nus-yam/ex-repair huggingface dataset:
Buggy code:
 void recovery_cipher_init ( bool passphrase_protection, bool pin_protection, const char * language, const char * label, bool _enforce_wordlist, uint32_t _auto_lock_delay_ms, uint32_t _u2f_counter, bool _dry_run ) { enforce_wordlist = _enforce_wordlist ; dry_run = _dry_run ; if (! dry_run ) { if ( pin_protection ) { if (! change_pin ( ) ) { recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_ActionCancelled, "PINs   do   not   match" ) ; layoutHome ( ) ; return ; } } else { storage_setPin ( "" ) ; } storage_setPassphraseProtected ( passphrase_protection ) ; storage_setLanguage ( language ) ; storage_setLabel ( label ) ; storage_setAutoLockDelayMs ( _auto_lock_delay_ms ) ; storage_setU2FCounter ( _u2f_counter ) ; } else if (! pin_protect ( "Enter   Your   PIN" ) ) { layoutHome ( ) ; return ; } if (! confirm ( ButtonRequestType_ButtonRequest_Other, dry_run? "Recovery   Dry   Run" : "Recovery", "When   entering   your   recovery   seed,   use   the   substitution   cipher   " "and   check   that   each   word   shows   up   correctly   on   the   screen." ) ) { fsm_sendFailure ( FailureType_Failure_ActionCancelled, "Recovery   cancelled" ) ; if (! dry_run ) storage_reset ( ) ; layoutHome ( ) ; return ; } memset ( mnemonic, 0, sizeof ( mnemonic ) // sizeof ( char ) ) ; awaiting_character = true ; <START_BUG> next_character ( ) ; <END_BUG> }

Fix:
<S2SV_ModStart> = true ; recovery_started = true ;
Buggy code:
 struct mapped_device * dm_get_from_kobject ( struct kobject * kobj ) { struct mapped_device * md ; md = container_of ( kobj, struct mapped_device, kobj_holder. kobj ) ; <START_BUG> if ( test_bit ( DMF_FREEING, & md -> flags ) || <END_BUG>  dm_deleting_md ( md ) ) <START_BUG> return NULL ; <END_BUG> dm_get ( md ) ;  return md ; }

Fix:
<S2SV_ModStart> kobj ) ; spin_lock ( & _minor_lock ) ; <S2SV_ModStart> md ) ) { md = NULL ; goto out ; } <S2SV_ModEnd> dm_get ( md <S2SV_ModStart> dm_get ( md ) ; out : spin_unlock ( & _minor_lock
Buggy code:
 SQLITE_PRIVATE ExprList * sqlite3ExprListAppend ( Parse * pParse, ExprList * pList, Expr * pExpr ) { struct ExprList_item * pItem ; sqlite3 * db = pParse -> db ; assert ( db!= 0 ) ; if ( pList == 0 ) { pList = sqlite3DbMallocRawNN ( db, sizeof ( ExprList ) ) ; if ( pList == 0 ) { goto no_mem ; } pList -> nExpr = 0 ; } else if ( ( pList -> nExpr & ( pList -> nExpr - 1 ) ) == 0 ) { ExprList * pNew ; pNew = sqlite3DbRealloc ( db, pList, <START_BUG> sizeof ( * pList ) + ( 2 * pList -> nExpr - 1 ) * sizeof ( pList -> a [ 0 ] ) ) ; <END_BUG> if ( pNew == 0 ) { goto no_mem ; } pList = pNew ; } pItem = & pList -> a [ pList -> nExpr ++ ] ; assert ( offsetof ( struct ExprList_item, zName ) == sizeof ( pItem -> pExpr ) ) ; assert ( offsetof ( struct ExprList_item, pExpr ) == 0 ) ; memset ( & pItem -> zName, 0, sizeof ( * pItem ) - offsetof ( struct ExprList_item, zName ) ) ; pItem -> pExpr = pExpr ; return pList ; no_mem : sqlite3ExprDelete ( db, pExpr ) ; sqlite3ExprListDelete ( db, pList ) ; return 0 ; }

Fix:
<S2SV_ModStart> ( 2 * ( sqlite3_int64 )
Buggy code:
 SYSCALL_DEFINE2 ( osf_getdomainname, char __user *, name, int, namelen ) { unsigned len ; int i ; if (! access_ok ( VERIFY_WRITE, name, namelen ) ) return - EFAULT ; len = namelen ; <START_BUG> if ( namelen > 32 ) <END_BUG> len = 32 ; down_read ( & uts_sem ) ; for ( i = 0 ; i < len ; ++ i ) { __put_user ( utsname ( ) -> domainname [ i ], name + i ) ; if ( utsname ( ) -> domainname [ i ] == '\\0' ) break ; } up_read ( & uts_sem ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( len <S2SV_ModEnd> > 32 )
Buggy code:
 struct ipv6_txoptions * ipv6_renew_options ( struct sock * sk, struct ipv6_txoptions * opt, int newtype, struct ipv6_opt_hdr __user * newopt, int newoptlen ) { int tot_len = 0 ; char * p ; struct ipv6_txoptions * opt2 ; int err ; if ( opt ) { if ( newtype!= IPV6_HOPOPTS && opt -> hopopt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> hopopt ) ) ; if ( newtype!= IPV6_RTHDRDSTOPTS && opt -> dst0opt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> dst0opt ) ) ; if ( newtype!= IPV6_RTHDR && opt -> srcrt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> srcrt ) ) ; if ( newtype!= IPV6_DSTOPTS && opt -> dst1opt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> dst1opt ) ) ; } if ( newopt && newoptlen ) tot_len += CMSG_ALIGN ( newoptlen ) ; if (! tot_len ) return NULL ; tot_len += sizeof ( * opt2 ) ; opt2 = sock_kmalloc ( sk, tot_len, GFP_ATOMIC ) ; if (! opt2 ) return ERR_PTR ( - ENOBUFS ) ; memset ( opt2, 0, tot_len ) ; <START_BUG> opt2 -> tot_len = tot_len ; <END_BUG> p = ( char * ) ( opt2 + 1 ) ; err = ipv6_renew_option ( opt? opt -> hopopt : NULL, newopt, newoptlen, newtype!= IPV6_HOPOPTS, & opt2 -> hopopt, & p ) ; if ( err ) goto out ; err = ipv6_renew_option ( opt? opt -> dst0opt : NULL, newopt, newoptlen, newtype!= IPV6_RTHDRDSTOPTS, & opt2 -> dst0opt, & p ) ; if ( err ) goto out ; err = ipv6_renew_option ( opt? opt -> srcrt : NULL, newopt

