nus-yam/ex-repair huggingface dataset:
Buggy code:
 void vp9_copy_and_extend_frame ( const YV12_BUFFER_CONFIG * src, YV12_BUFFER_CONFIG * dst ) { const int et_y = 16 ; const int el_y = 16 ; <START_BUG> const int eb_y = MAX ( ALIGN_POWER_OF_TWO ( src -> y_width, 6 ) - src -> y_width, <END_BUG> 16 ) ; const int er_y = MAX ( ALIGN_POWER_OF_TWO ( src -> y_height, 6 ) - src -> y_height, 16 ) ; const int uv_width_subsampling = ( src -> uv_width!= src -> y_width ) ; const int uv_height_subsampling = ( src -> uv_height!= src -> y_height ) ; const int et_uv = et_y >> uv_height_subsampling ; const int el_uv = el_y >> uv_width_subsampling ; const int eb_uv = eb_y >> uv_height_subsampling ; const int er_uv = er_y >> uv_width_subsampling ;  # if CONFIG_ALPHA <START_BUG> const int et_a = dst -> border >> ( dst -> alpha_height!= dst -> y_height ) ; const int el_a = dst -> border >> ( dst -> alpha_width!= dst -> y_width ) ; const int eb_a = et_a + dst -> alpha_height - src -> alpha_height ; const int er_a = el_a + dst -> alpha_width - src -> alpha_width ; copy_and_extend_plane ( src -> alpha_buffer, src -> alpha_stride, dst -> alpha_buffer, dst -> alpha_stride, src -> alpha_width, src -> alpha_height, et_a, el_a, eb_a, er_a ) ; # endif copy_and_extend_plane ( src -> y_buffer, src -> y_stride, dst -> y_buffer, dst -> y_stride, <END_BUG> src -> y_width, src -> y_height,  et_y, el_y, eb_y, er_y ) ; copy_and_extend_plane ( src -> u_buffer, src -> uv_stride, dst -> u_buffer, dst -> uv_stride, <START_BUG> src -> uv_width, src -> uv_<END_BUG>

Fix:
<S2SV_ModStart> ; const int er_y = MAX ( src -> y_width + 16, ALIGN_POWER_OF_TWO ( src -> y_width, 6 ) ) - src -> y_crop_width ; const int <S2SV_ModStart> = MAX ( src -> y_height + 16, <S2SV_ModStart> ( src -> y_height <S2SV_ModEnd>, 6 ) <S2SV_ModStart>, 6 ) ) <S2SV_ModStart> - src -> y_crop_height <S2SV_ModEnd> ; const int <S2SV_ModStart> ; # if CONFIG_VP9_HIGHBITDEPTH if ( src -> flags & YV12_FLAG_HIGHBITDEPTH ) { highbd_copy_and_extend_plane ( src -> y_buffer, src -> y_stride, dst -> y_buffer, dst -> y_stride, src -> y_crop_width, src -> y_crop_height, et_y, el_y, eb_y, er_y ) ; highbd_copy_and_extend_plane ( src -> u_buffer, src -> uv_stride, dst -> u_buffer, dst -> uv_stride, src -> uv_crop_width, src -> uv_crop_height, et_uv, el_uv, eb_uv, er_uv ) ;
Buggy code:
 static unsigned long get_seg_limit ( struct pt_regs * regs, int seg_reg_idx ) { <START_BUG> struct desc_struct * desc ; <END_BUG> unsigned long limit ; short sel ; sel = get_segment_selector ( regs, seg_reg_idx ) ; if ( sel < 0 ) return 0 ; if ( user_64bit_mode ( regs ) || v8086_mode ( regs ) ) return - 1L ; if (! sel ) return 0 ;  desc = get_desc ( sel ) ; <START_BUG> <END_BUG> if (! desc )  return 0 ; <START_BUG> limit = get_desc_limit ( desc ) ; <END_BUG>  if ( desc -> g ) <START_BUG> limit = ( limit << 12 ) + 0xfff ; return limit ; }<END_BUG>

Fix:
<S2SV_ModStart> { struct desc_struct <S2SV_ModEnd> desc ; unsigned <S2SV_ModStart> return 0 ; <S2SV_ModEnd> if (! <S2SV_ModStart> if (! get_desc ( & desc, sel ) <S2SV_ModEnd> ) return 0 <S2SV_ModStart> = get_desc_limit ( & <S2SV_ModStart> if ( desc. <S2SV_ModEnd> g ) limit
Buggy code:
 void sec_decrypt ( uint8 * data, int length ) <START_BUG> { <END_BUG> if ( g_sec_decrypt_use_count == 4096 ) { sec_update ( g_sec_decrypt_key, g_sec_decrypt_update_key ) ; rdssl_rc4_set_key ( & g_rc4_decrypt_key, g_sec_decrypt_key, g_rc4_key_len ) ; g_sec_decrypt_use_count = 0 ; } rdssl_rc4_crypt ( & g_rc4_decrypt_key, data, data, length ) ; g_sec_decrypt_use_count ++ ; }

Fix:
<S2SV_ModStart> length ) { if ( length <= 0 ) return ;
Buggy code:
 static int adev_open_output_stream ( struct audio_hw_device * dev, audio_io_handle_t handle, audio_devices_t devices, audio_output_flags_t flags, struct audio_config * config, struct audio_stream_out * * stream_out, const char * address ) { struct a2dp_audio_device * a2dp_dev = ( struct a2dp_audio_device * ) dev ; struct a2dp_stream_out * out ; int ret = 0 ; int i ; UNUSED ( address ) ; UNUSED ( handle ) ; UNUSED ( devices ) ; UNUSED ( flags ) ; INFO ( "opening   output" ) ; out = ( struct a2dp_stream_out * ) calloc ( 1, sizeof ( struct a2dp_stream_out ) ) ; if (! out ) return - ENOMEM ; out -> stream. common. get_sample_rate = out_get_sample_rate ; out -> stream. common. set_sample_rate = out_set_sample_rate ; out -> stream. common. get_buffer_size = out_get_buffer_size ; out -> stream. common. get_channels = out_get_channels ; out -> stream. common. get_format = out_get_format ; out -> stream. common. set_format = out_set_format ; out -> stream. common. standby = out_standby ; out -> stream. common. dump = out_dump ; out -> stream. common. set_parameters = out_set_parameters ; out -> stream. common. get_parameters = out_get_parameters ; out -> stream. common. add_audio_effect = out_add_audio_effect ; out -> stream. common. remove_audio_effect = out_remove_audio_effect ; out -> stream. get_latency = out_get_latency ; out -> stream. set_volume = out_set_volume ; out -> stream. write = out_write ; out -> stream. get_render_position = out_get_render_position ; out -> stream. get_presentation_position = out_get_presentation_position ; a2dp_stream_common_init ( & out -> common ) ; out -> common. cfg. channel_flags = AUDIO_STREAM

Fix:
<S2SV_ModStart> "success" ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 250000 )
Buggy code:
 void qedi_dbg_info ( struct qedi_dbg_ctx * qedi, const char * func, u32 line, u32 level, const char * fmt,... ) { va_list va ; <START_BUG> struct va_format vaf ; <END_BUG> char nfunc [ 32 ] ; memset ( nfunc, 0, sizeof ( nfunc ) ) ; memcpy ( nfunc, func, sizeof ( nfunc ) - 1 ) ; va_start ( va, fmt ) ; vaf. fmt = fmt ; vaf. va = & va ; if (! ( qedi_dbg_log & level ) ) goto ret ; if ( likely ( qedi ) && likely ( qedi -> pdev ) ) pr_info ( "[%s]:[%s:%d]:%d:   %pV", dev_name ( & qedi -> pdev -> dev ),  nfunc, line, qedi -> host_no, & vaf ) ; <START_BUG> else <END_BUG> pr_info ( "[0000:00:00.0]:[%s:%d]:   %pV", nfunc, line, & vaf ) ;  ret : va_end ( va ) ; }

