nus-yam/ex-repair huggingface dataset:
Buggy code:
 error_t httpReadRequestHeader ( HttpConnection * connection ) { error_t error ; size_t length ; error = socketSetTimeout ( connection -> socket, HTTP_SERVER_IDLE_TIMEOUT ) ; if ( error ) return error ; error = httpReceive ( connection, connection -> buffer, HTTP_SERVER_BUFFER_SIZE - 1, & length, SOCKET_FLAG_BREAK_CRLF ) ; if ( error ) return error ; error = socketSetTimeout ( connection -> socket, HTTP_SERVER_TIMEOUT ) ; if ( error ) return error ; connection -> buffer [ length ] = '\\0' ; TRACE_INFO ( "%s", connection -> buffer ) ; error = httpParseRequestLine ( connection, connection -> buffer ) ; if ( error ) return error ; connection -> request. chunkedEncoding = FALSE ; connection -> request. contentLength = 0 ; # if ( HTTP_SERVER_WEB_SOCKET_SUPPORT == ENABLED ) connection -> request. upgradeWebSocket = FALSE ; connection -> request. connectionUpgrade = FALSE ; osStrcpy ( connection -> request. clientKey, "" ) ; # endif if ( connection -> request. version >= HTTP_VERSION_1_0 ) { char_t firstChar ; char_t * separator ; char_t * name ; char_t * value ; firstChar = '\\0' ; while ( 1 ) { error = httpReadHeaderField ( connection, connection -> buffer, HTTP_SERVER_BUFFER_SIZE, & firstChar ) ; if ( error ) return error ; TRACE_DEBUG ( "%s", connection -> buffer ) ; if (! osStrcmp ( connection -> buffer, "\\r\\n" ) ) break ; <START_BUG> separator = strchr ( connection -> buffer, ':' ) ; <END_BUG> if ( separator!= NULL ) { * separator = '\\0' ; name = strTrimWhitespace ( connection -> buffer ) ; value = strTrimWhitespace ( separator + 1 ) ; httpParseHeaderField ( connection, name, value ) ; } } } if ( connection -> request. chunkedEncoding ) { connection -> request. byteCount = 0 ; connection -> request. firstChunk = TRUE ; connection -> request. lastChunk = FALSE ; } else { connection -> request. byteCount = connection -> request. contentLength ; } return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( connection ->
Buggy code:
 int lookup ( struct sip_msg * _m, char * _t, char * _f, char * _s ) { unsigned int flags ; urecord_t * r ; str aor, uri ; ucontact_t * ptr, * it ; int res ; int ret ; str path_dst ; str flags_s ; pv_value_t val ; int_str istr ; str sip_instance = { 0, 0 }, call_id = { 0, 0 } ; flags = 0 ; if ( _f && _f [ 0 ]!= 0 ) { if ( fixup_get_svalue ( _m, ( gparam_p ) _f, & flags_s )!= 0 ) { LM_ERR ( "invalid   owner   uri   parameter" ) ; return - 1 ; } for ( res = 0 ; res < flags_s. len ; res ++ ) { switch ( flags_s. s [ res ] ) { case'm' : flags |= REG_LOOKUP_METHODFILTER_FLAG ; break ; case 'b' : flags |= REG_LOOKUP_NOBRANCH_FLAG ; break ; default : LM_WARN ( "unsuported   flag   %c   \\n", flags_s. s [ res ] ) ; } } } if ( _s ) { if ( pv_get_spec_value ( _m, ( pv_spec_p ) _s, & val )!= 0 ) { LM_ERR ( "failed   to   get   PV   value\\n" ) ; return - 1 ; } if ( ( val. flags & PV_VAL_STR ) == 0 ) { LM_ERR ( "PV   vals   is   not   string\\n" ) ; return - 1 ; } uri = val. rs ; } else { if ( _m -> new_uri. s ) uri = _m -> new_uri ; else uri = _m -> first_line. u. request. uri ; } if ( extract_aor ( & uri, & aor, & sip_instance, & call_id ) < 0 ) { LM_ERR ( "failed   to   extract   address   of   record\\n" ) ; return - 3 ; } get_act_time ( ) ; ul. lock_udomain ( ( udomain_t * ) _t

Fix:
<S2SV_ModStart> ; } } it = it -> next ;
Buggy code:
 void avcodec_align_dimensions2 ( AVCodecContext * s, int * width, int * height, int linesize_align [ AV_NUM_DATA_POINTERS ] ) { int i ; int w_align = 1 ; int h_align = 1 ; AVPixFmtDescriptor const * desc = av_pix_fmt_desc_get ( s -> pix_fmt ) ; if ( desc ) { w_align = 1 << desc -> log2_chroma_w ; h_align = 1 << desc -> log2_chroma_h ; } switch ( s -> pix_fmt ) { case AV_PIX_FMT_YUV420P : case AV_PIX_FMT_YUYV422 : case AV_PIX_FMT_YVYU422 : case AV_PIX_FMT_UYVY422 : case AV_PIX_FMT_YUV422P : case AV_PIX_FMT_YUV440P : case AV_PIX_FMT_YUV444P : case AV_PIX_FMT_GBRP : case AV_PIX_FMT_GBRAP : case AV_PIX_FMT_GRAY8 : case AV_PIX_FMT_GRAY16BE : case AV_PIX_FMT_GRAY16LE : case AV_PIX_FMT_YUVJ420P : case AV_PIX_FMT_YUVJ422P : case AV_PIX_FMT_YUVJ440P : case AV_PIX_FMT_YUVJ444P : case AV_PIX_FMT_YUVA420P : case AV_PIX_FMT_YUVA422P : case AV_PIX_FMT_YUVA444P : case AV_PIX_FMT_YUV420P9LE : case AV_PIX_FMT_YUV420P9BE : case AV_PIX_FMT_YUV420P10LE : case AV_PIX_FMT_YUV420P10BE : case AV_PIX_FMT_YUV420P12LE : case AV_PIX_FMT_YUV420P12BE : case AV_PIX_FMT_YUV4

Fix:
<S2SV_ModStart> 4 ; } if ( s -> codec_id == AV_CODEC_ID_INTERPLAY_VIDEO ) { w_align = 8 ; h_align = 8 ; } <S2SV_ModStart> codec_id == AV_CODEC_ID_JV || s -> codec_id == AV_CODEC_ID_INTERPLAY_VIDEO
Buggy code:
 bool semaphore_try_wait ( semaphore_t * semaphore ) { assert ( semaphore!= NULL ) ; assert ( semaphore -> fd!= INVALID_FD ) ; <START_BUG> int flags = fcntl ( semaphore -> fd, F_GETFL ) ; <END_BUG> if ( flags == - 1 ) { LOG_ERROR ( "%s   unable   to   get   flags   for   semaphore   fd:   %s", __func__, strerror ( errno ) ) ; return false ; }  if ( fcntl ( semaphore -> fd, F_SETFL, flags | O_NONBLOCK ) == - 1 ) { <START_BUG> LOG_ERROR ( "%s   unable   to   set   O_NONBLOCK   for   semaphore   fd:   %s", __func__, strerror ( errno ) ) ; return false ; } eventfd_t value ; if ( eventfd_read ( semaphore -> fd, & value ) == - 1 ) return false ; <END_BUG> if ( fcntl ( semaphore -> fd, F_SETFL, flags ) == - 1 )  LOG_ERROR ( "%s   unable   to   resetore   flags   for   semaphore   fd:   %s", __func__, strerror ( errno ) ) ; return true ; }

Fix:
<S2SV_ModStart> int flags = TEMP_FAILURE_RETRY ( <S2SV_ModStart> fd, F_GETFL ) <S2SV_ModStart> } if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> flags | O_NONBLOCK ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> F_SETFL, flags )
Buggy code:
 static struct block_device * ext3_blkdev_get ( dev_t dev, struct super_block * sb ) { struct block_device * bdev ; char b [ BDEVNAME_SIZE ] ; bdev = blkdev_get_by_dev ( dev, FMODE_READ | FMODE_WRITE | FMODE_EXCL, sb ) ; if ( IS_ERR ( bdev ) ) goto fail ; return bdev ; fail : <START_BUG> ext3_msg ( sb, "error:   failed   to   open   journal   device   %s:   %ld", <END_BUG> __bdevname ( dev, b ), PTR_ERR ( bdev ) ) ; return NULL ; }

Fix:
<S2SV_ModStart> ( sb, KERN_ERR,
Buggy code:
 static int start_decoder ( vorb * f ) { uint8 header [ 6 ], x, y ; int len, i, j, k, max_submaps = 0 ; int longest_floorlist = 0 ; if (! start_page ( f ) ) return FALSE ; if (! ( f -> page_flag & PAGEFLAG_first_page ) ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> page_flag & PAGEFLAG_last_page ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> page_flag & PAGEFLAG_continued_packet ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> segment_count!= 1 ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> segments [ 0 ]!= 30 ) { if ( f -> segments [ 0 ] == 64 && getn ( f, header, 6 ) && header [ 0 ] == 'f' && header [ 1 ] == 'i' && header [ 2 ] =='s' && header [ 3 ] == 'h' && header [ 4 ] == 'e' && header [ 5 ] == 'a' && get8 ( f ) == 'd' && get8 ( f ) == '\\0' ) return error ( f, VORBIS_ogg_skeleton_not_supported ) ; else return error ( f, VORBIS_invalid_first_page ) ; } if ( get8 ( f )!= VORBIS_packet_id ) return error ( f, VORBIS_invalid_first_page ) ; if (! getn ( f, header, 6 ) ) return error ( f, VORBIS_unexpected_eof ) ; if (! vorbis_validate ( header ) ) return error ( f, VORBIS_invalid_first_page ) ; if ( get32 ( f )!= 0 ) return error ( f, VORBIS_invalid_first_page ) ; f -> channels = get8 ( f ) ; if (! f -> channels ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> channels > STB_VORBIS_MAX_CHANNELS

Fix:
<S2SV_ModStart> ; if ( current_length >= 32 ) return error ( f, VORBIS_invalid_setup ) ; if ( <S2SV_ModStart> 1 ) { int values = lookup1_values ( c -> entries, c -> dimensions ) ; if ( values < 0 ) return error ( f, VORBIS_invalid_setup ) ; <S2SV_ModStart> -> lookup_values = ( uint32 ) values <S2SV_ModEnd> ; } else <S2SV_ModStart> g -> values - 1 ; ++ j ) if ( p [ j ]. x == p [ j + 1 ]. x ) return error ( f, VORBIS_invalid_setup ) ; for ( j = 0 ; j < g -> values <S2SV_ModStart> ) + 1 ; if ( m -> coupling_steps > f -> channels ) return error ( f, VORBIS_invalid_setup )
Buggy code:
 hsm_com_errno_t unix_client_connect ( hsm_com_client_hdl_t * hdl ) { int fd, len ; struct sockaddr_un unix_addr ; <START_BUG> if ( ( fd = socket ( AF_UNIX, SOCK_STREAM, 0 ) ) < 0 ) <END_BUG> { return HSM_COM_ERROR ; } memset ( & unix_addr, 0, sizeof ( unix_addr ) ) ; unix_addr. sun_family = AF_UNIX ; if ( strlen ( hdl -> c_path ) >= sizeof ( unix_addr. sun_path ) ) {  close ( fd ) ; <START_BUG> return HSM_COM_PATH_ERR ; } snprintf ( unix_addr. sun_path, sizeof ( unix_addr. sun_path ), "%s", hdl -> c_path ) ; len = SUN_LEN ( & unix_addr ) ; unlink ( unix_addr. sun_path ) ; if ( bind ( fd, ( struct sockaddr * ) & unix_addr, len ) < 0 ) { <END_BUG> unlink ( hdl -> c_path ) ;  close ( fd ) ; return HSM_COM_BIND_ERR ; } if ( chmod ( unix_addr. sun_path, S_IRWXU ) < 0 ) { <START_BUG> unlink ( hdl -> c_path ) ; <END_BUG> close ( fd ) ; return HSM_COM_CHMOD_ERR ; } memset ( & unix_addr, 0, sizeof ( unix_addr ) ) ; unix_addr. sun_family = AF_UNIX ; strncpy ( unix_addr. sun_path, hdl -> s_path, sizeof ( unix_addr. sun_path ) ) ; unix_addr. sun_path [ sizeof ( unix_addr. sun_path ) - 1 ] = 0 ; len = SUN_LEN ( & unix_addr ) ; if ( connect ( fd, ( struct sockaddr * ) & unix_addr, len ) < 0 ) {  unlink ( hdl -> c_path ) ; <START_BUG> close ( fd ) ; return HSM_COM_CONX_ERR ; } hdl -> client_fd = fd ; hdl -> client_state = HSM_COM_C_STATE_CT ; if ( unix_sck_send_conn ( h<END_BUG>

Fix:
<S2SV_ModStart> sockaddr_un unix_addr ; hsm_com_errno_t res = HSM_COM_OK ; <S2SV_ModStart> ) ) { res = HSM_COM_PATH_ERR ; goto cleanup <S2SV_ModEnd> ; } snprintf <S2SV_ModStart> 0 ) { res = HSM_COM_BIND_ERR ; goto cleanup ; <S2SV_ModEnd> } if ( <S2SV_ModStart> 0 ) { res = HSM_COM_CHMOD_ERR ; goto cleanup <S2SV_ModEnd> ; } memset <S2SV_ModStart> 0 ) { res = HSM_COM_CONX_ERR ; goto cleanup <S2SV_ModEnd> ; } hdl <S2SV_ModStart> = HSM_COM_C_STATE_IN ; res = HSM_COM_SEND_ERR ; } return res ; cleanup : close ( fd ) ; return res <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static OPJ_BOOL opj_j2k_write_sot ( opj_j2k_t * p_j2k, OPJ_BYTE * p_data, OPJ_UINT32 p_total_data_size, OPJ_UINT32 * p_data_written, const opj_stream_private_t * p_stream, opj_event_mgr_t * p_manager ) { assert ( p_j2k!= 00 ) ; assert ( p_manager!= 00 ) ; assert ( p_stream!= 00 ) ; OPJ_UNUSED ( p_stream ) ; <START_BUG> OPJ_UNUSED ( p_manager ) ; <END_BUG> if ( p_total_data_size < 12 ) { opj_event_msg ( p_manager, EVT_ERROR, "Not   enough   bytes   in   output   buffer   to   write   SOT   marker\\n" ) ; return OPJ_FALSE ; } opj_write_bytes ( p_data, J2K_MS_SOT, 2 ) ; p_data += 2 ; opj_write_bytes ( p_data, 10, 2 ) ; p_data += 2 ; opj_write_bytes ( p_data, p_j2k -> m_current_tile_number, 2 ) ; p_data += 2 ; p_data += 4 ; opj_write_bytes ( p_data, p_j2k -> m_specific_param. m_encoder. m_current_tile_part_number, 1 ) ; ++ p_data ; opj_write_bytes ( p_data, p_j2k -> m_cp. tcps [ p_j2k -> m_current_tile_number ]. m_nb_tile_parts, 1 ) ; ++ p_data ; # ifdef USE_JPWL assert ( 0 && "TODO" ) ; # endif * p_data_written = 12 ; return OPJ_TRUE ; }

Fix:
<S2SV_ModStart> p_stream ) ; <S2SV_ModEnd> if ( p_total_data_size
Buggy code:
 static int do_devinfo_ioctl ( struct comedi_device * dev, struct comedi_devinfo __user * arg, struct file * file ) { struct comedi_devinfo devinfo ; const unsigned minor = iminor ( file -> f_dentry -> d_inode ) ; struct comedi_device_file_info * dev_file_info = comedi_get_device_file_info ( minor ) ; struct comedi_subdevice * read_subdev = comedi_get_read_subdevice ( dev_file_info ) ; struct comedi_subdevice * write_subdev = comedi_get_write_subdevice ( dev_file_info ) ; memset ( & devinfo, 0, sizeof ( devinfo ) ) ; devinfo. version_code = COMEDI_VERSION_CODE ; devinfo. n_subdevs = dev -> n_subdevices ; <START_BUG> memcpy ( devinfo. driver_name, dev -> driver -> driver_name, COMEDI_NAMELEN ) ; <END_BUG>  memcpy ( devinfo. board_name, dev -> board_name, COMEDI_NAMELEN ) ; <START_BUG> if ( read_subdev ) devinfo. read_subdevice = read_subdev - dev -> subdevices ; else devinfo. read_subdevice = - 1 ; if ( write_subdev ) devinfo. write_subdevice = write_subdev - dev -> subdevices ; else devinfo. write_subdevice = - 1 ; if ( copy_to_user ( arg, & devinfo, sizeof ( struct comedi_devinfo ) ) ) return - EFAULT ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> n_subdevices ; strlcpy <S2SV_ModEnd> ( devinfo. <S2SV_ModStart> COMEDI_NAMELEN ) ; strlcpy <S2SV_ModEnd> ( devinfo.
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; one = 1 ; image = AcquireImage ( image_info ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = Destroy

Fix:
<S2SV_ModStart> -> rows = 1 <S2SV_ModEnd> ; image -> <S2SV_ModStart> ( BImgBuff ) <S2SV_ModEnd> ; break ;
Buggy code:
 static int choose_filters ( struct archive_read * a ) { <START_BUG> int number_bidders, i, bid, best_bid ; <END_BUG> struct archive_read_filter_bidder * bidder, * best_bidder ; struct archive_read_filter * filter ; ssize_t avail ; int r ;  for ( ; ; ) { <START_BUG> number_bidders = sizeof ( a -> bidders ) // sizeof ( a -> bidders [ 0 ] ) ; best_bid = 0 ; best_bidder = NULL ; bidder = a -> bidders ; for ( i = 0 ; i < number_bidders ; i ++, bidder ++ ) { if ( bidder -> bid!= NULL ) { bid = ( bidder -> bid ) ( bidder, a -> filter ) ; if ( bid > best_bid ) { best_bid = bid ; best_bidder = bidder ; } } } if ( best_bidder == NULL ) { __archive_read_filter_ahead ( a -> filter, 1, & avail ) ; if ( avail < 0 ) { __archive_read_close_filters ( a ) ; __archive_read_free_filters ( a ) ; return ( ARCHIVE_FATAL ) ; } a -> archive. compression_name = a -> filter -> name ; a -> archive. compression_code = a -> filter -> code ; return ( ARCHIVE_OK ) ; } filter = ( struct archive_read_filter * ) calloc ( 1, sizeof ( * filter ) ) ; if ( filter == NULL ) return ( ARCHIVE_FATAL ) ; filter -> bidder = best_bidder ; filter -> archive = a ; filter -> upstream = a -> filter ; a -> filter = filter ; r = ( best_bidder -> init ) ( a -> filter ) ; if ( r!= ARCHIVE_OK ) { __archive_read_close_filters ( a ) ; __archive_read_free_filters ( a ) ; return ( ARCHIVE_FATAL ) ; } } <END_BUG> } 

Fix:
<S2SV_ModStart> bid, best_bid, n <S2SV_ModStart> ; for ( n = 0 ; n < 25 ; ++ n <S2SV_ModEnd> ) { number_bidders <S2SV_ModStart> ; } } archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Input <S2SV_blank> requires <S2SV_blank> too <S2SV_blank> many <S2SV_blank> filters <S2SV_blank> for <S2SV_blank> decoding" ) ; return ( ARCHIVE_FATAL ) ;
Buggy code:
 static inline long object_common1 ( UNSERIALIZE_PARAMETER, zend_class_entry * ce ) { <START_BUG> long elements ; <END_BUG> elements = parse_iv2 ( ( * p ) + 2, p ) ; ( * p ) += 2 ; if ( ce -> serialize == NULL ) { object_init_ex ( * rval, ce ) ; } else { zend_error ( E_WARNING, "Erroneous   data   format   for   unserializing   \'%s\'", ce -> name ) ;  return 0 ; <START_BUG> } return elements ; }<END_BUG>

Fix:
<S2SV_ModStart> long elements ; if ( * p >= max - 2 ) { zend_error ( E_WARNING, "Bad <S2SV_blank> unserialize <S2SV_blank> data" ) ; return - 1 ; } <S2SV_ModStart> ) ; return - 1 <S2SV_ModEnd> ; } return
Buggy code:
 static void perf_log_throttle ( struct perf_event * event, int enable ) { struct perf_output_handle handle ; struct perf_sample_data sample ; int ret ; struct { struct perf_event_header header ; u64 time ; u64 id ; u64 stream_id ; } throttle_event = {. header = {. type = PERF_RECORD_THROTTLE,. misc = 0,. size = sizeof ( throttle_event ), },. time = perf_clock ( ),. id = primary_event_id ( event ),. stream_id = event -> id, } ; if ( enable ) throttle_event. header. type = PERF_RECORD_UNTHROTTLE ; perf_event_header__init_id ( & throttle_event. header, & sample, event ) ; ret = perf_output_begin ( & handle, event, <START_BUG> throttle_event. header. size, 1, 0 ) ; <END_BUG> if ( ret ) return ; perf_output_put ( & handle, throttle_event ) ; perf_event__output_id_sample ( event, & handle, & sample ) ; perf_output_end ( & handle ) ; }

Fix:
<S2SV_ModStart>. size, <S2SV_ModEnd> 0 ) ;
Buggy code:
 <START_BUG> static void update_coef_probs ( VP9_COMP * cpi, vp9_writer * w ) { <END_BUG> const TX_MODE tx_mode = cpi -> common. tx_mode ; const TX_SIZE max_tx_size = tx_mode_to_biggest_tx_size [ tx_mode ] ; TX_SIZE tx_size ;  vp9_coeff_stats frame_branch_ct [ TX_SIZES ] [ PLANE_TYPES ] ; <START_BUG> vp9_clear_system_state ( ) ; for ( tx_size = TX_4X4 ; tx_size <= TX_32X32 ; ++ tx_size ) build_tree_distribution ( cpi, tx_size, frame_branch_ct [ tx_size ] ) ; <END_BUG> for ( tx_size = TX_4X4 ; tx_size <= max_tx_size ; ++ tx_size )  <START_BUG> update_coef_probs_common ( w, cpi, tx_size, frame_branch_ct [ tx_size ] ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> * cpi, vpx_writer <S2SV_ModEnd> * w ) <S2SV_ModStart> TX_SIZE tx_size ; <S2SV_ModEnd> for ( tx_size <S2SV_ModStart> ++ tx_size ) { vp9_coeff_stats frame_branch_ct [ PLANE_TYPES ] ; vp9_coeff_probs_model frame_coef_probs [ PLANE_TYPES ] ; if ( cpi -> td. counts -> tx. tx_totals [ tx_size ] <= 20 || ( tx_size >= TX_16X16 && cpi -> sf. tx_size_search_method == USE_TX_8X8 ) ) { vpx_write_bit ( w, 0 ) ; } else { build_tree_distribution ( cpi, tx_size, frame_branch_ct, frame_coef_probs ) ; <S2SV_ModStart> tx_size, frame_branch_ct, frame_coef_probs <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } } }
Buggy code:
 xfs_failaddr_t xfs_dinode_verify ( struct xfs_mount * mp, xfs_ino_t ino, struct xfs_dinode * dip ) { xfs_failaddr_t fa ; uint16_t mode ; uint16_t flags ; uint64_t flags2 ; uint64_t di_size ; if ( dip -> di_magic!= cpu_to_be16 ( XFS_DINODE_MAGIC ) ) return __this_address ; if ( dip -> di_version >= 3 ) { if (! xfs_sb_version_hascrc ( & mp -> m_sb ) ) return __this_address ; if (! xfs_verify_cksum ( ( char * ) dip, mp -> m_sb. sb_inodesize, XFS_DINODE_CRC_OFF ) ) return __this_address ; if ( be64_to_cpu ( dip -> di_ino )!= ino ) return __this_address ; if (! uuid_equal ( & dip -> di_uuid, & mp -> m_sb. sb_meta_uuid ) ) return __this_address ; } di_size = be64_to_cpu ( dip -> di_size ) ; if ( di_size & ( 1ULL << 63 ) ) return __this_address ; mode = be16_to_cpu ( dip -> di_mode ) ; if ( mode && xfs_mode_to_ftype ( mode ) == XFS_DIR3_FT_UNKNOWN ) return __this_address ; if ( ( S_ISLNK ( mode ) || S_ISDIR ( mode ) ) && di_size == 0 ) return __this_address ; if ( mode && be32_to_cpu ( dip -> di_nextents ) + be16_to_cpu ( dip -> di_anextents ) > be64_to_cpu ( dip -> di_nblocks ) ) return __this_address ; if ( mode && XFS_DFORK_BOFF ( dip ) > mp -> m_sb. sb_inodesize ) return __this_address ; flags = be16_to_cpu ( dip -> di_flags ) ; if ( mode && ( flags & XFS_DIFLAG_REALTIME ) &&! mp -> m_

Fix:
<S2SV_ModStart> case S_IFDIR : fa = xfs_dinode_verify_fork ( dip, mp, XFS_DATA_FORK ) ; if ( fa ) return fa ; break ; case 0 : break ; default : return __this_address ; } if ( XFS_DFORK_Q ( dip ) ) { fa = xfs_dinode_verify_fork ( dip, mp, XFS_ATTR_FORK ) ; if ( fa ) return fa ; <S2SV_ModEnd> } else {
Buggy code:
 static reactor_status_t run_reactor ( reactor_t * reactor, int iterations ) { assert ( reactor!= NULL ) ; reactor -> run_thread = pthread_self ( ) ; reactor -> is_running = true ; struct epoll_event events [ MAX_EVENTS ] ; for ( int i = 0 ; iterations == 0 || i < iterations ; ++ i ) { pthread_mutex_lock ( & reactor -> list_lock ) ; list_clear ( reactor -> invalidation_list ) ; pthread_mutex_unlock ( & reactor -> list_lock ) ; int ret ; do { <START_BUG> ret = epoll_wait ( reactor -> epoll_fd, events, MAX_EVENTS, - 1 ) ; <END_BUG> } while ( ret == - 1 && errno == EINTR ) ; if ( ret == - 1 ) { LOG_ERROR ( "%s   error   in   epoll_wait:   %s", __func__, strerror ( errno ) ) ; reactor -> is_running = false ; return REACTOR_STATUS_ERROR ; } for ( int j = 0 ; j < ret ; ++ j ) { if ( events [ j ]. data. ptr == NULL ) { eventfd_t value ; eventfd_read ( reactor -> event_fd, & value ) ; reactor -> is_running = false ; return REACTOR_STATUS_STOP ; } reactor_object_t * object = ( reactor_object_t * ) events [ j ]. data. ptr ; pthread_mutex_lock ( & reactor -> list_lock ) ; if ( list_contains ( reactor -> invalidation_list, object ) ) { pthread_mutex_unlock ( & reactor -> list_lock ) ; continue ; } pthread_mutex_lock ( & object -> lock ) ; pthread_mutex_unlock ( & reactor -> list_lock ) ; reactor -> object_removed = false ; if ( events [ j ]. events & ( EPOLLIN | EPOLLHUP | EPOLLRDHUP | EPOLLERR ) && object -> read_ready ) object -> read_ready ( object -> context ) ; if (! reactor -> object_removed && events [ j ]. events & EPOLLOUT && object -> write_ready ) object -> write_ready ( object -> context ) ; pthread_mutex_unlock ( & object -> lock ) ; if (

Fix:
<S2SV_ModStart> { ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, - 1 )
Buggy code:
 void btsock_l2cap_signaled ( int fd, int flags, uint32_t user_id ) { l2cap_socket * sock ; char drop_it = FALSE ; pthread_mutex_lock ( & state_lock ) ; sock = btsock_l2cap_find_by_id_l ( user_id ) ; if ( sock ) { if ( ( flags & SOCK_THREAD_FD_RD ) &&! sock -> server ) { if ( sock -> connected ) { int size = 0 ; <START_BUG> if (! ( flags & SOCK_THREAD_FD_EXCEPTION ) || ( ioctl ( sock -> our_fd, FIONREAD, & size ) <END_BUG> == 0 && size ) ) { uint8_t * buffer = osi_malloc ( L2CAP_MAX_SDU_LENGTH ) ; if ( buffer!= NULL ) {  int count = recv ( fd, buffer, L2CAP_MAX_SDU_LENGTH, <START_BUG> <END_BUG> MSG_NOSIGNAL | MSG_DONTWAIT ) ;  APPL_TRACE_DEBUG ( "btsock_l2cap_signaled   -   %d   bytes   received   from   socket", count ) ; if ( sock -> fixed_chan ) { if ( BTA_JvL2capWriteFixed ( sock -> channel, ( BD_ADDR * ) & sock -> addr, ( UINT32 ) buffer, btsock_l2cap_cbk, buffer, count, ( void * ) user_id )!= BTA_JV_SUCCESS ) { on_l2cap_write_fixed_done ( buffer, user_id ) ; } } else { if ( BTA_JvL2capWrite ( sock -> handle, ( UINT32 ) buffer, buffer, count, ( void * ) user_id )!= BTA_JV_SUCCESS ) { on_l2cap_write_done ( buffer, user_id ) ; } } } else { APPL_TRACE_ERROR ( "Unable   to   allocate   memory   for   data   packet   from   JAVA..." ) } } } else drop_it = TRUE ; } if ( flags & SOCK_THREAD_FD_WR ) { if ( flush_incoming_que_on_wr_signal_l ( sock ) && sock -> connected ) btsock_thread_add

Fix:
<S2SV_ModStart> ) || ( TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & size ) <S2SV_ModStart> int count = TEMP_FAILURE_RETRY ( <S2SV_ModStart> | MSG_DONTWAIT ) ) <S2SV_ModStart> ( drop_it || TEMP_FAILURE_RETRY ( <S2SV_ModStart> & size ) )
Buggy code:
 char * * <START_BUG> prepenv ( const struct rule * rule ) <END_BUG> { static const char * safeset [ ] = { "DISPLAY", "HOME", "LOGNAME", "MAIL", "PATH", "TERM", "USER", "USERNAME", NULL } ; struct env * env ;  env = createenv ( rule ) ; <START_BUG> if (! ( rule -> options & KEEPENV ) ) fillenv ( env, safeset ) ; if ( rule -> envlist ) fillenv ( env, rule -> envlist ) ; return flattenenv ( env ) ; }<END_BUG>

Fix:
<S2SV_ModStart> rule * rule, const struct passwd * mypw, const struct passwd * targpw ) { <S2SV_ModEnd> struct env * <S2SV_ModStart> createenv ( rule, mypw, targpw <S2SV_ModEnd> ) ; if
Buggy code:
 void init_xml_relax_ng ( ) { VALUE nokogiri = rb_define_module ( "Nokogiri" ) ; VALUE xml = rb_define_module_under ( nokogiri, "XML" ) ; VALUE klass = rb_define_class_under ( xml, "RelaxNG", cNokogiriXmlSchema ) ; cNokogiriXmlRelaxNG = klass ; <START_BUG> rb_define_singleton_method ( klass, "read_memory", read_memory, 1 ) ; <END_BUG>  rb_define_singleton_method ( klass, "from_document", from_document, 1 ) ; <START_BUG> rb_define_private_method ( klass, "validate_document", validate_document, 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, read_memory, - <S2SV_ModStart>, from_document, -
Buggy code:
 <START_BUG> void set_header ( HttpResponse res, const char * name, const char * value ) { <END_BUG> HttpHeader h = NULL ; ASSERT ( res ) ; ASSERT ( name ) ; NEW ( h ) ; h -> name = Str_dup ( name ) ;  h -> value = Str_dup ( value ) ; <START_BUG> if ( res -> headers ) { HttpHeader n, p ; for ( n = p = res -> headers ; p ; n = p, p = p -> next ) { if ( IS ( p -> name, name ) ) { FREE ( p -> value ) ; p -> value = Str_dup ( value ) ; destroy_entry ( h ) ; return ; } } n -> next = h ; } else { res -> headers = h ; } }<END_BUG>

