nus-yam/ex-repair huggingface dataset:
Buggy code:
 int main ( int argc, char * * argv ) { const char * safepath = SAFE_PATH ; const char * confpath = NULL ; char * shargv [ ] = { NULL, NULL } ; char * sh ; const char * cmd ; char cmdline [ LINE_MAX ] ; char myname [ _PW_NAME_LEN + 1 ] ; struct passwd * original_pw, * target_pw ; struct rule * rule ; uid_t uid ; uid_t target = 0 ; gid_t groups [ NGROUPS_MAX + 1 ] ; int ngroups ; int i, ch ; int sflag = 0 ; int nflag = 0 ; char cwdpath [ PATH_MAX ] ; const char * cwd ; char * login_style = NULL ; char * * envp ; # ifndef linux setprogname ( "doas" ) ; # endif # ifndef linux closefrom ( STDERR_FILENO + 1 ) ; # endif uid = getuid ( ) ; while ( ( ch = getopt ( argc, argv, "a:C:nsu:" ) )!= - 1 ) { switch ( ch ) { case 'a' : login_style = optarg ; break ; case 'C' : confpath = optarg ; break ; case 'u' : if ( parseuid ( optarg, & target )!= 0 ) errx ( 1, "unknown   user" ) ; break ; case 'n' : nflag = 1 ; break ; case's' : sflag = 1 ; break ; default : usage ( ) ; break ; } } argv += optind ; argc -= optind ; if ( confpath ) { if ( sflag ) usage ( ) ; } else if ( (! sflag &&! argc ) || ( sflag && argc ) ) usage ( ) ; original_pw = getpwuid ( uid ) ; if (! original_pw ) err ( 1, "getpwuid   failed" ) ; if ( strlcpy ( myname, original_pw -> pw_name, sizeof ( myname ) ) >= sizeof ( myname ) ) errx ( 1, "pw_name   too   long" ) ; ngroups = getgroups ( NGROUPS_MAX, groups ) ; if ( ngroups == - 1 ) err ( 1, "can\'t   get   groups" ) ; groups [

Fix:
<S2SV_ModStart> EXIT_FAILURE ) ; \\\n} <S2SV_ModEnd> while ( 0 <S2SV_ModStart> ) ; # else # if defined ( __linux__ ) || defined ( __FreeBSD__ ) || defined ( __NetBSD__ ) if ( setresgid ( target_pw -> pw_gid, target_pw -> pw_gid, target_pw -> pw_gid ) == - 1 ) err ( 1, "setresgid" ) ; # else if ( setregid ( target_pw -> pw_gid, target_pw -> pw_gid ) == - 1 ) err ( 1, "setregid" ) ; # endif if ( initgroups ( target_pw -> pw_name, target_pw -> pw_gid ) == - 1 ) err ( 1, "initgroups" ) ; # if defined ( __linux__ ) || defined ( __FreeBSD__ ) || defined ( __NetBSD__ ) if ( setresuid ( target, target, target ) == - 1 ) err ( 1, "setresuid" ) ; # else if ( setreuid ( target, target ) == - 1 ) err ( 1, "setreuid" ) ; # endif # <S2SV_ModStart> = cwdpath ; <S2SV_ModEnd> syslog (
Buggy code:
 int create_flush_cmd_control ( struct f2fs_sb_info * sbi ) { dev_t dev = sbi -> sb -> s_bdev -> bd_dev ; struct flush_cmd_control * fcc ; int err = 0 ; if ( SM_I ( sbi ) -> fcc_info ) { fcc = SM_I ( sbi ) -> fcc_info ; goto init_thread ; } fcc = kzalloc ( sizeof ( struct flush_cmd_control ), GFP_KERNEL ) ; if (! fcc ) return - ENOMEM ; atomic_set ( & fcc -> issued_flush, 0 ) ; atomic_set ( & fcc -> issing_flush, 0 ) ; init_waitqueue_head ( & fcc -> flush_wait_queue ) ; init_llist_head ( & fcc -> issue_list ) ; SM_I ( sbi ) -> fcc_info = fcc ; <START_BUG> init_thread : <END_BUG> fcc -> f2fs_issue_flush = kthread_run ( issue_flush_thread, sbi, "f2fs_flush-%u:%u", MAJOR ( dev ), MINOR ( dev ) ) ; if ( IS_ERR ( fcc -> f2fs_issue_flush ) ) { err = PTR_ERR ( fcc -> f2fs_issue_flush ) ; kfree ( fcc ) ; SM_I ( sbi ) -> fcc_info = NULL ; return err ; } return err ; }

Fix:
<S2SV_ModStart> = fcc ; if (! test_opt ( sbi, FLUSH_MERGE ) ) return err ;
Buggy code:
 static bool checkreturn decode_pointer_field ( pb_istream_t * stream, pb_wire_type_t wire_type, pb_field_iter_t * field ) { # ifndef PB_ENABLE_MALLOC PB_UNUSED ( wire_type ) ; PB_UNUSED ( field ) ; PB_RETURN_ERROR ( stream, "no   malloc   support" ) ; # else switch ( PB_HTYPE ( field -> type ) ) { case PB_HTYPE_REQUIRED : case PB_HTYPE_OPTIONAL : case PB_HTYPE_ONEOF : if (! check_wire_type ( wire_type, field ) ) PB_RETURN_ERROR ( stream, "wrong   wire   type" ) ; if ( PB_LTYPE_IS_SUBMSG ( field -> type ) && * ( void * * ) field -> pField!= NULL ) { pb_release_single_field ( field ) ; } if ( PB_HTYPE ( field -> type ) == PB_HTYPE_ONEOF ) { * ( pb_size_t * ) field -> pSize = field -> tag ; } if ( PB_LTYPE ( field -> type ) == PB_LTYPE_STRING || PB_LTYPE ( field -> type ) == PB_LTYPE_BYTES ) { field -> pData = field -> pField ; return decode_basic_field ( stream, field ) ; } else { if (! allocate_field ( stream, field -> pField, field -> data_size, 1 ) ) return false ; field -> pData = * ( void * * ) field -> pField ; initialize_pointer_field ( field -> pData, field ) ; return decode_basic_field ( stream, field ) ; } case PB_HTYPE_REPEATED : if ( wire_type == PB_WT_STRING && PB_LTYPE ( field -> type ) <= PB_LTYPE_LAST_PACKABLE ) { bool status = true ; pb_size_t * size = ( pb_size_t * ) field -> pSize ; size_t allocated_size = * size ; pb_istream_t substream ; if (! pb_make_string_substream ( stream, & substream ) ) return false ; while ( substream. bytes_left ) { if ( ( size_t ) * size + 1

Fix:
<S2SV_ModStart> "wrong <S2SV_blank> wire <S2SV_blank> type" ) ; if (! allocate_field ( stream, field -> pField, field -> data_size, ( size_t ) ( * size + 1 ) ) ) return false ; field -> pData = * ( char * * ) field -> pField + field -> data_size * ( * size ) ; <S2SV_ModStart> size ) ++ <S2SV_ModEnd> ; initialize_pointer_field (
Buggy code:
 static int fastrpc_dma_buf_attach ( struct dma_buf * dmabuf, struct dma_buf_attachment * attachment ) { struct fastrpc_dma_buf_attachment * a ; struct fastrpc_buf * buffer = dmabuf -> priv ; int ret ; a = kzalloc ( sizeof ( * a ), GFP_KERNEL ) ; if (! a ) return - ENOMEM ; ret = dma_get_sgtable ( buffer -> dev, & a -> sgt, buffer -> virt, FASTRPC_PHYS ( buffer -> phys ), buffer -> size ) ; if ( ret < 0 ) { dev_err ( buffer -> dev, "failed   to   get   scatterlist   from   DMA   API\\n" ) ; <START_BUG> return - EINVAL ; <END_BUG> } a -> dev = attachment -> dev ; INIT_LIST_HEAD ( & a -> node ) ; attachment -> priv = a ; mutex_lock ( & buffer -> lock ) ; list_add ( & a -> node, & buffer -> attachments ) ; mutex_unlock ( & buffer -> lock ) ; return 0 ; }

