nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int create_filesystem_object ( struct archive_write_disk * a ) { const char * linkname ; mode_t final_mode, mode ; int r ; <START_BUG> linkname = archive_entry_hardlink ( a -> entry ) ; <END_BUG> if ( linkname!= NULL ) { # if! HAVE_LINK return ( EPERM ) ;  # else <START_BUG> r = link ( linkname, a -> name )? errno : 0 ; if ( r == 0 && a -> filesize <= 0 ) { a -> todo = 0 ; a -> deferred = 0 ; } else if ( r == 0 && a -> filesize > 0 ) { a -> fd = open ( a -> name, O_WRONLY | O_TRUNC | O_BINARY | O_CLOEXEC ) ; __archive_ensure_cloexec_flag ( a -> fd ) ; if ( a -> fd < 0 ) r = errno ; } return ( r ) ; # endif } linkname = archive_entry_symlink ( a -> entry ) ; if ( linkname!= NULL ) { # if HAVE_SYMLINK return symlink ( linkname, a -> name )? errno : 0 ; # else return ( EPERM ) ; # endif } final_mode = a -> mode & 07777 ; mode = final_mode & 0777 & ~ a -> user_umask ; switch ( a -> mode & AE_IFMT ) { default : case AE_IFREG : a -> fd = open ( a -> name, O_WRONLY | O_CREAT | O_EXCL | O_BINARY | O_CLOEXEC, mode ) ; __archive_ensure_cloexec_flag ( a -> fd ) ; r = ( a -> fd < 0 ) ; break ; case AE_IFCHR : # ifdef HAVE_MKNOD r = mknod ( a -> name, mode | S_IFCHR, archive_entry_rdev ( a -> entry ) ) ; break ; # else return ( EINVAL ) ; # endif case AE_IFBLK : # ifdef HAVE_MKNOD r = mknod ( a -> name, mode | S_IFBLK, archive_entry_rdev ( a -> entry ) ) ; break ; # else return ( EINVAL ) ; # endif case AE_IFDIR : mode = ( mode |<END_BUG>

Fix:
<S2SV_ModStart> int r ; char * linkname_copy ; struct archive_string error_string ; int error_number ; <S2SV_ModStart> ; # else archive_string_init ( & error_string ) ; linkname_copy = strdup ( linkname ) ; if ( linkname_copy == NULL ) { return ( EPERM ) ; } r = cleanup_pathname_fsobj ( linkname_copy, & error_number, & error_string, a -> flags ) ; if ( r!= ARCHIVE_OK ) { archive_set_error ( & a -> archive, error_number, "%s", error_string. s ) ; free ( linkname_copy ) ; return ( EPERM ) ; } r = check_symlinks_fsobj ( linkname_copy, & error_number, & error_string, a -> flags ) ; if ( r!= ARCHIVE_OK ) { archive_set_error ( & a -> archive, error_number, "%s", error_string. s ) ; free ( linkname_copy ) ; return ( EPERM ) ; } free ( linkname_copy ) ;
Buggy code:
 static noinline int btrfs_ioctl_resize ( struct file * file, void __user * arg ) { struct inode * inode = file_inode ( file ) ; struct btrfs_fs_info * fs_info = btrfs_sb ( inode -> i_sb ) ; u64 new_size ; u64 old_size ; u64 devid = 1 ; struct btrfs_root * root = BTRFS_I ( inode ) -> root ; struct btrfs_ioctl_vol_args * vol_args ; struct btrfs_trans_handle * trans ; struct btrfs_device * device = NULL ; char * sizestr ; char * retptr ; char * devstr = NULL ; int ret = 0 ; int mod = 0 ; if (! capable ( CAP_SYS_ADMIN ) ) return - EPERM ; ret = mnt_want_write_file ( file ) ; if ( ret ) return ret ; if ( test_and_set_bit ( BTRFS_FS_EXCL_OP, & fs_info -> flags ) ) { mnt_drop_write_file ( file ) ; return BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS ; } vol_args = memdup_user ( arg, sizeof ( * vol_args ) ) ; if ( IS_ERR ( vol_args ) ) { ret = PTR_ERR ( vol_args ) ; goto out ; } vol_args -> name [ BTRFS_PATH_NAME_MAX ] = '\\0' ; sizestr = vol_args -> name ; devstr = strchr ( sizestr, ':' ) ; if ( devstr ) { sizestr = devstr + 1 ; * devstr = '\\0' ; devstr = vol_args -> name ; ret = kstrtoull ( devstr, 10, & devid ) ; if ( ret ) goto out_free ; if (! devid ) { ret = - EINVAL ; goto out_free ; } btrfs_info ( fs_info, "resizing   devid   %llu", devid ) ; } <START_BUG> device = btrfs_find_device ( fs_info -> fs_devices, devid, NULL, NULL ) ; <END_BUG> if (! device ) { btrfs_info ( fs_

Fix:
<S2SV_ModStart> NULL, NULL, true
Buggy code:
 int lzxd_decompress ( struct lzxd_stream * lzx, off_t out_bytes ) { register unsigned int bit_buffer ; register int bits_left, i = 0 ; unsigned char * i_ptr, * i_end ; register unsigned short sym ; int match_length, length_footer, extra, verbatim_bits, bytes_todo ; int this_run, main_element, aligned_bits, j ; unsigned char * window, * runsrc, * rundest, buf [ 12 ] ; unsigned int frame_size = 0, end_frame, match_offset, window_posn ; unsigned int R0, R1, R2 ; if (! lzx || ( out_bytes < 0 ) ) return MSPACK_ERR_ARGS ; if ( lzx -> error ) return lzx -> error ; i = lzx -> o_end - lzx -> o_ptr ; if ( ( off_t ) i > out_bytes ) i = ( int ) out_bytes ; if ( i ) { if ( lzx -> sys -> write ( lzx -> output, lzx -> o_ptr, i )!= i ) { return lzx -> error = MSPACK_ERR_WRITE ; } lzx -> o_ptr += i ; lzx -> offset += i ; out_bytes -= i ; } if ( out_bytes == 0 ) return MSPACK_ERR_OK ; RESTORE_BITS ; window = lzx -> window ; window_posn = lzx -> window_posn ; R0 = lzx -> R0 ; R1 = lzx -> R1 ; R2 = lzx -> R2 ; end_frame = ( unsigned int ) ( ( lzx -> offset + out_bytes ) // LZX_FRAME_SIZE ) + 1 ; while ( lzx -> frame < end_frame ) { if ( lzx -> reset_interval && ( ( lzx -> frame % lzx -> reset_interval ) == 0 ) ) { if ( lzx -> block_remaining ) { D ( ( "%d   bytes   remaining   at   reset   interval", lzx -> block_remaining ) ) return lzx -> error = MSPACK_ERR_DECRUNCH ; } lzxd

Fix:
<S2SV_ModStart> case LZX_BLOCKTYPE_UNCOMPRESSED : if ( window_posn + this_run > lzx -> window_size ) { D ( ( "match <S2SV_blank> ran <S2SV_blank> over <S2SV_blank> window <S2SV_blank> boundary" ) ) return lzx -> error = MSPACK_ERR_DECRUNCH ; }
Buggy code:
 static vpx_codec_err_t encoder_set_config ( vpx_codec_alg_priv_t * ctx, const vpx_codec_enc_cfg_t * cfg ) { vpx_codec_err_t res ; <START_BUG> if ( cfg -> g_w!= ctx -> cfg. g_w || cfg -> g_h!= ctx -> cfg. g_h ) <END_BUG>  ERROR ( "Cannot   change   width   or   height   after   initialization" ) ; <START_BUG> if ( cfg -> g_lag_in_frames > ctx -> cfg. g_lag_in_frames ) ERROR ( "Cannot   increase   lag_in_frames" ) ; res = validate_config ( ctx, cfg, & ctx -> extra_cfg ) ; if ( res == VPX_CODEC_OK ) { ctx -> cfg = * cfg ; set_encoder_config ( & ctx -> oxcf, & ctx -> cfg, & ctx -> extra_cfg ) ; <END_BUG> vp9_change_config ( ctx -> cpi, & ctx -> oxcf ) ;  <START_BUG> } <END_BUG> return res ; }

