nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void pimv2_print ( netdissect_options * ndo, register const u_char * bp, register u_int len, const u_char * bp2 ) { register const u_char * ep ; register const struct pim * pim = ( const struct pim * ) bp ; int advance ; enum checksum_status cksum_status ; <START_BUG> ep = ( const u_char * ) ndo -> ndo_snapend ; <END_BUG> if ( bp >= ep ) return ; if ( ep > bp + len ) ep = bp + len ;  ND_TCHECK ( pim -> pim_rsv ) ; <START_BUG> pimv2_addr_len = pim -> pim_rsv ; if ( pimv2_addr_len!= 0 ) <END_BUG> ND_PRINT ( ( ndo, ",   RFC2117-encoding" ) ) ;  ND_PRINT ( ( ndo, ",   cksum   0x%04x   ", EXTRACT_16BITS ( & pim -> pim_cksum ) ) ) ; if ( EXTRACT_16BITS ( & pim -> pim_cksum ) == 0 ) { ND_PRINT ( ( ndo, "(unverified)" ) ) ; } else { if ( PIM_TYPE ( pim -> pim_typever ) == PIMV2_TYPE_REGISTER ) { cksum_status = pimv2_check_checksum ( ndo, bp, bp2, 8 ) ; if ( cksum_status == INCORRECT ) { cksum_status = pimv2_check_checksum ( ndo, bp, bp2, len ) ; } } else { cksum_status = pimv2_check_checksum ( ndo, bp, bp2, len ) ; } switch ( cksum_status ) { case CORRECT : ND_PRINT ( ( ndo, "(correct)" ) ) ; break ; case INCORRECT : ND_PRINT ( ( ndo, "(incorrect)" ) ) ; break ; case UNVERIFIED : ND_PRINT ( ( ndo, "(unverified)" ) ) ; break ; } } <START_BUG> switch ( PIM_TYPE ( pim -> pim_typever ) ) { <END_BUG> case PIMV2_TYPE_HELLO : { uint16_t otype,

Fix:
<S2SV_ModStart> checksum_status cksum_status ; int pimv2_addr_len ; <S2SV_ModStart> + len ; if ( len < 2 ) goto trunc ; <S2SV_ModStart>, ", <S2SV_blank> RFC2117-encoding" ) ) ; if ( len < 4 ) goto trunc ; ND_TCHECK ( pim -> pim_cksum <S2SV_ModStart> ; } } bp += 4 ; len -= 4 ; <S2SV_ModStart>, olen ; while ( len > 0 ) { if ( len < 4 ) goto trunc ; <S2SV_ModEnd> ND_TCHECK2 ( bp <S2SV_ModStart> ] ) ; ND_PRINT ( ( ndo, "\\n\\t <S2SV_blank> <S2SV_blank> %s <S2SV_blank> Option <S2SV_blank> (%u), <S2SV_blank> length <S2SV_blank> %u, <S2SV_blank> Value: <S2SV_blank> ", tok2str ( pimv2_hello_option_values, "Unknown", otype ), otype, olen ) ) ; bp += 4 ; len -= 4 ; if ( len < olen ) goto trunc ; <S2SV_ModStart> 0 ], olen ) <S2SV_ModEnd> ; switch ( <S2SV_ModStart> = bp ; u_int plen = len ; <S2SV_ModStart>, ptr, plen, pimv2_unicast, pimv2_addr_len, 0 ) ; if ( advance < 0 ) goto
Buggy code:
 STATIC struct posix_acl * xfs_acl_from_disk ( struct xfs_acl * aclp ) { struct posix_acl_entry * acl_e ; struct posix_acl * acl ; struct xfs_acl_entry * ace ; <START_BUG> int count, i ; <END_BUG> count = be32_to_cpu ( aclp -> acl_cnt ) ; if ( count > XFS_ACL_MAX_ENTRIES ) return ERR_PTR ( - EFSCORRUPTED ) ; acl = posix_acl_alloc ( count, GFP_KERNEL ) ; if (! acl ) return ERR_PTR ( - ENOMEM ) ; for ( i = 0 ; i < count ; i ++ ) { acl_e = & acl -> a_entries [ i ] ; ace = & aclp -> acl_entry [ i ] ; acl_e -> e_tag = be32_to_cpu ( ace -> ae_tag ) ; acl_e -> e_perm = be16_to_cpu ( ace -> ae_perm ) ; switch ( acl_e -> e_tag ) { case ACL_USER : case ACL_GROUP : acl_e -> e_id = be32_to_cpu ( ace -> ae_id ) ; break ; case ACL_USER_OBJ : case ACL_GROUP_OBJ : case ACL_MASK : case ACL_OTHER : acl_e -> e_id = ACL_UNDEFINED_ID ; break ; default : goto fail ; } } return acl ; fail : posix_acl_release ( acl ) ; return ERR_PTR ( - EINVAL ) ; }

Fix:
<S2SV_ModStart> * ace ; unsigned
Buggy code:
 static int ipxitf_ioctl ( unsigned int cmd, void __user * arg ) { int rc = - EINVAL ; struct ifreq ifr ; int val ; switch ( cmd ) { case SIOCSIFADDR : { struct sockaddr_ipx * sipx ; struct ipx_interface_definition f ; rc = - EFAULT ; if ( copy_from_user ( & ifr, arg, sizeof ( ifr ) ) ) break ; sipx = ( struct sockaddr_ipx * ) & ifr. ifr_addr ; rc = - EINVAL ; if ( sipx -> sipx_family!= AF_IPX ) break ; f. ipx_network = sipx -> sipx_network ; memcpy ( f. ipx_device, ifr. ifr_name, sizeof ( f. ipx_device ) ) ; memcpy ( f. ipx_node, sipx -> sipx_node, IPX_NODE_LEN ) ; f. ipx_dlink_type = sipx -> sipx_type ; f. ipx_special = sipx -> sipx_special ; if ( sipx -> sipx_action == IPX_DLTITF ) rc = ipxitf_delete ( & f ) ; else rc = ipxitf_create ( & f ) ; break ; } case SIOCGIFADDR : { struct sockaddr_ipx * sipx ; struct ipx_interface * ipxif ; struct net_device * dev ; rc = - EFAULT ; if ( copy_from_user ( & ifr, arg, sizeof ( ifr ) ) ) break ; sipx = ( struct sockaddr_ipx * ) & ifr. ifr_addr ; dev = __dev_get_by_name ( & init_net, ifr. ifr_name ) ; rc = - ENODEV ; if (! dev ) break ; ipxif = ipxitf_find_using_phys ( dev, ipx_map_frame_type ( sipx -> sipx_type ) ) ; rc = - EADDRNOTAVAIL ; if (! ipxif ) break ; sipx -> sipx_family = AF_IPX ; sipx -> sipx_network = ipxif -> if_net

Fix:
<S2SV_ModStart> ; rc = 0 ; if ( copy_to_user ( arg, & ifr, sizeof ( ifr ) ) ) rc = <S2SV_ModStart> - EFAULT ; <S2SV_ModEnd> ipxitf_put ( ipxif <S2SV_ModStart> ( ipxif ) <S2SV_ModEnd> ; break ;
Buggy code:
 void Con_Dump_f ( void ) { int l, x, i ; short * line ; fileHandle_t f ; int bufferlen ; char * buffer ; char filename [ MAX_QPATH ] ; if ( Cmd_Argc ( )!= 2 ) { Com_Printf ( "usage:   condump   <filename>\\n" ) ; return ; } Q_strncpyz ( filename, Cmd_Argv ( 1 ), sizeof ( filename ) ) ; <START_BUG> COM_DefaultExtension ( filename, sizeof ( filename ), ".txt" ) ; <END_BUG> f = FS_FOpenFileWrite ( filename ) ; if (! f ) { Com_Printf ( "ERROR:   couldn\'t   open   %s.\\n", filename ) ; return ; } Com_Printf ( "Dumped   console   text   to   %s.\\n", filename ) ; for ( l = con. current - con. totallines + 1 ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( x = 0 ; x < con. linewidth ; x ++ ) if ( ( line [ x ] & 0xff )!=' ') { break ; } if ( x!= con. linewidth ) { break ; } } # ifdef _WIN32 bufferlen = con. linewidth + 3 * sizeof ( char ) ; # else bufferlen = con. linewidth + 2 * sizeof ( char ) ; # endif buffer = Hunk_AllocateTempMemory ( bufferlen ) ; buffer [ bufferlen - 1 ] = 0 ; for ( ; l <= con. current ; l ++ ) { line = con. text + ( l % con. totallines ) * con. linewidth ; for ( i = 0 ; i < con. linewidth ; i ++ ) buffer [ i ] = line [ i ] & 0xff ; for ( x = con. linewidth - 1 ; x >= 0 ; x -- ) { if ( buffer [ x ] ==' ') { buffer [ x ] = 0 ; } else { break ; } } # ifdef _WIN32 Q_strcat ( buffer, bufferlen, "\\r\\n" ) ; # else Q_strcat ( buffer, bufferlen, "\\n" ) ; # endif FS_Write ( buffer, strlen ( buffer ), f ) ; } H

Fix:
<S2SV_ModStart> ".txt" ) ; if (! COM_CompareExtension ( filename, ".txt" ) ) { Com_Printf ( "Con_Dump_f: <S2SV_blank> Only <S2SV_blank> the <S2SV_blank> \\".txt\\" <S2SV_blank> extension <S2SV_blank> is <S2SV_blank> supported <S2SV_blank> by <S2SV_blank> this <S2SV_blank> command!\\n" ) ; return ; }
Buggy code:
 static int treo_attach ( struct usb_serial * serial ) { struct usb_serial_port * swap_port ; if (! ( ( le16_to_cpu ( serial -> dev -> descriptor. idVendor ) == HANDSPRING_VENDOR_ID ) || ( le16_to_cpu ( serial -> dev -> descriptor. idVendor ) == KYOCERA_VENDOR_ID ) ) || ( serial -> num_interrupt_in == 0 ) ) return 0 ; <START_BUG> # define COPY_PORT ( dest, src ) do { int i ; for ( i = 0 ; i < ARRAY_SIZE ( src -> read_urbs ) ; ++ i ) { dest -> read_urbs [ i ] = src -> read_urbs [ i ] ; dest -> read_urbs [ i ] -> context = dest ; dest -> bulk_in_buffers [ i ] = src -> bulk_in_buffers [ i ] ; } dest -> read_urb = src -> read_urb ; dest -> bulk_in_endpointAddress = src -> bulk_in_endpointAddress ; dest -> bulk_in_buffer = src -> bulk_in_buffer ; dest -> bulk_in_size = src -> bulk_in_size ; dest -> interrupt_in_urb = src -> interrupt_in_urb ; dest -> interrupt_in_urb -> context = dest ; dest -> interrupt_in_endpointAddress = src -> interrupt_in_endpointAddress ; dest -> interrupt_in_buffer = src -> interrupt_in_buffer ; } while ( 0 ) ; <END_BUG> swap_port = kmalloc ( sizeof ( * swap_port ), GFP_KERNEL ) ; if (! swap_port ) return - ENOMEM ; COPY_PORT ( swap_port, serial -> port [ 0 ] ) ; COPY_PORT ( serial -> port [ 0 ], serial -> port [ 1 ] ) ; COPY_PORT ( serial -> port [ 1 ], swap_port ) ; kfree ( swap_port ) ; return 0 ; }

Fix:
<S2SV_ModStart> return 0 ; if ( serial -> num_bulk_in < 2 || serial -> num_interrupt_in < 2 ) { dev_err ( & serial -> interface -> dev, "missing <S2SV_blank> endpoints\\n" ) ; return - ENODEV ; }
Buggy code:
 static void __munlock_pagevec ( struct pagevec * pvec, struct zone * zone ) { int i ; int nr = pagevec_count ( pvec ) ; <START_BUG> int delta_munlocked ; <END_BUG> struct pagevec pvec_putback ; int pgrescued = 0 ; pagevec_init ( & pvec_putback, 0 ) ; spin_lock_irq ( zone_lru_lock ( zone ) ) ; for ( i = 0 ; i < nr ; i ++ ) { struct page * page = pvec -> pages [ i ] ; if ( TestClearPageMlocked ( page ) ) { if ( __munlock_isolate_lru_page ( page, false ) ) continue ; else __munlock_isolation_failed ( page ) ;  } <START_BUG> pagevec_add ( & pvec_putback, pvec -> pages [ i ] ) ; pvec -> pages [ i ] = NULL ; } <END_BUG> delta_munlocked = - nr + pagevec_count ( & pvec_putback ) ;  __mod_zone_page_state ( zone, NR_MLOCK, delta_munlocked ) ; spin_unlock_irq ( zone_lru_lock ( zone ) ) ; pagevec_release ( & pvec_putback ) ; for ( i = 0 ; i < nr ; i ++ ) { struct page * page = pvec -> pages [ i ] ; if ( page ) { lock_page ( page ) ; if (! __putback_lru_fast_prepare ( page, & pvec_putback, & pgrescued ) ) { get_page ( page ) ; __munlock_isolated_page ( page ) ; unlock_page ( page ) ; put_page ( page ) ; } } } if ( pagevec_count ( & pvec_putback ) ) __putback_lru_fast ( & pvec_putback, pgrescued ) ; }

Fix:
<S2SV_ModStart> ; int delta_munlocked = - nr <S2SV_ModStart> ) ; } else { delta_munlocked ++ ; } <S2SV_ModStart> NULL ; } <S2SV_ModEnd> __mod_zone_page_state ( zone
Buggy code:
 void ff_h264_free_tables ( H264Context * h, int free_rbsp ) { int i ; H264Context * hx ; av_freep ( & h -> intra4x4_pred_mode ) ; av_freep ( & h -> chroma_pred_mode_table ) ; av_freep ( & h -> cbp_table ) ; av_freep ( & h -> mvd_table [ 0 ] ) ; av_freep ( & h -> mvd_table [ 1 ] ) ; av_freep ( & h -> direct_table ) ; av_freep ( & h -> non_zero_count ) ; av_freep ( & h -> slice_table_base ) ; h -> slice_table = NULL ; av_freep ( & h -> list_counts ) ; av_freep ( & h -> mb2b_xy ) ; av_freep ( & h -> mb2br_xy ) ; av_buffer_pool_uninit ( & h -> qscale_table_pool ) ; av_buffer_pool_uninit ( & h -> mb_type_pool ) ; av_buffer_pool_uninit ( & h -> motion_val_pool ) ; av_buffer_pool_uninit ( & h -> ref_index_pool ) ; if ( free_rbsp && h -> DPB ) { for ( i = 0 ; i < H264_MAX_PICTURE_COUNT ; i ++ ) ff_h264_unref_picture ( h, & h -> DPB [ i ] ) ; <START_BUG> av_freep ( & h -> DPB ) ; <END_BUG> } else if ( h -> DPB ) { for ( i = 0 ; i < H264_MAX_PICTURE_COUNT ; i ++ ) h -> DPB [ i ]. needs_realloc = 1 ; } h -> cur_pic_ptr = NULL ; for ( i = 0 ; i < H264_MAX_THREADS ; i ++ ) { hx = h -> thread_context [ i ] ; if (! hx ) continue ; av_freep ( & hx -> top_borders [ 1 ] ) ; av_freep ( & hx -> top_borders [ 0 ]

Fix:
<S2SV_ModStart> ] ) ; memset ( h -> delayed_pic, 0, sizeof ( h -> delayed_pic ) ) ;
Buggy code:
 static int gs_usb_probe ( struct usb_interface * intf, const struct usb_device_id * id ) { struct gs_usb * dev ; int rc = - ENOMEM ; unsigned int icount, i ; <START_BUG> struct gs_host_config hconf = { <END_BUG>. byte_order = 0x0000beef, } ;  struct gs_device_config dconf ; <START_BUG> rc = usb_control_msg ( interface_to_usbdev ( intf ), usb_sndctrlpipe ( interface_to_usbdev ( intf ), 0 ), GS_USB_BREQ_HOST_FORMAT, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, 1, intf -> altsetting [ 0 ]. desc. bInterfaceNumber, <END_BUG> & hconf,  <START_BUG> sizeof ( hconf ), <END_BUG> 1000 ) ;  if ( rc < 0 ) { <START_BUG> dev_err ( & intf -> dev, "Couldn\'t   send   data   format   (err=%d)\\n", rc ) ; return rc ; <END_BUG> }  rc = usb_control_msg ( interface_to_usbdev ( intf ), usb_rcvctrlpipe ( interface_to_usbdev ( intf ), 0 ), GS_USB_BREQ_DEVICE_CONFIG, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, 1, intf -> altsetting [ 0 ]. desc. bInterfaceNumber, <START_BUG> & dconf, <END_BUG>  sizeof ( dconf ), <START_BUG> 1000 ) ; if ( rc < 0 ) { dev_err ( & intf -> dev, "Couldn\'t   get   device   config:   (err=%d)\\n", rc ) ; <END_BUG> return rc ;  } icount = dconf. icount + 1 ; dev_info ( & intf -> dev, "Configuring   for   %d   interfaces\\n", icount ) ; if ( icount > GS_MAX_INTF ) { dev_err ( & intf -> dev, "Driver   cannot   handle   more   that   %d   CAN   interfaces\\n", GS_MAX_INTF ) ; <START_BUG> return - EINVAL ; <END_BUG> } dev = kzalloc ( sizeof ( * dev ),

