nus-yam/ex-repair huggingface dataset:
Buggy code:
 WORD32 ihevcd_create ( iv_obj_t * ps_codec_obj, void * pv_api_ip, void * pv_api_op ) { <START_BUG> ihevcd_cxa_create_op_t * ps_create_op ; <END_BUG> WORD32 ret ; codec_t * ps_codec ;  ps_create_op = ( ihevcd_cxa_create_op_t * ) pv_api_op ; <START_BUG> ps_create_op -> s_ivd_create_op_t. u4_error_code = 0 ; <END_BUG> ret = ihevcd_allocate_static_bufs ( & ps_codec_obj, pv_api_ip, pv_api_op ) ;  <START_BUG> if ( ( IV_FAIL == ret ) && ( NULL!= ps_codec_obj ) ) <END_BUG> {  ihevcd_free_static_bufs ( ps_codec_obj ) ; <START_BUG> ps_create_op -> s_ivd_create_op_t. u4_error_code = IVD_MEM_ALLOC_FAILED ; ps_create_op -> s_ivd_create_op_t. u4_error_code = 1 << IVD_FATALERROR ; return IV_FAIL ; } ps_codec = ( codec_t * ) ps_codec_obj -> pv_codec_handle ; ret = ihevcd_init ( ps_codec ) ; TRACE_INIT ( NULL ) ; STATS_INIT ( ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> pv_api_op ) { ihevcd_cxa_create_ip_t * ps_create_ip ; <S2SV_ModStart> * ps_codec ; ps_create_ip = ( ihevcd_cxa_create_ip_t * ) pv_api_ip ; <S2SV_ModStart> = 0 ; ps_codec_obj = NULL ; <S2SV_ModStart> ) ; if <S2SV_ModEnd> ( IV_FAIL == <S2SV_ModStart> == ret ) { if <S2SV_ModEnd> ( NULL!= <S2SV_ModStart>!= ps_codec_obj ) { if ( ps_codec_obj -> pv_codec_handle <S2SV_ModStart> ps_codec_obj ) ; } else { void ( * pf_aligned_free ) ( void * pv_mem_ctxt, void * pv_buf ) ; void * pv_mem_ctxt ; pf_aligned_free = ps_create_ip -> s_ivd_create_ip_t. pf_aligned_free ; pv_mem_ctxt = ps_create_ip -> s_ivd_create_ip_t. pv_mem_ctxt ; pf_aligned_free ( pv_mem_ctxt, ps_codec_obj ) ; } }
Buggy code:
 static bool ldm_frag_add ( const u8 * data, int size, struct list_head * frags ) { struct frag * f ; struct list_head * item ; int rec, num, group ; BUG_ON (! data ||! frags ) ; if ( size < 2 * VBLK_SIZE_HEAD ) { ldm_error ( "Value   of   size   is   to   small." ) ; return false ; } group = get_unaligned_be32 ( data + 0x08 ) ; rec = get_unaligned_be16 ( data + 0x0C ) ; num = get_unaligned_be16 ( data + 0x0E ) ; if ( ( num < 1 ) || ( num > 4 ) ) { ldm_error ( "A   VBLK   claims   to   have   %d   parts.", num ) ; return false ; } if ( rec >= num ) { ldm_error ( "REC   value   (%d)   exceeds   NUM   value   (%d)", rec, num ) ; return false ; } list_for_each ( item, frags ) { f = list_entry ( item, struct frag, list ) ; if ( f -> group == group ) goto found ; } f = kmalloc ( sizeof ( * f ) + size * num, GFP_KERNEL ) ; if (! f ) { ldm_crit ( "Out   of   memory." ) ; return false ; } f -> group = group ; f -> num = num ; f -> rec = rec ; f -> map = 0xFF << num ; list_add_tail ( & f -> list, frags ) ; found : <START_BUG> if ( f -> map & ( 1 << rec ) ) { <END_BUG> ldm_error ( "Duplicate   VBLK,   part   %d.", rec ) ; f -> map &= 0x7F ; return false ; } f -> map |= ( 1 << rec ) ; data += VBLK_SIZE_HEAD ; size -= VBLK_SIZE_HEAD ; memcpy ( f -> data + rec * ( size - VBLK_SIZE_HEAD ) + VBLK_SIZE_HEAD, data, size ) ; return true ; }

Fix:
<S2SV_ModStart> : if ( rec >= f -> num ) { ldm_error ( "REC <S2SV_blank> value <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> NUM <S2SV_blank> value <S2SV_blank> (%d)", rec, f -> num ) ; return false ; } if (
Buggy code:
 static int nghttp2_session_upgrade_internal ( nghttp2_session * session, const uint8_t * settings_payload, size_t settings_payloadlen, void * stream_user_data ) { nghttp2_stream * stream ; nghttp2_frame frame ; nghttp2_settings_entry * iv ; size_t niv ; int rv ; nghttp2_priority_spec pri_spec ; nghttp2_mem * mem ; mem = & session -> mem ; if ( (! session -> server && session -> next_stream_id!= 1 ) || ( session -> server && session -> last_recv_stream_id >= 1 ) ) { return NGHTTP2_ERR_PROTO ; } if ( settings_payloadlen % NGHTTP2_FRAME_SETTINGS_ENTRY_LENGTH ) { <START_BUG> return NGHTTP2_ERR_INVALID_ARGUMENT ; <END_BUG> } rv = nghttp2_frame_unpack_settings_payload2 ( & iv, & niv, settings_payload, settings_payloadlen, mem ) ; if ( rv!= 0 ) { return rv ; } if ( session -> server ) { nghttp2_frame_hd_init ( & frame. hd, settings_payloadlen, NGHTTP2_SETTINGS, NGHTTP2_FLAG_NONE, 0 ) ; frame. settings. iv = iv ; frame. settings. niv = niv ; rv = nghttp2_session_on_settings_received ( session, & frame, 1 ) ; } else { rv = nghttp2_submit_settings ( session, NGHTTP2_FLAG_NONE, iv, niv ) ; } nghttp2_mem_free ( mem, iv ) ; if ( rv!= 0 ) { return rv ; } nghttp2_priority_spec_default_init ( & pri_spec ) ; stream = nghttp2_session_open_stream ( session, 1, NGHTTP2_STREAM_FLAG_NONE, & pri_spec, NGHTTP2_STREAM_OPENING, session -> server? NULL : stream_user_data ) ; if ( stream == NULL ) { return NGHTTP2_ERR_NOMEM ; } if ( session -> server ) { nghttp2_stream_shutdown ( stream, NGHTTP2_SHUT_RD ) ; session -> last_recv_stream_

Fix:
<S2SV_ModStart> { return NGHTTP2_ERR_INVALID_ARGUMENT ; } if ( settings_payloadlen // NGHTTP2_FRAME_SETTINGS_ENTRY_LENGTH > session -> max_settings ) { return NGHTTP2_ERR_TOO_MANY_SETTINGS
Buggy code:
 inline int web_client_api_request_v1_data ( RRDHOST * host, struct web_client * w, char * url ) { debug ( D_WEB_CLIENT, "%llu:   API   v1   data   with   URL   \'%s\'", w -> id, url ) ; int ret = 400 ; BUFFER * dimensions = NULL ; buffer_flush ( w -> response. data ) ; char * google_version = "0.6", * google_reqId = "0", * google_sig = "0", * google_out = "json", * responseHandler = NULL, * outFileName = NULL ; time_t last_timestamp_in_data = 0, google_timestamp = 0 ; char * chart = NULL, * before_str = NULL, * after_str = NULL, * group_time_str = NULL, * points_str = NULL ; int group = RRDR_GROUPING_AVERAGE ; uint32_t format = DATASOURCE_JSON ; uint32_t options = 0x00000000 ; while ( url ) { char * value = mystrsep ( & url, "?&" ) ; if (! value ||! * value ) continue ; char * name = mystrsep ( & value, "=" ) ; if (! name ||! * name ) continue ; if (! value ||! * value ) continue ; debug ( D_WEB_CLIENT, "%llu:   API   v1   data   query   param   \'%s\'   with   value   \'%s\'", w -> id, name, value ) ; if (! strcmp ( name, "chart" ) ) chart = value ; else if (! strcmp ( name, "dimension" ) ||! strcmp ( name, "dim" ) ||! strcmp ( name, "dimensions" ) ||! strcmp ( name, "dims" ) ) { if (! dimensions ) dimensions = buffer_create ( 100 ) ; buffer_strcat ( dimensions, "|" ) ; buffer_strcat ( dimensions, value ) ; } else if (! strcmp ( name, "after" ) ) after_str = value ; else if (! strcmp ( name, "before" ) ) before_str = value ; else if (! strcmp ( name, "points" ) ) points_str = value ; else if (

