nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int mountpoint_last ( struct nameidata * nd, struct path * path ) { int error = 0 ; struct dentry * dentry ; struct dentry * dir = nd -> path. dentry ; if ( nd -> flags & LOOKUP_RCU ) { if ( unlazy_walk ( nd, NULL ) ) { error = - ECHILD ; goto out ; } } nd -> flags &= ~ LOOKUP_PARENT ; if ( unlikely ( nd -> last_type!= LAST_NORM ) ) { error = handle_dots ( nd, nd -> last_type ) ; if ( error ) goto out ; dentry = dget ( nd -> path. dentry ) ; goto done ; } mutex_lock ( & dir -> d_inode -> i_mutex ) ; dentry = d_lookup ( dir, & nd -> last ) ; if (! dentry ) { dentry = d_alloc ( dir, & nd -> last ) ; if (! dentry ) { error = - ENOMEM ; mutex_unlock ( & dir -> d_inode -> i_mutex ) ; goto out ; } dentry = lookup_real ( dir -> d_inode, dentry, nd -> flags ) ; error = PTR_ERR ( dentry ) ; if ( IS_ERR ( dentry ) ) { mutex_unlock ( & dir -> d_inode -> i_mutex ) ; goto out ; } } mutex_unlock ( & dir -> d_inode -> i_mutex ) ; done : if (! dentry -> d_inode || d_is_negative ( dentry ) ) { error = - ENOENT ; dput ( dentry ) ; goto out ; } path -> dentry = dentry ; <START_BUG> path -> mnt = mntget ( nd -> path. mnt ) ; <END_BUG> if ( should_follow_link ( dentry, nd -> flags & LOOKUP_FOLLOW ) ) return 1 ;  follow_mount ( path ) ; <START_BUG> error = 0 ; out : terminate_walk ( nd ) ; return error ; }<END_BUG>

Fix:
<S2SV_ModStart> -> mnt = <S2SV_ModEnd> nd -> path <S2SV_ModStart> path. mnt <S2SV_ModEnd> ; if ( <S2SV_ModStart> return 1 ; mntget ( path -> mnt ) ;
Buggy code:
 static void print_value ( int output, int num, const char * devname, const char * value, const char * name, size_t valsz ) { if ( output & OUTPUT_VALUE_ONLY ) { fputs ( value, stdout ) ; fputc ( '\\n', stdout ) ; } else if ( output & OUTPUT_UDEV_LIST ) { print_udev_format ( name, value ) ; } else if ( output & OUTPUT_EXPORT_LIST ) { if ( num == 1 && devname ) printf ( "DEVNAME=%s\\n", devname ) ; fputs ( name, stdout ) ; fputs ( "=", stdout ) ; <START_BUG> safe_print ( value, valsz, NULL ) ; <END_BUG> fputs ( "\\n", stdout ) ; } else { if ( num == 1 && devname ) printf ( "%s:", devname ) ; fputs ( "   ", stdout ) ; fputs ( name, stdout ) ; fputs ( "=\\"", stdout ) ;  safe_print ( value, valsz, "\\"" ) ; <START_BUG> fputs ( "\\"", stdout ) ; } }<END_BUG>

Fix:
<S2SV_ModStart>, valsz, " <S2SV_blank> \\\\\\"\'$`<>" <S2SV_ModEnd> ) ; fputs <S2SV_ModStart>, valsz, "\\"\\\\" ) ; fputs ( "\\"" <S2SV_ModEnd>, stdout )
Buggy code:
 <START_BUG> void vp9_idct16x16_add ( const int16_t * input, uint8_t * dest, int stride, <END_BUG> int eob ) { if ( eob == 1 )  vp9_idct16x16_1_add ( input, dest, stride ) ; <START_BUG> else if ( eob <= 10 ) <END_BUG> vp9_idct16x16_10_add ( input, dest, stride ) ;  else <START_BUG> vp9_idct16x16_256_add ( input, dest, stride ) ; <END_BUG> }

Fix:
<S2SV_ModStart> vp9_idct16x16_add ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> == 1 ) vpx_idct16x16_1_add <S2SV_ModEnd> ( input, <S2SV_ModStart> <= 10 ) vpx_idct16x16_10_add <S2SV_ModEnd> ( input, <S2SV_ModStart> ) ; else vpx_idct16x16_256_add <S2SV_ModEnd> ( input,
Buggy code:
 void vp8_fix_contexts ( MACROBLOCKD * x ) { if ( x -> mode_info_context -> mbmi. mode!= B_PRED && x -> mode_info_context -> mbmi. mode!= SPLITMV ) { <START_BUG> vpx_memset ( x -> above_context, 0, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memset ( x -> left_context, 0, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> } else { <END_BUG> vpx_memset ( x -> above_context, 0, sizeof ( ENTROPY_CONTEXT_PLANES ) - 1 ) ;  <START_BUG> vpx_memset ( x -> left_context, 0, sizeof ( ENTROPY_CONTEXT_PLANES ) - 1 ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> SPLITMV ) { memset <S2SV_ModEnd> ( x -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( x -> <S2SV_ModStart> } else { memset <S2SV_ModEnd> ( x -> <S2SV_ModStart> 1 ) ; memset <S2SV_ModEnd> ( x ->
Buggy code:
 static int pfkey_recvmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct pfkey_sock * pfk = pfkey_sk ( sk ) ; struct sk_buff * skb ; int copied, err ; err = - EINVAL ; if ( flags & ~ ( MSG_PEEK | MSG_DONTWAIT | MSG_TRUNC | MSG_CMSG_COMPAT ) ) goto out ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> skb = skb_recv_datagram ( sk, flags, flags & MSG_DONTWAIT, & err ) ; if ( skb == NULL ) goto out ; copied = skb -> len ; if ( copied > len ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } skb_reset_transport_header ( skb ) ; err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto out_free ; sock_recv_ts_and_drops ( msg, sk, skb ) ; err = ( flags & MSG_TRUNC )? skb -> len : copied ; if ( pfk -> dump. dump!= NULL && 3 * atomic_read ( & sk -> sk_rmem_alloc ) <= sk -> sk_rcvbuf ) pfkey_do_dump ( pfk ) ; out_free : skb_free_datagram ( sk, skb ) ; out : return err ; }

Fix:
<S2SV_ModStart> goto out ; <S2SV_ModEnd> skb = skb_recv_datagram
Buggy code:
 static int logi_dj_raw_event ( struct hid_device * hdev, struct hid_report * report, u8 * data, int size ) { struct dj_receiver_dev * djrcv_dev = hid_get_drvdata ( hdev ) ; struct dj_report * dj_report = ( struct dj_report * ) data ; unsigned long flags ; bool report_processed = false ; <START_BUG> dbg_hid ( "%s,   size:%d\\n", __func__, size ) ; <END_BUG> spin_lock_irqsave ( & djrcv_dev -> lock, flags ) ; if ( dj_report -> report_id == REPORT_ID_DJ_SHORT ) { switch ( dj_report -> report_type ) { case REPORT_TYPE_NOTIF_DEVICE_PAIRED : case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : logi_dj_recv_queue_notification ( djrcv_dev, dj_report ) ; break ; case REPORT_TYPE_NOTIF_CONNECTION_STATUS : if ( dj_report -> report_params [ CONNECTION_STATUS_PARAM_STATUS ] == STATUS_LINKLOSS ) { logi_dj_recv_forward_null_report ( djrcv_dev, dj_report ) ; } break ; default : logi_dj_recv_forward_report ( djrcv_dev, dj_report ) ; } report_processed = true ; } spin_unlock_irqrestore ( & djrcv_dev -> lock, flags ) ; return report_processed ; }

