nus-yam/ex-repair huggingface dataset:
Buggy code:
 int tls1_change_cipher_state ( SSL * s, int which ) { unsigned char * p, * mac_secret ; unsigned char tmp1 [ EVP_MAX_KEY_LENGTH ] ; unsigned char tmp2 [ EVP_MAX_KEY_LENGTH ] ; unsigned char iv1 [ EVP_MAX_IV_LENGTH * 2 ] ; unsigned char iv2 [ EVP_MAX_IV_LENGTH * 2 ] ; unsigned char * ms, * key, * iv ; EVP_CIPHER_CTX * dd ; const EVP_CIPHER * c ; # ifndef OPENSSL_NO_COMP const SSL_COMP * comp ; # endif const EVP_MD * m ; int mac_type ; int * mac_secret_size ; EVP_MD_CTX * mac_ctx ; EVP_PKEY * mac_key ; int n, i, j, k, cl ; int reuse_dd = 0 ; c = s -> s3 -> tmp. new_sym_enc ; m = s -> s3 -> tmp. new_hash ; mac_type = s -> s3 -> tmp. new_mac_pkey_type ; # ifndef OPENSSL_NO_COMP comp = s -> s3 -> tmp. new_compression ; # endif if ( which & SSL3_CC_READ ) { <START_BUG> if ( s -> s3 -> tmp. new_cipher -> algorithm2 & TLS1_STREAM_MAC ) <END_BUG> s -> mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM ; else s -> mac_flags &= ~ SSL_MAC_FLAG_READ_MAC_STREAM ; if ( s -> enc_read_ctx!= NULL ) reuse_dd = 1 ; else if ( ( s -> enc_read_ctx = EVP_CIPHER_CTX_new ( ) ) == NULL ) goto err ; else EVP_CIPHER_CTX_reset ( s -> enc_read_ctx ) ; dd = s -> enc_read_ctx ; mac_ctx = ssl_replace_hash ( & s -> read_hash, NULL ) ; if ( mac_ctx == NULL ) goto err ; # ifndef OPENSSL_NO_COMP COMP_CTX_free ( s -> expand ) ; s -> expand = NULL ; if ( comp!= NULL ) { s -> expand = COMP

Fix:
<S2SV_ModStart> ( s -> tlsext_use_etm ) s -> s3 -> flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ ; else s -> s3 -> flags &= ~ TLS1_FLAGS_ENCRYPT_THEN_MAC_READ ; if ( s -> <S2SV_ModStart> } else { if ( s -> tlsext_use_etm ) s -> s3 -> flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE ; else s -> s3 -> flags &= ~ TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE ;
Buggy code:
 BOOL rdp_decrypt ( rdpRdp * rdp, STREAM * s, int length, UINT16 securityFlags ) { BYTE cmac [ 8 ] ; BYTE wmac [ 8 ] ; if ( rdp -> settings -> EncryptionMethods == ENCRYPTION_METHOD_FIPS ) { UINT16 len ; BYTE version, pad ; BYTE * sig ; if ( stream_get_left ( s ) < 12 ) return FALSE ; stream_read_UINT16 ( s, len ) ; stream_read_BYTE ( s, version ) ; stream_read_BYTE ( s, pad ) ; sig = s -> p ; stream_seek ( s, 8 ) ; length -= 12 ; if (! security_fips_decrypt ( s -> p, length, rdp ) ) { printf ( "FATAL:   cannot   decrypt\\n" ) ; return FALSE ; } if (! security_fips_check_signature ( s -> p, length - pad, sig, rdp ) ) { printf ( "FATAL:   invalid   packet   signature\\n" ) ; return FALSE ; } s -> size -= pad ; return TRUE ; } if ( stream_get_left ( s ) < 8 ) return FALSE ; stream_read ( s, wmac, sizeof ( wmac ) ) ; length -= sizeof ( wmac ) ; <START_BUG> security_decrypt ( s -> p, length, rdp ) ; <END_BUG> if ( securityFlags & SEC_SECURE_CHECKSUM ) security_salted_mac_signature ( rdp, s -> p, length, FALSE, cmac ) ; else security_mac_signature ( rdp, s -> p, length, cmac ) ; if ( memcmp ( wmac, cmac, sizeof ( wmac ) )!= 0 ) { printf ( "WARNING:   invalid   packet   signature\\n" ) ; } return TRUE ; }

Fix:
<S2SV_ModStart> wmac ) ; if (! <S2SV_ModStart>, rdp ) ) return FALSE
Buggy code:
 <START_BUG> static int bson_string_is_db_ref ( const unsigned char * string, const int length ) { <END_BUG> int result = 0 ; if ( length >= 4 ) { if ( string [ 1 ] == 'r' && string [ 2 ] == 'e' && string [ 3 ] == 'f' ) result = 1 ; } else if ( length >= 3 ) { if ( string [ 1 ] == 'i' && string [ 2 ] == 'd' ) result = 1 ; else if ( string [ 1 ] == 'd' && string [ 2 ] == 'b' ) result = 1 ; } return result ; }

Fix:
<S2SV_ModStart> string, const size_t <S2SV_ModEnd> length ) {
Buggy code:
 int jbig2_image_compose ( Jbig2Ctx * ctx, Jbig2Image * dst, Jbig2Image * src, int x, int y, Jbig2ComposeOp op ) { uint32_t w, h ; uint32_t shift ; uint32_t leftbyte ; uint8_t * ss ; uint8_t * dd ; uint8_t leftmask, rightmask ; int early = x >= 0 ; int late ; uint32_t bytewidth ; uint32_t syoffset = 0 ; if ( src == NULL ) <START_BUG> return 0 ; <END_BUG> w = src -> width ; h = src -> height ; shift = ( x & 7 ) ; ss = src -> data - early ; if ( x < 0 ) { if ( w < ( uint32_t ) - x ) w = 0 ; else w += x ; ss += ( - x - 1 ) >> 3 ; x = 0 ; } if ( y < 0 ) { if ( h < ( uint32_t ) - y ) h = 0 ; else h += y ; syoffset = - y * src -> stride ; y = 0 ; } if ( ( uint32_t ) x + w > dst -> width ) { if ( dst -> width < ( uint32_t ) x ) w = 0 ; else w = dst -> width - x ; } if ( ( uint32_t ) y + h > dst -> height ) { if ( dst -> height < ( uint32_t ) y ) h = 0 ; else h = dst -> height - y ; } # ifdef JBIG2_DEBUG jbig2_error ( ctx, JBIG2_SEVERITY_DEBUG, - 1, "compositing   %dx%d   at   (%d,   %d)   after   clipping", w, h, x, y ) ; # endif if ( ( w <= 0 ) || ( h <= 0 ) ) { # ifdef JBIG2_DEBUG jbig2_error ( ctx, JBIG2_SEVERITY_DEBUG, - 1, "zero   clipping   region" ) ; # endif return 0 ; } leftbyte = ( uint32_t ) x >> 3 ; dd = dst -> data + y * dst -> stride + leftbyte ; bytewidth = ( ( ( uint32_t ) x + w - 1

Fix:
<S2SV_ModStart> return 0 ; if ( ( UINT32_MAX - src -> width < ( x > 0? x : - x ) ) || ( UINT32_MAX - src -> height < ( y > 0? y : - y ) ) ) { # ifdef JBIG2_DEBUG jbig2_error ( ctx, JBIG2_SEVERITY_DEBUG, - 1, "overflow <S2SV_blank> in <S2SV_blank> compose_image" ) ; # endif return 0 ; }
Buggy code:
 int build_ntlmssp_auth_blob ( unsigned char * * pbuffer, u16 * buflen, struct cifs_ses * ses, const struct nls_table * nls_cp ) { int rc ; AUTHENTICATE_MESSAGE * sec_blob ; __u32 flags ; unsigned char * tmp ; rc = setup_ntlmv2_rsp ( ses, nls_cp ) ; if ( rc ) { cifs_dbg ( VFS, "Error   %d   during   NTLMSSP   authentication\\n", rc ) ; * buflen = 0 ; goto setup_ntlmv2_ret ; } * pbuffer = kmalloc ( size_of_ntlmssp_blob ( ses ), GFP_KERNEL ) ; sec_blob = ( AUTHENTICATE_MESSAGE * ) * pbuffer ; memcpy ( sec_blob -> Signature, NTLMSSP_SIGNATURE, 8 ) ; sec_blob -> MessageType = NtLmAuthenticate ; flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | <START_BUG> NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC ; <END_BUG>  if ( ses -> server -> sign ) { <START_BUG> flags |= NTLMSSP_NEGOTIATE_SIGN ; if (! ses -> server -> session_estab || ses -> ntlmssp -> sesskey_per_smbsess ) flags |= NTLMSSP_NEGOTIATE_KEY_XCH ; <END_BUG> }  tmp = * pbuffer + sizeof ( AUTHENTICATE_MESSAGE ) ; sec_blob -> NegotiateFlags = cpu_to_le32 ( flags ) ; sec_blob -> LmChallengeResponse. BufferOffset = cpu_to_le32 ( sizeof ( AUTHENTICATE_MESSAGE ) ) ; sec_blob -> LmChallengeResponse. Length = 0 ; sec_blob -> LmChallengeResponse. MaximumLength = 0 ; sec_blob -> NtChallengeResponse. BufferOffset = cpu_to_le32 ( tmp - * p

