nus-yam/ex-repair huggingface dataset:
Buggy code:
 static MagickBooleanType ReadPSDChannelPixels ( Image * image, const size_t channels, const size_t row, const ssize_t type, const unsigned char * pixels, ExceptionInfo * exception ) { Quantum pixel ; register const unsigned char * p ; register Quantum * q ; register ssize_t x ; size_t packet_size ; unsigned short nibble ; p = pixels ; q = GetAuthenticPixels ( image, 0, row, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) return MagickFalse ; packet_size = GetPSDPacketSize ( image ) ; for ( x = 0 ; x < ( ssize_t ) image -> columns ; x ++ ) { if ( packet_size == 1 ) pixel = ScaleCharToQuantum ( * p ++ ) ; else { p = PushShortPixel ( MSBEndian, p, & nibble ) ; pixel = ScaleShortToQuantum ( nibble ) ; } switch ( type ) { case - 1 : { SetPixelAlpha ( image, pixel, q ) ; break ; } case - 2 : case 0 : { SetPixelRed ( image, pixel, q ) ; if ( channels == 1 || type == - 2 ) SetPixelGray ( image, pixel, q ) ; if ( image -> storage_class == PseudoClass ) { if ( packet_size == 1 ) SetPixelIndex ( image, ScaleQuantumToChar ( pixel ), q ) ; else SetPixelIndex ( image, ScaleQuantumToShort ( pixel ), q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) ConstrainColormapIndex ( image, GetPixelIndex ( image, q ), exception ), q ) ; if ( image -> depth == 1 ) { ssize_t bit, number_bits ; number_bits = image -> columns - x ; if ( number_bits > 8 ) number_bits = 8 ; for ( bit = 0 ; bit < number_bits ; bit ++ ) { SetPixelIndex ( image, ( ( ( unsigned char ) pixel ) & ( 0x01 << ( 7 - bit ) ) )!= 0? 0 : 255, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) <START_BUG> GetPixelIndex ( image, q ), q ) ;<END_BUG>

Fix:
<S2SV_ModStart> ( ssize_t ) ConstrainColormapIndex ( image, <S2SV_ModStart> image, q ), exception
Buggy code:
 <START_BUG> static void super_block_uvrd ( const VP9_COMP * cpi, MACROBLOCK * x, <END_BUG> int * rate, int64_t * distortion, int * skippable, int64_t * sse, BLOCK_SIZE bsize, int64_t ref_best_rd ) { MACROBLOCKD * const xd = & x -> e_mbd ; MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ;  TX_SIZE uv_txfm_size = get_uv_tx_size ( mbmi ) ; <START_BUG> int plane ; int pnrate = 0, pnskip = 1 ; int64_t pndist = 0, pnsse = 0 ; <END_BUG> if ( ref_best_rd < 0 )  <START_BUG> goto term ; <END_BUG>  if ( is_inter_block ( mbmi ) ) { <START_BUG> int plane ; for ( plane = 1 ; plane < MAX_MB_PLANE ; ++ plane ) vp9_subtract_plane ( x, bsize, plane ) ; } * rate = 0 ; * distortion = 0 ; * sse = 0 ; * skippable = 1 ; for ( plane = 1 ; plane < MAX_MB_PLANE ; ++ plane ) { txfm_rd_in_plane ( x, & pnrate, & pndist, & pnskip, & pnsse, <END_BUG> ref_best_rd, plane, bsize, uv_txfm_size,  cpi -> sf. use_fast_coef_costing ) ; if ( pnrate == INT_MAX ) <START_BUG> goto term ; <END_BUG> * rate += pnrate ; * distortion += pndist ; * sse += pnsse ; * skippable &= pnskip ; }  return ; <START_BUG> term : * rate = INT_MAX ; * distortion = INT64_MAX ; * sse = INT64_MAX ; * skippable = 0 ; return ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> super_block_uvrd ( const <S2SV_ModStart> -> mbmi ; const TX_SIZE uv_tx_size <S2SV_ModEnd> = get_uv_tx_size ( <S2SV_ModStart> get_uv_tx_size ( mbmi, & xd -> plane [ 1 ] <S2SV_ModStart> = 0 ; int is_cost_valid = 1 ; <S2SV_ModStart> < 0 ) is_cost_valid = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( mbmi ) && is_cost_valid <S2SV_ModStart>, bsize, uv_tx_size <S2SV_ModEnd>, cpi -> <S2SV_ModStart> == INT_MAX ) { is_cost_valid = 0 ; break ; } <S2SV_ModEnd> * rate += <S2SV_ModStart> pnskip ; } if (! is_cost_valid ) { * rate = INT_MAX ; * distortion = INT64_MAX ; * sse = INT64_MAX ; * skippable = 0 ; } return is_cost_valid <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 __inline # if defined __GNUC_STDC_INLINE__ || defined __GNUC_GNU_INLINE__ __attribute__ ( ( __gnu_inline__ ) ) # endif # endif const struct ByUnfoldKey * unicode_unfold_key ( OnigCodePoint code ) { static const struct ByUnfoldKey wordlist [ ] = { { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0xffffffff, - 1, 0 }, { 0x1040a, 3267, 1 }, { 0x1e0a, 1727, 1 }, { 0x040a, 1016, 1 }, { 0x010a, 186, 1 }, { 0x1f0a, 2088, 1 }, { 0x2c0a, 2451, 1 }, { 0x0189, 619, 1 }, { 0x1f89, 134, 2 }, { 0x1f85, 154, 2 }, { 0x0389, 733, 1 }, { 0x03ff, 724, 1 }, { 0xab89, 1523, 1 }, { 0xab85, 1511, 1 }, { 0x10c89, 3384, 1 }, { 0x10c85, 3372, 1 }, { 0x1e84, 1911, 1 }, { 0x03f5, 752, 1 }, { 0x0184, 360, 1 }, { 0x1f84, 149, 2 }, { 0x2c84, 2592, 1 }, { 0x017d, 351, 1 }, { 0x1ff3, 96, 2 }, { 0xab84, 1508, 1 }, { 0xa784, 3105, 1 }, { 0x10c84, 3369, 1

Fix:
<S2SV_ModStart> code == gcode && wordlist [ key ]. index >= 0
Buggy code:
 void dvb_usbv2_disconnect ( struct usb_interface * intf ) { struct dvb_usb_device * d = usb_get_intfdata ( intf ) ; <START_BUG> const char * name = d -> name ; <END_BUG>  struct device dev = d -> udev -> dev ; <START_BUG> dev_dbg ( & d -> udev -> dev, "%s:   bInterfaceNumber=%d\\n", __func__, intf -> cur_altsetting -> desc. bInterfaceNumber ) ; if ( d -> props -> exit ) d -> props -> exit ( d ) ; dvb_usbv2_exit ( d ) ; <END_BUG> dev_info ( & dev, "%s:   \'%s\'   successfully   deinitialized   and   disconnected\\n",  <START_BUG> KBUILD_MODNAME, name ) ; <END_BUG> }

