nus-yam/ex-repair huggingface dataset:
Buggy code:
 grub_err_t grub_disk_read ( grub_disk_t disk, grub_disk_addr_t sector, grub_off_t offset, grub_size_t size, void * buf ) { char * tmp_buf ; unsigned real_offset ; if ( grub_disk_adjust_range ( disk, & sector, & offset, size )!= GRUB_ERR_NONE ) { grub_error_push ( ) ; grub_dprintf ( "disk", "Read   out   of   range:   sector   0x%llx   (%s).\\n", ( unsigned long long ) sector, grub_errmsg ) ; grub_error_pop ( ) ; return grub_errno ; } real_offset = offset ; tmp_buf = grub_malloc ( GRUB_DISK_SECTOR_SIZE << GRUB_DISK_CACHE_BITS ) ; if (! tmp_buf ) return grub_errno ; while ( size ) { char * data ; grub_disk_addr_t start_sector ; grub_size_t len ; grub_size_t pos ; start_sector = sector & ~ ( GRUB_DISK_CACHE_SIZE - 1 ) ; pos = ( sector - start_sector ) << GRUB_DISK_SECTOR_BITS ; len = ( ( GRUB_DISK_SECTOR_SIZE << GRUB_DISK_CACHE_BITS ) - pos - real_offset ) ; if ( len > size ) len = size ; data = grub_disk_cache_fetch ( disk -> dev -> id, disk -> id, start_sector ) ; if ( data ) { <START_BUG> if ( buf ) <END_BUG>  grub_memcpy ( buf, data + pos + real_offset, len ) ; <START_BUG> grub_disk_cache_unlock ( disk -> dev -> id, disk -> id, start_sector ) ; } else { if ( start_sector + GRUB_DISK_CACHE_SIZE > disk -> total_sectors || ( disk -> dev -> read ) ( disk, start_sector, GRUB_DISK_CACHE_SIZE, tmp_buf )!= GRUB_ERR_NONE ) { unsigned num ; char * p ; grub_errno = GR<END_BUG>

Fix:
<S2SV_ModStart> ( buf ) { if ( pos + real_offset + len >= size ) { grub_errno = GRUB_ERR_BAD_FS ; return grub_errno ; } <S2SV_ModStart> len ) ; }
Buggy code:
 int btpan_tap_open ( ) { struct ifreq ifr ; int fd, err ; const char * clonedev = "//dev//tun" ; <START_BUG> if ( ( fd = open ( clonedev, O_RDWR ) ) < 0 ) <END_BUG> { BTIF_TRACE_DEBUG ( "could   not   open   %s,   err:%d", clonedev, errno ) ; return fd ; } memset ( & ifr, 0, sizeof ( ifr ) ) ; ifr. ifr_flags = IFF_TAP | IFF_NO_PI ; strncpy ( ifr. ifr_name, TAP_IF_NAME, IFNAMSIZ ) ;  if ( ( err = ioctl ( fd, TUNSETIFF, ( void * ) & ifr ) ) < 0 ) <START_BUG> { BTIF_TRACE_DEBUG ( "ioctl   error:%d,   errno:%s", err, strerror ( errno ) ) ; close ( fd ) ; return err ; } if ( tap_if_up ( TAP_IF_NAME, controller_get_interface ( ) -> get_address ( ) ) == 0 ) { <END_BUG> int flags = fcntl ( fd, F_GETFL, 0 ) ;  <START_BUG> fcntl ( fd, F_SETFL, flags | O_NONBLOCK ) ; <END_BUG> return fd ; } BTIF_TRACE_ERROR ( "can   not   bring   up   tap   interface:%s", TAP_IF_NAME ) ; close ( fd ) ; return INVALID_FD ; }

Fix:
<S2SV_ModStart> ( fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart> clonedev, O_RDWR ) <S2SV_ModStart> ( err = TEMP_FAILURE_RETRY ( <S2SV_ModStart> ifr ) ) ) <S2SV_ModStart> int flags = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) ) ; TEMP_FAILURE_RETRY ( <S2SV_ModEnd> fcntl ( fd <S2SV_ModStart> | O_NONBLOCK ) )
Buggy code:
 static void bgp_update_print ( netdissect_options * ndo, const u_char * dat, int length ) { struct bgp bgp ; const u_char * p ; int withdrawn_routes_len ; int len ; int i ; ND_TCHECK2 ( dat [ 0 ], BGP_SIZE ) ; if ( length < BGP_SIZE ) goto trunc ; memcpy ( & bgp, dat, BGP_SIZE ) ; p = dat + BGP_SIZE ; length -= BGP_SIZE ; ND_TCHECK2 ( p [ 0 ], 2 ) ; if ( length < 2 ) goto trunc ; withdrawn_routes_len = EXTRACT_16BITS ( p ) ; p += 2 ; length -= 2 ; if ( withdrawn_routes_len ) { ND_TCHECK2 ( p [ 0 ], withdrawn_routes_len ) ; if ( length < withdrawn_routes_len ) goto trunc ; ND_PRINT ( ( ndo, "\\n\\t     Withdrawn   routes:   %d   bytes", withdrawn_routes_len ) ) ; p += withdrawn_routes_len ; length -= withdrawn_routes_len ; } ND_TCHECK2 ( p [ 0 ], 2 ) ; if ( length < 2 ) goto trunc ; len = EXTRACT_16BITS ( p ) ; p += 2 ; length -= 2 ; if ( withdrawn_routes_len == 0 && len == 0 && length == 0 ) { ND_PRINT ( ( ndo, "\\n\\t     End-of-Rib   Marker   (empty   NLRI)" ) ) ; return ; } if ( len ) { while ( len ) { int aflags, atype, alenlen, alen ; ND_TCHECK2 ( p [ 0 ], 2 ) ; if ( len < 2 ) goto trunc ; if ( length < 2 ) goto trunc ; aflags = * p ; atype = * ( p + 1 ) ; p += 2 ; len -= 2 ; length -= 2 ; alenlen = bgp_attr_lenlen ( aflags, p ) ; ND_TCHECK2 ( p [ 0 ], alenlen ) ; if ( len < alenlen ) goto trunc ; if ( length < alenlen ) goto trunc ; al

Fix:
<S2SV_ModStart> p, alen, 0
Buggy code:
 jas_matrix_t * jas_matrix_create ( int numrows, int numcols ) { jas_matrix_t * matrix ; int i ; <START_BUG> if ( numrows < 0 || numcols < 0 ) { <END_BUG>  return 0 ; <START_BUG> } if (! ( matrix = jas_malloc ( sizeof ( jas_matrix_t ) ) ) ) { <END_BUG> return 0 ;  } matrix -> flags_ = 0 ; matrix -> numrows_ = numrows ; matrix -> numcols_ = numcols ; matrix -> rows_ = 0 ; matrix -> maxrows_ = numrows ; matrix -> data_ = 0 ; <START_BUG> matrix -> datasize_ = numrows * numcols ; <END_BUG> if ( matrix -> maxrows_ > 0 ) { if (! ( matrix -> rows_ = jas_alloc2 ( matrix -> maxrows_, sizeof ( jas_seqent_t * ) ) ) ) {  jas_matrix_destroy ( matrix ) ; <START_BUG> return 0 ; } } if ( matrix -> datasize_ > 0 ) { if (! ( matrix -> data_ = jas_alloc2 ( matrix -> datasize_, sizeof ( jas_seqent_t ) ) ) ) { <END_BUG> jas_matrix_destroy ( matrix ) ;  return 0 ; } } for ( i = 0 ; i < numrows ; ++ i ) { matrix -> rows_ [ i ] = & matrix -> data_ [ i * matrix -> numcols_ ] ; } for ( i = 0 ; i < matrix -> datasize_ ; ++ i ) { matrix -> data_ [ i ] = 0 ; } matrix -> xstart_ = 0 ; matrix -> ystart_ = 0 ; matrix -> xend_ = matrix -> numcols_ ; matrix -> yend_ = matrix -> numrows_ ; return matrix ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> int i ; size_t size ; matrix = 0 ; <S2SV_ModStart> 0 ) { goto error <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) { goto error <S2SV_ModEnd> ; } matrix <S2SV_ModStart> -> datasize_ = 0 ; if (! jas_safe_size_mul ( numrows, numcols, & size ) ) { goto error ; } matrix -> datasize_ = size <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) { goto error <S2SV_ModEnd> ; } } <S2SV_ModStart> ) ) { goto error <S2SV_ModEnd> ; } } <S2SV_ModStart> return matrix ; error : if ( matrix ) { jas_matrix_destroy ( matrix ) ; } return 0 ;
Buggy code:
 static void ieee80211_if_setup ( struct net_device * dev ) { ether_setup ( dev ) ; <START_BUG> dev -> netdev_ops = & ieee80211_dataif_ops ; <END_BUG> dev -> destructor = free_netdev ; }

