nus-yam/ex-repair huggingface dataset:
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_hdr ( dec_state_t * ps_dec ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; UWORD16 u2_height ; UWORD16 u2_width ; if ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN )!= SEQUENCE_HEADER_CODE ) { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; return IMPEG2D_FRM_HDR_START_CODE_NOT_FOUND ; } impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; u2_width = impeg2d_bit_stream_get ( ps_stream, 12 ) ; u2_height = impeg2d_bit_stream_get ( ps_stream, 12 ) ; if ( ( u2_width!= ps_dec -> u2_horizontal_size ) || ( u2_height!= ps_dec -> u2_vertical_size ) ) { if ( 0 == ps_dec -> u2_header_done ) { ps_dec -> u2_horizontal_size = u2_width ; ps_dec -> u2_vertical_size = u2_height ; if ( 0 == ps_dec -> u4_frm_buf_stride ) { ps_dec -> u4_frm_buf_stride = ( UWORD32 ) ( u2_width ) ; } } else { if ( ( u2_width > ps_dec -> u2_create_max_width ) || ( u2_height > ps_dec -> u2_create_max_height ) ) { IMPEG2D_ERROR_CODES_T e_error = IMPEG2D_UNSUPPORTED_DIMENSIONS ; ps_dec -> u2_reinit_max_height = u2_height ; ps_dec -> u2_reinit_max_width = u2_width ; return e_error ; } else { return ( IMPEG2D_ERROR_CODES_T ) IVD_RES_CHANGED ; } } } if ( ( ps_dec -> u2_horizontal_size > ps_

Fix:
<S2SV_ModStart> = IMPEG2D_UNSUPPORTED_DIMENSIONS ; ps_dec -> u2_reinit_max_height = ps_dec -> u2_vertical_size ; ps_dec -> u2_reinit_max_width = ps_dec -> u2_horizontal_size ; return e_error <S2SV_ModEnd> ; } ps_dec
Buggy code:
 static void rpc_init_task ( struct rpc_task * task, const struct rpc_task_setup * task_setup_data ) { memset ( task, 0, sizeof ( * task ) ) ; atomic_set ( & task -> tk_count, 1 ) ; task -> tk_flags = task_setup_data -> flags ; task -> tk_ops = task_setup_data -> callback_ops ; task -> tk_calldata = task_setup_data -> callback_data ; INIT_LIST_HEAD ( & task -> tk_task ) ; task -> tk_garb_retry = 2 ; task -> tk_cred_retry = 2 ; <START_BUG> task -> tk_priority = task_setup_data -> priority - RPC_PRIORITY_LOW ; <END_BUG> task -> tk_owner = current -> tgid ; task -> tk_workqueue = task_setup_data -> workqueue ; if ( task -> tk_ops -> rpc_call_prepare!= NULL ) task -> tk_action = rpc_prepare_task ; task -> tk_start = ktime_get ( ) ; dprintk ( "RPC:               new   task   initialized,   procpid   %u\\n", task_pid_nr ( current ) ) ; }

Fix:
<S2SV_ModStart> ; task -> tk_rebind_retry = 2 ; task ->
Buggy code:
 error_t httpClientAddQueryParam ( HttpClientContext * context, const char_t * name, const char_t * value ) { size_t nameLen ; size_t valueLen ; char_t separator ; char_t * p ; if ( context == NULL || name == NULL ) return ERROR_INVALID_PARAMETER ; if ( name [ 0 ] == '\\0' ) return ERROR_INVALID_PARAMETER ; if ( context -> requestState!= HTTP_REQ_STATE_FORMAT_HEADER ) return ERROR_WRONG_STATE ; if ( context -> bufferLen > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_INVALID_SYNTAX ; context -> buffer [ context -> bufferLen ] = '\\0' ; <START_BUG> p = strchr ( context -> buffer,' ') ; <END_BUG> if ( p == NULL ) return ERROR_INVALID_SYNTAX ; p = strpbrk ( p + 1, "  ?" ) ; if ( p == NULL ) return ERROR_INVALID_SYNTAX ; if ( * p == '?' ) {  p = strchr ( p + 1,' ') ; <START_BUG> if ( p == NULL ) return ERROR_INVALID_SYNTAX ; separator = '&' ; } else { separator = '?' ; } nameLen = osStrlen ( name ) ; if ( value == NULL ) { if ( ( context -> bufferLen + nameLen + 1 ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; osMemmove ( p + nameLen + 1, p, context -> buffer + context -> bufferLen + 1 - p ) ; p [ 0 ] = separator ; osStrncpy ( p + 1, name, nameLen ) ; context -> bufferLen += nameLen + 1 ; } else { valueLen = osStrlen ( value ) ; if ( ( context -> bufferLen + nameLen + valueLen + 2 ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; osMemmove ( p + nameLen + valueLen + 2, p, context -> buffer + context -> bufferLen + 1 - p ) ; p [ 0 ] = separator ; osStrncpy ( p + 1, name, nameLen ) ; p [ nameLen + 1 ] = '=' ; osStrncpy ( p + nameLen + 2, value, valueLen ) ; context -> bufferLen += nameLen + valueLen + 2 ; } return NO<END_BUG>

Fix:
<S2SV_ModStart> ; p = osStrchr <S2SV_ModEnd> ( context -> <S2SV_ModStart> { p = osStrchr <S2SV_ModEnd> ( p +
Buggy code:
 int read_file ( struct sc_card * card, char * str_path, unsigned char * * data, size_t * data_len ) { struct sc_path path ; struct sc_file * file ; unsigned char * p ; int ok = 0 ; int r ; size_t len ; sc_format_path ( str_path, & path ) ; if ( SC_SUCCESS!= sc_select_file ( card, & path, & file ) ) { goto err ; } <START_BUG> len = file? file -> size : 4096 ; <END_BUG> p = realloc ( * data, len ) ; if (! p ) { goto err ; } * data = p ; * data_len = len ; r = sc_read_binary ( card, 0, p, len, 0 ) ; if ( r < 0 ) goto err ; * data_len = r ; ok = 1 ; err : sc_file_free ( file ) ; return ok ; }

Fix:
<S2SV_ModStart> len = file && file -> size > 0
Buggy code:
 SQLRETURN SQLSetDescFieldW ( SQLHDESC descriptor_handle, SQLSMALLINT rec_number, SQLSMALLINT field_identifier, SQLPOINTER value, SQLINTEGER buffer_length ) { DMHDESC descriptor = ( DMHDESC ) descriptor_handle ; SQLRETURN ret ; SQLCHAR s1 [ 100 + LOG_MESSAGE_LEN ] ; int isStrField = 0 ; if (! __validate_desc ( descriptor ) ) { dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, "Error:   SQL_INVALID_HANDLE" ) ; # ifdef WITH_HANDLE_REDIRECT { DMHDESC parent_desc ; parent_desc = find_parent_handle ( descriptor, SQL_HANDLE_DESC ) ; if ( parent_desc ) { dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, "Info:   found   parent   handle" ) ; if ( CHECK_SQLSETDESCFIELDW ( parent_desc -> connection ) ) { dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, "Info:   calling   redirected   driver   function" ) ; return SQLSETDESCFIELDW ( parent_desc -> connection, descriptor, rec_number, field_identifier, value, buffer_length ) ; } } } # endif return SQL_INVALID_HANDLE ; } function_entry ( descriptor ) ; if ( log_info. log_flag ) { <START_BUG> sprintf ( descriptor -> msg, "\\n\\t\\tEntry:\\\n   \\n\\t\\t\\tDescriptor   =   %p\\\n   \\n\\t\\t\\tRec   Number   =   %d\\\n   \\n\\t\\t\\tField   Ident   =   %s\\\n   \\n\\t\\t\\tValue   =   %p\\\n   \\n\\t\\t\\tBuffer   Length   =   %d", <END_BUG> descriptor, rec_number, __desc_attr_as_string ( s1, field_identifier ), value, ( int ) buffer_length ) ; dm_log_write ( __FILE__, __LINE__, LOG_INFO, LOG_INFO, descriptor -> msg ) ; } thread_protect ( SQL_HANDLE_DESC, descriptor ) ; if ( descriptor

