nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int store_icy ( URLContext * h, int size ) { HTTPContext * s = h -> priv_data ; <START_BUG> int remaining = s -> icy_metaint - s -> icy_data_read ; <END_BUG> if ( remaining < 0 ) return AVERROR_INVALIDDATA ; if (! remaining ) { uint8_t ch ; int len = http_read_stream_all ( h, & ch, 1 ) ; if ( len < 0 ) return len ; if ( ch > 0 ) { char data [ 255 * 16 + 1 ] ; int ret ; len = ch * 16 ; ret = http_read_stream_all ( h, data, len ) ; if ( ret < 0 ) return ret ; data [ len + 1 ] = 0 ; if ( ( ret = av_opt_set ( s, "icy_metadata_packet", data, 0 ) ) < 0 ) return ret ; update_metadata ( s, data ) ; } s -> icy_data_read = 0 ; remaining = s -> icy_metaint ; } return FFMIN ( size, remaining ) ; }

Fix:
<S2SV_ModStart> -> priv_data ; uint64_t remaining ; if ( s -> icy_metaint < s -> icy_data_read ) return AVERROR_INVALIDDATA ; <S2SV_ModEnd> remaining = s <S2SV_ModStart> s -> icy_data_read <S2SV_ModEnd> ; if (
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_

Fix:
<S2SV_ModStart> 128, size + EXTRA_BS_OFFSET
Buggy code:
 static void sas_discover_domain ( struct work_struct * work ) { struct domain_device * dev ; int error = 0 ; struct sas_discovery_event * ev = to_sas_discovery_event ( work ) ; struct asd_sas_port * port = ev -> port ; clear_bit ( DISCE_DISCOVER_DOMAIN, & port -> disc. pending ) ; if ( port -> port_dev ) return ; error = sas_get_port_device ( port ) ; if ( error ) return ; dev = port -> port_dev ; SAS_DPRINTK ( "DOING   DISCOVERY   on   port   %d,   pid:%d\\n", port -> id, task_pid_nr ( current ) ) ; switch ( dev -> dev_type ) { case SAS_END_DEVICE : error = sas_discover_end_dev ( dev ) ; break ; case SAS_EDGE_EXPANDER_DEVICE : case SAS_FANOUT_EXPANDER_DEVICE : error = sas_discover_root_expander ( dev ) ; break ; case SAS_SATA_DEV : case SAS_SATA_PM : # ifdef CONFIG_SCSI_SAS_ATA error = sas_discover_sata ( dev ) ; break ; # else SAS_DPRINTK ( "ATA   device   seen   but   CONFIG_SCSI_SAS_ATA=N   so   cannot   attach\\n" ) ; # endif default : error = - ENXIO ; SAS_DPRINTK ( "unhandled   device   %d\\n", dev -> dev_type ) ; break ; } if ( error ) { sas_rphy_free ( dev -> rphy ) ; list_del_init ( & dev -> disco_list_node ) ; spin_lock_irq ( & port -> dev_list_lock ) ; list_del_init ( & dev -> dev_list_node ) ; spin_unlock_irq ( & port -> dev_list_lock ) ; sas_put_device ( dev ) ; port -> port_dev = NULL ; } <START_BUG> SAS_DPRINTK ( "DONE   DISCOVERY   on   port   %d,   pid:%d,   result:%d\\n", port -> id, <END_BUG> task_pid

Fix:
<S2SV_ModStart> NULL ; } sas_probe_devices ( port ) ;
Buggy code:
 void serveloop ( GArray * servers ) { struct sockaddr_storage addrin ; socklen_t addrinlen = sizeof ( addrin ) ; int i ; int max ; fd_set mset ; fd_set rset ; max = 0 ; FD_ZERO ( & mset ) ; for ( i = 0 ; i < servers -> len ; i ++ ) { int sock ; if ( ( sock = ( g_array_index ( servers, SERVER, i ) ). socket ) >= 0 ) { FD_SET ( sock, & mset ) ; max = sock > max? sock : max ; } } for ( i = 0 ; i < modernsocks -> len ; i ++ ) { int sock = g_array_index ( modernsocks, int, i ) ; FD_SET ( sock, & mset ) ; max = sock > max? sock : max ; } for ( ; ; ) { if ( is_sighup_caught ) { int n ; GError * gerror = NULL ; msg ( LOG_INFO, "reconfiguration   request   received" ) ; is_sighup_caught = 0 ; n = append_new_servers ( servers, & gerror ) ; if ( n == - 1 ) msg ( LOG_ERR, "failed   to   append   new   servers:   %s", gerror -> message ) ; for ( i = servers -> len - n ; i < servers -> len ; ++ i ) { const SERVER server = g_array_index ( servers, SERVER, i ) ; if ( server. socket >= 0 ) { FD_SET ( server. socket, & mset ) ; max = server. socket > max? server. socket : max ; } msg ( LOG_INFO, "reconfigured   new   server:   %s", server. servename ) ; } } memcpy ( & rset, & mset, sizeof ( fd_set ) ) ; if ( select ( max + 1, & rset, NULL, NULL, NULL ) > 0 ) { <START_BUG> int net ; <END_BUG> DEBUG ( "accept,   " ) ; for ( i = 0 ; i < modernsocks -> len ; i ++ ) { int sock = g_array_index ( modernsocks, int, i ) ; if (! FD_ISSET (

Fix:
<S2SV_ModStart> 0 ) { <S2SV_ModEnd> DEBUG ( "accept, <S2SV_blank> " <S2SV_ModStart> continue ; } handle_modern_connection ( servers, sock ) ; } for ( i = 0 ; i < servers -> len ; i ++ ) { int net ; SERVER * serve ; serve = & ( g_array_index ( servers, SERVER, i ) ) ; if ( serve -> socket < 0 ) { continue ; } if ( FD_ISSET ( serve -> socket, & rset ) ) { <S2SV_ModEnd> if ( ( <S2SV_ModStart> = accept ( serve -> socket <S2SV_ModEnd>, ( struct <S2SV_ModStart> continue ; } handle_connection ( servers, net, serve, NULL <S2SV_ModEnd> ) ; }
Buggy code:
 static void rtc_irq_eoi_tracking_reset ( struct kvm_ioapic * ioapic ) { ioapic -> rtc_status. pending_eoi = 0 ; <START_BUG> bitmap_zero ( ioapic -> rtc_status. dest_map. map, KVM_MAX_VCPUS ) ; <END_BUG> }

Fix:
<S2SV_ModStart>. map, KVM_MAX_VCPU_ID <S2SV_ModEnd> ) ; }
Buggy code:
 static int process_plane ( uint8 * in, int width, int height, uint8 * out, int size ) { UNUSED ( size ) ; int indexw ; int indexh ; int code ; int collen ; int replen ; int color ; int x ; int revcode ; uint8 * last_line ; uint8 * this_line ; uint8 * org_in ; uint8 * org_out ; org_in = in ; org_out = out ; last_line = 0 ; indexh = 0 ; while ( indexh < height ) { out = ( org_out + width * height * 4 ) - ( ( indexh + 1 ) * width * 4 ) ; color = 0 ; this_line = out ; indexw = 0 ; if ( last_line == 0 ) { while ( indexw < width ) { code = CVAL ( in ) ; replen = code & 0xf ; collen = ( code >> 4 ) & 0xf ; revcode = ( replen << 4 ) | collen ; if ( ( revcode <= 47 ) && ( revcode >= 16 ) ) { replen = revcode ; collen = 0 ; } <START_BUG> while ( collen > 0 ) <END_BUG> { color = CVAL ( in ) ; * out = color ; out += 4 ; indexw ++ ; collen -- ; }  while ( replen > 0 ) <START_BUG> { * out = color ; out += 4 ; indexw ++ ; replen -- ; } } } else { while ( indexw < width ) { code = CVAL ( in ) ; replen = code & 0xf ; collen = ( code >> 4 ) & 0xf ; revcode = ( replen << 4 ) | collen ; if ( ( revcode <= 47 ) && ( revcode >= 16 ) ) { replen = revcode ; collen = 0 ; } <END_BUG> while ( collen > 0 )  { x = CVAL ( in ) ; if ( x & 1 ) { x = x >> 1 ; x = x + 1 ; color = - x ; } else { x = x >> 1 ; color = x ; } x = last_line [ indexw * 4 ] + color ; * out = x ; out += 4 ; indexw ++ ; collen -- ; } <START_BUG> while ( replen > 0 ) <END_BUG> { x = last_line [ indexw * 4 ] +

