nus-yam/ex-repair huggingface dataset:
Buggy code:
 int ppp_register_net_channel ( struct net * net, struct ppp_channel * chan ) { struct channel * pch ; struct ppp_net * pn ; pch = kzalloc ( sizeof ( struct channel ), GFP_KERNEL ) ; if (! pch ) return - ENOMEM ; pn = ppp_pernet ( net ) ; pch -> ppp = NULL ; pch -> chan = chan ; <START_BUG> pch -> chan_net = net ; <END_BUG> chan -> ppp = pch ; init_ppp_file ( & pch -> file, CHANNEL ) ; pch -> file. hdrlen = chan -> hdrlen ; # ifdef CONFIG_PPP_MULTILINK pch -> lastseq = - 1 ; # endif init_rwsem ( & pch -> chan_sem ) ; spin_lock_init ( & pch -> downl ) ; rwlock_init ( & pch -> upl ) ; spin_lock_bh ( & pn -> all_channels_lock ) ; pch -> file. index = ++ pn -> last_channel_index ; list_add ( & pch -> list, & pn -> new_channels ) ; atomic_inc ( & channel_count ) ; spin_unlock_bh ( & pn -> all_channels_lock ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> chan_net = get_net ( net ) <S2SV_ModEnd> ; chan ->
Buggy code:
 kadm5_ret_t kadm5_create_principal_3 ( void * server_handle, kadm5_principal_ent_t entry, long mask, int n_ks_tuple, krb5_key_salt_tuple * ks_tuple, char * password ) { krb5_db_entry * kdb ; osa_princ_ent_rec adb ; kadm5_policy_ent_rec polent ; krb5_boolean have_polent = FALSE ; krb5_int32 now ; krb5_tl_data * tl_data_tail ; unsigned int ret ; kadm5_server_handle_t handle = server_handle ; krb5_keyblock * act_mkey ; krb5_kvno act_kvno ; int new_n_ks_tuple = 0 ; krb5_key_salt_tuple * new_ks_tuple = NULL ; CHECK_HANDLE ( server_handle ) ; krb5_clear_error_message ( handle -> context ) ; check_1_6_dummy ( entry, mask, n_ks_tuple, ks_tuple, & password ) ; <START_BUG> if (! ( mask & KADM5_PRINCIPAL ) || ( mask & KADM5_MOD_NAME ) || <END_BUG> ( mask & KADM5_MOD_TIME ) || ( mask & KADM5_LAST_PWD_CHANGE ) || ( mask & KADM5_MKVNO ) || ( mask & KADM5_AUX_ATTRIBUTES ) || ( mask & KADM5_LAST_SUCCESS ) || ( mask & KADM5_LAST_FAILED ) || ( mask & KADM5_FAIL_AUTH_COUNT ) ) return KADM5_BAD_MASK ; if ( ( mask & KADM5_KEY_DATA ) && entry -> n_key_data!= 0 ) return KADM5_BAD_MASK ;  if ( ( mask & KADM5_POLICY ) && ( mask & KADM5_POLICY_CLR ) ) <START_BUG> return KADM5_BAD_MASK ; <END_BUG> if ( ( mask & ~ ALL_PRINC_MASK ) )  <START_BUG> return KADM5_BAD_MASK ; <END_BUG> if ( entry == NULL ) return EINVAL ; ret =

Fix:
<S2SV_ModStart> ; if ( entry == NULL ) return EINVAL ; if ( <S2SV_ModStart> KADM5_POLICY ) && entry -> policy == NULL <S2SV_ModEnd> ) return KADM5_BAD_MASK <S2SV_ModStart> ( mask & KADM5_POLICY ) && ( mask & KADM5_POLICY_CLR ) ) return KADM5_BAD_MASK ; if ( ( mask & <S2SV_ModStart> ) return KADM5_BAD_MASK <S2SV_ModEnd> ; ret =
Buggy code:
 STATIC int xfs_ioctl_setattr ( xfs_inode_t * ip, struct fsxattr * fa, int mask ) { struct xfs_mount * mp = ip -> i_mount ; struct xfs_trans * tp ; unsigned int lock_flags = 0 ; struct xfs_dquot * udqp = NULL ; struct xfs_dquot * pdqp = NULL ; struct xfs_dquot * olddquot = NULL ; int code ; trace_xfs_ioctl_setattr ( ip ) ; if ( mp -> m_flags & XFS_MOUNT_RDONLY ) return XFS_ERROR ( EROFS ) ; if ( XFS_FORCED_SHUTDOWN ( mp ) ) return XFS_ERROR ( EIO ) ; if ( ( mask & FSX_PROJID ) && ( fa -> fsx_projid > ( __uint16_t ) - 1 ) &&! xfs_sb_version_hasprojid32bit ( & ip -> i_mount -> m_sb ) ) return XFS_ERROR ( EINVAL ) ; if ( XFS_IS_QUOTA_ON ( mp ) && ( mask & FSX_PROJID ) ) { code = xfs_qm_vop_dqalloc ( ip, ip -> i_d. di_uid, ip -> i_d. di_gid, fa -> fsx_projid, XFS_QMOPT_PQUOTA, & udqp, NULL, & pdqp ) ; if ( code ) return code ; } tp = xfs_trans_alloc ( mp, XFS_TRANS_SETATTR_NOT_SIZE ) ; code = xfs_trans_reserve ( tp, & M_RES ( mp ) -> tr_ichange, 0, 0 ) ; if ( code ) goto error_return ; lock_flags = XFS_ILOCK_EXCL ; xfs_ilock ( ip, lock_flags ) ; if (! inode_owner_or_capable ( VFS_I ( ip ) ) ) { code = XFS_ERROR ( EPERM ) ; goto error_return ; } if ( mask & FSX_PROJID ) { if ( current_user_ns ( )!= & init_user_ns ) { code = XFS_ERROR ( E

Fix:
<S2SV_ModStart> ) &&! capable_wrt_inode_uidgid <S2SV_ModEnd> ( VFS_I (
Buggy code:
 static inline size_t GetPSDRowSize ( Image * image ) { if ( image -> depth == 1 ) <START_BUG> return ( ( image -> columns + 7 ) // 8 ) ; <END_BUG> else return ( image -> columns * GetPSDPacketSize ( image ) ) ; }

