nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int directblockRead ( struct READER * reader, struct DATAOBJECT * dataobject, struct FRACTALHEAP * fractalheap ) { char buf [ 4 ], * name, * value ; int size, offset_size, length_size, err, len ; uint8_t typeandversion ; uint64_t unknown, heap_header_address, block_offset, block_size, offset, length ; long store ; struct DIR * dir ; struct MYSOFA_ATTRIBUTE * attr ; UNUSED ( offset ) ; UNUSED ( block_size ) ; UNUSED ( block_offset ) ; <START_BUG> if ( fread ( buf, 1, 4, reader -> fhd )!= 4 || strncmp ( buf, "FHDB", 4 ) ) { <END_BUG> log ( "cannot   read   signature   of   fractal   heap   indirect   block\\n" ) ; return MYSOFA_INVALID_FORMAT ; }  log ( "%08" PRIX64 "   %.4s\\n", ( uint64_t ) ftell ( reader -> fhd ) - 4, buf ) ; <START_BUG> if ( fgetc ( reader -> fhd )!= 0 ) { log ( "object   FHDB   must   have   version   0\\n" ) ; return MYSOFA_UNSUPPORTED_FORMAT ; } if ( fseek ( reader -> fhd, reader -> superblock. size_of_offsets, SEEK_CUR ) < 0 ) return errno ; size = ( fractalheap -> maximum_heap_size + 7 ) // 8 ; block_offset = readValue ( reader, size ) ; if ( fractalheap -> flags & 2 ) if ( fseek ( reader -> fhd, 4, SEEK_CUR ) ) return errno ; offset_size = ceilf ( log2f ( fractalheap -> maximum_heap_size ) // 8 ) ; if ( fractalheap -> maximum_direct_block_size < fractalheap -> maximum_size ) length_size = ceilf ( log2f ( fractalheap -> maximum_direct_block_size ) // 8 ) ; else length_size = ceilf ( log2f ( fractalheap -> maximum_size ) // 8 ) ; log ( "   %d   %" PRIu64 "   %d\\n", size, block<END_BUG>

Fix:
<S2SV_ModStart> ; if ( reader -> recursive_counter >= 10 ) return MYSOFA_INVALID_FORMAT ; else reader -> recursive_counter ++ ; if ( <S2SV_ModStart> ( "%08" PRIX64 " <S2SV_blank> %.4s <S2SV_blank> stack <S2SV_blank> %d\\n" <S2SV_ModEnd>, ( uint64_t <S2SV_ModStart> 4, buf, reader -> recursive_counter <S2SV_ModStart> 0 ) ; reader -> recursive_counter -- ;
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char * pixels ; unsigned long

Fix:
<S2SV_ModStart> NULL ) { status = MagickFalse ; break <S2SV_ModEnd> ; } image
Buggy code:
 static const char * expr_context_name ( expr_context_ty ctx ) { switch ( ctx ) { case Load : return "Load" ; case Store : return "Store" ; case Del : return "Del" ; case AugLoad : return "AugLoad" ; case AugStore : return "AugStore" ; case Param : return "Param" ; default : <START_BUG> assert ( 0 ) ; <END_BUG> return "(unknown)" ; } }

Fix:
<S2SV_ModStart> ; default : abort ( ) <S2SV_ModEnd> ; } }
Buggy code:
 int yr_re_fast_exec ( uint8_t * code, uint8_t * input_data, <START_BUG> size_t input_size, <END_BUG> int flags, RE_MATCH_CALLBACK_FUNC callback, void * callback_args ) { RE_REPEAT_ANY_ARGS * repeat_any_args ; uint8_t * code_stack [ MAX_FAST_RE_STACK ] ; uint8_t * input_stack [ MAX_FAST_RE_STACK ] ; int matches_stack [ MAX_FAST_RE_STACK ] ; uint8_t * ip = code ; uint8_t * input = input_data ; uint8_t * next_input ; uint8_t * next_opcode ; uint8_t mask ; uint8_t value ; int i ; int stop ; int input_incr ; int sp = 0 ; int bytes_matched ;  int max_bytes_matched = input_size ; <START_BUG> input_incr = flags & RE_FLAGS_BACKWARDS? - 1 : 1 ; if ( flags & RE_FLAGS_BACKWARDS ) input -- ; code_stack [ sp ] = code ; input_stack [ sp ] = input ; matches_stack [ sp ] = 0 ; sp ++ ; while ( sp > 0 ) { sp -- ; ip = code_stack [ sp ] ; input = input_stack [ sp ] ; bytes_matched = matches_stack [ sp ] ; stop = FALSE ; while (! stop ) { if ( * ip == RE_OPCODE_MATCH ) { if ( flags & RE_FLAGS_EXHAUSTIVE ) { int cb_result = callback ( flags & RE_FLAGS_BACKWARDS? input + 1 : input_data, bytes_matched, flags, callback_args ) ; switch ( cb_result ) { case ERROR_INSUFFICIENT_MEMORY : return - 2 ; case ERROR_TOO_MANY_MATCHES : return - 3 ; default : if ( cb_result!= ERROR_SUCCESS ) return - 4 ; } break ; } else { return bytes_matched ; } } if ( bytes_matched >= max_bytes_matched ) break ; switch ( * ip ) { case RE_OPCODE_LITERAL : if ( * input == * ( ip + 1 ) ) { bytes_matched ++ ; input += input_incr<END_BUG>

Fix:
<S2SV_ModStart> input_data, size_t input_forwards_size, size_t input_backwards_size <S2SV_ModEnd>, int flags <S2SV_ModStart> ; int max_bytes_matched ; max_bytes_matched = flags & RE_FLAGS_BACKWARDS? input_backwards_size : input_forwards_size <S2SV_ModEnd> ; input_incr =
Buggy code:
 <START_BUG> static int decode_coefs ( VP9_COMMON * cm, const MACROBLOCKD * xd, PLANE_TYPE type, <END_BUG>  int16_t * dqcoeff, TX_SIZE tx_size, const int16_t * dq, <START_BUG> int ctx, const int16_t * scan, const int16_t * nb, <END_BUG> vp9_reader * r ) {  const int max_eob = 16 << ( tx_size << 1 ) ; <START_BUG> const FRAME_CONTEXT * const fc = & cm -> fc ; <END_BUG> FRAME_COUNTS * const counts = & cm -> counts ; const int ref = is_inter_block ( & xd -> mi [ 0 ] -> mbmi ) ; int band, c = 0 ;  const vp9_prob ( * coef_probs ) [ COEFF_CONTEXTS ] [ UNCONSTRAINED_NODES ] = <START_BUG> fc -> coef_probs [ tx_size ] [ type ] [ ref ] ; <END_BUG> const vp9_prob * prob ;  <START_BUG> unsigned int ( * coef_counts ) [ COEFF_CONTEXTS ] [ UNCONSTRAINED_NODES + 1 ] = <END_BUG> counts -> coef [ tx_size ] [ type ] [ ref ] ;  unsigned int ( * eob_branch_count ) [ COEFF_CONTEXTS ] = <START_BUG> counts -> eob_branch [ tx_size ] [ type ] [ ref ] ; <END_BUG> uint8_t token_cache [ 32 * 32 ] ;  const uint8_t * cat6 ; const uint8_t * band_translate = get_band_translate ( tx_size ) ; const int dq_shift = ( tx_size == TX_32X32 ) ; int v ; int16_t dqv = dq [ 0 ] ; while ( c < max_eob ) { <START_BUG> int val ; <END_BUG> band = * band_translate ++ ; prob = coef_probs [ band ] [ ctx ] ;  if (! cm -> frame_parallel_decoding_mode ) <START_BUG> ++ eob_branch_count [ band ] [ ctx ] ; <END_BUG> if (! vp9_read ( r, prob [ EOB_CONTEXT_NODE ] ) ) {  INCREMENT_COUNT ( EOB_MODEL_TOKEN ) ; break ; } <START_BUG> while (! vp9_read ( r, prob [ ZERO_CONTEXT_NODE ] ) )<END_BUG>