Fix:
<S2SV_ModStart> const char * devname = kstrdup ( dev_name ( & <S2SV_ModEnd> d -> udev <S2SV_ModStart> udev -> dev ), GFP_KERNEL ) ; const char * drvname = d -> name <S2SV_ModStart> d ) ; pr_info ( "%s: <S2SV_blank> \'%s:%s\' <S2SV_blank> successfully <S2SV_blank> deinitialized <S2SV_blank> and <S2SV_blank> disconnected\\n" <S2SV_ModEnd>, KBUILD_MODNAME, <S2SV_ModStart>, KBUILD_MODNAME, drvname, devname ) ; kfree ( devname <S2SV_ModEnd> ) ; }
Buggy code:
 static int evaluate_inter_mode_rd ( int mdcounts [ 4 ], RATE_DISTORTION * rd, int * disable_skip, VP8_COMP * cpi, MACROBLOCK * x ) { MB_PREDICTION_MODE this_mode = x -> e_mbd. mode_info_context -> mbmi. mode ; BLOCK * b = & x -> block [ 0 ] ; MACROBLOCKD * xd = & x -> e_mbd ; int distortion ; vp8_build_inter16x16_predictors_mby ( & x -> e_mbd, x -> e_mbd. predictor, 16 ) ; if ( cpi -> active_map_enabled && x -> active_ptr [ 0 ] == 0 ) { x -> skip = 1 ; } else if ( x -> encode_breakout ) { unsigned int sse ; unsigned int var ; unsigned int threshold = ( xd -> block [ 0 ]. dequant [ 1 ] * xd -> block [ 0 ]. dequant [ 1 ] >> 4 ) ; if ( threshold < x -> encode_breakout ) threshold = x -> encode_breakout ; <START_BUG> var = vp8_variance16x16 <END_BUG> ( * ( b -> base_src ), b -> src_stride, x -> e_mbd. predictor, 16, & sse ) ; if ( sse < threshold ) { unsigned int q2dc = xd -> block [ 24 ]. dequant [ 0 ] ; if ( ( sse - var < q2dc * q2dc >> 4 ) || ( sse // 2 > var && sse - var < 64 ) ) { unsigned int sse2 = VP8_UVSSE ( x ) ; if ( sse2 * 2 < threshold ) { x -> skip = 1 ; rd -> distortion2 = sse + sse2 ; rd -> rate2 = 500 ; rd -> rate_uv = 0 ; rd -> distortion_uv = sse2 ; * disable_skip = 1 ; return RDCOST ( x -> rdmult, x -> rddiv, rd -> rate2, rd -> distortion2 ) ; } } } } rd -> rate2 += vp8_cost_mv_ref ( this_mode, mdcounts ) ; macro_block_yrd ( x, & rd -> rate_y, & distortion ) ; rd -> rate2 += rd ->

Fix:
<S2SV_ModStart> ; var = vpx_variance16x16 <S2SV_ModEnd> ( * (
Buggy code:
 static enum AVPixelFormat h263_get_format ( AVCodecContext * avctx ) <START_BUG> { <END_BUG> if ( avctx -> bits_per_raw_sample > 8 ) {  av_assert1 ( avctx -> profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO ) ; <START_BUG> return avctx -> pix_fmt ; } if ( avctx -> codec -> id == AV_CODEC_ID_MSS2 ) return AV_PIX_FMT_YUV420P ; if ( CONFIG_GRAY && ( avctx -> flags & AV_CODEC_FLAG_GRAY ) ) { if ( avctx -> color_range == AVCOL_RANGE_UNSPECIFIED ) avctx -> color_range = AVCOL_RANGE_MPEG ; return AV_PIX_FMT_GRAY8 ; } return avctx -> pix_fmt = ff_get_format ( avctx, avctx -> codec -> pix_fmts ) ; }<END_BUG>

Fix:
<S2SV_ModStart> avctx ) { MpegEncContext * s = avctx -> priv_data ; <S2SV_ModStart> { av_assert1 ( s -> studio_profile <S2SV_ModEnd> ) ; return
Buggy code:
 void vp9_init_plane_quantizers ( VP9_COMP * cpi, MACROBLOCK * x ) { const VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; QUANTS * const quants = & cpi -> quants ; const int segment_id = xd -> mi [ 0 ] -> mbmi. segment_id ; const int qindex = vp9_get_qindex ( & cm -> seg, segment_id, cm -> base_qindex ) ; const int rdmult = vp9_compute_rd_mult ( cpi, qindex + cm -> y_dc_delta_q ) ; <START_BUG> const int zbin = cpi -> zbin_mode_boost + x -> act_zbin_adj ; <END_BUG> int i ; x -> plane [ 0 ]. quant = quants -> y_quant [ qindex ] ;  x -> plane [ 0 ]. quant_shift = quants -> y_quant_shift [ qindex ] ; <START_BUG> x -> plane [ 0 ]. zbin = quants -> y_zbin [ qindex ] ; x -> plane [ 0 ]. round = quants -> y_round [ qindex ] ; <END_BUG> x -> plane [ 0 ]. zbin_extra = ( int16_t ) ( ( cm -> y_dequant [ qindex ] [ 1 ] * zbin ) >> 7 ) ;  xd -> plane [ 0 ]. dequant = cm -> y_dequant [ qindex ] ; for ( i = 1 ; i < 3 ; i ++ ) { x -> plane [ i ]. quant = quants -> uv_quant [ qindex ] ; <START_BUG> x -> plane [ i ]. quant_shift = quants -> uv_quant_shift [ qindex ] ; <END_BUG> x -> plane [ i ]. zbin = quants -> uv_zbin [ qindex ] ; x -> plane [ i ]. round = quants -> uv_round [ qindex ] ;  x -> plane [ i ]. zbin_extra = ( int16_t ) ( ( cm -> uv_dequant [ qindex ] [ 1 ] * zbin ) >> 7 ) ; <START_BUG> xd -> plane [ i ]. dequant = cm -> uv_dequant [ qindex ] ; } <END_BUG> #

Fix:
<S2SV_ModStart> y_dc_delta_q ) ; int <S2SV_ModEnd> i ; x <S2SV_ModStart> 0 ]. quant_fp = quants -> y_quant_fp [ qindex ] ; x -> plane [ 0 ]. round_fp = quants -> y_round_fp [ qindex ] ; x -> plane [ 0 ]. <S2SV_ModStart> qindex ] ; xd -> plane [ 0 ]. dequant = cpi <S2SV_ModEnd> -> y_dequant [ <S2SV_ModStart> [ qindex ] ; x -> plane [ 0 ]. quant_thred [ 0 ] = x -> plane [ 0 ]. zbin [ 0 ] * x -> plane [ 0 ]. zbin [ 0 ] ; x -> plane [ 0 ]. quant_thred [ 1 ] = x -> plane [ 0 ]. zbin [ 1 ] * x -> plane [ 0 ]. zbin [ 1 <S2SV_ModEnd> ] ; for <S2SV_ModStart> i ]. quant_fp = quants -> uv_quant_fp [ qindex ] ; x -> plane [ i ]. round_fp = quants -> uv_round_fp [ qindex ] ; x -> plane [ i ]. <S2SV_ModStart> qindex ] ; xd -> plane [ i ]. dequant = cpi <S2SV_ModEnd> -> uv_
Buggy code:
 void eigrp_print ( netdissect_options * ndo, register const u_char * pptr, register u_int len ) { const struct eigrp_common_header * eigrp_com_header ; const struct eigrp_tlv_header * eigrp_tlv_header ; const u_char * tptr, * tlv_tptr ; u_int tlen, eigrp_tlv_len, eigrp_tlv_type, tlv_tlen, byte_length, bit_length ; uint8_t prefix [ 4 ] ; union { const struct eigrp_tlv_general_parm_t * eigrp_tlv_general_parm ; const struct eigrp_tlv_sw_version_t * eigrp_tlv_sw_version ; const struct eigrp_tlv_ip_int_t * eigrp_tlv_ip_int ; const struct eigrp_tlv_ip_ext_t * eigrp_tlv_ip_ext ; const struct eigrp_tlv_at_cable_setup_t * eigrp_tlv_at_cable_setup ; const struct eigrp_tlv_at_int_t * eigrp_tlv_at_int ; const struct eigrp_tlv_at_ext_t * eigrp_tlv_at_ext ; } tlv_ptr ; tptr = pptr ; eigrp_com_header = ( const struct eigrp_common_header * ) pptr ; ND_TCHECK ( * eigrp_com_header ) ; if ( eigrp_com_header -> version!= EIGRP_VERSION ) { ND_PRINT ( ( ndo, "EIGRP   version   %u   packet   not   supported", eigrp_com_header -> version ) ) ; return ; } if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "EIGRP   %s,   length:   %u", tok2str ( eigrp_opcode_values, "unknown   (%u)", eigrp_com_header -> opcode )

