nus-yam/ex-repair huggingface dataset:
Buggy code:
 protected int file_trycdf ( struct magic_set * ms, int fd, const unsigned char * buf, size_t nbytes ) { cdf_info_t info ; cdf_header_t h ; cdf_sat_t sat, ssat ; cdf_stream_t sst, scn ; cdf_dir_t dir ; int i ; const char * expn = "" ; const char * corrupt = "corrupt:   " ; info. i_fd = fd ; info. i_buf = buf ; info. i_len = nbytes ; if ( ms -> flags & MAGIC_APPLE ) return 0 ; if ( cdf_read_header ( & info, & h ) == - 1 ) return 0 ; # ifdef CDF_DEBUG cdf_dump_header ( & h ) ; # endif if ( ( i = cdf_read_sat ( & info, & h, & sat ) ) == - 1 ) { expn = "Can\'t   read   SAT" ; goto out0 ; } # ifdef CDF_DEBUG cdf_dump_sat ( "SAT", & sat, CDF_SEC_SIZE ( & h ) ) ; # endif if ( ( i = cdf_read_ssat ( & info, & h, & sat, & ssat ) ) == - 1 ) { expn = "Can\'t   read   SSAT" ; goto out1 ; } # ifdef CDF_DEBUG cdf_dump_sat ( "SSAT", & ssat, CDF_SHORT_SEC_SIZE ( & h ) ) ; # endif if ( ( i = cdf_read_dir ( & info, & h, & sat, & dir ) ) == - 1 ) { expn = "Can\'t   read   directory" ; goto out2 ; } const cdf_directory_t * root_storage ; if ( ( i = cdf_read_short_stream ( & info, & h, & sat, & dir, & sst, & root_storage ) ) == - 1 ) { expn = "Cannot   read   short   stream" ; goto out3 ; } # ifdef CDF_DEBUG cdf_dump_dir ( & info, & h, & sat, & ssat, & sst, & dir ) ; # endif # ifdef notdef if ( root_storage ) { if ( NOTMIME ( ms )

Fix:
<S2SV_ModStart> scn, root_storage <S2SV_ModEnd> ) ) <
Buggy code:
 static int kvaser_usb_leaf_flush_queue ( struct kvaser_usb_net_priv * priv ) { struct kvaser_cmd * cmd ; int rc ; <START_BUG> cmd = kmalloc ( sizeof ( * cmd ), GFP_KERNEL ) ; <END_BUG> if (! cmd ) return - ENOMEM ; cmd -> id = CMD_FLUSH_QUEUE ; cmd -> len = CMD_HEADER_LEN + sizeof ( struct kvaser_cmd_flush_queue ) ; cmd -> u. flush_queue. channel = priv -> channel ; cmd -> u. flush_queue. flags = 0x00 ; rc = kvaser_usb_send_cmd ( priv -> dev, cmd, cmd -> len ) ; kfree ( cmd ) ; return rc ; }

Fix:
<S2SV_ModStart> ; cmd = kzalloc <S2SV_ModEnd> ( sizeof (
Buggy code:
 int do_fpu_inst ( unsigned short inst, struct pt_regs * regs ) { struct task_struct * tsk = current ; struct sh_fpu_soft_struct * fpu = & ( tsk -> thread. xstate -> softfpu ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> if (! ( task_thread_info ( tsk ) -> status & TS_USEDFPU ) ) { fpu_init ( fpu ) ; task_thread_info ( tsk ) -> status |= TS_USEDFPU ; } return fpu_emulate ( inst, fpu, regs ) ; }

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 void vp8_reset_mb_tokens_context ( MACROBLOCKD * x ) { ENTROPY_CONTEXT * a_ctx = ( ( ENTROPY_CONTEXT * ) x -> above_context ) ; ENTROPY_CONTEXT * l_ctx = ( ( ENTROPY_CONTEXT * ) x -> left_context ) ; <START_BUG> vpx_memset ( a_ctx, 0, sizeof ( ENTROPY_CONTEXT_PLANES ) - 1 ) ; <END_BUG>  vpx_memset ( l_ctx, 0, sizeof ( ENTROPY_CONTEXT_PLANES ) - 1 ) ; <START_BUG> if (! x -> mode_info_context -> mbmi. is_4x4 ) { a_ctx [ 8 ] = l_ctx [ 8 ] = 0 ; } }<END_BUG>

Fix:
<S2SV_ModStart> left_context ) ; memset <S2SV_ModEnd> ( a_ctx, <S2SV_ModStart> 1 ) ; memset <S2SV_ModEnd> ( l_ctx,
Buggy code:
 static MagickBooleanType GetEXIFProperty ( const Image * image, const char * property, ExceptionInfo * exception ) { # define MaxDirectoryStack 16 # define EXIF_DELIMITER "\\n" # define EXIF_NUM_FORMATS 12 # define EXIF_FMT_BYTE 1 # define EXIF_FMT_STRING 2 # define EXIF_FMT_USHORT 3 # define EXIF_FMT_ULONG 4 # define EXIF_FMT_URATIONAL 5 # define EXIF_FMT_SBYTE 6 # define EXIF_FMT_UNDEFINED 7 # define EXIF_FMT_SSHORT 8 # define EXIF_FMT_SLONG 9 # define EXIF_FMT_SRATIONAL 10 # define EXIF_FMT_SINGLE 11 # define EXIF_FMT_DOUBLE 12 # define TAG_EXIF_OFFSET 0x8769 # define TAG_GPS_OFFSET 0x8825 # define TAG_INTEROP_OFFSET 0xa005 <START_BUG> # define EXIFMultipleValues ( size, format, arg ) { ssize_t component ; size_t length ; unsigned char * p1 ; length = 0 ; p1 = p ; for ( component = 0 ; component < components ; component ++ ) { length += FormatLocaleString ( buffer + length, MagickPathExtent - length, format ",   ", arg ) ; if ( length >= ( MagickPathExtent - 1 ) ) length = MagickPathExtent - 1 ; p1 += size ; } if ( length > 1 ) buffer [ length - 2 ] = '\\0' ; value = AcquireString ( buffer ) ; } <END_BUG>  # define EXIFMultipleFractions ( size, format, arg1, arg2 ) { ssize_t component ; size_t length ; unsigned char * p1 ; length = 0 ; p1 = p ; for ( component = 0 ; component < components ; component ++ ) { length += FormatLocaleString ( buffer + length, MagickPathExtent - length, format ",   ", ( arg1 ), ( arg2 ) ) ; if ( length >= ( MagickPathExtent - 1 ) ) length = MagickPathExtent - 1 ; p1 += size ; } if ( length > 1 ) buffer [ length - 2 ] = '\\0' ; value = AcquireString ( buffer ) ; } <START_BUG> typedef struct _DirectoryInfo { const<END_BUG>

Fix:
<S2SV_ModStart>, arg ) \\\n{ <S2SV_ModEnd> ssize_t component ; <S2SV_ModStart> buffer ) ; \\\n} <S2SV_ModEnd> # define EXIFMultipleFractions <S2SV_ModStart>, arg2 ) \\\n{ <S2SV_ModEnd> ssize_t component ; <S2SV_ModStart> buffer ) ; \\\n} <S2SV_ModEnd> typedef struct _DirectoryInfo <S2SV_ModStart> ; if ( q > ( exif + length - 12 ) ) break ; if ( <S2SV_ModStart> + 4 ) ; if ( components < 0 ) break
Buggy code:
 static int r_core_cmd_subst_i ( RCore * core, char * cmd, char * colon ) { const char * quotestr = "`" ; const char * tick = NULL ; char * ptr, * ptr2, * str ; char * arroba = NULL ; int i, ret = 0, pipefd ; bool usemyblock = false ; int scr_html = - 1 ; int scr_color = - 1 ; bool eos = false ; bool haveQuote = false ; if (! cmd ) { return 0 ; } cmd = r_str_trim_head_tail ( cmd ) ; switch ( * cmd ) { case '.' : if ( cmd [ 1 ] == \'"\' ) { return r_cmd_call ( core -> rcmd, cmd ) ; } break ; case \'"\' : for ( ; * cmd ; ) { int pipefd = - 1 ; ut64 oseek = UT64_MAX ; char * line, * p ; haveQuote = * cmd == \'"\' ; if ( haveQuote ) { cmd ++ ; <START_BUG> p = find_eoq ( cmd + 1 ) ; <END_BUG> if (! p ||! * p ) { eprintf ( "Missing   \\"   in   (%s).", cmd ) ; return false ; } * p ++ = 0 ; if (! * p ) { eos = true ; } } else { char * sc = strchr ( cmd, ';' ) ; if ( sc ) { * sc = 0 ; } r_core_cmd0 ( core, cmd ) ; if (! sc ) { break ; } cmd = sc + 1 ; continue ; } if ( p [ 0 ] ) { if ( p [ 0 ] == '@' ) { p -- ; } while ( p [ 1 ] == ';' || IS_WHITESPACE ( p [ 1 ] ) ) { p ++ ; } if ( p [ 1 ] == '@' || ( p [ 1 ] && p [ 2 ] == '@' ) ) { char * q = strchr ( p + 1, \'"\' ) ; if ( q ) { * q = 0 ; } haveQuote = q!= NULL ; oseek = core -> offset ; r_core_seek ( core, r_num_math ( core -> num, p + 2 ), 1 ) ; if ( q ) { * p = \'"\' ; p = q ; } else { p = str

