nus-yam/ex-repair huggingface dataset:
Buggy code:
 void vp8_remove_compressor ( VP8_COMP * * ptr ) { VP8_COMP * cpi = * ptr ; if (! cpi ) return ; if ( cpi && ( cpi -> common. current_video_frame > 0 ) ) { # if! ( CONFIG_REALTIME_ONLY ) if ( cpi -> pass == 2 ) { vp8_end_second_pass ( cpi ) ; } # endif # ifdef VP8_ENTROPY_STATS print_context_counters ( ) ; print_tree_update_probs ( ) ; print_mode_context ( ) ; # endif # if CONFIG_INTERNAL_STATS if ( cpi -> pass!= 1 ) { FILE * f = fopen ( "opsnr.stt", "a" ) ; double time_encoded = ( cpi -> last_end_time_stamp_seen - cpi -> first_time_stamp_ever ) // 10000000.000 ; double total_encode_time = ( cpi -> time_receive_data + cpi -> time_compress_data ) // 1000.000 ; double dr = ( double ) cpi -> bytes * 8.0 // 1000.0 // time_encoded ; if ( cpi -> b_calculate_psnr ) { <START_BUG> YV12_BUFFER_CONFIG * lst_yv12 = <END_BUG> & cpi -> common. yv12_fb [ cpi -> common. lst_fb_idx ] ; if ( cpi -> oxcf. number_of_layers > 1 ) { int i ; fprintf ( f, "Layer\\tBitrate\\tAVGPsnr\\tGLBPsnr\\tAVPsnrP\\t" "GLPsnrP\\tVPXSSIM\\t\\n" ) ; for ( i = 0 ; i < ( int ) cpi -> oxcf. number_of_layers ; i ++ ) { double dr = ( double ) cpi -> bytes_in_layer [ i ] * 8.0 // 1000.0 // time_encoded ; double samples = 3.0 // 2 * cpi -> frames_in_layer [ i ] *  lst_yv12 -> y_width * lst_yv12 -> y_height ; <START_BUG> double total_psnr = vpx_sse_to_psnr<END_BUG>

Fix:
<S2SV_ModStart> b_calculate_psnr ) { <S2SV_ModEnd> if ( cpi <S2SV_ModStart> i ] * cpi -> common. Width * cpi -> common. Height <S2SV_ModEnd> ; double total_psnr <S2SV_ModStart> -> count * cpi -> common. Width * cpi -> common. Height <S2SV_ModEnd> ; double total_psnr <S2SV_ModStart> cyclic_refresh_map ) ; vpx_free ( cpi -> consec_zero_last ) ; vpx_free ( cpi -> consec_zero_last_mvbias ) ; <S2SV_ModStart> # endif # ifdef OUTPUT_YUV_DENOISED fclose ( yuv_denoised_file ) ; # endif #
Buggy code:
 static void test_simple ( ) { json_set_alloc_funcs ( my_malloc, my_free ) ; create_and_free_complex_object ( ) ; <START_BUG> if ( malloc_called!= 20 || free_called!= 20 ) <END_BUG> fail ( "Custom   allocation   failed" ) ; }

Fix:
<S2SV_ModStart> ( malloc_called!= 1 <S2SV_ModEnd> || free_called!= <S2SV_ModStart> || free_called!= 1 <S2SV_ModEnd> ) fail (
Buggy code:
 static void pcd_init_units ( void ) { struct pcd_unit * cd ; int unit ; pcd_drive_count = 0 ; for ( unit = 0, cd = pcd ; unit < PCD_UNITS ; unit ++, cd ++ ) { struct gendisk * disk = alloc_disk ( 1 ) ; if (! disk ) continue ; disk -> queue = blk_mq_init_sq_queue ( & cd -> tag_set, & pcd_mq_ops, 1, BLK_MQ_F_SHOULD_MERGE ) ; if ( IS_ERR ( disk -> queue ) ) { <START_BUG> disk -> queue = NULL ; <END_BUG> continue ; } INIT_LIST_HEAD ( & cd -> rq_list ) ; disk -> queue -> queuedata = cd ; blk_queue_bounce_limit ( disk -> queue, BLK_BOUNCE_HIGH ) ; cd -> disk = disk ; cd -> pi = & cd -> pia ; cd -> present = 0 ; cd -> last_sense = 0 ; cd -> changed = 1 ; cd -> drive = ( * drives [ unit ] ) [ D_SLV ] ; if ( ( * drives [ unit ] ) [ D_PRT ] ) pcd_drive_count ++ ; cd -> name = & cd -> info. name [ 0 ] ; snprintf ( cd -> name, sizeof ( cd -> info. name ), "%s%d", name, unit ) ; cd -> info. ops = & pcd_dops ; cd -> info. handle = cd ; cd -> info. speed = 0 ; cd -> info. capacity = 1 ; cd -> info. mask = 0 ; disk -> major = major ; disk -> first_minor = unit ; strcpy ( disk -> disk_name, cd -> name ) ; disk -> fops = & pcd_bdops ; disk -> flags = GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE ; } }

Fix:
<S2SV_ModStart> ) ) { put_disk ( disk ) ;
Buggy code:
 void kvm_lapic_sync_from_vapic ( struct kvm_vcpu * vcpu ) { <START_BUG> u32 data ; <END_BUG> void * vapic ; if ( test_bit ( KVM_APIC_PV_EOI_PENDING, & vcpu -> arch. apic_attention ) ) apic_sync_pv_eoi_from_guest ( vcpu, vcpu -> arch. apic ) ; if (! test_bit ( KVM_APIC_CHECK_VAPIC, & vcpu -> arch. apic_attention ) ) return ;  vapic = kmap_atomic ( vcpu -> arch. apic -> vapic_page ) ; <START_BUG> data = * ( u32 * ) ( vapic + offset_in_page ( vcpu -> arch. apic -> vapic_addr ) ) ; kunmap_atomic ( vapic ) ; apic_set_tpr ( vcpu -> arch. apic, data & 0xff ) ; }<END_BUG>

Fix:
<S2SV_ModStart> { u32 data <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) return ; kvm_read_guest_cached ( vcpu -> kvm, & <S2SV_ModEnd> vcpu -> arch <S2SV_ModStart>. apic -> vapic_cache, & data, sizeof ( u32 ) <S2SV_ModEnd> ) ; apic_set_tpr
Buggy code:
 static int ndp_sock_recv ( struct ndp * ndp ) { struct ndp_msg * msg ; enum ndp_msg_type msg_type ; size_t len ; int err ; msg = ndp_msg_alloc ( ) ; if (! msg ) return - ENOMEM ; len = ndp_msg_payload_maxlen ( msg ) ; err = myrecvfrom6 ( ndp -> sock, msg -> buf, & len, 0, <START_BUG> & msg -> addrto, & msg -> ifindex ) ; <END_BUG> if ( err ) { err ( ndp, "Failed   to   receive   message" ) ; goto free_msg ; }  dbg ( ndp, "rcvd   from:   %s,   ifindex:   %u", <START_BUG> <END_BUG> str_in6_addr ( & msg -> addrto ), msg -> ifindex ) ;  if ( len < sizeof ( * msg -> icmp6_hdr ) ) { warn ( ndp, "rcvd   icmp6   packet   too   short   (%luB)", len ) ; err = 0 ; goto free_msg ; } err = ndp_msg_type_by_raw_type ( & msg_type, msg -> icmp6_hdr -> icmp6_type ) ; if ( err ) { err = 0 ; goto free_msg ; } ndp_msg_init ( msg, msg_type ) ; ndp_msg_payload_len_set ( msg, len ) ; if (! ndp_msg_check_valid ( msg ) ) { warn ( ndp, "rcvd   invalid   ND   message" ) ; err = 0 ; goto free_msg ; } dbg ( ndp, "rcvd   %s,   len:   %zuB", ndp_msg_type_info ( msg_type ) -> strabbr, len ) ; if (! ndp_msg_check_opts ( msg ) ) { err = 0 ; goto free_msg ; } err = ndp_call_handlers ( ndp, msg ) ; ; free_msg : ndp_msg_destroy ( msg ) ; return err ; }