Fix:
<S2SV_ModStart> vpx_codec_err_t res ; int force_key = 0 ; if ( cfg -> g_w!= ctx -> cfg. g_w || cfg -> g_h!= ctx -> cfg. g_h ) { if ( cfg -> g_lag_in_frames > 1 || cfg -> g_pass!= VPX_RC_ONE_PASS <S2SV_ModEnd> ) ERROR ( <S2SV_ModStart> "Cannot <S2SV_blank> change <S2SV_blank> width <S2SV_blank> or <S2SV_blank> height <S2SV_blank> after <S2SV_blank> initialization" ) ; if (! valid_ref_frame_size ( ctx -> cfg. g_w, ctx -> cfg. g_h, cfg -> g_w, cfg -> g_h ) || ( ctx -> cpi -> initial_width && ( int ) cfg -> g_w > ctx -> cpi -> initial_width ) || ( ctx -> cpi -> initial_height && ( int ) cfg -> g_h > ctx -> cpi -> initial_height ) ) force_key = 1 ; } <S2SV_ModStart> extra_cfg ) ; force_key |= ctx -> cpi -> common. profile!= ctx -> oxcf. profile ; <S2SV_ModStart> ) ; } if ( force_key ) ctx -> next_frame_flags |= VPX
Buggy code:
 void __sock_recv_timestamp ( struct msghdr * msg, struct sock * sk, struct sk_buff * skb ) { int need_software_tstamp = sock_flag ( sk, SOCK_RCVTSTAMP ) ; struct scm_timestamping tss ; int empty = 1 ; struct skb_shared_hwtstamps * shhwtstamps = skb_hwtstamps ( skb ) ; if ( need_software_tstamp && skb -> tstamp == 0 ) __net_timestamp ( skb ) ; if ( need_software_tstamp ) { if (! sock_flag ( sk, SOCK_RCVTSTAMPNS ) ) { struct timeval tv ; skb_get_timestamp ( skb, & tv ) ; put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMP, sizeof ( tv ), & tv ) ; } else { struct timespec ts ; skb_get_timestampns ( skb, & ts ) ; put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMPNS, sizeof ( ts ), & ts ) ; } } memset ( & tss, 0, sizeof ( tss ) ) ; if ( ( sk -> sk_tsflags & SOF_TIMESTAMPING_SOFTWARE ) && ktime_to_timespec_cond ( skb -> tstamp, tss. ts + 0 ) ) empty = 0 ; if ( shhwtstamps && ( sk -> sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE ) && ktime_to_timespec_cond ( shhwtstamps -> hwtstamp, tss. ts + 2 ) ) empty = 0 ; if (! empty ) { put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMPING, sizeof ( tss ), & tss ) ; if ( skb_is_err_queue ( skb ) && skb -> len && <START_BUG> ( sk -> sk_tsflags & SOF_TIMESTAMPING_OPT_STATS ) ) <END_BUG> put_cmsg ( msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS, skb -> len, skb -> data ) ; } }

Fix:
<S2SV_ModStart> -> len && SKB_EXT_ERR ( skb ) -> opt_stats <S2SV_ModEnd> ) put_cmsg (
Buggy code:
 int use_env ( ) { int indent ; size_t flags = 0 ; json_t * json ; json_error_t error ; # ifdef _WIN32 _setmode ( _fileno ( stdout ), _O_BINARY ) ; _setmode ( _fileno ( stderr ), _O_BINARY ) ; # endif indent = getenv_int ( "JSON_INDENT" ) ; if ( indent < 0 || indent > 255 ) { fprintf ( stderr, "invalid   value   for   JSON_INDENT:   %d\\n", indent ) ; return 2 ; } if ( indent > 0 ) flags |= JSON_INDENT ( indent ) ; if ( getenv_int ( "JSON_COMPACT" ) > 0 ) flags |= JSON_COMPACT ; if ( getenv_int ( "JSON_ENSURE_ASCII" ) ) flags |= JSON_ENSURE_ASCII ; if ( getenv_int ( "JSON_PRESERVE_ORDER" ) ) flags |= JSON_PRESERVE_ORDER ; if ( getenv_int ( "JSON_SORT_KEYS" ) ) flags |= JSON_SORT_KEYS ; <START_BUG> if ( getenv_int ( "STRIP" ) ) { <END_BUG> size_t size = 0, used = 0 ; char * buffer = NULL ; while ( 1 ) { size_t count ; size = ( size == 0? 128 : size * 2 ) ; buffer = realloc ( buffer, size ) ; if (! buffer ) { fprintf ( stderr, "Unable   to   allocate   %d   bytes\\n", ( int ) size ) ; return 1 ; } count = fread ( buffer + used, 1, size - used, stdin ) ; if ( count < size - used ) { buffer [ used + count ] = '\\0' ; break ; } used += count ; } json = json_loads ( strip ( buffer ), 0, & error ) ; free ( buffer ) ; } else json = json_loadf ( stdin, 0, & error ) ; if (! json ) { fprintf ( stderr, "%d   %d   %d\\n%s\\n", error. line, error. column, error. position, error. text ) ; return 1 ; } json_dumpf ( json, stdout, flags ) ; json_decref ( json ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( getenv ( "HASHSEED" ) ) json_object_seed ( getenv_int ( "HASHSEED" ) ) ; if (
Buggy code:
 static Image * ReadPWPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char filename [ MagickPathExtent ] ; FILE * file ; Image * image, * next_image, * pwp_image ; ImageInfo * read_info ; int c, unique_file ; MagickBooleanType status ; register Image * p ; register ssize_t i ; size_t filesize, length ; ssize_t count ; unsigned char magick [ MagickPathExtent ] ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } pwp_image = image ; memset ( magick, 0, sizeof ( magick ) ) ; count = ReadBlob ( pwp_image, 5, magick ) ; if ( ( count!= 5 ) || ( LocaleNCompare ( ( char * ) magick, "SFW95", 5 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; read_info = CloneImageInfo ( image_info ) ; ( void ) SetImageInfoProgressMonitor ( read_info, ( MagickProgressMonitor ) NULL, ( void * ) NULL ) ; SetImageInfoBlob ( read_info, ( void * ) NULL, 0 ) ; unique_file = AcquireUniqueFileResource ( filename ) ; ( void ) FormatLocaleString ( read_info -> filename, MagickPathExtent, "sfw:%s", filename ) ; for ( ; ; ) { ( void ) memset ( magick, 0, sizeof ( magick ) ) ; for ( c = ReadBlobByte ( pwp_image ) ; c!= EOF ; c = ReadBlobByte ( pwp_image ) ) { for ( i = 0 ;

