nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static double get_rate_correction_factor ( const VP9_COMP * cpi ) { <END_BUG> if ( cpi -> common. frame_type == KEY_FRAME ) {  return cpi -> rc. key_frame_rate_correction_factor ; <START_BUG> } else { if ( ( cpi -> refresh_alt_ref_frame || cpi -> refresh_golden_frame ) && <END_BUG>! cpi -> rc. is_src_frame_alt_ref &&  <START_BUG>! ( cpi -> use_svc && cpi -> oxcf. end_usage == USAGE_STREAM_FROM_SERVER ) ) <END_BUG> return cpi -> rc. gf_rate_correction_factor ; else return cpi -> rc. rate_correction_factor ; } }

Fix:
<S2SV_ModStart> cpi ) { const RATE_CONTROL * const rc = & cpi -> rc ; double rcf ; <S2SV_ModStart> KEY_FRAME ) { rcf = rc -> rate_correction_factors [ KF_STD ] ; } else if ( cpi -> oxcf. pass == 2 ) { RATE_FACTOR_LEVEL rf_lvl = cpi -> twopass. gf_group. rf_level [ cpi -> twopass. gf_group. index ] ; rcf = rc -> rate_correction_factors [ rf_lvl ] <S2SV_ModEnd> ; } else <S2SV_ModStart> ) &&! rc -> <S2SV_ModEnd> is_src_frame_alt_ref &&! <S2SV_ModStart> is_src_frame_alt_ref &&! <S2SV_ModEnd> cpi -> use_svc <S2SV_ModStart> -> use_svc && ( <S2SV_ModStart> -> oxcf. rc_mode!= VPX_CBR || cpi -> oxcf. gf_cbr_boost_pct > 20 ) ) rcf = rc -> rate_correction_factors [ GF_ARF_STD ] ; else rcf = rc -> rate_correction_factors [ INTER_NORMAL ] ; } rcf *= rcf_mult [ rc -> frame_size
Buggy code:
 static int protocol_client_msg ( VncState * vs, uint8_t * data, size_t len ) { int i ; uint16_t limit ; VncDisplay * vd = vs -> vd ; if ( data [ 0 ] > 3 ) { update_displaychangelistener ( & vd -> dcl, VNC_REFRESH_INTERVAL_BASE ) ; } switch ( data [ 0 ] ) { case VNC_MSG_CLIENT_SET_PIXEL_FORMAT : if ( len == 1 ) return 20 ; set_pixel_format ( vs, read_u8 ( data, 4 ), read_u8 ( data, 5 ), read_u8 ( data, 6 ), read_u8 ( data, 7 ), read_u16 ( data, 8 ), read_u16 ( data, 10 ), read_u16 ( data, 12 ), read_u8 ( data, 14 ), read_u8 ( data, 15 ), read_u8 ( data, 16 ) ) ; break ; case VNC_MSG_CLIENT_SET_ENCODINGS : if ( len == 1 ) return 4 ; if ( len == 4 ) { limit = read_u16 ( data, 2 ) ; if ( limit > 0 ) return 4 + ( limit * 4 ) ; } else limit = read_u16 ( data, 2 ) ; for ( i = 0 ; i < limit ; i ++ ) { int32_t val = read_s32 ( data, 4 + ( i * 4 ) ) ; memcpy ( data + 4 + ( i * 4 ), & val, sizeof ( val ) ) ; } set_encodings ( vs, ( int32_t * ) ( data + 4 ), limit ) ; break ; case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST : if ( len == 1 ) return 10 ; framebuffer_update_request ( vs, read_u8 ( data, 1 ), read_u16 ( data, 2 ), read_u16 ( data, 4 ), read_u16 ( data, 6 ), read_u16 ( data, 8 ) ) ; break ; case VNC_MSG_CLIENT_KEY_EVENT : if ( len == 1 ) return 8 ; key_event ( vs, read_u8 ( data, 1 ), read_

Fix:
<S2SV_ModStart> == 1 ) { <S2SV_ModStart> return 8 ; } <S2SV_ModStart> 4 ) ; if ( dlen > ( 1 << 20 ) ) { error_report ( "vnc: <S2SV_blank> client_cut_text <S2SV_blank> msg <S2SV_blank> payload <S2SV_blank> has <S2SV_blank> %u <S2SV_blank> bytes" " <S2SV_blank> which <S2SV_blank> exceeds <S2SV_blank> our <S2SV_blank> limit <S2SV_blank> of <S2SV_blank> 1MB.", dlen ) ; vnc_client_error ( vs ) ; break ; } <S2SV_ModStart> > 0 ) { <S2SV_ModStart> + dlen ; }
Buggy code:
 static void rd_use_partition ( VP9_COMP * cpi, <START_BUG> const TileInfo * const tile, <END_BUG> MODE_INFO * * mi_8x8, TOKENEXTRA * * tp, int mi_row, int mi_col, BLOCK_SIZE bsize, int * rate, int64_t * dist,  int do_recon ) { <START_BUG> VP9_COMMON * const cm = & cpi -> common ; <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  MACROBLOCKD * const xd = & x -> e_mbd ; const int mis = cm -> mi_stride ; <START_BUG> const int bsl = b_width_log2 ( bsize ) ; <END_BUG> const int mi_step = num_4x4_blocks_wide_lookup [ bsize ] // 2 ; const int bss = ( 1 << bsl ) // 4 ; int i, pl ; PARTITION_TYPE partition = PARTITION_NONE ; BLOCK_SIZE subsize ; ENTROPY_CONTEXT l [ 16 * MAX_MB_PLANE ], a [ 16 * MAX_MB_PLANE ] ; PARTITION_CONTEXT sl [ 8 ], sa [ 8 ] ;  int last_part_rate = INT_MAX ; <START_BUG> int64_t last_part_dist = INT64_MAX ; int64_t last_part_rd = INT64_MAX ; int none_rate = INT_MAX ; int64_t none_dist = INT64_MAX ; int64_t none_rd = INT64_MAX ; int chosen_rate = INT_MAX ; int64_t chosen_dist = INT64_MAX ; int64_t chosen_rd = INT64_MAX ; BLOCK_SIZE sub_subsize = BLOCK_4X4 ; int splits_below = 0 ; BLOCK_SIZE bs_type = mi_8x8 [ 0 ] -> mbmi. sb_type ; int do_partition_search = 1 ; <END_BUG> if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols )  return ; assert ( num_4x4_blocks_wide_lookup [ bsize ] == num_4x4_blocks_high_lookup [ bsize ] ) ; <START_BUG> partition = partition_lookup [ bsl ] [ bs_type ] ; <END_BUG> subsize = get

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, TileDataEnc * tile_data <S2SV_ModEnd>, MODE_INFO * <S2SV_ModStart>, int do_recon, PC_TREE * pc_tree <S2SV_ModStart> -> common ; TileInfo * const tile_info = & tile_data -> tile_info ; <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> int bsl = b_width_log2_lookup [ bsize ] <S2SV_ModEnd> ; const int <S2SV_ModStart> 8 ] ; RD_COST last_part_rdc, none_rdc, chosen_rdc <S2SV_ModEnd> ; BLOCK_SIZE sub_subsize <S2SV_ModStart> = 1 ; PICK_MODE_CONTEXT * ctx = & pc_tree -> none ; <S2SV_ModStart> ] ) ; vp9_rd_cost_reset ( & last_part_rdc ) ; vp9_rd_cost_reset ( & none_rdc ) ; vp9_rd_cost_reset ( & chosen_rdc ) ; <S2SV_ModStart> partition ) ; pc_tree -> partitioning = partition ; save_context ( x <S2SV_ModEnd>, mi_row, <S2SV_ModStart> bsize == BLOCK_16X16 && cpi -> oxcf. aq_mode <S2SV_ModStart> ( cpi, tile_info, x <S2SV_ModEnd>, mi
Buggy code:
 long kvm_arch_vcpu_ioctl ( struct file * filp, unsigned int ioctl, unsigned long arg ) { struct kvm_vcpu * vcpu = filp -> private_data ; void __user * argp = ( void __user * ) arg ; int r ; union { struct kvm_lapic_state * lapic ; struct kvm_xsave * xsave ; struct kvm_xcrs * xcrs ; void * buffer ; } u ; u. buffer = NULL ; switch ( ioctl ) { case KVM_GET_LAPIC : { r = - EINVAL ; if (! vcpu -> arch. apic ) goto out ; u. lapic = kzalloc ( sizeof ( struct kvm_lapic_state ), GFP_KERNEL ) ; r = - ENOMEM ; if (! u. lapic ) goto out ; r = kvm_vcpu_ioctl_get_lapic ( vcpu, u. lapic ) ; if ( r ) goto out ; r = - EFAULT ; if ( copy_to_user ( argp, u. lapic, sizeof ( struct kvm_lapic_state ) ) ) goto out ; r = 0 ; break ; } case KVM_SET_LAPIC : { r = - EINVAL ; if (! vcpu -> arch. apic ) goto out ; u. lapic = memdup_user ( argp, sizeof ( * u. lapic ) ) ; if ( IS_ERR ( u. lapic ) ) return PTR_ERR ( u. lapic ) ; r = kvm_vcpu_ioctl_set_lapic ( vcpu, u. lapic ) ; break ; } case KVM_INTERRUPT : { struct kvm_interrupt irq ; r = - EFAULT ; if ( copy_from_user ( & irq, argp, sizeof irq ) ) goto out ; r = kvm_vcpu_ioctl_interrupt ( vcpu, & irq ) ; break ; } case KVM_NMI : { r = kvm_vcpu_ioctl_nmi ( vcpu ) ; break ; } case KVM_SET_CPUID : { struct kvm_cpuid __user * cpuid

Fix:
<S2SV_ModStart> ; r = <S2SV_ModEnd> kvm_lapic_set_vapic_addr ( vcpu
Buggy code:
 static struct page * follow_page_pte ( struct vm_area_struct * vma, unsigned long address, pmd_t * pmd, unsigned int flags ) { struct mm_struct * mm = vma -> vm_mm ; struct dev_pagemap * pgmap = NULL ; struct page * page ; spinlock_t * ptl ; pte_t * ptep, pte ; retry : if ( unlikely ( pmd_bad ( * pmd ) ) ) return no_page_table ( vma, flags ) ; ptep = pte_offset_map_lock ( mm, pmd, address, & ptl ) ; pte = * ptep ; if (! pte_present ( pte ) ) { swp_entry_t entry ; if ( likely (! ( flags & FOLL_MIGRATION ) ) ) goto no_page ; if ( pte_none ( pte ) ) goto no_page ; entry = pte_to_swp_entry ( pte ) ; if (! is_migration_entry ( entry ) ) goto no_page ; pte_unmap_unlock ( ptep, ptl ) ; migration_entry_wait ( mm, pmd, address ) ; goto retry ; } if ( ( flags & FOLL_NUMA ) && pte_protnone ( pte ) ) goto no_page ; <START_BUG> if ( ( flags & FOLL_WRITE ) &&! pte_write ( pte ) ) { <END_BUG> pte_unmap_unlock ( ptep, ptl ) ; return NULL ; } page = vm_normal_page ( vma, address, pte ) ; if (! page && pte_devmap ( pte ) && ( flags & FOLL_GET ) ) { pgmap = get_dev_pagemap ( pte_pfn ( pte ), NULL ) ; if ( pgmap ) page = pte_page ( pte ) ; else goto no_page ; } else if ( unlikely (! page ) ) { if ( flags & FOLL_DUMP ) { page = ERR_PTR ( - EFAULT ) ; goto out ; } if ( is_zero_pfn ( pte_pfn ( pte ) ) ) { page = pte_page ( pte )

Fix:
<S2SV_ModStart> ) &&! can_follow_write_pte ( pte, flags <S2SV_ModEnd> ) ) {
Buggy code:
 <START_BUG> void Huff_offsetReceive ( node_t * node, int * ch, byte * fin, int * offset ) { <END_BUG> bloc = * offset ;  while ( node && node -> symbol == INTERNAL_NODE ) { <START_BUG> if ( get_bit ( fin ) ) { node = node -> right ; } else { node = node -> left ; } } if (! node ) { * ch = 0 ; return ; } * ch = node -> symbol ; * offset = bloc ; }<END_BUG>

Fix:
<S2SV_ModStart> int * offset, int maxoffset <S2SV_ModStart> INTERNAL_NODE ) { if ( bloc >= maxoffset ) { * ch = 0 ; * offset = maxoffset + 1 ; return ; }
Buggy code:
 jas_seq2d_t * jas_seq2d_copy ( jas_seq2d_t * x ) { jas_matrix_t * y ; <START_BUG> int i ; <END_BUG> int j ; y = jas_seq2d_create ( jas_seq2d_xstart ( x ), jas_seq2d_ystart ( x ), jas_seq2d_xend ( x ), jas_seq2d_yend ( x ) ) ; assert ( y ) ; for ( i = 0 ; i < x -> numrows_ ; ++ i ) { for ( j = 0 ; j < x -> numcols_ ; ++ j ) { * jas_matrix_getref ( y, i, j ) = jas_matrix_get ( x, i, j ) ; } } return y ; }

Fix:
<S2SV_ModStart> * y ; jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; y
Buggy code:
 jas_image_t * jas_image_create ( int numcmpts, jas_image_cmptparm_t * cmptparms, int clrspc ) { jas_image_t * image ; <START_BUG> uint_fast32_t rawsize ; <END_BUG> uint_fast32_t inmem ; int cmptno ; jas_image_cmptparm_t * cmptparm ;  if (! ( image = jas_image_create0 ( ) ) ) { <START_BUG> <END_BUG> return 0 ;  } image -> clrspc_ = clrspc ; image -> maxcmpts_ = numcmpts ; <START_BUG> image -> inmem_ = true ; <END_BUG> if (! ( image -> cmpts_ = jas_alloc2 ( image -> maxcmpts_, sizeof ( jas_image_cmpt_t * ) ) ) ) {  jas_image_destroy ( image ) ; <START_BUG> return 0 ; } for ( cmptno = 0 ; cmptno < image -> maxcmpts_ ; ++ cmptno ) { image -> cmpts_ [ cmptno ] = 0 ; <END_BUG> }  rawsize = 0 ; for ( cmptno = 0, cmptparm = cmptparms ; cmptno < numcmpts ; ++ cmptno, ++ cmptparm ) { rawsize += cmptparm -> width * cmptparm -> height * ( cmptparm -> prec + 7 ) // 8 ; } inmem = ( rawsize < JAS_IMAGE_INMEMTHRESH ) ; <START_BUG> for ( cmptno = 0, cmptparm = cmptparms ; cmptno < numcmpts ; ++ cmptno, <END_BUG>  ++ cmptparm ) { <START_BUG> if (! ( image -> cmpts_ [ cmptno ] = jas_image_cmpt_create ( cmptparm -> tlx, cmptparm -> tly, cmptparm -> hstep, cmptparm -> vstep, cmptparm -> width, cmptparm -> height, cmptparm -> prec, cmptparm -> sgnd, inmem ) ) ) { <END_BUG> jas_image_destroy ( image ) ;  <START_BUG> return 0 ; <END_BUG> }  ++ image -> numcmpts_ ; <START_BUG> } jas<END_BUG>

Fix:
<S2SV_ModStart> * image ; size_t <S2SV_ModEnd> rawsize ; uint_fast32_t <S2SV_ModStart> * cmptparm ; image = 0 ; JAS_DBGLOG ( 100, ( "jas_image_create(%d, <S2SV_blank> %p, <S2SV_blank> %d)\\n", numcmpts, cmptparms, clrspc ) ) ; <S2SV_ModStart> ) ) { goto error <S2SV_ModEnd> ; } image <S2SV_ModStart> = numcmpts ; <S2SV_ModEnd> if (! <S2SV_ModStart> ) ) { goto error <S2SV_ModEnd> ; } for <S2SV_ModStart> 0 ; } # if 0 <S2SV_ModStart> JAS_IMAGE_INMEMTHRESH ) ; # endif <S2SV_ModStart> cmptparm ) { if (! jas_safe_size_mul3 ( cmptparm -> width, cmptparm -> height, ( cmptparm -> prec + 7 ), & rawsize ) ) { goto error ; } rawsize //= 8 ; inmem = ( rawsize < JAS_IMAGE_INMEMTHRESH ) ; <S2SV_ModStart> ) ) { goto error ; } ++ image -> numcmpts_ ; } jas_image_setbbox ( image ) ; return image ; error : if ( image ) { <S2SV_ModStart> image ) ; } <S2SV_ModStart> 0 ; } <S2SV_ModEnd> <S
Buggy code:
 VTermState * vterm_obtain_state ( VTerm * vt ) { VTermState * state ; if ( vt -> state ) return vt -> state ; <START_BUG> state = vterm_state_new ( vt ) ; <END_BUG> vt -> state = state ; state -> combine_chars_size = 16 ; state -> combine_chars = vterm_allocator_malloc ( state -> vt, state -> combine_chars_size * sizeof ( state -> combine_chars [ 0 ] ) ) ; state -> tabstops = vterm_allocator_malloc ( state -> vt, ( state -> cols + 7 ) // 8 ) ; state -> lineinfo = vterm_allocator_malloc ( state -> vt, state -> rows * sizeof ( VTermLineInfo ) ) ; state -> encoding_utf8. enc = vterm_lookup_encoding ( ENC_UTF8, 'u' ) ; if ( * state -> encoding_utf8. enc -> init!= NULL ) ( * state -> encoding_utf8. enc -> init ) ( state -> encoding_utf8. enc, state -> encoding_utf8. data ) ; vterm_parser_set_callbacks ( vt, & parser_callbacks, state ) ; return state ; }

