nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int list_table_status ( MYSQL * mysql, const char * db, const char * wild ) { <START_BUG> char query [ 1024 ], * end ; <END_BUG> MYSQL_RES * result ; MYSQL_ROW row ;  end = strxmov ( query, "show   table   status   from   `", db, "`", NullS ) ; <START_BUG> <END_BUG> if ( wild && wild [ 0 ] )  strxmov ( end, "   like   \'", wild, "\'", NullS ) ; if ( mysql_query ( mysql, query ) ||! ( result = mysql_store_result ( mysql ) ) ) { fprintf ( stderr, "%s:   Cannot   get   status   for   db:   %s,   table:   %s:   %s\\n", my_progname, db, wild? wild : "", mysql_error ( mysql ) ) ; if ( mysql_errno ( mysql ) == ER_PARSE_ERROR ) fprintf ( stderr, "This   error   probably   means   that   your   MySQL   server   doesn\'t   support   the\\n\\\'show   table   status\'   command.\\n" ) ; return 1 ; } printf ( "Database:   %s", db ) ; if ( wild ) printf ( "     Wildcard:   %s", wild ) ; putchar ( '\\n' ) ; print_res_header ( result ) ; while ( ( row = mysql_fetch_row ( result ) ) ) print_res_row ( result, row ) ; print_res_top ( result ) ; mysql_free_result ( result ) ; return 0 ; }

Fix:
<S2SV_ModStart> char query [ NAME_LEN + 100 ] ; int len <S2SV_ModEnd> ; MYSQL_RES * <S2SV_ModStart> MYSQL_ROW row ; len = sizeof ( query ) ; len -= my_snprintf ( query, len, "show <S2SV_blank> table <S2SV_blank> status <S2SV_blank> from <S2SV_blank> `%s`", db <S2SV_ModEnd> ) ; if <S2SV_ModStart> [ 0 ] && len ) strxnmov ( query + strlen ( query ), len <S2SV_ModEnd>, " <S2SV_blank> like <S2SV_blank> \'",
Buggy code:
 static int host_start ( struct ci13xxx * ci ) { struct usb_hcd * hcd ; struct ehci_hcd * ehci ; int ret ; if ( usb_disabled ( ) ) return - ENODEV ; hcd = usb_create_hcd ( & ci_ehci_hc_driver, ci -> dev, dev_name ( ci -> dev ) ) ; if (! hcd ) return - ENOMEM ; dev_set_drvdata ( ci -> dev, ci ) ; hcd -> rsrc_start = ci -> hw_bank. phys ; hcd -> rsrc_len = ci -> hw_bank. size ; hcd -> regs = ci -> hw_bank. abs ; hcd -> has_tt = 1 ; hcd -> power_budget = ci -> platdata -> power_budget ; hcd -> phy = ci -> transceiver ; ehci = hcd_to_ehci ( hcd ) ; ehci -> caps = ci -> hw_bank. cap ; ehci -> has_hostpc = ci -> hw_bank. lpm ; ret = usb_add_hcd ( hcd, 0, 0 ) ; if ( ret ) usb_put_hcd ( hcd ) ; else ci -> hcd = hcd ; <START_BUG> return ret ; <END_BUG> }

Fix:
<S2SV_ModStart> = hcd ; if ( ci -> platdata -> flags & CI13XXX_DISABLE_STREAMING ) hw_write ( ci, OP_USBMODE, USBMODE_CI_SDIS, USBMODE_CI_SDIS ) ;
Buggy code:
 void options_apply ( ) { unsigned num = 0 ; SERVICE_OPTIONS * section ; CRYPTO_THREAD_write_lock ( stunnel_locks [ LOCK_SECTIONS ] ) ; <START_BUG> memcpy ( & global_options, & new_global_options, sizeof ( GLOBAL_OPTIONS ) ) ; <END_BUG> for ( section = new_service_options. next ; section ; section = section -> next ) section -> section_number = num ++ ; memcpy ( & service_options, & new_service_options, sizeof ( SERVICE_OPTIONS ) ) ;  number_of_sections = num ; <START_BUG> CRYPTO_THREAD_unlock ( stunnel_locks [ LOCK_SECTIONS ] ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, & new_global_options, sizeof ( GLOBAL_OPTIONS ) ) ; memset ( & new_global_options, 0 <S2SV_ModStart> ) ) ; memset ( & new_service_options, 0, sizeof ( SERVICE_OPTIONS ) ) ;
Buggy code:
 Pairs * hstoreArrayToPairs ( ArrayType * a, int * npairs ) { Datum * key_datums ; bool * key_nulls ; int key_count ; Pairs * key_pairs ; int bufsiz ; int i, j ; deconstruct_array ( a, TEXTOID, - 1, false, 'i', & key_datums, & key_nulls, & key_count ) ; if ( key_count == 0 ) { * npairs = 0 ; return NULL ; } <START_BUG> key_pairs = palloc ( sizeof ( Pairs ) * key_count ) ; <END_BUG> for ( i = 0, j = 0 ; i < key_count ; i ++ ) { if (! key_nulls [ i ] ) { key_pairs [ j ]. key = VARDATA ( key_datums [ i ] ) ; key_pairs [ j ]. keylen = VARSIZE ( key_datums [ i ] ) - VARHDRSZ ; key_pairs [ j ]. val = NULL ; key_pairs [ j ]. vallen = 0 ; key_pairs [ j ]. needfree = 0 ; key_pairs [ j ]. isnull = 1 ; j ++ ; } } * npairs = hstoreUniquePairs ( key_pairs, j, & bufsiz ) ; return key_pairs ; }

Fix:
<S2SV_ModStart> NULL ; } if ( key_count > MaxAllocSize // sizeof ( Pairs ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> pairs <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", key_count, ( int ) ( MaxAllocSize // sizeof ( Pairs ) ) ) ) ) ;
Buggy code:
 static int check_rpcsec_auth ( struct svc_req * rqstp ) { gss_ctx_id_t ctx ; krb5_context kctx ; OM_uint32 maj_stat, min_stat ; gss_name_t name ; krb5_principal princ ; int ret, success ; krb5_data * c1, * c2, * realm ; gss_buffer_desc gss_str ; kadm5_server_handle_t handle ; size_t slen ; char * sdots ; success = 0 ; handle = ( kadm5_server_handle_t ) global_server_handle ; if ( rqstp -> rq_cred. oa_flavor!= RPCSEC_GSS ) return 0 ; ctx = rqstp -> rq_svccred ; maj_stat = gss_inquire_context ( & min_stat, ctx, NULL, & name, NULL, NULL, NULL, NULL, NULL ) ; if ( maj_stat!= GSS_S_COMPLETE ) { krb5_klog_syslog ( LOG_ERR, _ ( "check_rpcsec_auth:   failed   " "inquire_context,   stat=%u" ), maj_stat ) ; log_badauth ( maj_stat, min_stat, rqstp -> rq_xprt, NULL ) ; goto fail_name ; } kctx = handle -> context ; ret = gss_to_krb5_name_1 ( rqstp, kctx, name, & princ, & gss_str ) ; if ( ret == 0 ) goto fail_name ; slen = gss_str. length ; trunc_name ( & slen, & sdots ) ; if ( krb5_princ_size ( kctx, princ )!= 2 ) goto fail_princ ; c1 = krb5_princ_component ( kctx, princ, 0 ) ; c2 = krb5_princ_component ( kctx, princ, 1 ) ; realm = krb5_princ_realm ( kctx, princ ) ; <START_BUG> if ( strncmp ( handle -> params. realm, realm -> data, realm -> length ) == 0 <END_BUG> && strncmp ( "kadmin", c1 -> data, c1 ->

