nus-yam/ex-repair huggingface dataset:
Buggy code:
 SYSCALL_DEFINE4 ( epoll_ctl, int, epfd, int, op, int, fd, struct epoll_event __user *, event ) { int error ; int did_lock_epmutex = 0 ; struct file * file, * tfile ; struct eventpoll * ep ; struct epitem * epi ; struct epoll_event epds ; error = - EFAULT ; if ( ep_op_has_event ( op ) && copy_from_user ( & epds, event, sizeof ( struct epoll_event ) ) ) goto error_return ; error = - EBADF ; file = fget ( epfd ) ; if (! file ) goto error_return ; tfile = fget ( fd ) ; if (! tfile ) goto error_fput ; error = - EPERM ; if (! tfile -> f_op ||! tfile -> f_op -> poll ) goto error_tgt_fput ; error = - EINVAL ; if ( file == tfile ||! is_file_epoll ( file ) ) goto error_tgt_fput ; ep = file -> private_data ; if ( op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL ) { mutex_lock ( & epmutex ) ; did_lock_epmutex = 1 ; } if ( op == EPOLL_CTL_ADD ) { if ( is_file_epoll ( tfile ) ) { error = - ELOOP ; <START_BUG> if ( ep_loop_check ( ep, tfile )!= 0 ) <END_BUG>  goto error_tgt_fput ; <START_BUG> } else list_add ( & tfile -> f_tfile_llink, & tfile_check_list ) ; } mutex_lock_nested ( & ep -> mtx, 0 ) ; epi = ep_find ( ep, tfile, fd ) ; error = - EINVAL ; switch ( op ) { case EPOLL_CTL_ADD : if (! epi ) { epds. events |= POLLERR | POLLHUP ; error = ep_insert ( ep, & epds, tfile, fd ) ; } else error = - EEXIST ; clear_tfile_check_list ( ) ; break ; case EPOLL_CTL_DEL :<END_BUG>

Fix:
<S2SV_ModStart>!= 0 ) { clear_tfile_check_list ( ) ; <S2SV_ModStart> goto error_tgt_fput ; }
Buggy code:
 void bit_write_UMC ( Bit_Chain * dat, BITCODE_UMC val ) { int i, j ; int negative ; unsigned char byte [ 5 ] ; BITCODE_UMC mask ; BITCODE_UMC value ; value = val ; mask = 0x0000007f ; for ( i = 4, j = 0 ; i >= 0 ; i --, j += 7 ) { byte [ i ] = ( unsigned char ) ( ( value & mask ) >> j ) ; byte [ i ] |= 0x80 ; mask = mask << 7 ; } for ( i = 0 ; i < 4 ; i ++ ) if ( byte [ i ] & 0x7f ) break ; <START_BUG> if ( byte [ i ] & 0x40 ) <END_BUG> i -- ; byte [ i ] &= 0x7f ; for ( j = 4 ; j >= i ; j -- ) bit_write_RC ( dat, byte [ j ] ) ; }

Fix:
<S2SV_ModStart> ] & 0x40 && i > 0
Buggy code:
 static struct cifsSesInfo * <START_BUG> cifs_find_smb_ses ( struct TCP_Server_Info * server, char * username ) <END_BUG> { struct list_head * tmp ; struct cifsSesInfo * ses ; write_lock ( & cifs_tcp_ses_lock ) ;  list_for_each ( tmp, & server -> smb_ses_list ) { <START_BUG> ses = list_entry ( tmp, struct cifsSesInfo, smb_ses_list ) ; <END_BUG> if ( strncmp ( ses -> userName, username, MAX_USERNAME_SIZE ) )  <START_BUG> continue ; <END_BUG> ++ ses -> ses_count ; write_unlock ( & cifs_tcp_ses_lock ) ; return ses ; } write_unlock ( & cifs_tcp_ses_lock ) ; return NULL ; }

Fix:
<S2SV_ModStart> * server, struct smb_vol * vol ) { <S2SV_ModEnd> struct cifsSesInfo * <S2SV_ModStart> cifs_tcp_ses_lock ) ; list_for_each_entry ( ses <S2SV_ModEnd>, & server <S2SV_ModStart> server -> smb_ses_list, smb_ses_list ) { switch ( server -> secType ) { case Kerberos : if ( vol -> linux_uid!= ses -> linux_uid ) continue ; break ; default : <S2SV_ModEnd> if ( strncmp <S2SV_ModStart> -> userName, vol -> <S2SV_ModStart> ) continue ; if ( strlen ( vol -> username )!= 0 && strncmp ( ses -> password, vol -> password, MAX_PASSWORD_SIZE ) ) continue ; }
Buggy code:
 int read_xattrs_from_disk ( int fd, struct squashfs_super_block * sBlk, int flag, long long * table_start ) { <START_BUG> int res, bytes, i, indexes, index_bytes, ids ; <END_BUG> long long * index, start, end ; struct squashfs_xattr_table id_table ; TRACE ( "read_xattrs_from_disk\\n" ) ; if ( sBlk -> xattr_id_table_start == SQUASHFS_INVALID_BLK ) return SQUASHFS_INVALID_BLK ; res = read_fs_bytes ( fd, sBlk -> xattr_id_table_start, sizeof ( id_table ), & id_table ) ; if ( res == 0 ) return 0 ; SQUASHFS_INSWAP_XATTR_TABLE ( & id_table ) ;  if ( flag ) { <START_BUG> * table_start = id_table. xattr_table_start ; <END_BUG> return id_table. xattr_ids ;  } ids = id_table. xattr_ids ; xattr_table_start = id_table. xattr_table_start ; index_bytes = SQUASHFS_XATTR_BLOCK_BYTES ( ids ) ; indexes = SQUASHFS_XATTR_BLOCKS ( ids ) ; index = malloc ( index_bytes ) ; if ( index == NULL ) MEM_ERROR ( ) ; <START_BUG> res = read_fs_bytes ( fd, sBlk -> xattr_id_table_start + sizeof ( id_table ), <END_BUG> index_bytes, index ) ; if ( res == 0 ) goto failed1 ; SQUASHFS_INSWAP_LONG_LONGS ( index, indexes ) ;  bytes = SQUASHFS_XATTR_BYTES ( ids ) ; <START_BUG> xattr_ids = malloc ( bytes ) ; if ( xattr_ids == NULL ) MEM_ERROR ( ) ; for ( i = 0 ; i < indexes ; i ++ ) { int expected = ( i + 1 )!= indexes? SQUASHFS_METADATA_SIZE : bytes & ( SQUASHFS_METADATA_SIZE - 1 ) ; int length = read_block ( fd, index [ i ], NULL, expected, ( ( unsigned char * ) xattr_ids ) + <END_BUG>