Fix:
<S2SV_ModStart> ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ; dev ->
Buggy code:
 static Gif_Stream * read_gif ( Gif_Reader * grr, int read_flags, const char * landmark, Gif_ReadErrorHandler handler ) { Gif_Stream * gfs ; Gif_Image * gfi ; Gif_Context gfc ; int unknown_block_type = 0 ; if ( gifgetc ( grr )!= 'G' || gifgetc ( grr )!= 'I' || gifgetc ( grr )!= 'F' ) return 0 ; ( void ) gifgetc ( grr ) ; ( void ) gifgetc ( grr ) ; ( void ) gifgetc ( grr ) ; gfs = Gif_NewStream ( ) ; gfi = Gif_NewImage ( ) ; gfc. stream = gfs ; gfc. prefix = Gif_NewArray ( Gif_Code, GIF_MAX_CODE ) ; gfc. suffix = Gif_NewArray ( uint8_t, GIF_MAX_CODE ) ; gfc. length = Gif_NewArray ( uint16_t, GIF_MAX_CODE ) ; gfc. handler = handler ; gfc. gfi = gfi ; gfc. errors [ 0 ] = gfc. errors [ 1 ] = 0 ; if (! gfs ||! gfi ||! gfc. prefix ||! gfc. suffix ||! gfc. length ) goto done ; gfs -> landmark = landmark ; GIF_DEBUG ( ( "\\nGIF   " ) ) ; if (! read_logical_screen_descriptor ( gfs, grr ) ) goto done ; GIF_DEBUG ( ( "logscrdesc   " ) ) ; while (! gifeof ( grr ) ) { uint8_t block = gifgetbyte ( grr ) ; switch ( block ) { case ',' : GIF_DEBUG ( ( "imageread   %d   ", gfs -> nimages ) ) ; gfi -> identifier = last_name ; last_name = 0 ; if (! Gif_AddImage ( gfs, gfi ) ) goto done ; else if (! read_image ( grr, & gfc, gfi, read_flags ) ) { Gif_RemoveImage ( gfs, gfs -> nimages - 1 ) ; gfi = 0 ; goto done ;

Fix:
<S2SV_ModStart> = 0 ; last_name = 0 ;
Buggy code:
 int kex_input_kexinit ( int type, u_int32_t seq, void * ctxt ) { struct ssh * ssh = ctxt ; struct kex * kex = ssh -> kex ; const u_char * ptr ; u_int i ; size_t dlen ; int r ; debug ( "SSH2_MSG_KEXINIT   received" ) ; if ( kex == NULL ) return SSH_ERR_INVALID_ARGUMENT ; <START_BUG> ptr = sshpkt_ptr ( ssh, & dlen ) ; <END_BUG> if ( ( r = sshbuf_put ( kex -> peer, ptr, dlen ) )!= 0 ) return r ; for ( i = 0 ; i < KEX_COOKIE_LEN ; i ++ ) if ( ( r = sshpkt_get_u8 ( ssh, NULL ) )!= 0 ) return r ; for ( i = 0 ; i < PROPOSAL_MAX ; i ++ ) if ( ( r = sshpkt_get_string ( ssh, NULL, NULL ) )!= 0 ) return r ; if ( ( r = sshpkt_get_u8 ( ssh, NULL ) )!= 0 || ( r = sshpkt_get_u32 ( ssh, NULL ) )!= 0 || ( r = sshpkt_get_end ( ssh ) )!= 0 ) return r ; if (! ( kex -> flags & KEX_INIT_SENT ) ) if ( ( r = kex_send_kexinit ( ssh ) )!= 0 ) return r ; if ( ( r = kex_choose_conf ( ssh ) )!= 0 ) return r ; if ( kex -> kex_type < KEX_MAX && kex -> kex [ kex -> kex_type ]!= NULL ) return ( kex -> kex [ kex -> kex_type ] ) ( ssh ) ; return SSH_ERR_INTERNAL_ERROR ; }

Fix:
<S2SV_ModStart> return SSH_ERR_INVALID_ARGUMENT ; ssh_dispatch_set ( ssh, SSH2_MSG_KEXINIT, NULL ) ;
Buggy code:
 void vpx_free ( void * memblk ) { if ( memblk ) { void * addr = ( void * ) ( ( ( size_t * ) memblk ) [ - 1 ] ) ; <START_BUG> # if CONFIG_MEM_MANAGER <END_BUG> hmm_free ( & hmm_d, addr ) ; # else VPX_FREE_L ( addr ) ;  # endif <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> ] ) ; free <S2SV_ModEnd> ( addr ) <S2SV_ModStart> addr ) ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 static int accept_server_socket ( int sfd ) { struct sockaddr_un remote ; struct pollfd pfd ; int fd ; socklen_t len = sizeof ( struct sockaddr_un ) ; BTIF_TRACE_EVENT ( "accept   fd   %d", sfd ) ; pfd. fd = sfd ; pfd. events = POLLIN ; <START_BUG> if ( poll ( & pfd, 1, 0 ) == 0 ) <END_BUG> { BTIF_TRACE_EVENT ( "accept   poll   timeout" ) ; return - 1 ; }  if ( ( fd = accept ( sfd, ( struct sockaddr * ) & remote, & len ) ) == - 1 ) <START_BUG> { BTIF_TRACE_ERROR ( "sock   accept   failed   (%s)", strerror ( errno ) ) ; return - 1 ; } return fd ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> 1, 0 ) <S2SV_ModStart> ( fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & len )
Buggy code:
 static int adjust_scalar_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, struct bpf_reg_state * dst_reg, struct bpf_reg_state src_reg ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; bool src_known, dst_known ; s64 smin_val, smax_val ; u64 umin_val, umax_val ; <START_BUG> if ( BPF_CLASS ( insn -> code )!= BPF_ALU64 ) { <END_BUG> coerce_reg_to_size ( dst_reg, 4 ) ; coerce_reg_to_size ( & src_reg, 4 ) ; } smin_val = src_reg. smin_value ; smax_val = src_reg. smax_value ; umin_val = src_reg. umin_value ; umax_val = src_reg. umax_value ; src_known = tnum_is_const ( src_reg. var_off ) ; dst_known = tnum_is_const ( dst_reg -> var_off ) ; switch ( opcode ) { case BPF_ADD : if ( signed_add_overflows ( dst_reg -> smin_value, smin_val ) || signed_add_overflows ( dst_reg -> smax_value, smax_val ) ) { dst_reg -> smin_value = S64_MIN ; dst_reg -> smax_value = S64_MAX ; } else { dst_reg -> smin_value += smin_val ; dst_reg -> smax_value += smax_val ; } if ( dst_reg -> umin_value + umin_val < umin_val || dst_reg -> umax_value + umax_val < umax_val ) { dst_reg -> umin_value = 0 ; dst_reg -> umax_value = U64_MAX ; } else { dst_reg -> umin_value += umin_val ; dst_reg -> umax_value += umax_val ; } dst_reg -> var_off = tnum_add ( dst_reg -> var_

