nus-yam/ex-repair huggingface dataset:
Buggy code:
 static gboolean parse_cosine_packet ( FILE_T fh, struct wtap_pkthdr * phdr, Buffer * buf, char * line, int * err, gchar * * err_info ) { union wtap_pseudo_header * pseudo_header = & phdr -> pseudo_header ; int num_items_scanned ; <START_BUG> int yy, mm, dd, hr, min, sec, csec ; <END_BUG> guint pkt_len ; int pro, off, pri, rm, error ; guint code1, code2 ; char if_name [ COSINE_MAX_IF_NAME_LEN ] = "", direction [ 6 ] = "" ; struct tm tm ; guint8 * pd ; int i, hex_lines, n, caplen = 0 ; if ( sscanf ( line, "%4d-%2d-%2d,%2d:%2d:%2d.%9d:", & yy, & mm, & dd, & hr, & min, & sec, & csec ) == 7 ) { num_items_scanned = sscanf ( line,  "%4d-%2d-%2d,%2d:%2d:%2d.%9d:   %5s   (%127[A-Za-z0-9//:]),   Length:%9u,   Pro:%9d,   Off:%9d,   Pri:%9d,   RM:%9d,   Err:%9d   [%8x,   %8x]", <START_BUG> & yy, & mm, & dd, & hr, & min, & sec, & csec, direction, if_name, & pkt_len, & pro, & off, & pri, & rm, & error, & code1, & code2 ) ; if ( num_items_scanned!= 17 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "cosine:   purported   control   blade   line   doesn\'t   have   code   values" ) ; return FALSE ; } } else { num_items_scanned = sscanf ( line, <END_BUG> "%5s   (%127[A-Za-z0-9//:]),   Length:%9u,   Pro:%9d,   Off:%9d,  

Fix:
<S2SV_ModStart> sec, csec, <S2SV_ModEnd> pkt_len ; int <S2SV_ModStart> ( line, "%4d-%2d-%2d,%2d:%2d:%2d.%9d: <S2SV_blank> %5s <S2SV_blank> (%127[A-Za-z0-9//:]), <S2SV_blank> Length:%9d, <S2SV_blank> Pro:%9d, <S2SV_blank> Off:%9d, <S2SV_blank> Pri:%9d, <S2SV_blank> RM:%9d, <S2SV_blank> Err:%9d <S2SV_blank> [%8x, <S2SV_blank> %8x]" <S2SV_ModEnd>, & yy <S2SV_ModStart> ( line, "%5s <S2SV_blank> (%127[A-Za-z0-9//:]), <S2SV_blank> Length:%9d, <S2SV_blank> Pro:%9d, <S2SV_blank> Off:%9d, <S2SV_blank> Pri:%9d, <S2SV_blank> RM:%9d, <S2SV_blank> Err:%9d <S2SV_blank> [%8x, <S2SV_blank> %8x]" <S2SV_ModEnd>, direction, <S2SV_ModStart> csec = 0 ; } if ( pkt_len < 0 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "cosine: <S2SV_blank> packet <S2SV_blank> header <S2SV_blank> has <S2SV_blank> a <S2SV_blank> negative <S2SV_blank> packet <S2SV_blank> length" ) ; return FALSE
Buggy code:
 <START_BUG> static int read_fragment_table ( long long * directory_table_end ) <END_BUG> { int res, i ;  int bytes = SQUASHFS_FRAGMENT_BYTES ( sBlk. s. fragments ) ; <START_BUG> <END_BUG> int indexes = SQUASHFS_FRAGMENT_INDEXES ( sBlk. s. fragments ) ;  long long fragment_table_index [ indexes ] ; TRACE ( "read_fragment_table:   %d   fragments,   reading   %d   fragment   indexes   " "from   0x%llx\\n", sBlk. s. fragments, indexes, sBlk. s. fragment_table_start ) ; <START_BUG> if ( sBlk. s. fragments == 0 ) { <END_BUG> * directory_table_end = sBlk. s. fragment_table_start ; return TRUE ; } fragment_table = malloc ( bytes ) ; if ( fragment_table == NULL ) EXIT_UNSQUASH ( "read_fragment_table:   failed   to   allocate   " "fragment   table\\n" ) ; res = read_fs_bytes ( fd, sBlk. s. fragment_table_start,  SQUASHFS_FRAGMENT_INDEX_BYTES ( sBlk. s. fragments ), <START_BUG> fragment_table_index ) ; if ( res == FALSE ) { ERROR ( "read_fragment_table:   failed   to   read   fragment   table   " "index\\n" ) ; return FALSE ; } SQUASHFS_INSWAP_FRAGMENT_INDEXES ( fragment_table_index, indexes ) ; for ( i = 0 ; i < indexes ; i ++ ) { int expected = ( i + 1 )!= indexes? SQUASHFS_METADATA_SIZE : bytes & ( SQUASHFS_METADATA_SIZE - 1 ) ; int length = read_block ( fd, fragment_table_index [ i ], NULL, expected, ( ( char * ) fragment_table ) + ( i * SQUASHFS_METADATA_SIZE ) ) ; TRACE ( "Read   fragment   table   block   %d,   from   0x%llx,   length   %d\\n", i, fragment_table_index [ i ], length ) ; if ( length == FALSE ) { ERROR ( "read_fragment_table:  <END_BUG>

Fix:
<S2SV_ModStart> long long * table_start <S2SV_ModEnd> ) { int <S2SV_ModStart>, i ; long long <S2SV_ModEnd> bytes = SQUASHFS_FRAGMENT_BYTES <S2SV_ModStart> = SQUASHFS_FRAGMENT_BYTES ( ( long long ) <S2SV_ModStart> = SQUASHFS_FRAGMENT_INDEXES ( ( long long ) sBlk. s. fragments ) ; int length = SQUASHFS_FRAGMENT_INDEX_BYTES ( ( long long ) sBlk. s. fragments ) ; long long * fragment_table_index ; if ( length!= ( * table_start - sBlk. s. fragment_table_start ) ) { ERROR ( "read_fragment_table: <S2SV_blank> Bad <S2SV_blank> fragment <S2SV_blank> count <S2SV_blank> in <S2SV_blank> super <S2SV_blank> block\\n" ) ; return FALSE ; } <S2SV_ModEnd> TRACE ( "read_fragment_table: <S2SV_blank> %d <S2SV_blank> fragments, <S2SV_blank> reading <S2SV_blank> %d <S2SV_blank> fragment <S2SV_blank> indexes <S2SV_blank> " <S2SV_ModStart> fragment_table_start ) ; fragment_table_index = alloc_index_table ( indexes ) ; <S2SV_ModEnd> fragment_table = malloc <S2SV_ModStart>. fragment_table_start, length <S2SV_ModEnd>, fragment_table_index ) <S2SV_ModStart> ) ; * table_start <S2SV_ModEnd> = fragment_table_index [
Buggy code:
 static long pipe_set_size ( struct pipe_inode_info * pipe, unsigned long nr_pages ) { struct pipe_buffer * bufs ; if ( nr_pages < pipe -> nrbufs ) return - EBUSY ; bufs = kcalloc ( nr_pages, sizeof ( * bufs ), GFP_KERNEL | __GFP_NOWARN ) ; if ( unlikely (! bufs ) ) return - ENOMEM ; if ( pipe -> nrbufs ) { unsigned int tail ; unsigned int head ; tail = pipe -> curbuf + pipe -> nrbufs ; if ( tail < pipe -> buffers ) tail = 0 ; else tail &= ( pipe -> buffers - 1 ) ; head = pipe -> nrbufs - tail ; if ( head ) memcpy ( bufs, pipe -> bufs + pipe -> curbuf, head * sizeof ( struct pipe_buffer ) ) ; if ( tail ) memcpy ( bufs + head, pipe -> bufs, tail * sizeof ( struct pipe_buffer ) ) ; } <START_BUG> pipe -> curbuf = 0 ; <END_BUG> kfree ( pipe -> bufs ) ; pipe -> bufs = bufs ; pipe -> buffers = nr_pages ; return nr_pages * PAGE_SIZE ; }

