nus-yam/ex-repair huggingface dataset:
Buggy code:
 PHPAPI PHP_FUNCTION ( fread ) { zval * arg1 ; long len ; php_stream * stream ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "rl", & arg1, & len ) == FAILURE ) { RETURN_FALSE ; } PHP_STREAM_TO_ZVAL ( stream, & arg1 ) ; if ( len <= 0 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Length   parameter   must   be   greater   than   0" ) ; RETURN_FALSE ; } <START_BUG> Z_STRVAL_P ( return_value ) = emalloc ( len + 1 ) ; <END_BUG> Z_STRLEN_P ( return_value ) = php_stream_read ( stream, Z_STRVAL_P ( return_value ), len ) ; Z_STRVAL_P ( return_value ) [ Z_STRLEN_P ( return_value ) ] = 0 ; Z_TYPE_P ( return_value ) = IS_STRING ; }

Fix:
<S2SV_ModStart> RETURN_FALSE ; } if ( len > INT_MAX ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Length <S2SV_blank> parameter <S2SV_blank> must <S2SV_blank> be <S2SV_blank> no <S2SV_blank> more <S2SV_blank> than <S2SV_blank> %d", INT_MAX ) ; RETURN_FALSE ; }
Buggy code:
 void vp9_get_tile_n_bits ( int mi_cols, int * min_log2_tile_cols, int * max_log2_tile_cols ) { <START_BUG> const int sb_cols = mi_cols_aligned_to_sb ( mi_cols ) >> MI_BLOCK_SIZE_LOG2 ; <END_BUG>  int min_log2 = 0, max_log2 = 0 ; <START_BUG> while ( ( sb_cols >> max_log2 ) >= MIN_TILE_WIDTH_B64 ) ++ max_log2 ; -- max_log2 ; if ( max_log2 < 0 ) max_log2 = 0 ; while ( ( MAX_TILE_WIDTH_B64 << min_log2 ) < sb_cols ) ++ min_log2 ; assert ( min_log2 <= max_log2 ) ; <END_BUG> * min_log2_tile_cols = min_log2 ;  <START_BUG> * max_log2_tile_cols = max_log2 ; <END_BUG> }

Fix:
<S2SV_ModStart> { const int sb64_cols <S2SV_ModEnd> = mi_cols_aligned_to_sb ( <S2SV_ModStart> >> MI_BLOCK_SIZE_LOG2 ; <S2SV_ModEnd> * min_log2_tile_cols = <S2SV_ModStart> * min_log2_tile_cols = get_min_log2_tile_cols ( sb64_cols ) <S2SV_ModEnd> ; * max_log2_tile_cols <S2SV_ModStart> * max_log2_tile_cols = get_max_log2_tile_cols ( sb64_cols ) ; assert ( * min_log2_tile_cols <= * max_log2_tile_cols ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static void dissect_rpcap_packet ( tvbuff_t * tvb, packet_info * pinfo, proto_tree * top_tree, proto_tree * parent_tree, gint offset, proto_item * top_item ) { proto_tree * tree ; proto_item * ti ; nstime_t ts ; tvbuff_t * new_tvb ; guint caplen, len, frame_no ; <START_BUG> gint reported_length_remaining ; <END_BUG> ti = proto_tree_add_item ( parent_tree, hf_packet, tvb, offset, 20, ENC_NA ) ; tree = proto_item_add_subtree ( ti, ett_packet ) ; ts. secs = tvb_get_ntohl ( tvb, offset ) ; ts. nsecs = tvb_get_ntohl ( tvb, offset + 4 ) * 1000 ; proto_tree_add_time ( tree, hf_timestamp, tvb, offset, 8, & ts ) ; offset += 8 ; caplen = tvb_get_ntohl ( tvb, offset ) ; ti = proto_tree_add_item ( tree, hf_caplen, tvb, offset, 4, ENC_BIG_ENDIAN ) ; offset += 4 ; len = tvb_get_ntohl ( tvb, offset ) ; proto_tree_add_item ( tree, hf_len, tvb, offset, 4, ENC_BIG_ENDIAN ) ; offset += 4 ; frame_no = tvb_get_ntohl ( tvb, offset ) ; proto_tree_add_item ( tree, hf_npkt, tvb, offset, 4, ENC_BIG_ENDIAN ) ; offset += 4 ; proto_item_append_text ( ti, ",   Frame   %u", frame_no ) ; proto_item_append_text ( top_item, "   Frame   %u", frame_no ) ; reported_length_remaining = tvb_reported_length_remaining ( tvb, offset ) ; if ( caplen > ( guint ) reported_length_remaining ) { expert_add_info ( pinfo, ti, & ei_caplen_too_big ) ; return ; } new_tvb = tv

Fix:
<S2SV_ModStart> ; gint reported_length_remaining ; struct eth_phdr eth ; void * phdr <S2SV_ModStart> WTAP_ENCAP_UNKNOWN ) { switch ( linktype ) { case WTAP_ENCAP_ETHERNET : eth. fcs_len = - 1 ; phdr = & eth ; break ; default : phdr = NULL ; break ; } dissector_try_uint_new <S2SV_ModEnd> ( wtap_encap_dissector_table, <S2SV_ModStart> pinfo, top_tree, TRUE, phdr
Buggy code:
 static int PyMemoTable_Set ( PyMemoTable * self, PyObject * key, Py_ssize_t value ) { PyMemoEntry * entry ; assert ( key!= NULL ) ; entry = _PyMemoTable_Lookup ( self, key ) ; if ( entry -> me_key!= NULL ) { entry -> me_value = value ; return 0 ; } Py_INCREF ( key ) ; entry -> me_key = key ; entry -> me_value = value ; self -> mt_used ++ ; <START_BUG> if (! ( self -> mt_used * 3 >= ( self -> mt_mask + 1 ) * 2 ) ) <END_BUG> return 0 ;  return _PyMemoTable_ResizeTable ( self, <START_BUG> <END_BUG> ( self -> mt_used > 50000? 2 : 4 ) * self -> mt_used ) ;  }

Fix:
<S2SV_ModStart> ; if ( SIZE_MAX // 3 >= self -> mt_used && <S2SV_ModEnd> self -> mt_used <S2SV_ModStart> mt_used * 3 < self -> mt_allocated <S2SV_ModEnd> * 2 ) <S2SV_ModStart> * 2 ) { <S2SV_ModEnd> return 0 ; <S2SV_ModStart> return 0 ; } size_t desired_size = <S2SV_ModEnd> ( self -> <S2SV_ModStart> self -> mt_used ; return _PyMemoTable_ResizeTable ( self, desired_size
Buggy code:
 static int stv06xx_isoc_init ( struct gspca_dev * gspca_dev ) <START_BUG> { <END_BUG> struct usb_host_interface * alt ; struct sd * sd = ( struct sd * ) gspca_dev ;  alt = & gspca_dev -> dev -> actconfig -> intf_cache [ 0 ] -> altsetting [ 1 ] ; <START_BUG> alt -> endpoint [ 0 ]. desc. wMaxPacketSize = cpu_to_le16 ( sd -> sensor -> max_packet_size [ gspca_dev -> curr_mode ] ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> gspca_dev ) { struct usb_interface_cache * intfc ; <S2SV_ModStart> ) gspca_dev ; intfc = <S2SV_ModEnd> gspca_dev -> dev <S2SV_ModStart> [ 0 ] ; if ( intfc -> num_altsetting < 2 ) return - ENODEV ; alt = & intfc <S2SV_ModStart> [ 1 ] ; if ( alt -> desc. bNumEndpoints < 1 ) return - ENODEV
Buggy code:
 WORD32 ih264d_start_of_pic ( dec_struct_t * ps_dec, WORD32 i4_poc, pocstruct_t * ps_temp_poc, UWORD16 u2_frame_num, dec_pic_params_t * ps_pps ) { pocstruct_t * ps_prev_poc = & ps_dec -> s_cur_pic_poc ; pocstruct_t * ps_cur_poc = ps_temp_poc ; pic_buffer_t * pic_buf ; ivd_video_decode_op_t * ps_dec_output = ( ivd_video_decode_op_t * ) ps_dec -> pv_dec_out ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; dec_seq_params_t * ps_seq = ps_pps -> ps_sps ; UWORD8 u1_bottom_field_flag = ps_cur_slice -> u1_bottom_field_flag ; UWORD8 u1_field_pic_flag = ps_cur_slice -> u1_field_pic_flag ; high_profile_tools_t s_high_profile ; WORD32 ret ; H264_MUTEX_LOCK ( & ps_dec -> process_disp_mutex ) ; ps_prev_poc -> i4_pic_order_cnt_lsb = ps_cur_poc -> i4_pic_order_cnt_lsb ; ps_prev_poc -> i4_pic_order_cnt_msb = ps_cur_poc -> i4_pic_order_cnt_msb ; ps_prev_poc -> i4_delta_pic_order_cnt_bottom = ps_cur_poc -> i4_delta_pic_order_cnt_bottom ; ps_prev_poc -> i4_delta_pic_order_cnt [ 0 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 0 ] ; ps_prev_poc -> i4_delta_pic_order_cnt [ 1 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 1 ] ; ps_prev_