Fix:
<S2SV_ModStart>, umax_val ; u64 insn_bitness = <S2SV_ModEnd> ( BPF_CLASS ( <S2SV_ModStart> -> code ) == BPF_ALU64 )? 64 : 32 ; <S2SV_ModEnd> smin_val = src_reg <S2SV_ModStart> if ( umax_val >= insn_bitness <S2SV_ModEnd> ) { mark_reg_unknown <S2SV_ModStart> if ( umax_val >= insn_bitness <S2SV_ModEnd> ) { mark_reg_unknown <S2SV_ModStart> break ; } if ( BPF_CLASS ( insn -> code )!= BPF_ALU64 ) { coerce_reg_to_size ( dst_reg, 4 ) ; coerce_reg_to_size ( & src_reg, 4 ) ; }
Buggy code:
 static void inbound_data_waiting ( void * context ) { eager_reader_t * reader = ( eager_reader_t * ) context ; data_buffer_t * buffer = ( data_buffer_t * ) reader -> allocator -> alloc ( reader -> buffer_size + sizeof ( data_buffer_t ) ) ; if (! buffer ) { LOG_ERROR ( "%s   couldn\'t   aquire   memory   for   inbound   data   buffer.", __func__ ) ; return ; } buffer -> length = 0 ; buffer -> offset = 0 ; <START_BUG> int bytes_read = read ( reader -> inbound_fd, buffer -> data, reader -> buffer_size ) ; <END_BUG> if ( bytes_read > 0 ) { buffer -> length = bytes_read ; fixed_queue_enqueue ( reader -> buffers, buffer ) ; eventfd_write ( reader -> bytes_available_fd, bytes_read ) ; } else { if ( bytes_read == 0 ) LOG_WARN ( "%s   fd   said   bytes   existed,   but   none   were   found.", __func__ ) ; else LOG_WARN ( "%s   unable   to   read   from   file   descriptor:   %s", __func__, strerror ( errno ) ) ; reader -> allocator -> free ( buffer ) ; } }

Fix:
<S2SV_ModStart> int bytes_read = TEMP_FAILURE_RETRY ( <S2SV_ModStart> reader -> buffer_size )
Buggy code:
 static int snd_compress_check_input ( struct snd_compr_params * params ) { if ( params -> buffer. fragment_size == 0 || <START_BUG> params -> buffer. fragments > SIZE_MAX // params -> buffer. fragment_size ) <END_BUG> return - EINVAL ; if ( params -> codec. id == 0 || params -> codec. id > SND_AUDIOCODEC_MAX ) return - EINVAL ; if ( params -> codec. ch_in == 0 || params -> codec. ch_out == 0 ) return - EINVAL ; return 0 ; }

Fix:
<S2SV_ModStart>. fragments > INT_MAX <S2SV_ModEnd> // params ->
Buggy code:
 static int crypto_report_comp ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_comp rcomp ; <START_BUG> snprintf ( rcomp. type, CRYPTO_MAX_ALG_NAME, "%s", "compression" ) ; <END_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_COMPRESS, sizeof ( struct crypto_report_comp ), & rcomp ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_comp rcomp ; strncpy <S2SV_ModEnd> ( rcomp. <S2SV_ModStart>. type, "compression", sizeof ( rcomp. type ) <S2SV_ModEnd> ) ; if
Buggy code:
 static krb5_error_code kdc_process_for_user ( kdc_realm_t * kdc_active_realm, krb5_pa_data * pa_data, krb5_keyblock * tgs_session, krb5_pa_s4u_x509_user * * s4u_x509_user, const char * * status ) { krb5_error_code code ; krb5_pa_for_user * for_user ; krb5_data req_data ; req_data. length = pa_data -> length ; req_data. data = ( char * ) pa_data -> contents ; code = decode_krb5_pa_for_user ( & req_data, & for_user ) ; if ( code ) <START_BUG> return code ; <END_BUG> code = verify_for_user_checksum ( kdc_context, tgs_session, for_user ) ; if ( code ) { * status = "INVALID_S4U2SELF_CHECKSUM" ; krb5_free_pa_for_user ( kdc_context, for_user ) ; return code ; } * s4u_x509_user = calloc ( 1, sizeof ( krb5_pa_s4u_x509_user ) ) ; if ( * s4u_x509_user == NULL ) { krb5_free_pa_for_user ( kdc_context, for_user ) ; return ENOMEM ; } ( * s4u_x509_user ) -> user_id. user = for_user -> user ; for_user -> user = NULL ; krb5_free_pa_for_user ( kdc_context, for_user ) ; return 0 ; }

Fix:
<S2SV_ModStart> ( code ) { * status = "DECODE_PA_FOR_USER" ; return code ; } <S2SV_ModEnd> code = verify_for_user_checksum
Buggy code:
 static int fwnet_incoming_packet ( struct fwnet_device * dev, __be32 * buf, int len, int source_node_id, int generation, bool is_broadcast ) { struct sk_buff * skb ; struct net_device * net = dev -> netdev ; struct rfc2734_header hdr ; unsigned lf ; unsigned long flags ; struct fwnet_peer * peer ; struct fwnet_partial_datagram * pd ; int fg_off ; int dg_size ; u16 datagram_label ; int retval ; u16 ether_type ; <START_BUG> hdr. w0 = be32_to_cpu ( buf [ 0 ] ) ; <END_BUG> lf = fwnet_get_hdr_lf ( & hdr ) ; if ( lf == RFC2374_HDR_UNFRAG ) { ether_type = fwnet_get_hdr_ether_type ( & hdr ) ; buf ++ ; len -= RFC2374_UNFRAG_HDR_SIZE ; skb = dev_alloc_skb ( len + LL_RESERVED_SPACE ( net ) ) ; if ( unlikely (! skb ) ) { net -> stats. rx_dropped ++ ; return - ENOMEM ; } skb_reserve ( skb, LL_RESERVED_SPACE ( net ) ) ; memcpy ( skb_put ( skb, len ), buf, len ) ; return fwnet_finish_incoming_packet ( net, skb, source_node_id, is_broadcast, ether_type ) ; }  hdr. w1 = ntohl ( buf [ 1 ] ) ; <START_BUG> buf += 2 ; len -= RFC2374_FRAG_HDR_SIZE ; if ( lf == RFC2374_HDR_FIRSTFRAG ) { ether_type = fwnet_get_hdr_ether_type ( & hdr ) ; fg_off = 0 ; } else { ether_type = 0 ; fg_off = fwnet_get_hdr_fg_off ( & hdr ) ; } datagram_label = fwnet_get_hdr_dgl ( & hdr ) ; dg_size = fwnet_get_hdr_dg_size ( & hdr ) ; <END_BUG> spin_lock_irqsave ( & dev -> lock, flags ) ;  peer = fwnet_peer_find_by_

Fix:
<S2SV_ModStart> u16 ether_type ; if ( len <= RFC2374_UNFRAG_HDR_SIZE ) return 0 ; <S2SV_ModStart> ) ; } if ( len <= RFC2374_FRAG_HDR_SIZE ) return 0 ; <S2SV_ModStart> hdr ) ; if ( fg_off + len > dg_size ) return 0 ;
Buggy code:
 static plist_t parse_string_node ( const char * * bnode, uint64_t size ) { plist_data_t data = plist_new_plist_data ( ) ; data -> type = PLIST_STRING ; data -> strval = ( char * ) malloc ( sizeof ( char ) * ( size + 1 ) ) ; <START_BUG> memcpy ( data -> strval, * bnode, size ) ; <END_BUG> data -> strval [ size ] = '\\0' ; data -> length = strlen ( data -> strval ) ; return node_create ( NULL, data ) ; }

Fix:
<S2SV_ModStart> ) ) ; if (! data -> strval ) { plist_free_data ( data ) ; PLIST_BIN_ERR ( "%s: <S2SV_blank> Could <S2SV_blank> not <S2SV_blank> allocate <S2SV_blank> %" PRIu64 " <S2SV_blank> bytes\\n", __func__, sizeof ( char ) * ( size + 1 ) ) ; return NULL ; }
Buggy code:
 static bool caller_is_in_ancestor ( pid_t pid, const char * contrl, const char * cg, char * * nextcg ) { <START_BUG> char fnam [ PROCLEN ] ; <END_BUG> FILE * f ; bool answer = false ;  char * line = NULL ; <START_BUG> size_t len = 0 ; int ret ; ret = snprintf ( fnam, PROCLEN, "//proc//%d//cgroup", pid ) ; if ( ret < 0 || ret >= PROCLEN ) return false ; if (! ( f = fopen ( fnam, "r" ) ) ) return false ; while ( getline ( & line, & len, f )!= - 1 ) { char * c1, * c2, * linecmp ; if (! line [ 0 ] ) continue ; c1 = strchr ( line, ':' ) ; if (! c1 ) goto out ; c1 ++ ; c2 = strchr ( c1, ':' ) ; if (! c2 ) <END_BUG> goto out ;  * c2 = '\\0' ; if ( strcmp ( c1, contrl )!= 0 ) continue ; c2 ++ ; stripnewline ( c2 ) ; prune_init_slice ( c2 ) ; linecmp = * cg == '//'? c2 : c2 + 1 ; if ( strncmp ( linecmp, cg, strlen ( linecmp ) )!= 0 ) { <START_BUG> if ( nextcg ) <END_BUG> * nextcg = get_next_cgroup_dir ( linecmp, cg ) ;  goto out ; <START_BUG> } answer = true ; <END_BUG> goto out ;  } out : fclose ( f ) ; free ( line ) ; return answer ; }