Fix:
<S2SV_ModStart> ) ; } account_pipe_buffers ( pipe, pipe -> buffers, nr_pages ) ;
Buggy code:
 static bool assoc_array_insert_into_terminal_node ( struct assoc_array_edit * edit, const struct assoc_array_ops * ops, const void * index_key, struct assoc_array_walk_result * result ) { struct assoc_array_shortcut * shortcut, * new_s0 ; struct assoc_array_node * node, * new_n0, * new_n1, * side ; struct assoc_array_ptr * ptr ; unsigned long dissimilarity, base_seg, blank ; size_t keylen ; bool have_meta ; int level, diff ; int slot, next_slot, free_slot, i, j ; node = result -> terminal_node. node ; level = result -> terminal_node. level ; edit -> segment_cache [ ASSOC_ARRAY_FAN_OUT ] = result -> terminal_node. slot ; pr_devel ( "-->%s()\\n", __func__ ) ; free_slot = - 1 ; for ( i = 0 ; i < ASSOC_ARRAY_FAN_OUT ; i ++ ) { ptr = node -> slots [ i ] ; if (! ptr ) { free_slot = i ; continue ; } <START_BUG> if ( ops -> compare_object ( assoc_array_ptr_to_leaf ( ptr ), index_key ) ) { <END_BUG> pr_devel ( "replace   in   slot   %d\\n", i ) ; edit -> leaf_p = & node -> slots [ i ] ; edit -> dead_leaf = node -> slots [ i ] ; pr_devel ( "<--%s()   =   ok   [replace]\\n", __func__ ) ; return true ; } } if ( free_slot >= 0 ) { pr_devel ( "insert   in   free   slot   %d\\n", free_slot ) ; edit -> leaf_p = & node -> slots [ free_slot ] ; edit -> adjust_count_on = node ; pr_devel ( "<--%s()   =   ok   [insert]\\n", __func__ ) ; return true ; } new_n0 = kzalloc ( sizeof ( struct assoc_array_node ), GFP_KERNEL ) ; if (! new_n0 ) return false ; edit -> new_meta [ 0 ] =

Fix:
<S2SV_ModStart> } if ( assoc_array_ptr_is_leaf ( ptr ) &&
Buggy code:
 <START_BUG> void sum_2_variances ( const var * a, const var * b, var * r ) { <END_BUG> fill_variance ( a -> sum_square_error + b -> sum_square_error,  a -> sum_error + b -> sum_error, a -> count + b -> count, r ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> r ) { assert ( a -> log2_count == b -> log2_count ) ; <S2SV_ModStart>, a -> log2_count + 1 <S2SV_ModEnd>, r )
Buggy code:
 stmt_ty <START_BUG> With ( asdl_seq * items, asdl_seq * body, int lineno, int col_offset, int <END_BUG> end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = With_kind ; p -> v. With. items = items ; p -> v. With. body = body ;  p -> lineno = lineno ; <START_BUG> p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> * body, string type_comment, <S2SV_ModStart> ; p -> v. With. type_comment = type_comment ; p ->
Buggy code:
 long vorbis_book_decodev_set ( codebook * book, ogg_int32_t * a, oggpack_buffer * b, int n, int point ) { if ( book -> used_entries > 0 ) { ogg_int32_t * v = book -> dec_buf ; int i, j ; if (! v ) return - 1 ; for ( i = 0 ; i < n ; ) { if ( decode_map ( book, b, v, point ) ) return - 1 ; <START_BUG> for ( j = 0 ; j < book -> dim ; j ++ ) <END_BUG> a [ i ++ ] = v [ j ] ; } } else { int i, j ; for ( i = 0 ; i < n ; ) {  for ( j = 0 ; j < book -> dim ; j ++ ) <START_BUG> a [ i ++ ] = 0 ; } } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> book -> dim && i < n <S2SV_ModStart> book -> dim && i < n
Buggy code:
 static int atalk_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { <START_BUG> struct sock * sk = sock -> sk ; <END_BUG> struct sockaddr_at * sat = ( struct sockaddr_at * ) msg -> msg_name ; struct ddpehdr * ddp ; int copied = 0 ; int offset = 0 ; int err = 0 ; struct sk_buff * skb ; skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & err ) ; lock_sock ( sk ) ; if (! skb ) goto out ; ddp = ddp_hdr ( skb ) ; copied = ntohs ( ddp -> deh_len_hops ) & 1023 ; if ( sk -> sk_type!= SOCK_RAW ) { offset = sizeof ( * ddp ) ; copied -= offset ; } if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } err = skb_copy_datagram_iovec ( skb, offset, msg -> msg_iov, copied ) ;  if (! err ) { <START_BUG> if ( sat ) { sat -> sat_family = AF_APPLETALK ; sat -> sat_port = ddp -> deh_sport ; sat -> sat_addr. s_node = ddp -> deh_snode ; sat -> sat_addr. s_net = ddp -> deh_snet ; <END_BUG> }  msg -> msg_namelen = sizeof ( * sat ) ; } skb_free_datagram ( sk, skb ) ; out : release_sock ( sk ) ; return err? : copied ; }

Fix:
<S2SV_ModStart> sock -> sk <S2SV_ModEnd> ; struct ddpehdr <S2SV_ModStart> (! err && msg -> msg_name ) { struct sockaddr_at * sat = msg -> msg_name ; <S2SV_ModEnd> sat -> sat_family <S2SV_ModStart> -> deh_snet ; <S2SV_ModEnd> msg -> msg_namelen
Buggy code:
 void * _TIFFmalloc ( tmsize_t s ) <START_BUG> { <END_BUG> return ( malloc ( ( size_t ) s ) ) ; }

Fix:
<S2SV_ModStart> s ) { if ( s == 0 ) return ( ( void * ) NULL ) ;
Buggy code:
 static int hfsplus_readdir ( struct file * filp, void * dirent, filldir_t filldir ) { struct inode * inode = filp -> f_path. dentry -> d_inode ; struct super_block * sb = inode -> i_sb ; int len, err ; char strbuf [ HFSPLUS_MAX_STRLEN + 1 ] ; hfsplus_cat_entry entry ; struct hfs_find_data fd ; struct hfsplus_readdir_data * rd ; u16 type ; if ( filp -> f_pos >= inode -> i_size ) return 0 ; err = hfs_find_init ( HFSPLUS_SB ( sb ) -> cat_tree, & fd ) ; if ( err ) return err ; hfsplus_cat_build_key ( sb, fd. search_key, inode -> i_ino, NULL ) ; err = hfs_brec_find ( & fd ) ; if ( err ) goto out ; switch ( ( u32 ) filp -> f_pos ) { case 0 : if ( filldir ( dirent, ".", 1, 0, inode -> i_ino, DT_DIR ) ) goto out ; filp -> f_pos ++ ; case 1 : <START_BUG> hfs_bnode_read ( fd. bnode, & entry, fd. entryoffset, <END_BUG> fd. entrylength ) ; if ( be16_to_cpu ( entry. type )!= HFSPLUS_FOLDER_THREAD ) { printk ( KERN_ERR "hfs:   bad   catalog   folder   thread\\n" ) ; err = - EIO ; goto out ; } if ( fd. entrylength < HFSPLUS_MIN_THREAD_SZ ) { printk ( KERN_ERR "hfs:   truncated   catalog   thread\\n" ) ; err = - EIO ; goto out ; } if ( filldir ( dirent, "..", 2, 1, be32_to_cpu ( entry. thread. parentID ), DT_DIR ) ) goto out ; filp -> f_pos ++ ; default : if ( filp -> f_pos >= inode -> i_size ) goto out ; err = hfs_brec_goto ( & fd, filp -> f_pos - 1 )