Fix:
<S2SV_ModStart> -> pu4_wts_ofsts_mat ; ps_dec -> u4_first_slice_in_pic = 0 ;
Buggy code:
 <START_BUG> static void __update_open_stateid ( struct nfs4_state * state, nfs4_stateid * open_stateid, const nfs4_stateid * deleg_stateid, int open_flags ) <END_BUG> { write_seqlock ( & state -> seqlock ) ; if ( deleg_stateid!= NULL ) { memcpy ( state -> stateid. data, deleg_stateid -> data, sizeof ( state -> stateid. data ) ) ; set_bit ( NFS_DELEGATED_STATE, & state -> flags ) ; } if ( open_stateid!= NULL )  nfs_set_open_stateid_locked ( state, open_stateid, open_flags ) ; <START_BUG> write_sequnlock ( & state -> seqlock ) ; spin_lock ( & state -> owner -> so_lock ) ; <END_BUG> update_open_stateflags ( state, open_flags ) ;  spin_unlock ( & state -> owner -> so_lock ) ; }

Fix:
<S2SV_ModStart> * deleg_stateid, fmode_t fmode <S2SV_ModEnd> ) { write_seqlock <S2SV_ModStart>, open_stateid, fmode <S2SV_ModEnd> ) ; write_sequnlock <S2SV_ModStart> ( state, fmode <S2SV_ModEnd> ) ; spin_unlock
Buggy code:
 static int sysMapBlockFile ( FILE * mapf, MemMapping * pMap ) { char block_dev [ PATH_MAX + 1 ] ; size_t size ; unsigned int blksize ; <START_BUG> unsigned int blocks ; <END_BUG> unsigned int range_count ; unsigned int i ; if ( fgets ( block_dev, sizeof ( block_dev ), mapf ) == NULL ) { LOGW ( "failed   to   read   block   device   from   header\\n" ) ; return - 1 ; } for ( i = 0 ; i < sizeof ( block_dev ) ; ++ i ) { if ( block_dev [ i ] == '\\n' ) { block_dev [ i ] = 0 ; break ; } } if ( fscanf ( mapf, "%zu   %u\\n%u\\n", & size, & blksize, & range_count )!= 3 ) { LOGW ( "failed   to   parse   block   map   header\\n" ) ; return - 1 ; }  blocks = ( ( size - 1 ) // blksize ) + 1 ; <START_BUG> <END_BUG> pMap -> range_count = range_count ;  <START_BUG> pMap -> ranges = malloc ( range_count * sizeof ( MappedRange ) ) ; <END_BUG>  memset ( pMap -> ranges, 0, range_count * sizeof ( MappedRange ) ) ; <START_BUG> unsigned char * reserve ; reserve = mmap64 ( NULL, blocks * blksize, PROT_NONE, MAP_PRIVATE | MAP_ANON, - 1, 0 ) ; if ( reserve == MAP_FAILED ) { LOGW ( "failed   to   reserve   address   space:   %s\\n", strerror ( errno ) ) ; <END_BUG> return - 1 ;  } <START_BUG> pMap -> ranges [ range_count - 1 ]. addr = reserve ; <END_BUG>  pMap -> ranges [ range_count - 1 ]. length = blocks * blksize ; <START_BUG> int fd = open ( block_dev, O_RDONLY ) ; if ( fd < 0 ) { LOGW ( "failed   to   open   block   device   %s:   %s\\n", block_dev, strerror ( errno ) ) ; return - 1 ; } unsigned char * next = reserve ; for ( i = 0 ; i < range_count ; ++ i ) { int start, end ; if ( fscanf<END_BUG>

Fix:
<S2SV_ModStart> int blksize ; size_t <S2SV_ModEnd> blocks ; unsigned <S2SV_ModStart> 1 ; } if ( blksize!= 0 ) { <S2SV_ModStart> + 1 ; } if ( size == 0 || blksize == 0 || blocks > SIZE_MAX // blksize || range_count == 0 ) { LOGE ( "invalid <S2SV_blank> data <S2SV_blank> in <S2SV_blank> block <S2SV_blank> map <S2SV_blank> file: <S2SV_blank> size <S2SV_blank> %zu, <S2SV_blank> blksize <S2SV_blank> %u, <S2SV_blank> range_count <S2SV_blank> %u\\n", size, blksize, range_count ) ; return - 1 ; } <S2SV_ModStart> -> ranges = calloc ( range_count, <S2SV_ModEnd> sizeof ( MappedRange <S2SV_ModStart> ) ) ; if <S2SV_ModEnd> ( pMap -> <S2SV_ModStart> pMap -> ranges == NULL ) { LOGE ( "calloc(%u, <S2SV_blank> %zu) <S2SV_blank> failed: <S2SV_blank> %s\\n", range_count, <S2SV_ModEnd> sizeof ( MappedRange <S2SV_ModStart> ( MappedRange ), strerror ( errno ) ) ; return - 1 ; } <S2SV_ModEnd> unsigned char * <S2SV_ModStart> ) ) ; free ( pMap -> ranges ) ; <S2SV_ModStart> return - 1 ; } int fd = open ( block_dev, O_RDONLY ) ; if ( fd < 0 ) { LOGW ( "failed <S2SV_blank> to <S2SV_blank> open
Buggy code:
 void * pvPortMalloc ( size_t xWantedSize ) { void * pvReturn = NULL ; static uint8_t * pucAlignedHeap = NULL ; # if ( portBYTE_ALIGNMENT!= 1 ) { if ( xWantedSize & portBYTE_ALIGNMENT_MASK ) { <START_BUG> xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ; <END_BUG> } } # endif vTaskSuspendAll ( ) ; { if ( pucAlignedHeap == NULL ) { pucAlignedHeap = ( uint8_t * ) ( ( ( portPOINTER_SIZE_TYPE ) & ucHeap [ portBYTE_ALIGNMENT ] ) & ( ~ ( ( portPOINTER_SIZE_TYPE ) portBYTE_ALIGNMENT_MASK ) ) ) ; }  if ( ( ( xNextFreeByte + xWantedSize ) < configADJUSTED_HEAP_SIZE ) && <START_BUG> ( ( xNextFreeByte + xWantedSize ) > xNextFreeByte ) ) { pvReturn = pucAlignedHeap + xNextFreeByte ; xNextFreeByte += xWantedSize ; } traceMALLOC ( pvReturn, xWantedSize ) ; } ( void ) xTaskResumeAll ( ) ; # if ( configUSE_MALLOC_FAILED_HOOK == 1 ) { if ( pvReturn == NULL ) { extern void vApplicationMallocFailedHook ( void ) ; vApplicationMallocFailedHook ( ) ; } } # endif return pvReturn ; }<END_BUG>