Fix:
<S2SV_ModStart> princ ) ; success = data_eq_string ( * realm, <S2SV_ModEnd> handle -> params <S2SV_ModStart> params. realm ) && data_eq_string ( * c1, "kadmin" ) &&! data_eq_string ( * c2, "history" ) ; <S2SV_ModEnd> fail_princ : if
Buggy code:
 static int userfaultfd_register ( struct userfaultfd_ctx * ctx, unsigned long arg ) { struct mm_struct * mm = ctx -> mm ; struct vm_area_struct * vma, * prev, * cur ; int ret ; struct uffdio_register uffdio_register ; struct uffdio_register __user * user_uffdio_register ; unsigned long vm_flags, new_flags ; bool found ; bool basic_ioctls ; unsigned long start, end, vma_end ; user_uffdio_register = ( struct uffdio_register __user * ) arg ; ret = - EFAULT ; if ( copy_from_user ( & uffdio_register, user_uffdio_register, sizeof ( uffdio_register ) - sizeof ( __u64 ) ) ) goto out ; ret = - EINVAL ; if (! uffdio_register. mode ) goto out ; if ( uffdio_register. mode & ~ ( UFFDIO_REGISTER_MODE_MISSING | UFFDIO_REGISTER_MODE_WP ) ) goto out ; vm_flags = 0 ; if ( uffdio_register. mode & UFFDIO_REGISTER_MODE_MISSING ) vm_flags |= VM_UFFD_MISSING ; if ( uffdio_register. mode & UFFDIO_REGISTER_MODE_WP ) { vm_flags |= VM_UFFD_WP ; ret = - EINVAL ; goto out ; } ret = validate_range ( mm, uffdio_register. range. start, uffdio_register. range. len ) ; if ( ret ) goto out ; start = uffdio_register. range. start ; end = start + uffdio_register. range. len ; ret = - ENOMEM ; if (! mmget_not_zero ( mm ) ) goto out ; <START_BUG> down_write ( & mm -> mmap_sem ) ; <END_BUG> vma = find_vma_prev ( mm, start, & prev ) ; if (! vma ) goto out_unlock ; ret = - EINVAL ; if ( vma -> vm_start >= end ) goto out_unlock ; if ( is_vm_hugetlb_page ( vma )

Fix:
<S2SV_ModStart> -> mmap_sem ) ; if (! mmget_still_valid ( mm ) ) goto out_unlock
Buggy code:
 static int ndp_sock_open ( struct ndp * ndp ) { int sock ; int ret ; int err ; int val ; sock = socket ( PF_INET6, SOCK_RAW, IPPROTO_ICMPV6 ) ; if ( sock == - 1 ) { err ( ndp, "Failed   to   create   ICMP6   socket." ) ; return - errno ; } val = 1 ; ret = setsockopt ( sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, & val, sizeof ( val ) ) ; if ( ret == - 1 ) { err ( ndp, "Failed   to   setsockopt   IPV6_RECVPKTINFO." ) ; err = - errno ; goto close_sock ; } val = 255 ; ret = setsockopt ( sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, & val, sizeof ( val ) ) ; if ( ret == - 1 ) { <START_BUG> err ( ndp, "Failed   to   setsockopt   IPV6_MULTICAST_HOPS." ) ; <END_BUG> err = - errno ; goto close_sock ; } ndp -> sock = sock ; return 0 ; close_sock : close ( sock ) ; return err ; }

Fix:
<S2SV_ModStart> ndp, "Failed <S2SV_blank> to <S2SV_blank> setsockopt <S2SV_blank> IPV6_MULTICAST_HOPS." ) ; err = - errno ; goto close_sock ; } val = 1 ; ret = setsockopt ( sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, & val, sizeof ( val ) ) ; if ( ret == - 1 ) { err ( ndp, "Failed <S2SV_blank> to <S2SV_blank> setsockopt <S2SV_blank> IPV6_RECVHOPLIMIT,."
Buggy code:
 static void GTextFieldSave ( GTextField * gt, int utf8 ) { unichar_t * ret ; char * cret ; FILE * file ; unichar_t * pt ; if ( _ggadget_use_gettext ) { char * temp = GWidgetOpenFile8 ( _ ( "Save" ), NULL, "*.{txt,py}", NULL, NULL ) ; ret = utf82u_copy ( temp ) ; free ( temp ) ; } else ret = GWidgetSaveAsFile ( GStringGetResource ( _STR_Save, NULL ), NULL, txt, NULL, NULL ) ; if ( ret == NULL ) return ; cret = u2def_copy ( ret ) ; free ( ret ) ; file = fopen ( cret, "w" ) ; if ( file == NULL ) { if ( _ggadget_use_gettext ) GWidgetError8 ( _ ( "Could   not   open   file" ), _ ( "Could   not   open   %.100s" ), cret ) ; else GWidgetError ( errort, error, cret ) ; free ( cret ) ; return ; } free ( cret ) ; if ( utf8 ) { putc ( 0xef, file ) ; putc ( 0xbb, file ) ; putc ( 0xbf, file ) ; for ( pt = gt -> text ; * pt ; ++ pt ) { if ( * pt < 0x80 ) putc ( * pt, file ) ; else if ( * pt < 0x800 ) { putc ( 0xc0 | ( * pt >> 6 ), file ) ; putc ( 0x80 | ( * pt & 0x3f ), file ) ; } else if ( * pt >= 0xd800 && * pt < 0xdc00 && pt [ 1 ] >= 0xdc00 && pt [ 1 ] < 0xe000 ) { int u = ( ( * pt >> 6 ) & 0xf ) + 1, y = ( ( * pt & 3 ) << 4 ) | ( ( pt [ 1 ] >> 6 ) & 0xf ) ; putc ( 0xf0 | ( u >> 2 ), file ) ; putc ( 0x80 | ( ( u & 3 ) << 4 ) | ( ( * pt >> 2 ) & 0xf ), file ) ; putc ( 0

Fix:
<S2SV_ModStart> file ) ; GTextFieldSaved ( gt ) ;
Buggy code:
 int my_csr_reader ( const char * i_csr_file_in, unsigned int * * o_row_idx, unsigned int * * o_column_idx, REALTYPE * * o_values, unsigned int * o_row_count, unsigned int * o_column_count, unsigned int * o_element_count ) { FILE * l_csr_file_handle ; const unsigned int l_line_length = 512 ; char l_line [ 512 + 1 ] ; unsigned int l_header_read = 0 ; unsigned int * l_row_idx_id = NULL ; unsigned int l_i = 0 ; l_csr_file_handle = fopen ( i_csr_file_in, "r" ) ; if ( l_csr_file_handle == NULL ) { fprintf ( stderr, "cannot   open   CSR   file!\\n" ) ; return - 1 ; } while ( fgets ( l_line, l_line_length, l_csr_file_handle )!= NULL ) { if ( strlen ( l_line ) == l_line_length ) { fprintf ( stderr, "could   not   read   file   length!\\n" ) ; return - 1 ; } if ( l_line [ 0 ] == '%' ) { continue ; } else { if ( l_header_read == 0 ) { <START_BUG> if ( sscanf ( l_line, "%u   %u   %u", o_row_count, o_column_count, o_element_count ) == 3 ) { <END_BUG> * o_column_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_element_count ) ) ; * o_row_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_row_count + 1 ) ) ; * o_values = ( REALTYPE * ) malloc ( sizeof ( double ) * ( * o_element_count ) ) ; l_row_idx_id = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_row_count ) ) ; if ( ( * o_row_idx == NULL ) || ( * o_column_idx == NULL ) || ( * o_values == NULL ) || ( l_row_idx_id == NULL