Fix:
<S2SV_ModStart> case 1 : if ( fd. entrylength > sizeof ( entry ) || fd. entrylength < 0 ) { err = - EIO ; goto out ; } <S2SV_ModStart> out ; } if ( fd. entrylength > sizeof ( entry ) || fd. entrylength < 0 ) { err = - EIO ; goto out ; }
Buggy code:
 static int userfaultfd_unregister ( struct userfaultfd_ctx * ctx, unsigned long arg ) { struct mm_struct * mm = ctx -> mm ; struct vm_area_struct * vma, * prev, * cur ; int ret ; struct uffdio_range uffdio_unregister ; unsigned long new_flags ; bool found ; unsigned long start, end, vma_end ; const void __user * buf = ( void __user * ) arg ; ret = - EFAULT ; if ( copy_from_user ( & uffdio_unregister, buf, sizeof ( uffdio_unregister ) ) ) goto out ; ret = validate_range ( mm, uffdio_unregister. start, uffdio_unregister. len ) ; if ( ret ) goto out ; start = uffdio_unregister. start ; end = start + uffdio_unregister. len ; ret = - ENOMEM ; if (! mmget_not_zero ( mm ) ) goto out ; down_write ( & mm -> mmap_sem ) ; <START_BUG> vma = find_vma_prev ( mm, start, & prev ) ; <END_BUG> if (! vma ) goto out_unlock ; ret = - EINVAL ; if ( vma -> vm_start >= end ) goto out_unlock ; if ( is_vm_hugetlb_page ( vma ) ) { unsigned long vma_hpagesize = vma_kernel_pagesize ( vma ) ; if ( start & ( vma_hpagesize - 1 ) ) goto out_unlock ; } found = false ; ret = - EINVAL ; for ( cur = vma ; cur && cur -> vm_start < end ; cur = cur -> vm_next ) { cond_resched ( ) ; BUG_ON (!! cur -> vm_userfaultfd_ctx. ctx ^!! ( cur -> vm_flags & ( VM_UFFD_MISSING | VM_UFFD_WP ) ) ) ; if (! vma_can_userfault ( cur ) ) goto out_unlock ; found = true ; } BUG_ON (! found ) ; if ( vma -> vm_start < start ) prev = vma ; ret = 0 ; do { cond_resched (

Fix:
<S2SV_ModStart> mmap_sem ) ; if (! mmget_still_valid ( mm ) ) goto out_unlock ;
Buggy code:
 NORET_TYPE void do_exit ( long code ) { struct task_struct * tsk = current ; int group_dead ; profile_task_exit ( tsk ) ; WARN_ON ( atomic_read ( & tsk -> fs_excl ) ) ; if ( unlikely ( in_interrupt ( ) ) ) panic ( "Aiee,   killing   interrupt   handler!" ) ; if ( unlikely (! tsk -> pid ) ) panic ( "Attempted   to   kill   the   idle   task!" ) ; tracehook_report_exit ( & code ) ; if ( unlikely ( tsk -> flags & PF_EXITING ) ) { printk ( KERN_ALERT "Fixing   recursive   fault   but   reboot   is   needed!\\n" ) ; tsk -> flags |= PF_EXITPIDONE ; if ( tsk -> io_context ) exit_io_context ( ) ; set_current_state ( TASK_UNINTERRUPTIBLE ) ; schedule ( ) ; } exit_signals ( tsk ) ; smp_mb ( ) ; spin_unlock_wait ( & tsk -> pi_lock ) ; if ( unlikely ( in_atomic ( ) ) ) printk ( KERN_INFO "note:   %s[%d]   exited   with   preempt_count   %d\\n", current -> comm, task_pid_nr ( current ), preempt_count ( ) ) ; acct_update_integrals ( tsk ) ; if ( tsk -> mm ) { update_hiwater_rss ( tsk -> mm ) ; update_hiwater_vm ( tsk -> mm ) ; } group_dead = atomic_dec_and_test ( & tsk -> signal -> live ) ; if ( group_dead ) { hrtimer_cancel ( & tsk -> signal -> real_timer ) ; exit_itimers ( tsk -> signal ) ; } acct_collect ( code, group_dead ) ; <START_BUG> # ifdef CONFIG_FUTEX <END_BUG>  if ( unlikely ( tsk -> robust_list ) ) <START_BUG> exit_robust_list ( tsk ) ; # ifdef CONFIG_COMPAT if ( unlikely ( tsk -> compat_robust_list ) ) compat_exit_robust_list ( tsk )<END_BUG>

Fix:
<S2SV_ModStart> group_dead ) ; if ( group_dead ) tty_audit_exit ( ) ; if ( unlikely ( tsk -> audit_context ) ) audit_free ( tsk ) ; tsk -> exit_code = code ; taskstats_exit ( tsk, group_dead ) ; exit_mm ( tsk ) ; if ( group_dead ) acct_process ( ) ; trace_sched_process_exit ( tsk ) ; exit_sem ( tsk ) ; exit_files ( tsk ) ; exit_fs ( tsk ) ; check_stack_usage ( ) ; exit_thread ( ) ; cgroup_exit ( tsk, 1 ) ; exit_keys ( tsk ) ; if ( group_dead && tsk -> signal -> leader ) disassociate_ctty ( 1 ) ; module_put ( task_thread_info ( tsk ) -> exec_domain -> module ) ; if ( tsk -> binfmt ) module_put ( tsk -> binfmt -> module ) ; proc_exit_connector ( tsk ) ; exit_notify ( tsk, group_dead ) ; # ifdef CONFIG_NUMA mpol_put ( tsk -> mempolicy
Buggy code:
 static int loadImage ( TIFF * in, struct image_data * image, struct dump_opts * dump, unsigned char * * read_ptr ) { uint32 i ; float xres = 0.0, yres = 0.0 ; <START_BUG> uint16 nstrips = 0, ntiles = 0, planar = 0 ; <END_BUG> uint16 bps = 0, spp = 0, res_unit = 0 ; uint16 orientation = 0 ; uint16 input_compression = 0, input_photometric = 0 ; uint16 subsampling_horiz, subsampling_vert ; uint32 width = 0, length = 0 ; uint32 stsize = 0, tlsize = 0, buffsize = 0, scanlinesize = 0 ; uint32 tw = 0, tl = 0 ; uint32 tile_rowsize = 0 ; unsigned char * read_buff = NULL ; unsigned char * new_buff = NULL ; int readunit = 0 ; static uint32 prev_readsize = 0 ; TIFFGetFieldDefaulted ( in, TIFFTAG_BITSPERSAMPLE, & bps ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_SAMPLESPERPIXEL, & spp ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_PLANARCONFIG, & planar ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_ORIENTATION, & orientation ) ; if (! TIFFGetFieldDefaulted ( in, TIFFTAG_PHOTOMETRIC, & input_photometric ) ) TIFFError ( "loadImage", "Image   lacks   Photometric   interpreation   tag" ) ; if (! TIFFGetField ( in, TIFFTAG_IMAGEWIDTH, & width ) ) TIFFError ( "loadimage", "Image   lacks   image   width   tag" ) ; if (! TIFFGetField ( in, TIFFTAG_IMAGELENGTH, & length ) ) TIFFError ( "loadimage", "Image   lacks   image   length   tag" ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_XRESOLUTION, & xres ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_YRESOLUTION, & yres ) ; if (! TIFFGetFieldDefaulted ( in, TIFFTAG_RESOLUTIONUNIT, & res_unit ) ) res_unit = RESUNIT_INCH ;

