nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int xfrm_user_rcv_msg ( struct sk_buff * skb, struct nlmsghdr * nlh, struct netlink_ext_ack * extack ) { struct net * net = sock_net ( skb -> sk ) ; struct nlattr * attrs [ XFRMA_MAX + 1 ] ; const struct xfrm_link * link ; int type, err ; # ifdef CONFIG_COMPAT if ( in_compat_syscall ( ) ) return - EOPNOTSUPP ; # endif type = nlh -> nlmsg_type ; if ( type > XFRM_MSG_MAX ) return - EINVAL ; type -= XFRM_MSG_BASE ; link = & xfrm_dispatch [ type ] ; if (! netlink_net_capable ( skb, CAP_NET_ADMIN ) ) return - EPERM ; if ( ( type == ( XFRM_MSG_GETSA - XFRM_MSG_BASE ) || type == ( XFRM_MSG_GETPOLICY - XFRM_MSG_BASE ) ) && ( nlh -> nlmsg_flags & NLM_F_DUMP ) ) { if ( link -> dump == NULL ) return - EINVAL ; { struct netlink_dump_control c = { <START_BUG>. dump = link -> dump, <END_BUG>. done = link -> done, } ; return netlink_dump_start ( net -> xfrm. nlsk, skb, nlh, & c ) ; } } err = nlmsg_parse ( nlh, xfrm_msg_min [ type ], attrs, link -> nla_max? : XFRMA_MAX, link -> nla_pol? : xfrma_policy, extack ) ; if ( err < 0 ) return err ; if ( link -> doit == NULL ) return - EINVAL ; return link -> doit ( skb, nlh, attrs ) ; }

Fix:
<S2SV_ModStart> = {. start = link -> start,.
Buggy code:
 vpx_codec_err_t vpx_svc_init ( SvcContext * svc_ctx, vpx_codec_ctx_t * codec_ctx, vpx_codec_iface_t * iface, vpx_codec_enc_cfg_t * enc_cfg ) { <START_BUG> int max_intra_size_pct ; <END_BUG> vpx_codec_err_t res ;  SvcInternal * const si = get_svc_internal ( svc_ctx ) ; <START_BUG> if ( svc_ctx == NULL || codec_ctx == NULL || iface == NULL || enc_cfg == NULL ) { return VPX_CODEC_INVALID_PARAM ; } if ( si == NULL ) return VPX_CODEC_MEM_ERROR ; si -> codec_ctx = codec_ctx ; si -> width = enc_cfg -> g_w ; si -> height = enc_cfg -> g_h ; if ( enc_cfg -> kf_max_dist < 2 ) { svc_log ( svc_ctx, SVC_LOG_ERROR, "key   frame   distance   too   small:   %d\\n", enc_cfg -> kf_max_dist ) ; return VPX_CODEC_INVALID_PARAM ; } si -> kf_dist = enc_cfg -> kf_max_dist ; if ( svc_ctx -> spatial_layers == 0 ) svc_ctx -> spatial_layers = VPX_SS_DEFAULT_LAYERS ; if ( svc_ctx -> spatial_layers < 1 || svc_ctx -> spatial_layers > VPX_SS_MAX_LAYERS ) { svc_log ( svc_ctx, SVC_LOG_ERROR, "spatial   layers:   invalid   value:   %d\\n", svc_ctx -> spatial_layers ) ; return VPX_CODEC_INVALID_PARAM ; } <END_BUG> res = parse_quantizer_values ( svc_ctx, si -> quantizers, 0 ) ;  if ( res!= VPX_CODEC_OK ) return res ; <START_BUG> res = parse_quantizer_values ( svc_ctx, si -> quantizers_keyframe, 1 ) ; <END_BUG> if ( res!= VPX_CODEC_OK )  memcpy ( si -> quantizer_keyframe, si -> quantizer, sizeof ( si -> quantizer ) ) ; <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> enc_cfg ) { <S2SV_ModEnd> vpx_codec_err_t res ; <S2SV_ModStart> vpx_codec_err_t res ; int i ; SvcInternal_t <S2SV_ModEnd> * const si <S2SV_ModStart> VPX_CODEC_INVALID_PARAM ; } if ( svc_ctx -> temporal_layering_mode == 3 ) { svc_ctx -> temporal_layers = 3 ; } else if ( svc_ctx -> temporal_layering_mode == 2 ) { svc_ctx -> temporal_layers = 2 ; } for ( i = 0 ; i < VPX_SS_MAX_LAYERS ; ++ i ) { si -> svc_params. max_quantizers [ i ] = MAX_QUANTIZER ; si -> svc_params. min_quantizers [ i ] = 0 ; si -> svc_params. scaling_factor_num [ i ] = DEFAULT_SCALE_FACTORS_NUM [ i ] ; si -> svc_params. scaling_factor_den [ i ] = DEFAULT_SCALE_FACTORS_DEN [ i ] ; } res = parse_options ( svc_ctx, si -> options <S2SV_ModEnd> ) ; if <S2SV_ModStart> return res ; if ( svc_ctx -> spatial_layers < 1
Buggy code:
 GF_Err abst_box_read ( GF_Box * s, GF_BitStream * bs ) { GF_AdobeBootstrapInfoBox * ptr = ( GF_AdobeBootstrapInfoBox * ) s ; int i ; u32 tmp_strsize ; char * tmp_str ; GF_Err e ; ISOM_DECREASE_SIZE ( ptr, 25 ) ptr -> bootstrapinfo_version = gf_bs_read_u32 ( bs ) ; ptr -> profile = gf_bs_read_int ( bs, 2 ) ; ptr -> live = gf_bs_read_int ( bs, 1 ) ; ptr -> update = gf_bs_read_int ( bs, 1 ) ; ptr -> reserved = gf_bs_read_int ( bs, 4 ) ; ptr -> time_scale = gf_bs_read_u32 ( bs ) ; ptr -> current_media_time = gf_bs_read_u64 ( bs ) ; ptr -> smpte_time_code_offset = gf_bs_read_u64 ( bs ) ; i = 0 ; if ( ptr -> size < 8 ) return GF_ISOM_INVALID_FILE ; tmp_strsize = ( u32 ) ptr -> size - 8 ; tmp_str = gf_malloc ( sizeof ( char ) * tmp_strsize ) ; if (! tmp_str ) return GF_OUT_OF_MEM ; memset ( tmp_str, 0, sizeof ( char ) * tmp_strsize ) ; while ( tmp_strsize ) { <START_BUG> tmp_str [ i ] = gf_bs_read_u8 ( bs ) ; <END_BUG> tmp_strsize -- ; if (! tmp_str [ i ] ) break ; i ++ ; } if ( i ) { ptr -> movie_identifier = gf_strdup ( tmp_str ) ; }  ptr -> server_entry_count = gf_bs_read_u8 ( bs ) ; <START_BUG> for ( i = 0 ; i < ptr -> server_entry_count ; i ++ ) { int j = 0 ; <END_BUG> tmp_strsize = ( u32 ) ptr -> size - 8 ;  while ( tmp_strsize ) { <START_BUG> tmp_str [ j ] = gf_bs_read_u8 ( bs ) ; <END_BUG> tmp_strsize -- ; if (