Fix:
<S2SV_ModStart> -> msg, "\\n\\t\\tEntry:\\\n\\n\\t\\t\\tDescriptor <S2SV_blank> = <S2SV_blank> %p\\\n\\n\\t\\t\\tRec <S2SV_blank> Number <S2SV_blank> = <S2SV_blank> %d\\\n\\n\\t\\t\\tField <S2SV_blank> Ident <S2SV_blank> = <S2SV_blank> %s\\\n\\n\\t\\t\\tValue <S2SV_blank> = <S2SV_blank> %p\\\n\\n\\t\\t\\tBuffer <S2SV_blank> Length <S2SV_blank> = <S2SV_blank> %d" <S2SV_ModEnd>, descriptor, <S2SV_ModStart> SQL_DESC_COUNT && ( intptr_t <S2SV_ModEnd> ) value < <S2SV_ModStart> == SQL_DESC_PARAMETER_TYPE && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_INPUT && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_OUTPUT && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_INPUT_OUTPUT && ( intptr_t ) <S2SV_ModStart>!= SQL_PARAM_INPUT_OUTPUT_STREAM && ( intptr_t )
Buggy code:
 static int validate_user_key ( struct fscrypt_info * crypt_info, struct fscrypt_context * ctx, u8 * raw_key, const char * prefix ) { char * description ; struct key * keyring_key ; struct fscrypt_key * master_key ; const struct user_key_payload * ukp ; int res ; description = kasprintf ( GFP_NOFS, "%s%*phN", prefix, FS_KEY_DESCRIPTOR_SIZE, ctx -> master_key_descriptor ) ; if (! description ) return - ENOMEM ; keyring_key = request_key ( & key_type_logon, description, NULL ) ; kfree ( description ) ; if ( IS_ERR ( keyring_key ) ) return PTR_ERR ( keyring_key ) ; <START_BUG> if ( keyring_key -> type!= & key_type_logon ) { <END_BUG> printk_once ( KERN_WARNING "%s:   key   type   must   be   logon\\n", __func__ ) ; res = - ENOKEY ; goto out ; }  down_read ( & keyring_key -> sem ) ; <START_BUG> <END_BUG> ukp = user_key_payload ( keyring_key ) ;  if ( ukp -> datalen!= sizeof ( struct fscrypt_key ) ) { res = - EINVAL ; up_read ( & keyring_key -> sem ) ; goto out ; } master_key = ( struct fscrypt_key * ) ukp -> data ; BUILD_BUG_ON ( FS_AES_128_ECB_KEY_SIZE!= FS_KEY_DERIVATION_NONCE_SIZE ) ; if ( master_key -> size!= FS_AES_256_XTS_KEY_SIZE ) { printk_once ( KERN_WARNING "%s:   key   size   incorrect:   %d\\n", __func__, master_key -> size ) ; res = - ENOKEY ; up_read ( & keyring_key -> sem ) ; goto out ; } res = derive_key_aes ( ctx -> nonce, master_key -> raw, raw_key ) ; up_read ( & keyring_key -> sem ) ; if ( res ) goto out ; crypt_info -> ci_keyring_key = keyring_key ; return 0

Fix:
<S2SV_ModStart> keyring_key ) ; down_read ( & keyring_key -> sem ) ; <S2SV_ModStart> out ; } ukp = user_key_payload ( keyring_key ) ; if ( ukp -> datalen!= sizeof ( struct fscrypt_key ) ) { res = - EINVAL ; goto out ; } master_key = ( struct fscrypt_key * ) ukp -> data ; BUILD_BUG_ON ( FS_AES_128_ECB_KEY_SIZE!= FS_KEY_DERIVATION_NONCE_SIZE ) ; if ( master_key -> size!= FS_AES_256_XTS_KEY_SIZE ) { printk_once ( KERN_WARNING "%s: <S2SV_blank> key <S2SV_blank> size <S2SV_blank> incorrect: <S2SV_blank> %d\\n", __func__, master_key -> size ) ; res = - ENOKEY ; goto out ; } res = derive_key_aes ( ctx -> nonce, master_key -> raw, raw_key ) ; out : up_read <S2SV_ModEnd> ( & keyring_key <S2SV_ModStart> sem ) ; key_put ( keyring_key ) ; return <S2SV_ModEnd> res ; }
Buggy code:
 UWORD16 impeg2d_get_mb_addr_incr ( stream_t * ps_stream ) { UWORD16 u2_mb_addr_incr = 0 ; <START_BUG> while ( impeg2d_bit_stream_nxt ( ps_stream, MB_ESCAPE_CODE_LEN ) == MB_ESCAPE_CODE ) <END_BUG> { impeg2d_bit_stream_flush ( ps_stream, MB_ESCAPE_CODE_LEN ) ; u2_mb_addr_incr += 33 ; } u2_mb_addr_incr += impeg2d_dec_vld_symbol ( ps_stream, gai2_impeg2d_mb_addr_incr, MB_ADDR_INCR_LEN ) + MB_ADDR_INCR_OFFSET ; return ( u2_mb_addr_incr ) ; }

Fix:
<S2SV_ModStart> ) == MB_ESCAPE_CODE && ps_stream -> u4_offset < ps_stream -> u4_max_offset
Buggy code:
 sctp_disposition_t sctp_sf_do_asconf_ack ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * asconf_ack = arg ; struct sctp_chunk * last_asconf = asoc -> addip_last_asconf ; struct sctp_chunk * abort ; struct sctp_paramhdr * err_param = NULL ; sctp_addiphdr_t * addip_hdr ; __u32 sent_serial, rcvd_serial ; if (! sctp_vtag_verify ( asconf_ack, asoc ) ) { sctp_add_cmd_sf ( commands, SCTP_CMD_REPORT_BAD_TAG, SCTP_NULL ( ) ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; } if (! net -> sctp. addip_noauth &&! asconf_ack -> auth ) return sctp_sf_discard_chunk ( net, ep, asoc, type, arg, commands ) ; if (! sctp_chunk_length_valid ( asconf_ack, sizeof ( sctp_addip_chunk_t ) ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ; addip_hdr = ( sctp_addiphdr_t * ) asconf_ack -> skb -> data ; rcvd_serial = ntohl ( addip_hdr -> serial ) ; if (! sctp_verify_asconf ( asoc, <START_BUG> ( sctp_paramhdr_t * ) addip_hdr -> params, <END_BUG> ( void * ) asconf_ack -> chunk_end, & err_param ) ) return sctp_sf_violation_paramlen ( net, ep, asoc, type, arg, ( void * ) err_param, commands ) ; if ( last_asconf ) { addip_hdr = ( sctp_addiphdr_t * ) last_asconf -> subh. addip_hdr ; sent_serial = ntohl ( addip

Fix:
<S2SV_ModStart> ( asoc, asconf_ack, false, <S2SV_ModEnd> & err_param )
Buggy code:
 int bt_sock_stream_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; int err = 0 ; size_t target, copied = 0 ; long timeo ; if ( flags & MSG_OOB ) <START_BUG> return - EOPNOTSUPP ; <END_BUG> msg -> msg_namelen = 0 ; BT_DBG ( "sk   %p   size   %zu", sk, size ) ; lock_sock ( sk ) ; target = sock_rcvlowat ( sk, flags & MSG_WAITALL, size ) ; timeo = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; do { struct sk_buff * skb ; int chunk ; skb = skb_dequeue ( & sk -> sk_receive_queue ) ; if (! skb ) { if ( copied >= target ) break ; err = sock_error ( sk ) ; if ( err ) break ; if ( sk -> sk_shutdown & RCV_SHUTDOWN ) break ; err = - EAGAIN ; if (! timeo ) break ; timeo = bt_sock_data_wait ( sk, timeo ) ; if ( signal_pending ( current ) ) { err = sock_intr_errno ( timeo ) ; goto out ; } continue ; } chunk = min_t ( unsigned int, skb -> len, size ) ; if ( skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, chunk ) ) { skb_queue_head ( & sk -> sk_receive_queue, skb ) ; if (! copied ) copied = - EFAULT ; break ; } copied += chunk ; size -= chunk ; sock_recv_ts_and_drops ( msg, sk, skb ) ; if (! ( flags & MSG_PEEK ) ) { int skb_len = skb_headlen ( skb ) ; if ( chunk <= skb_len ) { __skb_pull ( skb, chunk ) ; } else { struct sk_buff * frag ; __skb_pull ( skb, skb_len ) ; chunk -= skb_len ; skb_walk_frags (