Fix:
<S2SV_ModStart> { if ( 3 == <S2SV_ModStart>, o_element_count ) && 0!= * o_row_count && 0!= * o_column_count && 0!= * o_element_count ) <S2SV_ModEnd> { * o_column_idx
Buggy code:
 int WavpackSetConfiguration64 ( WavpackContext * wpc, WavpackConfig * config, int64_t total_samples, const unsigned char * chan_ids ) { uint32_t flags, bps = 0 ; uint32_t chan_mask = config -> channel_mask ; int num_chans = config -> num_channels ; <START_BUG> int i ; <END_BUG> wpc -> stream_version = ( config -> flags & CONFIG_COMPATIBLE_WRITE )? CUR_STREAM_VERS : MAX_STREAM_VERS ; if ( ( config -> qmode & QMODE_DSD_AUDIO ) && config -> bytes_per_sample == 1 && config -> bits_per_sample == 8 ) { # ifdef ENABLE_DSD wpc -> dsd_multiplier = 1 ; flags = DSD_FLAG ; for ( i = 14 ; i >= 0 ; -- i ) if ( config -> sample_rate % sample_rates [ i ] == 0 ) { int divisor = config -> sample_rate // sample_rates [ i ] ; if ( divisor && ( divisor & ( divisor - 1 ) ) == 0 ) { config -> sample_rate //= divisor ; wpc -> dsd_multiplier = divisor ; break ; } } if ( config -> flags & CONFIG_HYBRID_FLAG ) { strcpy ( wpc -> error_message, "hybrid   mode   not   available   for   DSD!" ) ; return FALSE ; } config -> flags &= ( CONFIG_HIGH_FLAG | CONFIG_MD5_CHECKSUM | CONFIG_PAIR_UNDEF_CHANS ) ; config -> float_norm_exp = config -> xmode = 0 ; # else strcpy ( wpc -> error_message, "libwavpack   not   configured   for   DSD!" ) ; return FALSE ; # endif } else flags = config -> bytes_per_sample - 1 ; wpc -> total_samples = total_samples ; wpc -> config. sample_rate = config -> sample_rate ; wpc -> config. num_channels = config -> num_channels ; wpc -> config. channel_mask = config -> channel_mask ; wpc -> config. bits_per_sample = config -> bits_per_sample ; wpc -> config. bytes_per_sample = config -> bytes_per_sample ; wpc ->

Fix:
<S2SV_ModStart> int i ; if (! config -> sample_rate ) { strcpy ( wpc -> error_message, "sample <S2SV_blank> rate <S2SV_blank> cannot <S2SV_blank> be <S2SV_blank> zero!" ) ; return FALSE ; }
Buggy code:
 static int read_bytes ( FILE * fp, void * buf, size_t bytes_to_read, int fail_on_eof, char * errbuf ) { size_t amt_read ; amt_read = fread ( buf, 1, bytes_to_read, fp ) ; if ( amt_read!= bytes_to_read ) { if ( ferror ( fp ) ) { pcap_fmt_errmsg_for_errno ( errbuf, PCAP_ERRBUF_SIZE, errno, "error   reading   dump   file" ) ; } else { if ( amt_read == 0 &&! fail_on_eof ) return ( 0 ) ; pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, <START_BUG> "truncated   dump   file;   tried   to   read   %" PRIsize "   bytes,   only   got   %" PRIsize, <END_BUG> bytes_to_read, amt_read ) ; } return ( - 1 ) ; } return ( 1 ) ; }

Fix:
<S2SV_ModStart>, PCAP_ERRBUF_SIZE, "truncated <S2SV_blank> pcapng <S2SV_blank> dump <S2SV_blank> file; <S2SV_blank> tried <S2SV_blank> to <S2SV_blank> read <S2SV_blank> %" <S2SV_ModEnd> PRIsize " <S2SV_blank> bytes, <S2SV_blank> only <S2SV_blank> got <S2SV_blank> %" PRIsize
Buggy code:
 int perf_pmu_register ( struct pmu * pmu, const char * name, int type ) { int cpu, ret ; mutex_lock ( & pmus_lock ) ; ret = - ENOMEM ; pmu -> pmu_disable_count = alloc_percpu ( int ) ; if (! pmu -> pmu_disable_count ) goto unlock ; pmu -> type = - 1 ; if (! name ) goto skip_type ; pmu -> name = name ; if ( type < 0 ) { type = idr_alloc ( & pmu_idr, pmu, PERF_TYPE_MAX, 0, GFP_KERNEL ) ; if ( type < 0 ) { ret = type ; goto free_pdc ; } } pmu -> type = type ; if ( pmu_bus_running ) { ret = pmu_dev_alloc ( pmu ) ; if ( ret ) goto free_idr ; } skip_type : pmu -> pmu_cpu_context = find_pmu_context ( pmu -> task_ctx_nr ) ; if ( pmu -> pmu_cpu_context ) goto got_cpu_context ; ret = - ENOMEM ; pmu -> pmu_cpu_context = alloc_percpu ( struct perf_cpu_context ) ; if (! pmu -> pmu_cpu_context ) goto free_dev ; for_each_possible_cpu ( cpu ) { struct perf_cpu_context * cpuctx ; cpuctx = per_cpu_ptr ( pmu -> pmu_cpu_context, cpu ) ; __perf_event_init_context ( & cpuctx -> ctx ) ; lockdep_set_class ( & cpuctx -> ctx. mutex, & cpuctx_mutex ) ; lockdep_set_class ( & cpuctx -> ctx. lock, & cpuctx_lock ) ; <START_BUG> cpuctx -> ctx. type = cpu_context ; <END_BUG> cpuctx -> ctx. pmu = pmu ; __perf_cpu_hrtimer_init ( cpuctx, cpu ) ; INIT_LIST_HEAD ( & cpuctx -> rotation_list ) ; cpuctx -> unique_pmu = pmu ; } got_cpu_context : if (! pmu -> start_txn ) { if ( pm

Fix:
<S2SV_ModStart> -> ctx. <S2SV_ModEnd> pmu = pmu
Buggy code:
 void IGDstartelt ( void * d, const char * name, int l ) { <START_BUG> struct IGDdatas * datas = ( struct IGDdatas * ) d ; <END_BUG> memcpy ( datas -> cureltname, name, l ) ; datas -> cureltname [ l ] = '\\0' ; datas -> level ++ ; if ( ( l == 7 ) &&! memcmp ( name, "service", l ) ) { datas -> tmp. controlurl [ 0 ] = '\\0' ; datas -> tmp. eventsuburl [ 0 ] = '\\0' ; datas -> tmp. scpdurl [ 0 ] = '\\0' ; datas -> tmp. servicetype [ 0 ] = '\\0' ; } }

Fix:
<S2SV_ModStart> * ) d ; if ( l >= MINIUPNPC_URL_MAXSIZE ) l = MINIUPNPC_URL_MAXSIZE - 1
Buggy code:
 static int do_replace ( struct net * net, const void __user * user, unsigned int len ) { int ret, countersize ; struct ebt_table_info * newinfo ; struct ebt_replace tmp ; if ( copy_from_user ( & tmp, user, sizeof ( tmp ) )!= 0 ) return - EFAULT ; if ( len!= sizeof ( tmp ) + tmp. entries_size ) { BUGPRINT ( "Wrong   len   argument\\n" ) ; return - EINVAL ; } if ( tmp. entries_size == 0 ) { BUGPRINT ( "Entries_size   never   zero\\n" ) ; return - EINVAL ; } if ( tmp. nentries >= ( ( INT_MAX - sizeof ( struct ebt_table_info ) ) // NR_CPUS - SMP_CACHE_BYTES ) // sizeof ( struct ebt_counter ) ) return - ENOMEM ; if ( tmp. num_counters >= INT_MAX // sizeof ( struct ebt_counter ) ) return - ENOMEM ; <START_BUG> countersize = COUNTER_OFFSET ( tmp. nentries ) * nr_cpu_ids ; <END_BUG> newinfo = vmalloc ( sizeof ( * newinfo ) + countersize ) ; if (! newinfo ) return - ENOMEM ; if ( countersize ) memset ( newinfo -> counters, 0, countersize ) ; newinfo -> entries = vmalloc ( tmp. entries_size ) ; if (! newinfo -> entries ) { ret = - ENOMEM ; goto free_newinfo ; } if ( copy_from_user ( newinfo -> entries, tmp. entries, tmp. entries_size )!= 0 ) { BUGPRINT ( "Couldn\'t   copy   entries   from   userspace\\n" ) ; ret = - EFAULT ; goto free_entries ; } ret = do_replace_finish ( net, & tmp, newinfo ) ; if ( ret == 0 ) return ret ; free_entries : vfree ( newinfo -> entries ) ; free_newinfo : vfree ( newinfo ) ; return ret ; }