Fix:
<S2SV_ModStart> "failed <S2SV_blank> to <S2SV_blank> get <S2SV_blank> scatterlist <S2SV_blank> from <S2SV_blank> DMA <S2SV_blank> API\\n" ) ; kfree ( a ) ;
Buggy code:
 int get_devices_from_authfile ( const char * authfile, const char * username, unsigned max_devs, int verbose, FILE * debug_file, device_t * devices, unsigned * n_devs ) { char * buf = NULL ; char * s_user, * s_token ; int retval = 0 ; int fd = - 1 ; struct stat st ; struct passwd * pw = NULL, pw_s ; char buffer [ BUFSIZE ] ; int gpu_ret ; FILE * opwfile = NULL ; unsigned i, j ; * n_devs = 0 ; <START_BUG> fd = open ( authfile, O_RDONLY, 0 ) ; <END_BUG> if ( fd < 0 ) { if ( verbose ) D ( debug_file, "Cannot   open   file:   %s   (%s)", authfile, strerror ( errno ) ) ; goto err ; } if ( fstat ( fd, & st ) < 0 ) { if ( verbose ) D ( debug_file, "Cannot   stat   file:   %s   (%s)", authfile, strerror ( errno ) ) ; goto err ; } if (! S_ISREG ( st. st_mode ) ) { if ( verbose ) D ( debug_file, "%s   is   not   a   regular   file", authfile ) ; goto err ; } if ( st. st_size == 0 ) { if ( verbose ) D ( debug_file, "File   %s   is   empty", authfile ) ; goto err ; } gpu_ret = getpwuid_r ( st. st_uid, & pw_s, buffer, sizeof ( buffer ), & pw ) ; if ( gpu_ret!= 0 || pw == NULL ) { D ( debug_file, "Unable   to   retrieve   credentials   for   uid   %u,   (%s)", st. st_uid, strerror ( errno ) ) ; goto err ; } if ( strcmp ( pw -> pw_name, username )!= 0 && strcmp ( pw -> pw_name, "root" )!= 0 ) { if ( strcmp ( username, "root" )!= 0 ) { D ( debug_file, "The   owner   of   the   authentication   file   is   neither   %s   nor   root", username ) ; } else { D ( debug

Fix:
<S2SV_ModStart> authfile, O_RDONLY | O_CLOEXEC | O_NOCTTY <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; goto err ; } else { fd = - 1 <S2SV_ModStart> opwfile ) ; <S2SV_ModEnd> if ( fd <S2SV_ModStart> if ( fd!= - 1 <S2SV_ModEnd> ) close (
Buggy code:
 static int psf_close ( SF_PRIVATE * psf ) { uint32_t k ; int error = 0 ; if ( psf -> codec_close ) { error = psf -> codec_close ( psf ) ; psf -> codec_close = NULL ; } ; if ( psf -> container_close ) error = psf -> container_close ( psf ) ; error = psf_fclose ( psf ) ; <START_BUG> psf_close_rsrc ( psf ) ; <END_BUG> free ( psf -> container_data ) ; free ( psf -> codec_data ) ; free ( psf -> interleave ) ; free ( psf -> dither ) ; free ( psf -> peak_info ) ; free ( psf -> broadcast_16k ) ; free ( psf -> loop_info ) ; free ( psf -> instrument ) ; free ( psf -> cues ) ; free ( psf -> channel_map ) ; free ( psf -> format_desc ) ; free ( psf -> strings. storage ) ; if ( psf -> wchunks. chunks ) for ( k = 0 ; k < psf -> wchunks. used ; k ++ ) free ( psf -> wchunks. chunks [ k ]. data ) ; free ( psf -> rchunks. chunks ) ; free ( psf -> wchunks. chunks ) ; free ( psf -> iterator ) ; free ( psf -> cart_16k ) ; memset ( psf, 0, sizeof ( SF_PRIVATE ) ) ; free ( psf ) ; return error ; }

Fix:
<S2SV_ModStart> psf_close_rsrc ( psf ) ; free ( psf -> header. ptr
Buggy code:
 static void pick_quickcompress_mode ( vpx_codec_alg_priv_t * ctx, unsigned long duration, unsigned long deadline ) { <START_BUG> MODE new_qc = MODE_BESTQUALITY ; <END_BUG>  if ( deadline ) { <START_BUG> const uint64_t duration_us = ( uint64_t ) duration * 1000000 * <END_BUG> ( uint64_t ) ctx -> cfg. g_timebase. num //  <START_BUG> ( uint64_t ) ctx -> cfg. g_timebase. den ; <END_BUG>  new_qc = ( deadline > duration_us )? MODE_GOODQUALITY : MODE_REALTIME ; <START_BUG> } if ( ctx -> cfg. g_pass == VPX_RC_FIRST_PASS ) new_qc = MODE_FIRSTPASS ; else if ( ctx -> cfg. g_pass == VPX_RC_LAST_PASS ) new_qc = ( new_qc == MODE_BESTQUALITY )? MODE_SECONDPASS_BEST : MODE_SECONDPASS ; <END_BUG> if ( ctx -> oxcf. mode!= new_qc ) {  <START_BUG> ctx -> oxcf. mode = new_qc ; <END_BUG> vp9_change_config ( ctx -> cpi, & ctx -> oxcf ) ; } }

Fix:
<S2SV_ModStart> ) { MODE new_mode = BEST ; switch ( ctx -> cfg. g_pass ) { case VPX_RC_ONE_PASS : <S2SV_ModEnd> if ( deadline <S2SV_ModStart> if ( deadline > 0 ) { const vpx_codec_enc_cfg_t * const cfg = & ctx -> cfg ; <S2SV_ModEnd> const uint64_t duration_us <S2SV_ModStart> ( uint64_t ) cfg -> <S2SV_ModEnd> g_timebase. num <S2SV_ModStart> ( uint64_t ) cfg -> <S2SV_ModEnd> g_timebase. den <S2SV_ModStart>. den ; new_mode <S2SV_ModEnd> = ( deadline <S2SV_ModStart> duration_us )? GOOD : REALTIME ; } else { new_mode = BEST ; } break ; case VPX_RC_FIRST_PASS : break ; case VPX_RC_LAST_PASS : new_mode = deadline > 0? GOOD : BEST ; break ; } <S2SV_ModEnd> if ( ctx <S2SV_ModStart>. mode!= new_mode <S2SV_ModEnd> ) { ctx <S2SV_ModStart>. mode = new_mode <S2SV_ModEnd> ; vp9_change_config (
Buggy code:
 static int requireDirective ( MaState * state, cchar * key, cchar * value ) { char * age, * type, * rest, * option, * ovalue, * tok ; int domains ; if (! maTokenize ( state, value, "%S  ?*", & type, & rest ) ) { return MPR_ERR_BAD_SYNTAX ; } if ( scaselesscmp ( type, "ability" ) == 0 ) { httpSetAuthRequiredAbilities ( state -> auth, rest ) ; } else if ( scaselesscmp ( type, "group" ) == 0 || scaselesscmp ( type, "role" ) == 0 ) { httpSetAuthRequiredAbilities ( state -> auth, rest ) ; } else if ( scaselesscmp ( type, "secure" ) == 0 ) { domains = 0 ; age = 0 ; for ( option = stok ( sclone ( rest ), "   \\t", & tok ) ; option ; option = stok ( 0, "   \\t", & tok ) ) { <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if ( smatch ( option, "age" ) ) { age = sfmt ( "%lld", ( int64 ) httpGetTicks ( ovalue ) ) ; } else if ( smatch ( option, "domains" ) ) { domains = 1 ; } } if ( age ) { if ( domains ) { age = sjoin ( "-1", age, NULL ) ; } } addCondition ( state, "secure", age, HTTP_ROUTE_STRICT_TLS ) ; } else if ( scaselesscmp ( type, "user" ) == 0 ) { httpSetAuthPermittedUsers ( state -> auth, rest ) ; } else if ( scaselesscmp ( type, "valid-user" ) == 0 ) { httpSetAuthAnyValidUser ( state -> auth ) ; } else { return configError ( state, key ) ; } return 0 ; }

