nus-yam/ex-repair huggingface dataset:
Buggy code:
 void SetBackgroundColor ( int par ) { <START_BUG> if ( par == STROKING ) { outpos += sprintf ( outpos, "   0   0   0   0   K" ) ; } <END_BUG>  else { outpos += sprintf ( outpos, "   0   0   0   0   k" ) ; } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> STROKING ) { send ( <S2SV_ModEnd> " <S2SV_blank> 0 <S2SV_blank> 0 <S2SV_blank> 0 <S2SV_blank> 0 <S2SV_blank> K" ) ; <S2SV_ModStart> } else { send ( <S2SV_ModEnd> " <S2SV_blank> 0 <S2SV_blank> 0 <S2SV_blank> 0 <S2SV_blank> 0 <S2SV_blank> k" ) ;
Buggy code:
 static void wdm_in_callback ( struct urb * urb ) { struct wdm_device * desc = urb -> context ; int status = urb -> status ; <START_BUG> spin_lock ( & desc -> iuspin ) ; <END_BUG> clear_bit ( WDM_RESPONDING, & desc -> flags ) ; if ( status ) { switch ( status ) { case - ENOENT : dev_dbg ( & desc -> intf -> dev, "nonzero   urb   status   received:   -ENOENT" ) ; goto skip_error ; case - ECONNRESET : dev_dbg ( & desc -> intf -> dev, "nonzero   urb   status   received:   -ECONNRESET" ) ; goto skip_error ; case - ESHUTDOWN : dev_dbg ( & desc -> intf -> dev, "nonzero   urb   status   received:   -ESHUTDOWN" ) ; goto skip_error ; case - EPIPE : dev_err ( & desc -> intf -> dev, "nonzero   urb   status   received:   -EPIPE\\n" ) ; break ; default : dev_err ( & desc -> intf -> dev, "Unexpected   error   %d\\n", status ) ; break ; } } desc -> rerr = status ;  desc -> reslength = urb -> actual_length ; <START_BUG> <END_BUG> memmove ( desc -> ubuf + desc -> length, desc -> inbuf, desc -> reslength ) ;  desc -> length += desc -> reslength ; skip_error : wake_up ( & desc -> wait ) ; set_bit ( WDM_READ, & desc -> flags ) ; spin_unlock ( & desc -> iuspin ) ; }

Fix:
<S2SV_ModStart> -> status ; int length = urb -> actual_length ; <S2SV_ModStart> = status ; if ( length + desc -> length > desc -> wMaxCommand ) { set_bit ( WDM_OVERFLOW, & desc -> flags ) ; } else { if (! test_bit ( WDM_OVERFLOW, & desc -> flags ) ) { <S2SV_ModEnd> memmove ( desc <S2SV_ModStart> -> inbuf, length ) ; desc -> length += length ; <S2SV_ModStart> desc -> reslength = length ; } } <S2SV_ModEnd> skip_error : wake_up
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowDCMException ( exception, message ) { if ( info. scale!= ( Quantum * ) NULL ) info. scale = ( Quantum * ) RelinquishMagickMemory ( info. scale ) ; if ( data!= ( unsigned char * ) NULL ) data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; if ( graymap!= ( int * ) NULL ) graymap = ( int * ) RelinquishMagickMemory ( graymap ) ; if ( bluemap!= ( int * ) NULL ) bluemap = ( int * ) RelinquishMagickMemory ( bluemap ) ; if ( greenmap!= ( int * ) NULL ) greenmap = ( int * ) RelinquishMagickMemory ( greenmap ) ; if ( redmap!= ( int * ) NULL ) redmap = ( int * ) RelinquishMagickMemory ( redmap ) ; if ( stream_info -> offsets!= ( ssize_t * ) NULL ) stream_info -> offsets = ( ssize_t * ) RelinquishMagickMemory ( stream_info -> offsets ) ; if ( stream_info!= ( DCMStreamInfo * ) NULL ) stream_info = ( DCMStreamInfo * ) RelinquishMagickMemory ( stream_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char explicit_vr [ MagickPathExtent ], implicit_vr [ MagickPathExtent ], magick [ MagickPathExtent ], photometric [ MagickPathExtent ] ; DCMInfo info ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, * redmap ; MagickBooleanType explicit_file, explicit_retry, use_explicit ; MagickOffsetType offset ; register unsigned char * p ; register ssize_t i ; size_t colors, height, length, number_scenes, quantum, status, width ; ssize_t count, scene ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( info <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char explicit_vr [ <S2SV_ModStart> break ; } if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 int do_mathemu ( struct pt_regs * regs, struct task_struct * fpt ) { int i ; int retcode = 0 ; unsigned long insn ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> # ifdef DEBUG_MATHEMU printk ( "In   do_mathemu()...   pc   is   %08lx\\n", regs -> pc ) ; printk ( "fpqdepth   is   %ld\\n", fpt -> thread. fpqdepth ) ; for ( i = 0 ; i < fpt -> thread. fpqdepth ; i ++ ) printk ( "%d:   %08lx   at   %08lx\\n", i, fpt -> thread. fpqueue [ i ]. insn, ( unsigned long ) fpt -> thread. fpqueue [ i ]. insn_addr ) ; # endif if ( fpt -> thread. fpqdepth == 0 ) { # ifdef DEBUG_MATHEMU printk ( "precise   trap   at   %08lx\\n", regs -> pc ) ; # endif if (! get_user ( insn, ( u32 __user * ) regs -> pc ) ) { retcode = do_one_mathemu ( insn, & fpt -> thread. fsr, fpt -> thread. float_regs ) ; if ( retcode ) { regs -> pc = regs -> npc ; regs -> npc += 4 ; } } return retcode ; } for ( i = 0 ; i < fpt -> thread. fpqdepth ; i ++ ) { retcode = do_one_mathemu ( fpt -> thread. fpqueue [ i ]. insn, & ( fpt -> thread. fsr ), fpt -> thread. float_regs ) ; if (! retcode ) break ; } if ( retcode ) fpt -> thread. fsr &= ~ ( 0x3000 | FSR_CEXC_MASK ) ; else fpt -> thread. fsr &= ~ 0x3000 ; fpt -> thread. fpqdepth = 0 ; return retcode ; }

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 void put_filp ( struct file * file ) { if ( atomic_long_dec_and_test ( & file -> f_count ) ) { security_file_free ( file ) ; <START_BUG> file_sb_list_del ( file ) ; <END_BUG> file_free ( file ) ; } }

Fix:
<S2SV_ModStart> file ) ; <S2SV_ModEnd> file_free ( file
Buggy code:
 int __fsnotify_parent ( const struct path * path, struct dentry * dentry, __u32 mask ) { struct dentry * parent ; struct inode * p_inode ; int ret = 0 ; if (! dentry ) dentry = path -> dentry ; if (! ( dentry -> d_flags & DCACHE_FSNOTIFY_PARENT_WATCHED ) ) return 0 ; parent = dget_parent ( dentry ) ; p_inode = parent -> d_inode ; if ( unlikely (! fsnotify_inode_watches_children ( p_inode ) ) ) __fsnotify_update_child_dentry_flags ( p_inode ) ; else if ( p_inode -> i_fsnotify_mask & mask ) { <START_BUG> mask |= FS_EVENT_ON_CHILD ; <END_BUG>  if ( path ) <START_BUG> ret = fsnotify ( p_inode, mask, path, FSNOTIFY_EVENT_PATH, <END_BUG> dentry -> d_name. name, 0 ) ;  else ret = fsnotify ( p_inode, mask, dentry -> d_inode, FSNOTIFY_EVENT_INODE, <START_BUG> dentry -> d_name. name, 0 ) ; <END_BUG> } dput ( parent ) ; return ret ; }

