nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int rename_in_ns ( int pid, char * oldname, char * * newnamep ) { <START_BUG> int fd = - 1, ofd = - 1, ret, ifindex = - 1 ; <END_BUG> bool grab_newname = false ; ofd = lxc_preserve_ns ( getpid ( ), "net" ) ; if ( ofd < 0 ) {  fprintf ( stderr, "Failed   opening   network   namespace   path   for   \'%d\'.", getpid ( ) ) ; <START_BUG> <END_BUG> return - 1 ;  } fd = lxc_preserve_ns ( pid, "net" ) ; if ( fd < 0 ) { <START_BUG> fprintf ( stderr, "Failed   opening   network   namespace   path   for   \'%d\'.", pid ) ; <END_BUG>  return - 1 ; <START_BUG> } <END_BUG> if ( setns ( fd, 0 ) < 0 ) {  fprintf ( stderr, "setns   to   container   network   namespace\\n" ) ; goto out_err ; } <START_BUG> close ( fd ) ; fd = - 1 ; <END_BUG> if (! * newnamep ) { grab_newname = true ; * newnamep = VETH_DEF_NAME ;  if (! ( ifindex = if_nametoindex ( oldname ) ) ) { <START_BUG> fprintf ( stderr, "failed   to   get   netdev   index\\n" ) ; goto out_err ; } } <END_BUG> if ( ( ret = lxc_netdev_rename_by_name ( oldname, * newnamep ) ) < 0 ) {  fprintf ( stderr, "Error   %d   renaming   netdev   %s   to   %s   in   container\\n", ret, oldname, * newnamep ) ; goto out_err ; } if ( grab_newname ) { <START_BUG> char ifname [ IFNAMSIZ ], * namep = ifname ; <END_BUG> if (! if_indextoname ( ifindex, namep ) ) {  fprintf ( stderr, "Failed   to   get   new   netdev   name\\n" ) ; <START_BUG> goto out_err ; } * newnamep = strdup ( namep ) ; if (! * newnamep ) <END_BUG> goto out_err ;  } <START_BUG> if ( setns ( ofd, 0<END_BUG>

Fix:
<S2SV_ModStart> newnamep ) { uid_t ruid, suid, euid ; int fret = - 1 ; int fd = - 1, ifindex <S2SV_ModEnd> = - 1 <S2SV_ModStart> 1, ret <S2SV_ModEnd> ; bool grab_newname <S2SV_ModStart> 0 ) { usernic_error ( <S2SV_ModEnd> "Failed <S2SV_blank> opening <S2SV_blank> network <S2SV_blank> namespace <S2SV_blank> path <S2SV_blank> for <S2SV_blank> \'%d\'.", getpid <S2SV_ModStart> ) ; return fret <S2SV_ModEnd> ; } fd <S2SV_ModStart> 0 ) { usernic_error ( <S2SV_ModEnd> "Failed <S2SV_blank> opening <S2SV_blank> network <S2SV_blank> namespace <S2SV_blank> path <S2SV_blank> for <S2SV_blank> \'%d\'.", pid <S2SV_ModStart> pid ) ; goto do_partial_cleanup ; } ret = getresuid ( & ruid, & euid, & suid ) ; if ( ret < 0 ) { usernic_error ( "Failed <S2SV_blank> to <S2SV_blank> retrieve <S2SV_blank> real, <S2SV_blank> effective, <S2SV_blank> and <S2SV_blank> saved <S2SV_blank> " "user <S2SV_blank> IDs: <S2SV_blank> %s\\n", strerror ( errno ) ) ; goto do_partial_cleanup ; } ret = <S2SV_ModEnd> setns ( fd <S2SV_ModStart> ( fd, CLONE_NEWNET ) ; <S2SV_ModEnd> close ( fd <S2SV_ModStart> fd ) ; fd = - 1 ; if ( ret < 0 ) { usernic_error ( "
Buggy code:
 static struct sk_buff * * gre_gro_receive ( struct sk_buff * * head, struct sk_buff * skb ) { struct sk_buff * * pp = NULL ; struct sk_buff * p ; const struct gre_base_hdr * greh ; unsigned int hlen, grehlen ; unsigned int off ; int flush = 1 ; struct packet_offload * ptype ; <START_BUG> __be16 type ; <END_BUG> off = skb_gro_offset ( skb ) ; hlen = off + sizeof ( * greh ) ; greh = skb_gro_header_fast ( skb, off ) ; if ( skb_gro_header_hard ( skb, hlen ) ) { greh = skb_gro_header_slow ( skb, hlen, off ) ; if ( unlikely (! greh ) ) goto out ; } if ( ( greh -> flags & ~ ( GRE_KEY | GRE_CSUM ) )!= 0 ) goto out ; type = greh -> protocol ; rcu_read_lock ( ) ; ptype = gro_find_receive_by_type ( type ) ; if (! ptype ) goto out_unlock ; grehlen = GRE_HEADER_SECTION ; if ( greh -> flags & GRE_KEY ) grehlen += GRE_HEADER_SECTION ; if ( greh -> flags & GRE_CSUM ) grehlen += GRE_HEADER_SECTION ; hlen = off + grehlen ; if ( skb_gro_header_hard ( skb, hlen ) ) { greh = skb_gro_header_slow ( skb, hlen, off ) ; if ( unlikely (! greh ) ) goto out_unlock ; } if ( ( greh -> flags & GRE_CSUM ) &&! NAPI_GRO_CB ( skb ) -> flush ) { if ( skb_gro_checksum_simple_validate ( skb ) ) goto out_unlock ; skb_gro_checksum_try_convert ( skb, IPPROTO_GRE, 0, null_compute_pseudo ) ; } for ( p = * head ; p ; p = p -> next ) { const struct gre_base_hdr * greh2 ; if (! NAPI_GRO_CB ( p ) ->

Fix:
<S2SV_ModStart> ; __be16 type ; if ( NAPI_GRO_CB ( skb ) -> encap_mark ) goto out ; NAPI_GRO_CB ( skb ) -> encap_mark = 1
Buggy code:
 int pop_open_connection ( struct PopAccountData * adata ) { char buf [ 1024 ] ; int rc = pop_connect ( adata ) ; if ( rc < 0 ) return rc ; rc = pop_capabilities ( adata, 0 ) ; if ( rc == - 1 ) goto err_conn ; if ( rc == - 2 ) return - 2 ; # ifdef USE_SSL if (! adata -> conn -> ssf && ( adata -> cmd_stls || C_SslForceTls ) ) { if ( C_SslForceTls ) adata -> use_stls = 2 ; if ( adata -> use_stls == 0 ) { enum QuadOption ans = query_quadoption ( C_SslStarttls, _ ( "Secure   connection   with   TLS?" ) ) ; if ( ans == MUTT_ABORT ) return - 2 ; adata -> use_stls = 1 ; if ( ans == MUTT_YES ) adata -> use_stls = 2 ; } if ( adata -> use_stls == 2 ) { mutt_str_strfcpy ( buf, "STLS\\r\\n", sizeof ( buf ) ) ; rc = pop_query ( adata, buf, sizeof ( buf ) ) ; <START_BUG> if ( rc == - 1 ) <END_BUG> goto err_conn ; if ( rc!= 0 ) { mutt_error ( "%s", adata -> err_msg ) ; } else if ( mutt_ssl_starttls ( adata -> conn ) ) { mutt_error ( _ ( "Could   not   negotiate   TLS   connection" ) ) ; return - 2 ; } else { rc = pop_capabilities ( adata, 1 ) ; if ( rc == - 1 ) goto err_conn ; if ( rc == - 2 ) return - 2 ; } } } if ( C_SslForceTls &&! adata -> conn -> ssf ) { mutt_error ( _ ( "Encrypted   connection   unavailable" ) ) ; return - 2 ; } # endif rc = pop_authenticate ( adata ) ; if ( rc == - 1 ) goto err_conn ; if ( rc == - 3 ) mutt_clear_error ( ) ; if ( rc!= 0 ) return rc ; rc = pop_capabilities ( adata, 2 ) ; if ( rc == - 1 ) goto err_conn ; if ( rc == - 2 ) return -