Fix:
<S2SV_ModStart> { option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 static int pptp_connect ( struct socket * sock, struct sockaddr * uservaddr, int sockaddr_len, int flags ) { struct sock * sk = sock -> sk ; struct sockaddr_pppox * sp = ( struct sockaddr_pppox * ) uservaddr ; struct pppox_sock * po = pppox_sk ( sk ) ; struct pptp_opt * opt = & po -> proto. pptp ; struct rtable * rt ; struct flowi4 fl4 ; int error = 0 ; <START_BUG> if ( sp -> sa_protocol!= PX_PROTO_PPTP ) <END_BUG> return - EINVAL ; if ( lookup_chan_dst ( sp -> sa_addr. pptp. call_id, sp -> sa_addr. pptp. sin_addr. s_addr ) ) return - EALREADY ; lock_sock ( sk ) ; if ( sk -> sk_state & PPPOX_CONNECTED ) { error = - EBUSY ; goto end ; } if ( sk -> sk_state & PPPOX_DEAD ) { error = - EALREADY ; goto end ; } if (! opt -> src_addr. sin_addr. s_addr ||! sp -> sa_addr. pptp. sin_addr. s_addr ) { error = - EINVAL ; goto end ; } po -> chan. private = sk ; po -> chan. ops = & pptp_chan_ops ; rt = ip_route_output_ports ( sock_net ( sk ), & fl4, sk, opt -> dst_addr. sin_addr. s_addr, opt -> src_addr. sin_addr. s_addr, 0, 0, IPPROTO_GRE, RT_CONN_FLAGS ( sk ), 0 ) ; if ( IS_ERR ( rt ) ) { error = - EHOSTUNREACH ; goto end ; } sk_setup_caps ( sk, & rt -> dst ) ; po -> chan. mtu = dst_mtu ( & rt -> dst ) ; if (! po -> chan. mtu ) po -> chan. mtu = PPP_MRU ; ip_rt_put ( rt ) ; po -> chan. mtu -= PPTP_HEADER_OVERHEAD ; po -> chan. hdrlen

Fix:
<S2SV_ModStart> ; if ( sockaddr_len < sizeof ( struct sockaddr_pppox ) ) return - EINVAL ; if (
Buggy code:
 bool_t xdr_nullstring ( XDR * xdrs, char * * objp ) { u_int size ; if ( xdrs -> x_op == XDR_ENCODE ) { if ( * objp == NULL ) size = 0 ; else size = strlen ( * objp ) + 1 ; } if (! xdr_u_int ( xdrs, & size ) ) { return FALSE ; } switch ( xdrs -> x_op ) { case XDR_DECODE : if ( size == 0 ) { * objp = NULL ; return TRUE ; } else if ( * objp == NULL ) { * objp = ( char * ) mem_alloc ( size ) ; if ( * objp == NULL ) { errno = ENOMEM ; return FALSE ; } } <START_BUG> return ( xdr_opaque ( xdrs, * objp, size ) ) ; <END_BUG> case XDR_ENCODE : if ( size!= 0 ) return ( xdr_opaque ( xdrs, * objp, size ) ) ; return TRUE ; case XDR_FREE : if ( * objp!= NULL ) mem_free ( * objp, size ) ; * objp = NULL ; return TRUE ; } return FALSE ; }

Fix:
<S2SV_ModStart> ; } } if (! <S2SV_ModEnd> xdr_opaque ( xdrs <S2SV_ModStart> size ) ) return FALSE ; if ( ( * objp ) [ size - 1 ]!= '\\0' ) return FALSE ; if ( memchr ( * objp, '\\0', size - 1 )!= NULL ) return FALSE ; return TRUE
Buggy code:
 static int usbhid_parse ( struct hid_device * hid ) { struct usb_interface * intf = to_usb_interface ( hid -> dev. parent ) ; struct usb_host_interface * interface = intf -> cur_altsetting ; struct usb_device * dev = interface_to_usbdev ( intf ) ; struct hid_descriptor * hdesc ; u32 quirks = 0 ; unsigned int rsize = 0 ; char * rdesc ; <START_BUG> int ret, n ; <END_BUG> quirks = usbhid_lookup_quirk ( le16_to_cpu ( dev -> descriptor. idVendor ), le16_to_cpu ( dev -> descriptor. idProduct ) ) ; if ( quirks & HID_QUIRK_IGNORE ) return - ENODEV ; if ( interface -> desc. bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT ) { if ( interface -> desc. bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD || interface -> desc. bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE ) quirks |= HID_QUIRK_NOGET ; } if ( usb_get_extra_descriptor ( interface, HID_DT_HID, & hdesc ) && (! interface -> desc. bNumEndpoints || usb_get_extra_descriptor ( & interface -> endpoint [ 0 ], HID_DT_HID, & hdesc ) ) ) { dbg_hid ( "class   descriptor   not   present\\n" ) ; return - ENODEV ; }  hid -> version = le16_to_cpu ( hdesc -> bcdHID ) ; <START_BUG> <END_BUG> hid -> country = hdesc -> bCountryCode ;  <START_BUG> for ( n = 0 ; n < hdesc -> bNumDescriptors ; n ++ ) <END_BUG> if ( hdesc -> desc [ n ]. bDescriptorType == HID_DT_REPORT ) rsize = le16_to_cpu ( hdesc -> desc [ n ]. wDescriptorLength ) ; if (! rsize || rsize > HID_MAX_DESCRIPTOR_SIZE ) { dbg_hid ( "weird   size   of   report   descriptor   (%u)\\n", rsize ) ; return - EINVAL ; } rdesc = kmalloc ( rsize, GFP_KERN

Fix:
<S2SV_ModStart> ret, n ; int num_descriptors ; size_t offset = offsetof ( struct hid_descriptor, desc ) <S2SV_ModStart> ENODEV ; } if ( hdesc -> bLength < sizeof ( struct hid_descriptor ) ) { dbg_hid ( "hid <S2SV_blank> descriptor <S2SV_blank> is <S2SV_blank> too <S2SV_blank> short\\n" ) ; return - EINVAL ; } <S2SV_ModStart> hdesc -> bCountryCode ; num_descriptors = min_t ( int, hdesc -> bNumDescriptors, ( hdesc -> bLength - offset ) // sizeof ( struct hid_class_descriptor ) ) <S2SV_ModStart> ; n < num_descriptors <S2SV_ModEnd> ; n ++
Buggy code:
 static int isoent_gen_joliet_identifier ( struct archive_write * a, struct isoent * isoent, struct idr * idr ) { struct iso9660 * iso9660 ; struct isoent * np ; unsigned char * p ; size_t l ; int r ; <START_BUG> int ffmax, parent_len ; <END_BUG> static const struct archive_rb_tree_ops rb_ops = { isoent_cmp_node_joliet, isoent_cmp_key_joliet } ; if ( isoent -> children. cnt == 0 ) return ( 0 ) ; iso9660 = a -> format_data ; if ( iso9660 -> opt. joliet == OPT_JOLIET_LONGNAME ) ffmax = 206 ; else ffmax = 128 ;  r = idr_start ( a, idr, isoent -> children. cnt, ffmax, 6, 2, & rb_ops ) ; <START_BUG> if ( r < 0 ) return ( r ) ; parent_len = 1 ; for ( np = isoent ; np -> parent!= np ; np = np -> parent ) parent_len += np -> mb_len + 1 ; for ( np = isoent -> children. first ; np!= NULL ; np = np -> chnext ) { unsigned char * dot ; int ext_off, noff, weight ; size_t lt ; <END_BUG> if ( ( int ) ( l = np -> file -> basename_utf16. length ) > ffmax )  l = ffmax ; p = malloc ( ( l + 1 ) * 2 ) ; if ( p == NULL ) { archive_set_error ( & a -> archive, ENOMEM, "Can\'t   allocate   memory" ) ; return ( ARCHIVE_FATAL ) ; } memcpy ( p, np -> file -> basename_utf16. s, l ) ; p [ l ] = 0 ; p [ l + 1 ] = 0 ; np -> identifier = ( char * ) p ; lt = l ; dot = p + l ; weight = 0 ; while ( lt > 0 ) { if (! joliet_allowed_char ( p [ 0 ], p [ 1 ] ) ) archive_be16enc ( p, 0x005F ) ; else if ( p [ 0 ] == 0 && p [ 1 ] == 0x2E ) dot