Fix:
<S2SV_ModStart> nextcg ) { <S2SV_ModEnd> bool answer = <S2SV_ModStart> ; char * c2 = get_pid_cgroup ( pid, contrl ) ; char * linecmp <S2SV_ModEnd> ; if ( <S2SV_ModStart>! c2 ) return false <S2SV_ModEnd> ; prune_init_slice ( <S2SV_ModStart> ( nextcg ) { <S2SV_ModStart> cg ) ; } <S2SV_ModStart> = true ; out : free ( c2 <S2SV_ModEnd> ) ; return
Buggy code:
 void gdImageWBMPCtx ( gdImagePtr image, int fg, gdIOCtx * out ) { <START_BUG> int x, y, pos ; <END_BUG> Wbmp * wbmp ; if ( ( wbmp = createwbmp ( gdImageSX ( image ), gdImageSY ( image ), WBMP_WHITE ) ) == NULL ) { gd_error ( "Could   not   create   WBMP" ) ; return ; } pos = 0 ; for ( y = 0 ; y < gdImageSY ( image ) ; y ++ ) { for ( x = 0 ; x < gdImageSX ( image ) ; x ++ ) {  if ( gdImageGetPixel ( image, x, y ) == fg ) { <START_BUG> wbmp -> bitmap [ pos ] = WBMP_BLACK ; } pos ++ ; } } if ( writewbmp ( wbmp, & gd_putout, out ) ) { gd_error ( "Could   not   save   WBMP" ) ; } freewbmp ( wbmp ) ; }<END_BUG>

Fix:
<S2SV_ModStart> out ) { _gdImageWBMPCtx <S2SV_ModEnd> ( image, <S2SV_ModStart> ( image, fg, out <S2SV_ModEnd> ) ; }
Buggy code:
 static bool msr_mtrr_valid ( unsigned msr ) { switch ( msr ) { case 0x200... 0x200 + 2 * KVM_NR_VAR_MTRR - 1 : case MSR_MTRRfix64K_00000 : case MSR_MTRRfix16K_80000 : case MSR_MTRRfix16K_A0000 : case MSR_MTRRfix4K_C0000 : case MSR_MTRRfix4K_C8000 : case MSR_MTRRfix4K_D0000 : case MSR_MTRRfix4K_D8000 : case MSR_MTRRfix4K_E0000 : case MSR_MTRRfix4K_E8000 : case MSR_MTRRfix4K_F0000 : case MSR_MTRRfix4K_F8000 : case MSR_MTRRdefType : case MSR_IA32_CR_PAT : return true ; <START_BUG> case 0x2f8 : <END_BUG> return true ; } return false ; }

Fix:
<S2SV_ModStart> return true ; <S2SV_ModEnd> } return false
Buggy code:
 static void php_html_entities ( INTERNAL_FUNCTION_PARAMETERS, int all ) { char * str, * hint_charset = NULL ; int str_len, hint_charset_len = 0 ; size_t new_len ; long flags = ENT_COMPAT ; char * replaced ; zend_bool double_encode = 1 ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "s|ls!b", & str, & str_len, & flags, & hint_charset, & hint_charset_len, & double_encode ) == FAILURE ) { return ; } replaced = php_escape_html_entities_ex ( str, str_len, & new_len, all, ( int ) flags, hint_charset, double_encode TSRMLS_CC ) ; <START_BUG> RETVAL_STRINGL ( replaced, ( int ) new_len, 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> TSRMLS_CC ) ; if ( new_len > INT_MAX ) { efree ( replaced ) ; RETURN_FALSE ; }
Buggy code:
 static krb5_error_code decode_sequence ( const uint8_t * asn1, size_t len, const struct seq_info * seq, void * val ) { krb5_error_code ret ; const uint8_t * contents ; size_t i, j, clen ; taginfo t ; assert ( seq -> n_fields > 0 ) ; for ( i = 0 ; i < seq -> n_fields ; i ++ ) { if ( len == 0 ) break ; <START_BUG> ret = get_tag ( asn1, len, & t, & contents, & clen, & asn1, & len ) ; <END_BUG> if ( ret ) goto error ; for ( ; i < seq -> n_fields ; i ++ ) { if ( check_atype_tag ( seq -> fields [ i ], & t ) ) break ; ret = omit_atype ( seq -> fields [ i ], val ) ; if ( ret ) goto error ; } if ( i == seq -> n_fields ) break ; ret = decode_atype ( & t, contents, clen, seq -> fields [ i ], val ) ; if ( ret ) goto error ; } for ( ; i < seq -> n_fields ; i ++ ) { ret = omit_atype ( seq -> fields [ i ], val ) ; if ( ret ) goto error ; } return 0 ; error : for ( j = 0 ; j < i ; j ++ ) free_atype ( seq -> fields [ j ], val ) ; for ( j = 0 ; j < i ; j ++ ) free_atype_ptr ( seq -> fields [ j ], val ) ; return ret ; }

Fix:
<S2SV_ModStart>, & len, 0
Buggy code:
 static void ctrycatchfinally ( JF, js_Ast * trystm, js_Ast * catchvar, js_Ast * catchstm, js_Ast * finallystm ) { int L1, L2, L3 ; L1 = emitjump ( J, F, OP_TRY ) ; { L2 = emitjump ( J, F, OP_TRY ) ; { cstm ( J, F, finallystm ) ; emit ( J, F, OP_THROW ) ; } label ( J, F, L2 ) ; if ( F -> strict ) { checkfutureword ( J, F, catchvar ) ; if (! strcmp ( catchvar -> string, "arguments" ) ) jsC_error ( J, catchvar, "redefining   \'arguments\'   is   not   allowed   in   strict   mode" ) ; if (! strcmp ( catchvar -> string, "eval" ) ) jsC_error ( J, catchvar, "redefining   \'eval\'   is   not   allowed   in   strict   mode" ) ; } emitline ( J, F, catchvar ) ; emitstring ( J, F, OP_CATCH, catchvar -> string ) ; cstm ( J, F, catchstm ) ; emit ( J, F, OP_ENDCATCH ) ; <START_BUG> L3 = emitjump ( J, F, OP_JUMP ) ; <END_BUG> } label ( J, F, L1 ) ; cstm ( J, F, trystm ) ; emit ( J, F, OP_ENDTRY ) ; label ( J, F, L3 ) ; cstm ( J, F, finallystm ) ; }

Fix:
<S2SV_ModStart> OP_ENDCATCH ) ; emit ( J, F, OP_ENDTRY ) ;
Buggy code:
 private int cdf_file_property_info ( struct magic_set * ms, const cdf_property_info_t * info, <START_BUG> size_t count, const uint64_t clsid [ 2 ] ) <END_BUG> { size_t i ; cdf_timestamp_t tp ; struct timespec ts ; char buf [ 64 ] ; const char * str = NULL ; const char * s ; int len ;  if (! NOTMIME ( ms ) ) <START_BUG> <END_BUG> str = cdf_clsid_to_mime ( clsid, clsid2mime ) ;  for ( i = 0 ; i < count ; i ++ ) { cdf_print_property_name ( buf, sizeof ( buf ), info [ i ]. pi_id ) ; switch ( info [ i ]. pi_type ) { case CDF_NULL : break ; case CDF_SIGNED16 : if ( NOTMIME ( ms ) && file_printf ( ms, ",   %s:   %hd", buf, info [ i ]. pi_s16 ) == - 1 ) return - 1 ; break ; case CDF_SIGNED32 : if ( NOTMIME ( ms ) && file_printf ( ms, ",   %s:   %d", buf, info [ i ]. pi_s32 ) == - 1 ) return - 1 ; break ; case CDF_UNSIGNED32 : if ( NOTMIME ( ms ) && file_printf ( ms, ",   %s:   %u", buf, info [ i ]. pi_u32 ) == - 1 ) return - 1 ; break ; case CDF_FLOAT : if ( NOTMIME ( ms ) && file_printf ( ms, ",   %s:   %g", buf, info [ i ]. pi_f ) == - 1 ) return - 1 ; break ; case CDF_DOUBLE : if ( NOTMIME ( ms ) && file_printf ( ms, ",   %s:   %g", buf, info [ i ]. pi_d ) == - 1 ) return - 1 ; break ; case CDF_LENGTH32_STRING : case CDF_LENGTH32_WSTRING : len = info [ i ]. pi_str. s_len ; if ( len > 1 ) { char vbuf [ 1024 ] ; size_t j, k = 1 ; if ( info [ i ]. pi_type == CDF_LENGTH32_WSTRING

