nus-yam/ex-repair huggingface dataset:
Buggy code:
 jas_matrix_t * jas_seq2d_input ( FILE * in ) { jas_matrix_t * matrix ; <START_BUG> int i ; <END_BUG> int j ; long x ;  int numrows ; <START_BUG> int numcols ; int xoff ; int yoff ; <END_BUG> if ( fscanf ( in, "%d   %d", & xoff, & yoff )!= 2 )  <START_BUG> return 0 ; <END_BUG>  if ( fscanf ( in, "%d   %d", & numcols, & numrows )!= 2 ) <START_BUG> <END_BUG> return 0 ;  if (! ( matrix = jas_seq2d_create ( xoff, yoff, xoff + numcols, yoff + numrows ) ) ) <START_BUG> return 0 ; <END_BUG> if ( jas_matrix_numrows ( matrix )!= numrows || jas_matrix_numcols ( matrix )!= numcols ) { abort ( ) ; } for ( i = 0 ; i < jas_matrix_numrows ( matrix ) ; i ++ ) { for ( j = 0 ; j < jas_matrix_numcols ( matrix ) ; j ++ ) { if ( fscanf ( in, "%ld", & x )!= 1 ) { jas_matrix_destroy ( matrix ) ; return 0 ; } jas_matrix_set ( matrix, i, j, JAS_CAST ( jas_seqent_t, x ) ) ; } } return matrix ; }

Fix:
<S2SV_ModStart> * matrix ; jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; long <S2SV_ModStart> long x ; jas_matind_t numrows ; jas_matind_t numcols ; jas_matind_t xoff ; jas_matind_t yoff ; long tmp_xoff ; long tmp_yoff ; long tmp_numrows ; long tmp_numcols <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( in, "%ld <S2SV_blank> %ld", & tmp_xoff, & tmp_yoff <S2SV_ModEnd> )!= 2 <S2SV_ModStart>!= 2 ) { return 0 ; } xoff = tmp_xoff ; yoff = tmp_yoff <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( in, "%ld <S2SV_blank> %ld", & tmp_numcols, & tmp_numrows <S2SV_ModEnd> )!= 2 <S2SV_ModStart>!= 2 ) { return 0 ; } numrows = tmp_numrows ; numcols = tmp_numcols <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) ) { return 0 ; } <S2SV_ModEnd> if ( jas_matrix_numrows
Buggy code:
 int jas_matrix_cmp ( jas_matrix_t * mat0, jas_matrix_t * mat1 ) { <START_BUG> int i ; <END_BUG> int j ; if ( mat0 -> numrows_!= mat1 -> numrows_ || mat0 -> numcols_!= mat1 -> numcols_ ) { return 1 ; } for ( i = 0 ; i < mat0 -> numrows_ ; i ++ ) { for ( j = 0 ; j < mat0 -> numcols_ ; j ++ ) { if ( jas_matrix_get ( mat0, i, j )!= jas_matrix_get ( mat1, i, j ) ) { return 1 ; } } } return 0 ; }

Fix:
<S2SV_ModStart> mat1 ) { jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; if
Buggy code:
 static int PredictorDecodeRow ( TIFF * tif, uint8 * op0, tmsize_t occ0, uint16 s ) { TIFFPredictorState * sp = PredictorState ( tif ) ; assert ( sp!= NULL ) ; assert ( sp -> decoderow!= NULL ) ; assert ( sp -> decodepfunc!= NULL ) ; if ( ( * sp -> decoderow ) ( tif, op0, occ0, s ) ) { <START_BUG> ( * sp -> decodepfunc ) ( tif, op0, occ0 ) ; <END_BUG>  return 1 ; <START_BUG> } else return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ) { return <S2SV_ModStart> occ0 ) ; <S2SV_ModEnd> } else return
Buggy code:
 static void nfs4_close_prepare ( struct rpc_task * task, void * data ) { struct nfs4_closedata * calldata = data ; struct nfs4_state * state = calldata -> state ; int clear_rd, clear_wr, clear_rdwr ; if ( nfs_wait_on_sequence ( calldata -> arg. seqid, task )!= 0 ) return ; clear_rd = clear_wr = clear_rdwr = 0 ; spin_lock ( & state -> owner -> so_lock ) ; if ( state -> n_rdwr == 0 ) { if ( state -> n_rdonly == 0 ) { clear_rd |= test_and_clear_bit ( NFS_O_RDONLY_STATE, & state -> flags ) ; clear_rdwr |= test_and_clear_bit ( NFS_O_RDWR_STATE, & state -> flags ) ; } if ( state -> n_wronly == 0 ) { clear_wr |= test_and_clear_bit ( NFS_O_WRONLY_STATE, & state -> flags ) ; clear_rdwr |= test_and_clear_bit ( NFS_O_RDWR_STATE, & state -> flags ) ; } } spin_unlock ( & state -> owner -> so_lock ) ; if (! clear_rd &&! clear_wr &&! clear_rdwr ) { task -> tk_action = NULL ; return ; } nfs_fattr_init ( calldata -> res. fattr ) ; if ( test_bit ( NFS_O_RDONLY_STATE, & state -> flags )!= 0 ) { task -> tk_msg. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_OPEN_DOWNGRADE ] ; <START_BUG> calldata -> arg. open_flags = FMODE_READ ; <END_BUG> } else if ( test_bit ( NFS_O_WRONLY_STATE, & state -> flags )!= 0 ) { task -> tk_msg. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_OPEN_DOWNGRADE ] ;  calldata -> arg. open_flags = FMODE_WRITE ; <START_BUG> } calldata -> timestamp = jiffies ; rpc_<END_BUG>

Fix:
<S2SV_ModStart> -> arg. fmode <S2SV_ModEnd> = FMODE_READ ; <S2SV_ModStart> -> arg. fmode <S2SV_ModEnd> = FMODE_WRITE ;
Buggy code:
 static void icmp6_nodeinfo_print ( netdissect_options * ndo, u_int icmp6len, const u_char * bp, const u_char * ep ) { const struct icmp6_nodeinfo * ni6 ; const struct icmp6_hdr * dp ; const u_char * cp ; size_t siz, i ; int needcomma ; if ( ep < bp ) return ; dp = ( const struct icmp6_hdr * ) bp ; ni6 = ( const struct icmp6_nodeinfo * ) bp ; siz = ep - bp ; switch ( ni6 -> ni_type ) { case ICMP6_NI_QUERY : if ( siz == sizeof ( * dp ) + 4 ) { ND_PRINT ( ( ndo, "   who-are-you   request" ) ) ; break ; } ND_PRINT ( ( ndo, "   node   information   query" ) ) ; ND_TCHECK2 ( * dp, sizeof ( * ni6 ) ) ; ni6 = ( const struct icmp6_nodeinfo * ) dp ; ND_PRINT ( ( ndo, "   (" ) ) ; switch ( EXTRACT_16BITS ( & ni6 -> ni_qtype ) ) { case NI_QTYPE_NOOP : ND_PRINT ( ( ndo, "noop" ) ) ; break ; case NI_QTYPE_SUPTYPES : ND_PRINT ( ( ndo, "supported   qtypes" ) ) ; i = EXTRACT_16BITS ( & ni6 -> ni_flags ) ; if ( i ) ND_PRINT ( ( ndo, "   [%s]", ( i & 0x01 )? "C" : "" ) ) ; break ; case NI_QTYPE_FQDN : ND_PRINT ( ( ndo, "DNS   name" ) ) ; break ; case NI_QTYPE_NODEADDR : ND_PRINT ( ( ndo, "node   addresses" ) ) ; i = ni6 -> ni_flags ; if (! i ) break ; ND_PRINT ( ( ndo, "   [%s%s%s%s%s%s]", ( i & NI_NODEADDR_FLAG_ANYCAST )? "a" : ""