Fix:
<S2SV_ModStart> int r ; size_t <S2SV_ModEnd> ffmax, parent_len <S2SV_ModStart>. cnt, ( int ) <S2SV_ModStart> if ( ( <S2SV_ModEnd> l = np <S2SV_ModStart> ; if ( <S2SV_ModEnd> np -> file <S2SV_ModStart> if ( parent_len > 240 || <S2SV_ModEnd> np -> mb_len <S2SV_ModStart> mb_len > 240 || parent_len + np -> mb_len > 240 <S2SV_ModStart> } if ( <S2SV_ModEnd> l == ffmax <S2SV_ModStart> else if ( <S2SV_ModEnd> l == ffmax <S2SV_ModStart> else if ( <S2SV_ModEnd> l == ffmax
Buggy code:
 php_http_url_t * php_http_url_parse ( const char * str, size_t len, unsigned flags TSRMLS_DC ) { <START_BUG> size_t maxlen = 3 * len ; <END_BUG> struct parse_state * state = ecalloc ( 1, sizeof ( * state ) + maxlen ) ; state -> end = str + len ; state -> ptr = str ; state -> flags = flags ; state -> maxlen = maxlen ; TSRMLS_SET_CTX ( state -> ts ) ; if (! parse_scheme ( state ) ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Failed   to   parse   URL   scheme:   \'%s\'", state -> ptr ) ; efree ( state ) ; return NULL ; } if (! parse_hier ( state ) ) { efree ( state ) ; return NULL ; } if (! parse_query ( state ) ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Failed   to   parse   URL   query:   \'%s\'", state -> ptr ) ; efree ( state ) ; return NULL ; } if (! parse_fragment ( state ) ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Failed   to   parse   URL   fragment:   \'%s\'", state -> ptr ) ; efree ( state ) ; return NULL ; } return ( php_http_url_t * ) state ; }

Fix:
<S2SV_ModStart> 3 * len + 8
Buggy code:
 static void set_block_size ( VP9_COMP * const cpi, <START_BUG> const TileInfo * const tile, <END_BUG> int mi_row, int mi_col, BLOCK_SIZE bsize ) { if ( cpi -> common. mi_cols > mi_col && cpi -> common. mi_rows > mi_row ) {  MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; <START_BUG> <END_BUG> set_modeinfo_offsets ( & cpi -> common, xd, mi_row, mi_col ) ;  xd -> mi [ 0 ] -> mbmi. sb_type = bsize ; <START_BUG> duplicate_mode_info_in_sb ( & cpi -> common, xd, mi_row, mi_col, bsize ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> const cpi, MACROBLOCK * const x, MACROBLOCKD * const xd <S2SV_ModEnd>, int mi_row <S2SV_ModStart> mi_row ) { set_mode_info_offsets <S2SV_ModEnd> ( & cpi <S2SV_ModStart> cpi -> common, x <S2SV_ModStart> = bsize ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 static int lockd ( void * vrqstp ) { int err = 0 ; <START_BUG> struct svc_rqst * rqstp = vrqstp ; <END_BUG> set_freezable ( ) ; allow_signal ( SIGKILL ) ; dprintk ( "NFS   locking   service   started   (ver   " LOCKD_VERSION ").\\n" ) ; while (! kthread_should_stop ( ) ) { long timeout = MAX_SCHEDULE_TIMEOUT ; RPC_IFDEBUG ( char buf [ RPC_MAX_ADDRBUFLEN ] ) ; rqstp -> rq_server -> sv_maxconn = nlm_max_connections ; if ( signalled ( ) ) { flush_signals ( current ) ; restart_grace ( ) ; continue ; } timeout = nlmsvc_retry_blocked ( ) ; err = svc_recv ( rqstp, timeout ) ; if ( err == - EAGAIN || err == - EINTR ) continue ; dprintk ( "lockd:   request   from   %s\\n", svc_print_addr ( rqstp, buf, sizeof ( buf ) ) ) ; svc_process ( rqstp ) ; } flush_signals ( current ) ; if ( nlmsvc_ops ) nlmsvc_invalidate_all ( ) ; nlm_shutdown_hosts ( ) ;  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> rqstp = vrqstp ; struct net * net = & init_net ; struct lockd_net * ln = net_generic ( net, lockd_net_id ) <S2SV_ModStart> ( ) ; cancel_delayed_work_sync ( & ln -> grace_period_end ) ; locks_end_grace ( & ln -> lockd_manager ) ;
Buggy code:
 PyObject * ast2obj_arg ( void * _o ) { arg_ty o = ( arg_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } result = PyType_GenericNew ( arg_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_identifier ( o -> arg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_arg, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> annotation ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_annotation, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_string ( o -> type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_comment, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> lineno ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_lineno, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> col_offset ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_col_offset, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } result
Buggy code:
 <START_BUG> static void <END_BUG> swabHorAcc32 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { uint32 * wp = ( uint32 * ) cp0 ; tmsize_t wc = cc // 4 ; TIFFSwabArrayOfLong ( wp, wc ) ;  horAcc32 ( tif, cp0, cc ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> swabHorAcc32 ( TIFF <S2SV_ModStart> wc ) ; return
Buggy code:
 static int cop1Emulate ( struct pt_regs * xcp, struct mips_fpu_struct * ctx, void * __user * fault_addr ) { mips_instruction ir ; unsigned long emulpc, contpc ; unsigned int cond ; if (! access_ok ( VERIFY_READ, xcp -> cp0_epc, sizeof ( mips_instruction ) ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) xcp -> cp0_epc ; return SIGBUS ; } if ( __get_user ( ir, ( mips_instruction __user * ) xcp -> cp0_epc ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) xcp -> cp0_epc ; return SIGSEGV ; } if ( ( xcp -> cp0_cause & CAUSEF_BD ) &&! isBranchInstr ( & ir ) ) xcp -> cp0_cause &= ~ CAUSEF_BD ; if ( xcp -> cp0_cause & CAUSEF_BD ) { emulpc = xcp -> cp0_epc + 4 ; if ( __compute_return_epc ( xcp ) ) { # ifdef CP1DBG printk ( "failed   to   emulate   branch   at   %p\\n", ( void * ) ( xcp -> cp0_epc ) ) ; # endif return SIGILL ; } if (! access_ok ( VERIFY_READ, emulpc, sizeof ( mips_instruction ) ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) emulpc ; return SIGBUS ; } if ( __get_user ( ir, ( mips_instruction __user * ) emulpc ) ) { MIPS_FPU_EMU_INC_STATS ( errors ) ; * fault_addr = ( mips_instruction __user * ) emulpc ; return SIGSEGV ; } contpc = xcp -> cp0_epc ; xcp -> cp0_epc = emulpc

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, xcp,
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG> fprintf ( stderr, "Usage:   %s   <width>   <height>   <infile>   <outfile>   <frame>\\n", exec_name ) ; exit ( EXIT_FAILURE ) ; }