Fix:
<S2SV_ModStart> ( vt ) ; if ( state == NULL ) return NULL
Buggy code:
 static void find_next_key_frame ( VP9_COMP * cpi, FIRSTPASS_STATS * this_frame ) { int i, j ; RATE_CONTROL * const rc = & cpi -> rc ; <START_BUG> struct twopass_rc * const twopass = & cpi -> twopass ; <END_BUG> const FIRSTPASS_STATS first_frame = * this_frame ;  const FIRSTPASS_STATS * start_position = twopass -> stats_in ; <START_BUG> FIRSTPASS_STATS next_frame ; FIRSTPASS_STATS last_frame ; <END_BUG> double decay_accumulator = 1.0 ;  double zero_motion_accumulator = 1.0 ; double boost_score = 0.0 ; double kf_mod_err = 0.0 ; double kf_group_err = 0.0 ; double recent_loop_decay [ 8 ] = { 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0 } ; vp9_zero ( next_frame ) ; cpi -> common. frame_type = KEY_FRAME ; <START_BUG> rc -> this_key_frame_forced = rc -> next_key_frame_forced ; <END_BUG> rc -> source_alt_ref_active = 0 ;  rc -> frames_till_gf_update_due = 0 ; <START_BUG> rc -> frames_to_key = 1 ; twopass -> kf_group_bits = 0 ; twopass -> kf_group_error_left = 0 ; <END_BUG> kf_mod_err = calculate_modified_err ( cpi, this_frame ) ;  i = 0 ; <START_BUG> while ( twopass -> stats_in < twopass -> stats_in_end ) { <END_BUG>  kf_group_err += calculate_modified_err ( cpi, this_frame ) ; <START_BUG> last_frame = * this_frame ; input_stats ( twopass, this_frame ) ; if ( cpi -> oxcf. auto_key && <END_BUG> lookup_next_frame_stats ( twopass, & next_frame )!= EOF ) {  double loop_decay_rate ; <START_BUG> if ( test_candidate_kf ( twopass, & last_frame, this_frame, & next_frame ) ) <END_BUG> break ;  loop_decay_

Fix:
<S2SV_ModStart> -> rc ; TWO_PASS <S2SV_ModEnd> * const twopass <S2SV_ModStart> cpi -> twopass ; GF_GROUP * const gf_group = & twopass -> gf_group ; const VP9EncoderConfig * const oxcf = & cpi -> oxcf <S2SV_ModStart> const FIRSTPASS_STATS * const <S2SV_ModStart> FIRSTPASS_STATS last_frame ; int kf_bits = 0 ; int loop_decay_counter = 0 ; <S2SV_ModStart> decay_accumulator = 1.0 ; double av_decay_accumulator = 0.0 <S2SV_ModStart> = KEY_FRAME ; vp9_zero ( * gf_group ) ; <S2SV_ModStart> = 0 ; cpi -> multi_arf_last_grp_enabled = 0 ; <S2SV_ModStart> calculate_modified_err ( cpi, twopass, oxcf <S2SV_ModStart> twopass -> stats_in_end && rc -> frames_to_key < cpi -> oxcf. key_freq <S2SV_ModStart> ( cpi, twopass, oxcf, <S2SV_ModStart>. auto_key && twopass -> stats_in < twopass -> stats_in_end <S2SV_ModEnd> ) { double <S2SV_ModStart>, this_frame, twopass -> stats_in <S2SV_ModEnd> ) ) break
Buggy code:
 static int list_fields ( MYSQL * mysql, const char * db, const char * table, const char * wild ) { <START_BUG> char query [ 1024 ], * end ; <END_BUG> MYSQL_RES * result ; MYSQL_ROW row ; ulong UNINIT_VAR ( rows ) ; if ( mysql_select_db ( mysql, db ) ) { fprintf ( stderr, "%s:   Cannot   connect   to   db:   %s:   %s\\n", my_progname, db, mysql_error ( mysql ) ) ; return 1 ; } if ( opt_count ) {  sprintf ( query, "select   count(*)   from   `%s`", table ) ; <START_BUG> if ( mysql_query ( mysql, query ) ||! ( result = mysql_store_result ( mysql ) ) ) { fprintf ( stderr, "%s:   Cannot   get   record   count   for   db:   %s,   table:   %s:   %s\\n", my_progname, db, table, mysql_error ( mysql ) ) ; return 1 ; } row = mysql_fetch_row ( result ) ; rows = ( ulong ) strtoull ( row [ 0 ], ( char * * ) 0, 10 ) ; mysql_free_result ( result ) ; } <END_BUG> end = strmov ( strmov ( strmov ( query, "show      columns   from   `" ), table ), "`" ) ;  <START_BUG> if ( wild && wild [ 0 ] ) <END_BUG> strxmov ( end, "   like   \'", wild, "\'", NullS ) ; if ( mysql_query ( mysql, query ) ||! ( result = mysql_store_result ( mysql ) ) ) { fprintf ( stderr, "%s:   Cannot   list   columns   in   db:   %s,   table:   %s:   %s\\n", my_progname, db, table, mysql_error ( mysql ) ) ; return 1 ; } printf ( "Database:   %s     Table:   %s", db, table ) ; if ( opt_count ) printf ( "     Rows:   %lu", rows ) ; if ( wild && wild [ 0 ] ) printf ( "     Wildcard:   %

Fix:
<S2SV_ModStart> char query [ NAME_LEN + 100 ] ; int len <S2SV_ModEnd> ; MYSQL_RES * <S2SV_ModStart> opt_count ) { my_snprintf ( query, sizeof ( query ) <S2SV_ModEnd>, "select <S2SV_blank> count(*) <S2SV_blank> from <S2SV_blank> `%s`", <S2SV_ModStart> ) ; } len = sizeof ( query ) ; len -= my_snprintf ( query, len, "show <S2SV_blank> //*!32332 <S2SV_blank> FULL <S2SV_blank> *// <S2SV_blank> columns <S2SV_blank> from <S2SV_blank> `%s`", table <S2SV_ModEnd> ) ; if <S2SV_ModStart> [ 0 ] && len ) strxnmov ( query + strlen ( query ), len <S2SV_ModEnd>, " <S2SV_blank> like <S2SV_blank> \'", <S2SV_ModStart> opt_show_keys ) { my_snprintf ( query, sizeof ( query ), "show <S2SV_blank> keys <S2SV_blank> from <S2SV_blank> `%s`", table <S2SV_ModEnd> ) ; if
Buggy code:
 void virtio_config_writeb ( VirtIODevice * vdev, uint32_t addr, uint32_t data ) { VirtioDeviceClass * k = VIRTIO_DEVICE_GET_CLASS ( vdev ) ; uint8_t val = data ; <START_BUG> if ( addr > ( vdev -> config_len - sizeof ( val ) ) ) <END_BUG> return ; stb_p ( vdev -> config + addr, val ) ; if ( k -> set_config ) { k -> set_config ( vdev, vdev -> config ) ; } }

Fix:
<S2SV_ModStart> if ( addr + <S2SV_ModEnd> sizeof ( val <S2SV_ModStart> ( val ) > vdev -> config_len ) { return ; } <S2SV_ModEnd> stb_p ( vdev
Buggy code:
 int ip_queue_xmit ( struct sk_buff * skb ) { struct sock * sk = skb -> sk ; struct inet_sock * inet = inet_sk ( sk ) ; <START_BUG> struct ip_options * opt = inet -> opt ; <END_BUG> struct rtable * rt ; struct iphdr * iph ; int res ; rcu_read_lock ( ) ;  rt = skb_rtable ( skb ) ; <START_BUG> if ( rt!= NULL ) goto packet_routed ; rt = ( struct rtable * ) __sk_dst_check ( sk, 0 ) ; if ( rt == NULL ) { __be32 daddr ; daddr = inet -> inet_daddr ; <END_BUG> if ( opt && opt -> srr )  <START_BUG> daddr = opt -> faddr ; <END_BUG> rt = ip_route_output_ports ( sock_net ( sk ), sk, daddr, inet -> inet_saddr, inet -> inet_dport, inet -> inet_sport, sk -> sk_protocol, RT_CONN_FLAGS ( sk ), sk -> sk_bound_dev_if ) ; if ( IS_ERR ( rt ) ) goto no_route ; sk_setup_caps ( sk, & rt -> dst ) ; } skb_dst_set_noref ( skb, & rt -> dst ) ; packet_routed :  if ( opt && opt -> is_strictroute && rt -> rt_dst!= rt -> rt_gateway ) <START_BUG> goto no_route ; <END_BUG> skb_push ( skb, sizeof ( struct iphdr ) + ( opt? opt -> optlen : 0 ) ) ;  skb_reset_network_header ( skb ) ; iph = ip_hdr ( skb ) ; * ( ( __be16 * ) iph ) = htons ( ( 4 << 12 ) | ( 5 << 8 ) | ( inet -> tos & 0xff ) ) ; if ( ip_dont_fragment ( sk, & rt -> dst ) &&! skb -> local_df ) iph -> frag_off = htons ( IP_DF ) ; else iph -> frag_off = 0 ; iph -> ttl = ip_select_ttl ( inet, & rt -> dst ) ; iph -> protocol = sk -> sk_protocol ; iph -> saddr = rt

