nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int crypto_report_comp ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_comp rcomp ; <START_BUG> strlcpy ( rcomp. type, "compression", sizeof ( rcomp. type ) ) ; <END_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_COMPRESS, sizeof ( struct crypto_report_comp ), & rcomp ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_comp rcomp ; strncpy <S2SV_ModEnd> ( rcomp.
Buggy code:
 struct _mdi * _WM_ParseNewMus ( uint8_t * mus_data, uint32_t mus_size ) { uint8_t mus_hdr [ ] = { 'M', 'U', 'S', 0x1A } ; uint32_t mus_song_ofs = 0 ; uint32_t mus_song_len = 0 ; uint16_t mus_ch_cnt1 = 0 ; uint16_t mus_ch_cnt2 = 0 ; uint16_t mus_no_instr = 0 ; uint32_t mus_data_ofs = 0 ; uint16_t * mus_mid_instr = NULL ; uint16_t mus_instr_cnt = 0 ; struct _mdi * mus_mdi ; uint32_t mus_divisions = 60 ; float tempo_f = 0.0 ; uint16_t mus_freq = 0 ; float samples_per_tick_f = 0.0 ; <START_BUG> uint8_t mus_event [ ] = { 0, 0, 0, 0 } ; <END_BUG> uint8_t mus_event_size = 0 ; uint8_t mus_prev_vol [ ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 } ; uint32_t setup_ret = 0 ; uint32_t mus_ticks = 0 ; uint32_t sample_count = 0 ; float sample_count_f = 0.0 ; float sample_remainder = 0.0 ; uint16_t pitchbend_tmp = 0 ; if ( mus_size < 17 ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_MUS, "File   too   short", 0 ) ; return NULL ; } if ( memcmp ( mus_data, mus_hdr, 4 ) ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_MUS, NULL, 0 ) ; return NULL ; } mus_song_len = ( mus_data [ 5 ] << 8 ) | mus

Fix:
<S2SV_ModStart> = 0.0 ; # define MUS_SZ 4 <S2SV_ModStart> uint8_t mus_event [ MUS_SZ <S2SV_ModStart> * ) mus_event, MUS_SZ
Buggy code:
 static void WritePixels ( struct ngiflib_img * i, struct ngiflib_decode_context * context, const u8 * pixels, u16 n ) { u16 tocopy ; struct ngiflib_gif * p = i -> parent ; while ( n > 0 ) { tocopy = ( context -> Xtogo < n )? context -> Xtogo : n ; if (! i -> gce. transparent_flag ) { # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif ngiflib_memcpy ( context -> frbuff_p. p8, pixels, tocopy ) ; pixels += tocopy ; context -> frbuff_p. p8 += tocopy ; # ifndef NGIFLIB_INDEXED_ONLY } else { int j ; for ( j = ( int ) tocopy ; j > 0 ; j -- ) { * ( context -> frbuff_p. p32 ++ ) = GifIndexToTrueColor ( i -> palette, * pixels ++ ) ; } } # endif } else { int j ; # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif for ( j = ( int ) tocopy ; j > 0 ; j -- ) { if ( * pixels!= i -> gce. transparent_color ) * context -> frbuff_p. p8 = * pixels ; pixels ++ ; context -> frbuff_p. p8 ++ ; } # ifndef NGIFLIB_INDEXED_ONLY } else { for ( j = ( int ) tocopy ; j > 0 ; j -- ) { if ( * pixels!= i -> gce. transparent_color ) { * context -> frbuff_p. p32 = GifIndexToTrueColor ( i -> palette, * pixels ) ; } pixels ++ ; context -> frbuff_p. p32 ++ ; } } # endif } context -> Xtogo -= tocopy ; if ( context -> Xtogo == 0 ) { # ifdef NGIFLIB_ENABLE_CALLBACKS if ( p -> line_cb ) p -> line_cb ( p, context -> line_p, context -> curY ) ; # endif context -> Xtogo = i ->

Fix:
<S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 4 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> ; break ; } while ( context -> pass > 0 && context -> pass < 4 && context -> curY >= p -> height ) { switch ( ++ context -> pass ) { case 2 : context -> curY = i -> posY + 4 ; break ; case 3 : context -> curY = i -> posY + 2 ; break ; case 4 : context -> curY = i -> posY + 1 ; break ; }
Buggy code:
 int ext4_insert_range ( struct inode * inode, loff_t offset, loff_t len ) { struct super_block * sb = inode -> i_sb ; handle_t * handle ; struct ext4_ext_path * path ; struct ext4_extent * extent ; ext4_lblk_t offset_lblk, len_lblk, ee_start_lblk = 0 ; unsigned int credits, ee_len ; int ret = 0, depth, split_flag = 0 ; loff_t ioffset ; if (! ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) return - EOPNOTSUPP ; if ( offset & ( EXT4_CLUSTER_SIZE ( sb ) - 1 ) || len & ( EXT4_CLUSTER_SIZE ( sb ) - 1 ) ) return - EINVAL ; if (! S_ISREG ( inode -> i_mode ) ) return - EOPNOTSUPP ; trace_ext4_insert_range ( inode, offset, len ) ; offset_lblk = offset >> EXT4_BLOCK_SIZE_BITS ( sb ) ; len_lblk = len >> EXT4_BLOCK_SIZE_BITS ( sb ) ; if ( ext4_should_journal_data ( inode ) ) { ret = ext4_force_commit ( inode -> i_sb ) ; if ( ret ) return ret ; } ioffset = round_down ( offset, PAGE_SIZE ) ; ret = filemap_write_and_wait_range ( inode -> i_mapping, ioffset, LLONG_MAX ) ; if ( ret ) return ret ; mutex_lock ( & inode -> i_mutex ) ; if (! ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) { ret = - EOPNOTSUPP ; goto out_mutex ; } if ( inode -> i_size + len > inode -> i_sb -> s_maxbytes ) { ret = - EFBIG ; goto out_mutex ; } if ( offset >= i_size_read ( inode ) ) { ret = - EINVAL ; goto out_mutex ; } <START_BUG> truncate_pagecache ( inode, ioffset ) ; <END_BUG>  ext4_inode_block_unlocked_dio ( inode ) ;

Fix:
<S2SV_ModStart> out_mutex ; } ext4_inode_block_unlocked_dio ( inode ) ; inode_dio_wait ( inode ) ; down_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModStart> ioffset ) ; <S2SV_ModEnd> credits = ext4_writepage_trans_blocks <S2SV_ModStart> ) ; goto out_mmap <S2SV_ModEnd> ; } inode <S2SV_ModStart> handle ) ; out_mmap : up_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModEnd> ext4_inode_resume_unlocked_dio ( inode
Buggy code:
 int mount_proc_if_needed ( const char * rootfs ) { char path [ MAXPATHLEN ] ; char link [ 20 ] ; int linklen, ret ; int mypid ; ret = snprintf ( path, MAXPATHLEN, "%s//proc//self", rootfs ) ; if ( ret < 0 || ret >= MAXPATHLEN ) { SYSERROR ( "proc   path   name   too   long" ) ; return - 1 ; } memset ( link, 0, 20 ) ; linklen = readlink ( path, link, 20 ) ; mypid = ( int ) getpid ( ) ; INFO ( "I   am   %d,   //proc//self   points   to   \'%s\'", mypid, link ) ; ret = snprintf ( path, MAXPATHLEN, "%s//proc", rootfs ) ; if ( ret < 0 || ret >= MAXPATHLEN ) { SYSERROR ( "proc   path   name   too   long" ) ; return - 1 ; } if ( linklen < 0 ) goto domount ; if ( atoi ( link )!= mypid ) { umount2 ( path, MNT_DETACH ) ; goto domount ; } return 0 ; domount : <START_BUG> if ( mount ( "proc", path, "proc", 0, NULL ) ) <END_BUG> return - 1 ; INFO ( "Mounted   //proc   in   container   for   security   transition" ) ; return 1 ; }

