nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int xfrm_alloc_replay_state_esn ( struct xfrm_replay_state_esn * * replay_esn, struct xfrm_replay_state_esn * * preplay_esn, struct nlattr * rta ) { struct xfrm_replay_state_esn * p, * pp, * up ; <START_BUG> if (! rta ) <END_BUG> return 0 ; up = nla_data ( rta ) ;  p = kmemdup ( up, xfrm_replay_state_esn_len ( up ), GFP_KERNEL ) ; <START_BUG> if (! p ) return - ENOMEM ; <END_BUG> pp = kmemdup ( up, xfrm_replay_state_esn_len ( up ), GFP_KERNEL ) ;  if (! pp ) { kfree ( p ) ; return - ENOMEM ; } <START_BUG> * replay_esn = p ; <END_BUG> * preplay_esn = pp ; return 0 ; }

Fix:
<S2SV_ModStart> * up ; int klen, ulen ; <S2SV_ModStart> rta ) ; klen = <S2SV_ModEnd> xfrm_replay_state_esn_len ( up <S2SV_ModStart> ( up ) ; ulen = nla_len ( rta ) >= klen? klen : sizeof ( * up ) ; p = kzalloc ( klen <S2SV_ModStart> ; pp = kzalloc ( klen <S2SV_ModEnd>, GFP_KERNEL ) <S2SV_ModStart> ENOMEM ; } memcpy ( p, up, ulen ) ; memcpy ( pp, up, ulen ) ;
Buggy code:
 static void copy_and_extend_plane ( const uint8_t * src, int src_pitch, uint8_t * dst, int dst_pitch, int w, int h, int extend_top, int extend_left, int extend_bottom, int extend_right ) { int i, linesize ; const uint8_t * src_ptr1 = src ; const uint8_t * src_ptr2 = src + w - 1 ; uint8_t * dst_ptr1 = dst - extend_left ; uint8_t * dst_ptr2 = dst + w ; for ( i = 0 ; i < h ; i ++ ) { <START_BUG> vpx_memset ( dst_ptr1, src_ptr1 [ 0 ], extend_left ) ; <END_BUG>  vpx_memcpy ( dst_ptr1 + extend_left, src_ptr1, w ) ; <START_BUG> vpx_memset ( dst_ptr2, src_ptr2 [ 0 ], extend_right ) ; src_ptr1 += src_pitch ; src_ptr2 += src_pitch ; dst_ptr1 += dst_pitch ; dst_ptr2 += dst_pitch ; } src_ptr1 = dst - extend_left ; src_ptr2 = dst + dst_pitch * ( h - 1 ) - extend_left ; dst_ptr1 = dst + dst_pitch * ( - extend_top ) - extend_left ; dst_ptr2 = dst + dst_pitch * ( h ) - extend_left ; linesize = extend_left + extend_right + w ; for ( i = 0 ; i < extend_top ; i ++ ) { <END_BUG> vpx_memcpy ( dst_ptr1, src_ptr1, linesize ) ;  dst_ptr1 += dst_pitch ; } for ( i = 0 ; i < extend_bottom ; i ++ ) { <START_BUG> vpx_memcpy ( dst_ptr2, src_ptr2, linesize ) ; <END_BUG> dst_ptr2 += dst_pitch ; } }

Fix:
<S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( dst_ptr1, <S2SV_ModStart> extend_left ) ; memcpy ( dst_ptr1 + extend_left, src_ptr1, w ) ; memset <S2SV_ModEnd> ( dst_ptr2, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dst_ptr1, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dst_ptr2,
Buggy code:
 static VarLenData * * get_html_data ( MAPI_Attr * a ) { VarLenData * * body = XCALLOC ( VarLenData *, a -> num_values + 1 ) ; int j ; for ( j = 0 ; j < a -> num_values ; j ++ ) <START_BUG> { <END_BUG> body [ j ] = XMALLOC ( VarLenData, 1 ) ; body [ j ] -> len = a -> values [ j ]. len ; body [ j ] -> data = CHECKED_XCALLOC ( unsigned char, a -> values [ j ]. len ) ; memmove ( body [ j ] -> data, a -> values [ j ]. data. buf, body [ j ] -> len ) ; }  return body ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> j ++ ) { if ( a -> type == szMAPI_BINARY ) <S2SV_ModStart> ) ; } }
Buggy code:
 static int _snd_timer_stop ( struct snd_timer_instance * timeri, int keep_flag, int event ) { struct snd_timer * timer ; unsigned long flags ; if ( snd_BUG_ON (! timeri ) ) return - ENXIO ; if ( timeri -> flags & SNDRV_TIMER_IFLG_SLAVE ) { if (! keep_flag ) { spin_lock_irqsave ( & slave_active_lock, flags ) ; timeri -> flags &= ~ SNDRV_TIMER_IFLG_RUNNING ; <START_BUG> spin_unlock_irqrestore ( & slave_active_lock, flags ) ; <END_BUG> } goto __end ; } timer = timeri -> timer ; if (! timer ) return - EINVAL ; spin_lock_irqsave ( & timer -> lock, flags ) ; list_del_init ( & timeri -> ack_list ) ; list_del_init ( & timeri -> active_list ) ; if ( ( timeri -> flags & SNDRV_TIMER_IFLG_RUNNING ) &&! ( -- timer -> running ) ) { timer -> hw. stop ( timer ) ; if ( timer -> flags & SNDRV_TIMER_FLG_RESCHED ) { timer -> flags &= ~ SNDRV_TIMER_FLG_RESCHED ; snd_timer_reschedule ( timer, 0 ) ; if ( timer -> flags & SNDRV_TIMER_FLG_CHANGE ) { timer -> flags &= ~ SNDRV_TIMER_FLG_CHANGE ; timer -> hw. start ( timer ) ; } } } if (! keep_flag ) timeri -> flags &= ~ ( SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START ) ; spin_unlock_irqrestore ( & timer -> lock, flags ) ; __end : if ( event!= SNDRV_TIMER_EVENT_RESOLUTION ) snd_timer_notify1 ( timeri, event ) ; return 0 ; }

Fix:
<S2SV_ModStart> ~ SNDRV_TIMER_IFLG_RUNNING ; list_del_init ( & timeri -> ack_list ) ; list_del_init ( & timeri -> active_list ) ;
Buggy code:
 static OPJ_BOOL bmp_read_rle8_data ( FILE * IN, OPJ_UINT8 * pData, OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height ) { <START_BUG> OPJ_UINT32 x, y ; <END_BUG> OPJ_UINT8 * pix ; const OPJ_UINT8 * beyond ; beyond = pData + stride * height ; pix = pData ;  x = y = 0U ; <START_BUG> while ( y < height ) { int c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } if ( c ) { int j, c1_int ; OPJ_UINT8 c1 ; c1_int = getc ( IN ) ; if ( c1_int == EOF ) { return OPJ_FALSE ; } c1 = ( OPJ_UINT8 ) c1_int ; for ( j = 0 ; ( j < c ) && ( x < width ) && ( ( OPJ_SIZE_T ) pix < ( OPJ_SIZE_T ) beyond ) ; j ++, x ++, pix ++ ) { <END_BUG> * pix = c1 ;  } } else { c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } if ( c == 0x00 ) { x = 0 ; ++ y ; pix = pData + y * stride + x ; } else if ( c == 0x01 ) { break ; } else if ( c == 0x02 ) { c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } x += ( OPJ_UINT32 ) c ; c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } y += ( OPJ_UINT32 ) c ; pix = pData + y * stride + x ; } else { int j ; for ( j = 0 ; ( j < c ) && ( x < width ) && ( ( OPJ_SIZE_T ) pix < ( OPJ_SIZE_T ) beyond ) ; j ++, x ++, pix ++ ) { int c1_int ; OPJ_UINT8 c1 ; c1_int = getc ( IN ) ; if ( c1