Fix:
<S2SV_ModStart> return ( ( ( <S2SV_ModStart> ) // 8 ) * GetPSDPacketSize ( image )
Buggy code:
 static void nodeConstruct ( struct SaveNode * node, tr_variant const * v, bool sort_dicts ) { node -> isVisited = false ; node -> childIndex = 0 ; if ( sort_dicts && tr_variantIsDict ( v ) ) { size_t const n = v -> val. l. count ; struct KeyIndex * tmp = tr_new ( struct KeyIndex, n ) ; for ( size_t i = 0 ; i < n ; i ++ ) { tmp [ i ]. val = v -> val. l. vals + i ; tmp [ i ]. keystr = tr_quark_get_string ( tmp [ i ]. val -> key, NULL ) ; } qsort ( tmp, n, sizeof ( struct KeyIndex ), compareKeyIndex ) ; <START_BUG> tr_variantInitDict ( & node -> sorted, n ) ; <END_BUG> for ( size_t i = 0 ; i < n ; ++ i ) {  node -> sorted. val. l. vals [ i ] = * tmp [ i ]. val ; <START_BUG> } <END_BUG> node -> sorted. val. l. count = n ;  tr_free ( tmp ) ; <START_BUG> node -> v = & node -> sorted ; <END_BUG> } else {  node -> v = v ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> compareKeyIndex ) ; node -> sorted = tr_new ( tr_variant, 1 ) ; tr_variantInitDict ( <S2SV_ModEnd> node -> sorted <S2SV_ModStart> node -> sorted -> <S2SV_ModEnd> val. l <S2SV_ModStart> node -> sorted -> <S2SV_ModEnd> val. l <S2SV_ModStart> tmp ) ; v = <S2SV_ModEnd> node -> sorted <S2SV_ModStart> { node -> sorted = NULL ; } node -> v = v ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static int <START_BUG> mptctl_hp_targetinfo ( unsigned long arg ) <END_BUG> { hp_target_info_t __user * uarg = ( void __user * ) arg ; SCSIDevicePage0_t * pg0_alloc ; SCSIDevicePage3_t * pg3_alloc ;  MPT_ADAPTER * ioc ; <START_BUG> MPT_SCSI_HOST * hd = NULL ; <END_BUG> hp_target_info_t karg ;  int iocnum ; int data_sz ; dma_addr_t page_dma ; CONFIGPARMS cfg ; ConfigPageHeader_t hdr ; int tmp, np, rc = 0 ; if ( copy_from_user ( & karg, uarg, sizeof ( hp_target_info_t ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_hp_targetinfo   -   " "Unable   to   read   in   hp_host_targetinfo   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; return - EFAULT ; } <START_BUG> if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || <END_BUG>  ( ioc == NULL ) ) { <START_BUG> printk ( KERN_DEBUG MYNAM "%s::mptctl_hp_targetinfo()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; <END_BUG> }  if ( karg. hdr. id >= MPT_MAX_FC_DEVICES ) return - EINVAL ; dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo   called.\\n", ioc -> name ) ) ; if ( ( ioc -> bus_type == SAS ) || ( ioc -> bus_type == FC ) ) return 0 ; if ( ( ioc -> spi_data. sdp0length == 0 ) || ( ioc -> sh == NULL ) ) return 0 ; if ( ioc -> sh -> host_no!= karg. hdr. host ) return - ENODEV ; data_sz = ioc -> spi_data. sdp0length

Fix:
<S2SV_ModStart> int mptctl_hp_targetinfo ( MPT_ADAPTER * ioc, <S2SV_ModStart> * pg3_alloc ; <S2SV_ModEnd> MPT_SCSI_HOST * hd <S2SV_ModStart> ; hp_target_info_t karg <S2SV_ModEnd> ; int data_sz <S2SV_ModStart> } if ( karg. hdr. id >= MPT_MAX_FC_DEVICES ) return - EINVAL ; dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo <S2SV_blank> called.\\n", ioc -> name ) ) ; if ( ( ioc -> bus_type == SAS ) || ( ioc -> bus_type == FC ) ) return 0 ; if ( ( ioc -> spi_data. sdp0length == 0 ) || ( ioc -> sh <S2SV_ModEnd> == NULL ) <S2SV_ModStart> NULL ) ) return 0 ; if ( ioc -> sh -> host_no!= karg. hdr. host ) <S2SV_ModEnd> return - ENODEV <S2SV_ModStart> - ENODEV ; <S2SV_ModEnd> data_sz = ioc
Buggy code:
 <START_BUG> int parse_rock_ridge_inode ( struct iso_directory_record * de, struct inode * inode ) <END_BUG> {  int result = parse_rock_ridge_inode_internal ( de, inode, 0 ) ; <START_BUG> if ( ( ISOFS_SB ( inode -> i_sb ) -> s_rock_offset == - 1 ) && ( ISOFS_SB ( inode -> i_sb ) -> s_rock == 2 ) ) { <END_BUG> result = parse_rock_ridge_inode_internal ( de, inode, 14 ) ;  } return result ; }

Fix:
<S2SV_ModStart> inode * inode, int relocated ) { int flags = relocated? RR_RELOC_DE : 0 ; <S2SV_ModEnd> int result = <S2SV_ModStart>, inode, flags <S2SV_ModEnd> ) ; if <S2SV_ModStart>, inode, flags | RR_REGARD_XA <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> static MB_PREDICTION_MODE read_intra_mode ( vp9_reader * r, const vp9_prob * p ) { <END_BUG>  return ( MB_PREDICTION_MODE ) vp9_read_tree ( r, vp9_intra_mode_tree, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static PREDICTION_MODE read_intra_mode ( vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> r, const vpx_prob <S2SV_ModEnd> * p ) <S2SV_ModStart> { return ( PREDICTION_MODE ) vpx_read_tree <S2SV_ModEnd> ( r,
Buggy code:
 static ssize_t k90_show_current_profile ( struct device * dev, struct device_attribute * attr, char * buf ) { int ret ; struct usb_interface * usbif = to_usb_interface ( dev -> parent ) ; struct usb_device * usbdev = interface_to_usbdev ( usbif ) ; int current_profile ; <START_BUG> char data [ 8 ] ; <END_BUG> ret = usb_control_msg ( usbdev, usb_rcvctrlpipe ( usbdev, 0 ), K90_REQUEST_STATUS, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, 0, data, 8, USB_CTRL_SET_TIMEOUT ) ; if ( ret < 0 ) { dev_warn ( dev, "Failed   to   get   K90   initial   state   (error   %d).\\n", ret ) ;  return - EIO ; <START_BUG> } current_profile = data [ 7 ] ; if ( current_profile < 1 || current_profile > 3 ) { dev_warn ( dev, "Read   invalid   current   profile:   %02hhx.\\n", data [ 7 ] ) ; <END_BUG> return - EIO ;  <START_BUG> } <END_BUG> return snprintf ( buf, PAGE_SIZE, "%d\\n", current_profile ) ; }

Fix:
<S2SV_ModStart> current_profile ; char * data ; data = kmalloc ( 8, GFP_KERNEL ) ; if (! data ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart> ret ) ; ret = - EIO ; goto out <S2SV_ModEnd> ; } current_profile <S2SV_ModStart> ] ) ; ret = <S2SV_ModEnd> - EIO ; <S2SV_ModStart> - EIO ; goto out ; } ret = snprintf ( buf, PAGE_SIZE, "%d\\n", current_profile ) ; out : kfree ( data ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int ovl_remove_upper ( struct dentry * dentry, bool is_dir ) { struct dentry * upperdir = ovl_dentry_upper ( dentry -> d_parent ) ; struct inode * dir = upperdir -> d_inode ; <START_BUG> struct dentry * upper = ovl_dentry_upper ( dentry ) ; <END_BUG> int err ; inode_lock_nested ( dir, I_MUTEX_PARENT ) ;  err = - ESTALE ; <START_BUG> <END_BUG> if ( upper -> d_parent == upperdir ) {  dget ( upper ) ; if ( is_dir ) err = vfs_rmdir ( dir, upper ) ; else err = vfs_unlink ( dir, upper, NULL ) ; <START_BUG> dput ( upper ) ; <END_BUG> ovl_dentry_version_inc ( dentry -> d_parent ) ;  } <START_BUG> if (! err ) d_drop ( dentry ) ; <END_BUG> inode_unlock ( dir ) ;  return err ; }

Fix:
<S2SV_ModStart> dentry * upper <S2SV_ModEnd> ; int err <S2SV_ModStart> I_MUTEX_PARENT ) ; upper = lookup_one_len ( dentry -> d_name. name, upperdir, dentry -> d_name. len ) ; err = PTR_ERR ( upper ) ; if ( IS_ERR ( upper ) ) goto out_unlock ; <S2SV_ModStart> if ( upper == ovl_dentry_upper ( dentry ) ) { <S2SV_ModEnd> if ( is_dir <S2SV_ModStart> NULL ) ; <S2SV_ModEnd> ovl_dentry_version_inc ( dentry <S2SV_ModStart> ) ; } dput ( upper ) ; <S2SV_ModStart> dentry ) ; out_unlock :
Buggy code:
 SYSCALL_DEFINE5 ( waitid, int, which, pid_t, upid, struct siginfo __user *, infop, int, options, struct rusage __user *, ru ) { struct rusage r ; struct waitid_info info = {. status = 0 } ; long err = kernel_waitid ( which, upid, & info, options, ru? & r : NULL ) ; int signo = 0 ; if ( err > 0 ) { signo = SIGCHLD ; err = 0 ; <START_BUG> } <END_BUG> if (! err ) { if ( ru && copy_to_user ( ru, & r, sizeof ( struct rusage ) ) ) return - EFAULT ; } if (! infop ) return err ; user_access_begin ( ) ; unsafe_put_user ( signo, & infop -> si_signo, Efault ) ; unsafe_put_user ( 0, & infop -> si_errno, Efault ) ; unsafe_put_user ( info. cause, & infop -> si_code, Efault ) ; unsafe_put_user ( info. pid, & infop -> si_pid, Efault ) ; unsafe_put_user ( info. uid, & infop -> si_uid, Efault ) ; unsafe_put_user ( info. status, & infop -> si_status, Efault ) ; user_access_end ( ) ; return err ; Efault : user_access_end ( ) ; return - EFAULT ; }

