nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int complete_emulated_mmio ( struct kvm_vcpu * vcpu ) { struct kvm_run * run = vcpu -> run ; struct kvm_mmio_fragment * frag ; unsigned len ; BUG_ON (! vcpu -> mmio_needed ) ; frag = & vcpu -> mmio_fragments [ vcpu -> mmio_cur_fragment ] ; len = min ( 8u, frag -> len ) ; if (! vcpu -> mmio_is_write ) memcpy ( frag -> data, run -> mmio. data, len ) ; if ( frag -> len <= 8 ) { frag ++ ; vcpu -> mmio_cur_fragment ++ ; } else { frag -> data += len ; frag -> gpa += len ; frag -> len -= len ; } <START_BUG> if ( vcpu -> mmio_cur_fragment == vcpu -> mmio_nr_fragments ) { <END_BUG> vcpu -> mmio_needed = 0 ; if ( vcpu -> mmio_is_write ) return 1 ; vcpu -> mmio_read_completed = 1 ; return complete_emulated_io ( vcpu ) ; } run -> exit_reason = KVM_EXIT_MMIO ; run -> mmio. phys_addr = frag -> gpa ; if ( vcpu -> mmio_is_write ) memcpy ( run -> mmio. data, frag -> data, min ( 8u, frag -> len ) ) ; run -> mmio. len = min ( 8u, frag -> len ) ; run -> mmio. is_write = vcpu -> mmio_is_write ; vcpu -> arch. complete_userspace_io = complete_emulated_mmio ; return 0 ; }

Fix:
<S2SV_ModStart> vcpu -> mmio_cur_fragment >= <S2SV_ModEnd> vcpu -> mmio_nr_fragments
Buggy code:
 static int rtl8xxxu_submit_int_urb ( struct ieee80211_hw * hw ) { struct rtl8xxxu_priv * priv = hw -> priv ; struct urb * urb ; u32 val32 ; int ret ; urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! urb ) return - ENOMEM ; usb_fill_int_urb ( urb, priv -> udev, priv -> pipe_interrupt, priv -> int_buf, USB_INTR_CONTENT_LENGTH, rtl8xxxu_int_complete, priv, 1 ) ; usb_anchor_urb ( urb, & priv -> int_anchor ) ; ret = usb_submit_urb ( urb, GFP_KERNEL ) ; if ( ret ) { usb_unanchor_urb ( urb ) ; <START_BUG> goto error ; <END_BUG> } val32 = rtl8xxxu_read32 ( priv, REG_USB_HIMR ) ; val32 |= USB_HIMR_CPWM ; rtl8xxxu_write32 ( priv, REG_USB_HIMR, val32 ) ; error : return ret ; }

Fix:
<S2SV_ModStart> urb ) ; usb_free_urb ( urb ) ;
Buggy code:
 static int ext4_split_extent_at ( handle_t * handle, struct inode * inode, struct ext4_ext_path * path, ext4_lblk_t split, int split_flag, int flags ) { ext4_fsblk_t newblock ; ext4_lblk_t ee_block ; struct ext4_extent * ex, newex, orig_ex ; struct ext4_extent * ex2 = NULL ; unsigned int ee_len, depth ; <START_BUG> int err = 0 ; <END_BUG> ext_debug ( "ext4_split_extents_at:   inode   %lu,   logical" "block   %llu\\n", inode -> i_ino, ( unsigned long long ) split ) ; ext4_ext_show_leaf ( inode, path ) ; depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; ee_block = le32_to_cpu ( ex -> ee_block ) ; ee_len = ext4_ext_get_actual_len ( ex ) ; newblock = split - ee_block + ext4_ext_pblock ( ex ) ; BUG_ON ( split < ee_block || split >= ( ee_block + ee_len ) ) ; err = ext4_ext_get_access ( handle, inode, path + depth ) ; if ( err ) goto out ; if ( split == ee_block ) { if ( split_flag & EXT4_EXT_MARK_UNINIT2 ) ext4_ext_mark_uninitialized ( ex ) ; else ext4_ext_mark_initialized ( ex ) ; if (! ( flags & EXT4_GET_BLOCKS_PRE_IO ) ) ext4_ext_try_to_merge ( handle, inode, path, ex ) ; err = ext4_ext_dirty ( handle, inode, path + path -> p_depth ) ; goto out ; } memcpy ( & orig_ex, ex, sizeof ( orig_ex ) ) ; ex -> ee_len = cpu_to_le16 ( split - ee_block ) ; if ( split_flag & EXT4_EXT_MARK_UNINIT1 ) ext4_ext_mark_uninitialized ( ex ) ; err = ext4_ext_dirty ( handle, inode, path + depth

Fix:
<S2SV_ModStart> err = 0 ; BUG_ON ( ( split_flag & ( EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2 ) ) == ( EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2 ) ) <S2SV_ModStart> ) ) { if ( split_flag & ( EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2 ) ) { if ( split_flag & EXT4_EXT_DATA_VALID1 ) err = ext4_ext_zeroout ( inode, ex2 ) ; else err = ext4_ext_zeroout ( inode, ex ) ; } else
Buggy code:
 Datum varbit_in ( PG_FUNCTION_ARGS ) { char * input_string = PG_GETARG_CSTRING ( 0 ) ; # ifdef NOT_USED Oid typelem = PG_GETARG_OID ( 1 ) ; # endif int32 atttypmod = PG_GETARG_INT32 ( 2 ) ; VarBit * result ; char * sp ; bits8 * r ; int len, bitlen, slen ; bool bit_not_hex ; int bc ; bits8 x = 0 ; if ( input_string [ 0 ] == 'b' || input_string [ 0 ] == 'B' ) { bit_not_hex = true ; sp = input_string + 1 ; } else if ( input_string [ 0 ] == 'x' || input_string [ 0 ] == 'X' ) { bit_not_hex = false ; sp = input_string + 1 ; } else { bit_not_hex = true ; sp = input_string ; } slen = strlen ( sp ) ; if ( bit_not_hex ) bitlen = slen ; else <START_BUG> bitlen = slen * 4 ; <END_BUG> if ( atttypmod <= 0 ) atttypmod = bitlen ; else if ( bitlen > atttypmod ) ereport ( ERROR, ( errcode ( ERRCODE_STRING_DATA_RIGHT_TRUNCATION ), errmsg ( "bit   string   too   long   for   type   bit   varying(%d)", atttypmod ) ) ) ; len = VARBITTOTALLEN ( bitlen ) ; result = ( VarBit * ) palloc0 ( len ) ; SET_VARSIZE ( result, len ) ; VARBITLEN ( result ) = Min ( bitlen, atttypmod ) ; r = VARBITS ( result ) ; if ( bit_not_hex ) { x = HIGHBIT ; for ( ; * sp ; sp ++ ) { if ( * sp == '1' ) * r |= x ; else if ( * sp!= '0' ) ereport ( ERROR, ( errcode ( ERRCODE_INVALID_TEXT_REPRESENTATION ), errmsg ( "\\"%c\\"   is   not   a   valid   binary   digit", * sp ) ) ) ; x >>= 1 ; if ( x == 0 ) { x = HIGHBIT ; r ++ ; } }

Fix:
<S2SV_ModStart> slen ; else { if ( slen > VARBITMAXLEN // 4 ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "bit <S2SV_blank> string <S2SV_blank> length <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", VARBITMAXLEN ) ) ) ; <S2SV_ModStart> * 4 ; }
Buggy code:
 static int fsmMkfile ( rpmfi fi, const char * dest, rpmfiles files, rpmpsm psm, int nodigest, int * setmeta, int * firsthardlink ) { int rc = 0 ; int numHardlinks = rpmfiFNlink ( fi ) ; if ( numHardlinks > 1 ) { if ( * firsthardlink < 0 ) { * firsthardlink = rpmfiFX ( fi ) ; <START_BUG> rc = expandRegular ( fi, dest, psm, nodigest, 1 ) ; <END_BUG> } else { char * fn = rpmfilesFN ( files, * firsthardlink ) ; rc = link ( fn, dest ) ; if ( rc < 0 ) { rc = RPMERR_LINK_FAILED ; } free ( fn ) ; } } if ( numHardlinks <= 1 ) { if (! rc )  rc = expandRegular ( fi, dest, psm, nodigest, 0 ) ; <START_BUG> } else if ( rpmfiArchiveHasContent ( fi ) ) { if (! rc ) <END_BUG> rc = expandRegular ( fi, dest, psm, nodigest, 0 ) ;  * firsthardlink = - 1 ; } else { * setmeta = 0 ; } return rc ; }