Fix:
<S2SV_ModStart> msg -> ifindex, & msg -> hoplimit <S2SV_ModStart> ( ndp, "rcvd <S2SV_blank> from: <S2SV_blank> %s, <S2SV_blank> ifindex: <S2SV_blank> %u, <S2SV_blank> hoplimit: <S2SV_blank> %d" <S2SV_ModEnd>, str_in6_addr ( <S2SV_ModStart> msg -> ifindex, msg -> hoplimit ) ; if ( msg -> hoplimit!= 255 ) { warn ( ndp, "ignoring <S2SV_blank> packet <S2SV_blank> with <S2SV_blank> bad <S2SV_blank> hop <S2SV_blank> limit <S2SV_blank> (%d)", msg -> hoplimit ) ; err = 0 ; goto free_msg ; } <S2SV_ModEnd> if ( len
Buggy code:
 static void btsnoop_write ( const void * data, size_t length ) { if ( logfile_fd!= INVALID_FD ) <START_BUG> write ( logfile_fd, data, length ) ; <END_BUG> btsnoop_net_write ( data, length ) ; }

Fix:
<S2SV_ModStart>!= INVALID_FD ) TEMP_FAILURE_RETRY ( <S2SV_ModStart> data, length )
Buggy code:
 int ECDSA_verify ( int type, const unsigned char * dgst, int dgst_len, const unsigned char * sigbuf, int sig_len, EC_KEY * eckey ) { ECDSA_SIG * s ; <START_BUG> int ret = - 1 ; <END_BUG> s = ECDSA_SIG_new ( ) ; if ( s == NULL ) return ( ret ) ;  if ( d2i_ECDSA_SIG ( & s, & sigbuf, sig_len ) == NULL ) goto err ; <START_BUG> ret = ECDSA_do_verify ( dgst, dgst_len, s, eckey ) ; err : <END_BUG> ECDSA_SIG_free ( s ) ;  return ( ret ) ; }

Fix:
<S2SV_ModStart> * s ; const unsigned char * p = sigbuf ; unsigned char * der = NULL ; int derlen = - 1 ; <S2SV_ModStart> s, & p <S2SV_ModEnd>, sig_len ) <S2SV_ModStart> == NULL ) goto err ; derlen = i2d_ECDSA_SIG ( s, & der ) ; if ( derlen!= sig_len || memcmp ( sigbuf, der, derlen ) ) <S2SV_ModStart> ; err : if ( derlen > 0 ) { OPENSSL_cleanse ( der, derlen ) ; OPENSSL_free ( der ) ; }
Buggy code:
 void __ip_select_ident ( struct net * net, struct iphdr * iph, int segs ) { <START_BUG> static u32 ip_idents_hashrnd __read_mostly ; <END_BUG> u32 hash, id ;  net_get_random_once ( & ip_idents_hashrnd, sizeof ( ip_idents_hashrnd ) ) ; <START_BUG> <END_BUG> hash = jhash_3words ( ( __force u32 ) iph -> daddr,  ( __force u32 ) iph -> saddr, <START_BUG> iph -> protocol ^ net_hash_mix ( net ), <END_BUG> ip_idents_hashrnd ) ; id = ip_idents_reserve ( hash, segs ) ; iph -> id = htons ( id ) ; }

Fix:
<S2SV_ModStart> segs ) { <S2SV_ModEnd> u32 hash, <S2SV_ModStart>, id ; if ( unlikely ( siphash_key_is_zero ( & net -> ipv4. ip_id_key ) ) ) get_random_bytes ( & net -> ipv4. ip_id_key <S2SV_ModEnd>, sizeof ( <S2SV_ModStart>, sizeof ( net -> ipv4. ip_id_key <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ; hash = siphash_3u32 <S2SV_ModEnd> ( ( __force <S2SV_ModStart> iph -> protocol, & net -> ipv4. ip_id_key <S2SV_ModEnd> ) ; id
Buggy code:
 static void lo_release ( struct gendisk * disk, fmode_t mode ) { <START_BUG> struct loop_device * lo = disk -> private_data ; <END_BUG> int err ; if ( atomic_dec_return ( & lo -> lo_refcnt ) ) return ; mutex_lock ( & lo -> lo_ctl_mutex ) ; if ( lo -> lo_flags & LO_FLAGS_AUTOCLEAR ) { err = loop_clr_fd ( lo ) ; if (! err ) return ; } else if ( lo -> lo_state == Lo_bound ) { blk_mq_freeze_queue ( lo -> lo_queue ) ; blk_mq_unfreeze_queue ( lo -> lo_queue ) ; }  mutex_unlock ( & lo -> lo_ctl_mutex ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> mode ) { mutex_lock ( & loop_index_mutex ) ; __lo_release ( <S2SV_ModEnd> disk -> private_data <S2SV_ModStart> disk -> private_data ) ; <S2SV_ModEnd> mutex_unlock ( & <S2SV_ModStart> mutex_unlock ( & loop_index_mutex <S2SV_ModEnd> ) ; }
Buggy code:
 int ipmi_si_port_setup ( struct si_sm_io * io ) { unsigned int addr = io -> addr_data ; int idx ; if (! addr ) return - ENODEV ; <START_BUG> io -> io_cleanup = port_cleanup ; <END_BUG> switch ( io -> regsize ) { case 1 : io -> inputb = port_inb ; io -> outputb = port_outb ; break ; case 2 : io -> inputb = port_inw ; io -> outputb = port_outw ; break ; case 4 : io -> inputb = port_inl ; io -> outputb = port_outl ; break ; default : dev_warn ( io -> dev, "Invalid   register   size:   %d\\n", io -> regsize ) ; return - EINVAL ; } for ( idx = 0 ; idx < io -> io_size ; idx ++ ) { if ( request_region ( addr + idx * io -> regspacing, io -> regsize, DEVICE_NAME ) == NULL ) { while ( idx -- ) release_region ( addr + idx * io -> regspacing, io -> regsize ) ; return - EIO ; } }  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> - ENODEV ; <S2SV_ModEnd> switch ( io <S2SV_ModStart> ; } } io -> io_cleanup = port_cleanup ;
Buggy code:
 static int rndr_quote ( struct buf * ob, const struct buf * text, void * opaque ) { if (! text ||! text -> size ) return 0 ; <START_BUG> BUFPUTSL ( ob, "<q>" ) ; <END_BUG> bufput ( ob, text -> data, text -> size ) ; BUFPUTSL ( ob, "<//q>" ) ; return 1 ; }

Fix:
<S2SV_ModStart> return 0 ; struct html_renderopt * options = opaque ; <S2SV_ModStart> "<q>" ) ; if ( options -> flags & HTML_ESCAPE ) escape_html ( ob, text -> data, text -> size ) ; else
Buggy code:
 static UINT drive_process_irp_write ( DRIVE_DEVICE * drive, IRP * irp ) { DRIVE_FILE * file ; UINT32 Length ; UINT64 Offset ; <START_BUG> if (! drive ||! irp ||! irp -> input ||! irp -> output ||! irp -> Complete ) <END_BUG> return ERROR_INVALID_PARAMETER ; if ( Stream_GetRemainingLength ( irp -> input ) < 32 ) return ERROR_INVALID_DATA ; Stream_Read_UINT32 ( irp -> input, Length ) ; Stream_Read_UINT64 ( irp -> input, Offset ) ; Stream_Seek ( irp -> input, 20 ) ;  file = drive_get_file_by_id ( drive, irp -> FileId ) ; <START_BUG> if (! file ) { irp -> IoStatus = STATUS_UNSUCCESSFUL ; Length = 0 ; } else if (! drive_file_seek ( file, Offset ) ) { irp -> IoStatus = drive_map_windows_err ( GetLastError ( ) ) ; Length = 0 ; } <END_BUG> else if (! drive_file_write ( file, Stream_Pointer ( irp -> input ), Length ) )  { irp -> IoStatus = drive_map_windows_err ( GetLastError ( ) ) ; Length = 0 ; } Stream_Write_UINT32 ( irp -> output, Length ) ; Stream_Write_UINT8 ( irp -> output, 0 ) ; return irp -> Complete ( irp ) ; }