Fix:
<S2SV_ModStart> } while ( indexw < width && <S2SV_ModStart> } while ( indexw < width && <S2SV_ModStart> } while ( indexw < width && <S2SV_ModStart> } while ( indexw < width &&
Buggy code:
 int xmlPushInput ( xmlParserCtxtPtr ctxt, xmlParserInputPtr input ) { int ret ; if ( input == NULL ) return ( - 1 ) ; if ( xmlParserDebugEntities ) { if ( ( ctxt -> input!= NULL ) && ( ctxt -> input -> filename ) ) xmlGenericError ( xmlGenericErrorContext, "%s(%d):   ", ctxt -> input -> filename, ctxt -> input -> line ) ; xmlGenericError ( xmlGenericErrorContext, <START_BUG> "Pushing   input   %d   :   %.30s\\n", ctxt -> inputNr + 1, input -> cur ) ; <END_BUG> } ret = inputPush ( ctxt, input ) ; if ( ctxt -> instate == XML_PARSER_EOF ) return ( - 1 ) ; GROW ; return ( ret ) ; }

Fix:
<S2SV_ModStart> input -> cur ) ; } if ( ( ( ctxt -> inputNr > 40 ) && ( ( ctxt -> options & XML_PARSE_HUGE ) == 0 ) ) || ( ctxt -> inputNr > 1024 ) ) { xmlFatalErr ( ctxt, XML_ERR_ENTITY_LOOP, NULL ) ; while ( ctxt -> inputNr > 1 ) xmlFreeInputStream ( inputPop ( ctxt ) ) ; return ( - 1
Buggy code:
 static void update_reference_frames ( VP8_COMP * cpi ) { VP8_COMMON * cm = & cpi -> common ; YV12_BUFFER_CONFIG * yv12_fb = cm -> yv12_fb ; if ( cm -> frame_type == KEY_FRAME ) { yv12_fb [ cm -> new_fb_idx ]. flags |= VP8_GOLD_FRAME | VP8_ALTR_FRAME ; yv12_fb [ cm -> gld_fb_idx ]. flags &= ~ VP8_GOLD_FRAME ; yv12_fb [ cm -> alt_fb_idx ]. flags &= ~ VP8_ALTR_FRAME ; cm -> alt_fb_idx = cm -> gld_fb_idx = cm -> new_fb_idx ; <START_BUG> # if CONFIG_MULTI_RES_ENCODING <END_BUG> cpi -> current_ref_frames [ GOLDEN_FRAME ] = cm -> current_video_frame ; cpi -> current_ref_frames [ ALTREF_FRAME ] = cm -> current_video_frame ;  # endif <START_BUG> } else { if ( cm -> refresh_alt_ref_frame ) { assert (! cm -> copy_buffer_to_arf ) ; cm -> yv12_fb [ cm -> new_fb_idx ]. flags |= VP8_ALTR_FRAME ; cm -> yv12_fb [ cm -> alt_fb_idx ]. flags &= ~ VP8_ALTR_FRAME ; cm -> alt_fb_idx = cm -> new_fb_idx ; <END_BUG> # if CONFIG_MULTI_RES_ENCODING  cpi -> current_ref_frames [ ALTREF_FRAME ] = cm -> current_video_frame ; <START_BUG> # endif <END_BUG> } else if ( cm -> copy_buffer_to_arf ) { assert (! ( cm -> copy_buffer_to_arf & ~ 0x3 ) ) ; if ( cm -> copy_buffer_to_arf == 1 ) { if ( cm -> alt_fb_idx!= cm -> lst_fb_idx ) { yv12_fb [ cm -> lst_fb_idx ]. flags |= VP8_ALTR_FRAME ; yv12_fb [ cm -> alt_fb_idx ]. flags &= ~ VP

Fix:
<S2SV_ModStart> -> new_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> -> current_video_frame ; <S2SV_ModEnd> } else { <S2SV_ModStart> -> new_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> -> current_video_frame ; <S2SV_ModEnd> } else if <S2SV_ModStart> -> lst_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> LAST_FRAME ] ; <S2SV_ModEnd> } } else <S2SV_ModStart> -> gld_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> GOLDEN_FRAME ] ; <S2SV_ModEnd> } } } <S2SV_ModStart> -> new_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> -> current_video_frame ; <S2SV_ModEnd> } else if <S2SV_ModStart> -> lst_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> LAST_FRAME ] ; <S2SV_ModEnd> } } else <S2SV_ModStart> -> alt_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> ALTREF_FRAME ] ; <S2SV_ModEnd> } } } <S2SV_ModStart> -> new_fb_idx ; <S2SV_ModEnd> cpi -> current_ref_frames <S2SV_ModStart> -> current_video_frame ; <S2SV_ModEnd> } # if <S2SV_ModStart> int i ; for ( i = LAST_FRAME <S2SV_ModEnd> ; i < <S2SV_ModStart> i < MAX_REF_FRAMES ; ++
Buggy code:
 void sink ( int argc, char * * argv, const char * src ) { static BUF buffer ; struct stat stb ; BUF * bp ; off_t i ; size_t j, count ; int amt, exists, first, ofd ; mode_t mode, omode, mask ; off_t size, statbytes ; unsigned long long ull ; int setimes, targisdir, wrerr ; char ch, * cp, * np, * targ, * why, * vect [ 1 ], buf [ 2048 ], visbuf [ 2048 ] ; char * * patterns = NULL ; size_t n, npatterns = 0 ; struct timeval tv [ 2 ] ; # define atime tv [ 0 ] # define mtime tv [ 1 ] # define SCREWUP ( str ) { why = str ; goto screwup ; } if ( TYPE_OVERFLOW ( time_t, 0 ) || TYPE_OVERFLOW ( off_t, 0 ) ) SCREWUP ( "Unexpected   off_t//time_t   size" ) ; setimes = targisdir = 0 ; mask = umask ( 0 ) ; if (! pflag ) ( void ) umask ( mask ) ; if ( argc!= 1 ) { run_err ( "ambiguous   target" ) ; exit ( 1 ) ; } targ = * argv ; if ( targetshouldbedirectory ) verifydir ( targ ) ; ( void ) atomicio ( vwrite, remout, "", 1 ) ; if ( stat ( targ, & stb ) == 0 && S_ISDIR ( stb. st_mode ) ) targisdir = 1 ; if ( src!= NULL &&! iamrecursive &&! Tflag ) { if ( brace_expand ( src, & patterns, & npatterns )!= 0 ) fatal ( "%s:   could   not   expand   pattern", __func__ ) ; } for ( first = 1 ; ; first = 0 ) { cp = buf ; if ( atomicio ( read, remin, cp, 1 )!= 1 ) goto done ; if ( * cp ++ == '\\n' ) SCREWUP ( "unexpected   <newline>" ) ; do { if ( atomicio ( read, remin, & ch, sizeof ( ch ) )!= sizeof ( ch ) ) SCREWUP ( "lost   connection" ) ; *

