nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int cma_req_handler ( struct ib_cm_id * cm_id, struct ib_cm_event * ib_event ) { struct rdma_id_private * listen_id, * conn_id ; struct rdma_cm_event event ; int offset, ret ; <START_BUG> u8 smac [ ETH_ALEN ] ; <END_BUG> u8 alt_smac [ ETH_ALEN ] ; u8 * psmac = smac ; u8 * palt_smac = alt_smac ; int is_iboe = ( ( rdma_node_get_transport ( cm_id -> device -> node_type ) == RDMA_TRANSPORT_IB ) && ( rdma_port_get_link_layer ( cm_id -> device, ib_event -> param. req_rcvd. port ) == IB_LINK_LAYER_ETHERNET ) ) ; listen_id = cm_id -> context ; if (! cma_check_req_qp_type ( & listen_id -> id, ib_event ) ) return - EINVAL ; if ( cma_disable_callback ( listen_id, RDMA_CM_LISTEN ) ) return - ECONNABORTED ; memset ( & event, 0, sizeof event ) ; offset = cma_user_data_offset ( listen_id ) ; event. event = RDMA_CM_EVENT_CONNECT_REQUEST ; if ( ib_event -> event == IB_CM_SIDR_REQ_RECEIVED ) { conn_id = cma_new_udp_id ( & listen_id -> id, ib_event ) ; event. param. ud. private_data = ib_event -> private_data + offset ; event. param. ud. private_data_len = IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE - offset ; } else { conn_id = cma_new_conn_id ( & listen_id -> id, ib_event ) ; cma_set_req_event_data ( & event, & ib_event -> param. req_rcvd, ib_event -> private_data, offset ) ; } if (! conn_id ) { ret = - ENOMEM ; goto err1 ; } mutex_lock_nested ( & conn_id -> handler_mutex

Fix:
<S2SV_ModStart>, ret ; <S2SV_ModEnd> listen_id = cm_id <S2SV_ModStart> goto err3 ; <S2SV_ModEnd> mutex_lock ( & <S2SV_ModStart> ( & lock <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> static void update_state ( VP9_COMP * cpi, PICK_MODE_CONTEXT * ctx, <END_BUG> int mi_row, int mi_col, BLOCK_SIZE bsize, int output_enabled ) { int i, x_idx, y ; VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; struct macroblock_plane * const p = x -> plane ; struct macroblockd_plane * const pd = xd -> plane ; MODE_INFO * mi = & ctx -> mic ; MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ; MODE_INFO * mi_addr = xd -> mi [ 0 ] ; <END_BUG> const struct segmentation * const seg = & cm -> seg ;  const int mis = cm -> mi_stride ; const int mi_width = num_8x8_blocks_wide_lookup [ bsize ] ; const int mi_height = num_8x8_blocks_high_lookup [ bsize ] ; int max_plane ; assert ( mi -> mbmi. sb_type == bsize ) ; * mi_addr = * mi ; <START_BUG> if ( seg -> enabled && output_enabled ) { <END_BUG> if ( cpi -> oxcf. aq_mode == COMPLEXITY_AQ ) { const uint8_t * const map = seg -> update_map? cpi -> segmentation_map : cm -> last_frame_seg_map ; mi_addr -> mbmi. segment_id =  vp9_get_segment_id ( cm, map, bsize, mi_row, mi_col ) ; <START_BUG> } <END_BUG> else if ( cpi -> oxcf. aq_mode == CYCLIC_REFRESH_AQ ) {  vp9_cyclic_refresh_update_segment ( cpi, & xd -> mi [ 0 ] -> mbmi, <START_BUG> mi_row, mi_col, bsize, 1 ) ; <END_BUG> vp9_init_plane_quantizers ( cpi, x ) ; } } max_plane = is_inter_block ( mbmi )? MAX_MB_PLANE : 1 ; for ( i = 0 ; i < max_plane ; ++

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, <S2SV_ModStart> -> common ; RD_COUNTS * const rdc = & td -> rd_counts ; <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> cm -> seg ; const int bw = num_8x8_blocks_wide_lookup [ mi -> mbmi. sb_type ] ; const int bh = num_8x8_blocks_high_lookup [ mi -> mbmi. sb_type ] ; const int x_mis = MIN ( bw, cm -> mi_cols - mi_col ) ; const int y_mis = MIN ( bh, cm -> mi_rows - mi_row ) ; MV_REF * const frame_mvs = cm -> cur_frame -> mvs + mi_row * cm -> mi_cols + mi_col ; int w, h <S2SV_ModStart> * mi ; * x -> mbmi_ext = ctx -> mbmi_ext ; <S2SV_ModStart> seg -> enabled <S2SV_ModEnd> ) { if <S2SV_ModStart>. segment_id = get_segment_id <S2SV_ModEnd> ( cm, <S2SV_ModStart> ) ; } <S2SV_ModEnd> if ( cpi <S2SV_ModStart>, bsize, ctx -> rate, ctx -> dist, x -> skip <S2SV_ModEnd> ) ; } <S2SV_ModStart> ; if ( <S2SV_ModEnd> is_
Buggy code:
 int ssl3_get_new_session_ticket ( SSL * s ) { int ok, al, ret = 0, ticklen ; long n ; const unsigned char * p ; unsigned char * d ; n = s -> method -> ssl_get_message ( s, SSL3_ST_CR_SESSION_TICKET_A, SSL3_ST_CR_SESSION_TICKET_B, SSL3_MT_NEWSESSION_TICKET, 16384, & ok ) ; if (! ok ) return ( ( int ) n ) ; if ( n < 6 ) { al = SSL_AD_DECODE_ERROR ; SSLerr ( SSL_F_SSL3_GET_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH ) ; goto f_err ; } p = d = ( unsigned char * ) s -> init_msg ; <START_BUG> n2l ( p, s -> session -> tlsext_tick_lifetime_hint ) ; <END_BUG> n2s ( p, ticklen ) ; if ( ticklen + 6!= n ) { al = SSL_AD_DECODE_ERROR ; SSLerr ( SSL_F_SSL3_GET_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH ) ; goto f_err ; } OPENSSL_free ( s -> session -> tlsext_tick ) ; s -> session -> tlsext_ticklen = 0 ; s -> session -> tlsext_tick = OPENSSL_malloc ( ticklen ) ; if (! s -> session -> tlsext_tick ) { SSLerr ( SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE ) ; goto err ; } memcpy ( s -> session -> tlsext_tick, p, ticklen ) ; s -> session -> tlsext_ticklen = ticklen ; EVP_Digest ( p, ticklen, s -> session -> session_id, & s -> session -> session_id_length, EVP_sha256 ( ), NULL ) ; ret = 1 ; return ( ret ) ; f_err : ssl3_send_alert ( s, SSL3_AL_FATAL, al ) ; err : s -> state = SSL_ST_ERR ; return ( - 1 ) ; }