Fix:
<S2SV_ModStart> = 0.0 ; uint32 nstrips = 0, ntiles = 0 ; uint16 <S2SV_ModEnd> planar = 0 <S2SV_ModStart>! read_buff ) { if ( buffsize > 0xFFFFFFFFU - 3 ) { TIFFError ( "loadImage", "Unable <S2SV_blank> to <S2SV_blank> allocate//reallocate <S2SV_blank> read <S2SV_blank> buffer" ) ; return ( - 1 ) ; } <S2SV_ModStart> 3 ) ; } <S2SV_ModStart> buffsize ) { if ( buffsize > 0xFFFFFFFFU - 3 ) { TIFFError ( "loadImage", "Unable <S2SV_blank> to <S2SV_blank> allocate//reallocate <S2SV_blank> read <S2SV_blank> buffer" ) ; return ( - 1 ) ; }
Buggy code:
 int sqlite3Fts3InitTokenizer ( Fts3Hash * pHash, const char * zArg, sqlite3_tokenizer * * ppTok, char * * pzErr ) { int rc ; char * z = ( char * ) zArg ; int n = 0 ; char * zCopy ; char * zEnd ; sqlite3_tokenizer_module * m ; zCopy = sqlite3_mprintf ( "%s", zArg ) ; if (! zCopy ) return SQLITE_NOMEM ; zEnd = & zCopy [ strlen ( zCopy ) ] ; z = ( char * ) sqlite3Fts3NextToken ( zCopy, & n ) ; if ( z == 0 ) { assert ( n == 0 ) ; z = zCopy ; } z [ n ] = '\\0' ; sqlite3Fts3Dequote ( z ) ; m = ( sqlite3_tokenizer_module * ) sqlite3Fts3HashFind ( pHash, z, ( int ) strlen ( z ) + 1 ) ; if (! m ) { sqlite3Fts3ErrMsg ( pzErr, "unknown   tokenizer:   %s", z ) ; rc = SQLITE_ERROR ; } else { char const * * aArg = 0 ; int iArg = 0 ; z = & z [ n + 1 ] ; while ( z < zEnd && ( NULL!= ( z = ( char * ) sqlite3Fts3NextToken ( z, & n ) ) ) ) { <START_BUG> int nNew = sizeof ( char * ) * ( iArg + 1 ) ; <END_BUG>  char const * * aNew = ( const char * * ) sqlite3_realloc ( ( void * ) aArg, nNew ) ; <START_BUG> if (! aNew ) { sqlite3_free ( zCopy ) ; sqlite3_free ( ( void * ) aArg ) ; return SQLITE_NOMEM ; } aArg = aNew ; aArg [ iArg ++ ] = z ; z [ n ] = '\\0' ; sqlite3Fts3Dequote ( z ) ; z = & z [ n + 1 ] ; } rc = m -> xCreate ( iArg, aArg, ppTok ) ; assert ( rc!= SQLITE_OK || * ppTok ) ; if ( rc!= SQLITE_OK ) { sqlite3Fts3ErrMsg ( pz<END_BUG>

Fix:
<S2SV_ModStart> ) ) { sqlite3_int64 <S2SV_ModEnd> nNew = sizeof <S2SV_ModStart> * * ) sqlite3_realloc64 <S2SV_ModEnd> ( ( void
Buggy code:
 int llc_print ( netdissect_options * ndo, const u_char * p, u_int length, u_int caplen, const struct lladdr_info * src, const struct lladdr_info * dst ) { uint8_t dsap_field, dsap, ssap_field, ssap ; uint16_t control ; int hdrlen ; int is_u ; if ( caplen < 3 ) { ND_PRINT ( ( ndo, "[|llc]" ) ) ; ND_DEFAULTPRINT ( ( const u_char * ) p, caplen ) ; return ( caplen ) ; } if ( length < 3 ) { ND_PRINT ( ( ndo, "[|llc]" ) ) ; ND_DEFAULTPRINT ( ( const u_char * ) p, caplen ) ; return ( length ) ; } dsap_field = * p ; ssap_field = * ( p + 1 ) ; control = * ( p + 2 ) ; if ( ( control & LLC_U_FMT ) == LLC_U_FMT ) { is_u = 1 ; hdrlen = 3 ; } else { if ( caplen < 4 ) { ND_PRINT ( ( ndo, "[|llc]" ) ) ; ND_DEFAULTPRINT ( ( const u_char * ) p, caplen ) ; return ( caplen ) ; } if ( length < 4 ) { ND_PRINT ( ( ndo, "[|llc]" ) ) ; ND_DEFAULTPRINT ( ( const u_char * ) p, caplen ) ; return ( length ) ; } control = EXTRACT_LE_16BITS ( p + 2 ) ; is_u = 0 ; hdrlen = 4 ; } if ( ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL ) { if ( ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "IPX   802.3:   " ) ) ; ipx_print ( ndo, p, length ) ; return ( 0 ) ; } dsap = dsap_field & ~ LLC_IG ; ssap = ssap_field & ~ LLC_GSAP ; if ( ndo -> ndo_eflag ) { ND_PRINT (

Fix:
<S2SV_ModStart> p, length <S2SV_ModEnd> ) ; return
Buggy code:
 int sqlite3WindowRewrite ( Parse * pParse, Select * p ) { int rc = SQLITE_OK ; if ( p -> pWin && p -> pPrior == 0 && ( p -> selFlags & SF_WinRewrite ) == 0 ) { Vdbe * v = sqlite3GetVdbe ( pParse ) ; sqlite3 * db = pParse -> db ; Select * pSub = 0 ; SrcList * pSrc = p -> pSrc ; Expr * pWhere = p -> pWhere ; ExprList * pGroupBy = p -> pGroupBy ; Expr * pHaving = p -> pHaving ; ExprList * pSort = 0 ; ExprList * pSublist = 0 ; Window * pMWin = p -> pWin ; Window * pWin ; Table * pTab ; pTab = sqlite3DbMallocZero ( db, sizeof ( Table ) ) ; if ( pTab == 0 ) { <START_BUG> return SQLITE_NOMEM ; <END_BUG> } p -> pSrc = 0 ; p -> pWhere = 0 ; p -> pGroupBy = 0 ; p -> pHaving = 0 ; p -> selFlags &= ~ SF_Aggregate ; p -> selFlags |= SF_WinRewrite ; pSort = sqlite3ExprListDup ( db, pMWin -> pPartition, 0 ) ; pSort = exprListAppendList ( pParse, pSort, pMWin -> pOrderBy, 1 ) ; if ( pSort && p -> pOrderBy && p -> pOrderBy -> nExpr <= pSort -> nExpr ) { int nSave = pSort -> nExpr ; pSort -> nExpr = p -> pOrderBy -> nExpr ; if ( sqlite3ExprListCompare ( pSort, p -> pOrderBy, - 1 ) == 0 ) { sqlite3ExprListDelete ( db, p -> pOrderBy ) ; p -> pOrderBy = 0 ; } pSort -> nExpr = nSave ; } pMWin -> iEphCsr = pParse -> nTab ++ ; pParse -> nTab += 3 ; selectWindowRewriteEList ( pParse, pMWin, pSrc, p -> pEList, pTab, & pSublist ) ; selectWindowRewriteEList ( pParse, pMWin, pSrc, p -> pOrderBy, pTab, & pSublist ) ; pMWin -> nBufferCol = ( pSublist? pSubl

Fix:
<S2SV_ModStart> ) { return sqlite3ErrorToParser ( db, SQLITE_NOMEM ) <S2SV_ModEnd> ; } p <S2SV_ModStart> ) ; } if ( rc && pParse -> nErr == 0 ) { assert ( pParse -> db -> mallocFailed ) ; return sqlite3ErrorToParser ( pParse -> db, SQLITE_NOMEM ) ; }
Buggy code:
 static void set_orig_addr ( struct msghdr * m, struct tipc_msg * msg ) { struct sockaddr_tipc * addr = ( struct sockaddr_tipc * ) m -> msg_name ; if ( addr ) { addr -> family = AF_TIPC ; <START_BUG> addr -> addrtype = TIPC_ADDR_ID ; <END_BUG> addr -> addr. id. ref = msg_origport ( msg ) ; addr -> addr. id. node = msg_orignode ( msg ) ; addr -> addr. name. domain = 0 ; addr -> scope = 0 ; m -> msg_namelen = sizeof ( struct sockaddr_tipc ) ; } }

