nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void show_frame ( WriterContext * w, AVFrame * frame, AVStream * stream, AVFormatContext * fmt_ctx ) { AVBPrint pbuf ; char val_str [ 128 ] ; const char * s ; int i ; av_bprint_init ( & pbuf, 1, AV_BPRINT_SIZE_UNLIMITED ) ; writer_print_section_header ( w, SECTION_ID_FRAME ) ; s = av_get_media_type_string ( stream -> codecpar -> codec_type ) ; if ( s ) print_str ( "media_type", s ) ; else print_str_opt ( "media_type", "unknown" ) ; print_int ( "stream_index", stream -> index ) ; print_int ( "key_frame", frame -> key_frame ) ; print_ts ( "pkt_pts", frame -> pts ) ; print_time ( "pkt_pts_time", frame -> pts, & stream -> time_base ) ; print_ts ( "pkt_dts", frame -> pkt_dts ) ; print_time ( "pkt_dts_time", frame -> pkt_dts, & stream -> time_base ) ; print_ts ( "best_effort_timestamp", frame -> best_effort_timestamp ) ; print_time ( "best_effort_timestamp_time", frame -> best_effort_timestamp, & stream -> time_base ) ; print_duration_ts ( "pkt_duration", frame -> pkt_duration ) ; print_duration_time ( "pkt_duration_time", frame -> pkt_duration, & stream -> time_base ) ; if ( frame -> pkt_pos!= - 1 ) print_fmt ( "pkt_pos", "%" PRId64, frame -> pkt_pos ) ; else print_str_opt ( "pkt_pos", "N//A" ) ; if ( frame -> pkt_size!= - 1 ) print_val ( "pkt_size", frame -> pkt_size, unit_byte_str ) ; else print_str_opt ( "pkt_size", "N//A" ) ; switch ( stream -> codecpar -> codec_type ) { AVRational sar

Fix:
<S2SV_ModStart> ) ) ; print_primaries ( w, <S2SV_ModEnd> frame -> color_primaries <S2SV_ModStart> frame -> color_primaries <S2SV_ModEnd> ) ; if
Buggy code:
 int main ( int ac, char * * av ) { int c_flag = 0, d_flag = 0, D_flag = 0, k_flag = 0, s_flag = 0 ; int sock, fd, ch, result, saved_errno ; u_int nalloc ; char * shell, * format, * pidstr, * agentsocket = NULL ; fd_set * readsetp = NULL, * writesetp = NULL ; struct rlimit rlim ; extern int optind ; extern char * optarg ; pid_t pid ; char pidstrbuf [ 1 + 3 * sizeof pid ] ; struct timeval * tvp = NULL ; size_t len ; mode_t prev_mask ; ssh_malloc_init ( ) ; sanitise_stdfd ( ) ; setegid ( getgid ( ) ) ; setgid ( getgid ( ) ) ; # ifdef WITH_OPENSSL OpenSSL_add_all_algorithms ( ) ; # endif <START_BUG> while ( ( ch = getopt ( ac, av, "cDdksE:a:t:" ) )!= - 1 ) { <END_BUG> switch ( ch ) { case 'E' : fingerprint_hash = ssh_digest_alg_by_name ( optarg ) ; if ( fingerprint_hash == - 1 ) fatal ( "Invalid   hash   algorithm   \\"%s\\"", optarg ) ; break ; case 'c' : if ( s_flag ) usage ( ) ; c_flag ++ ; break ; case 'k' :  k_flag ++ ; <START_BUG> break ; case's' : if ( c_flag ) usage ( ) ; s_flag ++ ; break ; case 'd' : if ( d_flag || D_flag ) usage ( ) ; d_flag ++ ; break ; case 'D' : if ( d_flag || D_flag ) usage ( ) ; D_flag ++ ; break ; case 'a' : agentsocket = optarg ; break ; case 't' : if ( ( lifetime = convtime ( optarg ) ) == - 1 ) { fprintf ( stderr, "Invalid   lifetime\\n" ) ; usage ( ) ; } break ; default : usage ( ) ; } } ac -= optind ; av += optind ; if ( ac > 0 && ( c_flag || k_flag || s_flag || d_flag<END_BUG>

Fix:
<S2SV_ModStart>, av, "cDdksE:a:P:t:" <S2SV_ModEnd> ) )!= <S2SV_ModStart> : k_flag ++ ; break ; case 'P' : if ( pkcs11_whitelist!= NULL ) fatal ( "-P <S2SV_blank> option <S2SV_blank> already <S2SV_blank> specified" ) ; pkcs11_whitelist = xstrdup ( optarg ) <S2SV_ModStart> ; if ( pkcs11_whitelist == NULL ) pkcs11_whitelist = xstrdup ( DEFAULT_PKCS11_WHITELIST ) ; if ( <S2SV_ModStart> ( pledge ( "stdio <S2SV_blank> rpath <S2SV_blank> cpath <S2SV_blank> unix <S2SV_blank> id <S2SV_blank> proc <S2SV_blank> exec" <S2SV_ModEnd>, NULL )
Buggy code:
 static void do_ssh2_kex ( void ) { char * myproposal [ PROPOSAL_MAX ] = { KEX_SERVER } ; struct kex * kex ; int r ; myproposal [ PROPOSAL_KEX_ALGS ] = compat_kex_proposal ( options. kex_algorithms ) ; myproposal [ PROPOSAL_ENC_ALGS_CTOS ] = compat_cipher_proposal ( options. ciphers ) ; myproposal [ PROPOSAL_ENC_ALGS_STOC ] = compat_cipher_proposal ( options. ciphers ) ; myproposal [ PROPOSAL_MAC_ALGS_CTOS ] = myproposal [ PROPOSAL_MAC_ALGS_STOC ] = options. macs ; if ( options. compression == COMP_NONE ) { myproposal [ PROPOSAL_COMP_ALGS_CTOS ] = myproposal [ PROPOSAL_COMP_ALGS_STOC ] = "none" ; <START_BUG> } else if ( options. compression == COMP_DELAYED ) { <END_BUG> myproposal [ PROPOSAL_COMP_ALGS_CTOS ] = myproposal [ PROPOSAL_COMP_ALGS_STOC ] = "none,zlib@openssh.com" ; } if ( options. rekey_limit || options. rekey_interval ) packet_set_rekey_limits ( options. rekey_limit, ( time_t ) options. rekey_interval ) ; myproposal [ PROPOSAL_SERVER_HOST_KEY_ALGS ] = compat_pkalg_proposal ( list_hostkey_types ( ) ) ; if ( ( r = kex_setup ( active_state, myproposal ) )!= 0 ) fatal ( "kex_setup:   %s", ssh_err ( r ) ) ; kex = active_state -> kex ; # ifdef WITH_OPENSSL kex -> kex [ KEX_DH_GRP1_SHA1 ] = kexdh_server ; kex -> kex [ KEX_DH_GRP14_SHA1 ] = kexdh_server ; kex -> kex [ KEX_DH_GRP14_SHA256 ] = kexdh_server ; kex -> kex [

Fix:
<S2SV_ModStart> "none" ; } <S2SV_ModEnd> if ( options
Buggy code:
 size_t cdf_count_chain ( const cdf_sat_t * sat, cdf_secid_t sid, size_t size ) { size_t i, j ; <START_BUG> cdf_secid_t maxsector = ( cdf_secid_t ) ( sat -> sat_len * size ) ; <END_BUG> DPRINTF ( ( "Chain:" ) ) ; for ( j = i = 0 ; sid >= 0 ; i ++, j ++ ) { DPRINTF ( ( "   %d", sid ) ) ; if ( j >= CDF_LOOP_LIMIT ) { DPRINTF ( ( "Counting   chain   loop   limit" ) ) ; errno = EFTYPE ; return ( size_t ) - 1 ; }  if ( sid > maxsector ) { <START_BUG> DPRINTF ( ( "Sector   %d   >   %d\\n", sid, maxsector ) ) ; errno = EFTYPE ; return ( size_t ) - 1 ; } sid = CDF_TOLE4 ( ( uint32_t ) sat -> sat_tab [ sid ] ) ; } if ( i == 0 ) { DPRINTF ( ( "   none,   sid:   %d\\n", sid ) ) ; return ( size_t ) - 1 ; } DPRINTF ( ( "\\n" ) ) ; return i ; }<END_BUG>

