nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int parse_key_constraints ( struct sshbuf * m, struct sshkey * k, time_t * deathp, u_int * secondsp, int * confirmp, char * * sk_providerp ) { u_char ctype ; int r ; u_int seconds, maxsign = 0 ; <START_BUG> char * ext_name = NULL ; <END_BUG> struct sshbuf * b = NULL ; while ( sshbuf_len ( m ) ) { if ( ( r = sshbuf_get_u8 ( m, & ctype ) )!= 0 ) { error_fr ( r, "parse   constraint   type" ) ;  goto err ; <START_BUG> } switch ( ctype ) { case SSH_AGENT_CONSTRAIN_LIFETIME : if ( * deathp!= 0 ) { error_f ( "lifetime   already   set" ) ; <END_BUG> goto err ;  } if ( ( r = sshbuf_get_u32 ( m, & seconds ) )!= 0 ) { error_fr ( r, "parse   lifetime   constraint" ) ; <START_BUG> goto err ; <END_BUG> } * deathp = monotime ( ) + seconds ; * secondsp = seconds ; break ; case SSH_AGENT_CONSTRAIN_CONFIRM : if ( * confirmp!= 0 ) { error_f ( "confirm   already   set" ) ;  goto err ; <START_BUG> } * confirmp = 1 ; break ; case SSH_AGENT_CONSTRAIN_MAXSIGN : if ( k == NULL ) { error_f ( "maxsign   not   valid   here" ) ; <END_BUG> goto err ;  } if ( maxsign!= 0 ) { error_f ( "maxsign   already   set" ) ; <START_BUG> goto err ; <END_BUG> } if ( ( r = sshbuf_get_u32 ( m, & maxsign ) )!= 0 ) { error_fr ( r, "parse   maxsign   constraint" ) ;  goto err ; <START_BUG> } if ( ( r = sshkey_enable_maxsign ( k, maxsign ) )!= 0 ) { error_fr ( r, "enable   maxsign" ) ; <END_BUG> goto err ;  } break ; case SSH_AGENT_CONSTRAIN_EXTENSION : <START_BUG> if ( ( r = sshbuf_get_cstring ( m, & ext_name, NULL )<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> while ( sshbuf_len <S2SV_ModStart> ) ; goto out <S2SV_ModEnd> ; } switch <S2SV_ModStart> "lifetime <S2SV_blank> already <S2SV_blank> set" ) ; r = SSH_ERR_INVALID_FORMAT ; goto out <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ; goto out <S2SV_ModEnd> ; } * <S2SV_ModStart> "confirm <S2SV_blank> already <S2SV_blank> set" ) ; r = SSH_ERR_INVALID_FORMAT ; goto out <S2SV_ModEnd> ; } * <S2SV_ModStart> "maxsign <S2SV_blank> not <S2SV_blank> valid <S2SV_blank> here" ) ; r = SSH_ERR_INVALID_FORMAT ; goto out <S2SV_ModEnd> ; } if <S2SV_ModStart> "maxsign <S2SV_blank> already <S2SV_blank> set" ) ; r = SSH_ERR_INVALID_FORMAT ; goto out <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ; goto out <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ; goto out <S2SV_ModEnd> ; } break <S2SV_ModStart> ( r = parse_key_constraint_extension ( m, sk_providerp ) )!= 0 ) goto out ; break ; default : error_f ( <S2SV_ModEnd> "Unknown <S2SV_blank> constraint <S2SV_blank> %d", ctype <S2SV_ModStart> ctype ) ; r = SSH_ERR_FEATURE_UNSUPPORTED ; goto out ; } } r = 0 ; out : return r <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static ssize_t oz_cdev_write ( struct file * filp, const char __user * buf, size_t count, loff_t * fpos ) { struct oz_pd * pd ; struct oz_elt_buf * eb ; struct oz_elt_info * ei ; struct oz_elt * elt ; struct oz_app_hdr * app_hdr ; struct oz_serial_ctx * ctx ; <START_BUG> spin_lock_bh ( & g_cdev. lock ) ; <END_BUG> pd = g_cdev. active_pd ; if ( pd ) oz_pd_get ( pd ) ; spin_unlock_bh ( & g_cdev. lock ) ; if ( pd == NULL ) return - ENXIO ; if (! ( pd -> state & OZ_PD_S_CONNECTED ) ) return - EAGAIN ; eb = & pd -> elt_buff ; ei = oz_elt_info_alloc ( eb ) ; if ( ei == NULL ) { count = 0 ; goto out ; } elt = ( struct oz_elt * ) ei -> data ; app_hdr = ( struct oz_app_hdr * ) ( elt + 1 ) ; elt -> length = sizeof ( struct oz_app_hdr ) + count ; elt -> type = OZ_ELT_APP_DATA ; ei -> app_id = OZ_APPID_SERIAL ; ei -> length = elt -> length + sizeof ( struct oz_elt ) ; app_hdr -> app_id = OZ_APPID_SERIAL ; if ( copy_from_user ( app_hdr + 1, buf, count ) ) goto out ; spin_lock_bh ( & pd -> app_lock [ OZ_APPID_USB - 1 ] ) ; ctx = ( struct oz_serial_ctx * ) pd -> app_ctx [ OZ_APPID_SERIAL - 1 ] ; if ( ctx ) { app_hdr -> elt_seq_num = ctx -> tx_seq_num ++ ; if ( ctx -> tx_seq_num == 0 ) ctx -> tx_seq_num = 1 ; spin_lock ( & eb -> lock ) ; if ( oz_queue_elt_info ( eb, 0, 0, ei ) == 0 ) ei = NULL ; spin

Fix:
<S2SV_ModStart> * ctx ; if ( count > sizeof ( ei -> data ) - sizeof ( * elt ) - sizeof ( * app_hdr ) ) return - EINVAL ;
Buggy code:
 static MagickBooleanType ReadPSDChannel ( Image * image, const ImageInfo * image_info, const PSDInfo * psd_info, LayerInfo * layer_info, const size_t channel, const PSDCompressionType compression, ExceptionInfo * exception ) { Image * channel_image, * mask ; MagickOffsetType offset ; MagickBooleanType status ; channel_image = image ; mask = ( Image * ) NULL ; if ( layer_info -> channel_info [ channel ]. type < - 1 ) { const char * option ; option = GetImageOption ( image_info, "psd:preserve-opacity-mask" ) ; if ( ( layer_info -> channel_info [ channel ]. type!= - 2 ) || ( layer_info -> mask. flags > 2 ) || ( ( layer_info -> mask. flags & 0x02 ) && ( IsStringTrue ( option ) == MagickFalse ) ) ) { SeekBlob ( image, layer_info -> channel_info [ channel ]. size - 2, SEEK_CUR ) ; return ( MagickTrue ) ; } mask = CloneImage ( image, layer_info -> mask. page. width, layer_info -> mask. page. height, MagickFalse, exception ) ; <START_BUG> mask -> matte = MagickFalse ; <END_BUG>  channel_image = mask ; <START_BUG> } offset = TellBlob ( image ) ; status = MagickTrue ; switch ( compression ) { case Raw : status = ReadPSDChannelRaw ( channel_image, psd_info -> channels, layer_info -> channel_info [ channel ]. type, exception ) ; break ; case RLE : { MagickOffsetType * sizes ; sizes = ReadPSDRLESizes ( channel_image, psd_info, channel_image -> rows ) ; if ( sizes == ( MagickOffsetType * ) NULL ) ThrowBinaryException ( ResourceLimitError, "MemoryAllocationFailed", image -> filename ) ; status = ReadPSDChannelRLE ( channel_image, psd_info, layer_info -> channel_info [ channel ]. type, sizes, exception ) ; sizes = ( MagickOffsetType * ) RelinquishMagickMemory ( sizes ) ; } break ; case ZipWithPrediction : case ZipWithoutPrediction : # ifdef MAGICKCORE_ZLIB_DELEGATE status = ReadPSDChannelZip ( channel_image, layer<END_BUG>