Fix:
<S2SV_ModStart> addrtype = TIPC_ADDR_ID ; memset ( & addr -> addr, 0, sizeof ( addr -> addr ) )
Buggy code:
 static BOOL update_read_bitmap_data ( rdpUpdate * update, wStream * s, BITMAP_DATA * bitmapData ) { WINPR_UNUSED ( update ) ; if ( Stream_GetRemainingLength ( s ) < 18 ) return FALSE ; Stream_Read_UINT16 ( s, bitmapData -> destLeft ) ; Stream_Read_UINT16 ( s, bitmapData -> destTop ) ; Stream_Read_UINT16 ( s, bitmapData -> destRight ) ; Stream_Read_UINT16 ( s, bitmapData -> destBottom ) ; Stream_Read_UINT16 ( s, bitmapData -> width ) ; Stream_Read_UINT16 ( s, bitmapData -> height ) ; Stream_Read_UINT16 ( s, bitmapData -> bitsPerPixel ) ; Stream_Read_UINT16 ( s, bitmapData -> flags ) ; Stream_Read_UINT16 ( s, bitmapData -> bitmapLength ) ; if ( bitmapData -> flags & BITMAP_COMPRESSION ) { if (! ( bitmapData -> flags & NO_BITMAP_COMPRESSION_HDR ) ) { <START_BUG> Stream_Read_UINT16 ( s, <END_BUG> bitmapData -> cbCompFirstRowSize ) ; Stream_Read_UINT16 ( s, bitmapData -> cbCompMainBodySize ) ; Stream_Read_UINT16 ( s, bitmapData -> cbScanWidth ) ; Stream_Read_UINT16 ( s, bitmapData -> cbUncompressedSize ) ; bitmapData -> bitmapLength = bitmapData -> cbCompMainBodySize ; } bitmapData -> compressed = TRUE ; } else bitmapData -> compressed = FALSE ; if ( Stream_GetRemainingLength ( s ) < bitmapData -> bitmapLength ) return FALSE ; if ( bitmapData -> bitmapLength > 0 ) { bitmapData -> bitmapDataStream = malloc ( bitmapData -> bitmapLength ) ; if (! bitmapData -> bitmapDataStream ) return FALSE ; memcpy ( bitmapData -> bitmapDataStream, Stream_Pointer ( s ), bitmapData -> bitmapLength ) ; Stream_Seek ( s, bitmapData -> bitmapLength ) ; } return TRUE ; }

Fix:
<S2SV_ModStart> ) ) { if ( Stream_GetRemainingLength ( s ) < 8 ) return FALSE ;
Buggy code:
 static int xen_evtchn_cpu_prepare ( unsigned int cpu ) { <START_BUG> int ret = 0 ; <END_BUG> if ( evtchn_ops -> percpu_init ) ret = evtchn_ops -> percpu_init ( cpu ) ; return ret ; }

Fix:
<S2SV_ModStart> ret = 0 ; xen_cpu_init_eoi ( cpu )
Buggy code:
 static void enable_nmi_window ( struct kvm_vcpu * vcpu ) { struct vcpu_svm * svm = to_svm ( vcpu ) ; if ( ( svm -> vcpu. arch. hflags & ( HF_NMI_MASK | HF_IRET_MASK ) ) == HF_NMI_MASK ) return ; svm -> nmi_singlestep = true ; svm -> vmcb -> save. rflags |= ( X86_EFLAGS_TF | X86_EFLAGS_RF ) ; <START_BUG> update_db_bp_intercept ( vcpu ) ; <END_BUG> }

Fix:
<S2SV_ModStart> X86_EFLAGS_RF ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 DECLAREwriteFunc ( writeBufferToContigTiles ) { uint32 imagew = TIFFScanlineSize ( out ) ; uint32 tilew = TIFFTileRowSize ( out ) ; int iskew = imagew - tilew ; tsize_t tilesize = TIFFTileSize ( out ) ; tdata_t obuf ; uint8 * bufp = ( uint8 * ) buf ; uint32 tl, tw ; uint32 row ; ( void ) spp ; obuf = _TIFFmalloc ( TIFFTileSize ( out ) ) ; if ( obuf == NULL ) return 0 ; _TIFFmemset ( obuf, 0, tilesize ) ; ( void ) TIFFGetField ( out, TIFFTAG_TILELENGTH, & tl ) ; ( void ) TIFFGetField ( out, TIFFTAG_TILEWIDTH, & tw ) ; for ( row = 0 ; row < imagelength ; row += tilelength ) { uint32 nrow = ( row + tl > imagelength )? imagelength - row : tl ; uint32 colb = 0 ; uint32 col ; <START_BUG> for ( col = 0 ; col < imagewidth ; col += tw ) { <END_BUG> if ( colb + tilew > imagew ) { uint32 width = imagew - colb ; int oskew = tilew - width ; cpStripToTile ( obuf, bufp + colb, nrow, width, oskew, oskew + iskew ) ; } else cpStripToTile ( obuf, bufp + colb, nrow, tilew, 0, iskew ) ; if ( TIFFWriteTile ( out, obuf, col, row, 0, 0 ) < 0 ) { TIFFError ( TIFFFileName ( out ), "Error,   can\'t   write   tile   at   %lu   %lu", ( unsigned long ) col, ( unsigned long ) row ) ; _TIFFfree ( obuf ) ; return 0 ; } colb += tilew ; } bufp += nrow * imagew ; } _TIFFfree ( obuf ) ; return 1 ; }

Fix:
<S2SV_ModStart> col < imagewidth && colb < imagew
Buggy code:
 static struct nfs4_opendata * nfs4_open_recoverdata_alloc ( struct nfs_open_context * ctx, struct nfs4_state * state ) { struct nfs4_opendata * opendata ; <START_BUG> opendata = nfs4_opendata_alloc ( & ctx -> path, state -> owner, 0, NULL ) ; <END_BUG> if ( opendata == NULL ) return ERR_PTR ( - ENOMEM ) ; opendata -> state = state ; atomic_inc ( & state -> count ) ; return opendata ; }

Fix:
<S2SV_ModStart> state -> owner, 0
Buggy code:
 void Util_handleEscapes ( char * buf ) { int editpos ; int insertpos ; ASSERT ( buf ) ; for ( editpos = insertpos = 0 ; * ( buf + editpos )!= '\\0' ; editpos ++, insertpos ++ ) { if ( * ( buf + editpos ) == '\\\\' ) { switch ( * ( buf + editpos + 1 ) ) { case 'n' : * ( buf + insertpos ) = '\\n' ; editpos ++ ; break ; case 't' : * ( buf + insertpos ) = '\\t' ; editpos ++ ; break ; case 'r' : * ( buf + insertpos ) = '\\r' ; editpos ++ ; break ; case' ': * ( buf + insertpos ) =' '; editpos ++ ; break ; case '0' : if ( * ( buf + editpos + 2 ) == 'x' ) { if ( ( * ( buf + editpos + 3 ) == '0' && * ( buf + editpos + 4 ) == '0' ) ) { * ( buf + insertpos ) = * ( buf + editpos ) ; } else { <START_BUG> * ( buf + insertpos ) = x2c ( & buf [ editpos + 3 ] ) ; <END_BUG> editpos += 4 ; } } break ; case '\\\\' : * ( buf + insertpos ) = '\\\\' ; editpos ++ ; break ; default : * ( buf + insertpos ) = * ( buf + editpos ) ; } } else { * ( buf + insertpos ) = * ( buf + editpos ) ; } } * ( buf + insertpos ) = '\\0' ; }

Fix:
<S2SV_ModStart> insertpos ) = _x2c <S2SV_ModEnd> ( & buf
Buggy code:
 jas_image_t * jpg_decode ( jas_stream_t * in, char * optstr ) { struct jpeg_decompress_struct cinfo ; struct jpeg_error_mgr jerr ; FILE * input_file ; jpg_dest_t dest_mgr_buf ; jpg_dest_t * dest_mgr = & dest_mgr_buf ; JDIMENSION num_scanlines ; jas_image_t * image ; int ret ; jpg_dec_importopts_t opts ; <START_BUG> size_t size ; <END_BUG> if ( jpg_dec_parseopts ( optstr, & opts ) ) { goto error ; } memset ( & cinfo, 0, sizeof ( struct jpeg_decompress_struct ) ) ; memset ( dest_mgr, 0, sizeof ( jpg_dest_t ) ) ; dest_mgr -> data = 0 ; image = 0 ; input_file = 0 ; if (! ( input_file = tmpfile ( ) ) ) { jas_eprintf ( "cannot   make   temporary   file\\n" ) ; goto error ; } if ( jpg_copystreamtofile ( input_file, in ) ) { jas_eprintf ( "cannot   copy   stream\\n" ) ; goto error ; } rewind ( input_file ) ; JAS_DBGLOG ( 10, ( "jpeg_std_error(%p)\\n", & jerr ) ) ; cinfo. err = jpeg_std_error ( & jerr ) ; JAS_DBGLOG ( 10, ( "jpeg_create_decompress(%p)\\n", & cinfo ) ) ; jpeg_create_decompress ( & cinfo ) ; JAS_DBGLOG ( 10, ( "jpeg_stdio_src(%p,   %p)\\n", & cinfo, input_file ) ) ; jpeg_stdio_src ( & cinfo, input_file ) ; JAS_DBGLOG ( 10, ( "jpeg_read_header(%p,   TRUE)\\n", & cinfo ) ) ; ret = jpeg_read_header ( & cinfo, TRUE ) ; JAS_DBGLOG ( 10, ( "jpeg_read_header   return   value   %d\\n", ret ) ) ;