Fix:
<S2SV_ModStart> = 0 ; ND_TCHECK2 ( * dp, sizeof ( * ni6 ) ) ; <S2SV_ModStart> ) + 4 ; ND_TCHECK ( cp [ 0 ] )
Buggy code:
 <START_BUG> void vp9_fht4x4_c ( const int16_t * input, int16_t * output, <END_BUG> int stride, int tx_type ) { if ( tx_type == DCT_DCT ) {  vp9_fdct4x4_c ( input, output, stride ) ; <START_BUG> } else { <END_BUG> int16_t out [ 4 * 4 ] ;  <START_BUG> int16_t * outptr = & out [ 0 ] ; <END_BUG> int i, j ;  int16_t temp_in [ 4 ], temp_out [ 4 ] ; <START_BUG> const transform_2d ht = FHT_4 [ tx_type ] ; for ( i = 0 ; i < 4 ; ++ i ) { for ( j = 0 ; j < 4 ; ++ j ) temp_in [ j ] = input [ j * stride + i ] * 16 ; if ( i == 0 && temp_in [ 0 ] ) temp_in [ 0 ] += 1 ; ht. cols ( temp_in, temp_out ) ; for ( j = 0 ; j < 4 ; ++ j ) <END_BUG> outptr [ j * 4 + i ] = temp_out [ j ] ;  } for ( i = 0 ; i < 4 ; ++ i ) { for ( j = 0 ; j < 4 ; ++ j ) temp_in [ j ] = out [ j + i * 4 ] ; ht. rows ( temp_in, temp_out ) ; for ( j = 0 ; j < 4 ; ++ j ) output [ j + i * 4 ] = ( temp_out [ j ] + 1 ) >> 2 ; } } }

Fix:
<S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> DCT_DCT ) { vpx_fdct4x4_c <S2SV_ModEnd> ( input, <S2SV_ModStart> } else { tran_low_t <S2SV_ModEnd> out [ 4 <S2SV_ModStart> 4 ] ; <S2SV_ModEnd> int i, <S2SV_ModStart>, j ; tran_low_t <S2SV_ModEnd> temp_in [ 4 <S2SV_ModStart> ++ j ) out <S2SV_ModEnd> [ j *
Buggy code:
 <START_BUG> static void rate_block ( int plane, int block, BLOCK_SIZE plane_bsize, <END_BUG> TX_SIZE tx_size, struct rdcost_block_args * args ) { int x_idx, y_idx ; txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & x_idx, & y_idx ) ;  args -> rate = cost_coeffs ( args -> x, plane, block, args -> t_above + x_idx, <START_BUG> args -> t_left + y_idx, tx_size, args -> so -> scan, args -> so -> neighbors, args -> use_fast_coef_costing ) ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> rate_block ( int <S2SV_ModStart> y_idx ) ; return <S2SV_ModEnd> cost_coeffs ( args
Buggy code:
 static int skcipher_setkey ( void * private, const u8 * key, unsigned int keylen ) { <START_BUG> return crypto_skcipher_setkey ( private, key, keylen ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> keylen ) { struct skcipher_tfm * tfm = private ; int err ; err = crypto_skcipher_setkey ( tfm -> skcipher <S2SV_ModEnd>, key, <S2SV_ModStart> keylen ) ; tfm -> has_key =! err ; return err ;
Buggy code:
 int i915_gem_execbuffer2 ( struct drm_device * dev, void * data, struct drm_file * file ) { struct drm_i915_gem_execbuffer2 * args = data ; struct drm_i915_gem_exec_object2 * exec2_list = NULL ; int ret ; <START_BUG> if ( args -> buffer_count < 1 ) { <END_BUG> DRM_DEBUG ( "execbuf2   with   %d   buffers\\n", args -> buffer_count ) ; return - EINVAL ; } exec2_list = kmalloc ( sizeof ( * exec2_list ) * args -> buffer_count, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY ) ; if ( exec2_list == NULL ) exec2_list = drm_malloc_ab ( sizeof ( * exec2_list ), args -> buffer_count ) ; if ( exec2_list == NULL ) { DRM_DEBUG ( "Failed   to   allocate   exec   list   for   %d   buffers\\n", args -> buffer_count ) ; return - ENOMEM ; } ret = copy_from_user ( exec2_list, ( struct drm_i915_relocation_entry __user * ) ( uintptr_t ) args -> buffers_ptr, sizeof ( * exec2_list ) * args -> buffer_count ) ; if ( ret!= 0 ) { DRM_DEBUG ( "copy   %d   exec   entries   failed   %d\\n", args -> buffer_count, ret ) ; drm_free_large ( exec2_list ) ; return - EFAULT ; } ret = i915_gem_do_execbuffer ( dev, data, file, args, exec2_list ) ; if (! ret ) { ret = copy_to_user ( ( struct drm_i915_relocation_entry __user * ) ( uintptr_t ) args -> buffers_ptr, exec2_list, sizeof ( * exec2_list ) * args -> buffer_count ) ; if ( ret ) { ret = - EFAULT ; DRM_DEBUG ( "failed   to   copy   %d   exec   entries   " "back   to   user   (%d)\\n", args ->

Fix:
<S2SV_ModStart> buffer_count < 1 || args -> buffer_count > UINT_MAX // sizeof ( * exec2_list )
Buggy code:
 struct request * blk_mq_tag_to_rq ( struct blk_mq_tags * tags, unsigned int tag ) { <START_BUG> struct request * rq = tags -> rqs [ tag ] ; <END_BUG>  struct blk_flush_queue * fq = blk_get_flush_queue ( rq -> q, rq -> mq_ctx ) ; <START_BUG> if (! is_flush_request ( rq, fq, tag ) ) return rq ; return fq -> flush_rq ; }<END_BUG>

Fix:
<S2SV_ModStart> tag ) { return <S2SV_ModEnd> tags -> rqs <S2SV_ModStart> tag ] ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 size_t OpenMP4Source ( char * filename, uint32_t traktype, uint32_t traksubtype ) { mp4object * mp4 = ( mp4object * ) malloc ( sizeof ( mp4object ) ) ; if ( mp4 == NULL ) return 0 ; <START_BUG> memset ( mp4, 0, sizeof ( mp4object ) ) ; <END_BUG> # ifdef _WINDOWS fopen_s ( & mp4 -> mediafp, filename, "rb" ) ; # else mp4 -> mediafp = fopen ( filename, "rb" ) ; # endif if ( mp4 -> mediafp ) { uint32_t qttag, qtsize32, skip, type = 0, subtype = 0, num ; size_t len ; int32_t nest = 0 ; uint64_t nestsize [ MAX_NEST_LEVEL ] = { 0 } ; uint64_t lastsize = 0, qtsize ; do { len = fread ( & qtsize32, 1, 4, mp4 -> mediafp ) ; len += fread ( & qttag, 1, 4, mp4 -> mediafp ) ;  if ( len == 8 ) <START_BUG> { if (! VALID_FOURCC ( qttag ) ) { <END_BUG> LONGSEEK ( mp4 -> mediafp, lastsize - 8 - 8, SEEK_CUR ) ;  NESTSIZE ( lastsize - 8 ) ; continue ; } qtsize32 = BYTESWAP32 ( qtsize32 ) ; if ( qtsize32 == 1 ) { <START_BUG> fread ( & qtsize, 1, 8, mp4 -> mediafp ) ; <END_BUG> qtsize = BYTESWAP64 ( qtsize ) - 8 ; } else qtsize = qtsize32 ; nest ++ ; if ( qtsize < 8 ) break ; if ( nest >= MAX_NEST_LEVEL ) break ; nestsize [ nest ] = qtsize ; lastsize = qtsize ; # if PRINT_MP4_STRUCTURE for ( int i = 1 ; i < nest ; i ++ ) printf ( "         " ) ; printf ( "%c%c%c%c   (%lld)\\n", ( qttag & 0xff ), ( ( qttag >> 8 ) & 0xff ), ( ( qttag >> 16 ) & 0xff ), ( ( qttag >> 24 )