Fix:
<S2SV_ModStart> int res, i, indexes, index_bytes ; unsigned int ids ; long long bytes <S2SV_ModEnd> ; long long <S2SV_ModStart> id_table ) ; ids = id_table. xattr_ids ; xattr_table_start <S2SV_ModEnd> = id_table. <S2SV_ModStart>. xattr_table_start ; index_bytes = SQUASHFS_XATTR_BLOCK_BYTES ( ( long long ) ids ) ; indexes = SQUASHFS_XATTR_BLOCKS ( ( long long ) ids ) ; if ( index_bytes!= ( sBlk -> bytes_used - ( <S2SV_ModEnd> sBlk -> xattr_id_table_start <S2SV_ModStart> ( id_table ) ) ) ) { ERROR ( "read_xattrs_from_disk: <S2SV_blank> Bad <S2SV_blank> xattr_ids <S2SV_blank> count <S2SV_blank> in <S2SV_blank> super <S2SV_blank> block\\n" ) ; return 0 ; } if ( table_start!= NULL ) * table_start = id_table. xattr_table_start ; if ( flag ) return id_table. xattr_ids ; index = malloc ( index_bytes ) ; if ( index == NULL ) MEM_ERROR ( ) ; res = read_fs_bytes ( fd, sBlk -> x
Buggy code:
 static int mp_dss_print ( netdissect_options * ndo, const u_char * opt, u_int opt_len, u_char flags ) { const struct mp_dss * mdss = ( const struct mp_dss * ) opt ; <START_BUG> if ( ( opt_len!= mp_dss_len ( mdss, 1 ) && <END_BUG> opt_len!= mp_dss_len ( mdss, 0 ) ) || flags & TH_SYN ) return 0 ; if ( mdss -> flags & MP_DSS_F ) ND_PRINT ( ( ndo, "   fin" ) ) ; opt += 4 ;  if ( mdss -> flags & MP_DSS_A ) { <START_BUG> ND_PRINT ( ( ndo, "   ack   " ) ) ; <END_BUG> if ( mdss -> flags & MP_DSS_a ) {  ND_PRINT ( ( ndo, "%" PRIu64, EXTRACT_64BITS ( opt ) ) ) ; opt += 8 ; <START_BUG> } else { <END_BUG>  ND_PRINT ( ( ndo, "%u", EXTRACT_32BITS ( opt ) ) ) ; <START_BUG> opt += 4 ; <END_BUG> }  } if ( mdss -> flags & MP_DSS_M ) { ND_PRINT ( ( ndo, "   seq   " ) ) ; <START_BUG> if ( mdss -> flags & MP_DSS_m ) { <END_BUG> ND_PRINT ( ( ndo, "%" PRIu64, EXTRACT_64BITS ( opt ) ) ) ; opt += 8 ;  } else { <START_BUG> <END_BUG> ND_PRINT ( ( ndo, "%u", EXTRACT_32BITS ( opt ) ) ) ;  opt += 4 ; <START_BUG> } <END_BUG> ND_PRINT ( ( ndo, "   subseq   %u", EXTRACT_32BITS ( opt ) ) ) ; opt += 4 ;  ND_PRINT ( ( ndo, "   len   %u", EXTRACT_16BITS ( opt ) ) ) ; <START_BUG> opt += 2 ; <END_BUG> if ( opt_len == mp_dss_len ( mdss, 1 ) )  ND_PRINT ( ( ndo, "   csum   0x%x", EXTRACT_16BITS ( opt ) ) ) ; } return 1 ; }

Fix:
<S2SV_ModStart> ; if ( opt_len < 4 ) return 0 ; if ( <S2SV_ModEnd> flags & TH_SYN <S2SV_ModStart> += 4 ; opt_len -= 4 ; <S2SV_ModStart> MP_DSS_a ) { if ( opt_len < 8 ) return 0 ; <S2SV_ModStart> += 8 ; opt_len -= 8 ; <S2SV_ModStart> } else { if ( opt_len < 4 ) return 0 ; <S2SV_ModStart> += 4 ; opt_len -= 4 ; <S2SV_ModStart> MP_DSS_m ) { if ( opt_len < 8 ) return 0 ; <S2SV_ModStart> += 8 ; opt_len -= 8 ; <S2SV_ModStart> } else { if ( opt_len < 4 ) return 0 ; <S2SV_ModStart> += 4 ; opt_len -= 4 ; } if ( opt_len < 4 ) return 0 ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> += 4 ; opt_len -= 4 ; if ( opt_len < 2 ) return 0 ; <S2SV_ModStart> += 2 ; opt_len -= 2 ; if ( opt_len >= 2 ) { ND_PRINT ( ( ndo, " <S2SV_blank> csum <S2SV_blank> 0x%x", EXTRACT_16BITS ( opt ) ) ) ; opt_len -= 2 ; } } if ( opt_len!= 0 )
Buggy code:
 static int check_options ( int argc, char * * argv, char * operation ) { int i = 0 ; int num_found = 0 ; char config_file [ FN_REFLEN ] ; char plugin_name [ FN_REFLEN ] ; const char * basedir_prefix = "--basedir=" ; int basedir_len = strlen ( basedir_prefix ) ; const char * datadir_prefix = "--datadir=" ; int datadir_len = strlen ( datadir_prefix ) ; const char * plugin_dir_prefix = "--plugin_dir=" ; int plugin_dir_len = strlen ( plugin_dir_prefix ) ; strcpy ( plugin_name, "" ) ; for ( i = 0 ; i < argc && num_found < 5 ; i ++ ) { if (! argv [ i ] ) { continue ; } if ( ( strcasecmp ( argv [ i ], "ENABLE" ) == 0 ) || ( strcasecmp ( argv [ i ], "DISABLE" ) == 0 ) ) { strcpy ( operation, argv [ i ] ) ; num_found ++ ; } else if ( ( strncasecmp ( argv [ i ], basedir_prefix, basedir_len ) == 0 ) &&! opt_basedir ) { opt_basedir = my_strndup ( argv [ i ] + basedir_len, strlen ( argv [ i ] ) - basedir_len, MYF ( MY_FAE ) ) ; num_found ++ ; } else if ( ( strncasecmp ( argv [ i ], datadir_prefix, datadir_len ) == 0 ) &&! opt_datadir ) { opt_datadir = my_strndup ( argv [ i ] + datadir_len, strlen ( argv [ i ] ) - datadir_len, MYF ( MY_FAE ) ) ; num_found ++ ; } else if ( ( strncasecmp ( argv [ i ], plugin_dir_prefix, plugin_dir_len ) == 0 ) &&! opt_plugin_dir ) { opt_plugin_dir = my_strndup ( argv [ i ] + plugin_dir_len, strlen ( argv [ i ] ) - plugin_dir_len, MYF ( MY_FAE ) ) ; num_found ++ ; } else { <START_BUG> strcpy ( plugin_name, argv [ i ] ) ; <END_BUG>

Fix:
<S2SV_ModStart> } else { if ( strlen ( argv [ i ] ) + 4 + 1 > FN_REFLEN ) { fprintf ( stderr, "ERROR: <S2SV_blank> argument <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long.\\n" ) ; return 1 ; }
Buggy code:
 generic_ret * create_principal3_2_svc ( cprinc3_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, service_name ; <END_BUG> OM_uint32 minor_stat ; kadm5_server_handle_t handle ; restriction_t * rp ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> rec. principal, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_ADD, arg -> rec. principal, & rp ) || kadm5int_acl_impose_restrictions ( handle -> context, & arg -> rec, & arg -> mask, rp ) ) { ret. code = KADM5_AUTH_ADD ; log_unauth ( "kadm5_create_principal", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_create_principal_3 ( ( void * ) handle, & arg -> rec, arg -> mask, arg -> n_ks_tuple, arg -> ks_tuple, arg -> passwd ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_create_principal", prime_arg, errmsg, & client_name, & service_name, rqstp

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static void input_csi_dispatch_sgr_colon ( struct input_ctx * ictx, u_int i ) { struct grid_cell * gc = & ictx -> cell. cell ; char * s = ictx -> param_list [ i ]. str, * copy, * ptr, * out ; int p [ 8 ] ; u_int n ; const char * errstr ; for ( n = 0 ; n < nitems ( p ) ; n ++ ) p [ n ] = - 1 ; n = 0 ; ptr = copy = xstrdup ( s ) ; while ( ( out = strsep ( & ptr, ":" ) )!= NULL ) { if ( * out!= '\\0' ) { p [ n ++ ] = strtonum ( out, 0, INT_MAX, & errstr ) ; if ( errstr!= NULL || n == nitems ( p ) ) { free ( copy ) ; return ; } <START_BUG> } else <END_BUG>  n ++ ; <START_BUG> log_debug ( "%s:   %u   =   %d", __func__, n - 1, p [ n - 1 ] ) ; } free ( copy ) ; if ( n == 0 ) return ; if ( p [ 0 ] == 4 ) { if ( n!= 2 ) return ; switch ( p [ 1 ] ) { case 0 : gc -> attr &= ~ GRID_ATTR_ALL_UNDERSCORE ; break ; case 1 : gc -> attr &= ~ GRID_ATTR_ALL_UNDERSCORE ; gc -> attr |= GRID_ATTR_UNDERSCORE ; break ; case 2 : gc -> attr &= ~ GRID_ATTR_ALL_UNDERSCORE ; gc -> attr |= GRID_ATTR_UNDERSCORE_2 ; break ; case 3 : gc -> attr &= ~ GRID_ATTR_ALL_UNDERSCORE ; gc -> attr |= GRID_ATTR_UNDERSCORE_3 ; break ; case 4 : gc -> attr &= ~ GRID_ATTR_ALL_UNDERSCORE ; gc -> attr |= GRID_ATTR_UNDERSCORE_4 ; break ; case 5 : gc -> attr &= ~ GRID_ATTR_ALL_UNDERSCORE ; gc -> attr |= GRID_ATTR_UNDERSCORE_5 ; break ; } return ; } if ( n < 2 || ( p [ 0 ]!= 38 && p [ 0 ]!= 48 && p [ 0 ]!= 58 ) ) return ; switch ( p<END_BUG>