Fix:
<S2SV_ModStart> opts ; size_t num_samples ; JAS_DBGLOG ( 100, ( "jpg_decode(%p, <S2SV_blank> \\"%s\\")\\n", in, optstr ) ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) ; <S2SV_ModEnd> if ( opts <S2SV_ModStart> ( opts. max_samples > 0 <S2SV_ModEnd> ) { if <S2SV_ModStart> if (! jas_safe_size_mul3 ( cinfo. image_width, cinfo. image_height, cinfo. num_components, & num_samples <S2SV_ModEnd> ) ) { <S2SV_ModStart> } if ( num_samples <S2SV_ModEnd> > opts. <S2SV_ModStart> > opts. max_samples <S2SV_ModEnd> ) { jas_eprintf <S2SV_ModStart> { jas_eprintf ( "image <S2SV_blank> is <S2SV_blank> too <S2SV_blank> large <S2SV_blank> (%zu <S2SV_blank> > <S2SV_blank> %zu)\\n", num_samples, opts. max_samples <S2SV_ModEnd> ) ; goto <S2SV_ModStart> ; } } JAS_DBGLOG ( 10, ( "jpeg_start_decompress(%p)\\n", & cinfo ) ) ; ret = jpeg_start_decompress ( & cinfo ) ; JAS_DBGLOG ( 10, ( "jpeg_start_decompress <S2SV_blank> return <S2SV_blank> value <S2SV_blank> %d\\
Buggy code:
 <START_BUG> static void get_frame_stats ( vpx_codec_ctx_t * ctx, <END_BUG> const vpx_image_t * img, vpx_codec_pts_t pts, unsigned int duration, vpx_enc_frame_flags_t flags, unsigned int deadline,  vpx_fixed_buf_t * stats ) { <START_BUG> vpx_codec_iter_t iter = NULL ; const vpx_codec_cx_pkt_t * pkt = NULL ; const vpx_codec_err_t res = vpx_codec_encode ( ctx, img, pts, duration, flags, deadline ) ; if ( res!= VPX_CODEC_OK ) die_codec ( ctx, "Failed   to   get   frame   stats." ) ; while ( ( pkt = vpx_codec_get_cx_data ( ctx, & iter ) )!= NULL ) { <END_BUG> if ( pkt -> kind == VPX_CODEC_STATS_PKT ) {  const uint8_t * const pkt_buf = pkt -> data. twopass_stats. buf ; const size_t pkt_size = pkt -> data. twopass_stats. sz ; stats -> buf = realloc ( stats -> buf, stats -> sz + pkt_size ) ; memcpy ( ( uint8_t * ) stats -> buf + stats -> sz, pkt_buf, pkt_size ) ; stats -> sz += pkt_size ; } } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> get_frame_stats ( vpx_codec_ctx_t <S2SV_ModStart> stats ) { int got_pkts = 0 ; <S2SV_ModStart> NULL ) { got_pkts = 1 ; <S2SV_ModStart> ; } } return got_pkts ;
Buggy code:
 PUBLIC void mprDefaultLogHandler ( cchar * tags, int level, cchar * msg ) { MprFile * file ; char tbuf [ 128 ] ; static int check = 0 ; if ( ( file = MPR -> logFile ) == 0 ) { return ; } if ( MPR -> logBackup && MPR -> logSize && ( check ++ % 1000 ) == 0 ) { backupLog ( ) ; } if ( tags && * tags ) { if ( MPR -> flags & MPR_LOG_DETAILED ) { fmt ( tbuf, sizeof ( tbuf ), "%s   %d   %s,   ", mprGetDate ( MPR_LOG_DATE ), level, tags ) ; mprWriteFileString ( file, tbuf ) ; } else if ( MPR -> flags & MPR_LOG_TAGGED ) { if ( schr ( tags,' ') ) { <START_BUG> tags = stok ( sclone ( tags ), "   ", NULL ) ; <END_BUG> } if (! isupper ( ( uchar ) * tags ) ) { tags = stitle ( tags ) ; } mprWriteFileFmt ( file, "%12s   ", sfmt ( "[%s]", tags ) ) ; } } mprWriteFileString ( file, msg ) ; mprWriteFileString ( file, "\\n" ) ; # if ME_MPR_OSLOG if ( level == 0 ) { mprWriteToOsLog ( sfmt ( "%s:   %d   %s:   %s", MPR -> name, level, tags, msg ), level ) ; } # endif }

Fix:
<S2SV_ModStart> { tags = ssplit <S2SV_ModEnd> ( sclone (
Buggy code:
 <START_BUG> void jas_matrix_bindsub ( jas_matrix_t * mat0, jas_matrix_t * mat1, int r0, <END_BUG> int c0, int r1, int c1 ) {  int i ; <START_BUG> if ( mat0 -> data_ ) { if (! ( mat0 -> flags_ & JAS_MATRIX_REF ) ) { jas_free ( mat0 -> data_ ) ; } mat0 -> data_ = 0 ; mat0 -> datasize_ = 0 ; } if ( mat0 -> rows_ ) { jas_free ( mat0 -> rows_ ) ; mat0 -> rows_ = 0 ; } mat0 -> flags_ |= JAS_MATRIX_REF ; mat0 -> numrows_ = r1 - r0 + 1 ; mat0 -> numcols_ = c1 - c0 + 1 ; mat0 -> maxrows_ = mat0 -> numrows_ ; if (! ( mat0 -> rows_ = jas_alloc2 ( mat0 -> maxrows_, sizeof ( jas_seqent_t * ) ) ) ) { abort ( ) ; } for ( i = 0 ; i < mat0 -> numrows_ ; ++ i ) { mat0 -> rows_ [ i ] = mat1 -> rows_ [ r0 + i ] + c0 ; } mat0 -> xstart_ = mat1 -> xstart_ + c0 ; mat0 -> ystart_ = mat1 -> ystart_ + r0 ; mat0 -> xend_ = mat0 -> xstart_ + mat0 -> numcols_ ; mat0 -> yend_ = mat0 -> ystart_ + mat0 -> numrows_ ; }<END_BUG>

Fix:
<S2SV_ModStart> * mat1, jas_matind_t r0, jas_matind_t c0, jas_matind_t r1, jas_matind_t <S2SV_ModEnd> c1 ) { <S2SV_ModStart> c1 ) { jas_matind_t <S2SV_ModEnd> i ; if
Buggy code:
 JsVar * jswrap_graphics_createArrayBuffer ( int width, int height, int bpp, JsVar * options ) { if ( width <= 0 || height <= 0 || width > 32767 || height > 32767 ) { jsExceptionHere ( JSET_ERROR, "Invalid   Size" ) ; return 0 ; } if (! isValidBPP ( bpp ) ) { jsExceptionHere ( JSET_ERROR, "Invalid   BPP" ) ; return 0 ; } JsVar * parent = jspNewObject ( 0, "Graphics" ) ; if (! parent ) return 0 ; JsGraphics gfx ; graphicsStructInit ( & gfx ) ; gfx. data. type = JSGRAPHICSTYPE_ARRAYBUFFER ; gfx. data. flags = JSGRAPHICSFLAGS_NONE ; gfx. graphicsVar = parent ; gfx. data. width = ( unsigned short ) width ; gfx. data. height = ( unsigned short ) height ; gfx. data. bpp = ( unsigned char ) bpp ; if ( jsvIsObject ( options ) ) { if ( jsvGetBoolAndUnLock ( jsvObjectGetChild ( options, "zigzag", 0 ) ) ) gfx. data. flags = ( JsGraphicsFlags ) ( gfx. data. flags | JSGRAPHICSFLAGS_ARRAYBUFFER_ZIGZAG ) ; if ( jsvGetBoolAndUnLock ( jsvObjectGetChild ( options, "msb", 0 ) ) ) gfx. data. flags = ( JsGraphicsFlags ) ( gfx. data. flags | JSGRAPHICSFLAGS_ARRAYBUFFER_MSB ) ; if ( jsvGetBoolAndUnLock ( jsvObjectGetChild ( options, "vertical_byte", 0 ) ) ) { if ( gfx. data. bpp == 1 ) gfx. data. flags = ( JsGraphicsFlags ) ( gfx. data. flags | JSGRAPHICSFLAGS_ARRAYBUFFER_VERTICAL_BYTE ) ; else <START_BUG> jsWarn ( "vertical_byte   only   works   for   1bpp   ArrayBuffers\\n" ) ; <END_BUG> } JsVar * colorv = jsvObjectGetChild ( options, "color_order", 0 ) ; if ( colorv ) { if ( jsvIsStringEqual ( colorv, "rgb" ) ) ; else if (! jsvIsStringEqual ( colorv, "brg" ) )