Fix:
<S2SV_ModStart> char * value,... <S2SV_ModStart> name ) ; va_list ap ; va_start ( ap, value ) ; <S2SV_ModStart> -> value = Str_vcat ( value, ap ) ; va_end ( ap <S2SV_ModEnd> ) ; if
Buggy code:
 void * create_directory_config ( apr_pool_t * mp, char * path ) { directory_config * dcfg = ( directory_config * ) apr_pcalloc ( mp, sizeof ( directory_config ) ) ; if ( dcfg == NULL ) return NULL ; # ifdef DEBUG_CONF ap_log_perror ( APLOG_MARK, APLOG_STARTUP | APLOG_NOERRNO, 0, mp, "Created   directory   config   %pp   path   %s", dcfg, path ) ; # endif dcfg -> mp = mp ; dcfg -> is_enabled = NOT_SET ; dcfg -> reqbody_access = NOT_SET ; dcfg -> reqintercept_oe = NOT_SET ; dcfg -> reqbody_buffering = NOT_SET ; dcfg -> reqbody_inmemory_limit = NOT_SET ; dcfg -> reqbody_limit = NOT_SET ; dcfg -> reqbody_no_files_limit = NOT_SET ; dcfg -> resbody_access = NOT_SET ; dcfg -> debuglog_name = NOT_SET_P ; dcfg -> debuglog_level = NOT_SET ; dcfg -> debuglog_fd = NOT_SET_P ; dcfg -> of_limit = NOT_SET ; dcfg -> if_limit_action = NOT_SET ; dcfg -> of_limit_action = NOT_SET ; dcfg -> of_mime_types = NOT_SET_P ; dcfg -> of_mime_types_cleared = NOT_SET ; dcfg -> cookie_format = NOT_SET ; dcfg -> argument_separator = NOT_SET ; dcfg -> cookiev0_separator = NOT_SET_P ; dcfg -> rule_inheritance = NOT_SET ; dcfg -> rule_exceptions = apr_array_make ( mp, 16, sizeof ( rule_exception * ) ) ; dcfg -> hash_method = apr_array_make ( mp, 16, sizeof ( hash_method * ) ) ; dcfg -> auditlog_flag = NOT_SET ; dcfg -> auditlog_type = NOT_SET ; dcfg -> max_rule_time = NOT_SET ; dcfg -> auditlog_dirperms = NOT_SET ; dcfg -> auditlog_fileperms = NOT_SET ;

Fix:
<S2SV_ModStart> = NOT_SET ; dcfg -> xml_external_entity = NOT_SET ;
Buggy code:
 jas_image_t * jp2_decode ( jas_stream_t * in, const char * optstr ) { jp2_box_t * box ; int found ; jas_image_t * image ; jp2_dec_t * dec ; bool samedtype ; int dtype ; unsigned int i ; jp2_cmap_t * cmapd ; jp2_pclr_t * pclrd ; jp2_cdef_t * cdefd ; unsigned int channo ; int newcmptno ; int_fast32_t * lutents ; # if 0 jp2_cdefchan_t * cdefent ; int cmptno ; # endif jp2_cmapent_t * cmapent ; jas_icchdr_t icchdr ; jas_iccprof_t * iccprof ; dec = 0 ; box = 0 ; image = 0 ; JAS_DBGLOG ( 100, ( "jp2_decode(%p,   \\"%s\\")\\n", in, optstr ) ) ; if (! ( dec = jp2_dec_create ( ) ) ) { goto error ; } if (! ( box = jp2_box_get ( in ) ) ) { jas_eprintf ( "error:   cannot   get   box\\n" ) ; goto error ; } if ( box -> type!= JP2_BOX_JP ) { jas_eprintf ( "error:   expecting   signature   box\\n" ) ; goto error ; } if ( box -> data. jp. magic!= JP2_JP_MAGIC ) { jas_eprintf ( "incorrect   magic   number\\n" ) ; goto error ; } jp2_box_destroy ( box ) ; box = 0 ; if (! ( box = jp2_box_get ( in ) ) ) { goto error ; } if ( box -> type!= JP2_BOX_FTYP ) { jas_eprintf ( "expecting   file   type   box\\n" ) ; goto error ; } jp2_box_destroy ( box ) ; box = 0 ; found = 0 ; while ( ( box = jp2_box_get ( in ) ) ) { if ( jas_getdbglevel ( ) >= 1 ) { j

Fix:
<S2SV_ModStart> { jas_eprintf ( "error: <S2SV_blank> number <S2SV_blank> of <S2SV_blank> components <S2SV_blank> mismatch <S2SV_blank> (IHDR)\\n" ) ; goto error <S2SV_ModEnd> ; } if <S2SV_ModStart> { jas_eprintf ( "error: <S2SV_blank> component <S2SV_blank> data <S2SV_blank> type <S2SV_blank> mismatch <S2SV_blank> (IHDR)\\n" ) ; goto error <S2SV_ModEnd> ; } if <S2SV_ModStart>, jas_image_numcmpts ( dec -> image ) ) ) { jas_eprintf ( "error: <S2SV_blank> number <S2SV_blank> of <S2SV_blank> components <S2SV_blank> mismatch <S2SV_blank> (BPCC)\\n" ) ; goto error <S2SV_ModEnd> ; } if <S2SV_ModStart> { jas_eprintf ( "error: <S2SV_blank> component <S2SV_blank> data <S2SV_blank> type <S2SV_blank> mismatch <S2SV_blank> (BPCC)\\n" ) ; goto error <S2SV_ModEnd> ; } }
Buggy code:
 void _modinit ( module_t * m ) { service_named_bind_command ( "chanserv", & cs_flags ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> cs_flags ) ; add_bool_conf_item ( "ANOPE_FLAGS_COMPAT", & chansvs. me -> conf_table, 0, & anope_flags_compat, true ) ; hook_add_event ( "nick_can_register" ) ; hook_add_nick_can_register ( check_registration_keywords ) ; hook_add_event ( "user_can_register" ) ; hook_add_user_can_register ( check_registration_keywords ) ;
Buggy code:
 static int calc_active_worst_quality_one_pass_cbr ( const VP9_COMP * cpi ) { const VP9_COMMON * const cm = & cpi -> common ; <START_BUG> const VP9_CONFIG * oxcf = & cpi -> oxcf ; <END_BUG> const RATE_CONTROL * rc = & cpi -> rc ;  int64_t critical_level = oxcf -> optimal_buffer_level >> 2 ; <START_BUG> int64_t buff_lvl_step = 0 ; int adjustment = 0 ; <END_BUG> int active_worst_quality ;  if ( cm -> frame_type == KEY_FRAME ) return rc -> worst_quality ; <START_BUG> if ( cm -> current_video_frame > 1 ) <END_BUG> active_worst_quality = MIN ( rc -> worst_quality,  rc -> avg_frame_qindex [ INTER_FRAME ] * 5 // 4 ) ; <START_BUG> else active_worst_quality = MIN ( rc -> worst_quality, <END_BUG> rc -> avg_frame_qindex [ KEY_FRAME ] * 3 // 2 ) ;  if ( rc -> buffer_level > oxcf -> optimal_buffer_level ) { int max_adjustment_down = active_worst_quality // 3 ; if ( max_adjustment_down ) { buff_lvl_step = ( ( oxcf -> maximum_buffer_size - oxcf -> optimal_buffer_level ) // max_adjustment_down ) ; if ( buff_lvl_step ) adjustment = ( int ) ( ( rc -> buffer_level - oxcf -> optimal_buffer_level ) // buff_lvl_step ) ; active_worst_quality -= adjustment ; } } else if ( rc -> buffer_level > critical_level ) { if ( critical_level ) { buff_lvl_step = ( oxcf -> optimal_buffer_level - critical_level ) ; if ( buff_lvl_step ) { adjustment = <START_BUG> ( int ) ( ( rc -> worst_quality - rc -> avg_frame_qindex [ INTER_FRAME ] ) * <END_BUG>  ( oxcf -> optimal_buffer_level - rc -> buffer_level ) // <START_BUG> buff_lvl_step ) ; } active_worst_quality = rc -> avg_frame_qindex [ INTER_FRAME ]<END_BUG>

Fix:
<S2SV_ModStart> common ; const RATE_CONTROL * rc <S2SV_ModEnd> = & cpi <S2SV_ModStart> & cpi -> <S2SV_ModEnd> rc ; int64_t <S2SV_ModStart> int64_t critical_level = rc <S2SV_ModEnd> -> optimal_buffer_level >> <S2SV_ModStart> -> optimal_buffer_level >> 3 <S2SV_ModEnd> ; int64_t buff_lvl_step <S2SV_ModStart> ; int active_worst_quality ; int ambient_qp ; unsigned int num_frames_weight_key = 5 * cpi -> svc. number_temporal_layers <S2SV_ModStart> -> worst_quality ; ambient_qp = <S2SV_ModEnd> ( cm -> <S2SV_ModStart> cm -> current_video_frame < num_frames_weight_key )? MIN ( <S2SV_ModEnd> rc -> avg_frame_qindex <S2SV_ModStart> [ INTER_FRAME ] <S2SV_ModEnd>, rc -> <S2SV_ModStart> [ KEY_FRAME ] ) : <S2SV_ModEnd> rc -> avg_frame_qindex <S2SV_ModStart> [ INTER_FRAME ] ; active_worst_quality = MIN ( rc -> worst_quality, ambient_qp * 5 // 4 ) ; if ( <S2SV_ModEnd> rc -> buffer_level <S2SV_ModStart> rc -> buffer_level > rc -> optimal_buffer_level ) { int max_adjustment_down = active_worst_quality // 3 ; if ( max
Buggy code:
 static int ssl_scan_clienthello_tlsext ( SSL * s, PACKET * pkt, int * al ) { unsigned int type ; int renegotiate_seen = 0 ; PACKET extensions ; * al = SSL_AD_DECODE_ERROR ; s -> servername_done = 0 ; s -> tlsext_status_type = - 1 ; # ifndef OPENSSL_NO_NEXTPROTONEG s -> s3 -> next_proto_neg_seen = 0 ; # endif OPENSSL_free ( s -> s3 -> alpn_selected ) ; s -> s3 -> alpn_selected = NULL ; s -> s3 -> alpn_selected_len = 0 ; OPENSSL_free ( s -> s3 -> alpn_proposed ) ; s -> s3 -> alpn_proposed = NULL ; s -> s3 -> alpn_proposed_len = 0 ; # ifndef OPENSSL_NO_HEARTBEATS s -> tlsext_heartbeat &= ~ ( SSL_DTLSEXT_HB_ENABLED | SSL_DTLSEXT_HB_DONT_SEND_REQUESTS ) ; # endif # ifndef OPENSSL_NO_EC if ( s -> options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG ) ssl_check_for_safari ( s, pkt ) ; # endif OPENSSL_free ( s -> s3 -> tmp. peer_sigalgs ) ; s -> s3 -> tmp. peer_sigalgs = NULL ; <START_BUG> s -> s3 -> flags &= ~ TLS1_FLAGS_ENCRYPT_THEN_MAC ; <END_BUG> # ifndef OPENSSL_NO_SRP OPENSSL_free ( s -> srp_ctx. login ) ; s -> srp_ctx. login = NULL ; # endif s -> srtp_profile = NULL ; if ( PACKET_remaining ( pkt ) == 0 ) goto ri_check ; if (! PACKET_as_length_prefixed_2 ( pkt, & extensions ) ) return 0 ; if (! tls1_check_duplicate_extensions ( & extensions ) ) return 0 ; while ( PACKET_get_net_2 ( & extensions, & type ) ) { PACKET extension ; if (! PACKET_get_length_prefixed_2 (

Fix:
<S2SV_ModStart> ; s -> tlsext_use_etm = 0 <S2SV_ModEnd> ; # ifndef <S2SV_ModStart> ) s -> tlsext_use_etm = 1 <S2SV_ModEnd> ; else if
Buggy code:
 int ssl3_write_bytes ( SSL * s, int type, const void * buf_, int len ) { const unsigned char * buf = buf_ ; int tot ; unsigned int n, split_send_fragment, maxpipes ; # if! defined ( OPENSSL_NO_MULTIBLOCK ) && EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK unsigned int max_send_fragment, nw ; unsigned int u_len = ( unsigned int ) len ; # endif SSL3_BUFFER * wb = & s -> rlayer. wbuf [ 0 ] ; int i ; if ( len < 0 ) { SSLerr ( SSL_F_SSL3_WRITE_BYTES, SSL_R_SSL_NEGATIVE_LENGTH ) ; return - 1 ; } s -> rwstate = SSL_NOTHING ; tot = s -> rlayer. wnum ; if ( ( unsigned int ) len < s -> rlayer. wnum ) { SSLerr ( SSL_F_SSL3_WRITE_BYTES, SSL_R_BAD_LENGTH ) ; return - 1 ; } s -> rlayer. wnum = 0 ; if ( SSL_in_init ( s ) &&! ossl_statem_get_in_handshake ( s ) ) { i = s -> handshake_func ( s ) ; if ( i < 0 ) return ( i ) ; if ( i == 0 ) { SSLerr ( SSL_F_SSL3_WRITE_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE ) ; return - 1 ; } } if ( wb -> left!= 0 ) { i = ssl3_write_pending ( s, type, & buf [ tot ], s -> rlayer. wpend_tot ) ; if ( i <= 0 ) { s -> rlayer. wnum = tot ; return i ; } tot += i ; } # if! defined ( OPENSSL_NO_MULTIBLOCK ) && EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK if ( type == SSL3_RT_APPLICATION_DATA && u_len >= 4 * ( max_send_fragment = s -> max_send_fragment ) && s -> compress == NULL && s -> msg_callback == NULL && <START_BUG>! SSL_USE_ETM ( s ) && SSL_USE_EXPLICIT_IV ( s ) && <END_BUG> EVP_CIP

Fix:
<S2SV_ModStart> NULL &&! SSL_WRITE_ETM <S2SV_ModEnd> ( s )
Buggy code:
 static size_t consume_init_expr ( ut8 * buf, ut8 * max, ut8 eoc, void * out, ut32 * offset ) { ut32 i = 0 ; while ( buf + i < max && buf [ i ]!= eoc ) { <START_BUG> i += 1 ; <END_BUG> } if ( buf [ i ]!= eoc ) { return 0 ; } if ( offset ) { * offset += i + 1 ; } return i + 1 ; }

Fix:
<S2SV_ModStart> ) { i ++ <S2SV_ModEnd> ; } if
Buggy code:
 static int read_exceptions ( struct pstore * ps, int ( * callback ) ( void * callback_context, chunk_t old, chunk_t new ), void * callback_context ) { int r, full = 1 ; for ( ps -> current_area = 0 ; full ; ps -> current_area ++ ) { r = area_io ( ps, READ ) ; if ( r ) return r ; r = insert_exceptions ( ps, callback, callback_context, & full ) ; if ( r ) return r ; } ps -> current_area -- ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> current_area -- ; skip_metadata ( ps ) ;
Buggy code:
 void ip6_print ( netdissect_options * ndo, const u_char * bp, u_int length ) { register const struct ip6_hdr * ip6 ; register int advance ; u_int len ; const u_char * ipend ; register const u_char * cp ; register u_int payload_len ; int nh ; int fragmented = 0 ; u_int flow ; ip6 = ( const struct ip6_hdr * ) bp ; ND_TCHECK ( * ip6 ) ; if ( length < sizeof ( struct ip6_hdr ) ) { ND_PRINT ( ( ndo, "truncated-ip6   %u", length ) ) ; return ; } if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "IP6   " ) ) ; if ( IP6_VERSION ( ip6 )!= 6 ) { ND_PRINT ( ( ndo, "version   error:   %u  !=   6", IP6_VERSION ( ip6 ) ) ) ; return ; } payload_len = EXTRACT_16BITS ( & ip6 -> ip6_plen ) ; len = payload_len + sizeof ( struct ip6_hdr ) ; if ( length < len ) ND_PRINT ( ( ndo, "truncated-ip6   -   %u   bytes   missing!", len - length ) ) ; if ( ndo -> ndo_vflag ) { flow = EXTRACT_32BITS ( & ip6 -> ip6_flow ) ; ND_PRINT ( ( ndo, "(" ) ) ; # if 0 if ( flow & 0x0f000000 ) ND_PRINT ( ( ndo, "pri   0x%02x,   ", ( flow & 0x0f000000 ) >> 24 ) ) ; if ( flow & 0x00ffffff ) ND_PRINT ( ( ndo, "flowlabel   0x%06x,   ", flow & 0x00ffffff ) ) ; # else if ( flow & 0x0ff00000 ) ND_PRINT ( ( ndo, "class   0x%02x,   ", ( flow & 0x0ff00000 ) >> 20 ) ) ; if ( flow & 0x000fffff ) ND_PRINT ( ( ndo, "flowlabel