Fix:
<S2SV_ModStart> ) ; struct ip_options_rcu * inet_opt <S2SV_ModEnd> ; struct rtable <S2SV_ModStart> ( ) ; inet_opt = rcu_dereference ( inet -> inet_opt ) ; <S2SV_ModStart> ; if ( inet_opt && inet_opt -> opt. <S2SV_ModEnd> srr ) daddr <S2SV_ModStart> ) daddr = inet_opt -> opt. <S2SV_ModEnd> faddr ; rt <S2SV_ModStart> : if ( inet_opt && inet_opt -> opt. <S2SV_ModEnd> is_strictroute && rt <S2SV_ModStart> ) + ( inet_opt? inet_opt -> opt. <S2SV_ModEnd> optlen : 0 <S2SV_ModStart> ; if ( inet_opt && inet_opt -> opt. <S2SV_ModEnd> optlen ) { <S2SV_ModStart> -> ihl += inet_opt -> opt. <S2SV_ModEnd> optlen >> 2 <S2SV_ModStart> ( skb, & inet_opt ->
Buggy code:
 int cdf_read_property_info ( const cdf_stream_t * sst, const cdf_header_t * h, uint32_t offs, cdf_property_info_t * * info, size_t * count, size_t * maxcount ) { const cdf_section_header_t * shp ; cdf_section_header_t sh ; const uint8_t * p, * q, * e ; int16_t s16 ; int32_t s32 ; uint32_t u32 ; int64_t s64 ; uint64_t u64 ; cdf_timestamp_t tp ; size_t i, o, o4, nelements, j ; cdf_property_info_t * inp ; if ( offs > UINT32_MAX // 4 ) { errno = EFTYPE ; goto out ; } shp = CAST ( const cdf_section_header_t *, ( const void * ) ( ( const char * ) sst -> sst_tab + offs ) ) ; if ( cdf_check_stream_offset ( sst, h, shp, sizeof ( * shp ), __LINE__ ) == - 1 ) goto out ; sh. sh_len = CDF_TOLE4 ( shp -> sh_len ) ; # define CDF_SHLEN_LIMIT ( UINT32_MAX // 8 ) if ( sh. sh_len > CDF_SHLEN_LIMIT ) { errno = EFTYPE ; goto out ; } sh. sh_properties = CDF_TOLE4 ( shp -> sh_properties ) ; # define CDF_PROP_LIMIT ( UINT32_MAX // ( 4 * sizeof ( * inp ) ) ) if ( sh. sh_properties > CDF_PROP_LIMIT ) goto out ; DPRINTF ( ( "section   len:   %u   properties   %u\\n", sh. sh_len, sh. sh_properties ) ) ; if ( * maxcount ) { if ( * maxcount > CDF_PROP_LIMIT ) goto out ; * maxcount += sh. sh_properties ; inp = CAST ( cdf_property_info_t *, realloc ( * info, * maxcount * sizeof ( * inp ) ) ) ; } else { * maxcount = sh. sh_properties ; inp = CAST ( cdf_property_info_t *, malloc ( * maxcount *

Fix:
<S2SV_ModStart> if ( q < p ) { DPRINTF ( ( "Wrapped <S2SV_blank> around <S2SV_blank> %p <S2SV_blank> < <S2SV_blank> %p\\n", q, p ) ) ; goto out ; } if ( q
Buggy code:
 UINT32 UIPC_Read ( tUIPC_CH_ID ch_id, UINT16 * p_msg_evt, UINT8 * p_buf, UINT32 len ) { int n ; int n_read = 0 ; int fd = uipc_main. ch [ ch_id ]. fd ; struct pollfd pfd ; UNUSED ( p_msg_evt ) ; if ( ch_id >= UIPC_CH_NUM ) { BTIF_TRACE_ERROR ( "UIPC_Read   :   invalid   ch   id   %d", ch_id ) ; return 0 ; } if ( fd == UIPC_DISCONNECTED ) { BTIF_TRACE_ERROR ( "UIPC_Read   :   channel   %d   closed", ch_id ) ; return 0 ; } while ( n_read < ( int ) len ) { pfd. fd = fd ; pfd. events = POLLIN | POLLHUP ; <START_BUG> if ( poll ( & pfd, 1, uipc_main. ch [ ch_id ]. read_poll_tmo_ms ) == 0 ) <END_BUG> { BTIF_TRACE_EVENT ( "poll   timeout   (%d   ms)", uipc_main. ch [ ch_id ]. read_poll_tmo_ms ) ; break ; } if ( pfd. revents & ( POLLHUP | POLLNVAL ) ) { BTIF_TRACE_EVENT ( "poll   :   channel   detached   remotely" ) ; UIPC_LOCK ( ) ; uipc_close_locked ( ch_id ) ; UIPC_UNLOCK ( ) ; return 0 ; }  n = recv ( fd, p_buf + n_read, len - n_read, 0 ) ; <START_BUG> if ( n == 0 ) { BTIF_TRACE_EVENT ( "UIPC_Read   :   channel   detached   remotely" ) ; UIPC_LOCK ( ) ; uipc_close_locked ( ch_id ) ; UIPC_UNLOCK ( ) ; return 0 ; } if ( n < 0 ) { BTIF_TRACE_EVENT ( "UIPC_Read   :   read   failed   (%s)",<END_BUG>

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> ]. read_poll_tmo_ms ) <S2SV_ModStart> } n = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 struct parsed_tag * parse_tag ( char * * s, int internal ) { struct parsed_tag * tag = NULL ; int tag_id ; char tagname [ MAX_TAG_LEN ], attrname [ MAX_TAG_LEN ] ; char * p, * q ; <START_BUG> int i, attr_id = 0, nattr ; <END_BUG> q = ( * s ) + 1 ; p = tagname ; if ( * q == '//' ) { * ( p ++ ) = * ( q ++ ) ; SKIP_BLANKS ( q ) ; } while ( * q &&! IS_SPACE ( * q ) &&! ( tagname [ 0 ]!= '//' && * q == '//' ) && * q!= '>' && p - tagname < MAX_TAG_LEN - 1 ) { * ( p ++ ) = TOLOWER ( * q ) ; q ++ ; } * p = '\\0' ; while ( * q &&! IS_SPACE ( * q ) &&! ( tagname [ 0 ]!= '//' && * q == '//' ) && * q!= '>' ) q ++ ; tag_id = getHash_si ( & tagtable, tagname, HTML_UNKNOWN ) ; if ( tag_id == HTML_UNKNOWN || (! internal && TagMAP [ tag_id ]. flag & TFLG_INT ) ) goto skip_parse_tagarg ; tag = New ( struct parsed_tag ) ; bzero ( tag, sizeof ( struct parsed_tag ) ) ; tag -> tagid = tag_id ; if ( ( nattr = TagMAP [ tag_id ]. max_attribute ) > 0 ) { tag -> attrid = NewAtom_N ( unsigned char, nattr ) ; tag -> value = New_N ( char *, nattr ) ; tag -> map = NewAtom_N ( unsigned char, MAX_TAGATTR ) ; memset ( tag -> map, MAX_TAGATTR, MAX_TAGATTR ) ; memset ( tag -> attrid, ATTR_UNKNOWN, nattr ) ; for ( i = 0 ; i < nattr ; i ++ ) tag -> map [ TagMAP [ tag_id ]. accept_attribute [ i ] ] = i ; } SKIP_BLANKS ( q ) ; while ( 1 ) { Str value = NULL, value_tmp = NULL ; if ( * q == '>' || * q == '\\0' ) goto done_parse_tag ; p =

Fix:
<S2SV_ModStart> 0, nattr ; tagname [ 0 ] = '\\0'
Buggy code:
 static Image * ReadPWPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { FILE * file ; Image * image, * next_image, * pwp_image ; ImageInfo * read_info ; int c, unique_file ; MagickBooleanType status ; register Image * p ; register ssize_t i ; size_t filesize, length ; ssize_t count ; unsigned char magick [ MagickPathExtent ] ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; pwp_image = AcquireImage ( image_info, exception ) ; image = pwp_image ; status = OpenBlob ( image_info, pwp_image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( ( Image * ) NULL ) ; count = ReadBlob ( pwp_image, 5, magick ) ; if ( ( count!= 5 ) || ( LocaleNCompare ( ( char * ) magick, "SFW95", 5 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; read_info = CloneImageInfo ( image_info ) ; ( void ) SetImageInfoProgressMonitor ( read_info, ( MagickProgressMonitor ) NULL, ( void * ) NULL ) ; SetImageInfoBlob ( read_info, ( void * ) NULL, 0 ) ; unique_file = AcquireUniqueFileResource ( read_info -> filename ) ; for ( ; ; ) { for ( c = ReadBlobByte ( pwp_image ) ; c!= EOF ; c = ReadBlobByte ( pwp_image ) ) { for ( i = 0 ; i < 17 ; i ++ ) magick [ i ] = magick [ i + 1 ] ; magick [ 17 ] = ( unsigned char ) c ; if ( LocaleNCompare ( ( char * ) ( magick + 12 ), "SFW94A", 6 ) == 0 ) break ; } if ( c == EOF

Fix:
<S2SV_ModStart> read_info ) ; <S2SV_ModEnd> if ( EOFBlob
Buggy code:
 static ssize_t cifs_iovec_write ( struct file * file, const struct iovec * iov, unsigned long nr_segs, loff_t * poffset ) { unsigned long nr_pages, i ; <START_BUG> size_t copied, len, cur_len ; <END_BUG> ssize_t total_written = 0 ; loff_t offset ; struct iov_iter it ; struct cifsFileInfo * open_file ; struct cifs_tcon * tcon ; struct cifs_sb_info * cifs_sb ; struct cifs_writedata * wdata, * tmp ; struct list_head wdata_list ; int rc ; pid_t pid ; len = iov_length ( iov, nr_segs ) ; if (! len ) return 0 ; rc = generic_write_checks ( file, poffset, & len, 0 ) ; if ( rc ) return rc ; INIT_LIST_HEAD ( & wdata_list ) ; cifs_sb = CIFS_SB ( file -> f_path. dentry -> d_sb ) ; open_file = file -> private_data ; tcon = tlink_tcon ( open_file -> tlink ) ; if (! tcon -> ses -> server -> ops -> async_writev ) return - ENOSYS ; offset = * poffset ; if ( cifs_sb -> mnt_cifs_flags & CIFS_MOUNT_RWPIDFORWARD ) pid = open_file -> pid ; else pid = current -> tgid ; iov_iter_init ( & it, iov, nr_segs, len, 0 ) ; do { size_t save_len ; nr_pages = get_numpages ( cifs_sb -> wsize, len, & cur_len ) ; wdata = cifs_writedata_alloc ( nr_pages, cifs_uncached_writev_complete ) ; if (! wdata ) { rc = - ENOMEM ; break ; } rc = cifs_write_allocate_pages ( wdata -> pages, nr_pages ) ; if ( rc ) { kfree ( wdata ) ; break ; } save_len = cur_len ; for ( i = 0 ; i < nr_pages ; i ++ ) {  copied = min_t ( const size

Fix:
<S2SV_ModStart> i ; size_t bytes, <S2SV_ModStart> ++ ) { bytes <S2SV_ModEnd> = min_t ( <S2SV_ModStart>, 0, bytes <S2SV_ModEnd> ) ; cur_len <S2SV_ModStart> copied ) ; if ( copied < bytes ) break ; <S2SV_ModStart> save_len - cur_len ; if (! cur_len ) { for ( i = 0 ; i < nr_pages ; i ++ ) put_page ( wdata -> pages [ i ] ) ; kfree ( wdata ) ; rc = - EFAULT ; break ; } for ( ; nr_pages > i + 1 ; nr_pages -- ) put_page ( wdata -> pages [ nr_pages - 1 ] )
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_vld_decode ( dec_state_t * ps_dec, WORD16 * pi2_outAddr, const UWORD8 * pu1_scan, UWORD8 * pu1_pos, UWORD16 u2_intra_flag, UWORD16 u2_chroma_flag, UWORD16 u2_d_picture, UWORD16 u2_intra_vlc_format, UWORD16 u2_mpeg2, WORD32 * pi4_num_coeffs ) { UWORD32 u4_sym_len ; UWORD32 u4_decoded_value ; UWORD32 u4_level_first_byte ; WORD32 u4_level ; UWORD32 u4_run, u4_numCoeffs ; UWORD32 u4_buf ; UWORD32 u4_buf_nxt ; UWORD32 u4_offset ; UWORD32 * pu4_buf_aligned ; UWORD32 u4_bits ; stream_t * ps_stream = & ps_dec -> s_bit_stream ; WORD32 u4_pos ; UWORD32 u4_nz_cols ; UWORD32 u4_nz_rows ; * pi4_num_coeffs = 0 ; ps_dec -> u4_non_zero_cols = 0 ; ps_dec -> u4_non_zero_rows = 0 ; u4_nz_cols = ps_dec -> u4_non_zero_cols ; u4_nz_rows = ps_dec -> u4_non_zero_rows ; GET_TEMP_STREAM_DATA ( u4_buf, u4_buf_nxt, u4_offset, pu4_buf_aligned, ps_stream ) if ( u2_intra_flag ) { WORD32 dc_size ; WORD32 dc_diff ; WORD32 maxLen ; WORD32 idx ; maxLen = MPEG2_DCT_DC_SIZE_LEN ; idx = 0 ; if ( u2_chroma_flag!= 0 ) { maxLen += 1 ; idx ++ ; } { WORD16 end = 0 ; UWORD32 maxLen_tmp = maxLen ; UWORD16 m_iBit ; IBITS_NXT ( u4_buf, u4_buf_nxt, u

Fix:
<S2SV_ModStart>, u4_sym_len ) lead_zeros = CLZ ( u4_bits ) - 15 ; if ( lead_zeros > 11 ) { return IMPEG2D_MB_DATA_DECODE_ERR ; } <S2SV_ModStart>, u4_sym_len ) lead_zeros = CLZ ( u4_bits ) - 15 ; if ( lead_zeros > 11 ) { return IMPEG2D_MB_DATA_DECODE_ERR ; }
Buggy code:
 int vp9_block_energy ( VP9_COMP * cpi, MACROBLOCK * x, BLOCK_SIZE bs ) { double energy ; <START_BUG> unsigned int var = block_variance ( cpi, x, bs ) ; <END_BUG> vp9_clear_system_state ( ) ; energy = 0.9 * ( log ( var + 1.0 ) - 10.0 ) ; return clamp ( ( int ) round ( energy ), ENERGY_MIN, ENERGY_MAX ) ; }

Fix:
<S2SV_ModStart> double energy ; double energy_midpoint ; vpx_clear_system_state ( ) ; energy_midpoint = ( cpi -> oxcf. pass == 2 )? cpi -> twopass. mb_av_energy : DEFAULT_E_MIDPOINT ; energy = vp9_log_block_var <S2SV_ModEnd> ( cpi, <S2SV_ModStart>, bs ) - energy_midpoint <S2SV_ModEnd> ; return clamp
Buggy code:
 static char_u * do_one_cmd ( char_u * * cmdlinep, int sourcing, # ifdef FEAT_EVAL struct condstack * cstack, # endif char_u * ( * fgetline ) ( int, void *, int ), void * cookie ) { char_u * p ; linenr_T lnum ; long n ; char * errormsg = NULL ; char_u * after_modifier = NULL ; exarg_T ea ; int save_msg_scroll = msg_scroll ; cmdmod_T save_cmdmod ; int ni ; char_u * cmd ; vim_memset ( & ea, 0, sizeof ( ea ) ) ; ea. line1 = 1 ; ea. line2 = 1 ; # ifdef FEAT_EVAL ++ ex_nesting_level ; # endif if ( quitmore # ifdef FEAT_EVAL &&! getline_equal ( fgetline, cookie, get_func_line ) # endif &&! getline_equal ( fgetline, cookie, getnextac ) ) -- quitmore ; save_cmdmod = cmdmod ; if ( ( * cmdlinep ) [ 0 ] == '#' && ( * cmdlinep ) [ 1 ] == '!' ) goto doend ; ea. cmd = * cmdlinep ; ea. cmdlinep = cmdlinep ; ea. getline = fgetline ; ea. cookie = cookie ; # ifdef FEAT_EVAL ea. cstack = cstack ; # endif if ( parse_command_modifiers ( & ea, & errormsg, FALSE ) == FAIL ) goto doend ; after_modifier = ea. cmd ; # ifdef FEAT_EVAL ea. skip = did_emsg || got_int || did_throw || ( cstack -> cs_idx >= 0 &&! ( cstack -> cs_flags [ cstack -> cs_idx ] & CSF_ACTIVE ) ) ; # else ea. skip = ( if_level > 0 ) ; # endif cmd = ea. cmd ; ea. cmd = skip_range ( ea. cmd, NULL ) ; if ( * ea. cmd == '*' && vim_strchr ( p_cpo, CPO_STAR ) == NULL ) ea. cmd = skipwhite ( ea. cmd + 1 ) ; p = find_command ( & ea, NULL ) ; # ifdef

Fix:
<S2SV_ModStart> endif if ( restricted!= 0 && ( ea. argt & RESTRICT ) ) { errormsg = _ ( "E981: <S2SV_blank> Command <S2SV_blank> not <S2SV_blank> allowed <S2SV_blank> in <S2SV_blank> rvim" ) ; goto doend ; } if (
Buggy code:
 static void pci_emul_capwrite ( struct pci_vdev * dev, int offset, int bytes, uint32_t val ) { int capid ; uint8_t capoff, nextoff ; if ( ( offset & ( bytes - 1 ) )!= 0 ) return ; capoff = CAP_START_OFFSET ; while ( 1 ) { nextoff = pci_get_cfgdata8 ( dev, capoff + 1 ) ; if ( nextoff == 0 ) break ; if ( offset >= capoff && offset < nextoff ) break ; capoff = nextoff ; } <START_BUG> assert ( offset >= capoff ) ; <END_BUG> if ( offset == capoff || offset == capoff + 1 ) { if ( offset == capoff && bytes == 4 ) { bytes = 2 ; offset += 2 ; val >>= 16 ; } else return ; } capid = pci_get_cfgdata8 ( dev, capoff ) ; switch ( capid ) { case PCIY_MSI : msicap_cfgwrite ( dev, capoff, offset, bytes, val ) ; break ; case PCIY_MSIX : msixcap_cfgwrite ( dev, capoff, offset, bytes, val ) ; break ; case PCIY_EXPRESS : pciecap_cfgwrite ( dev, capoff, offset, bytes, val ) ; break ; default : CFGWRITE ( dev, offset, val, bytes ) ; break ; } }

Fix:
<S2SV_ModStart> nextoff ; } <S2SV_ModEnd> if ( offset
Buggy code:
 <START_BUG> static VALUE from_document ( VALUE klass, VALUE document ) <END_BUG> { xmlDocPtr doc ; xmlSchemaParserCtxtPtr ctx ; xmlSchemaPtr schema ; VALUE errors ; VALUE rb_schema ;  Data_Get_Struct ( document, xmlDoc, doc ) ; <START_BUG> <END_BUG> doc = doc -> doc ;  if ( has_blank_nodes_p ( DOC_NODE_CACHE ( doc ) ) ) { rb_raise ( rb_eArgError, "Creating   a   schema   from   a   document   that   has   blank   nodes   exposed   to   Ruby   is   dangerous" ) ; } ctx = xmlSchemaNewDocParserCtxt ( doc ) ; errors = rb_ary_new ( ) ; xmlSetStructuredErrorFunc ( ( void * ) errors, Nokogiri_error_array_pusher ) ; # ifdef HAVE_XMLSCHEMASETPARSERSTRUCTUREDERRORS xmlSchemaSetParserStructuredErrors ( ctx, Nokogiri_error_array_pusher, ( void * ) errors ) ; # endif schema = xmlSchemaParse ( ctx ) ; xmlSetStructuredErrorFunc ( NULL, NULL ) ; xmlSchemaFreeParserCtxt ( ctx ) ; if ( NULL == schema ) { xmlErrorPtr error = xmlGetLastError ( ) ; if ( error ) Nokogiri_error_raise ( NULL, error ) ; else rb_raise ( rb_eRuntimeError, "Could   not   parse   document" ) ; return Qnil ; } rb_schema = Data_Wrap_Struct ( klass, 0, dealloc, schema ) ; rb_iv_set ( rb_schema, "@errors", errors ) ; <START_BUG> return rb_schema ; <END_BUG> return Qnil ; }

Fix:
<S2SV_ModStart> VALUE from_document ( int argc, VALUE * argv, VALUE klass ) { VALUE document ; VALUE parse_options ; int parse_options_int ; <S2SV_ModEnd> xmlDocPtr doc ; <S2SV_ModStart> VALUE rb_schema ; int scanned_args = 0 ; scanned_args = rb_scan_args ( argc, argv, "11", & document, & parse_options ) ; <S2SV_ModStart> doc -> doc ; if ( scanned_args == 1 ) { parse_options = rb_const_get ( rb_const_get ( mNokogiriXml, rb_intern ( "ParseOptions" ) ), rb_intern ( "DEFAULT_SCHEMA" ) ) ; } parse_options_int = ( int ) NUM2INT ( rb_funcall ( parse_options, rb_intern ( "to_i" ), 0 ) ) <S2SV_ModStart> errors ) ; rb_iv_set ( rb_schema, "@parse_options", parse_options ) ;
Buggy code:
 static int rock_continue ( struct rock_state * rs ) { int ret = 1 ; int blocksize = 1 << rs -> inode -> i_blkbits ; const int min_de_size = offsetof ( struct rock_ridge, u ) ; kfree ( rs -> buffer ) ; rs -> buffer = NULL ; if ( ( unsigned ) rs -> cont_offset > blocksize - min_de_size || ( unsigned ) rs -> cont_size > blocksize || ( unsigned ) ( rs -> cont_offset + rs -> cont_size ) > blocksize ) { printk ( KERN_NOTICE "rock:   corrupted   directory   entry.   " "extent=%d,   offset=%d,   size=%d\\n", rs -> cont_extent, rs -> cont_offset, rs -> cont_size ) ; ret = - EIO ; goto out ; } if ( rs -> cont_extent ) { struct buffer_head * bh ; rs -> buffer = kmalloc ( rs -> cont_size, GFP_KERNEL ) ; if (! rs -> buffer ) { ret = - ENOMEM ; goto out ; } ret = - EIO ; <START_BUG> bh = sb_bread ( rs -> inode -> i_sb, rs -> cont_extent ) ; <END_BUG> if ( bh ) { memcpy ( rs -> buffer, bh -> b_data + rs -> cont_offset, rs -> cont_size ) ; put_bh ( bh ) ; rs -> chr = rs -> buffer ; rs -> len = rs -> cont_size ; rs -> cont_extent = 0 ; rs -> cont_size = 0 ; rs -> cont_offset = 0 ; return 0 ; } printk ( "Unable   to   read   rock-ridge   attributes\\n" ) ; } out : kfree ( rs -> buffer ) ; rs -> buffer = NULL ; return ret ; }

Fix:
<S2SV_ModStart> - EIO ; if ( ++ rs -> cont_loops >= RR_MAX_CE_ENTRIES ) goto out ;
Buggy code:
 void vp8_build_intra_predictors_mbuv_s_c ( MACROBLOCKD * x, unsigned char * uabove_row, unsigned char * vabove_row, unsigned char * uleft, unsigned char * vleft, int left_stride, unsigned char * upred_ptr, unsigned char * vpred_ptr, int pred_stride ) { unsigned char uleft_col [ 8 ] ; unsigned char utop_left = uabove_row [ - 1 ] ; unsigned char vleft_col [ 8 ] ; unsigned char vtop_left = vabove_row [ - 1 ] ; int i, j ; for ( i = 0 ; i < 8 ; i ++ ) { uleft_col [ i ] = uleft [ i * left_stride ] ; vleft_col [ i ] = vleft [ i * left_stride ] ; } switch ( x -> mode_info_context -> mbmi. uv_mode ) { case DC_PRED : { int expected_udc ; int expected_vdc ; int shift ; int Uaverage = 0 ; int Vaverage = 0 ; if ( x -> up_available ) { for ( i = 0 ; i < 8 ; i ++ ) { Uaverage += uabove_row [ i ] ; Vaverage += vabove_row [ i ] ; } } if ( x -> left_available ) { for ( i = 0 ; i < 8 ; i ++ ) { Uaverage += uleft_col [ i ] ; Vaverage += vleft_col [ i ] ; } } if (! x -> up_available &&! x -> left_available ) { expected_udc = 128 ; expected_vdc = 128 ; } else { shift = 2 + x -> up_available + x -> left_available ; expected_udc = ( Uaverage + ( 1 << ( shift - 1 ) ) ) >> shift ; expected_vdc = ( Vaverage + ( 1 << ( shift - 1 ) ) ) >> shift ; } for ( i = 0 ; i < 8 ; i ++ ) { <START_BUG> vpx_memset ( upred_ptr, expected_udc, 8 ) ; <END_BUG>  vpx_memset ( vpred_ptr, expected_vdc, 8 ) ; <START_BUG> upred_ptr += pred_stride ; vpred_ptr += pred_stride ; } }<END_BUG>

Fix:
<S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( upred_ptr, <S2SV_ModStart> 8 ) ; memset <S2SV_ModEnd> ( vpred_ptr, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( upred_ptr, <S2SV_ModStart> 8 ) ; memcpy <S2SV_ModEnd> ( vpred_ptr, <S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( upred_ptr, <S2SV_ModStart> 8 ) ; memset <S2SV_ModEnd> ( vpred_ptr,
Buggy code:
 static xmlChar * xmlParseAttValueComplex ( xmlParserCtxtPtr ctxt, int * attlen, int normalize ) { xmlChar limit = 0 ; xmlChar * buf = NULL ; xmlChar * rep = NULL ; int len = 0 ; int buf_size = 0 ; int c, l, in_space = 0 ; xmlChar * current = NULL ; xmlEntityPtr ent ; if ( NXT ( 0 ) == \'"\' ) { ctxt -> instate = XML_PARSER_ATTRIBUTE_VALUE ; limit = \'"\' ; NEXT ; } else if ( NXT ( 0 ) == '\\'' ) { limit = '\\'' ; ctxt -> instate = XML_PARSER_ATTRIBUTE_VALUE ; NEXT ; } else { xmlFatalErr ( ctxt, XML_ERR_ATTRIBUTE_NOT_STARTED, NULL ) ; return ( NULL ) ; } buf_size = XML_PARSER_BUFFER_SIZE ; buf = ( xmlChar * ) xmlMallocAtomic ( buf_size * sizeof ( xmlChar ) ) ; if ( buf == NULL ) goto mem_error ; c = CUR_CHAR ( l ) ; while ( ( NXT ( 0 )!= limit ) && ( IS_CHAR ( c ) ) && ( c!= '<' ) ) { if ( c == 0 ) break ; if ( c == '&' ) { in_space = 0 ; if ( NXT ( 1 ) == '#' ) { int val = xmlParseCharRef ( ctxt ) ; if ( val == '&' ) { if ( ctxt -> replaceEntities ) { if ( len > buf_size - 10 ) { growBuffer ( buf, 10 ) ; } buf [ len ++ ] = '&' ; } else { if ( len > buf_size - 10 ) { growBuffer ( buf, 10 ) ; } buf [ len ++ ] = '&' ; buf [ len ++ ] = '#' ; buf [ len ++ ] = '3' ; buf [ len ++ ] = '8' ; buf [ len ++ ] = ';' ; } } else if ( val!= 0 ) { if ( len > buf_size - 10 ) { growBuffer ( buf, 10 ) ; } len += xmlCopyChar ( 0, & buf [ len ], val ) ; } } else { ent = xmlParseEntityRef ( ctxt ) ; ctxt -> nbentities ++ ; if ( ent!= NULL ) ctxt -> nbentities += ent -> owner ; if ( ( ent!= NULL ) && ( ent ->

Fix:
<S2SV_ModStart> { while ( ( len > 0 ) && ( <S2SV_ModStart> == 0x20 ) )
Buggy code:
 static int handle_emulation_failure ( struct kvm_vcpu * vcpu ) { int r = EMULATE_DONE ; ++ vcpu -> stat. insn_emulation_fail ; trace_kvm_emulate_insn_failed ( vcpu ) ; <START_BUG> if (! is_guest_mode ( vcpu ) ) { <END_BUG> vcpu -> run -> exit_reason = KVM_EXIT_INTERNAL_ERROR ; vcpu -> run -> internal. suberror = KVM_INTERNAL_ERROR_EMULATION ; vcpu -> run -> internal. ndata = 0 ; r = EMULATE_FAIL ; } kvm_queue_exception ( vcpu, UD_VECTOR ) ; return r ; }

Fix:
<S2SV_ModStart> ( vcpu ) && kvm_x86_ops -> get_cpl ( vcpu ) == 0
Buggy code:
 void icmp6_print ( netdissect_options * ndo, const u_char * bp, u_int length, const u_char * bp2, int fragmented ) { const struct icmp6_hdr * dp ; const struct ip6_hdr * ip ; const struct ip6_hdr * oip ; const struct udphdr * ouh ; int dport ; const u_char * ep ; u_int prot ; dp = ( const struct icmp6_hdr * ) bp ; ip = ( const struct ip6_hdr * ) bp2 ; oip = ( const struct ip6_hdr * ) ( dp + 1 ) ; ep = ndo -> ndo_snapend ; ND_TCHECK ( dp -> icmp6_cksum ) ; if ( ndo -> ndo_vflag &&! fragmented ) { uint16_t sum, udp_sum ; if ( ND_TTEST2 ( bp [ 0 ], length ) ) { udp_sum = EXTRACT_16BITS ( & dp -> icmp6_cksum ) ; sum = icmp6_cksum ( ndo, ip, dp, length ) ; if ( sum!= 0 ) ND_PRINT ( ( ndo, "[bad   icmp6   cksum   0x%04x   ->   0x%04x!]   ", udp_sum, in_cksum_shouldbe ( udp_sum, sum ) ) ) ; else ND_PRINT ( ( ndo, "[icmp6   sum   ok]   " ) ) ; } } ND_PRINT ( ( ndo, "ICMP6,   %s", tok2str ( icmp6_type_values, "unknown   icmp6   type   (%u)", dp -> icmp6_type ) ) ) ; if ( ndo -> ndo_vflag && ( dp -> icmp6_type == ND_ROUTER_SOLICIT || dp -> icmp6_type == ND_ROUTER_ADVERT || dp -> icmp6_type == ND_NEIGHBOR_ADVERT || dp -> icmp6_type == ND_NEIGHBOR_SOLICIT || dp -> icmp6_type == ND_REDIRECT || dp -> icmp6_type ==

Fix:
<S2SV_ModStart> ( ndo, "%s", icmp6_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 static int faultin_page ( struct task_struct * tsk, struct vm_area_struct * vma, unsigned long address, unsigned int * flags, int * nonblocking ) { unsigned int fault_flags = 0 ; int ret ; if ( ( * flags & ( FOLL_POPULATE | FOLL_MLOCK ) ) == FOLL_MLOCK ) return - ENOENT ; if ( ( * flags & FOLL_POPULATE ) && ( stack_guard_page_start ( vma, address ) || stack_guard_page_end ( vma, address + PAGE_SIZE ) ) ) return - ENOENT ; if ( * flags & FOLL_WRITE ) fault_flags |= FAULT_FLAG_WRITE ; if ( * flags & FOLL_REMOTE ) fault_flags |= FAULT_FLAG_REMOTE ; if ( nonblocking ) fault_flags |= FAULT_FLAG_ALLOW_RETRY ; if ( * flags & FOLL_NOWAIT ) fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT ; if ( * flags & FOLL_TRIED ) { VM_WARN_ON_ONCE ( fault_flags & FAULT_FLAG_ALLOW_RETRY ) ; fault_flags |= FAULT_FLAG_TRIED ; } ret = handle_mm_fault ( vma, address, fault_flags ) ; if ( ret & VM_FAULT_ERROR ) { if ( ret & VM_FAULT_OOM ) return - ENOMEM ; if ( ret & ( VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE ) ) return * flags & FOLL_HWPOISON? - EHWPOISON : - EFAULT ; if ( ret & ( VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV ) ) return - EFAULT ; BUG ( ) ; } if ( tsk ) { if ( ret & VM_FAULT_MAJOR ) tsk -> maj_flt ++ ; else tsk -> min_flt ++ ; } if ( ret & VM_FAULT_RETRY ) { if ( nonblocking ) * nonblocking = 0 ; return - EBUSY ; } if ( ( ret & VM_FAULT_WRITE ) &&! ( vma -> vm_flags & VM_WRITE ) ) <START_BUG> * flags &=<END_BUG>

Fix:
<S2SV_ModStart> ) * flags |= FOLL_COW <S2SV_ModEnd> ; return 0
Buggy code:
 static int isis_print ( netdissect_options * ndo, const uint8_t * p, u_int length ) { const struct isis_common_header * isis_header ; const struct isis_iih_lan_header * header_iih_lan ; const struct isis_iih_ptp_header * header_iih_ptp ; const struct isis_lsp_header * header_lsp ; const struct isis_csnp_header * header_csnp ; const struct isis_psnp_header * header_psnp ; const struct isis_tlv_lsp * tlv_lsp ; const struct isis_tlv_ptp_adj * tlv_ptp_adj ; const struct isis_tlv_is_reach * tlv_is_reach ; const struct isis_tlv_es_reach * tlv_es_reach ; uint8_t pdu_type, max_area, id_length, tlv_type, tlv_len, tmp, alen, lan_alen, prefix_len ; uint8_t ext_is_len, ext_ip_len, mt_len ; const uint8_t * optr, * pptr, * tptr ; u_short packet_len, pdu_len, key_id ; u_int i, vendor_id ; int sigcheck ; packet_len = length ; optr = p ; isis_header = ( const struct isis_common_header * ) p ; ND_TCHECK ( * isis_header ) ; if ( length < ISIS_COMMON_HEADER_SIZE ) goto trunc ; pptr = p + ( ISIS_COMMON_HEADER_SIZE ) ; header_iih_lan = ( const struct isis_iih_lan_header * ) pptr ; header_iih_ptp = ( const struct isis_iih_ptp_header * ) pptr ; header_lsp = ( const struct isis_lsp_header * ) pptr ; header_csnp = ( const struct isis_csnp_header * ) pptr ; header_psnp = ( const struct isis_psnp_header * ) pptr ; if (! ndo -> ndo_

Fix:
<S2SV_ModStart> tmp ) { ND_TCHECK2 ( * tptr, alen ) ;
Buggy code:
 static size_t read_uncompressed_header ( VP9Decoder * pbi, <START_BUG> struct vp9_read_bit_buffer * rb ) { <END_BUG> VP9_COMMON * const cm = & pbi -> common ;  size_t sz ; <START_BUG> <END_BUG> int i ;  cm -> last_frame_type = cm -> frame_type ; <START_BUG> if ( vp9_rb_read_literal ( rb, 2 )!= VP9_FRAME_MARKER ) <END_BUG> vpx_internal_error ( & cm -> error, VPX_CODEC_UNSUP_BITSTREAM, "Invalid   frame   marker" ) ;  cm -> profile = read_profile ( rb ) ; <START_BUG> if ( cm -> profile >= MAX_PROFILES ) vpx_internal_error ( & cm -> error, VPX_CODEC_UNSUP_BITSTREAM, "Unsupported   bitstream   profile" ) ; <END_BUG> cm -> show_existing_frame = vp9_rb_read_bit ( rb ) ;  if ( cm -> show_existing_frame ) { <START_BUG> const int frame_to_show = cm -> ref_frame_map [ vp9_rb_read_literal ( rb, 3 ) ] ; <END_BUG>  if ( cm -> frame_bufs [ frame_to_show ]. ref_count < 1 ) <START_BUG> vpx_internal_error ( & cm -> error, VPX_CODEC_UNSUP_BITSTREAM, "Buffer   %d   does   not   contain   a   decoded   frame", frame_to_show ) ; <END_BUG> ref_cnt_fb ( cm -> frame_bufs, & cm -> new_fb_idx, frame_to_show ) ;  pbi -> refresh_frame_flags = 0 ; cm -> lf. filter_level = 0 ; cm -> show_frame = 1 ; <START_BUG> return 0 ; <END_BUG> }  cm -> frame_type = ( FRAME_TYPE ) vp9_rb_read_bit ( rb ) ; <START_BUG> <END_BUG> cm -> show_frame = vp9_rb_read_bit ( rb ) ;  <START_BUG> cm -> error_resilient_mode = vp9_rb_read_bit ( rb ) ; <END_BUG> if ( cm -> frame_type == KEY_FRAME ) {  check_sync_code ( cm, rb ) ; <START_BUG> if ( cm -> profile > PROFILE_<END_BUG>

Fix:
<S2SV_ModStart> pbi, struct vpx_read_bit_buffer <S2SV_ModEnd> * rb ) <S2SV_ModStart> -> common ; BufferPool * const pool = cm -> buffer_pool ; RefCntBuffer * const frame_bufs = pool -> frame_bufs ; int i, mask, ref_index = 0 ; <S2SV_ModStart> size_t sz ; <S2SV_ModEnd> cm -> last_frame_type <S2SV_ModStart> -> frame_type ; cm -> last_intra_only = cm -> intra_only ; if ( vpx_rb_read_literal <S2SV_ModEnd> ( rb, <S2SV_ModStart> -> profile = vp9_read_profile ( rb ) ; # if CONFIG_VP9_HIGHBITDEPTH <S2SV_ModEnd> if ( cm <S2SV_ModStart> "Unsupported <S2SV_blank> bitstream <S2SV_blank> profile" ) ; # else if ( cm -> profile >= PROFILE_2 ) vpx_internal_error ( & cm -> error, VPX_CODEC_UNSUP_BITSTREAM, "Unsupported <S2SV_blank> bitstream <S2SV_blank> profile" ) ; # endif <S2SV_ModStart> -> show_existing_frame = vpx_rb_read_bit <S2SV_ModEnd> ( rb ) <S2SV_ModStart> -> ref_frame_map [ vpx_rb_read_literal <S2SV_ModEnd> ( rb, <S2SV_ModStart> ) ] ; lock_buffer_pool ( pool ) ; if
Buggy code:
 static int dcbnl_cee_fill ( struct sk_buff * skb, struct net_device * netdev ) { struct nlattr * cee, * app ; struct dcb_app_type * itr ; const struct dcbnl_rtnl_ops * ops = netdev -> dcbnl_ops ; int dcbx, i, err = - EMSGSIZE ; u8 value ; if ( nla_put_string ( skb, DCB_ATTR_IFNAME, netdev -> name ) ) goto nla_put_failure ; cee = nla_nest_start ( skb, DCB_ATTR_CEE ) ; if (! cee ) goto nla_put_failure ; if ( ops -> getpgtccfgtx && ops -> getpgbwgcfgtx ) { err = dcbnl_cee_pg_fill ( skb, netdev, 1 ) ; if ( err ) goto nla_put_failure ; } if ( ops -> getpgtccfgrx && ops -> getpgbwgcfgrx ) { err = dcbnl_cee_pg_fill ( skb, netdev, 0 ) ; if ( err ) goto nla_put_failure ; } if ( ops -> getpfccfg ) { struct nlattr * pfc_nest = nla_nest_start ( skb, DCB_ATTR_CEE_PFC ) ; if (! pfc_nest ) goto nla_put_failure ; for ( i = DCB_PFC_UP_ATTR_0 ; i <= DCB_PFC_UP_ATTR_7 ; i ++ ) { ops -> getpfccfg ( netdev, i - DCB_PFC_UP_ATTR_0, & value ) ; if ( nla_put_u8 ( skb, i, value ) ) goto nla_put_failure ; } nla_nest_end ( skb, pfc_nest ) ; } spin_lock ( & dcb_lock ) ; app = nla_nest_start ( skb, DCB_ATTR_CEE_APP_TABLE ) ; if (! app ) goto dcb_unlock ; list_for_each_entry ( itr, & dcb_app_list, list ) { if ( itr ->

Fix:
<S2SV_ModStart> cee_pg pg ; memset ( & pg, 0, sizeof ( pg ) ) ; <S2SV_ModStart> struct cee_pfc pfc ; memset ( & pfc, 0, sizeof ( pfc ) )
Buggy code:
 static int mxf_read_index_entry_array ( AVIOContext * pb, MXFIndexTableSegment * segment ) { int i, length ; segment -> nb_index_entries = avio_rb32 ( pb ) ; length = avio_rb32 ( pb ) ; <START_BUG> if (! ( segment -> temporal_offset_entries = av_calloc ( segment -> nb_index_entries, sizeof ( * segment -> temporal_offset_entries ) ) ) || <END_BUG>! ( segment -> flag_entries = av_calloc ( segment -> nb_index_entries, sizeof ( * segment -> flag_entries ) ) ) ||! ( segment -> stream_offset_entries = av_calloc ( segment -> nb_index_entries, sizeof ( * segment -> stream_offset_entries ) ) ) ) { av_freep ( & segment -> temporal_offset_entries ) ; av_freep ( & segment -> flag_entries ) ; return AVERROR ( ENOMEM ) ; }  for ( i = 0 ; i < segment -> nb_index_entries ; i ++ ) { <START_BUG> segment -> temporal_offset_entries [ i ] = avio_r8 ( pb ) ; avio_r8 ( pb ) ; segment -> flag_entries [ i ] = avio_r8 ( pb ) ; segment -> stream_offset_entries [ i ] = avio_rb64 ( pb ) ; avio_skip ( pb, length - 11 ) ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( segment -> nb_index_entries && length < 11 ) return AVERROR_INVALIDDATA ; if ( <S2SV_ModStart> ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ;