nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> void jslTokenAsString ( int token, char * str, size_t len ) { <END_BUG> if ( token > 32 && token < 128 ) { assert ( len >= 4 ) ; str [ 0 ] = '\\'' ; str [ 1 ] = ( char ) token ; str [ 2 ] = '\\'' ; str [ 3 ] = 0 ; return ; } switch ( token ) {  case LEX_EOF : strncpy ( str, "EOF", len ) ; return ; <START_BUG> <END_BUG> case LEX_ID : strncpy ( str, "ID", len ) ; return ;  <START_BUG> case LEX_INT : strncpy ( str, "INT", len ) ; return ; <END_BUG>  case LEX_FLOAT : strncpy ( str, "FLOAT", len ) ; return ; <START_BUG> <END_BUG> case LEX_STR : strncpy ( str, "STRING", len ) ; return ;  <START_BUG> case LEX_UNFINISHED_STR : strncpy ( str, "UNFINISHED   STRING", len ) ; return ; <END_BUG>  case LEX_TEMPLATE_LITERAL : strncpy ( str, "TEMPLATE   LITERAL", len ) ; return ; <START_BUG> <END_BUG> case LEX_UNFINISHED_TEMPLATE_LITERAL : strncpy ( str, "UNFINISHED   TEMPLATE   LITERAL", len ) ; return ;  <START_BUG> case LEX_REGEX : strncpy ( str, "REGEX", len ) ; return ; <END_BUG>  case LEX_UNFINISHED_REGEX : strncpy ( str, "UNFINISHED   REGEX", len ) ; return ; <START_BUG> <END_BUG> case LEX_UNFINISHED_COMMENT : strncpy ( str, "UNFINISHED   COMMENT", len ) ; return ;  } if ( token >= _LEX_OPERATOR_START && token < _LEX_R_LIST_END ) { const char tokenNames [ ] = "==\\0" "===\\0" "!=\\0" "!==\\0" "<=\\0" "<<\\0" "<<=\\0" ">=\\0" ">>\\0" ">>>\\0" ">>=\\0" ">>>=\\0" "+=\\0" "-=\\0" "++\\0" "--\\0" "*=\\0" "//=\\0" "%=\\0" "&=\\0

Fix:
<S2SV_ModStart> len ) { assert ( len > 28 ) ; <S2SV_ModStart> case LEX_EOF : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "EOF" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_ID : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "ID" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_INT : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "INT" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_FLOAT : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "FLOAT" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_STR : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "STRING" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_UNFINISHED_STR : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "UNFINISHED <S2SV_blank> STRING" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_TEMPLATE_LITERAL : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "TEMPLATE <S2SV_blank> LITERAL" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_UNFINISHED_TEMPLATE_LITERAL : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "UNFINISHED <S2SV_blank> TEMPLATE <S2SV_blank> LITERAL" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case LEX_REGEX : strcpy <S2SV_ModEnd> ( str, <S2SV_ModStart> str, "REGEX" <S2SV_ModEnd> ) ; return <S2SV_ModStart> case L
Buggy code:
 void addReply ( redisClient * c, robj * obj ) { if ( _installWriteEvent ( c )!= REDIS_OK ) return ; <START_BUG> redisAssert (! server. vm_enabled || obj -> storage == REDIS_VM_MEMORY ) ; <END_BUG> if ( obj -> encoding == REDIS_ENCODING_RAW ) { if ( _addReplyToBuffer ( c, obj -> ptr, sdslen ( obj -> ptr ) )!= REDIS_OK ) _addReplyObjectToList ( c, obj ) ; } else { obj = getDecodedObject ( obj ) ; if ( _addReplyToBuffer ( c, obj -> ptr, sdslen ( obj -> ptr ) )!= REDIS_OK ) _addReplyObjectToList ( c, obj ) ; decrRefCount ( obj ) ; } }

Fix:
<S2SV_ModStart>! server. ds_enabled <S2SV_ModEnd> || obj ->
Buggy code:
 int vp9_rc_clamp_pframe_target_size ( const VP9_COMP * const cpi, int target ) { const RATE_CONTROL * rc = & cpi -> rc ; <START_BUG> const int min_frame_target = MAX ( rc -> min_frame_bandwidth, <END_BUG>  rc -> av_per_frame_bandwidth >> 5 ) ; <START_BUG> if ( target < min_frame_target ) target = min_frame_target ; if ( cpi -> refresh_golden_frame && rc -> is_src_frame_alt_ref ) { target = min_frame_target ; } if ( target > rc -> max_frame_bandwidth ) target = rc -> max_frame_bandwidth ; <END_BUG> return target ;  }

Fix:
<S2SV_ModStart> rc ; const VP9EncoderConfig * oxcf = & cpi -> oxcf ; const <S2SV_ModStart>, rc -> avg_frame_bandwidth <S2SV_ModEnd> >> 5 ) <S2SV_ModStart> -> max_frame_bandwidth ; if ( oxcf -> rc_max_inter_bitrate_pct ) { const int max_rate = rc -> avg_frame_bandwidth * oxcf -> rc_max_inter_bitrate_pct // 100 ; target = MIN ( target, max_rate ) ; }
Buggy code:
 void init_util ( void ) { filegen_register ( statsdir, "peerstats", & peerstats ) ; filegen_register ( statsdir, "loopstats", & loopstats ) ; filegen_register ( statsdir, "clockstats", & clockstats ) ; filegen_register ( statsdir, "rawstats", & rawstats ) ; filegen_register ( statsdir, "sysstats", & sysstats ) ; filegen_register ( statsdir, "protostats", & protostats ) ; <START_BUG> # ifdef AUTOKEY <END_BUG> filegen_register ( statsdir, "cryptostats", & cryptostats ) ;  # endif <START_BUG> # ifdef DEBUG_TIMING filegen_register ( statsdir, "timingstats", & timingstats ) ; <END_BUG> # endif  step_callback = & ntpd_time_stepped ; # ifdef DEBUG atexit ( & uninit_util ) ; # endif }

Fix:
<S2SV_ModStart> protostats ) ; <S2SV_ModEnd> filegen_register ( statsdir <S2SV_ModStart> cryptostats ) ; <S2SV_ModEnd> filegen_register ( statsdir <S2SV_ModStart> timingstats ) ; <S2SV_ModEnd> step_callback = &
Buggy code:
 static int fr_add_pvc ( struct net_device * frad, unsigned int dlci, int type ) { hdlc_device * hdlc = dev_to_hdlc ( frad ) ; pvc_device * pvc ; struct net_device * dev ; int used ; if ( ( pvc = add_pvc ( frad, dlci ) ) == NULL ) { netdev_warn ( frad, "Memory   squeeze   on   fr_add_pvc()\\n" ) ; return - ENOBUFS ; } if ( * get_dev_p ( pvc, type ) ) return - EEXIST ; used = pvc_is_used ( pvc ) ; <START_BUG> if ( type == ARPHRD_ETHER ) <END_BUG> dev = alloc_netdev ( 0, "pvceth%d", ether_setup ) ;  else <START_BUG> dev = alloc_netdev ( 0, "pvc%d", pvc_setup ) ; if (! dev ) { netdev_warn ( frad, "Memory   squeeze   on   fr_pvc()\\n" ) ; delete_unused_pvcs ( hdlc ) ; return - ENOBUFS ; } if ( type == ARPHRD_ETHER ) random_ether_addr ( dev -> dev_addr ) ; else { * ( __be16 * ) dev -> dev_addr = htons ( dlci ) ; dlci_to_q922 ( dev -> broadcast, dlci ) ; } dev -> netdev_ops = & pvc_ops ; dev -> mtu = HDLC_MAX_MTU ; dev -> tx_queue_len = 0 ; dev -> ml_priv = pvc ; if ( register_netdevice ( dev )!= 0 ) { free_netdev ( dev ) ; delete_unused_pvcs ( hdlc ) ; return - EIO ; } dev -> destructor = free_netdev ; * get_dev_p ( pvc, type ) = dev ; if (! used ) { state ( hdlc ) -> dce_changed = 1 ; state ( hdlc ) -> dce_pvc_count ++ ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> == ARPHRD_ETHER ) { <S2SV_ModStart> ether_setup ) ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ; }
Buggy code:
 int oidc_handle_redirect_uri_request ( request_rec * r, oidc_cfg * c, oidc_session_t * session ) { if ( oidc_proto_is_redirect_authorization_response ( r, c ) ) { return oidc_handle_redirect_authorization_response ( r, c, session ) ; } else if ( oidc_proto_is_post_authorization_response ( r, c ) ) { return oidc_handle_post_authorization_response ( r, c, session ) ; } else if ( oidc_is_discovery_response ( r, c ) ) { return oidc_handle_discovery_response ( r, c ) ; } else if ( oidc_util_request_has_parameter ( r, "logout" ) ) { return oidc_handle_logout ( r, c, session ) ; } else if ( oidc_util_request_has_parameter ( r, "jwks" ) ) { return oidc_handle_jwks ( r, c ) ; } else if ( oidc_util_request_has_parameter ( r, "session" ) ) { return oidc_handle_session_management ( r, c, session ) ; } else if ( oidc_util_request_has_parameter ( r, "refresh" ) ) { return oidc_handle_refresh_token_request ( r, c, session ) ; } else if ( oidc_util_request_has_parameter ( r, "request_uri" ) ) { return oidc_handle_request_uri ( r, c ) ; } else if ( oidc_util_request_has_parameter ( r, "remove_at_cache" ) ) { return oidc_handle_remove_at_cache ( r, c ) ; } else if ( ( r -> args == NULL ) || ( apr_strnatcmp ( r -> args, "" ) == 0 ) ) { return oidc_proto_javascript_implicit ( r, c ) ; } if ( oidc_util_request_has_parameter ( r, "error" ) ) { oidc_handle_redirect_authorization_response ( r, c, session ) ; } return oidc_util_html_send_error ( r, c -> error_template, "Invalid   Request