Fix:
<S2SV_ModStart> ) ; else { jsExceptionHere ( JSET_ERROR, <S2SV_ModEnd> "vertical_byte <S2SV_blank> only <S2SV_blank> works <S2SV_blank> for <S2SV_blank> 1bpp <S2SV_blank> ArrayBuffers\\n" ) ; <S2SV_ModStart> "vertical_byte <S2SV_blank> only <S2SV_blank> works <S2SV_blank> for <S2SV_blank> 1bpp <S2SV_blank> ArrayBuffers\\n" ) ; return 0 ; } if ( gfx. data. height & 7 ) { jsExceptionHere ( JSET_ERROR, "height <S2SV_blank> must <S2SV_blank> be <S2SV_blank> a <S2SV_blank> multiple <S2SV_blank> of <S2SV_blank> 8 <S2SV_blank> when <S2SV_blank> using <S2SV_blank> vertical_byte\\n" ) ; return 0 ; }
Buggy code:
 int obj2ast_excepthandler ( PyObject * obj, excepthandler_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; int lineno ; int col_offset ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_lineno ) ) { <END_BUG> int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_lineno ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ;  } else { <START_BUG> PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   excepthandler" ) ; return 1 ; } if ( _PyObject_HasAttrId ( obj, & PyId_col_offset ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_col_offset ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_int ( tmp, & col_offset, arena ) ; if ( res!= 0 ) goto failed ; <END_BUG> Py_CLEAR ( tmp ) ;  } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"col_offset\\"   missing   from   excepthandler" ) ; return 1 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) ExceptHandler_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { expr_ty type ; identifier name ; asdl_seq * body ; <START_BUG> if ( exists_not_none ( obj, & PyId_type ) ) { <END_BUG> int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_type ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_expr ( tmp, & type, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ;  } else { <START_BUG> type = NULL ; } if ( exists_not_none ( obj, & PyId_name ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_<END_BUG>

Fix:
<S2SV_ModStart> } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"lineno\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> excepthandler" ) ; return 1 ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> ) ; } if ( lookup_attr_id ( obj, & PyId_col_offset, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"col_offset\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> excepthandler" ) ; return 1 ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> ( tmp ) <S2SV_ModEnd> ; } isinstance <S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_type, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; type = NULL ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> ) ; } if ( lookup_attr_id ( obj, & PyId
Buggy code:
 int yr_object_array_set_item ( YR_OBJECT * object, YR_OBJECT * item, int index ) { YR_OBJECT_ARRAY * array ; int i ; int count ; assert ( index >= 0 ) ; assert ( object -> type == OBJECT_TYPE_ARRAY ) ; array = object_as_array ( object ) ; if ( array -> items == NULL ) { <START_BUG> count = yr_max ( 64, ( index + 1 ) * 2 ) ; <END_BUG> array -> items = ( YR_ARRAY_ITEMS * ) yr_malloc ( sizeof ( YR_ARRAY_ITEMS ) + count * sizeof ( YR_OBJECT * ) ) ; if ( array -> items == NULL ) return ERROR_INSUFFICIENT_MEMORY ; memset ( array -> items -> objects, 0, count * sizeof ( YR_OBJECT * ) ) ; array -> items -> count = count ; } else if ( index >= array -> items -> count ) { count = array -> items -> count * 2 ;  array -> items = ( YR_ARRAY_ITEMS * ) yr_realloc ( <START_BUG> array -> items, sizeof ( YR_ARRAY_ITEMS ) + count * sizeof ( YR_OBJECT * ) ) ; if ( array -> items == NULL ) return ERROR_INSUFFICIENT_MEMORY ; for ( i = array -> items -> count ; i < count ; i ++ ) array -> items -> objects [ i ] = NULL ; array -> items -> count = count ; } item -> parent = object ; array -> items -> objects [ index ] = item ; return ERROR_SUCCESS ; }<END_BUG>

Fix:
<S2SV_ModStart> { count = 64 ; while ( count <= index ) count *= 2 <S2SV_ModEnd> ; array -> <S2SV_ModStart> * 2 ; while ( count <= index ) count *= 2 ;
Buggy code:
 int cipso_v4_sock_getattr ( struct sock * sk, struct netlbl_lsm_secattr * secattr ) { <START_BUG> struct ip_options * opt ; <END_BUG>  opt = inet_sk ( sk ) -> opt ; <START_BUG> <END_BUG> if ( opt == NULL || opt -> cipso == 0 )  return - ENOMSG ; <START_BUG> return cipso_v4_getattr ( opt -> __data + opt -> cipso - sizeof ( struct iphdr ), <END_BUG> secattr ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ) { struct ip_options_rcu <S2SV_ModEnd> * opt ; <S2SV_ModStart> * opt ; int res = - ENOMSG ; rcu_read_lock ( ) ; opt = rcu_dereference ( <S2SV_ModEnd> inet_sk ( sk <S2SV_ModStart> sk ) -> inet_opt ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> if ( opt && opt -> opt. cipso ) res = <S2SV_ModEnd> cipso_v4_getattr ( opt <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> + opt -> opt. <S2SV_ModStart> secattr ) ; rcu_read_unlock ( ) ; return res ;
Buggy code:
 int main ( int argc, char * * argv ) { int fd = xopen ( "//dev//null", O_RDWR ) ; while ( fd < 2 ) fd = xdup ( fd ) ; if ( fd > 2 ) close ( fd ) ; if ( argc < 8 ) { error_msg_and_die ( "Usage:   %s   SIGNO   CORE_SIZE_LIMIT   PID   UID   GID   TIME   BINARY_NAME   [HOSTNAME]", argv [ 0 ] ) ; } if ( strchr ( argv [ 1 ],' ') ) { int i ; for ( i = 1 ; argv [ i ] ; i ++ ) { strchrnul ( argv [ i ],' ') [ 0 ] = '\\0' ; } } logmode = LOGMODE_JOURNAL ; load_abrt_conf ( ) ; bool setting_MakeCompatCore ; bool setting_SaveBinaryImage ; { map_string_t * settings = new_map_string ( ) ; load_abrt_plugin_conf_file ( "CCpp.conf", settings ) ; const char * value ; value = get_map_string_item_or_NULL ( settings, "MakeCompatCore" ) ; setting_MakeCompatCore = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "SaveBinaryImage" ) ; setting_SaveBinaryImage = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "VerboseLog" ) ; if ( value ) g_verbose = xatoi_positive ( value ) ; free_map_string ( settings ) ; } errno = 0 ; const char * signal_str = argv [ 1 ] ; int signal_no = xatoi_positive ( signal_str ) ; off_t ulimit_c = strtoull ( argv [ 2 ], NULL, 10 ) ; if ( ulimit_c < 0 ) { ulimit_c = ~ ( ( off_t ) 1 << ( sizeof ( off_t ) * 8 - 1 ) ) ; } const char * pid_str = argv [ 3 ] ; pid_t pid = xatoi_positive ( argv [ 3 ] ) ; uid_t uid = xatoi

