nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> int get_vp9_frame_buffer ( void * cb_priv, size_t min_size, <END_BUG> vpx_codec_frame_buffer_t * fb ) { int i ; struct ExternalFrameBufferList * const ext_fb_list = ( struct ExternalFrameBufferList * ) cb_priv ; if ( ext_fb_list == NULL ) return - 1 ; for ( i = 0 ; i < ext_fb_list -> num_external_frame_buffers ; ++ i ) { if (! ext_fb_list -> ext_fb [ i ]. in_use ) break ; } if ( i == ext_fb_list -> num_external_frame_buffers ) return - 1 ; if ( ext_fb_list -> ext_fb [ i ]. size < min_size ) { free ( ext_fb_list -> ext_fb [ i ]. data ) ;  ext_fb_list -> ext_fb [ i ]. data = ( uint8_t * ) malloc ( min_size ) ; <START_BUG> if (! ext_fb_list -> ext_fb [ i ]. data ) return - 1 ; ext_fb_list -> ext_fb [ i ]. size = min_size ; } fb -> data = ext_fb_list -> ext_fb [ i ]. data ; fb -> size = ext_fb_list -> ext_fb [ i ]. size ; ext_fb_list -> ext_fb [ i ]. in_use = 1 ; fb -> priv = & ext_fb_list -> ext_fb [ i ] ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> uint8_t * ) calloc ( min_size, sizeof ( uint8_t ) <S2SV_ModEnd> ) ; if
Buggy code:
 static int prepare_vmcs02 ( struct kvm_vcpu * vcpu, struct vmcs12 * vmcs12, bool from_vmentry, u32 * entry_failure_code ) { struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; u32 exec_control, vmcs12_exec_ctrl ; vmcs_write16 ( GUEST_ES_SELECTOR, vmcs12 -> guest_es_selector ) ; vmcs_write16 ( GUEST_CS_SELECTOR, vmcs12 -> guest_cs_selector ) ; vmcs_write16 ( GUEST_SS_SELECTOR, vmcs12 -> guest_ss_selector ) ; vmcs_write16 ( GUEST_DS_SELECTOR, vmcs12 -> guest_ds_selector ) ; vmcs_write16 ( GUEST_FS_SELECTOR, vmcs12 -> guest_fs_selector ) ; vmcs_write16 ( GUEST_GS_SELECTOR, vmcs12 -> guest_gs_selector ) ; vmcs_write16 ( GUEST_LDTR_SELECTOR, vmcs12 -> guest_ldtr_selector ) ; vmcs_write16 ( GUEST_TR_SELECTOR, vmcs12 -> guest_tr_selector ) ; vmcs_write32 ( GUEST_ES_LIMIT, vmcs12 -> guest_es_limit ) ; vmcs_write32 ( GUEST_CS_LIMIT, vmcs12 -> guest_cs_limit ) ; vmcs_write32 ( GUEST_SS_LIMIT, vmcs12 -> guest_ss_limit ) ; vmcs_write32 ( GUEST_DS_LIMIT, vmcs12 -> guest_ds_limit ) ; vmcs_write32 ( GUEST_FS_LIMIT, vmcs12 -> guest_fs_limit ) ; vmcs_write32 ( GUEST_GS_LIMIT, vmcs12 -> guest_gs_limit ) ; vmcs_write32 ( GUEST_LDTR_LIMIT, vmcs12 -> guest_ldtr_limit ) ; vmcs_write32 ( GUEST_TR_LIMIT, vmcs12 -> guest_tr_limit ) ; vmcs_write32 ( GUEST_GDTR_LIMIT, vmcs12

Fix:
<S2SV_ModStart> tpr_threshold ) ; } else { # ifdef CONFIG_X86_64 exec_control |= CPU_BASED_CR8_LOAD_EXITING | CPU_BASED_CR8_STORE_EXITING ; # endif
Buggy code:
 <START_BUG> static bool new_idmap_permitted ( struct user_namespace * ns, int cap_setid, <END_BUG> struct uid_gid_map * new_map ) { if ( ( new_map -> nr_extents == 1 ) && ( new_map -> extent [ 0 ]. count == 1 ) ) { u32 id = new_map -> extent [ 0 ]. lower_first ; if ( cap_setid == CAP_SETUID ) { kuid_t uid = make_kuid ( ns -> parent, id ) ; if ( uid_eq ( uid, current_fsuid ( ) ) ) return true ; } else if ( cap_setid == CAP_SETGID ) { kgid_t gid = make_kgid ( ns -> parent, id ) ; if ( gid_eq ( gid, current_fsgid ( ) ) ) return true ; } } if (! cap_valid ( cap_setid ) ) return true ;  if ( ns_capable ( ns -> parent, cap_setid ) ) <START_BUG> return true ; return false ; }<END_BUG>

Fix:
<S2SV_ModStart> bool new_idmap_permitted ( const struct file * file, <S2SV_ModStart>, cap_setid ) && file_ns_capable ( file, ns -> parent, cap_setid )
Buggy code:
 RD_BOOL <START_BUG> ber_parse_header ( STREAM s, int tagval, int * length ) <END_BUG> { int tag, len ; if ( tagval > 0xff ) { in_uint16_be ( s, tag ) ; } else { in_uint8 ( s, tag ) ; } if ( tag!= tagval ) { logger ( Core, Error, "ber_parse_header(),   expected   tag   %d,   got   %d", tagval, tag ) ; return False ; } in_uint8 ( s, len ) ; if ( len & 0x80 ) { len &= ~ 0x80 ; * length = 0 ; while ( len -- ) next_be ( s, * length ) ; } else * length = len ; return s_check ( s ) ; }

Fix:
<S2SV_ModStart> int tagval, uint32 <S2SV_ModEnd> * length )
Buggy code:
 <START_BUG> static int can_open_cached ( struct nfs4_state * state, int mode ) <END_BUG> { int ret = 0 ;  switch ( mode & ( FMODE_READ | FMODE_WRITE | O_EXCL ) ) { <START_BUG> case FMODE_READ : ret |= test_bit ( NFS_O_RDONLY_STATE, & state -> flags )!= 0 ; break ; case FMODE_WRITE : ret |= test_bit ( NFS_O_WRONLY_STATE, & state -> flags )!= 0 ; break ; case FMODE_READ | FMODE_WRITE : ret |= test_bit ( NFS_O_RDWR_STATE, & state -> flags )!= 0 ; } <END_BUG> return ret ;  }

Fix:
<S2SV_ModStart> * state, fmode_t mode, int open_mode <S2SV_ModEnd> ) { int <S2SV_ModStart> = 0 ; if ( open_mode & O_EXCL ) goto out ; <S2SV_ModStart> FMODE_READ | FMODE_WRITE <S2SV_ModEnd> ) ) { <S2SV_ModStart> 0 ; } out :
Buggy code:
 static int klsi_105_get_line_state ( struct usb_serial_port * port, unsigned long * line_state_p ) { int rc ; u8 * status_buf ; __u16 status ; dev_info ( & port -> serial -> dev -> dev, "sending   SIO   Poll   request\\n" ) ; status_buf = kmalloc ( KLSI_STATUSBUF_LEN, GFP_KERNEL ) ; if (! status_buf ) return - ENOMEM ; status_buf [ 0 ] = 0xff ; status_buf [ 1 ] = 0xff ; rc = usb_control_msg ( port -> serial -> dev, usb_rcvctrlpipe ( port -> serial -> dev, 0 ), KL5KUSB105A_SIO_POLL, USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, status_buf, KLSI_STATUSBUF_LEN, 10000 ) ; <START_BUG> if ( rc < 0 ) <END_BUG>  dev_err ( & port -> dev, "Reading   line   status   failed   (error   =   %d)\\n", <START_BUG> rc ) ; else { status = get_unaligned_le16 ( status_buf ) ; dev_info ( & port -> serial -> dev -> dev, "read   status   %x   %x\\n", status_buf [ 0 ], status_buf [ 1 ] ) ; * line_state_p = klsi_105_status2linestate ( status ) ; } kfree ( status_buf ) ; return rc ; }<END_BUG>

Fix:
<S2SV_ModStart> if ( rc!= KLSI_STATUSBUF_LEN ) { <S2SV_ModEnd> dev_err ( & <S2SV_ModStart> -> dev, "reading <S2SV_blank> line <S2SV_blank> status <S2SV_blank> failed: <S2SV_blank> %d\\n", rc ) ; if ( rc >= 0 ) rc = - EIO ; } <S2SV_ModEnd> else { status
Buggy code:
 long keyctl_read_key ( key_serial_t keyid, char __user * buffer, size_t buflen ) { struct key * key ; key_ref_t key_ref ; long ret ; key_ref = lookup_user_key ( keyid, 0, 0 ) ; if ( IS_ERR ( key_ref ) ) { ret = - ENOKEY ; goto error ; } key = key_ref_to_ptr ( key_ref ) ; <START_BUG> if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) { <END_BUG> ret = - ENOKEY ; goto error2 ; } ret = key_permission ( key_ref, KEY_NEED_READ ) ; if ( ret == 0 ) goto can_read_key ; if ( ret!= - EACCES ) goto error2 ; if (! is_key_possessed ( key_ref ) ) { ret = - EACCES ; goto error2 ; } can_read_key : ret = - EOPNOTSUPP ; if ( key -> type -> read ) { down_read ( & key -> sem ) ; ret = key_validate ( key ) ; if ( ret == 0 ) ret = key -> type -> read ( key, buffer, buflen ) ; up_read ( & key -> sem ) ; } error2 : key_put ( key ) ; error : return ret ; }

Fix:
<S2SV_ModStart> key_ref ) ; ret = key_read_state ( key ) ; if ( ret < 0 ) goto error2 ; <S2SV_ModEnd> ret = key_permission
Buggy code:
 static int n_tty_ioctl ( struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg ) { struct n_tty_data * ldata = tty -> disc_data ; int retval ; switch ( cmd ) { case TIOCOUTQ : return put_user ( tty_chars_in_buffer ( tty ), ( int __user * ) arg ) ; case TIOCINQ : down_write ( & tty -> termios_rwsem ) ; <START_BUG> if ( L_ICANON ( tty ) ) <END_BUG> retval = inq_canon ( ldata ) ; else retval = read_cnt ( ldata ) ; up_write ( & tty -> termios_rwsem ) ; return put_user ( retval, ( unsigned int __user * ) arg ) ; default : return n_tty_ioctl_helper ( tty, file, cmd, arg ) ; } }

Fix:
<S2SV_ModStart> ( tty ) &&! L_EXTPROC ( tty )
Buggy code:
 static int orinoco_ioctl_set_auth ( struct net_device * dev, struct iw_request_info * info, union iwreq_data * wrqu, char * extra ) { struct orinoco_private * priv = ndev_priv ( dev ) ; hermes_t * hw = & priv -> hw ; struct iw_param * param = & wrqu -> param ; unsigned long flags ; int ret = - EINPROGRESS ; if ( orinoco_lock ( priv, & flags )!= 0 ) return - EBUSY ; switch ( param -> flags & IW_AUTH_INDEX ) { case IW_AUTH_WPA_VERSION : case IW_AUTH_CIPHER_PAIRWISE : case IW_AUTH_CIPHER_GROUP : case IW_AUTH_RX_UNENCRYPTED_EAPOL : case IW_AUTH_PRIVACY_INVOKED : case IW_AUTH_DROP_UNENCRYPTED : break ; case IW_AUTH_KEY_MGMT : priv -> key_mgmt = param -> value ; break ; case IW_AUTH_TKIP_COUNTERMEASURES : if ( param -> value ) { priv -> tkip_cm_active = 1 ; <START_BUG> ret = hermes_enable_port ( hw, 0 ) ; <END_BUG> } else { priv -> tkip_cm_active = 0 ; ret = hermes_disable_port ( hw, 0 ) ; } break ; case IW_AUTH_80211_AUTH_ALG : if ( param -> value & IW_AUTH_ALG_SHARED_KEY ) priv -> wep_restrict = 1 ; else if ( param -> value & IW_AUTH_ALG_OPEN_SYSTEM ) priv -> wep_restrict = 0 ; else ret = - EINVAL ; break ; case IW_AUTH_WPA_ENABLED : if ( priv -> has_wpa ) { priv -> wpa_enabled = param -> value? 1 : 0 ; } else { if ( param -> value ) ret = - EOPNOTSUPP ; priv -> wpa_enabled = 0 ; } break ; default : ret = - EOPNOTSUPP ; } orinoco_unlock ( priv, & flags ) ; return ret ; }

Fix:
<S2SV_ModStart> ; ret = hermes_disable_port ( hw, 0 ) ; } else { priv -> tkip_cm_active = 0 ; ret = hermes_enable_port <S2SV_ModEnd> ( hw,
Buggy code:
 static int unix_dgram_connect ( struct socket * sock, struct sockaddr * addr, int alen, int flags ) { struct sock * sk = sock -> sk ; struct net * net = sock_net ( sk ) ; struct sockaddr_un * sunaddr = ( struct sockaddr_un * ) addr ; struct sock * other ; unsigned int hash ; int err ; if ( addr -> sa_family!= AF_UNSPEC ) { err = unix_mkname ( sunaddr, alen, & hash ) ; if ( err < 0 ) goto out ; alen = err ; if ( test_bit ( SOCK_PASSCRED, & sock -> flags ) &&! unix_sk ( sk ) -> addr && ( err = unix_autobind ( sock ) )!= 0 ) goto out ; restart : other = unix_find_other ( net, sunaddr, alen, sock -> type, hash, & err ) ; if (! other ) goto out ; unix_state_double_lock ( sk, other ) ; if ( sock_flag ( other, SOCK_DEAD ) ) { unix_state_double_unlock ( sk, other ) ; sock_put ( other ) ; goto restart ; } err = - EPERM ; if (! unix_may_send ( sk, other ) ) goto out_unlock ; err = security_unix_may_send ( sk -> sk_socket, other -> sk_socket ) ; if ( err ) goto out_unlock ; } else { other = NULL ; unix_state_double_lock ( sk, other ) ; } if ( unix_peer ( sk ) ) { struct sock * old_peer = unix_peer ( sk ) ; unix_peer ( sk ) = other ; <START_BUG> unix_state_double_unlock ( sk, other ) ; <END_BUG> if ( other!= old_peer ) unix_dgram_disconnected ( sk, old_peer ) ; sock_put ( old_peer ) ; } else { unix_peer ( sk ) = other ; unix_state_double_unlock ( sk, other ) ; } return 0 ; out_unlock : unix_state_double_unlock ( sk, other ) ; sock_put ( other ) ; out : return err ; }

Fix:
<S2SV_ModStart> = other ; unix_dgram_peer_wake_disconnect_wakeup ( sk, old_peer ) ;
Buggy code:
 static MagickBooleanType ReadUncompressedRGBA ( Image * image, DDSInfo * dds_info, ExceptionInfo * exception ) { PixelPacket * q ; ssize_t alphaBits, x, y ; unsigned short color ; alphaBits = 0 ; if ( dds_info -> pixelformat. rgb_bitcount == 16 ) { if ( IsBitMask ( dds_info -> pixelformat, 0x7c00, 0x03e0, 0x001f, 0x8000 ) ) alphaBits = 1 ; else if ( IsBitMask ( dds_info -> pixelformat, 0x00ff, 0x00ff, 0x00ff, 0xff00 ) ) { alphaBits = 2 ; ( void ) SetImageType ( image, GrayscaleMatteType ) ; } else if ( IsBitMask ( dds_info -> pixelformat, 0x0f00, 0x00f0, 0x000f, 0xf000 ) ) alphaBits = 4 ; else ThrowBinaryException ( CorruptImageError, "ImageTypeNotSupported", image -> filename ) ; } for ( y = 0 ; y < ( ssize_t ) dds_info -> height ; y ++ ) { q = QueueAuthenticPixels ( image, 0, y, dds_info -> width, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) return MagickFalse ; for ( x = 0 ; x < ( ssize_t ) dds_info -> width ; x ++ ) { if ( dds_info -> pixelformat. rgb_bitcount == 16 ) { color = ReadBlobShort ( image ) ; if ( alphaBits == 1 ) { SetPixelAlpha ( q, ( color & ( 1 << 15 ) )? QuantumRange : 0 ) ; SetPixelRed ( q, ScaleCharToQuantum ( ( unsigned char ) ( ( ( ( unsigned short ) ( color << 1 ) >> 11 ) // 31.0 ) * 255 ) ) ) ; SetPixelGreen ( q, ScaleCharToQuantum ( ( unsigned char ) ( ( ( ( unsigned short ) ( color << 6 ) >> 11 ) // 31.0 ) * 255 ) ) ) ; SetPixelBlue ( q, ScaleCharToQuantum ( ( unsigned char ) ( ( ( ( unsigned short ) ( color << 11 ) >> 11 ) // 31.0 ) *

Fix:
<S2SV_ModStart> MagickFalse ; } return ( <S2SV_ModStart> dds_info, 4, exception ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 <START_BUG> void open_input_file ( struct VpxInputContext * input ) { <END_BUG> input -> file = strcmp ( input -> filename, "-" )? fopen ( input -> filename, "rb" ) : set_binary_mode ( stdin ) ; if (! input -> file ) fatal ( "Failed   to   open   input   file" ) ; if (! fseeko ( input -> file, 0, SEEK_END ) ) { input -> length = ftello ( input -> file ) ; rewind ( input -> file ) ; }  input -> detect. buf_read = fread ( input -> detect. buf, 1, 4, input -> file ) ; <START_BUG> input -> detect. position = 0 ; if ( input -> detect. buf_read == 4 && file_is_y4m ( input -> detect. buf ) ) { if ( y4m_input_open ( & input -> y4m, input -> file, input -> detect. buf, 4, input -> only_i420 ) >= 0 ) { input -> file_type = FILE_TYPE_Y4M ; input -> width = input -> y4m. pic_w ; input -> height = input -> y4m. pic_h ; <END_BUG> input -> framerate. numerator = input -> y4m. fps_n ;  input -> framerate. denominator = input -> y4m. fps_d ; <START_BUG> input -> use_i420 = 0 ; <END_BUG> } else fatal ( "Unsupported   Y4M   stream." ) ; } else if ( input -> detect. buf_read == 4 && fourcc_is_ivf ( input -> detect. buf ) ) { fatal ( "IVF   is   not   supported   as   input." ) ; } else { input -> file_type = FILE_TYPE_RAW ; } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> } input -> pixel_aspect_ratio. numerator = 1 ; input -> pixel_aspect_ratio. denominator = 1 ; input -> <S2SV_ModStart> ; input -> pixel_aspect_ratio. numerator = input -> y4m. par_n ; input -> pixel_aspect_ratio. denominator = input -> y4m. par_d ; input -> <S2SV_ModStart> ; input -> fmt = input -> y4m. vpx_fmt ; input -> bit_depth = input -> y4m. bit_depth <S2SV_ModEnd> ; } else
Buggy code:
 void vp9_loop_filter_init ( VP9_COMMON * cm ) { loop_filter_info_n * lfi = & cm -> lf_info ; struct loopfilter * lf = & cm -> lf ; int lvl ; update_sharpness ( lfi, lf -> sharpness_level ) ; lf -> last_sharpness_level = lf -> sharpness_level ; for ( lvl = 0 ; lvl <= MAX_LOOP_FILTER ; lvl ++ ) <START_BUG> vpx_memset ( lfi -> lfthr [ lvl ]. hev_thr, ( lvl >> 4 ), SIMD_WIDTH ) ; <END_BUG> }

Fix:
<S2SV_ModStart> lvl ++ ) memset <S2SV_ModEnd> ( lfi ->
Buggy code:
 static Image * ReadSUNImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define RMT_EQUAL_RGB 1 # define RMT_NONE 0 # define RMT_RAW 2 # define RT_STANDARD 1 # define RT_ENCODED 2 # define RT_FORMAT_RGB 3 typedef struct _SUNInfo { unsigned int magic, width, height, depth, length, type, maptype, maplength ; } SUNInfo ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bytes_per_line, extent, height, length ; ssize_t count, y ; SUNInfo sun_info ; unsigned char * sun_data, * sun_pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & sun_info, 0, sizeof ( sun_info ) ) ; sun_info. magic = ReadBlobMSBLong ( image ) ; do { if ( sun_info. magic!= 0x59a66a95 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; sun_info. width = ReadBlobMSBLong ( image ) ; sun_info. height = ReadBlobMSBLong ( image ) ; sun_info. depth = ReadBlobMSBLong ( image ) ; sun_info. length = ReadBlobMSBLong ( image ) ; sun_info. type = ReadBlobMSBLong ( image ) ; sun_info. maptype = ReadBlobMSBLong ( image ) ; sun_info

Fix:
<S2SV_ModStart> ( ResourceLimitError, "ImproperImageHeader" <S2SV_ModEnd> ) ; number_pixels <S2SV_ModStart> ( ResourceLimitError, "ImproperImageHeader" <S2SV_ModEnd> ) ; bytes_per_line <S2SV_ModStart> ( ResourceLimitError, "ImproperImageHeader" <S2SV_ModEnd> ) ; bytes_per_line <S2SV_ModStart> height ) ; else { if ( sun_info. length > ( height * bytes_per_line ) ) ThrowReaderException ( ResourceLimitError, "ImproperImageHeader" ) ; ( void ) CopyMagickMemory ( sun_pixels, sun_data, sun_info. length ) ; }
Buggy code:
 SYSCALL_DEFINE5 ( perf_event_open, struct perf_event_attr __user *, attr_uptr, pid_t, pid, int, cpu, int, group_fd, unsigned long, flags ) { struct perf_event * group_leader = NULL, * output_event = NULL ; struct perf_event * event, * sibling ; struct perf_event_attr attr ; struct perf_event_context * ctx ; struct file * event_file = NULL ; struct fd group = { NULL, 0 } ; struct task_struct * task = NULL ; struct pmu * pmu ; int event_fd ; int move_group = 0 ; int err ; int f_flags = O_RDWR ; if ( flags & ~ PERF_FLAG_ALL ) return - EINVAL ; err = perf_copy_attr ( attr_uptr, & attr ) ; if ( err ) return err ; if (! attr. exclude_kernel ) { if ( perf_paranoid_kernel ( ) &&! capable ( CAP_SYS_ADMIN ) ) return - EACCES ; } if ( attr. freq ) { if ( attr. sample_freq > sysctl_perf_event_sample_rate ) return - EINVAL ; } else { if ( attr. sample_period & ( 1ULL << 63 ) ) return - EINVAL ; } if ( ( flags & PERF_FLAG_PID_CGROUP ) && ( pid == - 1 || cpu == - 1 ) ) return - EINVAL ; if ( flags & PERF_FLAG_FD_CLOEXEC ) f_flags |= O_CLOEXEC ; event_fd = get_unused_fd_flags ( f_flags ) ; if ( event_fd < 0 ) return event_fd ; if ( group_fd!= - 1 ) { err = perf_fget_light ( group_fd, & group ) ; if ( err ) goto err_fd ; group_leader = group. file -> private_data ; if ( flags & PERF_FLAG_FD_OUTPUT ) output_event = group_leader ; if ( flags & PERF_FLAG_FD_NO_GROUP ) group_leader = NULL ; } if ( pid!= - 1 &&! ( flags & PERF_FLAG_PID_CGROUP ) ) { task = find_lively_task_by_

Fix:
<S2SV_ModStart> -> ctx -> task <S2SV_ModEnd>!= ctx -> <S2SV_ModStart>!= ctx -> task ) goto err_context ; if ( group_leader -> cpu!= event -> cpu <S2SV_ModEnd> ) goto err_context
Buggy code:
 void jpc_qmfb_split_colgrp ( jpc_fix_t * a, int numrows, int stride, int parity ) { int bufsize = JPC_CEILDIVPOW2 ( numrows, 1 ) ; jpc_fix_t splitbuf [ QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE ] ; jpc_fix_t * buf = splitbuf ; jpc_fix_t * srcptr ; jpc_fix_t * dstptr ; register jpc_fix_t * srcptr2 ; register jpc_fix_t * dstptr2 ; register int n ; register int i ; int m ; <START_BUG> int hstartcol ; <END_BUG> if ( bufsize > QMFB_SPLITBUFSIZE ) {  if (! ( buf = jas_alloc2 ( bufsize, sizeof ( jpc_fix_t ) ) ) ) { <START_BUG> abort ( ) ; } } if ( numrows >= 2 ) { <END_BUG> hstartcol = ( numrows + 1 - parity ) >> 1 ;  <START_BUG> m = numrows - hstartcol ; <END_BUG> n = m ; dstptr = buf ; srcptr = & a [ ( 1 - parity ) * stride ] ; while ( n -- > 0 ) { dstptr2 = dstptr ; srcptr2 = srcptr ; for ( i = 0 ; i < JPC_QMFB_COLGRPSIZE ; ++ i ) { * dstptr2 = * srcptr2 ; ++ dstptr2 ; ++ srcptr2 ; } dstptr += JPC_QMFB_COLGRPSIZE ; srcptr += stride << 1 ; } dstptr = & a [ ( 1 - parity ) * stride ] ; srcptr = & a [ ( 2 - parity ) * stride ] ; n = numrows - m - (! parity ) ; while ( n -- > 0 ) { dstptr2 = dstptr ; srcptr2 = srcptr ; for ( i = 0 ; i < JPC_QMFB_COLGRPSIZE ; ++ i ) { * dstptr2 = * srcptr2 ; ++ dstptr2 ; ++ srcptr2 ; } dstptr += stride ; srcptr += stride << 1 ; }  dstptr = & a [ hstartcol * stride ] ; <START_BUG> srcptr = buf ; n = m ; while<END_BUG>

Fix:
<S2SV_ModStart> m ; int hstartrow <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( buf = jas_alloc3 <S2SV_ModEnd> ( bufsize, <S2SV_ModStart> ( bufsize, JPC_QMFB_COLGRPSIZE, <S2SV_ModStart> 2 ) { hstartrow <S2SV_ModEnd> = ( numrows <S2SV_ModStart> = numrows - hstartrow <S2SV_ModEnd> ; n = <S2SV_ModStart> & a [ hstartrow <S2SV_ModEnd> * stride ]
Buggy code:
 static uint32_t scsi_init_iovec ( SCSIDiskReq * r ) <START_BUG> { <END_BUG>  r -> iov. iov_len = MIN ( r -> sector_count * 512, SCSI_DMA_BUF_SIZE ) ; <START_BUG> qemu_iovec_init_external ( & r -> qiov, & r -> iov, 1 ) ; return r -> qiov. size // 512 ; }<END_BUG>

Fix:
<S2SV_ModStart> r ) { SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, r -> req. dev ) ; if (! r -> iov. iov_base ) { r -> buflen = SCSI_DMA_BUF_SIZE ; r -> iov. iov_base = qemu_blockalign ( s -> bs, r -> buflen ) ; } <S2SV_ModStart> * 512, r -> buflen <S2SV_ModEnd> ) ; qemu_iovec_init_external
Buggy code:
 static void calc_pframe_target_size ( VP8_COMP * cpi ) { int min_frame_target ; int old_per_frame_bandwidth = cpi -> per_frame_bandwidth ; if ( cpi -> current_layer > 0 ) cpi -> per_frame_bandwidth = cpi -> layer_context [ cpi -> current_layer ]. avg_frame_size_for_layer ; min_frame_target = 0 ; if ( cpi -> pass == 2 ) { min_frame_target = cpi -> min_frame_bandwidth ; if ( min_frame_target < ( cpi -> av_per_frame_bandwidth >> 5 ) ) min_frame_target = cpi -> av_per_frame_bandwidth >> 5 ; } else if ( min_frame_target < cpi -> per_frame_bandwidth // 4 ) min_frame_target = cpi -> per_frame_bandwidth // 4 ; if ( ( cpi -> common. refresh_alt_ref_frame ) && ( cpi -> oxcf. number_of_layers == 1 ) ) { if ( cpi -> pass == 2 ) { cpi -> per_frame_bandwidth = cpi -> twopass. gf_bits ; cpi -> this_frame_target = cpi -> per_frame_bandwidth ; } } else { if ( cpi -> pass == 2 ) { cpi -> this_frame_target = cpi -> per_frame_bandwidth ; } else { int Adjustment ; if ( cpi -> kf_overspend_bits > 0 ) { Adjustment = ( cpi -> kf_bitrate_adjustment <= cpi -> kf_overspend_bits )? cpi -> kf_bitrate_adjustment : cpi -> kf_overspend_bits ; if ( Adjustment > ( cpi -> per_frame_bandwidth - min_frame_target ) ) Adjustment = ( cpi -> per_frame_bandwidth - min_frame_target ) ; cpi -> kf_overspend_bits -= Adjustment ; cpi -> this_frame_target = cpi -> per_frame_bandwidth - Adjustment ; if ( cpi -> this_frame_target < min_frame_target ) cpi -> this_frame_target = min_frame_target ; } else cpi -> this_frame_target

Fix:
<S2SV_ModStart> 1 ) ) { Adjustment = <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) * Adjustment ; if ( Adjustment > ( 10 * cpi -> this_frame_target ) // 100 ) Adjustment = ( 10 * cpi -> this_frame_target ) // 100 ; cpi -> this_frame_target += Adjustment ; } <S2SV_ModEnd> else cpi ->
Buggy code:
 static int jas_iccgetuint16 ( jas_stream_t * in, jas_iccuint16_t * val ) { <START_BUG> ulonglong tmp ; <END_BUG> if ( jas_iccgetuint ( in, 2, & tmp ) ) return - 1 ; * val = tmp ; return 0 ; }

Fix:
<S2SV_ModStart> val ) { jas_ulonglong <S2SV_ModEnd> tmp ; if
Buggy code:
 struct clock_source * dcn20_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( struct dce110_clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dcn20_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;
Buggy code:
 static int mlx5_fw_fatal_reporter_dump ( struct devlink_health_reporter * reporter, struct devlink_fmsg * fmsg, void * priv_ctx ) { struct mlx5_core_dev * dev = devlink_health_reporter_priv ( reporter ) ; u32 crdump_size = dev -> priv. health. crdump_size ; u32 * cr_data ; u32 data_size ; u32 offset ; int err ; if (! mlx5_core_is_pf ( dev ) ) return - EPERM ; cr_data = kvmalloc ( crdump_size, GFP_KERNEL ) ; if (! cr_data ) return - ENOMEM ; err = mlx5_crdump_collect ( dev, cr_data ) ; if ( err ) <START_BUG> return err ; <END_BUG> if ( priv_ctx ) { struct mlx5_fw_reporter_ctx * fw_reporter_ctx = priv_ctx ; err = mlx5_fw_reporter_ctx_pairs_put ( fmsg, fw_reporter_ctx ) ; if ( err ) goto free_data ; } err = devlink_fmsg_arr_pair_nest_start ( fmsg, "crdump_data" ) ; if ( err ) goto free_data ; for ( offset = 0 ; offset < crdump_size ; offset += data_size ) { if ( crdump_size - offset < MLX5_CR_DUMP_CHUNK_SIZE ) data_size = crdump_size - offset ; else data_size = MLX5_CR_DUMP_CHUNK_SIZE ; err = devlink_fmsg_binary_put ( fmsg, ( char * ) cr_data + offset, data_size ) ; if ( err ) goto free_data ; } err = devlink_fmsg_arr_pair_nest_end ( fmsg ) ; free_data : kvfree ( cr_data ) ; return err ; }

Fix:
<S2SV_ModStart> ( err ) goto free_data <S2SV_ModEnd> ; if (
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; PixelPacket * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; size_t Unknown6 ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; quantum_info = ( QuantumInfo * ) NULL ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = ( ImageInfo * ) NULL ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image

Fix:
<S2SV_ModStart> { MATLAB_KO : if ( clone_info!= ( ImageInfo * ) NULL )
Buggy code:
 <START_BUG> int64_t vp9_pick_inter_mode ( VP9_COMP * cpi, MACROBLOCK * x, <END_BUG>  const TileInfo * const tile, <START_BUG> int mi_row, int mi_col, int * returnrate, int64_t * returndistortion, BLOCK_SIZE bsize ) { MACROBLOCKD * xd = & x -> e_mbd ; <END_BUG> MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ;  struct macroblock_plane * const p = & x -> plane [ 0 ] ; struct macroblockd_plane * const pd = & xd -> plane [ 0 ] ; <START_BUG> MB_PREDICTION_MODE this_mode, best_mode = ZEROMV ; <END_BUG>  MV_REFERENCE_FRAME ref_frame, best_ref_frame = LAST_FRAME ; <START_BUG> INTERP_FILTER best_pred_filter = EIGHTTAP ; int_mv frame_mv [ MB_MODE_COUNT ] [ MAX_REF_FRAMES ] ; struct buf_2d yv12_mb [ 4 ] [ MAX_MB_PLANE ] ; static const int flag_list [ 4 ] = { 0, VP9_LAST_FLAG, VP9_GOLD_FLAG, VP9_ALT_FLAG } ; <END_BUG> int64_t best_rd = INT64_MAX ;  int64_t this_rd = INT64_MAX ; int rate = INT_MAX ; int64_t dist = INT64_MAX ; VP9_COMMON * cm = & cpi -> common ; <START_BUG> int intra_cost_penalty = 20 * vp9_dc_quant ( cm -> base_qindex, cm -> y_dc_delta_q ) ; <END_BUG> const int64_t inter_mode_thresh = RDCOST ( x -> rdmult, x -> rddiv,  intra_cost_penalty, 0 ) ; <START_BUG> const int64_t intra_mode_cost = 50 ; unsigned char segment_id = mbmi -> segment_id ; <END_BUG> const int * const rd_threshes = cpi -> rd_threshes [ segment_id ] [ bsize ] ;  <START_BUG> const int * const rd_thresh_freq_fact = cpi -> rd_thresh_freq_fact [ bsize ] ; <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> void <S2SV_ModEnd> vp9_pick_inter_mode ( VP9_COMP <S2SV_ModStart> * x, TileDataEnc * tile_data, int mi_row, int mi_col, RD_COST * rd_cost, BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx ) { VP9_COMMON * const cm = & cpi -> common ; SPEED_FEATURES * const sf = & cpi -> sf ; <S2SV_ModEnd> TileInfo * const <S2SV_ModStart> TileInfo * const tile_info = & tile_data -> tile_info ; MACROBLOCKD * const <S2SV_ModEnd> xd = & <S2SV_ModStart> ; MB_MODE_INFO * const <S2SV_ModStart> ] -> mbmi <S2SV_ModEnd> ; struct macroblockd_plane <S2SV_ModStart> 0 ] ; PREDICTION_MODE <S2SV_ModEnd> best_mode = ZEROMV <S2SV_ModStart> best_ref_frame = LAST_FRAME ; MV_REFERENCE_FRAME usable_ref_frame ; TX_SIZE best_tx_size = TX_SIZES <S2SV_ModStart> VP9_ALT_FLAG } ; RD_COST this_rdc, best_rdc ; uint8_t skip_
Buggy code:
 void vp8_plane_add_noise_c ( unsigned char * Start, char * noise, char blackclamp [ 16 ], char whiteclamp [ 16 ], char bothclamp [ 16 ], unsigned int Width, unsigned int Height, int Pitch ) { <START_BUG> unsigned int i, j ; <END_BUG> for ( i = 0 ; i < Height ; i ++ ) { unsigned char * Pos = Start + i * Pitch ; char * Ref = ( char * ) ( noise + ( rand ( ) & 0xff ) ) ; for ( j = 0 ; j < Width ; j ++ ) { if ( Pos [ j ] < blackclamp [ 0 ] ) Pos [ j ] = blackclamp [ 0 ] ; if ( Pos [ j ] > 255 + whiteclamp [ 0 ] ) Pos [ j ] = 255 + whiteclamp [ 0 ] ; Pos [ j ] += Ref [ j ] ; } } }

Fix:
<S2SV_ModStart> i, j ; ( void ) bothclamp
Buggy code:
 void impeg2d_dec_hdr ( void * pv_dec, impeg2d_video_decode_ip_t * ps_ip, impeg2d_video_decode_op_t * ps_op ) { UWORD32 u4_bits_read ; dec_state_t * ps_dec ; ps_dec = ( dec_state_t * ) pv_dec ; ps_op -> s_ivd_video_decode_op_t. u4_error_code = 0 ; impeg2d_bit_stream_init ( & ( ps_dec -> s_bit_stream ), ps_ip -> s_ivd_video_decode_ip_t. pv_stream_buffer, ps_ip -> s_ivd_video_decode_ip_t. u4_num_Bytes ) ; { { IMPEG2D_ERROR_CODES_T e_error ; e_error = impeg2d_process_video_header ( ps_dec ) ; if ( ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE!= e_error ) { ps_op -> s_ivd_video_decode_op_t. u4_error_code = e_error ; u4_bits_read = impeg2d_bit_stream_num_bits_read ( & ps_dec -> s_bit_stream ) ; ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed = u4_bits_read >> 3 ; if ( ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed > ps_ip -> s_ivd_video_decode_ip_t. u4_num_Bytes ) { ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed = ps_ip -> s_ivd_video_decode_ip_t. u4_num_Bytes ; } if ( ps_op -> s_ivd_video_decode_op_t. u4_error_code == 0 ) ps_op -> s_ivd_video_decode_op_t. u4_error_code = e_error ; <START_BUG> im<END_BUG>

Fix:
<S2SV_ModStart> = e_error ; if ( IMPEG2D_UNSUPPORTED_DIMENSIONS == e_error ) { ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed = 0 ; ps_dec -> u2_header_done = 0 ; ps_op -> s_ivd_video_decode_op_t. u4_pic_ht = ps_dec -> u2_reinit_max_height ; ps_op -> s_ivd_video_decode_op_t. u4_pic_wd = ps_dec -> u2_reinit_max_width ; }
Buggy code:
 static void InsertRow ( Image * image, unsigned char * p, ssize_t y, int bpp, ExceptionInfo * exception ) { int bit ; Quantum index ; register Quantum * q ; ssize_t x ; switch ( bpp ) { case 1 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) break ; for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 7 ) ; x += 8 ) { for ( bit = 0 ; bit < 8 ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( image, index, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; q += GetPixelChannels ( image ) ; } p ++ ; } if ( ( image -> columns % 8 )!= 0 ) { for ( bit = 0 ; bit < ( ssize_t ) ( image -> columns % 8 ) ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( image, index, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; q += GetPixelChannels ( image ) ; } p ++ ; } if (! SyncAuthenticPixels ( image, exception ) ) break ; break ; } case 2 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) break ; <START_BUG> for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 1 ) ; x += 2 ) <END_BUG> { index = ConstrainColormapIndex ( image, ( * p >> 6 ) & 0x3, exception ) ; SetPixelIndex ( image, index, q ) ; SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; q += GetPixelChannels ( image ) ; index = ConstrainColormapIndex ( image, ( * p >> 4 ) & 0x3, exception ) ; SetPixelIndex (

Fix:
<S2SV_ModStart> ; x += 4 <S2SV_ModEnd> ) { index
Buggy code:
 int main ( int argc, char * * argv ) { int i, n_valid, do_write, do_scrub ; char * c, * dname, * name ; DIR * dir ; FILE * fp ; pdf_t * pdf ; pdf_flag_t flags ; if ( argc < 2 ) usage ( ) ; do_write = do_scrub = flags = 0 ; name = NULL ; for ( i = 1 ; i < argc ; i ++ ) { if ( strncmp ( argv [ i ], "-w", 2 ) == 0 ) do_write = 1 ; else if ( strncmp ( argv [ i ], "-i", 2 ) == 0 ) flags |= PDF_FLAG_DISP_CREATOR ; else if ( strncmp ( argv [ i ], "-q", 2 ) == 0 ) flags |= PDF_FLAG_QUIET ; else if ( strncmp ( argv [ i ], "-s", 2 ) == 0 ) do_scrub = 1 ; else if ( argv [ i ] [ 0 ]!= '-' ) name = argv [ i ] ; else if ( argv [ i ] [ 0 ] == '-' ) usage ( ) ; } if (! name ) usage ( ) ; if (! ( fp = fopen ( name, "r" ) ) ) { ERR ( "Could   not   open   file   \'%s\'\\n", argv [ 1 ] ) ; return - 1 ; } else if (! pdf_is_pdf ( fp ) ) { ERR ( "\'%s\'   specified   is   not   a   valid   PDF\\n", name ) ; fclose ( fp ) ; return - 1 ; } if (! ( pdf = init_pdf ( fp, name ) ) ) { fclose ( fp ) ; return - 1 ; } for ( i = 0, n_valid = 0 ; i < pdf -> n_xrefs ; i ++ ) if ( pdf -> xrefs [ i ]. version ) ++ n_valid ; if ( n_valid < 2 ) { if (! ( flags & ( PDF_FLAG_QUIET | PDF_FLAG_DISP_CREATOR ) ) ) printf ( "%s:   There   is   only   one   version   of   this   PDF\\n", pdf -> name ) ; if ( do_write ) {

Fix:
<S2SV_ModStart> ; dname = safe_calloc <S2SV_ModEnd> ( strlen (
Buggy code:
 unsigned int nf_nat_redirect_ipv4 ( struct sk_buff * skb, const struct nf_nat_ipv4_multi_range_compat * mr, unsigned int hooknum ) { struct nf_conn * ct ; enum ip_conntrack_info ctinfo ; __be32 newdst ; struct nf_nat_range newrange ; NF_CT_ASSERT ( hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_LOCAL_OUT ) ; ct = nf_ct_get ( skb, & ctinfo ) ; NF_CT_ASSERT ( ct && ( ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ) ) ; if ( hooknum == NF_INET_LOCAL_OUT ) { newdst = htonl ( 0x7F000001 ) ; } else { struct in_device * indev ; struct in_ifaddr * ifa ; newdst = 0 ; rcu_read_lock ( ) ; indev = __in_dev_get_rcu ( skb -> dev ) ; <START_BUG> if ( indev!= NULL ) { <END_BUG> ifa = indev -> ifa_list ; newdst = ifa -> ifa_local ; } rcu_read_unlock ( ) ; if (! newdst ) return NF_DROP ; } memset ( & newrange. min_addr, 0, sizeof ( newrange. min_addr ) ) ; memset ( & newrange. max_addr, 0, sizeof ( newrange. max_addr ) ) ; newrange. flags = mr -> range [ 0 ]. flags | NF_NAT_RANGE_MAP_IPS ; newrange. min_addr. ip = newdst ; newrange. max_addr. ip = newdst ; newrange. min_proto = mr -> range [ 0 ]. min ; newrange. max_proto = mr -> range [ 0 ]. max ; return nf_nat_setup_info ( ct, & newrange, NF_NAT_MANIP_DST ) ; }

Fix:
<S2SV_ModStart> if ( indev && indev -> ifa_list <S2SV_ModEnd> ) { ifa
Buggy code:
 static netsnmp_pdu * _clone_pdu_header ( netsnmp_pdu * pdu ) { netsnmp_pdu * newpdu ; struct snmp_secmod_def * sptr ; int ret ; if (! pdu ) return NULL ; newpdu = ( netsnmp_pdu * ) malloc ( sizeof ( netsnmp_pdu ) ) ; if (! newpdu ) return NULL ; memmove ( newpdu, pdu, sizeof ( netsnmp_pdu ) ) ; newpdu -> variables = NULL ; newpdu -> enterprise = NULL ; newpdu -> community = NULL ; newpdu -> securityEngineID = NULL ; newpdu -> securityName = NULL ; newpdu -> contextEngineID = NULL ; newpdu -> contextName = NULL ; newpdu -> transport_data = NULL ; if ( snmp_clone_mem ( ( void * * ) & newpdu -> enterprise, pdu -> enterprise, sizeof ( oid ) * pdu -> enterprise_length ) || snmp_clone_mem ( ( void * * ) & newpdu -> community, pdu -> community, pdu -> community_len ) || snmp_clone_mem ( ( void * * ) & newpdu -> contextEngineID, pdu -> contextEngineID, pdu -> contextEngineIDLen ) || snmp_clone_mem ( ( void * * ) & newpdu -> securityEngineID, pdu -> securityEngineID, pdu -> securityEngineIDLen ) || snmp_clone_mem ( ( void * * ) & newpdu -> contextName, pdu -> contextName, pdu -> contextNameLen ) || snmp_clone_mem ( ( void * * ) & newpdu -> securityName, pdu -> securityName, pdu -> securityNameLen ) || snmp_clone_mem ( ( void * * ) & newpdu -> transport_data, pdu -> transport_data, pdu -> transport_data_length ) ) { snmp_free_pdu ( newpdu ) ; return NULL ; } <START_BUG> if ( pdu -> securityStateRef && <END_BUG> pdu -> command == SNMP_MSG_TRAP2 ) { netsnmp_assert ( pdu -> securityModel == SNMP_DEFAULT_SECMODEL ) ; ret = usm_clone_usmStateReference ( ( struct usmStateReference * ) pdu -> securityStateRef

Fix:
<S2SV_ModStart> NULL ; } sptr = find_sec_mod ( newpdu -> securityModel ) ; if ( sptr && sptr -> pdu_clone ) { ret = sptr -> pdu_clone ( pdu, newpdu <S2SV_ModEnd> ) ; if <S2SV_ModStart> NULL ; } <S2SV_ModEnd> } return newpdu
Buggy code:
 static int g2m_init_buffers ( G2MContext * c ) { int aligned_height ; if (! c -> framebuf || c -> old_width < c -> width || c -> old_height < c -> height ) { <START_BUG> c -> framebuf_stride = FFALIGN ( c -> width * 3, 16 ) ; <END_BUG>  aligned_height = FFALIGN ( c -> height, 16 ) ; <START_BUG> av_free ( c -> framebuf ) ; c -> framebuf = av_mallocz ( c -> framebuf_stride * aligned_height ) ; if (! c -> framebuf ) return AVERROR ( ENOMEM ) ; } if (! c -> synth_tile ||! c -> jpeg_tile || c -> old_tile_w < c -> tile_width || c -> old_tile_h < c -> tile_height ) { c -> tile_stride = FFALIGN ( c -> tile_width, 16 ) * 3 ; aligned_height = FFALIGN ( c -> tile_height, 16 ) ; av_free ( c -> synth_tile ) ; av_free ( c -> jpeg_tile ) ; av_free ( c -> kempf_buf ) ; av_free ( c -> kempf_flags ) ; c -> synth_tile = av_mallocz ( c -> tile_stride * aligned_height ) ; c -> jpeg_tile = av_mallocz ( c -> tile_stride * aligned_height ) ; c -> kempf_buf = av_mallocz ( ( c -> tile_width + 1 ) * aligned_height + FF_INPUT_BUFFER_PADDING_SIZE ) ; c -> kempf_flags = av_mallocz ( c -> tile_width * aligned_height ) ; if (! c -> synth_tile ||! c -> jpeg_tile ||! c -> kempf_buf ||! c -> kempf_flags ) return AVERROR ( ENOMEM ) ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> c -> width + 15 <S2SV_ModEnd>, 16 ) <S2SV_ModStart>, 16 ) * 3 ; aligned_height = <S2SV_ModEnd> c -> height <S2SV_ModStart> c -> height + 15 <S2SV_ModEnd> ; av_free (
Buggy code:
 static int mincore_unmapped_range ( unsigned long addr, unsigned long end, struct mm_walk * walk ) { <START_BUG> walk -> private += __mincore_unmapped_range ( addr, end, <END_BUG> walk -> vma, walk -> private ) ; return 0 ; }

Fix:
<S2SV_ModStart> walk ) { unsigned char * vec = walk -> private ; unsigned long nr = ( end - addr ) >> PAGE_SHIFT ; memset ( vec, 0, nr ) ; <S2SV_ModStart> -> private += nr <S2SV_ModEnd> ; return 0
Buggy code:
 static int do_ipv6_setsockopt ( struct sock * sk, int level, int optname, char __user * optval, unsigned int optlen ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct net * net = sock_net ( sk ) ; int val, valbool ; int retv = - ENOPROTOOPT ; bool needs_rtnl = setsockopt_needs_rtnl ( optname ) ; if (! optval ) val = 0 ; else { if ( optlen >= sizeof ( int ) ) { if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; } else val = 0 ; } valbool = ( val!= 0 ) ; if ( ip6_mroute_opt ( optname ) ) return ip6_mroute_setsockopt ( sk, optname, optval, optlen ) ; if ( needs_rtnl ) rtnl_lock ( ) ; lock_sock ( sk ) ; switch ( optname ) { case IPV6_ADDRFORM : if ( optlen < sizeof ( int ) ) goto e_inval ; if ( val == PF_INET ) { struct ipv6_txoptions * opt ; struct sk_buff * pktopt ; if ( sk -> sk_type == SOCK_RAW ) break ; if ( sk -> sk_protocol == IPPROTO_UDP || sk -> sk_protocol == IPPROTO_UDPLITE ) { struct udp_sock * up = udp_sk ( sk ) ; if ( up -> pending == AF_INET6 ) { retv = - EBUSY ; break ; } } else if ( sk -> sk_protocol!= IPPROTO_TCP ) break ; if ( sk -> sk_state!= TCP_ESTABLISHED ) { retv = - ENOTCONN ; break ; } if ( ipv6_only_sock ( sk ) ||! ipv6_addr_v4mapped ( & sk -> sk_v6_daddr ) ) { retv = - EADDRNOTAVAIL ; break ; } fl6_free_socklist ( sk ) ; ipv6_sock_mc_close ( sk ) ; sk_refcnt_debug_dec ( sk ) ; if ( sk -> sk_protocol == IPPROTO_TCP ) { struct inet_connection_sock * icsk = inet_

Fix:
<S2SV_ModStart> = xchg ( ( __force struct ipv6_txoptions * * ) <S2SV_ModStart> ( opt ) { atomic_sub ( opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt ) ; } <S2SV_ModEnd> pktopt = xchg <S2SV_ModStart> ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; opt = <S2SV_ModStart> ( sk, <S2SV_ModEnd> opt, optname <S2SV_ModStart> ( opt ) { atomic_sub ( opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt ) ; } <S2SV_ModEnd> break ; } <S2SV_ModStart> ) ) ; atomic_set ( & opt -> refcnt, 1 ) ; <S2SV_ModStart> ( opt ) { atomic_sub ( opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt ) ; } <S2SV_ModEnd> break ; }
Buggy code:
 int key_reject_and_link ( struct key * key, unsigned timeout, unsigned error, struct key * keyring, struct key * authkey ) { struct assoc_array_edit * edit ; struct timespec now ; int ret, awaken, link_ret = 0 ; key_check ( key ) ; key_check ( keyring ) ; awaken = 0 ; ret = - EBUSY ; if ( keyring ) { if ( keyring -> restrict_link ) return - EPERM ; link_ret = __key_link_begin ( keyring, & key -> index_key, & edit ) ; } mutex_lock ( & key_construction_mutex ) ; <START_BUG> if (! test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ) { <END_BUG> atomic_inc ( & key -> user -> nikeys ) ;  key -> reject_error = - error ; <START_BUG> smp_wmb ( ) ; set_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ; set_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ; now = current_kernel_time ( ) ; key -> expiry = now. tv_sec + timeout ; key_schedule_gc ( key -> expiry + key_gc_delay ) ; if ( test_and_clear_bit ( KEY_FLAG_USER_CONSTRUCT, & key -> flags ) ) awaken = 1 ; ret = 0 ; if ( keyring && link_ret == 0 ) __key_link ( key, & edit ) ; if ( authkey ) key_revoke ( authkey ) ; } mutex_unlock ( & key_construction_mutex ) ; if ( keyring && link_ret == 0 ) __key_link_end ( keyring, & key -> index_key, edit ) ; if ( awaken ) wake_up_bit ( & key -> flags, KEY_FLAG_USER_CONSTRUCT ) ; return ret == 0? link_ret : ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( key -> state == KEY_IS_UNINSTANTIATED <S2SV_ModEnd> ) { atomic_inc <S2SV_ModStart> nikeys ) ; mark_key_instantiated ( key, - error <S2SV_ModEnd> ) ; now
Buggy code:
 static int64_t rd_sbuv_dcpred ( const VP9_COMP * cpi, MACROBLOCK * x, int * rate, int * rate_tokenonly, int64_t * distortion, int * skippable, BLOCK_SIZE bsize ) { const VP9_COMMON * cm = & cpi -> common ; int64_t unused ; x -> e_mbd. mi [ 0 ] -> mbmi. uv_mode = DC_PRED ; <START_BUG> super_block_uvrd ( cpi, x, rate_tokenonly, distortion, <END_BUG> skippable, & unused, bsize, INT64_MAX ) ;  * rate = * rate_tokenonly + x -> intra_uv_mode_cost [ cm -> frame_type ] [ DC_PRED ] ; <START_BUG> return RDCOST ( x -> rdmult, x -> rddiv, * rate, * distortion ) ; }<END_BUG>

Fix:
<S2SV_ModStart> = DC_PRED ; memset ( x -> skip_txfm, SKIP_TXFM_NONE, sizeof ( x -> skip_txfm ) ) ; <S2SV_ModStart> * rate_tokenonly + cpi <S2SV_ModEnd> -> intra_uv_mode_cost [
Buggy code:
 static void lspci_process ( STREAM s ) { unsigned int pkglen ; static char * rest = NULL ; <START_BUG> char * buf ; <END_BUG> pkglen = s -> end - s -> p ; buf = xmalloc ( pkglen + 1 ) ; STRNCPY ( buf, ( char * ) s -> p, pkglen + 1 ) ; str_handle_lines ( buf, & rest, lspci_process_line, NULL ) ; xfree ( buf ) ; }

Fix:
<S2SV_ModStart> * buf ; struct stream packet = * s ; if (! s_check ( s ) ) { rdp_protocol_error ( "lspci_process(), <S2SV_blank> stream <S2SV_blank> is <S2SV_blank> in <S2SV_blank> unstable <S2SV_blank> state", & packet ) ; }
Buggy code:
 int <START_BUG> add_mibfile ( const char * tmpstr, const char * d_name, FILE * ip ) <END_BUG> { FILE * fp ; char token [ MAXTOKEN ], token2 [ MAXTOKEN ] ; if ( ( fp = fopen ( tmpstr, "r" ) ) == NULL ) { snmp_log_perror ( tmpstr ) ; return 1 ; } DEBUGMSGTL ( ( "parse-mibs", "Checking   file:   %s...\\n", tmpstr ) ) ; mibLine = 1 ; File = tmpstr ; if ( get_token ( fp, token, MAXTOKEN )!= LABEL ) { fclose ( fp ) ; return 1 ; } if ( get_token ( fp, token2, MAXTOKEN ) == DEFINITIONS ) { new_module ( token, tmpstr ) ;  if ( ip ) <START_BUG> fprintf ( ip, "%s   %s\\n", token, d_name ) ; fclose ( fp ) ; return 0 ; } else { fclose ( fp ) ; return 1 ; } }<END_BUG>

Fix:
<S2SV_ModStart> char * d_name <S2SV_ModEnd> ) { FILE <S2SV_ModStart> tmpstr ) ; <S2SV_ModEnd> fclose ( fp
Buggy code:
 static ssize_t fuse_fill_write_pages ( struct fuse_req * req, struct address_space * mapping, struct iov_iter * ii, loff_t pos ) { struct fuse_conn * fc = get_fuse_conn ( mapping -> host ) ; unsigned offset = pos & ( PAGE_CACHE_SIZE - 1 ) ; size_t count = 0 ; int err ; req -> in. argpages = 1 ; req -> page_descs [ 0 ]. offset = offset ; do { size_t tmp ; struct page * page ; pgoff_t index = pos >> PAGE_CACHE_SHIFT ; size_t bytes = min_t ( size_t, PAGE_CACHE_SIZE - offset, iov_iter_count ( ii ) ) ; bytes = min_t ( size_t, bytes, fc -> max_write - count ) ; again : err = - EFAULT ; if ( iov_iter_fault_in_readable ( ii, bytes ) ) break ; err = - ENOMEM ; page = grab_cache_page_write_begin ( mapping, index, 0 ) ; if (! page ) break ; if ( mapping_writably_mapped ( mapping ) ) flush_dcache_page ( page ) ; tmp = iov_iter_copy_from_user_atomic ( page, ii, offset, bytes ) ; <START_BUG> flush_dcache_page ( page ) ; <END_BUG> if (! tmp ) { unlock_page ( page ) ; page_cache_release ( page ) ; bytes = min ( bytes, iov_iter_single_seg_count ( ii ) ) ; goto again ; } err = 0 ; req -> pages [ req -> num_pages ] = page ; req -> page_descs [ req -> num_pages ]. length = tmp ; req -> num_pages ++ ;  iov_iter_advance ( ii, tmp ) ; <START_BUG> count += tmp ; pos += tmp ; offset += tmp ; if ( offset == PAGE_CACHE_SIZE ) offset = 0 ; if (! fc -> big_writes ) break ; } while ( iov_iter_count ( ii ) && count < fc -> max_write && req -> num_pages < req -> max_pages && offset == 0 ) ; return count > 0? count : err ; }<END_BUG>

Fix:
<S2SV_ModStart> flush_dcache_page ( page ) ; iov_iter_advance ( ii, tmp <S2SV_ModStart> num_pages ++ ; <S2SV_ModEnd> count += tmp
Buggy code:
 static void opl3_panning ( int dev, int voice, int value ) { <START_BUG> devc -> voc [ voice ]. panning = value ; <END_BUG> }

Fix:
<S2SV_ModStart> value ) { if ( voice < 0 || voice >= devc -> nr_voice ) return ;
Buggy code:
 int xfs_attr3_leaf_clearflag ( struct xfs_da_args * args ) { struct xfs_attr_leafblock * leaf ; struct xfs_attr_leaf_entry * entry ; struct xfs_attr_leaf_name_remote * name_rmt ; struct xfs_buf * bp ; int error ; # ifdef DEBUG struct xfs_attr3_icleaf_hdr ichdr ; xfs_attr_leaf_name_local_t * name_loc ; int namelen ; char * name ; # endif trace_xfs_attr_leaf_clearflag ( args ) ; error = xfs_attr3_leaf_read ( args -> trans, args -> dp, args -> blkno, - 1, & bp ) ; if ( error ) return ( error ) ; leaf = bp -> b_addr ; entry = & xfs_attr3_leaf_entryp ( leaf ) [ args -> index ] ; ASSERT ( entry -> flags & XFS_ATTR_INCOMPLETE ) ; # ifdef DEBUG xfs_attr3_leaf_hdr_from_disk ( & ichdr, leaf ) ; ASSERT ( args -> index < ichdr. count ) ; ASSERT ( args -> index >= 0 ) ; if ( entry -> flags & XFS_ATTR_LOCAL ) { name_loc = xfs_attr3_leaf_name_local ( leaf, args -> index ) ; namelen = name_loc -> namelen ; name = ( char * ) name_loc -> nameval ; } else { name_rmt = xfs_attr3_leaf_name_remote ( leaf, args -> index ) ; namelen = name_rmt -> namelen ; name = ( char * ) name_rmt -> name ; } ASSERT ( be32_to_cpu ( entry -> hashval ) == args -> hashval ) ; ASSERT ( namelen == args -> namelen ) ; ASSERT ( memcmp ( name, args -> name, namelen ) == 0 ) ; # endif entry -> flags &= ~ XFS_ATTR_INCOMPLETE ; xfs_trans_log_buf ( args -> trans, bp, XFS_DA_LOGRANGE ( leaf, entry, sizeof ( * entry ) ) ) ; if ( args -> rmtblkno ) {

Fix:
<S2SV_ModStart> ( args -> rmtvaluelen <S2SV_ModEnd> ) ; xfs_trans_log_buf