Fix:
<S2SV_ModStart> count, const cdf_directory_t * root_storage <S2SV_ModEnd> ) { size_t <S2SV_ModStart> ( ms ) && root_storage <S2SV_ModStart> = cdf_clsid_to_mime ( root_storage -> d_storage_uuid <S2SV_ModEnd>, clsid2mime )
Buggy code:
 int main ( ) { CU_pSuite pSuite = NULL ; unsigned int num_tests_failed ; nghttp2_enable_strict_preface = 0 ; if ( CUE_SUCCESS!= CU_initialize_registry ( ) ) return ( int ) CU_get_error ( ) ; pSuite = CU_add_suite ( "libnghttp2_TestSuite", init_suite1, clean_suite1 ) ; if ( NULL == pSuite ) { CU_cleanup_registry ( ) ; return ( int ) CU_get_error ( ) ; } if (! CU_add_test ( pSuite, "pq", test_nghttp2_pq ) ||! CU_add_test ( pSuite, "pq_update", test_nghttp2_pq_update ) ||! CU_add_test ( pSuite, "pq_remove", test_nghttp2_pq_remove ) ||! CU_add_test ( pSuite, "map", test_nghttp2_map ) ||! CU_add_test ( pSuite, "map_functional", test_nghttp2_map_functional ) ||! CU_add_test ( pSuite, "map_each_free", test_nghttp2_map_each_free ) ||! CU_add_test ( pSuite, "queue", test_nghttp2_queue ) ||! CU_add_test ( pSuite, "npn", test_nghttp2_npn ) ||! CU_add_test ( pSuite, "session_recv", test_nghttp2_session_recv ) ||! CU_add_test ( pSuite, "session_recv_invalid_stream_id", test_nghttp2_session_recv_invalid_stream_id ) ||! CU_add_test ( pSuite, "session_recv_invalid_frame", test_nghttp2_session_recv_invalid_frame ) ||! CU_add_test ( pSuite, "session_recv_eof", test_nghttp2_session_recv_eof ) ||! CU_add_test ( pSuite, "session_recv_data", test_nghttp2_session_recv_data ) ||! CU_add_test

Fix:
<S2SV_ModStart> ( pSuite, "session_too_many_settings", test_nghttp2_session_too_many_settings ) ||! CU_add_test ( pSuite,
Buggy code:
 int handle_popc ( u32 insn, struct pt_regs * regs ) { u64 value ; int ret, i, rd = ( ( insn >> 25 ) & 0x1f ) ; int from_kernel = ( regs -> tstate & TSTATE_PRIV )!= 0 ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> if ( insn & 0x2000 ) { maybe_flush_windows ( 0, 0, rd, from_kernel ) ; value = sign_extend_imm13 ( insn ) ; } else { maybe_flush_windows ( 0, insn & 0x1f, rd, from_kernel ) ; value = fetch_reg ( insn & 0x1f, regs ) ; } for ( ret = 0, i = 0 ; i < 16 ; i ++ ) { ret += popc_helper [ value & 0xf ] ; value >>= 4 ; } if ( rd < 16 ) { if ( rd ) regs -> u_regs [ rd ] = ret ; } else { if ( test_thread_flag ( TIF_32BIT ) ) { struct reg_window32 __user * win32 ; win32 = ( struct reg_window32 __user * ) ( ( unsigned long ) ( ( u32 ) regs -> u_regs [ UREG_FP ] ) ) ; put_user ( ret, & win32 -> locals [ rd - 16 ] ) ; } else { struct reg_window __user * win ; win = ( struct reg_window __user * ) ( regs -> u_regs [ UREG_FP ] + STACK_BIAS ) ; put_user ( ret, & win -> locals [ rd - 16 ] ) ; } } advance ( regs ) ; return 1 ; }

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 int imap_open_connection ( IMAP_DATA * idata ) { if ( mutt_socket_open ( idata -> conn ) < 0 ) return - 1 ; idata -> state = IMAP_CONNECTED ; if ( imap_cmd_step ( idata )!= IMAP_CMD_OK ) { imap_close_connection ( idata ) ; return - 1 ; } if ( ascii_strncasecmp ( "*   OK", idata -> buf, 4 ) == 0 ) { if ( ascii_strncasecmp ( "*   OK   [CAPABILITY", idata -> buf, 16 ) && imap_check_capabilities ( idata ) ) goto bail ; # if defined ( USE_SSL ) if (! idata -> conn -> ssf && ( option ( OPTSSLFORCETLS ) || mutt_bit_isset ( idata -> capabilities, STARTTLS ) ) ) { int rc ; if ( option ( OPTSSLFORCETLS ) ) rc = MUTT_YES ; else if ( ( rc = query_quadoption ( OPT_SSLSTARTTLS, _ ( "Secure   connection   with   TLS?" ) ) ) == - 1 ) goto err_close_conn ; if ( rc == MUTT_YES ) { if ( ( rc = imap_exec ( idata, "STARTTLS", IMAP_CMD_FAIL_OK ) ) == - 1 ) goto bail ; if ( rc!= - 2 ) { if ( mutt_ssl_starttls ( idata -> conn ) ) { mutt_error ( _ ( "Could   not   negotiate   TLS   connection" ) ) ; mutt_sleep ( 1 ) ; goto err_close_conn ; } else { if ( imap_exec ( idata, "CAPABILITY", 0 ) ) goto bail ; } } } } if ( option ( OPTSSLFORCETLS ) &&! idata -> conn -> ssf ) { mutt_error _ ( "Encrypted   connection   unavailable" ) ; mutt_sleep ( 1 ) ; goto err_close_conn ; } # endif } else if ( ascii_strncasecmp ( "*   PREAUTH", idata -> buf, 9 ) == 0 ) { <START_BUG> idata -> state = IMAP_AUTHENTICATED ; <END_BUG> if ( imap_check_capabilities ( idata )!= 0 ) goto bail ; FREE ( &

Fix:
<S2SV_ModStart> 0 ) { # if defined ( USE_SSL ) if (! idata -> conn -> ssf ) { if ( option ( OPTSSLFORCETLS ) || ( query_quadoption ( OPT_SSLSTARTTLS, _ ( "Abort <S2SV_blank> unencrypted <S2SV_blank> PREAUTH <S2SV_blank> connection?" ) )!= MUTT_NO ) ) { mutt_error _ ( "Encrypted <S2SV_blank> connection <S2SV_blank> unavailable" ) ; mutt_sleep ( 1 ) ; goto err_close_conn ; } } # endif
Buggy code:
 static void add_bytes_l2_c ( uint8_t * dst, uint8_t * src1, uint8_t * src2, int w ) { long i ; <START_BUG> for ( i = 0 ; i <= w - sizeof ( long ) ; i += sizeof ( long ) ) { <END_BUG> long a = * ( long * ) ( src1 + i ) ; long b = * ( long * ) ( src2 + i ) ; * ( long * ) ( dst + i ) = ( ( a & pb_7f ) + ( b & pb_7f ) ) ^ ( ( a ^ b ) & pb_80 ) ; } for ( ; i < w ; i ++ ) dst [ i ] = src1 [ i ] + src2 [ i ] ; }

Fix:
<S2SV_ModStart> <= w - ( int )
Buggy code:
 dfa * Ta3Grammar_FindDFA ( grammar * g, int type ) { dfa * d ; # if 1 d = & g -> g_dfa [ type - NT_OFFSET ] ; assert ( d -> d_type == type ) ; return d ; # else int i ; for ( i = g -> g_ndfas, d = g -> g_dfa ; -- i >= 0 ; d ++ ) { if ( d -> d_type == type ) return d ; } <START_BUG> assert ( 0 ) ; <END_BUG> # endif }