Fix:
<S2SV_ModStart> -> init_msg ; if ( s -> session -> session_id_length > 0 ) { int i = s -> session_ctx -> session_cache_mode ; SSL_SESSION * new_sess ; if ( i & SSL_SESS_CACHE_CLIENT ) { if ( i & SSL_SESS_CACHE_NO_INTERNAL_STORE ) { if ( s -> session_ctx -> remove_session_cb!= NULL ) s -> session_ctx -> remove_session_cb ( s -> session_ctx, s -> session ) ; } else { SSL_CTX_remove_session ( s -> session_ctx, s -> session ) ; } } if ( ( new_sess = ssl_session_dup ( s -> session, 0 ) ) == 0 ) { al = SSL_AD_INTERNAL_ERROR ; SSLerr ( SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE ) ; goto f_err ; } SSL_SESSION_free ( s -> session ) ; s -> session = new_sess ; }
Buggy code:
 static OPJ_BOOL opj_j2k_write_sot ( opj_j2k_t * p_j2k, OPJ_BYTE * p_data, <START_BUG> OPJ_UINT32 * p_data_written, <END_BUG> const opj_stream_private_t * p_stream, opj_event_mgr_t * p_manager ) { assert ( p_j2k!= 00 ) ; assert ( p_manager!= 00 ) ; assert ( p_stream!= 00 ) ; OPJ_UNUSED ( p_stream ) ; OPJ_UNUSED ( p_manager ) ;  opj_write_bytes ( p_data, J2K_MS_SOT, <START_BUG> 2 ) ; p_data += 2 ; opj_write_bytes ( p_data, 10, 2 ) ; p_data += 2 ; opj_write_bytes ( p_data, p_j2k -> m_current_tile_number, 2 ) ; p_data += 2 ; p_data += 4 ; opj_write_bytes ( p_data, p_j2k -> m_specific_param. m_encoder. m_current_tile_part_number, 1 ) ; ++ p_data ; opj_write_bytes ( p_data, p_j2k -> m_cp. tcps [ p_j2k -> m_current_tile_number ]. m_nb_tile_parts, 1 ) ; ++ p_data ; # ifdef USE_JPWL assert ( 0 && "TODO" ) ; # endif * p_data_written = 12 ; return OPJ_TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> p_data, OPJ_UINT32 p_total_data_size, OPJ_UINT32 <S2SV_ModStart> p_manager ) ; if ( p_total_data_size < 12 ) { opj_event_msg ( p_manager, EVT_ERROR, "Not <S2SV_blank> enough <S2SV_blank> bytes <S2SV_blank> in <S2SV_blank> output <S2SV_blank> buffer <S2SV_blank> to <S2SV_blank> write <S2SV_blank> SOT <S2SV_blank> marker\\n" ) ; return OPJ_FALSE ; }
Buggy code:
 static struct page * alloc_huge_page ( struct vm_area_struct * vma, unsigned long addr, int avoid_reserve ) { <START_BUG> struct hstate * h = hstate_vma ( vma ) ; <END_BUG>  struct page * page ; <START_BUG> struct address_space * mapping = vma -> vm_file -> f_mapping ; struct inode * inode = mapping -> host ; long chg ; chg = vma_needs_reservation ( h, vma, addr ) ; if ( chg < 0 ) return ERR_PTR ( - VM_FAULT_OOM ) ; if ( chg ) <END_BUG> if ( hugetlb_get_quota ( inode -> i_mapping, chg ) )  return ERR_PTR ( - VM_FAULT_SIGBUS ) ; spin_lock ( & hugetlb_lock ) ; page = dequeue_huge_page_vma ( h, vma, addr, avoid_reserve ) ; spin_unlock ( & hugetlb_lock ) ; if (! page ) { page = alloc_buddy_huge_page ( h, NUMA_NO_NODE ) ; if (! page ) { <START_BUG> hugetlb_put_quota ( inode -> i_mapping, chg ) ; <END_BUG> return ERR_PTR ( - VM_FAULT_SIGBUS ) ; } }  set_page_private ( page, ( unsigned long ) mapping ) ; <START_BUG> vma_commit_reservation ( h, vma, addr ) ; return page ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { struct hugepage_subpool * spool = subpool_vma ( vma ) ; struct <S2SV_ModStart> page * page <S2SV_ModEnd> ; long chg <S2SV_ModStart> ) if ( hugepage_subpool_get_pages ( spool <S2SV_ModEnd>, chg ) <S2SV_ModStart> page ) { hugepage_subpool_put_pages ( spool <S2SV_ModEnd>, chg ) <S2SV_ModStart> unsigned long ) spool <S2SV_ModEnd> ) ; vma_commit_reservation
Buggy code:
 static int x86_pmu_handle_irq ( struct pt_regs * regs ) { struct perf_sample_data data ; struct cpu_hw_events * cpuc ; struct perf_event * event ; int idx, handled = 0 ; u64 val ; perf_sample_data_init ( & data, 0 ) ; cpuc = & __get_cpu_var ( cpu_hw_events ) ; apic_write ( APIC_LVTPC, APIC_DM_NMI ) ; for ( idx = 0 ; idx < x86_pmu. num_counters ; idx ++ ) { if (! test_bit ( idx, cpuc -> active_mask ) ) { if ( __test_and_clear_bit ( idx, cpuc -> running ) ) handled ++ ; continue ; } event = cpuc -> events [ idx ] ; val = x86_perf_event_update ( event ) ; if ( val & ( 1ULL << ( x86_pmu. cntval_bits - 1 ) ) ) continue ; handled ++ ; data. period = event -> hw. last_period ; if (! x86_perf_event_set_period ( event ) ) continue ; <START_BUG> if ( perf_event_overflow ( event, 1, & data, regs ) ) <END_BUG> x86_pmu_stop ( event, 0 ) ; } if ( handled ) inc_irq_stat ( apic_perf_irqs ) ; return handled ; }

Fix:
<S2SV_ModStart> ( event, <S2SV_ModEnd> & data,
Buggy code:
 static int llcp_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; unsigned int copied, rlen ; struct sk_buff * skb, * cskb ; int err = 0 ; <START_BUG> pr_debug ( "%p   %zu\\n", sk, len ) ; <END_BUG> lock_sock ( sk ) ; if ( sk -> sk_state == LLCP_CLOSED && skb_queue_empty ( & sk -> sk_receive_queue ) ) { release_sock ( sk ) ; return 0 ; } release_sock ( sk ) ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) { pr_err ( "Recv   datagram   failed   state   %d   %d   %d", sk -> sk_state, err, sock_error ( sk ) ) ; if ( sk -> sk_shutdown & RCV_SHUTDOWN ) return 0 ; return err ; } rlen = skb -> len ; copied = min_t ( unsigned int, rlen, len ) ; cskb = skb ; if ( skb_copy_datagram_iovec ( cskb, 0, msg -> msg_iov, copied ) ) { if (! ( flags & MSG_PEEK ) ) skb_queue_head ( & sk -> sk_receive_queue, skb ) ; return - EFAULT ; } sock_recv_timestamp ( msg, sk, skb ) ; if ( sk -> sk_type == SOCK_DGRAM && msg -> msg_name ) { struct nfc_llcp_ui_cb * ui_cb = nfc_llcp_ui_skb_cb ( skb ) ; struct sockaddr_nfc_llcp * sockaddr = ( struct sockaddr_nfc_llcp * ) msg -> msg_name ; msg -> msg_namelen = sizeof ( struct sockaddr_nfc_llcp ) ; pr_debug ( "Datagram   socket   %d   %d\\n",

Fix:
<S2SV_ModStart>, len ) ; msg -> msg_namelen = 0 <S2SV_ModStart> ssap ) ; memset ( sockaddr, 0, sizeof ( * sockaddr ) ) ;
Buggy code:
 static int http_buf_read ( URLContext * h, uint8_t * buf, int size ) { HTTPContext * s = h -> priv_data ; int len ; len = s -> buf_end - s -> buf_ptr ; if ( len > 0 ) { if ( len > size ) len = size ; memcpy ( buf, s -> buf_ptr, len ) ; s -> buf_ptr += len ; } else { <START_BUG> int64_t target_end = s -> end_off? s -> end_off : s -> filesize ; <END_BUG>  if ( (! s -> willclose || s -> chunksize < 0 ) && <START_BUG> target_end >= 0 && s -> off >= target_end ) return AVERROR_EOF ; len = ffurl_read ( s -> hd, buf, size ) ; <END_BUG> if (! len && (! s -> willclose || s -> chunksize < 0 ) &&  target_end >= 0 && s -> off < target_end ) { av_log ( h, AV_LOG_ERROR, <START_BUG> "Stream   ends   prematurely   at   %" PRId64 ",   should   be   %" PRId64 "\\n", <END_BUG> s -> off, target_end ) ; return AVERROR ( EIO ) ; } } if ( len > 0 ) { s -> off += len ; if ( s -> chunksize > 0 ) s -> chunksize -= len ; } return len ; }