Fix:
<S2SV_ModStart> mask ) { struct name_snapshot name ; <S2SV_ModStart> |= FS_EVENT_ON_CHILD ; take_dentry_name_snapshot ( & name, dentry ) ; <S2SV_ModStart>, FSNOTIFY_EVENT_PATH, name <S2SV_ModEnd>. name, <S2SV_ModStart>, FSNOTIFY_EVENT_INODE, name <S2SV_ModEnd>. name, <S2SV_ModStart> name, 0 ) ; release_dentry_name_snapshot ( & name
Buggy code:
 int xfs_attr_rmtval_get ( struct xfs_da_args * args ) { struct xfs_bmbt_irec map [ ATTR_RMTVALUE_MAPSIZE ] ; struct xfs_mount * mp = args -> dp -> i_mount ; struct xfs_buf * bp ; xfs_dablk_t lblkno = args -> rmtblkno ; __uint8_t * dst = args -> value ; <START_BUG> int valuelen = args -> valuelen ; <END_BUG> int nmap ; int error ; int blkcnt = args -> rmtblkcnt ; int i ; int offset = 0 ; trace_xfs_attr_rmtval_get ( args ) ;  ASSERT (! ( args -> flags & ATTR_KERNOVAL ) ) ; <START_BUG> while ( valuelen > 0 ) { nmap = ATTR_RMTVALUE_MAPSIZE ; error = xfs_bmapi_read ( args -> dp, ( xfs_fileoff_t ) lblkno, blkcnt, map, & nmap, XFS_BMAPI_ATTRFORK ) ; if ( error ) return error ; ASSERT ( nmap >= 1 ) ; for ( i = 0 ; ( i < nmap ) && ( valuelen > 0 ) ; i ++ ) { xfs_daddr_t dblkno ; int dblkcnt ; ASSERT ( ( map [ i ]. br_startblock!= DELAYSTARTBLOCK ) && ( map [ i ]. br_startblock!= HOLESTARTBLOCK ) ) ; dblkno = XFS_FSB_TO_DADDR ( mp, map [ i ]. br_startblock ) ; dblkcnt = XFS_FSB_TO_BB ( mp, map [ i ]. br_blockcount ) ; error = xfs_trans_read_buf ( mp, NULL, mp -> m_ddev_targp, dblkno, dblkcnt, 0, & bp, & xfs_attr3_rmt_buf_ops ) ; if ( error ) return error ; error = xfs_attr_rmtval_copyout ( mp, bp, args -> dp -> i_ino, & offset, & valuelen, & dst ) ; xfs_buf_<END_BUG>

Fix:
<S2SV_ModStart> ; int valuelen <S2SV_ModEnd> ; int nmap <S2SV_ModStart> ATTR_KERNOVAL ) ) ; ASSERT ( args -> rmtvaluelen == args -> valuelen ) ; valuelen = args -> rmtvaluelen
Buggy code:
 void SWFShape_setLeftFillStyle ( SWFShape shape, SWFFillStyle fill ) { ShapeRecord record ; int idx ; if ( shape -> isEnded || shape -> isMorph ) return ; if ( fill == NOFILL ) { record = addStyleRecord ( shape ) ; record. record. stateChange -> leftFill = 0 ; record. record. stateChange -> flags |= SWF_SHAPE_FILLSTYLE0FLAG ; return ; } idx = getFillIdx ( shape, fill ) ; if ( idx == 0 ) { SWFFillStyle_addDependency ( fill, ( SWFCharacter ) shape ) ; if ( addFillStyle ( shape, fill ) < 0 ) return ; idx = getFillIdx ( shape, fill ) ; } <START_BUG> record = addStyleRecord ( shape ) ; <END_BUG> record. record. stateChange -> leftFill = idx ; record. record. stateChange -> flags |= SWF_SHAPE_FILLSTYLE0FLAG ; }

Fix:
<S2SV_ModStart> ) ; } else if ( idx >= 255 && shape -> useVersion == SWF_SHAPE1 ) { SWF_error ( "Too <S2SV_blank> many <S2SV_blank> fills <S2SV_blank> for <S2SV_blank> SWFShape <S2SV_blank> V1.\\n" "Use <S2SV_blank> a <S2SV_blank> higher <S2SV_blank> SWFShape <S2SV_blank> version\\n" ) ; }
Buggy code:
 int pam_sm_authenticate ( pam_handle_t * pamh, int flags, int argc, const char * * argv ) { struct passwd * pw = NULL, pw_s ; const char * user = NULL ; cfg_t cfg_st ; cfg_t * cfg = & cfg_st ; char buffer [ BUFSIZE ] ; char * buf = NULL ; char * authfile_dir ; size_t authfile_dir_len ; int pgu_ret, gpn_ret ; int retval = PAM_IGNORE ; device_t * devices = NULL ; unsigned n_devices = 0 ; int openasuser ; int should_free_origin = 0 ; int should_free_appid = 0 ; int should_free_auth_file = 0 ; int should_free_authpending_file = 0 ; parse_cfg ( flags, argc, argv, cfg ) ; if (! cfg -> origin ) { strcpy ( buffer, DEFAULT_ORIGIN_PREFIX ) ; if ( gethostname ( buffer + strlen ( DEFAULT_ORIGIN_PREFIX ), BUFSIZE - strlen ( DEFAULT_ORIGIN_PREFIX ) ) == - 1 ) { DBG ( "Unable   to   get   host   name" ) ; goto done ; } DBG ( "Origin   not   specified,   using   \\"%s\\"", buffer ) ; cfg -> origin = strdup ( buffer ) ; if (! cfg -> origin ) { DBG ( "Unable   to   allocate   memory" ) ; goto done ; } else { should_free_origin = 1 ; } } if (! cfg -> appid ) { DBG ( "Appid   not   specified,   using   the   same   value   of   origin   (%s)", cfg -> origin ) ; cfg -> appid = strdup ( cfg -> origin ) ; if (! cfg -> appid ) { DBG ( "Unable   to   allocate   memory" ) goto done ; } else { should_free_appid = 1 ; } } if ( cfg -> max_devs == 0 ) { DBG ( "Maximum   devices   number   not   set.   Using   default   (%d)", MAX_DEVS ) ; cfg -> max_devs = MAX_DEVS ; } devices = malloc ( sizeof ( device_t ) * cfg -> max_devs ) ; if (!

Fix:
<S2SV_ModStart> O_RDONLY | O_CREAT | O_CLOEXEC | O_NOFOLLOW | O_NOCTTY <S2SV_ModStart> ) ) ; if ( cfg -> is_custom_debug_file ) { fclose ( cfg -> debug_file ) ; }
Buggy code:
 static void perf_event_read_event ( struct perf_event * event, struct task_struct * task ) { struct perf_output_handle handle ; struct perf_sample_data sample ; struct perf_read_event read_event = {. header = {. type = PERF_RECORD_READ,. misc = 0,. size = sizeof ( read_event ) + event -> read_size, },. pid = perf_event_pid ( event, task ),. tid = perf_event_tid ( event, task ), } ; int ret ; perf_event_header__init_id ( & read_event. header, & sample, event ) ; <START_BUG> ret = perf_output_begin ( & handle, event, read_event. header. size, 0, 0 ) ; <END_BUG> if ( ret ) return ; perf_output_put ( & handle, read_event ) ; perf_output_read ( & handle, event ) ; perf_event__output_id_sample ( event, & handle, & sample ) ; perf_output_end ( & handle ) ; }