Fix:
<S2SV_ModStart> tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ) ; } ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ptr -> size <S2SV_ModEnd> ; while ( <S2SV_ModStart> tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ; } } ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ptr -> size <S2SV_ModEnd> ; while ( <S2SV_ModStart> tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ptr -> size <S2SV_ModEnd> ; while ( <S2SV_ModStart> tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ptr -> size <S2SV_ModEnd> ; while ( <S2SV_ModStart> tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ) ; } ISOM_DECREASE_SIZE ( ptr, 1 ) <S2SV_ModStart> ) ; } ISOM_DECREASE_SIZE ( ptr, 1 )
Buggy code:
 BITMAP_UPDATE * update_read_bitmap_update ( rdpUpdate * update, wStream * s ) { UINT32 i ; BITMAP_UPDATE * bitmapUpdate = calloc ( 1, sizeof ( BITMAP_UPDATE ) ) ; if (! bitmapUpdate ) goto fail ; if ( Stream_GetRemainingLength ( s ) < 2 ) goto fail ; Stream_Read_UINT16 ( s, bitmapUpdate -> number ) ; WLog_Print ( update -> log, WLOG_TRACE, "BitmapUpdate:   %" PRIu32 "", bitmapUpdate -> number ) ; if ( bitmapUpdate -> number > bitmapUpdate -> count ) { <START_BUG> UINT16 count ; <END_BUG> BITMAP_DATA * newdata ; count = bitmapUpdate -> number * 2 ;  newdata = ( BITMAP_DATA * ) realloc ( bitmapUpdate -> rectangles, <START_BUG> sizeof ( BITMAP_DATA ) * count ) ; if (! newdata ) goto fail ; bitmapUpdate -> rectangles = newdata ; ZeroMemory ( & bitmapUpdate -> rectangles [ bitmapUpdate -> count ], sizeof ( BITMAP_DATA ) * ( count - bitmapUpdate -> count ) ) ; bitmapUpdate -> count = count ; } for ( i = 0 ; i < bitmapUpdate -> number ; i ++ ) { if (! update_read_bitmap_data ( update, s, & bitmapUpdate -> rectangles [ i ] ) ) goto fail ; } return bitmapUpdate ; fail : free_bitmap_update ( update -> context, bitmapUpdate ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> count ) { UINT32 <S2SV_ModEnd> count = bitmapUpdate <S2SV_ModStart> * 2 ; BITMAP_DATA *
Buggy code:
 static void Sp_replace_regexp ( js_State * J ) { js_Regexp * re ; const char * source, * s, * r ; js_Buffer * sb = NULL ; int n, x ; Resub m ; source = checkstring ( J, 0 ) ; re = js_toregexp ( J, 1 ) ; <START_BUG> if ( js_regexec ( re -> prog, source, & m, 0 ) ) { <END_BUG> js_copy ( J, 0 ) ; return ; } re -> last = 0 ; loop : s = m. sub [ 0 ]. sp ; n = m. sub [ 0 ]. ep - m. sub [ 0 ]. sp ; if ( js_iscallable ( J, 2 ) ) { js_copy ( J, 2 ) ; js_pushundefined ( J ) ; for ( x = 0 ; m. sub [ x ]. sp ; ++ x ) js_pushlstring ( J, m. sub [ x ]. sp, m. sub [ x ]. ep - m. sub [ x ]. sp ) ; js_pushnumber ( J, s - source ) ; js_copy ( J, 0 ) ; js_call ( J, 2 + x ) ; r = js_tostring ( J, - 1 ) ; js_putm ( J, & sb, source, s ) ; js_puts ( J, & sb, r ) ; js_pop ( J, 1 ) ; } else { r = js_tostring ( J, 2 ) ; js_putm ( J, & sb, source, s ) ; while ( * r ) { if ( * r == '$' ) { switch ( * ( ++ r ) ) { case 0 : -- r ; case '$' : js_putc ( J, & sb, '$' ) ; break ; case '`' : js_putm ( J, & sb, source, s ) ; break ; case '\\'' : js_puts ( J, & sb, s + n ) ; break ; case '&' : js_putm ( J, & sb, s, s + n ) ; break ; case '0' : case '1' : case '2' : case '3' : case '4' : case '5' : case '6' : case '7' : case '8' : case '9' : x = * r - '

Fix:
<S2SV_ModStart> ; if ( js_doregexec ( J, <S2SV_ModEnd> re -> prog <S2SV_ModStart> if (! js_doregexec ( J, <S2SV_ModEnd> re -> prog
Buggy code:
 static Image * ReadPSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BoundingBox "BoundingBox:" # define BeginDocument "BeginDocument:" # define BeginXMPPacket "<?xpacket   begin=" # define EndXMPPacket "<?xpacket   end=" # define ICCProfile "BeginICCProfile:" # define CMYKCustomColor "CMYKCustomColor:" # define CMYKProcessColor "CMYKProcessColor:" # define DocumentMedia "DocumentMedia:" # define DocumentCustomColors "DocumentCustomColors:" # define DocumentProcessColors "DocumentProcessColors:" # define EndDocument "EndDocument:" # define HiResBoundingBox "HiResBoundingBox:" # define ImageData "ImageData:" # define PageBoundingBox "PageBoundingBox:" # define LanguageLevel "LanguageLevel:" # define PageMedia "PageMedia:" # define Pages "Pages:" # define PhotoshopProfile "BeginPhotoshop:" # define PostscriptLevel "!PS-" # define RenderPostscriptText "     Rendering   Postscript...     " # define SpotColor "+   " char command [ MagickPathExtent ], * density, filename [ MagickPathExtent ], geometry [ MagickPathExtent ], input_filename [ MagickPathExtent ], message [ MagickPathExtent ], * options, postscript_filename [ MagickPathExtent ] ; const char * option ; const DelegateInfo * delegate_info ; GeometryInfo geometry_info ; Image * image, * next, * postscript_image ; ImageInfo * read_info ; int c, file ; MagickBooleanType cmyk, fitPage, skip, status ; MagickStatusType flags ; PointInfo delta, resolution ; RectangleInfo page ; register char * p ; register ssize_t i ; SegmentInfo bounds, hires_bounds ; short int hex_digits [ 256 ] ; size_t length ; ssize_t count, priority ; StringInfo * profile ; unsigned long columns, extent, language_level, pages, rows, scene, spotcolor ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo *

Fix:
<S2SV_ModStart> "`%s\'", option ) ; page_geometry = DestroyString ( page_geometry
Buggy code:
 void vp9_rc_get_second_pass_params ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; RATE_CONTROL * const rc = & cpi -> rc ; <START_BUG> struct twopass_rc * const twopass = & cpi -> twopass ; <END_BUG> int frames_left ; FIRSTPASS_STATS this_frame ;  FIRSTPASS_STATS this_frame_copy ; <START_BUG> <END_BUG> double this_frame_intra_error ;  double this_frame_coded_error ; int target ; LAYER_CONTEXT * lc = NULL ; <START_BUG> int is_spatial_svc = ( cpi -> use_svc && cpi -> svc. number_temporal_layers == 1 ) ; <END_BUG> if ( is_spatial_svc ) {  lc = & cpi -> svc. layer_context [ cpi -> svc. spatial_layer_id ] ; <START_BUG> frames_left = ( int ) ( twopass -> total_stats. count - lc -> current_video_frame_in_layer ) ; } else { frames_left = ( int ) ( twopass -> total_stats. count - <END_BUG> cm -> current_video_frame ) ;  } if (! twopass -> stats_in ) return ; if ( cpi -> refresh_alt_ref_frame ) { cm -> frame_type = INTER_FRAME ; vp9_rc_set_frame_target ( cpi, twopass -> gf_bits ) ; return ; } vp9_clear_system_state ( ) ; if ( is_spatial_svc && twopass -> kf_intra_err_min == 0 ) { twopass -> kf_intra_err_min = KF_MB_INTRA_MIN * cpi -> common. MBs ; twopass -> gf_intra_err_min = GF_MB_INTRA_MIN * cpi -> common. MBs ; } if ( cpi -> oxcf. end_usage == USAGE_CONSTANT_QUALITY ) { twopass -> active_worst_quality = cpi -> oxcf. cq_level ; } else if ( cm -> current_video_frame == 0 || ( is_spatial_svc && lc -> current_video_frame_in

Fix:
<S2SV_ModStart> -> rc ; TWO_PASS <S2SV_ModEnd> * const twopass <S2SV_ModStart> cpi -> twopass ; GF_GROUP * const gf_group = & twopass -> gf_group <S2SV_ModStart> FIRSTPASS_STATS this_frame ; int target_rate ; LAYER_CONTEXT * const lc = is_two_pass_svc ( cpi )? & cpi -> svc. layer_context [ cpi -> svc. spatial_layer_id ] : 0 ; if ( lc!= NULL ) { frames_left = ( int ) ( twopass -> total_stats. count - lc -> current_video_frame_in_layer ) ; } else { frames_left = ( int ) ( twopass -> total_stats. count - cm -> current_video_frame ) ; } if (! twopass -> stats_in ) return ; if ( gf_group -> update_type [ gf_group -> index ] == ARF_UPDATE ) { int target_rate ; configure_buffer_updates ( cpi ) ; target_rate = gf_group -> bit_allocation [ gf_group -> index ] ; target_rate = vp9_rc_clamp_pframe_target_
Buggy code:
 static ssize_t _epoll_readv ( oe_fd_t * desc, const struct oe_iovec * iov, int iovcnt ) { ssize_t ret = - 1 ; epoll_t * file = _cast_epoll ( desc ) ; void * buf = NULL ; size_t buf_size = 0 ; <START_BUG> if (! file || ( iovcnt &&! iov ) || iovcnt < 0 || iovcnt > OE_IOV_MAX ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( iov, iovcnt, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_readv_ocall ( & ret, file -> host_fd, buf, iovcnt, buf_size )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> if ( oe_iov_sync ( iov, iovcnt, buf, buf_size )!= 0 ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; done : if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> = 0 ; size_t data_size = 0 ; <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> } if ( ret > ( ssize_t ) data_size ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; } if (
Buggy code:
 static char * decode_text_string ( const char * str, size_t str_len ) { int idx, is_hex, is_utf16be, ascii_idx ; char * ascii, hex_buf [ 5 ] = { 0 } ; is_hex = is_utf16be = idx = ascii_idx = 0 ; if ( str [ 0 ] == '(' ) { <START_BUG> ascii = malloc ( strlen ( str ) + 1 ) ; <END_BUG> strncpy ( ascii, str, strlen ( str ) + 1 ) ; return ascii ; } else if ( str [ 0 ] == '<' ) { is_hex = 1 ; ++ idx ; } if ( is_hex && ( str_len > 5 ) && ( str [ idx ] == 'F' ) && ( str [ idx + 1 ] == 'E' ) && ( str [ idx + 2 ] == 'F' ) && ( str [ idx + 3 ] == 'F' ) ) { is_utf16be = 1 ; idx += 4 ; } else return NULL ;  ascii = malloc ( str_len ) ; <START_BUG> for ( ; idx < str_len ; ++ idx ) { hex_buf [ 0 ] = str [ idx ++ ] ; hex_buf [ 1 ] = str [ idx ++ ] ; hex_buf [ 2 ] = str [ idx ++ ] ; hex_buf [ 3 ] = str [ idx ] ; ascii [ ascii_idx ++ ] = strtol ( hex_buf, NULL, 16 ) ; } return ascii ; }<END_BUG>

Fix:
<S2SV_ModStart> { ascii = safe_calloc <S2SV_ModEnd> ( strlen ( <S2SV_ModStart> ; ascii = safe_calloc <S2SV_ModEnd> ( str_len )
Buggy code:
 static char * get_header ( FILE * fp ) { <START_BUG> long start ; <END_BUG>  char * header ; <START_BUG> header = calloc ( 1, 1024 ) ; <END_BUG> start = ftell ( fp ) ;  fseek ( fp, 0, SEEK_SET ) ; SAFE_E ( fread ( header, 1, 1023, fp ), 1023, "Failed   to   load   PDF   header.\\n" ) ; fseek ( fp, start, SEEK_SET ) ; return header ; }

Fix:
<S2SV_ModStart> fp ) { <S2SV_ModEnd> char * header <S2SV_ModStart> char * header = safe_calloc ( <S2SV_ModEnd> 1024 ) ; <S2SV_ModStart> 1024 ) ; long
Buggy code:
 static int f_midi_set_alt ( struct usb_function * f, unsigned intf, unsigned alt ) { struct f_midi * midi = func_to_midi ( f ) ; unsigned i ; int err ; if ( intf!= midi -> ms_id ) return 0 ; err = f_midi_start_ep ( midi, f, midi -> in_ep ) ; if ( err ) return err ; err = f_midi_start_ep ( midi, f, midi -> out_ep ) ; if ( err ) return err ; while ( kfifo_avail ( & midi -> in_req_fifo ) ) { struct usb_request * req = midi_alloc_ep_req ( midi -> in_ep, midi -> buflen ) ; if ( req == NULL ) return - ENOMEM ; req -> length = 0 ; req -> complete = f_midi_complete ; kfifo_put ( & midi -> in_req_fifo, req ) ; } for ( i = 0 ; i < midi -> qlen && err == 0 ; i ++ ) { struct usb_request * req = midi_alloc_ep_req ( midi -> out_ep, midi -> buflen ) ; if ( req == NULL ) return - ENOMEM ; req -> complete = f_midi_complete ; err = usb_ep_queue ( midi -> out_ep, req, GFP_ATOMIC ) ; if ( err ) { ERROR ( midi, "%s:   couldn\'t   enqueue   request:   %d\\n", midi -> out_ep -> name, err ) ; <START_BUG> free_ep_req ( midi -> out_ep, req ) ; <END_BUG> return err ; } } return 0 ; }

Fix:
<S2SV_ModStart> err ) ; if ( req -> buf!= NULL )
Buggy code:
 long tty_ioctl ( struct file * file, unsigned int cmd, unsigned long arg ) { struct tty_struct * tty = file_tty ( file ) ; struct tty_struct * real_tty ; void __user * p = ( void __user * ) arg ; int retval ; struct tty_ldisc * ld ; if ( tty_paranoia_check ( tty, file_inode ( file ), "tty_ioctl" ) ) return - EINVAL ; real_tty = tty_pair_get_tty ( tty ) ; switch ( cmd ) { case TIOCSETD : case TIOCSBRK : case TIOCCBRK : case TCSBRK : case TCSBRKP : retval = tty_check_change ( tty ) ; if ( retval ) return retval ; if ( cmd!= TIOCCBRK ) { tty_wait_until_sent ( tty, 0 ) ; if ( signal_pending ( current ) ) return - EINTR ; } break ; } switch ( cmd ) { case TIOCSTI : return tiocsti ( tty, p ) ; case TIOCGWINSZ : return tiocgwinsz ( real_tty, p ) ; case TIOCSWINSZ : return tiocswinsz ( real_tty, p ) ; case TIOCCONS : return real_tty!= tty? - EINVAL : tioccons ( file ) ; case FIONBIO : return fionbio ( file, p ) ; case TIOCEXCL : set_bit ( TTY_EXCLUSIVE, & tty -> flags ) ; return 0 ; case TIOCNXCL : clear_bit ( TTY_EXCLUSIVE, & tty -> flags ) ; return 0 ; case TIOCGEXCL : { int excl = test_bit ( TTY_EXCLUSIVE, & tty -> flags ) ; return put_user ( excl, ( int __user * ) p ) ; } case TIOCNOTTY : if ( current -> signal -> tty!= tty ) return - ENOTTY ; no_tty ( ) ; return 0 ; case TIOCSCTTY : return tiocsctty ( real_tty, file, arg ) ; case TIOCGPGRP : return tiocgpgrp ( tty, real_tty, p ) ; case TIOCSPGR

Fix:
<S2SV_ModStart> TIOCGETD : return tiocgetd ( tty, <S2SV_ModEnd> p ) ;
Buggy code:
 void mono_gc_cleanup ( void ) { # ifdef DEBUG g_message ( "%s:   cleaning   up   finalizer", __func__ ) ; # endif if (! gc_disabled ) { ResetEvent ( shutdown_event ) ; finished = TRUE ; if ( mono_thread_internal_current ( )!= gc_thread ) { mono_gc_finalize_notify ( ) ; if ( WaitForSingleObjectEx ( shutdown_event, 2000, FALSE ) == WAIT_TIMEOUT ) { int ret ; suspend_finalizers = TRUE ; mono_thread_internal_stop ( gc_thread ) ; ret = WaitForSingleObjectEx ( gc_thread -> handle, 100, TRUE ) ; if ( ret == WAIT_TIMEOUT ) { g_warning ( "Shutting   down   finalizer   thread   timed   out." ) ; } else { Sleep ( 100 ) ; } } } gc_thread = NULL ; # ifdef HAVE_BOEHM_GC GC_finalizer_notifier = NULL ; # endif } DeleteCriticalSection ( & handle_section ) ; DeleteCriticalSection ( & allocator_section ) ; DeleteCriticalSection ( & finalizer_mutex ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> finalizer_mutex ) ; DeleteCriticalSection ( & reference_queue_mutex ) ;
Buggy code:
 void test_path_dotgit__dotgit_modules_symlink ( void ) { cl_assert_equal_b ( true, git_path_isvalid ( NULL, ".gitmodules", 0, GIT_PATH_REJECT_DOT_GIT_HFS | GIT_PATH_REJECT_DOT_GIT_NTFS ) ) ; cl_assert_equal_b ( false, git_path_isvalid ( NULL, ".gitmodules", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_HFS ) ) ; cl_assert_equal_b ( false, git_path_isvalid ( NULL, ".gitmodules", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS ) ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> ) ) ; cl_assert_equal_b ( false, git_path_isvalid ( NULL, ".gitmodules <S2SV_blank>. <S2SV_blank>.::$DATA", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS ) ) ;
Buggy code:
 int ip_options_echo ( struct ip_options * dopt, struct sk_buff * skb ) { <START_BUG> struct ip_options * sopt ; <END_BUG> unsigned char * sptr, * dptr ; int soffset, doffset ; int optlen ; __be32 daddr ; memset ( dopt, 0, sizeof ( struct ip_options ) ) ; sopt = & ( IPCB ( skb ) -> opt ) ;  if ( sopt -> optlen == 0 ) { <START_BUG> dopt -> optlen = 0 ; return 0 ; <END_BUG> }  sptr = skb_network_header ( skb ) ; dptr = dopt -> __data ; daddr = skb_rtable ( skb ) -> rt_spec_dst ; if ( sopt -> rr ) { optlen = sptr [ sopt -> rr + 1 ] ; soffset = sptr [ sopt -> rr + 2 ] ; dopt -> rr = dopt -> optlen + sizeof ( struct iphdr ) ; memcpy ( dptr, sptr + sopt -> rr, optlen ) ; if ( sopt -> rr_needaddr && soffset <= optlen ) { if ( soffset + 3 > optlen ) return - EINVAL ; dptr [ 2 ] = soffset + 4 ; dopt -> rr_needaddr = 1 ; } dptr += optlen ; dopt -> optlen += optlen ; } if ( sopt -> ts ) { optlen = sptr [ sopt -> ts + 1 ] ; soffset = sptr [ sopt -> ts + 2 ] ; dopt -> ts = dopt -> optlen + sizeof ( struct iphdr ) ; memcpy ( dptr, sptr + sopt -> ts, optlen ) ; if ( soffset <= optlen ) { if ( sopt -> ts_needaddr ) { if ( soffset + 3 > optlen ) return - EINVAL ; dopt -> ts_needaddr = 1 ; soffset += 4 ; } if ( sopt -> ts_needtime ) { if ( soffset + 3 > optlen ) return - EINVAL ; if ( ( dptr [ 3 ] & 0xF )!= IPOPT_TS_PRESPEC ) { dopt -> ts_needtime = 1 ; soffset += 4 ; } else { dopt ->

Fix:
<S2SV_ModStart> skb ) { const <S2SV_ModStart> == 0 ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> return 0 ; <S2SV_ModEnd> sptr = skb_network_header
Buggy code:
 WORD32 ih264d_create ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { <START_BUG> ih264d_create_op_t * ps_create_op ; <END_BUG>  WORD32 ret ; <START_BUG> ps_create_op = ( ih264d_create_op_t * ) pv_api_op ; ps_create_op -> s_ivd_create_op_t. u4_error_code = 0 ; <END_BUG> ret = ih264d_allocate_static_bufs ( & dec_hdl, pv_api_ip, pv_api_op ) ;  <START_BUG> if ( ( IV_FAIL == ret ) && ( NULL!= dec_hdl ) ) <END_BUG> {  ih264d_free_static_bufs ( dec_hdl ) ; <START_BUG> ps_create_op -> s_ivd_create_op_t. u4_error_code = IVD_MEM_ALLOC_FAILED ; ps_create_op -> s_ivd_create_op_t. u4_error_code = 1 << IVD_FATALERROR ; return IV_FAIL ; } return IV_SUCCESS ; }<END_BUG>

Fix:
<S2SV_ModStart> pv_api_op ) { ih264d_create_ip_t * ps_create_ip ; <S2SV_ModStart> ; WORD32 ret ; ps_create_ip = ( ih264d_create_ip_t * ) pv_api_ip <S2SV_ModStart> = 0 ; dec_hdl = NULL ; <S2SV_ModStart> ; if ( <S2SV_ModEnd> IV_FAIL == ret <S2SV_ModStart> == ret ) { if ( dec_hdl ) { if ( dec_hdl -> pv_codec_handle <S2SV_ModEnd> ) { ih264d_free_static_bufs <S2SV_ModStart> dec_hdl ) ; } else { void ( * pf_aligned_free ) ( void * pv_mem_ctxt, void * pv_buf ) ; void * pv_mem_ctxt ; pf_aligned_free = ps_create_ip -> s_ivd_create_ip_t. pf_aligned_free ; pv_mem_ctxt = ps_create_ip -> s_ivd_create_ip_t. pv_mem_ctxt ; pf_aligned_free ( pv_mem_ctxt, dec_hdl ) ; } }
Buggy code:
 int ieee80211_radiotap_iterator_init ( struct ieee80211_radiotap_iterator * iterator, struct ieee80211_radiotap_header * radiotap_header, int max_length, const struct ieee80211_radiotap_vendor_namespaces * vns ) { <START_BUG> if ( radiotap_header -> it_version ) <END_BUG> return - EINVAL ; if ( max_length < get_unaligned_le16 ( & radiotap_header -> it_len ) ) return - EINVAL ; iterator -> _rtheader = radiotap_header ; iterator -> _max_length = get_unaligned_le16 ( & radiotap_header -> it_len ) ; iterator -> _arg_index = 0 ; iterator -> _bitmap_shifter = get_unaligned_le32 ( & radiotap_header -> it_present ) ; iterator -> _arg = ( uint8_t * ) radiotap_header + sizeof ( * radiotap_header ) ; iterator -> _reset_on_ext = 0 ; iterator -> _next_bitmap = & radiotap_header -> it_present ; iterator -> _next_bitmap ++ ; iterator -> _vns = vns ; iterator -> current_namespace = & radiotap_ns ; iterator -> is_radiotap_ns = 1 ; if ( iterator -> _bitmap_shifter & ( 1 << IEEE80211_RADIOTAP_EXT ) ) { while ( get_unaligned_le32 ( iterator -> _arg ) & ( 1 << IEEE80211_RADIOTAP_EXT ) ) { iterator -> _arg += sizeof ( uint32_t ) ; if ( ( unsigned long ) iterator -> _arg -  ( unsigned long ) iterator -> _rtheader > <START_BUG> ( unsigned long ) iterator -> _max_length ) return - EINVAL ; } iterator -> _arg += sizeof ( uint32_t ) ; } iterator -> this_arg = iterator -> _arg ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> { if ( max_length < sizeof ( struct ieee80211_radiotap_header ) ) return - EINVAL ; if ( <S2SV_ModStart> iterator -> _rtheader + sizeof ( uint32_t )
Buggy code:
 static void setup_decoding_thread_data ( VP8D_COMP * pbi, MACROBLOCKD * xd, MB_ROW_DEC * mbrd, int count ) { VP8_COMMON * const pc = & pbi -> common ; int i ; for ( i = 0 ; i < count ; i ++ ) { MACROBLOCKD * mbd = & mbrd [ i ]. mbd ; mbd -> subpixel_predict = xd -> subpixel_predict ; mbd -> subpixel_predict8x4 = xd -> subpixel_predict8x4 ; mbd -> subpixel_predict8x8 = xd -> subpixel_predict8x8 ; mbd -> subpixel_predict16x16 = xd -> subpixel_predict16x16 ; mbd -> mode_info_context = pc -> mi + pc -> mode_info_stride * ( i + 1 ) ; mbd -> mode_info_stride = pc -> mode_info_stride ; mbd -> frame_type = pc -> frame_type ; mbd -> pre = xd -> pre ; mbd -> dst = xd -> dst ; mbd -> segmentation_enabled = xd -> segmentation_enabled ; mbd -> mb_segement_abs_delta = xd -> mb_segement_abs_delta ; <START_BUG> vpx_memcpy ( mbd -> segment_feature_data, xd -> segment_feature_data, sizeof ( xd -> segment_feature_data ) ) ; <END_BUG>  vpx_memcpy ( mbd -> ref_lf_deltas, xd -> ref_lf_deltas, sizeof ( xd -> ref_lf_deltas ) ) ; <START_BUG> <END_BUG> vpx_memcpy ( mbd -> mode_lf_deltas, xd -> mode_lf_deltas, sizeof ( xd -> mode_lf_deltas ) ) ;  mbd -> mode_ref_lf_delta_enabled = xd -> mode_ref_lf_delta_enabled ; mbd -> mode_ref_lf_delta_update = xd -> mode_ref_lf_delta_update ; mbd -> current_bc = & pbi -> mbc [ 0 ] ; <START_BUG> vpx_memcpy ( mbd -> dequant_y1_dc, xd -> dequant_y1_dc, sizeof ( xd -> dequant<END_BUG>

Fix:
<S2SV_ModStart> -> mb_segement_abs_delta ; memcpy <S2SV_ModEnd> ( mbd -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( mbd -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( mbd -> <S2SV_ModStart> 0 ] ; memcpy <S2SV_ModEnd> ( mbd -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( mbd -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( mbd -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( mbd ->
Buggy code:
 static int run_post_create ( const char * dirname ) { if (! dir_is_in_dump_location ( dirname ) ) { error_msg ( "Bad   problem   directory   name   \'%s\',   should   start   with:   \'%s\'", dirname, g_settings_dump_location ) ; return 400 ; } <START_BUG> if (! dump_dir_accessible_by_uid ( dirname, client_uid ) ) <END_BUG> { if ( errno == ENOTDIR ) { error_msg ( "Path   \'%s\'   isn\'t   problem   directory", dirname ) ; return 404 ; } error_msg ( "Problem   directory   \'%s\'   can\'t   be   accessed   by   user   with   uid   %ld", dirname, ( long ) client_uid ) ; return 403 ; } int child_stdout_fd ; int child_pid = spawn_event_handler_child ( dirname, "post-create", & child_stdout_fd ) ; char * dup_of_dir = NULL ; struct strbuf * cmd_output = strbuf_new ( ) ; bool child_is_post_create = 1 ; read_child_output : for ( ; ; ) { char buf [ 250 ] ; errno = 0 ; int r = safe_read ( child_stdout_fd, buf, sizeof ( buf ) - 1 ) ; if ( r <= 0 ) break ; buf [ r ] = '\\0' ; char * raw = buf ; char * newline ; while ( ( newline = strchr ( raw, '\\n' ) )!= NULL ) { * newline = '\\0' ; strbuf_append_str ( cmd_output, raw ) ; char * msg = cmd_output -> buf ; log ( "%s", msg ) ; if ( child_is_post_create && prefixcmp ( msg, "DUP_OF_DIR:   " ) == 0 ) { free ( dup_of_dir ) ; dup_of_dir = xstrdup ( msg + strlen ( "DUP_OF_DIR:   " ) ) ; } strbuf_clear ( cmd_output ) ; raw = newline + 1 ; } strbuf_append_str ( cmd_output, raw ) ; } int status = 0 ; if ( safe_waitpid ( child_pid, & status,

Fix:
<S2SV_ModStart> 400 ; } if ( g_settings_privatereports ) { struct stat statbuf ; if ( lstat ( dirname, & statbuf )!= 0 ||! S_ISDIR ( statbuf. st_mode ) ) { error_msg ( "Path <S2SV_blank> \'%s\' <S2SV_blank> isn\'t <S2SV_blank> directory", dirname ) ; return 404 ; } struct group * gr = getgrnam ( "abrt" ) ; if (! gr ) { error_msg ( "Group <S2SV_blank> \'abrt\' <S2SV_blank> does <S2SV_blank> not <S2SV_blank> exist" ) ; return 500 ; } if ( statbuf. st_uid!= 0 ||! ( statbuf. st_gid == 0 || statbuf. st_gid == gr -> gr_gid ) || statbuf. st_mode & 07 ) { error_msg ( "Problem <S2SV_blank> directory <S2SV_blank> \'%s\' <S2SV_blank> isn\'t <S2SV_blank> owned <S2SV_blank> by <S2SV_blank> root:abrt <S2SV_blank> or <S2SV_blank> others <S2SV_blank> are <S2SV_blank> not <S2SV_blank> restricted <S2SV_blank> from <S2SV_blank> access", dirname ) ; return 403 ; } struct dump_dir * dd = dd_opendir ( dirname, DD_OPEN_READONLY ) ; const bool complete = dd && problem_dump_dir_is
Buggy code:
 rfbBool HandleRFBServerMessage ( rfbClient * client ) { rfbServerToClientMsg msg ; if ( client -> serverPort == - 1 ) client -> vncRec -> readTimestamp = TRUE ; if (! ReadFromRFBServer ( client, ( char * ) & msg, 1 ) ) return FALSE ; switch ( msg. type ) { case rfbSetColourMapEntries : { break ; } case rfbFramebufferUpdate : { rfbFramebufferUpdateRectHeader rect ; int linesToRead ; int bytesPerLine ; int i ; if (! ReadFromRFBServer ( client, ( ( char * ) & msg. fu ) + 1, sz_rfbFramebufferUpdateMsg - 1 ) ) return FALSE ; msg. fu. nRects = rfbClientSwap16IfLE ( msg. fu. nRects ) ; for ( i = 0 ; i < msg. fu. nRects ; i ++ ) { if (! ReadFromRFBServer ( client, ( char * ) & rect, sz_rfbFramebufferUpdateRectHeader ) ) return FALSE ; rect. encoding = rfbClientSwap32IfLE ( rect. encoding ) ; if ( rect. encoding == rfbEncodingLastRect ) break ; rect. r. x = rfbClientSwap16IfLE ( rect. r. x ) ; rect. r. y = rfbClientSwap16IfLE ( rect. r. y ) ; rect. r. w = rfbClientSwap16IfLE ( rect. r. w ) ; rect. r. h = rfbClientSwap16IfLE ( rect. r. h ) ; if ( rect. encoding == rfbEncodingXCursor || rect. encoding == rfbEncodingRichCursor ) { if (! HandleCursorShape ( client, rect. r. x, rect. r. y, rect. r. w, rect. r. h, rect. encoding ) ) { return FALSE ; } continue ; } if ( rect. encoding == rfbEncodingPointerPos ) { if (! client -> HandleCursorPos ( client, rect. r. x, rect. r. y ) ) { return FALSE ; } continue ; } if ( rect. encoding == rfbEncodingKeyboardLedState ) { client -> KeyboardLedStateEnabled = 1 ; if ( client -> HandleKeyboardLedState!= NULL ) client -> HandleKeyboardLedState ( client, rect. r.

Fix:
<S2SV_ModStart> ; default : if ( msg. tc. length > MAX_TEXTCHAT_SIZE ) return FALSE ;
Buggy code:
 rdpCredssp * credssp_new ( freerdp * instance, rdpTransport * transport, rdpSettings * settings ) { rdpCredssp * credssp ; credssp = ( rdpCredssp * ) malloc ( sizeof ( rdpCredssp ) ) ; ZeroMemory ( credssp, sizeof ( rdpCredssp ) ) ; if ( credssp!= NULL ) { HKEY hKey ; LONG status ; DWORD dwType ; DWORD dwSize ; credssp -> instance = instance ; credssp -> settings = settings ; credssp -> server = settings -> ServerMode ; credssp -> transport = transport ; credssp -> send_seq_num = 0 ; credssp -> recv_seq_num = 0 ; ZeroMemory ( & credssp -> negoToken, sizeof ( SecBuffer ) ) ; ZeroMemory ( & credssp -> pubKeyAuth, sizeof ( SecBuffer ) ) ; <START_BUG> ZeroMemory ( & credssp -> authInfo, sizeof ( SecBuffer ) ) ; <END_BUG> if ( credssp -> server ) { status = RegOpenKeyEx ( HKEY_LOCAL_MACHINE, _T ( "Software\\\\FreeRDP\\\\Server" ), 0, KEY_READ | KEY_WOW64_64KEY, & hKey ) ; if ( status == ERROR_SUCCESS ) { status = RegQueryValueEx ( hKey, _T ( "SspiModule" ), NULL, & dwType, NULL, & dwSize ) ; if ( status == ERROR_SUCCESS ) { credssp -> SspiModule = ( LPTSTR ) malloc ( dwSize + sizeof ( TCHAR ) ) ; status = RegQueryValueEx ( hKey, _T ( "SspiModule" ), NULL, & dwType, ( BYTE * ) credssp -> SspiModule, & dwSize ) ; if ( status == ERROR_SUCCESS ) { _tprintf ( _T ( "Using   SSPI   Module:   %s\\n" ), credssp -> SspiModule ) ; RegCloseKey ( hKey ) ; } } } } } return credssp ; }

Fix:
<S2SV_ModStart> ( SecBuffer ) ) ; SecInvalidateHandle ( & credssp -> context
Buggy code:
 static int unimac_mdio_probe ( struct platform_device * pdev ) { struct unimac_mdio_pdata * pdata = pdev -> dev. platform_data ; struct unimac_mdio_priv * priv ; struct device_node * np ; struct mii_bus * bus ; struct resource * r ; int ret ; np = pdev -> dev. of_node ; priv = devm_kzalloc ( & pdev -> dev, sizeof ( * priv ), GFP_KERNEL ) ; if (! priv ) return - ENOMEM ; r = platform_get_resource ( pdev, IORESOURCE_MEM, 0 ) ; <START_BUG> priv -> base = devm_ioremap ( & pdev -> dev, r -> start, resource_size ( r ) ) ; <END_BUG> if (! priv -> base ) { dev_err ( & pdev -> dev, "failed   to   remap   register\\n" ) ; return - ENOMEM ; } priv -> mii_bus = mdiobus_alloc ( ) ; if (! priv -> mii_bus ) return - ENOMEM ; bus = priv -> mii_bus ; bus -> priv = priv ; if ( pdata ) { bus -> name = pdata -> bus_name ; priv -> wait_func = pdata -> wait_func ; priv -> wait_func_data = pdata -> wait_func_data ; bus -> phy_mask = ~ pdata -> phy_mask ; } else { bus -> name = "unimac   MII   bus" ; priv -> wait_func_data = priv ; priv -> wait_func = unimac_mdio_poll ; } bus -> parent = & pdev -> dev ; bus -> read = unimac_mdio_read ; bus -> write = unimac_mdio_write ; bus -> reset = unimac_mdio_reset ; snprintf ( bus -> id, MII_BUS_ID_SIZE, "%s-%d", pdev -> name, pdev -> id ) ; ret = of_mdiobus_register ( bus, np ) ; if ( ret ) { dev_err ( & pdev -> dev, "MDIO   bus   registration   failed\\n" ) ; goto out_mdio_free ; } platform_set_

Fix:
<S2SV_ModStart> 0 ) ; if (! r ) return - EINVAL ;
Buggy code:
 static void do_iccprofile_item ( deark * c, lctx * d, i64 pos, i64 len ) { i64 selector ; i64 data_len ; if ( len < 4 ) return ; selector = de_getu32be ( pos ) ; data_len = len - 4 ; de_dbg ( c, "ICC   profile   segment,   selector=%d,   data   len=%d", ( int ) selector, ( int ) data_len ) ; if ( selector!= 1 ) { dbuf_close ( d -> iccprofile_file ) ; d -> iccprofile_file = NULL ; } if ( selector == 0 ) { d -> iccprofile_file = dbuf_create_output_file ( c, "icc", NULL, DE_CREATEFLAG_IS_AUX ) ; } if ( selector == 0 || selector == 1 ) { <START_BUG> dbuf_copy ( c -> infile, pos + 4, data_len, d -> iccprofile_file ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> 1 ) { if (! d -> iccprofile_file ) { de_warn ( c, "Bad <S2SV_blank> ICC <S2SV_blank> profile <S2SV_blank> segment" ) ; return ; }
Buggy code:
 static int burl_normalize_2F_to_slash_fix ( buffer * b, int qs, int i ) { char * const s = b -> ptr ; const int blen = ( int ) buffer_string_length ( b ) ; const int used = qs < 0? blen : qs ; int j = i ; for ( ; i < used ; ++ i, ++ j ) { s [ j ] = s [ i ] ; if ( s [ i ] == '%' && s [ i + 1 ] == '2' && s [ i + 2 ] == 'F' ) { s [ j ] = '//' ; i += 2 ; } } if ( qs >= 0 ) { <START_BUG> memmove ( s + j, s + qs, blen - qs ) ; <END_BUG>  j += blen - qs ; <START_BUG> } buffer_string_set_length ( b, j ) ; return qs ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { const int qslen = blen - qs ; <S2SV_ModStart> + qs, ( size_t ) qslen ) ; qs = j <S2SV_ModEnd> ; j += <S2SV_ModStart> ; j += qslen <S2SV_ModEnd> ; } buffer_string_set_length
Buggy code:
 static Image * ReadBMPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { BMPInfo bmp_info ; Image * image ; MagickBooleanType status ; MagickOffsetType offset, profile_data, profile_size, start_position ; MemoryInfo * pixel_info ; Quantum index ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bit, bytes_per_line, length ; ssize_t count, y ; unsigned char magick [ 12 ], * pixels ; unsigned int blue, green, offset_bits, red ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) memset ( & bmp_info, 0, sizeof ( bmp_info ) ) ; bmp_info. ba_offset = 0 ; start_position = 0 ; offset_bits = 0 ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { PixelInfo quantum_bits ; PixelPacket shift ; start_position = TellBlob ( image ) - 2 ; bmp_info. ba_offset = 0 ; while ( LocaleNCompare ( ( char * ) magick, "BA", 2 ) == 0 ) { bmp_info. file_size = ReadBlobLSBLong ( image ) ; bmp_info. ba_offset = ReadBlobLSBLong ( image ) ; bmp_info. offset_bits = ReadBlobLSBLong ( image ) ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) break

Fix:
<S2SV_ModStart> = MagickFalse ; break <S2SV_ModEnd> ; } image
Buggy code:
 <START_BUG> void nsc_encode ( NSC_CONTEXT * context, const BYTE * bmpdata, UINT32 rowstride ) <END_BUG> {  nsc_encode_argb_to_aycocg ( context, bmpdata, rowstride ) ; <START_BUG> if ( context -> ChromaSubsamplingLevel ) { <END_BUG> nsc_encode_subsampling ( context ) ;  } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> BOOL <S2SV_ModEnd> nsc_encode ( NSC_CONTEXT <S2SV_ModStart> rowstride ) { if (! context ||! bmpdata || ( rowstride == 0 ) ) return FALSE ; if (! <S2SV_ModStart>, rowstride ) ) return FALSE <S2SV_ModStart> ChromaSubsamplingLevel ) { if (! <S2SV_ModStart> ( context ) ) return FALSE ; } return TRUE ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 void pimv1_print ( netdissect_options * ndo, register const u_char * bp, register u_int len ) { <START_BUG> register const u_char * ep ; <END_BUG> register u_char type ;  ep = ( const u_char * ) ndo -> ndo_snapend ; <START_BUG> if ( bp >= ep ) return ; ND_TCHECK ( bp [ 1 ] ) ; type = bp [ 1 ] ; ND_PRINT ( ( ndo, "   %s", tok2str ( pimv1_type_str, "[type   %u]", type ) ) ) ; switch ( type ) { case PIMV1_TYPE_QUERY : if ( ND_TTEST ( bp [ 8 ] ) ) { switch ( bp [ 8 ] >> 4 ) { case 0 : ND_PRINT ( ( ndo, "   Dense-mode" ) ) ; break ; case 1 : ND_PRINT ( ( ndo, "   Sparse-mode" ) ) ; break ; case 2 : ND_PRINT ( ( ndo, "   Sparse-Dense-mode" ) ) ; break ; default : ND_PRINT ( ( ndo, "   mode-%d", bp [ 8 ] >> 4 ) ) ; break ; } } if ( ndo -> ndo_vflag ) { ND_TCHECK2 ( bp [ 10 ], 2 ) ; ND_PRINT ( ( ndo, "   (Hold-time   " ) ) ; unsigned_relts_print ( ndo, EXTRACT_16BITS ( & bp [ 10 ] ) ) ; ND_PRINT ( ( ndo, ")" ) ) ; } break ; case PIMV1_TYPE_REGISTER : ND_TCHECK2 ( bp [ 8 ], 20 ) ; ND_PRINT ( ( ndo, "   for   %s   >   %s", ipaddr_string ( ndo, & bp [ 20 ] ), ipaddr_string ( ndo, & bp [ 24 ] ) ) ) ; break ; case PIMV1_TYPE_REGISTER_STOP : ND_TCHECK2 ( bp [ 12 ], sizeof ( struct in_addr ) ) ; ND_PRINT ( ( ndo, "   for   %s   >   %s", ipaddr_string<END_BUG>

Fix:
<S2SV_ModStart> ) { register <S2SV_ModEnd> u_char type ; <S2SV_ModStart> u_char type ; <S2SV_ModEnd> ND_TCHECK ( bp <S2SV_ModStart> -> ndo_vflag ) { if ( len < 8 ) goto trunc ; <S2SV_ModStart> 8 ) ; }
Buggy code:
 static const u_char * ikev1_n_print ( netdissect_options * ndo, u_char tpay _U_, const struct isakmp_gen * ext, u_int item_len, const u_char * ep, uint32_t phase _U_, uint32_t doi0 _U_, uint32_t proto0 _U_, int depth _U_ ) { const struct ikev1_pl_n * p ; struct ikev1_pl_n n ; const u_char * cp ; const u_char * ep2 ; uint32_t doi ; uint32_t proto ; static const char * notify_error_str [ ] = { NULL, "INVALID-PAYLOAD-TYPE", "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", "INVALID-COOKIE", "INVALID-MAJOR-VERSION", "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE", "INVALID-FLAGS", "INVALID-MESSAGE-ID", "INVALID-PROTOCOL-ID", "INVALID-SPI", "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED", "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX", "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION", "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING", "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED", "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION", "AUTHENTICATION-FAILED", "INVALID-SIGNATURE", "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME", "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", "UNEQUAL-PAYLOAD-LENGTHS", } ; static const char * ipsec_notify_error_str [ ] = { "RESERVED", } ; static const char * notify_status_str [ ] = { "CONNECTED", } ; static const char * ipsec_notify_status_str [ ] = { "RESPONDER-LIFETIME", "REPLAY-STATUS", "INITIAL-CONTACT", } ; # define NOT

Fix:
<S2SV_ModStart>, cp, ep2 <S2SV_ModEnd>, map, <S2SV_ModStart> nmap ) ; if ( cp == NULL ) { ND_PRINT ( ( ndo, ")" ) ) ; goto trunc ; }
Buggy code:
 void vp8_bilinear_predict4x4_neon ( unsigned char * src_ptr, int src_pixels_per_line, int xoffset, int yoffset, unsigned char * dst_ptr, int dst_pitch ) { uint8x8_t d0u8, d1u8, d2u8, d3u8, d4u8, d5u8, d6u8 ; uint8x8_t d26u8, d27u8, d28u8, d29u8, d30u8 ; <START_BUG> uint32x2_t d28u32, d29u32, d30u32 ; <END_BUG> uint8x16_t q1u8, q2u8 ; uint16x8_t q1u16, q2u16 ; uint16x8_t q7u16, q8u16, q9u16 ; uint64x2_t q4u64, q5u64 ; uint64x1_t d12u64 ; uint32x2x2_t d0u32x2, d1u32x2, d2u32x2, d3u32x2 ; if ( xoffset == 0 ) { d28u32 = vld1_lane_u32 ( ( const uint32_t * ) src_ptr, d28u32, 0 ) ; src_ptr += src_pixels_per_line ; d28u32 = vld1_lane_u32 ( ( const uint32_t * ) src_ptr, d28u32, 1 ) ; src_ptr += src_pixels_per_line ; d29u32 = vld1_lane_u32 ( ( const uint32_t * ) src_ptr, d29u32, 0 ) ; src_ptr += src_pixels_per_line ; d29u32 = vld1_lane_u32 ( ( const uint32_t * ) src_ptr, d29u32, 1 ) ; src_ptr += src_pixels_per_line ; d30u32 = vld1_lane_u32 ( ( const uint32_t * ) src_ptr, d30u32, 0 ) ; d28u8 = vreinterpret_u8_u32 ( d

Fix:
<S2SV_ModStart>, d30u8 ; uint8x16_t q1u8, q2u8 ; uint16x8_t q1u16, q2u16 ; uint16x8_t q7u16, q8u16, q9u16 ; uint64x2_t q4u64, q5u64 ; uint64x1_t d12u64 ; uint32x2x2_t d0u32x2, d1u32x2, d2u32x2, d3u32x2 ; if ( xoffset == 0 ) { uint32x2_t d28u32 = vdup_n_u32 ( 0 ) ; uint32x2_t d29u32 = vdup_n_u32 ( 0 ) ; uint32x2_t d30u32 = vdup_n_u32 ( 0 ) ; <S2SV_ModEnd> d28u32 = vld1_lane_u32 <S2SV_ModStart> = vdup_n_u8 ( <S2SV_ModEnd> bifilter4_coeff [ xoffset <S2SV_ModStart> = vdup_n_u8 ( <S2SV_ModEnd> bifilter4_coeff [ xoffset
Buggy code:
 static int udp_v6_push_pending_frames ( struct sock * sk ) { struct sk_buff * skb ; struct udphdr * uh ; struct udp_sock * up = udp_sk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; <START_BUG> struct flowi6 * fl6 = & inet -> cork. fl. u. ip6 ; <END_BUG>  int err = 0 ; <START_BUG> int is_udplite = IS_UDPLITE ( sk ) ; __wsum csum = 0 ; if ( ( skb = skb_peek ( & sk -> sk_write_queue ) ) == NULL ) goto out ; uh = udp_hdr ( skb ) ; uh -> source = fl6 -> fl6_sport ; uh -> dest = fl6 -> fl6_dport ; uh -> len = htons ( up -> len ) ; uh -> check = 0 ; if ( is_udplite ) csum = udplite_csum_outgoing ( sk, skb ) ; else if ( skb -> ip_summed == CHECKSUM_PARTIAL ) { udp6_hwcsum_outgoing ( sk, skb, & fl6 -> saddr, & fl6 -> daddr, up -> len ) ; goto send ; } else csum = udp_csum_outgoing ( sk, skb ) ; uh -> check = csum_ipv6_magic ( & fl6 -> saddr, & fl6 -> daddr, up -> len, fl6 -> flowi6_proto, csum ) ; if ( uh -> check == 0 ) uh -> check = CSUM_MANGLED_0 ; send : err = ip6_push_pending_frames ( sk ) ; if ( err ) { if ( err == - ENOBUFS &&! inet6_sk ( sk ) -> recverr ) { UDP6_INC_STATS_USER ( sock_net ( sk ), UDP_MIB_SNDBUFERRORS, is_udplite ) ; err = 0 ; } } else UDP6_INC_STATS_USER ( sock_net ( sk ), UDP_MIB_OUTDATAGRAMS, is_udplite ) ; out : up -> len = 0 ; up -> pending = 0 ; return err<END_BUG>

Fix:
<S2SV_ModStart> struct flowi6 * fl6 ; int err = 0 ; int is_udplite = IS_UDPLITE ( sk ) ; __wsum csum = 0 ; if ( up -> pending == AF_INET ) return udp_push_pending_frames ( sk ) ; <S2SV_ModStart>. ip6 ; <S2SV_ModEnd> if ( (
Buggy code:
 xmlAttrPtr xsltAttrTemplateProcess ( xsltTransformContextPtr ctxt, xmlNodePtr target, xmlAttrPtr attr ) { const xmlChar * value ; xmlAttrPtr ret ; if ( ( ctxt == NULL ) || ( attr == NULL ) || ( target == NULL ) ) return ( NULL ) ; if ( attr -> type!= XML_ATTRIBUTE_NODE ) return ( NULL ) ; # ifdef XSLT_REFACTORED if ( attr -> psvi == xsltXSLTAttrMarker ) return ( NULL ) ; # else if ( ( attr -> ns!= NULL ) && xmlStrEqual ( attr -> ns -> href, XSLT_NAMESPACE ) ) return ( NULL ) ; # endif if ( attr -> children!= NULL ) { if ( ( attr -> children -> type!= XML_TEXT_NODE ) || ( attr -> children -> next!= NULL ) ) { xsltTransformError ( ctxt, NULL, attr -> parent, "Internal   error:   The   children   of   an   attribute   node   of   a   " "literal   result   element   are   not   in   the   expected   form.\\n" ) ; return ( NULL ) ; } value = attr -> children -> content ; if ( value == NULL ) value = xmlDictLookup ( ctxt -> dict, BAD_CAST "", 0 ) ; } else value = xmlDictLookup ( ctxt -> dict, BAD_CAST "", 0 ) ; ret = target -> properties ; while ( ret!= NULL ) { if ( ( ( attr -> ns!= NULL ) == ( ret -> ns!= NULL ) ) && xmlStrEqual ( ret -> name, attr -> name ) && ( ( attr -> ns == NULL ) || xmlStrEqual ( ret -> ns -> href, attr -> ns -> href ) ) ) { break ; } ret = ret -> next ; } if ( ret!= NULL ) { xmlFreeNodeList ( ret -> children ) ; ret -> children = ret -> last = NULL ; if ( ( ret -> ns!= NULL ) && (! xmlStrEqual ( ret -> ns -> prefix, attr -> ns -> prefix ) ) ) { ret -> ns = xsltGetNamespace ( ctxt, attr -> parent, attr -> ns, target ) ; } } else { if ( attr -> ns!= NULL ) ret = xmlNewNsProp ( target, xsltGetNamespace ( ctxt, attr -> parent, attr -> ns, target ), attr -> name, NULL ) ; else ret = xmlNew

Fix:
<S2SV_ModStart> -> dict ) && xmlDictOwns ( ctxt -> dict, value )
Buggy code:
 void arp_print ( netdissect_options * ndo, const u_char * bp, u_int length, u_int caplen ) { const struct arp_pkthdr * ap ; u_short pro, hrd, op, linkaddr ; ap = ( const struct arp_pkthdr * ) bp ; ND_TCHECK ( * ap ) ; hrd = HRD ( ap ) ; pro = PRO ( ap ) ; op = OP ( ap ) ; switch ( hrd ) { case ARPHRD_ATM2225 : atmarp_print ( ndo, bp, length, caplen ) ; return ; case ARPHRD_FRELAY : linkaddr = LINKADDR_FRELAY ; break ; default : linkaddr = LINKADDR_ETHER ; break ; } <START_BUG> if (! ND_TTEST2 ( * ar_tpa ( ap ), PROTO_LEN ( ap ) ) ) { <END_BUG> ND_PRINT ( ( ndo, "%s", tstr ) ) ; ND_DEFAULTPRINT ( ( const u_char * ) ap, length ) ; return ; } if (! ndo -> ndo_eflag ) { ND_PRINT ( ( ndo, "ARP,   " ) ) ; } if ( ( pro!= ETHERTYPE_IP && pro!= ETHERTYPE_TRAIL ) || PROTO_LEN ( ap )!= 4 || HRD_LEN ( ap ) == 0 || ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, "%s   (len   %u),   %s   (len   %u)", tok2str ( arphrd_values, "Unknown   Hardware   (%u)", hrd ), HRD_LEN ( ap ), tok2str ( ethertype_values, "Unknown   Protocol   (0x%04x)", pro ), PROTO_LEN ( ap ) ) ) ; if (! ndo -> ndo_vflag ) { goto out ; } } ND_PRINT ( ( ndo, "%s%s   ", ndo -> ndo_vflag? ",   " : "", tok2str ( arpop_values, "Unknown   (%u)", op ) ) ) ; switch ( op ) { case ARPOP_REQUEST :  ND_

Fix:
<S2SV_ModStart> ND_TTEST2 ( * TPA <S2SV_ModEnd> ( ap ) <S2SV_ModStart> ( ndo, "who-has <S2SV_blank> " ) ) ; tpaddr_print_ip ( ndo, ap, pro <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( ndo, " <S2SV_blank> tell <S2SV_blank> " ) ) ; spaddr_print_ip ( ndo, ap, pro <S2SV_ModEnd> ) ; break <S2SV_ModStart> case ARPOP_REPLY : spaddr_print_ip ( ndo, ap, pro ) ; ND_PRINT ( ( ndo, " <S2SV_blank> is-at <S2SV_blank> %s" <S2SV_ModEnd>, linkaddr_string ( <S2SV_ModStart> ( ndo, "%s <S2SV_blank> at <S2SV_blank> " <S2SV_ModEnd>, linkaddr_string ( <S2SV_ModStart> ap ) ) ) ) ; tpaddr_print_ip ( ndo, ap, pro <S2SV_ModEnd> ) ; break <S2SV_ModStart> ( ndo, "%s <S2SV_blank> at <S2SV_blank> " <S2SV_ModEnd>, linkaddr_string ( <S2SV_ModStart> ap ) ) ) ) ; spaddr_print_ip ( ndo, ap, pro <S2SV_ModEnd> ) ; break
Buggy code:
 static int asf_build_simple_index ( AVFormatContext * s, int stream_index ) { ff_asf_guid g ; ASFContext * asf = s -> priv_data ; int64_t current_pos = avio_tell ( s -> pb ) ; int64_t ret ; if ( ( ret = avio_seek ( s -> pb, asf -> data_object_offset + asf -> data_object_size, SEEK_SET ) ) < 0 ) { return ret ; } if ( ( ret = ff_get_guid ( s -> pb, & g ) ) < 0 ) goto end ; while ( ff_guidcmp ( & g, & ff_asf_simple_index_header ) ) { int64_t gsize = avio_rl64 ( s -> pb ) ; if ( gsize < 24 || avio_feof ( s -> pb ) ) { goto end ; } avio_skip ( s -> pb, gsize - 24 ) ; if ( ( ret = ff_get_guid ( s -> pb, & g ) ) < 0 ) goto end ; } { int64_t itime, last_pos = - 1 ; int pct, ict ; int i ; int64_t av_unused gsize = avio_rl64 ( s -> pb ) ; if ( ( ret = ff_get_guid ( s -> pb, & g ) ) < 0 ) goto end ; itime = avio_rl64 ( s -> pb ) ; pct = avio_rl32 ( s -> pb ) ; ict = avio_rl32 ( s -> pb ) ; av_log ( s, AV_LOG_DEBUG, "itime:0x%" PRIx64 ",   pct:%d,   ict:%d\\n", itime, pct, ict ) ; for ( i = 0 ; i < ict ; i ++ ) { int pktnum = avio_rl32 ( s -> pb ) ; int pktct = avio_rl16 ( s -> pb ) ; int64_t pos = s -> internal -> data_offset + s -> packet_size * ( int64_t ) pktnum ; <START_BUG> int64_t index_pts = FFMAX ( av_rescale ( itime,<END_BUG>

Fix:
<S2SV_ModStart> 0 ) ; if ( avio_feof ( s -> pb ) ) { ret = AVERROR_INVALIDDATA ; goto end ; }