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( ru
Buggy code:
 int bson_check_string ( bson * b, const char * string, <START_BUG> const int length ) { <END_BUG> return bson_validate_string ( b, ( const unsigned char * ) string, length, 1, 0, 0 ) ; }

Fix:
<S2SV_ModStart> string, const size_t <S2SV_ModEnd> length ) {
Buggy code:
 static int dispatch_discard_io ( struct xen_blkif * blkif, struct blkif_request * req ) { int err = 0 ; int status = BLKIF_RSP_OKAY ; struct block_device * bdev = blkif -> vbd. bdev ; unsigned long secure ; <START_BUG> blkif -> st_ds_req ++ ; <END_BUG> xen_blkif_get ( blkif ) ; secure = ( blkif -> vbd. discard_secure && ( req -> u. discard. flag & BLKIF_DISCARD_SECURE ) )? BLKDEV_DISCARD_SECURE : 0 ; err = blkdev_issue_discard ( bdev, req -> u. discard. sector_number, req -> u. discard. nr_sectors, GFP_KERNEL, secure ) ;  if ( err == - EOPNOTSUPP ) { <START_BUG> pr_debug ( DRV_PFX "discard   op   failed,   not   supported\\n" ) ; status = BLKIF_RSP_EOPNOTSUPP ; } else if ( err ) status = BLKIF_RSP_ERROR ; make_response ( blkif, req -> u. discard. id, req -> operation, status ) ; xen_blkif_put ( blkif ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> long secure ; struct phys_req preq ; preq. sector_number = req -> u. discard. sector_number ; preq. nr_sects = req -> u. discard. nr_sectors ; err = xen_vbd_translate ( & preq, blkif, WRITE ) ; if ( err ) { pr_warn ( DRV_PFX "access <S2SV_blank> denied: <S2SV_blank> DISCARD <S2SV_blank> [%llu->%llu] <S2SV_blank> on <S2SV_blank> dev=%04x\\n", preq. sector_number, preq. sector_number + preq. nr_sects, blkif -> vbd. pdevice ) ; goto fail_response ; } <S2SV_ModStart> secure ) ; fail_response :
Buggy code:
 key_ref_t keyring_search ( key_ref_t keyring, struct key_type * type, const char * description ) { struct keyring_search_context ctx = {. index_key. type = type,. index_key. description = description,. cred = current_cred ( ), <START_BUG>. match_data. cmp = type -> match, <END_BUG>. match_data. raw_data = description,. match_data. lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,. flags = KEYRING_SEARCH_DO_STATE_CHECK, } ; key_ref_t key ;  int ret ; <START_BUG> if (! ctx. match_data. cmp ) return ERR_PTR ( - ENOKEY ) ; if ( type -> match_preparse ) { ret = type -> match_preparse ( & ctx. match_data ) ; if ( ret < 0 ) return ERR_PTR ( ret ) ; } key = keyring_search_aux ( keyring, & ctx ) ; if ( type -> match_free ) type -> match_free ( & ctx. match_data ) ; return key ; }<END_BUG>

Fix:
<S2SV_ModStart>. cmp = key_default_cmp <S2SV_ModEnd>,. match_data <S2SV_ModStart> ; int ret <S2SV_ModEnd> ; if (
Buggy code:
 SECURITY_STATUS ntlm_read_NegotiateMessage ( NTLM_CONTEXT * context, PSecBuffer buffer ) { wStream * s ; size_t length ; NTLM_NEGOTIATE_MESSAGE * message ; message = & context -> NEGOTIATE_MESSAGE ; ZeroMemory ( message, sizeof ( NTLM_NEGOTIATE_MESSAGE ) ) ; s = Stream_New ( ( BYTE * ) buffer -> pvBuffer, buffer -> cbBuffer ) ; if (! s ) return SEC_E_INTERNAL_ERROR ; if ( ntlm_read_message_header ( s, ( NTLM_MESSAGE_HEADER * ) message ) < 0 ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( message -> MessageType!= MESSAGE_TYPE_NEGOTIATE ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } <START_BUG> Stream_Read_UINT32 ( s, message -> NegotiateFlags ) ; <END_BUG> if (! ( ( message -> NegotiateFlags & NTLMSSP_REQUEST_TARGET ) && ( message -> NegotiateFlags & NTLMSSP_NEGOTIATE_NTLM ) && ( message -> NegotiateFlags & NTLMSSP_NEGOTIATE_UNICODE ) ) ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } context -> NegotiateFlags = message -> NegotiateFlags ; if ( ntlm_read_message_fields ( s, & ( message -> DomainName ) ) < 0 ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( ntlm_read_message_fields ( s, & ( message -> Workstation ) ) < 0 ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } if ( message -> NegotiateFlags & NTLMSSP_NEGOTIATE_VERSION ) { if ( ntlm_read_version_info ( s, & ( message -> Version ) ) < 0 ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; } } length = Stream_GetPosition ( s ) ; buffer -> cbBuffer = length ; if

Fix:
<S2SV_ModStart> SEC_E_INVALID_TOKEN ; } if ( Stream_GetRemainingLength ( s ) < 4 ) { Stream_Free ( s, FALSE ) ; return SEC_E_INVALID_TOKEN ; }
Buggy code:
 R_API int r_core_bin_set_env ( RCore * r, RBinFile * binfile ) { RBinObject * binobj = binfile? binfile -> o : NULL ; RBinInfo * info = binobj? binobj -> info : NULL ; if ( info ) { int va = info -> has_va ; <START_BUG> const char * arch = info -> arch ; <END_BUG> ut16 bits = info -> bits ; ut64 baseaddr = r_bin_get_baddr ( r -> bin ) ; r_config_set_i ( r -> config, "io.va", ( binobj -> info )? binobj -> info -> has_va : 0 ) ; r_config_set_i ( r -> config, "bin.baddr", baseaddr ) ; r_config_set ( r -> config, "asm.arch", arch ) ; r_config_set_i ( r -> config, "asm.bits", bits ) ; r_config_set ( r -> config, "anal.arch", arch ) ;  if ( info -> cpu && * info -> cpu ) { <START_BUG> <END_BUG> r_config_set ( r -> config, "anal.cpu", info -> cpu ) ;  } else { r_config_set ( r -> config, "anal.cpu", arch ) ; } r_asm_use ( r -> assembler, arch ) ; r_core_bin_info ( r, R_CORE_BIN_ACC_ALL, R_CORE_BIN_SET, va, NULL, NULL ) ; <START_BUG> r_core_bin_set_cur ( r, binfile ) ; <END_BUG> return true ; } return false ; }

Fix:
<S2SV_ModStart> -> has_va ; <S2SV_ModEnd> char * arch <S2SV_ModStart> * arch = strdup ( info -> arch ) ; char * cpu = info -> cpu? strdup ( info -> cpu ) : NULL <S2SV_ModEnd> ; ut16 bits <S2SV_ModStart> ; if ( <S2SV_ModEnd> cpu && * <S2SV_ModStart> cpu && * <S2SV_ModEnd> cpu ) { <S2SV_ModStart>, "anal.cpu", <S2SV_ModEnd> cpu ) ; <S2SV_ModStart> r, binfile ) ; free ( cpu ) ; free ( arch
Buggy code:
 int xfs_setattr_nonsize ( struct xfs_inode * ip, struct iattr * iattr, int flags ) { xfs_mount_t * mp = ip -> i_mount ; struct inode * inode = VFS_I ( ip ) ; int mask = iattr -> ia_valid ; xfs_trans_t * tp ; int error ; kuid_t uid = GLOBAL_ROOT_UID, iuid = GLOBAL_ROOT_UID ; kgid_t gid = GLOBAL_ROOT_GID, igid = GLOBAL_ROOT_GID ; struct xfs_dquot * udqp = NULL, * gdqp = NULL ; struct xfs_dquot * olddquot1 = NULL, * olddquot2 = NULL ; ASSERT ( ( mask & ATTR_SIZE ) == 0 ) ; if ( XFS_IS_QUOTA_ON ( mp ) && ( mask & ( ATTR_UID | ATTR_GID ) ) ) { uint qflags = 0 ; if ( ( mask & ATTR_UID ) && XFS_IS_UQUOTA_ON ( mp ) ) { uid = iattr -> ia_uid ; qflags |= XFS_QMOPT_UQUOTA ; } else { uid = inode -> i_uid ; } if ( ( mask & ATTR_GID ) && XFS_IS_GQUOTA_ON ( mp ) ) { gid = iattr -> ia_gid ; qflags |= XFS_QMOPT_GQUOTA ; } else { gid = inode -> i_gid ; } ASSERT ( udqp == NULL ) ; ASSERT ( gdqp == NULL ) ; error = xfs_qm_vop_dqalloc ( ip, xfs_kuid_to_uid ( uid ), xfs_kgid_to_gid ( gid ), xfs_get_projid ( ip ), qflags, & udqp, & gdqp, NULL ) ; if ( error ) return error ; } error = xfs_trans_alloc ( mp, & M_RES ( mp ) -> tr_ichange, 0, 0, 0, & tp ) ; if ( error ) goto out_dqrele ; xfs_ilock ( ip, XFS_ILOCK_EXCL ) ; xfs_trans_ijoin ( tp, ip, 0 ) ; if ( mask &

Fix:
<S2SV_ModStart> tp ) ; xfs_iunlock ( ip, XFS_ILOCK_EXCL ) ;
Buggy code:
 generic_ret * chpass_principal3_2_svc ( chpass3_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) ) { ret. code = chpass_principal_wrapper_3 ( ( void * ) handle, arg -> princ, arg -> keepold, arg -> n_ks_tuple, arg -> ks_tuple, arg -> pass ) ; } else if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_CHANGEPW, arg -> princ, NULL ) ) { ret. code = kadm5_chpass_principal_3 ( ( void * ) handle, arg -> princ, arg -> keepold, arg -> n_ks_tuple, arg -> ks_tuple, arg -> pass ) ; } else { log_unauth ( "kadm5_chpass_principal", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_CHANGEPW ; } if ( ret. code!= KADM5_

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 struct net * get_net_ns_by_id ( struct net * net, int id ) { struct net * peer ; if ( id < 0 ) return NULL ; rcu_read_lock ( ) ; spin_lock_bh ( & net -> nsid_lock ) ; peer = idr_find ( & net -> netns_ids, id ) ; if ( peer ) <START_BUG> get_net ( peer ) ; <END_BUG> spin_unlock_bh ( & net -> nsid_lock ) ; rcu_read_unlock ( ) ; return peer ; }

Fix:
<S2SV_ModStart> ( peer ) peer = maybe_get_net <S2SV_ModEnd> ( peer )
Buggy code:
 asmlinkage long compat_sys_recvmmsg ( int fd, struct compat_mmsghdr __user * mmsg, unsigned int vlen, unsigned int flags, struct compat_timespec __user * timeout ) { int datagrams ; struct timespec ktspec ; if ( flags & MSG_CMSG_COMPAT ) return - EINVAL ; <START_BUG> if ( COMPAT_USE_64BIT_TIME ) <END_BUG> return __sys_recvmmsg ( fd, ( struct mmsghdr __user * ) mmsg, vlen, flags | MSG_CMSG_COMPAT, ( struct timespec * ) timeout ) ; if ( timeout == NULL ) return __sys_recvmmsg ( fd, ( struct mmsghdr __user * ) mmsg, vlen, flags | MSG_CMSG_COMPAT, NULL ) ;  if ( get_compat_timespec ( & ktspec, timeout ) ) <START_BUG> return - EFAULT ; datagrams = __sys_recvmmsg ( fd, ( struct mmsghdr __user * ) mmsg, vlen, flags | MSG_CMSG_COMPAT, & ktspec ) ; <END_BUG> if ( datagrams > 0 && put_compat_timespec ( & ktspec, timeout ) )  datagrams = - EFAULT ; return datagrams ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> timeout == NULL <S2SV_ModStart> ; if ( compat_get_timespec <S2SV_ModEnd> ( & ktspec <S2SV_ModStart> > 0 && compat_put_timespec <S2SV_ModEnd> ( & ktspec
Buggy code:
 void show_object_with_name ( FILE * out, struct object * obj, <START_BUG> struct strbuf * path, const char * component ) <END_BUG> { char * name = path_name ( path, component ) ; char * p ; fprintf ( out, "%s   ", oid_to_hex ( & obj -> oid ) ) ; for ( p = name ; * p && * p!= '\\n' ; p ++ ) fputc ( * p, out ) ; fputc ( '\\n', out ) ;  free ( name ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * obj, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name ) { const <S2SV_ModEnd> char * p <S2SV_ModStart> out ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 <START_BUG> static void nsc_rle_decompress_data ( NSC_CONTEXT * context ) <END_BUG> { UINT16 i ; BYTE * rle ; UINT32 planeSize ; UINT32 originalSize ;  rle = context -> Planes ; <START_BUG> for ( i = 0 ; i < 4 ; i ++ ) { originalSize = context -> OrgByteCount [ i ] ; planeSize = context -> PlaneByteCount [ i ] ; if ( planeSize == 0 ) <END_BUG> FillMemory ( context -> priv -> PlaneBuffers [ i ], originalSize, 0xFF ) ;  <START_BUG> else if ( planeSize < originalSize ) <END_BUG>  nsc_rle_decode ( rle, context -> priv -> PlaneBuffers [ i ], originalSize ) ; <START_BUG> else CopyMemory ( context -> priv -> PlaneBuffers [ i ], rle, originalSize ) ; <END_BUG> rle += planeSize ;  } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> nsc_rle_decompress_data ( NSC_CONTEXT <S2SV_ModStart> UINT32 originalSize ; if (! context ) return FALSE ; <S2SV_ModStart> == 0 ) { if ( context -> priv -> PlaneBuffersLength < originalSize ) return FALSE ; <S2SV_ModStart> 0xFF ) ; } <S2SV_ModStart> < originalSize ) { if (! <S2SV_ModStart> i ], context -> priv -> PlaneBuffersLength, originalSize ) ) return FALSE ; } else { if ( context -> priv -> PlaneBuffersLength < originalSize ) return FALSE ; <S2SV_ModEnd> CopyMemory ( context <S2SV_ModStart> originalSize ) ; } <S2SV_ModStart> planeSize ; } return TRUE ;
Buggy code:
 static apr_status_t parse_chunk_size ( http_ctx_t * ctx, const char * buffer, apr_size_t len, int linelimit ) { apr_size_t i = 0 ; while ( i < len ) { char c = buffer [ i ] ; ap_xlate_proto_from_ascii ( & c, 1 ) ; <START_BUG> if ( ctx -> state == BODY_CHUNK_END ) { <END_BUG> if ( c == LF ) {  ctx -> state = BODY_CHUNK ; <START_BUG> } i ++ ; continue ; } if ( ctx -> state == BODY_CHUNK ) { if (! apr_isxdigit ( c ) ) { <END_BUG> return APR_EGENERAL ;  } else { ctx -> state = BODY_CHUNK_PART ; } ctx -> remaining = 0 ; <START_BUG> ctx -> chunkbits = sizeof ( long ) * 8 ; <END_BUG> ctx -> chunk_used = 0 ; }  if ( c == ';' || c == CR ) { <START_BUG> ctx -> state = BODY_CHUNK_EXT ; } <END_BUG> else if ( c == LF ) {  if ( ctx -> remaining ) { ctx -> state = BODY_CHUNK_DATA ; } else { ctx -> state = BODY_CHUNK_TRAILER ; } } else if ( ctx -> state!= BODY_CHUNK_EXT ) { <START_BUG> int xvalue = 0 ; <END_BUG> if (! ctx -> remaining && c == '0' ) { i ++ ;  continue ; <START_BUG> } if ( c >= '0' && c <= '9' ) { xvalue = c - '0' ; } else if ( c >= 'A' && c <= 'F' ) { xvalue = c - 'A' + 0xa ; } else if ( c >= 'a' && c <= 'f' ) { xvalue = c - 'a' + 0xa ; } else { <END_BUG> return APR_EGENERAL ;  } ctx -> remaining = ( ctx -> remaining << 4 ) | xvalue ; <START_BUG> ctx -> chunkbits -= 4 ; <END_BUG> if ( ctx -> chunkbits <= 0 || ctx -> remaining < 0 ) { return APR_ENOSPC ;  } <START_BUG> } i ++ ; } ctx -> chunk_used += len ; if ( ctx -> chunk_used < 0 || ctx -> chunk_used > linelimit ) { return APR_ENOSPC ; } return APR_SUCCESS<END_BUG>

Fix:
<S2SV_ModStart> state == BODY_CHUNK_END || ctx -> state == BODY_CHUNK_END_LF <S2SV_ModStart> state = BODY_CHUNK ; } else if ( c == CR && ctx -> state == BODY_CHUNK_END ) { ctx -> state = BODY_CHUNK_END_LF ; } else { return APR_EINVAL <S2SV_ModStart> ) { return APR_EINVAL <S2SV_ModEnd> ; } else <S2SV_ModStart> = sizeof ( apr_off_t <S2SV_ModEnd> ) * 8 <S2SV_ModStart> ( c == LF ) { if ( ctx -> remaining ) { ctx -> state = BODY_CHUNK_DATA ; } else { ctx -> state = BODY_CHUNK_TRAILER ; } } else if ( ctx -> state == BODY_CHUNK_LF ) { return APR_EINVAL ; } else if ( c == CR ) { ctx -> state = BODY_CHUNK_LF ; } else if ( c == ';' <S2SV_ModEnd> ) { ctx <S2SV_ModStart> else if ( ctx -> state == BODY_CHUNK_EXT ) { if ( c!= '\\t' && apr_iscntrl ( c ) ) { return APR_EINVAL ; } } else if ( ctx -> state == BODY_CHUNK_PART <S2SV_ModEnd> ) { int <S2SV_ModStart> { int xvalue
Buggy code:
 static int inv_remap_prob ( int v, int m ) { <START_BUG> static int inv_map_table [ MAX_PROB - 1 ] = { <END_BUG>  6, 19, 32, 45, 58, 71, 84, 97, 110, 123, 136, 149, 162, 175, 188, <START_BUG> 201, 214, 227, 240, 253, 0, 1, 2, 3, 4, 5, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 189, 190, 191, 192, 193, 194,<END_BUG>

Fix:
<S2SV_ModStart> inv_map_table [ MAX_PROB <S2SV_ModEnd> ] = { <S2SV_ModStart> ] = { 7, 20, 33, 46, 59, 72, 85, 98, 111, 124, 137, 150, 163, 176, 189, 202, 215, 228, 241, 254, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 99, 100, 101,
Buggy code:
 static void set_segment_data ( VP8_COMP * cpi, signed char * feature_data, unsigned char abs_delta ) { cpi -> mb. e_mbd. mb_segement_abs_delta = abs_delta ; <START_BUG> vpx_memcpy ( cpi -> segment_feature_data, feature_data, sizeof ( cpi -> segment_feature_data ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> = abs_delta ; memcpy <S2SV_ModEnd> ( cpi ->
Buggy code:
 ssize_t nghttp2_session_mem_recv ( nghttp2_session * session, const uint8_t * in, size_t inlen ) { const uint8_t * first = in, * last = in + inlen ; nghttp2_inbound_frame * iframe = & session -> iframe ; size_t readlen ; ssize_t padlen ; int rv ; int busy = 0 ; nghttp2_frame_hd cont_hd ; nghttp2_stream * stream ; size_t pri_fieldlen ; nghttp2_mem * mem ; DEBUGF ( "recv:   connection   recv_window_size=%d,   local_window=%d\\n", session -> recv_window_size, session -> local_window_size ) ; mem = & session -> mem ; rv = nghttp2_session_adjust_idle_stream ( session ) ; if ( nghttp2_is_fatal ( rv ) ) { return rv ; } if (! nghttp2_session_want_read ( session ) ) { return ( ssize_t ) inlen ; } for ( ; ; ) { switch ( iframe -> state ) { case NGHTTP2_IB_READ_CLIENT_MAGIC : readlen = nghttp2_min ( inlen, iframe -> payloadleft ) ; if ( memcmp ( & NGHTTP2_CLIENT_MAGIC [ NGHTTP2_CLIENT_MAGIC_LEN - iframe -> payloadleft ], in, readlen )!= 0 ) { return NGHTTP2_ERR_BAD_CLIENT_MAGIC ; } iframe -> payloadleft -= readlen ; in += readlen ; if ( iframe -> payloadleft == 0 ) { session_inbound_frame_reset ( session ) ; iframe -> state = NGHTTP2_IB_READ_FIRST_SETTINGS ; } break ; case NGHTTP2_IB_READ_FIRST_SETTINGS : DEBUGF ( "recv:   [IB_READ_FIRST_SETTINGS]\\n" ) ; readlen = inbound_frame_buf_read ( iframe, in, last ) ; in += readlen ; if ( nghttp2_buf_mark_avail ( & iframe -> sbuf ) ) { return in - first ; } if ( iframe -> sbuf. pos [ 3 ]!= NGHTTP2_SETTINGS || (

Fix:
<S2SV_ModStart> + 1 ; if ( iframe -> max_niv - 1 > session -> max_settings ) { rv = nghttp2_session_terminate_session_with_reason ( session, NGHTTP2_ENHANCE_YOUR_CALM, "SETTINGS: <S2SV_blank> too <S2SV_blank> many <S2SV_blank> setting <S2SV_blank> entries" ) ; if ( nghttp2_is_fatal ( rv ) ) { return rv ; } return ( ssize_t ) inlen ; }
Buggy code:
 static void * __dma_alloc_coherent ( struct device * dev, size_t size, dma_addr_t * dma_handle, gfp_t flags, struct dma_attrs * attrs ) { if ( dev == NULL ) { WARN_ONCE ( 1, "Use   an   actual   device   structure   for   DMA   allocation\\n" ) ; return NULL ; } if ( IS_ENABLED ( CONFIG_ZONE_DMA ) && dev -> coherent_dma_mask <= DMA_BIT_MASK ( 32 ) ) flags |= GFP_DMA ; if ( IS_ENABLED ( CONFIG_DMA_CMA ) && ( flags & __GFP_WAIT ) ) { struct page * page ; void * addr ; size = PAGE_ALIGN ( size ) ; page = dma_alloc_from_contiguous ( dev, size >> PAGE_SHIFT, get_order ( size ) ) ; if (! page ) return NULL ; * dma_handle = phys_to_dma ( dev, page_to_phys ( page ) ) ; addr = page_address ( page ) ; <START_BUG> if ( flags & __GFP_ZERO ) <END_BUG> memset ( addr, 0, size ) ; return addr ; } else { return swiotlb_alloc_coherent ( dev, size, dma_handle, flags ) ; } }

