nus-yam/ex-repair huggingface dataset:
Buggy code:
 int jas_seq2d_output ( jas_matrix_t * matrix, FILE * out ) { # define MAXLINELEN 80 <START_BUG> int i ; <END_BUG> int j ; jas_seqent_t x ; char buf [ MAXLINELEN + 1 ] ; char sbuf [ MAXLINELEN + 1 ] ; int n ; fprintf ( out, "%" PRIiFAST32 "   %" PRIiFAST32 "\\n", jas_seq2d_xstart ( matrix ), jas_seq2d_ystart ( matrix ) ) ; fprintf ( out, "%" PRIiFAST32 "   %" PRIiFAST32 "\\n", jas_matrix_numcols ( matrix ), jas_matrix_numrows ( matrix ) ) ; buf [ 0 ] = '\\0' ; for ( i = 0 ; i < jas_matrix_numrows ( matrix ) ; ++ i ) { for ( j = 0 ; j < jas_matrix_numcols ( matrix ) ; ++ j ) { x = jas_matrix_get ( matrix, i, j ) ; sprintf ( sbuf, "%s%4ld", ( strlen ( buf ) > 0 )? "   " : "", JAS_CAST ( long, x ) ) ; n = JAS_CAST ( int, strlen ( buf ) ) ; if ( n + JAS_CAST ( int, strlen ( sbuf ) ) > MAXLINELEN ) { fputs ( buf, out ) ; fputs ( "\\n", out ) ; buf [ 0 ] = '\\0' ; } strcat ( buf, sbuf ) ; if ( j == jas_matrix_numcols ( matrix ) - 1 ) { fputs ( buf, out ) ; fputs ( "\\n", out ) ; buf [ 0 ] = '\\0' ; } } } fputs ( buf, out ) ; return 0 ; }

Fix:
<S2SV_ModStart> define MAXLINELEN 80 jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; jas_seqent_t
Buggy code:
 static unsigned xen_netbk_tx_build_gops ( struct xen_netbk * netbk ) { struct gnttab_copy * gop = netbk -> tx_copy_ops, * request_gop ; struct sk_buff * skb ; int ret ; while ( ( ( nr_pending_reqs ( netbk ) + MAX_SKB_FRAGS ) < MAX_PENDING_REQS ) &&! list_empty ( & netbk -> net_schedule_list ) ) { struct xenvif * vif ; struct xen_netif_tx_request txreq ; struct xen_netif_tx_request txfrags [ MAX_SKB_FRAGS ] ; struct page * page ; struct xen_netif_extra_info extras [ XEN_NETIF_EXTRA_TYPE_MAX - 1 ] ; u16 pending_idx ; RING_IDX idx ; int work_to_do ; unsigned int data_len ; pending_ring_idx_t index ; vif = poll_net_schedule_list ( netbk ) ; if (! vif ) continue ; <START_BUG> RING_FINAL_CHECK_FOR_REQUESTS ( & vif -> tx, work_to_do ) ; <END_BUG> if (! work_to_do ) { xenvif_put ( vif ) ; continue ; } idx = vif -> tx. req_cons ; rmb ( ) ; memcpy ( & txreq, RING_GET_REQUEST ( & vif -> tx, idx ), sizeof ( txreq ) ) ; if ( txreq. size > vif -> remaining_credit && tx_credit_exceeded ( vif, txreq. size ) ) { xenvif_put ( vif ) ; continue ; } vif -> remaining_credit -= txreq. size ; work_to_do -- ; vif -> tx. req_cons = ++ idx ; memset ( extras, 0, sizeof ( extras ) ) ; if ( txreq. flags & XEN_NETTXF_extra_info ) { work_to_do = xen_netbk_get_extras ( vif, extras, work_to_do ) ; idx = vif -> tx. req_cons ;  if ( unlikely ( work_to_do < 0 ) ) { <START_BUG> netbk_tx_err ( v<END_BUG>

Fix:
<S2SV_ModStart> ) continue ; if ( vif -> tx. sring -> req_prod - vif -> tx. req_cons > XEN_NETIF_TX_RING_SIZE ) { netdev_err ( vif -> dev, "Impossible <S2SV_blank> number <S2SV_blank> of <S2SV_blank> requests. <S2SV_blank> " "req_prod <S2SV_blank> %d, <S2SV_blank> req_cons <S2SV_blank> %d, <S2SV_blank> size <S2SV_blank> %ld\\n", vif -> tx. sring -> req_prod, vif -> tx. req_cons, XEN_NETIF_TX_RING_SIZE ) ; netbk_fatal_tx_err ( vif ) ; continue ; } <S2SV_ModStart> 0 ) ) continue ; <S2SV_ModEnd> } ret = <S2SV_ModStart> 0 ) ) continue ; <S2SV_ModEnd> idx += ret <S2SV_ModStart> ) ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> size ) ; netbk_fatal_tx_err ( vif <S2SV_ModEnd> ) ; continue <S2SV_ModStart> skb ) ; <S2SV_ModEnd> continue ; }
Buggy code:
 <START_BUG> static int _nfs4_do_open ( struct inode * dir, struct path * path, int flags, struct iattr * sattr, struct rpc_cred * cred, struct nfs4_state * * res ) <END_BUG> { struct nfs4_state_owner * sp ; struct nfs4_state * state = NULL ; struct nfs_server * server = NFS_SERVER ( dir ) ; struct nfs4_opendata * opendata ; int status ; status = - ENOMEM ; if (! ( sp = nfs4_get_state_owner ( server, cred ) ) ) { dprintk ( "nfs4_do_open:   nfs4_get_state_owner   failed!\\n" ) ; goto out_err ; } status = nfs4_recover_expired_lease ( server ) ; if ( status!= 0 ) goto err_put_state_owner ; if ( path -> dentry -> d_inode!= NULL )  nfs4_return_incompatible_delegation ( path -> dentry -> d_inode, flags & ( FMODE_READ | FMODE_WRITE ) ) ; <START_BUG> status = - ENOMEM ; <END_BUG> opendata = nfs4_opendata_alloc ( path, sp, flags, sattr ) ;  if ( opendata == NULL ) goto err_put_state_owner ; if ( path -> dentry -> d_inode!= NULL ) opendata -> state = nfs4_get_open_state ( path -> dentry -> d_inode, sp ) ; status = _nfs4_proc_open ( opendata ) ; if ( status!= 0 ) goto err_opendata_put ; if ( opendata -> o_arg. open_flags & O_EXCL ) nfs4_exclusive_attrset ( opendata, sattr ) ; state = nfs4_opendata_to_nfs4_state ( opendata ) ; status = PTR_ERR ( state ) ; if ( IS_ERR ( state ) ) goto err_opendata_put ; nfs4_opendata_put ( opendata ) ; nfs4_put_state_owner ( sp ) ; * res = state ; return 0 ; err_opendata

Fix:
<S2SV_ModStart> * path, fmode_t fmode, <S2SV_ModStart> -> d_inode, fmode <S2SV_ModEnd> ) ; status <S2SV_ModStart> path, sp, fmode
Buggy code:
 static int mailimf_group_parse ( const char * message, size_t length, size_t * indx, struct mailimf_group * * result ) { size_t cur_token ; char * display_name ; struct mailimf_mailbox_list * mailbox_list ; struct mailimf_group * group ; int r ; int res ; <START_BUG> cur_token = * indx ; <END_BUG> mailbox_list = NULL ; r = mailimf_display_name_parse ( message, length, & cur_token, & display_name ) ; if ( r!= MAILIMF_NO_ERROR ) { res = r ; goto err ; } r = mailimf_colon_parse ( message, length, & cur_token ) ; if ( r!= MAILIMF_NO_ERROR ) { res = r ; goto free_display_name ; } r = mailimf_mailbox_list_parse ( message, length, & cur_token, & mailbox_list ) ; switch ( r ) { case MAILIMF_NO_ERROR : break ; case MAILIMF_ERROR_PARSE : r = mailimf_cfws_parse ( message, length, & cur_token ) ; if ( ( r!= MAILIMF_NO_ERROR ) && ( r!= MAILIMF_ERROR_PARSE ) ) {  res = r ; <START_BUG> goto free_display_name ; } break ; default : res = r ; goto free_display_name ; } r = mailimf_semi_colon_parse ( message, length, & cur_token ) ; if ( r!= MAILIMF_NO_ERROR ) { res = r ; goto free_mailbox_list ; } group = mailimf_group_new ( display_name, mailbox_list ) ; if ( group == NULL ) { res = MAILIMF_ERROR_MEMORY ; goto free_mailbox_list ; } * indx = cur_token ; * result = group ; return MAILIMF_NO_ERROR ; free_mailbox_list : if ( mailbox_list!= NULL ) { mailimf_mailbox_list_free ( mailbox_list ) ; } free_display_name : mailimf_display_name_free ( display_name ) ; err : return res ; }<END_BUG>