Fix:
<S2SV_ModStart> portBYTE_ALIGNMENT_MASK ) { if ( ( xWantedSize + ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ) > xWantedSize ) { <S2SV_ModStart> ) ) ; } else { xWantedSize = 0 ; } <S2SV_ModStart> } if ( ( xWantedSize > 0 ) &&
Buggy code:
 static Image * ReadBGRImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * canvas_image, * image ; MagickBooleanType status ; MagickOffsetType scene ; QuantumInfo * quantum_info ; QuantumType quantum_type ; register ssize_t i ; size_t length ; ssize_t count, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( OptionError, "MustSpecifyImageSize" ) ; if ( image_info -> interlace!= PartitionInterlace ) { status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } if ( DiscardBlobBytes ( image, ( MagickSizeType ) image -> offset ) == MagickFalse ) ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; } canvas_image = CloneImage ( image, image -> extract_info. width, 1, MagickFalse, exception ) ; ( void ) SetImageVirtualPixelMethod ( canvas_image, BlackVirtualPixelMethod ) ; quantum_info = AcquireQuantumInfo ( image_info, canvas_image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; pixels = GetQuantumPixels ( quantum_info ) ; quantum_type = BGRQuantum ; if ( LocaleCompare ( image_info -> magick, "BGRA" ) == 0 ) { quantum_type = BGRAQuantum ; image -> matte = MagickTrue ; } if ( image_info -> number_scenes!= 0 ) while ( image ->

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 void comps_objrtree_unite ( COMPS_ObjRTree * rt1, COMPS_ObjRTree * rt2 ) { COMPS_HSList * tmplist, * tmp_subnodes ; COMPS_HSListItem * it ; struct Pair { COMPS_HSList * subnodes ; char * key ; <START_BUG> char added ; <END_BUG> } * pair, * parent_pair ; pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = rt2 -> subnodes ; pair -> key = NULL ; tmplist = comps_hslist_create ( ) ; comps_hslist_init ( tmplist, NULL, NULL, & free ) ; comps_hslist_append ( tmplist, pair, 0 ) ; while ( tmplist -> first!= NULL ) { it = tmplist -> first ; comps_hslist_remove ( tmplist, tmplist -> first ) ; tmp_subnodes = ( ( struct Pair * ) it -> data ) -> subnodes ; parent_pair = ( struct Pair * ) it -> data ; free ( it ) ; for ( it = tmp_subnodes -> first ; it!= NULL ; it = it -> next ) { pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = ( ( COMPS_ObjRTreeData * ) it -> data ) -> subnodes ; if ( parent_pair -> key!= NULL ) { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_ObjRTreeData * ) it -> data ) -> key ) + strlen ( parent_pair -> key ) + 1 ) ) ; memcpy ( pair -> key, parent_pair -> key, sizeof ( char ) * strlen ( parent_pair -> key ) ) ; memcpy ( pair -> key + strlen ( parent_pair -> key ), ( ( COMPS_ObjRTreeData * ) it -> data ) -> key, sizeof ( char ) * ( strlen ( ( ( COMPS_ObjRTreeData * ) it -> data ) -> key ) + 1 ) ) ; } else { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_ObjRTreeData * ) it -> data ) -> key ) + 1 ) ) ; memcpy ( pair -> key, ( ( COMPS_ObjRTreeData * ) it -> data ) -> key

Fix:
<S2SV_ModStart> * key ; <S2SV_ModEnd> } * pair
Buggy code:
 static int kvaser_usb_leaf_set_opt_mode ( const struct kvaser_usb_net_priv * priv ) { struct kvaser_cmd * cmd ; int rc ; <START_BUG> cmd = kmalloc ( sizeof ( * cmd ), GFP_KERNEL ) ; <END_BUG> if (! cmd ) return - ENOMEM ; cmd -> id = CMD_SET_CTRL_MODE ; cmd -> len = CMD_HEADER_LEN + sizeof ( struct kvaser_cmd_ctrl_mode ) ; cmd -> u. ctrl_mode. tid = 0xff ; cmd -> u. ctrl_mode. channel = priv -> channel ; if ( priv -> can. ctrlmode & CAN_CTRLMODE_LISTENONLY ) cmd -> u. ctrl_mode. ctrl_mode = KVASER_CTRL_MODE_SILENT ; else cmd -> u. ctrl_mode. ctrl_mode = KVASER_CTRL_MODE_NORMAL ; rc = kvaser_usb_send_cmd ( priv -> dev, cmd, cmd -> len ) ; kfree ( cmd ) ; return rc ; }

Fix:
<S2SV_ModStart> ; cmd = kzalloc <S2SV_ModEnd> ( sizeof (
Buggy code:
 static int extractRDNSequence ( struct ndpi_packet_struct * packet, u_int offset, char * buffer, u_int buffer_len, char * rdnSeqBuf, u_int * rdnSeqBuf_offset, u_int rdnSeqBuf_len, const char * label ) { u_int8_t str_len = packet -> payload [ offset + 4 ], is_printable = 1 ; char * str ; <START_BUG> u_int len, j ; <END_BUG> if ( ( offset + 4 + str_len ) >= packet -> payload_packet_len ) return ( - 1 ) ; str = ( char * ) & packet -> payload [ offset + 5 ] ; len = ( u_int ) ndpi_min ( str_len, buffer_len - 1 ) ; strncpy ( buffer, str, len ) ; buffer [ len ] = '\\0' ; for ( j = 0 ; j < len ; j ++ ) { if (! ndpi_isprint ( buffer [ j ] ) ) { is_printable = 0 ; break ; } } if ( is_printable ) { int rc = snprintf ( & rdnSeqBuf [ * rdnSeqBuf_offset ], rdnSeqBuf_len - ( * rdnSeqBuf_offset ), "%s%s=%s", ( * rdnSeqBuf_offset > 0 )? ",   " : "", label, buffer ) ; if ( rc > 0 ) ( * rdnSeqBuf_offset ) += rc ; } return ( is_printable ) ; }

Fix:
<S2SV_ModStart>, j ; if ( * rdnSeqBuf_offset >= rdnSeqBuf_len ) { # ifdef DEBUG_TLS printf ( "[TLS] <S2SV_blank> %s() <S2SV_blank> [buffer <S2SV_blank> capacity <S2SV_blank> reached][%u]\\n", __FUNCTION__, rdnSeqBuf_len ) ; # endif return - 1 ; }
Buggy code:
 gboolean cib_notify_client ( gpointer key, gpointer value, gpointer user_data ) { const char * type = NULL ; gboolean do_send = FALSE ; cib_client_t * client = value ; xmlNode * update_msg = user_data ; CRM_CHECK ( client!= NULL, return TRUE ) ; CRM_CHECK ( update_msg!= NULL, return TRUE ) ; <START_BUG> if ( client -> ipc == NULL ) { <END_BUG> crm_warn ( "Skipping   client   with   NULL   channel" ) ; return FALSE ; } type = crm_element_value ( update_msg, F_SUBTYPE ) ; CRM_LOG_ASSERT ( type!= NULL ) ; if ( client -> diffs && safe_str_eq ( type, T_CIB_DIFF_NOTIFY ) ) { do_send = TRUE ; } else if ( client -> replace && safe_str_eq ( type, T_CIB_REPLACE_NOTIFY ) ) { do_send = TRUE ; } else if ( client -> confirmations && safe_str_eq ( type, T_CIB_UPDATE_CONFIRM ) ) { do_send = TRUE ; } else if ( client -> pre_notify && safe_str_eq ( type, T_CIB_PRE_NOTIFY ) ) { do_send = TRUE ; } else if ( client -> post_notify && safe_str_eq ( type, T_CIB_POST_NOTIFY ) ) { do_send = TRUE ; } if ( do_send ) { if ( client -> ipc ) { if ( crm_ipcs_send ( client -> ipc, 0, update_msg, TRUE ) == FALSE ) { crm_warn ( "Notification   of   client   %s//%s   failed", client -> name, client -> id ) ; } # ifdef HAVE_GNUTLS_GNUTLS_H } else if ( client -> session ) { crm_debug ( "Sent   %s   notification   to   client   %s//%s", type, client -> name, client -> id ) ; crm_send_remote_msg ( client -> session, update_msg, client -> encrypted ) ; # endif } else { crm_err ( "Unknown   transport   for   %s", client ->