Fix:
<S2SV_ModStart> -> pool, "The <S2SV_blank> OpenID <S2SV_blank> Connect <S2SV_blank> callback <S2SV_blank> URL <S2SV_blank> received <S2SV_blank> an <S2SV_blank> invalid <S2SV_blank> request" ), <S2SV_ModEnd> HTTP_INTERNAL_SERVER_ERROR ) ;
Buggy code:
 static int tcos_select_file ( sc_card_t * card, const sc_path_t * in_path, sc_file_t * * file_out ) { sc_context_t * ctx ; sc_apdu_t apdu ; sc_file_t * file = NULL ; u8 buf [ SC_MAX_APDU_BUFFER_SIZE ], pathbuf [ SC_MAX_PATH_SIZE ], * path = pathbuf ; unsigned int i ; int r, pathlen ; assert ( card!= NULL && in_path!= NULL ) ; ctx = card -> ctx ; memcpy ( path, in_path -> value, in_path -> len ) ; pathlen = in_path -> len ; sc_format_apdu ( card, & apdu, SC_APDU_CASE_4_SHORT, 0xA4, 0, 0x04 ) ; switch ( in_path -> type ) { case SC_PATH_TYPE_FILE_ID : if ( pathlen!= 2 ) return SC_ERROR_INVALID_ARGUMENTS ; case SC_PATH_TYPE_FROM_CURRENT : apdu. p1 = 9 ; break ; case SC_PATH_TYPE_DF_NAME : apdu. p1 = 4 ; break ; case SC_PATH_TYPE_PATH : apdu. p1 = 8 ; if ( pathlen >= 2 && memcmp ( path, "\\x3F\\x00", 2 ) == 0 ) path += 2, pathlen -= 2 ; if ( pathlen == 0 ) apdu. p1 = 0 ; break ; case SC_PATH_TYPE_PARENT : apdu. p1 = 3 ; pathlen = 0 ; break ; default : SC_FUNC_RETURN ( ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_ARGUMENTS ) ; } if ( pathlen == 0 ) apdu. cse = SC_APDU_CASE_2_SHORT ; apdu. lc = pathlen ; apdu. data = path ; apdu. datalen = pathlen ; if ( file_out!= NULL ) { apdu. resp = buf ; apdu. resplen = sizeof ( buf ) ; apdu. le = 256 ; } else { apdu. resplen = 0 ; apdu. le = 0 ; apdu. p2 = 0x0C ; apdu. cse = ( pathlen == 0 )? SC_APDU

Fix:
<S2SV_ModStart> ] ) { size_t <S2SV_ModEnd> j, len <S2SV_ModStart> case 0x84 : file -> namelen = MIN ( sizeof file -> name, len ) ; <S2SV_ModStart>, d, <S2SV_ModEnd> file -> namelen <S2SV_ModStart> file -> namelen ) <S2SV_ModEnd> ; break ;
Buggy code:
 int flush_completed_IO ( struct inode * inode ) { <START_BUG> ext4_io_end_t * io ; <END_BUG> int ret = 0 ; int ret2 = 0 ;  if ( list_empty ( & EXT4_I ( inode ) -> i_completed_io_list ) ) <START_BUG> return ret ; dump_completed_IO ( inode ) ; <END_BUG> while (! list_empty ( & EXT4_I ( inode ) -> i_completed_io_list ) ) {  <START_BUG> io = list_entry ( EXT4_I ( inode ) -> i_completed_io_list. next, <END_BUG> ext4_io_end_t, list ) ;  ret = ext4_end_io_nolock ( io ) ; <START_BUG> if ( ret < 0 ) ret2 = ret ; else list_del_init ( & io -> list ) ; } <END_BUG> return ( ret2 < 0 )? ret2 : 0 ;  }

Fix:
<S2SV_ModStart> ext4_io_end_t * io ; struct ext4_inode_info * ei = EXT4_I ( inode ) ; unsigned long flags <S2SV_ModStart> list_empty ( & ei <S2SV_ModEnd> -> i_completed_io_list ) <S2SV_ModStart> inode ) ; spin_lock_irqsave ( & ei -> i_completed_io_lock, flags ) ; <S2SV_ModStart> list_empty ( & ei <S2SV_ModEnd> -> i_completed_io_list ) <S2SV_ModStart> = list_entry ( ei <S2SV_ModEnd> -> i_completed_io_list. <S2SV_ModStart> list ) ; spin_unlock_irqrestore ( & ei -> i_completed_io_lock, flags ) ; <S2SV_ModStart> ext4_end_io_nolock ( io ) ; spin_lock_irqsave ( & ei -> i_completed_io_lock, flags <S2SV_ModStart> ) ; } spin_unlock_irqrestore ( & ei -> i_completed_io_lock, flags ) ;
Buggy code:
 static noinline void key_gc_unused_keys ( struct list_head * keys ) { while (! list_empty ( keys ) ) { struct key * key = list_entry ( keys -> next, struct key, graveyard_link ) ; <START_BUG> list_del ( & key -> graveyard_link ) ; <END_BUG> kdebug ( "-   %u", key -> serial ) ; key_check ( key ) ;  if ( test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) && <START_BUG>! test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) && key -> type -> destroy ) key -> type -> destroy ( key ) ; security_key_free ( key ) ; if ( test_bit ( KEY_FLAG_IN_QUOTA, & key -> flags ) ) { spin_lock ( & key -> user -> lock ) ; key -> user -> qnkeys -- ; key -> user -> qnbytes -= key -> quotalen ; spin_unlock ( & key -> user -> lock ) ; } atomic_dec ( & key -> user -> nkeys ) ; <END_BUG> if ( test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) )  atomic_dec ( & key -> user -> nikeys ) ; key_user_put ( key -> user ) ; kfree ( key -> description ) ; memzero_explicit ( key, sizeof ( * key ) ) ; kmem_cache_free ( key_jar, key ) ; } }