Fix:
<S2SV_ModStart> exception ) ; if ( mask!= ( Image * ) NULL ) { <S2SV_ModStart> = mask ; }
Buggy code:
 int genl_register_family ( struct genl_family * family ) { int err, i ; int start = GENL_START_ALLOC, end = GENL_MAX_ID ; err = genl_validate_ops ( family ) ; if ( err ) return err ; genl_lock_all ( ) ; if ( genl_family_find_byname ( family -> name ) ) { err = - EEXIST ; goto errout_locked ; } if ( family == & genl_ctrl ) { start = end = GENL_ID_CTRL ; } else if ( strcmp ( family -> name, "pmcraid" ) == 0 ) { start = end = GENL_ID_PMCRAID ; } else if ( strcmp ( family -> name, "VFS_DQUOT" ) == 0 ) { start = end = GENL_ID_VFS_DQUOT ; } if ( family -> maxattr &&! family -> parallel_ops ) { family -> attrbuf = kmalloc_array ( family -> maxattr + 1, sizeof ( struct nlattr * ), GFP_KERNEL ) ; if ( family -> attrbuf == NULL ) { err = - ENOMEM ; goto errout_locked ; } } else family -> attrbuf = NULL ; family -> id = idr_alloc ( & genl_fam_idr, family, start, end + 1, GFP_KERNEL ) ; if ( family -> id < 0 ) { err = family -> id ; <START_BUG> goto errout_locked ; <END_BUG> } err = genl_validate_assign_mc_groups ( family ) ; if ( err ) goto errout_remove ; genl_unlock_all ( ) ; genl_ctrl_event ( CTRL_CMD_NEWFAMILY, family, NULL, 0 ) ; for ( i = 0 ; i < family -> n_mcgrps ; i ++ ) genl_ctrl_event ( CTRL_CMD_NEWMCAST_GRP, family, & family -> mcgrps [ i ], family -> mcgrp_offset + i ) ; return 0 ; errout_remove : idr_remove ( & genl_fam_idr, family -> id ) ;  kfree ( family -> attrbuf ) ; <START_BUG> errout_locked<END_BUG>

Fix:
<S2SV_ModStart> id ; goto errout_free <S2SV_ModEnd> ; } err <S2SV_ModStart> id ) ; errout_free :
Buggy code:
 static target_ulong disas_insn ( CPUX86State * env, DisasContext * s, target_ulong pc_start ) { int b, prefixes ; int shift ; TCGMemOp ot, aflag, dflag ; int modrm, reg, rm, mod, op, opreg, val ; target_ulong next_eip, tval ; int rex_w, rex_r ; s -> pc_start = s -> pc = pc_start ; prefixes = 0 ; s -> override = - 1 ; rex_w = - 1 ; rex_r = 0 ; # ifdef TARGET_X86_64 s -> rex_x = 0 ; s -> rex_b = 0 ; x86_64_hregs = 0 ; # endif s -> rip_offset = 0 ; s -> vex_l = 0 ; s -> vex_v = 0 ; <START_BUG> next_byte : <END_BUG> b = cpu_ldub_code ( env, s -> pc ) ; s -> pc ++ ; switch ( b ) { case 0xf3 : prefixes |= PREFIX_REPZ ; goto next_byte ; case 0xf2 : prefixes |= PREFIX_REPNZ ; goto next_byte ; case 0xf0 : prefixes |= PREFIX_LOCK ; goto next_byte ; case 0x2e : s -> override = R_CS ; goto next_byte ; case 0x36 : s -> override = R_SS ; goto next_byte ; case 0x3e : s -> override = R_DS ; goto next_byte ; case 0x26 : s -> override = R_ES ; goto next_byte ; case 0x64 : s -> override = R_FS ; goto next_byte ; case 0x65 : s -> override = R_GS ; goto next_byte ; case 0x66 : prefixes |= PREFIX_DATA ; goto next_byte ; case 0x67 : prefixes |= PREFIX_ADR ; goto next_byte ; # ifdef TARGET_X86_64 case 0x40... 0x4f : if ( CODE64 ( s ) ) { rex_w = ( b >> 3 ) & 1 ; rex_r = ( b & 0x4 ) << 1 ; s -> rex_x = ( b & 0x2 ) << 2 ; REX_B ( s ) = ( b & 0x1 ) <<

Fix:
<S2SV_ModStart> ; next_byte : if ( s -> pc - pc_start > 14 ) { goto illegal_op ; }
Buggy code:
 static void sas_revalidate_domain ( struct work_struct * work ) { int res = 0 ; struct sas_discovery_event * ev = to_sas_discovery_event ( work ) ; struct asd_sas_port * port = ev -> port ; struct sas_ha_struct * ha = port -> ha ; struct domain_device * ddev = port -> port_dev ; mutex_lock ( & ha -> disco_mutex ) ; if ( test_bit ( SAS_HA_ATA_EH_ACTIVE, & ha -> state ) ) { SAS_DPRINTK ( "REVALIDATION   DEFERRED   on   port   %d,   pid:%d\\n", port -> id, task_pid_nr ( current ) ) ; goto out ; } clear_bit ( DISCE_REVALIDATE_DOMAIN, & port -> disc. pending ) ; SAS_DPRINTK ( "REVALIDATING   DOMAIN   on   port   %d,   pid:%d\\n", port -> id, task_pid_nr ( current ) ) ; if ( ddev && ( ddev -> dev_type == SAS_FANOUT_EXPANDER_DEVICE || ddev -> dev_type == SAS_EDGE_EXPANDER_DEVICE ) ) res = sas_ex_revalidate_domain ( ddev ) ; SAS_DPRINTK ( "done   REVALIDATING   DOMAIN   on   port   %d,   pid:%d,   res   0x%x\\n", port -> id, task_pid_nr ( current ), res ) ; out : mutex_unlock ( & ha -> disco_mutex ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> disco_mutex ) ; sas_destruct_devices ( port ) ; sas_destruct_ports ( port ) ; sas_probe_devices ( port ) ;
Buggy code:
 int tmx_check_pretran ( sip_msg_t * msg ) { unsigned int chid ; unsigned int slotid ; int dsize ; struct via_param * vbr ; str scallid ; str scseqmet ; str scseqnum ; str sftag ; str svbranch = { NULL, 0 } ; pretran_t * it ; if ( _tmx_ptran_table == NULL ) { LM_ERR ( "pretran   hash   table   not   initialized   yet\\n" ) ; return - 1 ; } if ( get_route_type ( )!= REQUEST_ROUTE ) { LM_ERR ( "invalid   usage   -   not   in   request   route\\n" ) ; return - 1 ; } if ( msg -> first_line. type!= SIP_REQUEST ) { LM_ERR ( "invalid   usage   -   not   a   sip   request\\n" ) ; return - 1 ; } if ( parse_headers ( msg, HDR_FROM_F | HDR_VIA1_F | HDR_CALLID_F | HDR_CSEQ_F, 0 ) < 0 ) { LM_ERR ( "failed   to   parse   required   headers\\n" ) ; return - 1 ; } if ( msg -> cseq == NULL || msg -> cseq -> parsed == NULL ) { LM_ERR ( "failed   to   parse   cseq   headers\\n" ) ; return - 1 ; } if ( get_cseq ( msg ) -> method_id == METHOD_ACK || get_cseq ( msg ) -> method_id == METHOD_CANCEL ) { LM_DBG ( "no   pre-transaction   management   for   ACK   or   CANCEL\\n" ) ; return - 1 ; } if ( msg -> via1 == 0 ) { LM_ERR ( "failed   to   get   Via   header\\n" ) ; return - 1 ; } if ( parse_from_header ( msg ) < 0 || get_from ( msg ) -> tag_value. len == 0 ) { LM_ERR ( "failed   to   get   From   header\\n" ) ; return - 1 ; } if ( msg -> callid == NULL || msg -> callid -> body. s == NULL ) { LM_ERR (

Fix:
<S2SV_ModStart> svbranch. len + 1
Buggy code:
 static void svc_log_reset ( SvcContext * svc_ctx ) { <START_BUG> SvcInternal * const si = ( SvcInternal * ) svc_ctx -> internal ; <END_BUG> si -> message_buffer [ 0 ] = '\\0' ; }

Fix:
<S2SV_ModStart> svc_ctx ) { SvcInternal_t <S2SV_ModEnd> * const si <S2SV_ModStart> si = ( SvcInternal_t <S2SV_ModEnd> * ) svc_ctx
Buggy code:
 static int http_open ( URLContext * h, const char * uri, int flags, AVDictionary * * options ) { HTTPContext * s = h -> priv_data ; int ret ; if ( s -> seekable == 1 ) h -> is_streamed = 0 ; else h -> is_streamed = 1 ; <START_BUG> s -> filesize = - 1 ; <END_BUG> s -> location = av_strdup ( uri ) ; if (! s -> location ) return AVERROR ( ENOMEM ) ; if ( options ) av_dict_copy ( & s -> chained_options, * options, 0 ) ; if ( s -> headers ) { int len = strlen ( s -> headers ) ; if ( len < 2 || strcmp ( "\\r\\n", s -> headers + len - 2 ) ) { av_log ( h, AV_LOG_WARNING, "No   trailing   CRLF   found   in   HTTP   header.\\n" ) ; ret = av_reallocp ( & s -> headers, len + 3 ) ; if ( ret < 0 ) return ret ; s -> headers [ len ] = '\\r' ; s -> headers [ len + 1 ] = '\\n' ; s -> headers [ len + 2 ] = '\\0' ; } } if ( s -> listen ) { return http_listen ( h, uri, flags, options ) ; } ret = http_open_cnx ( h, options ) ; if ( ret < 0 ) av_dict_free ( & s -> chained_options ) ; return ret ; }

Fix:
<S2SV_ModStart> -> filesize = UINT64_MAX <S2SV_ModEnd> ; s ->
Buggy code:
 int ssl3_get_key_exchange ( SSL * s ) { # ifndef OPENSSL_NO_RSA unsigned char * q, md_buf [ EVP_MAX_MD_SIZE * 2 ] ; # endif EVP_MD_CTX md_ctx ; unsigned char * param, * p ; int al, j, ok ; long i, param_len, n, alg_k, alg_a ; EVP_PKEY * pkey = NULL ; const EVP_MD * md = NULL ; # ifndef OPENSSL_NO_RSA RSA * rsa = NULL ; # endif # ifndef OPENSSL_NO_DH DH * dh = NULL ; # endif # ifndef OPENSSL_NO_ECDH EC_KEY * ecdh = NULL ; BN_CTX * bn_ctx = NULL ; EC_POINT * srvr_ecpoint = NULL ; int curve_nid = 0 ; int encoded_pt_len = 0 ; # endif EVP_MD_CTX_init ( & md_ctx ) ; n = s -> method -> ssl_get_message ( s, SSL3_ST_CR_KEY_EXCH_A, SSL3_ST_CR_KEY_EXCH_B, - 1, s -> max_cert_list, & ok ) ; if (! ok ) return ( ( int ) n ) ; alg_k = s -> s3 -> tmp. new_cipher -> algorithm_mkey ; if ( s -> s3 -> tmp. message_type!= SSL3_MT_SERVER_KEY_EXCHANGE ) { if ( alg_k & ( SSL_kDHE | SSL_kECDHE ) ) { SSLerr ( SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE ) ; al = SSL_AD_UNEXPECTED_MESSAGE ; goto f_err ; } # ifndef OPENSSL_NO_PSK if ( alg_k & SSL_kPSK ) { s -> session -> sess_cert = ssl_sess_cert_new ( ) ; if ( s -> ctx -> psk_identity_hint ) OPENSSL_free ( s -> ctx -> psk_identity_hint ) ; s -> ctx -> psk_identity_hint = NULL ; } # endif s -> s3 -> tmp. reuse_

Fix:
<S2SV_ModStart> { if (! SSL_C_IS_EXPORT ( s -> s3 -> tmp. new_cipher ) ) { al = SSL_AD_UNEXPECTED_MESSAGE ; SSLerr ( SSL_F_SSL3_GET_SERVER_CERTIFICATE, SSL_R_UNEXPECTED_MESSAGE ) ; goto f_err ; } if (
Buggy code:
 static void InsertRow ( unsigned char * p, ssize_t y, Image * image, int bpp ) { ExceptionInfo * exception ; int bit ; ssize_t x ; register PixelPacket * q ; IndexPacket index ; register IndexPacket * indexes ; exception = ( & image -> exception ) ; switch ( bpp ) { case 1 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) break ; indexes = GetAuthenticIndexQueue ( image ) ; for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 7 ) ; x += 8 ) { for ( bit = 0 ; bit < 8 ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( indexes + x + bit, index ) ; SetPixelRGBO ( q, image -> colormap + ( ssize_t ) index ) ; q ++ ; } p ++ ; } if ( ( image -> columns % 8 )!= 0 ) { for ( bit = 0 ; bit < ( ssize_t ) ( image -> columns % 8 ) ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( indexes + x + bit, index ) ; SetPixelRGBO ( q, image -> colormap + ( ssize_t ) index ) ; q ++ ; } p ++ ; } if (! SyncAuthenticPixels ( image, exception ) ) break ; break ; } case 2 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) break ; indexes = GetAuthenticIndexQueue ( image ) ; <START_BUG> for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 1 ) ; x += 4 ) <END_BUG> { index = ConstrainColormapIndex ( image, ( * p >> 6 ) & 0x3 ) ; SetPixelIndex ( indexes + x, index ) ; SetPixelRGBO ( q, image -> colormap + ( ssize_t ) index ) ; q ++ ; index = ConstrainColormapIndex ( image, ( * p >> 4 ) & 0x3

Fix:
<S2SV_ModStart> -> columns - 3 <S2SV_ModEnd> ) ; x <S2SV_ModStart> index ) ; q ++ ; p <S2SV_ModEnd> ++ ; } <S2SV_ModStart> % 4 ) > <S2SV_ModEnd> 1 ) { <S2SV_ModStart> % 4 ) > <S2SV_ModEnd> 2 ) {
Buggy code:
 static ssize_t rpmsg_eptdev_write_iter ( struct kiocb * iocb, struct iov_iter * from ) { struct file * filp = iocb -> ki_filp ; struct rpmsg_eptdev * eptdev = filp -> private_data ; size_t len = iov_iter_count ( from ) ; void * kbuf ; int ret ; kbuf = kzalloc ( len, GFP_KERNEL ) ; if (! kbuf ) return - ENOMEM ; if (! copy_from_iter_full ( kbuf, len, from ) ) <START_BUG> return - EFAULT ; <END_BUG> if ( mutex_lock_interruptible ( & eptdev -> ept_lock ) ) { ret = - ERESTARTSYS ; goto free_kbuf ; } if (! eptdev -> ept ) { ret = - EPIPE ; goto unlock_eptdev ; } if ( filp -> f_flags & O_NONBLOCK ) ret = rpmsg_trysend ( eptdev -> ept, kbuf, len ) ; else ret = rpmsg_send ( eptdev -> ept, kbuf, len ) ; unlock_eptdev : mutex_unlock ( & eptdev -> ept_lock ) ; free_kbuf : kfree ( kbuf ) ; return ret < 0? ret : len ; }

Fix:
<S2SV_ModStart> from ) ) { ret = <S2SV_ModEnd> - EFAULT ; <S2SV_ModStart> - EFAULT ; goto free_kbuf ; }
Buggy code:
 private int cdf_file_summary_info ( struct magic_set * ms, const cdf_header_t * h, <START_BUG> const cdf_stream_t * sst, const uint64_t clsid [ 2 ] ) <END_BUG> { cdf_summary_info_header_t si ; cdf_property_info_t * info ; size_t count ; int m ; if ( cdf_unpack_summary_info ( sst, h, & si, & info, & count ) == - 1 ) return - 1 ; if ( NOTMIME ( ms ) ) { const char * str ; if ( file_printf ( ms, "Composite   Document   File   V2   Document" ) == - 1 ) return - 1 ; if ( file_printf ( ms, ",   %s   Endian", si. si_byte_order == 0xfffe? "Little" : "Big" ) == - 1 ) return - 2 ; switch ( si. si_os ) { case 2 : if ( file_printf ( ms, ",   Os:   Windows,   Version   %d.%d", si. si_os_version & 0xff, ( uint32_t ) si. si_os_version >> 8 ) == - 1 ) return - 2 ; break ; case 1 : if ( file_printf ( ms, ",   Os:   MacOS,   Version   %d.%d", ( uint32_t ) si. si_os_version >> 8, si. si_os_version & 0xff ) == - 1 ) return - 2 ; break ; default : if ( file_printf ( ms, ",   Os   %d,   Version:   %d.%d", si. si_os, si. si_os_version & 0xff, ( uint32_t ) si. si_os_version >> 8 ) == - 1 ) return - 2 ; break ; }  str = cdf_clsid_to_mime ( clsid, clsid2desc ) ; <START_BUG> if ( str ) if ( file_printf ( ms, ",   %s", str ) == - 1 ) <END_BUG> return - 2 ;  } <START_BUG> m = cdf_file_property_info ( ms, info, count, clsid ) ; <END_BUG> free ( info ) ; return m == - 1? - 2 : m ; }

Fix:
<S2SV_ModStart> sst, const cdf_directory_t * root_storage <S2SV_ModEnd> ) { cdf_summary_info_header_t <S2SV_ModStart> break ; } if ( root_storage ) { <S2SV_ModStart> = cdf_clsid_to_mime ( root_storage -> d_storage_uuid <S2SV_ModEnd>, clsid2desc ) <S2SV_ModStart> - 2 ; } <S2SV_ModStart>, count, root_storage <S2SV_ModEnd> ) ; free
Buggy code:
 static int em_jcxz ( struct x86_emulate_ctxt * ctxt ) <START_BUG> { <END_BUG> if ( address_mask ( ctxt, reg_read ( ctxt, VCPU_REGS_RCX ) ) == 0 )  jmp_rel ( ctxt, ctxt -> src. val ) ; <START_BUG> <END_BUG> return X86EMUL_CONTINUE ;  }

Fix:
<S2SV_ModStart> ctxt ) { int rc = X86EMUL_CONTINUE ; <S2SV_ModStart> == 0 ) rc = <S2SV_ModStart> ) ; return rc <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 struct vm_area_struct * find_extend_vma ( struct mm_struct * mm, unsigned long addr ) { struct vm_area_struct * vma ; unsigned long start ; addr &= PAGE_MASK ; vma = find_vma ( mm, addr ) ; if (! vma ) return NULL ; if ( vma -> vm_start <= addr ) return vma ; if (! ( vma -> vm_flags & VM_GROWSDOWN ) ) return NULL ; <START_BUG> start = vma -> vm_start ; <END_BUG> if ( expand_stack ( vma, addr ) ) return NULL ; if ( vma -> vm_flags & VM_LOCKED ) populate_vma_page_range ( vma, addr, start, NULL ) ; return vma ; }

Fix:
<S2SV_ModStart> return NULL ; if (! mmget_still_valid ( mm ) ) return NULL ;
Buggy code:
 static int net_ctl_permissions ( struct ctl_table_header * head, struct ctl_table * table ) { struct net * net = container_of ( head -> set, struct net, sysctls ) ; kuid_t root_uid = make_kuid ( net -> user_ns, 0 ) ; kgid_t root_gid = make_kgid ( net -> user_ns, 0 ) ; if ( ns_capable ( net -> user_ns, CAP_NET_ADMIN ) || <START_BUG> uid_eq ( root_uid, current_uid ( ) ) ) { <END_BUG> int mode = ( table -> mode >> 6 ) & 7 ; return ( mode << 6 ) | ( mode << 3 ) | mode ; }  if ( gid_eq ( root_gid, current_gid ( ) ) ) { <START_BUG> int mode = ( table -> mode >> 3 ) & 7 ; return ( mode << 3 ) | mode ; } return table -> mode ; }<END_BUG>

Fix:
<S2SV_ModStart> ( root_uid, current_euid <S2SV_ModEnd> ( ) ) <S2SV_ModStart> } if ( in_egroup_p ( root_gid <S2SV_ModEnd> ) ) {
Buggy code:
 static vpx_codec_err_t set_encoder_config ( <START_BUG> VP9_CONFIG * oxcf, <END_BUG> const vpx_codec_enc_cfg_t * cfg, const struct vp9_extracfg * extra_cfg ) {  oxcf -> profile = cfg -> g_profile ; <START_BUG> <END_BUG> oxcf -> width = cfg -> g_w ;  oxcf -> height = cfg -> g_h ; <START_BUG> oxcf -> bit_depth = extra_cfg -> bit_depth ; <END_BUG> oxcf -> framerate = ( double ) cfg -> g_timebase. den // cfg -> g_timebase. num ;  if ( oxcf -> framerate > 180 ) <START_BUG> <END_BUG> oxcf -> framerate = 30 ;  switch ( cfg -> g_pass ) { case VPX_RC_ONE_PASS : <START_BUG> oxcf -> mode = MODE_GOODQUALITY ; <END_BUG> break ; case VPX_RC_FIRST_PASS :  oxcf -> mode = MODE_FIRSTPASS ; <START_BUG> break ; case VPX_RC_LAST_PASS : <END_BUG> oxcf -> mode = MODE_SECONDPASS_BEST ;  break ; } oxcf -> lag_in_frames = cfg -> g_pass == VPX_RC_FIRST_PASS? 0 : cfg -> g_lag_in_frames ; <START_BUG> oxcf -> end_usage = USAGE_LOCAL_FILE_PLAYBACK ; <END_BUG>  if ( cfg -> rc_end_usage == VPX_CQ ) <START_BUG> oxcf -> end_usage = USAGE_CONSTRAINED_QUALITY ; else if ( cfg -> rc_end_usage == VPX_Q ) oxcf -> end_usage = USAGE_CONSTANT_QUALITY ; else if ( cfg -> rc_end_usage == VPX_CBR ) oxcf -> end_usage = USAGE_STREAM_FROM_SERVER ; <END_BUG> oxcf -> target_bandwidth = cfg -> rc_target_bitrate ;  oxcf -> rc_max_intra_bitrate_pct = extra_cfg -> rc_max_intra_bitrate_pct ; <START_BUG> oxcf -> best_allowed_q = q_trans [ cfg -> rc_min_quantizer ] ; <END_BUG>  oxcf -> worst_allowed_q = q_trans [ cfg -> rc_max_quant

Fix:
<S2SV_ModStart> vpx_codec_err_t set_encoder_config ( VP9EncoderConfig <S2SV_ModEnd> * oxcf, <S2SV_ModStart> extra_cfg ) { const int is_vbr = cfg -> rc_end_usage == VPX_VBR ; int sl, tl ; <S2SV_ModStart> ; oxcf -> max_threads = ( int ) cfg -> g_threads ; oxcf -> <S2SV_ModStart> -> bit_depth = cfg -> g_bit_depth ; oxcf -> input_bit_depth = cfg -> g_input_bit_depth ; oxcf -> init_framerate <S2SV_ModEnd> = ( double <S2SV_ModStart> ( oxcf -> init_framerate <S2SV_ModEnd> > 180 ) <S2SV_ModStart> ) oxcf -> init_framerate = 30 ; oxcf -> mode = GOOD <S2SV_ModEnd> ; switch ( <S2SV_ModStart> : oxcf -> pass = 0 <S2SV_ModEnd> ; break ; <S2SV_ModStart> : oxcf -> pass = 1 <S2SV_ModEnd> ; break ; <S2SV_ModStart> : oxcf -> pass = 2 <S2SV_ModEnd> ; break ; <S2SV_ModStart> ; oxcf -> rc_mode = <S2SV_ModEnd> cfg -> rc_end_usage <S2SV_ModStart> cfg -> rc_end_usage <S2SV_ModEnd> ; oxcf -> <S2SV_ModStart> -> target_bandwidth = 1000 * <S2SV_ModStart> ; oxcf
Buggy code:
 <START_BUG> int get_down2_steps ( int in_length, int out_length ) { <END_BUG> int steps = 0 ; int proj_in_length ; while ( ( proj_in_length = get_down2_length ( in_length, 1 ) ) >= out_length ) { ++ steps ; in_length = proj_in_length ; } return steps ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 int read_yuv_frame ( struct VpxInputContext * input_ctx, vpx_image_t * yuv_frame ) { FILE * f = input_ctx -> file ; struct FileTypeDetectionBuffer * detect = & input_ctx -> detect ; int plane = 0 ; int shortread = 0 ; <START_BUG> for ( plane = 0 ; plane < 3 ; ++ plane ) { <END_BUG> uint8_t * ptr ;  const int w = ( plane? ( 1 + yuv_frame -> d_w ) // 2 : yuv_frame -> d_w ) ; <START_BUG> <END_BUG> const int h = ( plane? ( 1 + yuv_frame -> d_h ) // 2 : yuv_frame -> d_h ) ;  int r ; switch ( plane ) { case 1 : ptr = yuv_frame -> planes [ yuv_frame -> fmt == VPX_IMG_FMT_YV12? VPX_PLANE_V : VPX_PLANE_U ] ; break ; case 2 : ptr = yuv_frame -> planes [ yuv_frame -> fmt == VPX_IMG_FMT_YV12? VPX_PLANE_U : VPX_PLANE_V ] ; break ; default : ptr = yuv_frame -> planes [ plane ] ; } for ( r = 0 ; r < h ; ++ r ) { <START_BUG> size_t needed = w ; <END_BUG> size_t buf_position = 0 ; const size_t left = detect -> buf_read - detect -> position ; if ( left > 0 ) { const size_t more = ( left < needed )? left : needed ; memcpy ( ptr, detect -> buf + detect -> position, more ) ; buf_position = more ; needed -= more ; detect -> position += more ; } if ( needed > 0 ) { shortread |= ( fread ( ptr + buf_position, 1, needed, f ) < needed ) ; } ptr += yuv_frame -> stride [ plane ] ; } } return shortread ; }

Fix:
<S2SV_ModStart> = 0 ; const int bytespp = ( yuv_frame -> fmt & VPX_IMG_FMT_HIGHBITDEPTH )? 2 : 1 ; <S2SV_ModStart> int w = vpx_img_plane_width ( yuv_frame, plane <S2SV_ModEnd> ) ; const <S2SV_ModStart> int h = vpx_img_plane_height ( yuv_frame, plane <S2SV_ModEnd> ) ; int <S2SV_ModStart> needed = w * bytespp
Buggy code:
 static vpx_codec_err_t encoder_destroy ( vpx_codec_alg_priv_t * ctx ) { free ( ctx -> cx_data ) ; vp9_remove_compressor ( ctx -> cpi ) ; <START_BUG> free ( ctx ) ; <END_BUG> return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> cpi ) ; # if CONFIG_MULTITHREAD pthread_mutex_destroy ( & ctx -> buffer_pool -> pool_mutex ) ; # endif vpx_free ( ctx -> buffer_pool ) ; vpx_free <S2SV_ModEnd> ( ctx )
Buggy code:
 void tcp_sack_option ( struct tcpcb * tp, struct tcphdr * th, u_char * cp, int optlen ) { int tmp_olen ; u_char * tmp_cp ; struct sackhole * cur, * p, * temp ; if (! tp -> sack_enable ) return ; if ( ( th -> th_flags & TH_ACK ) == 0 ) return ; if ( SEQ_LT ( th -> th_ack, tp -> snd_una ) || SEQ_GT ( th -> th_ack, tp -> snd_max ) ) return ; if ( optlen <= 2 || ( optlen - 2 ) % TCPOLEN_SACK!= 0 ) return ; tmp_cp = cp + 2 ; tmp_olen = optlen - 2 ; tcpstat_inc ( tcps_sack_rcv_opts ) ; if ( tp -> snd_numholes < 0 ) tp -> snd_numholes = 0 ; if ( tp -> t_maxseg == 0 ) panic ( "tcp_sack_option" ) ; while ( tmp_olen > 0 ) { struct sackblk sack ; memcpy ( & sack. start, tmp_cp, sizeof ( tcp_seq ) ) ; sack. start = ntohl ( sack. start ) ; memcpy ( & sack. end, tmp_cp + sizeof ( tcp_seq ), sizeof ( tcp_seq ) ) ; sack. end = ntohl ( sack. end ) ; tmp_olen -= TCPOLEN_SACK ; tmp_cp += TCPOLEN_SACK ; if ( SEQ_LEQ ( sack. end, sack. start ) ) continue ; if ( SEQ_LEQ ( sack. end, tp -> snd_una ) ) continue ; if ( SEQ_GT ( th -> th_ack, tp -> snd_una ) ) { if ( SEQ_LT ( sack. start, th -> th_ack ) ) continue ; } if ( SEQ_GT ( sack. end, tp -> snd_max ) ) continue ; if ( tp -> snd_holes == NULL ) { tp -> snd_holes = ( struct sackhole * ) pool_get ( & sackhl_pool, PR_NOWAIT )

Fix:
<S2SV_ModStart> ) ) { if ( tp -> snd_numholes >= TCP_SACKHOLE_LIMIT ) goto done ; <S2SV_ModStart> ) ) { if ( tp -> snd_numholes >= TCP_SACKHOLE_LIMIT ) goto done ;
Buggy code:
 static int walk_pmd_range ( pud_t * pud, unsigned long addr, unsigned long end, struct mm_walk * walk ) { pmd_t * pmd ; unsigned long next ; int err = 0 ; pmd = pmd_offset ( pud, addr ) ; do { again : next = pmd_addr_end ( addr, end ) ; if ( pmd_none ( * pmd ) ) { if ( walk -> pte_hole ) err = walk -> pte_hole ( addr, next, walk ) ; if ( err ) break ; continue ; } if ( walk -> pmd_entry ) err = walk -> pmd_entry ( pmd, addr, next, walk ) ; if ( err ) break ; if (! walk -> pte_entry ) continue ; split_huge_page_pmd ( walk -> mm, pmd ) ; <START_BUG> if ( pmd_none_or_clear_bad ( pmd ) ) <END_BUG> goto again ; err = walk_pte_range ( pmd, addr, next, walk ) ; if ( err ) break ; } while ( pmd ++, addr = next, addr!= end ) ; return err ; }

Fix:
<S2SV_ModStart> ; if ( pmd_none_or_trans_huge_or_clear_bad <S2SV_ModEnd> ( pmd )
Buggy code:
 int cdf_unpack_summary_info ( const cdf_stream_t * sst, const cdf_header_t * h, cdf_summary_info_header_t * ssi, cdf_property_info_t * * info, size_t * count ) { <START_BUG> size_t i, maxcount ; <END_BUG> const cdf_summary_info_header_t * si = CAST ( const cdf_summary_info_header_t *, sst -> sst_tab ) ; const cdf_section_declaration_t * sd = CAST ( const cdf_section_declaration_t *, ( const void * ) ( ( const char * ) sst -> sst_tab + CDF_SECTION_DECLARATION_OFFSET ) ) ; if ( cdf_check_stream_offset ( sst, h, si, sizeof ( * si ), __LINE__ ) == - 1 || cdf_check_stream_offset ( sst, h, sd, sizeof ( * sd ), __LINE__ ) == - 1 ) return - 1 ; ssi -> si_byte_order = CDF_TOLE2 ( si -> si_byte_order ) ; ssi -> si_os_version = CDF_TOLE2 ( si -> si_os_version ) ; ssi -> si_os = CDF_TOLE2 ( si -> si_os ) ; ssi -> si_class = si -> si_class ; cdf_swap_class ( & ssi -> si_class ) ;  ssi -> si_count = CDF_TOLE2 ( si -> si_count ) ; <START_BUG> * count = 0 ; maxcount = 0 ; * info = NULL ; <END_BUG> for ( i = 0 ; i < CDF_TOLE4 ( si -> si_count ) ; i ++ ) {  if ( i >= CDF_LOOP_LIMIT ) { DPRINTF ( ( "Unpack   summary   info   loop   limit" ) ) ; errno = EFTYPE ; return - 1 ; } if ( cdf_read_property_info ( sst, h, CDF_TOLE4 ( sd -> sd_offset ), <START_BUG> info, count, & maxcount ) == - 1 ) { <END_BUG> return - 1 ;  } <START_BUG> } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { size_t <S2SV_ModEnd> maxcount ; const <S2SV_ModStart> -> si_count = CDF_TOLE4 <S2SV_ModEnd> ( si -> <S2SV_ModStart> = NULL ; if ( cdf_read_property_info ( sst, h, CDF_TOLE4 ( <S2SV_ModEnd> sd -> sd_offset <S2SV_ModStart> - 1 ) <S2SV_ModEnd> return - 1 <S2SV_ModStart> - 1 ; <S2SV_ModEnd> return 0 ;
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; <START_BUG> ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; <END_BUG> ps_dec -> pv_dec_out = ps_dec_op ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_BS_BUF_NULL ; return IV_FAIL ; } if ( ps_dec_ip -> u4_num_Bytes <= 0 ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |=

Fix:
<S2SV_ModStart> ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; }
Buggy code:
 static void nonrd_use_partition ( VP9_COMP * cpi, <START_BUG> const TileInfo * const tile, <END_BUG>  MODE_INFO * * mi_8x8, <START_BUG> TOKENEXTRA * * tp, int mi_row, int mi_col, BLOCK_SIZE bsize, int output_enabled, <END_BUG> int * totrate, int64_t * totdist ) {  VP9_COMMON * const cm = & cpi -> common ; <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> MACROBLOCKD * const xd = & x -> e_mbd ;  const int bsl = b_width_log2 ( bsize ), hbs = ( 1 << bsl ) // 4 ; <START_BUG> const int mis = cm -> mi_stride ; PARTITION_TYPE partition ; BLOCK_SIZE subsize ; <END_BUG> int rate = INT_MAX ;  int64_t dist = INT64_MAX ; if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; <START_BUG> subsize = ( bsize >= BLOCK_8X8 )? mi_8x8 [ 0 ] -> mbmi. sb_type : BLOCK_4X4 ; <END_BUG> partition = partition_lookup [ bsl ] [ subsize ] ;  switch ( partition ) { <START_BUG> case PARTITION_NONE : <END_BUG> nonrd_pick_sb_modes ( cpi, tile, mi_row, mi_col, totrate, totdist, subsize ) ;  <START_BUG> get_block_context ( x, subsize ) -> mic. mbmi = xd -> mi [ 0 ] -> mbmi ; <END_BUG> break ; case PARTITION_VERT :  * get_sb_index ( x, subsize ) = 0 ; <START_BUG> <END_BUG> nonrd_pick_sb_modes ( cpi, tile, mi_row, mi_col, totrate, totdist, subsize ) ;  <START_BUG> get_block_context ( x, subsize ) -> mic. mbmi = xd -> mi [ 0 ] -> mbmi ; <END_BUG>  if ( mi_col + hbs < cm -> mi_cols ) { <START_BUG> * get_sb_index ( x, subsize ) = 1 ; <END_BUG> nonrd_pick_sb_modes ( cpi, tile, mi_row, mi_col + hbs, 

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, TileDataEnc * tile_data <S2SV_ModEnd>, MODE_INFO * <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd>, TOKENEXTRA * <S2SV_ModStart> int output_enabled, RD_COST * dummy_cost, PC_TREE * pc_tree <S2SV_ModEnd> ) { VP9_COMMON <S2SV_ModStart> -> common ; TileInfo * tile_info = & tile_data -> tile_info ; <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> int bsl = b_width_log2_lookup [ bsize ] <S2SV_ModEnd>, hbs = <S2SV_ModStart> BLOCK_SIZE subsize ; <S2SV_ModEnd> if ( mi_row <S2SV_ModStart> BLOCK_8X8 )? mi <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> subsize ] ; if ( output_enabled && bsize!= BLOCK_4X4 ) { int ctx = partition_plane_context ( xd, mi_row, mi_col, bsize ) ; td -> counts -> partition [ ctx ] [ partition ] ++ ; } <S2SV_ModStart> case PARTITION_NONE : pc_tree -> none. pred_pixel_ready = 1 ; <S2SV_ModStart> ( cpi, tile_data, x, mi_row, mi_col, dummy_cost, subsize, & pc_tree -> none
Buggy code:
 static void mntput_no_expire ( struct mount * mnt ) { rcu_read_lock ( ) ; mnt_add_count ( mnt, - 1 ) ; if ( likely ( mnt -> mnt_ns ) ) { rcu_read_unlock ( ) ; return ; } lock_mount_hash ( ) ; if ( mnt_get_count ( mnt ) ) { rcu_read_unlock ( ) ; unlock_mount_hash ( ) ; return ; } if ( unlikely ( mnt -> mnt. mnt_flags & MNT_DOOMED ) ) { rcu_read_unlock ( ) ; unlock_mount_hash ( ) ; return ; } mnt -> mnt. mnt_flags |= MNT_DOOMED ; rcu_read_unlock ( ) ; list_del ( & mnt -> mnt_instance ) ; <START_BUG> unlock_mount_hash ( ) ; <END_BUG> if ( likely (! ( mnt -> mnt. mnt_flags & MNT_INTERNAL ) ) ) { struct task_struct * task = current ; if ( likely (! ( task -> flags & PF_KTHREAD ) ) ) { init_task_work ( & mnt -> mnt_rcu, __cleanup_mnt ) ; if (! task_work_add ( task, & mnt -> mnt_rcu, true ) ) return ; } if ( llist_add ( & mnt -> mnt_llist, & delayed_mntput_list ) ) schedule_delayed_work ( & delayed_mntput_work, 1 ) ; return ; } cleanup_mnt ( mnt ) ; }

Fix:
<S2SV_ModStart> mnt_instance ) ; if ( unlikely (! list_empty ( & mnt -> mnt_mounts ) ) ) { struct mount * p, * tmp ; list_for_each_entry_safe ( p, tmp, & mnt -> mnt_mounts, mnt_child ) { umount_mnt ( p ) ; } }
Buggy code:
 static ssize_t generic_perform_write ( struct file * file, struct iov_iter * i, loff_t pos ) { struct address_space * mapping = file -> f_mapping ; const struct address_space_operations * a_ops = mapping -> a_ops ; long status = 0 ; ssize_t written = 0 ; unsigned int flags = 0 ; if ( segment_eq ( get_fs ( ), KERNEL_DS ) ) flags |= AOP_FLAG_UNINTERRUPTIBLE ; do { struct page * page ; pgoff_t index ; unsigned long offset ; unsigned long bytes ; size_t copied ; void * fsdata ; offset = ( pos & ( PAGE_CACHE_SIZE - 1 ) ) ; index = pos >> PAGE_CACHE_SHIFT ; bytes = min_t ( unsigned long, PAGE_CACHE_SIZE - offset, iov_iter_count ( i ) ) ; again : if ( unlikely ( iov_iter_fault_in_readable ( i, bytes ) ) ) { status = - EFAULT ; break ; } status = a_ops -> write_begin ( file, mapping, pos, bytes, flags, & page, & fsdata ) ; if ( unlikely ( status ) ) break ; pagefault_disable ( ) ; copied = iov_iter_copy_from_user_atomic ( page, i, offset, bytes ) ; pagefault_enable ( ) ; flush_dcache_page ( page ) ; status = a_ops -> write_end ( file, mapping, pos, bytes, copied, page, fsdata ) ; if ( unlikely ( status < 0 ) ) break ; copied = status ; cond_resched ( ) ; <START_BUG> if ( unlikely ( copied == 0 ) ) { <END_BUG> bytes = min_t ( unsigned long, PAGE_CACHE_SIZE - offset, iov_iter_single_seg_count ( i ) ) ; goto again ; }  iov_iter_advance ( i, copied ) ; <START_BUG> pos += copied ; written += copied ; balance_dirty_pages_ratelimited ( mapping ) ; } while ( iov_iter_count ( i ) ) ; return written? written : status ; }<END_BUG>

Fix:
<S2SV_ModStart> ( ) ; iov_iter_advance ( i, copied ) ; <S2SV_ModStart> again ; } <S2SV_ModEnd> pos += copied
Buggy code:
 static void lockd_down_net ( struct svc_serv * serv, struct net * net ) { struct lockd_net * ln = net_generic ( net, lockd_net_id ) ; if ( ln -> nlmsvc_users ) { if ( -- ln -> nlmsvc_users == 0 ) { nlm_shutdown_hosts_net ( net ) ; <START_BUG> cancel_delayed_work_sync ( & ln -> grace_period_end ) ; <END_BUG> locks_end_grace ( & ln -> lockd_manager ) ; svc_shutdown_net ( serv, net ) ; dprintk ( "lockd_down_net:   per-net   data   destroyed;   net=%p\\n", net ) ; } } else { printk ( KERN_ERR "lockd_down_net:   no   users!   task=%p,   net=%p\\n", nlmsvc_task, net ) ; BUG ( ) ; } }

Fix:
<S2SV_ModStart> net ) ; <S2SV_ModEnd> svc_shutdown_net ( serv
Buggy code:
 void AcpiNsTerminate ( void ) { ACPI_STATUS Status ; <START_BUG> ACPI_FUNCTION_TRACE ( NsTerminate ) ; <END_BUG> # ifdef ACPI_EXEC_APP { ACPI_OPERAND_OBJECT * Prev ;  ACPI_OPERAND_OBJECT * Next ; <START_BUG> Next = AcpiGbl_ModuleCodeList ; while ( Next ) { Prev = Next ; Next = Next -> Method. Mutex ; Prev -> Method. Mutex = NULL ; AcpiUtRemoveReference ( Prev ) ; } <END_BUG> }  # endif AcpiNsDeleteNamespaceSubtree ( AcpiGbl_RootNode ) ; Status = AcpiUtAcquireMutex ( ACPI_MTX_NAMESPACE ) ; if ( ACPI_FAILURE ( Status ) ) { return_VOID ; } AcpiNsDeleteNode ( AcpiGbl_RootNode ) ; ( void ) AcpiUtReleaseMutex ( ACPI_MTX_NAMESPACE ) ; ACPI_DEBUG_PRINT ( ( ACPI_DB_INFO, "Namespace   freed\\n" ) ) ; return_VOID ; }

Fix:
<S2SV_ModStart> ACPI_STATUS Status ; <S2SV_ModEnd> ACPI_OPERAND_OBJECT * Prev <S2SV_ModStart> ACPI_OPERAND_OBJECT * Next ; ACPI_FUNCTION_TRACE ( NsTerminate ) <S2SV_ModStart> ) ; } <S2SV_ModEnd> AcpiNsDeleteNamespaceSubtree ( AcpiGbl_RootNode
Buggy code:
 static int do_check ( struct bpf_verifier_env * env ) { struct bpf_verifier_state * state = & env -> cur_state ; struct bpf_insn * insns = env -> prog -> insnsi ; struct bpf_reg_state * regs = state -> regs ; int insn_cnt = env -> prog -> len ; int insn_idx, prev_insn_idx = 0 ; int insn_processed = 0 ; bool do_print_state = false ; init_reg_state ( regs ) ; insn_idx = 0 ; env -> varlen_map_value_access = false ; for ( ; ; ) { struct bpf_insn * insn ; u8 class ; int err ; if ( insn_idx >= insn_cnt ) { verbose ( "invalid   insn   idx   %d   insn_cnt   %d\\n", insn_idx, insn_cnt ) ; return - EFAULT ; } insn = & insns [ insn_idx ] ; class = BPF_CLASS ( insn -> code ) ; if ( ++ insn_processed > BPF_COMPLEXITY_LIMIT_INSNS ) { verbose ( "BPF   program   is   too   large.   Processed   %d   insn\\n", insn_processed ) ; return - E2BIG ; } err = is_state_visited ( env, insn_idx ) ; if ( err < 0 ) return err ; if ( err == 1 ) { if ( log_level ) { if ( do_print_state ) verbose ( "\\nfrom   %d   to   %d:   safe\\n", prev_insn_idx, insn_idx ) ; else verbose ( "%d:   safe\\n", insn_idx ) ; } goto process_bpf_exit ; } if ( log_level && do_print_state ) { verbose ( "\\nfrom   %d   to   %d:", prev_insn_idx, insn_idx ) ; print_verifier_state ( & env -> cur_state ) ; do_print_state = false ; } if ( log_level ) { verbose ( "%d:   ", insn_idx ) ; <START_BUG> print_bpf_insn ( insn ) ; <END_BUG> } err = ext_analyzer_insn_hook ( env, insn_

Fix:
<S2SV_ModStart> ; print_bpf_insn ( env,
Buggy code:
 static Image * ReadDDSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status, cubemap = MagickFalse, volume = MagickFalse ; CompressionType compression ; DDSInfo dds_info ; DDSDecoder * decoder ; PixelTrait alpha_trait ; size_t n, num_images ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } <START_BUG> if ( ReadDDSInfo ( image, & dds_info )!= MagickTrue ) { <END_BUG> ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ;  } <START_BUG> if ( dds_info. ddscaps2 & DDSCAPS2_CUBEMAP ) cubemap = MagickTrue ; if ( dds_info. ddscaps2 & DDSCAPS2_VOLUME && dds_info. depth > 0 ) volume = MagickTrue ; ( void ) SeekBlob ( image, 128, SEEK_SET ) ; if ( dds_info. pixelformat. flags & DDPF_RGB ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { alpha_trait = BlendPixelTrait ; decoder = ReadUncompressedRGBA ; } else { alpha_trait = UndefinedPixelTrait ; decoder = ReadUncompressedRGB ; } } else if ( dds_info. pixelformat. flags & DDPF_LUMINANCE ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { ThrowReaderException ( CorruptImageError, "ImageTypeNotSupported" ) ;<END_BUG>

Fix:
<S2SV_ModStart>!= MagickTrue ) <S2SV_ModEnd> ThrowReaderException ( CorruptImageError <S2SV_ModStart> "ImproperImageHeader" ) ; <S2SV_ModEnd> if ( dds_info <S2SV_ModStart>. depth ; if ( num_images < 1 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ;
Buggy code:
 static int llc_ui_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sockaddr_llc * uaddr = ( struct sockaddr_llc * ) msg -> msg_name ; const int nonblock = flags & MSG_DONTWAIT ; struct sk_buff * skb = NULL ; struct sock * sk = sock -> sk ; struct llc_sock * llc = llc_sk ( sk ) ; unsigned long cpu_flags ; size_t copied = 0 ; u32 peek_seq = 0 ; u32 * seq ; unsigned long used ; int target ; <START_BUG> long timeo ; <END_BUG> lock_sock ( sk ) ; copied = - ENOTCONN ; if ( unlikely ( sk -> sk_type == SOCK_STREAM && sk -> sk_state == TCP_LISTEN ) ) goto out ; timeo = sock_rcvtimeo ( sk, nonblock ) ; seq = & llc -> copied_seq ; if ( flags & MSG_PEEK ) { peek_seq = llc -> copied_seq ; seq = & peek_seq ; } target = sock_rcvlowat ( sk, flags & MSG_WAITALL, len ) ; copied = 0 ; do { u32 offset ; if ( signal_pending ( current ) ) { if ( copied ) break ; copied = timeo? sock_intr_errno ( timeo ) : - EAGAIN ; break ; } skb = skb_peek ( & sk -> sk_receive_queue ) ; if ( skb ) { offset = * seq ; goto found_ok_skb ; } if ( copied >= target &&! sk -> sk_backlog. tail ) break ; if ( copied ) { if ( sk -> sk_err || sk -> sk_state == TCP_CLOSE || ( sk -> sk_shutdown & RCV_SHUTDOWN ) ||! timeo || ( flags & MSG_PEEK ) ) break ; } else { if ( sock_flag ( sk, SOCK_DONE ) ) break ; if ( sk -> sk_err ) { copied = sock_error ( sk ) ; break ; } if ( sk -> sk_shutdown & RCV_SHUTDOWN ) break ; if ( sk -> sk_type == SOCK_STREAM && sk -> sk_state == TCP_

Fix:
<S2SV_ModStart> ; long timeo ; msg -> msg_namelen = 0
Buggy code:
 int x25_negotiate_facilities ( struct sk_buff * skb, struct sock * sk, struct x25_facilities * new, struct x25_dte_facilities * dte ) { struct x25_sock * x25 = x25_sk ( sk ) ; struct x25_facilities * ours = & x25 -> facilities ; struct x25_facilities theirs ; int len ; memset ( & theirs, 0, sizeof ( theirs ) ) ; <START_BUG> memcpy ( new, ours, sizeof ( * new ) ) ; <END_BUG> len = x25_parse_facilities ( skb, & theirs, dte, & x25 -> vc_facil_mask ) ; if ( len < 0 ) return len ; if ( ( theirs. reverse & 0x01 ) && ( ours -> reverse & 0x01 ) ) { SOCK_DEBUG ( sk, "X.25:   rejecting   reverse   charging   request\\n" ) ; return - 1 ; } new -> reverse = theirs. reverse ; if ( theirs. throughput ) { int theirs_in = theirs. throughput & 0x0f ; int theirs_out = theirs. throughput & 0xf0 ; int ours_in = ours -> throughput & 0x0f ; int ours_out = ours -> throughput & 0xf0 ; if (! ours_in || theirs_in < ours_in ) { SOCK_DEBUG ( sk, "X.25:   inbound   throughput   negotiated\\n" ) ; new -> throughput = ( new -> throughput & 0xf0 ) | theirs_in ; } if (! ours_out || theirs_out < ours_out ) { SOCK_DEBUG ( sk, "X.25:   outbound   throughput   negotiated\\n" ) ; new -> throughput = ( new -> throughput & 0x0f ) | theirs_out ; } } if ( theirs. pacsize_in && theirs. pacsize_out ) { if ( theirs. pacsize_in < ours -> pacsize_in ) { SOCK_DEBUG ( sk, "X.25:   packet   size   inwards   negotiated   down\\n" ) ;

Fix:
<S2SV_ModStart> ( * new ) ) ; memset ( dte, 0, sizeof ( * dte
Buggy code:
 static int init_normalization ( struct compiling * c ) { PyObject * m = PyImport_ImportModuleNoBlock ( "unicodedata" ) ; if (! m ) return 0 ; c -> c_normalize = PyObject_GetAttrString ( m, "normalize" ) ; Py_DECREF ( m ) ; if (! c -> c_normalize ) return 0 ; <START_BUG> c -> c_normalize_args = Py_BuildValue ( "(sN)", "NFKC", Py_None ) ; <END_BUG> if (! c -> c_normalize_args ) { Py_CLEAR ( c -> c_normalize ) ; return 0 ; } PyTuple_SET_ITEM ( c -> c_normalize_args, 1, NULL ) ; return 1 ; }

Fix:
<S2SV_ModStart> return 0 ; <S2SV_ModEnd> return 1 ;
Buggy code:
 static OM_uint32 acc_ctx_hints ( OM_uint32 * minor_status, gss_ctx_id_t * ctx, spnego_gss_cred_id_t spcred, gss_buffer_t * mechListMIC, OM_uint32 * negState, send_token_flag * return_token ) { OM_uint32 tmpmin, ret ; gss_OID_set supported_mechSet ; spnego_gss_ctx_id_t sc = NULL ; * mechListMIC = GSS_C_NO_BUFFER ; supported_mechSet = GSS_C_NO_OID_SET ; * return_token = NO_TOKEN_SEND ; * negState = REJECT ; * minor_status = 0 ; if ( * ctx!= GSS_C_NO_CONTEXT ) return GSS_S_DEFECTIVE_TOKEN ; ret = get_negotiable_mechs ( minor_status, spcred, GSS_C_ACCEPT, & supported_mechSet ) ; if ( ret!= GSS_S_COMPLETE ) goto cleanup ; ret = make_NegHints ( minor_status, mechListMIC ) ; if ( ret!= GSS_S_COMPLETE ) goto cleanup ; <START_BUG> sc = create_spnego_ctx ( ) ; <END_BUG> if ( sc == NULL ) { ret = GSS_S_FAILURE ; goto cleanup ; } if ( put_mech_set ( supported_mechSet, & sc -> DER_mechTypes ) < 0 ) { ret = GSS_S_FAILURE ; goto cleanup ; } sc -> internal_mech = GSS_C_NO_OID ; * negState = ACCEPT_INCOMPLETE ; * return_token = INIT_TOKEN_SEND ; sc -> firstpass = 1 ; * ctx = ( gss_ctx_id_t ) sc ; sc = NULL ; ret = GSS_S_COMPLETE ; cleanup : release_spnego_ctx ( & sc ) ; gss_release_oid_set ( & tmpmin, & supported_mechSet ) ; return ret ; }

Fix:
<S2SV_ModStart> = create_spnego_ctx ( 0
Buggy code:
 int btrfs_search_slot ( struct btrfs_trans_handle * trans, struct btrfs_root * root, struct btrfs_key * key, struct btrfs_path * p, int ins_len, int cow ) { struct extent_buffer * b ; int slot ; int ret ; int err ; int level ; int lowest_unlock = 1 ; int root_lock ; int write_lock_level = 0 ; u8 lowest_level = 0 ; int min_write_lock_level ; int prev_cmp ; lowest_level = p -> lowest_level ; WARN_ON ( lowest_level && ins_len > 0 ) ; WARN_ON ( p -> nodes [ 0 ]!= NULL ) ; BUG_ON (! cow && ins_len ) ; if ( ins_len < 0 ) { lowest_unlock = 2 ; write_lock_level = 2 ; } else if ( ins_len > 0 ) { write_lock_level = 1 ; } if (! cow ) write_lock_level = - 1 ; if ( cow && ( p -> keep_locks || p -> lowest_level ) ) write_lock_level = BTRFS_MAX_LEVEL ; min_write_lock_level = write_lock_level ; again : prev_cmp = - 1 ; root_lock = BTRFS_READ_LOCK ; level = 0 ; if ( p -> search_commit_root ) { if ( p -> need_commit_sem ) down_read ( & root -> fs_info -> commit_root_sem ) ; b = root -> commit_root ; extent_buffer_get ( b ) ; level = btrfs_header_level ( b ) ; if ( p -> need_commit_sem ) up_read ( & root -> fs_info -> commit_root_sem ) ; if (! p -> skip_locking ) btrfs_tree_read_lock ( b ) ; } else { if ( p -> skip_locking ) { b = btrfs_root_node ( root ) ; level = btrfs_header_level ( b ) ; } else { b = btrfs_read_lock_root_node ( root ) ; level = btrfs_header_level ( b ) ; if ( level <= write_lock_level ) {

Fix:
<S2SV_ModStart> ret < 0 &&! p -> skip_release_on_error