Fix:
<S2SV_ModStart> ipc == NULL && client -> session == NULL
Buggy code:
 generic_ret * set_string_2_svc ( sstring_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_MODIFY, arg -> princ, NULL ) ) { ret. code = KADM5_AUTH_MODIFY ; log_unauth ( "kadm5_mod_strings", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_set_string ( ( void * ) handle, arg -> princ, arg -> key, arg -> value ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_mod_strings", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; } free ( prime_arg ) ;  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static void print_mi_data ( VP9_COMMON * cm, FILE * file, const char * descriptor, size_t member_offset ) { <START_BUG> int mi_row ; <END_BUG> int mi_col ; int mi_index = 0 ;  MODE_INFO * * mi_8x8 = cm -> mi_grid_visible ; <START_BUG> int rows = cm -> mi_rows ; int cols = cm -> mi_cols ; char prefix = descriptor [ 0 ] ; <END_BUG> log_frame_info ( cm, descriptor, file ) ;  mi_index = 0 ; for ( mi_row = 0 ; mi_row < rows ; mi_row ++ ) { fprintf ( file, "%c   ", prefix ) ; for ( mi_col = 0 ; mi_col < cols ; mi_col ++ ) { fprintf ( file, "%2d   ", <START_BUG> * ( ( int * ) ( ( char * ) ( & mi_8x8 [ mi_index ] -> mbmi ) + <END_BUG> member_offset ) ) ) ;  mi_index ++ ; <START_BUG> } fprintf ( file, "\\n" ) ; <END_BUG> mi_index += 8 ;  } fprintf ( file, "\\n" ) ; }

Fix:
<S2SV_ModStart> { int mi_row, mi_col <S2SV_ModEnd> ; MODE_INFO * <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd> = cm -> <S2SV_ModStart>, file ) <S2SV_ModEnd> ; for ( <S2SV_ModStart> ) ( & mi [ 0 <S2SV_ModEnd> ] -> mbmi <S2SV_ModStart> ) ) ; mi <S2SV_ModEnd> ++ ; } <S2SV_ModStart> "\\n" ) ; mi <S2SV_ModEnd> += 8 ;
Buggy code:
 <START_BUG> static bool dump_fd_info ( const char * dest_filename, char * source_filename, int source_base_ofs ) <END_BUG> { FILE * fp = fopen ( dest_filename, "w" ) ; if (! fp ) return false ; unsigned fd = 0 ; while ( fd <= 99999 ) { sprintf ( source_filename + source_base_ofs, "fd//%u", fd ) ; char * name = malloc_readlink ( source_filename ) ; if (! name ) break ; fprintf ( fp, "%u:%s\\n", fd, name ) ; free ( name ) ; sprintf ( source_filename + source_base_ofs, "fdinfo//%u", fd ) ; fd ++ ; FILE * in = fopen ( source_filename, "r" ) ; if (! in ) continue ; char buf [ 128 ] ; while ( fgets ( buf, sizeof ( buf ) - 1, in ) ) { char * eol = strchrnul ( buf, '\\n' ) ; eol [ 0 ] = '\\n' ; eol [ 1 ] = '\\0' ; fputs ( buf, fp ) ; } fclose ( in ) ; }  fclose ( fp ) ; <START_BUG> return true ; }<END_BUG>

Fix:
<S2SV_ModStart>, int source_base_ofs, uid_t uid, gid_t gid <S2SV_ModStart> ) ; } const int dest_fd = fileno ( fp ) ; if ( fchown ( dest_fd, uid, gid ) < 0 ) { perror_msg ( "Can\'t <S2SV_blank> change <S2SV_blank> \'%s\' <S2SV_blank> ownership <S2SV_blank> to <S2SV_blank> %lu:%lu", dest_filename, ( long ) uid, ( long ) gid ) ; fclose ( fp ) ; unlink ( dest_filename ) ; return false ; }
Buggy code:
 static int cdxl_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * pkt ) { CDXLVideoContext * c = avctx -> priv_data ; AVFrame * const p = data ; int ret, w, h, encoding, aligned_width, buf_size = pkt -> size ; const uint8_t * buf = pkt -> data ; if ( buf_size < 32 ) return AVERROR_INVALIDDATA ; encoding = buf [ 1 ] & 7 ; c -> format = buf [ 1 ] & 0xE0 ; w = AV_RB16 ( & buf [ 14 ] ) ; h = AV_RB16 ( & buf [ 16 ] ) ; c -> bpp = buf [ 19 ] ; c -> palette_size = AV_RB16 ( & buf [ 20 ] ) ; c -> palette = buf + 32 ; c -> video = c -> palette + c -> palette_size ; c -> video_size = buf_size - c -> palette_size - 32 ; if ( c -> palette_size > 512 ) return AVERROR_INVALIDDATA ; if ( buf_size < c -> palette_size + 32 ) return AVERROR_INVALIDDATA ; if ( c -> bpp < 1 ) return AVERROR_INVALIDDATA ; if ( c -> format!= BIT_PLANAR && c -> format!= BIT_LINE && c -> format!= CHUNKY ) { avpriv_request_sample ( avctx, "Pixel   format   0x%0x", c -> format ) ; return AVERROR_PATCHWELCOME ; } if ( ( ret = ff_set_dimensions ( avctx, w, h ) ) < 0 ) return ret ; if ( c -> format == CHUNKY ) aligned_width = avctx -> width ; else aligned_width = FFALIGN ( c -> avctx -> width, 16 ) ; c -> padded_bits = aligned_width - c -> avctx -> width ; if ( c -> video_size < aligned_width * avctx -> height * ( int64_t ) c -> bpp // 8 ) return AVERROR_INVALIDDATA ; <START_BUG> if (! encoding && c -> palette_size && c -> bpp <= 8 ) { <END_BUG> avctx -> pix_fmt = AV_PIX_FMT_PAL8 ; } else if ( encoding == 1

Fix:
<S2SV_ModStart> bpp <= 8 && c -> format!= CHUNKY
Buggy code:
 static void decode_mb_mode_mvs ( VP8D_COMP * pbi, MODE_INFO * mi, MB_MODE_INFO * mbmi ) <START_BUG> { <END_BUG> if ( pbi -> mb. update_mb_segmentation_map ) read_mb_features ( & pbi -> mbc [ 8 ], & mi -> mbmi, & pbi -> mb ) ; else if ( pbi -> common. frame_type == KEY_FRAME ) mi -> mbmi. segment_id = 0 ; if ( pbi -> common. mb_no_coeff_skip ) mi -> mbmi. mb_skip_coeff = vp8_read ( & pbi -> mbc [ 8 ], pbi -> prob_skip_false ) ; else mi -> mbmi. mb_skip_coeff = 0 ; mi -> mbmi. is_4x4 = 0 ; if ( pbi -> common. frame_type == KEY_FRAME ) read_kf_modes ( pbi, mi ) ; else read_mb_modes_mv ( pbi, mi, & mi -> mbmi ) ; }

