nus-yam/ex-repair huggingface dataset:
Buggy code:
 static enum fetch_step vbf_stp_error ( struct worker * wrk, struct busyobj * bo ) { ssize_t l, ll, o ; double now ; uint8_t * ptr ; struct vsb * synth_body ; CHECK_OBJ_NOTNULL ( wrk, WORKER_MAGIC ) ; CHECK_OBJ_NOTNULL ( bo, BUSYOBJ_MAGIC ) ; CHECK_OBJ_NOTNULL ( bo -> fetch_objcore, OBJCORE_MAGIC ) ; AN ( bo -> fetch_objcore -> flags & OC_F_BUSY ) ; assert ( bo -> director_state == DIR_S_NULL ) ; wrk -> stats -> fetch_failed ++ ; now = W_TIM_real ( wrk ) ; VSLb_ts_busyobj ( bo, "Error", now ) ; if ( bo -> fetch_objcore -> stobj -> stevedore!= NULL ) ObjFreeObj ( bo -> wrk, bo -> fetch_objcore ) ; HTTP_Setup ( bo -> beresp, bo -> ws, bo -> vsl, SLT_BerespMethod ) ; http_PutResponse ( bo -> beresp, "HTTP//1.1", 503, "Backend   fetch   failed" ) ; http_TimeHeader ( bo -> beresp, "Date:   ", now ) ; http_SetHeader ( bo -> beresp, "Server:   Varnish" ) ; bo -> fetch_objcore -> t_origin = now ; if (! VTAILQ_EMPTY ( & bo -> fetch_objcore -> objhead -> waitinglist ) ) { bo -> fetch_objcore -> ttl = 1 ; bo -> fetch_objcore -> grace = 5 ; bo -> fetch_objcore -> keep = 5 ; } else { bo -> fetch_objcore -> ttl = 0 ; bo -> fetch_objcore -> grace = 0 ; bo -> fetch_objcore -> keep = 0 ; } synth_body = VSB_new_auto ( ) ; AN ( synth_body ) ; VCL_backend_error_method ( bo -> vcl, wrk, NULL, bo, synth_body ) ; AZ ( VSB_finish ( synth_body ) ) ; if ( wrk -> handling == VCL_RET

Fix:
<S2SV_ModStart> ) break ; if ( l > ll ) l = ll ;
Buggy code:
 static int tap_if_down ( const char * devname ) { struct ifreq ifr ; int sk ; sk = socket ( AF_INET, SOCK_DGRAM, 0 ) ; if ( sk < 0 ) return - 1 ; memset ( & ifr, 0, sizeof ( ifr ) ) ; strncpy ( ifr. ifr_name, devname, IF_NAMESIZE - 1 ) ; ifr. ifr_flags &= ~ IFF_UP ; <START_BUG> ioctl ( sk, SIOCSIFFLAGS, ( caddr_t ) & ifr ) ; <END_BUG> close ( sk ) ; return 0 ; }

Fix:
<S2SV_ModStart> ~ IFF_UP ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> ) & ifr )
Buggy code:
 static void __iov_iter_advance_iov ( struct iov_iter * i, size_t bytes ) { if ( likely ( i -> nr_segs == 1 ) ) { i -> iov_offset += bytes ; } else { const struct iovec * iov = i -> iov ; size_t base = i -> iov_offset ; <START_BUG> while ( bytes ) { <END_BUG> int copy = min ( bytes, iov -> iov_len - base ) ; bytes -= copy ; base += copy ; if ( iov -> iov_len == base ) { iov ++ ; base = 0 ; } } i -> iov = iov ; i -> iov_offset = base ; } }

Fix:
<S2SV_ModStart> while ( bytes ||! iov -> iov_len
Buggy code:
 static int setupLookaside ( sqlite3 * db, void * pBuf, int sz, int cnt ) { # ifndef SQLITE_OMIT_LOOKASIDE void * pStart ; if ( sqlite3LookasideUsed ( db, 0 ) > 0 ) { return SQLITE_BUSY ; } if ( db -> lookaside. bMalloced ) { sqlite3_free ( db -> lookaside. pStart ) ; } sz = ROUNDDOWN8 ( sz ) ; if ( sz <= ( int ) sizeof ( LookasideSlot * ) ) sz = 0 ; if ( cnt < 0 ) cnt = 0 ; if ( sz == 0 || cnt == 0 ) { sz = 0 ; pStart = 0 ; } else if ( pBuf == 0 ) { sqlite3BeginBenignMalloc ( ) ; <START_BUG> pStart = sqlite3Malloc ( sz * cnt ) ; <END_BUG> sqlite3EndBenignMalloc ( ) ; if ( pStart ) cnt = sqlite3MallocSize ( pStart ) // sz ; } else { pStart = pBuf ; } db -> lookaside. pStart = pStart ; db -> lookaside. pInit = 0 ; db -> lookaside. pFree = 0 ; db -> lookaside. sz = ( u16 ) sz ; if ( pStart ) { int i ; LookasideSlot * p ; assert ( sz > ( int ) sizeof ( LookasideSlot * ) ) ; db -> lookaside. nSlot = cnt ; p = ( LookasideSlot * ) pStart ; for ( i = cnt - 1 ; i >= 0 ; i -- ) { p -> pNext = db -> lookaside. pInit ; db -> lookaside. pInit = p ; p = ( LookasideSlot * ) & ( ( u8 * ) p ) [ sz ] ; } db -> lookaside. pEnd = p ; db -> lookaside. bDisable = 0 ; db -> lookaside. bMalloced = pBuf == 0? 1 : 0 ; } else { db -> lookaside. pStart = db ; db -> lookaside. pEnd = db ; db -> lookaside. bDisable = 1 ; db -> lookaside. bMalloced = 0 ; db -> lookaside. nSlot = 0 ;

Fix:
<S2SV_ModStart> ( sz * ( sqlite3_int64 )
Buggy code:
 static void alpha_perf_event_irq_handler ( unsigned long la_ptr, struct pt_regs * regs ) { struct cpu_hw_events * cpuc ; struct perf_sample_data data ; struct perf_event * event ; struct hw_perf_event * hwc ; int idx, j ; __get_cpu_var ( irq_pmi_count ) ++ ; cpuc = & __get_cpu_var ( cpu_hw_events ) ; wrperfmon ( PERFMON_CMD_DISABLE, cpuc -> idx_mask ) ; if ( unlikely ( la_ptr >= alpha_pmu -> num_pmcs ) ) { irq_err_count ++ ; pr_warning ( "PMI:   silly   index   %ld\\n", la_ptr ) ; wrperfmon ( PERFMON_CMD_ENABLE, cpuc -> idx_mask ) ; return ; } idx = la_ptr ; perf_sample_data_init ( & data, 0 ) ; for ( j = 0 ; j < cpuc -> n_events ; j ++ ) { if ( cpuc -> current_idx [ j ] == idx ) break ; } if ( unlikely ( j == cpuc -> n_events ) ) { wrperfmon ( PERFMON_CMD_ENABLE, cpuc -> idx_mask ) ; return ; } event = cpuc -> event [ j ] ; if ( unlikely (! event ) ) { irq_err_count ++ ; pr_warning ( "PMI:   No   event   at   index   %d!\\n", idx ) ; wrperfmon ( PERFMON_CMD_ENABLE, cpuc -> idx_mask ) ; return ; } hwc = & event -> hw ; alpha_perf_event_update ( event, hwc, idx, alpha_pmu -> pmc_max_period [ idx ] + 1 ) ; data. period = event -> hw. last_period ; if ( alpha_perf_event_set_period ( event, hwc, idx ) ) { <START_BUG> if ( perf_event_overflow ( event, 1, & data, regs ) ) { <END_BUG> alpha_pmu_stop ( event, 0 ) ; } } wrperfmon ( PERFMON_CMD_ENABLE, cpuc -> idx_mask ) ; return ; }