Fix:
<S2SV_ModStart> } } else { <S2SV_ModStart> n ++ ; if ( n == nitems ( p ) ) { free ( copy ) ; return ; } }
Buggy code:
 <START_BUG> static int mptctl_do_reset ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_diag_reset __user * urinfo = ( void __user * ) arg ;  struct mpt_ioctl_diag_reset krinfo ; <START_BUG> MPT_ADAPTER * iocp ; if ( copy_from_user ( & krinfo, urinfo, sizeof ( struct mpt_ioctl_diag_reset ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_do_reset   -   " "Unable   to   copy   mpt_ioctl_diag_reset   struct   @   %p\\n", __FILE__, __LINE__, urinfo ) ; <END_BUG> return - EFAULT ;  } if ( mpt_verify_adapter ( krinfo. hdr. iocnum, & iocp ) < 0 ) { printk ( KERN_DEBUG MYNAM "%s@%d::mptctl_do_reset   -   ioc%d   not   found!\\n", __FILE__, __LINE__, krinfo. hdr. iocnum ) ; return - ENODEV ; } dctlprintk ( iocp, printk ( MYIOC_s_DEBUG_FMT "mptctl_do_reset   called.\\n", iocp -> name ) ) ; if ( mpt_HardResetHandler ( iocp, CAN_SLEEP )!= 0 ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_do_reset   -   reset   failed.\\n", iocp -> name, __FILE__, __LINE__ ) ; return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> int mptctl_do_reset ( MPT_ADAPTER * iocp, <S2SV_ModStart> struct mpt_ioctl_diag_reset krinfo <S2SV_ModEnd> ; if ( <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; } dctlprintk
Buggy code:
 static struct mount * clone_mnt ( struct mount * old, struct dentry * root, int flag ) { struct super_block * sb = old -> mnt. mnt_sb ; struct mount * mnt ; int err ; mnt = alloc_vfsmnt ( old -> mnt_devname ) ; if (! mnt ) return ERR_PTR ( - ENOMEM ) ; if ( flag & ( CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE ) ) mnt -> mnt_group_id = 0 ; else mnt -> mnt_group_id = old -> mnt_group_id ; if ( ( flag & CL_MAKE_SHARED ) &&! mnt -> mnt_group_id ) { err = mnt_alloc_group_id ( mnt ) ; if ( err ) goto out_free ; } mnt -> mnt. mnt_flags = old -> mnt. mnt_flags & ~ ( MNT_WRITE_HOLD | MNT_MARKED ) ; <START_BUG> if ( ( flag & CL_UNPRIVILEGED ) && ( mnt -> mnt. mnt_flags & MNT_READONLY ) ) <END_BUG> mnt -> mnt. mnt_flags |= MNT_LOCK_READONLY ;  if ( ( flag & CL_UNPRIVILEGED ) && list_empty ( & old -> mnt_expire ) ) <START_BUG> mnt -> mnt. mnt_flags |= MNT_LOCKED ; atomic_inc ( & sb -> s_active ) ; mnt -> mnt. mnt_sb = sb ; mnt -> mnt. mnt_root = dget ( root ) ; mnt -> mnt_mountpoint = mnt -> mnt. mnt_root ; mnt -> mnt_parent = mnt ; lock_mount_hash ( ) ; list_add_tail ( & mnt -> mnt_instance, & sb -> s_mounts ) ; unlock_mount_hash ( ) ; if ( ( flag & CL_SLAVE ) || ( ( flag & CL_SHARED_TO_SLAVE ) && IS_MNT_SHARED ( old ) ) ) { list_add ( & mnt -> mnt_slave, & old -> mnt_slave_list<END_BUG>

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> flag & CL_UNPRIVILEGED <S2SV_ModStart> & CL_UNPRIVILEGED ) { mnt -> mnt. mnt_flags |= MNT_LOCK_ATIME ; if <S2SV_ModEnd> ( mnt -> <S2SV_ModStart> mnt_flags & MNT_READONLY <S2SV_ModEnd> ) mnt -> <S2SV_ModStart> ; if ( mnt -> mnt. mnt_flags & MNT_NODEV ) mnt -> mnt. mnt_flags |= MNT_LOCK_NODEV ; if ( mnt -> mnt. mnt_flags & MNT_NOSUID ) mnt -> mnt. mnt_flags |= MNT_LOCK_NOSUID ; if ( mnt -> mnt. mnt_flags & MNT_NOEXEC ) mnt -> mnt. mnt_flags |= MNT_LOCK_NOEXEC ; } if (
Buggy code:
 int ParseDsdiffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t infilesize, total_samples ; DFFFileHeader dff_file_header ; DFFChunkHeader dff_chunk_header ; uint32_t bcount ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & dff_file_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & dff_file_header ) + 4, sizeof ( DFFFileHeader ) - 4, & bcount ) || bcount!= sizeof ( DFFFileHeader ) - 4 ) || strncmp ( dff_file_header. formType, "DSD   ", 4 ) ) { error_line ( "%s   is   not   a   valid  .DFF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & dff_file_header, sizeof ( DFFFileHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackBigEndianToNative ( & dff_file_header, DFFFileHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && dff_file_header. ckDataSize && dff_file_header. ckDataSize + 1 && dff_file_header. ckDataSize + 12!= infilesize ) { error_line ( "%s   is   not   a   valid  .DFF   file   (by   total   size)!", infilename ) ; return WAVPACK_SOFT_ERROR ; } if ( debug_logging_mode ) error_line ( "file   header   indicated   length   =   %lld", dff_file_header. ckDataSize ) ; # endif while ( 1 ) { if (! DoReadFile ( infile, & dff_chunk_header, sizeof ( DFFChunkHeader ), & bcount ) ||

Fix:
<S2SV_ModStart> { char * prop_chunk ; if ( dff_chunk_header. ckDataSize < 4 || dff_chunk_header. ckDataSize > 1024 ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.DFF <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } if ( debug_logging_mode ) error_line ( "got <S2SV_blank> PROP <S2SV_blank> chunk <S2SV_blank> of <S2SV_blank> %d <S2SV_blank> bytes <S2SV_blank> total", ( int ) dff_chunk_header. ckDataSize ) ;
Buggy code:
 int modbus_reply ( modbus_t * ctx, const uint8_t * req, int req_length, modbus_mapping_t * mb_mapping ) { int offset ; int slave ; int function ; uint16_t address ; uint8_t rsp [ MAX_MESSAGE_LENGTH ] ; int rsp_length = 0 ; sft_t sft ; if ( ctx == NULL ) { errno = EINVAL ; return - 1 ; } offset = ctx -> backend -> header_length ; slave = req [ offset - 1 ] ; function = req [ offset ] ; address = ( req [ offset + 1 ] << 8 ) + req [ offset + 2 ] ; sft. slave = slave ; sft. function = function ; sft. t_id = ctx -> backend -> prepare_response_tid ( req, & req_length ) ; switch ( function ) { case MODBUS_FC_READ_COILS : case MODBUS_FC_READ_DISCRETE_INPUTS : { unsigned int is_input = ( function == MODBUS_FC_READ_DISCRETE_INPUTS ) ; int start_bits = is_input? mb_mapping -> start_input_bits : mb_mapping -> start_bits ; int nb_bits = is_input? mb_mapping -> nb_input_bits : mb_mapping -> nb_bits ; uint8_t * tab_bits = is_input? mb_mapping -> tab_input_bits : mb_mapping -> tab_bits ; const char * const name = is_input? "read_input_bits" : "read_bits" ; int nb = ( req [ offset + 3 ] << 8 ) + req [ offset + 4 ] ; int mapping_address = address - start_bits ; if ( nb < 1 || MODBUS_MAX_READ_BITS < nb ) { rsp_length = response_exception ( ctx, & sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE, "Illegal   nb   of   values   %d   in   %s   (max   %d)\\n", nb, name, MODBUS_MAX_READ_BITS ) ; } else if ( mapping_address < 0 || ( mapping_address + nb ) > nb_bits ) { rsp_length =