Fix:
<S2SV_ModStart> = 0 ; ( void ) <S2SV_ModEnd> utimes ( vect <S2SV_ModStart> ], tv <S2SV_ModEnd> ) ; }
Buggy code:
 static zend_bool add_post_var ( zval * arr, post_var_data_t * var, zend_bool eof TSRMLS_DC ) { <START_BUG> char * ksep, * vsep, * val ; <END_BUG> size_t klen, vlen ; unsigned int new_vlen ; if ( var -> ptr >= var -> end ) { return 0 ; }  vsep = memchr ( var -> ptr, '&', var -> end - var -> ptr ) ; <START_BUG> if (! vsep ) { <END_BUG> if (! eof ) {  return 0 ; } else { vsep = var -> end ; } } ksep = memchr ( var -> ptr, '=', vsep - var -> ptr ) ; if ( ksep ) { * ksep = '\\0' ; klen = ksep - var -> ptr ; vlen = vsep - ++ ksep ; } else { ksep = "" ; klen = vsep - var -> ptr ; vlen = 0 ; } php_url_decode ( var -> ptr, klen ) ; val = estrndup ( ksep, vlen ) ; if ( vlen ) { vlen = php_url_decode ( val, vlen ) ; } if ( sapi_module. input_filter ( PARSE_POST, var -> ptr, & val, vlen, & new_vlen TSRMLS_CC ) ) { php_register_variable_safe ( var -> ptr, val, new_vlen, arr TSRMLS_CC ) ; } efree ( val ) ; var -> ptr = vsep + ( vsep!= var -> end ) ; <START_BUG> return 1 ; <END_BUG> }

Fix:
<S2SV_ModStart> { char * start, * <S2SV_ModStart> 0 ; } start = var -> ptr + var -> already_scanned ; <S2SV_ModStart> = memchr ( start <S2SV_ModEnd>, '&', <S2SV_ModStart> -> end - start <S2SV_ModEnd> ) ; if <S2SV_ModStart> eof ) { var -> already_scanned = var -> end - var -> ptr ; <S2SV_ModStart> end ) ; var -> already_scanned = 0 ;
Buggy code:
 int __kvm_set_memory_region ( struct kvm * kvm, struct kvm_userspace_memory_region * mem, int user_alloc ) { int r ; gfn_t base_gfn ; unsigned long npages ; struct kvm_memory_slot * memslot, * slot ; struct kvm_memory_slot old, new ; struct kvm_memslots * slots, * old_memslots ; r = check_memory_region_flags ( mem ) ; if ( r ) goto out ; r = - EINVAL ; if ( mem -> memory_size & ( PAGE_SIZE - 1 ) ) goto out ; if ( mem -> guest_phys_addr & ( PAGE_SIZE - 1 ) ) goto out ; if ( user_alloc && ( ( mem -> userspace_addr & ( PAGE_SIZE - 1 ) ) ||! access_ok ( VERIFY_WRITE, ( void __user * ) ( unsigned long ) mem -> userspace_addr, mem -> memory_size ) ) ) goto out ; if ( mem -> slot >= KVM_MEM_SLOTS_NUM ) goto out ; if ( mem -> guest_phys_addr + mem -> memory_size < mem -> guest_phys_addr ) goto out ; memslot = id_to_memslot ( kvm -> memslots, mem -> slot ) ; base_gfn = mem -> guest_phys_addr >> PAGE_SHIFT ; npages = mem -> memory_size >> PAGE_SHIFT ; r = - EINVAL ; if ( npages > KVM_MEM_MAX_NR_PAGES ) goto out ; if (! npages ) mem -> flags &= ~ KVM_MEM_LOG_DIRTY_PAGES ; new = old = * memslot ; new. id = mem -> slot ; new. base_gfn = base_gfn ; new. npages = npages ; new. flags = mem -> flags ; r = - EINVAL ; if ( npages && old. npages && npages!= old. npages ) goto out_free ; if (! npages &&! old. npages ) goto out_free ; r = - EEXIST ; kvm_for_each_memslot ( slot, kvm -> memslots ) { if ( slot -> id >= KVM_MEMORY_S

Fix:
<S2SV_ModStart> srcu ) ; kvm_iommu_unmap_pages ( kvm, & old ) ; <S2SV_ModStart> ) goto out_free <S2SV_ModEnd> ; r = <S2SV_ModStart> ; if ( npages ) { r = kvm_iommu_map_pages ( kvm, & new ) ; if ( r ) goto out_slots ; } if ( <S2SV_ModStart> return 0 ; out_slots : kfree ( slots ) ;
Buggy code:
 static int add_ballooned_pages ( int nr_pages ) { enum bp_state st ; if ( xen_hotplug_unpopulated ) { st = reserve_additional_memory ( ) ; if ( st!= BP_ECANCELED ) { mutex_unlock ( & balloon_mutex ) ; wait_event ( balloon_wq,! list_empty ( & ballooned_pages ) ) ; mutex_lock ( & balloon_mutex ) ; return 0 ; } } <START_BUG> st = decrease_reservation ( nr_pages, GFP_USER ) ; <END_BUG> if ( st!= BP_DONE ) return - ENOMEM ; return 0 ; }

Fix:
<S2SV_ModStart> ; } } if ( si_mem_available ( ) < nr_pages ) return - ENOMEM ;
Buggy code:
 static int smb_send_rqst ( struct TCP_Server_Info * server, struct smb_rqst * rqst ) { int rc ; struct kvec * iov = rqst -> rq_iov ; int n_vec = rqst -> rq_nvec ; unsigned int smb_buf_length = get_rfc1002_length ( iov [ 0 ]. iov_base ) ; unsigned int i ; size_t total_len = 0, sent ; struct socket * ssocket = server -> ssocket ; <START_BUG> int val = 1 ; <END_BUG> cFYI ( 1, "Sending   smb:   smb_len=%u", smb_buf_length ) ; dump_smb ( iov [ 0 ]. iov_base, iov [ 0 ]. iov_len ) ; kernel_setsockopt ( ssocket, SOL_TCP, TCP_CORK, ( char * ) & val, sizeof ( val ) ) ; rc = smb_send_kvec ( server, iov, n_vec, & sent ) ; if ( rc < 0 ) goto uncork ; total_len += sent ; for ( i = 0 ; i < rqst -> rq_npages ; i ++ ) { struct kvec p_iov ; cifs_rqst_page_to_kvec ( rqst, i, & p_iov ) ; rc = smb_send_kvec ( server, & p_iov, 1, & sent ) ; kunmap ( rqst -> rq_pages [ i ] ) ; if ( rc < 0 ) break ; total_len += sent ; } uncork : val = 0 ; kernel_setsockopt ( ssocket, SOL_TCP, TCP_CORK, ( char * ) & val, sizeof ( val ) ) ; if ( ( total_len > 0 ) && ( total_len!= smb_buf_length + 4 ) ) { cFYI ( 1, "partial   send   (wanted=%u   sent=%zu):   terminating   " "session", smb_buf_length + 4, total_len ) ; server -> tcpStatus = CifsNeedReconnect ; } if ( rc < 0 && rc!= - EINTR ) cERROR ( 1, "Error   %d   sending