Fix:
<S2SV_ModStart>, psm, 1, <S2SV_ModStart>, psm, 1, <S2SV_ModStart>, psm, 0,
Buggy code:
 void qedi_dbg_err ( struct qedi_dbg_ctx * qedi, const char * func, u32 line, const char * fmt,... ) { va_list va ; <START_BUG> struct va_format vaf ; <END_BUG> char nfunc [ 32 ] ; memset ( nfunc, 0, sizeof ( nfunc ) ) ; memcpy ( nfunc, func, sizeof ( nfunc ) - 1 ) ; va_start ( va, fmt ) ; vaf. fmt = fmt ; vaf. va = & va ; if ( likely ( qedi ) && likely ( qedi -> pdev ) ) pr_err ( "[%s]:[%s:%d]:%d:   %pV", dev_name ( & qedi -> pdev -> dev ),  nfunc, line, qedi -> host_no, & vaf ) ; <START_BUG> else <END_BUG> pr_err ( "[0000:00:00.0]:[%s:%d]:   %pV", nfunc, line, & vaf ) ;  va_end ( va ) ; }

Fix:
<S2SV_ModStart> struct va_format vaf <S2SV_ModEnd> ; va_start ( <S2SV_ModStart> dev ), func <S2SV_ModEnd>, line, <S2SV_ModStart> ( "[0000:00:00.0]:[%s:%d]: <S2SV_blank> %pV", func <S2SV_ModEnd>, line,
Buggy code:
 static int add_push_report_sideband_pkt ( git_push * push, git_pkt_data * data_pkt, git_buf * data_pkt_buf ) { git_pkt * pkt ; const char * line, * line_end = NULL ; size_t line_len ; int error ; int reading_from_buf = data_pkt_buf -> size > 0 ; if ( reading_from_buf ) { git_buf_put ( data_pkt_buf, data_pkt -> data, data_pkt -> len ) ; line = data_pkt_buf -> ptr ; line_len = data_pkt_buf -> size ; } else { line = data_pkt -> data ; line_len = data_pkt -> len ; } while ( line_len > 0 ) { error = git_pkt_parse_line ( & pkt, line, & line_end, line_len ) ; if ( error == GIT_EBUFS ) { if (! reading_from_buf ) git_buf_put ( data_pkt_buf, line, line_len ) ; error = 0 ; goto done ; } else if ( error < 0 ) goto done ; line_len -= ( line_end - line ) ; line = line_end ; <START_BUG> if ( pkt == NULL ) <END_BUG> continue ; error = add_push_report_pkt ( push, pkt ) ; git_pkt_free ( pkt ) ; if ( error < 0 && error!= GIT_ITEROVER ) goto done ; } error = 0 ; done : if ( reading_from_buf ) git_buf_consume ( data_pkt_buf, line_end ) ; return error ; }

Fix:
<S2SV_ModStart> = line_end ; <S2SV_ModEnd> error = add_push_report_pkt
Buggy code:
 static vpx_codec_err_t validate_config ( vpx_codec_alg_priv_t * ctx, const vpx_codec_enc_cfg_t * cfg, const struct vp8_extracfg * vp8_cfg, int finalize ) { RANGE_CHECK ( cfg, g_w, 1, 16383 ) ; RANGE_CHECK ( cfg, g_h, 1, 16383 ) ; RANGE_CHECK ( cfg, g_timebase. den, 1, 1000000000 ) ; <START_BUG> RANGE_CHECK ( cfg, g_timebase. num, 1, cfg -> g_timebase. den ) ; <END_BUG> RANGE_CHECK_HI ( cfg, g_profile, 3 ) ; RANGE_CHECK_HI ( cfg, rc_max_quantizer, 63 ) ; RANGE_CHECK_HI ( cfg, rc_min_quantizer, cfg -> rc_max_quantizer ) ; RANGE_CHECK_HI ( cfg, g_threads, 64 ) ; # if CONFIG_REALTIME_ONLY RANGE_CHECK_HI ( cfg, g_lag_in_frames, 0 ) ; # elif CONFIG_MULTI_RES_ENCODING if ( ctx -> base. enc. total_encoders > 1 ) RANGE_CHECK_HI ( cfg, g_lag_in_frames, 0 ) ; # else RANGE_CHECK_HI ( cfg, g_lag_in_frames, 25 ) ; # endif RANGE_CHECK ( cfg, rc_end_usage, VPX_VBR, VPX_Q ) ; RANGE_CHECK_HI ( cfg, rc_undershoot_pct, 1000 ) ; RANGE_CHECK_HI ( cfg, rc_overshoot_pct, 1000 ) ; RANGE_CHECK_HI ( cfg, rc_2pass_vbr_bias_pct, 100 ) ; RANGE_CHECK ( cfg, kf_mode, VPX_KF_DISABLED, VPX_KF_AUTO ) ; # if CONFIG_MULTI_RES_ENCODING if ( ctx -> base. enc. total_encoders > 1 ) RANGE_CHECK_HI ( cfg, rc_resize_allowed, 0 ) ; # else RANGE_CHECK_BOOL ( cfg, rc_resize_allowed ) ; # endif RANGE_CHECK_HI ( cfg

Fix:
<S2SV_ModStart>, 1, 1000000000 <S2SV_ModEnd> ) ; RANGE_CHECK_HI <S2SV_ModStart> 0, 63 ) ; RANGE_CHECK_HI ( vp8_cfg, screen_content_mode, 2 <S2SV_ModStart> - 1 ] && cfg -> rc_target_bitrate > 0
Buggy code:
 <START_BUG> static void prefetch_table ( const volatile byte * tab, size_t len ) <END_BUG> { size_t i ;  for ( i = 0 ; i < len ; i += 8 * 32 ) <START_BUG> { ( void ) tab [ i + 0 * 32 ] ; ( void ) tab [ i + 1 * 32 ] ; ( void ) tab [ i + 2 * 32 ] ; ( void ) tab [ i + 3 * 32 ] ; ( void ) tab [ i + 4 * 32 ] ; ( void ) tab [ i + 5 * 32 ] ; ( void ) tab [ i + 6 * 32 ] ; ( void ) tab [ i + 7 * 32 ] ; } <END_BUG> ( void ) tab [ len - 1 ] ;  }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static inline <S2SV_ModStart> = 0 ; len - i >= 8 * 32 <S2SV_ModEnd> ; i += <S2SV_ModStart> ] ; } for ( ; i < len ; i += 32 ) { ( void ) tab [ i ] ; }
Buggy code:
 static bool CopyKeyAliasesToKeymap ( struct xkb_keymap * keymap, KeyNamesInfo * info ) { AliasInfo * alias ; unsigned i, num_key_aliases ; struct xkb_key_alias * key_aliases ; num_key_aliases = 0 ; darray_foreach ( alias, info -> aliases ) { if (! XkbKeyByName ( keymap, alias -> real, false ) ) { log_vrb ( info -> ctx, 5, "Attempt   to   alias   %s   to   non-existent   key   %s;   Ignored\\n", KeyNameText ( info -> ctx, alias -> alias ), KeyNameText ( info -> ctx, alias -> real ) ) ; alias -> real = XKB_ATOM_NONE ; continue ; } if ( XkbKeyByName ( keymap, alias -> alias, false ) ) { log_vrb ( info -> ctx, 5, "Attempt   to   create   alias   with   the   name   of   a   real   key;   " "Alias   \\"%s   =   %s\\"   ignored\\n", KeyNameText ( info -> ctx, alias -> alias ), KeyNameText ( info -> ctx, alias -> real ) ) ; alias -> real = XKB_ATOM_NONE ; continue ; } num_key_aliases ++ ; } key_aliases = NULL ; if ( num_key_aliases > 0 ) { key_aliases = calloc ( num_key_aliases, sizeof ( * key_aliases ) ) ; if (! key_aliases ) return false ; <START_BUG> } <END_BUG> i = 0 ; darray_foreach ( alias, info -> aliases ) { if ( alias -> real!= XKB_ATOM_NONE ) { key_aliases [ i ]. alias = alias -> alias ; key_aliases [ i ]. real = alias -> real ; i ++ ; } }  keymap -> num_key_aliases = num_key_aliases ; <START_BUG> keymap -> key_aliases = key_aliases ; return true ; }<END_BUG>

Fix:
<S2SV_ModStart> return false ; <S2SV_ModEnd> i = 0 <S2SV_ModStart> ; } } }
Buggy code:
 rfbBool rfbHandleAuthResult ( rfbClient * client ) { <START_BUG> uint32_t authResult = 0, reasonLen = 0 ; <END_BUG> char * reason = NULL ; if (! ReadFromRFBServer ( client, ( char * ) & authResult, 4 ) ) return FALSE ; authResult = rfbClientSwap32IfLE ( authResult ) ; switch ( authResult ) { case rfbVncAuthOK : rfbClientLog ( "VNC   authentication   succeeded\\n" ) ; return TRUE ; break ; case rfbVncAuthFailed : if ( client -> major == 3 && client -> minor > 7 ) {  if (! ReadFromRFBServer ( client, ( char * ) & reasonLen, 4 ) ) return FALSE ; <START_BUG> reasonLen = rfbClientSwap32IfLE ( reasonLen ) ; reason = malloc ( ( uint64_t ) reasonLen + 1 ) ; if (! ReadFromRFBServer ( client, reason, reasonLen ) ) { free ( reason ) ; return FALSE ; } reason [ reasonLen ] = 0 ; rfbClientLog ( "VNC   connection   failed:   %s\\n", reason ) ; free ( reason ) ; return FALSE ; } rfbClientLog ( "VNC   authentication   failed\\n" ) ; return FALSE ; case rfbVncAuthTooMany : rfbClientLog ( "VNC   authentication   failed   -   too   many   tries\\n" ) ; return FALSE ; } rfbClientLog ( "Unknown   VNC   authentication   result:   %d\\n", ( int ) authResult ) ; return FALSE ; }<END_BUG>

Fix:
<S2SV_ModStart> authResult = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> 7 ) { ReadReason ( client <S2SV_ModEnd> ) ; return
Buggy code:
 static void handle_associated_event ( struct cpu_hw_events * cpuc, int idx, struct perf_sample_data * data, struct pt_regs * regs ) { struct perf_event * event = cpuc -> events [ idx ] ; struct hw_perf_event * hwc = & event -> hw ; mipspmu_event_update ( event, hwc, idx ) ; data -> period = event -> hw. last_period ; if (! mipspmu_event_set_period ( event, hwc, idx ) ) return ; <START_BUG> if ( perf_event_overflow ( event, 0, data, regs ) ) <END_BUG> mipspmu -> disable_event ( idx ) ; }

Fix:
<S2SV_ModStart> ( event, <S2SV_ModEnd> data, regs
Buggy code:
 static void test_burl_normalize ( void ) { buffer * psrc = buffer_init ( ) ; buffer * ptmp = buffer_init ( ) ; int flags ; flags = HTTP_PARSEOPT_URL_NORMALIZE_UNRESERVED ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "no-slash" ), CONST_STR_LEN ( "no-slash" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//" ), CONST_STR_LEN ( "//" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc" ), CONST_STR_LEN ( "//abc" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc//" ), CONST_STR_LEN ( "//abc//" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc//def" ), CONST_STR_LEN ( "//abc//def" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc?" ), CONST_STR_LEN ( "//abc?" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc?d" ), CONST_STR_LEN ( "//abc?d" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc?d=" ), CONST_STR_LEN ( "//abc?d=" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc?d=e" ), CONST_STR_LEN ( "//abc?d=e" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//abc?d=e&" ), CONST_STR_LEN ( "//abc?d=e&" ) ) ; run_burl

Fix:
<S2SV_ModStart>, CONST_STR_LEN ( "%2f?" ), CONST_STR_LEN ( "//?" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN ( "//%2f?" ), CONST_STR_LEN ( "////?" ) ) ; run_burl_normalize ( psrc, ptmp, flags, __LINE__, CONST_STR_LEN (
Buggy code:
 static int show_stream ( WriterContext * w, AVFormatContext * fmt_ctx, int stream_idx, InputStream * ist, int in_program ) { AVStream * stream = ist -> st ; AVCodecParameters * par ; AVCodecContext * dec_ctx ; char val_str [ 128 ] ; const char * s ; AVRational sar, dar ; AVBPrint pbuf ; const AVCodecDescriptor * cd ; int ret = 0 ; const char * profile = NULL ; av_bprint_init ( & pbuf, 1, AV_BPRINT_SIZE_UNLIMITED ) ; writer_print_section_header ( w, in_program? SECTION_ID_PROGRAM_STREAM : SECTION_ID_STREAM ) ; print_int ( "index", stream -> index ) ; par = stream -> codecpar ; dec_ctx = ist -> dec_ctx ; if ( cd = avcodec_descriptor_get ( par -> codec_id ) ) { print_str ( "codec_name", cd -> name ) ; if (! do_bitexact ) { print_str ( "codec_long_name", cd -> long_name? cd -> long_name : "unknown" ) ; } } else { print_str_opt ( "codec_name", "unknown" ) ; if (! do_bitexact ) { print_str_opt ( "codec_long_name", "unknown" ) ; } } if (! do_bitexact && ( profile = avcodec_profile_name ( par -> codec_id, par -> profile ) ) ) print_str ( "profile", profile ) ; else { if ( par -> profile!= FF_PROFILE_UNKNOWN ) { char profile_num [ 12 ] ; snprintf ( profile_num, sizeof ( profile_num ), "%d", par -> profile ) ; print_str ( "profile", profile_num ) ; } else print_str_opt ( "profile", "unknown" ) ; } s = av_get_media_type_string ( par -> codec_type ) ; if ( s ) print_str ( "codec_type", s ) ; else print_str_opt ( "codec_type", "unknown" ) ; # if FF_API_LAVF_AVCTX if ( dec_ctx ) print_q

Fix:
<S2SV_ModStart> ) ) ; print_primaries ( w, <S2SV_ModEnd> par -> color_primaries <S2SV_ModStart> par -> color_primaries <S2SV_ModEnd> ) ; if
Buggy code:
 static int mpeg4_decode_studio_block ( MpegEncContext * s, int32_t block [ 64 ], int n ) { Mpeg4DecContext * ctx = s -> avctx -> priv_data ; int cc, dct_dc_size, dct_diff, code, j, idx = 1, group = 0, run = 0, additional_code_len, sign, mismatch ; VLC * cur_vlc = & ctx -> studio_intra_tab [ 0 ] ; uint8_t * const scantable = s -> intra_scantable. permutated ; const uint16_t * quant_matrix ; uint32_t flc ; const int min = - 1 * ( 1 << ( s -> avctx -> bits_per_raw_sample + 6 ) ) ; const int max = ( ( 1 << ( s -> avctx -> bits_per_raw_sample + 6 ) ) - 1 ) ; mismatch = 1 ; memset ( block, 0, 64 * sizeof ( int32_t ) ) ; if ( n < 4 ) { cc = 0 ; dct_dc_size = get_vlc2 ( & s -> gb, ctx -> studio_luma_dc. table, STUDIO_INTRA_BITS, 2 ) ; quant_matrix = s -> intra_matrix ; } else { cc = ( n & 1 ) + 1 ; if ( ctx -> rgb ) dct_dc_size = get_vlc2 ( & s -> gb, ctx -> studio_luma_dc. table, STUDIO_INTRA_BITS, 2 ) ; else dct_dc_size = get_vlc2 ( & s -> gb, ctx -> studio_chroma_dc. table, STUDIO_INTRA_BITS, 2 ) ; quant_matrix = s -> chroma_intra_matrix ; } if ( dct_dc_size < 0 ) { av_log ( s -> avctx, AV_LOG_ERROR, "illegal   dct_dc_size   vlc\\n" ) ; return AVERROR_INVALIDDATA ; } else if ( dct_dc_size == 0 ) { dct_diff = 0 ; } else { dct_diff = get_xbits ( & s -> gb, dct_dc_size ) ; if (

Fix:
<S2SV_ModStart> += run ; if ( idx > 63 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> 20 ) { if ( idx > 63 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> 21 ) { if ( idx > 63 ) return AVERROR_INVALIDDATA ;
Buggy code:
 static int udf_symlink_filler ( struct file * file, struct page * page ) { struct inode * inode = page -> mapping -> host ; struct buffer_head * bh = NULL ; unsigned char * symlink ; int err ; unsigned char * p = kmap ( page ) ; struct udf_inode_info * iinfo ; uint32_t pos ; if ( inode -> i_size > inode -> i_sb -> s_blocksize ) { err = - ENAMETOOLONG ; goto out_unmap ; } iinfo = UDF_I ( inode ) ; pos = udf_block_map ( inode, 0 ) ; down_read ( & iinfo -> i_data_sem ) ; if ( iinfo -> i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ) { symlink = iinfo -> i_ext. i_data + iinfo -> i_lenEAttr ; } else { bh = sb_bread ( inode -> i_sb, pos ) ; if (! bh ) { err = - EIO ; goto out_unlock_inode ; } symlink = bh -> b_data ; } <START_BUG> udf_pc_to_char ( inode -> i_sb, symlink, inode -> i_size, p ) ; <END_BUG>  brelse ( bh ) ; <START_BUG> up_read ( & iinfo -> i_data_sem ) ; SetPageUptodate ( page ) ; kunmap ( page ) ; unlock_page ( page ) ; return 0 ; out_unlock_inode : up_read ( & iinfo -> i_data_sem ) ; SetPageError ( page ) ; out_unmap : kunmap ( page ) ; unlock_page ( page ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> b_data ; } err = <S2SV_ModStart> i_size, p, PAGE_SIZE <S2SV_ModStart> ( bh ) ; if ( err ) goto out_unlock_inode
Buggy code:
 static int server_input_global_request ( int type, u_int32_t seq, void * ctxt ) { char * rtype ; int want_reply ; int r, success = 0, allocated_listen_port = 0 ; struct sshbuf * resp = NULL ; rtype = packet_get_string ( NULL ) ; want_reply = packet_get_char ( ) ; debug ( "server_input_global_request:   rtype   %s   want_reply   %d", rtype, want_reply ) ; if ( strcmp ( rtype, "tcpip-forward" ) == 0 ) { struct passwd * pw ; struct Forward fwd ; pw = the_authctxt -> pw ; if ( pw == NULL ||! the_authctxt -> valid ) fatal ( "server_input_global_request:   no//invalid   user" ) ; memset ( & fwd, 0, sizeof ( fwd ) ) ; fwd. listen_host = packet_get_string ( NULL ) ; fwd. listen_port = ( u_short ) packet_get_int ( ) ; debug ( "server_input_global_request:   tcpip-forward   listen   %s   port   %d", fwd. listen_host, fwd. listen_port ) ; if ( ( options. allow_tcp_forwarding & FORWARD_REMOTE ) == 0 || no_port_forwarding_flag || options. disable_forwarding || (! want_reply && fwd. listen_port == 0 ) || ( fwd. listen_port!= 0 &&! bind_permitted ( fwd. listen_port, pw -> pw_uid ) ) ) { success = 0 ; packet_send_debug ( "Server   has   disabled   port   forwarding." ) ; } else { success = channel_setup_remote_fwd_listener ( & fwd, & allocated_listen_port, & options. fwd_opts ) ; } free ( fwd. listen_host ) ; if ( ( resp = sshbuf_new ( ) ) == NULL ) fatal ( "%s:   sshbuf_new", __func__ ) ; if ( allocated_listen_port!= 0 && ( r = sshbuf_put_u32 ( resp, allocated_listen_port ) )!= 0 ) fatal ( "%s:   sshbuf_put_u32:   %s", __func

Fix:
<S2SV_ModStart> options. disable_forwarding ||! use_privsep
Buggy code:
 static int snd_seq_device_dev_free ( struct snd_device * device ) { struct snd_seq_device * dev = device -> device_data ; <START_BUG> put_device ( & dev -> dev ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> -> device_data ; cancel_autoload_drivers ( ) ;
Buggy code:
 <START_BUG> static const char * parse_string ( cJSON * item, const char * str ) <END_BUG> {  const char * ptr = str + 1 ; <START_BUG> char * ptr2 ; char * out ; int len = 0 ; unsigned uc, uc2 ; if ( * str!= \'\\"\' ) { <END_BUG> ep = str ;  <START_BUG> return 0 ; <END_BUG> }  while ( * ptr!= \'\\"\' && * ptr && ++ len ) <START_BUG> <END_BUG> if ( * ptr ++ == '\\\\' )  <START_BUG> ptr ++ ; <END_BUG>  if (! ( out = ( char * ) cJSON_malloc ( len + 1 ) ) ) <START_BUG> return 0 ; ptr = str + 1 ; ptr2 = out ; <END_BUG> while ( * ptr!= \'\\"\' && * ptr ) {  if ( * ptr!= '\\\\' ) * ptr2 ++ = * ptr ++ ; else { ptr ++ ; switch ( * ptr ) { case 'b' : * ptr2 ++ = '\\b' ; break ; case 'f' : * ptr2 ++ = '\\f' ; break ; case 'n' : * ptr2 ++ = '\\n' ; break ; case 'r' : * ptr2 ++ = '\\r' ; break ; case 't' : * ptr2 ++ = '\\t' ; break ; case 'u' : <START_BUG> sscanf ( ptr + 1, "%4x", & uc ) ; <END_BUG>  ptr += 4 ; <START_BUG> if ( ( uc >= 0xDC00 && uc <= 0xDFFF ) || uc == 0 ) <END_BUG> break ;  <START_BUG> if ( uc >= 0xD800 && uc <= 0xDBFF ) { <END_BUG> if ( ptr [ 1 ]!= '\\\\' || ptr [ 2 ]!= 'u' )  break ; <START_BUG> <END_BUG> sscanf ( ptr + 3, "%4x", & uc2 ) ;  ptr += 6 ; if ( uc2 < 0xDC00 || uc2 > 0xDFFF ) <START_BUG> break ; <END_BUG>  uc = 0x10000 | ( ( uc & 0x3FF ) << 10 ) | ( uc2 & 0x3FF ) ; <START_BUG> } len = 4 ; if ( uc < 0x80 ) <END_BUG> len = 1 ;  else if ( uc < 0x800 ) len = 2 ; else if ( uc < 0x10000 ) len = 3 ; ptr2 += len ; switch ( len ) { case 4 : * -- ptr2 = ( ( uc |

Fix:
<S2SV_ModStart> char * str, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * * ep ) { const char * ptr = str + 1, * end_ptr = str + 1 ; char * ptr2 ; char * <S2SV_ModEnd> out ; int <S2SV_ModStart> \'\\"\' ) { * <S2SV_ModStart> = str ; return 0 ; <S2SV_ModEnd> } while ( <S2SV_ModStart> while ( * end_ptr <S2SV_ModEnd>!= \'\\"\' && <S2SV_ModStart> \'\\"\' && * end_ptr <S2SV_ModEnd> && ++ len <S2SV_ModStart> ++ len ) if ( * end_ptr <S2SV_ModEnd> ++ == '\\\\' <S2SV_ModStart> == '\\\\' ) end_ptr ++ ; out = ( char * ) cJSON_malloc ( len + 1 ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> if (! out ) return 0 ; item -> valuestring <S2SV_ModEnd> = out ; <S2SV_ModStart> = out ; item -> type = cJSON_String ; ptr = str + 1 ; ptr2 = out ; while ( ptr < end_ptr ) <S2SV_ModEnd> { if ( <S2SV_ModStart> case 'u' : uc = parse_hex4 ( ptr + 1 ) ; <S2SV_ModEnd> ptr += 4 <S2SV_ModStart> += 4 ; if ( ptr >= end_ptr ) { * ep = str ; return 0 ; } <S2SV_ModStart> == 0 ) { * ep = str ; return 0 ; } <S2SV_ModEnd> if ( uc <S2SV_ModStart> <=
Buggy code:
 u_int fr_print ( netdissect_options * ndo, register const u_char * p, u_int length ) { int ret ; uint16_t extracted_ethertype ; u_int dlci ; u_int addr_len ; uint16_t nlpid ; u_int hdr_len ; uint8_t flags [ 4 ] ; ret = parse_q922_addr ( ndo, p, & dlci, & addr_len, flags, length ) ; if ( ret == - 1 ) goto trunc ; if ( ret == 0 ) { ND_PRINT ( ( ndo, "Q.922,   invalid   address" ) ) ; return 0 ; } ND_TCHECK ( p [ addr_len ] ) ; if ( length < addr_len + 1 ) goto trunc ; if ( p [ addr_len ]!= LLC_UI && dlci!= 0 ) { if (! ND_TTEST2 ( p [ addr_len ], 2 ) || length < addr_len + 2 ) { ND_PRINT ( ( ndo, "UI   %02x!   ", p [ addr_len ] ) ) ; } else { extracted_ethertype = EXTRACT_16BITS ( p + addr_len ) ; if ( ndo -> ndo_eflag ) fr_hdr_print ( ndo, length, addr_len, dlci, flags, extracted_ethertype ) ; if ( ethertype_print ( ndo, extracted_ethertype, p + addr_len + ETHERTYPE_LEN, length - addr_len - ETHERTYPE_LEN, ndo -> ndo_snapend - p - addr_len - ETHERTYPE_LEN, NULL, NULL ) == 0 ) ND_PRINT ( ( ndo, "UI   %02x!   ", p [ addr_len ] ) ) ; else return addr_len + 2 ; } } ND_TCHECK ( p [ addr_len + 1 ] ) ; if ( length < addr_len + 2 ) goto trunc ; if ( p [ addr_len + 1 ] == 0 ) { if ( addr_len!= 3 ) ND_PRINT ( ( ndo, "Pad!   " ) ) ; hdr_len = addr_len + 1 + 1 + 1 ; } else { if (

Fix:
<S2SV_ModStart> length + 1 ) ; break ; case NLPID_SNAP : if ( snap_print ( ndo, p, length <S2SV_ModStart> ndo_snapend - p <S2SV_ModEnd>, NULL,
Buggy code:
 int sctp_do_peeloff ( struct sock * sk, sctp_assoc_t id, struct socket * * sockp ) { struct sctp_association * asoc = sctp_id2assoc ( sk, id ) ; struct sctp_sock * sp = sctp_sk ( sk ) ; struct socket * sock ; <START_BUG> int err = 0 ; <END_BUG> if (! asoc ) return - EINVAL ; if ( waitqueue_active ( & asoc -> wait ) ) return - EBUSY ; if (! sctp_style ( sk, UDP ) ) return - EINVAL ; err = sock_create ( sk -> sk_family, SOCK_SEQPACKET, IPPROTO_SCTP, & sock ) ; if ( err < 0 ) return err ; sctp_copy_sock ( sock -> sk, sk, asoc ) ; sp -> pf -> to_sk_daddr ( & asoc -> peer. primary_addr, sk ) ; sctp_sock_migrate ( sk, sock -> sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH ) ; * sockp = sock ; return err ; }

Fix:
<S2SV_ModStart> err = 0 ; if (! net_eq ( current -> nsproxy -> net_ns, sock_net ( sk ) ) ) return - EINVAL
Buggy code:
 static int em_ret ( struct x86_emulate_ctxt * ctxt ) { <START_BUG> ctxt -> dst. type = OP_REG ; <END_BUG> ctxt -> dst. addr. reg = & ctxt -> _eip ;  ctxt -> dst. bytes = ctxt -> op_bytes ; <START_BUG> return em_pop ( ctxt ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ctxt ) { int rc ; unsigned long eip ; rc = emulate_pop ( ctxt, & eip, <S2SV_ModEnd> ctxt -> op_bytes <S2SV_ModStart> ctxt -> op_bytes ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; return assign_eip_near ( ctxt, eip <S2SV_ModEnd> ) ; }
Buggy code:
 static int mobility_opt_print ( netdissect_options * ndo, const u_char * bp, const unsigned len ) { unsigned i, optlen ; for ( i = 0 ; i < len ; i += optlen ) { ND_TCHECK ( bp [ i ] ) ; if ( bp [ i ] == IP6MOPT_PAD1 ) optlen = 1 ; else { if ( i + 1 < len ) { ND_TCHECK ( bp [ i + 1 ] ) ; optlen = bp [ i + 1 ] + 2 ; } else goto trunc ; } if ( i + optlen > len ) goto trunc ; ND_TCHECK ( bp [ i + optlen ] ) ; switch ( bp [ i ] ) { case IP6MOPT_PAD1 : ND_PRINT ( ( ndo, "(pad1)" ) ) ; break ; case IP6MOPT_PADN : if ( len - i < IP6MOPT_MINLEN ) { ND_PRINT ( ( ndo, "(padn:   trunc)" ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "(padn)" ) ) ; break ; case IP6MOPT_REFRESH : if ( len - i < IP6MOPT_REFRESH_MINLEN ) { ND_PRINT ( ( ndo, "(refresh:   trunc)" ) ) ; goto trunc ; } ND_TCHECK_16BITS ( & bp [ i + 2 ] ) ; ND_PRINT ( ( ndo, "(refresh:   %u)", EXTRACT_16BITS ( & bp [ i + 2 ] ) << 2 ) ) ; break ; case IP6MOPT_ALTCOA : if ( len - i < IP6MOPT_ALTCOA_MINLEN ) { ND_PRINT ( ( ndo, "(altcoa:   trunc)" ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "(alt-CoA:   %s)", ip6addr_string ( ndo, & bp [ i + 2 ] ) ) ) ; break ; case IP6MOPT_NONCEID : if ( len - i < IP6MOPT_NONCEID_MINLEN ) { ND_PRINT ( ( ndo, "(ni:   trunc)" ) ) ; goto trunc ; }

Fix:
<S2SV_ModStart> trunc ; } ND_TCHECK_16BITS ( & bp [ i + 2 ] ) ; ND_TCHECK_16BITS ( & bp [ i + 4 ] ) ;
Buggy code:
 void choose_windows ( s ) const char * s ; { <START_BUG> register int i ; <END_BUG> for ( i = 0 ; winchoices [ i ]. procs ; i ++ ) { if ( '+' == winchoices [ i ]. procs -> name [ 0 ] ) continue ; if ( '-' == winchoices [ i ]. procs -> name [ 0 ] ) continue ; if (! strcmpi ( s, winchoices [ i ]. procs -> name ) ) { windowprocs = * winchoices [ i ]. procs ; if ( last_winchoice && last_winchoice -> ini_routine ) ( * last_winchoice -> ini_routine ) ( WININIT_UNDO ) ; if ( winchoices [ i ]. ini_routine ) ( * winchoices [ i ]. ini_routine ) ( WININIT ) ; last_winchoice = & winchoices [ i ] ; return ; } } if (! windowprocs. win_raw_print ) windowprocs. win_raw_print = def_raw_print ; if (! windowprocs. win_wait_synch ) windowprocs. win_wait_synch = def_wait_synch ; if (! winchoices [ 0 ]. procs ) {  raw_printf ( "No   window   types?" ) ; <START_BUG> nh_terminate ( EXIT_FAILURE ) ; <END_BUG> }  if (! winchoices [ 1 ]. procs ) { config_error_add ( "Window   type   %s   not   recognized.     The   only   choice   is:   %s", s, winchoices [ 0 ]. procs -> name ) ; } else { char buf [ BUFSZ ] ; boolean first = TRUE ; buf [ 0 ] = '\\0' ; for ( i = 0 ; winchoices [ i ]. procs ; i ++ ) { if ( '+' == winchoices [ i ]. procs -> name [ 0 ] ) continue ; if ( '-' == winchoices [ i ]. procs -> name [ 0 ] ) continue ; Sprintf ( eos ( buf ), "%s%s", first? "" : ",   ", winchoices [ i ]. procs -> name ) ; first = FALSE ; } config_error_add ( "Window   type   %s   not   recognized.     Choices   are:     %s", s, buf ) ; } <START_BUG> if ( windowprocs. win<END_BUG>

Fix:
<S2SV_ModStart> s ; { int i ; char * tmps = 0 <S2SV_ModEnd> ; for ( <S2SV_ModStart> { raw_printf ( "No <S2SV_blank> window <S2SV_blank> types <S2SV_blank> supported?" <S2SV_ModEnd> ) ; nh_terminate <S2SV_ModStart> ) ; } # define WINDOW_TYPE_MAXLEN 50 if ( strlen ( s ) >= WINDOW_TYPE_MAXLEN ) { tmps = ( char * ) alloc ( WINDOW_TYPE_MAXLEN ) ; ( void ) strncpy ( tmps, s, WINDOW_TYPE_MAXLEN - 1 ) ; tmps [ WINDOW_TYPE_MAXLEN - 1 ] = '\\0' ; s = tmps ; } # undef WINDOW_TYPE_MAXLEN <S2SV_ModStart> } if ( tmps ) free ( ( genericptr_t ) tmps ) ; if (
Buggy code:
 void impeg2d_flush_ext_and_user_data ( dec_state_t * ps_dec ) { UWORD32 u4_start_code ; stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; <START_BUG> while ( u4_start_code == EXTENSION_START_CODE || u4_start_code == USER_DATA_START_CODE ) <END_BUG> { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ;  while ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_PREFIX_LEN )!= START_CODE_PREFIX ) <START_BUG> { impeg2d_bit_stream_flush ( ps_stream, 8 ) ; } u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> ; while ( ( <S2SV_ModStart> u4_start_code == USER_DATA_START_CODE ) && ( ps_stream -> u4_offset < ps_stream -> u4_max_offset ) <S2SV_ModStart> )!= START_CODE_PREFIX && ( ps_stream -> u4_offset < ps_stream -> u4_max_offset )
Buggy code:
 struct bio * bio_map_user_iov ( struct request_queue * q, const struct iov_iter * iter, gfp_t gfp_mask ) { int j ; int nr_pages = 0 ; struct page * * pages ; struct bio * bio ; int cur_page = 0 ; int ret, offset ; struct iov_iter i ; struct iovec iov ; iov_for_each ( iov, i, * iter ) { unsigned long uaddr = ( unsigned long ) iov. iov_base ; unsigned long len = iov. iov_len ; unsigned long end = ( uaddr + len + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; unsigned long start = uaddr >> PAGE_SHIFT ; if ( end < start ) return ERR_PTR ( - EINVAL ) ; nr_pages += end - start ; if ( uaddr & queue_dma_alignment ( q ) ) return ERR_PTR ( - EINVAL ) ; } if (! nr_pages ) return ERR_PTR ( - EINVAL ) ; bio = bio_kmalloc ( gfp_mask, nr_pages ) ; if (! bio ) return ERR_PTR ( - ENOMEM ) ; ret = - ENOMEM ; pages = kcalloc ( nr_pages, sizeof ( struct page * ), gfp_mask ) ; if (! pages ) goto out ; iov_for_each ( iov, i, * iter ) { unsigned long uaddr = ( unsigned long ) iov. iov_base ; unsigned long len = iov. iov_len ; unsigned long end = ( uaddr + len + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; unsigned long start = uaddr >> PAGE_SHIFT ; const int local_nr_pages = end - start ; const int page_limit = cur_page + local_nr_pages ; ret = get_user_pages_fast ( uaddr, local_nr_pages, ( iter -> type & WRITE )!= WRITE, & pages [ cur_page ] ) ; if ( ret < local_nr_pages ) { ret = - EFAULT ; goto out_unmap ; } offset = offset_in_page ( uaddr ) ; for ( j = cur_page ; j < page_limit ; j ++ ) { unsigned int bytes

Fix:
<S2SV_ModStart> - offset ; unsigned short prev_bi_vcnt = bio -> bi_vcnt ; <S2SV_ModStart> ) break ; if ( bio -> bi_vcnt == prev_bi_vcnt ) put_page ( pages [ j ] ) ;
Buggy code:
 opj_pi_iterator_t * opj_pi_create_decode ( opj_image_t * p_image, opj_cp_t * p_cp, OPJ_UINT32 p_tile_no ) { OPJ_UINT32 pino ; OPJ_UINT32 compno, resno ; OPJ_UINT32 * l_tmp_data ; OPJ_UINT32 * * l_tmp_ptr ; OPJ_UINT32 l_max_res ; OPJ_UINT32 l_max_prec ; OPJ_INT32 l_tx0, l_tx1, l_ty0, l_ty1 ; OPJ_UINT32 l_dx_min, l_dy_min ; OPJ_UINT32 l_bound ; OPJ_UINT32 l_step_p, l_step_c, l_step_r, l_step_l ; OPJ_UINT32 l_data_stride ; opj_pi_iterator_t * l_pi = 00 ; opj_tcp_t * l_tcp = 00 ; const opj_tccp_t * l_tccp = 00 ; opj_pi_comp_t * l_current_comp = 00 ; opj_image_comp_t * l_img_comp = 00 ; opj_pi_iterator_t * l_current_pi = 00 ; OPJ_UINT32 * l_encoding_value_ptr = 00 ; assert ( p_cp!= 00 ) ; assert ( p_image!= 00 ) ; assert ( p_tile_no < p_cp -> tw * p_cp -> th ) ; l_tcp = & p_cp -> tcps [ p_tile_no ] ; l_bound = l_tcp -> numpocs + 1 ; l_data_stride = 4 * OPJ_J2K_MAXRLVLS ; l_tmp_data = ( OPJ_UINT32 * ) opj_malloc ( l_data_stride * p_image -> numcomps * sizeof ( OPJ_UINT32 ) ) ; if (! l_tmp_data ) { return 00 ; } l_tmp_ptr = ( OPJ_UINT32 * * ) opj_m

Fix:
<S2SV_ModStart> opj_calloc ( ( size_t ) ( <S2SV_ModStart> -> numlayers + 1U <S2SV_ModEnd> ) * l_step_l
Buggy code:
 static int vfio_msi_enable ( struct vfio_pci_device * vdev, int nvec, bool msix ) { struct pci_dev * pdev = vdev -> pdev ; unsigned int flag = msix? PCI_IRQ_MSIX : PCI_IRQ_MSI ; int ret ; if (! is_irq_none ( vdev ) ) return - EINVAL ; <START_BUG> vdev -> ctx = kzalloc ( nvec * sizeof ( struct vfio_pci_irq_ctx ), GFP_KERNEL ) ; <END_BUG> if (! vdev -> ctx ) return - ENOMEM ; ret = pci_alloc_irq_vectors ( pdev, 1, nvec, flag ) ; if ( ret < nvec ) { if ( ret > 0 ) pci_free_irq_vectors ( pdev ) ; kfree ( vdev -> ctx ) ; return ret ; } vdev -> num_ctx = nvec ; vdev -> irq_type = msix? VFIO_PCI_MSIX_IRQ_INDEX : VFIO_PCI_MSI_IRQ_INDEX ; if (! msix ) { vdev -> msi_qmax = fls ( nvec * 2 - 1 ) - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> -> ctx = kcalloc ( nvec, <S2SV_ModEnd> sizeof ( struct
Buggy code:
 static int compile_search ( struct Context * ctx, const struct Pattern * pat, struct Buffer * buf ) { if ( do_search ( pat, 0 ) == 0 ) return 0 ; if ( pat -> not ) mutt_buffer_addstr ( buf, "NOT   " ) ; if ( pat -> child ) { int clauses ; clauses = do_search ( pat -> child, 1 ) ; if ( clauses > 0 ) { const struct Pattern * clause = pat -> child ; mutt_buffer_addch ( buf, '(' ) ; while ( clauses ) { if ( do_search ( clause, 0 ) ) { if ( pat -> op == MUTT_OR && clauses > 1 ) mutt_buffer_addstr ( buf, "OR   " ) ; clauses -- ; if ( compile_search ( ctx, clause, buf ) < 0 ) return - 1 ; if ( clauses ) mutt_buffer_addch ( buf,' ') ; } clause = clause -> next ; } mutt_buffer_addch ( buf, ')' ) ; } } else { char term [ STRING ] ; char * delim = NULL ; switch ( pat -> op ) { case MUTT_HEADER : mutt_buffer_addstr ( buf, "HEADER   " ) ; delim = strchr ( pat -> p. str, ':' ) ; if (! delim ) { mutt_error ( _ ( "Header   search   without   header   name:   %s" ), pat -> p. str ) ; return - 1 ; } * delim = '\\0' ; <START_BUG> imap_quote_string ( term, sizeof ( term ), pat -> p. str ) ; <END_BUG> mutt_buffer_addstr ( buf, term ) ; mutt_buffer_addch ( buf,' ') ; * delim = ':' ; delim ++ ; SKIPWS ( delim ) ;  imap_quote_string ( term, sizeof ( term ), delim ) ; <START_BUG> mutt_buffer_addstr ( buf, term ) ; break ; case MUTT_BODY : mutt_buffer_addstr ( buf, "BODY   " ) ; <END_BUG> imap_quote_string ( term, sizeof ( term ), pat -> p. str ) ;  mutt_buffer_addstr ( buf, term ) ; break ; case MUTT_WHOLE_MSG : mutt_buffer

Fix:
<S2SV_ModStart> p. str, false <S2SV_ModStart> ), delim, false <S2SV_ModStart> p. str, false <S2SV_ModStart> p. str, false <S2SV_ModStart> p. str, false
Buggy code:
 PHP_MINIT_FUNCTION ( spl_array ) { REGISTER_SPL_STD_CLASS_EX ( ArrayObject, spl_array_object_new, spl_funcs_ArrayObject ) ; REGISTER_SPL_IMPLEMENTS ( ArrayObject, Aggregate ) ; REGISTER_SPL_IMPLEMENTS ( ArrayObject, ArrayAccess ) ; REGISTER_SPL_IMPLEMENTS ( ArrayObject, Serializable ) ; REGISTER_SPL_IMPLEMENTS ( ArrayObject, Countable ) ; memcpy ( & spl_handler_ArrayObject, zend_get_std_object_handlers ( ), sizeof ( zend_object_handlers ) ) ; spl_handler_ArrayObject. clone_obj = spl_array_object_clone ; spl_handler_ArrayObject. read_dimension = spl_array_read_dimension ; spl_handler_ArrayObject. write_dimension = spl_array_write_dimension ; spl_handler_ArrayObject. unset_dimension = spl_array_unset_dimension ; spl_handler_ArrayObject. has_dimension = spl_array_has_dimension ; spl_handler_ArrayObject. count_elements = spl_array_object_count_elements ; spl_handler_ArrayObject. get_properties = spl_array_get_properties ; <START_BUG> spl_handler_ArrayObject. get_debug_info = spl_array_get_debug_info ; <END_BUG> spl_handler_ArrayObject. read_property = spl_array_read_property ; spl_handler_ArrayObject. write_property = spl_array_write_property ; spl_handler_ArrayObject. get_property_ptr_ptr = spl_array_get_property_ptr_ptr ; spl_handler_ArrayObject. has_property = spl_array_has_property ; spl_handler_ArrayObject. unset_property = spl_array_unset_property ; spl_handler_ArrayObject. compare_objects = spl_array_compare_objects ; REGISTER_SPL_STD_CLASS_EX ( ArrayIterator, spl_array_object_new, spl_funcs_ArrayIterator ) ; REGISTER_SPL_IMPLEMENTS ( ArrayIterator, Iterator ) ; REGISTER_SPL_IMPLEMENTS ( ArrayIterator, ArrayAccess ) ; REGISTER_SPL_IMPLEMENTS ( ArrayIterator, SeekableIterator ) ; REGISTER_SPL_IMP

Fix:
<S2SV_ModStart> get_debug_info = spl_array_get_debug_info ; spl_handler_ArrayObject. get_gc = spl_array_get_gc
Buggy code:
 static int <START_BUG> mptctl_do_mpt_command ( struct mpt_ioctl_command karg, void __user * mfPtr ) <END_BUG> {  MPT_ADAPTER * ioc ; <START_BUG> MPT_FRAME_HDR * mf = NULL ; MPIHeader_t * hdr ; char * psge ; struct buflist bufIn ; struct buflist bufOut ; dma_addr_t dma_addr_in ; dma_addr_t dma_addr_out ; int sgSize = 0 ; <END_BUG> int iocnum, flagsLength ;  int sz, rc = 0 ; int msgContext ; u16 req_idx ; ulong timeout ; unsigned long timeleft ; struct scsi_device * sdev ; unsigned long flags ; u8 function ; bufIn. kptr = bufOut. kptr = NULL ; bufIn. len = bufOut. len = 0 ; <START_BUG> if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || <END_BUG> ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_do_mpt_command()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } spin_lock_irqsave ( & ioc -> taskmgmt_lock, flags ) ; if ( ioc -> ioc_reset_in_progress ) { spin_unlock_irqrestore ( & ioc -> taskmgmt_lock, flags ) ; printk ( KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command   -   " "Busy   with   diagnostic   reset\\n", __FILE__, __LINE__ ) ; return - EBUSY ; } spin_unlock_irqrestore ( & ioc -> taskmgmt_lock, flags ) ; if ( karg. maxReplyBytes < 0 || karg. dataInSize < 0 || karg. dataOutSize < 0 || karg. dataSgeOffset < 0 || karg. maxSenseBytes < 0 || karg. dataSgeOffset > ioc -> req_sz // 4 ) return - EINVAL ; sz = karg. dataSgeOffset *

Fix:
<S2SV_ModStart> int mptctl_do_mpt_command ( MPT_ADAPTER * ioc, <S2SV_ModStart> mfPtr ) { <S2SV_ModEnd> MPT_FRAME_HDR * mf <S2SV_ModStart> 0 ; int <S2SV_ModEnd> flagsLength ; int <S2SV_ModStart> = 0 ; <S2SV_ModEnd> spin_lock_irqsave ( &
Buggy code:
 static void interp_reply ( netdissect_options * ndo, const struct sunrpc_msg * rp, uint32_t proc, uint32_t vers, int length ) { register const uint32_t * dp ; register int v3 ; int er ; v3 = ( vers == NFS_VER3 ) ; if (! v3 && proc < NFS_NPROCS ) proc = nfsv3_procid [ proc ] ; ND_PRINT ( ( ndo, "   %s", tok2str ( nfsproc_str, "proc-%u", proc ) ) ) ; switch ( proc ) { case NFSPROC_GETATTR : dp = parserep ( ndo, rp, length ) ; if ( dp!= NULL && parseattrstat ( ndo, dp,! ndo -> ndo_qflag, v3 )!= 0 ) return ; break ; case NFSPROC_SETATTR : if (! ( dp = parserep ( ndo, rp, length ) ) ) return ; if ( v3 ) { if ( parsewccres ( ndo, dp, ndo -> ndo_vflag ) ) return ; } else { if ( parseattrstat ( ndo, dp,! ndo -> ndo_qflag, 0 )!= 0 ) return ; } break ; case NFSPROC_LOOKUP : if (! ( dp = parserep ( ndo, rp, length ) ) ) break ; if ( v3 ) { if (! ( dp = parsestatus ( ndo, dp, & er ) ) ) break ; if ( er ) { if ( ndo -> ndo_vflag > 1 ) { ND_PRINT ( ( ndo, "   post   dattr:" ) ) ; dp = parse_post_op_attr ( ndo, dp, ndo -> ndo_vflag ) ; } } else { if (! ( dp = parsefh ( ndo, dp, v3 ) ) ) break ; if ( ( dp = parse_post_op_attr ( ndo, dp, ndo -> ndo_vflag ) ) && ndo -> ndo_vflag > 1 ) { ND_PRINT ( ( ndo, "   post   dattr:" ) ) ; dp = parse_post_op_attr ( n

Fix:
<S2SV_ModStart>! er ) { ND_TCHECK ( <S2SV_ModEnd> dp [ 0 <S2SV_ModStart> 0 ] ) ; ND_PRINT ( ( ndo, " <S2SV_blank> c <S2SV_blank> %04x", EXTRACT_32BITS ( & dp [ 0 ] ) ) ) ; } <S2SV_ModEnd> return ; case
Buggy code:
 static Image * ExtractPostscript ( Image * image, const ImageInfo * image_info, MagickOffsetType PS_Offset, ssize_t PS_Size, ExceptionInfo * exception ) { char postscript_file [ MagickPathExtent ] ; const MagicInfo * magic_info ; FILE * ps_file ; ImageInfo * clone_info ; Image * image2 ; unsigned char magick [ 2 * MagickPathExtent ] ; if ( ( clone_info = CloneImageInfo ( image_info ) ) == NULL ) return ( image ) ; clone_info -> blob = ( void * ) NULL ; clone_info -> length = 0 ; ( void ) AcquireUniqueFilename ( postscript_file ) ; ps_file = fopen_utf8 ( postscript_file, "wb" ) ; if ( ps_file == ( FILE * ) NULL ) goto FINISH ; ( void ) SeekBlob ( image, PS_Offset, SEEK_SET ) ; ( void ) ReadBlob ( image, 2 * MagickPathExtent, magick ) ; ( void ) SeekBlob ( image, PS_Offset, SEEK_SET ) ; while ( PS_Size -- > 0 ) { ( void ) fputc ( ReadBlobByte ( image ), ps_file ) ; } ( void ) fclose ( ps_file ) ; magic_info = GetMagicInfo ( magick, 2 * MagickPathExtent, exception ) ; if ( magic_info == ( const MagicInfo * ) NULL ) goto FINISH_UNL ; if ( exception -> severity!= UndefinedException ) goto FINISH_UNL ; if ( magic_info -> name == ( char * ) NULL ) goto FINISH_UNL ; <START_BUG> ( void ) CopyMagickMemory ( clone_info -> magick, magic_info -> name, MagickPathExtent ) ; <END_BUG> FormatLocaleString ( clone_info -> filename, MagickPathExtent, "%s", postscript_file ) ; image2 = ReadImage ( clone_info, exception ) ; if (! image2 ) goto FINISH_UNL ; ( void ) CopyMagickMemory ( image2 -> filename, image -> filename, MagickPathExtent ) ; ( void ) CopyMagickMemory ( image2 -> magick_filename, image -> magick_filename, MagickPathExtent ) ; ( void ) CopyMagickMemory ( image2 -> magick, image -> magick, MagickPathExtent

Fix:
<S2SV_ModStart> ( void ) strncpy <S2SV_ModEnd> ( clone_info ->
Buggy code:
 int snmp_helper ( void * context, size_t hdrlen, unsigned char tag, const void * data, size_t datalen ) { struct snmp_ctx * ctx = ( struct snmp_ctx * ) context ; <START_BUG> __be32 * pdata = ( __be32 * ) data ; <END_BUG> if ( * pdata == ctx -> from ) { pr_debug ( "%s:   %pI4   to   %pI4\\n", __func__, ( void * ) & ctx -> from, ( void * ) & ctx -> to ) ; if ( * ctx -> check ) fast_csum ( ctx, ( unsigned char * ) data - ctx -> begin ) ; * pdata = ctx -> to ; } return 1 ; }

Fix:
<S2SV_ModStart> ; __be32 * pdata ; if ( datalen!= 4 ) return - EINVAL ;
Buggy code:
 u_int mfr_print ( netdissect_options * ndo, register const u_char * p, u_int length ) { u_int tlen, idx, hdr_len = 0 ; uint16_t sequence_num ; uint8_t ie_type, ie_len ; const uint8_t * tptr ; ND_TCHECK2 ( * p, 4 ) ; if ( ( p [ 0 ] & MFR_BEC_MASK ) == MFR_CTRL_FRAME && p [ 1 ] == 0 ) { ND_PRINT ( ( ndo, "FRF.16   Control,   Flags   [%s],   %s,   length   %u", bittok2str ( frf_flag_values, "none", ( p [ 0 ] & MFR_BEC_MASK ) ), tok2str ( mfr_ctrl_msg_values, "Unknown   Message   (0x%02x)", p [ 2 ] ), length ) ) ; tptr = p + 3 ; tlen = length - 3 ; hdr_len = 3 ; if (! ndo -> ndo_vflag ) return hdr_len ; while ( tlen > sizeof ( struct ie_tlv_header_t ) ) { ND_TCHECK2 ( * tptr, sizeof ( struct ie_tlv_header_t ) ) ; ie_type = tptr [ 0 ] ; ie_len = tptr [ 1 ] ; ND_PRINT ( ( ndo, "\\n\\tIE   %s   (%u),   length   %u:   ", tok2str ( mfr_ctrl_ie_values, "Unknown", ie_type ), ie_type, ie_len ) ) ; if ( ie_type == 0 || ie_len <= sizeof ( struct ie_tlv_header_t ) ) return hdr_len ; ND_TCHECK2 ( * tptr, ie_len ) ; tptr += sizeof ( struct ie_tlv_header_t ) ; ie_len -= sizeof ( struct ie_tlv_header_t ) ; tlen -= sizeof ( struct ie_tlv_header_t ) ; switch ( ie_type ) { <START_BUG> case MFR_CTRL_IE_MAGIC_NUM : <END_BUG> ND_PRINT

Fix:
<S2SV_ModStart> case MFR_CTRL_IE_MAGIC_NUM : if ( ie_len!= 4 ) { ND_PRINT ( ( ndo, "(invalid <S2SV_blank> length)" ) ) ; break ; }
Buggy code:
 static void setup_token_decoder ( VP8D_COMP * pbi, const unsigned char * token_part_sizes ) { vp8_reader * bool_decoder = & pbi -> mbc [ 0 ] ; unsigned int partition_idx ; unsigned int fragment_idx ; unsigned int num_token_partitions ; const unsigned char * first_fragment_end = pbi -> fragments. ptrs [ 0 ] + pbi -> fragments. sizes [ 0 ] ; TOKEN_PARTITION multi_token_partition = ( TOKEN_PARTITION ) vp8_read_literal ( & pbi -> mbc [ 8 ], 2 ) ; if (! vp8dx_bool_error ( & pbi -> mbc [ 8 ] ) ) pbi -> common. multi_token_partition = multi_token_partition ; num_token_partitions = 1 << pbi -> common. multi_token_partition ; for ( fragment_idx = 0 ; fragment_idx < pbi -> fragments. count ; ++ fragment_idx ) { unsigned int fragment_size = pbi -> fragments. sizes [ fragment_idx ] ; const unsigned char * fragment_end = pbi -> fragments. ptrs [ fragment_idx ] + fragment_size ; if ( fragment_idx == 0 ) { ptrdiff_t ext_first_part_size = token_part_sizes - pbi -> fragments. ptrs [ 0 ] + 3 * ( num_token_partitions - 1 ) ; fragment_size -= ( unsigned int ) ext_first_part_size ; if ( fragment_size > 0 ) { pbi -> fragments. sizes [ 0 ] = ( unsigned int ) ext_first_part_size ; fragment_idx ++ ; pbi -> fragments. ptrs [ fragment_idx ] = pbi -> fragments. ptrs [ 0 ] + pbi -> fragments. sizes [ 0 ] ; } } while ( fragment_size > 0 ) { ptrdiff_t partition_size = read_available_partition_size ( pbi, token_part_sizes, pbi -> fragments. ptrs [ fragment_idx ], first_fragment_end, fragment_end, fragment_idx - 1, num_token_partitions ) ; pbi -> fragments. sizes [ fragment_idx ] = ( unsigned int ) partition_size ; fragment_size -= ( unsigned int ) partition_size ; assert ( fragment_idx

Fix:
<S2SV_ModStart> - 1 ) { <S2SV_ModStart> - 1 ; } if ( pbi -> decoding_thread_count > pbi -> common. mb_rows - 1 ) { pbi -> decoding_thread_count = pbi -> common. mb_rows - 1 ; }