Fix:
<S2SV_ModStart> mp4object ) ) ; struct stat64 mp4stat ; stat64 ( filename, & mp4stat ) ; mp4 -> filesize = mp4stat. st_size ; if ( mp4 -> filesize < 64 ) return 0 <S2SV_ModStart> mediafp ) ; mp4 -> filepos += len ; <S2SV_ModStart> len == 8 && mp4 -> filepos < mp4 -> filesize <S2SV_ModStart> ) ) { CloseSource ( ( size_t ) mp4 ) ; mp4 = NULL ; break <S2SV_ModEnd> ; } qtsize32 <S2SV_ModStart> 1 ) { len = <S2SV_ModStart> -> mediafp ) ; mp4 -> filepos += len <S2SV_ModStart>, 'a' ) || qttag == MAKEID ( 'f', 'r', 'e', 'e' ) ) { LongSeek ( mp4 <S2SV_ModEnd>, qtsize - <S2SV_ModStart> qtsize - 8 <S2SV_ModEnd> ) ; NESTSIZE <S2SV_ModStart>!= MAKEID ('s', 't', 'b', 'l' <S2SV_ModEnd> ) && qttag <S2SV_ModStart>!= MAKEID ('s', 't', 't' <S2SV_ModEnd>,'s' ) <S2SV_ModStart>, 't','s', 'c' <S2SV_ModEnd> ) && qttag <S2SV_ModStart>, 't'
Buggy code:
 void br_mdb_notify ( struct net_device * dev, struct net_bridge_port * port, struct br_ip * group, int type ) { <START_BUG> struct br_mdb_entry entry ; <END_BUG> entry. ifindex = port -> dev -> ifindex ; entry. addr. proto = group -> proto ; entry. addr. u. ip4 = group -> u. ip4 ; # if IS_ENABLED ( CONFIG_IPV6 ) entry. addr. u. ip6 = group -> u. ip6 ; # endif __br_mdb_notify ( dev, & entry, type ) ; }

Fix:
<S2SV_ModStart> struct br_mdb_entry entry ; memset ( & entry, 0, sizeof ( entry ) )
Buggy code:
 int vp8_set_active_map ( VP8_COMP * cpi, unsigned char * map, unsigned int rows, unsigned int cols ) { if ( rows == cpi -> common. mb_rows && cols == cpi -> common. mb_cols ) { if ( map ) { <START_BUG> vpx_memcpy ( cpi -> active_map, map, rows * cols ) ; <END_BUG> cpi -> active_map_enabled = 1 ; } else cpi -> active_map_enabled = 0 ; return 0 ; } else { return - 1 ; } }

Fix:
<S2SV_ModStart> map ) { memcpy <S2SV_ModEnd> ( cpi ->
Buggy code:
 static int create_fixed_stream_quirk ( struct snd_usb_audio * chip, struct usb_interface * iface, struct usb_driver * driver, const struct snd_usb_audio_quirk * quirk ) { struct audioformat * fp ; struct usb_host_interface * alts ; struct usb_interface_descriptor * altsd ; int stream, err ; unsigned * rate_table = NULL ; fp = kmemdup ( quirk -> data, sizeof ( * fp ), GFP_KERNEL ) ; if (! fp ) { usb_audio_err ( chip, "cannot   memdup\\n" ) ; return - ENOMEM ; } if ( fp -> nr_rates > MAX_NR_RATES ) { kfree ( fp ) ; return - EINVAL ; } if ( fp -> nr_rates > 0 ) { rate_table = kmemdup ( fp -> rate_table, sizeof ( int ) * fp -> nr_rates, GFP_KERNEL ) ; if (! rate_table ) { kfree ( fp ) ; return - ENOMEM ; } fp -> rate_table = rate_table ; } stream = ( fp -> endpoint & USB_DIR_IN )? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK ; err = snd_usb_add_audio_stream ( chip, stream, fp ) ; if ( err < 0 ) { kfree ( fp ) ; kfree ( rate_table ) ; return err ; } if ( fp -> iface!= get_iface_desc ( & iface -> altsetting [ 0 ] ) -> bInterfaceNumber || fp -> altset_idx >= iface -> num_altsetting ) { kfree ( fp ) ; kfree ( rate_table ) ; return - EINVAL ; } alts = & iface -> altsetting [ fp -> altset_idx ] ; altsd = get_iface_desc ( alts ) ; <START_BUG> fp -> protocol = altsd -> bInterfaceProtocol ; <END_BUG> if ( fp -> datainterval == 0 ) fp -> datainterval = snd_usb_parse_datainterval ( chip, alts ) ; if ( fp -> maxpacksize == 0 ) fp -> maxpacksize = le16_to_cpu ( get_endpoint ( alts, 0 )

Fix:
<S2SV_ModStart> alts ) ; if ( altsd -> bNumEndpoints < 1 ) { kfree ( fp ) ; kfree ( rate_table ) ; return - EINVAL ; }
Buggy code:
 int yyparse ( void * yyscanner, RE_LEX_ENVIRONMENT * lex_env ) { int yychar ; YY_INITIAL_VALUE ( static YYSTYPE yyval_default ; ) YYSTYPE yylval YY_INITIAL_VALUE ( = yyval_default ) ; int yynerrs ; int yystate ; int yyerrstatus ; yytype_int16 yyssa [ YYINITDEPTH ] ; yytype_int16 * yyss ; yytype_int16 * yyssp ; YYSTYPE yyvsa [ YYINITDEPTH ] ; YYSTYPE * yyvs ; YYSTYPE * yyvsp ; YYSIZE_T yystacksize ; int yyn ; int yyresult ; int yytoken = 0 ; YYSTYPE yyval ; # if YYERROR_VERBOSE char yymsgbuf [ 128 ] ; char * yymsg = yymsgbuf ; YYSIZE_T yymsg_alloc = sizeof yymsgbuf ; # endif # define YYPOPSTACK ( N ) ( yyvsp -= ( N ), yyssp -= ( N ) ) int yylen = 0 ; yyssp = yyss = yyssa ; yyvsp = yyvs = yyvsa ; yystacksize = YYINITDEPTH ; YYDPRINTF ( ( stderr, "Starting   parse\\n" ) ) ; yystate = 0 ; yyerrstatus = 0 ; yynerrs = 0 ; yychar = YYEMPTY ; goto yysetstate ; yynewstate : yyssp ++ ; yysetstate : * yyssp = yystate ; if ( yyss + yystacksize - 1 <= yyssp ) { YYSIZE_T yysize = yyssp - yyss + 1 ; # ifdef yyoverflow { YYSTYPE * yyvs1 = yyvs ; yytype_int16 * yyss1 = yyss ; yyoverflow ( YY_ ( "memory   exhausted" ), & yyss1, yysize * sizeof ( * yyssp ), & yyvs1, yysize * sizeof ( * yyvsp ), & yystacksize ) ; yyss = yyss1 ; yyvs = yyvs1 ; } # else # ifndef YYSTACK_RELOCATE goto yyexhaustedlab ; # else if ( YY

Fix:
<S2SV_ModStart> : # line 113 <S2SV_ModEnd> "re_grammar.y" { RE_AST <S2SV_ModStart> } # line 1348 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 122 <S2SV_ModEnd> "re_grammar.y" { ( <S2SV_ModStart> } # line 1356 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 126 <S2SV_ModEnd> "re_grammar.y" { mark_as_not_fast_regexp <S2SV_ModStart> ( ) ; incr_ast_levels ( ) ; <S2SV_ModStart> } # line 1372 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 138 <S2SV_ModEnd> "re_grammar.y" { RE_NODE <S2SV_ModStart> ( ) ; incr_ast_levels ( ) ; <S2SV_ModStart> } # line 1392 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 157 <S2SV_ModEnd> "re_grammar.y" { ( <S2SV_ModStart> } # line 1400 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 161 "re_grammar.y" { incr_ast_levels ( ) ; <S2SV_ModEnd> ( yyval. <S2SV_ModStart> } # line 1414 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 174 <S2SV_ModEnd> "re_grammar.y" {
Buggy code:
 static int format8BIM ( Image * ifile, Image * ofile ) { char temp [ MagickPathExtent ] ; unsigned int foundOSType ; int ID, resCount, i, c ; ssize_t count ; unsigned char * PString, * str ; resCount = 0 ; foundOSType = 0 ; ( void ) foundOSType ; c = ReadBlobByte ( ifile ) ; while ( c!= EOF ) { if ( c == '8' ) { unsigned char buffer [ 5 ] ; buffer [ 0 ] = ( unsigned char ) c ; for ( i = 1 ; i < 4 ; i ++ ) { c = ReadBlobByte ( ifile ) ; if ( c == EOF ) return ( - 1 ) ; buffer [ i ] = ( unsigned char ) c ; } buffer [ 4 ] = 0 ; if ( strcmp ( ( const char * ) buffer, "8BIM" ) == 0 ) foundOSType = 1 ; else continue ; } else { c = ReadBlobByte ( ifile ) ; continue ; } ID = ReadBlobMSBSignedShort ( ifile ) ; if ( ID < 0 ) return ( - 1 ) ; { unsigned char plen ; c = ReadBlobByte ( ifile ) ; if ( c == EOF ) return ( - 1 ) ; plen = ( unsigned char ) c ; PString = ( unsigned char * ) AcquireQuantumMemory ( ( size_t ) ( plen + MagickPathExtent ), sizeof ( * PString ) ) ; if ( PString == ( unsigned char * ) NULL ) return 0 ; for ( i = 0 ; i < plen ; i ++ ) { c = ReadBlobByte ( ifile ) ; if ( c == EOF ) { PString = ( unsigned char * ) RelinquishMagickMemory ( PString ) ; return - 1 ; } PString [ i ] = ( unsigned char ) c ; } PString [ plen ] = 0 ; if ( ( plen & 0x01 ) == 0 ) { c = ReadBlobByte ( ifile ) ; if ( c == EOF ) { PString = ( unsigned char * ) RelinquishMagickMemory ( PString ) ; return - 1 ; } } } count = ( ssize_t ) ReadBlobMSBSignedLong ( ifile ) ; if ( ( count < 0 ) || ( count > GetBlobSize ( ifile