Fix:
<S2SV_ModStart> graveyard_link ) ; short state = key -> state ; <S2SV_ModStart> ; if ( state == KEY_IS_POSITIVE && <S2SV_ModEnd> key -> type <S2SV_ModStart> ; if ( state!= KEY_IS_UNINSTANTIATED <S2SV_ModEnd> ) atomic_dec (
Buggy code:
 static int br_mdb_fill_info ( struct sk_buff * skb, struct netlink_callback * cb, struct net_device * dev ) { struct net_bridge * br = netdev_priv ( dev ) ; struct net_bridge_mdb_htable * mdb ; struct nlattr * nest, * nest2 ; int i, err = 0 ; int idx = 0, s_idx = cb -> args [ 1 ] ; if ( br -> multicast_disabled ) return 0 ; mdb = rcu_dereference ( br -> mdb ) ; if (! mdb ) return 0 ; nest = nla_nest_start ( skb, MDBA_MDB ) ; if ( nest == NULL ) return - EMSGSIZE ; for ( i = 0 ; i < mdb -> max ; i ++ ) { struct net_bridge_mdb_entry * mp ; struct net_bridge_port_group * p, * * pp ; struct net_bridge_port * port ; hlist_for_each_entry_rcu ( mp, & mdb -> mhash [ i ], hlist [ mdb -> ver ] ) { if ( idx < s_idx ) goto skip ; nest2 = nla_nest_start ( skb, MDBA_MDB_ENTRY ) ; if ( nest2 == NULL ) { err = - EMSGSIZE ; goto out ; } for ( pp = & mp -> ports ; ( p = rcu_dereference ( * pp ) )!= NULL ; pp = & p -> next ) { port = p -> port ; if ( port ) { struct br_mdb_entry e ; <START_BUG> e. ifindex = port -> dev -> ifindex ; <END_BUG> e. state = p -> state ; if ( p -> addr. proto == htons ( ETH_P_IP ) ) e. addr. u. ip4 = p -> addr. u. ip4 ; # if IS_ENABLED ( CONFIG_IPV6 ) if ( p -> addr. proto == htons ( ETH_P_IPV6 ) ) e. addr. u. ip6 = p -> addr. u. ip6 ; # endif e. addr. proto = p -> addr. proto ; if ( nla_put ( skb, MDBA_MDB_ENTRY_INFO, sizeof ( e ), & e ) ) { nla_nest

Fix:
<S2SV_ModStart> br_mdb_entry e ; memset ( & e, 0, sizeof ( e ) ) ;
Buggy code:
 asmlinkage void bad_mode ( struct pt_regs * regs, int reason, unsigned int esr ) <START_BUG> { <END_BUG> console_verbose ( ) ; pr_crit ( "Bad   mode   in   %s   handler   detected,   code   0x%08x\\n", handler [ reason ], esr ) ;  die ( "Oops   -   bad   mode", regs, 0 ) ; <START_BUG> local_irq_disable ( ) ; panic ( "bad   mode" ) ; }<END_BUG>

Fix:
<S2SV_ModStart> esr ) { siginfo_t info ; void __user * pc = ( void __user * ) instruction_pointer ( regs ) ; <S2SV_ModStart> esr ) ; __show_regs ( regs ) ; info. si_signo = SIGILL ; info. si_errno = 0 ; info. si_code = ILL_ILLOPC ; info. si_addr = pc ; arm64_notify_die <S2SV_ModEnd> ( "Oops <S2SV_blank> - <S2SV_blank> bad <S2SV_blank> mode", <S2SV_ModStart>, regs, & info, 0 <S2SV_ModEnd> ) ; }
Buggy code:
 static void record_recent_object ( struct object * obj, <START_BUG> struct strbuf * path, <END_BUG>  const char * last, <START_BUG> void * data ) { sha1_array_append ( & recent_objects, obj -> oid. hash ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * obj, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name <S2SV_ModEnd>, void *
Buggy code:
 void vp9_set_segment_data ( struct segmentation * seg, signed char * feature_data, unsigned char abs_delta ) { seg -> abs_delta = abs_delta ; <START_BUG> vpx_memcpy ( seg -> feature_data, feature_data, sizeof ( seg -> feature_data ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> = abs_delta ; memcpy <S2SV_ModEnd> ( seg ->
Buggy code:
 static copyFunc pickCopyFunc ( TIFF * in, TIFF * out, uint16 bitspersample, uint16 samplesperpixel ) { uint16 shortv ; uint32 w, l, tw, tl ; int bychunk ; <START_BUG> ( void ) TIFFGetField ( in, TIFFTAG_PLANARCONFIG, & shortv ) ; <END_BUG> if ( shortv!= config && bitspersample!= 8 && samplesperpixel > 1 ) { fprintf ( stderr, "%s:   Cannot   handle   different   planar   configuration   w//   bits//sample  !=   8\\n", TIFFFileName ( in ) ) ; return ( NULL ) ; } TIFFGetField ( in, TIFFTAG_IMAGEWIDTH, & w ) ; TIFFGetField ( in, TIFFTAG_IMAGELENGTH, & l ) ; if (! ( TIFFIsTiled ( out ) || TIFFIsTiled ( in ) ) ) { uint32 irps = ( uint32 ) - 1L ; TIFFGetField ( in, TIFFTAG_ROWSPERSTRIP, & irps ) ; bychunk =! bias && ( rowsperstrip == irps ) ; } else { if ( bias ) { fprintf ( stderr, "%s:   Cannot   handle   tiled   configuration   w//bias   image\\n", TIFFFileName ( in ) ) ; return ( NULL ) ; } if ( TIFFIsTiled ( out ) ) { if (! TIFFGetField ( in, TIFFTAG_TILEWIDTH, & tw ) ) tw = w ; if (! TIFFGetField ( in, TIFFTAG_TILELENGTH, & tl ) ) tl = l ; bychunk = ( tw == tilewidth && tl == tilelength ) ; } else { TIFFGetField ( in, TIFFTAG_TILEWIDTH, & tw ) ; TIFFGetField ( in, TIFFTAG_TILELENGTH, & tl ) ; bychunk = ( tw == w && tl == rowsperstrip ) ; } } # define T 1 # define F 0 # define pack ( a, b, c, d, e ) ( ( long ) ( ( ( a ) << 11 ) | ( ( b ) << 3 ) | ( ( c ) << 2 ) | ( ( d ) << 1 ) | ( e ) ) ) switch ( pack ( shortv, config, TIFFIsTiled (

Fix:
<S2SV_ModStart> ( void ) TIFFGetFieldDefaulted <S2SV_ModEnd> ( in,
Buggy code:
 int cdf_read_property_info ( const cdf_stream_t * sst, const cdf_header_t * h, uint32_t offs, cdf_property_info_t * * info, size_t * count, size_t * maxcount ) { const cdf_section_header_t * shp ; cdf_section_header_t sh ; const uint8_t * p, * q, * e ; size_t i, o4, nelements, j, slen, left ; cdf_property_info_t * inp ; if ( offs > UINT32_MAX // 4 ) { errno = EFTYPE ; goto out ; } shp = CAST ( const cdf_section_header_t *, cdf_offset ( sst -> sst_tab, offs ) ) ; if ( cdf_check_stream_offset ( sst, h, shp, sizeof ( * shp ), __LINE__ ) == - 1 ) goto out ; sh. sh_len = CDF_TOLE4 ( shp -> sh_len ) ; if ( sh. sh_len > CDF_SHLEN_LIMIT ) { errno = EFTYPE ; goto out ; } if ( cdf_check_stream_offset ( sst, h, shp, sh. sh_len, __LINE__ ) == - 1 ) goto out ; sh. sh_properties = CDF_TOLE4 ( shp -> sh_properties ) ; DPRINTF ( ( "section   len:   %u   properties   %u\\n", sh. sh_len, sh. sh_properties ) ) ; if ( sh. sh_properties > CDF_PROP_LIMIT ) goto out ; inp = cdf_grow_info ( info, maxcount, sh. sh_properties ) ; if ( inp == NULL ) goto out ; inp += * count ; * count += sh. sh_properties ; p = CAST ( const uint8_t *, cdf_offset ( sst -> sst_tab, offs + sizeof ( sh ) ) ) ; e = CAST ( const uint8_t *, cdf_offset ( shp, sh. sh_len ) ) ; if ( p >= e || cdf_check_stream_offset ( sst, h, e, 0, __LINE__ ) == - 1 ) goto out ; for ( i = 0 ; i < sh. sh

Fix:
<S2SV_ModStart> if ( nelements > CDF_ELEMENT_LIMIT || nelements <S2SV_ModStart> DPRINTF ( ( "CDF_VECTOR <S2SV_blank> with <S2SV_blank> nelements <S2SV_blank> == <S2SV_blank> %" SIZE_T_FORMAT "u\\n", nelements <S2SV_ModEnd> ) ) ; <S2SV_ModStart> nelem ; } <S2SV_ModEnd> for ( j
Buggy code:
 struct bpf_map * bpf_map_get_with_uref ( u32 ufd ) { struct fd f = fdget ( ufd ) ; struct bpf_map * map ; map = __bpf_map_get ( f ) ; if ( IS_ERR ( map ) ) return map ; <START_BUG> bpf_map_inc ( map, true ) ; <END_BUG> fdput ( f ) ; return map ; }