Fix:
<S2SV_ModStart> int res ; clist * list ; <S2SV_ModStart> res = r ; goto free_display_name ; } list = clist_new ( ) ; if ( list == NULL ) { res = MAILIMF_ERROR_MEMORY ; goto free_display_name ; } mailbox_list = mailimf_mailbox_list_new ( list ) ; if ( mailbox_list == NULL ) { res = MAILIMF_ERROR_MEMORY ; clist_free ( list )
Buggy code:
 void receive_tcppacket ( connection_t * c, const char * buffer, int len ) { <START_BUG> vpn_packet_t outpkt ; <END_BUG> outpkt. len = len ; if ( c -> options & OPTION_TCPONLY ) outpkt. priority = 0 ; else outpkt. priority = - 1 ; memcpy ( outpkt. data, buffer, len ) ; receive_packet ( c -> node, & outpkt ) ; }

Fix:
<S2SV_ModStart> { vpn_packet_t outpkt ; if ( len > sizeof outpkt. data ) return
Buggy code:
 static int vmci_transport_dgram_dequeue ( struct kiocb * kiocb, struct vsock_sock * vsk, struct msghdr * msg, size_t len, int flags ) { int err ; int noblock ; struct vmci_datagram * dg ; size_t payload_len ; struct sk_buff * skb ; noblock = flags & MSG_DONTWAIT ; if ( flags & MSG_OOB || flags & MSG_ERRQUEUE ) return - EOPNOTSUPP ; <START_BUG> err = 0 ; <END_BUG> skb = skb_recv_datagram ( & vsk -> sk, flags, noblock, & err ) ; if ( err ) return err ; if (! skb ) return - EAGAIN ; dg = ( struct vmci_datagram * ) skb -> data ; if (! dg ) goto out ; payload_len = dg -> payload_size ; if ( payload_len!= skb -> len - sizeof ( * dg ) ) { err = - EINVAL ; goto out ; } if ( payload_len > len ) { payload_len = len ; msg -> msg_flags |= MSG_TRUNC ; } err = skb_copy_datagram_iovec ( skb, sizeof ( * dg ), msg -> msg_iov, payload_len ) ; if ( err ) goto out ;  msg -> msg_namelen = 0 ; <START_BUG> if ( msg -> msg_name ) { struct sockaddr_vm * vm_addr ; vm_addr = ( struct sockaddr_vm * ) msg -> msg_name ; vsock_addr_init ( vm_addr, dg -> src. context, dg -> src. resource ) ; msg -> msg_namelen = sizeof ( * vm_addr ) ; } err = payload_len ; out : skb_free_datagram ( & vsk -> sk, skb ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> - EOPNOTSUPP ; msg -> msg_namelen = 0 ; <S2SV_ModStart> goto out ; <S2SV_ModEnd> if ( msg
Buggy code:
 int ASN1_verify ( i2d_of_void * i2d, X509_ALGOR * a, ASN1_BIT_STRING * signature, char * data, EVP_PKEY * pkey ) { EVP_MD_CTX ctx ; const EVP_MD * type ; unsigned char * p, * buf_in = NULL ; int ret = - 1, i, inl ; EVP_MD_CTX_init ( & ctx ) ; i = OBJ_obj2nid ( a -> algorithm ) ; type = EVP_get_digestbyname ( OBJ_nid2sn ( i ) ) ; if ( type == NULL ) { ASN1err ( ASN1_F_ASN1_VERIFY, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ) ; goto err ; } <START_BUG> inl = i2d ( data, NULL ) ; <END_BUG> buf_in = OPENSSL_malloc ( ( unsigned int ) inl ) ; if ( buf_in == NULL ) { ASN1err ( ASN1_F_ASN1_VERIFY, ERR_R_MALLOC_FAILURE ) ; goto err ; } p = buf_in ; i2d ( data, & p ) ; ret = EVP_VerifyInit_ex ( & ctx, type, NULL ) && EVP_VerifyUpdate ( & ctx, ( unsigned char * ) buf_in, inl ) ; OPENSSL_cleanse ( buf_in, ( unsigned int ) inl ) ; OPENSSL_free ( buf_in ) ; if (! ret ) { ASN1err ( ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB ) ; goto err ; } ret = - 1 ; if ( EVP_VerifyFinal ( & ctx, ( unsigned char * ) signature -> data, ( unsigned int ) signature -> length, pkey ) <= 0 ) { ASN1err ( ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB ) ; ret = 0 ; goto err ; } ret = 1 ; err : EVP_MD_CTX_cleanup ( & ctx ) ; return ( ret ) ; }

Fix:
<S2SV_ModStart> err ; } if ( signature -> type == V_ASN1_BIT_STRING && signature -> flags & 0x7 ) { ASN1err ( ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT ) ; goto err ; }
Buggy code:
 char * irc_ctcp_dcc_filename_without_quotes ( const char * filename ) { int length ; length = strlen ( filename ) ; <START_BUG> if ( length > 0 ) <END_BUG> { if ( ( filename [ 0 ] == \'\\"\' ) && ( filename [ length - 1 ] == \'\\"\' ) ) return weechat_strndup ( filename + 1, length - 2 ) ; } return strdup ( filename ) ; }

Fix:
<S2SV_ModStart> ( length > 1 <S2SV_ModEnd> ) { if
Buggy code:
 static int get_linux_shareopts ( const char * shareopts, char * * plinux_opts ) { int rc ; assert ( plinux_opts!= NULL ) ; * plinux_opts = NULL ; ( void ) add_linux_shareopt ( plinux_opts, "no_subtree_check", NULL ) ; ( void ) add_linux_shareopt ( plinux_opts, "no_root_squash", NULL ) ; ( void ) add_linux_shareopt ( plinux_opts, "mountpoint", NULL ) ; <START_BUG> rc = foreach_nfs_shareopt ( shareopts, get_linux_shareopts_cb, <END_BUG> plinux_opts ) ; if ( rc!= SA_OK ) { free ( * plinux_opts ) ; * plinux_opts = NULL ; } return ( rc ) ; }

Fix:
<S2SV_ModStart> ; rc = foreach_shareopt <S2SV_ModEnd> ( shareopts,
Buggy code:
 static int m_authenticate ( struct Client * client_p, struct Client * source_p, int parc, const char * parv [ ] ) { struct Client * agent_p = NULL ; struct Client * saslserv_p = NULL ; if (! IsCapable ( source_p, CLICAP_SASL ) ) return 0 ; if ( strlen ( client_p -> id ) == 3 ) { <START_BUG> exit_client ( client_p, client_p, client_p, "Mixing   client   and   server   protocol" ) ; <END_BUG> return 0 ; } saslserv_p = find_named_client ( ConfigFileEntry. sasl_service ) ; if ( saslserv_p == NULL ||! IsService ( saslserv_p ) ) { sendto_one ( source_p, form_str ( ERR_SASLABORTED ), me. name, EmptyString ( source_p -> name )? "*" : source_p -> name ) ; return 0 ; } if ( source_p -> localClient -> sasl_complete ) { * source_p -> localClient -> sasl_agent = '\\0' ; source_p -> localClient -> sasl_complete = 0 ; } if ( strlen ( parv [ 1 ] ) > 400 ) { sendto_one ( source_p, form_str ( ERR_SASLTOOLONG ), me. name, EmptyString ( source_p -> name )? "*" : source_p -> name ) ; return 0 ; } if (! * source_p -> id ) { strcpy ( source_p -> id, generate_uid ( ) ) ; add_to_id_hash ( source_p -> id, source_p ) ; } if ( * source_p -> localClient -> sasl_agent ) agent_p = find_id ( source_p -> localClient -> sasl_agent ) ; if ( agent_p == NULL ) { sendto_one ( saslserv_p, ":%s   ENCAP   %s   SASL   %s   %s   H   %s   %s", me. id, saslserv_p -> servptr -> name, source_p -> id, saslserv_p -> id, source_p -> host, source_p -> sockhost ) ; if