Fix:
<S2SV_ModStart> - ENOMEM ; tmp. name [ sizeof ( tmp. name ) - 1 ] = 0 ;
Buggy code:
 sctp_disposition_t sctp_sf_do_asconf ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * chunk = arg ; struct sctp_chunk * asconf_ack = NULL ; struct sctp_paramhdr * err_param = NULL ; sctp_addiphdr_t * hdr ; <START_BUG> union sctp_addr_param * addr_param ; <END_BUG> __u32 serial ; int length ; if (! sctp_vtag_verify ( chunk, asoc ) ) { sctp_add_cmd_sf ( commands, SCTP_CMD_REPORT_BAD_TAG, SCTP_NULL ( ) ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; } if (! net -> sctp. addip_noauth &&! chunk -> auth ) return sctp_sf_discard_chunk ( net, ep, asoc, type, arg, commands ) ; if (! sctp_chunk_length_valid ( chunk, sizeof ( sctp_addip_chunk_t ) ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ; hdr = ( sctp_addiphdr_t * ) chunk -> skb -> data ; serial = ntohl ( hdr -> serial ) ;  addr_param = ( union sctp_addr_param * ) hdr -> params ; <START_BUG> length = ntohs ( addr_param -> p. length ) ; if ( length < sizeof ( sctp_paramhdr_t ) ) return sctp_sf_violation_paramlen ( net, ep, asoc, type, arg, ( void * ) addr_param, commands ) ; if (! sctp_verify_asconf ( asoc, <END_BUG> ( sctp_paramhdr_t * ) ( ( void * ) addr_param + length ),  ( void * ) chunk -> chunk_end, & err_param ) ) return sctp_sf_violation_paramlen ( net, ep, asoc, type, arg, ( void * ) err_param,

Fix:
<S2SV_ModStart> * hdr ; __u32 serial <S2SV_ModEnd> ; if ( <S2SV_ModStart> serial ) ; <S2SV_ModEnd> if (! <S2SV_ModStart> ( asoc, chunk, true, <S2SV_ModEnd> & err_param )
Buggy code:
 static expr_ty FstringParser_Finish ( FstringParser * state, struct compiling * c, const node * n ) { asdl_seq * seq ; FstringParser_check_invariants ( state ) ; <START_BUG> if ( state -> expr_list. size == 0 ) { <END_BUG> if (! state -> last_str ) { state -> last_str = PyUnicode_FromStringAndSize ( NULL, 0 ) ; if (! state -> last_str ) goto error ; } return make_str_node_and_del ( & state -> last_str, c, n ) ; } if ( state -> last_str ) { expr_ty str = make_str_node_and_del ( & state -> last_str, c, n ) ; if (! str || ExprList_Append ( & state -> expr_list, str ) < 0 ) goto error ; } assert ( state -> last_str == NULL ) ; seq = ExprList_Finish ( & state -> expr_list, c -> c_arena ) ; if (! seq ) goto error ;  if ( seq -> size == 1 ) <START_BUG> return seq -> elements [ 0 ] ; return JoinedStr ( seq, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; error : FstringParser_Dealloc ( state ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if (! state -> fmode ) { assert (! <S2SV_ModStart> expr_list. size ) ; <S2SV_ModEnd> if (! <S2SV_ModStart> goto error ; <S2SV_ModEnd> return JoinedStr (
Buggy code:
 void WT_Interpolate ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_PCM * pOutputBuffer ; EAS_I32 phaseInc ; EAS_I32 phaseFrac ; EAS_I32 acc0 ; const EAS_SAMPLE * pSamples ; const EAS_SAMPLE * loopEnd ; EAS_I32 samp1 ; EAS_I32 samp2 ; EAS_I32 numSamples ; numSamples = pWTIntFrame -> numSamples ; if ( numSamples <= 0 ) { <START_BUG> ALOGE ( "b//26366256" ) ; <END_BUG> return ; } pOutputBuffer = pWTIntFrame -> pAudioBuffer ; loopEnd = ( const EAS_SAMPLE * ) pWTVoice -> loopEnd + 1 ; pSamples = ( const EAS_SAMPLE * ) pWTVoice -> phaseAccum ; phaseFrac = pWTVoice -> phaseFrac ; phaseInc = pWTIntFrame -> frame. phaseIncrement ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif while ( numSamples -- ) { acc0 = samp2 - samp1 ; acc0 = acc0 * phaseFrac ; acc0 = samp1 + ( acc0 >> NUM_PHASE_FRAC_BITS ) ; * pOutputBuffer ++ = ( EAS_I16 ) ( acc0 >> 2 ) ; phaseFrac += phaseInc ; acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS ; if ( acc0 > 0 ) { pSamples += acc0 ; phaseFrac = ( EAS_I32 ) ( ( EAS_U32 ) phaseFrac & PHASE_FRAC_MASK ) ; acc0 = ( EAS_I32 ) ( pSamples - loopEnd ) ; if ( acc0 >= 0 ) pSamples = ( const EAS_SAMPLE * ) pWTVoice -> loopStart + acc0 ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ]

Fix:
<S2SV_ModStart> ALOGE ( "b//26366256" ) ; android_errorWriteLog ( 0x534e4554, "26366256"
Buggy code:
 static Image * ReadARTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { const unsigned char * pixels ; Image * image ; QuantumInfo * quantum_info ; MagickBooleanType status ; size_t length ; ssize_t count, y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 1 ; image -> endian = MSBEndian ; ( void ) ReadBlobLSBShort ( image ) ; image -> columns = ( size_t ) ReadBlobLSBShort ( image ) ; ( void ) ReadBlobLSBShort ( image ) ; image -> rows = ( size_t ) ReadBlobLSBShort ( image ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( image_info -> ping!= MagickFalse ) { ( void ) CloseBlob ( image ) ; return ( GetFirstImageInList ( image ) ) ; } status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; SetImageColorspace ( image, GRAYColorspace, exception ) ; quantum_info = AcquireQuantumInfo ( image_info, image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; length = GetQuantumExtent ( image, quantum_info, GrayQuantum ) ; for ( y = 0 ; y < ( ssize_t ) image -> rows ; y ++ ) { register Quantum * magick_restrict