Fix:
<S2SV_ModStart> size ) ; if ( ( dj_report -> device_index < DJ_DEVICE_INDEX_MIN ) || ( dj_report -> device_index > DJ_DEVICE_INDEX_MAX ) ) { dev_err ( & hdev -> dev, "%s: <S2SV_blank> invalid <S2SV_blank> device <S2SV_blank> index:%d\\n", __func__, dj_report -> device_index ) ; return false ; }
Buggy code:
 int mlx4_register_vlan ( struct mlx4_dev * dev, u8 port, u16 vlan, int * index ) { struct mlx4_vlan_table * table = & mlx4_priv ( dev ) -> port [ port ]. vlan_table ; int i, err = 0 ; int free = - 1 ; mutex_lock ( & table -> mutex ) ; for ( i = MLX4_VLAN_REGULAR ; i < MLX4_MAX_VLAN_NUM ; i ++ ) { if ( free < 0 && ( table -> refs [ i ] == 0 ) ) { free = i ; continue ; } if ( table -> refs [ i ] && ( vlan == ( MLX4_VLAN_MASK & be32_to_cpu ( table -> entries [ i ] ) ) ) ) { * index = i ; ++ table -> refs [ i ] ; goto out ; <START_BUG> } <END_BUG> } if ( table -> total == table -> max ) { err = - ENOSPC ; goto out ; } table -> refs [ free ] = 1 ; table -> entries [ free ] = cpu_to_be32 ( vlan | MLX4_VLAN_VALID ) ; err = mlx4_set_port_vlan_table ( dev, port, table -> entries ) ; if ( unlikely ( err ) ) { mlx4_warn ( dev, "Failed   adding   vlan:   %u\\n", vlan ) ; table -> refs [ free ] = 0 ; table -> entries [ free ] = 0 ; goto out ; } * index = free ; ++ table -> total ; out : mutex_unlock ( & table -> mutex ) ; return err ; }

Fix:
<S2SV_ModStart> out ; } } if ( free < 0 ) { err = - ENOMEM ; goto out ;
Buggy code:
 <START_BUG> void bpf_map_inc ( struct bpf_map * map, bool uref ) <END_BUG> {  atomic_inc ( & map -> refcnt ) ; <START_BUG> if ( uref ) atomic_inc ( & map -> usercnt ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> struct bpf_map * <S2SV_ModEnd> bpf_map_inc ( struct <S2SV_ModStart> uref ) { if ( atomic_inc_return ( & map -> refcnt ) > BPF_MAX_REFCNT ) { atomic_dec <S2SV_ModEnd> ( & map <S2SV_ModStart> refcnt ) ; return ERR_PTR ( - EBUSY ) ; } <S2SV_ModStart> usercnt ) ; return map ;
Buggy code:
 static int efx_probe_all ( struct efx_nic * efx ) { int rc ; rc = efx_probe_nic ( efx ) ; if ( rc ) { netif_err ( efx, probe, efx -> net_dev, "failed   to   create   NIC\\n" ) ; goto fail1 ; } rc = efx_probe_port ( efx ) ; if ( rc ) { netif_err ( efx, probe, efx -> net_dev, "failed   to   create   port\\n" ) ; goto fail2 ; } <START_BUG> efx -> rxq_entries = efx -> txq_entries = EFX_DEFAULT_DMAQ_SIZE ; <END_BUG> rc = efx_probe_channels ( efx ) ; if ( rc ) goto fail3 ; rc = efx_probe_filters ( efx ) ; if ( rc ) { netif_err ( efx, probe, efx -> net_dev, "failed   to   create   filter   tables\\n" ) ; goto fail4 ; } return 0 ; fail4 : efx_remove_channels ( efx ) ; fail3 : efx_remove_port ( efx ) ; fail2 : efx_remove_nic ( efx ) ; fail1 : return rc ; }

Fix:
<S2SV_ModStart> fail2 ; } BUILD_BUG_ON ( EFX_DEFAULT_DMAQ_SIZE < EFX_RXQ_MIN_ENT ) ; if ( WARN_ON ( EFX_DEFAULT_DMAQ_SIZE < EFX_TXQ_MIN_ENT ( efx ) ) ) { rc = - EINVAL ; goto fail3 ; }
Buggy code:
 PyObject * ast2obj_expr ( void * _o ) { expr_ty o = ( expr_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } switch ( o -> kind ) { case BoolOp_kind : result = PyType_GenericNew ( BoolOp_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_boolop ( o -> v. BoolOp. op ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_op, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. BoolOp. values, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_values, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case BinOp_kind : result = PyType_GenericNew ( BinOp_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_expr ( o -> v. BinOp. left ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_left, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_operator ( o -> v. BinOp. op ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_op, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> v. BinOp. right ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_right, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case UnaryOp_kind : result = PyType_GenericNew ( UnaryOp_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_unaryop ( o -> v. UnaryOp.

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } switch
Buggy code:
 static char * __filterQuotedShell ( const char * arg ) { r_return_val_if_fail ( arg, NULL ) ; char * a = malloc ( strlen ( arg ) + 1 ) ; if (! a ) { return NULL ; } char * b = a ; while ( * arg ) { switch ( * arg ) { case' ': case '=' : <START_BUG> case '\\r' : <END_BUG> case '\\n' : break ; default : * b ++ = * arg ; break ; } arg ++ ; } * b = 0 ; return a ; }

Fix:
<S2SV_ModStart> '=' : case \'"\' : case '\\\\' : case
Buggy code:
 void cipso_v4_sock_delattr ( struct sock * sk ) { int hdr_delta ; <START_BUG> struct ip_options * opt ; <END_BUG> struct inet_sock * sk_inet ; sk_inet = inet_sk ( sk ) ;  opt = sk_inet -> opt ; <START_BUG> <END_BUG> if ( opt == NULL || opt -> cipso == 0 )  return ; <START_BUG> hdr_delta = cipso_v4_delopt ( & sk_inet -> opt ) ; <END_BUG> if ( sk_inet -> is_icsk && hdr_delta > 0 ) { struct inet_connection_sock * sk_conn = inet_csk ( sk ) ; sk_conn -> icsk_ext_hdr_len -= hdr_delta ; sk_conn -> icsk_sync_mss ( sk, sk_conn -> icsk_pmtu_cookie ) ; } }

Fix:
<S2SV_ModStart> hdr_delta ; struct ip_options_rcu <S2SV_ModEnd> * opt ; <S2SV_ModStart> ; opt = rcu_dereference_protected ( sk_inet -> inet_opt, 1 ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> || opt -> opt. <S2SV_ModStart> & sk_inet -> inet_opt <S2SV_ModEnd> ) ; if
Buggy code:
 int bt_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; struct sk_buff * skb ; size_t copied ; int err ; BT_DBG ( "sock   %p   sk   %p   len   %zu", sock, sk, len ) ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; <START_BUG> skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; <END_BUG> if (! skb ) { if ( sk -> sk_shutdown & RCV_SHUTDOWN ) return 0 ; return err ; }  msg -> msg_namelen = 0 ; <START_BUG> copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } skb_reset_transport_header ( skb ) ; err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err == 0 ) sock_recv_ts_and_drops ( msg, sk, skb ) ; skb_free_datagram ( sk, skb ) ; return err? : copied ; }<END_BUG>

Fix:
<S2SV_ModStart> - EOPNOTSUPP ; msg -> msg_namelen = 0 ; <S2SV_ModStart> err ; } <S2SV_ModEnd> copied = skb
Buggy code:
 static int svc_can_register ( const uint16_t * name, size_t name_len, pid_t spid, uid_t uid ) { const char * perm = "add" ; <START_BUG> return check_mac_perms_from_lookup ( spid, uid, perm, str8 ( name, name_len ) )? 1 : 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> = "add" ; if ( uid >= AID_APP ) { return 0 ; }
Buggy code:
 static int cxusb_ctrl_msg ( struct dvb_usb_device * d, u8 cmd, u8 * wbuf, int wlen, u8 * rbuf, int rlen ) { struct cxusb_state * st = d -> priv ; <START_BUG> int ret, wo ; <END_BUG> if ( 1 + wlen > MAX_XFER_SIZE ) { warn ( "i2c   wr:   len=%d   is   too   big!\\n", wlen ) ; return - EOPNOTSUPP ; }  wo = ( rbuf == NULL || rlen == 0 ) ; <START_BUG> mutex_lock ( & d -> data_mutex ) ; st -> data [ 0 ] = cmd ; memcpy ( & st -> data [ 1 ], wbuf, wlen ) ; <END_BUG> if ( wo )  ret = dvb_usb_generic_write ( d, st -> data, 1 + wlen ) ; else ret = dvb_usb_generic_rw ( d, st -> data, 1 + wlen, <START_BUG> rbuf, rlen, 0 ) ; <END_BUG> mutex_unlock ( & d -> data_mutex ) ; return ret ; }

