nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int compare_img ( const vpx_image_t * const img1, const vpx_image_t * const img2 ) { <START_BUG> const uint32_t c_w = <END_BUG> ( img1 -> d_w + img1 -> x_chroma_shift ) >> img1 -> x_chroma_shift ; const uint32_t c_h = ( img1 -> d_h + img1 -> y_chroma_shift ) >> img1 -> y_chroma_shift ; uint32_t i ; int match = 1 ; match &= ( img1 -> fmt == img2 -> fmt ) ; match &= ( img1 -> d_w == img2 -> d_w ) ; match &= ( img1 -> d_h == img2 -> d_h ) ;  for ( i = 0 ; i < img1 -> d_h ; ++ i ) <START_BUG> match &= ( memcmp ( img1 -> planes [ VPX_PLANE_Y ] + i * img1 -> stride [ VPX_PLANE_Y ], img2 -> planes [ VPX_PLANE_Y ] + i * img2 -> stride [ VPX_PLANE_Y ], <END_BUG> img1 -> d_w ) == 0 ) ;  for ( i = 0 ; i < c_h ; ++ i ) match &= ( memcmp ( img1 -> planes [ VPX_PLANE_U ] + i * img1 -> stride [ VPX_PLANE_U ], img2 -> planes [ VPX_PLANE_U ] + i * img2 -> stride [ VPX_PLANE_U ], c_w ) == 0 ) ; for ( i = 0 ; i < c_h ; ++ i ) match &= ( memcmp ( img1 -> planes [ VPX_PLANE_V ] + i * img1 -> stride [ VPX_PLANE_V ], img2 -> planes [ VPX_PLANE_V ] + i * img2 -> stride [ VPX_PLANE_V ], c_w ) == 0 ) ; return match ; }

Fix:
<S2SV_ModStart> img2 ) { uint32_t l_w = img1 -> d_w ; <S2SV_ModEnd> uint32_t c_w = <S2SV_ModStart> d_h ) ; # if CONFIG_VP9_HIGHBITDEPTH if ( img1 -> fmt & VPX_IMG_FMT_HIGHBITDEPTH ) { l_w *= 2 ; c_w *= 2 ; } # endif <S2SV_ModStart> VPX_PLANE_Y ], l_w <S2SV_ModEnd> ) == 0
Buggy code:
 int writefile ( const char * name, struct string * s ) { FILE * f ; int ret ; f = fopen ( name, "w" ) ; if (! f ) { warn ( "open   %s:", name ) ; return - 1 ; } ret = 0 ; <START_BUG> if ( fwrite ( s -> s, 1, s -> n, f )!= s -> n || fflush ( f )!= 0 ) { <END_BUG> warn ( "write   %s:", name ) ; ret = - 1 ; } fclose ( f ) ; return ret ; }

Fix:
<S2SV_ModStart> ; if ( s && ( <S2SV_ModStart> )!= 0 )
Buggy code:
 int vp8dx_receive_compressed_data ( VP8D_COMP * pbi, size_t size, const uint8_t * source, int64_t time_stamp ) { <START_BUG> # if HAVE_NEON <END_BUG> int64_t dx_store_reg [ 8 ] ; # endif VP8_COMMON * cm = & pbi -> common ; int retcode = - 1 ;  pbi -> common. error. error_code = VPX_CODEC_OK ; <START_BUG> retcode = check_fragments_for_errors ( pbi ) ; if ( retcode <= 0 ) return retcode ; <END_BUG> # if HAVE_NEON  # if CONFIG_RUNTIME_CPU_DETECT if ( cm -> cpu_caps & HAS_NEON ) # endif { vp8_push_neon ( dx_store_reg ) ; } # endif cm -> new_fb_idx = get_free_fb ( cm ) ; pbi -> dec_fb_ref [ INTRA_FRAME ] = & cm -> yv12_fb [ cm -> new_fb_idx ] ; pbi -> dec_fb_ref [ LAST_FRAME ] = & cm -> yv12_fb [ cm -> lst_fb_idx ] ; pbi -> dec_fb_ref [ GOLDEN_FRAME ] = & cm -> yv12_fb [ cm -> gld_fb_idx ] ; pbi -> dec_fb_ref [ ALTREF_FRAME ] = & cm -> yv12_fb [ cm -> alt_fb_idx ] ; if ( setjmp ( pbi -> common. error. jmp ) ) { cm -> yv12_fb [ cm -> lst_fb_idx ]. corrupted = 1 ; if ( cm -> fb_idx_ref_cnt [ cm -> new_fb_idx ] > 0 ) cm -> fb_idx_ref_cnt [ cm -> new_fb_idx ] -- ; goto decode_exit ; } pbi -> common. error. setjmp = 1 ; retcode = vp8_decode_frame ( pbi ) ; if ( retcode < 0 ) { if ( cm -> fb_idx_ref_cnt [ cm -> new_fb_idx ] > 0 ) cm -> fb_idx_ref_cnt [ cm -> new_fb_idx ] -- ; pbi -> common. error

Fix:
<S2SV_ModStart> time_stamp ) { <S2SV_ModEnd> VP8_COMMON * cm <S2SV_ModStart> - 1 ; ( void ) size ; ( void ) source ; <S2SV_ModStart> return retcode ; <S2SV_ModEnd> cm -> new_fb_idx <S2SV_ModStart> ; decode_exit : <S2SV_ModEnd> pbi -> common <S2SV_ModStart> = 0 ; vp8_clear_system_state ( ) ;
Buggy code:
 static void sas_unregister_devs_sas_addr ( struct domain_device * parent, int phy_id, bool last ) { struct expander_device * ex_dev = & parent -> ex_dev ; struct ex_phy * phy = & ex_dev -> ex_phy [ phy_id ] ; struct domain_device * child, * n, * found = NULL ; if ( last ) { list_for_each_entry_safe ( child, n, & ex_dev -> children, siblings ) { if ( SAS_ADDR ( child -> sas_addr ) == SAS_ADDR ( phy -> attached_sas_addr ) ) { set_bit ( SAS_DEV_GONE, & child -> state ) ; if ( child -> dev_type == SAS_EDGE_EXPANDER_DEVICE || child -> dev_type == SAS_FANOUT_EXPANDER_DEVICE ) sas_unregister_ex_tree ( parent -> port, child ) ; else sas_unregister_dev ( parent -> port, child ) ; found = child ; break ; } } sas_disable_routing ( parent, phy -> attached_sas_addr ) ; } memset ( phy -> attached_sas_addr, 0, SAS_ADDR_SIZE ) ; if ( phy -> port ) { sas_port_delete_phy ( phy -> port, phy -> phy ) ; sas_device_set_phy ( found, phy -> port ) ; if ( phy -> port -> num_phys == 0 ) <START_BUG> sas_port_delete ( phy -> port ) ; <END_BUG> phy -> port = NULL ; } }

Fix:
<S2SV_ModStart> == 0 ) list_add_tail ( & phy -> port -> del_list, & parent -> port -> sas_port_del_list <S2SV_ModEnd> ) ; phy
Buggy code:
 u_int atm_if_print ( netdissect_options * ndo, const struct pcap_pkthdr * h, const u_char * p ) { u_int caplen = h -> caplen ; u_int length = h -> len ; uint32_t llchdr ; u_int hdrlen = 0 ; if ( caplen < 1 || length < 1 ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ( caplen ) ; } if ( * p == LLC_UI ) { if ( ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "CNLPID   " ) ) ; <START_BUG> isoclns_print ( ndo, p + 1, length - 1, caplen - 1 ) ; <END_BUG> return hdrlen ; } if ( caplen < 3 || length < 3 ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ( caplen ) ; } llchdr = EXTRACT_24BITS ( p ) ; if ( llchdr!= LLC_UI_HDR ( LLCSAP_SNAP ) && llchdr!= LLC_UI_HDR ( LLCSAP_ISONS ) && llchdr!= LLC_UI_HDR ( LLCSAP_IP ) ) { if ( caplen < 20 || length < 20 ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ( caplen ) ; } if ( ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "%08x%08x   %08x%08x   ", EXTRACT_32BITS ( p ), EXTRACT_32BITS ( p + 4 ), EXTRACT_32BITS ( p + 8 ), EXTRACT_32BITS ( p + 12 ) ) ) ; p += 20 ; length -= 20 ; caplen -= 20 ; hdrlen += 20 ; } hdrlen += atm_llc_print ( ndo, p, length, caplen ) ; return ( hdrlen ) ; }