Fix:
<S2SV_ModStart> } } } fix_google_param ( google_out ) ; fix_google_param ( google_sig ) ; fix_google_param ( google_reqId ) ; fix_google_param ( google_version ) ; fix_google_param ( responseHandler ) ; fix_google_param ( outFileName ) ;
Buggy code:
 int main ( int argc, char * * argv ) { int frame_cnt = 0 ; FILE * outfile = NULL ; vpx_codec_ctx_t codec ; const VpxInterface * decoder = NULL ; VpxVideoReader * reader = NULL ; const VpxVideoInfo * info = NULL ; int n = 0 ; int m = 0 ; int is_range = 0 ; char * nptr = NULL ; exec_name = argv [ 0 ] ; if ( argc!= 4 ) die ( "Invalid   number   of   arguments." ) ; reader = vpx_video_reader_open ( argv [ 1 ] ) ; if (! reader ) die ( "Failed   to   open   %s   for   reading.", argv [ 1 ] ) ; if (! ( outfile = fopen ( argv [ 2 ], "wb" ) ) ) die ( "Failed   to   open   %s   for   writing.", argv [ 2 ] ) ; n = strtol ( argv [ 3 ], & nptr, 0 ) ; m = strtol ( nptr + 1, NULL, 0 ) ; is_range = ( * nptr == '-' ) ; if (! n ||! m || ( * nptr!= '-' && * nptr!= '//' ) ) die ( "Couldn\'t   parse   pattern   %s.\\n", argv [ 3 ] ) ; info = vpx_video_reader_get_info ( reader ) ; decoder = get_vpx_decoder_by_fourcc ( info -> codec_fourcc ) ; if (! decoder ) die ( "Unknown   input   codec." ) ; <START_BUG> printf ( "Using   %s\\n", vpx_codec_iface_name ( decoder -> interface ( ) ) ) ; <END_BUG>  if ( vpx_codec_dec_init ( & codec, decoder -> interface ( ), NULL, 0 ) ) <START_BUG> die_codec ( & codec, "Failed   to   initialize   decoder." ) ; while ( vpx_video_reader_read_frame ( reader ) ) { vpx_codec_iter_t iter = NULL ; vpx_image_t * img = NULL ; size_t frame_size = 0 ; int skip ; const unsigned char * frame = vpx_video_reader_get_frame ( reader, & frame_size ) ; if ( v<END_BUG>

Fix:
<S2SV_ModStart> ( decoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart>, decoder -> codec_interface <S2SV_ModEnd> ( ),
Buggy code:
 void jas_matrix_divpow2 ( jas_matrix_t * matrix, int n ) { <START_BUG> int i ; <END_BUG> int j ; jas_seqent_t * rowstart ;  int rowstep ; <START_BUG> jas_seqent_t * data ; if ( jas_matrix_numrows ( matrix ) > 0 && jas_matrix_numcols ( matrix ) > 0 ) { assert ( matrix -> rows_ ) ; rowstep = jas_matrix_rowstep ( matrix ) ; for ( i = matrix -> numrows_, rowstart = matrix -> rows_ [ 0 ] ; i > 0 ; -- i, rowstart += rowstep ) { for ( j = matrix -> numcols_, data = rowstart ; j > 0 ; -- j, ++ data ) { * data = ( * data >= 0 )? ( ( * data ) >> n ) : ( - ( ( - ( * data ) ) >> n ) ) ; } } } }<END_BUG>

Fix:
<S2SV_ModStart> n ) { jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; jas_seqent_t <S2SV_ModStart> * rowstart ; jas_matind_t <S2SV_ModEnd> rowstep ; jas_seqent_t
Buggy code:
 static int tower_probe ( struct usb_interface * interface, const struct usb_device_id * id ) { struct device * idev = & interface -> dev ; struct usb_device * udev = interface_to_usbdev ( interface ) ; struct lego_usb_tower * dev = NULL ; struct usb_host_interface * iface_desc ; struct usb_endpoint_descriptor * endpoint ; struct tower_get_version_reply get_version_reply ; int i ; int retval = - ENOMEM ; int result ; dev = kmalloc ( sizeof ( struct lego_usb_tower ), GFP_KERNEL ) ; if (! dev ) goto exit ; mutex_init ( & dev -> lock ) ; dev -> udev = udev ; dev -> open_count = 0 ; dev -> read_buffer = NULL ; dev -> read_buffer_length = 0 ; dev -> read_packet_length = 0 ; spin_lock_init ( & dev -> read_buffer_lock ) ; dev -> packet_timeout_jiffies = msecs_to_jiffies ( packet_timeout ) ; dev -> read_last_arrival = jiffies ; init_waitqueue_head ( & dev -> read_wait ) ; init_waitqueue_head ( & dev -> write_wait ) ; dev -> interrupt_in_buffer = NULL ; dev -> interrupt_in_endpoint = NULL ; dev -> interrupt_in_urb = NULL ; dev -> interrupt_in_running = 0 ; dev -> interrupt_in_done = 0 ; dev -> interrupt_out_buffer = NULL ; dev -> interrupt_out_endpoint = NULL ; dev -> interrupt_out_urb = NULL ; dev -> interrupt_out_busy = 0 ; iface_desc = interface -> cur_altsetting ; for ( i = 0 ; i < iface_desc -> desc. bNumEndpoints ; ++ i ) { endpoint = & iface_desc -> endpoint [ i ]. desc ; if ( usb_endpoint_xfer_int ( endpoint ) ) { if ( usb_endpoint_dir_in ( endpoint ) ) dev -> interrupt_in_endpoint = endpoint ; else dev -> interrupt_out_endpoint = endpoint ; } } if ( dev -> interrupt_in_endpoint == NULL ) { dev_err ( idev, "interrupt   in   endpoint   not   found\\n

Fix:
<S2SV_ModStart> -> bInterval ; <S2SV_ModEnd> result = usb_control_msg <S2SV_ModStart> ) ) ; usb_set_intfdata ( interface, dev ) ; retval = usb_register_dev ( interface, & tower_class ) ; if ( retval ) { dev_err ( idev, "Not <S2SV_blank> able <S2SV_blank> to <S2SV_blank> get <S2SV_blank> a <S2SV_blank> minor <S2SV_blank> for <S2SV_blank> this <S2SV_blank> device.\\n" ) ; usb_set_intfdata ( interface, NULL ) ; goto error ; } dev -> minor = interface -> minor ; dev_info ( & interface -> dev, "LEGO <S2SV_blank> USB <S2SV_blank> Tower <S2SV_blank> #%d <S2SV_blank> now <S2SV_blank> attached <S2SV_blank> to <S2SV_blank> major <S2SV_blank> " "%d <S2SV_blank> minor <S2SV_blank> %d\\n", ( dev -> minor - LEGO_USB_TOWER_MINOR_BASE ), USB_MAJOR, dev -> minor ) ;
Buggy code:
 static bool nested_vmx_exit_handled ( struct kvm_vcpu * vcpu ) { u32 intr_info = vmcs_read32 ( VM_EXIT_INTR_INFO ) ; struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; struct vmcs12 * vmcs12 = get_vmcs12 ( vcpu ) ; u32 exit_reason = vmx -> exit_reason ; if ( vmx -> nested. nested_run_pending ) return 0 ; if ( unlikely ( vmx -> fail ) ) { pr_info_ratelimited ( "%s   failed   vm   entry   %x\\n", __func__, vmcs_read32 ( VM_INSTRUCTION_ERROR ) ) ; return 1 ; } switch ( exit_reason ) { case EXIT_REASON_EXCEPTION_NMI : if (! is_exception ( intr_info ) ) return 0 ; else if ( is_page_fault ( intr_info ) ) return enable_ept ; return vmcs12 -> exception_bitmap & ( 1u << ( intr_info & INTR_INFO_VECTOR_MASK ) ) ; case EXIT_REASON_EXTERNAL_INTERRUPT : return 0 ; case EXIT_REASON_TRIPLE_FAULT : return 1 ; case EXIT_REASON_PENDING_INTERRUPT : return nested_cpu_has ( vmcs12, CPU_BASED_VIRTUAL_INTR_PENDING ) ; case EXIT_REASON_NMI_WINDOW : return nested_cpu_has ( vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING ) ; case EXIT_REASON_TASK_SWITCH : return 1 ; case EXIT_REASON_CPUID : return 1 ; case EXIT_REASON_HLT : return nested_cpu_has ( vmcs12, CPU_BASED_HLT_EXITING ) ; case EXIT_REASON_INVD : return 1 ; case EXIT_REASON_INVLPG : return nested_cpu_has ( vmcs12, CPU_BASED_INVLPG_EXITING ) ; case EXIT_REASON_RDPMC : return nested_cpu_has ( vmcs12, CPU_BASED_RDPMC_EXITING ) ; case EXIT_REASON_RDTSC : return nested