Fix:
<S2SV_ModStart> x, y, written <S2SV_ModStart> = y = written = <S2SV_ModStart> pix = c1 ; written ++ <S2SV_ModStart> = c1 ; written ++ ; <S2SV_ModStart> } } } if ( written!= width * height ) { fprintf ( stderr, "warning, <S2SV_blank> image\'s <S2SV_blank> actual <S2SV_blank> size <S2SV_blank> does <S2SV_blank> not <S2SV_blank> match <S2SV_blank> advertized <S2SV_blank> one\\n" ) ; return OPJ_FALSE ; }
Buggy code:
 static krb5_error_code get_matching_data ( krb5_context context, pkinit_plg_crypto_context plg_cryptoctx, pkinit_req_crypto_context req_cryptoctx, X509 * cert, pkinit_cert_matching_data * * md_out ) { krb5_error_code ret = ENOMEM ; pkinit_cert_matching_data * md = NULL ; krb5_principal * pkinit_sans = NULL, * upn_sans = NULL ; size_t i, j ; <START_BUG> char buf [ DN_BUF_LEN ] ; <END_BUG> unsigned int bufsize = sizeof ( buf ) ; * md_out = NULL ; md = calloc ( 1, sizeof ( * md ) ) ; if ( md == NULL ) goto cleanup ;  X509_NAME_oneline_ex ( X509_get_subject_name ( cert ), buf, & bufsize, <START_BUG> XN_FLAG_SEP_COMMA_PLUS ) ; <END_BUG> md -> subject_dn = strdup ( buf ) ;  if ( md -> subject_dn == NULL ) { ret = ENOMEM ; goto cleanup ; } <START_BUG> X509_NAME_oneline_ex ( X509_get_issuer_name ( cert ), buf, & bufsize, <END_BUG> XN_FLAG_SEP_COMMA_PLUS ) ;  md -> issuer_dn = strdup ( buf ) ; <START_BUG> if ( md -> issuer_dn == NULL ) { ret = ENOMEM ; goto cleanup ; } ret = crypto_retrieve_X509_sans ( context, plg_cryptoctx, req_cryptoctx, cert, & pkinit_sans, & upn_sans, NULL ) ; if ( ret ) goto cleanup ; j = 0 ; if ( pkinit_sans!= NULL ) { for ( i = 0 ; pkinit_sans [ i ]!= NULL ; i ++ ) j ++ ; } if ( upn_sans!= NULL ) { for ( i = 0 ; upn_sans [ i ]!= NULL ; i ++ ) j ++ ; } if ( j!= 0 ) { md -> sans = calloc ( ( size_t ) j + 1, sizeof ( * md -> sans ) ) ; if ( md -> sans == NULL ) { ret = ENOMEM<END_BUG>

Fix:
<S2SV_ModStart>, j ; * md_out = NULL ; md = calloc ( 1, sizeof ( <S2SV_ModEnd> * md ) <S2SV_ModStart> goto cleanup ; ret = rfc2253_name <S2SV_ModEnd> ( X509_get_subject_name ( <S2SV_ModStart> cert ), & <S2SV_ModEnd> md -> subject_dn <S2SV_ModStart> md -> subject_dn ) ; if ( ret ) goto cleanup ; ret = rfc2253_name <S2SV_ModEnd> ( X509_get_issuer_name ( <S2SV_ModStart> cert ), & <S2SV_ModEnd> md -> issuer_dn <S2SV_ModStart> md -> issuer_dn ) ; if ( ret ) goto cleanup ; <S2SV_ModEnd> ret = crypto_retrieve_X509_sans
Buggy code:
 void tcpUpdateRetransmitQueue ( Socket * socket ) { size_t length ; TcpQueueItem * prevQueueItem ; TcpQueueItem * queueItem ; TcpHeader * header ; prevQueueItem = NULL ; queueItem = socket -> retransmitQueue ; while ( queueItem!= NULL ) { header = ( TcpHeader * ) queueItem -> header ; if ( header -> flags & TCP_FLAG_SYN ) <START_BUG> length = 1 ; <END_BUG>  else if ( header -> flags & TCP_FLAG_FIN ) <START_BUG> length = queueItem -> length + 1 ; <END_BUG> else  length = queueItem -> length ; if ( TCP_CMP_SEQ ( socket -> sndUna, ntohl ( header -> seqNum ) + length ) >= 0 ) { if ( prevQueueItem == NULL ) { socket -> retransmitQueue = queueItem -> next ; memPoolFree ( queueItem ) ; queueItem = socket -> retransmitQueue ; } else { prevQueueItem -> next = queueItem -> next ; memPoolFree ( queueItem ) ; queueItem = prevQueueItem -> next ; } tcpTimerStart ( & socket -> retransmitTimer, socket -> rto ) ; socket -> retransmitCount = 0 ; } else { prevQueueItem = queueItem ; queueItem = queueItem -> next ; } } if ( socket -> retransmitQueue == NULL ) tcpTimerStop ( & socket -> retransmitTimer ) ; }

Fix:
<S2SV_ModStart> & TCP_FLAG_SYN ) { <S2SV_ModStart> = 1 ; } <S2SV_ModStart> & TCP_FLAG_FIN ) { <S2SV_ModStart> + 1 ; } else { length = queueItem -> length ; } <S2SV_ModEnd> if ( TCP_CMP_SEQ
Buggy code:
 static int decode_zbuf ( AVBPrint * bp, const uint8_t * data, const uint8_t * data_end ) { z_stream zstream ; unsigned char * buf ; unsigned buf_size ; int ret ; zstream. zalloc = ff_png_zalloc ; zstream. zfree = ff_png_zfree ; zstream. opaque = NULL ; if ( inflateInit ( & zstream )!= Z_OK ) return AVERROR_EXTERNAL ; zstream. next_in = ( unsigned char * ) data ; zstream. avail_in = data_end - data ; av_bprint_init ( bp, 0, - 1 ) ; while ( zstream. avail_in > 0 ) { <START_BUG> av_bprint_get_buffer ( bp, 1, & buf, & buf_size ) ; <END_BUG> if (! buf_size ) { ret = AVERROR ( ENOMEM ) ; goto fail ; } zstream. next_out = buf ;  zstream. avail_out = buf_size ; <START_BUG> ret = inflate ( & zstream, Z_PARTIAL_FLUSH ) ; if ( ret!= Z_OK && ret!= Z_STREAM_END ) { ret = AVERROR_EXTERNAL ; goto fail ; } bp -> len += zstream. next_out - buf ; if ( ret == Z_STREAM_END ) break ; } inflateEnd ( & zstream ) ; bp -> str [ bp -> len ] = 0 ; return 0 ; fail : inflateEnd ( & zstream ) ; av_bprint_finalize ( bp, NULL ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ( bp, 2, & buf, & buf_size ) ; if ( buf_size < 2 <S2SV_ModEnd> ) { ret <S2SV_ModStart> avail_out = buf_size - 1
Buggy code:
 u_int chdlc_print ( netdissect_options * ndo, register const u_char * p, u_int length ) { u_int proto ; const u_char * bp = p ; if ( length < CHDLC_HDRLEN ) goto trunc ; ND_TCHECK2 ( * p, CHDLC_HDRLEN ) ; proto = EXTRACT_16BITS ( & p [ 2 ] ) ; if ( ndo -> ndo_eflag ) { ND_PRINT ( ( ndo, "%s,   ethertype   %s   (0x%04x),   length   %u:   ", tok2str ( chdlc_cast_values, "0x%02x", p [ 0 ] ), tok2str ( ethertype_values, "Unknown", proto ), proto, length ) ) ; } length -= CHDLC_HDRLEN ; p += CHDLC_HDRLEN ; switch ( proto ) { case ETHERTYPE_IP : ip_print ( ndo, p, length ) ; break ; case ETHERTYPE_IPV6 : ip6_print ( ndo, p, length ) ; break ; case CHDLC_TYPE_SLARP : chdlc_slarp_print ( ndo, p, length ) ; break ; # if 0 case CHDLC_TYPE_CDP : chdlc_cdp_print ( p, length ) ; break ; # endif case ETHERTYPE_MPLS : case ETHERTYPE_MPLS_MULTI : mpls_print ( ndo, p, length ) ; break ; case ETHERTYPE_ISO : if ( length < 2 ) goto trunc ; ND_TCHECK_16BITS ( p ) ; if ( * ( p + 1 ) == 0x81 || * ( p + 1 ) == 0x82 || * ( p + 1 ) == 0x83 ) <START_BUG> isoclns_print ( ndo, p + 1, length - 1, ndo -> ndo_snapend - p - 1 ) ; <END_BUG> else  isoclns_print ( ndo, p, length, ndo -> ndo_snapend - p ) ; <START_BUG> break ; default : if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo,<END_BUG>

Fix:
<S2SV_ModStart> length - 1 <S2SV_ModEnd> ) ; else <S2SV_ModStart> p, length <S2SV_ModEnd> ) ; break
Buggy code:
 void init_directory_config ( directory_config * dcfg ) { if ( dcfg == NULL ) return ; if ( dcfg -> is_enabled == NOT_SET ) dcfg -> is_enabled = 0 ; if ( dcfg -> reqbody_access == NOT_SET ) dcfg -> reqbody_access = 0 ; if ( dcfg -> reqintercept_oe == NOT_SET ) dcfg -> reqintercept_oe = 0 ; if ( dcfg -> reqbody_buffering == NOT_SET ) dcfg -> reqbody_buffering = REQUEST_BODY_FORCEBUF_OFF ; if ( dcfg -> reqbody_inmemory_limit == NOT_SET ) dcfg -> reqbody_inmemory_limit = REQUEST_BODY_DEFAULT_INMEMORY_LIMIT ; if ( dcfg -> reqbody_limit == NOT_SET ) dcfg -> reqbody_limit = REQUEST_BODY_DEFAULT_LIMIT ; if ( dcfg -> reqbody_no_files_limit == NOT_SET ) dcfg -> reqbody_no_files_limit = REQUEST_BODY_NO_FILES_DEFAULT_LIMIT ; if ( dcfg -> resbody_access == NOT_SET ) dcfg -> resbody_access = 0 ; if ( dcfg -> of_limit == NOT_SET ) dcfg -> of_limit = RESPONSE_BODY_DEFAULT_LIMIT ; if ( dcfg -> if_limit_action == NOT_SET ) dcfg -> if_limit_action = REQUEST_BODY_LIMIT_ACTION_REJECT ; if ( dcfg -> of_limit_action == NOT_SET ) dcfg -> of_limit_action = RESPONSE_BODY_LIMIT_ACTION_REJECT ; if ( dcfg -> of_mime_types == NOT_SET_P ) { dcfg -> of_mime_types = apr_table_make ( dcfg -> mp, 3 ) ; if ( dcfg -> of_mime_types_cleared!= 1 ) { apr_table_setn ( dcfg -> of_mime_types, "text//plain", "1" ) ; apr_table_setn ( dcfg -> of_mime_types, "text//html", "1" ) ; } } if ( dcfg -> debuglog_fd == NOT_SET_P ) dcfg -> debuglog_fd = NULL ; if

Fix:
<S2SV_ModStart> = 0 ; if ( dcfg -> xml_external_entity == NOT_SET ) dcfg -> xml_external_entity = 0 ;
Buggy code:
 void next_character ( void ) <START_BUG> { <END_BUG> strlcpy ( cipher, english_alphabet, ENGLISH_ALPHABET_BUF ) ; random_permute_char ( cipher, strlen ( cipher ) ) ; static char CONFIDENTIAL current_word [ CURRENT_WORD_BUF ] ; get_current_word ( current_word ) ; if ( strlen ( current_word ) > 4 ) { memzero ( current_word, sizeof ( current_word ) ) ; recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_SyntaxError, "Words   were   not   entered   correctly.   Make   sure   you   are   using   the   substition   cipher." ) ; layoutHome ( ) ; return ; } CharacterRequest resp ; memset ( & resp, 0, sizeof ( CharacterRequest ) ) ; resp. word_pos = get_current_word_pos ( ) ; resp. character_pos = strlen ( current_word ) ; msg_write ( MessageType_MessageType_CharacterRequest, & resp ) ; bool auto_completed = false ; if ( strlen ( current_word ) >= 3 ) { auto_completed = attempt_auto_complete ( current_word ) ; } # if DEBUG_LINK if ( auto_completed ) { strlcpy ( auto_completed_word, current_word, CURRENT_WORD_BUF ) ; } else { auto_completed_word [ 0 ] = '\\0' ; } # endif format_current_word ( current_word, auto_completed ) ; layout_cipher ( current_word, cipher ) ; memzero ( current_word, sizeof ( current_word ) ) ; }

Fix:
<S2SV_ModStart> void ) { if (! recovery_started ) { recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_UnexpectedMessage, "Not <S2SV_blank> in <S2SV_blank> Recovery <S2SV_blank> mode" ) ; layoutHome ( ) ; return ; }
Buggy code:
 static gboolean export_desktop_file ( const char * app, const char * branch, const char * arch, GKeyFile * metadata, const char * const * previous_ids, int parent_fd, const char * name, struct stat * stat_buf, char * * target, GCancellable * cancellable, GError * * error ) { gboolean ret = FALSE ; glnx_autofd int desktop_fd = - 1 ; g_autofree char * tmpfile_name = g_strdup_printf ( "export-desktop-XXXXXX" ) ; g_autoptr ( GOutputStream ) out_stream = NULL ; g_autofree gchar * data = NULL ; gsize data_len ; g_autofree gchar * new_data = NULL ; gsize new_data_len ; g_autoptr ( GKeyFile ) keyfile = NULL ; g_autofree gchar * old_exec = NULL ; gint old_argc ; g_auto ( GStrv ) old_argv = NULL ; g_auto ( GStrv ) groups = NULL ; GString * new_exec = NULL ; g_autofree char * escaped_app = maybe_quote ( app ) ; g_autofree char * escaped_branch = maybe_quote ( branch ) ; g_autofree char * escaped_arch = maybe_quote ( arch ) ; int i ; if (! flatpak_openat_noatime ( parent_fd, name, & desktop_fd, cancellable, error ) ) goto out ; if (! read_fd ( desktop_fd, stat_buf, & data, & data_len, error ) ) goto out ; keyfile = g_key_file_new ( ) ; if (! g_key_file_load_from_data ( keyfile, data, data_len, G_KEY_FILE_KEEP_TRANSLATIONS, error ) ) goto out ; if ( g_str_has_suffix ( name, ".service" ) ) { g_autofree gchar * dbus_name = NULL ; g_autofree gchar * expected_dbus_name = g_strndup ( name, strlen ( name ) - strlen ( ".service" ) ) ; dbus_name = g_key_file_get_string ( keyfile

Fix:
<S2SV_ModStart> else if ( g_str_has_prefix <S2SV_ModEnd> ( arg, <S2SV_ModStart>, "@@" ) <S2SV_ModEnd> ) g_print (
Buggy code:
 static void encode_frame ( struct stream_state * stream, struct VpxEncoderConfig * global, struct vpx_image * img, unsigned int frames_in ) { vpx_codec_pts_t frame_start, next_frame_start ; struct vpx_codec_enc_cfg * cfg = & stream -> config. cfg ; struct vpx_usec_timer timer ; frame_start = ( cfg -> g_timebase. den * ( int64_t ) ( frames_in - 1 ) * global -> framerate. den ) // cfg -> g_timebase. num // global -> framerate. num ; next_frame_start = ( cfg -> g_timebase. den * ( int64_t ) ( frames_in ) * global -> framerate. den ) // cfg -> g_timebase. num // global -> framerate. num ; <START_BUG> if ( img && ( img -> d_w!= cfg -> g_w || img -> d_h!= cfg -> g_h ) ) { <END_BUG>  if (! stream -> img ) <START_BUG> <END_BUG> stream -> img = vpx_img_alloc ( NULL, VPX_IMG_FMT_I420,  cfg -> g_w, cfg -> g_h, 16 ) ; I420Scale ( img -> planes [ VPX_PLANE_Y ], img -> stride [ VPX_PLANE_Y ], img -> planes [ VPX_PLANE_U ], img -> stride [ VPX_PLANE_U ], img -> planes [ VPX_PLANE_V ], img -> stride [ VPX_PLANE_V ], img -> d_w, img -> d_h, stream -> img -> planes [ VPX_PLANE_Y ], stream -> img -> stride [ VPX_PLANE_Y ], stream -> img -> planes [ VPX_PLANE_U ], stream -> img -> stride [ VPX_PLANE_U ], stream -> img -> planes [ VPX_PLANE_V ], stream -> img -> stride [ VPX_PLANE_V ], stream -> img -> d_w, stream -> img -> d_h, kFilterBox ) ; <START_BUG> img =<END_BUG>