Fix:
<S2SV_ModStart> d ; } abort ( <S2SV_ModEnd> ) ; #
Buggy code:
 static int read_public_key ( RSA * rsa ) { int r ; sc_path_t path ; sc_file_t * file ; u8 buf [ 2048 ], * p = buf ; size_t bufsize, keysize ; r = select_app_df ( ) ; if ( r ) return 1 ; sc_format_path ( "I1012", & path ) ; r = sc_select_file ( card, & path, & file ) ; if ( r ) { fprintf ( stderr, "Unable   to   select   public   key   file:   %s\\n", sc_strerror ( r ) ) ; return 2 ; } <START_BUG> bufsize = file -> size ; <END_BUG> sc_file_free ( file ) ; r = sc_read_binary ( card, 0, buf, bufsize, 0 ) ; if ( r < 0 ) { fprintf ( stderr, "Unable   to   read   public   key   file:   %s\\n", sc_strerror ( r ) ) ; return 2 ; } bufsize = r ; do { if ( bufsize < 4 ) return 3 ; keysize = ( p [ 0 ] << 8 ) | p [ 1 ] ; if ( keysize == 0 ) break ; if ( keysize < 3 ) return 3 ; if ( p [ 2 ] == opt_key_num ) break ; p += keysize ; bufsize -= keysize ; } while ( 1 ) ; if ( keysize == 0 ) { printf ( "Key   number   %d   not   found.\\n", opt_key_num ) ; return 2 ; } return parse_public_key ( p, keysize, rsa ) ; }

Fix:
<S2SV_ModStart> } bufsize = MIN ( <S2SV_ModStart> file -> size, sizeof buf )
Buggy code:
 int ldbm_back_bind ( Slapi_PBlock * pb ) { backend * be ; ldbm_instance * inst ; ber_tag_t method ; struct berval * cred ; struct ldbminfo * li ; struct backentry * e ; Slapi_Attr * attr ; Slapi_Value * * bvals ; entry_address * addr ; back_txn txn = { NULL } ; int rc = SLAPI_BIND_SUCCESS ; int result_sent = 0 ; slapi_pblock_get ( pb, SLAPI_BACKEND, & be ) ; slapi_pblock_get ( pb, SLAPI_PLUGIN_PRIVATE, & li ) ; slapi_pblock_get ( pb, SLAPI_TARGET_ADDRESS, & addr ) ; slapi_pblock_get ( pb, SLAPI_BIND_METHOD, & method ) ; slapi_pblock_get ( pb, SLAPI_BIND_CREDENTIALS, & cred ) ; slapi_pblock_get ( pb, SLAPI_TXN, & txn. back_txn_txn ) ; if (! txn. back_txn_txn ) { dblayer_txn_init ( li, & txn ) ; slapi_pblock_set ( pb, SLAPI_TXN, txn. back_txn_txn ) ; } inst = ( ldbm_instance * ) be -> be_instance_info ; if ( inst -> inst_ref_count ) { slapi_counter_increment ( inst -> inst_ref_count ) ; } else { slapi_log_err ( SLAPI_LOG_ERR, "ldbm_back_bind", "instance   %s   does   not   exist.\\n", inst -> inst_name ) ; return ( SLAPI_BIND_FAIL ) ; } if ( method == LDAP_AUTH_SIMPLE && cred -> bv_len == 0 ) { rc = SLAPI_BIND_ANONYMOUS ; goto bail ; } if ( ( e = find_entry ( pb, be, addr, & txn, & result_sent ) ) == NULL ) { rc = SLAPI_BIND_FAIL ; if (! result_sent ) { slapi_send_ldap_result ( pb, LDAP_INAPPROPRIATE_AUTH

Fix:
<S2SV_ModStart> 0 ) { slapi_pblock_set ( pb, SLAPI_PB_RESULT_TEXT, "Entry <S2SV_blank> does <S2SV_blank> not <S2SV_blank> have <S2SV_blank> userpassword <S2SV_blank> set" ) ; <S2SV_ModStart> ( pb, LDAP_INVALID_CREDENTIALS, NULL, <S2SV_ModEnd> NULL, 0
Buggy code:
 int bta_co_rfc_data_outgoing ( void * user_data, uint8_t * buf, uint16_t size ) { pthread_mutex_lock ( & slot_lock ) ; uint32_t id = ( uintptr_t ) user_data ; int ret = false ; rfc_slot_t * slot = find_rfc_slot_by_id ( id ) ; if (! slot ) goto out ; <START_BUG> int received = recv ( slot -> fd, buf, size, 0 ) ; <END_BUG> if ( received == size ) { ret = true ; } else { LOG_ERROR ( "%s   error   receiving   RFCOMM   data   from   app:   %s", __func__, strerror ( errno ) ) ; cleanup_rfc_slot ( slot ) ; } out : ; pthread_mutex_unlock ( & slot_lock ) ; return ret ; }

Fix:
<S2SV_ModStart> int received = TEMP_FAILURE_RETRY ( <S2SV_ModStart> size, 0 )
Buggy code:
 static void youngcollection ( lua_State * L, global_State * g ) { GCObject * * psurvival ; lua_assert ( g -> gcstate == GCSpropagate ) ; markold ( g, g -> allgc, g -> reallyold ) ; markold ( g, g -> finobj, g -> finobjrold ) ; atomic ( L ) ; <START_BUG> psurvival = sweepgen ( L, g, & g -> allgc, g -> survival ) ; <END_BUG> sweepgen ( L, g, psurvival, g -> reallyold ) ; g -> reallyold = g -> old ; g -> old = * psurvival ; g -> survival = g -> allgc ; psurvival = sweepgen ( L, g, & g -> finobj, g -> finobjsur ) ; sweepgen ( L, g, psurvival, g -> finobjrold ) ; g -> finobjrold = g -> finobjold ; g -> finobjold = * psurvival ; g -> finobjsur = g -> finobj ; sweepgen ( L, g, & g -> tobefnz, NULL ) ; finishgencycle ( L, g ) ; }

Fix:
<S2SV_ModStart> L ) ; g -> gcstate = GCSswpallgc ;
Buggy code:
 PyObject * ast2obj_type_ignore ( void * _o ) { type_ignore_ty o = ( type_ignore_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } switch ( o -> kind ) { case TypeIgnore_kind : result = PyType_GenericNew ( TypeIgnore_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_int ( o -> v. TypeIgnore. lineno ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_lineno, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; } return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } switch
Buggy code:
 void vp8cx_pick_filter_level_fast ( YV12_BUFFER_CONFIG * sd, VP8_COMP * cpi ) { VP8_COMMON * cm = & cpi -> common ; int best_err = 0 ; int filt_err = 0 ; int min_filter_level = get_min_filter_level ( cpi, cm -> base_qindex ) ; int max_filter_level = get_max_filter_level ( cpi, cm -> base_qindex ) ; int filt_val ; <START_BUG> int best_filt_val = cm -> filter_level ; <END_BUG> YV12_BUFFER_CONFIG * saved_frame = cm -> frame_to_show ; cm -> frame_to_show = & cpi -> pick_lf_lvl_frame ; if ( cm -> frame_type == KEY_FRAME ) cm -> sharpness_level = 0 ; else cm -> sharpness_level = cpi -> oxcf. Sharpness ; if ( cm -> sharpness_level!= cm -> last_sharpness_level ) { vp8_loop_filter_update_sharpness ( & cm -> lf_info, cm -> sharpness_level ) ; cm -> last_sharpness_level = cm -> sharpness_level ; } if ( cm -> filter_level < min_filter_level ) cm -> filter_level = min_filter_level ; else if ( cm -> filter_level > max_filter_level ) cm -> filter_level = max_filter_level ; filt_val = cm -> filter_level ; best_filt_val = filt_val ;  vp8_yv12_copy_partial_frame ( saved_frame, cm -> frame_to_show ) ; <START_BUG> vp8_loop_filter_partial_frame ( cm, & cpi -> mb. e_mbd, filt_val ) ; best_err = calc_partial_ssl_err ( sd, cm -> frame_to_show ) ; filt_val -= 1 + ( filt_val > 10 ) ; while ( filt_val >= min_filter_level ) { <END_BUG> vp8_yv12_copy_partial_frame ( saved_frame, cm -> frame_to_show ) ;  vp8_loop_filter_partial_frame ( cm