Fix:
<S2SV_ModStart> ; } } const uid_t dduid = g_settings_privatereports? 0 : fsuid ; <S2SV_ModStart> ( path, dduid <S2SV_ModEnd>, DEFAULT_DUMP_DIR_MODE,
Buggy code:
 void common_timer_get ( struct k_itimer * timr, struct itimerspec64 * cur_setting ) { const struct k_clock * kc = timr -> kclock ; ktime_t now, remaining, iv ; struct timespec64 ts64 ; bool sig_none ; <START_BUG> sig_none = ( timr -> it_sigev_notify & ~ SIGEV_THREAD_ID ) == SIGEV_NONE ; <END_BUG> iv = timr -> it_interval ; if ( iv ) { cur_setting -> it_interval = ktime_to_timespec64 ( iv ) ; } else if (! timr -> it_active ) { if (! sig_none ) return ; } kc -> clock_get ( timr -> it_clock, & ts64 ) ; now = timespec64_to_ktime ( ts64 ) ; if ( iv && ( timr -> it_requeue_pending & REQUEUE_PENDING || sig_none ) ) timr -> it_overrun += kc -> timer_forward ( timr, now ) ; remaining = kc -> timer_remaining ( timr, now ) ; if ( remaining <= 0 ) { if (! sig_none ) cur_setting -> it_value. tv_nsec = 1 ; } else { cur_setting -> it_value = ktime_to_timespec64 ( remaining ) ; } }

Fix:
<S2SV_ModStart> ; sig_none = <S2SV_ModEnd> timr -> it_sigev_notify <S2SV_ModStart> timr -> it_sigev_notify <S2SV_ModEnd> == SIGEV_NONE ;
Buggy code:
 static void sctp_v6_get_dst ( struct sctp_transport * t, union sctp_addr * saddr, struct flowi * fl, struct sock * sk ) { struct sctp_association * asoc = t -> asoc ; struct dst_entry * dst = NULL ; struct flowi6 * fl6 = & fl -> u. ip6 ; struct sctp_bind_addr * bp ; <START_BUG> struct sctp_sockaddr_entry * laddr ; <END_BUG> union sctp_addr * baddr = NULL ; union sctp_addr * daddr = & t -> ipaddr ; union sctp_addr dst_saddr ;  __u8 matchlen = 0 ; <START_BUG> __u8 bmatchlen ; sctp_scope_t scope ; memset ( fl6, 0, sizeof ( struct flowi6 ) ) ; fl6 -> daddr = daddr -> v6. sin6_addr ; fl6 -> fl6_dport = daddr -> v6. sin6_port ; fl6 -> flowi6_proto = IPPROTO_SCTP ; if ( ipv6_addr_type ( & daddr -> v6. sin6_addr ) & IPV6_ADDR_LINKLOCAL ) fl6 -> flowi6_oif = daddr -> v6. sin6_scope_id ; pr_debug ( "%s:   dst=%pI6   ", __func__, & fl6 -> daddr ) ; if ( asoc ) fl6 -> fl6_sport = htons ( asoc -> base. bind_addr. port ) ; if ( saddr ) { fl6 -> saddr = saddr -> v6. sin6_addr ; fl6 -> fl6_sport = saddr -> v6. sin6_port ; pr_debug ( "src=%pI6   -   ", & fl6 -> saddr ) ; } <END_BUG> dst = ip6_dst_lookup_flow ( sk, fl6, NULL, false ) ;  if (! asoc || saddr ) goto out ; bp = & asoc -> base. bind_addr ; scope = sctp_scope ( daddr ) ; if (! IS_ERR ( dst ) ) { sctp_v6_to_addr ( & dst_saddr, & fl6 -> saddr,

Fix:
<S2SV_ModStart> bp ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct <S2SV_ModStart> sctp_addr dst_saddr ; struct in6_addr * final_p, final ; <S2SV_ModStart> ) ; } final_p = fl6_update_dst ( fl6, np -> opt, & final ) ; <S2SV_ModStart>, fl6, final_p <S2SV_ModEnd>, false ) <S2SV_ModStart>. sin6_port ; final_p = fl6_update_dst ( fl6, np -> opt, & final ) ; <S2SV_ModStart>, fl6, final_p <S2SV_ModEnd>, false )
Buggy code:
 static void recovery_abort ( void ) { if (! dry_run ) { storage_reset ( ) ; <START_BUG> } <END_BUG> awaiting_character = false ; memzero ( mnemonic, sizeof ( mnemonic ) ) ; memzero ( cipher, sizeof ( cipher ) ) ; }

Fix:
<S2SV_ModStart> ) ; } recovery_started = false ;
Buggy code:
 static enum led_brightness k90_backlight_get ( struct led_classdev * led_cdev ) { int ret ; struct k90_led * led = container_of ( led_cdev, struct k90_led, cdev ) ; struct device * dev = led -> cdev. dev -> parent ; struct usb_interface * usbif = to_usb_interface ( dev -> parent ) ; struct usb_device * usbdev = interface_to_usbdev ( usbif ) ; int brightness ; <START_BUG> char data [ 8 ] ; <END_BUG> ret = usb_control_msg ( usbdev, usb_rcvctrlpipe ( usbdev, 0 ), K90_REQUEST_STATUS, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, 0, data, 8, USB_CTRL_SET_TIMEOUT ) ; if ( ret < 0 ) { dev_warn ( dev, "Failed   to   get   K90   initial   state   (error   %d).\\n", ret ) ;  return - EIO ; <START_BUG> } brightness = data [ 4 ] ; if ( brightness < 0 || brightness > 3 ) { dev_warn ( dev, "Read   invalid   backlight   brightness:   %02hhx.\\n", data [ 4 ] ) ; <END_BUG> return - EIO ;  <START_BUG> } <END_BUG> return brightness ; }

Fix:
<S2SV_ModStart> brightness ; char * data ; data = kmalloc ( 8, GFP_KERNEL ) ; if (! data ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart> ret ) ; ret = - EIO ; goto out <S2SV_ModEnd> ; } brightness <S2SV_ModStart> ] ) ; ret = <S2SV_ModEnd> - EIO ; <S2SV_ModStart> - EIO ; goto out ; } ret = brightness ; out : kfree ( data ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int do_command ( unsigned char c ) { static int dtr_up = 0 ; int newbaud, newflow, newparity, newbits ; const char * xfr_cmd ; char * fname ; int r ; switch ( c ) { case KEY_EXIT : return 1 ; case KEY_QUIT : term_set_hupcl ( tty_fd, 0 ) ; term_flush ( tty_fd ) ; term_apply ( tty_fd ) ; term_erase ( tty_fd ) ; return 1 ; case KEY_STATUS : show_status ( dtr_up ) ; break ; case KEY_PULSE : fd_printf ( STO, "\\r\\n***   pulse   DTR   ***\\r\\n" ) ; if ( term_pulse_dtr ( tty_fd ) < 0 ) fd_printf ( STO, "***   FAILED\\r\\n" ) ; break ; case KEY_TOGGLE : if ( dtr_up ) r = term_lower_dtr ( tty_fd ) ; else r = term_raise_dtr ( tty_fd ) ; if ( r >= 0 ) dtr_up =! dtr_up ; fd_printf ( STO, "\\r\\n***   DTR:   %s   ***\\r\\n", dtr_up? "up" : "down" ) ; break ; case KEY_BAUD_UP : case KEY_BAUD_DN : if ( c == KEY_BAUD_UP ) opts. baud = baud_up ( opts. baud ) ; else opts. baud = baud_down ( opts. baud ) ; term_set_baudrate ( tty_fd, opts. baud ) ; tty_q. len = 0 ; term_flush ( tty_fd ) ; term_apply ( tty_fd ) ; newbaud = term_get_baudrate ( tty_fd, NULL ) ; if ( opts. baud!= newbaud ) { fd_printf ( STO, "\\r\\n***   baud:   %d   (%d)   ***\\r\\n", opts. baud, newbaud ) ; } else { fd_printf ( STO, "\\r\\n***   baud:   %d   ***\\

Fix:
<S2SV_ModStart> xfr_cmd, fname <S2SV_ModEnd> ) ; free
Buggy code:
 gboolean mainloop_destroy_trigger ( crm_trigger_t * source ) { source -> trigger = FALSE ; if ( source -> id > 0 ) { g_source_remove ( source -> id ) ; <START_BUG> } <END_BUG> return TRUE ; }

Fix:
<S2SV_ModStart> id ) ; source -> id = 0 ;