Fix:
<S2SV_ModStart>. num ; # if CONFIG_VP9_HIGHBITDEPTH if ( img ) { if ( ( img -> fmt & VPX_IMG_FMT_HIGHBITDEPTH ) <S2SV_ModEnd> && ( img <S2SV_ModStart> { if ( img -> fmt!= VPX_IMG_FMT_I42016 ) { fprintf ( stderr, "%s <S2SV_blank> can <S2SV_blank> only <S2SV_blank> scale <S2SV_blank> 4:2:0 <S2SV_blank> inputs\\n", exec_name ) ; exit ( EXIT_FAILURE ) ; } # if CONFIG_LIBYUV if ( <S2SV_ModStart> -> img ) { <S2SV_ModStart> ( NULL, VPX_IMG_FMT_I42016, cfg -> g_w, cfg -> g_h, 16 ) ; } I420Scale_16 ( ( uint16 * ) img -> planes [ VPX_PLANE_Y ], img -> stride [ VPX_PLANE_Y ] // 2, ( uint16 * ) img -> planes [ VPX_PLANE_U ], img -> stride [ VPX_PLANE_U ] // 2, ( uint16 * ) img -> planes [ VPX_PLANE_V ]
Buggy code:
 static int sanity_check_raw_super ( struct f2fs_sb_info * sbi, struct buffer_head * bh ) { struct f2fs_super_block * raw_super = ( struct f2fs_super_block * ) ( bh -> b_data + F2FS_SUPER_OFFSET ) ; struct super_block * sb = sbi -> sb ; unsigned int blocksize ; if ( F2FS_SUPER_MAGIC!= le32_to_cpu ( raw_super -> magic ) ) { f2fs_msg ( sb, KERN_INFO, "Magic   Mismatch,   valid(0x%x)   -   read(0x%x)", F2FS_SUPER_MAGIC, le32_to_cpu ( raw_super -> magic ) ) ; return 1 ; } if ( F2FS_BLKSIZE!= PAGE_SIZE ) { f2fs_msg ( sb, KERN_INFO, "Invalid   page_cache_size   (%lu),   supports   only   4KB\\n", PAGE_SIZE ) ; return 1 ; } blocksize = 1 << le32_to_cpu ( raw_super -> log_blocksize ) ; if ( blocksize!= F2FS_BLKSIZE ) { f2fs_msg ( sb, KERN_INFO, "Invalid   blocksize   (%u),   supports   only   4KB\\n", blocksize ) ; return 1 ; } if ( le32_to_cpu ( raw_super -> log_blocks_per_seg )!= 9 ) { f2fs_msg ( sb, KERN_INFO, "Invalid   log   blocks   per   segment   (%u)\\n", le32_to_cpu ( raw_super -> log_blocks_per_seg ) ) ; return 1 ; } if ( le32_to_cpu ( raw_super -> log_sectorsize ) > F2FS_MAX_LOG_SECTOR_SIZE || le32_to_cpu ( raw_super -> log_sectorsize ) < F2FS_MIN_LOG_SECTOR_SIZE ) { f2fs_msg ( sb, KERN_INFO, "Invalid   log   sectorsize   (%u)", le32_to_cpu ( raw_super -> log_sectors

Fix:
<S2SV_ModStart> } if ( le32_to_cpu ( raw_super -> segment_count ) > F2FS_MAX_SEGMENT ) { f2fs_msg ( sb, KERN_INFO, "Invalid <S2SV_blank> segment <S2SV_blank> count <S2SV_blank> (%u)", le32_to_cpu ( raw_super -> segment_count ) ) ; return 1 ; } if (
Buggy code:
 static int PARSER_FLAGS ( PyCompilerFlags * flags ) { int parser_flags = 0 ; if (! flags ) return 0 ; if ( flags -> cf_flags & PyCF_DONT_IMPLY_DEDENT ) parser_flags |= PyPARSE_DONT_IMPLY_DEDENT ; if ( flags -> cf_flags & PyCF_IGNORE_COOKIE ) parser_flags |= PyPARSE_IGNORE_COOKIE ; if ( flags -> cf_flags & CO_FUTURE_BARRY_AS_BDFL ) parser_flags |= PyPARSE_BARRY_AS_BDFL ; <START_BUG> return parser_flags ; <END_BUG> }

Fix:
<S2SV_ModStart> |= PyPARSE_BARRY_AS_BDFL ; if ( flags -> cf_flags & PyCF_TYPE_COMMENTS ) parser_flags |= PyPARSE_TYPE_COMMENTS ;
Buggy code:
 static int tcp_v6_connect ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct sockaddr_in6 * usin = ( struct sockaddr_in6 * ) uaddr ; struct inet_sock * inet = inet_sk ( sk ) ; struct inet_connection_sock * icsk = inet_csk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct tcp_sock * tp = tcp_sk ( sk ) ; <START_BUG> struct in6_addr * saddr = NULL, * final_p, final ; <END_BUG> struct flowi6 fl6 ; struct dst_entry * dst ; int addr_type ; int err ; if ( addr_len < SIN6_LEN_RFC2133 ) return - EINVAL ; if ( usin -> sin6_family!= AF_INET6 ) return - EAFNOSUPPORT ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; if ( np -> sndflow ) { fl6. flowlabel = usin -> sin6_flowinfo & IPV6_FLOWINFO_MASK ; IP6_ECN_flow_init ( fl6. flowlabel ) ; if ( fl6. flowlabel & IPV6_FLOWLABEL_MASK ) { struct ip6_flowlabel * flowlabel ; flowlabel = fl6_sock_lookup ( sk, fl6. flowlabel ) ; if (! flowlabel ) return - EINVAL ; fl6_sock_release ( flowlabel ) ; } } if ( ipv6_addr_any ( & usin -> sin6_addr ) ) usin -> sin6_addr. s6_addr [ 15 ] = 0x1 ; addr_type = ipv6_addr_type ( & usin -> sin6_addr ) ; if ( addr_type & IPV6_ADDR_MULTICAST ) return - ENETUNREACH ; if ( addr_type & IPV6_ADDR_LINKLOCAL ) { if ( addr_len >= sizeof ( struct sockaddr_in6 ) && usin -> sin6_scope_id ) { if ( sk -> sk_bound_dev_if && sk -> sk_bound_dev_if!= usin -> sin6_scope_id ) return - EINVAL ; sk -> sk_bound_dev_

Fix:
<S2SV_ModStart> final_p, final ; struct ipv6_txoptions * opt <S2SV_ModStart> -> inet_sport ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> & fl6, <S2SV_ModEnd> opt, & <S2SV_ModStart> ; if ( <S2SV_ModEnd> opt ) icsk <S2SV_ModStart> -> icsk_ext_hdr_len = <S2SV_ModEnd> opt -> opt_flen <S2SV_ModStart> -> opt_flen + <S2SV_ModEnd> opt -> opt_nflen <S2SV_ModStart> opt -> opt_nflen <S2SV_ModEnd> ; tp ->
Buggy code:
 <START_BUG> static inline struct enamemem * <END_BUG> lookup_bytestring ( netdissect_options * ndo, register const u_char * bs, const unsigned int nlen ) {  struct enamemem * tp ; <START_BUG> register u_int i, j, k ; if ( nlen >= 6 ) { k = ( bs [ 0 ] << 8 ) | bs [ 1 ] ; j = ( bs [ 2 ] << 8 ) | bs [ 3 ] ; i = ( bs [ 4 ] << 8 ) | bs [ 5 ] ; } else if ( nlen >= 4 ) { k = ( bs [ 0 ] << 8 ) | bs [ 1 ] ; j = ( bs [ 2 ] << 8 ) | bs [ 3 ] ; i = 0 ; } else i = j = k = 0 ; tp = & bytestringtable [ ( i ^ j ) & ( HASHNAMESIZE - 1 ) ] ; <END_BUG> while ( tp -> e_nxt )  if ( tp -> e_addr0 == i && <START_BUG> tp -> e_addr1 == j && <END_BUG>  tp -> e_addr2 == k && <START_BUG> <END_BUG> memcmp ( ( const char * ) bs, ( const char * ) ( tp -> e_bs ), nlen ) == 0 )  return tp ; else <START_BUG> tp = tp -> e_nxt ; <END_BUG> tp -> e_addr0 = i ; tp -> e_addr1 = j ; tp -> e_addr2 = k ; tp -> e_bs = ( u_char * ) calloc ( 1, nlen + 1 ) ;  if ( tp -> e_bs == NULL ) <START_BUG> ( * ndo -> ndo_error ) ( ndo, "lookup_bytestring:   calloc" ) ; <END_BUG> memcpy ( tp -> e_bs, bs, nlen ) ;  <START_BUG> tp -> e_nxt = ( struct enamemem * ) calloc ( 1, sizeof ( * tp ) ) ; <END_BUG>  if ( tp -> e_nxt == NULL ) <START_BUG> ( * ndo -> ndo_error ) ( ndo, "lookup_bytestring:   calloc" ) ; return tp ; }<END_BUG>