Fix:
<S2SV_ModStart> tot_len ) ; atomic_set ( & opt2 -> refcnt, 1 ) ;
Buggy code:
 static int __key_instantiate_and_link ( struct key * key, struct key_preparsed_payload * prep, struct key * keyring, struct key * authkey, struct assoc_array_edit * * _edit ) { int ret, awaken ; key_check ( key ) ; key_check ( keyring ) ; awaken = 0 ; ret = - EBUSY ; mutex_lock ( & key_construction_mutex ) ; <START_BUG> if (! test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ) { <END_BUG> ret = key -> type -> instantiate ( key, prep ) ; if ( ret == 0 ) { atomic_inc ( & key -> user -> nikeys ) ;  set_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ; <START_BUG> if ( test_and_clear_bit ( KEY_FLAG_USER_CONSTRUCT, & key -> flags ) ) awaken = 1 ; if ( keyring ) { if ( test_bit ( KEY_FLAG_KEEP, & keyring -> flags ) ) set_bit ( KEY_FLAG_KEEP, & key -> flags ) ; __key_link ( key, _edit ) ; } if ( authkey ) key_revoke ( authkey ) ; if ( prep -> expiry!= TIME_T_MAX ) { key -> expiry = prep -> expiry ; key_schedule_gc ( prep -> expiry + key_gc_delay ) ; } } } mutex_unlock ( & key_construction_mutex ) ; if ( awaken ) wake_up_bit ( & key -> flags, KEY_FLAG_USER_CONSTRUCT ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( key -> state == KEY_IS_UNINSTANTIATED <S2SV_ModEnd> ) { ret <S2SV_ModStart> nikeys ) ; mark_key_instantiated ( key, 0 <S2SV_ModEnd> ) ; if
Buggy code:
 struct resource_pool * dce110_create_resource_pool ( uint8_t num_virtual_links, struct dc * dc, struct hw_asic_id asic_id ) { struct dce110_resource_pool * pool = kzalloc ( sizeof ( struct dce110_resource_pool ), GFP_KERNEL ) ; if (! pool ) return NULL ; if ( construct ( num_virtual_links, dc, pool, asic_id ) ) return & pool -> base ; <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> -> base ; kfree ( pool ) ;
Buggy code:
 void Con_Dump_f ( void ) { int l, x, i ; short * line ; fileHandle_t f ; int bufferlen ; char * buffer ; char filename [ MAX_QPATH ] ; if ( Cmd_Argc ( )!= 2 ) { Com_Printf ( "usage:   condump   <filename>\\n" ) ; return ; } Q_strncpyz ( filename, Cmd_Argv ( 1 ), sizeof ( filename ) ) ; <START_BUG> COM_DefaultExtension ( filename, sizeof ( filename ), ".txt" ) ; <END_BUG> f = FS_FOpenFileWrite ( filename ) ; if (! f ) { Com_Printf ( "ERROR:   couldn\'t   open   %s.\\n", filename ) ; return ; } Com_Printf ( "Dumped   console   text   to   %s.\\n", filename ) ; for ( l = con. current - con. totallines + 1 ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( x = 0 ; x < con. linewidth ; x ++ ) if ( ( line [ x ] & 0xff )!=' ') { break ; } if ( x!= con. linewidth ) { break ; } } # ifdef _WIN32 bufferlen = con. linewidth + 3 * sizeof ( char ) ; # else bufferlen = con. linewidth + 2 * sizeof ( char ) ; # endif buffer = Hunk_AllocateTempMemory ( bufferlen ) ; buffer [ bufferlen - 1 ] = 0 ; for ( ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( i = 0 ; i < con. linewidth ; i ++ ) buffer [ i ] = line [ i ] & 0xff ; for ( x = con. linewidth - 1 ; x >= 0 ; x -- ) { if ( buffer [ x ] ==' ') { buffer [ x ] = 0 ; } else { break ; } } # ifdef _WIN32 Q_strcat ( buffer, bufferlen, "\\r\\n" ) ; # else Q_strcat ( buffer, bufferlen, "\\n" ) ; # endif FS_Write ( buffer, strlen ( buffer ), f ) ; }

Fix:
<S2SV_ModStart> ".txt" ) ; if (! COM_CompareExtension ( filename, ".txt" ) ) { Com_Printf ( "Con_Dump_f: <S2SV_blank> Only <S2SV_blank> the <S2SV_blank> \\".txt\\" <S2SV_blank> extension <S2SV_blank> is <S2SV_blank> supported <S2SV_blank> by <S2SV_blank> this <S2SV_blank> command!\\n" ) ; return ; }
Buggy code:
 unsigned char * base64decode ( const char * buf, size_t * size ) { if (! buf ||! size ) return NULL ; size_t len = ( * size > 0 )? * size : strlen ( buf ) ; if ( len <= 0 ) return NULL ; unsigned char * outbuf = ( unsigned char * ) malloc ( ( len // 4 ) * 3 + 3 ) ; const char * ptr = buf ; int p = 0 ; <START_BUG> size_t l = 0 ; <END_BUG> do {  ptr += strspn ( ptr, "\\r\\n\\t   " ) ; <START_BUG> if ( * ptr == '\\0' || ptr >= buf + len ) { break ; } <END_BUG> l = strcspn ( ptr, "\\r\\n\\t   " ) ;  if ( l > 3 && ptr + l <= buf + len ) { p += base64decode_block ( outbuf + p, ptr, l ) ; ptr += l ; } else { break ; } } while ( 1 ) ; outbuf [ p ] = 0 ; * size = p ; return outbuf ; }

Fix:
<S2SV_ModStart> = 0 ; int wv, w1, w2, w3, w4 ; int tmpval [ 4 ] ; int tmpcnt <S2SV_ModEnd> = 0 ; <S2SV_ModStart> ; do { while ( ptr < buf + len && ( * ptr =='<S2SV_blank>'|| * ptr == '\\t' || * ptr == '\\n' || * ptr == '\\r' ) ) { ptr ++ ; } <S2SV_ModEnd> if ( * <S2SV_ModStart> break ; } if ( ( wv = base64_table [ ( int ) ( unsigned char ) * ptr ++ ] ) == - 1 ) { continue ; } tmpval [ tmpcnt ++ ] = wv ; if ( tmpcnt == 4 ) { tmpcnt = 0 ; w1 = tmpval [ 0 ] ; w2 = tmpval [ 1 ] ; w3 = tmpval [ 2 ] ; w4 = tmpval [ 3 ] ; if ( w2 >= 0 ) { outbuf [ p ++ ] = ( unsigned char ) ( ( ( w1 << 2 ) + ( w2 >> 4 ) ) & 0xFF ) ; } if ( w3 >= 0 ) { outbuf [ p ++ ] = ( unsigned char ) ( ( ( w2 << 4 ) + ( w3 >> 2 ) ) &
Buggy code:
 const char * string_of_NPNVariable ( int variable ) { const char * str ; switch ( variable ) { # define _ ( VAL ) case VAL : str = # VAL ; break ; _ ( NPNVxDisplay ) ; _ ( NPNVxtAppContext ) ; _ ( NPNVnetscapeWindow ) ; _ ( NPNVjavascriptEnabledBool ) ; _ ( NPNVasdEnabledBool ) ; _ ( NPNVisOfflineBool ) ; _ ( NPNVserviceManager ) ; _ ( NPNVDOMElement ) ; _ ( NPNVDOMWindow ) ; _ ( NPNVToolkit ) ; _ ( NPNVSupportsXEmbedBool ) ; _ ( NPNVWindowNPObject ) ; _ ( NPNVPluginElementNPObject ) ; _ ( NPNVSupportsWindowless ) ; <START_BUG> # undef _ <END_BUG> default : switch ( variable & 0xff ) { # define _ ( VAL, VAR ) case VAL : str = # VAR ; break _ ( 10, NPNVserviceManager ) ; _ ( 11, NPNVDOMElement ) ; _ ( 12, NPNVDOMWindow ) ; _ ( 13, NPNVToolkit ) ; # undef _ default : str = "<unknown   variable>" ; break ; } break ; } return str ; }

Fix:
<S2SV_ModStart> NPNVSupportsWindowless ) ; _ ( NPNVprivateModeBool ) ; _ ( NPNVsupportsAdvancedKeyHandling ) ;
Buggy code:
 int disrsi_ ( int stream, int * negate, unsigned * value, unsigned count ) { int c ; unsigned locval ; unsigned ndigs ; char * cp ; char scratch [ DIS_BUFSIZ + 1 ] ; assert ( negate!= NULL ) ; assert ( value!= NULL ) ; assert ( count ) ; assert ( stream >= 0 ) ; assert ( dis_getc!= NULL ) ; assert ( dis_gets!= NULL ) ; memset ( scratch, 0, DIS_BUFSIZ + 1 ) ; if ( dis_umaxd == 0 ) disiui_ ( ) ; <START_BUG> switch ( c = ( * dis_getc ) ( stream ) ) <END_BUG> { case '-' : case '+' : * negate = c == '-' ; if ( ( * dis_gets ) ( stream, scratch, count )!= ( int ) count ) { return ( DIS_EOD ) ; } if ( count >= dis_umaxd ) { if ( count > dis_umaxd ) goto overflow ; if ( memcmp ( scratch, dis_umax, dis_umaxd ) > 0 ) goto overflow ; } cp = scratch ; locval = 0 ; do { if ( ( ( c = * cp ++ ) < '0' ) || ( c > '9' ) ) { return ( DIS_NONDIGIT ) ; } locval = 10 * locval + c - '0' ; } while ( -- count ) ; * value = locval ; return ( DIS_SUCCESS ) ; break ; case '0' : return ( DIS_LEADZRO ) ; break ; case '1' : case '2' : case '3' : case '4' : case '5' : case '6' : case '7' : case '8' : case '9' : ndigs = c - '0' ; if ( count > 1 ) { if ( ( * dis_gets ) ( stream, scratch + 1, count - 1 )!= ( int ) count - 1 ) { return ( DIS_EOD ) ; } cp = scratch ; if ( count >= dis_umaxd ) { if ( count > dis_umaxd ) break ; * cp = c ; if ( memcmp ( scratch, dis_umax, dis_umaxd ) > 0 ) break ; } while ( -- count ) { if ( ( ( c =

Fix:
<S2SV_ModStart> ( ) ; if ( count >= dis_umaxd ) { if ( count > dis_umaxd ) goto overflow ; if ( memcmp ( scratch, dis_umax, dis_umaxd ) > 0 ) goto overflow ; }
Buggy code:
 static int sanitize_ptr_alu ( struct bpf_verifier_env * env, struct bpf_insn * insn, const struct bpf_reg_state * ptr_reg, struct bpf_reg_state * dst_reg, bool off_is_neg ) { struct bpf_verifier_state * vstate = env -> cur_state ; struct bpf_insn_aux_data * aux = cur_aux ( env ) ; bool ptr_is_dst_reg = ptr_reg == dst_reg ; u8 opcode = BPF_OP ( insn -> code ) ; u32 alu_state, alu_limit ; struct bpf_reg_state tmp ; bool ret ; <START_BUG> if ( env -> allow_ptr_leaks || BPF_SRC ( insn -> code ) == BPF_K ) <END_BUG> return 0 ; if ( vstate -> speculative ) goto do_sim ; alu_state = off_is_neg? BPF_ALU_NEG_VALUE : 0 ; alu_state |= ptr_is_dst_reg? BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST ; if ( retrieve_ptr_limit ( ptr_reg, & alu_limit, opcode, off_is_neg ) ) return 0 ;  if ( aux -> alu_state && <START_BUG> ( aux -> alu_state!= alu_state || aux -> alu_limit!= alu_limit ) ) <END_BUG> return - EACCES ;  aux -> alu_state = alu_state ; aux -> alu_limit = alu_limit ; do_sim : if (! ptr_is_dst_reg ) { tmp = * dst_reg ; * dst_reg = * ptr_reg ; } ret = push_stack ( env, env -> insn_idx + 1, env -> insn_idx, true ) ; if (! ptr_is_dst_reg ) * dst_reg = tmp ; return! ret? - EFAULT : 0 ; }

Fix:
<S2SV_ModStart> ; if ( can_skip_alu_sanitation ( env, insn ) <S2SV_ModEnd> ) return 0 <S2SV_ModStart> ; if ( update_alu_sanitation_state ( aux, alu_state, <S2SV_ModEnd> alu_limit ) ) <S2SV_ModStart> return - EACCES <S2SV_ModEnd> ; do_sim :
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { PadContext * s = inlink -> dst -> priv ; AVFrame * out ; int needs_copy = frame_needs_copy ( s, in ) ; if ( needs_copy ) { av_log ( inlink -> dst, AV_LOG_DEBUG, "Direct   padding   impossible   allocating   new   frame\\n" ) ; out = ff_get_video_buffer ( inlink -> dst -> outputs [ 0 ], FFMAX ( inlink -> w, s -> w ), FFMAX ( inlink -> h, s -> h ) ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; } else { int i ; out = in ; <START_BUG> for ( i = 0 ; i < 4 && out -> data [ i ] ; i ++ ) { <END_BUG> int hsub = s -> draw. hsub [ i ] ; int vsub = s -> draw. vsub [ i ] ; out -> data [ i ] -= ( s -> x >> hsub ) * s -> draw. pixelstep [ i ] + ( s -> y >> vsub ) * out -> linesize [ i ] ; } } if ( s -> y ) { ff_fill_rectangle ( & s -> draw, & s -> color, out -> data, out -> linesize, 0, 0, s -> w, s -> y ) ; } if ( s -> h > s -> y + s -> in_h ) { ff_fill_rectangle ( & s -> draw, & s -> color, out -> data, out -> linesize, 0, s -> y + s -> in_h, s -> w, s -> h - s -> y - s -> in_h ) ; } ff_fill_rectangle ( & s -> draw, & s -> color, out -> data, out -> linesize, 0, s -> y, s -> x, in -> height ) ; if ( needs_copy ) { ff_copy_rectangle2 ( & s -> draw, out -> data, out -> linesize, in -> data, in -> linesize, s -> x, s -> y, 0, 0, in -> width, in -> height )

Fix:
<S2SV_ModStart> [ i ] && out -> linesize [ i ]
Buggy code:
 static int parsegid ( const char * s, gid_t * gid ) { struct group * gr ; <START_BUG> const char * errstr ; <END_BUG> if ( ( gr = getgrnam ( s ) )!= NULL ) { * gid = gr -> gr_gid ; return 0 ; } # if! defined ( __linux__ ) &&! defined ( __NetBSD__ ) * gid = strtonum ( s, 0, GID_MAX, & errstr ) ;  # else <START_BUG> sscanf ( s, "%d", gid ) ; <END_BUG> # endif  if ( errstr ) return - 1 ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> * gr ; # if! defined ( __linux__ ) &&! defined ( __NetBSD__ ) <S2SV_ModStart> char * errstr = NULL ; # else int status ; # endif <S2SV_ModEnd> if ( ( <S2SV_ModStart> errstr ) ; if ( errstr ) return - 1 ; # else status = <S2SV_ModEnd> sscanf ( s <S2SV_ModStart> gid ) ; if ( status!= 1 <S2SV_ModEnd> ) return - <S2SV_ModStart> - 1 ; # endif
Buggy code:
 static void set_segmentation_map ( VP8_COMP * cpi, unsigned char * segmentation_map ) { <START_BUG> vpx_memcpy ( cpi -> segmentation_map, segmentation_map, ( cpi -> common. mb_rows * cpi -> common. mb_cols ) ) ; <END_BUG> cpi -> mb. e_mbd. update_mb_segmentation_map = 1 ; cpi -> mb. e_mbd. update_mb_segmentation_data = 1 ; }

Fix:
<S2SV_ModStart> segmentation_map ) { memcpy <S2SV_ModEnd> ( cpi ->
Buggy code:
 void rds_inc_info_copy ( struct rds_incoming * inc, struct rds_info_iterator * iter, __be32 saddr, __be32 daddr, int flip ) { struct rds_info_message minfo ; minfo. seq = be64_to_cpu ( inc -> i_hdr. h_sequence ) ; minfo. len = be32_to_cpu ( inc -> i_hdr. h_len ) ; if ( flip ) { minfo. laddr = daddr ; minfo. faddr = saddr ; minfo. lport = inc -> i_hdr. h_dport ; minfo. fport = inc -> i_hdr. h_sport ; } else { minfo. laddr = saddr ; minfo. faddr = daddr ; minfo. lport = inc -> i_hdr. h_sport ; minfo. fport = inc -> i_hdr. h_dport ; } <START_BUG> rds_info_copy ( iter, & minfo, sizeof ( minfo ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> h_dport ; } minfo. flags = 0 ;
Buggy code:
 int key_update ( key_ref_t key_ref, const void * payload, size_t plen ) { struct key_preparsed_payload prep ; struct key * key = key_ref_to_ptr ( key_ref ) ; int ret ; key_check ( key ) ; ret = key_permission ( key_ref, KEY_NEED_WRITE ) ; if ( ret < 0 ) return ret ; if (! key -> type -> update ) return - EOPNOTSUPP ; memset ( & prep, 0, sizeof ( prep ) ) ; prep. data = payload ; prep. datalen = plen ; prep. quotalen = key -> type -> def_datalen ; prep. expiry = TIME_T_MAX ; if ( key -> type -> preparse ) { ret = key -> type -> preparse ( & prep ) ; if ( ret < 0 ) goto error ; } down_write ( & key -> sem ) ; ret = key -> type -> update ( key, & prep ) ; if ( ret == 0 ) <START_BUG> clear_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ; <END_BUG> up_write ( & key -> sem ) ; error : if ( key -> type -> preparse ) key -> type -> free_preparse ( & prep ) ; return ret ; }