Fix:
<S2SV_ModStart> length - 1 <S2SV_ModEnd> ) ; return
Buggy code:
 static krb5_error_code process_chpw_request ( krb5_context context, void * server_handle, char * realm, krb5_keytab keytab, const krb5_fulladdr * local_faddr, const krb5_fulladdr * remote_faddr, krb5_data * req, krb5_data * rep ) { krb5_error_code ret ; char * ptr ; unsigned int plen, vno ; krb5_data ap_req, ap_rep = empty_data ( ) ; krb5_data cipher = empty_data ( ), clear = empty_data ( ) ; krb5_auth_context auth_context = NULL ; krb5_principal changepw = NULL ; krb5_principal client, target = NULL ; krb5_ticket * ticket = NULL ; krb5_replay_data replay ; krb5_error krberror ; int numresult ; char strresult [ 1024 ] ; char * clientstr = NULL, * targetstr = NULL ; const char * errmsg = NULL ; size_t clen ; char * cdots ; struct sockaddr_storage ss ; socklen_t salen ; char addrbuf [ 100 ] ; krb5_address * addr = remote_faddr -> address ; * rep = empty_data ( ) ; if ( req -> length < 4 ) { ret = KRB5KRB_AP_ERR_MODIFIED ; numresult = KRB5_KPASSWD_MALFORMED ; strlcpy ( strresult, "Request   was   truncated", sizeof ( strresult ) ) ; <START_BUG> goto chpwfail ; <END_BUG> } ptr = req -> data ; plen = ( * ptr ++ & 0xff ) ; plen = ( plen << 8 ) | ( * ptr ++ & 0xff ) ; if ( plen!= req -> length ) { ret = KRB5KRB_AP_ERR_MODIFIED ; numresult = KRB5_KPASSWD_MALFORMED ; strlcpy ( strresult, "Request   length   was   inconsistent", sizeof ( strresult ) ) ;  goto chpwfail ; <START_BUG> } vno = ( * ptr ++ & 0xff ) ; vno = ( vno << 8 ) | ( * ptr ++ & 0xff )<END_BUG>

Fix:
<S2SV_ModStart> ) ; goto bailout <S2SV_ModEnd> ; } ptr <S2SV_ModStart> ) ; goto bailout <S2SV_ModEnd> ; } vno <S2SV_ModStart> ) ; goto bailout <S2SV_ModEnd> ; } ap_req <S2SV_ModStart> ) ; goto bailout <S2SV_ModEnd> ; } ap_req
Buggy code:
 static void encode_block ( int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * arg ) { struct encode_b_args * const args = arg ; MACROBLOCK * const x = args -> x ; MACROBLOCKD * const xd = & x -> e_mbd ; struct optimize_ctx * const ctx = args -> ctx ; struct macroblock_plane * const p = & x -> plane [ plane ] ; struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <START_BUG> int16_t * const dqcoeff = BLOCK_OFFSET ( pd -> dqcoeff, block ) ; <END_BUG> int i, j ; uint8_t * dst ; ENTROPY_CONTEXT * a, * l ; txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & i, & j ) ; dst = & pd -> dst. buf [ 4 * j * pd -> dst. stride + 4 * i ] ; a = & ctx -> ta [ plane ] [ i ] ; l = & ctx -> tl [ plane ] [ j ] ; if ( x -> zcoeff_blk [ tx_size ] [ block ] && plane == 0 ) { p -> eobs [ block ] = 0 ; * a = * l = 0 ; return ; }  if (! x -> skip_recode ) <START_BUG> <END_BUG> vp9_xform_quant ( x, plane, block, plane_bsize, tx_size ) ;  if ( x -> optimize && (! x -> skip_recode ||! x -> skip_optimize ) ) { <START_BUG> optimize_b ( plane, block, plane_bsize, tx_size, x, a, l ) ; <END_BUG> } else { * a = * l = p -> eobs [ block ] > 0 ; } if ( p -> eobs [ block ] ) * ( args -> skip ) = 0 ; if ( x -> skip_encode || p -> eobs [ block ] == 0 ) return ;  switch ( tx_size ) { <START_BUG> case TX_32X32 : <END_BUG> vp9_idct32x32_add ( dqcoeff, dst, pd -> dst. stride, p -> eobs [ block ] ) ;  break ; case TX_16X16 : <START_BUG> vp9_idct16x16_add ( dq<END_BUG>

Fix:
<S2SV_ModStart> plane ] ; tran_low_t <S2SV_ModEnd> * const dqcoeff <S2SV_ModStart> -> skip_recode ) { if ( x -> quant_fp ) { if ( x -> skip_txfm [ 0 ] == SKIP_TXFM_AC_DC && plane == 0 ) { p -> eobs [ block ] = 0 ; * a = * l = 0 ; return ; } else { vp9_xform_quant_fp ( x, plane, block, plane_bsize, tx_size ) ; } } else { if ( max_txsize_lookup [ plane_bsize ] == tx_size ) { int txfm_blk_index = ( plane << 2 ) + ( block >> ( tx_size << 1 ) ) ; if ( x -> skip_txfm [ txfm_blk_index ] == SKIP_TXFM_NONE ) { <S2SV_ModStart> tx_size ) ; } else if ( x -> skip_txfm [ txfm_blk_index ] == SKIP_TXFM_AC_ONLY ) { vp9_xform_quant_dc ( x, plane, block, plane_bsize, tx_size ) ; } else { p -> e
Buggy code:
 static void <START_BUG> l2tp_proto_ver_print ( netdissect_options * ndo, const uint16_t * dat ) <END_BUG> { ND_PRINT ( ( ndo, "%u.%u", ( EXTRACT_16BITS ( dat ) >> 8 ), ( EXTRACT_16BITS ( dat ) & 0xff ) ) ) ; }

Fix:
<S2SV_ModStart> uint16_t * dat, u_int length ) { if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } <S2SV_ModEnd> ND_PRINT ( (
Buggy code:
 static inline key_ref_t __key_update ( key_ref_t key_ref, struct key_preparsed_payload * prep ) { struct key * key = key_ref_to_ptr ( key_ref ) ; int ret ; ret = key_permission ( key_ref, KEY_NEED_WRITE ) ; if ( ret < 0 ) goto error ; ret = - EEXIST ; if (! key -> type -> update ) goto error ; down_write ( & key -> sem ) ; ret = key -> type -> update ( key, prep ) ; if ( ret == 0 ) <START_BUG> clear_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ; <END_BUG> up_write ( & key -> sem ) ; if ( ret < 0 ) goto error ; out : return key_ref ; error : key_put ( key ) ; key_ref = ERR_PTR ( ret ) ; goto out ; }

Fix:
<S2SV_ModStart> == 0 ) mark_key_instantiated ( key, 0 <S2SV_ModEnd> ) ; up_write
Buggy code:
 static bool states_equal ( struct bpf_verifier_env * env, struct bpf_verifier_state * old, struct bpf_verifier_state * cur ) { int i ; <START_BUG> if ( old -> curframe!= cur -> curframe ) <END_BUG> return false ; for ( i = 0 ; i <= old -> curframe ; i ++ ) { if ( old -> frame [ i ] -> callsite!= cur -> frame [ i ] -> callsite ) return false ; if (! func_states_equal ( old -> frame [ i ], cur -> frame [ i ] ) ) return false ; } return true ; }