Fix:
<S2SV_ModStart> } else { uint64_t <S2SV_ModEnd> target_end = s <S2SV_ModStart> s -> chunksize == UINT64_MAX ) <S2SV_ModEnd> && s -> <S2SV_ModStart> s -> chunksize == UINT64_MAX ) && s -> off < <S2SV_ModEnd> target_end ) { <S2SV_ModStart> AV_LOG_ERROR, "Stream <S2SV_blank> ends <S2SV_blank> prematurely <S2SV_blank> at <S2SV_blank> %" PRIu64 ", <S2SV_blank> should <S2SV_blank> be <S2SV_blank> %" PRIu64 <S2SV_ModEnd> "\\n", s
Buggy code:
 static ssize_t _consolefs_write ( oe_fd_t * file_, const void * buf, size_t count ) { ssize_t ret = - 1 ; file_t * file = _cast_file ( file_ ) ; <START_BUG> if (! file ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( oe_syscall_write_ocall ( & ret, file -> host_fd, buf, count )!= OE_OK ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> (! file || count > OE_SSIZE_MAX <S2SV_ModStart> OE_EINVAL ) ; if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 static const u_char * ikev1_nonce_print ( netdissect_options * ndo, u_char tpay _U_, const struct isakmp_gen * ext, u_int item_len _U_, const u_char * ep, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { struct isakmp_gen e ; ND_PRINT ( ( ndo, "%s:", NPSTR ( ISAKMP_NPTYPE_NONCE ) ) ) ; ND_TCHECK ( * ext ) ; UNALIGNED_MEMCPY ( & e, ext, sizeof ( e ) ) ; <START_BUG> ND_PRINT ( ( ndo, "   n   len=%d", ntohs ( e. len ) - 4 ) ) ; <END_BUG>  if ( 2 < ndo -> ndo_vflag && 4 < ntohs ( e. len ) ) { <START_BUG> ND_PRINT ( ( ndo, "   " ) ) ; if (! rawprint ( ndo, ( const uint8_t * ) ( ext + 1 ), ntohs ( e. len ) - 4 ) ) goto trunc ; <END_BUG> } else if ( 1 < ndo -> ndo_vflag && 4 < ntohs ( e. len ) ) {  ND_PRINT ( ( ndo, "   " ) ) ; <START_BUG> if (! ike_show_somedata ( ndo, ( const u_char * ) ( const uint8_t * ) ( ext + 1 ), ep ) ) <END_BUG> goto trunc ; }  return ( const u_char * ) ext + ntohs ( e. len ) ; <START_BUG> trunc : ND_PRINT ( ( ndo, "   [|%s]", NPSTR ( ISAKMP_NPTYPE_NONCE ) ) ) ; return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> ( ndo, " <S2SV_blank> n <S2SV_blank> len=%u" <S2SV_ModEnd>, ntohs ( <S2SV_ModStart> ; if ( ntohs ( e. len ) > 4 ) { if ( <S2SV_ModEnd> ndo -> ndo_vflag <S2SV_ModStart> ndo -> ndo_vflag > 2 <S2SV_ModEnd> ) { ND_PRINT <S2SV_ModStart> else if ( <S2SV_ModEnd> ndo -> ndo_vflag <S2SV_ModStart> ndo -> ndo_vflag > 1 <S2SV_ModEnd> ) { ND_PRINT <S2SV_ModStart> * ) ( <S2SV_ModEnd> ext + 1 <S2SV_ModStart> trunc ; } }
Buggy code:
 static int tcpmss_mangle_packet ( struct sk_buff * skb, const struct xt_action_param * par, unsigned int family, unsigned int tcphoff, unsigned int minlen ) { const struct xt_tcpmss_info * info = par -> targinfo ; struct tcphdr * tcph ; int len, tcp_hdrlen ; unsigned int i ; __be16 oldval ; u16 newmss ; u8 * opt ; if ( par -> fragoff!= 0 ) return 0 ; if (! skb_make_writable ( skb, skb -> len ) ) return - 1 ; len = skb -> len - tcphoff ; if ( len < ( int ) sizeof ( struct tcphdr ) ) return - 1 ; tcph = ( struct tcphdr * ) ( skb_network_header ( skb ) + tcphoff ) ; tcp_hdrlen = tcph -> doff * 4 ; <START_BUG> if ( len < tcp_hdrlen ) <END_BUG> return - 1 ; if ( info -> mss == XT_TCPMSS_CLAMP_PMTU ) { struct net * net = xt_net ( par ) ; unsigned int in_mtu = tcpmss_reverse_mtu ( net, skb, family ) ; unsigned int min_mtu = min ( dst_mtu ( skb_dst ( skb ) ), in_mtu ) ; if ( min_mtu <= minlen ) { net_err_ratelimited ( "unknown   or   invalid   path-MTU   (%u)\\n", min_mtu ) ; return - 1 ; } newmss = min_mtu - minlen ; } else newmss = info -> mss ; opt = ( u_int8_t * ) tcph ; for ( i = sizeof ( struct tcphdr ) ; i <= tcp_hdrlen - TCPOLEN_MSS ; i += optlen ( opt, i ) ) { if ( opt [ i ] == TCPOPT_MSS && opt [ i + 1 ] == TCPOLEN_MSS ) { u_int16_t oldmss ; oldmss = ( opt [ i + 2 ] << 8 ) | opt [ i + 3 ] ; if ( oldmss <= newmss )

Fix:
<S2SV_ModStart> len < tcp_hdrlen || tcp_hdrlen < sizeof ( struct tcphdr ) <S2SV_ModStart> ; if ( tcp_hdrlen >= 15 * 4 ) return 0 ; if (
Buggy code:
 static int snd_hrtimer_start ( struct snd_timer * t ) { struct snd_hrtimer * stime = t -> private_data ; atomic_set ( & stime -> running, 0 ) ; <START_BUG> hrtimer_cancel ( & stime -> hrt ) ; <END_BUG> hrtimer_start ( & stime -> hrt, ns_to_ktime ( t -> sticks * resolution ), HRTIMER_MODE_REL ) ; atomic_set ( & stime -> running, 1 ) ; return 0 ; }

Fix:
<S2SV_ModStart> 0 ) ; hrtimer_try_to_cancel <S2SV_ModEnd> ( & stime
Buggy code:
 static int dccp_error ( struct net * net, struct nf_conn * tmpl, struct sk_buff * skb, unsigned int dataoff, enum ip_conntrack_info * ctinfo, u_int8_t pf, unsigned int hooknum ) { struct dccp_hdr _dh, * dh ; unsigned int dccp_len = skb -> len - dataoff ; unsigned int cscov ; const char * msg ; <START_BUG> dh = skb_header_pointer ( skb, dataoff, sizeof ( _dh ), & dh ) ; <END_BUG> if ( dh == NULL ) { msg = "nf_ct_dccp:   short   packet   " ; goto out_invalid ; } if ( dh -> dccph_doff * 4 < sizeof ( struct dccp_hdr ) || dh -> dccph_doff * 4 > dccp_len ) { msg = "nf_ct_dccp:   truncated//malformed   packet   " ; goto out_invalid ; } cscov = dccp_len ; if ( dh -> dccph_cscov ) { cscov = ( dh -> dccph_cscov - 1 ) * 4 ; if ( cscov > dccp_len ) { msg = "nf_ct_dccp:   bad   checksum   coverage   " ; goto out_invalid ; } } if ( net -> ct. sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && nf_checksum_partial ( skb, hooknum, dataoff, cscov, IPPROTO_DCCP, pf ) ) { msg = "nf_ct_dccp:   bad   checksum   " ; goto out_invalid ; } if ( dh -> dccph_type >= DCCP_PKT_INVALID ) { msg = "nf_ct_dccp:   reserved   packet   type   " ; goto out_invalid ; } return NF_ACCEPT ; out_invalid : if ( LOG_INVALID ( net, IPPROTO_DCCP ) ) nf_log_packet ( net, pf, 0, skb, NULL, NULL, NULL, "%s", msg ) ; return - NF_ACCEPT ; }