Fix:
<S2SV_ModStart> static inline struct bsnamemem <S2SV_ModEnd> * lookup_bytestring ( <S2SV_ModStart> ) { struct bsnamemem <S2SV_ModEnd> * tp ; <S2SV_ModStart> ( tp -> bs_nxt ) if ( nlen == tp -> bs_nbytes <S2SV_ModEnd> && tp -> <S2SV_ModStart> && tp -> bs_addr0 == i <S2SV_ModEnd> && tp -> <S2SV_ModStart> && tp -> bs_addr1 == j && tp -> bs_addr2 <S2SV_ModEnd> == k && <S2SV_ModStart> ( tp -> bs_bytes <S2SV_ModEnd> ), nlen <S2SV_ModStart> = tp -> bs_nxt ; tp -> bs_addr0 = i ; tp -> bs_addr1 = j ; tp -> bs_addr2 = k ; tp -> bs_bytes <S2SV_ModEnd> = ( u_char <S2SV_ModStart> ( tp -> bs_bytes <S2SV_ModEnd> == NULL ) <S2SV_ModStart> ( tp -> bs_bytes, bs, nlen ) ; tp -> bs_nbytes = nlen ; tp -> bs_nxt <S2SV_ModEnd> = ( struct <S2SV_ModStart> = ( struct bsnamemem <S2SV_ModEnd> * ) calloc <S2SV_ModStart> ( tp -> bs_nxt <S2SV_ModEnd> == NULL )
Buggy code:
 <START_BUG> void ntlm_print_negotiate_flags ( UINT32 flags ) <END_BUG> { int i ; const char * str ; WLog_INFO ( TAG, "negotiateFlags   \\"0x%08" PRIX32 "\\"", flags ) ; for ( i = 31 ; i >= 0 ; i -- ) { if ( ( flags >> i ) & 1 ) { str = NTLM_NEGOTIATE_STRINGS [ ( 31 - i ) ] ; WLog_INFO ( TAG, "\\t%s   (%d),", str, ( 31 - i ) ) ; } } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 struct resource_pool * dce100_create_resource_pool ( uint8_t num_virtual_links, struct dc * dc ) { struct dce110_resource_pool * pool = kzalloc ( sizeof ( struct dce110_resource_pool ), GFP_KERNEL ) ; if (! pool ) return NULL ; if ( construct ( num_virtual_links, dc, pool ) ) return & pool -> base ; <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> -> base ; kfree ( pool ) ;
Buggy code:
 <START_BUG> static void <END_BUG> swabHorDiff32 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { uint32 * wp = ( uint32 * ) cp0 ; tmsize_t wc = cc // 4 ;  horDiff32 ( tif, cp0, cc ) ; <START_BUG> TIFFSwabArrayOfLong ( wp, wc ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> swabHorDiff32 ( TIFF <S2SV_ModStart> // 4 ; if (! <S2SV_ModStart>, cc ) ) return 0 <S2SV_ModStart> wc ) ; return 1 ;
Buggy code:
 int sysMapFile ( const char * fn, MemMapping * pMap ) { memset ( pMap, 0, sizeof ( * pMap ) ) ; if ( fn && fn [ 0 ] == '@' ) { FILE * mapf = fopen ( fn + 1, "r" ) ; if ( mapf == NULL ) { LOGV ( "Unable   to   open   \'%s\':   %s\\n", fn + 1, strerror ( errno ) ) ; return - 1 ; } if ( sysMapBlockFile ( mapf, pMap )!= 0 ) { LOGW ( "Map   of   \'%s\'   failed\\n", fn ) ; <START_BUG> return - 1 ; <END_BUG> } fclose ( mapf ) ; } else { int fd = open ( fn, O_RDONLY, 0 ) ; if ( fd < 0 ) { LOGE ( "Unable   to   open   \'%s\':   %s\\n", fn, strerror ( errno ) ) ; return - 1 ; } if ( sysMapFD ( fd, pMap )!= 0 ) { LOGE ( "Map   of   \'%s\'   failed\\n", fn ) ; close ( fd ) ; return - 1 ; } close ( fd ) ; } return 0 ; }

Fix:
<S2SV_ModStart> fn ) ; fclose ( mapf ) ;
Buggy code:
 int bus_verify_polkit_async ( sd_bus_message * call, int capability, const char * action, const char * * details, bool interactive, uid_t good_user, Hashmap * * registry, sd_bus_error * ret_error ) { # if ENABLE_POLKIT _cleanup_ ( sd_bus_message_unrefp ) sd_bus_message * pk = NULL ; AsyncPolkitQuery * q ; <START_BUG> const char * sender ; <END_BUG>  sd_bus_message_handler_t callback ; <START_BUG> void * userdata ; int c ; # endif int r ; assert ( call ) ; assert ( action ) ; <END_BUG> assert ( registry ) ;  r = check_good_user ( call, good_user ) ; if ( r!= 0 ) return r ; # if ENABLE_POLKIT q = hashmap_get ( * registry, call ) ; if ( q ) { int authorized, challenge ; assert ( q -> reply ) ; if (! streq ( q -> action, action ) ||! strv_equal ( q -> details, ( char * * ) details ) ) return - ESTALE ; if ( sd_bus_message_is_method_error ( q -> reply, NULL ) ) { const sd_bus_error * e ; e = sd_bus_message_get_error ( q -> reply ) ; if ( sd_bus_error_has_name ( e, SD_BUS_ERROR_SERVICE_UNKNOWN ) || sd_bus_error_has_name ( e, SD_BUS_ERROR_NAME_HAS_NO_OWNER ) ) return - EACCES ; sd_bus_error_copy ( ret_error, e ) ; return - sd_bus_error_get_errno ( e ) ; } r = sd_bus_message_enter_container ( q -> reply, 'r', "bba{ss}" ) ; if ( r >= 0 ) r = sd_bus_message_read ( q -> reply, "bb", & authorized, & challenge ) ; if ( r < 0 ) return r ; if ( authorized ) return 1 ; if ( challenge ) return sd_bus_error_set ( ret_error, SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED, "Interactive   authentication   required." ) ; return - E

Fix:
<S2SV_ModStart> * q ; int c ; # endif <S2SV_ModStart> * sender ; int r ; assert ( call ) ; assert ( action ) ; assert ( registry ) ; r = check_good_user ( call, good_user ) ; if ( r!= 0 ) return r ; # if ENABLE_POLKIT q = hashmap_get ( * registry, call ) ; if ( q ) { int authorized, challenge ; assert ( q -> reply ) ; if (! streq ( q -> action, action ) ||! strv_equal ( q -> details, ( char * * ) details ) ) return - ESTALE ; if ( sd_bus_message_is_method_error ( q -> reply, NULL ) ) { const sd_bus_error * e ; e = sd_bus_message_get_error ( q -> reply ) ; if ( sd_bus_error_has_name ( e, SD_BUS_ERROR_SERVICE_UNKNOWN ) || sd_bus_error_has_name ( e, SD_BUS_ERROR_NAME_HAS_NO_OWNER ) ) return - EACCES ; sd_bus_error_copy ( ret_error, e ) ;
Buggy code:
 void vp9_update_mbgraph_stats ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; int i, n_frames = vp9_lookahead_depth ( cpi -> lookahead ) ; <START_BUG> YV12_BUFFER_CONFIG * golden_ref = get_ref_frame_buffer ( cpi, GOLDEN_FRAME ) ; <END_BUG> if ( n_frames <= cpi -> rc. frames_till_gf_update_due ) return ; if ( n_frames > MAX_LAG_BUFFERS ) n_frames = MAX_LAG_BUFFERS ; cpi -> mbgraph_n_frames = n_frames ; for ( i = 0 ; i < n_frames ; i ++ ) { MBGRAPH_FRAME_STATS * frame_stats = & cpi -> mbgraph_stats [ i ] ;  vpx_memset ( frame_stats -> mb_stats, 0, <START_BUG> cm -> mb_rows * cm -> mb_cols * sizeof ( * cpi -> mbgraph_stats [ i ]. mb_stats ) ) ; } for ( i = 0 ; i < n_frames ; i ++ ) { MBGRAPH_FRAME_STATS * frame_stats = & cpi -> mbgraph_stats [ i ] ; struct lookahead_entry * q_cur = vp9_lookahead_peek ( cpi -> lookahead, i ) ; assert ( q_cur!= NULL ) ; update_mbgraph_frame_stats ( cpi, frame_stats, & q_cur -> img, golden_ref, cpi -> Source ) ; } <END_BUG> vp9_clear_system_state ( ) ;  separate_arf_mbs ( cpi ) ; }

