nus-yam/ex-repair huggingface dataset:
Buggy code:
 long do_shmat ( int shmid, char __user * shmaddr, int shmflg, ulong * raddr, unsigned long shmlba ) { struct shmid_kernel * shp ; unsigned long addr ; unsigned long size ; struct file * file ; int err ; unsigned long flags ; unsigned long prot ; int acc_mode ; struct ipc_namespace * ns ; struct shm_file_data * sfd ; struct path path ; fmode_t f_mode ; unsigned long populate = 0 ; err = - EINVAL ; if ( shmid < 0 ) goto out ; else if ( ( addr = ( ulong ) shmaddr ) ) { if ( addr & ( shmlba - 1 ) ) { <START_BUG> if ( shmflg & SHM_RND ) <END_BUG> addr &= ~ ( shmlba - 1 ) ; else # ifndef __ARCH_FORCE_SHMLBA if ( addr & ~ PAGE_MASK ) # endif goto out ; } flags = MAP_SHARED | MAP_FIXED ; } else { if ( ( shmflg & SHM_REMAP ) ) goto out ; flags = MAP_SHARED ; } if ( shmflg & SHM_RDONLY ) { prot = PROT_READ ; acc_mode = S_IRUGO ; f_mode = FMODE_READ ; } else { prot = PROT_READ | PROT_WRITE ; acc_mode = S_IRUGO | S_IWUGO ; f_mode = FMODE_READ | FMODE_WRITE ; } if ( shmflg & SHM_EXEC ) { prot |= PROT_EXEC ; acc_mode |= S_IXUGO ; } ns = current -> nsproxy -> ipc_ns ; rcu_read_lock ( ) ; shp = shm_obtain_object_check ( ns, shmid ) ; if ( IS_ERR ( shp ) ) { err = PTR_ERR ( shp ) ; goto out_unlock ; } err = - EACCES ; if ( ipcperms ( ns, & shp -> shm_perm, acc_mode ) ) goto out_unlock ; err = security_shm_shmat ( shp, shmaddr, shmflg ) ; if ( err ) goto out_unlock ; ipc_lock_object (

Fix:
<S2SV_ModStart> { if ( ( <S2SV_ModStart> shmflg & SHM_RND ) && addr >= shmlba
Buggy code:
 static double calculate_modified_err ( const VP9_COMP * cpi, <START_BUG> const FIRSTPASS_STATS * this_frame ) { <END_BUG>  const struct twopass_rc * twopass = & cpi -> twopass ; <START_BUG> const SVC * const svc = & cpi -> svc ; const FIRSTPASS_STATS * stats ; double av_err ; double modified_error ; if ( svc -> number_spatial_layers > 1 && svc -> number_temporal_layers == 1 ) { twopass = & svc -> layer_context [ svc -> spatial_layer_id ]. twopass ; } stats = & twopass -> total_stats ; <END_BUG> av_err = stats -> ssim_weighted_pred_err // stats -> count ;  <START_BUG> modified_error = av_err * pow ( this_frame -> ssim_weighted_pred_err // <END_BUG> DOUBLE_DIVIDE_CHECK ( av_err ),  cpi -> oxcf. two_pass_vbrbias // 100.0 ) ; <START_BUG> return fclamp ( modified_error, twopass -> modified_error_min, twopass -> modified_error_max ) ; }<END_BUG>

Fix:
<S2SV_ModStart> cpi, const TWO_PASS * twopass, const VP9EncoderConfig * oxcf, const <S2SV_ModStart> ) { const FIRSTPASS_STATS * const <S2SV_ModEnd> stats = & <S2SV_ModStart> -> total_stats ; const double av_weight <S2SV_ModEnd> = stats -> <S2SV_ModStart> = stats -> weight <S2SV_ModEnd> // stats -> <S2SV_ModStart> -> count ; const double av_err = ( stats -> coded_error * av_weight ) // stats -> count ; double <S2SV_ModStart> ( this_frame -> coded_error * this_frame -> weight <S2SV_ModEnd> // DOUBLE_DIVIDE_CHECK ( <S2SV_ModStart> av_err ), oxcf -> <S2SV_ModEnd> two_pass_vbrbias // 100.0 <S2SV_ModStart> two_pass_vbrbias // 100.0 ) ; modified_error *= pow ( calculate_active_area ( cpi, this_frame ), ACT_AREA_CORRECTION
Buggy code:
 static int handle_wrmsr ( struct kvm_vcpu * vcpu ) { struct msr_data msr ; u32 ecx = vcpu -> arch. regs [ VCPU_REGS_RCX ] ; u64 data = ( vcpu -> arch. regs [ VCPU_REGS_RAX ] & - 1u ) | ( ( u64 ) ( vcpu -> arch. regs [ VCPU_REGS_RDX ] & - 1u ) << 32 ) ; msr. data = data ; msr. index = ecx ; msr. host_initiated = false ; <START_BUG> if ( vmx_set_msr ( vcpu, & msr )!= 0 ) { <END_BUG> trace_kvm_msr_write_ex ( ecx, data ) ; kvm_inject_gp ( vcpu, 0 ) ; return 1 ; } trace_kvm_msr_write ( ecx, data ) ; skip_emulated_instruction ( vcpu ) ; return 1 ; }

Fix:
<S2SV_ModStart> ; if ( kvm_set_msr <S2SV_ModEnd> ( vcpu,
Buggy code:
 static void exif_mnote_data_canon_load ( ExifMnoteData * ne, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataCanon * n = ( ExifMnoteDataCanon * ) ne ; ExifShort c ; size_t i, tcount, o, datao ; if (! n ||! buf ||! buf_size ) { exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteCanon", "Short   MakerNote" ) ; return ; } datao = 6 + n -> offset ; <START_BUG> if ( ( datao + 2 < datao ) || ( datao + 2 < 2 ) || ( datao + 2 > buf_size ) ) { <END_BUG> exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteCanon", "Short   MakerNote" ) ; return ; } c = exif_get_short ( buf + datao, n -> order ) ; datao += 2 ; exif_mnote_data_canon_clear ( n ) ; n -> entries = exif_mem_alloc ( ne -> mem, sizeof ( MnoteCanonEntry ) * c ) ; if (! n -> entries ) { EXIF_LOG_NO_MEMORY ( ne -> log, "ExifMnoteCanon", sizeof ( MnoteCanonEntry ) * c ) ; return ; } tcount = 0 ; for ( i = c, o = datao ; i ; -- i, o += 12 ) { size_t s ;  if ( ( o + 12 < o ) || ( o + 12 < 12 ) || ( o + 12 > buf_size ) ) { <START_BUG> exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, <END_BUG> "ExifMnoteCanon", "Short   MakerNote" ) ;  break ; } n -> entries [ tcount ]. tag = exif_get_short ( buf + o, n -> order ) ; <START_BUG> n -> entries [ tcount ]. format = exif_get_short ( buf + o + 2, n -> order ) ; <END_BUG>  n -> entries [ tcount ]. components = exif_get_long ( buf + o +