Fix:
<S2SV_ModStart> == 0 ) mark_key_instantiated ( key, 0 <S2SV_ModEnd> ) ; up_write
Buggy code:
 int sock_setsockopt ( struct socket * sock, int level, int optname, char __user * optval, unsigned int optlen ) { struct sock * sk = sock -> sk ; int val ; int valbool ; struct linger ling ; int ret = 0 ; if ( optname == SO_BINDTODEVICE ) return sock_setbindtodevice ( sk, optval, optlen ) ; if ( optlen < sizeof ( int ) ) return - EINVAL ; if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; valbool = val? 1 : 0 ; lock_sock ( sk ) ; switch ( optname ) { case SO_DEBUG : if ( val &&! capable ( CAP_NET_ADMIN ) ) ret = - EACCES ; else sock_valbool_flag ( sk, SOCK_DBG, valbool ) ; break ; case SO_REUSEADDR : sk -> sk_reuse = ( valbool? SK_CAN_REUSE : SK_NO_REUSE ) ; break ; case SO_REUSEPORT : sk -> sk_reuseport = valbool ; break ; case SO_TYPE : case SO_PROTOCOL : case SO_DOMAIN : case SO_ERROR : ret = - ENOPROTOOPT ; break ; case SO_DONTROUTE : sock_valbool_flag ( sk, SOCK_LOCALROUTE, valbool ) ; break ; case SO_BROADCAST : sock_valbool_flag ( sk, SOCK_BROADCAST, valbool ) ; break ; case SO_SNDBUF : val = min_t ( u32, val, sysctl_wmem_max ) ; set_sndbuf : sk -> sk_userlocks |= SOCK_SNDBUF_LOCK ; <START_BUG> sk -> sk_sndbuf = max_t ( u32, val * 2, SOCK_MIN_SNDBUF ) ; <END_BUG> sk -> sk_write_space ( sk ) ; break ; case SO_SNDBUFFORCE : if (! capable ( CAP_NET_ADMIN ) ) { ret = - EPERM ; break ; } goto set_sndbuf ; case SO_RCVBUF : val = min_t ( u32, val, sysctl_rmem_max ) ; set_rcvbuf :

Fix:
<S2SV_ModStart> = max_t ( int <S2SV_ModEnd>, val * <S2SV_ModStart> = max_t ( int <S2SV_ModEnd>, val *
Buggy code:
 int ip6_append_data ( struct sock * sk, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int transhdrlen, int hlimit, int tclass, struct ipv6_txoptions * opt, struct flowi6 * fl6, struct rt6_info * rt, unsigned int flags, int dontfrag ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct inet_cork * cork ; struct sk_buff * skb, * skb_prev = NULL ; <START_BUG> unsigned int maxfraglen, fragheaderlen ; <END_BUG> int exthdrlen ; int dst_exthdrlen ;  int hh_len ; <START_BUG> int mtu ; int copy ; int err ; int offset = 0 ; __u8 tx_flags = 0 ; if ( flags & MSG_PROBE ) return 0 ; cork = & inet -> cork. base ; if ( skb_queue_empty ( & sk -> sk_write_queue ) ) { if ( opt ) { if ( WARN_ON ( np -> cork. opt ) ) return - EINVAL ; np -> cork. opt = kzalloc ( opt -> tot_len, sk -> sk_allocation ) ; if ( unlikely ( np -> cork. opt == NULL ) ) return - ENOBUFS ; np -> cork. opt -> tot_len = opt -> tot_len ; np -> cork. opt -> opt_flen = opt -> opt_flen ; np -> cork. opt -> opt_nflen = opt -> opt_nflen ; np -> cork. opt -> dst0opt = ip6_opt_dup ( opt -> dst0opt, sk -> sk_allocation ) ; if ( opt -> dst0opt &&! np -> cork. opt -> dst0opt ) return - ENOBUFS ; np -> cork. opt -> dst1opt = ip6_opt_dup ( opt -> dst1opt, sk -> sk_allocation ) ; if ( opt -> dst1opt &&! np -> cork. opt -> dst1opt ) return - ENOBUFS ; np -> cork. opt -> hopopt = ip<END_BUG>

Fix:
<S2SV_ModStart> maxfraglen, fragheaderlen, mtu <S2SV_ModStart> ; int hh_len <S2SV_ModEnd> ; int copy <S2SV_ModStart> skb, rt, np -> pmtudisc == IPV6_PMTUDISC_PROBE
Buggy code:
 static inline unsigned int ReadPropertyUnsignedLong ( const EndianType endian, const unsigned char * buffer ) { unsigned int value ; if ( endian == LSBEndian ) { <START_BUG> value = ( unsigned int ) ( ( buffer [ 3 ] << 24 ) | ( buffer [ 2 ] << 16 ) | <END_BUG>  ( buffer [ 1 ] << 8 ) | ( buffer [ 0 ] ) ) ; <START_BUG> <END_BUG> return ( ( unsigned int ) ( value & 0xffffffff ) ) ;  } <START_BUG> value = ( unsigned int ) ( ( buffer [ 0 ] << 24 ) | ( buffer [ 1 ] << 16 ) | <END_BUG>  ( buffer [ 2 ] << 8 ) | buffer [ 3 ] ) ; <START_BUG> <END_BUG> return ( ( unsigned int ) ( value & 0xffffffff ) ) ;  }

Fix:
<S2SV_ModStart> unsigned int ) <S2SV_ModEnd> buffer [ 3 <S2SV_ModStart> ] << 24 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 2 <S2SV_ModStart> ] << 16 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 1 <S2SV_ModStart> ] << 8 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> [ 0 ] <S2SV_ModEnd> ; return ( <S2SV_ModStart> ; return ( <S2SV_ModEnd> value & 0xffffffff <S2SV_ModStart> value & 0xffffffff <S2SV_ModEnd> ) ; } <S2SV_ModStart> unsigned int ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> ] << 24 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 1 <S2SV_ModStart> ] << 16 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 2 <S2SV_ModStart> ] << 8 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 3 <S2SV_ModStart> [ 3 ] ; return <S2SV_ModEnd> ( value & <S2SV_ModStart> & 0xffffffff ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 unsigned long insn_get_seg_base ( struct pt_regs * regs, int seg_reg_idx ) { <START_BUG> struct desc_struct * desc ; <END_BUG> short sel ; sel = get_segment_selector ( regs, seg_reg_idx ) ; if ( sel < 0 ) return - 1L ; if ( v8086_mode ( regs ) ) return ( unsigned long ) ( sel << 4 ) ; if ( user_64bit_mode ( regs ) ) { unsigned long base ; if ( seg_reg_idx == INAT_SEG_REG_FS ) rdmsrl ( MSR_FS_BASE, base ) ; else if ( seg_reg_idx == INAT_SEG_REG_GS ) rdmsrl ( MSR_KERNEL_GS_BASE, base ) ; else base = 0 ; return base ; } if (! sel ) return - 1L ;  desc = get_desc ( sel ) ; <START_BUG> <END_BUG> if (! desc )  return - 1L ; <START_BUG> return get_desc_base ( desc ) ; <END_BUG> }

Fix:
<S2SV_ModStart> { struct desc_struct <S2SV_ModEnd> desc ; short <S2SV_ModStart> - 1L ; <S2SV_ModEnd> if (! <S2SV_ModStart> if (! get_desc ( & desc, sel ) <S2SV_ModEnd> ) return - <S2SV_ModStart> return get_desc_base ( &
Buggy code:
 apr_status_t h2_stream_add_header ( h2_stream * stream, const char * name, size_t nlen, const char * value, size_t vlen ) { <START_BUG> ap_assert ( stream ) ; <END_BUG>  if (! stream -> has_response ) { <START_BUG> if ( name [ 0 ] == ':' ) { if ( ( vlen ) > stream -> session -> s -> limit_req_line ) { ap_log_cerror ( APLOG_MARK, APLOG_TRACE1, 0, stream -> session -> c, "h2_stream(%ld-%d):   pseudo   header   %s   too   long", stream -> session -> id, stream -> id, name ) ; <END_BUG> return h2_stream_set_error ( stream,  HTTP_REQUEST_URI_TOO_LARGE ) ; } } else if ( ( nlen + 2 + vlen ) > stream -> session -> s -> limit_req_fieldsize ) { ap_log_cerror ( APLOG_MARK, APLOG_TRACE1, 0, stream -> session -> c, "h2_stream(%ld-%d):   header   %s   too   long", stream -> session -> id, stream -> id, name ) ; <START_BUG> return h2_stream_set_error ( stream, <END_BUG>  HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE ) ; <START_BUG> } if ( name [ 0 ]!= ':' ) { ++ stream -> request_headers_added ; if ( stream -> request_headers_added > stream -> session -> s -> limit_req_fields ) { ap_log_cerror ( APLOG_MARK, APLOG_TRACE1, 0, stream -> session -> c, "h2_stream(%ld-%d):   too   many   header   lines", stream -> session -> id, stream -> id ) ; return h2_stream_set_error ( stream, HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE ) ; } } } if ( h2_stream_is_scheduled ( stream ) ) { return add_trailer ( stream, name, nlen, value, vlen ) ; } else { if (! stream -> rtmp ) { stream -> rtmp = h2_req_create ( stream -> id, stream -> pool, NULL, NULL, NULL<END_BUG>

Fix:
<S2SV_ModStart> vlen ) { int error = 0 ; <S2SV_ModStart> ; if ( <S2SV_ModEnd> stream -> has_response <S2SV_ModStart> has_response ) { return APR_EINVAL ; } ++ stream -> request_headers_added ; <S2SV_ModStart> name ) ; error = HTTP_REQUEST_URI_TOO_LARGE <S2SV_ModEnd> ; } } <S2SV_ModStart> name ) ; error = HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE ; } if ( stream -> request_headers_added > stream -> session -> s -> limit_req_fields + 4 ) { if ( stream -> request_headers_added > stream -> session -> s -> limit_req_fields + 4 + 100 ) { return APR_ECONNRESET ; } ap_log_cerror ( APLOG_MARK, APLOG_TRACE1, 0, stream -> session -> c, "h2_stream(%ld-%d): <S2SV_blank> too <S2SV_blank> many <S2SV_blank> header <S2SV_blank> lines", stream -> session -> id, stream -> id ) ; error = HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE ; } if ( h2_stream_is_scheduled ( stream ) ) { return add_trailer ( stream, name, nlen, value, vlen )
Buggy code:
 void ndpi_search_h323 ( struct ndpi_detection_module_struct * ndpi_struct, struct ndpi_flow_struct * flow ) { struct ndpi_packet_struct * packet = & flow -> packet ; u_int16_t dport = 0, sport = 0 ; NDPI_LOG_DBG ( ndpi_struct, "search   H323\\n" ) ; if ( ( packet -> tcp!= NULL ) && ( packet -> tcp -> dest!= ntohs ( 102 ) ) ) { NDPI_LOG_DBG2 ( ndpi_struct, "calculated   dport   over   tcp\\n" ) ; if ( packet -> payload_packet_len >= 4 && ( packet -> payload [ 0 ] == 0x03 ) && ( packet -> payload [ 1 ] == 0x00 ) ) { struct tpkt * t = ( struct tpkt * ) packet -> payload ; u_int16_t len = ntohs ( t -> len ) ; if ( packet -> payload_packet_len == len ) { if ( packet -> payload [ 4 ] == ( packet -> payload_packet_len - sizeof ( struct tpkt ) - 1 ) ) { if ( ( packet -> payload [ 5 ] == 0xE0 ) || ( packet -> payload [ 5 ] == 0xD0 ) ) { NDPI_LOG_INFO ( ndpi_struct, "found   RDP\\n" ) ; ndpi_set_detected_protocol ( ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN ) ; return ; } } flow -> l4. tcp. h323_valid_packets ++ ; if ( flow -> l4. tcp. h323_valid_packets >= 2 ) { NDPI_LOG_INFO ( ndpi_struct, "found   H323   broadcast\\n" ) ; ndpi_set_detected_protocol ( ndpi_struct, flow, NDPI_PROTOCOL_H323, NDPI_PROTOCOL_UNKNOWN ) ; } } else { NDPI_EXCLUDE_PROTO ( ndpi_struct, flow ) ; return ; } } } else if ( packet -> udp!= NULL ) { sport = ntohs ( packet -> udp -> source ), dport =

Fix:
<S2SV_ModStart> == 1719 ) { if ( ( packet -> payload_packet_len >= 5 ) && <S2SV_ModEnd> ( packet -> <S2SV_ModStart> ] == 0x16 ) && ( <S2SV_ModEnd> packet -> payload <S2SV_ModStart> ] == 0x80 ) && ( <S2SV_ModEnd> packet -> payload <S2SV_ModStart> ] == 0x06 ) && ( <S2SV_ModEnd> packet -> payload <S2SV_ModStart> == 0x00 ) )
Buggy code:
 static int php_handler ( request_rec * r ) { php_struct * volatile ctx ; void * conf ; apr_bucket_brigade * volatile brigade ; apr_bucket * bucket ; apr_status_t rv ; request_rec * volatile parent_req = NULL ; TSRMLS_FETCH ( ) ; # define PHPAP_INI_OFF php_apache_ini_dtor ( r, parent_req TSRMLS_CC ) ; conf = ap_get_module_config ( r -> per_dir_config, & php5_module ) ; ctx = SG ( server_context ) ; if ( ctx == NULL || ( ctx && ctx -> request_processed &&! strcmp ( r -> protocol, "INCLUDED" ) ) ) { normal : ctx = SG ( server_context ) = apr_pcalloc ( r -> pool, sizeof ( * ctx ) ) ; apr_pool_cleanup_register ( r -> pool, ( void * ) & SG ( server_context ), php_server_context_cleanup, apr_pool_cleanup_null ) ; ctx -> r = r ; ctx = NULL ; } else { parent_req = ctx -> r ; ctx -> r = r ; } apply_config ( conf ) ; if ( strcmp ( r -> handler, PHP_MAGIC_TYPE ) && strcmp ( r -> handler, PHP_SOURCE_MAGIC_TYPE ) && strcmp ( r -> handler, PHP_SCRIPT ) ) { if (! AP2 ( xbithack ) || strcmp ( r -> handler, "text//html" ) ||! ( r -> finfo. protection & APR_UEXECUTE ) ) { PHPAP_INI_OFF ; return DECLINED ; } } if ( r -> used_path_info == AP_REQ_REJECT_PATH_INFO && r -> path_info && r -> path_info [ 0 ] ) { PHPAP_INI_OFF ; return HTTP_NOT_FOUND ; } if (! AP2 ( engine ) ) { PHPAP_INI_OFF ; return DECLINED ; } if ( r -> finfo. filetype == 0 ) { php_apache_sapi_log_message_ex ( "script   \'%s\'   not   found   or   unable   to   stat", r TSRMLS_

Fix:
<S2SV_ModStart> = 1 ; apr_brigade_cleanup ( brigade ) ;
Buggy code:
 bgp_size_t bgp_packet_attribute ( struct bgp * bgp, struct peer * peer, struct stream * s, struct attr * attr, struct bpacket_attr_vec_arr * vecarr, struct prefix * p, afi_t afi, safi_t safi, struct peer * from, struct prefix_rd * prd, mpls_label_t * label, uint32_t num_labels, int addpath_encode, uint32_t addpath_tx_id ) { size_t cp ; size_t aspath_sizep ; struct aspath * aspath ; int send_as4_path = 0 ; int send_as4_aggregator = 0 ; int use32bit = ( CHECK_FLAG ( peer -> cap, PEER_CAP_AS4_RCV ) )? 1 : 0 ; if (! bgp ) bgp = peer -> bgp ; cp = stream_get_endp ( s ) ; if ( p &&! ( ( afi == AFI_IP && safi == SAFI_UNICAST ) &&! peer_cap_enhe ( peer, afi, safi ) ) ) { size_t mpattrlen_pos = 0 ; mpattrlen_pos = bgp_packet_mpattr_start ( s, peer, afi, safi, vecarr, attr ) ; bgp_packet_mpattr_prefix ( s, afi, safi, p, prd, label, num_labels, addpath_encode, addpath_tx_id, attr ) ; bgp_packet_mpattr_end ( s, mpattrlen_pos ) ; } stream_putc ( s, BGP_ATTR_FLAG_TRANS ) ; stream_putc ( s, BGP_ATTR_ORIGIN ) ; stream_putc ( s, 1 ) ; stream_putc ( s, attr -> origin ) ; if ( peer -> sort == BGP_PEER_EBGP && (! CHECK_FLAG ( peer -> af_flags [ afi ] [ safi ], PEER_FLAG_AS_PATH_UNCHANGED ) || attr -> aspath -> segments == NULL ) && (! CHECK_FLAG ( peer -> af_flags [ afi ] [ safi ], PEER_FLAG_RSERVER_CLIENT ) ) ) { aspath = aspath_dup (

Fix:
<S2SV_ModStart> ; # if ENABLE_BGP_VNC_ATTR <S2SV_ModEnd> bgp_packet_mpattr_tea ( bgp
Buggy code:
 static int chmd_read_headers ( struct mspack_system * sys, struct mspack_file * fh, struct mschmd_header * chm, int entire ) { unsigned int section, name_len, x, errors, num_chunks ; unsigned char buf [ 0x54 ], * chunk = NULL, * name, * p, * end ; struct mschmd_file * fi, * link = NULL ; off_t offset, length ; int num_entries ; chm -> files = NULL ; chm -> sysfiles = NULL ; chm -> chunk_cache = NULL ; chm -> sec0. base. chm = chm ; chm -> sec0. base. id = 0 ; chm -> sec1. base. chm = chm ; chm -> sec1. base. id = 1 ; chm -> sec1. content = NULL ; chm -> sec1. control = NULL ; chm -> sec1. spaninfo = NULL ; chm -> sec1. rtable = NULL ; if ( sys -> read ( fh, & buf [ 0 ], chmhead_SIZEOF )!= chmhead_SIZEOF ) { return MSPACK_ERR_READ ; } if ( EndGetI32 ( & buf [ chmhead_Signature ] )!= 0x46535449 ) { return MSPACK_ERR_SIGNATURE ; } if ( mspack_memcmp ( & buf [ chmhead_GUID1 ], & guids [ 0 ], 32L )!= 0 ) { D ( ( "incorrect   GUIDs" ) ) return MSPACK_ERR_SIGNATURE ; } chm -> version = EndGetI32 ( & buf [ chmhead_Version ] ) ; chm -> timestamp = EndGetM32 ( & buf [ chmhead_Timestamp ] ) ; chm -> language = EndGetI32 ( & buf [ chmhead_LanguageID ] ) ; if ( chm -> version > 3 ) { sys -> message ( fh, "WARNING;   CHM   version   >   3" ) ; } if ( sys -> read ( fh, & buf [ 0 ], chmhst3_SIZEOF )!= chmhst3_SIZEOF ) { return MSPACK_ERR_READ ; } if ( read_off64 ( & offset, & buf [ chmhst_Offset

Fix:
<S2SV_ModStart> chm -> index_root >= <S2SV_ModEnd> chm -> num_chunks <S2SV_ModStart> goto chunk_end ; if ( name_len == 0 ) goto chunk_end ;
Buggy code:
 static void * Type_MLU_Read ( struct _cms_typehandler_struct * self, cmsIOHANDLER * io, cmsUInt32Number * nItems, cmsUInt32Number SizeOfTag ) { cmsMLU * mlu ; cmsUInt32Number Count, RecLen, NumOfWchar ; cmsUInt32Number SizeOfHeader ; cmsUInt32Number Len, Offset ; cmsUInt32Number i ; wchar_t * Block ; cmsUInt32Number BeginOfThisString, EndOfThisString, LargestPosition ; * nItems = 0 ; if (! _cmsReadUInt32Number ( io, & Count ) ) return NULL ; if (! _cmsReadUInt32Number ( io, & RecLen ) ) return NULL ; if ( RecLen!= 12 ) { cmsSignalError ( self -> ContextID, cmsERROR_UNKNOWN_EXTENSION, "multiLocalizedUnicodeType   of   len  !=   12   is   not   supported." ) ; return NULL ; } mlu = cmsMLUalloc ( self -> ContextID, Count ) ; if ( mlu == NULL ) return NULL ; mlu -> UsedEntries = Count ; SizeOfHeader = 12 * Count + sizeof ( _cmsTagBase ) ; LargestPosition = 0 ; for ( i = 0 ; i < Count ; i ++ ) { if (! _cmsReadUInt16Number ( io, & mlu -> Entries [ i ]. Language ) ) goto Error ; if (! _cmsReadUInt16Number ( io, & mlu -> Entries [ i ]. Country ) ) goto Error ; if (! _cmsReadUInt32Number ( io, & Len ) ) goto Error ; if (! _cmsReadUInt32Number ( io, & Offset ) ) goto Error ; <START_BUG> if ( Offset < ( SizeOfHeader + 8 ) ) goto Error ; <END_BUG> BeginOfThisString = Offset - SizeOfHeader - 8 ; mlu -> Entries [ i ]. Len = ( Len * sizeof ( wchar_t ) ) // sizeof ( cmsUInt16Number ) ; mlu -> Entries [ i ]. StrW = ( BeginOfThisString * sizeof ( wchar_t ) ) // sizeof ( cmsUInt16Number ) ; EndOfThisString = BeginOfThisString + Len ; if ( EndOfThisString > LargestPosition ) LargestPosition = EndOfThisString ; } SizeOfTag = ( LargestPosition

Fix:
<S2SV_ModStart> + 8 ) ) goto Error ; if ( ( Offset + Len ) > SizeOfTag + 8
Buggy code:
 int kvm_set_msr ( struct kvm_vcpu * vcpu, struct msr_data * msr ) { <START_BUG> return kvm_x86_ops -> set_msr ( vcpu, msr ) ; <END_BUG> }

Fix:
<S2SV_ModStart> msr ) { switch ( msr -> index ) { case MSR_FS_BASE : case MSR_GS_BASE : case MSR_KERNEL_GS_BASE : case MSR_CSTAR : case MSR_LSTAR : if ( is_noncanonical_address ( msr -> data ) ) return 1 ; break ; case MSR_IA32_SYSENTER_EIP : case MSR_IA32_SYSENTER_ESP : msr -> data = get_canonical ( msr -> data ) ; }
Buggy code:
 void vp8_end_second_pass ( VP8_COMP * cpi ) { <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> cpi ) { ( void ) cpi ;
Buggy code:
 static int mov_read_dref ( MOVContext * c, AVIOContext * pb, MOVAtom atom ) { AVStream * st ; MOVStreamContext * sc ; int entries, i, j ; if ( c -> fc -> nb_streams < 1 ) return 0 ; st = c -> fc -> streams [ c -> fc -> nb_streams - 1 ] ; sc = st -> priv_data ; avio_rb32 ( pb ) ; entries = avio_rb32 ( pb ) ; if ( entries >= UINT_MAX // sizeof ( * sc -> drefs ) ) return AVERROR_INVALIDDATA ; av_free ( sc -> drefs ) ; <START_BUG> sc -> drefs = av_mallocz ( entries * sizeof ( * sc -> drefs ) ) ; <END_BUG> if (! sc -> drefs ) return AVERROR ( ENOMEM ) ; sc -> drefs_count = entries ; for ( i = 0 ; i < sc -> drefs_count ; i ++ ) { MOVDref * dref = & sc -> drefs [ i ] ; uint32_t size = avio_rb32 ( pb ) ; int64_t next = avio_tell ( pb ) + size - 4 ; if ( size < 12 ) return AVERROR_INVALIDDATA ; dref -> type = avio_rl32 ( pb ) ; avio_rb32 ( pb ) ; av_dlog ( c -> fc, "type   %.4s   size   %d\\n", ( char * ) & dref -> type, size ) ; if ( dref -> type == MKTAG ( 'a', 'l', 'i','s' ) && size > 150 ) { uint16_t volume_len, len ; int16_t type ; avio_skip ( pb, 10 ) ; volume_len = avio_r8 ( pb ) ; volume_len = FFMIN ( volume_len, 27 ) ; avio_read ( pb, dref -> volume, 27 ) ; dref -> volume [ volume_len ] = 0 ; av_log ( c -> fc, AV_LOG_DEBUG, "volume   %s,   len   %d\\n", dref -> volume, volume_len ) ; avio_skip (

Fix:
<S2SV_ModStart> ; sc -> drefs_count = 0 ; sc ->
Buggy code:
 DECLAREcpFunc ( cpContig2SeparateByRow ) { tsize_t scanlinesizein = TIFFScanlineSize ( in ) ; tsize_t scanlinesizeout = TIFFScanlineSize ( out ) ; tdata_t inbuf ; tdata_t outbuf ; register uint8 * inp, * outp ; register uint32 n ; uint32 row ; tsample_t s ; <START_BUG> inbuf = _TIFFmalloc ( scanlinesizein ) ; <END_BUG> outbuf = _TIFFmalloc ( scanlinesizeout ) ; if (! inbuf ||! outbuf ) goto bad ; _TIFFmemset ( inbuf, 0, scanlinesizein ) ; _TIFFmemset ( outbuf, 0, scanlinesizeout ) ; for ( s = 0 ; s < spp ; s ++ ) { for ( row = 0 ; row < imagelength ; row ++ ) { if ( TIFFReadScanline ( in, inbuf, row, 0 ) < 0 &&! ignore ) { TIFFError ( TIFFFileName ( in ), "Error,   can\'t   read   scanline   %lu", ( unsigned long ) row ) ; goto bad ; } inp = ( ( uint8 * ) inbuf ) + s ; outp = ( uint8 * ) outbuf ; for ( n = imagewidth ; n -- > 0 ; ) { * outp ++ = * inp ; inp += spp ; } if ( TIFFWriteScanline ( out, outbuf, row, s ) < 0 ) { TIFFError ( TIFFFileName ( out ), "Error,   can\'t   write   scanline   %lu", ( unsigned long ) row ) ; goto bad ; } } } if ( inbuf ) _TIFFfree ( inbuf ) ; if ( outbuf ) _TIFFfree ( outbuf ) ; return 1 ; bad : if ( inbuf ) _TIFFfree ( inbuf ) ; if ( outbuf ) _TIFFfree ( outbuf ) ; return 0 ; }

Fix:
<S2SV_ModStart> tsample_t s ; uint16 bps = 0 ; ( void ) TIFFGetField ( in, TIFFTAG_BITSPERSAMPLE, & bps ) ; if ( bps!= 8 ) { TIFFError ( TIFFFileName ( in ), "Error, <S2SV_blank> can <S2SV_blank> only <S2SV_blank> handle <S2SV_blank> BitsPerSample=8 <S2SV_blank> in <S2SV_blank> %s", "cpContig2SeparateByRow" ) ; return 0 ; }
Buggy code:
 static void opj_j2k_set_cinema_parameters ( opj_cparameters_t * parameters, opj_image_t * image, opj_event_mgr_t * p_manager ) { int i ; parameters -> tile_size_on = OPJ_FALSE ; parameters -> cp_tdx = 1 ; parameters -> cp_tdy = 1 ; parameters -> tp_flag = 'C' ; parameters -> tp_on = 1 ; parameters -> cp_tx0 = 0 ; parameters -> cp_ty0 = 0 ; parameters -> image_offset_x0 = 0 ; parameters -> image_offset_y0 = 0 ; parameters -> cblockw_init = 32 ; parameters -> cblockh_init = 32 ; parameters -> mode = 0 ; parameters -> roi_compno = - 1 ; parameters -> subsampling_dx = 1 ; parameters -> subsampling_dy = 1 ; parameters -> irreversible = 1 ; if ( parameters -> tcp_numlayers > 1 ) { opj_event_msg ( p_manager, EVT_WARNING, "JPEG   2000   Profile-3   and   4   (2k//4k   dc   profile)   requires:\\n" "1   single   quality   layer" "->   Number   of   layers   forced   to   1   (rather   than   %d)\\n" "->   Rate   of   the   last   layer   (%3.1f)   will   be   used", parameters -> tcp_numlayers, parameters -> tcp_rates [ parameters -> tcp_numlayers - 1 ] ) ; parameters -> tcp_rates [ 0 ] = parameters -> tcp_rates [ parameters -> tcp_numlayers - 1 ] ; parameters -> tcp_numlayers = 1 ; } switch ( parameters -> rsiz ) { case OPJ_PROFILE_CINEMA_2K : if ( parameters -> numresolution > 6 ) { opj_event_msg ( p_manager, EVT_WARNING, "JPEG   2000   Profile-3   (2k   dc   profile)   requires:\\n" "Number   of   decomposition   levels   <=   5\\n" "->   Number   of   decomposition   levels   forced   to   5   (rather   than   %d)\\n", parameters -> numresolution

Fix:
<S2SV_ModStart> |= 0x01 ; if ( parameters -> numresolution == 1 ) { parameters -> res_spec = 1 ; parameters -> prcw_init [ 0 ] = 128 ; parameters -> prch_init [ 0 ] = 128 ; } else { <S2SV_ModStart> = 256 ; }
Buggy code:
 <START_BUG> static int tile_worker_hook ( void * arg1, void * arg2 ) { <END_BUG>  TileWorkerData * const tile_data = ( TileWorkerData * ) arg1 ; <START_BUG> <END_BUG> const TileInfo * const tile = ( TileInfo * ) arg2 ;  <START_BUG> int mi_row, mi_col ; <END_BUG> for ( mi_row = tile -> mi_row_start ; mi_row < tile -> mi_row_end ; mi_row += MI_BLOCK_SIZE ) { vp9_zero ( tile_data -> xd. left_context ) ; vp9_zero ( tile_data -> xd. left_seg_context ) ; for ( mi_col = tile -> mi_col_start ; mi_col < tile -> mi_col_end ; mi_col += MI_BLOCK_SIZE ) {  decode_partition ( tile_data -> cm, & tile_data -> xd, tile, <START_BUG> <END_BUG> mi_row, mi_col, & tile_data -> bit_reader, BLOCK_64X64 ) ;  } } return! tile_data -> xd. corrupted ; }

Fix:
<S2SV_ModStart> int tile_worker_hook ( <S2SV_ModEnd> TileWorkerData * const <S2SV_ModStart> * const tile_data, <S2SV_ModEnd> const TileInfo * <S2SV_ModStart> * const tile ) { <S2SV_ModEnd> int mi_row, <S2SV_ModStart> mi_row, mi_col ; if ( setjmp ( tile_data -> error_info. jmp ) ) { tile_data -> error_info. setjmp = 0 ; tile_data -> xd. corrupted = 1 ; return 0 ; } tile_data -> error_info. setjmp = 1 ; tile_data -> xd. error_info = & tile_data -> error_info <S2SV_ModStart> ( tile_data -> pbi <S2SV_ModEnd>, & tile_data <S2SV_ModStart> tile_data -> xd <S2SV_ModEnd>, mi_row, <S2SV_ModStart> bit_reader, BLOCK_64X64, 4
Buggy code:
 int pci_bus_configured ( int bus ) { <START_BUG> assert ( bus >= 0 && bus < MAXBUSES ) ; <END_BUG> return ( pci_businfo [ bus ]!= NULL ) ; }

Fix:
<S2SV_ModStart> bus ) { <S2SV_ModEnd> return ( pci_businfo
Buggy code:
 static int tpacket_rcv ( struct sk_buff * skb, struct net_device * dev, struct packet_type * pt, struct net_device * orig_dev ) { struct sock * sk ; struct packet_sock * po ; struct sockaddr_ll * sll ; union { struct tpacket_hdr * h1 ; struct tpacket2_hdr * h2 ; void * raw ; } h ; u8 * skb_head = skb -> data ; int skb_len = skb -> len ; unsigned int snaplen, res ; unsigned long status = TP_STATUS_LOSING | TP_STATUS_USER ; unsigned short macoff, netoff, hdrlen ; struct sk_buff * copy_skb = NULL ; struct timeval tv ; struct timespec ts ; struct skb_shared_hwtstamps * shhwtstamps = skb_hwtstamps ( skb ) ; if ( skb -> pkt_type == PACKET_LOOPBACK ) goto drop ; sk = pt -> af_packet_priv ; po = pkt_sk ( sk ) ; if (! net_eq ( dev_net ( dev ), sock_net ( sk ) ) ) goto drop ; if ( dev -> header_ops ) { if ( sk -> sk_type!= SOCK_DGRAM ) skb_push ( skb, skb -> data - skb_mac_header ( skb ) ) ; else if ( skb -> pkt_type == PACKET_OUTGOING ) { skb_pull ( skb, skb_network_offset ( skb ) ) ; } } if ( skb -> ip_summed == CHECKSUM_PARTIAL ) status |= TP_STATUS_CSUMNOTREADY ; snaplen = skb -> len ; res = run_filter ( skb, sk, snaplen ) ; if (! res ) goto drop_n_restore ; if ( snaplen > res ) snaplen = res ; if ( sk -> sk_type == SOCK_DGRAM ) { macoff = netoff = TPACKET_ALIGN ( po -> tp_hdrlen ) + 16 + po -> tp_reserve ; } else { unsigned maclen = skb_network_offset ( skb ) ; netoff = TPACKET_ALIGN ( po -> tp_hdrl

Fix:
<S2SV_ModStart> 0 ; } h. h2 -> tp_padding = 0 ;
Buggy code:
 static int uas_switch_interface ( struct usb_device * udev, struct usb_interface * intf ) { <START_BUG> int alt ; <END_BUG> alt = uas_find_uas_alt_setting ( intf ) ;  if ( alt < 0 ) <START_BUG> return alt ; return usb_set_interface ( udev, <END_BUG> intf -> altsetting [ 0 ]. desc. bInterfaceNumber, alt ) ;  }

Fix:
<S2SV_ModStart> intf ) { struct usb_host_interface * <S2SV_ModEnd> alt ; alt <S2SV_ModStart> ; if (! alt ) return - ENODEV <S2SV_ModEnd> ; return usb_set_interface <S2SV_ModStart> ( udev, alt -> <S2SV_ModEnd> desc. bInterfaceNumber <S2SV_ModStart> bInterfaceNumber, alt -> desc. bAlternateSetting
Buggy code:
 static void down2_symeven ( const uint8_t * const input, int length, uint8_t * output ) { <START_BUG> static const int16_t * filter = vp9_down2_symeven_half_filter ; <END_BUG> const int filter_len_half = sizeof ( vp9_down2_symeven_half_filter ) // 2 ; int i, j ; uint8_t * optr = output ; int l1 = filter_len_half ; int l2 = ( length - filter_len_half ) ; l1 += ( l1 & 1 ) ; l2 += ( l2 & 1 ) ; if ( l1 > l2 ) { for ( i = 0 ; i < length ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) ; for ( j = 0 ; j < filter_len_half ; ++ j ) { sum += ( input [ ( i - j < 0? 0 : i - j ) ] + input [ ( i + 1 + j >= length? length - 1 : i + 1 + j ) ] ) * filter [ j ] ; } sum >>= FILTER_BITS ; * optr ++ = clip_pixel ( sum ) ; } } else { for ( i = 0 ; i < l1 ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) ; for ( j = 0 ; j < filter_len_half ; ++ j ) { sum += ( input [ ( i - j < 0? 0 : i - j ) ] + input [ i + 1 + j ] ) * filter [ j ] ; } sum >>= FILTER_BITS ; * optr ++ = clip_pixel ( sum ) ; } for ( ; i < l2 ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) ; for ( j = 0 ; j < filter_len_half ; ++ j ) { sum += ( input [ i - j ] + input [ i + 1 + j ] ) * filter [ j ] ; } sum >>= FILTER_BITS ; * optr ++ = clip_pixel ( sum ) ; } for ( ; i < length ; i += 2 ) { int sum = ( 1 << ( FILTER_BITS - 1 ) ) ; for ( j = 0 ; j < filter_len_half ; ++ j ) {

Fix:
<S2SV_ModStart> output ) { <S2SV_ModEnd> const int16_t *
Buggy code:
 static RList * r_bin_wasm_get_data_entries ( RBinWasmObj * bin, RBinWasmSection * sec ) { RList * ret = NULL ; RBinWasmDataEntry * ptr = NULL ; <START_BUG> if (! ( ret = r_list_newf ( ( RListFree ) free ) ) ) { <END_BUG> return NULL ; } ut8 * buf = bin -> buf -> buf + ( ut32 ) sec -> payload_data ;  ut32 len = sec -> payload_len ; <START_BUG> ut32 count = sec -> count ; ut32 i = 0, r = 0 ; size_t n = 0 ; <END_BUG> while ( i < len && r < count ) {  if (! ( ptr = R_NEW0 ( RBinWasmDataEntry ) ) ) { return ret ; } if (! ( consume_u32 ( buf + i, buf + len, & ptr -> index, & i ) ) ) { <START_BUG> free ( ptr ) ; <END_BUG> return ret ; } if (! ( n = consume_init_expr ( buf + i, buf + len, R_BIN_WASM_END_OF_CODE, NULL, & i ) ) ) {  free ( ptr ) ; <START_BUG> return ret ; } ptr -> offset. len = n ; if (! ( consume_u32 ( buf + i, buf + len, & ptr -> size, & i ) ) ) { <END_BUG> free ( ptr ) ;  return ret ; } ptr -> data = sec -> payload_data + i ; r_list_append ( ret, ptr ) ; r += 1 ; } return ret ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> = NULL ; ut32 len = sec -> payload_len ; <S2SV_ModStart> -> payload_data ; int buflen = bin -> buf -> length - ( ut32 ) sec -> payload_data <S2SV_ModEnd> ; ut32 count <S2SV_ModStart> i < len && len < buflen <S2SV_ModStart> ) ) { goto beach ; } if ( i + 4 >= buflen ) { goto beach <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) { goto beach <S2SV_ModEnd> ; } ptr <S2SV_ModStart> ) ) { goto beach ; } if ( i + 4 >= buflen ) { goto beach <S2SV_ModEnd> ; } ptr <S2SV_ModStart> return ret ; beach : free ( ptr ) ; return ret ;
Buggy code:
 static Image * ReadMATImageV4 ( const ImageInfo * image_info, Image * image, ExceptionInfo * exception ) { typedef struct { unsigned char Type [ 4 ] ; unsigned int nRows ; unsigned int nCols ; unsigned int imagf ; unsigned int nameLen ; } MAT4_HDR ; long ldblk ; EndianType endian ; Image * rotated_image ; MagickBooleanType status ; MAT4_HDR HDR ; QuantumInfo * quantum_info ; QuantumFormatType format_type ; register ssize_t i ; ssize_t count, y ; unsigned char * pixels ; unsigned int depth ; quantum_info = ( QuantumInfo * ) NULL ; ( void ) SeekBlob ( image, 0, SEEK_SET ) ; status = MagickTrue ; while ( EOFBlob ( image ) == MagickFalse ) { ldblk = ReadBlobLSBLong ( image ) ; <START_BUG> if ( ( ldblk > 9999 ) || ( ldblk < 0 ) ) <END_BUG> break ; HDR. Type [ 3 ] = ldblk % 10 ; ldblk //= 10 ; HDR. Type [ 2 ] = ldblk % 10 ; ldblk //= 10 ; HDR. Type [ 1 ] = ldblk % 10 ; ldblk //= 10 ; HDR. Type [ 0 ] = ldblk ; if ( HDR. Type [ 3 ]!= 0 ) break ; if ( HDR. Type [ 2 ]!= 0 ) break ; if ( HDR. Type [ 0 ] == 0 ) { HDR. nRows = ReadBlobLSBLong ( image ) ; HDR. nCols = ReadBlobLSBLong ( image ) ; HDR. imagf = ReadBlobLSBLong ( image ) ; HDR. nameLen = ReadBlobLSBLong ( image ) ; endian = LSBEndian ; } else { HDR. nRows = ReadBlobMSBLong ( image ) ; HDR. nCols = ReadBlobMSBLong ( image ) ; HDR. imagf = ReadBlobMSBLong ( image ) ; HDR. nameLen = ReadBlobMSBLong ( image ) ; endian = MSBEndian ; } if ( ( HDR. imagf!= 0 ) && ( HDR. imagf!= 1 ) )

Fix:
<S2SV_ModStart> ; if ( EOFBlob ( image ) ) break ; if (