Fix:
<S2SV_ModStart> return map ; map =
Buggy code:
 int sock_getsockopt ( struct socket * sock, int level, int optname, char __user * optval, int __user * optlen ) { struct sock * sk = sock -> sk ; union { int val ; struct linger ling ; struct timeval tm ; } v ; int lv = sizeof ( int ) ; int len ; if ( get_user ( len, optlen ) ) return - EFAULT ; if ( len < 0 ) return - EINVAL ; memset ( & v, 0, sizeof ( v ) ) ; switch ( optname ) { case SO_DEBUG : v. val = sock_flag ( sk, SOCK_DBG ) ; break ; case SO_DONTROUTE : v. val = sock_flag ( sk, SOCK_LOCALROUTE ) ; break ; case SO_BROADCAST : v. val =!! sock_flag ( sk, SOCK_BROADCAST ) ; break ; case SO_SNDBUF : v. val = sk -> sk_sndbuf ; break ; case SO_RCVBUF : v. val = sk -> sk_rcvbuf ; break ; case SO_REUSEADDR : v. val = sk -> sk_reuse ; break ; case SO_KEEPALIVE : v. val =!! sock_flag ( sk, SOCK_KEEPOPEN ) ; break ; case SO_TYPE : v. val = sk -> sk_type ; break ; case SO_PROTOCOL : v. val = sk -> sk_protocol ; break ; case SO_DOMAIN : v. val = sk -> sk_family ; break ; case SO_ERROR : v. val = - sock_error ( sk ) ; if ( v. val == 0 ) v. val = xchg ( & sk -> sk_err_soft, 0 ) ; break ; case SO_OOBINLINE : v. val =!! sock_flag ( sk, SOCK_URGINLINE ) ; break ; case SO_NO_CHECK : v. val = sk -> sk_no_check ; break ; case SO_PRIORITY : v. val = sk -> sk_priority ; break ; case SO_LINGER : lv = sizeof ( v. ling ) ; v. ling. l_onoff =!! sock_flag ( sk, SOCK_LINGER ) ; v. ling. l_ling

Fix:
<S2SV_ModStart>. val =!! <S2SV_ModStart> -> flags ) <S2SV_ModEnd> ; break ; <S2SV_ModStart>. val =!! <S2SV_ModStart> -> flags ) <S2SV_ModEnd> ; break ;
Buggy code:
 static int lldp_private_8021_print ( netdissect_options * ndo, const u_char * tptr, u_int tlv_len ) { int subtype, hexdump = FALSE ; u_int sublen ; u_int tval ; <START_BUG> uint8_t i ; <END_BUG> if ( tlv_len < 4 ) { return hexdump ; } subtype = * ( tptr + 3 ) ; ND_PRINT ( ( ndo, "\\n\\t     %s   Subtype   (%u)", tok2str ( lldp_8021_subtype_values, "unknown", subtype ), subtype ) ) ; switch ( subtype ) { case LLDP_PRIVATE_8021_SUBTYPE_PORT_VLAN_ID : if ( tlv_len < 6 ) { return hexdump ; } ND_PRINT ( ( ndo, "\\n\\t         port   vlan   id   (PVID):   %u", EXTRACT_16BITS ( tptr + 4 ) ) ) ; break ; case LLDP_PRIVATE_8021_SUBTYPE_PROTOCOL_VLAN_ID : if ( tlv_len < 7 ) { return hexdump ; } ND_PRINT ( ( ndo, "\\n\\t         port   and   protocol   vlan   id   (PPVID):   %u,   flags   [%s]   (0x%02x)", EXTRACT_16BITS ( tptr + 5 ), bittok2str ( lldp_8021_port_protocol_id_values, "none", * ( tptr + 4 ) ), * ( tptr + 4 ) ) ) ; break ; case LLDP_PRIVATE_8021_SUBTYPE_VLAN_NAME : if ( tlv_len < 6 ) { return hexdump ; } ND_PRINT ( ( ndo, "\\n\\t         vlan   id   (VID):   %u", EXTRACT_16BITS ( tptr + 4 ) ) ) ; if ( tlv_len < 7 ) { return hexdump ; } sublen = * ( tptr + 6 ) ; if ( tlv_len < 7 + sublen ) { return hexdump ; } ND_PRINT ( ( ndo, "\\n\\t         vlan

Fix:
<S2SV_ModStart> u_int tval ; u_int <S2SV_ModEnd> i ; if <S2SV_ModStart> ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> Priority: <S2SV_blank> %u, <S2SV_blank> RES: <S2SV_blank> %u, <S2SV_blank> Sel: <S2SV_blank> %u, <S2SV_blank> Protocol <S2SV_blank> ID: <S2SV_blank> %u" <S2SV_ModEnd>, tval >> <S2SV_ModStart> & 0x07 ), <S2SV_ModEnd> EXTRACT_16BITS ( tptr
Buggy code:
 static int l2tp_ip6_bind ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sockaddr_l2tpip6 * addr = ( struct sockaddr_l2tpip6 * ) uaddr ; struct net * net = sock_net ( sk ) ; __be32 v4addr = 0 ; int addr_type ; int err ; <START_BUG> if (! sock_flag ( sk, SOCK_ZAPPED ) ) <END_BUG> return - EINVAL ; if ( addr -> l2tp_family!= AF_INET6 ) return - EINVAL ; if ( addr_len < sizeof ( * addr ) ) return - EINVAL ; addr_type = ipv6_addr_type ( & addr -> l2tp_addr ) ; if ( addr_type == IPV6_ADDR_MAPPED ) return - EADDRNOTAVAIL ; if ( addr_type & IPV6_ADDR_MULTICAST ) return - EADDRNOTAVAIL ; err = - EADDRINUSE ; read_lock_bh ( & l2tp_ip6_lock ) ; if ( __l2tp_ip6_bind_lookup ( net, & addr -> l2tp_addr, sk -> sk_bound_dev_if, addr -> l2tp_conn_id ) ) goto out_in_use ; read_unlock_bh ( & l2tp_ip6_lock ) ; lock_sock ( sk ) ; err = - EINVAL ;  if ( sk -> sk_state!= TCP_CLOSE ) <START_BUG> goto out_unlock ; rcu_read_lock ( ) ; if ( addr_type!= IPV6_ADDR_ANY ) { struct net_device * dev = NULL ; if ( addr_type & IPV6_ADDR_LINKLOCAL ) { if ( addr_len >= sizeof ( struct sockaddr_in6 ) && addr -> l2tp_scope_id ) { sk -> sk_bound_dev_if = addr -> l2tp_scope_id ; } if (! sk -> sk_bound_dev_if ) goto out_unlock_rcu ; err = - ENODEV ; dev = dev_get_by<END_BUG>

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> addr -> l2tp_family <S2SV_ModStart> ; if (! sock_flag ( sk, SOCK_ZAPPED ) ) goto out_unlock ; if (
Buggy code:
 int vp9_get_frame_buffer ( void * cb_priv, size_t min_size, vpx_codec_frame_buffer_t * fb ) { int i ; InternalFrameBufferList * const int_fb_list = ( InternalFrameBufferList * ) cb_priv ; if ( int_fb_list == NULL ) return - 1 ; for ( i = 0 ; i < int_fb_list -> num_internal_frame_buffers ; ++ i ) { if (! int_fb_list -> int_fb [ i ]. in_use ) break ; } if ( i == int_fb_list -> num_internal_frame_buffers ) return - 1 ; if ( int_fb_list -> int_fb [ i ]. size < min_size ) { int_fb_list -> int_fb [ i ]. data = ( uint8_t * ) vpx_realloc ( int_fb_list -> int_fb [ i ]. data, min_size ) ; if (! int_fb_list -> int_fb [ i ]. data ) return - 1 ; <START_BUG> int_fb_list -> int_fb [ i ]. size = min_size ; <END_BUG> } fb -> data = int_fb_list -> int_fb [ i ]. data ; fb -> size = int_fb_list -> int_fb [ i ]. size ; int_fb_list -> int_fb [ i ]. in_use = 1 ; fb -> priv = & int_fb_list -> int_fb [ i ] ; return 0 ; }

Fix:
<S2SV_ModStart> - 1 ; memset ( int_fb_list -> int_fb [ i ]. data, 0, min_size ) ;
Buggy code:
 static int ast_type_init ( PyObject * self, PyObject * args, PyObject * kw ) { <START_BUG> _Py_IDENTIFIER ( _fields ) ; <END_BUG> Py_ssize_t i, numfields = 0 ; int res = - 1 ; PyObject * key, * value, * fields ;  fields = _PyObject_GetAttrId ( ( PyObject * ) Py_TYPE ( self ), & PyId__fields ) ; <START_BUG> if (! fields ) PyErr_Clear ( ) ; if ( fields ) { numfields = PySequence_Size ( fields ) ; if ( numfields == - 1 ) goto cleanup ; } res = 0 ; <END_BUG> if ( PyTuple_GET_SIZE ( args ) > 0 ) {  if ( numfields!= PyTuple_GET_SIZE ( args ) ) { <START_BUG> PyErr_Format ( PyExc_TypeError, "%.400s   constructor   takes   %s" <END_BUG> "%zd   positional   argument%s",  Py_TYPE ( self ) -> tp_name, <START_BUG> numfields == 0? "" : "either   0   or   ", numfields, numfields == 1? "" : "s" ) ; res = - 1 ; goto cleanup ; } for ( i = 0 ; i < PyTuple_GET_SIZE ( args ) ; i ++ ) { PyObject * name = PySequence_GetItem ( fields, i ) ; if (! name ) { res = - 1 ; goto cleanup ; } res = PyObject_SetAttr ( self, name, PyTuple_GET_ITEM ( args, i ) ) ; Py_DECREF ( name ) ; if ( res < 0 ) goto cleanup ; } <END_BUG> }  if ( kw ) { i = 0 ; while ( PyDict_Next ( kw, & i, & key, & value ) ) { res = PyObject_SetAttr ( self, key, value ) ; if ( res < 0 ) goto cleanup ; } } cleanup : Py_XDECREF ( fields ) ; return res ; }

Fix:
<S2SV_ModStart> kw ) { <S2SV_ModEnd> Py_ssize_t i, <S2SV_ModStart> * fields ; if ( lookup_attr_id <S2SV_ModEnd> ( ( PyObject <S2SV_ModStart>, & PyId__fields, & fields ) < 0 ) { goto cleanup ; } <S2SV_ModEnd> if ( fields <S2SV_ModStart> ; if ( numfields < <S2SV_ModStart> ( args ) <S2SV_ModEnd> ) { PyErr_Format <S2SV_ModStart> ( PyExc_TypeError, "%.400s <S2SV_blank> constructor <S2SV_blank> takes <S2SV_blank> at <S2SV_blank> most <S2SV_blank> " <S2SV_ModEnd> "%zd <S2SV_blank> positional <S2SV_blank> argument%s", Py_TYPE <S2SV_ModStart> ) -> tp_name <S2SV_ModEnd>, numfields, <S2SV_ModStart> cleanup ; } <S2SV_ModEnd> if ( kw
Buggy code:
 static void wrap_lines_smart ( ASS_Renderer * render_priv, double max_text_width ) { int i ; GlyphInfo * cur, * s1, * e1, * s2, * s3 ; int last_space ; int break_type ; int exit ; double pen_shift_x ; double pen_shift_y ; int cur_line ; int run_offset ; TextInfo * text_info = & render_priv -> text_info ; last_space = - 1 ; text_info -> n_lines = 1 ; break_type = 0 ; s1 = text_info -> glyphs ; for ( i = 0 ; i < text_info -> length ; ++ i ) { int break_at = - 1 ; double s_offset, len ; cur = text_info -> glyphs + i ; s_offset = d6_to_double ( s1 -> bbox. xMin + s1 -> pos. x ) ; len = d6_to_double ( cur -> bbox. xMax + cur -> pos. x ) - s_offset ; if ( cur -> symbol == '\\n' ) { break_type = 2 ; break_at = i ; ass_msg ( render_priv -> library, MSGL_DBG2, "forced   line   break   at   %d", break_at ) ; } else if ( cur -> symbol ==' ') { last_space = i ; } else if ( len >= max_text_width && ( render_priv -> state. wrap_style!= 2 ) ) { break_type = 1 ; break_at = last_space ; if ( break_at >= 0 ) ass_msg ( render_priv -> library, MSGL_DBG2, "line   break   at   %d", break_at ) ; } if ( break_at!= - 1 ) { int lead = break_at + 1 ; if ( text_info -> n_lines >= text_info -> max_lines ) { text_info -> max_lines *= 2 ; text_info -> lines = realloc ( text_info -> lines, sizeof ( LineInfo ) * text_info -> max_lines ) ; } if ( lead < text_info -> length ) { text_info -> glyphs [ lead ]. linebreak = break_type ; last_space = - 1 ; s1 =

Fix:
<S2SV_ModStart> ) ) { if ( w -> linebreak || w == text_info -> glyphs ) text_info -> n_lines -- ; if ( w!= text_info -> glyphs )
Buggy code:
 static ssize_t __nfs4_get_acl_uncached ( struct inode * inode, void * buf, size_t buflen ) { struct page * pages [ NFS4ACL_MAXPAGES ] = { NULL, } ; struct nfs_getaclargs args = {. fh = NFS_FH ( inode ),. acl_pages = pages,. acl_len = buflen, } ; struct nfs_getaclres res = {. acl_len = buflen, } ; void * resp_buf ; struct rpc_message msg = {. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_GETACL ],. rpc_argp = & args,. rpc_resp = & res, } ; int ret = - ENOMEM, npages, i, acl_len = 0 ; npages = ( buflen + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; if ( npages == 0 ) npages = 1 ; for ( i = 0 ; i < npages ; i ++ ) { pages [ i ] = alloc_page ( GFP_KERNEL ) ; if (! pages [ i ] ) goto out_free ; } if ( npages > 1 ) { res. acl_scratch = alloc_page ( GFP_KERNEL ) ; if (! res. acl_scratch ) goto out_free ; } args. acl_len = npages * PAGE_SIZE ; args. acl_pgbase = 0 ; if ( buf == NULL ) res. acl_flags |= NFS4_ACL_LEN_REQUEST ; resp_buf = page_address ( pages [ 0 ] ) ; dprintk ( "%s     buf   %p   buflen   %zu   npages   %d   args.acl_len   %zu\\n", __func__, buf, buflen, npages, args. acl_len ) ; ret = nfs4_call_sync ( NFS_SERVER ( inode ) -> client, NFS_SERVER ( inode ), & msg, & args. seq_args, & res. seq_res, 0 ) ; if ( ret ) goto out_free ; acl_len = res. acl_len - res. acl_data_offset ; if ( acl_len > args. acl_len )

Fix:
<S2SV_ModStart>. acl_data_offset, <S2SV_ModEnd> acl_len ) ;
Buggy code:
 int btsock_thread_post_cmd ( int h, int type, const unsigned char * data, int size, uint32_t user_id ) { if ( h < 0 || h >= MAX_THREAD ) { APPL_TRACE_ERROR ( "invalid   bt   thread   handle:%d", h ) ; return FALSE ; } if ( ts [ h ]. cmd_fdw == - 1 ) { APPL_TRACE_ERROR ( "cmd   socket   is   not   created.   socket   thread   may   not   initialized" ) ; return FALSE ; } sock_cmd_t cmd = { CMD_USER_PRIVATE, 0, type, size, user_id } ; APPL_TRACE_DEBUG ( "post   cmd   type:%d,   size:%d,   h:%d,   ", type, size, h ) ; sock_cmd_t * cmd_send = & cmd ; int size_send = sizeof ( cmd ) ; if ( data && size ) { size_send = sizeof ( cmd ) + size ; cmd_send = ( sock_cmd_t * ) alloca ( size_send ) ; if ( cmd_send ) { * cmd_send = cmd ; memcpy ( cmd_send + 1, data, size ) ; } else { APPL_TRACE_ERROR ( "alloca   failed   at   h:%d,   cmd   type:%d,   size:%d", h, type, size_send ) ; return FALSE ; } } <START_BUG> return send ( ts [ h ]. cmd_fdw, cmd_send, size_send, 0 ) == size_send ; <END_BUG> }