Fix:
<S2SV_ModStart> ; if ( CHECKOVERFLOW ( datao, buf_size, 2 <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; if ( CHECKOVERFLOW ( o, buf_size, 12 ) ) { exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteCanon", "Short <S2SV_blank> MakerNote" ) ; break ; } n -> entries [ tcount ]. tag = exif_get_short ( buf + o, n -> order ) ; n -> entries [ tcount ]. format = exif_get_short ( buf + o + 2, n -> order ) ; n -> entries [ tcount ]. components = exif_get_long ( buf + o + 4, n -> order ) ; n -> entries [ tcount ]. order = n -> order ; exif_log ( ne -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteCanon", "Loading <S2SV_blank> entry <S2SV_blank> 0x%x <S2SV_blank> (\'%s\')...", n -> entries [ tcount ]. tag, mnote_canon_tag_get_name ( n -> entries [ tcount ]. tag ) ) ; if ( exif_format
Buggy code:
 static void nfs4_xdr_enc_getacl ( struct rpc_rqst * req, struct xdr_stream * xdr, struct nfs_getaclargs * args ) { struct compound_hdr hdr = {. minorversion = nfs4_xdr_minorversion ( & args -> seq_args ), } ; uint32_t replen ; encode_compound_hdr ( xdr, req, & hdr ) ; encode_sequence ( xdr, & args -> seq_args, & hdr ) ; encode_putfh ( xdr, args -> fh, & hdr ) ; <START_BUG> replen = hdr. replen + op_decode_hdr_maxsz + nfs4_fattr_bitmap_maxsz + 1 ; <END_BUG> encode_getattr_two ( xdr, FATTR4_WORD0_ACL, 0, & hdr ) ; xdr_inline_pages ( & req -> rq_rcv_buf, replen << 2, args -> acl_pages, args -> acl_pgbase, args -> acl_len ) ;  encode_nops ( & hdr ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> + op_decode_hdr_maxsz + <S2SV_ModEnd> 1 ; encode_getattr_two <S2SV_ModStart> acl_len ) ; xdr_set_scratch_buffer ( xdr, page_address ( args -> acl_scratch ), PAGE_SIZE ) ;
Buggy code:
 void fe_netjoin_init ( void ) { settings_add_bool ( "misc", "hide_netsplit_quits", TRUE ) ; settings_add_int ( "misc", "netjoin_max_nicks", 10 ) ; join_tag = - 1 ; printing_joins = FALSE ; read_settings ( ) ; signal_add ( "setup   changed", ( SIGNAL_FUNC ) read_settings ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> read_settings ) ; signal_add ( "server <S2SV_blank> disconnected", ( SIGNAL_FUNC ) sig_server_disconnected ) ;
Buggy code:
 <START_BUG> void * H264SwDecMalloc ( u32 size ) <END_BUG> {  return malloc ( size ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( u32 size, u32 num ) { if ( size > UINT32_MAX // num ) { return NULL ; } <S2SV_ModEnd> return malloc ( <S2SV_ModStart> malloc ( size * num
Buggy code:
 ssize_t oe_recvfrom ( int sockfd, void * buf, size_t len, int flags, <START_BUG> const struct oe_sockaddr * src_addr, <END_BUG> oe_socklen_t * addrlen ) { ssize_t ret = - 1 ; oe_fd_t * sock ; if (! ( sock = oe_fdtable_get ( sockfd, OE_FD_TYPE_SOCKET ) ) ) OE_RAISE_ERRNO ( oe_errno ) ; ret = sock -> ops. socket. recvfrom ( sock, buf, len, flags, src_addr, addrlen ) ; done : return ret ; }

Fix:
<S2SV_ModStart> int flags, <S2SV_ModEnd> struct oe_sockaddr *
Buggy code:
 static int sc_oberthur_read_file ( struct sc_pkcs15_card * p15card, const char * in_path, unsigned char * * out, size_t * out_len, int verify_pin ) { struct sc_context * ctx = p15card -> card -> ctx ; struct sc_card * card = p15card -> card ; struct sc_file * file = NULL ; struct sc_path path ; size_t sz ; int rv ; LOG_FUNC_CALLED ( ctx ) ; if (! in_path ||! out ||! out_len ) LOG_TEST_RET ( ctx, SC_ERROR_INVALID_ARGUMENTS, "Cannot   read   oberthur   file" ) ; sc_log ( ctx, "read   file   \'%s\';   verify_pin:%i", in_path, verify_pin ) ; * out = NULL ; * out_len = 0 ; sc_format_path ( in_path, & path ) ; rv = sc_select_file ( card, & path, & file ) ; if ( rv!= SC_SUCCESS ) { sc_file_free ( file ) ; LOG_TEST_RET ( ctx, rv, "Cannot   select   oberthur   file   to   read" ) ; } if ( file -> ef_structure == SC_FILE_EF_TRANSPARENT ) sz = file -> size ; else sz = ( file -> record_length + 2 ) * file -> record_count ; * out = calloc ( sz, 1 ) ; if ( * out == NULL ) { sc_file_free ( file ) ; LOG_TEST_RET ( ctx, SC_ERROR_OUT_OF_MEMORY, "Cannot   read   oberthur   file" ) ; } if ( file -> ef_structure == SC_FILE_EF_TRANSPARENT ) { rv = sc_read_binary ( card, 0, * out, sz, 0 ) ; } else { <START_BUG> int rec ; <END_BUG> int offs = 0 ;  int rec_len = file -> record_length ; <START_BUG> <END_BUG> for ( rec = 1 ; ; rec ++ ) {  rv = sc_read_record ( card, rec, * out + offs + 2, rec_len, SC_RECORD_BY_REC_NR ) ; if

Fix:
<S2SV_ModStart> } else { size_t rec ; size_t <S2SV_ModEnd> offs = 0 <S2SV_ModStart> = 0 ; size_t <S2SV_ModEnd> rec_len = file <S2SV_ModStart> ++ ) { if ( rec > file -> record_count ) { rv = 0 ; break ; }
Buggy code:
 void sctp_generate_t3_rtx_event ( unsigned long peer ) { int error ; struct sctp_transport * transport = ( struct sctp_transport * ) peer ; struct sctp_association * asoc = transport -> asoc ; <START_BUG> struct net * net = sock_net ( asoc -> base. sk ) ; <END_BUG>  bh_lock_sock ( asoc -> base. sk ) ; <START_BUG> <END_BUG> if ( sock_owned_by_user ( asoc -> base. sk ) ) {  pr_debug ( "%s:   sock   is   busy\\n", __func__ ) ; if (! mod_timer ( & transport -> T3_rtx_timer, jiffies + ( HZ // 20 ) ) ) sctp_transport_hold ( transport ) ; goto out_unlock ; } if ( transport -> dead ) goto out_unlock ; error = sctp_do_sm ( net, SCTP_EVENT_T_TIMEOUT, SCTP_ST_TIMEOUT ( SCTP_EVENT_TIMEOUT_T3_RTX ), asoc -> state, asoc -> ep, asoc, transport, GFP_ATOMIC ) ; if ( error ) <START_BUG> asoc -> base. sk -> sk_err = - error ; <END_BUG> out_unlock :  bh_unlock_sock ( asoc -> base. sk ) ; <START_BUG> sctp_transport_put ( transport ) ; }<END_BUG>

Fix:
<S2SV_ModStart> asoc ; struct sock * sk = asoc -> base. sk ; struct <S2SV_ModStart> = sock_net ( <S2SV_ModEnd> sk ) ; <S2SV_ModStart> ; bh_lock_sock ( <S2SV_ModEnd> sk ) ; <S2SV_ModStart> ( sock_owned_by_user ( <S2SV_ModEnd> sk ) ) <S2SV_ModStart> ( error ) <S2SV_ModEnd> sk -> sk_err <S2SV_ModStart> : bh_unlock_sock ( <S2SV_ModEnd> sk ) ;
Buggy code:
 int sqlite3Select ( Parse * pParse, Select * p, SelectDest * pDest ) { int i, j ; WhereInfo * pWInfo ; Vdbe * v ; int isAgg ; ExprList * pEList = 0 ; SrcList * pTabList ; Expr * pWhere ; ExprList * pGroupBy ; Expr * pHaving ; int rc = 1 ; DistinctCtx sDistinct ; SortCtx sSort ; AggInfo sAggInfo ; int iEnd ; sqlite3 * db ; ExprList * pMinMaxOrderBy = 0 ; u8 minMaxFlag ; db = pParse -> db ; v = sqlite3GetVdbe ( pParse ) ; if ( p == 0 || db -> mallocFailed || pParse -> nErr ) { return 1 ; } if ( sqlite3AuthCheck ( pParse, SQLITE_SELECT, 0, 0, 0 ) ) return 1 ; memset ( & sAggInfo, 0, sizeof ( sAggInfo ) ) ; # if SELECTTRACE_ENABLED SELECTTRACE ( 1, pParse, p, ( "begin   processing:\\n", pParse -> addrExplain ) ) ; if ( sqlite3SelectTrace & 0x100 ) { sqlite3TreeViewSelect ( 0, p, 0 ) ; } # endif assert ( p -> pOrderBy == 0 || pDest -> eDest!= SRT_DistFifo ) ; assert ( p -> pOrderBy == 0 || pDest -> eDest!= SRT_Fifo ) ; assert ( p -> pOrderBy == 0 || pDest -> eDest!= SRT_DistQueue ) ; assert ( p -> pOrderBy == 0 || pDest -> eDest!= SRT_Queue ) ; if ( IgnorableOrderby ( pDest ) ) { assert ( pDest -> eDest == SRT_Exists || pDest -> eDest == SRT_Union || pDest -> eDest == SRT_Except || pDest -> eDest == SRT_Discard || pDest -> eDest == SRT_Queue || pDest -> eDest == SRT_DistFifo || pDest -> eDest == SRT_DistQueue || pDest -> eDest == SRT_Fifo ) ; sqlite3ExprListDelete ( db, p -> pOrderBy ) ; p -> pOrderBy = 0 ; p -> selFlags &= ~ SF_Distinct ; } sqlite3SelectPrep ( pParse, p

