nus-yam/ex-repair huggingface dataset:
Buggy code:
 int y4m_input_fetch_frame ( y4m_input * _y4m, FILE * _fin, vpx_image_t * _img ) { char frame [ 6 ] ; int pic_sz ; int c_w ; int c_h ; <START_BUG> int c_sz ; <END_BUG> if (! file_read ( frame, 6, _fin ) ) return 0 ; if ( memcmp ( frame, "FRAME", 5 ) ) { fprintf ( stderr, "Loss   of   framing   in   Y4M   input   data\\n" ) ; return - 1 ; } if ( frame [ 5 ]!= '\\n' ) { char c ; int j ; for ( j = 0 ; j < 79 && file_read ( & c, 1, _fin ) && c!= '\\n' ; j ++ ) { } if ( j == 79 ) { fprintf ( stderr, "Error   parsing   Y4M   frame   header\\n" ) ; return - 1 ; } } if (! file_read ( _y4m -> dst_buf, _y4m -> dst_buf_read_sz, _fin ) ) { fprintf ( stderr, "Error   reading   Y4M   frame   data.\\n" ) ; return - 1 ; } if (! file_read ( _y4m -> aux_buf, _y4m -> aux_buf_read_sz, _fin ) ) { fprintf ( stderr, "Error   reading   Y4M   frame   data.\\n" ) ; return - 1 ; } ( * _y4m -> convert ) ( _y4m, _y4m -> dst_buf, _y4m -> aux_buf ) ; memset ( _img, 0, sizeof ( * _img ) ) ; _img -> fmt = _y4m -> vpx_fmt ; _img -> w = _img -> d_w = _y4m -> pic_w ; _img -> h = _img -> d_h = _y4m -> pic_h ; _img -> x_chroma_shift = _y4m -> dst_c_dec_h >> 1 ; _img -> y_chroma_shift = _y4m -> dst_c_dec_v >> 1 ;  _img -> bps

Fix:
<S2SV_ModStart> ; int c_sz ; int bytes_per_sample = _y4m -> bit_depth > 8? 2 : 1 <S2SV_ModStart> = _y4m -> bps <S2SV_ModEnd> ; pic_sz = <S2SV_ModStart> _y4m -> pic_h * bytes_per_sample <S2SV_ModStart> -> dst_c_dec_h ; c_w *= bytes_per_sample ; <S2SV_ModStart> -> stride [ VPX_PLANE_Y <S2SV_ModEnd> ] = _img <S2SV_ModStart> -> stride [ VPX_PLANE_ALPHA ] = <S2SV_ModEnd> _y4m -> pic_w <S2SV_ModStart> _y4m -> pic_w * bytes_per_sample <S2SV_ModStart> -> stride [ VPX_PLANE_U <S2SV_ModEnd> ] = _img <S2SV_ModStart> -> stride [ VPX_PLANE_V <S2SV_ModEnd> ] = c_w <S2SV_ModStart> -> planes [ VPX_PLANE_Y <S2SV_ModEnd> ] = _y4m <S2SV_ModStart> -> planes [ VPX_PLANE_U <S2SV_ModEnd> ] = _y4m <S2SV_ModStart> -> planes [ VPX_PLANE_V <S2SV_ModEnd> ] = _y4m <S2SV_ModStart> -> planes [ VPX_PLANE_ALPHA <S2SV_ModEnd> ] = _y4m
Buggy code:
 <START_BUG> static void fdct8 ( const int16_t * input, int16_t * output ) { <END_BUG>  int s0, s1, s2, s3, s4, s5, s6, s7 ; <START_BUG> <END_BUG> int t0, t1, t2, t3 ;  int x0, x1, x2, x3 ; s0 = input [ 0 ] + input [ 7 ] ; s1 = input [ 1 ] + input [ 6 ] ; s2 = input [ 2 ] + input [ 5 ] ; s3 = input [ 3 ] + input [ 4 ] ; s4 = input [ 3 ] - input [ 4 ] ; s5 = input [ 2 ] - input [ 5 ] ; s6 = input [ 1 ] - input [ 6 ] ; s7 = input [ 0 ] - input [ 7 ] ; x0 = s0 + s3 ; x1 = s1 + s2 ; x2 = s1 - s2 ; x3 = s0 - s3 ; t0 = ( x0 + x1 ) * cospi_16_64 ; t1 = ( x0 - x1 ) * cospi_16_64 ; t2 = x2 * cospi_24_64 + x3 * cospi_8_64 ; t3 = - x2 * cospi_8_64 + x3 * cospi_24_64 ; <START_BUG> output [ 0 ] = fdct_round_shift ( t0 ) ; <END_BUG>  output [ 2 ] = fdct_round_shift ( t2 ) ; <START_BUG> <END_BUG> output [ 4 ] = fdct_round_shift ( t1 ) ;  <START_BUG> output [ 6 ] = fdct_round_shift ( t3 ) ; <END_BUG> t0 = ( s6 - s5 ) * cospi_16_64 ; t1 = ( s6 + s5 ) * cospi_16_64 ;  t2 = fdct_round_shift ( t0 ) ; <START_BUG> t3 = fdct_round_shift ( t1 ) ; x0 = s4 + t2 ; x1 = s4 - t2 ; x2 = s7 - t3 ; x3 = s7 + t3 ; t0 = x0 * cospi_28_64 + x3 * cospi_4_64 ; t1 = x1 * cos<END_BUG>

Fix:
<S2SV_ModStart> fdct8 ( const tran_low_t * input, tran_low_t <S2SV_ModEnd> * output ) <S2SV_ModStart> output ) { tran_high_t <S2SV_ModEnd> s0, s1 <S2SV_ModStart>, s7 ; tran_high_t t0, t1, t2, t3 ; tran_high_t <S2SV_ModEnd> x0, x1 <S2SV_ModStart> 0 ] = ( tran_low_t ) <S2SV_ModStart> 2 ] = ( tran_low_t ) <S2SV_ModStart> 4 ] = ( tran_low_t ) <S2SV_ModStart> 6 ] = ( tran_low_t ) <S2SV_ModStart> ; t2 = ( tran_low_t ) fdct_round_shift ( t0 ) ; t3 = ( tran_low_t ) <S2SV_ModEnd> fdct_round_shift ( t1 <S2SV_ModStart> 1 ] = ( tran_low_t ) <S2SV_ModStart> 3 ] = ( tran_low_t ) <S2SV_ModStart> 5 ] = ( tran_low_t ) <S2SV_ModStart> 7 ] = ( tran_low_t )
Buggy code:
 static void get_cx_data ( struct stream_state * stream, struct VpxEncoderConfig * global, int * got_data ) { const vpx_codec_cx_pkt_t * pkt ; const struct vpx_codec_enc_cfg * cfg = & stream -> config. cfg ; vpx_codec_iter_t iter = NULL ; * got_data = 0 ; while ( ( pkt = vpx_codec_get_cx_data ( & stream -> encoder, & iter ) ) ) { static size_t fsize = 0 ; <START_BUG> static off_t ivf_header_pos = 0 ; <END_BUG> switch ( pkt -> kind ) { case VPX_CODEC_CX_FRAME_PKT : if (! ( pkt -> data. frame. flags & VPX_FRAME_IS_FRAGMENT ) ) { stream -> frames_out ++ ; } if (! global -> quiet ) fprintf ( stderr, "   %6luF", ( unsigned long ) pkt -> data. frame. sz ) ; update_rate_histogram ( stream -> rate_hist, cfg, pkt ) ; # if CONFIG_WEBM_IO if ( stream -> config. write_webm ) {  if (! stream -> ebml. debug ) <START_BUG> stream -> hash = murmur ( pkt -> data. frame. buf, ( int ) pkt -> data. frame. sz, stream -> hash ) ; write_webm_block ( & stream -> ebml, cfg, pkt ) ; } # endif if (! stream -> config. write_webm ) { if ( pkt -> data. frame. partition_id <= 0 ) { ivf_header_pos = ftello ( stream -> file ) ; fsize = pkt -> data. frame. sz ; ivf_write_frame_header ( stream -> file, pkt -> data. frame. pts, fsize ) ; } else { fsize += pkt -> data. frame. sz ; if (! ( pkt -> data. frame. flags & VPX_FRAME_IS_FRAGMENT ) ) { <END_BUG> off_t currpos = ftello ( stream -> file ) ;  fseeko ( stream -> file, ivf_header_pos, SEEK_SET ) ; ivf_write_frame_size ( stream -> file, fsize ) ; fseeko ( stream -> file