Fix:
<S2SV_ModStart> } } return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 <START_BUG> static VALUE from_document ( VALUE klass, VALUE document ) <END_BUG> { xmlDocPtr doc ; xmlRelaxNGParserCtxtPtr ctx ; xmlRelaxNGPtr schema ; VALUE errors ; VALUE rb_schema ; Data_Get_Struct ( document, xmlDoc, doc ) ; doc = doc -> doc ; ctx = xmlRelaxNGNewDocParserCtxt ( doc ) ; errors = rb_ary_new ( ) ; xmlSetStructuredErrorFunc ( ( void * ) errors, Nokogiri_error_array_pusher ) ; # ifdef HAVE_XMLRELAXNGSETPARSERSTRUCTUREDERRORS xmlRelaxNGSetParserStructuredErrors ( ctx, Nokogiri_error_array_pusher, ( void * ) errors ) ; # endif schema = xmlRelaxNGParse ( ctx ) ; xmlSetStructuredErrorFunc ( NULL, NULL ) ; xmlRelaxNGFreeParserCtxt ( ctx ) ; if ( NULL == schema ) { xmlErrorPtr error = xmlGetLastError ( ) ; if ( error ) Nokogiri_error_raise ( NULL, error ) ; else rb_raise ( rb_eRuntimeError, "Could   not   parse   document" ) ; return Qnil ; } rb_schema = Data_Wrap_Struct ( klass, 0, dealloc, schema ) ; rb_iv_set ( rb_schema, "@errors", errors ) ;  return rb_schema ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> VALUE from_document ( int argc, VALUE * argv, VALUE klass ) { VALUE document ; VALUE parse_options ; xmlDocPtr doc ; xmlRelaxNGParserCtxtPtr ctx ; xmlRelaxNGPtr schema ; VALUE errors ; VALUE rb_schema ; int scanned_args = 0 ; scanned_args = rb_scan_args ( argc, argv, "11", & document, & parse_options ) ; Data_Get_Struct ( document, xmlDoc, doc ) ; doc = doc -> doc ; if ( scanned_args == 1 ) { parse_options = rb_const_get ( rb_const_get ( mNokogiriXml, rb_intern ( "ParseOptions" ) ), rb_intern ( "DEFAULT_SCHEMA" ) ) ; } <S2SV_ModEnd> ctx = xmlRelaxNGNewDocParserCtxt <S2SV_ModStart> errors ) ; rb_iv_set ( rb_schema, "@parse_options", parse_options ) ;
Buggy code:
 static EAS_RESULT PushcdlStack ( EAS_U32 * pStack, EAS_INT * pStackPtr, EAS_U32 value ) { <START_BUG> if ( * pStackPtr >= CDL_STACK_SIZE ) <END_BUG>  return EAS_ERROR_FILE_FORMAT ; <START_BUG> * pStackPtr = * pStackPtr + 1 ; pStack [ * pStackPtr ] = value ; return EAS_SUCCESS ; }<END_BUG>

Fix:
<S2SV_ModStart> * pStackPtr >= ( CDL_STACK_SIZE - 1 ) ) { ALOGE ( "b//34031018, <S2SV_blank> stackPtr(%d)", * pStackPtr ) ; android_errorWriteLog ( 0x534e4554, "34031018" ) ; <S2SV_ModEnd> return EAS_ERROR_FILE_FORMAT ; <S2SV_ModStart> return EAS_ERROR_FILE_FORMAT ; }
Buggy code:
 static int cdrom_ioctl_drive_status ( struct cdrom_device_info * cdi, unsigned long arg ) { cd_dbg ( CD_DO_IOCTL, "entering   CDROM_DRIVE_STATUS\\n" ) ; if (! ( cdi -> ops -> capability & CDC_DRIVE_STATUS ) ) return - ENOSYS ; if (! CDROM_CAN ( CDC_SELECT_DISC ) || ( arg == CDSL_CURRENT || arg == CDSL_NONE ) ) return cdi -> ops -> drive_status ( cdi, CDSL_CURRENT ) ; <START_BUG> if ( ( ( int ) arg >= cdi -> capacity ) ) <END_BUG> return - EINVAL ; return cdrom_slot_status ( cdi, arg ) ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> arg >= cdi <S2SV_ModStart> cdi -> capacity <S2SV_ModEnd> ) return -
Buggy code:
 static void rfbProcessClientNormalMessage ( rfbClientPtr cl ) { int n ; rfbClientToServerMsg msg ; char * str ; READ ( ( char * ) & msg, 1 ) switch ( msg. type ) { case rfbSetPixelFormat : READ ( ( ( char * ) & msg ) + 1, sz_rfbSetPixelFormatMsg - 1 ) cl -> format. bitsPerPixel = msg. spf. format. bitsPerPixel ; cl -> format. depth = msg. spf. format. depth ; cl -> format. bigEndian = ( msg. spf. format. bigEndian? 1 : 0 ) ; cl -> format. trueColour = ( msg. spf. format. trueColour? 1 : 0 ) ; cl -> format. redMax = Swap16IfLE ( msg. spf. format. redMax ) ; cl -> format. greenMax = Swap16IfLE ( msg. spf. format. greenMax ) ; cl -> format. blueMax = Swap16IfLE ( msg. spf. format. blueMax ) ; cl -> format. redShift = msg. spf. format. redShift ; cl -> format. greenShift = msg. spf. format. greenShift ; cl -> format. blueShift = msg. spf. format. blueShift ; cl -> readyForSetColourMapEntries = TRUE ; rfbSetTranslateFunction ( cl ) ; return ; case rfbFixColourMapEntries : READ ( ( ( char * ) & msg ) + 1, sz_rfbFixColourMapEntriesMsg - 1 ) rfbLog ( "rfbProcessClientNormalMessage:   FixColourMapEntries   unsupported\\n" ) ; rfbCloseClient ( cl ) ; return ; case rfbSetEncodings : { int i ; CARD32 enc ; Bool firstFence =! cl -> enableFence ; Bool firstCU =! cl -> enableCU ; Bool firstGII =! cl -> enableGII ; Bool logTightCompressLevel = FALSE ; READ ( ( ( char * ) & msg ) + 1, sz_rfbSetEncodingsMsg - 1 ) msg. se. nEncodings = Swap16IfLE ( msg. se. nEncodings ) ; cl -> preferredEncoding = - 1 ; cl -> useCopyRect = FALSE ; cl -> enableCursorShapeUpdates = FALSE ; cl -> enableCursorPosUpdates

Fix:
<S2SV_ModStart> flags ) ; <S2SV_ModEnd> if ( msg <S2SV_ModStart> data ) ) { <S2SV_ModStart> length ) ; SKIP ( msg. f. length ) } else { READ ( data, msg. f. length ) <S2SV_ModEnd> HandleFence ( cl <S2SV_ModStart> data ) ; }
Buggy code:
 static void ComputePrincipleComponent ( const float * covariance, DDSVector3 * principle ) { DDSVector4 row0, row1, row2, v ; register ssize_t i ; row0. x = covariance [ 0 ] ; row0. y = covariance [ 1 ] ; row0. z = covariance [ 2 ] ; row0. w = 0.0f ; row1. x = covariance [ 1 ] ; row1. y = covariance [ 3 ] ; row1. z = covariance [ 4 ] ; row1. w = 0.0f ; row2. x = covariance [ 2 ] ; row2. y = covariance [ 4 ] ; row2. z = covariance [ 5 ] ; row2. w = 0.0f ; VectorInit ( v, 1.0f ) ; for ( i = 0 ; i < 8 ; i ++ ) { DDSVector4 w ; float a ; w. x = row0. x * v. x ; w. y = row0. y * v. x ; w. z = row0. z * v. x ; w. w = row0. w * v. x ; w. x = ( row1. x * v. y ) + w. x ; w. y = ( row1. y * v. y ) + w. y ; w. z = ( row1. z * v. y ) + w. z ; w. w = ( row1. w * v. y ) + w. w ; w. x = ( row2. x * v. z ) + w. x ; w. y = ( row2. y * v. z ) + w. y ; w. z = ( row2. z * v. z ) + w. z ; w. w = ( row2. w * v. z ) + w. w ; <START_BUG> a = 1.0f // MaxF ( w. x, MaxF ( w. y, w. z ) ) ; <END_BUG> v. x = w. x * a ; v. y = w. y * a ; v. z = w. z * a ; v. w = w. w * a ; } VectorCopy43 ( v, principle ) ; }