Fix:
<S2SV_ModStart> : if ( safe_mount <S2SV_ModEnd> ( "proc", <S2SV_ModStart> 0, NULL, rootfs ) < 0 <S2SV_ModEnd> ) return -
Buggy code:
 static void exif_data_load_data_content ( ExifData * data, ExifIfd ifd, const unsigned char * d, <START_BUG> unsigned int ds, unsigned int offset, unsigned int recursion_depth ) <END_BUG> { ExifLong o, thumbnail_offset = 0, thumbnail_length = 0 ; ExifShort n ; ExifEntry * entry ; unsigned int i ; ExifTag tag ; if (! data ||! data -> priv ) return ; if ( ( ( ( int ) ifd ) < 0 ) || ( ( ( int ) ifd ) >= EXIF_IFD_COUNT ) ) return ;  if ( recursion_depth > 12 ) { <START_BUG> exif_log ( data -> priv -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", <END_BUG> "Deep   recursion   detected!" ) ;  return ; } if ( ( offset + 2 < offset ) || ( offset + 2 < 2 ) || ( offset + 2 > ds ) ) { exif_log ( data -> priv -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", "Tag   data   past   end   of   buffer   (%u   >   %u)", offset + 2, ds ) ; return ; } n = exif_get_short ( d + offset, data -> priv -> order ) ; exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Loading   %hu   entries...", n ) ; offset += 2 ; if ( offset + 12 * n > ds ) { n = ( ds - offset ) // 12 ; exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Short   data;   only   loading   %hu   entries...", n ) ; } for ( i = 0 ; i < n ; i ++ ) { tag = exif_get_short ( d + offset + 12 * i, data -> priv -> order ) ; switch ( tag ) { case EXIF_TAG_EXIF_IFD_POINTER : case EXIF_TAG_GPS_INFO_IFD_POINTER : case EXIF_TAG_INTEROPERABILITY_IFD_POINTER : case EXIF_TAG_JPEG_INTERCHANGE_FORMAT_

Fix:
<S2SV_ModStart>, unsigned int recursion_cost <S2SV_ModEnd> ) { ExifLong <S2SV_ModStart> ; if ( recursion_cost > 170 <S2SV_ModEnd> ) { exif_log <S2SV_ModStart>, "ExifData", "Deep//expensive <S2SV_blank> recursion <S2SV_blank> detected!" <S2SV_ModEnd> ) ; return <S2SV_ModStart>, o, recursion_cost + level_cost ( n ) <S2SV_ModEnd> ) ; break <S2SV_ModStart>, o, recursion_cost + level_cost ( n ) <S2SV_ModEnd> ) ; break <S2SV_ModStart>, o, recursion_cost + level_cost ( n ) <S2SV_ModEnd> ) ; break
Buggy code:
 static void sgi_timer_get ( struct k_itimer * timr, struct itimerspec * cur_setting ) { if ( timr -> it. mmtimer. clock == TIMER_OFF ) { cur_setting -> it_interval. tv_nsec = 0 ; cur_setting -> it_interval. tv_sec = 0 ; cur_setting -> it_value. tv_nsec = 0 ; cur_setting -> it_value. tv_sec = 0 ; return ; } <START_BUG> ns_to_timespec ( cur_setting -> it_interval, timr -> it. mmtimer. incr * sgi_clock_period ) ; <END_BUG>  ns_to_timespec ( cur_setting -> it_value, ( timr -> it. mmtimer. expires - rtc_time ( ) ) * sgi_clock_period ) ; <START_BUG> <END_BUG> return ;  }

Fix:
<S2SV_ModStart> return ; } <S2SV_ModEnd> cur_setting -> it_interval <S2SV_ModStart> cur_setting -> it_interval = ns_to_timespec ( <S2SV_ModEnd> timr -> it <S2SV_ModStart> sgi_clock_period ) ; <S2SV_ModEnd> cur_setting -> it_value <S2SV_ModStart> cur_setting -> it_value = ns_to_timespec ( <S2SV_ModEnd> ( timr -> <S2SV_ModStart> sgi_clock_period ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void copy_to_user_state ( struct xfrm_state * x, struct xfrm_usersa_info * p ) { <START_BUG> memcpy ( & p -> id, & x -> id, sizeof ( p -> id ) ) ; <END_BUG> memcpy ( & p -> sel, & x -> sel, sizeof ( p -> sel ) ) ; memcpy ( & p -> lft, & x -> lft, sizeof ( p -> lft ) ) ; memcpy ( & p -> curlft, & x -> curlft, sizeof ( p -> curlft ) ) ; memcpy ( & p -> stats, & x -> stats, sizeof ( p -> stats ) ) ; memcpy ( & p -> saddr, & x -> props. saddr, sizeof ( p -> saddr ) ) ; p -> mode = x -> props. mode ; p -> replay_window = x -> props. replay_window ; p -> reqid = x -> props. reqid ; p -> family = x -> props. family ; p -> flags = x -> props. flags ; p -> seq = x -> km. seq ; }

Fix:
<S2SV_ModStart> p ) { memset ( p, 0, sizeof ( * p ) ) ;
Buggy code:
 <START_BUG> dictionary * iniparser_load ( const char * ininame ) <END_BUG> { FILE * in ; char line [ ASCIILINESZ + 1 ] ; char section [ ASCIILINESZ + 1 ] ; char key [ ASCIILINESZ + 1 ] ; char tmp [ ( ASCIILINESZ * 2 ) + 1 ] ; char val [ ASCIILINESZ + 1 ] ; int last = 0 ; int len ; int lineno = 0 ; int errs = 0 ; dictionary * dict ; if ( ( in = fopen ( ininame, "r" ) ) == NULL ) { fprintf ( stderr, "iniparser:   cannot   open   %s\\n", ininame ) ; return NULL ; } dict = dictionary_new ( 0 ) ; if (! dict ) { fclose ( in ) ; return NULL ; } memset ( line, 0, ASCIILINESZ ) ; memset ( section, 0, ASCIILINESZ ) ; memset ( key, 0, ASCIILINESZ ) ; memset ( val, 0, ASCIILINESZ ) ; last = 0 ; while ( fgets ( line + last, ASCIILINESZ - last, in )!= NULL ) { lineno ++ ; len = ( int ) strlen ( line ) - 1 ; if ( len == 0 ) continue ; if ( line [ len ]!= '\\n' &&! feof ( in ) ) { fprintf ( stderr, "iniparser:   input   line   too   long   in   %s   (%d)\\n", ininame, lineno ) ; dictionary_del ( dict ) ; fclose ( in ) ; return NULL ; } while ( ( len >= 0 ) && ( ( line [ len ] == '\\n' ) || ( isspace ( line [ len ] ) ) ) ) { line [ len ] = 0 ; len -- ; } if ( len < 0 ) { len = 0 ; } if ( line [ len ] == '\\\\' ) { last = len ; continue ; } else { last = 0 ; } switch ( iniparser_line ( line, section, key, val ) ) { case LINE_EMPTY : case LINE_COMMENT : break ; case LINE_SECTION : errs = dictionary_set ( dict, section, NULL ) ; break ; case LINE_VALUE : sprintf ( tmp, "%s:%s", section, key ) ; errs = dictionary

Fix:
<S2SV_ModStart> char * ininame, load_options options <S2SV_ModStart> case LINE_ERROR : if ( options & HIDE_ERRORED_LINE_CONTENT ) { <S2SV_ModStart> ( stderr, "iniparser: <S2SV_blank> syntax <S2SV_blank> error <S2SV_blank> in <S2SV_blank> %s <S2SV_blank> (%d)\\n", ininame, lineno ) ; } else { fprintf ( stderr, <S2SV_ModStart> line ) ; }
Buggy code:
 static int load_state_from_tss16 ( struct x86_emulate_ctxt * ctxt, struct tss_segment_16 * tss ) { int ret ; u8 cpl ; ctxt -> _eip = tss -> ip ; ctxt -> eflags = tss -> flag | 2 ; * reg_write ( ctxt, VCPU_REGS_RAX ) = tss -> ax ; * reg_write ( ctxt, VCPU_REGS_RCX ) = tss -> cx ; * reg_write ( ctxt, VCPU_REGS_RDX ) = tss -> dx ; * reg_write ( ctxt, VCPU_REGS_RBX ) = tss -> bx ; * reg_write ( ctxt, VCPU_REGS_RSP ) = tss -> sp ; * reg_write ( ctxt, VCPU_REGS_RBP ) = tss -> bp ; * reg_write ( ctxt, VCPU_REGS_RSI ) = tss -> si ; * reg_write ( ctxt, VCPU_REGS_RDI ) = tss -> di ; set_segment_selector ( ctxt, tss -> ldt, VCPU_SREG_LDTR ) ; set_segment_selector ( ctxt, tss -> es, VCPU_SREG_ES ) ; set_segment_selector ( ctxt, tss -> cs, VCPU_SREG_CS ) ; set_segment_selector ( ctxt, tss -> ss, VCPU_SREG_SS ) ; set_segment_selector ( ctxt, tss -> ds, VCPU_SREG_DS ) ; cpl = tss -> cs & 3 ; <START_BUG> ret = __load_segment_descriptor ( ctxt, tss -> ldt, VCPU_SREG_LDTR, cpl, true ) ; <END_BUG> if ( ret!= X86EMUL_CONTINUE ) return ret ;  ret = __load_segment_descriptor ( ctxt, tss -> es, VCPU_SREG_ES, cpl, true ) ; <START_BUG> if ( ret!= X86EMUL_CONTINUE ) return ret ; <END_BUG> ret = __load_segment_descriptor ( ctxt, tss -> cs, VCPU_SREG_CS, cpl, true ) ;  if ( ret!= X86EMUL_CONTINUE ) return ret

Fix:
<S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if <S2SV_ModStart>, cpl, true, NULL <S2SV_ModEnd> ) ; if
Buggy code:
 static int htc_config_pipe_credits ( struct htc_target * target ) { struct sk_buff * skb ; struct htc_config_pipe_msg * cp_msg ; int ret ; unsigned long time_left ; skb = alloc_skb ( 50 + sizeof ( struct htc_frame_hdr ), GFP_ATOMIC ) ; if (! skb ) { dev_err ( target -> dev, "failed   to   allocate   send   buffer\\n" ) ; return - ENOMEM ; } skb_reserve ( skb, sizeof ( struct htc_frame_hdr ) ) ; cp_msg = skb_put ( skb, sizeof ( struct htc_config_pipe_msg ) ) ; cp_msg -> message_id = cpu_to_be16 ( HTC_MSG_CONFIG_PIPE_ID ) ; cp_msg -> pipe_id = USB_WLAN_TX_PIPE ; cp_msg -> credits = target -> credits ; target -> htc_flags |= HTC_OP_CONFIG_PIPE_CREDITS ; ret = htc_issue_send ( target, skb, skb -> len, 0, ENDPOINT0 ) ; if ( ret ) goto err ; time_left = wait_for_completion_timeout ( & target -> cmd_wait, HZ ) ; if (! time_left ) { dev_err ( target -> dev, "HTC   credit   config   timeout\\n" ) ; <START_BUG> return - ETIMEDOUT ; <END_BUG> } return 0 ; err : kfree_skb ( skb ) ; return - EINVAL ; }

Fix:
<S2SV_ModStart> "HTC <S2SV_blank> credit <S2SV_blank> config <S2SV_blank> timeout\\n" ) ; kfree_skb ( skb ) ;
Buggy code:
 krb5_error_code kdc_process_s4u2proxy_req ( kdc_realm_t * kdc_active_realm, krb5_kdc_req * request, const krb5_enc_tkt_part * t2enc, const krb5_db_entry * server, krb5_const_principal server_princ, krb5_const_principal proxy_princ, const char * * status ) { krb5_error_code errcode ; if ( request -> kdc_options & ( NON_TGT_OPTION | KDC_OPT_ENC_TKT_IN_SKEY ) ) { <START_BUG> return KRB5KDC_ERR_BADOPTION ; <END_BUG> } if (! krb5_principal_compare ( kdc_context, server -> princ,  server_princ ) ) { <START_BUG> return KRB5KDC_ERR_SERVER_NOMATCH ; } if (! isflagset ( t2enc -> flags, TKT_FLG_FORWARDABLE ) ) { * status = "EVIDENCE_TKT_NOT_FORWARDABLE" ; return KRB5_TKT_NOT_FORWARDABLE ; } errcode = check_allowed_to_delegate_to ( kdc_context, t2enc -> client, server, proxy_princ ) ; if ( errcode ) { * status = "NOT_ALLOWED_TO_DELEGATE" ; return errcode ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ) { * status = "INVALID_S4U2PROXY_OPTIONS" ; <S2SV_ModStart> ) ) { * status = "EVIDENCE_TICKET_MISMATCH" ;
Buggy code:
 static StkId rethook ( lua_State * L, CallInfo * ci, StkId firstres, int nres ) { ptrdiff_t oldtop = savestack ( L, L -> top ) ; int delta = 0 ; if ( isLuacode ( ci ) ) { <START_BUG> Proto * p = clLvalue ( s2v ( ci -> func ) ) -> p ; <END_BUG> if ( p -> is_vararg ) delta = ci -> u. l. nextraargs + p -> numparams + 1 ; if ( L -> top < ci -> top ) L -> top = ci -> top ; } if ( L -> hookmask & LUA_MASKRET ) { int ftransfer ; ci -> func += delta ; ftransfer = cast ( unsigned short, firstres - ci -> func ) ; luaD_hook ( L, LUA_HOOKRET, - 1, ftransfer, nres ) ; ci -> func -= delta ; }  if ( isLua ( ci -> previous ) ) <START_BUG> <END_BUG> L -> oldpc = ci -> previous -> u. l. savedpc ;  return restorestack ( L, oldtop ) ; }

Fix:
<S2SV_ModStart> * p = ci_func ( ci <S2SV_ModEnd> ) -> p <S2SV_ModStart> isLua ( ci = ci <S2SV_ModStart> -> oldpc = pcRel ( ci <S2SV_ModEnd> -> u. <S2SV_ModStart> l. savedpc, ci_func ( ci ) -> p )
Buggy code:
 void luaD_callnoyield ( lua_State * L, StkId func, int nResults ) { incXCcalls ( L ) ; <START_BUG> if ( getCcalls ( L ) <= CSTACKERR ) <END_BUG>  luaE_freeCI ( L ) ; <START_BUG> luaD_call ( L, func, nResults ) ; decXCcalls ( L ) ; }<END_BUG>

Fix:
<S2SV_ModStart> <= CSTACKERR ) { luaE_exitCcall <S2SV_ModEnd> ( L ) <S2SV_ModStart> L ) ; luaE_enterCcall ( L ) ; }
Buggy code:
 static int tok_nextc ( struct tok_state * tok ) { for ( ; ; ) { if ( tok -> cur!= tok -> inp ) { return Py_CHARMASK ( * tok -> cur ++ ) ; } if ( tok -> done!= E_OK ) return EOF ; if ( tok -> fp == NULL ) { char * end = strchr ( tok -> inp, '\\n' ) ; if ( end!= NULL ) end ++ ; else { end = strchr ( tok -> inp, '\\0' ) ; if ( end == tok -> inp ) { tok -> done = E_EOF ; return EOF ; } } if ( tok -> start == NULL ) tok -> buf = tok -> cur ; tok -> line_start = tok -> cur ; tok -> lineno ++ ; tok -> inp = end ; return Py_CHARMASK ( * tok -> cur ++ ) ; } if ( tok -> prompt!= NULL ) { char * newtok = PyOS_Readline ( stdin, stdout, tok -> prompt ) ; # ifndef PGEN if ( newtok!= NULL ) { char * translated = translate_newlines ( newtok, 0, tok ) ; PyMem_FREE ( newtok ) ; if ( translated == NULL ) return EOF ; newtok = translated ; } if ( tok -> encoding && newtok && * newtok ) { Py_ssize_t buflen ; const char * buf ; PyObject * u = translate_into_utf8 ( newtok, tok -> encoding ) ; PyMem_FREE ( newtok ) ; if (! u ) { tok -> done = E_DECODE ; return EOF ; } buflen = PyBytes_GET_SIZE ( u ) ; buf = PyBytes_AS_STRING ( u ) ; <START_BUG> newtok = PyMem_MALLOC ( buflen + 1 ) ; <END_BUG> strcpy ( newtok, buf ) ; Py_DECREF ( u ) ; } # endif if ( tok -> nextprompt!= NULL ) tok -> prompt = tok -> nextprompt ; if ( newtok == NULL ) tok -> done = E_INTR ; else if ( * newtok == '\\0' ) { PyMem_FREE ( newtok ) ; tok -> done = E_EOF ; } else if ( tok -> start!= NULL ) { size_t start = tok -> start - tok -> buf ; size_t oldlen = tok -> cur - tok -> buf

Fix:
<S2SV_ModStart> 1 ) ; if ( newtok == NULL ) { Py_DECREF ( u ) ; tok -> done = E_NOMEM ; return EOF ; }
Buggy code:
 NOEXPORT char * base64 ( int encode, const char * in, int len ) { BIO * bio, * b64 ; char * out ; int n ; b64 = BIO_new ( BIO_f_base64 ( ) ) ; if (! b64 ) return NULL ; BIO_set_flags ( b64, BIO_FLAGS_BASE64_NO_NL ) ; bio = BIO_new ( BIO_s_mem ( ) ) ; if (! bio ) { <START_BUG> str_free ( b64 ) ; <END_BUG> return NULL ; } if ( encode ) bio = BIO_push ( b64, bio ) ; BIO_write ( bio, in, len ) ; ( void ) BIO_flush ( bio ) ; if ( encode ) { bio = BIO_pop ( bio ) ; BIO_free ( b64 ) ; } else { bio = BIO_push ( b64, bio ) ; } n = BIO_pending ( bio ) ; out = str_alloc ( n < 32? 32 : ( size_t ) n + 1 ) ; n = BIO_read ( bio, out, n ) ; if ( n < 0 ) { BIO_free_all ( bio ) ; str_free ( out ) ; return NULL ; } BIO_free_all ( bio ) ; return out ; }

Fix:
<S2SV_ModStart> bio ) { BIO_free <S2SV_ModEnd> ( b64 )
Buggy code:
 void * jas_realloc ( void * ptr, size_t size ) { void * result ; <START_BUG> JAS_DBGLOG ( 101, ( "jas_realloc   called   with   %x,%zu\\n", ptr, size ) ) ; <END_BUG> result = realloc ( ptr, size ) ; JAS_DBGLOG ( 100, ( "jas_realloc(%p,   %zu)   ->   %p\\n", ptr, size, result ) ) ; return result ; }

Fix:
<S2SV_ModStart> 101, ( "jas_realloc(%x, <S2SV_blank> %zu)\\n" <S2SV_ModEnd>, ptr,
Buggy code:
 static zval * * spl_array_get_dimension_ptr_ptr ( int check_inherited, zval * object, zval * offset, int type TSRMLS_DC ) { spl_array_object * intern = ( spl_array_object * ) zend_object_store_get_object ( object TSRMLS_CC ) ; zval * * retval ; char * key ; uint len ; long index ; HashTable * ht = spl_array_get_hash_table ( intern, 0 TSRMLS_CC ) ; <START_BUG> if (! offset ) { <END_BUG> return & EG ( uninitialized_zval_ptr ) ; } if ( ( type == BP_VAR_W || type == BP_VAR_RW ) && ( ht -> nApplyCount > 0 ) ) { zend_error ( E_WARNING, "Modification   of   ArrayObject   during   sorting   is   prohibited" ) ; return & EG ( error_zval_ptr ) ; ; } switch ( Z_TYPE_P ( offset ) ) { case IS_STRING : key = Z_STRVAL_P ( offset ) ; len = Z_STRLEN_P ( offset ) + 1 ; string_offest : if ( zend_symtable_find ( ht, key, len, ( void * * ) & retval ) == FAILURE ) { switch ( type ) { case BP_VAR_R : zend_error ( E_NOTICE, "Undefined   index:   %s", key ) ; case BP_VAR_UNSET : case BP_VAR_IS : retval = & EG ( uninitialized_zval_ptr ) ; break ; case BP_VAR_RW : zend_error ( E_NOTICE, "Undefined   index:   %s", key ) ; case BP_VAR_W : { zval * value ; ALLOC_INIT_ZVAL ( value ) ; zend_symtable_update ( ht, key, len, ( void * * ) & value, sizeof ( void * ), ( void * * ) & retval ) ; } } } return retval ; case IS_NULL : key = "" ; len = 1 ; goto string_offest ; case IS_RESOURCE : zend_error ( E_STRICT, "Resource   ID#%ld   used   as   offset,

Fix:
<S2SV_ModStart> (! offset ||! ht
Buggy code:
 void vp8_dequant_idct_add_c ( short * input, short * dq, unsigned char * dest, int stride ) { int i ; for ( i = 0 ; i < 16 ; i ++ ) { input [ i ] = dq [ i ] * input [ i ] ; } vp8_short_idct4x4llm_c ( input, dest, stride, dest, stride ) ; <START_BUG> vpx_memset ( input, 0, 32 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( input,
Buggy code:
 static int try_to_unmap_cluster ( unsigned long cursor, unsigned int * mapcount, struct vm_area_struct * vma, struct page * check_page ) { struct mm_struct * mm = vma -> vm_mm ; pmd_t * pmd ; pte_t * pte ; pte_t pteval ; spinlock_t * ptl ; struct page * page ; unsigned long address ; unsigned long mmun_start ; unsigned long mmun_end ; unsigned long end ; int ret = SWAP_AGAIN ; int locked_vma = 0 ; address = ( vma -> vm_start + cursor ) & CLUSTER_MASK ; end = address + CLUSTER_SIZE ; if ( address < vma -> vm_start ) address = vma -> vm_start ; if ( end > vma -> vm_end ) end = vma -> vm_end ; pmd = mm_find_pmd ( mm, address ) ; if (! pmd ) return ret ; mmun_start = address ; mmun_end = end ; mmu_notifier_invalidate_range_start ( mm, mmun_start, mmun_end ) ; if ( down_read_trylock ( & vma -> vm_mm -> mmap_sem ) ) { locked_vma = ( vma -> vm_flags & VM_LOCKED ) ; if (! locked_vma ) up_read ( & vma -> vm_mm -> mmap_sem ) ; } pte = pte_offset_map_lock ( mm, pmd, address, & ptl ) ; update_hiwater_rss ( mm ) ; for ( ; address < end ; pte ++, address += PAGE_SIZE ) { if (! pte_present ( * pte ) ) continue ; page = vm_normal_page ( vma, address, * pte ) ; BUG_ON (! page || PageAnon ( page ) ) ; if ( locked_vma ) { <START_BUG> mlock_vma_page ( page ) ; <END_BUG>  if ( page == check_page ) <START_BUG> <END_BUG> ret = SWAP_MLOCK ;  continue ; } if ( ptep_clear_flush_young_notify ( vma, address, pte ) ) continue ; flush_cache_

Fix:
<S2SV_ModStart> locked_vma ) { <S2SV_ModEnd> if ( page <S2SV_ModStart> == check_page ) { mlock_vma_page ( page ) ; <S2SV_ModStart> = SWAP_MLOCK ; } else if ( trylock_page ( page ) ) { mlock_vma_page ( page ) ; unlock_page ( page ) ; }
Buggy code:
 int udpv6_sendmsg ( struct sock * sk, struct msghdr * msg, size_t len ) { struct ipv6_txoptions opt_space ; struct udp_sock * up = udp_sk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; DECLARE_SOCKADDR ( struct sockaddr_in6 *, sin6, msg -> msg_name ) ; struct in6_addr * daddr, * final_p, final ; <START_BUG> struct ipv6_txoptions * opt = NULL ; <END_BUG> struct ip6_flowlabel * flowlabel = NULL ; struct flowi6 fl6 ; struct dst_entry * dst ; int addr_len = msg -> msg_namelen ; int ulen = len ; int hlimit = - 1 ; int tclass = - 1 ; int dontfrag = - 1 ; int corkreq = up -> corkflag || msg -> msg_flags & MSG_MORE ; int err ; int connected = 0 ; int is_udplite = IS_UDPLITE ( sk ) ; int ( * getfrag ) ( void *, char *, int, int, int, struct sk_buff * ) ; if ( sin6 ) { if ( addr_len < offsetof ( struct sockaddr, sa_data ) ) return - EINVAL ; switch ( sin6 -> sin6_family ) { case AF_INET6 : if ( addr_len < SIN6_LEN_RFC2133 ) return - EINVAL ; daddr = & sin6 -> sin6_addr ; break ; case AF_INET : goto do_udp_sendmsg ; case AF_UNSPEC : msg -> msg_name = sin6 = NULL ; msg -> msg_namelen = addr_len = 0 ; daddr = NULL ; break ; default : return - EINVAL ; } } else if (! up -> pending ) { if ( sk -> sk_state!= TCP_ESTABLISHED ) return - EDESTADDRREQ ; daddr = & sk -> sk_v6_daddr ; } else daddr = NULL ; if ( daddr ) { if ( ipv6_addr_v4mapped ( daddr ) ) { struct sockaddr_in sin ; sin. sin_family = AF_INET

Fix:
<S2SV_ModStart> ipv6_txoptions * opt = NULL ; struct ipv6_txoptions * opt_to_free <S2SV_ModStart>! opt ) { opt = txopt_get ( np ) ; opt_to_free = opt ; } <S2SV_ModEnd> if ( flowlabel <S2SV_ModStart> fl6_sock_release ( flowlabel ) ; txopt_put ( opt_to_free
Buggy code:
 void skb_complete_tx_timestamp ( struct sk_buff * skb, struct skb_shared_hwtstamps * hwtstamps ) { struct sock * sk = skb -> sk ; if (! skb_may_tx_timestamp ( sk, false ) ) return ; if ( likely ( atomic_inc_not_zero ( & sk -> sk_refcnt ) ) ) { * skb_hwtstamps ( skb ) = * hwtstamps ; <START_BUG> __skb_complete_tx_timestamp ( skb, sk, SCM_TSTAMP_SND ) ; <END_BUG> sock_put ( sk ) ; } }

Fix:
<S2SV_ModStart> sk, SCM_TSTAMP_SND, false
Buggy code:
 int ring_buffer_resize ( struct ring_buffer * buffer, unsigned long size, int cpu_id ) { struct ring_buffer_per_cpu * cpu_buffer ; unsigned long nr_pages ; int cpu, err = 0 ; if (! buffer ) return size ; if ( cpu_id!= RING_BUFFER_ALL_CPUS &&! cpumask_test_cpu ( cpu_id, buffer -> cpumask ) ) return size ; <START_BUG> size = DIV_ROUND_UP ( size, BUF_PAGE_SIZE ) ; <END_BUG> size *= BUF_PAGE_SIZE ; if ( size < BUF_PAGE_SIZE * 2 ) size = BUF_PAGE_SIZE * 2 ; nr_pages = DIV_ROUND_UP ( size, BUF_PAGE_SIZE ) ; if ( atomic_read ( & buffer -> resize_disabled ) ) return - EBUSY ; mutex_lock ( & buffer -> mutex ) ; if ( cpu_id == RING_BUFFER_ALL_CPUS ) { for_each_buffer_cpu ( buffer, cpu ) { cpu_buffer = buffer -> buffers [ cpu ] ; cpu_buffer -> nr_pages_to_update = nr_pages - cpu_buffer -> nr_pages ; if ( cpu_buffer -> nr_pages_to_update <= 0 ) continue ; INIT_LIST_HEAD ( & cpu_buffer -> new_pages ) ; if ( __rb_allocate_pages ( cpu_buffer -> nr_pages_to_update, & cpu_buffer -> new_pages, cpu ) ) { err = - ENOMEM ; goto out_err ; } } get_online_cpus ( ) ; for_each_buffer_cpu ( buffer, cpu ) { cpu_buffer = buffer -> buffers [ cpu ] ; if (! cpu_buffer -> nr_pages_to_update ) continue ; if (! cpu_online ( cpu ) ) { rb_update_pages ( cpu_buffer ) ; cpu_buffer -> nr_pages_to_update = 0 ; } else { schedule_work_on ( cpu, & cpu_buffer -> update_pages_work ) ; } } for_each_buffer_cpu ( buffer, cpu ) { cpu_buffer = buffer -> buffers [ cpu ] ; if (! cpu_buffer -> nr_pages_to_update ) continue ; if ( cpu_online ( cpu ) )

Fix:
<S2SV_ModStart> return size ; nr_pages = DIV_ROUND_UP ( size, BUF_PAGE_SIZE ) ; if ( nr_pages < 2 ) nr_pages = 2 ; size = nr_pages * BUF_PAGE_SIZE <S2SV_ModEnd> ; if (
Buggy code:
 SYSCALL_DEFINE1 ( inotify_init1, int, flags ) { struct fsnotify_group * group ; struct user_struct * user ; int ret ; BUILD_BUG_ON ( IN_CLOEXEC!= O_CLOEXEC ) ; BUILD_BUG_ON ( IN_NONBLOCK!= O_NONBLOCK ) ; if ( flags & ~ ( IN_CLOEXEC | IN_NONBLOCK ) ) return - EINVAL ; user = get_current_user ( ) ; if ( unlikely ( atomic_read ( & user -> inotify_devs ) >= inotify_max_user_instances ) ) { ret = - EMFILE ; goto out_free_uid ; } group = inotify_new_group ( user, inotify_max_queued_events ) ; if ( IS_ERR ( group ) ) { ret = PTR_ERR ( group ) ; goto out_free_uid ; } atomic_inc ( & user -> inotify_devs ) ; ret = anon_inode_getfd ( "inotify", & inotify_fops, group, O_RDONLY | flags ) ; if ( ret >= 0 ) return ret ; <START_BUG> atomic_dec ( & user -> inotify_devs ) ; <END_BUG> out_free_uid : free_uid ( user ) ; return ret ; }

Fix:
<S2SV_ModStart> return ret ; fsnotify_put_group ( group ) ;
Buggy code:
 static INT AirPDcapDecryptWPABroadcastKey ( const EAPOL_RSN_KEY * pEAPKey, guint8 * decryption_key, PAIRPDCAP_SEC_ASSOCIATION sa, guint eapol_len ) { guint8 key_version ; guint8 * key_data ; guint8 * szEncryptedKey ; guint16 key_bytes_len = 0 ; guint16 key_len ; static AIRPDCAP_KEY_ITEM dummy_key ; AIRPDCAP_SEC_ASSOCIATION * tmp_sa ; key_version = AIRPDCAP_EAP_KEY_DESCR_VER ( pEAPKey -> key_information [ 1 ] ) ; if ( key_version == AIRPDCAP_WPA_KEY_VER_NOT_CCMP ) { key_bytes_len = pntoh16 ( pEAPKey -> key_length ) ; } else if ( key_version == AIRPDCAP_WPA_KEY_VER_AES_CCMP ) { key_bytes_len = pntoh16 ( pEAPKey -> key_data_len ) ; if ( key_bytes_len < 16 ) { return AIRPDCAP_RET_NO_VALID_HANDSHAKE ; } } <START_BUG> if ( key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof ( EAPOL_RSN_KEY ) ) { <END_BUG> return AIRPDCAP_RET_NO_VALID_HANDSHAKE ; } key_data = ( guint8 * ) pEAPKey + sizeof ( EAPOL_RSN_KEY ) ; szEncryptedKey = ( guint8 * ) g_memdup ( key_data, key_bytes_len ) ; DEBUG_DUMP ( "Encrypted   Broadcast   key:", szEncryptedKey, key_bytes_len ) ; DEBUG_DUMP ( "KeyIV:", pEAPKey -> key_iv, 16 ) ; DEBUG_DUMP ( "decryption_key:", decryption_key, 16 ) ; tmp_sa = ( AIRPDCAP_SEC_ASSOCIATION * ) g_malloc ( sizeof ( AIRPDCAP_SEC_ASSOCIATION ) ) ; mem

Fix:
<S2SV_ModStart> } if ( ( <S2SV_ModStart> key_bytes_len < GROUP_KEY_MIN_LEN ) || ( eapol_len < sizeof ( EAPOL_RSN_KEY ) ) || ( <S2SV_ModEnd> key_bytes_len > eapol_len <S2SV_ModStart> sizeof ( EAPOL_RSN_KEY )
Buggy code:
 int32_t DownmixLib_Create ( const effect_uuid_t * uuid, <START_BUG> int32_t sessionId, <END_BUG>  int32_t ioId, <START_BUG> effect_handle_t * pHandle ) { int ret ; int i ; downmix_module_t * module ; const effect_descriptor_t * desc ; ALOGV ( "DownmixLib_Create()" ) ; # ifdef DOWNMIX_TEST_CHANNEL_INDEX ALOGI ( "DOWNMIX_TEST_CHANNEL_INDEX:   should   work:" ) ; Downmix_testIndexComputation ( AUDIO_CHANNEL_OUT_FRONT_LEFT | AUDIO_CHANNEL_OUT_FRONT_RIGHT | AUDIO_CHANNEL_OUT_LOW_FREQUENCY | AUDIO_CHANNEL_OUT_BACK_CENTER ) ; Downmix_testIndexComputation ( CHANNEL_MASK_QUAD_SIDE | CHANNEL_MASK_QUAD_BACK ) ; Downmix_testIndexComputation ( CHANNEL_MASK_5POINT1_SIDE | AUDIO_CHANNEL_OUT_BACK_CENTER ) ; Downmix_testIndexComputation ( CHANNEL_MASK_5POINT1_BACK | AUDIO_CHANNEL_OUT_BACK_CENTER ) ; ALOGI ( "DOWNMIX_TEST_CHANNEL_INDEX:   should   NOT   work:" ) ; Downmix_testIndexComputation ( AUDIO_CHANNEL_OUT_FRONT_LEFT | AUDIO_CHANNEL_OUT_FRONT_RIGHT | AUDIO_CHANNEL_OUT_LOW_FREQUENCY | AUDIO_CHANNEL_OUT_BACK_LEFT ) ; Downmix_testIndexComputation ( AUDIO_CHANNEL_OUT_FRONT_LEFT | AUDIO_CHANNEL_OUT_FRONT_RIGHT | AUDIO_CHANNEL_OUT_LOW_FREQUENCY | AUDIO_CHANNEL_OUT_SIDE_LEFT ) ; Downmix_testIndexComputation ( AUDIO_CHANNEL_OUT_FRONT_LEFT | AUDIO_CHANNEL_OUT_BACK_LEFT | AUDIO_CHANNEL_OUT_BACK_RIGHT ) ; Downmix_testIndexComputation ( AUDIO_CHANNEL_OUT_FRONT_LEFT | AUDIO_CHANNEL_OUT_SIDE_LEFT | AUDIO_CHANNEL_OUT_SIDE_RIGHT<END_BUG>

Fix:
<S2SV_ModStart>, int32_t sessionId __unused <S2SV_ModStart>, int32_t ioId __unused
Buggy code:
 static int nntp_fetch_headers ( struct Context * ctx, void * hc, anum_t first, anum_t last, int restore ) { struct NntpData * nntp_data = ctx -> data ; struct FetchCtx fc ; struct Header * hdr = NULL ; char buf [ HUGE_STRING ] ; int rc = 0 ; int oldmsgcount = ctx -> msgcount ; anum_t current ; anum_t first_over = first ; # ifdef USE_HCACHE void * hdata = NULL ; # endif if (! last || first > last ) return 0 ; fc. ctx = ctx ; fc. first = first ; fc. last = last ; fc. restore = restore ; <START_BUG> fc. messages = mutt_mem_calloc ( last - first + 1, sizeof ( unsigned char ) ) ; <END_BUG> # ifdef USE_HCACHE fc. hc = hc ; # endif if ( NntpListgroup && nntp_data -> nserv -> hasLISTGROUP &&! nntp_data -> deleted ) { if (! ctx -> quiet ) mutt_message ( _ ( "Fetching   list   of   articles..." ) ) ; if ( nntp_data -> nserv -> hasLISTGROUPrange ) snprintf ( buf, sizeof ( buf ), "LISTGROUP   %s   %u-%u\\r\\n", nntp_data -> group, first, last ) ; else snprintf ( buf, sizeof ( buf ), "LISTGROUP   %s\\r\\n", nntp_data -> group ) ; rc = nntp_fetch_lines ( nntp_data, buf, sizeof ( buf ), NULL, fetch_numbers, & fc ) ; if ( rc > 0 ) { mutt_error ( "LISTGROUP:   %s", buf ) ; } if ( rc == 0 ) { for ( current = first ; current <= last && rc == 0 ; current ++ ) { if ( fc. messages [ current - first ] ) continue ; snprintf ( buf, sizeof ( buf ), "%u", current ) ; if ( nntp_data -> bcache ) { mutt_debug ( 2, "#1   mutt_bcache_del   %s\\n", buf ) ; mutt_bcache_del (

Fix:
<S2SV_ModStart> char ) ) ; if ( fc. messages == NULL ) return - 1
Buggy code:
 static int verify_source_vc ( char * * ret_path, const char * src_vc ) { _cleanup_close_ int fd = - 1 ; char * path ; int r ; fd = open_terminal ( src_vc, O_RDWR | O_CLOEXEC | O_NOCTTY ) ; if ( fd < 0 ) return log_error_errno ( fd, "Failed   to   open   %s:   %m", src_vc ) ; r = verify_vc_device ( fd ) ; if ( r < 0 ) return log_error_errno ( r, "Device   %s   is   not   a   virtual   console:   %m", src_vc ) ; r = verify_vc_allocation_byfd ( fd ) ; if ( r < 0 ) return log_error_errno ( r, "Virtual   console   %s   is   not   allocated:   %m", src_vc ) ; <START_BUG> r = verify_vc_kbmode ( fd ) ; <END_BUG> if ( r < 0 ) return log_error_errno ( r, "Virtual   console   %s   is   not   in   K_XLATE   or   K_UNICODE:   %m", src_vc ) ; path = strdup ( src_vc ) ; if (! path ) return log_oom ( ) ; * ret_path = path ; return TAKE_FD ( fd ) ; }

Fix:
<S2SV_ModStart> ; r = vt_verify_kbmode <S2SV_ModEnd> ( fd )
Buggy code:
 static int hci_sock_getname ( struct socket * sock, struct sockaddr * addr, int * addr_len, int peer ) { struct sockaddr_hci * haddr = ( struct sockaddr_hci * ) addr ; struct sock * sk = sock -> sk ; struct hci_dev * hdev = hci_pi ( sk ) -> hdev ; BT_DBG ( "sock   %p   sk   %p", sock, sk ) ; if (! hdev ) return - EBADFD ; lock_sock ( sk ) ; * addr_len = sizeof ( * haddr ) ; haddr -> hci_family = AF_BLUETOOTH ; haddr -> hci_dev = hdev -> id ; <START_BUG> release_sock ( sk ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> -> id ; haddr -> hci_channel = 0 ;
Buggy code:
 static void ReadReason ( rfbClient * client ) { uint32_t reasonLen ; char * reason ; if (! ReadFromRFBServer ( client, ( char * ) & reasonLen, 4 ) ) return ; reasonLen = rfbClientSwap32IfLE ( reasonLen ) ; <START_BUG> reason = malloc ( ( uint64_t ) reasonLen + 1 ) ; <END_BUG> if (! ReadFromRFBServer ( client, reason, reasonLen ) ) { free ( reason ) ; return ; } reason [ reasonLen ] = 0 ; rfbClientLog ( "VNC   connection   failed:   %s\\n", reason ) ; free ( reason ) ; }

Fix:
<S2SV_ModStart> reasonLen ) ; if ( reasonLen > 1 << 20 ) { rfbClientLog ( "VNC <S2SV_blank> connection <S2SV_blank> failed, <S2SV_blank> but <S2SV_blank> sent <S2SV_blank> reason <S2SV_blank> length <S2SV_blank> of <S2SV_blank> %u <S2SV_blank> exceeds <S2SV_blank> limit <S2SV_blank> of <S2SV_blank> 1MB", ( unsigned int ) reasonLen ) ; return ; } <S2SV_ModStart> = malloc ( <S2SV_ModEnd> reasonLen + 1
Buggy code:
 rfbBool webSocketsHasDataInBuffer ( rfbClientPtr cl ) { ws_ctx_t * wsctx = ( ws_ctx_t * ) cl -> wsctx ; <START_BUG> if ( wsctx && wsctx -> readbuflen ) <END_BUG> return TRUE ; return ( cl -> sslctx && rfbssl_pending ( cl ) > 0 ) ; }

Fix:
<S2SV_ModStart> && wsctx -> readlen <S2SV_ModEnd> ) return TRUE
Buggy code:
 static int dissect_spoolss_uint16uni ( tvbuff_t * tvb, int offset, packet_info * pinfo _U_, proto_tree * tree, guint8 * drep _U_, char * * data, int hf_name ) { gint len, remaining ; char * text ; if ( offset % 2 ) offset += 2 - ( offset % 2 ) ; <START_BUG> remaining = tvb_captured_length_remaining ( tvb, offset ) ; <END_BUG> if ( remaining <= 0 ) { if ( data ) * data = g_strdup ( "" ) ; return offset ; } text = tvb_get_string_enc ( NULL, tvb, offset, remaining, ENC_UTF_16 | ENC_LITTLE_ENDIAN ) ; len = ( int ) strlen ( text ) ; proto_tree_add_string ( tree, hf_name, tvb, offset, len * 2, text ) ; if ( data ) * data = text ; else g_free ( text ) ; return offset + ( len + 1 ) * 2 ; }

Fix:
<S2SV_ModStart> ; remaining = tvb_reported_length_remaining <S2SV_ModEnd> ( tvb,
Buggy code:
 static void cyclic_background_refresh ( VP8_COMP * cpi, int Q, int lf_adjustment ) { unsigned char * seg_map = cpi -> segmentation_map ; signed char feature_data [ MB_LVL_MAX ] [ MAX_MB_SEGMENTS ] ; int i ; int block_count = cpi -> cyclic_refresh_mode_max_mbs_perframe ; int mbs_in_frame = cpi -> common. mb_rows * cpi -> common. mb_cols ; cpi -> cyclic_refresh_q = Q // 2 ; <START_BUG> vpx_memset ( cpi -> segmentation_map, 0, mbs_in_frame ) ; <END_BUG>  if ( cpi -> common. frame_type!= KEY_FRAME ) <START_BUG> { i = cpi -> cyclic_refresh_mode_index ; assert ( i < mbs_in_frame ) ; do { if ( cpi -> cyclic_refresh_map [ i ] == 0 ) { seg_map [ i ] = 1 ; block_count -- ; } else if ( cpi -> cyclic_refresh_map [ i ] < 0 ) cpi -> cyclic_refresh_map [ i ] ++ ; i ++ ; if ( i == mbs_in_frame ) i = 0 ; } while ( block_count && i!= cpi -> cyclic_refresh_mode_index ) ; <END_BUG> cpi -> cyclic_refresh_mode_index = i ;  } cpi -> mb. e_mbd. update_mb_segmentation_map = 1 ; cpi -> mb. e_mbd. update_mb_segmentation_data = 1 ; enable_segmentation ( cpi ) ; feature_data [ MB_LVL_ALT_Q ] [ 0 ] = 0 ; feature_data [ MB_LVL_ALT_Q ] [ 1 ] = ( cpi -> cyclic_refresh_q - Q ) ; feature_data [ MB_LVL_ALT_Q ] [ 2 ] = 0 ; feature_data [ MB_LVL_ALT_Q ] [ 3 ] = 0 ; feature_data [ MB_LVL_ALT_LF ] [ 0 ] = 0 ; feature_data [ MB_LVL_ALT_LF ] [ 1 ] = lf_adjustment ; feature_data [ MB_

Fix:
<S2SV_ModStart> // 2 ; if ( cpi -> oxcf. screen_content_mode ) { int qp_thresh = ( cpi -> oxcf. screen_content_mode == 2 )? 80 : 100 ; if ( Q >= qp_thresh ) { cpi -> cyclic_refresh_mode_max_mbs_perframe = ( cpi -> common. mb_rows * cpi -> common. mb_cols ) // 10 ; } else if ( cpi -> frames_since_key > 250 && Q < 20 && cpi -> mb. skip_true_count > ( int ) ( 0.95 * mbs_in_frame ) ) { cpi -> cyclic_refresh_mode_max_mbs_perframe = 0 ; } else { cpi -> cyclic_refresh_mode_max_mbs_perframe = ( cpi -> common. mb_rows * cpi -> common. mb_cols ) // 20 ; } block_count = cpi -> cyclic_refresh_mode_max_mbs_perframe ; } memset <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> frame_type!= KEY_FRAME && block_count > 0 <S2SV_ModStart> = i ; # if CONFIG_
Buggy code:
 long video_ioctl2 ( struct file * file, unsigned int cmd, unsigned long arg ) { <START_BUG> char sbuf [ 128 ] ; <END_BUG> void * mbuf = NULL ; void * parg = ( void * ) arg ; long err = - EINVAL ; bool has_array_args ; size_t array_size = 0 ; void __user * user_ptr = NULL ; void * * kernel_ptr = NULL ; if ( _IOC_DIR ( cmd )!= _IOC_NONE ) { if ( _IOC_SIZE ( cmd ) <= sizeof ( sbuf ) ) { parg = sbuf ; } else { mbuf = kmalloc ( _IOC_SIZE ( cmd ), GFP_KERNEL ) ; if ( NULL == mbuf ) return - ENOMEM ; parg = mbuf ; } err = - EFAULT ; if ( _IOC_DIR ( cmd ) & _IOC_WRITE ) { unsigned long n = cmd_input_size ( cmd ) ; if ( copy_from_user ( parg, ( void __user * ) arg, n ) ) goto out ; if ( n < _IOC_SIZE ( cmd ) ) memset ( ( u8 * ) parg + n, 0, _IOC_SIZE ( cmd ) - n ) ; } else { memset ( parg, 0, _IOC_SIZE ( cmd ) ) ; } } err = check_array_args ( cmd, parg, & array_size, & user_ptr, & kernel_ptr ) ; if ( err < 0 ) goto out ; has_array_args = err ; if ( has_array_args ) { mbuf = kmalloc ( array_size, GFP_KERNEL ) ; err = - ENOMEM ; if ( NULL == mbuf ) goto out_array_args ; err = - EFAULT ; if ( copy_from_user ( mbuf, user_ptr, array_size ) ) goto out_array_args ; * kernel_ptr = mbuf ; }  err = __video_do_ioctl ( file, cmd, parg ) ; <START_BUG> if ( err == - ENOIOCTLCMD ) err = - EINVAL ; if ( has_array_args ) { * kernel_ptr = user_ptr ; if ( copy_to_user ( user_ptr<END_BUG>

Fix:
<S2SV_ModStart> arg ) { return video_usercopy <S2SV_ModEnd> ( file, <S2SV_ModStart>, cmd, arg, __video_do_ioctl ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int perf_event_refresh ( struct perf_event * event, int refresh ) { <START_BUG> if ( event -> attr. inherit ||! is_sampling_event ( event ) ) <END_BUG> return - EINVAL ; atomic_add ( refresh, & event -> event_limit ) ; perf_event_enable ( event ) ;  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> refresh ) { struct perf_event_context * ctx ; int ret ; ctx = perf_event_ctx_lock <S2SV_ModEnd> ( event ) <S2SV_ModStart> event ) ; ret = _perf_event_refresh ( event, refresh ) ; perf_event_ctx_unlock ( event, ctx ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int mlx4_register_mac ( struct mlx4_dev * dev, u8 port, u64 mac, int * index ) { struct mlx4_mac_table * table = & mlx4_priv ( dev ) -> port [ port ]. mac_table ; int i, err = 0 ; int free = - 1 ; mlx4_dbg ( dev, "Registering   MAC:   0x%llx\\n", ( unsigned long long ) mac ) ; mutex_lock ( & table -> mutex ) ; for ( i = 0 ; i < MLX4_MAX_MAC_NUM - 1 ; i ++ ) { if ( free < 0 &&! table -> refs [ i ] ) { free = i ; continue ; } if ( mac == ( MLX4_MAC_MASK & be64_to_cpu ( table -> entries [ i ] ) ) ) { * index = i ; ++ table -> refs [ i ] ; goto out ; } } <START_BUG> mlx4_dbg ( dev, "Free   MAC   index   is   %d\\n", free ) ; <END_BUG> if ( table -> total == table -> max ) { err = - ENOSPC ; goto out ; } table -> refs [ free ] = 1 ; table -> entries [ free ] = cpu_to_be64 ( mac | MLX4_MAC_VALID ) ; err = mlx4_set_port_mac_table ( dev, port, table -> entries ) ; if ( unlikely ( err ) ) { mlx4_err ( dev, "Failed   adding   MAC:   0x%llx\\n", ( unsigned long long ) mac ) ; table -> refs [ free ] = 0 ; table -> entries [ free ] = 0 ; goto out ; } * index = free ; ++ table -> total ; out : mutex_unlock ( & table -> mutex ) ; return err ; }

Fix:
<S2SV_ModStart> ; } } if ( free < 0 ) { err = - ENOMEM ; goto out ; }
Buggy code:
 static int do_check ( struct bpf_verifier_env * env ) { struct bpf_verifier_state * state ; struct bpf_insn * insns = env -> prog -> insnsi ; struct bpf_reg_state * regs ; int insn_cnt = env -> prog -> len ; int insn_idx, prev_insn_idx = 0 ; int insn_processed = 0 ; bool do_print_state = false ; state = kzalloc ( sizeof ( struct bpf_verifier_state ), GFP_KERNEL ) ; if (! state ) return - ENOMEM ; env -> cur_state = state ; init_reg_state ( env, state -> regs ) ; state -> parent = NULL ; insn_idx = 0 ; for ( ; ; ) { struct bpf_insn * insn ; u8 class ; int err ; if ( insn_idx >= insn_cnt ) { verbose ( env, "invalid   insn   idx   %d   insn_cnt   %d\\n", insn_idx, insn_cnt ) ; return - EFAULT ; } insn = & insns [ insn_idx ] ; class = BPF_CLASS ( insn -> code ) ; if ( ++ insn_processed > BPF_COMPLEXITY_LIMIT_INSNS ) { verbose ( env, "BPF   program   is   too   large.   Processed   %d   insn\\n", insn_processed ) ; return - E2BIG ; } err = is_state_visited ( env, insn_idx ) ; if ( err < 0 ) return err ; if ( err == 1 ) { if ( env -> log. level ) { if ( do_print_state ) verbose ( env, "\\nfrom   %d   to   %d:   safe\\n", prev_insn_idx, insn_idx ) ; else verbose ( env, "%d:   safe\\n", insn_idx ) ; } goto process_bpf_exit ; } if ( need_resched ( ) ) cond_resched ( ) ; if ( env -> log. level > 1 || ( env -> log. level && do_print_state ) ) { if ( env -> log. level > 1 ) verbose ( env, "%d:", insn_idx ) ; else verbose ( env, "\\nfrom  

Fix:
<S2SV_ModStart> env ) ; env -> insn_aux_data [ insn_idx ]. seen = true ; <S2SV_ModStart> insn_idx ++ ; env -> insn_aux_data [ insn_idx ]. seen = true ;
Buggy code:
 static void dns_resolver_describe ( const struct key * key, struct seq_file * m ) { seq_puts ( m, key -> description ) ; <START_BUG> if ( key_is_instantiated ( key ) ) { <END_BUG> int err = PTR_ERR ( key -> payload. data [ dns_key_error ] ) ; if ( err ) seq_printf ( m, ":   %d", err ) ; else seq_printf ( m, ":   %u", key -> datalen ) ; } }

Fix:
<S2SV_ModStart> ; if ( key_is_positive <S2SV_ModEnd> ( key )
Buggy code:
 static void vhost_scsi_send_evt ( struct vhost_scsi * vs, struct vhost_scsi_tpg * tpg, struct se_lun * lun, u32 event, u32 reason ) { struct vhost_scsi_evt * evt ; evt = vhost_scsi_allocate_evt ( vs, event, reason ) ; if (! evt ) return ; if ( tpg && lun ) { evt -> event. lun [ 0 ] = 0x01 ; <START_BUG> evt -> event. lun [ 1 ] = tpg -> tport_tpgt & 0xFF ; <END_BUG> if ( lun -> unpacked_lun >= 256 ) evt -> event. lun [ 2 ] = lun -> unpacked_lun >> 8 | 0x40 ; evt -> event. lun [ 3 ] = lun -> unpacked_lun & 0xFF ; } llist_add ( & evt -> list, & vs -> vs_event_list ) ; vhost_work_queue ( & vs -> dev, & vs -> vs_event_work ) ; }

Fix:
<S2SV_ModStart> tpg -> tport_tpgt <S2SV_ModEnd> ; if (
Buggy code:
 int sc_pkcs15_decode_prkdf_entry ( struct sc_pkcs15_card * p15card, struct sc_pkcs15_object * obj, const u8 * * buf, size_t * buflen ) { sc_context_t * ctx = p15card -> card -> ctx ; struct sc_pkcs15_prkey_info info ; int r, i, gostr3410_params [ 3 ] ; struct sc_pkcs15_keyinfo_gostparams * keyinfo_gostparams ; size_t usage_len = sizeof ( info. usage ) ; size_t af_len = sizeof ( info. access_flags ) ; struct sc_asn1_entry asn1_com_key_attr [ C_ASN1_COM_KEY_ATTR_SIZE ] ; struct sc_asn1_entry asn1_com_prkey_attr [ C_ASN1_COM_PRKEY_ATTR_SIZE ] ; struct sc_asn1_entry asn1_rsakey_attr [ C_ASN1_RSAKEY_ATTR_SIZE ] ; struct sc_asn1_entry asn1_prk_rsa_attr [ C_ASN1_PRK_RSA_ATTR_SIZE ] ; struct sc_asn1_entry asn1_dsakey_attr [ C_ASN1_DSAKEY_ATTR_SIZE ] ; struct sc_asn1_entry asn1_prk_dsa_attr [ C_ASN1_PRK_DSA_ATTR_SIZE ] ; struct sc_asn1_entry asn1_dsakey_i_p_attr [ C_ASN1_DSAKEY_I_P_ATTR_SIZE ] ; struct sc_asn1_entry asn1_dsakey_value_attr [ C_ASN1_DSAKEY_VALUE_ATTR_SIZE ] ; struct sc_asn1_entry asn1_gostr3410key_attr [ C_ASN1_GOSTR3410KEY_ATTR_SIZE ] ; struct sc_asn1_entry asn1_prk_gostr3410_attr [ C_ASN1_PRK_GOSTR3410_ATTR_SIZE ] ; struct sc_asn1_entry asn1_ecckey_attr [ C_ASN1_ECCKEY_ATTR ] ; struct sc_

Fix:
<S2SV_ModStart> 0 ) { free ( info. subject. value ) ; <S2SV_ModEnd> } if (
Buggy code:
 int __ext4_journal_stop ( const char * where, unsigned int line, handle_t * handle ) { struct super_block * sb ; int err ; int rc ; if (! ext4_handle_valid ( handle ) ) { ext4_put_nojournal ( handle ) ; return 0 ; } <START_BUG> if (! handle -> h_transaction ) { <END_BUG>  err = jbd2_journal_stop ( handle ) ; <START_BUG> <END_BUG> return handle -> h_err? handle -> h_err : err ;  } <START_BUG> sb = handle -> h_transaction -> t_journal -> j_private ; <END_BUG> err = handle -> h_err ; rc = jbd2_journal_stop ( handle ) ; if (! err ) err = rc ; if ( err ) __ext4_std_error ( sb, where, line, err ) ; return err ; }

Fix:
<S2SV_ModStart> 0 ; } err = handle -> h_err ; <S2SV_ModStart> h_transaction ) { rc <S2SV_ModEnd> = jbd2_journal_stop ( <S2SV_ModStart> ) ; return err? err : rc <S2SV_ModEnd> ; } sb <S2SV_ModStart> t_journal -> j_private <S2SV_ModEnd> ; rc =
Buggy code:
 int kvm_read_guest_page ( struct kvm * kvm, gfn_t gfn, void * data, int offset, int len ) { int r ; unsigned long addr ; addr = gfn_to_hva ( kvm, gfn ) ; if ( kvm_is_error_hva ( addr ) ) return - EFAULT ; <START_BUG> r = copy_from_user ( data, ( void __user * ) addr + offset, len ) ; <END_BUG> if ( r ) return - EFAULT ; return 0 ; }

Fix:
<S2SV_ModStart> ; r = __copy_from_user <S2SV_ModEnd> ( data,
Buggy code:
 static int irda_recvmsg_dgram ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct irda_sock * self = irda_sk ( sk ) ; struct sk_buff * skb ; size_t copied ; int err ; IRDA_DEBUG ( 4, "%s()\\n", __func__ ) ; <START_BUG> skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, <END_BUG> flags & MSG_DONTWAIT, & err ) ; if (! skb ) return err ; skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { IRDA_DEBUG ( 2, "%s(),   Received   truncated   frame   (%zd   <   %zd)!\\n", __func__, copied, size ) ; copied = size ; msg -> msg_flags |= MSG_TRUNC ; } skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; skb_free_datagram ( sk, skb ) ; if ( self -> rx_flow == FLOW_STOP ) { if ( ( atomic_read ( & sk -> sk_rmem_alloc ) << 2 ) <= sk -> sk_rcvbuf ) { IRDA_DEBUG ( 2, "%s(),   Starting   IrTTP\\n", __func__ ) ; self -> rx_flow = FLOW_START ; irttp_flow_request ( self -> tsap, FLOW_START ) ; } } return copied ; }

Fix:
<S2SV_ModStart> __func__ ) ; msg -> msg_namelen = 0 ;