Fix:
<S2SV_ModStart> cur -> curframe ) return false ; if ( old -> speculative &&! cur -> speculative
Buggy code:
 gdImagePtr gdImageCreate ( int sx, int sy ) { int i ; gdImagePtr im ; if ( overflow2 ( sx, sy ) ) { return NULL ; } if ( overflow2 ( sizeof ( unsigned char * ), sy ) ) { return NULL ; } <START_BUG> im = ( gdImage * ) gdCalloc ( 1, sizeof ( gdImage ) ) ; <END_BUG> im -> pixels = ( unsigned char * * ) gdMalloc ( sizeof ( unsigned char * ) * sy ) ; im -> AA_opacity = ( unsigned char * * ) gdMalloc ( sizeof ( unsigned char * ) * sy ) ; im -> polyInts = 0 ; im -> polyAllocated = 0 ; im -> brush = 0 ; im -> tile = 0 ; im -> style = 0 ; for ( i = 0 ; i < sy ; i ++ ) { im -> pixels [ i ] = ( unsigned char * ) gdCalloc ( sx, sizeof ( unsigned char ) ) ; im -> AA_opacity [ i ] = ( unsigned char * ) gdCalloc ( sx, sizeof ( unsigned char ) ) ; } im -> sx = sx ; im -> sy = sy ; im -> colorsTotal = 0 ; im -> transparent = ( - 1 ) ; im -> interlace = 0 ; im -> thick = 1 ; im -> AA = 0 ; im -> AA_polygon = 0 ; for ( i = 0 ; i < gdMaxColors ; i ++ ) { im -> open [ i ] = 1 ; im -> red [ i ] = 0 ; im -> green [ i ] = 0 ; im -> blue [ i ] = 0 ; } im -> trueColor = 0 ; im -> tpixels = 0 ; im -> cx1 = 0 ; im -> cy1 = 0 ; im -> cx2 = im -> sx - 1 ; im -> cy2 = im -> sy - 1 ; im -> interpolation = NULL ; im -> interpolation_id = GD_BILINEAR_FIXED ; return im ; }

Fix:
<S2SV_ModStart> NULL ; } if ( overflow2 ( sizeof ( unsigned char * ), sx ) ) { return NULL ; }
Buggy code:
 int yyparse ( void * yyscanner, HEX_LEX_ENVIRONMENT * lex_env ) { int yychar ; YY_INITIAL_VALUE ( static YYSTYPE yyval_default ; ) YYSTYPE yylval YY_INITIAL_VALUE ( = yyval_default ) ; int yynerrs ; int yystate ; int yyerrstatus ; yytype_int16 yyssa [ YYINITDEPTH ] ; yytype_int16 * yyss ; yytype_int16 * yyssp ; YYSTYPE yyvsa [ YYINITDEPTH ] ; YYSTYPE * yyvs ; YYSTYPE * yyvsp ; YYSIZE_T yystacksize ; int yyn ; int yyresult ; int yytoken = 0 ; YYSTYPE yyval ; # if YYERROR_VERBOSE char yymsgbuf [ 128 ] ; char * yymsg = yymsgbuf ; YYSIZE_T yymsg_alloc = sizeof yymsgbuf ; # endif # define YYPOPSTACK ( N ) ( yyvsp -= ( N ), yyssp -= ( N ) ) int yylen = 0 ; yyssp = yyss = yyssa ; yyvsp = yyvs = yyvsa ; yystacksize = YYINITDEPTH ; YYDPRINTF ( ( stderr, "Starting   parse\\n" ) ) ; yystate = 0 ; yyerrstatus = 0 ; yynerrs = 0 ; yychar = YYEMPTY ; goto yysetstate ; yynewstate : yyssp ++ ; yysetstate : * yyssp = yystate ; if ( yyss + yystacksize - 1 <= yyssp ) { YYSIZE_T yysize = yyssp - yyss + 1 ; # ifdef yyoverflow { YYSTYPE * yyvs1 = yyvs ; yytype_int16 * yyss1 = yyss ; yyoverflow ( YY_ ( "memory   exhausted" ), & yyss1, yysize * sizeof ( * yyssp ), & yyvs1, yysize * sizeof ( * yyvsp ), & yystacksize ) ; yyss = yyss1 ; yyvs = yyvs1 ; } # else # ifndef YYSTACK_RELOCATE goto yyexhaustedlab ; # else if ( YY

Fix:
<S2SV_ModStart> : # line 113 <S2SV_ModEnd> "hex_grammar.y" { RE_AST <S2SV_ModStart> } # line 1337 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 122 <S2SV_ModEnd> "hex_grammar.y" { ( <S2SV_ModStart> } # line 1345 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 126 "hex_grammar.y" { incr_ast_levels ( ) ; <S2SV_ModEnd> ( yyval. <S2SV_ModStart> } # line 1360 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 137 <S2SV_ModEnd> "hex_grammar.y" { RE_NODE <S2SV_ModStart> ]. re_node ) ; incr_ast_levels ( <S2SV_ModStart> } # line 1424 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 201 <S2SV_ModEnd> "hex_grammar.y" { ( <S2SV_ModStart> } # line 1432 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 205 "hex_grammar.y" { incr_ast_levels ( ) ; <S2SV_ModEnd> ( yyval. <S2SV_ModStart> } # line 1447 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 220 <S2SV_ModEnd> "hex_grammar.y" { ( <S2SV_ModStart> } # line 1455 <S2SV_ModEnd> "hex
Buggy code:
 static int update_write_order_info ( rdpContext * context, wStream * s, ORDER_INFO * orderInfo, size_t offset ) { size_t position ; WINPR_UNUSED ( context ) ; position = Stream_GetPosition ( s ) ; Stream_SetPosition ( s, offset ) ; Stream_Write_UINT8 ( s, orderInfo -> controlFlags ) ; if ( orderInfo -> controlFlags & ORDER_TYPE_CHANGE ) Stream_Write_UINT8 ( s, orderInfo -> orderType ) ; update_write_field_flags ( s, orderInfo -> fieldFlags, orderInfo -> controlFlags, <START_BUG> PRIMARY_DRAWING_ORDER_FIELD_BYTES [ orderInfo -> orderType ] ) ; <END_BUG> update_write_bounds ( s, orderInfo ) ; Stream_SetPosition ( s, position ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> controlFlags, get_primary_drawing_order_field_bytes ( <S2SV_ModEnd> orderInfo -> orderType <S2SV_ModStart> orderInfo -> orderType, NULL ) <S2SV_ModEnd> ) ; update_write_bounds
Buggy code:
 static void ImportCbYCrYQuantum ( const Image * image, QuantumInfo * quantum_info, const MagickSizeType number_pixels, const unsigned char * magick_restrict p, Quantum * magick_restrict q, ExceptionInfo * exception ) { QuantumAny range ; register ssize_t x ; unsigned int pixel ; assert ( image!= ( Image * ) NULL ) ; assert ( image -> signature == MagickCoreSignature ) ; switch ( quantum_info -> depth ) { case 10 : { Quantum cbcr [ 4 ] ; pixel = 0 ; if ( quantum_info -> pack == MagickFalse ) { register ssize_t i ; size_t quantum ; ssize_t n ; n = 0 ; quantum = 0 ; <START_BUG> for ( x = 0 ; x < ( ssize_t ) number_pixels ; x += 2 ) <END_BUG> { for ( i = 0 ; i < 4 ; i ++ ) { switch ( n % 3 ) { case 0 : { p = PushLongPixel ( quantum_info -> endian, p, & pixel ) ; quantum = ( size_t ) ( ScaleShortToQuantum ( ( unsigned short ) ( ( ( pixel >> 22 ) & 0x3ff ) << 6 ) ) ) ; break ; } case 1 : { quantum = ( size_t ) ( ScaleShortToQuantum ( ( unsigned short ) ( ( ( pixel >> 12 ) & 0x3ff ) << 6 ) ) ) ; break ; } case 2 : { quantum = ( size_t ) ( ScaleShortToQuantum ( ( unsigned short ) ( ( ( pixel >> 2 ) & 0x3ff ) << 6 ) ) ) ; break ; } } cbcr [ i ] = ( Quantum ) ( quantum ) ; n ++ ; } p += quantum_info -> pad ; SetPixelRed ( image, cbcr [ 1 ], q ) ; SetPixelGreen ( image, cbcr [ 0 ], q ) ; SetPixelBlue ( image, cbcr [ 2 ], q ) ; q += GetPixelChannels ( image ) ; SetPixelRed ( image, cbcr [ 3 ], q ) ; SetPixelGreen ( image, cbcr [ 0 ], q ) ; SetPixelBlue ( image, cbcr [ 2 ], q ) ; q += GetPixelChannels ( image )