Fix:
<S2SV_ModStart> ; p = cmd [ 0 ]? <S2SV_ModStart> + 1 ) : NULL
Buggy code:
 stmt_ty <START_BUG> AsyncWith ( asdl_seq * items, asdl_seq * body, int lineno, int col_offset, int <END_BUG> end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = AsyncWith_kind ; p -> v. AsyncWith. items = items ; p -> v. AsyncWith. body = body ;  p -> lineno = lineno ; <START_BUG> p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> * body, string type_comment, <S2SV_ModStart> ; p -> v. AsyncWith. type_comment = type_comment ; p ->
Buggy code:
 static PyObject * parsenumber ( struct compiling * c, const char * s ) { char * dup, * end ; PyObject * res = NULL ; assert ( s!= NULL ) ; if ( strchr ( s, '_' ) == NULL ) { return parsenumber_raw ( c, s ) ; } dup = PyMem_Malloc ( strlen ( s ) + 1 ) ; <START_BUG> end = dup ; <END_BUG> for ( ; * s ; s ++ ) { if ( * s!= '_' ) { * end ++ = * s ; } } * end = '\\0' ; res = parsenumber_raw ( c, dup ) ; PyMem_Free ( dup ) ; return res ; }

Fix:
<S2SV_ModStart> 1 ) ; if ( dup == NULL ) { return PyErr_NoMemory ( ) ; }
Buggy code:
 void WT_NoiseGenerator ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_PCM * pOutputBuffer ; EAS_I32 phaseInc ; EAS_I32 tmp0 ; EAS_I32 tmp1 ; EAS_I32 nInterpolatedSample ; EAS_I32 numSamples ; numSamples = pWTIntFrame -> numSamples ; if ( numSamples <= 0 ) { <START_BUG> ALOGE ( "b//26366256" ) ; <END_BUG> return ; } pOutputBuffer = pWTIntFrame -> pAudioBuffer ; phaseInc = pWTIntFrame -> frame. phaseIncrement ; tmp0 = ( EAS_I32 ) ( pWTVoice -> phaseAccum ) >> 18 ; tmp1 = ( EAS_I32 ) ( pWTVoice -> loopEnd ) >> 18 ; while ( numSamples -- ) { nInterpolatedSample = MULT_AUDIO_COEF ( tmp0, ( PHASE_ONE - pWTVoice -> phaseFrac ) ) ; nInterpolatedSample += MULT_AUDIO_COEF ( tmp1, pWTVoice -> phaseFrac ) ; * pOutputBuffer ++ = ( EAS_PCM ) nInterpolatedSample ; pWTVoice -> phaseFrac += ( EAS_U32 ) phaseInc ; if ( GET_PHASE_INT_PART ( pWTVoice -> phaseFrac ) ) { tmp0 = tmp1 ; pWTVoice -> phaseAccum = pWTVoice -> loopEnd ; pWTVoice -> loopEnd = ( 5 * pWTVoice -> loopEnd + 1 ) ; tmp1 = ( EAS_I32 ) ( pWTVoice -> loopEnd ) >> 18 ; pWTVoice -> phaseFrac = GET_PHASE_FRAC_PART ( pWTVoice -> phaseFrac ) ; } } }

Fix:
<S2SV_ModStart> ALOGE ( "b//26366256" ) ; android_errorWriteLog ( 0x534e4554, "26366256"
Buggy code:
 static struct task_struct * copy_process ( unsigned long clone_flags, unsigned long stack_start, unsigned long stack_size, int __user * child_tidptr, struct pid * pid, int trace ) { int retval ; struct task_struct * p ; if ( ( clone_flags & ( CLONE_NEWNS | CLONE_FS ) ) == ( CLONE_NEWNS | CLONE_FS ) ) return ERR_PTR ( - EINVAL ) ; <START_BUG> if ( ( clone_flags & CLONE_THREAD ) &&! ( clone_flags & CLONE_SIGHAND ) ) <END_BUG> return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_SIGHAND ) &&! ( clone_flags & CLONE_VM ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_PARENT ) && current -> signal -> flags & SIGNAL_UNKILLABLE ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & ( CLONE_VM | CLONE_NEWPID ) ) && ( task_active_pid_ns ( current )!= current -> nsproxy -> pid_ns ) ) return ERR_PTR ( - EINVAL ) ; retval = security_task_create ( clone_flags ) ; if ( retval ) goto fork_out ; retval = - ENOMEM ; p = dup_task_struct ( current ) ; if (! p ) goto fork_out ; ftrace_graph_init_task ( p ) ; get_seccomp_filter ( p ) ; rt_mutex_init_task ( p ) ; # ifdef CONFIG_PROVE_LOCKING DEBUG_LOCKS_WARN_ON (! p -> hardirqs_enabled ) ; DEBUG_LOCKS_WARN_ON (! p -> softirqs_enabled ) ; # endif retval = - EAGAIN ; if ( atomic_read ( & p -> real_cred -> user -> processes ) >= task_rlimit ( p, RLIMIT_NPROC ) ) { if (! capable ( CAP_SYS_ADMIN ) &&! capable ( CAP_SYS_RESOURCE ) && p -> real_cred -> user!= INIT_USER ) goto bad_fork_free ; } current -> flags &= ~ PF_NPROC_EXCEEDED ; retval = copy

Fix:
<S2SV_ModStart> ( clone_flags & ( CLONE_NEWUSER | CLONE_FS ) ) == ( CLONE_NEWUSER | CLONE_FS ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags &
Buggy code:
 void configSetCommand ( client * c ) { robj * o ; long long ll ; int err ; serverAssertWithInfo ( c, c -> argv [ 2 ], sdsEncodedObject ( c -> argv [ 2 ] ) ) ; serverAssertWithInfo ( c, c -> argv [ 3 ], sdsEncodedObject ( c -> argv [ 3 ] ) ) ; o = c -> argv [ 3 ] ; if ( 0 ) { config_set_special_field ( "dbfilename" ) { if (! pathIsBaseName ( o -> ptr ) ) { addReplyError ( c, "dbfilename   can\'t   be   a   path,   just   a   filename" ) ; return ; } zfree ( server. rdb_filename ) ; server. rdb_filename = zstrdup ( o -> ptr ) ; } config_set_special_field ( "requirepass" ) { if ( sdslen ( o -> ptr ) > CONFIG_AUTHPASS_MAX_LEN ) goto badfmt ; zfree ( server. requirepass ) ; server. requirepass = ( ( char * ) o -> ptr ) [ 0 ]? zstrdup ( o -> ptr ) : NULL ; } config_set_special_field ( "masterauth" ) { zfree ( server. masterauth ) ; server. masterauth = ( ( char * ) o -> ptr ) [ 0 ]? zstrdup ( o -> ptr ) : NULL ; } config_set_special_field ( "cluster-announce-ip" ) { zfree ( server. cluster_announce_ip ) ; server. cluster_announce_ip = ( ( char * ) o -> ptr ) [ 0 ]? zstrdup ( o -> ptr ) : NULL ; } config_set_special_field ( "maxclients" ) { int orig_value = server. maxclients ; if ( getLongLongFromObject ( o, & ll ) == C_ERR || ll < 1 ) goto badfmt ; server. maxclients = ll ; if ( ll > orig_value ) { adjustOpenFilesLimit ( ) ; if ( server. maxclients!= ll ) { addReplyErrorFormat ( c, "The   operating   system   is   not   able   to   handle   the   specified   number   of   clients,   try   with   %d", server. maxclients )