Fix:
<S2SV_ModStart> ) break ; if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 const char * linkaddr_string ( netdissect_options * ndo, const u_char * ep, const unsigned int type, const unsigned int len ) { register u_int i ; register char * cp ; <START_BUG> register struct enamemem * tp ; <END_BUG> if ( len == 0 ) return ( "<empty>" ) ; if ( type == LINKADDR_ETHER && len == ETHER_ADDR_LEN ) return ( etheraddr_string ( ndo, ep ) ) ; if ( type == LINKADDR_FRELAY ) return ( q922_string ( ndo, ep, len ) ) ; tp = lookup_bytestring ( ndo, ep, len ) ;  if ( tp -> e_name ) <START_BUG> return ( tp -> e_name ) ; tp -> e_name = cp = ( char * ) malloc ( len * 3 ) ; <END_BUG> if ( tp -> e_name == NULL )  ( * ndo -> ndo_error ) ( ndo, "linkaddr_string:   malloc" ) ; * cp ++ = hex [ * ep >> 4 ] ; * cp ++ = hex [ * ep ++ & 0xf ] ; for ( i = len - 1 ; i > 0 ; -- i ) { * cp ++ = ':' ; * cp ++ = hex [ * ep >> 4 ] ; * cp ++ = hex [ * ep ++ & 0xf ] ; } * cp = '\\0' ; <START_BUG> return ( tp -> e_name ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ; register struct bsnamemem <S2SV_ModEnd> * tp ; <S2SV_ModStart> ( tp -> bs_name ) return ( tp -> bs_name ) ; tp -> bs_name <S2SV_ModEnd> = cp = <S2SV_ModStart> ( tp -> bs_name <S2SV_ModEnd> == NULL ) <S2SV_ModStart> ( tp -> bs_name <S2SV_ModEnd> ) ; }
Buggy code:
 static int f2fs_read_data_page ( struct file * file, struct page * page ) { <START_BUG> struct inode * inode = page -> mapping -> host ; <END_BUG> int ret = - EAGAIN ; trace_f2fs_readpage ( page, DATA ) ; if ( f2fs_has_inline_data ( inode ) ) ret = f2fs_read_inline_data ( inode, page ) ; if ( ret == - EAGAIN )  ret = f2fs_mpage_readpages ( page -> mapping, NULL, page, 1, false ) ; <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> * inode = page_file_mapping ( page ) <S2SV_ModEnd> -> host ; <S2SV_ModStart> = f2fs_mpage_readpages ( page_file_mapping ( page ) <S2SV_ModEnd>, NULL,
Buggy code:
 static MagickBooleanType load_tile ( Image * image, Image * tile_image, XCFDocInfo * inDocInfo, XCFLayerInfo * inLayerInfo, size_t data_length, ExceptionInfo * exception ) { ssize_t y ; register ssize_t x ; register Quantum * q ; ssize_t count ; unsigned char * graydata ; XCFPixelInfo * xcfdata, * xcfodata ; <START_BUG> xcfdata = ( XCFPixelInfo * ) AcquireQuantumMemory ( data_length, sizeof ( * xcfdata ) ) ; <END_BUG> if ( xcfdata == ( XCFPixelInfo * ) NULL ) ThrowBinaryException ( ResourceLimitError, "MemoryAllocationFailed", image -> filename ) ; xcfodata = xcfdata ; graydata = ( unsigned char * ) xcfdata ; count = ReadBlob ( image, data_length, ( unsigned char * ) xcfdata ) ; if ( count!= ( ssize_t ) data_length ) ThrowBinaryException ( CorruptImageError, "NotEnoughPixelData", image -> filename ) ; for ( y = 0 ; y < ( ssize_t ) tile_image -> rows ; y ++ ) { q = GetAuthenticPixels ( tile_image, 0, y, tile_image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) break ; if ( inDocInfo -> image_type == GIMP_GRAY ) { for ( x = 0 ; x < ( ssize_t ) tile_image -> columns ; x ++ ) { SetPixelGray ( tile_image, ScaleCharToQuantum ( * graydata ), q ) ; SetPixelAlpha ( tile_image, ScaleCharToQuantum ( ( unsigned char ) inLayerInfo -> alpha ), q ) ; graydata ++ ; q += GetPixelChannels ( tile_image ) ; } } else if ( inDocInfo -> image_type == GIMP_RGB ) { for ( x = 0 ; x < ( ssize_t ) tile_image -> columns ; x ++ ) { SetPixelRed ( tile_image, ScaleCharToQuantum ( xcfdata -> red ), q ) ; SetPixelGreen ( tile_image, ScaleCharToQuantum ( xcfdata -> green ), q ) ; SetPixelBlue ( tile_image, ScaleCharTo

Fix:
<S2SV_ModStart> ) AcquireQuantumMemory ( MagickMax ( data_length, tile_image -> columns * tile_image -> rows ) <S2SV_ModEnd>, sizeof (
Buggy code:
 int msPostGISLayerSetTimeFilter ( layerObj * lp, const char * timestring, const char * timefield ) { char * * atimes, * * aranges = NULL ; int numtimes = 0, i = 0, numranges = 0 ; size_t buffer_size = 512 ; char buffer [ 512 ], bufferTmp [ 512 ] ; buffer [ 0 ] = '\\0' ; bufferTmp [ 0 ] = '\\0' ; if (! lp ||! timestring ||! timefield ) <START_BUG> return MS_FALSE ; <END_BUG> if ( strstr ( timestring, "," ) == NULL && strstr ( timestring, "//" ) == NULL ) { createPostgresTimeCompareSimple ( timefield, timestring, buffer, buffer_size ) ; } else { atimes = msStringSplit ( timestring, ',', & numtimes ) ; if ( atimes == NULL || numtimes < 1 ) return MS_FALSE ; strlcat ( buffer, "(", buffer_size ) ; for ( i = 0 ; i < numtimes ; i ++ ) { if ( i!= 0 ) { strlcat ( buffer, "   OR   ", buffer_size ) ; } strlcat ( buffer, "(", buffer_size ) ; aranges = msStringSplit ( atimes [ i ], '//', & numranges ) ; if (! aranges ) return MS_FALSE ; if ( numranges == 1 ) { createPostgresTimeCompareSimple ( timefield, atimes [ i ], bufferTmp, buffer_size ) ; strlcat ( buffer, bufferTmp, buffer_size ) ; } else if ( numranges == 2 ) { createPostgresTimeCompareRange ( timefield, aranges [ 0 ], aranges [ 1 ], bufferTmp, buffer_size ) ; strlcat ( buffer, bufferTmp, buffer_size ) ; } else { return MS_FALSE ; } msFreeCharArray ( aranges, numranges ) ; strlcat ( buffer, ")", buffer_size ) ; } strlcat ( buffer, ")", buffer_size ) ; msFreeCharArray ( atimes, numtimes ) ; } if (! * buffer ) { return MS_FALSE ; } if ( lp -> filteritem ) free ( lp -> filteritem ) ; lp -> filteritem = msStrdup ( timefield ) ; if ( & lp -> filter ) { if ( lp -> filter

Fix:
<S2SV_ModStart> return MS_FALSE ; if ( strchr ( timestring, '\\'' ) || strchr ( timestring, '\\\\' ) ) { msSetError ( MS_MISCERR, "Invalid <S2SV_blank> time <S2SV_blank> filter.", "msPostGISLayerSetTimeFilter()" ) ; return MS_FALSE ; }
Buggy code:
 int snd_ctl_add ( struct snd_card * card, struct snd_kcontrol * kcontrol ) { struct snd_ctl_elem_id id ; unsigned int idx ; unsigned int count ; int err = - EINVAL ; if (! kcontrol ) return err ; if ( snd_BUG_ON (! card ||! kcontrol -> info ) ) goto error ; id = kcontrol -> id ; <START_BUG> down_write ( & card -> controls_rwsem ) ; <END_BUG> if ( snd_ctl_find_id ( card, & id ) ) { up_write ( & card -> controls_rwsem ) ; dev_err ( card -> dev, "control   %i:%i:%i:%s:%i   is   already   present\\n", id. iface, id. device, id. subdevice, id. name, id. index ) ; err = - EBUSY ; goto error ; } if ( snd_ctl_find_hole ( card, kcontrol -> count ) < 0 ) { up_write ( & card -> controls_rwsem ) ; err = - ENOMEM ; goto error ; } list_add_tail ( & kcontrol -> list, & card -> controls ) ; card -> controls_count += kcontrol -> count ; kcontrol -> id. numid = card -> last_numid + 1 ; card -> last_numid += kcontrol -> count ; count = kcontrol -> count ; up_write ( & card -> controls_rwsem ) ; for ( idx = 0 ; idx < count ; idx ++, id. index ++, id. numid ++ ) snd_ctl_notify ( card, SNDRV_CTL_EVENT_MASK_ADD, & id ) ; return 0 ; error : snd_ctl_free_one ( kcontrol ) ; return err ; }

Fix:
<S2SV_ModStart> -> id ; if ( id. index > UINT_MAX - kcontrol -> count ) goto error ;
Buggy code:
 static void test_decode ( struct stream_state * stream, enum TestDecodeFatality fatal, const VpxInterface * codec ) { vpx_image_t enc_img, dec_img ; if ( stream -> mismatch_seen ) return ; if ( strcmp ( codec -> name, "vp8" ) == 0 ) { struct vpx_ref_frame ref_enc, ref_dec ; int width, height ; width = ( stream -> config. cfg. g_w + 15 ) & ~ 15 ; height = ( stream -> config. cfg. g_h + 15 ) & ~ 15 ; vpx_img_alloc ( & ref_enc. img, VPX_IMG_FMT_I420, width, height, 1 ) ; enc_img = ref_enc. img ; vpx_img_alloc ( & ref_dec. img, VPX_IMG_FMT_I420, width, height, 1 ) ; dec_img = ref_dec. img ; ref_enc. frame_type = VP8_LAST_FRAME ; ref_dec. frame_type = VP8_LAST_FRAME ; vpx_codec_control ( & stream -> encoder, VP8_COPY_REFERENCE, & ref_enc ) ; vpx_codec_control ( & stream -> decoder, VP8_COPY_REFERENCE, & ref_dec ) ; } else { <START_BUG> struct vp9_ref_frame ref ; <END_BUG> ref. idx = 0 ;  vpx_codec_control ( & stream -> encoder, VP9_GET_REFERENCE, & ref ) ; <START_BUG> enc_img = ref. img ; <END_BUG> vpx_codec_control ( & stream -> decoder, VP9_GET_REFERENCE, & ref ) ;  dec_img = ref. img ; } ctx_exit_on_error ( & stream -> encoder, "Failed   to   get   encoder   reference   frame" ) ; ctx_exit_on_error ( & stream -> decoder, "Failed   to   get   decoder   reference   frame" ) ; if (! compare_img ( & enc_img, & dec_img ) ) { int y [ 4 ], u [ 4 ], v [ 4 ] ; <START_BUG> find_mismatch ( & enc_img, & dec_img, y, u, v ) ; <END_BUG> stream

Fix:
<S2SV_ModStart> { struct vp9_ref_frame ref_enc, ref_dec ; ref_enc <S2SV_ModEnd>. idx = <S2SV_ModStart> = 0 ; ref_dec. idx = 0 ; <S2SV_ModStart> VP9_GET_REFERENCE, & ref_enc ) ; enc_img = ref_enc <S2SV_ModEnd>. img ; <S2SV_ModStart> VP9_GET_REFERENCE, & ref_dec ) ; dec_img = ref_dec. img ; # if CONFIG_VP9_HIGHBITDEPTH if ( ( enc_img. fmt & VPX_IMG_FMT_HIGHBITDEPTH )!= ( dec_img. fmt & VPX_IMG_FMT_HIGHBITDEPTH ) ) { if ( enc_img. fmt & VPX_IMG_FMT_HIGHBITDEPTH ) { vpx_img_alloc ( & enc_img, enc_img. fmt - VPX_IMG_FMT_HIGHBITDEPTH, enc_img. d_w, enc_img. d_h, 16 ) ; vpx_img_truncate_16_to_8 ( & enc_img, & ref_enc. img ) ; } if ( dec_img. fmt & VPX
Buggy code:
 static vpx_codec_err_t ctrl_set_roi_map ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> args ) { ( void ) ctx ; ( void ) args ;
Buggy code:
 static int check_best_zero_mv ( const VP9_COMP * cpi, const uint8_t mode_context [ MAX_REF_FRAMES ], int_mv frame_mv [ MB_MODE_COUNT ] [ MAX_REF_FRAMES ], <START_BUG> int disable_inter_mode_mask, int this_mode, int ref_frame, <END_BUG> int second_ref_frame ) { if (! ( disable_inter_mode_mask & ( 1 << INTER_OFFSET ( ZEROMV ) ) ) && ( this_mode == NEARMV || this_mode == NEARESTMV || this_mode == ZEROMV ) && frame_mv [ this_mode ] [ ref_frame ]. as_int == 0 && ( second_ref_frame == NONE ||  frame_mv [ this_mode ] [ second_ref_frame ]. as_int == 0 ) ) { <START_BUG> <END_BUG> int rfc = mode_context [ ref_frame ] ;  int c1 = cost_mv_ref ( cpi, NEARMV, rfc ) ; int c2 = cost_mv_ref ( cpi, NEARESTMV, rfc ) ; int c3 = cost_mv_ref ( cpi, ZEROMV, rfc ) ; if ( this_mode == NEARMV ) { if ( c1 > c3 ) return 0 ; } else if ( this_mode == NEARESTMV ) { if ( c2 > c3 ) return 0 ; } else { assert ( this_mode == ZEROMV ) ; <START_BUG> if ( second_ref_frame == NONE ) { <END_BUG>  if ( ( c3 >= c2 && frame_mv [ NEARESTMV ] [ ref_frame ]. as_int == 0 ) || <START_BUG> <END_BUG> ( c3 >= c1 && frame_mv [ NEARMV ] [ ref_frame ]. as_int == 0 ) )  return 0 ; } else { <START_BUG> if ( ( c3 >= c2 && frame_mv [ NEARESTMV ] [ ref_frame ]. as_int == 0 && <END_BUG> frame_mv [ NEARESTMV ] [ second_ref_frame ]. as_int == 0 ) ||  ( c3 >= c1 && frame_mv [ NEARMV ] [ ref_frame ]

Fix:
<S2SV_ModStart> MAX_REF_FRAMES ], int this_mode, const MV_REFERENCE_FRAME ref_frames [ 2 ] ) { if ( ( this_mode == NEARMV || this_mode == NEARESTMV || this_mode == ZEROMV ) && frame_mv [ this_mode ] [ ref_frames [ 0 ] ]. as_int == 0 && ( ref_frames [ 1 ] <S2SV_ModEnd> == NONE || <S2SV_ModStart> this_mode ] [ ref_frames [ 1 ] <S2SV_ModEnd> ]. as_int <S2SV_ModStart> = mode_context [ ref_frames [ 0 ] <S2SV_ModEnd> ] ; int <S2SV_ModStart> ; if ( ref_frames [ 1 ] <S2SV_ModEnd> == NONE ) <S2SV_ModStart> NEARESTMV ] [ ref_frames [ 0 ] <S2SV_ModEnd> ]. as_int <S2SV_ModStart> NEARMV ] [ ref_frames [ 0 ] <S2SV_ModEnd> ]. as_int <S2SV_ModStart> NEARESTMV ] [ ref_frames [ 0 ] ]. as_int == 0 && frame_mv [ NEARESTMV ] [ ref_frames [ 1 ] <S2SV_ModEnd> ]. as_int <S2SV_ModStart> NEARMV ] [ ref_frames [ 0 ] ]. as_int == 0 && frame_mv [ NEARMV ]
Buggy code:
 static inline void header_put_be_3byte ( SF_PRIVATE * psf, int x ) <START_BUG> { if ( psf -> headindex < SIGNED_SIZEOF ( psf -> header ) - 3 ) <END_BUG>  { psf -> header [ psf -> headindex ++ ] = ( x >> 16 ) ; <START_BUG> <END_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 8 ) ;  <START_BUG> psf -> header [ psf -> headindex ++ ] = x ; <END_BUG>  } ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> x ) { <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. ptr [ <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> x ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 CMD_FUNC ( m_authenticate ) { aClient * agent_p = NULL ; if (! SASL_SERVER ||! MyConnect ( sptr ) || BadPtr ( parv [ 1 ] ) ||! CHECKPROTO ( sptr, PROTO_SASL ) ) return 0 ; if ( sptr -> local -> sasl_complete ) { sendto_one ( sptr, err_str ( ERR_SASLALREADY ), me. name, BadPtr ( sptr -> name )? "*" : sptr -> name ) ; return 0 ; } <START_BUG> if ( strlen ( parv [ 1 ] ) > 400 ) <END_BUG> { sendto_one ( sptr, err_str ( ERR_SASLTOOLONG ), me. name, BadPtr ( sptr -> name )? "*" : sptr -> name ) ; return 0 ; } if ( * sptr -> local -> sasl_agent ) agent_p = find_client ( sptr -> local -> sasl_agent, NULL ) ; if ( agent_p == NULL ) { char * addr = BadPtr ( sptr -> ip )? "0" : sptr -> ip ; char * certfp = moddata_client_get ( sptr, "certfp" ) ; sendto_server ( NULL, 0, 0, ":%s   SASL   %s   %s   H   %s   %s", me. name, SASL_SERVER, encode_puid ( sptr ), addr, addr ) ; if ( certfp ) sendto_server ( NULL, 0, 0, ":%s   SASL   %s   %s   S   %s   %s", me. name, SASL_SERVER, encode_puid ( sptr ), parv [ 1 ], certfp ) ; else sendto_server ( NULL, 0, 0, ":%s   SASL   %s   %s   S   %s", me. name, SASL_SERVER, encode_puid ( sptr ), parv [ 1 ] ) ; } else sendto_server ( NULL, 0, 0, ":%s   SASL   %s   %s   C   %s", me. name, AGENT_SID ( agent_p ), encode_puid ( sp

Fix:
<S2SV_ModStart> } if ( ( parv [ 1 ] [ 0 ] == ':' ) || strchr ( parv [ 1 ],'<S2SV_blank>') ) { sendto_one ( sptr, err_str ( ERR_CANNOTDOCOMMAND ), me. name, "*", "AUTHENTICATE", "Invalid <S2SV_blank> parameter" ) ; return 0 ; } if (
Buggy code:
 qboolean S_AL_Init ( soundInterface_t * si ) { # ifdef USE_OPENAL const char * device = NULL ; const char * inputdevice = NULL ; int i ; if (! si ) { return qfalse ; } for ( i = 0 ; i < MAX_RAW_STREAMS ; i ++ ) { streamSourceHandles [ i ] = - 1 ; streamPlaying [ i ] = qfalse ; streamSources [ i ] = 0 ; streamNumBuffers [ i ] = 0 ; streamBufIndex [ i ] = 0 ; } s_alPrecache = Cvar_Get ( "s_alPrecache", "1", CVAR_ARCHIVE ) ; s_alGain = Cvar_Get ( "s_alGain", "1.0", CVAR_ARCHIVE ) ; s_alSources = Cvar_Get ( "s_alSources", "128", CVAR_ARCHIVE ) ; s_alDopplerFactor = Cvar_Get ( "s_alDopplerFactor", "1.0", CVAR_ARCHIVE ) ; s_alDopplerSpeed = Cvar_Get ( "s_alDopplerSpeed", "9000", CVAR_ARCHIVE ) ; s_alMinDistance = Cvar_Get ( "s_alMinDistance", "120", CVAR_CHEAT ) ; s_alMaxDistance = Cvar_Get ( "s_alMaxDistance", "1024", CVAR_CHEAT ) ; s_alRolloff = Cvar_Get ( "s_alRolloff", "2", CVAR_CHEAT ) ; s_alGraceDistance = Cvar_Get ( "s_alGraceDistance", "512", CVAR_CHEAT ) ; <START_BUG> s_alDriver = Cvar_Get ( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH ) ; <END_BUG> s_alInputDevice = Cvar_Get ( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_LATCH ) ;  s_alDevice = Cvar_Get ( "s_alDevice", "", CVAR_ARCHIVE | CVAR_LATCH )

Fix:
<S2SV_ModStart> CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED <S2SV_ModStart> CVAR_LATCH ) ; if ( COM_CompareExtension ( s_alDriver -> string, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", s_alDriver -> string ) ; return qfalse ; }
Buggy code:
 static void __skb_complete_tx_timestamp ( struct sk_buff * skb, struct sock * sk, <START_BUG> int tstype ) <END_BUG> { struct sock_exterr_skb * serr ;  int err ; <START_BUG> serr = SKB_EXT_ERR ( skb ) ; memset ( serr, 0, sizeof ( * serr ) ) ; serr -> ee. ee_errno = ENOMSG ; serr -> ee. ee_origin = SO_EE_ORIGIN_TIMESTAMPING ; <END_BUG> serr -> ee. ee_info = tstype ;  if ( sk -> sk_tsflags & SOF_TIMESTAMPING_OPT_ID ) { serr -> ee. ee_data = skb_shinfo ( skb ) -> tskey ; if ( sk -> sk_protocol == IPPROTO_TCP && sk -> sk_type == SOCK_STREAM ) serr -> ee. ee_data -= sk -> sk_tskey ; } err = sock_queue_err_skb ( sk, skb ) ; if ( err ) kfree_skb ( skb ) ; }

Fix:
<S2SV_ModStart>, int tstype, bool opt_stats <S2SV_ModStart> ; int err ; BUILD_BUG_ON ( sizeof ( struct sock_exterr_skb ) > sizeof ( skb -> cb ) ) <S2SV_ModStart> ee_info = tstype ; serr -> opt_stats = opt_stats
Buggy code:
 <START_BUG> static int do_16x16_motion_search ( VP9_COMP * cpi, const int_mv * ref_mv, <END_BUG> int_mv * dst_mv, int mb_row, int mb_col ) {  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; unsigned int err, tmp_err ; <END_BUG> int_mv tmp_mv ;  err = vp9_sad16x16 ( x -> plane [ 0 ]. src. buf, x -> plane [ 0 ]. src. stride, <START_BUG> xd -> plane [ 0 ]. pre [ 0 ]. buf, xd -> plane [ 0 ]. pre [ 0 ]. stride, <END_BUG> INT_MAX ) ; dst_mv -> as_int = 0 ;  tmp_err = do_16x16_motion_iteration ( cpi, & ref_mv -> as_mv, & tmp_mv. as_mv, <START_BUG> mb_row, mb_col ) ; if ( tmp_err < err ) { err = tmp_err ; dst_mv -> as_int = tmp_mv. as_int ; } if ( ref_mv -> as_int ) { unsigned int tmp_err ; int_mv zero_ref_mv, tmp_mv ; zero_ref_mv. as_int = 0 ; tmp_err = do_16x16_motion_iteration ( cpi, & zero_ref_mv. as_mv, & tmp_mv. as_mv, mb_row, mb_col ) ; if ( tmp_err < err ) { dst_mv -> as_int = tmp_mv. as_int ; err = tmp_err ; } } return err ; }<END_BUG>

Fix:
<S2SV_ModStart> cpi, const MV * ref_mv, int_mv * <S2SV_ModEnd> dst_mv, int <S2SV_ModStart> & cpi -> td. <S2SV_ModStart>, tmp_err ; MV tmp_mv ; err = vpx_sad16x16 <S2SV_ModEnd> ( x -> <S2SV_ModStart> ]. stride <S2SV_ModEnd> ) ; dst_mv <S2SV_ModStart> ( cpi, ref_mv, & tmp_mv, mb_row, mb_col ) ; if ( tmp_err < err ) { err = tmp_err ; dst_mv -> as_mv = tmp_mv ; } if ( ref_mv -> row!= 0 || ref_mv -> col!= 0 ) { unsigned int tmp_err ; MV zero_ref_mv = { 0, 0 }, tmp_mv ; tmp_err = do_16x16_motion_iteration ( cpi, & zero_ref_mv, & tmp_mv, mb_row, mb_col ) ; if ( tmp_err < err ) { dst_mv -> as_mv = tmp_mv <S2SV_ModEnd> ; err =
Buggy code:
 static int raw_cmd_copyout ( int cmd, void __user * param, struct floppy_raw_cmd * ptr ) { int ret ; while ( ptr ) { <START_BUG> ret = copy_to_user ( param, ptr, sizeof ( * ptr ) ) ; <END_BUG> if ( ret ) return - EFAULT ; param += sizeof ( struct floppy_raw_cmd ) ; if ( ( ptr -> flags & FD_RAW_READ ) && ptr -> buffer_length ) { if ( ptr -> length >= 0 && ptr -> length <= ptr -> buffer_length ) { long length = ptr -> buffer_length - ptr -> length ; ret = fd_copyout ( ptr -> data, ptr -> kernel_data, length ) ; if ( ret ) return ret ; } } ptr = ptr -> next ; } return 0 ; }

Fix:
<S2SV_ModStart> ptr ) { struct floppy_raw_cmd cmd = * ptr ; cmd. next = NULL ; cmd. kernel_data = NULL ; <S2SV_ModStart> ( param, & cmd <S2SV_ModEnd>, sizeof ( <S2SV_ModStart>, sizeof ( cmd <S2SV_ModEnd> ) ) ;
Buggy code:
 static inline int verify_replay ( struct xfrm_usersa_info * p, struct nlattr * * attrs ) { struct nlattr * rt = attrs [ XFRMA_REPLAY_ESN_VAL ] ; <START_BUG> if ( ( p -> flags & XFRM_STATE_ESN ) &&! rt ) <END_BUG>  return - EINVAL ; <START_BUG> if (! rt ) return 0 ; if ( p -> id. proto!= IPPROTO_ESP ) return - EINVAL ; if ( p -> replay_window!= 0 ) return - EINVAL ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> XFRMA_REPLAY_ESN_VAL ] ; struct xfrm_replay_state_esn * rs ; if <S2SV_ModEnd> ( p -> <S2SV_ModStart> & XFRM_STATE_ESN ) { if ( <S2SV_ModEnd>! rt ) <S2SV_ModStart> - EINVAL ; rs = nla_data ( rt ) ; if ( rs -> bmp_len > XFRMA_REPLAY_ESN_MAX // sizeof ( rs -> bmp [ 0 ] ) // 8 ) return - EINVAL ; if ( nla_len ( rt ) < xfrm_replay_state_esn_len ( rs ) && nla_len ( rt )!= sizeof ( * rs ) ) return - EINVAL ; }
Buggy code:
 static int mct_u232_port_probe ( struct usb_serial_port * port ) { <START_BUG> struct mct_u232_private * priv ; <END_BUG> priv = kzalloc ( sizeof ( * priv ), GFP_KERNEL ) ; if (! priv ) return - ENOMEM ;  priv -> read_urb = port -> serial -> port [ 1 ] -> interrupt_in_urb ; <START_BUG> priv -> read_urb -> context = port ; spin_lock_init ( & priv -> lock ) ; usb_set_serial_port_data ( port, priv ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { struct usb_serial * serial = port -> serial ; struct <S2SV_ModStart> * priv ; if (! serial -> port [ 1 ] ||! serial -> port [ 1 ] -> interrupt_in_urb ) { dev_err ( & port -> dev, "expected <S2SV_blank> endpoint <S2SV_blank> missing\\n" ) ; return - ENODEV ; } <S2SV_ModStart> -> read_urb = <S2SV_ModEnd> serial -> port
Buggy code:
 PHP_FUNCTION ( imageaffinematrixget ) { double affine [ 6 ] ; long type ; zval * options ; zval * * tmp ; int res = GD_FALSE, i ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "l|z", & type, & options ) == FAILURE ) { return ; } switch ( ( gdAffineStandardMatrix ) type ) { case GD_AFFINE_TRANSLATE : case GD_AFFINE_SCALE : { double x, y ; if ( Z_TYPE_P ( options )!= IS_ARRAY ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Array   expected   as   options" ) ; } if ( zend_hash_find ( HASH_OF ( options ), "x", sizeof ( "x" ), ( void * * ) & tmp )!= FAILURE ) { <START_BUG> convert_to_double_ex ( tmp ) ; <END_BUG>  x = Z_DVAL_PP ( tmp ) ; <START_BUG> } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Missing   x   position" ) ; RETURN_FALSE ; } if ( zend_hash_find ( HASH_OF ( options ), "y", sizeof ( "y" ), ( void * * ) & tmp )!= FAILURE ) { <END_BUG> convert_to_double_ex ( tmp ) ;  <START_BUG> y = Z_DVAL_PP ( tmp ) ; <END_BUG> } else { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Missing   y   position" ) ; RETURN_FALSE ; } if ( type == GD_AFFINE_TRANSLATE ) { res = gdAffineTranslate ( affine, x, y ) ; } else { res = gdAffineScale ( affine, x, y ) ; } break ; } case GD_AFFINE_ROTATE : case GD_AFFINE_SHEAR_HORIZONTAL : case GD_AFFINE_SHEAR_VERTICAL : { double angle ; convert_to_double_ex ( & options ) ; angle = Z_DVAL_P ( options ) ; if ( type == GD_AFFINE_SHEAR_HORIZONTAL ) { res = gdAffineS

Fix:
<S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_DOUBLE ) { zval dval ; dval = * * tmp ; zval_copy_ctor ( & dval ) ; convert_to_double ( & dval <S2SV_ModEnd> ) ; x <S2SV_ModStart> ; x = Z_DVAL ( dval ) ; } else { x = <S2SV_ModStart> tmp ) ; } <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_DOUBLE ) { zval dval ; dval = * * tmp ; zval_copy_ctor ( & dval ) ; convert_to_double ( & dval <S2SV_ModEnd> ) ; y <S2SV_ModStart> ; y = Z_DVAL ( dval ) ; } else { y = <S2SV_ModStart> tmp ) ; }
Buggy code:
 static inline int check_entry_size_and_hooks ( struct arpt_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct arpt_entry )!= 0 || <START_BUG> ( unsigned char * ) e + sizeof ( struct arpt_entry ) >= limit ) { <END_BUG> duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct arpt_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } err = check_entry ( e ) ; if ( err ) return err ; for ( h = 0 ; h < NF_ARP_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { pr_err ( "Underflows   must   be   unconditional   and   " "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> arpt_entry ) >= limit || ( unsigned char * ) e + e -> next_offset >
Buggy code:
 static int multipath_ioctl ( struct dm_target * ti, unsigned int cmd, unsigned long arg ) { struct multipath * m = ( struct multipath * ) ti -> private ; struct block_device * bdev = NULL ; fmode_t mode = 0 ; unsigned long flags ; int r = 0 ; spin_lock_irqsave ( & m -> lock, flags ) ; if (! m -> current_pgpath ) __choose_pgpath ( m, 0 ) ; if ( m -> current_pgpath ) { bdev = m -> current_pgpath -> path. dev -> bdev ; mode = m -> current_pgpath -> path. dev -> mode ; } if ( m -> queue_io ) r = - EAGAIN ; else if (! bdev ) r = - EIO ; spin_unlock_irqrestore ( & m -> lock, flags ) ; <START_BUG> return r? : __blkdev_driver_ioctl ( bdev, mode, cmd, arg ) ; <END_BUG> }

Fix:
<S2SV_ModStart> flags ) ; if (! r && ti -> len!= i_size_read ( bdev -> bd_inode ) >> SECTOR_SHIFT ) r = scsi_verify_blk_ioctl ( NULL, cmd ) ;
Buggy code:
 static int mxf_parse_structural_metadata ( MXFContext * mxf ) { MXFPackage * material_package = NULL ; int i, j, k, ret ; av_log ( mxf -> fc, AV_LOG_TRACE, "metadata   sets   count   %d\\n", mxf -> metadata_sets_count ) ; for ( i = 0 ; i < mxf -> packages_count ; i ++ ) { material_package = mxf_resolve_strong_ref ( mxf, & mxf -> packages_refs [ i ], MaterialPackage ) ; if ( material_package ) break ; } if (! material_package ) { av_log ( mxf -> fc, AV_LOG_ERROR, "no   material   package   found\\n" ) ; return AVERROR_INVALIDDATA ; } mxf_add_umid_metadata ( & mxf -> fc -> metadata, "material_package_umid", material_package ) ; if ( material_package -> name && material_package -> name [ 0 ] ) av_dict_set ( & mxf -> fc -> metadata, "material_package_name", material_package -> name, 0 ) ; mxf_parse_package_comments ( mxf, & mxf -> fc -> metadata, material_package ) ; for ( i = 0 ; i < material_package -> tracks_count ; i ++ ) { MXFPackage * source_package = NULL ; MXFTrack * material_track = NULL ; MXFTrack * source_track = NULL ; MXFTrack * temp_track = NULL ; MXFDescriptor * descriptor = NULL ; MXFStructuralComponent * component = NULL ; MXFTimecodeComponent * mxf_tc = NULL ; UID * essence_container_ul = NULL ; const MXFCodecUL * codec_ul = NULL ; const MXFCodecUL * container_ul = NULL ; const MXFCodecUL * pix_fmt_ul = NULL ; AVStream * st ; AVTimecode tc ; int flags ; if (! ( material_track = mxf_resolve_strong_ref ( mxf, & material_package -> tracks_refs [ i ], Track ) ) ) { av_log ( mxf -> fc, AV_LOG_ERROR, "could   not   resolve   material   track   strong   ref\\n

Fix:
<S2SV_ModStart> av_log ( mxf -> fc
Buggy code:
 static VALUE cState_space_before_set ( VALUE self, VALUE space_before ) { unsigned long len ; GET_STATE ( self ) ; Check_Type ( space_before, T_STRING ) ; len = RSTRING_LEN ( space_before ) ; if ( len == 0 ) { if ( state -> space_before ) { ruby_xfree ( state -> space_before ) ; state -> space_before = NULL ; state -> space_before_len = 0 ; } } else { if ( state -> space_before ) ruby_xfree ( state -> space_before ) ; <START_BUG> state -> space_before = strdup ( RSTRING_PTR ( space_before ) ) ; <END_BUG> state -> space_before_len = len ; } return Qnil ; }

Fix:
<S2SV_ModStart> -> space_before = fstrndup <S2SV_ModEnd> ( RSTRING_PTR ( <S2SV_ModStart> ( space_before ), len
Buggy code:
 static MatchinfoBuffer * fts3MIBufferNew ( int nElem, const char * zMatchinfo ) { MatchinfoBuffer * pRet ; <START_BUG> int nByte = sizeof ( u32 ) * ( 2 * nElem + 1 ) + sizeof ( MatchinfoBuffer ) ; <END_BUG>  int nStr = ( int ) strlen ( zMatchinfo ) ; <START_BUG> <END_BUG> pRet = sqlite3_malloc ( nByte + nStr + 1 ) ;  if ( pRet ) { memset ( pRet, 0, nByte ) ; pRet -> aMatchinfo [ 0 ] = ( u8 * ) ( & pRet -> aMatchinfo [ 1 ] ) - ( u8 * ) pRet ; pRet -> aMatchinfo [ 1 + nElem ] = pRet -> aMatchinfo [ 0 ] + sizeof ( u32 ) * ( nElem + 1 ) ; pRet -> nElem = nElem ; pRet -> zMatchinfo = ( ( char * ) pRet ) + nByte ; memcpy ( pRet -> zMatchinfo, zMatchinfo, nStr + 1 ) ; pRet -> aRef [ 0 ] = 1 ; } return pRet ; }

Fix:
<S2SV_ModStart> * pRet ; sqlite3_int64 <S2SV_ModEnd> nByte = sizeof <S2SV_ModStart> ( 2 * ( sqlite3_int64 ) <S2SV_ModStart> MatchinfoBuffer ) ; sqlite3_int64 nStr = <S2SV_ModEnd> strlen ( zMatchinfo <S2SV_ModStart> ; pRet = sqlite3_malloc64 <S2SV_ModEnd> ( nByte +
Buggy code:
 static int rio_ioctl ( struct net_device * dev, struct ifreq * rq, int cmd ) { int phy_addr ; struct netdev_private * np = netdev_priv ( dev ) ; <START_BUG> struct mii_data * miidata = ( struct mii_data * ) & rq -> ifr_ifru ; <END_BUG> struct netdev_desc * desc ; int i ; phy_addr = np -> phy_addr ; switch ( cmd ) {  case SIOCDEVPRIVATE : <START_BUG> break ; <END_BUG> case SIOCDEVPRIVATE + 1 :  <START_BUG> miidata -> out_value = mii_read ( dev, phy_addr, miidata -> reg_num ) ; <END_BUG> break ;  case SIOCDEVPRIVATE + 2 : <START_BUG> <END_BUG> mii_write ( dev, phy_addr, miidata -> reg_num, miidata -> in_value ) ;  break ; case SIOCDEVPRIVATE + 3 : break ; case SIOCDEVPRIVATE + 4 : break ; case SIOCDEVPRIVATE + 5 : netif_stop_queue ( dev ) ; break ; case SIOCDEVPRIVATE + 6 : netif_wake_queue ( dev ) ; break ; case SIOCDEVPRIVATE + 7 : printk ( "tx_full=%x   cur_tx=%lx   old_tx=%lx   cur_rx=%lx   old_rx=%lx\\n", netif_queue_stopped ( dev ), np -> cur_tx, np -> old_tx, np -> cur_rx, np -> old_rx ) ; break ; case SIOCDEVPRIVATE + 8 : printk ( "TX   ring:\\n" ) ; for ( i = 0 ; i < TX_RING_SIZE ; i ++ ) { desc = & np -> tx_ring [ i ] ; printk ( "%02x:cur:%08x   next:%08x   status:%08x   frag1:%08x   frag0:%08x", i, ( u32 ) ( np -> tx_ring_dma + i * sizeof ( * desc ) ), ( u32 ) le64_to_cpu ( desc -> next_desc ), ( u32 ) le64_to_cpu ( desc -> status ), ( u32 ) (

Fix:
<S2SV_ModStart> ) ; struct mii_ioctl_data <S2SV_ModEnd> * miidata = <S2SV_ModStart> * miidata = if_mii ( rq ) <S2SV_ModEnd> ; phy_addr = <S2SV_ModStart> ) { case SIOCGMIIPHY : miidata -> phy_id = phy_addr ; <S2SV_ModEnd> break ; case <S2SV_ModStart> break ; case SIOCGMIIREG <S2SV_ModEnd> : miidata -> <S2SV_ModStart> : miidata -> val_out <S2SV_ModEnd> = mii_read ( <S2SV_ModStart> break ; case SIOCSMIIREG : if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; <S2SV_ModEnd> mii_write ( dev <S2SV_ModStart>, miidata -> val_in <S2SV_ModEnd> ) ; break
Buggy code:
 rfbBool InitialiseRFBConnection ( rfbClient * client ) { rfbProtocolVersionMsg pv ; int major, minor ; uint32_t authScheme ; uint32_t subAuthScheme ; rfbClientInitMsg ci ; if ( client -> listenSpecified ) errorMessageOnReadFailure = FALSE ; if (! ReadFromRFBServer ( client, pv, sz_rfbProtocolVersionMsg ) ) return FALSE ; pv [ sz_rfbProtocolVersionMsg ] = 0 ; errorMessageOnReadFailure = TRUE ; pv [ sz_rfbProtocolVersionMsg ] = 0 ; if ( sscanf ( pv, rfbProtocolVersionFormat, & major, & minor )!= 2 ) { rfbClientLog ( "Not   a   valid   VNC   server   (%s)\\n", pv ) ; return FALSE ; } DefaultSupportedMessages ( client ) ; client -> major = major ; client -> minor = minor ; if ( ( major == rfbProtocolMajorVersion ) && ( minor > rfbProtocolMinorVersion ) ) client -> minor = rfbProtocolMinorVersion ; if ( major == 3 && ( minor == 4 || minor == 6 ) ) { rfbClientLog ( "UltraVNC   server   detected,   enabling   UltraVNC   specific   messages\\n", pv ) ; DefaultSupportedMessagesUltraVNC ( client ) ; } if ( major == 3 && ( minor == 14 || minor == 16 ) ) { minor = minor - 10 ; client -> minor = minor ; rfbClientLog ( "UltraVNC   Single   Click   server   detected,   enabling   UltraVNC   specific   messages\\n", pv ) ; DefaultSupportedMessagesUltraVNC ( client ) ; } if ( major == 3 && minor == 5 ) { rfbClientLog ( "TightVNC   server   detected,   enabling   TightVNC   specific   messages\\n", pv ) ; DefaultSupportedMessagesTightVNC ( client ) ; } if ( ( major == 3 && minor > 8 ) || major > 3 ) { client -> major = 3 ; client -> minor = 8 ; } rfbClientLog ( "VNC   server   supports   protocol   version   %d.%d   (viewer   %d.%d)\\n", major, minor, rfbProtocolMajorVersion, rfb