Fix:
<S2SV_ModStart> = 1.0f // MagickMax ( w. x, MagickMax <S2SV_ModEnd> ( w.
Buggy code:
 void dm9000EventHandler ( NetInterface * interface ) { error_t error ; uint8_t status ; <START_BUG> status = dm9000ReadReg ( DM9000_REG_ISR ) ; <END_BUG> if ( ( status & ISR_LNKCHG )!= 0 ) {  dm9000WriteReg ( DM9000_REG_ISR, ISR_LNKCHG ) ; <START_BUG> <END_BUG> status = dm9000ReadReg ( DM9000_REG_NSR ) ;  if ( ( status & NSR_LINKST )!= 0 ) { if ( ( status & NSR_SPEED )!= 0 ) { interface -> linkSpeed = NIC_LINK_SPEED_10MBPS ; } else { interface -> linkSpeed = NIC_LINK_SPEED_100MBPS ; } <START_BUG> status = dm9000ReadReg ( DM9000_REG_NCR ) ; <END_BUG> if ( ( status & NCR_FDX )!= 0 ) { interface -> duplexMode = NIC_FULL_DUPLEX_MODE ; } else { interface -> duplexMode = NIC_HALF_DUPLEX_MODE ; } interface -> linkState = TRUE ; } else { interface -> linkState = FALSE ; } nicNotifyLinkChange ( interface ) ; }  if ( ( status & ISR_PR )!= 0 ) <START_BUG> { <END_BUG> dm9000WriteReg ( DM9000_REG_ISR, ISR_PR ) ;  do { error = dm9000ReceivePacket ( interface ) ; } while ( error!= ERROR_BUFFER_EMPTY ) ; } <START_BUG> dm9000WriteReg ( DM9000_REG_IMR, IMR_PAR | IMR_LNKCHGI | IMR_PTI | IMR_PRI ) ; <END_BUG> }

Fix:
<S2SV_ModStart> = dm9000ReadReg ( DM9000_ISR ) ; if ( ( status & DM9000_ISR_LNKCHG <S2SV_ModEnd> )!= 0 <S2SV_ModStart> { dm9000WriteReg ( DM9000_ISR, DM9000_ISR_LNKCHG <S2SV_ModEnd> ) ; status <S2SV_ModStart> = dm9000ReadReg ( DM9000_NSR ) ; if ( ( status & DM9000_NSR_LINKST )!= 0 ) { if ( ( status & DM9000_NSR_SPEED <S2SV_ModEnd> )!= 0 <S2SV_ModStart> = dm9000ReadReg ( DM9000_NCR ) ; if ( ( status & DM9000_NCR_FDX <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( status & DM9000_ISR_PR <S2SV_ModEnd> )!= 0 <S2SV_ModStart> { dm9000WriteReg ( DM9000_ISR, DM9000_ISR_PR <S2SV_ModEnd> ) ; do <S2SV_ModStart> } dm9000WriteReg ( DM9000_IMR, DM9000_IMR_PAR | DM9000_IMR_LNKCHGI | DM9000_IMR_PTI | DM9000_IMR_PRI <S2SV_ModEnd>
Buggy code:
 jas_matrix_t * jas_matrix_create ( int numrows, int numcols ) { jas_matrix_t * matrix ; int i ; <START_BUG> if (! ( matrix = jas_malloc ( sizeof ( jas_matrix_t ) ) ) ) { <END_BUG> return 0 ; } matrix -> flags_ = 0 ; matrix -> numrows_ = numrows ; matrix -> numcols_ = numcols ; matrix -> rows_ = 0 ; matrix -> maxrows_ = numrows ; matrix -> data_ = 0 ; matrix -> datasize_ = numrows * numcols ; if ( matrix -> maxrows_ > 0 ) { if (! ( matrix -> rows_ = jas_alloc2 ( matrix -> maxrows_, sizeof ( jas_seqent_t * ) ) ) ) { jas_matrix_destroy ( matrix ) ; return 0 ; } } if ( matrix -> datasize_ > 0 ) { if (! ( matrix -> data_ = jas_alloc2 ( matrix -> datasize_, sizeof ( jas_seqent_t ) ) ) ) { jas_matrix_destroy ( matrix ) ; return 0 ; } } for ( i = 0 ; i < numrows ; ++ i ) { matrix -> rows_ [ i ] = & matrix -> data_ [ i * matrix -> numcols_ ] ; } for ( i = 0 ; i < matrix -> datasize_ ; ++ i ) { matrix -> data_ [ i ] = 0 ; } matrix -> xstart_ = 0 ; matrix -> ystart_ = 0 ; matrix -> xend_ = matrix -> numcols_ ; matrix -> yend_ = matrix -> numrows_ ; return matrix ; }

Fix:
<S2SV_ModStart> ; if ( numrows < 0 || numcols < 0 ) { return 0 ; } if (
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_ext_data ( dec_state_t * ps_dec ) { stream_t * ps_stream ; UWORD32 u4_start_code ; IMPEG2D_ERROR_CODES_T e_error ; e_error = ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE ; ps_stream = & ps_dec -> s_bit_stream ; u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; while ( ( u4_start_code == EXTENSION_START_CODE || u4_start_code == USER_DATA_START_CODE ) && <START_BUG> ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE == e_error ) <END_BUG> { if ( u4_start_code == USER_DATA_START_CODE ) { impeg2d_dec_user_data ( ps_dec ) ; } else { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, EXT_ID_LEN ) ; switch ( u4_start_code ) { case SEQ_DISPLAY_EXT_ID : impeg2d_dec_seq_disp_ext ( ps_dec ) ; break ; case SEQ_SCALABLE_EXT_ID : e_error = IMPEG2D_SCALABILITIY_NOT_SUPPORTED ; break ; default : impeg2d_bit_stream_flush ( ps_stream, EXT_ID_LEN ) ; impeg2d_peek_next_start_code ( ps_dec ) ; break ; } } u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; } return e_error ; }

Fix:
<S2SV_ModStart> IVD_ERROR_NONE == e_error && ( ps_stream -> u4_offset < ps_stream -> u4_max_offset )
Buggy code:
 ExprDef * ExprAppendMultiKeysymList ( ExprDef * expr, ExprDef * append ) { unsigned nSyms = darray_size ( expr -> keysym_list. syms ) ; unsigned numEntries = darray_size ( append -> keysym_list. syms ) ; darray_append ( expr -> keysym_list. symsMapIndex, nSyms ) ; darray_append ( expr -> keysym_list. symsNumEntries, numEntries ) ; darray_concat ( expr -> keysym_list. syms, append -> keysym_list. syms ) ; <START_BUG> FreeStmt ( ( ParseCommon * ) & append ) ; <END_BUG> return expr ; }

Fix:
<S2SV_ModStart> ParseCommon * ) <S2SV_ModEnd> append ) ;
Buggy code:
 void open_log_file ( const char * name, const char * prog, const char * namespace, const char * instance ) { char * file_name ; if ( log_file ) { fclose ( log_file ) ; log_file = NULL ; } if (! name ) return ; file_name = make_file_name ( name, prog, namespace, instance ) ; <START_BUG> log_file = fopen ( file_name, "a" ) ; <END_BUG> if ( log_file ) { int n = fileno ( log_file ) ; fcntl ( n, F_SETFD, FD_CLOEXEC | fcntl ( n, F_GETFD ) ) ; fcntl ( n, F_SETFL, O_NONBLOCK | fcntl ( n, F_GETFL ) ) ; } FREE ( file_name ) ; }