Fix:
<S2SV_ModStart> ( event, <S2SV_ModEnd> & data,
Buggy code:
 void luaT_getvarargs ( lua_State * L, CallInfo * ci, StkId where, int wanted ) { int i ; int nextra = ci -> u. l. nextraargs ; if ( wanted < 0 ) { wanted = nextra ; <START_BUG> checkstackp ( L, nextra, where ) ; <END_BUG> L -> top = where + nextra ; } for ( i = 0 ; i < wanted && i < nextra ; i ++ ) setobjs2s ( L, where + i, ci -> func - nextra + i ) ; for ( ; i < wanted ; i ++ ) setnilvalue ( s2v ( where + i ) ) ; }

Fix:
<S2SV_ModStart> = nextra ; checkstackGCp <S2SV_ModEnd> ( L,
Buggy code:
 static <START_BUG> void headerMergeLegacySigs ( Header h, Header sigh ) <END_BUG> { HeaderIterator hi ; struct rpmtd_s td ;  hi = headerInitIterator ( sigh ) ; <START_BUG> for ( ; headerNext ( hi, & td ) ; rpmtdFreeData ( & td ) ) { switch ( td. tag ) { case RPMSIGTAG_SIZE : <END_BUG> td. tag = RPMTAG_SIGSIZE ;  break ; case RPMSIGTAG_PGP : <START_BUG> td. tag = RPMTAG_SIGPGP ; <END_BUG> break ; case RPMSIGTAG_MD5 : td. tag = RPMTAG_SIGMD5 ; break ; case RPMSIGTAG_GPG : td. tag = RPMTAG_SIGGPG ; break ; case RPMSIGTAG_PGP5 : td. tag = RPMTAG_SIGPGP5 ; break ; case RPMSIGTAG_PAYLOADSIZE : td. tag = RPMTAG_ARCHIVESIZE ; break ; case RPMSIGTAG_FILESIGNATURES : td. tag = RPMTAG_FILESIGNATURES ; break ; case RPMSIGTAG_FILESIGNATURELENGTH : td. tag = RPMTAG_FILESIGNATURELENGTH ; break ; case RPMSIGTAG_VERITYSIGNATURES : case RPMSIGTAG_VERITYSIGNATUREALGO : case RPMSIGTAG_SHA1 : case RPMSIGTAG_SHA256 : case RPMSIGTAG_DSA : case RPMSIGTAG_RSA : default :  if (! ( td. tag >= HEADER_SIGBASE && td. tag < HEADER_TAGBASE ) ) <START_BUG> continue ; break ; } <END_BUG> if (! headerIsEntry ( h, td. tag ) ) {  switch ( td. type ) { case RPM_NULL_TYPE : continue ; break ; case RPM_CHAR_TYPE : case RPM_INT8_TYPE : case RPM_INT16_TYPE : case RPM_INT32_TYPE : case RPM_INT64_TYPE : if ( td. count!= 1 ) continue ; break ; case RPM_STRING_TYPE : case RPM_STRING_ARRAY_TYPE : case RPM_BIN_TYPE : if ( td. count >= 16 * 1024 ) continue ; break ; case RPM_I18NSTRING_TYPE : continue ;

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static rpmTagVal <S2SV_ModEnd> headerMergeLegacySigs ( Header <S2SV_ModStart>, Header sigh, char * * msg ) { const struct taglate_s * xl <S2SV_ModEnd> ; struct rpmtd_s <S2SV_ModStart> rpmtd_s td ; rpmtdReset ( & td ) ; for ( xl = xlateTags ; xl -> stag ; xl ++ ) { if ( headerIsEntry ( h, xl -> xtag ) ) break ; if ( headerGet ( sigh, xl -> stag, & td, HEADERGET_RAW | HEADERGET_MINMEM ) ) { if ( xl -> stag!= xl -> xtag ) <S2SV_ModEnd> td. tag <S2SV_ModStart>. tag = xl -> xtag ; if ( td. type!= rpmTagGetTagType ( <S2SV_ModEnd> td. tag <S2SV_ModStart> td. tag ) ) break ; if ( td. count < 1 || td. count > 16 * 1024 * 1024 ) break ; if ( xl -> count && td. count!= xl -> count ) break ; <S2SV_ModEnd> if (! <S2SV_ModStart> if (! headerPut <S2SV_ModEnd> ( h, <S2SV_ModStart> ( h, <S2SV_ModEnd> & td, <S2SV_ModStart>, HEADERPUT_DEFAULT ) ) break ; rpmtd
Buggy code:
 static int do_ip_vs_get_ctl ( struct sock * sk, int cmd, void __user * user, int * len ) { unsigned char arg [ 128 ] ; int ret = 0 ; unsigned int copylen ; struct net * net = sock_net ( sk ) ; struct netns_ipvs * ipvs = net_ipvs ( net ) ; BUG_ON (! net ) ; if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; if ( cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX ) return - EINVAL ; if ( * len < get_arglen [ GET_CMDID ( cmd ) ] ) { pr_err ( "get_ctl:   len   %u   <   %u\\n", * len, get_arglen [ GET_CMDID ( cmd ) ] ) ; return - EINVAL ; } copylen = get_arglen [ GET_CMDID ( cmd ) ] ; if ( copylen > 128 ) return - EINVAL ; if ( copy_from_user ( arg, user, copylen )!= 0 ) return - EFAULT ; if ( cmd == IP_VS_SO_GET_DAEMON ) { struct ip_vs_daemon_user d [ 2 ] ; memset ( & d, 0, sizeof ( d ) ) ; if ( mutex_lock_interruptible ( & ipvs -> sync_mutex ) ) return - ERESTARTSYS ; if ( ipvs -> sync_state & IP_VS_STATE_MASTER ) { d [ 0 ]. state = IP_VS_STATE_MASTER ; strlcpy ( d [ 0 ]. mcast_ifn, ipvs -> master_mcast_ifn, sizeof ( d [ 0 ]. mcast_ifn ) ) ; d [ 0 ]. syncid = ipvs -> master_syncid ; } if ( ipvs -> sync_state & IP_VS_STATE_BACKUP ) { d [ 1 ]. state = IP_VS_STATE_BACKUP ; strlcpy ( d [ 1 ]. mcast_ifn, ipvs -> backup_mcast_ifn, sizeof ( d [ 1 ]. mcast_ifn ) ) ; d [ 1 ]. syncid = ipvs -> backup_

Fix:
<S2SV_ModStart> ip_vs_timeout_user t ; memset ( & t, 0, sizeof ( t ) ) ;
Buggy code:
 static void perf_event_interrupt ( struct pt_regs * regs ) { int i ; struct cpu_hw_events * cpuhw = & __get_cpu_var ( cpu_hw_events ) ; struct perf_event * event ; unsigned long val ; int found = 0 ; int nmi ; if ( cpuhw -> n_limited ) freeze_limited_counters ( cpuhw, mfspr ( SPRN_PMC5 ), mfspr ( SPRN_PMC6 ) ) ; perf_read_regs ( regs ) ; nmi = perf_intr_is_nmi ( regs ) ; if ( nmi ) nmi_enter ( ) ; else irq_enter ( ) ; for ( i = 0 ; i < cpuhw -> n_events ; ++ i ) { event = cpuhw -> event [ i ] ; if (! event -> hw. idx || is_limited_pmc ( event -> hw. idx ) ) continue ; val = read_pmc ( event -> hw. idx ) ; if ( ( int ) val < 0 ) { found = 1 ; record_and_restart ( event, val, regs, nmi ) ; } } if (! found ) { for ( i = 0 ; i < ppmu -> n_counter ; ++ i ) { if ( is_limited_pmc ( i + 1 ) ) continue ; val = read_pmc ( i + 1 ) ; <START_BUG> if ( ( int ) val < 0 ) <END_BUG> write_pmc ( i + 1, 0 ) ; } } write_mmcr0 ( cpuhw, cpuhw -> mmcr [ 0 ] ) ; if ( nmi ) nmi_exit ( ) ; else irq_exit ( ) ; }