Fix:
<S2SV_ModStart> client_p, "Mixing <S2SV_blank> client <S2SV_blank> and <S2SV_blank> server <S2SV_blank> protocol" ) ; return 0 ; } if ( * parv [ 1 ] == ':' || strchr ( parv [ 1 ],'<S2SV_blank>') ) { exit_client ( client_p, client_p, client_p, "Malformed <S2SV_blank> AUTHENTICATE"
Buggy code:
 static int fpAcc ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; uint32 bps = tif -> tif_dir. td_bitspersample // 8 ; tmsize_t wc = cc // bps ; tmsize_t count = cc ; uint8 * cp = ( uint8 * ) cp0 ; <START_BUG> uint8 * tmp = ( uint8 * ) _TIFFmalloc ( cc ) ; <END_BUG> if ( cc % ( bps * stride )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "fpAcc", "%s", "cc%(bps*stride))!=0" ) ; return 0 ; }  if (! tmp ) <START_BUG> return 0 ; while ( count > stride ) { REPEAT4 ( stride, cp [ stride ] = ( unsigned char ) ( ( cp [ stride ] + cp [ 0 ] ) & 0xff ) ; cp ++ ) count -= stride ; } _TIFFmemcpy ( tmp, cp0, cc ) ; cp = ( uint8 * ) cp0 ; for ( count = 0 ; count < wc ; count ++ ) { uint32 byte ; for ( byte = 0 ; byte < bps ; byte ++ ) { # if WORDS_BIGENDIAN cp [ bps * count + byte ] = tmp [ byte * wc + count ] ; # else cp [ bps * count + byte ] = tmp [ ( bps - byte - 1 ) * wc + count ] ; # endif } } _TIFFfree ( tmp ) ; return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> uint8 * tmp <S2SV_ModEnd> ; if ( <S2SV_ModStart> 0 ; } tmp = ( uint8 * ) _TIFFmalloc ( cc ) ;
Buggy code:
 static VALUE cState_array_nl_set ( VALUE self, VALUE array_nl ) { unsigned long len ; GET_STATE ( self ) ; Check_Type ( array_nl, T_STRING ) ; len = RSTRING_LEN ( array_nl ) ; if ( len == 0 ) { if ( state -> array_nl ) { ruby_xfree ( state -> array_nl ) ; state -> array_nl = NULL ; } } else { if ( state -> array_nl ) ruby_xfree ( state -> array_nl ) ; <START_BUG> state -> array_nl = strdup ( RSTRING_PTR ( array_nl ) ) ; <END_BUG> state -> array_nl_len = len ; } return Qnil ; }

Fix:
<S2SV_ModStart> -> array_nl = fstrndup <S2SV_ModEnd> ( RSTRING_PTR ( <S2SV_ModStart> ( array_nl ), len
Buggy code:
 static Image * ReadPSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BoundingBox "BoundingBox:" # define BeginDocument "BeginDocument:" # define BeginXMPPacket "<?xpacket   begin=" # define EndXMPPacket "<?xpacket   end=" # define ICCProfile "BeginICCProfile:" # define CMYKCustomColor "CMYKCustomColor:" # define CMYKProcessColor "CMYKProcessColor:" # define DocumentMedia "DocumentMedia:" # define DocumentCustomColors "DocumentCustomColors:" # define DocumentProcessColors "DocumentProcessColors:" # define EndDocument "EndDocument:" # define HiResBoundingBox "HiResBoundingBox:" # define ImageData "ImageData:" # define PageBoundingBox "PageBoundingBox:" # define LanguageLevel "LanguageLevel:" # define PageMedia "PageMedia:" # define Pages "Pages:" # define PhotoshopProfile "BeginPhotoshop:" # define PostscriptLevel "!PS-" # define RenderPostscriptText "     Rendering   Postscript...     " # define SpotColor "+   " char command [ MaxTextExtent ], * density, filename [ MaxTextExtent ], geometry [ MaxTextExtent ], input_filename [ MaxTextExtent ], message [ MaxTextExtent ], * options, postscript_filename [ MaxTextExtent ] ; const char * option ; const DelegateInfo * delegate_info ; GeometryInfo geometry_info ; Image * image, * next, * postscript_image ; ImageInfo * read_info ; int c, file ; MagickBooleanType cmyk, fitPage, skip, status ; MagickStatusType flags ; PointInfo delta, resolution ; RectangleInfo page ; register char * p ; register ssize_t i ; SegmentInfo bounds, hires_bounds ; short int hex_digits [ 256 ] ; size_t length, priority ; ssize_t count ; StringInfo * profile ; unsigned long columns, extent, language_level, pages, rows, scene, spotcolor ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert (

Fix:
<S2SV_ModStart> "`%s\'", option ) ; geometry = DestroyString ( geometry
Buggy code:
 static int DecodeGifImg ( struct ngiflib_img * i ) { struct ngiflib_decode_context context ; long npix ; u8 * stackp ; u8 * stack_top ; u16 clr ; u16 eof ; u16 free ; u16 act_code = 0 ; u16 old_code = 0 ; u16 read_byt ; u16 ab_prfx [ 4096 ] ; u8 ab_suffx [ 4096 ] ; u8 ab_stack [ 4096 ] ; u8 flags ; u8 casspecial = 0 ; if (! i ) return - 1 ; i -> posX = GetWord ( i -> parent ) ; i -> posY = GetWord ( i -> parent ) ; i -> width = GetWord ( i -> parent ) ; i -> height = GetWord ( i -> parent ) ; <START_BUG> context. Xtogo = i -> width ; <END_BUG> context. curY = i -> posY ; # ifdef NGIFLIB_INDEXED_ONLY # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width ; context. frbuff_p. p8 = context. line_p. p8 + i -> posX ; # else context. frbuff_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width + i -> posX ; # endif # else if ( i -> parent -> mode & NGIFLIB_MODE_INDEXED ) { # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width ; context. frbuff_p. p8 = context. line_p. p8 + i -> posX ; # else context. frbuff_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width + i -> posX ; # endif } else { # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p32 = i -> parent -> frbuff. p32 + ( u32 ) i