Fix:
<S2SV_ModStart> size, 0 <S2SV_ModEnd> ) ; if
Buggy code:
 static int ext4_split_extent ( handle_t * handle, struct inode * inode, struct ext4_ext_path * path, struct ext4_map_blocks * map, int split_flag, int flags ) { ext4_lblk_t ee_block ; struct ext4_extent * ex ; unsigned int ee_len, depth ; int err = 0 ; int uninitialized ; int split_flag1, flags1 ; depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; ee_block = le32_to_cpu ( ex -> ee_block ) ; ee_len = ext4_ext_get_actual_len ( ex ) ; uninitialized = ext4_ext_is_uninitialized ( ex ) ; if ( map -> m_lblk + map -> m_len < ee_block + ee_len ) { <START_BUG> split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT? <END_BUG> EXT4_EXT_MAY_ZEROOUT : 0 ; flags1 = flags | EXT4_GET_BLOCKS_PRE_IO ; if ( uninitialized ) split_flag1 |= EXT4_EXT_MARK_UNINIT1 | EXT4_EXT_MARK_UNINIT2 ;  err = ext4_split_extent_at ( handle, inode, path, <START_BUG> map -> m_lblk + map -> m_len, split_flag1, flags1 ) ; if ( err ) goto out ; } ext4_ext_drop_refs ( path ) ; path = ext4_ext_find_extent ( inode, map -> m_lblk, path ) ; if ( IS_ERR ( path ) ) return PTR_ERR ( path ) ; if ( map -> m_lblk >= ee_block ) { <END_BUG> split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT?  EXT4_EXT_MAY_ZEROOUT : 0 ; if ( uninitialized ) split_flag1 |= EXT4_EXT_MARK_UNINIT1 ; if ( split_flag & EXT4_EXT_MARK_UNINIT2 ) split_flag1 |= EXT4_EXT_MARK_UNINIT2 ; err = ext4_split_extent_at ( handle, inode, path, map -> m_lblk, split_

Fix:
<S2SV_ModStart> split_flag & EXT4_EXT_MAY_ZEROOUT <S2SV_ModEnd> ; flags1 = <S2SV_ModStart> | EXT4_EXT_MARK_UNINIT2 ; if ( split_flag & EXT4_EXT_DATA_VALID2 ) split_flag1 |= EXT4_EXT_DATA_VALID1 ; <S2SV_ModStart> = split_flag & ( EXT4_EXT_MAY_ZEROOUT | EXT4_EXT_DATA_VALID2 ) <S2SV_ModEnd> ; if (
Buggy code:
 hsm_com_errno_t hcom_client_init ( OUT p_hsm_com_client_hdl_t * p_hdl, IN char * server_path, IN char * client_path, IN int max_data_len ) { hsm_com_client_hdl_t * hdl = NULL ; hsm_com_errno_t res = HSM_COM_OK ; if ( ( strlen ( server_path ) > ( HSM_COM_SVR_MAX_PATH - 1 ) ) || ( strlen ( server_path ) == 0 ) ) { res = HSM_COM_PATH_ERR ; goto cleanup ; } if ( ( strlen ( client_path ) > ( HSM_COM_SVR_MAX_PATH - 1 ) ) || ( strlen ( client_path ) == 0 ) ) { res = HSM_COM_PATH_ERR ; goto cleanup ; } if ( ( hdl = calloc ( 1, sizeof ( hsm_com_client_hdl_t ) ) ) == NULL ) { res = HSM_COM_NO_MEM ; goto cleanup ; } if ( ( hdl -> scr. scratch = malloc ( max_data_len ) ) == NULL ) { res = HSM_COM_NO_MEM ; goto cleanup ; } if ( ( hdl -> recv_buf = malloc ( max_data_len ) ) == NULL ) { res = HSM_COM_NO_MEM ; goto cleanup ; } if ( ( hdl -> send_buf = malloc ( max_data_len ) ) == NULL ) { res = HSM_COM_NO_MEM ; goto cleanup ; } hdl -> scr. scratch_fill = 0 ; hdl -> scr. scratch_len = max_data_len ; hdl -> buf_len = max_data_len ; hdl -> trans_id = 1 ; strcpy ( hdl -> s_path, server_path ) ; strcpy ( hdl -> c_path, client_path ) ; <START_BUG> hdl -> client_state = HSM_COM_C_STATE_IN ; <END_BUG> * p_hdl = hdl ; return res ; cleanup : if ( hdl ) { if ( hdl -> scr. scratch ) { free ( hdl -> scr. scratch ) ; } if (

Fix:
<S2SV_ModStart> client_path ) ; if ( mkstemp ( hdl -> c_path ) == - 1 ) { res = HSM_COM_PATH_ERR ; goto cleanup ; }
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { AVFilterContext * ctx = inlink -> dst ; LutContext * s = ctx -> priv ; AVFilterLink * outlink = ctx -> outputs [ 0 ] ; AVFrame * out ; uint8_t * inrow, * outrow, * inrow0, * outrow0 ; int i, j, plane, direct = 0 ; if ( av_frame_is_writable ( in ) ) { direct = 1 ; out = in ; } else { out = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; } if ( s -> is_rgb ) { inrow0 = in -> data [ 0 ] ; outrow0 = out -> data [ 0 ] ; for ( i = 0 ; i < in -> height ; i ++ ) { int w = inlink -> w ; const uint8_t ( * tab ) [ 256 ] = ( const uint8_t ( * ) [ 256 ] ) s -> lut ; inrow = inrow0 ; outrow = outrow0 ; for ( j = 0 ; j < w ; j ++ ) { switch ( s -> step ) { case 4 : outrow [ 3 ] = tab [ 3 ] [ inrow [ 3 ] ] ; case 3 : outrow [ 2 ] = tab [ 2 ] [ inrow [ 2 ] ] ; case 2 : outrow [ 1 ] = tab [ 1 ] [ inrow [ 1 ] ] ; default : outrow [ 0 ] = tab [ 0 ] [ inrow [ 0 ] ] ; } outrow += s -> step ; inrow += s -> step ; } inrow0 += in -> linesize [ 0 ] ; outrow0 += out -> linesize [ 0 ] ; } } else { <START_BUG> for ( plane = 0 ; plane < 4 && in -> data [ plane ] ; plane ++ ) { <END_BUG> int vsub = plane == 1 || plane == 2? s -> vsub : 0 ; int hsub = plane == 1 || plane == 2? s -> hsub : 0 ; int h = FF_CEIL_RSHIFT ( inlink -> h, v

Fix:
<S2SV_ModStart> [ plane ] && in -> linesize [ plane ]
Buggy code:
 static fp_info * fp_set_per_packet_inf_from_conv ( umts_fp_conversation_info_t * p_conv_data, tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree _U_ ) { fp_info * fpi ; guint8 tfi, c_t ; int offset = 0, i = 0, j = 0, num_tbs, chan, tb_size, tb_bit_off ; gboolean is_control_frame ; umts_mac_info * macinf ; rlc_info * rlcinf ; guint8 fake_lchid = 0 ; gint * cur_val = NULL ; fpi = wmem_new0 ( wmem_file_scope ( ), fp_info ) ; p_add_proto_data ( wmem_file_scope ( ), pinfo, proto_fp, 0, fpi ) ; fpi -> iface_type = p_conv_data -> iface_type ; fpi -> division = p_conv_data -> division ; fpi -> release = 7 ; fpi -> release_year = 2006 ; fpi -> release_month = 12 ; fpi -> channel = p_conv_data -> channel ; fpi -> dch_crc_present = p_conv_data -> dch_crc_present ; fpi -> link_type = FP_Link_Ethernet ; # if 0 if (! pinfo -> fd -> flags. visited && p_conv_data -> reset_frag ) { fpi -> reset_frag = p_conv_data -> reset_frag ; p_conv_data -> reset_frag = FALSE ; } # endif fpi -> srcport = pinfo -> srcport ; fpi -> destport = pinfo -> destport ; fpi -> com_context_id = p_conv_data -> com_context_id ; if ( pinfo -> link_dir == P2P_DIR_UL ) { fpi -> is_uplink = TRUE ; } else { fpi -> is_uplink = FALSE ; } is_control_frame = tvb_get_guint8 ( tvb, offset ) & 0x01 ; switch ( fpi -> channel ) { case CHANNEL_HSDSCH : fpi -> hsdsch_entity