Fix:
<S2SV_ModStart> struct va_format vaf <S2SV_ModEnd> ; va_start ( <S2SV_ModStart> dev ), func <S2SV_ModEnd>, line, <S2SV_ModStart> ( "[0000:00:00.0]:[%s:%d]: <S2SV_blank> %pV", func <S2SV_ModEnd>, line,
Buggy code:
 <START_BUG> void vp9_cond_prob_diff_update ( vp9_writer * w, vp9_prob * oldp, <END_BUG> const unsigned int ct [ 2 ] ) {  const vp9_prob upd = DIFF_UPDATE_PROB ; <START_BUG> <END_BUG> vp9_prob newp = get_binary_prob ( ct [ 0 ], ct [ 1 ] ) ;  const int savings = vp9_prob_diff_update_savings_search ( ct, * oldp, & newp, upd ) ; assert ( newp >= 1 ) ; if ( savings > 0 ) { <START_BUG> vp9_write ( w, 1, upd ) ; <END_BUG> vp9_write_prob_diff_update ( w, newp, * oldp ) ; * oldp = newp ; } else {  vp9_write ( w, 0, upd ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> void vp9_cond_prob_diff_update ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> * w, vpx_prob <S2SV_ModEnd> * oldp, <S2SV_ModStart> ) { const vpx_prob <S2SV_ModEnd> upd = DIFF_UPDATE_PROB <S2SV_ModStart> = DIFF_UPDATE_PROB ; vpx_prob <S2SV_ModEnd> newp = get_binary_prob <S2SV_ModStart> 0 ) { vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> } else { vpx_write <S2SV_ModEnd> ( w,
Buggy code:
 static void yv12_extend_frame_left_right_c ( YV12_BUFFER_CONFIG * ybf, unsigned char * y_src, unsigned char * u_src, unsigned char * v_src ) { int i ; unsigned char * src_ptr1, * src_ptr2 ; unsigned char * dest_ptr1, * dest_ptr2 ; unsigned int Border ; int plane_stride ; int plane_height ; int plane_width ; Border = ybf -> border ; plane_stride = ybf -> y_stride ; plane_height = 16 ; plane_width = ybf -> y_width ; src_ptr1 = y_src ; src_ptr2 = src_ptr1 + plane_width - 1 ; dest_ptr1 = src_ptr1 - Border ; dest_ptr2 = src_ptr2 + 1 ; for ( i = 0 ; i < plane_height ; i ++ ) { <START_BUG> vpx_memset ( dest_ptr1, src_ptr1 [ 0 ], Border ) ; <END_BUG> vpx_memset ( dest_ptr2, src_ptr2 [ 0 ], Border ) ; src_ptr1 += plane_stride ; src_ptr2 += plane_stride ; dest_ptr1 += plane_stride ; dest_ptr2 += plane_stride ; } plane_stride = ybf -> uv_stride ; plane_height = 8 ; plane_width = ybf -> uv_width ; Border //= 2 ; src_ptr1 = u_src ; src_ptr2 = src_ptr1 + plane_width - 1 ; dest_ptr1 = src_ptr1 - Border ; dest_ptr2 = src_ptr2 + 1 ; for ( i = 0 ; i < plane_height ; i ++ ) {  vpx_memset ( dest_ptr1, src_ptr1 [ 0 ], Border ) ; <START_BUG> vpx_memset ( dest_ptr2, src_ptr2 [ 0 ], Border ) ; src_ptr1 += plane_stride ; src_ptr2 += plane_stride ; dest_ptr1 += plane_stride ; dest_ptr2 += plane_stride ; } src_ptr1 = v_src ; src_ptr2 = src_ptr1 + plane_width - 1 ; dest_ptr1 = src_ptr1 - Border ; dest_ptr2 = src_<END_BUG>

Fix:
<S2SV_ModStart> ++ ) { memset ( dest_ptr1, src_ptr1 [ 0 ], Border ) ; memset <S2SV_ModEnd> ( dest_ptr2, <S2SV_ModStart> ++ ) { memset ( dest_ptr1, src_ptr1 [ 0 ], Border ) ; memset <S2SV_ModEnd> ( dest_ptr2, <S2SV_ModStart> ++ ) { memset ( dest_ptr1, src_ptr1 [ 0 ], Border ) ; memset <S2SV_ModEnd> ( dest_ptr2,
Buggy code:
 static void InsertRow ( Image * image, unsigned char * p, ssize_t y, int bpp, ExceptionInfo * exception ) { int bit ; Quantum index ; register Quantum * q ; ssize_t x ; switch ( bpp ) { case 1 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) break ; for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 7 ) ; x += 8 ) { for ( bit = 0 ; bit < 8 ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( image, index, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; q += GetPixelChannels ( image ) ; } p ++ ; } if ( ( image -> columns % 8 )!= 0 ) { for ( bit = 0 ; bit < ( ssize_t ) ( image -> columns % 8 ) ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( image, index, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; q += GetPixelChannels ( image ) ; } p ++ ; } if (! SyncAuthenticPixels ( image, exception ) ) break ; break ; } case 2 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) break ; <START_BUG> for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 1 ) ; x += 4 ) <END_BUG> { index = ConstrainColormapIndex ( image, ( * p >> 6 ) & 0x3, exception ) ; SetPixelIndex ( image, index, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; q += GetPixelChannels ( image ) ; index = ConstrainColormapIndex ( image, ( * p >> 4 ) & 0x3, exception ) ; SetPixelIndex (

Fix:
<S2SV_ModStart> -> columns - 3 <S2SV_ModEnd> ) ; x <S2SV_ModStart> q ) ; q += GetPixelChannels ( image ) ; p ++ <S2SV_ModEnd> ; } if <S2SV_ModStart> % 4 ) > <S2SV_ModEnd> 1 ) { <S2SV_ModStart> % 4 ) > <S2SV_ModEnd> 2 ) {
Buggy code:
 static ext3_fsblk_t get_sb_block ( void * * data, struct super_block * sb ) { ext3_fsblk_t sb_block ; char * options = ( char * ) * data ; if (! options || strncmp ( options, "sb=", 3 )!= 0 ) return 1 ; options += 3 ; sb_block = simple_strtoul ( options, & options, 0 ) ; if ( * options && * options!= ',' ) { <START_BUG> ext3_msg ( sb, "error:   invalid   sb   specification:   %s", <END_BUG> ( char * ) * data ) ; return 1 ; } if ( * options == ',' ) options ++ ; * data = ( void * ) options ; return sb_block ; }

Fix:
<S2SV_ModStart> ( sb, KERN_ERR,
Buggy code:
 void mp_decode_to_lua_array ( lua_State * L, mp_cur * c, size_t len ) { assert ( len <= UINT_MAX ) ; int index = 1 ; <START_BUG> lua_newtable ( L ) ; <END_BUG> while ( len -- ) { lua_pushnumber ( L, index ++ ) ; mp_decode_to_lua_type ( L, c ) ; if ( c -> err ) return ; lua_settable ( L, - 3 ) ; } }

Fix:
<S2SV_ModStart> lua_newtable ( L ) ; luaL_checkstack ( L, 1, "in <S2SV_blank> function <S2SV_blank> mp_decode_to_lua_array"
Buggy code:
 int m_authenticate ( struct Client * cptr, struct Client * sptr, int parc, char * parv [ ] ) { struct Client * acptr ; int first = 0 ; char realhost [ HOSTLEN + 3 ] ; char * hoststr = ( cli_sockhost ( cptr )? cli_sockhost ( cptr ) : cli_sock_ip ( cptr ) ) ; if (! CapActive ( cptr, CAP_SASL ) ) return 0 ; if ( parc < 2 ) return need_more_params ( cptr, "AUTHENTICATE" ) ; if ( strlen ( parv [ 1 ] ) > 400 ) return send_reply ( cptr, ERR_SASLTOOLONG ) ; if ( IsSASLComplete ( cptr ) ) return send_reply ( cptr, ERR_SASLALREADY ) ; if (! ( acptr = cli_saslagent ( cptr ) ) ) { if ( strcmp ( feature_str ( FEAT_SASL_SERVER ), "*" ) ) acptr = find_match_server ( ( char * ) feature_str ( FEAT_SASL_SERVER ) ) ; else acptr = NULL ; } if (! acptr && strcmp ( feature_str ( FEAT_SASL_SERVER ), "*" ) ) return send_reply ( cptr, ERR_SASLFAIL, ":   service   unavailable" ) ; if ( acptr && IsMe ( acptr ) ) return 0 ; if (! cli_saslcookie ( cptr ) ) { do { cli_saslcookie ( cptr ) = ircrandom ( ) & 0x7fffffff ; } while (! cli_saslcookie ( cptr ) ) ; first = 1 ; } if ( strchr ( hoststr, ':' )!= NULL ) ircd_snprintf ( 0, realhost, sizeof ( realhost ), "[%s]", hoststr ) ; else ircd_strncpy ( realhost, hoststr, sizeof ( realhost ) ) ; if ( acptr ) { if ( first ) { <START_BUG> if (! EmptyString ( cli_sslclifp ( cptr ) ) ) <END_BUG> sendcmdto_one ( & me, CMD_SASL, acptr, "%C   %C!%u.%u   S

Fix:
<S2SV_ModStart> { if ( * parv [ 1 ] == ':' || strchr ( parv [ 1 ],'<S2SV_blank>') ) return exit_client ( cptr, sptr, sptr, "Malformed <S2SV_blank> AUTHENTICATE" ) ; if ( <S2SV_ModStart> { if ( * parv [ 1 ] == ':' || strchr ( parv [ 1 ],'<S2SV_blank>') ) return exit_client ( cptr, sptr, sptr, "Malformed <S2SV_blank> AUTHENTICATE" ) ; if (
Buggy code:
 int virDomainGetTime ( virDomainPtr dom, long long * seconds, unsigned int * nseconds, unsigned int flags ) { VIR_DOMAIN_DEBUG ( dom, "seconds=%p,   nseconds=%p,   flags=%x", seconds, nseconds, flags ) ; virResetLastError ( ) ; <START_BUG> virCheckDomainReturn ( dom, - 1 ) ; <END_BUG> if ( dom -> conn -> driver -> domainGetTime ) { int ret = dom -> conn -> driver -> domainGetTime ( dom, seconds, nseconds, flags ) ; if ( ret < 0 ) goto error ; return ret ; } virReportUnsupportedError ( ) ; error : virDispatchError ( dom -> conn ) ; return - 1 ; }

Fix:
<S2SV_ModStart>, - 1 ) ; virCheckReadOnlyGoto ( dom -> conn -> flags, error
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_d_slice ( dec_state_t * ps_dec ) { UWORD32 i ; yuv_buf_t * ps_cur_frm_buf = & ps_dec -> s_cur_frm_buf ; stream_t * ps_stream = & ps_dec -> s_bit_stream ; UWORD8 * pu1_vld_buf ; WORD16 i2_dc_diff ; UWORD32 u4_frame_width = ps_dec -> u2_frame_width ; UWORD32 u4_frm_offset = 0 ; if ( ps_dec -> u2_picture_structure!= FRAME_PICTURE ) { u4_frame_width <<= 1 ; if ( ps_dec -> u2_picture_structure == BOTTOM_FIELD ) { u4_frm_offset = ps_dec -> u2_frame_width ; } } do { UWORD32 u4_x_offset, u4_y_offset ; UWORD32 u4_blk_pos ; WORD16 i2_dc_val ; UWORD32 u4_dst_x_offset = u4_frm_offset + ( ps_dec -> u2_mb_x << 4 ) ; UWORD32 u4_dst_y_offset = ( ps_dec -> u2_mb_y << 4 ) * u4_frame_width ; UWORD8 * pu1_vld_buf8 = ps_cur_frm_buf -> pu1_y + u4_dst_x_offset + u4_dst_y_offset ; UWORD32 u4_dst_wd = u4_frame_width ; <START_BUG> while ( impeg2d_bit_stream_nxt ( ps_stream, MB_STUFFING_CODE_LEN ) == MB_STUFFING_CODE ) <END_BUG> impeg2d_bit_stream_flush ( ps_stream, MB_STUFFING_CODE_LEN ) ; impeg2d_bit_stream_flush ( ps_stream, 1 ) ; if ( impeg2d_bit_stream_get ( ps_stream, 1 )!= 0x01 ) { } for ( i = 0 ; i < NUM_LUMA_BL

Fix:
<S2SV_ModStart> ) == MB_STUFFING_CODE && ps_stream -> u4_offset < ps_stream -> u4_max_offset
Buggy code:
 static int serdes_probe ( struct platform_device * pdev ) { struct phy_provider * provider ; struct serdes_ctrl * ctrl ; unsigned int i ; int ret ; ctrl = devm_kzalloc ( & pdev -> dev, sizeof ( * ctrl ), GFP_KERNEL ) ; if (! ctrl ) return - ENOMEM ; ctrl -> dev = & pdev -> dev ; ctrl -> regs = syscon_node_to_regmap ( pdev -> dev. parent -> of_node ) ; if ( IS_ERR ( ctrl -> regs ) ) return PTR_ERR ( ctrl -> regs ) ; <START_BUG> for ( i = 0 ; i <= SERDES_MAX ; i ++ ) { <END_BUG> ret = serdes_phy_create ( ctrl, i, & ctrl -> phys [ i ] ) ; if ( ret ) return ret ; } dev_set_drvdata ( & pdev -> dev, ctrl ) ; provider = devm_of_phy_provider_register ( ctrl -> dev, serdes_simple_xlate ) ; return PTR_ERR_OR_ZERO ( provider ) ; }

Fix:
<S2SV_ModStart> 0 ; i < <S2SV_ModEnd> SERDES_MAX ; i
Buggy code:
 void safe_fprintf ( FILE * f, const char * fmt,... ) { char fmtbuff_stack [ 256 ] ; char outbuff [ 256 ] ; char * fmtbuff_heap ; char * fmtbuff ; int fmtbuff_length ; int length, n ; va_list ap ; const char * p ; unsigned i ; wchar_t wc ; char try_wc ; fmtbuff_heap = NULL ; fmtbuff_length = sizeof ( fmtbuff_stack ) ; fmtbuff = fmtbuff_stack ; va_start ( ap, fmt ) ; length = vsnprintf ( fmtbuff, fmtbuff_length, fmt, ap ) ; va_end ( ap ) ; while ( length < 0 || length >= fmtbuff_length ) { if ( length >= fmtbuff_length ) fmtbuff_length = length + 1 ; else if ( fmtbuff_length < 8192 ) fmtbuff_length *= 2 ; else if ( fmtbuff_length < 1000000 ) fmtbuff_length += fmtbuff_length // 4 ; else { length = fmtbuff_length ; fmtbuff_heap [ length - 1 ] = '\\0' ; break ; } free ( fmtbuff_heap ) ; fmtbuff_heap = malloc ( fmtbuff_length ) ; if ( fmtbuff_heap!= NULL ) { fmtbuff = fmtbuff_heap ; va_start ( ap, fmt ) ; length = vsnprintf ( fmtbuff, fmtbuff_length, fmt, ap ) ; va_end ( ap ) ; } else { length = sizeof ( fmtbuff_stack ) - 1 ; break ; } } if ( mbtowc ( NULL, NULL, 1 ) == - 1 ) { free ( fmtbuff_heap ) ; return ; } p = fmtbuff ; i = 0 ; try_wc = 1 ; while ( * p!= '\\0' ) { if ( try_wc && ( n = mbtowc ( & wc, p, length ) )!= - 1 ) { length -= n ; if ( iswprint ( wc ) && wc!= L'\\\\' ) { while ( n -- > 0 ) outbuff [ i ++ ] = * p ++ ; } else { while ( n -- > 0 ) i += ( unsigned ) bsdtar_expand_char ( outbuff, i, * p ++ ) ; } } else { i += ( unsigned ) bsdtar_expand_char ( outbuff,

Fix:
<S2SV_ModStart> outbuff ) - 128 <S2SV_ModEnd> ) ) {
Buggy code:
 static int parse_codes ( struct archive_read * a ) { int i, j, val, n, r ; unsigned char bitlengths [ MAX_SYMBOLS ], zerocount, ppmd_flags ; unsigned int maxorder ; struct huffman_code precode ; struct rar * rar = ( struct rar * ) ( a -> format -> data ) ; struct rar_br * br = & ( rar -> br ) ; free_codes ( a ) ; rar_br_consume_unalined_bits ( br ) ; if (! rar_br_read_ahead ( a, br, 1 ) ) goto truncated_data ; if ( ( rar -> is_ppmd_block = rar_br_bits ( br, 1 ) )!= 0 ) { rar_br_consume ( br, 1 ) ; if (! rar_br_read_ahead ( a, br, 7 ) ) goto truncated_data ; ppmd_flags = rar_br_bits ( br, 7 ) ; rar_br_consume ( br, 7 ) ; if ( ppmd_flags & 0x20 ) { if (! rar_br_read_ahead ( a, br, 8 ) ) goto truncated_data ; rar -> dictionary_size = ( rar_br_bits ( br, 8 ) + 1 ) << 20 ; rar_br_consume ( br, 8 ) ; } if ( ppmd_flags & 0x40 ) { if (! rar_br_read_ahead ( a, br, 8 ) ) goto truncated_data ; rar -> ppmd_escape = rar -> ppmd7_context. InitEsc = rar_br_bits ( br, 8 ) ; rar_br_consume ( br, 8 ) ; } else rar -> ppmd_escape = 2 ; if ( ppmd_flags & 0x20 ) { maxorder = ( ppmd_flags & 0x1F ) + 1 ; if ( maxorder > 16 ) maxorder = 16 + ( maxorder - 16 ) * 3 ; if ( maxorder == 1 ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Truncated   RAR   file   data" ) ; return ( ARCHIVE_FATAL ) ; } __archive

Fix:
<S2SV_ModStart> ; if ( rar -> dictionary_size == 0 ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Invalid <S2SV_blank> zero <S2SV_blank> dictionary <S2SV_blank> size" ) ; return ( ARCHIVE_FATAL ) ; } if (
Buggy code:
 void request_init ( VALUE mod ) { req_class = rb_define_class_under ( mod, "Request", rb_cObject ) ; rb_define_method ( req_class, "to_s", to_s, 0 ) ; rb_define_method ( req_class, "to_h", to_h, 0 ) ; rb_define_method ( req_class, "environment", to_h, 0 ) ; rb_define_method ( req_class, "env", to_h, 0 ) ; rb_define_method ( req_class, "request_method", method, 0 ) ; rb_define_method ( req_class, "script_name", script_name, 0 ) ; rb_define_method ( req_class, "path_info", path_info, 0 ) ; rb_define_method ( req_class, "query_string", query_string, 0 ) ; rb_define_method ( req_class, "server_name", server_name, 0 ) ; rb_define_method ( req_class, "server_port", server_port, 0 ) ; <START_BUG> rb_define_method ( req_class, "rack_version", rack_version, 0 ) ; <END_BUG> rb_define_method ( req_class, "rack_url_scheme", rack_url_scheme, 0 ) ; rb_define_method ( req_class, "rack_input", rack_input, 0 ) ; rb_define_method ( req_class, "rack_errors", rack_errors, 0 ) ; rb_define_method ( req_class, "rack_multithread", rack_multithread, 0 ) ; rb_define_method ( req_class, "rack_multiprocess", rack_multiprocess, 0 ) ; rb_define_method ( req_class, "rack_run_once", rack_run_once, 0 ) ; rb_define_method ( req_class, "rack_upgrade?", rack_upgrade, 0 ) ; rb_define_method ( req_class, "headers", headers, 0 ) ; rb_define_method ( req_class, "body", body, 0 ) ; rb_define_method ( req_

Fix:
<S2SV_ModStart> ( req_class, "remote_addr", remote_addr, 0 ) ; rb_define_method ( req_class, <S2SV_ModStart> ( & rack_version_val ) ; remote_addr_val = rb_str_new_cstr ( "REMOTE_ADDR" ) ; rb_gc_register_address ( & remote_addr_val
Buggy code:
 static int masq_inet_event ( struct notifier_block * this, unsigned long event, void * ptr ) { <START_BUG> struct net_device * dev = ( ( struct in_ifaddr * ) ptr ) -> ifa_dev -> dev ; <END_BUG> struct netdev_notifier_info info ;  netdev_notifier_info_init ( & info, dev ) ; <START_BUG> return masq_device_event ( this, event, & info ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { struct in_device * idev <S2SV_ModEnd> = ( ( <S2SV_ModStart> ) -> ifa_dev <S2SV_ModEnd> ; struct netdev_notifier_info <S2SV_ModStart> netdev_notifier_info info ; if ( idev -> dead ) return NOTIFY_DONE ; <S2SV_ModStart> & info, idev ->
Buggy code:
 TEE_Result syscall_cryp_obj_populate ( unsigned long obj, struct utee_attribute * usr_attrs, unsigned long attr_count ) { TEE_Result res ; struct tee_ta_session * sess ; struct tee_obj * o ; const struct tee_cryp_obj_type_props * type_props ; TEE_Attribute * attrs = NULL ; res = tee_ta_get_current_session ( & sess ) ; if ( res!= TEE_SUCCESS ) return res ; res = tee_obj_get ( to_user_ta_ctx ( sess -> ctx ), tee_svc_uref_to_vaddr ( obj ), & o ) ; if ( res!= TEE_SUCCESS ) return res ; if ( ( o -> info. handleFlags & TEE_HANDLE_FLAG_PERSISTENT )!= 0 ) return TEE_ERROR_BAD_PARAMETERS ; if ( ( o -> info. handleFlags & TEE_HANDLE_FLAG_INITIALIZED )!= 0 ) return TEE_ERROR_BAD_PARAMETERS ; type_props = tee_svc_find_type_props ( o -> info. objectType ) ; if (! type_props ) return TEE_ERROR_NOT_IMPLEMENTED ; <START_BUG> attrs = malloc ( sizeof ( TEE_Attribute ) * attr_count ) ; <END_BUG> if (! attrs ) return TEE_ERROR_OUT_OF_MEMORY ; res = copy_in_attrs ( to_user_ta_ctx ( sess -> ctx ), usr_attrs, attr_count, attrs ) ; if ( res!= TEE_SUCCESS ) goto out ; res = tee_svc_cryp_check_attr ( ATTR_USAGE_POPULATE, type_props, attrs, attr_count ) ; if ( res!= TEE_SUCCESS ) goto out ; res = tee_svc_cryp_obj_populate_type ( o, type_props, attrs, attr_count ) ; if ( res == TEE_SUCCESS ) o -> info. handleFlags |= TEE_HANDLE_FLAG_INITIALIZED ; out : free ( attrs ) ; return res ; }

Fix:
<S2SV_ModStart> return TEE_ERROR_NOT_IMPLEMENTED ; size_t alloc_size = 0 ; if ( MUL_OVERFLOW ( sizeof ( TEE_Attribute ), attr_count, & alloc_size ) ) return TEE_ERROR_OVERFLOW ; <S2SV_ModStart> = malloc ( alloc_size <S2SV_ModEnd> ) ; if
Buggy code:
 bool initiate_stratum ( struct pool * pool ) { bool ret = false, recvd = false, noresume = false, sockd = false ; char s [ RBUFSIZE ], * sret = NULL, * nonce1, * sessionid ; json_t * val = NULL, * res_val, * err_val ; json_error_t err ; int n2size ; resend : if (! setup_stratum_socket ( pool ) ) { sockd = false ; goto out ; } sockd = true ; if ( recvd ) { clear_sock ( pool ) ; sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   []}", swork_id ++ ) ; } else { if ( pool -> sessionid ) sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   [\\"" PACKAGE "//" VERSION "\\",   \\"%s\\"]}", swork_id ++, pool -> sessionid ) ; else sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   [\\"" PACKAGE "//" VERSION "\\"]}", swork_id ++ ) ; } if ( __stratum_send ( pool, s, strlen ( s ) )!= SEND_OK ) { applog ( LOG_DEBUG, "Failed   to   send   s   in   initiate_stratum" ) ; goto out ; } if (! socket_full ( pool, DEFAULT_SOCKWAIT ) ) { applog ( LOG_DEBUG, "Timed   out   waiting   for   response   in   initiate_stratum" ) ; goto out ; } sret = recv_line ( pool ) ; if (! sret ) goto out ; recvd = true ; val = JSON_LOADS ( sret, & err ) ; free ( sret ) ; if (! val ) { applog ( LOG_INFO, "JSON   decode   failed(%d):   %s", err. line, err. text ) ; goto out ; } res_val = json_object_get ( val, "result" ) ; err_val = json_object_

Fix:
<S2SV_ModStart> if (! valid_hex ( nonce1 ) <S2SV_ModEnd> ) { applog <S2SV_ModStart> ( LOG_INFO, "Failed <S2SV_blank> to <S2SV_blank> get <S2SV_blank> valid <S2SV_blank> nonce1 <S2SV_blank> in <S2SV_blank> initiate_stratum" <S2SV_ModEnd> ) ; free <S2SV_ModStart> ; if ( n2size < 2 || n2size > 16 <S2SV_ModEnd> ) { applog <S2SV_ModStart> ( LOG_INFO, "Failed <S2SV_blank> to <S2SV_blank> get <S2SV_blank> valid <S2SV_blank> n2size <S2SV_blank> in <S2SV_blank> initiate_stratum" <S2SV_ModEnd> ) ; free
Buggy code:
 void vp9_remove_common ( VP9_COMMON * cm ) { <START_BUG> vp9_free_frame_buffers ( cm ) ; <END_BUG>  vp9_free_internal_frame_buffers ( & cm -> int_frame_buffers ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> cm ) { vp9_free_context_buffers <S2SV_ModEnd> ( cm ) <S2SV_ModStart> cm ) ; vpx_free ( cm -> fc ) ; cm -> fc = NULL ; vpx_free ( cm -> frame_contexts ) ; cm -> frame_contexts = NULL <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static vpx_codec_err_t decode_one ( vpx_codec_alg_priv_t * ctx, const uint8_t * * data, unsigned int data_sz, void * user_priv, int64_t deadline ) { <START_BUG> YV12_BUFFER_CONFIG sd = { 0 } ; <END_BUG> int64_t time_stamp = 0, time_end_stamp = 0 ; vp9_ppflags_t flags = { 0 } ; VP9_COMMON * cm = NULL ; ctx -> img_avail = 0 ; if (! ctx -> si. h ) {  const vpx_codec_err_t res = <START_BUG> <END_BUG> ctx -> base. iface -> dec. peek_si ( * data, data_sz, & ctx -> si ) ;  if ( res!= VPX_CODEC_OK ) return res ; <START_BUG> } <END_BUG>  if (! ctx -> decoder_init ) { <START_BUG> init_decoder ( ctx ) ; <END_BUG> if ( ctx -> pbi == NULL )  return VPX_CODEC_ERROR ; ctx -> decoder_init = 1 ; <START_BUG> } <END_BUG> cm = & ctx -> pbi -> common ; if ( vp9_receive_compressed_data ( ctx -> pbi, data_sz, data, deadline ) ) return update_error_state ( ctx, & cm -> error ) ; if ( ctx -> base. init_flags & VPX_CODEC_USE_POSTPROC ) set_ppflags ( ctx, & flags ) ; if ( vp9_get_raw_frame ( ctx -> pbi, & sd, & time_stamp, & time_end_stamp, & flags ) ) return update_error_state ( ctx, & cm -> error ) ; yuvconfig2image ( & ctx -> img, & sd, user_priv ) ; ctx -> img. fb_priv = cm -> frame_bufs [ cm -> new_fb_idx ]. raw_frame_buffer. priv ; ctx -> img_avail = 1 ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> deadline ) { const VPxWorkerInterface * const winterface = vpx_get_worker_interface ( ) ; ( void ) deadline <S2SV_ModEnd> ; if ( <S2SV_ModStart> h ) { int is_intra_only = 0 ; <S2SV_ModStart> vpx_codec_err_t res = decoder_peek_si_internal <S2SV_ModEnd> ( * data <S2SV_ModStart> ctx -> si, & is_intra_only, ctx -> decrypt_cb, ctx -> decrypt_state <S2SV_ModStart> return res ; if (! ctx -> si. is_kf &&! is_intra_only ) return VPX_CODEC_ERROR ; <S2SV_ModStart>! ctx -> frame_parallel_decode ) { VPxWorker * const worker = ctx -> frame_workers ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; frame_worker_data -> data = * data ; frame_worker_data -> data_size = data_sz ; frame_worker_data -> user_priv = user_priv ; frame_worker_data -> received_frame = 1 ; frame_worker_data -> pbi -> decrypt_cb = ctx -> decrypt_cb ; frame_worker_data -> pbi ->
Buggy code:
 static bool nested_vmx_exit_handled ( struct kvm_vcpu * vcpu ) { u32 intr_info = vmcs_read32 ( VM_EXIT_INTR_INFO ) ; struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; struct vmcs12 * vmcs12 = get_vmcs12 ( vcpu ) ; u32 exit_reason = vmx -> exit_reason ; trace_kvm_nested_vmexit ( kvm_rip_read ( vcpu ), exit_reason, vmcs_readl ( EXIT_QUALIFICATION ), vmx -> idt_vectoring_info, intr_info, vmcs_read32 ( VM_EXIT_INTR_ERROR_CODE ), KVM_ISA_VMX ) ; if ( vmx -> nested. nested_run_pending ) return 0 ; if ( unlikely ( vmx -> fail ) ) { pr_info_ratelimited ( "%s   failed   vm   entry   %x\\n", __func__, vmcs_read32 ( VM_INSTRUCTION_ERROR ) ) ; return 1 ; } switch ( exit_reason ) { case EXIT_REASON_EXCEPTION_NMI : if (! is_exception ( intr_info ) ) return 0 ; else if ( is_page_fault ( intr_info ) ) return enable_ept ; else if ( is_no_device ( intr_info ) &&! ( vmcs12 -> guest_cr0 & X86_CR0_TS ) ) return 0 ; return vmcs12 -> exception_bitmap & ( 1u << ( intr_info & INTR_INFO_VECTOR_MASK ) ) ; case EXIT_REASON_EXTERNAL_INTERRUPT : return 0 ; case EXIT_REASON_TRIPLE_FAULT : return 1 ; case EXIT_REASON_PENDING_INTERRUPT : return nested_cpu_has ( vmcs12, CPU_BASED_VIRTUAL_INTR_PENDING ) ; case EXIT_REASON_NMI_WINDOW : return nested_cpu_has ( vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING ) ; case EXIT_REASON_TASK_SWITCH : return 1 ; case EXIT_REASON_CPUID : if ( kvm_register_read ( vcpu,

Fix:
<S2SV_ModStart> case EXIT_REASON_INVEPT : case EXIT_REASON_INVVPID :
Buggy code:
 void __ip_select_ident ( struct iphdr * iph, int segs ) { static u32 ip_idents_hashrnd __read_mostly ; <START_BUG> u32 hash, id ; <END_BUG>  net_get_random_once ( & ip_idents_hashrnd, sizeof ( ip_idents_hashrnd ) ) ; <START_BUG> hash = jhash_3words ( ( __force u32 ) iph -> daddr, ( __force u32 ) iph -> saddr, <END_BUG> iph -> protocol,  ip_idents_hashrnd ) ; id = ip_idents_reserve ( hash, segs ) ; iph -> id = htons ( id ) ; }

Fix:
<S2SV_ModStart> ip_idents_hashrnd __read_mostly ; static u32 ip_idents_hashrnd_extra __read_mostly ; <S2SV_ModStart> sizeof ( ip_idents_hashrnd ) ) ; net_get_random_once ( & ip_idents_hashrnd_extra, sizeof ( ip_idents_hashrnd_extra <S2SV_ModStart> iph -> protocol ^ ip_idents_hashrnd_extra
Buggy code:
 int vp9_get_raw_frame ( VP9Decoder * pbi, YV12_BUFFER_CONFIG * sd, <START_BUG> int64_t * time_stamp, int64_t * time_end_stamp, <END_BUG>  vp9_ppflags_t * flags ) { <START_BUG> <END_BUG> int ret = - 1 ;  if ( pbi -> ready_for_new_data == 1 ) return ret ; <START_BUG> if ( pbi -> common. show_frame == 0 ) <END_BUG> return ret ; pbi -> ready_for_new_data = 1 ;  * time_stamp = pbi -> last_time_stamp ; <START_BUG> * time_end_stamp = 0 ; <END_BUG> # if CONFIG_VP9_POSTPROC  <START_BUG> ret = vp9_post_proc_frame ( & pbi -> common, sd, flags ) ; <END_BUG> # else  * sd = * pbi -> common. frame_to_show ; <START_BUG> sd -> y_width = pbi -> common. width ; sd -> y_height = pbi -> common. height ; sd -> uv_width = sd -> y_width >> pbi -> common. subsampling_x ; sd -> uv_height = sd -> y_height >> pbi -> common. subsampling_y ; ret = 0 ; # endif <END_BUG> vp9_clear_system_state ( ) ;  return ret ; }

Fix:
<S2SV_ModStart> * sd, <S2SV_ModEnd> vp9_ppflags_t * flags <S2SV_ModStart> flags ) { VP9_COMMON * const cm = & pbi -> common ; <S2SV_ModStart> - 1 ; # if! CONFIG_VP9_POSTPROC ( void ) * flags ; # endif <S2SV_ModStart> return ret ; pbi -> ready_for_new_data = 1 ; if (! cm -> show_frame <S2SV_ModEnd> ) return ret <S2SV_ModStart> = 1 ; <S2SV_ModEnd> # if CONFIG_VP9_POSTPROC <S2SV_ModStart> # if CONFIG_VP9_POSTPROC if (! cm -> show_existing_frame ) { <S2SV_ModStart> = vp9_post_proc_frame ( cm <S2SV_ModEnd>, sd, <S2SV_ModStart> flags ) ; } else { * sd = * cm -> frame_to_show ; ret = 0 ; } <S2SV_ModStart> sd = * cm -> frame_to_show <S2SV_ModEnd> ; ret = <S2SV_ModStart> ; # endif vpx_clear_system_state <S2SV_ModEnd> ( ) ;
Buggy code:
 static int read_private_key ( RSA * rsa ) { int r ; sc_path_t path ; sc_file_t * file ; const sc_acl_entry_t * e ; u8 buf [ 2048 ], * p = buf ; size_t bufsize, keysize ; r = select_app_df ( ) ; if ( r ) return 1 ; sc_format_path ( "I0012", & path ) ; r = sc_select_file ( card, & path, & file ) ; if ( r ) { fprintf ( stderr, "Unable   to   select   private   key   file:   %s\\n", sc_strerror ( r ) ) ; return 2 ; } e = sc_file_get_acl_entry ( file, SC_AC_OP_READ ) ; if ( e == NULL || e -> method == SC_AC_NEVER ) return 10 ; <START_BUG> bufsize = file -> size ; <END_BUG> sc_file_free ( file ) ; r = sc_read_binary ( card, 0, buf, bufsize, 0 ) ; if ( r < 0 ) { fprintf ( stderr, "Unable   to   read   private   key   file:   %s\\n", sc_strerror ( r ) ) ; return 2 ; } bufsize = r ; do { if ( bufsize < 4 ) return 3 ; keysize = ( p [ 0 ] << 8 ) | p [ 1 ] ; if ( keysize == 0 ) break ; if ( keysize < 3 ) return 3 ; if ( p [ 2 ] == opt_key_num ) break ; p += keysize ; bufsize -= keysize ; } while ( 1 ) ; if ( keysize == 0 ) { printf ( "Key   number   %d   not   found.\\n", opt_key_num ) ; return 2 ; } return parse_private_key ( p, keysize, rsa ) ; }

Fix:
<S2SV_ModStart> ; bufsize = MIN ( <S2SV_ModStart> file -> size, sizeof buf )
Buggy code:
 static void sctp_generate_timeout_event ( struct sctp_association * asoc, sctp_event_timeout_t timeout_type ) { <START_BUG> struct net * net = sock_net ( asoc -> base. sk ) ; <END_BUG> int error = 0 ;  bh_lock_sock ( asoc -> base. sk ) ; <START_BUG> <END_BUG> if ( sock_owned_by_user ( asoc -> base. sk ) ) {  pr_debug ( "%s:   sock   is   busy:   timer   %d\\n", __func__, timeout_type ) ; if (! mod_timer ( & asoc -> timers [ timeout_type ], jiffies + ( HZ // 20 ) ) ) sctp_association_hold ( asoc ) ; goto out_unlock ; } if ( asoc -> base. dead ) goto out_unlock ; error = sctp_do_sm ( net, SCTP_EVENT_T_TIMEOUT, SCTP_ST_TIMEOUT ( timeout_type ), asoc -> state, asoc -> ep, asoc, ( void * ) timeout_type, GFP_ATOMIC ) ; if ( error ) <START_BUG> asoc -> base. sk -> sk_err = - error ; <END_BUG> out_unlock :  bh_unlock_sock ( asoc -> base. sk ) ; <START_BUG> sctp_association_put ( asoc ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { struct sock * sk = asoc -> base. sk ; struct <S2SV_ModStart> = sock_net ( <S2SV_ModEnd> sk ) ; <S2SV_ModStart> ; bh_lock_sock ( <S2SV_ModEnd> sk ) ; <S2SV_ModStart> ( sock_owned_by_user ( <S2SV_ModEnd> sk ) ) <S2SV_ModStart> ( error ) <S2SV_ModEnd> sk -> sk_err <S2SV_ModStart> : bh_unlock_sock ( <S2SV_ModEnd> sk ) ;
Buggy code:
 <START_BUG> static void <END_BUG> ip_printts ( netdissect_options * ndo, register const u_char * cp, u_int length ) { register u_int ptr ; register u_int len ; int hoplen ; const char * type ; if ( length < 4 ) { ND_PRINT ( ( ndo, "[bad   length   %u]", length ) ) ;  return ; <START_BUG> } ND_PRINT ( ( ndo, "   TS{" ) ) ; hoplen = ( ( cp [ 3 ] & 0xF )!= IPOPT_TS_TSONLY )? 8 : 4 ; if ( ( length - 4 ) & ( hoplen - 1 ) ) ND_PRINT ( ( ndo, "[bad   length   %u]", length ) ) ; <END_BUG> ptr = cp [ 2 ] - 1 ;  len = 0 ; if ( ptr < 4 || ( ( ptr - 4 ) & ( hoplen - 1 ) ) || ptr > length + 1 ) ND_PRINT ( ( ndo, "[bad   ptr   %u]", cp [ 2 ] ) ) ; <START_BUG> switch ( cp [ 3 ] & 0xF ) { <END_BUG> case IPOPT_TS_TSONLY : ND_PRINT ( ( ndo, "TSONLY" ) ) ; break ; case IPOPT_TS_TSANDADDR : ND_PRINT ( ( ndo, "TS+ADDR" ) ) ; break ; case 2 : ND_PRINT ( ( ndo, "PRESPEC2.0" ) ) ; break ; case 3 : ND_PRINT ( ( ndo, "PRESPEC" ) ) ; break ; default : ND_PRINT ( ( ndo, "[bad   ts   type   %d]", cp [ 3 ] & 0xF ) ) ; goto done ; } type = "   " ; for ( len = 4 ; len < length ; len += hoplen ) { if ( ptr == len )  type = "   ^   " ; <START_BUG> ND_PRINT ( ( ndo, "%s%d@%s", type, EXTRACT_32BITS ( & cp [ len + hoplen - 4 ] ), hoplen!= 8? "" : ipaddr_string ( ndo, & cp [ len ] ) ) ) ; type = "   " ; } done : ND_PRINT ( ( ndo<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> ip_printts ( netdissect_options <S2SV_ModStart> ) ; return ( 0 ) <S2SV_ModStart> ) ) ; ND_TCHECK ( cp [ 2 ] ) ; <S2SV_ModStart> ) ) ; ND_TCHECK ( cp [ 3 ] ) ; <S2SV_ModStart> type = " <S2SV_blank> ^ <S2SV_blank> " ; ND_TCHECK2 ( cp [ len ], hoplen ) <S2SV_ModStart> ) ) ; return ( 0 ) ; trunc : return ( - 1 ) ;
Buggy code:
 int obj2ast_arg ( PyObject * obj, arg_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; identifier arg ; expr_ty annotation ; string type_comment ; int lineno ; int col_offset ; <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_arg ) ) { <END_BUG> int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_arg ) ; if ( tmp == NULL ) goto failed ;  res = obj2ast_identifier ( tmp, & arg, arena ) ; <START_BUG> if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <END_BUG> } else {  PyErr_SetString ( PyExc_TypeError, "required   field   \\"arg\\"   missing   from   arg" ) ; return 1 ; } if ( exists_not_none ( obj, & PyId_annotation ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_annotation ) ; if ( tmp == NULL ) goto failed ; <START_BUG> res = obj2ast_expr ( tmp, & annotation, arena ) ; <END_BUG> if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ;  } else { <START_BUG> annotation = NULL ; } if ( exists_not_none ( obj, & PyId_type_comment ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_type_comment ) ; if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_string ( tmp, & type_comment, arena ) ;  if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { type_comment = NULL ; } if ( _PyObject_HasAttrId ( obj, & PyId_lineno ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_lineno ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   arg" ) ; return 1 ; } if ( _PyObject_HasAttrId

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_arg, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"arg\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> arg" ) ; return 1 ; } else { int res ; res = obj2ast_identifier ( tmp, & arg, arena ) ; if ( res!= 0 <S2SV_ModEnd> ) goto failed <S2SV_ModStart> goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id ( obj, & PyId_annotation, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; annotation = NULL ; } else { int res ; res = obj2ast_expr ( tmp, & annotation <S2SV_ModEnd>, arena ) <S2SV_ModStart> ) ; } if ( lookup_attr_id ( obj, & PyId_type_comment, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; type_comment = NULL ; } else {
Buggy code:
 PHP_FUNCTION ( imageconvolution ) { zval * SIM, * hash_matrix ; zval * * var = NULL, * * var2 = NULL ; gdImagePtr im_src = NULL ; double div, offset ; int nelem, i, j, res ; float matrix [ 3 ] [ 3 ] = { { 0, 0, 0 }, { 0, 0, 0 }, { 0, 0, 0 } } ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "radd", & SIM, & hash_matrix, & div, & offset ) == FAILURE ) { RETURN_FALSE ; } ZEND_FETCH_RESOURCE ( im_src, gdImagePtr, & SIM, - 1, "Image", le_gd ) ; nelem = zend_hash_num_elements ( Z_ARRVAL_P ( hash_matrix ) ) ; if ( nelem!= 3 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "You   must   have   3x3   array" ) ; RETURN_FALSE ; } for ( i = 0 ; i < 3 ; i ++ ) { if ( zend_hash_index_find ( Z_ARRVAL_P ( hash_matrix ), ( i ), ( void * * ) & var ) == SUCCESS && Z_TYPE_PP ( var ) == IS_ARRAY ) { if ( Z_TYPE_PP ( var )!= IS_ARRAY || zend_hash_num_elements ( Z_ARRVAL_PP ( var ) )!= 3 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "You   must   have   3x3   array" ) ; RETURN_FALSE ; } for ( j = 0 ; j < 3 ; j ++ ) { if ( zend_hash_index_find ( Z_ARRVAL_PP ( var ), ( j ), ( void * * ) & var2 ) == SUCCESS ) { <START_BUG> SEPARATE_ZVAL ( var2 ) ; <END_BUG>  convert_to_double ( * var2 ) ; <START_BUG> <END_BUG> matrix [ i ] [ j ] = ( float ) Z_DVAL_PP ( var2 ) ;  } else { <START_BUG> php_error_docref ( NULL TSRML<END_BUG>

Fix:
<S2SV_ModStart> SUCCESS ) { if ( Z_TYPE_PP <S2SV_ModEnd> ( var2 ) <S2SV_ModStart> ( var2 )!= IS_DOUBLE ) { zval dval ; dval = * * var ; zval_copy_ctor ( & dval ) <S2SV_ModStart> ; convert_to_double ( & dval ) ; matrix [ i ] [ j ] = ( float ) Z_DVAL ( dval ) ; } else { matrix [ i ] [ j ] = ( float ) Z_DVAL_PP ( <S2SV_ModEnd> var2 ) ; <S2SV_ModStart> var2 ) ; } } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "You <S2SV_blank> must <S2SV_blank> have <S2SV_blank> a <S2SV_blank> 3x3 <S2SV_blank> matrix" ) ; RETURN_FALSE ; } } } } res = gdImageConvolution ( im_src, matrix, <S2SV_ModEnd> ( float ) <S2SV_ModStart> ( float ) div, ( float ) offset ) ; if ( res ) { RETURN_TRUE <S2SV_ModEnd> ; } else <S2SV_ModStart> } else { <S2SV_ModEnd> RETURN_FALSE ; } <S2SV_ModStart> ; } } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int nfs3svc_decode_readargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd3_readargs * args ) { unsigned int len ; int v ; u32 max_blocksize = svc_max_payload ( rqstp ) ; p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; p = xdr_decode_hyper ( p, & args -> offset ) ; <START_BUG> args -> count = ntohl ( * p ++ ) ; <END_BUG> len = min ( args -> count, max_blocksize ) ; v = 0 ; while ( len > 0 ) { struct page * p = * ( rqstp -> rq_next_page ++ ) ; rqstp -> rq_vec [ v ]. iov_base = page_address ( p ) ; rqstp -> rq_vec [ v ]. iov_len = min_t ( unsigned int, len, PAGE_SIZE ) ; len -= rqstp -> rq_vec [ v ]. iov_len ; v ++ ; } args -> vlen = v ;  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> p ++ ) ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 <S2SV_ModStart> v ; return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static __be32 nfsd3_proc_setacl ( struct svc_rqst * rqstp, struct nfsd3_setaclargs * argp, struct nfsd3_attrstat * resp ) { struct inode * inode ; svc_fh * fh ; __be32 nfserr = 0 ; int error ; fh = fh_copy ( & resp -> fh, & argp -> fh ) ; nfserr = fh_verify ( rqstp, & resp -> fh, 0, NFSD_MAY_SATTR ) ; if ( nfserr ) goto out ; inode = d_inode ( fh -> fh_dentry ) ; <START_BUG> if (! IS_POSIXACL ( inode ) ||! inode -> i_op -> set_acl ) { <END_BUG> error = - EOPNOTSUPP ; goto out_errno ;  } <START_BUG> error = fh_want_write ( fh ) ; if ( error ) <END_BUG> goto out_errno ;  error = inode -> i_op -> set_acl ( inode, argp -> acl_access, ACL_TYPE_ACCESS ) ; if ( error ) goto out_drop_write ; <START_BUG> error = inode -> i_op -> set_acl ( inode, argp -> acl_default, <END_BUG> ACL_TYPE_DEFAULT ) ; out_drop_write : fh_drop_write ( fh ) ; out_errno : nfserr = nfserrno ( error ) ; out : posix_acl_release ( argp -> acl_access ) ; posix_acl_release ( argp -> acl_default ) ; RETURN_STATUS ( nfserr ) ; }

Fix:
<S2SV_ModStart> fh_dentry ) ; error = fh_want_write ( fh ) ; if ( error ) <S2SV_ModEnd> goto out_errno ; <S2SV_ModStart> goto out_errno ; fh_lock ( fh ) ; error = set_posix_acl ( inode, ACL_TYPE_ACCESS, argp -> acl_access <S2SV_ModEnd> ) ; if <S2SV_ModStart> error ) goto out_drop_lock ; error = set_posix_acl ( inode, ACL_TYPE_DEFAULT <S2SV_ModEnd>, argp -> <S2SV_ModStart> argp -> acl_default ) ; out_drop_lock : fh_unlock ( fh ) ; <S2SV_ModEnd> fh_drop_write ( fh
Buggy code:
 int evutil_parse_sockaddr_port ( const char * ip_as_string, struct sockaddr * out, int * outlen ) { int port ; char buf [ 128 ] ; const char * cp, * addr_part, * port_part ; int is_ipv6 ; cp = strchr ( ip_as_string, ':' ) ; if ( * ip_as_string == '[' ) { <START_BUG> int len ; <END_BUG> if (! ( cp = strchr ( ip_as_string, ']' ) ) ) { return - 1 ; }  len = ( int ) ( cp - ( ip_as_string + 1 ) ) ; <START_BUG> <END_BUG> if ( len > ( int ) sizeof ( buf ) - 1 ) {  return - 1 ; } memcpy ( buf, ip_as_string + 1, len ) ; buf [ len ] = '\\0' ; addr_part = buf ; if ( cp [ 1 ] == ':' ) port_part = cp + 2 ; else port_part = NULL ; is_ipv6 = 1 ; } else if ( cp && strchr ( cp + 1, ':' ) ) { is_ipv6 = 1 ; addr_part = ip_as_string ; port_part = NULL ; } else if ( cp ) { is_ipv6 = 0 ; if ( cp - ip_as_string > ( int ) sizeof ( buf ) - 1 ) { return - 1 ; } memcpy ( buf, ip_as_string, cp - ip_as_string ) ; buf [ cp - ip_as_string ] = '\\0' ; addr_part = buf ; port_part = cp + 1 ; } else { addr_part = ip_as_string ; port_part = NULL ; is_ipv6 = 0 ; } if ( port_part == NULL ) { port = 0 ; } else { port = atoi ( port_part ) ; if ( port <= 0 || port > 65535 ) { return - 1 ; } } if (! addr_part ) return - 1 ; # ifdef AF_INET6 if ( is_ipv6 ) { struct sockaddr_in6 sin6 ; memset ( & sin6, 0, sizeof ( sin6 ) ) ; # ifdef EVENT__HAVE_STRUCT_SOCKADDR_IN6_SIN6_LEN sin6. sin6_len = sizeof

Fix:
<S2SV_ModStart> '[' ) { size_t <S2SV_ModEnd> len ; if <S2SV_ModStart> } len = <S2SV_ModEnd> ( cp - <S2SV_ModStart> ( len > <S2SV_ModEnd> sizeof ( buf
Buggy code:
 <START_BUG> void nfs4_close_state ( struct path * path, struct nfs4_state * state, mode_t mode ) <END_BUG> {  __nfs4_close ( path, state, mode, 0 ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * state, fmode_t fmode <S2SV_ModEnd> ) { __nfs4_close <S2SV_ModStart>, state, fmode <S2SV_ModEnd>, 0 )
Buggy code:
 static ssize_t _epoll_read ( oe_fd_t * epoll_, void * buf, size_t count ) { ssize_t ret = - 1 ; epoll_t * file = _cast_epoll ( epoll_ ) ; oe_errno = 0 ; <START_BUG> if (! file ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( oe_syscall_read_ocall ( & ret, file -> host_fd, buf, count )!= OE_OK ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> (! file || count > OE_SSIZE_MAX <S2SV_ModStart> OE_EINVAL ) ; if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 krb5_error_code process_tgs_req ( struct server_handle * handle, krb5_data * pkt, const krb5_fulladdr * from, krb5_data * * response ) { krb5_keyblock * subkey = 0 ; krb5_keyblock * header_key = NULL ; krb5_kdc_req * request = 0 ; krb5_db_entry * server = NULL ; krb5_db_entry * stkt_server = NULL ; krb5_kdc_rep reply ; krb5_enc_kdc_rep_part reply_encpart ; krb5_ticket ticket_reply, * header_ticket = 0 ; int st_idx = 0 ; krb5_enc_tkt_part enc_tkt_reply ; int newtransited = 0 ; krb5_error_code retval = 0 ; krb5_keyblock encrypting_key ; krb5_timestamp kdc_time, authtime = 0 ; krb5_keyblock session_key ; krb5_keyblock * reply_key = NULL ; krb5_key_data * server_key ; krb5_principal cprinc = NULL, sprinc = NULL, altcprinc = NULL ; krb5_last_req_entry * nolrarray [ 2 ], nolrentry ; int errcode ; const char * status = 0 ; krb5_enc_tkt_part * header_enc_tkt = NULL ; krb5_enc_tkt_part * subject_tkt = NULL ; krb5_db_entry * client = NULL, * header_server = NULL ; krb5_db_entry * local_tgt, * local_tgt_storage = NULL ; krb5_pa_s4u_x509_user * s4u_x509_user = NULL ; krb5_authdata * * kdc_issued_auth_data = NULL ; unsigned int c_flags = 0, s_flags = 0 ; krb5_boolean is_referral ; const char * emsg = NULL ; krb5_kvno ticket_kvno = 0 ; struct kdc_request_state * state = NULL ; krb5_pa_data *

Fix:
<S2SV_ModStart> ; cleanup : if ( status == NULL ) status = "UNKNOWN_REASON" <S2SV_ModEnd> ; if (
Buggy code:
 WORD32 ih264d_parse_bslice ( dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice ) { dec_pic_params_t * ps_pps = ps_dec -> ps_cur_pps ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD8 u1_ref_idx_re_flag_lx ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD32 u4_temp, ui_temp1 ; WORD32 i_temp ; WORD32 ret ; { WORD8 * pi1_buf ; WORD16 * pi2_mv = ps_dec -> s_default_mv_pred. i2_mv ; WORD32 * pi4_mv = ( WORD32 * ) pi2_mv ; WORD16 * pi16_refFrame ; pi1_buf = ps_dec -> s_default_mv_pred. i1_ref_frame ; pi16_refFrame = ( WORD16 * ) pi1_buf ; * pi4_mv = 0 ; * ( pi4_mv + 1 ) = 0 ; * pi16_refFrame = OUT_OF_RANGE_REF ; ps_dec -> s_default_mv_pred. u1_col_ref_pic_idx = ( UWORD8 ) - 1 ; ps_dec -> s_default_mv_pred. u1_pic_type = ( UWORD8 ) - 1 ; } ps_slice -> u1_num_ref_idx_active_override_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; COPYTHECONTEXT ( "SH:   num_ref_idx_override_flag", ps_slice -> u1_num_ref_idx_active_override_flag ) ; u4_temp = ps_dec -> ps_cur_pps -> u1_num_ref_idx_lx_active [ 0 ] ; ui_temp1 =

Fix:
<S2SV_ModStart> -> u1_dpb_commands_read ) { i_temp = ih264d_read_mmco_commands ( ps_dec ) ; if ( i_temp < 0 ) { return ERROR_DBP_MANAGER_T ; } <S2SV_ModStart> -> u4_bitoffset = i_temp ; } <S2SV_ModEnd> else ps_bitstrm ->