Fix:
<S2SV_ModStart> UINT64 Offset ; void * ptr ; <S2SV_ModStart> 20 ) ; ptr = Stream_Pointer ( irp -> input ) ; if (! Stream_SafeSeek ( irp -> input, Length ) ) return ERROR_INVALID_DATA ; <S2SV_ModStart> ( file, ptr <S2SV_ModEnd>, Length )
Buggy code:
 int ext4_punch_hole ( struct inode * inode, loff_t offset, loff_t length ) { struct super_block * sb = inode -> i_sb ; ext4_lblk_t first_block, stop_block ; struct address_space * mapping = inode -> i_mapping ; loff_t first_block_offset, last_block_offset ; handle_t * handle ; unsigned int credits ; int ret = 0 ; if (! S_ISREG ( inode -> i_mode ) ) return - EOPNOTSUPP ; trace_ext4_punch_hole ( inode, offset, length, 0 ) ; if ( mapping -> nrpages && mapping_tagged ( mapping, PAGECACHE_TAG_DIRTY ) ) { ret = filemap_write_and_wait_range ( mapping, offset, offset + length - 1 ) ; if ( ret ) return ret ; } mutex_lock ( & inode -> i_mutex ) ; if ( offset >= inode -> i_size ) goto out_mutex ; if ( offset + length > inode -> i_size ) { length = inode -> i_size + PAGE_CACHE_SIZE - ( inode -> i_size & ( PAGE_CACHE_SIZE - 1 ) ) - offset ; } if ( offset & ( sb -> s_blocksize - 1 ) || ( offset + length ) & ( sb -> s_blocksize - 1 ) ) { ret = ext4_inode_attach_jinode ( inode ) ; if ( ret < 0 ) goto out_mutex ; } <START_BUG> first_block_offset = round_up ( offset, sb -> s_blocksize ) ; <END_BUG> last_block_offset = round_down ( ( offset + length ), sb -> s_blocksize ) - 1 ; if ( last_block_offset > first_block_offset ) truncate_pagecache_range ( inode, first_block_offset, last_block_offset ) ;  ext4_inode_block_unlocked_dio ( inode ) ; <START_BUG> inode_dio_wait ( inode ) ; if ( ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) credits = ext4_writepage_trans_blocks ( inode ) ; else credits = ext4_blocks_for_truncate ( inode ) ;<END_BUG>

Fix:
<S2SV_ModStart> out_mutex ; } ext4_inode_block_unlocked_dio ( inode ) ; inode_dio_wait ( inode ) ; down_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModStart> last_block_offset ) ; <S2SV_ModEnd> if ( ext4_test_inode_flag <S2SV_ModStart> handle ) ; <S2SV_ModEnd> inode -> i_mtime <S2SV_ModStart> ; out_dio : up_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ;
Buggy code:
 static void sig_server_setup_fill_chatnet ( IRC_SERVER_CONNECT_REC * conn, IRC_CHATNET_REC * ircnet ) { if (! IS_IRC_SERVER_CONNECT ( conn ) ) return ; g_return_if_fail ( IS_IRCNET ( ircnet ) ) ; if ( ircnet -> alternate_nick!= NULL ) { g_free_and_null ( conn -> alternate_nick ) ; conn -> alternate_nick = g_strdup ( ircnet -> alternate_nick ) ; } if ( ircnet -> usermode!= NULL ) { g_free_and_null ( conn -> usermode ) ; conn -> usermode = g_strdup ( ircnet -> usermode ) ; } if ( ircnet -> max_kicks > 0 ) conn -> max_kicks = ircnet -> max_kicks ; if ( ircnet -> max_msgs > 0 ) conn -> max_msgs = ircnet -> max_msgs ; if ( ircnet -> max_modes > 0 ) conn -> max_modes = ircnet -> max_modes ; if ( ircnet -> max_whois > 0 ) conn -> max_whois = ircnet -> max_whois ; if ( ircnet -> max_cmds_at_once > 0 ) conn -> max_cmds_at_once = ircnet -> max_cmds_at_once ; if ( ircnet -> cmd_queue_speed > 0 ) conn -> cmd_queue_speed = ircnet -> cmd_queue_speed ; if ( ircnet -> max_query_chans > 0 ) conn -> max_query_chans = ircnet -> max_query_chans ; conn -> sasl_mechanism = SASL_MECHANISM_NONE ; conn -> sasl_username = NULL ; conn -> sasl_password = NULL ; if ( ircnet -> sasl_mechanism!= NULL ) { if (! g_ascii_strcasecmp ( ircnet -> sasl_mechanism, "plain" ) ) { conn -> sasl_mechanism = SASL_MECHANISM_PLAIN ; if ( ircnet -> sasl_username!= NULL && * ircnet -> sasl_username &&

Fix:
<S2SV_ModStart> -> sasl_username = g_strdup ( ircnet -> sasl_username ) ; conn -> sasl_password = g_strdup ( ircnet -> sasl_password ) <S2SV_ModEnd> ; } else
Buggy code:
 static Image * ReadTXTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char colorspace [ MaxTextExtent ], text [ MaxTextExtent ] ; Image * image ; IndexPacket * indexes ; long x_offset, y_offset ; MagickBooleanType status ; MagickPixelPacket pixel ; QuantumAny range ; register ssize_t i, x ; register PixelPacket * q ; ssize_t count, type, y ; unsigned long depth, height, max_value, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( text, 0, sizeof ( text ) ) ; ( void ) ReadBlobString ( image, text ) ; if ( LocaleNCompare ( ( char * ) text, MagickID, strlen ( MagickID ) )!= 0 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { width = 0 ; height = 0 ; max_value = 0 ; * colorspace = '\\0' ; count = ( ssize_t ) sscanf ( text + 32, "%lu,%lu,%lu,%s", & width, & height, & max_value, colorspace ) ; if ( ( count!= 4 ) || ( width == 0 ) || ( height == 0 ) || ( max_value == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; image -> columns = width ; image -> rows = height ; for ( depth = 1 ; ( GetQuantumRange ( depth ) + 1 ) < max_value ; depth ++ ) ; image -> depth = depth ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status

Fix:
<S2SV_ModStart> ; } } if ( EOFBlob ( image )!= MagickFalse ) { ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; break ; }
Buggy code:
 sds genRedisInfoString ( void ) { sds info ; time_t uptime = time ( NULL ) - server. stat_starttime ; int j ; char hmem [ 64 ] ; struct rusage self_ru, c_ru ; getrusage ( RUSAGE_SELF, & self_ru ) ; getrusage ( RUSAGE_CHILDREN, & c_ru ) ; bytesToHuman ( hmem, zmalloc_used_memory ( ) ) ; info = sdscatprintf ( sdsempty ( ), "redis_version:%s\\r\\n" "redis_git_sha1:%s\\r\\n" "redis_git_dirty:%d\\r\\n" "arch_bits:%s\\r\\n" "multiplexing_api:%s\\r\\n" "process_id:%ld\\r\\n" "uptime_in_seconds:%ld\\r\\n" "uptime_in_days:%ld\\r\\n" "lru_clock:%ld\\r\\n" "used_cpu_sys:%.2f\\r\\n" "used_cpu_user:%.2f\\r\\n" "used_cpu_sys_childrens:%.2f\\r\\n" "used_cpu_user_childrens:%.2f\\r\\n" "connected_clients:%d\\r\\n" "connected_slaves:%d\\r\\n" "blocked_clients:%d\\r\\n" "used_memory:%zu\\r\\n" "used_memory_human:%s\\r\\n" "used_memory_rss:%zu\\r\\n" "mem_fragmentation_ratio:%.2f\\r\\n" "use_tcmalloc:%d\\r\\n" "loading:%d\\r\\n" "aof_enabled:%d\\r\\n" "changes_since_last_save:%lld\\r\\n" "bgsave_in_progress:%d\\r\\n" "last_save_time:%ld\\r\\n" "bgrewriteaof_in_progress:%d\\r\\n" "total_connections_received:%lld\\r\\n" "total_commands_processed:%lld\\r\\n" "

Fix:
<S2SV_ModStart> "hash_max_zipmap_value:%zu\\r\\n" "pubsub_channels:%ld\\r\\n" "pubsub_patterns:%u\\r\\n" "ds_enabled:%d\\r\\n" <S2SV_ModEnd> "role:%s\\r\\n", REDIS_VERSION <S2SV_ModStart>, server. ds_enabled <S2SV_ModEnd>!= 0, <S2SV_ModStart> ( server. ds_enabled <S2SV_ModEnd> ) { lockThreadedIO <S2SV_ModStart> ( info, "cache_max_memory:%llu\\r\\n" "cache_blocked_clients:%lu\\r\\n" <S2SV_ModEnd>, ( unsigned <S2SV_ModStart> ) server. cache_max_memory <S2SV_ModEnd>, ( unsigned <S2SV_ModStart> ( unsigned long ) server. cache_blocked_clients <S2SV_ModEnd> ) ; unlockThreadedIO
Buggy code:
 static RD_BOOL mcs_parse_domain_params ( STREAM s ) { <START_BUG> int length ; <END_BUG>  ber_parse_header ( s, MCS_TAG_DOMAIN_PARAMS, & length ) ; <START_BUG> in_uint8s ( s, length ) ; return s_check ( s ) ; }<END_BUG>

Fix:
<S2SV_ModStart> s ) { uint32 length ; struct stream packet = * s <S2SV_ModEnd> ; ber_parse_header ( <S2SV_ModStart> length ) ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "mcs_parse_domain_params(), <S2SV_blank> consume <S2SV_blank> domain <S2SV_blank> params <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 int DetectEngineContentInspection ( DetectEngineCtx * de_ctx, DetectEngineThreadCtx * det_ctx, const Signature * s, const SigMatchData * smd, Flow * f, uint8_t * buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t inspection_mode, void * data ) { SCEnter ( ) ; KEYWORD_PROFILING_START ; det_ctx -> inspection_recursion_counter ++ ; if ( det_ctx -> inspection_recursion_counter == de_ctx -> inspection_recursion_limit ) { det_ctx -> discontinue_matching = 1 ; KEYWORD_PROFILING_END ( det_ctx, smd -> type, 0 ) ; SCReturnInt ( 0 ) ; } if ( smd == NULL || buffer_len == 0 ) { KEYWORD_PROFILING_END ( det_ctx, smd -> type, 0 ) ; SCReturnInt ( 0 ) ; } if ( smd -> type == DETECT_CONTENT ) { DetectContentData * cd = ( DetectContentData * ) smd -> ctx ; SCLogDebug ( "inspecting   content   %" PRIu32 "   buffer_len   %" PRIu32, cd -> id, buffer_len ) ; # ifdef DEBUG BUG_ON ( cd -> depth!= 0 && cd -> depth <= cd -> offset ) ; # endif uint8_t * found = NULL ; uint32_t offset = 0 ; uint32_t depth = buffer_len ; uint32_t prev_offset = 0 ; uint32_t prev_buffer_offset = det_ctx -> buffer_offset ; do { if ( ( cd -> flags & DETECT_CONTENT_DISTANCE ) || ( cd -> flags & DETECT_CONTENT_WITHIN ) ) { SCLogDebug ( "det_ctx->buffer_offset   %" PRIu32, det_ctx -> buffer_offset ) ; offset = prev_buffer_offset ; depth = buffer_len ; int distance = cd -> distance ; if ( cd -> flags & DETECT_CONTENT_DISTANCE ) { if ( cd -> flags & DETECT_CONTENT_DISTANCE_BE ) { distance = det_ctx -> bj_values [ cd -> distance ] ; } if ( distance < 0 && ( uint32_t ) ( abs ( distance

Fix:
<S2SV_ModStart> ) ) { if ( ( cd -> flags & ( DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN ) ) == 0 ) { det_ctx -> discontinue_matching = 1 ; } <S2SV_ModStart> } if ( smd -> is_last ) { goto match <S2SV_ModEnd> ; } SCLogDebug <S2SV_ModStart> ) ; } SCLogDebug ( "no <S2SV_blank> match <S2SV_blank> for <S2SV_blank> \'next <S2SV_blank> sm\'" ) ; <S2SV_ModStart> -> discontinue_matching ) { SCLogDebug ( "\'next <S2SV_blank> sm\' <S2SV_blank> said <S2SV_blank> to <S2SV_blank> discontinue <S2SV_blank> this <S2SV_blank> right <S2SV_blank> now" ) ; goto no_match ; } if ( ( cd -> flags & DETECT_CONTENT_RELATIVE_NEXT ) == 0 ) { SCLogDebug ( "\'next <S2SV_blank> sm\' <S2SV_blank> does <S2SV_blank> not <S2SV_blank> depend <S2SV_blank> on <S2SV_blank> me, <S2SV_blank> so <S2SV_blank> we <S2SV_blank> can <S2SV_blank> give <S2SV_blank> up" ) ; det_ctx -> discontinue_matching = 1 ; goto no_match ; } SCLogDebug ( "\'next <S2SV_blank> sm\' <S2SV_blank> depends <S2SV_blank> on <S2SV_blank> me <S2SV_blank> %p, <S2SV_blank> lets <S2SV_blank> see <S2SV_blank> what <S2SV_blank> we <S2SV_blank> can <S2SV_blank> do <S2SV_blank> (flags <S2SV_blank> %u)", cd, cd -> flags ) <S2SV_ModEnd> ;
Buggy code:
 <START_BUG> void close_connection ( h2o_http2_conn_t * conn ) <END_BUG> { conn -> state = H2O_HTTP2_CONN_STATE_IS_CLOSING ; if ( conn -> _write. buf_in_flight!= NULL || h2o_timeout_is_linked ( & conn -> _write. timeout_entry ) ) { } else { close_connection_now ( conn ) ;  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> int <S2SV_ModEnd> close_connection ( h2o_http2_conn_t <S2SV_ModStart> conn ) ; return - 1 ; } return 0 ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static zend_always_inline int process_nested_data ( UNSERIALIZE_PARAMETER, HashTable * ht, zend_long elements, int objprops ) { while ( elements -- > 0 ) { zval key, * data, d, * old_data ; zend_ulong idx ; ZVAL_UNDEF ( & key ) ; if (! php_var_unserialize_internal ( & key, p, max, NULL, classes ) ) { zval_dtor ( & key ) ; return 0 ; } data = NULL ; ZVAL_UNDEF ( & d ) ; if (! objprops ) { if ( Z_TYPE ( key ) == IS_LONG ) { idx = Z_LVAL ( key ) ; numeric_key : if ( UNEXPECTED ( ( old_data = zend_hash_index_find ( ht, idx ) )!= NULL ) ) { var_push_dtor ( var_hash, old_data ) ; data = zend_hash_index_update ( ht, idx, & d ) ; } else { data = zend_hash_index_add_new ( ht, idx, & d ) ; } } else if ( Z_TYPE ( key ) == IS_STRING ) { if ( UNEXPECTED ( ZEND_HANDLE_NUMERIC ( Z_STR ( key ), idx ) ) ) { goto numeric_key ; } if ( UNEXPECTED ( ( old_data = zend_hash_find ( ht, Z_STR ( key ) ) )!= NULL ) ) { var_push_dtor ( var_hash, old_data ) ; data = zend_hash_update ( ht, Z_STR ( key ), & d ) ; } else { data = zend_hash_add_new ( ht, Z_STR ( key ), & d ) ; } } else { zval_dtor ( & key ) ; return 0 ; } } else { if ( EXPECTED ( Z_TYPE ( key ) == IS_STRING ) ) { string_key : if ( ( old_data = zend_hash_find ( ht, Z_STR ( key ) ) )!= NULL ) { if ( Z_TYPE_P ( old_data ) == IS_INDIRECT ) { old_data = Z_INDIRECT_P ( old_data ) ; } var_push_dtor ( var_hash

Fix:
<S2SV_ModStart> 0 ; } <S2SV_ModEnd> var_push_dtor ( var_hash <S2SV_ModStart> data ) ; <S2SV_ModEnd> zval_dtor ( &
Buggy code:
 WORD32 ih264d_parse_decode_slice ( UWORD8 u1_is_idr_slice, UWORD8 u1_nal_ref_idc, dec_struct_t * ps_dec ) { dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; dec_pic_params_t * ps_pps ; dec_seq_params_t * ps_seq ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; pocstruct_t s_tmp_poc ; WORD32 i_delta_poc [ 2 ] ; WORD32 i4_poc = 0 ; UWORD16 u2_first_mb_in_slice, u2_frame_num ; UWORD8 u1_field_pic_flag, u1_redundant_pic_cnt = 0, u1_slice_type ; UWORD32 u4_idr_pic_id = 0 ; UWORD8 u1_bottom_field_flag, u1_pic_order_cnt_type ; UWORD8 u1_nal_unit_type ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; WORD8 i1_is_end_of_poc ; WORD32 ret, end_of_frame ; WORD32 prev_slice_err, num_mb_skipped ; UWORD8 u1_mbaff ; pocstruct_t * ps_cur_poc ; UWORD32 u4_temp ; WORD32 i_temp ; UWORD32 u4_call_end_of_pic = 0 ; ps_dec -> ps_dpb_cmds -> u1_dpb_commands_read_slc = 0 ; u2_first_mb_in_slice = ih264d_uev ( pu4_bitstrm_ofst, pu4_bitstrm_buf ) ; if ( u2_first_mb_in_slice > ( ps_dec -> u2_frm_ht_in_mbs * ps_dec -> u2_frm_

Fix:
<S2SV_ModStart> MASK_ERR_PIC_SET_ID ) return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; COPYTHECONTEXT ( <S2SV_ModStart> ) { return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; } ps_seq <S2SV_ModStart> ps_seq ) return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; if ( <S2SV_ModStart> u1_is_valid ) return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; u2_frame_num = <S2SV_ModStart> 65535 ) return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; COPYTHECONTEXT ( <S2SV_ModStart> i4_max_pic_order_cntLsb ) return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; s_tmp_poc. <S2SV_ModStart> MAX_REDUNDANT_PIC_CNT ) return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; u1_redundant_pic_cnt =
Buggy code:
 error_t udpSendDatagram ( Socket * socket, const SocketMsg * message, uint_t flags ) { error_t error ; size_t offset ; NetBuffer * buffer ; <START_BUG> NetTxAncillary ancillary ; <END_BUG> buffer = udpAllocBuffer ( 0, & offset ) ; if ( buffer == NULL ) return ERROR_OUT_OF_MEMORY ; error = netBufferAppend ( buffer, message -> data, message -> length ) ; if (! error ) { ancillary = NET_DEFAULT_TX_ANCILLARY ; if ( message -> ttl!= 0 ) { ancillary. ttl = message -> ttl ; } else if ( ipIsMulticastAddr ( & message -> destIpAddr ) ) { ancillary. ttl = socket -> multicastTtl ; } else { ancillary. ttl = socket -> ttl ; } if ( flags & SOCKET_FLAG_DONT_ROUTE ) { ancillary. dontRoute = TRUE ; } # if ( IP_DIFF_SERV_SUPPORT == ENABLED ) ancillary. dscp = socket -> dscp ; # endif # if ( ETH_SUPPORT == ENABLED ) ancillary. srcMacAddr = message -> srcMacAddr ; ancillary. destMacAddr = message -> destMacAddr ; # endif # if ( ETH_VLAN_SUPPORT == ENABLED ) ancillary. vlanPcp = socket -> vlanPcp ; ancillary. vlanDei = socket -> vlanDei ; # endif # if ( ETH_VMAN_SUPPORT == ENABLED ) ancillary. vmanPcp = socket -> vmanPcp ; ancillary. vmanDei = socket -> vmanDei ; # endif # if ( ETH_PORT_TAGGING_SUPPORT == ENABLED ) ancillary. port = message -> switchPort ; # endif # if ( ETH_TIMESTAMP_SUPPORT == ENABLED ) ancillary. timestampId = message -> timestampId ; # endif  error = udpSendBuffer ( socket -> interface, & message -> srcIpAddr, <START_BUG> socket -> localPort, & message -> destIpAddr, message -> destPort, buffer, offset, & ancillary ) ; } netBufferFree ( buffer ) ; return error ; }<END_BUG>

Fix:
<S2SV_ModStart> * buffer ; NetInterface * interface ; <S2SV_ModStart> NetTxAncillary ancillary ; if ( message -> interface!= NULL ) { interface = message -> interface ; } else { interface = socket -> interface ; } <S2SV_ModStart> = udpSendBuffer ( <S2SV_ModEnd> interface, &
Buggy code:
 static void toggle_os_keylockstates ( int fd, int changedlockstates ) { BTIF_TRACE_EVENT ( "%s:   fd   =   %d,   changedlockstates   =   0x%x", __FUNCTION__, fd, changedlockstates ) ; UINT8 hidreport [ 9 ] ; int reportIndex ; memset ( hidreport, 0, 9 ) ; hidreport [ 0 ] = 1 ; reportIndex = 4 ; if ( changedlockstates & BTIF_HH_KEYSTATE_MASK_CAPSLOCK ) { BTIF_TRACE_DEBUG ( "%s   Setting   CAPSLOCK", __FUNCTION__ ) ; hidreport [ reportIndex ++ ] = ( UINT8 ) HID_REPORT_CAPSLOCK ; } if ( changedlockstates & BTIF_HH_KEYSTATE_MASK_NUMLOCK ) { BTIF_TRACE_DEBUG ( "%s   Setting   NUMLOCK", __FUNCTION__ ) ; hidreport [ reportIndex ++ ] = ( UINT8 ) HID_REPORT_NUMLOCK ; } if ( changedlockstates & BTIF_HH_KEYSTATE_MASK_SCROLLLOCK ) { BTIF_TRACE_DEBUG ( "%s   Setting   SCROLLLOCK", __FUNCTION__ ) ; hidreport [ reportIndex ++ ] = ( UINT8 ) HID_REPORT_SCROLLLOCK ; } BTIF_TRACE_DEBUG ( "Writing   hidreport   #1   to   os:   " "%s:     %x   %x   %x", __FUNCTION__, hidreport [ 0 ], hidreport [ 1 ], hidreport [ 2 ] ) ; BTIF_TRACE_DEBUG ( "%s:     %x   %x   %x", __FUNCTION__, hidreport [ 3 ], hidreport [ 4 ], hidreport [ 5 ] ) ; BTIF_TRACE_DEBUG ( "%s:     %x   %x   %x", __FUNCTION__, hidreport [ 6 ], hidreport [ 7 ], hidreport [ 8 ] ) ; bta_hh_co_write ( fd, hidreport, sizeof ( hidreport ) ) ; <START_BUG> usleep ( 200000 ) ;<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 200000 )
Buggy code:
 static int rd_inter16x16_uv ( VP8_COMP * cpi, MACROBLOCK * x, int * rate, int * distortion, int fullpixel ) <START_BUG> { <END_BUG> vp8_build_inter16x16_predictors_mbuv ( & x -> e_mbd ) ; vp8_subtract_mbuv ( x -> src_diff, x -> src. u_buffer, x -> src. v_buffer, x -> src. uv_stride, & x -> e_mbd. predictor [ 256 ], & x -> e_mbd. predictor [ 320 ], 8 ) ; vp8_transform_mbuv ( x ) ; vp8_quantize_mbuv ( x ) ; * rate = rd_cost_mbuv ( x ) ; * distortion = vp8_mbuverror ( x ) // 4 ; return RDCOST ( x -> rdmult, x -> rddiv, * rate, * distortion ) ; }

Fix:
<S2SV_ModStart> fullpixel ) { ( void ) cpi ; ( void ) fullpixel ;
Buggy code:
 void freeClient ( redisClient * c ) { listNode * ln ; sdsfree ( c -> querybuf ) ; c -> querybuf = NULL ; if ( c -> flags & REDIS_BLOCKED ) unblockClientWaitingData ( c ) ; unwatchAllKeys ( c ) ; listRelease ( c -> watched_keys ) ; pubsubUnsubscribeAllChannels ( c, 0 ) ; pubsubUnsubscribeAllPatterns ( c, 0 ) ; dictRelease ( c -> pubsub_channels ) ; listRelease ( c -> pubsub_patterns ) ; aeDeleteFileEvent ( server. el, c -> fd, AE_READABLE ) ; aeDeleteFileEvent ( server. el, c -> fd, AE_WRITABLE ) ; listRelease ( c -> reply ) ; freeClientArgv ( c ) ; close ( c -> fd ) ; ln = listSearchKey ( server. clients, c ) ; redisAssert ( ln!= NULL ) ; listDelNode ( server. clients, ln ) ; if ( c -> flags & REDIS_IO_WAIT ) { <START_BUG> redisAssert ( server. vm_enabled ) ; <END_BUG> if ( listLength ( c -> io_keys ) == 0 ) { ln = listSearchKey ( server. io_ready_clients, c ) ; redisAssert ( ln!= NULL ) ; listDelNode ( server. io_ready_clients, ln ) ; } else { while ( listLength ( c -> io_keys ) ) { ln = listFirst ( c -> io_keys ) ; dontWaitForSwappedKey ( c, ln -> value ) ; } }  server. vm_blocked_clients -- ; <START_BUG> } listRelease ( c -> io_keys ) ; if ( c -> flags & REDIS_SLAVE ) { if ( c -> replstate == REDIS_REPL_SEND_BULK && c -> repldbfd!= - 1 ) close ( c -> repldbfd ) ; list * l = ( c -> flags & REDIS_MONITOR )? server. monitors : server. slaves ; ln = listSearchKey ( l, c ) ; redisAssert ( ln!= NULL ) ; listDelNode ( l, ln ) ; } if ( c -> flags & REDIS_MASTER ) { server. master = NULL ; server. replstate = REDIS_REPL_CONNECT ; while ( listLength ( server. slaves ) ) { ln = listFirst (<END_BUG>

Fix:
<S2SV_ModStart> ( server. ds_enabled <S2SV_ModEnd> ) ; if <S2SV_ModStart> } server. cache_blocked_clients <S2SV_ModEnd> -- ; }
Buggy code:
 static int br_mdb_dump ( struct sk_buff * skb, struct netlink_callback * cb ) { struct net_device * dev ; struct net * net = sock_net ( skb -> sk ) ; struct nlmsghdr * nlh = NULL ; int idx = 0, s_idx ; s_idx = cb -> args [ 0 ] ; rcu_read_lock ( ) ; cb -> seq = net -> dev_base_seq + br_mdb_rehash_seq ; for_each_netdev_rcu ( net, dev ) { if ( dev -> priv_flags & IFF_EBRIDGE ) { struct br_port_msg * bpm ; if ( idx < s_idx ) goto skip ; nlh = nlmsg_put ( skb, NETLINK_CB ( cb -> skb ). portid, cb -> nlh -> nlmsg_seq, RTM_GETMDB, sizeof ( * bpm ), NLM_F_MULTI ) ; if ( nlh == NULL ) break ; <START_BUG> bpm = nlmsg_data ( nlh ) ; <END_BUG> bpm -> ifindex = dev -> ifindex ; if ( br_mdb_fill_info ( skb, cb, dev ) < 0 ) goto out ; if ( br_rports_fill_info ( skb, cb, dev ) < 0 ) goto out ; cb -> args [ 1 ] = 0 ; nlmsg_end ( skb, nlh ) ; skip : idx ++ ; } } out : if ( nlh ) nlmsg_end ( skb, nlh ) ; rcu_read_unlock ( ) ; cb -> args [ 0 ] = idx ; return skb -> len ; }

Fix:
<S2SV_ModStart> nlmsg_data ( nlh ) ; memset ( bpm, 0, sizeof ( * bpm )
Buggy code:
 int context_init ( SERVICE_OPTIONS * section ) { # if OPENSSL_VERSION_NUMBER >= 0x10100000L if ( section -> option. client ) section -> ctx = SSL_CTX_new ( TLS_client_method ( ) ) ; else section -> ctx = SSL_CTX_new ( TLS_server_method ( ) ) ; if (! SSL_CTX_set_min_proto_version ( section -> ctx, section -> min_proto_version ) ) { s_log ( LOG_ERR, "Failed   to   set   the   minimum   protocol   version   0x%X", section -> min_proto_version ) ; return 1 ; } if (! SSL_CTX_set_max_proto_version ( section -> ctx, section -> max_proto_version ) ) { s_log ( LOG_ERR, "Failed   to   set   the   maximum   protocol   version   0x%X", section -> max_proto_version ) ; return 1 ; } # else if ( section -> option. client ) section -> ctx = SSL_CTX_new ( section -> client_method ) ; else section -> ctx = SSL_CTX_new ( section -> server_method ) ; # endif if (! section -> ctx ) { sslerror ( "SSL_CTX_new" ) ; return 1 ; } if (! SSL_CTX_set_ex_data ( section -> ctx, index_ssl_ctx_opt, section ) ) { sslerror ( "SSL_CTX_set_ex_data" ) ; return 1 ; } current_section = section ; <START_BUG> if ( section -> cipher_list ) { <END_BUG> s_log ( LOG_DEBUG, "Ciphers:   %s", section -> cipher_list ) ; if (! SSL_CTX_set_cipher_list ( section -> ctx, section -> cipher_list ) ) { sslerror ( "SSL_CTX_set_cipher_list" ) ; return 1 ; } } # ifndef OPENSSL_NO_TLS1_3 if ( section -> ciphersuites ) { s_log ( LOG_DEBUG, "TLSv1.3   ciphersuites:   %s", section -> ciphersuites ) ; if (! SSL_CTX_set_ciphersuites ( section ->

Fix:
<S2SV_ModStart> = section ; # if OPENSSL_VERSION_NUMBER >= 0x10100000L if ( section -> security_level >= 0 ) { SSL_CTX_set_security_level ( section -> ctx, section -> security_level ) ; s_log ( LOG_INFO, "User-specified <S2SV_blank> security <S2SV_blank> level <S2SV_blank> set: <S2SV_blank> %d", section -> security_level ) ; } else if ( SSL_CTX_get_security_level ( section -> ctx ) < DEFAULT_SECURITY_LEVEL ) { SSL_CTX_set_security_level ( section -> ctx, DEFAULT_SECURITY_LEVEL ) ; s_log ( LOG_INFO, "stunnel <S2SV_blank> default <S2SV_blank> security <S2SV_blank> level <S2SV_blank> set: <S2SV_blank> %d", DEFAULT_SECURITY_LEVEL ) ; } else { s_log ( LOG_INFO, "OpenSSL <S2SV_blank> security <S2SV_blank> level <S2SV_blank> is <S2SV_blank> used: <S2SV_blank> %d", SSL_CTX_get_security_level ( section -> ctx ) ) ; } # endif <S2SV_ModStart> return 1 ; # ifndef OPENSSL_NO_TLSEXT <S2SV_ModStart>. client ) <S2SV_ModEnd> SSL_CTX_set_tlsext_servername_callback ( section <S2SV_ModStart> ; # endif <S2SV_ModEnd>
Buggy code:
 static void nodeDestruct ( struct SaveNode * node ) { <START_BUG> if ( node -> v == & node -> sorted ) <END_BUG> {  tr_free ( node -> sorted. val. l. vals ) ; <START_BUG> <END_BUG> }  }

Fix:
<S2SV_ModStart> node ) { TR_ASSERT ( node!= NULL ) ; <S2SV_ModStart> ( node -> sorted!= NULL <S2SV_ModEnd> ) { tr_free <S2SV_ModStart> node -> sorted -> <S2SV_ModEnd> val. l <S2SV_ModStart> vals ) ; tr_free ( node -> sorted ) ;
Buggy code:
 bool_t mqttSnClientIsShortTopicName ( const char_t * topicName ) { bool_t res ; res = FALSE ; if ( osStrlen ( topicName ) == 2 ) { <START_BUG> if ( strchr ( topicName, '#' ) == NULL && strchr ( topicName, '+' ) == NULL ) <END_BUG> { res = TRUE ; } } return res ; }

Fix:
<S2SV_ModStart> { if ( osStrchr <S2SV_ModEnd> ( topicName, <S2SV_ModStart> == NULL && osStrchr <S2SV_ModEnd> ( topicName,
Buggy code:
 static int ttusbdecfe_dvbs_diseqc_send_master_cmd ( struct dvb_frontend * fe, struct dvb_diseqc_master_cmd * cmd ) { struct ttusbdecfe_state * state = ( struct ttusbdecfe_state * ) fe -> demodulator_priv ; u8 b [ ] = { 0x00, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } ; <START_BUG> memcpy ( & b [ 4 ], cmd -> msg, cmd -> msg_len ) ; <END_BUG> state -> config -> send_command ( fe, 0x72, sizeof ( b ) - ( 6 - cmd -> msg_len ), b, NULL, NULL ) ; return 0 ; }

Fix:
<S2SV_ModStart> 0x00 } ; if ( cmd -> msg_len > sizeof ( b ) - 4 ) return - EINVAL ;
Buggy code:
 static int dtls1_buffer_record ( SSL * s, record_pqueue * queue, unsigned char * priority ) { DTLS1_RECORD_DATA * rdata ; pitem * item ; if ( pqueue_size ( queue -> q ) >= 100 ) return 0 ; rdata = OPENSSL_malloc ( sizeof ( DTLS1_RECORD_DATA ) ) ; item = pitem_new ( priority, rdata ) ; if ( rdata == NULL || item == NULL ) { if ( rdata!= NULL ) OPENSSL_free ( rdata ) ; if ( item!= NULL ) pitem_free ( item ) ; SSLerr ( SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR ) ; return ( 0 ) ; } rdata -> packet = s -> packet ; rdata -> packet_length = s -> packet_length ; memcpy ( & ( rdata -> rbuf ), & ( s -> s3 -> rbuf ), sizeof ( SSL3_BUFFER ) ) ; memcpy ( & ( rdata -> rrec ), & ( s -> s3 -> rrec ), sizeof ( SSL3_RECORD ) ) ; item -> data = rdata ; # ifndef OPENSSL_NO_SCTP if ( BIO_dgram_is_sctp ( SSL_get_rbio ( s ) ) && ( s -> state == SSL3_ST_SR_FINISHED_A || s -> state == SSL3_ST_CR_FINISHED_A ) ) { BIO_ctrl ( SSL_get_rbio ( s ), BIO_CTRL_DGRAM_SCTP_GET_RCVINFO, sizeof ( rdata -> recordinfo ), & rdata -> recordinfo ) ; } # endif s -> packet = NULL ; s -> packet_length = 0 ; memset ( & ( s -> s3 -> rbuf ), 0, sizeof ( SSL3_BUFFER ) ) ; memset ( & ( s -> s3 -> rrec ), 0, sizeof ( SSL3_RECORD ) ) ; if (! ssl3_setup_buffers ( s ) ) { SSLerr ( SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR ) ; <START_BUG> OPENSSL_free ( rdata ) ; <END_BUG> pitem_free ( item ) ;  return ( 0 ) ; <START_BUG> } if ( pqueue<END_BUG>

Fix:
<S2SV_ModStart> ERR_R_INTERNAL_ERROR ) ; if ( rdata -> rbuf. buf!= NULL ) <S2SV_ModStart> OPENSSL_free ( rdata -> rbuf. buf ) ; OPENSSL_free ( rdata <S2SV_ModStart> ; return ( - 1 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ERR_R_INTERNAL_ERROR ) ; if ( rdata -> rbuf. buf!= NULL ) <S2SV_ModStart> OPENSSL_free ( rdata -> rbuf. buf ) ; OPENSSL_free ( rdata <S2SV_ModStart> ; return ( - 1 <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> static void estimate_ref_frame_costs ( VP9_COMP * cpi, int segment_id, <END_BUG> unsigned int * ref_costs_single, unsigned int * ref_costs_comp,  vp9_prob * comp_mode_p ) { <START_BUG> <END_BUG> VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; int seg_ref_active = vp9_segfeature_active ( & cm -> seg, segment_id, SEG_LVL_REF_FRAME ) ; if ( seg_ref_active ) { vpx_memset ( ref_costs_single, 0, MAX_REF_FRAMES * sizeof ( * ref_costs_single ) ) ; <START_BUG> vpx_memset ( ref_costs_comp, 0, MAX_REF_FRAMES * sizeof ( * ref_costs_comp ) ) ; <END_BUG> * comp_mode_p = 128 ; } else {  vp9_prob intra_inter_p = vp9_get_intra_inter_prob ( cm, xd ) ; <START_BUG> <END_BUG> vp9_prob comp_inter_p = 128 ;  if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) { comp_inter_p = vp9_get_reference_mode_prob ( cm, xd ) ; * comp_mode_p = comp_inter_p ; } else { * comp_mode_p = 128 ; } ref_costs_single [ INTRA_FRAME ] = vp9_cost_bit ( intra_inter_p, 0 ) ; if ( cm -> reference_mode!= COMPOUND_REFERENCE ) { <START_BUG> vp9_prob ref_single_p1 = vp9_get_pred_prob_single_ref_p1 ( cm, xd ) ; <END_BUG>  vp9_prob ref_single_p2 = vp9_get_pred_prob_single_ref_p2 ( cm, xd ) ; <START_BUG> unsigned int base_cost = vp9_cost_bit ( intra_inter_p, 1 ) ; if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) base_cost += vp9_cost_bit ( comp_inter_p, 0 ) ; ref_costs_single<END_BUG>

Fix:
<S2SV_ModStart> void estimate_ref_frame_costs ( const VP9_COMMON * cm, const MACROBLOCKD * xd, <S2SV_ModEnd> int segment_id, <S2SV_ModStart> * ref_costs_comp, vpx_prob <S2SV_ModEnd> * comp_mode_p ) <S2SV_ModStart> comp_mode_p ) { int seg_ref_active = segfeature_active ( & cm -> seg, segment_id, SEG_LVL_REF_FRAME ) ; if ( seg_ref_active ) { memset <S2SV_ModEnd> ( ref_costs_single, <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( ref_costs_comp, <S2SV_ModStart> } else { vpx_prob <S2SV_ModEnd> intra_inter_p = vp9_get_intra_inter_prob <S2SV_ModStart> xd ) ; vpx_prob <S2SV_ModEnd> comp_inter_p = 128 <S2SV_ModStart> COMPOUND_REFERENCE ) { vpx_prob <S2SV_ModEnd> ref_single_p1 = vp9_get_pred_prob_single_ref_p1 <S2SV_ModStart> xd ) ; vpx_prob <S2SV_ModEnd> ref_single_p2 = vp9_get_pred_prob_single_ref_p2 <S2SV_ModStart> SINGLE_REFERENCE ) { vpx_prob <S2SV_ModEnd> ref_comp
Buggy code:
 int iwch_cxgb3_ofld_send ( struct t3cdev * tdev, struct sk_buff * skb ) { int error = 0 ; struct cxio_rdev * rdev ; rdev = ( struct cxio_rdev * ) tdev -> ulp ; if ( cxio_fatal_error ( rdev ) ) { kfree_skb ( skb ) ; return - EIO ; } error = cxgb3_ofld_send ( tdev, skb ) ; if ( error < 0 ) kfree_skb ( skb ) ; <START_BUG> return error ; <END_BUG> }

Fix:
<S2SV_ModStart> ; return error < 0? error : 0
Buggy code:
 <START_BUG> void vp9_tokenize_sb ( VP9_COMP * cpi, TOKENEXTRA * * t, int dry_run, <END_BUG> BLOCK_SIZE bsize ) { VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; <START_BUG> <END_BUG> MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ;  TOKENEXTRA * t_backup = * t ; const int ctx = vp9_get_skip_context ( xd ) ; <START_BUG> const int skip_inc =! vp9_segfeature_active ( & cm -> seg, mbmi -> segment_id, <END_BUG> SEG_LVL_SKIP ) ;  struct tokenize_b_args arg = { cpi, xd, t } ; <START_BUG> if ( mbmi -> skip ) { if (! dry_run ) <END_BUG> cm -> counts. skip [ ctx ] [ 1 ] += skip_inc ;  reset_skip_context ( xd, bsize ) ; <START_BUG> if ( dry_run ) <END_BUG> * t = t_backup ; return ; } if (! dry_run ) {  cm -> counts. skip [ ctx ] [ 0 ] += skip_inc ; <START_BUG> vp9_foreach_transformed_block ( xd, bsize, tokenize_b, & arg ) ; } else { vp9_foreach_transformed_block ( xd, bsize, set_entropy_context_b, & arg ) ; <END_BUG> * t = t_backup ;  } }

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, <S2SV_ModStart> -> common ; MACROBLOCK * const x = & td -> mb ; <S2SV_ModStart> xd = & x -> <S2SV_ModEnd> e_mbd ; MB_MODE_INFO <S2SV_ModStart> ] -> mbmi <S2SV_ModEnd> ; const int <S2SV_ModStart> skip_inc =! segfeature_active <S2SV_ModEnd> ( & cm <S2SV_ModStart> { cpi, td <S2SV_ModEnd>, t } <S2SV_ModStart>! dry_run ) td -> counts -> <S2SV_ModEnd> skip [ ctx <S2SV_ModStart> bsize ) ; <S2SV_ModEnd> return ; } <S2SV_ModStart> dry_run ) { td -> counts -> <S2SV_ModEnd> skip [ ctx <S2SV_ModStart> arg ) ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 void vrrp_print_data ( void ) { <START_BUG> FILE * file = fopen ( dump_file, "w" ) ; <END_BUG> if (! file ) { log_message ( LOG_INFO, "Can\'t   open   %s   (%d:   %s)", dump_file, errno, strerror ( errno ) ) ; return ; } dump_data_vrrp ( file ) ; fclose ( file ) ; }

Fix:
<S2SV_ModStart> * file = fopen_safe <S2SV_ModEnd> ( dump_file,
Buggy code:
 char * curl_easy_escape ( CURL * handle, const char * string, int inlength ) { size_t alloc = ( inlength? ( size_t ) inlength : strlen ( string ) ) + 1 ; char * ns ; char * testing_ptr = NULL ; unsigned char in ; size_t newlen = alloc ; <START_BUG> int strindex = 0 ; <END_BUG> size_t length ; CURLcode res ; ns = malloc ( alloc ) ; if (! ns ) return NULL ; length = alloc - 1 ; while ( length -- ) { in = * string ; if ( Curl_isunreserved ( in ) ) ns [ strindex ++ ] = in ; else { newlen += 2 ; if ( newlen > alloc ) { alloc *= 2 ; testing_ptr = realloc ( ns, alloc ) ; if (! testing_ptr ) { free ( ns ) ; return NULL ; } else { ns = testing_ptr ; } } res = Curl_convert_to_network ( handle, & in, 1 ) ; if ( res ) { free ( ns ) ; return NULL ; } snprintf ( & ns [ strindex ], 4, "%%%02X", in ) ; strindex += 3 ; } string ++ ; } ns [ strindex ] = 0 ; return ns ; }

Fix:
<S2SV_ModStart> = alloc ; size_t <S2SV_ModEnd> strindex = 0
Buggy code:
 EAPI_MAIN int elm_main ( int argc, char * argv [ ] ) { int args = 1 ; unsigned char quitOption = 0 ; <START_BUG> Browser_Window * window ; <END_BUG> Ecore_Getopt_Value values [ ] = { ECORE_GETOPT_VALUE_STR ( evas_engine_name ),  ECORE_GETOPT_VALUE_BOOL ( quitOption ), <START_BUG> ECORE_GETOPT_VALUE_BOOL ( frame_flattening_enabled ), ECORE_GETOPT_VALUE_BOOL ( quitOption ), ECORE_GETOPT_VALUE_BOOL ( quitOption ), ECORE_GETOPT_VALUE_BOOL ( quitOption ), ECORE_GETOPT_VALUE_NONE } ; if (! ewk_init ( ) ) return EXIT_FAILURE ; ewk_view_smart_class_set ( miniBrowserViewSmartClass ( ) ) ; ecore_app_args_set ( argc, ( const char * * ) argv ) ; args = ecore_getopt_parse ( & options, values, argc, argv ) ; if ( args < 0 ) return quit ( EINA_FALSE, "ERROR:   could   not   parse   options.\\n" ) ; if ( quitOption ) return quit ( EINA_TRUE, NULL ) ; if ( evas_engine_name ) elm_config_preferred_engine_set ( evas_engine_name ) ; # if defined ( WTF_USE_ACCELERATED_COMPOSITING ) && defined ( HAVE_ECORE_X ) else { evas_engine_name = "opengl_x11" ; elm_config_preferred_engine_set ( evas_engine_name ) ; } # endif Ewk_Context * context = ewk_context_default_get ( ) ; ewk_context_favicon_database_directory_set ( context, NULL ) ; <END_BUG> if ( args < argc ) {  char * url = url_from_user_input ( argv [ args ] ) ; window = window_create ( url ) ; free ( url ) ; } else window = window_create ( DEFAULT_URL ) ; if (! window ) return quit ( EINA_FALSE, "ERROR:   could   not   create   browser   window.\\n" ) ; windows = eina_

Fix:
<S2SV_ModStart> Browser_Window * window ; char * window_size_string = NULL <S2SV_ModStart> evas_engine_name ), ECORE_GETOPT_VALUE_STR ( window_size_string ), <S2SV_ModStart> ; if ( window_size_string ) parse_window_size ( window_size_string, & window_width, & window_height ) ; if (
Buggy code:
 static void regulator_ena_gpio_free ( struct regulator_dev * rdev ) { struct regulator_enable_gpio * pin, * n ; if (! rdev -> ena_pin ) return ; list_for_each_entry_safe ( pin, n, & regulator_ena_gpio_list, list ) { if ( pin -> gpiod == rdev -> ena_pin -> gpiod ) { if ( pin -> request_count <= 1 ) { pin -> request_count = 0 ; gpiod_put ( pin -> gpiod ) ; list_del ( & pin -> list ) ; kfree ( pin ) ; <START_BUG> } else { <END_BUG> pin -> request_count -- ; } } } }

Fix:
<S2SV_ModStart> pin ) ; rdev -> ena_pin = NULL ; return ;
Buggy code:
 static int archive_read_format_cpio_read_header ( struct archive_read * a, struct archive_entry * entry ) { struct cpio * cpio ; const void * h ; struct archive_string_conv * sconv ; size_t namelength ; size_t name_pad ; int r ; cpio = ( struct cpio * ) ( a -> format -> data ) ; sconv = cpio -> opt_sconv ; if ( sconv == NULL ) { if (! cpio -> init_default_conversion ) { cpio -> sconv_default = archive_string_default_conversion_for_read ( & ( a -> archive ) ) ; cpio -> init_default_conversion = 1 ; } sconv = cpio -> sconv_default ; } r = ( cpio -> read_header ( a, cpio, entry, & namelength, & name_pad ) ) ; if ( r < ARCHIVE_WARN ) return ( r ) ; h = __archive_read_ahead ( a, namelength + name_pad, NULL ) ; if ( h == NULL ) return ( ARCHIVE_FATAL ) ; if ( archive_entry_copy_pathname_l ( entry, ( const char * ) h, namelength, sconv )!= 0 ) { if ( errno == ENOMEM ) { archive_set_error ( & a -> archive, ENOMEM, "Can\'t   allocate   memory   for   Pathname" ) ; return ( ARCHIVE_FATAL ) ; } archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Pathname   can\'t   be   converted   from   %s   to   current   locale.", archive_string_conversion_charset_name ( sconv ) ) ; r = ARCHIVE_WARN ; } cpio -> entry_offset = 0 ; __archive_read_consume ( a, namelength + name_pad ) ; if ( archive_entry_filetype ( entry ) == AE_IFLNK ) { <START_BUG> h = __archive_read_ahead ( a, <END_BUG> ( size_t ) cpio -> entry_bytes_remaining, NULL ) ; if ( h == NULL ) return ( ARCHIVE_FATAL ) ; if ( archive_entry_copy_symlink_l

Fix:
<S2SV_ModStart> AE_IFLNK ) { if ( cpio -> entry_bytes_remaining > 1024 * 1024 ) { archive_set_error ( & a -> archive, ENOMEM, "Rejecting <S2SV_blank> malformed <S2SV_blank> cpio <S2SV_blank> archive: <S2SV_blank> symlink <S2SV_blank> contents <S2SV_blank> exceed <S2SV_blank> 1 <S2SV_blank> megabyte" ) ; return ( ARCHIVE_FATAL ) ; }