Fix:
<S2SV_ModStart> ) length ) { quantum_info = DestroyQuantumInfo ( quantum_info ) ; <S2SV_ModStart> "UnableToReadImageData" ) ; }
Buggy code:
 WORD32 ih264d_parse_nal_unit ( iv_obj_t * dec_hdl, ivd_video_decode_op_t * ps_dec_op, UWORD8 * pu1_buf, UWORD32 u4_length ) { dec_bit_stream_t * ps_bitstrm ; dec_struct_t * ps_dec = ( dec_struct_t * ) dec_hdl -> pv_codec_handle ; ivd_video_decode_ip_t * ps_dec_in = ( ivd_video_decode_ip_t * ) ps_dec -> pv_dec_in ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; UWORD8 u1_first_byte, u1_nal_ref_idc ; UWORD8 u1_nal_unit_type ; WORD32 i_status = OK ; ps_bitstrm = ps_dec -> ps_bitstrm ; if ( pu1_buf ) { if ( u4_length ) { ps_dec_op -> u4_frame_decoded_flag = 0 ; ih264d_process_nal_unit ( ps_dec -> ps_bitstrm, pu1_buf, u4_length ) ; SWITCHOFFTRACE ; u1_first_byte = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ; if ( NAL_FORBIDDEN_BIT ( u1_first_byte ) ) { H264_DEC_DEBUG_PRINT ( "\\nForbidden   bit   set   in   Nal   Unit,   Let\'s   try\\n" ) ; } <START_BUG> u1_nal_unit_type = NAL_UNIT_TYPE ( u1_first_byte ) ; <END_BUG> ps_dec -> u1_nal_unit_type = u1_nal_unit_type ; u1_nal_ref_idc = ( UWORD8 ) ( NAL_REF_IDC ( u1_first_byte ) ) ; switch ( u1_nal_unit_type ) { case SLICE_DATA_PARTITION_A_NAL : case SLICE_DATA_PARTITION_B_NAL : case

Fix:
<S2SV_ModStart> u1_first_byte ) ; if ( ( ps_dec -> u2_total_mbs_coded!= 0 ) && ( u1_nal_unit_type > IDR_SLICE_NAL ) ) { return ERROR_INCOMPLETE_FRAME ; }
Buggy code:
 static arguments_ty ast_for_arguments ( struct compiling * c, const node * n ) { int i, j, k, nposargs = 0, nkwonlyargs = 0 ; int nposdefaults = 0, found_default = 0 ; asdl_seq * posargs, * posdefaults, * kwonlyargs, * kwdefaults ; arg_ty vararg = NULL, kwarg = NULL ; arg_ty arg ; node * ch ; if ( TYPE ( n ) == parameters ) { if ( NCH ( n ) == 2 ) return arguments ( NULL, NULL, NULL, NULL, NULL, NULL, c -> c_arena ) ; n = CHILD ( n, 1 ) ; } assert ( TYPE ( n ) == typedargslist || TYPE ( n ) == varargslist ) ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == STAR ) { i ++ ; if ( i < NCH ( n ) && ( TYPE ( CHILD ( n, i ) ) == tfpdef || TYPE ( CHILD ( n, i ) ) == vfpdef ) ) { i ++ ; } break ; } if ( TYPE ( ch ) == DOUBLESTAR ) break ; if ( TYPE ( ch ) == vfpdef || TYPE ( ch ) == tfpdef ) nposargs ++ ; if ( TYPE ( ch ) == EQUAL ) nposdefaults ++ ; } for ( ; i < NCH ( n ) ; ++ i ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == DOUBLESTAR ) break ; if ( TYPE ( ch ) == tfpdef || TYPE ( ch ) == vfpdef ) nkwonlyargs ++ ; } posargs = ( nposargs? _Ta3_asdl_seq_new ( nposargs, c -> c_arena ) : NULL ) ; if (! posargs && nposargs ) return NULL ; kwonlyargs = ( nkwonlyargs? _Ta3_asdl_seq_new ( nkwonlyargs, c -> c_arena ) : NULL ) ; if (! kwonlyargs && nkwonlyargs ) return NULL ; posdefaults = ( nposdefaults? _Ta3_asdl_seq_new ( nposdefaults, c -> c

Fix:
<S2SV_ModStart> return NULL ; <S2SV_ModEnd> i = 0 <S2SV_ModStart> ; if ( <S2SV_ModEnd> TYPE ( CHILD <S2SV_ModStart> ; if ( <S2SV_ModEnd> TYPE ( CHILD <S2SV_ModStart> ; if ( <S2SV_ModEnd> TYPE ( CHILD <S2SV_ModStart> ; if ( <S2SV_ModEnd> TYPE ( CHILD <S2SV_ModStart> ; if ( <S2SV_ModEnd> TYPE ( CHILD
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_

Fix:
<S2SV_ModStart> buflen, buf_size - 8
Buggy code:
 int kvm_set_msr_common ( struct kvm_vcpu * vcpu, struct msr_data * msr_info ) { bool pr = false ; u32 msr = msr_info -> index ; u64 data = msr_info -> data ; switch ( msr ) { case MSR_AMD64_NB_CFG : case MSR_IA32_UCODE_REV : case MSR_IA32_UCODE_WRITE : case MSR_VM_HSAVE_PA : case MSR_AMD64_PATCH_LOADER : case MSR_AMD64_BU_CFG2 : break ; case MSR_EFER : return set_efer ( vcpu, data ) ; case MSR_K7_HWCR : data &= ~ ( u64 ) 0x40 ; data &= ~ ( u64 ) 0x100 ; data &= ~ ( u64 ) 0x8 ; if ( data!= 0 ) { vcpu_unimpl ( vcpu, "unimplemented   HWCR   wrmsr:   0x%llx\\n", data ) ; return 1 ; } break ; case MSR_FAM10H_MMIO_CONF_BASE : if ( data!= 0 ) { vcpu_unimpl ( vcpu, "unimplemented   MMIO_CONF_BASE   wrmsr:   " "0x%llx\\n", data ) ; return 1 ; } break ; case MSR_IA32_DEBUGCTLMSR : if (! data ) { break ; } else if ( data & ~ ( DEBUGCTLMSR_LBR | DEBUGCTLMSR_BTF ) ) { return 1 ; } vcpu_unimpl ( vcpu, "%s:   MSR_IA32_DEBUGCTLMSR   0x%llx,   nop\\n", __func__, data ) ; break ; case 0x200... 0x2ff : return set_msr_mtrr ( vcpu, msr, data ) ; case MSR_IA32_APICBASE : kvm_set_apic_base ( vcpu, data ) ; break ; case APIC_BASE_MSR... APIC_BASE_MSR + 0x3ff : return kvm_x2

Fix:
<S2SV_ModStart> | 1 ) ; if ( vcpu -> arch. time_offset & ( sizeof ( struct pvclock_vcpu_time_info ) - 1 ) ) break
Buggy code:
 static int nsv_parse_NSVf_header ( AVFormatContext * s ) { NSVContext * nsv = s -> priv_data ; AVIOContext * pb = s -> pb ; unsigned int av_unused file_size ; unsigned int size ; int64_t duration ; int strings_size ; int table_entries ; int table_entries_used ; nsv -> state = NSV_UNSYNC ; size = avio_rl32 ( pb ) ; if ( size < 28 ) return - 1 ; nsv -> NSVf_end = size ; file_size = ( uint32_t ) avio_rl32 ( pb ) ; av_log ( s, AV_LOG_TRACE, "NSV   NSVf   chunk_size   %u\\n", size ) ; av_log ( s, AV_LOG_TRACE, "NSV   NSVf   file_size   %u\\n", file_size ) ; nsv -> duration = duration = avio_rl32 ( pb ) ; av_log ( s, AV_LOG_TRACE, "NSV   NSVf   duration   %" PRId64 "   ms\\n", duration ) ; strings_size = avio_rl32 ( pb ) ; table_entries = avio_rl32 ( pb ) ; table_entries_used = avio_rl32 ( pb ) ; av_log ( s, AV_LOG_TRACE, "NSV   NSVf   info-strings   size:   %d,   table   entries:   %d,   bis   %d\\n", strings_size, table_entries, table_entries_used ) ; if ( avio_feof ( pb ) ) return - 1 ; av_log ( s, AV_LOG_TRACE, "NSV   got   header;   filepos   %" PRId64 "\\n", avio_tell ( pb ) ) ; if ( strings_size > 0 ) { char * strings ; char * p, * endp ; char * token, * value ; char quote ; p = strings = av_mallocz ( ( size_t ) strings_size + 1 ) ; if (! p ) return AVERROR ( ENOMEM ) ; endp = strings + strings