Fix:
<S2SV_ModStart> ) == 0 && p -> pWin == 0
Buggy code:
 static ssize_t n_tty_write ( struct tty_struct * tty, struct file * file, const unsigned char * buf, size_t nr ) { const unsigned char * b = buf ; DECLARE_WAITQUEUE ( wait, current ) ; int c ; ssize_t retval = 0 ; if ( L_TOSTOP ( tty ) && file -> f_op -> write!= redirected_tty_write ) { retval = tty_check_change ( tty ) ; if ( retval ) return retval ; } down_read ( & tty -> termios_rwsem ) ; process_echoes ( tty ) ; add_wait_queue ( & tty -> write_wait, & wait ) ; while ( 1 ) { set_current_state ( TASK_INTERRUPTIBLE ) ; if ( signal_pending ( current ) ) { retval = - ERESTARTSYS ; break ; } if ( tty_hung_up_p ( file ) || ( tty -> link &&! tty -> link -> count ) ) { retval = - EIO ; break ; } if ( O_OPOST ( tty ) ) { while ( nr > 0 ) { ssize_t num = process_output_block ( tty, b, nr ) ; if ( num < 0 ) { if ( num == - EAGAIN ) break ; retval = num ; goto break_out ; } b += num ; nr -= num ; if ( nr == 0 ) break ; c = * b ; if ( process_output ( c, tty ) < 0 ) break ; b ++ ; nr -- ; } if ( tty -> ops -> flush_chars ) tty -> ops -> flush_chars ( tty ) ; } else { <START_BUG> while ( nr > 0 ) { <END_BUG>  c = tty -> ops -> write ( tty, b, nr ) ; <START_BUG> if ( c < 0 ) { retval = c ; goto break_out ; } if (! c ) break ; b += c ; nr -= c ; } } if (! nr ) break ; if ( file -> f_flags & O_NONBLOCK ) { retval = - EAGAIN ; break ; } up_read ( & tty -> termios_rwsem ) ; schedule ( ) ; down_read ( & tty -> termios_rwsem ) ; } break_out : __set_current_state ( TASK_RUNNING ) ; remove_wait_queue<END_BUG>

Fix:
<S2SV_ModStart> } else { struct n_tty_data * ldata = tty -> disc_data ; <S2SV_ModStart> 0 ) { mutex_lock ( & ldata -> output_lock ) ; <S2SV_ModStart> b, nr ) ; mutex_unlock ( & ldata -> output_lock
Buggy code:
 int readfile ( char_u * fname, char_u * sfname, linenr_T from, linenr_T lines_to_skip, linenr_T lines_to_read, exarg_T * eap, int flags ) { int fd = 0 ; int newfile = ( flags & READ_NEW ) ; int check_readonly ; int filtering = ( flags & READ_FILTER ) ; int read_stdin = ( flags & READ_STDIN ) ; int read_buffer = ( flags & READ_BUFFER ) ; int read_fifo = ( flags & READ_FIFO ) ; int set_options = newfile || read_buffer || ( eap!= NULL && eap -> read_edit ) ; linenr_T read_buf_lnum = 1 ; colnr_T read_buf_col = 0 ; char_u c ; linenr_T lnum = from ; char_u * ptr = NULL ; char_u * buffer = NULL ; char_u * new_buffer = NULL ; char_u * line_start = NULL ; int wasempty ; colnr_T len ; long size = 0 ; char_u * p ; off_T filesize = 0 ; int skip_read = FALSE ; # ifdef FEAT_CRYPT char_u * cryptkey = NULL ; int did_ask_for_key = FALSE ; # endif # ifdef FEAT_PERSISTENT_UNDO context_sha256_T sha_ctx ; int read_undo_file = FALSE ; # endif int split = 0 ; # define UNKNOWN 0x0fffffff linenr_T linecnt ; int error = FALSE ; int ff_error = EOL_UNKNOWN ; long linerest = 0 ; # ifdef UNIX int perm = 0 ; int swap_mode = - 1 ; # else int perm ; # endif int fileformat = 0 ; int keep_fileformat = FALSE ; stat_T st ; int file_readonly ; linenr_T skip_count = 0 ; linenr_T read_count = 0 ; int msg_save = msg_scroll ; linenr_T read_no_eol_lnum = 0 ; int try_mac ; int try_dos ; int try_unix ; int file_rewind = FALSE ; # ifdef FEAT_MBYTE int can_

Fix:
<S2SV_ModStart>!= NULL ) { char_u * swap_fname = <S2SV_ModEnd> curbuf -> b_ml <S2SV_ModStart> ml_mfp -> mf_fname ; if ( ( swap_mode & 044 ) == 040 ) { stat_T swap_st ; if ( mch_stat ( ( char * ) swap_fname, & swap_st ) >= 0 && st. st_gid!= swap_st. st_gid && fchown ( curbuf -> b_ml. ml_mfp -> mf_fd, - 1, st. st_gid ) == - 1 ) swap_mode &= 0600 ; } ( void ) mch_setperm ( swap_fname <S2SV_ModStart> swap_mode ) ; }
Buggy code:
 int dtls1_read_bytes ( SSL * s, int type, unsigned char * buf, int len, int peek ) { int al, i, j, ret ; unsigned int n ; SSL3_RECORD * rr ; void ( * cb ) ( const SSL * ssl, int type2, int val ) = NULL ; if ( s -> s3 -> rbuf. buf == NULL ) if (! ssl3_setup_buffers ( s ) ) return ( - 1 ) ; if ( ( type && ( type!= SSL3_RT_APPLICATION_DATA ) && ( type!= SSL3_RT_HANDSHAKE ) ) || ( peek && ( type!= SSL3_RT_APPLICATION_DATA ) ) ) { SSLerr ( SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR ) ; return - 1 ; } if ( ( ret = have_handshake_fragment ( s, type, buf, len, peek ) ) ) return ret ; # ifndef OPENSSL_NO_SCTP if ( (! s -> in_handshake && SSL_in_init ( s ) ) || ( BIO_dgram_is_sctp ( SSL_get_rbio ( s ) ) && ( s -> state == DTLS1_SCTP_ST_SR_READ_SOCK || s -> state == DTLS1_SCTP_ST_CR_READ_SOCK ) && s -> s3 -> in_read_app_data!= 2 ) ) # else if (! s -> in_handshake && SSL_in_init ( s ) ) # endif { i = s -> handshake_func ( s ) ; if ( i < 0 ) return ( i ) ; if ( i == 0 ) { SSLerr ( SSL_F_DTLS1_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE ) ; return ( - 1 ) ; } } start : s -> rwstate = SSL_NOTHING ; rr = & ( s -> s3 -> rrec ) ; if ( s -> state == SSL_ST_OK && rr -> length == 0 ) { pitem * item ; item = pqueue_pop ( s -> d1 -> buffered_app_data. q ) ; if ( item ) { # ifndef OPENSSL_NO_SCTP if ( BIO