Fix:
<S2SV_ModStart> ; c_t = ( <S2SV_ModStart>, 4 ) + 1 ) % 0xf <S2SV_ModStart> ] = c_t <S2SV_ModEnd> ; macinf -> <S2SV_ModStart> lchId_type_table [ c_t <S2SV_ModEnd> ] ; rlcinf <S2SV_ModStart> lchId_rlc_map [ c_t <S2SV_ModEnd> ] ; }
Buggy code:
 static void test_iterators ( ) { <START_BUG> json_t * object, * foo, * bar, * baz ; <END_BUG>  void * iter ; <START_BUG> if ( json_object_iter ( NULL ) ) fail ( "able   to   iterate   over   NULL" ) ; if ( json_object_iter_next ( NULL, NULL ) ) fail ( "able   to   increment   an   iterator   on   a   NULL   object" ) ; object = json_object ( ) ; foo = json_string ( "foo" ) ; bar = json_string ( "bar" ) ; baz = json_string ( "baz" ) ; if (! object ||! foo ||! bar ||! bar ) fail ( "unable   to   create   values" ) ; if ( json_object_iter_next ( object, NULL ) ) fail ( "able   to   increment   a   NULL   iterator" ) ; if ( json_object_set ( object, "a", foo ) || json_object_set ( object, "b", bar ) || json_object_set ( object, "c", baz ) ) fail ( "unable   to   populate   object" ) ; iter = json_object_iter ( object ) ; if (! iter ) fail ( "unable   to   get   iterator" ) ; <END_BUG> if ( strcmp ( json_object_iter_key ( iter ), "a" ) )  fail ( "iterating   failed:   wrong   key" ) ; if ( json_object_iter_value ( iter )!= foo ) <START_BUG> fail ( "iterating   failed:   wrong   value" ) ; <END_BUG>  iter = json_object_iter_next ( object, iter ) ; <START_BUG> if (! iter ) fail ( "unable   to   increment   iterator" ) ; if ( strcmp ( json_object_iter_key ( iter ), "b" ) ) <END_BUG> fail ( "iterating   failed:   wrong   key" ) ;  <START_BUG> if ( json_object_iter_value ( iter )!= bar ) <END_BUG> fail ( "iterating   failed:   wrong   value" ) ; iter = json_object_iter_next ( object, iter ) ; if (! iter ) fail ( "unable   to   increment   iterator" ) ; if ( strcmp ( json_object_iter_key ( iter

Fix:
<S2SV_ModStart> ( ) { int i ; <S2SV_ModStart> * baz ; const char * iter_keys [ 3 ] ; int have_key [ 3 ] = { 0, 0, 0 } ; json_t * iter_values [ 3 ] ; <S2SV_ModStart> "unable <S2SV_blank> to <S2SV_blank> get <S2SV_blank> iterator" ) ; iter_keys [ 0 ] = json_object_iter_key ( iter ) ; iter_values [ 0 ] = json_object_iter_value ( iter ) ; iter = json_object_iter_next ( object, iter ) ; if (! iter ) fail ( "unable <S2SV_blank> to <S2SV_blank> increment <S2SV_blank> iterator" ) ; iter_keys [ 1 ] = json_object_iter_key ( iter ) ; iter_values [ 1 ] = json_object_iter_value ( iter ) ; iter = json_object_iter_next ( object, iter ) ; if (! iter ) fail ( "unable <S2SV_blank> to <S2SV_blank> increment <S2SV_blank> iterator" ) ; iter_keys [ 2 ] = json_object_iter_key ( iter ) ; iter_values [ 2 ] = json_object_iter_value ( iter ) ; if ( json_object_iter_next ( object, iter )!= NULL ) fail ( "
Buggy code:
 static void xsltCompileLocationPathPattern ( xsltParserContextPtr ctxt, int novar ) { SKIP_BLANKS ; if ( ( CUR == '//' ) && ( NXT ( 1 ) == '//' ) ) { NEXT ; NEXT ; ctxt -> comp -> priority = 0.5 ; xsltCompileRelativePathPattern ( ctxt, NULL, novar ) ; } else if ( CUR == '//' ) { NEXT ; SKIP_BLANKS ; PUSH ( XSLT_OP_ROOT, NULL, NULL, novar ) ; if ( ( CUR!= 0 ) && ( CUR!= '|' ) ) { PUSH ( XSLT_OP_PARENT, NULL, NULL, novar ) ; xsltCompileRelativePathPattern ( ctxt, NULL, novar ) ; } } else if ( CUR == '*' ) { xsltCompileRelativePathPattern ( ctxt, NULL, novar ) ; } else if ( CUR == '@' ) { xsltCompileRelativePathPattern ( ctxt, NULL, novar ) ; } else { xmlChar * name ; name = xsltScanNCName ( ctxt ) ; if ( name == NULL ) { xsltTransformError ( NULL, NULL, NULL, "xsltCompileLocationPathPattern   :   Name   expected\\n" ) ; ctxt -> error = 1 ; return ; } SKIP_BLANKS ; if ( ( CUR == '(' ) &&! xmlXPathIsNodeType ( name ) ) { xsltCompileIdKeyPattern ( ctxt, name, 1, novar, 0 ) ; <START_BUG> if ( ( CUR == '//' ) && ( NXT ( 1 ) == '//' ) ) { <END_BUG> PUSH ( XSLT_OP_ANCESTOR, NULL, NULL, novar ) ; NEXT ; NEXT ; SKIP_BLANKS ; xsltCompileRelativePathPattern ( ctxt, NULL, novar ) ; } else if ( CUR == '//' ) { PUSH ( XSLT_OP_PARENT, NULL, NULL, novar ) ; NEXT ; SKIP_BLANKS ; xsltCompileRelativePathPattern ( ctxt, NULL, novar ) ; } return ; } xsltCompileRelativePathPattern ( ctxt, name, novar ) ; } error : return ; }

Fix:
<S2SV_ModStart> ; if ( ctxt -> error ) return ; if (
Buggy code:
 static void perf_remove_from_owner ( struct perf_event * event ) { struct task_struct * owner ; rcu_read_lock ( ) ; owner = ACCESS_ONCE ( event -> owner ) ; smp_read_barrier_depends ( ) ; if ( owner ) { get_task_struct ( owner ) ; } rcu_read_unlock ( ) ; if ( owner ) { <START_BUG> mutex_lock ( & owner -> perf_event_mutex ) ; <END_BUG> if ( event -> owner ) list_del_init ( & event -> owner_entry ) ; mutex_unlock ( & owner -> perf_event_mutex ) ; put_task_struct ( owner ) ; } }

Fix:
<S2SV_ModStart> owner ) { mutex_lock_nested <S2SV_ModEnd> ( & owner <S2SV_ModStart> owner -> perf_event_mutex, SINGLE_DEPTH_NESTING
Buggy code:
 smb_sdrc_t smb2_flush ( smb_request_t * sr ) { <START_BUG> smb_ofile_t * of = NULL ; <END_BUG> uint16_t StructSize ; uint16_t reserved1 ; uint32_t reserved2 ; smb2fid_t smb2fid ; uint32_t status ; int rc = 0 ; rc = smb_mbc_decodef ( & sr -> smb_data, "wwlqq", & StructSize, & reserved1, & reserved2, & smb2fid. persistent, & smb2fid. temporal ) ; if ( rc ) return ( SDRC_ERROR ) ; if ( StructSize!= 24 ) return ( SDRC_ERROR ) ; status = smb2sr_lookup_fid ( sr, & smb2fid ) ; if ( status ) { smb2sr_put_error ( sr, status ) ; return ( SDRC_SUCCESS ) ; }  of = sr -> fid_ofile ; <START_BUG> if ( ( of -> f_node -> flags & NODE_FLAGS_WRITE_THROUGH ) == 0 ) ( void ) smb_fsop_commit ( sr, of -> f_cr, of -> f_node ) ; ( void ) smb_mbc_encodef ( & sr -> reply, "wwl", 4, 0 ) ; return ( SDRC_SUCCESS ) ; }<END_BUG>