Fix:
<S2SV_ModStart> int decode_coefs ( <S2SV_ModEnd> const MACROBLOCKD * <S2SV_ModStart> PLANE_TYPE type, tran_low_t <S2SV_ModEnd> * dqcoeff, <S2SV_ModStart> * nb, vpx_reader * r ) { FRAME_COUNTS * counts = xd -> counts ; <S2SV_ModEnd> const int max_eob <S2SV_ModStart> const fc = xd -> fc <S2SV_ModEnd> ; const int <S2SV_ModStart> 0 ; const vpx_prob <S2SV_ModEnd> ( * coef_probs <S2SV_ModStart> ] ; const vpx_prob <S2SV_ModEnd> * prob ; <S2SV_ModStart> + 1 ] ; unsigned int ( * eob_branch_count ) [ COEFF_CONTEXTS ] ; uint8_t token_cache [ 32 * 32 ] ; const uint8_t * band_translate = get_band_translate ( tx_size ) ; const int dq_shift = ( tx_size == TX_32X32 ) ; int v, token ; int16_t dqv = dq [ 0 ] ; const uint8_t * cat1_prob ; const uint8_t * cat2_prob ; const uint8_t * cat3_prob ; const uint8_t * cat4_prob ; const uint8_t * cat5_prob ; const uint8_t * cat
Buggy code:
 static OPJ_BOOL opj_pi_next_pcrl ( opj_pi_iterator_t * pi ) { opj_pi_comp_t * comp = NULL ; opj_pi_resolution_t * res = NULL ; OPJ_UINT32 index = 0 ; if (! pi -> first ) { comp = & pi -> comps [ pi -> compno ] ; goto LABEL_SKIP ; } else { OPJ_UINT32 compno, resno ; pi -> first = 0 ; pi -> dx = 0 ; pi -> dy = 0 ; for ( compno = 0 ; compno < pi -> numcomps ; compno ++ ) { comp = & pi -> comps [ compno ] ; for ( resno = 0 ; resno < comp -> numresolutions ; resno ++ ) { OPJ_UINT32 dx, dy ; res = & comp -> resolutions [ resno ] ; dx = comp -> dx * ( 1u << ( res -> pdx + comp -> numresolutions - 1 - resno ) ) ; dy = comp -> dy * ( 1u << ( res -> pdy + comp -> numresolutions - 1 - resno ) ) ; pi -> dx =! pi -> dx? dx : opj_uint_min ( pi -> dx, dx ) ; pi -> dy =! pi -> dy? dy : opj_uint_min ( pi -> dy, dy ) ; } } } if (! pi -> tp_on ) { pi -> poc. ty0 = pi -> ty0 ; pi -> poc. tx0 = pi -> tx0 ; pi -> poc. ty1 = pi -> ty1 ; pi -> poc. tx1 = pi -> tx1 ; } for ( pi -> y = pi -> poc. ty0 ; pi -> y < pi -> poc. ty1 ; pi -> y += ( OPJ_INT32 ) ( pi -> dy - ( OPJ_UINT32 ) ( pi -> y % ( OPJ_INT32 ) pi -> dy ) ) ) { for ( pi -> x = pi -> poc. tx0 ; pi -> x < pi -> poc. tx1 ; pi -> x += ( OPJ_INT32 ) ( pi -> dx - ( OPJ_UINT32 ) ( pi -> x % ( OPJ_INT32 ) pi -> dx )

Fix:
<S2SV_ModStart> ; if ( rpx >= 31 || ( ( comp -> dx << rpx ) >> rpx )!= comp -> dx || rpy >= 31 || ( ( comp -> dy << rpy ) >> rpy )!= comp -> dy ) { continue ; } if (
Buggy code:
 static const interp_kernel * choose_interp_filter ( int inlength, int outlength ) { int outlength16 = outlength * 16 ; if ( outlength16 >= inlength * 16 ) <START_BUG> return vp9_filteredinterp_filters1000 ; <END_BUG> else if ( outlength16 >= inlength * 13 )  return vp9_filteredinterp_filters875 ; <START_BUG> else if ( outlength16 >= inlength * 11 ) <END_BUG> return vp9_filteredinterp_filters750 ;  else if ( outlength16 >= inlength * 9 ) <START_BUG> return vp9_filteredinterp_filters625 ; <END_BUG> else  return vp9_filteredinterp_filters500 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> 16 ) return filteredinterp_filters1000 <S2SV_ModEnd> ; else if <S2SV_ModStart> 13 ) return filteredinterp_filters875 <S2SV_ModEnd> ; else if <S2SV_ModStart> 11 ) return filteredinterp_filters750 <S2SV_ModEnd> ; else if <S2SV_ModStart> 9 ) return filteredinterp_filters625 <S2SV_ModEnd> ; else return <S2SV_ModStart> ; else return filteredinterp_filters500 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int on_header_cb ( nghttp2_session * ngh2, const nghttp2_frame * frame, const uint8_t * name, size_t namelen, const uint8_t * value, size_t valuelen, uint8_t flags, void * userp ) { h2_session * session = ( h2_session * ) userp ; h2_stream * stream ; apr_status_t status ; ( void ) flags ; stream = get_stream ( session, frame -> hd. stream_id ) ; if (! stream ) { <START_BUG> ap_log_cerror ( APLOG_MARK, APLOG_ERR, 0, session -> c, <END_BUG> APLOGNO ( 02920 ) "h2_session:     stream(%ld-%d):   on_header   unknown   stream", session -> id, ( int ) frame -> hd. stream_id ) ; return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE ; } status = h2_stream_add_header ( stream, ( const char * ) name, namelen, ( const char * ) value, valuelen ) ;  if ( status!= APR_SUCCESS &&! h2_stream_is_ready ( stream ) ) { <START_BUG> return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ( APLOG_MARK, APLOG_DEBUG <S2SV_ModEnd>, 0, <S2SV_ModStart> valuelen ) ; if ( status == APR_ECONNRESET ) { ap_log_cerror ( APLOG_MARK, APLOG_TRACE1, status, session -> c, "h2-stream(%ld-%d): <S2SV_blank> on_header, <S2SV_blank> reset <S2SV_blank> stream", session -> id, stream -> id ) ; nghttp2_submit_rst_stream ( ngh2, NGHTTP2_FLAG_NONE, stream -> id, NGHTTP2_INTERNAL_ERROR ) ; } else
Buggy code:
 static void encode_block_pass1 ( int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * arg ) { MACROBLOCK * const x = ( MACROBLOCK * ) arg ; MACROBLOCKD * const xd = & x -> e_mbd ; struct macroblock_plane * const p = & x -> plane [ plane ] ; struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <START_BUG> int16_t * const dqcoeff = BLOCK_OFFSET ( pd -> dqcoeff, block ) ; <END_BUG> int i, j ; uint8_t * dst ; txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & i, & j ) ; dst = & pd -> dst. buf [ 4 * j * pd -> dst. stride + 4 * i ] ; vp9_xform_quant ( x, plane, block, plane_bsize, tx_size ) ; if ( p -> eobs [ block ] > 0 )  xd -> itxm_add ( dqcoeff, dst, pd -> dst. stride, p -> eobs [ block ] ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> plane ] ; tran_low_t <S2SV_ModEnd> * const dqcoeff <S2SV_ModStart> > 0 ) { # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { x -> highbd_itxm_add ( dqcoeff, dst, pd -> dst. stride, p -> eobs [ block ], xd -> bd ) ; return ; } # endif x <S2SV_ModEnd> -> itxm_add ( <S2SV_ModStart> ] ) ; }
Buggy code:
 <START_BUG> CYCLIC_REFRESH * vp9_cyclic_refresh_alloc ( int mi_rows, int mi_cols ) { <END_BUG> CYCLIC_REFRESH * const cr = vpx_calloc ( 1, sizeof ( * cr ) ) ; if ( cr == NULL ) return NULL ; cr -> map = vpx_calloc ( mi_rows * mi_cols, sizeof ( * cr -> map ) ) ; if ( cr -> map == NULL ) { vpx_free ( cr ) ; return NULL ; }  return cr ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> mi_cols ) { size_t last_coded_q_map_size ; <S2SV_ModStart> NULL ; } last_coded_q_map_size = mi_rows * mi_cols * sizeof ( * cr -> last_coded_q_map ) ; cr -> last_coded_q_map = vpx_malloc ( last_coded_q_map_size ) ; if ( cr -> last_coded_q_map == NULL ) { vpx_free ( cr ) ; return NULL ; } assert ( MAXQ <= 255 ) ; memset ( cr -> last_coded_q_map, MAXQ, last_coded_q_map_size ) ;
Buggy code:
 void ppp_unregister_channel ( struct ppp_channel * chan ) { struct channel * pch = chan -> ppp ; struct ppp_net * pn ; if (! pch ) return ; chan -> ppp = NULL ; down_write ( & pch -> chan_sem ) ; spin_lock_bh ( & pch -> downl ) ; pch -> chan = NULL ; spin_unlock_bh ( & pch -> downl ) ; up_write ( & pch -> chan_sem ) ; ppp_disconnect_channel ( pch ) ; pn = ppp_pernet ( pch -> chan_net ) ; spin_lock_bh ( & pn -> all_channels_lock ) ; list_del ( & pch -> list ) ; spin_unlock_bh ( & pn -> all_channels_lock ) ; <START_BUG> pch -> file. dead = 1 ; <END_BUG> wake_up_interruptible ( & pch -> file. rwait ) ; if ( atomic_dec_and_test ( & pch -> file. refcnt ) ) ppp_destroy_channel ( pch ) ; }