Fix:
<S2SV_ModStart> i ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> + size ; }
Buggy code:
 void flash_option_bytes_init ( int boot_from_dfu ) { uint32_t val = 0xfffff8aa ; if ( boot_from_dfu ) { val &= ~ ( 1 << 27 ) ; } else { if ( solo_is_locked ( ) ) { val = 0xfffff8cc ; } } val &= ~ ( 1 << 26 ) ; val &= ~ ( 1 << 25 ) ; val &= ~ ( 1 << 24 ) ; if ( FLASH -> OPTR == val ) { return ; } __disable_irq ( ) ; while ( FLASH -> SR & ( 1 << 16 ) ) ; flash_unlock ( ) ; if ( FLASH -> CR & ( 1 << 30 ) ) { FLASH -> OPTKEYR = 0x08192A3B ; FLASH -> OPTKEYR = 0x4C5D6E7F ; } FLASH -> OPTR = val ; FLASH -> CR |= ( 1 << 17 ) ; while ( FLASH -> SR & ( 1 << 16 ) ) ; flash_lock ( ) ; <START_BUG> __enable_irq ( ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( ) ; FLASH -> CR |= FLASH_CR_OBL_LAUNCH ; while ( true <S2SV_ModEnd> ) ; }
Buggy code:
 static int target_xcopy_locate_se_dev_e4_iter ( struct se_device * se_dev, <START_BUG> void * data ) <END_BUG> { struct xcopy_dev_search_info * info = data ; unsigned char tmp_dev_wwn [ XCOPY_NAA_IEEE_REGEX_LEN ] ; int rc ;  if (! se_dev -> dev_attrib. emulate_3pc ) <START_BUG> <END_BUG> return 0 ;  memset ( & tmp_dev_wwn [ 0 ], 0, XCOPY_NAA_IEEE_REGEX_LEN ) ; target_xcopy_gen_naa_ieee ( se_dev, & tmp_dev_wwn [ 0 ] ) ; <START_BUG> rc = memcmp ( & tmp_dev_wwn [ 0 ], info -> dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN ) ; <END_BUG>  if ( rc!= 0 ) <START_BUG> return 0 ; <END_BUG> info -> found_dev = se_dev ;  pr_debug ( "XCOPY   0xe4:   located   se_dev:   %p\\n", se_dev ) ; <START_BUG> rc = target_depend_item ( & se_dev -> dev_group. cg_item ) ; <END_BUG> if ( rc!= 0 ) { pr_err ( "configfs_depend_item   attempt   failed:   %d   for   se_dev:   %p\\n", rc, se_dev ) ; return rc ; } pr_debug ( "Called   configfs_depend_item   for   se_dev:   %p   se_dev->se_dev_group:   %p\\n", se_dev, & se_dev -> dev_group ) ; return 1 ; }

Fix:
<S2SV_ModStart> * se_dev, const unsigned char * dev_wwn ) { <S2SV_ModEnd> unsigned char tmp_dev_wwn <S2SV_ModStart>. emulate_3pc ) { pr_debug ( "XCOPY: <S2SV_blank> emulate_3pc <S2SV_blank> disabled <S2SV_blank> on <S2SV_blank> se_dev <S2SV_blank> %p\\n", se_dev ) ; <S2SV_ModStart> return 0 ; } <S2SV_ModStart> 0 ], <S2SV_ModEnd> dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN <S2SV_ModStart>!= 0 ) { pr_debug ( "XCOPY: <S2SV_blank> skip <S2SV_blank> non-matching: <S2SV_blank> %*ph\\n", XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn ) ; <S2SV_ModStart> return 0 ; } <S2SV_ModEnd> pr_debug ( "XCOPY <S2SV_blank> 0xe4: <S2SV_blank> located <S2SV_blank> se_dev: <S2SV_blank> %p\\n" <S2SV_ModStart> se_dev ) ; <S2SV_ModEnd> return 1 ;
Buggy code:
 static int open_url ( AVFormatContext * s, AVIOContext * * pb, const char * url, AVDictionary * opts, AVDictionary * opts2, int * is_http ) { HLSContext * c = s -> priv_data ; AVDictionary * tmp = NULL ; const char * proto_name = NULL ; int ret ; av_dict_copy ( & tmp, opts, 0 ) ; av_dict_copy ( & tmp, opts2, 0 ) ; if ( av_strstart ( url, "crypto", NULL ) ) { if ( url [ 6 ] == '+' || url [ 6 ] == ':' ) proto_name = avio_find_protocol_name ( url + 7 ) ; } if (! proto_name ) proto_name = avio_find_protocol_name ( url ) ; if (! proto_name ) return AVERROR_INVALIDDATA ; <START_BUG> if (! av_strstart ( proto_name, "http", NULL ) &&! av_strstart ( proto_name, "file", NULL ) ) <END_BUG> return AVERROR_INVALIDDATA ; if (! strncmp ( proto_name, url, strlen ( proto_name ) ) && url [ strlen ( proto_name ) ] == ':' ) ; else if ( av_strstart ( url, "crypto", NULL ) &&! strncmp ( proto_name, url + 7, strlen ( proto_name ) ) && url [ 7 + strlen ( proto_name ) ] == ':' ) ; else if ( strcmp ( proto_name, "file" ) ||! strncmp ( url, "file,", 5 ) ) return AVERROR_INVALIDDATA ; ret = s -> io_open ( s, pb, url, AVIO_FLAG_READ, & tmp ) ; if ( ret >= 0 ) { char * new_cookies = NULL ; if (! ( s -> flags & AVFMT_FLAG_CUSTOM_IO ) ) av_opt_get ( * pb, "cookies", AV_OPT_SEARCH_CHILDREN, ( uint8_t * * ) & new_cookies ) ; if ( new_cookies ) { av_free ( c -> cookies ) ; c -> cookies = new_cookies ; } av_dict_set ( & opts, "cookies", c -> cookies, 0 ) ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> av_strstart ( proto_name <S2SV_ModStart> ( proto_name, "file", NULL ) ) { if ( strcmp ( c -> allowed_extensions, "ALL" ) &&! av_match_ext ( url, c -> allowed_extensions ) ) { av_log ( s, AV_LOG_ERROR, "Filename <S2SV_blank> extension <S2SV_blank> of <S2SV_blank> \\\'%s\\\' <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> common <S2SV_blank> multimedia <S2SV_blank> extension, <S2SV_blank> blocked <S2SV_blank> for <S2SV_blank> security <S2SV_blank> reasons.\\n" "If <S2SV_blank> you <S2SV_blank> wish <S2SV_blank> to <S2SV_blank> override <S2SV_blank> this <S2SV_blank> adjust <S2SV_blank> allowed_extensions, <S2SV_blank> you <S2SV_blank> can <S2SV_blank> set <S2SV_blank> it <S2SV_blank> to <S2SV_blank> \\\'ALL\\\' <S2SV_blank> to <S2SV_blank> allow <S2SV_blank> all\\n", url ) ; return AVERROR_INVALIDDATA ; } } else if ( av_strstart ( proto_name, <S2SV_ModStart>, NULL ) ) { ; } else <S2SV_ModEnd> return AVERROR_INVALIDDATA ;
Buggy code:
 static void ip_optprint ( netdissect_options * ndo, register const u_char * cp, u_int length ) { register u_int option_len ; const char * sep = "" ; for ( ; length > 0 ; cp += option_len, length -= option_len ) { u_int option_code ; ND_PRINT ( ( ndo, "%s", sep ) ) ; sep = "," ; ND_TCHECK ( * cp ) ; option_code = * cp ; ND_PRINT ( ( ndo, "%s", tok2str ( ip_option_values, "unknown   %u", option_code ) ) ) ; if ( option_code == IPOPT_NOP || option_code == IPOPT_EOL ) option_len = 1 ; else { ND_TCHECK ( cp [ 1 ] ) ; option_len = cp [ 1 ] ; if ( option_len < 2 ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", option_len ) ) ; return ; } } if ( option_len > length ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", option_len ) ) ; return ; } ND_TCHECK2 ( * cp, option_len ) ; switch ( option_code ) { case IPOPT_EOL : return ; case IPOPT_TS : <START_BUG> ip_printts ( ndo, cp, option_len ) ; <END_BUG> break ; case IPOPT_RR : case IPOPT_SSRR : case IPOPT_LSRR : if ( ip_printroute ( ndo, cp, option_len ) == - 1 ) goto trunc ; break ;  case IPOPT_RA : <START_BUG> if ( option_len < 4 ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", option_len ) ) ; break ; } ND_TCHECK ( cp [ 3 ] ) ; if ( EXTRACT_16BITS ( & cp [ 2 ] )!= 0 ) ND_PRINT ( ( ndo, "   value   %u", EXTRACT_16BITS ( & cp [ 2 ] ) ) ) ; break ; case IPOPT_NOP : case IPOPT_SECURITY :<END_BUG>