Fix:
<S2SV_ModStart> sr ) { <S2SV_ModEnd> uint16_t StructSize ; <S2SV_ModStart> ) ; } smb_ofile_flush ( sr, <S2SV_ModEnd> sr -> fid_ofile <S2SV_ModStart> sr -> fid_ofile <S2SV_ModEnd> ) ; (
Buggy code:
 int propagate_mnt ( struct mount * dest_mnt, struct mountpoint * dest_mp, struct mount * source_mnt, struct hlist_head * tree_list ) { struct mount * m, * n ; int ret = 0 ; user_ns = current -> nsproxy -> mnt_ns -> user_ns ; last_dest = dest_mnt ; <START_BUG> last_source = source_mnt ; <END_BUG> mp = dest_mp ; list = tree_list ; dest_master = dest_mnt -> mnt_master ; for ( n = next_peer ( dest_mnt ) ; n!= dest_mnt ; n = next_peer ( n ) ) { ret = propagate_one ( n ) ; if ( ret ) goto out ; } for ( m = next_group ( dest_mnt, dest_mnt ) ; m ; m = next_group ( m, dest_mnt ) ) { n = m ; do { ret = propagate_one ( n ) ; if ( ret ) goto out ; n = next_peer ( n ) ; } while ( n!= m ) ; } out : read_seqlock_excl ( & mount_lock ) ; hlist_for_each_entry ( n, tree_list, mnt_hash ) { m = n -> mnt_parent ; if ( m -> mnt_master!= dest_mnt -> mnt_master ) CLEAR_MNT_MARK ( m -> mnt_master ) ; } read_sequnlock_excl ( & mount_lock ) ; return ret ; }

Fix:
<S2SV_ModStart> = dest_mnt ; first_source = source_mnt ;
Buggy code:
 int ext4_ext_get_blocks ( handle_t * handle, struct inode * inode, ext4_lblk_t iblock, unsigned int max_blocks, struct buffer_head * bh_result, int flags ) { struct ext4_ext_path * path = NULL ; struct ext4_extent_header * eh ; struct ext4_extent newex, * ex, * last_ex ; ext4_fsblk_t newblock ; int err = 0, depth, ret, cache_type ; unsigned int allocated = 0 ; struct ext4_allocation_request ar ; ext4_io_end_t * io = EXT4_I ( inode ) -> cur_aio_dio ; __clear_bit ( BH_New, & bh_result -> b_state ) ; ext_debug ( "blocks   %u//%u   requested   for   inode   %lu\\n", iblock, max_blocks, inode -> i_ino ) ; cache_type = ext4_ext_in_cache ( inode, iblock, & newex ) ; if ( cache_type ) { if ( cache_type == EXT4_EXT_CACHE_GAP ) { if ( ( flags & EXT4_GET_BLOCKS_CREATE ) == 0 ) { goto out2 ; } } else if ( cache_type == EXT4_EXT_CACHE_EXTENT ) { newblock = iblock - le32_to_cpu ( newex. ee_block ) + ext_pblock ( & newex ) ; allocated = ext4_ext_get_actual_len ( & newex ) - ( iblock - le32_to_cpu ( newex. ee_block ) ) ; goto out ; } else { BUG ( ) ; } } path = ext4_ext_find_extent ( inode, iblock, NULL ) ; if ( IS_ERR ( path ) ) { err = PTR_ERR ( path ) ; path = NULL ; goto out2 ; } depth = ext_depth ( inode ) ; if ( path [ depth ]. p_ext == NULL && depth!= 0 ) { ext4_error ( inode -> i_sb, "bad   extent   address   " "inode:   %lu,   iblock:   %d,   depth:   %d", inode -> i

Fix:
<S2SV_ModStart> ; if ( ( flags & EXT4_GET_BLOCKS_PRE_IO ) ) <S2SV_ModEnd> { if ( <S2SV_ModStart> ) ; } if ( ext4_should_dioread_nolock ( inode ) ) set_buffer_uninit ( bh_result ) ;
Buggy code:
 int ext4_map_blocks ( handle_t * handle, struct inode * inode, struct ext4_map_blocks * map, int flags ) { struct extent_status es ; int retval ; int ret = 0 ; # ifdef ES_AGGRESSIVE_TEST struct ext4_map_blocks orig_map ; memcpy ( & orig_map, map, sizeof ( * map ) ) ; # endif map -> m_flags = 0 ; ext_debug ( "ext4_map_blocks():   inode   %lu,   flag   %d,   max_blocks   %u," "logical   block   %lu\\n", inode -> i_ino, flags, map -> m_len, ( unsigned long ) map -> m_lblk ) ; if ( unlikely ( map -> m_len > INT_MAX ) ) map -> m_len = INT_MAX ; if ( unlikely ( map -> m_lblk >= EXT_MAX_BLOCKS ) ) return - EFSCORRUPTED ; if ( ext4_es_lookup_extent ( inode, map -> m_lblk, & es ) ) { if ( ext4_es_is_written ( & es ) || ext4_es_is_unwritten ( & es ) ) { map -> m_pblk = ext4_es_pblock ( & es ) + map -> m_lblk - es. es_lblk ; map -> m_flags |= ext4_es_is_written ( & es )? EXT4_MAP_MAPPED : EXT4_MAP_UNWRITTEN ; retval = es. es_len - ( map -> m_lblk - es. es_lblk ) ; if ( retval > map -> m_len ) retval = map -> m_len ; map -> m_len = retval ; } else if ( ext4_es_is_delayed ( & es ) || ext4_es_is_hole ( & es ) ) { map -> m_pblk = 0 ; retval = es. es_len - ( map -> m_lblk - es. es_lblk ) ; if ( retval > map -> m_len ) retval = map -> m_len ; map -> m_len = retval ; retval = 0 ; } else { BUG_ON ( 1 ) ; } # ifdef

Fix:
<S2SV_ModStart> return ret ; if ( map -> m_flags & EXT4_MAP_NEW &&! ( map -> m_flags & EXT4_MAP_UNWRITTEN ) &&! ( flags & EXT4_GET_BLOCKS_ZERO ) &&! IS_NOQUOTA ( inode ) && ext4_should_order_data ( inode ) ) { ret = ext4_jbd2_file_inode ( handle, inode ) ; if ( ret ) return ret ; } } return <S2SV_ModEnd> retval ; }
Buggy code:
 int data_on_connection ( int fd, callback_remove_handler remove ) { int nread ; char * network_packet ; char network_line [ 8192 ] ; char * p ; unsigned long id ; char string [ 1024 ] ; unsigned long msg_id = UINT32_MAX ; enum network_protocol version = network_client_get_version ( fd ) ; ioctl ( fd, FIONREAD, & nread ) ; univention_debug ( UV_DEBUG_TRANSFILE, UV_DEBUG_ALL, "new   connection   data   =   %d\\n", nread ) ; if ( nread == 0 ) { univention_debug ( UV_DEBUG_TRANSFILE, UV_DEBUG_PROCESS, "%d   failed,   got   0   close   connection   to   listener   ", fd ) ; close ( fd ) ; FD_CLR ( fd, & readfds ) ; remove ( fd ) ; network_client_dump ( ) ; return 0 ; } if ( nread >= 8192 ) { univention_debug ( UV_DEBUG_TRANSFILE, UV_DEBUG_ERROR, "%d   failed,   more   than   8192   close   connection   to   listener   ", fd ) ; close ( fd ) ; FD_CLR ( fd, & readfds ) ; remove ( fd ) ; return 0 ; } network_packet = malloc ( ( nread + 1 ) * sizeof ( char ) ) ; read ( fd, network_packet, nread ) ; network_packet [ nread ] = '\\0' ; memset ( network_line, 0, 8192 ) ; p = network_packet ; p_sem ( sem_id ) ; while ( get_network_line ( p, network_line ) ) { if ( strlen ( network_line ) > 0 ) { univention_debug ( UV_DEBUG_TRANSFILE, UV_DEBUG_ALL, "line   =   [%s]", network_line ) ; } if (! strncmp ( network_line, "MSGID:   ", strlen ( "MSGID:   " ) ) ) { msg_id = strtoul ( & ( network_line [ strlen ( "MSGID:   " ) ] ), NULL, 10 ) ; p += strlen ( network_line ) ; } else