Fix:
<S2SV_ModStart> parent ) ; if ( ( i -> width > i -> parent -> width ) || ( i -> height > i -> parent -> height ) ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "*** <S2SV_blank> ERROR <S2SV_blank> *** <S2SV_blank> Image <S2SV_blank> bigger <S2SV_blank> than <S2SV_blank> global <S2SV_blank> GIF <S2SV_blank> canvas <S2SV_blank>!\\n" ) ; # endif return - 1 ; } if ( ( i -> posX + i -> width ) > i -> parent -> width ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "*** <S2SV_blank> WARNING <S2SV_blank> *** <S2SV_blank> Adjusting <S2SV_blank> X <S2SV_blank> position\\n" ) ; # endif i -> posX = i -> parent -> width - i -> width ; } if ( ( i -> posY + i -> height ) > i -> parent -> height ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "*** <S2SV_blank> WARNING <S2SV_blank> *** <S2SV_blank> Adjusting <S2SV_blank> Y <S2SV_blank> position\\n" ) ; # endif
Buggy code:
 void gdImageGifCtx ( gdImagePtr im, gdIOCtxPtr out ) { <START_BUG> gdImagePtr pim = 0, tim = im ; <END_BUG> int interlace, BitsPerPixel ; interlace = im -> interlace ; if ( im -> trueColor ) {  pim = gdImageCreatePaletteFromTrueColor ( im, 1, 256 ) ; <START_BUG> if (! pim ) { return ; } tim = pim ; } BitsPerPixel = colorstobpp ( tim -> colorsTotal ) ; GIFEncode ( out, tim -> sx, tim -> sy, tim -> interlace, 0, tim -> transparent, BitsPerPixel, tim -> red, tim -> green, tim -> blue, tim ) ; if ( pim ) { gdImageDestroy ( pim ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> out ) { _gdImageGifCtx <S2SV_ModEnd> ( im, <S2SV_ModStart> ( im, out <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 <START_BUG> void impeg2d_dec_p_mb_params ( dec_state_t * ps_dec ) <END_BUG> { stream_t * ps_stream = & ps_dec -> s_bit_stream ; UWORD16 u2_mb_addr_incr ; UWORD16 u2_total_len ; UWORD16 u2_len ; UWORD16 u2_mb_type ; UWORD32 u4_next_word ; const dec_mb_params_t * ps_dec_mb_params ; if ( impeg2d_bit_stream_nxt ( ps_stream, 1 ) == 1 ) { impeg2d_bit_stream_flush ( ps_stream, 1 ) ; } else { u2_mb_addr_incr = impeg2d_get_mb_addr_incr ( ps_stream ) ; if ( 0 == ps_dec -> u2_first_mb ) { if ( ps_dec -> u2_is_mpeg2 && ( ( ps_dec -> u2_mb_x + u2_mb_addr_incr ) > ps_dec -> u2_num_horiz_mb ) ) { u2_mb_addr_incr = ps_dec -> u2_num_horiz_mb - ps_dec -> u2_mb_x ; } impeg2d_dec_skip_mbs ( ps_dec, ( UWORD16 ) ( u2_mb_addr_incr - 1 ) ) ; } } u4_next_word = ( UWORD16 ) impeg2d_bit_stream_nxt ( ps_stream, 16 ) ; { u2_mb_type = ps_dec -> pu2_mb_type [ BITS ( ( UWORD16 ) u4_next_word, 15, 10 ) ] ; u2_len = BITS ( u2_mb_type, 15, 8 ) ; u2_total_len = u2_len ; u4_next_word = ( UWORD16 ) LSW ( ( UWORD16 ) u4_next_word << u2_len ) ; } { if ( ( u2_mb_type & MB_FORW_OR_BACK ) && ps_dec -> u2_read_motion_type ) { WORD

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> WORD32 <S2SV_ModEnd> impeg2d_dec_p_mb_params ( dec_state_t <S2SV_ModStart> -> s_mb_type ; if ( NULL == ps_dec_mb_params -> pf_func_mb_params ) return - 1 ; <S2SV_ModStart> ; } } return 0 ;
Buggy code:
 static inline void header_put_le_int ( SF_PRIVATE * psf, int x ) <START_BUG> { if ( psf -> headindex < SIGNED_SIZEOF ( psf -> header ) - 4 ) <END_BUG>  { psf -> header [ psf -> headindex ++ ] = x ; <START_BUG> <END_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 8 ) ;  <START_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 16 ) ; <END_BUG>  psf -> header [ psf -> headindex ++ ] = ( x >> 24 ) ; <START_BUG> <END_BUG> } ;  }

Fix:
<S2SV_ModStart> x ) { <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. ptr [ <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int ras_putdatastd ( jas_stream_t * out, ras_hdr_t * hdr, jas_image_t * image, int numcmpts, int * cmpts ) { int rowsize ; int pad ; unsigned int z ; int nz ; int c ; int x ; int y ; int v ; jas_matrix_t * data [ 3 ] ; int i ; <START_BUG> for ( i = 0 ; i < numcmpts ; ++ i ) { <END_BUG>  data [ i ] = jas_matrix_create ( jas_image_height ( image ), jas_image_width ( image ) ) ; <START_BUG> assert ( data [ i ] ) ; } rowsize = RAS_ROWSIZE ( hdr ) ; pad = rowsize - ( hdr -> width * hdr -> depth + 7 ) // 8 ; hdr -> length = hdr -> height * rowsize ; for ( y = 0 ; y < hdr -> height ; y ++ ) { for ( i = 0 ; i < numcmpts ; ++ i ) { if ( jas_image_readcmpt ( image, cmpts [ i ], 0, y, jas_image_width ( image ), 1, data [ i ] ) ) { <END_BUG> return - 1 ;  } } z = 0 ; nz = 0 ; for ( x = 0 ; x < hdr -> width ; x ++ ) { z <<= hdr -> depth ; if ( RAS_ISRGB ( hdr ) ) { v = RAS_RED ( ( jas_matrix_getv ( data [ 0 ], x ) ) ) | RAS_GREEN ( ( jas_matrix_getv ( data [ 1 ], x ) ) ) | RAS_BLUE ( ( jas_matrix_getv ( data [ 2 ], x ) ) ) ; } else { v = ( jas_matrix_getv ( data [ 0 ], x ) ) ; } z |= v & RAS_ONES ( hdr -> depth ) ; nz += hdr -> depth ; while ( nz >= 8 ) { c = ( z >> ( nz - 8 ) ) & 0xff ; if ( jas_stream_putc ( out, c ) == EOF ) { <START_BUG> return - 1 ; <END_BUG> }  nz -= 8 ; <START_BUG> z &= RAS_ONES ( nz ) ; } } if ( nz > 0<END_BUG>

Fix:
<S2SV_ModStart> int i ; assert ( numcmpts <= 3 ) ; for ( i = 0 ; i < 3 ; ++ i ) { data [ i ] = 0 ; } <S2SV_ModStart> i ) { if (! ( <S2SV_ModStart> image ) ) ) ) { goto error ; } <S2SV_ModEnd> } rowsize = <S2SV_ModStart> ) ) { goto error <S2SV_ModEnd> ; } } <S2SV_ModStart> EOF ) { goto error ; } nz -= 8 ; z &= RAS_ONES ( nz ) ; } } if ( nz > 0 ) { c = ( z >> ( 8 - nz ) ) & RAS_ONES ( nz ) ; if ( jas_stream_putc ( out, c ) == EOF ) { goto error ; } } if ( pad % 2 ) { if ( jas_stream_putc ( out, 0 ) == EOF ) { goto error ; } } } for ( i = 0 ; i < numcmpts ; ++ i ) { jas_matrix_destroy ( data [ i ] ) ; data [ i ] = 0 ; } return 0 ; error : for ( i = 0 ; i < numcmpts ; ++ i ) { if ( data [ i ] ) { jas_matrix_destroy ( data [ i ] )
Buggy code:
 int snmp_version ( void * context, size_t hdrlen, unsigned char tag, const void * data, size_t datalen ) { <START_BUG> if ( * ( unsigned char * ) data > 1 ) <END_BUG> return - ENOTSUPP ; return 1 ; }

Fix:
<S2SV_ModStart> { if ( datalen!= 1 ) return - EINVAL ; if (
Buggy code:
 int bt_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; struct sk_buff * skb ; size_t copied ; int err ; BT_DBG ( "sock   %p   sk   %p   len   %zu", sock, sk, len ) ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) { <START_BUG> if ( sk -> sk_shutdown & RCV_SHUTDOWN ) { <END_BUG> msg -> msg_namelen = 0 ; return 0 ; } return err ; } copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } skb_reset_transport_header ( skb ) ; err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err == 0 ) { sock_recv_ts_and_drops ( msg, sk, skb ) ; if ( bt_sk ( sk ) -> skb_msg_name ) bt_sk ( sk ) -> skb_msg_name ( skb, msg -> msg_name, & msg -> msg_namelen ) ;  else <START_BUG> msg -> msg_namelen = 0 ; } skb_free_datagram ( sk, skb ) ; return err? : copied ; }<END_BUG>

Fix:
<S2SV_ModStart> & RCV_SHUTDOWN ) return 0 ; <S2SV_ModEnd> return err ; <S2SV_ModStart> msg_namelen ) ; <S2SV_ModEnd> } skb_free_datagram (
Buggy code:
 static void do_perf_sw_event ( enum perf_type_id type, u32 event_id, <START_BUG> u64 nr, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) { struct swevent_htable * swhash = & __get_cpu_var ( swevent_htable ) ; struct perf_event * event ; struct hlist_node * node ; struct hlist_head * head ; rcu_read_lock ( ) ; head = find_swevent_head_rcu ( swhash, type, event_id ) ; if (! head ) goto end ; hlist_for_each_entry_rcu ( event, node, head, hlist_entry ) { if ( perf_swevent_match ( event, type, event_id, data, regs ) )  perf_swevent_event ( event, nr, nmi, data, regs ) ; <START_BUG> } end : rcu_read_unlock ( ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, u64 nr <S2SV_ModEnd>, struct perf_sample_data <S2SV_ModStart>, nr, <S2SV_ModEnd> data, regs
Buggy code:
 static void on_page_prepare ( GtkNotebook * assistant, GtkWidget * page, gpointer user_data ) { if (! is_processing_finished ( ) ) { show_next_step_button ( ) ; clear_warnings ( ) ; } gtk_widget_hide ( g_btn_detail ) ; gtk_widget_hide ( g_btn_onfail ) ; if (! g_expert_mode ) gtk_widget_hide ( g_btn_repeat ) ; save_items_from_notepad ( ) ; <START_BUG> save_text_from_text_view ( g_tv_comment, FILENAME_COMMENT ) ; <END_BUG> if ( pages [ PAGENO_SUMMARY ]. page_widget == page ) { if (! g_expert_mode ) { int n = select_next_page_no ( pages [ PAGENO_SUMMARY ]. page_no, NULL ) ; log_info ( "switching   to   page_no:%d", n ) ; gtk_notebook_set_current_page ( assistant, n ) ; return ; } } if ( pages [ PAGENO_EDIT_ELEMENTS ]. page_widget == page ) { if ( highlight_forbidden ( ) ) { add_sensitive_data_warning ( ) ; show_warnings ( ) ; gtk_expander_set_expanded ( g_exp_search, TRUE ) ; } else gtk_toggle_button_set_active ( GTK_TOGGLE_BUTTON ( g_rb_custom_search ), TRUE ) ; show_warnings ( ) ; } if ( pages [ PAGENO_REVIEW_DATA ]. page_widget == page ) { update_ls_details_checkboxes ( g_event_selected ) ; gtk_widget_set_sensitive ( g_btn_next, gtk_toggle_button_get_active ( g_tb_approve_bt ) ) ; } if ( pages [ PAGENO_EDIT_COMMENT ]. page_widget == page ) { gtk_widget_show ( g_btn_detail ) ; gtk_widget_set_sensitive ( g_btn_next, false ) ; on_comment_changed ( gtk_text_view_get_buffer ( g_tv_comment ), NULL ) ; } if ( pages [ PAGENO_

Fix:
<S2SV_ModStart> g_tv_comment, FILENAME_COMMENT ) ; problem_data_reload_from_dump_dir ( ) ; update_gui_state_from_problem_data ( 0
Buggy code:
 static arguments_ty ast_for_arguments ( struct compiling * c, const node * n ) { int i, j, k, nposargs = 0, nkwonlyargs = 0 ; int nposdefaults = 0, found_default = 0 ; asdl_seq * posargs, * posdefaults, * kwonlyargs, * kwdefaults ; arg_ty vararg = NULL, kwarg = NULL ; arg_ty arg = NULL ; node * ch ; if ( TYPE ( n ) == parameters ) { if ( NCH ( n ) == 2 ) return arguments ( NULL, NULL, NULL, NULL, NULL, NULL, c -> c_arena ) ; n = CHILD ( n, 1 ) ; } assert ( TYPE ( n ) == typedargslist || TYPE ( n ) == varargslist ) ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == STAR ) { i ++ ; if ( i < NCH ( n ) && ( TYPE ( CHILD ( n, i ) ) == tfpdef || TYPE ( CHILD ( n, i ) ) == vfpdef ) ) { i ++ ; } break ; } if ( TYPE ( ch ) == DOUBLESTAR ) break ; if ( TYPE ( ch ) == vfpdef || TYPE ( ch ) == tfpdef ) nposargs ++ ; if ( TYPE ( ch ) == EQUAL ) nposdefaults ++ ; } for ( ; i < NCH ( n ) ; ++ i ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == DOUBLESTAR ) break ; if ( TYPE ( ch ) == tfpdef || TYPE ( ch ) == vfpdef ) nkwonlyargs ++ ; } posargs = ( nposargs? _Ta3_asdl_seq_new ( nposargs, c -> c_arena ) : NULL ) ; if (! posargs && nposargs ) return NULL ; kwonlyargs = ( nkwonlyargs? _Ta3_asdl_seq_new ( nkwonlyargs, c -> c_arena ) : NULL ) ; if (! kwonlyargs && nkwonlyargs ) return NULL ; posdefaults = ( nposdefaults? _Ta3_asdl_seq_new ( nposdefaults, c

Fix:
<S2SV_ModStart> ; if ( i < NCH ( n ) &&
Buggy code:
 static int do_ip_vs_get_ctl ( struct sock * sk, int cmd, void __user * user, int * len ) { unsigned char arg [ 128 ] ; int ret = 0 ; <START_BUG> if (! capable ( CAP_NET_ADMIN ) ) <END_BUG>  return - EPERM ; <START_BUG> if ( * len < get_arglen [ GET_CMDID ( cmd ) ] ) { pr_err ( "get_ctl:   len   %u   <   %u\\n", * len, get_arglen [ GET_CMDID ( cmd ) ] ) ; return - EINVAL ; } <END_BUG> if ( copy_from_user ( arg, user, get_arglen [ GET_CMDID ( cmd ) ] )!= 0 )  return - EFAULT ; if ( mutex_lock_interruptible ( & __ip_vs_mutex ) ) return - ERESTARTSYS ; switch ( cmd ) { case IP_VS_SO_GET_VERSION : { char buf [ 64 ] ; sprintf ( buf, "IP   Virtual   Server   version   %d.%d.%d   (size=%d)", NVERSION ( IP_VS_VERSION_CODE ), IP_VS_CONN_TAB_SIZE ) ; if ( copy_to_user ( user, buf, strlen ( buf ) + 1 )!= 0 ) { ret = - EFAULT ; goto out ; } * len = strlen ( buf ) + 1 ; } break ; case IP_VS_SO_GET_INFO : { struct ip_vs_getinfo info ; info. version = IP_VS_VERSION_CODE ; info. size = IP_VS_CONN_TAB_SIZE ; info. num_services = ip_vs_num_services ; if ( copy_to_user ( user, & info, sizeof ( info ) )!= 0 ) ret = - EFAULT ; } break ; case IP_VS_SO_GET_SERVICES : { struct ip_vs_get_services * get ; int size ; get = ( struct ip_vs_get_services * ) arg ; size = sizeof ( * get ) + sizeof ( struct ip_vs_service_entry ) * get -> num_services ; if ( * len!= size ) { pr_err ( "length:   %u  !=   %u\\n", * len, size ) ; ret =

Fix:
<S2SV_ModStart> = 0 ; unsigned int copylen ; <S2SV_ModStart> return - EPERM ; if ( cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX ) return - EINVAL <S2SV_ModStart> EINVAL ; } copylen = get_arglen [ GET_CMDID ( cmd ) ] ; if ( copylen > 128 ) return - EINVAL ; <S2SV_ModStart>, user, copylen <S2SV_ModEnd> )!= 0
Buggy code:
 static void * bpf_any_get ( void * raw, enum bpf_type type ) { switch ( type ) { case BPF_TYPE_PROG : <START_BUG> atomic_inc ( & ( ( struct bpf_prog * ) raw ) -> aux -> refcnt ) ; <END_BUG> break ; case BPF_TYPE_MAP :  bpf_map_inc ( raw, true ) ; <START_BUG> break ; default : WARN_ON_ONCE ( 1 ) ; break ; } return raw ; }<END_BUG>