Fix:
<S2SV_ModStart> ; int ret <S2SV_ModEnd> ; if ( <S2SV_ModStart> EOPNOTSUPP ; } if ( rlen > MAX_XFER_SIZE ) { warn ( "i2c <S2SV_blank> rd: <S2SV_blank> len=%d <S2SV_blank> is <S2SV_blank> too <S2SV_blank> big!\\n", rlen ) ; return - EOPNOTSUPP ; } <S2SV_ModEnd> mutex_lock ( & <S2SV_ModStart> wlen ) ; <S2SV_ModEnd> ret = dvb_usb_generic_rw <S2SV_ModStart> + wlen, st -> data <S2SV_ModEnd>, rlen, <S2SV_ModStart> rlen, 0 ) ; if (! ret && rbuf && rlen ) memcpy ( rbuf, st -> data, rlen
Buggy code:
 static int read_data ( void * opaque, uint8_t * buf, int buf_size ) { struct playlist * v = opaque ; HLSContext * c = v -> parent -> priv_data ; int ret, i ; <START_BUG> int just_opened = 0 ; <END_BUG> restart : if (! v -> needed ) return AVERROR_EOF ; if (! v -> input ) { int64_t reload_interval ; struct segment * seg ; if ( v -> ctx && v -> ctx -> nb_streams ) { v -> needed = 0 ; for ( i = 0 ; i < v -> n_main_streams ; i ++ ) { if ( v -> main_streams [ i ] -> discard < AVDISCARD_ALL ) { v -> needed = 1 ; break ; } } } if (! v -> needed ) { av_log ( v -> parent, AV_LOG_INFO, "No   longer   receiving   playlist   %d\\n", v -> index ) ; return AVERROR_EOF ; } reload_interval = default_reload_interval ( v ) ; reload :  if (! v -> finished && <START_BUG> av_gettime_relative ( ) - v -> last_load_time >= reload_interval ) { if ( ( ret = parse_playlist ( c, v -> url, v, NULL ) ) < 0 ) { av_log ( v -> parent, AV_LOG_WARNING, "Failed   to   reload   playlist   %d\\n", v -> index ) ; return ret ; } reload_interval = v -> target_duration // 2 ; } if ( v -> cur_seq_no < v -> start_seq_no ) { av_log ( NULL, AV_LOG_WARNING, "skipping   %d   segments   ahead,   expired   from   playlists\\n", v -> start_seq_no - v -> cur_seq_no ) ; v -> cur_seq_no = v -> start_seq_no ; } if ( v -> cur_seq_no >= v -> start_seq_no + v -> n_segments ) { if ( v -> finished ) return AVERROR_EOF ; while ( av_gettime_relative ( ) - v -> last_load_time < reload_interval ) { if ( ff_check_interrupt ( c -> interrupt_<END_BUG>

Fix:
<S2SV_ModStart> ; int just_opened = 0 ; int reload_count <S2SV_ModStart> ; reload : reload_count ++ ; if ( reload_count > c -> max_reload ) return AVERROR_EOF ;
Buggy code:
 static int <START_BUG> mptctl_gettargetinfo ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_targetinfo __user * uarg = ( void __user * ) arg ; struct mpt_ioctl_targetinfo karg ;  MPT_ADAPTER * ioc ; <START_BUG> VirtDevice * vdevice ; char * pmem ; <END_BUG> int * pdata ;  int iocnum ; int numDevices = 0 ; int lun ; int maxWordsLeft ; int numBytes ; u8 port ; struct scsi_device * sdev ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_targetinfo ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_gettargetinfo   -   " "Unable   to   read   in   mpt_ioctl_targetinfo   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; <START_BUG> return - EFAULT ; <END_BUG> } if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_gettargetinfo()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo   called.\\n", ioc -> name ) ) ; numBytes = karg. hdr. maxDataSize - sizeof ( mpt_ioctl_header ) ; maxWordsLeft = numBytes // sizeof ( int ) ; port = karg. hdr. port ; if ( maxWordsLeft <= 0 ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo()   -   no   memory   available!\\n", ioc -> name, __FILE__, __LINE__ ) ; return - ENOMEM ; } pmem = kzalloc ( numBytes, GFP_KERNEL ) ; if (! pmem ) { printk ( MYIOC_s_ERR_FMT

Fix:
<S2SV_ModStart> int mptctl_gettargetinfo ( MPT_ADAPTER * ioc, <S2SV_ModStart> mpt_ioctl_targetinfo karg ; <S2SV_ModEnd> VirtDevice * vdevice <S2SV_ModStart> int * pdata <S2SV_ModEnd> ; int numDevices <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; } dctlprintk
Buggy code:
 int yyparse ( void * yyscanner, YR_COMPILER * compiler ) { int yychar ; YY_INITIAL_VALUE ( static YYSTYPE yyval_default ; ) YYSTYPE yylval YY_INITIAL_VALUE ( = yyval_default ) ; int yynerrs ; int yystate ; int yyerrstatus ; yytype_int16 yyssa [ YYINITDEPTH ] ; yytype_int16 * yyss ; yytype_int16 * yyssp ; YYSTYPE yyvsa [ YYINITDEPTH ] ; YYSTYPE * yyvs ; YYSTYPE * yyvsp ; YYSIZE_T yystacksize ; int yyn ; int yyresult ; int yytoken = 0 ; YYSTYPE yyval ; # if YYERROR_VERBOSE char yymsgbuf [ 128 ] ; char * yymsg = yymsgbuf ; YYSIZE_T yymsg_alloc = sizeof yymsgbuf ; # endif # define YYPOPSTACK ( N ) ( yyvsp -= ( N ), yyssp -= ( N ) ) int yylen = 0 ; yyssp = yyss = yyssa ; yyvsp = yyvs = yyvsa ; yystacksize = YYINITDEPTH ; YYDPRINTF ( ( stderr, "Starting   parse\\n" ) ) ; yystate = 0 ; yyerrstatus = 0 ; yynerrs = 0 ; yychar = YYEMPTY ; goto yysetstate ; yynewstate : yyssp ++ ; yysetstate : * yyssp = yystate ; if ( yyss + yystacksize - 1 <= yyssp ) { YYSIZE_T yysize = yyssp - yyss + 1 ; # ifdef yyoverflow { YYSTYPE * yyvs1 = yyvs ; yytype_int16 * yyss1 = yyss ; yyoverflow ( YY_ ( "memory   exhausted" ), & yyss1, yysize * sizeof ( * yyssp ), & yyvs1, yysize * sizeof ( * yyvsp ), & yystacksize ) ; yyss = yyss1 ; yyvs = yyvs1 ; } # else # ifndef YYSTACK_RELOCATE goto yyexhaustedlab ; # else if ( YYMAXDEPTH <= yystack

