nus-yam/ex-repair huggingface dataset:
Buggy code:
 asmlinkage void kernel_unaligned_trap ( struct pt_regs * regs, unsigned int insn ) { enum direction dir = decode_direction ( insn ) ; int size = decode_access_size ( insn ) ; if (! ok_for_kernel ( insn ) || dir == both ) { printk ( "Unsupported   unaligned   load//store   trap   for   kernel   at   <%08lx>.\\n", regs -> pc ) ; unaligned_panic ( "Wheee.   Kernel   does   fpu//atomic   unaligned   load//store." ) ; } else { unsigned long addr = compute_effective_address ( regs, insn ) ; int err ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, addr ) ; <END_BUG> switch ( dir ) { case load : err = do_int_load ( fetch_reg_addr ( ( ( insn >> 25 ) & 0x1f ), regs ), size, ( unsigned long * ) addr, decode_signedness ( insn ) ) ; break ; case store : err = do_int_store ( ( ( insn >> 25 ) & 0x1f ), size, ( unsigned long * ) addr, regs ) ; break ; default : panic ( "Impossible   kernel   unaligned   trap." ) ; } if ( err ) kernel_mna_trap_fault ( regs, insn ) ; else advance ( regs ) ; } }

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, addr
Buggy code:
 static Image * ReadBMPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { BMPInfo bmp_info ; Image * image ; MagickBooleanType status ; MagickOffsetType offset, start_position ; MemoryInfo * pixel_info ; Quantum index ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bit, bytes_per_line, length ; ssize_t count, y ; unsigned char magick [ 12 ], * pixels ; unsigned int blue, green, offset_bits, red ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) memset ( & bmp_info, 0, sizeof ( bmp_info ) ) ; bmp_info. ba_offset = 0 ; start_position = 0 ; offset_bits = 0 ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { PixelInfo quantum_bits ; PixelPacket shift ; if ( bmp_info. ba_offset == 0 ) start_position = TellBlob ( image ) - 2 ; bmp_info. ba_offset = 0 ; while ( LocaleNCompare ( ( char * ) magick, "BA", 2 ) == 0 ) { bmp_info. file_size = ReadBlobLSBLong ( image ) ; bmp_info. ba_offset = ReadBlobLSBLong ( image ) ; bmp_info. offset_bits = ReadBlobLSBLong ( image ) ; count = ReadBlob ( image, 2, magick ) ; if (

Fix:
<S2SV_ModStart> ReadBlobLSBLong ( image ) ; if ( bmp_info. number_colors > GetBlobSize ( image ) ) ThrowReaderException ( CorruptImageError, "InsufficientImageDataInFile"
Buggy code:
 static int snd_timer_user_tselect ( struct file * file, struct snd_timer_select __user * _tselect ) { struct snd_timer_user * tu ; struct snd_timer_select tselect ; char str [ 32 ] ; int err = 0 ; tu = file -> private_data ; if ( tu -> timeri ) { snd_timer_close ( tu -> timeri ) ; tu -> timeri = NULL ; } if ( copy_from_user ( & tselect, _tselect, sizeof ( tselect ) ) ) { err = - EFAULT ; goto __err ; } sprintf ( str, "application   %i", current -> pid ) ; if ( tselect. id. dev_class!= SNDRV_TIMER_CLASS_SLAVE ) tselect. id. dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION ; err = snd_timer_open ( & tu -> timeri, str, & tselect. id, current -> pid ) ; if ( err < 0 ) goto __err ; <START_BUG> kfree ( tu -> queue ) ; <END_BUG> tu -> queue = NULL ; kfree ( tu -> tqueue ) ; tu -> tqueue = NULL ; if ( tu -> tread ) { tu -> tqueue = kmalloc ( tu -> queue_size * sizeof ( struct snd_timer_tread ), GFP_KERNEL ) ; if ( tu -> tqueue == NULL ) err = - ENOMEM ; } else { tu -> queue = kmalloc ( tu -> queue_size * sizeof ( struct snd_timer_read ), GFP_KERNEL ) ; if ( tu -> queue == NULL ) err = - ENOMEM ; } if ( err < 0 ) { snd_timer_close ( tu -> timeri ) ; tu -> timeri = NULL ; } else { tu -> timeri -> flags |= SNDRV_TIMER_IFLG_FAST ; tu -> timeri -> callback = tu -> tread? snd_timer_user_tinterrupt : snd_timer_user_interrupt ; tu -> timeri -> ccallback = snd_timer_user_ccallback ; tu -> timeri -> callback_data = ( void * ) tu ; tu -> timeri -> disconnect = snd_timer_user_disconnect ; } __err : return err ; }

Fix:
<S2SV_ModStart> goto __err ; tu -> qhead = tu -> qtail = tu -> qused = 0 ;
Buggy code:
 void ip4_datagram_release_cb ( struct sock * sk ) { const struct inet_sock * inet = inet_sk ( sk ) ; const struct ip_options_rcu * inet_opt ; __be32 daddr = inet -> inet_daddr ; <START_BUG> struct flowi4 fl4 ; <END_BUG> struct rtable * rt ;  if (! __sk_dst_get ( sk ) || __sk_dst_check ( sk, 0 ) ) <START_BUG> return ; rcu_read_lock ( ) ; inet_opt = rcu_dereference ( inet -> inet_opt ) ; if ( inet_opt && inet_opt -> opt. srr ) daddr = inet_opt -> opt. faddr ; rt = ip_route_output_ports ( sock_net ( sk ), & fl4, sk, daddr, inet -> inet_saddr, inet -> inet_dport, inet -> inet_sport, sk -> sk_protocol, RT_CONN_FLAGS ( sk ), sk -> sk_bound_dev_if ) ; <END_BUG> if (! IS_ERR ( rt ) )  <START_BUG> __sk_dst_set ( sk, & rt -> dst ) ; <END_BUG> rcu_read_unlock ( ) ; }

Fix:
<S2SV_ModStart> inet_daddr ; struct dst_entry * dst ; struct <S2SV_ModStart> * rt ; rcu_read_lock ( ) ; dst = __sk_dst_get ( sk ) ; <S2SV_ModStart> if (! dst ||! dst -> obsolete || dst -> ops -> check ( dst <S2SV_ModEnd>, 0 ) <S2SV_ModStart> 0 ) ) { rcu_read_unlock ( ) ; return ; } <S2SV_ModEnd> inet_opt = rcu_dereference <S2SV_ModStart> sk_bound_dev_if ) ; dst = <S2SV_ModEnd>! IS_ERR ( <S2SV_ModStart> ( rt )? <S2SV_ModEnd> & rt -> <S2SV_ModStart> & rt -> dst : NULL ; sk_dst_set ( sk,
Buggy code:
 bool extract_sockaddr ( struct pool * pool, char * url ) { char * url_begin, * url_end, * ipv6_begin, * ipv6_end, * port_start = NULL ; char url_address [ 256 ], port [ 6 ] ; int url_len, port_len = 0 ; url_begin = strstr ( url, "////" ) ; if (! url_begin ) url_begin = url ; else url_begin += 2 ; ipv6_begin = strstr ( url_begin, "[" ) ; ipv6_end = strstr ( url_begin, "]" ) ; if ( ipv6_begin && ipv6_end && ipv6_end > ipv6_begin ) url_end = strstr ( ipv6_end, ":" ) ; else url_end = strstr ( url_begin, ":" ) ; if ( url_end ) { url_len = url_end - url_begin ; port_len = strlen ( url_begin ) - url_len - 1 ; if ( port_len < 1 ) return false ; port_start = url_end + 1 ; } else url_len = strlen ( url_begin ) ; if ( url_len < 1 ) return false ; <START_BUG> sprintf ( url_address, "%.*s", url_len, url_begin ) ; <END_BUG> if ( port_len ) snprintf ( port, 6, "%.*s", port_len, port_start ) ; else strcpy ( port, "80" ) ; free ( pool -> stratum_port ) ; pool -> stratum_port = strdup ( port ) ; free ( pool -> sockaddr_url ) ; pool -> sockaddr_url = strdup ( url_address ) ; return true ; }