Fix:
<S2SV_ModStart> ; x += 4 <S2SV_ModEnd> ) { for
Buggy code:
 int DSA_verify ( int type, const unsigned char * dgst, int dgst_len, const unsigned char * sigbuf, int siglen, DSA * dsa ) { DSA_SIG * s ; <START_BUG> int ret = - 1 ; <END_BUG> s = DSA_SIG_new ( ) ; if ( s == NULL ) return ( ret ) ;  if ( d2i_DSA_SIG ( & s, & sigbuf, siglen ) == NULL ) goto err ; <START_BUG> ret = DSA_do_verify ( dgst, dgst_len, s, dsa ) ; err : <END_BUG> DSA_SIG_free ( s ) ;  return ( ret ) ; }

Fix:
<S2SV_ModStart> * s ; const unsigned char * p = sigbuf ; unsigned char * der = NULL ; int derlen = - 1 ; <S2SV_ModStart> s, & p <S2SV_ModEnd>, siglen ) <S2SV_ModStart> == NULL ) goto err ; derlen = i2d_DSA_SIG ( s, & der ) ; if ( derlen!= siglen || memcmp ( sigbuf, der, derlen ) ) <S2SV_ModStart> ; err : if ( derlen > 0 ) { OPENSSL_cleanse ( der, derlen ) ; OPENSSL_free ( der ) ; }
Buggy code:
 static struct nfs4_state * nfs4_opendata_to_nfs4_state ( struct nfs4_opendata * data ) { struct inode * inode ; struct nfs4_state * state = NULL ; struct nfs_delegation * delegation ; int ret ; if (! data -> rpc_done ) { state = nfs4_try_open_cached ( data ) ; goto out ; } ret = - EAGAIN ; if (! ( data -> f_attr. valid & NFS_ATTR_FATTR ) ) goto err ; inode = nfs_fhget ( data -> dir -> d_sb, & data -> o_res. fh, & data -> f_attr ) ; ret = PTR_ERR ( inode ) ; if ( IS_ERR ( inode ) ) goto err ; ret = - ENOMEM ; state = nfs4_get_open_state ( inode, data -> owner ) ; if ( state == NULL ) goto err_put_inode ; if ( data -> o_res. delegation_type!= 0 ) { int delegation_flags = 0 ; rcu_read_lock ( ) ; delegation = rcu_dereference ( NFS_I ( inode ) -> delegation ) ; if ( delegation ) delegation_flags = delegation -> flags ; rcu_read_unlock ( ) ; if ( ( delegation_flags & 1UL << NFS_DELEGATION_NEED_RECLAIM ) == 0 ) nfs_inode_set_delegation ( state -> inode, data -> owner -> so_cred, & data -> o_res ) ; else nfs_inode_reclaim_delegation ( state -> inode, data -> owner -> so_cred, & data -> o_res ) ; } update_open_stateid ( state, & data -> o_res. stateid, NULL, <START_BUG> data -> o_arg. open_flags ) ; <END_BUG> iput ( inode ) ; out : return state ; err_put_inode : iput ( inode ) ; err : return ERR_PTR ( ret ) ; }

Fix:
<S2SV_ModStart> -> o_arg. fmode <S2SV_ModEnd> ) ; iput
Buggy code:
 static int reverseSamplesBytes ( uint16 spp, uint16 bps, uint32 width, uint8 * src, uint8 * dst ) { int i ; uint32 col, bytes_per_pixel, col_offset ; uint8 bytebuff1 ; unsigned char swapbuff [ 32 ] ; if ( ( src == NULL ) || ( dst == NULL ) ) { TIFFError ( "reverseSamplesBytes", "Invalid   input   or   output   buffer" ) ; return ( 1 ) ; } bytes_per_pixel = ( ( bps * spp ) + 7 ) // 8 ; <START_BUG> switch ( bps // 8 ) <END_BUG> { case 8 : case 4 : case 3 : case 2 : for ( col = 0 ; col < ( width // 2 ) ; col ++ ) { col_offset = col * bytes_per_pixel ; _TIFFmemcpy ( swapbuff, src + col_offset, bytes_per_pixel ) ; _TIFFmemcpy ( src + col_offset, dst - col_offset - bytes_per_pixel, bytes_per_pixel ) ; _TIFFmemcpy ( dst - col_offset - bytes_per_pixel, swapbuff, bytes_per_pixel ) ; } break ; case 1 : for ( col = 0 ; col < ( width // 2 ) ; col ++ ) { for ( i = 0 ; i < spp ; i ++ ) { bytebuff1 = * src ; * src ++ = * ( dst - spp + i ) ; * ( dst - spp + i ) = bytebuff1 ; } dst -= spp ; } break ; default : TIFFError ( "reverseSamplesBytes", "Unsupported   bit   depth   %d", bps ) ; return ( 1 ) ; } return ( 0 ) ; }

Fix:
<S2SV_ModStart> // 8 ; if ( bytes_per_pixel > sizeof ( swapbuff ) ) { TIFFError ( "reverseSamplesBytes", "bytes_per_pixel <S2SV_blank> too <S2SV_blank> large" ) ; return ( 1 ) ; }
Buggy code:
 void WT_Interpolate ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_PCM * pOutputBuffer ; EAS_I32 phaseInc ; EAS_I32 phaseFrac ; EAS_I32 acc0 ; const EAS_SAMPLE * pSamples ; const EAS_SAMPLE * loopEnd ; EAS_I32 samp1 ; EAS_I32 samp2 ; EAS_I32 numSamples ; <START_BUG> numSamples = pWTIntFrame -> numSamples ; <END_BUG> pOutputBuffer = pWTIntFrame -> pAudioBuffer ; loopEnd = ( const EAS_SAMPLE * ) pWTVoice -> loopEnd + 1 ; pSamples = ( const EAS_SAMPLE * ) pWTVoice -> phaseAccum ; phaseFrac = pWTVoice -> phaseFrac ; phaseInc = pWTIntFrame -> frame. phaseIncrement ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif while ( numSamples -- ) { acc0 = samp2 - samp1 ; acc0 = acc0 * phaseFrac ; acc0 = samp1 + ( acc0 >> NUM_PHASE_FRAC_BITS ) ; * pOutputBuffer ++ = ( EAS_I16 ) ( acc0 >> 2 ) ; phaseFrac += phaseInc ; acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS ; if ( acc0 > 0 ) { pSamples += acc0 ; phaseFrac = ( EAS_I32 ) ( ( EAS_U32 ) phaseFrac & PHASE_FRAC_MASK ) ; acc0 = ( EAS_I32 ) ( pSamples - loopEnd ) ; if ( acc0 >= 0 ) pSamples = ( const EAS_SAMPLE * ) pWTVoice -> loopStart + acc0 ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif } } pWTVoice -> phaseAccum = ( EAS