Fix:
<S2SV_ModStart> cpi, GOLDEN_FRAME ) ; assert ( golden_ref!= NULL <S2SV_ModStart> i ] ; memset <S2SV_ModEnd> ( frame_stats -> <S2SV_ModStart> ) ; } vpx_clear_system_state <S2SV_ModEnd> ( ) ;
Buggy code:
 static int htc_setup_complete ( struct htc_target * target ) { struct sk_buff * skb ; struct htc_comp_msg * comp_msg ; int ret = 0 ; unsigned long time_left ; skb = alloc_skb ( 50 + sizeof ( struct htc_frame_hdr ), GFP_ATOMIC ) ; if (! skb ) { dev_err ( target -> dev, "failed   to   allocate   send   buffer\\n" ) ; return - ENOMEM ; } skb_reserve ( skb, sizeof ( struct htc_frame_hdr ) ) ; comp_msg = skb_put ( skb, sizeof ( struct htc_comp_msg ) ) ; comp_msg -> msg_id = cpu_to_be16 ( HTC_MSG_SETUP_COMPLETE_ID ) ; target -> htc_flags |= HTC_OP_START_WAIT ; ret = htc_issue_send ( target, skb, skb -> len, 0, ENDPOINT0 ) ; if ( ret ) goto err ; time_left = wait_for_completion_timeout ( & target -> cmd_wait, HZ ) ; if (! time_left ) { dev_err ( target -> dev, "HTC   start   timeout\\n" ) ; <START_BUG> return - ETIMEDOUT ; <END_BUG> } return 0 ; err : kfree_skb ( skb ) ; return - EINVAL ; }

Fix:
<S2SV_ModStart> "HTC <S2SV_blank> start <S2SV_blank> timeout\\n" ) ; kfree_skb ( skb ) ;
Buggy code:
 ssize_t cdf_read_short_sector ( const cdf_stream_t * sst, void * buf, size_t offs, size_t len, const cdf_header_t * h, cdf_secid_t id ) { <START_BUG> size_t ss = CDF_SEC_SIZE ( h ) ; <END_BUG> size_t pos = CDF_SHORT_SEC_POS ( h, id ) ; assert ( ss == len ) ;  if ( pos > ss * sst -> sst_len ) { <START_BUG> DPRINTF ( ( "Out   of   bounds   read   %" SIZE_T_FORMAT "u   >   %" SIZE_T_FORMAT "u\\n", <END_BUG> pos, ss * sst -> sst_len ) ) ;  return - 1 ; } ( void ) memcpy ( ( ( char * ) buf ) + offs, ( ( const char * ) sst -> sst_tab ) + pos, len ) ; return len ; }

Fix:
<S2SV_ModStart> size_t ss = CDF_SHORT_SEC_SIZE <S2SV_ModEnd> ( h ) <S2SV_ModStart> ( pos > CDF_SEC_SIZE ( h ) <S2SV_ModEnd> * sst -> <S2SV_ModStart>, pos, CDF_SEC_SIZE ( h ) <S2SV_ModEnd> * sst ->
Buggy code:
 static int l2tp_ip6_bind ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sockaddr_l2tpip6 * addr = ( struct sockaddr_l2tpip6 * ) uaddr ; struct net * net = sock_net ( sk ) ; __be32 v4addr = 0 ; int addr_type ; int err ; <START_BUG> if (! sock_flag ( sk, SOCK_ZAPPED ) ) <END_BUG> return - EINVAL ; if ( addr -> l2tp_family!= AF_INET6 ) return - EINVAL ; if ( addr_len < sizeof ( * addr ) ) return - EINVAL ; addr_type = ipv6_addr_type ( & addr -> l2tp_addr ) ; if ( addr_type == IPV6_ADDR_MAPPED ) return - EADDRNOTAVAIL ; if ( addr_type & IPV6_ADDR_MULTICAST ) return - EADDRNOTAVAIL ; err = - EADDRINUSE ; read_lock_bh ( & l2tp_ip6_lock ) ; if ( __l2tp_ip6_bind_lookup ( net, & addr -> l2tp_addr, sk -> sk_bound_dev_if, addr -> l2tp_conn_id ) ) goto out_in_use ; read_unlock_bh ( & l2tp_ip6_lock ) ; lock_sock ( sk ) ; err = - EINVAL ;  if ( sk -> sk_state!= TCP_CLOSE ) <START_BUG> goto out_unlock ; rcu_read_lock ( ) ; if ( addr_type!= IPV6_ADDR_ANY ) { struct net_device * dev = NULL ; if ( addr_type & IPV6_ADDR_LINKLOCAL ) { if ( addr_len >= sizeof ( struct sockaddr_in6 ) && addr -> l2tp_scope_id ) { sk -> sk_bound_dev_if = addr -> l2tp_scope_id ; } if (! sk -> sk_bound_dev_if ) goto out_unlock_rcu ; err = - ENODEV ; dev = dev_get_<END_BUG>

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> addr -> l2tp_family <S2SV_ModStart> ; if (! sock_flag ( sk, SOCK_ZAPPED ) ) goto out_unlock ; if (
Buggy code:
 static int mount_entry_on_absolute_rootfs ( struct mntent * mntent, const struct lxc_rootfs * rootfs, const char * lxc_name ) { char * aux ; char path [ MAXPATHLEN ] ; int r, ret = 0, offset ; const char * lxcpath ; lxcpath = lxc_global_config_value ( "lxc.lxcpath" ) ; if (! lxcpath ) { ERROR ( "Out   of   memory" ) ; return - 1 ; } r = snprintf ( path, MAXPATHLEN, "%s//%s//rootfs", lxcpath, lxc_name ) ; if ( r < 0 || r >= MAXPATHLEN ) goto skipvarlib ; aux = strstr ( mntent -> mnt_dir, path ) ; if ( aux ) { offset = strlen ( path ) ; goto skipabs ; } skipvarlib : aux = strstr ( mntent -> mnt_dir, rootfs -> path ) ; if (! aux ) { WARN ( "ignoring   mount   point   \'%s\'", mntent -> mnt_dir ) ; return ret ; } offset = strlen ( rootfs -> path ) ; skipabs : r = snprintf ( path, MAXPATHLEN, "%s//%s", rootfs -> mount, aux + offset ) ; if ( r < 0 || r >= MAXPATHLEN ) { WARN ( "pathnme   too   long   for   \'%s\'", mntent -> mnt_dir ) ; return - 1 ; } <START_BUG> return mount_entry_on_generic ( mntent, path ) ; <END_BUG> }

Fix:
<S2SV_ModStart> mntent, path, rootfs -> mount
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG> fprintf ( stderr, "Usage:   %s   <codec>   <width>   <height>   <infile>   <outfile>   " "<keyframe-interval>   [<error-resilient>]\\nSee   comments   in   " "simple_encoder.c   for   more   information.\\n", exec_name ) ; exit ( EXIT_FAILURE ) ; }

Fix:
<S2SV_ModStart> void usage_exit ( void
Buggy code:
 int libevt_record_values_read_event ( libevt_record_values_t * record_values, uint8_t * record_data, size_t record_data_size, uint8_t strict_mode, libcerror_error_t * * error ) { static char * function = "libevt_record_values_read_event" ; size_t record_data_offset = 0 ; size_t strings_data_offset = 0 ; ssize_t value_data_size = 0 ; uint32_t data_offset = 0 ; uint32_t data_size = 0 ; uint32_t members_data_size = 0 ; uint32_t size = 0 ; uint32_t size_copy = 0 ; uint32_t strings_offset = 0 ; uint32_t strings_size = 0 ; uint32_t user_sid_offset = 0 ; uint32_t user_sid_size = 0 ; # if defined ( HAVE_DEBUG_OUTPUT ) uint32_t value_32bit = 0 ; uint16_t value_16bit = 0 ; # endif if ( record_values == NULL ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s:   invalid   record   values.", function ) ; return ( - 1 ) ; } if ( record_data == NULL ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s:   invalid   record   data.", function ) ; return ( - 1 ) ; } if ( record_data_size > ( size_t ) SSIZE_MAX ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s:   invalid   record   data   size   value   exceeds   maximum.", function ) ; return ( - 1 ) ; } if ( record_data_size < ( sizeof ( evt_record_event_header_t ) + 4 ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_