Fix:
<S2SV_ModStart> all_channels_lock ) ; put_net ( pch -> chan_net ) ; pch -> chan_net = NULL ;
Buggy code:
 static inline LineContribType * _gdContributionsAlloc ( unsigned int line_length, unsigned int windows_size ) { unsigned int u = 0 ; LineContribType * res ; <START_BUG> int overflow_error = 0 ; <END_BUG>  res = ( LineContribType * ) gdMalloc ( sizeof ( LineContribType ) ) ; <START_BUG> if (! res ) { return NULL ; } res -> WindowSize = windows_size ; res -> LineLength = line_length ; if ( overflow2 ( line_length, sizeof ( ContributionType ) ) ) { gdFree ( res ) ; return NULL ; } res -> ContribRow = ( ContributionType * ) gdMalloc ( line_length * sizeof ( ContributionType ) ) ; if ( res -> ContribRow == NULL ) { gdFree ( res ) ; return NULL ; } <END_BUG> for ( u = 0 ; u < line_length ; u ++ ) {  if ( overflow2 ( windows_size, sizeof ( double ) ) ) { overflow_error = 1 ; } else { <START_BUG> res -> ContribRow [ u ]. Weights = ( double * ) gdMalloc ( windows_size * sizeof ( double ) ) ; <END_BUG> } if ( overflow_error == 1 || res -> ContribRow [ u ]. Weights == NULL ) { unsigned int i ;  u -- ; <START_BUG> <END_BUG> for ( i = 0 ; i <= u ; i ++ ) {  gdFree ( res -> ContribRow [ i ]. Weights ) ; } gdFree ( res -> ContribRow ) ; gdFree ( res ) ; return NULL ; } } return res ; }

Fix:
<S2SV_ModStart> * res ; size_t weights_size ; if ( overflow2 ( windows_size, sizeof ( double ) ) ) { return NULL ; } else { weights_size = windows_size * sizeof ( double ) ; } res = ( LineContribType * ) gdMalloc ( sizeof ( LineContribType ) ) ; if (! res ) { return NULL ; } res -> WindowSize = windows_size ; res -> LineLength = line_length ; if ( overflow2 ( line_length, sizeof ( ContributionType ) ) ) { gdFree ( res ) ; return NULL ; } res -> ContribRow = ( ContributionType * ) gdMalloc ( line_length * sizeof ( ContributionType ) ) ; if ( res -> ContribRow == NULL ) { gdFree ( res ) ; return NULL ; } for ( u <S2SV_ModEnd> = 0 ; <S2SV_ModStart> = 0 ; <S2SV_ModEnd> u < line_length <S2SV_ModStart> u ++ ) <S2SV_ModEnd> { res -> <S2SV_ModStart> ) gdMalloc ( weights_size ) ; if ( <S2SV_ModEnd> res -> ContribRow <S2SV_ModStart> int i ; <S2SV_ModEnd> for ( i <S2SV_ModStart> 0 ; i < <S2SV_ModEnd> u ; i
Buggy code:
 void Con_Dump_f ( void ) { int l, x, i ; short * line ; fileHandle_t f ; int bufferlen ; char * buffer ; char filename [ MAX_QPATH ] ; if ( Cmd_Argc ( )!= 2 ) { Com_Printf ( "usage:   condump   <filename>\\n" ) ; return ; } Q_strncpyz ( filename, Cmd_Argv ( 1 ), sizeof ( filename ) ) ; <START_BUG> COM_DefaultExtension ( filename, sizeof ( filename ), ".txt" ) ; <END_BUG> f = FS_FOpenFileWrite ( filename ) ; if (! f ) { Com_Printf ( "ERROR:   couldn\'t   open   %s.\\n", filename ) ; return ; } Com_Printf ( "Dumped   console   text   to   %s.\\n", filename ) ; for ( l = con. current - con. totallines + 1 ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( x = 0 ; x < con. linewidth ; x ++ ) if ( ( line [ x ] & 0xff )!=' ') break ; if ( x!= con. linewidth ) break ; } # ifdef _WIN32 bufferlen = con. linewidth + 3 * sizeof ( char ) ; # else bufferlen = con. linewidth + 2 * sizeof ( char ) ; # endif buffer = Hunk_AllocateTempMemory ( bufferlen ) ; buffer [ bufferlen - 1 ] = 0 ; for ( ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( i = 0 ; i < con. linewidth ; i ++ ) buffer [ i ] = line [ i ] & 0xff ; for ( x = con. linewidth - 1 ; x >= 0 ; x -- ) { if ( buffer [ x ] ==' ') buffer [ x ] = 0 ; else break ; } # ifdef _WIN32 Q_strcat ( buffer, bufferlen, "\\r\\n" ) ; # else Q_strcat ( buffer, bufferlen, "\\n" ) ; # endif FS_Write ( buffer, strlen ( buffer ), f ) ; } Hunk_FreeTempMemory ( buffer

Fix:
<S2SV_ModStart> ".txt" ) ; if (! COM_CompareExtension ( filename, ".txt" ) ) { Com_Printf ( "Con_Dump_f: <S2SV_blank> Only <S2SV_blank> the <S2SV_blank> \\".txt\\" <S2SV_blank> extension <S2SV_blank> is <S2SV_blank> supported <S2SV_blank> by <S2SV_blank> this <S2SV_blank> command!\\n" ) ; return ; }
Buggy code:
 static void update_buffer_level ( VP9_COMP * cpi, int encoded_frame_size ) { <START_BUG> const VP9_COMMON * const cm = & cpi -> common ; <END_BUG> const VP9_CONFIG * oxcf = & cpi -> oxcf ; RATE_CONTROL * const rc = & cpi -> rc ; if (! cm -> show_frame ) { rc -> bits_off_target -= encoded_frame_size ; } else {  rc -> bits_off_target += rc -> av_per_frame_bandwidth - encoded_frame_size ; <START_BUG> } <END_BUG> rc -> bits_off_target = MIN ( rc -> bits_off_target, oxcf -> maximum_buffer_size ) ;  rc -> buffer_level = rc -> bits_off_target ; <START_BUG> if ( cpi -> use_svc && cpi -> oxcf. end_usage == USAGE_STREAM_FROM_SERVER ) { <END_BUG> update_layer_buffer_level ( & cpi -> svc, encoded_frame_size ) ; } }

Fix:
<S2SV_ModStart> cpi -> common <S2SV_ModEnd> ; RATE_CONTROL * <S2SV_ModStart> += rc -> avg_frame_bandwidth <S2SV_ModEnd> - encoded_frame_size ; <S2SV_ModStart> -> bits_off_target, rc <S2SV_ModEnd> -> maximum_buffer_size ) <S2SV_ModStart> ; if ( is_one_pass_cbr_svc ( cpi ) <S2SV_ModEnd> ) { update_layer_buffer_level
Buggy code:
 static void snd_timer_user_ccallback ( struct snd_timer_instance * timeri, int event, struct timespec * tstamp, unsigned long resolution ) { struct snd_timer_user * tu = timeri -> callback_data ; struct snd_timer_tread r1 ; unsigned long flags ; if ( event >= SNDRV_TIMER_EVENT_START && event <= SNDRV_TIMER_EVENT_PAUSE ) tu -> tstamp = * tstamp ; if ( ( tu -> filter & ( 1 << event ) ) == 0 ||! tu -> tread ) return ; <START_BUG> r1. event = event ; <END_BUG> r1. tstamp = * tstamp ; r1. val = resolution ; spin_lock_irqsave ( & tu -> qlock, flags ) ; snd_timer_user_append_to_tqueue ( tu, & r1 ) ; spin_unlock_irqrestore ( & tu -> qlock, flags ) ; kill_fasync ( & tu -> fasync, SIGIO, POLL_IN ) ; wake_up ( & tu -> qchange_sleep ) ; }

Fix:
<S2SV_ModStart> ) return ; memset ( & r1, 0, sizeof ( r1 ) ) ;
Buggy code:
 PHP_FUNCTION ( unserialize ) { char * buf = NULL ; size_t buf_len ; const unsigned char * p ; php_unserialize_data_t var_hash ; <START_BUG> zval * options = NULL, * classes = NULL ; <END_BUG> HashTable * class_hash = NULL ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ), "s|a", & buf, & buf_len, & options ) == FAILURE ) { RETURN_FALSE ; } if ( buf_len == 0 ) { RETURN_FALSE ; } p = ( const unsigned char * ) buf ; PHP_VAR_UNSERIALIZE_INIT ( var_hash ) ; if ( options!= NULL ) { classes = zend_hash_str_find ( Z_ARRVAL_P ( options ), "allowed_classes", sizeof ( "allowed_classes" ) - 1 ) ; if ( classes && ( Z_TYPE_P ( classes ) == IS_ARRAY ||! zend_is_true ( classes ) ) ) { ALLOC_HASHTABLE ( class_hash ) ; zend_hash_init ( class_hash, ( Z_TYPE_P ( classes ) == IS_ARRAY )? zend_hash_num_elements ( Z_ARRVAL_P ( classes ) ) : 0, NULL, NULL, 0 ) ; } if ( class_hash && Z_TYPE_P ( classes ) == IS_ARRAY ) { zval * entry ; zend_string * lcname ; ZEND_HASH_FOREACH_VAL ( Z_ARRVAL_P ( classes ), entry ) { convert_to_string_ex ( entry ) ; lcname = zend_string_tolower ( Z_STR_P ( entry ) ) ; zend_hash_add_empty_element ( class_hash, lcname ) ; zend_string_release ( lcname ) ; } ZEND_HASH_FOREACH_END ( ) ; } }  if (! php_var_unserialize_ex ( return_value, & p, p + buf_len, & var_hash, class_hash ) ) { <START_BUG> PHP_VAR_UNSERIALIZE_DESTROY ( var_hash ) ; if ( class_hash ) { zend_hash_destroy ( class_hash ) ; FREE_HASHTABLE ( class_hash ) ; } <END_BUG> zval_

Fix:
<S2SV_ModStart> classes = NULL ; zval * retval <S2SV_ModStart> ; } } retval = var_tmp_var ( & var_hash ) ; <S2SV_ModStart>! php_var_unserialize_ex ( retval <S2SV_ModEnd>, & p <S2SV_ModStart> ) ; } <S2SV_ModEnd> if (! <S2SV_ModStart> RETURN_FALSE ; } ZVAL_COPY ( return_value, retval <S2SV_ModEnd> ) ; PHP_VAR_UNSERIALIZE_DESTROY
Buggy code:
 int dtls1_get_record ( SSL * s ) { int ssl_major, ssl_minor ; int i, n ; SSL3_RECORD * rr ; unsigned char * p = NULL ; unsigned short version ; DTLS1_BITMAP * bitmap ; unsigned int is_next_epoch ; rr = & ( s -> s3 -> rrec ) ; <START_BUG> dtls1_process_buffered_records ( s ) ; <END_BUG> if ( dtls1_get_processed_record ( s ) ) return 1 ; again : if ( ( s -> rstate!= SSL_ST_READ_BODY ) || ( s -> packet_length < DTLS1_RT_HEADER_LENGTH ) ) { n = ssl3_read_n ( s, DTLS1_RT_HEADER_LENGTH, s -> s3 -> rbuf. len, 0 ) ; if ( n <= 0 ) return ( n ) ; if ( s -> packet_length!= DTLS1_RT_HEADER_LENGTH ) { s -> packet_length = 0 ; goto again ; } s -> rstate = SSL_ST_READ_BODY ; p = s -> packet ; if ( s -> msg_callback ) s -> msg_callback ( 0, 0, SSL3_RT_HEADER, p, DTLS1_RT_HEADER_LENGTH, s, s -> msg_callback_arg ) ; rr -> type = * ( p ++ ) ; ssl_major = * ( p ++ ) ; ssl_minor = * ( p ++ ) ; version = ( ssl_major << 8 ) | ssl_minor ; n2s ( p, rr -> epoch ) ; memcpy ( & ( s -> s3 -> read_sequence [ 2 ] ), p, 6 ) ; p += 6 ; n2s ( p, rr -> length ) ; if (! s -> first_packet ) { if ( version!= s -> version ) { rr -> length = 0 ; s -> packet_length = 0 ; goto again ; } } if ( ( version & 0xff00 )!= ( s -> version & 0xff00 ) ) { rr -> length = 0 ; s -> packet_length = 0 ; goto again ; } if ( rr -> length > SSL3_RT_MAX_ENCRYPTED_LENGTH ) { rr -> length = 0 ; s -> packet_length = 0 ; goto again ; } } if ( rr -> length >

Fix:
<S2SV_ModStart> rrec ) ; if ( <S2SV_ModStart> ( s ) < 0 ) return - 1 <S2SV_ModStart> listen ) { if ( <S2SV_ModStart> rr -> seq_num ) < 0 ) return - 1 ; dtls1_record_bitmap_update ( s, bitmap <S2SV_ModStart> again ; } dtls1_record_bitmap_update ( s, bitmap ) ;
Buggy code:
 uint16_t enc28j60ReadPhyReg ( NetInterface * interface, uint16_t address ) { uint16_t data ; <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MIREGADR, address & REG_ADDR_MASK ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_MICMD, MICMD_MIIRD ) ; <START_BUG> <END_BUG> while ( ( enc28j60ReadReg ( interface, ENC28J60_REG_MISTAT ) & MISTAT_BUSY )!= 0 )  { } <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MICMD, 0 ) ; <END_BUG>  data = enc28j60ReadReg ( interface, ENC28J60_REG_MIRDL ) ; <START_BUG> <END_BUG> data |= enc28j60ReadReg ( interface, ENC28J60_REG_MIRDH ) << 8 ;  return data ; }

Fix:
<S2SV_ModStart> ( interface, ENC28J60_MIREGADR <S2SV_ModEnd>, address & <S2SV_ModStart> ( interface, ENC28J60_MICMD, ENC28J60_MICMD_MIIRD <S2SV_ModEnd> ) ; while <S2SV_ModStart> ( interface, ENC28J60_MISTAT ) & ENC28J60_MISTAT_BUSY <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC28J60_MICMD <S2SV_ModEnd>, 0 ) <S2SV_ModStart> ( interface, ENC28J60_MIRDL <S2SV_ModEnd> ) ; data <S2SV_ModStart> ( interface, ENC28J60_MIRDH <S2SV_ModEnd> ) << 8
Buggy code:
 static wStream * rdg_receive_packet ( rdpRdg * rdg ) { wStream * s ; const size_t header = sizeof ( RdgPacketHeader ) ; size_t packetLength ; assert ( header <= INT_MAX ) ; s = Stream_New ( NULL, 1024 ) ; if (! s ) return NULL ; if (! rdg_read_all ( rdg -> tlsOut, Stream_Buffer ( s ), header ) ) { Stream_Free ( s, TRUE ) ; return NULL ; } Stream_Seek ( s, 4 ) ; Stream_Read_UINT32 ( s, packetLength ) ; <START_BUG> if ( ( packetLength > INT_MAX ) ||! Stream_EnsureCapacity ( s, packetLength ) ) <END_BUG> { Stream_Free ( s, TRUE ) ; return NULL ; } if (! rdg_read_all ( rdg -> tlsOut, Stream_Buffer ( s ) + header, ( int ) packetLength - ( int ) header ) ) { Stream_Free ( s, TRUE ) ; return NULL ; } Stream_SetLength ( s, packetLength ) ; return s ; }

Fix:
<S2SV_ModStart>, packetLength ) || ( packetLength < header )
Buggy code:
 int BN_GF2m_mod_inv ( BIGNUM * r, const BIGNUM * a, const BIGNUM * p, BN_CTX * ctx ) { BIGNUM * b, * c = NULL, * u = NULL, * v = NULL, * tmp ; int ret = 0 ; bn_check_top ( a ) ; bn_check_top ( p ) ; BN_CTX_start ( ctx ) ; if ( ( b = BN_CTX_get ( ctx ) ) == NULL ) goto err ; if ( ( c = BN_CTX_get ( ctx ) ) == NULL ) goto err ; if ( ( u = BN_CTX_get ( ctx ) ) == NULL ) goto err ; if ( ( v = BN_CTX_get ( ctx ) ) == NULL ) goto err ; if (! BN_GF2m_mod ( u, a, p ) ) goto err ; if ( BN_is_zero ( u ) ) goto err ; if (! BN_copy ( v, p ) ) goto err ; # if 0 if (! BN_one ( b ) ) goto err ; while ( 1 ) { while (! BN_is_odd ( u ) ) { if ( BN_is_zero ( u ) ) goto err ; if (! BN_rshift1 ( u, u ) ) goto err ; if ( BN_is_odd ( b ) ) { if (! BN_GF2m_add ( b, b, p ) ) goto err ; } if (! BN_rshift1 ( b, b ) ) goto err ; } if ( BN_abs_is_word ( u, 1 ) ) break ; if ( BN_num_bits ( u ) < BN_num_bits ( v ) ) { tmp = u ; u = v ; v = tmp ; tmp = b ; b = c ; c = tmp ; } if (! BN_GF2m_add ( u, u, v ) ) goto err ; if (! BN_GF2m_add ( b, b, c ) ) goto err ; } # else { <START_BUG> int i, ubits = BN_num_bits ( u ), vbits = BN_num_bits<END_BUG>

Fix:
<S2SV_ModStart> { int i ; int <S2SV_ModEnd> ubits = BN_num_bits <S2SV_ModStart> ( u ) ; int <S2SV_ModEnd> vbits = BN_num_bits <S2SV_ModStart> ( v ) ; int <S2SV_ModEnd> top = p <S2SV_ModStart> ubits <= BN_BITS2 ) { if ( <S2SV_ModEnd> udp [ 0 <S2SV_ModStart> 0 ] == 0 ) goto err ; if ( udp [ 0 ] == <S2SV_ModStart> ) break ; }
Buggy code:
 static void activate_desktop_file ( ActivateParameters * parameters, NautilusFile * file ) { ActivateParametersDesktop * parameters_desktop ; char * primary, * secondary, * display_name ; GtkWidget * dialog ; GdkScreen * screen ; char * uri ; screen = gtk_widget_get_screen ( GTK_WIDGET ( parameters -> parent_window ) ) ; if (! nautilus_file_is_trusted_link ( file ) ) { parameters_desktop = g_new0 ( ActivateParametersDesktop, 1 ) ; if ( parameters -> parent_window ) { parameters_desktop -> parent_window = parameters -> parent_window ; g_object_add_weak_pointer ( G_OBJECT ( parameters_desktop -> parent_window ), ( gpointer * ) & parameters_desktop -> parent_window ) ; } parameters_desktop -> file = nautilus_file_ref ( file ) ; primary = _ ( "Untrusted   application   launcher" ) ; display_name = nautilus_file_get_display_name ( file ) ; secondary = g_strdup_printf ( _ ( "The   application   launcher   “%s”   has   not   been   marked   as   trusted.   " "If   you   do   not   know   the   source   of   this   file,   launching   it   may   be   unsafe." ), display_name ) ; dialog = gtk_message_dialog_new ( parameters -> parent_window, 0, GTK_MESSAGE_WARNING, GTK_BUTTONS_NONE, NULL ) ; g_object_set ( dialog, "text", primary, "secondary-text", secondary, NULL ) ; gtk_dialog_add_button ( GTK_DIALOG ( dialog ), <START_BUG> _ ( "_Launch   Anyway" ), RESPONSE_RUN ) ; <END_BUG> if ( nautilus_file_can_set_permissions ( file ) ) { gtk_dialog_add_button ( GTK_DIALOG ( dialog ),  _ ( "Mark   as   _Trusted" ), RESPONSE_MARK_TRUSTED ) ; <START_BUG> } <END_BUG> gtk_dialog_add_button ( GTK_DIALOG ( dialog ),  _ ( "_Cancel" ), GTK_RESPONSE_CANCEL ) ; gtk_

Fix:
<S2SV_ModStart>, _ ( "_Cancel" ), GTK_RESPONSE_CANCEL ) ; gtk_dialog_set_default_response ( GTK_DIALOG ( dialog ), GTK_RESPONSE_CANCEL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, _ ( "Trust <S2SV_blank> and <S2SV_blank> _Launch" ), GTK_RESPONSE_OK <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> g_signal_connect ( dialog
Buggy code:
 void vp8_copy_mem16x16_c ( unsigned char * src, int src_stride, unsigned char * dst, int dst_stride ) { int r ; for ( r = 0 ; r < 16 ; r ++ ) { <START_BUG> # if! ( CONFIG_FAST_UNALIGNED ) <END_BUG> dst [ 0 ] = src [ 0 ] ; dst [ 1 ] = src [ 1 ] ; dst [ 2 ] = src [ 2 ] ; dst [ 3 ] = src [ 3 ] ; dst [ 4 ] = src [ 4 ] ; dst [ 5 ] = src [ 5 ] ; dst [ 6 ] = src [ 6 ] ; dst [ 7 ] = src [ 7 ] ; dst [ 8 ] = src [ 8 ] ; dst [ 9 ] = src [ 9 ] ; dst [ 10 ] = src [ 10 ] ; dst [ 11 ] = src [ 11 ] ; dst [ 12 ] = src [ 12 ] ; dst [ 13 ] = src [ 13 ] ; dst [ 14 ] = src [ 14 ] ; dst [ 15 ] = src [ 15 ] ; # else ( ( uint32_t * ) dst ) [ 0 ] = ( ( uint32_t * ) src ) [ 0 ] ; ( ( uint32_t * ) dst ) [ 1 ] = ( ( uint32_t * ) src ) [ 1 ] ; ( ( uint32_t * ) dst ) [ 2 ] = ( ( uint32_t * ) src ) [ 2 ] ; ( ( uint32_t * ) dst ) [ 3 ] = ( ( uint32_t * ) src ) [ 3 ] ; # endif src += src_stride ; dst += dst_stride ; } }

Fix:
<S2SV_ModStart> ++ ) { memcpy ( dst, src, 16 ) ; <S2SV_ModEnd> src += src_stride
Buggy code:
 <START_BUG> void vp9_loop_filter_rows ( const YV12_BUFFER_CONFIG * frame_buffer, <END_BUG>  VP9_COMMON * cm, MACROBLOCKD * xd, <START_BUG> int start, int stop, int y_only ) { const int num_planes = y_only? 1 : MAX_MB_PLANE ; <END_BUG> int mi_row, mi_col ;  LOOP_FILTER_MASK lfm ; <START_BUG> int use_420 = y_only || ( xd -> plane [ 1 ]. subsampling_y == 1 && <END_BUG>  xd -> plane [ 1 ]. subsampling_x == 1 ) ; <START_BUG> for ( mi_row = start ; mi_row < stop ; mi_row += MI_BLOCK_SIZE ) { <END_BUG> MODE_INFO * * mi_8x8 = cm -> mi_grid_visible + mi_row * cm -> mi_stride ;  for ( mi_col = 0 ; mi_col < cm -> mi_cols ; mi_col += MI_BLOCK_SIZE ) { int plane ; <START_BUG> vp9_setup_dst_planes ( xd, frame_buffer, mi_row, mi_col ) ; <END_BUG>  if ( use_420 ) <START_BUG> <END_BUG> vp9_setup_mask ( cm, mi_row, mi_col, mi_8x8 + mi_col, cm -> mi_stride,  & lfm ) ; <START_BUG> for ( plane = 0 ; plane < num_planes ; ++ plane ) { <END_BUG>  if ( use_420 ) <START_BUG> vp9_filter_block_plane ( cm, & xd -> plane [ plane ], mi_row, & lfm ) ; else filter_block_plane_non420 ( cm, & xd -> plane [ plane ], mi_8x8 + mi_col, mi_row, mi_col ) ; <END_BUG> }  } } }

Fix:
<S2SV_ModStart> void vp9_loop_filter_rows ( <S2SV_ModEnd> YV12_BUFFER_CONFIG * frame_buffer <S2SV_ModStart> * cm, struct macroblockd_plane planes [ MAX_MB_PLANE ] <S2SV_ModEnd>, int start <S2SV_ModStart> : MAX_MB_PLANE ; enum lf_path path <S2SV_ModEnd> ; LOOP_FILTER_MASK lfm <S2SV_ModStart> lfm ; int mi_row, mi_col ; if ( y_only ) path = LF_PATH_444 ; else if ( planes <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> == 1 && planes <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> == 1 ) path = LF_PATH_420 ; else if ( planes [ 1 ]. subsampling_y == 0 && planes [ 1 ]. subsampling_x == 0 ) path = LF_PATH_444 ; else path = LF_PATH_SLOW <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd> = cm -> <S2SV_ModStart> ; vp9_setup_dst_planes ( planes <S2SV_ModEnd>, frame_buffer, <S2SV_ModStart> mi_col ) ; <S2SV_ModEnd> vp9_setup_mask ( cm <S2SV_ModStart>, mi_col, mi <S2SV_ModEnd> + mi_col, <S2SV_ModStart> lfm ) ; vp9_filter_block_plane_ss00 ( cm, & planes
Buggy code:
 void kvm_lapic_sync_to_vapic ( struct kvm_vcpu * vcpu ) { u32 data, tpr ; int max_irr, max_isr ; <START_BUG> struct kvm_lapic * apic = vcpu -> arch. apic ; <END_BUG> void * vapic ; apic_sync_pv_eoi_to_guest ( vcpu, apic ) ; if (! test_bit ( KVM_APIC_CHECK_VAPIC, & vcpu -> arch. apic_attention ) ) return ; tpr = kvm_apic_get_reg ( apic, APIC_TASKPRI ) & 0xff ; max_irr = apic_find_highest_irr ( apic ) ; if ( max_irr < 0 ) max_irr = 0 ; max_isr = apic_find_highest_isr ( apic ) ; if ( max_isr < 0 ) max_isr = 0 ; data = ( tpr & 0xff ) | ( ( max_isr & 0xf0 ) << 8 ) | ( max_irr << 24 ) ;  vapic = kmap_atomic ( vcpu -> arch. apic -> vapic_page ) ; <START_BUG> * ( u32 * ) ( vapic + offset_in_page ( vcpu -> arch. apic -> vapic_addr ) ) = data ; kunmap_atomic ( vapic ) ; }<END_BUG>

Fix:
<S2SV_ModStart> arch. apic <S2SV_ModEnd> ; apic_sync_pv_eoi_to_guest ( <S2SV_ModStart> 24 ) ; kvm_write_guest_cached ( vcpu -> kvm, & <S2SV_ModEnd> vcpu -> arch <S2SV_ModStart>. apic -> vapic_cache, & data, sizeof ( u32 ) <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> static vpx_codec_err_t ctrl_set_svc ( vpx_codec_alg_priv_t * ctx, int ctr_id, <END_BUG> va_list args ) { int data = va_arg ( args, int ) ; const vpx_codec_enc_cfg_t * cfg = & ctx -> cfg ; vp9_set_svc ( ctx -> cpi, data ) ; if ( data == 1 &&  ( cfg -> rc_end_usage == VPX_CBR || <START_BUG> cfg -> g_pass == VPX_RC_FIRST_PASS || cfg -> g_pass == VPX_RC_LAST_PASS ) && cfg -> ss_number_layers > 1 && cfg -> ts_number_layers > 1 ) { return VPX_CODEC_INVALID_PARAM ; } return VPX_CODEC_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> ( cfg -> <S2SV_ModEnd> g_pass == VPX_RC_FIRST_PASS
Buggy code:
 static int bgp_attr_print ( netdissect_options * ndo, u_int atype, const u_char * pptr, u_int len ) { int i ; uint16_t af ; uint8_t safi, snpa, nhlen ; union { float f ; uint32_t i ; } bw ; int advance ; u_int tlen ; const u_char * tptr ; char buf [ MAXHOSTNAMELEN + 100 ] ; int as_size ; tptr = pptr ; tlen = len ; switch ( atype ) { case BGPTYPE_ORIGIN : if ( len!= 1 ) ND_PRINT ( ( ndo, "invalid   len" ) ) ; else { ND_TCHECK ( * tptr ) ; ND_PRINT ( ( ndo, "%s", tok2str ( bgp_origin_values, "Unknown   Origin   Typecode", tptr [ 0 ] ) ) ) ; } break ; case BGPTYPE_AS4_PATH : case BGPTYPE_AS_PATH : if ( len % 2 ) { ND_PRINT ( ( ndo, "invalid   len" ) ) ; break ; } if (! len ) { ND_PRINT ( ( ndo, "empty" ) ) ; break ; } as_size = bgp_attr_get_as_size ( ndo, atype, pptr, len ) ; while ( tptr < pptr + len ) { ND_TCHECK ( tptr [ 0 ] ) ; ND_PRINT ( ( ndo, "%s", tok2str ( bgp_as_path_segment_open_values, <START_BUG> "?", tptr [ 0 ] ) ) ) ; <END_BUG> for ( i = 0 ; i < tptr [ 1 ] * as_size ; i += as_size ) { ND_TCHECK2 ( tptr [ 2 + i ], as_size ) ; ND_PRINT ( ( ndo, "%s   ", as_printf ( ndo, astostr, sizeof ( astostr ), as_size == 2? EXTRACT_16BITS ( & tptr [ 2 + i ] ) : EXTRACT_32BITS ( & tptr [ 2 + i ] ) ) ) ) ; } ND_TCHECK ( tptr [ 0 ] ) ; ND_PRINT

Fix:
<S2SV_ModStart> ] ) ) ) ; ND_TCHECK ( tptr [ 1 ]
Buggy code:
 static void vmx_refresh_apicv_exec_ctrl ( struct kvm_vcpu * vcpu ) { struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; vmcs_write32 ( PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl ( vmx ) ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> ) ) ; if ( cpu_has_secondary_exec_ctrls ( ) ) { if ( kvm_vcpu_apicv_active ( vcpu ) ) vmcs_set_bits ( SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_APIC_REGISTER_VIRT | SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY ) ; else vmcs_clear_bits ( SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_APIC_REGISTER_VIRT | SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY ) ; } if ( cpu_has_vmx_msr_bitmap ( ) ) vmx_set_msr_bitmap ( vcpu ) ;
Buggy code:
 static __forceinline void draw_line ( float * output, int x0, int y0, int x1, int y1, int n ) { int dy = y1 - y0 ; int adx = x1 - x0 ; int ady = abs ( dy ) ; int base ; int x = x0, y = y0 ; int err = 0 ; int sy ; # ifdef STB_VORBIS_DIVIDE_TABLE if ( adx < DIVTAB_DENOM && ady < DIVTAB_NUMER ) { if ( dy < 0 ) { base = - integer_divide_table [ ady ] [ adx ] ; sy = base - 1 ; } else { base = integer_divide_table [ ady ] [ adx ] ; sy = base + 1 ; } } else { base = dy // adx ; if ( dy < 0 ) sy = base - 1 ; else sy = base + 1 ; } # else base = dy // adx ; if ( dy < 0 ) sy = base - 1 ; else sy = base + 1 ; # endif ady -= abs ( base ) * adx ; if ( x1 > n ) x1 = n ; if ( x < x1 ) { <START_BUG> LINE_OP ( output [ x ], inverse_db_table [ y ] ) ; <END_BUG> for ( ++ x ; x < x1 ; ++ x ) { err += ady ; if ( err >= adx ) { err -= adx ; y += sy ; } else y += base ;  LINE_OP ( output [ x ], inverse_db_table [ y ] ) ; <START_BUG> } } }<END_BUG>

Fix:
<S2SV_ModStart> inverse_db_table [ y & 255 <S2SV_ModStart> inverse_db_table [ y & 255
Buggy code:
 void arch_pick_mmap_layout ( struct mm_struct * mm ) { unsigned long random_factor = 0UL ; if ( current -> flags & PF_RANDOMIZE ) random_factor = arch_mmap_rnd ( ) ; <START_BUG> mm -> mmap_legacy_base = mmap_legacy_base ( random_factor ) ; <END_BUG> if ( mmap_is_legacy ( ) ) { mm -> mmap_base = mm -> mmap_legacy_base ; mm -> get_unmapped_area = arch_get_unmapped_area ; } else { mm -> mmap_base = mmap_base ( random_factor ) ; mm -> get_unmapped_area = arch_get_unmapped_area_topdown ; } }

Fix:
<S2SV_ModStart> -> mmap_legacy_base = TASK_UNMAPPED_BASE + random_factor <S2SV_ModEnd> ; if (
Buggy code:
 static int strncat_from_utf8_libarchive2 ( struct archive_string * as, const void * _p, size_t len, struct archive_string_conv * sc ) { const char * s ; int n ; char * p ; char * end ; uint32_t unicode ; # if HAVE_WCRTOMB mbstate_t shift_state ; memset ( & shift_state, 0, sizeof ( shift_state ) ) ; # else wctomb ( NULL, L'\\0' ) ; # endif ( void ) sc ; if ( archive_string_ensure ( as, as -> length + len + 1 ) == NULL ) return ( - 1 ) ; s = ( const char * ) _p ; p = as -> s + as -> length ; end = as -> s + as -> buffer_length - MB_CUR_MAX - 1 ; while ( ( n = _utf8_to_unicode ( & unicode, s, len ) )!= 0 ) { wchar_t wc ; if ( p >= end ) { as -> length = p - as -> s ; if ( archive_string_ensure ( as, <START_BUG> as -> length + len * 2 + 1 ) == NULL ) <END_BUG> return ( - 1 ) ; p = as -> s + as -> length ; end = as -> s + as -> buffer_length - MB_CUR_MAX - 1 ; } if ( n < 0 ) { n *= - 1 ; wc = L'?' ; } else wc = ( wchar_t ) unicode ; s += n ; len -= n ; # if HAVE_WCRTOMB n = ( int ) wcrtomb ( p, wc, & shift_state ) ; # else n = ( int ) wctomb ( p, wc ) ; # endif if ( n == - 1 ) return ( - 1 ) ; p += n ; } as -> length = p - as -> s ; as -> s [ as -> length ] = '\\0' ; return ( 0 ) ; }

Fix:
<S2SV_ModStart> -> length + max ( <S2SV_ModStart> len * 2, ( size_t ) MB_CUR_MAX )
Buggy code:
 static ngx_int_t ngx_http_auth_spnego_handler ( ngx_http_request_t * r ) { ngx_int_t ret = NGX_DECLINED ; ngx_http_auth_spnego_ctx_t * ctx ; ngx_http_auth_spnego_loc_conf_t * alcf ; alcf = ngx_http_get_module_loc_conf ( r, ngx_http_auth_spnego_module ) ; if ( alcf -> protect == 0 ) { return NGX_DECLINED ; } ctx = ngx_http_get_module_ctx ( r, ngx_http_auth_spnego_module ) ; if ( NULL == ctx ) { ctx = ngx_palloc ( r -> pool, sizeof ( ngx_http_auth_spnego_ctx_t ) ) ; if ( NULL == ctx ) { return NGX_HTTP_INTERNAL_SERVER_ERROR ; } ctx -> token. len = 0 ; ctx -> token. data = NULL ; ctx -> head = 0 ; ctx -> ret = NGX_HTTP_UNAUTHORIZED ; ngx_http_set_ctx ( r, ctx, ngx_http_auth_spnego_module ) ; } spnego_debug3 ( "SSO   auth   handling   IN:   token.len=%d,   head=%d,   ret=%d", ctx -> token. len, ctx -> head, ctx -> ret ) ; if ( ctx -> token. len && ctx -> head ) { spnego_debug1 ( "Found   token   and   head,   returning   %d", ctx -> ret ) ; return ctx -> ret ; } if ( NULL!= r -> headers_in. user. data ) { spnego_debug0 ( "User   header   set" ) ; return NGX_OK ; } spnego_debug0 ( "Begin   auth" ) ; if ( alcf -> allow_basic ) { spnego_debug0 ( "Detect   basic   auth" ) ; ret = ngx_http_auth_basic_user ( r ) ; if ( NGX_OK == ret ) { spnego_debug0 ( "Basic   auth   credentials

Fix:
<S2SV_ModStart> ; if ( NGX_OK!= <S2SV_ModEnd> ngx_http_auth_spnego_basic ( r
Buggy code:
 void ngx_gmtime ( time_t t, ngx_tm_t * tp ) { ngx_int_t yday ; <START_BUG> ngx_uint_t n, sec, min, hour, mday, mon, year, wday, days, leap ; <END_BUG>  n = ( ngx_uint_t ) t ; <START_BUG> days = n // 86400 ; <END_BUG> wday = ( 4 + days ) % 7 ;  <START_BUG> n %= 86400 ; <END_BUG> hour = n // 3600 ;  n %= 3600 ; <START_BUG> <END_BUG> min = n // 60 ;  <START_BUG> sec = n % 60 ; <END_BUG> days = days - ( 31 + 28 ) + 719527 ; year = ( days + 2 ) * 400 // ( 365 * 400 + 100 - 4 + 1 ) ; yday = days - ( 365 * year + year // 4 - year // 100 + year // 400 ) ; if ( yday < 0 ) { leap = ( year % 4 == 0 ) && ( year % 100 || ( year % 400 == 0 ) ) ; yday = 365 + leap + yday ; year -- ; } mon = ( yday + 31 ) * 10 // 306 ; mday = yday - ( 367 * mon // 12 - 30 ) + 1 ; if ( yday >= 306 ) { year ++ ; mon -= 10 ; } else { mon += 2 ; } tp -> ngx_tm_sec = ( ngx_tm_sec_t ) sec ; tp -> ngx_tm_min = ( ngx_tm_min_t ) min ; tp -> ngx_tm_hour = ( ngx_tm_hour_t ) hour ; tp -> ngx_tm_mday = ( ngx_tm_mday_t ) mday ; tp -> ngx_tm_mon = ( ngx_tm_mon_t ) mon ; tp -> ngx_tm_year = ( ngx_tm_year_t ) year ; tp -> ngx_tm_wday = ( ngx_tm_wday_t ) wday ; }