Fix:
<S2SV_ModStart> return - EOPNOTSUPP <S2SV_ModEnd> ; BT_DBG (
Buggy code:
 static vpx_codec_err_t decoder_set_fb_fn ( vpx_codec_alg_priv_t * ctx, vpx_get_frame_buffer_cb_fn_t cb_get, vpx_release_frame_buffer_cb_fn_t cb_release, void * cb_priv ) { if ( cb_get == NULL || cb_release == NULL ) { return VPX_CODEC_INVALID_PARAM ; <START_BUG> } else if ( ctx -> pbi == NULL ) { <END_BUG> ctx -> get_ext_fb_cb = cb_get ; ctx -> release_ext_fb_cb = cb_release ; ctx -> ext_priv = cb_priv ; return VPX_CODEC_OK ; } return VPX_CODEC_ERROR ; }

Fix:
<S2SV_ModStart> ( ctx -> frame_workers <S2SV_ModEnd> == NULL )
Buggy code:
 error_t coapClientWriteBody ( CoapClientRequest * request, const void * data, size_t length, size_t * written, bool_t last ) { error_t error ; size_t n ; uint32_t value ; uint32_t blockPos ; uint32_t blockSzx ; size_t payloadLen ; const uint8_t * payload ; CoapMessage * requestMsg ; CoapMessage * responseMsg ; CoapCode responseCode ; error = NO_ERROR ; if ( written!= NULL ) * written = 0 ; while ( length > 0 || last ) { requestMsg = coapClientGetRequestMessage ( request ) ; error = coapGetUintOption ( requestMsg, COAP_OPT_BLOCK1, 0, & value ) ; if (! error ) { blockPos = COAP_GET_BLOCK_POS ( value ) ; blockSzx = COAP_GET_BLOCK_SZX ( value ) ; } else { blockPos = 0 ; blockSzx = request -> txBlockSzx ; } error = coapClientGetPayload ( requestMsg, & payload, & payloadLen ) ; if ( error ) break ; if ( length > 0 && payloadLen < COAP_GET_BLOCK_SIZE ( blockSzx ) ) { n = MIN ( length, COAP_GET_BLOCK_SIZE ( blockSzx ) - payloadLen ) ; error = coapClientWritePayload ( requestMsg, data, n ) ; if ( error ) break ; data = ( uint8_t * ) data + n ; length -= n ; if ( written!= NULL ) * written += n ; } else { if ( blockPos > 0 || length > 0 ||! last ) { COAP_SET_BLOCK_NUM ( value, blockPos >> ( blockSzx + 4 ) ) ; if ( length == 0 && last ) <START_BUG> COAP_SET_BLOCK_M ( value, 0 ) ; <END_BUG>  else <START_BUG> <END_BUG> COAP_SET_BLOCK_M ( value, 1 ) ;  COAP_SET_BLOCK_SZX ( value, blockSzx ) ; error = coapClientSetUintOption ( requestMsg, COAP_OPT_BLOCK1, 0, value ) ; if ( error ) break ; } if ( length == 0 && last ) { if ( request -> rxBlockSzx

Fix:
<S2SV_ModStart> && last ) { <S2SV_ModStart> 0 ) ; } else { <S2SV_ModEnd> COAP_SET_BLOCK_M ( value <S2SV_ModStart> 1 ) ; }
Buggy code:
 static int acp_hw_init ( void * handle ) { int r, i ; uint64_t acp_base ; u32 val = 0 ; u32 count = 0 ; struct device * dev ; <START_BUG> struct i2s_platform_data * i2s_pdata ; <END_BUG> struct amdgpu_device * adev = ( struct amdgpu_device * ) handle ; const struct amdgpu_ip_block * ip_block = amdgpu_device_ip_get_ip_block ( adev, AMD_IP_BLOCK_TYPE_ACP ) ; if (! ip_block ) return - EINVAL ; r = amd_acp_hw_init ( adev -> acp. cgs_device, ip_block -> version -> major, ip_block -> version -> minor ) ; if ( r == - ENODEV ) { amdgpu_dpm_set_powergating_by_smu ( adev, AMD_IP_BLOCK_TYPE_ACP, true ) ; return 0 ; } else if ( r ) { return r ; } if ( adev -> rmmio_size == 0 || adev -> rmmio_size < 0x5289 ) return - EINVAL ; acp_base = adev -> rmmio_base ; adev -> acp. acp_genpd = kzalloc ( sizeof ( struct acp_pm_domain ), GFP_KERNEL ) ; if ( adev -> acp. acp_genpd == NULL ) return - ENOMEM ; adev -> acp. acp_genpd -> gpd. name = "ACP_AUDIO" ; adev -> acp. acp_genpd -> gpd. power_off = acp_poweroff ; adev -> acp. acp_genpd -> gpd. power_on = acp_poweron ; adev -> acp. acp_genpd -> adev = adev ; pm_genpd_init ( & adev -> acp. acp_genpd -> gpd, NULL, false ) ; adev -> acp. acp_cell = kcalloc ( ACP_DEVS, sizeof ( struct mfd_cell ), GFP_KERNEL ) ; if

Fix:
<S2SV_ModStart> i2s_platform_data * i2s_pdata = NULL <S2SV_ModStart> == NULL ) { r = <S2SV_ModEnd> - ENOMEM ; <S2SV_ModStart> - ENOMEM ; goto failure ; } <S2SV_ModStart> NULL ) { r = <S2SV_ModEnd> - ENOMEM ; <S2SV_ModStart> - ENOMEM ; goto failure ; <S2SV_ModStart> NULL ) { r = - ENOMEM ; goto failure <S2SV_ModEnd> ; } switch <S2SV_ModStart> ( r ) goto failure <S2SV_ModEnd> ; for ( <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> add <S2SV_blank> dev <S2SV_blank> to <S2SV_blank> genpd\\n" ) ; goto failure <S2SV_ModEnd> ; } } <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> reset <S2SV_blank> ACP\\n" ) ; r = - ETIMEDOUT ; goto failure <S2SV_ModEnd> ; } udelay <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> reset <S2SV_blank> ACP\\n" ) ; r = - ETIMEDOUT ; goto failure <S2SV_ModEnd> ; } udelay <S2SV_ModStart> return 0 ; failure : kfree ( i2s_pdata ) ; kfree ( adev -> acp. acp_res ) ; kfree ( adev -> acp. acp_cell ) ; kfree ( adev -> acp. acp_genpd ) ; return r ;
Buggy code:
 static int smb_send_kvec ( struct TCP_Server_Info * server, struct kvec * iov, size_t n_vec, size_t * sent ) { int rc = 0 ; int i = 0 ; struct msghdr smb_msg ; unsigned int remaining ; size_t first_vec = 0 ; struct socket * ssocket = server -> ssocket ; <START_BUG> * sent = 0 ; <END_BUG> if ( ssocket == NULL ) return - ENOTSOCK ; smb_msg. msg_name = ( struct sockaddr * ) & server -> dstaddr ; smb_msg. msg_namelen = sizeof ( struct sockaddr ) ; smb_msg. msg_control = NULL ; smb_msg. msg_controllen = 0 ; if ( server -> noblocksnd ) smb_msg. msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL ; else smb_msg. msg_flags = MSG_NOSIGNAL ; remaining = 0 ; for ( i = 0 ; i < n_vec ; i ++ ) remaining += iov [ i ]. iov_len ; i = 0 ; while ( remaining ) { rc = kernel_sendmsg ( ssocket, & smb_msg, & iov [ first_vec ], n_vec - first_vec, remaining ) ; if ( rc == - ENOSPC || rc == - EAGAIN ) { WARN_ON_ONCE ( rc == - ENOSPC ) ; i ++ ; if ( i >= 14 || (! server -> noblocksnd && ( i > 2 ) ) ) { cERROR ( 1, "sends   on   sock   %p   stuck   for   15   " "seconds", ssocket ) ; rc = - EAGAIN ; break ; } msleep ( 1 << i ) ; continue ; } if ( rc < 0 ) break ; * sent += rc ; if ( rc == remaining ) { remaining = 0 ; break ; } if ( rc > remaining ) { cERROR ( 1, "sent   %d   requested   %d", rc, remaining ) ; break ; } if ( rc == 0 ) { cERROR ( 1, "tcp   sent   no   data" ) ; msleep ( 500 ) ; continue ; } remaining -= rc ; for ( i = first_vec ; i < n

