nus-yam/ex-repair huggingface dataset:
Buggy code:
 struct sctp_chunk * sctp_inq_pop ( struct sctp_inq * queue ) { struct sctp_chunk * chunk ; sctp_chunkhdr_t * ch = NULL ; if ( ( chunk = queue -> in_progress ) ) { if ( chunk -> singleton || chunk -> end_of_packet || chunk -> pdiscard ) { sctp_chunk_free ( chunk ) ; chunk = queue -> in_progress = NULL ; } else { ch = ( sctp_chunkhdr_t * ) chunk -> chunk_end ; skb_pull ( chunk -> skb, chunk -> chunk_end - chunk -> skb -> data ) ; <START_BUG> if ( skb_headlen ( chunk -> skb ) < sizeof ( sctp_chunkhdr_t ) ) { <END_BUG> sctp_chunk_free ( chunk ) ; chunk = queue -> in_progress = NULL ; } } } if (! chunk ) { struct list_head * entry ; if ( list_empty ( & queue -> in_chunk_list ) ) return NULL ; entry = queue -> in_chunk_list. next ; chunk = queue -> in_progress = list_entry ( entry, struct sctp_chunk, list ) ; list_del_init ( entry ) ; chunk -> singleton = 1 ; ch = ( sctp_chunkhdr_t * ) chunk -> skb -> data ; chunk -> data_accepted = 0 ; } chunk -> chunk_hdr = ch ; chunk -> chunk_end = ( ( __u8 * ) ch ) + WORD_ROUND ( ntohs ( ch -> length ) ) ; if ( unlikely ( skb_is_nonlinear ( chunk -> skb ) ) ) { if ( chunk -> chunk_end > skb_tail_pointer ( chunk -> skb ) ) chunk -> chunk_end = skb_tail_pointer ( chunk -> skb ) ; } skb_pull ( chunk -> skb, sizeof ( sctp_chunkhdr_t ) ) ; chunk -> subh. v = NULL ;  if ( chunk -> chunk_end < skb_tail_pointer ( chunk -> skb ) ) { <START_BUG> chunk -> singleton = 0 ; } else if ( chunk -> chunk_end > skb_tail_pointer ( chunk -> skb ) ) { <END_BUG> sctp_chunk_free ( chunk ) ;  chunk = queue ->

Fix:
<S2SV_ModStart> data ) ; <S2SV_ModEnd> } } if <S2SV_ModStart> chunk -> chunk_end + sizeof ( sctp_chunkhdr_t ) <S2SV_ModStart> ) ) { chunk -> pdiscard = 1 ; chunk -> chunk_end = skb_tail_pointer ( chunk -> skb ) ; } else { chunk -> end_of_packet = 1 ; } pr_debug ( "+++sctp_inq_pop+++ <S2SV_blank> chunk:%p[%s], <S2SV_blank> length:%d, <S2SV_blank> skb->len:%d\\n", chunk, sctp_cname ( SCTP_ST_CHUNK ( chunk -> chunk_hdr -> type ) ), ntohs ( chunk -> chunk_hdr -> length ), chunk -> skb -> len ) ; return <S2SV_ModEnd> chunk ; }
Buggy code:
 void icmp_print ( netdissect_options * ndo, const u_char * bp, u_int plen, const u_char * bp2, int fragmented ) { char * cp ; const struct icmp * dp ; const struct icmp_ext_t * ext_dp ; const struct ip * ip ; const char * str, * fmt ; const struct ip * oip ; const struct udphdr * ouh ; const uint8_t * obj_tptr ; uint32_t raw_label ; const u_char * snapend_save ; const struct icmp_mpls_ext_object_header_t * icmp_mpls_ext_object_header ; u_int hlen, dport, mtu, obj_tlen, obj_class_num, obj_ctype ; char buf [ MAXHOSTNAMELEN + 100 ] ; struct cksum_vec vec [ 1 ] ; dp = ( const struct icmp * ) bp ; ext_dp = ( const struct icmp_ext_t * ) bp ; ip = ( const struct ip * ) bp2 ; str = buf ; ND_TCHECK ( dp -> icmp_code ) ; switch ( dp -> icmp_type ) { case ICMP_ECHO : case ICMP_ECHOREPLY : ND_TCHECK ( dp -> icmp_seq ) ; ( void ) snprintf ( buf, sizeof ( buf ), "echo   %s,   id   %u,   seq   %u", dp -> icmp_type == ICMP_ECHO? "request" : "reply", EXTRACT_16BITS ( & dp -> icmp_id ), EXTRACT_16BITS ( & dp -> icmp_seq ) ) ; break ; case ICMP_UNREACH : ND_TCHECK ( dp -> icmp_ip. ip_dst ) ; switch ( dp -> icmp_code ) { case ICMP_UNREACH_PROTOCOL : ND_TCHECK ( dp -> icmp_ip. ip_p ) ; ( void ) snprintf ( buf, sizeof ( buf ), "%s   protocol   %d   unreachable", ipaddr_string ( ndo, & dp -> icmp_ip. ip_dst ), dp -> icmp_ip. ip_p ) ; break ; case IC

Fix:
<S2SV_ModStart> 0 ) { ND_TCHECK_16BITS ( & dp -> icmp_cksum ) ;
Buggy code:
 int __gfs2_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int error ; int len ; char * data ; const char * name = gfs2_acl_name ( type ) ; if ( acl && acl -> a_count > GFS2_ACL_MAX_ENTRIES ( GFS2_SB ( inode ) ) ) return - E2BIG ; if ( type == ACL_TYPE_ACCESS ) { umode_t mode = inode -> i_mode ; <START_BUG> error = posix_acl_equiv_mode ( acl, & mode ) ; <END_BUG> if ( error < 0 ) return error ; if ( error == 0 ) acl = NULL ;  if ( mode!= inode -> i_mode ) { <START_BUG> inode -> i_mode = mode ; mark_inode_dirty ( inode ) ; <END_BUG> }  } if ( acl ) { len = posix_acl_to_xattr ( & init_user_ns, acl, NULL, 0 ) ; if ( len == 0 ) return 0 ; data = kmalloc ( len, GFP_NOFS ) ; if ( data == NULL ) return - ENOMEM ; error = posix_acl_to_xattr ( & init_user_ns, acl, data, len ) ; if ( error < 0 ) goto out ; } else { data = NULL ; len = 0 ; } error = __gfs2_xattr_set ( inode, name, data, len, 0, GFS2_EATYPE_SYS ) ; if ( error ) goto out ; set_cached_acl ( inode, type, acl ) ; out : kfree ( data ) ; return error ; }

Fix:
<S2SV_ModStart> ; error = posix_acl_update_mode ( inode, & inode -> i_mode, & acl ) ; if ( error ) return error <S2SV_ModEnd> ; if ( <S2SV_ModStart> -> i_mode ) <S2SV_ModEnd> mark_inode_dirty ( inode <S2SV_ModStart> inode ) ; <S2SV_ModEnd> } if (
Buggy code:
 int my_redel ( const char * org_name, const char * tmp_name, myf MyFlags ) { int error = 1 ; DBUG_ENTER ( "my_redel" ) ; DBUG_PRINT ( "my", ( "org_name:   \'%s\'   tmp_name:   \'%s\'     MyFlags:   %d", org_name, tmp_name, MyFlags ) ) ; <START_BUG> if ( my_copystat ( org_name, tmp_name, MyFlags ) < 0 ) <END_BUG>  goto end ; <START_BUG> if ( MyFlags & MY_REDEL_MAKE_BACKUP ) { char name_buff [ FN_REFLEN + 20 ] ; char ext [ 20 ] ; ext [ 0 ] = '-' ; get_date ( ext + 1, 2 + 4, ( time_t ) 0 ) ; strmov ( strend ( ext ), REDEL_EXT ) ; if ( my_rename ( org_name, fn_format ( name_buff, org_name, "", ext, 2 ), MyFlags ) ) goto end ; } else if ( my_delete_allow_opened ( org_name, MyFlags ) ) goto end ; if ( my_rename ( tmp_name, org_name, MyFlags ) ) goto end ; error = 0 ; end : DBUG_RETURN ( error ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if (! ( MyFlags & MY_REDEL_NO_COPY_STAT ) ) { if ( <S2SV_ModStart> goto end ; }
Buggy code:
 static void write_image_file ( const vpx_image_t * img, const int planes [ 3 ], FILE * file ) { <START_BUG> int i, y ; <END_BUG> for ( i = 0 ; i < 3 ; ++ i ) { const int plane = planes [ i ] ; const unsigned char * buf = img -> planes [ plane ] ; const int stride = img -> stride [ plane ] ; const int w = vpx_img_plane_width ( img, plane ) ; const int h = vpx_img_plane_height ( img, plane ) ; for ( y = 0 ; y < h ; ++ y ) {  fwrite ( buf, 1, w, file ) ; <START_BUG> buf += stride ; } } }<END_BUG>