Fix:
<S2SV_ModStart> 0 ; static int64_t <S2SV_ModEnd> ivf_header_pos = 0 <S2SV_ModStart> write_webm ) { <S2SV_ModEnd> write_webm_block ( & <S2SV_ModStart> ) ) { const int64_t <S2SV_ModEnd> currpos = ftello <S2SV_ModStart> ; break ; # if CONFIG_FP_MB_STATS case VPX_CODEC_FPMB_STATS_PKT : stats_write ( & stream -> fpmb_stats, pkt -> data. firstpass_mb_stats. buf, pkt -> data. firstpass_mb_stats. sz ) ; stream -> nbytes += pkt -> data. raw. sz ; break ; # endif
Buggy code:
 static struct buffer_head * ext4_xattr_cache_find ( struct inode * inode, struct ext4_xattr_header * header, <START_BUG> struct mb_cache_entry * * pce ) <END_BUG> { __u32 hash = le32_to_cpu ( header -> h_hash ) ;  struct mb_cache_entry * ce ; <START_BUG> struct mb_cache * ext4_mb_cache = EXT4_GET_MB_CACHE ( inode ) ; if (! header -> h_hash ) return NULL ; ea_idebug ( inode, "looking   for   cached   blocks   [%x]", ( int ) hash ) ; <END_BUG> again :  <START_BUG> ce = mb_cache_entry_find_first ( ext4_mb_cache, inode -> i_sb -> s_bdev, <END_BUG> hash ) ; while ( ce ) { struct buffer_head * bh ;  if ( IS_ERR ( ce ) ) { <START_BUG> if ( PTR_ERR ( ce ) == - EAGAIN ) goto again ; break ; } bh = sb_bread ( inode -> i_sb, ce -> e_block ) ; if (! bh ) { EXT4_ERROR_INODE ( inode, "block   %lu   read   error", ( unsigned long ) ce -> e_block ) ; } else if ( le32_to_cpu ( BHDR ( bh ) -> h_refcount ) >= EXT4_XATTR_REFCOUNT_MAX ) { ea_idebug ( inode, "block   %lu   refcount   %d>=%d", ( unsigned long ) ce -> e_block, le32_to_cpu ( BHDR ( bh ) -> h_refcount ), EXT4_XATTR_REFCOUNT_MAX ) ; } else if ( ext4_xattr_cmp ( header, BHDR ( bh ) ) == 0 ) { * pce = ce ; return bh ; } brelse ( bh ) ; <END_BUG> ce = mb_cache_entry_find_next ( ce, inode -> i_sb -> s_bdev, hash ) ;  } return NULL ; }

Fix:
<S2SV_ModStart> header, struct mb2_cache_entry <S2SV_ModEnd> * * pce <S2SV_ModStart> ) ; struct mb2_cache_entry * ce ; struct mb2_cache <S2SV_ModEnd> * ext4_mb_cache = <S2SV_ModStart> hash ) ; ce = mb2_cache_entry_find_first <S2SV_ModEnd> ( ext4_mb_cache, <S2SV_ModStart> ( ext4_mb_cache, <S2SV_ModEnd> hash ) ; <S2SV_ModStart> * bh ; <S2SV_ModEnd> bh = sb_bread <S2SV_ModStart> ; ce = mb2_cache_entry_find_next ( ext4_mb_cache, ce <S2SV_ModEnd> ) ; }
Buggy code:
 int rds_ib_xmit ( struct rds_connection * conn, struct rds_message * rm, unsigned int hdr_off, unsigned int sg, unsigned int off ) { struct rds_ib_connection * ic = conn -> c_transport_data ; struct ib_device * dev = ic -> i_cm_id -> device ; struct rds_ib_send_work * send = NULL ; struct rds_ib_send_work * first ; struct rds_ib_send_work * prev ; struct ib_send_wr * failed_wr ; struct scatterlist * scat ; u32 pos ; u32 i ; u32 work_alloc ; u32 credit_alloc = 0 ; u32 posted ; u32 adv_credits = 0 ; int send_flags = 0 ; int bytes_sent = 0 ; int ret ; int flow_controlled = 0 ; int nr_sig = 0 ; BUG_ON ( off % RDS_FRAG_SIZE ) ; BUG_ON ( hdr_off!= 0 && hdr_off!= sizeof ( struct rds_header ) ) ; if ( conn -> c_loopback && rm -> m_inc. i_hdr. h_flags & RDS_FLAG_CONG_BITMAP ) { rds_cong_map_updated ( conn -> c_fcong, ~ ( u64 ) 0 ) ; <START_BUG> return sizeof ( struct rds_header ) + RDS_CONG_MAP_BYTES ; <END_BUG> } if ( be32_to_cpu ( rm -> m_inc. i_hdr. h_len ) == 0 ) i = 1 ; else i = ceil ( be32_to_cpu ( rm -> m_inc. i_hdr. h_len ), RDS_FRAG_SIZE ) ; work_alloc = rds_ib_ring_alloc ( & ic -> i_send_ring, i, & pos ) ; if ( work_alloc == 0 ) { set_bit ( RDS_LL_SEND_FULL, & conn -> c_flags ) ; rds_ib_stats_inc ( s_ib_tx_ring_full ) ; ret = - ENOMEM ; goto out ; } if ( ic -> i_flowctl ) { credit_alloc = rds_ib_send_grab_credits ( ic, work_alloc, & posted, 0, RDS_MAX_ADV_

Fix:
<S2SV_ModStart> 0 ) ; scat = & rm -> data. op_sg [ sg ] ; ret = <S2SV_ModEnd> sizeof ( struct <S2SV_ModStart> ) + RDS_CONG_MAP_BYTES ; ret = min_t ( int, ret, scat -> length - conn -> c_xmit_data_off ) ; return ret
Buggy code:
 static bool ResolveStateAndPredicate ( ExprDef * expr, enum xkb_match_operation * pred_rtrn, xkb_mod_mask_t * mods_rtrn, CompatInfo * info ) { if ( expr == NULL ) { * pred_rtrn = MATCH_ANY_OR_NONE ; * mods_rtrn = MOD_REAL_MASK_ALL ; return true ; } * pred_rtrn = MATCH_EXACTLY ; if ( expr -> expr. op == EXPR_ACTION_DECL ) { const char * pred_txt = xkb_atom_text ( info -> ctx, expr -> action. name ) ; <START_BUG> if (! LookupString ( symInterpretMatchMaskNames, pred_txt, pred_rtrn ) ) { <END_BUG> log_err ( info -> ctx, "Illegal   modifier   predicate   \\"%s\\";   Ignored\\n", pred_txt ) ; return false ; } expr = expr -> action. args ; } else if ( expr -> expr. op == EXPR_IDENT ) { const char * pred_txt = xkb_atom_text ( info -> ctx, expr -> ident. ident ) ; if ( pred_txt && istreq ( pred_txt, "any" ) ) { * pred_rtrn = MATCH_ANY ; * mods_rtrn = MOD_REAL_MASK_ALL ; return true ; } } return ExprResolveModMask ( info -> ctx, expr, MOD_REAL, & info -> mods, mods_rtrn ) ; }