Fix:
<S2SV_ModStart> ; log_file = fopen_safe <S2SV_ModEnd> ( file_name,
Buggy code:
 error_t httpClientSetUri ( HttpClientContext * context, const char_t * uri ) { size_t m ; size_t n ; char_t * p ; char_t * q ; if ( context == NULL || uri == NULL ) return ERROR_INVALID_PARAMETER ; if ( uri [ 0 ] == '\\0' ) return ERROR_INVALID_PARAMETER ; if ( context -> requestState!= HTTP_REQ_STATE_FORMAT_HEADER ) return ERROR_WRONG_STATE ; if ( context -> bufferLen > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_INVALID_SYNTAX ; context -> buffer [ context -> bufferLen ] = '\\0' ; <START_BUG> p = strchr ( context -> buffer,' ') ; <END_BUG> if ( p == NULL ) return ERROR_INVALID_SYNTAX ; p ++ ; q = strpbrk ( p, "  ?" ) ; if ( q == NULL ) return ERROR_INVALID_SYNTAX ; m = q - p ; n = osStrlen ( uri ) ; if ( ( context -> bufferLen + n - m ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; osMemmove ( p + n, q, context -> buffer + context -> bufferLen + 1 - q ) ; osStrncpy ( p, uri, n ) ; context -> bufferLen = context -> bufferLen + n - m ; return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; p = osStrchr <S2SV_ModEnd> ( context ->
Buggy code:
 int verify_compat_iovec ( struct msghdr * kern_msg, struct iovec * kern_iov, struct sockaddr_storage * kern_address, int mode ) { int tot_len ; if ( kern_msg -> msg_namelen ) { if ( mode == VERIFY_READ ) { int err = move_addr_to_kernel ( kern_msg -> msg_name, kern_msg -> msg_namelen, kern_address ) ; if ( err < 0 ) return err ; } <START_BUG> kern_msg -> msg_name = kern_address ; <END_BUG> } else kern_msg -> msg_name = NULL ; tot_len = iov_from_user_compat_to_kern ( kern_iov, ( struct compat_iovec __user * ) kern_msg -> msg_iov, kern_msg -> msg_iovlen ) ; if ( tot_len >= 0 ) kern_msg -> msg_iov = kern_iov ; return tot_len ; }

Fix:
<S2SV_ModStart> err ; } if ( kern_msg -> msg_name )
Buggy code:
 static void oz_usb_handle_ep_data ( struct oz_usb_ctx * usb_ctx, struct oz_usb_hdr * usb_hdr, int len ) { struct oz_data * data_hdr = ( struct oz_data * ) usb_hdr ; switch ( data_hdr -> format ) { case OZ_DATA_F_MULTIPLE_FIXED : { struct oz_multiple_fixed * body = ( struct oz_multiple_fixed * ) data_hdr ; u8 * data = body -> data ; <START_BUG> int n ; <END_BUG>  if (! body -> unit_size ) <START_BUG> break ; <END_BUG> n = ( len - sizeof ( struct oz_multiple_fixed ) + 1 )  // body -> unit_size ; while ( n -- ) { oz_hcd_data_ind ( usb_ctx -> hport, body -> endpoint, data, body -> unit_size ) ; data += body -> unit_size ; } } break ; case OZ_DATA_F_ISOC_FIXED : { struct oz_isoc_fixed * body = ( struct oz_isoc_fixed * ) data_hdr ; int data_len = len - sizeof ( struct oz_isoc_fixed ) + 1 ; int unit_size = body -> unit_size ; u8 * data = body -> data ; int count ; int i ; if (! unit_size ) break ; count = data_len // unit_size ; for ( i = 0 ; i < count ; i ++ ) { oz_hcd_data_ind ( usb_ctx -> hport, body -> endpoint, data, unit_size ) ; data += unit_size ; } } break ; } }

Fix:
<S2SV_ModStart> -> data ; unsigned <S2SV_ModStart> body -> unit_size || len < sizeof ( struct oz_multiple_fixed ) - 1 <S2SV_ModStart> ( len - ( <S2SV_ModStart> struct oz_multiple_fixed ) - 1 ) <S2SV_ModEnd> ) // body
Buggy code:
 static int set_vt_partitioning ( VP9_COMP * cpi, <START_BUG> void * data, <END_BUG>  const TileInfo * const tile, <START_BUG> BLOCK_SIZE bsize, int mi_row, int mi_col, <END_BUG> int mi_size ) {  VP9_COMMON * const cm = & cpi -> common ; variance_node vt ; const int block_width = num_8x8_blocks_wide_lookup [ bsize ] ; const int block_height = num_8x8_blocks_high_lookup [ bsize ] ; <START_BUG> const int64_t threshold_multiplier = 25 ; <END_BUG> int64_t threshold = threshold_multiplier * cpi -> common. base_qindex ; assert ( block_height == block_width ) ; tree_to_node ( data, bsize, & vt ) ;  if ( mi_col + block_width // 2 < cm -> mi_cols && <START_BUG> mi_row + block_height // 2 < cm -> mi_rows && vt. part_variances -> none. variance < threshold ) { <END_BUG> set_block_size ( cpi, tile, mi_row, mi_col, bsize ) ;  return 1 ; } if ( mi_row + block_height // 2 < cm -> mi_rows && <START_BUG> vt. part_variances -> vert [ 0 ]. variance < threshold && <END_BUG> vt. part_variances -> vert [ 1 ]. variance < threshold ) { BLOCK_SIZE subsize = get_subsize ( bsize, PARTITION_VERT ) ;  set_block_size ( cpi, tile, mi_row, mi_col, subsize ) ; <START_BUG> <END_BUG> set_block_size ( cpi, tile, mi_row, mi_col + block_width // 2, subsize ) ;  return 1 ; } <START_BUG> if ( mi_col + block_width // 2 < cm -> mi_cols && <END_BUG> vt. part_variances -> horz [ 0 ]. variance < threshold && vt. part_variances -> horz [ 1 ]. variance < threshold ) { BLOCK_SIZE subsize = get_subsize ( bsize, PARTITION_HORZ ) ;  set_block_size ( cpi, tile, mi_row, mi_col, subsize ) ; <START_BUG> <END_BUG> set_block_size ( cpi, tile,

Fix:
<S2SV_ModStart> * cpi, MACROBLOCK * const x, MACROBLOCKD * const xd, <S2SV_ModStart> * data, <S2SV_ModEnd> BLOCK_SIZE bsize, <S2SV_ModStart> int mi_col, int64_t threshold, BLOCK_SIZE bsize_min, int force_split <S2SV_ModEnd> ) { VP9_COMMON <S2SV_ModStart> ] ; const int low_res = ( cm -> width <= 352 && cm -> height <= 288 ) <S2SV_ModEnd> ; assert ( <S2SV_ModStart> ; if ( force_split == 1 ) return 0 ; if ( bsize == bsize_min ) { if ( low_res || cm -> frame_type == KEY_FRAME ) get_variance ( & vt. part_variances -> none ) ; if ( <S2SV_ModStart> ( cpi, x, xd, mi_row, mi_col, bsize ) ; return 1 ; } return 0 ; } else if ( bsize > bsize_min ) { if ( low_res || cm -> frame_type == KEY_FRAME ) get_variance ( & vt. part_variances -> none ) ; if ( cm -> frame_type == KEY_FRAME && ( bsize > BLOCK_32X32 || vt. part_variances -> none. variance >
Buggy code:
 extern int onig_new_deluxe ( regex_t * * reg, const UChar * pattern, const UChar * pattern_end, OnigCompileInfo * ci, OnigErrorInfo * einfo ) { int r ; UChar * cpat, * cpat_end ; if ( IS_NOT_NULL ( einfo ) ) einfo -> par = ( UChar * ) NULL ; if ( ci -> pattern_enc!= ci -> target_enc ) { <START_BUG> r = conv_encoding ( ci -> pattern_enc, ci -> target_enc, pattern, pattern_end, <END_BUG> & cpat, & cpat_end ) ; if ( r!= 0 ) return r ; } else { cpat = ( UChar * ) pattern ; cpat_end = ( UChar * ) pattern_end ; } * reg = ( regex_t * ) xmalloc ( sizeof ( regex_t ) ) ; if ( IS_NULL ( * reg ) ) { r = ONIGERR_MEMORY ; goto err2 ; } r = onig_reg_init ( * reg, ci -> option, ci -> case_fold_flag, ci -> target_enc, ci -> syntax ) ; if ( r!= 0 ) goto err ; r = onig_compile ( * reg, cpat, cpat_end, einfo ) ; if ( r!= 0 ) { err : onig_free ( * reg ) ; * reg = NULL ; } err2 : if ( cpat!= pattern ) xfree ( cpat ) ; return r ; }

Fix:
<S2SV_ModStart> target_enc ) { return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION <S2SV_ModEnd> ; } else