Fix:
<S2SV_ModStart> 0 ) { if ( len < ( u_int ) advance ) goto trunc ; <S2SV_ModStart> ip6 ) ; if ( advance < 0 ) return ; <S2SV_ModStart> case IPPROTO_ROUTING : ND_TCHECK ( * cp ) ; <S2SV_ModStart> ip6 ) ; if ( advance < 0 ) return ; <S2SV_ModStart>, cp ) ; if ( advance < 0 ) return <S2SV_ModStart> padlen ) ; if ( advance < 0 ) return ;
Buggy code:
 static NPError g_NPN_GetValue ( NPP instance, NPNVariable variable, void * value ) { D ( bug ( "NPN_GetValue   instance=%p,   variable=%d   [%s]\\n", instance, variable, string_of_NPNVariable ( variable ) ) ) ; if (! thread_check ( ) ) { npw_printf ( "WARNING:   NPN_GetValue   not   called   from   the   main   thread\\n" ) ; return NPERR_INVALID_INSTANCE_ERROR ; } PluginInstance * plugin = NULL ; if ( instance ) plugin = PLUGIN_INSTANCE ( instance ) ; switch ( variable ) { case NPNVxDisplay : * ( void * * ) value = x_display ; break ; case NPNVxtAppContext : * ( void * * ) value = XtDisplayToApplicationContext ( x_display ) ; break ; case NPNVToolkit : * ( NPNToolkitType * ) value = NPW_TOOLKIT ; break ; # if USE_XPCOM case NPNVserviceManager : { nsIServiceManager * sm ; int ret = NS_GetServiceManager ( & sm ) ; if ( NS_FAILED ( ret ) ) { npw_printf ( "WARNING:   NS_GetServiceManager   failed\\n" ) ; return NPERR_GENERIC_ERROR ; } * ( nsIServiceManager * * ) value = sm ; break ; } case NPNVDOMWindow : case NPNVDOMElement : npw_printf ( "WARNING:   %s   is   not   supported   by   NPN_GetValue()\\n", string_of_NPNVariable ( variable ) ) ; return NPERR_INVALID_PARAM ; # endif case NPNVnetscapeWindow : if ( plugin == NULL ) { npw_printf ( "ERROR:   NPNVnetscapeWindow   requires   a   non   NULL   instance\\n" ) ; return NPERR_INVALID_INSTANCE_ERROR ; } if ( plugin -> browser_toplevel == NULL ) { GdkNativeWindow netscape_xid = None ; NPError error = g_NPN_GetValue_real ( instance, variable, & netscape_xid ) ; if ( error!= NPERR_NO_ERROR ) return error ; if (

Fix:
<S2SV_ModStart> case NPNVPluginElementNPObject : case NPNVprivateModeBool : case NPNVsupportsAdvancedKeyHandling :
Buggy code:
 static void command_timed_out ( UNUSED_ATTR void * context ) { pthread_mutex_lock ( & commands_pending_response_lock ) ; if ( list_is_empty ( commands_pending_response ) ) { LOG_ERROR ( "%s   with   no   commands   pending   response", __func__ ) ; } else { waiting_command_t * wait_entry = list_front ( commands_pending_response ) ; pthread_mutex_unlock ( & commands_pending_response_lock ) ; LOG_ERROR ( "%s   hci   layer   timeout   waiting   for   response   to   a   command.   opcode:   0x%x", __func__, wait_entry -> opcode ) ; } LOG_ERROR ( "%s   restarting   the   bluetooth   process.", __func__ ) ; <START_BUG> usleep ( 10000 ) ; <END_BUG> kill ( getpid ( ), SIGKILL ) ; }

Fix:
<S2SV_ModStart> __func__ ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 10000 )
Buggy code:
 int tcp_v4_connect ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct sockaddr_in * usin = ( struct sockaddr_in * ) uaddr ; struct inet_sock * inet = inet_sk ( sk ) ; struct tcp_sock * tp = tcp_sk ( sk ) ; __be16 orig_sport, orig_dport ; __be32 daddr, nexthop ; struct flowi4 fl4 ; struct rtable * rt ; <START_BUG> int err ; <END_BUG> if ( addr_len < sizeof ( struct sockaddr_in ) ) return - EINVAL ; if ( usin -> sin_family!= AF_INET ) return - EAFNOSUPPORT ; nexthop = daddr = usin -> sin_addr. s_addr ;  if ( inet -> opt && inet -> opt -> srr ) { <START_BUG> if (! daddr ) return - EINVAL ; <END_BUG> nexthop = inet -> opt -> faddr ;  } orig_sport = inet -> inet_sport ; orig_dport = usin -> sin_port ; rt = ip_route_connect ( & fl4, nexthop, inet -> inet_saddr, RT_CONN_FLAGS ( sk ), sk -> sk_bound_dev_if, IPPROTO_TCP, orig_sport, orig_dport, sk, true ) ; if ( IS_ERR ( rt ) ) { err = PTR_ERR ( rt ) ; if ( err == - ENETUNREACH ) IP_INC_STATS_BH ( sock_net ( sk ), IPSTATS_MIB_OUTNOROUTES ) ; return err ; } if ( rt -> rt_flags & ( RTCF_MULTICAST | RTCF_BROADCAST ) ) { ip_rt_put ( rt ) ; return - ENETUNREACH ; } <START_BUG> if (! inet -> opt ||! inet -> opt -> srr ) <END_BUG> daddr = rt -> rt_dst ; if (! inet -> inet_saddr ) inet -> inet_saddr = rt -> rt_src ; inet -> inet_rcv_saddr = inet -> inet_saddr ; if ( tp -> rx_opt. ts_recent_stamp && inet -> inet_daddr!= daddr ) { tp -> rx_opt. ts

Fix:
<S2SV_ModStart> ; int err ; struct ip_options_rcu * inet_opt <S2SV_ModStart>. s_addr ; inet_opt = rcu_dereference_protected ( inet -> inet_opt, sock_owned_by_user ( sk ) ) ; if ( inet_opt && inet_opt -> opt. <S2SV_ModEnd> srr ) { <S2SV_ModStart> ; nexthop = inet_opt -> opt. <S2SV_ModEnd> faddr ; } <S2SV_ModStart> if (! inet_opt ||! inet_opt -> opt. <S2SV_ModEnd> srr ) daddr <S2SV_ModStart> ; if ( inet_opt ) inet_csk ( sk ) -> icsk_ext_hdr_len = inet_opt -> opt. <S2SV_ModEnd> optlen ; tp
Buggy code:
 void jpc_qmfb_split_col ( jpc_fix_t * a, int numrows, int stride, int parity ) { int bufsize = JPC_CEILDIVPOW2 ( numrows, 1 ) ; jpc_fix_t splitbuf [ QMFB_SPLITBUFSIZE ] ; jpc_fix_t * buf = splitbuf ; register jpc_fix_t * srcptr ; register jpc_fix_t * dstptr ; register int n ; register int m ; <START_BUG> int hstartcol ; <END_BUG> if ( bufsize > QMFB_SPLITBUFSIZE ) { if (! ( buf = jas_alloc2 ( bufsize, sizeof ( jpc_fix_t ) ) ) ) { abort ( ) ; } } if ( numrows >= 2 ) {  hstartcol = ( numrows + 1 - parity ) >> 1 ; <START_BUG> <END_BUG> m = numrows - hstartcol ;  n = m ; dstptr = buf ; srcptr = & a [ ( 1 - parity ) * stride ] ; while ( n -- > 0 ) { * dstptr = * srcptr ; ++ dstptr ; srcptr += stride << 1 ; } dstptr = & a [ ( 1 - parity ) * stride ] ; srcptr = & a [ ( 2 - parity ) * stride ] ; n = numrows - m - (! parity ) ; while ( n -- > 0 ) { * dstptr = * srcptr ; dstptr += stride ; srcptr += stride << 1 ; } <START_BUG> dstptr = & a [ hstartcol * stride ] ; <END_BUG> srcptr = buf ; n = m ; while ( n -- > 0 ) { * dstptr = * srcptr ; dstptr += stride ; ++ srcptr ; } } if ( buf!= splitbuf ) { jas_free ( buf ) ; } }

Fix:
<S2SV_ModStart> m ; int hstartrow <S2SV_ModEnd> ; if ( <S2SV_ModStart> 2 ) { hstartrow <S2SV_ModEnd> = ( numrows <S2SV_ModStart> = numrows - hstartrow <S2SV_ModEnd> ; n = <S2SV_ModStart> & a [ hstartrow <S2SV_ModEnd> * stride ]
Buggy code:
 void interprete ( char * lbook, char * path ) { int status, i, j, n, message_id, inactive ; char list [ 1000 ], section [ 256 ], str [ NAME_LENGTH ], str1 [ NAME_LENGTH ], str2 [ NAME_LENGTH ], edit_id [ 80 ], file_name [ 256 ], command [ 256 ], enc_path [ 256 ], dec_path [ 256 ], uname [ 80 ], full_name [ 256 ], user_email [ 256 ], logbook [ 256 ], logbook_enc [ 256 ], * experiment, group [ 256 ], css [ 256 ], * pfile, attachment [ MAX_PATH_LENGTH ], str3 [ NAME_LENGTH ], thumb_name [ 256 ], sid [ 32 ], error_str [ 256 ], subdir [ 256 ], * s ; LOGBOOK * lbs ; FILE * f ; strcpy ( dec_path, path ) ; url_decode ( dec_path ) ; strcpy ( enc_path, dec_path ) ; url_encode ( enc_path, sizeof ( enc_path ) ) ; strencode2 ( command, isparam ( "cmd" )? getparam ( "cmd" ) : "", sizeof ( command ) ) ; strencode2 ( group, isparam ( "group" )? getparam ( "group" ) : "", sizeof ( group ) ) ; experiment = getparam ( "exp" ) ; if ( getcfg ( lbook, "Logging   Level", str, sizeof ( str ) ) ) _logging_level = atoi ( str ) ; else _logging_level = 2 ; set_condition ( "" ) ; message_id = atoi ( dec_path ) ; if ( isparam ( "jcmd" ) && * getparam ( "jcmd" ) ) strlcpy ( command, getparam ( "jcmd" ), sizeof ( command ) ) ; if ( stricmp ( command, "loc" ) == 0 ) { show_http_header ( NULL, FALSE, NULL ) ; <START_BUG> if ( isparam ( "value" ) && * getparam ( "value" ) ) <END_BUG>  rsputs ( loc ( getparam ( "value" ) ) ) ; <START_BUG> s = loc ( "Drop   attachments   here..." ) ; s =<END_BUG>

Fix:
<S2SV_ModStart> "value" ) ) { strencode2 ( str, getparam ( "value" ), sizeof ( str ) ) ; <S2SV_ModStart> ( loc ( str ) ) ; } <S2SV_ModEnd> s = loc
Buggy code:
 static int flakey_ioctl ( struct dm_target * ti, unsigned int cmd, unsigned long arg ) { struct flakey_c * fc = ti -> private ; <START_BUG> return __blkdev_driver_ioctl ( fc -> dev -> bdev, fc -> dev -> mode, cmd, arg ) ; <END_BUG> }

Fix:
<S2SV_ModStart> -> private ; struct dm_dev * dev = fc -> dev ; int r = 0 ; if <S2SV_ModEnd> ( fc -> <S2SV_ModStart> ( fc -> start || ti -> len!= i_size_read ( dev -> bdev -> bd_inode ) >> SECTOR_SHIFT ) r = scsi_verify_blk_ioctl ( NULL, cmd ) ; return r? : __blkdev_driver_ioctl ( <S2SV_ModStart> -> bdev, <S2SV_ModEnd> dev -> mode
Buggy code:
 static int pit_ioport_read ( struct kvm_io_device * this, gpa_t addr, int len, void * data ) { struct kvm_pit * pit = dev_to_pit ( this ) ; struct kvm_kpit_state * pit_state = & pit -> pit_state ; struct kvm * kvm = pit -> kvm ; int ret, count ; struct kvm_kpit_channel_state * s ; if (! pit_in_range ( addr ) ) return - EOPNOTSUPP ; addr &= KVM_PIT_CHANNEL_MASK ; <START_BUG> s = & pit_state -> channels [ addr ] ; <END_BUG> mutex_lock ( & pit_state -> lock ) ; if ( s -> status_latched ) { s -> status_latched = 0 ; ret = s -> status ; } else if ( s -> count_latched ) { switch ( s -> count_latched ) { default : case RW_STATE_LSB : ret = s -> latched_count & 0xff ; s -> count_latched = 0 ; break ; case RW_STATE_MSB : ret = s -> latched_count >> 8 ; s -> count_latched = 0 ; break ; case RW_STATE_WORD0 : ret = s -> latched_count & 0xff ; s -> count_latched = RW_STATE_MSB ; break ; } } else { switch ( s -> read_state ) { default : case RW_STATE_LSB : count = pit_get_count ( kvm, addr ) ; ret = count & 0xff ; break ; case RW_STATE_MSB : count = pit_get_count ( kvm, addr ) ; ret = ( count >> 8 ) & 0xff ; break ; case RW_STATE_WORD0 : count = pit_get_count ( kvm, addr ) ; ret = count & 0xff ; s -> read_state = RW_STATE_WORD1 ; break ; case RW_STATE_WORD1 : count = pit_get_count ( kvm, addr ) ; ret = ( count >> 8 ) & 0xff ; s -> read_state = RW_STATE_WORD0 ; break ; } } if (

Fix:
<S2SV_ModStart> &= KVM_PIT_CHANNEL_MASK ; if ( addr == 3 ) return 0 ;
Buggy code:
 int inet6_sk_rebuild_header ( struct sock * sk ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct dst_entry * dst ; dst = __sk_dst_check ( sk, np -> dst_cookie ) ; if (! dst ) { struct inet_sock * inet = inet_sk ( sk ) ; struct in6_addr * final_p, final ; struct flowi6 fl6 ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; fl6. flowi6_proto = sk -> sk_protocol ; fl6. daddr = sk -> sk_v6_daddr ; fl6. saddr = np -> saddr ; fl6. flowlabel = np -> flow_label ; fl6. flowi6_oif = sk -> sk_bound_dev_if ; fl6. flowi6_mark = sk -> sk_mark ; fl6. fl6_dport = inet -> inet_dport ; fl6. fl6_sport = inet -> inet_sport ; security_sk_classify_flow ( sk, flowi6_to_flowi ( & fl6 ) ) ; <START_BUG> final_p = fl6_update_dst ( & fl6, np -> opt, & final ) ; <END_BUG> dst = ip6_dst_lookup_flow ( sk, & fl6, final_p ) ; if ( IS_ERR ( dst ) ) { sk -> sk_route_caps = 0 ; sk -> sk_err_soft = - PTR_ERR ( dst ) ; return PTR_ERR ( dst ) ; } __ip6_dst_store ( sk, dst, NULL, NULL ) ; } return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; rcu_read_lock ( ) ; <S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ), & final ) ; rcu_read_unlock ( <S2SV_ModEnd> ) ; dst