Fix:
<S2SV_ModStart> ] ; int nb_bits = req [ offset + 5 ] ; int <S2SV_ModStart> MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb <S2SV_ModStart> offset + 4 ] ; int nb_bytes = req [ offset + 5 <S2SV_ModStart> 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8
Buggy code:
 rfbClient * rfbGetClient ( int bitsPerSample, int samplesPerPixel, int bytesPerPixel ) { # ifdef WIN32 WSADATA unused ; # endif rfbClient * client = ( rfbClient * ) calloc ( sizeof ( rfbClient ), 1 ) ; if (! client ) { rfbClientErr ( "Couldn\'t   allocate   client   structure!\\n" ) ; return NULL ; } # ifdef WIN32 if ( ( errno = WSAStartup ( MAKEWORD ( 2, 0 ), & unused ) )!= 0 ) { rfbClientErr ( "Could   not   init   Windows   Sockets:   %s\\n", strerror ( errno ) ) ; return NULL ; } # endif initAppData ( & client -> appData ) ; client -> endianTest = 1 ; client -> programName = "" ; client -> serverHost = strdup ( "" ) ; client -> serverPort = 5900 ; client -> destHost = NULL ; client -> destPort = 5900 ; <START_BUG> client -> connectTimeout = DEFAULT_CONNECT_TIMEOUT ; <END_BUG> client -> CurrentKeyboardLedState = 0 ; client -> HandleKeyboardLedState = ( HandleKeyboardLedStateProc ) DummyPoint ; client -> updateRect. x = - 1 ; client -> frameBuffer = NULL ; client -> outputWindow = 0 ; client -> format. bitsPerPixel = bytesPerPixel * 8 ; client -> format. depth = bitsPerSample * samplesPerPixel ; client -> appData. requestedDepth = client -> format. depth ; client -> format. bigEndian = * ( char * ) & client -> endianTest? FALSE : TRUE ; client -> format. trueColour = 1 ; if ( client -> format. bitsPerPixel == 8 ) { client -> format. redMax = 7 ; client -> format. greenMax = 7 ; client -> format. blueMax = 3 ; client -> format. redShift = 0 ; client -> format. greenShift = 3 ; client -> format. blueShift = 6 ; } else { client -> format. redMax = ( 1 << bitsPerSample ) - 1 ; client -> format. greenMax = ( 1 << bitsPerSample ) - 1 ; client -> format. blueMax = ( 1 << bitsPerSample ) - 1 ; if (! client -> format. bigEndian ) { client -> format. redShift = 0 ; client -> format. greenShift = bitsPer

Fix:
<S2SV_ModStart> connectTimeout = DEFAULT_CONNECT_TIMEOUT ; client -> readTimeout = DEFAULT_READ_TIMEOUT
Buggy code:
 <START_BUG> void exit_io_context ( void ) <END_BUG> { struct io_context * ioc ;  task_lock ( current ) ; <START_BUG> <END_BUG> ioc = current -> io_context ;  <START_BUG> current -> io_context = NULL ; <END_BUG>  task_unlock ( current ) ; <START_BUG> if ( atomic_dec_and_test ( & ioc -> nr_tasks ) ) { if ( ioc -> aic && ioc -> aic -> exit ) ioc -> aic -> exit ( ioc -> aic ) ; cfq_exit ( ioc ) ; } put_io_context ( ioc ) ; }<END_BUG>

Fix:
<S2SV_ModStart> void exit_io_context ( struct task_struct * task <S2SV_ModEnd> ) { struct <S2SV_ModStart> ; task_lock ( task <S2SV_ModEnd> ) ; ioc <S2SV_ModStart> ; ioc = task <S2SV_ModEnd> -> io_context ; <S2SV_ModStart> -> io_context ; task <S2SV_ModEnd> -> io_context = <S2SV_ModStart> ; task_unlock ( task <S2SV_ModEnd> ) ; if
Buggy code:
 static void ov511_mode_init_regs ( struct sd * sd ) { struct gspca_dev * gspca_dev = ( struct gspca_dev * ) sd ; int hsegs, vsegs, packet_size, fps, needed ; int interlaced = 0 ; struct usb_host_interface * alt ; struct usb_interface * intf ; intf = usb_ifnum_to_if ( sd -> gspca_dev. dev, sd -> gspca_dev. iface ) ; alt = usb_altnum_to_altsetting ( intf, sd -> gspca_dev. alt ) ; if (! alt ) { gspca_err ( gspca_dev, "Couldn\'t   get   altsetting\\n" ) ; <START_BUG> sd -> gspca_dev. usb_err = - EIO ; <END_BUG> return ; } packet_size = le16_to_cpu ( alt -> endpoint [ 0 ]. desc. wMaxPacketSize ) ; reg_w ( sd, R51x_FIFO_PSIZE, packet_size >> 5 ) ; reg_w ( sd, R511_CAM_UV_EN, 0x01 ) ; reg_w ( sd, R511_SNAP_UV_EN, 0x01 ) ; reg_w ( sd, R511_SNAP_OPTS, 0x03 ) ; hsegs = ( sd -> gspca_dev. pixfmt. width >> 3 ) - 1 ; vsegs = ( sd -> gspca_dev. pixfmt. height >> 3 ) - 1 ; reg_w ( sd, R511_CAM_PXCNT, hsegs ) ; reg_w ( sd, R511_CAM_LNCNT, vsegs ) ; reg_w ( sd, R511_CAM_PXDIV, 0x00 ) ; reg_w ( sd, R511_CAM_LNDIV, 0x00 ) ; reg_w ( sd, R511_CAM_OPTS, 0x03 ) ; reg_w ( sd, R511_SNAP_PXCNT, hsegs ) ; reg_w ( sd, R511_SNAP_LNCNT, v

Fix:
<S2SV_ModStart> = - EIO ; return ; } if ( alt -> desc. bNumEndpoints < 1 ) { sd -> gspca_dev. usb_err = - ENODEV
Buggy code:
 static int netlink_sendmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len ) { struct sock_iocb * siocb = kiocb_to_siocb ( kiocb ) ; struct sock * sk = sock -> sk ; struct netlink_sock * nlk = nlk_sk ( sk ) ; struct sockaddr_nl * addr = msg -> msg_name ; u32 dst_pid ; u32 dst_group ; struct sk_buff * skb ; int err ; struct scm_cookie scm ; if ( msg -> msg_flags & MSG_OOB ) return - EOPNOTSUPP ; if ( NULL == siocb -> scm ) siocb -> scm = & scm ; err = scm_send ( sock, msg, siocb -> scm, true ) ; if ( err < 0 ) return err ; if ( msg -> msg_namelen ) { err = - EINVAL ; if ( addr -> nl_family!= AF_NETLINK ) goto out ; dst_pid = addr -> nl_pid ; dst_group = ffs ( addr -> nl_groups ) ; err = - EPERM ; <START_BUG> if ( dst_group &&! netlink_capable ( sock, NL_NONROOT_SEND ) ) <END_BUG> goto out ; } else { dst_pid = nlk -> dst_pid ; dst_group = nlk -> dst_group ; } if (! nlk -> pid ) { err = netlink_autobind ( sock ) ; if ( err ) goto out ; } err = - EMSGSIZE ; if ( len > sk -> sk_sndbuf - 32 ) goto out ; err = - ENOBUFS ; skb = alloc_skb ( len, GFP_KERNEL ) ; if ( skb == NULL ) goto out ; NETLINK_CB ( skb ). pid = nlk -> pid ; NETLINK_CB ( skb ). dst_group = dst_group ; memcpy ( NETLINK_CREDS ( skb ), & siocb -> scm -> creds, sizeof ( struct ucred ) ) ; err = - EFAULT ; if ( memcpy_fromiovec ( skb_put ( skb, len ), msg -> msg_iov, len ) ) { k

Fix:
<S2SV_ModStart> ; if ( ( dst_group || dst_pid ) <S2SV_ModEnd> &&! netlink_capable
Buggy code:
 int vt_reset_keyboard ( int fd ) { <START_BUG> int kb ; <END_BUG>  kb = vt_default_utf8 ( )!= 0? K_UNICODE : K_XLATE ; <START_BUG> if ( ioctl ( fd, KDSKBMODE, kb ) < 0 ) return - errno ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> { int kb, r <S2SV_ModStart> K_UNICODE : K_XLATE ; r = vt_verify_kbmode ( fd ) ; if ( r == - EBUSY ) { log_debug_errno ( r, "Keyboard <S2SV_blank> is <S2SV_blank> not <S2SV_blank> in <S2SV_blank> XLATE <S2SV_blank> or <S2SV_blank> UNICODE <S2SV_blank> mode, <S2SV_blank> not <S2SV_blank> resetting: <S2SV_blank> %m" ) ; return 0 ; } else if ( r < 0 ) return r
Buggy code:
 int oidc_oauth_check_userid ( request_rec * r, oidc_cfg * c ) { if (! ap_is_initial_req ( r ) ) { if ( r -> main!= NULL ) r -> user = r -> main -> user ; else if ( r -> prev!= NULL ) r -> user = r -> prev -> user ; if ( r -> user!= NULL ) { oidc_debug ( r, "recycling   user   \'%s\'   from   initial   request   for   sub-request", r -> user ) ; return OK ; } } else if ( ( c -> redirect_uri!= NULL ) && ( oidc_util_request_matches_url ( r, c -> redirect_uri ) ) ) { if ( oidc_util_request_has_parameter ( r, "jwks" ) ) { return oidc_handle_jwks ( r, c ) ; } } const char * access_token = NULL ; if ( oidc_oauth_get_bearer_token ( r, & access_token ) == FALSE ) return oidc_oauth_return_www_authenticate ( r, "invalid_request", "No   bearer   token   found   in   the   request" ) ; json_t * token = NULL ; char * s_token = NULL ; if ( c -> oauth. introspection_endpoint_url!= NULL ) { if ( oidc_oauth_resolve_access_token ( r, c, access_token, & token, & s_token ) == FALSE ) return oidc_oauth_return_www_authenticate ( r, "invalid_token", "Reference   token   could   not   be   introspected" ) ; } else { if ( oidc_oauth_validate_jwt_access_token ( r, c, access_token, & token, & s_token ) == FALSE ) return oidc_oauth_return_www_authenticate ( r, "invalid_token", "JWT   token   could   not   be   validated" ) ; } if ( token == NULL ) { oidc_error ( r, "could   not   resolve   claims   (token   ==   NULL)" ) ; return oidc_oauth_return_www_authenticate ( r, "invalid_token", "No  

Fix:
<S2SV_ModStart> ) ; } oidc_scrub_headers ( r ) ;
Buggy code:
 static VALUE ossl_cipher_init ( int argc, VALUE * argv, VALUE self, int mode ) { EVP_CIPHER_CTX * ctx ; unsigned char key [ EVP_MAX_KEY_LENGTH ], * p_key = NULL ; unsigned char iv [ EVP_MAX_IV_LENGTH ], * p_iv = NULL ; VALUE pass, init_v ; if ( rb_scan_args ( argc, argv, "02", & pass, & init_v ) > 0 ) { VALUE cname = rb_class_path ( rb_obj_class ( self ) ) ; rb_warn ( "arguments   for   %" PRIsVALUE "#encrypt   and   %" PRIsVALUE "#decrypt   were   deprecated;   " "use   %" PRIsVALUE "#pkcs5_keyivgen   to   derive   key   and   IV", cname, cname, cname ) ; StringValue ( pass ) ; GetCipher ( self, ctx ) ; if ( NIL_P ( init_v ) ) memcpy ( iv, "OpenSSL   for   Ruby   rulez!", sizeof ( iv ) ) ; else { StringValue ( init_v ) ; if ( EVP_MAX_IV_LENGTH > RSTRING_LEN ( init_v ) ) { memset ( iv, 0, EVP_MAX_IV_LENGTH ) ; memcpy ( iv, RSTRING_PTR ( init_v ), RSTRING_LEN ( init_v ) ) ; } else memcpy ( iv, RSTRING_PTR ( init_v ), sizeof ( iv ) ) ; } EVP_BytesToKey ( EVP_CIPHER_CTX_cipher ( ctx ), EVP_md5 ( ), iv, ( unsigned char * ) RSTRING_PTR ( pass ), RSTRING_LENINT ( pass ), 1, key, NULL ) ; p_key = key ; p_iv = iv ; } else { GetCipher ( self, ctx ) ; } if ( EVP_CipherInit_ex ( ctx, NULL, NULL, p_key, p_iv, mode )!= 1 ) { ossl_raise ( eCipherError, NULL ) ; } <START_BUG> return self ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; } if ( p_key ) rb_ivar_set ( self, id_key_set, Qtrue ) ;
Buggy code:
 static ssize_t _hostsock_recvmsg ( oe_fd_t * sock_, struct oe_msghdr * msg, int flags ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_errno = 0 ; void * buf = NULL ; <START_BUG> size_t buf_size = 0 ; <END_BUG> if (! sock ||! msg || ( msg -> msg_iovlen &&! msg -> msg_iov ) ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( msg -> msg_iov, ( int ) msg -> msg_iovlen, & buf, & buf_size )!= 0 ) <START_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ; <END_BUG> {  if ( oe_syscall_recvmsg_ocall ( & ret, sock -> host_fd, msg -> msg_name, msg -> msg_namelen, <START_BUG> & msg -> msg_namelen, <END_BUG> buf, msg -> msg_iovlen, buf_size, msg -> msg_control, msg -> msg_controllen,  & msg -> msg_controllen, <START_BUG> flags )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } if ( ret == - 1 ) OE_RAISE_ERRNO ( oe_errno ) ; } <END_BUG> if ( oe_iov_sync ( msg -> msg_iov, ( int ) msg -> msg_iovlen, buf, buf_size )!= 0 )  OE_RAISE_ERRNO ( OE_EINVAL ) ; done : if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> ; size_t buf_size = 0 ; size_t data_size = 0 ; oe_socklen_t namelen_out = 0 ; size_t controllen_out <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL ) ; <S2SV_ModStart> msg_namelen, & namelen_out <S2SV_ModEnd>, buf, <S2SV_ModStart> msg_controllen, & controllen_out <S2SV_ModEnd>, flags ) <S2SV_ModStart> } if (! msg -> msg_name ) msg -> msg_namelen = 0 ; else { if ( namelen_out > sizeof ( struct oe_sockaddr_storage ) ) OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( msg -> msg_namelen >= namelen_out ) msg -> msg_namelen = namelen_out ; } if (! msg -> msg_control ) msg -> msg_controllen = 0 ; else { if ( msg -> msg_controllen >= controllen_out ) msg ->
Buggy code:
 <START_BUG> static void encode_txfm_probs ( VP9_COMMON * cm, vp9_writer * w ) { <END_BUG> vp9_write_literal ( w, MIN ( cm -> tx_mode, ALLOW_32X32 ), 2 ) ; if ( cm -> tx_mode >= ALLOW_32X32 )  vp9_write_bit ( w, cm -> tx_mode == TX_MODE_SELECT ) ; <START_BUG> if ( cm -> tx_mode == TX_MODE_SELECT ) { int i, j ; unsigned int ct_8x8p [ TX_SIZES - 3 ] [ 2 ] ; unsigned int ct_16x16p [ TX_SIZES - 2 ] [ 2 ] ; unsigned int ct_32x32p [ TX_SIZES - 1 ] [ 2 ] ; for ( i = 0 ; i < TX_SIZE_CONTEXTS ; i ++ ) { <END_BUG> tx_counts_to_branch_counts_8x8 ( cm -> counts. tx. p8x8 [ i ], ct_8x8p ) ;  for ( j = 0 ; j < TX_SIZES - 3 ; j ++ ) <START_BUG> vp9_cond_prob_diff_update ( w, & cm -> fc. tx_probs. p8x8 [ i ] [ j ], ct_8x8p [ j ] ) ; <END_BUG> } for ( i = 0 ; i < TX_SIZE_CONTEXTS ; i ++ ) {  tx_counts_to_branch_counts_16x16 ( cm -> counts. tx. p16x16 [ i ], ct_16x16p ) ; <START_BUG> for ( j = 0 ; j < TX_SIZES - 2 ; j ++ ) <END_BUG> vp9_cond_prob_diff_update ( w, & cm -> fc. tx_probs. p16x16 [ i ] [ j ],  ct_16x16p [ j ] ) ; } for ( i = 0 ; i < TX_SIZE_CONTEXTS ; i ++ ) { <START_BUG> tx_counts_to_branch_counts_32x32 ( cm -> counts. tx. p32x32 [ i ], ct_32x32p ) ; <END_BUG> for ( j = 0 ; j < TX_SIZES - 1 ; j ++ )  vp9_cond_prob_diff_update ( w,

Fix:
<S2SV_ModStart> * cm, vpx_writer * w, FRAME_COUNTS * counts ) { vpx_write_literal <S2SV_ModEnd> ( w, <S2SV_ModStart> >= ALLOW_32X32 ) vpx_write_bit <S2SV_ModEnd> ( w, <S2SV_ModStart> { tx_counts_to_branch_counts_8x8 ( counts -> <S2SV_ModEnd> tx. p8x8 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> tx_probs. p8x8 <S2SV_ModStart> { tx_counts_to_branch_counts_16x16 ( counts -> <S2SV_ModEnd> tx. p16x16 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> tx_probs. p16x16 <S2SV_ModStart> { tx_counts_to_branch_counts_32x32 ( counts -> <S2SV_ModEnd> tx. p32x32 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> tx_probs. p32x32
Buggy code:
 static void child_setup_func ( gpointer user_data ) { ChildSetupData * data = ( ChildSetupData * ) user_data ; FdMapEntry * fd_map = data -> fd_map ; sigset_t set ; int i ; flatpak_close_fds_workaround ( 3 ) ; if ( data -> instance_id_fd!= - 1 ) <START_BUG> drop_cloexec ( data -> instance_id_fd ) ; <END_BUG> sigemptyset ( & set ) ; if ( pthread_sigmask ( SIG_SETMASK, & set, NULL ) == - 1 ) { g_warning ( "Failed   to   unblock   signals   when   starting   child" ) ; return ; } for ( i = 1 ; i < NSIG ; i ++ ) { if ( i!= SIGSTOP && i!= SIGKILL ) signal ( i, SIG_DFL ) ; } for ( i = 0 ; i < data -> fd_map_len ; i ++ ) { if ( fd_map [ i ]. from!= fd_map [ i ]. to ) { dup2 ( fd_map [ i ]. from, fd_map [ i ]. to ) ; close ( fd_map [ i ]. from ) ; } } for ( i = 0 ; i < data -> fd_map_len ; i ++ ) { if ( fd_map [ i ]. to!= fd_map [ i ]. final ) { dup2 ( fd_map [ i ]. to, fd_map [ i ]. final ) ; close ( fd_map [ i ]. to ) ; } drop_cloexec ( fd_map [ i ]. final ) ; } setsid ( ) ; setpgid ( 0, 0 ) ; if ( data -> set_tty ) { for ( i = 0 ; i < data -> fd_map_len ; i ++ ) { if ( fd_map [ i ]. from == data -> tty ) { if ( ioctl ( fd_map [ i ]. final, TIOCSCTTY, 0 ) == - 1 ) g_debug ( "ioctl(%d,   TIOCSCTTY,   0)   failed:   %s", fd_map [ i ]. final, strerror ( errno ) ) ; break ; } } } }

Fix:
<S2SV_ModStart> data -> instance_id_fd ) ; if ( data -> env_fd!= - 1 ) drop_cloexec ( data -> env_fd
Buggy code:
 <START_BUG> int64_t vp9_rd_pick_inter_mode_sub8x8 ( VP9_COMP * cpi, MACROBLOCK * x, <END_BUG>  const TileInfo * const tile, <START_BUG> int mi_row, int mi_col, <END_BUG> int * returnrate,  int64_t * returndistortion, BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx, int64_t best_rd_so_far ) { <START_BUG> VP9_COMMON * cm = & cpi -> common ; <END_BUG>  MACROBLOCKD * xd = & x -> e_mbd ; <START_BUG> <END_BUG> MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ;  <START_BUG> const struct segmentation * seg = & cm -> seg ; <END_BUG> MV_REFERENCE_FRAME ref_frame, second_ref_frame ; unsigned char segment_id = mbmi -> segment_id ; int comp_pred, i ; int_mv frame_mv [ MB_MODE_COUNT ] [ MAX_REF_FRAMES ] ; struct buf_2d yv12_mb [ 4 ] [ MAX_MB_PLANE ] ; static const int flag_list [ 4 ] = { 0, VP9_LAST_FLAG, VP9_GOLD_FLAG, VP9_ALT_FLAG } ; int64_t best_rd = best_rd_so_far ; int64_t best_yrd = best_rd_so_far ;  int64_t best_tx_rd [ TX_MODES ] ; <START_BUG> int64_t best_tx_diff [ TX_MODES ] ; int64_t best_pred_diff [ REFERENCE_MODES ] ; int64_t best_pred_rd [ REFERENCE_MODES ] ; int64_t best_filter_rd [ SWITCHABLE_FILTER_CONTEXTS ] ; int64_t best_filter_diff [ SWITCHABLE_FILTER_CONTEXTS ] ; <END_BUG> MB_MODE_INFO best_mbmode = { 0 } ;  int mode_index, best_mode_index = 0 ; unsigned int ref_costs_single [ MAX_REF_FRAMES ], ref_costs_comp [ MAX_REF_FRAMES ] ; <START_BUG> vp9_prob comp_mode_p ; <END_BUG> int64_t best_

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> void <S2SV_ModEnd> vp9_rd_pick_inter_mode_sub8x8 ( VP9_COMP <S2SV_ModStart> * cpi, TileDataEnc * tile_data, <S2SV_ModStart> * x, <S2SV_ModEnd> int mi_row, <S2SV_ModStart> int mi_col, RD_COST * rd_cost <S2SV_ModEnd>, BLOCK_SIZE bsize <S2SV_ModStart> { VP9_COMMON * const <S2SV_ModStart> cpi -> common ; RD_OPT * const rd_opt = & cpi -> rd ; SPEED_FEATURES * const sf = & cpi -> sf <S2SV_ModStart> ; MACROBLOCKD * const <S2SV_ModStart> ; MB_MODE_INFO * const <S2SV_ModStart> struct segmentation * const <S2SV_ModStart> best_rd_so_far ; int64_t <S2SV_ModEnd> best_pred_diff [ REFERENCE_MODES <S2SV_ModStart> ; MB_MODE_INFO best_mbmode ; int ref_index, best_ref_index <S2SV_ModEnd> = 0 ; <S2SV_ModStart> MAX_REF_FRAMES ] ; vpx_prob comp_mode_p <S2SV_ModEnd> ; INTERP_FILTER tmp_best_filter <S2SV_ModStart> ; int rate_uv_intra, rate_uv_tokenonly <S2SV_ModEnd>
Buggy code:
 <START_BUG> void vp9_entropy_mv_init ( ) { <END_BUG> vp9_tokens_from_tree ( mv_joint_encodings, vp9_mv_joint_tree ) ; vp9_tokens_from_tree ( mv_class_encodings, vp9_mv_class_tree ) ; vp9_tokens_from_tree ( mv_class0_encodings, vp9_mv_class0_tree ) ; vp9_tokens_from_tree ( mv_fp_encodings, vp9_mv_fp_tree ) ; }

Fix:
<S2SV_ModStart> void vp9_entropy_mv_init ( void
Buggy code:
 void pdo_stmt_init ( TSRMLS_D ) { zend_class_entry ce ; INIT_CLASS_ENTRY ( ce, "PDOStatement", pdo_dbstmt_functions ) ; pdo_dbstmt_ce = zend_register_internal_class ( & ce TSRMLS_CC ) ; pdo_dbstmt_ce -> get_iterator = pdo_stmt_iter_get ; pdo_dbstmt_ce -> create_object = pdo_dbstmt_new ; zend_class_implements ( pdo_dbstmt_ce TSRMLS_CC, 1, zend_ce_traversable ) ; zend_declare_property_null ( pdo_dbstmt_ce, "queryString", sizeof ( "queryString" ) - 1, ZEND_ACC_PUBLIC TSRMLS_CC ) ; memcpy ( & pdo_dbstmt_object_handlers, & std_object_handlers, sizeof ( zend_object_handlers ) ) ; pdo_dbstmt_object_handlers. write_property = dbstmt_prop_write ; pdo_dbstmt_object_handlers. unset_property = dbstmt_prop_delete ; pdo_dbstmt_object_handlers. get_method = dbstmt_method_get ; pdo_dbstmt_object_handlers. compare_objects = dbstmt_compare ; pdo_dbstmt_object_handlers. clone_obj = dbstmt_clone_obj ; INIT_CLASS_ENTRY ( ce, "PDORow", pdo_row_functions ) ; pdo_row_ce = zend_register_internal_class ( & ce TSRMLS_CC ) ; pdo_row_ce -> ce_flags |= ZEND_ACC_FINAL_CLASS ; pdo_row_ce -> create_object = pdo_row_new ; pdo_row_ce -> serialize = pdo_row_serialize ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> = pdo_row_serialize ; pdo_row_ce -> unserialize = zend_class_unserialize_deny ;
Buggy code:
 static void tty_set_termios_ldisc ( struct tty_struct * tty, int num ) { down_write ( & tty -> termios_rwsem ) ; tty -> termios. c_line = num ; up_write ( & tty -> termios_rwsem ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> termios_rwsem ) ; tty -> disc_data = NULL ; tty -> receive_room = 0 ;
Buggy code:
 static int check_entry_size_and_hooks ( struct ip6t_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct ip6t_entry )!= 0 || ( unsigned char * ) e + sizeof ( struct ip6t_entry ) >= limit || ( unsigned char * ) e + e -> next_offset > limit ) { duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct ip6t_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } err = check_entry ( e ) ; if ( err ) return err ; for ( h = 0 ; h < NF_INET_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { <START_BUG> pr_err ( "Underflows   must   be   unconditional   and   " <END_BUG> "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> ) ) { pr_debug <S2SV_ModEnd> ( "Underflows <S2SV_blank> must <S2SV_blank> be <S2SV_blank> unconditional <S2SV_blank> and <S2SV_blank> " "use <S2SV_blank> the <S2SV_blank> STANDARD <S2SV_blank> target <S2SV_blank> with <S2SV_blank> "
Buggy code:
 static int nfc_llcp_build_gb ( struct nfc_llcp_local * local ) { <START_BUG> u8 * gb_cur, * version_tlv, version, version_length ; <END_BUG> u8 * lto_tlv, lto_length ; u8 * wks_tlv, wks_length ; u8 * miux_tlv, miux_length ; __be16 wks = cpu_to_be16 ( local -> local_wks ) ; u8 gb_len = 0 ; int ret = 0 ; version = LLCP_VERSION_11 ; version_tlv = nfc_llcp_build_tlv ( LLCP_TLV_VERSION, & version, 1, & version_length ) ;  gb_len += version_length ; <START_BUG> lto_tlv = nfc_llcp_build_tlv ( LLCP_TLV_LTO, & local -> lto, 1, & lto_length ) ; <END_BUG> gb_len += lto_length ;  pr_debug ( "Local   wks   0x%lx\\n", local -> local_wks ) ; wks_tlv = nfc_llcp_build_tlv ( LLCP_TLV_WKS, ( u8 * ) & wks, 2, & wks_length ) ; <START_BUG> gb_len += wks_length ; <END_BUG> miux_tlv = nfc_llcp_build_tlv ( LLCP_TLV_MIUX, ( u8 * ) & local -> miux, 0,  & miux_length ) ; <START_BUG> gb_len += miux_length ; gb_len += ARRAY_SIZE ( llcp_magic ) ; if ( gb_len > NFC_MAX_GT_LEN ) { ret = - EINVAL ; goto out ; } gb_cur = local -> gb ; memcpy ( gb_cur, llcp_magic, ARRAY_SIZE ( llcp_magic ) ) ; gb_cur += ARRAY_SIZE ( llcp_magic ) ; memcpy ( gb_cur, version_tlv, version_length ) ; gb_cur += version_length ; memcpy ( gb_cur, lto_tlv, lto_length ) ; gb_cur += l<END_BUG>

Fix:
<S2SV_ModStart> * gb_cur, version, version_length ; u8 lto_length, wks_length, miux_length ; u8 * version_tlv = NULL, * lto_tlv = NULL, * wks_tlv = NULL, * miux_tlv = NULL <S2SV_ModEnd> ; __be16 wks <S2SV_ModStart> version_length ) ; if (! version_tlv ) { ret = - ENOMEM ; goto out ; } <S2SV_ModStart> lto_length ) ; if (! lto_tlv ) { ret = - ENOMEM ; goto out ; } <S2SV_ModStart> wks_length ) ; if (! wks_tlv ) { ret = - ENOMEM ; goto out ; } <S2SV_ModStart> miux_length ) ; if (! miux_tlv ) { ret = - ENOMEM ; goto out ; }
Buggy code:
 int usbnet_probe ( struct usb_interface * udev, const struct usb_device_id * prod ) { struct usbnet * dev ; struct net_device * net ; struct usb_host_interface * interface ; struct driver_info * info ; struct usb_device * xdev ; int status ; const char * name ; struct usb_driver * driver = to_usb_driver ( udev -> dev. driver ) ; if (! driver -> supports_autosuspend ) { driver -> supports_autosuspend = 1 ; pm_runtime_enable ( & udev -> dev ) ; } name = udev -> dev. driver -> name ; info = ( struct driver_info * ) prod -> driver_info ; if (! info ) { dev_dbg ( & udev -> dev, "blacklisted   by   %s\\n", name ) ; return - ENODEV ; } xdev = interface_to_usbdev ( udev ) ; interface = udev -> cur_altsetting ; status = - ENOMEM ; net = alloc_etherdev ( sizeof ( * dev ) ) ; if (! net ) goto out ; SET_NETDEV_DEV ( net, & udev -> dev ) ; dev = netdev_priv ( net ) ; dev -> udev = xdev ; dev -> intf = udev ; dev -> driver_info = info ; dev -> driver_name = name ; dev -> msg_enable = netif_msg_init ( msg_level, NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_LINK ) ; init_waitqueue_head ( & dev -> wait ) ; skb_queue_head_init ( & dev -> rxq ) ; skb_queue_head_init ( & dev -> txq ) ; skb_queue_head_init ( & dev -> done ) ; skb_queue_head_init ( & dev -> rxq_pause ) ; dev -> bh. func = usbnet_bh ; dev -> bh. data = ( unsigned long ) dev ; INIT_WORK ( & dev -> kevent, usbnet_deferred_kevent ) ; init_usb_anchor ( & dev -> deferred ) ; dev -> delay. function = usbnet_bh ; dev -> delay. data = ( unsigned long ) dev ; init_timer ( & dev -> delay )

Fix:
<S2SV_ModStart> ; out1 : cancel_work_sync ( & dev -> kevent ) ; del_timer_sync ( & dev -> delay ) ;
Buggy code:
 static int vdbePmaReadBlob ( PmaReader * p, int nByte, u8 * * ppOut ) { int iBuf ; int nAvail ; if ( p -> aMap ) { * ppOut = & p -> aMap [ p -> iReadOff ] ; p -> iReadOff += nByte ; return SQLITE_OK ; } assert ( p -> aBuffer ) ; iBuf = p -> iReadOff % p -> nBuffer ; if ( iBuf == 0 ) { int nRead ; int rc ; if ( ( p -> iEof - p -> iReadOff ) > ( i64 ) p -> nBuffer ) { nRead = p -> nBuffer ; } else { nRead = ( int ) ( p -> iEof - p -> iReadOff ) ; } assert ( nRead > 0 ) ; rc = sqlite3OsRead ( p -> pFd, p -> aBuffer, nRead, p -> iReadOff ) ; assert ( rc!= SQLITE_IOERR_SHORT_READ ) ; if ( rc!= SQLITE_OK ) return rc ; } nAvail = p -> nBuffer - iBuf ; if ( nByte <= nAvail ) { * ppOut = & p -> aBuffer [ iBuf ] ; p -> iReadOff += nByte ; } else { int nRem ; if ( p -> nAlloc < nByte ) { u8 * aNew ; <START_BUG> int nNew = MAX ( 128, p -> nAlloc * 2 ) ; <END_BUG> while ( nByte > nNew ) nNew = nNew * 2 ; aNew = sqlite3Realloc ( p -> aAlloc, nNew ) ; if (! aNew ) return SQLITE_NOMEM_BKPT ; p -> nAlloc = nNew ; p -> aAlloc = aNew ; } memcpy ( p -> aAlloc, & p -> aBuffer [ iBuf ], nAvail ) ; p -> iReadOff += nAvail ; nRem = nByte - nAvail ; while ( nRem > 0 ) { int rc ; int nCopy ; u8 * aNext ; nCopy = nRem ; if ( nRem > p -> nBuffer ) nCopy = p -> nBuffer ; rc = vdbePmaReadBlob ( p, nCopy, & aNext ) ; if ( rc!= SQLITE_

Fix:
<S2SV_ModStart> * aNew ; sqlite3_int64 <S2SV_ModEnd> nNew = MAX <S2SV_ModStart> ( 128, 2 * ( sqlite3_int64 ) <S2SV_ModStart> p -> nAlloc <S2SV_ModEnd> ) ; while
Buggy code:
 static inline int l2cap_connect_rsp ( struct l2cap_conn * conn, struct l2cap_cmd_hdr * cmd, u8 * data ) { struct l2cap_conn_rsp * rsp = ( struct l2cap_conn_rsp * ) data ; u16 scid, dcid, result, status ; struct sock * sk ; u8 req [ 128 ] ; scid = __le16_to_cpu ( rsp -> scid ) ; dcid = __le16_to_cpu ( rsp -> dcid ) ; result = __le16_to_cpu ( rsp -> result ) ; status = __le16_to_cpu ( rsp -> status ) ; BT_DBG ( "dcid   0x%4.4x   scid   0x%4.4x   result   0x%2.2x   status   0x%2.2x", dcid, scid, result, status ) ; if ( scid ) { sk = l2cap_get_chan_by_scid ( & conn -> chan_list, scid ) ; if (! sk ) return 0 ; } else { sk = l2cap_get_chan_by_ident ( & conn -> chan_list, cmd -> ident ) ; if (! sk ) return 0 ; } switch ( result ) { case L2CAP_CR_SUCCESS : sk -> sk_state = BT_CONFIG ; l2cap_pi ( sk ) -> ident = 0 ; l2cap_pi ( sk ) -> dcid = dcid ; l2cap_pi ( sk ) -> conf_state |= L2CAP_CONF_REQ_SENT ; l2cap_pi ( sk ) -> conf_state &= ~ L2CAP_CONF_CONNECT_PEND ; l2cap_send_cmd ( conn, l2cap_get_ident ( conn ), L2CAP_CONF_REQ, l2cap_build_conf_req ( sk, req ), req ) ; <START_BUG> break ; <END_BUG> case L2CAP_CR_PEND : l2cap_pi ( sk ) -> conf_state |= L2CAP_CONF_CONNECT_PEND ; break ; default : l2cap_chan_del ( sk, ECONNREFUSED ) ; break ; } bh_unlock_sock ( sk )

Fix:
<S2SV_ModStart> req ) ; l2cap_pi ( sk ) -> num_conf_req ++ ;
Buggy code:
 static int encrypt ( struct blkcipher_desc * desc, struct scatterlist * dst, struct scatterlist * src, unsigned int nbytes ) { struct blkcipher_walk walk ; struct crypto_blkcipher * tfm = desc -> tfm ; struct salsa20_ctx * ctx = crypto_blkcipher_ctx ( tfm ) ; int err ; blkcipher_walk_init ( & walk, dst, src, nbytes ) ; err = blkcipher_walk_virt_block ( desc, & walk, 64 ) ; salsa20_ivsetup ( ctx, walk. iv ) ; <START_BUG> if ( likely ( walk. nbytes == nbytes ) ) <END_BUG> { salsa20_encrypt_bytes ( ctx, walk. src. virt. addr, walk. dst. virt. addr, nbytes ) ; return blkcipher_walk_done ( desc, & walk, 0 ) ; } while ( walk. nbytes >= 64 ) { salsa20_encrypt_bytes ( ctx, walk. src. virt. addr, walk. dst. virt. addr, walk. nbytes - ( walk. nbytes % 64 ) ) ; err = blkcipher_walk_done ( desc, & walk, walk. nbytes % 64 ) ; } if ( walk. nbytes ) { salsa20_encrypt_bytes ( ctx, walk. src. virt. addr, walk. dst. virt. addr, walk. nbytes ) ; err = blkcipher_walk_done ( desc, & walk, 0 ) ; } return err ; }

Fix:
<S2SV_ModStart> iv ) ; <S2SV_ModEnd> while ( walk
Buggy code:
 static int dccp_v6_connect ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct sockaddr_in6 * usin = ( struct sockaddr_in6 * ) uaddr ; struct inet_connection_sock * icsk = inet_csk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct dccp_sock * dp = dccp_sk ( sk ) ; <START_BUG> struct in6_addr * saddr = NULL, * final_p, final ; <END_BUG> struct flowi6 fl6 ; struct dst_entry * dst ; int addr_type ; int err ; dp -> dccps_role = DCCP_ROLE_CLIENT ; if ( addr_len < SIN6_LEN_RFC2133 ) return - EINVAL ; if ( usin -> sin6_family!= AF_INET6 ) return - EAFNOSUPPORT ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; if ( np -> sndflow ) { fl6. flowlabel = usin -> sin6_flowinfo & IPV6_FLOWINFO_MASK ; IP6_ECN_flow_init ( fl6. flowlabel ) ; if ( fl6. flowlabel & IPV6_FLOWLABEL_MASK ) { struct ip6_flowlabel * flowlabel ; flowlabel = fl6_sock_lookup ( sk, fl6. flowlabel ) ; if ( flowlabel == NULL ) return - EINVAL ; fl6_sock_release ( flowlabel ) ; } } if ( ipv6_addr_any ( & usin -> sin6_addr ) ) usin -> sin6_addr. s6_addr [ 15 ] = 1 ; addr_type = ipv6_addr_type ( & usin -> sin6_addr ) ; if ( addr_type & IPV6_ADDR_MULTICAST ) return - ENETUNREACH ; if ( addr_type & IPV6_ADDR_LINKLOCAL ) { if ( addr_len >= sizeof ( struct sockaddr_in6 ) && usin -> sin6_scope_id ) { if ( sk -> sk_bound_dev_if && sk -> sk_bound_dev_if!= usin -> sin

Fix:
<S2SV_ModStart> final_p, final ; struct ipv6_txoptions * opt <S2SV_ModStart> ) ) ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> & fl6, <S2SV_ModEnd> opt, & <S2SV_ModStart> ; if ( opt <S2SV_ModEnd> ) icsk -> <S2SV_ModStart> -> icsk_ext_hdr_len = <S2SV_ModEnd> opt -> opt_flen <S2SV_ModStart> -> opt_flen + <S2SV_ModEnd> opt -> opt_nflen <S2SV_ModStart> opt -> opt_nflen <S2SV_ModEnd> ; inet ->