Fix:
<S2SV_ModStart> ) ) { if ( <S2SV_ModStart> -> seq_num ) < 0 ) { SSLerr ( SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR ) ; return - 1 ; } <S2SV_ModEnd> rr -> length
Buggy code:
 static int newque ( struct ipc_namespace * ns, struct ipc_params * params ) { struct msg_queue * msq ; int id, retval ; key_t key = params -> key ; int msgflg = params -> flg ; msq = ipc_rcu_alloc ( sizeof ( * msq ) ) ; if (! msq ) return - ENOMEM ; msq -> q_perm. mode = msgflg & S_IRWXUGO ; msq -> q_perm. key = key ; msq -> q_perm. security = NULL ; retval = security_msg_queue_alloc ( msq ) ; if ( retval ) { ipc_rcu_putref ( msq, ipc_rcu_free ) ; return retval ; } <START_BUG> id = ipc_addid ( & msg_ids ( ns ), & msq -> q_perm, ns -> msg_ctlmni ) ; <END_BUG> if ( id < 0 ) { ipc_rcu_putref ( msq, msg_rcu_free ) ; return id ; }  msq -> q_stime = msq -> q_rtime = 0 ; <START_BUG> msq -> q_ctime = get_seconds ( ) ; msq -> q_cbytes = msq -> q_qnum = 0 ; msq -> q_qbytes = ns -> msg_ctlmnb ; msq -> q_lspid = msq -> q_lrpid = 0 ; INIT_LIST_HEAD ( & msq -> q_messages ) ; INIT_LIST_HEAD ( & msq -> q_receivers ) ; INIT_LIST_HEAD ( & msq -> q_senders ) ; ipc_unlock_object ( & msq -> q_perm ) ; rcu_read_unlock ( ) ; return msq -> q_perm. id ; }<END_BUG>

Fix:
<S2SV_ModStart> retval ; } msq -> q_stime = msq -> q_rtime = 0 ; msq -> q_ctime = get_seconds ( ) ; msq -> q_cbytes = msq -> q_qnum = 0 ; msq -> q_qbytes = ns -> msg_ctlmnb ; msq -> q_lspid = msq -> q_lrpid = 0 ; INIT_LIST_HEAD ( & msq -> q_messages ) ; INIT_LIST_HEAD ( & msq -> q_receivers ) ; INIT_LIST_HEAD ( & msq -> q_senders ) ; <S2SV_ModStart> id ; } <S2SV_ModEnd> ipc_unlock_object ( &
Buggy code:
 int vp9_receive_compressed_data ( VP9Decoder * pbi, <START_BUG> size_t size, const uint8_t * * psource, <END_BUG> int64_t time_stamp ) {  VP9_COMMON * const cm = & pbi -> common ; <START_BUG> const uint8_t * source = * psource ; int retcode = 0 ; cm -> error. error_code = VPX_CODEC_OK ; if ( size == 0 ) { <END_BUG> if ( cm -> frame_refs [ 0 ]. idx!= INT_MAX )  cm -> frame_refs [ 0 ]. buf -> corrupted = 1 ; } <START_BUG> if ( cm -> new_fb_idx >= 0 && cm -> frame_bufs [ cm -> new_fb_idx ]. ref_count == 0 ) <END_BUG>  cm -> release_fb_cb ( cm -> cb_priv, <START_BUG> <END_BUG> & cm -> frame_bufs [ cm -> new_fb_idx ]. raw_frame_buffer ) ;  cm -> new_fb_idx = get_free_fb ( cm ) ; <START_BUG> if ( setjmp ( cm -> error. jmp ) ) { <END_BUG>  cm -> error. setjmp = 0 ; <START_BUG> <END_BUG> if ( cm -> frame_refs [ 0 ]. idx!= INT_MAX )  cm -> frame_refs [ 0 ]. buf -> corrupted = 1 ; if ( cm -> frame_bufs [ cm -> new_fb_idx ]. ref_count > 0 ) cm -> frame_bufs [ cm -> new_fb_idx ]. ref_count -- ; return - 1 ; } cm -> error. setjmp = 1 ; <START_BUG> retcode = vp9_decode_frame ( pbi, source, source + size, psource ) ; <END_BUG>  if ( retcode < 0 ) { <START_BUG> <END_BUG> cm -> error. error_code = VPX_CODEC_ERROR ;  <START_BUG> cm -> error. setjmp = 0 ; <END_BUG> if ( cm -> frame_bufs [ cm -> new_fb_idx ]. ref_count > 0 ) cm -> frame_bufs [ cm -> new_fb_idx ]. ref_count -- ; return retcode ; }  swap_frame_buffers ( pbi ) ; <START_BUG> # if WRITE_RECON_BUFFER == 2 if ( cm -> show_frame ) write_dx_frame_to_file ( cm -><END_BUG>

Fix:
<S2SV_ModStart> * * psource <S2SV_ModEnd> ) { VP9_COMMON <S2SV_ModStart> { VP9_COMMON * volatile <S2SV_ModStart> pbi -> common ; BufferPool * volatile const pool = cm -> buffer_pool ; RefCntBuffer * volatile const frame_bufs = cm -> buffer_pool -> frame_bufs <S2SV_ModStart> ]. idx > 0 ) { assert ( cm -> frame_refs [ 0 ]. buf!= NULL ) ; <S2SV_ModEnd> cm -> frame_refs <S2SV_ModStart> 1 ; } } pbi -> ready_for_new_data = 0 ; if (! pbi -> frame_parallel_decode && <S2SV_ModEnd> cm -> new_fb_idx <S2SV_ModStart> >= 0 && <S2SV_ModEnd> frame_bufs [ cm <S2SV_ModStart> == 0 ) pool <S2SV_ModEnd> -> release_fb_cb ( <S2SV_ModStart> -> release_fb_cb ( pool <S2SV_ModEnd> -> cb_priv, <S2SV_ModStart> cb_priv, & <S2SV_ModEnd> frame_bufs [ cm <S2SV_ModStart> ; if ( cm -> new_fb_idx == INVALID_IDX ) return VPX_CODEC_MEM_ERROR ; cm -> cur_frame = & pool -> frame_bufs [ cm -> new_fb_idx ] ; pbi -> hold_ref_buf = 0 ; if ( pbi -> frame_
Buggy code:
 static int asf_read_marker ( AVFormatContext * s, int64_t size ) { AVIOContext * pb = s -> pb ; ASFContext * asf = s -> priv_data ; int i, count, name_len, ret ; char name [ 1024 ] ; avio_rl64 ( pb ) ; avio_rl64 ( pb ) ; count = avio_rl32 ( pb ) ; avio_rl16 ( pb ) ; name_len = avio_rl16 ( pb ) ; <START_BUG> for ( i = 0 ; i < name_len ; i ++ ) <END_BUG> avio_r8 ( pb ) ; for ( i = 0 ; i < count ; i ++ ) { int64_t pres_time ;  int name_len ; <START_BUG> avio_rl64 ( pb ) ; pres_time = avio_rl64 ( pb ) ; pres_time -= asf -> hdr. preroll * 10000 ; avio_rl16 ( pb ) ; avio_rl32 ( pb ) ; avio_rl32 ( pb ) ; name_len = avio_rl32 ( pb ) ; if ( ( ret = avio_get_str16le ( pb, name_len * 2, name, sizeof ( name ) ) ) < name_len ) avio_skip ( pb, name_len - ret ) ; avpriv_new_chapter ( s, i, ( AVRational ) { 1, 10000000 }, pres_time, AV_NOPTS_VALUE, name ) ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> pb ) ; avio_skip ( pb, name_len <S2SV_ModEnd> ) ; for <S2SV_ModStart> ; int name_len ; if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA
Buggy code:
 static int cdc_ncm_bind ( struct usbnet * dev, struct usb_interface * intf ) { <START_BUG> int ret ; <END_BUG> if ( cdc_ncm_select_altsetting ( intf )!= CDC_NCM_COMM_ALTSETTING_NCM ) return - ENODEV ;  ret = cdc_ncm_bind_common ( dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0 ) ; <START_BUG> <END_BUG> usbnet_link_change ( dev, 0, 0 ) ;  return ret ; }