Fix:
<S2SV_ModStart> case IPOPT_TS : if ( ip_printts <S2SV_ModEnd> ( ndo, <S2SV_ModStart> break ; case IPOPT_RR : case IPOPT_SSRR : case IPOPT_LSRR : if ( ip_printroute ( ndo, cp, option_len ) == - 1 ) goto trunc ; break ; case
Buggy code:
 static int nfp_flower_spawn_phy_reprs ( struct nfp_app * app, struct nfp_flower_priv * priv ) { struct nfp_eth_table * eth_tbl = app -> pf -> eth_tbl ; atomic_t * replies = & priv -> reify_replies ; struct nfp_flower_repr_priv * repr_priv ; struct nfp_repr * nfp_repr ; struct sk_buff * ctrl_skb ; struct nfp_reprs * reprs ; int err, reify_cnt ; unsigned int i ; ctrl_skb = nfp_flower_cmsg_mac_repr_start ( app, eth_tbl -> count ) ; if (! ctrl_skb ) return - ENOMEM ; reprs = nfp_reprs_alloc ( eth_tbl -> max_index + 1 ) ; if (! reprs ) { err = - ENOMEM ; goto err_free_ctrl_skb ; } for ( i = 0 ; i < eth_tbl -> count ; i ++ ) { unsigned int phys_port = eth_tbl -> ports [ i ]. index ; struct net_device * repr ; struct nfp_port * port ; u32 cmsg_port_id ; repr = nfp_repr_alloc ( app ) ; if (! repr ) { err = - ENOMEM ; goto err_reprs_clean ; } repr_priv = kzalloc ( sizeof ( * repr_priv ), GFP_KERNEL ) ; if (! repr_priv ) { err = - ENOMEM ; <START_BUG> goto err_reprs_clean ; <END_BUG> } nfp_repr = netdev_priv ( repr ) ; nfp_repr -> app_priv = repr_priv ; repr_priv -> nfp_repr = nfp_repr ; port = nfp_port_alloc ( app, NFP_PORT_PHYS_PORT, repr ) ; if ( IS_ERR ( port ) ) { err = PTR_ERR ( port ) ;  nfp_repr_free ( repr ) ; <START_BUG> goto err_reprs_clean ; } err = nfp_port_init_phy_port ( app -> pf, app, port, i ) ; <END_BUG> if ( err ) {  nfp_port_free (

Fix:
<S2SV_ModStart> - ENOMEM ; nfp_repr_free ( repr ) ; <S2SV_ModStart> port ) ; kfree ( repr_priv ) ; <S2SV_ModStart> err ) { kfree ( repr_priv ) ; <S2SV_ModStart> err ) { kfree ( repr_priv ) ;
Buggy code:
 int ocfs2_set_acl ( handle_t * handle, struct inode * inode, struct buffer_head * di_bh, int type, struct posix_acl * acl, struct ocfs2_alloc_context * meta_ac, struct ocfs2_alloc_context * data_ac ) { int name_index ; void * value = NULL ; size_t size = 0 ; int ret ; if ( S_ISLNK ( inode -> i_mode ) ) return - EOPNOTSUPP ; switch ( type ) { case ACL_TYPE_ACCESS : name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> umode_t mode = inode -> i_mode ; <END_BUG>  ret = posix_acl_equiv_mode ( acl, & mode ) ; <START_BUG> if ( ret < 0 ) return ret ; if ( ret == 0 ) acl = NULL ; ret = ocfs2_acl_set_mode ( inode, di_bh, handle, mode ) ; if ( ret ) return ret ; } break ; case ACL_TYPE_DEFAULT : name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } if ( acl ) { value = ocfs2_acl_to_xattr ( acl, & size ) ; if ( IS_ERR ( value ) ) return ( int ) PTR_ERR ( value ) ; } if ( handle ) ret = ocfs2_xattr_set_handle ( handle, inode, di_bh, name_index, "", value, size, 0, meta_ac, data_ac ) ; else ret = ocfs2_xattr_set ( inode, name_index, "", value, size, 0 ) ; kfree ( value ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> { umode_t mode ; ret = posix_acl_update_mode ( inode <S2SV_ModEnd>, & mode <S2SV_ModStart>, & mode, & acl ) ; if ( ret ) return ret <S2SV_ModEnd> ; ret =
Buggy code:
 static struct dst_entry * ip6_sk_dst_check ( struct sock * sk, struct dst_entry * dst, const struct flowi6 * fl6 ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; <START_BUG> struct rt6_info * rt = ( struct rt6_info * ) dst ; <END_BUG> if (! dst )  goto out ; <START_BUG> if ( ip6_rt_check ( & rt -> rt6i_dst, & fl6 -> daddr, np -> daddr_cache ) || # ifdef CONFIG_IPV6_SUBTREES ip6_rt_check ( & rt -> rt6i_src, & fl6 -> saddr, np -> saddr_cache ) || # endif ( fl6 -> flowi6_oif && fl6 -> flowi6_oif!= dst -> dev -> ifindex ) ) { dst_release ( dst ) ; dst = NULL ; } out : return dst ; }<END_BUG>

Fix:
<S2SV_ModStart> rt6_info * rt <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) goto out ; if ( dst -> ops -> family!= AF_INET6 ) { dst_release ( dst ) ; return NULL ; } rt = ( struct rt6_info * ) dst
Buggy code:
 static int cp2112_gpio_direction_input ( struct gpio_chip * chip, unsigned offset ) { struct cp2112_device * dev = gpiochip_get_data ( chip ) ; struct hid_device * hdev = dev -> hdev ; u8 * buf = dev -> in_out_buffer ; <START_BUG> unsigned long flags ; <END_BUG> int ret ;  spin_lock_irqsave ( & dev -> lock, flags ) ; <START_BUG> ret = hid_hw_raw_request ( hdev, CP2112_GPIO_CONFIG, buf, CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, HID_REQ_GET_REPORT ) ; if ( ret!= CP2112_GPIO_CONFIG_LENGTH ) { hid_err ( hdev, "error   requesting   GPIO   config:   %d\\n", ret ) ; goto exit ; } buf [ 1 ] &= ~ ( 1 << offset ) ; buf [ 2 ] = gpio_push_pull ; ret = hid_hw_raw_request ( hdev, CP2112_GPIO_CONFIG, buf, CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, HID_REQ_SET_REPORT ) ; if ( ret < 0 ) { hid_err ( hdev, "error   setting   GPIO   config:   %d\\n", ret ) ; goto exit ; } ret = 0 ; exit : <END_BUG> spin_unlock_irqrestore ( & dev -> lock, flags ) ;  return ret <= 0? ret : - EIO ; }