Fix:
<S2SV_ModStart> return ; } if ( len < sizeof ( struct eigrp_common_header ) ) { ND_PRINT ( ( ndo, "EIGRP <S2SV_blank> %s, <S2SV_blank> length: <S2SV_blank> %u <S2SV_blank> (too <S2SV_blank> short, <S2SV_blank> < <S2SV_blank> %u)", tok2str ( eigrp_opcode_values, "unknown <S2SV_blank> (%u)", eigrp_com_header -> opcode ), len, ( u_int ) sizeof ( struct eigrp_common_header ) ) ) ; return ; } <S2SV_ModStart> ) ) ; if ( eigrp_tlv_len < sizeof ( struct eigrp_tlv_header ) ) { ND_PRINT ( ( ndo, " <S2SV_blank> (too <S2SV_blank> short, <S2SV_blank> < <S2SV_blank> %u)", ( u_int ) sizeof ( struct eigrp_tlv_header ) ) ) ; break ; } <S2SV_ModStart> ) tlv_tptr ; if ( tlv_tlen < sizeof ( * tlv_ptr. eigrp_tlv_general_parm ) ) { ND_PRINT ( ( ndo, " <S2SV_blank> (too <S2SV_blank> short, <S2SV_blank> < <S2SV_blank> %u)", ( u_int ) (
Buggy code:
 static void Rp_test ( js_State * J ) { js_Regexp * re ; const char * text ; <START_BUG> int opts ; <END_BUG> Resub m ; re = js_toregexp ( J, 0 ) ; text = js_tostring ( J, 1 ) ; opts = 0 ; if ( re -> flags & JS_REGEXP_G ) { if ( re -> last > strlen ( text ) ) { re -> last = 0 ; js_pushboolean ( J, 0 ) ; return ; } if ( re -> last > 0 ) { text += re -> last ; opts |= REG_NOTBOL ; } }  if (! js_regexec ( re -> prog, text, & m, opts ) ) { <START_BUG> if ( re -> flags & JS_REGEXP_G ) re -> last = re -> last + ( m. sub [ 0 ]. ep - text ) ; js_pushboolean ( J, 1 ) ; return ; } if ( re -> flags & JS_REGEXP_G ) re -> last = 0 ; js_pushboolean ( J, 0 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> text ; int result ; int <S2SV_ModStart> ; } } result = <S2SV_ModEnd> js_regexec ( re <S2SV_ModStart>, opts ) ; if ( result < 0 ) js_error ( J, "regexec <S2SV_blank> failed" ) ; if ( result == 0
Buggy code:
 void vp9_regular_quantize_b_4x4 ( MACROBLOCK * x, int plane, int block, const int16_t * scan, const int16_t * iscan ) { MACROBLOCKD * const xd = & x -> e_mbd ; struct macroblock_plane * p = & x -> plane [ plane ] ; struct macroblockd_plane * pd = & xd -> plane [ plane ] ; <START_BUG> vp9_quantize_b ( BLOCK_OFFSET ( p -> coeff, block ), <END_BUG> 16, x -> skip_block, p -> zbin, p -> round, p -> quant, p -> quant_shift, BLOCK_OFFSET ( p -> qcoeff, block ), BLOCK_OFFSET ( pd -> dqcoeff, block ),  pd -> dequant, p -> zbin_extra, & p -> eobs [ block ], scan, iscan ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> plane ] ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { vpx_highbd_quantize_b <S2SV_ModEnd> ( BLOCK_OFFSET ( <S2SV_ModStart> -> dequant, & p -> eobs [ block ], scan, iscan ) ; return ; } # endif vpx_quantize_b ( BLOCK_OFFSET ( p -> coeff, block ), 16, x -> skip_block, p -> zbin, p -> round, p -> quant, p -> quant_shift, BLOCK_OFFSET ( p -> qcoeff, block ), BLOCK_OFFSET ( pd -> dqcoeff, block ), pd -> dequant <S2SV_ModEnd>, & p
Buggy code:
 static int xfrm_dump_policy_done ( struct netlink_callback * cb ) { <START_BUG> struct xfrm_policy_walk * walk = ( struct xfrm_policy_walk * ) & cb -> args [ 1 ] ; <END_BUG> struct net * net = sock_net ( cb -> skb -> sk ) ; xfrm_policy_walk_done ( walk, net ) ; return 0 ; }

Fix:
<S2SV_ModStart> xfrm_policy_walk * ) <S2SV_ModEnd> cb -> args <S2SV_ModStart> cb -> args <S2SV_ModEnd> ; struct net
Buggy code:
 static struct rds_connection * __rds_conn_create ( struct net * net, __be32 laddr, __be32 faddr, struct rds_transport * trans, gfp_t gfp, int is_outgoing ) { struct rds_connection * conn, * parent = NULL ; struct hlist_head * head = rds_conn_bucket ( laddr, faddr ) ; struct rds_transport * loop_trans ; unsigned long flags ; int ret ; rcu_read_lock ( ) ; conn = rds_conn_lookup ( net, head, laddr, faddr, trans ) ; if ( conn && conn -> c_loopback && conn -> c_trans!= & rds_loop_transport && laddr == faddr &&! is_outgoing ) { parent = conn ; conn = parent -> c_passive ; } rcu_read_unlock ( ) ; if ( conn ) goto out ; conn = kmem_cache_zalloc ( rds_conn_slab, gfp ) ; if (! conn ) { conn = ERR_PTR ( - ENOMEM ) ; goto out ; } INIT_HLIST_NODE ( & conn -> c_hash_node ) ; conn -> c_laddr = laddr ; conn -> c_faddr = faddr ; spin_lock_init ( & conn -> c_lock ) ; conn -> c_next_tx_seq = 1 ; rds_conn_net_set ( conn, net ) ; init_waitqueue_head ( & conn -> c_waitq ) ; INIT_LIST_HEAD ( & conn -> c_send_queue ) ; INIT_LIST_HEAD ( & conn -> c_retrans ) ; ret = rds_cong_get_maps ( conn ) ; if ( ret ) { kmem_cache_free ( rds_conn_slab, conn ) ; conn = ERR_PTR ( ret ) ; goto out ; } loop_trans = rds_trans_get_preferred ( net, faddr ) ; if ( loop_trans ) { rds_trans_put ( loop_trans ) ; conn -> c_loopback = 1 ; if ( is_outgoing && trans -> t_prefer_loopback ) { trans = & rds_loop_transport ; } <START_BUG> } <END_BUG> if ( trans == NULL ) { kmem_cache_free ( rds_conn_

Fix:
<S2SV_ModStart> rds_loop_transport ; } <S2SV_ModEnd> } conn ->
Buggy code:
 int pam_sm_authenticate ( pam_handle_t * pamh, int flags, int argc, const char * * argv ) { struct passwd * pw = NULL, pw_s ; const char * user = NULL ; cfg_t cfg_st ; cfg_t * cfg = & cfg_st ; char buffer [ BUFSIZE ] ; char * buf = NULL ; char * authfile_dir ; size_t authfile_dir_len ; int pgu_ret, gpn_ret ; int retval = PAM_IGNORE ; device_t * devices = NULL ; unsigned n_devices = 0 ; <START_BUG> int openasuser ; <END_BUG> int should_free_origin = 0 ; int should_free_appid = 0 ; int should_free_auth_file = 0 ;  int should_free_authpending_file = 0 ; <START_BUG> parse_cfg ( flags, argc, argv, cfg ) ; if (! cfg -> origin ) { strcpy ( buffer, DEFAULT_ORIGIN_PREFIX ) ; if ( gethostname ( buffer + strlen ( DEFAULT_ORIGIN_PREFIX ), BUFSIZE - strlen ( DEFAULT_ORIGIN_PREFIX ) ) == - 1 ) { DBG ( "Unable   to   get   host   name" ) ; goto done ; } DBG ( "Origin   not   specified,   using   \\"%s\\"", buffer ) ; cfg -> origin = strdup ( buffer ) ; if (! cfg -> origin ) { DBG ( "Unable   to   allocate   memory" ) ; goto done ; } else { should_free_origin = 1 ; } } if (! cfg -> appid ) { DBG ( "Appid   not   specified,   using   the   same   value   of   origin   (%s)", cfg -> origin ) ; cfg -> appid = strdup ( cfg -> origin ) ; if (! cfg -> appid ) { DBG ( "Unable   to   allocate   memory" ) goto done ; } else { should_free_appid = 1 ; } } if ( cfg -> max_devs == 0 ) { DBG ( "Maximum   devices   number   not   set.   Using   default   (%d)", MAX_DEVS ) ; cfg -> max_devs = MAX_DEVS ; } devices = malloc ( sizeof ( device_t ) * cfg -> max_devs )<END_BUG>

Fix:
<S2SV_ModStart> ; int openasuser = 0 <S2SV_ModStart> should_free_authpending_file = 0 ; PAM_MODUTIL_DEF_PRIVS ( privs ) <S2SV_ModStart> done ; } openasuser = geteuid ( ) == 0? 1 : 0 ; <S2SV_ModStart> DEFAULT_AUTHFILE ) ; if (! openasuser ) { DBG ( "WARNING: <S2SV_blank> not <S2SV_blank> dropping <S2SV_blank> privileges <S2SV_blank> when <S2SV_blank> reading <S2SV_blank> %s, <S2SV_blank> please <S2SV_blank> " "consider <S2SV_blank> setting <S2SV_blank> openasuser=1 <S2SV_blank> in <S2SV_blank> the <S2SV_blank> module <S2SV_blank> configuration" <S2SV_ModEnd>, buf ) <S2SV_ModStart> buf ) ; } } DBG ( "Using <S2SV_blank> authentication <S2SV_blank> file <S2SV_blank> %s", buf ) ; <S2SV_ModStart> ) ; } if (! openasuser ) { openasuser <S2SV_ModEnd> = geteuid ( <S2SV_ModStart> -> openasuser ; } <S2SV_ModStart> openasuser ) { DBG ( "Dropping <S2SV_blank> privileges" ) ; if ( pam_modutil_drop_priv ( pamh, & privs, pw <S2SV_ModEnd> ) ) { <S2SV_ModStart> ( "Unable <S2SV_blank> to <S2SV_blank> switch <S2SV_blank> user <S2SV_blank> to <S2SV_blank> uid <S2SV_blank> %i", pw -> <S2SV_ModEnd> pw_uid ) ; <S2SV_ModStart> ( "Switched <S2SV_blank> to <S2SV_blank> uid <S2SV_blank> %i
Buggy code:
 static int indenterror ( struct tok_state * tok ) <START_BUG> { <END_BUG> if ( tok -> alterror ) { tok -> done = E_TABSPACE ; tok -> cur = tok -> inp ;  return 1 ; <START_BUG> } if ( tok -> altwarning ) { # ifdef PGEN PySys_WriteStderr ( "inconsistent   use   of   tabs   and   spaces   " "in   indentation\\n" ) ; # else PySys_FormatStderr ( "%U:   inconsistent   use   of   tabs   and   spaces   " "in   indentation\\n", tok -> filename ) ; # endif tok -> altwarning = 0 ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> * tok ) <S2SV_ModEnd> { tok -> <S2SV_ModStart> inp ; return ERRORTOKEN <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int catc_probe ( struct usb_interface * intf, const struct usb_device_id * id ) { struct device * dev = & intf -> dev ; struct usb_device * usbdev = interface_to_usbdev ( intf ) ; struct net_device * netdev ; struct catc * catc ; u8 broadcast [ ETH_ALEN ] ; <START_BUG> int i, pktsz, ret ; <END_BUG> if ( usb_set_interface ( usbdev, intf -> altsetting -> desc. bInterfaceNumber, 1 ) ) { dev_err ( dev, "Can\'t   set   altsetting   1.\\n" ) ; return - EIO ; } netdev = alloc_etherdev ( sizeof ( struct catc ) ) ; if (! netdev ) return - ENOMEM ; catc = netdev_priv ( netdev ) ; netdev -> netdev_ops = & catc_netdev_ops ; netdev -> watchdog_timeo = TX_TIMEOUT ; netdev -> ethtool_ops = & ops ; catc -> usbdev = usbdev ; catc -> netdev = netdev ; spin_lock_init ( & catc -> tx_lock ) ; spin_lock_init ( & catc -> ctrl_lock ) ; init_timer ( & catc -> timer ) ; catc -> timer. data = ( long ) catc ; catc -> timer. function = catc_stats_timer ; catc -> ctrl_urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; catc -> tx_urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; catc -> rx_urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; catc -> irq_urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; if ( (! catc -> ctrl_urb ) || (! catc -> tx_urb ) || (! catc -> rx_urb ) || (! catc -> irq_urb ) ) { dev_err ( & intf -> dev, "No   free   urbs   available.\\n" ) ; ret = - ENOMEM ; goto fail_free ; } if ( le16_to_cpu ( usbdev -> descriptor. idVendor ) == 0x0423

Fix:
<S2SV_ModStart> ] ; int <S2SV_ModEnd> pktsz, ret <S2SV_ModStart> is_f5u011 ) { u32 * buf ; int i ; <S2SV_ModStart> "Checking <S2SV_blank> memory <S2SV_blank> size\\n" ) ; buf = kmalloc ( 4, GFP_KERNEL ) ; if (! buf ) { ret = - ENOMEM ; goto fail_free ; } * buf <S2SV_ModEnd> = 0x12345678 ; <S2SV_ModStart>, 0x7a80, buf <S2SV_ModEnd>, 4 ) <S2SV_ModStart> 4 ) ; * buf <S2SV_ModEnd> = 0x87654321 ; <S2SV_ModStart>, 0xfa80, buf <S2SV_ModEnd>, 4 ) <S2SV_ModStart>, 0x7a80, buf <S2SV_ModEnd>, 4 ) <S2SV_ModStart> ; switch ( * buf <S2SV_ModEnd> ) { case <S2SV_ModStart> break ; } kfree ( buf ) ;
Buggy code:
 <START_BUG> error_t mqttSnClientDisconnect ( MqttSnClientContext * context ) <END_BUG> { error_t error ; systime_t time ; if ( context == NULL ) return ERROR_INVALID_PARAMETER ; error = NO_ERROR ; while (! error ) { time = osGetSystemTime ( ) ; if ( context -> state == MQTT_SN_CLIENT_STATE_ACTIVE ) { context -> startTime = time ;  error = mqttSnClientSendDisconnect ( context, 0 ) ; <START_BUG> } else if ( context -> state == MQTT_SN_CLIENT_STATE_SENDING_REQ ) { if ( timeCompare ( time, context -> startTime + context -> timeout ) >= 0 ) { mqttSnClientShutdownConnection ( context ) ; error = ERROR_TIMEOUT ; } else if ( timeCompare ( time, context -> retransmitStartTime + MQTT_SN_CLIENT_RETRY_TIMEOUT ) >= 0 ) { <END_BUG> error = mqttSnClientSendDisconnect ( context, 0 ) ;  } else { error = mqttSnClientProcessEvents ( context, MQTT_SN_CLIENT_TICK_INTERVAL ) ; } } else if ( context -> state == MQTT_SN_CLIENT_STATE_DISCONNECTING ) { error = mqttSnClientShutdownConnection ( context ) ; mqttSnClientCloseConnection ( context ) ; context -> state = MQTT_SN_CLIENT_STATE_DISCONNECTED ; } else if ( context -> state == MQTT_SN_CLIENT_STATE_DISCONNECTED ) { break ; } else { error = ERROR_WRONG_STATE ; } } if ( error!= NO_ERROR && error!= ERROR_WOULD_BLOCK ) { mqttSnClientCloseConnection ( context ) ; context -> state = MQTT_SN_CLIENT_STATE_DISCONNECTED ; } return error ; }

Fix:
<S2SV_ModStart> MqttSnClientContext * context, systime_t duration <S2SV_ModStart> ( context, duration // 1000 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ( context, duration // 1000 <S2SV_ModEnd> ) ; }
Buggy code:
 int jas_stream_read ( jas_stream_t * stream, void * buf, int cnt ) { int n ; int c ; <START_BUG> char * bufptr ; <END_BUG> bufptr = buf ; n = 0 ; while ( n < cnt ) { if ( ( c = jas_stream_getc ( stream ) ) == EOF ) { return n ; } * bufptr ++ = c ; ++ n ; } return n ; }

Fix:
<S2SV_ModStart> * bufptr ; if ( cnt < 0 ) { jas_deprecated ( "negative <S2SV_blank> count <S2SV_blank> for <S2SV_blank> jas_stream_read" ) ; }
Buggy code:
 void init_global_keywords ( bool global_active ) { install_keyword_root ( "linkbeat_use_polling", use_polling_handler, global_active ) ; # if HAVE_DECL_CLONE_NEWNET install_keyword_root ( "net_namespace", & net_namespace_handler, global_active ) ; install_keyword_root ( "namespace_with_ipsets", & namespace_ipsets_handler, global_active ) ; # endif install_keyword_root ( "use_pid_dir", & use_pid_dir_handler, global_active ) ; install_keyword_root ( "instance", & instance_handler, global_active ) ; install_keyword_root ( "child_wait_time", & child_wait_handler, global_active ) ; install_keyword_root ( "global_defs", NULL, global_active ) ; install_keyword ( "router_id", & routerid_handler ) ; install_keyword ( "notification_email_from", & emailfrom_handler ) ; install_keyword ( "smtp_server", & smtpserver_handler ) ; install_keyword ( "smtp_helo_name", & smtphelo_handler ) ; install_keyword ( "smtp_connect_timeout", & smtpto_handler ) ; install_keyword ( "notification_email", & email_handler ) ; install_keyword ( "smtp_alert", & smtp_alert_handler ) ; # ifdef _WITH_VRRP_ install_keyword ( "smtp_alert_vrrp", & smtp_alert_vrrp_handler ) ; # endif # ifdef _WITH_LVS_ install_keyword ( "smtp_alert_checker", & smtp_alert_checker_handler ) ; # endif # ifdef _WITH_VRRP_ install_keyword ( "dynamic_interfaces", & dynamic_interfaces_handler ) ; install_keyword ( "no_email_faults", & no_email_faults_handler ) ; install_keyword ( "default_interface", & default_interface_handler ) ; # endif # ifdef _WITH_LVS_ install_keyword ( "lvs_timeouts", & lvs_timeouts ) ; install_keyword

Fix:
<S2SV_ModStart> ; # endif install_keyword ( "umask", & umask_handler ) ;
Buggy code:
 int genl_register_family ( struct genl_family * family ) { int err, i ; int start = GENL_START_ALLOC, end = GENL_MAX_ID ; err = genl_validate_ops ( family ) ; if ( err ) return err ; genl_lock_all ( ) ; if ( genl_family_find_byname ( family -> name ) ) { err = - EEXIST ; goto errout_locked ; } if ( family == & genl_ctrl ) { start = end = GENL_ID_CTRL ; } else if ( strcmp ( family -> name, "pmcraid" ) == 0 ) { start = end = GENL_ID_PMCRAID ; } else if ( strcmp ( family -> name, "VFS_DQUOT" ) == 0 ) { start = end = GENL_ID_VFS_DQUOT ; } if ( family -> maxattr &&! family -> parallel_ops ) { family -> attrbuf = kmalloc_array ( family -> maxattr + 1, sizeof ( struct nlattr * ), GFP_KERNEL ) ; if ( family -> attrbuf == NULL ) { err = - ENOMEM ; goto errout_locked ; } } else family -> attrbuf = NULL ; family -> id = idr_alloc ( & genl_fam_idr, family, start, end + 1, GFP_KERNEL ) ; if ( family -> id < 0 ) { err = family -> id ; <START_BUG> goto errout_locked ; <END_BUG> } err = genl_validate_assign_mc_groups ( family ) ; if ( err ) goto errout_remove ; genl_unlock_all ( ) ; genl_ctrl_event ( CTRL_CMD_NEWFAMILY, family, NULL, 0 ) ; for ( i = 0 ; i < family -> n_mcgrps ; i ++ ) genl_ctrl_event ( CTRL_CMD_NEWMCAST_GRP, family, & family -> mcgrps [ i ], family -> mcgrp_offset + i ) ; return 0 ; errout_remove : idr_remove ( & genl_fam_idr, family -> id ) ;  kfree ( family -> attrbuf ) ; <START_BUG> errout_locked :<END_BUG>

Fix:
<S2SV_ModStart> id ; goto errout_free <S2SV_ModEnd> ; } err <S2SV_ModStart> id ) ; errout_free :
Buggy code:
 <START_BUG> void fadst8_sse2 ( __m128i * in ) { <END_BUG> const __m128i k__cospi_p02_p30 = pair_set_epi16 ( cospi_2_64, cospi_30_64 ) ; const __m128i k__cospi_p30_m02 = pair_set_epi16 ( cospi_30_64, - cospi_2_64 ) ; const __m128i k__cospi_p10_p22 = pair_set_epi16 ( cospi_10_64, cospi_22_64 ) ; const __m128i k__cospi_p22_m10 = pair_set_epi16 ( cospi_22_64, - cospi_10_64 ) ; const __m128i k__cospi_p18_p14 = pair_set_epi16 ( cospi_18_64, cospi_14_64 ) ; const __m128i k__cospi_p14_m18 = pair_set_epi16 ( cospi_14_64, - cospi_18_64 ) ; const __m128i k__cospi_p26_p06 = pair_set_epi16 ( cospi_26_64, cospi_6_64 ) ; const __m128i k__cospi_p06_m26 = pair_set_epi16 ( cospi_6_64, - cospi_26_64 ) ; const __m128i k__cospi_p08_p24 = pair_set_epi16 ( cospi_8_64, cospi_24_64 ) ; const __m128i k__cospi_p24_m08 = pair_set_epi16 ( cospi_24_64, - cospi_8_64 ) ; const __m128i k__cospi_m24_p08 = pair_set_epi16 ( - cospi_24_64, cospi_8_64 ) ; const __m128i k__cospi_p16_m16 = pair_set_epi16 ( cospi_16_64, - cospi_16_64 ) ;  const __m128i k__cospi_p16_p16 = _mm_set1_

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t )
Buggy code:
 void perf_event_enable ( struct perf_event * event ) { <START_BUG> struct perf_event_context * ctx = event -> ctx ; <END_BUG> struct task_struct * task = ctx -> task ; if (! task ) { cpu_function_call ( event -> cpu, __perf_event_enable, event ) ; return ; } raw_spin_lock_irq ( & ctx -> lock ) ; if ( event -> state >= PERF_EVENT_STATE_INACTIVE ) goto out ; if ( event -> state == PERF_EVENT_STATE_ERROR ) event -> state = PERF_EVENT_STATE_OFF ; retry : if (! ctx -> is_active ) { __perf_event_mark_enabled ( event ) ;  goto out ; <START_BUG> } raw_spin_unlock_irq ( & ctx -> lock ) ; if (! task_function_call ( task, __perf_event_enable, event ) ) return ; raw_spin_lock_irq ( & ctx -> lock ) ; if ( ctx -> is_active && event -> state == PERF_EVENT_STATE_OFF ) { task = ctx -> task ; goto retry ; } out : raw_spin_unlock_irq ( & ctx -> lock ) ; }<END_BUG>

Fix:
<S2SV_ModStart> perf_event_context * ctx ; ctx = perf_event_ctx_lock <S2SV_ModEnd> ( event ) <S2SV_ModStart> event ) ; _perf_event_enable ( event ) ; perf_event_ctx_unlock ( event, ctx <S2SV_ModEnd> ) ; }
Buggy code:
 static void keyring_describe ( const struct key * keyring, struct seq_file * m ) { if ( keyring -> description ) seq_puts ( m, keyring -> description ) ; else seq_puts ( m, "[anon]" ) ; <START_BUG> if ( key_is_instantiated ( keyring ) ) { <END_BUG> if ( keyring -> keys. nr_leaves_on_tree!= 0 ) seq_printf ( m, ":   %lu", keyring -> keys. nr_leaves_on_tree ) ; else seq_puts ( m, ":   empty" ) ; } }

Fix:
<S2SV_ModStart> ; if ( key_is_positive <S2SV_ModEnd> ( keyring )
Buggy code:
 static krb5_int32 find_referral_tgs ( kdc_realm_t * kdc_active_realm, krb5_kdc_req * request, krb5_principal * krbtgt_princ ) { krb5_error_code retval = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN ; char * * realms = NULL, * hostname = NULL ; krb5_data srealm = request -> server -> realm ; if (! is_referral_req ( kdc_active_realm, request ) ) goto cleanup ; hostname = data2string ( krb5_princ_component ( kdc_context, request -> server, 1 ) ) ; if ( hostname == NULL ) { retval = ENOMEM ; goto cleanup ; } if ( strchr ( hostname, '.' ) == NULL ) goto cleanup ; retval = krb5_get_host_realm ( kdc_context, hostname, & realms ) ; if ( retval ) { kdc_err ( kdc_context, retval, "unable   to   find   realm   of   host" ) ; goto cleanup ; } <START_BUG> if ( realms == NULL || realms [ 0 ] == '\\0' || <END_BUG> data_eq_string ( srealm, realms [ 0 ] ) ) { retval = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN ; goto cleanup ; } retval = krb5_build_principal ( kdc_context, krbtgt_princ, srealm. length, srealm. data, "krbtgt", realms [ 0 ], ( char * ) 0 ) ; cleanup : krb5_free_host_realm ( kdc_context, realms ) ; free ( hostname ) ; return retval ; }

Fix:
<S2SV_ModStart> 0 ] == NULL || * realms [ 0 ] ==
Buggy code:
 static int dnxhd_decode_header ( DNXHDContext * ctx, AVFrame * frame, const uint8_t * buf, int buf_size, int first_field ) { int i, cid, ret ; int old_bit_depth = ctx -> bit_depth, bitdepth ; uint64_t header_prefix ; if ( buf_size < 0x280 ) { av_log ( ctx -> avctx, AV_LOG_ERROR, "buffer   too   small   (%d   <   640).\\n", buf_size ) ; return AVERROR_INVALIDDATA ; } header_prefix = ff_dnxhd_parse_header_prefix ( buf ) ; if ( header_prefix == 0 ) { av_log ( ctx -> avctx, AV_LOG_ERROR, "unknown   header   0x%02X   0x%02X   0x%02X   0x%02X   0x%02X\\n", buf [ 0 ], buf [ 1 ], buf [ 2 ], buf [ 3 ], buf [ 4 ] ) ; return AVERROR_INVALIDDATA ; } if ( buf [ 5 ] & 2 ) { ctx -> cur_field = buf [ 5 ] & 1 ; frame -> interlaced_frame = 1 ; frame -> top_field_first = first_field ^ ctx -> cur_field ; av_log ( ctx -> avctx, AV_LOG_DEBUG, "interlaced   %d,   cur   field   %d\\n", buf [ 5 ] & 3, ctx -> cur_field ) ; } else { ctx -> cur_field = 0 ; } ctx -> mbaff = ( buf [ 0x6 ] >> 5 ) & 1 ; ctx -> height = AV_RB16 ( buf + 0x18 ) ; ctx -> width = AV_RB16 ( buf + 0x1a ) ; switch ( buf [ 0x21 ] >> 5 ) { case 1 : bitdepth = 8 ; break ; case 2 : bitdepth = 10 ; break ; case 3 : bitdepth = 12 ; break ; default : av_log ( ctx -> avctx, AV_LOG_ERROR, "Unknown   bitdepth   indicator   (%d)\\n", buf [ 0x21 ] >> 5 ) ; return AVERROR_INVALIDDATA ; }

Fix:
<S2SV_ModStart> mb_height > 68 ) { av_log ( ctx -> avctx, AV_LOG_ERROR, "mb <S2SV_blank> height <S2SV_blank> too <S2SV_blank> big: <S2SV_blank> %d\\n", ctx -> mb_height ) ; return AVERROR_INVALIDDATA ; } ctx -> data_offset = 0x280 ; } if ( <S2SV_ModEnd> ( ctx -> <S2SV_ModStart> AVERROR_INVALIDDATA ; } <S2SV_ModEnd> if ( buf_size
Buggy code:
 static int irda_recvmsg_stream ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct irda_sock * self = irda_sk ( sk ) ; int noblock = flags & MSG_DONTWAIT ; size_t copied = 0 ; int target, err ; long timeo ; IRDA_DEBUG ( 3, "%s()\\n", __func__ ) ; if ( ( err = sock_error ( sk ) ) < 0 ) return err ; if ( sock -> flags & __SO_ACCEPTCON ) return - EINVAL ; err = - EOPNOTSUPP ; if ( flags & MSG_OOB ) return - EOPNOTSUPP ; err = 0 ; target = sock_rcvlowat ( sk, flags & MSG_WAITALL, size ) ; timeo = sock_rcvtimeo ( sk, noblock ) ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> do { int chunk ; struct sk_buff * skb = skb_dequeue ( & sk -> sk_receive_queue ) ; if ( skb == NULL ) { DEFINE_WAIT ( wait ) ; err = 0 ; if ( copied >= target ) break ; prepare_to_wait_exclusive ( sk_sleep ( sk ), & wait, TASK_INTERRUPTIBLE ) ; err = sock_error ( sk ) ; if ( err ) ; else if ( sk -> sk_shutdown & RCV_SHUTDOWN ) ; else if ( noblock ) err = - EAGAIN ; else if ( signal_pending ( current ) ) err = sock_intr_errno ( timeo ) ; else if ( sk -> sk_state!= TCP_ESTABLISHED ) err = - ENOTCONN ; else if ( skb_peek ( & sk -> sk_receive_queue ) == NULL ) schedule ( ) ; finish_wait ( sk_sleep ( sk ), & wait ) ; if ( err ) return err ; if ( sk -> sk_shutdown & RCV_SHUTDOWN ) break ; continue ; } chunk = min_t ( unsigned int, skb -> len, size ) ; if ( memcpy_toiovec ( msg -> msg_iov, skb ->

Fix:
<S2SV_ModStart> noblock ) ; <S2SV_ModEnd> do { int
Buggy code:
 TSQuery QTN2QT ( QTNode * in ) { TSQuery out ; int len ; int sumlen = 0, nnode = 0 ; QTN2QTState state ; <START_BUG> cntsize ( in, & sumlen, & nnode ) ; <END_BUG> len = COMPUTESIZE ( nnode, sumlen ) ; out = ( TSQuery ) palloc0 ( len ) ; SET_VARSIZE ( out, len ) ; out -> size = nnode ; state. curitem = GETQUERY ( out ) ; state. operand = state. curoperand = GETOPERAND ( out ) ; fillQT ( & state, in ) ; return out ; }

Fix:
<S2SV_ModStart>, & nnode ) ; if ( TSQUERY_TOO_BIG ( nnode, sumlen ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "tsquery <S2SV_blank> is <S2SV_blank> too <S2SV_blank> large" ) )
Buggy code:
 void HTML_put_string ( HTStructured * me, const char * s ) <START_BUG> { <END_BUG> # ifdef USE_PRETTYSRC char * translated_string = NULL ; # endif if ( s == NULL || ( LYMapsOnly && me -> sp [ 0 ]. tag_number!= HTML_OBJECT ) ) return ; # ifdef USE_PRETTYSRC if ( psrc_convert_string ) { StrAllocCopy ( translated_string, s ) ; TRANSLATE_AND_UNESCAPE_ENTITIES ( & translated_string, TRUE, FALSE ) ; s = ( const char * ) translated_string ; } # endif switch ( me -> sp [ 0 ]. tag_number ) { case HTML_COMMENT : break ; case HTML_TITLE :  HTChunkPuts ( & me -> title, s ) ; <START_BUG> break ; case HTML_STYLE : <END_BUG> HTChunkPuts ( & me -> style_block, s ) ;  break ; case HTML_SCRIPT : <START_BUG> HTChunkPuts ( & me -> script, s ) ; <END_BUG> break ; case HTML_PRE : case HTML_LISTING : case HTML_XMP : case HTML_PLAINTEXT : HText_appendText ( me -> text, s ) ; break ; case HTML_OBJECT :  HTChunkPuts ( & me -> object, s ) ; <START_BUG> break ; case HTML_TEXTAREA : <END_BUG> HTChunkPuts ( & me -> textarea, s ) ;  break ; case HTML_SELECT : case HTML_OPTION : <START_BUG> HTChunkPuts ( & me -> option, s ) ; <END_BUG> break ; case HTML_MATH :  HTChunkPuts ( & me -> math, s ) ; <START_BUG> break ; default : if (! me -> sp -> style -> freeFormat ) { # ifdef USE_PRETTYSRC if ( psrc_view ) { for ( ; * s ; ++ s ) HTML_put_character ( me, * s ) ; } else # endif HText_appendText ( me -> text, s ) ; break ; } else { const char * p = s ; char c ; if ( me -> style_change ) { for ( ; * p && ( ( * p == '\\n' ) || ( * p == '\\r' ) || ( * p ==' ') || ( * p == '\\t' ) ) ; p ++ ) ; if (! * p ) break ; UPDATE_STYLE ; } for ( ; * p ;<END_BUG>

Fix:
<S2SV_ModStart> s ) { HTChunk * target = NULL ; <S2SV_ModStart> case HTML_TITLE : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> title <S2SV_ModEnd> ; break ; <S2SV_ModStart> case HTML_STYLE : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> style_block <S2SV_ModEnd> ; break ; <S2SV_ModStart> case HTML_SCRIPT : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> script <S2SV_ModEnd> ; break ; <S2SV_ModStart> case HTML_OBJECT : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> object <S2SV_ModEnd> ; break ; <S2SV_ModStart> case HTML_TEXTAREA : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> textarea <S2SV_ModEnd> ; break ; <S2SV_ModStart> case HTML_OPTION : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> option <S2SV_ModEnd> ; break ; <S2SV_ModStart> case HTML_MATH : target = <S2SV_ModEnd> & me -> <S2SV_ModStart> me -> math <S2SV_ModEnd> ; break ; <S2SV_ModStart> } } } if ( target!= NULL ) { if ( target -> data == s ) { CTRACE ( ( tfp, "BUG: <S2SV_blank> appending <S2SV_blank> chunk <S2SV_blank> to <S2SV_blank> itself: <S2SV_blank> `%.*s\'\\n", target -> size, target -> data ) ) ; } else { HTChunkPuts ( target, s ) ; } }
Buggy code:
 static arguments_ty ast_for_arguments ( struct compiling * c, const node * n ) { int i, j, k, nposargs = 0, nkwonlyargs = 0 ; int nposdefaults = 0, found_default = 0 ; asdl_seq * posargs, * posdefaults, * kwonlyargs, * kwdefaults ; arg_ty vararg = NULL, kwarg = NULL ; arg_ty arg ; node * ch ; if ( TYPE ( n ) == parameters ) { if ( NCH ( n ) == 2 ) return arguments ( NULL, NULL, NULL, NULL, NULL, NULL, c -> c_arena ) ; n = CHILD ( n, 1 ) ; } assert ( TYPE ( n ) == typedargslist || TYPE ( n ) == varargslist ) ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == STAR ) { i ++ ; if ( i < NCH ( n ) && ( TYPE ( CHILD ( n, i ) ) == tfpdef || TYPE ( CHILD ( n, i ) ) == vfpdef ) ) { i ++ ; } break ; } if ( TYPE ( ch ) == DOUBLESTAR ) break ; if ( TYPE ( ch ) == vfpdef || TYPE ( ch ) == tfpdef ) nposargs ++ ; if ( TYPE ( ch ) == EQUAL ) nposdefaults ++ ; } for ( ; i < NCH ( n ) ; ++ i ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == DOUBLESTAR ) break ; if ( TYPE ( ch ) == tfpdef || TYPE ( ch ) == vfpdef ) nkwonlyargs ++ ; } posargs = ( nposargs? _Py_asdl_seq_new ( nposargs, c -> c_arena ) : NULL ) ; if (! posargs && nposargs ) return NULL ; kwonlyargs = ( nkwonlyargs? _Py_asdl_seq_new ( nkwonlyargs, c -> c_arena ) : NULL ) ; if (! kwonlyargs && nkwonlyargs ) return NULL ; posdefaults = ( nposdefaults? _Py_asdl_seq_new ( nposdefaults, c -> c_arena ) : NULL

Fix:
<S2SV_ModStart> ; i += 1 ; if ( i < NCH ( n ) && TYPE ( CHILD ( n, i ) ) == COMMA ) i += 1 <S2SV_ModEnd> ; break ; <S2SV_ModStart> n ) && ( <S2SV_ModStart> ) == COMMA || TYPE ( CHILD ( n, i + 1 ) ) == TYPE_COMMENT ) <S2SV_ModStart> += 2 ; if ( i < NCH ( n ) && TYPE ( CHILD ( n, i ) ) == TYPE_COMMENT ) { ast_error ( c, CHILD ( n, i ), "bare <S2SV_blank> * <S2SV_blank> has <S2SV_blank> associated <S2SV_blank> type <S2SV_blank> comment" ) ; return NULL ; } <S2SV_ModStart> ; i += 2 ; if ( i < NCH ( n ) && TYPE ( CHILD ( n, i ) ) == COMMA ) i += 1 ; if ( i < NCH ( n ) && TYPE ( CHILD ( n, i ) ) == TYPE_COMMENT ) { vararg -> type_comment = NEW_TYPE_COMMENT ( CHILD ( n, i ) ) ; if (! vararg -> type_comment ) return NULL ; i += 1 ; } <S2SV_ModEnd> if ( i <S2SV_ModStart> ; i += 2 ; if ( TYPE ( CHILD ( n, i ) ) == COMMA ) i +=
Buggy code:
 static int sc_pkcs15emu_sc_hsm_init ( sc_pkcs15_card_t * p15card ) { sc_card_t * card = p15card -> card ; sc_hsm_private_data_t * priv = ( sc_hsm_private_data_t * ) card -> drv_data ; sc_file_t * file = NULL ; sc_path_t path ; u8 filelist [ MAX_EXT_APDU_LENGTH ] ; int filelistlength ; int r, i ; sc_cvc_t devcert ; struct sc_app_info * appinfo ; struct sc_pkcs15_auth_info pin_info ; struct sc_pkcs15_object pin_obj ; struct sc_pin_cmd_data pindata ; u8 efbin [ 1024 ] ; u8 * ptr ; size_t len ; LOG_FUNC_CALLED ( card -> ctx ) ; appinfo = calloc ( 1, sizeof ( struct sc_app_info ) ) ; if ( appinfo == NULL ) { LOG_FUNC_RETURN ( card -> ctx, SC_ERROR_OUT_OF_MEMORY ) ; } appinfo -> aid = sc_hsm_aid ; appinfo -> ddo. aid = sc_hsm_aid ; p15card -> app = appinfo ; sc_path_set ( & path, SC_PATH_TYPE_DF_NAME, sc_hsm_aid. value, sc_hsm_aid. len, 0, 0 ) ; r = sc_select_file ( card, & path, & file ) ; LOG_TEST_RET ( card -> ctx, r, "Could   not   select   SmartCard-HSM   application" ) ; p15card -> card -> version. hw_major = 24 ; p15card -> card -> version. hw_minor = 13 ; if ( file && file -> prop_attr && file -> prop_attr_len >= 2 ) { p15card -> card -> version. fw_major = file -> prop_attr [ file -> prop_attr_len - 2 ] ; p15card -> card -> version. fw_minor = file -> prop_attr [ file -> prop_attr_len - 1 ] ; } sc_file_free ( file ) ; if ( priv -> EF_C_DevAut && priv -> EF_C

Fix:
<S2SV_ModStart> "Skipping <S2SV_blank> optional <S2SV_blank> EF.C_DevAut" ) ; if ( len > 0 ) { <S2SV_ModStart> = len ; }
Buggy code:
 int sas_smp_get_phy_events ( struct sas_phy * phy ) { int res ; u8 * req ; u8 * resp ; struct sas_rphy * rphy = dev_to_rphy ( phy -> dev. parent ) ; struct domain_device * dev = sas_find_dev_by_rphy ( rphy ) ; req = alloc_smp_req ( RPEL_REQ_SIZE ) ; if (! req ) return - ENOMEM ; resp = alloc_smp_resp ( RPEL_RESP_SIZE ) ; if (! resp ) { kfree ( req ) ; return - ENOMEM ; } req [ 1 ] = SMP_REPORT_PHY_ERR_LOG ; req [ 9 ] = phy -> number ; res = smp_execute_task ( dev, req, RPEL_REQ_SIZE, resp, RPEL_RESP_SIZE ) ; if (! res ) goto out ; phy -> invalid_dword_count = scsi_to_u32 ( & resp [ 12 ] ) ; phy -> running_disparity_error_count = scsi_to_u32 ( & resp [ 16 ] ) ; phy -> loss_of_dword_sync_count = scsi_to_u32 ( & resp [ 20 ] ) ; phy -> phy_reset_problem_count = scsi_to_u32 ( & resp [ 24 ] ) ; out : <START_BUG> kfree ( resp ) ; <END_BUG> return res ; }

Fix:
<S2SV_ModStart> : kfree ( req ) ; kfree (
Buggy code:
 static int rm_read_multi ( AVFormatContext * s, AVIOContext * pb, AVStream * st, char * mime ) { int number_of_streams = avio_rb16 ( pb ) ; int number_of_mdpr ; int i, ret ; unsigned size2 ; for ( i = 0 ; i < number_of_streams ; i ++ ) avio_rb16 ( pb ) ; number_of_mdpr = avio_rb16 ( pb ) ; if ( number_of_mdpr!= 1 ) { avpriv_request_sample ( s, "MLTI   with   multiple   (%d)   MDPR", number_of_mdpr ) ; } for ( i = 0 ; i < number_of_mdpr ; i ++ ) { AVStream * st2 ; if ( i > 0 ) { st2 = avformat_new_stream ( s, NULL ) ; if (! st2 ) { ret = AVERROR ( ENOMEM ) ; return ret ; } st2 -> id = st -> id + ( i << 16 ) ; st2 -> codecpar -> bit_rate = st -> codecpar -> bit_rate ; st2 -> start_time = st -> start_time ; st2 -> duration = st -> duration ; st2 -> codecpar -> codec_type = AVMEDIA_TYPE_DATA ; st2 -> priv_data = ff_rm_alloc_rmstream ( ) ; if (! st2 -> priv_data ) return AVERROR ( ENOMEM ) ; } else st2 = st ; size2 = avio_rb32 ( pb ) ; ret = ff_rm_read_mdpr_codecdata ( s, s -> pb, st2, st2 -> priv_data, <START_BUG> size2, mime ) ; <END_BUG> if ( ret < 0 ) return ret ; } return 0 ; }

Fix:
<S2SV_ModStart>, size2, NULL <S2SV_ModEnd> ) ; if
Buggy code:
 static int efind ( name ) char * name ; { static char efbuf [ 100 ] ; my_regex_t re ; <START_BUG> sprintf ( efbuf, "REG_%s", name ) ; <END_BUG> assert ( strlen ( efbuf ) < sizeof ( efbuf ) ) ; re. re_endp = efbuf ; ( void ) my_regerror ( REG_ATOI, & re, efbuf, sizeof ( efbuf ) ) ; return ( atoi ( efbuf ) ) ; }

Fix:
<S2SV_ModStart> my_regex_t re ; snprintf ( efbuf, sizeof ( efbuf ) <S2SV_ModEnd>, "REG_%s",
Buggy code:
 static int do_remount ( struct path * path, int flags, int mnt_flags, void * data ) { int err ; struct super_block * sb = path -> mnt -> mnt_sb ; struct mount * mnt = real_mount ( path -> mnt ) ; if (! check_mnt ( mnt ) ) return - EINVAL ; if ( path -> dentry!= path -> mnt -> mnt_root ) return - EINVAL ; err = security_sb_remount ( sb, data ) ; if ( err ) return err ; down_write ( & sb -> s_umount ) ; if ( flags & MS_BIND ) err = change_mount_flags ( path -> mnt, flags ) ; else if (! capable ( CAP_SYS_ADMIN ) ) err = - EPERM ; else err = do_remount_sb ( sb, flags, data, 0 ) ; if (! err ) { lock_mount_hash ( ) ; <START_BUG> mnt_flags |= mnt -> mnt. mnt_flags & MNT_PROPAGATION_MASK ; <END_BUG> mnt -> mnt. mnt_flags = mnt_flags ; touch_mnt_namespace ( mnt -> mnt_ns ) ; unlock_mount_hash ( ) ; } up_write ( & sb -> s_umount ) ; return err ; }

Fix:
<S2SV_ModStart>. mnt_flags & ~ MNT_USER_SETTABLE_MASK <S2SV_ModEnd> ; mnt ->
Buggy code:
 void preproc_mount_mnt_dir ( void ) { if (! tmpfs_mounted ) { if ( arg_debug ) printf ( "Mounting   tmpfs   on   %s   directory\\n", RUN_MNT_DIR ) ; if ( mount ( "tmpfs", RUN_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME, "mode=755,gid=0" ) < 0 ) errExit ( "mounting   //run//firejail//mnt" ) ; tmpfs_mounted = 1 ; fs_logger2 ( "tmpfs", RUN_MNT_DIR ) ; # ifdef HAVE_SECCOMP <START_BUG> if ( arg_seccomp_block_secondary ) <END_BUG> copy_file ( PATH_SECCOMP_BLOCK_SECONDARY, RUN_SECCOMP_BLOCK_SECONDARY, getuid ( ), getgid ( ), 0644 ) ; else { copy_file ( PATH_SECCOMP_32, RUN_SECCOMP_32, getuid ( ), getgid ( ), 0644 ) ; } if ( arg_allow_debuggers ) copy_file ( PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid ( ), getgid ( ), 0644 ) ; else copy_file ( PATH_SECCOMP_DEFAULT, RUN_SECCOMP_CFG, getuid ( ), getgid ( ), 0644 ) ; if ( arg_memory_deny_write_execute ) copy_file ( PATH_SECCOMP_MDWX, RUN_SECCOMP_MDWX, getuid ( ), getgid ( ), 0644 ) ; create_empty_file_as_root ( RUN_SECCOMP_PROTOCOL, 0644 ) ; if ( set_perms ( RUN_SECCOMP_PROTOCOL, getuid ( ), getgid ( ), 0644 ) ) errExit ( "set_perms" ) ; create_empty_file_as_root ( RUN_SECCOMP_POSTEXEC, 0644 ) ; if ( set_perms ( RUN_SECCOMP_POSTEXEC, getuid ( ), getgid ( ), 0644 ) ) errExit ( "set_perms" ) ; # endif } }

Fix:
<S2SV_ModStart> # ifdef HAVE_SECCOMP create_empty_dir_as_root ( RUN_SECCOMP_DIR, 0755 ) ;
Buggy code:
 static void userfaultfd_event_wait_completion ( struct userfaultfd_ctx * ctx, struct userfaultfd_wait_queue * ewq ) { struct userfaultfd_ctx * release_new_ctx ; if ( WARN_ON_ONCE ( current -> flags & PF_EXITING ) ) goto out ; ewq -> ctx = ctx ; init_waitqueue_entry ( & ewq -> wq, current ) ; release_new_ctx = NULL ; spin_lock ( & ctx -> event_wqh. lock ) ; __add_wait_queue ( & ctx -> event_wqh, & ewq -> wq ) ; for ( ; ; ) { set_current_state ( TASK_KILLABLE ) ; if ( ewq -> msg. event == 0 ) break ; if ( READ_ONCE ( ctx -> released ) || fatal_signal_pending ( current ) ) { __remove_wait_queue ( & ctx -> event_wqh, & ewq -> wq ) ; if ( ewq -> msg. event == UFFD_EVENT_FORK ) { struct userfaultfd_ctx * new ; new = ( struct userfaultfd_ctx * ) ( unsigned long ) ewq -> msg. arg. reserved. reserved1 ; release_new_ctx = new ; } break ; } spin_unlock ( & ctx -> event_wqh. lock ) ; wake_up_poll ( & ctx -> fd_wqh, EPOLLIN ) ; schedule ( ) ; spin_lock ( & ctx -> event_wqh. lock ) ; } __set_current_state ( TASK_RUNNING ) ; spin_unlock ( & ctx -> event_wqh. lock ) ; if ( release_new_ctx ) { struct vm_area_struct * vma ; struct mm_struct * mm = release_new_ctx -> mm ; down_write ( & mm -> mmap_sem ) ; <START_BUG> for ( vma = mm -> mmap ; vma ; vma = vma -> vm_next ) <END_BUG> if ( vma -> vm_userfaultfd_ctx. ctx == release_new_ctx ) { vma -> vm_userfaultfd_ctx = NULL_VM_UFFD_CTX ; vma -> vm_flags &= ~ ( VM_UFFD_WP | VM_

Fix:
<S2SV_ModStart> mmap_sem ) ; VM_WARN_ON (! mmget_still_valid ( mm ) ) ;