Fix:
<S2SV_ModStart> ; int best_filt_val <S2SV_ModEnd> ; YV12_BUFFER_CONFIG * <S2SV_ModStart> = filt_val ; yv12_copy_partial_frame <S2SV_ModEnd> ( saved_frame, <S2SV_ModStart> min_filter_level ) { yv12_copy_partial_frame <S2SV_ModEnd> ( saved_frame, <S2SV_ModStart> max_filter_level ) { yv12_copy_partial_frame <S2SV_ModEnd> ( saved_frame,
Buggy code:
 void vp8_denoiser_free ( VP8_DENOISER * denoiser ) { int i ; assert ( denoiser ) ; for ( i = 0 ; i < MAX_REF_FRAMES ; i ++ ) { vp8_yv12_de_alloc_frame_buffer ( & denoiser -> yv12_running_avg [ i ] ) ; } vp8_yv12_de_alloc_frame_buffer ( & denoiser -> yv12_mc_running_avg ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> yv12_mc_running_avg ) ; vp8_yv12_de_alloc_frame_buffer ( & denoiser -> yv12_last_source ) ; vpx_free ( denoiser -> denoise_state ) ;
Buggy code:
 static irqreturn_t snd_msnd_interrupt ( int irq, void * dev_id ) { struct snd_msnd * chip = dev_id ; void * pwDSPQData = chip -> mappedbase + DSPQ_DATA_BUFF ; <START_BUG> while ( readw ( chip -> DSPQ + JQS_wTail )!= readw ( chip -> DSPQ + JQS_wHead ) ) { <END_BUG> u16 wTmp ; snd_msnd_eval_dsp_msg ( chip, readw ( pwDSPQData + 2 * readw ( chip -> DSPQ + JQS_wHead ) ) ) ;  wTmp = readw ( chip -> DSPQ + JQS_wHead ) + 1 ; <START_BUG> <END_BUG> if ( wTmp > readw ( chip -> DSPQ + JQS_wSize ) )  writew ( 0, chip -> DSPQ + JQS_wHead ) ; else writew ( wTmp, chip -> DSPQ + JQS_wHead ) ; <START_BUG> } <END_BUG> inb ( chip -> io + HP_RXL ) ; return IRQ_HANDLED ; }

Fix:
<S2SV_ModStart> + DSPQ_DATA_BUFF ; u16 head, tail, size ; head <S2SV_ModEnd> = readw ( <S2SV_ModStart> + JQS_wHead ) ; tail = readw ( chip -> DSPQ + JQS_wTail ) ; size = <S2SV_ModEnd> readw ( chip <S2SV_ModStart> + JQS_wSize ) ; if ( head > size || tail > size ) goto out ; while ( head!= tail ) { snd_msnd_eval_dsp_msg ( chip, readw ( pwDSPQData + 2 * head ) ) ; if ( ++ head > size ) head = 0 ; writew ( head <S2SV_ModEnd>, chip -> <S2SV_ModStart> ) ; } out :
Buggy code:
 static void update_sharpness ( loop_filter_info_n * lfi, int sharpness_lvl ) { int lvl ; for ( lvl = 0 ; lvl <= MAX_LOOP_FILTER ; lvl ++ ) { int block_inside_limit = lvl >> ( ( sharpness_lvl > 0 ) + ( sharpness_lvl > 4 ) ) ; if ( sharpness_lvl > 0 ) { if ( block_inside_limit > ( 9 - sharpness_lvl ) ) block_inside_limit = ( 9 - sharpness_lvl ) ; } if ( block_inside_limit < 1 ) block_inside_limit = 1 ; <START_BUG> vpx_memset ( lfi -> lfthr [ lvl ]. lim, block_inside_limit, SIMD_WIDTH ) ; <END_BUG>  vpx_memset ( lfi -> lfthr [ lvl ]. mblim, ( 2 * ( lvl + 2 ) + block_inside_limit ), <START_BUG> SIMD_WIDTH ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> = 1 ; memset <S2SV_ModEnd> ( lfi -> <S2SV_ModStart> SIMD_WIDTH ) ; memset <S2SV_ModEnd> ( lfi ->
Buggy code:
 static int mxf_read_primer_pack ( void * arg, AVIOContext * pb, int tag, int size, UID uid, int64_t klv_offset ) { MXFContext * mxf = arg ; int item_num = avio_rb32 ( pb ) ; int item_len = avio_rb32 ( pb ) ; if ( item_len!= 18 ) { avpriv_request_sample ( pb, "Primer   pack   item   length   %d", item_len ) ; return AVERROR_PATCHWELCOME ; } <START_BUG> if ( item_num > 65536 ) { <END_BUG> av_log ( mxf -> fc, AV_LOG_ERROR, "item_num   %d   is   too   large\\n", item_num ) ; return AVERROR_INVALIDDATA ; } if ( mxf -> local_tags ) av_log ( mxf -> fc, AV_LOG_VERBOSE, "Multiple   primer   packs\\n" ) ; av_free ( mxf -> local_tags ) ; mxf -> local_tags_count = 0 ; mxf -> local_tags = av_calloc ( item_num, item_len ) ; if (! mxf -> local_tags ) return AVERROR ( ENOMEM ) ; mxf -> local_tags_count = item_num ; avio_read ( pb, mxf -> local_tags, item_num * item_len ) ; return 0 ; }

Fix:
<S2SV_ModStart> item_num > 65536 || item_num < 0
Buggy code:
 int btsock_thread_exit ( int h ) { if ( h < 0 || h >= MAX_THREAD ) { APPL_TRACE_ERROR ( "invalid   bt   thread   handle:%d", h ) ; return FALSE ; } if ( ts [ h ]. cmd_fdw == - 1 ) { APPL_TRACE_ERROR ( "cmd   socket   is   not   created" ) ; return FALSE ; } sock_cmd_t cmd = { CMD_EXIT, 0, 0, 0, 0 } ; <START_BUG> if ( send ( ts [ h ]. cmd_fdw, & cmd, sizeof ( cmd ), 0 ) == sizeof ( cmd ) ) <END_BUG> { pthread_join ( ts [ h ]. thread_id, 0 ) ; pthread_mutex_lock ( & thread_slot_lock ) ; free_thread_slot ( h ) ; pthread_mutex_unlock ( & thread_slot_lock ) ; return TRUE ; } return FALSE ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> ), 0 )
Buggy code:
 <START_BUG> int bind_ports ( void ) { <END_BUG> SERVICE_OPTIONS * opt ; int listening_section ; # ifdef USE_LIBWRAP libwrap_init ( ) ; # endif s_poll_init ( fds, 1 ) ; for ( opt = service_options. next ; opt ; opt = opt -> next ) { unsigned i ; for ( i = 0 ; i < opt -> local_addr. num ; ++ i ) opt -> local_fd [ i ] = INVALID_SOCKET ; } listening_section = 0 ; for ( opt = service_options. next ; opt ; opt = opt -> next ) { opt -> bound_ports = 0 ; if ( opt -> local_addr. num ) { unsigned i ; s_log ( LOG_DEBUG, "Binding   service   [%s]", opt -> servname ) ; for ( i = 0 ; i < opt -> local_addr. num ; ++ i ) { SOCKET fd ; fd = bind_port ( opt, listening_section, i ) ; opt -> local_fd [ i ] = fd ; if ( fd!= INVALID_SOCKET ) { s_poll_add ( fds, fd, 1, 0 ) ; ++ opt -> bound_ports ; } } if (! opt -> bound_ports ) { s_log ( LOG_ERR, "Binding   service   [%s]   failed", opt -> servname ) ; return 1 ; } ++ listening_section ; } else if ( opt -> exec_name && opt -> connect_addr. names ) { s_log ( LOG_DEBUG, "Skipped   exec+connect   service   [%s]", opt -> servname ) ; # ifndef OPENSSL_NO_TLSEXT } else if (! opt -> option. client && opt -> sni ) { s_log ( LOG_DEBUG, "Skipped   SNI   slave   service   [%s]", opt -> servname ) ; # endif } else { s_log ( LOG_ERR, "Invalid   service   [%s]", opt -> servname ) ; return 1 ; } } if ( listening_section < systemd_fds ) { s_log ( LOG_ERR, "Too   many   listening   file   descriptors   received   from   systemd,   got   %d", systemd_fds ) ; return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> NOEXPORT
Buggy code:
 <START_BUG> static void read_tx_mode_probs ( struct tx_probs * tx_probs, vp9_reader * r ) { <END_BUG> int i, j ; for ( i = 0 ; i < TX_SIZE_CONTEXTS ; ++ i ) for ( j = 0 ; j < TX_SIZES - 3 ; ++ j ) vp9_diff_update_prob ( r, & tx_probs -> p8x8 [ i ] [ j ] ) ; for ( i = 0 ; i < TX_SIZE_CONTEXTS ; ++ i ) for ( j = 0 ; j < TX_SIZES - 2 ; ++ j ) vp9_diff_update_prob ( r, & tx_probs -> p16x16 [ i ] [ j ] ) ; for ( i = 0 ; i < TX_SIZE_CONTEXTS ; ++ i ) for ( j = 0 ; j < TX_SIZES - 1 ; ++ j ) vp9_diff_update_prob ( r, & tx_probs -> p32x32 [ i ] [ j ] ) ; }