Fix:
<S2SV_ModStart> return false ; if ( url_len >= sizeof ( url_address ) ) { applog ( LOG_WARNING, "%s: <S2SV_blank> Truncating <S2SV_blank> overflowed <S2SV_blank> address <S2SV_blank> \'%.*s\'", __func__, url_len, url_begin ) ; url_len = sizeof ( url_address ) - 1 ; }
Buggy code:
 <START_BUG> void nfs4_close_sync ( struct path * path, struct nfs4_state * state, mode_t mode ) <END_BUG> {  __nfs4_close ( path, state, mode, 1 ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * state, fmode_t fmode <S2SV_ModEnd> ) { __nfs4_close <S2SV_ModStart>, state, fmode <S2SV_ModEnd>, 1 )
Buggy code:
 int ff_h263_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt ) { const uint8_t * buf = avpkt -> data ; int buf_size = avpkt -> size ; MpegEncContext * s = avctx -> priv_data ; int ret ; int slice_ret = 0 ; AVFrame * pict = data ; if ( buf_size == 0 ) { if ( s -> low_delay == 0 && s -> next_picture_ptr ) { if ( ( ret = av_frame_ref ( pict, s -> next_picture_ptr -> f ) ) < 0 ) return ret ; s -> next_picture_ptr = NULL ; * got_frame = 1 ; } return 0 ; } if ( s -> avctx -> flags & AV_CODEC_FLAG_TRUNCATED ) { int next ; if ( CONFIG_MPEG4_DECODER && s -> codec_id == AV_CODEC_ID_MPEG4 ) { next = ff_mpeg4_find_frame_end ( & s -> parse_context, buf, buf_size ) ; } else if ( CONFIG_H263_DECODER && s -> codec_id == AV_CODEC_ID_H263 ) { next = ff_h263_find_frame_end ( & s -> parse_context, buf, buf_size ) ; } else if ( CONFIG_H263P_DECODER && s -> codec_id == AV_CODEC_ID_H263P ) { next = ff_h263_find_frame_end ( & s -> parse_context, buf, buf_size ) ; } else { av_log ( s -> avctx, AV_LOG_ERROR, "this   codec   does   not   support   truncated   bitstreams\\n" ) ; return AVERROR ( ENOSYS ) ; } if ( ff_combine_frame ( & s -> parse_context, next, ( const uint8_t * * ) & buf, & buf_size ) < 0 ) return buf_size ; } retry : if ( s -> divx_packed && s -> bitstream_buffer_size ) { int i ; for ( i = 0 ; i < buf_size -

Fix:
<S2SV_ModStart> ; frame_end : if (! s -> studio_profile )
Buggy code:
 int rtl_usb_probe ( struct usb_interface * intf, const struct usb_device_id * id, struct rtl_hal_cfg * rtl_hal_cfg ) { int err ; struct ieee80211_hw * hw = NULL ; struct rtl_priv * rtlpriv = NULL ; struct usb_device * udev ; struct rtl_usb_priv * usb_priv ; hw = ieee80211_alloc_hw ( sizeof ( struct rtl_priv ) + sizeof ( struct rtl_usb_priv ), & rtl_ops ) ; if (! hw ) { WARN_ONCE ( true, "rtl_usb:   ieee80211   alloc   failed\\n" ) ; return - ENOMEM ; } rtlpriv = hw -> priv ; rtlpriv -> hw = hw ; rtlpriv -> usb_data = kcalloc ( RTL_USB_MAX_RX_COUNT, sizeof ( u32 ), GFP_KERNEL ) ; <START_BUG> if (! rtlpriv -> usb_data ) <END_BUG> return - ENOMEM ;  spin_lock_init ( & rtlpriv -> locks. usb_lock ) ; <START_BUG> INIT_WORK ( & rtlpriv -> works. fill_h2c_cmd, rtl_fill_h2c_cmd_work_callback ) ; INIT_WORK ( & rtlpriv -> works. lps_change_work, rtl_lps_change_work_callback ) ; rtlpriv -> usb_data_index = 0 ; init_completion ( & rtlpriv -> firmware_loading_complete ) ; SET_IEEE80211_DEV ( hw, & intf -> dev ) ; udev = interface_to_usbdev ( intf ) ; usb_get_dev ( udev ) ; usb_priv = rtl_usbpriv ( hw ) ; memset ( usb_priv, 0, sizeof ( * usb_priv ) ) ; usb_priv -> dev. intf = intf ; usb_priv -> dev. udev = udev ; usb_set_intfdata ( intf, hw ) ; rtlpriv -> rtlhal. interface = INTF_USB ; rtlpriv -> cfg = rtl_hal_cfg ; rtlpriv -> intf_ops = & rtl_usb_ops ; _rtl_usb<END_BUG>

Fix:
<S2SV_ModStart> -> usb_data ) { ieee80211_free_hw ( hw ) ; <S2SV_ModStart> - ENOMEM ; } <S2SV_ModStart> rtlpriv -> firmware_loading_complete ) ; kfree ( rtlpriv -> usb_data
Buggy code:
 static struct grub_ext4_extent_header * grub_ext4_find_leaf ( struct grub_ext2_data * data, char * buf, struct grub_ext4_extent_header * ext_block, grub_uint32_t fileblock ) { struct grub_ext4_extent_idx * index ; while ( 1 ) { int i ; grub_disk_addr_t block ; index = ( struct grub_ext4_extent_idx * ) ( ext_block + 1 ) ; if ( grub_le_to_cpu16 ( ext_block -> magic )!= EXT4_EXT_MAGIC ) return 0 ; if ( ext_block -> depth == 0 ) return ext_block ; for ( i = 0 ; i < grub_le_to_cpu16 ( ext_block -> entries ) ; i ++ ) { if ( fileblock < grub_le_to_cpu32 ( index [ i ]. block ) ) break ; } if ( -- i < 0 ) return 0 ; block = grub_le_to_cpu16 ( index [ i ]. leaf_hi ) ; block = ( block << 32 ) + grub_le_to_cpu32 ( index [ i ]. leaf ) ; if ( grub_disk_read ( data -> disk, block << LOG2_EXT2_BLOCK_SIZE ( data ), 0, EXT2_BLOCK_SIZE ( data ), buf ) ) <START_BUG> return 0 ; <END_BUG> ext_block = ( struct grub_ext4_extent_header * ) buf ; } }