Fix:
<S2SV_ModStart>, y ; # if CONFIG_VP9_HIGHBITDEPTH const int bytes_per_sample = ( ( img -> fmt & VPX_IMG_FMT_HIGHBITDEPTH )? 2 : 1 ) ; # else const int bytes_per_sample = 1 ; # endif <S2SV_ModStart> ( buf, bytes_per_sample <S2SV_ModEnd>, w,
Buggy code:
 int rpmPackageFilesInstall ( rpmts ts, rpmte te, rpmfiles files, rpmpsm psm, char * * failedFile ) { FD_t payload = rpmtePayload ( te ) ; rpmfi fi = rpmfiNewArchiveReader ( payload, files, RPMFI_ITER_READ_ARCHIVE ) ; rpmfs fs = rpmteGetFileStates ( te ) ; rpmPlugins plugins = rpmtsPlugins ( ts ) ; struct stat sb ; int saveerrno = errno ; int rc = 0 ; int nodigest = ( rpmtsFlags ( ts ) & RPMTRANS_FLAG_NOFILEDIGEST )? 1 : 0 ; int nofcaps = ( rpmtsFlags ( ts ) & RPMTRANS_FLAG_NOCAPS )? 1 : 0 ; int firsthardlink = - 1 ; int skip ; rpmFileAction action ; char * tid = NULL ; const char * suffix ; char * fpath = NULL ; if ( fi == NULL ) { rc = RPMERR_BAD_MAGIC ; goto exit ; } rasprintf ( & tid, ";%08x", ( unsigned ) rpmtsGetTid ( ts ) ) ; rc = fsmMkdirs ( files, fs, plugins ) ; while (! rc ) { rc = rpmfiNext ( fi ) ; if ( rc < 0 ) { if ( rc == RPMERR_ITER_END ) rc = 0 ; break ; } action = rpmfsGetAction ( fs, rpmfiFX ( fi ) ) ; skip = XFA_SKIPPING ( action ) ; suffix = S_ISDIR ( rpmfiFMode ( fi ) )? NULL : tid ; if ( action!= FA_TOUCH ) { fpath = fsmFsPath ( fi, suffix ) ; } else { fpath = fsmFsPath ( fi, "" ) ; } rc = rpmfiStat ( fi, 1, & sb ) ; fsmDebug ( fpath, action, & sb ) ; if ( rc ) break ; rc = rpmpluginsCallFsmFilePre ( plugins, fi, fpath, sb. st_mode, action ) ; if ( rc ) { skip = 1 ; } else { setFileState ( fs, rpmfiFX ( fi ) ) ; } if (! skip ) { int setmeta = 1 ; if (! suffix ) { rc = fsmBackup ( fi, action ) ; } if (! suffix

Fix:
<S2SV_ModStart>, psm, 0,
Buggy code:
 SQLITE_PRIVATE With * sqlite3WithAdd ( Parse * pParse, With * pWith, Token * pName, ExprList * pArglist, Select * pQuery ) { sqlite3 * db = pParse -> db ; With * pNew ; char * zName ; zName = sqlite3NameFromToken ( pParse -> db, pName ) ; if ( zName && pWith ) { int i ; for ( i = 0 ; i < pWith -> nCte ; i ++ ) { if ( sqlite3StrICmp ( zName, pWith -> a [ i ]. zName ) == 0 ) { sqlite3ErrorMsg ( pParse, "duplicate   WITH   table   name:   %s", zName ) ; } } } if ( pWith ) { <START_BUG> int nByte = sizeof ( * pWith ) + ( sizeof ( pWith -> a [ 1 ] ) * pWith -> nCte ) ; <END_BUG> pNew = sqlite3DbRealloc ( db, pWith, nByte ) ; } else { pNew = sqlite3DbMallocZero ( db, sizeof ( * pWith ) ) ; } assert ( ( pNew!= 0 && zName!= 0 ) || db -> mallocFailed ) ; if ( db -> mallocFailed ) { sqlite3ExprListDelete ( db, pArglist ) ; sqlite3SelectDelete ( db, pQuery ) ; sqlite3DbFree ( db, zName ) ; pNew = pWith ; } else { pNew -> a [ pNew -> nCte ]. pSelect = pQuery ; pNew -> a [ pNew -> nCte ]. pCols = pArglist ; pNew -> a [ pNew -> nCte ]. zName = zName ; pNew -> a [ pNew -> nCte ]. zCteErr = 0 ; pNew -> nCte ++ ; } return pNew ; }

Fix:
<S2SV_ModStart> pWith ) { sqlite3_int64 <S2SV_ModEnd> nByte = sizeof
Buggy code:
 <START_BUG> void vp9_fht16x16_sse2 ( const int16_t * input, int16_t * output, <END_BUG> int stride, int tx_type ) { __m128i in0 [ 16 ], in1 [ 16 ] ; switch ( tx_type ) { case DCT_DCT :  vp9_fdct16x16_sse2 ( input, output, stride ) ; <START_BUG> break ; case ADST_DCT : load_buffer_16x16 ( input, in0, in1, stride ) ; fadst16_sse2 ( in0, in1 ) ; right_shift_16x16 ( in0, in1 ) ; fdct16_sse2 ( in0, in1 ) ; write_buffer_16x16 ( output, in0, in1, 16 ) ; break ; case DCT_ADST : load_buffer_16x16 ( input, in0, in1, stride ) ; fdct16_sse2 ( in0, in1 ) ; right_shift_16x16 ( in0, in1 ) ; fadst16_sse2 ( in0, in1 ) ; write_buffer_16x16 ( output, in0, in1, 16 ) ; break ; case ADST_ADST : load_buffer_16x16 ( input, in0, in1, stride ) ; fadst16_sse2 ( in0, in1 ) ; right_shift_16x16 ( in0, in1 ) ; fadst16_sse2 ( in0, in1 ) ; write_buffer_16x16 ( output, in0, in1, 16 ) ; break ; default : assert ( 0 ) ; break ; } }<END_BUG>

Fix:
<S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> case DCT_DCT : vpx_fdct16x16_sse2 <S2SV_ModEnd> ( input,
Buggy code:
 PS_SERIALIZER_DECODE_FUNC ( php_binary ) { const char * p ; char * name ; const char * endptr = val + vallen ; zval * current ; int namelen ; int has_value ; php_unserialize_data_t var_hash ; <START_BUG> PHP_VAR_UNSERIALIZE_INIT ( var_hash ) ; <END_BUG> for ( p = val ; p < endptr ; ) {  zval * * tmp ; <START_BUG> namelen = ( ( unsigned char ) ( * p ) ) & ( ~ PS_BIN_UNDEF ) ; if ( namelen < 0 || namelen > PS_BIN_MAX || ( p + namelen ) >= endptr ) { PHP_VAR_UNSERIALIZE_DESTROY ( var_hash ) ; return FAILURE ; } has_value = * p & PS_BIN_UNDEF? 0 : 1 ; name = estrndup ( p + 1, namelen ) ; p += namelen + 1 ; if ( zend_hash_find ( & EG ( symbol_table ), name, namelen + 1, ( void * * ) & tmp ) == SUCCESS ) { if ( ( Z_TYPE_PP ( tmp ) == IS_ARRAY && Z_ARRVAL_PP ( tmp ) == & EG ( symbol_table ) ) || * tmp == PS ( http_session_vars ) ) { <END_BUG> efree ( name ) ;  continue ; } } if ( has_value ) { ALLOC_INIT_ZVAL ( current ) ; if ( php_var_unserialize ( & current, ( const unsigned char * * ) & p, ( const unsigned char * ) endptr, & var_hash TSRMLS_CC ) ) { <START_BUG> php_set_session_var ( name, namelen, current, & var_hash TSRMLS_CC ) ; <END_BUG> } else { PHP_VAR_UNSERIALIZE_DESTROY ( var_hash ) ; return FAILURE ; } var_push_dtor_no_addref ( & var_hash, & current ) ; }  PS_ADD_VARL ( name, namelen ) ; <START_BUG> efree ( name ) ; } PHP_VAR_UNSERIALIZE_DESTROY ( var_hash ) ; return SUCCESS ; }<END_BUG>

Fix:
<S2SV_ModStart> php_unserialize_data_t var_hash ; int skip = 0 ; <S2SV_ModStart> * * tmp ; skip = 0 <S2SV_ModStart> ) ) { skip = 1 <S2SV_ModEnd> ; } } <S2SV_ModStart> ) ) { if (! skip ) { <S2SV_ModStart> TSRMLS_CC ) ; } <S2SV_ModStart> ) ; } if (! skip ) { <S2SV_ModStart> namelen ) ; }
Buggy code:
 void acpi_ns_terminate ( void ) { acpi_status status ; <START_BUG> ACPI_FUNCTION_TRACE ( ns_terminate ) ; <END_BUG> # ifdef ACPI_EXEC_APP { union acpi_operand_object * prev ;  union acpi_operand_object * next ; <START_BUG> next = acpi_gbl_module_code_list ; while ( next ) { prev = next ; next = next -> method. mutex ; prev -> method. mutex = NULL ; acpi_ut_remove_reference ( prev ) ; } <END_BUG> }  # endif acpi_ns_delete_namespace_subtree ( acpi_gbl_root_node ) ; status = acpi_ut_acquire_mutex ( ACPI_MTX_NAMESPACE ) ; if ( ACPI_FAILURE ( status ) ) { return_VOID ; } acpi_ns_delete_node ( acpi_gbl_root_node ) ; ( void ) acpi_ut_release_mutex ( ACPI_MTX_NAMESPACE ) ; ACPI_DEBUG_PRINT ( ( ACPI_DB_INFO, "Namespace   freed\\n" ) ) ; return_VOID ; }

Fix:
<S2SV_ModStart> acpi_status status ; <S2SV_ModEnd> union acpi_operand_object * <S2SV_ModStart> acpi_operand_object * next ; ACPI_FUNCTION_TRACE ( ns_terminate ) <S2SV_ModStart> ) ; } <S2SV_ModEnd> acpi_ns_delete_namespace_subtree ( acpi_gbl_root_node
Buggy code:
 static int parse_exp ( Node * * np, PToken * tok, int term, UChar * * src, UChar * end, ScanEnv * env, int group_head ) { <START_BUG> int r, len, group = 0 ; <END_BUG> Node * qn ;  Node * * tp ; <START_BUG> * np = NULL ; if ( tok -> type == ( enum TokenSyms ) term ) <END_BUG> goto end_of_token ;  switch ( tok -> type ) { case TK_ALT : case TK_EOT : end_of_token : * np = node_new_empty ( ) ; CHECK_NULL_RETURN_MEMERR ( * np ) ; return tok -> type ; break ; case TK_SUBEXP_OPEN : r = parse_bag ( np, tok, TK_SUBEXP_CLOSE, src, end, env ) ; if ( r < 0 ) return r ; if ( r == 1 ) { if ( group_head == 0 ) group = 1 ; else { Node * target = * np ; * np = node_new_group ( target ) ; if ( IS_NULL ( * np ) ) { onig_node_free ( target ) ; return ONIGERR_MEMORY ; } group = 2 ; } } else if ( r == 2 ) { Node * target ; OnigOptionType prev = env -> options ; env -> options = BAG_ ( * np ) -> o. options ; r = fetch_token ( tok, src, end, env ) ; if ( r < 0 ) return r ; r = parse_subexp ( & target, tok, term, src, end, env, 0 ) ; env -> options = prev ; if ( r < 0 ) { onig_node_free ( target ) ; return r ; } NODE_BODY ( * np ) = target ; return tok -> type ; } break ; case TK_SUBEXP_CLOSE : if (! IS_SYNTAX_BV ( env -> syntax, ONIG_SYN_ALLOW_UNMATCHED_CLOSE_SUBEXP ) ) return ONIGERR_UNMATCHED_CLOSE_PARENTHESIS ; if ( tok -> escaped ) goto tk_raw_byte ; else goto tk_byte ; break ; case TK_STRING : tk_byte : { * np = node_new_str ( tok -> backp, * src ) ; CHECK_

Fix:
<S2SV_ModStart> len, group <S2SV_ModEnd> ; Node * <S2SV_ModStart> * * tp ; unsigned int parse_depth ; group = 0 <S2SV_ModStart> ) goto end_of_token ; parse_depth = env -> parse_depth <S2SV_ModStart> return ONIGERR_TARGET_OF_REPEAT_OPERATOR_INVALID ; parse_depth ++ ; if ( parse_depth > ParseDepthLimit ) return ONIGERR_PARSE_DEPTH_LIMIT_OVER ;
Buggy code:
 int mp4client_main ( int argc, char * * argv ) { char c ; const char * str ; int ret_val = 0 ; u32 i, times [ 100 ], nb_times, dump_mode ; u32 simulation_time_in_ms = 0 ; u32 initial_service_id = 0 ; Bool auto_exit = GF_FALSE ; Bool logs_set = GF_FALSE ; Bool start_fs = GF_FALSE ; Bool use_rtix = GF_FALSE ; Bool pause_at_first = GF_FALSE ; Bool no_cfg_save = GF_FALSE ; Bool is_cfg_only = GF_FALSE ; Double play_from = 0 ; # ifdef GPAC_MEMORY_TRACKING GF_MemTrackerType mem_track = GF_MemTrackerNone ; # endif Double fps = GF_IMPORT_DEFAULT_FPS ; Bool fill_ar, visible, do_uncache, has_command ; char * url_arg, * out_arg, * the_cfg, * rti_file, * views, * mosaic ; FILE * logfile = NULL ; Float scale = 1 ; # ifndef WIN32 dlopen ( NULL, RTLD_NOW | RTLD_GLOBAL ) ; # endif strcpy ( the_url, "." ) ; memset ( & user, 0, sizeof ( GF_User ) ) ; dump_mode = DUMP_NONE ; fill_ar = visible = do_uncache = has_command = GF_FALSE ; url_arg = out_arg = the_cfg = rti_file = views = mosaic = NULL ; nb_times = 0 ; times [ 0 ] = 0 ; for ( i = 1 ; i < ( u32 ) argc ; i ++ ) { char * arg = argv [ i ] ; if (! strcmp ( arg, "-c" ) ||! strcmp ( arg, "-cfg" ) ) { the_cfg = argv [ i + 1 ] ; i ++ ; } else if (! strcmp ( arg, "-mem-track" ) ||! strcmp ( arg, "-mem-track-stack" ) ) { # ifdef GPAC_MEMORY_TRACKING mem_track =! strcmp ( arg, "-mem-track-stack" )? GF_MemTrackerBackTrace

Fix:
<S2SV_ModStart> [ sizeof ( the_url <S2SV_ModEnd> ) - 1
Buggy code:
 static void umount_tree ( struct mount * mnt, enum umount_tree_flags how ) { LIST_HEAD ( tmp_list ) ; struct mount * p ; if ( how & UMOUNT_PROPAGATE ) propagate_mount_unlock ( mnt ) ; for ( p = mnt ; p ; p = next_mnt ( p, mnt ) ) { p -> mnt. mnt_flags |= MNT_UMOUNT ; list_move ( & p -> mnt_list, & tmp_list ) ; } list_for_each_entry ( p, & tmp_list, mnt_list ) { list_del_init ( & p -> mnt_child ) ; } if ( how & UMOUNT_PROPAGATE ) propagate_umount ( & tmp_list ) ; while (! list_empty ( & tmp_list ) ) { bool disconnect ; p = list_first_entry ( & tmp_list, struct mount, mnt_list ) ; list_del_init ( & p -> mnt_expire ) ; list_del_init ( & p -> mnt_list ) ; __touch_mnt_namespace ( p -> mnt_ns ) ; p -> mnt_ns = NULL ; if ( how & UMOUNT_SYNC ) p -> mnt. mnt_flags |= MNT_SYNC_UMOUNT ; <START_BUG> disconnect =! IS_MNT_LOCKED_AND_LAZY ( p ) ; <END_BUG> pin_insert_group ( & p -> mnt_umount, & p -> mnt_parent -> mnt, disconnect? & unmounted : NULL ) ; if ( mnt_has_parent ( p ) ) { mnt_add_count ( p -> mnt_parent, - 1 ) ; if (! disconnect ) { list_add_tail ( & p -> mnt_child, & p -> mnt_parent -> mnt_mounts ) ; } else { umount_mnt ( p ) ; } } change_mnt_propagation ( p, MS_PRIVATE ) ; } }

Fix:
<S2SV_ModStart> disconnect =! ( ( ( how & UMOUNT_CONNECTED ) && mnt_has_parent ( p ) && ( p -> mnt_parent -> mnt. mnt_flags & MNT_UMOUNT ) ) || <S2SV_ModStart> IS_MNT_LOCKED_AND_LAZY ( p )
Buggy code:
 static void write_modes_sb ( VP9_COMP * cpi, const TileInfo * const tile, <START_BUG> vp9_writer * w, TOKENEXTRA * * tok, TOKENEXTRA * tok_end, <END_BUG> int mi_row, int mi_col, BLOCK_SIZE bsize ) {  VP9_COMMON * const cm = & cpi -> common ; <START_BUG> <END_BUG> MACROBLOCKD * const xd = & cpi -> mb. e_mbd ;  <START_BUG> const int bsl = b_width_log2 ( bsize ) ; <END_BUG> const int bs = ( 1 << bsl ) // 4 ; PARTITION_TYPE partition ; BLOCK_SIZE subsize ;  MODE_INFO * m = cm -> mi_grid_visible [ mi_row * cm -> mi_stride + mi_col ] ; <START_BUG> if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; partition = partition_lookup [ bsl ] [ m -> mbmi. sb_type ] ; write_partition ( cm, xd, bs, mi_row, mi_col, partition, bsize, w ) ; subsize = get_subsize ( bsize, partition ) ; if ( subsize < BLOCK_8X8 ) { write_modes_b ( cpi, tile, w, tok, tok_end, mi_row, mi_col ) ; } else { switch ( partition ) { case PARTITION_NONE : write_modes_b ( cpi, tile, w, tok, tok_end, mi_row, mi_col ) ; break ; case PARTITION_HORZ : write_modes_b ( cpi, tile, w, tok, tok_end, mi_row, mi_col ) ; if ( mi_row + bs < cm -> mi_rows ) write_modes_b ( cpi, tile, w, tok, tok_end, mi_row + bs, mi_col ) ; break ; case PARTITION_VERT : write_modes_b ( cpi, tile, w, tok, tok_end, mi_row, mi_col ) ; if ( mi_col + bs < cm -> mi_cols ) write_modes_b ( cpi, tile, w, tok, tok_end, mi_row, mi_col + bs ) ; break ; case<END_BUG>

Fix:
<S2SV_ModStart> const tile, vpx_writer * w, <S2SV_ModEnd> TOKENEXTRA * * <S2SV_ModStart> * tok, const TOKENEXTRA * const <S2SV_ModEnd> tok_end, int <S2SV_ModStart> bsize ) { const <S2SV_ModStart> & cpi -> td. <S2SV_ModStart> int bsl = b_width_log2_lookup [ bsize ] <S2SV_ModEnd> ; const int <S2SV_ModStart> BLOCK_SIZE subsize ; const MODE_INFO * m = NULL ; if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; <S2SV_ModEnd> m = cm <S2SV_ModStart> + mi_col ] <S2SV_ModEnd> ; partition =
Buggy code:
 key_ref_t key_create_or_update ( key_ref_t keyring_ref, const char * type, const char * description, const void * payload, size_t plen, key_perm_t perm, unsigned long flags ) { struct keyring_index_key index_key = {. description = description, } ; struct key_preparsed_payload prep ; struct assoc_array_edit * edit ; const struct cred * cred = current_cred ( ) ; struct key * keyring, * key = NULL ; key_ref_t key_ref ; int ret ; index_key. type = key_type_lookup ( type ) ; if ( IS_ERR ( index_key. type ) ) { key_ref = ERR_PTR ( - ENODEV ) ; goto error ; } key_ref = ERR_PTR ( - EINVAL ) ; <START_BUG> if (! index_key. type -> match ||! index_key. type -> instantiate || <END_BUG> (! index_key. description &&! index_key. type -> preparse ) ) goto error_put_type ; keyring = key_ref_to_ptr ( keyring_ref ) ; key_check ( keyring ) ; key_ref = ERR_PTR ( - ENOTDIR ) ; if ( keyring -> type!= & key_type_keyring ) goto error_put_type ; memset ( & prep, 0, sizeof ( prep ) ) ; prep. data = payload ; prep. datalen = plen ; prep. quotalen = index_key. type -> def_datalen ; prep. trusted = flags & KEY_ALLOC_TRUSTED ; prep. expiry = TIME_T_MAX ; if ( index_key. type -> preparse ) { ret = index_key. type -> preparse ( & prep ) ; if ( ret < 0 ) { key_ref = ERR_PTR ( ret ) ; goto error_free_prep ; } if (! index_key. description ) index_key. description = prep. description ; key_ref = ERR_PTR ( - EINVAL ) ; if (! index_key. description ) goto error_free_prep ; } index_key. desc_len = strlen ( index_key. description ) ; key_ref = ERR_PTR ( - EPERM ) ; if (!

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd>! index_key.
Buggy code:
 int __kvm_set_memory_region ( struct kvm * kvm, struct kvm_userspace_memory_region * mem, int user_alloc ) { int r ; gfn_t base_gfn ; unsigned long npages ; unsigned long i ; struct kvm_memory_slot * memslot ; struct kvm_memory_slot old, new ; struct kvm_memslots * slots, * old_memslots ; r = check_memory_region_flags ( mem ) ; if ( r ) goto out ; r = - EINVAL ; if ( mem -> memory_size & ( PAGE_SIZE - 1 ) ) goto out ; if ( mem -> guest_phys_addr & ( PAGE_SIZE - 1 ) ) goto out ; if ( user_alloc && ( ( mem -> userspace_addr & ( PAGE_SIZE - 1 ) ) ||! access_ok ( VERIFY_WRITE, ( void __user * ) ( unsigned long ) mem -> userspace_addr, mem -> memory_size ) ) ) goto out ; if ( mem -> slot >= KVM_MEM_SLOTS_NUM ) goto out ; if ( mem -> guest_phys_addr + mem -> memory_size < mem -> guest_phys_addr ) goto out ; memslot = id_to_memslot ( kvm -> memslots, mem -> slot ) ; base_gfn = mem -> guest_phys_addr >> PAGE_SHIFT ; npages = mem -> memory_size >> PAGE_SHIFT ; r = - EINVAL ; if ( npages > KVM_MEM_MAX_NR_PAGES ) goto out ; if (! npages ) mem -> flags &= ~ KVM_MEM_LOG_DIRTY_PAGES ; new = old = * memslot ; new. id = mem -> slot ; new. base_gfn = base_gfn ; new. npages = npages ; new. flags = mem -> flags ; r = - EINVAL ; if ( npages && old. npages && npages!= old. npages ) goto out_free ; r = - EEXIST ; for ( i = 0 ; i < KVM_MEMORY_SLOTS ; ++ i ) { struct kvm_memory_slot * s = & kvm -> memslots -> memslots [ i ] ; if ( s

Fix:
<S2SV_ModStart> (! npages || base_gfn!= old. base_gfn
Buggy code:
 static bool regsafe ( struct bpf_reg_state * rold, struct bpf_reg_state * rcur, struct idpair * idmap ) { if (! ( rold -> live & REG_LIVE_READ ) ) return true ; if ( memcmp ( rold, rcur, offsetof ( struct bpf_reg_state, live ) ) == 0 ) return true ; if ( rold -> type == NOT_INIT ) return true ; if ( rcur -> type == NOT_INIT ) return false ; switch ( rold -> type ) { case SCALAR_VALUE : if ( rcur -> type == SCALAR_VALUE ) { return range_within ( rold, rcur ) && tnum_in ( rold -> var_off, rcur -> var_off ) ; } else { <START_BUG> return rold -> umin_value == 0 && <END_BUG> rold -> umax_value == U64_MAX && rold -> smin_value == S64_MIN && rold -> smax_value == S64_MAX && tnum_is_unknown ( rold -> var_off ) ; } case PTR_TO_MAP_VALUE : return memcmp ( rold, rcur, offsetof ( struct bpf_reg_state, id ) ) == 0 && range_within ( rold, rcur ) && tnum_in ( rold -> var_off, rcur -> var_off ) ; case PTR_TO_MAP_VALUE_OR_NULL : if ( rcur -> type!= PTR_TO_MAP_VALUE_OR_NULL ) return false ; if ( memcmp ( rold, rcur, offsetof ( struct bpf_reg_state, id ) ) ) return false ; return check_ids ( rold -> id, rcur -> id, idmap ) ; case PTR_TO_PACKET_META : case PTR_TO_PACKET : if ( rcur -> type!= rold -> type ) return false ; if ( rold -> range > rcur -> range ) return false ; if ( rold -> off!= rcur -> off ) return false ; if ( rold -> id &&! check_ids ( rold -> id, rcur -> id, idmap ) ) return false ; return range_within ( rold, rcur ) && t

Fix:
<S2SV_ModStart> else { return false <S2SV_ModEnd> ; } case
Buggy code:
 static void validate_stream_config ( const struct stream_state * stream, const struct VpxEncoderConfig * global ) { const struct stream_state * streami ; <START_BUG> if (! stream -> config. cfg. g_w ||! stream -> config. cfg. g_h ) <END_BUG> fatal ( "Stream   %d:   Specify   stream   dimensions   with   --width   (-w)   " "   and   --height   (-h)", stream -> index ) ;  if ( stream -> config. cfg. g_profile!= 0 &&! global -> experimental_bitstream ) { <START_BUG> fatal ( "Stream   %d:   profile   %d   is   experimental   and   requires   the   --%s   flag", stream -> index, stream -> config. cfg. g_profile, experimental_bitstream. long_name ) ; } for ( streami = stream ; streami ; streami = streami -> next ) { <END_BUG> if (! streami -> config. out_fn )  fatal ( "Stream   %d:   Output   file   is   required   (specify   with   -o)", streami -> index ) ; if ( streami!= stream ) { <START_BUG> const char * a = stream -> config. out_fn ; <END_BUG> const char * b = streami -> config. out_fn ; if (! strcmp ( a, b ) && strcmp ( a, "//dev//null" ) && strcmp ( a, ":nul" ) ) fatal ( "Stream   %d:   duplicate   output   file   (from   stream   %d)", streami -> index, stream -> index ) ; } if ( streami!= stream ) {  const char * a = stream -> config. stats_fn ; <START_BUG> const char * b = streami -> config. stats_fn ; if ( a && b &&! strcmp ( a, b ) ) fatal ( "Stream   %d:   duplicate   stats   file   (from   stream   %d)", streami -> index, stream -> index ) ; } } }<END_BUG>

Fix:
<S2SV_ModStart> * streami ; ( void ) global ; <S2SV_ModStart>. cfg. g_input_bit_depth > ( unsigned int ) stream -> config. cfg. g_bit_depth ) { fatal ( "Stream <S2SV_blank> %d: <S2SV_blank> codec <S2SV_blank> bit <S2SV_blank> depth <S2SV_blank> (%d) <S2SV_blank> less <S2SV_blank> than <S2SV_blank> input <S2SV_blank> bit <S2SV_blank> depth <S2SV_blank> (%d)", stream -> index, ( int ) stream -> config. cfg. g_bit_depth, stream -> config. cfg. g_input_bit_depth ) ; } for ( streami = stream ; streami ; streami = streami -> next ) { if (! streami -> config. out_fn ) fatal ( "Stream <S2SV_blank> %d: <S2SV_blank> Output <S2SV_blank> file <S2SV_blank> is <S2SV_blank> required <S2SV_blank> (specify <S2SV_blank> with <S2SV_blank> -o)", streami -> index ) ; if ( streami!= stream ) { const char * a = stream <S2SV_ModEnd> -> config. <S2SV_ModStart> config. out_fn ; const char * b = streami -> config. out_fn ; if (! strcmp ( a, b ) && strcmp ( a, "//dev//null" ) && strcmp ( a, ":nul" ) ) fatal ( "Stream <S2SV_blank> %d: <S2SV_blank> duplicate <S2SV_blank> output <S2SV_blank>
Buggy code:
 static long do_get_mempolicy ( int * policy, nodemask_t * nmask, unsigned long addr, unsigned long flags ) { int err ; struct mm_struct * mm = current -> mm ; struct vm_area_struct * vma = NULL ; struct mempolicy * pol = current -> mempolicy ; if ( flags & ~ ( unsigned long ) ( MPOL_F_NODE | MPOL_F_ADDR | MPOL_F_MEMS_ALLOWED ) ) return - EINVAL ; if ( flags & MPOL_F_MEMS_ALLOWED ) { if ( flags & ( MPOL_F_NODE | MPOL_F_ADDR ) ) return - EINVAL ; * policy = 0 ; task_lock ( current ) ; * nmask = cpuset_current_mems_allowed ; task_unlock ( current ) ; return 0 ; } if ( flags & MPOL_F_ADDR ) { down_read ( & mm -> mmap_sem ) ; vma = find_vma_intersection ( mm, addr, addr + 1 ) ; if (! vma ) { up_read ( & mm -> mmap_sem ) ; return - EFAULT ; } if ( vma -> vm_ops && vma -> vm_ops -> get_policy ) pol = vma -> vm_ops -> get_policy ( vma, addr ) ; else pol = vma -> vm_policy ; } else if ( addr ) return - EINVAL ; if (! pol ) pol = & default_policy ; if ( flags & MPOL_F_NODE ) { if ( flags & MPOL_F_ADDR ) { err = lookup_node ( addr ) ; if ( err < 0 ) goto out ; * policy = err ; } else if ( pol == current -> mempolicy && pol -> mode == MPOL_INTERLEAVE ) { * policy = next_node_in ( current -> il_prev, pol -> v. nodes ) ; } else { err = - EINVAL ; goto out ; } } else { * policy = pol == & default_policy? MPOL_DEFAULT : pol -> mode ; * policy |= ( pol -> flags & MPOL_MODE_FLAGS ) ; } <START_BUG> if ( vma ) { <END_BUG> up_read ( & current -> mm -> mmap_sem ) ; vma = NULL ; } err = 0 ; if

Fix:
<S2SV_ModStart> ) ; } <S2SV_ModEnd> err = 0
Buggy code:
 static int http_connect ( http_subtransport * t ) { int error ; if ( t -> connected && http_should_keep_alive ( & t -> parser ) && t -> parse_finished ) return 0 ; if ( t -> io ) { git_stream_close ( t -> io ) ; git_stream_free ( t -> io ) ; t -> io = NULL ; t -> connected = 0 ; } if ( t -> connection_data. use_ssl ) { error = git_tls_stream_new ( & t -> io, t -> connection_data. host, t -> connection_data. port ) ; } else { # ifdef GIT_CURL error = git_curl_stream_new ( & t -> io, t -> connection_data. host, t -> connection_data. port ) ; # else error = git_socket_stream_new ( & t -> io, t -> connection_data. host, t -> connection_data. port ) ; # endif } if ( error < 0 ) return error ; GITERR_CHECK_VERSION ( t -> io, GIT_STREAM_VERSION, "git_stream" ) ; apply_proxy_config ( t ) ; error = git_stream_connect ( t -> io ) ; if ( (! error || error == GIT_ECERTIFICATE ) && t -> owner -> certificate_check_cb!= NULL && git_stream_is_encrypted ( t -> io ) ) { git_cert * cert ; <START_BUG> int is_valid ; <END_BUG> if ( ( error = git_stream_certificate ( & cert, t -> io ) ) < 0 ) return error ;  giterr_clear ( ) ; <START_BUG> is_valid = error!= GIT_ECERTIFICATE ; error = t -> owner -> certificate_check_cb ( cert, is_valid, t -> connection_data. host, t -> owner -> message_cb_payload ) ; if ( error < 0 ) { if (! giterr_last ( ) ) giterr_set ( GITERR_NET, "user   cancelled   certificate   check" ) ; return error ; } } if ( error < 0 ) return error ; t -> connected = 1 ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; int is_valid = ( error == GIT_OK ) <S2SV_ModStart> giterr_clear ( ) <S2SV_ModEnd> ; error =
Buggy code:
 static void pci_emul_cmdsts_write ( struct pci_vdev * dev, int coff, uint32_t new, int bytes ) { int i, rshift ; uint32_t cmd, cmd2, changed, old, readonly ; cmd = pci_get_cfgdata16 ( dev, PCIR_COMMAND ) ; rshift = ( coff & 0x3 ) * 8 ; readonly = 0xFFFFF880 >> rshift ; old = CFGREAD ( dev, coff, bytes ) ; new &= ~ readonly ; new |= ( old & readonly ) ; CFGWRITE ( dev, coff, new, bytes ) ; cmd2 = pci_get_cfgdata16 ( dev, PCIR_COMMAND ) ; changed = cmd ^ cmd2 ; for ( i = 0 ; i <= PCI_BARMAX ; i ++ ) { switch ( dev -> bar [ i ]. type ) { case PCIBAR_NONE : case PCIBAR_MEMHI64 : break ; case PCIBAR_IO : if ( changed & PCIM_CMD_PORTEN ) { if ( porten ( dev ) ) register_bar ( dev, i ) ; else unregister_bar ( dev, i ) ; } break ; case PCIBAR_MEM32 : case PCIBAR_MEM64 : if ( changed & PCIM_CMD_MEMEN ) { if ( memen ( dev ) ) register_bar ( dev, i ) ; else unregister_bar ( dev, i ) ; } break ; default : <START_BUG> assert ( 0 ) ; <END_BUG> } } pci_lintr_update ( dev ) ; }

Fix:
<S2SV_ModStart> ; default : pr_err ( "%s: <S2SV_blank> invalid <S2SV_blank> bar <S2SV_blank> type <S2SV_blank> %d\\n", __func__, dev -> bar [ i ]. type ) ; return <S2SV_ModEnd> ; } }
Buggy code:
 static int l2tp_ip6_getname ( struct socket * sock, struct sockaddr * uaddr, int * uaddr_len, int peer ) { struct sockaddr_l2tpip6 * lsa = ( struct sockaddr_l2tpip6 * ) uaddr ; struct sock * sk = sock -> sk ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct l2tp_ip6_sock * lsk = l2tp_ip6_sk ( sk ) ; lsa -> l2tp_family = AF_INET6 ; lsa -> l2tp_flowinfo = 0 ; lsa -> l2tp_scope_id = 0 ; <START_BUG> if ( peer ) { <END_BUG> if (! lsk -> peer_conn_id ) return - ENOTCONN ; lsa -> l2tp_conn_id = lsk -> peer_conn_id ; lsa -> l2tp_addr = np -> daddr ; if ( np -> sndflow ) lsa -> l2tp_flowinfo = np -> flow_label ; } else { if ( ipv6_addr_any ( & np -> rcv_saddr ) ) lsa -> l2tp_addr = np -> saddr ; else lsa -> l2tp_addr = np -> rcv_saddr ; lsa -> l2tp_conn_id = lsk -> conn_id ; } if ( ipv6_addr_type ( & lsa -> l2tp_addr ) & IPV6_ADDR_LINKLOCAL ) lsa -> l2tp_scope_id = sk -> sk_bound_dev_if ; * uaddr_len = sizeof ( * lsa ) ; return 0 ; }

Fix:
<S2SV_ModStart> = 0 ; lsa -> l2tp_unused = 0 ;
Buggy code:
 static Image * ReadSGIImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; SGIInfo iris_info ; size_t bytes_per_pixel, quantum ; ssize_t count, y, z ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } iris_info. magic = ReadBlobMSBShort ( image ) ; do { if ( iris_info. magic!= 0x01DA ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; iris_info. storage = ( unsigned char ) ReadBlobByte ( image ) ; switch ( iris_info. storage ) { case 0x00 : image -> compression = NoCompression ; break ; case 0x01 : image -> compression = RLECompression ; break ; default : ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; } iris_info. bytes_per_pixel = ( unsigned char ) ReadBlobByte ( image ) ; if ( ( iris_info. bytes_per_pixel == 0 ) || ( iris_info. bytes_per_pixel > 2 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; iris_info. dimension = ReadBlobMSBShort ( image ) ; iris_info. columns = ReadBlobMSBShort ( image ) ; iris_info. rows = ReadBlobMSBShort ( image ) ; iris_info.

Fix:
<S2SV_ModStart> image ) ; count = <S2SV_ModEnd> ReadBlob ( image <S2SV_ModStart> iris_info. name ) ; if ( count!= sizeof ( iris_info. name ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" <S2SV_ModStart> filler ) ; if ( count!= sizeof ( iris_info. filler ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) <S2SV_ModEnd> ; image -> <S2SV_ModStart> } if ( <S2SV_ModEnd> ( image_info ->
Buggy code:
 static int lua_websocket_read ( lua_State * L ) { apr_socket_t * sock ; apr_status_t rv ; <START_BUG> int n = 0 ; <END_BUG> apr_size_t len = 1 ; apr_size_t plen = 0 ; unsigned short payload_short = 0 ; apr_uint64_t payload_long = 0 ; unsigned char * mask_bytes ; char byte ; int plaintext ; request_rec * r = ap_lua_check_request_rec ( L, 1 ) ; plaintext = ap_lua_ssl_is_https ( r -> connection )? 0 : 1 ; mask_bytes = apr_pcalloc ( r -> pool, 4 ) ;  sock = ap_get_conn_socket ( r -> connection ) ; <START_BUG> if ( plaintext ) { rv = apr_socket_recv ( sock, & byte, & len ) ; } else { rv = lua_websocket_readbytes ( r -> connection, & byte, 1 ) ; } if ( rv == APR_SUCCESS ) { unsigned char ubyte, fin, opcode, mask, payload ; ubyte = ( unsigned char ) byte ; fin = ubyte >> ( CHAR_BIT - 1 ) ; opcode = ubyte & 0xf ; if ( plaintext ) { rv = apr_socket_recv ( sock, & byte, & len ) ; } else { rv = lua_websocket_readbytes ( r -> connection, & byte, 1 ) ; } if ( rv == APR_SUCCESS ) { ubyte = ( unsigned char ) byte ; mask = ubyte >> ( CHAR_BIT - 1 ) ; payload = ubyte & 0x7f ; plen = payload ; if ( payload == 126 ) { len = 2 ; if ( plaintext ) { rv = apr_socket_recv ( sock, ( char * ) & payload_short, & len ) ; } else { rv = lua_websocket_readbytes ( r -> connection, ( char * ) & payload_short, 2 ) ; } payload_short = ntohs ( payload_short ) ; if ( rv == APR_SUCCESS ) { plen = payload_short ; } else { return 0 ; } } if ( payload == 127 ) { len = 8 ; if ( plaintext ) { rv = apr_socket_recv ( sock,<END_BUG>

Fix:
<S2SV_ModStart> rv ; int do_read = 1 ; int <S2SV_ModStart> -> connection ) ; while ( do_read ) { do_read = 0 <S2SV_ModStart> plen ) ; do_read = 1 ; } <S2SV_ModEnd> } } }
Buggy code:
 static void pkinit_server_verify_padata ( krb5_context context, krb5_data * req_pkt, krb5_kdc_req * request, krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data * data, krb5_kdcpreauth_callbacks cb, krb5_kdcpreauth_rock rock, krb5_kdcpreauth_moddata moddata, krb5_kdcpreauth_verify_respond_fn respond, void * arg ) { krb5_error_code retval = 0 ; krb5_data authp_data = { 0, 0, NULL }, krb5_authz = { 0, 0, NULL } ; krb5_pa_pk_as_req * reqp = NULL ; krb5_pa_pk_as_req_draft9 * reqp9 = NULL ; krb5_auth_pack * auth_pack = NULL ; krb5_auth_pack_draft9 * auth_pack9 = NULL ; pkinit_kdc_context plgctx = NULL ; pkinit_kdc_req_context reqctx = NULL ; krb5_checksum cksum = { 0, 0, 0, NULL } ; krb5_data * der_req = NULL ; int valid_eku = 0, valid_san = 0 ; krb5_data k5data ; int is_signed = 1 ; krb5_pa_data * * e_data = NULL ; krb5_kdcpreauth_modreq modreq = NULL ; pkiDebug ( "pkinit_verify_padata:   entered!\\n" ) ; if ( data == NULL || data -> length <= 0 || data -> contents == NULL ) { <START_BUG> ( * respond ) ( arg, 0, NULL, NULL, NULL ) ; <END_BUG> return ; } if ( moddata == NULL ) { ( * respond ) ( arg, EINVAL, NULL, NULL, NULL ) ; return ; } plgctx = pkinit_find_realm_context ( context, moddata, request -> server ) ; if ( plgctx == NULL ) {  ( * respond ) ( arg, 0, NULL, NULL, NULL ) ; <START_BUG> return ; } # if<END_BUG>

Fix:
<S2SV_ModStart> ( arg, EINVAL <S2SV_ModEnd>, NULL, <S2SV_ModStart> ( arg, EINVAL <S2SV_ModEnd>, NULL,
Buggy code:
 void * chk_malloc ( size_t bytes ) { <START_BUG> char * buffer = ( char * ) dlmalloc ( bytes + CHK_OVERHEAD_SIZE ) ; <END_BUG> if ( buffer ) { memset ( buffer, CHK_SENTINEL_VALUE, bytes + CHK_OVERHEAD_SIZE ) ; size_t offset = dlmalloc_usable_size ( buffer ) - sizeof ( size_t ) ; * ( size_t * ) ( buffer + offset ) = bytes ; buffer += CHK_SENTINEL_HEAD_SIZE ; } return buffer ; }

Fix:
<S2SV_ModStart> bytes ) { size_t size = bytes + CHK_OVERHEAD_SIZE ; if ( size < bytes ) { return NULL ; } uint8_t <S2SV_ModEnd> * buffer = <S2SV_ModStart> buffer = ( uint8_t <S2SV_ModEnd> * ) dlmalloc <S2SV_ModStart> ) dlmalloc ( size <S2SV_ModEnd> ) ; if
Buggy code:
 static int get_default_root ( pool * p, int allow_symlinks, const char * * root ) { config_rec * c = NULL ; const char * dir = NULL ; int res ; c = find_config ( main_server -> conf, CONF_PARAM, "DefaultRoot", FALSE ) ; while ( c!= NULL ) { pr_signals_handle ( ) ; if ( c -> argc < 2 ) { dir = c -> argv [ 0 ] ; break ; } res = pr_expr_eval_group_and ( ( ( char * * ) c -> argv ) + 1 ) ; if ( res ) { dir = c -> argv [ 0 ] ; break ; } c = find_config_next ( c, c -> next, CONF_PARAM, "DefaultRoot", FALSE ) ; } if ( dir!= NULL ) { const char * new_dir ; new_dir = path_subst_uservar ( p, & dir ) ; if ( new_dir!= NULL ) { dir = new_dir ; } if ( strncmp ( dir, "//", 2 ) == 0 ) { dir = NULL ; } else { char * realdir ; int xerrno = 0 ; if ( allow_symlinks == FALSE ) { char * path, target_path [ PR_TUNABLE_PATH_MAX + 1 ] ; <START_BUG> struct stat st ; <END_BUG> size_t pathlen ; path = pstrdup ( p, dir ) ; if ( * path!= '//' ) { if ( * path == '~' ) { if ( pr_fs_interpolate ( dir, target_path, sizeof ( target_path ) - 1 ) < 0 ) { return - 1 ; } path = target_path ; } } pathlen = strlen ( path ) ; if ( pathlen > 1 && path [ pathlen - 1 ] == '//' ) { path [ pathlen - 1 ] = '\\0' ; }  pr_fs_clear_cache2 ( path ) ; <START_BUG> res = pr_fsio_lstat ( path, & st ) ; if ( res < 0 ) { <END_BUG> xerrno = errno ;  <START_BUG> pr_log_pri ( PR_LOG_WARNING, "error:   unable   to   check   %s:   %s", path, <END_BUG> strerror ( xerrno ) ) ; errno = xerrno ; return - 1 ; } if ( S_

Fix:
<S2SV_ModStart> 1 ] ; <S2SV_ModEnd> size_t pathlen ; <S2SV_ModStart> '\\0' ; } res = is_symlink_path ( p, path, pathlen <S2SV_ModEnd> ) ; if <S2SV_ModStart> 0 ) { if ( errno == EPERM ) { <S2SV_ModEnd> pr_log_pri ( PR_LOG_WARNING <S2SV_ModStart> ( PR_LOG_WARNING, "error: <S2SV_blank> DefaultRoot <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> a <S2SV_blank> symlink <S2SV_blank> " "(denied <S2SV_blank> by <S2SV_blank> AllowChrootSymlinks <S2SV_blank> config)", path ) ; } <S2SV_ModEnd> errno = EPERM
Buggy code:
 static int parse_video_info ( AVIOContext * pb, AVStream * st ) { uint16_t size_asf ; uint32_t size_bmp ; unsigned int tag ; st -> codecpar -> width = avio_rl32 ( pb ) ; st -> codecpar -> height = avio_rl32 ( pb ) ; avio_skip ( pb, 1 ) ; size_asf = avio_rl16 ( pb ) ; tag = ff_get_bmp_header ( pb, st, & size_bmp ) ; st -> codecpar -> codec_tag = tag ; st -> codecpar -> codec_id = ff_codec_get_id ( ff_codec_bmp_tags, tag ) ; size_bmp = FFMAX ( size_asf, size_bmp ) ; <START_BUG> if ( size_bmp > BMP_HEADER_SIZE ) { <END_BUG> int ret ; st -> codecpar -> extradata_size = size_bmp - BMP_HEADER_SIZE ; if (! ( st -> codecpar -> extradata = av_malloc ( st -> codecpar -> extradata_size + AV_INPUT_BUFFER_PADDING_SIZE ) ) ) { st -> codecpar -> extradata_size = 0 ; return AVERROR ( ENOMEM ) ; } memset ( st -> codecpar -> extradata + st -> codecpar -> extradata_size, 0, AV_INPUT_BUFFER_PADDING_SIZE ) ; if ( ( ret = avio_read ( pb, st -> codecpar -> extradata, st -> codecpar -> extradata_size ) ) < 0 ) return ret ; } return 0 ; }

Fix:
<S2SV_ModStart> size_bmp > BMP_HEADER_SIZE && size_bmp < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE
Buggy code:
 static int tt_s2_4600_frontend_attach ( struct dvb_usb_adapter * adap ) { struct dvb_usb_device * d = adap -> dev ; <START_BUG> struct dw2102_state * state = d -> priv ; <END_BUG> u8 obuf [ 3 ] = { 0xe, 0x80, 0 } ; u8 ibuf [ ] = { 0 } ; struct i2c_adapter * i2c_adapter ; struct i2c_client * client ; struct i2c_board_info board_info ; struct m88ds3103_platform_data m88ds3103_pdata = { } ; struct ts2020_config ts2020_config = { } ;  if ( dvb_usb_generic_rw ( d, obuf, 3, ibuf, 1, 0 ) < 0 ) <START_BUG> err ( "command   0x0e   transfer   failed." ) ; <END_BUG> obuf [ 0 ] = 0xe ;  <START_BUG> obuf [ 1 ] = 0x02 ; <END_BUG>  obuf [ 2 ] = 1 ; <START_BUG> <END_BUG> if ( dvb_usb_generic_rw ( d, obuf, 3, ibuf, 1, 0 ) < 0 )  err ( "command   0x0e   transfer   failed." ) ; msleep ( 300 ) ; <START_BUG> obuf [ 0 ] = 0xe ; <END_BUG>  obuf [ 1 ] = 0x83 ; <START_BUG> <END_BUG> obuf [ 2 ] = 0 ;  <START_BUG> if ( dvb_usb_generic_rw ( d, obuf, 3, ibuf, 1, 0 ) < 0 ) <END_BUG> err ( "command   0x0e   transfer   failed." ) ;  obuf [ 0 ] = 0xe ; <START_BUG> <END_BUG> obuf [ 1 ] = 0x83 ;  <START_BUG> obuf [ 2 ] = 1 ; <END_BUG>  if ( dvb_usb_generic_rw ( d, obuf, 3, ibuf, 1, 0 ) < 0 ) <START_BUG> err ( "command   0x0e   transfer   failed." ) ; <END_BUG> obuf [ 0 ] = 0x51 ;  <START_BUG> if ( dvb_usb_generic_rw ( d, obuf, 1, ibuf, 1, 0 ) < 0 ) <END_BUG>  err ( "command   0x51   transfer   failed." ) ; <START_BUG> m<END_BUG>

Fix:
<S2SV_ModStart> d -> priv <S2SV_ModEnd> ; struct i2c_adapter <S2SV_ModStart> { } ; mutex_lock ( & d -> data_mutex ) ; state -> data [ 0 ] = 0xe ; state -> data [ 1 ] = 0x80 ; state -> data [ 2 ] = 0x0 ; <S2SV_ModStart> ( d, state -> data <S2SV_ModEnd>, 3, <S2SV_ModStart>, 3, state -> data <S2SV_ModEnd>, 1, <S2SV_ModStart> "command <S2SV_blank> 0x0e <S2SV_blank> transfer <S2SV_blank> failed." ) ; state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = 0xe ; state -> data <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> = 0x02 ; state -> data <S2SV_ModEnd> [ 2 ] <S2SV_ModStart> ( d, state -> data <S2SV_ModEnd>, 3, <S2SV_ModStart>, 3, state -> data <S2SV_ModEnd>, 1, <S2SV_ModStart> 300 ) ; state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = 0xe ; state -> data <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> = 0x83 ; state -> data <S2SV_ModEnd> [ 2 ] <S2SV_ModStart> ( d, state -> data <S2SV_ModEnd>, 3, <S2SV_ModStart>, 3, state -> data <S2SV_ModEnd>, 1, <S2SV_ModStart> "command <S2SV_blank> 0x0e <S2SV_blank> transfer <S2SV_blank> failed." ) ; state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = 0xe ; state -> data <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> = 0x83 ; state -> data <S2SV_ModEnd> [
Buggy code:
 static int packet_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct sk_buff * skb ; int copied, err ; struct sockaddr_ll * sll ; int vnet_hdr_len = 0 ; err = - EINVAL ; if ( flags & ~ ( MSG_PEEK | MSG_DONTWAIT | MSG_TRUNC | MSG_CMSG_COMPAT | MSG_ERRQUEUE ) ) goto out ; # if 0 if ( pkt_sk ( sk ) -> ifindex < 0 ) return - ENODEV ; # endif if ( flags & MSG_ERRQUEUE ) { err = packet_recv_error ( sk, msg, len ) ; goto out ; } skb = skb_recv_datagram ( sk, flags, flags & MSG_DONTWAIT, & err ) ; if ( skb == NULL ) goto out ; if ( pkt_sk ( sk ) -> has_vnet_hdr ) { struct virtio_net_hdr vnet_hdr = { 0 } ; err = - EINVAL ; vnet_hdr_len = sizeof ( vnet_hdr ) ; if ( len < vnet_hdr_len ) goto out_free ; len -= vnet_hdr_len ; if ( skb_is_gso ( skb ) ) { struct skb_shared_info * sinfo = skb_shinfo ( skb ) ; vnet_hdr. hdr_len = skb_headlen ( skb ) ; vnet_hdr. gso_size = sinfo -> gso_size ; if ( sinfo -> gso_type & SKB_GSO_TCPV4 ) vnet_hdr. gso_type = VIRTIO_NET_HDR_GSO_TCPV4 ; else if ( sinfo -> gso_type & SKB_GSO_TCPV6 ) vnet_hdr. gso_type = VIRTIO_NET_HDR_GSO_TCPV6 ; else if ( sinfo -> gso_type & SKB_GSO_UDP ) vnet_hdr. gso_type = VIRTIO_NET_HDR_GSO_UDP ; else

Fix:
<S2SV_ModStart> 0 ; } aux. tp_padding = 0 ;
Buggy code:
 static int compile_bag_node ( BagNode * node, regex_t * reg, ScanEnv * env ) { int r, len ; switch ( node -> type ) { case BAG_MEMORY : r = compile_bag_memory_node ( node, reg, env ) ; break ; case BAG_OPTION : r = compile_option_node ( node, reg, env ) ; break ; case BAG_STOP_BACKTRACK : if ( NODE_IS_STOP_BT_SIMPLE_REPEAT ( node ) ) { QuantNode * qn = QUANT_ ( NODE_BAG_BODY ( node ) ) ; r = compile_tree_n_times ( NODE_QUANT_BODY ( qn ), qn -> lower, reg, env ) ; if ( r!= 0 ) return r ; len = compile_length_tree ( NODE_QUANT_BODY ( qn ), reg ) ; if ( len < 0 ) return len ; r = add_op ( reg, OP_PUSH ) ; if ( r!= 0 ) return r ; COP ( reg ) -> push. addr = SIZE_INC_OP + len + SIZE_OP_POP_OUT + SIZE_OP_JUMP ; r = compile_tree ( NODE_QUANT_BODY ( qn ), reg, env ) ; if ( r!= 0 ) return r ; r = add_op ( reg, OP_POP_OUT ) ; if ( r!= 0 ) return r ; r = add_op ( reg, OP_JUMP ) ; if ( r!= 0 ) return r ; COP ( reg ) -> jump. addr = - ( ( int ) SIZE_OP_PUSH + len + ( int ) SIZE_OP_POP_OUT ) ; } else { r = add_op ( reg, OP_ATOMIC_START ) ; if ( r!= 0 ) return r ; r = compile_tree ( NODE_BAG_BODY ( node ), reg, env ) ; if ( r!= 0 ) return r ; r = add_op ( reg, OP_ATOMIC_END ) ; } break ; case BAG_IF_ELSE : { <START_BUG> int cond_len, then_len, jump_len ; <END_BUG> Node * cond = NODE_BAG_BODY ( node ) ; Node * Then = node -> te. Then ; Node * Else = node -> te.

Fix:
<S2SV_ModStart>, then_len, else_len, <S2SV_ModStart> then_len + SIZE_OP_ATOMIC_END + <S2SV_ModEnd> SIZE_OP_JUMP ; r <S2SV_ModStart> ) ) { <S2SV_ModEnd> else_len = compile_length_tree <S2SV_ModStart>, reg ) ; if ( else_len < 0 ) return else_len ; } else else_len = 0 <S2SV_ModStart>. addr = SIZE_OP_ATOMIC_END + <S2SV_ModStart> ; r = add_op ( reg, OP_ATOMIC_END ) ; if ( r!= 0 ) return r ; if ( IS_NOT_NULL ( Else ) ) { r =
Buggy code:
 int cdf_read_property_info ( const cdf_stream_t * sst, const cdf_header_t * h, uint32_t offs, cdf_property_info_t * * info, size_t * count, size_t * maxcount ) { const cdf_section_header_t * shp ; cdf_section_header_t sh ; const uint8_t * p, * q, * e ; int16_t s16 ; int32_t s32 ; uint32_t u32 ; int64_t s64 ; uint64_t u64 ; cdf_timestamp_t tp ; size_t i, o, o4, nelements, j ; cdf_property_info_t * inp ; if ( offs > UINT32_MAX // 4 ) { errno = EFTYPE ; goto out ; } shp = CAST ( const cdf_section_header_t *, ( const void * ) ( ( const char * ) sst -> sst_tab + offs ) ) ; if ( cdf_check_stream_offset ( sst, h, shp, sizeof ( * shp ), __LINE__ ) == - 1 ) goto out ; sh. sh_len = CDF_TOLE4 ( shp -> sh_len ) ; # define CDF_SHLEN_LIMIT ( UINT32_MAX // 8 ) if ( sh. sh_len > CDF_SHLEN_LIMIT ) { errno = EFTYPE ; goto out ; } sh. sh_properties = CDF_TOLE4 ( shp -> sh_properties ) ; # define CDF_PROP_LIMIT ( UINT32_MAX // ( 4 * sizeof ( * inp ) ) ) if ( sh. sh_properties > CDF_PROP_LIMIT ) goto out ; DPRINTF ( ( "section   len:   %u   properties   %u\\n", sh. sh_len, sh. sh_properties ) ) ; if ( * maxcount ) { if ( * maxcount > CDF_PROP_LIMIT ) goto out ; * maxcount += sh. sh_properties ; inp = CAST ( cdf_property_info_t *, realloc ( * info, * maxcount * sizeof ( * inp ) ) ) ; } else { * maxcount = sh. sh_properties ; inp = CAST ( cdf_property_info_t *, malloc ( * maxcount *

Fix:
<S2SV_ModStart> ++ ) { size_t ofs = CDF_GETUINT32 ( p, ( i << 1 ) + 1 ) ; <S2SV_ModStart> ) p + ofs <S2SV_ModEnd> - 2 * <S2SV_ModStart> sizeof ( uint32_t ) <S2SV_ModStart> SIZE_T_FORMAT "u) <S2SV_blank> id=%x <S2SV_blank> type=%x <S2SV_blank> offs=0x%tx,0x%x\\n", i, <S2SV_ModEnd> inp [ i <S2SV_ModStart> - p, offs <S2SV_ModEnd> ) ) ;