Fix:
<S2SV_ModStart> case BPF_TYPE_PROG : raw = bpf_prog_inc ( raw <S2SV_ModEnd> ) ; break <S2SV_ModStart> case BPF_TYPE_MAP : raw =
Buggy code:
 void processRequest ( struct reqelem * req ) { ssize_t n ; unsigned int l, m ; unsigned char buf [ 2048 ] ; const unsigned char * p ; int type ; struct device * d = devlist ; unsigned char rbuf [ 4096 ] ; unsigned char * rp = rbuf + 1 ; unsigned char nrep = 0 ; time_t t ; struct service * newserv = NULL ; struct service * serv ; n = read ( req -> socket, buf, sizeof ( buf ) ) ; if ( n < 0 ) { if ( errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK ) return ; syslog ( LOG_ERR, "(s=%d)   processRequest():   read():   %m", req -> socket ) ; goto error ; } if ( n == 0 ) { syslog ( LOG_INFO, "(s=%d)   request   connection   closed", req -> socket ) ; goto error ; } t = time ( NULL ) ; type = buf [ 0 ] ; p = buf + 1 ; DECODELENGTH_CHECKLIMIT ( l, p, buf + n ) ; if ( p + l > buf + n ) { syslog ( LOG_WARNING, "bad   request   (length   encoding)" ) ; goto error ; } if ( l == 0 && type!= 3 ) { syslog ( LOG_WARNING, "bad   request   (length=0)" ) ; goto error ; } syslog ( LOG_INFO, "(s=%d)   request   type=%d   str=\'%.*s\'", req -> socket, type, l, p ) ; switch ( type ) { case 1 : case 2 : case 3 : while ( d && ( nrep < 255 ) ) { if ( d -> t < t ) { syslog ( LOG_INFO, "outdated   device" ) ; } else { if ( d -> headers [ HEADER_LOCATION ]. l + d -> headers [ HEADER_NT ]. l + d -> headers [ HEADER_USN ]. l + 6 + ( rp - rbuf ) >= ( int ) sizeof ( rbuf ) ) break ; if ( ( type == 1 && 0 == memcmp ( d -> headers [ HEADER_NT ]. p, p, l ) ) || ( type == 2 && 0 == memcmp ( d -> headers [ HEADER_USN ]. p, p,

Fix:
<S2SV_ModStart> error ; } memset ( newserv, 0, sizeof ( struct service ) ) ;
Buggy code:
 static int hugetlbfs_fill_super ( struct super_block * sb, void * data, int silent ) { struct inode * inode ; struct dentry * root ; int ret ; struct hugetlbfs_config config ; struct hugetlbfs_sb_info * sbinfo ; save_mount_options ( sb, data ) ; config. nr_blocks = - 1 ; config. nr_inodes = - 1 ; config. uid = current_fsuid ( ) ; config. gid = current_fsgid ( ) ; config. mode = 0755 ; config. hstate = & default_hstate ; ret = hugetlbfs_parse_options ( data, & config ) ; if ( ret ) return ret ; sbinfo = kmalloc ( sizeof ( struct hugetlbfs_sb_info ), GFP_KERNEL ) ; if (! sbinfo ) return - ENOMEM ; sb -> s_fs_info = sbinfo ; sbinfo -> hstate = config. hstate ; spin_lock_init ( & sbinfo -> stat_lock ) ; <START_BUG> sbinfo -> max_blocks = config. nr_blocks ; <END_BUG>  sbinfo -> free_blocks = config. nr_blocks ; <START_BUG> sbinfo -> max_inodes = config. nr_inodes ; sbinfo -> free_inodes = config. nr_inodes ; sb -> s_maxbytes = MAX_LFS_FILESIZE ; sb -> s_blocksize = huge_page_size ( config. hstate ) ; sb -> s_blocksize_bits = huge_page_shift ( config. hstate ) ; sb -> s_magic = HUGETLBFS_MAGIC ; sb -> s_op = & hugetlbfs_ops ; sb -> s_time_gran = 1 ; inode = hugetlbfs_get_root ( sb, & config ) ; <END_BUG> if (! inode )  goto out_free ; <START_BUG> root = d_alloc_root ( inode ) ; <END_BUG> if (! root ) { iput ( inode ) ; goto out_free ; } sb -> s_root = root ; return 0 ; out_free :  kfree ( sbinfo ) ; <START_BUG> return - ENOMEM ; }<END_BUG>

Fix:
<S2SV_ModStart> ; sbinfo -> max_inodes = config. nr_inodes ; sbinfo -> free_inodes = config. nr_inodes ; sbinfo -> spool = NULL ; if ( <S2SV_ModEnd> config. nr_blocks <S2SV_ModStart> config. nr_blocks!= - 1 ) { sbinfo -> spool = hugepage_new_subpool ( <S2SV_ModEnd> config. nr_blocks <S2SV_ModStart> config. nr_blocks <S2SV_ModEnd> ) ; if <S2SV_ModStart> if (! sbinfo -> spool <S2SV_ModEnd> ) goto out_free <S2SV_ModStart> goto out_free ; } sb -> s_maxbytes = MAX_LFS_FILESIZE ; sb -> s_blocksize = huge_page_size ( config. hstate ) ; sb -> s_blocksize_bits = huge_page_shift ( config. hstate ) ; sb -> s_magic = HUGETLBFS_MAGIC ; sb -> s_op = & hugetlbfs_ops ; sb -> s_time_gran = 1 ; inode = hugetlbfs_get_root ( sb, & config ) ; if (! inode ) goto out_free ; <S2SV_ModStart> ; out_free : if ( sbinfo -> spool ) k
Buggy code:
 static int decompress_i ( AVCodecContext * avctx, uint32_t * dst, int linesize ) { SCPRContext * s = avctx -> priv_data ; GetByteContext * gb = & s -> gb ; int cx = 0, cx1 = 0, k = 0, clr = 0 ; int run, r, g, b, off, y = 0, x = 0, z, ret ; unsigned backstep = linesize - avctx -> width ; const int cxshift = s -> cxshift ; unsigned lx, ly, ptype ; reinit_tables ( s ) ; bytestream2_skip ( gb, 2 ) ; init_rangecoder ( & s -> rc, gb ) ; while ( k < avctx -> width + 1 ) { ret = decode_unit ( s, & s -> pixel_model [ 0 ] [ cx + cx1 ], 400, & r ) ; if ( ret < 0 ) return ret ; cx1 = ( cx << 6 ) & 0xFC0 ; cx = r >> cxshift ; ret = decode_unit ( s, & s -> pixel_model [ 1 ] [ cx + cx1 ], 400, & g ) ; if ( ret < 0 ) return ret ; cx1 = ( cx << 6 ) & 0xFC0 ; cx = g >> cxshift ; ret = decode_unit ( s, & s -> pixel_model [ 2 ] [ cx + cx1 ], 400, & b ) ; if ( ret < 0 ) return ret ; cx1 = ( cx << 6 ) & 0xFC0 ; cx = b >> cxshift ; ret = decode_value ( s, s -> run_model [ 0 ], 256, 400, & run ) ; if ( ret < 0 ) return ret ; clr = ( b << 16 ) + ( g << 8 ) + r ; k += run ; while ( run -- > 0 ) { <START_BUG> dst [ y * linesize + x ] = clr ; <END_BUG> lx = x ; ly = y ; x ++ ; if ( x >= avctx -> width ) { x = 0 ; y ++ ; } } } off = - linesize - 1 ; ptype = 0 ; while ( x < avctx -> width && y < avctx -> height ) { ret = decode_value ( s, s -> op_model [ ptype ], 6,

Fix:
<S2SV_ModStart> 0 ) { if ( y >= avctx -> height ) return AVERROR_INVALIDDATA ;
Buggy code:
 static inline signed int ReadPropertySignedLong ( const EndianType endian, const unsigned char * buffer ) { union { unsigned int unsigned_value ; signed int signed_value ; } quantum ; unsigned int value ; if ( endian == LSBEndian ) { <START_BUG> value = ( unsigned int ) ( ( buffer [ 3 ] << 24 ) | ( buffer [ 2 ] << 16 ) | <END_BUG>  ( buffer [ 1 ] << 8 ) | ( buffer [ 0 ] ) ) ; <START_BUG> <END_BUG> quantum. unsigned_value = ( value & 0xffffffff ) ;  return ( quantum. signed_value ) ; } <START_BUG> value = ( unsigned int ) ( ( buffer [ 0 ] << 24 ) | ( buffer [ 1 ] << 16 ) | <END_BUG>  ( buffer [ 2 ] << 8 ) | buffer [ 3 ] ) ; <START_BUG> <END_BUG> quantum. unsigned_value = ( value & 0xffffffff ) ;  return ( quantum. signed_value ) ; }

