nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int netlink_dump ( struct sock * sk ) { struct netlink_sock * nlk = nlk_sk ( sk ) ; struct netlink_callback * cb ; struct sk_buff * skb = NULL ; struct nlmsghdr * nlh ; <START_BUG> int len, err = - ENOBUFS ; <END_BUG> int alloc_min_size ; int alloc_size ; mutex_lock ( nlk -> cb_mutex ) ; if (! nlk -> cb_running ) { err = - EINVAL ; goto errout_skb ; } if ( atomic_read ( & sk -> sk_rmem_alloc ) >= sk -> sk_rcvbuf ) goto errout_skb ; cb = & nlk -> cb ; alloc_min_size = max_t ( int, cb -> min_dump_alloc, NLMSG_GOODSIZE ) ; if ( alloc_min_size < nlk -> max_recvmsg_len ) { alloc_size = nlk -> max_recvmsg_len ; skb = alloc_skb ( alloc_size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY ) ; } if (! skb ) { alloc_size = alloc_min_size ; skb = alloc_skb ( alloc_size, GFP_KERNEL ) ; } if (! skb ) goto errout_skb ; skb_reserve ( skb, skb_tailroom ( skb ) - alloc_size ) ; netlink_skb_set_owner_r ( skb, sk ) ; len = cb -> dump ( skb, cb ) ; if ( len > 0 ) { mutex_unlock ( nlk -> cb_mutex ) ; if ( sk_filter ( sk, skb ) ) kfree_skb ( skb ) ; else __netlink_sendskb ( sk, skb ) ; return 0 ; } nlh = nlmsg_put_answer ( skb, cb, NLMSG_DONE, sizeof ( len ), NLM_F_MULTI ) ; if (! nlh ) goto errout_skb ; nl_dump_check_consistent ( cb, nlh ) ; memcpy ( nlmsg_data ( nlh ), & len, sizeof ( len ) ) ; if ( sk_filter ( sk,

Fix:
<S2SV_ModStart> * nlh ; struct module * module ; <S2SV_ModStart> = false ; module = cb -> module ; skb = cb -> skb ; <S2SV_ModStart> ; module_put ( <S2SV_ModEnd> module ) ; <S2SV_ModStart> ; consume_skb ( <S2SV_ModEnd> skb ) ;
Buggy code:
 GPLOT * gplotRead ( const char * filename ) { <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> char * rootname, * title, * xlabel, * ylabel, * ignores ; l_int32 outformat, ret, version, ignore ; FILE * fp ; GPLOT * gplot ; PROCNAME ( "gplotRead" ) ; if (! filename ) return ( GPLOT * ) ERROR_PTR ( "filename   not   defined", procName, NULL ) ; if ( ( fp = fopenReadStream ( filename ) ) == NULL ) return ( GPLOT * ) ERROR_PTR ( "stream   not   opened", procName, NULL ) ; ret = fscanf ( fp, "Gplot   Version   %d\\n", & version ) ; if ( ret!= 1 ) { fclose ( fp ) ; return ( GPLOT * ) ERROR_PTR ( "not   a   gplot   file", procName, NULL ) ; } if ( version!= GPLOT_VERSION_NUMBER ) { fclose ( fp ) ; return ( GPLOT * ) ERROR_PTR ( "invalid   gplot   version", procName, NULL ) ; }  ignore = fscanf ( fp, "Rootname:   %s\\n", buf ) ; <START_BUG> rootname = stringNew ( buf ) ; ignore = fscanf ( fp, "Output   format:   %d\\n", & outformat ) ; <END_BUG> ignores = fgets ( buf, L_BUF_SIZE, fp ) ;  title = stringNew ( buf + 7 ) ; title [ strlen ( title ) - 1 ] = '\\0' ; <START_BUG> ignores = fgets ( buf, L_BUF_SIZE, fp ) ; <END_BUG> xlabel = stringNew ( buf + 14 ) ; xlabel [ strlen ( xlabel ) - 1 ] = '\\0' ;  ignores = fgets ( buf, L_BUF_SIZE, fp ) ; <START_BUG> ylabel = stringNew ( buf + 14 ) ; ylabel [ strlen ( ylabel ) - 1 ] = '\\0' ; gplot = gplotCreate ( rootname, outformat, title, xlabel, ylabel ) ; LEPT_FREE ( rootname ) ; LEPT_FREE ( title ) ; LEPT_FREE ( xlabel ) ; LEPT_FREE ( ylabel ) ; if (<END_BUG>

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( fp, "Rootname: <S2SV_blank> %511s\\n" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( fp, "Commandfile <S2SV_blank> name: <S2SV_blank> %511s\\n" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ( fp, "Output <S2SV_blank> file <S2SV_blank> name: <S2SV_blank> %511s\\n" <S2SV_ModEnd>, buf )
Buggy code:
 void processRequest ( struct reqelem * req ) { ssize_t n ; unsigned int l, m ; unsigned char buf [ 2048 ] ; const unsigned char * p ; enum request_type type ; struct device * d = devlist ; unsigned char rbuf [ RESPONSE_BUFFER_SIZE ] ; unsigned char * rp ; unsigned char nrep = 0 ; time_t t ; struct service * newserv = NULL ; struct service * serv ; n = read ( req -> socket, buf, sizeof ( buf ) ) ; if ( n < 0 ) { if ( errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK ) return ; syslog ( LOG_ERR, "(s=%d)   processRequest():   read():   %m", req -> socket ) ; goto error ; } if ( n == 0 ) { syslog ( LOG_INFO, "(s=%d)   request   connection   closed", req -> socket ) ; goto error ; } t = time ( NULL ) ; type = buf [ 0 ] ; p = buf + 1 ; DECODELENGTH_CHECKLIMIT ( l, p, buf + n ) ; <START_BUG> if ( p + l > buf + n ) { <END_BUG> syslog ( LOG_WARNING, "bad   request   (length   encoding   l=%u   n=%u)", l, ( unsigned ) n ) ; goto error ; } if ( l == 0 && type!= MINISSDPD_SEARCH_ALL && type!= MINISSDPD_GET_VERSION && type!= MINISSDPD_NOTIF ) { syslog ( LOG_WARNING, "bad   request   (length=0,   type=%d)", type ) ; goto error ; } syslog ( LOG_INFO, "(s=%d)   request   type=%d   str=\'%.*s\'", req -> socket, type, l, p ) ; switch ( type ) { case MINISSDPD_GET_VERSION : rp = rbuf ; CODELENGTH ( ( sizeof ( MINISSDPD_VERSION ) - 1 ), rp ) ; memcpy ( rp, MINISSDPD_VERSION, sizeof ( MINISSDPD_VERSION ) - 1 ) ; rp += ( sizeof ( MINISSDPD_VERSION ) - 1 ) ; if ( write_or_buffer ( req, rbuf, rp - rbuf ) < 0 ) { syslog ( LOG

Fix:
<S2SV_ModStart> ; if ( l > ( unsigned ) ( <S2SV_ModEnd> buf + n <S2SV_ModStart> buf + n - p ) <S2SV_ModStart> ; if ( l > ( unsigned ) ( <S2SV_ModEnd> buf + n <S2SV_ModStart> buf + n - p ) <S2SV_ModStart> ; if ( l > ( unsigned ) ( <S2SV_ModEnd> buf + n <S2SV_ModStart> buf + n - p ) <S2SV_ModStart> ; if ( l > ( unsigned ) ( <S2SV_ModEnd> buf + n <S2SV_ModStart> buf + n - p )
Buggy code:
 jas_stream_t * jas_stream_memopen ( char * buf, int bufsize ) { <START_BUG> jas_stream_t * stream ; <END_BUG> jas_stream_memobj_t * obj ; JAS_DBGLOG ( 100, ( "jas_stream_memopen(%p,   %d)\\n", buf, bufsize ) ) ;  if (! ( stream = jas_stream_create ( ) ) ) { <START_BUG> return 0 ; } stream -> openmode_ = JAS_STREAM_READ | JAS_STREAM_WRITE | JAS_STREAM_BINARY ; jas_stream_initbuf ( stream, JAS_STREAM_FULLBUF, 0, 0 ) ; stream -> ops_ = & jas_stream_memops ; if (! ( obj = jas_malloc ( sizeof ( jas_stream_memobj_t ) ) ) ) { jas_stream_destroy ( stream ) ; return 0 ; } stream -> obj_ = ( void * ) obj ; obj -> myalloc_ = 0 ; obj -> buf_ = 0 ; if ( bufsize <= 0 ) { <END_BUG> obj -> bufsize_ = 1024 ;  obj -> growable_ = 1 ; } else { <START_BUG> obj -> bufsize_ = bufsize ; <END_BUG>  obj -> growable_ = 0 ; <START_BUG> } if ( buf ) { obj -> buf_ = ( unsigned char * ) buf ; } else { obj -> buf_ = jas_malloc ( obj -> bufsize_ ) ; obj -> myalloc_ = 1 ; } if (! obj -> buf_ ) { jas_stream_close ( stream ) ; return 0 ; } JAS_DBGLOG ( 100, ( "jas_stream_memopen   buffer   buf=%p   myalloc=%d\\n", obj -> buf_, obj -> myalloc_ ) ) ; if ( bufsize > 0 && buf ) { obj -> len_ = bufsize ; } else { obj -> len_ = 0 ; } obj -> pos_ = 0 ; return stream ; }<END_BUG>

Fix:
<S2SV_ModStart> bufsize ) { char * new_buf ; size_t new_bufsize <S2SV_ModEnd> ; JAS_DBGLOG ( <S2SV_ModStart> ; if ( bufsize < 0 ) { jas_deprecated ( "negative <S2SV_blank> buffer <S2SV_blank> size <S2SV_blank> for <S2SV_blank> jas_stream_memopen" ) ; } if ( buf && bufsize <= 0 ) { jas_eprintf ( "Invalid <S2SV_blank> use <S2SV_blank> of <S2SV_blank> jas_stream_memopen <S2SV_blank> detected.\\n" ) ; jas_deprecated ( "A <S2SV_blank> user-provided <S2SV_blank> buffer <S2SV_blank> for <S2SV_blank> " "jas_stream_memopen <S2SV_blank> cannot <S2SV_blank> be <S2SV_blank> growable.\\n" ) ; } <S2SV_ModEnd> if ( bufsize <S2SV_ModStart> 0 ) { new_bufsize = 0 ; new_buf = 0 <S2SV_ModEnd> ; } else <S2SV_ModStart> } else { new_bufsize <S2SV_ModEnd> = bufsize ; <S2SV_ModStart> = bufsize ; new_buf = buf ; } return jas_stream_memopen2 ( new_buf, new_bufsize ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int hwahc_security_create ( struct hwahc * hwahc ) { int result ; struct wusbhc * wusbhc = & hwahc -> wusbhc ; struct usb_device * usb_dev = hwahc -> wa. usb_dev ; struct device * dev = & usb_dev -> dev ; struct usb_security_descriptor * secd ; struct usb_encryption_descriptor * etd ; void * itr, * top ; size_t itr_size, needed, bytes ; u8 index ; char buf [ 64 ] ; index = ( usb_dev -> actconfig - usb_dev -> config ) // sizeof ( usb_dev -> config [ 0 ] ) ; itr = usb_dev -> rawdescriptors [ index ] ; itr_size = le16_to_cpu ( usb_dev -> actconfig -> desc. wTotalLength ) ; top = itr + itr_size ; result = __usb_get_extra_descriptor ( usb_dev -> rawdescriptors [ index ], le16_to_cpu ( usb_dev -> actconfig -> desc. wTotalLength ), <START_BUG> USB_DT_SECURITY, ( void * * ) & secd ) ; <END_BUG> if ( result == - 1 ) { dev_warn ( dev, "BUG?   WUSB   host   has   no   security   descriptors\\n" ) ; return 0 ; } needed = sizeof ( * secd ) ; if ( top - ( void * ) secd < needed ) { dev_err ( dev, "BUG?   Not   enough   data   to   process   security   " "descriptor   header   (%zu   bytes   left   vs   %zu   needed)\\n", top - ( void * ) secd, needed ) ; return 0 ; } needed = le16_to_cpu ( secd -> wTotalLength ) ; if ( top - ( void * ) secd < needed ) { dev_err ( dev, "BUG?   Not   enough   data   to   process   security   " "descriptors   (%zu   bytes   left   vs   %zu   needed)\\n", top - ( void * ) secd, needed ) ; return 0 ; } itr = ( void * ) secd + sizeof ( * secd ) ; top = ( void * ) secd + le16

Fix:
<S2SV_ModStart> ) & secd, sizeof ( * secd )
Buggy code:
 static ssize_t o2nm_node_local_store ( struct config_item * item, const char * page, size_t count ) { struct o2nm_node * node = to_o2nm_node ( item ) ; <START_BUG> struct o2nm_cluster * cluster = to_o2nm_cluster_from_node ( node ) ; <END_BUG> unsigned long tmp ; char * p = ( char * ) page ; ssize_t ret ; tmp = simple_strtoul ( p, & p, 0 ) ; if (! p || ( * p && ( * p!= '\\n' ) ) ) return - EINVAL ; tmp =!! tmp ; if (! test_bit ( O2NM_NODE_ATTR_ADDRESS, & node -> nd_set_attributes ) ||! test_bit ( O2NM_NODE_ATTR_NUM, & node -> nd_set_attributes ) ||! test_bit ( O2NM_NODE_ATTR_PORT, & node -> nd_set_attributes ) ) return - EINVAL ;  if ( tmp && tmp == cluster -> cl_has_local && <START_BUG> cluster -> cl_local_node!= node -> nd_num ) <END_BUG> return - EBUSY ;  <START_BUG> if ( tmp &&! cluster -> cl_has_local ) { <END_BUG> ret = o2net_start_listening ( node ) ; if ( ret )  return ret ; <START_BUG> } if (! tmp && cluster -> cl_has_local && cluster -> cl_local_node == node -> nd_num ) { o2net_stop_listening ( node ) ; cluster -> cl_local_node = O2NM_INVALID_NODE_NUM ; } node -> nd_local = tmp ; if ( node -> nd_local ) { cluster -> cl_has_local = tmp ; cluster -> cl_local_node = node -> nd_num ; } <END_BUG> return count ;  }

Fix:
<S2SV_ModStart> o2nm_cluster * cluster <S2SV_ModEnd> ; unsigned long <S2SV_ModStart> - EINVAL ; o2nm_lock_subsystem ( ) ; cluster = to_o2nm_cluster_from_node ( node ) ; if (! cluster ) { ret = - EINVAL ; goto out ; } <S2SV_ModStart> -> nd_num ) { ret = <S2SV_ModEnd> - EBUSY ; <S2SV_ModStart> - EBUSY ; goto out ; } <S2SV_ModStart> ( ret ) goto out <S2SV_ModEnd> ; } if <S2SV_ModStart> nd_num ; } ret = count ; out : o2nm_unlock_subsystem ( ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int zipfileUpdate ( sqlite3_vtab * pVtab, int nVal, sqlite3_value * * apVal, sqlite_int64 * pRowid ) { ZipfileTab * pTab = ( ZipfileTab * ) pVtab ; int rc = SQLITE_OK ; ZipfileEntry * pNew = 0 ; u32 mode = 0 ; u32 mTime = 0 ; i64 sz = 0 ; const char * zPath = 0 ; int nPath = 0 ; const u8 * pData = 0 ; int nData = 0 ; int iMethod = 0 ; u8 * pFree = 0 ; char * zFree = 0 ; ZipfileEntry * pOld = 0 ; ZipfileEntry * pOld2 = 0 ; int bUpdate = 0 ; int bIsDir = 0 ; u32 iCrc32 = 0 ; if ( pTab -> pWriteFd == 0 ) { rc = zipfileBegin ( pVtab ) ; if ( rc!= SQLITE_OK ) return rc ; } if ( sqlite3_value_type ( apVal [ 0 ] )!= SQLITE_NULL ) { const char * zDelete = ( const char * ) sqlite3_value_text ( apVal [ 0 ] ) ; int nDelete = ( int ) strlen ( zDelete ) ; if ( nVal > 1 ) { const char * zUpdate = ( const char * ) sqlite3_value_text ( apVal [ 1 ] ) ; if ( zUpdate && zipfileComparePath ( zUpdate, zDelete, nDelete )!= 0 ) { bUpdate = 1 ; } } for ( pOld = pTab -> pFirstEntry ; 1 ; pOld = pOld -> pNext ) { if ( zipfileComparePath ( pOld -> cds. zFile, zDelete, nDelete ) == 0 ) { break ; } assert ( pOld -> pNext ) ; } } if ( nVal > 1 ) { if ( sqlite3_value_type ( apVal [ 5 ] )!= SQLITE_NULL ) { zipfileTableErr ( pTab, "sz   must   be   NULL" ) ; rc = SQLITE_CONSTRAINT ; } if ( sqlite3_value_type ( apVal [ 6 ] )!= SQLITE_NULL ) { zipfileTableErr ( pTab, "rawdata   must   be   NULL" ) ; rc = SQLITE_CONSTRAINT ; }

Fix:
<S2SV_ModStart> ] ) ; if ( zPath == 0 ) zPath = "" ;
Buggy code:
 <START_BUG> static void encode_uniform ( vp9_writer * w, int v ) { <END_BUG> const int l = 8 ; const int m = ( 1 << l ) - 191 ; if ( v < m ) {  vp9_write_literal ( w, v, l - 1 ) ; <START_BUG> } else { <END_BUG> vp9_write_literal ( w, m + ( ( v - m ) >> 1 ), l - 1 ) ;  <START_BUG> vp9_write_literal ( w, ( v - m ) & 1, 1 ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> void encode_uniform ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> m ) { vpx_write_literal <S2SV_ModEnd> ( w, <S2SV_ModStart> } else { vpx_write_literal <S2SV_ModEnd> ( w, <S2SV_ModStart> 1 ) ; vpx_write_literal <S2SV_ModEnd> ( w,
Buggy code:
 static void mark_commit ( struct commit * c, void * data ) { <START_BUG> mark_object ( & c -> object, NULL, NULL, data ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, NULL, <S2SV_ModEnd> data ) ;
Buggy code:
 int main ( void ) { int fd, len, sock_opt ; int error ; struct cn_msg * message ; struct pollfd pfd ; struct nlmsghdr * incoming_msg ; struct cn_msg * incoming_cn_msg ; struct hv_kvp_msg * hv_msg ; char * p ; char * key_value ; char * key_name ; int op ; int pool ; char * if_name ; struct hv_kvp_ipaddr_value * kvp_ip_val ; daemon ( 1, 0 ) ; openlog ( "KVP", 0, LOG_USER ) ; syslog ( LOG_INFO, "KVP   starting;   pid   is:%d", getpid ( ) ) ; kvp_get_os_info ( ) ; if ( kvp_file_init ( ) ) { syslog ( LOG_ERR, "Failed   to   initialize   the   pools" ) ; exit ( EXIT_FAILURE ) ; } fd = socket ( AF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR ) ; if ( fd < 0 ) { syslog ( LOG_ERR, "netlink   socket   creation   failed;   error:%d", fd ) ; exit ( EXIT_FAILURE ) ; } addr. nl_family = AF_NETLINK ; addr. nl_pad = 0 ; addr. nl_pid = 0 ; addr. nl_groups = CN_KVP_IDX ; error = bind ( fd, ( struct sockaddr * ) & addr, sizeof ( addr ) ) ; if ( error < 0 ) { syslog ( LOG_ERR, "bind   failed;   error:%d", error ) ; close ( fd ) ; exit ( EXIT_FAILURE ) ; } sock_opt = addr. nl_groups ; setsockopt ( fd, 270, 1, & sock_opt, sizeof ( sock_opt ) ) ; message = ( struct cn_msg * ) kvp_send_buffer ; message -> id. idx = CN_KVP_IDX ; message -> id. val = CN_KVP_VAL ; hv_msg = ( struct hv_kvp_msg * ) message -> data ; hv_msg -> kvp_hdr. operation = KVP_OP_REGISTER1 ; message -> ack = 0 ; message -> len = sizeof ( struct hv_kvp_msg )

Fix:
<S2SV_ModStart> len < 0 <S2SV_ModEnd> ) { syslog <S2SV_ModStart> 1 ; } if ( addr. nl_pid ) { syslog ( LOG_WARNING, "Received <S2SV_blank> packet <S2SV_blank> from <S2SV_blank> untrusted <S2SV_blank> pid:%u", addr. nl_pid ) ; continue ; }
Buggy code:
 static void zz_motion_search ( VP8_COMP * cpi, MACROBLOCK * x, YV12_BUFFER_CONFIG * raw_buffer, int * raw_motion_err, YV12_BUFFER_CONFIG * recon_buffer, int * best_motion_err, int recon_yoffset ) { MACROBLOCKD * const xd = & x -> e_mbd ; BLOCK * b = & x -> block [ 0 ] ; BLOCKD * d = & x -> e_mbd. block [ 0 ] ; unsigned char * src_ptr = ( * ( b -> base_src ) + b -> src ) ; int src_stride = b -> src_stride ; unsigned char * raw_ptr ; int raw_stride = raw_buffer -> y_stride ; unsigned char * ref_ptr ; int ref_stride = x -> e_mbd. pre. y_stride ; <START_BUG> raw_ptr = ( unsigned char * ) ( raw_buffer -> y_buffer + recon_yoffset <END_BUG> + d -> offset ) ;  vp8_mse16x16 ( src_ptr, src_stride, raw_ptr, raw_stride, <START_BUG> ( unsigned int * ) ( raw_motion_err ) ) ; xd -> pre. y_buffer = recon_buffer -> y_buffer + recon_yoffset ; ref_ptr = ( unsigned char * ) ( xd -> pre. y_buffer + d -> offset ) ; <END_BUG> vp8_mse16x16 ( src_ptr, src_stride, ref_ptr, ref_stride,  ( unsigned int * ) ( best_motion_err ) ) ; }

Fix:
<S2SV_ModStart>. y_stride ; ( void ) cpi ; <S2SV_ModStart> offset ) ; vpx_mse16x16 <S2SV_ModEnd> ( src_ptr, <S2SV_ModStart> offset ) ; vpx_mse16x16 <S2SV_ModEnd> ( src_ptr,
Buggy code:
 static vpx_codec_err_t image2yuvconfig ( const vpx_image_t * img, YV12_BUFFER_CONFIG * yv12 ) { <START_BUG> vpx_codec_err_t res = VPX_CODEC_OK ; <END_BUG> yv12 -> y_buffer = img -> planes [ VPX_PLANE_Y ] ; yv12 -> u_buffer = img -> planes [ VPX_PLANE_U ] ; yv12 -> v_buffer = img -> planes [ VPX_PLANE_V ] ;  yv12 -> y_crop_width = img -> d_w ; <START_BUG> <END_BUG> yv12 -> y_crop_height = img -> d_h ;  <START_BUG> yv12 -> y_width = img -> d_w ; <END_BUG>  yv12 -> y_height = img -> d_h ; <START_BUG> <END_BUG> yv12 -> uv_width = ( 1 + yv12 -> y_width ) // 2 ;  <START_BUG> yv12 -> uv_height = ( 1 + yv12 -> y_height ) // 2 ; <END_BUG> yv12 -> y_stride = img -> stride [ VPX_PLANE_Y ] ; yv12 -> uv_stride = img -> stride [ VPX_PLANE_U ] ; yv12 -> border = ( img -> stride [ VPX_PLANE_Y ] - img -> w ) // 2 ; return res ; }

Fix:
<S2SV_ModStart> yv12 ) { const int y_w = img -> d_w ; const int y_h = img -> d_h ; const int uv_w = ( img -> d_w + 1 ) // 2 ; const int uv_h = ( img -> d_h + 1 ) // 2 ; <S2SV_ModStart> -> y_crop_width = y_w <S2SV_ModEnd> ; yv12 -> <S2SV_ModStart> -> y_crop_height = y_h <S2SV_ModEnd> ; yv12 -> <S2SV_ModStart> -> y_width = y_w <S2SV_ModEnd> ; yv12 -> <S2SV_ModStart> -> y_height = y_h ; yv12 -> uv_crop_width = uv_w ; yv12 -> uv_crop_height = uv_h <S2SV_ModEnd> ; yv12 -> <S2SV_ModStart> -> uv_width = uv_w ; yv12 -> uv_height = uv_h ; yv12 -> y_stride = img -> stride [ VPX_PLANE_Y ] ; yv12 -> uv_stride = img -> stride [ VPX_PLANE_U ] ; yv12 -> border = ( img -> stride [ VPX_PLANE_Y ] - img -> w <S2SV_ModEnd> ) //
Buggy code:
 void cJSON_ReplaceItemInArray ( cJSON * array, int which, cJSON * newitem ) { cJSON * c = array -> child ; <START_BUG> while ( c && which > 0 ) { <END_BUG>  c = c -> next ; <START_BUG> -- which ; } if (! c ) return ; newitem -> next = c -> next ; newitem -> prev = c -> prev ; if ( newitem -> next ) newitem -> next -> prev = newitem ; if ( c == array -> child ) array -> child = newitem ; else newitem -> prev -> next = newitem ; c -> next = c -> prev = 0 ; cJSON_Delete ( c ) ; }<END_BUG>

Fix:
<S2SV_ModStart> > 0 ) <S2SV_ModEnd> c = c <S2SV_ModStart> c -> next, which -- ; <S2SV_ModEnd> if (!
Buggy code:
 static struct cifsSesInfo * cifs_get_smb_ses ( struct TCP_Server_Info * server, struct smb_vol * volume_info ) { int rc = - ENOMEM, xid ; struct cifsSesInfo * ses ; xid = GetXid ( ) ; <START_BUG> ses = cifs_find_smb_ses ( server, volume_info -> username ) ; <END_BUG> if ( ses ) { cFYI ( 1, "Existing   smb   sess   found   (status=%d)", ses -> status ) ; cifs_put_tcp_session ( server ) ; mutex_lock ( & ses -> session_mutex ) ; rc = cifs_negotiate_protocol ( xid, ses ) ; if ( rc ) { mutex_unlock ( & ses -> session_mutex ) ; cifs_put_smb_ses ( ses ) ; FreeXid ( xid ) ; return ERR_PTR ( rc ) ; } if ( ses -> need_reconnect ) { cFYI ( 1, "Session   needs   reconnect" ) ; rc = cifs_setup_session ( xid, ses, volume_info -> local_nls ) ; if ( rc ) { mutex_unlock ( & ses -> session_mutex ) ; cifs_put_smb_ses ( ses ) ; FreeXid ( xid ) ; return ERR_PTR ( rc ) ; } } mutex_unlock ( & ses -> session_mutex ) ; FreeXid ( xid ) ; return ses ; } cFYI ( 1, "Existing   smb   sess   not   found" ) ; ses = sesInfoAlloc ( ) ; if ( ses == NULL ) goto get_ses_fail ; ses -> server = server ; if ( server -> addr. sockAddr6. sin6_family == AF_INET6 ) sprintf ( ses -> serverName, "%pI6", & server -> addr. sockAddr6. sin6_addr ) ; else sprintf ( ses -> serverName, "%pI4", & server -> addr. sockAddr. sin_addr. s_addr ) ; if ( volume_info -> username ) strncpy ( ses -> userName, volume_info -> username, MAX_USERNAME_SIZE ) ; if ( volume_info -> password ) { ses -> password = kstrdup ( volume_info -> password, GFP_

Fix:
<S2SV_ModStart> server, volume_info <S2SV_ModEnd> ) ; if
Buggy code:
 static __be32 nfsacld_proc_setacl ( struct svc_rqst * rqstp, struct nfsd3_setaclargs * argp, struct nfsd_attrstat * resp ) { struct inode * inode ; svc_fh * fh ; __be32 nfserr = 0 ; int error ; dprintk ( "nfsd:   SETACL(2acl)       %s\\n", SVCFH_fmt ( & argp -> fh ) ) ; fh = fh_copy ( & resp -> fh, & argp -> fh ) ; nfserr = fh_verify ( rqstp, & resp -> fh, 0, NFSD_MAY_SATTR ) ; if ( nfserr ) goto out ; inode = d_inode ( fh -> fh_dentry ) ; <START_BUG> if (! IS_POSIXACL ( inode ) ||! inode -> i_op -> set_acl ) { <END_BUG> error = - EOPNOTSUPP ; goto out_errno ;  } <START_BUG> error = fh_want_write ( fh ) ; if ( error ) goto out_errno ; <END_BUG> error = inode -> i_op -> set_acl ( inode, argp -> acl_access, ACL_TYPE_ACCESS ) ;  if ( error ) goto out_drop_write ; <START_BUG> error = inode -> i_op -> set_acl ( inode, argp -> acl_default, <END_BUG> ACL_TYPE_DEFAULT ) ; if ( error ) goto out_drop_write ; fh_drop_write ( fh ) ; nfserr = fh_getattr ( fh, & resp -> stat ) ; out : posix_acl_release ( argp -> acl_access ) ; posix_acl_release ( argp -> acl_default ) ; return nfserr ;  out_drop_write : <START_BUG> fh_drop_write ( fh ) ; out_errno : nfserr = nfserrno ( error ) ; goto out ; }<END_BUG>

Fix:
<S2SV_ModStart> fh_dentry ) ; error = fh_want_write ( fh ) ; if ( error ) <S2SV_ModEnd> goto out_errno ; <S2SV_ModStart> goto out_errno ; fh_lock ( fh ) ; error = set_posix_acl ( inode, ACL_TYPE_ACCESS <S2SV_ModEnd>, argp -> <S2SV_ModStart> argp -> acl_access ) ; if ( error ) goto out_drop_lock ; error = set_posix_acl ( inode, ACL_TYPE_DEFAULT <S2SV_ModEnd>, argp -> <S2SV_ModStart> argp -> acl_default ) ; if ( error ) goto out_drop_lock ; fh_unlock ( fh ) <S2SV_ModEnd> ; fh_drop_write ( <S2SV_ModStart> return nfserr ; out_drop_lock : fh_unlock ( fh ) ; <S2SV_ModEnd> fh_drop_write ( fh
Buggy code:
 static void fpm_child_init ( struct fpm_worker_pool_s * wp ) { <START_BUG> fpm_globals. max_requests = wp -> config -> pm_max_requests ; <END_BUG> if ( 0 > fpm_stdio_init_child ( wp ) || 0 > fpm_log_init_child ( wp ) || 0 > fpm_status_init_child ( wp ) || 0 > fpm_unix_init_child ( wp ) || 0 > fpm_signals_init_child ( ) || 0 > fpm_env_init_child ( wp ) || 0 > fpm_php_init_child ( wp ) ) { zlog ( ZLOG_ERROR, "[pool   %s]   child   failed   to   initialize", wp -> config -> name ) ; exit ( FPM_EXIT_SOFTWARE ) ; } }

Fix:
<S2SV_ModStart> config -> pm_max_requests ; fpm_globals. listening_socket = dup ( wp -> listening_socket )
Buggy code:
 static int db_interception ( struct vcpu_svm * svm ) { struct kvm_run * kvm_run = svm -> vcpu. run ; if (! ( svm -> vcpu. guest_debug & ( KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP ) ) &&! svm -> nmi_singlestep ) { kvm_queue_exception ( & svm -> vcpu, DB_VECTOR ) ; return 1 ; } if ( svm -> nmi_singlestep ) { svm -> nmi_singlestep = false ; if (! ( svm -> vcpu. guest_debug & KVM_GUESTDBG_SINGLESTEP ) ) svm -> vmcb -> save. rflags &= ~ ( X86_EFLAGS_TF | X86_EFLAGS_RF ) ; <START_BUG> update_db_bp_intercept ( & svm -> vcpu ) ; <END_BUG> } if ( svm -> vcpu. guest_debug & ( KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP ) ) { kvm_run -> exit_reason = KVM_EXIT_DEBUG ; kvm_run -> debug. arch. pc = svm -> vmcb -> save. cs. base + svm -> vmcb -> save. rip ; kvm_run -> debug. arch. exception = DB_VECTOR ; return 0 ; } return 1 ; }

Fix:
<S2SV_ModStart> X86_EFLAGS_RF ) ; <S2SV_ModEnd> } if (
Buggy code:
 static struct fileIdentDesc * udf_find_entry ( struct inode * dir, const struct qstr * child, struct udf_fileident_bh * fibh, struct fileIdentDesc * cfi ) { struct fileIdentDesc * fi = NULL ; loff_t f_pos ; int block, flen ; unsigned char * fname = NULL ; unsigned char * nameptr ; uint8_t lfi ; uint16_t liu ; loff_t size ; struct kernel_lb_addr eloc ; uint32_t elen ; sector_t offset ; struct extent_position epos = { } ; struct udf_inode_info * dinfo = UDF_I ( dir ) ; int isdotdot = child -> len == 2 && child -> name [ 0 ] == '.' && child -> name [ 1 ] == '.' ; size = udf_ext0_offset ( dir ) + dir -> i_size ; f_pos = udf_ext0_offset ( dir ) ; fibh -> sbh = fibh -> ebh = NULL ; fibh -> soffset = fibh -> eoffset = f_pos & ( dir -> i_sb -> s_blocksize - 1 ) ; if ( dinfo -> i_alloc_type!= ICBTAG_FLAG_AD_IN_ICB ) { if ( inode_bmap ( dir, f_pos >> dir -> i_sb -> s_blocksize_bits, & epos, & eloc, & elen, & offset )!= ( EXT_RECORDED_ALLOCATED >> 30 ) ) goto out_err ; block = udf_get_lb_pblock ( dir -> i_sb, & eloc, offset ) ; if ( ( ++ offset << dir -> i_sb -> s_blocksize_bits ) < elen ) { if ( dinfo -> i_alloc_type == ICBTAG_FLAG_AD_SHORT ) epos. offset -= sizeof ( struct short_ad ) ; else if ( dinfo -> i_alloc_type == ICBTAG_FLAG_AD_LONG ) epos. offset -= sizeof ( struct long_ad ) ; } else offset = 0 ; fibh -> sbh = fibh -> ebh = udf_tread ( dir -> i_sb, block ) ; if (! fibh -> sb

Fix:
<S2SV_ModStart>, nameptr, lfi, fname, UDF_NAME_LEN <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> int check_fragments_for_errors ( VP8D_COMP * pbi ) <END_BUG> { if (! pbi -> ec_active && pbi -> fragments. count <= 1 && pbi -> fragments. sizes [ 0 ] == 0 ) { VP8_COMMON * cm = & pbi -> common ; if ( cm -> fb_idx_ref_cnt [ cm -> lst_fb_idx ] > 1 ) { const int prev_idx = cm -> lst_fb_idx ; cm -> fb_idx_ref_cnt [ prev_idx ] -- ; cm -> lst_fb_idx = get_free_fb ( cm ) ; vp8_yv12_copy_frame ( & cm -> yv12_fb [ prev_idx ], & cm -> yv12_fb [ cm -> lst_fb_idx ] ) ; } cm -> yv12_fb [ cm -> lst_fb_idx ]. corrupted = 1 ; cm -> show_frame = 0 ; return 0 ; } return 1 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static int daemon_AuthUserPwd ( char * username, char * password, char * errbuf ) { # ifdef _WIN32 <START_BUG> HANDLE Token ; <END_BUG>  if ( LogonUser ( username, ".", password, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, & Token ) == 0 ) <START_BUG> { <END_BUG> pcap_fmt_errmsg_for_win32_err ( errbuf, PCAP_ERRBUF_SIZE,  <START_BUG> GetLastError ( ), "LogonUser()   failed" ) ; <END_BUG> return - 1 ; }  if ( ImpersonateLoggedOnUser ( Token ) == 0 ) <START_BUG> { pcap_fmt_errmsg_for_win32_err ( errbuf, PCAP_ERRBUF_SIZE, GetLastError ( ), "ImpersonateLoggedOnUser()   failed" ) ; CloseHandle ( Token ) ; <END_BUG> return - 1 ;  } CloseHandle ( Token ) ; return 0 ; <START_BUG> # else <END_BUG> struct passwd * user ; char * user_password ; # ifdef HAVE_GETSPNAM struct spwd * usersp ; # endif char * crypt_password ; if ( ( user = getpwnam ( username ) ) == NULL ) {  pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed:   user   name   or   password   incorrect" ) ; <START_BUG> return - 1 ; } # ifdef HAVE_GETSPNAM if ( ( usersp = getspnam ( username ) ) == NULL ) { <END_BUG> pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed:   user   name   or   password   incorrect" ) ;  return - 1 ; } user_password = usersp -> sp_pwdp ; # else user_password = user -> pw_passwd ; # endif <START_BUG> crypt_password = crypt ( password, user_password ) ; <END_BUG> if ( crypt_password == NULL ) {  pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed" ) ; <START_BUG> return - 1 ; } if ( strcmp ( user_password, crypt_password )!= 0 ) { <END_BUG> pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed:   user   name   or

Fix:
<S2SV_ModStart> # ifdef _WIN32 DWORD error ; <S2SV_ModStart> HANDLE Token ; char errmsgbuf [ PCAP_ERRBUF_SIZE ] ; <S2SV_ModStart> 0 ) { pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication <S2SV_blank> failed" ) ; error = GetLastError ( ) ; if ( error!= ERROR_LOGON_FAILURE ) { pcap_fmt_errmsg_for_win32_err ( errmsgbuf, PCAP_ERRBUF_SIZE, error, "LogonUser() <S2SV_blank> failed" ) ; rpcapd_log ( LOGPRIO_ERROR, "%s", errmsgbuf ) ; } return - 1 ; } if ( ImpersonateLoggedOnUser ( Token ) == 0 ) { pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication <S2SV_blank> failed" ) ; pcap_fmt_errmsg_for_win32_err ( errmsgbuf <S2SV_ModEnd>, PCAP_ERRBUF_SIZE, <S2SV_ModStart> ( ), "ImpersonateLoggedOnUser() <S2SV_blank> failed" ) ; rpcapd_log ( LOGPRIO_ERROR, "%s", errmsgbuf ) ; CloseHandle <S2SV_ModEnd> ( Token ) <S2SV_ModStart> (
Buggy code:
 void bta_hl_co_put_rx_data ( UINT8 app_id, tBTA_HL_MDL_HANDLE mdl_handle, UINT16 data_size, UINT8 * p_data, UINT16 evt ) { UINT8 app_idx, mcl_idx, mdl_idx ; btif_hl_mdl_cb_t * p_dcb ; tBTA_HL_STATUS status = BTA_HL_STATUS_FAIL ; int r ; BTIF_TRACE_DEBUG ( "%s   app_id=%d   mdl_handle=0x%x   data_size=%d", __FUNCTION__, app_id, mdl_handle, data_size ) ; if ( btif_hl_find_mdl_idx_using_handle ( mdl_handle, & app_idx, & mcl_idx, & mdl_idx ) ) { p_dcb = BTIF_HL_GET_MDL_CB_PTR ( app_idx, mcl_idx, mdl_idx ) ; if ( ( p_dcb -> p_rx_pkt = ( UINT8 * ) btif_hl_get_buf ( data_size ) )!= NULL ) { memcpy ( p_dcb -> p_rx_pkt, p_data, data_size ) ; if ( p_dcb -> p_scb ) { BTIF_TRACE_DEBUG ( "app_idx=%d   mcl_idx=0x%x   mdl_idx=0x%x   data_size=%d", app_idx, mcl_idx, mdl_idx, data_size ) ; <START_BUG> r = send ( p_dcb -> p_scb -> socket_id [ 1 ], p_dcb -> p_rx_pkt, data_size, 0 ) ; <END_BUG> if ( r == data_size ) { BTIF_TRACE_DEBUG ( "socket   send   success   data_size=%d", data_size ) ; status = BTA_HL_STATUS_OK ; } else { BTIF_TRACE_ERROR ( "socket   send   failed   r=%d   data_size=%d", r, data_size ) ; }

Fix:
<S2SV_ModStart> ; r = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 static void uipc_check_interrupt_locked ( void ) { if ( SAFE_FD_ISSET ( uipc_main. signal_fds [ 0 ], & uipc_main. read_set ) ) { char sig_recv = 0 ; <START_BUG> recv ( uipc_main. signal_fds [ 0 ], & sig_recv, sizeof ( sig_recv ), MSG_WAITALL ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> = 0 ; TEMP_FAILURE_RETRY ( <S2SV_ModStart>, MSG_WAITALL ) )
Buggy code:
 static int bson_validate_string ( bson * b, const unsigned char * string, <START_BUG> const int length, const char check_utf8, const char check_dot, <END_BUG> const char check_dollar ) {  int position = 0 ; <START_BUG> int sequence_length = 1 ; if ( check_dollar && string [ 0 ] == '$' ) { if (! bson_string_is_db_ref ( string, length ) ) b -> err |= BSON_FIELD_INIT_DOLLAR ; } while ( position < length ) { if ( check_dot && * ( string + position ) == '.' ) { b -> err |= BSON_FIELD_HAS_DOT ; } if ( check_utf8 ) { sequence_length = trailingBytesForUTF8 [ * ( string + position ) ] + 1 ; if ( ( position + sequence_length ) > length ) { b -> err |= BSON_NOT_UTF8 ; return BSON_ERROR ; } if (! isLegalUTF8 ( string + position, sequence_length ) ) { b -> err |= BSON_NOT_UTF8 ; return BSON_ERROR ; } } position += sequence_length ; } return BSON_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> string, const size_t <S2SV_ModEnd> length, const <S2SV_ModStart> check_dollar ) { size_t <S2SV_ModEnd> position = 0
Buggy code:
 int mp4boxMain ( int argc, char * * argv ) { u32 i, j ; const char * gpac_profile = "0" ; GF_Err e = GF_OK ; nb_tsel_acts = nb_add = nb_cat = nb_track_act = nb_sdp_ex = max_ptime = nb_meta_act = rtp_rate = major_brand = nb_alt_brand_add = nb_alt_brand_rem = car_dur = minor_version = 0 ; split_duration = 0.0 ; split_start = - 1.0 ; interleaving_time = 0 ; dash_duration = dash_subduration = 0.0 ; import_fps. num = import_fps. den = 0 ; import_flags = 0 ; split_size = 0 ; movie_time = 0 ; dump_nal = dump_saps = dump_saps_mode = force_new = 0 ; FullInter = HintInter = encode = do_scene_log = old_interleave = do_saf = do_hash = verbose = do_mpd_rip = merge_vtt_cues = get_nb_tracks = GF_FALSE ; # ifndef GPAC_DISABLE_SCENE_DUMP dump_mode = GF_SM_DUMP_NONE ; # endif Frag = force_ocr = remove_sys_tracks = agg_samples = remove_hint = keep_sys_tracks = remove_root_od = single_group = clean_groups = compress_moov = GF_FALSE ; conv_type = HintIt = needSave = print_sdp = regular_iod = dump_std = open_edit = dump_rtp = dump_cr = dump_srt = dump_ttxt = dump_m2ts = dump_cart = import_subtitle = force_cat = pack_wgt = dash_live = GF_FALSE ; no_fragments_defaults = GF_FALSE ; single_traf_per_moof = hls_clock = GF_FALSE ; tfdt_per_traf = GF_FALSE ; dump_nal_type = 0 ; dump_isom = 0 ; print_info = 0 ; align_cat = G

Fix:
<S2SV_ModStart> ( stderr, "File <S2SV_blank> %s <S2SV_blank> has <S2SV_blank> no <S2SV_blank> IOD\\n" <S2SV_ModEnd>, inName )
Buggy code:
 void formUpdateBuffer ( Anchor * a, Buffer * buf, FormItemList * form ) { Buffer save ; char * p ; int spos, epos, rows, c_rows, pos, col = 0 ; Line * l ; copyBuffer ( & save, buf ) ; gotoLine ( buf, a -> start. line ) ; switch ( form -> type ) { case FORM_TEXTAREA : case FORM_INPUT_TEXT : case FORM_INPUT_FILE : case FORM_INPUT_PASSWORD : case FORM_INPUT_CHECKBOX : case FORM_INPUT_RADIO : # ifdef MENU_SELECT case FORM_SELECT : # endif spos = a -> start. pos ; epos = a -> end. pos ; break ; default : spos = a -> start. pos + 1 ; epos = a -> end. pos - 1 ; } switch ( form -> type ) { case FORM_INPUT_CHECKBOX : case FORM_INPUT_RADIO : if ( buf -> currentLine == NULL || spos >= buf -> currentLine -> len || spos < 0 ) break ; if ( form -> checked ) buf -> currentLine -> lineBuf [ spos ] = '*' ; else buf -> currentLine -> lineBuf [ spos ] =' '; break ; case FORM_INPUT_TEXT : case FORM_INPUT_FILE : case FORM_INPUT_PASSWORD : case FORM_TEXTAREA : # ifdef MENU_SELECT case FORM_SELECT : if ( form -> type == FORM_SELECT ) { p = form -> label -> ptr ; updateSelectOption ( form, form -> select_option ) ; } else # endif { if (! form -> value ) break ; p = form -> value -> ptr ; } l = buf -> currentLine ; if (! l ) break ; if ( form -> type == FORM_TEXTAREA ) { int n = a -> y - buf -> currentLine -> linenumber ; if ( n > 0 ) for ( ; l && n ; l = l -> prev, n -- ) ; else if ( n < 0 ) for ( ; l && n ; l = l -> prev, n ++ ) ; if (! l ) break ; } rows = form -> rows? form -> rows : 1 ; col = COLPOS ( l, a -> start. pos ) ; for ( c_rows = 0 ; c_rows < rows ; c_rows ++, l = l -> next )

Fix:
<S2SV_ModStart> { if ( l == NULL ) break ; if (
Buggy code:
 <START_BUG> static void utee_param_to_param ( struct tee_ta_param * p, struct utee_params * up ) <END_BUG> { size_t n ; uint32_t types = up -> types ; p -> types = types ; for ( n = 0 ; n < TEE_NUM_PARAMS ; n ++ ) { uintptr_t a = up -> vals [ n * 2 ] ; size_t b = up -> vals [ n * 2 + 1 ] ;  switch ( TEE_PARAM_TYPE_GET ( types, n ) ) { <START_BUG> <END_BUG> case TEE_PARAM_TYPE_MEMREF_INPUT :  case TEE_PARAM_TYPE_MEMREF_OUTPUT : case TEE_PARAM_TYPE_MEMREF_INOUT : p -> u [ n ]. mem. mobj = & mobj_virt ; p -> u [ n ]. mem. offs = a ; p -> u [ n ]. mem. size = b ; <START_BUG> break ; <END_BUG> case TEE_PARAM_TYPE_VALUE_INPUT : case TEE_PARAM_TYPE_VALUE_INOUT : p -> u [ n ]. val. a = a ; p -> u [ n ]. val. b = b ; break ; default : memset ( & p -> u [ n ], 0, sizeof ( p -> u [ n ] ) ) ; break ; }  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static TEE_Result utee_param_to_param ( struct user_ta_ctx * utc, <S2SV_ModEnd> struct tee_ta_param * <S2SV_ModStart> 1 ] ; uint32_t flags = TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER ; <S2SV_ModStart> ) { case TEE_PARAM_TYPE_MEMREF_OUTPUT : case TEE_PARAM_TYPE_MEMREF_INOUT : flags |= TEE_MEMORY_ACCESS_WRITE ; case TEE_PARAM_TYPE_MEMREF_INPUT <S2SV_ModEnd> : p -> <S2SV_ModStart> = b ; if ( tee_mmu_check_access_rights ( utc, flags, a, b ) ) return TEE_ERROR_ACCESS_DENIED ; <S2SV_ModStart> ; } } return TEE_SUCCESS ;
Buggy code:
 static inline int mk_vhost_fdt_open ( int id, unsigned int hash, struct session_request * sr ) { int i ; int fd ; struct vhost_fdt_hash_table * ht = NULL ; struct vhost_fdt_hash_chain * hc ; if ( config -> fdt == MK_FALSE ) { return open ( sr -> real_path. data, sr -> file_info. flags_read_only ) ; } ht = mk_vhost_fdt_table_lookup ( id, sr -> host_conf ) ; if ( mk_unlikely (! ht ) ) { return open ( sr -> real_path. data, sr -> file_info. flags_read_only ) ; } hc = mk_vhost_fdt_chain_lookup ( hash, ht ) ; if ( hc ) { hc -> readers ++ ; return hc -> fd ; } fd = open ( sr -> real_path. data, sr -> file_info. flags_read_only ) ; if ( fd == - 1 ) { return - 1 ; } if ( ht -> av_slots <= 0 ) { return fd ; } for ( i = 0 ; i < VHOST_FDT_HASHTABLE_CHAINS ; i ++ ) { hc = & ht -> chain [ i ] ; if ( hc -> fd == - 1 ) { hc -> fd = fd ; hc -> hash = hash ; hc -> readers ++ ; ht -> av_slots -- ; sr -> vhost_fdt_id = id ; sr -> vhost_fdt_hash = hash ; <START_BUG> return fd ; <END_BUG> } } return - 1 ; }

Fix:
<S2SV_ModStart> = hash ; sr -> fd_is_fdt = MK_TRUE ;
Buggy code:
 static void test_show_object ( struct object * object, <START_BUG> struct strbuf * path, <END_BUG>  const char * last, void * data ) <START_BUG> { struct bitmap_test_data * tdata = data ; int bitmap_pos ; bitmap_pos = bitmap_position ( object -> oid. hash ) ; if ( bitmap_pos < 0 ) die ( "Object   not   in   bitmap:   %s\\n", oid_to_hex ( & object -> oid ) ) ; bitmap_set ( tdata -> base, bitmap_pos ) ; display_progress ( tdata -> prg, ++ tdata -> seen ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * object, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name <S2SV_ModEnd>, void *
Buggy code:
 static int l2tp_ip6_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sockaddr_l2tpip6 * lsa = ( struct sockaddr_l2tpip6 * ) msg -> msg_name ; size_t copied = 0 ; int err = - EOPNOTSUPP ; struct sk_buff * skb ; if ( flags & MSG_OOB ) goto out ; if ( addr_len ) * addr_len = sizeof ( * lsa ) ; if ( flags & MSG_ERRQUEUE ) return ipv6_recv_error ( sk, msg, len ) ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto done ; sock_recv_timestamp ( msg, sk, skb ) ; if ( lsa ) { lsa -> l2tp_family = AF_INET6 ; lsa -> l2tp_unused = 0 ; lsa -> l2tp_addr = ipv6_hdr ( skb ) -> saddr ; lsa -> l2tp_flowinfo = 0 ; lsa -> l2tp_scope_id = 0 ; <START_BUG> if ( ipv6_addr_type ( & lsa -> l2tp_addr ) & IPV6_ADDR_LINKLOCAL ) <END_BUG> lsa -> l2tp_scope_id = IP6CB ( skb ) -> iif ; } if ( np -> rxopt. all ) ip6_datagram_recv_ctl ( sk, msg, skb ) ; if ( flags & MSG_TRUNC ) copied = skb -> len ; done : skb_free_datagram ( sk, skb ) ; out : return err? err : copied ; }

Fix:
<S2SV_ModStart> = 0 ; lsa -> l2tp_conn_id = 0 ;
Buggy code:
 static int cac_read_binary ( sc_card_t * card, unsigned int idx, unsigned char * buf, size_t count, unsigned long flags ) { cac_private_data_t * priv = CAC_DATA ( card ) ; int r = 0 ; u8 * val = NULL ; u8 * cert_ptr ; <START_BUG> size_t val_len ; <END_BUG> size_t len, cert_len ; u8 cert_type ; SC_FUNC_CALLED ( card -> ctx, SC_LOG_DEBUG_VERBOSE ) ; if ( priv -> cached ) { sc_log ( card -> ctx, "returning   cached   value   idx=%d   count=%" SC_FORMAT_LEN_SIZE_T "u", idx, count ) ; if ( idx > priv -> cache_buf_len ) { LOG_FUNC_RETURN ( card -> ctx, SC_ERROR_FILE_END_REACHED ) ; } len = MIN ( count, priv -> cache_buf_len - idx ) ; memcpy ( buf, & priv -> cache_buf [ idx ], len ) ; LOG_FUNC_RETURN ( card -> ctx, len ) ; } sc_log ( card -> ctx, "clearing   cache   idx=%d   count=%" SC_FORMAT_LEN_SIZE_T "u", idx, count ) ; free ( priv -> cache_buf ) ; priv -> cache_buf = NULL ; priv -> cache_buf_len = 0 ; r = cac_cac1_get_certificate ( card, & val, & val_len ) ; if ( r < 0 ) goto done ; if ( val_len < 1 ) { r = SC_ERROR_INVALID_DATA ; goto done ; } cert_type = val [ 0 ] ; cert_ptr = val + 1 ; cert_len = val_len - 1 ; if ( ( cert_type & 0x3 ) == 1 ) { # ifdef ENABLE_ZLIB r = sc_decompress_alloc ( & priv -> cache_buf, & priv -> cache_buf_len, cert_ptr, cert_len, COMPRESSION_AUTO ) ; # else sc_log ( card -> ctx, "CAC   compression   not   supported,   no   zlib" ) ; r = SC_ERROR_NOT_SUPPORTED ; # endif if

Fix:
<S2SV_ModStart> ; size_t val_len = 0
Buggy code:
 static inline int sctp_chunk_length_valid ( struct sctp_chunk * chunk, __u16 required_length ) { __u16 chunk_length = ntohs ( chunk -> chunk_hdr -> length ) ; <START_BUG> if ( unlikely ( chunk_length < required_length ) ) <END_BUG> return 0 ; return 1 ; }

Fix:
<S2SV_ModStart> ( unlikely ( chunk -> pdiscard ) ) return 0 ; if ( unlikely (
Buggy code:
 pcap_t * pcap_ng_check_header ( const uint8_t * magic, FILE * fp, u_int precision, char * errbuf, int * err ) { bpf_u_int32 magic_int ; size_t amt_read ; bpf_u_int32 total_length ; bpf_u_int32 byte_order_magic ; struct block_header * bhdrp ; struct section_header_block * shbp ; pcap_t * p ; int swapped = 0 ; struct pcap_ng_sf * ps ; int status ; struct block_cursor cursor ; struct interface_description_block * idbp ; * err = 0 ; memcpy ( & magic_int, magic, sizeof ( magic_int ) ) ; if ( magic_int!= BT_SHB ) { return ( NULL ) ; } amt_read = fread ( & total_length, 1, sizeof ( total_length ), fp ) ; if ( amt_read < sizeof ( total_length ) ) { if ( ferror ( fp ) ) { pcap_fmt_errmsg_for_errno ( errbuf, PCAP_ERRBUF_SIZE, errno, "error   reading   dump   file" ) ; * err = 1 ; return ( NULL ) ; } return ( NULL ) ; } amt_read = fread ( & byte_order_magic, 1, sizeof ( byte_order_magic ), fp ) ; if ( amt_read < sizeof ( byte_order_magic ) ) { if ( ferror ( fp ) ) { pcap_fmt_errmsg_for_errno ( errbuf, PCAP_ERRBUF_SIZE, errno, "error   reading   dump   file" ) ; * err = 1 ; return ( NULL ) ; } return ( NULL ) ; } if ( byte_order_magic!= BYTE_ORDER_MAGIC ) { byte_order_magic = SWAPLONG ( byte_order_magic ) ; if ( byte_order_magic!= BYTE_ORDER_MAGIC ) { return ( NULL ) ; } swapped = 1 ; total_length = SWAPLONG ( total_length ) ; } if ( total_length < sizeof ( * bhdrp ) + sizeof ( * shbp ) + sizeof ( struct block_trailer ) || ( total_length > BT_SHB_

Fix:
<S2SV_ModStart>, "Section <S2SV_blank> Header <S2SV_blank> Block <S2SV_blank> in <S2SV_blank> pcapng <S2SV_blank> dump <S2SV_blank> file <S2SV_blank> has <S2SV_blank> invalid <S2SV_blank> length <S2SV_blank> %" PRIsize " <S2SV_blank> < <S2SV_blank> _%u_ <S2SV_blank> < <S2SV_blank> %u <S2SV_blank> (BT_SHB_INSANE_MAX)" <S2SV_ModEnd>, sizeof (
Buggy code:
 static int vp8_rdcost_mby ( MACROBLOCK * mb ) { int cost = 0 ; int b ; MACROBLOCKD * x = & mb -> e_mbd ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; <START_BUG> vpx_memcpy ( & t_above, mb -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, mb -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; for ( b = 0 ; b < 16 ; b ++ ) cost += cost_coeffs ( mb, x -> block + b, PLANE_TYPE_Y_NO_DC, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; cost += cost_coeffs ( mb, x -> block + 24, PLANE_TYPE_Y2, ta + vp8_block2above [ 24 ], tl + vp8_block2left [ 24 ] ) ; return cost ; }<END_BUG>

Fix:
<S2SV_ModStart> * tl ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left
Buggy code:
 static void ip_optprint ( netdissect_options * ndo, register const u_char * cp, u_int length ) { register u_int option_len ; const char * sep = "" ; for ( ; length > 0 ; cp += option_len, length -= option_len ) { u_int option_code ; ND_PRINT ( ( ndo, "%s", sep ) ) ; sep = "," ; ND_TCHECK ( * cp ) ; option_code = * cp ; ND_PRINT ( ( ndo, "%s", tok2str ( ip_option_values, "unknown   %u", option_code ) ) ) ; if ( option_code == IPOPT_NOP || option_code == IPOPT_EOL ) option_len = 1 ; else { ND_TCHECK ( cp [ 1 ] ) ; option_len = cp [ 1 ] ; if ( option_len < 2 ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", option_len ) ) ; return ; } } if ( option_len > length ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", option_len ) ) ; return ; } ND_TCHECK2 ( * cp, option_len ) ; switch ( option_code ) { case IPOPT_EOL : return ; case IPOPT_TS : ip_printts ( ndo, cp, option_len ) ; break ; case IPOPT_RR : case IPOPT_SSRR : case IPOPT_LSRR : <START_BUG> ip_printroute ( ndo, cp, option_len ) ; <END_BUG> break ; case IPOPT_RA : if ( option_len < 4 ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", option_len ) ) ; break ; } ND_TCHECK ( cp [ 3 ] ) ; if ( EXTRACT_16BITS ( & cp [ 2 ] )!= 0 ) ND_PRINT ( ( ndo, "   value   %u", EXTRACT_16BITS ( & cp [ 2 ] ) ) ) ; break ; case IPOPT_NOP : case IPOPT_SECURITY : default : break ; } } return ; trunc :

Fix:
<S2SV_ModStart> case IPOPT_LSRR : if ( <S2SV_ModStart>, option_len ) == - 1 ) goto trunc
Buggy code:
 <START_BUG> static int renameColumnSelectCb ( Walker * pWalker, Select * p ) { <END_BUG> renameWalkWith ( pWalker, p ) ; return WRC_Continue ; }

Fix:
<S2SV_ModStart> p ) { if ( p -> selFlags & SF_View ) return WRC_Prune ;
Buggy code:
 static int iwgif_read_image ( struct iwgifrcontext * rctx ) { int retval = 0 ; struct lzwdeccontext d ; size_t subblocksize ; int has_local_ct ; int local_ct_size ; unsigned int root_codesize ; if (! iwgif_read ( rctx, rctx -> rbuf, 9 ) ) goto done ; rctx -> image_left = ( int ) iw_get_ui16le ( & rctx -> rbuf [ 0 ] ) ; rctx -> image_top = ( int ) iw_get_ui16le ( & rctx -> rbuf [ 2 ] ) ; rctx -> image_width = ( int ) iw_get_ui16le ( & rctx -> rbuf [ 4 ] ) ; <START_BUG> rctx -> image_height = ( int ) iw_get_ui16le ( & rctx -> rbuf [ 6 ] ) ; <END_BUG> rctx -> interlaced = ( int ) ( ( rctx -> rbuf [ 8 ] >> 6 ) & 0x01 ) ; has_local_ct = ( int ) ( ( rctx -> rbuf [ 8 ] >> 7 ) & 0x01 ) ; if ( has_local_ct ) { local_ct_size = ( int ) ( rctx -> rbuf [ 8 ] & 0x07 ) ; rctx -> colortable. num_entries = 1 << ( 1 + local_ct_size ) ; } if ( has_local_ct ) { if (! iwgif_read_color_table ( rctx, & rctx -> colortable ) ) goto done ; } if ( rctx -> has_transparency ) { rctx -> colortable. entry [ rctx -> trans_color_index ]. a = 0 ; } if (! iwgif_read ( rctx, rctx -> rbuf, 1 ) ) goto done ; root_codesize = ( unsigned int ) rctx -> rbuf [ 0 ] ; if ( root_codesize < 2 || root_codesize > 11 ) { iw_set_error ( rctx -> ctx, "Invalid   LZW   minimum   code   size" ) ; goto done ; } if (! iwgif_init_screen ( rctx ) ) goto done ; rctx -> total_npixels = ( size_t ) rctx -> image_width * ( size_t ) rctx -> image_height ; if (! iwgif_

Fix:
<S2SV_ModStart> ] ) ; if ( rctx -> image_width < 1 || rctx -> image_height < 1 ) { iw_set_error ( rctx -> ctx, "Invalid <S2SV_blank> image <S2SV_blank> dimensions" ) ; goto done ; }
Buggy code:
 static int parse_elements ( netdissect_options * ndo, struct mgmt_body_t * pbody, const u_char * p, int offset, u_int length ) { u_int elementlen ; struct ssid_t ssid ; struct challenge_t challenge ; struct rates_t rates ; struct ds_t ds ; struct cf_t cf ; struct tim_t tim ; pbody -> challenge_present = 0 ; pbody -> ssid_present = 0 ; pbody -> rates_present = 0 ; pbody -> ds_present = 0 ; pbody -> cf_present = 0 ; pbody -> tim_present = 0 ; while ( length!= 0 ) { if (! ND_TTEST2 ( * ( p + offset ), 2 ) ) return 0 ; if ( length < 2 ) return 0 ; elementlen = * ( p + offset + 1 ) ; if (! ND_TTEST2 ( * ( p + offset + 2 ), elementlen ) ) return 0 ; if ( length < elementlen + 2 ) return 0 ; switch ( * ( p + offset ) ) { case E_SSID : memcpy ( & ssid, p + offset, 2 ) ; offset += 2 ; length -= 2 ; if ( ssid. length!= 0 ) { if ( ssid. length > sizeof ( ssid. ssid ) - 1 ) return 0 ; <START_BUG> if (! ND_TTEST2 ( * ( p + offset ), ssid. length ) ) <END_BUG> return 0 ; if ( length < ssid. length ) return 0 ; memcpy ( & ssid. ssid, p + offset, ssid. length ) ; offset += ssid. length ; length -= ssid. length ; } ssid. ssid [ ssid. length ] = '\\0' ; if (! pbody -> ssid_present ) { pbody -> ssid = ssid ; pbody -> ssid_present = 1 ; } break ; case E_CHALLENGE : memcpy ( & challenge, p + offset, 2 ) ; offset += 2 ; length -= 2 ; if ( challenge. length!= 0 ) { if ( challenge. length > sizeof ( challenge. text ) - 1 ) return 0 ;  if (! ND_TTEST2 ( * ( p + offset ), challenge. length ) ) <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> return 0 ; <S2SV_ModEnd> memcpy ( & <S2SV_ModStart> return 0 ; <S2SV_ModEnd> memcpy ( & <S2SV_ModStart> return 0 ; <S2SV_ModEnd> memcpy ( & <S2SV_ModStart> p + offset <S2SV_ModEnd>, tim.