Fix:
<S2SV_ModStart> -> in_out_buffer ; <S2SV_ModEnd> int ret ; <S2SV_ModStart> int ret ; mutex_lock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; ret <S2SV_ModStart> ; exit : mutex_unlock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; return
Buggy code:
 static void balloon_process ( struct work_struct * work ) { enum bp_state state = BP_DONE ; long credit ; do { mutex_lock ( & balloon_mutex ) ; credit = current_credit ( ) ; if ( credit > 0 ) { if ( balloon_is_inflated ( ) ) state = increase_reservation ( credit ) ; else state = reserve_additional_memory ( ) ; } <START_BUG> if ( credit < 0 ) <END_BUG>  state = decrease_reservation ( - credit, GFP_BALLOON ) ; <START_BUG> state = update_schedule ( state ) ; mutex_unlock ( & balloon_mutex ) ; cond_resched ( ) ; } while ( credit && state == BP_DONE ) ; if ( state == BP_EAGAIN ) schedule_delayed_work ( & balloon_worker, balloon_stats. schedule_delay * HZ ) ; }<END_BUG>

Fix:
<S2SV_ModStart> < 0 ) { long n_pages ; n_pages = min ( - credit, si_mem_available ( ) ) ; <S2SV_ModStart> = decrease_reservation ( n_pages <S2SV_ModEnd>, GFP_BALLOON ) <S2SV_ModStart> GFP_BALLOON ) ; if ( state == BP_DONE && n_pages!= - credit && n_pages < totalreserve_pages ) state = BP_EAGAIN ; }
Buggy code:
 static void copy_fields ( const FieldMatchContext * fm, AVFrame * dst, const AVFrame * src, int field ) { int plane ; <START_BUG> for ( plane = 0 ; plane < 4 && src -> data [ plane ] ; plane ++ ) <END_BUG> av_image_copy_plane ( dst -> data [ plane ] + field * dst -> linesize [ plane ], dst -> linesize [ plane ] << 1, src -> data [ plane ] + field * src -> linesize [ plane ], src -> linesize [ plane ] << 1, get_width ( fm, src, plane ), get_height ( fm, src, plane ) // 2 ) ; }

Fix:
<S2SV_ModStart> src -> data [ plane ] && src -> linesize
Buggy code:
 int vp8_refining_search_sadx4 ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int error_per_bit, int search_range, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { MV neighbors [ 4 ] = { { - 1, 0 }, { 0, - 1 }, { 0, 1 }, { 1, 0 } } ; int i, j ; short this_row_offset, this_col_offset ; int what_stride = b -> src_stride ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; unsigned char * best_address = ( unsigned char * ) ( base_pre + d -> offset + ( ref_mv -> as_mv. row * pre_stride ) + ref_mv -> as_mv. col ) ; unsigned char * check_here ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; bestsad = fn_ptr -> sdf ( what, what_stride, best_address, <START_BUG> in_what_stride, UINT_MAX ) <END_BUG> + mvsad_err_cost ( ref_mv, & fcenter_mv, mvsadcost, error_per_bit ) ; for ( i = 0 ; i < search_range ; i ++ ) { int best_site = - 1 ; int all_in = 1 ; all_in &= ( ( ref_mv -> as_mv. row - 1 ) > x -> mv_

Fix:
<S2SV_ModStart> best_address, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; if
Buggy code:
 static inline signed short ReadPropertySignedShort ( const EndianType endian, const unsigned char * buffer ) { union { unsigned short unsigned_value ; signed short signed_value ; } quantum ; unsigned short value ; if ( endian == LSBEndian ) { <START_BUG> value = ( unsigned short ) ( ( buffer [ 1 ] << 8 ) | buffer [ 0 ] ) ; <END_BUG>  quantum. unsigned_value = ( value & 0xffff ) ; <START_BUG> return ( quantum. signed_value ) ; } <END_BUG> value = ( unsigned short ) ( ( ( ( unsigned char * ) buffer ) [ 0 ] << 8 ) |  <START_BUG> ( ( unsigned char * ) buffer ) [ 1 ] ) ; <END_BUG>  quantum. unsigned_value = ( value & 0xffff ) ; <START_BUG> return ( quantum. signed_value ) ; }<END_BUG>

Fix:
<S2SV_ModStart> unsigned short ) <S2SV_ModEnd> buffer [ 1 <S2SV_ModStart> ] << 8 ; value |= ( unsigned short ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> [ 0 ] <S2SV_ModEnd> ; quantum. <S2SV_ModStart>. unsigned_value = <S2SV_ModEnd> value & 0xffff <S2SV_ModStart> value & 0xffff <S2SV_ModEnd> ; return ( <S2SV_ModStart> unsigned short ) buffer <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> ] << 8 ; value |= ( unsigned short ) buffer <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> [ 1 ] <S2SV_ModEnd> ; quantum. <S2SV_ModStart>. unsigned_value = <S2SV_ModEnd> value & 0xffff <S2SV_ModStart> value & 0xffff <S2SV_ModEnd> ; return (
Buggy code:
 void httpClientParseQopParam ( const HttpParam * param, HttpWwwAuthenticateHeader * authHeader ) { # if ( HTTP_CLIENT_DIGEST_AUTH_SUPPORT == ENABLED ) size_t i ; size_t n ; authHeader -> qop = HTTP_AUTH_QOP_NONE ; for ( i = 0 ; i < param -> valueLen ; i += ( n + 1 ) ) { for ( n = 0 ; ( i + n ) < param -> valueLen ; n ++ ) { <START_BUG> if ( strchr ( ",   \\t", param -> value [ i + n ] ) ) <END_BUG> break ; } if ( n == 4 &&! osStrncasecmp ( param -> value + i, "auth", 4 ) ) { authHeader -> qop = HTTP_AUTH_QOP_AUTH ; } } if ( authHeader -> qop == HTTP_AUTH_QOP_NONE ) { authHeader -> mode = HTTP_AUTH_MODE_NONE ; } # endif }

Fix:
<S2SV_ModStart> { if ( osStrchr <S2SV_ModEnd> ( ", <S2SV_blank> \\t", <S2SV_ModStart> n ] )!= NULL ) { break ; } <S2SV_ModEnd> } if (
Buggy code:
 <START_BUG> int ip_options_get ( struct net * net, struct ip_options * * optp, <END_BUG> unsigned char * data, int optlen ) {  struct ip_options * opt = ip_options_get_alloc ( optlen ) ; <START_BUG> if (! opt ) return - ENOMEM ; if ( optlen ) <END_BUG> memcpy ( opt -> __data, data, optlen ) ;  return ip_options_get_finish ( net, optp, opt, optlen ) ; }

Fix:
<S2SV_ModStart> net, struct ip_options_rcu <S2SV_ModEnd> * * optp <S2SV_ModStart> ) { struct ip_options_rcu <S2SV_ModEnd> * opt = <S2SV_ModStart> ( opt -> opt.
Buggy code:
 static bool check_underflow ( const struct ip6t_entry * e ) { const struct xt_entry_target * t ; unsigned int verdict ; <START_BUG> if (! unconditional ( & e -> ipv6 ) ) <END_BUG> return false ; t = ip6t_get_target_c ( e ) ; if ( strcmp ( t -> u. user. name, XT_STANDARD_TARGET )!= 0 ) return false ; verdict = ( ( struct xt_standard_target * ) t ) -> verdict ; verdict = - verdict - 1 ; return verdict == NF_DROP || verdict == NF_ACCEPT ; }

Fix:
<S2SV_ModStart>! unconditional ( e <S2SV_ModEnd> ) ) return