Fix:
<S2SV_ModStart> * tx_probs, vpx_reader <S2SV_ModEnd> * r )
Buggy code:
 <START_BUG> static int mem_resize ( jas_stream_memobj_t * m, int bufsize ) <END_BUG> { unsigned char * buf ;  assert ( bufsize >= 0 ) ; <START_BUG> <END_BUG> JAS_DBGLOG ( 100, ( "mem_resize(%p,   %d)\\n", m, bufsize ) ) ;  if (! ( buf = jas_realloc2 ( m -> buf_, bufsize, sizeof ( unsigned char ) ) ) && bufsize ) { JAS_DBGLOG ( 100, ( "mem_resize   realloc   failed\\n" ) ) ; return - 1 ; } JAS_DBGLOG ( 100, ( "mem_resize   realloc   succeeded\\n" ) ) ; m -> buf_ = buf ; m -> bufsize_ = bufsize ; return 0 ; }

Fix:
<S2SV_ModStart> * m, size_t <S2SV_ModEnd> bufsize ) { <S2SV_ModStart> * buf ; <S2SV_ModEnd> JAS_DBGLOG ( 100 <S2SV_ModStart> 100, ( "mem_resize(%p, <S2SV_blank> %zu)\\n" <S2SV_ModEnd>, m, <S2SV_ModStart> ) ) ; if (! bufsize ) { jas_eprintf ( "mem_resize <S2SV_blank> was <S2SV_blank> not <S2SV_blank> really <S2SV_blank> designed <S2SV_blank> to <S2SV_blank> handle <S2SV_blank> a <S2SV_blank> buffer <S2SV_blank> of <S2SV_blank> size <S2SV_blank> 0\\n" "This <S2SV_blank> may <S2SV_blank> not <S2SV_blank> work.\\n" ) ; }
Buggy code:
 static ssize_t aio_setup_vectored_rw ( struct kiocb * kiocb, int rw, char __user * buf, unsigned long * nr_segs, size_t * len, struct iovec * * iovec, <START_BUG> bool compat ) <END_BUG> { ssize_t ret ; * nr_segs = * len ; # ifdef CONFIG_COMPAT if ( compat ) ret = compat_rw_copy_check_uvector ( rw, ( struct compat_iovec __user * ) buf, * nr_segs, UIO_FASTIOV, * iovec, iovec ) ; else # endif ret = rw_copy_check_uvector ( rw, ( struct iovec __user * ) buf, * nr_segs, UIO_FASTIOV, * iovec, iovec ) ; if ( ret < 0 ) return ret ; * len = ret ;  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart>, bool compat, struct iov_iter * iter <S2SV_ModStart> = ret ; iov_iter_init ( iter, rw, * iovec, * nr_segs, * len ) ;
Buggy code:
 static int proc_connectinfo ( struct usb_dev_state * ps, void __user * arg ) { <START_BUG> struct usbdevfs_connectinfo ci = { <END_BUG> . devnum = ps -> dev -> devnum, <START_BUG>. slow = ps -> dev -> speed == USB_SPEED_LOW <END_BUG> } ;  if ( copy_to_user ( arg, & ci, sizeof ( ci ) ) ) return - EFAULT ; return 0 ; }

Fix:
<S2SV_ModStart> struct usbdevfs_connectinfo ci ; memset ( & ci, 0, sizeof ( ci ) ) ; ci <S2SV_ModEnd>. devnum = <S2SV_ModStart> dev -> devnum ; ci <S2SV_ModEnd>. slow = <S2SV_ModStart> speed == USB_SPEED_LOW <S2SV_ModEnd> ; if (
Buggy code:
 static int aes_ccm_ctrl ( EVP_CIPHER_CTX * c, int type, int arg, void * ptr ) { EVP_AES_CCM_CTX * cctx = EVP_C_DATA ( EVP_AES_CCM_CTX, c ) ; switch ( type ) { case EVP_CTRL_INIT : cctx -> key_set = 0 ; cctx -> iv_set = 0 ; cctx -> L = 8 ; cctx -> M = 12 ; cctx -> tag_set = 0 ; cctx -> len_set = 0 ; cctx -> tls_aad_len = - 1 ; return 1 ; case EVP_CTRL_AEAD_TLS1_AAD : if ( arg!= EVP_AEAD_TLS1_AAD_LEN ) return 0 ; memcpy ( EVP_CIPHER_CTX_buf_noconst ( c ), ptr, arg ) ; cctx -> tls_aad_len = arg ; { uint16_t len = EVP_CIPHER_CTX_buf_noconst ( c ) [ arg - 2 ] << 8 | EVP_CIPHER_CTX_buf_noconst ( c ) [ arg - 1 ] ; <START_BUG> len -= EVP_CCM_TLS_EXPLICIT_IV_LEN ; <END_BUG>  if (! EVP_CIPHER_CTX_encrypting ( c ) ) <START_BUG> <END_BUG> len -= cctx -> M ;  EVP_CIPHER_CTX_buf_noconst ( c ) [ arg - 2 ] = len >> 8 ; EVP_CIPHER_CTX_buf_noconst ( c ) [ arg - 1 ] = len & 0xff ; } return cctx -> M ; case EVP_CTRL_CCM_SET_IV_FIXED : if ( arg!= EVP_CCM_TLS_FIXED_IV_LEN ) return 0 ; memcpy ( EVP_CIPHER_CTX_iv_noconst ( c ), ptr, arg ) ; return 1 ; case EVP_CTRL_AEAD_SET_IVLEN : arg = 15 - arg ; case EVP_CTRL_CCM_SET_L : if ( arg < 2 || arg > 8

Fix:
<S2SV_ModStart> 1 ] ; if ( len < EVP_CCM_TLS_EXPLICIT_IV_LEN ) return 0 ; <S2SV_ModStart> c ) ) { if ( len < cctx -> M ) return 0 ; <S2SV_ModStart> -> M ; }
Buggy code:
 <START_BUG> int fit_config_verify_required_sigs ( const void * fit, int conf_noffset, <END_BUG> const void * sig_blob ) {  int noffset ; <START_BUG> int sig_node ; int verified = 0 ; int reqd_sigs = 0 ; bool reqd_policy_all = true ; <END_BUG> const char * reqd_mode ;  sig_node = fdt_subnode_offset ( sig_blob, 0, FIT_SIG_NODENAME ) ; if ( sig_node < 0 ) { debug ( "%s:   No   signature   node   found:   %s\\n", __func__, fdt_strerror ( sig_node ) ) ; return 0 ; } reqd_mode = fdt_getprop ( sig_blob, sig_node, "required-mode", NULL ) ; if ( reqd_mode &&! strcmp ( reqd_mode, "any" ) ) reqd_policy_all = false ; debug ( "%s:   required-mode   policy   set   to   \'%s\'\\n", __func__, reqd_policy_all? "all" : "any" ) ; fdt_for_each_subnode ( noffset, sig_blob, sig_node ) { const char * required ; int ret ; required = fdt_getprop ( sig_blob, noffset, FIT_KEY_REQUIRED, NULL ) ; if (! required || strcmp ( required, "conf" ) ) continue ; reqd_sigs ++ ; ret = fit_config_verify_sig ( fit, conf_noffset, sig_blob, noffset ) ; if ( ret ) { if ( reqd_policy_all ) { printf ( "Failed   to   verify   required   signature   \'%s\'\\n", fit_get_name ( sig_blob, noffset, NULL ) ) ; return ret ; } } else { verified ++ ; if (! reqd_policy_all ) break ; } } if ( reqd_sigs &&! verified ) { printf ( "Failed   to   verify   \'any\'   of   the   required   signature(s)\\n" ) ; return - EPERM ; } return 0 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> sig_blob ) { const char * name = fit_get_name ( fit, conf_noffset, NULL ) ; <S2SV_ModStart> * reqd_mode ; if ( strchr ( name, '@' ) ) { printf ( "Configuration <S2SV_blank> node <S2SV_blank> \'%s\' <S2SV_blank> contains <S2SV_blank> \'@\'\\n", name ) ; return - EPERM ; }