Fix:
<S2SV_ModStart> sent = 0 <S2SV_ModEnd> ; smb_msg.
Buggy code:
 static int snd_ctl_elem_write ( struct snd_card * card, struct snd_ctl_file * file, struct snd_ctl_elem_value * control ) { struct snd_kcontrol * kctl ; struct snd_kcontrol_volatile * vd ; unsigned int index_offset ; int result ; down_read ( & card -> controls_rwsem ) ; kctl = snd_ctl_find_id ( card, & control -> id ) ; if ( kctl == NULL ) { result = - ENOENT ; } else { index_offset = snd_ctl_get_ioff ( kctl, & control -> id ) ; vd = & kctl -> vd [ index_offset ] ; if (! ( vd -> access & SNDRV_CTL_ELEM_ACCESS_WRITE ) || kctl -> put == NULL || ( file && vd -> owner && vd -> owner!= file ) ) { result = - EPERM ; } else { snd_ctl_build_ioff ( & control -> id, kctl, index_offset ) ; result = kctl -> put ( kctl, control ) ; } if ( result > 0 ) { <START_BUG> up_read ( & card -> controls_rwsem ) ; <END_BUG> snd_ctl_notify ( card, SNDRV_CTL_EVENT_MASK_VALUE,  & control -> id ) ; <START_BUG> return 0 ; } } up_read ( & card -> controls_rwsem ) ; return result ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { struct snd_ctl_elem_id id = control -> id ; <S2SV_ModStart>, SNDRV_CTL_EVENT_MASK_VALUE, & <S2SV_ModEnd> id ) ;
Buggy code:
 static vpx_codec_err_t ctrl_copy_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> vpx_ref_frame_t * const frame = va_arg ( args, vpx_ref_frame_t * ) ; if ( frame!= NULL ) { YV12_BUFFER_CONFIG sd ; image2yuvconfig ( & frame -> img, & sd ) ; vp9_copy_reference_enc ( ctx -> cpi, ref_frame_to_vp9_reframe ( frame -> frame_type ), & sd ) ; return VPX_CODEC_OK ; } else { return VPX_CODEC_INVALID_PARAM ; } }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )
Buggy code:
 static gchar * read_file ( gchar * filepath ) { FILE * f ; size_t length ; gchar * ret = NULL ; <START_BUG> f = fopen ( filepath, "rb" ) ; <END_BUG> if ( f ) { fseek ( f, 0, SEEK_END ) ; length = ( size_t ) ftell ( f ) ; fseek ( f, 0, SEEK_SET ) ; ret = MALLOC ( length + 1 ) ; if ( ret ) { if ( fread ( ret, length, 1, f )!= 1 ) { log_message ( LOG_INFO, "Failed   to   read   all   of   %s", filepath ) ; } ret [ length ] = '\\0' ; } else log_message ( LOG_INFO, "Unable   to   read   Dbus   file   %s", filepath ) ; fclose ( f ) ; } return ret ; }

Fix:
<S2SV_ModStart> ( filepath, "r" <S2SV_ModEnd> ) ; if
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; MATLAB_HDR. Version = ReadBlobLSBShort ( image ) ; if ( ReadBlob ( image, 2, ( unsigned char * ) & MATLAB_HDR. EndianIndicator )!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( logging ) ( void ) LogMagickEvent ( C

Fix:
<S2SV_ModStart> 2 ) ; quantum_info = DestroyQuantumInfo ( quantum_info ) ;
Buggy code:
 static void set_roi_map ( const vpx_codec_enc_cfg_t * cfg, vpx_codec_ctx_t * codec ) { unsigned int i ; <START_BUG> vpx_roi_map_t roi = { 0 } ; <END_BUG> roi. rows = ( cfg -> g_h + 15 ) // 16 ; roi. cols = ( cfg -> g_w + 15 ) // 16 ; roi. delta_q [ 0 ] = 0 ; roi. delta_q [ 1 ] = - 2 ; roi. delta_q [ 2 ] = - 4 ; roi. delta_q [ 3 ] = - 6 ; roi. delta_lf [ 0 ] = 0 ; roi. delta_lf [ 1 ] = 1 ; roi. delta_lf [ 2 ] = 2 ; roi. delta_lf [ 3 ] = 3 ; roi. static_threshold [ 0 ] = 1500 ; roi. static_threshold [ 1 ] = 1000 ; roi. static_threshold [ 2 ] = 500 ; roi. static_threshold [ 3 ] = 0 ; roi. roi_map = ( uint8_t * ) malloc ( roi. rows * roi. cols ) ; for ( i = 0 ; i < roi. rows * roi. cols ; ++ i ) roi. roi_map [ i ] = i % 4 ; if ( vpx_codec_control ( codec, VP8E_SET_ROI_MAP, & roi ) ) die_codec ( codec, "Failed   to   set   ROI   map" ) ; free ( roi. roi_map ) ; }

Fix:
<S2SV_ModStart> ; vpx_roi_map_t roi ; memset ( & roi, 0, sizeof ( roi ) ) <S2SV_ModEnd> ; roi.
Buggy code:
 static void dtls1_clear_queues ( SSL * s ) { pitem * item = NULL ; hm_fragment * frag = NULL ; DTLS1_RECORD_DATA * rdata ; while ( ( item = pqueue_pop ( s -> d1 -> unprocessed_rcds. q ) )!= NULL ) { rdata = ( DTLS1_RECORD_DATA * ) item -> data ; if ( rdata -> rbuf. buf ) { OPENSSL_free ( rdata -> rbuf. buf ) ; } OPENSSL_free ( item -> data ) ; pitem_free ( item ) ; } while ( ( item = pqueue_pop ( s -> d1 -> processed_rcds. q ) )!= NULL ) { rdata = ( DTLS1_RECORD_DATA * ) item -> data ; if ( rdata -> rbuf. buf ) { OPENSSL_free ( rdata -> rbuf. buf ) ; } OPENSSL_free ( item -> data ) ; pitem_free ( item ) ; } while ( ( item = pqueue_pop ( s -> d1 -> buffered_messages ) )!= NULL ) { frag = ( hm_fragment * ) item -> data ; OPENSSL_free ( frag -> fragment ) ; OPENSSL_free ( frag ) ; pitem_free ( item ) ; } while ( ( item = pqueue_pop ( s -> d1 -> sent_messages ) )!= NULL ) { frag = ( hm_fragment * ) item -> data ; OPENSSL_free ( frag -> fragment ) ; OPENSSL_free ( frag ) ; pitem_free ( item ) ; } while ( ( item = pqueue_pop ( s -> d1 -> buffered_app_data. q ) )!= NULL ) { <START_BUG> frag = ( hm_fragment * ) item -> data ; <END_BUG> OPENSSL_free ( frag -> fragment ) ; OPENSSL_free ( frag ) ; pitem_free ( item ) ; } }