Fix:
<S2SV_ModStart> ), & _dh <S2SV_ModEnd> ) ; if
Buggy code:
 int ocfs2_setattr ( struct dentry * dentry, struct iattr * attr ) { int status = 0, size_change ; int inode_locked = 0 ; struct inode * inode = d_inode ( dentry ) ; struct super_block * sb = inode -> i_sb ; struct ocfs2_super * osb = OCFS2_SB ( sb ) ; struct buffer_head * bh = NULL ; handle_t * handle = NULL ; struct dquot * transfer_to [ MAXQUOTAS ] = { } ; int qtype ; int had_lock ; struct ocfs2_lock_holder oh ; trace_ocfs2_setattr ( inode, dentry, ( unsigned long long ) OCFS2_I ( inode ) -> ip_blkno, dentry -> d_name. len, dentry -> d_name. name, attr -> ia_valid, attr -> ia_mode, from_kuid ( & init_user_ns, attr -> ia_uid ), from_kgid ( & init_user_ns, attr -> ia_gid ) ) ; if ( S_ISLNK ( inode -> i_mode ) ) attr -> ia_valid &= ~ ATTR_SIZE ; # define OCFS2_VALID_ATTRS ( ATTR_ATIME | ATTR_MTIME | ATTR_CTIME | ATTR_SIZE | ATTR_GID | ATTR_UID | ATTR_MODE ) if (! ( attr -> ia_valid & OCFS2_VALID_ATTRS ) ) return 0 ; status = setattr_prepare ( dentry, attr ) ; if ( status ) return status ; if ( is_quota_modification ( inode, attr ) ) { status = dquot_initialize ( inode ) ; if ( status ) return status ; } size_change = S_ISREG ( inode -> i_mode ) && attr -> ia_valid & ATTR_SIZE ; if ( size_change ) { <START_BUG> status = ocfs2_rw_lock ( inode, 1 ) ; <END_BUG> if ( status < 0 ) { mlog_errno ( status ) ; goto bail ; } } had_lock = ocfs2_inode_lock_tracker ( inode, & bh, 1, & oh ) ; if ( had_lock < 0 ) { status = had_lock ; goto bail_unlock_rw ; } else

Fix:
<S2SV_ModStart> size_change ) { inode_dio_wait ( inode ) ; <S2SV_ModStart> ) goto bail_unlock <S2SV_ModEnd> ; if (
Buggy code:
 static jas_image_cmpt_t * jas_image_cmpt_create ( int_fast32_t tlx, int_fast32_t tly, int_fast32_t hstep, int_fast32_t vstep, int_fast32_t width, int_fast32_t height, uint_fast16_t depth, bool sgnd, uint_fast32_t inmem ) { jas_image_cmpt_t * cmpt ; size_t size ; cmpt = 0 ; if ( width < 0 || height < 0 || hstep <= 0 || vstep <= 0 ) { goto error ; } if (! jas_safe_intfast32_add ( tlx, width, 0 ) ||! jas_safe_intfast32_add ( tly, height, 0 ) ) { goto error ; } if (! ( cmpt = jas_malloc ( sizeof ( jas_image_cmpt_t ) ) ) ) { goto error ; } cmpt -> type_ = JAS_IMAGE_CT_UNKNOWN ; cmpt -> tlx_ = tlx ; cmpt -> tly_ = tly ; cmpt -> hstep_ = hstep ; cmpt -> vstep_ = vstep ; cmpt -> width_ = width ; cmpt -> height_ = height ; cmpt -> prec_ = depth ; cmpt -> sgnd_ = sgnd ; cmpt -> stream_ = 0 ; cmpt -> cps_ = ( depth + 7 ) // 8 ; if (! jas_safe_size_mul ( cmpt -> width_, cmpt -> height_, & size ) ||! jas_safe_size_mul ( size, cmpt -> cps_, & size ) ) { goto error ; } <START_BUG> cmpt -> stream_ = ( inmem )? jas_stream_memopen ( 0, size ) : <END_BUG> jas_stream_tmpfile ( ) ; if (! cmpt -> stream_ ) { goto error ; } if ( jas_stream_seek ( cmpt -> stream_, size - 1, SEEK_SET ) < 0 || jas_stream_putc ( cmpt -> stream_, 0 ) == EOF || jas_stream_seek ( cmpt -> stream_, 0, SEEK_

Fix:
<S2SV_ModStart> inmem )? jas_stream_memopen2 <S2SV_ModEnd> ( 0,
Buggy code:
 void luaD_call ( lua_State * L, StkId func, int nresults ) { lua_CFunction f ; retry : switch ( ttypetag ( s2v ( func ) ) ) { case LUA_VCCL : f = clCvalue ( s2v ( func ) ) -> f ; goto Cfunc ; case LUA_VLCF : f = fvalue ( s2v ( func ) ) ; Cfunc : { int n ; <START_BUG> CallInfo * ci = next_ci ( L ) ; <END_BUG> checkstackp ( L, LUA_MINSTACK, func ) ; ci -> nresults = nresults ; ci -> callstatus = CIST_C ; ci -> top = L -> top + LUA_MINSTACK ;  ci -> func = func ; <START_BUG> L -> ci = ci ; lua_assert ( ci -> top <= L -> stack_last ) ; if ( L -> hookmask & LUA_MASKCALL ) { int narg = cast_int ( L -> top - func ) - 1 ; luaD_hook ( L, LUA_HOOKCALL, - 1, 1, narg ) ; } lua_unlock ( L ) ; n = ( * f ) ( L ) ; lua_lock ( L ) ; api_checknelems ( L, n ) ; luaD_poscall ( L, ci, n ) ; break ; } case LUA_VLCL : { <END_BUG> CallInfo * ci = next_ci ( L ) ;  Proto * p = clLvalue ( s2v ( func ) ) -> p ; int narg = cast_int ( L -> top - func ) - 1 ; int nfixparams = p -> numparams ; int fsize = p -> maxstacksize ; <START_BUG> checkstackp ( L, fsize, func ) ; <END_BUG> ci -> nresults = nresults ; ci -> u. l. savedpc = p -> code ; ci -> callstatus = 0 ; ci -> top = func + 1 + fsize ; ci -> func = func ; L -> ci = ci ; for ( ; narg < nfixparams ; narg ++ ) setnilvalue ( s2v ( L -> top ++ ) ) ; lua_assert ( ci -> top <= L -> stack_last ) ; luaV_execute ( L, ci ) ; break ; } default : {  checkstackp ( L

Fix:
<S2SV_ModStart> CallInfo * ci ; checkstackGCp ( L, LUA_MINSTACK, func ) ; L -> ci = ci <S2SV_ModStart> next_ci ( L <S2SV_ModEnd> ) ; ci <S2SV_ModStart> func = func <S2SV_ModEnd> ; lua_assert ( <S2SV_ModStart> CallInfo * ci <S2SV_ModEnd> ; Proto * <S2SV_ModStart> -> maxstacksize ; checkstackGCp <S2SV_ModEnd> ( L, <S2SV_ModStart> fsize, func ) ; L -> ci = ci = next_ci ( L <S2SV_ModStart> default : { checkstackGCp <S2SV_ModEnd> ( L,
Buggy code:
 static int efx_ethtool_set_ringparam ( struct net_device * net_dev, struct ethtool_ringparam * ring ) { <START_BUG> struct efx_nic * efx = netdev_priv ( net_dev ) ; <END_BUG> if ( ring -> rx_mini_pending || ring -> rx_jumbo_pending || ring -> rx_pending > EFX_MAX_DMAQ_SIZE || ring -> tx_pending > EFX_MAX_DMAQ_SIZE ) return - EINVAL ;  if ( ring -> rx_pending < EFX_MIN_RING_SIZE || <START_BUG> ring -> tx_pending < EFX_MIN_RING_SIZE ) { netif_err ( efx, drv, efx -> net_dev, <END_BUG> "TX   and   RX   queues   cannot   be   smaller   than   %ld\\n",  EFX_MIN_RING_SIZE ) ; return - EINVAL ; } <START_BUG> return efx_realloc_channels ( efx, ring -> rx_pending, ring -> tx_pending ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( net_dev ) ; u32 txq_entries <S2SV_ModStart> -> rx_pending < EFX_RXQ_MIN_ENT <S2SV_ModEnd> ) { netif_err <S2SV_ModStart> -> net_dev, "RX <S2SV_blank> queues <S2SV_blank> cannot <S2SV_blank> be <S2SV_blank> smaller <S2SV_blank> than <S2SV_blank> %u\\n", EFX_RXQ_MIN_ENT <S2SV_ModEnd> ) ; return <S2SV_ModStart> EINVAL ; } txq_entries = max ( ring -> tx_pending, EFX_TXQ_MIN_ENT ( efx ) ) ; if ( txq_entries!= ring -> tx_pending ) netif_warn ( efx, drv, efx -> net_dev, "increasing <S2SV_blank> TX <S2SV_blank> queue <S2SV_blank> size <S2SV_blank> to <S2SV_blank> minimum <S2SV_blank> of <S2SV_blank> %u\\n", txq_entries ) ; <S2SV_ModStart> -> rx_pending, txq_entries <S2SV_ModEnd> ) ; }
Buggy code:
 generic_ret * setkey_principal_2_svc ( setkey_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_SETKEY, arg -> princ, NULL ) ) { ret. code = kadm5_setkey_principal ( ( void * ) handle, arg -> princ, arg -> keyblocks, arg -> n_keys ) ; } else { log_unauth ( "kadm5_setkey_principal", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_SETKEY ; } if ( ret. code!= KADM5_AUTH_SETKEY ) { if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_setkey_principal", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; } free ( prime

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 <START_BUG> static void nsc_decode ( NSC_CONTEXT * context ) <END_BUG> { UINT16 x ; UINT16 y ;  UINT16 rw = ROUND_UP_TO ( context -> width, 8 ) ; <START_BUG> <END_BUG> BYTE shift = context -> ColorLossLevel - 1 ;  <START_BUG> BYTE * bmpdata = context -> BitmapData ; <END_BUG> for ( y = 0 ; y < context -> height ; y ++ ) { const BYTE * yplane ; const BYTE * coplane ; const BYTE * cgplane ; const BYTE * aplane = context -> priv -> PlaneBuffers [ 3 ] + y * context -> width ; if ( context -> ChromaSubsamplingLevel ) { yplane = context -> priv -> PlaneBuffers [ 0 ] + y * rw ; coplane = context -> priv -> PlaneBuffers [ 1 ] + ( y >> 1 ) * ( rw >> 1 ) ; cgplane = context -> priv -> PlaneBuffers [ 2 ] + ( y >> 1 ) * ( rw >> 1 ) ; } else { yplane = context -> priv -> PlaneBuffers [ 0 ] + y * context -> width ; coplane = context -> priv -> PlaneBuffers [ 1 ] + y * context -> width ; cgplane = context -> priv -> PlaneBuffers [ 2 ] + y * context -> width ; } for ( x = 0 ; x < context -> width ; x ++ ) { INT16 y_val = ( INT16 ) * yplane ; INT16 co_val = ( INT16 ) ( INT8 ) ( * coplane << shift ) ; INT16 cg_val = ( INT16 ) ( INT8 ) ( * cgplane << shift ) ; INT16 r_val = y_val + co_val - cg_val ; INT16 g_val = y_val + cg_val ; INT16 b_val = y_val - co_val - cg_val ;  * bmpdata ++ = MINMAX ( b_val, 0, 0xFF ) ; <START_BUG> * bmpdata ++ = MINMAX ( g_val, 0, 0xFF ) ; * bmpdata ++ = MINMAX ( r_val, 0, 0xFF ) ; * bmpdata ++ = * aplane ; yplane ++ ; coplane += ( context -> ChromaSubsamplingLevel? x % 2 : 1 ) ; cgplane += ( context -> ChromaSubsamplingLevel? x<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> nsc_decode ( NSC_CONTEXT <S2SV_ModStart> ; UINT16 rw ; BYTE shift ; BYTE * bmpdata ; size_t pos = 0 ; if (! context ) return FALSE ; rw <S2SV_ModStart> 8 ) ; <S2SV_ModEnd> shift = context <S2SV_ModStart> - 1 ; <S2SV_ModEnd> bmpdata = context <S2SV_ModStart> context -> BitmapData ; if (! bmpdata ) return FALSE <S2SV_ModStart> - cg_val ; if ( pos + 4 > context -> BitmapDataLength ) return FALSE ; pos += 4 ; <S2SV_ModStart> ; } } return TRUE ;
Buggy code:
 static int put_chars ( u32 vtermno, const char * buf, int count ) { struct port * port ; <START_BUG> struct scatterlist sg [ 1 ] ; <END_BUG> if ( unlikely ( early_put_chars ) ) return early_put_chars ( vtermno, buf, count ) ; port = find_port_by_vtermno ( vtermno ) ; if (! port ) return - EPIPE ;  sg_init_one ( sg, buf, count ) ; <START_BUG> <END_BUG> return __send_to_port ( port, sg, 1, count, ( void * ) buf, false ) ;  <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> [ 1 ] ; void * data ; int ret <S2SV_ModStart> - EPIPE ; data = kmemdup ( buf, count, GFP_ATOMIC ) ; if (! data ) return - ENOMEM ; <S2SV_ModStart> ( sg, data <S2SV_ModEnd>, count ) <S2SV_ModStart> count ) ; ret = <S2SV_ModEnd> __send_to_port ( port <S2SV_ModStart>, count, data <S2SV_ModEnd>, false ) <S2SV_ModStart> false ) ; kfree ( data ) ; return ret ;
Buggy code:
 static void bond_setup ( struct net_device * bond_dev ) { struct bonding * bond = netdev_priv ( bond_dev ) ; rwlock_init ( & bond -> lock ) ; rwlock_init ( & bond -> curr_slave_lock ) ; bond -> params = bonding_defaults ; bond -> dev = bond_dev ; INIT_LIST_HEAD ( & bond -> vlan_list ) ; ether_setup ( bond_dev ) ; bond_dev -> netdev_ops = & bond_netdev_ops ; bond_dev -> ethtool_ops = & bond_ethtool_ops ; bond_set_mode_ops ( bond, bond -> params. mode ) ; bond_dev -> destructor = bond_destructor ; bond_dev -> tx_queue_len = 0 ; bond_dev -> flags |= IFF_MASTER | IFF_MULTICAST ; bond_dev -> priv_flags |= IFF_BONDING ; <START_BUG> bond_dev -> priv_flags &= ~ IFF_XMIT_DST_RELEASE ; <END_BUG> bond_dev -> features |= NETIF_F_VLAN_CHALLENGED ; bond_dev -> features |= NETIF_F_LLTX ; bond_dev -> hw_features = BOND_VLAN_FEATURES | NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_FILTER ; bond_dev -> hw_features &= ~ ( NETIF_F_ALL_CSUM & ~ NETIF_F_NO_CSUM ) ; bond_dev -> features |= bond_dev -> hw_features ; }

Fix:
<S2SV_ModStart> priv_flags &= ~ ( IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING ) <S2SV_ModEnd> ; bond_dev ->
Buggy code:
 static int mwifiex_pcie_init_evt_ring ( struct mwifiex_adapter * adapter ) { struct pcie_service_card * card = adapter -> card ; struct mwifiex_evt_buf_desc * desc ; struct sk_buff * skb ; dma_addr_t buf_pa ; int i ; for ( i = 0 ; i < MWIFIEX_MAX_EVT_BD ; i ++ ) { skb = dev_alloc_skb ( MAX_EVENT_SIZE ) ; if (! skb ) { mwifiex_dbg ( adapter, ERROR, "Unable   to   allocate   skb   for   EVENT   buf.\\n" ) ; kfree ( card -> evtbd_ring_vbase ) ; return - ENOMEM ; } skb_put ( skb, MAX_EVENT_SIZE ) ; if ( mwifiex_map_pci_memory ( adapter, skb, MAX_EVENT_SIZE, <START_BUG> PCI_DMA_FROMDEVICE ) ) <END_BUG> return - 1 ;  buf_pa = MWIFIEX_SKB_DMA_ADDR ( skb ) ; <START_BUG> mwifiex_dbg ( adapter, EVENT, "info:   EVT   ring:   skb=%p   len=%d   data=%p   buf_pa=%#x:%x\\n", skb, skb -> len, skb -> data, ( u32 ) buf_pa, ( u32 ) ( ( u64 ) buf_pa >> 32 ) ) ; card -> evt_buf_list [ i ] = skb ; card -> evtbd_ring [ i ] = ( void * ) ( card -> evtbd_ring_vbase + ( sizeof ( * desc ) * i ) ) ; desc = card -> evtbd_ring [ i ] ; desc -> paddr = buf_pa ; desc -> len = ( u16 ) skb -> len ; desc -> flags = 0 ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> PCI_DMA_FROMDEVICE ) ) { kfree_skb ( skb ) ; kfree ( card -> evtbd_ring_vbase ) ; <S2SV_ModStart> - 1 ; }
Buggy code:
 int perf_output_begin ( struct perf_output_handle * handle, struct perf_event * event, unsigned int size, <START_BUG> int nmi, int sample ) <END_BUG> { struct ring_buffer * rb ; unsigned long tail, offset, head ; int have_lost ; struct perf_sample_data sample_data ; struct { struct perf_event_header header ; u64 id ; u64 lost ; } lost_event ; rcu_read_lock ( ) ; if ( event -> parent ) event = event -> parent ; rb = rcu_dereference ( event -> rb ) ; if (! rb ) goto out ; handle -> rb = rb ; handle -> event = event ;  handle -> nmi = nmi ; <START_BUG> handle -> sample = sample ; if (! rb -> nr_pages ) goto out ; have_lost = local_read ( & rb -> lost ) ; if ( have_lost ) { lost_event. header. size = sizeof ( lost_event ) ; perf_event_header__init_id ( & lost_event. header, & sample_data, event ) ; size += lost_event. header. size ; } perf_output_get_handle ( handle ) ; do { tail = ACCESS_ONCE ( rb -> user_page -> data_tail ) ; smp_rmb ( ) ; offset = head = local_read ( & rb -> head ) ; head += size ; if ( unlikely (! perf_output_space ( rb, tail, offset, head ) ) ) goto fail ; } while ( local_cmpxchg ( & rb -> head, offset, head )!= offset ) ; if ( head - local_read ( & rb -> wakeup ) > rb -> watermark ) local_add ( rb -> watermark, & rb -> wakeup ) ; handle -> page = offset >> ( PAGE_SHIFT + page_order ( rb ) ) ; handle -> page &= rb -> nr_pages - 1 ; handle -> size = offset & ( ( PAGE_SIZE << page_order ( rb ) ) - 1 ) ; handle -> addr = rb -> data_pages [ handle -> page ] ; handle -> addr += handle -> size ; handle -> size = ( PAGE_SIZE << page_order ( rb ) ) - handle -> size ; if ( have_lost ) { lost_event. header. type = PERF_RECORD_LO<END_BUG>

Fix:
<S2SV_ModStart> size, int <S2SV_ModEnd> sample ) { <S2SV_ModStart> ; handle -> <S2SV_ModEnd> sample = sample
Buggy code:
 static int ext2_fill_super ( struct super_block * sb, void * data, int silent ) { struct buffer_head * bh ; struct ext2_sb_info * sbi ; struct ext2_super_block * es ; struct inode * root ; unsigned long block ; unsigned long sb_block = get_sb_block ( & data ) ; unsigned long logic_sb_block ; unsigned long offset = 0 ; unsigned long def_mount_opts ; long ret = - EINVAL ; int blocksize = BLOCK_SIZE ; int db_count ; int i, j ; __le32 features ; int err ; err = - ENOMEM ; sbi = kzalloc ( sizeof ( * sbi ), GFP_KERNEL ) ; if (! sbi ) goto failed ; sbi -> s_blockgroup_lock = kzalloc ( sizeof ( struct blockgroup_lock ), GFP_KERNEL ) ; if (! sbi -> s_blockgroup_lock ) { kfree ( sbi ) ; goto failed ; } sb -> s_fs_info = sbi ; sbi -> s_sb_block = sb_block ; spin_lock_init ( & sbi -> s_lock ) ; blocksize = sb_min_blocksize ( sb, BLOCK_SIZE ) ; if (! blocksize ) { ext2_msg ( sb, KERN_ERR, "error:   unable   to   set   blocksize" ) ; goto failed_sbi ; } if ( blocksize!= BLOCK_SIZE ) { logic_sb_block = ( sb_block * BLOCK_SIZE ) // blocksize ; offset = ( sb_block * BLOCK_SIZE ) % blocksize ; } else { logic_sb_block = sb_block ; } if (! ( bh = sb_bread ( sb, logic_sb_block ) ) ) { ext2_msg ( sb, KERN_ERR, "error:   unable   to   read   superblock" ) ; goto failed_sbi ; } es = ( struct ext2_super_block * ) ( ( ( char * ) bh -> b_data ) + offset ) ; sbi -> s_es = es ; sb -> s_magic = le16_to_cpu ( es -> s_magic ) ; if ( sb -> s_magic!= EXT2_SUPER_MAGIC

Fix:
<S2SV_ModStart> failed_mount3 ; } # ifdef CONFIG_EXT2_FS_XATTR sbi -> s_mb_cache = ext2_xattr_create_cache ( ) ; if (! sbi -> s_mb_cache ) { ext2_msg ( sb, KERN_ERR, "Failed <S2SV_blank> to <S2SV_blank> create <S2SV_blank> an <S2SV_blank> mb_cache" ) ; goto failed_mount3 ; } # endif <S2SV_ModStart> ; failed_mount3 : if ( sbi -> s_mb_cache ) ext2_xattr_destroy_cache ( sbi -> s_mb_cache ) ;
Buggy code:
 static void setup_format_params ( int track ) { int n ; int il ; int count ; int head_shift ; int track_shift ; struct fparm { unsigned char track, head, sect, size ; } * here = ( struct fparm * ) floppy_track_buffer ; raw_cmd = & default_raw_cmd ; raw_cmd -> track = track ; raw_cmd -> flags = ( FD_RAW_WRITE | FD_RAW_INTR | FD_RAW_SPIN | FD_RAW_NEED_DISK | FD_RAW_NEED_SEEK ) ; raw_cmd -> rate = _floppy -> rate & 0x43 ; raw_cmd -> cmd_count = NR_F ; COMMAND = FM_MODE ( _floppy, FD_FORMAT ) ; DR_SELECT = UNIT ( current_drive ) + PH_HEAD ( _floppy, format_req. head ) ; F_SIZECODE = FD_SIZECODE ( _floppy ) ; F_SECT_PER_TRACK = _floppy -> sect << 2 >> F_SIZECODE ; F_GAP = _floppy -> fmt_gap ; F_FILL = FD_FILL_BYTE ; raw_cmd -> kernel_data = floppy_track_buffer ; raw_cmd -> length = 4 * F_SECT_PER_TRACK ; <START_BUG> head_shift = ( F_SECT_PER_TRACK + 5 ) // 6 ; <END_BUG> track_shift = 2 * head_shift + 3 ; n = ( track_shift * format_req. track + head_shift * format_req. head ) % F_SECT_PER_TRACK ; il = 1 ; if ( _floppy -> fmt_gap < 0x22 ) il ++ ; for ( count = 0 ; count < F_SECT_PER_TRACK ; ++ count ) { here [ count ]. track = format_req. track ; here [ count ]. head = format_req. head ; here [ count ]. sect = 0 ; here [ count ]. size = F_SIZECODE ; } for ( count = 1 ; count <= F_SECT_PER_TRACK ; ++ count ) { here [ n ]. sect = count ; n = ( n + il ) %

Fix:
<S2SV_ModStart> * F_SECT_PER_TRACK ; if (! F_SECT_PER_TRACK ) return ;
Buggy code:
 static int cg_opendir ( const char * path, struct fuse_file_info * fi ) { struct fuse_context * fc = fuse_get_context ( ) ; const char * cgroup ; struct file_info * dir_info ; char * controller = NULL ; if (! fc ) return - EIO ; if ( strcmp ( path, "//cgroup" ) == 0 ) { cgroup = NULL ; controller = NULL ; } else { controller = pick_controller_from_path ( fc, path ) ; if (! controller ) return - EIO ; cgroup = find_cgroup_in_path ( path ) ; if (! cgroup ) { cgroup = "//" ; } } <START_BUG> if ( cgroup &&! fc_may_access ( fc, controller, cgroup, NULL, O_RDONLY ) ) { <END_BUG> return - EACCES ; } dir_info = malloc ( sizeof ( * dir_info ) ) ; if (! dir_info ) return - ENOMEM ; dir_info -> controller = must_copy_string ( controller ) ; dir_info -> cgroup = must_copy_string ( cgroup ) ; dir_info -> type = LXC_TYPE_CGDIR ; dir_info -> buf = NULL ; dir_info -> file = NULL ; dir_info -> buflen = 0 ; fi -> fh = ( unsigned long ) dir_info ; return 0 ; }

Fix:
<S2SV_ModStart> if ( cgroup ) { if (! caller_may_see_dir ( fc -> pid, controller, cgroup ) ) return - ENOENT ; if ( <S2SV_ModEnd>! fc_may_access ( <S2SV_ModStart> O_RDONLY ) ) <S2SV_ModEnd> return - EACCES
Buggy code:
 <START_BUG> int open_debug_log ( void ) { <END_BUG> if ( verify_config || test_scheduling == TRUE ) return OK ; if ( debug_level == DEBUGL_NONE ) return OK ;  if ( ( debug_file_fp = fopen ( debug_file, "a+" ) ) == NULL ) <START_BUG> return ERROR ; <END_BUG> ( void ) fcntl ( fileno ( debug_file_fp ), F_SETFD, FD_CLOEXEC ) ;  return OK ; }

Fix:
<S2SV_ModStart> void ) { int fh ; struct stat st ; <S2SV_ModStart> if ( ( fh = open ( debug_file, O_RDWR | O_APPEND | O_CREAT | O_NOFOLLOW, S_IRUSR | S_IWUSR ) ) == - 1 ) return ERROR ; if ( ( debug_file_fp = fdopen ( fh <S2SV_ModEnd>, "a+" ) <S2SV_ModStart> return ERROR ; if ( ( fstat ( fh, & st ) ) == - 1 ) { debug_file_fp = NULL ; close ( fh ) ; return ERROR ; } if ( st. st_nlink!= 1 || ( st. st_mode & S_IFMT )!= S_IFREG ) { debug_file_fp = NULL ; close ( fh ) ; return ERROR ; } <S2SV_ModStart> ) fcntl ( fh <S2SV_ModEnd>, F_SETFD,
Buggy code:
 static int snd_ctl_elem_user_get ( struct snd_kcontrol * kcontrol, struct snd_ctl_elem_value * ucontrol ) { struct user_element * ue = kcontrol -> private_data ; <START_BUG> memcpy ( & ucontrol -> value, ue -> elem_data, ue -> elem_data_size ) ; <END_BUG>  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> -> private_data ; mutex_lock ( & ue -> card -> user_ctl_lock ) ; <S2SV_ModStart> elem_data_size ) ; mutex_unlock ( & ue -> card -> user_ctl_lock ) ;
Buggy code:
 static krb5_error_code get_tag ( const uint8_t * asn1, size_t len, taginfo * tag_out, const uint8_t * * contents_out, size_t * clen_out, <START_BUG> const uint8_t * * remainder_out, size_t * rlen_out ) <END_BUG> { krb5_error_code ret ; uint8_t o ; const uint8_t * c, * p, * tag_start = asn1 ; size_t clen, llen, i ; taginfo t ; * contents_out = * remainder_out = NULL ; * clen_out = * rlen_out = 0 ; if ( len == 0 ) return ASN1_OVERRUN ; o = * asn1 ++ ; len -- ; tag_out -> asn1class = o & 0xC0 ; tag_out -> construction = o & 0x20 ; if ( ( o & 0x1F )!= 0x1F ) { tag_out -> tagnum = o & 0x1F ; } else { tag_out -> tagnum = 0 ; do { if ( len == 0 ) return ASN1_OVERRUN ; o = * asn1 ++ ; len -- ; tag_out -> tagnum = ( tag_out -> tagnum << 7 ) | ( o & 0x7F ) ; } while ( o & 0x80 ) ; } if ( len == 0 ) return ASN1_OVERRUN ; o = * asn1 ++ ; len -- ; if ( o == 0x80 ) { if ( tag_out -> construction!= CONSTRUCTED ) return ASN1_MISMATCH_INDEF ;  p = asn1 ; <START_BUG> while (! ( len >= 2 && p [ 0 ] == 0 && p [ 1 ] == 0 ) ) { <END_BUG> ret = get_tag ( p, len, & t, & c, & clen, & p, & len ) ;  if ( ret ) return ret ; } tag_out -> tag_end_len = 2 ; * contents_out = asn1 ; * clen_out = p - asn1 ; * remainder_out = p + 2 ; * rlen_out = len - 2 ; } else if ( ( o & 0x80 ) == 0 ) { if ( o > len ) return ASN1_OVERRUN ; tag_out ->

Fix:
<S2SV_ModStart> size_t * rlen_out, int recursion <S2SV_ModStart> return ASN1_MISMATCH_INDEF ; if ( recursion >= 32 ) return ASN1_OVERFLOW ; <S2SV_ModStart>, & len, recursion + 1
Buggy code:
 static int caif_seqpkt_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct sk_buff * skb ; int ret ; int copylen ; ret = - EOPNOTSUPP ; if ( m -> msg_flags & MSG_OOB ) <START_BUG> goto read_error ; <END_BUG> m -> msg_namelen = 0 ; skb = skb_recv_datagram ( sk, flags, 0, & ret ) ; if (! skb ) goto read_error ; copylen = skb -> len ; if ( len < copylen ) { m -> msg_flags |= MSG_TRUNC ; copylen = len ; } ret = skb_copy_datagram_iovec ( skb, 0, m -> msg_iov, copylen ) ; if ( ret ) goto out_free ; ret = ( flags & MSG_TRUNC )? skb -> len : copylen ; out_free : skb_free_datagram ( sk, skb ) ; caif_check_flow_release ( sk ) ; return ret ; read_error : return ret ; }

Fix:
<S2SV_ModStart> ) goto read_error <S2SV_ModEnd> ; skb =
Buggy code:
 static int sctp_wait_for_sndbuf ( struct sctp_association * asoc, long * timeo_p, size_t msg_len ) { struct sock * sk = asoc -> base. sk ; int err = 0 ; long current_timeo = * timeo_p ; DEFINE_WAIT ( wait ) ; pr_debug ( "%s:   asoc:%p,   timeo:%ld,   msg_len:%zu\\n", __func__, asoc, * timeo_p, msg_len ) ; sctp_association_hold ( asoc ) ; for ( ; ; ) { prepare_to_wait_exclusive ( & asoc -> wait, & wait, TASK_INTERRUPTIBLE ) ; if (! * timeo_p ) goto do_nonblock ; if ( sk -> sk_err || asoc -> state >= SCTP_STATE_SHUTDOWN_PENDING || asoc -> base. dead ) goto do_error ; if ( signal_pending ( current ) ) goto do_interrupted ; if ( msg_len <= sctp_wspace ( asoc ) ) break ; release_sock ( sk ) ; current_timeo = schedule_timeout ( current_timeo ) ; <START_BUG> BUG_ON ( sk!= asoc -> base. sk ) ; <END_BUG> lock_sock ( sk ) ; * timeo_p = current_timeo ; } out : finish_wait ( & asoc -> wait, & wait ) ; sctp_association_put ( asoc ) ; return err ; do_error : err = - EPIPE ; goto out ; do_interrupted : err = sock_intr_errno ( * timeo_p ) ; goto out ; do_nonblock : err = - EAGAIN ; goto out ; }

Fix:
<S2SV_ModStart> current_timeo ) ; if <S2SV_ModEnd> ( sk!= <S2SV_ModStart>. sk ) goto do_error
Buggy code:
 int v3d_submit_cl_ioctl ( struct drm_device * dev, void * data, struct drm_file * file_priv ) { struct v3d_dev * v3d = to_v3d_dev ( dev ) ; struct v3d_file_priv * v3d_priv = file_priv -> driver_priv ; struct drm_v3d_submit_cl * args = data ; struct v3d_bin_job * bin = NULL ; struct v3d_render_job * render ; struct ww_acquire_ctx acquire_ctx ; int ret = 0 ; trace_v3d_submit_cl_ioctl ( & v3d -> drm, args -> rcl_start, args -> rcl_end ) ; if ( args -> pad!= 0 ) { DRM_INFO ( "pad   must   be   zero:   %d\\n", args -> pad ) ; return - EINVAL ; } render = kcalloc ( 1, sizeof ( * render ), GFP_KERNEL ) ; if (! render ) return - ENOMEM ; render -> start = args -> rcl_start ; render -> end = args -> rcl_end ; INIT_LIST_HEAD ( & render -> unref_list ) ; ret = v3d_job_init ( v3d, file_priv, & render -> base, v3d_render_job_free, args -> in_sync_rcl ) ; if ( ret ) { kfree ( render ) ; return ret ; } if ( args -> bcl_start!= args -> bcl_end ) { bin = kcalloc ( 1, sizeof ( * bin ), GFP_KERNEL ) ; <START_BUG> if (! bin ) <END_BUG> return - ENOMEM ;  ret = v3d_job_init ( v3d, file_priv, & bin -> base, <START_BUG> v3d_job_free, args -> in_sync_bcl ) ; if ( ret ) { <END_BUG> v3d_job_put ( & render -> base ) ;  return ret ; } bin -> start = args -> bcl_start ; bin -> end = args -> bcl_end ; bin -> qma = args -> qma ; bin -> qms = args -> qms ; bin -> qts

Fix:
<S2SV_ModStart>! bin ) { v3d_job_put ( & render -> base ) ; <S2SV_ModStart> - ENOMEM ; } <S2SV_ModStart> render -> base ) ; kfree ( bin
Buggy code:
 static int __sock_diag_rcv_msg ( struct sk_buff * skb, struct nlmsghdr * nlh ) { int err ; struct sock_diag_req * req = nlmsg_data ( nlh ) ; const struct sock_diag_handler * hndl ; if ( nlmsg_len ( nlh ) < sizeof ( * req ) ) return - EINVAL ; <START_BUG> hndl = sock_diag_lock_handler ( req -> sdiag_family ) ; <END_BUG> if ( hndl == NULL ) err = - ENOENT ; else err = hndl -> dump ( skb, nlh ) ; sock_diag_unlock_handler ( hndl ) ; return err ; }

Fix:
<S2SV_ModStart> - EINVAL ; if ( req -> sdiag_family >= AF_MAX ) return - EINVAL ;
Buggy code:
 static inline signed int ReadPropertyMSBLong ( const unsigned char * * p, size_t * length ) { union { unsigned int unsigned_value ; signed int signed_value ; } quantum ; int c ; register ssize_t i ; unsigned char buffer [ 4 ] ; <START_BUG> size_t <END_BUG> value ; if ( * length < 4 ) return ( - 1 ) ; for ( i = 0 ; i < 4 ; i ++ ) { c = ( int ) ( * ( * p ) ++ ) ; ( * length ) -- ; buffer [ i ] = ( unsigned char ) c ; }  value = ( size_t ) ( buffer [ 0 ] << 24 ) ; <START_BUG> <END_BUG> value |= buffer [ 1 ] << 16 ;  <START_BUG> value |= buffer [ 2 ] << 8 ; <END_BUG>  value |= buffer [ 3 ] ; <START_BUG> <END_BUG> quantum. unsigned_value = ( value & 0xffffffff ) ;  return ( quantum. signed_value ) ; }

Fix:
<S2SV_ModStart> 4 ] ; unsigned int <S2SV_ModEnd> value ; if <S2SV_ModStart> value = ( unsigned int ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> ] << 24 <S2SV_ModEnd> ; value |= <S2SV_ModStart> ; value |= ( unsigned int ) <S2SV_ModStart> ; value |= ( unsigned int ) <S2SV_ModStart> ; value |= ( unsigned int ) <S2SV_ModStart>. unsigned_value = <S2SV_ModEnd> value & 0xffffffff <S2SV_ModStart> value & 0xffffffff <S2SV_ModEnd> ; return (
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * buf ) { AVFilterContext * ctx = inlink -> dst ; FPSContext * s = ctx -> priv ; AVFilterLink * outlink = ctx -> outputs [ 0 ] ; int64_t delta ; int i, ret ; s -> frames_in ++ ; if ( s -> pts == AV_NOPTS_VALUE ) { if ( buf -> pts!= AV_NOPTS_VALUE ) { ret = write_to_fifo ( s -> fifo, buf ) ; if ( ret < 0 ) return ret ; if ( s -> start_time!= DBL_MAX && s -> start_time!= AV_NOPTS_VALUE ) { double first_pts = s -> start_time * AV_TIME_BASE ; first_pts = FFMIN ( FFMAX ( first_pts, INT64_MIN ), INT64_MAX ) ; s -> first_pts = s -> pts = av_rescale_q ( first_pts, AV_TIME_BASE_Q, inlink -> time_base ) ; av_log ( ctx, AV_LOG_VERBOSE, "Set   first   pts   to   (in:%" PRId64 "   out:%" PRId64 ")\\n", s -> first_pts, av_rescale_q ( first_pts, AV_TIME_BASE_Q, outlink -> time_base ) ) ; } else { s -> first_pts = s -> pts = buf -> pts ; } } else { av_log ( ctx, AV_LOG_WARNING, "Discarding   initial   frame(s)   with   no   " "timestamp.\\n" ) ; av_frame_free ( & buf ) ; s -> drop ++ ; } return 0 ; } <START_BUG> if ( buf -> pts == AV_NOPTS_VALUE ) { <END_BUG> return write_to_fifo ( s -> fifo, buf ) ; } delta = av_rescale_q_rnd ( buf -> pts - s -> pts, inlink -> time_base, outlink -> time_base, s -> rounding ) ; if ( delta < 1 ) { AVFrame * tmp ; int drop = av_fifo_size ( s -> fifo ) // sizeof ( AVFrame * ) ; av_log ( ctx, AV_LOG

Fix:
<S2SV_ModStart> pts == AV_NOPTS_VALUE || av_fifo_size ( s -> fifo ) <= 0
Buggy code:
 static void xen_netbk_fill_frags ( struct xen_netbk * netbk, struct sk_buff * skb ) { struct skb_shared_info * shinfo = skb_shinfo ( skb ) ; int nr_frags = shinfo -> nr_frags ; int i ; for ( i = 0 ; i < nr_frags ; i ++ ) { skb_frag_t * frag = shinfo -> frags + i ; struct xen_netif_tx_request * txp ; struct page * page ; u16 pending_idx ; pending_idx = frag_get_pending_idx ( frag ) ; txp = & netbk -> pending_tx_info [ pending_idx ]. req ; page = virt_to_page ( idx_to_kaddr ( netbk, pending_idx ) ) ; __skb_fill_page_desc ( skb, i, page, txp -> offset, txp -> size ) ; skb -> len += txp -> size ; skb -> data_len += txp -> size ; skb -> truesize += txp -> size ; get_page ( netbk -> mmap_pages [ pending_idx ] ) ; <START_BUG> xen_netbk_idx_release ( netbk, pending_idx ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> netbk, pending_idx, XEN_NETIF_RSP_OKAY