Fix:
<S2SV_ModStart> buf ) ) { return 0 ; } <S2SV_ModEnd> ext_block = (
Buggy code:
 static int try_read_command_binary ( conn * c ) { if ( c -> rbytes < sizeof ( c -> binary_header ) ) { return 0 ; } else { memcpy ( & c -> binary_header, c -> rcurr, sizeof ( c -> binary_header ) ) ; protocol_binary_request_header * req ; req = & c -> binary_header ; if ( settings. verbose > 1 ) { int ii ; fprintf ( stderr, "<%d   Read   binary   protocol   data:", c -> sfd ) ; for ( ii = 0 ; ii < sizeof ( req -> bytes ) ; ++ ii ) { if ( ii % 4 == 0 ) { fprintf ( stderr, "\\n<%d       ", c -> sfd ) ; } fprintf ( stderr, "   0x%02x", req -> bytes [ ii ] ) ; } fprintf ( stderr, "\\n" ) ; } c -> binary_header = * req ; c -> binary_header. request. keylen = ntohs ( req -> request. keylen ) ; c -> binary_header. request. bodylen = ntohl ( req -> request. bodylen ) ; c -> binary_header. request. cas = ntohll ( req -> request. cas ) ; if ( c -> binary_header. request. magic!= PROTOCOL_BINARY_REQ ) { if ( settings. verbose ) { fprintf ( stderr, "Invalid   magic:     %x\\n", c -> binary_header. request. magic ) ; } conn_set_state ( c, conn_closing ) ; return - 1 ; } uint8_t extlen = c -> binary_header. request. extlen ; uint16_t keylen = c -> binary_header. request. keylen ; if ( c -> rbytes < keylen + extlen + sizeof ( c -> binary_header ) ) { return 0 ; } if (! resp_start ( c ) ) { conn_set_state ( c, conn_closing ) ; return - 1 ; } c -> cmd = c -> binary_header. request. opcode ; c -> keylen = c -> binary_header. request. keylen ; c -> opaque = c -> binary_header. request. opaque ; c -> cas = 0 ; c -> last_cmd_time = current_

Fix:
<S2SV_ModStart> ) + BIN_MAX_EXTLEN + 1 <S2SV_ModStart> binary_header ), extlen > BIN_MAX_EXTLEN? BIN_MAX_EXTLEN :
Buggy code:
 static void aodv_extension ( netdissect_options * ndo, const struct aodv_ext * ep, u_int length ) { <START_BUG> const struct aodv_hello * ah ; <END_BUG> switch ( ep -> type ) { case AODV_EXT_HELLO : ah = ( const struct aodv_hello * ) ( const void * ) ep ; ND_TCHECK ( * ah ) ; if ( length < sizeof ( struct aodv_hello ) )  goto trunc ; <START_BUG> ND_PRINT ( ( ndo, "\\n\\text   HELLO   %ld   ms", ( unsigned long ) EXTRACT_32BITS ( & ah -> interval ) ) ) ; break ; default : ND_PRINT ( ( ndo, "\\n\\text   %u   %u", ep -> type, ep -> length ) ) ; break ; } return ; trunc : ND_PRINT ( ( ndo, "   [|hello]" ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> aodv_hello * ah ; ND_TCHECK ( * ep ) <S2SV_ModStart> goto trunc ; if ( ep -> length < 4 ) { ND_PRINT ( ( ndo, "\\n\\text <S2SV_blank> HELLO <S2SV_blank> - <S2SV_blank> bad <S2SV_blank> length <S2SV_blank> %u", ep -> length ) ) ; break ; }
Buggy code:
 SYSCALL_DEFINE2 ( timerfd_create, int, clockid, int, flags ) { int ufd ; struct timerfd_ctx * ctx ; BUILD_BUG_ON ( TFD_CLOEXEC!= O_CLOEXEC ) ; BUILD_BUG_ON ( TFD_NONBLOCK!= O_NONBLOCK ) ; if ( ( flags & ~ TFD_CREATE_FLAGS ) || ( clockid!= CLOCK_MONOTONIC && clockid!= CLOCK_REALTIME && clockid!= CLOCK_REALTIME_ALARM && clockid!= CLOCK_BOOTTIME && clockid!= CLOCK_BOOTTIME_ALARM ) ) return - EINVAL ; if (! capable ( CAP_WAKE_ALARM ) && ( clockid == CLOCK_REALTIME_ALARM || clockid == CLOCK_BOOTTIME_ALARM ) ) return - EPERM ; ctx = kzalloc ( sizeof ( * ctx ), GFP_KERNEL ) ; if (! ctx ) return - ENOMEM ; init_waitqueue_head ( & ctx -> wqh ) ; <START_BUG> ctx -> clockid = clockid ; <END_BUG> if ( isalarm ( ctx ) ) alarm_init ( & ctx -> t. alarm, ctx -> clockid == CLOCK_REALTIME_ALARM? ALARM_REALTIME : ALARM_BOOTTIME, timerfd_alarmproc ) ; else hrtimer_init ( & ctx -> t. tmr, clockid, HRTIMER_MODE_ABS ) ; ctx -> moffs = ktime_mono_to_real ( 0 ) ; ufd = anon_inode_getfd ( "[timerfd]", & timerfd_fops, ctx, O_RDWR | ( flags & TFD_SHARED_FCNTL_FLAGS ) ) ; if ( ufd < 0 ) kfree ( ctx ) ; return ufd ; }

Fix:
<S2SV_ModStart> wqh ) ; spin_lock_init ( & ctx -> cancel_lock ) ;
Buggy code:
 node * PyParser_ParseFileObject ( FILE * fp, PyObject * filename, const char * enc, grammar * g, int start, const char * ps1, const char * ps2, perrdetail * err_ret, int * flags ) { struct tok_state * tok ; if ( initerr ( err_ret, filename ) < 0 ) return NULL ; if ( ( tok = PyTokenizer_FromFile ( fp, enc, ps1, ps2 ) ) == NULL ) { err_ret -> error = E_NOMEM ; return NULL ; } <START_BUG> # ifndef PGEN <END_BUG> Py_INCREF ( err_ret -> filename ) ; tok -> filename = err_ret -> filename ; # endif return parsetok ( tok, g, start, err_ret, flags ) ; }

Fix:
<S2SV_ModStart> NULL ; } if ( * flags & PyPARSE_TYPE_COMMENTS ) { tok -> type_comments = 1 ; }
Buggy code:
 uint8_t hfs_cat_traverse ( HFS_INFO * hfs, TSK_HFS_BTREE_CB a_cb, void * ptr ) { TSK_FS_INFO * fs = & ( hfs -> fs_info ) ; uint32_t cur_node ; char * node ; uint16_t nodesize ; uint8_t is_done = 0 ; tsk_error_reset ( ) ; nodesize = tsk_getu16 ( fs -> endian, hfs -> catalog_header. nodesize ) ; if ( ( node = ( char * ) tsk_malloc ( nodesize ) ) == NULL ) return 1 ; cur_node = tsk_getu32 ( fs -> endian, hfs -> catalog_header. rootNode ) ; if ( cur_node == 0 ) { if ( tsk_verbose ) tsk_fprintf ( stderr, "hfs_cat_traverse:   " "empty   extents   btree\\n" ) ; free ( node ) ; return 1 ; } if ( tsk_verbose ) tsk_fprintf ( stderr, "hfs_cat_traverse:   starting   at   " "root   node   %" PRIu32 ";   nodesize   =   %" PRIu16 "\\n", cur_node, nodesize ) ; is_done = 0 ; while ( is_done == 0 ) { TSK_OFF_T cur_off ; uint16_t num_rec ; ssize_t cnt ; hfs_btree_node * node_desc ; if ( cur_node > tsk_getu32 ( fs -> endian, hfs -> catalog_header. totalNodes ) ) { tsk_error_set_errno ( TSK_ERR_FS_GENFS ) ; tsk_error_set_errstr ( "hfs_cat_traverse:   Node   %d   too   large   for   file", cur_node ) ; free ( node ) ; return 1 ; } cur_off = cur_node * nodesize ; cnt = tsk_fs_attr_read ( hfs -> catalog_attr, cur_off, node, nodesize, 0 ) ; if ( cnt!= nodesize ) { if ( cnt >= 0 ) { tsk_error_reset ( ) ; tsk_