Fix:
<S2SV_ModStart> unsigned int ) <S2SV_ModEnd> buffer [ 3 <S2SV_ModStart> ] << 24 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 2 <S2SV_ModStart> ] << 16 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 1 <S2SV_ModStart> ] << 8 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> [ 0 ] <S2SV_ModEnd> ; quantum. <S2SV_ModStart>. unsigned_value = <S2SV_ModEnd> value & 0xffffffff <S2SV_ModStart> value & 0xffffffff <S2SV_ModEnd> ; return ( <S2SV_ModStart> unsigned int ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> ] << 24 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 1 <S2SV_ModStart> ] << 16 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 2 <S2SV_ModStart> ] << 8 ; value |= ( unsigned int ) <S2SV_ModEnd> buffer [ 3 <S2SV_ModStart> [ 3 ] <S2SV_ModEnd> ; quantum. <S2SV_ModStart>. unsigned_value = <S2SV_ModEnd> value & 0xffffffff <S2SV_ModStart> value & 0xffffffff <S2SV_ModEnd> ; return (
Buggy code:
 static int ldp_tlv_print ( netdissect_options * ndo, register const u_char * tptr, u_short msg_tlen ) { struct ldp_tlv_header { uint8_t type [ 2 ] ; uint8_t length [ 2 ] ; } ; const struct ldp_tlv_header * ldp_tlv_header ; u_short tlv_type, tlv_len, tlv_tlen, af, ft_flags ; u_char fec_type ; u_int ui, vc_info_len, vc_info_tlv_type, vc_info_tlv_len, idx ; char buf [ 100 ] ; int i ; ldp_tlv_header = ( const struct ldp_tlv_header * ) tptr ; ND_TCHECK ( * ldp_tlv_header ) ; tlv_len = EXTRACT_16BITS ( ldp_tlv_header -> length ) ; if ( tlv_len + 4 > msg_tlen ) { ND_PRINT ( ( ndo, "\\n\\t\\t   TLV   contents   go   past   end   of   message" ) ) ; return 0 ; } tlv_tlen = tlv_len ; tlv_type = LDP_MASK_TLV_TYPE ( EXTRACT_16BITS ( ldp_tlv_header -> type ) ) ; ND_PRINT ( ( ndo, "\\n\\t         %s   TLV   (0x%04x),   length:   %u,   Flags:   [%s   and   %s   forward   if   unknown]", tok2str ( ldp_tlv_values, "Unknown", tlv_type ), tlv_type, tlv_len, LDP_MASK_U_BIT ( EXTRACT_16BITS ( & ldp_tlv_header -> type ) )? "continue   processing" : "ignore", LDP_MASK_F_BIT ( EXTRACT_16BITS ( & ldp_tlv_header -> type ) )? "do" : "don\'t" ) ) ; tptr += sizeof ( struct ldp_tlv_header ) ; switch ( tlv_type ) { case LDP_TL

Fix:
<S2SV_ModStart> : TLV_TCHECK ( 12 <S2SV_ModEnd> ) ; ft_flags <S2SV_ModStart> ( ndo, "%s", tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 void jiffies_to_timeval ( const unsigned long jiffies, struct timeval * value ) { <START_BUG> u64 nsec = ( u64 ) jiffies * TICK_NSEC ; <END_BUG> long tv_usec ;  value -> tv_sec = div_long_long_rem ( nsec, NSEC_PER_SEC, & tv_usec ) ; <START_BUG> tv_usec //= NSEC_PER_USEC ; <END_BUG> value -> tv_usec = tv_usec ;  }

Fix:
<S2SV_ModStart> value ) { u32 rem ; value -> tv_sec = div_u64_rem ( <S2SV_ModEnd> ( u64 ) <S2SV_ModStart> jiffies * TICK_NSEC, <S2SV_ModEnd> NSEC_PER_SEC, & <S2SV_ModStart> NSEC_PER_SEC, & rem ) <S2SV_ModEnd> ; value -> <S2SV_ModStart> -> tv_usec = rem // NSEC_PER_USEC <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void btif_config_save ( void ) { assert ( alarm_timer!= NULL ) ; assert ( config!= NULL ) ; <START_BUG> alarm_set ( alarm_timer, CONFIG_SETTLE_PERIOD_MS, timer_config_save, NULL ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, CONFIG_SETTLE_PERIOD_MS, timer_config_save_cb <S2SV_ModEnd>, NULL )
Buggy code:
 static inline int handle_dots ( struct nameidata * nd, int type ) { if ( type == LAST_DOTDOT ) { if ( nd -> flags & LOOKUP_RCU ) { return follow_dotdot_rcu ( nd ) ; } else <START_BUG> follow_dotdot ( nd ) ; <END_BUG> } return 0 ; }

Fix:
<S2SV_ModStart> ; } else return
Buggy code:
 static BT_HDR * create_pbuf ( UINT16 len, UINT8 * data ) { <START_BUG> BT_HDR * p_buf = GKI_getbuf ( ( UINT16 ) ( len + BTA_HH_MIN_OFFSET + sizeof ( BT_HDR ) ) ) ; <END_BUG> if ( p_buf ) { UINT8 * pbuf_data ; p_buf -> len = len ; p_buf -> offset = BTA_HH_MIN_OFFSET ; pbuf_data = ( UINT8 * ) ( p_buf + 1 ) + p_buf -> offset ; memcpy ( pbuf_data, data, len ) ; } return p_buf ; }

Fix:
<S2SV_ModStart> data ) { UINT16 buflen = <S2SV_ModEnd> ( UINT16 ) <S2SV_ModStart> BT_HDR ) ) ; if ( buflen < len ) { android_errorWriteWithInfoLog ( 0x534e4554, "28672558", - 1, NULL, 0 ) ; return NULL ; } BT_HDR * p_buf = GKI_getbuf ( buflen
Buggy code:
 static struct mnt_namespace * dup_mnt_ns ( struct mnt_namespace * mnt_ns, struct user_namespace * user_ns, struct fs_struct * fs ) { struct mnt_namespace * new_ns ; struct vfsmount * rootmnt = NULL, * pwdmnt = NULL ; struct mount * p, * q ; struct mount * old = mnt_ns -> root ; struct mount * new ; int copy_flags ; new_ns = alloc_mnt_ns ( user_ns ) ; if ( IS_ERR ( new_ns ) ) return new_ns ; down_write ( & namespace_sem ) ; copy_flags = CL_COPY_ALL | CL_EXPIRE ; if ( user_ns!= mnt_ns -> user_ns ) <START_BUG> copy_flags |= CL_SHARED_TO_SLAVE ; <END_BUG> new = copy_tree ( old, old -> mnt. mnt_root, copy_flags ) ; if ( IS_ERR ( new ) ) { up_write ( & namespace_sem ) ; free_mnt_ns ( new_ns ) ; return ERR_CAST ( new ) ; } new_ns -> root = new ; br_write_lock ( & vfsmount_lock ) ; list_add_tail ( & new_ns -> list, & new -> mnt_list ) ; br_write_unlock ( & vfsmount_lock ) ; p = old ; q = new ; while ( p ) { q -> mnt_ns = new_ns ; if ( fs ) { if ( & p -> mnt == fs -> root. mnt ) { fs -> root. mnt = mntget ( & q -> mnt ) ; rootmnt = & p -> mnt ; } if ( & p -> mnt == fs -> pwd. mnt ) { fs -> pwd. mnt = mntget ( & q -> mnt ) ; pwdmnt = & p -> mnt ; } } p = next_mnt ( p, old ) ; q = next_mnt ( q, new ) ; } up_write ( & namespace_sem ) ; if ( rootmnt ) mntput ( rootmnt ) ; if ( pwdmnt ) mntput ( pwdmnt ) ; return new_ns ; }