Fix:
<S2SV_ModStart> ; if ( pmc_overflow ( val ) <S2SV_ModEnd> ) write_pmc (
Buggy code:
 static int iucv_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; struct iucv_sock * iucv = iucv_sk ( sk ) ; unsigned int copied, rlen ; struct sk_buff * skb, * rskb, * cskb ; <START_BUG> int err = 0 ; <END_BUG> if ( ( sk -> sk_state == IUCV_DISCONN ) && skb_queue_empty ( & iucv -> backlog_skb_q ) && skb_queue_empty ( & sk -> sk_receive_queue ) && list_empty ( & iucv -> message_q. list ) ) return 0 ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) { if ( sk -> sk_shutdown & RCV_SHUTDOWN ) return 0 ; return err ; } rlen = skb -> len ; copied = min_t ( unsigned int, rlen, len ) ; if (! rlen ) sk -> sk_shutdown = sk -> sk_shutdown | RCV_SHUTDOWN ; cskb = skb ; if ( skb_copy_datagram_iovec ( cskb, 0, msg -> msg_iov, copied ) ) { if (! ( flags & MSG_PEEK ) ) skb_queue_head ( & sk -> sk_receive_queue, skb ) ; return - EFAULT ; } if ( sk -> sk_type == SOCK_SEQPACKET ) { if ( copied < rlen ) msg -> msg_flags |= MSG_TRUNC ; msg -> msg_flags |= MSG_EOR ; } err = put_cmsg ( msg, SOL_IUCV, SCM_IUCV_TRGCLS, CB_TRGCLS_LEN, CB_TRGCLS ( skb ) ) ; if ( err ) { if (! ( flags & MSG_PEEK ) ) skb_queue_head ( & sk -> sk_receive_queue, skb ) ; return

Fix:
<S2SV_ModStart> ; int err = 0 ; msg -> msg_namelen
Buggy code:
 static void file_add_mapi_attrs ( File * file, MAPI_Attr * * attrs ) { int i ; for ( i = 0 ; attrs [ i ] ; i ++ ) { MAPI_Attr * a = attrs [ i ] ; if ( a -> num_values ) { switch ( a -> name ) { case MAPI_ATTACH_LONG_FILENAME : <START_BUG> if ( file -> name ) XFREE ( file -> name ) ; <END_BUG> file -> name = strdup ( ( char * ) a -> values [ 0 ]. data. buf ) ; break ; case MAPI_ATTACH_DATA_OBJ :  file -> len = a -> values [ 0 ]. len ; <START_BUG> if ( file -> data ) XFREE ( file -> data ) ; file -> data = CHECKED_XMALLOC ( unsigned char, file -> len ) ; memmove ( file -> data, a -> values [ 0 ]. data. buf, file -> len ) ; break ; case MAPI_ATTACH_MIME_TAG : <END_BUG> if ( file -> mime_type ) XFREE ( file -> mime_type ) ;  file -> mime_type = CHECKED_XMALLOC ( char, a -> values [ 0 ]. len ) ; memmove ( file -> mime_type, a -> values [ 0 ]. data. buf, a -> values [ 0 ]. len ) ; break ; case MAPI_ATTACH_CONTENT_ID : <START_BUG> if ( file -> content_id ) XFREE ( file -> content_id ) ; <END_BUG> file -> content_id = CHECKED_XMALLOC ( char, a -> values [ 0 ]. len ) ; memmove ( file -> content_id, a -> values [ 0 ]. data. buf, a -> values [ 0 ]. len ) ; break ; default : break ; } } } }

Fix:
<S2SV_ModStart> case MAPI_ATTACH_LONG_FILENAME : assert ( a -> type == szMAPI_STRING ) ; <S2SV_ModStart> case MAPI_ATTACH_DATA_OBJ : assert ( ( a -> type == szMAPI_BINARY ) || ( a -> type == szMAPI_OBJECT ) ) ; <S2SV_ModStart> case MAPI_ATTACH_MIME_TAG : assert ( a -> type == szMAPI_STRING ) ; <S2SV_ModStart> case MAPI_ATTACH_CONTENT_ID : assert ( a -> type == szMAPI_STRING ) ;
Buggy code:
 static grub_disk_addr_t grub_ext2_read_block ( grub_fshelp_node_t node, grub_disk_addr_t fileblock ) { struct grub_ext2_data * data = node -> data ; struct grub_ext2_inode * inode = & node -> inode ; int blknr = - 1 ; unsigned int blksz = EXT2_BLOCK_SIZE ( data ) ; int log2_blksz = LOG2_EXT2_BLOCK_SIZE ( data ) ; if ( grub_le_to_cpu32 ( inode -> flags ) & EXT4_EXTENTS_FLAG ) { # ifndef _MSC_VER char buf [ EXT2_BLOCK_SIZE ( data ) ] ; # else char * buf = grub_malloc ( EXT2_BLOCK_SIZE ( data ) ) ; # endif struct grub_ext4_extent_header * leaf ; struct grub_ext4_extent * ext ; int i ; leaf = grub_ext4_find_leaf ( data, buf, ( struct grub_ext4_extent_header * ) inode -> blocks. dir_blocks, fileblock ) ; if (! leaf ) { grub_error ( GRUB_ERR_BAD_FS, "invalid   extent" ) ; return - 1 ; } ext = ( struct grub_ext4_extent * ) ( leaf + 1 ) ; for ( i = 0 ; i < grub_le_to_cpu16 ( leaf -> entries ) ; i ++ ) { if ( fileblock < grub_le_to_cpu32 ( ext [ i ]. block ) ) break ; } if ( -- i >= 0 ) { fileblock -= grub_le_to_cpu32 ( ext [ i ]. block ) ; if ( fileblock >= grub_le_to_cpu16 ( ext [ i ]. len ) ) return 0 ; else { grub_disk_addr_t start ; start = grub_le_to_cpu16 ( ext [ i ]. start_hi ) ; start = ( start << 32 ) + grub_le_to_cpu32 ( ext [ i ]. start ) ; return fileblock + start ; } } else { grub_error ( GRUB_ERR_BAD_FS,

Fix:
<S2SV_ModStart> < INDIRECT_BLOCKS ) { <S2SV_ModStart> ] ) ; }
Buggy code:
 struct sk_buff * nf_ct_frag6_gather ( struct sk_buff * skb, u32 user ) { struct sk_buff * clone ; struct net_device * dev = skb -> dev ; struct frag_hdr * fhdr ; struct nf_ct_frag6_queue * fq ; struct ipv6hdr * hdr ; int fhoff, nhoff ; u8 prevhdr ; struct sk_buff * ret_skb = NULL ; if ( ipv6_hdr ( skb ) -> payload_len == 0 ) { pr_debug ( "payload   len   =   0\\n" ) ; return skb ; } if ( find_prev_fhdr ( skb, & prevhdr, & nhoff, & fhoff ) < 0 ) return skb ; clone = skb_clone ( skb, GFP_ATOMIC ) ; if ( clone == NULL ) { pr_debug ( "Can\'t   clone   skb\\n" ) ; return skb ; } NFCT_FRAG6_CB ( clone ) -> orig = skb ; if (! pskb_may_pull ( clone, fhoff + sizeof ( * fhdr ) ) ) { pr_debug ( "message   is   too   short.\\n" ) ; goto ret_orig ; } skb_set_transport_header ( clone, fhoff ) ; hdr = ipv6_hdr ( clone ) ; fhdr = ( struct frag_hdr * ) skb_transport_header ( clone ) ; <START_BUG> if (! ( fhdr -> frag_off & htons ( 0xFFF9 ) ) ) { <END_BUG> pr_debug ( "Invalid   fragment   offset\\n" ) ; goto ret_orig ; } if ( atomic_read ( & nf_init_frags. mem ) > nf_init_frags. high_thresh ) nf_ct_frag6_evictor ( ) ; fq = fq_find ( fhdr -> identification, user, & hdr -> saddr, & hdr -> daddr ) ; if ( fq == NULL ) { pr_debug ( "Can\'t   find   and   can\'t   create   new   queue\\n" ) ; goto ret_orig ; } spin_lock_bh ( & fq -> q. lock ) ; if ( nf_ct_frag6_queue ( fq,

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> atomic_read ( &
Buggy code:
 void macvlan_common_setup ( struct net_device * dev ) { ether_setup ( dev ) ; <START_BUG> dev -> priv_flags &= ~ IFF_XMIT_DST_RELEASE ; <END_BUG> dev -> netdev_ops = & macvlan_netdev_ops ; dev -> destructor = free_netdev ; dev -> header_ops = & macvlan_hard_header_ops, dev -> ethtool_ops = & macvlan_ethtool_ops ; }

Fix:
<S2SV_ModStart> priv_flags &= ~ ( IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING ) <S2SV_ModEnd> ; dev ->
Buggy code:
 static void mpeg4_encode_gop_header ( MpegEncContext * s ) { <START_BUG> int hours, minutes, seconds ; <END_BUG> int64_t time ; put_bits ( & s -> pb, 16, 0 ) ; put_bits ( & s -> pb, 16, GOP_STARTCODE ) ; time = s -> current_picture_ptr -> f -> pts ; if ( s -> reordered_input_picture [ 1 ] ) time = FFMIN ( time, s -> reordered_input_picture [ 1 ] -> f -> pts ) ; time = time * s -> avctx -> time_base. num ; s -> last_time_base = FFUDIV ( time, s -> avctx -> time_base. den ) ; seconds = FFUDIV ( time, s -> avctx -> time_base. den ) ; minutes = FFUDIV ( seconds, 60 ) ; seconds = FFUMOD ( seconds, 60 ) ; hours = FFUDIV ( minutes, 60 ) ; minutes = FFUMOD ( minutes, 60 ) ; hours = FFUMOD ( hours, 24 ) ; put_bits ( & s -> pb, 5, hours ) ; put_bits ( & s -> pb, 6, minutes ) ; put_bits ( & s -> pb, 1, 1 ) ; put_bits ( & s -> pb, 6, seconds ) ; put_bits ( & s -> pb, 1,!! ( s -> avctx -> flags & AV_CODEC_FLAG_CLOSED_GOP ) ) ; put_bits ( & s -> pb, 1, 0 ) ; ff_mpeg4_stuffing ( & s -> pb ) ; }

Fix:
<S2SV_ModStart> s ) { int64_t <S2SV_ModEnd> hours, minutes
Buggy code:
 long vhost_dev_ioctl ( struct vhost_dev * d, unsigned int ioctl, void __user * argp ) { struct file * eventfp, * filep = NULL ; struct eventfd_ctx * ctx = NULL ; u64 p ; long r ; int i, fd ; if ( ioctl == VHOST_SET_OWNER ) { r = vhost_dev_set_owner ( d ) ; goto done ; } r = vhost_dev_check_owner ( d ) ; if ( r ) goto done ; switch ( ioctl ) { case VHOST_SET_MEM_TABLE : r = vhost_set_memory ( d, argp ) ; break ; case VHOST_SET_LOG_BASE : if ( copy_from_user ( & p, argp, sizeof p ) ) { r = - EFAULT ; break ; } if ( ( u64 ) ( unsigned long ) p!= p ) { r = - EFAULT ; break ; } for ( i = 0 ; i < d -> nvqs ; ++ i ) { struct vhost_virtqueue * vq ; void __user * base = ( void __user * ) ( unsigned long ) p ; vq = d -> vqs [ i ] ; mutex_lock ( & vq -> mutex ) ; if ( vq -> private_data &&! vq_log_access_ok ( vq, base ) ) r = - EFAULT ; else vq -> log_base = base ; mutex_unlock ( & vq -> mutex ) ; } break ; case VHOST_SET_LOG_FD : r = get_user ( fd, ( int __user * ) argp ) ; if ( r < 0 ) break ; eventfp = fd == - 1? NULL : eventfd_fget ( fd ) ; if ( IS_ERR ( eventfp ) ) { r = PTR_ERR ( eventfp ) ; break ; } if ( eventfp!= d -> log_file ) { filep = d -> log_file ; <START_BUG> ctx = d -> log_ctx ; <END_BUG> d -> log_ctx = eventfp? eventfd_ctx_fileget ( eventfp ) : NULL ; } else filep = eventfp ; for ( i = 0 ; i < d -> nvqs ; ++ i ) { mutex_lock ( & d -> vqs [ i ] -> mutex ) ; d -> v

Fix:
<S2SV_ModStart> -> log_file ; d -> log_file = eventfp ;
Buggy code:
 struct dentry * nfs4_atomic_open ( struct inode * dir, struct dentry * dentry, struct nameidata * nd ) { struct path path = {. mnt = nd -> path. mnt,. dentry = dentry, } ; struct dentry * parent ; struct iattr attr ; struct rpc_cred * cred ; struct nfs4_state * state ; <START_BUG> struct dentry * res ; <END_BUG> if ( nd -> flags & LOOKUP_CREATE ) { attr. ia_mode = nd -> intent. open. create_mode ; attr. ia_valid = ATTR_MODE ; if (! IS_POSIXACL ( dir ) ) attr. ia_mode &= ~ current -> fs -> umask ; } else { attr. ia_valid = 0 ; BUG_ON ( nd -> intent. open. flags & O_CREAT ) ; } cred = rpc_lookup_cred ( ) ; if ( IS_ERR ( cred ) ) return ( struct dentry * ) cred ; parent = dentry -> d_parent ; nfs_block_sillyrename ( parent ) ;  state = nfs4_do_open ( dir, & path, nd -> intent. open. flags, & attr, cred ) ; <START_BUG> put_rpccred ( cred ) ; if ( IS_ERR ( state ) ) { if ( PTR_ERR ( state ) == - ENOENT ) { d_add ( dentry, NULL ) ; nfs_set_verifier ( dentry, nfs_save_change_attribute ( dir ) ) ; } nfs_unblock_sillyrename ( parent ) ; return ( struct dentry * ) state ; } res = d_add_unique ( dentry, igrab ( state -> inode ) ) ; if ( res!= NULL ) path. dentry = res ; nfs_set_verifier ( path. dentry, nfs_save_change_attribute ( dir ) ) ; nfs_unblock_sillyrename ( parent ) ; <END_BUG> nfs4_intent_set_file ( nd, & path, state ) ;  return res ; }

Fix:
<S2SV_ModStart> dentry * res ; fmode_t fmode = nd -> intent. open. flags & ( FMODE_READ | FMODE_WRITE | FMODE_EXEC ) <S2SV_ModStart> & path, fmode, <S2SV_ModStart> path, state, fmode
Buggy code:
 int hugetlb_mcopy_atomic_pte ( struct mm_struct * dst_mm, pte_t * dst_pte, struct vm_area_struct * dst_vma, unsigned long dst_addr, unsigned long src_addr, struct page * * pagep ) { int vm_shared = dst_vma -> vm_flags & VM_SHARED ; struct hstate * h = hstate_vma ( dst_vma ) ; pte_t _dst_pte ; spinlock_t * ptl ; int ret ; struct page * page ; if (! * pagep ) { ret = - ENOMEM ; page = alloc_huge_page ( dst_vma, dst_addr, 0 ) ; if ( IS_ERR ( page ) ) goto out ; ret = copy_huge_page_from_user ( page, ( const void __user * ) src_addr, pages_per_huge_page ( h ), false ) ; if ( unlikely ( ret ) ) { ret = - EFAULT ; * pagep = page ; goto out ; } } else { page = * pagep ; * pagep = NULL ; } __SetPageUptodate ( page ) ; set_page_huge_active ( page ) ; if ( vm_shared ) { struct address_space * mapping = dst_vma -> vm_file -> f_mapping ; pgoff_t idx = vma_hugecache_offset ( h, dst_vma, dst_addr ) ; ret = huge_add_to_page_cache ( page, mapping, idx ) ; if ( ret ) goto out_release_nounlock ; } ptl = huge_pte_lockptr ( h, dst_mm, dst_pte ) ; spin_lock ( ptl ) ; ret = - EEXIST ; if (! huge_pte_none ( huge_ptep_get ( dst_pte ) ) ) goto out_release_unlock ; if ( vm_shared ) { page_dup_rmap ( page, true ) ; } else { ClearPagePrivate ( page ) ; hugepage_add_new_anon_rmap ( page, dst_vma, dst_addr ) ; } _dst_pte = make_huge_pt

Fix:
<S2SV_ModStart> ptl ) ; if ( vm_shared ) unlock_page ( page ) ; out_release_nounlock : <S2SV_ModEnd> put_page ( page
Buggy code:
 static int apparmor_setprocattr ( struct task_struct * task, char * name, void * value, size_t size ) { struct common_audit_data sa ; struct apparmor_audit_data aad = { 0, } ; <START_BUG> char * command, * args = value ; <END_BUG> size_t arg_size ; int error ; if ( size == 0 )  return - EINVAL ; <START_BUG> if ( args [ size - 1 ]!= '\\0' ) { <END_BUG> if ( size == PAGE_SIZE )  <START_BUG> return - EINVAL ; <END_BUG>  args [ size ] = '\\0' ; <START_BUG> } if ( current!= task ) return - EACCES ; args = value ; args = strim ( args ) ; command = strsep ( & args, "   " ) ; if (! args ) return - EINVAL ; args = skip_spaces ( args ) ; if (! * args ) return - EINVAL ; arg_size = size - ( args - ( char * ) value ) ; <END_BUG> if ( strcmp ( name, "current" ) == 0 ) {  if ( strcmp ( command, "changehat" ) == 0 ) { error = aa_setprocattr_changehat ( args, arg_size,! AA_DO_TEST ) ; <START_BUG> } else if ( strcmp ( command, "permhat" ) == 0 ) { <END_BUG> error = aa_setprocattr_changehat ( args, arg_size, AA_DO_TEST ) ; } else if ( strcmp ( command, "changeprofile" ) == 0 ) { error = aa_setprocattr_changeprofile ( args,! AA_ONEXEC,! AA_DO_TEST ) ; } else if ( strcmp ( command, "permprofile" ) == 0 ) { error = aa_setprocattr_changeprofile ( args,! AA_ONEXEC, AA_DO_TEST ) ; } else goto fail ;  } else if ( strcmp ( name, "exec" ) == 0 ) { <START_BUG> if ( strcmp ( command, "exec" ) == 0 ) error = aa_setprocattr_changeprofile ( args, AA_ONEXEC,! AA_DO_TEST ) ; else goto fail ; <END_BUG> } else  return - EINVAL ; if (! error ) error = size ; return error ; fail : sa. type = LSM_AUDIT_

Fix:
<S2SV_ModStart> command, * largs = NULL, * <S2SV_ModStart> return - EINVAL ; if ( current!= task ) return - EACCES <S2SV_ModStart> '\\0' ) { largs = args = kmalloc ( size + 1, GFP_KERNEL ) ; if (! args <S2SV_ModEnd> ) return - <S2SV_ModStart> ) return - ENOMEM ; memcpy ( args, value, size ) ; args [ size ] = '\\0' ; } error = - <S2SV_ModStart> EINVAL ; args = strim ( args ) ; command = strsep ( & args, " <S2SV_blank> " ) ; if (! args ) goto out ; args = skip_spaces ( args ) ; if (! * args ) goto out ; arg_size = size - ( args - ( char * ) value ) ; if ( strcmp ( name, "current" ) == 0 ) { if ( strcmp ( command, "changehat" ) == 0 ) { error = aa_setprocattr_changehat ( args, arg_size,! AA_DO_TEST ) ; } else if ( strcmp ( command, "permhat" ) == 0 ) { error = aa_setprocattr_changehat ( args, arg_size, AA_DO_
Buggy code:
 static void * bpf_obj_do_get ( const struct filename * pathname, enum bpf_type * type ) { struct inode * inode ; struct path path ; void * raw ; int ret ; ret = kern_path ( pathname -> name, LOOKUP_FOLLOW, & path ) ; if ( ret ) return ERR_PTR ( ret ) ; inode = d_backing_inode ( path. dentry ) ; ret = inode_permission ( inode, MAY_WRITE ) ; if ( ret ) goto out ; ret = bpf_inode_type ( inode, type ) ; if ( ret ) goto out ; raw = bpf_any_get ( inode -> i_private, * type ) ; <START_BUG> touch_atime ( & path ) ; <END_BUG> path_put ( & path ) ; return raw ; out : path_put ( & path ) ; return ERR_PTR ( ret ) ; }

Fix:
<S2SV_ModStart> type ) ; if (! IS_ERR ( raw ) )
Buggy code:
 static struct dentry * proc_mount ( struct file_system_type * fs_type, int flags, const char * dev_name, void * data ) { int err ; struct super_block * sb ; struct pid_namespace * ns ; char * options ; if ( flags & MS_KERNMOUNT ) { ns = ( struct pid_namespace * ) data ; options = NULL ; } else { ns = task_active_pid_ns ( current ) ; options = data ; if (! ns_capable ( ns -> user_ns, CAP_SYS_ADMIN ) ) return ERR_PTR ( - EPERM ) ; } sb = sget ( fs_type, proc_test_super, proc_set_super, flags, ns ) ; if ( IS_ERR ( sb ) ) return ERR_CAST ( sb ) ; <START_BUG> if (! proc_parse_options ( options, ns ) ) { <END_BUG> deactivate_locked_super ( sb ) ; return ERR_PTR ( - EINVAL ) ; } if (! sb -> s_root ) { err = proc_fill_super ( sb ) ; if ( err ) { deactivate_locked_super ( sb ) ; return ERR_PTR ( err ) ; } sb -> s_flags |= MS_ACTIVE ; sb -> s_iflags |= SB_I_NOEXEC ; } return dget ( sb -> s_root ) ; }

Fix:
<S2SV_ModStart> sb ) ; sb -> s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH ;
Buggy code:
 int main ( int argc, char * argv [ ] ) { int ret ; struct lxc_lock * lock ; lock = lxc_newlock ( NULL, NULL ) ; if (! lock ) { fprintf ( stderr, "%d:   failed   to   get   unnamed   lock\\n", __LINE__ ) ; exit ( 1 ) ; } ret = lxclock ( lock, 0 ) ; if ( ret ) { fprintf ( stderr, "%d:   failed   to   take   unnamed   lock   (%d)\\n", __LINE__, ret ) ; exit ( 1 ) ; } ret = lxcunlock ( lock ) ; if ( ret ) { fprintf ( stderr, "%d:   failed   to   put   unnamed   lock   (%d)\\n", __LINE__, ret ) ; exit ( 1 ) ; } lxc_putlock ( lock ) ; lock = lxc_newlock ( "//var//lib//lxc", mycontainername ) ; if (! lock ) { fprintf ( stderr, "%d:   failed   to   get   lock\\n", __LINE__ ) ; exit ( 1 ) ; } struct stat sb ; <START_BUG> char * pathname = RUNTIME_PATH "//lock//lxc//var//lib//lxc//" ; <END_BUG> ret = stat ( pathname, & sb ) ; if ( ret!= 0 ) { fprintf ( stderr, "%d:   filename   %s   not   created\\n", __LINE__, pathname ) ; exit ( 1 ) ; } lxc_putlock ( lock ) ; test_two_locks ( ) ; fprintf ( stderr, "all   tests   passed\\n" ) ; exit ( ret ) ; }

Fix:
<S2SV_ModStart> pathname = RUNTIME_PATH "//lxc//lock//var//lib//lxc//" <S2SV_ModEnd> ; ret =
Buggy code:
 <START_BUG> void vp9_predict_intra_block ( const MACROBLOCKD * xd, int block_idx, int bwl_in, <END_BUG>  TX_SIZE tx_size, MB_PREDICTION_MODE mode, <START_BUG> const uint8_t * ref, int ref_stride, uint8_t * dst, int dst_stride, int aoff, int loff, int plane ) { <END_BUG> const int bwl = bwl_in - tx_size ;  <START_BUG> const int wmask = ( 1 << bwl ) - 1 ; <END_BUG>  const int have_top = ( block_idx >> bwl ) || xd -> up_available ; <START_BUG> <END_BUG> const int have_left = ( block_idx & wmask ) || xd -> left_available ;  const int have_right = ( ( block_idx & wmask )!= wmask ) ; const int x = aoff * 4 ; const int y = loff * 4 ; assert ( bwl >= 0 ) ; build_intra_predictors ( xd, ref, ref_stride, dst, dst_stride, mode, tx_size, have_top, have_left, have_right, x, y, plane ) ; }

Fix:
<S2SV_ModStart> xd, int <S2SV_ModEnd> bwl_in, TX_SIZE <S2SV_ModStart> TX_SIZE tx_size, PREDICTION_MODE <S2SV_ModEnd> mode, const <S2SV_ModStart> { const int bw <S2SV_ModEnd> = ( 1 <S2SV_ModStart> ( 1 << bwl_in ) ; const int txw = ( 1 << tx_size ) <S2SV_ModEnd> ; const int <S2SV_ModStart> int have_top = loff <S2SV_ModEnd> || xd -> <S2SV_ModStart> int have_left = aoff || xd -> left_available ; const int have_right = ( aoff + txw ) < bw ; const int x = aoff * 4 ; const int y = loff * 4 ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { build_intra_predictors_high ( xd, ref, ref_stride, dst, dst_stride, mode, tx_size, have_top, have_left, have_right, x, y, plane, xd -> bd ) ; return ; } # endif <S2SV_ModEnd> build_intra_predictors ( xd
Buggy code:
 static void * vips_foreign_load_start ( VipsImage * out, void * a, void * b ) { VipsForeignLoad * load = VIPS_FOREIGN_LOAD ( b ) ; <START_BUG> VipsForeignLoadClass * class = VIPS_FOREIGN_LOAD_GET_CLASS ( load ) ; <END_BUG> if (! load -> real ) { if (! ( load -> real = vips_foreign_load_temp ( load ) ) ) return ( NULL ) ; # ifdef DEBUG printf ( "vips_foreign_load_start:   triggering   ->load()\\n" ) ; # endif load -> real -> progress_signal = load -> out ; g_object_set_qdata ( G_OBJECT ( load -> real ), vips__foreign_load_operation, load ) ; if ( class -> load ( load ) ||  vips_image_pio_input ( load -> real ) ) <START_BUG> return ( NULL ) ; if (! vips_foreign_load_iscompat ( load -> real, out ) ) <END_BUG> return ( NULL ) ;  vips_image_pipelinev ( load -> out, load -> out -> dhint, load -> real, NULL ) ; } return ( vips_region_new ( load -> real ) ) ; }

Fix:
<S2SV_ModStart> VIPS_FOREIGN_LOAD_GET_CLASS ( load ) ; if ( load -> error ) return ( NULL <S2SV_ModStart> -> real ) || <S2SV_ModEnd> vips_foreign_load_iscompat ( load <S2SV_ModStart> out ) ) { vips_operation_invalidate ( VIPS_OPERATION ( load ) ) ; load -> error = TRUE ; return ( NULL ) ; } <S2SV_ModEnd> vips_image_pipelinev ( load
Buggy code:
 WORD32 ih264d_start_of_pic ( dec_struct_t * ps_dec, WORD32 i4_poc, pocstruct_t * ps_temp_poc, UWORD16 u2_frame_num, dec_pic_params_t * ps_pps ) { pocstruct_t * ps_prev_poc = & ps_dec -> s_cur_pic_poc ; pocstruct_t * ps_cur_poc = ps_temp_poc ; pic_buffer_t * pic_buf ; ivd_video_decode_op_t * ps_dec_output = ( ivd_video_decode_op_t * ) ps_dec -> pv_dec_out ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; dec_seq_params_t * ps_seq = ps_pps -> ps_sps ; UWORD8 u1_bottom_field_flag = ps_cur_slice -> u1_bottom_field_flag ; UWORD8 u1_field_pic_flag = ps_cur_slice -> u1_field_pic_flag ; high_profile_tools_t s_high_profile ; WORD32 ret ; H264_MUTEX_LOCK ( & ps_dec -> process_disp_mutex ) ; ps_prev_poc -> i4_pic_order_cnt_lsb = ps_cur_poc -> i4_pic_order_cnt_lsb ; ps_prev_poc -> i4_pic_order_cnt_msb = ps_cur_poc -> i4_pic_order_cnt_msb ; ps_prev_poc -> i4_delta_pic_order_cnt_bottom = ps_cur_poc -> i4_delta_pic_order_cnt_bottom ; ps_prev_poc -> i4_delta_pic_order_cnt [ 0 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 0 ] ; ps_prev_poc -> i4_delta_pic_order_cnt [ 1 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 1 ] ; ps_prev_

Fix:
<S2SV_ModStart> ; ps_dec -> u2_cur_slice_num = 0 ; ps_dec -> <S2SV_ModStart> ; ps_dec -> <S2SV_ModEnd> u2_cur_slice_num_dec_thread = 0
Buggy code:
 static void nfs4_open_release ( void * calldata ) { struct nfs4_opendata * data = calldata ; struct nfs4_state * state = NULL ; if ( data -> cancelled == 0 ) goto out_free ; if ( data -> rpc_status!= 0 ||! data -> rpc_done ) goto out_free ; if ( data -> o_res. rflags & NFS4_OPEN_RESULT_CONFIRM ) goto out_free ; state = nfs4_opendata_to_nfs4_state ( data ) ; if (! IS_ERR ( state ) ) <START_BUG> nfs4_close_state ( & data -> path, state, data -> o_arg. open_flags ) ; <END_BUG> out_free : nfs4_opendata_put ( data ) ; }

Fix:
<S2SV_ModStart> -> o_arg. fmode <S2SV_ModEnd> ) ; out_free
Buggy code:
 void vp9_resize_plane ( const uint8_t * const input, int height, int width, int in_stride, uint8_t * output, int height2, int width2, int out_stride ) { int i ; uint8_t * intbuf = ( uint8_t * ) malloc ( sizeof ( uint8_t ) * width2 * height ) ; uint8_t * tmpbuf = ( uint8_t * ) malloc ( sizeof ( uint8_t ) * ( width < height? height : width ) ) ; uint8_t * arrbuf = ( uint8_t * ) malloc ( sizeof ( uint8_t ) * ( height + height2 ) ) ; <START_BUG> for ( i = 0 ; i < height ; ++ i ) <END_BUG> resize_multistep ( input + in_stride * i, width, intbuf + width2 * i, width2, tmpbuf ) ; for ( i = 0 ; i < width2 ; ++ i ) { fill_col_to_arr ( intbuf + i, width2, height, arrbuf ) ; resize_multistep ( arrbuf, height, arrbuf + height, height2, tmpbuf ) ; fill_arr_to_col ( output + i, out_stride, height2, arrbuf + height ) ; } free ( intbuf ) ; free ( tmpbuf ) ; free ( arrbuf ) ; }

Fix:
<S2SV_ModStart> ) ) ; assert ( width > 0 ) ; assert ( height > 0 ) ; assert ( width2 > 0 ) ; assert ( height2 > 0 ) ;
Buggy code:
 error_t httpCheckCharset ( const char_t * s, size_t length, uint_t charset ) { error_t error ; size_t i ; uint8_t c ; uint_t m ; error = NO_ERROR ; for ( i = 0 ; i < length ; i ++ ) { c = ( uint8_t ) s [ i ] ; m = HTTP_CHARSET_OCTET ; if ( iscntrl ( c ) ) m |= HTTP_CHARSET_CTL ; if ( isprint ( c ) && c <= 126 ) m |= HTTP_CHARSET_TEXT | HTTP_CHARSET_VCHAR ; if ( c ==' '|| c == '\\t' ) m |= HTTP_CHARSET_TEXT | HTTP_CHARSET_LWS ; if ( isalpha ( c ) ) m |= HTTP_CHARSET_TCHAR | HTTP_CHARSET_ALPHA ; if ( osIsdigit ( c ) ) m |= HTTP_CHARSET_TCHAR | HTTP_CHARSET_DIGIT ; if ( isxdigit ( c ) ) m |= HTTP_CHARSET_HEX ; if ( c >= 128 ) m |= HTTP_CHARSET_TEXT | HTTP_CHARSET_OBS_TEXT ; <START_BUG> if ( strchr ( "!#$%&\'*+-.^_`|~", c ) ) <END_BUG> m |= HTTP_CHARSET_TCHAR ; if ( ( m & charset ) == 0 ) error = ERROR_INVALID_SYNTAX ; } return error ; }

Fix:
<S2SV_ModStart> ; if ( osStrchr <S2SV_ModEnd> ( "!#$%&\'*+-.^_`|~",
Buggy code:
 static struct ucounts * get_ucounts ( struct user_namespace * ns, kuid_t uid ) { struct hlist_head * hashent = ucounts_hashentry ( ns, uid ) ; struct ucounts * ucounts, * new ; spin_lock_irq ( & ucounts_lock ) ; ucounts = find_ucounts ( ns, uid, hashent ) ; if (! ucounts ) { spin_unlock_irq ( & ucounts_lock ) ; new = kzalloc ( sizeof ( * new ), GFP_KERNEL ) ; if (! new ) return NULL ; new -> ns = ns ; new -> uid = uid ; <START_BUG> atomic_set ( & new -> count, 0 ) ; <END_BUG> spin_lock_irq ( & ucounts_lock ) ; ucounts = find_ucounts ( ns, uid, hashent ) ; if ( ucounts ) { kfree ( new ) ; } else { hlist_add_head ( & new -> node, hashent ) ; ucounts = new ; } }  if (! atomic_add_unless ( & ucounts -> count, 1, INT_MAX ) ) <START_BUG> ucounts = NULL ; spin_unlock_irq ( & ucounts_lock ) ; return ucounts ; }<END_BUG>

Fix:
<S2SV_ModStart> = uid ; <S2SV_ModEnd> new -> count <S2SV_ModStart> new -> count = 0 <S2SV_ModEnd> ; spin_lock_irq ( <S2SV_ModStart> } if ( <S2SV_ModEnd> ucounts -> count <S2SV_ModStart> ucounts -> count == INT_MAX ) ucounts = NULL ; else ucounts -> count += 1 <S2SV_ModEnd> ; spin_unlock_irq (
Buggy code:
 static vpx_codec_err_t vp8_decode ( vpx_codec_alg_priv_t * ctx, const uint8_t * data, unsigned int data_sz, void * user_priv, long deadline ) { vpx_codec_err_t res = VPX_CODEC_OK ; unsigned int resolution_change = 0 ; unsigned int w, h ; <START_BUG> if ( update_fragments ( ctx, data, data_sz, & res ) <= 0 ) <END_BUG> return res ; w = ctx -> si. w ; h = ctx -> si. h ; res = vp8_peek_si_internal ( ctx -> fragments. ptrs [ 0 ], ctx -> fragments. sizes [ 0 ], & ctx -> si, ctx -> decrypt_cb, ctx -> decrypt_state ) ; if ( ( res == VPX_CODEC_UNSUP_BITSTREAM ) &&! ctx -> si. is_kf ) { res = VPX_CODEC_OK ; } if (! ctx -> decoder_init &&! ctx -> si. is_kf ) res = VPX_CODEC_UNSUP_BITSTREAM ; if ( ( ctx -> si. h!= h ) || ( ctx -> si. w!= w ) ) resolution_change = 1 ;  if (! res && ctx -> defer_alloc ) <START_BUG> { int i ; for ( i = 1 ;! res && i < NELEMENTS ( ctx -> mmaps ) ; i ++ ) { vpx_codec_dec_cfg_t cfg ; cfg. w = ctx -> si. w ; cfg. h = ctx -> si. h ; ctx -> mmaps [ i ]. id = vp8_mem_req_segs [ i ]. id ; ctx -> mmaps [ i ]. sz = vp8_mem_req_segs [ i ]. sz ; ctx -> mmaps [ i ]. align = vp8_mem_req_segs [ i ]. align ; ctx -> mmaps [ i ]. flags = vp8_mem_req_segs [ i ]. flags ; if (! ctx -> mmaps [ i ]. sz ) ctx -> mmaps [ i ]. sz = vp8_mem_req_segs [ i ]. calc_sz ( & cfg, ctx -> base. init_flags ) ; res =<END_BUG>

Fix:
<S2SV_ModStart> ; if (! ctx -> fragments. enabled && ( data == NULL && data_sz == 0 ) ) { return 0 ; } if ( <S2SV_ModStart>! res &&! <S2SV_ModEnd> ctx -> decoder_init <S2SV_ModStart> ctx -> decoder_init <S2SV_ModEnd> ) { VP8D_CONFIG <S2SV_ModStart> ; ctx -> decoder_init = 1 ; } if ( ctx -> decoder_init ) { ctx -> <S2SV_ModStart> ctx -> decrypt_state <S2SV_ModEnd> ; } if <S2SV_ModStart> = 0 ; vp8_clear_system_state ( ) ;
Buggy code:
 static int userns_install ( struct nsproxy * nsproxy, void * ns ) { struct user_namespace * user_ns = ns ; struct cred * cred ; if ( user_ns == current_user_ns ( ) ) return - EINVAL ; <START_BUG> if ( atomic_read ( & current -> mm -> mm_users ) > 1 ) <END_BUG> return - EINVAL ; if (! ns_capable ( user_ns, CAP_SYS_ADMIN ) ) return - EPERM ; cred = prepare_creds ( ) ; if (! cred ) return - ENOMEM ; put_user_ns ( cred -> user_ns ) ; set_cred_user_ns ( cred, get_user_ns ( user_ns ) ) ; return commit_creds ( cred ) ; }

Fix:
<S2SV_ModStart> mm_users ) > 1 ) return - EINVAL ; if ( current -> fs -> users!=
Buggy code:
 WORD32 ih264d_parse_inter_slice_data_cavlc ( dec_struct_t * ps_dec, dec_slice_params_t * ps_slice, UWORD16 u2_first_mb_in_slice ) { UWORD32 uc_more_data_flag ; WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2, u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_read_mb_type ; UWORD32 u1_mbaff ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end = 0 ; UWORD32 u1_tfr_n_mb = 0 ; UWORD32 u1_decode_nmb = 0 ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data = ps_dec -> ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD32 u1_mb_threshold ; WORD32 ret = OK ; if ( ps_slice -> u1_slice_type == P_SLICE ) { u1_inter_mb_type = P_MB ; u1_deblk_mb_type = D_INTER_MB ; u1_mb_threshold = 5 ; } else { u1_inter_mb_type = B_MB ; u1_deblk_mb_type = D_B_SLI

Fix:
<S2SV_ModStart> u1_num_mbs ++ ; <S2SV_ModEnd> u1_num_mbsNby2 ++ ; <S2SV_ModStart> ) ; } ps_dec -> u2_total_mbs_coded += u1_num_mbs ;
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; one = 1 ; image = AcquireImage ( image_info ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImage

Fix:
<S2SV_ModStart> Rec. RecordLength ) ; if ( Rec. RecordLength > GetBlobSize ( image ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader"
Buggy code:
 static int ext4_ext_split ( handle_t * handle, struct inode * inode, unsigned int flags, struct ext4_ext_path * path, struct ext4_extent * newext, int at ) { struct buffer_head * bh = NULL ; int depth = ext_depth ( inode ) ; struct ext4_extent_header * neh ; struct ext4_extent_idx * fidx ; int i = at, k, m, a ; ext4_fsblk_t newblock, oldblock ; __le32 border ; ext4_fsblk_t * ablocks = NULL ; int err = 0 ; <START_BUG> if ( unlikely ( path [ depth ]. p_ext > EXT_MAX_EXTENT ( path [ depth ]. p_hdr ) ) ) { <END_BUG> EXT4_ERROR_INODE ( inode, "p_ext   >   EXT_MAX_EXTENT!" ) ; return - EFSCORRUPTED ; } if ( path [ depth ]. p_ext!= EXT_MAX_EXTENT ( path [ depth ]. p_hdr ) ) { border = path [ depth ]. p_ext [ 1 ]. ee_block ; ext_debug ( "leaf   will   be   split." "   next   leaf   starts   at   %d\\n", le32_to_cpu ( border ) ) ; } else { border = newext -> ee_block ; ext_debug ( "leaf   will   be   added." "   next   leaf   starts   at   %d\\n", le32_to_cpu ( border ) ) ; } ablocks = kcalloc ( depth, sizeof ( ext4_fsblk_t ), GFP_NOFS ) ; if (! ablocks ) return - ENOMEM ; ext_debug ( "allocate   %d   blocks   for   indexes//leaf\\n", depth - at ) ; for ( a = 0 ; a < depth - at ; a ++ ) { newblock = ext4_ext_new_meta_block ( handle, inode, path, newext, & err, flags ) ; if ( newblock == 0 ) goto cleanup ; ablocks [ a ] = newblock ; } newblock = ablocks [ -- a ] ; if ( unlikely ( newblock == 0 ) ) { EXT4_ERROR_INODE (

Fix:
<S2SV_ModStart> = 0 ; size_t ext_size = 0 ; <S2SV_ModStart> ) ; } ext_size = sizeof ( struct ext4_extent_header ) + sizeof ( struct ext4_extent ) * le16_to_cpu ( neh -> eh_entries ) ; memset ( bh -> b_data + ext_size, 0, inode -> i_sb -> s_blocksize - ext_size ) ; <S2SV_ModStart> ) ; } ext_size = sizeof ( struct ext4_extent_header ) + ( sizeof ( struct ext4_extent ) * le16_to_cpu ( neh -> eh_entries ) ) ; memset ( bh -> b_data + ext_size, 0, inode -> i_sb -> s_blocksize - ext_size ) ;
Buggy code:
 <START_BUG> void vp9_encode_block_intra ( MACROBLOCK * x, int plane, int block, <END_BUG> BLOCK_SIZE plane_bsize, TX_SIZE tx_size,  unsigned char * skip ) { <START_BUG> <END_BUG> struct encode_b_args arg = { x, NULL, skip } ;  encode_block_intra ( plane, block, plane_bsize, tx_size, & arg ) ; }

Fix:
<S2SV_ModStart> void vp9_encode_block_intra ( <S2SV_ModEnd> int plane, <S2SV_ModStart> TX_SIZE tx_size, void * arg <S2SV_ModEnd> ) { struct <S2SV_ModStart> { struct encode_b_args * const args = arg ; MACROBLOCK * const x = args -> x ; MACROBLOCKD * const xd = & x -> e_mbd ; MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; struct macroblock_plane * const p = & x -> plane [ plane ] ; struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; tran_low_t * coeff = BLOCK_OFFSET ( p -> coeff, block ) ; tran_low_t * qcoeff = BLOCK_OFFSET ( p -> qcoeff, block ) ; tran_low_t * dqcoeff = BLOCK_OFFSET ( pd -> dqcoeff, block ) ; const scan_order * scan_order ; TX_TYPE tx_type = DCT_DCT ; PREDICTION_MODE mode ; const int bwl = b_width_log2_lookup [ plane_bsize ] ; const int diff_stride = 4 * ( 1 << bwl ) ; uint8
Buggy code:
 void fib_del_ifaddr ( struct in_ifaddr * ifa, struct in_ifaddr * iprim ) { struct in_device * in_dev = ifa -> ifa_dev ; struct net_device * dev = in_dev -> dev ; struct in_ifaddr * ifa1 ; struct in_ifaddr * prim = ifa, * prim1 = NULL ; __be32 brd = ifa -> ifa_address | ~ ifa -> ifa_mask ; __be32 any = ifa -> ifa_address & ifa -> ifa_mask ; # define LOCAL_OK 1 # define BRD_OK 2 # define BRD0_OK 4 # define BRD1_OK 8 unsigned int ok = 0 ; int subnet = 0 ; int gone = 1 ; int same_prefsrc = 0 ; if ( ifa -> ifa_flags & IFA_F_SECONDARY ) { prim = inet_ifa_byprefix ( in_dev, any, ifa -> ifa_mask ) ; if (! prim ) { pr_warn ( "%s:   bug:   prim   ==   NULL\\n", __func__ ) ; return ; } if ( iprim && iprim!= prim ) { pr_warn ( "%s:   bug:   iprim  !=   prim\\n", __func__ ) ; return ; } } else if (! ipv4_is_zeronet ( any ) && ( any!= ifa -> ifa_local || ifa -> ifa_prefixlen < 32 ) ) { if (! ( ifa -> ifa_flags & IFA_F_NOPREFIXROUTE ) ) fib_magic ( RTM_DELROUTE, dev -> flags & IFF_LOOPBACK? RTN_LOCAL : RTN_UNICAST, any, ifa -> ifa_prefixlen, prim ) ; subnet = 1 ; } <START_BUG> for ( ifa1 = in_dev -> ifa_list ; ifa1 ; ifa1 = ifa1 -> ifa_next ) { <END_BUG> if ( ifa1 == ifa ) { gone = 0 ; continue ; } if ( iprim && ifa1 -> ifa_mask == iprim -> ifa_mask && inet_ifa_match ( ifa1 ->

Fix:
<S2SV_ModStart> 1 ; } if ( in_dev -> dead ) goto no_promotions ; <S2SV_ModStart> } } } no_promotions :
Buggy code:
 static int persistent_prepare_exception ( struct dm_exception_store * store, struct dm_exception * e ) { <START_BUG> struct pstore * ps = get_info ( store ) ; <END_BUG> uint32_t stride ; chunk_t next_free ; sector_t size = get_dev_size ( dm_snap_cow ( store -> snap ) -> bdev ) ; if ( size < ( ( ps -> next_free + 1 ) * store -> chunk_size ) ) return - ENOSPC ; e -> new_chunk = ps -> next_free ;  stride = ( ps -> exceptions_per_area + 1 ) ; <START_BUG> next_free = ++ ps -> next_free ; if ( sector_div ( next_free, stride ) == 1 ) <END_BUG> ps -> next_free ++ ;  atomic_inc ( & ps -> pending_count ) ; return 0 ; }

Fix:
<S2SV_ModStart> ( store ) <S2SV_ModEnd> ; sector_t size <S2SV_ModStart> -> next_free ; <S2SV_ModEnd> ps -> next_free <S2SV_ModStart> -> next_free ++ ; skip_metadata ( ps )
Buggy code:
 generic_ret * modify_principal_2_svc ( mprinc_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; restriction_t * rp ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> rec. principal, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_MODIFY, arg -> rec. principal, & rp ) || kadm5int_acl_impose_restrictions ( handle -> context, & arg -> rec, & arg -> mask, rp ) ) { ret. code = KADM5_AUTH_MODIFY ; log_unauth ( "kadm5_modify_principal", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_modify_principal ( ( void * ) handle, & arg -> rec, arg -> mask ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_modify_principal", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; } free ( prime_arg )

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle