accept, pin_len, pin_code -> pin ) ; if ( accept ) pairing_cb. pin_code_len = pin_len ; } # else BTA_DmPinReply ( ( UINT8 * ) bd_addr -> address, accept, pin_len, pin_code -> pin ) ; if ( accept ) pairing_cb. pin_code_len = pin_len ; # endif return BT_STATUS_SUCCESS ; }

Fix:
<S2SV_ModStart> pin_code == NULL || pin_len > PIN_CODE_LEN
Buggy code:
 error_t ipStringToAddr ( const char_t * str, IpAddr * ipAddr ) { error_t error ; # if ( IPV6_SUPPORT == ENABLED ) <START_BUG> if ( strchr ( str, ':' ) ) <END_BUG> { ipAddr -> length = sizeof ( Ipv6Addr ) ; error = ipv6StringToAddr ( str, & ipAddr -> ipv6Addr ) ; } else # endif # if ( IPV4_SUPPORT == ENABLED )  if ( strchr ( str, '.' ) ) <START_BUG> { ipAddr -> length = sizeof ( Ipv4Addr ) ; error = ipv4StringToAddr ( str, & ipAddr -> ipv4Addr ) ; } else # endif { error = ERROR_FAILURE ; } return error ; }<END_BUG>

Fix:
<S2SV_ModStart> ) if ( osStrchr <S2SV_ModEnd> ( str, <S2SV_ModStart>, ':' )!= NULL <S2SV_ModStart> ) if ( osStrchr <S2SV_ModEnd> ( str, <S2SV_ModStart>, '.' )!= NULL
Buggy code:
 int udp_sendmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct udp_sock * up = udp_sk ( sk ) ; struct flowi4 * fl4 ; int ulen = len ; struct ipcm_cookie ipc ; struct rtable * rt = NULL ; int free = 0 ; int connected = 0 ; __be32 daddr, faddr, saddr ; __be16 dport ; u8 tos ; int err, is_udplite = IS_UDPLITE ( sk ) ; int corkreq = up -> corkflag || msg -> msg_flags & MSG_MORE ; int ( * getfrag ) ( void *, char *, int, int, int, struct sk_buff * ) ; <START_BUG> struct sk_buff * skb ; <END_BUG> if ( len > 0xFFFF ) return - EMSGSIZE ; if ( msg -> msg_flags & MSG_OOB ) return - EOPNOTSUPP ; ipc. opt = NULL ; ipc. tx_flags = 0 ; getfrag = is_udplite? udplite_getfrag : ip_generic_getfrag ; if ( up -> pending ) { lock_sock ( sk ) ; if ( likely ( up -> pending ) ) { if ( unlikely ( up -> pending!= AF_INET ) ) { release_sock ( sk ) ; return - EINVAL ; } goto do_append_data ; } release_sock ( sk ) ; } ulen += sizeof ( struct udphdr ) ; if ( msg -> msg_name ) { struct sockaddr_in * usin = ( struct sockaddr_in * ) msg -> msg_name ; if ( msg -> msg_namelen < sizeof ( * usin ) ) return - EINVAL ; if ( usin -> sin_family!= AF_INET ) { if ( usin -> sin_family!= AF_UNSPEC ) return - EAFNOSUPPORT ; } daddr = usin -> sin_addr. s_addr ; dport = usin -> sin_port ; if ( dport == 0 ) return - EINVAL ; } else { if ( sk -> sk_state!= TCP_ESTABLISHED ) return - EDESTADDRREQ ; d

Fix:
<S2SV_ModStart> sk_buff * skb ; struct ip_options_data opt_copy <S2SV_ModStart>. opt ) { struct ip_options_rcu * inet_opt ; rcu_read_lock ( ) ; inet_opt = rcu_dereference ( inet -> inet_opt ) ; if ( inet_opt ) { memcpy ( & opt_copy, inet_opt, sizeof ( * inet_opt ) + inet_opt -> opt. optlen ) ; ipc. opt = & opt_copy. opt ; } rcu_read_unlock ( ) ; } <S2SV_ModEnd> saddr = ipc <S2SV_ModStart>. opt -> opt. <S2SV_ModStart>. opt -> opt. <S2SV_ModStart>. opt -> opt.
Buggy code:
 static int zerocopy_sg_from_iovec ( struct sk_buff * skb, const struct iovec * from, int offset, size_t count ) { int len = iov_length ( from, count ) - offset ; int copy = skb_headlen ( skb ) ; int size, offset1 = 0 ; int i = 0 ; while ( count && ( offset >= from -> iov_len ) ) { offset -= from -> iov_len ; ++ from ; -- count ; } while ( count && ( copy > 0 ) ) { size = min_t ( unsigned int, copy, from -> iov_len - offset ) ; if ( copy_from_user ( skb -> data + offset1, from -> iov_base + offset, size ) ) return - EFAULT ; if ( copy > size ) { ++ from ; -- count ; offset = 0 ; } else offset += size ; copy -= size ; offset1 += size ; } if ( len == offset1 ) return 0 ; while ( count -- ) { struct page * page [ MAX_SKB_FRAGS ] ; int num_pages ; unsigned long base ; unsigned long truesize ; len = from -> iov_len - offset ; if (! len ) { offset = 0 ; ++ from ; continue ; } base = ( unsigned long ) from -> iov_base + offset ; size = ( ( base & ~ PAGE_MASK ) + len + ~ PAGE_MASK ) >> PAGE_SHIFT ; <START_BUG> num_pages = get_user_pages_fast ( base, size, 0, & page [ i ] ) ; <END_BUG>  if ( ( num_pages!= size ) || <START_BUG> ( num_pages > MAX_SKB_FRAGS - skb_shinfo ( skb ) -> nr_frags ) ) { for ( i = 0 ; i < num_pages ; i ++ ) put_page ( page [ i ] ) ; return - EFAULT ; } truesize = size * PAGE_SIZE ; skb -> data_len += len ; skb -> len += len ; skb -> truesize += truesize ; atomic_add ( truesize, & skb -> sk -> sk_wmem_alloc ) ; while ( len ) { int off = base & ~ PAGE_MASK ; int size = min_t ( int, len<END_BUG>

Fix:
<S2SV_ModStart> >> PAGE_SHIFT ; if ( i + size > MAX_SKB_FRAGS ) return - EMSGSIZE ; <S2SV_ModStart> ; if ( <S2SV_ModEnd> num_pages!= size <S2SV_ModStart> num_pages!= size <S2SV_ModEnd> ) { for
Buggy code:
 static int readContigStripsIntoBuffer ( TIFF * in, uint8 * buf ) { uint8 * bufp = buf ; int32 bytes_read = 0 ; uint32 strip, nstrips = TIFFNumberOfStrips ( in ) ; uint32 stripsize = TIFFStripSize ( in ) ; uint32 rows = 0 ; uint32 rps = TIFFGetFieldDefaulted ( in, TIFFTAG_ROWSPERSTRIP, & rps ) ; tsize_t scanline_size = TIFFScanlineSize ( in ) ; if ( scanline_size == 0 ) { TIFFError ( "", "TIFF   scanline   size   is   zero!" ) ; return 0 ; } for ( strip = 0 ; strip < nstrips ; strip ++ ) { bytes_read = TIFFReadEncodedStrip ( in, strip, bufp, - 1 ) ; rows = bytes_read // scanline_size ; if ( ( strip < ( nstrips - 1 ) ) && ( bytes_read!= ( int32 ) stripsize ) ) TIFFError ( "", "Strip   %d:   read   %lu   bytes,   strip   size   %lu", ( int ) strip + 1, ( unsigned long ) bytes_read, ( unsigned long ) stripsize ) ; if ( bytes_read < 0 &&! ignore ) { TIFFError ( "", "Error   reading   strip   %lu   after   %lu   rows", ( unsigned long ) strip, ( unsigned long ) rows ) ; return 0 ; } <START_BUG> bufp += bytes_read ; <END_BUG> } return 1 ; }

Fix:
<S2SV_ModStart> } bufp += stripsize <S2SV_ModEnd> ; } return
Buggy code:
 static __u8 * nci_extract_rf_params_nfca_passive_poll ( struct nci_dev * ndev, struct rf_tech_specific_params_nfca_poll * nfca_poll, __u8 * data ) { nfca_poll -> sens_res = __le16_to_cpu ( * ( ( __u16 * ) data ) ) ; data += 2 ; <START_BUG> nfca_poll -> nfcid1_len = * data ++ ; <END_BUG> pr_debug ( "sens_res   0x%x,   nfcid1_len   %d\\n", nfca_poll -> sens_res, nfca_poll -> nfcid1_len ) ; memcpy ( nfca_poll -> nfcid1, data, nfca_poll -> nfcid1_len ) ; data += nfca_poll -> nfcid1_len ; nfca_poll -> sel_res_len = * data ++ ; if ( nfca_poll -> sel_res_len!= 0 ) nfca_poll -> sel_res = * data ++ ; pr_debug ( "sel_res_len   %d,   sel_res   0x%x\\n", nfca_poll -> sel_res_len, nfca_poll -> sel_res ) ; return data ; }

Fix:
<S2SV_ModStart> -> nfcid1_len = min_t ( __u8, <S2SV_ModStart> * data ++, NFC_NFCID1_MAXSIZE )
Buggy code:
 int perf_event_task_enable ( void ) <START_BUG> { <END_BUG> struct perf_event * event ; mutex_lock ( & current -> perf_event_mutex ) ;  list_for_each_entry ( event, & current -> perf_event_list, owner_entry ) <START_BUG> <END_BUG> perf_event_for_each_child ( event, perf_event_enable ) ;  mutex_unlock ( & current -> perf_event_mutex ) ; return 0 ; }

Fix:
<S2SV_ModStart> void ) { struct perf_event_context * ctx ; <S2SV_ModStart>, owner_entry ) { ctx = perf_event_ctx_lock ( event ) ; <S2SV_ModStart> ( event, _perf_event_enable ) ; perf_event_ctx_unlock ( event, ctx ) ; } <S2SV_ModEnd> mutex_unlock ( &
Buggy code:
 void gtkui_icmp_redir ( void ) { GtkWidget * dialog, * table, * hbox, * image, * label, * entry1, * entry2, * frame ; gint response = 0 ; DEBUG_MSG ( "gtk_icmp_redir" ) ; dialog = gtk_dialog_new_with_buttons ( "MITM   Attack:   ICMP   Redirect", GTK_WINDOW ( window ), GTK_DIALOG_MODAL, GTK_STOCK_OK, GTK_RESPONSE_OK, GTK_STOCK_CANCEL, GTK_RESPONSE_CANCEL, NULL ) ; gtk_container_set_border_width ( GTK_CONTAINER ( dialog ), 5 ) ; gtk_dialog_set_has_separator ( GTK_DIALOG ( dialog ), FALSE ) ; hbox = gtk_hbox_new ( FALSE, 5 ) ; gtk_box_pack_start ( GTK_BOX ( GTK_DIALOG ( dialog ) -> vbox ), hbox, FALSE, FALSE, 0 ) ; gtk_widget_show ( hbox ) ; image = gtk_image_new_from_stock ( GTK_STOCK_DIALOG_QUESTION, GTK_ICON_SIZE_DIALOG ) ; gtk_misc_set_alignment ( GTK_MISC ( image ), 0.5, 0.1 ) ; gtk_box_pack_start ( GTK_BOX ( hbox ), image, FALSE, FALSE, 5 ) ; gtk_widget_show ( image ) ; frame = gtk_frame_new ( "Gateway   Information" ) ; gtk_container_set_border_width ( GTK_CONTAINER ( frame ), 5 ) ; gtk_box_pack_start ( GTK_BOX ( hbox ), frame, TRUE, TRUE, 0 ) ; gtk_widget_show ( frame ) ; table = gtk_table_new ( 2, 2, FALSE ) ; gtk_table_set_row_spacings ( GTK_TABLE ( table ), 5 ) ; gtk_table_set_col_spacings ( GTK_TABLE ( table ), 5 ) ; gtk_container_set_border_width ( GTK_CONTAINER ( table ), 8 ) ; gtk_container_add ( GTK_CONTAINER ( frame )