Fix:
<S2SV_ModStart> intf ) { <S2SV_ModEnd> if ( cdc_ncm_select_altsetting <S2SV_ModStart> - ENODEV ; return <S2SV_ModEnd> cdc_ncm_bind_common ( dev <S2SV_ModStart> 0 ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int tls1_enc ( SSL * s, SSL3_RECORD * recs, unsigned int n_recs, int send ) { EVP_CIPHER_CTX * ds ; size_t reclen [ SSL_MAX_PIPELINES ] ; unsigned char buf [ SSL_MAX_PIPELINES ] [ EVP_AEAD_TLS1_AAD_LEN ] ; int bs, i, j, k, pad = 0, ret, mac_size = 0 ; const EVP_CIPHER * enc ; unsigned int ctr ; if ( send ) { if ( EVP_MD_CTX_md ( s -> write_hash ) ) { int n = EVP_MD_CTX_size ( s -> write_hash ) ; OPENSSL_assert ( n >= 0 ) ; } ds = s -> enc_write_ctx ; if ( s -> enc_write_ctx == NULL ) enc = NULL ; else { int ivlen ; enc = EVP_CIPHER_CTX_cipher ( s -> enc_write_ctx ) ; if ( SSL_USE_EXPLICIT_IV ( s ) && EVP_CIPHER_mode ( enc ) == EVP_CIPH_CBC_MODE ) ivlen = EVP_CIPHER_iv_length ( enc ) ; else ivlen = 0 ; if ( ivlen > 1 ) { for ( ctr = 0 ; ctr < n_recs ; ctr ++ ) { if ( recs [ ctr ]. data!= recs [ ctr ]. input ) { SSLerr ( SSL_F_TLS1_ENC, ERR_R_INTERNAL_ERROR ) ; return - 1 ; } else if ( RAND_bytes ( recs [ ctr ]. input, ivlen ) <= 0 ) { SSLerr ( SSL_F_TLS1_ENC, ERR_R_INTERNAL_ERROR ) ; return - 1 ; } } } } } else { if ( EVP_MD_CTX_md ( s -> read_hash ) ) { int n = EVP_MD_CTX_size ( s -> read_hash ) ; OPENSSL_assert ( n >= 0 ) ; } ds = s -> enc_read_ctx ; if ( s -> enc_read_ctx == NULL ) enc = NULL ; else enc = EVP_CIPHER_CTX_cipher ( s ->

Fix:
<S2SV_ModStart> if (! SSL_READ_ETM <S2SV_ModEnd> ( s )
Buggy code:
 static MagickBooleanType ReadDXT3 ( Image * image, DDSInfo * dds_info, ExceptionInfo * exception ) { DDSColors colors ; ssize_t j, y ; PixelPacket * q ; register ssize_t i, x ; unsigned char alpha ; size_t a0, a1, bits, code ; unsigned short c0, c1 ; for ( y = 0 ; y < ( ssize_t ) dds_info -> height ; y += 4 ) { for ( x = 0 ; x < ( ssize_t ) dds_info -> width ; x += 4 ) { <START_BUG> q = QueueAuthenticPixels ( image, x, y, Min ( 4, dds_info -> width - x ), <END_BUG>  Min ( 4, dds_info -> height - y ), exception ) ; <START_BUG> if ( q == ( PixelPacket * ) NULL ) return MagickFalse ; a0 = ReadBlobLSBLong ( image ) ; a1 = ReadBlobLSBLong ( image ) ; c0 = ReadBlobLSBShort ( image ) ; c1 = ReadBlobLSBShort ( image ) ; bits = ReadBlobLSBLong ( image ) ; CalculateColors ( c0, c1, & colors, MagickTrue ) ; for ( j = 0 ; j < 4 ; j ++ ) { for ( i = 0 ; i < 4 ; i ++ ) { if ( ( x + i ) < ( ssize_t ) dds_info -> width && ( y + j ) < ( ssize_t ) dds_info -> height ) { code = ( bits >> ( ( 4 * j + i ) * 2 ) ) & 0x3 ; SetPixelRed ( q, ScaleCharToQuantum ( colors. r [ code ] ) ) ; SetPixelGreen ( q, ScaleCharToQuantum ( colors. g [ code ] ) ) ; SetPixelBlue ( q, ScaleCharToQuantum ( colors. b [ code ] ) ) ; if ( j < 2 ) alpha = 17U * ( unsigned char ) ( ( a0 >> ( 4 * ( 4 * j + i ) ) ) & 0xf ) ; else alpha = 17U * ( unsigned char ) ( ( a1 >> ( 4 * ( 4 * ( j - 2 ) + i ) ) ) & 0xf ) ; SetPixelAlpha ( q,<END_BUG>

Fix:
<S2SV_ModStart>, y, MagickMin <S2SV_ModEnd> ( 4, <S2SV_ModStart> x ), MagickMin <S2SV_ModEnd> ( 4, <S2SV_ModStart> ; } } return ( <S2SV_ModStart> dds_info, 16, exception ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int lmp_print_data_link_subobjs ( netdissect_options * ndo, const u_char * obj_tptr, int total_subobj_len, int offset ) { int hexdump = FALSE ; int subobj_type, subobj_len ; union { float f ; uint32_t i ; } bw ; while ( total_subobj_len > 0 && hexdump == FALSE ) { <START_BUG> subobj_type = EXTRACT_8BITS ( obj_tptr + offset ) ; <END_BUG> subobj_len = EXTRACT_8BITS ( obj_tptr + offset + 1 ) ; ND_PRINT ( ( ndo, "\\n\\t         Subobject,   Type:   %s   (%u),   Length:   %u", tok2str ( lmp_data_link_subobj, "Unknown", subobj_type ), subobj_type, subobj_len ) ) ; if ( subobj_len < 4 ) { ND_PRINT ( ( ndo, "   (too   short)" ) ) ; break ; } if ( ( subobj_len % 4 )!= 0 ) { ND_PRINT ( ( ndo, "   (not   a   multiple   of   4)" ) ) ; break ; } if ( total_subobj_len < subobj_len ) { ND_PRINT ( ( ndo, "   (goes   past   the   end   of   the   object)" ) ) ; break ; } switch ( subobj_type ) { case INT_SWITCHING_TYPE_SUBOBJ :  ND_PRINT ( ( ndo, "\\n\\t             Switching   Type:   %s   (%u)", <START_BUG> tok2str ( gmpls_switch_cap_values, "Unknown", EXTRACT_8BITS ( obj_tptr + offset + 2 ) ), <END_BUG> EXTRACT_8BITS ( obj_tptr + offset + 2 ) ) ) ;  ND_PRINT ( ( ndo, "\\n\\t             Encoding   Type:   %s   (%u)", tok2str ( gmpls_encoding_values, "Unknown", EXTRACT_8BITS ( obj_tptr + offset + 3 ) ), EXTRACT_8BITS

Fix:
<S2SV_ModStart> FALSE ) { ND_TCHECK_16BITS ( obj_tptr + offset ) ; <S2SV_ModStart> case INT_SWITCHING_TYPE_SUBOBJ : ND_TCHECK_8BITS ( obj_tptr + offset + 2 ) ; <S2SV_ModStart> 2 ) ) ) ; ND_TCHECK_8BITS ( obj_tptr + offset + 3 <S2SV_ModStart> ) ) ; ND_TCHECK_32BITS ( obj_tptr + offset + 8 ) ; <S2SV_ModStart> case WAVELENGTH_SUBOBJ : ND_TCHECK_32BITS ( obj_tptr + offset + 4 ) ;
Buggy code:
 WORD32 ixheaacd_real_synth_filt ( ia_esbr_hbe_txposer_struct * ptr_hbe_txposer, WORD32 num_columns, FLOAT32 qmf_buf_real [ ] [ 64 ], FLOAT32 qmf_buf_imag [ ] [ 64 ] ) { WORD32 i, j, k, l, idx ; FLOAT32 g [ 640 ] ; FLOAT32 w [ 640 ] ; FLOAT32 synth_out [ 128 ] ; FLOAT32 accu_r ; WORD32 synth_size = ptr_hbe_txposer -> synth_size ; FLOAT32 * ptr_cos_tab_trans_qmf = ( FLOAT32 * ) & ixheaacd_cos_table_trans_qmf [ 0 ] [ 0 ] + ptr_hbe_txposer -> k_start * 32 ; FLOAT32 * buffer = ptr_hbe_txposer -> synth_buf ; for ( idx = 0 ; idx < num_columns ; idx ++ ) { FLOAT32 loc_qmf_buf [ 64 ] ; FLOAT32 * synth_buf_r = loc_qmf_buf ; FLOAT32 * out_buf = ptr_hbe_txposer -> ptr_input_buf + ( idx + 1 ) * ptr_hbe_txposer -> synth_size ; FLOAT32 * synth_cos_tab = ptr_hbe_txposer -> synth_cos_tab ; const FLOAT32 * interp_window_coeff = ptr_hbe_txposer -> synth_wind_coeff ; if ( ptr_hbe_txposer -> k_start < 0 ) return - 1 ; for ( k = 0 ; k < synth_size ; k ++ ) { WORD32 ki = ptr_hbe_txposer -> k_start + k ; synth_buf_r [ k ] = ( FLOAT32 ) ( ptr_cos_tab_trans_qmf [ ( k << 1 ) + 0 ] * qmf_buf_real [ idx ] [ ki ] + ptr_cos_tab_trans_qmf [ ( k << 1 ) + 1 ] * qmf_buf_imag [ idx ] [ ki ] ) ; synth_buf_r [ k + ptr_hbe_txposer -> synth_size ] = 0