Fix:
<S2SV_ModStart> case EXIT_REASON_VMON : case EXIT_REASON_INVEPT :
Buggy code:
 WORD32 ih264d_process_intra_mb ( dec_struct_t * ps_dec, dec_mb_info_t * ps_cur_mb_info, UWORD8 u1_mb_num ) { UWORD8 u1_mb_type = ps_cur_mb_info -> u1_mb_type ; UWORD8 uc_temp = ps_cur_mb_info -> u1_mb_ngbr_availablity ; UWORD8 u1_top_available = BOOLEAN ( uc_temp & TOP_MB_AVAILABLE_MASK ) ; UWORD8 u1_left_available = BOOLEAN ( uc_temp & LEFT_MB_AVAILABLE_MASK ) ; UWORD8 u1_use_top_right_mb = BOOLEAN ( uc_temp & TOP_RIGHT_MB_AVAILABLE_MASK ) ; UWORD8 u1_use_top_left_mb = BOOLEAN ( uc_temp & TOP_LEFT_MB_AVAILABLE_MASK ) ; UWORD8 uc_useTopMB = u1_top_available ; UWORD16 u2_use_left_mb = u1_left_available ; UWORD16 u2_use_left_mb_pack ; UWORD8 * pu1_luma_pred_buffer ; UWORD8 * pu1_luma_rec_buffer ; UWORD8 * puc_top ; mb_neigbour_params_t * ps_left_mb ; mb_neigbour_params_t * ps_top_mb ; mb_neigbour_params_t * ps_top_right_mb ; mb_neigbour_params_t * ps_curmb ; UWORD16 u2_mbx = ps_cur_mb_info -> u2_mbx ; UWORD32 ui_pred_width, ui_rec_width ; WORD16 * pi2_y_coeff ; UWORD8 u1_mbaff, u1_topmb, u1_mb_field_decoding_flag ; UWORD32 u4_num_pmbair ; UWORD16 ui2_luma_csbp = ps_cur_mb_info -> u2_luma_csbp ; UWORD8 * pu1_yleft, * pu1_ytop

Fix:
<S2SV_ModStart> ) ; } i1_intra_pred = CLIP3 ( 0, 8, i1_intra_pred ) ; <S2SV_ModStart> ) ; } i1_intra_pred = CLIP3 ( 0, 8, i1_intra_pred ) ;
Buggy code:
 static netdev_tx_t hns_nic_net_xmit ( struct sk_buff * skb, struct net_device * ndev ) { struct hns_nic_priv * priv = netdev_priv ( ndev ) ; <START_BUG> int ret ; <END_BUG> assert ( skb -> queue_mapping < ndev -> ae_handle -> q_num ) ;  ret = hns_nic_net_xmit_hw ( ndev, skb, <START_BUG> & tx_ring_data ( priv, skb -> queue_mapping ) ) ; <END_BUG> if ( ret == NETDEV_TX_OK ) {  netif_trans_update ( ndev ) ; ndev -> stats. tx_bytes += skb -> len ; ndev -> stats. tx_packets ++ ; } return ( netdev_tx_t ) ret ; }

Fix:
<S2SV_ModStart> ndev ) ; <S2SV_ModEnd> assert ( skb <S2SV_ModStart> q_num ) ; return <S2SV_ModEnd> hns_nic_net_xmit_hw ( ndev <S2SV_ModStart> ) ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 ssize_t cdf_read_sector ( const cdf_info_t * info, void * buf, size_t offs, size_t len, const cdf_header_t * h, cdf_secid_t id ) { <START_BUG> assert ( ( size_t ) CDF_SEC_SIZE ( h ) == len ) ; <END_BUG>  return cdf_read ( info, ( off_t ) CDF_SEC_POS ( h, id ), <START_BUG> ( ( char * ) buf ) + offs, len ) ; }<END_BUG>

Fix:
<S2SV_ModStart> id ) { size_t ss = <S2SV_ModEnd> CDF_SEC_SIZE ( h <S2SV_ModStart> ( h ) ; size_t pos = CDF_SEC_POS ( h, id ) ; assert ( ss <S2SV_ModStart> ( off_t ) pos, <S2SV_ModEnd> ( ( char
Buggy code:
 <START_BUG> static int update_mv ( vp9_writer * w, const unsigned int ct [ 2 ], vp9_prob * cur_p, <END_BUG>  vp9_prob upd_p ) { <START_BUG> <END_BUG> const vp9_prob new_p = get_binary_prob ( ct [ 0 ], ct [ 1 ] ) | 1 ;  const int update = cost_branch256 ( ct, * cur_p ) + vp9_cost_zero ( upd_p ) > cost_branch256 ( ct, new_p ) + vp9_cost_one ( upd_p ) + 7 * 256 ; <START_BUG> vp9_write ( w, update, upd_p ) ; <END_BUG> if ( update ) { * cur_p = new_p ;  vp9_write_literal ( w, new_p >> 1, 7 ) ; <START_BUG> } return update ; }<END_BUG>

Fix:
<S2SV_ModStart> int update_mv ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> 2 ], vpx_prob <S2SV_ModEnd> * cur_p, <S2SV_ModStart> * cur_p, vpx_prob <S2SV_ModEnd> upd_p ) { <S2SV_ModStart> ) { const vpx_prob <S2SV_ModEnd> new_p = get_binary_prob <S2SV_ModStart> * 256 ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> = new_p ; vpx_write_literal <S2SV_ModEnd> ( w,
Buggy code:
 static void * zend_mm_realloc_heap ( zend_mm_heap * heap, void * ptr, size_t size, size_t copy_size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC ) { size_t page_offset ; size_t old_size ; size_t new_size ; void * ret ; # if ZEND_DEBUG size_t real_size ; zend_mm_debug_info * dbg ; # endif page_offset = ZEND_MM_ALIGNED_OFFSET ( ptr, ZEND_MM_CHUNK_SIZE ) ; if ( UNEXPECTED ( page_offset == 0 ) ) { if ( UNEXPECTED ( ptr == NULL ) ) { return zend_mm_alloc_heap ( heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC ) ; } old_size = zend_mm_get_huge_block_size ( heap, ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC ) ; # if ZEND_DEBUG real_size = size ; size = ZEND_MM_ALIGNED_SIZE ( size ) + ZEND_MM_ALIGNED_SIZE ( sizeof ( zend_mm_debug_info ) ) ; # endif if ( size > ZEND_MM_MAX_LARGE_SIZE ) { # if ZEND_DEBUG size = real_size ; # endif # ifdef ZEND_WIN32 new_size = ZEND_MM_ALIGNED_SIZE_EX ( size, MAX ( REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE ) ) ; # else new_size = ZEND_MM_ALIGNED_SIZE_EX ( size, REAL_PAGE_SIZE ) ; # endif if ( new_size == old_size ) { # if ZEND_DEBUG zend_mm_change_huge_block_size ( heap, ptr, new_size, real_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC ) ; # else zend_mm_change_huge_block_size ( heap, ptr, new_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG

Fix:
<S2SV_ModStart> { int old_bin_num <S2SV_ModEnd> = ZEND_MM_SRUN_BIN_NUM ( <S2SV_ModStart> old_bin_num ] ; if ( size <= ZEND_MM_MAX_SMALL_SIZE ) { int <S2SV_ModStart> return ptr ; }
Buggy code:
 int dns_packet_is_reply_for ( DnsPacket * p, const DnsResourceKey * key ) { int r ; assert ( p ) ; assert ( key ) ; if ( DNS_PACKET_QR ( p )!= 1 ) return 0 ; r = dns_packet_extract ( p ) ; if ( r < 0 ) return r ; <START_BUG> if ( p -> question -> n_keys!= 1 ) <END_BUG> return 0 ; return dns_resource_key_equal ( p -> question -> keys [ 0 ], key ) ; }

Fix:
<S2SV_ModStart> ; if (! p -> question ) return 0 ; if (
Buggy code:
 static void print_trans ( netdissect_options * ndo, const u_char * words, const u_char * data1, const u_char * buf, const u_char * maxbuf ) { u_int bcc ; const char * f1, * f2, * f3, * f4 ; const u_char * data, * param ; const u_char * w = words + 1 ; int datalen, paramlen ; if ( request ) { ND_TCHECK2 ( w [ 12 * 2 ], 2 ) ; paramlen = EXTRACT_LE_16BITS ( w + 9 * 2 ) ; param = buf + EXTRACT_LE_16BITS ( w + 10 * 2 ) ; datalen = EXTRACT_LE_16BITS ( w + 11 * 2 ) ; data = buf + EXTRACT_LE_16BITS ( w + 12 * 2 ) ; f1 = "TotParamCnt=[d]   \\nTotDataCnt=[d]   \\nMaxParmCnt=[d]   \\nMaxDataCnt=[d]\\nMaxSCnt=[d]   \\nTransFlags=[w]   \\nRes1=[w]   \\nRes2=[w]   \\nRes3=[w]\\nParamCnt=[d]   \\nParamOff=[d]   \\nDataCnt=[d]   \\nDataOff=[d]   \\nSUCnt=[d]\\n" ; f2 = "|Name=[S]\\n" ; f3 = "|Param   " ; f4 = "|Data   " ; } else { ND_TCHECK2 ( w [ 7 * 2 ], 2 ) ; paramlen = EXTRACT_LE_16BITS ( w + 3 * 2 ) ; param = buf + EXTRACT_LE_16BITS ( w + 4 * 2 ) ; datalen = EXTRACT_LE_16BITS ( w + 6 * 2 ) ; data = buf + EXTRACT_LE_16BITS ( w + 7 * 2 ) ; f1 = "TotParamCnt=[d]   \\nTotDataCnt=[d]   \\nRes1=[d]\\nParamCnt=[d]   \\nParamOff=[d]   \\nRes2=[d]   \\nDataCnt=[d]   \\nDataOff=[d]   \\nRes3

Fix:
<S2SV_ModStart> unicodestr ) ; # define MAILSLOT_BROWSE_STR "\\\\MAILSLOT\\\\BROWSE" ND_TCHECK2 ( * ( data1 + 2 ), strlen ( MAILSLOT_BROWSE_STR ) + 1 ) ; <S2SV_ModStart> 2 ), MAILSLOT_BROWSE_STR <S2SV_ModEnd> ) == 0 <S2SV_ModStart> return ; } # undef MAILSLOT_BROWSE_STR # define PIPE_LANMAN_STR "\\\\PIPE\\\\LANMAN" ND_TCHECK2 ( * ( data1 + 2 ), strlen ( PIPE_LANMAN_STR ) + 1 ) ; <S2SV_ModStart> 2 ), PIPE_LANMAN_STR <S2SV_ModEnd> ) == 0 <S2SV_ModStart> return ; } # undef PIPE_LANMAN_STR
Buggy code:
 void vrrp_print_json ( void ) { FILE * file ; element e ; struct json_object * array ; if ( LIST_ISEMPTY ( vrrp_data -> vrrp ) ) return ; <START_BUG> file = fopen ( "//tmp//keepalived.json", "w" ) ; <END_BUG> if (! file ) { log_message ( LOG_INFO, "Can\'t   open   //tmp//keepalived.json   (%d:   %s)", errno, strerror ( errno ) ) ; return ; } array = json_object_new_array ( ) ; for ( e = LIST_HEAD ( vrrp_data -> vrrp ) ; e ; ELEMENT_NEXT ( e ) ) { struct json_object * instance_json, * json_stats, * json_data, * vips, * evips, * track_ifp, * track_script ; # ifdef _HAVE_FIB_ROUTING_ struct json_object * vroutes, * vrules ; # endif element f ; vrrp_t * vrrp = ELEMENT_DATA ( e ) ; instance_json = json_object_new_object ( ) ; json_stats = json_object_new_object ( ) ; json_data = json_object_new_object ( ) ; vips = json_object_new_array ( ) ; evips = json_object_new_array ( ) ; track_ifp = json_object_new_array ( ) ; track_script = json_object_new_array ( ) ; # ifdef _HAVE_FIB_ROUTING_ vroutes = json_object_new_array ( ) ; vrules = json_object_new_array ( ) ; # endif json_object_object_add ( json_data, "iname", json_object_new_string ( vrrp -> iname ) ) ; json_object_object_add ( json_data, "dont_track_primary", json_object_new_int ( vrrp -> dont_track_primary ) ) ; json_object_object_add ( json_data, "skip_check_adv_addr", json_object_new_int ( vrrp -> skip_check_adv_addr ) ) ;

Fix:
<S2SV_ModStart> ; file = fopen_safe <S2SV_ModEnd> ( "//tmp//keepalived.json",
Buggy code:
 <START_BUG> static void <END_BUG> horAcc32 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; uint32 * wp = ( uint32 * ) cp0 ; tmsize_t wc = cc // 4 ;  assert ( ( cc % ( 4 * stride ) ) == 0 ) ; <START_BUG> if ( wc > stride ) { wc -= stride ; do { REPEAT4 ( stride, wp [ stride ] += wp [ 0 ] ; wp ++ ) wc -= stride ; } while ( wc > 0 ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> horAcc32 ( TIFF <S2SV_ModStart> // 4 ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> stride ) )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "horAcc32", "%s", "cc%(4*stride))!=0" ) ; return 0 ; } <S2SV_ModEnd> if ( wc <S2SV_ModStart> ) ; } return 1 ;
Buggy code:
 static int crypto_report_acomp ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_acomp racomp ; <START_BUG> strlcpy ( racomp. type, "acomp", sizeof ( racomp. type ) ) ; <END_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_ACOMP, sizeof ( struct crypto_report_acomp ), & racomp ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_acomp racomp ; strncpy <S2SV_ModEnd> ( racomp.
Buggy code:
 <START_BUG> void vp9_rc_init ( const VP9_CONFIG * oxcf, int pass, RATE_CONTROL * rc ) { <END_BUG>  if ( pass == 0 && oxcf -> end_usage == USAGE_STREAM_FROM_SERVER ) { <START_BUG> <END_BUG> rc -> avg_frame_qindex [ 0 ] = oxcf -> worst_allowed_q ;  <START_BUG> rc -> avg_frame_qindex [ 1 ] = oxcf -> worst_allowed_q ; <END_BUG> rc -> avg_frame_qindex [ 2 ] = oxcf -> worst_allowed_q ; } else {  rc -> avg_frame_qindex [ 0 ] = ( oxcf -> worst_allowed_q + <START_BUG> oxcf -> best_allowed_q ) // 2 ; <END_BUG> rc -> avg_frame_qindex [ 1 ] = ( oxcf -> worst_allowed_q +  oxcf -> best_allowed_q ) // 2 ; <START_BUG> rc -> avg_frame_qindex [ 2 ] = ( oxcf -> worst_allowed_q + <END_BUG> oxcf -> best_allowed_q ) // 2 ; }  rc -> last_q [ 0 ] = oxcf -> best_allowed_q ; <START_BUG> rc -> last_q [ 1 ] = oxcf -> best_allowed_q ; rc -> last_q [ 2 ] = oxcf -> best_allowed_q ; rc -> buffer_level = oxcf -> starting_buffer_level ; rc -> bits_off_target = oxcf -> starting_buffer_level ; rc -> rolling_target_bits = rc -> av_per_frame_bandwidth ; rc -> rolling_actual_bits = rc -> av_per_frame_bandwidth ; rc -> long_rolling_target_bits = rc -> av_per_frame_bandwidth ; rc -> long_rolling_actual_bits = rc -> av_per_frame_bandwidth ; rc -> total_actual_bits = 0 ; rc -> total_target_vs_actual = 0 ; rc -> baseline_gf_interval = DEFAULT_GF_INTERVAL ; rc -> frames_since_key = 8 ; rc -> this_key_frame_forced = 0 ; rc -> next_key_frame_forced = 0 ; rc -> source_alt_ref_pending = 0 ; rc -> source_alt_ref_active =<END_BUG>