Fix:
<S2SV_ModStart> 0 ) { int class = <S2SV_ModEnd> getClientTypeByName ( v <S2SV_ModStart> j ] ) ; if ( class <S2SV_ModStart> == - 1 || class == CLIENT_TYPE_MASTER
Buggy code:
 static ssize_t ib_ucm_write ( struct file * filp, const char __user * buf, size_t len, loff_t * pos ) { struct ib_ucm_file * file = filp -> private_data ; struct ib_ucm_cmd_hdr hdr ; <START_BUG> ssize_t result ; <END_BUG> if ( len < sizeof ( hdr ) ) return - EINVAL ; if ( copy_from_user ( & hdr, buf, sizeof ( hdr ) ) ) return - EFAULT ; if ( hdr. cmd >= ARRAY_SIZE ( ucm_cmd_table ) ) return - EINVAL ; if ( hdr. in + sizeof ( hdr ) > len ) return - EINVAL ; result = ucm_cmd_table [ hdr. cmd ] ( file, buf + sizeof ( hdr ), hdr. in, hdr. out ) ; if (! result ) result = len ; return result ; }

Fix:
<S2SV_ModStart> ; ssize_t result ; if ( WARN_ON_ONCE (! ib_safe_file_access ( filp ) ) ) return - EACCES
Buggy code:
 static int64_t http_seek_internal ( URLContext * h, int64_t off, int whence, int force_reconnect ) { HTTPContext * s = h -> priv_data ; URLContext * old_hd = s -> hd ; <START_BUG> int64_t old_off = s -> off ; <END_BUG> uint8_t old_buf [ BUFFER_SIZE ] ; int old_buf_size, ret ; AVDictionary * options = NULL ; if ( whence == AVSEEK_SIZE ) return s -> filesize ; else if (! force_reconnect && ( ( whence == SEEK_CUR && off == 0 ) || ( whence == SEEK_SET && off == s -> off ) ) ) return s -> off ;  else if ( ( s -> filesize == - 1 && whence == SEEK_END ) ) <START_BUG> return AVERROR ( ENOSYS ) ; if ( whence == SEEK_CUR ) off += s -> off ; else if ( whence == SEEK_END ) off += s -> filesize ; else if ( whence!= SEEK_SET ) return AVERROR ( EINVAL ) ; if ( off < 0 ) return AVERROR ( EINVAL ) ; s -> off = off ; if ( s -> off && h -> is_streamed ) return AVERROR ( ENOSYS ) ; old_buf_size = s -> buf_end - s -> buf_ptr ; memcpy ( old_buf, s -> buf_ptr, old_buf_size ) ; s -> hd = NULL ; if ( ( ret = http_open_cnx ( h, & options ) ) < 0 ) { av_dict_free ( & options ) ; memcpy ( s -> buffer, old_buf, old_buf_size ) ; s -> buf_ptr = s -> buffer ; s -> buf_end = s -> buffer + old_buf_size ; s -> hd = old_hd ; s -> off = old_off ; return ret ; } av_dict_free ( & options ) ; ffurl_close ( old_hd ) ; return off ; }<END_BUG>

Fix:
<S2SV_ModStart> -> hd ; uint64_t <S2SV_ModEnd> old_off = s <S2SV_ModStart> -> filesize == UINT64_MAX <S2SV_ModEnd> && whence ==
Buggy code:
 static ssize_t __nfs4_get_acl_uncached ( struct inode * inode, void * buf, size_t buflen ) { <START_BUG> struct page * pages [ NFS4ACL_MAXPAGES ] ; <END_BUG> struct nfs_getaclargs args = {. fh = NFS_FH ( inode ),. acl_pages = pages,. acl_len = buflen, } ; struct nfs_getaclres res = {. acl_len = buflen, } ; void * resp_buf ; struct rpc_message msg = {. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_GETACL ],. rpc_argp = & args,. rpc_resp = & res, } ;  struct page * localpage = NULL ; <START_BUG> int ret ; if ( buflen < PAGE_SIZE ) { localpage = alloc_page ( GFP_KERNEL ) ; resp_buf = page_address ( localpage ) ; if ( localpage == NULL ) <END_BUG> return - ENOMEM ;  args. acl_pages [ 0 ] = localpage ; args. acl_pgbase = 0 ; args. acl_len = PAGE_SIZE ; } else { resp_buf = buf ; buf_to_pages ( buf, buflen, args. acl_pages, & args. acl_pgbase ) ; } ret = nfs4_call_sync ( NFS_SERVER ( inode ) -> client, NFS_SERVER ( inode ), & msg, & args. seq_args, & res. seq_res, 0 ) ; if ( ret ) goto out_free ; <START_BUG> if ( res. acl_len > args. acl_len ) <END_BUG>  nfs4_write_cached_acl ( inode, NULL, res. acl_len ) ; <START_BUG> else <END_BUG> nfs4_write_cached_acl ( inode, resp_buf, res. acl_len ) ;  if ( buf ) { ret = - ERANGE ; <START_BUG> if ( res. acl_len > buflen ) <END_BUG> goto out_free ;  if ( localpage ) <START_BUG> <END_BUG> memcpy ( buf, resp_buf, res. acl_len ) ;  } ret = res. acl_len ; out_free : <START_BUG> if ( localpage ) <END_BUG>  __free_page ( localpage ) ; <START_BUG> return ret<END_BUG>

Fix:
<S2SV_ModStart> [ NFS4ACL_MAXPAGES ] = { NULL, } <S2SV_ModStart>, } ; int ret = - ENOMEM, npages, i, acl_len = 0 ; npages = ( buflen + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; if ( npages == 0 ) npages = 1 ; for ( i = 0 ; i < npages ; i ++ ) { pages [ i ] = alloc_page ( GFP_KERNEL ) ; if (! pages [ i ] ) goto out_free ; } if ( npages > 1 ) { args. acl_scratch = alloc_page ( GFP_KERNEL ) ; if (! args. acl_scratch ) goto out_free ; } args. acl_len = npages * PAGE_SIZE ; args. acl_pgbase = 0 ; if ( buf <S2SV_ModEnd> == NULL ) <S2SV_ModStart> == NULL ) res. acl_flags |= NFS4_ACL_LEN_REQUEST ; resp_buf = page_address ( pages [ 0 ] ) ; dprintk ( "%s <S2SV_blank> <S2SV_blank> buf <S2SV_blank> %p <S2SV_blank> buflen <S2SV_blank> %ld <S2SV_blank> npages <S2SV_blank> %d <S2SV_blank> args.acl_len <S2SV_blank> %ld\\n"
Buggy code:
 static const u_char * ikev1_n_print ( netdissect_options * ndo, u_char tpay _U_, const struct isakmp_gen * ext, u_int item_len, <START_BUG> const u_char * ep, uint32_t phase, uint32_t doi0 _U_, <END_BUG>  uint32_t proto0 _U_, int depth ) <START_BUG> { const struct ikev1_pl_n * p ; struct ikev1_pl_n n ; const u_char * cp ; const u_char * ep2 ; uint32_t doi ; uint32_t proto ; static const char * notify_error_str [ ] = { NULL, "INVALID-PAYLOAD-TYPE", "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", "INVALID-COOKIE", "INVALID-MAJOR-VERSION", "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE", "INVALID-FLAGS", "INVALID-MESSAGE-ID", "INVALID-PROTOCOL-ID", "INVALID-SPI", "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED", "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX", "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION", "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING", "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED", "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION", "AUTHENTICATION-FAILED", "INVALID-SIGNATURE", "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME", "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", "UNEQUAL-PAYLOAD-LENGTHS", } ; static const char * ipsec_notify_error_str [ ] = { "RESERVED", } ; static const char * notify_status_str [ ] = { "CONNECTED", } ; static const char * ipsec_notify_status_str [ ] = { "RESPONDER-LIFETIME", "REPLAY-STATUS", "INITIAL-CONTACT", } ; # define NOTIFY<END_BUG>