Fix:
<S2SV_ModStart> mbmi ) { ( void ) mbmi ;
Buggy code:
 int nfs4_do_close ( struct path * path, struct nfs4_state * state, int wait ) { struct nfs_server * server = NFS_SERVER ( state -> inode ) ; struct nfs4_closedata * calldata ; struct nfs4_state_owner * sp = state -> owner ; struct rpc_task * task ; struct rpc_message msg = {. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_CLOSE ],. rpc_cred = state -> owner -> so_cred, } ; struct rpc_task_setup task_setup_data = {. rpc_client = server -> client,. rpc_message = & msg,. callback_ops = & nfs4_close_ops,. workqueue = nfsiod_workqueue,. flags = RPC_TASK_ASYNC, } ; int status = - ENOMEM ; calldata = kmalloc ( sizeof ( * calldata ), GFP_KERNEL ) ; if ( calldata == NULL ) goto out ; calldata -> inode = state -> inode ; calldata -> state = state ; calldata -> arg. fh = NFS_FH ( state -> inode ) ; calldata -> arg. stateid = & state -> open_stateid ; calldata -> arg. seqid = nfs_alloc_seqid ( & state -> owner -> so_seqid ) ; if ( calldata -> arg. seqid == NULL ) goto out_free_calldata ; <START_BUG> calldata -> arg. open_flags = 0 ; <END_BUG> calldata -> arg. bitmask = server -> attr_bitmask ; calldata -> res. fattr = & calldata -> fattr ; calldata -> res. seqid = calldata -> arg. seqid ; calldata -> res. server = server ; calldata -> path. mnt = mntget ( path -> mnt ) ; calldata -> path. dentry = dget ( path -> dentry ) ; msg. rpc_argp = & calldata -> arg, msg. rpc_resp = & calldata -> res, task_setup_data. callback_data = calldata ; task = rpc_run_task ( & task_setup_data ) ; if ( IS_ERR ( task ) ) return PTR_ERR ( task ) ; status = 0 ; if ( wait ) status =

Fix:
<S2SV_ModStart> -> arg. fmode <S2SV_ModEnd> = 0 ;
Buggy code:
 int main ( int argc, char * * argv ) { FILE * infile = NULL ; <START_BUG> VpxVideoWriter * writer = NULL ; <END_BUG> vpx_codec_ctx_t codec ; vpx_codec_enc_cfg_t cfg ; vpx_image_t raw ; vpx_codec_err_t res ;  vpx_fixed_buf_t stats = { 0 } ; <START_BUG> VpxVideoInfo info = { 0 } ; <END_BUG> const VpxInterface * encoder = NULL ;  int pass ; const int fps = 30 ; const int bitrate = 200 ; const char * const codec_arg = argv [ 1 ] ; const char * const width_arg = argv [ 2 ] ; const char * const height_arg = argv [ 3 ] ; const char * const infile_arg = argv [ 4 ] ; const char * const outfile_arg = argv [ 5 ] ; exec_name = argv [ 0 ] ; if ( argc!= 6 ) die ( "Invalid   number   of   arguments." ) ; encoder = get_vpx_encoder_by_name ( codec_arg ) ; if (! encoder ) die ( "Unsupported   codec." ) ; <START_BUG> info. codec_fourcc = encoder -> fourcc ; <END_BUG> info. time_base. numerator = 1 ; info. time_base. denominator = fps ; info. frame_width = strtol ( width_arg, NULL, 0 ) ;  info. frame_height = strtol ( height_arg, NULL, 0 ) ; <START_BUG> <END_BUG> if ( info. frame_width <= 0 ||  <START_BUG> info. frame_height <= 0 || <END_BUG>  ( info. frame_width % 2 )!= 0 || <START_BUG> <END_BUG> ( info. frame_height % 2 )!= 0 ) {  <START_BUG> die ( "Invalid   frame   size:   %dx%d", info. frame_width, info. frame_height ) ; <END_BUG> }  if (! vpx_img_alloc ( & raw, VPX_IMG_FMT_I420, info. frame_width, <START_BUG> <END_BUG> info. frame_height, 1 ) ) {  <START_BUG> die ( "Failed   to   allocate   image", info. frame_width, info. frame_height ) ; <END_BUG> } writer = vpx_video_writer_open ( outfile_arg, kContainerIVF, & info ) ;

Fix:
<S2SV_ModStart> = NULL ; int w, h <S2SV_ModEnd> ; vpx_codec_ctx_t codec <S2SV_ModStart> ; vpx_fixed_buf_t stats <S2SV_ModEnd> ; const VpxInterface <S2SV_ModStart> encoder = NULL <S2SV_ModEnd> ; const int <S2SV_ModStart> "Unsupported <S2SV_blank> codec." ) ; w <S2SV_ModEnd> = strtol ( <S2SV_ModStart> 0 ) ; h <S2SV_ModEnd> = strtol ( <S2SV_ModStart> ; if ( w <S2SV_ModEnd> <= 0 || <S2SV_ModStart> <= 0 || h <S2SV_ModEnd> <= 0 || <S2SV_ModStart> <= 0 || ( w <S2SV_ModEnd> % 2 ) <S2SV_ModStart>!= 0 || ( h <S2SV_ModEnd> % 2 ) <S2SV_ModStart>!= 0 ) <S2SV_ModEnd> die ( "Invalid <S2SV_blank> frame <S2SV_blank> size: <S2SV_blank> %dx%d" <S2SV_ModStart> ( "Invalid <S2SV_blank> frame <S2SV_blank> size: <S2SV_blank> %dx%d", w, h ) ; <S2SV_ModEnd> if (! <S2SV_ModStart>, VPX_IMG_FMT_I420, w, h <S2SV_ModEnd>, 1 ) <S2SV_ModStart> 1 ) ) <S2SV_ModEnd> die ( "Failed <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> image" <S2SV_ModStart> ( "Failed <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> image", w, h ) ; printf ( "Using <S2SV_blank> %s\\n", vpx_codec_iface_name ( encoder -> codec_interface ( ) ) ) ; res = vpx_codec_enc_
Buggy code:
 krb5_error_code _kdc_as_rep ( kdc_request_t r, krb5_data * reply, const char * from, struct sockaddr * from_addr, int datagram_reply ) { krb5_context context = r -> context ; krb5_kdc_configuration * config = r -> config ; KDC_REQ * req = & r -> req ; KDC_REQ_BODY * b = NULL ; AS_REP rep ; KDCOptions f ; krb5_enctype setype ; krb5_error_code ret = 0 ; Key * skey ; int found_pa = 0 ; int i, flags = HDB_F_FOR_AS_REQ ; METHOD_DATA error_method ; const PA_DATA * pa ; memset ( & rep, 0, sizeof ( rep ) ) ; error_method. len = 0 ; error_method. val = NULL ; ret = _kdc_fast_unwrap_request ( r ) ; if ( ret ) { _kdc_r_log ( r, 0, "FAST   unwrap   request   from   %s   failed:   %d", from, ret ) ; goto out ; } b = & req -> req_body ; f = b -> kdc_options ; if ( f. canonicalize ) flags |= HDB_F_CANON ; if ( b -> sname == NULL ) { ret = KRB5KRB_ERR_GENERIC ; _kdc_set_e_text ( r, "No   server   in   request" ) ; } else { ret = _krb5_principalname2krb5_principal ( context, & r -> server_princ, * ( b -> sname ), b -> realm ) ; if ( ret == 0 ) ret = krb5_unparse_name ( context, r -> server_princ, & r -> server_name ) ; } if ( ret ) { kdc_log ( context, config, 0, "AS-REQ   malformed   server   name   from   %s", from ) ; goto out ; } if ( b -> cname == NULL ) { ret = KRB5KRB_ERR_GENERIC ; _kdc_set_e_text ( r, "No   client   in  