Fix:
<S2SV_ModStart> val = 1 ; if ( ssocket == NULL ) return - ENOTSOCK
Buggy code:
 int flb_gzip_compress ( void * in_data, size_t in_len, void * * out_data, size_t * out_len ) { int flush ; int status ; int footer_start ; uint8_t * pb ; size_t out_size ; void * out_buf ; z_stream strm ; mz_ulong crc ; <START_BUG> out_size = in_len + 32 ; <END_BUG> out_buf = flb_malloc ( out_size ) ; if (! out_buf ) { flb_errno ( ) ; flb_error ( "[gzip]   could   not   allocate   outgoing   buffer" ) ; return - 1 ; } memset ( & strm, '\\0', sizeof ( strm ) ) ; strm. zalloc = Z_NULL ; strm. zfree = Z_NULL ; strm. opaque = Z_NULL ; strm. next_in = in_data ; strm. avail_in = in_len ; strm. total_out = 0 ; deflateInit2 ( & strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED, - Z_DEFAULT_WINDOW_BITS, 9, Z_DEFAULT_STRATEGY ) ; gzip_header ( out_buf ) ; pb = ( uint8_t * ) out_buf + FLB_GZIP_HEADER_OFFSET ; flush = Z_NO_FLUSH ; while ( 1 ) { strm. next_out = pb + strm. total_out ; strm. avail_out = out_size - ( pb - ( uint8_t * ) out_buf ) ; if ( strm. avail_in == 0 ) { flush = Z_FINISH ; } status = deflate ( & strm, flush ) ; if ( status == Z_STREAM_END ) { break ; } else if ( status!= Z_OK ) { deflateEnd ( & strm ) ; return - 1 ; } } if ( deflateEnd ( & strm )!= Z_OK ) { flb_free ( out_buf ) ; return - 1 ; } * out_len = strm. total_out ; footer_start = FLB_GZIP_HEADER_OFFSET + * out_len ; pb = ( uint8_t * ) out_buf + footer_start ; crc

Fix:
<S2SV_ModStart> mz_ulong crc ; int max_input_expansion = ( ( int ) ( in_len // 32000 ) + 1 ) * 5 ; out_size = 10 + 8 + max_input_expansion + in_len <S2SV_ModEnd> ; out_buf =
Buggy code:
 native_handle_t * native_handle_create ( int numFds, int numInts ) { <START_BUG> native_handle_t * h = malloc ( <END_BUG>  sizeof ( native_handle_t ) + sizeof ( int ) * ( numFds + numInts ) ) ; <START_BUG> if ( h ) { h -> version = sizeof ( native_handle_t ) ; h -> numFds = numFds ; h -> numInts = numInts ; } return h ; }<END_BUG>

Fix:
<S2SV_ModStart> numInts ) { if ( numFds < 0 || numInts < 0 || numFds > kMaxNativeFds || numInts > kMaxNativeInts ) { return NULL ; } size_t mallocSize = <S2SV_ModEnd> sizeof ( native_handle_t <S2SV_ModStart> native_handle_t ) + ( <S2SV_ModStart> + numInts ) ) ; native_handle_t * h = malloc ( mallocSize
Buggy code:
 bool ExprResolveLhs ( struct xkb_context * ctx, const ExprDef * expr, const char * * elem_rtrn, const char * * field_rtrn, ExprDef * * index_rtrn ) { switch ( expr -> expr. op ) { case EXPR_IDENT : * elem_rtrn = NULL ; * field_rtrn = xkb_atom_text ( ctx, expr -> ident. ident ) ; * index_rtrn = NULL ; return ( * field_rtrn!= NULL ) ; case EXPR_FIELD_REF : * elem_rtrn = xkb_atom_text ( ctx, expr -> field_ref. element ) ; * field_rtrn = xkb_atom_text ( ctx, expr -> field_ref. field ) ; * index_rtrn = NULL ; <START_BUG> return true ; <END_BUG> case EXPR_ARRAY_REF : * elem_rtrn = xkb_atom_text ( ctx, expr -> array_ref. element ) ; * field_rtrn = xkb_atom_text ( ctx, expr -> array_ref. field ) ; * index_rtrn = expr -> array_ref. entry ;  return true ; <START_BUG> default : break ; } log_wsgo ( ctx, "Unexpected   operator   %d   in   ResolveLhs\\n", expr -> expr. op ) ; return false ; }<END_BUG>

Fix:
<S2SV_ModStart> NULL ; return ( * elem_rtrn!= NULL && * field_rtrn!= NULL ) <S2SV_ModEnd> ; case EXPR_ARRAY_REF <S2SV_ModStart>. entry ; if ( expr -> array_ref. element!= XKB_ATOM_NONE && * elem_rtrn == NULL ) return false ; if ( * field_rtrn == NULL ) return false ;
Buggy code:
 int vp8_full_search_sad_c ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int sad_per_bit, int distance, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; int what_stride = b -> src_stride ; unsigned char * in_what ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; int mv_stride = pre_stride ; unsigned char * bestaddress ; int_mv * best_mv = & d -> bmi. mv ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int r, c ; unsigned char * check_here ; int ref_row = ref_mv -> as_mv. row ; int ref_col = ref_mv -> as_mv. col ; int row_min = ref_row - distance ; int row_max = ref_row + distance ; int col_min = ref_col - distance ; int col_max = ref_col + distance ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; in_what = base_pre + d -> offset ; bestaddress = in_what + ( ref_row * pre_stride ) + ref_col ; best_mv -> as_mv. row = ref_row ; best_mv -> as_mv. col = ref_col ; bestsad = fn_ptr -> sdf ( what, what_stride, bestaddress, <START_BUG> in_what_stride, UINT_MAX ) <END_BUG> + mvsad_err_cost ( best_

Fix:
<S2SV_ModStart> bestaddress, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; this_mv
Buggy code:
 static void sycc444_to_rgb ( opj_image_t * img ) { int * d0, * d1, * d2, * r, * g, * b ; const int * y, * cb, * cr ; <START_BUG> unsigned int maxw, maxh, max, i ; <END_BUG> int offset, upb ; upb = ( int ) img -> comps [ 0 ]. prec ; offset = 1 << ( upb - 1 ) ; upb = ( 1 << upb ) - 1 ;  maxw = ( unsigned int ) img -> comps [ 0 ]. w ; maxh = ( unsigned int ) img -> comps [ 0 ]. h ; <START_BUG> max = maxw * maxh ; y = img -> comps [ 0 ]. data ; cb = img -> comps [ 1 ]. data ; cr = img -> comps [ 2 ]. data ; <END_BUG> d0 = r = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ;  <START_BUG> d1 = g = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ; <END_BUG>  d2 = b = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ; <START_BUG> if ( r == NULL || g == NULL || b == NULL ) goto fails ; for ( i = 0U ; i < max ; ++ i ) { sycc_to_rgb ( offset, upb, * y, * cb, * cr, r, g, b ) ; ++ y ; ++ cb ; ++ cr ; ++ r ; ++ g ; ++ b ; } free ( img -> comps [ 0 ]. data ) ; img -> comps [ 0 ]. data = d0 ; free ( img -> comps [ 1 ]. data ) ; img -> comps [ 1 ]. data = d1 ; free ( img -> comps [ 2 ]. data ) ; img -> comps [ 2 ]. data = d2 ; <END_BUG> return ;  fails : <START_BUG> if ( r ) free ( r ) ; <END_BUG> if ( g ) free ( g ) ; if ( b ) free ( b ) ; }

Fix:
<S2SV_ModStart> * cr ; size_t <S2SV_ModEnd> maxw, maxh <S2SV_ModStart> maxw = ( size_t <S2SV_ModEnd> ) img -> <S2SV_ModStart> maxh = ( size_t <S2SV_ModEnd> ) img -> <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> = d2 ; img -> color_space = OPJ_CLRSPC_SRGB ; <S2SV_ModStart> ; fails : free ( r ) ; free ( g ) ; <S2SV_ModEnd> free ( b
Buggy code:
 static int validate_node ( node * tree ) { int type = TYPE ( tree ) ; int nch = NCH ( tree ) ; dfa * nt_dfa ; state * dfa_state ; int pos, arc ; assert ( ISNONTERMINAL ( type ) ) ; type -= NT_OFFSET ; if ( type >= _PyParser_Grammar. g_ndfas ) { PyErr_Format ( parser_error, "Unrecognized   node   type   %d.", TYPE ( tree ) ) ; return 0 ; } nt_dfa = & _PyParser_Grammar. g_dfa [ type ] ; REQ ( tree, nt_dfa -> d_type ) ; dfa_state = & nt_dfa -> d_state [ nt_dfa -> d_initial ] ; for ( pos = 0 ; pos < nch ; ++ pos ) { node * ch = CHILD ( tree, pos ) ; int ch_type = TYPE ( ch ) ; <START_BUG> for ( arc = 0 ; arc < dfa_state -> s_narcs ; ++ arc ) { <END_BUG> short a_label = dfa_state -> s_arc [ arc ]. a_lbl ; assert ( a_label < _PyParser_Grammar. g_ll. ll_nlabels ) ; if ( _PyParser_Grammar. g_ll. ll_label [ a_label ]. lb_type == ch_type ) { if ( ISNONTERMINAL ( ch_type ) &&! validate_node ( ch ) ) return 0 ; dfa_state = & nt_dfa -> d_state [ dfa_state -> s_arc [ arc ]. a_arrow ] ; goto arc_found ; } } { short a_label = dfa_state -> s_arc -> a_lbl ; int next_type ; if (! a_label ) goto illegal_num_children ; next_type = _PyParser_Grammar. g_ll. ll_label [ a_label ]. lb_type ; if ( ISNONTERMINAL ( next_type ) ) PyErr_Format ( parser_error, "Expected   node   type   %d,   got   %d.", next_type, ch_type ) ; else PyErr_Format ( parser_error, "Illegal   terminal:   expected   %s.", _PyParser_TokenNames [ next_type

Fix:
<S2SV_ModStart> ch ) ; if ( ch_type == suite && TYPE ( tree ) == funcdef ) { ch_type = func_body_suite ; }
Buggy code:
 l_ok pixFillMapHoles ( PIX * pix, l_int32 nx, l_int32 ny, l_int32 filltype ) { l_int32 w, h, y, nmiss, goodcol, i, j, found, ival, valtest ; l_uint32 val, lastval ; <START_BUG> NUMA * na ; <END_BUG> PIX * pixt ; PROCNAME ( "pixFillMapHoles" ) ; if (! pix || pixGetDepth ( pix )!= 8 ) return ERROR_INT ( "pix   not   defined   or   not   8   bpp", procName, 1 ) ; if ( pixGetColormap ( pix ) ) return ERROR_INT ( "pix   is   colormapped", procName, 1 ) ; pixGetDimensions ( pix, & w, & h, NULL ) ; na = numaCreate ( 0 ) ; nmiss = 0 ; valtest = ( filltype == L_FILL_WHITE )? 255 : 0 ; for ( j = 0 ; j < nx ; j ++ ) { found = FALSE ; for ( i = 0 ; i < ny ; i ++ ) { pixGetPixel ( pix, j, i, & val ) ; if ( val!= valtest ) { y = i ; found = TRUE ; break ; } } if ( found == FALSE ) { numaAddNumber ( na, 0 ) ; nmiss ++ ; } else { numaAddNumber ( na, 1 ) ; for ( i = y - 1 ; i >= 0 ; i -- ) pixSetPixel ( pix, j, i, val ) ; pixGetPixel ( pix, j, 0, & lastval ) ; for ( i = 1 ; i < h ; i ++ ) { pixGetPixel ( pix, j, i, & val ) ; if ( val == valtest ) pixSetPixel ( pix, j, i, lastval ) ; else lastval = val ; } } } numaAddNumber ( na, 0 ) ; if ( nmiss == nx ) { numaDestroy ( & na ) ; L_WARNING ( "no   bg   found;   no   data   in   any   column\\n", procName ) ; return 1 ; } if ( nmiss > 0 ) {  pixt = pixCopy ( NULL, pix ) ; <START_BUG> goodcol = 0 ; for ( j =<END_BUG>

Fix:
<S2SV_ModStart> NUMA * na <S2SV_ModEnd> ; PROCNAME ( <S2SV_ModStart> 0 ) { <S2SV_ModEnd> goodcol = 0 <S2SV_ModStart> j -- ) <S2SV_ModEnd> pixRasterop ( pix <S2SV_ModStart>, PIX_SRC, pix <S2SV_ModEnd>, j + <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> } for ( <S2SV_ModStart>, PIX_SRC, pix <S2SV_ModEnd>, j - <S2SV_ModStart> 0 ) ; } } <S2SV_ModEnd> } if (
Buggy code:
 static inline int check_entry_size_and_hooks ( struct arpt_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct arpt_entry )!= 0 || ( unsigned char * ) e + sizeof ( struct arpt_entry ) >= limit || ( unsigned char * ) e + e -> next_offset > limit ) { duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct arpt_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } if (! arp_checkentry ( & e -> arp ) ) return - EINVAL ; <START_BUG> err = xt_check_entry_offsets ( e, e -> target_offset, e -> next_offset ) ; <END_BUG> if ( err ) return err ; for ( h = 0 ; h < NF_ARP_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { pr_debug ( "Underflows   must   be   unconditional   and   " "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart>, e -> elems, e ->
Buggy code:
 static krb5_error_code tgs_build_reply ( krb5_context context, krb5_kdc_configuration * config, KDC_REQ * req, KDC_REQ_BODY * b, hdb_entry_ex * krbtgt, krb5_enctype krbtgt_etype, const krb5_keyblock * replykey, int rk_is_subkey, krb5_ticket * ticket, krb5_data * reply, const char * from, const char * * e_text, AuthorizationData * * auth_data, const struct sockaddr * from_addr ) { krb5_error_code ret ; krb5_principal cp = NULL, sp = NULL, rsp = NULL, tp = NULL, dp = NULL ; krb5_principal krbtgt_out_principal = NULL ; char * spn = NULL, * cpn = NULL, * tpn = NULL, * dpn = NULL, * krbtgt_out_n = NULL ; hdb_entry_ex * server = NULL, * client = NULL, * s4u2self_impersonated_client = NULL ; HDB * clientdb, * s4u2self_impersonated_clientdb ; krb5_realm ref_realm = NULL ; EncTicketPart * tgt = & ticket -> ticket ; krb5_principals spp = NULL ; const EncryptionKey * ekey ; krb5_keyblock sessionkey ; krb5_kvno kvno ; <START_BUG> krb5_data rspac ; <END_BUG> const char * our_realm = krb5_principal_get_comp_string ( context, krbtgt -> entry. principal, 1 ) ; char * * capath = NULL ; size_t num_capath = 0 ; hdb_entry_ex * krbtgt_out = NULL ; METHOD_DATA enc_pa_data ; PrincipalName * s ; Realm r ; EncTicketPart adtkt ; char opt_str [ 128 ] ; int signedpath = 0 ; Key * tkey_check ; Key * tkey_sign ; int flags = HDB_F_FOR_TGS_REQ ; memset ( & sessionkey, 0, sizeof ( sessionkey ) ) ; memset ( & adtkt, 0, sizeof ( adtkt