Fix:
<S2SV_ModStart>, uint32_t phase _U_ <S2SV_ModStart>, int depth _U_ <S2SV_ModStart> ep ) { <S2SV_ModEnd> switch ( ntohs <S2SV_ModStart> [ 0 ] ) ; ND_PRINT ( ( ndo, " <S2SV_blank> attrs=(" ) <S2SV_ModStart> ) ; } ND_PRINT ( ( ndo, ")" ) ) ; <S2SV_ModStart> case IPSECDOI_NTYPE_REPLAY_STATUS : ND_PRINT ( ( ndo, " <S2SV_blank> status=(" ) ) ; <S2SV_ModStart> ) ) ; ND_PRINT ( ( ndo, ")" ) ) <S2SV_ModEnd> ; break ; <S2SV_ModStart> ; default : if ( ndo -> ndo_vflag > 3 ) { ND_PRINT ( ( ndo, " <S2SV_blank> data=(" ) ) ; if (! rawprint ( ndo, ( const uint8_t * ) ( cp ), ep - cp ) ) goto trunc ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ) ) ; } else { if (! ike_show_somedata ( ndo, cp, ep ) ) goto trunc ; } break ; }
Buggy code:
 void impeg2d_peek_next_start_code ( dec_state_t * ps_dec ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; impeg2d_bit_stream_flush_to_byte_boundary ( ps_stream ) ; while ( ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_PREFIX_LEN )!= START_CODE_PREFIX ) <START_BUG> && ( ps_dec -> s_bit_stream. u4_offset <= ps_dec -> s_bit_stream. u4_max_offset ) ) <END_BUG> { impeg2d_bit_stream_get ( ps_stream, 8 ) ; } return ; }

Fix:
<S2SV_ModStart> s_bit_stream. u4_offset < <S2SV_ModEnd> ps_dec -> s_bit_stream
Buggy code:
 struct dst_entry * inet6_csk_route_req ( const struct sock * sk, struct flowi6 * fl6, const struct request_sock * req, u8 proto ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; const struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct in6_addr * final_p, final ; struct dst_entry * dst ; memset ( fl6, 0, sizeof ( * fl6 ) ) ; fl6 -> flowi6_proto = proto ; fl6 -> daddr = ireq -> ir_v6_rmt_addr ; <START_BUG> final_p = fl6_update_dst ( fl6, np -> opt, & final ) ; <END_BUG>  fl6 -> saddr = ireq -> ir_v6_loc_addr ; <START_BUG> fl6 -> flowi6_oif = ireq -> ir_iif ; fl6 -> flowi6_mark = ireq -> ir_mark ; fl6 -> fl6_dport = ireq -> ir_rmt_port ; fl6 -> fl6_sport = htons ( ireq -> ir_num ) ; security_req_classify_flow ( req, flowi6_to_flowi ( fl6 ) ) ; dst = ip6_dst_lookup_flow ( sk, fl6, final_p ) ; if ( IS_ERR ( dst ) ) return NULL ; return dst ; }<END_BUG>

Fix:
<S2SV_ModStart> -> ir_v6_rmt_addr ; rcu_read_lock ( ) ; <S2SV_ModStart> ( fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ) <S2SV_ModStart> final ) ; rcu_read_unlock ( ) ;
Buggy code:
 int nfs3svc_decode_writeargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd3_writeargs * args ) { unsigned int len, v, hdr, dlen ; u32 max_blocksize = svc_max_payload ( rqstp ) ; struct kvec * head = rqstp -> rq_arg. head ; struct kvec * tail = rqstp -> rq_arg. tail ; p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; p = xdr_decode_hyper ( p, & args -> offset ) ; args -> count = ntohl ( * p ++ ) ; args -> stable = ntohl ( * p ++ ) ; <START_BUG> len = args -> len = ntohl ( * p ++ ) ; <END_BUG> if ( args -> count!= args -> len ) return 0 ; hdr = ( void * ) p - head -> iov_base ; dlen = head -> iov_len + rqstp -> rq_arg. page_len + tail -> iov_len - hdr ; if ( dlen < XDR_QUADLEN ( len ) * 4 ) return 0 ; if ( args -> count > max_blocksize ) { args -> count = max_blocksize ; len = args -> len = max_blocksize ; } rqstp -> rq_vec [ 0 ]. iov_base = ( void * ) p ; rqstp -> rq_vec [ 0 ]. iov_len = head -> iov_len - hdr ; v = 0 ; while ( len > rqstp -> rq_vec [ v ]. iov_len ) { len -= rqstp -> rq_vec [ v ]. iov_len ; v ++ ; rqstp -> rq_vec [ v ]. iov_base = page_address ( rqstp -> rq_pages [ v ] ) ; rqstp -> rq_vec [ v ]. iov_len = PAGE_SIZE ; } rqstp -> rq_vec [ v ]. iov_len = len ; args -> vlen = v + 1 ; return 1 ; }

Fix:
<S2SV_ModStart> p ++ ) ; if ( ( void * ) p > head -> iov_base + head -> iov_len ) return 0
Buggy code:
 static int x25_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct x25_sock * x25 = x25_sk ( sk ) ; struct sockaddr_x25 * sx25 = ( struct sockaddr_x25 * ) msg -> msg_name ; size_t copied ; int qbit, header_len ; struct sk_buff * skb ; unsigned char * asmptr ; int rc = - ENOTCONN ; lock_sock ( sk ) ; if ( x25 -> neighbour == NULL ) goto out ; header_len = x25 -> neighbour -> extended? X25_EXT_MIN_LEN : X25_STD_MIN_LEN ; if ( sk -> sk_state!= TCP_ESTABLISHED ) goto out ; if ( flags & MSG_OOB ) { rc = - EINVAL ; if ( sock_flag ( sk, SOCK_URGINLINE ) ||! skb_peek ( & x25 -> interrupt_in_queue ) ) goto out ; skb = skb_dequeue ( & x25 -> interrupt_in_queue ) ; if (! pskb_may_pull ( skb, X25_STD_MIN_LEN ) ) goto out_free_dgram ; skb_pull ( skb, X25_STD_MIN_LEN ) ; if ( test_bit ( X25_Q_BIT_FLAG, & x25 -> flags ) ) { asmptr = skb_push ( skb, 1 ) ; * asmptr = 0x00 ; } msg -> msg_flags |= MSG_OOB ; } else { release_sock ( sk ) ; skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & rc ) ; lock_sock ( sk ) ; if (! skb ) goto out ; if (! pskb_may_pull ( skb, header_len ) ) goto out_free_dgram ; qbit = ( skb -> data [ 0 ] & X25_Q_BIT ) == X25_Q_BIT ; skb_pull ( skb, header_len ) ; if ( test_bit ( X

Fix:
<S2SV_ModStart> -> dest_addr ; <S2SV_ModEnd> msg -> msg_namelen <S2SV_ModStart> = sizeof ( * sx25 ) ; } <S2SV_ModEnd> x25_check_rbuf ( sk
Buggy code:
 int x86_decode_insn ( struct x86_emulate_ctxt * ctxt, void * insn, int insn_len ) { int rc = X86EMUL_CONTINUE ; int mode = ctxt -> mode ; int def_op_bytes, def_ad_bytes, goffset, simd_prefix ; bool op_prefix = false ; bool has_seg_override = false ; struct opcode opcode ; ctxt -> memop. type = OP_NONE ; ctxt -> memopp = NULL ; ctxt -> _eip = ctxt -> eip ; ctxt -> fetch. ptr = ctxt -> fetch. data ; ctxt -> fetch. end = ctxt -> fetch. data + insn_len ; ctxt -> opcode_len = 1 ; if ( insn_len > 0 ) memcpy ( ctxt -> fetch. data, insn, insn_len ) ; else { rc = __do_insn_fetch_bytes ( ctxt, 1 ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; } switch ( mode ) { case X86EMUL_MODE_REAL : case X86EMUL_MODE_VM86 : case X86EMUL_MODE_PROT16 : def_op_bytes = def_ad_bytes = 2 ; break ; case X86EMUL_MODE_PROT32 : def_op_bytes = def_ad_bytes = 4 ; break ; # ifdef CONFIG_X86_64 case X86EMUL_MODE_PROT64 : def_op_bytes = 4 ; def_ad_bytes = 8 ; break ; # endif default : return EMULATION_FAILED ; } ctxt -> op_bytes = def_op_bytes ; ctxt -> ad_bytes = def_ad_bytes ; for ( ; ; ) { switch ( ctxt -> b = insn_fetch ( u8, ctxt ) ) { case 0x66 : op_prefix = true ; ctxt -> op_bytes = def_op_bytes ^ 6 ; break ; case 0x67 : if ( mode == X86EMUL_MODE_PROT64 ) ctxt -> ad_bytes = def_ad_bytes ^ 12 ; else ctxt -> ad_bytes = def_ad_bytes ^ 6 ; break ; case 0x26 : case 0x2e : case 0x36 : case 0x3e : has_seg_override = true ; ctxt ->