Fix:
<S2SV_ModStart> ( cdf_secid_t ) ( <S2SV_ModStart> * size ) // sizeof ( maxsector ) ) <S2SV_ModStart> if ( sid >= maxsector ) { DPRINTF ( ( "Sector <S2SV_blank> %d <S2SV_blank> >= <S2SV_blank> %d\\n" <S2SV_ModEnd>, sid,
Buggy code:
 static int ext4_writepage ( struct page * page, struct writeback_control * wbc ) { int ret = 0 ; loff_t size ; unsigned int len ; <START_BUG> struct buffer_head * page_bufs ; <END_BUG> struct inode * inode = page -> mapping -> host ; trace_ext4_writepage ( inode, page ) ; size = i_size_read ( inode ) ; if ( page -> index == size >> PAGE_CACHE_SHIFT ) len = size & ~ PAGE_CACHE_MASK ; else len = PAGE_CACHE_SIZE ; if ( page_has_buffers ( page ) ) { page_bufs = page_buffers ( page ) ; if ( walk_page_buffers ( NULL, page_bufs, 0, len, NULL, ext4_bh_delay_or_unwritten ) ) { redirty_page_for_writepage ( wbc, page ) ; unlock_page ( page ) ; return 0 ; } } else { ret = block_prepare_write ( page, 0, len, noalloc_get_block_write ) ; if (! ret ) { page_bufs = page_buffers ( page ) ; if ( walk_page_buffers ( NULL, page_bufs, 0, len, NULL, ext4_bh_delay_or_unwritten ) ) { redirty_page_for_writepage ( wbc, page ) ; unlock_page ( page ) ; return 0 ; } } else { redirty_page_for_writepage ( wbc, page ) ; unlock_page ( page ) ; return 0 ; } block_commit_write ( page, 0, len ) ; } if ( PageChecked ( page ) && ext4_should_journal_data ( inode ) ) { ClearPageChecked ( page ) ; return __ext4_journalled_writepage ( page, len ) ; } if ( test_opt ( inode -> i_sb, NOBH ) && ext4_should_writeback_data ( inode ) ) ret = nobh_writepage ( page, noalloc_get_block_write, wbc ) ;  else <START_BUG> ret = block_write_full_page ( page, noalloc_get_block_write, wbc ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> buffer_head * page_bufs = NULL <S2SV_ModStart> ) ; else if ( page_bufs && buffer_uninit ( page_bufs ) ) { ext4_set_bh_endio ( page_bufs, inode ) ; ret = block_write_full_page_endio ( page, noalloc_get_block_write, wbc, ext4_end_io_buffer_write ) ; } else
Buggy code:
 void beep_print ( netdissect_options * ndo, const u_char * bp, u_int length ) { <START_BUG> if ( l_strnstart ( "MSG", 4, ( const char * ) bp, length ) ) <END_BUG> ND_PRINT ( ( ndo, "   BEEP   MSG" ) ) ;  else if ( l_strnstart ( "RPY   ", 4, ( const char * ) bp, length ) ) <START_BUG> ND_PRINT ( ( ndo, "   BEEP   RPY" ) ) ; <END_BUG> else if ( l_strnstart ( "ERR   ", 4, ( const char * ) bp, length ) )  ND_PRINT ( ( ndo, "   BEEP   ERR" ) ) ; <START_BUG> else if ( l_strnstart ( "ANS   ", 4, ( const char * ) bp, length ) ) <END_BUG> ND_PRINT ( ( ndo, "   BEEP   ANS" ) ) ;  else if ( l_strnstart ( "NUL   ", 4, ( const char * ) bp, length ) ) <START_BUG> ND_PRINT ( ( ndo, "   BEEP   NUL" ) ) ; <END_BUG> else if ( l_strnstart ( "SEQ   ", 4, ( const char * ) bp, length ) )  ND_PRINT ( ( ndo, "   BEEP   SEQ" ) ) ; <START_BUG> else if ( l_strnstart ( "END", 4, ( const char * ) bp, length ) ) <END_BUG> ND_PRINT ( ( ndo, "   BEEP   END" ) ) ; else ND_PRINT ( ( ndo, "   BEEP   (payload   or   undecoded)" ) ) ; }

Fix:
<S2SV_ModStart> ( l_strnstart ( ndo, <S2SV_ModStart> ( l_strnstart ( ndo, <S2SV_ModStart> ( l_strnstart ( ndo, <S2SV_ModStart> ( l_strnstart ( ndo, <S2SV_ModStart> ( l_strnstart ( ndo, <S2SV_ModStart> ( l_strnstart ( ndo, <S2SV_ModStart> ( l_strnstart ( ndo,
Buggy code:
 void opj_get_all_encoding_parameters ( const opj_image_t * p_image, const opj_cp_t * p_cp, OPJ_UINT32 tileno, OPJ_INT32 * p_tx0, OPJ_INT32 * p_tx1, OPJ_INT32 * p_ty0, OPJ_INT32 * p_ty1, OPJ_UINT32 * p_dx_min, OPJ_UINT32 * p_dy_min, OPJ_UINT32 * p_max_prec, OPJ_UINT32 * p_max_res, OPJ_UINT32 * * p_resolutions ) { OPJ_UINT32 compno, resno ; const opj_tcp_t * tcp = 00 ; const opj_tccp_t * l_tccp = 00 ; const opj_image_comp_t * l_img_comp = 00 ; OPJ_UINT32 * lResolutionPtr ; OPJ_UINT32 p, q ; assert ( p_cp!= 00 ) ; assert ( p_image!= 00 ) ; assert ( tileno < p_cp -> tw * p_cp -> th ) ; tcp = & p_cp -> tcps [ tileno ] ; l_tccp = tcp -> tccps ; l_img_comp = p_image -> comps ; p = tileno % p_cp -> tw ; q = tileno // p_cp -> tw ; <START_BUG> * p_tx0 = opj_int_max ( ( OPJ_INT32 ) ( p_cp -> tx0 + p * p_cp -> tdx ), ( OPJ_INT32 ) p_image -> x0 ) ; <END_BUG>  * p_tx1 = opj_int_min ( ( OPJ_INT32 ) ( p_cp -> tx0 + ( p + 1 ) * p_cp -> tdx ), ( OPJ_INT32 ) p_image -> x1 ) ; <START_BUG> <END_BUG> * p_ty0 = opj_int_max ( ( OPJ_INT32 ) ( p_cp -> ty0 + q * p_cp -> tdy ), ( OPJ_INT32 ) p_image -> y0 ) ; 

Fix:
<S2SV_ModStart> * p_tx0 = ( OPJ_INT32 ) opj_uint_max <S2SV_ModEnd> ( p_cp -> <S2SV_ModStart> p_cp -> tdx, <S2SV_ModEnd> p_image -> x0 <S2SV_ModStart> * p_tx1 = ( OPJ_INT32 ) opj_uint_min <S2SV_ModEnd> ( p_cp -> <S2SV_ModStart> p_cp -> tdx, <S2SV_ModEnd> p_image -> x1 <S2SV_ModStart> * p_ty0 = ( OPJ_INT32 ) opj_uint_max <S2SV_ModEnd> ( p_cp -> <S2SV_ModStart> p_cp -> tdy, <S2SV_ModEnd> p_image -> y0 <S2SV_ModStart> * p_ty1 = ( OPJ_INT32 ) opj_uint_min <S2SV_ModEnd> ( p_cp -> <S2SV_ModStart> p_cp -> tdy, <S2SV_ModEnd> p_image -> y1
Buggy code:
 LUA_API void lua_sethook ( lua_State * L, lua_Hook func, int mask, int count ) { if ( func == NULL || mask == 0 ) { mask = 0 ; func = NULL ; } <START_BUG> if ( isLua ( L -> ci ) ) <END_BUG> L -> oldpc = L -> ci -> u. l. savedpc ; L -> hook = func ; L -> basehookcount = count ; resethookcount ( L ) ; L -> hookmask = cast_byte ( mask ) ; if ( mask ) settraps ( L -> ci ) ; }

Fix:
<S2SV_ModStart> NULL ; } <S2SV_ModEnd> L -> hook
Buggy code:
 BIO * PKCS7_dataDecode ( PKCS7 * p7, EVP_PKEY * pkey, BIO * in_bio, X509 * pcert ) { int i, j ; BIO * out = NULL, * btmp = NULL, * etmp = NULL, * bio = NULL ; X509_ALGOR * xa ; ASN1_OCTET_STRING * data_body = NULL ; const EVP_MD * evp_md ; const EVP_CIPHER * evp_cipher = NULL ; EVP_CIPHER_CTX * evp_ctx = NULL ; X509_ALGOR * enc_alg = NULL ; STACK_OF ( X509_ALGOR ) * md_sk = NULL ; STACK_OF ( PKCS7_RECIP_INFO ) * rsk = NULL ; PKCS7_RECIP_INFO * ri = NULL ; unsigned char * ek = NULL, * tkey = NULL ; int eklen = 0, tkeylen = 0 ; if ( p7 == NULL ) { PKCS7err ( PKCS7_F_PKCS7_DATADECODE, PKCS7_R_INVALID_NULL_POINTER ) ; return NULL ; } if ( p7 -> d. ptr == NULL ) { PKCS7err ( PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT ) ; return NULL ; } i = OBJ_obj2nid ( p7 -> type ) ; p7 -> state = PKCS7_S_HEADER ; switch ( i ) { case NID_pkcs7_signed : data_body = PKCS7_get_octet_string ( p7 -> d. sign -> contents ) ; if (! PKCS7_is_detached ( p7 ) && data_body == NULL ) { PKCS7err ( PKCS7_F_PKCS7_DATADECODE, PKCS7_R_INVALID_SIGNED_DATA_TYPE ) ; goto err ; } md_sk = p7 -> d. sign -> md_algs ; break ; case NID_pkcs7_signedAndEnveloped : rsk = p7 -> d. signed_and_enveloped -> recipientinfo ; md_sk = p7 -> d. signed_and_enveloped -> md_algs ; data_body = p7 -> d. signed_

Fix:
<S2SV_ModStart> } if ( data_body == NULL && in_bio == NULL ) { PKCS7err ( PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT ) ; goto err ; } if ( <S2SV_ModStart> } if ( <S2SV_ModEnd> in_bio!= NULL <S2SV_ModStart>!= NULL ) <S2SV_ModEnd> { bio =
Buggy code:
 static pdf_creator_t * new_creator ( int * n_elements ) { pdf_creator_t * daddy ; static const pdf_creator_t creator_template [ ] = { { "Title", "" }, { "Author", "" }, { "Subject", "" }, { "Keywords", "" }, { "Creator", "" }, { "Producer", "" }, { "CreationDate", "" }, { "ModDate", "" }, { "Trapped", "" }, } ; <START_BUG> daddy = malloc ( sizeof ( creator_template ) ) ; <END_BUG> memcpy ( daddy, creator_template, sizeof ( creator_template ) ) ; if ( n_elements ) * n_elements = sizeof ( creator_template ) // sizeof ( creator_template [ 0 ] ) ; return daddy ; }

Fix:
<S2SV_ModStart> ; daddy = safe_calloc <S2SV_ModEnd> ( sizeof (
Buggy code:
 static struct clock_source * dce120_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( * clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dce112_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;
Buggy code:
 static int udf_read_inode ( struct inode * inode, bool hidden_inode ) { struct buffer_head * bh = NULL ; struct fileEntry * fe ; struct extendedFileEntry * efe ; uint16_t ident ; struct udf_inode_info * iinfo = UDF_I ( inode ) ; struct udf_sb_info * sbi = UDF_SB ( inode -> i_sb ) ; struct kernel_lb_addr * iloc = & iinfo -> i_location ; unsigned int link_count ; unsigned int indirections = 0 ; int bs = inode -> i_sb -> s_blocksize ; int ret = - EIO ; reread : if ( iloc -> logicalBlockNum >= sbi -> s_partmaps [ iloc -> partitionReferenceNum ]. s_partition_len ) { udf_debug ( "block=%d,   partition=%d   out   of   range\\n", iloc -> logicalBlockNum, iloc -> partitionReferenceNum ) ; return - EIO ; } bh = udf_read_ptagged ( inode -> i_sb, iloc, 0, & ident ) ; if (! bh ) { udf_err ( inode -> i_sb, "(ino   %ld)   failed  !bh\\n", inode -> i_ino ) ; return - EIO ; } if ( ident!= TAG_IDENT_FE && ident!= TAG_IDENT_EFE && ident!= TAG_IDENT_USE ) { udf_err ( inode -> i_sb, "(ino   %ld)   failed   ident=%d\\n", inode -> i_ino, ident ) ; goto out ; } fe = ( struct fileEntry * ) bh -> b_data ; efe = ( struct extendedFileEntry * ) bh -> b_data ; if ( fe -> icbTag. strategyType == cpu_to_le16 ( 4096 ) ) { struct buffer_head * ibh ; ibh = udf_read_ptagged ( inode -> i_sb, iloc, 1, & ident ) ; if ( ident == TAG_IDENT_IE && ibh ) { struct kernel_lb_addr loc ; struct indirectEntry * ie ; ie = ( struct indirectEntry * ) ibh -> b_data ; loc = lelb_to_cpu ( ie -> indirectICB. extLocation ) ; if ( ie -> indirectICB

Fix:
<S2SV_ModStart> ( iinfo -> i_lenEAttr > bs || iinfo -> i_lenAlloc > bs ) goto out ; if ( udf_file_entry_alloc_offset ( inode ) + iinfo -> i_lenAlloc > bs ) goto out ; if ( iinfo ->
Buggy code:
 <START_BUG> static unsigned int XBMInteger ( Image * image, short int * hex_digits ) <END_BUG> { int c ; unsigned int value ; do { c = ReadBlobByte ( image ) ; if ( c == EOF )  return ( 0 ) ; <START_BUG> } while ( ( c ==' ') || ( c == '\\t' ) || ( c == '\\n' ) || ( c == '\\r' ) ) ; value = 0 ; while ( hex_digits [ c ] >= 0 ) { if ( value > ( unsigned int ) ( INT_MAX // 10 ) ) break ; value *= 16 ; c &= 0xff ; if ( value > ( unsigned int ) ( INT_MAX - hex_digits [ c ] ) ) break ; value += hex_digits [ c ] ; c = ReadBlobByte ( image ) ; if ( c == EOF ) <END_BUG> return ( 0 ) ;  } <START_BUG> return ( value ) ; <END_BUG> }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static <S2SV_ModEnd> int XBMInteger ( <S2SV_ModStart> ) return ( - 1 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) return ( - 1 <S2SV_ModEnd> ) ; } <S2SV_ModStart> } return ( ( int )
Buggy code:
 int tls1_mac ( SSL * ssl, SSL3_RECORD * rec, unsigned char * md, int send ) { unsigned char * seq ; EVP_MD_CTX * hash ; size_t md_size ; int i ; EVP_MD_CTX * hmac = NULL, * mac_ctx ; unsigned char header [ 13 ] ; int stream_mac = ( send? ( ssl -> mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM ) : ( ssl -> mac_flags & SSL_MAC_FLAG_READ_MAC_STREAM ) ) ; int t ; if ( send ) { seq = RECORD_LAYER_get_write_sequence ( & ssl -> rlayer ) ; hash = ssl -> write_hash ; } else { seq = RECORD_LAYER_get_read_sequence ( & ssl -> rlayer ) ; hash = ssl -> read_hash ; } t = EVP_MD_CTX_size ( hash ) ; OPENSSL_assert ( t >= 0 ) ; md_size = t ; if ( stream_mac ) { mac_ctx = hash ; } else { hmac = EVP_MD_CTX_new ( ) ; if ( hmac == NULL ||! EVP_MD_CTX_copy ( hmac, hash ) ) return - 1 ; mac_ctx = hmac ; } if ( SSL_IS_DTLS ( ssl ) ) { unsigned char dtlsseq [ 8 ], * p = dtlsseq ; s2n ( send? DTLS_RECORD_LAYER_get_w_epoch ( & ssl -> rlayer ) : DTLS_RECORD_LAYER_get_r_epoch ( & ssl -> rlayer ), p ) ; memcpy ( p, & seq [ 2 ], 6 ) ; memcpy ( header, dtlsseq, 8 ) ; } else memcpy ( header, seq, 8 ) ; header [ 8 ] = rec -> type ; header [ 9 ] = ( unsigned char ) ( ssl -> version >> 8 ) ; header [ 10 ] = ( unsigned char ) ( ssl -> version ) ; header [ 11 ] = ( rec -> length ) >> 8 ; header [ 12 ] = ( rec -> length ) & 0xff ; <START_BUG> if (! send &&! SSL_USE_ETM ( ssl ) && <END_BUG> EVP_CIPHER_CTX_mode ( ssl -> enc_read

Fix:
<S2SV_ModStart> send &&! SSL_READ_ETM <S2SV_ModEnd> ( ssl ) <S2SV_ModStart> send &&! SSL_READ_ETM <S2SV_ModEnd> ( ssl )
Buggy code:
 static int renameUnmapSelectCb ( Walker * pWalker, Select * p ) { Parse * pParse = pWalker -> pParse ; int i ; if ( pParse -> nErr ) return WRC_Abort ; <START_BUG> if ( ALWAYS ( p -> pEList ) ) { <END_BUG> ExprList * pList = p -> pEList ; for ( i = 0 ; i < pList -> nExpr ; i ++ ) { if ( pList -> a [ i ]. zName ) { sqlite3RenameTokenRemap ( pParse, 0, ( void * ) pList -> a [ i ]. zName ) ; } } } if ( ALWAYS ( p -> pSrc ) ) { SrcList * pSrc = p -> pSrc ; for ( i = 0 ; i < pSrc -> nSrc ; i ++ ) { sqlite3RenameTokenRemap ( pParse, 0, ( void * ) pSrc -> a [ i ]. zName ) ; } } renameWalkWith ( pWalker, p ) ; return WRC_Continue ; }

Fix:
<S2SV_ModStart> ; if ( p -> selFlags & SF_View ) return WRC_Prune ; if (
Buggy code:
 static int l2tp_ip_bind ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct sockaddr_l2tpip * addr = ( struct sockaddr_l2tpip * ) uaddr ; struct net * net = sock_net ( sk ) ; int ret ; int chk_addr_ret ; <START_BUG> if (! sock_flag ( sk, SOCK_ZAPPED ) ) <END_BUG> return - EINVAL ;  if ( addr_len < sizeof ( struct sockaddr_l2tpip ) ) <START_BUG> return - EINVAL ; <END_BUG> if ( addr -> l2tp_family!= AF_INET )  return - EINVAL ; ret = - EADDRINUSE ; read_lock_bh ( & l2tp_ip_lock ) ; if ( __l2tp_ip_bind_lookup ( net, addr -> l2tp_addr. s_addr, sk -> sk_bound_dev_if, addr -> l2tp_conn_id ) ) goto out_in_use ; read_unlock_bh ( & l2tp_ip_lock ) ; <START_BUG> lock_sock ( sk ) ; <END_BUG> if ( sk -> sk_state!= TCP_CLOSE || addr_len < sizeof ( struct sockaddr_l2tpip ) ) goto out ; chk_addr_ret = inet_addr_type ( net, addr -> l2tp_addr. s_addr ) ; ret = - EADDRNOTAVAIL ; if ( addr -> l2tp_addr. s_addr && chk_addr_ret!= RTN_LOCAL && chk_addr_ret!= RTN_MULTICAST && chk_addr_ret!= RTN_BROADCAST ) goto out ; if ( addr -> l2tp_addr. s_addr ) inet -> inet_rcv_saddr = inet -> inet_saddr = addr -> l2tp_addr. s_addr ; if ( chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST ) inet -> inet_saddr = 0 ; sk_dst_reset ( sk ) ; l2tp_ip_sk ( sk ) -> conn_id = addr -> l2tp_conn_id ; write_

Fix:
<S2SV_ModStart> ; if ( addr_len < sizeof ( struct sockaddr_l2tpip <S2SV_ModEnd> ) ) return <S2SV_ModStart> ; if ( addr -> l2tp_family!= AF_INET <S2SV_ModEnd> ) return - <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> ret = - <S2SV_ModStart> ( sk ) ; if (! sock_flag ( sk, SOCK_ZAPPED ) ) goto out
Buggy code:
 int common_timer_set ( struct k_itimer * timr, int flags, struct itimerspec64 * new_setting, struct itimerspec64 * old_setting ) { const struct k_clock * kc = timr -> kclock ; bool sigev_none ; ktime_t expires ; if ( old_setting ) common_timer_get ( timr, old_setting ) ; timr -> it_interval = 0 ; if ( kc -> timer_try_to_cancel ( timr ) < 0 ) return TIMER_RETRY ; timr -> it_active = 0 ; timr -> it_requeue_pending = ( timr -> it_requeue_pending + 2 ) & ~ REQUEUE_PENDING ; timr -> it_overrun_last = 0 ; if (! new_setting -> it_value. tv_sec &&! new_setting -> it_value. tv_nsec ) return 0 ; timr -> it_interval = timespec64_to_ktime ( new_setting -> it_interval ) ; expires = timespec64_to_ktime ( new_setting -> it_value ) ; <START_BUG> sigev_none = ( timr -> it_sigev_notify & ~ SIGEV_THREAD_ID ) == SIGEV_NONE ; <END_BUG> kc -> timer_arm ( timr, expires, flags & TIMER_ABSTIME, sigev_none ) ; timr -> it_active =! sigev_none ; return 0 ; }

Fix:
<S2SV_ModStart> ; sigev_none = <S2SV_ModEnd> timr -> it_sigev_notify <S2SV_ModStart> timr -> it_sigev_notify <S2SV_ModEnd> == SIGEV_NONE ;
Buggy code:
 <START_BUG> static void prob_diff_update ( const vp9_tree_index * tree, <END_BUG>  vp9_prob probs [ ], <START_BUG> const unsigned int counts [ ], <END_BUG> int n, vp9_writer * w ) {  int i ; unsigned int branch_ct [ 32 ] [ 2 ] ; assert ( n <= 32 ) ; vp9_tree_probs_from_distribution ( tree, branch_ct, counts ) ; for ( i = 0 ; i < n - 1 ; ++ i ) vp9_cond_prob_diff_update ( w, & probs [ i ], branch_ct [ i ] ) ; }

Fix:
<S2SV_ModStart> prob_diff_update ( const vpx_tree_index <S2SV_ModEnd> * tree, <S2SV_ModStart> * tree, vpx_prob <S2SV_ModEnd> probs [ ] <S2SV_ModStart> int n, vpx_writer <S2SV_ModEnd> * w )
Buggy code:
 static void untrusted_launcher_response_callback ( GtkDialog * dialog, int response_id, ActivateParametersDesktop * parameters ) { GdkScreen * screen ; char * uri ; GFile * file ; switch ( response_id ) { <START_BUG> case RESPONSE_RUN : <END_BUG> { screen = gtk_widget_get_screen ( GTK_WIDGET ( parameters -> parent_window ) ) ; uri = nautilus_file_get_uri ( parameters -> file ) ; DEBUG ( "Launching   untrusted   launcher   %s", uri ) ; nautilus_launch_desktop_file ( screen, uri, NULL, parameters -> parent_window ) ; g_free ( uri ) ;  } <START_BUG> break ; case RESPONSE_MARK_TRUSTED : { file = nautilus_file_get_location ( parameters -> file ) ; nautilus_file_mark_desktop_file_trusted ( file, parameters -> parent_window, TRUE, NULL, NULL ) ; g_object_unref ( file ) ; } break ; default : { } break ; } gtk_widget_destroy ( GTK_WIDGET ( dialog ) ) ; activate_parameters_desktop_free ( parameters ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { case GTK_RESPONSE_OK : { file = nautilus_file_get_location ( parameters -> file ) ; nautilus_file_set_metadata ( parameters -> file, NAUTILUS_METADATA_KEY_DESKTOP_FILE_TRUSTED, NULL, "yes" ) ; nautilus_file_mark_desktop_file_executable ( file, parameters -> parent_window, TRUE, NULL, NULL ) ; nautilus_file_invalidate_all_attributes ( parameters -> file ) ; <S2SV_ModEnd> screen = gtk_widget_get_screen <S2SV_ModStart> uri ) ; <S2SV_ModEnd> g_object_unref ( file
Buggy code:
 static int crypto_skcipher_init_tfm ( struct crypto_tfm * tfm ) { struct crypto_skcipher * skcipher = __crypto_skcipher_cast ( tfm ) ; struct skcipher_alg * alg = crypto_skcipher_alg ( skcipher ) ; if ( tfm -> __crt_alg -> cra_type == & crypto_blkcipher_type ) return crypto_init_skcipher_ops_blkcipher ( tfm ) ; if ( tfm -> __crt_alg -> cra_type == & crypto_ablkcipher_type || tfm -> __crt_alg -> cra_type == & crypto_givcipher_type ) return crypto_init_skcipher_ops_ablkcipher ( tfm ) ; <START_BUG> skcipher -> setkey = alg -> setkey ; <END_BUG> skcipher -> encrypt = alg -> encrypt ; skcipher -> decrypt = alg -> decrypt ; skcipher -> ivsize = alg -> ivsize ; skcipher -> keysize = alg -> max_keysize ; if ( alg -> exit ) skcipher -> base. exit = crypto_skcipher_exit_tfm ; if ( alg -> init ) return alg -> init ( skcipher ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> setkey = skcipher_setkey <S2SV_ModEnd> ; skcipher ->
Buggy code:
 static void ssdp_recv ( int sd ) { ssize_t len ; struct sockaddr sa ; socklen_t salen ; <START_BUG> char buf [ MAX_PKT_SIZE ] ; <END_BUG> memset ( buf, 0, sizeof ( buf ) ) ;  len = recvfrom ( sd, buf, sizeof ( buf ), MSG_DONTWAIT, & sa, & salen ) ; <START_BUG> if ( len > 0 ) { <END_BUG> buf [ len ] = 0 ;  if ( sa. sa_family!= AF_INET ) return ; if ( strstr ( buf, "M-SEARCH   *" ) ) { size_t i ; char * ptr, * type ; struct ifsock * ifs ; struct sockaddr_in * sin = ( struct sockaddr_in * ) & sa ; ifs = find_outbound ( & sa ) ; if (! ifs ) { logit ( LOG_DEBUG, "No   matching   socket   for   client   %s", inet_ntoa ( sin -> sin_addr ) ) ; return ; } logit ( LOG_DEBUG, "Matching   socket   for   client   %s", inet_ntoa ( sin -> sin_addr ) ) ; type = strcasestr ( buf, "\\r\\nST:" ) ; if (! type ) { logit ( LOG_DEBUG, "No   Search   Type   (ST:)   found   in   M-SEARCH   *,   assuming   " SSDP_ST_ALL ) ; type = SSDP_ST_ALL ; send_message ( ifs, type, & sa ) ; return ; } type = strchr ( type, ':' ) ; if (! type ) return ; type ++ ; while ( isspace ( * type ) ) type ++ ; ptr = strstr ( type, "\\r\\n" ) ; if (! ptr ) return ; * ptr = 0 ; for ( i = 0 ; supported_types [ i ] ; i ++ ) { if (! strcmp ( supported_types [ i ], type ) ) { logit ( LOG_DEBUG, "M-SEARCH   *   ST:   %s   from   %s   port   %d", type, inet_ntoa ( sin -> sin_addr ), ntohs ( sin -> sin_port ) ) ; send_message ( ifs, type, & sa )

Fix:
<S2SV_ModStart> buf [ MAX_PKT_SIZE + 1 <S2SV_ModStart> ( buf ) - 1 <S2SV_ModStart> 0 ) { <S2SV_ModEnd> if ( sa
Buggy code:
 static unsigned long randomize_stack_top ( unsigned long stack_top ) { <START_BUG> unsigned int random_variable = 0 ; <END_BUG> if ( ( current -> flags & PF_RANDOMIZE ) &&! ( current -> personality & ADDR_NO_RANDOMIZE ) ) {  random_variable = get_random_int ( ) & STACK_RND_MASK ; <START_BUG> random_variable <<= PAGE_SHIFT ; } # ifdef CONFIG_STACK_GROWSUP return PAGE_ALIGN ( stack_top ) + random_variable ; # else return PAGE_ALIGN ( stack_top ) - random_variable ; # endif }<END_BUG>

Fix:
<S2SV_ModStart> ) { unsigned long <S2SV_ModEnd> random_variable = 0 <S2SV_ModStart> { random_variable = ( unsigned long ) <S2SV_ModStart> get_random_int ( ) ; random_variable &= <S2SV_ModEnd> STACK_RND_MASK ; random_variable
Buggy code:
 static void vmx_set_msr_bitmap ( struct kvm_vcpu * vcpu ) { unsigned long * msr_bitmap ; if ( is_guest_mode ( vcpu ) ) msr_bitmap = vmx_msr_bitmap_nested ; <START_BUG> else if ( vcpu -> arch. apic_base & X2APIC_ENABLE ) { <END_BUG> if ( is_long_mode ( vcpu ) ) msr_bitmap = vmx_msr_bitmap_longmode_x2apic ; else msr_bitmap = vmx_msr_bitmap_legacy_x2apic ; } else { if ( is_long_mode ( vcpu ) ) msr_bitmap = vmx_msr_bitmap_longmode ; else msr_bitmap = vmx_msr_bitmap_legacy ; } vmcs_write64 ( MSR_BITMAP, __pa ( msr_bitmap ) ) ; }

Fix:
<S2SV_ModStart> else if ( cpu_has_secondary_exec_ctrls ( ) && ( vmcs_read32 ( SECONDARY_VM_EXEC_CONTROL ) & SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE ) <S2SV_ModEnd> ) { if
Buggy code:
 static Image * handle_add_command ( GraphicsManager * self, const GraphicsCommand * g, const uint8_t * payload, bool * is_dirty, uint32_t iid ) { # define ABRT ( code,... ) { set_add_response ( # code, __VA_ARGS__ ) ; self -> loading_image = 0 ; if ( img ) img -> data_loaded = false ; return NULL ; } # define MAX_DATA_SZ ( 4u * 100000000u ) has_add_respose = false ; bool existing, init_img = true ; Image * img = NULL ; unsigned char tt = g -> transmission_type? g -> transmission_type : 'd' ; enum FORMATS { RGB = 24, RGBA = 32, PNG = 100 } ; uint32_t fmt = g -> format? g -> format : RGBA ; if ( tt == 'd' && self -> loading_image ) init_img = false ; if ( init_img ) { self -> last_init_graphics_command = * g ; self -> last_init_graphics_command. id = iid ; self -> loading_image = 0 ; if ( g -> data_width > 10000 || g -> data_height > 10000 ) ABRT ( EINVAL, "Image   too   large" ) ; remove_images ( self, add_trim_predicate, 0 ) ; img = find_or_create_image ( self, iid, & existing ) ; if ( existing ) { free_load_data ( & img -> load_data ) ; img -> data_loaded = false ; free_refs_data ( img ) ; * is_dirty = true ; self -> layers_dirty = true ; } else { img -> internal_id = internal_id_counter ++ ; img -> client_id = iid ; } img -> atime = monotonic ( ) ; img -> used_storage = 0 ; img -> width = g -> data_width ; img -> height = g -> data_height ; switch ( fmt ) { case PNG : if ( g -> data_sz > MAX_DATA_SZ ) ABRT ( EINVAL, "PNG   data   size   too   large" ) ; img -> load_data. is_4byte_aligned = true ; img -> load_data. is_opaque = false ; img -> load_data. data

Fix:
<S2SV_ModStart> ( EBADF, "Failed <S2SV_blank> to <S2SV_blank> open <S2SV_blank> file <S2SV_blank> for <S2SV_blank> graphics <S2SV_blank> transmission <S2SV_blank> with <S2SV_blank> error: <S2SV_blank> [%d] <S2SV_blank> %s" <S2SV_ModEnd>, errno,
Buggy code:
 static OPJ_BOOL opj_j2k_write_all_tile_parts ( opj_j2k_t * p_j2k, OPJ_BYTE * p_data, OPJ_UINT32 * p_data_written, OPJ_UINT32 p_total_data_size, opj_stream_private_t * p_stream, struct opj_event_mgr * p_manager ) { OPJ_UINT32 tilepartno = 0 ; OPJ_UINT32 l_nb_bytes_written = 0 ; OPJ_UINT32 l_current_nb_bytes_written ; OPJ_UINT32 l_part_tile_size ; OPJ_UINT32 tot_num_tp ; OPJ_UINT32 pino ; OPJ_BYTE * l_begin_data ; opj_tcp_t * l_tcp = 00 ; opj_tcd_t * l_tcd = 00 ; opj_cp_t * l_cp = 00 ; l_tcd = p_j2k -> m_tcd ; l_cp = & ( p_j2k -> m_cp ) ; l_tcp = l_cp -> tcps + p_j2k -> m_current_tile_number ; tot_num_tp = opj_j2k_get_num_tp ( l_cp, 0, p_j2k -> m_current_tile_number ) ; ++ p_j2k -> m_specific_param. m_encoder. m_current_tile_part_number ; for ( tilepartno = 1 ; tilepartno < tot_num_tp ; ++ tilepartno ) { p_j2k -> m_specific_param. m_encoder. m_current_poc_tile_part_number = tilepartno ; l_current_nb_bytes_written = 0 ; l_part_tile_size = 0 ; l_begin_data = p_data ; <START_BUG> if (! opj_j2k_write_sot ( p_j2k, p_data, & l_current_nb_bytes_written, p_stream, <END_BUG> p_manager ) ) { return OPJ_FALSE ; } l_nb_bytes_written += l_current_nb

Fix:
<S2SV_ModStart>, p_data, p_total_data_size, <S2SV_ModStart>, p_data, p_total_data_size,
Buggy code:
 jas_image_t * bmp_decode ( jas_stream_t * in, char * optstr ) { jas_image_t * image ; bmp_hdr_t hdr ; bmp_info_t * info ; uint_fast16_t cmptno ; jas_image_cmptparm_t cmptparms [ 3 ] ; jas_image_cmptparm_t * cmptparm ; uint_fast16_t numcmpts ; long n ; <START_BUG> if ( optstr ) { <END_BUG> jas_eprintf ( "warning:   ignoring   BMP   decoder   options\\n" ) ; } jas_eprintf ( "THE   BMP   FORMAT   IS   NOT   FULLY   SUPPORTED!\\n" "THAT   IS,   THE   JASPER   SOFTWARE   CANNOT   DECODE   ALL   TYPES   OF   BMP   DATA.\\n" "IF   YOU   HAVE   ANY   PROBLEMS,   PLEASE   TRY   CONVERTING   YOUR   IMAGE   DATA\\n" "TO   THE   PNM   FORMAT,   AND   USING   THIS   FORMAT   INSTEAD.\\n" ) ; if ( bmp_gethdr ( in, & hdr ) ) { jas_eprintf ( "cannot   get   header\\n" ) ;  return 0 ; <START_BUG> } JAS_DBGLOG ( 1, ( "BMP   header:   magic   0x%x;   siz   %d;   res1   %d;   res2   %d;   off   %d\\n", hdr. magic, hdr. siz, hdr. reserved1, hdr. reserved2, hdr. off ) ) ; if (! ( info = bmp_getinfo ( in ) ) ) { jas_eprintf ( "cannot   get   info\\n" ) ; <END_BUG> return 0 ;  } JAS_DBGLOG ( 1, <START_BUG> ( "BMP   information:   len   %d;   width   %d;   height   %d;   numplanes   %d;   " <END_BUG> "depth   %d;   enctype   %d;   siz   %d;   hres   %d;   v

Fix:
<S2SV_ModStart> long n ; image = 0 ; info = 0 ; <S2SV_ModStart> "cannot <S2SV_blank> get <S2SV_blank> header\\n" ) ; goto error <S2SV_ModEnd> ; } JAS_DBGLOG <S2SV_ModStart> "cannot <S2SV_blank> get <S2SV_blank> info\\n" ) ; goto error <S2SV_ModEnd> ; } JAS_DBGLOG <S2SV_ModStart> 1, ( "BMP <S2SV_blank> information: <S2SV_blank> len <S2SV_blank> %ld; <S2SV_blank> width <S2SV_blank> %ld; <S2SV_blank> height <S2SV_blank> %ld; <S2SV_blank> numplanes <S2SV_blank> %d; <S2SV_blank> " "depth <S2SV_blank> %d; <S2SV_blank> enctype <S2SV_blank> %ld; <S2SV_blank> siz <S2SV_blank> %ld; <S2SV_blank> hres <S2SV_blank> %ld; <S2SV_blank> vres <S2SV_blank> %ld; <S2SV_blank> numcolors <S2SV_blank> %ld; <S2SV_blank> " "mincolors <S2SV_blank> %ld\\n", JAS_CAST ( long <S2SV_ModEnd>, info -> <S2SV_ModStart> info -> len ), JAS_CAST ( long <S2SV_ModStart> info -> width ), JAS_CAST ( long <S2SV_ModStart> info -> height ), JAS_CAST ( long <S2SV_ModStart> info -> numplanes ), JAS_CAST ( long, <S2SV_ModEnd> info -> depth <S2SV_ModStart> info -> depth ), JAS_CAST ( long <S2SV_ModStart> info -> enctype ), JAS_CAST ( long <S2SV_ModStart> info -> siz ), JAS_CAST ( long <S2SV_ModStart> info
Buggy code:
 <START_BUG> static const char * parse_object ( cJSON * item, const char * value ) <END_BUG> { cJSON * child ; if ( * value!= '{' ) {  ep = value ; <START_BUG> return 0 ; } item -> type = cJSON_Object ; value = skip ( value + 1 ) ; if ( * value == '}' ) <END_BUG> return value + 1 ;  <START_BUG> if (! ( item -> child = child = cJSON_New_Item ( ) ) ) <END_BUG> return 0 ;  if (! ( value = skip ( parse_string ( child, skip ( value ) ) ) ) ) <START_BUG> return 0 ; child -> string = child -> valuestring ; child -> valuestring = 0 ; if ( * value!= ':' ) { <END_BUG> ep = value ;  return 0 ; } <START_BUG> if (! ( value = skip ( parse_value ( child, skip ( value + 1 ) ) ) ) ) <END_BUG> return 0 ; while ( * value == ',' ) { cJSON * new_item ; if (! ( new_item = cJSON_New_Item ( ) ) ) return 0 ; child -> next = new_item ; new_item -> prev = child ;  child = new_item ; <START_BUG> <END_BUG> if (! ( value = skip ( parse_string ( child, skip ( value + 1 ) ) ) ) )  return 0 ; child -> string = child -> valuestring ; child -> valuestring = 0 ; if ( * value!= ':' ) { <START_BUG> ep = value ; <END_BUG> return 0 ; }  if (! ( value = skip ( parse_value ( child, skip ( value + 1 ) ) ) ) ) <START_BUG> return 0 ; } if ( * value == '}' ) <END_BUG> return value + 1 ;  ep = value ; return 0 ; }

Fix:
<S2SV_ModStart> char * value, const char * * ep <S2SV_ModStart> '{' ) { * ep = value ; return 0 ; <S2SV_ModEnd> } item -> <S2SV_ModStart> == '}' ) return value + 1 ; <S2SV_ModEnd> item -> child <S2SV_ModStart> cJSON_New_Item ( ) ; if (! item -> child ) return 0 ; <S2SV_ModEnd> value = skip <S2SV_ModStart> ( value ), ep ) ) ; if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> ':' ) { * ep = value ; return 0 ; } <S2SV_ModEnd> value = skip <S2SV_ModStart> + 1 ), ep ) ) ; if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> = child ; child = new_item ; <S2SV_ModEnd> value = skip <S2SV_ModStart> + 1 ), ep ) ) ; if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> ':' ) { * ep = value ; return 0 ; } <S2SV_ModEnd> value = skip <S2SV_ModStart> + 1 ), ep ) ) ; if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> == '}' ) return value + 1 ; * ep = value ; <S2SV_ModEnd> return 0 ;
Buggy code:
 int <START_BUG> run_cmd ( int fd,... ) <END_BUG> { pid_t pid ; sigset_t sigm, sigm_old ; sigemptyset ( & sigm ) ; sigaddset ( & sigm, SIGTERM ) ; sigprocmask ( SIG_BLOCK, & sigm, & sigm_old ) ; pid = fork ( ) ; if ( pid < 0 ) { sigprocmask ( SIG_SETMASK, & sigm_old, NULL ) ; fd_printf ( STO, "***   cannot   fork:   %s   ***\\r\\n", strerror ( errno ) ) ; return - 1 ; } else if ( pid ) { int status, r ; sigprocmask ( SIG_SETMASK, & sigm_old, NULL ) ; do { r = waitpid ( pid, & status, 0 ) ; } while ( r < 0 && errno == EINTR ) ; term_apply ( STI ) ; if ( WIFEXITED ( status ) ) { fd_printf ( STO, "\\r\\n***   exit   status:   %d   ***\\r\\n", WEXITSTATUS ( status ) ) ; return WEXITSTATUS ( status ) ; } else if ( WIFSIGNALED ( status ) ) { fd_printf ( STO, "\\r\\n***   killed   by   signal:   %d   ***\\r\\n", WTERMSIG ( status ) ) ; return - 1 ; } else { fd_printf ( STO, "\\r\\n***   abnormal   termination:   0x%x   ***\\r\\n", r ) ; return - 1 ; } } else { long fl ;  char cmd [ 512 ] ; <START_BUG> term_remove ( STI ) ; term_erase ( fd ) ; fl = fcntl ( fd, F_GETFL ) ; fl &= ~ O_NONBLOCK ; fcntl ( fd, F_SETFL, fl ) ; close ( STI ) ; close ( STO ) ; dup2 ( fd, STI ) ; dup2 ( fd, STO ) ; <END_BUG> {  char * c, * ce ; const char * s ; int n ; va_list vls ; <START_BUG> strcpy ( cmd, EXEC ) ; <END_BUG> c = & cmd [ sizeof ( EXEC ) - 1 ] ; ce = cmd + sizeof ( cmd )

Fix:
<S2SV_ModStart> int fd, const char * cmd, const char * args_extra <S2SV_ModEnd> ) { pid_t <S2SV_ModStart> long fl ; int argc ; char * argv [ RUNCMD_ARGS_MAX + 1 ] ; int r <S2SV_ModEnd> ; term_remove ( <S2SV_ModStart> STO ) ; argc = 0 ; r = split_quoted <S2SV_ModEnd> ( cmd, <S2SV_ModStart> ( cmd, & argc, argv, RUNCMD_ARGS_MAX ) ; if ( r < 0 ) { fd_printf ( STDERR_FILENO, "Cannot <S2SV_blank> parse <S2SV_blank> command\\n" ) ; exit ( RUNCMD_EXEC_FAIL ) ; } r = split_quoted ( args_extra, & argc, argv, RUNCMD_ARGS_MAX ) ; if ( r < 0 ) { fd_printf ( STDERR_FILENO, "Cannot <S2SV_blank> parse <S2SV_blank> extra <S2SV_blank> args\\n" ) ; exit ( RUNCMD_EXEC_FAIL ) ; } if ( argc < 1 ) { fd_printf ( STDERR_FILENO, "No <S2SV_blank> command <S2SV_blank> given\\n" ) ; exit ( RUNCMD_EXEC_FAIL ) ; } argv [ argc ] = NULL ; fd_printf ( STDERR_FILENO, "$ <S2SV_blank> %s <S2SV_blank> %s\\n
Buggy code:
 static int peer_recv_callback ( rdpTransport * transport, wStream * s, void * extra ) { freerdp_peer * client = ( freerdp_peer * ) extra ; rdpRdp * rdp = client -> context -> rdp ; switch ( rdp -> state ) { case CONNECTION_STATE_INITIAL : if (! rdp_server_accept_nego ( rdp, s ) ) return - 1 ; if ( rdp -> nego -> selected_protocol & PROTOCOL_NLA ) { sspi_CopyAuthIdentity ( & client -> identity, & ( rdp -> nego -> transport -> credssp -> identity ) ) ; IFCALLRET ( client -> Logon, client -> authenticated, client, & client -> identity, TRUE ) ; credssp_free ( rdp -> nego -> transport -> credssp ) ; <START_BUG> } <END_BUG> else { IFCALLRET ( client -> Logon, client -> authenticated, client, & client -> identity, FALSE ) ; } break ; case CONNECTION_STATE_NEGO : if (! rdp_server_accept_mcs_connect_initial ( rdp, s ) ) return - 1 ; break ; case CONNECTION_STATE_MCS_CONNECT : if (! rdp_server_accept_mcs_erect_domain_request ( rdp, s ) ) return - 1 ; break ; case CONNECTION_STATE_MCS_ERECT_DOMAIN : if (! rdp_server_accept_mcs_attach_user_request ( rdp, s ) ) return - 1 ; break ; case CONNECTION_STATE_MCS_ATTACH_USER : if (! rdp_server_accept_mcs_channel_join_request ( rdp, s ) ) return - 1 ; break ; case CONNECTION_STATE_MCS_CHANNEL_JOIN : if ( rdp -> settings -> DisableEncryption ) { if (! rdp_server_accept_client_keys ( rdp, s ) ) return - 1 ; break ; } rdp -> state = CONNECTION_STATE_ESTABLISH_KEYS ; case CONNECTION_STATE_ESTABLISH_KEYS : if (! rdp_server_accept_client_info ( rdp, s ) ) return - 1 ; IFCALL ( client -> Capabilities, client ) ; if (! rdp_send_demand_

Fix:
<S2SV_ModStart> credssp ) ; rdp -> nego -> transport -> credssp = NULL ;
Buggy code:
 int main ( int argc, char * * cargv ) { uschar * * argv = USS cargv ; int arg_receive_timeout = - 1 ; int arg_smtp_receive_timeout = - 1 ; int arg_error_handling = error_handling ; int filter_sfd = - 1 ; int filter_ufd = - 1 ; int group_count ; int i, rv ; int list_queue_option = 0 ; int msg_action = 0 ; int msg_action_arg = - 1 ; int namelen = ( argv [ 0 ] == NULL )? 0 : Ustrlen ( argv [ 0 ] ) ; int queue_only_reason = 0 ; # ifdef EXIM_PERL int perl_start_option = 0 ; # endif int recipients_arg = argc ; int sender_address_domain = 0 ; int test_retry_arg = - 1 ; int test_rewrite_arg = - 1 ; BOOL arg_queue_only = FALSE ; BOOL bi_option = FALSE ; BOOL checking = FALSE ; BOOL count_queue = FALSE ; BOOL expansion_test = FALSE ; BOOL extract_recipients = FALSE ; BOOL flag_G = FALSE ; BOOL flag_n = FALSE ; BOOL forced_delivery = FALSE ; BOOL f_end_dot = FALSE ; BOOL deliver_give_up = FALSE ; BOOL list_queue = FALSE ; BOOL list_options = FALSE ; BOOL list_config = FALSE ; BOOL local_queue_only ; BOOL more = TRUE ; BOOL one_msg_action = FALSE ; BOOL opt_D_used = FALSE ; BOOL queue_only_set = FALSE ; BOOL receiving_message = TRUE ; BOOL sender_ident_set = FALSE ; BOOL session_local_queue_only ; BOOL unprivileged ; BOOL removed_privilege = FALSE ; BOOL usage_wanted = FALSE ; BOOL verify_address_mode = FALSE ; BOOL verify_as_sender = FALSE ; BOOL version_printed = FALSE ; uschar * alias_arg = NULL ; uschar * called_as = US "" ; uschar * cmdline_syslog_name = NULL ; uschar * start_queue_run_id = NULL ; uschar * stop_queue_run_id = NULL ; uschar * expansion_

Fix:
<S2SV_ModStart> == 0 ) if ( received_protocol ) { fprintf ( stderr, "received_protocol <S2SV_blank> is <S2SV_blank> set <S2SV_blank> already\\n" ) ; exit ( EXIT_FAILURE ) ; } else <S2SV_ModStart> { uschar * hn ; if ( received_protocol ) { fprintf ( stderr, "received_protocol <S2SV_blank> is <S2SV_blank> set <S2SV_blank> already\\n" ) ; exit ( EXIT_FAILURE ) ; }
Buggy code:
 static void init_vmcb ( struct vcpu_svm * svm ) { struct vmcb_control_area * control = & svm -> vmcb -> control ; struct vmcb_save_area * save = & svm -> vmcb -> save ; svm -> vcpu. fpu_active = 1 ; svm -> vcpu. arch. hflags = 0 ; set_cr_intercept ( svm, INTERCEPT_CR0_READ ) ; set_cr_intercept ( svm, INTERCEPT_CR3_READ ) ; set_cr_intercept ( svm, INTERCEPT_CR4_READ ) ; set_cr_intercept ( svm, INTERCEPT_CR0_WRITE ) ; set_cr_intercept ( svm, INTERCEPT_CR3_WRITE ) ; set_cr_intercept ( svm, INTERCEPT_CR4_WRITE ) ; set_cr_intercept ( svm, INTERCEPT_CR8_WRITE ) ; set_dr_intercepts ( svm ) ; set_exception_intercept ( svm, PF_VECTOR ) ; set_exception_intercept ( svm, UD_VECTOR ) ; set_exception_intercept ( svm, MC_VECTOR ) ; <START_BUG> set_exception_intercept ( svm, AC_VECTOR ) ; <END_BUG> set_intercept ( svm, INTERCEPT_INTR ) ; set_intercept ( svm, INTERCEPT_NMI ) ; set_intercept ( svm, INTERCEPT_SMI ) ; set_intercept ( svm, INTERCEPT_SELECTIVE_CR0 ) ; set_intercept ( svm, INTERCEPT_RDPMC ) ; set_intercept ( svm, INTERCEPT_CPUID ) ; set_intercept ( svm, INTERCEPT_INVD ) ; set_intercept ( svm, INTERCEPT_HLT ) ; set_intercept ( svm, INTERCEPT_INVLPG ) ; set_intercept ( svm, INTERCEPT_INVLPGA ) ; set_intercept ( svm, INTERCEPT_IOIO_PROT ) ; set_intercept ( svm, INTERCEPT_MSR_PROT ) ; set_intercept ( svm, INTERCEPT_TASK_SWITCH ) ; set_intercept ( svm, INTERCEPT_SHUTDOWN ) ; set_intercept ( svm, INTERCEPT

Fix:
<S2SV_ModStart> svm, AC_VECTOR ) ; set_exception_intercept ( svm, DB_VECTOR
Buggy code:
 static void model_rd_for_sb_y ( VP9_COMP * cpi, BLOCK_SIZE bsize, MACROBLOCK * x, MACROBLOCKD * xd, <START_BUG> int * out_rate_sum, int64_t * out_dist_sum ) { <END_BUG> unsigned int sse ; int rate ; int64_t dist ; struct macroblock_plane * const p = & x -> plane [ 0 ] ; struct macroblockd_plane * const pd = & xd -> plane [ 0 ] ;  int var = cpi -> fn_ptr [ bsize ]. vf ( p -> src. buf, p -> src. stride, <START_BUG> pd -> dst. buf, pd -> dst. stride, & sse ) ; <END_BUG> vp9_model_rd_from_var_lapndz ( sse + var, 1 << num_pels_log2_lookup [ bsize ],  pd -> dequant [ 1 ] >> 3, & rate, & dist ) ; * out_rate_sum = rate ; * out_dist_sum = dist << 3 ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> int64_t * out_dist_sum, unsigned int * var_y, unsigned int * sse_y <S2SV_ModStart> 0 ] ; const int64_t dc_thr = p -> quant_thred [ 0 ] >> 6 ; const int64_t ac_thr = p -> quant_thred [ 1 ] >> 6 ; const uint32_t dc_quant = pd -> dequant [ 0 ] ; const uint32_t ac_quant = pd -> dequant [ 1 ] ; unsigned <S2SV_ModStart> sse ) ; int skip_dc = 0 ; * var_y = var ; * sse_y = sse ; if ( cpi -> common. tx_mode == TX_MODE_SELECT ) { if ( sse > ( var << 2 ) ) xd -> mi [ 0 ] -> mbmi. tx_size = MIN ( max_txsize_lookup [ bsize ], tx_mode_to_biggest_tx_size [ cpi -> common. tx_mode ] ) ; else xd -> mi [ 0 ] -> mbmi. tx_size = TX_8X8 ; if ( cpi -> oxcf. aq_mode == CYCLIC_REFRESH
Buggy code:
 int ASN1_item_verify ( const ASN1_ITEM * it, X509_ALGOR * a, ASN1_BIT_STRING * signature, void * asn, EVP_PKEY * pkey ) { EVP_MD_CTX ctx ; unsigned char * buf_in = NULL ; int ret = - 1, inl ; int mdnid, pknid ; if (! pkey ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ERR_R_PASSED_NULL_PARAMETER ) ; return - 1 ; } <START_BUG> EVP_MD_CTX_init ( & ctx ) ; <END_BUG> if (! OBJ_find_sigid_algs ( OBJ_obj2nid ( a -> algorithm ), & mdnid, & pknid ) ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM ) ; goto err ; } if ( mdnid == NID_undef ) { if (! pkey -> ameth ||! pkey -> ameth -> item_verify ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM ) ; goto err ; } ret = pkey -> ameth -> item_verify ( & ctx, it, asn, a, signature, pkey ) ; if ( ret!= 2 ) goto err ; ret = - 1 ; } else { const EVP_MD * type ; type = EVP_get_digestbynid ( mdnid ) ; if ( type == NULL ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ) ; goto err ; } if ( EVP_PKEY_type ( pknid )!= pkey -> ameth -> pkey_id ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_WRONG_PUBLIC_KEY_TYPE ) ; goto err ; } if (! EVP_DigestVerifyInit ( & ctx, NULL, type, NULL, pkey ) ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB ) ; ret = 0 ; goto err ; } } inl = ASN1_item_i2d ( asn

Fix:
<S2SV_ModStart> 1 ; } if ( signature -> type == V_ASN1_BIT_STRING && signature -> flags & 0x7 ) { ASN1err ( ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT ) ; return - 1 ; }
Buggy code:
 static int pop_sync_mailbox ( struct Context * ctx, int * index_hint ) { int i, j, ret = 0 ; char buf [ LONG_STRING ] ; struct PopData * pop_data = ( struct PopData * ) ctx -> data ; struct Progress progress ; # ifdef USE_HCACHE header_cache_t * hc = NULL ; # endif pop_data -> check_time = 0 ; while ( true ) { if ( pop_reconnect ( ctx ) < 0 ) return - 1 ; mutt_progress_init ( & progress, _ ( "Marking   messages   deleted..." ), MUTT_PROGRESS_MSG, WriteInc, ctx -> deleted ) ; # ifdef USE_HCACHE hc = pop_hcache_open ( pop_data, ctx -> path ) ; # endif for ( i = 0, j = 0, ret = 0 ; ret == 0 && i < ctx -> msgcount ; i ++ ) { if ( ctx -> hdrs [ i ] -> deleted && ctx -> hdrs [ i ] -> refno!= - 1 ) { j ++ ; if (! ctx -> quiet ) mutt_progress_update ( & progress, j, - 1 ) ; snprintf ( buf, sizeof ( buf ), "DELE   %d\\r\\n", ctx -> hdrs [ i ] -> refno ) ; ret = pop_query ( pop_data, buf, sizeof ( buf ) ) ; if ( ret == 0 ) { <START_BUG> mutt_bcache_del ( pop_data -> bcache, ctx -> hdrs [ i ] -> data ) ; <END_BUG> # ifdef USE_HCACHE mutt_hcache_delete ( hc, ctx -> hdrs [ i ] -> data, strlen ( ctx -> hdrs [ i ] -> data ) ) ; # endif } } # ifdef USE_HCACHE if ( ctx -> hdrs [ i ] -> changed ) { mutt_hcache_store ( hc, ctx -> hdrs [ i ] -> data, strlen ( ctx -> hdrs [ i ] -> data ), ctx -> hdrs [ i ], 0 ) ; } # endif } # ifdef USE_HCACHE mutt_hcache_close ( hc ) ; # endif if ( ret == 0 ) { mutt_str_strfcpy ( buf, "QUIT\\r\\n", sizeof ( buf ) ) ; ret = pop_query ( pop

Fix:
<S2SV_ModStart> -> bcache, cache_id ( <S2SV_ModStart> ] -> data )
Buggy code:
 cJSON * cJSON_Parse ( const char * value ) { <START_BUG> cJSON * c ; <END_BUG> ep = 0 ; if (! ( c = cJSON_New_Item ( ) ) ) return 0 ; if (! parse_value ( c, skip ( value ) ) ) { cJSON_Delete ( c ) ; return 0 ; } return c ; }

Fix:
<S2SV_ModStart> value ) { return cJSON_ParseWithOpts ( value, 0, 0 ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int tpm_open ( struct inode * inode, struct file * file ) { int minor = iminor ( inode ) ; struct tpm_chip * chip = NULL, * pos ; rcu_read_lock ( ) ; list_for_each_entry_rcu ( pos, & tpm_chip_list, list ) { if ( pos -> vendor. miscdev. minor == minor ) { chip = pos ; get_device ( chip -> dev ) ; break ; } } rcu_read_unlock ( ) ; if (! chip ) return - ENODEV ; if ( test_and_set_bit ( 0, & chip -> is_open ) ) { dev_dbg ( chip -> dev, "Another   process   owns   this   TPM\\n" ) ; put_device ( chip -> dev ) ; return - EBUSY ; } <START_BUG> chip -> data_buffer = kmalloc ( TPM_BUFSIZE * sizeof ( u8 ), GFP_KERNEL ) ; <END_BUG> if ( chip -> data_buffer == NULL ) { clear_bit ( 0, & chip -> is_open ) ; put_device ( chip -> dev ) ; return - ENOMEM ; } atomic_set ( & chip -> data_pending, 0 ) ; file -> private_data = chip ; return 0 ; }

Fix:
<S2SV_ModStart> -> data_buffer = kzalloc ( TPM_BUFSIZE <S2SV_ModEnd>, GFP_KERNEL )
Buggy code:
 static void update_alt_ref_frame_stats ( VP9_COMP * cpi ) { RATE_CONTROL * const rc = & cpi -> rc ; rc -> frames_since_golden = 0 ; <START_BUG> # if CONFIG_MULTIPLE_ARF <END_BUG> if (! cpi -> multi_arf_enabled ) # endif rc -> source_alt_ref_pending = 0 ; rc -> source_alt_ref_active = 1 ; }

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> rc -> source_alt_ref_pending