Fix:
<S2SV_ModStart> ; struct gs_host_config * hconf <S2SV_ModEnd> ; struct gs_device_config <S2SV_ModStart> ; struct gs_device_config * dconf ; hconf = kmalloc ( sizeof ( * hconf ), GFP_KERNEL ) ; if (! hconf ) return - ENOMEM ; hconf -> byte_order = 0x0000beef <S2SV_ModEnd> ; rc = <S2SV_ModStart>. bInterfaceNumber, <S2SV_ModEnd> hconf, sizeof <S2SV_ModStart>, sizeof ( * <S2SV_ModStart> 1000 ) ; kfree ( hconf ) ; <S2SV_ModStart> rc ; } dconf = kmalloc ( sizeof ( * dconf ), GFP_KERNEL ) ; if (! dconf ) return - ENOMEM ; <S2SV_ModStart>. bInterfaceNumber, <S2SV_ModEnd> dconf, sizeof <S2SV_ModStart>, sizeof ( * <S2SV_ModStart> rc ) ; kfree ( dconf ) ; return rc ; } icount = dconf -> <S2SV_ModEnd> icount + 1 <S2SV_ModStart> GS_MAX_INTF ) ; kfree ( dconf ) ; <S2SV_ModStart>! dev ) { kfree ( dconf ) ; <S2SV_ModStart> - ENOMEM ; } <S2SV_ModStart>, intf, <S2SV_ModEnd> dconf ) ; <S2SV_ModStart> ; kfree ( dconf ) ; kfree ( <S2SV_ModStart> dev ; } kfree ( dconf ) ;
Buggy code:
 int mwifiex_cmd_append_vsie_tlv ( struct mwifiex_private * priv, u16 vsie_mask, u8 * * buffer ) { int id, ret_len = 0 ; struct mwifiex_ie_types_vendor_param_set * vs_param_set ; if (! buffer ) return 0 ; if (! ( * buffer ) ) return 0 ; for ( id = 0 ; id < MWIFIEX_MAX_VSIE_NUM ; id ++ ) { if ( priv -> vs_ie [ id ]. mask & vsie_mask ) { vs_param_set = ( struct mwifiex_ie_types_vendor_param_set * ) * buffer ; vs_param_set -> header. type = cpu_to_le16 ( TLV_TYPE_PASSTHROUGH ) ; vs_param_set -> header. len = cpu_to_le16 ( ( ( ( u16 ) priv -> vs_ie [ id ]. ie [ 1 ] ) & 0x00FF ) + 2 ) ; <START_BUG> memcpy ( vs_param_set -> ie, priv -> vs_ie [ id ]. ie, <END_BUG> le16_to_cpu ( vs_param_set -> header. len ) ) ; * buffer += le16_to_cpu ( vs_param_set -> header. len ) + sizeof ( struct mwifiex_ie_types_header ) ; ret_len += le16_to_cpu ( vs_param_set -> header. len ) + sizeof ( struct mwifiex_ie_types_header ) ; } } return ret_len ; }

Fix:
<S2SV_ModStart> 2 ) ; if ( le16_to_cpu ( vs_param_set -> header. len ) > MWIFIEX_MAX_VSIE_LEN ) { mwifiex_dbg ( priv -> adapter, ERROR, "Invalid <S2SV_blank> param <S2SV_blank> length!\\n" ) ; break ; }
Buggy code:
 static int sd_e_h ( GWindow gw, GEvent * event ) { struct sd_data * sd = GDrawGetUserData ( gw ) ; if ( sd == NULL ) return ( true ) ; if ( event -> type == et_close ) { SD_DoCancel ( sd ) ; <START_BUG> } else if ( event -> type == et_char ) { <END_BUG> if ( event -> u. chr. keysym == GK_F1 || event -> u. chr. keysym == GK_Help ) { help ( "scripting.html" ) ; return ( true ) ; } return ( false ) ; } else if ( event -> type == et_map ) GDrawRaise ( gw ) ; else if ( event -> type == et_resize ) GDrawRequestExpose ( gw, NULL, false ) ; return ( true ) ; }

Fix:
<S2SV_ModStart> -> type == et_controlevent && event -> u. control. subtype == et_textchanged ) { sd -> fv -> script_unsaved =! GTextFieldIsEmpty ( GWidgetGetControl ( sd -> gw, CID_Script ) ) ; } else if ( event -> type == et_controlevent && event -> u. control. subtype == et_save ) { sd -> fv -> script_unsaved = false ; } else if ( event -> type ==
Buggy code:
 int main ( int argc, char * argv [ ] ) { <START_BUG> p_fm_config_conx_hdlt hdl ; <END_BUG> int instance = 0 ; fm_mgr_config_errno_t res ; char * rem_addr = NULL ; char * community = "public" ; char Opts [ 256 ] ; int arg ; char * command ; int i ; strcpy ( Opts, "i:d:h-" ) ; while ( ( arg = getopt ( argc, argv, Opts ) )!= EOF ) { switch ( arg ) { case 'h' : case '-' : usage ( argv [ 0 ] ) ; return ( 0 ) ; case 'i' : instance = atol ( optarg ) ; break ; case 'd' : rem_addr = optarg ; break ; default : usage ( argv [ 0 ] ) ; return ( - 1 ) ; } } if ( optind >= argc ) { fprintf ( stderr, "Command   required\\n" ) ; usage ( argv [ 0 ] ) ; return - 1 ; } command = argv [ optind ++ ] ; printf ( "Connecting   to   %s   FM   instance   %d\\n", ( rem_addr == NULL )? "LOCAL" : rem_addr, instance ) ; if ( ( res = fm_mgr_config_init ( & hdl, instance, rem_addr, community ) )!= FM_CONF_OK ) { fprintf ( stderr, "Failed   to   initialize   the   client   handle:   %d\\n", res ) ;  goto die_clean ; <START_BUG> } if ( ( res = fm_mgr_config_connect ( hdl ) )!= FM_CONF_OK ) { fprintf ( stderr, "Failed   to   connect:   (%d)   %s\\n", res, fm_mgr_get_error_str ( res ) ) ; <END_BUG> goto die_clean ;  } for ( i = 0 ; i < commandListLen ; i ++ ) { if ( strcmp ( command, commandList [ i ]. name ) == 0 ) { <START_BUG> return commandList [ i ]. cmdPtr ( hdl, commandList [ i ]. mgr, ( argc - optind ), & argv [ optind ] ) ; <END_BUG>  } <START_BUG> } fprintf ( stderr, "Command   (%s)<END_BUG>

Fix:
<S2SV_ModStart> { p_fm_config_conx_hdlt hdl = NULL <S2SV_ModStart> ) ; goto cleanup <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ; goto cleanup <S2SV_ModEnd> ; } for <S2SV_ModStart> 0 ) { res = <S2SV_ModEnd> commandList [ i <S2SV_ModStart> ] ) ; goto cleanup ; <S2SV_ModStart> - 1 ; cleanup : if ( hdl ) { if ( hdl -> sm_hdl ) { if ( hdl -> sm_hdl -> c_path [ 0 ] ) unlink ( hdl -> sm_hdl -> c_path ) ; } if ( hdl -> pm_hdl ) { if ( hdl -> pm_hdl -> c_path [ 0 ] ) unlink ( hdl -> pm_hdl -> c_path ) ; } if ( hdl -> fe_hdl ) { if ( hdl -> fe_hdl -> c_path [ 0 ] ) unlink ( hdl -> fe_hdl -> c_path ) ; } <S2SV_ModEnd> free ( hdl <S2SV_ModStart> hdl ) ; }
Buggy code:
 static struct mnt_namespace * create_mnt_ns ( struct vfsmount * m ) { struct mnt_namespace * new_ns = alloc_mnt_ns ( & init_user_ns ) ; if (! IS_ERR ( new_ns ) ) { struct mount * mnt = real_mount ( m ) ; mnt -> mnt_ns = new_ns ; new_ns -> root = mnt ; <START_BUG> list_add ( & mnt -> mnt_list, & new_ns -> list ) ; <END_BUG> } else { mntput ( m ) ; } return new_ns ; }