Fix:
<S2SV_ModStart>, pred_rtrn ) ||! expr -> action. args
Buggy code:
 <START_BUG> static void <END_BUG> fpAcc ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; uint32 bps = tif -> tif_dir. td_bitspersample // 8 ; tmsize_t wc = cc // bps ; tmsize_t count = cc ; uint8 * cp = ( uint8 * ) cp0 ; uint8 * tmp = ( uint8 * ) _TIFFmalloc ( cc ) ;  assert ( ( cc % ( bps * stride ) ) == 0 ) ; <START_BUG> if (! tmp ) <END_BUG> return ;  while ( count > stride ) { REPEAT4 ( stride, cp [ stride ] = ( unsigned char ) ( ( cp [ stride ] + cp [ 0 ] ) & 0xff ) ; cp ++ ) count -= stride ; } _TIFFmemcpy ( tmp, cp0, cc ) ; cp = ( uint8 * ) cp0 ; for ( count = 0 ; count < wc ; count ++ ) { uint32 byte ; for ( byte = 0 ; byte < bps ; byte ++ ) { # if WORDS_BIGENDIAN cp [ bps * count + byte ] = tmp [ byte * wc + count ] ; # else cp [ bps * count + byte ] = tmp [ ( bps - byte - 1 ) * wc + count ] ; # endif } } _TIFFfree ( tmp ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> fpAcc ( TIFF <S2SV_ModStart> cc ) ; if <S2SV_ModEnd> ( cc % <S2SV_ModStart> * stride )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "fpAcc", "%s", "cc%(bps*stride))!=0" ) ; return 0 ; } <S2SV_ModEnd> if (! <S2SV_ModStart> tmp ) return 0 <S2SV_ModStart> tmp ) ; return 1 ;
Buggy code:
 static ssize_t _hostsock_sendmsg ( oe_fd_t * sock_, const struct oe_msghdr * msg, int flags ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; void * buf = NULL ; <START_BUG> size_t buf_size = 0 ; <END_BUG> oe_errno = 0 ; if (! sock ||! msg || ( msg -> msg_iovlen &&! msg -> msg_iov ) ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( msg -> msg_iov, ( int ) msg -> msg_iovlen, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_sendmsg_ocall ( & ret, sock -> host_fd, msg -> msg_name, msg -> msg_namelen, buf, msg -> msg_iovlen, buf_size, msg -> msg_control, msg -> msg_controllen, flags )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> done : <END_BUG> if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> ; size_t buf_size = 0 ; size_t data_size <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> ) ; } if ( ret > ( ssize_t ) data_size ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 int am_check_url ( request_rec * r, const char * url ) { const char * i ; for ( i = url ; * i ; i ++ ) { if ( * i >= 0 && * i <' ') { AM_LOG_RERROR ( APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r, "Control   character   detected   in   URL." ) ; return HTTP_BAD_REQUEST ; } <START_BUG> } <END_BUG> return OK ; }

Fix:
<S2SV_ModStart> HTTP_BAD_REQUEST ; } if ( * i == '\\\\' ) { AM_LOG_RERROR ( APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r, "Backslash <S2SV_blank> character <S2SV_blank> detected <S2SV_blank> in <S2SV_blank> URL." ) ; return HTTP_BAD_REQUEST ; }
Buggy code:
 YY_DECL { yy_state_type yy_current_state ; char * yy_cp, * yy_bp ; int yy_act ; struct yyguts_t * yyg = ( struct yyguts_t * ) yyscanner ; yylval = yylval_param ; if (! yyg -> yy_init ) { yyg -> yy_init = 1 ; # ifdef YY_USER_INIT YY_USER_INIT ; # endif if (! yyg -> yy_start ) yyg -> yy_start = 1 ; if (! yyin ) yyin = stdin ; if (! yyout ) yyout = stdout ; if (! YY_CURRENT_BUFFER ) { re_yyensure_buffer_stack ( yyscanner ) ; YY_CURRENT_BUFFER_LVALUE = re_yy_create_buffer ( yyin, YY_BUF_SIZE, yyscanner ) ; } re_yy_load_buffer_state ( yyscanner ) ; } { # line 99 "re_lexer.l" # line 863 "re_lexer.c" while ( 1 ) { yy_cp = yyg -> yy_c_buf_p ; * yy_cp = yyg -> yy_hold_char ; yy_bp = yy_cp ; yy_current_state = yyg -> yy_start ; yy_match : do { YY_CHAR yy_c = yy_ec [ YY_SC_TO_UI ( * yy_cp ) ] ; if ( yy_accept [ yy_current_state ] ) { yyg -> yy_last_accepting_state = yy_current_state ; yyg -> yy_last_accepting_cpos = yy_cp ; } while ( yy_chk [ yy_base [ yy_current_state ] + yy_c ]!= yy_current_state ) { yy_current_state = ( int ) yy_def [ yy_current_state ] ; if ( yy_current_state >= 45 ) yy_c = yy_meta [ ( unsigned int ) yy_c ] ; } yy_current_state = yy_nxt [ yy_base [ yy_current_state ] + ( unsigned int ) yy_c ] ; ++ yy_cp ; } while ( yy_current_state!= 44 ) ; yy_cp

Fix:
<S2SV_ModStart>, lex_env, "illegal <S2SV_blank> escape <S2SV_blank> sequence" <S2SV_ModEnd> ) ; yyterminate <S2SV_ModStart>, lex_env, "illegal <S2SV_blank> escape <S2SV_blank> sequence" <S2SV_ModEnd> ) ; yyterminate <S2SV_ModStart>, lex_env, "illegal <S2SV_blank> escape <S2SV_blank> sequence" <S2SV_ModEnd> ) ; yyterminate
Buggy code:
 static int unix_dgram_sendmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len ) { struct sock_iocb * siocb = kiocb_to_siocb ( kiocb ) ; struct sock * sk = sock -> sk ; struct net * net = sock_net ( sk ) ; struct unix_sock * u = unix_sk ( sk ) ; struct sockaddr_un * sunaddr = msg -> msg_name ; struct sock * other = NULL ; int namelen = 0 ; int err ; unsigned int hash ; struct sk_buff * skb ; long timeo ; struct scm_cookie tmp_scm ; int max_level ; int data_len = 0 ; if ( NULL == siocb -> scm ) siocb -> scm = & tmp_scm ; wait_for_unix_gc ( ) ; <START_BUG> err = scm_send ( sock, msg, siocb -> scm ) ; <END_BUG> if ( err < 0 ) return err ; err = - EOPNOTSUPP ; if ( msg -> msg_flags & MSG_OOB ) goto out ; if ( msg -> msg_namelen ) { err = unix_mkname ( sunaddr, msg -> msg_namelen, & hash ) ; if ( err < 0 ) goto out ; namelen = err ; } else { sunaddr = NULL ; err = - ENOTCONN ; other = unix_peer_get ( sk ) ; if (! other ) goto out ; } if ( test_bit ( SOCK_PASSCRED, & sock -> flags ) &&! u -> addr && ( err = unix_autobind ( sock ) )!= 0 ) goto out ; err = - EMSGSIZE ; if ( len > sk -> sk_sndbuf - 32 ) goto out ; if ( len > SKB_MAX_ALLOC ) data_len = min_t ( size_t, len - SKB_MAX_ALLOC, MAX_SKB_FRAGS * PAGE_SIZE ) ; skb = sock_alloc_send_pskb ( sk, len - data_len, data_len, msg -> msg_flags & MSG_DONTWAIT, & err ) ; if ( skb == NULL ) goto out ; err = unix_scm_to

Fix:
<S2SV_ModStart> siocb -> scm, false
Buggy code:
 static int isis_print_mt_port_cap_subtlv ( netdissect_options * ndo, const uint8_t * tptr, int len ) { int stlv_type, stlv_len ; const struct isis_subtlv_spb_mcid * subtlv_spb_mcid ; int i ; while ( len > 2 ) { <START_BUG> stlv_type = * ( tptr ++ ) ; <END_BUG> stlv_len = * ( tptr ++ ) ; ND_PRINT ( ( ndo, "\\n\\t               %s   subTLV   #%u,   length:   %u", tok2str ( isis_mt_port_cap_subtlv_values, "unknown", stlv_type ), stlv_type, stlv_len ) ) ;  len = len - 2 ; <START_BUG> switch ( stlv_type ) { case ISIS_SUBTLV_SPB_MCID : { <END_BUG> ND_TCHECK2 ( * ( tptr ), ISIS_SUBTLV_SPB_MCID_MIN_LEN ) ;  subtlv_spb_mcid = ( const struct isis_subtlv_spb_mcid * ) tptr ; ND_PRINT ( ( ndo, "\\n\\t                   MCID:   " ) ) ; isis_print_mcid ( ndo, & ( subtlv_spb_mcid -> mcid ) ) ; ND_PRINT ( ( ndo, "\\n\\t                   AUX-MCID:   " ) ) ; isis_print_mcid ( ndo, & ( subtlv_spb_mcid -> aux_mcid ) ) ; <START_BUG> tptr = tptr + sizeof ( struct isis_subtlv_spb_mcid ) ; <END_BUG> len = len - sizeof ( struct isis_subtlv_spb_mcid ) ; break ; } case ISIS_SUBTLV_SPB_DIGEST : {  ND_TCHECK2 ( * ( tptr ), ISIS_SUBTLV_SPB_DIGEST_MIN_LEN ) ; <START_BUG> ND_PRINT ( (<END_BUG>

Fix:
<S2SV_ModStart> 2 ) { ND_TCHECK2 ( * tptr, 2 ) ; <S2SV_ModStart> len - 2 ; if ( len < stlv_len ) goto trunc ; ND_TCHECK2 ( * ( tptr ), stlv_len ) <S2SV_ModStart> ISIS_SUBTLV_SPB_MCID : { if ( stlv_len < ISIS_SUBTLV_SPB_MCID_MIN_LEN ) goto trunc <S2SV_ModEnd> ; subtlv_spb_mcid = <S2SV_ModStart> = tptr + ISIS_SUBTLV_SPB_MCID_MIN_LEN ; len = len - ISIS_SUBTLV_SPB_MCID_MIN_LEN ; stlv_len = stlv_len - ISIS_SUBTLV_SPB_MCID_MIN_LEN <S2SV_ModEnd> ; break ; <S2SV_ModStart> ISIS_SUBTLV_SPB_DIGEST : { if ( stlv_len < ISIS_SUBTLV_SPB_DIGEST_MIN_LEN ) goto trunc <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> - ISIS_SUBTLV_SPB_DIGEST_MIN_LEN ; stlv_len = stlv_
Buggy code:
 static int read_header ( FFV1Context * f ) { uint8_t state [ CONTEXT_SIZE ] ; int i, j, context_count = - 1 ; RangeCoder * const c = & f -> slice_context [ 0 ] -> c ; memset ( state, 128, sizeof ( state ) ) ; if ( f -> version < 2 ) { <START_BUG> unsigned v = get_symbol ( c, state, 0 ) ; <END_BUG> if ( v >= 2 ) { av_log ( f -> avctx, AV_LOG_ERROR, "invalid   version   %d   in   ver01   header\\n", v ) ; return AVERROR_INVALIDDATA ; } f -> version = v ; f -> ac = f -> avctx -> coder_type = get_symbol ( c, state, 0 ) ; if ( f -> ac > 1 ) { for ( i = 1 ; i < 256 ; i ++ ) f -> state_transition [ i ] = get_symbol ( c, state, 1 ) + c -> one_state [ i ] ; } f -> colorspace = get_symbol ( c, state, 0 ) ; if ( f -> version > 0 ) f -> avctx -> bits_per_raw_sample = get_symbol ( c, state, 0 ) ;  f -> chroma_planes = get_rac ( c, state ) ; <START_BUG> <END_BUG> f -> chroma_h_shift = get_symbol ( c, state, 0 ) ;  <START_BUG> f -> chroma_v_shift = get_symbol ( c, state, 0 ) ; <END_BUG>  f -> transparency = get_rac ( c, state ) ; <START_BUG> f -> plane_count = 2 + f -> transparency ; } if ( f -> colorspace == 0 ) { if (! f -> transparency &&! f -> chroma_planes ) { if ( f -> avctx -> bits_per_raw_sample <= 8 ) f -> avctx -> pix_fmt = AV_PIX_FMT_GRAY8 ; else f -> avctx -> pix_fmt = AV_PIX_FMT_GRAY16 ; } else if ( f -> avctx -> bits_per_raw_sample <= 8 &&! f -> transparency ) { switch ( 16 * f -> chroma_h_shift + f -> chroma_v_shift ) { case 0x00 :<END_BUG>

Fix:
<S2SV_ModStart> 2 ) { int chroma_planes, chroma_h_shift, chroma_v_shift, transparency ; <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> chroma_planes = get_rac <S2SV_ModStart> state ) ; <S2SV_ModEnd> chroma_h_shift = get_symbol <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> chroma_v_shift = get_symbol <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> transparency = get_rac <S2SV_ModStart>, state ) ; if ( f -> plane_count ) { if ( chroma_planes!= f -> chroma_planes || chroma_h_shift!= f -> chroma_h_shift || chroma_v_shift!= f -> chroma_v_shift || transparency!= f -> transparency ) { av_log ( f -> avctx, AV_LOG_ERROR, "Invalid <S2SV_blank> change <S2SV_blank> of <S2SV_blank> global <S2SV_blank> parameters\\n" ) ; return AVERROR_INVALIDDATA ; } } f -> chroma_planes = chroma_planes ; f -> chroma_h_shift = chroma_h_shift ; f -> chroma_v_shift = chroma_v_shift ; f -> transparency = transparency
Buggy code:
 static void adapt_coef_probs ( VP9_COMMON * cm, TX_SIZE tx_size, unsigned int count_sat, unsigned int update_factor ) { const FRAME_CONTEXT * pre_fc = & cm -> frame_contexts [ cm -> frame_context_idx ] ; <START_BUG> vp9_coeff_probs_model * const probs = cm -> fc. coef_probs [ tx_size ] ; <END_BUG> const vp9_coeff_probs_model * const pre_probs = pre_fc -> coef_probs [ tx_size ] ; vp9_coeff_count_model * counts = cm -> counts. coef [ tx_size ] ; unsigned int ( * eob_counts ) [ REF_TYPES ] [ COEF_BANDS ] [ COEFF_CONTEXTS ] = cm -> counts. eob_branch [ tx_size ] ; int i, j, k, l, m ; for ( i = 0 ; i < PLANE_TYPES ; ++ i ) for ( j = 0 ; j < REF_TYPES ; ++ j ) for ( k = 0 ; k < COEF_BANDS ; ++ k ) for ( l = 0 ; l < BAND_COEFF_CONTEXTS ( k ) ; ++ l ) { const int n0 = counts [ i ] [ j ] [ k ] [ l ] [ ZERO_TOKEN ] ; const int n1 = counts [ i ] [ j ] [ k ] [ l ] [ ONE_TOKEN ] ; const int n2 = counts [ i ] [ j ] [ k ] [ l ] [ TWO_TOKEN ] ; const int neob = counts [ i ] [ j ] [ k ] [ l ] [ EOB_MODEL_TOKEN ] ; const unsigned int branch_ct [ UNCONSTRAINED_NODES ] [ 2 ] = { { neob, eob_counts [ i ] [ j ] [ k ] [ l ] - neob }, { n0, n1 + n2 }, { n1, n2 } } ; for ( m = 0 ; m < UNCONSTRAINED_NODES ; ++ m ) probs [ i ] [ j ] [ k ] [ l ] [ m ] = merge_probs ( pre_probs [ i ] [ j ] [ k ] [ l ] [ m ], branch_ct [ m ], count_sat, update

Fix:
<S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> coef_probs [ tx_size
Buggy code:
 int SMB2_read ( const unsigned int xid, struct cifs_io_parms * io_parms, unsigned int * nbytes, char * * buf, int * buf_type ) { struct smb_rqst rqst ; int resp_buftype, rc = - EACCES ; struct smb2_read_plain_req * req = NULL ; struct smb2_read_rsp * rsp = NULL ; struct kvec iov [ 1 ] ; struct kvec rsp_iov ; unsigned int total_len ; int flags = CIFS_LOG_ERROR ; struct cifs_ses * ses = io_parms -> tcon -> ses ; * nbytes = 0 ; rc = smb2_new_read_req ( ( void * * ) & req, & total_len, io_parms, NULL, 0, 0 ) ; if ( rc ) return rc ; if ( smb3_encryption_required ( io_parms -> tcon ) ) flags |= CIFS_TRANSFORM_REQ ; iov [ 0 ]. iov_base = ( char * ) req ; iov [ 0 ]. iov_len = total_len ; memset ( & rqst, 0, sizeof ( struct smb_rqst ) ) ; rqst. rq_iov = iov ; rqst. rq_nvec = 1 ; rc = cifs_send_recv ( xid, ses, & rqst, & resp_buftype, flags, & rsp_iov ) ; <START_BUG> cifs_small_buf_release ( req ) ; <END_BUG> rsp = ( struct smb2_read_rsp * ) rsp_iov. iov_base ; if ( rc ) { if ( rc!= - ENODATA ) { cifs_stats_fail_inc ( io_parms -> tcon, SMB2_READ_HE ) ; cifs_dbg ( VFS, "Send   error   in   read   =   %d\\n", rc ) ; trace_smb3_read_err ( xid, req -> PersistentFileId, io_parms -> tcon -> tid, ses -> Suid, io_parms -> offset, io_parms -> length, rc ) ; } else trace_smb3_read_done ( xid, req -> PersistentFileId, io_parms -> tcon -> tid

Fix:
<S2SV_ModStart> rsp_iov ) ; <S2SV_ModEnd> rsp = ( <S2SV_ModStart> length ) ; cifs_small_buf_release ( req ) ;
Buggy code:
 static OPJ_BOOL bmp_read_info_header ( FILE * IN, OPJ_BITMAPINFOHEADER * header ) { memset ( header, 0, sizeof ( * header ) ) ; header -> biSize = ( OPJ_UINT32 ) getc ( IN ) ; header -> biSize |= ( OPJ_UINT32 ) getc ( IN ) << 8 ; header -> biSize |= ( OPJ_UINT32 ) getc ( IN ) << 16 ; header -> biSize |= ( OPJ_UINT32 ) getc ( IN ) << 24 ; switch ( header -> biSize ) { case 12U : case 40U : case 52U : case 56U : case 108U : case 124U : break ; default : fprintf ( stderr, "Error,   unknown   BMP   header   size   %d\\n", header -> biSize ) ; return OPJ_FALSE ; } header -> biWidth = ( OPJ_UINT32 ) getc ( IN ) ; header -> biWidth |= ( OPJ_UINT32 ) getc ( IN ) << 8 ; header -> biWidth |= ( OPJ_UINT32 ) getc ( IN ) << 16 ; header -> biWidth |= ( OPJ_UINT32 ) getc ( IN ) << 24 ; header -> biHeight = ( OPJ_UINT32 ) getc ( IN ) ; header -> biHeight |= ( OPJ_UINT32 ) getc ( IN ) << 8 ; header -> biHeight |= ( OPJ_UINT32 ) getc ( IN ) << 16 ; header -> biHeight |= ( OPJ_UINT32 ) getc ( IN ) << 24 ; header -> biPlanes = ( OPJ_UINT16 ) getc ( IN ) ; header -> biPlanes |= ( OPJ_UINT16 ) ( ( OPJ_UINT32 ) getc ( IN ) << 8 ) ; header -> biBitCount = ( OPJ_UINT16 ) getc ( IN ) ; header -> biBitCount |= ( OPJ_UINT16 ) ( ( OPJ_UINT32 ) getc ( IN ) << 8 ) ; <START_BUG> if ( header -> biSize >= 40U ) { <END_BUG> header -> biCompression = ( OPJ_UINT32 ) getc ( IN ) ; header -> biCompression |= ( OP

Fix:
<S2SV_ModStart> ( header -> biBitCount == 0 ) { fprintf ( stderr, "Error, <S2SV_blank> invalid <S2SV_blank> biBitCount <S2SV_blank> %d\\n", 0 ) ; return OPJ_FALSE ; } if ( header ->
Buggy code:
 int wwunpack ( uint8_t * exe, uint32_t exesz, uint8_t * wwsect, struct cli_exe_section * sects, uint16_t scount, uint32_t pe, int desc ) { uint8_t * structs = wwsect + 0x2a1, * compd, * ccur, * unpd, * ucur, bc ; uint32_t src, srcend, szd, bt, bits ; int error = 0, i ; cli_dbgmsg ( "in   wwunpack\\n" ) ; while ( 1 ) { if (! CLI_ISCONTAINED ( wwsect, sects [ scount ]. rsz, structs, 17 ) ) { cli_dbgmsg ( "WWPack:   Array   of   structs   out   of   section\\n" ) ; break ; } src = sects [ scount ]. rva - cli_readint32 ( structs ) ; structs += 8 ; szd = cli_readint32 ( structs ) * 4 ; structs += 4 ; srcend = cli_readint32 ( structs ) ; structs += 4 ; unpd = ucur = exe + src + srcend + 4 - szd ; if (! szd ||! CLI_ISCONTAINED ( exe, exesz, unpd, szd ) ) { cli_dbgmsg ( "WWPack:   Compressed   data   out   of   file\\n" ) ; break ; } cli_dbgmsg ( "WWP:   src:   %x,   szd:   %x,   srcend:   %x   -   %x\\n", src, szd, srcend, srcend + 4 - szd ) ; if (! ( compd = cli_malloc ( szd ) ) ) { cli_dbgmsg ( "WWPack:   Unable   to   allocate   memory   for   compd\\n" ) ; break ; } memcpy ( compd, unpd, szd ) ; memset ( unpd, - 1, szd ) ; ccur = compd ; RESEED ; while (! error ) { uint32_t backbytes, backsize ; uint8_t saved ; BIT ; if (! bits ) { if ( ccur - comp

Fix:
<S2SV_ModStart> 8 ) ; if (! CLI_ISCONTAINED ( wwsect, sects [ scount ]. rsz, wwsect + 0x295, 4 ) ||! CLI_ISCONTAINED ( wwsect, sects [ scount ]. rsz, wwsect + 0x295 + sects [ scount ]. rva, 4 ) ||! CLI_ISCONTAINED ( wwsect, sects [ scount ]. rsz, wwsect + 0x295 + sects [ scount ]. rva + 0x299, 4 ) ) { cli_dbgmsg ( "WWPack: <S2SV_blank> unpack <S2SV_blank> memory <S2SV_blank> address <S2SV_blank> out <S2SV_blank> of <S2SV_blank> bounds.\\n" ) ; return CL_EFORMAT ; }
Buggy code:
 void zephyr_print ( netdissect_options * ndo, const u_char * cp, int length ) { struct z_packet z ; const char * parse = ( const char * ) cp ; int parselen = length ; const char * s ; int lose = 0 ; <START_BUG> z. kind = 0 ; <END_BUG> z. class = 0 ; z. inst = 0 ; z. opcode = 0 ; z. sender = 0 ; z. recipient = 0 ;  # define PARSE_STRING s = parse_field ( ndo, & parse, & parselen ) ; if (! s ) lose = 1 ; <START_BUG> # define PARSE_FIELD_INT ( field ) PARSE_STRING if (! lose ) field = strtol ( s, 0, 16 ) ; # define PARSE_FIELD_STR ( field ) PARSE_STRING if (! lose ) field = s ; PARSE_FIELD_STR ( z. version ) ; if ( lose ) return ; if ( strncmp ( z. version, "ZEPH", 4 ) ) return ; PARSE_FIELD_INT ( z. numfields ) ; PARSE_FIELD_INT ( z. kind ) ; PARSE_FIELD_STR ( z. uid ) ; PARSE_FIELD_INT ( z. port ) ; PARSE_FIELD_INT ( z. auth ) ; PARSE_FIELD_INT ( z. authlen ) ; PARSE_FIELD_STR ( z. authdata ) ; PARSE_FIELD_STR ( z. class ) ; PARSE_FIELD_STR ( z. inst ) ; PARSE_FIELD_STR ( z. opcode ) ; PARSE_FIELD_STR ( z. sender ) ; PARSE_FIELD_STR ( z. recipient ) ; PARSE_FIELD_STR ( z. format ) ; PARSE_FIELD_INT ( z. cksum ) ; PARSE_FIELD_INT ( z. multi ) ; PARSE_FIELD_STR ( z. multi_uid ) ; <END_BUG> if ( lose ) {  ND_PRINT ( ( ndo, "   [|zephyr]   (%d)", length ) ) ; return ; } ND_PRINT ( ( ndo, "   zephyr" ) ) ; if ( strncmp ( z. version + 4, "0.2", 3 ) ) { ND_PRINT ( ( ndo, "   v%s", z. version + 4 ) ) ; return ;

Fix:
<S2SV_ModStart> = 0 ; int truncated = 0 ; <S2SV_ModStart>, & parselen, & truncated ) ; if ( truncated ) goto trunc <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( lose ) goto trunc ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ) ) ; return ; trunc : ND_PRINT ( ( ndo, " <S2SV_blank> [|zephyr] <S2SV_blank> (%d)", length ) ) ; return ;
Buggy code:
 static __u8 * cp_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { unsigned long quirks = ( unsigned long ) hid_get_drvdata ( hdev ) ; unsigned int i ; <START_BUG> if (! ( quirks & CP_RDESC_SWAPPED_MIN_MAX ) ) <END_BUG> return rdesc ; for ( i = 0 ; i < * rsize - 4 ; i ++ ) if ( rdesc [ i ] == 0x29 && rdesc [ i + 2 ] == 0x19 ) { rdesc [ i ] = 0x19 ; rdesc [ i + 2 ] = 0x29 ; swap ( rdesc [ i + 3 ], rdesc [ i + 1 ] ) ; } return rdesc ; }

Fix:
<S2SV_ModStart> & CP_RDESC_SWAPPED_MIN_MAX ) ) return rdesc ; if ( * rsize < 4
Buggy code:
 int hugetlb_reserve_pages ( struct inode * inode, long from, long to, struct vm_area_struct * vma, vm_flags_t vm_flags ) { long ret, chg ; struct hstate * h = hstate_inode ( inode ) ; <START_BUG> if ( vm_flags & VM_NORESERVE ) <END_BUG> return 0 ; if (! vma || vma -> vm_flags & VM_MAYSHARE ) chg = region_chg ( & inode -> i_mapping -> private_list, from, to ) ; else { struct resv_map * resv_map = resv_map_alloc ( ) ; if (! resv_map ) return - ENOMEM ; chg = to - from ; set_vma_resv_map ( vma, resv_map ) ; set_vma_resv_flags ( vma, HPAGE_RESV_OWNER ) ; } if ( chg < 0 ) return chg ;  if ( hugetlb_get_quota ( inode -> i_mapping, chg ) ) <START_BUG> return - ENOSPC ; ret = hugetlb_acct_memory ( h, chg ) ; if ( ret < 0 ) { <END_BUG> hugetlb_put_quota ( inode -> i_mapping, chg ) ;  return ret ; } if (! vma || vma -> vm_flags & VM_MAYSHARE ) region_add ( & inode -> i_mapping -> private_list, from, to ) ; return 0 ; }

Fix:
<S2SV_ModStart> inode ) ; struct hugepage_subpool * spool = subpool_inode ( inode ) ; <S2SV_ModStart> ; if ( hugepage_subpool_get_pages ( spool <S2SV_ModEnd>, chg ) <S2SV_ModStart> 0 ) { hugepage_subpool_put_pages ( spool <S2SV_ModEnd>, chg )
Buggy code:
 static int ima_lsm_rule_init ( struct ima_measure_rule_entry * entry, char * args, int lsm_rule, int audit_type ) { int result ; if ( entry -> lsm [ lsm_rule ]. rule ) return - EINVAL ; entry -> lsm [ lsm_rule ]. type = audit_type ; result = security_filter_rule_init ( entry -> lsm [ lsm_rule ]. type, Audit_equal, args, & entry -> lsm [ lsm_rule ]. rule ) ; <START_BUG> return result ; <END_BUG> }

Fix:
<S2SV_ModStart> rule ) ; if (! entry -> lsm [ lsm_rule ]. rule ) return - EINVAL ;
Buggy code:
 <START_BUG> void vp9_choose_segmap_coding_method ( VP9_COMP * cpi ) { <END_BUG> VP9_COMMON * const cm = & cpi -> common ; struct segmentation * seg = & cm -> seg ; int no_pred_cost ; int t_pred_cost = INT_MAX ; int i, tile_col, mi_row, mi_col ; int temporal_predictor_count [ PREDICTION_PROBS ] [ 2 ] = { { 0 } } ; int no_pred_segcounts [ MAX_SEGMENTS ] = { 0 } ; int t_unpred_seg_counts [ MAX_SEGMENTS ] = { 0 } ;  vp9_prob no_pred_tree [ SEG_TREE_PROBS ] ; <START_BUG> <END_BUG> vp9_prob t_pred_tree [ SEG_TREE_PROBS ] ;  <START_BUG> vp9_prob t_nopred_prob [ PREDICTION_PROBS ] ; <END_BUG>  const int mis = cm -> mi_stride ; <START_BUG> MODE_INFO * * mi_ptr, * * mi ; vpx_memset ( seg -> tree_probs, 255, sizeof ( seg -> tree_probs ) ) ; <END_BUG> vpx_memset ( seg -> pred_probs, 255, sizeof ( seg -> pred_probs ) ) ;  for ( tile_col = 0 ; tile_col < 1 << cm -> log2_tile_cols ; tile_col ++ ) { TileInfo tile ; <START_BUG> vp9_tile_init ( & tile, cm, 0, tile_col ) ; <END_BUG> mi_ptr = cm -> mi_grid_visible + tile. mi_col_start ; for ( mi_row = 0 ; mi_row < cm -> mi_rows ;  mi_row += 8, mi_ptr += 8 * mis ) { <START_BUG> mi = mi_ptr ; for ( mi_col = tile. mi_col_start ; mi_col < tile. mi_col_end ; mi_col += 8, mi += 8 ) <END_BUG> count_segs_sb ( cpi, & tile, mi, no_pred_segcounts,  temporal_predictor_count, t_unpred_seg_counts, mi_row, mi_col, BLOCK_64X64 ) ; } } calc_segtree_probs ( no_pred_segcounts,

Fix:
<S2SV_ModStart> void vp9_choose_segmap_coding_method ( VP9_COMMON * cm, MACROBLOCKD * xd ) { <S2SV_ModEnd> struct segmentation * <S2SV_ModStart> 0 } ; vpx_prob <S2SV_ModEnd> no_pred_tree [ SEG_TREE_PROBS <S2SV_ModStart> SEG_TREE_PROBS ] ; vpx_prob <S2SV_ModEnd> t_pred_tree [ SEG_TREE_PROBS <S2SV_ModStart> SEG_TREE_PROBS ] ; vpx_prob <S2SV_ModEnd> t_nopred_prob [ PREDICTION_PROBS <S2SV_ModStart> PREDICTION_PROBS ] ; memset <S2SV_ModEnd> ( seg -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( seg -> <S2SV_ModStart> TileInfo tile ; MODE_INFO * * mi_ptr ; <S2SV_ModStart> += 8 * cm -> mi_stride ) { MODE_INFO * * <S2SV_ModEnd> mi = mi_ptr <S2SV_ModStart> ) count_segs_sb ( cm, xd <S2SV_ModEnd>, & tile <S2SV_ModStart> = 1 ; memcpy <S2SV_ModEnd> ( seg -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( seg -> <S2SV_ModStart> = 0 ; memcpy <S2SV_ModEnd> ( seg ->
Buggy code:
 IV_API_CALL_STATUS_T impeg2d_api_entity ( iv_obj_t * ps_dechdl, void * pv_api_ip, void * pv_api_op ) { iv_obj_t * ps_dec_handle ; dec_state_t * ps_dec_state ; dec_state_multi_core_t * ps_dec_state_multi_core ; impeg2d_video_decode_ip_t * ps_dec_ip ; impeg2d_video_decode_op_t * ps_dec_op ; WORD32 bytes_remaining ; pic_buf_t * ps_disp_pic ; ps_dec_ip = ( impeg2d_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( impeg2d_video_decode_op_t * ) pv_api_op ; memset ( ps_dec_op, 0, sizeof ( impeg2d_video_decode_op_t ) ) ; ps_dec_op -> s_ivd_video_decode_op_t. u4_size = sizeof ( impeg2d_video_decode_op_t ) ; ps_dec_op -> s_ivd_video_decode_op_t. u4_output_present = 0 ; bytes_remaining = ps_dec_ip -> s_ivd_video_decode_ip_t. u4_num_Bytes ; ps_dec_handle = ( iv_obj_t * ) ps_dechdl ; if ( ps_dechdl == NULL ) { return ( IV_FAIL ) ; } ps_dec_state_multi_core = ps_dec_handle -> pv_codec_handle ; ps_dec_state = ps_dec_state_multi_core -> ps_dec_state [ 0 ] ; ps_dec_state -> ps_disp_frm_buf = & ( ps_dec_op -> s_ivd_video_decode_op_t. s_disp_frm_buf ) ; if ( 0 == ps_dec_state -> u4_share_disp_buf ) { ps_dec_state -> ps_disp_frm_buf -> pv_y_buf = ps_dec_ip ->

Fix:
<S2SV_ModStart> u2_decode_header ) && ( <S2SV_ModStart> bytes_remaining > 0 ) && ( 1 == ps_dec_state -> u2_header_done )
Buggy code:
 static stmt_ty ast_for_with_stmt ( struct compiling * c, const node * n0, bool is_async ) { const node * const n = is_async? CHILD ( n0, 1 ) : n0 ; <START_BUG> int i, n_items, end_lineno, end_col_offset ; <END_BUG> asdl_seq * items, * body ;  REQ ( n, with_stmt ) ; <START_BUG> <END_BUG> n_items = ( NCH ( n ) - 2 ) // 2 ;  items = _Py_asdl_seq_new ( n_items, c -> c_arena ) ; if (! items ) return NULL ; <START_BUG> for ( i = 1 ; i < NCH ( n ) - 2 ; i += 2 ) { <END_BUG> withitem_ty item = ast_for_with_item ( c, CHILD ( n, i ) ) ; if (! item ) return NULL ; asdl_seq_SET ( items, ( i - 1 ) // 2, item ) ; } body = ast_for_suite ( c, CHILD ( n, NCH ( n ) - 1 ) ) ; if (! body ) return NULL ; get_last_end_pos ( body, & end_lineno, & end_col_offset ) ;  if ( is_async ) <START_BUG> <END_BUG> return AsyncWith ( items, body, LINENO ( n0 ), n0 -> n_col_offset,  end_lineno, end_col_offset, c -> c_arena ) ; else <START_BUG> return With ( items, body, LINENO ( n ), n -> n_col_offset, <END_BUG> end_lineno, end_col_offset, c -> c_arena ) ; }

Fix:
<S2SV_ModStart>, n_items, nch_minus_type, has_type_comment, <S2SV_ModStart> * body ; string type_comment ; <S2SV_ModStart> with_stmt ) ; has_type_comment = TYPE ( CHILD ( n, NCH ( n ) - 2 ) ) == TYPE_COMMENT ; nch_minus_type = NCH ( n ) - has_type_comment ; <S2SV_ModStart> n_items = ( nch_minus_type <S2SV_ModEnd> - 2 ) <S2SV_ModStart> ; i < nch_minus_type <S2SV_ModEnd> - 2 ; <S2SV_ModStart> ; if ( has_type_comment ) { type_comment = NEW_TYPE_COMMENT ( CHILD ( n, NCH ( n ) - 2 ) ) ; if (! type_comment ) return NULL ; } else type_comment = NULL ; if ( <S2SV_ModStart>, body, type_comment, <S2SV_ModStart> items, body, type_comment
Buggy code:
 static Image * ReadARTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; QuantumInfo * quantum_info ; QuantumType quantum_type ; MagickBooleanType status ; size_t length ; ssize_t count, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 1 ; image -> endian = MSBEndian ; ( void ) ReadBlobLSBShort ( image ) ; image -> columns = ( size_t ) ReadBlobLSBShort ( image ) ; ( void ) ReadBlobLSBShort ( image ) ; image -> rows = ( size_t ) ReadBlobLSBShort ( image ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( AcquireImageColormap ( image, 2 ) == MagickFalse ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; if ( image_info -> ping!= MagickFalse ) { ( void ) CloseBlob ( image ) ; return ( GetFirstImageInList ( image ) ) ; } <START_BUG> SetImageColorspace ( image, GRAYColorspace ) ; <END_BUG> quantum_type = IndexQuantum ; quantum_info = AcquireQuantumInfo ( image_info, image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; pixels = GetQuantumPixels ( quantum_info ) ; length = GetQuantumExtent ( image, quantum_info, quantum_type ) ; for ( y = 0 ; y < ( ssize

Fix:
<S2SV_ModStart> ) ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 opj_image_t * tgatoimage ( const char * filename, opj_cparameters_t * parameters ) { FILE * f ; opj_image_t * image ; unsigned int image_width, image_height, pixel_bit_depth ; unsigned int x, y ; int flip_image = 0 ; opj_image_cmptparm_t cmptparm [ 4 ] ; int numcomps ; OPJ_COLOR_SPACE color_space ; OPJ_BOOL mono ; OPJ_BOOL save_alpha ; int subsampling_dx, subsampling_dy ; int i ; f = fopen ( filename, "rb" ) ; if (! f ) { fprintf ( stderr, "Failed   to   open   %s   for   reading  !!\\n", filename ) ; return 0 ; } if (! tga_readheader ( f, & pixel_bit_depth, & image_width, & image_height, & flip_image ) ) { fclose ( f ) ; return NULL ; } if (! ( ( pixel_bit_depth == 24 ) || ( pixel_bit_depth == 32 ) ) ) { fclose ( f ) ; return NULL ; } memset ( & cmptparm [ 0 ], 0, 4 * sizeof ( opj_image_cmptparm_t ) ) ; mono = ( pixel_bit_depth == 8 ) || ( pixel_bit_depth == 16 ) ; save_alpha = ( pixel_bit_depth == 16 ) || ( pixel_bit_depth == 32 ) ; if ( mono ) { color_space = OPJ_CLRSPC_GRAY ; numcomps = save_alpha? 2 : 1 ; } else { numcomps = save_alpha? 4 : 3 ; color_space = OPJ_CLRSPC_SRGB ; } <START_BUG> subsampling_dx = parameters -> subsampling_dx ; <END_BUG> subsampling_dy = parameters -> subsampling_dy ; for ( i = 0 ; i < numcomps ; i ++ ) { cmptparm [ i ]. prec = 8 ; cmptparm [ i ]. bpp = 8 ; cmptparm [ i ]. sgnd = 0 ; cmptparm [ i ]. dx = ( OPJ_UINT32 ) subsampling_dx ; cmptpar

Fix:
<S2SV_ModStart> OPJ_CLRSPC_SRGB ; } if ( image_height!= 0 && image_width > 10000000 // image_height // numcomps ) { char ch ; OPJ_UINT64 expected_file_size = ( OPJ_UINT64 ) image_width * image_height * numcomps ; long curpos = ftell ( f ) ; if ( expected_file_size > ( OPJ_UINT64 ) INT_MAX ) { expected_file_size = ( OPJ_UINT64 ) INT_MAX ; } fseek ( f, ( long ) expected_file_size - 1, SEEK_SET ) ; if ( fread ( & ch, 1, 1, f )!= 1 ) { fclose ( f ) ; return NULL ; } fseek ( f, curpos, SEEK_SET ) ; }
Buggy code:
 int adis_update_scan_mode ( struct iio_dev * indio_dev, const unsigned long * scan_mask ) { struct adis * adis = iio_device_get_drvdata ( indio_dev ) ; const struct iio_chan_spec * chan ; unsigned int scan_count ; unsigned int i, j ; __be16 * tx, * rx ; kfree ( adis -> xfer ) ; kfree ( adis -> buffer ) ; if ( adis -> burst && adis -> burst -> en ) return adis_update_scan_mode_burst ( indio_dev, scan_mask ) ; scan_count = indio_dev -> scan_bytes // 2 ; adis -> xfer = kcalloc ( scan_count + 1, sizeof ( * adis -> xfer ), GFP_KERNEL ) ; if (! adis -> xfer ) return - ENOMEM ; adis -> buffer = kcalloc ( indio_dev -> scan_bytes, 2, GFP_KERNEL ) ; <START_BUG> if (! adis -> buffer ) <END_BUG> return - ENOMEM ;  rx = adis -> buffer ; <START_BUG> tx = rx + scan_count ; spi_message_init ( & adis -> msg ) ; for ( j = 0 ; j <= scan_count ; j ++ ) { adis -> xfer [ j ]. bits_per_word = 8 ; if ( j!= scan_count ) adis -> xfer [ j ]. cs_change = 1 ; adis -> xfer [ j ]. len = 2 ; adis -> xfer [ j ]. delay_usecs = adis -> data -> read_delay ; if ( j < scan_count ) adis -> xfer [ j ]. tx_buf = & tx [ j ] ; if ( j >= 1 ) adis -> xfer [ j ]. rx_buf = & rx [ j - 1 ] ; spi_message_add_tail ( & adis -> xfer [ j ], & adis -> msg ) ; } chan = indio_dev -> channels ; for ( i = 0 ; i < indio_dev -> num_channels ; i ++, chan ++ ) { if (! test_bit ( chan -> scan_index, scan_mask ) ) continue ; if ( chan<END_BUG>

Fix:
<S2SV_ModStart> -> buffer ) { kfree ( adis -> xfer ) ; adis -> xfer = NULL ; <S2SV_ModStart> - ENOMEM ; }
Buggy code:
 int main ( int argc, char * * argv ) { const char command0 [ ] = { 0x00, 0x00 } ; char command1 [ ] = "\\x01\\x00urn:schemas-upnp-org:device:InternetGatewayDevice" ; char command2 [ ] = "\\x02\\x00uuid:fc4ec57e-b051-11db-88f8-0060085db3f6::upnp:rootdevice" ; const char command3 [ ] = { 0x03, 0x00 } ; char command3compat [ ] = "\\x03\\x00ssdp:all" ; char command4 [ ] = "\\x04\\x00test:test:test" ; const char bad_command [ ] = { 0xff, 0xff } ; const char overflow [ ] = { 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff } ; <START_BUG> const char command5 [ ] = { 0x05, 0x00 } ; <END_BUG> int s ; int i ; void * tmp ; unsigned char * resp = NULL ; size_t respsize = 0 ; unsigned char buf [ 4096 ] ; ssize_t n ; int total = 0 ; const char * sockpath = "//var//run//minissdpd.sock" ; for ( i = 0 ; i < argc - 1 ; i ++ ) { if ( 0 == strcmp ( argv [ i ], "-s" ) ) sockpath = argv [ ++ i ] ; } command1 [ 1 ] = sizeof ( command1 ) - 3 ; command2 [ 1 ] = sizeof ( command2 ) - 3 ; command3compat [ 1 ] = sizeof ( command3compat ) - 3 ; command4 [ 1 ] = sizeof ( command4 ) - 3 ; s = connect_unix_socket ( sockpath ) ; n = SENDCOMMAND ( command0, sizeof ( command0 ) ) ; n = read ( s, buf, sizeof ( buf ) ) ; printf ( "Response   received   %d   bytes\\n", ( int ) n ) ; if ( n > 0 ) { printversion ( buf, n ) ; } else { printf ( "Command   0   (get   version)   not   supported\\n" ) ; close ( s ) ; s = connect_unix_socket ( sock