Fix:
<S2SV_ModStart> -> server_princ, <S2SV_ModEnd> r -> client_princ <S2SV_ModStart> r -> client_princ? & r -> client_princ -> name : NULL, <S2SV_ModEnd> r -> client_princ <S2SV_ModStart> r -> client_princ? & r -> client_princ -> realm : NULL <S2SV_ModEnd>, NULL,
Buggy code:
 static int jpc_siz_getparms ( jpc_ms_t * ms, jpc_cstate_t * cstate, jas_stream_t * in ) { jpc_siz_t * siz = & ms -> parms. siz ; unsigned int i ; uint_fast8_t tmp ; <START_BUG> cstate = 0 ; <END_BUG> if ( jpc_getuint16 ( in, & siz -> caps ) || jpc_getuint32 ( in, & siz -> width ) || jpc_getuint32 ( in, & siz -> height ) || jpc_getuint32 ( in, & siz -> xoff ) || jpc_getuint32 ( in, & siz -> yoff ) || jpc_getuint32 ( in, & siz -> tilewidth ) || jpc_getuint32 ( in, & siz -> tileheight ) || jpc_getuint32 ( in, & siz -> tilexoff ) || jpc_getuint32 ( in, & siz -> tileyoff ) || jpc_getuint16 ( in, & siz -> numcomps ) ) {  return - 1 ; <START_BUG> } <END_BUG> if (! siz -> width ||! siz -> height ||! siz -> tilewidth || ! siz -> tileheight ||! siz -> numcomps || siz -> numcomps > 16384 ) { return - 1 ; } if ( siz -> tilexoff >= siz -> width || siz -> tileyoff >= siz -> height ) { jas_eprintf ( "all   tiles   are   outside   the   image   area\\n" ) ; return - 1 ; } if (! ( siz -> comps = jas_alloc2 ( siz -> numcomps, sizeof ( jpc_sizcomp_t ) ) ) ) { return - 1 ; } for ( i = 0 ; i < siz -> numcomps ; ++ i ) { if ( jpc_getuint8 ( in, & tmp ) || jpc_getuint8 ( in, & siz -> comps [ i ]. hsamp ) || jpc_getuint8 ( in, & siz -> comps [ i ]. vsamp ) ) { jas_free ( siz -> comps ) ; return - 1 ; } if ( s

Fix:
<S2SV_ModStart> uint_fast8_t tmp ; siz -> comps = 0 ; <S2SV_ModStart> ) ) { goto error ; } if (! siz -> width ||! siz -> height ) { jas_eprintf ( "reference <S2SV_blank> grid <S2SV_blank> cannot <S2SV_blank> have <S2SV_blank> zero <S2SV_blank> area\\n" ) ; goto error ; } if (! siz -> tilewidth ||! siz -> tileheight ) { jas_eprintf ( "tile <S2SV_blank> cannot <S2SV_blank> have <S2SV_blank> zero <S2SV_blank> area\\n" ) ; goto error ; } if (! siz -> numcomps || siz -> numcomps > 16384 ) { jas_eprintf ( "number <S2SV_blank> of <S2SV_blank> components <S2SV_blank> not <S2SV_blank> in <S2SV_blank> permissible <S2SV_blank> range\\n" ) ; goto error ; } if ( siz -> xoff >= siz -> width ) { jas_eprintf ( "XOsiz <S2SV_blank> not <S2SV_blank> in <S2SV_blank> permissible <S2SV_blank> range\\n" ) ; goto error ; } if ( siz -> yoff >= siz -> height ) { jas_eprintf ( "YOsiz <S2SV_blank> not <S2SV_blank> in <S2SV_blank> permissible <S2SV_blank> range\\n" ) ; goto error ; } if ( siz -> tilexoff > s
Buggy code:
 static char * isis_print_id ( const uint8_t * cp, int id_len ) { int i ; static char id [ sizeof ( "xxxx.xxxx.xxxx.yy-zz" ) ] ; char * pos = id ; <START_BUG> for ( i = 1 ; i <= SYSTEM_ID_LEN ; i ++ ) { <END_BUG> snprintf ( pos, sizeof ( id ) - ( pos - id ), "%02x", * cp ++ ) ; pos += strlen ( pos ) ; if ( i == 2 || i == 4 ) * pos ++ = '.' ; } if ( id_len >= NODE_ID_LEN ) { snprintf ( pos, sizeof ( id ) - ( pos - id ), ".%02x", * cp ++ ) ; pos += strlen ( pos ) ; } if ( id_len == LSP_ID_LEN ) snprintf ( pos, sizeof ( id ) - ( pos - id ), "-%02x", * cp ) ; return ( id ) ; }

Fix:
<S2SV_ModStart> = id ; int sysid_len ; sysid_len = SYSTEM_ID_LEN ; if ( sysid_len > id_len ) sysid_len = id_len ; <S2SV_ModStart> ; i <= sysid_len <S2SV_ModEnd> ; i ++
Buggy code:
 static void init_encode_frame_mb_context ( VP8_COMP * cpi ) { MACROBLOCK * const x = & cpi -> mb ; VP8_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; x -> gf_active_ptr = ( signed char * ) cpi -> gf_active_flags ; x -> mb_activity_ptr = cpi -> mb_activity_map ; x -> act_zbin_adj = 0 ; x -> partition_info = x -> pi ; xd -> mode_info_context = cm -> mi ; xd -> mode_info_stride = cm -> mode_info_stride ; xd -> frame_type = cm -> frame_type ; if ( cm -> frame_type == KEY_FRAME ) vp8_init_mbmode_probs ( cm ) ; x -> src = * cpi -> Source ; xd -> pre = cm -> yv12_fb [ cm -> lst_fb_idx ] ; xd -> dst = cm -> yv12_fb [ cm -> new_fb_idx ] ; vp8_setup_intra_recon ( & cm -> yv12_fb [ cm -> new_fb_idx ] ) ; vp8_build_block_offsets ( x ) ; xd -> mode_info_context -> mbmi. mode = DC_PRED ; xd -> mode_info_context -> mbmi. uv_mode = DC_PRED ; xd -> left_context = & cm -> left_context ; x -> mvc = cm -> fc. mvc ; <START_BUG> vpx_memset ( cm -> above_context, 0, <END_BUG> sizeof ( ENTROPY_CONTEXT_PLANES ) * cm -> mb_cols ) ; if ( cpi -> ref_frame_flags == VP8_LAST_FRAME ) vp8_calc_ref_frame_costs ( x -> ref_frame_cost, cpi -> prob_intra_coded, 255, 128 ) ; else if ( ( cpi -> oxcf. number_of_layers > 1 ) && ( cpi -> ref_frame_flags == VP8_GOLD_FRAME ) ) vp8_calc_ref_frame_costs ( x -> ref_frame_cost, cpi -> prob_in

Fix:
<S2SV_ModStart>. mvc ; memset <S2SV_ModEnd> ( cm ->
Buggy code:
 void sctp_auth_get_cookie_params ( struct sctp_tcb * stcb, struct mbuf * m, uint32_t offset, uint32_t length ) { struct sctp_paramhdr * phdr, tmp_param ; uint16_t plen, ptype ; uint8_t random_store [ SCTP_PARAM_BUFFER_SIZE ] ; struct sctp_auth_random * p_random = NULL ; uint16_t random_len = 0 ; uint8_t hmacs_store [ SCTP_PARAM_BUFFER_SIZE ] ; struct sctp_auth_hmac_algo * hmacs = NULL ; uint16_t hmacs_len = 0 ; uint8_t chunks_store [ SCTP_PARAM_BUFFER_SIZE ] ; struct sctp_auth_chunk_list * chunks = NULL ; uint16_t num_chunks = 0 ; sctp_key_t * new_key ; uint32_t keylen ; length += offset ; phdr = ( struct sctp_paramhdr * ) sctp_m_getptr ( m, offset, sizeof ( struct sctp_paramhdr ), ( uint8_t * ) & tmp_param ) ; while ( phdr!= NULL ) { ptype = ntohs ( phdr -> param_type ) ; plen = ntohs ( phdr -> param_length ) ; <START_BUG> if ( ( plen == 0 ) || ( offset + plen > length ) ) <END_BUG> break ; if ( ptype == SCTP_RANDOM ) { if ( plen > sizeof ( random_store ) ) break ; phdr = sctp_get_next_param ( m, offset, ( struct sctp_paramhdr * ) random_store, plen ) ; if ( phdr == NULL ) return ; p_random = ( struct sctp_auth_random * ) phdr ; random_len = plen - sizeof ( * p_random ) ; } else if ( ptype == SCTP_HMAC_LIST ) { uint16_t num_hmacs ; uint16_t i ; if ( plen > sizeof ( hmacs_store ) ) break ; phdr = sctp_get_next_param ( m, offset, ( struct sctp_paramhdr * ) hmacs_store, plen ) ; if ( ph