Fix:
<S2SV_ModStart>!= UINT32_MAX && version > PROTOCOL_UNKNOWN && version < PROTOCOL_3 <S2SV_ModEnd> ) { univention_debug
Buggy code:
 local void process ( char * path ) { int method = - 1 ; size_t len ; struct stat st ; static char * sufs [ ] = { ".z", "-z", "_z", ".Z", ".gz", "-gz", ".zz", "-zz", ".zip", ".ZIP", ".tgz", NULL } ; if ( path == NULL ) { strcpy ( g. inf, "<stdin>" ) ; g. ind = 0 ; g. name = NULL ; g. mtime = g. headis & 2? ( fstat ( g. ind, & st )? time ( NULL ) : st. st_mtime ) : 0 ; len = 0 ; } else { if ( path!= g. inf ) { strncpy ( g. inf, path, sizeof ( g. inf ) ) ; if ( g. inf [ sizeof ( g. inf ) - 1 ] ) bail ( "name   too   long:   ", path ) ; } len = strlen ( g. inf ) ; if ( lstat ( g. inf, & st ) ) { if ( errno == ENOENT && ( g. list || g. decode ) ) { char * * try = sufs ; do { if ( * try == NULL || len + strlen ( * try ) >= sizeof ( g. inf ) ) break ; strcpy ( g. inf + len, * try ++ ) ; errno = 0 ; } while ( lstat ( g. inf, & st ) && errno == ENOENT ) ; } # ifdef EOVERFLOW if ( errno == EOVERFLOW || errno == EFBIG ) bail ( g. inf, "   too   large   --   not   compiled   with   large   file   support" ) ; # endif if ( errno ) { g. inf [ len ] = 0 ; complain ( "%s   does   not   exist   --   skipping", g. inf ) ; return ; } len = strlen ( g. inf ) ; } if ( ( st. st_mode & S_IFMT )!= S_IFREG && ( st. st_mode & S_IFMT )!= S_IFLNK && ( st. st_mode & S_IFMT )!= S_IFDIR ) { complain ( "%s   is   a   special   file   or   device

Fix:
<S2SV_ModStart> char * to = g. inf, * sufx = "" ; size_t pre = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> g. decode ) { if ( <S2SV_ModEnd> ( g. <S2SV_ModStart> NULL ) { pre = justname ( g. inf ) - g. inf ; to = justname ( <S2SV_ModEnd> g. hname <S2SV_ModStart> g. hname ) <S2SV_ModStart> = strlen ( to ) ; } else if ( <S2SV_ModEnd> strcmp ( to <S2SV_ModStart>, ".tgz" ) == 0 ) sufx = ".tar" ; } else sufx = g. sufx ; <S2SV_ModEnd> g. outf <S2SV_ModStart> = MALLOC ( pre + len + strlen ( sufx ) <S2SV_ModEnd> + 1 ) <S2SV_ModStart>. outf, g. inf, pre ) ; memcpy <S2SV_ModEnd> ( g. <S2SV_ModStart>. outf + pre, to, len ) ; strcpy ( g. outf + pre + len, <S2SV_ModEnd> sufx ) ;
Buggy code:
 int hashbin_delete ( hashbin_t * hashbin, FREE_FUNC free_func ) { irda_queue_t * queue ; unsigned long flags = 0 ; int i ; IRDA_ASSERT ( hashbin!= NULL, return - 1 ; ) ; IRDA_ASSERT ( hashbin -> magic == HB_MAGIC, return - 1 ; ) ; <START_BUG> if ( hashbin -> hb_type & HB_LOCK ) { <END_BUG> spin_lock_irqsave_nested ( & hashbin -> hb_spinlock, flags, hashbin_lock_depth ++ ) ; } for ( i = 0 ; i < HASHBIN_SIZE ; i ++ ) {  queue = dequeue_first ( ( irda_queue_t * * ) & hashbin -> hb_queue [ i ] ) ; <START_BUG> <END_BUG> while ( queue ) {  if ( free_func ) <START_BUG> ( * free_func ) ( queue ) ; <END_BUG> queue = dequeue_first ( ( irda_queue_t * * ) & hashbin -> hb_queue [ i ] ) ; } } hashbin -> hb_current = NULL ; hashbin -> magic = ~ HB_MAGIC ;  if ( hashbin -> hb_type & HB_LOCK ) { <START_BUG> spin_unlock_irqrestore ( & hashbin -> hb_spinlock, flags ) ; <END_BUG> # ifdef CONFIG_LOCKDEP  hashbin_lock_depth -- ; # endif } kfree ( hashbin ) ; return 0 ; }

Fix:
<S2SV_ModStart> & HB_LOCK ) spin_lock_irqsave ( & hashbin -> hb_spinlock, flags ) ; <S2SV_ModEnd> for ( i <S2SV_ModStart> ++ ) { while ( 1 ) { <S2SV_ModStart> ] ) ; if (! queue ) break ; <S2SV_ModEnd> if ( free_func <S2SV_ModStart> ( free_func ) { if ( hashbin -> hb_type & HB_LOCK ) spin_unlock_irqrestore ( & hashbin -> hb_spinlock, flags ) ; free_func ( queue ) ; if ( hashbin -> hb_type & HB_LOCK ) spin_lock_irqsave ( & hashbin -> hb_spinlock, flags ) ; } <S2SV_ModEnd> } } hashbin <S2SV_ModStart> & HB_LOCK ) <S2SV_ModEnd> spin_unlock_irqrestore ( & <S2SV_ModStart> flags ) ; <S2SV_ModEnd> kfree ( hashbin
Buggy code:
 static pngquant_error rwpng_read_image24_libpng ( FILE * infile, png24_image * mainprog_ptr, int verbose ) { png_structp png_ptr = NULL ; png_infop info_ptr = NULL ; png_size_t rowbytes ; int color_type, bit_depth ; png_ptr = png_create_read_struct ( PNG_LIBPNG_VER_STRING, mainprog_ptr, rwpng_error_handler, verbose? rwpng_warning_stderr_handler : rwpng_warning_silent_handler ) ; if (! png_ptr ) { return PNG_OUT_OF_MEMORY_ERROR ; } info_ptr = png_create_info_struct ( png_ptr ) ; if (! info_ptr ) { png_destroy_read_struct ( & png_ptr, NULL, NULL ) ; return PNG_OUT_OF_MEMORY_ERROR ; } if ( setjmp ( mainprog_ptr -> jmpbuf ) ) { png_destroy_read_struct ( & png_ptr, & info_ptr, NULL ) ; return LIBPNG_FATAL_ERROR ; } # if defined ( PNG_SKIP_sRGB_CHECK_PROFILE ) && defined ( PNG_SET_OPTION_SUPPORTED ) png_set_option ( png_ptr, PNG_SKIP_sRGB_CHECK_PROFILE, PNG_OPTION_ON ) ; # endif # if PNG_LIBPNG_VER >= 10500 && defined ( PNG_UNKNOWN_CHUNKS_SUPPORTED ) png_set_keep_unknown_chunks ( png_ptr, PNG_HANDLE_CHUNK_IF_SAFE, ( png_const_bytep ) "pHYs\\0iTXt\\0tEXt\\0zTXt", 4 ) ; # endif png_set_read_user_chunk_fn ( png_ptr, & mainprog_ptr -> chunks, read_chunk_callback ) ; struct rwpng_read_data read_data = { infile, 0 } ; png_set_read_fn ( png_ptr, & read_data, user_read_data ) ; png_read_info ( png_ptr, info_ptr ) ; png_get_IHDR ( png_ptr, info_ptr, & mainprog_ptr -> width, & mainprog_ptr -> height, & bit_

Fix:
<S2SV_ModStart> NULL ) ; <S2SV_ModEnd> if (! <S2SV_ModStart> ; if ( rowbytes > INT_MAX // mainprog_ptr -> height ) { png_destroy_read_struct ( & png_ptr, & info_ptr, NULL ) ; return PNG_OUT_OF_MEMORY_ERROR ; } if (
Buggy code:
 void virtio_config_writew ( VirtIODevice * vdev, uint32_t addr, uint32_t data ) { VirtioDeviceClass * k = VIRTIO_DEVICE_GET_CLASS ( vdev ) ; uint16_t val = data ; <START_BUG> if ( addr > ( vdev -> config_len - sizeof ( val ) ) ) <END_BUG> return ; stw_p ( vdev -> config + addr, val ) ; if ( k -> set_config ) { k -> set_config ( vdev, vdev -> config ) ; } }

Fix:
<S2SV_ModStart> if ( addr + <S2SV_ModEnd> sizeof ( val <S2SV_ModStart> ( val ) > vdev -> config_len ) { return ; } <S2SV_ModEnd> stw_p ( vdev
Buggy code:
 static INLINE void fdct32x32 ( int rd_transform, <START_BUG> const int16_t * src, int16_t * dst, int src_stride ) { <END_BUG> if ( rd_transform )  vp9_fdct32x32_rd ( src, dst, src_stride ) ; <START_BUG> else <END_BUG> vp9_fdct32x32 ( src, dst, src_stride ) ;  }

Fix:
<S2SV_ModStart> * src, tran_low_t <S2SV_ModEnd> * dst, <S2SV_ModStart> ( rd_transform ) vpx_fdct32x32_rd <S2SV_ModEnd> ( src, <S2SV_ModStart> ) ; else vpx_fdct32x32 <S2SV_ModEnd> ( src,
Buggy code:
 static Status accept_xsmp_connection ( SmsConn sms_conn, GsmXsmpServer * server, unsigned long * mask_ret, SmsCallbacks * callbacks_ret, char * * failure_reason_ret ) { IceConn ice_conn ; <START_BUG> GsmXSMPClient * client ; <END_BUG> if ( server -> priv -> xsmp_sockets == NULL ) { g_debug ( "GsmXsmpServer:   In   shutdown,   rejecting   new   client" ) ; * failure_reason_ret = strdup ( _ ( "Refusing   new   client   connection   because   the   session   is   currently   being   shut   down\\n" ) ) ; return FALSE ; } ice_conn = SmsGetIceConnection ( sms_conn ) ;  client = ice_conn -> context ; <START_BUG> <END_BUG> g_return_val_if_fail ( client!= NULL, TRUE ) ;  <START_BUG> gsm_xsmp_client_connect ( client, sms_conn, mask_ret, callbacks_ret ) ; <END_BUG> return TRUE ; }

Fix:
<S2SV_ModStart> IceConn ice_conn ; GsmClient * client ; GsmIceConnectionWatch * data <S2SV_ModEnd> ; if ( <S2SV_ModStart> sms_conn ) ; data <S2SV_ModEnd> = ice_conn -> <S2SV_ModStart> -> context ; free_ice_connection_watch ( data ) ; client = gsm_xsmp_client_new ( ice_conn ) ; gsm_store_add ( server -> priv -> client_store, gsm_client_peek_id ( client ), G_OBJECT ( client ) ) ; g_object_unref ( client <S2SV_ModEnd> ) ; gsm_xsmp_client_connect <S2SV_ModStart> ; gsm_xsmp_client_connect ( GSM_XSMP_CLIENT ( client ) <S2SV_ModEnd>, sms_conn,
Buggy code:
 static int handle_vmon ( struct kvm_vcpu * vcpu ) { int ret ; gpa_t vmptr ; struct page * page ; struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX ; <START_BUG> if (! kvm_read_cr4_bits ( vcpu, X86_CR4_VMXE ) ) { <END_BUG> kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 1 ; } if ( vmx -> nested. vmxon ) { nested_vmx_failValid ( vcpu, VMXERR_VMXON_IN_VMX_ROOT_OPERATION ) ; return kvm_skip_emulated_instruction ( vcpu ) ; } if ( ( vmx -> msr_ia32_feature_control & VMXON_NEEDED_FEATURES )!= VMXON_NEEDED_FEATURES ) { kvm_inject_gp ( vcpu, 0 ) ; return 1 ; } if ( nested_vmx_get_vmptr ( vcpu, & vmptr ) ) return 1 ; if (! PAGE_ALIGNED ( vmptr ) || ( vmptr >> cpuid_maxphyaddr ( vcpu ) ) ) { nested_vmx_failInvalid ( vcpu ) ; return kvm_skip_emulated_instruction ( vcpu ) ; } page = kvm_vcpu_gpa_to_page ( vcpu, vmptr ) ; if ( is_error_page ( page ) ) { nested_vmx_failInvalid ( vcpu ) ; return kvm_skip_emulated_instruction ( vcpu ) ; } if ( * ( u32 * ) kmap ( page )!= VMCS12_REVISION ) { kunmap ( page ) ; kvm_release_page_clean ( page ) ; nested_vmx_failInvalid ( vcpu ) ; return kvm_skip_emulated_instruction ( vcpu ) ; } kunmap ( page ) ; kvm_release_page_clean ( page ) ; vmx -> nested. vmxon_ptr = vmptr ; ret = enter

Fix:
<S2SV_ModStart> vcpu, X86_CR4_VMXE ) ) { kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 1 ; } if ( vmx_get_cpl ( vcpu
Buggy code:
 static void ikev2_parent_inI1outR1_continue ( struct pluto_crypto_req_cont * pcrc, struct pluto_crypto_req * r, err_t ugh ) { struct ke_continuation * ke = ( struct ke_continuation * ) pcrc ; struct msg_digest * md = ke -> md ; struct state * const st = md -> st ; stf_status e ; DBG ( DBG_CONTROLMORE, DBG_log ( "ikev2   parent   inI1outR1:   calculated   ke+nonce,   sending   R1" ) ) ; if ( st == NULL ) { loglog ( RC_LOG_SERIOUS, "%s:   Request   was   disconnected   from   state", __FUNCTION__ ) ; if ( ke -> md ) release_md ( ke -> md ) ; return ; } passert ( ugh == NULL ) ; passert ( cur_state == NULL ) ; passert ( st!= NULL ) ; passert ( st -> st_suspended_md == ke -> md ) ; set_suspended ( st, NULL ) ; set_cur_state ( st ) ; st -> st_calculating = FALSE ; e = ikev2_parent_inI1outR1_tail ( pcrc, r ) ; if ( ke -> md!= NULL ) { complete_v2_state_transition ( & ke -> md, e ) ; if ( ke -> md ) release_md ( ke -> md ) ; } reset_globals ( ) ; <START_BUG> passert ( GLOBALS_ARE_RESET ( ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static int get_gate_page ( struct mm_struct * mm, unsigned long address, unsigned int gup_flags, struct vm_area_struct * * vma, struct page * * page ) { pgd_t * pgd ; p4d_t * p4d ; pud_t * pud ; pmd_t * pmd ; pte_t * pte ; int ret = - EFAULT ; if ( gup_flags & FOLL_WRITE ) return - EFAULT ; if ( address > TASK_SIZE ) pgd = pgd_offset_k ( address ) ; else pgd = pgd_offset_gate ( mm, address ) ; BUG_ON ( pgd_none ( * pgd ) ) ; p4d = p4d_offset ( pgd, address ) ; BUG_ON ( p4d_none ( * p4d ) ) ; pud = pud_offset ( p4d, address ) ; BUG_ON ( pud_none ( * pud ) ) ; pmd = pmd_offset ( pud, address ) ; if (! pmd_present ( * pmd ) ) return - EFAULT ; VM_BUG_ON ( pmd_trans_huge ( * pmd ) ) ; pte = pte_offset_map ( pmd, address ) ; if ( pte_none ( * pte ) ) goto unmap ; * vma = get_gate_vma ( mm ) ; if (! page ) goto out ; * page = vm_normal_page ( * vma, address, * pte ) ; if (! * page ) { if ( ( gup_flags & FOLL_DUMP ) ||! is_zero_pfn ( pte_pfn ( * pte ) ) ) goto unmap ; * page = pte_page ( * pte ) ; if ( is_device_public_page ( * page ) ) goto unmap ; } <START_BUG> get_page ( * page ) ; <END_BUG> out : ret = 0 ; unmap : pte_unmap ( pte ) ; return ret ; }

Fix:
<S2SV_ModStart> unmap ; } if ( unlikely (! try_get_page ( * page ) ) ) { ret = - ENOMEM ; goto unmap ; } <S2SV_ModEnd> out : ret
Buggy code:
 static uint8_t * extend_raw_data ( LHAFileHeader * * header, LHAInputStream * stream, size_t nbytes ) { LHAFileHeader * new_header ; size_t new_raw_len ; <START_BUG> uint8_t * result ; <END_BUG> new_raw_len = RAW_DATA_LEN ( header ) + nbytes ; new_header = realloc ( * header, sizeof ( LHAFileHeader ) + new_raw_len ) ; if ( new_header == NULL ) { return NULL ; } * header = new_header ; new_header -> raw_data = ( uint8_t * ) ( new_header + 1 ) ; result = new_header -> raw_data + new_header -> raw_data_len ; if (! lha_input_stream_read ( stream, result, nbytes ) ) { return NULL ; } new_header -> raw_data_len = new_raw_len ; return result ; }

Fix:
<S2SV_ModStart> * result ; if ( nbytes > LEVEL_3_MAX_HEADER_LEN ) { return NULL ; }
Buggy code:
 int snd_ctl_replace ( struct snd_card * card, struct snd_kcontrol * kcontrol, bool add_on_replace ) { <START_BUG> struct snd_ctl_elem_id id ; <END_BUG> unsigned int idx ; struct snd_kcontrol * old ; int ret ; if (! kcontrol ) return - EINVAL ; if ( snd_BUG_ON (! card ||! kcontrol -> info ) ) { ret = - EINVAL ; goto error ; } id = kcontrol -> id ; down_write ( & card -> controls_rwsem ) ; old = snd_ctl_find_id ( card, & id ) ; if (! old ) { if ( add_on_replace ) goto add ; up_write ( & card -> controls_rwsem ) ; ret = - EINVAL ; goto error ; } ret = snd_ctl_remove ( card, old ) ; if ( ret < 0 ) { up_write ( & card -> controls_rwsem ) ; goto error ; } add : if ( snd_ctl_find_hole ( card, kcontrol -> count ) < 0 ) { up_write ( & card -> controls_rwsem ) ; ret = - ENOMEM ; goto error ; } list_add_tail ( & kcontrol -> list, & card -> controls ) ; card -> controls_count += kcontrol -> count ; kcontrol -> id. numid = card -> last_numid + 1 ; card -> last_numid += kcontrol -> count ;  up_write ( & card -> controls_rwsem ) ; <START_BUG> <END_BUG> for ( idx = 0 ; idx < kcontrol -> count ; idx ++, id. index ++, id. numid ++ )  snd_ctl_notify ( card, SNDRV_CTL_EVENT_MASK_ADD, & id ) ; return 0 ; error : snd_ctl_free_one ( kcontrol ) ; return ret ; }

Fix:
<S2SV_ModStart> struct snd_ctl_elem_id id ; unsigned int count <S2SV_ModStart> -> count ; count = kcontrol -> count ; <S2SV_ModStart> ; idx < <S2SV_ModEnd> count ; idx
Buggy code:
 static int raw_cmd_copyin ( int cmd, void __user * param, struct floppy_raw_cmd * * rcmd ) { struct floppy_raw_cmd * ptr ; int ret ; int i ; * rcmd = NULL ; loop : ptr = kmalloc ( sizeof ( struct floppy_raw_cmd ), GFP_USER ) ; if (! ptr ) return - ENOMEM ; * rcmd = ptr ; ret = copy_from_user ( ptr, param, sizeof ( * ptr ) ) ; <START_BUG> if ( ret ) <END_BUG>  return - EFAULT ; <START_BUG> ptr -> next = NULL ; ptr -> buffer_length = 0 ; param += sizeof ( struct floppy_raw_cmd ) ; if ( ptr -> cmd_count > 33 ) return - EINVAL ; for ( i = 0 ; i < 16 ; i ++ ) ptr -> reply [ i ] = 0 ; ptr -> resultcode = 0 ; <END_BUG> ptr -> kernel_data = NULL ;  if ( ptr -> flags & ( FD_RAW_READ | FD_RAW_WRITE ) ) { if ( ptr -> length <= 0 ) return - EINVAL ; ptr -> kernel_data = ( char * ) fd_dma_mem_alloc ( ptr -> length ) ; fallback_on_nodma_alloc ( & ptr -> kernel_data, ptr -> length ) ; if (! ptr -> kernel_data ) return - ENOMEM ; ptr -> buffer_length = ptr -> length ; } if ( ptr -> flags & FD_RAW_WRITE ) { ret = fd_copyin ( ptr -> data, ptr -> kernel_data, ptr -> length ) ; if ( ret ) return ret ; } if ( ptr -> flags & FD_RAW_MORE ) { rcmd = & ( ptr -> next ) ; ptr -> rate &= 0x43 ; goto loop ; } return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; ptr -> next = NULL ; ptr -> buffer_length = 0 ; ptr -> kernel_data = NULL ; <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; param += <S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( ptr
Buggy code:
 static int cp2112_gpio_direction_input ( struct gpio_chip * chip, unsigned offset ) { struct cp2112_device * dev = gpiochip_get_data ( chip ) ; struct hid_device * hdev = dev -> hdev ; u8 * buf = dev -> in_out_buffer ; int ret ; mutex_lock ( & dev -> lock ) ; ret = hid_hw_raw_request ( hdev, CP2112_GPIO_CONFIG, buf, CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, HID_REQ_GET_REPORT ) ; if ( ret!= CP2112_GPIO_CONFIG_LENGTH ) { hid_err ( hdev, "error   requesting   GPIO   config:   %d\\n", ret ) ; goto exit ; } buf [ 1 ] &= ~ ( 1 << offset ) ; buf [ 2 ] = gpio_push_pull ; ret = hid_hw_raw_request ( hdev, CP2112_GPIO_CONFIG, buf, CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, HID_REQ_SET_REPORT ) ; if ( ret < 0 ) { hid_err ( hdev, "error   setting   GPIO   config:   %d\\n", ret ) ; goto exit ; } ret = 0 ; exit : mutex_unlock ( & dev -> lock ) ; <START_BUG> return ret <= 0? ret : - EIO ; <END_BUG> }

Fix:
<S2SV_ModStart> ; return ret < <S2SV_ModEnd> 0? ret
Buggy code:
 void snd_pcm_period_elapsed ( struct snd_pcm_substream * substream ) { struct snd_pcm_runtime * runtime ; unsigned long flags ; if ( PCM_RUNTIME_CHECK ( substream ) ) return ; runtime = substream -> runtime ; snd_pcm_stream_lock_irqsave ( substream, flags ) ; if (! snd_pcm_running ( substream ) || snd_pcm_update_hw_ptr0 ( substream, 1 ) < 0 ) goto _end ; # ifdef CONFIG_SND_PCM_TIMER if ( substream -> timer_running ) snd_timer_interrupt ( substream -> timer, 1 ) ; # endif _end : <START_BUG> snd_pcm_stream_unlock_irqrestore ( substream, flags ) ; <END_BUG> kill_fasync ( & runtime -> fasync, SIGIO, POLL_IN ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> endif _end : <S2SV_ModEnd> kill_fasync ( & <S2SV_ModStart> POLL_IN ) ; snd_pcm_stream_unlock_irqrestore ( substream, flags ) ;
Buggy code:
 int do_set_thread_area ( struct task_struct * p, int idx, struct user_desc __user * u_info, int can_allocate ) { struct user_desc info ; if ( copy_from_user ( & info, u_info, sizeof ( info ) ) ) <START_BUG> return - EFAULT ; <END_BUG> if ( idx == - 1 ) idx = info. entry_number ; if ( idx == - 1 && can_allocate ) { idx = get_free_idx ( ) ; if ( idx < 0 ) return idx ; if ( put_user ( idx, & u_info -> entry_number ) ) return - EFAULT ; } if ( idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX ) return - EINVAL ; set_tls_desc ( p, idx, & info, 1 ) ; return 0 ; }

Fix:
<S2SV_ModStart> return - EFAULT ; if (! tls_desc_okay ( & info ) ) return - EINVAL