Fix:
<S2SV_ModStart> { if ( user_sid_size > ( ( record_data_size - 4 ) - user_sid_offset ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: <S2SV_blank> user <S2SV_blank> SID <S2SV_blank> data <S2SV_blank> size <S2SV_blank> value <S2SV_blank> out <S2SV_blank> of <S2SV_blank> bounds.", function ) ; goto on_error ; } if ( <S2SV_ModStart> 0 ) { if ( strings_size > ( ( record_data_size - 4 ) - strings_offset ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: <S2SV_blank> strings <S2SV_blank> size <S2SV_blank> value <S2SV_blank> out <S2SV_blank> of <S2SV_blank> bounds.", function ) ; goto on_error ; } <S2SV_ModStart> 0 ) { if ( data_size > ( ( record_data_size - 4 ) - data_offset ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT
Buggy code:
 <START_BUG> static int changedline ( const Proto * p, int oldpc, int newpc ) { <END_BUG> while ( oldpc ++ < newpc ) { if ( p -> lineinfo [ oldpc ]!= 0 ) return ( luaG_getfuncline ( p, oldpc - 1 )!= luaG_getfuncline ( p, newpc ) ) ; } return 0 ; }

Fix:
<S2SV_ModStart> newpc ) { if ( p -> lineinfo == NULL ) return 0 ;
Buggy code:
 void snd_msndmidi_input_read ( void * mpuv ) { unsigned long flags ; struct snd_msndmidi * mpu = mpuv ; void * pwMIDQData = mpu -> dev -> mappedbase + MIDQ_DATA_BUFF ; <START_BUG> spin_lock_irqsave ( & mpu -> input_lock, flags ) ; <END_BUG>  while ( readw ( mpu -> dev -> MIDQ + JQS_wTail )!= <START_BUG> readw ( mpu -> dev -> MIDQ + JQS_wHead ) ) { u16 wTmp, val ; val = readw ( pwMIDQData + 2 * readw ( mpu -> dev -> MIDQ + JQS_wHead ) ) ; if ( test_bit ( MSNDMIDI_MODE_BIT_INPUT_TRIGGER, & mpu -> mode ) ) snd_rawmidi_receive ( mpu -> substream_input, ( unsigned char * ) & val, 1 ) ; <END_BUG> wTmp = readw ( mpu -> dev -> MIDQ + JQS_wHead ) + 1 ;  if ( wTmp > readw ( mpu -> dev -> MIDQ + JQS_wSize ) ) writew ( 0, mpu -> dev -> MIDQ + JQS_wHead ) ; else writew ( wTmp, mpu -> dev -> MIDQ + JQS_wHead ) ; } spin_unlock_irqrestore ( & mpu -> input_lock, flags ) ; }

Fix:
<S2SV_ModStart> + MIDQ_DATA_BUFF ; u16 head, tail, size ; <S2SV_ModStart> flags ) ; head = readw ( mpu -> dev -> MIDQ + JQS_wHead ) ; tail = readw ( mpu -> dev -> MIDQ + JQS_wTail ) ; size = readw ( mpu -> dev -> MIDQ + JQS_wSize ) ; if ( head > size || tail > size ) goto out ; while ( head!= tail ) { unsigned char val = readw ( pwMIDQData + 2 * head ) ; if ( test_bit ( MSNDMIDI_MODE_BIT_INPUT_TRIGGER, & mpu -> mode ) ) snd_rawmidi_receive ( mpu -> substream_input, & val <S2SV_ModEnd>, 1 ) <S2SV_ModStart> 1 ) ; if ( ++ head > size ) head = 0 ; writew ( head, <S2SV_ModEnd> mpu -> dev <S2SV_ModStart> + JQS_wHead ) ; } out : <S2SV_ModEnd> spin_unlock_irqrestore ( &
Buggy code:
 static int inet_rtm_getroute ( struct sk_buff * in_skb, struct nlmsghdr * nlh, struct netlink_ext_ack * extack ) { struct net * net = sock_net ( in_skb -> sk ) ; struct rtmsg * rtm ; struct nlattr * tb [ RTA_MAX + 1 ] ; struct fib_result res = { } ; struct rtable * rt = NULL ; struct flowi4 fl4 ; __be32 dst = 0 ; __be32 src = 0 ; u32 iif ; int err ; int mark ; struct sk_buff * skb ; u32 table_id = RT_TABLE_MAIN ; kuid_t uid ; err = nlmsg_parse ( nlh, sizeof ( * rtm ), tb, RTA_MAX, rtm_ipv4_policy, extack ) ; if ( err < 0 ) goto errout ; rtm = nlmsg_data ( nlh ) ; skb = alloc_skb ( NLMSG_GOODSIZE, GFP_KERNEL ) ; if (! skb ) { err = - ENOBUFS ; goto errout ; } skb_reset_mac_header ( skb ) ; skb_reset_network_header ( skb ) ; src = tb [ RTA_SRC ]? nla_get_in_addr ( tb [ RTA_SRC ] ) : 0 ; dst = tb [ RTA_DST ]? nla_get_in_addr ( tb [ RTA_DST ] ) : 0 ; iif = tb [ RTA_IIF ]? nla_get_u32 ( tb [ RTA_IIF ] ) : 0 ; mark = tb [ RTA_MARK ]? nla_get_u32 ( tb [ RTA_MARK ] ) : 0 ; if ( tb [ RTA_UID ] ) uid = make_kuid ( current_user_ns ( ), nla_get_u32 ( tb [ RTA_UID ] ) ) ; else uid = ( iif? INVALID_UID : current_uid ( ) ) ; ip_hdr ( skb ) -> protocol = IPPROTO_UDP ; ip_hdr ( skb ) -> saddr = src ; ip_hdr ( skb ) -> daddr = dst ; sk

Fix:
<S2SV_ModStart> & RTM_F_FIB_MATCH ) { if (! res. fi ) { err = fib_props [ res. type ]. error ; if (! err ) err = - EHOSTUNREACH ; <S2SV_ModEnd> goto errout_free ; <S2SV_ModStart> goto errout_free ; } err = fib_dump_info ( skb, NETLINK_CB ( in_skb ). portid, nlh -> nlmsg_seq, RTM_NEWROUTE, table_id, rt -> rt_type, res. prefix, res. prefixlen, fl4. flowi4_tos, res. fi, 0 ) ; } else { err = rt_fill_info ( net, dst, src, table_id, & fl4, skb, NETLINK_CB ( in_skb ). portid, nlh -> nlmsg_seq ) ; } if ( err < 0 ) goto errout_free ;
Buggy code:
 bool agoo_ws_create_req ( agooCon c, long mlen ) { uint8_t op = 0x0F & * c -> buf ; if ( NULL == ( c -> req = agoo_req_create ( mlen ) ) ) { agoo_log_cat ( & agoo_error_cat, "Out   of   memory   attempting   to   allocate   request." ) ; return true ; } if ( NULL == c -> up || agoo_server. ctx_nil_value == c -> up -> ctx ) { return true ; } memset ( c -> req, 0, sizeof ( struct _agooReq ) ) ; if ( ( long ) c -> bcnt <= mlen ) { memcpy ( c -> req -> msg, c -> buf, c -> bcnt ) ; if ( ( long ) c -> bcnt < mlen ) { memset ( c -> req -> msg + c -> bcnt, 0, mlen - c -> bcnt ) ; } } else { memcpy ( c -> req -> msg, c -> buf, mlen ) ; } c -> req -> msg [ mlen ] = '\\0' ; c -> req -> mlen = mlen ; c -> req -> method = ( AGOO_WS_OP_BIN == op )? AGOO_ON_BIN : AGOO_ON_MSG ; c -> req -> upgrade = AGOO_UP_NONE ; c -> req -> up = c -> up ; <START_BUG> c -> req -> res = NULL ; <END_BUG> if ( c -> up -> on_msg ) { c -> req -> hook = agoo_hook_create ( AGOO_NONE, NULL, c -> up -> ctx, PUSH_HOOK, & agoo_server. eval_queue ) ; } return false ; }

Fix:
<S2SV_ModStart> -> up ; memcpy ( c -> req -> remote, c -> remote, sizeof ( c -> remote ) ) ;
Buggy code:
 int vp8dx_get_raw_frame ( VP8D_COMP * pbi, YV12_BUFFER_CONFIG * sd, int64_t * time_stamp, int64_t * time_end_stamp, vp8_ppflags_t * flags ) { int ret = - 1 ; if ( pbi -> ready_for_new_data == 1 ) return ret ; if ( pbi -> common. show_frame == 0 ) return ret ; pbi -> ready_for_new_data = 1 ; * time_stamp = pbi -> last_time_stamp ; * time_end_stamp = 0 ; # if CONFIG_POSTPROC ret = vp8_post_proc_frame ( & pbi -> common, sd, flags ) ; # else <START_BUG> if ( pbi -> common. frame_to_show ) <END_BUG> { * sd = * pbi -> common. frame_to_show ; sd -> y_width = pbi -> common. Width ; sd -> y_height = pbi -> common. Height ; sd -> uv_height = pbi -> common. Height // 2 ; ret = 0 ; } else { ret = - 1 ; } # endif vp8_clear_system_state ( ) ; return ret ; }

Fix:
<S2SV_ModStart> ; # else ( void ) flags ;
Buggy code:
 static ssize_t map_write ( struct file * file, const char __user * buf, size_t count, loff_t * ppos, int cap_setid, struct uid_gid_map * map, struct uid_gid_map * parent_map ) { struct seq_file * seq = file -> private_data ; struct user_namespace * ns = seq -> private ; struct uid_gid_map new_map ; unsigned idx ; struct uid_gid_extent * extent = NULL ; unsigned long page = 0 ; char * kbuf, * pos, * next_line ; ssize_t ret = - EINVAL ; mutex_lock ( & id_map_mutex ) ; ret = - EPERM ; if ( map -> nr_extents!= 0 ) goto out ; if ( cap_valid ( cap_setid ) &&! ns_capable ( ns, cap_setid ) ) goto out ; ret = - ENOMEM ; page = __get_free_page ( GFP_TEMPORARY ) ; kbuf = ( char * ) page ; if (! page ) goto out ; ret = - EINVAL ; if ( ( * ppos!= 0 ) || ( count >= PAGE_SIZE ) ) goto out ; ret = - EFAULT ; if ( copy_from_user ( kbuf, buf, count ) ) goto out ; kbuf [ count ] = '\\0' ; ret = - EINVAL ; pos = kbuf ; new_map. nr_extents = 0 ; for ( ; pos ; pos = next_line ) { extent = & new_map. extent [ new_map. nr_extents ] ; next_line = strchr ( pos, '\\n' ) ; if ( next_line ) { * next_line = '\\0' ; next_line ++ ; if ( * next_line == '\\0' ) next_line = NULL ; } pos = skip_spaces ( pos ) ; extent -> first = simple_strtoul ( pos, & pos, 10 ) ; if (! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; extent -> lower_first = simple_strtoul ( pos, & pos, 10 ) ; if (! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; extent -> count =

Fix:
<S2SV_ModStart>! new_idmap_permitted ( file,
Buggy code:
 static void scsi_read_complete ( void * opaque, int ret ) { SCSIDiskReq * r = ( SCSIDiskReq * ) opaque ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, r -> req. dev ) ; int n ; if ( r -> req. aiocb!= NULL ) { r -> req. aiocb = NULL ; bdrv_acct_done ( s -> bs, & r -> acct ) ; } if ( ret ) { if ( scsi_handle_rw_error ( r, - ret, SCSI_REQ_STATUS_RETRY_READ ) ) { return ; } } <START_BUG> DPRINTF ( "Data   ready   tag=0x%x   len=%zd\\n", r -> req. tag, r -> iov. iov_len ) ; <END_BUG>  n = r -> iov. iov_len // 512 ; <START_BUG> r -> sector += n ; r -> sector_count -= n ; <END_BUG> scsi_req_data ( & r -> req, r -> iov. iov_len ) ;  }

Fix:
<S2SV_ModStart>, r -> qiov. size <S2SV_ModEnd> ) ; n <S2SV_ModStart> = r -> qiov. size <S2SV_ModEnd> // 512 ; <S2SV_ModStart>, r -> qiov. size <S2SV_ModEnd> ) ; }
Buggy code:
 static int kvm_iommu_unmap_memslots ( struct kvm * kvm ) { int idx ; struct kvm_memslots * slots ; struct kvm_memory_slot * memslot ; idx = srcu_read_lock ( & kvm -> srcu ) ; slots = kvm_memslots ( kvm ) ; kvm_for_each_memslot ( memslot, slots ) <START_BUG> kvm_iommu_put_pages ( kvm, memslot -> base_gfn, memslot -> npages ) ; <END_BUG> srcu_read_unlock ( & kvm -> srcu, idx ) ; return 0 ; }

Fix:
<S2SV_ModStart>, slots ) kvm_iommu_unmap_pages <S2SV_ModEnd> ( kvm, <S2SV_ModStart> kvm, memslot <S2SV_ModEnd> ) ; srcu_read_unlock
Buggy code:
 static int ceph_x_verify_authorizer_reply ( struct ceph_auth_client * ac, struct ceph_authorizer * a, size_t len ) { struct ceph_x_authorizer * au = ( void * ) a ; struct ceph_x_ticket_handler * th ; int ret = 0 ; struct ceph_x_authorize_reply reply ; <START_BUG> void * p = au -> reply_buf ; <END_BUG> void * end = p + sizeof ( au -> reply_buf ) ; th = get_ticket_handler ( ac, au -> service ) ; if ( IS_ERR ( th ) ) return PTR_ERR ( th ) ;  ret = ceph_x_decrypt ( & th -> session_key, & p, end, & reply, sizeof ( reply ) ) ; <START_BUG> if ( ret < 0 ) return ret ; if ( ret!= sizeof ( reply ) ) return - EPERM ; if ( au -> nonce + 1!= le64_to_cpu ( reply. nonce_plus_one ) ) ret = - EPERM ; else ret = 0 ; dout ( "verify_authorizer_reply   nonce   %llx   got   %llx   ret   %d\\n", au -> nonce, le64_to_cpu ( reply. nonce_plus_one ), ret ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; void * preply = & reply ; void * <S2SV_ModStart> end, & preply <S2SV_ModEnd>, sizeof (
Buggy code:
 static void icmp6_send ( struct sk_buff * skb, u8 type, u8 code, __u32 info, const struct in6_addr * force_saddr ) { struct net * net = dev_net ( skb -> dev ) ; struct inet6_dev * idev = NULL ; struct ipv6hdr * hdr = ipv6_hdr ( skb ) ; struct sock * sk ; struct ipv6_pinfo * np ; const struct in6_addr * saddr = NULL ; struct dst_entry * dst ; struct icmp6hdr tmp_hdr ; struct flowi6 fl6 ; struct icmpv6_msg msg ; struct sockcm_cookie sockc_unused = { 0 } ; struct ipcm6_cookie ipc6 ; int iif = 0 ; int addr_type = 0 ; int len ; int err = 0 ; u32 mark = IP6_REPLY_MARK ( net, skb -> mark ) ; if ( ( u8 * ) hdr < skb -> head || ( skb_network_header ( skb ) + sizeof ( * hdr ) ) > skb_tail_pointer ( skb ) ) return ; addr_type = ipv6_addr_type ( & hdr -> daddr ) ; if ( ipv6_chk_addr ( net, & hdr -> daddr, skb -> dev, 0 ) || ipv6_chk_acast_addr_src ( net, skb -> dev, & hdr -> daddr ) ) saddr = & hdr -> daddr ; if ( addr_type & IPV6_ADDR_MULTICAST || skb -> pkt_type!= PACKET_HOST ) { if ( type!= ICMPV6_PKT_TOOBIG &&! ( type == ICMPV6_PARAMPROB && code == ICMPV6_UNK_OPTION && ( opt_unrec ( skb, info ) ) ) ) return ; saddr = NULL ; } addr_type = ipv6_addr_type ( & hdr -> saddr ) ; if ( __ipv6_addr_needs_scope_id ( addr_type ) ) iif = skb -> dev -> ifindex ; <START_BUG> else <END_BUG>  iif = l3mdev_master_ifindex ( skb_dst ( skb ) -> dev ) ; <START_BUG> if ( ( addr_type ==<END_BUG>

Fix:
<S2SV_ModStart> ifindex ; else { dst = skb_dst ( skb ) ; <S2SV_ModStart> = l3mdev_master_ifindex ( dst? dst -> dev : skb -> dev ) ; } <S2SV_ModEnd> if ( (