Fix:
<S2SV_ModStart> OpMask ) ; <S2SV_ModEnd> if ( ctxt <S2SV_ModStart> -> _eip ; done :
Buggy code:
 void vp8_bilinear_predict8x8_neon ( unsigned char * src_ptr, int src_pixels_per_line, int xoffset, int yoffset, unsigned char * dst_ptr, int dst_pitch ) { uint8x8_t d0u8, d1u8, d2u8, d3u8, d4u8, d5u8, d6u8, d7u8, d8u8, d9u8, d11u8 ; uint8x8_t d22u8, d23u8, d24u8, d25u8, d26u8, d27u8, d28u8, d29u8, d30u8 ; uint8x16_t q1u8, q2u8, q3u8, q4u8, q5u8 ; uint16x8_t q1u16, q2u16, q3u16, q4u16, q5u16 ; uint16x8_t q6u16, q7u16, q8u16, q9u16, q10u16 ; if ( xoffset == 0 ) { d22u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d23u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d24u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d25u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d26u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d27u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d28u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d29u8 = vld1_u8 ( src_ptr ) ; src_ptr += src_pixels_per_line ; d30u8 = vld1

Fix:
<S2SV_ModStart> = vdup_n_u8 ( <S2SV_ModEnd> bifilter4_coeff [ xoffset <S2SV_ModStart> = vdup_n_u8 ( <S2SV_ModEnd> bifilter4_coeff [ xoffset
Buggy code:
 static int cx24116_send_diseqc_msg ( struct dvb_frontend * fe, struct dvb_diseqc_master_cmd * d ) { struct cx24116_state * state = fe -> demodulator_priv ; int i, ret ; <START_BUG> if ( debug ) { <END_BUG> printk ( KERN_INFO "cx24116:   %s(", __func__ ) ; for ( i = 0 ; i < d -> msg_len ; ) { printk ( KERN_INFO "0x%02x", d -> msg [ i ] ) ; if ( ++ i < d -> msg_len ) printk ( KERN_INFO ",   " ) ; } printk ( ")   toneburst=%d\\n", toneburst ) ; }  if ( d -> msg_len > ( CX24116_ARGLEN - CX24116_DISEQC_MSGOFS ) ) <START_BUG> return - EINVAL ; for ( i = 0 ; i < d -> msg_len ; i ++ ) state -> dsec_cmd. args [ CX24116_DISEQC_MSGOFS + i ] = d -> msg [ i ] ; state -> dsec_cmd. args [ CX24116_DISEQC_MSGLEN ] = d -> msg_len ; state -> dsec_cmd. len = CX24116_DISEQC_MSGOFS + state -> dsec_cmd. args [ CX24116_DISEQC_MSGLEN ] ; if ( toneburst == CX24116_DISEQC_MESGCACHE ) return 0 ; else if ( toneburst == CX24116_DISEQC_TONEOFF ) state -> dsec_cmd. args [ CX24116_DISEQC_BURST ] = 0 ; else if ( toneburst == CX24116_DISEQC_TONECACHE ) { if ( d -> msg_len >= 4 && d -> msg [ 2 ] == 0x38 ) state -> dsec_cmd. args [ CX24116_DISEQC_BURST ] = ( ( d -> msg [ 3 ] & 4 ) >> 2 ) ; if ( debug ) dprintk ( "%s   burst=%d\\n", __func__,<END_BUG>

Fix:
<S2SV_ModStart> ; if ( d -> msg_len > sizeof ( d -> msg ) ) return - EINVAL ; if ( <S2SV_ModStart> ) ; } <S2SV_ModEnd> for ( i
Buggy code:
 void __sock_recv_timestamp ( struct msghdr * msg, struct sock * sk, struct sk_buff * skb ) { int need_software_tstamp = sock_flag ( sk, SOCK_RCVTSTAMP ) ; struct scm_timestamping tss ; int empty = 1 ; struct skb_shared_hwtstamps * shhwtstamps = skb_hwtstamps ( skb ) ; if ( need_software_tstamp && skb -> tstamp == 0 ) __net_timestamp ( skb ) ; if ( need_software_tstamp ) { if (! sock_flag ( sk, SOCK_RCVTSTAMPNS ) ) { struct timeval tv ; skb_get_timestamp ( skb, & tv ) ; put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMP, sizeof ( tv ), & tv ) ; } else { struct timespec ts ; skb_get_timestampns ( skb, & ts ) ; put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMPNS, sizeof ( ts ), & ts ) ; } } memset ( & tss, 0, sizeof ( tss ) ) ; if ( ( sk -> sk_tsflags & SOF_TIMESTAMPING_SOFTWARE ) && ktime_to_timespec_cond ( skb -> tstamp, tss. ts + 0 ) ) empty = 0 ; if ( shhwtstamps && ( sk -> sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE ) && ktime_to_timespec_cond ( shhwtstamps -> hwtstamp, tss. ts + 2 ) ) empty = 0 ; if (! empty ) { put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMPING, sizeof ( tss ), & tss ) ; <START_BUG> if ( skb -> len && ( sk -> sk_tsflags & SOF_TIMESTAMPING_OPT_STATS ) ) <END_BUG> put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS, skb -> len, skb -> data ) ; } }

Fix:
<S2SV_ModStart> ; if ( skb_is_err_queue ( skb ) &&
Buggy code:
 int yr_re_fast_exec ( uint8_t * code, uint8_t * input_data, size_t input_forwards_size, size_t input_backwards_size, int flags, RE_MATCH_CALLBACK_FUNC callback, void * callback_args, int * matches ) { RE_REPEAT_ANY_ARGS * repeat_any_args ; uint8_t * code_stack [ MAX_FAST_RE_STACK ] ; uint8_t * input_stack [ MAX_FAST_RE_STACK ] ; int matches_stack [ MAX_FAST_RE_STACK ] ; uint8_t * ip = code ; uint8_t * input = input_data ; uint8_t * next_input ; uint8_t * next_opcode ; uint8_t mask ; uint8_t value ; int i ; int stop ; int input_incr ; int sp = 0 ; int bytes_matched ; int max_bytes_matched ; max_bytes_matched = flags & RE_FLAGS_BACKWARDS? ( int ) input_backwards_size : ( int ) input_forwards_size ; input_incr = flags & RE_FLAGS_BACKWARDS? - 1 : 1 ; if ( flags & RE_FLAGS_BACKWARDS ) input -- ; code_stack [ sp ] = code ; input_stack [ sp ] = input ; matches_stack [ sp ] = 0 ; sp ++ ; while ( sp > 0 ) { sp -- ; ip = code_stack [ sp ] ; input = input_stack [ sp ] ; bytes_matched = matches_stack [ sp ] ; stop = FALSE ; while (! stop ) { if ( * ip == RE_OPCODE_MATCH ) { if ( flags & RE_FLAGS_EXHAUSTIVE ) { FAIL_ON_ERROR ( callback ( flags & RE_FLAGS_BACKWARDS? input + 1 : input_data, bytes_matched, flags, callback_args ) ) ; break ; } else { if ( matches!= NULL ) * matches = bytes_matched ; return ERROR_SUCCESS ; } } if ( bytes_matched >= max_bytes_matched ) break ; switch ( * ip ) { case RE_OPCODE_LITERAL : if ( * input == * ( ip + 1 ) ) { bytes_matched ++ ; input