Fix:
<S2SV_ModStart> void usage_exit ( void
Buggy code:
 int main ( int argc, char * * argv ) { test_cmp_parameters inParam ; FILE * fbase = NULL, * ftest = NULL ; int same = 0 ; <START_BUG> char lbase [ 256 ] ; <END_BUG>  char strbase [ 256 ] ; <START_BUG> <END_BUG> char ltest [ 256 ] ;  <START_BUG> char strtest [ 256 ] ; <END_BUG> if ( parse_cmdline_cmp ( argc, argv, & inParam ) == 1 ) { compare_dump_files_help_display ( ) ; goto cleanup ; } printf ( "******Parameters*********   \\n" ) ; printf ( "   base_filename   =   %s\\n" "   test_filename   =   %s\\n", inParam. base_filename, inParam. test_filename ) ; printf ( "*************************   \\n" ) ; printf ( "Try   to   open:   %s   for   reading  ...   ", inParam. base_filename ) ; if ( ( fbase = fopen ( inParam. base_filename, "rb" ) ) == NULL ) { goto cleanup ; } printf ( "Ok.\\n" ) ; printf ( "Try   to   open:   %s   for   reading  ...   ", inParam. test_filename ) ; if ( ( ftest = fopen ( inParam. test_filename, "rb" ) ) == NULL ) { goto cleanup ; } printf ( "Ok.\\n" ) ; while ( fgets ( lbase, sizeof ( lbase ), fbase ) && fgets ( ltest, sizeof ( ltest ), ftest ) ) {  int nbase = sscanf ( lbase, "%255[^\\r\\n]", strbase ) ; <START_BUG> <END_BUG> int ntest = sscanf ( ltest, "%255[^\\r\\n]", strtest ) ;  <START_BUG> assert ( nbase!= 255 && ntest!= 255 ) ; <END_BUG> if ( nbase!= 1 || ntest!= 1 ) { fprintf ( stderr, "could   not   parse   line   from   files\\n" ) ; goto cleanup ; } if ( strcmp ( strbase, strtest )!= 0 ) { fprintf ( stderr, "<%s>   vs.   <%s>\\n", strbase, strtest ) ; goto cleanup ; } } same = 1 ; printf

Fix:
<S2SV_ModStart> char lbase [ 512 <S2SV_ModEnd> ] ; char <S2SV_ModStart> char strbase [ 512 <S2SV_ModEnd> ] ; char <S2SV_ModStart> char ltest [ 512 <S2SV_ModEnd> ] ; char <S2SV_ModStart> char strtest [ 512 <S2SV_ModEnd> ] ; if <S2SV_ModStart> ( lbase, "%511[^\\r\\n]" <S2SV_ModEnd>, strbase ) <S2SV_ModStart> ( ltest, "%511[^\\r\\n]" <S2SV_ModEnd>, strtest ) <S2SV_ModStart> ( nbase!= 511 <S2SV_ModEnd> && ntest!= <S2SV_ModStart> && ntest!= 511 <S2SV_ModEnd> ) ; if
Buggy code:
 PHP_FUNCTION ( radius_get_vendor_attr ) { <START_BUG> int res ; <END_BUG>  const void * data ; <START_BUG> int len ; <END_BUG> u_int32_t vendor ;  <START_BUG> if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "s", & data, & len ) == FAILURE ) { <END_BUG> return ; }  res = rad_get_vendor_attr ( & vendor, & data, ( size_t * ) & len ) ; <START_BUG> if ( res == - 1 ) { RETURN_FALSE ; } else { array_init ( return_value ) ; <END_BUG> add_assoc_long ( return_value, "attr", res ) ;  add_assoc_long ( return_value, "vendor", vendor ) ; <START_BUG> add_assoc_stringl ( return_value, "data", ( char * ) data, len, 1 ) ; <END_BUG> return ; } }

Fix:
<S2SV_ModStart> radius_get_vendor_attr ) { <S2SV_ModEnd> const void * <S2SV_ModStart> void * data, * raw <S2SV_ModStart> ; u_int32_t vendor ; unsigned char type ; size_t data_len <S2SV_ModStart> "s", & raw <S2SV_ModEnd>, & len <S2SV_ModStart> return ; } if ( <S2SV_ModEnd> rad_get_vendor_attr ( & <S2SV_ModStart> vendor, & type, & data, & data_len, raw, len ) <S2SV_ModEnd> == - 1 <S2SV_ModStart>, "attr", type <S2SV_ModEnd> ) ; add_assoc_long <S2SV_ModStart> ) data, data_len <S2SV_ModEnd>, 1 )
Buggy code:
 static int nr_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct sockaddr_ax25 * sax = ( struct sockaddr_ax25 * ) msg -> msg_name ; size_t copied ; struct sk_buff * skb ; int er ; lock_sock ( sk ) ; if ( sk -> sk_state!= TCP_ESTABLISHED ) { release_sock ( sk ) ; return - ENOTCONN ; } if ( ( skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & er ) ) == NULL ) { release_sock ( sk ) ; return er ; } skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } er = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( er < 0 ) { skb_free_datagram ( sk, skb ) ; release_sock ( sk ) ; return er ; } if ( sax!= NULL ) { memset ( sax, 0, sizeof ( * sax ) ) ; sax -> sax25_family = AF_NETROM ; skb_copy_from_linear_data_offset ( skb, 7, sax -> sax25_call. ax25_call, AX25_ADDR_LEN ) ; <START_BUG> } <END_BUG> msg -> msg_namelen = sizeof ( * sax ) ;  skb_free_datagram ( sk, skb ) ; <START_BUG> release_sock ( sk ) ; return copied ; }<END_BUG>

Fix:
<S2SV_ModStart> AX25_ADDR_LEN ) ; <S2SV_ModEnd> msg -> msg_namelen <S2SV_ModStart> sax ) ; }
Buggy code:
 static char * search_make_new ( const struct search_state * const state, int n, const char * const base_name ) { const size_t base_len = strlen ( base_name ) ; <START_BUG> const char need_to_append_dot = base_name [ base_len - 1 ] == '.'? 0 : 1 ; <END_BUG>  struct search_domain * dom ; <START_BUG> for ( dom = state -> head ; dom ; dom = dom -> next ) { if (! n -- ) { const u8 * const postfix = ( ( u8 * ) dom ) + sizeof ( struct search_domain ) ; const int postfix_len = dom -> len ; char * const newname = ( char * ) mm_malloc ( base_len + need_to_append_dot + postfix_len + 1 ) ; if (! newname ) return NULL ; memcpy ( newname, base_name, base_len ) ; if ( need_to_append_dot ) newname [ base_len ] = '.' ; memcpy ( newname + base_len + need_to_append_dot, postfix, postfix_len ) ; newname [ base_len + need_to_append_dot + postfix_len ] = 0 ; return newname ; } } EVUTIL_ASSERT ( 0 ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> base_name ) ; char need_to_append_dot ; struct search_domain * dom ; if (! base_len ) return NULL ; <S2SV_ModEnd> need_to_append_dot = base_name <S2SV_ModStart> : 1 ; <S2SV_ModEnd> for ( dom
Buggy code:
 static int udf_load_logicalvol ( struct super_block * sb, sector_t block, struct kernel_lb_addr * fileset ) { struct logicalVolDesc * lvd ; <START_BUG> int i, j, offset ; <END_BUG> uint8_t type ; struct udf_sb_info * sbi = UDF_SB ( sb ) ; struct genericPartitionMap * gpm ; uint16_t ident ; struct buffer_head * bh ; unsigned int table_len ; int ret = 0 ; bh = udf_read_tagged ( sb, block, block, & ident ) ; if (! bh ) return 1 ; BUG_ON ( ident!= TAG_IDENT_LVD ) ; lvd = ( struct logicalVolDesc * ) bh -> b_data ; table_len = le32_to_cpu ( lvd -> mapTableLength ) ; if ( sizeof ( * lvd ) + table_len > sb -> s_blocksize ) { udf_err ( sb, "error   loading   logical   volume   descriptor:   " "Partition   table   too   long   (%u   >   %lu)\\n", table_len, sb -> s_blocksize - sizeof ( * lvd ) ) ; goto out_bh ; } ret = udf_sb_alloc_partition_maps ( sb, le32_to_cpu ( lvd -> numPartitionMaps ) ) ; if ( ret ) goto out_bh ; for ( i = 0, offset = 0 ; i < sbi -> s_partitions && offset < table_len ; i ++, offset += gpm -> partitionMapLength ) { struct udf_part_map * map = & sbi -> s_partmaps [ i ] ; gpm = ( struct genericPartitionMap * ) & ( lvd -> partitionMaps [ offset ] ) ; type = gpm -> partitionMapType ; if ( type == 1 ) { struct genericPartitionMap1 * gpm1 = ( struct genericPartitionMap1 * ) gpm ; map -> s_partition_type = UDF_TYPE1_MAP15 ; map -> s_volumeseqnum = le16_to_cpu ( gpm1 -> volSeqNum ) ; map -> s_partition_num = le16_to_cpu ( gpm1 -> partitionNum ) ; map -> s_partition_func = NULL ; } else if ( type ==