Fix:
<S2SV_ModStart> ; break ; default : assert ( FALSE ) ; <S2SV_ModStart> } # line 2371 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 834 <S2SV_ModEnd> "grammar.y" { if <S2SV_ModStart> ; break ; default : assert ( FALSE ) ; <S2SV_ModStart> } # line 2409 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 872 <S2SV_ModEnd> "grammar.y" { SIZED_STRING <S2SV_ModStart> } # line 2455 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 918 <S2SV_ModEnd> "grammar.y" { if <S2SV_ModStart> } # line 2478 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 940 <S2SV_ModEnd> "grammar.y" { compiler <S2SV_ModStart> } # line 2491 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 949 <S2SV_ModEnd> "grammar.y" { compiler <S2SV_ModStart> } # line 2504 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 958 <S2SV_ModEnd> "grammar.y" { CHECK_TYPE <S2SV_ModStart> } # line 2523 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 973 <S2SV_ModEnd> "grammar.y" { CHECK_TYPE <S2SV_ModStart> } # line 2539 <S2SV_ModEnd> "grammar.c" break ; <S2SV_ModStart> : # line 985 <S2SV_ModEnd> "grammar.y" {
Buggy code:
 <START_BUG> int file_is_raw ( struct VpxInputContext * input ) { <END_BUG> uint8_t buf [ 32 ] ; int is_raw = 0 ; vpx_codec_stream_info_t si ; si. sz = sizeof ( si ) ; if ( fread ( buf, 1, 32, input -> file ) == 32 ) { int i ; if ( mem_get_le32 ( buf ) < 256 * 1024 * 1024 ) { for ( i = 0 ; i < get_vpx_decoder_count ( ) ; ++ i ) { const VpxInterface * const decoder = get_vpx_decoder_by_index ( i ) ;  if (! vpx_codec_peek_stream_info ( decoder -> interface ( ), <START_BUG> buf + 4, 32 - 4, & si ) ) { is_raw = 1 ; input -> fourcc = decoder -> fourcc ; input -> width = si. w ; input -> height = si. h ; input -> framerate. numerator = 30 ; input -> framerate. denominator = 1 ; break ; } } } } rewind ( input -> file ) ; return is_raw ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> ( decoder -> codec_interface <S2SV_ModEnd> ( ),
Buggy code:
 static void show_object ( struct object * obj, <START_BUG> struct strbuf * path, const char * component, <END_BUG> void * cb_data ) { struct rev_list_info * info = cb_data ;  finish_object ( obj, path, component, cb_data ) ; <START_BUG> if ( info -> flags & REV_LIST_QUIET ) return ; <END_BUG> show_object_with_name ( stdout, obj, path, component ) ;  }

Fix:
<S2SV_ModStart> * obj, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name <S2SV_ModEnd>, void * <S2SV_ModStart> ( obj, name <S2SV_ModEnd>, cb_data ) <S2SV_ModStart>, obj, name <S2SV_ModEnd> ) ; }
Buggy code:
 static void hid_input_field ( struct hid_device * hid, struct hid_field * field, __u8 * data, int interrupt ) { unsigned n ; unsigned count = field -> report_count ; unsigned offset = field -> report_offset ; unsigned size = field -> report_size ; __s32 min = field -> logical_minimum ; __s32 max = field -> logical_maximum ; __s32 * value ; value = kmalloc ( sizeof ( __s32 ) * count, GFP_ATOMIC ) ; if (! value ) return ; for ( n = 0 ; n < count ; n ++ ) { value [ n ] = min < 0? snto32 ( hid_field_extract ( hid, data, offset + n * size, size ), size ) : hid_field_extract ( hid, data, offset + n * size, size ) ; if (! ( field -> flags & HID_MAIN_ITEM_VARIABLE ) && <START_BUG> value [ n ] >= min && value [ n ] <= max && <END_BUG> field -> usage [ value [ n ] - min ]. hid == HID_UP_KEYBOARD + 1 ) goto exit ; } for ( n = 0 ; n < count ; n ++ ) { if ( HID_MAIN_ITEM_VARIABLE & field -> flags ) { hid_process_event ( hid, field, & field -> usage [ n ], value [ n ], interrupt ) ; continue ; } if ( field -> value [ n ] >= min && field -> value [ n ] <= max  && field -> usage [ field -> value [ n ] - min ]. hid <START_BUG> && search ( value, field -> value [ n ], count ) ) hid_process_event ( hid, field, & field -> usage [ field -> value [ n ] - min ], 0, interrupt ) ; if ( value [ n ] >= min && value [ n ] <= max <END_BUG> && field -> usage [ value [ n ] - min ]. hid  && search ( field -> value, value [ n ], count ) ) hid_process_event ( hid, field, & field -> usage [ value [ n ] - min ], 1, interrupt ) ; } memcpy ( field -> value, value, count * sizeof ( __s32 ) )

Fix:
<S2SV_ModStart> ] <= max && value [ n ] - min < field -> maxusage <S2SV_ModStart> && field -> value [ n ] - min < field -> maxusage && field -> <S2SV_ModStart> <= max && value [ n ] - min < field -> maxusage &&
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_slice_data ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 end_of_slice_flag ; sps_t * ps_sps ; pps_t * ps_pps ; slice_header_t * ps_slice_hdr ; WORD32 end_of_pic ; tile_t * ps_tile, * ps_tile_prev ; WORD32 i ; WORD32 ctb_addr ; WORD32 tile_idx ; WORD32 cabac_init_idc ; WORD32 ctb_size ; WORD32 num_ctb_in_row ; WORD32 num_min4x4_in_ctb ; WORD32 slice_qp ; WORD32 slice_start_ctb_idx ; WORD32 tile_start_ctb_idx ; ps_slice_hdr = ps_codec -> s_parse. ps_slice_hdr_base ; ps_pps = ps_codec -> s_parse. ps_pps_base ; ps_sps = ps_codec -> s_parse. ps_sps_base ; ps_slice_hdr += ( ps_codec -> s_parse. i4_cur_slice_idx & ( MAX_SLICE_HDR_CNT - 1 ) ) ; ps_pps += ps_slice_hdr -> i1_pps_id ; ps_sps += ps_pps -> i1_sps_id ; if ( 0!= ps_codec -> s_parse. i4_cur_slice_idx ) { if (! ps_slice_hdr -> i1_dependent_slice_flag ) { ps_codec -> s_parse. i4_cur_independent_slice_idx = ps_codec -> s_parse. i4_cur_slice_idx & ( MAX_SLICE_HDR_CNT - 1 ) ; } } ctb_size = 1 << ps_sps -> i1_log2_ctb_size ; num_min4x4_in_ctb = ( ctb_size // 4 ) * ( ctb_size // 4 ) ; num_ctb_in_row =

Fix:
<S2SV_ModStart> ) ) { ret = <S2SV_ModStart> ] ) ; if ( ret!= ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ) { ps_codec -> i4_slice_error = 1 ; end_of_slice_flag = 1 ; ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; } <S2SV_ModStart> } } { ret = <S2SV_ModStart> ] ) ; if ( ret!= ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ) { ps_codec -> i4_slice_error = 1 ; end_of_slice_flag = 1 ; ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; } <S2SV_ModStart> default_ctxt ) { ret = <S2SV_ModStart> ] ) ; if ( ret!= ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ) { ps_codec -> i4_slice_error = 1 ; end_of_slice_flag = 1 ; ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; } <S2SV_ModStart> } else { ret = <S2SV_ModStart> au1_ctxt_models_sync ) ; if ( ret!= ( IHEVCD_
Buggy code:
 int VP8_UVSSE ( MACROBLOCK * x ) { unsigned char * uptr, * vptr ; unsigned char * upred_ptr = ( * ( x -> block [ 16 ]. base_src ) + x -> block [ 16 ]. src ) ; unsigned char * vpred_ptr = ( * ( x -> block [ 20 ]. base_src ) + x -> block [ 20 ]. src ) ; int uv_stride = x -> block [ 16 ]. src_stride ; unsigned int sse1 = 0 ; unsigned int sse2 = 0 ; int mv_row = x -> e_mbd. mode_info_context -> mbmi. mv. as_mv. row ; int mv_col = x -> e_mbd. mode_info_context -> mbmi. mv. as_mv. col ; int offset ; int pre_stride = x -> e_mbd. pre. uv_stride ; if ( mv_row < 0 ) mv_row -= 1 ; else mv_row += 1 ; if ( mv_col < 0 ) mv_col -= 1 ; else mv_col += 1 ; mv_row //= 2 ; mv_col //= 2 ; offset = ( mv_row >> 3 ) * pre_stride + ( mv_col >> 3 ) ; uptr = x -> e_mbd. pre. u_buffer + offset ; vptr = x -> e_mbd. pre. v_buffer + offset ; if ( ( mv_row | mv_col ) & 7 ) { <START_BUG> vp8_sub_pixel_variance8x8 ( uptr, pre_stride, <END_BUG> mv_col & 7, mv_row & 7, upred_ptr, uv_stride, & sse2 ) ;  vp8_sub_pixel_variance8x8 ( vptr, pre_stride, <START_BUG> mv_col & 7, mv_row & 7, vpred_ptr, uv_stride, & sse1 ) ; sse2 += sse1 ; } else { <END_BUG> vp8_variance8x8 ( uptr, pre_stride,  upred_ptr, uv_stride, & sse2 ) ; <START_BUG> vp8_variance8x8 ( vptr, pre_stride, <END_BUG> vpred_ptr, uv_stride, & sse1 ) ; sse2 += sse1 ; } return sse2 ; }