Fix:
<S2SV_ModStart> ++ ) { <S2SV_ModEnd> if ( bytes_matched <S2SV_ModStart> max_bytes_matched ) break ; next_input = input + i * input_incr <S2SV_ModStart> -> min ; bytes_matched = yr_min ( bytes_matched, max_bytes_matched ) ;
Buggy code:
 EAS_BOOL WT_CheckSampleEnd ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame, EAS_BOOL update ) { EAS_U32 endPhaseAccum ; EAS_U32 endPhaseFrac ; EAS_I32 numSamples ; EAS_BOOL done = EAS_FALSE ; endPhaseFrac = pWTVoice -> phaseFrac + ( pWTIntFrame -> frame. phaseIncrement << SYNTH_UPDATE_PERIOD_IN_BITS ) ; endPhaseAccum = pWTVoice -> phaseAccum + GET_PHASE_INT_PART ( endPhaseFrac ) ; if ( endPhaseAccum >= pWTVoice -> loopEnd ) { numSamples = ( EAS_I32 ) ( pWTVoice -> loopEnd - pWTVoice -> phaseAccum ) ; numSamples = ( EAS_I32 ) ( ( numSamples << NUM_PHASE_FRAC_BITS ) - pWTVoice -> phaseFrac ) ; if ( pWTIntFrame -> frame. phaseIncrement ) { pWTIntFrame -> numSamples = 1 + ( numSamples // pWTIntFrame -> frame. phaseIncrement ) ; } else { pWTIntFrame -> numSamples = numSamples ; } if ( pWTIntFrame -> numSamples < 0 ) { ALOGE ( "b//26366256" ) ; <START_BUG> pWTIntFrame -> numSamples = 0 ; <END_BUG> } done = EAS_TRUE ; } if ( update ) { pWTVoice -> phaseFrac = endPhaseFrac ; pWTVoice -> phaseAccum = endPhaseAccum ; } return done ; }

Fix:
<S2SV_ModStart> "b//26366256" ) ; android_errorWriteLog ( 0x534e4554, "26366256" ) ;
Buggy code:
 char * compose_path ( ctrl_t * ctrl, char * path ) { struct stat st ; static char rpath [ PATH_MAX ] ; char * name, * ptr ; char dir [ PATH_MAX ] = { 0 } ; strlcpy ( dir, ctrl -> cwd, sizeof ( dir ) ) ; DBG ( "Compose   path   from   cwd:   %s,   arg:   %s", ctrl -> cwd, path? : "" ) ; if (! path ||! strlen ( path ) ) goto check ; if ( path ) { if ( path [ 0 ]!= '//' ) { if ( dir [ strlen ( dir ) - 1 ]!= '//' ) strlcat ( dir, "//", sizeof ( dir ) ) ; } strlcat ( dir, path, sizeof ( dir ) ) ; } check : while ( ( ptr = strstr ( dir, "////" ) ) ) memmove ( ptr, & ptr [ 1 ], strlen ( & ptr [ 1 ] ) + 1 ) ; if (! chrooted ) { size_t len = strlen ( home ) ; DBG ( "Server   path   from   CWD:   %s", dir ) ; if ( len > 0 && home [ len - 1 ] == '//' ) len -- ; memmove ( dir + len, dir, strlen ( dir ) + 1 ) ; memcpy ( dir, home, len ) ; DBG ( "Resulting   non-chroot   path:   %s", dir ) ; } if (! stat ( dir, & st ) && S_ISDIR ( st. st_mode ) ) { if (! realpath ( dir, rpath ) ) return NULL ; } else { name = basename ( path ) ; ptr = dirname ( dir ) ; memset ( rpath, 0, sizeof ( rpath ) ) ; if (! realpath ( ptr, rpath ) ) { INFO ( "Failed   realpath(%s):   %m", ptr ) ; return NULL ; } if ( rpath [ 1 ]!= 0 ) strlcat ( rpath, "//", sizeof ( rpath ) ) ; strlcat ( rpath, name, sizeof ( rpath ) ) ; } <START_BUG> if (! chrooted && strncmp ( dir, home, strlen ( home ) ) ) { <END_BUG> DBG ( "Failed   non-chroot   dir:%s   vs

Fix:
<S2SV_ModStart> && strncmp ( rpath <S2SV_ModEnd>, home,
Buggy code:
 static ssize_t ucma_process_join ( struct ucma_file * file, struct rdma_ucm_join_mcast * cmd, int out_len ) { struct rdma_ucm_create_id_resp resp ; struct ucma_context * ctx ; struct ucma_multicast * mc ; struct sockaddr * addr ; int ret ; u8 join_state ; if ( out_len < sizeof ( resp ) ) return - ENOSPC ; addr = ( struct sockaddr * ) & cmd -> addr ; if ( cmd -> addr_size!= rdma_addr_size ( addr ) ) return - EINVAL ; if ( cmd -> join_flags == RDMA_MC_JOIN_FLAG_FULLMEMBER ) join_state = BIT ( FULLMEMBER_JOIN ) ; else if ( cmd -> join_flags == RDMA_MC_JOIN_FLAG_SENDONLY_FULLMEMBER ) join_state = BIT ( SENDONLY_FULLMEMBER_JOIN ) ; else return - EINVAL ; ctx = ucma_get_ctx_dev ( file, cmd -> id ) ; if ( IS_ERR ( ctx ) ) return PTR_ERR ( ctx ) ; mutex_lock ( & file -> mut ) ; mc = ucma_alloc_multicast ( ctx ) ; if (! mc ) { ret = - ENOMEM ; goto err1 ; } mc -> join_state = join_state ; mc -> uid = cmd -> uid ; memcpy ( & mc -> addr, addr, cmd -> addr_size ) ; ret = rdma_join_multicast ( ctx -> cm_id, ( struct sockaddr * ) & mc -> addr, join_state, mc ) ; if ( ret ) goto err2 ; resp. id = mc -> id ; if ( copy_to_user ( u64_to_user_ptr ( cmd -> response ), & resp, sizeof ( resp ) ) ) { ret = - EFAULT ; goto err3 ; } <START_BUG> mutex_unlock ( & file -> mut ) ; <END_BUG> ucma_put_ctx ( ctx ) ; return 0 ; err3 : rdma_leave_multicast ( ctx -> cm_id, ( struct sockaddr * ) & mc -> addr ) ; ucma_cleanup_mc_events ( mc ) ; err2 : mutex_lock ( & mut ) ; idr_

Fix:
<S2SV_ModStart> err3 ; } mutex_lock ( & mut ) ; idr_replace ( & multicast_idr, mc, mc -> id ) ; mutex_unlock ( & mut ) ;
Buggy code:
 DhcpOption * dhcpGetOption ( const DhcpMessage * message, size_t length, uint8_t optionCode ) { <START_BUG> uint_t i ; <END_BUG> DhcpOption * option ;  if ( length < sizeof ( DhcpMessage ) ) <START_BUG> <END_BUG> return NULL ;  length -= sizeof ( DhcpMessage ) ; for ( i = 0 ; i < length ; i ++ ) { option = ( DhcpOption * ) ( message -> options + i ) ; if ( option -> code == DHCP_OPT_PAD ) <START_BUG> continue ; <END_BUG>  if ( option -> code == DHCP_OPT_END ) <START_BUG> break ; <END_BUG> if ( ( i + 1 ) >= length || ( i + 1 + option -> length ) >= length )  break ; if ( option -> code == optionCode ) return option ; i += option -> length + 1 ; } <START_BUG> return NULL ; <END_BUG> }

Fix:
<S2SV_ModStart> optionCode ) { size_t <S2SV_ModEnd> i ; DhcpOption <S2SV_ModStart> if ( length >= <S2SV_ModEnd> sizeof ( DhcpMessage <S2SV_ModStart> DhcpMessage ) ) { <S2SV_ModEnd> length -= sizeof <S2SV_ModStart> == DHCP_OPT_PAD ) { } else <S2SV_ModEnd> if ( option <S2SV_ModStart> code == DHCP_OPT_END ) { break ; } else { if ( ( i + 1 ) >= length <S2SV_ModStart> ( i + sizeof ( DhcpOption ) <S2SV_ModEnd> + option -> <S2SV_ModStart> -> length ) > <S2SV_ModEnd> length ) break <S2SV_ModStart> 1 ; } } }
Buggy code:
 static ssize_t aio_run_iocb ( struct kiocb * req, unsigned opcode, char __user * buf, size_t len, bool compat ) { struct file * file = req -> ki_filp ; ssize_t ret ; unsigned long nr_segs ; int rw ; fmode_t mode ; aio_rw_op * rw_op ; rw_iter_op * iter_op ; struct iovec inline_vecs [ UIO_FASTIOV ], * iovec = inline_vecs ; struct iov_iter iter ; switch ( opcode ) { case IOCB_CMD_PREAD : case IOCB_CMD_PREADV : mode = FMODE_READ ; rw = READ ; rw_op = file -> f_op -> aio_read ; iter_op = file -> f_op -> read_iter ; goto rw_common ; case IOCB_CMD_PWRITE : case IOCB_CMD_PWRITEV : mode = FMODE_WRITE ; rw = WRITE ; rw_op = file -> f_op -> aio_write ; iter_op = file -> f_op -> write_iter ; goto rw_common ; rw_common : if ( unlikely (! ( file -> f_mode & mode ) ) ) return - EBADF ; if (! rw_op &&! iter_op ) return - EINVAL ; if ( opcode == IOCB_CMD_PREADV || opcode == IOCB_CMD_PWRITEV ) ret = aio_setup_vectored_rw ( req, rw, buf, & nr_segs, <START_BUG> & len, & iovec, compat ) ; <END_BUG> else ret = aio_setup_single_vector ( req, rw, buf, & nr_segs,  len, iovec ) ; <START_BUG> if (! ret ) ret = rw_verify_area ( rw, file, & req -> ki_pos, len ) ; if ( ret < 0 ) { if ( iovec!= inline_vecs ) kfree ( iovec ) ; return ret ; } len = ret ; if ( req -> ki_pos < 0 ) { ret = - EINVAL ; break ; } if ( rw == WRITE ) file_start_write ( file ) ; if ( iter_op ) { <END_BUG> iov_iter_init ( & iter,

Fix:
<S2SV_ModStart> iovec, compat, & iter <S2SV_ModStart> len, iovec, & iter <S2SV_ModStart> iter_op ) { ret = iter_op ( req, & iter ) ; } else { ret = rw_op ( req, iter. iov, iter. <S2SV_ModEnd> nr_segs, req
Buggy code:
 struct sk_buff * __skb_recv_datagram ( struct sock * sk, unsigned int flags, int * peeked, int * off, int * err ) { struct sk_buff * skb ; long timeo ; int error = sock_error ( sk ) ; if ( error ) goto no_packet ; timeo = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; do { unsigned long cpu_flags ; struct sk_buff_head * queue = & sk -> sk_receive_queue ; spin_lock_irqsave ( & queue -> lock, cpu_flags ) ; skb_queue_walk ( queue, skb ) { * peeked = skb -> peeked ; if ( flags & MSG_PEEK ) { <START_BUG> if ( * off >= skb -> len ) { <END_BUG> * off -= skb -> len ; continue ; } skb -> peeked = 1 ; atomic_inc ( & skb -> users ) ; } else __skb_unlink ( skb, queue ) ; spin_unlock_irqrestore ( & queue -> lock, cpu_flags ) ; return skb ; } spin_unlock_irqrestore ( & queue -> lock, cpu_flags ) ; error = - EAGAIN ; if (! timeo ) goto no_packet ; } while (! wait_for_packet ( sk, err, & timeo ) ) ; return NULL ; no_packet : * err = error ; return NULL ; }

Fix:
<S2SV_ModStart> skb -> len && skb -> len
Buggy code:
 int install_process_keyring_to_cred ( struct cred * new ) { struct key * keyring ; if ( new -> process_keyring ) <START_BUG> return - EEXIST ; <END_BUG> keyring = keyring_alloc ( "_pid", new -> uid, new -> gid, new, KEY_POS_ALL | KEY_USR_VIEW, KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL ) ; if ( IS_ERR ( keyring ) ) return PTR_ERR ( keyring ) ; new -> process_keyring = keyring ; return 0 ; }

Fix:
<S2SV_ModStart> process_keyring ) return 0 <S2SV_ModEnd> ; keyring =
Buggy code:
 static MagickBooleanType ReadPSDLayersInternal ( Image * image, const ImageInfo * image_info, const PSDInfo * psd_info, const MagickBooleanType skip_layers, ExceptionInfo * exception ) { char type [ 4 ] ; LayerInfo * layer_info ; MagickSizeType size ; MagickBooleanType status ; register ssize_t i ; ssize_t count, j, number_layers ; size = GetPSDSize ( psd_info, image ) ; if ( size == 0 ) { ( void ) ReadBlobLong ( image ) ; count = ReadBlob ( image, 4, ( unsigned char * ) type ) ; ReversePSDString ( image, type, 4 ) ; status = MagickFalse ; if ( ( count == 0 ) || ( LocaleNCompare ( type, "8BIM", 4 )!= 0 ) ) return ( MagickTrue ) ; else { count = ReadBlob ( image, 4, ( unsigned char * ) type ) ; ReversePSDString ( image, type, 4 ) ; if ( ( count!= 0 ) && ( LocaleNCompare ( type, "Lr16", 4 ) == 0 ) ) size = GetPSDSize ( psd_info, image ) ; else return ( MagickTrue ) ; } } status = MagickTrue ; if ( size!= 0 ) { layer_info = ( LayerInfo * ) NULL ; number_layers = ( short ) ReadBlobShort ( image ) ; if ( number_layers < 0 ) { number_layers = MagickAbsoluteValue ( number_layers ) ; if ( image -> debug!= MagickFalse ) ( void ) LogMagickEvent ( CoderEvent, GetMagickModule ( ), "     negative   layer   count   corrected   for" ) ; image -> matte = MagickTrue ; } if ( skip_layers!= MagickFalse ) return ( MagickTrue ) ; if ( image -> debug!= MagickFalse ) ( void ) LogMagickEvent ( CoderEvent, GetMagickModule ( ), "     image   contains   %.20g   layers", ( double ) number_layers ) ; if ( number_layers == 0 ) ThrowBinaryException ( CorruptImageError, "InvalidNumberOfLayers", image -> filename ) ; layer_info = ( LayerInfo * ) AcquireQuantumMemory ( ( size_t ) number

Fix:
<S2SV_ModStart> ; if ( EOFBlob ( image )!= MagickFalse ) { layer_info = DestroyLayerInfo ( layer_info, number_layers ) ; ThrowBinaryException ( CorruptImageError, "InsufficientImageDataInFile", image -> filename ) ; } if (
Buggy code:
 int snd_timer_open ( struct snd_timer_instance * * ti, char * owner, struct snd_timer_id * tid, unsigned int slave_id ) { struct snd_timer * timer ; struct snd_timer_instance * timeri = NULL ; struct device * card_dev_to_put = NULL ; int err ; mutex_lock ( & register_mutex ) ; if ( tid -> dev_class == SNDRV_TIMER_CLASS_SLAVE ) { if ( tid -> dev_sclass <= SNDRV_TIMER_SCLASS_NONE || tid -> dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER ) { pr_debug ( "ALSA:   timer:   invalid   slave   class   %i\\n", tid -> dev_sclass ) ; err = - EINVAL ; goto unlock ; } timeri = snd_timer_instance_new ( owner, NULL ) ; if (! timeri ) { err = - ENOMEM ; goto unlock ; } timeri -> slave_class = tid -> dev_sclass ; timeri -> slave_id = tid -> device ; timeri -> flags |= SNDRV_TIMER_IFLG_SLAVE ; list_add_tail ( & timeri -> open_list, & snd_timer_slave_list ) ; err = snd_timer_check_slave ( timeri ) ; if ( err < 0 ) { snd_timer_close_locked ( timeri, & card_dev_to_put ) ; timeri = NULL ; } goto unlock ; } timer = snd_timer_find ( tid ) ; # ifdef CONFIG_MODULES if (! timer ) { mutex_unlock ( & register_mutex ) ; snd_timer_request ( tid ) ; mutex_lock ( & register_mutex ) ; timer = snd_timer_find ( tid ) ; } # endif if (! timer ) { err = - ENODEV ; goto unlock ; } if (! list_empty ( & timer -> open_list_head ) ) { <START_BUG> timeri = list_entry ( timer -> open_list_head. next, <END_BUG> struct snd_timer_instance, open_list ) ;  if ( timeri -> flags & SNDRV_TIMER_IFLG_

Fix:
<S2SV_ModStart> ) ) { struct snd_timer_instance * t = <S2SV_ModEnd> list_entry ( timer <S2SV_ModStart> ; if ( t <S2SV_ModEnd> -> flags & <S2SV_ModStart> = - EBUSY <S2SV_ModEnd> ; goto unlock
Buggy code:
 static char * rfc2047_decode_word ( const char * s, size_t len, enum ContentEncoding enc ) { const char * it = s ; const char * end = s + len ; if ( enc == ENCQUOTEDPRINTABLE ) { struct Buffer buf = { 0 } ; for ( ; it < end ; ++ it ) { if ( * it == '_' ) { mutt_buffer_addch ( & buf,' ') ; } else if ( ( * it == '=' ) && (! ( it [ 1 ] & ~ 127 ) && hexval ( it [ 1 ] )!= - 1 ) && (! ( it [ 2 ] & ~ 127 ) && hexval ( it [ 2 ] )!= - 1 ) ) { mutt_buffer_addch ( & buf, ( hexval ( it [ 1 ] ) << 4 ) | hexval ( it [ 2 ] ) ) ; it += 2 ; } else { mutt_buffer_addch ( & buf, * it ) ; } } mutt_buffer_addch ( & buf, '\\0' ) ; return buf. data ; } else if ( enc == ENCBASE64 ) { <START_BUG> char * out = mutt_mem_malloc ( 3 * len // 4 + 1 ) ; <END_BUG>  int dlen = mutt_b64_decode ( out, it ) ; <START_BUG> if ( dlen == - 1 ) { FREE ( & out ) ; return NULL ; } out [ dlen ] = '\\0' ; return out ; } assert ( 0 ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> ENCBASE64 ) { const int olen = <S2SV_ModEnd> 3 * len <S2SV_ModStart> 4 + 1 ; char * out = mutt_mem_malloc ( olen <S2SV_ModStart> out, it, olen
Buggy code:
 static void ext4_clamp_want_extra_isize ( struct super_block * sb ) { struct ext4_sb_info * sbi = EXT4_SB ( sb ) ; struct ext4_super_block * es = sbi -> s_es ; <START_BUG> if ( sbi -> s_inode_size > EXT4_GOOD_OLD_INODE_SIZE && <END_BUG> sbi -> s_want_extra_isize == 0 ) { sbi -> s_want_extra_isize = sizeof ( struct ext4_inode ) - EXT4_GOOD_OLD_INODE_SIZE ; if ( ext4_has_feature_extra_isize ( sb ) ) { if ( sbi -> s_want_extra_isize < le16_to_cpu ( es -> s_want_extra_isize ) ) sbi -> s_want_extra_isize = le16_to_cpu ( es -> s_want_extra_isize ) ; if ( sbi -> s_want_extra_isize < le16_to_cpu ( es -> s_min_extra_isize ) ) sbi -> s_want_extra_isize = le16_to_cpu ( es -> s_min_extra_isize ) ; } } if ( EXT4_GOOD_OLD_INODE_SIZE + sbi -> s_want_extra_isize >  sbi -> s_inode_size ) { <START_BUG> sbi -> s_want_extra_isize = sizeof ( struct ext4_inode ) - EXT4_GOOD_OLD_INODE_SIZE ; ext4_msg ( sb, KERN_INFO, "required   extra   inode   space   not   available" ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> -> s_es ; unsigned def_extra_isize = sizeof ( struct ext4_inode ) - EXT4_GOOD_OLD_INODE_SIZE ; <S2SV_ModStart> sbi -> s_inode_size == EXT4_GOOD_OLD_INODE_SIZE ) { sbi -> s_want_extra_isize = 0 ; return ; } if ( sbi -> s_want_extra_isize < 4 ) { sbi -> s_want_extra_isize = def_extra_isize ; if ( ext4_has_feature_extra_isize ( sb ) ) { if ( sbi -> s_want_extra_isize < le16_to_cpu ( es -> s_want_extra_isize ) ) sbi -> s_want_extra_isize = le16_to_cpu ( es -> s_want_extra_isize ) ; if ( sbi -> s_want_extra_isize < le16_to_cpu ( es -> s_min_extra_isize ) ) sbi -> s_want_extra_isize = le16_to_cpu ( es -> s_min
Buggy code:
 <START_BUG> static int jas_iccputuint ( jas_stream_t * out, int n, ulonglong val ) <END_BUG> { int i ; int c ; for ( i = n ; i > 0 ; -- i ) { c = ( val >> ( 8 * ( i - 1 ) ) ) & 0xff ; if ( jas_stream_putc ( out, c ) == EOF ) return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> int n, jas_ulonglong <S2SV_ModEnd> val ) {
Buggy code:
 static noinline void key_gc_unused_keys ( struct list_head * keys ) { while (! list_empty ( keys ) ) { struct key * key = list_entry ( keys -> next, struct key, graveyard_link ) ; list_del ( & key -> graveyard_link ) ; kdebug ( "-   %u", key -> serial ) ; key_check ( key ) ; security_key_free ( key ) ; if ( test_bit ( KEY_FLAG_IN_QUOTA, & key -> flags ) ) { spin_lock ( & key -> user -> lock ) ; key -> user -> qnkeys -- ; key -> user -> qnbytes -= key -> quotalen ; spin_unlock ( & key -> user -> lock ) ; } atomic_dec ( & key -> user -> nkeys ) ; if ( test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ) atomic_dec ( & key -> user -> nikeys ) ; <START_BUG> key_user_put ( key -> user ) ; <END_BUG> if ( key -> type -> destroy ) key -> type -> destroy ( key ) ; kfree ( key -> description ) ; # ifdef KEY_DEBUGGING key -> magic = KEY_DEBUG_MAGIC_X ; # endif kmem_cache_free ( key_jar, key ) ; } }

Fix:
<S2SV_ModStart> nikeys ) ; if ( key -> type -> destroy ) key -> type -> destroy ( key ) ; <S2SV_ModStart> key -> user <S2SV_ModEnd> ) ; kfree
Buggy code:
 char * ReadInput ( char * filename ) { FILE * finput ; long filesize, num ; char * buffer ; if ( ( finput = fopen ( filename, "r" ) ) == 0 ) { fprintf ( stderr, "%s:   Cannot   open   file   %s\\n", axohelp, filename ) ; <START_BUG> exit ( - 1 ) ; <END_BUG> } if ( ( fseek ( finput, 0, SEEK_END )!= 0 ) || ( ( filesize = ftell ( finput ) ) < 0 ) || ( fseek ( finput, 0, SEEK_SET )!= 0 ) ) { fprintf ( stderr, "%s:   File   error   in   file   %s\\n", axohelp, filename ) ;  exit ( - 1 ) ; <START_BUG> } if ( ( buffer = malloc ( ( filesize + 1 ) * sizeof ( char ) ) ) == 0 ) { fprintf ( stderr, "%s:   Error   allocating   %ld   bytes   of   memory", axohelp, filesize + 1 ) ; <END_BUG> exit ( - 1 ) ;  } num = fread ( buffer, 1, filesize, finput ) ; if ( ferror ( finput ) ) { fprintf ( stderr, "%s:   Error   reading   file   %s\\n", axohelp, filename ) ; <START_BUG> exit ( - 1 ) ; <END_BUG> } buffer [ num ] = 0 ; fclose ( finput ) ; return ( buffer ) ; }

Fix:
<S2SV_ModStart> ; exit ( <S2SV_ModEnd> 1 ) ; <S2SV_ModStart> ; exit ( <S2SV_ModEnd> 1 ) ; <S2SV_ModStart> ; exit ( <S2SV_ModEnd> 1 ) ; <S2SV_ModStart> ; exit ( <S2SV_ModEnd> 1 ) ;