Fix:
<S2SV_ModStart> ; krb5_data rspac ; const char * tgt_realm = krb5_principal_get_realm ( context, krbtgt -> entry. principal ) <S2SV_ModStart>, cp, tgt_realm,
Buggy code:
 struct resource_pool * dce120_create_resource_pool ( uint8_t num_virtual_links, struct dc * dc ) { struct dce110_resource_pool * pool = kzalloc ( sizeof ( struct dce110_resource_pool ), GFP_KERNEL ) ; if (! pool ) return NULL ; if ( construct ( num_virtual_links, dc, pool ) ) return & pool -> base ; <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> -> base ; kfree ( pool ) ;
Buggy code:
 int cli_scanxar ( cli_ctx * ctx ) { int rc = CL_SUCCESS ; unsigned int cksum_fails = 0 ; unsigned int extract_errors = 0 ; # if HAVE_LIBXML2 int fd = - 1 ; struct xar_header hdr ; fmap_t * map = * ctx -> fmap ; <START_BUG> long length, offset, size, at ; <END_BUG> int encoding ; z_stream strm ; char * toc, * tmpname ; xmlTextReaderPtr reader = NULL ; int a_hash, e_hash ; unsigned char * a_cksum = NULL, * e_cksum = NULL ; void * a_hash_ctx = NULL, * e_hash_ctx = NULL ; char result [ SHA1_HASH_SIZE ] ; memset ( & strm, 0x00, sizeof ( z_stream ) ) ; if ( fmap_readn ( * ctx -> fmap, & hdr, 0, sizeof ( hdr ) )!= sizeof ( hdr ) ) { cli_dbgmsg ( "cli_scanxar:   Invalid   header,   too   short.\\n" ) ; return CL_EFORMAT ; } hdr. magic = be32_to_host ( hdr. magic ) ; if ( hdr. magic == XAR_HEADER_MAGIC ) { cli_dbgmsg ( "cli_scanxar:   Matched   magic\\n" ) ; } else { cli_dbgmsg ( "cli_scanxar:   Invalid   magic\\n" ) ; return CL_EFORMAT ; } hdr. size = be16_to_host ( hdr. size ) ; hdr. version = be16_to_host ( hdr. version ) ; hdr. toc_length_compressed = be64_to_host ( hdr. toc_length_compressed ) ; hdr. toc_length_decompressed = be64_to_host ( hdr. toc_length_decompressed ) ; hdr. chksum_alg = be32_to_host ( hdr. chksum_alg ) ; strm. next_in = ( unsigned char * ) fmap_need_off_once ( * ctx -> fmap, hdr. size, hdr. toc_length_compressed ) ; if ( strm. next_in == NULL ) { cli_dbgmsg ( "cli_scanxar:  

Fix:
<S2SV_ModStart> -> fmap ; size_t <S2SV_ModEnd> length, offset <S2SV_ModStart> ; goto exit_toc ; } if ( hdr. toc_length_decompressed!= strm. total_out ) { cli_dbgmsg ( "TOC <S2SV_blank> decompress <S2SV_blank> length <S2SV_blank> %" PRIu64 " <S2SV_blank> does <S2SV_blank> not <S2SV_blank> match <S2SV_blank> amount <S2SV_blank> decompressed <S2SV_blank> %lu\\n", hdr. toc_length_decompressed, strm. total_out ) ; toc [ strm. total_out ] = '\\0' ; hdr. toc_length_decompressed = strm. total_out <S2SV_ModStart> } cli_dbgmsg ( "cli_scanxar: <S2SV_blank> decompress <S2SV_blank> into <S2SV_blank> temp <S2SV_blank> file:\\n%s, <S2SV_blank> size <S2SV_blank> %zu,\\n" "from <S2SV_blank> xar <S2SV_blank> heap <S2SV_blank> offset <S2SV_blank> %zu <S2SV_blank> length <S2SV_blank> %zu\\n" <S2SV_ModEnd>, tmpname, <S2SV_ModStart> long in_remaining = MIN ( length, map -> len - at ) <S2SV_ModEnd> ; unsigned long <S2SV_ModStart> ; int lret ; if ( length > in_remaining ) length = in_remaining <S2SV_ModStart> ; cli_dbgmsg ( "cli_scanxar: <S2SV_blank> Can\'t <S2SV_blank> read <S2SV_blank> %i <S2SV_blank> bytes
Buggy code:
 static int parseOperand ( RAsm * a, const char * str, Operand * op, bool isrepop ) { size_t pos, nextpos = 0 ; x86newTokenType last_type ; int size_token = 1 ; bool explicit_size = false ; int reg_index = 0 ; op -> type = 0 ; while ( size_token ) { pos = nextpos ; last_type = getToken ( str, & pos, & nextpos ) ; if (! r_str_ncasecmp ( str + pos, "ptr", 3 ) ) { continue ; } else if (! r_str_ncasecmp ( str + pos, "byte", 4 ) ) { op -> type |= OT_MEMORY | OT_BYTE ; op -> dest_size = OT_BYTE ; explicit_size = true ; } else if (! r_str_ncasecmp ( str + pos, "word", 4 ) ) { op -> type |= OT_MEMORY | OT_WORD ; op -> dest_size = OT_WORD ; explicit_size = true ; } else if (! r_str_ncasecmp ( str + pos, "dword", 5 ) ) { op -> type |= OT_MEMORY | OT_DWORD ; op -> dest_size = OT_DWORD ; explicit_size = true ; } else if (! r_str_ncasecmp ( str + pos, "qword", 5 ) ) { op -> type |= OT_MEMORY | OT_QWORD ; op -> dest_size = OT_QWORD ; explicit_size = true ; } else if (! r_str_ncasecmp ( str + pos, "oword", 5 ) ) { op -> type |= OT_MEMORY | OT_OWORD ; op -> dest_size = OT_OWORD ; explicit_size = true ; } else if (! r_str_ncasecmp ( str + pos, "tbyte", 5 ) ) { op -> type |= OT_MEMORY | OT_TBYTE ; op -> dest_size = OT_TBYTE ; explicit_size = true ; } else { size_token = 0 ; } } if ( str [ pos ] == '[' ) { if (! op -> type ) { op -> type = OT_MEMORY ; } op -> offset = op -> scale [ 0 ] = op -> scale [ 1 ] = 0 ;

Fix:
<S2SV_ModStart> X86R_UNDEFINED ) { if ( reg_index < 2 ) { <S2SV_ModStart> = temp ; } <S2SV_ModStart> += temp ; if ( reg_index < 2 ) { <S2SV_ModStart> = X86R_UNDEFINED ; }
Buggy code:
 void * adminchild ( struct clientparam * param ) { int i, res ; char * buf ; char username [ 256 ] ; char * sb ; char * req = NULL ; struct printparam pp ; <START_BUG> int contentlen = 0 ; <END_BUG> int isform = 0 ; pp. inbuf = 0 ; pp. cp = param ; buf = myalloc ( LINESIZE ) ; if (! buf ) { RETURN ( 555 ) ; } i = sockgetlinebuf ( param, CLIENT, ( unsigned char * ) buf, LINESIZE - 1, '\\n', conf. timeouts [ STRING_S ] ) ; if ( i < 5 || ( ( buf [ 0 ]!= 'G' || buf [ 1 ]!= 'E' || buf [ 2 ]!= 'T' || buf [ 3 ]!=' '|| buf [ 4 ]!= '//' ) && ( buf [ 0 ]!= 'P' || buf [ 1 ]!= 'O' || buf [ 2 ]!= 'S' || buf [ 3 ]!= 'T' || buf [ 4 ]!=' '|| buf [ 5 ]!= '//' ) ) ) { RETURN ( 701 ) ; } buf [ i ] = 0 ; sb = strchr ( buf + 5,' ') ; if (! sb ) { RETURN ( 702 ) ; } * sb = 0 ; req = mystrdup ( buf + ( ( * buf == 'P' )? 6 : 5 ) ) ; while ( ( i = sockgetlinebuf ( param, CLIENT, ( unsigned char * ) buf, LINESIZE - 1, '\\n', conf. timeouts [ STRING_S ] ) ) > 2 ) { buf [ i ] = 0 ; if ( i > 19 && (! strncasecmp ( buf, "authorization", 13 ) ) ) { sb = strchr ( buf, ':' ) ; if (! sb ) continue ; ++ sb ; while ( isspace ( * sb ) ) sb ++ ; if (! * sb || strncasecmp ( sb, "basic", 5 ) ) { continue ; } sb += 5 ; while ( isspace ( * sb ) ) sb ++ ; i = de64 ( ( unsigned char * ) sb, ( unsigned char * ) username, 255 ) ; if ( i <= 0 ) continue ; username [ i ] = 0 ; sb = strchr ( ( char * ) username, ':' ) ; if ( sb