Fix:
<S2SV_ModStart> ( ( plen < sizeof ( struct sctp_paramhdr ) <S2SV_ModEnd> ) || (
Buggy code:
 static Image * ReadICONImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { IconFile icon_file ; IconInfo icon_info ; Image * image ; MagickBooleanType status ; register ssize_t i, x ; register Quantum * q ; register unsigned char * p ; size_t bit, byte, bytes_per_line, one, scanline_pad ; ssize_t count, offset, y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; ( void ) LogMagickEvent ( CoderEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } icon_file. reserved = ( short ) ReadBlobLSBShort ( image ) ; icon_file. resource_type = ( short ) ReadBlobLSBShort ( image ) ; icon_file. count = ( short ) ReadBlobLSBShort ( image ) ; if ( ( icon_file. reserved!= 0 ) || ( ( icon_file. resource_type!= 1 ) && ( icon_file. resource_type!= 2 ) ) || ( icon_file. count > MaxIcons ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; for ( i = 0 ; i < icon_file. count ; i ++ ) { icon_file. directory [ i ]. width = ( unsigned char ) ReadBlobByte ( image ) ; icon_file. directory [ i ]. height = ( unsigned char ) ReadBlobByte ( image ) ; icon_file. directory [ i ]. colors = ( unsigned char ) ReadBlobByte ( image ) ; icon_file. directory [ i ]. reserved = ( unsigned char ) ReadBlobByte ( image ) ; icon_file. directory [ i ]. planes = ( unsigned short ) ReadBlobLSBShort ( image ) ; icon_file. directory [ i ]. bits_per_pixel = ( unsigned short )

Fix:
<S2SV_ModStart> ]. size ; if ( ~ length < 16 ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" )
Buggy code:
 static int pppol2tp_getsockopt ( struct socket * sock, int level, int optname, char __user * optval, int __user * optlen ) { struct sock * sk = sock -> sk ; struct l2tp_session * session ; struct l2tp_tunnel * tunnel ; int val, len ; int err ; struct pppol2tp_session * ps ; if ( level!= SOL_PPPOL2TP ) <START_BUG> return udp_prot. getsockopt ( sk, level, optname, optval, optlen ) ; <END_BUG> if ( get_user ( len, optlen ) ) return - EFAULT ; len = min_t ( unsigned int, len, sizeof ( int ) ) ; if ( len < 0 ) return - EINVAL ; err = - ENOTCONN ; if ( sk -> sk_user_data == NULL ) goto end ; err = - EBADF ; session = pppol2tp_sock_to_session ( sk ) ; if ( session == NULL ) goto end ; ps = l2tp_session_priv ( session ) ; if ( ( session -> session_id == 0 ) && ( session -> peer_session_id == 0 ) ) { err = - EBADF ; tunnel = l2tp_sock_to_tunnel ( ps -> tunnel_sock ) ; if ( tunnel == NULL ) goto end_put_sess ; err = pppol2tp_tunnel_getsockopt ( sk, tunnel, optname, & val ) ; sock_put ( ps -> tunnel_sock ) ; } else err = pppol2tp_session_getsockopt ( sk, session, optname, & val ) ; err = - EFAULT ; if ( put_user ( len, optlen ) ) goto end_put_sess ; if ( copy_to_user ( ( void __user * ) optval, & val, len ) ) goto end_put_sess ; err = 0 ; end_put_sess : sock_put ( sk ) ; end : return err ; }

Fix:
<S2SV_ModStart> SOL_PPPOL2TP ) return - EINVAL <S2SV_ModEnd> ; if (
Buggy code:
 static int ati_remote2_probe ( struct usb_interface * interface, const struct usb_device_id * id ) { struct usb_device * udev = interface_to_usbdev ( interface ) ; struct usb_host_interface * alt = interface -> cur_altsetting ; struct ati_remote2 * ar2 ; int r ; if ( alt -> desc. bInterfaceNumber ) return - ENODEV ; ar2 = kzalloc ( sizeof ( struct ati_remote2 ), GFP_KERNEL ) ; if (! ar2 ) return - ENOMEM ; ar2 -> udev = udev ; <START_BUG> ar2 -> intf [ 0 ] = interface ; <END_BUG> ar2 -> ep [ 0 ] = & alt -> endpoint [ 0 ]. desc ; ar2 -> intf [ 1 ] = usb_ifnum_to_if ( udev, 1 ) ;  r = usb_driver_claim_interface ( & ati_remote2_driver, ar2 -> intf [ 1 ], ar2 ) ; <START_BUG> if ( r ) goto fail1 ; alt = ar2 -> intf [ 1 ] -> cur_altsetting ; <END_BUG> ar2 -> ep [ 1 ] = & alt -> endpoint [ 0 ]. desc ;  r = ati_remote2_urb_init ( ar2 ) ; if ( r ) <START_BUG> goto fail2 ; <END_BUG> ar2 -> channel_mask = channel_mask ; ar2 -> mode_mask = mode_mask ; r = ati_remote2_setup ( ar2, ar2 -> channel_mask ) ; if ( r )  goto fail2 ; <START_BUG> usb_make_path ( udev, ar2 -> phys, sizeof ( ar2 -> phys ) ) ; strlcat ( ar2 -> phys, "//input0", sizeof ( ar2 -> phys ) ) ; strlcat ( ar2 -> name, "ATI   Remote   Wonder   II", sizeof ( ar2 -> name ) ) ; r = sysfs_create_group ( & udev -> dev. kobj, & ati_remote2_attr_group ) ; if ( r ) <END_BUG> goto fail2 ;  r = ati_remote2_input_init ( ar2 ) ; if ( r ) <START_BUG> goto fail3 ; <END_BUG> usb_set_intfdata ( interface, ar2 ) ; interface ->

Fix:
<S2SV_ModStart> = udev ; if ( alt -> desc. bNumEndpoints < 1 ||! alt -> endpoint ) { dev_err ( & interface -> dev, "%s(): <S2SV_blank> interface <S2SV_blank> 0 <S2SV_blank> must <S2SV_blank> have <S2SV_blank> an <S2SV_blank> endpoint\\n", __func__ ) ; r = - ENODEV ; goto fail1 ; } <S2SV_ModStart> 1 ) ; if ( ( udev -> actconfig -> desc. bNumInterfaces < 2 ) ||! ar2 -> intf [ 1 ] ) { dev_err ( & interface -> dev, "%s(): <S2SV_blank> need <S2SV_blank> 2 <S2SV_blank> interfaces, <S2SV_blank> found <S2SV_blank> %d\\n", __func__, udev -> actconfig -> desc. bNumInterfaces ) ; r = - ENODEV ; goto fail1 ; } <S2SV_ModStart> -> cur_altsetting ; if ( alt -> desc. bNumEndpoints < 1 ||! alt -> endpoint ) { dev_err ( & interface -> dev, "%s(): <S2SV_blank> interface <S2SV_blank> 1 <S2SV_blank> must <S2SV_blank> have <S2SV_blank> an <S2SV_blank> endpoint\\n", __func__ ) ; r = - ENODEV ; goto fail2 ; } <S2SV_ModStart> r ) goto fail3 <S2SV_ModEnd> ; ar2 -> <S2SV_ModStart> r ) goto fail3 <S2SV_ModEnd> ; usb_make_path ( <S2SV_ModStart> r
Buggy code:
 void vp9_setup_src_planes ( MACROBLOCK * x, const YV12_BUFFER_CONFIG * src, int mi_row, int mi_col ) { <START_BUG> uint8_t * const buffers [ 4 ] = { src -> y_buffer, src -> u_buffer, src -> v_buffer, <END_BUG> src -> alpha_buffer } ;  const int strides [ 4 ] = { src -> y_stride, src -> uv_stride, src -> uv_stride, <START_BUG> src -> alpha_stride } ; int i ; x -> e_mbd. cur_buf = src ; for ( i = 0 ; i < MAX_MB_PLANE ; i ++ ) setup_pred_plane ( & x -> plane [ i ]. src, buffers [ i ], strides [ i ], mi_row, mi_col, NULL, x -> e_mbd. plane [ i ]. subsampling_x, x -> e_mbd. plane [ i ]. subsampling_y ) ; }<END_BUG>