Fix:
<S2SV_ModStart> size_t ) count + 1
Buggy code:
 void _moddeinit ( module_unload_intent_t intent ) { service_named_unbind_command ( "chanserv", & cs_flags ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> cs_flags ) ; hook_del_nick_can_register ( check_registration_keywords ) ; hook_del_user_can_register ( check_registration_keywords ) ; del_conf_item ( "ANOPE_FLAGS_COMPAT", & chansvs. me -> conf_table ) ;
Buggy code:
 <START_BUG> static inline ulong encode_twos_comp ( long n, int prec ) <END_BUG> {  ulong result ; <START_BUG> assert ( prec >= 2 ) ; jas_eprintf ( "warning:   support   for   signed   data   is   untested\\n" ) ; if ( n < 0 ) { result = - n ; result = ( result ^ 0xffffffffUL ) + 1 ; result &= ( 1 << prec ) - 1 ; } else { result = n ; } return result ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> static inline jas_ulong <S2SV_ModEnd> encode_twos_comp ( long <S2SV_ModStart> prec ) { jas_ulong <S2SV_ModEnd> result ; assert
Buggy code:
 <START_BUG> static PixelChannels * * AcquirePixelThreadSet ( const Image * image ) <END_BUG> { PixelChannels * * pixels ; register ssize_t i ; size_t  number_threads ; <START_BUG> number_threads = ( size_t ) GetMagickResourceLimit ( ThreadResource ) ; pixels = ( PixelChannels * * ) AcquireQuantumMemory ( number_threads, sizeof ( * pixels ) ) ; if ( pixels == ( PixelChannels * * ) NULL ) return ( ( PixelChannels * * ) NULL ) ; ( void ) memset ( pixels, 0, number_threads * sizeof ( * pixels ) ) ; <END_BUG> for ( i = 0 ; i < ( ssize_t ) number_threads ; i ++ )  { register ssize_t j ; <START_BUG> pixels [ i ] = ( PixelChannels * ) AcquireQuantumMemory ( image -> columns, <END_BUG> sizeof ( * * pixels ) ) ; if ( pixels [ i ] == ( PixelChannels * ) NULL ) return ( DestroyPixelThreadSet ( pixels ) ) ;  for ( j = 0 ; j < ( ssize_t ) image -> columns ; j ++ ) <START_BUG> { register ssize_t k ; for ( k = 0 ; k < MaxPixelChannels ; k ++ ) pixels [ i ] [ j ]. channel [ k ] = 0.0 ; } } return ( pixels ) ; }<END_BUG>

Fix:
<S2SV_ModStart> const Image * images ) { const Image * next ; <S2SV_ModEnd> PixelChannels * * <S2SV_ModStart> i ; size_t columns, <S2SV_ModStart> ) ) ; columns = images -> columns ; for ( next = images ; next!= ( Image * ) NULL ; next = next -> next ) columns = MagickMax ( next -> columns, columns ) ; <S2SV_ModStart> ) AcquireQuantumMemory ( columns, <S2SV_ModEnd> sizeof ( * <S2SV_ModStart> ( ssize_t ) <S2SV_ModEnd> columns ; j
Buggy code:
 int mndp_add_attribute ( struct mt_packet * packet, enum mt_mndp_attrtype attrtype, void * attrdata, unsigned short data_len ) { unsigned char * data = packet -> data + packet -> size ; unsigned short type = attrtype ; unsigned short len = data_len ; <START_BUG> if ( packet -> size + 4 + data_len > MT_PACKET_LEN ) { <END_BUG> fprintf ( stderr, _ ( "mndp_add_attribute:   ERROR,   too   large   packet.   Exceeds   %d   bytes\\n" ), MT_PACKET_LEN ) ; return - 1 ; } type = htons ( type ) ; memcpy ( data, & type, sizeof ( type ) ) ; len = htons ( len ) ; memcpy ( data + 2, & len, sizeof ( len ) ) ; memcpy ( data + 4, attrdata, data_len ) ; packet -> size += 4 + data_len ; return 4 + data_len ; }

Fix:
<S2SV_ModStart> ; if ( data_len > MT_PACKET_LEN - 4 - <S2SV_ModStart> packet -> size <S2SV_ModEnd> ) { fprintf
Buggy code:
 int vp9_release_frame_buffer ( void * cb_priv, vpx_codec_frame_buffer_t * fb ) { InternalFrameBuffer * const int_fb = ( InternalFrameBuffer * ) fb -> priv ; ( void ) cb_priv ; <START_BUG> int_fb -> in_use = 0 ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ) cb_priv ; if ( int_fb )
Buggy code:
 static VALUE ossl_cipher_initialize ( VALUE self, VALUE str ) { EVP_CIPHER_CTX * ctx ; const EVP_CIPHER * cipher ; <START_BUG> char * name ; <END_BUG> unsigned char dummy_key [ EVP_MAX_KEY_LENGTH ] = { 0 } ; name = StringValueCStr ( str ) ; GetCipherInit ( self, ctx ) ; if ( ctx ) { ossl_raise ( rb_eRuntimeError, "Cipher   already   inititalized!" ) ; } AllocCipher ( self, ctx ) ; if (! ( cipher = EVP_get_cipherbyname ( name ) ) ) { ossl_raise ( rb_eRuntimeError, "unsupported   cipher   algorithm   (%" PRIsVALUE ")", str ) ; }  if ( EVP_CipherInit_ex ( ctx, cipher, NULL, dummy_key, NULL, - 1 )!= 1 ) <START_BUG> ossl_raise ( eCipherError, NULL ) ; return self ; }<END_BUG>

Fix:
<S2SV_ModStart> char * name <S2SV_ModEnd> ; name = <S2SV_ModStart>, NULL, NULL <S2SV_ModEnd>, NULL,
Buggy code:
 void vp8_setup_intra_recon_top_line ( YV12_BUFFER_CONFIG * ybf ) { <START_BUG> vpx_memset ( ybf -> y_buffer - 1 - ybf -> y_stride, 127, ybf -> y_width + 5 ) ; <END_BUG>  vpx_memset ( ybf -> u_buffer - 1 - ybf -> uv_stride, 127, ybf -> uv_width + 5 ) ; <START_BUG> <END_BUG> vpx_memset ( ybf -> v_buffer - 1 - ybf -> uv_stride, 127, ybf -> uv_width + 5 ) ;  }

