nus-yam/ex-repair huggingface dataset:
Buggy code:
 static long ext4_zero_range ( struct file * file, loff_t offset, loff_t len, int mode ) { struct inode * inode = file_inode ( file ) ; handle_t * handle = NULL ; unsigned int max_blocks ; loff_t new_size = 0 ; int ret = 0 ; int flags ; int credits ; int partial_begin, partial_end ; loff_t start, end ; ext4_lblk_t lblk ; struct address_space * mapping = inode -> i_mapping ; unsigned int blkbits = inode -> i_blkbits ; trace_ext4_zero_range ( inode, offset, len, mode ) ; if (! S_ISREG ( inode -> i_mode ) ) return - EINVAL ; if ( ext4_should_journal_data ( inode ) ) { ret = ext4_force_commit ( inode -> i_sb ) ; if ( ret ) return ret ; } if ( mapping -> nrpages && mapping_tagged ( mapping, PAGECACHE_TAG_DIRTY ) ) { ret = filemap_write_and_wait_range ( mapping, offset, offset + len - 1 ) ; if ( ret ) return ret ; } start = round_up ( offset, 1 << blkbits ) ; end = round_down ( ( offset + len ), 1 << blkbits ) ; if ( start < offset || end > offset + len ) return - EINVAL ; partial_begin = offset & ( ( 1 << blkbits ) - 1 ) ; partial_end = ( offset + len ) & ( ( 1 << blkbits ) - 1 ) ; lblk = start >> blkbits ; max_blocks = ( end >> blkbits ) ; if ( max_blocks < lblk ) max_blocks = 0 ; else max_blocks -= lblk ; <START_BUG> flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT | <END_BUG> EXT4_GET_BLOCKS_CONVERT_UNWRITTEN | EXT4_EX_NOCACHE ;  if ( mode & FALLOC_FL_KEEP_SIZE ) <START_BUG> flags |= EXT4_GET_BLOCKS_KEEP_SIZE ; <END_BUG> mutex_lock ( & inode -> i_mutex ) ;  if (! ( ext4_test_inode_flag ( inode, EXT4_INODE

Fix:
<S2SV_ModStart> -= lblk ; mutex_lock ( & inode -> i_mutex ) ; if (! ( ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) ) { ret = - EOPNOTSUPP ; goto out_mutex ; } if (! <S2SV_ModEnd> ( mode & <S2SV_ModStart> & FALLOC_FL_KEEP_SIZE ) && offset + len > i_size_read ( inode ) ) { new_size = offset + len ; ret = inode_newsize_ok ( inode, new_size ) ; if ( ret ) goto out_mutex ; } flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT ; if ( mode & FALLOC_FL_KEEP_SIZE ) <S2SV_ModStart> |= EXT4_GET_BLOCKS_KEEP_SIZE ; if ( partial_begin || partial_end ) { ret = ext4_alloc_file_blocks ( file, round_down ( offset, 1 << blkbits ) >> blkbits, ( round_up ( ( offset + len ), 1 << blkbits ) - round_down ( offset, 1 << blkbits ) ) >> blkbits, new_
Buggy code:
 static void block_rd_txfm ( int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * arg ) { struct rdcost_block_args * args = arg ; MACROBLOCK * const x = args -> x ; MACROBLOCKD * const xd = & x -> e_mbd ; MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ; int64_t rd1, rd2, rd ; <START_BUG> if ( args -> skip ) <END_BUG> return ;  if (! is_inter_block ( mbmi ) ) <START_BUG> <END_BUG> vp9_encode_block_intra ( x, plane, block, plane_bsize, tx_size, & mbmi -> skip ) ;  else vp9_xform_quant ( x, plane, block, plane_bsize, tx_size ) ; <START_BUG> dist_block ( plane, block, tx_size, args ) ; <END_BUG> rate_block ( plane, block, plane_bsize, tx_size, args ) ;  rd1 = RDCOST ( x -> rdmult, x -> rddiv, args -> rate, args -> dist ) ; <START_BUG> <END_BUG> rd2 = RDCOST ( x -> rdmult, x -> rddiv, 0, args -> sse ) ;  rd = MIN ( rd1, rd2 ) ; if ( plane == 0 ) x -> zcoeff_blk [ tx_size ] [ block ] =! x -> plane [ plane ]. eobs [ block ] || ( rd1 > rd2 &&! xd -> lossless ) ; <START_BUG> args -> this_rate += args -> rate ; <END_BUG>  args -> this_dist += args -> dist ; <START_BUG> <END_BUG> args -> this_sse += args -> sse ;  args -> this_rd += rd ; if ( args -> this_rd > args -> best_rd ) { <START_BUG> args -> skip = 1 ; <END_BUG> return ; }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, rd ; int rate ; int64_t dist ; int64_t sse ; if ( args -> exit_early <S2SV_ModEnd> ) return ; <S2SV_ModStart> mbmi ) ) { struct encode_b_args arg = { x, NULL, & mbmi -> skip } ; vp9_encode_block_intra ( <S2SV_ModEnd> plane, block <S2SV_ModStart> tx_size, & arg ) ; dist_block ( x, plane, block, tx_size, & dist, & sse ) ; } else if ( max_txsize_lookup [ plane_bsize ] == tx_size ) { if ( x -> skip_txfm [ ( plane << 2 ) + ( block >> ( tx_size << 1 ) ) ] == SKIP_TXFM_NONE ) { <S2SV_ModEnd> vp9_xform_quant ( x <S2SV_ModStart> ; dist_block ( x, plane, block, tx_size, & dist, & sse ) ; } else if ( x -> skip_txfm [ ( plane << 2 ) + ( block >> ( tx_size << 1 ) ) ] == SKIP_TXFM_AC_ONLY ) { tran_low_t * const coeff = BLOCK_OFFSET ( x -> plane [ plane ].
Buggy code:
 static int rd_inter4x4_uv ( VP8_COMP * cpi, MACROBLOCK * x, int * rate, int * distortion, int fullpixel ) <START_BUG> { <END_BUG> vp8_build_inter4x4_predictors_mbuv ( & x -> e_mbd ) ; vp8_subtract_mbuv ( x -> src_diff, x -> src. u_buffer, x -> src. v_buffer, x -> src. uv_stride, & x -> e_mbd. predictor [ 256 ], & x -> e_mbd. predictor [ 320 ], 8 ) ; vp8_transform_mbuv ( x ) ; vp8_quantize_mbuv ( x ) ; * rate = rd_cost_mbuv ( x ) ; * distortion = vp8_mbuverror ( x ) // 4 ; return RDCOST ( x -> rdmult, x -> rddiv, * rate, * distortion ) ; }

Fix:
<S2SV_ModStart> fullpixel ) { ( void ) cpi ; ( void ) fullpixel ;
Buggy code:
 void dump_isom_sdp ( GF_ISOFile * file, char * inName, Bool is_final_name ) { const char * sdp ; u32 size, i ; FILE * dump ; if ( inName ) { char szBuf [ 1024 ] ; strcpy ( szBuf, inName ) ; if (! is_final_name ) { char * ext = strchr ( szBuf, '.' ) ; if ( ext ) ext [ 0 ] = 0 ; strcat ( szBuf, "_sdp.txt" ) ; } dump = gf_fopen ( szBuf, "wt" ) ; if (! dump ) { fprintf ( stderr, "Failed   to   open   %s   for   dumping\\n", szBuf ) ; return ; } } else { dump = stdout ; fprintf ( dump, "*   File   SDP   content   *\\n\\n" ) ; } gf_isom_sdp_get ( file, & sdp, & size ) ; <START_BUG> fprintf ( dump, "%s", sdp ) ; <END_BUG> fprintf ( dump, "\\r\\n" ) ; for ( i = 0 ; i < gf_isom_get_track_count ( file ) ; i ++ ) { if ( gf_isom_get_media_type ( file, i + 1 )!= GF_ISOM_MEDIA_HINT ) continue ; gf_isom_sdp_track_get ( file, i + 1, & sdp, & size ) ; fprintf ( dump, "%s", sdp ) ; } fprintf ( dump, "\\n\\n" ) ; if ( inName ) gf_fclose ( dump ) ; }

Fix:
<S2SV_ModStart> size ) ; if ( sdp && size )
Buggy code:
 static int ext4_ext_handle_uninitialized_extents ( handle_t * handle, struct inode * inode, struct ext4_map_blocks * map, struct ext4_ext_path * path, int flags, unsigned int allocated, ext4_fsblk_t newblock ) { int ret = 0 ; int err = 0 ; ext4_io_end_t * io = ext4_inode_aio ( inode ) ; ext_debug ( "ext4_ext_handle_uninitialized_extents:   inode   %lu,   logical   " "block   %llu,   max_blocks   %u,   flags   %x,   allocated   %u\\n", inode -> i_ino, ( unsigned long long ) map -> m_lblk, map -> m_len, flags, allocated ) ; ext4_ext_show_leaf ( inode, path ) ; trace_ext4_ext_handle_uninitialized_extents ( inode, map, allocated, newblock ) ; if ( ( flags & EXT4_GET_BLOCKS_PRE_IO ) ) { ret = ext4_split_unwritten_extents ( handle, inode, map, path, flags ) ; if ( ret <= 0 ) goto out ; if ( io ) ext4_set_io_unwritten_flag ( inode, io ) ; else ext4_set_inode_state ( inode, EXT4_STATE_DIO_UNWRITTEN ) ; if ( ext4_should_dioread_nolock ( inode ) ) map -> m_flags |= EXT4_MAP_UNINIT ; goto out ; } if ( ( flags & EXT4_GET_BLOCKS_CONVERT ) ) { <START_BUG> ret = ext4_convert_unwritten_extents_endio ( handle, inode, <END_BUG> path ) ; if ( ret >= 0 ) { ext4_update_inode_fsync_trans ( handle, inode, 1 ) ; err = check_eofblocks_fl ( handle, inode, map -> m_lblk, path, map -> m_len ) ; } else err = ret ; goto out2 ; } if ( flags & EXT4_GET_BLOCKS_UNINIT_EXT ) goto map_out ; if ( ( flags & EXT4_GET_BLOCKS

Fix:
<S2SV_ModStart>, inode, map,
Buggy code:
 gboolean flatpak_run_app ( FlatpakDecomposed * app_ref, FlatpakDeploy * app_deploy, FlatpakContext * extra_context, const char * custom_runtime, const char * custom_runtime_version, const char * custom_runtime_commit, int parent_pid, FlatpakRunFlags flags, const char * cwd, const char * custom_command, char * args [ ], int n_args, int instance_id_fd, char * * instance_dir_out, GCancellable * cancellable, GError * * error ) { g_autoptr ( FlatpakDeploy ) runtime_deploy = NULL ; g_autoptr ( GBytes ) runtime_deploy_data = NULL ; g_autoptr ( GBytes ) app_deploy_data = NULL ; g_autoptr ( GFile ) app_files = NULL ; g_autoptr ( GFile ) runtime_files = NULL ; g_autoptr ( GFile ) bin_ldconfig = NULL ; g_autoptr ( GFile ) app_id_dir = NULL ; g_autoptr ( GFile ) real_app_id_dir = NULL ; g_autofree char * default_runtime_pref = NULL ; g_autoptr ( FlatpakDecomposed ) default_runtime = NULL ; g_autofree char * default_command = NULL ; g_autoptr ( GKeyFile ) metakey = NULL ; g_autoptr ( GKeyFile ) runtime_metakey = NULL ; g_autoptr ( FlatpakBwrap ) bwrap = NULL ; const char * command = "//bin//sh" ; g_autoptr ( GError ) my_error = NULL ; g_autoptr ( FlatpakDecomposed ) runtime_ref = NULL ; int i ; g_autoptr ( GPtrArray ) previous_app_id_dirs = NULL ; g_autofree char * app_id = NULL ; g_autofree char * app_arch = NULL ; g_autofree char * app_info_path = NULL ; g_autofree char * instance_id_host_dir = NULL ; g_autoptr ( FlatpakContext ) app_context = NULL ; g_autoptr (

Fix:
<S2SV_ModStart> default_command ; } flatpak_bwrap_envp_to_args ( bwrap ) ; <S2SV_ModStart> |= G_SPAWN_LEAVE_DESCRIPTORS_OPEN ; g_assert ( bwrap -> envp!= NULL ) ; g_assert ( bwrap -> envp [ 0 ] == NULL ) ; <S2SV_ModStart> FALSE ) ; g_assert ( bwrap -> envp!= NULL ) ; g_assert ( bwrap -> envp [ 0 ] == NULL ) ;
Buggy code:
 static void sctp_sock_migrate ( struct sock * oldsk, struct sock * newsk, struct sctp_association * assoc, sctp_socket_type_t type ) { struct sctp_sock * oldsp = sctp_sk ( oldsk ) ; struct sctp_sock * newsp = sctp_sk ( newsk ) ; struct sctp_bind_bucket * pp ; struct sctp_endpoint * newep = newsp -> ep ; struct sk_buff * skb, * tmp ; struct sctp_ulpevent * event ; struct sctp_bind_hashbucket * head ; <START_BUG> struct list_head tmplist ; <END_BUG> newsk -> sk_sndbuf = oldsk -> sk_sndbuf ; newsk -> sk_rcvbuf = oldsk -> sk_rcvbuf ;  if ( oldsp -> do_auto_asconf ) { <START_BUG> memcpy ( & tmplist, & newsp -> auto_asconf_list, sizeof ( tmplist ) ) ; inet_sk_copy_descendant ( newsk, oldsk ) ; memcpy ( & newsp -> auto_asconf_list, & tmplist, sizeof ( tmplist ) ) ; } else inet_sk_copy_descendant ( newsk, oldsk ) ; newsp -> ep = newep ; newsp -> hmac = NULL ; head = & sctp_port_hashtable [ sctp_phashfn ( sock_net ( oldsk ), inet_sk ( oldsk ) -> inet_num ) ] ; local_bh_disable ( ) ; spin_lock ( & head -> lock ) ; pp = sctp_sk ( oldsk ) -> bind_hash ; sk_add_bind_node ( newsk, & pp -> owner ) ; sctp_sk ( newsk ) -> bind_hash = pp ; inet_sk ( newsk ) -> inet_num = inet_sk ( oldsk ) -> inet_num ; spin_unlock ( & head -> lock ) ; local_bh_enable ( ) ; sctp_bind_addr_dup ( & newsp -> ep -> base. bind_addr, & oldsp -> ep -> base. bind_addr, GFP_KERNEL ) ; sctp_skb_for_each ( skb, & oldsk -> sk_receive_queue<END_BUG>

Fix:
<S2SV_ModStart> * head ; <S2SV_ModEnd> newsk -> sk_sndbuf <S2SV_ModStart> -> sk_rcvbuf ; sctp_copy_descendant <S2SV_ModEnd> ( newsk,
Buggy code:
 void test_re ( ) { assert_true_rule ( "rule   test   {   strings:   $a   =   //ssi//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //ssi(s|p)//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //ssim*//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //ssa?//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //Miss//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //(M|N)iss//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //[M-N]iss//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //(Mi|ssi)ssippi//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmiss

Fix:
<S2SV_ModStart> " <S2SV_blank> <S2SV_blank> <S2SV_blank> xy <S2SV_blank> <S2SV_blank> <S2SV_blank> x" ) ; assert_regexp_syntax_error ( "\\\\x0" ) ; assert_regexp_syntax_error ( "\\\\x" ) ; assert_regexp_syntax_error ( "\\\\xxy" ) ;
Buggy code:
 PyObject * ast2obj_arguments ( void * _o ) { arguments_ty o = ( arguments_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } result = PyType_GenericNew ( arguments_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_list ( o -> args, ast2obj_arg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_args, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_arg ( o -> vararg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_vararg, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> kwonlyargs, ast2obj_arg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_kwonlyargs, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> kw_defaults, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_kw_defaults, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_arg ( o -> kwarg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_kwarg, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> defaults, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_defaults, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } result
Buggy code:
 static int _c2s_sx_sasl_callback ( int cb, void * arg, void * * res, sx_t s, void * cbarg ) { c2s_t c2s = ( c2s_t ) cbarg ; const char * my_realm, * mech ; sx_sasl_creds_t creds ; static char buf [ 3072 ] ; char mechbuf [ 256 ] ; struct jid_st jid ; jid_static_buf jid_buf ; int i, r ; sess_t sess ; char skey [ 44 ] ; host_t host ; jid_static ( & jid, & jid_buf ) ; assert ( s!= NULL ) ; sprintf ( skey, "%d", s -> tag ) ; sess = xhash_get ( c2s -> sessions, skey ) ; switch ( cb ) { case sx_sasl_cb_GET_REALM : if ( s -> req_to == NULL ) my_realm = "" ; else { host = xhash_get ( c2s -> hosts, s -> req_to ) ; if ( host == NULL ) { log_write ( c2s -> log, LOG_ERR, "SASL   callback   for   non-existing   host:   %s", s -> req_to ) ; * res = ( void * ) NULL ; return sx_sasl_ret_FAIL ; } my_realm = host -> realm ; if ( my_realm == NULL ) my_realm = s -> req_to ; } strncpy ( buf, my_realm, 256 ) ; * res = ( void * ) buf ; log_debug ( ZONE, "sx   sasl   callback:   get   realm:   realm   is   \'%s\'", buf ) ; return sx_sasl_ret_OK ; break ; case sx_sasl_cb_GET_PASS : assert ( sess!= NULL ) ; creds = ( sx_sasl_creds_t ) arg ; log_debug ( ZONE, "sx   sasl   callback:   get   pass   (authnid=%s,   realm=%s)", creds -> authnid, creds -> realm ) ; if ( sess -> host -> ar -> get_password && ( sess -> host -> ar -> get_password ) ( sess -> host -> ar,

Fix:
<S2SV_ModStart> [ i ] ) ; log_debug ( ZONE, "sx <S2SV_blank> sasl <S2SV_blank> callback: <S2SV_blank> check <S2SV_blank> mech <S2SV_blank> (mech=%s)", mechbuf
Buggy code:
 arg_ty <START_BUG> arg ( identifier arg, expr_ty annotation, int lineno, int col_offset, int <END_BUG> end_lineno, int end_col_offset, PyArena * arena ) { arg_ty p ; if (! arg ) { PyErr_SetString ( PyExc_ValueError, "field   arg   is   required   for   arg" ) ; return NULL ; } p = ( arg_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> arg = arg ; p -> annotation = annotation ;  p -> lineno = lineno ; <START_BUG> p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> expr_ty annotation, string type_comment, <S2SV_ModStart> ; p -> type_comment = type_comment ; p ->
Buggy code:
 BOOL transport_accept_nla ( rdpTransport * transport ) { freerdp * instance ; rdpSettings * settings ; if ( transport -> TlsIn == NULL ) transport -> TlsIn = tls_new ( transport -> settings ) ; if ( transport -> TlsOut == NULL ) transport -> TlsOut = transport -> TlsIn ; transport -> layer = TRANSPORT_LAYER_TLS ; transport -> TlsIn -> sockfd = transport -> TcpIn -> sockfd ; if ( tls_accept ( transport -> TlsIn, transport -> settings -> CertificateFile, transport -> settings -> PrivateKeyFile )!= TRUE ) return FALSE ; if ( transport -> settings -> Authentication!= TRUE ) return TRUE ; settings = transport -> settings ; instance = ( freerdp * ) settings -> instance ; if ( transport -> credssp == NULL ) transport -> credssp = credssp_new ( instance, transport, settings ) ; if ( credssp_authenticate ( transport -> credssp ) < 0 ) { fprintf ( stderr, "client   authentication   failure\\n" ) ; credssp_free ( transport -> credssp ) ; <START_BUG> return FALSE ; <END_BUG> } return TRUE ; }

Fix:
<S2SV_ModStart> credssp ) ; transport -> credssp = NULL ;
Buggy code:
 SQLITE_PRIVATE void * sqlite3ArrayAllocate ( sqlite3 * db, void * pArray, int szEntry, int * pnEntry, int * pIdx ) { char * z ; <START_BUG> int n = * pnEntry ; <END_BUG> if ( ( n & ( n - 1 ) ) == 0 ) {  int sz = ( n == 0 )? 1 : 2 * n ; <START_BUG> void * pNew = sqlite3DbRealloc ( db, pArray, sz * szEntry ) ; if ( pNew == 0 ) { * pIdx = - 1 ; return pArray ; } pArray = pNew ; } z = ( char * ) pArray ; memset ( & z [ n * szEntry ], 0, szEntry ) ; * pIdx = n ; ++ * pnEntry ; return pArray ; }<END_BUG>

Fix:
<S2SV_ModStart> * z ; sqlite3_int64 <S2SV_ModEnd> n = * <S2SV_ModStart> 0 ) { sqlite3_int64 <S2SV_ModEnd> sz = (
Buggy code:
 file_transfer_t * imcb_file_send_start ( struct im_connection * ic, char * handle, char * file_name, size_t file_size ) { bee_t * bee = ic -> bee ; bee_user_t * bu = bee_user_by_handle ( bee, ic, handle ) ; <START_BUG> if ( bee -> ui -> ft_in_start ) { <END_BUG> return bee -> ui -> ft_in_start ( bee, bu, file_name, file_size ) ; } else { return NULL ; } }

Fix:
<S2SV_ModStart> ui -> ft_in_start && bu
Buggy code:
 vpx_codec_err_t vpx_svc_encode ( SvcContext * svc_ctx, vpx_codec_ctx_t * codec_ctx, struct vpx_image * rawimg, vpx_codec_pts_t pts, int64_t duration, int deadline ) { vpx_codec_err_t res ; vpx_codec_iter_t iter ; const vpx_codec_cx_pkt_t * cx_pkt ; <START_BUG> struct LayerData * cx_layer_list = NULL ; <END_BUG> struct LayerData * layer_data ; struct Superframe superframe ; SvcInternal * const si = get_svc_internal ( svc_ctx ) ; if ( svc_ctx == NULL || codec_ctx == NULL || si == NULL ) { return VPX_CODEC_INVALID_PARAM ; }  memset ( & superframe, 0, sizeof ( superframe ) ) ; <START_BUG> svc_log_reset ( svc_ctx ) ; si -> rc_stats_buf_used = 0 ; si -> layers = svc_ctx -> spatial_layers ; if ( si -> frame_within_gop >= si -> kf_dist || si -> encode_frame_count == 0 ) { si -> frame_within_gop = 0 ; } si -> is_keyframe = ( si -> frame_within_gop == 0 ) ; si -> frame_size = 0 ; if ( rawimg!= NULL ) { svc_log ( svc_ctx, SVC_LOG_DEBUG, "vpx_svc_encode     layers:   %d,   frame_count:   %d,   " "frame_within_gop:   %d\\n", si -> layers, si -> encode_frame_count, si -> frame_within_gop ) ; } for ( si -> layer = 0 ; si -> layer < si -> layers ; ++ si -> layer ) { if ( svc_ctx -> encoding_mode == ALT_INTER_LAYER_PREDICTION_IP && si -> is_keyframe && ( si -> layer == 1 || si -> layer == 3 ) ) { svc_log ( svc_ctx, SVC_LOG_DEBUG, "Skip   encoding   layer   %d\\n", si -> layer ) ; continue ; } if ( rawimg!= NULL ) { calculate_enc_frame_<END_BUG>

Fix:
<S2SV_ModStart> * cx_pkt ; SvcInternal_t <S2SV_ModEnd> * const si <S2SV_ModStart> VPX_CODEC_INVALID_PARAM ; } svc_log_reset ( svc_ctx ) ; res = vpx_codec_encode ( codec_ctx, rawimg, pts, ( uint32_t ) duration <S2SV_ModEnd>, 0, <S2SV_ModStart>, 0, <S2SV_ModEnd> deadline ) ; <S2SV_ModStart> kind ) { # if VPX_ENCODER_ABI_VERSION > ( 5 + VPX_CODEC_ABI_VERSION ) # if CONFIG_SPATIAL_SVC case VPX_CODEC_SPATIAL_SVC_LAYER_PSNR : { int i ; for ( i = 0 ; i < svc_ctx -> spatial_layers ; ++ i ) { int j ; svc_log ( svc_ctx, SVC_LOG_DEBUG, "SVC <S2SV_blank> frame: <S2SV_blank> %d, <S2SV_blank> layer: <S2SV_blank> %d, <S2SV_blank> PSNR(Total//Y//U//V): <S2SV_blank> " "%2.3f <S2SV_blank> <S2SV_blank> %2.3f <S2SV_blank> <S2SV_blank> %2.3f <S2SV_blank> <S2SV_blank> %2.3f <S2SV_blank> \\n", si -> psnr_pkt
Buggy code:
 static void __xen_evtchn_do_upcall ( void ) { struct vcpu_info * vcpu_info = __this_cpu_read ( xen_vcpu ) ; <START_BUG> int cpu = smp_processor_id ( ) ; <END_BUG> do { vcpu_info -> evtchn_upcall_pending = 0 ; xen_evtchn_handle_events ( cpu ) ; BUG_ON (! irqs_disabled ( ) ) ; virt_rmb ( ) ; } while ( vcpu_info -> evtchn_upcall_pending ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> = smp_processor_id ( ) ; read_lock ( & evtchn_rwlock <S2SV_ModStart> evtchn_upcall_pending ) ; read_unlock ( & evtchn_rwlock ) ;
Buggy code:
 static int read_compressed_header ( VP9Decoder * pbi, const uint8_t * data, size_t partition_size ) { VP9_COMMON * const cm = & pbi -> common ; MACROBLOCKD * const xd = & pbi -> mb ; <START_BUG> FRAME_CONTEXT * const fc = & cm -> fc ; <END_BUG> vp9_reader r ; int k ;  if ( vp9_reader_init ( & r, data, partition_size ) ) <START_BUG> vpx_internal_error ( & cm -> error, VPX_CODEC_MEM_ERROR, "Failed   to   allocate   bool   decoder   0" ) ; cm -> tx_mode = xd -> lossless? ONLY_4X4 : read_tx_mode ( & r ) ; if ( cm -> tx_mode == TX_MODE_SELECT ) read_tx_mode_probs ( & fc -> tx_probs, & r ) ; read_coef_probs ( fc, cm -> tx_mode, & r ) ; for ( k = 0 ; k < SKIP_CONTEXTS ; ++ k ) vp9_diff_update_prob ( & r, & fc -> skip_probs [ k ] ) ; if (! frame_is_intra_only ( cm ) ) { nmv_context * const nmvc = & fc -> nmvc ; int i, j ; read_inter_mode_probs ( fc, & r ) ; if ( cm -> interp_filter == SWITCHABLE ) read_switchable_interp_probs ( fc, & r ) ; for ( i = 0 ; i < INTRA_INTER_CONTEXTS ; i ++ ) vp9_diff_update_prob ( & r, & fc -> intra_inter_prob [ i ] ) ; cm -> reference_mode = read_frame_reference_mode ( cm, & r ) ; if ( cm -> reference_mode!= SINGLE_REFERENCE ) setup_compound_reference_mode ( cm ) ; read_frame_reference_mode_probs ( cm, & r ) ; for ( j = 0 ; j < BLOCK_SIZE_GROUPS ; j ++ ) for ( i = 0 ; i < INTRA_MODES - 1 ; ++ i ) vp9_diff_update_prob ( & r, & fc -> y_mode_prob [ j ] [ i ] ) ;<END_BUG>

Fix:
<S2SV_ModStart> const fc = cm -> fc ; vpx_reader <S2SV_ModEnd> r ; int <S2SV_ModStart> ; if ( vpx_reader_init <S2SV_ModEnd> ( & r <S2SV_ModStart> data, partition_size, pbi -> decrypt_cb, pbi -> decrypt_state <S2SV_ModStart> ; } return vpx_reader_has_error <S2SV_ModEnd> ( & r
Buggy code:
 int lzo1x_decompress_safe ( const unsigned char * in, size_t in_len, unsigned char * out, size_t * out_len ) { unsigned char * op ; const unsigned char * ip ; size_t t, next ; size_t state = 0 ; const unsigned char * m_pos ; const unsigned char * const ip_end = in + in_len ; unsigned char * const op_end = out + * out_len ; op = out ; ip = in ; if ( unlikely ( in_len < 3 ) ) goto input_overrun ; if ( * ip > 17 ) { t = * ip ++ - 17 ; if ( t < 4 ) { next = t ; goto match_next ; } goto copy_literal_run ; } for ( ; ; ) { t = * ip ++ ; if ( t < 16 ) { if ( likely ( state == 0 ) ) { if ( unlikely ( t == 0 ) ) { while ( unlikely ( * ip == 0 ) ) { t += 255 ; ip ++ ; <START_BUG> NEED_IP ( 1 ) ; <END_BUG> } t += 15 + * ip ++ ; } t += 3 ; copy_literal_run : # if defined ( CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS )  if ( likely ( HAVE_IP ( t + 15 ) && HAVE_OP ( t + 15 ) ) ) { <START_BUG> const unsigned char * ie = ip + t ; unsigned char * oe = op + t ; do { COPY8 ( op, ip ) ; op += 8 ; ip += 8 ; COPY8 ( op, ip ) ; op += 8 ; ip += 8 ; } while ( ip < ie ) ; ip = ie ; op = oe ; } else # endif { <END_BUG> NEED_OP ( t ) ;  <START_BUG> NEED_IP ( t + 3 ) ; <END_BUG> do { * op ++ = * ip ++ ; } while ( -- t > 0 ) ; } state = 4 ; continue ; } else if ( state!= 4 ) { next = t & 3 ; m_pos = op - 1 ; m_pos -= t >> 2 ; m_pos -= * ip ++ << 2 ; TEST_LB ( m_pos ) ;  NEED_OP ( 2 ) ; <START_BUG> op [ 0 ] = m_pos [ 0 ] ; op [ 1 ] = m<END_BUG>

Fix:
<S2SV_ModStart> NEED_IP ( 1, 0 <S2SV_ModStart> HAVE_IP ( t, <S2SV_ModEnd> 15 ) && <S2SV_ModStart> HAVE_OP ( t, <S2SV_ModEnd> 15 ) ) <S2SV_ModStart> NEED_OP ( t, 0 <S2SV_ModStart> NEED_IP ( t, <S2SV_ModEnd> 3 ) ; <S2SV_ModStart> NEED_OP ( 2, 0 <S2SV_ModStart> NEED_IP ( 1, 0 <S2SV_ModStart> NEED_IP ( 2, 0 <S2SV_ModStart> NEED_IP ( 1, 0 <S2SV_ModStart> NEED_IP ( 2, 0 <S2SV_ModStart> HAVE_OP ( t, <S2SV_ModEnd> 15 ) ) <S2SV_ModStart> HAVE_IP ( 6, 0 <S2SV_ModStart> NEED_OP ( t, 0 <S2SV_ModStart> NEED_OP ( t, 0 <S2SV_ModStart> HAVE_IP ( 6, 0 <S2SV_ModStart> HAVE_OP ( 4, 0 <S2SV_ModStart> NEED_IP ( t, <S2SV_ModEnd> 3 ) ; <S2SV_ModStart> NEED_OP ( t, 0
Buggy code:
 <START_BUG> void vp9_idct32x32_add ( const int16_t * input, uint8_t * dest, int stride, <END_BUG> int eob ) { if ( eob == 1 )  vp9_idct32x32_1_add ( input, dest, stride ) ; <START_BUG> else if ( eob <= 34 ) <END_BUG> vp9_idct32x32_34_add ( input, dest, stride ) ;  else <START_BUG> vp9_idct32x32_1024_add ( input, dest, stride ) ; <END_BUG> }

Fix:
<S2SV_ModStart> vp9_idct32x32_add ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> == 1 ) vpx_idct32x32_1_add <S2SV_ModEnd> ( input, <S2SV_ModStart> <= 34 ) vpx_idct32x32_34_add <S2SV_ModEnd> ( input, <S2SV_ModStart> ) ; else vpx_idct32x32_1024_add <S2SV_ModEnd> ( input,
Buggy code:
 <START_BUG> static int get_max_filter_level ( VP9_COMP * cpi ) { <END_BUG> return cpi -> twopass. section_intra_rating > 8? MAX_LOOP_FILTER * 3 // 4 : MAX_LOOP_FILTER ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> int get_max_filter_level ( const <S2SV_ModStart> VP9_COMP * cpi ) { if ( cpi -> oxcf. pass == 2 <S2SV_ModStart> MAX_LOOP_FILTER ; } else { return MAX_LOOP_FILTER ; } }
Buggy code:
 int vp8_calc_ss_err ( YV12_BUFFER_CONFIG * source, YV12_BUFFER_CONFIG * dest ) { int i, j ; int Total = 0 ; unsigned char * src = source -> y_buffer ; unsigned char * dst = dest -> y_buffer ; for ( i = 0 ; i < source -> y_height ; i += 16 ) { for ( j = 0 ; j < source -> y_width ; j += 16 ) { unsigned int sse ; <START_BUG> Total += vp8_mse16x16 ( src + j, source -> y_stride, dst + j, dest -> y_stride, & sse ) ; <END_BUG> } src += 16 * source -> y_stride ; dst += 16 * dest -> y_stride ; } return Total ; }

Fix:
<S2SV_ModStart> ; Total += vpx_mse16x16 <S2SV_ModEnd> ( src +
Buggy code:
 int cdf_read_short_sector_chain ( const cdf_header_t * h, const cdf_sat_t * ssat, const cdf_stream_t * sst, cdf_secid_t sid, size_t len, cdf_stream_t * scn ) { <START_BUG> size_t ss = CDF_SEC_SIZE ( h ), i, j ; <END_BUG> scn -> sst_len = cdf_count_chain ( ssat, sid, CDF_SEC_SIZE ( h ) ) ; scn -> sst_dirlen = len ; if ( sst -> sst_tab == NULL || scn -> sst_len == ( size_t ) - 1 ) return - 1 ; scn -> sst_tab = calloc ( scn -> sst_len, ss ) ; if ( scn -> sst_tab == NULL ) return - 1 ; for ( j = i = 0 ; sid >= 0 ; i ++, j ++ ) { if ( j >= CDF_LOOP_LIMIT ) { DPRINTF ( ( "Read   short   sector   chain   loop   limit" ) ) ; errno = EFTYPE ; goto out ; } if ( i >= scn -> sst_len ) { DPRINTF ( ( "Out   of   bounds   reading   short   sector   chain   " "%" SIZE_T_FORMAT "u   >   %" SIZE_T_FORMAT "u\\n", i, scn -> sst_len ) ) ; errno = EFTYPE ; goto out ; } if ( cdf_read_short_sector ( sst, scn -> sst_tab, i * ss, ss, h, sid )!= ( ssize_t ) ss ) { DPRINTF ( ( "Reading   short   sector   chain   %d", sid ) ) ; goto out ; } sid = CDF_TOLE4 ( ( uint32_t ) ssat -> sat_tab [ sid ] ) ; } return 0 ; out : free ( scn -> sst_tab ) ; return - 1 ; }

Fix:
<S2SV_ModStart> size_t ss = CDF_SHORT_SEC_SIZE <S2SV_ModEnd> ( h )
Buggy code:
 static bool generic_new ( struct nf_conn * ct, const struct sk_buff * skb, unsigned int dataoff, unsigned int * timeouts ) { <START_BUG> return true ; <END_BUG> }

Fix:
<S2SV_ModStart> ) { return nf_generic_should_process ( nf_ct_protonum ( ct ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int store_asoundrc ( void ) { fs_build_mnt_dir ( ) ; char * src ; char * dest = RUN_ASOUNDRC_FILE ; FILE * fp = fopen ( dest, "w" ) ; if ( fp ) { fprintf ( fp, "\\n" ) ; SET_PERMS_STREAM ( fp, getuid ( ), getgid ( ), 0644 ) ; fclose ( fp ) ; } if ( asprintf ( & src, "%s//.asoundrc", cfg. homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( src, & s ) == 0 ) { if ( is_link ( src ) ) { <START_BUG> fprintf ( stderr, "Error:   invalid  .asoundrc   file\\n" ) ; <END_BUG> exit ( 1 ) ; }  pid_t child = fork ( ) ; <START_BUG> if ( child < 0 ) errExit ( "fork" ) ; if ( child == 0 ) { drop_privs ( 0 ) ; int rv = copy_file ( src, dest ) ; if ( rv ) <END_BUG> fprintf ( stderr, "Warning:   cannot   transfer  .asoundrc   in   private   home   directory\\n" ) ;  else { <START_BUG> fs_logger2 ( "clone", dest ) ; <END_BUG> } _exit ( 0 ) ; } waitpid ( child, NULL, 0 ) ; if ( chown ( dest, getuid ( ), getgid ( ) ) == - 1 ) errExit ( "fchown" ) ; if ( chmod ( dest, 0644 ) == - 1 ) errExit ( "fchmod" ) ; return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> ) ) { char * rp = realpath ( src, NULL ) ; if (! rp ) { <S2SV_ModStart> ( stderr, "Error: <S2SV_blank> Cannot <S2SV_blank> access <S2SV_blank> %s\\n", src <S2SV_ModEnd> ) ; exit <S2SV_ModStart> ) ; } if ( strncmp ( rp, cfg. homedir, strlen ( cfg. homedir ) )!= 0 ) { <S2SV_ModEnd> fprintf ( stderr <S2SV_ModStart> ( stderr, "Error: <S2SV_blank>.asoundrc <S2SV_blank> is <S2SV_blank> a <S2SV_blank> symbolic <S2SV_blank> link <S2SV_blank> pointing <S2SV_blank> to <S2SV_blank> a <S2SV_blank> file <S2SV_blank> outside <S2SV_blank> home <S2SV_blank> directory\\n" ) ; exit ( 1 ) ; } free ( rp ) ; } copy_file_as_user ( src, dest, getuid ( ), getgid ( ), 0644 ) ; <S2SV_ModEnd> fs_logger2 ( "clone" <S2SV_ModStart> "clone", dest <S2SV_ModEnd> ) ; return
Buggy code:
 static void unset_active_map ( const vpx_codec_enc_cfg_t * cfg, vpx_codec_ctx_t * codec ) { <START_BUG> vpx_active_map_t map = { 0 } ; <END_BUG> map. rows = ( cfg -> g_h + 15 ) // 16 ; map. cols = ( cfg -> g_w + 15 ) // 16 ; map. active_map = NULL ; if ( vpx_codec_control ( codec, VP8E_SET_ACTIVEMAP, & map ) ) die_codec ( codec, "Failed   to   set   active   map" ) ; }

Fix:
<S2SV_ModStart> map = { 0, 0,
Buggy code:
 static void ext4_end_io_work ( struct work_struct * work ) { ext4_io_end_t * io = container_of ( work, ext4_io_end_t, work ) ; struct inode * inode = io -> inode ; <START_BUG> int ret = 0 ; <END_BUG> mutex_lock ( & inode -> i_mutex ) ; ret = ext4_end_io_nolock ( io ) ;  if ( ret >= 0 ) { <START_BUG> if (! list_empty ( & io -> list ) ) list_del_init ( & io -> list ) ; <END_BUG> ext4_free_io_end ( io ) ;  } mutex_unlock ( & inode -> i_mutex ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> -> inode ; struct ext4_inode_info * ei = EXT4_I ( inode ) ; unsigned long flags ; int ret <S2SV_ModEnd> ; mutex_lock ( <S2SV_ModStart> if ( ret < <S2SV_ModEnd> 0 ) { <S2SV_ModStart> 0 ) { mutex_unlock ( & inode -> i_mutex ) ; return ; } spin_lock_irqsave ( & ei -> i_completed_io_lock, flags ) ; <S2SV_ModStart> list ) ; spin_unlock_irqrestore ( & ei -> i_completed_io_lock, flags ) ; <S2SV_ModEnd> mutex_unlock ( & <S2SV_ModStart> i_mutex ) ; ext4_free_io_end ( io ) ;
Buggy code:
 bool initiate_stratum ( struct pool * pool ) { char s [ RBUFSIZE ], * sret = NULL, * nonce1, * sessionid ; json_t * val = NULL, * res_val, * err_val ; bool ret = false, recvd = false ; json_error_t err ; int n2size ; if (! setup_stratum_curl ( pool ) ) goto out ; resend : if ( pool -> sessionid ) sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   [\\"%s\\"]}", swork_id ++, pool -> sessionid ) ; else sprintf ( s, "{\\"id\\":   %d,   \\"method\\":   \\"mining.subscribe\\",   \\"params\\":   []}", swork_id ++ ) ; if (! __stratum_send ( pool, s, strlen ( s ) ) ) { applog ( LOG_DEBUG, "Failed   to   send   s   in   initiate_stratum" ) ; goto out ; } if (! socket_full ( pool, true ) ) { applog ( LOG_DEBUG, "Timed   out   waiting   for   response   in   initiate_stratum" ) ; goto out ; } sret = recv_line ( pool ) ; if (! sret ) goto out ; recvd = true ; val = JSON_LOADS ( sret, & err ) ; free ( sret ) ; if (! val ) { applog ( LOG_INFO, "JSON   decode   failed(%d):   %s", err. line, err. text ) ; goto out ; } res_val = json_object_get ( val, "result" ) ; err_val = json_object_get ( val, "error" ) ; if (! res_val || json_is_null ( res_val ) || ( err_val &&! json_is_null ( err_val ) ) ) { char * ss ; if ( err_val ) ss = json_dumps ( err_val, JSON_INDENT ( 3 ) ) ; else ss = strdup ( "(unknown   reason)" ) ; applog ( LOG_INFO, "JSON-RPC   decode

Fix:
<S2SV_ModStart> ; if ( n2size < 1 ) <S2SV_ModEnd> { applog (
Buggy code:
 <START_BUG> int fourcc_is_ivf ( const char detect [ 4 ] ) { <END_BUG> if ( memcmp ( detect, "DKIF", 4 ) == 0 ) { return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 int __usb_get_extra_descriptor ( char * buffer, unsigned size, <START_BUG> unsigned char type, void * * ptr ) <END_BUG> { struct usb_descriptor_header * header ; while ( size >= sizeof ( struct usb_descriptor_header ) ) { header = ( struct usb_descriptor_header * ) buffer ;  if ( header -> bLength < 2 ) { <START_BUG> printk ( KERN_ERR "%s:   bogus   descriptor,   type   %d   length   %d\\n", usbcore_name, header -> bDescriptorType, header -> bLength ) ; return - 1 ; } <END_BUG> if ( header -> bDescriptorType == type ) {  * ptr = header ; return 0 ; } buffer += header -> bLength ; size -= header -> bLength ; } return - 1 ; }

Fix:
<S2SV_ModStart> * * ptr, size_t minsize <S2SV_ModStart> bLength < 2 || header -> bLength > size <S2SV_ModStart> bDescriptorType == type && header -> bLength >= minsize
Buggy code:
 static __u8 * nci_extract_rf_params_nfcb_passive_poll ( struct nci_dev * ndev, struct rf_tech_specific_params_nfcb_poll * nfcb_poll, __u8 * data ) { <START_BUG> nfcb_poll -> sensb_res_len = * data ++ ; <END_BUG> pr_debug ( "sensb_res_len   %d\\n", nfcb_poll -> sensb_res_len ) ; memcpy ( nfcb_poll -> sensb_res, data, nfcb_poll -> sensb_res_len ) ; data += nfcb_poll -> sensb_res_len ; return data ; }

Fix:
<S2SV_ModStart> -> sensb_res_len = min_t ( __u8, <S2SV_ModStart> * data ++, NFC_SENSB_RES_MAXSIZE )
Buggy code:
 static int nsv_read_chunk ( AVFormatContext * s, int fill_header ) { NSVContext * nsv = s -> priv_data ; AVIOContext * pb = s -> pb ; AVStream * st [ 2 ] = { NULL, NULL } ; NSVStream * nst ; AVPacket * pkt ; int i, err = 0 ; uint8_t auxcount ; uint32_t vsize ; uint16_t asize ; <START_BUG> uint16_t auxsize ; <END_BUG> if ( nsv -> ahead [ 0 ]. data || nsv -> ahead [ 1 ]. data ) return 0 ; null_chunk_retry : if ( pb -> eof_reached ) return - 1 ; for ( i = 0 ; i < NSV_MAX_RESYNC_TRIES && nsv -> state < NSV_FOUND_NSVS &&! err ; i ++ ) err = nsv_resync ( s ) ; if ( err < 0 ) return err ; if ( nsv -> state == NSV_FOUND_NSVS ) err = nsv_parse_NSVs_header ( s ) ; if ( err < 0 ) return err ; if ( nsv -> state!= NSV_HAS_READ_NSVS && nsv -> state!= NSV_FOUND_BEEF ) return - 1 ; auxcount = avio_r8 ( pb ) ; vsize = avio_rl16 ( pb ) ; asize = avio_rl16 ( pb ) ; vsize = ( vsize << 4 ) | ( auxcount >> 4 ) ; auxcount &= 0x0f ; av_log ( s, AV_LOG_TRACE, "NSV   CHUNK   %" PRIu8 "   aux,   %" PRIu32 "   bytes   video,   %" PRIu16 "   bytes   audio\\n", auxcount, vsize, asize ) ; for ( i = 0 ; i < auxcount ; i ++ ) { uint32_t av_unused auxtag ; auxsize = avio_rl16 ( pb ) ; auxtag = avio_rl32 ( pb ) ; avio_skip ( pb, auxsize ) ; vsize -= auxsize + sizeof ( uint16_t ) + sizeof ( uint32_t ) ; } if ( pb -> eof_reached ) return -

Fix:
<S2SV_ModStart> ; uint16_t auxsize ; int ret <S2SV_ModStart> NSV_ST_VIDEO ] ; if ( ( ret = <S2SV_ModStart>, vsize ) ) < 0 ) return ret <S2SV_ModStart> ; } } if ( ( ret = <S2SV_ModStart>, asize ) ) < 0 ) return ret
Buggy code:
 int ff_combine_frame ( ParseContext * pc, int next, const uint8_t * * buf, int * buf_size ) { if ( pc -> overread ) { av_dlog ( NULL, "overread   %d,   state:%X   next:%d   index:%d   o_index:%d\\n", pc -> overread, pc -> state, next, pc -> index, pc -> overread_index ) ; av_dlog ( NULL, "%X   %X   %X   %X\\n", ( * buf ) [ 0 ], ( * buf ) [ 1 ], ( * buf ) [ 2 ], ( * buf ) [ 3 ] ) ; } for ( ; pc -> overread > 0 ; pc -> overread -- ) { pc -> buffer [ pc -> index ++ ] = pc -> buffer [ pc -> overread_index ++ ] ; } if (! * buf_size && next == END_NOT_FOUND ) { next = 0 ; } pc -> last_index = pc -> index ; if ( next == END_NOT_FOUND ) { void * new_buffer = av_fast_realloc ( pc -> buffer, & pc -> buffer_size, ( * buf_size ) + pc -> index + FF_INPUT_BUFFER_PADDING_SIZE ) ; <START_BUG> if (! new_buffer ) <END_BUG>  return AVERROR ( ENOMEM ) ; <START_BUG> pc -> buffer = new_buffer ; memcpy ( & pc -> buffer [ pc -> index ], * buf, * buf_size ) ; pc -> index += * buf_size ; return - 1 ; } * buf_size = pc -> overread_index = pc -> index + next ; if ( pc -> index ) { void * new_buffer = av_fast_realloc ( pc -> buffer, & pc -> buffer_size, next + pc -> index + FF_INPUT_BUFFER_PADDING_SIZE ) ; <END_BUG> if (! new_buffer )  <START_BUG> return AVERROR ( ENOMEM ) ; <END_BUG> pc -> buffer = new_buffer ; if ( next > - FF_INPUT_BUFFER_PADDING_SIZE ) memcpy ( & pc -> buffer [ pc -> index ], * buf, next + FF_INPUT_BUFFER_PADDING_SIZE ) ; pc -> index = 0 ; * buf = pc -> buffer ; }

Fix:
<S2SV_ModStart>! new_buffer ) { pc -> index = 0 ; <S2SV_ModStart> ENOMEM ) ; } <S2SV_ModStart>! new_buffer ) { pc -> overread_index = pc -> index = 0 ; <S2SV_ModStart> ENOMEM ) ; }
Buggy code:
 static Image * ExtractPostscript ( Image * image, const ImageInfo * image_info, MagickOffsetType PS_Offset, ssize_t PS_Size, ExceptionInfo * exception ) { char postscript_file [ MaxTextExtent ] ; const MagicInfo * magic_info ; FILE * ps_file ; ImageInfo * clone_info ; Image * image2 ; unsigned char magick [ 2 * MaxTextExtent ] ; if ( ( clone_info = CloneImageInfo ( image_info ) ) == NULL ) return ( image ) ; clone_info -> blob = ( void * ) NULL ; clone_info -> length = 0 ; ( void ) AcquireUniqueFilename ( postscript_file ) ; ps_file = fopen_utf8 ( postscript_file, "wb" ) ; if ( ps_file == ( FILE * ) NULL ) goto FINISH ; ( void ) SeekBlob ( image, PS_Offset, SEEK_SET ) ; ( void ) ReadBlob ( image, 2 * MaxTextExtent, magick ) ; ( void ) SeekBlob ( image, PS_Offset, SEEK_SET ) ; while ( PS_Size -- > 0 ) { ( void ) fputc ( ReadBlobByte ( image ), ps_file ) ; } ( void ) fclose ( ps_file ) ; magic_info = GetMagicInfo ( magick, 2 * MaxTextExtent, exception ) ; if ( magic_info == ( const MagicInfo * ) NULL ) goto FINISH_UNL ; if ( exception -> severity!= UndefinedException ) goto FINISH_UNL ; if ( magic_info -> name == ( char * ) NULL ) goto FINISH_UNL ; <START_BUG> ( void ) CopyMagickMemory ( clone_info -> magick, magic_info -> name, MaxTextExtent ) ; <END_BUG> FormatLocaleString ( clone_info -> filename, MaxTextExtent, "%s", postscript_file ) ; image2 = ReadImage ( clone_info, exception ) ; if (! image2 ) goto FINISH_UNL ; ( void ) CopyMagickMemory ( image2 -> filename, image -> filename, MaxTextExtent ) ; ( void ) CopyMagickMemory ( image2 -> magick_filename, image -> magick_filename, MaxTextExtent ) ; ( void ) CopyMagickMemory ( image2 -> magick, image -> magick, MaxTextExtent ) ; image2 -> depth = image ->

Fix:
<S2SV_ModStart> ( void ) strncpy <S2SV_ModEnd> ( clone_info ->
Buggy code:
 static int unix_attach_fds ( struct scm_cookie * scm, struct sk_buff * skb ) { int i ; unsigned char max_level = 0 ; int unix_sock_count = 0 ; <START_BUG> for ( i = scm -> fp -> count - 1 ; i >= 0 ; i -- ) { <END_BUG> struct sock * sk = unix_get_socket ( scm -> fp -> fp [ i ] ) ; if ( sk ) { unix_sock_count ++ ; max_level = max ( max_level, unix_sk ( sk ) -> recursion_level ) ; } } if ( unlikely ( max_level > MAX_RECURSION_LEVEL ) ) return - ETOOMANYREFS ; UNIXCB ( skb ). fp = scm_fp_dup ( scm -> fp ) ; if (! UNIXCB ( skb ). fp ) return - ENOMEM ;  if ( unix_sock_count ) { <START_BUG> for ( i = scm -> fp -> count - 1 ; i >= 0 ; i -- ) unix_inflight ( scm -> fp -> fp [ i ] ) ; <END_BUG> }  return max_level ; }

Fix:
<S2SV_ModStart> = 0 ; if ( too_many_unix_fds ( current ) ) return - ETOOMANYREFS ; <S2SV_ModStart> - ENOMEM ; <S2SV_ModEnd> for ( i <S2SV_ModStart> ] ) ; <S2SV_ModEnd> return max_level ;
Buggy code:
 static int matchCurrentInput ( const InString * input, int pos, const widechar * passInstructions, int passIC ) { int k ; int kk = pos ; <START_BUG> for ( k = passIC + 2 ; k < passIC + 2 + passInstructions [ passIC + 1 ] ; k ++ ) <END_BUG> if ( input -> chars [ kk ] == ENDSEGMENT || passInstructions [ k ]!= input -> chars [ kk ++ ] ) return 0 ; return 1 ; }

Fix:
<S2SV_ModStart> + 2 ; ( ( <S2SV_ModStart> + 1 ] ) && ( kk < input -> length ) )
Buggy code:
 GF_Err adts_dmx_process ( GF_Filter * filter ) { GF_ADTSDmxCtx * ctx = gf_filter_get_udta ( filter ) ; GF_FilterPacket * pck, * dst_pck ; u8 * data, * output ; u8 * start ; u32 pck_size, remain, prev_pck_size ; u64 cts = GF_FILTER_NO_TS ; if (! ctx -> duration. num ) adts_dmx_check_dur ( filter, ctx ) ; if ( ctx -> opid &&! ctx -> is_playing ) return GF_OK ; pck = gf_filter_pid_get_packet ( ctx -> ipid ) ; if (! pck ) { if ( gf_filter_pid_is_eos ( ctx -> ipid ) ) { if (! ctx -> adts_buffer_size ) { if ( ctx -> opid ) gf_filter_pid_set_eos ( ctx -> opid ) ; if ( ctx -> src_pck ) gf_filter_pck_unref ( ctx -> src_pck ) ; ctx -> src_pck = NULL ; return GF_EOS ; } } else { return GF_OK ; } } prev_pck_size = ctx -> adts_buffer_size ; if ( pck &&! ctx -> resume_from ) { data = ( char * ) gf_filter_pck_get_data ( pck, & pck_size ) ; if (! pck_size ) { gf_filter_pid_drop_packet ( ctx -> ipid ) ; return GF_OK ; } if ( ctx -> byte_offset!= GF_FILTER_NO_BO ) { u64 byte_offset = gf_filter_pck_get_byte_offset ( pck ) ; if (! ctx -> adts_buffer_size ) { ctx -> byte_offset = byte_offset ; } else if ( ctx -> byte_offset + ctx -> adts_buffer_size!= byte_offset ) { ctx -> byte_offset = GF_FILTER_NO_BO ; if ( ( byte_offset!= GF_FILTER_NO_BO ) && ( byte_offset > ctx -> adts_buffer_size

Fix:
<S2SV_ModStart> break ; } if ( ctx -> hdr. frame_size < ctx -> hdr. hdr_size ) { GF_LOG ( GF_LOG_WARNING, GF_LOG_PARSER, ( "[ADTSDmx] <S2SV_blank> Corrupted <S2SV_blank> ADTS <S2SV_blank> frame <S2SV_blank> header, <S2SV_blank> resyncing\\n" ) ) ; ctx -> nb_frames = 0 ; goto drop_byte ; }
Buggy code:
 u_int null_if_print ( netdissect_options * ndo, const struct pcap_pkthdr * h, const u_char * p ) { u_int length = h -> len ; u_int caplen = h -> caplen ; u_int family ; if ( caplen < NULL_HDRLEN ) { ND_PRINT ( ( ndo, "[|null]" ) ) ; return ( NULL_HDRLEN ) ; } memcpy ( ( char * ) & family, ( const char * ) p, sizeof ( family ) ) ; if ( ( family & 0xFFFF0000 )!= 0 ) family = SWAPLONG ( family ) ; if ( ndo -> ndo_eflag ) null_hdr_print ( ndo, family, length ) ; length -= NULL_HDRLEN ; caplen -= NULL_HDRLEN ; p += NULL_HDRLEN ; switch ( family ) { case BSD_AFNUM_INET : ip_print ( ndo, p, length ) ; break ; case BSD_AFNUM_INET6_BSD : case BSD_AFNUM_INET6_FREEBSD : case BSD_AFNUM_INET6_DARWIN : ip6_print ( ndo, p, length ) ; break ; case BSD_AFNUM_ISO : <START_BUG> isoclns_print ( ndo, p, length, caplen ) ; <END_BUG> break ; case BSD_AFNUM_APPLETALK : atalk_print ( ndo, p, length ) ; break ; case BSD_AFNUM_IPX : ipx_print ( ndo, p, length ) ; break ; default : if (! ndo -> ndo_eflag ) null_hdr_print ( ndo, family, length + NULL_HDRLEN ) ; if (! ndo -> ndo_suppress_default_print ) ND_DEFAULTPRINT ( p, caplen ) ; } return ( NULL_HDRLEN ) ; }

Fix:
<S2SV_ModStart> p, length <S2SV_ModEnd> ) ; break
Buggy code:
 static int userfaultfd_release ( struct inode * inode, struct file * file ) { struct userfaultfd_ctx * ctx = file -> private_data ; struct mm_struct * mm = ctx -> mm ; struct vm_area_struct * vma, * prev ; struct userfaultfd_wake_range range = {. len = 0, } ; unsigned long new_flags ; WRITE_ONCE ( ctx -> released, true ) ; if (! mmget_not_zero ( mm ) ) goto wakeup ; down_write ( & mm -> mmap_sem ) ; <START_BUG> prev = NULL ; <END_BUG> for ( vma = mm -> mmap ; vma ; vma = vma -> vm_next ) { cond_resched ( ) ; BUG_ON (!! vma -> vm_userfaultfd_ctx. ctx ^!! ( vma -> vm_flags & ( VM_UFFD_MISSING | VM_UFFD_WP ) ) ) ; if ( vma -> vm_userfaultfd_ctx. ctx!= ctx ) { prev = vma ; continue ; } new_flags = vma -> vm_flags & ~ ( VM_UFFD_MISSING | VM_UFFD_WP ) ; prev = vma_merge ( mm, prev, vma -> vm_start, vma -> vm_end, new_flags, vma -> anon_vma, vma -> vm_file, vma -> vm_pgoff, vma_policy ( vma ), NULL_VM_UFFD_CTX ) ; if ( prev ) vma = prev ; else prev = vma ; vma -> vm_flags = new_flags ; vma -> vm_userfaultfd_ctx = NULL_VM_UFFD_CTX ; }  up_write ( & mm -> mmap_sem ) ; <START_BUG> mmput ( mm ) ; wakeup : spin_lock ( & ctx -> fault_pending_wqh. lock ) ; __wake_up_locked_key ( & ctx -> fault_pending_wqh, TASK_NORMAL, & range ) ; __wake_up ( & ctx -> fault_wqh, TASK_NORMAL, 1, & range ) ; spin_unlock ( & ctx -> fault_pending_wqh. lock ) ; wake_up_<END_BUG>

Fix:
<S2SV_ModStart> mmap_sem ) ; if (! mmget_still_valid ( mm ) ) goto skip_mm ; <S2SV_ModStart> NULL_VM_UFFD_CTX ; } skip_mm :
Buggy code:
 void w3m_exit ( int i ) { # ifdef USE_MIGEMO init_migemo ( ) ; # endif stopDownload ( ) ; deleteFiles ( ) ; # ifdef USE_SSL free_ssl_ctx ( ) ; # endif disconnectFTP ( ) ; # ifdef USE_NNTP disconnectNews ( ) ; # endif # ifdef __MINGW32_VERSION WSACleanup ( ) ; # endif <START_BUG> exit ( i ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ; # endif # ifdef HAVE_MKDTEMP if ( no_rc_dir && tmp_dir!= rc_dir ) if ( rmdir ( tmp_dir )!= 0 ) { fprintf ( stderr, "Can\'t <S2SV_blank> remove <S2SV_blank> temporary <S2SV_blank> directory <S2SV_blank> (%s)!\\n", tmp_dir ) ; exit ( 1 ) ; } # endif
Buggy code:
 static boolean_t is_authenticated ( HttpRequest req, HttpResponse res ) { if ( Run. httpd. credentials ) { if (! basic_authenticate ( req ) ) { send_error ( req, res, SC_UNAUTHORIZED, "You   are   not   authorized   to   access   monit.   Either   you   supplied   the   wrong   credentials   (e.g.   bad   password),   or   your   browser   doesn\'t   understand   how   to   supply   the   credentials   required" ) ; set_header ( res, "WWW-Authenticate", "Basic   realm=\\"monit\\"" ) ; return false ; } } <START_BUG> return true ; <END_BUG> }

Fix:
<S2SV_ModStart> ; } } if ( IS ( req -> method, METHOD_POST ) ) { const char * cookie = get_header ( req, "Cookie" ) ; const char * token = get_parameter ( req, "securitytoken" ) ; if (! cookie ) { LogError ( "HttpRequest: <S2SV_blank> access <S2SV_blank> denied <S2SV_blank> -- <S2SV_blank> client <S2SV_blank> [%s]: <S2SV_blank> missing <S2SV_blank> CSRF <S2SV_blank> token <S2SV_blank> cookie\\n", NVLSTR ( Socket_getRemoteHost ( req -> S ) ) ) ; send_error ( req, res, SC_FORBIDDEN, "Invalid <S2SV_blank> CSRF <S2SV_blank> Token" ) ; return false ; } if (! token ) { LogError ( "HttpRequest: <S2SV_blank> access <S2SV_blank> denied <S2SV_blank> -- <S2SV_blank> client <S2SV_blank> [%s]: <S2SV_blank> missing <S2SV_blank> CSRF <S2SV_blank> token <S2SV_blank> in <S2SV_blank> HTTP <S2SV_blank> parameter\\n", NVLSTR ( Socket_getRemoteHost ( req -> S ) ) ) ; send_error ( req, res, SC_FORBIDDEN, "Invalid <S2SV_blank> CSRF <S2SV_blank> Token" ) ; return false ; } if (! Str_startsWith ( cookie, "securitytoken=" ) ) { LogError ( "HttpRequest: <S2SV_blank> access <S2SV_blank> denied <S2SV_blank> -- <S2SV_blank> client <S2SV_blank>
Buggy code:
 static PixelChannels * * AcquirePixelThreadSet ( const Image * images ) { const Image * next ; PixelChannels * * pixels ; register ssize_t i ; size_t columns, <START_BUG> number_threads ; <END_BUG>  number_threads = ( size_t ) GetMagickResourceLimit ( ThreadResource ) ; <START_BUG> <END_BUG> pixels = ( PixelChannels * * ) AcquireQuantumMemory ( number_threads,  sizeof ( * pixels ) ) ; if ( pixels == ( PixelChannels * * ) NULL ) return ( ( PixelChannels * * ) NULL ) ; <START_BUG> ( void ) memset ( pixels, 0, number_threads * sizeof ( * pixels ) ) ; <END_BUG> columns = images -> columns ; for ( next = images ; next!= ( Image * ) NULL ; next = next -> next ) columns = MagickMax ( next -> columns, columns ) ;  for ( i = 0 ; i < ( ssize_t ) number_threads ; i ++ ) <START_BUG> { register ssize_t j ; pixels [ i ] = ( PixelChannels * ) AcquireQuantumMemory ( columns, sizeof ( * * pixels ) ) ; if ( pixels [ i ] == ( PixelChannels * ) NULL ) return ( DestroyPixelThreadSet ( pixels ) ) ; for ( j = 0 ; j < ( ssize_t ) columns ; j ++ ) { register ssize_t k ; for ( k = 0 ; k < MaxPixelChannels ; k ++ ) pixels [ i ] [ j ]. channel [ k ] = 0.0 ; } } return ( pixels ) ; }<END_BUG>

Fix:
<S2SV_ModStart> size_t columns, rows ; rows = MagickMax ( GetImageListLength ( images ), <S2SV_ModEnd> ( size_t ) <S2SV_ModStart> ( ThreadResource ) ) <S2SV_ModStart> ) AcquireQuantumMemory ( rows, <S2SV_ModEnd> sizeof ( * <S2SV_ModStart> NULL ) ; columns = MaxPixelChannels ; for ( next = images ; next!= ( Image * ) NULL ; next = next -> next ) columns = MagickMax ( next -> columns, columns ) ; for ( i = 0 <S2SV_ModEnd> ; i < <S2SV_ModStart> ( ssize_t ) rows <S2SV_ModEnd> ; i ++