Fix:
<S2SV_ModStart> nameLength ) ; if ( client -> si. nameLength > 1 << 20 ) { rfbClientErr ( "Too <S2SV_blank> big <S2SV_blank> desktop <S2SV_blank> name <S2SV_blank> length <S2SV_blank> sent <S2SV_blank> by <S2SV_blank> server: <S2SV_blank> %u <S2SV_blank> B <S2SV_blank> > <S2SV_blank> 1 <S2SV_blank> MB\\n", ( unsigned int ) client -> si. nameLength ) ; return FALSE ; } <S2SV_ModStart> = malloc ( <S2SV_ModEnd> client -> si
Buggy code:
 int parse_config ( char * filename, bridge_t * * bridges ) { dictionary * ubridge_config = NULL ; const char * value ; const char * bridge_name ; int i, nsec ; <START_BUG> if ( ( ubridge_config = iniparser_load ( filename ) ) == NULL ) { <END_BUG> return FALSE ; } nsec = iniparser_getnsec ( ubridge_config ) ; for ( i = 0 ; i < nsec ; i ++ ) { bridge_t * bridge ; nio_t * source_nio = NULL ; nio_t * destination_nio = NULL ; bridge_name = iniparser_getsecname ( ubridge_config, i ) ; printf ( "Parsing   %s\\n", bridge_name ) ; if ( getstr ( ubridge_config, bridge_name, "source_udp", & value ) ) source_nio = create_udp_tunnel ( value ) ; else if ( getstr ( ubridge_config, bridge_name, "source_unix", & value ) ) source_nio = create_unix_socket ( value ) ; else if ( getstr ( ubridge_config, bridge_name, "source_ethernet", & value ) ) source_nio = open_ethernet_device ( value ) ; else if ( getstr ( ubridge_config, bridge_name, "source_tap", & value ) ) source_nio = open_tap_device ( value ) ; # ifdef LINUX_RAW else if ( getstr ( ubridge_config, bridge_name, "source_linux_raw", & value ) ) source_nio = open_linux_raw ( value ) ; # endif # ifdef __APPLE__ else if ( getstr ( ubridge_config, bridge_name, "source_fusion_vmnet", & value ) ) source_nio = open_fusion_vmnet ( value ) ; # endif else fprintf ( stderr, "source   NIO   not   found\\n" ) ; if ( getstr ( ubridge_config, bridge_name, "destination_udp", & value ) ) destination_nio = create_udp_tunnel ( value ) ; else if ( getstr ( ubridge_config, bridge_name,

Fix:
<S2SV_ModStart> iniparser_load ( filename, HIDE_ERRORED_LINE_CONTENT
Buggy code:
 static void write_frame_size ( const VP9_COMMON * cm, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG>  vp9_wb_write_literal ( wb, cm -> width - 1, 16 ) ; <START_BUG> <END_BUG> vp9_wb_write_literal ( wb, cm -> height - 1, 16 ) ;  write_display_size ( cm, wb ) ; }

Fix:
<S2SV_ModStart> cm, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> wb ) { vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 16 ) ; vpx_wb_write_literal <S2SV_ModEnd> ( wb,
Buggy code:
 int saa7164_bus_get ( struct saa7164_dev * dev, struct tmComResInfo * msg, void * buf, int peekonly ) { struct tmComResBusInfo * bus = & dev -> bus ; u32 bytes_to_read, write_distance, curr_grp, curr_gwp, new_grp, buf_size, space_rem ; struct tmComResInfo msg_tmp ; int ret = SAA_ERR_BAD_PARAMETER ; saa7164_bus_verify ( dev ) ; if ( msg == NULL ) return ret ; if ( msg -> size > dev -> bus. m_wMaxReqSize ) { printk ( KERN_ERR "%s()   Exceeded   dev->bus.m_wMaxReqSize\\n", __func__ ) ; return ret ; } if ( ( peekonly == 0 ) && ( msg -> size > 0 ) && ( buf == NULL ) ) { printk ( KERN_ERR "%s()   Missing   msg   buf,   size   should   be   %d   bytes\\n", __func__, msg -> size ) ; return ret ; } mutex_lock ( & bus -> lock ) ; curr_gwp = saa7164_readl ( bus -> m_dwGetWritePos ) ; curr_grp = saa7164_readl ( bus -> m_dwGetReadPos ) ; if ( curr_gwp == curr_grp ) { ret = SAA_ERR_EMPTY ; goto out ; } bytes_to_read = sizeof ( * msg ) ; write_distance = 0 ; if ( curr_gwp >= curr_grp ) write_distance = curr_gwp - curr_grp ; else write_distance = curr_gwp + bus -> m_dwSizeGetRing - curr_grp ; if ( bytes_to_read > write_distance ) { printk ( KERN_ERR "%s()   No   message//response   found\\n", __func__ ) ; ret = SAA_ERR_INVALID_COMMAND ; goto out ; } new_grp = curr_grp + bytes_to_read ; if ( new_grp > bus -> m_dwSizeGetRing ) { new_grp -= bus -> m_dwSizeGetRing ; space_rem = bus -> m_dwSizeGet

Fix:
<S2SV_ModStart> controlselector ) ; memcpy ( msg, & msg_tmp, sizeof ( * msg ) ) ; <S2SV_ModStart> peekonly ) { <S2SV_ModEnd> goto peekout ; <S2SV_ModStart> ) ) { if ( buf ) memcpy_fromio ( buf <S2SV_ModEnd>, bus -> <S2SV_ModStart> -> m_pdwGetRing + sizeof ( * msg ) - space_rem, buf_size ) ; } else if ( space_rem == sizeof ( * msg ) ) { if ( buf ) memcpy_fromio ( buf <S2SV_ModEnd>, bus -> <S2SV_ModStart> -> m_pdwGetRing, buf_size ) ; } else { if ( buf ) { <S2SV_ModEnd> memcpy_fromio ( buf <S2SV_ModStart> -> m_pdwGetRing + curr_grp + sizeof ( * msg ), space_rem - sizeof ( * msg ) ) ; memcpy_fromio ( buf + space_rem - sizeof ( * msg ), bus -> m_pdwGetRing, bytes_to_read - space_rem ) ; } } } else { if ( buf ) memcpy_fromio ( buf, bus -> m_pdwGetRing + curr_grp + sizeof ( * msg ), <S2SV_ModEnd> buf_size ) ; <S2SV_ModStart>