Fix:
<S2SV_ModStart> ybf ) { memset <S2SV_ModEnd> ( ybf -> <S2SV_ModStart> 5 ) ; memset <S2SV_ModEnd> ( ybf -> <S2SV_ModStart> 5 ) ; memset <S2SV_ModEnd> ( ybf ->
Buggy code:
 void cJSON_ReplaceItemInObject ( cJSON * object, const char * string, cJSON * newitem ) { int i = 0 ; cJSON * c = object -> child ; <START_BUG> while ( c && cJSON_strcasecmp ( c -> string, string ) ) { <END_BUG> ++ i ; c = c -> next ;  } <START_BUG> if ( c ) { newitem -> string = cJSON_strdup ( string ) ; cJSON_ReplaceItemInArray ( object, i, newitem ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> string ) ) i ++, <S2SV_ModEnd> c = c <S2SV_ModStart> -> next ; <S2SV_ModEnd> if ( c
Buggy code:
 error_t ssiProcessEchoCommand ( HttpConnection * connection, const char_t * tag, size_t length ) { error_t error ; char_t * separator ; char_t * attribute ; char_t * value ; if ( length < 4 || length >= HTTP_SERVER_BUFFER_SIZE ) return ERROR_INVALID_TAG ; osMemcpy ( connection -> buffer, tag + 4, length - 4 ) ; connection -> buffer [ length - 4 ] = '\\0' ; <START_BUG> separator = strchr ( connection -> buffer, '=' ) ; <END_BUG> if (! separator ) return ERROR_INVALID_TAG ; * separator = '\\0' ; attribute = strTrimWhitespace ( connection -> buffer ) ; value = strTrimWhitespace ( separator + 1 ) ; if ( value [ 0 ] == '\\'' || value [ 0 ] == \'\\"\' ) value ++ ; length = osStrlen ( value ) ; if ( length > 0 ) { if ( value [ length - 1 ] == '\\'' || value [ length - 1 ] == \'\\"\' ) value [ length - 1 ] = '\\0' ; } if ( osStrcasecmp ( attribute, "var" ) ) return ERROR_INVALID_TAG ; if (! osStrcasecmp ( value, "REMOTE_ADDR" ) ) { ipAddrToString ( & connection -> socket -> remoteIpAddr, connection -> buffer ) ; } else if (! osStrcasecmp ( value, "REMOTE_PORT" ) ) { osSprintf ( connection -> buffer, "%" PRIu16, connection -> socket -> remotePort ) ; } else if (! osStrcasecmp ( value, "SERVER_ADDR" ) ) { ipAddrToString ( & connection -> socket -> localIpAddr, connection -> buffer ) ; } else if (! osStrcasecmp ( value, "SERVER_PORT" ) ) { osSprintf ( connection -> buffer, "%" PRIu16, connection -> socket -> localPort ) ; } else if (! osStrcasecmp ( value, "REQUEST_METHOD" ) ) { osStrcpy ( connection -> buffer, connection -> request. method ) ; } else if (! osStrcasecmp ( value, "DOCUMENT_ROOT" ) ) { osStrcpy ( connection -> buffer, connection -> settings -> rootDirectory ) ; } else if (! osStrcasecmp ( value, "DOCUMENT_URI" ) ) { osStrcpy ( connection -> buffer, connection -> request

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( connection ->
Buggy code:
 <START_BUG> static void rd_pick_partition ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> TOKENEXTRA * * tp, int mi_row,  int mi_col, BLOCK_SIZE bsize, int * rate, <START_BUG> int64_t * dist, int do_recon, int64_t best_rd ) { VP9_COMMON * const cm = & cpi -> common ; <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  MACROBLOCKD * const xd = & x -> e_mbd ; const int mi_step = num_8x8_blocks_wide_lookup [ bsize ] // 2 ; ENTROPY_CONTEXT l [ 16 * MAX_MB_PLANE ], a [ 16 * MAX_MB_PLANE ] ; PARTITION_CONTEXT sl [ 8 ], sa [ 8 ] ; TOKENEXTRA * tp_orig = * tp ; <START_BUG> PICK_MODE_CONTEXT * ctx = get_block_context ( x, bsize ) ; <END_BUG> int i, pl ; BLOCK_SIZE subsize ;  int this_rate, sum_rate = 0, best_rate = INT_MAX ; <START_BUG> int64_t this_dist, sum_dist = 0, best_dist = INT64_MAX ; int64_t sum_rd = 0 ; int do_split = bsize >= BLOCK_8X8 ; int do_rect = 1 ; const int force_horz_split = ( mi_row + mi_step >= cm -> mi_rows ) ; const int force_vert_split = ( mi_col + mi_step >= cm -> mi_cols ) ; const int xss = x -> e_mbd. plane [ 1 ]. subsampling_x ; const int yss = x -> e_mbd. plane [ 1 ]. subsampling_y ; <END_BUG> int partition_none_allowed =! force_horz_split &&! force_vert_split ;  int partition_horz_allowed =! force_vert_split && yss <= xss && bsize >= BLOCK_8X8 ; int partition_vert_allowed =! force_horz_split && xss <= yss && bsize >= BLOCK_8X8 ; ( void ) * tp_orig ; <START_BUG> if ( bsize <<END_BUG>

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, TileDataEnc * tile_data <S2SV_ModEnd>, TOKENEXTRA * <S2SV_ModStart> int mi_row, int mi_col, <S2SV_ModEnd> BLOCK_SIZE bsize, <S2SV_ModStart> BLOCK_SIZE bsize, RD_COST * rd_cost, int64_t best_rd, PC_TREE * pc_tree <S2SV_ModEnd> ) { VP9_COMMON <S2SV_ModStart> -> common ; TileInfo * const tile_info = & tile_data -> tile_info ; <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> * ctx = & pc_tree -> none <S2SV_ModEnd> ; int i <S2SV_ModStart> BLOCK_SIZE subsize ; RD_COST this_rdc, sum_rdc, best_rdc <S2SV_ModEnd> ; int do_split <S2SV_ModStart>. subsampling_y ; BLOCK_SIZE min_size = x -> min_partition_size ; BLOCK_SIZE max_size = x -> max_partition_size ; # if CONFIG_FP_MB_STATS unsigned int src_diff_var = UINT_MAX ; int none_complexity = 0 ; # endif <S2SV_ModStart> * tp_orig ; <S2SV_ModEnd> assert ( num_8x8_blocks_wide_lookup <S2SV_ModStart> [ bsize ] ) ; vp9_rd
Buggy code:
 static int __jfs_set_acl ( tid_t tid, struct inode * inode, int type, struct posix_acl * acl ) { char * ea_name ; int rc ; int size = 0 ; char * value = NULL ; switch ( type ) { case ACL_TYPE_ACCESS : ea_name = XATTR_NAME_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> rc = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( rc < 0 )  return rc ; <START_BUG> inode -> i_ctime = CURRENT_TIME ; mark_inode_dirty ( inode ) ; if ( rc == 0 ) acl = NULL ; } break ; case ACL_TYPE_DEFAULT : ea_name = XATTR_NAME_POSIX_ACL_DEFAULT ; break ; default : return - EINVAL ; } if ( acl ) { size = posix_acl_xattr_size ( acl -> a_count ) ; value = kmalloc ( size, GFP_KERNEL ) ; if (! value ) return - ENOMEM ; rc = posix_acl_to_xattr ( & init_user_ns, acl, value, size ) ; if ( rc < 0 ) goto out ; } rc = __jfs_setxattr ( tid, inode, ea_name, value, size, 0 ) ; out : kfree ( value ) ; if (! rc ) set_cached_acl ( inode, type, acl ) ; return rc ; }<END_BUG>

Fix:
<S2SV_ModStart> { rc = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( rc ) return rc ; inode -> i_ctime = CURRENT_TIME ; mark_inode_dirty ( inode ) ; } break ; case ACL_TYPE_DEFAULT : ea_name = XATTR_NAME_POSIX_ACL_DEFAULT ; break ; default : return - EINVAL ; } if ( acl ) { size = posix_acl_xattr_size ( acl -> a_count ) ; value = kmalloc ( size, GFP_KERNEL ) ; if (! value ) return - ENOMEM ; rc = posix_acl_to_xattr ( & init_user_ns, acl, value, size <S2SV_ModStart> < 0 ) <S2SV_ModEnd> goto out ;
Buggy code:
 static int msr_open ( struct inode * inode, struct file * file ) { unsigned int cpu ; <START_BUG> struct cpuinfo_x86 * c ; <END_BUG> cpu = iminor ( file -> f_path. dentry -> d_inode ) ; if ( cpu >= nr_cpu_ids ||! cpu_online ( cpu ) ) return - ENXIO ; c = & cpu_data ( cpu ) ; if (! cpu_has ( c, X86_FEATURE_MSR ) ) return - EIO ; return 0 ; }

Fix:
<S2SV_ModStart> cpuinfo_x86 * c ; if (! capable ( CAP_SYS_RAWIO ) ) return - EPERM
Buggy code:
 int mp_pack ( lua_State * L ) { int nargs = lua_gettop ( L ) ; int i ; mp_buf * buf ; if ( nargs == 0 ) <START_BUG> return luaL_argerror ( L, 0, "MessagePack   pack   needs   input." ) ; <END_BUG> buf = mp_buf_new ( L ) ; for ( i = 1 ; i <= nargs ; i ++ ) { lua_pushvalue ( L, i ) ; mp_encode_lua_type ( L, buf, 0 ) ; lua_pushlstring ( L, ( char * ) buf -> b, buf -> len ) ; buf -> free += buf -> len ; buf -> len = 0 ; } mp_buf_free ( L, buf ) ; lua_concat ( L, nargs ) ; return 1 ; }

Fix:
<S2SV_ModStart> 0, "MessagePack <S2SV_blank> pack <S2SV_blank> needs <S2SV_blank> input." ) ; if (! lua_checkstack ( L, nargs ) ) return luaL_argerror ( L, 0, "Too <S2SV_blank> many <S2SV_blank> arguments <S2SV_blank> for <S2SV_blank> MessagePack <S2SV_blank> pack."
Buggy code:
 DECLAREreadFunc ( readContigTilesIntoBuffer ) { int status = 1 ; tsize_t tilesize = TIFFTileSize ( in ) ; tdata_t tilebuf ; uint32 imagew = TIFFScanlineSize ( in ) ; uint32 tilew = TIFFTileRowSize ( in ) ; <START_BUG> int iskew = imagew - tilew ; <END_BUG> uint8 * bufp = ( uint8 * ) buf ; uint32 tw, tl ; uint32 row ; ( void ) spp ; tilebuf = _TIFFmalloc ( tilesize ) ; if ( tilebuf == 0 ) return 0 ; _TIFFmemset ( tilebuf, 0, tilesize ) ; ( void ) TIFFGetField ( in, TIFFTAG_TILEWIDTH, & tw ) ; ( void ) TIFFGetField ( in, TIFFTAG_TILELENGTH, & tl ) ; for ( row = 0 ; row < imagelength ; row += tl ) { uint32 nrow = ( row + tl > imagelength )? imagelength - row : tl ; uint32 colb = 0 ; uint32 col ; for ( col = 0 ; col < imagewidth && colb < imagew ; col += tw ) { if ( TIFFReadTile ( in, tilebuf, col, row, 0, 0 ) < 0 &&! ignore ) { TIFFError ( TIFFFileName ( in ), "Error,   can\'t   read   tile   at   %lu   %lu", ( unsigned long ) col, ( unsigned long ) row ) ; status = 0 ; goto done ; }  if ( colb + tilew > imagew ) { <START_BUG> uint32 width = imagew - colb ; uint32 oskew = tilew - width ; cpStripToTile ( bufp + colb, tilebuf, nrow, width, oskew + iskew, oskew ) ; } else cpStripToTile ( bufp + colb, tilebuf, nrow, tilew, iskew, 0 ) ; colb += tilew ; } bufp += imagew * nrow ; } done : _TIFFfree ( tilebuf ) ; return status ; }<END_BUG>

Fix:
<S2SV_ModStart> in ) ; int64 iskew = ( int64 ) imagew - ( int64 ) <S2SV_ModEnd> tilew ; uint8 <S2SV_ModStart> if ( colb > iskew <S2SV_ModEnd> ) { uint32
Buggy code:
 static void jas_stream_initbuf ( jas_stream_t * stream, int bufmode, char * buf, int bufsize ) { assert (! stream -> bufbase_ ) ; if ( bufmode!= JAS_STREAM_UNBUF ) { if (! buf ) { if ( ( stream -> bufbase_ = jas_malloc ( JAS_STREAM_BUFSIZE + JAS_STREAM_MAXPUTBACK ) ) ) { stream -> bufmode_ |= JAS_STREAM_FREEBUF ; stream -> bufsize_ = JAS_STREAM_BUFSIZE ; } else { stream -> bufbase_ = stream -> tinybuf_ ; stream -> bufsize_ = 1 ; } } else { assert ( bufsize > JAS_STREAM_MAXPUTBACK ) ; <START_BUG> stream -> bufbase_ = JAS_CAST ( uchar *, buf ) ; <END_BUG> stream -> bufsize_ = bufsize - JAS_STREAM_MAXPUTBACK ; } } else { assert (! buf ) ; stream -> bufbase_ = stream -> tinybuf_ ; stream -> bufsize_ = 1 ; } stream -> bufstart_ = & stream -> bufbase_ [ JAS_STREAM_MAXPUTBACK ] ; stream -> ptr_ = stream -> bufstart_ ; stream -> cnt_ = 0 ; stream -> bufmode_ |= bufmode & JAS_STREAM_BUFMODEMASK ; }

Fix:
<S2SV_ModStart> = JAS_CAST ( jas_uchar <S2SV_ModEnd> *, buf
Buggy code:
 void vp9_init_quantizer ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; QUANTS * const quants = & cpi -> quants ; int i, q, quant ; for ( q = 0 ; q < QINDEX_RANGE ; q ++ ) { <START_BUG> const int qzbin_factor = q == 0? 64 : ( vp9_dc_quant ( q, 0 ) < 148? 84 : 80 ) ; <END_BUG> const int qrounding_factor = q == 0? 64 : 48 ; for ( i = 0 ; i < 2 ; ++ i ) {  quant = i == 0? vp9_dc_quant ( q, cm -> y_dc_delta_q ) <START_BUG> <END_BUG> : vp9_ac_quant ( q, 0 ) ;  invert_quant ( & quants -> y_quant [ q ] [ i ], & quants -> y_quant_shift [ q ] [ i ], quant ) ; <START_BUG> quants -> y_zbin [ q ] [ i ] = ROUND_POWER_OF_TWO ( qzbin_factor * quant, 7 ) ; <END_BUG> quants -> y_round [ q ] [ i ] = ( qrounding_factor * quant ) >> 7 ;  cm -> y_dequant [ q ] [ i ] = quant ; <START_BUG> <END_BUG> quant = i == 0? vp9_dc_quant ( q, cm -> uv_dc_delta_q )  <START_BUG> : vp9_ac_quant ( q, cm -> uv_ac_delta_q ) ; <END_BUG> invert_quant ( & quants -> uv_quant [ q ] [ i ], & quants -> uv_quant_shift [ q ] [ i ], quant ) ;  quants -> uv_zbin [ q ] [ i ] = ROUND_POWER_OF_TWO ( qzbin_factor * quant, 7 ) ; <START_BUG> quants -> uv_round [ q ] [ i ] = ( qrounding_factor * quant ) >> 7 ; <END_BUG> cm -> uv_dequant [ q ] [ i ] = quant ;  # if CONFIG_ALPHA quant = i == 0? vp9_dc_quant ( q, cm -> a_dc_delta_q ) : vp9_ac_quant ( q, cm ->

Fix:
<S2SV_ModStart> int qzbin_factor = get_qzbin_factor ( q, cm -> bit_depth <S2SV_ModEnd> ) ; const <S2SV_ModStart> i ) { int qrounding_factor_fp = i == 0? 48 : 42 ; if ( q == 0 ) qrounding_factor_fp = 64 ; <S2SV_ModStart> cm -> y_dc_delta_q, cm -> bit_depth <S2SV_ModStart> q, 0, cm -> bit_depth <S2SV_ModStart> ; quants -> y_quant_fp [ q ] [ i ] = ( 1 << 16 ) // quant ; quants -> y_round_fp [ q ] [ i ] = ( qrounding_factor_fp <S2SV_ModEnd> * quant ) <S2SV_ModStart> >> 7 ; quants -> y_zbin [ q ] [ i ] = ROUND_POWER_OF_TWO ( qzbin_factor * quant, 7 ) ; quants -> y_round [ q ] [ i ] = ( qrounding_factor * quant ) >> 7 ; cpi <S2SV_ModEnd> -> y_dequant [ <S2SV_ModStart> cm -> uv_dc_delta_q, cm -> bit_depth <S2SV_ModStart> cm -> uv_ac_delta_q, cm -> bit_depth <S2SV_ModStart> ; quants -> uv_quant_fp [
Buggy code:
 static int dnxhd_find_frame_end ( DNXHDParserContext * dctx, const uint8_t * buf, int buf_size ) { ParseContext * pc = & dctx -> pc ; uint64_t state = pc -> state64 ; int pic_found = pc -> frame_start_found ; int i = 0 ; int interlaced = dctx -> interlaced ; int cur_field = dctx -> cur_field ; if (! pic_found ) { for ( i = 0 ; i < buf_size ; i ++ ) { state = ( state << 8 ) | buf [ i ] ; if ( ff_dnxhd_check_header_prefix ( state & 0xffffffffff00LL )!= 0 ) { i ++ ; pic_found = 1 ; interlaced = ( state & 2 ) >> 1 ; cur_field = state & 1 ; dctx -> cur_byte = 0 ; dctx -> remaining = 0 ; break ; } } } if ( pic_found &&! dctx -> remaining ) { if (! buf_size ) return 0 ; for ( ; i < buf_size ; i ++ ) { dctx -> cur_byte ++ ; state = ( state << 8 ) | buf [ i ] ; if ( dctx -> cur_byte == 24 ) { dctx -> h = ( state >> 32 ) & 0xFFFF ; } else if ( dctx -> cur_byte == 26 ) { dctx -> w = ( state >> 32 ) & 0xFFFF ; } else if ( dctx -> cur_byte == 42 ) { int cid = ( state >> 32 ) & 0xFFFFFFFF ; <START_BUG> if ( cid <= 0 ) <END_BUG> continue ;  dctx -> remaining = avpriv_dnxhd_get_frame_size ( cid ) ; <START_BUG> <END_BUG> if ( dctx -> remaining <= 0 ) {  <START_BUG> dctx -> remaining = dnxhd_get_hr_frame_size ( cid, dctx -> w, dctx -> h ) ; <END_BUG>  if ( dctx -> remaining <= 0 ) <START_BUG> <END_BUG> return dctx -> remaining ;  } if ( buf_size - i >= dctx -> remaining && (! dctx -> interlaced || dctx -> cur_field ) ) { int remaining = dctx -> remaining ; pc -> frame_start_found = 0 ; pc -> state64

Fix:
<S2SV_ModStart> & 0xFFFFFFFF ; int remaining ; <S2SV_ModStart> ) continue ; <S2SV_ModEnd> remaining = avpriv_dnxhd_get_frame_size <S2SV_ModStart> ; if ( <S2SV_ModEnd> remaining <= 0 <S2SV_ModStart> 0 ) { <S2SV_ModEnd> remaining = dnxhd_get_hr_frame_size <S2SV_ModStart> ; if ( <S2SV_ModEnd> remaining <= 0 <S2SV_ModStart> <= 0 ) continue ; } dctx -> remaining = remaining ; <S2SV_ModEnd> if ( buf_size
Buggy code:
 static int sctp_getsockopt_assoc_stats ( struct sock * sk, int len, char __user * optval, int __user * optlen ) { struct sctp_assoc_stats sas ; struct sctp_association * asoc = NULL ; if ( len < sizeof ( sctp_assoc_t ) ) return - EINVAL ; <START_BUG> if ( copy_from_user ( & sas, optval, len ) ) <END_BUG> return - EFAULT ; asoc = sctp_id2assoc ( sk, sas. sas_assoc_id ) ; if (! asoc ) return - EINVAL ; sas. sas_rtxchunks = asoc -> stats. rtxchunks ; sas. sas_gapcnt = asoc -> stats. gapcnt ; sas. sas_outofseqtsns = asoc -> stats. outofseqtsns ; sas. sas_osacks = asoc -> stats. osacks ; sas. sas_isacks = asoc -> stats. isacks ; sas. sas_octrlchunks = asoc -> stats. octrlchunks ; sas. sas_ictrlchunks = asoc -> stats. ictrlchunks ; sas. sas_oodchunks = asoc -> stats. oodchunks ; sas. sas_iodchunks = asoc -> stats. iodchunks ; sas. sas_ouodchunks = asoc -> stats. ouodchunks ; sas. sas_iuodchunks = asoc -> stats. iuodchunks ; sas. sas_idupchunks = asoc -> stats. idupchunks ; sas. sas_opackets = asoc -> stats. opackets ; sas. sas_ipackets = asoc -> stats. ipackets ; sas. sas_maxrto = asoc -> stats. max_obs_rto ; memcpy ( & sas. sas_obs_rto_ipaddr, & asoc -> stats. obs_rto_ipaddr, sizeof ( struct sockaddr_storage ) ) ; asoc -> stats. max_obs_rto = asoc -> rto_min ;  len = min_t ( size_t, len, sizeof ( sas ) ) ; <START_BUG> if ( put_user ( len, optlen ) ) return - EFAULT ; SCTP_DEBUG_PRINTK ( "sctp_getsockopt_assoc_stat(%<END_BUG>

Fix:
<S2SV_ModStart> - EINVAL ; len = min_t ( size_t, len, sizeof ( sas ) ) ; <S2SV_ModStart> -> rto_min ; <S2SV_ModEnd> if ( put_user
Buggy code:
 int lldp_decode ( struct lldpd * cfg, char * frame, int s, struct lldpd_hardware * hardware, struct lldpd_chassis * * newchassis, struct lldpd_port * * newport ) { struct lldpd_chassis * chassis ; struct lldpd_port * port ; const char lldpaddr [ ] = LLDP_MULTICAST_ADDR ; const char dot1 [ ] = LLDP_TLV_ORG_DOT1 ; const char dot3 [ ] = LLDP_TLV_ORG_DOT3 ; const char med [ ] = LLDP_TLV_ORG_MED ; const char dcbx [ ] = LLDP_TLV_ORG_DCBX ; unsigned char orgid [ 3 ] ; int length, gotend = 0, ttl_received = 0 ; int tlv_size, tlv_type, tlv_subtype ; u_int8_t * pos, * tlv ; char * b ; # ifdef ENABLE_DOT1 struct lldpd_vlan * vlan = NULL ; int vlan_len ; struct lldpd_ppvid * ppvid ; struct lldpd_pi * pi = NULL ; # endif struct lldpd_mgmt * mgmt ; int af ; u_int8_t addr_str_length, addr_str_buffer [ 32 ] ; u_int8_t addr_family, addr_length, * addr_ptr, iface_subtype ; u_int32_t iface_number, iface ; # ifdef ENABLE_CUSTOM struct lldpd_custom * custom = NULL ; # endif log_debug ( "lldp", "receive   LLDP   PDU   on   %s", hardware -> h_ifname ) ; if ( ( chassis = calloc ( 1, sizeof ( struct lldpd_chassis ) ) ) == NULL ) { log_warn ( "lldp", "failed   to   allocate   remote   chassis" ) ; return - 1 ; } TAILQ_INIT ( & chassis -> c_mgmt ) ; if ( ( port = calloc ( 1, sizeof ( struct lldpd_port ) ) ) == NULL ) { log_warn ( "lldp", "failed   to   allocate   remote   port" ) ; free (

Fix:
<S2SV_ModStart> NULL ) { if <S2SV_ModEnd> ( errno == <S2SV_ModStart> == ENOMEM ) <S2SV_ModEnd> log_warn ( "lldp" <S2SV_ModStart>, "unable <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> memory <S2SV_blank> " "for <S2SV_blank> management <S2SV_blank> address" ) ; else log_warn ( "lldp", "too <S2SV_blank> large <S2SV_blank> management <S2SV_blank> address <S2SV_blank> " "received <S2SV_blank> on <S2SV_blank> %s", hardware -> h_ifname
Buggy code:
 SQLITE_PRIVATE SrcList * sqlite3SrcListEnlarge ( Parse * pParse, SrcList * pSrc, int nExtra, int iStart ) { int i ; assert ( iStart >= 0 ) ; assert ( nExtra >= 1 ) ; assert ( pSrc!= 0 ) ; assert ( iStart <= pSrc -> nSrc ) ; if ( ( u32 ) pSrc -> nSrc + nExtra > pSrc -> nAlloc ) { SrcList * pNew ; <START_BUG> int nAlloc = pSrc -> nSrc * 2 + nExtra ; <END_BUG> sqlite3 * db = pParse -> db ; if ( pSrc -> nSrc + nExtra >= SQLITE_MAX_SRCLIST ) { sqlite3ErrorMsg ( pParse, "too   many   FROM   clause   terms,   max:   %d", SQLITE_MAX_SRCLIST ) ; return 0 ; } if ( nAlloc > SQLITE_MAX_SRCLIST ) nAlloc = SQLITE_MAX_SRCLIST ; pNew = sqlite3DbRealloc ( db, pSrc, sizeof ( * pSrc ) + ( nAlloc - 1 ) * sizeof ( pSrc -> a [ 0 ] ) ) ; if ( pNew == 0 ) { assert ( db -> mallocFailed ) ; return 0 ; } pSrc = pNew ; pSrc -> nAlloc = nAlloc ; } for ( i = pSrc -> nSrc - 1 ; i >= iStart ; i -- ) { pSrc -> a [ i + nExtra ] = pSrc -> a [ i ] ; } pSrc -> nSrc += nExtra ; memset ( & pSrc -> a [ iStart ], 0, sizeof ( pSrc -> a [ 0 ] ) * nExtra ) ; for ( i = iStart ; i < iStart + nExtra ; i ++ ) { pSrc -> a [ i ]. iCursor = - 1 ; } return pSrc ; }

Fix:
<S2SV_ModStart> * pNew ; sqlite3_int64 nAlloc = 2 * ( sqlite3_int64 ) pSrc -> nSrc <S2SV_ModEnd> + nExtra ;
Buggy code:
 PyObject * ast2obj_comprehension ( void * _o ) { comprehension_ty o = ( comprehension_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } result = PyType_GenericNew ( comprehension_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_expr ( o -> target ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_target, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> iter ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_iter, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> ifs, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_ifs, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> is_async ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_is_async, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } result
Buggy code:
 static int futex_requeue ( u32 __user * uaddr1, unsigned int flags, u32 __user * uaddr2, int nr_wake, int nr_requeue, u32 * cmpval, int requeue_pi ) { union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT ; int drop_count = 0, task_count = 0, ret ; struct futex_pi_state * pi_state = NULL ; struct futex_hash_bucket * hb1, * hb2 ; struct futex_q * this, * next ; <START_BUG> DEFINE_WAKE_Q ( wake_q ) ; <END_BUG> if (! IS_ENABLED ( CONFIG_FUTEX_PI ) && requeue_pi ) return - ENOSYS ; if ( requeue_pi ) { if ( uaddr1 == uaddr2 ) return - EINVAL ; if ( refill_pi_state_cache ( ) ) return - ENOMEM ; if ( nr_wake!= 1 ) return - EINVAL ; } retry : ret = get_futex_key ( uaddr1, flags & FLAGS_SHARED, & key1, VERIFY_READ ) ; if ( unlikely ( ret!= 0 ) ) goto out ; ret = get_futex_key ( uaddr2, flags & FLAGS_SHARED, & key2, requeue_pi? VERIFY_WRITE : VERIFY_READ ) ; if ( unlikely ( ret!= 0 ) ) goto out_put_key1 ; if ( requeue_pi && match_futex ( & key1, & key2 ) ) { ret = - EINVAL ; goto out_put_keys ; } hb1 = hash_futex ( & key1 ) ; hb2 = hash_futex ( & key2 ) ; retry_private : hb_waiters_inc ( hb2 ) ; double_lock_hb ( hb1, hb2 ) ; if ( likely ( cmpval!= NULL ) ) { u32 curval ; ret = get_futex_value_locked ( & curval, uaddr1 ) ; if ( unlikely ( ret ) ) { double_unlock_hb ( hb1, hb2 ) ; hb_waiters_dec ( hb2 ) ; ret

Fix:
<S2SV_ModStart> ( wake_q ) ; if ( nr_wake < 0 || nr_requeue < 0 ) return - EINVAL
Buggy code:
 <START_BUG> int ntlm_read_message_fields_buffer ( wStream * s, NTLM_MESSAGE_FIELDS * fields ) <END_BUG> { if ( fields -> Len > 0 ) {  if ( ( fields -> BufferOffset + fields -> Len ) > Stream_Length ( s ) ) <START_BUG> return - 1 ; fields -> Buffer = ( PBYTE ) malloc ( fields -> Len ) ; if (! fields -> Buffer ) return - 1 ; Stream_SetPosition ( s, fields -> BufferOffset ) ; Stream_Read ( s, fields -> Buffer, fields -> Len ) ; } return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> 0 ) { const UINT64 offset = ( UINT64 ) <S2SV_ModEnd> fields -> BufferOffset <S2SV_ModStart> -> BufferOffset + ( UINT64 ) <S2SV_ModStart> fields -> Len ; if ( offset <S2SV_ModEnd> > Stream_Length (
Buggy code:
 <START_BUG> static void write_tile_info ( VP9_COMMON * cm, struct vp9_write_bit_buffer * wb ) { <END_BUG> int min_log2_tile_cols, max_log2_tile_cols, ones ; vp9_get_tile_n_bits ( cm -> mi_cols, & min_log2_tile_cols, & max_log2_tile_cols ) ; ones = cm -> log2_tile_cols - min_log2_tile_cols ; while ( ones -- )  vp9_wb_write_bit ( wb, 1 ) ; <START_BUG> if ( cm -> log2_tile_cols < max_log2_tile_cols ) <END_BUG> vp9_wb_write_bit ( wb, 0 ) ;  <START_BUG> vp9_wb_write_bit ( wb, cm -> log2_tile_rows!= 0 ) ; <END_BUG> if ( cm -> log2_tile_rows!= 0 )  vp9_wb_write_bit ( wb, cm -> log2_tile_rows!= 1 ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> void write_tile_info ( const VP9_COMMON * const <S2SV_ModEnd> cm, struct <S2SV_ModStart> cm, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> ones -- ) vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> < max_log2_tile_cols ) vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> 0 ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart>!= 0 ) vpx_wb_write_bit <S2SV_ModEnd> ( wb,
Buggy code:
 static struct prog_entry * predicate_parse ( const char * str, int nr_parens, int nr_preds, parse_pred_fn parse_pred, void * data, struct filter_parse_error * pe ) { struct prog_entry * prog_stack ; struct prog_entry * prog ; const char * ptr = str ; char * inverts = NULL ; int * op_stack ; int * top ; int invert = 0 ; int ret = - ENOMEM ; int len ; int N = 0 ; int i ; nr_preds += 2 ; op_stack = kmalloc_array ( nr_parens, sizeof ( * op_stack ), GFP_KERNEL ) ; if (! op_stack ) return ERR_PTR ( - ENOMEM ) ; prog_stack = kmalloc_array ( nr_preds, sizeof ( * prog_stack ), GFP_KERNEL ) ; if (! prog_stack ) { parse_error ( pe, - ENOMEM, 0 ) ; goto out_free ; } inverts = kmalloc_array ( nr_preds, sizeof ( * inverts ), GFP_KERNEL ) ; if (! inverts ) { parse_error ( pe, - ENOMEM, 0 ) ; goto out_free ; } top = op_stack ; prog = prog_stack ; * top = 0 ; while ( * ptr ) { const char * next = ptr ++ ; if ( isspace ( * next ) ) continue ; switch ( * next ) { case '(' : if ( top - op_stack > nr_parens ) return ERR_PTR ( - EINVAL ) ; * ( ++ top ) = invert ; continue ; case '!' : if (! is_not ( next ) ) break ; invert =! invert ; continue ; } if ( N >= nr_preds ) { parse_error ( pe, FILT_ERR_TOO_MANY_PREDS, next - str ) ; goto out_free ; } inverts [ N ] = invert ; prog [ N ]. target = N - 1 ; len = parse_pred ( next, data, ptr - str, pe, & prog [ N ]. pred ) ; if ( len < 0 ) { ret = len ; goto out_free ; } ptr = next + len ; N ++ ; ret = - 1 ; while (

Fix:
<S2SV_ModStart> out_free ; } if (! N ) { ret = - EINVAL ; parse_error ( pe, FILT_ERR_NO_FILTER, ptr - str ) ; goto out_free ; }