Fix:
<S2SV_ModStart> 0x05, 0x00 } ; const char bad_command4 [ ] = { 0x04, 0x01, 0x60, 0x8f, 0xff, 0xff, 0xff, 0x7f <S2SV_ModStart> n ) ; if ( n == 0 ) { <S2SV_ModStart> s ) ; s = connect_unix_socket ( sockpath ) ; } n = SENDCOMMAND ( bad_command4, sizeof ( bad_command4 ) ) ; n = read ( s, buf, sizeof ( buf ) ) ; printf ( "Response <S2SV_blank> received <S2SV_blank> %d <S2SV_blank> bytes\\n", ( int ) n ) ; printresponse ( buf, n ) ; close ( s ) ;
Buggy code:
 static void ImportGrayQuantum ( const Image * image, QuantumInfo * quantum_info, const MagickSizeType number_pixels, const unsigned char * magick_restrict p, Quantum * magick_restrict q, ExceptionInfo * exception ) { QuantumAny range ; register ssize_t x ; ssize_t bit ; unsigned int pixel ; assert ( image!= ( Image * ) NULL ) ; assert ( image -> signature == MagickCoreSignature ) ; <START_BUG> switch ( quantum_info -> depth ) <END_BUG> { case 1 : { register Quantum black, white ; black = 0 ; white = QuantumRange ; if ( quantum_info -> min_is_white!= MagickFalse ) { black = QuantumRange ; white = 0 ; } for ( x = 0 ; x < ( ( ssize_t ) number_pixels - 7 ) ; x += 8 ) { for ( bit = 0 ; bit < 8 ; bit ++ ) { SetPixelGray ( image, ( ( * p ) & ( 1 << ( 7 - bit ) ) ) == 0? black : white, q ) ; q += GetPixelChannels ( image ) ; } p ++ ; } for ( bit = 0 ; bit < ( ssize_t ) ( number_pixels % 8 ) ; bit ++ ) { SetPixelGray ( image, ( ( * p ) & ( 0x01 << ( 7 - bit ) ) ) == 0? black : white, q ) ; q += GetPixelChannels ( image ) ; } if ( bit!= 0 ) p ++ ; break ; } case 4 : { register unsigned char pixel ; range = GetQuantumRange ( quantum_info -> depth ) ; for ( x = 0 ; x < ( ( ssize_t ) number_pixels - 1 ) ; x += 2 ) { pixel = ( unsigned char ) ( ( * p >> 4 ) & 0xf ) ; SetPixelGray ( image, ScaleAnyToQuantum ( pixel, range ), q ) ; q += GetPixelChannels ( image ) ; pixel = ( unsigned char ) ( ( * p ) & 0xf ) ; SetPixelGray ( image, ScaleAnyToQuantum ( pixel, range ), q ) ; p ++ ; q += GetPixelChannels ( image ) ; } for ( bit = 0 ; bit < ( ssize_t ) ( number_pixels % 2 )

Fix:
<S2SV_ModStart> MagickCoreSignature ) ; pixel = 0 ;
Buggy code:
 int btsock_thread_add_fd ( int h, int fd, int type, int flags, uint32_t user_id ) { if ( h < 0 || h >= MAX_THREAD ) { APPL_TRACE_ERROR ( "invalid   bt   thread   handle:%d", h ) ; return FALSE ; } if ( ts [ h ]. cmd_fdw == - 1 ) { APPL_TRACE_ERROR ( "cmd   socket   is   not   created.   socket   thread   may   not   initialized" ) ; return FALSE ; } if ( flags & SOCK_THREAD_ADD_FD_SYNC ) { if ( ts [ h ]. thread_id == pthread_self ( ) ) { flags &= ~ SOCK_THREAD_ADD_FD_SYNC ; add_poll ( h, fd, type, flags, user_id ) ; return TRUE ; } APPL_TRACE_DEBUG ( "THREAD_ADD_FD_SYNC   is   not   called   in   poll   thread,   fallback   to   async" ) ; } sock_cmd_t cmd = { CMD_ADD_FD, fd, type, flags, user_id } ; APPL_TRACE_DEBUG ( "adding   fd:%d,   flags:0x%x", fd, flags ) ; <START_BUG> return send ( ts [ h ]. cmd_fdw, & cmd, sizeof ( cmd ), 0 ) == sizeof ( cmd ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 struct sta_info * sta_info_alloc ( struct ieee80211_sub_if_data * sdata, const u8 * addr, gfp_t gfp ) { struct ieee80211_local * local = sdata -> local ; struct sta_info * sta ; struct timespec uptime ; struct ieee80211_tx_latency_bin_ranges * tx_latency ; int i ; sta = kzalloc ( sizeof ( * sta ) + local -> hw. sta_data_size, gfp ) ; if (! sta ) return NULL ; rcu_read_lock ( ) ; tx_latency = rcu_dereference ( local -> tx_latency ) ; if ( tx_latency ) { sta -> tx_lat = kzalloc ( IEEE80211_NUM_TIDS * sizeof ( struct ieee80211_tx_latency_stat ), GFP_ATOMIC ) ; if (! sta -> tx_lat ) { rcu_read_unlock ( ) ; goto free ; } if ( tx_latency -> n_ranges ) { for ( i = 0 ; i < IEEE80211_NUM_TIDS ; i ++ ) { sta -> tx_lat [ i ]. bin_count = tx_latency -> n_ranges + 1 ; sta -> tx_lat [ i ]. bins = kcalloc ( sta -> tx_lat [ i ]. bin_count, sizeof ( u32 ), GFP_ATOMIC ) ; if (! sta -> tx_lat [ i ]. bins ) { rcu_read_unlock ( ) ; goto free ; } } } } rcu_read_unlock ( ) ; <START_BUG> spin_lock_init ( & sta -> lock ) ; <END_BUG> INIT_WORK ( & sta -> drv_unblock_wk, sta_unblock ) ; INIT_WORK ( & sta -> ampdu_mlme. work, ieee80211_ba_session_work ) ; mutex_init ( & sta -> ampdu_mlme. mtx ) ; # ifdef CONFIG_MAC80211_MESH if ( ieee80211_vif_is_mesh ( & sdata -> vif ) &&!

Fix:
<S2SV_ModStart> sta -> lock ) ; spin_lock_init ( & sta -> ps_lock
Buggy code:
 static void update_best_mode ( BEST_MODE * best_mode, int this_rd, RATE_DISTORTION * rd, int other_cost, MACROBLOCK * x ) { MB_PREDICTION_MODE this_mode = x -> e_mbd. mode_info_context -> mbmi. mode ; other_cost += x -> ref_frame_cost [ x -> e_mbd. mode_info_context -> mbmi. ref_frame ] ; best_mode -> yrd = RDCOST ( x -> rdmult, x -> rddiv, ( rd -> rate2 - rd -> rate_uv - other_cost ), ( rd -> distortion2 - rd -> distortion_uv ) ) ; best_mode -> rd = this_rd ; <START_BUG> vpx_memcpy ( & best_mode -> mbmode, & x -> e_mbd. mode_info_context -> mbmi, sizeof ( MB_MODE_INFO ) ) ; <END_BUG>  vpx_memcpy ( & best_mode -> partition, x -> partition_info, sizeof ( PARTITION_INFO ) ) ; <START_BUG> if ( ( this_mode == B_PRED ) || ( this_mode == SPLITMV ) ) { int i ; for ( i = 0 ; i < 16 ; i ++ ) { best_mode -> bmodes [ i ] = x -> e_mbd. block [ i ]. bmi ; } } }<END_BUG>

Fix:
<S2SV_ModStart> = this_rd ; memcpy <S2SV_ModEnd> ( & best_mode <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & best_mode