Fix:
<S2SV_ModStart> yday ; ngx_uint_t <S2SV_ModEnd> sec, min <S2SV_ModStart>, leap ; if ( t < 0 ) { t = 0 ; } days = t <S2SV_ModEnd> // 86400 ; <S2SV_ModStart> // 86400 ; sec = t % 86400 ; <S2SV_ModStart> % 7 ; hour = sec <S2SV_ModEnd> // 3600 ; <S2SV_ModStart> // 3600 ; sec <S2SV_ModEnd> %= 3600 ; <S2SV_ModStart> ; min = sec <S2SV_ModEnd> // 60 ; <S2SV_ModStart> 60 ; sec %= <S2SV_ModEnd> 60 ; days
Buggy code:
 static s32 gf_hevc_read_sps_bs_internal ( GF_BitStream * bs, HEVCState * hevc, u8 layer_id, u32 * vui_flag_pos ) { s32 vps_id, sps_id = - 1 ; u32 i, nb_CTUs, depth ; HEVC_SPS * sps ; HEVC_VPS * vps ; HEVC_ProfileTierLevel ptl ; Bool multiLayerExtSpsFlag ; u8 sps_ext_or_max_sub_layers_minus1, max_sub_layers_minus1 ; if ( vui_flag_pos ) * vui_flag_pos = 0 ; vps_id = gf_bs_read_int_log ( bs, 4, "vps_id" ) ; <START_BUG> if ( vps_id >= 16 ) { <END_BUG> return - 1 ; } memset ( & ptl, 0, sizeof ( ptl ) ) ; max_sub_layers_minus1 = 0 ; sps_ext_or_max_sub_layers_minus1 = 0 ; if ( layer_id == 0 ) max_sub_layers_minus1 = gf_bs_read_int_log ( bs, 3, "max_sub_layers_minus1" ) ; else sps_ext_or_max_sub_layers_minus1 = gf_bs_read_int_log ( bs, 3, "sps_ext_or_max_sub_layers_minus1" ) ; multiLayerExtSpsFlag = ( layer_id!= 0 ) && ( sps_ext_or_max_sub_layers_minus1 == 7 ) ; if (! multiLayerExtSpsFlag ) { gf_bs_read_int_log ( bs, 1, "temporal_id_nesting_flag" ) ; hevc_profile_tier_level ( bs, 1, max_sub_layers_minus1, & ptl, 0 ) ; } sps_id = gf_bs_read_ue_log ( bs, "sps_id" ) ; if ( ( sps_id < 0 ) || ( sps_id >= 16 ) ) { return - 1 ; } sps = & hevc -> sps [ sps_

Fix:
<S2SV_ModStart> ; if ( ( vps_id < 0 ) || ( <S2SV_ModStart> vps_id >= 16 )
Buggy code:
 int nfssvc_decode_readlinkargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd_readlinkargs * args ) { p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; <START_BUG> args -> buffer = page_address ( * ( rqstp -> rq_next_page ++ ) ) ; <END_BUG>  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> return 0 ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 ; <S2SV_ModStart> ) ; return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 WORD32 ih264d_parse_decode_slice ( UWORD8 u1_is_idr_slice, UWORD8 u1_nal_ref_idc, dec_struct_t * ps_dec ) { dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; dec_pic_params_t * ps_pps ; dec_seq_params_t * ps_seq ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; pocstruct_t s_tmp_poc ; WORD32 i_delta_poc [ 2 ] ; WORD32 i4_poc = 0 ; UWORD16 u2_first_mb_in_slice, u2_frame_num ; UWORD8 u1_field_pic_flag, u1_redundant_pic_cnt = 0, u1_slice_type ; UWORD32 u4_idr_pic_id = 0 ; UWORD8 u1_bottom_field_flag, u1_pic_order_cnt_type ; UWORD8 u1_nal_unit_type ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; WORD8 i1_is_end_of_poc ; WORD32 ret, end_of_frame ; WORD32 prev_slice_err, num_mb_skipped ; UWORD8 u1_mbaff ; pocstruct_t * ps_cur_poc ; UWORD32 u4_temp ; WORD32 i_temp ; UWORD32 u4_call_end_of_pic = 0 ; ps_dec -> ps_dpb_cmds -> u1_dpb_commands_read_slc = 0 ; u2_first_mb_in_slice = ih264d_uev ( pu4_bitstrm_ofst, pu4_bitstrm_buf ) ; if ( u2_first_mb_in_slice > ( ps_dec -> u2_frm_ht_in_mbs * ps_dec -> u2_frm_

Fix:
<S2SV_ModStart> pv_parse_tu_coeff_data ; } <S2SV_ModEnd> if ( u1_slice_type
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM

Fix:
<S2SV_ModStart> = 2 ; if ( ps_dec -> u4_first_slice_in_pic && ( ps_dec -> u2_total_mbs_coded == 0 ) ) prev_slice_err = 1 ;
Buggy code:
 static void scalar32_min_max_or ( struct bpf_reg_state * dst_reg, struct bpf_reg_state * src_reg ) { bool src_known = tnum_subreg_is_const ( src_reg -> var_off ) ; bool dst_known = tnum_subreg_is_const ( dst_reg -> var_off ) ; struct tnum var32_off = tnum_subreg ( dst_reg -> var_off ) ; <START_BUG> s32 smin_val = src_reg -> smin_value ; <END_BUG>  u32 umin_val = src_reg -> umin_value ; <START_BUG> if ( src_known && dst_known ) return ; dst_reg -> u32_min_value = max ( dst_reg -> u32_min_value, umin_val ) ; dst_reg -> u32_max_value = var32_off. value | var32_off. mask ; if ( dst_reg -> s32_min_value < 0 || smin_val < 0 ) { dst_reg -> s32_min_value = S32_MIN ; dst_reg -> s32_max_value = S32_MAX ; } else { <END_BUG> dst_reg -> s32_min_value = dst_reg -> umin_value ;  <START_BUG> dst_reg -> s32_max_value = dst_reg -> umax_value ; <END_BUG> } }

Fix:
<S2SV_ModStart> = src_reg -> s32_min_value <S2SV_ModEnd> ; u32 umin_val <S2SV_ModStart> = src_reg -> u32_min_value <S2SV_ModEnd> ; if ( <S2SV_ModStart> = dst_reg -> u32_min_value <S2SV_ModEnd> ; dst_reg -> <S2SV_ModStart> = dst_reg -> u32_max_value <S2SV_ModEnd> ; } }
Buggy code:
 static __always_inline int __do_follow_link ( struct path * path, struct nameidata * nd ) { int error ; void * cookie ; struct dentry * dentry = path -> dentry ; touch_atime ( path -> mnt, dentry ) ; nd_set_link ( nd, NULL ) ; if ( path -> mnt!= nd -> path. mnt ) { path_to_nameidata ( path, nd ) ; dget ( dentry ) ; } mntget ( path -> mnt ) ; <START_BUG> cookie = dentry -> d_inode -> i_op -> follow_link ( dentry, nd ) ; <END_BUG> error = PTR_ERR ( cookie ) ; if (! IS_ERR ( cookie ) ) { char * s = nd_get_link ( nd ) ; error = 0 ; if ( s ) error = __vfs_follow_link ( nd, s ) ; else if ( nd -> last_type == LAST_BIND ) { error = force_reval_path ( & nd -> path, nd ) ; if ( error ) path_put ( & nd -> path ) ; } if ( dentry -> d_inode -> i_op -> put_link ) dentry -> d_inode -> i_op -> put_link ( dentry, nd, cookie ) ; } return error ; }

Fix:
<S2SV_ModStart> mnt ) ; nd -> last_type = LAST_BIND ;