Fix:
<S2SV_ModStart> ; if ( ptr_hbe_txposer -> <S2SV_ModStart> ) ( * ( ptr_hbe_txposer -> ixheaacd_real_synth_fft ) ) <S2SV_ModEnd> ( synth_buf_r,
Buggy code:
 apr_status_t ap_http_filter ( ap_filter_t * f, apr_bucket_brigade * b, ap_input_mode_t mode, apr_read_type_e block, apr_off_t readbytes ) { core_server_config * conf ; apr_bucket * e ; http_ctx_t * ctx = f -> ctx ; apr_status_t rv ; apr_off_t totalread ; int again ; conf = ( core_server_config * ) ap_get_module_config ( f -> r -> server -> module_config, & core_module ) ; if ( mode!= AP_MODE_READBYTES && mode!= AP_MODE_GETLINE ) { return ap_get_brigade ( f -> next, b, mode, block, readbytes ) ; } if (! ctx ) { const char * tenc, * lenp ; f -> ctx = ctx = apr_pcalloc ( f -> r -> pool, sizeof ( * ctx ) ) ; ctx -> state = BODY_NONE ; if (! f -> r -> proxyreq ) { ctx -> limit = ap_get_limit_req_body ( f -> r ) ; } else { ctx -> limit = 0 ; } tenc = apr_table_get ( f -> r -> headers_in, "Transfer-Encoding" ) ; lenp = apr_table_get ( f -> r -> headers_in, "Content-Length" ) ; if ( tenc ) { if ( strcasecmp ( tenc, "chunked" ) == 0 || ap_find_last_token ( f -> r -> pool, tenc, "chunked" ) ) { ctx -> state = BODY_CHUNK ; } else if ( f -> r -> proxyreq == PROXYREQ_RESPONSE ) { ap_log_rerror ( APLOG_MARK, APLOG_INFO, 0, f -> r, APLOGNO ( 02555 ) <START_BUG> "Unknown   Transfer-Encoding:   %s;" <END_BUG> "   using   read-until-close", tenc ) ; tenc = NULL ; } else { ap_log_rerror ( APLOG_MARK, APLOG_INFO, 0, f -> r, APLOGNO ( 01585 ) "Unknown   Transfer-Encoding:   %s",

Fix:
<S2SV_ModStart> ( 02555 ) "Unknown <S2SV_blank> Transfer-Encoding: <S2SV_blank> %s; <S2SV_blank> " "using <S2SV_blank> read-until-close" <S2SV_ModEnd>, tenc ) <S2SV_ModStart> ) ; return APR_EINVAL <S2SV_ModEnd> ; } if <S2SV_ModStart> bb ) ; apr_brigade_cleanup ( bb ) ; <S2SV_ModStart> BODY_CHUNK_EXT : case BODY_CHUNK_LF : case BODY_CHUNK_END : case BODY_CHUNK_END_LF <S2SV_ModEnd> : { rv <S2SV_ModStart> BODY_CHUNK_TRAILER ) { return read_chunked_trailers ( ctx, f, b, conf -> merge_trailers == AP_MERGE_TRAILERS_ENABLE <S2SV_ModEnd> ) ; } <S2SV_ModStart> default : { ap_log_rerror ( APLOG_MARK, APLOG_ERR, 0, f -> r, APLOGNO ( 02901 ) "Unexpected <S2SV_blank> body <S2SV_blank> state <S2SV_blank> (%i)", ( int ) ctx -> state ) ; return APR_EGENERAL <S2SV_ModEnd> ; } }
Buggy code:
 static void accumulate_stats ( FIRSTPASS_STATS * section, const FIRSTPASS_STATS * frame ) { section -> frame += frame -> frame ; <START_BUG> section -> spatial_layer_id = frame -> spatial_layer_id ; <END_BUG> section -> intra_error += frame -> intra_error ; section -> coded_error += frame -> coded_error ; section -> sr_coded_error += frame -> sr_coded_error ;  section -> ssim_weighted_pred_err += frame -> ssim_weighted_pred_err ; <START_BUG> section -> pcnt_inter += frame -> pcnt_inter ; section -> pcnt_motion += frame -> pcnt_motion ; section -> pcnt_second_ref += frame -> pcnt_second_ref ; <END_BUG> section -> pcnt_neutral += frame -> pcnt_neutral ;  section -> MVr += frame -> MVr ; section -> mvr_abs += frame -> mvr_abs ; section -> MVc += frame -> MVc ; section -> mvc_abs += frame -> mvc_abs ; section -> MVrv += frame -> MVrv ; section -> MVcv += frame -> MVcv ; section -> mv_in_out_count += frame -> mv_in_out_count ; section -> new_mv_count += frame -> new_mv_count ; section -> count += frame -> count ; section -> duration += frame -> duration ; }

Fix:
<S2SV_ModStart> ; section -> weight += frame -> weight ; section -> <S2SV_ModStart> ; section -> <S2SV_ModEnd> pcnt_inter += frame <S2SV_ModStart> frame -> pcnt_neutral ; section -> intra_skip_pct += frame -> intra_skip_pct ; section -> inactive_zone_rows += frame -> inactive_zone_rows ; section -> inactive_zone_cols += frame -> inactive_zone_cols
Buggy code:
 <START_BUG> void options_free ( ) { <END_BUG>  parse_global_option ( CMD_FREE, NULL, NULL ) ; <START_BUG> <END_BUG> } 

Fix:
<S2SV_ModStart> void options_free ( int current ) { GLOBAL_OPTIONS * global = current? & global_options : & new_global_options ; SERVICE_OPTIONS * service = current? & service_options : & new_service_options ; <S2SV_ModEnd> parse_global_option ( CMD_FREE <S2SV_ModStart> parse_global_option ( CMD_FREE, global <S2SV_ModStart> NULL ) ; CRYPTO_THREAD_write_lock ( stunnel_locks [ LOCK_SECTIONS ] ) ; while ( service ) { SERVICE_OPTIONS * tmp = service ; service = service -> next ; tmp -> next = NULL ; service_free ( tmp ) ; } CRYPTO_THREAD_unlock ( stunnel_locks [ LOCK_SECTIONS ] ) ;
Buggy code:
 static ssize_t _consolefs_writev ( oe_fd_t * desc, const struct oe_iovec * iov, int iovcnt ) { ssize_t ret = - 1 ; file_t * file = _cast_file ( desc ) ; void * buf = NULL ; size_t buf_size = 0 ; <START_BUG> if (! file || (! iov && iovcnt ) || iovcnt < 0 || iovcnt > OE_IOV_MAX ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( iov, iovcnt, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_writev_ocall ( & ret, file -> host_fd, buf, iovcnt, buf_size )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> done : <END_BUG> if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> = 0 ; size_t data_size = 0 ; <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> ) ; } if ( ret > ( ssize_t ) data_size ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 static void tun_net_init ( struct net_device * dev ) { struct tun_struct * tun = netdev_priv ( dev ) ; switch ( tun -> flags & TUN_TYPE_MASK ) { case TUN_TUN_DEV : dev -> netdev_ops = & tun_netdev_ops ; dev -> hard_header_len = 0 ; dev -> addr_len = 0 ; dev -> mtu = 1500 ; dev -> type = ARPHRD_NONE ; dev -> flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST ; dev -> tx_queue_len = TUN_READQ_SIZE ; break ; case TUN_TAP_DEV : dev -> netdev_ops = & tap_netdev_ops ; ether_setup ( dev ) ; <START_BUG> random_ether_addr ( dev -> dev_addr ) ; <END_BUG> dev -> tx_queue_len = TUN_READQ_SIZE ; break ; } }