Fix:
<S2SV_ModStart> NULL ) { rdata = ( DTLS1_RECORD_DATA * ) item -> data ; if ( rdata -> rbuf. buf ) { OPENSSL_free ( rdata -> rbuf. buf ) ; } OPENSSL_free ( item -> data <S2SV_ModEnd> ) ; pitem_free
Buggy code:
 static int pcrypt_create_aead ( struct crypto_template * tmpl, struct rtattr * * tb, u32 type, u32 mask ) { struct pcrypt_instance_ctx * ctx ; struct crypto_attr_type * algt ; struct aead_instance * inst ; struct aead_alg * alg ; const char * name ; int err ; algt = crypto_get_attr_type ( tb ) ; if ( IS_ERR ( algt ) ) return PTR_ERR ( algt ) ; name = crypto_attr_alg_name ( tb [ 1 ] ) ; if ( IS_ERR ( name ) ) return PTR_ERR ( name ) ; inst = kzalloc ( sizeof ( * inst ) + sizeof ( * ctx ), GFP_KERNEL ) ; if (! inst ) return - ENOMEM ; ctx = aead_instance_ctx ( inst ) ; crypto_set_aead_spawn ( & ctx -> spawn, aead_crypto_instance ( inst ) ) ; err = crypto_grab_aead ( & ctx -> spawn, name, 0, 0 ) ; if ( err ) goto out_free_inst ; alg = crypto_spawn_aead_alg ( & ctx -> spawn ) ; err = pcrypt_init_instance ( aead_crypto_instance ( inst ), & alg -> base ) ; if ( err ) goto out_drop_aead ; inst -> alg. base. cra_flags = CRYPTO_ALG_ASYNC ; inst -> alg. ivsize = crypto_aead_alg_ivsize ( alg ) ; inst -> alg. maxauthsize = crypto_aead_alg_maxauthsize ( alg ) ; inst -> alg. base. cra_ctxsize = sizeof ( struct pcrypt_aead_ctx ) ; inst -> alg. init = pcrypt_aead_init_tfm ; inst -> alg. exit = pcrypt_aead_exit_tfm ; inst -> alg. setkey = pcrypt_aead_setkey ; inst -> alg. setauthsize = pcrypt_aead_setauthsize ; inst -> alg. encrypt = pcrypt_aead_encrypt ; inst -> alg. decrypt = pcrypt_aead_decrypt ; <START_BUG> err = aead_register_instance ( tmpl, inst ) ; <END_BUG>

Fix:
<S2SV_ModStart> = pcrypt_aead_decrypt ; inst -> free = pcrypt_free ;
Buggy code:
 static bool parse_reconnect ( struct pool * pool, json_t * val ) { <START_BUG> char * sockaddr_url, * stratum_port, * tmp ; <END_BUG> char * url, * port, address [ 256 ] ;  if ( opt_disable_client_reconnect ) { <START_BUG> applog ( LOG_WARNING, "Stratum   client.reconnect   forbidden,   aborting." ) ; return false ; } memset ( address, 0, 255 ) ; <END_BUG> url = ( char * ) json_string_value ( json_array_get ( val, 0 ) ) ;  if (! url ) url = pool -> sockaddr_url ; port = ( char * ) json_string_value ( json_array_get ( val, 1 ) ) ; if (! port ) port = pool -> stratum_port ; <START_BUG> sprintf ( address, "%s:%s", url, port ) ; <END_BUG> if (! extract_sockaddr ( address, & sockaddr_url, & stratum_port ) ) return false ; applog ( LOG_NOTICE, "Reconnect   requested   from   %s   to   %s", get_pool_name ( pool ), address ) ; clear_pool_work ( pool ) ; mutex_lock ( & pool -> stratum_lock ) ; __suspend_stratum ( pool ) ; tmp = pool -> sockaddr_url ; pool -> sockaddr_url = sockaddr_url ; pool -> stratum_url = pool -> sockaddr_url ; free ( tmp ) ; tmp = pool -> stratum_port ; pool -> stratum_port = stratum_port ; free ( tmp ) ; mutex_unlock ( & pool -> stratum_lock ) ; if (! restart_stratum ( pool ) ) { pool_failed ( pool ) ; return false ; } return true ; }

Fix:
<S2SV_ModStart> val ) { if ( opt_disable_client_reconnect ) { applog ( LOG_WARNING, "Stratum <S2SV_blank> client.reconnect <S2SV_blank> received <S2SV_blank> but <S2SV_blank> is <S2SV_blank> disabled, <S2SV_blank> not <S2SV_blank> reconnecting." ) ; return false ; } <S2SV_ModEnd> char * url <S2SV_ModStart> 256 ] ; char * sockaddr_url, * stratum_port, * tmp ; url = ( char * ) json_string_value ( json_array_get ( val, 0 ) ) ; if (! url ) url = pool -> sockaddr_url ; port <S2SV_ModEnd> = ( char <S2SV_ModStart> ( val, <S2SV_ModEnd> 1 ) ) <S2SV_ModStart> -> stratum_port ; snprintf ( address, sizeof ( address ) <S2SV_ModEnd>, "%s:%s",
Buggy code:
 static VALUE ossl_cipher_update ( int argc, VALUE * argv, VALUE self ) { EVP_CIPHER_CTX * ctx ; unsigned char * in ; long in_len, out_len ; VALUE data, str ; rb_scan_args ( argc, argv, "11", & data, & str ) ; <START_BUG> StringValue ( data ) ; <END_BUG> in = ( unsigned char * ) RSTRING_PTR ( data ) ; if ( ( in_len = RSTRING_LEN ( data ) ) == 0 ) ossl_raise ( rb_eArgError, "data   must   not   be   empty" ) ; GetCipher ( self, ctx ) ; out_len = in_len + EVP_CIPHER_CTX_block_size ( ctx ) ; if ( out_len <= 0 ) { ossl_raise ( rb_eRangeError, "data   too   big   to   make   output   buffer:   %ld   bytes", in_len ) ; } if ( NIL_P ( str ) ) { str = rb_str_new ( 0, out_len ) ; } else { StringValue ( str ) ; rb_str_resize ( str, out_len ) ; } if (! ossl_cipher_update_long ( ctx, ( unsigned char * ) RSTRING_PTR ( str ), & out_len, in, in_len ) ) ossl_raise ( eCipherError, NULL ) ; assert ( out_len < RSTRING_LEN ( str ) ) ; rb_str_set_len ( str, out_len ) ; return str ; }

Fix:
<S2SV_ModStart> str ) ; if (! RTEST ( rb_attr_get ( self, id_key_set ) ) ) ossl_raise ( eCipherError, "key <S2SV_blank> not <S2SV_blank> set" ) ;
Buggy code:
 static int PredictorEncodeTile ( TIFF * tif, uint8 * bp0, tmsize_t cc0, uint16 s ) { static const char module [ ] = "PredictorEncodeTile" ; TIFFPredictorState * sp = PredictorState ( tif ) ; uint8 * working_copy ; tmsize_t cc = cc0, rowsize ; unsigned char * bp ; int result_code ; assert ( sp!= NULL ) ; assert ( sp -> encodepfunc!= NULL ) ; assert ( sp -> encodetile!= NULL ) ; working_copy = ( uint8 * ) _TIFFmalloc ( cc0 ) ; if ( working_copy == NULL ) { TIFFErrorExt ( tif -> tif_clientdata, module, "Out   of   memory   allocating   " TIFF_SSIZE_FORMAT "   byte   temp   buffer.", cc0 ) ; return 0 ; } memcpy ( working_copy, bp0, cc0 ) ; bp = working_copy ; rowsize = sp -> rowsize ; assert ( rowsize > 0 ) ; if ( ( cc0 % rowsize )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "PredictorEncodeTile", "%s", "(cc0%rowsize)!=0" ) ; <START_BUG> return 0 ; <END_BUG> } while ( cc > 0 ) { ( * sp -> encodepfunc ) ( tif, bp, rowsize ) ; cc -= rowsize ; bp += rowsize ; } result_code = ( * sp -> encodetile ) ( tif, working_copy, cc0, s ) ; _TIFFfree ( working_copy ) ; return result_code ; }