Fix:
<S2SV_ModStart> printparam pp ; unsigned <S2SV_ModEnd> contentlen = 0 <S2SV_ModStart> sb ++ ; sscanf ( sb, "%u", & contentlen ) ; if ( contentlen > LINESIZE * 1024 ) contentlen = 0 <S2SV_ModEnd> ; } else <S2SV_ModStart> & pp, "<form <S2SV_blank> method=\\"POST\\" <S2SV_blank> action=\\"//U\\" <S2SV_blank> enctype=\\"application//x-www-form-urlencoded\\"><textarea <S2SV_blank> cols=\\"80\\" <S2SV_blank> rows=\\"30\\" <S2SV_blank> name=\\"conffile\\">" <S2SV_ModEnd> ) ; while <S2SV_ModStart> 'U' : { unsigned <S2SV_ModEnd> l = 0 <S2SV_ModStart>! writable ||! contentlen || <S2SV_ModStart> } while ( l < contentlen && <S2SV_ModStart> ) buf, ( contentlen - l ) > <S2SV_ModStart> LINESIZE - 1? LINESIZE - 1 : contentlen - l <S2SV_ModStart> l ) ; if (! l ) { if ( i < 9 || <S2SV_ModEnd> strncasecmp ( buf <S2SV_ModStart> error ) { buf [ i ] = 0 ; <S2SV_ModStart> l += i <S2SV_ModEnd> ; } if
Buggy code:
 static M_fs_error_t M_fs_copy_file ( const char * path_old, const char * path_new, M_fs_file_mode_t mode, M_fs_progress_cb_t cb, M_fs_progress_flags_t progress_flags, M_fs_progress_t * progress, const M_fs_perms_t * perms ) { M_fs_file_t * fd_old ; M_fs_file_t * fd_new ; M_fs_info_t * info = NULL ; unsigned char temp [ M_FS_BUF_SIZE ] ; size_t read_len ; size_t wrote_len ; size_t wrote_total = 0 ; size_t offset ; M_fs_error_t res ; <START_BUG> if ( M_fs_perms_can_access ( path_new, M_FS_PERMS_MODE_NONE ) == M_FS_ERROR_SUCCESS ) { <END_BUG> res = M_fs_delete ( path_new, M_FALSE, NULL, M_FS_PROGRESS_NOEXTRA ) ; if ( res!= M_FS_ERROR_SUCCESS ) { return res ; } } res = M_fs_file_open ( & fd_old, path_old, M_FS_BUF_SIZE, M_FS_FILE_MODE_READ | M_FS_FILE_MODE_NOCREATE, NULL ) ; if ( res!= M_FS_ERROR_SUCCESS ) { return res ; } if ( perms == NULL && mode & M_FS_FILE_MODE_PRESERVE_PERMS ) { res = M_fs_info_file ( & info, fd_old, M_FS_PATH_INFO_FLAGS_NONE ) ; if ( res!= M_FS_ERROR_SUCCESS ) { M_fs_file_close ( fd_old ) ; return res ; } perms = M_fs_info_get_perms ( info ) ; } res = M_fs_file_open ( & fd_new, path_new, M_FS_BUF_SIZE, M_FS_FILE_MODE_WRITE | M_FS_FILE_MODE_OVERWRITE, perms ) ; M_fs_info_destroy ( info ) ; if ( res!= M_FS_ERROR_SUCCESS )

Fix:
<S2SV_ModStart> M_fs_error_t res ; <S2SV_ModEnd> res = M_fs_file_open
Buggy code:
 void __scm_destroy ( struct scm_cookie * scm ) { struct scm_fp_list * fpl = scm -> fp ; int i ; if ( fpl ) { scm -> fp = NULL ; for ( i = fpl -> count - 1 ; i >= 0 ; i -- ) fput ( fpl -> fp [ i ] ) ; <START_BUG> kfree ( fpl ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> ] ) ; free_uid ( fpl -> user ) ;
Buggy code:
 static zend_bool add_post_var ( zval * arr, post_var_data_t * var, zend_bool eof ) { <START_BUG> char * ksep, * vsep, * val ; <END_BUG> size_t klen, vlen ; size_t new_vlen ; if ( var -> ptr >= var -> end ) { return 0 ; }  vsep = memchr ( var -> ptr, '&', var -> end - var -> ptr ) ; <START_BUG> if (! vsep ) { <END_BUG> if (! eof ) {  return 0 ; } else { vsep = var -> end ; } } ksep = memchr ( var -> ptr, '=', vsep - var -> ptr ) ; if ( ksep ) { * ksep = '\\0' ; klen = ksep - var -> ptr ; vlen = vsep - ++ ksep ; } else { ksep = "" ; klen = vsep - var -> ptr ; vlen = 0 ; } php_url_decode ( var -> ptr, klen ) ; val = estrndup ( ksep, vlen ) ; if ( vlen ) { vlen = php_url_decode ( val, vlen ) ; } if ( sapi_module. input_filter ( PARSE_POST, var -> ptr, & val, vlen, & new_vlen ) ) { php_register_variable_safe ( var -> ptr, val, new_vlen, arr ) ; } efree ( val ) ; var -> ptr = vsep + ( vsep!= var -> end ) ; <START_BUG> return 1 ; <END_BUG> }

Fix:
<S2SV_ModStart> { char * start, * <S2SV_ModStart> 0 ; } start = var -> ptr + var -> already_scanned ; <S2SV_ModStart> = memchr ( start <S2SV_ModEnd>, '&', <S2SV_ModStart> -> end - start <S2SV_ModEnd> ) ; if <S2SV_ModStart> eof ) { var -> already_scanned = var -> end - var -> ptr ; <S2SV_ModStart> end ) ; var -> already_scanned = 0 ;
Buggy code:
 WORD32 ih264d_mark_err_slice_skip ( dec_struct_t * ps_dec, WORD32 num_mb_skip, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num, pocstruct_t * ps_cur_poc, WORD32 prev_slice_err ) { WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2 ; UWORD32 u1_mb_idx = ps_dec -> u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end ; UWORD32 u1_tfr_n_mb ; UWORD32 u1_decode_nmb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD16 u2_total_mbs_coded ; UWORD32 u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; parse_part_params_t * ps_part_info ; WORD32 ret ; UNUSED ( u1_is_idr_slice ) ; if ( ps_dec -> ps_dec_err_status -> u1_err_flag & REJECT_CUR_PIC ) { ih264d

Fix:
<S2SV_ModStart> } } } <S2SV_ModEnd> } else {
Buggy code:
 static int rsvp_obj_print ( netdissect_options * ndo, const u_char * pptr, u_int plen, const u_char * tptr, const char * ident, u_int tlen, const struct rsvp_common_header * rsvp_com_header ) { const struct rsvp_object_header * rsvp_obj_header ; const u_char * obj_tptr ; union { const struct rsvp_obj_integrity_t * rsvp_obj_integrity ; const struct rsvp_obj_frr_t * rsvp_obj_frr ; } obj_ptr ; u_short rsvp_obj_len, rsvp_obj_ctype, obj_tlen, intserv_serv_tlen ; int hexdump, processed, padbytes, error_code, error_value, i, sigcheck ; union { float f ; uint32_t i ; } bw ; uint8_t namelen ; u_int action, subchannel ; while ( tlen >= sizeof ( struct rsvp_object_header ) ) { ND_TCHECK2 ( * tptr, sizeof ( struct rsvp_object_header ) ) ; rsvp_obj_header = ( const struct rsvp_object_header * ) tptr ; rsvp_obj_len = EXTRACT_16BITS ( rsvp_obj_header -> length ) ; rsvp_obj_ctype = rsvp_obj_header -> ctype ; if ( rsvp_obj_len % 4 ) { ND_PRINT ( ( ndo, "%sERROR:   object   header   size   %u   not   a   multiple   of   4", ident, rsvp_obj_len ) ) ; return - 1 ; } if ( rsvp_obj_len < sizeof ( struct rsvp_object_header ) ) { ND_PRINT ( ( ndo, "%sERROR:   object   header   too   short   %u   <   %lu", ident, rsvp_obj_len, ( unsigned long ) sizeof ( const struct rsvp_object_header ) ) ) ; return - 1 ; } ND_PRINT ( ( ndo, "%s%s   Object   (%u)   Flags:   [%s", ident, tok2str ( rsvp_obj_values

Fix:
<S2SV_ModStart> ) obj_tptr ; switch ( rsvp_obj_ctype ) { case RSVP_CTYPE_1 : if ( obj_tlen < sizeof ( struct rsvp_obj_frr_t ) ) return - 1 ; <S2SV_ModStart> bandwidth ) ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> - 1 ; bw. i = EXTRACT_32BITS ( obj_ptr. rsvp_obj_frr -> bandwidth ) ;
Buggy code:
 static int cqspi_setup_flash ( struct cqspi_st * cqspi, struct device_node * np ) { struct platform_device * pdev = cqspi -> pdev ; struct device * dev = & pdev -> dev ; struct cqspi_flash_pdata * f_pdata ; struct spi_nor * nor ; struct mtd_info * mtd ; unsigned int cs ; int i, ret ; for_each_available_child_of_node ( dev -> of_node, np ) { if ( of_property_read_u32 ( np, "reg", & cs ) ) { dev_err ( dev, "Couldn\'t   determine   chip   select.\\n" ) ; goto err ; } <START_BUG> if ( cs > CQSPI_MAX_CHIPSELECT ) { <END_BUG> dev_err ( dev, "Chip   select   %d   out   of   range.\\n", cs ) ; goto err ; } f_pdata = & cqspi -> f_pdata [ cs ] ; f_pdata -> cqspi = cqspi ; f_pdata -> cs = cs ; ret = cqspi_of_get_flash_pdata ( pdev, f_pdata, np ) ; if ( ret ) goto err ; nor = & f_pdata -> nor ; mtd = & nor -> mtd ; mtd -> priv = nor ; nor -> dev = dev ; spi_nor_set_flash_node ( nor, np ) ; nor -> priv = f_pdata ; nor -> read_reg = cqspi_read_reg ; nor -> write_reg = cqspi_write_reg ; nor -> read = cqspi_read ; nor -> write = cqspi_write ; nor -> erase = cqspi_erase ; nor -> prepare = cqspi_prep ; nor -> unprepare = cqspi_unprep ; mtd -> name = devm_kasprintf ( dev, GFP_KERNEL, "%s.%d", dev_name ( dev ), cs ) ; if (! mtd -> name ) { ret = - ENOMEM ; goto err ; } ret = spi_nor_scan ( nor, NULL, SPI_NOR_QUAD ) ; if ( ret ) goto

Fix:
<S2SV_ModStart> if ( cs >= <S2SV_ModEnd> CQSPI_MAX_CHIPSELECT ) {
Buggy code:
 static void f_parser ( lua_State * L, void * ud ) { int i ; Proto * tf ; Closure * cl ; struct SParser * p = cast ( struct SParser *, ud ) ; int c = luaZ_lookahead ( p -> z ) ; luaC_checkGC ( L ) ; <START_BUG> tf = ( ( c == LUA_SIGNATURE [ 0 ] )? luaU_undump : luaY_parser ) ( L, p -> z, <END_BUG> & p -> buff, p -> name ) ; cl = luaF_newLclosure ( L, tf -> nups, hvalue ( gt ( L ) ) ) ; cl -> l. p = tf ; for ( i = 0 ; i < tf -> nups ; i ++ ) cl -> l. upvals [ i ] = luaF_newupval ( L ) ; setclvalue ( L, L -> top, cl ) ; incr_top ( L ) ; }

Fix:
<S2SV_ModStart> tf = ( <S2SV_ModEnd> luaY_parser ) (
Buggy code:
 static int ext4_xattr_block_list ( struct dentry * dentry, char * buffer, size_t buffer_size ) { struct inode * inode = d_inode ( dentry ) ; struct buffer_head * bh = NULL ; int error ; <START_BUG> struct mb_cache * ext4_mb_cache = EXT4_GET_MB_CACHE ( inode ) ; <END_BUG> ea_idebug ( inode, "buffer=%p,   buffer_size=%ld", buffer, ( long ) buffer_size ) ; error = 0 ; if (! EXT4_I ( inode ) -> i_file_acl ) goto cleanup ; ea_idebug ( inode, "reading   block   %llu", ( unsigned long long ) EXT4_I ( inode ) -> i_file_acl ) ; bh = sb_bread ( inode -> i_sb, EXT4_I ( inode ) -> i_file_acl ) ; error = - EIO ; if (! bh ) goto cleanup ; ea_bdebug ( bh, "b_count=%d,   refcount=%d", atomic_read ( & ( bh -> b_count ) ), le32_to_cpu ( BHDR ( bh ) -> h_refcount ) ) ; if ( ext4_xattr_check_block ( inode, bh ) ) { EXT4_ERROR_INODE ( inode, "bad   block   %llu", EXT4_I ( inode ) -> i_file_acl ) ; error = - EFSCORRUPTED ; goto cleanup ; } ext4_xattr_cache_insert ( ext4_mb_cache, bh ) ; error = ext4_xattr_list_entries ( dentry, BFIRST ( bh ), buffer, buffer_size ) ; cleanup : brelse ( bh ) ; return error ; }

Fix:
<S2SV_ModStart> error ; struct mb2_cache <S2SV_ModEnd> * ext4_mb_cache =
Buggy code:
 __be32 ipv6_select_ident ( struct net * net, const struct in6_addr * daddr, const struct in6_addr * saddr ) { <START_BUG> static u32 ip6_idents_hashrnd __read_mostly ; <END_BUG> u32 id ; net_get_random_once ( & ip6_idents_hashrnd, sizeof ( ip6_idents_hashrnd ) ) ;  id = __ipv6_select_ident ( net, ip6_idents_hashrnd, daddr, saddr ) ; <START_BUG> return htonl ( id ) ; }<END_BUG>

Fix:
<S2SV_ModStart> saddr ) { u32 id <S2SV_ModEnd> ; id = <S2SV_ModStart> __ipv6_select_ident ( net <S2SV_ModEnd>, daddr,
Buggy code:
 static PyObject * <START_BUG> _Unpickler_MemoGet ( UnpicklerObject * self, Py_ssize_t idx ) <END_BUG> {  if ( idx < 0 || idx >= self -> memo_size ) <START_BUG> return NULL ; return self -> memo [ idx ] ; }<END_BUG>

Fix:
<S2SV_ModStart> * self, size_t <S2SV_ModEnd> idx ) { <S2SV_ModStart> { if ( <S2SV_ModEnd> idx >= self
Buggy code:
 <START_BUG> static void duplicate_mode_info_in_sb ( VP9_COMMON * const cm, <END_BUG>  MACROBLOCKD * const xd, <START_BUG> int mi_row, int mi_col, BLOCK_SIZE bsize ) { const int block_width = num_8x8_blocks_wide_lookup [ bsize ] ; const int block_height = num_8x8_blocks_high_lookup [ bsize ] ; int i, j ; for ( j = 0 ; j < block_height ; ++ j ) for ( i = 0 ; i < block_width ; ++ i ) { if ( mi_row + j < cm -> mi_rows && mi_col + i < cm -> mi_cols ) xd -> mi [ j * xd -> mi_stride + i ] = xd -> mi [ 0 ] ; } }<END_BUG>

Fix:
<S2SV_ModStart> ( VP9_COMMON * <S2SV_ModEnd> cm, MACROBLOCKD <S2SV_ModStart>, MACROBLOCKD * <S2SV_ModEnd> xd, int