Fix:
<S2SV_ModStart> ; int i <S2SV_ModEnd>, offset ; <S2SV_ModStart> ) ) { if ( udf_load_sparable_map ( sb, map, ( <S2SV_ModEnd> struct sparablePartitionMap * <S2SV_ModStart> struct sparablePartitionMap * ) gpm ) < 0 ) goto out_bh <S2SV_ModEnd> ; } else
Buggy code:
 int vp8_yv12_de_alloc_frame_buffer ( YV12_BUFFER_CONFIG * ybf ) { if ( ybf ) { if ( ybf -> buffer_alloc_sz > 0 ) { vpx_free ( ybf -> buffer_alloc ) ; } <START_BUG> vpx_memset ( ybf, 0, sizeof ( YV12_BUFFER_CONFIG ) ) ; <END_BUG> } else { return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> ) ; } memset <S2SV_ModEnd> ( ybf,
Buggy code:
 static void dex_parse_debug_item ( RBinFile * binfile, RBinDexObj * bin, RBinDexClass * c, int MI, int MA, int paddr, int ins_size, int insns_size, char * class_name, int regsz, int debug_info_off ) { struct r_bin_t * rbin = binfile -> rbin ; const ut8 * p4 = r_buf_get_at ( binfile -> buf, debug_info_off, NULL ) ; const ut8 * p4_end = p4 + binfile -> buf -> length - debug_info_off ; ut64 line_start ; ut64 parameters_size ; ut64 param_type_idx ; ut16 argReg = regsz - ins_size ; ut64 source_file_idx = c -> source_file ; RList * params, * debug_positions, * emitted_debug_locals = NULL ; bool keep = true ; if ( argReg > regsz ) { return ; } p4 = r_uleb128 ( p4, p4_end - p4, & line_start ) ; p4 = r_uleb128 ( p4, p4_end - p4, & parameters_size ) ; ut32 address = 0 ; ut32 line = line_start ; if (! ( debug_positions = r_list_newf ( ( RListFree ) free ) ) ) { return ; } if (! ( emitted_debug_locals = r_list_newf ( ( RListFree ) free ) ) ) { r_list_free ( debug_positions ) ; return ; } struct dex_debug_local_t debug_locals [ regsz ] ; memset ( debug_locals, 0, sizeof ( struct dex_debug_local_t ) * regsz ) ; if (! ( MA & 0x0008 ) ) { debug_locals [ argReg ]. name = "this" ; debug_locals [ argReg ]. descriptor = r_str_newf ( "%s;", class_name ) ; debug_locals [ argReg ]. startAddress = 0 ; debug_locals [ argReg ]. signature = NULL ; debug_locals [ argReg ]. live = true ; argReg ++ ; } if (! ( params = d

Fix:
<S2SV_ModStart> parameters_size ; } if ( p4 <= 0 ) { return ; }
Buggy code:
 int main ( int argc, char * * argv ) { mode_t old_umask ; <START_BUG> cleanup_free char * base_path = NULL ; <END_BUG> int clone_flags ; char * old_cwd = NULL ; pid_t pid ; int event_fd = - 1 ; int child_wait_fd = - 1 ; int setup_finished_pipe [ ] = { - 1, - 1 } ; const char * new_cwd ; uid_t ns_uid ; gid_t ns_gid ; struct stat sbuf ; uint64_t val ; int res UNUSED ; cleanup_free char * seccomp_data = NULL ; size_t seccomp_len ; struct sock_fprog seccomp_prog ; cleanup_free char * args_data = NULL ; if ( argc == 2 && ( strcmp ( argv [ 1 ], "--version" ) == 0 ) ) print_version_and_exit ( ) ; real_uid = getuid ( ) ; real_gid = getgid ( ) ; acquire_privs ( ) ; if ( prctl ( PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0 ) < 0 ) die_with_error ( "prctl(PR_SET_NO_NEW_CAPS)   failed" ) ; read_overflowids ( ) ; argv0 = argv [ 0 ] ; if ( isatty ( 1 ) ) host_tty_dev = ttyname ( 1 ) ; argv ++ ; argc -- ; if ( argc == 0 ) usage ( EXIT_FAILURE, stderr ) ; parse_args ( & argc, ( const char * * * ) & argv ) ; args_data = opt_args_data ; opt_args_data = NULL ; if ( ( requested_caps [ 0 ] || requested_caps [ 1 ] ) && is_privileged ) die ( "--cap-add   in   setuid   mode   can   be   used   only   by   root" ) ; if ( opt_userns_block_fd!= - 1 &&! opt_unshare_user ) die ( "--userns-block-fd   requires   --unshare-user" ) ; if ( opt_userns_block_fd!= - 1 && opt_info_fd == - 1 ) die ( "--userns-block-fd   requires   --info-fd" )

Fix:
<S2SV_ModStart> mode_t old_umask ; const <S2SV_ModEnd> char * base_path <S2SV_ModStart> ; base_path = "//tmp" ; <S2SV_ModEnd> __debug__ ( (
Buggy code:
 static char * pool_strdup ( const char * s ) { <START_BUG> char * r = pool_alloc ( strlen ( s ) + 1 ) ; <END_BUG>  strcpy ( r, s ) ; <START_BUG> return r ; }<END_BUG>

Fix:
<S2SV_ModStart> s ) { size_t len = strlen ( s ) + 1 ; <S2SV_ModStart> = pool_alloc ( len ) ; memcpy <S2SV_ModEnd> ( r, <S2SV_ModStart> r, s, len
Buggy code:
 static void parseFirstLine ( Webs * wp ) { char * op, * protoVer, * url, * host, * query, * path, * port, * ext, * buf ; int listenPort ; assert ( wp ) ; assert ( websValid ( wp ) ) ; op = getToken ( wp, 0 ) ; if ( op == NULL || * op == '\\0' ) { websError ( wp, HTTP_CODE_NOT_FOUND | WEBS_CLOSE, "Bad   HTTP   request" ) ; return ; } wp -> method = supper ( sclone ( op ) ) ; url = getToken ( wp, 0 ) ; if ( url == NULL || * url == '\\0' ) { websError ( wp, HTTP_CODE_BAD_REQUEST | WEBS_CLOSE, "Bad   HTTP   request" ) ; return ; } if ( strlen ( url ) > ME_GOAHEAD_LIMIT_URI ) { websError ( wp, HTTP_CODE_REQUEST_URL_TOO_LARGE | WEBS_CLOSE, "URI   too   big" ) ; return ; } protoVer = getToken ( wp, "\\r\\n" ) ; if ( websGetLogLevel ( ) == 2 ) { trace ( 2, "%s   %s   %s", wp -> method, url, protoVer ) ; } host = path = port = query = ext = NULL ; if ( websUrlParse ( url, & buf, NULL, & host, & port, & path, & ext, NULL, & query ) < 0 ) { error ( "Cannot   parse   URL:   %s", url ) ; websError ( wp, HTTP_CODE_BAD_REQUEST | WEBS_CLOSE | WEBS_NOLOG, "Bad   URL" ) ; return ; } <START_BUG> if ( ( wp -> path = websNormalizeUriPath ( path ) ) == 0 ) { <END_BUG> error ( "Cannot   normalize   URL:   %s", url ) ; websError ( wp, HTTP_CODE_BAD_REQUEST | WEBS_CLOSE | WEBS_NOLOG, "Bad   URL" ) ; wfree ( buf ) ; return ; } wp -> url = sclone ( url ) ; if ( ext ) { wp -> ext = sclone ( slower ( ext ) ) ; } wp -> filename = sfmt ( "%s%s", websGetDocuments ( ),

Fix:
<S2SV_ModStart> -> path = websValidateUriPath <S2SV_ModEnd> ( path )
Buggy code:
 static void make_response ( struct xen_blkif_ring * ring, u64 id, unsigned short op, int st ) { <START_BUG> struct blkif_response resp ; <END_BUG> unsigned long flags ; union blkif_back_rings * blk_rings ; int notify ;  resp. id = id ; <START_BUG> resp. operation = op ; resp. status = st ; spin_lock_irqsave ( & ring -> blk_ring_lock, flags ) ; blk_rings = & ring -> blk_rings ; switch ( ring -> blkif -> blk_protocol ) { case BLKIF_PROTOCOL_NATIVE : <END_BUG> memcpy ( RING_GET_RESPONSE ( & blk_rings -> native, blk_rings -> native. rsp_prod_pvt ),  & resp, sizeof ( resp ) ) ; break ; case BLKIF_PROTOCOL_X86_32 : <START_BUG> memcpy ( RING_GET_RESPONSE ( & blk_rings -> x86_32, blk_rings -> x86_32. rsp_prod_pvt ), <END_BUG> & resp, sizeof ( resp ) ) ; break ; case BLKIF_PROTOCOL_X86_64 :  memcpy ( RING_GET_RESPONSE ( & blk_rings -> x86_64, blk_rings -> x86_64. rsp_prod_pvt ), <START_BUG> & resp, sizeof ( resp ) ) ; break ; default : BUG ( ) ; <END_BUG> }  blk_rings -> common. rsp_prod_pvt ++ ; RING_PUSH_RESPONSES_AND_CHECK_NOTIFY ( & blk_rings -> common, notify ) ; spin_unlock_irqrestore ( & ring -> blk_ring_lock, flags ) ; if ( notify ) notify_remote_via_irq ( ring -> irq ) ; }

Fix:
<S2SV_ModStart> { struct blkif_response * <S2SV_ModStart> int notify ; <S2SV_ModEnd> spin_lock_irqsave ( & <S2SV_ModStart> case BLKIF_PROTOCOL_NATIVE : resp = <S2SV_ModEnd> RING_GET_RESPONSE ( & <S2SV_ModStart> native. rsp_prod_pvt <S2SV_ModEnd> ) ; break <S2SV_ModStart> case BLKIF_PROTOCOL_X86_32 : resp = <S2SV_ModEnd> RING_GET_RESPONSE ( & <S2SV_ModStart> x86_32. rsp_prod_pvt <S2SV_ModEnd> ) ; break <S2SV_ModStart> case BLKIF_PROTOCOL_X86_64 : resp = <S2SV_ModEnd> RING_GET_RESPONSE ( & <S2SV_ModStart>. rsp_prod_pvt ) <S2SV_ModEnd> ; break ; <S2SV_ModStart> ) ; } resp -> id = id ; resp -> operation = op ; resp -> status = st ;
Buggy code:
 struct sock * inet_csk_clone_lock ( const struct sock * sk, const struct request_sock * req, const gfp_t priority ) { struct sock * newsk = sk_clone_lock ( sk, priority ) ; if ( newsk ) { struct inet_connection_sock * newicsk = inet_csk ( newsk ) ; newsk -> sk_state = TCP_SYN_RECV ; newicsk -> icsk_bind_hash = NULL ; inet_sk ( newsk ) -> inet_dport = inet_rsk ( req ) -> ir_rmt_port ; inet_sk ( newsk ) -> inet_num = inet_rsk ( req ) -> ir_num ; inet_sk ( newsk ) -> inet_sport = htons ( inet_rsk ( req ) -> ir_num ) ; newsk -> sk_write_space = sk_stream_write_space ; sock_reset_flag ( newsk, SOCK_RCU_FREE ) ; <START_BUG> newsk -> sk_mark = inet_rsk ( req ) -> ir_mark ; <END_BUG> atomic64_set ( & newsk -> sk_cookie, atomic64_read ( & inet_rsk ( req ) -> ir_cookie ) ) ; newicsk -> icsk_retransmits = 0 ; newicsk -> icsk_backoff = 0 ; newicsk -> icsk_probes_out = 0 ; memset ( & newicsk -> icsk_accept_queue, 0, sizeof ( newicsk -> icsk_accept_queue ) ) ; security_inet_csk_clone ( newsk, req ) ; } return newsk ; }

Fix:
<S2SV_ModStart> SOCK_RCU_FREE ) ; inet_sk ( newsk ) -> mc_list = NULL ;
Buggy code:
 void vp8_pack_bitstream ( VP8_COMP * cpi, unsigned char * dest, unsigned char * dest_end, unsigned long * size ) { int i, j ; VP8_HEADER oh ; VP8_COMMON * const pc = & cpi -> common ; vp8_writer * const bc = cpi -> bc ; MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; int extra_bytes_packed = 0 ; unsigned char * cx_data = dest ; unsigned char * cx_data_end = dest_end ; const int * mb_feature_data_bits ; oh. show_frame = ( int ) pc -> show_frame ; oh. type = ( int ) pc -> frame_type ; oh. version = pc -> version ; oh. first_partition_length_in_bytes = 0 ; mb_feature_data_bits = vp8_mb_feature_data_bits ; bc [ 0 ]. error = & pc -> error ; validate_buffer ( cx_data, 3, cx_data_end, & cpi -> common. error ) ; cx_data += 3 ; # if defined ( SECTIONBITS_OUTPUT ) Sectionbits [ active_section = 1 ] += sizeof ( VP8_HEADER ) * 8 * 256 ; # endif if ( oh. type == KEY_FRAME ) { int v ; validate_buffer ( cx_data, 7, cx_data_end, & cpi -> common. error ) ; cx_data [ 0 ] = 0x9D ; cx_data [ 1 ] = 0x01 ; cx_data [ 2 ] = 0x2a ; v = ( pc -> horiz_scale << 14 ) | pc -> Width ; cx_data [ 3 ] = v ; cx_data [ 4 ] = v >> 8 ; v = ( pc -> vert_scale << 14 ) | pc -> Height ; cx_data [ 5 ] = v ; cx_data [ 6 ] = v >> 8 ; extra_bytes_packed = 7 ; cx_data += extra_bytes_packed ; vp8_start_encode ( bc, cx_data, cx_data_end ) ; vp8_write_bit ( bc, 0 ) ; vp8_write_bit ( bc, pc -> clamp_type ) ; } else vp8_start

Fix:
<S2SV_ModStart> 0 ) { memcpy <S2SV_ModEnd> ( & cpi <S2SV_ModStart> ++ ) { memmove <S2SV_ModEnd> ( dp, <S2SV_ModStart> else # endif vp8_pack_tokens <S2SV_ModEnd> ( & cpi
Buggy code:
 static void rd_release_device_space ( struct rd_dev * rd_dev ) { <START_BUG> u32 i, j, page_count = 0, sg_per_table ; <END_BUG> struct rd_dev_sg_table * sg_table ; struct page * pg ; struct scatterlist * sg ; if (! rd_dev -> sg_table_array ||! rd_dev -> sg_table_count ) return ;  sg_table = rd_dev -> sg_table_array ; <START_BUG> <END_BUG> for ( i = 0 ; i < rd_dev -> sg_table_count ; i ++ ) {  sg = sg_table [ i ]. sg_table ; sg_per_table = sg_table [ i ]. rd_sg_count ; for ( j = 0 ; j < sg_per_table ; j ++ ) { pg = sg_page ( & sg [ j ] ) ; if ( pg ) { __free_page ( pg ) ; page_count ++ ; } } kfree ( sg ) ; } pr_debug ( "CORE_RD[%u]   -   Released   device   space   for   Ramdisk" "   Device   ID:   %u,   pages   %u   in   %u   tables   total   bytes   %lu\\n", rd_dev -> rd_host -> rd_host_id, rd_dev -> rd_dev_id, page_count, rd_dev -> sg_table_count, ( unsigned long ) page_count * PAGE_SIZE ) ; <START_BUG> kfree ( sg_table ) ; <END_BUG> rd_dev -> sg_table_array = NULL ; rd_dev -> sg_table_count = 0 ; }