Fix:
<S2SV_ModStart> ) ), ETH_ASCII_ADDR_LEN <S2SV_ModEnd> ) ; strncat <S2SV_ModStart>, "//", 1 <S2SV_ModEnd> ) ; strncat <S2SV_ModStart> ) ), IP6_ASCII_ADDR_LEN <S2SV_ModEnd> ) ; gtkui_start_mitm
Buggy code:
 static gboolean is_link_trusted ( NautilusFile * file, gboolean is_launcher ) { GFile * location ; gboolean res ; <START_BUG> if (! is_launcher ) <END_BUG> { return TRUE ; }  if ( nautilus_file_can_execute ( file ) ) <START_BUG> { return TRUE ; } res = FALSE ; if ( nautilus_file_is_local ( file ) ) { location = nautilus_file_get_location ( file ) ; res = nautilus_is_in_system_dir ( location ) ; g_object_unref ( location ) ; } return res ; }<END_BUG>

Fix:
<S2SV_ModStart> gboolean res ; g_autofree gchar * trusted = NULL ; <S2SV_ModStart> TRUE ; } trusted = nautilus_file_get_metadata ( file, NAUTILUS_METADATA_KEY_DESKTOP_FILE_TRUSTED, NULL ) ; <S2SV_ModStart> ( file ) && trusted!= NULL
Buggy code:
 static int traceLogDirective ( MaState * state, cchar * key, cchar * value ) { HttpRoute * route ; char * format, * option, * ovalue, * tok, * path, * formatter ; ssize size ; int flags, backup, level ; route = state -> route ; size = MAXINT ; backup = 0 ; flags = 0 ; path = 0 ; format = ME_HTTP_LOG_FORMAT ; formatter = "detail" ; level = 0 ; if ( route -> trace -> flags & MPR_LOG_CMDLINE ) { mprLog ( "info   appweb   config", 4, "Already   tracing.   Ignoring   TraceLog   directive" ) ; return 0 ; } for ( option = maGetNextArg ( sclone ( value ), & tok ) ; option ; option = maGetNextArg ( tok, & tok ) ) { if (! path ) { path = sclone ( option ) ; } else { <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if ( smatch ( option, "anew" ) ) { flags |= MPR_LOG_ANEW ; } else if ( smatch ( option, "backup" ) ) { backup = atoi ( ovalue ) ; } else if ( smatch ( option, "format" ) ) { format = ovalue ; } else if ( smatch ( option, "level" ) ) { level = ( int ) stoi ( ovalue ) ; } else if ( smatch ( option, "size" ) ) { size = ( ssize ) getnum ( ovalue ) ; } else if ( smatch ( option, "formatter" ) ) { formatter = ovalue ; } else { mprLog ( "error   appweb   config", 0, "Unknown   TraceLog   option   %s", option ) ; } } } if ( size < HTTP_TRACE_MIN_LOG_SIZE ) { size = HTTP_TRACE_MIN_LOG_SIZE ; } if ( path == 0 ) { mprLog ( "error   appweb   config", 0, "Missing   TraceLog   filename" ) ; return MPR_ERR_BAD_SYNTAX ; } if ( formatter ) { http

Fix:
<S2SV_ModStart> { option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 generic_ret * modify_policy_2_svc ( mpol_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } prime_arg = arg -> rec. policy ; if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_MODIFY, NULL, NULL ) ) { log_unauth ( "kadm5_modify_policy", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_MODIFY ; } else { ret. code = kadm5_modify_policy ( ( void * ) handle, & arg -> rec, arg -> mask ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_modify_policy", ( ( prime_arg == NULL )? "(null)" : prime_arg ), errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; }  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_release_buffer ( & minor_stat, & service_name ) ; exit_func : free_server_handle ( handle ) ; return & ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 error_t ftpClientParsePwdReply ( FtpClientContext * context, char_t * path, size_t maxLen ) { size_t length ; char_t * p ; p = strrchr ( context -> buffer, \'\\"\' ) ; if ( p == NULL ) return ERROR_INVALID_SYNTAX ; * p = '\\0' ; <START_BUG> p = strchr ( context -> buffer, \'\\"\' ) ; <END_BUG> if ( p == NULL ) return ERROR_INVALID_SYNTAX ; length = osStrlen ( p + 1 ) ; length = MIN ( length, maxLen ) ; osStrncpy ( path, p + 1, length ) ; path [ length ] = '\\0' ; return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; p = osStrchr <S2SV_ModEnd> ( context ->
Buggy code:
 void luaC_barrier_ ( lua_State * L, GCObject * o, GCObject * v ) { global_State * g = G ( L ) ; lua_assert ( isblack ( o ) && iswhite ( v ) &&! isdead ( g, v ) &&! isdead ( g, o ) ) ; if ( keepinvariant ( g ) ) { reallymarkobject ( g, v ) ; if ( isold ( o ) ) { lua_assert (! isold ( v ) ) ; setage ( v, G_OLD0 ) ; } } else { lua_assert ( issweepphase ( g ) ) ; <START_BUG> makewhite ( g, o ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> ) ) ; if ( g -> gckind == KGC_INC )
Buggy code:
 <START_BUG> static void dist_block ( int plane, int block, TX_SIZE tx_size, <END_BUG>  struct rdcost_block_args * args ) { <START_BUG> <END_BUG> const int ss_txfrm_size = tx_size << 1 ;  MACROBLOCK * const x = args -> x ; MACROBLOCKD * const xd = & x -> e_mbd ; const struct macroblock_plane * const p = & x -> plane [ plane ] ; const struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; int64_t this_sse ; int shift = tx_size == TX_32X32? 0 : 2 ; <START_BUG> int16_t * const coeff = BLOCK_OFFSET ( p -> coeff, block ) ; <END_BUG>  int16_t * const dqcoeff = BLOCK_OFFSET ( pd -> dqcoeff, block ) ; <START_BUG> <END_BUG> args -> dist = vp9_block_error ( coeff, dqcoeff, 16 << ss_txfrm_size,  <START_BUG> & this_sse ) >> shift ; <END_BUG> args -> sse = this_sse >> shift ; if ( x -> skip_encode &&! is_inter_block ( & xd -> mi [ 0 ] -> mbmi ) ) { int64_t p = ( pd -> dequant [ 1 ] * pd -> dequant [ 1 ] *  ( 1 << ss_txfrm_size ) ) >> ( shift + 2 ) ; <START_BUG> args -> dist += ( p >> 4 ) ; <END_BUG> args -> sse += p ;  } }

Fix:
<S2SV_ModStart> void dist_block ( MACROBLOCK * x, <S2SV_ModStart> TX_SIZE tx_size, int64_t * out_dist, int64_t * out_sse <S2SV_ModEnd> ) { const <S2SV_ModStart> tx_size << 1 <S2SV_ModEnd> ; MACROBLOCKD * <S2SV_ModStart> : 2 ; tran_low_t <S2SV_ModEnd> * const coeff <S2SV_ModStart> block ) ; tran_low_t <S2SV_ModEnd> * const dqcoeff <S2SV_ModStart> block ) ; # if CONFIG_VP9_HIGHBITDEPTH const int bd = ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH )? xd -> bd : 8 ; * out_dist = vp9_highbd_block_error <S2SV_ModEnd> ( coeff, <S2SV_ModStart>, & this_sse, bd ) >> shift ; # else * out_dist = vp9_block_error ( coeff, dqcoeff, 16 << ss_txfrm_size, & this_sse ) >> shift ; # endif * out_sse <S2SV_ModEnd> = this_sse >> <S2SV_ModStart> ) ) >> # if CONFIG_VP9_HIGHBITDEPTH <S2SV_ModStart> shift + 2 + ( bd - 8 ) * 2 ) ; # else ( shift + 2 ) ; # endif * out_dist <S2SV_ModEnd> +
Buggy code:
 uint8_t ethereum_extractThorchainData ( const EthereumSignTx * msg, char * buffer ) { uint16_t offset = 4 + ( 5 * 32 ) ; int16_t len = msg -> data_length - offset ; <START_BUG> if ( msg -> has_data_length && len > 0 ) { <END_BUG> memcpy ( buffer, msg -> data_initial_chunk. bytes + offset, len ) ;  return len < 256? ( uint8_t ) len : 0 ; <START_BUG> } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> len > 0 && len < 256 <S2SV_ModStart> ) ; return <S2SV_ModEnd> ( uint8_t ) <S2SV_ModStart> uint8_t ) len <S2SV_ModEnd> ; } return
Buggy code:
 static int perf_event_read_group ( struct perf_event * event, u64 read_format, char __user * buf ) { struct perf_event * leader = event -> group_leader, * sub ; <START_BUG> int n = 0, size = 0, ret = - EFAULT ; <END_BUG>  struct perf_event_context * ctx = leader -> ctx ; <START_BUG> u64 values [ 5 ] ; u64 count, enabled, running ; mutex_lock ( & ctx -> mutex ) ; count = perf_event_read_value ( leader, & enabled, & running ) ; values [ n ++ ] = 1 + leader -> nr_siblings ; if ( read_format & PERF_FORMAT_TOTAL_TIME_ENABLED ) values [ n ++ ] = enabled ; if ( read_format & PERF_FORMAT_TOTAL_TIME_RUNNING ) values [ n ++ ] = running ; values [ n ++ ] = count ; if ( read_format & PERF_FORMAT_ID ) values [ n ++ ] = primary_event_id ( leader ) ; size = n * sizeof ( u64 ) ; if ( copy_to_user ( buf, values, size ) ) goto unlock ; ret = size ; list_for_each_entry ( sub, & leader -> sibling_list, group_entry ) { n = 0 ; values [ n ++ ] = perf_event_read_value ( sub, & enabled, & running ) ; if ( read_format & PERF_FORMAT_ID ) values [ n ++ ] = primary_event_id ( sub ) ; size = n * sizeof ( u64 ) ; if ( copy_to_user ( buf + ret, values, size ) ) { <END_BUG> ret = - EFAULT ;  <START_BUG> goto unlock ; <END_BUG> } ret += size ; }  unlock : <START_BUG> mutex_unlock ( & ctx -> mutex ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> * sub ; struct perf_event_context * ctx = leader -> ctx ; <S2SV_ModStart> 0, ret ; u64 count, enabled, running ; u64 values [ 5 ] ; lockdep_assert_held ( & ctx -> mutex ) ; count = perf_event_read_value ( leader, & enabled, & running ) ; values [ n ++ ] = 1 + leader -> nr_siblings ; if ( read_format & PERF_FORMAT_TOTAL_TIME_ENABLED ) values [ n ++ ] = enabled ; if ( read_format & PERF_FORMAT_TOTAL_TIME_RUNNING ) values [ n ++ ] = running ; values [ n ++ ] = count ; if ( read_format & PERF_FORMAT_ID ) values [ n ++ ] = primary_event_id ( leader ) ; size = n * sizeof ( u64 ) ; if ( copy_to_user ( buf, values, size ) ) return <S2SV_ModEnd> - EFAULT ; <S2SV_ModStart> - EFAULT ; <S2SV_ModEnd> ret = size <S2SV_ModStart> ) ) { return <S2SV_ModEnd> - EFAULT ; <S2SV_ModStart> - EFAULT ; <S2SV_ModEnd> } ret += <S2SV_ModStart> size ; } <S2SV_ModEnd> return ret ;
Buggy code:
 static void ubik_print ( netdissect_options * ndo, register const u_char * bp ) { int ubik_op ; int32_t temp ; ubik_op = EXTRACT_32BITS ( bp + sizeof ( struct rx_header ) ) ; ND_PRINT ( ( ndo, "   ubik   call   %s", tok2str ( ubik_req, "op#%d", ubik_op ) ) ) ; bp += sizeof ( struct rx_header ) + 4 ; switch ( ubik_op ) { case 10000 : ND_TCHECK2 ( bp [ 0 ], 4 ) ; temp = EXTRACT_32BITS ( bp ) ; bp += sizeof ( int32_t ) ; ND_PRINT ( ( ndo, "   syncsite   %s", temp? "yes" : "no" ) ) ; ND_PRINT ( ( ndo, "   votestart" ) ) ; DATEOUT ( ) ; ND_PRINT ( ( ndo, "   dbversion" ) ) ; UBIK_VERSIONOUT ( ) ; ND_PRINT ( ( ndo, "   tid" ) ) ; UBIK_VERSIONOUT ( ) ; break ; case 10003 : ND_PRINT ( ( ndo, "   site" ) ) ; UINTOUT ( ) ; break ; case 20000 : case 20001 : case 20007 : case 20008 : case 20010 : ND_PRINT ( ( ndo, "   tid" ) ) ; UBIK_VERSIONOUT ( ) ; break ; case 20002 : ND_PRINT ( ( ndo, "   tid" ) ) ; UBIK_VERSIONOUT ( ) ; ND_PRINT ( ( ndo, "   file" ) ) ; INTOUT ( ) ; ND_PRINT ( ( ndo, "   pos" ) ) ; INTOUT ( ) ; ND_PRINT ( ( ndo, "   length" ) ) ; INTOUT ( ) ; <START_BUG> temp = EXTRACT_32BITS ( bp ) ; <END_BUG> bp += sizeof ( int32_t ) ; tok2str ( ubik_lock_types, "type   %d", temp ) ; break ; case 20003 : ND_PRINT ( ( ndo, "   tid" ) ) ; UBIK_VERSIONOUT

Fix:
<S2SV_ModStart> ( ) ; ND_TCHECK_32BITS ( bp ) ;
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8_get_frame_corrupted ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctrl_id, va_list args ) { int * corrupted = va_arg ( args, int * ) ; VP8D_COMP * pbi = ( VP8D_COMP * ) ctx -> yv12_frame_buffers. pbi [ 0 ] ; if ( corrupted && pbi ) {  * corrupted = pbi -> common. frame_to_show -> corrupted ; <START_BUG> return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; }<END_BUG>

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args <S2SV_ModStart> pbi ) { const YV12_BUFFER_CONFIG * const frame <S2SV_ModEnd> = pbi -> <S2SV_ModStart> common. frame_to_show ; if ( frame == NULL ) return VPX_CODEC_ERROR ; * corrupted = frame
Buggy code:
 void imap_quote_string ( char * dest, size_t dlen, const char * src, bool quote_backtick ) { const char * quote = "`\\"\\\\" ; if (! quote_backtick ) quote ++ ; char * pt = dest ; const char * s = src ; * pt ++ = \'"\' ; dlen -= 2 ; for ( ; * s && dlen ; s ++ ) { if ( strchr ( quote, * s ) ) { <START_BUG> dlen -= 2 ; <END_BUG> if ( dlen == 0 ) break ; * pt ++ = '\\\\' ; * pt ++ = * s ; } else { * pt ++ = * s ; dlen -- ; } } * pt ++ = \'"\' ; * pt = '\\0' ; }

Fix:
<S2SV_ModStart> ) ) { if ( dlen < 2 ) break ; <S2SV_ModStart> dlen -= 2 <S2SV_ModEnd> ; * pt
Buggy code:
 static asdl_seq * ast_for_suite ( struct compiling * c, const node * n ) { asdl_seq * seq ; stmt_ty s ; int i, total, num, end, pos = 0 ; node * ch ; <START_BUG> REQ ( n, suite ) ; <END_BUG> total = num_stmts ( n ) ; seq = _Py_asdl_seq_new ( total, c -> c_arena ) ; if (! seq ) return NULL ; if ( TYPE ( CHILD ( n, 0 ) ) == simple_stmt ) { n = CHILD ( n, 0 ) ; end = NCH ( n ) - 1 ; if ( TYPE ( CHILD ( n, end - 1 ) ) == SEMI ) end -- ; for ( i = 0 ; i < end ; i += 2 ) { ch = CHILD ( n, i ) ; s = ast_for_stmt ( c, ch ) ; if (! s ) return NULL ; asdl_seq_SET ( seq, pos ++, s ) ; } } else {  for ( i = 2 ; i < ( NCH ( n ) - 1 ) ; i ++ ) { <START_BUG> ch = CHILD ( n, i ) ; REQ ( ch, stmt ) ; num = num_stmts ( ch ) ; if ( num == 1 ) { s = ast_for_stmt ( c, ch ) ; if (! s ) return NULL ; asdl_seq_SET ( seq, pos ++, s ) ; } else { int j ; ch = CHILD ( ch, 0 ) ; REQ ( ch, simple_stmt ) ; for ( j = 0 ; j < NCH ( ch ) ; j += 2 ) { if ( NCH ( CHILD ( ch, j ) ) == 0 ) { assert ( ( j + 1 ) == NCH ( ch ) ) ; break ; } s = ast_for_stmt ( c, CHILD ( ch, j ) ) ; if (! s ) return NULL ; asdl_seq_SET ( seq, pos ++, s ) ; } } } } assert ( pos == seq -> size ) ; return seq ; }<END_BUG>

Fix:
<S2SV_ModStart> * ch ; if ( TYPE ( n )!= func_body_suite ) { <S2SV_ModStart> suite ) ; } <S2SV_ModStart> } else { i = 2 ; if ( TYPE ( CHILD ( n, 1 ) ) == TYPE_COMMENT ) { i += 2 ; REQ ( CHILD ( n, 2 ), NEWLINE ) ; } for ( <S2SV_ModEnd> ; i <
Buggy code:
 static int em_ret_near_imm ( struct x86_emulate_ctxt * ctxt ) { int rc ; <START_BUG> ctxt -> dst. type = OP_REG ; <END_BUG> ctxt -> dst. addr. reg = & ctxt -> _eip ; ctxt -> dst. bytes = ctxt -> op_bytes ;  rc = emulate_pop ( ctxt, & ctxt -> dst. val, ctxt -> op_bytes ) ; <START_BUG> if ( rc!= X86EMUL_CONTINUE ) return rc ; rsp_increment ( ctxt, ctxt -> src. val ) ; return X86EMUL_CONTINUE ; }<END_BUG>

Fix:
<S2SV_ModStart> int rc ; unsigned long eip <S2SV_ModEnd> ; rc = <S2SV_ModStart> ctxt, & eip <S2SV_ModEnd>, ctxt -> <S2SV_ModStart> ctxt -> op_bytes ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; rc = assign_eip_near ( ctxt, eip
Buggy code:
 static UINT serial_process_irp_write ( SERIAL_DEVICE * serial, IRP * irp ) { UINT32 Length ; UINT64 Offset ; <START_BUG> DWORD nbWritten = 0 ; <END_BUG> if ( Stream_GetRemainingLength ( irp -> input ) < 32 ) return ERROR_INVALID_DATA ; Stream_Read_UINT32 ( irp -> input, Length ) ; Stream_Read_UINT64 ( irp -> input, Offset ) ;  Stream_Seek ( irp -> input, 20 ) ; <START_BUG> WLog_Print ( serial -> log, WLOG_DEBUG, "writing   %" PRIu32 "   bytes   to   %s", Length, serial -> device. name ) ; <END_BUG> if ( CommWriteFile ( serial -> hComm, Stream_Pointer ( irp -> input ), Length, & nbWritten, NULL ) )  { irp -> IoStatus = STATUS_SUCCESS ; } else { WLog_Print ( serial -> log, WLOG_DEBUG, "write   failure   to   %s,   nbWritten=%" PRIu32 ",   last-error:   0x%08" PRIX32 "", serial -> device. name, nbWritten, GetLastError ( ) ) ; irp -> IoStatus = _GetLastErrorToIoStatus ( serial ) ; } WLog_Print ( serial -> log, WLOG_DEBUG, "%" PRIu32 "   bytes   written   to   %s", nbWritten, serial -> device. name ) ; Stream_Write_UINT32 ( irp -> output, nbWritten ) ; Stream_Write_UINT8 ( irp -> output, 0 ) ; return CHANNEL_RC_OK ; }

Fix:
<S2SV_ModStart> UINT64 Offset ; void * ptr ; <S2SV_ModStart> Offset ) ; if (! Stream_SafeSeek <S2SV_ModEnd> ( irp -> <S2SV_ModStart>, 20 ) ) return ERROR_INVALID_DATA <S2SV_ModStart> name ) ; ptr = Stream_Pointer ( irp -> input ) ; if (! Stream_SafeSeek ( irp -> input, Length ) ) return ERROR_INVALID_DATA ; <S2SV_ModStart> -> hComm, ptr <S2SV_ModEnd>, Length,