Fix:
<S2SV_ModStart> ; if ( keylen >= nodesize - rec_off <S2SV_ModEnd> ) { tsk_error_set_errno <S2SV_ModStart>, keylen, ( nodesize - rec_off ) <S2SV_ModEnd> ) ; free
Buggy code:
 static int putint ( jas_stream_t * out, int sgnd, int prec, long val ) { int n ; int c ; bool s ; <START_BUG> ulong tmp ; <END_BUG> assert ( (! sgnd && prec >= 1 ) || ( sgnd && prec >= 2 ) ) ; if ( sgnd ) { val = encode_twos_comp ( val, prec ) ; } assert ( val >= 0 ) ; val &= ( 1 << prec ) - 1 ; n = ( prec + 7 ) // 8 ; while ( -- n >= 0 ) { c = ( val >> ( n * 8 ) ) & 0xff ; if ( jas_stream_putc ( out, c )!= c ) return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> bool s ; jas_ulong <S2SV_ModEnd> tmp ; assert
Buggy code:
 error_t ftpClientOpenDir ( FtpClientContext * context, const char_t * path ) { error_t error ; if ( context == NULL || path == NULL ) return ERROR_INVALID_PARAMETER ; error = NO_ERROR ; while (! error ) { if ( context -> state == FTP_CLIENT_STATE_CONNECTED ) { error = ftpClientFormatCommand ( context, "TYPE", "A" ) ; if (! error ) { ftpClientChangeState ( context, FTP_CLIENT_STATE_SUB_COMMAND_1 ) ; } } else if ( context -> state == FTP_CLIENT_STATE_SUB_COMMAND_1 ) { error = ftpClientSendCommand ( context ) ; if (! error ) { if ( FTP_REPLY_CODE_2YZ ( context -> replyCode ) ) { ftpClientChangeState ( context, FTP_CLIENT_STATE_SUB_COMMAND_2 ) ; } else { error = ERROR_UNEXPECTED_RESPONSE ; } } } else if ( context -> state == FTP_CLIENT_STATE_SUB_COMMAND_2 || context -> state == FTP_CLIENT_STATE_SUB_COMMAND_3 || context -> state == FTP_CLIENT_STATE_SUB_COMMAND_4 || context -> state == FTP_CLIENT_STATE_SUB_COMMAND_5 || context -> state == FTP_CLIENT_STATE_SUB_COMMAND_6 || context -> state == FTP_CLIENT_STATE_CONNECTING_TCP || context -> state == FTP_CLIENT_STATE_SUB_COMMAND_8 || context -> state == FTP_CLIENT_STATE_ACCEPTING_TCP || context -> state == FTP_CLIENT_STATE_CONNECTING_TLS ) { error = ftpClientInitDataTransfer ( context, FALSE ) ; } else if ( context -> state == FTP_CLIENT_STATE_SUB_COMMAND_7 ) { if (! osStrcmp ( path, "." ) ) <START_BUG> ftpClientFormatCommand ( context, "LIST", NULL ) ; <END_BUG>  else <START_BUG> <END_BUG> ftpClientFormatCommand ( context, "LIST", path ) ;  if (! error ) { ftpClientChangeState ( context, FTP_CLIENT_STATE_SUB_COMMAND_8 ) ; } } else if ( context -> state == FTP_CLIENT_STATE_SUB_COMMAND_9 ) { context -> bufferPos = 0 ; context -> commandLen = 0 ; context -> replyLen = 0 ; ftpClient

Fix:
<S2SV_ModStart> "." ) ) { <S2SV_ModStart> NULL ) ; } else { <S2SV_ModEnd> ftpClientFormatCommand ( context <S2SV_ModStart> path ) ; }
Buggy code:
 static int snd_hrtimer_stop ( struct snd_timer * t ) { struct snd_hrtimer * stime = t -> private_data ; atomic_set ( & stime -> running, 0 ) ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> 0 ) ; hrtimer_try_to_cancel ( & stime -> hrt ) ;
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; one = 1 ; image = AcquireImage ( image_info, exception ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) {

Fix:
<S2SV_ModStart> Rec. RecordLength ) ; if ( Rec. RecordLength > GetBlobSize ( image ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader"
Buggy code:
 <START_BUG> static void usage ( char * progname ) { <END_BUG> printf ( "Usage:\\n" ) ; printf ( "%s   <input_yuv>   <width>x<height>   <target_width>x<target_height>   ",  progname ) ; <START_BUG> printf ( "<output_yuv>   [<frames>]\\n" ) ; }<END_BUG>

Fix:
<S2SV_ModStart> void usage ( <S2SV_ModEnd> ) { printf <S2SV_ModStart> ( "%s <S2SV_blank> <input_yuv> <S2SV_blank> <width>x<height> <S2SV_blank> <target_width>x<target_height> <S2SV_blank> ", exec_name <S2SV_ModEnd> ) ; printf
Buggy code:
 void vp8cx_pick_filter_level ( YV12_BUFFER_CONFIG * sd, VP8_COMP * cpi ) { VP8_COMMON * cm = & cpi -> common ; int best_err = 0 ; int filt_err = 0 ; int min_filter_level = get_min_filter_level ( cpi, cm -> base_qindex ) ; int max_filter_level = get_max_filter_level ( cpi, cm -> base_qindex ) ; int filter_step ; int filt_high = 0 ; <START_BUG> int filt_mid = cm -> filter_level ; <END_BUG> int filt_low = 0 ; int filt_best ; int filt_direction = 0 ; int Bias = 0 ; int ss_err [ MAX_LOOP_FILTER + 1 ] ; YV12_BUFFER_CONFIG * saved_frame = cm -> frame_to_show ;  vpx_memset ( ss_err, 0, sizeof ( ss_err ) ) ; <START_BUG> cm -> frame_to_show = & cpi -> pick_lf_lvl_frame ; if ( cm -> frame_type == KEY_FRAME ) cm -> sharpness_level = 0 ; else cm -> sharpness_level = cpi -> oxcf. Sharpness ; filt_mid = cm -> filter_level ; if ( filt_mid < min_filter_level ) filt_mid = min_filter_level ; else if ( filt_mid > max_filter_level ) filt_mid = max_filter_level ; filter_step = ( filt_mid < 16 )? 4 : filt_mid // 4 ; vpx_yv12_copy_y ( saved_frame, cm -> frame_to_show ) ; vp8cx_set_alt_lf_level ( cpi, filt_mid ) ; vp8_loop_filter_frame_yonly ( cm, & cpi -> mb. e_mbd, filt_mid ) ; best_err = vp8_calc_ss_err ( sd, cm -> frame_to_show ) ; ss_err [ filt_mid ] = best_err ; filt_best = filt_mid ; while ( filter_step > 0 ) { Bias = ( best_err >> ( 15 - ( filt_mid // 8 ) ) ) *<END_BUG>

Fix:
<S2SV_ModStart> ; int filt_mid <S2SV_ModEnd> ; int filt_low <S2SV_ModStart> -> frame_to_show ; memset <S2SV_ModEnd> ( ss_err,
Buggy code:
 static int llcp_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; unsigned int copied, rlen ; struct sk_buff * skb, * cskb ; int err = 0 ; pr_debug ( "%p   %zu\\n", sk, len ) ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> lock_sock ( sk ) ; if ( sk -> sk_state == LLCP_CLOSED && skb_queue_empty ( & sk -> sk_receive_queue ) ) { release_sock ( sk ) ; return 0 ; } release_sock ( sk ) ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) { pr_err ( "Recv   datagram   failed   state   %d   %d   %d", sk -> sk_state, err, sock_error ( sk ) ) ; if ( sk -> sk_shutdown & RCV_SHUTDOWN ) return 0 ; return err ; } rlen = skb -> len ; copied = min_t ( unsigned int, rlen, len ) ; cskb = skb ; if ( skb_copy_datagram_iovec ( cskb, 0, msg -> msg_iov, copied ) ) { if (! ( flags & MSG_PEEK ) ) skb_queue_head ( & sk -> sk_receive_queue, skb ) ; return - EFAULT ; } sock_recv_timestamp ( msg, sk, skb ) ; if ( sk -> sk_type == SOCK_DGRAM && msg -> msg_name ) { struct nfc_llcp_ui_cb * ui_cb = nfc_llcp_ui_skb_cb ( skb ) ; struct sockaddr_nfc_llcp * sockaddr = ( struct sockaddr_nfc_llcp * ) msg -> msg_name ; msg -> msg_namelen = sizeof ( struct sockaddr_nfc_llcp ) ; pr_debug ( "Datagram   socket

Fix:
<S2SV_ModStart> len ) ; <S2SV_ModEnd> lock_sock ( sk
Buggy code:
 static void credential_write_item ( FILE * fp, const char * key, const char * value ) { if (! value ) return ; <START_BUG> fprintf ( fp, "%s=%s\\n", key, value ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) return ; if ( strchr ( value, '\\n' ) ) die ( "credential <S2SV_blank> value <S2SV_blank> for <S2SV_blank> %s <S2SV_blank> contains <S2SV_blank> newline", key ) ;
Buggy code:
 int fscrypt_process_policy ( struct inode * inode, const struct fscrypt_policy * policy ) <START_BUG> { <END_BUG> if ( policy -> version!= 0 ) return - EINVAL ; if (! inode_has_encryption_context ( inode ) ) { if (! inode -> i_sb -> s_cop -> empty_dir ) return - EOPNOTSUPP ; if (! inode -> i_sb -> s_cop -> empty_dir ( inode ) ) return - ENOTEMPTY ; return create_encryption_context_from_policy ( inode, policy ) ; } if ( is_encryption_context_consistent_with_policy ( inode, policy ) ) return 0 ; printk ( KERN_WARNING "%s:   Policy   inconsistent   with   encryption   context\\n", __func__ ) ; return - EINVAL ; }

Fix:
<S2SV_ModStart> policy ) { if (! inode_owner_or_capable ( inode ) ) return - EACCES ;
Buggy code:
 static void open_output_file ( struct stream_state * stream, <START_BUG> struct VpxEncoderConfig * global ) { <END_BUG> const char * fn = stream -> config. out_fn ; const struct vpx_codec_enc_cfg * const cfg = & stream -> config. cfg ; if ( cfg -> g_pass == VPX_RC_FIRST_PASS ) return ; stream -> file = strcmp ( fn, "-" )? fopen ( fn, "wb" ) : set_binary_mode ( stdout ) ; if (! stream -> file ) fatal ( "Failed   to   open   output   file" ) ; if ( stream -> config. write_webm && fseek ( stream -> file, 0, SEEK_CUR ) ) fatal ( "WebM   output   to   pipes   not   supported." ) ; # if CONFIG_WEBM_IO if ( stream -> config. write_webm ) { stream -> ebml. stream = stream -> file ; write_webm_file_header ( & stream -> ebml, cfg, & global -> framerate, stream -> config. stereo_fmt,  global -> codec -> fourcc ) ; <START_BUG> } # endif if (! stream -> config. write_webm ) { ivf_write_file_header ( stream -> file, cfg, global -> codec -> fourcc, 0 ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> VpxEncoderConfig * global, const struct VpxRational * pixel_aspect_ratio <S2SV_ModStart> codec -> fourcc, pixel_aspect_ratio
Buggy code:
 static int hash_recvmsg ( struct kiocb * unused, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct alg_sock * ask = alg_sk ( sk ) ; struct hash_ctx * ctx = ask -> private ; unsigned ds = crypto_ahash_digestsize ( crypto_ahash_reqtfm ( & ctx -> req ) ) ; int err ; if ( len > ds ) len = ds ; else if ( len < ds ) msg -> msg_flags |= MSG_TRUNC ; <START_BUG> lock_sock ( sk ) ; <END_BUG> if ( ctx -> more ) { ctx -> more = 0 ; ahash_request_set_crypt ( & ctx -> req, NULL, ctx -> result, 0 ) ; err = af_alg_wait_for_completion ( crypto_ahash_final ( & ctx -> req ), & ctx -> completion ) ; if ( err ) goto unlock ; } err = memcpy_toiovec ( msg -> msg_iov, ctx -> result, len ) ; unlock : release_sock ( sk ) ; return err? : len ; }

Fix:
<S2SV_ModStart> |= MSG_TRUNC ; msg -> msg_namelen = 0 ;
Buggy code:
 static int unix_attach_fds ( struct scm_cookie * scm, struct sk_buff * skb ) { int i ; unsigned char max_level = 0 ; int unix_sock_count = 0 ; if ( too_many_unix_fds ( current ) ) return - ETOOMANYREFS ; for ( i = scm -> fp -> count - 1 ; i >= 0 ; i -- ) { struct sock * sk = unix_get_socket ( scm -> fp -> fp [ i ] ) ; if ( sk ) { unix_sock_count ++ ; max_level = max ( max_level, unix_sk ( sk ) -> recursion_level ) ; } } if ( unlikely ( max_level > MAX_RECURSION_LEVEL ) ) return - ETOOMANYREFS ; UNIXCB ( skb ). fp = scm_fp_dup ( scm -> fp ) ; if (! UNIXCB ( skb ). fp ) return - ENOMEM ; for ( i = scm -> fp -> count - 1 ; i >= 0 ; i -- ) <START_BUG> unix_inflight ( scm -> fp -> fp [ i ] ) ; <END_BUG> return max_level ; }

Fix:
<S2SV_ModStart> -> fp -> user, scm -> fp ->
Buggy code:
 void ipc_rcu_putref ( void * ptr ) { <START_BUG> if ( -- container_of ( ptr, struct ipc_rcu_hdr, data ) -> refcount > 0 ) <END_BUG> return ; if ( container_of ( ptr, struct ipc_rcu_hdr, data ) -> is_vmalloc ) { call_rcu ( & container_of ( ptr, struct ipc_rcu_grace, data ) -> rcu, ipc_schedule_free ) ; } else { kfree_rcu ( container_of ( ptr, struct ipc_rcu_grace, data ), rcu ) ; } }

Fix:
<S2SV_ModStart> { if (! atomic_dec_and_test ( & <S2SV_ModEnd> container_of ( ptr <S2SV_ModStart> ) -> refcount ) <S2SV_ModEnd> ) return ;
Buggy code:
 static void write_version ( FILE * fp, const char * fname, const char * dirname, xref_t * xref ) { long start ; char * c, * new_fname, data ; FILE * new_fp ; start = ftell ( fp ) ; if ( ( c = strstr ( fname, ".pdf" ) ) ) * c = '\\0' ; <START_BUG> new_fname = malloc ( strlen ( fname ) + strlen ( dirname ) + 16 ) ; <END_BUG> snprintf ( new_fname, strlen ( fname ) + strlen ( dirname ) + 16, "%s//%s-version-%d.pdf", dirname, fname, xref -> version ) ; if (! ( new_fp = fopen ( new_fname, "w" ) ) ) { ERR ( "Could   not   create   file   \'%s\'\\n", new_fname ) ; fseek ( fp, start, SEEK_SET ) ; free ( new_fname ) ; return ; } fseek ( fp, 0, SEEK_SET ) ; while ( fread ( & data, 1, 1, fp ) ) fwrite ( & data, 1, 1, new_fp ) ; fprintf ( new_fp, "\\r\\nstartxref\\r\\n%ld\\r\\n%%%%EOF", xref -> start ) ; fclose ( new_fp ) ; free ( new_fname ) ; fseek ( fp, start, SEEK_SET ) ; }

Fix:
<S2SV_ModStart> ; new_fname = safe_calloc <S2SV_ModEnd> ( strlen (
Buggy code:
 static int wanxl_ioctl ( struct net_device * dev, struct ifreq * ifr, int cmd ) { const size_t size = sizeof ( sync_serial_settings ) ; sync_serial_settings line ; port_t * port = dev_to_port ( dev ) ; if ( cmd!= SIOCWANDEV ) return hdlc_ioctl ( dev, ifr, cmd ) ; switch ( ifr -> ifr_settings. type ) { case IF_GET_IFACE : ifr -> ifr_settings. type = IF_IFACE_SYNC_SERIAL ; if ( ifr -> ifr_settings. size < size ) { ifr -> ifr_settings. size = size ; return - ENOBUFS ; <START_BUG> } <END_BUG> line. clock_type = get_status ( port ) -> clocking ; line. clock_rate = 0 ; line. loopback = 0 ; if ( copy_to_user ( ifr -> ifr_settings. ifs_ifsu. sync, & line, size ) ) return - EFAULT ; return 0 ; case IF_IFACE_SYNC_SERIAL : if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; if ( dev -> flags & IFF_UP ) return - EBUSY ; if ( copy_from_user ( & line, ifr -> ifr_settings. ifs_ifsu. sync, size ) ) return - EFAULT ; if ( line. clock_type!= CLOCK_EXT && line. clock_type!= CLOCK_TXFROMRX ) return - EINVAL ; if ( line. loopback!= 0 ) return - EINVAL ; get_status ( port ) -> clocking = line. clock_type ; return 0 ; default : return hdlc_ioctl ( dev, ifr, cmd ) ; } }

Fix:
<S2SV_ModStart> ENOBUFS ; } memset ( & line, 0, sizeof ( line ) ) ;
Buggy code:
 static int adjust_scalar_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, struct bpf_reg_state * dst_reg, struct bpf_reg_state src_reg ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; bool src_known, dst_known ; s64 smin_val, smax_val ; u64 umin_val, umax_val ; if ( BPF_CLASS ( insn -> code )!= BPF_ALU64 ) { <START_BUG> coerce_reg_to_32 ( dst_reg ) ; <END_BUG>  coerce_reg_to_32 ( & src_reg ) ; <START_BUG> } smin_val = src_reg. smin_value ; smax_val = src_reg. smax_value ; umin_val = src_reg. umin_value ; umax_val = src_reg. umax_value ; src_known = tnum_is_const ( src_reg. var_off ) ; dst_known = tnum_is_const ( dst_reg -> var_off ) ; switch ( opcode ) { case BPF_ADD : if ( signed_add_overflows ( dst_reg -> smin_value, smin_val ) || signed_add_overflows ( dst_reg -> smax_value, smax_val ) ) { dst_reg -> smin_value = S64_MIN ; dst_reg -> smax_value = S64_MAX ; } else { dst_reg -> smin_value += smin_val ; dst_reg -> smax_value += smax_val ; } if ( dst_reg -> umin_value + umin_val < umin_val || dst_reg -> umax_value + umax_val < umax_val ) { dst_reg -> umin_value = 0 ; dst_reg -> umax_value = U64_MAX ; } else { dst_reg -> umin_value += umin_val ; dst_reg -> umax_value += umax_val ; } dst_reg -> var_off = tnum_add ( dst_reg -> var_off<END_BUG>

Fix:
<S2SV_ModStart> BPF_ALU64 ) { coerce_reg_to_size ( dst_reg, 4 ) ; coerce_reg_to_size <S2SV_ModEnd> ( & src_reg <S2SV_ModStart> ( & src_reg, 4
Buggy code:
 struct sock * cookie_v6_check ( struct sock * sk, struct sk_buff * skb ) { struct tcp_options_received tcp_opt ; struct inet_request_sock * ireq ; struct tcp_request_sock * treq ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct tcp_sock * tp = tcp_sk ( sk ) ; const struct tcphdr * th = tcp_hdr ( skb ) ; __u32 cookie = ntohl ( th -> ack_seq ) - 1 ; struct sock * ret = sk ; struct request_sock * req ; int mss ; struct dst_entry * dst ; __u8 rcv_wscale ; if (! sysctl_tcp_syncookies ||! th -> ack || th -> rst ) goto out ; if ( tcp_synq_no_recent_overflow ( sk ) ) goto out ; mss = __cookie_v6_check ( ipv6_hdr ( skb ), th, cookie ) ; if ( mss == 0 ) { NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_SYNCOOKIESFAILED ) ; goto out ; } NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_SYNCOOKIESRECV ) ; memset ( & tcp_opt, 0, sizeof ( tcp_opt ) ) ; tcp_parse_options ( skb, & tcp_opt, 0, NULL ) ; if (! cookie_timestamp_decode ( & tcp_opt ) ) goto out ; ret = NULL ; req = inet_reqsk_alloc ( & tcp6_request_sock_ops, sk, false ) ; if (! req ) goto out ; ireq = inet_rsk ( req ) ; treq = tcp_rsk ( req ) ; treq -> tfo_listener = false ; if ( security_inet_conn_request ( sk, skb, req ) ) goto out_free ; req -> mss = mss ; ireq -> ir_rmt_port = th -> source ; ireq -> ir_num = ntohs ( th -> dest ) ; ireq -> ir_v6_rmt_addr = ipv6_hdr ( skb ) -> saddr ; i

Fix:
<S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt )
Buggy code:
 static ssize_t _epoll_writev ( oe_fd_t * desc, const struct oe_iovec * iov, int iovcnt ) { ssize_t ret = - 1 ; epoll_t * file = _cast_epoll ( desc ) ; void * buf = NULL ; size_t buf_size = 0 ; <START_BUG> if (! file || ( iovcnt &&! iov ) || iovcnt < 0 || iovcnt > OE_IOV_MAX ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( iov, iovcnt, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_writev_ocall ( & ret, file -> host_fd, buf, iovcnt, buf_size )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> done : <END_BUG> if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> = 0 ; size_t data_size = 0 ; <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> ) ; } if ( ret > ( ssize_t ) data_size ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 <START_BUG> static int target_xcopy_locate_se_dev_e4 ( const unsigned char * dev_wwn, <END_BUG>  struct se_device * * found_dev ) <START_BUG> { <END_BUG> struct xcopy_dev_search_info info ;  int ret ; memset ( & info, 0, sizeof ( info ) ) ; info. dev_wwn = dev_wwn ; ret = target_for_each_device ( target_xcopy_locate_se_dev_e4_iter, & info ) ; if ( ret == 1 ) { * found_dev = info. found_dev ; return 0 ; <START_BUG> } else { <END_BUG> pr_debug_ratelimited ( "Unable   to   locate   0xe4   descriptor   for   EXTENDED_COPY\\n" ) ; return - EINVAL ; }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> int target_xcopy_locate_se_dev_e4 ( struct se_session * sess, <S2SV_ModStart> se_device * * _found_dev, struct percpu_ref * * _found_lun_ref <S2SV_ModEnd> ) { struct <S2SV_ModStart> ) { struct se_dev_entry * deve ; struct se_node_acl * nacl ; struct se_lun * this_lun = NULL ; struct se_device * found_dev = NULL ; if (! sess ) goto err_out ; pr_debug ( "XCOPY <S2SV_blank> 0xe4: <S2SV_blank> searching <S2SV_blank> for: <S2SV_blank> %*ph\\n", XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn ) ; nacl = sess -> se_node_acl ; rcu_read_lock ( ) ; hlist_for_each_entry_rcu ( deve, & nacl -> lun_entry_hlist, link ) { struct se_device * this_dev ; int rc ; this_lun = rcu_dereference ( deve -> se_lun ) ; this_dev = rcu_dereference_raw ( this_lun ->
Buggy code:
 struct vfsmount * collect_mounts ( struct path * path ) { struct mount * tree ; <START_BUG> namespace_lock ( ) ; <END_BUG> tree = copy_tree ( real_mount ( path -> mnt ), path -> dentry, CL_COPY_ALL | CL_PRIVATE ) ; namespace_unlock ( ) ; if ( IS_ERR ( tree ) ) return ERR_CAST ( tree ) ; return & tree -> mnt ; }

Fix:
<S2SV_ModStart> ( ) ; if (! check_mnt ( real_mount ( path -> mnt ) ) ) tree = ERR_PTR ( - EINVAL ) ; else
Buggy code:
 static void ext2_put_super ( struct super_block * sb ) { int db_count ; int i ; struct ext2_sb_info * sbi = EXT2_SB ( sb ) ; dquot_disable ( sb, - 1, DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED ) ; <START_BUG> ext2_xattr_put_super ( sb ) ; <END_BUG> if (! ( sb -> s_flags & MS_RDONLY ) ) { struct ext2_super_block * es = sbi -> s_es ; spin_lock ( & sbi -> s_lock ) ; es -> s_state = cpu_to_le16 ( sbi -> s_mount_state ) ; spin_unlock ( & sbi -> s_lock ) ; ext2_sync_super ( sb, es, 1 ) ; } db_count = sbi -> s_gdb_count ; for ( i = 0 ; i < db_count ; i ++ ) if ( sbi -> s_group_desc [ i ] ) brelse ( sbi -> s_group_desc [ i ] ) ; kfree ( sbi -> s_group_desc ) ; kfree ( sbi -> s_debts ) ; percpu_counter_destroy ( & sbi -> s_freeblocks_counter ) ; percpu_counter_destroy ( & sbi -> s_freeinodes_counter ) ; percpu_counter_destroy ( & sbi -> s_dirs_counter ) ; brelse ( sbi -> s_sbh ) ; sb -> s_fs_info = NULL ; kfree ( sbi -> s_blockgroup_lock ) ; kfree ( sbi ) ; }

Fix:
<S2SV_ModStart> DQUOT_LIMITS_ENABLED ) ; if ( sbi -> s_mb_cache ) { ext2_xattr_destroy_cache ( sbi -> s_mb_cache ) ; sbi -> s_mb_cache = NULL ; } <S2SV_ModEnd> if (!
Buggy code:
 static int xpm_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt ) { XPMDecContext * x = avctx -> priv_data ; AVFrame * p = data ; <START_BUG> const uint8_t * end, * ptr = avpkt -> data ; <END_BUG> int ncolors, cpp, ret, i, j ; int64_t size ; uint32_t * dst ; avctx -> pix_fmt = AV_PIX_FMT_BGRA ;  end = avpkt -> data + avpkt -> size ; <START_BUG> <END_BUG> while ( memcmp ( ptr, "", 9 ) && ptr < end - 9 )  ptr ++ ; if ( ptr >= end ) { av_log ( avctx, AV_LOG_ERROR, "missing   signature\\n" ) ; return AVERROR_INVALIDDATA ; } ptr += mod_strcspn ( ptr, "\\"" ) ; if ( sscanf ( ptr, "\\"%u   %u   %u   %u\\",", & avctx -> width, & avctx -> height, & ncolors, & cpp )!= 4 ) { av_log ( avctx, AV_LOG_ERROR, "missing   image   parameters\\n" ) ; return AVERROR_INVALIDDATA ; } if ( ( ret = ff_set_dimensions ( avctx, avctx -> width, avctx -> height ) ) < 0 ) return ret ; if ( ( ret = ff_get_buffer ( avctx, p, 0 ) ) < 0 ) return ret ; if ( cpp <= 0 || cpp >= 5 ) { av_log ( avctx, AV_LOG_ERROR, "unsupported//invalid   number   of   chars   per   pixel:   %d\\n", cpp ) ; return AVERROR_INVALIDDATA ; } size = 1 ; for ( i = 0 ; i < cpp ; i ++ ) <START_BUG> size *= 94 ; <END_BUG> if ( ncolors <= 0 || ncolors > size ) { av_log ( avctx, AV_LOG_ERROR, "invalid   number   of   colors:   %d\\n", ncolors ) ; return AVERROR_INVALIDDATA ; } size *= 4 ; av_fast_padded_malloc ( &

Fix:
<S2SV_ModStart>, * ptr <S2SV_ModEnd> ; int ncolors <S2SV_ModStart> = AV_PIX_FMT_BGRA ; av_fast_padded_malloc ( & x -> buf, & x -> buf_size, avpkt -> size ) ; if (! x -> buf ) return AVERROR ( ENOMEM ) ; memcpy ( x -> buf, avpkt -> data, avpkt -> size ) ; x -> buf [ avpkt -> size ] = 0 ; ptr = x -> buf ; end = x -> buf <S2SV_ModEnd> + avpkt -> <S2SV_ModStart> ; while ( end - ptr > 9 && <S2SV_ModStart>, 9 ) ) ptr ++ ; if ( end - ptr <= 9 <S2SV_ModEnd> ) { av_log <S2SV_ModStart> ) size *= 95 <S2SV_ModEnd> ; if ( <S2SV_ModStart> + 1 ; if ( end - ptr < 1 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> ; if ( end - ptr < cpp <S2SV_ModEnd> ) return AVERROR_INVALIDDATA <S2SV_ModStart> + 1 ; if ( end - ptr < 1 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> ] ) ; if ( end - ptr < 1 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> + 1 ; if ( end - ptr < 1 ) return AVERROR_INVALID
Buggy code:
 int SMB2_tcon ( const unsigned int xid, struct cifs_ses * ses, const char * tree, struct cifs_tcon * tcon, const struct nls_table * cp ) { struct smb2_tree_connect_req * req ; struct smb2_tree_connect_rsp * rsp = NULL ; struct kvec iov [ 2 ] ; int rc = 0 ; int resp_buftype ; int unc_path_len ; struct TCP_Server_Info * server ; __le16 * unc_path = NULL ; cifs_dbg ( FYI, "TCON\\n" ) ; if ( ( ses -> server ) && tree ) server = ses -> server ; else return - EIO ; if ( tcon && tcon -> bad_network_name ) return - ENOENT ; unc_path = kmalloc ( MAX_SHARENAME_LENGTH * 2, GFP_KERNEL ) ; if ( unc_path == NULL ) return - ENOMEM ; unc_path_len = cifs_strtoUTF16 ( unc_path, tree, strlen ( tree ), cp ) + 1 ; unc_path_len *= 2 ; if ( unc_path_len < 2 ) { kfree ( unc_path ) ; return - EINVAL ; } rc = small_smb2_init ( SMB2_TREE_CONNECT, tcon, ( void * * ) & req ) ; if ( rc ) { kfree ( unc_path ) ; return rc ; } if ( tcon == NULL ) { req -> hdr. SessionId = ses -> Suid ; } iov [ 0 ]. iov_base = ( char * ) req ; iov [ 0 ]. iov_len = get_rfc1002_length ( req ) + 4 - 1 ; req -> PathOffset = cpu_to_le16 ( sizeof ( struct smb2_tree_connect_req ) - 1 - 4 ) ; req -> PathLength = cpu_to_le16 ( unc_path_len - 2 ) ; iov [ 1 ]. iov_base = unc_path ; iov [ 1 ]. iov_len = unc_path_len ; inc_rfc1001_len ( req, unc_path_len - 1 ) ; rc = SendReceive2 ( xid, ses, iov,

Fix:
<S2SV_ModStart> tree ) ; if ( tcon )
Buggy code:
 __be32 ipv6_proxy_select_ident ( struct net * net, struct sk_buff * skb ) { <START_BUG> static u32 ip6_proxy_idents_hashrnd __read_mostly ; <END_BUG> struct in6_addr buf [ 2 ] ; struct in6_addr * addrs ; u32 id ; addrs = skb_header_pointer ( skb, skb_network_offset ( skb ) + offsetof ( struct ipv6hdr, saddr ), sizeof ( buf ), buf ) ; if (! addrs ) return 0 ;  net_get_random_once ( & ip6_proxy_idents_hashrnd, <START_BUG> sizeof ( ip6_proxy_idents_hashrnd ) ) ; <END_BUG> id = __ipv6_select_ident ( net, ip6_proxy_idents_hashrnd,  & addrs [ 1 ], & addrs [ 0 ] ) ; return htonl ( id ) ; }

Fix:
<S2SV_ModStart> skb ) { <S2SV_ModEnd> struct in6_addr buf <S2SV_ModStart> return 0 ; <S2SV_ModEnd> id = __ipv6_select_ident <S2SV_ModStart> ( net, <S2SV_ModEnd> & addrs [
Buggy code:
 static int evtchn_fifo_percpu_deinit ( unsigned int cpu ) { <START_BUG> __evtchn_fifo_handle_events ( cpu, true ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ( cpu, NULL <S2SV_ModEnd> ) ; return
Buggy code:
 static Image * ReadBMPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { BMPInfo bmp_info ; Image * image ; IndexPacket index ; MagickBooleanType status ; MagickOffsetType offset, start_position ; MemoryInfo * pixel_info ; register IndexPacket * indexes ; register PixelPacket * q ; register ssize_t i, x ; register unsigned char * p ; size_t bit, blue, bytes_per_line, green, length, red ; ssize_t count, y ; unsigned char magick [ 12 ], * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & bmp_info, 0, sizeof ( bmp_info ) ) ; bmp_info. ba_offset = 0 ; start_position = 0 ; count = ReadBlob ( image, 2, magick ) ; do { LongPixelPacket shift ; PixelPacket quantum_bits ; size_t profile_data, profile_size ; if ( bmp_info. ba_offset == 0 ) start_position = TellBlob ( image ) - 2 ; bmp_info. ba_offset = 0 ; while ( LocaleNCompare ( ( char * ) magick, "BA", 2 ) == 0 ) { bmp_info. file_size = ReadBlobLSBLong ( image ) ; bmp_info. ba_offset = ReadBlobLSBLong ( image ) ; bmp_info. offset_bits = ReadBlobLSBLong ( image ) ; count = ReadBlob ( image, 2, magick ) ; if ( count!= 2 ) break ; } if ( image -> debug!= MagickFalse ) ( void ) LogMag

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static int hmac_create ( struct crypto_template * tmpl, struct rtattr * * tb ) { struct shash_instance * inst ; struct crypto_alg * alg ; struct shash_alg * salg ; int err ; int ds ; int ss ; err = crypto_check_attr_type ( tb, CRYPTO_ALG_TYPE_SHASH ) ; if ( err ) return err ; salg = shash_attr_alg ( tb [ 1 ], 0, 0 ) ; if ( IS_ERR ( salg ) ) return PTR_ERR ( salg ) ; <START_BUG> err = - EINVAL ; <END_BUG>  ds = salg -> digestsize ; <START_BUG> <END_BUG> ss = salg -> statesize ;  alg = & salg -> base ; if ( ds > alg -> cra_blocksize || ss < alg -> cra_blocksize ) goto out_put_alg ; inst = shash_alloc_instance ( "hmac", alg ) ; err = PTR_ERR ( inst ) ; if ( IS_ERR ( inst ) ) goto out_put_alg ; err = crypto_init_shash_spawn ( shash_instance_ctx ( inst ), salg, shash_crypto_instance ( inst ) ) ; if ( err ) goto out_free_inst ; inst -> alg. base. cra_priority = alg -> cra_priority ; inst -> alg. base. cra_blocksize = alg -> cra_blocksize ; inst -> alg. base. cra_alignmask = alg -> cra_alignmask ; ss = ALIGN ( ss, alg -> cra_alignmask + 1 ) ; inst -> alg. digestsize = ds ; inst -> alg. statesize = ss ; inst -> alg. base. cra_ctxsize = sizeof ( struct hmac_ctx ) + ALIGN ( ss * 2, crypto_tfm_ctx_alignment ( ) ) ; inst -> alg. base. cra_init = hmac_init_tfm ; inst -> alg. base. cra_exit = hmac_exit_tfm ; inst -> alg. init = hmac_init ; inst -> alg. update = hmac_update ; inst -> alg. final = hmac_final ; inst -> alg. finup = hmac_finup ; inst -> alg. export = hmac_export ; inst -> alg. import =

Fix:
<S2SV_ModStart> salg ) ; alg = & salg -> base ; <S2SV_ModStart> - EINVAL ; if ( crypto_shash_alg_has_setkey ( salg ) ) goto out_put_alg ; <S2SV_ModStart> salg -> statesize <S2SV_ModEnd> ; if (
Buggy code:
 static int xwd_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt ) { AVFrame * p = data ; const uint8_t * buf = avpkt -> data ; int i, ret, buf_size = avpkt -> size ; uint32_t version, header_size, vclass, ncolors ; uint32_t xoffset, be, bpp, lsize, rsize ; uint32_t pixformat, pixdepth, bunit, bitorder, bpad ; uint32_t rgb [ 3 ] ; uint8_t * ptr ; GetByteContext gb ; if ( buf_size < XWD_HEADER_SIZE ) return AVERROR_INVALIDDATA ; bytestream2_init ( & gb, buf, buf_size ) ; header_size = bytestream2_get_be32u ( & gb ) ; version = bytestream2_get_be32u ( & gb ) ; if ( version!= XWD_VERSION ) { av_log ( avctx, AV_LOG_ERROR, "unsupported   version\\n" ) ; return AVERROR_INVALIDDATA ; } if ( buf_size < header_size || header_size < XWD_HEADER_SIZE ) { av_log ( avctx, AV_LOG_ERROR, "invalid   header   size\\n" ) ; return AVERROR_INVALIDDATA ; } pixformat = bytestream2_get_be32u ( & gb ) ; pixdepth = bytestream2_get_be32u ( & gb ) ; avctx -> width = bytestream2_get_be32u ( & gb ) ; avctx -> height = bytestream2_get_be32u ( & gb ) ; xoffset = bytestream2_get_be32u ( & gb ) ; be = bytestream2_get_be32u ( & gb ) ; bunit = bytestream2_get_be32u ( & gb ) ; bitorder = bytestream2_get_be32u ( & gb ) ; bpad = bytestream2_get_be32u ( & gb ) ; bpp = bytestream2_get_be32u ( & gb ) ; lsize = bytestream2_get

Fix:
<S2SV_ModStart> ; if ( bpp == 1 && <S2SV_ModStart> else if ( bpp == 8 &&