Fix:
<S2SV_ModStart> copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED
Buggy code:
 static struct mount * clone_mnt ( struct mount * old, struct dentry * root, int flag ) { struct super_block * sb = old -> mnt. mnt_sb ; struct mount * mnt ; int err ; mnt = alloc_vfsmnt ( old -> mnt_devname ) ; if (! mnt ) return ERR_PTR ( - ENOMEM ) ; if ( flag & ( CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE ) ) mnt -> mnt_group_id = 0 ; else mnt -> mnt_group_id = old -> mnt_group_id ; if ( ( flag & CL_MAKE_SHARED ) &&! mnt -> mnt_group_id ) { err = mnt_alloc_group_id ( mnt ) ; if ( err ) goto out_free ; } mnt -> mnt. mnt_flags = old -> mnt. mnt_flags & ~ MNT_WRITE_HOLD ; <START_BUG> atomic_inc ( & sb -> s_active ) ; <END_BUG> mnt -> mnt. mnt_sb = sb ; mnt -> mnt. mnt_root = dget ( root ) ; mnt -> mnt_mountpoint = mnt -> mnt. mnt_root ; mnt -> mnt_parent = mnt ; br_write_lock ( & vfsmount_lock ) ; list_add_tail ( & mnt -> mnt_instance, & sb -> s_mounts ) ; br_write_unlock ( & vfsmount_lock ) ; if ( ( flag & CL_SLAVE ) || ( ( flag & CL_SHARED_TO_SLAVE ) && IS_MNT_SHARED ( old ) ) ) { list_add ( & mnt -> mnt_slave, & old -> mnt_slave_list ) ; mnt -> mnt_master = old ; CLEAR_MNT_SHARED ( mnt ) ; } else if (! ( flag & CL_PRIVATE ) ) { if ( ( flag & CL_MAKE_SHARED ) || IS_MNT_SHARED ( old ) ) list_add ( & mnt -> mnt_share, & old -> mnt_share ) ; if ( IS_MNT_S

Fix:
<S2SV_ModStart> ~ MNT_WRITE_HOLD ; if ( ( flag & CL_UNPRIVILEGED ) && ( mnt -> mnt. mnt_flags & MNT_READONLY ) ) mnt -> mnt. mnt_flags |= MNT_LOCK_READONLY ;
Buggy code:
 void iov_iter_pipe ( struct iov_iter * i, int direction, struct pipe_inode_info * pipe, size_t count ) { <START_BUG> BUG_ON ( direction!= ITER_PIPE ) ; <END_BUG> i -> type = direction ; i -> pipe = pipe ; i -> idx = ( pipe -> curbuf + pipe -> nrbufs ) & ( pipe -> buffers - 1 ) ; i -> iov_offset = 0 ; i -> count = count ; }

Fix:
<S2SV_ModStart> direction!= ITER_PIPE ) ; WARN_ON ( pipe -> nrbufs == pipe -> buffers
Buggy code:
 static void ext4_free_io_end ( ext4_io_end_t * io ) { <START_BUG> BUG_ON (! io ) ; <END_BUG> iput ( io -> inode ) ; kfree ( io ) ; }

Fix:
<S2SV_ModStart> (! io ) ; if ( io -> page ) put_page ( io -> page
Buggy code:
 static void skcipher_release ( void * private ) { <START_BUG> crypto_free_skcipher ( private ) ; <END_BUG> }

Fix:
<S2SV_ModStart> private ) { struct skcipher_tfm * tfm = private ; crypto_free_skcipher ( tfm -> skcipher ) ; kfree ( tfm <S2SV_ModEnd> ) ; }
Buggy code:
 static void win_enter_ext ( win_T * wp, int undo_sync, int curwin_invalid, int trigger_new_autocmds, int trigger_enter_autocmds, int trigger_leave_autocmds ) { int other_buffer = FALSE ; if ( wp == curwin &&! curwin_invalid ) return ; # ifdef FEAT_JOB_CHANNEL if (! curwin_invalid ) leaving_window ( curwin ) ; # endif if (! curwin_invalid && trigger_leave_autocmds ) { if ( wp -> w_buffer!= curbuf ) { apply_autocmds ( EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf ) ; other_buffer = TRUE ; if (! win_valid ( wp ) ) return ; } apply_autocmds ( EVENT_WINLEAVE, NULL, NULL, FALSE, curbuf ) ; if (! win_valid ( wp ) ) return ; # ifdef FEAT_EVAL if ( aborting ( ) ) return ; # endif } if ( undo_sync && curbuf!= wp -> w_buffer ) u_sync ( FALSE ) ; update_topline ( ) ; if ( wp -> w_buffer!= curbuf ) buf_copy_options ( wp -> w_buffer, BCO_ENTER | BCO_NOHELP ) ; if (! curwin_invalid ) { prevwin = curwin ; curwin -> w_redr_status = TRUE ; } curwin = wp ; curbuf = wp -> w_buffer ; check_cursor ( ) ; if (! virtual_active ( ) ) curwin -> w_cursor. coladd = 0 ; changed_line_abv_curs ( ) ; if ( curwin -> w_localdir!= NULL || curtab -> tp_localdir!= NULL ) { char_u * dirname ; if ( globaldir == NULL ) { char_u cwd [ MAXPATHL ] ; if ( mch_dirname ( cwd, MAXPATHL ) == OK ) globaldir = vim_strsave ( cwd ) ; } if ( curwin -> w_localdir!= NULL ) dirname = curwin -> w_localdir ; else dirname = curtab -> tp_localdir ; if ( mch_chdir ( ( char * ) dirname ) == 0 ) shorten_

Fix:
<S2SV_ModStart> ( bt_terminal ( curwin <S2SV_ModEnd> -> w_buffer )
Buggy code:
 public int magic_setparam ( struct magic_set * ms, int param, const void * val ) { switch ( param ) { case MAGIC_PARAM_INDIR_MAX : ms -> indir_max = * ( const size_t * ) val ; return 0 ; case MAGIC_PARAM_NAME_MAX : ms -> name_max = * ( const size_t * ) val ; return 0 ; case MAGIC_PARAM_ELF_PHNUM_MAX : ms -> elf_phnum_max = * ( const size_t * ) val ; return 0 ; case MAGIC_PARAM_ELF_SHNUM_MAX : ms -> elf_shnum_max = * ( const size_t * ) val ; return 0 ; <START_BUG> default : <END_BUG> errno = EINVAL ; return - 1 ; } }

Fix:
<S2SV_ModStart> return 0 ; case MAGIC_PARAM_ELF_NOTES_MAX : ms -> elf_notes_max = * ( const size_t * ) val ; return 0 ;
Buggy code:
 static void rpl_dio_printopt ( netdissect_options * ndo, const struct rpl_dio_genoption * opt, u_int length ) { if ( length < RPL_DIO_GENOPTION_LEN ) return ; length -= RPL_DIO_GENOPTION_LEN ; ND_TCHECK ( opt -> rpl_dio_len ) ; while ( ( opt -> rpl_dio_type == RPL_OPT_PAD0 && ( const u_char * ) opt < ndo -> ndo_snapend ) || ND_TTEST2 ( * opt, ( opt -> rpl_dio_len + 2 ) ) ) { unsigned int optlen = opt -> rpl_dio_len + 2 ; if ( opt -> rpl_dio_type == RPL_OPT_PAD0 ) { optlen = 1 ; ND_PRINT ( ( ndo, "   opt:pad0" ) ) ; } else { ND_PRINT ( ( ndo, "   opt:%s   len:%u   ", tok2str ( rpl_subopt_values, "subopt:%u", opt -> rpl_dio_type ), optlen ) ) ; if ( ndo -> ndo_vflag > 2 ) { unsigned int paylen = opt -> rpl_dio_len ; if ( paylen > length ) paylen = length ; hex_print ( ndo, "   ", ( ( const uint8_t * ) opt ) + RPL_DIO_GENOPTION_LEN, paylen ) ; } } opt = ( const struct rpl_dio_genoption * ) ( ( ( const char * ) opt ) + optlen ) ; length -= optlen ; <START_BUG> } <END_BUG> return ; trunc :  ND_PRINT ( ( ndo, "   [|truncated]" ) ) ; <START_BUG> return ; }<END_BUG>

Fix:
<S2SV_ModStart> -= optlen ; ND_TCHECK ( opt -> rpl_dio_len ) ; <S2SV_ModStart> ( ndo, "%s", rpl_tstr <S2SV_ModEnd> ) ) ;