Fix:
<S2SV_ModStart> const buffers [ 3 <S2SV_ModEnd> ] = { <S2SV_ModStart> src -> v_buffer <S2SV_ModEnd> } ; const <S2SV_ModStart> int strides [ 3 <S2SV_ModEnd> ] = { <S2SV_ModStart> src -> uv_stride <S2SV_ModEnd> } ; int
Buggy code:
 static int xc2028_set_config ( struct dvb_frontend * fe, void * priv_cfg ) { struct xc2028_data * priv = fe -> tuner_priv ; struct xc2028_ctrl * p = priv_cfg ; int rc = 0 ; tuner_dbg ( "%s   called\\n", __func__ ) ; mutex_lock ( & priv -> lock ) ; kfree ( priv -> ctrl. fname ) ; <START_BUG> memcpy ( & priv -> ctrl, p, sizeof ( priv -> ctrl ) ) ; <END_BUG> if ( p -> fname ) { priv -> ctrl. fname = kstrdup ( p -> fname, GFP_KERNEL ) ; if ( priv -> ctrl. fname == NULL )  rc = - ENOMEM ; <START_BUG> } if (! firmware_name [ 0 ] && p -> fname && priv -> fname && strcmp ( p -> fname, priv -> fname ) ) free_firmware ( priv ) ; if ( priv -> ctrl. max_len < 9 ) priv -> ctrl. max_len = 13 ; if ( priv -> state == XC2028_NO_FIRMWARE ) { if (! firmware_name [ 0 ] ) priv -> fname = priv -> ctrl. fname ; else priv -> fname = firmware_name ; rc = request_firmware_nowait ( THIS_MODULE, 1, priv -> fname, priv -> i2c_props. adap -> dev. parent, GFP_KERNEL, fe, load_firmware_cb ) ; if ( rc < 0 ) { tuner_err ( "Failed   to   request   firmware   %s\\n", priv -> fname ) ; priv -> state = XC2028_NODEV ; } else priv -> state = XC2028_WAITING_FIRMWARE ; } mutex_unlock ( & priv -> lock ) ; return rc ; }<END_BUG>

Fix:
<S2SV_ModStart> fname ) ; priv -> ctrl. fname = NULL ; <S2SV_ModStart> == NULL ) return <S2SV_ModEnd> - ENOMEM ;
Buggy code:
 Datum ltree_in ( PG_FUNCTION_ARGS ) { char * buf = ( char * ) PG_GETARG_POINTER ( 0 ) ; char * ptr ; nodeitem * list, * lptr ; int num = 0, totallen = 0 ; int state = LTPRS_WAITNAME ; ltree * result ; ltree_level * curlevel ; int charlen ; int pos = 0 ; ptr = buf ; while ( * ptr ) { charlen = pg_mblen ( ptr ) ; if ( charlen == 1 && t_iseq ( ptr, '.' ) ) num ++ ; ptr += charlen ; } <START_BUG> list = lptr = ( nodeitem * ) palloc ( sizeof ( nodeitem ) * ( num + 1 ) ) ; <END_BUG> ptr = buf ; while ( * ptr ) { charlen = pg_mblen ( ptr ) ; if ( state == LTPRS_WAITNAME ) { if ( ISALNUM ( ptr ) ) { lptr -> start = ptr ; lptr -> wlen = 0 ; state = LTPRS_WAITDELIM ; } else UNCHAR ; } else if ( state == LTPRS_WAITDELIM ) { if ( charlen == 1 && t_iseq ( ptr, '.' ) ) { lptr -> len = ptr - lptr -> start ; if ( lptr -> wlen > 255 ) ereport ( ERROR, ( errcode ( ERRCODE_NAME_TOO_LONG ), errmsg ( "name   of   level   is   too   long" ), errdetail ( "Name   length   is   %d,   must   " "be   <   256,   in   position   %d.", lptr -> wlen, pos ) ) ) ; totallen += MAXALIGN ( lptr -> len + LEVEL_HDRSIZE ) ; lptr ++ ; state = LTPRS_WAITNAME ; } else if (! ISALNUM ( ptr ) ) UNCHAR ; } else elog ( ERROR, "internal   error   in   parser" ) ; ptr += charlen ; lptr -> wlen ++ ; pos ++ ; } if ( state == LTPRS_WAITDELIM ) { lptr -> len = ptr - lptr -> start ; if ( lptr -> wlen > 255 ) ereport ( ERROR, ( errcode ( ERRCODE_NAME_TOO_LONG ), errmsg ( "

Fix:
<S2SV_ModStart> charlen ; } if ( num + 1 > MaxAllocSize // sizeof ( nodeitem ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> levels <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", num + 1, ( int ) ( MaxAllocSize // sizeof ( nodeitem ) ) ) ) ) ;
Buggy code:
 static int udf_pc_to_char ( struct super_block * sb, unsigned char * from, int fromlen, unsigned char * to, int tolen ) { struct pathComponent * pc ; int elen = 0 ; int comp_len ; unsigned char * p = to ; tolen -- ; while ( elen < fromlen ) { pc = ( struct pathComponent * ) ( from + elen ) ; <START_BUG> switch ( pc -> componentType ) { <END_BUG> case 1 : if ( pc -> lengthComponentIdent > 0 )  break ; <START_BUG> case 2 : if ( tolen == 0 ) return - ENAMETOOLONG ; p = to ; * p ++ = '//' ; tolen -- ; break ; case 3 : if ( tolen < 3 ) return - ENAMETOOLONG ; memcpy ( p, "..//", 3 ) ; p += 3 ; tolen -= 3 ; break ; case 4 : if ( tolen < 2 ) return - ENAMETOOLONG ; memcpy ( p, ".//", 2 ) ; p += 2 ; tolen -= 2 ; break ; <END_BUG> case 5 :  comp_len = udf_get_filename ( sb, pc -> componentIdent, pc -> lengthComponentIdent, p, tolen ) ; p += comp_len ; tolen -= comp_len ; if ( tolen == 0 ) return - ENAMETOOLONG ; * p ++ = '//' ; tolen -- ; break ; } <START_BUG> elen += sizeof ( struct pathComponent ) + pc -> lengthComponentIdent ; <END_BUG> } if ( p > to + 1 ) p [ - 1 ] = '\\0' ; else p [ 0 ] = '\\0' ; return 0 ; }

Fix:
<S2SV_ModStart> elen ) ; elen += sizeof ( struct pathComponent ) ; <S2SV_ModStart> > 0 ) { elen += pc -> lengthComponentIdent ; break ; } <S2SV_ModEnd> case 2 : <S2SV_ModStart> case 5 : elen += pc -> lengthComponentIdent ; if ( elen > fromlen ) return - EIO ; <S2SV_ModStart> break ; } <S2SV_ModEnd> } if (
Buggy code:
 int TS_OBJ_print_bio ( BIO * bio, const ASN1_OBJECT * obj ) { char obj_txt [ 128 ] ; <START_BUG> int len = OBJ_obj2txt ( obj_txt, sizeof ( obj_txt ), obj, 0 ) ; <END_BUG>  BIO_write ( bio, obj_txt, len ) ; <START_BUG> BIO_write ( bio, "\\n", 1 ) ; return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> 128 ] ; <S2SV_ModEnd> OBJ_obj2txt ( obj_txt <S2SV_ModStart> 0 ) ; BIO_printf <S2SV_ModEnd> ( bio, <S2SV_ModStart> ( bio, "%s\\n", obj_txt <S2SV_ModEnd> ) ; return