Fix:
<S2SV_ModStart> dev ) ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ;
Buggy code:
 static void iriap_getvaluebyclass_indication ( struct iriap_cb * self, struct sk_buff * skb ) { struct ias_object * obj ; struct ias_attrib * attrib ; int name_len ; int attr_len ; char name [ IAS_MAX_CLASSNAME + 1 ] ; char attr [ IAS_MAX_ATTRIBNAME + 1 ] ; __u8 * fp ; int n ; IRDA_DEBUG ( 4, "%s()\\n", __func__ ) ; IRDA_ASSERT ( self!= NULL, return ; ) ; IRDA_ASSERT ( self -> magic == IAS_MAGIC, return ; ) ; IRDA_ASSERT ( skb!= NULL, return ; ) ; fp = skb -> data ; n = 1 ; name_len = fp [ n ++ ] ; <START_BUG> memcpy ( name, fp + n, name_len ) ; n += name_len ; <END_BUG> name [ name_len ] = '\\0' ;  attr_len = fp [ n ++ ] ; <START_BUG> memcpy ( attr, fp + n, attr_len ) ; n += attr_len ; attr [ attr_len ] = '\\0' ; IRDA_DEBUG ( 4, "LM-IAS:   Looking   up   %s:   %s\\n", name, attr ) ; obj = irias_find_object ( name ) ; if ( obj == NULL ) { IRDA_DEBUG ( 2, "LM-IAS:   Object   %s   not   found\\n", name ) ; iriap_getvaluebyclass_response ( self, 0x1235, IAS_CLASS_UNKNOWN, & irias_missing ) ; return ; } IRDA_DEBUG ( 4, "LM-IAS:   found   %s,   id=%d\\n", obj -> name, obj -> id ) ; attrib = irias_find_attrib ( obj, attr ) ; if ( attrib == NULL ) { IRDA_DEBUG ( 2, "LM-IAS:   Attribute   %s   not   found\\n", attr ) ; iriap_getvaluebyclass_response ( self, obj -> id, IAS_ATTRIB_UNKNOWN, & irias_missing ) ; return ; } iriap_getvaluebyclass_response ( self, obj -><END_BUG>

Fix:
<S2SV_ModStart> ++ ] ; IRDA_ASSERT ( name_len < IAS_MAX_CLASSNAME + 1, return ; ) ; <S2SV_ModStart> n ++ ] ; IRDA_ASSERT ( attr_len < IAS_MAX_ATTRIBNAME + 1, return ; )
Buggy code:
 static ssize_t ucma_write ( struct file * filp, const char __user * buf, size_t len, loff_t * pos ) { struct ucma_file * file = filp -> private_data ; struct rdma_ucm_cmd_hdr hdr ; <START_BUG> ssize_t ret ; <END_BUG> if ( len < sizeof ( hdr ) ) return - EINVAL ; if ( copy_from_user ( & hdr, buf, sizeof ( hdr ) ) ) return - EFAULT ; if ( hdr. cmd >= ARRAY_SIZE ( ucma_cmd_table ) ) return - EINVAL ; if ( hdr. in + sizeof ( hdr ) > len ) return - EINVAL ; if (! ucma_cmd_table [ hdr. cmd ] ) return - ENOSYS ; ret = ucma_cmd_table [ hdr. cmd ] ( file, buf + sizeof ( hdr ), hdr. in, hdr. out ) ; if (! ret ) ret = len ; return ret ; }

Fix:
<S2SV_ModStart> ; ssize_t ret ; if ( WARN_ON_ONCE (! ib_safe_file_access ( filp ) ) ) return - EACCES
Buggy code:
 static void tokenadd ( struct jv_parser * p, char c ) { assert ( p -> tokenpos <= p -> tokenlen ) ; <START_BUG> if ( p -> tokenpos == p -> tokenlen ) { <END_BUG> p -> tokenlen = p -> tokenlen * 2 + 256 ; p -> tokenbuf = jv_mem_realloc ( p -> tokenbuf, p -> tokenlen ) ; } assert ( p -> tokenpos < p -> tokenlen ) ; p -> tokenbuf [ p -> tokenpos ++ ] = c ; }

Fix:
<S2SV_ModStart> p -> tokenpos >= ( <S2SV_ModEnd> p -> tokenlen <S2SV_ModStart> p -> tokenlen - 1 )
Buggy code:
 static void queue_delete ( struct snd_seq_queue * q ) { <START_BUG> snd_seq_timer_stop ( q -> timer ) ; <END_BUG>  snd_seq_timer_close ( q ) ; <START_BUG> snd_use_lock_sync ( & q -> use_lock ) ; snd_seq_prioq_delete ( & q -> tickq ) ; snd_seq_prioq_delete ( & q -> timeq ) ; snd_seq_timer_delete ( & q -> timer ) ; kfree ( q ) ; }<END_BUG>

Fix:
<S2SV_ModStart> q ) { mutex_lock ( & q -> timer_mutex ) ; <S2SV_ModStart> snd_seq_timer_close ( q ) ; mutex_unlock ( & q -> timer_mutex
Buggy code:
 static int tcos_select_file ( sc_card_t * card, const sc_path_t * in_path, sc_file_t * * file_out ) { sc_context_t * ctx ; sc_apdu_t apdu ; sc_file_t * file = NULL ; u8 buf [ SC_MAX_APDU_BUFFER_SIZE ], pathbuf [ SC_MAX_PATH_SIZE ], * path = pathbuf ; unsigned int i ; int r, pathlen ; assert ( card!= NULL && in_path!= NULL ) ; ctx = card -> ctx ; memcpy ( path, in_path -> value, in_path -> len ) ; pathlen = in_path -> len ; sc_format_apdu ( card, & apdu, SC_APDU_CASE_4_SHORT, 0xA4, 0, 0x04 ) ; switch ( in_path -> type ) { case SC_PATH_TYPE_FILE_ID : if ( pathlen!= 2 ) return SC_ERROR_INVALID_ARGUMENTS ; case SC_PATH_TYPE_FROM_CURRENT : apdu. p1 = 9 ; break ; case SC_PATH_TYPE_DF_NAME : apdu. p1 = 4 ; break ; case SC_PATH_TYPE_PATH : apdu. p1 = 8 ; if ( pathlen >= 2 && memcmp ( path, "\\x3F\\x00", 2 ) == 0 ) path += 2, pathlen -= 2 ; if ( pathlen == 0 ) apdu. p1 = 0 ; break ; case SC_PATH_TYPE_PARENT : apdu. p1 = 3 ; pathlen = 0 ; break ; default : SC_FUNC_RETURN ( ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_ARGUMENTS ) ; } if ( pathlen == 0 ) apdu. cse = SC_APDU_CASE_2_SHORT ; apdu. lc = pathlen ; apdu. data = path ; apdu. datalen = pathlen ; if ( file_out!= NULL ) { apdu. resp = buf ; apdu. resplen = sizeof ( buf ) ; apdu. le = 256 ; } else { apdu. resplen = 0 ; apdu. le = 0 ; apdu. p2 = 0x0C ; apdu. cse = ( pathlen == 0 )? SC_APDU_

Fix:
<S2SV_ModStart> ] ) { size_t <S2SV_ModEnd> j, len <S2SV_ModStart> case 0x84 : file -> namelen = MIN ( sizeof file -> name, len ) ; <S2SV_ModStart>, d, <S2SV_ModEnd> file -> namelen <S2SV_ModStart> file -> namelen ) <S2SV_ModEnd> ; break ;
Buggy code:
 int btrfs_add_link ( struct btrfs_trans_handle * trans, struct inode * parent_inode, struct inode * inode, const char * name, int name_len, int add_backref, u64 index ) { int ret = 0 ; struct btrfs_key key ; struct btrfs_root * root = BTRFS_I ( parent_inode ) -> root ; u64 ino = btrfs_ino ( inode ) ; u64 parent_ino = btrfs_ino ( parent_inode ) ; if ( unlikely ( ino == BTRFS_FIRST_FREE_OBJECTID ) ) { memcpy ( & key, & BTRFS_I ( inode ) -> root -> root_key, sizeof ( key ) ) ; } else { key. objectid = ino ; btrfs_set_key_type ( & key, BTRFS_INODE_ITEM_KEY ) ; key. offset = 0 ; } if ( unlikely ( ino == BTRFS_FIRST_FREE_OBJECTID ) ) { ret = btrfs_add_root_ref ( trans, root -> fs_info -> tree_root, key. objectid, root -> root_key. objectid, parent_ino, index, name, name_len ) ; } else if ( add_backref ) { ret = btrfs_insert_inode_ref ( trans, root, name, name_len, ino, parent_ino, index ) ; } if ( ret ) return ret ; ret = btrfs_insert_dir_item ( trans, root, name, name_len, parent_inode, & key, btrfs_inode_type ( inode ), index ) ; <START_BUG> if ( ret == - EEXIST ) <END_BUG> goto fail_dir_item ; else if ( ret ) { btrfs_abort_transaction ( trans, root, ret ) ; return ret ; } btrfs_i_size_write ( parent_inode, parent_inode -> i_size + name_len * 2 ) ; inode_inc_iversion ( parent_inode ) ; parent_inode -> i_mtime = parent_inode -> i_ctime = CURRENT_TIME ; ret = btrfs_update_inode ( trans, root,

Fix:
<S2SV_ModStart> == - EEXIST || ret == - EOVERFLOW
Buggy code:
 static int cop1Emulate ( struct pt_regs * xcp, struct mips_fpu_struct * ctx, void * __user * fault_addr ) { mips_instruction ir ; unsigned long emulpc, contpc ; unsigned int cond ; if (! access_ok ( VERIFY_READ, xcp -> cp0_epc, sizeof ( mips_instruction ) ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) xcp -> cp0_epc ; return SIGBUS ; } if ( __get_user ( ir, ( mips_instruction __user * ) xcp -> cp0_epc ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) xcp -> cp0_epc ; return SIGSEGV ; } if ( ( xcp -> cp0_cause & CAUSEF_BD ) &&! isBranchInstr ( & ir ) ) xcp -> cp0_cause &= ~ CAUSEF_BD ; if ( xcp -> cp0_cause & CAUSEF_BD ) { emulpc = xcp -> cp0_epc + 4 ; if ( __compute_return_epc ( xcp ) ) { # ifdef CP1DBG printk ( "failed   to   emulate   branch   at   %p\\n", ( void * ) ( xcp -> cp0_epc ) ) ; # endif return SIGILL ; } if (! access_ok ( VERIFY_READ, emulpc, sizeof ( mips_instruction ) ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) emulpc ; return SIGBUS ; } if ( __get_user ( ir, ( mips_instruction __user * ) emulpc ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) emulpc ; return SIGSEGV ; } contpc = xcp -> cp0_epc ; xcp -> cp0_epc = emulpc -

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, xcp,
Buggy code:
 int main ( int argc, char * * argv ) { int error ; my_bool first_argument_uses_wildcards = 0 ; char * wild ; MYSQL mysql ; MY_INIT ( argv [ 0 ] ) ; my_getopt_use_args_separator = TRUE ; if ( load_defaults ( "my", load_default_groups, & argc, & argv ) ) exit ( 1 ) ; my_getopt_use_args_separator = FALSE ; get_options ( & argc, & argv ) ; wild = 0 ; if ( argc ) { char * pos = argv [ argc - 1 ], * to ; for ( to = pos ; * pos ; pos ++, to ++ ) { switch ( * pos ) { case '*' : * pos = '%' ; first_argument_uses_wildcards = 1 ; break ; case '?' : * pos = '_' ; first_argument_uses_wildcards = 1 ; break ; case '%' : case '_' : first_argument_uses_wildcards = 1 ; break ; case '\\\\' : pos ++ ; default : break ; } * to = * pos ; } * to = * pos ; } if ( first_argument_uses_wildcards ) wild = argv [ -- argc ] ; else if ( argc == 3 ) wild = argv [ -- argc ] ; if ( argc > 2 ) { fprintf ( stderr, "%s:   Too   many   arguments\\n", my_progname ) ; exit ( 1 ) ; } mysql_init ( & mysql ) ; if ( opt_compress ) mysql_options ( & mysql, MYSQL_OPT_COMPRESS, NullS ) ; <START_BUG> # ifdef HAVE_OPENSSL <END_BUG> if ( opt_use_ssl ) { mysql_ssl_set ( & mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca, opt_ssl_capath, opt_ssl_cipher ) ; mysql_options ( & mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl ) ; mysql_options ( & mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath ) ; } mysql_options ( & mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, ( char * ) & opt_ssl_verify_server_cert ) ; # endif if ( opt_protocol

Fix:
<S2SV_ModStart> NullS ) ; SSL_SET_OPTIONS ( & mysql ) ; <S2SV_ModEnd> if ( opt_protocol
Buggy code:
 static int simulate_rdhwr ( struct pt_regs * regs, unsigned int opcode ) { struct thread_info * ti = task_thread_info ( current ) ; if ( ( opcode & OPCODE ) == SPEC3 && ( opcode & FUNC ) == RDHWR ) { int rd = ( opcode & RD ) >> 11 ; int rt = ( opcode & RT ) >> 16 ; perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, <START_BUG> 1, 0, regs, 0 ) ; <END_BUG> switch ( rd ) { case 0 : regs -> regs [ rt ] = smp_processor_id ( ) ; return 0 ; case 1 : regs -> regs [ rt ] = min ( current_cpu_data. dcache. linesz, current_cpu_data. icache. linesz ) ; return 0 ; case 2 : regs -> regs [ rt ] = read_c0_count ( ) ; return 0 ; case 3 : switch ( current_cpu_data. cputype ) { case CPU_20KC : case CPU_25KF : regs -> regs [ rt ] = 1 ; break ; default : regs -> regs [ rt ] = 2 ; } return 0 ; case 29 : regs -> regs [ rt ] = ti -> tp_value ; return 0 ; default : return - 1 ; } } return - 1 ; }

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, 0
Buggy code:
 static void cmd_parse_lsub ( struct ImapData * idata, char * s ) { char buf [ STRING ] ; char errstr [ STRING ] ; struct Buffer err, token ; struct Url url ; struct ImapList list ; if ( idata -> cmddata && idata -> cmdtype == IMAP_CT_LIST ) { cmd_parse_list ( idata, s ) ; return ; } if (! ImapCheckSubscribed ) return ; idata -> cmdtype = IMAP_CT_LIST ; idata -> cmddata = & list ; cmd_parse_list ( idata, s ) ; idata -> cmddata = NULL ; if (! list. name || list. noselect ) return ; mutt_debug ( 3, "Subscribing   to   %s\\n", list. name ) ; mutt_str_strfcpy ( buf, "mailboxes   \\"", sizeof ( buf ) ) ; mutt_account_tourl ( & idata -> conn -> account, & url ) ; <START_BUG> imap_quote_string ( errstr, sizeof ( errstr ), list. name ) ; <END_BUG> url. path = errstr + 1 ; url. path [ strlen ( url. path ) - 1 ] = '\\0' ; if ( mutt_str_strcmp ( url. user, ImapUser ) == 0 ) url. user = NULL ; url_tostring ( & url, buf + 11, sizeof ( buf ) - 11, 0 ) ; mutt_str_strcat ( buf, sizeof ( buf ), "\\"" ) ; mutt_buffer_init ( & token ) ; mutt_buffer_init ( & err ) ; err. data = errstr ; err. dsize = sizeof ( errstr ) ; if ( mutt_parse_rc_line ( buf, & token, & err ) ) mutt_debug ( 1, "Error   adding   subscribed   mailbox:   %s\\n", errstr ) ; FREE ( & token. data ) ; }

Fix:
<S2SV_ModStart> list. name, true