Fix:
<S2SV_ModStart> vp9_rc_init ( const VP9EncoderConfig <S2SV_ModEnd> * oxcf, <S2SV_ModStart> rc ) { int i ; <S2SV_ModStart> && oxcf -> rc_mode == VPX_CBR <S2SV_ModEnd> ) { rc <S2SV_ModStart> -> avg_frame_qindex [ KEY_FRAME <S2SV_ModEnd> ] = oxcf <S2SV_ModStart> -> avg_frame_qindex [ INTER_FRAME <S2SV_ModEnd> ] = oxcf <S2SV_ModStart> -> avg_frame_qindex [ KEY_FRAME <S2SV_ModEnd> ] = ( <S2SV_ModStart> -> avg_frame_qindex [ INTER_FRAME <S2SV_ModEnd> ] = ( <S2SV_ModStart> // 2 ; } rc -> last_q [ KEY_FRAME ] = oxcf -> best_allowed_q ; rc -> last_q [ INTER_FRAME ] = oxcf -> worst_allowed_q ; rc -> buffer_level = rc -> starting_buffer_level ; rc -> bits_off_target = rc -> starting_buffer_level ; rc -> rolling_target_bits = rc -> avg_frame_bandwidth ; rc -> rolling_actual_bits = rc -> avg_frame_bandwidth ; rc -> long_rolling_target_bits = rc -> avg_frame_bandwidth ; rc -> long_rolling_actual_bits = rc
Buggy code:
 jas_matrix_t * jas_matrix_copy ( jas_matrix_t * x ) { jas_matrix_t * y ; <START_BUG> int i ; <END_BUG> int j ; y = jas_matrix_create ( x -> numrows_, x -> numcols_ ) ; for ( i = 0 ; i < x -> numrows_ ; ++ i ) { for ( j = 0 ; j < x -> numcols_ ; ++ j ) { * jas_matrix_getref ( y, i, j ) = jas_matrix_get ( x, i, j ) ; } } return y ; }

Fix:
<S2SV_ModStart> * y ; jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; y
Buggy code:
 static int hls_slice_header ( HEVCContext * s ) { GetBitContext * gb = & s -> HEVClc -> gb ; SliceHeader * sh = & s -> sh ; int i, ret ; <START_BUG> sh -> first_slice_in_pic_flag = get_bits1 ( gb ) ; <END_BUG> if ( ( IS_IDR ( s ) || IS_BLA ( s ) ) && sh -> first_slice_in_pic_flag ) { s -> seq_decode = ( s -> seq_decode + 1 ) & 0xff ; s -> max_ra = INT_MAX ; if ( IS_IDR ( s ) ) ff_hevc_clear_refs ( s ) ; } sh -> no_output_of_prior_pics_flag = 0 ; if ( IS_IRAP ( s ) ) sh -> no_output_of_prior_pics_flag = get_bits1 ( gb ) ; sh -> pps_id = get_ue_golomb_long ( gb ) ; if ( sh -> pps_id >= HEVC_MAX_PPS_COUNT ||! s -> ps. pps_list [ sh -> pps_id ] ) { av_log ( s -> avctx, AV_LOG_ERROR, "PPS   id   out   of   range:   %d\\n", sh -> pps_id ) ; return AVERROR_INVALIDDATA ; } if (! sh -> first_slice_in_pic_flag && s -> ps. pps!= ( HEVCPPS * ) s -> ps. pps_list [ sh -> pps_id ] -> data ) { av_log ( s -> avctx, AV_LOG_ERROR, "PPS   changed   between   slices.\\n" ) ; return AVERROR_INVALIDDATA ; } s -> ps. pps = ( HEVCPPS * ) s -> ps. pps_list [ sh -> pps_id ] -> data ; if ( s -> nal_unit_type == HEVC_NAL_CRA_NUT && s -> last_eos == 1 ) sh -> no_output_of_prior_pics_flag = 1 ; if ( s -> ps. sps!= ( HEVCSPS * ) s -> ps. sps_list [

Fix:
<S2SV_ModStart> gb ) ; if ( s -> ref && sh -> first_slice_in_pic_flag ) { av_log ( s -> avctx, AV_LOG_ERROR, "Two <S2SV_blank> slices <S2SV_blank> reporting <S2SV_blank> being <S2SV_blank> the <S2SV_blank> first <S2SV_blank> in <S2SV_blank> the <S2SV_blank> same <S2SV_blank> frame.\\n" ) ; return 1 ; }
Buggy code:
 int dev_forward_skb ( struct net_device * dev, struct sk_buff * skb ) { skb_orphan ( skb ) ; <START_BUG> if (! ( dev -> flags & IFF_UP ) ) <END_BUG> return NET_RX_DROP ;  if ( skb -> len > ( dev -> mtu + dev -> hard_header_len ) ) <START_BUG> <END_BUG> return NET_RX_DROP ;  skb_set_dev ( skb, dev ) ; skb -> tstamp. tv64 = 0 ; skb -> pkt_type = PACKET_HOST ; skb -> protocol = eth_type_trans ( skb, dev ) ; return netif_rx ( skb ) ; }

Fix:
<S2SV_ModStart> & IFF_UP ) || <S2SV_ModEnd> ( skb -> <S2SV_ModStart> hard_header_len ) ) ) { kfree_skb ( skb ) ; <S2SV_ModStart> return NET_RX_DROP ; }
Buggy code:
 int add_packetdata ( struct mt_packet * packet, unsigned char * data, unsigned short length ) { <START_BUG> if ( packet -> size + length > MT_PACKET_LEN ) { <END_BUG> fprintf ( stderr, _ ( "add_control_packet:   ERROR,   too   large   packet.   Exceeds   %d   bytes\\n" ), MT_PACKET_LEN ) ; return - 1 ; } memcpy ( packet -> data + packet -> size, data, length ) ; packet -> size += length ; return length ; }

Fix:
<S2SV_ModStart> { if ( length > MT_PACKET_LEN - <S2SV_ModStart> packet -> size <S2SV_ModEnd> ) { fprintf
Buggy code:
 static int rds_loop_xmit ( struct rds_connection * conn, struct rds_message * rm, unsigned int hdr_off, unsigned int sg, unsigned int off ) { <START_BUG> if ( rm -> m_inc. i_hdr. h_flags & RDS_FLAG_CONG_BITMAP ) { <END_BUG> rds_cong_map_updated ( conn -> c_fcong, ~ ( u64 ) 0 ) ;  return sizeof ( struct rds_header ) + RDS_CONG_MAP_BYTES ; <START_BUG> } BUG_ON ( hdr_off || sg || off ) ; rds_inc_init ( & rm -> m_inc, conn, conn -> c_laddr ) ; rds_message_addref ( rm ) ; rds_recv_incoming ( conn, conn -> c_laddr, conn -> c_faddr, & rm -> m_inc, GFP_KERNEL, KM_USER0 ) ; rds_send_drop_acked ( conn, be64_to_cpu ( rm -> m_inc. i_hdr. h_sequence ), NULL ) ; rds_inc_put ( & rm -> m_inc ) ; <END_BUG> return sizeof ( struct rds_header ) + be32_to_cpu ( rm -> m_inc. i_hdr. h_len ) ;  }

Fix:
<S2SV_ModStart> off ) { struct scatterlist * sgp = & rm -> data. op_sg [ sg ] ; int ret = sizeof ( struct rds_header ) + be32_to_cpu ( rm -> m_inc. i_hdr. h_len ) ; <S2SV_ModStart> 0 ) ; ret = min_t ( int, ret, sgp -> length - conn -> c_xmit_data_off ) ; goto out <S2SV_ModEnd> ; } BUG_ON <S2SV_ModStart> m_inc ) ; out : return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 gchar * _rsvg_io_get_file_path ( const gchar * filename, const gchar * base_uri ) { gchar * absolute_filename ; <START_BUG> if ( g_file_test ( filename, G_FILE_TEST_EXISTS ) || g_path_is_absolute ( filename ) ) { <END_BUG> absolute_filename = g_strdup ( filename ) ; } else { gchar * tmpcdir ; gchar * base_filename ; if ( base_uri ) { base_filename = g_filename_from_uri ( base_uri, NULL, NULL ) ; if ( base_filename!= NULL ) { tmpcdir = g_path_get_dirname ( base_filename ) ; g_free ( base_filename ) ; } else return NULL ; } else tmpcdir = g_get_current_dir ( ) ; absolute_filename = g_build_filename ( tmpcdir, filename, NULL ) ; g_free ( tmpcdir ) ; } return absolute_filename ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> g_path_is_absolute ( filename
Buggy code:
 TfLiteIntArray * TfLiteIntArrayCreate ( int size ) { <START_BUG> TfLiteIntArray * ret = <END_BUG>  ( TfLiteIntArray * ) malloc ( TfLiteIntArrayGetSizeInBytes ( size ) ) ; <START_BUG> ret -> size = size ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> size ) { int alloc_size = TfLiteIntArrayGetSizeInBytes ( size ) ; if ( alloc_size <= 0 ) return NULL ; <S2SV_ModStart> ) malloc ( alloc_size ) ; if (! ret ) return ret <S2SV_ModEnd> ; ret ->
Buggy code:
 static void test_function ( char * ( * my_asnprintf ) ( char *, size_t *, const char *,... ) ) { char buf [ 8 ] ; int size ; for ( size = 0 ; size <= 8 ; size ++ ) { size_t length = size ; char * result = my_asnprintf ( NULL, & length, "%d", 12345 ) ; ASSERT ( result!= NULL ) ; ASSERT ( strcmp ( result, "12345" ) == 0 ) ; ASSERT ( length == 5 ) ; free ( result ) ; } for ( size = 0 ; size <= 8 ; size ++ ) { size_t length ; char * result ; memcpy ( buf, "DEADBEEF", 8 ) ; length = size ; result = my_asnprintf ( buf, & length, "%d", 12345 ) ; ASSERT ( result!= NULL ) ; ASSERT ( strcmp ( result, "12345" ) == 0 ) ; ASSERT ( length == 5 ) ; <START_BUG> if ( size < 6 ) <END_BUG> ASSERT ( result!= buf ) ; ASSERT ( memcmp ( buf + size, & "DEADBEEF" [ size ], 8 - size ) == 0 ) ; if ( result!= buf ) free ( result ) ; }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ( size < 5 + 1 <S2SV_ModEnd> ) ASSERT ( <S2SV_ModStart> ) ; } for ( size = 0 ; size <= 8 ; size ++ ) { size_t length ; char * result ; memcpy ( buf, "DEADBEEF", 8 ) ; length = size ; result = my_asnprintf ( buf, & length, "%2.0f", 1.6314159265358979e+125 ) ; ASSERT ( result!= NULL ) ; ASSERT ( strcmp ( result, "163141592653589790215729350939528493057529598899734151772468186268423257777068536614838678161083520756952076273094236944990208" ) == 0 ) ; ASSERT ( length == 126 ) ; if ( size < 126 + 1 ) ASSERT ( result!= buf ) ; ASSERT ( memcmp ( buf + size, & "DEADBEEF" [ size ], 8 - size ) == 0 ) ; if ( result!= buf ) free ( result ) ; }
Buggy code:
 static vpx_image_t * img_alloc_helper ( vpx_image_t * img, vpx_img_fmt_t fmt, unsigned int d_w, unsigned int d_h, unsigned int buf_align, unsigned int stride_align, unsigned char * img_data ) { unsigned int h, w, s, xcs, ycs, bps ; <START_BUG> int align ; <END_BUG> if (! buf_align ) buf_align = 1 ; if ( buf_align & ( buf_align - 1 ) ) goto fail ; if (! stride_align ) stride_align = 1 ; if ( stride_align & ( stride_align - 1 ) ) goto fail ; switch ( fmt ) { case VPX_IMG_FMT_RGB32 : case VPX_IMG_FMT_RGB32_LE : case VPX_IMG_FMT_ARGB : case VPX_IMG_FMT_ARGB_LE : bps = 32 ; break ; case VPX_IMG_FMT_RGB24 : case VPX_IMG_FMT_BGR24 : bps = 24 ; break ; case VPX_IMG_FMT_RGB565 : case VPX_IMG_FMT_RGB565_LE : case VPX_IMG_FMT_RGB555 : case VPX_IMG_FMT_RGB555_LE : case VPX_IMG_FMT_UYVY : case VPX_IMG_FMT_YUY2 : case VPX_IMG_FMT_YVYU : bps = 16 ; break ; case VPX_IMG_FMT_I420 : case VPX_IMG_FMT_YV12 : case VPX_IMG_FMT_VPXI420 : case VPX_IMG_FMT_VPXYV12 : bps = 12 ; break ;  default : <START_BUG> bps = 16 ; break ; } switch ( fmt ) { case VPX_IMG_FMT_I420 : case VPX_IMG_FMT_YV12 : case VPX_IMG_FMT_VPXI4<END_BUG>

Fix:
<S2SV_ModStart>, bps ; unsigned int stride_in_bytes ; <S2SV_ModStart> ; break ; case VPX_IMG_FMT_I422 : case VPX_IMG_FMT_I440 : bps = 16 ; break ; case VPX_IMG_FMT_I444 : bps = 24 ; break ; case VPX_IMG_FMT_I42016 : bps = 24 ; break ; case VPX_IMG_FMT_I42216 : case VPX_IMG_FMT_I44016 : bps = 32 ; break ; case VPX_IMG_FMT_I44416 : bps = 48 ; break ; <S2SV_ModStart> case VPX_IMG_FMT_VPXYV12 : case VPX_IMG_FMT_I422 : case VPX_IMG_FMT_I42016 : case VPX_IMG_FMT_I42216 : <S2SV_ModStart> VPX_IMG_FMT_I420 : case VPX_IMG_FMT_I440 : case <S2SV_ModStart> :
Buggy code:
 static int prepend_path ( const struct path * path, const struct path * root, char * * buffer, int * buflen ) { struct dentry * dentry ; struct vfsmount * vfsmnt ; struct mount * mnt ; int error = 0 ; unsigned seq, m_seq = 0 ; char * bptr ; int blen ; rcu_read_lock ( ) ; restart_mnt : read_seqbegin_or_lock ( & mount_lock, & m_seq ) ; seq = 0 ; rcu_read_lock ( ) ; restart : bptr = * buffer ; blen = * buflen ; error = 0 ; dentry = path -> dentry ; vfsmnt = path -> mnt ; mnt = real_mount ( vfsmnt ) ; read_seqbegin_or_lock ( & rename_lock, & seq ) ; while ( dentry!= root -> dentry || vfsmnt!= root -> mnt ) { struct dentry * parent ; if ( dentry == vfsmnt -> mnt_root || IS_ROOT ( dentry ) ) { <START_BUG> struct mount * parent = ACCESS_ONCE ( mnt -> mnt_parent ) ; <END_BUG> if ( mnt!= parent ) { dentry = ACCESS_ONCE ( mnt -> mnt_mountpoint ) ; mnt = parent ; vfsmnt = & mnt -> mnt ; continue ; } if (! error ) error = is_mounted ( vfsmnt )? 1 : 2 ; break ; } parent = dentry -> d_parent ; prefetch ( parent ) ; error = prepend_name ( & bptr, & blen, & dentry -> d_name ) ; if ( error ) break ; dentry = parent ; } if (! ( seq & 1 ) ) rcu_read_unlock ( ) ; if ( need_seqretry ( & rename_lock, seq ) ) { seq = 1 ; goto restart ; } done_seqretry ( & rename_lock, seq ) ; if (! ( m_seq & 1 ) ) rcu_read_unlock ( ) ; if ( need_seqretry ( & mount_lock, m_seq ) ) { m_seq = 1 ; goto restart_mnt ; } done_seqretry ( & mount_lock, m_seq ) ; if ( error >= 0 && bptr == * buffer ) { if ( -- blen < 0

Fix:
<S2SV_ModStart> mnt_parent ) ; if ( dentry!= vfsmnt -> mnt_root ) { bptr = * buffer ; blen = * buflen ; error = 3 ; break ; }
Buggy code:
 static void _out_result ( conn_t out, nad_t nad ) { int attr ; jid_t from, to ; char * rkey ; int rkeylen ; attr = nad_find_attr ( nad, 0, - 1, "from", NULL ) ; if ( attr < 0 || ( from = jid_new ( NAD_AVAL ( nad, attr ), NAD_AVAL_L ( nad, attr ) ) ) == NULL ) { log_debug ( ZONE, "missing   or   invalid   from   on   db   result   packet" ) ; nad_free ( nad ) ; return ; } attr = nad_find_attr ( nad, 0, - 1, "to", NULL ) ; if ( attr < 0 || ( to = jid_new ( NAD_AVAL ( nad, attr ), NAD_AVAL_L ( nad, attr ) ) ) == NULL ) { log_debug ( ZONE, "missing   or   invalid   to   on   db   result   packet" ) ; jid_free ( from ) ; nad_free ( nad ) ; return ; } rkey = s2s_route_key ( NULL, to -> domain, from -> domain ) ; rkeylen = strlen ( rkey ) ; <START_BUG> if ( nad_find_attr ( nad, 0, - 1, "type", "valid" ) >= 0 ) { <END_BUG> log_write ( out -> s2s -> log, LOG_NOTICE, "[%d]   [%s,   port=%d]   outgoing   route   \'%s\'   is   now   valid%s%s", out -> fd -> fd, out -> ip, out -> port, rkey, ( out -> s -> flags & SX_SSL_WRAPPER )? ",   TLS   negotiated" : "", out -> s -> compressed? ",   ZLIB   compression   enabled" : "" ) ; xhash_put ( out -> states, pstrdup ( xhash_pool ( out -> states ), rkey ), ( void * ) conn_VALID ) ; log_debug ( ZONE, "%s   valid,   flushing   queue", rkey ) ; out_flush_route_queue ( out -> s2s

Fix:
<S2SV_ModStart> ) >= 0 && xhash_get ( out -> states, rkey ) == ( void * ) conn_INPROGRESS
Buggy code:
 void vp8mt_de_alloc_temp_buffers ( VP8D_COMP * pbi, int mb_rows ) { int i ; <START_BUG> if ( pbi -> b_multithreaded_rd ) <END_BUG> { vpx_free ( pbi -> mt_current_mb_col ) ; pbi -> mt_current_mb_col = NULL ; if ( pbi -> mt_yabove_row )  { <START_BUG> for ( i = 0 ; i < mb_rows ; i ++ ) { vpx_free ( pbi -> mt_yabove_row [ i ] ) ; pbi -> mt_yabove_row [ i ] = NULL ; } vpx_free ( pbi -> mt_yabove_row ) ; pbi -> mt_yabove_row = NULL ; } if ( pbi -> mt_uabove_row ) <END_BUG> {  for ( i = 0 ; i < mb_rows ; i ++ ) { vpx_free ( pbi -> mt_uabove_row [ i ] ) ; pbi -> mt_uabove_row [ i ] = NULL ; } vpx_free ( pbi -> mt_uabove_row ) ; pbi -> mt_uabove_row = NULL ; } if ( pbi -> mt_vabove_row ) <START_BUG> { <END_BUG> for ( i = 0 ; i < mb_rows ; i ++ ) { vpx_free ( pbi -> mt_vabove_row [ i ] ) ; pbi -> mt_vabove_row [ i ] = NULL ; } vpx_free ( pbi -> mt_vabove_row ) ; pbi -> mt_vabove_row = NULL ; } if ( pbi -> mt_yleft_col )  { <START_BUG> for ( i = 0 ; i < mb_rows ; i ++ ) { vpx_free ( pbi -> mt_yleft_col [ i ] ) ; pbi -> mt_yleft_col [ i ] = NULL ; } vpx_free ( pbi -> mt_yleft_col ) ; pbi -> mt_yleft_col = NULL ; } if ( pbi -> mt_uleft_col ) <END_BUG> {  for ( i = 0 ; i < mb_rows ; i ++ ) { vpx_free ( pbi -> mt_uleft_col [ i ]

Fix:
<S2SV_ModStart> int i ; <S2SV_ModEnd> vpx_free ( pbi <S2SV_ModStart> -> mt_yabove_row ) { for ( i = 0 ; i < mb_rows ; ++ i ) <S2SV_ModEnd> { vpx_free ( <S2SV_ModStart> -> mt_uabove_row ) { for ( i = 0 ; i < mb_rows ; ++ i ) <S2SV_ModEnd> { vpx_free ( <S2SV_ModStart> -> mt_vabove_row ) { for ( i = 0 ; i < mb_rows ; ++ i ) <S2SV_ModEnd> { vpx_free ( <S2SV_ModStart> -> mt_yleft_col ) { for ( i = 0 ; i < mb_rows ; ++ i ) <S2SV_ModEnd> { vpx_free ( <S2SV_ModStart> -> mt_uleft_col ) { for ( i = 0 ; i < mb_rows ; ++ i ) <S2SV_ModEnd> { vpx_free ( <S2SV_ModStart> -> mt_vleft_col ) { for ( i = 0 ; i < mb_rows ; ++ i ) <S2SV_ModEnd> { vpx_free ( <S2SV_ModStart> ; } } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int inotify_release ( struct inode * ignored, struct file * file ) { struct fsnotify_group * group = file -> private_data ; <START_BUG> struct user_struct * user = group -> inotify_data. user ; <END_BUG> pr_debug ( "%s:   group=%p\\n", __func__, group ) ; fsnotify_clear_marks_by_group ( group ) ; fsnotify_put_group ( group ) ;  atomic_dec ( & user -> inotify_devs ) ; <START_BUG> return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> private_data ; <S2SV_ModEnd> pr_debug ( "%s: <S2SV_blank> group=%p\\n" <S2SV_ModStart> group ) ; <S2SV_ModEnd> return 0 ;
Buggy code:
 <START_BUG> static void update_switchable_interp_probs ( VP9_COMMON * cm, vp9_writer * w ) { <END_BUG> int j ; for ( j = 0 ; j < SWITCHABLE_FILTER_CONTEXTS ; ++ j ) prob_diff_update ( vp9_switchable_interp_tree,  cm -> fc. switchable_interp_prob [ j ], <START_BUG> <END_BUG> cm -> counts. switchable_interp [ j ], SWITCHABLE_FILTERS, w ) ;  }

Fix:
<S2SV_ModStart> * cm, vpx_writer * w, FRAME_COUNTS * counts <S2SV_ModEnd> ) { int <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> switchable_interp_prob [ j <S2SV_ModStart> j ], counts -> <S2SV_ModEnd> switchable_interp [ j
Buggy code:
 static Curves16Data * CurvesAlloc ( cmsContext ContextID, int nCurves, int nElements, cmsToneCurve * * G ) { int i, j ; Curves16Data * c16 ; c16 = _cmsMallocZero ( ContextID, sizeof ( Curves16Data ) ) ; if ( c16 == NULL ) return NULL ; c16 -> nCurves = nCurves ; c16 -> nElements = nElements ; c16 -> Curves = _cmsCalloc ( ContextID, nCurves, sizeof ( cmsUInt16Number * ) ) ; if ( c16 -> Curves == NULL ) return NULL ; for ( i = 0 ; i < nCurves ; i ++ ) { <START_BUG> c16 -> Curves [ i ] = _cmsCalloc ( ContextID, nElements, sizeof ( cmsUInt16Number ) ) ; <END_BUG> if ( nElements == 256 ) { for ( j = 0 ; j < nElements ; j ++ ) { c16 -> Curves [ i ] [ j ] = cmsEvalToneCurve16 ( G [ i ], FROM_8_TO_16 ( j ) ) ; } } else { for ( j = 0 ; j < nElements ; j ++ ) { c16 -> Curves [ i ] [ j ] = cmsEvalToneCurve16 ( G [ i ], ( cmsUInt16Number ) j ) ; } } } return c16 ; }

Fix:
<S2SV_ModStart> ) ) ; if ( c16 -> Curves [ i ] == NULL ) { for ( j = 0 ; j < i ; j ++ ) { _cmsFree ( ContextID, c16 -> Curves [ j ] ) ; } _cmsFree ( ContextID, c16 -> Curves ) ; _cmsFree ( ContextID, c16 ) ; return NULL ; }
Buggy code:
 static int match_at ( regex_t * reg, const UChar * str, const UChar * end, # ifdef USE_MATCH_RANGE_MUST_BE_INSIDE_OF_SPECIFIED_RANGE const UChar * right_range, # endif const UChar * sstart, UChar * sprev, OnigMatchArg * msa ) { static UChar FinishCode [ ] = { OP_FINISH } ; int i, n, num_mem, best_len, pop_level ; LengthType tlen, tlen2 ; MemNumType mem ; RelAddrType addr ; UChar * s, * q, * sbegin ; int is_alloca ; char * alloc_base ; OnigStackType * stk_base, * stk, * stk_end ; OnigStackType * stkp ; OnigStackIndex si ; OnigStackIndex * repeat_stk ; OnigStackIndex * mem_start_stk, * mem_end_stk ; # ifdef USE_COMBINATION_EXPLOSION_CHECK int scv ; unsigned char * state_check_buff = msa -> state_check_buff ; int num_comb_exp_check = reg -> num_comb_exp_check ; # endif UChar * p = reg -> p ; OnigOptionType option = reg -> options ; OnigEncoding encode = reg -> enc ; OnigCaseFoldType case_fold_flag = reg -> case_fold_flag ; pop_level = reg -> stack_pop_level ; num_mem = reg -> num_mem ; STACK_INIT ( INIT_MATCH_STACK_SIZE ) ; UPDATE_FOR_STACK_REALLOC ; for ( i = 1 ; i <= num_mem ; i ++ ) { mem_start_stk [ i ] = mem_end_stk [ i ] = INVALID_STACK_INDEX ; } # ifdef ONIG_DEBUG_MATCH fprintf ( stderr, "match_at:   str:   %d,   end:   %d,   start:   %d,   sprev:   %d\\n", ( int ) str, ( int ) end, ( int ) sstart, ( int ) sprev ) ; fprintf ( stderr, "size:   %d,   start   offset:   %d\\n"

Fix:
<S2SV_ModStart> OP_EXACT1 ) ; <S2SV_ModEnd> DATA_ENSURE ( 1 <S2SV_ModStart> ++ ; s <S2SV_ModEnd> ++ ; MOP_OUT
Buggy code:
 <START_BUG> static int jas_iccgetuint ( jas_stream_t * in, int n, ulonglong * val ) <END_BUG> { int i ; int c ;  ulonglong v ; <START_BUG> v = 0 ; for ( i = n ; i > 0 ; -- i ) { if ( ( c = jas_stream_getc ( in ) ) == EOF ) return - 1 ; v = ( v << 8 ) | c ; } * val = v ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> int n, jas_ulonglong <S2SV_ModEnd> * val ) <S2SV_ModStart> int c ; jas_ulonglong <S2SV_ModEnd> v ; v
Buggy code:
 void dump_global_data ( FILE * fp, data_t * data ) { # ifdef _WITH_VRRP_ char buf [ 64 ] ; # endif if (! data ) return ; conf_write ( fp, "------<   Global   definitions   >------" ) ; # if HAVE_DECL_CLONE_NEWNET conf_write ( fp, "   Network   namespace   =   %s", data -> network_namespace? data -> network_namespace : "(default)" ) ; # endif if ( data -> instance_name ) conf_write ( fp, "   Instance   name   =   %s", data -> instance_name ) ; if ( data -> router_id ) conf_write ( fp, "   Router   ID   =   %s", data -> router_id ) ; if ( data -> smtp_server. ss_family ) { conf_write ( fp, "   Smtp   server   =   %s", inet_sockaddrtos ( & data -> smtp_server ) ) ; conf_write ( fp, "   Smtp   server   port   =   %u", ntohs ( inet_sockaddrport ( & data -> smtp_server ) ) ) ; } if ( data -> smtp_helo_name ) conf_write ( fp, "   Smtp   HELO   name   =   %s", data -> smtp_helo_name ) ; if ( data -> smtp_connection_to ) conf_write ( fp, "   Smtp   server   connection   timeout   =   %lu", data -> smtp_connection_to // TIMER_HZ ) ; if ( data -> email_from ) { conf_write ( fp, "   Email   notification   from   =   %s", data -> email_from ) ; dump_list ( fp, data -> email ) ; } conf_write ( fp, "   Default   smtp_alert   =   %s", data -> smtp_alert == - 1? "unset" : data -> smtp_alert? "on" : "off" ) ; # ifdef _WITH_VRRP_ conf_write ( fp, "   Default   smtp_alert_vrrp   =   %s", data -> smtp_alert_vrrp == - 1? "unset" :

Fix:
<S2SV_ModStart> vrrp_rx_bufs_multiples ) ; conf_write ( fp, " <S2SV_blank> umask <S2SV_blank> = <S2SV_blank> 0%o", global_data -> umask ) ;
Buggy code:
 int git_pkt_parse_line ( git_pkt * * head, const char * line, const char * * out, size_t bufflen ) { int ret ; int32_t len ; if ( bufflen > 0 && bufflen < PKT_LEN_SIZE ) return GIT_EBUFS ; len = parse_len ( line ) ; if ( len < 0 ) { if ( bufflen >= 4 &&! git__prefixcmp ( line, "PACK" ) ) { giterr_clear ( ) ; * out = line ; return pack_pkt ( head ) ; } return ( int ) len ; } if ( bufflen > 0 && bufflen < ( size_t ) len ) return GIT_EBUFS ; <START_BUG> line += PKT_LEN_SIZE ; <END_BUG> if ( len == PKT_LEN_SIZE ) { * head = NULL ; * out = line ; return 0 ; } if ( len == 0 ) { * out = line ; return flush_pkt ( head ) ; } len -= PKT_LEN_SIZE ; if ( * line == GIT_SIDE_BAND_DATA ) ret = data_pkt ( head, line, len ) ; else if ( * line == GIT_SIDE_BAND_PROGRESS ) ret = sideband_progress_pkt ( head, line, len ) ; else if ( * line == GIT_SIDE_BAND_ERROR ) ret = sideband_error_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "ACK" ) ) ret = ack_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "NAK" ) ) ret = nak_pkt ( head ) ; else if (! git__prefixcmp ( line, "ERR   " ) ) ret = err_pkt ( head, line, len ) ; else if ( * line == '#' ) ret = comment_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "ok" ) ) ret = ok_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "ng" ) ) ret = ng_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line,

Fix:
<S2SV_ModStart> return GIT_EBUFS ; if ( len!= 0 && len < PKT_LEN_SIZE ) return GIT_ERROR ;
Buggy code:
 int idn2_to_ascii_4i ( const uint32_t * input, size_t inlen, char * output, int flags ) { uint32_t * input_u32 ; uint8_t * input_u8, * output_u8 ; size_t length ; int rc ; if (! input ) { if ( output ) * output = 0 ; return IDN2_OK ; } input_u32 = ( uint32_t * ) malloc ( ( inlen + 1 ) * sizeof ( uint32_t ) ) ; if (! input_u32 ) return IDN2_MALLOC ; u32_cpy ( input_u32, input, inlen ) ; input_u32 [ inlen ] = 0 ; input_u8 = u32_to_u8 ( input_u32, inlen + 1, NULL, & length ) ; free ( input_u32 ) ; if (! input_u8 ) { if ( errno == ENOMEM ) return IDN2_MALLOC ; return IDN2_ENCODING_ERROR ; } rc = idn2_lookup_u8 ( input_u8, & output_u8, flags ) ; free ( input_u8 ) ; if ( rc == IDN2_OK ) { <START_BUG> if ( output ) <END_BUG>  strcpy ( output, ( const char * ) output_u8 ) ; <START_BUG> free ( output_u8 ) ; } return rc ; }<END_BUG>

Fix:
<S2SV_ModStart> IDN2_OK ) { size_t len = strlen ( ( char * ) output_u8 ) ; if ( len > 63 ) { free ( output_u8 ) ; return IDN2_TOO_BIG_DOMAIN ; } <S2SV_ModStart> output, ( <S2SV_ModEnd> char * )