Fix:
<S2SV_ModStart> = mnt ; new_ns -> mounts ++ ;
Buggy code:
 <START_BUG> static void parse_input ( h2o_http2_conn_t * conn ) <END_BUG> { size_t http2_max_concurrent_requests_per_connection = conn -> super. ctx -> globalconf -> http2. max_concurrent_requests_per_connection ; int perform_early_exit = 0 ; if ( conn -> num_streams. pull. half_closed + conn -> num_streams. push. half_closed!= http2_max_concurrent_requests_per_connection ) perform_early_exit = 1 ; while ( conn -> state < H2O_HTTP2_CONN_STATE_IS_CLOSING && conn -> sock -> input -> size!= 0 ) { if ( perform_early_exit == 1 && conn -> num_streams. pull. half_closed + conn -> num_streams. push. half_closed == http2_max_concurrent_requests_per_connection ) goto EarlyExit ; const char * err_desc = NULL ; ssize_t ret = conn -> _read_expect ( conn, ( uint8_t * ) conn -> sock -> input -> bytes, conn -> sock -> input -> size, & err_desc ) ; if ( ret == H2O_HTTP2_ERROR_INCOMPLETE ) { break ; } else if ( ret < 0 ) { if ( ret!= H2O_HTTP2_ERROR_PROTOCOL_CLOSE_IMMEDIATELY ) { enqueue_goaway ( conn, ( int ) ret, err_desc!= NULL? ( h2o_iovec_t ) { ( char * ) err_desc, strlen ( err_desc ) } : ( h2o_iovec_t ) { } ) ; }  close_connection ( conn ) ; <START_BUG> return ; } h2o_buffer_consume ( & conn -> sock -> input, ret ) ; } if (! h2o_socket_is_reading ( conn -> sock ) ) h2o_socket_read_start ( conn -> sock, on_read ) ; <END_BUG> return ;  EarlyExit : if ( h2o_socket_is_reading ( conn -> sock ) ) h2o_socket_read_stop ( conn -> sock ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> parse_input ( h2o_http2_conn_t <S2SV_ModStart> ) ; } return <S2SV_ModStart> ( conn ) <S2SV_ModEnd> ; } h2o_buffer_consume <S2SV_ModStart> ) ; return 0 <S2SV_ModStart> sock ) ; return 0 ;
Buggy code:
 int HTMLtagproc1 ( struct parsed_tag * tag, struct html_feed_environ * h_env ) { char * p, * q, * r ; int i, w, x, y, z, count, width ; struct readbuffer * obuf = h_env -> obuf ; struct environment * envs = h_env -> envs ; Str tmp ; int hseq ; int cmd ; # ifdef ID_EXT char * id = NULL ; # endif cmd = tag -> tagid ; if ( obuf -> flag & RB_PRE ) { switch ( cmd ) { case HTML_NOBR : case HTML_N_NOBR : case HTML_PRE_INT : case HTML_N_PRE_INT : return 1 ; } } switch ( cmd ) { case HTML_B : obuf -> in_bold ++ ; if ( obuf -> in_bold > 1 ) return 1 ; return 0 ; case HTML_N_B : if ( obuf -> in_bold == 1 && close_effect0 ( obuf, HTML_B ) ) obuf -> in_bold = 0 ; if ( obuf -> in_bold > 0 ) { obuf -> in_bold -- ; if ( obuf -> in_bold == 0 ) return 0 ; } return 1 ; case HTML_I : obuf -> in_italic ++ ; if ( obuf -> in_italic > 1 ) return 1 ; return 0 ; case HTML_N_I : if ( obuf -> in_italic == 1 && close_effect0 ( obuf, HTML_I ) ) obuf -> in_italic = 0 ; if ( obuf -> in_italic > 0 ) { obuf -> in_italic -- ; if ( obuf -> in_italic == 0 ) return 0 ; } return 1 ; case HTML_U : obuf -> in_under ++ ; if ( obuf -> in_under > 1 ) return 1 ; return 0 ; case HTML_N_U : if ( obuf -> in_under == 1 && close_effect0 ( obuf, HTML_U ) ) obuf -> in_under = 0 ; if ( obuf -> in_under > 0 ) { obuf -> in_under -- ; if ( obuf -> in_under == 0 ) return 0 ; } return 1 ; case HTML_EM : HTMLlineproc1 ( "<

Fix:
<S2SV_ModStart> ; if ( h_env -> envc == 0 || ( h_env -> envc_real < h_env -> nenv && envs [ h_env -> envc ]. env!= HTML_DL && envs [ h_env -> envc ]. env!= HTML_DL_COMPACT ) ) { PUSH_ENV ( HTML_DL ) ; } if (
Buggy code:
 <START_BUG> int secure_decrypt ( void * data, unsigned int data_length, int is_signed ) <END_BUG> {  at91_aes_key_size_t key_size ; <START_BUG> unsigned int cmac_key [ 8 ], cipher_key [ 8 ] ; unsigned int iv [ AT91_AES_IV_SIZE_WORD ] ; unsigned int computed_cmac [ AT91_AES_BLOCK_SIZE_WORD ] ; unsigned int fixed_length ; const unsigned int * cmac ; int rc = - 1 ; <END_BUG> init_keys ( & key_size, cipher_key, cmac_key, iv ) ;  at91_aes_init ( ) ; if ( is_signed ) { if ( at91_aes_cmac ( data_length, data, computed_cmac, key_size, cmac_key ) ) goto exit ; fixed_length = at91_aes_roundup ( data_length ) ; cmac = ( const unsigned int * ) ( ( char * ) data + fixed_length ) ; if (! consttime_memequal ( cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE ) ) goto exit ; } if ( at91_aes_cbc ( data_length, data, data, 0, key_size, cipher_key, iv ) ) goto exit ; rc = 0 ; exit : at91_aes_cleanup ( ) ; <START_BUG> memset ( cmac_key, 0, sizeof ( cmac_key ) ) ; <END_BUG> memset ( cipher_key, 0, sizeof ( cipher_key ) ) ; memset ( iv, 0, sizeof ( iv ) ) ; return rc ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> { at91_aes_key_size_t key_size <S2SV_ModEnd> ; unsigned int <S2SV_ModStart> - 1 ; # if defined ( CONFIG_AES_KEY_SIZE_128 ) key_size = AT91_AES_KEY_SIZE_128 ; # elif defined ( CONFIG_AES_KEY_SIZE_192 ) key_size = AT91_AES_KEY_SIZE_192 ; # elif defined ( CONFIG_AES_KEY_SIZE_256 ) key_size = AT91_AES_KEY_SIZE_256 ; # else # error "bad <S2SV_blank> AES <S2SV_blank> key <S2SV_blank> size" # endif <S2SV_ModEnd> at91_aes_init ( ) <S2SV_ModStart> ( ) ; <S2SV_ModEnd> return rc ;
Buggy code:
 static void rpza_decode_stream ( RpzaContext * s ) { int width = s -> avctx -> width ; int stride = s -> frame. linesize [ 0 ] // 2 ; int row_inc = stride - 4 ; int stream_ptr = 0 ; int chunk_size ; unsigned char opcode ; int n_blocks ; unsigned short colorA = 0, colorB ; unsigned short color4 [ 4 ] ; unsigned char index, idx ; unsigned short ta, tb ; unsigned short * pixels = ( unsigned short * ) s -> frame. data [ 0 ] ; int row_ptr = 0 ; <START_BUG> int pixel_ptr = 0 ; <END_BUG> int block_ptr ; int pixel_x, pixel_y ; int total_blocks ; if ( s -> buf [ stream_ptr ]!= 0xe1 ) av_log ( s -> avctx, AV_LOG_ERROR, "First   chunk   byte   is   0x%02x   instead   of   0xe1\\n", s -> buf [ stream_ptr ] ) ; chunk_size = AV_RB32 ( & s -> buf [ stream_ptr ] ) & 0x00FFFFFF ; stream_ptr += 4 ; if ( chunk_size!= s -> size ) av_log ( s -> avctx, AV_LOG_ERROR, "MOV   chunk   size  !=   encoded   chunk   size;   using   MOV   chunk   size\\n" ) ; chunk_size = s -> size ; total_blocks = ( ( s -> avctx -> width + 3 ) // 4 ) * ( ( s -> avctx -> height + 3 ) // 4 ) ; while ( stream_ptr < chunk_size ) { opcode = s -> buf [ stream_ptr ++ ] ; n_blocks = ( opcode & 0x1f ) + 1 ; if ( ( opcode & 0x80 ) == 0 ) { colorA = ( opcode << 8 ) | ( s -> buf [ stream_ptr ++ ] ) ; opcode = 0 ; if ( ( s -> buf [ stream_ptr ] & 0x80 )!= 0 ) { opcode = 0x20 ; n_blocks = 1 ; } } switch ( opcode & 0xe0 ) { case 0x80 : while ( n_blocks -- ) { ADVANCE_BLOCK ( ) ; } break ; case 0xa0 : colorA = AV_RB