Fix:
<S2SV_ModStart> page ) ; <S2SV_ModEnd> memset ( addr
Buggy code:
 static void recalculate_apic_map ( struct kvm * kvm ) { struct kvm_apic_map * new, * old = NULL ; struct kvm_vcpu * vcpu ; int i ; new = kzalloc ( sizeof ( struct kvm_apic_map ), GFP_KERNEL ) ; mutex_lock ( & kvm -> arch. apic_map_lock ) ; if (! new ) goto out ; new -> ldr_bits = 8 ; new -> cid_shift = 8 ; new -> cid_mask = 0 ; new -> lid_mask = 0xff ; kvm_for_each_vcpu ( i, vcpu, kvm ) { struct kvm_lapic * apic = vcpu -> arch. apic ; u16 cid, lid ; u32 ldr ; if (! kvm_apic_present ( vcpu ) ) continue ; if ( apic_x2apic_mode ( apic ) ) { new -> ldr_bits = 32 ; new -> cid_shift = 16 ; <START_BUG> new -> cid_mask = new -> lid_mask = 0xffff ; <END_BUG> } else if ( kvm_apic_sw_enabled ( apic ) &&! new -> cid_mask && kvm_apic_get_reg ( apic, APIC_DFR ) == APIC_DFR_CLUSTER ) { new -> cid_shift = 4 ; new -> cid_mask = 0xf ; new -> lid_mask = 0xf ; } new -> phys_map [ kvm_apic_id ( apic ) ] = apic ; ldr = kvm_apic_get_reg ( apic, APIC_LDR ) ; cid = apic_cluster_id ( new, ldr ) ; lid = apic_logical_id ( new, ldr ) ; if ( lid ) new -> logical_map [ cid ] [ ffs ( lid ) - 1 ] = apic ; } out : old = rcu_dereference_protected ( kvm -> arch. apic_map, lockdep_is_held ( & kvm -> arch. apic_map_lock ) ) ; rcu_assign_pointer ( kvm -> arch. apic_map, new ) ; mutex_

Fix:
<S2SV_ModStart> -> cid_mask = ( 1 << KVM_X2APIC_CID_BITS ) - 1 ;
Buggy code:
 static void core_anal_bytes ( RCore * core, const ut8 * buf, int len, int nops, int fmt ) { int stacksize = r_config_get_i ( core -> config, "esil.stack.depth" ) ; bool iotrap = r_config_get_i ( core -> config, "esil.iotrap" ) ; bool romem = r_config_get_i ( core -> config, "esil.romem" ) ; bool stats = r_config_get_i ( core -> config, "esil.stats" ) ; bool be = core -> print -> big_endian ; bool use_color = core -> print -> flags & R_PRINT_FLAGS_COLOR ; core -> parser -> relsub = r_config_get_i ( core -> config, "asm.relsub" ) ; int ret, i, j, idx, size ; const char * color = "" ; const char * esilstr ; const char * opexstr ; RAnalHint * hint ; RAnalEsil * esil = NULL ; RAsmOp asmop ; RAnalOp op = { 0 } ; ut64 addr ; bool isFirst = true ; unsigned int addrsize = r_config_get_i ( core -> config, "esil.addr.size" ) ; int totalsize = 0 ; if ( use_color ) { color = core -> cons -> pal. label ; } switch ( fmt ) { case 'j' : r_cons_printf ( "[" ) ; break ; case 'r' : esil = r_anal_esil_new ( stacksize, iotrap, addrsize ) ; if (! esil ) { return ; } r_anal_esil_to_reil_setup ( esil, core -> anal, romem, stats ) ; r_anal_esil_set_pc ( esil, core -> offset ) ; break ; } for ( i = idx = ret = 0 ; idx < len && (! nops || ( nops && i < nops ) ) ; i ++, idx += ret ) { addr = core -> offset + idx ; hint = r_anal_hint_get ( core -> anal, addr ) ; r_asm_set_pc ( core -> assembler, addr ) ;

Fix:
<S2SV_ModStart> 0 ) ; int minsz = R_MIN ( len, size ) ; minsz = R_MAX ( minsz, 0 ) ; <S2SV_ModStart> ; j < minsz <S2SV_ModEnd> ; j ++ <S2SV_ModStart> ++ ) { ut8 ch = ( ( j + idx - 1 ) > minsz )? 0xff : <S2SV_ModEnd> buf [ j <S2SV_ModStart> + idx ] ; r_cons_printf ( "%02x", ch <S2SV_ModStart>!= UT64_MAX ) { <S2SV_ModStart> val ) ; } <S2SV_ModStart>!= UT64_MAX ) { <S2SV_ModStart> ptr ) ; } <S2SV_ModStart> - 1 ) { <S2SV_ModStart> refptr ) ; }
Buggy code:
 static int yam_ioctl ( struct net_device * dev, struct ifreq * ifr, int cmd ) { struct yam_port * yp = netdev_priv ( dev ) ; struct yamdrv_ioctl_cfg yi ; struct yamdrv_ioctl_mcs * ym ; int ioctl_cmd ; if ( copy_from_user ( & ioctl_cmd, ifr -> ifr_data, sizeof ( int ) ) ) return - EFAULT ; if ( yp -> magic!= YAM_MAGIC ) return - EINVAL ; if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; if ( cmd!= SIOCDEVPRIVATE ) return - EINVAL ; switch ( ioctl_cmd ) { case SIOCYAMRESERVED : return - EINVAL ; case SIOCYAMSMCS : if ( netif_running ( dev ) ) return - EINVAL ; if ( ( ym = kmalloc ( sizeof ( struct yamdrv_ioctl_mcs ), GFP_KERNEL ) ) == NULL ) return - ENOBUFS ; if ( copy_from_user ( ym, ifr -> ifr_data, sizeof ( struct yamdrv_ioctl_mcs ) ) ) { kfree ( ym ) ; return - EFAULT ; } if ( ym -> bitrate > YAM_MAXBITRATE ) { kfree ( ym ) ; return - EINVAL ; } add_mcs ( ym -> bits, ym -> bitrate, 0 ) ; kfree ( ym ) ; break ; case SIOCYAMSCFG : if (! capable ( CAP_SYS_RAWIO ) ) return - EPERM ; if ( copy_from_user ( & yi, ifr -> ifr_data, sizeof ( struct yamdrv_ioctl_cfg ) ) ) return - EFAULT ; if ( ( yi. cfg. mask & YAM_IOBASE ) && netif_running ( dev ) ) return - EINVAL ; if ( ( yi. cfg. mask & YAM_IRQ ) && netif_running ( dev ) ) return - EINVAL ; if ( ( yi. cfg. mask & YAM_BITRATE ) && netif_running ( dev ) ) return

Fix:
<S2SV_ModStart> case SIOCYAMGCFG : memset ( & yi, 0, sizeof ( yi ) ) ;
Buggy code:
 <START_BUG> static void update_read_synchronize ( rdpUpdate * update, wStream * s ) <END_BUG> { WINPR_UNUSED ( update ) ;  Stream_Seek_UINT16 ( s ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> update_read_synchronize ( rdpUpdate <S2SV_ModStart> update ) ; return Stream_SafeSeek ( s, 2 <S2SV_ModEnd> ) ; }
Buggy code:
 static const char * <START_BUG> parse_field ( netdissect_options * ndo, const char * * pptr, int * len ) <END_BUG> { const char * s ;  if ( * len <= 0 ||! pptr ||! * pptr ) <START_BUG> return NULL ; if ( * pptr > ( const char * ) ndo -> ndo_snapend ) return NULL ; s = * pptr ; <END_BUG> while ( * pptr <= ( const char * ) ndo -> ndo_snapend && * len >= 0 && * * pptr ) {  ( * pptr ) ++ ; ( * len ) -- ; } ( * pptr ) ++ ; ( * len ) -- ; <START_BUG> if ( * len < 0 || * pptr > ( const char * ) ndo -> ndo_snapend ) <END_BUG> return NULL ; return s ; }