Fix:
<S2SV_ModStart> ) ) ; mutt_socket_empty ( adata -> conn ) ;
Buggy code:
 static struct bpf_verifier_state * push_stack ( struct bpf_verifier_env * env, <START_BUG> int insn_idx, int prev_insn_idx ) <END_BUG> { struct bpf_verifier_state * cur = env -> cur_state ; struct bpf_verifier_stack_elem * elem ; int err ; elem = kzalloc ( sizeof ( struct bpf_verifier_stack_elem ), GFP_KERNEL ) ; if (! elem ) goto err ; elem -> insn_idx = insn_idx ; elem -> prev_insn_idx = prev_insn_idx ; elem -> next = env -> head ; env -> head = elem ; env -> stack_size ++ ; err = copy_verifier_state ( & elem -> st, cur ) ; if ( err )  goto err ; <START_BUG> if ( env -> stack_size > BPF_COMPLEXITY_LIMIT_STACK ) { verbose ( env, "BPF   program   is   too   complex\\n" ) ; goto err ; } return & elem -> st ; err : free_verifier_state ( env -> cur_state, true ) ; env -> cur_state = NULL ; while (! pop_stack ( env, NULL, NULL ) ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart>, int prev_insn_idx, bool speculative <S2SV_ModStart> ) goto err ; elem -> st. speculative |= speculative
Buggy code:
 enum nss_status _nss_mymachines_getgrnam_r ( const char * name, struct group * gr, char * buffer, size_t buflen, int * errnop ) { _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL ; _cleanup_bus_message_unref_ sd_bus_message * reply = NULL ; _cleanup_bus_flush_close_unref_ sd_bus * bus = NULL ; const char * p, * e, * machine ; uint32_t mapped ; uid_t gid ; size_t l ; int r ; assert ( name ) ; assert ( gr ) ; p = startswith ( name, "vg-" ) ; if (! p ) goto not_found ; e = strrchr ( p, '-' ) ; if (! e || e == p ) goto not_found ; <START_BUG> r = parse_gid ( e + 1, & gid ) ; <END_BUG> if ( r < 0 ) goto not_found ; machine = strndupa ( p, e - p ) ; if (! machine_name_is_valid ( machine ) ) goto not_found ; r = sd_bus_open_system ( & bus ) ; if ( r < 0 ) goto fail ; r = sd_bus_call_method ( bus, "org.freedesktop.machine1", "//org//freedesktop//machine1", "org.freedesktop.machine1.Manager", "MapFromMachineGroup", & error, & reply, "su", machine, ( uint32_t ) gid ) ; if ( r < 0 ) { if ( sd_bus_error_has_name ( & error, BUS_ERROR_NO_SUCH_GROUP_MAPPING ) ) goto not_found ; goto fail ; } r = sd_bus_message_read ( reply, "u", & mapped ) ; if ( r < 0 ) goto fail ; l = sizeof ( char * ) + strlen ( name ) + 1 ; if ( buflen < l ) { * errnop = ENOMEM ; return NSS_STATUS_TRYAGAIN ; } memzero ( buffer, sizeof ( char * ) ) ; strcpy ( buffer + sizeof ( char * ), name ) ; gr -> gr_name =

Fix:
<S2SV_ModStart> goto not_found ; if ( e - p > HOST_NAME_MAX - 1 ) goto not_found ;
Buggy code:
 static void destroy_server_connect ( SERVER_CONNECT_REC * conn ) { IRC_SERVER_CONNECT_REC * ircconn ; ircconn = IRC_SERVER_CONNECT ( conn ) ; if ( ircconn == NULL ) return ; g_free_not_null ( ircconn -> usermode ) ; g_free_not_null ( ircconn -> alternate_nick ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> alternate_nick ) ; g_free_not_null ( ircconn -> sasl_username ) ; g_free_not_null ( ircconn -> sasl_password ) ;
Buggy code:
 void WT_InterpolateNoLoop ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_PCM * pOutputBuffer ; EAS_I32 phaseInc ; EAS_I32 phaseFrac ; EAS_I32 acc0 ; const EAS_SAMPLE * pSamples ; EAS_I32 samp1 ; EAS_I32 samp2 ; EAS_I32 numSamples ; numSamples = pWTIntFrame -> numSamples ; if ( numSamples <= 0 ) { <START_BUG> ALOGE ( "b//26366256" ) ; <END_BUG> return ; } pOutputBuffer = pWTIntFrame -> pAudioBuffer ; phaseInc = pWTIntFrame -> frame. phaseIncrement ; pSamples = ( const EAS_SAMPLE * ) pWTVoice -> phaseAccum ; phaseFrac = ( EAS_I32 ) pWTVoice -> phaseFrac ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif while ( numSamples -- ) { acc0 = samp2 - samp1 ; acc0 = acc0 * phaseFrac ; acc0 = samp1 + ( acc0 >> NUM_PHASE_FRAC_BITS ) ; * pOutputBuffer ++ = ( EAS_I16 ) ( acc0 >> 2 ) ; phaseFrac += phaseInc ; acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS ; if ( acc0 > 0 ) { pSamples += acc0 ; phaseFrac = ( EAS_I32 ) ( ( EAS_U32 ) phaseFrac & PHASE_FRAC_MASK ) ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif } } pWTVoice -> phaseAccum = ( EAS_U32 ) pSamples ; pWTVoice -> phaseFrac = ( EAS_U32 ) phaseFrac ; }

Fix:
<S2SV_ModStart> ALOGE ( "b//26366256" ) ; android_errorWriteLog ( 0x534e4554, "26366256"
Buggy code:
 opj_image_t * pgxtoimage ( const char * filename, opj_cparameters_t * parameters ) { FILE * f = NULL ; int w, h, prec ; int i, numcomps, max ; OPJ_COLOR_SPACE color_space ; opj_image_cmptparm_t cmptparm ; opj_image_t * image = NULL ; int adjustS, ushift, dshift, force8 ; char endian1, endian2, sign ; char signtmp [ 32 ] ; char temp [ 32 ] ; int bigendian ; opj_image_comp_t * comp = NULL ; numcomps = 1 ; color_space = OPJ_CLRSPC_GRAY ; memset ( & cmptparm, 0, sizeof ( opj_image_cmptparm_t ) ) ; max = 0 ; f = fopen ( filename, "rb" ) ; if (! f ) { fprintf ( stderr, "Failed   to   open   %s   for   reading  !\\n", filename ) ; return NULL ; } fseek ( f, 0, SEEK_SET ) ; <START_BUG> if ( fscanf ( f, "PG%[   \\t]%c%c%[   \\t+-]%d%[   \\t]%d%[   \\t]%d", temp, & endian1, <END_BUG> & endian2, signtmp, & prec, temp, & w, temp, & h )!= 9 ) { fclose ( f ) ; fprintf ( stderr, "ERROR:   Failed   to   read   the   right   number   of   element   from   the   fscanf()   function!\\n" ) ; return NULL ; } i = 0 ; sign = '+' ; while ( signtmp [ i ]!= '\\0' ) { if ( signtmp [ i ] == '-' ) { sign = '-' ; } i ++ ; } fgetc ( f ) ; if ( endian1 == 'M' && endian2 == 'L' ) { bigendian = 1 ; } else if ( endian2 == 'M' && endian1 == 'L' ) { bigendian = 0 ; } else { fclose ( f ) ; fprintf ( stderr, "Bad   pgx   header,   please   check   input  

Fix:
<S2SV_ModStart> ( f, "PG%31[ <S2SV_blank> \\t]%c%c%31[ <S2SV_blank> \\t+-]%d%31[ <S2SV_blank> \\t]%d%31[ <S2SV_blank> \\t]%d" <S2SV_ModEnd>, temp,
Buggy code:
 int rt6_print ( netdissect_options * ndo, register const u_char * bp, const u_char * bp2 _U_ ) { register const struct ip6_rthdr * dp ; register const struct ip6_rthdr0 * dp0 ; register const u_char * ep ; int i, len ; register const struct in6_addr * addr ; dp = ( const struct ip6_rthdr * ) bp ; <START_BUG> len = dp -> ip6r_len ; <END_BUG> ep = ndo -> ndo_snapend ; ND_TCHECK ( dp -> ip6r_segleft ) ; ND_PRINT ( ( ndo, "srcrt   (len=%d", dp -> ip6r_len ) ) ; ND_PRINT ( ( ndo, ",   type=%d", dp -> ip6r_type ) ) ; ND_PRINT ( ( ndo, ",   segleft=%d", dp -> ip6r_segleft ) ) ; switch ( dp -> ip6r_type ) { case IPV6_RTHDR_TYPE_0 : case IPV6_RTHDR_TYPE_2 : dp0 = ( const struct ip6_rthdr0 * ) dp ; ND_TCHECK ( dp0 -> ip6r0_reserved ) ; if ( dp0 -> ip6r0_reserved || ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, ",   rsv=0x%0x", EXTRACT_32BITS ( & dp0 -> ip6r0_reserved ) ) ) ; } if ( len % 2 == 1 ) goto trunc ; len >>= 1 ; addr = & dp0 -> ip6r0_addr [ 0 ] ; for ( i = 0 ; i < len ; i ++ ) { if ( ( const u_char * ) ( addr + 1 ) > ep ) goto trunc ; ND_PRINT ( ( ndo, ",   [%d]%s", i, ip6addr_string ( ndo, addr ) ) ) ; addr ++ ; } ND_PRINT ( ( ndo, ")   " ) ) ; return ( ( dp0 -> ip6r0_len + 1 ) << 3 ) ; break ; default : goto trunc ; break ; } trunc :

Fix:
<S2SV_ModStart> ) bp ; ep = ndo -> ndo_snapend ; ND_TCHECK ( dp -> ip6r_segleft ) ; <S2SV_ModStart> dp -> ip6r_len <S2SV_ModEnd> ; ND_PRINT (
Buggy code:
 static Image * ReadSUNImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define RMT_EQUAL_RGB 1 # define RMT_NONE 0 # define RMT_RAW 2 # define RT_STANDARD 1 # define RT_ENCODED 2 # define RT_FORMAT_RGB 3 typedef struct _SUNInfo { unsigned int magic, width, height, depth, length, type, maptype, maplength ; } SUNInfo ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bytes_per_line, extent, length ; ssize_t count, y ; SUNInfo sun_info ; unsigned char * sun_data, * sun_pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & sun_info, 0, sizeof ( sun_info ) ) ; sun_info. magic = ReadBlobMSBLong ( image ) ; do { if ( sun_info. magic!= 0x59a66a95 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; sun_info. width = ReadBlobMSBLong ( image ) ; sun_info. height = ReadBlobMSBLong ( image ) ; sun_info. depth = ReadBlobMSBLong ( image ) ; sun_info. length = ReadBlobMSBLong ( image ) ; sun_info. type = ReadBlobMSBLong ( image ) ; sun_info. maptype = ReadBlobMSBLong ( image ) ; sun_info. ma

Fix:
<S2SV_ModStart> "ImproperImageHeader" ) ; bytes_per_line = sun_info. width * sun_info. depth ; <S2SV_ModStart> ( size_t ) MagickMax ( <S2SV_ModStart>. length, bytes_per_line * sun_info. width ), <S2SV_ModStart> sun_info. height <S2SV_ModEnd> ; if (
Buggy code:
 static int readContigStripsIntoBuffer ( TIFF * in, uint8 * buf ) { uint8 * bufp = buf ; int32 bytes_read = 0 ; <START_BUG> uint16 strip, nstrips = TIFFNumberOfStrips ( in ) ; <END_BUG> uint32 stripsize = TIFFStripSize ( in ) ; uint32 rows = 0 ; uint32 rps = TIFFGetFieldDefaulted ( in, TIFFTAG_ROWSPERSTRIP, & rps ) ; tsize_t scanline_size = TIFFScanlineSize ( in ) ; if ( scanline_size == 0 ) { TIFFError ( "", "TIFF   scanline   size   is   zero!" ) ; return 0 ; } for ( strip = 0 ; strip < nstrips ; strip ++ ) { bytes_read = TIFFReadEncodedStrip ( in, strip, bufp, - 1 ) ; rows = bytes_read // scanline_size ; if ( ( strip < ( nstrips - 1 ) ) && ( bytes_read!= ( int32 ) stripsize ) ) TIFFError ( "", "Strip   %d:   read   %lu   bytes,   strip   size   %lu", ( int ) strip + 1, ( unsigned long ) bytes_read, ( unsigned long ) stripsize ) ; if ( bytes_read < 0 &&! ignore ) { TIFFError ( "", "Error   reading   strip   %lu   after   %lu   rows", ( unsigned long ) strip, ( unsigned long ) rows ) ; return 0 ; } bufp += bytes_read ; } return 1 ; }

Fix:
<S2SV_ModStart> = 0 ; uint32 <S2SV_ModEnd> strip, nstrips
Buggy code:
 static RList * relocs ( RBinFile * arch ) { struct r_bin_bflt_obj * obj = ( struct r_bin_bflt_obj * ) arch -> o -> bin_obj ; RList * list = r_list_newf ( ( RListFree ) free ) ; int i, len, n_got, amount ; if (! list ||! obj ) { r_list_free ( list ) ; return NULL ; } if ( obj -> hdr -> flags & FLAT_FLAG_GOTPIC ) { n_got = get_ngot_entries ( obj ) ; if ( n_got ) { amount = n_got * sizeof ( ut32 ) ; if ( amount < n_got || amount > UT32_MAX ) { goto out_error ; } <START_BUG> struct reloc_struct_t * got_table = calloc ( 1, n_got * sizeof ( ut32 ) ) ; <END_BUG> if ( got_table ) { ut32 offset = 0 ; for ( i = 0 ; i < n_got ; offset += 4, i ++ ) { ut32 got_entry ; if ( obj -> hdr -> data_start + offset + 4 > obj -> size || obj -> hdr -> data_start + offset + 4 < offset ) { break ; } len = r_buf_read_at ( obj -> b, obj -> hdr -> data_start + offset, ( ut8 * ) & got_entry, sizeof ( ut32 ) ) ; if (! VALID_GOT_ENTRY ( got_entry ) || len!= sizeof ( ut32 ) ) { break ; } got_table [ i ]. addr_to_patch = got_entry ; got_table [ i ]. data_offset = got_entry + BFLT_HDR_SIZE ; } obj -> n_got = n_got ; obj -> got_table = got_table ; } } } if ( obj -> hdr -> reloc_count > 0 ) { int n_reloc = obj -> hdr -> reloc_count ; amount = n_reloc * sizeof ( struct reloc_struct_t ) ; if ( amount < n_reloc || amount > UT32_MAX ) { goto out_error ; } struct reloc_struct_t * reloc_table = calloc ( 1, amount + 1 ) ; if (!

Fix:
<S2SV_ModStart> * sizeof ( struct reloc_struct_t <S2SV_ModEnd> ) ) ;
Buggy code:
 unsigned char * ssl_add_serverhello_tlsext ( SSL * s, unsigned char * buf, unsigned char * limit, int * al ) { int extdatalen = 0 ; unsigned char * orig = buf ; unsigned char * ret = buf ; # ifndef OPENSSL_NO_NEXTPROTONEG int next_proto_neg_seen ; # endif # ifndef OPENSSL_NO_EC unsigned long alg_k = s -> s3 -> tmp. new_cipher -> algorithm_mkey ; unsigned long alg_a = s -> s3 -> tmp. new_cipher -> algorithm_auth ; int using_ecc = ( alg_k & SSL_kECDHE ) || ( alg_a & SSL_aECDSA ) ; using_ecc = using_ecc && ( s -> session -> tlsext_ecpointformatlist!= NULL ) ; # endif ret += 2 ; if ( ret >= limit ) return NULL ; if ( s -> s3 -> send_connection_binding ) { int el ; if (! ssl_add_serverhello_renegotiate_ext ( s, 0, & el, 0 ) ) { SSLerr ( SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR ) ; return NULL ; } if ( CHECKLEN ( ret, 4 + el, limit ) ) return NULL ; s2n ( TLSEXT_TYPE_renegotiate, ret ) ; s2n ( el, ret ) ; if (! ssl_add_serverhello_renegotiate_ext ( s, ret, & el, el ) ) { SSLerr ( SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR ) ; return NULL ; } ret += el ; } if ( s -> version == SSL3_VERSION ) goto done ; if (! s -> hit && s -> servername_done == 1 && s -> session -> tlsext_hostname!= NULL ) { if ( CHECKLEN ( ret, 4, limit ) ) return NULL ; s2n ( TLSEXT_TYPE_server_name, ret ) ; s2n ( 0, ret ) ; } # ifndef OPENSSL_NO_EC if ( using_ecc ) { const unsigned char * plist ; size_t plistlen ; tls1_get_format

Fix:
<S2SV_ModStart> ( s -> tlsext_use_etm <S2SV_ModEnd> ) { if <S2SV_ModStart> ) s -> tlsext_use_etm = 0 <S2SV_ModEnd> ; else {
Buggy code:
 static void perf_event_interrupt ( struct pt_regs * regs ) { int i ; struct cpu_hw_events * cpuhw = & __get_cpu_var ( cpu_hw_events ) ; struct perf_event * event ; unsigned long val ; int found = 0 ; int nmi ; if ( cpuhw -> n_limited ) freeze_limited_counters ( cpuhw, mfspr ( SPRN_PMC5 ), mfspr ( SPRN_PMC6 ) ) ; perf_read_regs ( regs ) ; nmi = perf_intr_is_nmi ( regs ) ; if ( nmi ) nmi_enter ( ) ; else irq_enter ( ) ; for ( i = 0 ; i < cpuhw -> n_events ; ++ i ) { event = cpuhw -> event [ i ] ; if (! event -> hw. idx || is_limited_pmc ( event -> hw. idx ) ) continue ; val = read_pmc ( event -> hw. idx ) ; if ( ( int ) val < 0 ) { found = 1 ; <START_BUG> record_and_restart ( event, val, regs, nmi ) ; <END_BUG> } } if (! found ) { for ( i = 0 ; i < ppmu -> n_counter ; ++ i ) { if ( is_limited_pmc ( i + 1 ) ) continue ; val = read_pmc ( i + 1 ) ; if ( pmc_overflow ( val ) ) write_pmc ( i + 1, 0 ) ; } } write_mmcr0 ( cpuhw, cpuhw -> mmcr [ 0 ] ) ; if ( nmi ) nmi_exit ( ) ; else irq_exit ( ) ; }

Fix:
<S2SV_ModStart> val, regs <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> int sctp_verify_asconf ( const struct sctp_association * asoc, <END_BUG>  struct sctp_paramhdr * param_hdr, void * chunk_end, <START_BUG> struct sctp_paramhdr * * errp ) { <END_BUG> sctp_addip_param_t * asconf_param ;  union sctp_params param ; <START_BUG> int length, plen ; <END_BUG>  param. v = ( sctp_paramhdr_t * ) param_hdr ; <START_BUG> while ( param. v <= chunk_end - sizeof ( sctp_paramhdr_t ) ) { length = ntohs ( param. p -> length ) ; * errp = param. p ; if ( param. v > chunk_end - length || length < sizeof ( sctp_paramhdr_t ) ) return 0 ; switch ( param. p -> type ) { case SCTP_PARAM_ADD_IP : case SCTP_PARAM_DEL_IP : case SCTP_PARAM_SET_PRIMARY : asconf_param = ( sctp_addip_param_t * ) param. v ; plen = ntohs ( asconf_param -> param_hdr. length ) ; if ( plen < sizeof ( sctp_addip_param_t ) + sizeof ( sctp_paramhdr_t ) ) return 0 ; break ; case SCTP_PARAM_SUCCESS_REPORT : case SCTP_PARAM_ADAPTATION_LAYER_IND : if ( length!= sizeof ( sctp_addip_param_t ) ) return 0 ; break ; default : break ; } param. v += WORD_ROUND ( length ) ; } if ( param. v!= chunk_end ) return 0 ; return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> bool <S2SV_ModEnd> sctp_verify_asconf ( const <S2SV_ModStart> asoc, struct sctp_chunk * chunk, bool addr_param_needed <S2SV_ModEnd>, struct sctp_paramhdr <S2SV_ModStart> errp ) { sctp_addip_chunk_t * addip = ( sctp_addip_chunk_t * ) chunk -> chunk_hdr <S2SV_ModEnd> ; union sctp_params <S2SV_ModStart> sctp_params param ; bool addr_param_seen = false ; sctp_walk_params ( param, addip, addip_hdr. params ) { size_t length = ntohs ( param. p -> length ) ; * errp = param. p ; switch ( param. p -> type ) { case SCTP_PARAM_ERR_CAUSE : break ; case SCTP_PARAM_IPV4_ADDRESS : if ( length!= sizeof ( sctp_ipv4addr_param_t ) ) return false ; addr_param_seen = true ; break ; case SCTP_PARAM_IPV6_ADDRESS : if ( length!= sizeof ( sctp_ipv6addr_
Buggy code:
 static void __local_bh_enable ( unsigned int cnt ) { <START_BUG> lockdep_assert_irqs_disabled ( ) ; <END_BUG> if ( softirq_count ( ) == ( cnt & SOFTIRQ_MASK ) ) trace_softirqs_on ( _RET_IP_ ) ;  preempt_count_sub ( cnt ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> { lockdep_assert_irqs_disabled ( ) ; if ( preempt_count ( ) == cnt ) trace_preempt_on ( CALLER_ADDR0, get_lock_parent_ip ( ) <S2SV_ModStart> _RET_IP_ ) ; __preempt_count_sub <S2SV_ModEnd> ( cnt )
Buggy code:
 bool all_tests ( ) { mu_run_test ( test_r_str_newf ) ; mu_run_test ( test_r_str_replace_char_once ) ; mu_run_test ( test_r_str_replace_char ) ; mu_run_test ( test_r_str_replace ) ; mu_run_test ( test_r_str_bits64 ) ; mu_run_test ( test_r_str_rwx ) ; mu_run_test ( test_r_str_rwx_i ) ; mu_run_test ( test_r_str_bool ) ; mu_run_test ( test_r_str_trim ) ; mu_run_test ( test_r_str_case ) ; mu_run_test ( test_r_str_split ) ; mu_run_test ( test_r_str_tokenize ) ; mu_run_test ( test_r_str_char_count ) ; mu_run_test ( test_r_str_word_count ) ; mu_run_test ( test_r_str_ichr ) ; mu_run_test ( test_r_str_lchr ) ; mu_run_test ( test_r_sub_str_lchr ) ; mu_run_test ( test_r_sub_str_rchr ) ; mu_run_test ( test_r_str_rchr ) ; mu_run_test ( test_r_str_ansi_len ) ; mu_run_test ( test_r_str_len_utf8_ansi ) ; mu_run_test ( test_r_str_utf8_charsize ) ; mu_run_test ( test_r_str_utf8_charsize_prev ) ; mu_run_test ( test_r_str_sanitize_sdb_key ) ; <START_BUG> mu_run_test ( test_r_str_unescape ) ; <END_BUG> mu_run_test ( test_r_str_constpool ) ; mu_run_test ( test_r_str_format_msvc_argv ) ; mu_run_test ( test_r_str_str_xy ) ; return tests_passed!= tests_run ; }

Fix:
<S2SV_ModStart> ; mu_run_test ( test_r_str_escape_sh ) ; mu_run_test (
Buggy code:
 static int i8042_start ( struct serio * serio ) { struct i8042_port * port = serio -> port_data ; <START_BUG> port -> exists = true ; <END_BUG>  mb ( ) ; <START_BUG> return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> port_data ; spin_lock_irq ( & i8042_lock ) ; <S2SV_ModStart> = true ; spin_unlock_irq ( & i8042_lock <S2SV_ModEnd> ) ; return
Buggy code:
 static void copy_and_extend_plane ( unsigned char * s, int sp, unsigned char * d, int dp, int h, int w, int et, int el, int eb, int er ) { int i ; unsigned char * src_ptr1, * src_ptr2 ; unsigned char * dest_ptr1, * dest_ptr2 ; int linesize ; src_ptr1 = s ; src_ptr2 = s + w - 1 ; dest_ptr1 = d - el ; dest_ptr2 = d + w ; for ( i = 0 ; i < h ; i ++ ) { <START_BUG> vpx_memset ( dest_ptr1, src_ptr1 [ 0 ], el ) ; <END_BUG>  vpx_memcpy ( dest_ptr1 + el, src_ptr1, w ) ; <START_BUG> vpx_memset ( dest_ptr2, src_ptr2 [ 0 ], er ) ; src_ptr1 += sp ; src_ptr2 += sp ; dest_ptr1 += dp ; dest_ptr2 += dp ; } src_ptr1 = d - el ; src_ptr2 = d + dp * ( h - 1 ) - el ; dest_ptr1 = d + dp * ( - et ) - el ; dest_ptr2 = d + dp * ( h ) - el ; linesize = el + er + w ; for ( i = 0 ; i < et ; i ++ ) { <END_BUG> vpx_memcpy ( dest_ptr1, src_ptr1, linesize ) ;  dest_ptr1 += dp ; } for ( i = 0 ; i < eb ; i ++ ) { <START_BUG> vpx_memcpy ( dest_ptr2, src_ptr2, linesize ) ; <END_BUG> dest_ptr2 += dp ; } }

Fix:
<S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( dest_ptr1, <S2SV_ModStart> el ) ; memcpy ( dest_ptr1 + el, src_ptr1, w ) ; memset <S2SV_ModEnd> ( dest_ptr2, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr1, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr2,
Buggy code:
 <START_BUG> static ssize_t aio_setup_single_vector ( struct kiocb * kiocb ) <END_BUG>  { <START_BUG> kiocb -> ki_iovec = & kiocb -> ki_inline_vec ; kiocb -> ki_iovec -> iov_base = kiocb -> ki_buf ; <END_BUG> kiocb -> ki_iovec -> iov_len = kiocb -> ki_left ;  kiocb -> ki_nr_segs = 1 ; kiocb -> ki_cur_seg = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> ssize_t aio_setup_single_vector ( int type, struct file * file, <S2SV_ModStart> kiocb ) { int bytes ; bytes = rw_verify_area ( type, file, & kiocb -> ki_pos, kiocb -> ki_left ) ; if ( bytes < 0 ) return bytes ; <S2SV_ModStart> -> iov_len = bytes <S2SV_ModEnd> ; kiocb ->
Buggy code:
 WORD32 ih264d_parse_pslice ( dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice ) { dec_pic_params_t * ps_pps = ps_dec -> ps_cur_pps ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD8 u1_mbaff = ps_dec -> ps_cur_slice -> u1_mbaff_frame_flag ; UWORD8 u1_field_pic_flag = ps_cur_slice -> u1_field_pic_flag ; UWORD32 u4_temp ; WORD32 i_temp ; WORD32 ret ; { WORD8 * pi1_buf ; WORD16 * pi2_mv = ps_dec -> s_default_mv_pred. i2_mv ; WORD32 * pi4_mv = ( WORD32 * ) pi2_mv ; WORD16 * pi16_refFrame ; pi1_buf = ps_dec -> s_default_mv_pred. i1_ref_frame ; pi16_refFrame = ( WORD16 * ) pi1_buf ; * pi4_mv = 0 ; * ( pi4_mv + 1 ) = 0 ; * pi16_refFrame = OUT_OF_RANGE_REF ; ps_dec -> s_default_mv_pred. u1_col_ref_pic_idx = ( UWORD8 ) - 1 ; ps_dec -> s_default_mv_pred. u1_pic_type = ( UWORD8 ) - 1 ; } ps_cur_slice -> u1_num_ref_idx_active_override_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; COPYTHECONTEXT ( "SH:   num_ref_idx_override_flag", ps_cur_slice -> u1_num_ref_idx_active_override_flag

Fix:
<S2SV_ModStart> -> u1_dpb_commands_read ) { i_temp = ih264d_read_mmco_commands ( ps_dec ) ; if ( i_temp < 0 ) { return ERROR_DBP_MANAGER_T ; } <S2SV_ModStart> -> u4_bitoffset = i_temp ; } <S2SV_ModEnd> else ps_bitstrm ->
Buggy code:
 static int isis_print_mt_capability_subtlv ( netdissect_options * ndo, const uint8_t * tptr, int len ) { int stlv_type, stlv_len, tmp ; while ( len > 2 ) { <START_BUG> stlv_type = * ( tptr ++ ) ; <END_BUG> stlv_len = * ( tptr ++ ) ; ND_PRINT ( ( ndo, "\\n\\t             %s   subTLV   #%u,   length:   %u", tok2str ( isis_mt_capability_subtlv_values, "unknown", stlv_type ), stlv_type, stlv_len ) ) ;  len = len - 2 ; <START_BUG> switch ( stlv_type ) { case ISIS_SUBTLV_SPB_INSTANCE : <END_BUG> ND_TCHECK2 ( * tptr, ISIS_SUBTLV_SPB_INSTANCE_MIN_LEN ) ;  ND_PRINT ( ( ndo, "\\n\\t                 CIST   Root-ID:   %08x", EXTRACT_32BITS ( tptr ) ) ) ; tptr = tptr + 4 ; ND_PRINT ( ( ndo, "   %08x", EXTRACT_32BITS ( tptr ) ) ) ; tptr = tptr + 4 ; ND_PRINT ( ( ndo, ",   Path   Cost:   %08x", EXTRACT_32BITS ( tptr ) ) ) ; tptr = tptr + 4 ; ND_PRINT ( ( ndo, ",   Prio:   %d", EXTRACT_16BITS ( tptr ) ) ) ; tptr = tptr + 2 ; ND_PRINT ( ( ndo, "\\n\\t                 RES:   %d", EXTRACT_16BITS ( tptr ) >> 5 ) ) ; ND_PRINT ( ( ndo, ",   V:   %d", ( EXTRACT_16BITS ( tptr ) >> 4 ) & 0x0001 ) ) ; ND_PRINT ( ( ndo, ",   SPSource-ID:   %d", ( EXTRACT_32BITS ( tptr ) & 0x000fffff )

Fix:
<S2SV_ModStart> 2 ) { ND_TCHECK2 ( * tptr, 2 ) ; <S2SV_ModStart> len - 2 ; if ( len < stlv_len ) goto trunc ; ND_TCHECK2 ( * ( tptr ), stlv_len ) <S2SV_ModStart> case ISIS_SUBTLV_SPB_INSTANCE : if ( stlv_len < ISIS_SUBTLV_SPB_INSTANCE_MIN_LEN ) goto trunc <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> - ISIS_SUBTLV_SPB_INSTANCE_MIN_LEN ; stlv_len = stlv_len - ISIS_SUBTLV_SPB_INSTANCE_MIN_LEN ; <S2SV_ModStart> tmp ) { if ( stlv_len < ISIS_SUBTLV_SPB_INSTANCE_VLAN_TUPLE_LEN ) goto trunc <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> len = len - ISIS_SUBTLV_SPB_INSTANCE_VLAN_TUPLE_LEN ; stlv_len = stlv_len <S2SV_ModStart> case ISIS_SUBTLV_SPBM_SI : if ( stlv_len < 8 ) goto trunc <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> break
Buggy code:
 static int compile_length_bag_node ( BagNode * node, regex_t * reg ) { int len ; int tlen ; if ( node -> type == BAG_OPTION ) return compile_length_option_node ( node, reg ) ; if ( NODE_BAG_BODY ( node ) ) { tlen = compile_length_tree ( NODE_BAG_BODY ( node ), reg ) ; if ( tlen < 0 ) return tlen ; } else tlen = 0 ; switch ( node -> type ) { case BAG_MEMORY : # ifdef USE_CALL if ( node -> m. regnum == 0 && NODE_IS_CALLED ( node ) ) { len = tlen + SIZE_OP_CALL + SIZE_OP_JUMP + SIZE_OP_RETURN ; return len ; } if ( NODE_IS_CALLED ( node ) ) { len = SIZE_OP_MEMORY_START_PUSH + tlen + SIZE_OP_CALL + SIZE_OP_JUMP + SIZE_OP_RETURN ; if ( MEM_STATUS_AT0 ( reg -> bt_mem_end, node -> m. regnum ) ) len += ( NODE_IS_RECURSION ( node )? SIZE_OP_MEMORY_END_PUSH_REC : SIZE_OP_MEMORY_END_PUSH ) ; else len += ( NODE_IS_RECURSION ( node )? SIZE_OP_MEMORY_END_REC : SIZE_OP_MEMORY_END ) ; } else if ( NODE_IS_RECURSION ( node ) ) { len = SIZE_OP_MEMORY_START_PUSH ; len += tlen + ( MEM_STATUS_AT0 ( reg -> bt_mem_end, node -> m. regnum )? SIZE_OP_MEMORY_END_PUSH_REC : SIZE_OP_MEMORY_END_REC ) ; } else # endif { if ( MEM_STATUS_AT0 ( reg -> bt_mem_start, node -> m. regnum ) ) len = SIZE_OP_MEMORY_START_PUSH ; else len = SIZE_OP_MEMORY_START ; len += tlen + ( MEM_STATUS_AT0 ( reg -> bt_mem_end, node -> m. regnum )? SIZE_OP_MEMORY_END_PUSH : SIZE_OP_MEMORY_END ) ; }

Fix:
<S2SV_ModStart> tlen ; } len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END ; <S2SV_ModStart> ) ) { <S2SV_ModEnd> tlen = compile_length_tree
Buggy code:
 Bool GPAC_EventProc ( void * ptr, GF_Event * evt ) { if (! term ) return 0 ; if ( gui_mode == 1 ) { if ( evt -> type == GF_EVENT_QUIT ) { Run = 0 ; } else if ( evt -> type == GF_EVENT_KEYDOWN ) { switch ( evt -> key. key_code ) { case GF_KEY_C : if ( evt -> key. flags & ( GF_KEY_MOD_CTRL | GF_KEY_MOD_ALT ) ) { hide_shell ( shell_visible? 1 : 0 ) ; if ( shell_visible ) gui_mode = 2 ; } break ; default : break ; } } return 0 ; } switch ( evt -> type ) { case GF_EVENT_DURATION : Duration = ( u64 ) ( 1000 * ( s64 ) evt -> duration. duration ) ; CanSeek = evt -> duration. can_seek ; break ; case GF_EVENT_MESSAGE : { const char * servName ; if (! evt -> message. service ||! strcmp ( evt -> message. service, the_url ) ) { servName = "" ; } else if (! strnicmp ( evt -> message. service, "data:", 5 ) ) { servName = "(embedded   data)" ; } else { servName = evt -> message. service ; } if (! evt -> message. message ) return 0 ; if ( evt -> message. error ) { if (! is_connected ) last_error = evt -> message. error ; if ( evt -> message. error == GF_SCRIPT_INFO ) { GF_LOG ( GF_LOG_INFO, GF_LOG_CONSOLE, ( "%s\\n", evt -> message. message ) ) ; } else { GF_LOG ( GF_LOG_ERROR, GF_LOG_CONSOLE, ( "%s   %s:   %s\\n", servName, evt -> message. message, gf_error_to_string ( evt -> message. error ) ) ) ; } } else if (! be_quiet ) GF_LOG ( GF_LOG_INFO, GF_LOG_CONSOLE, ( "%s   %s\\n", servName, evt -> message. message ) ) ; } break ; case

Fix:
<S2SV_ModStart> ) ) { strncpy <S2SV_ModEnd> ( the_url, <S2SV_ModStart> navigate. to_url, sizeof ( the_url ) - 1 ) ; the_url [ sizeof ( the_url ) - 1 ] = 0 <S2SV_ModEnd> ; fprintf (
Buggy code:
 void pointZZ_pDouble ( PointZZ_p * rop, const PointZZ_p * op, const CurveZZ_p * curve ) { <START_BUG> mpz_t numer, denom, lambda ; <END_BUG> mpz_inits ( numer, denom, lambda, NULL ) ; mpz_mul ( numer, op -> x, op -> x ) ; mpz_mul_ui ( numer, numer, 3 ) ; mpz_add ( numer, numer, curve -> a ) ; mpz_mul_ui ( denom, op -> y, 2 ) ; mpz_invert ( denom, denom, curve -> p ) ; mpz_mul ( lambda, numer, denom ) ; mpz_mod ( lambda, lambda, curve -> p ) ; mpz_mul ( rop -> x, lambda, lambda ) ; mpz_sub ( rop -> x, rop -> x, op -> x ) ; mpz_sub ( rop -> x, rop -> x, op -> x ) ; mpz_mod ( rop -> x, rop -> x, curve -> p ) ; mpz_sub ( rop -> y, op -> x, rop -> x ) ; mpz_mul ( rop -> y, lambda, rop -> y ) ; mpz_sub ( rop -> y, rop -> y, op -> y ) ; mpz_mod ( rop -> y, rop -> y, curve -> p ) ; mpz_clears ( numer, denom, lambda, NULL ) ; }

Fix:
<S2SV_ModStart> curve ) { if ( pointZZ_pIsIdentityElement ( op ) ) { return pointZZ_pSetToIdentityElement ( rop ) ; }
Buggy code:
 void pci_lintr_assert ( struct pci_vdev * dev ) { <START_BUG> assert ( dev -> lintr. pin > 0 ) ; <END_BUG> pthread_mutex_lock ( & dev -> lintr. lock ) ; if ( dev -> lintr. state == IDLE ) { if ( pci_lintr_permitted ( dev ) ) { dev -> lintr. state = ASSERTED ; pci_irq_assert ( dev ) ; } else dev -> lintr. state = PENDING ; } pthread_mutex_unlock ( & dev -> lintr. lock ) ; }

Fix:
<S2SV_ModStart> dev ) { if <S2SV_ModEnd> ( dev -> <S2SV_ModStart> lintr. pin <= 0 ) { pr_warn ( "%s: <S2SV_blank> Invalid <S2SV_blank> intr <S2SV_blank> pin <S2SV_blank> on <S2SV_blank> dev <S2SV_blank> [%s]\\n", __func__, dev -> name ) ; return ; } <S2SV_ModEnd> pthread_mutex_lock ( &
Buggy code:
 static Image * ReadMPCImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char cache_filename [ MaxTextExtent ], id [ MaxTextExtent ], keyword [ MaxTextExtent ], * options ; const unsigned char * p ; GeometryInfo geometry_info ; Image * image ; int c ; LinkedListInfo * profiles ; MagickBooleanType status ; MagickOffsetType offset ; MagickStatusType flags ; register ssize_t i ; size_t depth, length ; ssize_t count ; StringInfo * profile ; unsigned int signature ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) CopyMagickString ( cache_filename, image -> filename, MaxTextExtent ) ; AppendImageFormat ( "cache", cache_filename ) ; c = ReadBlobByte ( image ) ; if ( c == EOF ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } * id = '\\0' ; ( void ) ResetMagickMemory ( keyword, 0, sizeof ( keyword ) ) ; offset = 0 ; do { profiles = ( LinkedListInfo * ) NULL ; length = MaxTextExtent ; options = AcquireString ( ( char * ) NULL ) ; signature = GetMagickSignature ( ( const StringInfo * ) NULL ) ; image -> depth = 8 ; image -> compression = NoCompression ; while ( ( isgraph ( c )!= MagickFalse ) && ( c!= ( int ) ':' ) ) { register char * p ; if ( c == ( int ) '{' ) { char * comment ; length = MaxTextExtent ; comment = AcquireString ( ( char * ) NULL ) ; for ( p = comment ; comment!= ( char * ) NULL ; p ++ ) { c = Read

Fix:
<S2SV_ModStart> PseudoClass ) { image -> colormap = ( PixelPacket * ) AcquireQuantumMemory ( <S2SV_ModEnd> image -> colors <S2SV_ModStart> image -> colors + 1, sizeof ( * image -> colormap ) ) ; if ( image -> colormap == ( PixelPacket * ) NULL <S2SV_ModEnd> ) ThrowReaderException ( <S2SV_ModStart> ) break ; if ( ( AcquireMagickResource ( WidthResource <S2SV_ModEnd>, image -> <S2SV_ModStart> image -> columns ) == MagickFalse ) || ( AcquireMagickResource ( HeightResource <S2SV_ModStart> -> rows ) <S2SV_ModEnd> == MagickFalse ) <S2SV_ModStart> == MagickFalse ) ) ThrowReaderException ( ImageError, "WidthOrHeightExceedsLimit" ) ; <S2SV_ModEnd> status = PersistPixelCache
Buggy code:
 rfbBool SetFormatAndEncodings ( rfbClient * client ) { rfbSetPixelFormatMsg spf ; <START_BUG> char buf [ sz_rfbSetEncodingsMsg + MAX_ENCODINGS * 4 ] ; <END_BUG>  rfbSetEncodingsMsg * se = ( rfbSetEncodingsMsg * ) buf ; <START_BUG> <END_BUG> uint32_t * encs = ( uint32_t * ) ( & buf [ sz_rfbSetEncodingsMsg ] ) ;  int len = 0 ; rfbBool requestCompressLevel = FALSE ; rfbBool requestQualityLevel = FALSE ; rfbBool requestLastRectEncoding = FALSE ; rfbClientProtocolExtension * e ; if (! SupportsClient2Server ( client, rfbSetPixelFormat ) ) return TRUE ; spf. type = rfbSetPixelFormat ; spf. pad1 = 0 ; spf. pad2 = 0 ; spf. format = client -> format ; spf. format. redMax = rfbClientSwap16IfLE ( spf. format. redMax ) ; spf. format. greenMax = rfbClientSwap16IfLE ( spf. format. greenMax ) ; spf. format. blueMax = rfbClientSwap16IfLE ( spf. format. blueMax ) ; if (! WriteToRFBServer ( client, ( char * ) & spf, sz_rfbSetPixelFormatMsg ) ) return FALSE ; if (! SupportsClient2Server ( client, rfbSetEncodings ) ) return TRUE ; se -> type = rfbSetEncodings ; se -> pad = 0 ; se -> nEncodings = 0 ; if ( client -> appData. encodingsString ) { const char * encStr = client -> appData. encodingsString ; int encStrLen ; do { const char * nextEncStr = strchr ( encStr,' ') ; if ( nextEncStr ) { encStrLen = nextEncStr - encStr ; nextEncStr ++ ; } else { encStrLen = strlen ( encStr ) ; } if ( strncasecmp ( encStr, "raw", encStrLen ) == 0 ) { encs [ se -> nEncodings ++ ] = rfbClientSwap32IfLE ( rfbEncodingRaw ) ; } else if ( strncasecmp ( encStr, "copyrect", encStrLen ) == 0 ) { encs [ se -> n

Fix:
<S2SV_ModStart> rfbSetPixelFormatMsg spf ; union { char bytes <S2SV_ModEnd> [ sz_rfbSetEncodingsMsg + <S2SV_ModStart> ] ; rfbSetEncodingsMsg msg ; } buf ; rfbSetEncodingsMsg * se = & buf. msg <S2SV_ModEnd> ; uint32_t * <S2SV_ModStart> ( & buf. bytes <S2SV_ModStart> client, buf. bytes
Buggy code:
 int fscrypt_get_encryption_info ( struct inode * inode ) { <START_BUG> struct fscrypt_info * ci = inode -> i_crypt_info ; <END_BUG>  if (! ci || <START_BUG> ( ci -> ci_keyring_key && ( ci -> ci_keyring_key -> flags & ( ( 1 << KEY_FLAG_INVALIDATED ) | ( 1 << KEY_FLAG_REVOKED ) | ( 1 << KEY_FLAG_DEAD ) ) ) ) ) return fscrypt_get_crypt_info ( inode ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> struct fscrypt_info * crypt_info ; struct fscrypt_context ctx ; struct crypto_skcipher * ctfm ; const char * cipher_str ; int keysize ; u8 * raw_key = NULL ; int res ; if ( <S2SV_ModEnd> inode -> i_crypt_info <S2SV_ModStart> inode -> i_crypt_info ) return 0 ; res = fscrypt_initialize ( inode -> i_sb -> s_cop -> flags ) ; if ( res ) return res <S2SV_ModStart> if (! inode -> i_sb -> s_cop -> get_context ) return - EOPNOTSUPP ; res = inode -> i_sb -> s_cop -> get_context ( inode, & ctx, sizeof ( ctx ) ) ; if ( res < 0 ) { if (! fscrypt_dummy_context_enabled ( inode ) || inode -> i_sb -> s_cop -> is_encrypted ( inode ) ) return res ; memset ( & ctx, 0, sizeof ( ctx ) ) ; ctx. format = FS_ENCRYPTION_CONTEXT_FORMAT_V1 ; ctx. contents_encryption_mode = FS_ENCRYPTION_MODE_AES_256_XTS ; ctx
Buggy code:
 static void timerfd_remove_cancel ( struct timerfd_ctx * ctx ) { <START_BUG> if ( ctx -> might_cancel ) { <END_BUG> ctx -> might_cancel = false ;  spin_lock ( & cancel_lock ) ; <START_BUG> <END_BUG> list_del_rcu ( & ctx -> clist ) ;  <START_BUG> spin_unlock ( & cancel_lock ) ; <END_BUG> }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ctx ) { <S2SV_ModEnd> spin_lock ( & <S2SV_ModStart> spin_lock ( & ctx -> <S2SV_ModStart> cancel_lock ) ; __timerfd_remove_cancel ( ctx <S2SV_ModEnd> ) ; spin_unlock <S2SV_ModStart> spin_unlock ( & ctx -> <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static inline void header_put_le_short ( SF_PRIVATE * psf, int x ) <START_BUG> { if ( psf -> headindex < SIGNED_SIZEOF ( psf -> header ) - 2 ) <END_BUG>  { psf -> header [ psf -> headindex ++ ] = x ; <START_BUG> <END_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 8 ) ;  <START_BUG> } ; <END_BUG> }

Fix:
<S2SV_ModStart> x ) { <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. ptr [ <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static struct VP8D_COMP * create_decompressor ( VP8D_CONFIG * oxcf ) { VP8D_COMP * pbi = vpx_memalign ( 32, sizeof ( VP8D_COMP ) ) ; if (! pbi ) return NULL ; <START_BUG> vpx_memset ( pbi, 0, sizeof ( VP8D_COMP ) ) ; <END_BUG> if ( setjmp ( pbi -> common. error. jmp ) ) { pbi -> common. error. setjmp = 0 ; remove_decompressor ( pbi ) ; return 0 ; } pbi -> common. error. setjmp = 1 ; vp8_create_common ( & pbi -> common ) ; pbi -> common. current_video_frame = 0 ; pbi -> ready_for_new_data = 1 ; vp8cx_init_de_quantizer ( pbi ) ; vp8_loop_filter_init ( & pbi -> common ) ; pbi -> common. error. setjmp = 0 ; # if CONFIG_ERROR_CONCEALMENT pbi -> ec_enabled = oxcf -> error_concealment ; pbi -> overlaps = NULL ; # else  pbi -> ec_enabled = 0 ; <START_BUG> # endif pbi -> ec_active = 0 ; pbi -> decoded_key_frame = 0 ; pbi -> independent_partitions = 0 ; vp8_setup_block_dptrs ( & pbi -> mb ) ; return pbi ; }<END_BUG>

Fix:
<S2SV_ModStart> return NULL ; memset <S2SV_ModEnd> ( pbi, <S2SV_ModStart> ; # else ( void ) oxcf ;
Buggy code:
 int module_load ( YR_SCAN_CONTEXT * context, YR_OBJECT * module_object, void * module_data, size_t module_data_size ) { set_integer ( 1, module_object, "constants.one" ) ; set_integer ( 2, module_object, "constants.two" ) ; set_string ( "foo", module_object, "constants.foo" ) ; set_string ( "", module_object, "constants.empty" ) ; set_integer ( 1, module_object, "struct_array[1].i" ) ; set_integer ( 0, module_object, "integer_array[%i]", 0 ) ; set_integer ( 1, module_object, "integer_array[%i]", 1 ) ; set_integer ( 2, module_object, "integer_array[%i]", 2 ) ; <START_BUG> set_string ( "foo", module_object, "string_array[%i]", 0 ) ; <END_BUG> set_string ( "bar", module_object, "string_array[%i]", 1 ) ; set_string ( "baz", module_object, "string_array[%i]", 2 ) ; set_sized_string ( "foo\\0bar", 7, module_object, "string_array[%i]", 3 ) ; set_string ( "foo", module_object, "string_dict[%s]", "foo" ) ; set_string ( "bar", module_object, "string_dict[\\"bar\\"]" ) ; set_string ( "foo", module_object, "struct_dict[%s].s", "foo" ) ; set_integer ( 1, module_object, "struct_dict[%s].i", "foo" ) ; return ERROR_SUCCESS ; }

Fix:
<S2SV_ModStart> 2 ) ; set_integer ( 256, module_object, "integer_array[%i]", 256 ) ;
Buggy code:
 static FILE * open_log_file ( void ) { <START_BUG> if ( log_fp ) <END_BUG> return log_fp ; log_fp = fopen ( log_file, "a+" ) ; if ( log_fp == NULL ) {  if ( daemon_mode == FALSE ) { <START_BUG> printf ( "Warning:   Cannot   open   log   file   \'%s\'   for   writing\\n", log_file ) ; <END_BUG> }  return NULL ; } ( void ) fcntl ( fileno ( log_fp ), F_SETFD, FD_CLOEXEC ) ; return log_fp ; }

Fix:
<S2SV_ModStart> void ) { int fh ; struct stat st ; if ( log_fp ) return log_fp ; if ( ( fh = open ( log_file, O_RDWR | O_APPEND | O_CREAT | O_NOFOLLOW, S_IRUSR | S_IWUSR ) ) == - 1 ) { if ( daemon_mode == FALSE ) printf ( "Warning: <S2SV_blank> Cannot <S2SV_blank> open <S2SV_blank> log <S2SV_blank> file <S2SV_blank> \'%s\' <S2SV_blank> for <S2SV_blank> writing\\n", log_file ) ; return NULL ; } log_fp = fdopen ( fh <S2SV_ModEnd>, "a+" ) <S2SV_ModStart> == FALSE ) <S2SV_ModEnd> printf ( "Warning: <S2SV_blank> Cannot <S2SV_blank> open <S2SV_blank> log <S2SV_blank> file <S2SV_blank> \'%s\' <S2SV_blank> for <S2SV_blank> writing\\n" <S2SV_ModStart> log_file ) ; return NULL ; } if ( ( fstat ( fh, & st ) ) == - 1 ) { log_fp = NULL ; close ( fh ) ; if ( daemon_mode == FALSE ) printf ( "Warning: <S2SV_blank> Cannot <S2SV_blank> fstat <S2SV_blank> log <S2SV_blank> file <S2SV_blank> \'%s\'\\n", log_file ) ; return NULL ; } if ( st. st_nlink!= 1 || ( st. st_mode & S_
Buggy code:
 DEFINE_TEST ( test_write_disk_secure ) { # if defined ( _WIN32 ) &&! defined ( __CYGWIN__ ) skipping ( "archive_write_disk   security   checks   not   supported   on   Windows" ) ; # else struct archive * a ; struct archive_entry * ae ; struct stat st ; assertUmask ( UMASK ) ; assert ( ( a = archive_write_disk_new ( ) )!= NULL ) ; assert ( ( ae = archive_entry_new ( ) )!= NULL ) ; archive_entry_copy_pathname ( ae, "dir" ) ; archive_entry_set_mode ( ae, S_IFDIR | 0777 ) ; assert ( 0 == archive_write_header ( a, ae ) ) ; archive_entry_free ( ae ) ; assert ( 0 == archive_write_finish_entry ( a ) ) ; assert ( ( ae = archive_entry_new ( ) )!= NULL ) ; archive_entry_copy_pathname ( ae, "link_to_dir" ) ; archive_entry_set_mode ( ae, S_IFLNK | 0777 ) ; archive_entry_set_symlink ( ae, "dir" ) ; archive_write_disk_set_options ( a, 0 ) ; assert ( 0 == archive_write_header ( a, ae ) ) ; assert ( 0 == archive_write_finish_entry ( a ) ) ; assert ( archive_entry_clear ( ae )!= NULL ) ; archive_entry_copy_pathname ( ae, "link_to_dir//filea" ) ; archive_entry_set_mode ( ae, S_IFREG | 0777 ) ; assert ( 0 == archive_write_header ( a, ae ) ) ; assert ( 0 == archive_write_finish_entry ( a ) ) ; assert ( archive_entry_clear ( ae )!= NULL ) ; archive_entry_copy_pathname ( ae, "link_to_dir//fileb" ) ; archive_entry_set_mode ( ae, S_IFREG | 0777 ) ; archive_write_disk_set_options ( a, ARCHIVE_EXTRACT_SECURE_SYMLINKS ) ; failure ( "Extracting   a   file   through   a   symlink   should   fail   here." ) ; assertEqualInt ( AR

Fix:
<S2SV_ModStart> ae ) ; assert ( ( ae = archive_entry_new ( ) )!= NULL ) ; archive_entry_copy_pathname ( ae, "//tmp//libarchive_test-test_write_disk_secure-absolute_path.tmp" ) ; archive_entry_set_mode ( ae, S_IFREG | 0777 ) ; assert ( 0 == archive_write_header ( a, ae ) ) ; assert ( 0 == archive_write_finish_entry ( a ) ) ; assertFileExists ( "//tmp//libarchive_test-test_write_disk_secure-absolute_path.tmp" ) ; assert ( 0 == unlink ( "//tmp//libarchive_test-test_write_disk_secure-absolute_path.tmp" ) ) ; assert ( archive_entry_clear ( ae )!= NULL ) ; archive_entry_copy_pathname ( ae, "//tmp//libarchive_test-test_write_disk_secure-absolute_path.tmp" ) ; archive_entry_set_mode ( ae, S_IFREG | 0777 ) ; archive_write_disk_set_options ( a, ARCHIVE_EXTRACT_SECURE_NOAB
Buggy code:
 <START_BUG> MB_PREDICTION_MODE vp9_above_block_mode ( const MODE_INFO * cur_mi, <END_BUG> const MODE_INFO * above_mi, int b ) { if ( b == 0 || b == 1 ) { if (! above_mi || is_inter_block ( & above_mi -> mbmi ) ) return DC_PRED ; return get_y_mode ( above_mi, b + 2 ) ; } else { assert ( b == 2 || b == 3 ) ; return cur_mi -> bmi [ b - 2 ]. as_mode ; } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> PREDICTION_MODE <S2SV_ModEnd> vp9_above_block_mode ( const