Fix:
<S2SV_ModStart> "(cc0%rowsize)!=0" ) ; _TIFFfree ( working_copy ) ;
Buggy code:
 int main ( int argc, char * * argv ) { if (! parse_args ( argc, argv ) ) { usage ( argv [ 0 ] ) ; } if ( bond && discoverable ) { fprintf ( stderr, "Can   only   select   either   bond   or   discoverable,   not   both\\n" ) ; usage ( argv [ 0 ] ) ; } if ( sco_listen && sco_connect ) { fprintf ( stderr, "Can   only   select   either   sco_listen   or   sco_connect,   not   both\\n" ) ; usage ( argv [ 0 ] ) ; } if (! bond &&! discover &&! discoverable &&! up &&! get_name &&! set_name &&! sco_listen &&! sco_connect ) { fprintf ( stderr, "Must   specify   one   command\\n" ) ; usage ( argv [ 0 ] ) ; } if ( signal ( SIGINT, sig_handler ) == SIG_ERR ) { fprintf ( stderr, "Will   be   unable   to   catch   signals\\n" ) ; } fprintf ( stdout, "Bringing   up   bluetooth   adapter\\n" ) ; if (! hal_open ( callbacks_get_adapter_struct ( ) ) ) { fprintf ( stderr, "Unable   to   open   Bluetooth   HAL.\\n" ) ; return 1 ; } if ( discover ) { <START_BUG> CALL_AND_WAIT ( bt_interface -> enable ( ), adapter_state_changed ) ; <END_BUG> fprintf ( stdout, "BT   adapter   is   up\\n" ) ; fprintf ( stdout, "Starting   to   start   discovery\\n" ) ; CALL_AND_WAIT ( bt_interface -> start_discovery ( ), discovery_state_changed ) ; fprintf ( stdout, "Started   discovery   for   %d   seconds\\n", timeout_in_sec ) ; sleep ( timeout_in_sec ) ; fprintf ( stdout, "Starting   to   cancel   discovery\\n" ) ; CALL_AND_WAIT ( bt_interface -> cancel_discovery ( ), discovery_state_changed ) ; fprintf ( stdout, "Cancelled   discovery   after   %d   seconds\\n", timeout_in_sec ) ; } if ( discover

Fix:
<S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false <S2SV_ModStart> -> enable ( false
Buggy code:
 void CLASS identify ( ) { static const short pana [ ] [ 6 ] = { { 3130, 1743, 4, 0, - 6, 0 }, { 3130, 2055, 4, 0, - 6, 0 }, { 3130, 2319, 4, 0, - 6, 0 }, { 3170, 2103, 18, 0, - 42, 20 }, { 3170, 2367, 18, 13, - 42, - 21 }, { 3177, 2367, 0, 0, - 1, 0 }, { 3304, 2458, 0, 0, - 1, 0 }, { 3330, 2463, 9, 0, - 5, 0 }, { 3330, 2479, 9, 0, - 17, 4 }, { 3370, 1899, 15, 0, - 44, 20 }, { 3370, 2235, 15, 0, - 44, 20 }, { 3370, 2511, 15, 10, - 44, - 21 }, { 3690, 2751, 3, 0, - 8, - 3 }, { 3710, 2751, 0, 0, - 3, 0 }, { 3724, 2450, 0, 0, 0, - 2 }, { 3770, 2487, 17, 0, - 44, 19 }, { 3770, 2799, 17, 15, - 44, - 19 }, { 3880, 2170, 6, 0, - 6, 0 }, { 4060, 3018, 0, 0, 0, - 2 }, { 4290, 2391, 3, 0, - 8, - 1 }, { 4330, 2439, 17, 15, - 44, - 19 }, { 4508, 2962, 0, 0, - 3, - 4 }, { 4508, 3330, 0, 0, - 3, - 6 }, } ; static const ushort canon [ ] [ 11 ] = { { 1944, 1416, 0, 0, 48, 0 }, { 2144, 1560, 4, 8, 52, 2, 0, 0, 0, 25 }, { 2224, 1456, 48, 6, 0, 2 }, { 2

Fix:
<S2SV_ModStart> "Quicktake" ) ; # ifdef LIBRAW_LIBRARY_BUILD if ( fuji_width &&! dng_version &&! ( imgdata. process_warnings & LIBRAW_WARN_PARSEFUJI_PROCESSED ) ) fuji_width = 0 ; # endif
Buggy code:
 int do_mathemu ( struct pt_regs * regs, struct fpustate * f ) { unsigned long pc = regs -> tpc ; unsigned long tstate = regs -> tstate ; u32 insn = 0 ; int type = 0 ; # define TYPE ( ftt, r, ru, b, bu, a, au ) type = ( au << 2 ) | ( a << 0 ) | ( bu << 5 ) | ( b << 3 ) | ( ru << 8 ) | ( r << 6 ) | ( ftt << 9 ) int freg ; static u64 zero [ 2 ] = { 0L, 0L } ; int flags ; FP_DECL_EX ; FP_DECL_S ( SA ) ; FP_DECL_S ( SB ) ; FP_DECL_S ( SR ) ; FP_DECL_D ( DA ) ; FP_DECL_D ( DB ) ; FP_DECL_D ( DR ) ; FP_DECL_Q ( QA ) ; FP_DECL_Q ( QB ) ; FP_DECL_Q ( QR ) ; int IR ; long XR, xfsr ; if ( tstate & TSTATE_PRIV ) die_if_kernel ( "unfinished//unimplemented   FPop   from   kernel", regs ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> if ( test_thread_flag ( TIF_32BIT ) ) pc = ( u32 ) pc ; if ( get_user ( insn, ( u32 __user * ) pc )!= - EFAULT ) { if ( ( insn & 0xc1f80000 ) == 0x81a00000 ) { switch ( ( insn >> 5 ) & 0x1ff ) { case FMOVQ : case FNEGQ : case FABSQ : TYPE ( 3, 3, 0, 3, 0, 0, 0 ) ; break ; case FSQRTQ : TYPE ( 3, 3, 1, 3, 1, 0, 0 ) ; break ; case FADDQ : case FSUBQ : case FMULQ : case FDIVQ : TYPE ( 3, 3, 1, 3, 1, 3, 1 ) ; break ; case FDMULQ : TYPE ( 3, 3, 1, 2, 1, 2

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 char * selaGetCombName ( SELA * sela, l_int32 size, l_int32 direction ) { char * selname ; <START_BUG> char combname [ L_BUF_SIZE ] ; <END_BUG> l_int32 i, nsels, sx, sy, found ; SEL * sel ; PROCNAME ( "selaGetCombName" ) ; if (! sela ) return ( char * ) ERROR_PTR ( "sela   not   defined", procName, NULL ) ; if ( direction!= L_HORIZ && direction!= L_VERT ) return ( char * ) ERROR_PTR ( "invalid   direction", procName, NULL ) ; if ( direction == L_HORIZ )  snprintf ( combname, L_BUF_SIZE, "sel_comb_%dh", size ) ; <START_BUG> else <END_BUG> snprintf ( combname, L_BUF_SIZE, "sel_comb_%dv", size ) ;  found = FALSE ; nsels = selaGetCount ( sela ) ; for ( i = 0 ; i < nsels ; i ++ ) { sel = selaGetSel ( sela, i ) ; selGetParameters ( sel, & sy, & sx, NULL, NULL ) ; if ( sy!= 1 && sx!= 1 ) continue ; selname = selGetName ( sel ) ; if (! strcmp ( selname, combname ) ) { found = TRUE ; break ; } } if ( found ) return stringNew ( selname ) ; else return ( char * ) ERROR_PTR ( "sel   not   found", procName, NULL ) ; }