Fix:
<S2SV_ModStart> int * len, int * truncated <S2SV_ModStart> * s ; <S2SV_ModEnd> s = * <S2SV_ModStart> * pptr ; for ( ; ; ) { if ( * len == 0 ) { return NULL ; } if (! ND_TTEST ( <S2SV_ModEnd> * * pptr <S2SV_ModStart> * pptr ) ) { * truncated = 1 ; return NULL ; } if ( * * pptr == '\\0' ) { break ; } <S2SV_ModEnd> ( * pptr <S2SV_ModStart> ) -- ; <S2SV_ModEnd> return s ;
Buggy code:
 int ext4_orphan_del ( handle_t * handle, struct inode * inode ) { struct list_head * prev ; struct ext4_inode_info * ei = EXT4_I ( inode ) ; struct ext4_sb_info * sbi ; __u32 ino_next ; struct ext4_iloc iloc ; int err = 0 ; <START_BUG> if (! EXT4_SB ( inode -> i_sb ) -> s_journal ) <END_BUG> return 0 ; mutex_lock ( & EXT4_SB ( inode -> i_sb ) -> s_orphan_lock ) ; if ( list_empty ( & ei -> i_orphan ) ) goto out ; ino_next = NEXT_ORPHAN ( inode ) ; prev = ei -> i_orphan. prev ; sbi = EXT4_SB ( inode -> i_sb ) ; jbd_debug ( 4, "remove   inode   %lu   from   orphan   list\\n", inode -> i_ino ) ; list_del_init ( & ei -> i_orphan ) ; if (! handle ) goto out ; err = ext4_reserve_inode_write ( handle, inode, & iloc ) ; if ( err ) goto out_err ; if ( prev == & sbi -> s_orphan ) { jbd_debug ( 4, "superblock   will   point   to   %u\\n", ino_next ) ; BUFFER_TRACE ( sbi -> s_sbh, "get_write_access" ) ; err = ext4_journal_get_write_access ( handle, sbi -> s_sbh ) ; if ( err ) goto out_brelse ; sbi -> s_es -> s_last_orphan = cpu_to_le32 ( ino_next ) ; err = ext4_handle_dirty_super ( handle, inode -> i_sb ) ; } else { struct ext4_iloc iloc2 ; struct inode * i_prev = & list_entry ( prev, struct ext4_inode_info, i_orphan ) -> vfs_inode ; jbd_debug ( 4, "orphan   inode   %lu   will   point   to   %u\\n", i_prev -> i_ino, ino_next

Fix:
<S2SV_ModStart> ; if ( ( <S2SV_ModStart> ) -> s_journal ) &&! ( EXT4_SB ( inode -> i_sb ) -> s_mount_state & EXT4_ORPHAN_FS )
Buggy code:
 void vp9_rc_postencode_update_drop_frame ( VP9_COMP * cpi ) { update_buffer_level ( cpi, 0 ) ; <START_BUG> cpi -> common. last_frame_type = cpi -> common. frame_type ; <END_BUG> cpi -> rc. frames_since_key ++ ; cpi -> rc. frames_to_key -- ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ; cpi -> <S2SV_ModEnd> rc. frames_since_key <S2SV_ModStart> frames_to_key -- ; cpi -> rc. rc_2_frame = 0 ; cpi -> rc. rc_1_frame = 0 ;
Buggy code:
 struct sock * tcp_v4_syn_recv_sock ( struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst ) { struct inet_request_sock * ireq ; struct inet_sock * newinet ; struct tcp_sock * newtp ; struct sock * newsk ; # ifdef CONFIG_TCP_MD5SIG struct tcp_md5sig_key * key ; # endif <START_BUG> if ( sk_acceptq_is_full ( sk ) ) <END_BUG> goto exit_overflow ; if (! dst && ( dst = inet_csk_route_req ( sk, req ) ) == NULL ) goto exit ; newsk = tcp_create_openreq_child ( sk, req, skb ) ; if (! newsk ) goto exit_nonewsk ; newsk -> sk_gso_type = SKB_GSO_TCPV4 ; sk_setup_caps ( newsk, dst ) ; newtp = tcp_sk ( newsk ) ; newinet = inet_sk ( newsk ) ; ireq = inet_rsk ( req ) ; newinet -> inet_daddr = ireq -> rmt_addr ; newinet -> inet_rcv_saddr = ireq -> loc_addr ; newinet -> inet_saddr = ireq -> loc_addr ;  newinet -> opt = ireq -> opt ; <START_BUG> ireq -> opt = NULL ; newinet -> mc_index = inet_iif ( skb ) ; newinet -> mc_ttl = ip_hdr ( skb ) -> ttl ; inet_csk ( newsk ) -> icsk_ext_hdr_len = 0 ; if ( newinet -> opt ) inet_csk ( newsk ) -> icsk_ext_hdr_len = newinet -> opt -> optlen ; newinet -> inet_id = newtp -> write_seq ^ jiffies ; tcp_mtup_init ( newsk ) ; tcp_sync_mss ( newsk, dst_mtu ( dst ) ) ; newtp -> advmss = dst_metric_advmss ( dst ) ; if ( tcp_sk ( sk ) -> rx_opt. user_mss && tcp_sk ( sk ) -> rx_opt. user_mss < newtp -> adv<END_BUG>

Fix:
<S2SV_ModStart> ; # endif struct ip_options_rcu * inet_opt ; <S2SV_ModStart> -> loc_addr ; inet_opt = ireq -> opt ; rcu_assign_pointer ( newinet -> inet_opt, inet_opt ) ; <S2SV_ModEnd> ireq -> opt <S2SV_ModStart> ireq -> opt = NULL ; newinet -> mc_index = inet_iif ( skb ) ; newinet -> mc_ttl = ip_hdr ( skb ) -> ttl ; inet_csk ( newsk ) -> icsk_ext_hdr_len = 0 ; if ( inet_opt ) inet_csk ( newsk ) -> icsk_ext_hdr_len = inet_opt -> opt. <S2SV_ModEnd> optlen ; newinet
Buggy code:
 static Image * ReadPSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BoundingBox "BoundingBox:" # define BeginDocument "BeginDocument:" # define BeginXMPPacket "<?xpacket   begin=" # define EndXMPPacket "<?xpacket   end=" # define ICCProfile "BeginICCProfile:" # define CMYKCustomColor "CMYKCustomColor:" # define CMYKProcessColor "CMYKProcessColor:" # define DocumentMedia "DocumentMedia:" # define DocumentCustomColors "DocumentCustomColors:" # define DocumentProcessColors "DocumentProcessColors:" # define EndDocument "EndDocument:" # define HiResBoundingBox "HiResBoundingBox:" # define ImageData "ImageData:" # define PageBoundingBox "PageBoundingBox:" # define LanguageLevel "LanguageLevel:" # define PageMedia "PageMedia:" # define Pages "Pages:" # define PhotoshopProfile "BeginPhotoshop:" # define PostscriptLevel "!PS-" # define RenderPostscriptText "     Rendering   Postscript...     " # define SpotColor "+   " char command [ MaxTextExtent ], * density, filename [ MaxTextExtent ], geometry [ MaxTextExtent ], input_filename [ MaxTextExtent ], message [ MaxTextExtent ], * options, postscript_filename [ MaxTextExtent ] ; const char * option ; const DelegateInfo * delegate_info ; GeometryInfo geometry_info ; Image * image, * next, * postscript_image ; ImageInfo * read_info ; int c, file ; MagickBooleanType cmyk, fitPage, skip, status ; MagickStatusType flags ; PointInfo delta, resolution ; RectangleInfo page ; register char * p ; register ssize_t i ; SegmentInfo bounds, hires_bounds ; short int hex_digits [ 256 ] ; size_t length, priority ; ssize_t count ; StringInfo * profile ; unsigned long columns, extent, language_level, pages, rows, scene, spotcolor ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert

Fix:
<S2SV_ModStart> "`%s\'", option ) ; geometry = DestroyString ( geometry
Buggy code:
 int tmx_check_pretran ( sip_msg_t * msg ) { unsigned int chid ; unsigned int slotid ; int dsize ; struct via_param * vbr ; str scallid ; str scseqmet ; str scseqnum ; str sftag ; str svbranch = { NULL, 0 } ; pretran_t * it ; if ( _tmx_ptran_table == NULL ) { LM_ERR ( "pretran   hash   table   not   initialized   yet\\n" ) ; return - 1 ; } if ( get_route_type ( )!= REQUEST_ROUTE ) { LM_ERR ( "invalid   usage   -   not   in   request   route\\n" ) ; return - 1 ; } if ( msg -> first_line. type!= SIP_REQUEST ) { LM_ERR ( "invalid   usage   -   not   a   sip   request\\n" ) ; return - 1 ; } if ( parse_headers ( msg, HDR_FROM_F | HDR_VIA1_F | HDR_CALLID_F | HDR_CSEQ_F, 0 ) < 0 ) { LM_ERR ( "failed   to   parse   required   headers\\n" ) ; return - 1 ; } if ( msg -> cseq == NULL || msg -> cseq -> parsed == NULL ) { LM_ERR ( "failed   to   parse   cseq   headers\\n" ) ; return - 1 ; } if ( get_cseq ( msg ) -> method_id == METHOD_ACK || get_cseq ( msg ) -> method_id == METHOD_CANCEL ) { LM_DBG ( "no   pre-transaction   management   for   ACK   or   CANCEL\\n" ) ; return - 1 ; } if ( msg -> via1 == 0 ) { LM_ERR ( "failed   to   get   Via   header\\n" ) ; return - 1 ; } if ( parse_from_header ( msg ) < 0 || get_from ( msg ) -> tag_value. len == 0 ) { LM_ERR ( "failed   to   get   From   header\\n" ) ; return - 1 ; } if ( msg -> callid == NULL || msg -> callid -> body. s == NULL ) { LM_ERR

Fix:
<S2SV_ModStart> svbranch. len + 1
Buggy code:
 int vp9_alloc_context_buffers ( VP9_COMMON * cm, int width, int height ) { int new_mi_size ; vp9_set_mb_mi ( cm, width, height ) ; new_mi_size = cm -> mi_stride * calc_mi_size ( cm -> mi_rows ) ; if ( cm -> mi_alloc_size < new_mi_size ) { cm -> free_mi ( cm ) ; if ( cm -> alloc_mi ( cm, new_mi_size ) ) goto fail ; } if ( cm -> seg_map_alloc_size < cm -> mi_rows * cm -> mi_cols ) { free_seg_map ( cm ) ; if ( alloc_seg_map ( cm, cm -> mi_rows * cm -> mi_cols ) ) goto fail ; } if ( cm -> above_context_alloc_cols < cm -> mi_cols ) { vpx_free ( cm -> above_context ) ; cm -> above_context = ( ENTROPY_CONTEXT * ) vpx_calloc ( 2 * mi_cols_aligned_to_sb ( cm -> mi_cols ) * MAX_MB_PLANE, sizeof ( * cm -> above_context ) ) ; if (! cm -> above_context ) goto fail ; vpx_free ( cm -> above_seg_context ) ; cm -> above_seg_context = ( PARTITION_CONTEXT * ) vpx_calloc ( mi_cols_aligned_to_sb ( cm -> mi_cols ), sizeof ( * cm -> above_seg_context ) ) ; if (! cm -> above_seg_context ) goto fail ; cm -> above_context_alloc_cols = cm -> mi_cols ; } return 0 ; fail : <START_BUG> vp9_free_context_buffers ( cm ) ; <END_BUG> return 1 ; }

Fix:
<S2SV_ModStart> ; fail : vp9_set_mb_mi ( cm, 0, 0 ) ;
Buggy code:
 static int str_lower_case_match ( OnigEncoding enc, int case_fold_flag, const UChar * t, const UChar * tend, const UChar * p, const UChar * end ) { int lowlen ; UChar * q, lowbuf [ ONIGENC_MBC_CASE_FOLD_MAXLEN ] ; while ( t < tend ) { lowlen = ONIGENC_MBC_CASE_FOLD ( enc, case_fold_flag, & p, end, lowbuf ) ; q = lowbuf ; while ( lowlen > 0 ) { <START_BUG> if ( * t ++!= * q ++ ) return 0 ; <END_BUG> lowlen -- ; } } return 1 ; }

Fix:
<S2SV_ModStart> { if ( t >= tend ) return 0 ; if (
Buggy code:
 static BOOLEAN flush_incoming_que_on_wr_signal_l ( l2cap_socket * sock ) { uint8_t * buf ; uint32_t len ; while ( packet_get_head_l ( sock, & buf, & len ) ) { <START_BUG> int sent = send ( sock -> our_fd, buf, len, MSG_DONTWAIT ) ; <END_BUG> if ( sent == ( signed ) len ) osi_free ( buf ) ; else if ( sent >= 0 ) { packet_put_head_l ( sock, buf + sent, len - sent ) ; osi_free ( buf ) ; if (! sent ) return TRUE ; } else { packet_put_head_l ( sock, buf, len ) ; osi_free ( buf ) ; return errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN ; } } return FALSE ; }

Fix:
<S2SV_ModStart> int sent = TEMP_FAILURE_RETRY ( <S2SV_ModStart> len, MSG_DONTWAIT )
Buggy code:
 <START_BUG> WORD32 ih264d_end_of_pic ( dec_struct_t * ps_dec, <END_BUG> UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num ) { dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ;  WORD32 ret ; <START_BUG> ps_dec -> u2_mbx = 0xffff ; ps_dec -> u2_mby = 0 ; { dec_err_status_t * ps_err = ps_dec -> ps_dec_err_status ; if ( ps_err -> u1_err_flag & REJECT_CUR_PIC ) { ih264d_err_pic_dispbuf_mgr ( ps_dec ) ; return ERROR_NEW_FRAME_EXPECTED ; } } H264_MUTEX_LOCK ( & ps_dec -> process_disp_mutex ) ; ret = ih264d_end_of_pic_processing ( ps_dec ) ; if ( ret!= OK ) return ret ; <END_BUG> ps_dec -> u2_total_mbs_coded = 0 ;  { pocstruct_t * ps_prev_poc = & ps_dec -> s_prev_pic_poc ; pocstruct_t * ps_cur_poc = & ps_dec -> s_cur_pic_poc ; if ( ( 0 == u1_is_idr_slice ) && ps_cur_slice -> u1_nal_ref_idc ) ps_dec -> u2_prev_ref_frame_num = ps_cur_slice -> u2_frame_num ; if ( u1_is_idr_slice || ps_cur_slice -> u1_mmco_equalto5 ) ps_dec -> u2_prev_ref_frame_num = 0 ; if ( ps_dec -> ps_cur_sps -> u1_gaps_in_frame_num_value_allowed_flag ) { ret = ih264d_decode_gaps_in_frame_num ( ps_dec, u2_frame_num ) ; if ( ret!= OK ) return ret ; } ps_prev_poc -> i4_prev_frame_num_ofst = ps_cur_poc -> i4_

Fix:
<S2SV_ModStart> dec_struct_t * ps_dec <S2SV_ModEnd> ) { dec_slice_params_t <S2SV_ModStart> ; WORD32 ret <S2SV_ModEnd> ; { dec_err_status_t <S2SV_ModStart> return ret ; <S2SV_ModEnd> H264_MUTEX_UNLOCK ( &