nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> int xt_check_entry_offsets ( const void * base, <END_BUG> unsigned int target_offset, unsigned int next_offset ) {  const struct xt_entry_target * t ; <START_BUG> <END_BUG> const char * e = base ;  if ( target_offset + sizeof ( * t ) > next_offset ) return - EINVAL ; t = ( void * ) ( e + target_offset ) ; if ( t -> u. target_size < sizeof ( * t ) ) return - EINVAL ; if ( target_offset + t -> u. target_size > next_offset ) return - EINVAL ; if ( strcmp ( t -> u. user. name, XT_STANDARD_TARGET ) == 0 && target_offset + sizeof ( struct xt_standard_target )!= next_offset ) return - EINVAL ; return 0 ; }

Fix:
<S2SV_ModStart> void * base, const char * elems <S2SV_ModStart> next_offset ) { long size_of_base_struct = elems - ( const char * ) base ; <S2SV_ModStart> e = base ; if ( target_offset < size_of_base_struct ) return - EINVAL
Buggy code:
 <START_BUG> int64_t vp9_block_error_c ( const int16_t * coeff, const int16_t * dqcoeff, <END_BUG> intptr_t block_size, int64_t * ssz ) { int i ; int64_t error = 0, sqcoeff = 0 ; for ( i = 0 ; i < block_size ; i ++ ) { const int diff = coeff [ i ] - dqcoeff [ i ] ; error += diff * diff ; sqcoeff += coeff [ i ] * coeff [ i ] ; } * ssz = sqcoeff ; return error ; }

Fix:
<S2SV_ModStart> vp9_block_error_c ( const tran_low_t <S2SV_ModEnd> * coeff, <S2SV_ModStart> coeff, const tran_low_t <S2SV_ModEnd> * dqcoeff,
Buggy code:
 static void sas_eh_handle_sas_errors ( struct Scsi_Host * shost, struct list_head * work_q ) { struct scsi_cmnd * cmd, * n ; enum task_disposition res = TASK_IS_DONE ; int tmf_resp, need_reset ; struct sas_internal * i = to_sas_internal ( shost -> transportt ) ; unsigned long flags ; struct sas_ha_struct * ha = SHOST_TO_SAS_HA ( shost ) ; LIST_HEAD ( done ) ; list_for_each_entry_safe ( cmd, n, work_q, eh_entry ) { struct domain_device * dev = cmd_to_domain_dev ( cmd ) ; struct sas_task * task ; spin_lock_irqsave ( & dev -> done_lock, flags ) ; task = TO_SAS_TASK ( cmd ) ; spin_unlock_irqrestore ( & dev -> done_lock, flags ) ; if (! task ) list_move_tail ( & cmd -> eh_entry, & done ) ; } Again : list_for_each_entry_safe ( cmd, n, work_q, eh_entry ) { struct sas_task * task = TO_SAS_TASK ( cmd ) ; list_del_init ( & cmd -> eh_entry ) ; spin_lock_irqsave ( & task -> task_state_lock, flags ) ; need_reset = task -> task_state_flags & SAS_TASK_NEED_DEV_RESET ; spin_unlock_irqrestore ( & task -> task_state_lock, flags ) ; if ( need_reset ) { SAS_DPRINTK ( "%s:   task   0x%p   requests   reset\\n", __func__, task ) ; goto reset ; } SAS_DPRINTK ( "trying   to   find   task   0x%p\\n", task ) ; res = sas_scsi_find_task ( task ) ; switch ( res ) { case TASK_IS_DONE : SAS_DPRINTK ( "%s:   task   0x%p   is   done\\n", __func__, task ) ; <START_BUG> sas_eh_defer_cmd ( cmd ) ; <END_BUG> continue ; case TASK_IS

Fix:
<S2SV_ModStart> task ) ; sas_eh_finish_cmd <S2SV_ModEnd> ( cmd ) <S2SV_ModStart> task ) ; sas_eh_finish_cmd <S2SV_ModEnd> ( cmd ) <S2SV_ModStart> lun ) ; sas_eh_finish_cmd <S2SV_ModEnd> ( cmd )
Buggy code:
 int sock_send_fd ( int sock_fd, const uint8_t * buf, int len, int send_fd ) { ssize_t ret ; struct msghdr msg ; unsigned char * buffer = ( unsigned char * ) buf ; memset ( & msg, 0, sizeof ( msg ) ) ; struct cmsghdr * cmsg ; char msgbuf [ CMSG_SPACE ( 1 ) ] ; asrt ( send_fd!= - 1 ) ; if ( sock_fd == - 1 || send_fd == - 1 ) return - 1 ; msg. msg_control = msgbuf ; msg. msg_controllen = sizeof msgbuf ; cmsg = CMSG_FIRSTHDR ( & msg ) ; cmsg -> cmsg_level = SOL_SOCKET ; cmsg -> cmsg_type = SCM_RIGHTS ; cmsg -> cmsg_len = CMSG_LEN ( sizeof send_fd ) ; memcpy ( CMSG_DATA ( cmsg ), & send_fd, sizeof send_fd ) ; int ret_len = len ; while ( len > 0 ) { struct iovec iv ; memset ( & iv, 0, sizeof ( iv ) ) ; iv. iov_base = buffer ; iv. iov_len = len ; msg. msg_iov = & iv ; msg. msg_iovlen = 1 ; do { <START_BUG> ret = sendmsg ( sock_fd, & msg, MSG_NOSIGNAL ) ; <END_BUG> } while ( ret < 0 && errno == EINTR ) ; if ( ret < 0 ) { BTIF_TRACE_ERROR ( "fd:%d,   send_fd:%d,   sendmsg   ret:%d,   errno:%d,   %s", sock_fd, send_fd, ( int ) ret, errno, strerror ( errno ) ) ; ret_len = - 1 ; break ; } buffer += ret ; len -= ret ; memset ( & msg, 0, sizeof ( msg ) ) ; } BTIF_TRACE_DEBUG ( "close   fd:%d   after   sent", send_fd ) ; close ( send_fd ) ; return ret_len ; }

Fix:
<S2SV_ModStart> { ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> msg, MSG_NOSIGNAL )
Buggy code:
 static struct nvmet_fc_tgt_queue * nvmet_fc_find_target_queue ( struct nvmet_fc_tgtport * tgtport, u64 connection_id ) { struct nvmet_fc_tgt_assoc * assoc ; struct nvmet_fc_tgt_queue * queue ; u64 association_id = nvmet_fc_getassociationid ( connection_id ) ; u16 qid = nvmet_fc_getqueueid ( connection_id ) ; <START_BUG> unsigned long flags ; <END_BUG> spin_lock_irqsave ( & tgtport -> lock, flags ) ; list_for_each_entry ( assoc, & tgtport -> assoc_list, a_list ) { if ( association_id == assoc -> association_id ) { queue = assoc -> queues [ qid ] ; if ( queue && (! atomic_read ( & queue -> connected ) ||! nvmet_fc_tgt_q_get ( queue ) ) ) queue = NULL ; spin_unlock_irqrestore ( & tgtport -> lock, flags ) ; return queue ; } } spin_unlock_irqrestore ( & tgtport -> lock, flags ) ; return NULL ; }

Fix:
<S2SV_ModStart> unsigned long flags ; if ( qid > NVMET_NR_QUEUES ) return NULL
Buggy code:
 const char * cJSON_GetErrorPtr ( void ) { <START_BUG> return ep ; <END_BUG> }

Fix:
<S2SV_ModStart> ) { return global_ep <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 bool_t enc28j60IrqHandler ( NetInterface * interface ) { bool_t flag ; uint8_t status ; flag = FALSE ; <START_BUG> enc28j60ClearBit ( interface, ENC28J60_REG_EIE, EIE_INTIE ) ; <END_BUG>  status = enc28j60ReadReg ( interface, ENC28J60_REG_EIR ) ; <START_BUG> <END_BUG> if ( ( status & EIR_LINKIF )!= 0 )  { <START_BUG> enc28j60ClearBit ( interface, ENC28J60_REG_EIE, EIE_LINKIE ) ; <END_BUG> interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; }  if ( ( status & EIR_PKTIF )!= 0 ) <START_BUG> { <END_BUG> enc28j60ClearBit ( interface, ENC28J60_REG_EIE, EIE_PKTIE ) ;  interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; } <START_BUG> if ( ( status & ( EIR_TXIF | EIE_TXERIE ) )!= 0 ) <END_BUG> {  enc28j60ClearBit ( interface, ENC28J60_REG_EIR, EIR_TXIF | EIE_TXERIE ) ; <START_BUG> flag |= osSetEventFromIsr ( & interface -> nicTxEvent ) ; } <END_BUG> enc28j60SetBit ( interface, ENC28J60_REG_EIE, EIE_INTIE ) ;  return flag ; }

Fix:
<S2SV_ModStart> ( interface, ENC28J60_EIE, ENC28J60_EIE_INTIE <S2SV_ModEnd> ) ; status <S2SV_ModStart> ( interface, ENC28J60_EIR <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( status & ENC28J60_EIR_LINKIF <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC28J60_EIE, ENC28J60_EIE_LINKIE <S2SV_ModEnd> ) ; interface <S2SV_ModStart> } if ( enc28j60ReadReg ( interface, ENC28J60_EPKTCNT <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC28J60_EIE, ENC28J60_EIE_PKTIE <S2SV_ModEnd> ) ; interface <S2SV_ModStart> status & ( ENC28J60_EIR_TXIF | ENC28J60_EIE_TXERIE <S2SV_ModEnd> ) )!= <S2SV_ModStart> ( interface, ENC28J60_EIR, ENC28J60_EIR_TXIF | ENC28J60_EIE_TXERIE <S2SV_ModEnd> ) ; flag <S2SV_ModStart> ( interface, ENC28J60_EIE, ENC28J60_EIE_INTIE <S2SV_ModEnd> ) ; return
Buggy code:
 <START_BUG> static int mpeg4_decode_profile_level ( MpegEncContext * s, GetBitContext * gb ) <END_BUG> { s -> avctx -> profile = get_bits ( gb, 4 ) ;  s -> avctx -> level = get_bits ( gb, 4 ) ; <START_BUG> <END_BUG> if ( s -> avctx -> profile == 0 && s -> avctx -> level == 8 ) {  <START_BUG> s -> avctx -> level = 0 ; <END_BUG> } return 0 ; }

Fix:
<S2SV_ModStart> GetBitContext * gb, int * profile, int * level ) { * <S2SV_ModEnd> profile = get_bits <S2SV_ModStart> 4 ) ; * <S2SV_ModEnd> level = get_bits <S2SV_ModStart> ; if ( * <S2SV_ModEnd> profile == 0 <S2SV_ModStart> == 0 && * <S2SV_ModEnd> level == 8 <S2SV_ModStart> 8 ) { * <S2SV_ModEnd> level = 0
Buggy code:
 static void usm_free_usmStateReference ( void * old ) { <START_BUG> struct usmStateReference * old_ref = ( struct usmStateReference * ) old ; <END_BUG>  if ( old_ref ) { <START_BUG> if ( old_ref -> usr_name_length ) SNMP_FREE ( old_ref -> usr_name ) ; <END_BUG> if ( old_ref -> usr_engine_id_length )  SNMP_FREE ( old_ref -> usr_engine_id ) ; <START_BUG> if ( old_ref -> usr_auth_protocol_length ) <END_BUG> SNMP_FREE ( old_ref -> usr_auth_protocol ) ;  if ( old_ref -> usr_priv_protocol_length ) <START_BUG> SNMP_FREE ( old_ref -> usr_priv_protocol ) ; <END_BUG> if ( old_ref -> usr_auth_key_length && old_ref -> usr_auth_key ) {  <START_BUG> SNMP_ZERO ( old_ref -> usr_auth_key, old_ref -> usr_auth_key_length ) ; <END_BUG>  SNMP_FREE ( old_ref -> usr_auth_key ) ; <START_BUG> } <END_BUG> if ( old_ref -> usr_priv_key_length && old_ref -> usr_priv_key ) {  <START_BUG> SNMP_ZERO ( old_ref -> usr_priv_key, old_ref -> usr_priv_key_length ) ; <END_BUG>  SNMP_FREE ( old_ref -> usr_priv_key ) ; <START_BUG> } <END_BUG> SNMP_ZERO ( old_ref, sizeof ( * old_ref ) ) ;  SNMP_FREE ( old_ref ) ; } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> struct usmStateReference * ref = <S2SV_ModEnd> old ; if <S2SV_ModStart> ; if (! ref ) return ; if ( -- ref -> refcnt > 0 ) return ; SNMP_FREE ( ref <S2SV_ModEnd> -> usr_name ) <S2SV_ModStart> usr_name ) ; SNMP_FREE ( ref <S2SV_ModEnd> -> usr_engine_id ) <S2SV_ModStart> usr_engine_id ) ; SNMP_FREE ( ref <S2SV_ModEnd> -> usr_auth_protocol ) <S2SV_ModStart> usr_auth_protocol ) ; SNMP_FREE ( ref <S2SV_ModEnd> -> usr_priv_protocol ) <S2SV_ModStart> ; if ( ref <S2SV_ModEnd> -> usr_auth_key_length && <S2SV_ModStart> -> usr_auth_key_length && ref <S2SV_ModEnd> -> usr_auth_key ) <S2SV_ModStart> { SNMP_ZERO ( ref <S2SV_ModEnd> -> usr_auth_key, <S2SV_ModStart> -> usr_auth_key, ref <S2SV_ModEnd> -> usr_auth_key_length ) <S2SV_ModStart> ; SNMP_FREE ( ref <S2SV_ModEnd> -> usr_auth_key ) <S2SV_ModStart> } if ( ref <S2SV_ModEnd> -> usr_priv_key_length && <S2SV_ModStart> -> usr_priv_key_length && ref <S2SV_ModEnd> -> usr_priv_key ) <S2SV_ModStart> { SNMP_ZERO ( ref <S2SV_ModEnd> -> usr_priv_key, <S2SV_ModStart> -> usr_priv_key, ref
Buggy code:
 vpx_codec_err_t vpx_codec_control_ ( vpx_codec_ctx_t * ctx, int ctrl_id,... ) { vpx_codec_err_t res ; if (! ctx ||! ctrl_id ) res = VPX_CODEC_INVALID_PARAM ; else if (! ctx -> iface ||! ctx -> priv ||! ctx -> iface -> ctrl_maps ) res = VPX_CODEC_ERROR ; else { vpx_codec_ctrl_fn_map_t * entry ; res = VPX_CODEC_ERROR ; for ( entry = ctx -> iface -> ctrl_maps ; entry && entry -> fn ; entry ++ ) { if (! entry -> ctrl_id || entry -> ctrl_id == ctrl_id ) { va_list ap ; va_start ( ap, ctrl_id ) ; <START_BUG> res = entry -> fn ( ctx -> priv -> alg_priv, ctrl_id, ap ) ; <END_BUG> va_end ( ap ) ; break ; } } } return SAVE_STATUS ( ctx, res ) ; }

Fix:
<S2SV_ModStart> -> fn ( ( vpx_codec_alg_priv_t * ) <S2SV_ModStart> ctx -> priv <S2SV_ModEnd>, ap )
Buggy code:
 <START_BUG> static int match ( Reinst * pc, const char * sp, const char * bol, int flags, Resub * out ) <END_BUG> { Resub scratch ;  int i ; <START_BUG> Rune c ; <END_BUG> for ( ; ; ) {  switch ( pc -> opcode ) { case I_END : <START_BUG> return 1 ; <END_BUG> case I_JUMP : pc = pc -> x ; break ; case I_SPLIT : scratch = * out ;  if ( match ( pc -> x, sp, bol, flags, & scratch ) ) { <START_BUG> * out = scratch ; <END_BUG> return 1 ;  } pc = pc -> y ; break ; case I_PLA : <START_BUG> if (! match ( pc -> x, sp, bol, flags, out ) ) <END_BUG> return 0 ; pc = pc -> y ; break ; case I_NLA : scratch = * out ;  if ( match ( pc -> x, sp, bol, flags, & scratch ) ) <START_BUG> return 0 ; pc = pc -> y ; break ; case I_ANYNL : sp += chartorune ( & c, sp ) ; if ( c == 0 ) <END_BUG> return 0 ;  pc = pc + 1 ; break ; case I_ANY : sp += chartorune ( & c, sp ) ; if ( c == 0 ) <START_BUG> return 0 ; <END_BUG> if ( isnewline ( c ) )  return 0 ; <START_BUG> pc = pc + 1 ; break ; case I_CHAR : sp += chartorune ( & c, sp ) ; if ( c == 0 ) <END_BUG> return 0 ;  if ( flags & REG_ICASE ) c = canon ( c ) ; if ( c!= pc -> c ) <START_BUG> return 0 ; <END_BUG> pc = pc + 1 ; break ; case I_CCLASS : sp += chartorune ( & c, sp ) ; if ( c == 0 )  return 0 ; <START_BUG> if ( flags & REG_ICASE ) { if (! incclasscanon ( pc -> cc, canon ( c ) ) ) <END_BUG> return 0 ;  } else { if (! incclass ( pc -> cc, c ) ) <START_BUG> return 0 ; <END_BUG> } pc = pc + 1 ; break ; case I_NCCLASS : sp += chartorune ( & c, sp ) ; if ( c == 0 )  return 0 ; <START_BUG> if ( flags & REG_ICASE ) { if ( incclasscanon ( pc -> cc, canon<END_BUG>

Fix:
<S2SV_ModStart> Resub * out, int depth <S2SV_ModStart> scratch ; int result ; int <S2SV_ModStart> Rune c ; if ( depth > MAXREC ) return - 1 ; <S2SV_ModStart> I_END : return 0 <S2SV_ModEnd> ; case I_JUMP <S2SV_ModStart> * out ; result = <S2SV_ModEnd> match ( pc <S2SV_ModStart>, & scratch, depth + 1 ) ; if ( result == - 1 ) return - 1 ; if ( result == 0 <S2SV_ModEnd> ) { * <S2SV_ModStart> scratch ; return 0 <S2SV_ModEnd> ; } pc <S2SV_ModStart> case I_PLA : result = <S2SV_ModEnd> match ( pc <S2SV_ModStart> flags, out, depth + 1 ) ; if ( result == - 1 ) return - 1 ; if ( result == 1 ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> * out ; result = <S2SV_ModEnd> match ( pc <S2SV_ModStart>, & scratch, depth + 1 ) ; if ( result == - 1 ) return - 1 ; if ( result == 0 ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> c ) return 1 <S2SV_ModEnd> ; pc = <S2SV_ModStart> 0 ) return 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) return 1 <S2SV_ModEnd> ; } else <S2SV_ModStart> ) ) return 1 <S2SV_ModEnd> ;
Buggy code:
 void vp9_rc_get_one_pass_cbr_params ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; RATE_CONTROL * const rc = & cpi -> rc ; int target ; if ( ( cm -> current_video_frame == 0 || <START_BUG> ( cm -> frame_flags & FRAMEFLAGS_KEY ) || <END_BUG> rc -> frames_to_key == 0 ||  ( cpi -> oxcf. auto_key && test_for_kf_one_pass ( cpi ) ) ) ) { <START_BUG> cm -> frame_type = KEY_FRAME ; rc -> this_key_frame_forced = cm -> current_video_frame!= 0 && rc -> frames_to_key == 0 ; <END_BUG> rc -> frames_to_key = cpi -> key_frame_frequency ;  rc -> kf_boost = DEFAULT_KF_BOOST ; <START_BUG> rc -> source_alt_ref_active = 0 ; <END_BUG> target = calc_iframe_target_size_one_pass_cbr ( cpi ) ; } else { cm -> frame_type = INTER_FRAME ;  target = calc_pframe_target_size_one_pass_cbr ( cpi ) ; <START_BUG> <END_BUG> }  vp9_rc_set_frame_target ( cpi, target ) ; <START_BUG> rc -> frames_till_gf_update_due = INT_MAX ; <END_BUG> rc -> baseline_gf_interval = INT_MAX ; }

Fix:
<S2SV_ModStart> 0 || ( cpi <S2SV_ModEnd> -> frame_flags & <S2SV_ModStart>. auto_key && 0 <S2SV_ModEnd> ) ) ) <S2SV_ModStart> = cpi -> oxcf. key_freq <S2SV_ModEnd> ; rc -> <S2SV_ModStart> source_alt_ref_active = 0 <S2SV_ModEnd> ; } else <S2SV_ModStart> = INTER_FRAME ; } if ( rc -> frames_till_gf_update_due == 0 ) { if ( cpi -> oxcf. aq_mode == CYCLIC_REFRESH_AQ ) vp9_cyclic_refresh_set_golden_update ( cpi ) ; else rc -> baseline_gf_interval = ( rc -> min_gf_interval + rc -> max_gf_interval ) // 2 ; rc -> frames_till_gf_update_due = rc -> baseline_gf_interval ; if ( rc -> frames_till_gf_update_due > rc -> frames_to_key ) rc -> frames_till_gf_update_due = rc -> frames_to_key ; cpi -> refresh_golden_frame = 1 ; rc -> gfu_boost = DEFAULT_GF_BOOST ; } if
Buggy code:
 const vpx_codec_cx_pkt_t * vpx_codec_get_cx_data ( vpx_codec_ctx_t * ctx, vpx_codec_iter_t * iter ) { const vpx_codec_cx_pkt_t * pkt = NULL ; if ( ctx ) { if (! iter ) ctx -> err = VPX_CODEC_INVALID_PARAM ; else if (! ctx -> iface ||! ctx -> priv ) ctx -> err = VPX_CODEC_ERROR ; else if (! ( ctx -> iface -> caps & VPX_CODEC_CAP_ENCODER ) ) ctx -> err = VPX_CODEC_INCAPABLE ; else <START_BUG> pkt = ctx -> iface -> enc. get_cx_data ( ctx -> priv -> alg_priv, iter ) ; <END_BUG> } if ( pkt && pkt -> kind == VPX_CODEC_CX_FRAME_PKT ) { vpx_codec_priv_t * const priv = ctx -> priv ; char * const dst_buf = ( char * ) priv -> enc. cx_data_dst_buf. buf ; if ( dst_buf && pkt -> data. raw. buf!= dst_buf && pkt -> data. raw. sz + priv -> enc. cx_data_pad_before + priv -> enc. cx_data_pad_after <= priv -> enc. cx_data_dst_buf. sz ) { vpx_codec_cx_pkt_t * modified_pkt = & priv -> enc. cx_data_pkt ; memcpy ( dst_buf + priv -> enc. cx_data_pad_before, pkt -> data. raw. buf, pkt -> data. raw. sz ) ; * modified_pkt = * pkt ; modified_pkt -> data. raw. buf = dst_buf ; modified_pkt -> data. raw. sz += priv -> enc. cx_data_pad_before + priv -> enc. cx_data_pad_after ; pkt = modified_pkt ; } if ( dst_buf == pkt -> data. raw. buf ) { priv -> enc. cx_data_dst_buf. buf = dst_buf + pkt -> data. raw. sz ; priv -> enc. cx_data_dst_buf.

Fix:
<S2SV_ModStart>. get_cx_data ( get_alg_priv ( ctx ) <S2SV_ModEnd>, iter )
Buggy code:
 int main ( argc, argv ) int argc ; char * argv [ ] ; { krb5_data pname_data, tkt_data ; int sock = 0 ; socklen_t l ; int retval ; struct sockaddr_in l_inaddr, f_inaddr ; krb5_creds creds, * new_creds ; krb5_ccache cc ; krb5_data msgtext, msg ; krb5_context context ; krb5_auth_context auth_context = NULL ; # ifndef DEBUG freopen ( "//tmp//uu-server.log", "w", stderr ) ; # endif retval = krb5_init_context ( & context ) ; if ( retval ) { com_err ( argv [ 0 ], retval, "while   initializing   krb5" ) ; exit ( 1 ) ; } # ifdef DEBUG { int one = 1 ; int acc ; struct servent * sp ; socklen_t namelen = sizeof ( f_inaddr ) ; if ( ( sock = socket ( PF_INET, SOCK_STREAM, 0 ) ) < 0 ) { com_err ( "uu-server", errno, "creating   socket" ) ; exit ( 3 ) ; } l_inaddr. sin_family = AF_INET ; l_inaddr. sin_addr. s_addr = 0 ; if ( argc == 2 ) { l_inaddr. sin_port = htons ( atoi ( argv [ 1 ] ) ) ; } else { if (! ( sp = getservbyname ( "uu-sample", "tcp" ) ) ) { com_err ( "uu-server", 0, "can\'t   find   uu-sample//tcp   service" ) ; exit ( 3 ) ; } l_inaddr. sin_port = sp -> s_port ; } ( void ) setsockopt ( sock, SOL_SOCKET, SO_REUSEADDR, ( char * ) & one, sizeof ( one ) ) ; if ( bind ( sock, ( struct sockaddr * ) & l_inaddr, sizeof ( l_inaddr ) ) ) { com_err ( "uu-server", errno, "binding   socket" ) ; exit ( 3 ) ; } if ( listen ( sock, 1 ) == - 1 ) { com_

Fix:
<S2SV_ModStart> if ( retval || pname_data. length == 0 || pname_data. data [ pname_data. length - 1 ]!= '\\0'
Buggy code:
 static const u_char * ikev1_t_print ( netdissect_options * ndo, u_char tpay _U_, const struct isakmp_gen * ext, u_int item_len, const u_char * ep, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto, int depth _U_ ) { const struct ikev1_pl_t * p ; struct ikev1_pl_t t ; const u_char * cp ; const char * idstr ; const struct attrmap * map ; size_t nmap ; const u_char * ep2 ; ND_PRINT ( ( ndo, "%s:", NPSTR ( ISAKMP_NPTYPE_T ) ) ) ; p = ( const struct ikev1_pl_t * ) ext ; ND_TCHECK ( * p ) ; UNALIGNED_MEMCPY ( & t, ext, sizeof ( t ) ) ; switch ( proto ) { case 1 : idstr = STR_OR_ID ( t. t_id, ikev1_p_map ) ; map = oakley_t_map ; nmap = sizeof ( oakley_t_map ) // sizeof ( oakley_t_map [ 0 ] ) ; break ; case 2 : idstr = STR_OR_ID ( t. t_id, ah_p_map ) ; map = ipsec_t_map ; nmap = sizeof ( ipsec_t_map ) // sizeof ( ipsec_t_map [ 0 ] ) ; break ; case 3 : idstr = STR_OR_ID ( t. t_id, esp_p_map ) ; map = ipsec_t_map ; nmap = sizeof ( ipsec_t_map ) // sizeof ( ipsec_t_map [ 0 ] ) ; break ; case 4 : idstr = STR_OR_ID ( t. t_id, ipcomp_p_map ) ; map = ipsec_t_map ; nmap = sizeof ( ipsec_t_map ) // sizeof ( ipsec_t_map [ 0 ] ) ; break ; default : idstr = NULL ; map = NULL ; nmap = 0 ; break ; } if ( id

Fix:
<S2SV_ModStart> && nmap ) <S2SV_ModEnd> cp = ikev1_attrmap_print <S2SV_ModStart>, cp, ep2, map, nmap ) ; else cp = ikev1_attr_print ( ndo, cp, ep2 ) ; if ( cp == NULL ) goto trunc ; } if <S2SV_ModStart> < ep2 ) <S2SV_ModEnd> ND_PRINT ( (
Buggy code:
 static int Downmix_Command ( effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, void * pCmdData, uint32_t * replySize, void * pReplyData ) { downmix_module_t * pDwmModule = ( downmix_module_t * ) self ; downmix_object_t * pDownmixer ; int retsize ; if ( pDwmModule == NULL || pDwmModule -> context. state == DOWNMIX_STATE_UNINITIALIZED ) { return - EINVAL ; } pDownmixer = ( downmix_object_t * ) & pDwmModule -> context ; ALOGV ( "Downmix_Command   command   %" PRIu32 "   cmdSize   %" PRIu32, cmdCode, cmdSize ) ; switch ( cmdCode ) { case EFFECT_CMD_INIT : <START_BUG> if ( pReplyData == NULL || * replySize!= sizeof ( int ) ) { <END_BUG> return - EINVAL ; } * ( int * ) pReplyData = Downmix_Init ( pDwmModule ) ; break ; case EFFECT_CMD_SET_CONFIG : if ( pCmdData == NULL || cmdSize!= sizeof ( effect_config_t )  || pReplyData == NULL || * replySize!= sizeof ( int ) ) { <START_BUG> return - EINVAL ; } * ( int * ) pReplyData = Downmix_Configure ( pDwmModule, ( effect_config_t * ) pCmdData, false ) ; break ; case EFFECT_CMD_RESET : Downmix_Reset ( pDownmixer, false ) ; break ; case EFFECT_CMD_GET_PARAM : ALOGV ( "Downmix_Command   EFFECT_CMD_GET_PARAM   pCmdData   %p,   *replySize   %" PRIu32 ",   pReplyData:   %p", pCmdData, * replySize, pReplyData ) ; if ( pCmdData == NULL || cmdSize < ( int ) ( sizeof ( effect_param_t ) + sizeof ( int32_t ) ) || <END_BUG> pReplyData == NULL ||  * replySize < ( int ) sizeof ( effect_param_t ) + 2 * sizeof ( int32_t ) ) { return - E

Fix:
<S2SV_ModStart> == NULL || replySize == NULL || <S2SV_ModStart> ) || pReplyData == NULL || replySize <S2SV_ModStart> ) || pReplyData == NULL || replySize <S2SV_ModStart> == NULL || replySize == NULL || <S2SV_ModStart> == NULL || replySize == NULL || <S2SV_ModStart> if ( pReplyData == NULL || replySize
Buggy code:
 static void <START_BUG> sraSpanInsertAfter ( sraSpan * newspan, sraSpan * after ) { <END_BUG> newspan -> _next = after -> _next ; newspan -> _prev = after ; after -> _next -> _prev = newspan ; after -> _next = newspan ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, sraSpan * after ) { if ( newspan && <S2SV_ModStart> newspan ; } }
Buggy code:
 mrb_value mrb_io_initialize_copy ( mrb_state * mrb, mrb_value copy ) { mrb_value orig ; mrb_value buf ; struct mrb_io * fptr_copy ; struct mrb_io * fptr_orig ; mrb_bool failed = TRUE ; mrb_get_args ( mrb, "o", & orig ) ; <START_BUG> fptr_copy = ( struct mrb_io * ) DATA_PTR ( copy ) ; <END_BUG> if ( fptr_copy!= NULL ) { fptr_finalize ( mrb, fptr_copy, FALSE ) ; mrb_free ( mrb, fptr_copy ) ; }  fptr_copy = ( struct mrb_io * ) mrb_io_alloc ( mrb ) ; <START_BUG> fptr_orig = io_get_open_fptr ( mrb, orig ) ; DATA_TYPE ( copy ) = & mrb_io_type ; DATA_PTR ( copy ) = fptr_copy ; buf = mrb_iv_get ( mrb, orig, mrb_intern_cstr ( mrb, "@buf" ) ) ; mrb_iv_set ( mrb, copy, mrb_intern_cstr ( mrb, "@buf" ), buf ) ; fptr_copy -> fd = mrb_dup ( mrb, fptr_orig -> fd, & failed ) ; if ( failed ) { mrb_sys_fail ( mrb, 0 ) ; } mrb_fd_cloexec ( mrb, fptr_copy -> fd ) ; if ( fptr_orig -> fd2!= - 1 ) { fptr_copy -> fd2 = mrb_dup ( mrb, fptr_orig -> fd2, & failed ) ; if ( failed ) { close ( fptr_copy -> fd ) ; mrb_sys_fail ( mrb, 0 ) ; } mrb_fd_cloexec ( mrb, fptr_copy -> fd2 ) ; } fptr_copy -> pid = fptr_orig -> pid ; fptr_copy -> readable = fptr_orig -> readable ; fptr_copy -> writable = fptr_orig -> writable ; fptr_copy -> sync = fptr_orig -> sync ; fptr_<END_BUG>

Fix:
<S2SV_ModStart> orig ) ; fptr_orig = io_get_open_fptr ( mrb, orig ) ; <S2SV_ModStart> mrb_io_alloc ( mrb <S2SV_ModEnd> ) ; DATA_TYPE
Buggy code:
 <START_BUG> int main_loop ( int argc, const char * * argv_ ) { <END_BUG> vpx_codec_ctx_t decoder ; char * fn = NULL ; int i ; uint8_t * buf = NULL ; size_t bytes_in_buffer = 0, buffer_size = 0 ; FILE * infile ; int frame_in = 0, frame_out = 0, flipuv = 0, noblit = 0 ;  int do_md5 = 0, progress = 0 ; <START_BUG> int stop_after = 0, postproc = 0, summary = 0, quiet = 1 ; int arg_skip = 0 ; <END_BUG> int ec_enabled = 0 ;  const VpxInterface * interface = NULL ; const VpxInterface * fourcc_interface = NULL ; uint64_t dx_time = 0 ; struct arg arg ; char * * argv, * * argi, * * argj ; int single_file ; int use_y4m = 1 ; <START_BUG> vpx_codec_dec_cfg_t cfg = { 0 } ; <END_BUG> # if CONFIG_VP8_DECODER vp8_postproc_cfg_t vp8_pp_cfg = { 0 } ; int vp8_dbg_color_ref_frame = 0 ; int vp8_dbg_color_mb_modes = 0 ; int vp8_dbg_color_b_modes = 0 ; int vp8_dbg_display_mv = 0 ; # endif int frames_corrupted = 0 ; int dec_flags = 0 ; int do_scale = 0 ; vpx_image_t * scaled_img = NULL ;  int frame_avail, got_data ; <START_BUG> int num_external_frame_buffers = 0 ; <END_BUG> struct ExternalFrameBufferList ext_fb_list = { 0 } ;  const char * outfile_pattern = NULL ; char outfile_name [ PATH_MAX ] = { 0 } ; FILE * outfile = NULL ; MD5Context md5_ctx ; unsigned char md5_digest [ 16 ] ; <START_BUG> struct VpxDecInputContext input = { 0 } ; <END_BUG>  struct VpxInputContext vpx_input_ctx = { 0 } ; <START_BUG> <END_BUG> struct WebmInputContext webm_ctx = { 0 } ;  <START_BUG> input. vpx_input_ctx = & vpx_input_ctx ; <END_BUG> input.

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> progress = 0, frame_parallel = 0 <S2SV_ModStart> ; int ec_enabled = 0 ; int keep_going <S2SV_ModStart> = 1 ; int opt_yv12 = 0 ; int opt_i420 = 0 ; <S2SV_ModStart> = { 0, 0, 0 } ; # if CONFIG_VP9_HIGHBITDEPTH int output_bit_depth = 0 ; # endif <S2SV_ModEnd> # if CONFIG_VP8_DECODER <S2SV_ModStart> = NULL ; # if CONFIG_VP9_HIGHBITDEPTH vpx_image_t * img_shifted = NULL ; # endif <S2SV_ModStart> frame_avail, got_data, flush_decoder = 0 <S2SV_ModStart> = { 0, NULL <S2SV_ModStart> input = { NULL, NULL <S2SV_ModEnd> } ; struct <S2SV_ModStart> struct VpxInputContext vpx_input_ctx ; # if CONFIG_WEBM_IO <S2SV_ModEnd> struct WebmInputContext webm_ctx <S2SV_ModStart> struct WebmInputContext webm_ctx ; memset ( & ( webm_ctx ), 0, sizeof ( webm_ctx ) ) <S2SV_ModEnd> ; input. <S2SV_ModStart> ; input. webm_ctx = & webm_ctx ;
Buggy code:
 int main ( int argc, char * * argv ) { int result ; int error = FALSE ; int display_license = FALSE ; int display_help = FALSE ; int c = 0 ; struct tm * tm, tm_s ; time_t now ; char datestring [ 256 ] ; nagios_macros * mac ; const char * worker_socket = NULL ; int i ; # ifdef HAVE_SIGACTION struct sigaction sig_action ; # endif # ifdef HAVE_GETOPT_H int option_index = 0 ; static struct option long_options [ ] = { { "help", no_argument, 0, 'h' }, { "version", no_argument, 0, 'V' }, { "license", no_argument, 0, 'V' }, { "verify-config", no_argument, 0, 'v' }, { "daemon", no_argument, 0, 'd' }, { "test-scheduling", no_argument, 0,'s' }, { "precache-objects", no_argument, 0, 'p' }, { "use-precached-objects", no_argument, 0, 'u' }, { "enable-timing-point", no_argument, 0, 'T' }, { "worker", required_argument, 0, 'W' }, { 0, 0, 0, 0 } } ; # define getopt ( argc, argv, o ) getopt_long ( argc, argv, o, long_options, & option_index ) # endif memset ( & loadctl, 0, sizeof ( loadctl ) ) ; mac = get_global_macros ( ) ; if ( argc < 2 ) error = TRUE ; while ( 1 ) { c = getopt ( argc, argv, "+hVvdspuxTW" ) ; if ( c == - 1 || c == EOF ) break ; switch ( c ) { case '?' : case 'h' : display_help = TRUE ; break ; case 'V' : display_license = TRUE ; break ; case 'v' : verify_config ++ ; break ; case's' : test_scheduling = TRUE ; break ; case 'd' : daemon_mode = TRUE ; break ; case 'p' : pre

Fix:
<S2SV_ModStart> ; if ( daemon_mode == TRUE && sigrestart == FALSE ) { result = daemon_init ( ) ; if ( result == ERROR ) { logit ( NSLOG_PROCESS_INFO | NSLOG_RUNTIME_ERROR, TRUE, "Bailing <S2SV_blank> out <S2SV_blank> due <S2SV_blank> to <S2SV_blank> failure <S2SV_blank> to <S2SV_blank> daemonize. <S2SV_blank> (PID=%d)", ( int ) getpid ( ) ) ; cleanup ( ) ; exit ( EXIT_FAILURE ) ; } nagios_pid = ( int ) getpid ( ) ; } if ( <S2SV_ModStart> exit ( EXIT_FAILURE <S2SV_ModEnd> ) ; }
Buggy code:
 static gboolean cosine_seek_read ( wtap * wth, gint64 seek_off, struct wtap_pkthdr * phdr, Buffer * buf, int * err, gchar * * err_info ) { <START_BUG> int pkt_len ; <END_BUG> char line [ COSINE_LINE_LENGTH ] ; if ( file_seek ( wth -> random_fh, seek_off, SEEK_SET, err ) == - 1 ) return FALSE ; if ( file_gets ( line, COSINE_LINE_LENGTH, wth -> random_fh ) == NULL ) { * err = file_error ( wth -> random_fh, err_info ) ; if ( * err == 0 ) { * err = WTAP_ERR_SHORT_READ ; } return FALSE ; }  pkt_len = parse_cosine_rec_hdr ( phdr, line, err, err_info ) ; <START_BUG> if ( pkt_len == - 1 ) return FALSE ; <END_BUG> return parse_cosine_hex_dump ( wth -> random_fh, phdr, pkt_len, buf, err,  err_info ) ; }

Fix:
<S2SV_ModStart> err_info ) { <S2SV_ModEnd> char line [ <S2SV_ModStart> FALSE ; } return parse_cosine_packet <S2SV_ModEnd> ( wth -> <S2SV_ModStart>, phdr, buf, line <S2SV_ModEnd>, err,
Buggy code:
 static void nfs4_open_prepare ( struct rpc_task * task, void * calldata ) { struct nfs4_opendata * data = calldata ; struct nfs4_state_owner * sp = data -> owner ; if ( nfs_wait_on_sequence ( data -> o_arg. seqid, task )!= 0 ) return ; if ( data -> state!= NULL ) { struct nfs_delegation * delegation ; <START_BUG> if ( can_open_cached ( data -> state, data -> o_arg. open_flags & ( FMODE_READ | FMODE_WRITE | O_EXCL ) ) ) <END_BUG> goto out_no_action ; rcu_read_lock ( ) ; delegation = rcu_dereference ( NFS_I ( data -> state -> inode ) -> delegation ) ; if ( delegation!= NULL && test_bit ( NFS_DELEGATION_NEED_RECLAIM, & delegation -> flags ) == 0 ) { rcu_read_unlock ( ) ; goto out_no_action ; } rcu_read_unlock ( ) ; } data -> o_arg. id = sp -> so_owner_id. id ; data -> o_arg. clientid = sp -> so_client -> cl_clientid ; if ( data -> o_arg. claim == NFS4_OPEN_CLAIM_PREVIOUS ) { task -> tk_msg. rpc_proc = & nfs4_procedures [ NFSPROC4_CLNT_OPEN_NOATTR ] ; nfs_copy_fh ( & data -> o_res. fh, data -> o_arg. fh ) ; } data -> timestamp = jiffies ; rpc_call_start ( task ) ; return ; out_no_action : task -> tk_action = NULL ; }

Fix:
<S2SV_ModStart> -> o_arg. fmode, data -> o_arg. open_flags <S2SV_ModEnd> ) ) goto
Buggy code:
 static int mp_capable_print ( netdissect_options * ndo, const u_char * opt, u_int opt_len, u_char flags ) { const struct mp_capable * mpc = ( const struct mp_capable * ) opt ; <START_BUG> if (! ( opt_len == 12 && flags & TH_SYN ) && <END_BUG>! ( opt_len == 20 && ( flags & ( TH_SYN | TH_ACK ) ) == TH_ACK ) ) return 0 ; if ( MP_CAPABLE_OPT_VERSION ( mpc -> sub_ver )!= 0 ) { ND_PRINT ( ( ndo, "   Unknown   Version   (%d)", MP_CAPABLE_OPT_VERSION ( mpc -> sub_ver ) ) ) ; return 1 ; } if ( mpc -> flags & MP_CAPABLE_C ) ND_PRINT ( ( ndo, "   csum" ) ) ; ND_PRINT ( ( ndo, "   {0x%" PRIx64, EXTRACT_64BITS ( mpc -> sender_key ) ) ) ; if ( opt_len == 20 ) ND_PRINT ( ( ndo, ",0x%" PRIx64, EXTRACT_64BITS ( mpc -> receiver_key ) ) ) ; ND_PRINT ( ( ndo, "}" ) ) ; return 1 ; }

Fix:
<S2SV_ModStart> == 12 && ( <S2SV_ModStart> flags & TH_SYN )
Buggy code:
 <START_BUG> int xml_init ( modsec_rec * msr, char * * error_msg ) { <END_BUG> if ( error_msg == NULL ) return - 1 ; * error_msg = NULL ; msr -> xml = apr_pcalloc ( msr -> mp, sizeof ( xml_data ) ) ; if ( msr -> xml == NULL ) return - 1 ;  return 1 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> error_msg ) { xmlParserInputBufferCreateFilenameFunc entity ; <S2SV_ModStart> - 1 ; if ( msr -> txcfg -> xml_external_entity == 0 ) { entity = xmlParserInputBufferCreateFilenameDefault ( xml_unload_external_entity ) ; }
Buggy code:
 size_t OpenMP4SourceUDTA ( char * filename ) { mp4object * mp4 = ( mp4object * ) malloc ( sizeof ( mp4object ) ) ; if ( mp4 == NULL ) return 0 ; memset ( mp4, 0, sizeof ( mp4object ) ) ; # ifdef _WINDOWS fopen_s ( & mp4 -> mediafp, filename, "rb" ) ; # else mp4 -> mediafp = fopen ( filename, "rb" ) ; # endif if ( mp4 -> mediafp ) { <START_BUG> uint32_t qttag, qtsize32, len ; <END_BUG> int32_t nest = 0 ; uint64_t nestsize [ MAX_NEST_LEVEL ] = { 0 } ; uint64_t lastsize = 0, qtsize ; do { len = fread ( & qtsize32, 1, 4, mp4 -> mediafp ) ; len += fread ( & qttag, 1, 4, mp4 -> mediafp ) ; if ( len == 8 ) { if (! GPMF_VALID_FOURCC ( qttag ) ) {  LONGSEEK ( mp4 -> mediafp, lastsize - 8 - 8, SEEK_CUR ) ; <START_BUG> NESTSIZE ( lastsize - 8 ) ; continue ; } qtsize32 = BYTESWAP32 ( qtsize32 ) ; if ( qtsize32 == 1 ) { fread ( & qtsize, 1, 8, mp4 -> mediafp ) ; qtsize = BYTESWAP64 ( qtsize ) - 8 ; } else qtsize = qtsize32 ; nest ++ ; if ( qtsize < 8 ) break ; if ( nest >= MAX_NEST_LEVEL ) break ; nestsize [ nest ] = qtsize ; lastsize = qtsize ; if ( qttag == MAKEID ('m', 'd', 'a', 't' ) || qttag == MAKEID ( 'f', 't', 'y', 'p' ) ) { <END_BUG> LONGSEEK ( mp4 -> mediafp, qtsize - 8, SEEK_CUR ) ;  NESTSIZE ( qtsize ) ; continue ; } if ( qttag == MAKEID ( 'G', 'P', 'M', 'F' ) ) { mp4 -> videolength += 1.0 ;

Fix:
<S2SV_ModStart> qttag, qtsize32 ; size_t <S2SV_ModEnd> len ; int32_t <S2SV_ModStart> ) ) { LongSeek ( mp4 <S2SV_ModEnd>, lastsize - <S2SV_ModStart> 8 - 8 <S2SV_ModEnd> ) ; NESTSIZE <S2SV_ModStart> ) ) { LongSeek ( mp4 <S2SV_ModEnd>, qtsize - <S2SV_ModStart> qtsize - 8 <S2SV_ModEnd> ) ; NESTSIZE <S2SV_ModStart> ) ) { LongSeek ( mp4 <S2SV_ModEnd>, qtsize - <S2SV_ModStart> qtsize - 8 <S2SV_ModEnd> ) ; NESTSIZE
Buggy code:
 void send_ldap_result_ext ( Slapi_PBlock * pb, int err, char * matched, char * text, int nentries, struct berval * * urls, BerElement * ber ) { Slapi_Operation * operation ; passwdPolicy * pwpolicy = NULL ; Connection * conn = NULL ; Slapi_DN * sdn = NULL ; const char * dn = NULL ; ber_tag_t tag ; int flush_ber_element = 1 ; ber_tag_t bind_method = 0 ; int internal_op ; int i, rc, logit = 0 ; char * pbtext ; slapi_pblock_get ( pb, SLAPI_BIND_METHOD, & bind_method ) ; slapi_pblock_get ( pb, SLAPI_OPERATION, & operation ) ; slapi_pblock_get ( pb, SLAPI_CONNECTION, & conn ) ; if ( text ) { pbtext = text ; } else { <START_BUG> slapi_pblock_get ( pb, SLAPI_PB_RESULT_TEXT, & pbtext ) ; <END_BUG> } if ( operation == NULL ) { slapi_log_err ( SLAPI_LOG_ERR, "send_ldap_result_ext", "No   operation   found:   slapi_search_internal_set_pb   was   incomplete   (invalid   \'base\'  ?)\\n" ) ; return ; } if ( operation -> o_status == SLAPI_OP_STATUS_RESULT_SENT ) { return ; } if ( ber!= NULL ) { flush_ber_element = 0 ; } if ( err!= LDAP_SUCCESS ) { if ( err == LDAP_INVALID_CREDENTIALS || err == LDAP_INAPPROPRIATE_AUTH || err == LDAP_AUTH_METHOD_NOT_SUPPORTED || err == LDAP_STRONG_AUTH_NOT_SUPPORTED || err == LDAP_STRONG_AUTH_REQUIRED || err == LDAP_CONFIDENTIALITY_REQUIRED || err == LDAP_INSUFFICIENT_ACCESS || err == LDAP_AUTH_UNKNOWN ) { slapi_counter_increment ( g_get_global_snmp_vars ( ) -> ops_tbl. dsSecurityErrors ) ; } else if ( err!= LDAP_REFERRAL && err!= LDAP_OPT_REFERRALS && err!= LDAP_PARTIAL_

Fix:
<S2SV_ModStart> ( pb, SLAPI_RESULT_TEXT <S2SV_ModEnd>, & pbtext
Buggy code:
 static void print_attr_string ( netdissect_options * ndo, register const u_char * data, u_int length, u_short attr_code ) { register u_int i ; ND_TCHECK2 ( data [ 0 ], length ) ; switch ( attr_code ) { case TUNNEL_PASS : if ( length < 3 ) <START_BUG> { <END_BUG> ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } if ( * data && ( * data <= 0x1F ) ) ND_PRINT ( ( ndo, "Tag[%u]   ", * data ) ) ; else ND_PRINT ( ( ndo, "Tag[Unused]   " ) ) ; data ++ ; length -- ; ND_PRINT ( ( ndo, "Salt   %u   ", EXTRACT_16BITS ( data ) ) ) ; data += 2 ; length -= 2 ; break ; case TUNNEL_CLIENT_END : case TUNNEL_SERVER_END : case TUNNEL_PRIV_GROUP : case TUNNEL_ASSIGN_ID : case TUNNEL_CLIENT_AUTH : case TUNNEL_SERVER_AUTH : if ( * data <= 0x1F ) { if ( length < 1 )  { <START_BUG> ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } if ( * data ) ND_PRINT ( ( ndo, "Tag[%u]   ", * data ) ) ; else ND_PRINT ( ( ndo, "Tag[Unused]   " ) ) ; data ++ ; length -- ; } break ; <END_BUG> case EGRESS_VLAN_NAME :  ND_PRINT ( ( ndo, "%s   (0x%02x)   ", tok2str ( rfc4675_tagged, "Unknown   tag", * data ), * data ) ) ; data ++ ; length -- ; break ; } <START_BUG> for ( i = 0 ; * data && i < length ; i ++, data ++ ) <END_BUG> ND_PRINT ( ( ndo, "%c", ( * data < 32 || * data > 126 )? '.' : * data ) ) ; return ; trunc : ND_PRINT ( ( ndo, "%s", tstr ) ) ; }

Fix:
<S2SV_ModStart> < 3 ) goto trunc ; <S2SV_ModEnd> if ( * <S2SV_ModStart> < 1 ) goto trunc ; if ( * data ) ND_PRINT ( ( ndo, "Tag[%u] <S2SV_blank> ", * data ) ) ; else ND_PRINT ( ( ndo, "Tag[Unused] <S2SV_blank> " ) ) ; data ++ ; length -- ; } <S2SV_ModEnd> break ; case <S2SV_ModStart> case EGRESS_VLAN_NAME : if ( length < 1 ) goto trunc ; <S2SV_ModStart> = 0 ; i < length && * data <S2SV_ModEnd> ; i ++
Buggy code:
 static int ivr_read_header ( AVFormatContext * s ) { unsigned tag, type, len, tlen, value ; int i, j, n, count, nb_streams = 0, ret ; uint8_t key [ 256 ], val [ 256 ] ; AVIOContext * pb = s -> pb ; AVStream * st ; int64_t pos, offset, temp ; pos = avio_tell ( pb ) ; tag = avio_rl32 ( pb ) ; if ( tag == MKTAG ( '.', 'R', '1', 'M' ) ) { if ( avio_rb16 ( pb )!= 1 ) return AVERROR_INVALIDDATA ; if ( avio_r8 ( pb )!= 1 ) return AVERROR_INVALIDDATA ; len = avio_rb32 ( pb ) ; avio_skip ( pb, len ) ; avio_skip ( pb, 5 ) ; temp = avio_rb64 ( pb ) ; while (! avio_feof ( pb ) && temp ) { offset = temp ; temp = avio_rb64 ( pb ) ; } avio_skip ( pb, offset - avio_tell ( pb ) ) ; if ( avio_r8 ( pb )!= 1 ) return AVERROR_INVALIDDATA ; len = avio_rb32 ( pb ) ; avio_skip ( pb, len ) ; if ( avio_r8 ( pb )!= 2 ) return AVERROR_INVALIDDATA ; avio_skip ( pb, 16 ) ; pos = avio_tell ( pb ) ; tag = avio_rl32 ( pb ) ; } if ( tag!= MKTAG ( '.', 'R', 'E', 'C' ) ) return AVERROR_INVALIDDATA ; if ( avio_r8 ( pb )!= 0 ) return AVERROR_INVALIDDATA ; count = avio_rb32 ( pb ) ; for ( i = 0 ; i < count ; i ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; type = avio_r8 ( pb ) ; tlen = avio_rb32 ( pb ) ; a

Fix:
<S2SV_ModStart> j ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> ) ) ; }
Buggy code:
 static int vc4_get_bcl ( struct drm_device * dev, struct vc4_exec_info * exec ) { struct drm_vc4_submit_cl * args = exec -> args ; void * temp = NULL ; void * bin ; int ret = 0 ; uint32_t bin_offset = 0 ; uint32_t shader_rec_offset = roundup ( bin_offset + args -> bin_cl_size, 16 ) ; uint32_t uniforms_offset = shader_rec_offset + args -> shader_rec_size ; uint32_t exec_size = uniforms_offset + args -> uniforms_size ; uint32_t temp_size = exec_size + ( sizeof ( struct vc4_shader_state ) * args -> shader_rec_count ) ; struct vc4_bo * bo ; if ( shader_rec_offset < args -> bin_cl_size || uniforms_offset < shader_rec_offset || exec_size < uniforms_offset || args -> shader_rec_count >= ( UINT_MAX // sizeof ( struct vc4_shader_state ) ) || temp_size < exec_size ) { DRM_ERROR ( "overflow   in   exec   arguments\\n" ) ; <START_BUG> goto fail ; <END_BUG> } temp = drm_malloc_ab ( temp_size, 1 ) ; if (! temp ) { DRM_ERROR ( "Failed   to   allocate   storage   for   copying   " "in   bin//render   CLs.\\n" ) ; ret = - ENOMEM ; goto fail ; } bin = temp + bin_offset ; exec -> shader_rec_u = temp + shader_rec_offset ; exec -> uniforms_u = temp + uniforms_offset ; exec -> shader_state = temp + exec_size ; exec -> shader_state_size = args -> shader_rec_count ; if ( copy_from_user ( bin, ( void __user * ) ( uintptr_t ) args -> bin_cl, args -> bin_cl_size ) ) { ret = - EFAULT ; goto fail ; } if ( copy_from_user ( exec -> shader_rec_u, ( void __user * ) ( uintptr_t ) args -> shader_rec, args -> shader_rec_size ) ) { ret = - EFAULT ; goto fail

Fix:
<S2SV_ModStart> "overflow <S2SV_blank> in <S2SV_blank> exec <S2SV_blank> arguments\\n" ) ; ret = - EINVAL ;
Buggy code:
 static int __ext4_set_acl ( handle_t * handle, struct inode * inode, int type, struct posix_acl * acl ) { int name_index ; void * value = NULL ; size_t size = 0 ; int error ; switch ( type ) { case ACL_TYPE_ACCESS : name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> error = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( error < 0 ) return error ; else { inode -> i_ctime = ext4_current_time ( inode ) ; ext4_mark_inode_dirty ( handle, inode ) ;  if ( error == 0 ) <START_BUG> acl = NULL ; } } break ; case ACL_TYPE_DEFAULT : name_index = EXT4_XATTR_INDEX_POSIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } if ( acl ) { value = ext4_acl_to_disk ( acl, & size ) ; if ( IS_ERR ( value ) ) return ( int ) PTR_ERR ( value ) ; } error = ext4_xattr_set_handle ( handle, inode, name_index, "", value, size, 0 ) ; kfree ( value ) ; if (! error ) set_cached_acl ( inode, type, acl ) ; return error ; }<END_BUG>

Fix:
<S2SV_ModStart> { error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( error ) return error ; <S2SV_ModEnd> inode -> i_ctime <S2SV_ModStart> inode ) ; <S2SV_ModEnd> } break ;
Buggy code:
 void * vpx_realloc ( void * memblk, size_t size ) { void * addr, * new_addr = NULL ; int align = DEFAULT_ALIGNMENT ; if (! memblk ) new_addr = vpx_malloc ( size ) ; else if (! size ) vpx_free ( memblk ) ; else { addr = ( void * ) ( ( ( size_t * ) memblk ) [ - 1 ] ) ; memblk = NULL ; <START_BUG> # if CONFIG_MEM_MANAGER <END_BUG> new_addr = vpx_mm_realloc ( addr, size + align + ADDRESS_STORAGE_SIZE ) ;  # else <START_BUG> new_addr = VPX_REALLOC_L ( addr, size + align + ADDRESS_STORAGE_SIZE ) ; # endif if ( new_addr ) { addr = new_addr ; new_addr = ( void * ) ( ( ( size_t ) ( ( unsigned char * ) new_addr + ADDRESS_STORAGE_SIZE ) + ( align - 1 ) ) & ( size_t ) - align ) ; ( ( size_t * ) new_addr ) [ - 1 ] = ( size_t ) addr ; } } return new_addr ; }<END_BUG>

Fix:
<S2SV_ModStart> = NULL ; new_addr = realloc <S2SV_ModEnd> ( addr, <S2SV_ModStart> ADDRESS_STORAGE_SIZE ) ; <S2SV_ModEnd> if ( new_addr
Buggy code:
 static int fb_mmap ( struct file * file, struct vm_area_struct * vma ) { struct fb_info * info = file_fb_info ( file ) ; struct fb_ops * fb ; <START_BUG> unsigned long off ; <END_BUG> unsigned long start ; u32 len ; if (! info ) return - ENODEV ;  if ( vma -> vm_pgoff > ( ~ 0UL >> PAGE_SHIFT ) ) <START_BUG> return - EINVAL ; <END_BUG> off = vma -> vm_pgoff << PAGE_SHIFT ;  fb = info -> fbops ; if (! fb ) return - ENODEV ; mutex_lock ( & info -> mm_lock ) ; <START_BUG> if ( fb -> fb_mmap ) { <END_BUG> int res ; res = fb -> fb_mmap ( info, vma ) ; mutex_unlock ( & info -> mm_lock ) ; return res ; } start = info -> fix. smem_start ; len = PAGE_ALIGN ( ( start & ~ PAGE_MASK ) + info -> fix. smem_len ) ; if ( off >= len ) { off -= len ; if ( info -> var. accel_flags ) { mutex_unlock ( & info -> mm_lock ) ; return - EINVAL ; } start = info -> fix. mmio_start ; len = PAGE_ALIGN ( ( start & ~ PAGE_MASK ) + info -> fix. mmio_len ) ; } mutex_unlock ( & info -> mm_lock ) ; start &= PAGE_MASK ; if ( ( vma -> vm_end - vma -> vm_start + off ) > len ) return - EINVAL ; off += start ; vma -> vm_pgoff = off >> PAGE_SHIFT ; vma -> vm_page_prot = vm_get_page_prot ( vma -> vm_flags ) ;  fb_pgprotect ( file, vma, off ) ; <START_BUG> if ( io_remap_pfn_range ( vma, vma -> vm_start, off >> PAGE_SHIFT, vma -> vm_end - vma -> vm_start, vma -> vm_page_prot ) ) return - EAGAIN ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; unsigned long mmio_pgoff <S2SV_ModEnd> ; unsigned long <S2SV_ModStart> - ENODEV ; fb = info -> fbops ; if (! fb ) return - ENODEV ; mutex_lock ( & info -> mm_lock ) ; if ( fb -> fb_mmap ) { int res ; res = fb -> fb_mmap ( info, vma ) ; mutex_unlock ( & info -> mm_lock ) ; return res ; } start = info -> fix. smem_start ; len = info -> fix. smem_len ; mmio_pgoff = PAGE_ALIGN ( ( start & ~ PAGE_MASK ) + len ) >> PAGE_SHIFT ; if ( <S2SV_ModEnd> vma -> vm_pgoff <S2SV_ModStart> vma -> vm_pgoff >= mmio_pgoff ) { vma -> vm_pgoff -= mmio_pgoff ; start = info -> fix. mmio_start ; len = info -> fix. mmio_len ; } mutex_unlock <S2SV_ModEnd> ( & info <S2SV_ModStart> mm_lock ) ; <S2SV_ModEnd> vma -> vm_page_prot <S2SV_ModStart>, vma, start ) ; return vm_iomap_memory ( vma, start, len ) <S2SV_ModEnd> ; } <S
Buggy code:
 static size_t optsize ( lua_State * L, char opt, const char * * fmt ) { switch ( opt ) { case 'B' : case 'b' : return sizeof ( char ) ; case 'H' : case 'h' : return sizeof ( short ) ; case 'L' : case 'l' : return sizeof ( long ) ; case 'T' : return sizeof ( size_t ) ; case 'f' : return sizeof ( float ) ; case 'd' : return sizeof ( double ) ; case 'x' : return 1 ; <START_BUG> case 'c' : return getnum ( L, fmt, 1 ) ; <END_BUG> case 'i' : case 'I' : {  int sz = getnum ( L, fmt, sizeof ( int ) ) ; <START_BUG> if ( sz > MAXINTSIZE ) luaL_error ( L, "integral   size   %d   is   larger   than   limit   of   %d", sz, MAXINTSIZE ) ; return sz ; } default : return 0 ; } }<END_BUG>

Fix:
<S2SV_ModStart> return getnum ( <S2SV_ModEnd> fmt, 1 <S2SV_ModStart> = getnum ( <S2SV_ModEnd> fmt, sizeof
Buggy code:
 jp2_box_t * jp2_box_get ( jas_stream_t * in ) { jp2_box_t * box ; jp2_boxinfo_t * boxinfo ; jas_stream_t * tmpstream ; uint_fast32_t len ; uint_fast64_t extlen ; bool dataflag ; box = 0 ; tmpstream = 0 ; <START_BUG> if (! ( box = jas_malloc ( sizeof ( jp2_box_t ) ) ) ) { <END_BUG> goto error ; } box -> ops = & jp2_boxinfo_unk. ops ; if ( jp2_getuint32 ( in, & len ) || jp2_getuint32 ( in, & box -> type ) ) { goto error ; } boxinfo = jp2_boxinfolookup ( box -> type ) ; box -> info = boxinfo ; box -> len = len ; JAS_DBGLOG ( 10, (  "preliminary   processing   of   JP2   box:   type=%c%s%c   (0x%08x);   length=%d\\n", <START_BUG> \'"\', boxinfo -> name, \'"\', box -> type, box -> len ) ) ; <END_BUG> if ( box -> len == 1 ) {  if ( jp2_getuint64 ( in, & extlen ) ) { goto error ; } if ( extlen > 0xffffffffUL ) { jas_eprintf ( "warning:   cannot   handle   large   64-bit   box   length\\n" ) ; extlen = 0xffffffffUL ; } box -> len = extlen ; box -> datalen = extlen - JP2_BOX_HDRLEN ( true ) ; } else { box -> datalen = box -> len - JP2_BOX_HDRLEN ( false ) ; } if ( box -> len!= 0 && box -> len < 8 ) { goto error ; } dataflag =! ( box -> info -> flags & ( JP2_BOX_SUPER | JP2_BOX_NODATA ) ) ; if ( dataflag ) { if (! ( tmpstream = jas_stream_memopen ( 0, 0 ) ) ) { goto error ; } if ( jas_stream_copy ( tmpstream, in, box -> datalen ) ) {

Fix:
<S2SV_ModStart> ( box = jp2_box_create0 ( ) ) ) { goto error ; } <S2SV_ModEnd> if ( jp2_getuint32 <S2SV_ModStart> 10, ( "preliminary <S2SV_blank> processing <S2SV_blank> of <S2SV_blank> JP2 <S2SV_blank> box: <S2SV_blank> " "type=%c%s%c <S2SV_blank> (0x%08x); <S2SV_blank> length=%" PRIuFAST32 "\\n" <S2SV_ModEnd>, \'"\', <S2SV_ModStart> 1 ) { JAS_DBGLOG ( 10, ( "big <S2SV_blank> length\\n" ) ) ;
Buggy code:
 int udp_recvmsg ( struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; DECLARE_SOCKADDR ( struct sockaddr_in *, sin, msg -> msg_name ) ; struct sk_buff * skb ; unsigned int ulen, copied ; int peeked, off = 0 ; int err ; int is_udplite = IS_UDPLITE ( sk ) ; bool slow ; if ( flags & MSG_ERRQUEUE ) return ip_recv_error ( sk, msg, len, addr_len ) ; try_again : skb = __skb_recv_datagram ( sk, flags | ( noblock? MSG_DONTWAIT : 0 ), & peeked, & off, & err ) ; if (! skb ) goto out ; ulen = skb -> len - sizeof ( struct udphdr ) ; copied = len ; if ( copied > ulen ) copied = ulen ; else if ( copied < ulen ) msg -> msg_flags |= MSG_TRUNC ; if ( copied < ulen || UDP_SKB_CB ( skb ) -> partial_cov ) { if ( udp_lib_checksum_complete ( skb ) ) goto csum_copy_err ; } if ( skb_csum_unnecessary ( skb ) ) err = skb_copy_datagram_msg ( skb, sizeof ( struct udphdr ), msg, copied ) ; else { err = skb_copy_and_csum_datagram_msg ( skb, sizeof ( struct udphdr ), msg ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( unlikely ( err ) ) { trace_kfree_skb ( skb, udp_recvmsg ) ; if (! peeked ) { atomic_inc ( & sk -> sk_drops ) ; UDP_INC_STATS_USER ( sock_net ( sk ), UDP_MIB_INERRORS, is_udplite ) ; } goto out_free ; } if (! peeked ) UDP_INC_STATS_USER ( sock_net ( sk ), UDP_MIB_INDATAGR

Fix:
<S2SV_ModStart> slow ) ; cond_resched ( ) <S2SV_ModEnd> ; msg ->
Buggy code:
 void lxc_execute_bind_init ( struct lxc_conf * conf ) { int ret ; char path [ PATH_MAX ], destpath [ PATH_MAX ], * p ; p = choose_init ( conf -> rootfs. mount ) ; if ( p ) { free ( p ) ; return ; } ret = snprintf ( path, PATH_MAX, SBINDIR "//init.lxc.static" ) ; if ( ret < 0 || ret >= PATH_MAX ) { WARN ( "Path   name   too   long   searching   for   lxc.init.static" ) ; return ; } if (! file_exists ( path ) ) { INFO ( "%s   does   not   exist   on   host", path ) ; return ; } ret = snprintf ( destpath, PATH_MAX, "%s%s", conf -> rootfs. mount, "//init.lxc.static" ) ; if ( ret < 0 || ret >= PATH_MAX ) { WARN ( "Path   name   too   long   for   container\'s   lxc.init.static" ) ; return ; } if (! file_exists ( destpath ) ) { FILE * pathfile = fopen ( destpath, "wb" ) ; if (! pathfile ) { SYSERROR ( "Failed   to   create   mount   target   \'%s\'", destpath ) ; return ; } fclose ( pathfile ) ; } <START_BUG> ret = mount ( path, destpath, "none", MS_BIND, NULL ) ; <END_BUG> if ( ret < 0 ) SYSERROR ( "Failed   to   bind   lxc.init.static   into   container" ) ; INFO ( "lxc.init.static   bound   into   container   at   %s", path ) ; }

Fix:
<S2SV_ModStart> } ret = safe_mount ( path, destpath, "none", MS_BIND, NULL, conf -> rootfs. mount <S2SV_ModEnd> ) ; if