Fix:
<S2SV_ModStart> char combname [ L_BUFSIZE <S2SV_ModEnd> ] ; l_int32 <S2SV_ModStart> ( combname, L_BUFSIZE <S2SV_ModEnd>, "sel_comb_%dh", <S2SV_ModStart> ( combname, L_BUFSIZE <S2SV_ModEnd>, "sel_comb_%dv",
Buggy code:
 struct lldpd_mgmt * lldpd_alloc_mgmt ( int family, void * addrptr, size_t addrsize, u_int32_t iface ) { struct lldpd_mgmt * mgmt ; log_debug ( "alloc", "allocate   a   new   management   address   (family:   %d)", family ) ; if ( family <= LLDPD_AF_UNSPEC || family >= LLDPD_AF_LAST ) { errno = EAFNOSUPPORT ; return NULL ; } if ( addrsize > LLDPD_MGMT_MAXADDRSIZE ) { errno = EOVERFLOW ; return NULL ; } mgmt = calloc ( 1, sizeof ( struct lldpd_mgmt ) ) ; if ( mgmt == NULL ) { errno = ENOMEM ; return NULL ; } mgmt -> m_family = family ; <START_BUG> assert ( addrsize <= LLDPD_MGMT_MAXADDRSIZE ) ; <END_BUG> memcpy ( & mgmt -> m_addr, addrptr, addrsize ) ; mgmt -> m_addrsize = addrsize ; mgmt -> m_iface = iface ; return mgmt ; }

Fix:
<S2SV_ModStart> = family ; <S2SV_ModEnd> memcpy ( &
Buggy code:
 <START_BUG> static const char * parse_value ( cJSON * item, const char * value ) <END_BUG> { if (! value ) return 0 ; if (! strncmp ( value, "null", 4 ) ) { item -> type = cJSON_NULL ; return value + 4 ; } if (! strncmp ( value, "false", 5 ) ) { item -> type = cJSON_False ; return value + 5 ; } if (! strncmp ( value, "true", 4 ) ) { item -> type = cJSON_True ; item -> valueint = 1 ; return value + 4 ; } if ( * value == \'\\"\' )  return parse_string ( item, value ) ; <START_BUG> if ( * value == '-' || ( * value >= '0' && * value <= '9' ) ) <END_BUG> return parse_number ( item, value ) ;  if ( * value == '[' ) <START_BUG> return parse_array ( item, value ) ; <END_BUG> if ( * value == '{' )  return parse_object ( item, value ) ; <START_BUG> ep = value ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> char * value, const char * * ep ) { if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> == \'\\"\' ) { <S2SV_ModStart> item, value, ep ) ; } <S2SV_ModEnd> if ( * <S2SV_ModStart> '9' ) ) { <S2SV_ModStart> value ) ; } <S2SV_ModStart> == '[' ) { <S2SV_ModStart> item, value, ep ) ; } <S2SV_ModEnd> if ( * <S2SV_ModStart> == '{' ) { <S2SV_ModStart> item, value, ep ) ; } * ep = value ; <S2SV_ModEnd> return 0 ;
Buggy code:
 EXTERN SV * decode_entities ( pTHX_ SV * sv, HV * entity2char, bool expand_prefix ) { STRLEN len ; char * s = SvPV_force ( sv, len ) ; char * t = s ; char * end = s + len ; char * ent_start ; char * repl ; STRLEN repl_len ; # ifdef UNICODE_HTML_PARSER char buf [ UTF8_MAXLEN ] ; int repl_utf8 ; int high_surrogate = 0 ; # else char buf [ 1 ] ; # endif # if defined ( __GNUC__ ) && defined ( UNICODE_HTML_PARSER ) repl_utf8 = 0 ; # endif while ( s < end ) { assert ( t <= s ) ; if ( ( * t ++ = * s ++ )!= '&' ) continue ; ent_start = s ; repl = 0 ; <START_BUG> if ( * s == '#' ) { <END_BUG> UV num = 0 ; UV prev = 0 ; int ok = 0 ; s ++ ;  if ( * s == 'x' || * s == 'X' ) { <START_BUG> s ++ ; <END_BUG> while ( * s ) {  char * tmp = strchr ( PL_hexdigit, * s ) ; if (! tmp ) break ; num = num << 4 | ( ( tmp - PL_hexdigit ) & 15 ) ; if ( prev && num <= prev ) { ok = 0 ; break ; } prev = num ; s ++ ; ok = 1 ; } } else { <START_BUG> while ( isDIGIT ( * s ) ) { <END_BUG> num = num * 10 + ( * s - '0' ) ; if ( prev && num < prev ) { ok = 0 ; break ; } prev = num ; s ++ ; ok = 1 ; } } if ( ok ) { # ifdef UNICODE_HTML_PARSER if (! SvUTF8 ( sv ) && num <= 255 ) { buf [ 0 ] = ( char ) num ; repl = buf ; repl_len = 1 ; repl_utf8 = 0 ; } else { char * tmp ; if ( ( num & 0xFFFFFC00 ) == 0xDC00 ) { if ( high_surrogate!= 0 ) { t -= 3 ; num = ( ( high_surrogate - 0xD800 ) << 10 ) + ( num - 0xDC00 ) + 0x10000 ; high_sur

Fix:
<S2SV_ModStart> ; if ( s < end && <S2SV_ModStart> ++ ; if ( s < end && <S2SV_ModStart> == 'X' ) ) <S2SV_ModStart> ; while ( s < end <S2SV_ModEnd> ) { char <S2SV_ModStart> { while ( s < end && <S2SV_ModStart> ; while ( s < end && <S2SV_ModStart> ; if ( s < end &&
Buggy code:
 qboolean S_AL_Init ( soundInterface_t * si ) { # ifdef USE_OPENAL const char * device = NULL ; const char * inputdevice = NULL ; int i ; if (! si ) { return qfalse ; } for ( i = 0 ; i < MAX_RAW_STREAMS ; i ++ ) { streamSourceHandles [ i ] = - 1 ; streamPlaying [ i ] = qfalse ; streamSources [ i ] = 0 ; streamNumBuffers [ i ] = 0 ; streamBufIndex [ i ] = 0 ; } s_alPrecache = Cvar_Get ( "s_alPrecache", "1", CVAR_ARCHIVE ) ; s_alGain = Cvar_Get ( "s_alGain", "1.0", CVAR_ARCHIVE ) ; s_alSources = Cvar_Get ( "s_alSources", "128", CVAR_ARCHIVE ) ; s_alDopplerFactor = Cvar_Get ( "s_alDopplerFactor", "1.0", CVAR_ARCHIVE ) ; s_alDopplerSpeed = Cvar_Get ( "s_alDopplerSpeed", "9000", CVAR_ARCHIVE ) ; s_alMinDistance = Cvar_Get ( "s_alMinDistance", "256", CVAR_ARCHIVE ) ; s_alMaxDistance = Cvar_Get ( "s_alMaxDistance", "1024", CVAR_ARCHIVE ) ; s_alRolloff = Cvar_Get ( "s_alRolloff", "1.3", CVAR_ARCHIVE ) ; s_alGraceDistance = Cvar_Get ( "s_alGraceDistance", "512", CVAR_ARCHIVE ) ; s_alTalkAnims = Cvar_Get ( "s_alTalkAnims", "160", CVAR_ARCHIVE ) ; <START_BUG> s_alDriver = Cvar_Get ( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH ) ; <END_BUG> s_alInputDevice = Cvar_Get ( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_L

Fix:
<S2SV_ModStart> CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED <S2SV_ModStart> CVAR_LATCH ) ; if ( COM_CompareExtension ( s_alDriver -> string, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", s_alDriver -> string ) ; return qfalse ; }
Buggy code:
 uint32_t * GetPayload ( size_t handle, uint32_t * lastpayload, uint32_t index ) { mp4object * mp4 = ( mp4object * ) handle ; if ( mp4 == NULL ) return NULL ; uint32_t * MP4buffer = NULL ; if ( index < mp4 -> indexcount && mp4 -> mediafp ) { MP4buffer = ( uint32_t * ) realloc ( ( void * ) lastpayload, mp4 -> metasizes [ index ] ) ; if ( MP4buffer ) { <START_BUG> LONGSEEK ( mp4 -> mediafp, mp4 -> metaoffsets [ index ], SEEK_SET ) ; <END_BUG> fread ( MP4buffer, 1, mp4 -> metasizes [ index ], mp4 -> mediafp ) ;  return MP4buffer ; <START_BUG> } } return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> MP4buffer ) { if ( mp4 -> filesize > mp4 -> metaoffsets [ index ] + mp4 -> metasizes [ index ] ) { <S2SV_ModStart> mediafp ) ; mp4 -> filepos = mp4 -> metaoffsets [ index ] + mp4 -> metasizes [ index ] ; <S2SV_ModStart> return MP4buffer ; }
Buggy code:
 static void _prolog_error ( batch_job_launch_msg_t * req, int rc ) { char * err_name_ptr, err_name [ 256 ], path_name [ MAXPATHLEN ] ; char * fmt_char ; int fd ; if ( req -> std_err || req -> std_out ) { if ( req -> std_err ) strncpy ( err_name, req -> std_err, sizeof ( err_name ) ) ; else strncpy ( err_name, req -> std_out, sizeof ( err_name ) ) ; if ( ( fmt_char = strchr ( err_name, ( int ) '%' ) ) && ( fmt_char [ 1 ] == 'j' ) &&! strchr ( fmt_char + 1, ( int ) '%' ) ) { char tmp_name [ 256 ] ; fmt_char [ 1 ] = 'u' ; snprintf ( tmp_name, sizeof ( tmp_name ), err_name, req -> job_id ) ; strncpy ( err_name, tmp_name, sizeof ( err_name ) ) ; } } else { snprintf ( err_name, sizeof ( err_name ), "slurm-%u.out", req -> job_id ) ; } err_name_ptr = err_name ; if ( err_name_ptr [ 0 ] == '//' ) snprintf ( path_name, MAXPATHLEN, "%s", err_name_ptr ) ; else if ( req -> work_dir ) snprintf ( path_name, MAXPATHLEN, "%s//%s", req -> work_dir, err_name_ptr ) ; else snprintf ( path_name, MAXPATHLEN, "//%s", err_name_ptr ) ; <START_BUG> if ( ( fd = open ( path_name, ( O_CREAT | O_APPEND | O_WRONLY ), 0644 ) ) == - 1 ) { <END_BUG>  error ( "Unable   to   open   %s:   %s", path_name, <START_BUG> slurm_strerror ( errno ) ) ; return ; } snprintf ( err_name, sizeof ( err_name ), "Error   running   slurm   prolog:   %d\\n", WEXITSTATUS ( rc ) ) ; safe_write ( fd, err_name<END_BUG>

Fix:
<S2SV_ModStart> ( fd = _open_as_other ( path_name, req <S2SV_ModEnd> ) ) == <S2SV_ModStart> { error ( "Unable <S2SV_blank> to <S2SV_blank> open <S2SV_blank> %s: <S2SV_blank> Permission <S2SV_blank> denied", path_name <S2SV_ModEnd> ) ; return
Buggy code:
 static INT AirPDcapScanForKeys ( PAIRPDCAP_CONTEXT ctx, const guint8 * data, const guint mac_header_len, const guint tot_len, AIRPDCAP_SEC_ASSOCIATION_ID id ) { const UCHAR * addr ; guint bodyLength ; PAIRPDCAP_SEC_ASSOCIATION sta_sa ; PAIRPDCAP_SEC_ASSOCIATION sa ; guint offset = 0 ; const guint8 dot1x_header [ ] = { 0xAA, 0xAA, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8E } ; const guint8 bt_dot1x_header [ ] = { 0xAA, 0xAA, 0x03, 0x00, 0x19, 0x58, 0x00, 0x03 } ; const guint8 tdls_header [ ] = { 0xAA, 0xAA, 0x03, 0x00, 0x00, 0x00, 0x89, 0x0D, 0x02, 0X0C } ; const EAPOL_RSN_KEY * pEAPKey ; # ifdef _DEBUG # define MSGBUF_LEN 255 CHAR msgbuf [ MSGBUF_LEN ] ; # endif AIRPDCAP_DEBUG_TRACE_START ( "AirPDcapScanForKeys" ) ; offset = mac_header_len ; if ( memcmp ( data + offset, dot1x_header, 8 ) == 0 || memcmp ( data + offset, bt_dot1x_header, 8 ) == 0 ) { AIRPDCAP_DEBUG_PRINT_LINE ( "AirPDcapScanForKeys", "Authentication:   EAPOL   packet", AIRPDCAP_DEBUG_LEVEL_3 ) ; offset += 8 ; if ( data [ offset + 1 ]!= 3 ) { AIRPDCAP_DEBUG_PRINT_LINE ( "AirPDcapScanForKeys", "Not   EAPOL-Key", AIRPDCAP_DEBUG_LEVEL_3 ) ; return AIRPDCAP_RET_NO_VALID_HANDSHAKE ; } bodyLength = pntoh16 ( data + offset + 2 ) ; <START_BUG> if<END_BUG>

Fix:
<S2SV_ModStart> if ( ( ( <S2SV_ModStart> ) < bodyLength ) || ( bodyLength < sizeof ( EAPOL_RSN_KEY ) )
Buggy code:
 static int grub_ext2_iterate_dir ( grub_fshelp_node_t dir, int ( * hook ) ( const char * filename, enum grub_fshelp_filetype filetype, grub_fshelp_node_t node, void * closure ), void * closure ) { unsigned int fpos = 0 ; struct grub_fshelp_node * diro = ( struct grub_fshelp_node * ) dir ; if (! diro -> inode_read ) { grub_ext2_read_inode ( diro -> data, diro -> ino, & diro -> inode ) ; if ( grub_errno ) return 0 ; } if ( hook ) while ( fpos < grub_le_to_cpu32 ( diro -> inode. size ) ) { struct ext2_dirent dirent ; grub_ext2_read_file ( diro, NULL, NULL, 0, fpos, sizeof ( dirent ), ( char * ) & dirent ) ; if ( grub_errno ) return 0 ; if ( dirent. direntlen == 0 ) return 0 ; if ( dirent. namelen!= 0 ) { <START_BUG> # ifndef _MSC_VER <END_BUG>  char filename [ dirent. namelen + 1 ] ; <START_BUG> # else char * filename = grub_malloc ( dirent. namelen + 1 ) ; # endif struct grub_fshelp_node * fdiro ; <END_BUG> enum grub_fshelp_filetype type = GRUB_FSHELP_UNKNOWN ;  grub_ext2_read_file ( diro, 0, 0, 0, fpos + sizeof ( struct ext2_dirent ), dirent. namelen, filename ) ; if ( grub_errno ) <START_BUG> return 0 ; <END_BUG> fdiro = grub_malloc ( sizeof ( struct grub_fshelp_node ) ) ; if (! fdiro )  return 0 ; <START_BUG> fdiro -> data = diro -> data ; fdiro -> ino = grub_le_to_cpu32 ( dirent. inode ) ; filename [ dirent. namelen ] = '\\0' ; if ( dirent. filetype!= FILETYPE_UNKNOWN ) { fdi<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { char * filename = grub_malloc ( <S2SV_ModEnd> dirent. namelen <S2SV_ModStart> namelen + 1 ) ; <S2SV_ModEnd> struct grub_fshelp_node * <S2SV_ModStart> = GRUB_FSHELP_UNKNOWN ; if (! filename ) { break ; } <S2SV_ModStart> ( grub_errno ) { free ( filename ) ; return 0 ; } <S2SV_ModEnd> fdiro = grub_malloc <S2SV_ModStart>! fdiro ) { free ( filename ) ; return 0 ; } <S2SV_ModEnd> fdiro -> data <S2SV_ModStart> ( grub_errno ) { free ( filename ) ; <S2SV_ModEnd> grub_free ( fdiro <S2SV_ModStart> closure ) ) { free ( filename ) ; return 1 ; } free ( filename ) <S2SV_ModEnd> ; } fpos