Fix:
<S2SV_ModStart> int pixel_ptr = - 4 <S2SV_ModEnd> ; int block_ptr <S2SV_ModStart> -- ) { ADVANCE_BLOCK ( ) <S2SV_ModStart> row_inc ; } <S2SV_ModEnd> } break ; <S2SV_ModStart> -- ) { ADVANCE_BLOCK ( ) ; <S2SV_ModStart> row_inc ; } <S2SV_ModEnd> } break ; <S2SV_ModStart> ) return ; ADVANCE_BLOCK ( ) ; <S2SV_ModStart> row_inc ; } <S2SV_ModEnd> break ; default
Buggy code:
 static int updateDevice ( const struct header * headers, time_t t ) { struct device * * pp = & devlist ; struct device * p = * pp ; while ( p ) { if ( p -> headers [ HEADER_NT ]. l == headers [ HEADER_NT ]. l && ( 0 == memcmp ( p -> headers [ HEADER_NT ]. p, headers [ HEADER_NT ]. p, headers [ HEADER_NT ]. l ) ) && p -> headers [ HEADER_USN ]. l == headers [ HEADER_USN ]. l && ( 0 == memcmp ( p -> headers [ HEADER_USN ]. p, headers [ HEADER_USN ]. p, headers [ HEADER_USN ]. l ) ) ) { syslog ( LOG_DEBUG, "device   updated   :   %.*s", headers [ HEADER_USN ]. l, headers [ HEADER_USN ]. p ) ; p -> t = t ; if ( headers [ HEADER_LOCATION ]. l > p -> headers [ HEADER_LOCATION ]. l ) { struct device * tmp ; tmp = realloc ( p, sizeof ( struct device ) + headers [ 0 ]. l + headers [ 1 ]. l + headers [ 2 ]. l ) ; if (! tmp ) { syslog ( LOG_ERR, "updateDevice()   :   memory   allocation   error" ) ; <START_BUG> free ( p ) ; <END_BUG> return 0 ; } p = tmp ; * pp = p ; } memcpy ( p -> data + p -> headers [ 0 ]. l + p -> headers [ 1 ]. l, headers [ 2 ]. p, headers [ 2 ]. l ) ; return 0 ; } pp = & p -> next ; p = * pp ; } syslog ( LOG_INFO, "new   device   discovered   :   %.*s", headers [ HEADER_USN ]. l, headers [ HEADER_USN ]. p ) ; { char * pc ; int i ; p = malloc ( sizeof ( struct device ) + headers [ 0 ]. l + headers [ 1 ]. l + headers [ 2 ]. l ) ; if (! p ) { syslog ( LOG_ERR, "updateDevice():   cannot   allocate   memory" ) ; return - 1 ; } p -> next = devlist ; p -> t = t ; pc = p

Fix:
<S2SV_ModStart> "updateDevice() <S2SV_blank> : <S2SV_blank> memory <S2SV_blank> allocation <S2SV_blank> error" ) ; * pp = p -> next ;
Buggy code:
 node * PyParser_ParseStringObject ( const char * s, PyObject * filename, grammar * g, int start, perrdetail * err_ret, int * flags ) { struct tok_state * tok ; int exec_input = start == file_input ; if ( initerr ( err_ret, filename ) < 0 ) return NULL ; if ( * flags & PyPARSE_IGNORE_COOKIE ) tok = PyTokenizer_FromUTF8 ( s, exec_input ) ; else tok = PyTokenizer_FromString ( s, exec_input ) ; if ( tok == NULL ) { err_ret -> error = PyErr_Occurred ( )? E_DECODE : E_NOMEM ; return NULL ; } <START_BUG> # ifndef PGEN <END_BUG> Py_INCREF ( err_ret -> filename ) ; tok -> filename = err_ret -> filename ; # endif return parsetok ( tok, g, start, err_ret, flags ) ; }

Fix:
<S2SV_ModStart> NULL ; } if ( * flags & PyPARSE_TYPE_COMMENTS ) { tok -> type_comments = 1 ; }
Buggy code:
 static bool fib6_rule_suppress ( struct fib_rule * rule, struct fib_lookup_arg * arg ) { struct fib6_result * res = arg -> result ; struct rt6_info * rt = res -> rt6 ; struct net_device * dev = NULL ; if (! rt ) return false ; if ( rt -> rt6i_idev ) dev = rt -> rt6i_idev -> dev ; if ( rt -> rt6i_dst. plen <= rule -> suppress_prefixlen ) goto suppress_route ; if ( rule -> suppress_ifgroup!= - 1 && dev && dev -> group == rule -> suppress_ifgroup ) goto suppress_route ; return false ; suppress_route : <START_BUG> ip6_rt_put ( rt ) ; <END_BUG> return true ; }

Fix:
<S2SV_ModStart> ; suppress_route : if (! ( arg -> flags & FIB_LOOKUP_NOREF ) )
Buggy code:
 static int __get_data_block ( struct inode * inode, sector_t iblock, struct buffer_head * bh, int create, int flag, pgoff_t * next_pgofs ) { struct f2fs_map_blocks map ; int err ; map. m_lblk = iblock ; map. m_len = bh -> b_size >> inode -> i_blkbits ; map. m_next_pgofs = next_pgofs ; err = f2fs_map_blocks ( inode, & map, create, flag ) ; if (! err ) { map_bh ( bh, inode -> i_sb, map. m_pblk ) ; bh -> b_state = ( bh -> b_state & ~ F2FS_MAP_FLAGS ) | map. m_flags ; <START_BUG> bh -> b_size = map. m_len << inode -> i_blkbits ; <END_BUG> } return err ; }

Fix:
<S2SV_ModStart> -> b_size = ( u64 )
Buggy code:
 static void read_ref_frames ( VP9_COMMON * const cm, MACROBLOCKD * const xd, <START_BUG> vp9_reader * r, <END_BUG> int segment_id, MV_REFERENCE_FRAME ref_frame [ 2 ] ) {  FRAME_CONTEXT * const fc = & cm -> fc ; <START_BUG> FRAME_COUNTS * const counts = & cm -> counts ; if ( vp9_segfeature_active ( & cm -> seg, segment_id, SEG_LVL_REF_FRAME ) ) { <END_BUG> ref_frame [ 0 ] = ( MV_REFERENCE_FRAME ) vp9_get_segdata ( & cm -> seg, segment_id,  SEG_LVL_REF_FRAME ) ; ref_frame [ 1 ] = NONE ; } else { const REFERENCE_MODE mode = read_block_reference_mode ( cm, xd, r ) ; if ( mode == COMPOUND_REFERENCE ) { const int idx = cm -> ref_frame_sign_bias [ cm -> comp_fixed_ref ] ; const int ctx = vp9_get_pred_context_comp_ref_p ( cm, xd ) ; <START_BUG> const int bit = vp9_read ( r, fc -> comp_ref_prob [ ctx ] ) ; <END_BUG>  if (! cm -> frame_parallel_decoding_mode ) <START_BUG> ++ counts -> comp_ref [ ctx ] [ bit ] ; ref_frame [ idx ] = cm -> comp_fixed_ref ; ref_frame [! idx ] = cm -> comp_var_ref [ bit ] ; } else if ( mode == SINGLE_REFERENCE ) { const int ctx0 = vp9_get_pred_context_single_ref_p1 ( xd ) ; <END_BUG> const int bit0 = vp9_read ( r, fc -> single_ref_prob [ ctx0 ] [ 0 ] ) ;  <START_BUG> if (! cm -> frame_parallel_decoding_mode ) <END_BUG> ++ counts -> single_ref [ ctx0 ] [ 0 ] [ bit0 ] ; if ( bit0 ) { const int ctx1 = vp9_get_pred_context_single_ref_p2 ( xd ) ;  const int bit1 = vp9_read ( r, fc -> single_ref_prob [ ctx1 ] [ 1 ] ) ; <START_BUG> <END_BUG> if (! cm -> frame_parallel_decoding

Fix:
<S2SV_ModStart> const xd, vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> const fc = cm -> fc ; FRAME_COUNTS * counts = xd -> counts ; if ( segfeature_active ( <S2SV_ModStart> & cm -> <S2SV_ModEnd> seg, segment_id <S2SV_ModStart> ( MV_REFERENCE_FRAME ) get_segdata <S2SV_ModEnd> ( & cm <S2SV_ModStart> int bit = vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> ; if ( counts <S2SV_ModEnd> ) ++ counts <S2SV_ModStart> int bit0 = vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> ; if ( counts <S2SV_ModEnd> ) ++ counts <S2SV_ModStart> int bit1 = vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> ; if ( counts <S2SV_ModEnd> ) ++ counts
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_hdr ( dec_state_t * ps_dec ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; impeg2d_bit_stream_get ( ps_stream, 10 ) ; ps_dec -> e_pic_type = ( e_pic_type_t ) impeg2d_bit_stream_get ( ps_stream, 3 ) ; if ( ( ps_dec -> e_pic_type < I_PIC ) || ( ps_dec -> e_pic_type > D_PIC ) ) { impeg2d_next_code ( ps_dec, PICTURE_START_CODE ) ; return IMPEG2D_INVALID_PIC_TYPE ; } impeg2d_bit_stream_get ( ps_stream, 16 ) ; if ( ps_dec -> e_pic_type == P_PIC || ps_dec -> e_pic_type == B_PIC ) { ps_dec -> u2_full_pel_forw_vector = impeg2d_bit_stream_get_bit ( ps_stream ) ; ps_dec -> u2_forw_f_code = impeg2d_bit_stream_get ( ps_stream, 3 ) ; } if ( ps_dec -> e_pic_type == B_PIC ) { ps_dec -> u2_full_pel_back_vector = impeg2d_bit_stream_get_bit ( ps_stream ) ; ps_dec -> u2_back_f_code = impeg2d_bit_stream_get ( ps_stream, 3 ) ; } if ( ps_dec -> u2_is_mpeg2 == 0 ) { <START_BUG> ps_dec -> au2_f_code [ 0 ] [ 0 ] = ps_dec -> au2_f_code [ 0 ] [ 1 ] = ps_dec -> u2_forw_f_code ; <END_BUG> ps_dec -> au2_f_code [ 1 ] [ 0 ] = ps_dec -> au2_f_code [ 1 ] [ 1 ] = ps_dec

Fix:
<S2SV_ModStart> 0 ) { if ( ps_dec -> u2_forw_f_code < 1 || ps_dec -> u2_forw_f_code > 7 || ps_dec -> u2_back_f_code < 1 || ps_dec -> u2_back_f_code > 7 ) { return IMPEG2D_UNKNOWN_ERROR ; }
Buggy code:
 static void pimv1_join_prune_print ( netdissect_options * ndo, register const u_char * bp, register u_int len ) { int ngroups, njoin, nprune ; int njp ; if ( ND_TTEST2 ( bp [ 0 ], 30 ) && bp [ 11 ] == 1 && ( ( njoin = EXTRACT_16BITS ( & bp [ 20 ] ) ) + EXTRACT_16BITS ( & bp [ 22 ] ) ) == 1 ) { int hold ; ND_PRINT ( ( ndo, "   RPF   %s   ", ipaddr_string ( ndo, bp ) ) ) ; hold = EXTRACT_16BITS ( & bp [ 6 ] ) ; if ( hold!= 180 ) { ND_PRINT ( ( ndo, "Hold   " ) ) ; unsigned_relts_print ( ndo, hold ) ; } ND_PRINT ( ( ndo, "%s   (%s//%d,   %s", njoin? "Join" : "Prune", ipaddr_string ( ndo, & bp [ 26 ] ), bp [ 25 ] & 0x3f, ipaddr_string ( ndo, & bp [ 12 ] ) ) ) ; if ( EXTRACT_32BITS ( & bp [ 16 ] )!= 0xffffffff ) ND_PRINT ( ( ndo, "//%s", ipaddr_string ( ndo, & bp [ 16 ] ) ) ) ; ND_PRINT ( ( ndo, ")   %s%s   %s", ( bp [ 24 ] & 0x01 )? "Sparse" : "Dense", ( bp [ 25 ] & 0x80 )? "   WC" : "", ( bp [ 25 ] & 0x40 )? "RP" : "SPT" ) ) ; return ; } <START_BUG> ND_TCHECK2 ( bp [ 0 ], sizeof ( struct in_addr ) ) ; <END_BUG> if ( ndo -> ndo_vflag > 1 ) ND_PRINT ( ( ndo, "\\n" ) ) ; ND_PRINT ( ( ndo, "   Upstream   Nbr:   %s", ipaddr_string ( ndo, bp ) ) ) ;  ND_TCHECK2 ( bp [ 6 ], 2 )

Fix:
<S2SV_ModStart> return ; } if ( len < sizeof ( struct in_addr ) ) goto trunc ; <S2SV_ModStart> ) ) ; bp += 4 ; len -= 4 ; if ( len < 4 ) goto trunc ; <S2SV_ModStart> ( bp [ 2 <S2SV_ModEnd> ], 2 <S2SV_ModStart> & bp [ 2 <S2SV_ModEnd> ] ) ) <S2SV_ModStart> ; bp += 4 <S2SV_ModEnd> ; len -= <S2SV_ModStart> ; len -= 4 ; if ( len < 4 ) goto trunc <S2SV_ModEnd> ; ND_TCHECK2 ( <S2SV_ModStart> -- ) { if ( len < 4 ) goto trunc ; <S2SV_ModStart> ) ) ; bp += 4 ; len -= 4 ; if ( len < 4 ) goto trunc ; <S2SV_ModStart> ( bp [ 0 <S2SV_ModEnd> ], sizeof <S2SV_ModStart> & bp [ 0 <S2SV_ModEnd> ] )!= <S2SV_ModStart> & bp [ 0 ] ) ) ) ; bp += 4 ; len -= 4 ; if ( len < 4 ) goto trunc <S2SV_ModEnd> ; ND_TCHECK2 ( <S2SV_ModStart> ( bp [ 0 <S2SV_ModEnd> ], 4 <S2SV_ModStart> & bp [ 0 <S2SV_ModEnd> ] ) ; <S2SV_ModStart> & bp [ 2 <S2SV_ModEnd> ] ) ; <S2SV_ModStart> ; bp += 4 <S2SV_ModEnd> ; len -= <S2SV_ModStart> ; len -= 4 <S2SV_ModEnd> ; for ( <S2SV_ModStart> = "Prune" ; if ( len < 6 ) goto trunc ;
Buggy code:
 <START_BUG> static int get_minq_index ( double maxq, double x3, double x2, double x1 ) { <END_BUG> int i ; const double minqtarget = MIN ( ( ( x3 * maxq + x2 ) * maxq + x1 ) * maxq, maxq ) ; if ( minqtarget <= 2.0 ) return 0 ;  for ( i = 0 ; i < QINDEX_RANGE ; i ++ ) <START_BUG> <END_BUG> if ( minqtarget <= vp9_convert_qindex_to_q ( i ) )  <START_BUG> return i ; <END_BUG> return QINDEX_RANGE - 1 ; }

Fix:
<S2SV_ModStart>, double x1, vpx_bit_depth_t bit_depth <S2SV_ModStart> i ++ ) { <S2SV_ModStart> vp9_convert_qindex_to_q ( i, bit_depth <S2SV_ModStart> return i ; }
Buggy code:
 void jshGetPinString ( char * result, Pin pin ) { result [ 0 ] = 0 ; # ifdef PIN_NAMES_DIRECT if ( jshIsPinValid ( pin ) ) { result [ 0 ] = ( char ) ( 'A' + ( pinInfo [ pin ]. port & JSH_PORT_MASK ) - JSH_PORTA ) ; itostr ( pinInfo [ pin ]. pin - JSH_PIN0, & result [ 1 ], 10 ) ; # else if ( false ) { # if JSH_PORTA_OFFSET!= - 1 } else if ( # if JSH_PORTA_OFFSET!= 0 pin >= JSH_PORTA_OFFSET && # endif pin < JSH_PORTA_OFFSET + JSH_PORTA_COUNT ) { result [ 0 ] = 'A' ; itostr ( pin - JSH_PORTA_OFFSET, & result [ 1 ], 10 ) ; # endif # if JSH_PORTB_OFFSET!= - 1 } else if ( pin >= JSH_PORTB_OFFSET && pin < JSH_PORTB_OFFSET + JSH_PORTB_COUNT ) { result [ 0 ] = 'B' ; itostr ( pin - JSH_PORTB_OFFSET, & result [ 1 ], 10 ) ; # endif # if JSH_PORTC_OFFSET!= - 1 } else if ( pin >= JSH_PORTC_OFFSET && pin < JSH_PORTC_OFFSET + JSH_PORTC_COUNT ) { result [ 0 ] = 'C' ; itostr ( pin - JSH_PORTC_OFFSET, & result [ 1 ], 10 ) ; # endif # if JSH_PORTD_OFFSET!= - 1 } else if ( # if JSH_PORTD_OFFSET!= 0 pin >= JSH_PORTD_OFFSET && # endif pin < JSH_PORTD_OFFSET + JSH_PORTD_COUNT ) { result [ 0 ] = 'D' ; itostr ( pin - JSH_PORTD_OFFSET, & result [ 1 ], 10 ) ; # endif # if JSH_PORTE_OFFSET!= - 1 } else if ( pin >= JSH_PORTE_OFFSET && pin < JSH_PORTE_OFFSET + JSH_PORTE_COUNT ) {

Fix:
<S2SV_ModStart> } else { strcpy <S2SV_ModEnd> ( result, <S2SV_ModStart> result, "undefined" <S2SV_ModEnd> ) ; }
Buggy code:
 int regset_tls_set ( struct task_struct * target, const struct user_regset * regset, unsigned int pos, unsigned int count, const void * kbuf, const void __user * ubuf ) { struct user_desc infobuf [ GDT_ENTRY_TLS_ENTRIES ] ; const struct user_desc * info ; <START_BUG> if ( pos >= GDT_ENTRY_TLS_ENTRIES * sizeof ( struct user_desc ) || <END_BUG> ( pos % sizeof ( struct user_desc ) )!= 0 || ( count % sizeof ( struct user_desc ) )!= 0 ) return - EINVAL ; if ( kbuf ) info = kbuf ; else if ( __copy_from_user ( infobuf, ubuf, count ) ) return - EFAULT ; else info = infobuf ;  set_tls_desc ( target, <START_BUG> GDT_ENTRY_TLS_MIN + ( pos // sizeof ( struct user_desc ) ), info, count // sizeof ( struct user_desc ) ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> * info ; int i ; <S2SV_ModStart> = infobuf ; for ( i = 0 ; i < count // sizeof ( struct user_desc ) ; i ++ ) if (! tls_desc_okay ( info + i ) ) return - EINVAL ;
Buggy code:
 static int attach_recursive_mnt ( struct mount * source_mnt, struct mount * dest_mnt, struct mountpoint * dest_mp, struct path * parent_path ) { HLIST_HEAD ( tree_list ) ; <START_BUG> struct mount * child, * p ; <END_BUG> struct hlist_node * n ; int err ;  if ( IS_MNT_SHARED ( dest_mnt ) ) { <START_BUG> err = invent_group_ids ( source_mnt, true ) ; if ( err ) goto out ; <END_BUG> err = propagate_mnt ( dest_mnt, dest_mp, source_mnt, & tree_list ) ;  lock_mount_hash ( ) ; if ( err ) goto out_cleanup_ids ; for ( p = source_mnt ; p ; p = next_mnt ( p, source_mnt ) ) set_mnt_shared ( p ) ; } else { lock_mount_hash ( ) ; } if ( parent_path ) { detach_mnt ( source_mnt, parent_path ) ; attach_mnt ( source_mnt, dest_mnt, dest_mp ) ; touch_mnt_namespace ( source_mnt -> mnt_ns ) ; } else { mnt_set_mountpoint ( dest_mnt, dest_mp, source_mnt ) ; commit_tree ( source_mnt, NULL ) ; } hlist_for_each_entry_safe ( child, n, & tree_list, mnt_hash ) { struct mount * q ; hlist_del_init ( & child -> mnt_hash ) ; q = __lookup_mnt_last ( & child -> mnt_parent -> mnt, child -> mnt_mountpoint ) ; commit_tree ( child, q ) ; } unlock_mount_hash ( ) ; return 0 ; out_cleanup_ids : while (! hlist_empty ( & tree_list ) ) { child = hlist_entry ( tree_list. first, struct mount, mnt_hash ) ; <START_BUG> umount_tree ( child, UMOUNT_SYNC ) ; <END_BUG> } unlock_mount_hash ( ) ; cleanup_group_ids ( source_mnt, NULL ) ; out :  return err ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ) ; struct mnt_namespace * ns = dest_mnt -> mnt_ns ; struct <S2SV_ModStart> ; if (! parent_path ) { err = count_mounts ( ns, source_mnt <S2SV_ModEnd> ) ; if <S2SV_ModStart> goto out ; } if ( IS_MNT_SHARED ( dest_mnt ) ) { err = invent_group_ids ( source_mnt, true ) ; if ( err ) goto out ; <S2SV_ModStart> mnt_hash ) ; child -> mnt_parent -> mnt_ns -> pending_mounts = 0 ; <S2SV_ModStart> ; out : ns -> pending_mounts = 0 ;
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG>  int i ; <START_BUG> fprintf ( stderr, "Usage:   %s   <options>   -o   dst_filename   src_filename   \\n", exec_name ) ; fprintf ( stderr, "\\nOptions:\\n" ) ; arg_show_usage ( stderr, main_args ) ; fprintf ( stderr, "\\nEncoder   Global   Options:\\n" ) ; arg_show_usage ( stderr, global_args ) ; fprintf ( stderr, "\\nRate   Control   Options:\\n" ) ; arg_show_usage ( stderr, rc_args ) ; fprintf ( stderr, "\\nTwopass   Rate   Control   Options:\\n" ) ; arg_show_usage ( stderr, rc_twopass_args ) ; fprintf ( stderr, "\\nKeyframe   Placement   Options:\\n" ) ; arg_show_usage ( stderr, kf_args ) ; # if CONFIG_VP8_ENCODER fprintf ( stderr, "\\nVP8   Specific   Options:\\n" ) ; arg_show_usage ( stderr, vp8_args ) ; # endif # if CONFIG_VP9_ENCODER fprintf ( stderr, "\\nVP9   Specific   Options:\\n" ) ; arg_show_usage ( stderr, vp9_args ) ; # endif <END_BUG> fprintf ( stderr, "\\nStream   timebase   (--timebase):\\n"  "     The   desired   precision   of   timestamps   in   the   output,   expressed\\n" "     in   fractional   seconds.   Default   is   1//1000.\\n" ) ; fprintf ( stderr, "\\nIncluded   encoders:\\n\\n" ) ; <START_BUG> for ( i = 0 ; i < get_vpx_encoder_count ( ) ; ++ i ) { <END_BUG> const VpxInterface * const encoder = get_vpx_encoder_by_index ( i ) ;  fprintf ( stderr, "         %-6s   -   %s\\n", <START_BUG> <END_BUG> encoder -> name, vpx_codec_iface_name ( encoder -> interface ( ) ) ) ;  <START_BUG> } <END_BUG> exit ( EXIT_FAILURE ) ; }

Fix:
<S2SV_ModStart> void usage_exit ( void <S2SV_ModStart> { int i ; const int num_encoder = get_vpx_encoder_count ( ) <S2SV_ModStart> ; # endif # if CONFIG_VP10_ENCODER fprintf ( stderr, "\\nVP10 <S2SV_blank> Specific <S2SV_blank> Options:\\n" ) ; arg_show_usage ( stderr, vp10_args ) ; # endif <S2SV_ModStart> ; i < num_encoder <S2SV_ModEnd> ; ++ i <S2SV_ModStart> i ) ; const char * defstr = ( i == ( num_encoder - 1 ) )? "(default)" : "" ; fprintf ( stderr, " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> %-6s <S2SV_blank> - <S2SV_blank> %s <S2SV_blank> %s\\n" <S2SV_ModEnd>, encoder -> <S2SV_ModStart> ( encoder -> codec_interface ( ) ), defstr <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } fprintf ( stderr, "\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> " ) ; fprintf ( stderr, "Use <S2SV_blank> --codec <S2SV_blank> to <S2SV_blank> switch <S2SV_blank> to <S2SV_blank> a <S2SV_blank> non-default <S2SV_blank> encoder.\\n\\n" ) ;
Buggy code:
 int main ( int argc, char * * argv ) { int fd = xopen ( "//dev//null", O_RDWR ) ; while ( fd < 2 ) fd = xdup ( fd ) ; if ( fd > 2 ) close ( fd ) ; if ( argc < 8 ) { error_msg_and_die ( "Usage:   %s   SIGNO   CORE_SIZE_LIMIT   PID   UID   GID   TIME   BINARY_NAME   [HOSTNAME]", argv [ 0 ] ) ; } if ( strchr ( argv [ 1 ],' ') ) { int i ; for ( i = 1 ; argv [ i ] ; i ++ ) { strchrnul ( argv [ i ],' ') [ 0 ] = '\\0' ; } } logmode = LOGMODE_JOURNAL ; load_abrt_conf ( ) ; bool setting_MakeCompatCore ; bool setting_SaveBinaryImage ; { map_string_t * settings = new_map_string ( ) ; load_abrt_plugin_conf_file ( "CCpp.conf", settings ) ; const char * value ; value = get_map_string_item_or_NULL ( settings, "MakeCompatCore" ) ; setting_MakeCompatCore = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "SaveBinaryImage" ) ; setting_SaveBinaryImage = value && string_to_bool ( value ) ; value = get_map_string_item_or_NULL ( settings, "VerboseLog" ) ; if ( value ) g_verbose = xatoi_positive ( value ) ; free_map_string ( settings ) ; } errno = 0 ; const char * signal_str = argv [ 1 ] ; int signal_no = xatoi_positive ( signal_str ) ; off_t ulimit_c = strtoull ( argv [ 2 ], NULL, 10 ) ; if ( ulimit_c < 0 ) { ulimit_c = ~ ( ( off_t ) 1 << ( sizeof ( off_t ) * 8 - 1 ) ) ; } const char * pid_str = argv [ 3 ] ; pid_t pid = xatoi_positive ( argv [ 3 ] ) ; uid_t uid = xatoi

Fix:
<S2SV_ModStart>, fsuid, <S2SV_ModEnd> NULL ) ;
Buggy code:
 void vp9_decoder_remove ( VP9Decoder * pbi ) { <START_BUG> VP9_COMMON * const cm = & pbi -> common ; <END_BUG> int i ;  vp9_remove_common ( cm ) ; <START_BUG> vp9_worker_end ( & pbi -> lf_worker ) ; <END_BUG> vpx_free ( pbi -> lf_worker. data1 ) ;  for ( i = 0 ; i < pbi -> num_tile_workers ; ++ i ) { <START_BUG> VP9Worker * const worker = & pbi -> tile_workers [ i ] ; <END_BUG>  vp9_worker_end ( worker ) ; <START_BUG> <END_BUG> vpx_free ( worker -> data1 ) ;  <START_BUG> vpx_free ( worker -> data2 ) ; <END_BUG> } vpx_free ( pbi -> tile_workers ) ;  if ( pbi -> num_tile_workers ) { <START_BUG> const int sb_rows = mi_cols_aligned_to_sb ( cm -> mi_rows ) >> MI_BLOCK_SIZE_LOG2 ; <END_BUG> vp9_loop_filter_dealloc ( & pbi -> lf_row_sync, sb_rows ) ;  } vpx_free ( pbi ) ; }

Fix:
<S2SV_ModStart> pbi ) { <S2SV_ModEnd> int i ; <S2SV_ModStart> int i ; vpx_get_worker_interface ( ) -> end <S2SV_ModEnd> ( & pbi <S2SV_ModStart> lf_worker. data1 ) ; vpx_free ( pbi -> tile_data <S2SV_ModStart> i ) { VPxWorker <S2SV_ModEnd> * const worker <S2SV_ModStart> i ] ; vpx_get_worker_interface ( ) -> end <S2SV_ModEnd> ( worker ) <S2SV_ModStart> worker ) ; } vpx_free ( pbi -> tile_worker_data <S2SV_ModEnd> ) ; vpx_free <S2SV_ModStart> ; vpx_free ( pbi -> tile_worker_info ) ; <S2SV_ModEnd> vpx_free ( pbi <S2SV_ModStart> pbi -> num_tile_workers > 0 ) { <S2SV_ModEnd> vp9_loop_filter_dealloc ( & <S2SV_ModStart> pbi -> lf_row_sync <S2SV_ModEnd> ) ; }
Buggy code:
 static Image * ReadCUTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowCUTReaderException ( severity, tag ) { if ( palette!= NULL ) palette = DestroyImage ( palette ) ; if ( clone_info!= NULL ) clone_info = DestroyImageInfo ( clone_info ) ; ThrowReaderException ( severity, tag ) ; } <END_BUG> Image * image, * palette ; ImageInfo * clone_info ; MagickBooleanType status ; MagickOffsetType offset ; size_t EncodedByte ; unsigned char RunCount, RunValue, RunCountMasked ; CUTHeader Header ; CUTPalHeader PalHeader ; ssize_t depth ; ssize_t i, j ; ssize_t ldblk ; unsigned char * BImgBuff = NULL, * ptrB ; PixelPacket * q ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } palette = NULL ; clone_info = NULL ; Header. Width = ReadBlobLSBShort ( image ) ; Header. Height = ReadBlobLSBShort ( image ) ; Header. Reserved = ReadBlobLSBShort ( image ) ; if ( Header. Width == 0 || Header. Height == 0 || Header. Reserved!= 0 ) CUT_KO : ThrowCUTReaderException ( CorruptImageError, "ImproperImageHeader" ) ; EncodedByte = ReadBlobLSBShort ( image ) ; RunCount = ( unsigned char ) ReadBlobByte ( image ) ; RunCountMasked = RunCount & 0x7F ; ldblk = 0 ; while ( ( int ) RunCountMasked!= 0 ) { i = 1 ; if ( ( int ) RunCount < 0x80 ) i = ( ssize_

Fix:
<S2SV_ModStart>, tag ) \\\n{ <S2SV_ModEnd> if ( palette <S2SV_ModStart> tag ) ; \\\n} <S2SV_ModEnd> Image * image <S2SV_ModStart> goto NoMemory ; ( void ) memset ( BImgBuff, 0, ( size_t ) ldblk * sizeof ( * BImgBuff ) ) ;
Buggy code:
 static inline void uipc_wakeup_locked ( void ) { char sig_on = 1 ; BTIF_TRACE_EVENT ( "UIPC   SEND   WAKE   UP" ) ; <START_BUG> send ( uipc_main. signal_fds [ 1 ], & sig_on, sizeof ( sig_on ), 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> "UIPC <S2SV_blank> SEND <S2SV_blank> WAKE <S2SV_blank> UP" ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 cJSON * iperf_json_printf ( const char * format,... ) { cJSON * o ; va_list argp ; const char * cp ; char name [ 100 ] ; char * np ; cJSON * j ; o = cJSON_CreateObject ( ) ; if ( o == NULL ) return NULL ; va_start ( argp, format ) ; np = name ; for ( cp = format ; * cp!= '\\0' ; ++ cp ) { switch ( * cp ) { case' ': break ; case ':' : * np = '\\0' ; break ; case '%' : ++ cp ; switch ( * cp ) { case 'b' : j = cJSON_CreateBool ( va_arg ( argp, int ) ) ; break ; case 'd' : <START_BUG> j = cJSON_CreateInt ( va_arg ( argp, int64_t ) ) ; <END_BUG> break ; case 'f' :  j = cJSON_CreateFloat ( va_arg ( argp, double ) ) ; <START_BUG> break ; case's' : j = cJSON_CreateString ( va_arg ( argp, char * ) ) ; break ; default : return NULL ; } if ( j == NULL ) return NULL ; cJSON_AddItemToObject ( o, name, j ) ; np = name ; break ; default : * np ++ = * cp ; break ; } } va_end ( argp ) ; return o ; }<END_BUG>

Fix:
<S2SV_ModStart> : j = cJSON_CreateNumber <S2SV_ModEnd> ( va_arg ( <S2SV_ModStart> : j = cJSON_CreateNumber <S2SV_ModEnd> ( va_arg (
Buggy code:
 int rose_parse_facilities ( unsigned char * p, struct rose_facilities_struct * facilities ) { int facilities_len, len ; facilities_len = * p ++ ; if ( facilities_len == 0 ) return 0 ; while ( facilities_len > 0 ) { if ( * p == 0x00 ) { facilities_len -- ; p ++ ; switch ( * p ) { case FAC_NATIONAL : len = rose_parse_national ( p + 1, facilities, facilities_len - 1 ) ; <START_BUG> facilities_len -= len + 1 ; <END_BUG> p += len + 1 ; break ; case FAC_CCITT : len = rose_parse_ccitt ( p + 1, facilities, facilities_len - 1 ) ;  facilities_len -= len + 1 ; <START_BUG> p += len + 1 ; break ; default : printk ( KERN_DEBUG "ROSE:   rose_parse_facilities   -   unknown   facilities   family   %02X\\n", * p ) ; facilities_len -- ; p ++ ; break ; } } else break ; } return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> 1 ) ; if ( len < 0 ) return 0 ; <S2SV_ModStart> 1 ) ; if ( len < 0 ) return 0 ;