Fix:
<S2SV_ModStart> -> numSamples ; if ( numSamples <= 0 ) { ALOGE ( "b//26366256" ) ; return ; }
Buggy code:
 static int __videobuf_mmap_mapper ( struct videobuf_queue * q, struct vm_area_struct * vma ) { struct videbuf_vmalloc_memory * mem ; struct videobuf_mapping * map ; unsigned int first ; int retval ; unsigned long offset = vma -> vm_pgoff << PAGE_SHIFT ; if (! ( vma -> vm_flags & VM_WRITE ) ||! ( vma -> vm_flags & VM_SHARED ) ) return - EINVAL ; for ( first = 0 ; first < VIDEO_MAX_FRAME ; first ++ ) { if ( NULL == q -> bufs [ first ] ) continue ; if ( V4L2_MEMORY_MMAP!= q -> bufs [ first ] -> memory ) continue ; if ( q -> bufs [ first ] -> boff == offset ) break ; } if ( VIDEO_MAX_FRAME == first ) { dprintk ( 1, "mmap   app   bug:   offset   invalid   [offset=0x%lx]\\n", ( vma -> vm_pgoff << PAGE_SHIFT ) ) ; return - EINVAL ; } <START_BUG> map = q -> bufs [ first ] -> map = kmalloc ( sizeof ( struct videobuf_mapping ), GFP_KERNEL ) ; <END_BUG> if ( NULL == map ) return - ENOMEM ; map -> start = vma -> vm_start ; map -> end = vma -> vm_end ; map -> q = q ; q -> bufs [ first ] -> baddr = vma -> vm_start ; vma -> vm_ops = & videobuf_vm_ops ; vma -> vm_flags |= VM_DONTEXPAND | VM_RESERVED ; vma -> vm_private_data = map ; mem = q -> bufs [ first ] -> priv ; BUG_ON (! mem ) ; MAGIC_CHECK ( mem -> magic, MAGIC_VMAL_MEM ) ; retval = remap_vmalloc_range ( vma, mem -> vmalloc, 0 ) ; if ( retval < 0 ) { dprintk ( 1, "mmap:   postponing   remap_vmalloc_range\\n" ) ; mem -> vma = kmalloc ( sizeof ( * vma ), GFP

Fix:
<S2SV_ModStart> -> map = kzalloc <S2SV_ModEnd> ( sizeof (
Buggy code:
 int evm_update_evmxattr ( struct dentry * dentry, const char * xattr_name, const char * xattr_value, size_t xattr_value_len ) { struct inode * inode = dentry -> d_inode ; struct evm_ima_xattr_data xattr_data ; int rc = 0 ; rc = evm_calc_hmac ( dentry, xattr_name, xattr_value, xattr_value_len, xattr_data. digest ) ; if ( rc == 0 ) { xattr_data. type = EVM_XATTR_HMAC ; rc = __vfs_setxattr_noperm ( dentry, XATTR_NAME_EVM, & xattr_data, sizeof ( xattr_data ), 0 ) ; } <START_BUG> else if ( rc == - ENODATA ) <END_BUG> rc = inode -> i_op -> removexattr ( dentry, XATTR_NAME_EVM ) ;  return rc ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> == - ENODATA && inode -> i_op -> removexattr ) { <S2SV_ModEnd> rc = inode <S2SV_ModStart> XATTR_NAME_EVM ) ; }
Buggy code:
 static void gre_print_0 ( netdissect_options * ndo, const u_char * bp, u_int length ) { u_int len = length ; uint16_t flags, prot ; flags = EXTRACT_16BITS ( bp ) ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, ",   Flags   [%s]", bittok2str ( gre_flag_values, "none", flags ) ) ) ; len -= 2 ; bp += 2 ; ND_TCHECK2 ( * bp, 2 ) ; if ( len < 2 ) goto trunc ; prot = EXTRACT_16BITS ( bp ) ; len -= 2 ; bp += 2 ; if ( ( flags & GRE_CP ) | ( flags & GRE_RP ) ) { ND_TCHECK2 ( * bp, 2 ) ; if ( len < 2 ) goto trunc ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, ",   sum   0x%x", EXTRACT_16BITS ( bp ) ) ) ; bp += 2 ; len -= 2 ; ND_TCHECK2 ( * bp, 2 ) ; if ( len < 2 ) goto trunc ; ND_PRINT ( ( ndo, ",   off   0x%x", EXTRACT_16BITS ( bp ) ) ) ; bp += 2 ; len -= 2 ; } if ( flags & GRE_KP ) { ND_TCHECK2 ( * bp, 4 ) ; if ( len < 4 ) goto trunc ; ND_PRINT ( ( ndo, ",   key=0x%x", EXTRACT_32BITS ( bp ) ) ) ; bp += 4 ; len -= 4 ; } if ( flags & GRE_SP ) { ND_TCHECK2 ( * bp, 4 ) ; if ( len < 4 ) goto trunc ; ND_PRINT ( ( ndo, ",   seq   %u", EXTRACT_32BITS ( bp ) ) ) ; bp += 4 ; len -= 4 ; } if ( flags & GRE_RP ) { for ( ; ; ) { uint16_t af ; uint8_t sreoff ; uint8_t srelen ; ND_TCHECK2 ( * bp, 4 ) ; if ( len < 4 )

Fix:
<S2SV_ModStart> bp, len ) ; break ; case ETHERTYPE_TEB : ether_print ( ndo, bp, len <S2SV_ModStart> ndo_snapend - bp <S2SV_ModEnd>, NULL,
Buggy code:
 GF_Err stbl_GetSampleInfos ( GF_SampleTableBox * stbl, u32 sampleNumber, u64 * offset, u32 * chunkNumber, u32 * descIndex, GF_StscEntry * * out_ent ) { GF_Err e ; u32 i, k, offsetInChunk, size, chunk_num ; GF_ChunkOffsetBox * stco ; GF_ChunkLargeOffsetBox * co64 ; GF_StscEntry * ent ; ( * offset ) = 0 ; ( * chunkNumber ) = ( * descIndex ) = 0 ; if ( out_ent ) ( * out_ent ) = NULL ; if (! stbl ||! sampleNumber ) return GF_BAD_PARAM ; if (! stbl -> ChunkOffset ||! stbl -> SampleToChunk ||! stbl -> SampleSize ) return GF_ISOM_INVALID_FILE ; if ( stbl -> SampleSize && stbl -> SampleToChunk -> nb_entries == stbl -> SampleSize -> sampleCount ) { ent = & stbl -> SampleToChunk -> entries [ sampleNumber - 1 ] ; if (! ent ) return GF_BAD_PARAM ; ( * descIndex ) = ent -> sampleDescriptionIndex ; ( * chunkNumber ) = sampleNumber ; if ( out_ent ) * out_ent = ent ; if ( stbl -> ChunkOffset -> type == GF_ISOM_BOX_TYPE_STCO ) { stco = ( GF_ChunkOffsetBox * ) stbl -> ChunkOffset ; if (! stco -> offsets ) return GF_ISOM_INVALID_FILE ; <START_BUG> ( * offset ) = ( u64 ) stco -> offsets [ sampleNumber - 1 ] ; <END_BUG> } else { co64 = ( GF_ChunkLargeOffsetBox * ) stbl -> ChunkOffset ;  if (! co64 -> offsets ) return GF_ISOM_INVALID_FILE ; <START_BUG> ( * offset ) = co64 -> offsets [ sampleNumber - 1 ] ; } return GF_OK ; } if ( stbl -> SampleToChunk -> firstSampleInCurrentChunk && ( stbl -> SampleToChunk -> firstSampleInCurrentChunk <= sampleNumber ) ) { i = stbl -> SampleToChunk -> currentIndex ; ent = & stbl -> SampleToChunk -> entries [ stbl -> SampleToChunk -> currentIndex<END_BUG>

Fix:
<S2SV_ModStart> return GF_ISOM_INVALID_FILE ; if ( stco -> nb_entries < sampleNumber ) return GF_ISOM_INVALID_FILE ; <S2SV_ModStart> co64 -> offsets ) return GF_ISOM_INVALID_FILE ; if ( co64 -> nb_entries < sampleNumber
Buggy code:
 static void settings_init ( void ) { settings. use_cas = true ; settings. access = 0700 ; settings. port = 11211 ; <START_BUG> settings. udpport = 11211 ; <END_BUG> settings. inter = NULL ; settings. maxbytes = 64 * 1024 * 1024 ; settings. maxconns = 1024 ; settings. verbose = 0 ; settings. oldest_live = 0 ; settings. oldest_cas = 0 ; settings. evict_to_free = 1 ; settings. socketpath = NULL ; settings. factor = 1.25 ; settings. chunk_size = 48 ; settings. num_threads = 4 ; settings. num_threads_per_udp = 0 ; settings. prefix_delimiter = ':' ; settings. detail_enabled = 0 ; settings. reqs_per_event = 20 ; settings. backlog = 1024 ; settings. binding_protocol = negotiating_prot ; settings. item_size_max = 1024 * 1024 ; settings. slab_page_size = 1024 * 1024 ; settings. slab_chunk_size_max = settings. slab_page_size // 2 ; settings. sasl = false ; settings. maxconns_fast = true ; settings. lru_crawler = false ; settings. lru_crawler_sleep = 100 ; settings. lru_crawler_tocrawl = 0 ; settings. lru_maintainer_thread = false ; settings. lru_segmented = true ; settings. hot_lru_pct = 20 ; settings. warm_lru_pct = 40 ; settings. hot_max_factor = 0.2 ; settings. warm_max_factor = 2.0 ; settings. inline_ascii_response = false ; settings. temp_lru = false ; settings. temporary_ttl = 61 ; settings. idle_timeout = 0 ; settings. hashpower_init = 0 ; settings. slab_reassign = true ; settings. slab_automove = 1 ; settings. slab_automove_ratio = 0.8 ; settings. slab_automove_window = 30 ; settings. shutdown_command = false ; settings. tail_repair_time = TAIL_REPAIR_TIME_DEFAULT ; settings. flush_enabled = true ; settings. dump_enabled = true ; settings. crawls_persleep = 1000 ; settings. logger_watcher_buf_size = LOGGER_WATCHER_BU

Fix:
<S2SV_ModStart>. udpport = 0 <S2SV_ModEnd> ; settings.
Buggy code:
 ssize_t socket_read ( const socket_t * socket, void * buf, size_t count ) { assert ( socket!= NULL ) ; assert ( buf!= NULL ) ; <START_BUG> return recv ( socket -> fd, buf, count, MSG_DONTWAIT ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, MSG_DONTWAIT ) )
Buggy code:
 <START_BUG> static void update_state_rt ( VP9_COMP * cpi, PICK_MODE_CONTEXT * ctx, <END_BUG> int mi_row, int mi_col, int bsize ) { VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; <END_BUG> MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ;  const struct segmentation * const seg = & cm -> seg ; <START_BUG> * ( xd -> mi [ 0 ] ) = ctx -> mic ; <END_BUG>  if ( ( cpi -> oxcf. aq_mode == CYCLIC_REFRESH_AQ ) && seg -> enabled ) { <START_BUG> <END_BUG> vp9_cyclic_refresh_update_segment ( cpi, & xd -> mi [ 0 ] -> mbmi,  <START_BUG> mi_row, mi_col, bsize, 1 ) ; <END_BUG> vp9_init_plane_quantizers ( cpi, x ) ; } if ( is_inter_block ( mbmi ) ) {  vp9_update_mv_count ( cm, xd ) ; <START_BUG> if ( cm -> interp_filter == SWITCHABLE ) { const int pred_ctx = vp9_get_pred_context_switchable_interp ( xd ) ; <END_BUG> ++ cm -> counts. switchable_interp [ pred_ctx ] [ mbmi -> interp_filter ] ;  } <START_BUG> } <END_BUG> x -> skip = ctx -> skip ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> -> e_mbd ; MODE_INFO * const mi = xd -> mi [ 0 ] ; <S2SV_ModStart> -> seg ; const int bw = num_8x8_blocks_wide_lookup [ mi -> mbmi. sb_type ] ; const int bh = num_8x8_blocks_high_lookup [ mi -> mbmi. sb_type ] ; const int x_mis = MIN ( bw, cm -> mi_cols - mi_col ) ; const int y_mis = MIN ( bh, cm -> mi_rows - mi_row ) ; <S2SV_ModStart> -> mic ; * ( x -> mbmi_ext ) = ctx -> mbmi_ext ; if ( seg -> enabled && cpi -> oxcf. aq_mode ) { if <S2SV_ModEnd> ( cpi -> <S2SV_ModStart>. aq_mode == COMPLEXITY_AQ || cpi -> oxcf. aq_mode == VARIANCE_AQ ) { const uint8_t * const map = seg -> update_map? cpi -> segmentation_map : cm -> last_frame_seg_map ; mbmi ->
Buggy code:
 static int sctp_process_param ( struct sctp_association * asoc, union sctp_params param, const union sctp_addr * peer_addr, gfp_t gfp ) { struct net * net = sock_net ( asoc -> base. sk ) ; union sctp_addr addr ; int i ; __u16 sat ; int retval = 1 ; sctp_scope_t scope ; time_t stale ; struct sctp_af * af ; union sctp_addr_param * addr_param ; struct sctp_transport * t ; struct sctp_endpoint * ep = asoc -> ep ; switch ( param. p -> type ) { case SCTP_PARAM_IPV6_ADDRESS : if ( PF_INET6!= asoc -> base. sk -> sk_family ) break ; goto do_addr_param ; case SCTP_PARAM_IPV4_ADDRESS : if ( ipv6_only_sock ( asoc -> base. sk ) ) break ; do_addr_param : af = sctp_get_af_specific ( param_type2af ( param. p -> type ) ) ; af -> from_addr_param ( & addr, param. addr, htons ( asoc -> peer. port ), 0 ) ; scope = sctp_scope ( peer_addr ) ; if ( sctp_in_scope ( net, & addr, scope ) ) if (! sctp_assoc_add_peer ( asoc, & addr, gfp, SCTP_UNCONFIRMED ) ) return 0 ; break ; case SCTP_PARAM_COOKIE_PRESERVATIVE : if (! net -> sctp. cookie_preserve_enable ) break ; stale = ntohl ( param. life -> lifespan_increment ) ; asoc -> cookie_life = ktime_add_ms ( asoc -> cookie_life, stale ) ; break ; case SCTP_PARAM_HOST_NAME_ADDRESS : pr_debug ( "%s:   unimplemented   SCTP_HOST_NAME_ADDRESS\\n", __func__ ) ; break ; case SCTP_PARAM_SUPPORTED_ADDRESS_TYPES : asoc -> peer. ipv4_address = 0 ; asoc -> peer. ipv6_address = 0 ; if ( peer_addr -> sa.

Fix:
<S2SV_ModStart> ) ) ; if ( af == NULL ) break ;
Buggy code:
 static int <START_BUG> mptctl_hp_hostinfo ( unsigned long arg, unsigned int data_size ) <END_BUG> { hp_host_info_t __user * uarg = ( void __user * ) arg ;  MPT_ADAPTER * ioc ; <START_BUG> struct pci_dev * pdev ; char * pbuf = NULL ; dma_addr_t buf_dma ; hp_host_info_t karg ; CONFIGPARMS cfg ; <END_BUG> ConfigPageHeader_t hdr ;  int iocnum ; int rc, cim_rev ; ToolboxIstwiReadWriteRequest_t * IstwiRWRequest ; MPT_FRAME_HDR * mf = NULL ; unsigned long timeleft ; int retval ; u32 msgcontext ; if ( data_size == sizeof ( hp_host_info_t ) ) cim_rev = 1 ; else if ( data_size == sizeof ( hp_host_info_rev0_t ) ) cim_rev = 0 ; else return - EFAULT ; if ( copy_from_user ( & karg, uarg, sizeof ( hp_host_info_t ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_hp_host_info   -   " "Unable   to   read   in   hp_host_info   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; return - EFAULT ; } <START_BUG> if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || <END_BUG> ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_hp_hostinfo()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT ":   mptctl_hp_hostinfo   called.\\n", ioc -> name ) ) ; pdev = ( struct pci_dev * ) ioc -> pcidev ; karg. vendor = pdev -> vendor ; karg. device = pdev -> device ; karg

Fix:
<S2SV_ModStart> int mptctl_hp_hostinfo ( MPT_ADAPTER * ioc, <S2SV_ModStart> ) arg ; <S2SV_ModEnd> struct pci_dev * <S2SV_ModStart> ; ConfigPageHeader_t hdr <S2SV_ModEnd> ; int rc <S2SV_ModStart> EFAULT ; } <S2SV_ModEnd> dctlprintk ( ioc
Buggy code:
 <START_BUG> static int cost_mv_ref ( const VP9_COMP * cpi, MB_PREDICTION_MODE mode, <END_BUG>  int mode_context ) { <START_BUG> const MACROBLOCK * const x = & cpi -> mb ; const int segment_id = x -> e_mbd. mi [ 0 ] -> mbmi. segment_id ; if (! vp9_segfeature_active ( & cpi -> common. seg, segment_id, SEG_LVL_SKIP ) ) { assert ( is_inter_mode ( mode ) ) ; <END_BUG> return x -> inter_mode_cost [ mode_context ] [ INTER_OFFSET ( mode ) ] ;  <START_BUG> } else { <END_BUG> return 0 ; } }

Fix:
<S2SV_ModStart> * cpi, PREDICTION_MODE <S2SV_ModEnd> mode, int <S2SV_ModStart>, int mode_context <S2SV_ModEnd> ) { assert <S2SV_ModStart> ) ; return cpi <S2SV_ModEnd> -> inter_mode_cost [ <S2SV_ModStart> ] ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int mingw_rmdir ( const char * pathname ) { int ret, tries = 0 ; wchar_t wpathname [ MAX_PATH ] ; if ( xutftowcs_path ( wpathname, pathname ) < 0 ) return - 1 ; while ( ( ret = _wrmdir ( wpathname ) ) == - 1 && tries < ARRAY_SIZE ( delay ) ) { if (! is_file_in_use_error ( GetLastError ( ) ) ) errno = err_win_to_posix ( GetLastError ( ) ) ; if ( errno!= EACCES ) break ; if (! is_dir_empty ( wpathname ) ) { errno = ENOTEMPTY ; break ; } Sleep ( delay [ tries ] ) ; tries ++ ; } while ( ret == - 1 && errno == EACCES && is_file_in_use_error ( GetLastError ( ) ) && ask_yes_no_if_possible ( "Deletion   of   directory   \'%s\'   failed.   " "Should   I   try   again?", pathname ) ) ret = _wrmdir ( wpathname ) ; <START_BUG> return ret ; <END_BUG> }

Fix:
<S2SV_ModStart> wpathname ) ; if (! ret ) invalidate_lstat_cache ( ) ;
Buggy code:
 static int print_bacp_config_options ( netdissect_options * ndo, const u_char * p, int length ) { int len, opt ; if ( length < 2 ) return 0 ; ND_TCHECK2 ( * p, 2 ) ; len = p [ 1 ] ; opt = p [ 0 ] ; if ( length < len ) return 0 ; if ( len < 2 ) { ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u   (length   bogus,   should   be   >=   2)", tok2str ( bacconfopts_values, "Unknown", opt ), opt, len ) ) ; return 0 ; } ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u", tok2str ( bacconfopts_values, "Unknown", opt ), opt, len ) ) ; switch ( opt ) { case BACPOPT_FPEER : if ( len!= 6 ) { ND_PRINT ( ( ndo, "   (length   bogus,   should   be   =   6)" ) ) ; return len ; } <START_BUG> ND_TCHECK2 ( * ( p + 2 ), 4 ) ; <END_BUG> ND_PRINT ( ( ndo, ":   Magic-Num   0x%08x", EXTRACT_32BITS ( p + 2 ) ) ) ; break ; default : if ( ndo -> ndo_vflag < 2 ) print_unknown_data ( ndo, & p [ 2 ], "\\n\\t         ", len - 2 ) ; break ; } if ( ndo -> ndo_vflag > 1 ) print_unknown_data ( ndo, & p [ 2 ], "\\n\\t         ", len - 2 ) ; return len ; trunc : ND_PRINT ( ( ndo, "[|bacp]" ) ) ; return 0 ; }

Fix:
<S2SV_ModStart> len ; } ND_TCHECK_32BITS <S2SV_ModEnd> ( p + <S2SV_ModStart> p + 2 <S2SV_ModEnd> ) ; ND_PRINT
Buggy code:
 static Image * ReadMPCImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char cache_filename [ MagickPathExtent ], id [ MagickPathExtent ], keyword [ MagickPathExtent ], * options ; const unsigned char * p ; GeometryInfo geometry_info ; Image * image ; int c ; LinkedListInfo * profiles ; MagickBooleanType status ; MagickOffsetType offset ; MagickStatusType flags ; register ssize_t i ; size_t depth, length ; ssize_t count ; StringInfo * profile ; unsigned int signature ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) CopyMagickString ( cache_filename, image -> filename, MagickPathExtent ) ; AppendImageFormat ( "cache", cache_filename ) ; c = ReadBlobByte ( image ) ; if ( c == EOF ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } * id = '\\0' ; ( void ) ResetMagickMemory ( keyword, 0, sizeof ( keyword ) ) ; offset = 0 ; do { profiles = ( LinkedListInfo * ) NULL ; length = MagickPathExtent ; options = AcquireString ( ( char * ) NULL ) ; signature = GetMagickSignature ( ( const StringInfo * ) NULL ) ; image -> depth = 8 ; image -> compression = NoCompression ; while ( ( isgraph ( c )!= MagickFalse ) && ( c!= ( int ) ':' ) ) { register char * p ; if ( c == ( int ) '{' ) { char * comment ; length = MagickPathExtent ; comment = AcquireString ( ( char * ) NULL ) ; for ( p = comment ; comment!= ( char *

Fix:
<S2SV_ModStart> options ) ; if ( image -> number_meta_channels > MaxPixelChannels ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ;
Buggy code:
 <START_BUG> static char * print_value ( cJSON * item, int depth, int fmt ) <END_BUG> { char * out = 0 ; if (! item )  return 0 ; <START_BUG> switch ( ( item -> type ) & 255 ) { <END_BUG> case cJSON_NULL : out = cJSON_strdup ( "null" ) ; break ;  case cJSON_False : out = cJSON_strdup ( "false" ) ; break ; case cJSON_True : out = cJSON_strdup ( "true" ) ; break ; <START_BUG> case cJSON_Number : out = print_number ( item ) ; break ; <END_BUG>  case cJSON_String : out = print_string ( item ) ; break ; <START_BUG> <END_BUG> case cJSON_Array : out = print_array ( item, depth, fmt ) ; break ;  <START_BUG> case cJSON_Object : out = print_object ( item, depth, fmt ) ; break ; <END_BUG> } return out ; }

Fix:
<S2SV_ModStart>, int fmt, printbuffer * p <S2SV_ModStart> return 0 ; if ( p ) { <S2SV_ModStart> case cJSON_NULL : { out = ensure ( p, 5 ) ; if ( out ) strcpy ( out, "null" ) ; break ; } case cJSON_False : { out = ensure ( p, 6 ) ; if ( out ) strcpy ( out, "false" ) ; break ; } case cJSON_True : { out = ensure ( p, 5 ) ; if ( out ) strcpy ( out, "true" ) ; break ; } case cJSON_Number : out = print_number ( item, p ) ; break ; case cJSON_String : out = print_string ( item, p ) ; break ; case cJSON_Array : out = print_array ( item, depth, fmt, p ) ; break ; case cJSON_Object : out = print_object ( item, depth, fmt, p ) ; break ; } } else { switch ( ( item -> type ) & 255 ) { case cJSON_NULL : <S2SV_ModStart> print_number ( item, 0 <S2SV_ModStart> print_string ( item, 0 <S2SV_ModStart> depth, fmt, 0 <S2SV_ModStart> depth, fmt, 0
Buggy code:
 void mm_release ( struct task_struct * tsk, struct mm_struct * mm ) { <START_BUG> struct completion * vfork_done = tsk -> vfork_done ; <END_BUG> deactivate_mm ( tsk, mm ) ; if ( vfork_done ) { tsk -> vfork_done = NULL ; complete ( vfork_done ) ; } if ( tsk -> clear_child_tid &&! ( tsk -> flags & PF_SIGNALED ) && atomic_read ( & mm -> mm_users ) > 1 ) { u32 __user * tidptr = tsk -> clear_child_tid ; tsk -> clear_child_tid = NULL ; put_user ( 0, tidptr ) ; sys_futex ( tidptr, FUTEX_WAKE, 1, NULL, NULL, 0 ) ; } }

Fix:
<S2SV_ModStart> -> vfork_done ; # ifdef CONFIG_FUTEX if ( unlikely ( tsk -> robust_list ) ) exit_robust_list ( tsk ) ; # ifdef CONFIG_COMPAT if ( unlikely ( tsk -> compat_robust_list ) ) compat_exit_robust_list ( tsk ) ; # endif # endif
Buggy code:
 static ssize_t aio_setup_single_vector ( struct kiocb * kiocb, int rw, char __user * buf, unsigned long * nr_segs, size_t len, <START_BUG> struct iovec * iovec ) <END_BUG> { if ( unlikely (! access_ok (! rw, buf, len ) ) ) return - EFAULT ; iovec -> iov_base = buf ; iovec -> iov_len = len ; * nr_segs = 1 ;  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> iovec * iovec, struct iov_iter * iter ) { if ( len > MAX_RW_COUNT ) len = MAX_RW_COUNT ; <S2SV_ModEnd> if ( unlikely <S2SV_ModStart> = 1 ; iov_iter_init ( iter, rw, iovec, * nr_segs, len ) ;
Buggy code:
 static GstFlowReturn gst_asf_demux_process_ext_content_desc ( GstASFDemux * demux, guint8 * data, guint64 size ) { GstTagList * taglist ; guint16 blockcount, i ; gboolean content3D = FALSE ; struct { const gchar * interleave_name ; GstASF3DMode interleaving_type ; } stereoscopic_layout_map [ ] = { { "SideBySideRF", GST_ASF_3D_SIDE_BY_SIDE_HALF_RL }, { "SideBySideLF", GST_ASF_3D_SIDE_BY_SIDE_HALF_LR }, { "OverUnderRT", GST_ASF_3D_TOP_AND_BOTTOM_HALF_RL }, { "OverUnderLT", GST_ASF_3D_TOP_AND_BOTTOM_HALF_LR }, { "DualStream", GST_ASF_3D_DUAL_STREAM } } ; GST_INFO_OBJECT ( demux, "object   is   an   extended   content   description" ) ; taglist = gst_tag_list_new_empty ( ) ; if ( size < 2 ) goto not_enough_data ; blockcount = gst_asf_demux_get_uint16 ( & data, & size ) ; for ( i = 1 ; i <= blockcount ; ++ i ) { const gchar * gst_tag_name ; guint16 datatype ; guint16 value_len ; guint16 name_len ; GValue tag_value = { 0, } ; gsize in, out ; gchar * name ; gchar * name_utf8 = NULL ; gchar * value ; if (! gst_asf_demux_get_string ( & name, & name_len, & data, & size ) ) goto not_enough_data ; if ( size < 2 ) { g_free ( name ) ; goto not_enough_data ; } datatype = gst_asf_demux_get_uint16 ( & data, & size ) ; if (! gst_asf_demux_get_string (

Fix:
<S2SV_ModStart> { guint uint_val ; if ( value_len < 4 ) break ; uint_val <S2SV_ModStart> { gboolean bool_val ; if ( value_len < 4 ) break ; bool_val
Buggy code:
 static int __rds_rdma_map ( struct rds_sock * rs, struct rds_get_mr_args * args, u64 * cookie_ret, struct rds_mr * * mr_ret ) { struct rds_mr * mr = NULL, * found ; unsigned int nr_pages ; struct page * * pages = NULL ; struct scatterlist * sg ; void * trans_private ; unsigned long flags ; rds_rdma_cookie_t cookie ; unsigned int nents ; long i ; int ret ; <START_BUG> if ( rs -> rs_bound_addr == 0 ) { <END_BUG> ret = - ENOTCONN ; goto out ; } if (! rs -> rs_transport -> get_mr ) { ret = - EOPNOTSUPP ; goto out ; } nr_pages = rds_pages_in_vec ( & args -> vec ) ; if ( nr_pages == 0 ) { ret = - EINVAL ; goto out ; } if ( ( nr_pages - 1 ) > ( RDS_MAX_MSG_SIZE >> PAGE_SHIFT ) ) { ret = - EMSGSIZE ; goto out ; } rdsdebug ( "RDS:   get_mr   addr   %llx   len   %llu   nr_pages   %u\\n", args -> vec. addr, args -> vec. bytes, nr_pages ) ; pages = kcalloc ( nr_pages, sizeof ( struct page * ), GFP_KERNEL ) ; if (! pages ) { ret = - ENOMEM ; goto out ; } mr = kzalloc ( sizeof ( struct rds_mr ), GFP_KERNEL ) ; if (! mr ) { ret = - ENOMEM ; goto out ; } refcount_set ( & mr -> r_refcount, 1 ) ; RB_CLEAR_NODE ( & mr -> r_rb_node ) ; mr -> r_trans = rs -> rs_transport ; mr -> r_sock = rs ; if ( args -> flags & RDS_RDMA_USE_ONCE ) mr -> r_use_once = 1 ; if ( args -> flags & RDS_RDMA_INVALIDATE ) mr -> r_invalidate = 1 ; if ( args -> flags & RDS_RDMA_READWRITE ) mr -> r_write = 1 ; ret = rds_pin_pages ( args -> vec. addr

Fix:
<S2SV_ModStart> rs_bound_addr == 0 ||! rs -> rs_transport
Buggy code:
 static void mpage_put_bnr_to_bhs ( struct mpage_da_data * mpd, sector_t logical, struct buffer_head * exbh ) { struct inode * inode = mpd -> inode ; struct address_space * mapping = inode -> i_mapping ; int blocks = exbh -> b_size >> inode -> i_blkbits ; sector_t pblock = exbh -> b_blocknr, cur_logical ; struct buffer_head * head, * bh ; pgoff_t index, end ; struct pagevec pvec ; int nr_pages, i ; index = logical >> ( PAGE_CACHE_SHIFT - inode -> i_blkbits ) ; end = ( logical + blocks - 1 ) >> ( PAGE_CACHE_SHIFT - inode -> i_blkbits ) ; cur_logical = index << ( PAGE_CACHE_SHIFT - inode -> i_blkbits ) ; pagevec_init ( & pvec, 0 ) ; while ( index <= end ) { nr_pages = pagevec_lookup ( & pvec, mapping, index, PAGEVEC_SIZE ) ; if ( nr_pages == 0 ) break ; for ( i = 0 ; i < nr_pages ; i ++ ) { struct page * page = pvec. pages [ i ] ; index = page -> index ; if ( index > end ) break ; index ++ ; BUG_ON (! PageLocked ( page ) ) ; BUG_ON ( PageWriteback ( page ) ) ; BUG_ON (! page_has_buffers ( page ) ) ; bh = page_buffers ( page ) ; head = bh ; do { if ( cur_logical >= logical ) break ; cur_logical ++ ; } while ( ( bh = bh -> b_this_page )!= head ) ; do { if ( cur_logical >= logical + blocks ) break ; if ( buffer_delay ( bh ) || buffer_unwritten ( bh ) ) { BUG_ON ( bh -> b_bdev!= inode -> i_sb -> s_bdev ) ; if ( buffer_delay ( bh ) ) { clear_buffer_delay ( bh ) ; bh -> b_blocknr = pblock ; } else { clear_buffer_unwritten ( bh ) ; BUG_ON ( bh -> b_blocknr!= pblock ) ; } }

Fix:
<S2SV_ModStart> pblock ) ; if ( buffer_uninit ( exbh ) ) set_buffer_uninit ( bh ) ;