Fix:
<S2SV_ModStart> 7 ) { vpx_sub_pixel_variance8x8 <S2SV_ModEnd> ( uptr, <S2SV_ModStart> sse2 ) ; vpx_sub_pixel_variance8x8 <S2SV_ModEnd> ( vptr, <S2SV_ModStart> } else { vpx_variance8x8 <S2SV_ModEnd> ( uptr, <S2SV_ModStart> sse2 ) ; vpx_variance8x8 <S2SV_ModEnd> ( vptr,
Buggy code:
 static int mboxlist_do_find ( struct find_rock * rock, const strarray_t * patterns ) { const char * userid = rock -> userid ; int isadmin = rock -> isadmin ; int crossdomains = config_getswitch ( IMAPOPT_CROSSDOMAINS ) ; char inbox [ MAX_MAILBOX_BUFFER ] ; size_t inboxlen = 0 ; size_t prefixlen, len ; size_t domainlen = 0 ; size_t userlen = userid? strlen ( userid ) : 0 ; char domainpat [ MAX_MAILBOX_BUFFER ] ; char commonpat [ MAX_MAILBOX_BUFFER ] ; int r = 0 ; int i ; const char * p ; if ( patterns -> count < 1 ) return 0 ; for ( i = 0 ; i < patterns -> count ; i ++ ) { glob * g = glob_init ( strarray_nth ( patterns, i ), rock -> namespace -> hier_sep ) ; ptrarray_append ( & rock -> globs, g ) ; } if ( config_virtdomains && userid && ( p = strchr ( userid, '@' ) ) ) { userlen = p - userid ; domainlen = strlen ( p ) ; snprintf ( domainpat, sizeof ( domainpat ), "%s!", p + 1 ) ; } else domainpat [ 0 ] = '\\0' ; if ( userid && (! ( p = strchr ( userid, rock -> namespace -> hier_sep ) ) || ( ( p - userid ) > ( int ) userlen ) ) && strlen ( userid ) + 7 < MAX_MAILBOX_BUFFER ) { char * t, * tmpuser = NULL ; const char * inboxuser ; if ( domainlen ) snprintf ( inbox, sizeof ( inbox ), "%s!", userid + userlen + 1 ) ; if ( rock -> namespace -> hier_sep == '//' && ( p = strchr ( userid, '.' ) ) ) { tmpuser = xmalloc ( userlen ) ; memcpy ( tmpuser, userid, userlen ) ; t = tmpuser + ( p - userid ) ; while ( t < ( tmpuser + userlen ) ) { if ( * t == '.' ) * t = '^' ; t ++ ; } inboxuser = tmpuser ; } else inboxuser = userid ; snprintf ( inbox + domainlen, sizeof ( inbox ) - domain

Fix:
<S2SV_ModStart> if ( prefixlen <= <S2SV_ModEnd> len ) {
Buggy code:
 static struct sk_buff * xfrm_state_netlink ( struct sk_buff * in_skb, struct xfrm_state * x, u32 seq ) { struct xfrm_dump_info info ; <START_BUG> struct sk_buff * skb ; <END_BUG> skb = nlmsg_new ( NLMSG_DEFAULT_SIZE, GFP_ATOMIC ) ; if (! skb ) return ERR_PTR ( - ENOMEM ) ; info. in_skb = in_skb ; info. out_skb = skb ; info. nlmsg_seq = seq ; info. nlmsg_flags = 0 ;  if ( dump_one_state ( x, 0, & info ) ) { <START_BUG> kfree_skb ( skb ) ; <END_BUG> return NULL ;  } return skb ; }

Fix:
<S2SV_ModStart> sk_buff * skb ; int err <S2SV_ModStart> = 0 ; err = <S2SV_ModEnd> dump_one_state ( x <S2SV_ModStart> & info ) ; if ( err <S2SV_ModStart> ) ; return ERR_PTR ( err ) <S2SV_ModEnd> ; } return
Buggy code:
 void impeg2d_dec_pic_data_thread ( dec_state_t * ps_dec ) { WORD32 i4_continue_decode ; WORD32 i4_cur_row, temp ; UWORD32 u4_bits_read ; WORD32 i4_dequeue_job ; IMPEG2D_ERROR_CODES_T e_error ; i4_cur_row = ps_dec -> u2_mb_y + 1 ; i4_continue_decode = 1 ; i4_dequeue_job = 1 ; do { if ( i4_cur_row > ps_dec -> u2_num_vert_mb ) { i4_continue_decode = 0 ; break ; } { if ( ( ps_dec -> i4_num_cores > 1 ) && ( i4_dequeue_job ) ) { job_t s_job ; IV_API_CALL_STATUS_T e_ret ; UWORD8 * pu1_buf ; e_ret = impeg2_jobq_dequeue ( ps_dec -> pv_jobq, & s_job, sizeof ( s_job ), 1, 1 ) ; if ( e_ret!= IV_SUCCESS ) break ; if ( CMD_PROCESS == s_job. i4_cmd ) { pu1_buf = ps_dec -> pu1_inp_bits_buf + s_job. i4_bistream_ofst ; impeg2d_bit_stream_init ( & ( ps_dec -> s_bit_stream ), pu1_buf, ( ps_dec -> u4_num_inp_bytes - s_job. i4_bistream_ofst ) + 8 ) ; i4_cur_row = s_job. i2_start_mb_y ; ps_dec -> i4_start_mb_y = s_job. i2_start_mb_y ; ps_dec -> i4_end_mb_y = s_job. i2_end_mb_y ; ps_dec -> u2_mb_x = 0 ; ps_dec -> u2_mb_y = ps_dec -> i4_start_mb_y ; ps_dec -> u2_num_mbs_left = ( ps_dec -> i4_end

Fix:
<S2SV_ModStart> ; if ( 1 == ps_dec -> i4_num_cores && 0 == ps_dec -> u2_num_mbs_left ) { i4_continue_decode = 0 ; android_errorWriteLog ( 0x534e4554, "26070014" ) ; } if (
Buggy code:
 int ip6_fragment ( struct sk_buff * skb, int ( * output ) ( struct sk_buff * ) ) { struct sk_buff * frag ; struct rt6_info * rt = ( struct rt6_info * ) skb_dst ( skb ) ; struct ipv6_pinfo * np = skb -> sk? inet6_sk ( skb -> sk ) : NULL ; struct ipv6hdr * tmp_hdr ; struct frag_hdr * fh ; unsigned int mtu, hlen, left, len ; __be32 frag_id = 0 ; int ptr, offset = 0, err = 0 ; u8 * prevhdr, nexthdr = 0 ; struct net * net = dev_net ( skb_dst ( skb ) -> dev ) ; hlen = ip6_find_1stfragopt ( skb, & prevhdr ) ; nexthdr = * prevhdr ; mtu = ip6_skb_dst_mtu ( skb ) ; if (! skb -> local_df && skb -> len > mtu ) { skb -> dev = skb_dst ( skb ) -> dev ; icmpv6_send ( skb, ICMPV6_PKT_TOOBIG, 0, mtu ) ; IP6_INC_STATS ( net, ip6_dst_idev ( skb_dst ( skb ) ), IPSTATS_MIB_FRAGFAILS ) ; kfree_skb ( skb ) ; return - EMSGSIZE ; } if ( np && np -> frag_size < mtu ) { if ( np -> frag_size ) mtu = np -> frag_size ; } mtu -= hlen + sizeof ( struct frag_hdr ) ; if ( skb_has_frag_list ( skb ) ) { int first_len = skb_pagelen ( skb ) ; struct sk_buff * frag2 ; if ( first_len - hlen > mtu || ( ( first_len - hlen ) & 7 ) || skb_cloned ( skb ) ) goto slow_path ; skb_walk_frags ( skb, frag ) { if ( frag -> len > mtu || ( ( frag -> len & 7 ) && frag -> next ) || skb_headroom ( frag ) < hlen )

Fix:
<S2SV_ModStart> ipv6_select_ident ( fh, rt <S2SV_ModStart> ipv6_select_ident ( fh, rt
Buggy code:
 void print_arrays_for ( char * set ) { FILE * f ; <START_BUG> sprintf ( buf, "%s.conf", set ) ; <END_BUG> if ( ( f = fopen ( buf, "r" ) ) == NULL ) { fprintf ( stderr, "%s:   can\'t   read   conf   file   for   charset   %s\\n", prog, set ) ; exit ( EXIT_FAILURE ) ; }  printf ( "\\\n         \\n\\n", <START_BUG> set, prog ) ; print_array ( f, set, "ctype", CTYPE_TABLE_SIZE ) ; print_array ( f, set, "to_lower", TO_LOWER_TABLE_SIZE ) ; print_array ( f, set, "to_upper", TO_UPPER_TABLE_SIZE ) ; print_array ( f, set, "sort_order", SORT_ORDER_TABLE_SIZE ) ; printf ( "\\n" ) ; fclose ( f ) ; return ; }<END_BUG>

Fix:
<S2SV_ModStart> * f ; snprintf ( buf, sizeof ( buf ) <S2SV_ModEnd>, "%s.conf", <S2SV_ModStart> } printf ( "\\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> \\n\\n" <S2SV_ModEnd>, set,
Buggy code:
 static inline int ip6_ufo_append_data ( struct sock * sk, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int hh_len, int fragheaderlen, int transhdrlen, int mtu, unsigned int flags, struct rt6_info * rt ) { struct sk_buff * skb ; int err ; if ( ( skb = skb_peek_tail ( & sk -> sk_write_queue ) ) == NULL ) { <START_BUG> skb = sock_alloc_send_skb ( sk, <END_BUG> hh_len + fragheaderlen + transhdrlen + 20, ( flags & MSG_DONTWAIT ), & err ) ; if ( skb == NULL ) return err ; skb_reserve ( skb, hh_len ) ; skb_put ( skb, fragheaderlen + transhdrlen ) ; skb_reset_network_header ( skb ) ; skb -> transport_header = skb -> network_header + fragheaderlen ; skb -> protocol = htons ( ETH_P_IPV6 ) ; skb -> ip_summed = CHECKSUM_PARTIAL ;  skb -> csum = 0 ; <START_BUG> } err = skb_append_datato_frags ( sk, skb, getfrag, from, ( length - transhdrlen ) ) ; if (! err ) { struct frag_hdr fhdr ; skb_shinfo ( skb ) -> gso_size = ( mtu - fragheaderlen - sizeof ( struct frag_hdr ) ) & ~ 7 ; skb_shinfo ( skb ) -> gso_type = SKB_GSO_UDP ; ipv6_select_ident ( & fhdr, rt ) ; skb_shinfo ( skb ) -> ip6_frag_id = fhdr. identification ; __skb_queue_tail ( & sk -> sk_write_queue, skb ) ; <END_BUG> return 0 ;  } kfree_skb ( skb ) ; return err ; }

Fix:
<S2SV_ModStart> NULL ) { struct frag_hdr fhdr ; <S2SV_ModStart> csum = 0 <S2SV_ModEnd> ; skb_shinfo ( <S2SV_ModStart> skb ) ; } return skb_append_datato_frags ( sk, skb, getfrag, from, ( length - transhdrlen ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static void process_blob ( struct rev_info * revs, struct blob * blob, show_object_fn show, struct strbuf * path, const char * name, void * cb_data ) { struct object * obj = & blob -> object ; <START_BUG> if (! revs -> blob_objects ) <END_BUG> return ; if (! obj ) die ( "bad   blob   object" ) ; if ( obj -> flags & ( UNINTERESTING | SEEN ) ) return ; obj -> flags |= SEEN ;  show ( obj, path, name, cb_data ) ; <START_BUG> <END_BUG> } 

Fix:
<S2SV_ModStart> -> object ; size_t pathlen ; <S2SV_ModStart> |= SEEN ; pathlen = path -> len ; strbuf_addstr ( path, name ) ; <S2SV_ModStart> obj, path -> buf <S2SV_ModEnd>, cb_data ) <S2SV_ModStart> cb_data ) ; strbuf_setlen ( path, pathlen ) ;
Buggy code:
 <START_BUG> void oz_hcd_get_desc_cnf ( void * hport, u8 req_id, int status, const u8 * desc, <END_BUG>  int length, int offset, int total_size ) <START_BUG> { struct oz_port * port = hport ; struct urb * urb ; int err = 0 ; oz_dbg ( ON, "oz_hcd_get_desc_cnf   length   =   %d   offs   =   %d   tot_size   =   %d\\n", length, offset, total_size ) ; urb = oz_find_urb_by_id ( port, 0, req_id ) ; if (! urb ) return ; if ( status == 0 ) { <END_BUG> int copy_len ;  <START_BUG> int required_size = urb -> transfer_buffer_length ; <END_BUG> if ( required_size > total_size ) required_size = total_size ; copy_len = required_size - offset ; if ( length <= copy_len ) copy_len = length ; memcpy ( urb -> transfer_buffer + offset, desc, copy_len ) ; offset += copy_len ; if ( offset < required_size ) { struct usb_ctrlrequest * setup = ( struct usb_ctrlrequest * ) urb -> setup_packet ; unsigned wvalue = le16_to_cpu ( setup -> wValue ) ; if ( oz_enqueue_ep_urb ( port, 0, 0, urb, req_id ) ) err = - ENOMEM ; else if ( oz_usb_get_desc_req ( port -> hpd, req_id, setup -> bRequestType, ( u8 ) ( wvalue >> 8 ), ( u8 ) wvalue, setup -> wIndex, offset, required_size - offset ) ) { oz_dequeue_ep_urb ( port, 0, 0, urb ) ; err = - ENOMEM ; } if ( err == 0 ) return ; } } urb -> actual_length = total_size ; oz_complete_urb ( port -> ozhcd -> hcd, urb, 0 ) ; }

Fix:
<S2SV_ModStart> u8 req_id, u8 <S2SV_ModEnd> status, const <S2SV_ModStart> * desc, u8 length, u16 offset, u16 <S2SV_ModEnd> total_size ) { <S2SV_ModStart> 0 ) { unsigned <S2SV_ModStart> int copy_len ; unsigned
Buggy code:
 int rds_rdma_extra_size ( struct rds_rdma_args * args ) { struct rds_iovec vec ; struct rds_iovec __user * local_vec ; int tot_pages = 0 ; unsigned int nr_pages ; unsigned int i ; <START_BUG> local_vec = ( struct rds_iovec __user * ) ( unsigned long ) args -> local_vec_addr ; <END_BUG> for ( i = 0 ; i < args -> nr_local ; i ++ ) { if ( copy_from_user ( & vec, & local_vec [ i ], sizeof ( struct rds_iovec ) ) ) return - EFAULT ; nr_pages = rds_pages_in_vec ( & vec ) ; if ( nr_pages == 0 ) return - EINVAL ; tot_pages += nr_pages ; if ( tot_pages < 0 ) return - EINVAL ; } return tot_pages * sizeof ( struct scatterlist ) ; }

Fix:
<S2SV_ModStart> args -> local_vec_addr ; if ( args -> nr_local == 0 ) return - EINVAL
Buggy code:
 static bool add_free_nid ( struct f2fs_sb_info * sbi, nid_t nid, bool build ) { struct f2fs_nm_info * nm_i = NM_I ( sbi ) ; <START_BUG> struct free_nid * i ; <END_BUG> struct nat_entry * ne ;  int err ; <START_BUG> if ( unlikely ( nid == 0 ) ) return false ; <END_BUG> if ( build ) {  ne = __lookup_nat_cache ( nm_i, nid ) ; if ( ne && (! get_nat_flag ( ne, IS_CHECKPOINTED ) || nat_get_blkaddr ( ne )!= NULL_ADDR ) ) <START_BUG> return false ; <END_BUG> } i = f2fs_kmem_cache_alloc ( free_nid_slab, GFP_NOFS ) ; i -> nid = nid ; i -> state = NID_NEW ; if ( radix_tree_preload ( GFP_NOFS ) ) { kmem_cache_free ( free_nid_slab, i ) ; return true ; } spin_lock ( & nm_i -> nid_list_lock ) ; err = __insert_nid_to_list ( sbi, i, FREE_NID_LIST, true ) ; spin_unlock ( & nm_i -> nid_list_lock ) ; radix_tree_preload_end ( ) ; if ( err ) { kmem_cache_free ( free_nid_slab, i ) ; return true ; } return true ; }

Fix:
<S2SV_ModStart> free_nid * i, * e <S2SV_ModStart> ; int err = - EINVAL ; bool ret = false <S2SV_ModStart> return false ; i = f2fs_kmem_cache_alloc ( free_nid_slab, GFP_NOFS ) ; i -> nid = nid ; i -> state = NID_NEW ; if ( radix_tree_preload ( GFP_NOFS ) ) goto err ; spin_lock ( & nm_i -> nid_list_lock ) ; <S2SV_ModStart> NULL_ADDR ) ) goto err_out ; e = __lookup_free_nid_list ( nm_i, nid ) ; if ( e ) { if ( e -> state == NID_NEW ) ret = true ; goto err_out ; } } ret = true ; err = __insert_nid_to_list ( sbi, i, FREE_NID_LIST, true ) ; err_out : spin_unlock ( & nm_i -> nid_list_lock ) ; radix_tree_preload_end ( ) ; err : if ( err ) kmem_cache_free ( free_nid_slab, i ) ; return ret <S2SV_ModEnd> ; } <S2SV
Buggy code:
 static PyObject * builtin_compile_impl ( PyObject * module, PyObject * source, PyObject * filename, const char * mode, int flags, int dont_inherit, int optimize ) { PyObject * source_copy ; const char * str ; int compile_mode = - 1 ; int is_ast ; PyCompilerFlags cf ; <START_BUG> int start [ ] = { Py_file_input, Py_eval_input, Py_single_input } ; <END_BUG> PyObject * result ; cf. cf_flags = flags | PyCF_SOURCE_IS_UTF8 ; if ( flags &  ~ ( PyCF_MASK | PyCF_MASK_OBSOLETE | PyCF_DONT_IMPLY_DEDENT | PyCF_ONLY_AST ) ) <START_BUG> { PyErr_SetString ( PyExc_ValueError, "compile():   unrecognised   flags" ) ; goto error ; } if ( optimize < - 1 || optimize > 2 ) { PyErr_SetString ( PyExc_ValueError, "compile():   invalid   optimize   value" ) ; goto error ; } if (! dont_inherit ) { PyEval_MergeCompilerFlags ( & cf ) ; } if ( strcmp ( mode, "exec" ) == 0 ) compile_mode = 0 ; else if ( strcmp ( mode, "eval" ) == 0 ) compile_mode = 1 ; else if ( strcmp ( mode, "single" ) == 0 ) compile_mode = 2 ; <END_BUG> else {  PyErr_SetString ( PyExc_ValueError, <START_BUG> "compile()   mode   must   be   \'exec\',   \'eval\'   or   \'single\'" ) ; <END_BUG> goto error ; } is_ast = PyAST_Check ( source ) ; if ( is_ast == - 1 ) goto error ; if ( is_ast ) { if ( flags & PyCF_ONLY_AST ) { Py_INCREF ( source ) ; result = source ; } else { PyArena * arena ; mod_ty mod ; arena = PyArena_New ( ) ; if ( arena == NULL ) goto error ; mod = PyAST_obj2mod ( source, arena, compile_mode ) ; if ( mod == NULL ) { PyArena_Free ( arena ) ; goto error ; } if (! PyAST_Validate ( mod ) ) {

Fix:
<S2SV_ModStart> Py_eval_input, Py_single_input, Py_func_type_input <S2SV_ModStart> PyCF_DONT_IMPLY_DEDENT | PyCF_ONLY_AST | PyCF_TYPE_COMMENTS <S2SV_ModStart> 2 ; else if ( strcmp ( mode, "func_type" ) == 0 ) { if (! ( flags & PyCF_ONLY_AST ) ) <S2SV_ModStart> ( PyExc_ValueError, "compile() <S2SV_blank> mode <S2SV_blank> \'func_type\' <S2SV_blank> requires <S2SV_blank> flag <S2SV_blank> PyCF_ONLY_AST" ) ; goto error ; } compile_mode = 3 ; } else { const char * msg ; if ( flags & PyCF_ONLY_AST ) msg = "compile() <S2SV_blank> mode <S2SV_blank> must <S2SV_blank> be <S2SV_blank> \'exec\', <S2SV_blank> \'eval\', <S2SV_blank> \'single\' <S2SV_blank> or <S2SV_blank> \'func_type\'" ; else msg = "compile() <S2SV_blank> mode <S2SV_blank> must <S2SV_blank> be <S2SV_blank> \'exec\', <S2SV_blank> \'eval\' <S2SV_blank> or <S2SV_blank> \'single\'" ; PyErr_SetString ( PyExc_ValueError, msg <S2SV_ModEnd> ) ; goto
Buggy code:
 void luaT_adjustvarargs ( lua_State * L, int nfixparams, CallInfo * ci, const Proto * p ) { int i ; int actual = cast_int ( L -> top - ci -> func ) - 1 ; int nextra = actual - nfixparams ; ci -> u. l. nextraargs = nextra ; <START_BUG> checkstackGC ( L, p -> maxstacksize + 1 ) ; <END_BUG> setobjs2s ( L, L -> top ++, ci -> func ) ; for ( i = 1 ; i <= nfixparams ; i ++ ) { setobjs2s ( L, L -> top ++, ci -> func + i ) ; setnilvalue ( s2v ( ci -> func + i ) ) ; } ci -> func += actual + 1 ; ci -> top += actual + 1 ; lua_assert ( L -> top <= ci -> top && ci -> top <= L -> stack_last ) ; }

Fix:
<S2SV_ModStart> = nextra ; luaD_checkstack <S2SV_ModEnd> ( L,
Buggy code:
 int archive_wstring_append_from_mbs ( struct archive_wstring * dest, const char * p, size_t len ) { size_t r ; int ret_val = 0 ; <START_BUG> size_t wcs_length = len ; <END_BUG> size_t mbs_length = len ; const char * mbs = p ; wchar_t * wcs ; # if HAVE_MBRTOWC mbstate_t shift_state ; memset ( & shift_state, 0, sizeof ( shift_state ) ) ; # endif  if ( NULL == archive_wstring_ensure ( dest, dest -> length + wcs_length + 1 ) ) <START_BUG> return ( - 1 ) ; wcs = dest -> s + dest -> length ; while ( * mbs && mbs_length > 0 ) { <END_BUG> if ( wcs_length == 0 ) {  dest -> length = wcs - dest -> s ; dest -> s [ dest -> length ] = L'\\0' ; <START_BUG> wcs_length = mbs_length ; <END_BUG> if ( NULL == archive_wstring_ensure ( dest, dest -> length + wcs_length + 1 ) ) return ( - 1 ) ; wcs = dest -> s + dest -> length ; } # if HAVE_MBRTOWC r = mbrtowc ( wcs, mbs, wcs_length, & shift_state ) ; # else r = mbtowc ( wcs, mbs, wcs_length ) ; # endif if ( r == ( size_t ) - 1 || r == ( size_t ) - 2 ) { ret_val = - 1 ; if ( errno == EILSEQ ) { ++ mbs ; -- mbs_length ; continue ; } else break ; } if ( r == 0 || r > mbs_length ) break ; wcs ++ ; wcs_length -- ; mbs += r ; mbs_length -= r ; } dest -> length = wcs - dest -> s ; dest -> s [ dest -> length ] = L'\\0' ; return ( ret_val ) ; }

Fix:
<S2SV_ModStart> 0 ; size_t <S2SV_ModEnd> mbs_length = len <S2SV_ModStart> -> length + len <S2SV_ModEnd> + 1 ) <S2SV_ModStart> 0 ) { # if HAVE_MBRTOWC r = mbrtowc ( wcs, mbs, mbs_length, & shift_state ) ; # else r = mbtowc ( wcs, mbs, mbs_length ) ; # endif if ( r == ( size_t ) - 1 || r == ( size_t ) - 2 ) { ret_val = - 1 ; break ; } if ( r == 0 || r > mbs_length ) break ; wcs ++ ; mbs += r ; mbs_length -= r ; } <S2SV_ModEnd> dest -> length <S2SV_ModStart> = L'\\0' ; <S2SV_ModEnd> return ( ret_val
Buggy code:
 int tcp_disconnect ( struct sock * sk, int flags ) { struct inet_sock * inet = inet_sk ( sk ) ; struct inet_connection_sock * icsk = inet_csk ( sk ) ; struct tcp_sock * tp = tcp_sk ( sk ) ; int err = 0 ; int old_state = sk -> sk_state ; if ( old_state!= TCP_CLOSE ) tcp_set_state ( sk, TCP_CLOSE ) ; if ( old_state == TCP_LISTEN ) { inet_csk_listen_stop ( sk ) ; } else if ( unlikely ( tp -> repair ) ) { sk -> sk_err = ECONNABORTED ; } else if ( tcp_need_reset ( old_state ) || ( tp -> snd_nxt!= tp -> write_seq && ( 1 << old_state ) & ( TCPF_CLOSING | TCPF_LAST_ACK ) ) ) { tcp_send_active_reset ( sk, gfp_any ( ) ) ; sk -> sk_err = ECONNRESET ; } else if ( old_state == TCP_SYN_SENT ) sk -> sk_err = ECONNRESET ; tcp_clear_xmit_timers ( sk ) ; __skb_queue_purge ( & sk -> sk_receive_queue ) ; tcp_write_queue_purge ( sk ) ; tcp_fastopen_active_disable_ofo_check ( sk ) ; skb_rbtree_purge ( & tp -> out_of_order_queue ) ; inet -> inet_dport = 0 ; if (! ( sk -> sk_userlocks & SOCK_BINDADDR_LOCK ) ) inet_reset_saddr ( sk ) ; sk -> sk_shutdown = 0 ; sock_reset_flag ( sk, SOCK_DONE ) ; tp -> srtt_us = 0 ; tp -> write_seq += tp -> max_window + 2 ; if ( tp -> write_seq == 0 ) tp -> write_seq = 1 ; icsk -> icsk_backoff = 0 ; tp -> snd_cwnd = 2 ; icsk -> icsk_probes_out = 0 ; tp -> packets_out = 0 ; tp -> snd_ssthresh = TCP_INFINITE_SSTHRESH ; tp -> snd_cwnd

Fix:
<S2SV_ModStart> sk ) ; icsk -> icsk_ack. rcv_mss = TCP_MIN_MSS ;
Buggy code:
 <START_BUG> static vpx_codec_err_t ctrl_set_svc_layer_id ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_svc_layer_id_t * const data = va_arg ( args, vpx_svc_layer_id_t * ) ; VP9_COMP * const cpi = ( VP9_COMP * ) ctx -> cpi ; SVC * const svc = & cpi -> svc ; svc -> spatial_layer_id = data -> spatial_layer_id ; svc -> temporal_layer_id = data -> temporal_layer_id ; if ( svc -> temporal_layer_id < 0 || svc -> temporal_layer_id >= ( int ) ctx -> cfg. ts_number_layers ) { return VPX_CODEC_INVALID_PARAM ; } if ( svc -> spatial_layer_id < 0 || svc -> spatial_layer_id >= ( int ) ctx -> cfg. ss_number_layers ) { return VPX_CODEC_INVALID_PARAM ; } return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static int kempf_decode_tile ( G2MContext * c, int tile_x, int tile_y, const uint8_t * src, int src_size ) { int width, height ; int hdr, zsize, npal, tidx = - 1, ret ; int i, j ; const uint8_t * src_end = src + src_size ; uint8_t pal [ 768 ], transp [ 3 ] ; uLongf dlen = ( c -> tile_width + 1 ) * c -> tile_height ; int sub_type ; int nblocks, cblocks, bstride ; int bits, bitbuf, coded ; uint8_t * dst = c -> framebuf + tile_x * c -> tile_width * 3 + tile_y * c -> tile_height * c -> framebuf_stride ; if ( src_size < 2 ) return AVERROR_INVALIDDATA ; width = FFMIN ( c -> width - tile_x * c -> tile_width, c -> tile_width ) ; height = FFMIN ( c -> height - tile_y * c -> tile_height, c -> tile_height ) ; hdr = * src ++ ; sub_type = hdr >> 5 ; if ( sub_type == 0 ) { int j ; memcpy ( transp, src, 3 ) ; src += 3 ; for ( j = 0 ; j < height ; j ++, dst += c -> framebuf_stride ) for ( i = 0 ; i < width ; i ++ ) memcpy ( dst + i * 3, transp, 3 ) ; return 0 ; } else if ( sub_type == 1 ) { return jpg_decode_data ( & c -> jc, width, height, src, src_end - src, dst, c -> framebuf_stride, NULL, 0, 0, 0 ) ; } if ( sub_type!= 2 ) { memcpy ( transp, src, 3 ) ; src += 3 ; } npal = * src ++ + 1 ; memcpy ( pal, src, npal * 3 ) ; src += npal * 3 ; if ( sub_type!= 2 ) { for ( i = 0 ; i < npal ; i ++ ) { if (! memcmp ( pal + i * 3, transp, 3 ) ) { tidx

Fix:
<S2SV_ModStart> src < zsize + ( sub_type!= 2 ) <S2SV_ModStart> bits ) { if ( src >= src_end ) return AVERROR_INVALIDDATA ;
Buggy code:
 static int replace_map_fd_with_map_ptr ( struct verifier_env * env ) { struct bpf_insn * insn = env -> prog -> insnsi ; int insn_cnt = env -> prog -> len ; int i, j ; for ( i = 0 ; i < insn_cnt ; i ++, insn ++ ) { if ( BPF_CLASS ( insn -> code ) == BPF_LDX && ( BPF_MODE ( insn -> code )!= BPF_MEM || insn -> imm!= 0 ) ) { verbose ( "BPF_LDX   uses   reserved   fields\\n" ) ; return - EINVAL ; } if ( BPF_CLASS ( insn -> code ) == BPF_STX && ( ( BPF_MODE ( insn -> code )!= BPF_MEM && BPF_MODE ( insn -> code )!= BPF_XADD ) || insn -> imm!= 0 ) ) { verbose ( "BPF_STX   uses   reserved   fields\\n" ) ; return - EINVAL ; } if ( insn [ 0 ]. code == ( BPF_LD | BPF_IMM | BPF_DW ) ) { struct bpf_map * map ; struct fd f ; if ( i == insn_cnt - 1 || insn [ 1 ]. code!= 0 || insn [ 1 ]. dst_reg!= 0 || insn [ 1 ]. src_reg!= 0 || insn [ 1 ]. off!= 0 ) { verbose ( "invalid   bpf_ld_imm64   insn\\n" ) ; return - EINVAL ; } if ( insn -> src_reg == 0 ) goto next_insn ; if ( insn -> src_reg!= BPF_PSEUDO_MAP_FD ) { verbose ( "unrecognized   bpf_ld_imm64   insn\\n" ) ; return - EINVAL ; } f = fdget ( insn -> imm ) ; map = __bpf_map_get ( f ) ; if ( IS_ERR ( map ) ) { verbose ( "fd   %d   is   not   pointing   to   valid   bpf_map\\n", insn -> imm ) ; return PTR_ERR ( map ) ; } insn [ 0 ]. imm = ( u32 ) (

Fix:
<S2SV_ModStart> E2BIG ; } map = bpf_map_inc ( map, false ) ; if ( IS_ERR ( map ) ) { fdput ( f ) ; return PTR_ERR ( map ) ; } <S2SV_ModStart> = map ; <S2SV_ModEnd> fdput ( f