Fix:
<S2SV_ModStart> NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | NTLMSSP_NEGOTIATE_SEAL <S2SV_ModStart> -> sign ) <S2SV_ModEnd> flags |= NTLMSSP_NEGOTIATE_SIGN <S2SV_ModStart> |= NTLMSSP_NEGOTIATE_KEY_XCH ; <S2SV_ModEnd> tmp = *
Buggy code:
 int udpv6_recvmsg ( struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct sk_buff * skb ; unsigned int ulen, copied ; int peeked, off = 0 ; int err ; <START_BUG> int is_udplite = IS_UDPLITE ( sk ) ; <END_BUG> int is_udp4 ; bool slow ; if ( flags & MSG_ERRQUEUE ) return ipv6_recv_error ( sk, msg, len, addr_len ) ; if ( np -> rxpmtu && np -> rxopt. bits. rxpmtu ) return ipv6_recv_rxpmtu ( sk, msg, len, addr_len ) ; try_again : skb = __skb_recv_datagram ( sk, flags | ( noblock? MSG_DONTWAIT : 0 ), & peeked, & off, & err ) ; if (! skb ) goto out ; ulen = skb -> len - sizeof ( struct udphdr ) ; copied = len ; if ( copied > ulen ) copied = ulen ; else if ( copied < ulen ) msg -> msg_flags |= MSG_TRUNC ; is_udp4 = ( skb -> protocol == htons ( ETH_P_IP ) ) ; if ( copied < ulen || UDP_SKB_CB ( skb ) -> partial_cov ) {  if ( udp_lib_checksum_complete ( skb ) ) <START_BUG> goto csum_copy_err ; } <END_BUG> if ( skb_csum_unnecessary ( skb ) )  err = skb_copy_datagram_msg ( skb, sizeof ( struct udphdr ), msg, copied ) ; else { err = skb_copy_and_csum_datagram_msg ( skb, sizeof ( struct udphdr ), msg ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( unlikely ( err ) ) { trace_kfree_skb ( skb, udpv6_recvmsg ) ; if (! peeked ) { atomic_

Fix:
<S2SV_ModStart> ( sk ) ; bool checksum_valid = false <S2SV_ModStart> partial_cov ) { checksum_valid =! <S2SV_ModEnd> udp_lib_checksum_complete ( skb <S2SV_ModStart> ( skb ) ; if (! checksum_valid <S2SV_ModStart> } if ( checksum_valid ||
Buggy code:
 void setattr_copy ( struct inode * inode, const struct iattr * attr ) { unsigned int ia_valid = attr -> ia_valid ; if ( ia_valid & ATTR_UID ) inode -> i_uid = attr -> ia_uid ; if ( ia_valid & ATTR_GID ) inode -> i_gid = attr -> ia_gid ; if ( ia_valid & ATTR_ATIME ) inode -> i_atime = timespec_trunc ( attr -> ia_atime, inode -> i_sb -> s_time_gran ) ; if ( ia_valid & ATTR_MTIME ) inode -> i_mtime = timespec_trunc ( attr -> ia_mtime, inode -> i_sb -> s_time_gran ) ; if ( ia_valid & ATTR_CTIME ) inode -> i_ctime = timespec_trunc ( attr -> ia_ctime, inode -> i_sb -> s_time_gran ) ; if ( ia_valid & ATTR_MODE ) { umode_t mode = attr -> ia_mode ; if (! in_group_p ( inode -> i_gid ) && <START_BUG>! inode_capable ( inode, CAP_FSETID ) ) <END_BUG> mode &= ~ S_ISGID ; inode -> i_mode = mode ; } }

Fix:
<S2SV_ModStart> ) &&! capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode,
Buggy code:
 static int wrmsr_interception ( struct vcpu_svm * svm ) { struct msr_data msr ; u32 ecx = svm -> vcpu. arch. regs [ VCPU_REGS_RCX ] ; u64 data = ( svm -> vcpu. arch. regs [ VCPU_REGS_RAX ] & - 1u ) | ( ( u64 ) ( svm -> vcpu. arch. regs [ VCPU_REGS_RDX ] & - 1u ) << 32 ) ; msr. data = data ; msr. index = ecx ; msr. host_initiated = false ; svm -> next_rip = kvm_rip_read ( & svm -> vcpu ) + 2 ; <START_BUG> if ( svm_set_msr ( & svm -> vcpu, & msr ) ) { <END_BUG> trace_kvm_msr_write_ex ( ecx, data ) ; kvm_inject_gp ( & svm -> vcpu, 0 ) ; } else { trace_kvm_msr_write ( ecx, data ) ; skip_emulated_instruction ( & svm -> vcpu ) ; } return 1 ; }

Fix:
<S2SV_ModStart> ; if ( kvm_set_msr <S2SV_ModEnd> ( & svm
Buggy code:
 void isoclns_print ( netdissect_options * ndo, <START_BUG> const uint8_t * p, u_int length, u_int caplen ) <END_BUG> {  if ( caplen <= 1 ) { <START_BUG> ND_PRINT ( ( ndo, "|OSI" ) ) ; return ; } if ( ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "OSI   NLPID   %s   (0x%02x):   ", tok2str ( nlpid_values, "Unknown", * p ), * p ) ) ; switch ( * p ) { case NLPID_CLNP : if (! clnp_print ( ndo, p, length ) ) <END_BUG> print_unknown_data ( ndo, p, "\\n\\t", caplen ) ;  break ; case NLPID_ESIS : esis_print ( ndo, p, length ) ; return ; case NLPID_ISIS : if (! isis_print ( ndo, p, length ) ) <START_BUG> print_unknown_data ( ndo, p, "\\n\\t", caplen ) ; <END_BUG> break ; case NLPID_NULLNS : ND_PRINT ( ( ndo, "%slength:   %u", ndo -> ndo_eflag? "" : ",   ", length ) ) ; break ; case NLPID_Q933 : q933_print ( ndo, p + 1, length - 1 ) ; break ; case NLPID_IP : ip_print ( ndo, p + 1, length - 1 ) ; break ; case NLPID_IP6 : ip6_print ( ndo, p + 1, length - 1 ) ; break ; case NLPID_PPP : ppp_print ( ndo, p + 1, length - 1 ) ; break ; default : if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "OSI   NLPID   0x%02x   unknown", * p ) ) ; ND_PRINT ( ( ndo, "%slength:   %u", ndo -> ndo_eflag? "" : ",   ", length ) ) ;  if ( caplen > 1 ) <START_BUG> <END_BUG> print_

Fix:
<S2SV_ModStart>, u_int length <S2SV_ModEnd> ) { if <S2SV_ModStart> { if (! ND_TTEST ( * p ) <S2SV_ModEnd> ) { ND_PRINT <S2SV_ModStart>, "\\n\\t", length <S2SV_ModEnd> ) ; break <S2SV_ModStart>, "\\n\\t", length <S2SV_ModEnd> ) ; break <S2SV_ModStart> ; if ( length <S2SV_ModEnd> > 1 ) <S2SV_ModStart>, "\\n\\t", length <S2SV_ModEnd> ) ; break
Buggy code:
 static int growOpArray ( Vdbe * v, int nOp ) { VdbeOp * pNew ; Parse * p = v -> pParse ; # ifdef SQLITE_TEST_REALLOC_STRESS <START_BUG> int nNew = ( v -> nOpAlloc >= 512? v -> nOpAlloc * 2 : v -> nOpAlloc + nOp ) ; <END_BUG> # else  int nNew = ( v -> nOpAlloc? v -> nOpAlloc * 2 : ( int ) ( 1024 // sizeof ( Op ) ) ) ; <START_BUG> UNUSED_PARAMETER ( nOp ) ; # endif if ( nNew > p -> db -> aLimit [ SQLITE_LIMIT_VDBE_OP ] ) { sqlite3OomFault ( p -> db ) ; return SQLITE_NOMEM ; } assert ( nOp <= ( 1024 // sizeof ( Op ) ) ) ; assert ( nNew >= ( v -> nOpAlloc + nOp ) ) ; pNew = sqlite3DbRealloc ( p -> db, v -> aOp, nNew * sizeof ( Op ) ) ; if ( pNew ) { p -> szOpAlloc = sqlite3DbMallocSize ( p -> db, pNew ) ; v -> nOpAlloc = p -> szOpAlloc // sizeof ( Op ) ; v -> aOp = pNew ; } return ( pNew? SQLITE_OK : SQLITE_NOMEM_BKPT ) ; }<END_BUG>

Fix:
<S2SV_ModStart> # ifdef SQLITE_TEST_REALLOC_STRESS sqlite3_int64 <S2SV_ModEnd> nNew = ( <S2SV_ModStart> >= 512? 2 * ( sqlite3_int64 ) v -> nOpAlloc : ( sqlite3_int64 ) <S2SV_ModEnd> v -> nOpAlloc <S2SV_ModStart> ; # else sqlite3_int64 <S2SV_ModEnd> nNew = ( <S2SV_ModStart> -> nOpAlloc? 2 * ( sqlite3_int64 ) v -> nOpAlloc : ( sqlite3_int64 ) <S2SV_ModEnd> 1024 // sizeof <S2SV_ModStart> sizeof ( Op <S2SV_ModEnd> ) ) ;
Buggy code:
 static int uhid_write ( int fd, const struct uhid_event * ev ) { <START_BUG> ssize_t ret = write ( fd, ev, sizeof ( * ev ) ) ; <END_BUG> if ( ret < 0 ) { int rtn = - errno ; APPL_TRACE_ERROR ( "%s:   Cannot   write   to   uhid:%s", __FUNCTION__, strerror ( errno ) ) ; return rtn ; } else if ( ret!= ( ssize_t ) sizeof ( * ev ) ) { APPL_TRACE_ERROR ( "%s:   Wrong   size   written   to   uhid:   %zd  !=   %zu", __FUNCTION__, ret, sizeof ( * ev ) ) ; return - EFAULT ; } return 0 ; }

Fix:
<S2SV_ModStart> ssize_t ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> ( * ev )
Buggy code:
 static int jpeg_size ( unsigned char * data, unsigned int data_size, int * width, int * height ) { int i = 0 ; if ( i + 3 < data_size && data [ i ] == 0xFF && data [ i + 1 ] == 0xD8 && data [ i + 2 ] == 0xFF && data [ i + 3 ] == 0xE0 ) { i += 4 ; if ( i + 6 < data_size && data [ i + 2 ] == 'J' && data [ i + 3 ] == 'F' && data [ i + 4 ] == 'I' && data [ i + 5 ] == 'F' && data [ i + 6 ] == 0x00 ) { unsigned short block_length = data [ i ] * 256 + data [ i + 1 ] ; while ( i < data_size ) { i += block_length ; if ( ( i + 1 ) >= data_size ) return - 1 ; if ( data [ i ]!= 0xFF ) return - 1 ; if ( data [ i + 1 ] == 0xC0 ) { * height = data [ i + 5 ] * 256 + data [ i + 6 ] ; * width = data [ i + 7 ] * 256 + data [ i + 8 ] ; return 0 ; } i += 2 ; <START_BUG> block_length = data [ i ] * 256 + data [ i + 1 ] ; <END_BUG> } } } return - 1 ; }

Fix:
<S2SV_ModStart> += 2 ; if ( i + 1 < data_size )
Buggy code:
 static int read_part_of_packet ( AVFormatContext * s, int64_t * pts, int * len, int * strid, int read_packet ) { AVIOContext * pb = s -> pb ; PVAContext * pvactx = s -> priv_data ; int syncword, streamid, reserved, flags, length, pts_flag ; int64_t pva_pts = AV_NOPTS_VALUE, startpos ; int ret ; recover : startpos = avio_tell ( pb ) ; syncword = avio_rb16 ( pb ) ; streamid = avio_r8 ( pb ) ; avio_r8 ( pb ) ; reserved = avio_r8 ( pb ) ; flags = avio_r8 ( pb ) ; length = avio_rb16 ( pb ) ; pts_flag = flags & 0x10 ; if ( syncword!= PVA_MAGIC ) { pva_log ( s, AV_LOG_ERROR, "invalid   syncword\\n" ) ; return AVERROR ( EIO ) ; } if ( streamid!= PVA_VIDEO_PAYLOAD && streamid!= PVA_AUDIO_PAYLOAD ) { pva_log ( s, AV_LOG_ERROR, "invalid   streamid\\n" ) ; return AVERROR ( EIO ) ; } if ( reserved!= 0x55 ) { pva_log ( s, AV_LOG_WARNING, "expected   reserved   byte   to   be   0x55\\n" ) ; } if ( length > PVA_MAX_PAYLOAD_LENGTH ) { pva_log ( s, AV_LOG_ERROR, "invalid   payload   length   %u\\n", length ) ; return AVERROR ( EIO ) ; } if ( streamid == PVA_VIDEO_PAYLOAD && pts_flag ) { pva_pts = avio_rb32 ( pb ) ; length -= 4 ; } else if ( streamid == PVA_AUDIO_PAYLOAD ) { if (! pvactx -> continue_pes ) { int pes_signal, pes_header_data_length, pes_packet_length, pes_flags ; unsigned char pes_header_data

Fix:
<S2SV_ModStart> ; if ( avio_feof ( pb ) ) { return AVERROR_EOF ; } if (
Buggy code:
 int ParseWave64HeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t total_samples = 0, infilesize ; Wave64ChunkHeader chunk_header ; Wave64FileHeader filehdr ; WaveHeader WaveHeader ; uint32_t bcount ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & filehdr, fourcc, 4 ) ; if (! DoReadFile ( infile, ( ( char * ) & filehdr ) + 4, sizeof ( Wave64FileHeader ) - 4, & bcount ) || bcount!= sizeof ( Wave64FileHeader ) - 4 || memcmp ( filehdr. ckID, riff_guid, sizeof ( riff_guid ) ) || memcmp ( filehdr. formType, wave_guid, sizeof ( wave_guid ) ) ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & filehdr, sizeof ( filehdr ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackLittleEndianToNative ( & filehdr, Wave64ChunkHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && filehdr. ckSize && filehdr. ckSize + 1 && filehdr. ckSize!= infilesize ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } # endif while ( 1 ) { if (! DoReadFile ( infile, & chunk_header, sizeof ( Wave64ChunkHeader ), & bcount ) || bcount!= sizeof ( Wave64ChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO

Fix:
<S2SV_ModStart> ; char * buff ; if ( bytes_to_copy < 0 || bytes_to_copy > 4194304 ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.W64 <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; }
Buggy code:
 static ssize_t o2nm_node_ipv4_address_store ( struct config_item * item, const char * page, size_t count ) { struct o2nm_node * node = to_o2nm_node ( item ) ; <START_BUG> struct o2nm_cluster * cluster = to_o2nm_cluster_from_node ( node ) ; <END_BUG> int ret, i ; struct rb_node * * p, * parent ; unsigned int octets [ 4 ] ; __be32 ipv4_addr = 0 ; ret = sscanf ( page, "%3u.%3u.%3u.%3u", & octets [ 3 ], & octets [ 2 ], & octets [ 1 ], & octets [ 0 ] ) ; if ( ret!= 4 ) return - EINVAL ; for ( i = 0 ; i < ARRAY_SIZE ( octets ) ; i ++ ) { if ( octets [ i ] > 255 ) return - ERANGE ; be32_add_cpu ( & ipv4_addr, octets [ i ] << ( i * 8 ) ) ; }  ret = 0 ; <START_BUG> write_lock ( & cluster -> cl_nodes_lock ) ; if ( o2nm_node_ip_tree_lookup ( cluster, ipv4_addr, & p, & parent ) ) ret = - EEXIST ; else if ( test_and_set_bit ( O2NM_NODE_ATTR_ADDRESS, & node -> nd_set_attributes ) ) ret = - EBUSY ; else { rb_link_node ( & node -> nd_ip_node, parent, p ) ; rb_insert_color ( & node -> nd_ip_node, & cluster -> cl_node_ip_tree ) ; } write_unlock ( & cluster -> cl_nodes_lock ) ; <END_BUG> if ( ret )  return ret ; memcpy ( & node -> nd_ipv4_address, & ipv4_addr, sizeof ( ipv4_addr ) ) ; return count ; }

Fix:
<S2SV_ModStart> o2nm_cluster * cluster <S2SV_ModEnd> ; int ret <S2SV_ModStart> ) ; } o2nm_lock_subsystem ( ) ; cluster = to_o2nm_cluster_from_node ( node ) ; if (! cluster ) { o2nm_unlock_subsystem ( ) ; return - EINVAL ; } <S2SV_ModStart> cl_nodes_lock ) ; o2nm_unlock_subsystem ( ) ;
Buggy code:
 static void unix_copy_addr ( struct msghdr * msg, struct sock * sk ) { <START_BUG> struct unix_sock * u = unix_sk ( sk ) ; <END_BUG> msg -> msg_namelen = 0 ; if ( u -> addr ) { msg -> msg_namelen = u -> addr -> len ; memcpy ( msg -> msg_name, u -> addr -> name, u -> addr -> len ) ; } }

Fix:
<S2SV_ModStart> ( sk ) <S2SV_ModEnd> ; if (
Buggy code:
 static void parse_sec_attr_44 ( sc_file_t * file, const u8 * buf, size_t len ) { const int df_idx [ 8 ] = { SC_AC_OP_DELETE, SC_AC_OP_CREATE, SC_AC_OP_CREATE, SC_AC_OP_INVALIDATE, SC_AC_OP_REHABILITATE, SC_AC_OP_LOCK, SC_AC_OP_DELETE, - 1 } ; const int ef_idx [ 8 ] = { SC_AC_OP_READ, SC_AC_OP_UPDATE, SC_AC_OP_WRITE, SC_AC_OP_INVALIDATE, SC_AC_OP_REHABILITATE, - 1, SC_AC_OP_ERASE, - 1 } ; const int efi_idx [ 8 ] = { SC_AC_OP_READ, SC_AC_OP_ERASE, SC_AC_OP_UPDATE, SC_AC_OP_INVALIDATE, SC_AC_OP_REHABILITATE, - 1, SC_AC_OP_ERASE, - 1 } ; u8 bValue ; int i ; int iKeyRef = 0 ; int iMethod ; int iPinCount ; int iOffset = 0 ; int iOperation ; const int * p_idx ; while ( len > 1 ) { size_t iACLen = buf [ iOffset ] & 0x0F ; if ( iACLen > len ) break ; iMethod = SC_AC_NONE ; if ( buf [ iOffset ] & 0X80 ) { size_t iParmLen = 1 ; size_t iKeyLen = 0 ; if ( buf [ iOffset ] & 0x20 ) iKeyLen ++ ; if ( buf [ iOffset + 1 ] & 0x40 ) iParmLen ++ ; if ( buf [ iOffset + 1 ] & 0x20 ) iParmLen ++ ; if ( buf [ iOffset + 1 ] & 0x10 ) iParmLen ++ ; if ( buf [ iOffset + 1 ] & 0x08 ) iParmLen ++ ; if ( iKeyLen ) { int iSC ; if ( len < 1 + ( size_t ) iACLen ) break ; iSC = buf [ iOffset + iACLen ] ; switch ( ( iSC >> 5 )

Fix:
<S2SV_ModStart> iPinCount = iACLen > 0? iACLen - 1 : 0 <S2SV_ModEnd> ; if (
Buggy code:
 static void nfs4_close_done ( struct rpc_task * task, void * data ) { struct nfs4_closedata * calldata = data ; struct nfs4_state * state = calldata -> state ; struct nfs_server * server = NFS_SERVER ( calldata -> inode ) ; if ( RPC_ASSASSINATED ( task ) ) return ; switch ( task -> tk_status ) { case 0 : nfs_set_open_stateid ( state, & calldata -> res. stateid, 0 ) ; renew_lease ( server, calldata -> timestamp ) ; break ; case - NFS4ERR_STALE_STATEID : case - NFS4ERR_OLD_STATEID : case - NFS4ERR_BAD_STATEID : case - NFS4ERR_EXPIRED : <START_BUG> if ( calldata -> arg. open_flags == 0 ) <END_BUG> break ; default : if ( nfs4_async_handle_error ( task, server, state ) == - EAGAIN ) { rpc_restart_call ( task ) ; return ; } } nfs_refresh_inode ( calldata -> inode, calldata -> res. fattr ) ; }

Fix:
<S2SV_ModStart> -> arg. fmode <S2SV_ModEnd> == 0 )
Buggy code:
 static int jpc_dec_process_siz ( jpc_dec_t * dec, jpc_ms_t * ms ) { jpc_siz_t * siz = & ms -> parms. siz ; int compno ; int tileno ; jpc_dec_tile_t * tile ; jpc_dec_tcomp_t * tcomp ; int htileno ; int vtileno ; jpc_dec_cmpt_t * cmpt ; <START_BUG> dec -> xstart = siz -> xoff ; <END_BUG> dec -> ystart = siz -> yoff ; dec -> xend = siz -> width ; dec -> yend = siz -> height ; dec -> tilewidth = siz -> tilewidth ; dec -> tileheight = siz -> tileheight ; dec -> tilexoff = siz -> tilexoff ; dec -> tileyoff = siz -> tileyoff ; dec -> numcomps = siz -> numcomps ; if (! ( dec -> cp = jpc_dec_cp_create ( dec -> numcomps ) ) ) { return - 1 ; } if (! ( dec -> cmpts = jas_alloc2 ( dec -> numcomps, sizeof ( jpc_dec_cmpt_t ) ) ) ) { return - 1 ; } for ( compno = 0, cmpt = dec -> cmpts ; compno < dec -> numcomps ; ++ compno, ++ cmpt ) { cmpt -> prec = siz -> comps [ compno ]. prec ; cmpt -> sgnd = siz -> comps [ compno ]. sgnd ; cmpt -> hstep = siz -> comps [ compno ]. hsamp ; cmpt -> vstep = siz -> comps [ compno ]. vsamp ; cmpt -> width = JPC_CEILDIV ( dec -> xend, cmpt -> hstep ) - JPC_CEILDIV ( dec -> xstart, cmpt -> hstep ) ; cmpt -> height = JPC_CEILDIV ( dec -> yend, cmpt -> vstep ) - JPC_CEILDIV ( dec -> ystart, cmpt -> vstep ) ; cmpt -> hsubstep = 0 ; cmpt -> vsubstep = 0 ; } dec -> image = 0 ; dec -> numhtiles = JPC_CEIL

Fix:
<S2SV_ModStart> * cmpt ; size_t size ; <S2SV_ModStart> tileheight ) ; if (! jas_safe_size_mul ( <S2SV_ModEnd> dec -> numhtiles <S2SV_ModStart> dec -> numhtiles, <S2SV_ModEnd> dec -> numvtiles <S2SV_ModStart> dec -> numvtiles, & size <S2SV_ModEnd> ) ) { <S2SV_ModStart> 1 ; } dec -> numtiles = size ; JAS_DBGLOG ( 10, ( "numtiles <S2SV_blank> = <S2SV_blank> %d; <S2SV_blank> numhtiles <S2SV_blank> = <S2SV_blank> %d; <S2SV_blank> numvtiles <S2SV_blank> = <S2SV_blank> %d;\\n", dec -> numtiles, dec -> numhtiles, dec -> numvtiles ) ) ; if (! ( dec -> tiles = jas_alloc2 ( dec -> numtiles, sizeof ( jpc_dec_tile_t ) ) ) ) { return - 1 ; }
Buggy code:
 static const xmlChar * xmlParseNameComplex ( xmlParserCtxtPtr ctxt ) { int len = 0, l ; int c ; int count = 0 ; # ifdef DEBUG nbParseNameComplex ++ ; # endif GROW ; if ( ctxt -> instate == XML_PARSER_EOF ) return ( NULL ) ; c = CUR_CHAR ( l ) ; if ( ( ctxt -> options & XML_PARSE_OLD10 ) == 0 ) { if ( ( c ==' ') || ( c == '>' ) || ( c == '//' ) || (! ( ( ( c >= 'a' ) && ( c <= 'z' ) ) || ( ( c >= 'A' ) && ( c <= 'Z' ) ) || ( c == '_' ) || ( c == ':' ) || ( ( c >= 0xC0 ) && ( c <= 0xD6 ) ) || ( ( c >= 0xD8 ) && ( c <= 0xF6 ) ) || ( ( c >= 0xF8 ) && ( c <= 0x2FF ) ) || ( ( c >= 0x370 ) && ( c <= 0x37D ) ) || ( ( c >= 0x37F ) && ( c <= 0x1FFF ) ) || ( ( c >= 0x200C ) && ( c <= 0x200D ) ) || ( ( c >= 0x2070 ) && ( c <= 0x218F ) ) || ( ( c >= 0x2C00 ) && ( c <= 0x2FEF ) ) || ( ( c >= 0x3001 ) && ( c <= 0xD7FF ) ) || ( ( c >= 0xF900 ) && ( c <= 0xFDCF ) ) || ( ( c >= 0xFDF0 ) && ( c <= 0xFFFD ) ) || ( ( c >= 0x10000 ) && ( c <= 0xEFFFF ) ) ) ) ) { return ( NULL ) ; } len += l ; NEXTL ( l ) ; c = CUR_CHAR ( l ) ; while ( ( c!=' ') && ( c!= '>' ) && ( c!= '//' ) && ( ( ( c >= 'a' ) && ( c <= 'z' ) ) || ( ( c >= 'A' ) && ( c <= 'Z' ) ) || ( ( c >= '0' ) && ( c <= '9' ) ) ||

Fix:
<S2SV_ModStart> l ) ; <S2SV_ModEnd> } } if <S2SV_ModStart> XML_ERR_NAME_TOO_LONG, "Name" ) ; return ( NULL ) ; } if ( ctxt -> input -> cur - ctxt -> input -> base < len ) { xmlFatalErr ( ctxt, XML_ERR_INTERNAL_ERROR, "unexpected <S2SV_blank> change <S2SV_blank> of <S2SV_blank> input <S2SV_blank> buffer"
Buggy code:
 int fpm_unix_resolve_socket_premissions ( struct fpm_worker_pool_s * wp ) { struct fpm_worker_pool_config_s * c = wp -> config ; wp -> socket_uid = - 1 ; wp -> socket_gid = - 1 ; <START_BUG> wp -> socket_mode = 0666 ; <END_BUG> if (! c ) { return 0 ; } if ( c -> listen_owner && * c -> listen_owner ) { struct passwd * pwd ; pwd = getpwnam ( c -> listen_owner ) ; if (! pwd ) { zlog ( ZLOG_SYSERROR, "[pool   %s]   cannot   get   uid   for   user   \'%s\'", wp -> config -> name, c -> listen_owner ) ; return - 1 ; } wp -> socket_uid = pwd -> pw_uid ; wp -> socket_gid = pwd -> pw_gid ; } if ( c -> listen_group && * c -> listen_group ) { struct group * grp ; grp = getgrnam ( c -> listen_group ) ; if (! grp ) { zlog ( ZLOG_SYSERROR, "[pool   %s]   cannot   get   gid   for   group   \'%s\'", wp -> config -> name, c -> listen_group ) ; return - 1 ; } wp -> socket_gid = grp -> gr_gid ; } if ( c -> listen_mode && * c -> listen_mode ) { wp -> socket_mode = strtoul ( c -> listen_mode, 0, 8 ) ; } return 0 ; }

Fix:
<S2SV_ModStart> -> socket_mode = 0660 <S2SV_ModEnd> ; if (
Buggy code:
 int jas_memdump ( FILE * out, void * data, size_t len ) { size_t i ; size_t j ; <START_BUG> uchar * dp ; <END_BUG> dp = data ; for ( i = 0 ; i < len ; i += 16 ) { fprintf ( out, "%04zx:", i ) ; for ( j = 0 ; j < 16 ; ++ j ) { if ( i + j < len ) { fprintf ( out, "   %02x", dp [ i + j ] ) ; } } fprintf ( out, "\\n" ) ; } return 0 ; }

Fix:
<S2SV_ModStart> size_t j ; jas_uchar <S2SV_ModEnd> * dp ;
Buggy code:
 int sctp_rcv ( struct sk_buff * skb ) { struct sock * sk ; struct sctp_association * asoc ; struct sctp_endpoint * ep = NULL ; struct sctp_ep_common * rcvr ; struct sctp_transport * transport = NULL ; struct sctp_chunk * chunk ; struct sctphdr * sh ; union sctp_addr src ; union sctp_addr dest ; int family ; struct sctp_af * af ; if ( skb -> pkt_type!= PACKET_HOST ) goto discard_it ; SCTP_INC_STATS_BH ( SCTP_MIB_INSCTPPACKS ) ; if ( skb_linearize ( skb ) ) goto discard_it ; sh = sctp_hdr ( skb ) ; __skb_pull ( skb, skb_transport_offset ( skb ) ) ; if ( skb -> len < sizeof ( struct sctphdr ) ) goto discard_it ; if (! skb_csum_unnecessary ( skb ) && sctp_rcv_checksum ( skb ) < 0 ) goto discard_it ; skb_pull ( skb, sizeof ( struct sctphdr ) ) ; if ( skb -> len < sizeof ( struct sctp_chunkhdr ) ) goto discard_it ; family = ipver2af ( ip_hdr ( skb ) -> version ) ; af = sctp_get_af_specific ( family ) ; if ( unlikely (! af ) ) goto discard_it ; af -> from_skb ( & src, skb, 1 ) ; af -> from_skb ( & dest, skb, 0 ) ; if (! af -> addr_valid ( & src, NULL, skb ) ||! af -> addr_valid ( & dest, NULL, skb ) ) goto discard_it ; asoc = __sctp_rcv_lookup ( skb, & src, & dest, & transport ) ; if (! asoc ) ep = __sctp_rcv_lookup_endpoint ( & dest ) ; rcvr = asoc? & asoc -> base : & ep -> base ; sk = rcvr -> sk ; if ( sk -> sk_bound_dev_if && ( sk -> sk_bound_dev_if!= af ->

Fix:
<S2SV_ModStart> ; if ( sk!= rcvr -> sk ) { sctp_bh_unlock_sock ( sk ) ; sk = rcvr -> sk ; sctp_bh_lock_sock ( sk ) ; } if (
Buggy code:
 <START_BUG> static int udf_translate_to_linux ( uint8_t * newName, uint8_t * udfName, <END_BUG>  int udfLen, uint8_t * fidName, <START_BUG> int fidNameLen ) { int index, newIndex = 0, needsCRC = 0 ; int extIndex = 0, newExtIndex = 0, hasExt = 0 ; unsigned short valueCRC ; uint8_t curr ; if ( udfName [ 0 ] == '.' && ( udfLen == 1 || ( udfLen == 2 && udfName [ 1 ] == '.' ) ) ) { needsCRC = 1 ; newIndex = udfLen ; memcpy ( newName, udfName, udfLen ) ; } else { for ( index = 0 ; index < udfLen ; index ++ ) { curr = udfName [ index ] ; if ( curr == '//' || curr == 0 ) { needsCRC = 1 ; curr = ILLEGAL_CHAR_MARK ; while ( index + 1 < udfLen && ( udfName [ index + 1 ] == '//' || udfName [ index + 1 ] == 0 ) ) index ++ ; } if ( curr == EXT_MARK && ( udfLen - index - 1 ) <= EXT_SIZE ) { if ( udfLen == index + 1 ) hasExt = 0 ; else { hasExt = 1 ; extIndex = index ; newExtIndex = newIndex ; } } <END_BUG> if ( newIndex < 256 )  newName [ newIndex ++ ] = curr ; else needsCRC = 1 ; } } if ( needsCRC ) { uint8_t ext [ EXT_SIZE ] ; int localExtIndex = 0 ; if ( hasExt ) { int maxFilenameLen ; for ( index = 0 ; index < EXT_SIZE && extIndex + index + 1 < udfLen ; index ++ ) { curr = udfName [ extIndex + index + 1 ] ; if ( curr == '//' || curr == 0 ) { needsCRC = 1 ; curr = ILLEGAL_CHAR_MARK ; while ( extIndex + index + 2 < udfLen && ( index + 1 < EXT_SIZE && ( udfName [ extIndex + index + 2 ] == '//' || udfName [ extIndex + index + 2 ] == 0 ) ) ) index ++ ; } ext [ localExtIndex ++ ] = curr ; } <START_BUG> maxFilenameLen = 250 - localExtIndex ; <END_BUG> if ( newIndex > maxFilenameLen ) newIndex = maxFilenameLen ; else newIndex

Fix:
<S2SV_ModStart> * newName, int newLen, <S2SV_ModStart> * udfName, int udfLen, <S2SV_ModEnd> uint8_t * fidName <S2SV_ModStart> ( newIndex < newLen <S2SV_ModEnd> ) newName [ <S2SV_ModStart> } maxFilenameLen = newLen - CRC_LEN <S2SV_ModEnd> - localExtIndex ; <S2SV_ModStart> ( newIndex > newLen - CRC_LEN ) newIndex = newLen - CRC_LEN <S2SV_ModEnd> ; newName [
Buggy code:
 static void ttm_put_pages ( struct page * * pages, unsigned npages, int flags, enum ttm_caching_state cstate ) { struct ttm_page_pool * pool = ttm_get_pool ( flags, false, cstate ) ; # ifdef CONFIG_TRANSPARENT_HUGEPAGE struct ttm_page_pool * huge = ttm_get_pool ( flags, true, cstate ) ; # endif unsigned long irq_flags ; unsigned i ; if ( pool == NULL ) { i = 0 ; while ( i < npages ) { # ifdef CONFIG_TRANSPARENT_HUGEPAGE struct page * p = pages [ i ] ; # endif unsigned order = 0, j ; if (! pages [ i ] ) { ++ i ; continue ; } # ifdef CONFIG_TRANSPARENT_HUGEPAGE if (! ( flags & TTM_PAGE_FLAG_DMA32 ) && ( npages - i ) >= HPAGE_PMD_NR ) { for ( j = 1 ; j < HPAGE_PMD_NR ; ++ j ) <START_BUG> if ( p ++!= pages [ i + j ] ) <END_BUG> break ; if ( j == HPAGE_PMD_NR ) order = HPAGE_PMD_ORDER ; } # endif if ( page_count ( pages [ i ] )!= 1 ) pr_err ( "Erroneous   page   count.   Leaking   pages.\\n" ) ; __free_pages ( pages [ i ], order ) ; j = 1 << order ; while ( j ) { pages [ i ++ ] = NULL ; -- j ; } } return ; } i = 0 ; # ifdef CONFIG_TRANSPARENT_HUGEPAGE if ( huge ) { unsigned max_size, n2free ; spin_lock_irqsave ( & huge -> lock, irq_flags ) ; while ( ( npages - i ) >= HPAGE_PMD_NR ) { struct page * p = pages [ i ] ; unsigned j ; if (! p ) break ; for ( j = 1 ; j < HPAGE_PMD_NR ; ++ j )  if ( p ++!= pages [ i + j ] ) <START_BUG> break ; if ( j!= HPAGE_PMD_N<END_BUG>

Fix:
<S2SV_ModStart> ) if ( ++ p <S2SV_ModEnd>!= pages [ <S2SV_ModStart> ) if ( ++ p <S2SV_ModEnd>!= pages [
Buggy code:
 char * cJSON_PrintUnformatted ( cJSON * item ) { <START_BUG> return print_value ( item, 0, 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> 0, 0, 0
Buggy code:
 static void rose_loopback_timer ( unsigned long param ) { struct sk_buff * skb ; struct net_device * dev ; rose_address * dest ; struct sock * sk ; unsigned short frametype ; unsigned int lci_i, lci_o ; <START_BUG> while ( ( skb = skb_dequeue ( & loopback_queue ) )!= NULL ) { <END_BUG> lci_i = ( ( skb -> data [ 0 ] << 8 ) & 0xF00 ) + ( ( skb -> data [ 1 ] << 0 ) & 0x0FF ) ; frametype = skb -> data [ 2 ] ;  dest = ( rose_address * ) ( skb -> data + 4 ) ; <START_BUG> lci_o = ROSE_DEFAULT_MAXVC + 1 - lci_i ; skb_reset_transport_header ( skb ) ; sk = rose_find_socket ( lci_o, rose_loopback_neigh ) ; if ( sk ) { if ( rose_process_rx_frame ( sk, skb ) == 0 ) kfree_skb ( skb ) ; continue ; } if ( frametype == ROSE_CALL_REQUEST ) { if ( ( dev = rose_dev_get ( dest ) )!= NULL ) { if ( rose_rx_call_request ( skb, dev, rose_loopback_neigh, lci_o ) == 0 ) kfree_skb ( skb ) ; } else { kfree_skb ( skb ) ; } } else { kfree_skb ( skb ) ; } } }<END_BUG>

Fix:
<S2SV_ModStart> NULL ) { if ( skb -> len < ROSE_MIN_LEN ) { kfree_skb ( skb ) ; continue ; } <S2SV_ModStart> 2 ] ; if ( frametype == ROSE_CALL_REQUEST && ( skb -> len <= ROSE_CALL_REQ_FACILITIES_OFF || skb -> data [ ROSE_CALL_REQ_ADDR_LEN_OFF ]!= ROSE_CALL_REQ_ADDR_LEN_VAL ) ) { kfree_skb ( skb ) ; continue ; } <S2SV_ModStart> -> data + ROSE_CALL_REQ_DEST_ADDR_OFF <S2SV_ModEnd> ) ; lci_o
Buggy code:
 static int rc_pick_q_and_bounds_two_pass ( const VP9_COMP * cpi, int * bottom_index, int * top_index ) { const VP9_COMMON * const cm = & cpi -> common ; const RATE_CONTROL * const rc = & cpi -> rc ; <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG>  int active_best_quality ; <START_BUG> int active_worst_quality = cpi -> twopass. active_worst_quality ; int q ; <END_BUG> if ( frame_is_intra_only ( cm ) ) {  # if! CONFIG_MULTIPLE_ARF <START_BUG> if ( rc -> this_key_frame_forced ) { <END_BUG>  int qindex = rc -> last_boosted_qindex ; <START_BUG> <END_BUG> double last_boosted_q = vp9_convert_qindex_to_q ( qindex ) ;  int delta_qindex = vp9_compute_qdelta ( rc, last_boosted_q, <START_BUG> last_boosted_q * 0.75 ) ; <END_BUG>  active_best_quality = MAX ( qindex + delta_qindex, rc -> best_quality ) ; <START_BUG> } else { double q_adj_factor = 1.0 ; double q_val ; <END_BUG> active_best_quality = get_active_quality ( active_worst_quality,  rc -> kf_boost, kf_low, kf_high, kf_low_motion_minq, kf_high_motion_minq ) ; if ( ( cm -> width * cm -> height ) <= ( 352 * 288 ) ) { q_adj_factor -= 0.25 ; } q_adj_factor += 0.05 - ( 0.001 * ( double ) cpi -> twopass. kf_zeromotion_pct ) ; <START_BUG> q_val = vp9_convert_qindex_to_q ( active_best_quality ) ; <END_BUG> active_best_quality += vp9_compute_qdelta ( rc, q_val,  q_val * q_adj_factor ) ; <START_BUG> } # else double current_q ; current_q = vp9_convert_qindex_to_q ( active_worst_quality<END_BUG>

Fix:
<S2SV_ModStart> rc ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> -> oxcf ; const GF_GROUP * gf_group = & cpi -> twopass. gf_group ; const int cq_level = get_active_cq_level ( rc, oxcf ) ; int active_best_quality ; int active_worst_quality = cpi -> twopass. active_worst_quality ; int q ; int * inter_minq ; ASSIGN_MINQ_TABLE ( cm -> bit_depth, inter_minq ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( cm ) || vp9_is_upper_layer_key_frame ( cpi ) ) { <S2SV_ModEnd> if ( rc <S2SV_ModStart> this_key_frame_forced ) { double last_boosted_q ; int delta_qindex ; int qindex ; if ( cpi -> twopass. last_kfgroup_zeromotion_pct >= STATIC_MOTION_THRESH ) { qindex = MIN ( rc -> last_kf_qindex, <S2SV_ModEnd> rc -> last_boosted_qindex <S2SV_ModStart> rc -> last_boosted_qindex ) ; active_
Buggy code:
 int SMB2_negotiate ( const unsigned int xid, struct cifs_ses * ses ) { struct smb_rqst rqst ; struct smb2_negotiate_req * req ; struct smb2_negotiate_rsp * rsp ; struct kvec iov [ 1 ] ; struct kvec rsp_iov ; int rc = 0 ; int resp_buftype ; struct TCP_Server_Info * server = ses -> server ; int blob_offset, blob_length ; char * security_blob ; int flags = CIFS_NEG_OP ; unsigned int total_len ; cifs_dbg ( FYI, "Negotiate   protocol\\n" ) ; if (! server ) { WARN ( 1, "%s:   server   is   NULL!\\n", __func__ ) ; return - EIO ; } rc = smb2_plain_req_init ( SMB2_NEGOTIATE, NULL, ( void * * ) & req, & total_len ) ; if ( rc ) return rc ; req -> sync_hdr. SessionId = 0 ; memset ( server -> preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE ) ; memset ( ses -> preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE ) ; if ( strcmp ( ses -> server -> vals -> version_string, SMB3ANY_VERSION_STRING ) == 0 ) { req -> Dialects [ 0 ] = cpu_to_le16 ( SMB30_PROT_ID ) ; req -> Dialects [ 1 ] = cpu_to_le16 ( SMB302_PROT_ID ) ; req -> DialectCount = cpu_to_le16 ( 2 ) ; total_len += 4 ; } else if ( strcmp ( ses -> server -> vals -> version_string, SMBDEFAULT_VERSION_STRING ) == 0 ) { req -> Dialects [ 0 ] = cpu_to_le16 ( SMB21_PROT_ID ) ; req -> Dialects [ 1 ] = cpu_to_le16 ( SMB30_PROT_ID ) ; req -> Dialects [ 2 ] = cpu_to_le16 ( SMB302_PROT_ID ) ; req -> Dialects [ 3 ] = cpu_to_le16 ( SMB311

Fix:
<S2SV_ModStart> & smb21_operations ; ses -> server -> vals = & smb21_values ; <S2SV_ModStart> SMB311_PROT_ID ) ) { <S2SV_ModStart> & smb311_operations ; ses -> server -> vals = & smb311_values ; }
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; PixelPacket * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; size_t Unknown6 ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; quantum_info = ( QuantumInfo * ) NULL ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = ( ImageInfo * ) NULL ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image

Fix:
<S2SV_ModStart> 6 ) ) { MATLAB_KO : clone_info = DestroyImageInfo ( clone_info ) ; <S2SV_ModEnd> ThrowReaderException ( CorruptImageError <S2SV_ModStart> "ImproperImageHeader" ) ; }
Buggy code:
 static int http_read_stream ( URLContext * h, uint8_t * buf, int size ) { HTTPContext * s = h -> priv_data ; int err, new_location, read_ret ; int64_t seek_ret ; if (! s -> hd ) return AVERROR_EOF ; if ( s -> end_chunked_post &&! s -> end_header ) { err = http_read_header ( h, & new_location ) ; if ( err < 0 ) return err ; } <START_BUG> if ( s -> chunksize >= 0 ) { <END_BUG> if (! s -> chunksize ) { char line [ 32 ] ; do { if ( ( err = http_get_line ( s, line, sizeof ( line ) ) ) < 0 ) return err ; } while (! * line ) ;  s -> chunksize = strtoll ( line, NULL, 16 ) ; <START_BUG> <END_BUG> av_log ( NULL, AV_LOG_TRACE, "Chunked   encoding   data   size:   %" PRId64 "\'\\n",  s -> chunksize ) ; if (! s -> chunksize ) <START_BUG> return 0 ; <END_BUG> } size = FFMIN ( size, s -> chunksize ) ; } # if CONFIG_ZLIB if ( s -> compressed ) return http_buf_read_compressed ( h, buf, size ) ; # endif read_ret = http_buf_read ( h, buf, size ) ; if ( ( read_ret < 0 && s -> reconnect && (! h -> is_streamed || s -> reconnect_streamed ) && s -> filesize > 0 && s -> off < s -> filesize ) || ( read_ret == 0 && s -> reconnect_at_eof && (! h -> is_streamed || s -> reconnect_streamed ) ) ) {  int64_t target = h -> is_streamed? 0 : s -> off ; <START_BUG> if ( s -> reconnect_delay > s -> reconnect_delay_max ) return AVERROR ( EIO ) ; <END_BUG> av_log ( h, AV_LOG_INFO, "Will   reconnect   at   %" PRId64 "   error=%s.\\n", s -> off, av_err2str ( read_ret ) ) ;  av_usleep ( 1000U * 1000 * s -> reconnect_delay ) ; s -> reconnect_delay = 1 +

Fix:
<S2SV_ModStart> s -> chunksize!= UINT64_MAX <S2SV_ModEnd> ) { if <S2SV_ModStart> -> chunksize = strtoull <S2SV_ModEnd> ( line, <S2SV_ModStart> ; av_log ( h <S2SV_ModEnd>, AV_LOG_TRACE, <S2SV_ModStart> AV_LOG_TRACE, "Chunked <S2SV_blank> encoding <S2SV_blank> data <S2SV_blank> size: <S2SV_blank> %" PRIu64 <S2SV_ModEnd> "\'\\n", s <S2SV_ModStart> return 0 ; else if ( s -> chunksize == UINT64_MAX ) { av_log ( h, AV_LOG_ERROR, "Invalid <S2SV_blank> chunk <S2SV_blank> size <S2SV_blank> %" PRIu64 "\\n", s -> chunksize ) ; return AVERROR ( EINVAL ) ; } <S2SV_ModStart> ) ) { uint64_t <S2SV_ModEnd> target = h <S2SV_ModStart> AV_LOG_INFO, "Will <S2SV_blank> reconnect <S2SV_blank> at <S2SV_blank> %" PRIu64 <S2SV_ModEnd> " <S2SV_blank> error=%s.\\n", s <S2SV_ModStart> AV_LOG_ERROR, "Failed <S2SV_blank> to <S2SV_blank> reconnect <S2SV_blank> at <S2SV_blank> %" PRIu64 <S2SV_ModEnd> ".\\n", target
Buggy code:
 <START_BUG> void ntlm_print_message_fields ( NTLM_MESSAGE_FIELDS * fields, const char * name ) <END_BUG> { WLog_DBG ( TAG, "%s   (Len:   %" PRIu16 "   MaxLen:   %" PRIu16 "   BufferOffset:   %" PRIu32 ")", name, fields -> Len, fields -> MaxLen, fields -> BufferOffset ) ; if ( fields -> Len > 0 ) winpr_HexDump ( TAG, WLOG_DEBUG, fields -> Buffer, fields -> Len ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 kadm5_ret_t kadm5_create_principal_3 ( void * server_handle, kadm5_principal_ent_t entry, long mask, int n_ks_tuple, krb5_key_salt_tuple * ks_tuple, char * password ) { krb5_db_entry * kdb ; osa_princ_ent_rec adb ; kadm5_policy_ent_rec polent ; krb5_boolean have_polent = FALSE ; krb5_timestamp now ; krb5_tl_data * tl_data_tail ; unsigned int ret ; kadm5_server_handle_t handle = server_handle ; krb5_keyblock * act_mkey ; krb5_kvno act_kvno ; int new_n_ks_tuple = 0 ; krb5_key_salt_tuple * new_ks_tuple = NULL ; CHECK_HANDLE ( server_handle ) ; krb5_clear_error_message ( handle -> context ) ; check_1_6_dummy ( entry, mask, n_ks_tuple, ks_tuple, & password ) ; if ( entry == NULL ) return EINVAL ; if (! ( mask & KADM5_PRINCIPAL ) || ( mask & KADM5_MOD_NAME ) || ( mask & KADM5_MOD_TIME ) || ( mask & KADM5_LAST_PWD_CHANGE ) || ( mask & KADM5_MKVNO ) || ( mask & KADM5_AUX_ATTRIBUTES ) || ( mask & KADM5_LAST_SUCCESS ) || ( mask & KADM5_LAST_FAILED ) || ( mask & KADM5_FAIL_AUTH_COUNT ) ) return KADM5_BAD_MASK ; if ( ( mask & KADM5_KEY_DATA ) && entry -> n_key_data!= 0 ) return KADM5_BAD_MASK ; if ( ( mask & KADM5_POLICY ) && entry -> policy == NULL ) return KADM5_BAD_MASK ; if ( ( mask & KADM5_POLICY ) && ( mask & KADM5_POLICY_CLR ) ) return KADM5_BAD_MASK ; if ( ( mask & ~

Fix:
<S2SV_ModStart> return KADM5_BAD_MASK ; if ( mask & KADM5_TL_DATA ) { for ( tl_data_tail = entry -> tl_data ; tl_data_tail!= NULL ; tl_data_tail = tl_data_tail -> tl_data_next ) { if ( tl_data_tail -> tl_data_type < 256 ) return KADM5_BAD_TL_TYPE ; } }
Buggy code:
 void vp9_reset_segment_features ( struct segmentation * seg ) { seg -> enabled = 0 ; seg -> update_map = 0 ; seg -> update_data = 0 ; <START_BUG> vpx_memset ( seg -> tree_probs, 255, sizeof ( seg -> tree_probs ) ) ; <END_BUG> vp9_clearall_segfeatures ( seg ) ; }

Fix:
<S2SV_ModStart> = 0 ; memset <S2SV_ModEnd> ( seg ->
Buggy code:
 static void controloptions ( lua_State * L, int opt, const char * * fmt, Header * h ) { switch ( opt ) { case' ': return ; case '>' : h -> endian = BIG ; return ; case '<' : h -> endian = LITTLE ; return ; case '!' : { <START_BUG> int a = getnum ( L, fmt, MAXALIGN ) ; <END_BUG> if (! isp2 ( a ) ) luaL_error ( L, "alignment   %d   is   not   a   power   of   2", a ) ; h -> align = a ; return ; } default : { const char * msg = lua_pushfstring ( L, "invalid   format   option   \'%c\'", opt ) ; luaL_argerror ( L, 1, msg ) ; } } }

Fix:
<S2SV_ModStart> = getnum ( <S2SV_ModEnd> fmt, MAXALIGN
Buggy code:
 static struct page * follow_page_pte ( struct vm_area_struct * vma, unsigned long address, pmd_t * pmd, unsigned int flags, struct dev_pagemap * * pgmap ) { struct mm_struct * mm = vma -> vm_mm ; struct page * page ; spinlock_t * ptl ; pte_t * ptep, pte ; retry : if ( unlikely ( pmd_bad ( * pmd ) ) ) return no_page_table ( vma, flags ) ; ptep = pte_offset_map_lock ( mm, pmd, address, & ptl ) ; pte = * ptep ; if (! pte_present ( pte ) ) { swp_entry_t entry ; if ( likely (! ( flags & FOLL_MIGRATION ) ) ) goto no_page ; if ( pte_none ( pte ) ) goto no_page ; entry = pte_to_swp_entry ( pte ) ; if (! is_migration_entry ( entry ) ) goto no_page ; pte_unmap_unlock ( ptep, ptl ) ; migration_entry_wait ( mm, pmd, address ) ; goto retry ; } if ( ( flags & FOLL_NUMA ) && pte_protnone ( pte ) ) goto no_page ; if ( ( flags & FOLL_WRITE ) &&! can_follow_write_pte ( pte, flags ) ) { pte_unmap_unlock ( ptep, ptl ) ; return NULL ; } page = vm_normal_page ( vma, address, pte ) ; if (! page && pte_devmap ( pte ) && ( flags & FOLL_GET ) ) { * pgmap = get_dev_pagemap ( pte_pfn ( pte ), * pgmap ) ; if ( * pgmap ) page = pte_page ( pte ) ; else goto no_page ; } else if ( unlikely (! page ) ) { if ( flags & FOLL_DUMP ) { page = ERR_PTR ( - EFAULT ) ; goto out ; } if ( is_zero_pfn ( pte_pfn ( pte ) ) ) { page = p

Fix:
<S2SV_ModStart> & FOLL_GET ) { if ( unlikely (! try_get_page ( page ) ) ) { page = ERR_PTR ( - ENOMEM ) ; goto out ; } } <S2SV_ModEnd> if ( flags
Buggy code:
 int perf_config ( config_fn_t fn, void * data ) { <START_BUG> int ret = 0, found = 0 ; <END_BUG> char * repo_config = NULL ; const char * home = NULL ; if ( config_exclusive_filename ) return perf_config_from_file ( fn, config_exclusive_filename, data ) ; if ( perf_config_system ( ) &&! access ( perf_etc_perfconfig ( ), R_OK ) ) { ret += perf_config_from_file ( fn, perf_etc_perfconfig ( ), data ) ; found += 1 ; } home = getenv ( "HOME" ) ; if ( perf_config_global ( ) && home ) { char * user_config = strdup ( mkpath ( "%s//.perfconfig", home ) ) ; if (! access ( user_config, R_OK ) ) { ret += perf_config_from_file ( fn, user_config, data ) ; found += 1 ; } free ( user_config ) ; }  repo_config = perf_pathdup ( "config" ) ; <START_BUG> if (! access ( repo_config, R_OK ) ) { ret += perf_config_from_file ( fn, repo_config, data ) ; found += 1 ; } free ( repo_config ) ; if ( found == 0 ) return - 1 ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> found = 0 <S2SV_ModEnd> ; const char <S2SV_ModStart> ) ; } <S2SV_ModEnd> if ( found
Buggy code:
 void big_key_revoke ( struct key * key ) { struct path * path = ( struct path * ) & key -> payload. data [ big_key_path ] ; key_payload_reserve ( key, 0 ) ; <START_BUG> if ( key_is_instantiated ( key ) && <END_BUG> ( size_t ) key -> payload. data [ big_key_len ] > BIG_KEY_FILE_THRESHOLD ) vfs_truncate ( path, 0 ) ; }

Fix:
<S2SV_ModStart> ; if ( key_is_positive <S2SV_ModEnd> ( key )
Buggy code:
 static int pcd_detect ( void ) { char id [ 18 ] ; int k, unit ; struct pcd_unit * cd ; printk ( "%s:   %s   version   %s,   major   %d,   nice   %d\\n", name, name, PCD_VERSION, major, nice ) ; par_drv = pi_register_driver ( name ) ; if (! par_drv ) { pr_err ( "failed   to   register   %s   driver\\n", name ) ; return - 1 ; } k = 0 ; if ( pcd_drive_count == 0 ) { cd = pcd ; if ( pi_init ( cd -> pi, 1, - 1, - 1, - 1, - 1, - 1, pcd_buffer, PI_PCD, verbose, cd -> name ) ) { if (! pcd_probe ( cd, - 1, id ) && cd -> disk ) { cd -> present = 1 ; k ++ ; } else pi_release ( cd -> pi ) ; } } else { for ( unit = 0, cd = pcd ; unit < PCD_UNITS ; unit ++, cd ++ ) { int * conf = * drives [ unit ] ; if (! conf [ D_PRT ] ) continue ; if (! pi_init ( cd -> pi, 0, conf [ D_PRT ], conf [ D_MOD ], conf [ D_UNI ], conf [ D_PRO ], conf [ D_DLY ], pcd_buffer, PI_PCD, verbose, cd -> name ) ) continue ; if (! pcd_probe ( cd, conf [ D_SLV ], id ) && cd -> disk ) { cd -> present = 1 ; k ++ ; } else pi_release ( cd -> pi ) ; } } if ( k ) return 0 ; printk ( "%s:   No   CD-ROM   drive   found\\n", name ) ; for ( unit = 0, cd = pcd ; unit < PCD_UNITS ; unit ++, cd ++ ) { <START_BUG> blk_cleanup_queue ( cd -> disk -> queue ) ; <END_BUG> cd -> disk -> queue = NULL ; blk_mq_free_tag_set ( & cd -> tag_set ) ; put_disk ( cd -> disk

Fix:
<S2SV_ModStart> ++ ) { if (! cd -> disk ) continue ;