Fix:
<S2SV_ModStart> ) { u32 page_count <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) return ; page_count = rd_release_sgl_table ( rd_dev, <S2SV_ModEnd> rd_dev -> sg_table_array <S2SV_ModStart> rd_dev -> sg_table_array, <S2SV_ModEnd> rd_dev -> sg_table_count <S2SV_ModStart> rd_dev -> sg_table_count ) ; <S2SV_ModEnd> pr_debug ( "CORE_RD[%u] <S2SV_blank> - <S2SV_blank> Released <S2SV_blank> device <S2SV_blank> space <S2SV_blank> for <S2SV_blank> Ramdisk" <S2SV_ModStart> PAGE_SIZE ) ; <S2SV_ModEnd> rd_dev -> sg_table_array
Buggy code:
 void test_parser ( void ) { <START_BUG> int i, retval ; <END_BUG> bzrtpPacket_t * zrtpPacket ; bzrtpContext_t * context87654321 = bzrtp_createBzrtpContext ( 0x87654321 ) ; bzrtpContext_t * context12345678 = bzrtp_createBzrtpContext ( 0x12345678 ) ; memcpy ( context12345678 -> channelContext [ 0 ] -> selfH [ 0 ], H12345678 [ 0 ], 32 ) ; memcpy ( context12345678 -> channelContext [ 0 ] -> selfH [ 1 ], H12345678 [ 1 ], 32 ) ; memcpy ( context12345678 -> channelContext [ 0 ] -> selfH [ 2 ], H12345678 [ 2 ], 32 ) ; memcpy ( context12345678 -> channelContext [ 0 ] -> selfH [ 3 ], H12345678 [ 3 ], 32 ) ; memcpy ( context87654321 -> channelContext [ 0 ] -> selfH [ 0 ], H87654321 [ 0 ], 32 ) ; memcpy ( context87654321 -> channelContext [ 0 ] -> selfH [ 1 ], H87654321 [ 1 ], 32 ) ; memcpy ( context87654321 -> channelContext [ 0 ] -> selfH [ 2 ], H87654321 [ 2 ], 32 ) ; memcpy ( context87654321 -> channelContext [ 0 ] -> selfH [ 3 ], H87654321 [ 3 ], 32 ) ; context87654321 -> channelContext [ 0 ] -> keyAgreementAlgo = ZRTP_KEYAGREEMENT_DH3k ; context12345678 -> channelContext [ 0 ] -> keyAgreementAlgo = ZRTP_KEYAGREEMENT_DH3k ; context87654321 -> channelContext [ 0 ] -> cipherAlgo = ZRTP_CIPHER_AES1 ; context12345678 -> channelContext [ 0 ] -> cipherAlgo = ZRTP_CIPHER_AES1 ; context87654321 -> channelContext [ 0 ] -> hashAlgo = ZRTP_HASH_S256 ; context12345678 -> channelContext [

Fix:
<S2SV_ModStart> void ) { test_parser_param ( <S2SV_ModEnd> 0 ) ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int cib_remote_listen ( gpointer data ) { <START_BUG> int lpc = 0 ; <END_BUG> int csock = 0 ;  unsigned laddr ; <START_BUG> time_t now = 0 ; time_t start = time ( NULL ) ; struct sockaddr_in addr ; int ssock = * ( int * ) data ; <END_BUG> # ifdef HAVE_GNUTLS_GNUTLS_H  gnutls_session * session = NULL ; # endif cib_client_t * new_client = NULL ; <START_BUG> xmlNode * login = NULL ; <END_BUG> const char * user = NULL ; const char * pass = NULL ; const char * tmp = NULL ; # ifdef HAVE_DECL_NANOSLEEP const struct timespec sleepfast = { 0, 10000000 } ; # endif static struct mainloop_fd_callbacks remote_client_fd_callbacks = {. dispatch = cib_remote_msg,. destroy = cib_remote_connection_destroy, } ; laddr = sizeof ( addr ) ; csock = accept ( ssock, ( struct sockaddr * ) & addr, & laddr ) ; crm_debug ( "New   %s   connection   from   %s", ssock == remote_tls_fd? "secure" : "clear-text", inet_ntoa ( addr. sin_addr ) ) ; if ( csock == - 1 ) { crm_err ( "accept   socket   failed" ) ; return TRUE ; }  if ( ssock == remote_tls_fd ) { <START_BUG> # ifdef HAVE_GNUTLS_GNUTLS_H <END_BUG> session = create_tls_session ( csock, GNUTLS_SERVER ) ;  if ( session == NULL ) { crm_err ( "TLS   session   creation   failed" ) ; close ( csock ) ; return TRUE ; } # endif } <START_BUG> do { <END_BUG> crm_trace ( "Iter:   %d", lpc ++ ) ; if ( ssock == remote_tls_fd ) { # ifdef HAVE_GNUTLS_GNUTLS_H  login = crm_recv_remote_msg ( session, TRUE ) ; <START_BUG> # endif } else { <END_BUG> login = crm_recv_remote_msg ( GINT_TO_POINTER ( csock ), FALSE ) ;  }

Fix:
<S2SV_ModStart> ) { int <S2SV_ModEnd> csock = 0 <S2SV_ModStart> ; unsigned laddr <S2SV_ModEnd> ; struct sockaddr_in <S2SV_ModStart> ) data ; int flag ; <S2SV_ModStart> = NULL ; <S2SV_ModEnd> static struct mainloop_fd_callbacks <S2SV_ModStart> } if ( ( flag = fcntl ( csock, F_GETFL ) ) >= 0 ) { if ( fcntl ( csock, F_SETFL, flag | O_NONBLOCK ) < 0 ) { crm_err ( "fcntl() <S2SV_blank> write <S2SV_blank> failed" ) ; close ( csock ) ; return TRUE ; } } else { crm_err ( "fcntl() <S2SV_blank> read <S2SV_blank> failed" ) ; close ( csock ) ; return TRUE ; } if ( <S2SV_ModStart> HAVE_GNUTLS_GNUTLS_H session = crm_create_anon_tls_session <S2SV_ModEnd> ( csock, <S2SV_ModStart> csock, GNUTLS_SERVER, anon_cred_s <S2SV_ModStart> # endif } num_clients ++ ; new_client = calloc ( 1, sizeof ( cib_client_t ) ) ; new_client -> id = crm_generate_uuid ( ) ; new_client -> callback_id = NULL ; new_client -> remote_auth_timeout =
Buggy code:
 bool __net_get_random_once ( void * buf, int nbytes, bool * done, <START_BUG> struct static_key * done_key ) <END_BUG> { static DEFINE_SPINLOCK ( lock ) ; unsigned long flags ; spin_lock_irqsave ( & lock, flags ) ; if ( * done ) { spin_unlock_irqrestore ( & lock, flags ) ; return false ; } get_random_bytes ( buf, nbytes ) ; * done = true ; spin_unlock_irqrestore ( & lock, flags ) ;  __net_random_once_disable_jump ( done_key ) ; <START_BUG> return true ; }<END_BUG>

Fix:
<S2SV_ModStart> struct static_key * once_key <S2SV_ModEnd> ) { static <S2SV_ModStart> ; __net_random_once_disable_jump ( once_key <S2SV_ModEnd> ) ; return