nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int zip_read_mac_metadata ( struct archive_read * a, struct archive_entry * entry, struct zip_entry * rsrc ) { struct zip * zip = ( struct zip * ) a -> format -> data ; unsigned char * metadata, * mp ; int64_t offset = archive_filter_bytes ( & a -> archive, 0 ) ; size_t remaining_bytes, metadata_bytes ; ssize_t hsize ; int ret = ARCHIVE_OK, eof ; switch ( rsrc -> compression ) { <START_BUG> case 0 : <END_BUG> # ifdef HAVE_ZLIB_H case 8 : # endif break ; default : archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Unsupported   ZIP   compression   method   (%s)", compression_name ( rsrc -> compression ) ) ; return ( ARCHIVE_WARN ) ; } if ( rsrc -> uncompressed_size > ( 4 * 1024 * 1024 ) ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Mac   metadata   is   too   large:   %jd   >   4M   bytes",  ( intmax_t ) rsrc -> uncompressed_size ) ; <START_BUG> return ( ARCHIVE_WARN ) ; } metadata = malloc ( ( size_t ) rsrc -> uncompressed_size ) ; if ( metadata == NULL ) { archive_set_error ( & a -> archive, ENOMEM, "Can\'t   allocate   memory   for   Mac   metadata" ) ; return ( ARCHIVE_FATAL ) ; } if ( offset < rsrc -> local_header_offset ) __archive_read_consume ( a, rsrc -> local_header_offset - offset ) ; else if ( offset!= rsrc -> local_header_offset ) { __archive_read_seek ( a, rsrc -> local_header_offset, SEEK_SET ) ; } hsize = zip_get_local_file_header_size ( a, 0 ) ; __archive_read_consume ( a, hsize ) ; remaining_bytes = ( size_t ) rsrc -> compressed_size ; metadata_bytes = ( size_t ) rsrc -> uncompressed_size ; mp = metadata ; eof = 0 ; while (! eof && remaining_bytes ) { const<END_BUG>

Fix:
<S2SV_ModStart> case 0 : if ( rsrc -> uncompressed_size!= rsrc -> compressed_size ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Malformed <S2SV_blank> OS <S2SV_blank> X <S2SV_blank> metadata <S2SV_blank> entry: <S2SV_blank> inconsistent <S2SV_blank> size" ) ; return ( ARCHIVE_FATAL ) ; } <S2SV_ModStart> rsrc -> uncompressed_size ) ; return ( ARCHIVE_WARN ) ; } if ( rsrc -> compressed_size > ( 4 * 1024 * 1024 ) ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Mac <S2SV_blank> metadata <S2SV_blank> is <S2SV_blank> too <S2SV_blank> large: <S2SV_blank> %jd <S2SV_blank> > <S2SV_blank> 4M <S2SV_blank> bytes", ( intmax_t ) rsrc -> compressed_size <S2SV_ModStart> case 0 : if ( ( size_t ) bytes_avail > metadata_bytes ) bytes_avail = metadata_bytes ;
Buggy code:
 <START_BUG> void ext4_xattr_destroy_cache ( struct mb_cache * cache ) <END_BUG> { if ( cache )  mb_cache_destroy ( cache ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ext4_xattr_destroy_cache ( struct mb2_cache <S2SV_ModEnd> * cache ) <S2SV_ModStart> ( cache ) mb2_cache_destroy <S2SV_ModEnd> ( cache )
Buggy code:
 static void set_active_map ( const vpx_codec_enc_cfg_t * cfg, vpx_codec_ctx_t * codec ) { unsigned int i ; <START_BUG> vpx_active_map_t map = { 0 } ; <END_BUG> map. rows = ( cfg -> g_h + 15 ) // 16 ; map. cols = ( cfg -> g_w + 15 ) // 16 ; map. active_map = ( uint8_t * ) malloc ( map. rows * map. cols ) ; for ( i = 0 ; i < map. rows * map. cols ; ++ i ) map. active_map [ i ] = i % 2 ; if ( vpx_codec_control ( codec, VP8E_SET_ACTIVEMAP, & map ) ) die_codec ( codec, "Failed   to   set   active   map" ) ; free ( map. active_map ) ; }

Fix:
<S2SV_ModStart> map = { 0, 0,
Buggy code:
 static void timerfd_setup_cancel ( struct timerfd_ctx * ctx, int flags ) <START_BUG> { <END_BUG> if ( ( ctx -> clockid == CLOCK_REALTIME || ctx -> clockid == CLOCK_REALTIME_ALARM ) && ( flags & TFD_TIMER_ABSTIME ) && ( flags & TFD_TIMER_CANCEL_ON_SET ) ) { if (! ctx -> might_cancel ) { ctx -> might_cancel = true ; spin_lock ( & cancel_lock ) ; list_add_rcu ( & ctx -> clist, & cancel_list ) ; spin_unlock ( & cancel_lock ) ; }  } else if ( ctx -> might_cancel ) { <START_BUG> timerfd_remove_cancel ( ctx ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> flags ) { spin_lock ( & ctx -> cancel_lock ) ; <S2SV_ModStart> } } else { __timerfd_remove_cancel <S2SV_ModEnd> ( ctx ) <S2SV_ModStart> ) ; } spin_unlock ( & ctx -> cancel_lock ) ;
Buggy code:
 static int check_entry_size_and_hooks ( struct ipt_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct ipt_entry )!= 0 || <START_BUG> ( unsigned char * ) e + sizeof ( struct ipt_entry ) >= limit ) { <END_BUG> duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct ipt_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } err = check_entry ( e ) ; if ( err ) return err ; for ( h = 0 ; h < NF_INET_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { pr_err ( "Underflows   must   be   unconditional   and   " "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> ipt_entry ) >= limit || ( unsigned char * ) e + e -> next_offset >
Buggy code:
 <START_BUG> uint32_t GetPayloadTime ( size_t handle, uint32_t index, float * in, float * out ) <END_BUG> { mp4object * mp4 = ( mp4object * ) handle ;  if ( mp4 == NULL ) return 0 ; <START_BUG> <END_BUG> if ( mp4 -> metaoffsets == 0 || mp4 -> basemetadataduration == 0 || mp4 -> meta_clockdemon == 0 || in == NULL || out == NULL ) return 1 ;  <START_BUG> * in = ( float ) ( ( double ) index * ( double ) mp4 -> basemetadataduration // ( double ) mp4 -> meta_clockdemon ) ; <END_BUG>  * out = ( float ) ( ( double ) ( index + 1 ) * ( double ) mp4 -> basemetadataduration // ( double ) mp4 -> meta_clockdemon ) ; <START_BUG> <END_BUG> return 0 ;  }

Fix:
<S2SV_ModStart> uint32_t index, double <S2SV_ModEnd> * in, <S2SV_ModStart> * in, double <S2SV_ModEnd> * out ) <S2SV_ModStart> NULL ) return GPMF_ERROR_MEMORY <S2SV_ModEnd> ; if ( <S2SV_ModStart> NULL ) return GPMF_ERROR_MEMORY <S2SV_ModEnd> ; * in <S2SV_ModStart> * in = <S2SV_ModEnd> ( ( double <S2SV_ModStart> * out = <S2SV_ModEnd> ( ( double <S2SV_ModStart> ) ; return GPMF_OK <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static krb5_error_code tgs_make_reply ( krb5_context context, krb5_kdc_configuration * config, KDC_REQ_BODY * b, krb5_const_principal tgt_name, const EncTicketPart * tgt, const krb5_keyblock * replykey, int rk_is_subkey, const EncryptionKey * serverkey, const krb5_keyblock * sessionkey, krb5_kvno kvno, AuthorizationData * auth_data, hdb_entry_ex * server, krb5_principal server_principal, const char * server_name, hdb_entry_ex * client, <START_BUG> krb5_principal client_principal, <END_BUG> hdb_entry_ex * krbtgt, krb5_enctype krbtgt_etype, krb5_principals spp, const krb5_data * rspac, const METHOD_DATA * enc_pa_data, const char * * e_text, krb5_data * reply ) { KDC_REP rep ; EncKDCRepPart ek ; EncTicketPart et ; KDCOptions f = b -> kdc_options ; krb5_error_code ret ; int is_weak = 0 ; memset ( & rep, 0, sizeof ( rep ) ) ; memset ( & et, 0, sizeof ( et ) ) ; memset ( & ek, 0, sizeof ( ek ) ) ; rep. pvno = 5 ; rep. msg_type = krb_tgs_rep ; et. authtime = tgt -> authtime ; _kdc_fix_time ( & b -> till ) ; et. endtime = min ( tgt -> endtime, * b -> till ) ; ALLOC ( et. starttime ) ; * et. starttime = kdc_time ; ret = check_tgs_flags ( context, config, b, tgt, & et ) ; if ( ret ) goto out ; # define GLOBAL_FORCE_TRANSITED_CHECK ( config -> trpolicy == TRPOLICY_ALWAYS_CHECK ) # define GLOBAL_ALLOW_PER_PRINCIPAL ( config -> trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL ) # define GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK ( config -> trpolicy == TRPOLICY_ALWAYS_

Fix:
<S2SV_ModStart>, krb5_principal client_principal, const char * tgt_realm <S2SV_ModStart> principal ), tgt_realm <S2SV_ModEnd> ) ; if
Buggy code:
 static void yv12_extend_frame_bottom_c ( YV12_BUFFER_CONFIG * ybf ) { int i ; unsigned char * src_ptr1, * src_ptr2 ; unsigned char * dest_ptr2 ; unsigned int Border ; int plane_stride ; int plane_height ; Border = ybf -> border ; plane_stride = ybf -> y_stride ; plane_height = ybf -> y_height ; src_ptr1 = ybf -> y_buffer - Border ; src_ptr2 = src_ptr1 + ( plane_height * plane_stride ) - plane_stride ; dest_ptr2 = src_ptr2 + plane_stride ; for ( i = 0 ; i < ( int ) Border ; i ++ ) { <START_BUG> vpx_memcpy ( dest_ptr2, src_ptr2, plane_stride ) ; <END_BUG> dest_ptr2 += plane_stride ; } plane_stride = ybf -> uv_stride ; plane_height = ybf -> uv_height ; Border //= 2 ; src_ptr1 = ybf -> u_buffer - Border ; src_ptr2 = src_ptr1 + ( plane_height * plane_stride ) - plane_stride ; dest_ptr2 = src_ptr2 + plane_stride ; for ( i = 0 ; i < ( int ) ( Border ) ; i ++ ) {  vpx_memcpy ( dest_ptr2, src_ptr2, plane_stride ) ; <START_BUG> dest_ptr2 += plane_stride ; } src_ptr1 = ybf -> v_buffer - Border ; src_ptr2 = src_ptr1 + ( plane_height * plane_stride ) - plane_stride ; dest_ptr2 = src_ptr2 + plane_stride ; for ( i = 0 ; i < ( int ) ( Border ) ; i ++ ) { <END_BUG> vpx_memcpy ( dest_ptr2, src_ptr2, plane_stride ) ;  dest_ptr2 += plane_stride ; } }

Fix:
<S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr2, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr2, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr2,
Buggy code:
 static identifier new_identifier ( const char * n, struct compiling * c ) { PyObject * id = PyUnicode_DecodeUTF8 ( n, strlen ( n ), NULL ) ; if (! id ) return NULL ; assert ( PyUnicode_IS_READY ( id ) ) ; if (! PyUnicode_IS_ASCII ( id ) ) { PyObject * id2 ; <START_BUG> if (! c -> c_normalize &&! init_normalization ( c ) ) { <END_BUG> Py_DECREF ( id ) ; return NULL ; }  PyTuple_SET_ITEM ( c -> c_normalize_args, 1, id ) ; <START_BUG> <END_BUG> id2 = PyObject_Call ( c -> c_normalize, c -> c_normalize_args, NULL ) ;  Py_DECREF ( id ) ; if (! id2 ) return NULL ; id = id2 ; } PyUnicode_InternInPlace ( & id ) ; if ( PyArena_AddPyObject ( c -> c_arena, id ) < 0 ) { Py_DECREF ( id ) ; return NULL ; } return id ; }

Fix:
<S2SV_ModStart> * id2 ; PyObject * form ; PyObject * args [ 2 ] ; _Py_IDENTIFIER ( NFKC ) ; <S2SV_ModStart> NULL ; } form = _PyUnicode_FromId ( & PyId_NFKC ) ; if ( form == NULL ) { Py_DECREF ( id ) ; return NULL ; } args [ 0 ] = form ; args [ 1 ] = id ; id2 = _PyObject_FastCall <S2SV_ModEnd> ( c -> <S2SV_ModStart> -> c_normalize, args, 2 ) ; Py_DECREF ( id ) ; if (! id2 ) return NULL ; if (! PyUnicode_Check ( id2 ) ) { PyErr_Format ( PyExc_TypeError, "unicodedata.normalize() <S2SV_blank> must <S2SV_blank> return <S2SV_blank> a <S2SV_blank> string, <S2SV_blank> not <S2SV_blank> " "%.200s", Py_TYPE ( id2 ) -> tp_name ) ; Py_DECREF ( id2 ) ; return NULL ; } <S2SV_ModEnd> id = id2
Buggy code:
 stmt_ty FunctionDef ( identifier name, arguments_ty args, asdl_seq * body, asdl_seq * <START_BUG> decorator_list, expr_ty returns, int lineno, int col_offset, int <END_BUG> end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; if (! name ) { PyErr_SetString ( PyExc_ValueError, "field   name   is   required   for   FunctionDef" ) ; return NULL ; } if (! args ) { PyErr_SetString ( PyExc_ValueError, "field   args   is   required   for   FunctionDef" ) ; return NULL ; } p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = FunctionDef_kind ; p -> v. FunctionDef. name = name ; p -> v. FunctionDef. args = args ; p -> v. FunctionDef. body = body ; p -> v. FunctionDef. decorator_list = decorator_list ;  p -> v. FunctionDef. returns = returns ; <START_BUG> p -> lineno = lineno ; p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> expr_ty returns, string type_comment, <S2SV_ModStart> returns = returns ; p -> v. FunctionDef. type_comment = type_comment
Buggy code:
 static void inotify_free_group_priv ( struct fsnotify_group * group ) { idr_for_each ( & group -> inotify_data. idr, idr_callback, group ) ; idr_remove_all ( & group -> inotify_data. idr ) ; idr_destroy ( & group -> inotify_data. idr ) ; <START_BUG> free_uid ( group -> inotify_data. user ) ; <END_BUG> }

Fix:
<S2SV_ModStart> idr ) ; atomic_dec ( & group -> inotify_data. user -> inotify_devs ) ;
Buggy code:
 int vfs_rename ( struct inode * old_dir, struct dentry * old_dentry, struct inode * new_dir, struct dentry * new_dentry, struct inode * * delegated_inode, unsigned int flags ) { int error ; bool is_dir = d_is_dir ( old_dentry ) ; const unsigned char * old_name ; struct inode * source = old_dentry -> d_inode ; struct inode * target = new_dentry -> d_inode ; bool new_is_dir = false ; unsigned max_links = new_dir -> i_sb -> s_max_links ; <START_BUG> if ( source == target ) <END_BUG> return 0 ; error = may_delete ( old_dir, old_dentry, is_dir ) ; if ( error ) return error ; if (! target ) { error = may_create ( new_dir, new_dentry ) ; } else { new_is_dir = d_is_dir ( new_dentry ) ; if (! ( flags & RENAME_EXCHANGE ) ) error = may_delete ( new_dir, new_dentry, is_dir ) ; else error = may_delete ( new_dir, new_dentry, new_is_dir ) ; } if ( error ) return error ; if (! old_dir -> i_op -> rename &&! old_dir -> i_op -> rename2 ) return - EPERM ; if ( flags &&! old_dir -> i_op -> rename2 ) return - EINVAL ; if ( new_dir!= old_dir ) { if ( is_dir ) { error = inode_permission ( source, MAY_WRITE ) ; if ( error ) return error ; } if ( ( flags & RENAME_EXCHANGE ) && new_is_dir ) { error = inode_permission ( target, MAY_WRITE ) ; if ( error ) return error ; } } error = security_inode_rename ( old_dir, old_dentry, new_dir, new_dentry, flags ) ; if ( error ) return error ; old_name = fsnotify_oldname_init ( old_dentry -> d_name. name ) ; dget ( new_dentry ) ; if (! is_dir || ( flags & RENAME_EXCHANGE ) ) lock

Fix:
<S2SV_ModStart> ; if ( vfs_select_inode ( old_dentry, 0 ) == vfs_select_inode ( new_dentry, 0 ) <S2SV_ModEnd> ) return 0
Buggy code:
 int vp8_encode_intra ( VP8_COMP * cpi, MACROBLOCK * x, int use_dc_pred ) { int i ; int intra_pred_var = 0 ; ( void ) cpi ; if ( use_dc_pred ) { x -> e_mbd. mode_info_context -> mbmi. mode = DC_PRED ; x -> e_mbd. mode_info_context -> mbmi. uv_mode = DC_PRED ; x -> e_mbd. mode_info_context -> mbmi. ref_frame = INTRA_FRAME ; vp8_encode_intra16x16mby ( x ) ; vp8_inverse_transform_mby ( & x -> e_mbd ) ; } else { for ( i = 0 ; i < 16 ; i ++ ) { x -> e_mbd. block [ i ]. bmi. as_mode = B_DC_PRED ; vp8_encode_intra4x4block ( x, i ) ; } } <START_BUG> intra_pred_var = vp8_get_mb_ss ( x -> src_diff ) ; <END_BUG> return intra_pred_var ; }

Fix:
<S2SV_ModStart> } intra_pred_var = vpx_get_mb_ss <S2SV_ModEnd> ( x ->
Buggy code:
 static int rawsock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; struct sk_buff * skb ; int copied ; int rc ; pr_debug ( "sock=%p   sk=%p   len=%zu   flags=%d\\n", sock, sk, len, flags ) ; skb = skb_recv_datagram ( sk, flags, noblock, & rc ) ; if (! skb ) return rc ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } rc = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; skb_free_datagram ( sk, skb ) ; return rc? : copied ; }

Fix:
<S2SV_ModStart> return rc ; <S2SV_ModEnd> copied = skb
Buggy code:
 static void umount_tree ( struct mount * mnt, enum umount_tree_flags how ) { LIST_HEAD ( tmp_list ) ; struct mount * p ; if ( how & UMOUNT_PROPAGATE ) propagate_mount_unlock ( mnt ) ; for ( p = mnt ; p ; p = next_mnt ( p, mnt ) ) { p -> mnt. mnt_flags |= MNT_UMOUNT ; list_move ( & p -> mnt_list, & tmp_list ) ; } list_for_each_entry ( p, & tmp_list, mnt_list ) { list_del_init ( & p -> mnt_child ) ; } if ( how & UMOUNT_PROPAGATE ) propagate_umount ( & tmp_list ) ; while (! list_empty ( & tmp_list ) ) { <START_BUG> bool disconnect ; <END_BUG> p = list_first_entry ( & tmp_list, struct mount, mnt_list ) ; list_del_init ( & p -> mnt_expire ) ; list_del_init ( & p -> mnt_list ) ;  __touch_mnt_namespace ( p -> mnt_ns ) ; <START_BUG> p -> mnt_ns = NULL ; if ( how & UMOUNT_SYNC ) p -> mnt. mnt_flags |= MNT_SYNC_UMOUNT ; disconnect = disconnect_mount ( p, how ) ; pin_insert_group ( & p -> mnt_umount, & p -> mnt_parent -> mnt, disconnect? & unmounted : NULL ) ; if ( mnt_has_parent ( p ) ) { mnt_add_count ( p -> mnt_parent, - 1 ) ; if (! disconnect ) { list_add_tail ( & p -> mnt_child, & p -> mnt_parent -> mnt_mounts ) ; } else { umount_mnt ( p ) ; } } change_mnt_propagation ( p, MS_PRIVATE ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> ) ) { struct mnt_namespace * ns ; <S2SV_ModStart> mnt_list ) ; ns = p -> mnt_ns ; if ( ns ) { ns -> mounts -- ; __touch_mnt_namespace ( ns ) ; } <S2SV_ModEnd> p -> mnt_ns
Buggy code:
 int nfsd_cross_mnt ( struct svc_rqst * rqstp, struct dentry * * dpp, struct svc_export * * expp ) { struct svc_export * exp = * expp, * exp2 = NULL ; struct dentry * dentry = * dpp ; struct path path = {. mnt = mntget ( exp -> ex_path. mnt ),. dentry = dget ( dentry ) } ; int err = 0 ; err = follow_down ( & path ) ; if ( err < 0 ) <START_BUG> goto out ; <END_BUG> exp2 = rqst_exp_get_by_name ( rqstp, & path ) ; if ( IS_ERR ( exp2 ) ) { err = PTR_ERR ( exp2 ) ; if ( err == - ENOENT &&! ( exp -> ex_flags & NFSEXP_V4ROOT ) ) err = 0 ; path_put ( & path ) ; goto out ; } if ( nfsd_v4client ( rqstp ) || ( exp -> ex_flags & NFSEXP_CROSSMOUNT ) || EX_NOHIDE ( exp2 ) ) { * dpp = path. dentry ; path. dentry = dentry ; * expp = exp2 ; exp2 = exp ; } path_put ( & path ) ; exp_put ( exp2 ) ; out : return err ; }

Fix:
<S2SV_ModStart> goto out ; if ( path. mnt == exp -> ex_path. mnt && path. dentry == dentry && nfsd_mountpoint ( dentry, exp ) == 2 ) { path_put ( & path ) ; goto out ; }
Buggy code:
 void vsyslog ( pri, fmt, ap ) int pri ; register const char * fmt ; va_list ap ; { struct tm now_tm ; time_t now ; int fd ; FILE * f ; char * buf = 0 ; size_t bufsize = 0 ; size_t prioff, msgoff ; struct sigaction action, oldaction ; struct sigaction * oldaction_ptr = NULL ; int sigpipe ; int saved_errno = errno ; # define INTERNALLOG LOG_ERR | LOG_CONS | LOG_PERROR | LOG_PID if ( pri & ~ ( LOG_PRIMASK | LOG_FACMASK ) ) { syslog ( INTERNALLOG, "syslog:   unknown   facility//priority:   %x", pri ) ; pri &= LOG_PRIMASK | LOG_FACMASK ; } if ( ( LOG_MASK ( LOG_PRI ( pri ) ) & LogMask ) == 0 ) return ; if ( ( pri & LOG_FACMASK ) == 0 ) pri |= LogFacility ; f = open_memstream ( & buf, & bufsize ) ; prioff = fprintf ( f, "<%d>", pri ) ; ( void ) time ( & now ) ; # ifdef USE_IN_LIBIO f -> _IO_write_ptr += strftime ( f -> _IO_write_ptr, f -> _IO_write_end - f -> _IO_write_ptr, "%h   %e   %T   ", __localtime_r ( & now, & now_tm ) ) ; # else f -> __bufp += strftime ( f -> __bufp, f -> __put_limit - f -> __bufp, "%h   %e   %T   ", __localtime_r ( & now, & now_tm ) ) ; # endif msgoff = ftell ( f ) ; if ( LogTag == NULL ) LogTag = __progname ; if ( LogTag!= NULL ) fputs_unlocked ( LogTag, f ) ; if ( LogStat & LOG_PID ) fprintf ( f, "[%d]", __getpid ( ) ) ; if ( LogTag!= NULL ) putc_unlocked ( ':', f ), putc_unlocked ('  ', f ) ; __set_errno ( saved_errno ) ; vfprintf ( f, fmt

Fix:
<S2SV_ModStart> - msgoff ; if ( buf [ bufsize - 1 ]!= '\\n' ) { <S2SV_ModStart> = 1 ; } <S2SV_ModStart>, iov, v - iov + 1 <S2SV_ModEnd> ) ; }
Buggy code:
 static int raw_sendmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipcm_cookie ipc ; struct rtable * rt = NULL ; int free = 0 ; __be32 daddr ; __be32 saddr ; u8 tos ; int err ; <START_BUG> err = - EMSGSIZE ; <END_BUG> if ( len > 0xFFFF ) goto out ; err = - EOPNOTSUPP ; if ( msg -> msg_flags & MSG_OOB ) goto out ; if ( msg -> msg_namelen ) { struct sockaddr_in * usin = ( struct sockaddr_in * ) msg -> msg_name ; err = - EINVAL ; if ( msg -> msg_namelen < sizeof ( * usin ) ) goto out ; if ( usin -> sin_family!= AF_INET ) { static int complained ; if (! complained ++ ) printk ( KERN_INFO "%s   forgot   to   set   AF_INET   in   " "raw   sendmsg.   Fix   it!\\n", current -> comm ) ; err = - EAFNOSUPPORT ; if ( usin -> sin_family ) goto out ; } daddr = usin -> sin_addr. s_addr ; } else { err = - EDESTADDRREQ ; if ( sk -> sk_state!= TCP_ESTABLISHED ) goto out ; daddr = inet -> inet_daddr ; } ipc. addr = inet -> inet_saddr ; ipc. opt = NULL ; ipc. tx_flags = 0 ; ipc. oif = sk -> sk_bound_dev_if ; if ( msg -> msg_controllen ) { err = ip_cmsg_send ( sock_net ( sk ), msg, & ipc ) ; if ( err ) goto out ; if ( ipc. opt ) free = 1 ; } saddr = ipc. addr ; ipc. addr = daddr ; if (! ipc. opt )  ipc. opt = inet -> opt ; <START_BUG> if ( ipc. opt ) { err = - EINVAL ; if ( inet -> hdrincl ) goto done ; <END_BUG> if ( ipc.

Fix:
<S2SV_ModStart> int err ; struct ip_options_data opt_copy ; <S2SV_ModStart>. opt ) { struct ip_options_rcu * inet_opt ; rcu_read_lock ( ) ; inet_opt = rcu_dereference ( inet -> inet_opt ) ; if ( inet_opt ) { memcpy ( & opt_copy, inet_opt, sizeof ( * inet_opt ) + inet_opt -> opt. optlen ) ; ipc. opt = & opt_copy. opt ; } rcu_read_unlock ( ) ; } <S2SV_ModEnd> if ( ipc <S2SV_ModStart>. opt -> opt. <S2SV_ModStart>. opt -> opt.
Buggy code:
 vpx_codec_err_t vp9_set_reference_dec ( VP9_COMMON * cm, VP9_REFFRAME ref_frame_flag, YV12_BUFFER_CONFIG * sd ) { <START_BUG> RefBuffer * ref_buf = NULL ; <END_BUG> if ( ref_frame_flag == VP9_LAST_FLAG ) { ref_buf = & cm -> frame_refs [ 0 ] ; } else if ( ref_frame_flag == VP9_GOLD_FLAG ) { ref_buf = & cm -> frame_refs [ 1 ] ; } else if ( ref_frame_flag == VP9_ALT_FLAG ) { ref_buf = & cm -> frame_refs [ 2 ] ; } else { vpx_internal_error ( & cm -> error, VPX_CODEC_ERROR, "Invalid   reference   frame" ) ; return cm -> error. error_code ; } if (! equal_dimensions ( ref_buf -> buf, sd ) ) { vpx_internal_error ( & cm -> error, VPX_CODEC_ERROR, "Incorrect   buffer   dimensions" ) ; } else { int * ref_fb_ptr = & ref_buf -> idx ; const int free_fb = get_free_fb ( cm ) ;  cm -> frame_bufs [ free_fb ]. ref_count -- ; <START_BUG> <END_BUG> ref_cnt_fb ( cm -> frame_bufs, ref_fb_ptr, free_fb ) ;  <START_BUG> ref_buf -> buf = & cm -> frame_bufs [ * ref_fb_ptr ]. buf ; <END_BUG> vp8_yv12_copy_frame ( sd, ref_buf -> buf ) ; } return cm -> error. error_code ; }

Fix:
<S2SV_ModStart> ref_buf = NULL ; RefCntBuffer * const frame_bufs = cm -> buffer_pool -> frame_bufs <S2SV_ModStart> cm ) ; if ( cm -> new_fb_idx == INVALID_IDX ) return VPX_CODEC_MEM_ERROR ; -- <S2SV_ModEnd> frame_bufs [ free_fb <S2SV_ModStart> ]. ref_count <S2SV_ModEnd> ; ref_cnt_fb ( <S2SV_ModStart> ; ref_cnt_fb ( <S2SV_ModEnd> frame_bufs, ref_fb_ptr <S2SV_ModStart> buf = & <S2SV_ModEnd> frame_bufs [ *
Buggy code:
 static int uio_mmap_physical ( struct vm_area_struct * vma ) { struct uio_device * idev = vma -> vm_private_data ; int mi = uio_find_mem_index ( vma ) ; <START_BUG> if ( mi < 0 ) <END_BUG> return - EINVAL ; vma -> vm_ops = & uio_physical_vm_ops ; vma -> vm_page_prot = pgprot_noncached ( vma -> vm_page_prot ) ; return remap_pfn_range ( vma, vma -> vm_start,  idev -> info -> mem [ mi ]. addr >> PAGE_SHIFT, <START_BUG> vma -> vm_end - vma -> vm_start, vma -> vm_page_prot ) ; }<END_BUG>

Fix:
<S2SV_ModStart> vma ) ; struct uio_mem * mem ; <S2SV_ModStart> mi < 0 ) return - EINVAL ; mem = idev -> info -> mem + mi ; if ( vma -> vm_end - vma -> vm_start > mem -> size <S2SV_ModStart> -> vm_start, mem -> <S2SV_ModEnd> addr >> PAGE_SHIFT
Buggy code:
 static int nfs4_callback_svc ( void * vrqstp ) { int err ; struct svc_rqst * rqstp = vrqstp ; set_freezable ( ) ; <START_BUG> while (! kthread_should_stop ( ) ) { <END_BUG> err = svc_recv ( rqstp, MAX_SCHEDULE_TIMEOUT ) ; if ( err == - EAGAIN || err == - EINTR ) continue ; svc_process ( rqstp ) ; }  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> while (! kthread_freezable_should_stop ( NULL <S2SV_ModEnd> ) ) { <S2SV_ModStart> ) ) { if ( signal_pending ( current ) ) flush_signals ( current ) ; <S2SV_ModStart> ) ; } svc_exit_thread ( rqstp ) ; module_put_and_exit ( 0 ) ;
Buggy code:
 int install_user_keyrings ( void ) { struct user_struct * user ; const struct cred * cred ; struct key * uid_keyring, * session_keyring ; key_perm_t user_keyring_perm ; char buf [ 20 ] ; int ret ; uid_t uid ; user_keyring_perm = ( KEY_POS_ALL & ~ KEY_POS_SETATTR ) | KEY_USR_ALL ; cred = current_cred ( ) ; user = cred -> user ; uid = from_kuid ( cred -> user_ns, user -> uid ) ; kenter ( "%p{%u}", user, uid ) ; <START_BUG> if ( user -> uid_keyring ) { <END_BUG> kleave ( "   =   0   [exist]" ) ; return 0 ; } mutex_lock ( & key_user_keyring_mutex ) ; ret = 0 ; if (! user -> uid_keyring ) { sprintf ( buf, "_uid.%u", uid ) ; uid_keyring = find_keyring_by_name ( buf, true ) ; if ( IS_ERR ( uid_keyring ) ) { uid_keyring = keyring_alloc ( buf, user -> uid, INVALID_GID, cred, user_keyring_perm, KEY_ALLOC_IN_QUOTA, NULL ) ; if ( IS_ERR ( uid_keyring ) ) { ret = PTR_ERR ( uid_keyring ) ; goto error ; } } sprintf ( buf, "_uid_ses.%u", uid ) ; session_keyring = find_keyring_by_name ( buf, true ) ; if ( IS_ERR ( session_keyring ) ) { session_keyring = keyring_alloc ( buf, user -> uid, INVALID_GID, cred, user_keyring_perm, KEY_ALLOC_IN_QUOTA, NULL ) ; if ( IS_ERR ( session_keyring ) ) { ret = PTR_ERR ( session_keyring ) ; goto error_release ; } ret = key_link ( session_keyring, uid_keyring ) ; if ( ret < 0 ) goto error_release_both ; } user -> uid_keyring = uid_keyring ; user -> session_keyring = session_keyring ; } mutex_unlock ( & key_user_keyring

Fix:
<S2SV_ModStart> user -> uid_keyring && user -> session_keyring
Buggy code:
 static void numtostr ( js_State * J, const char * fmt, int w, double n ) { <START_BUG> char buf [ 32 ], * e ; <END_BUG> sprintf ( buf, fmt, w, n ) ; e = strchr ( buf, 'e' ) ; if ( e ) { int exp = atoi ( e + 1 ) ; sprintf ( e, "e%+d", exp ) ; } js_pushstring ( J, buf ) ; }

Fix:
<S2SV_ModStart> char buf [ 50 <S2SV_ModEnd> ], *
Buggy code:
 int ParseDsdiffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t infilesize, total_samples ; DFFFileHeader dff_file_header ; DFFChunkHeader dff_chunk_header ; uint32_t bcount ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & dff_file_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & dff_file_header ) + 4, sizeof ( DFFFileHeader ) - 4, & bcount ) || bcount!= sizeof ( DFFFileHeader ) - 4 ) || strncmp ( dff_file_header. formType, "DSD   ", 4 ) ) { error_line ( "%s   is   not   a   valid  .DFF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & dff_file_header, sizeof ( DFFFileHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackBigEndianToNative ( & dff_file_header, DFFFileHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && dff_file_header. ckDataSize && dff_file_header. ckDataSize + 1 && dff_file_header. ckDataSize + 12!= infilesize ) { error_line ( "%s   is   not   a   valid  .DFF   file   (by   total   size)!", infilename ) ; return WAVPACK_SOFT_ERROR ; } if ( debug_logging_mode ) error_line ( "file   header   indicated   length   =   %lld", dff_file_header. ckDataSize ) ; # endif while ( 1 ) { if (! DoReadFile ( infile, & dff_chunk_header, sizeof ( DFFChunkHeader ), & bcount )

Fix:
<S2SV_ModStart> char * buff ; if ( bytes_to_copy < 0 || bytes_to_copy > 4194304 ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.DFF <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } buff
Buggy code:
 <START_BUG> static void show_object ( struct object * object, struct strbuf * path, <END_BUG>  const char * last, void * data ) <START_BUG> { struct bitmap * base = data ; bitmap_set ( base, find_object_pos ( object -> oid. hash ) ) ; mark_as_seen ( object ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * object, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name <S2SV_ModEnd>, void *
Buggy code:
 static long sg_ioctl ( struct file * filp, unsigned int cmd_in, unsigned long arg ) { void __user * p = ( void __user * ) arg ; int __user * ip = p ; int result, val, read_only ; Sg_device * sdp ; Sg_fd * sfp ; Sg_request * srp ; unsigned long iflags ; if ( (! ( sfp = ( Sg_fd * ) filp -> private_data ) ) || (! ( sdp = sfp -> parentdp ) ) ) return - ENXIO ; SCSI_LOG_TIMEOUT ( 3, sg_printk ( KERN_INFO, sdp, "sg_ioctl:   cmd=0x%x\\n", ( int ) cmd_in ) ) ; read_only = ( O_RDWR!= ( filp -> f_flags & O_ACCMODE ) ) ; switch ( cmd_in ) { case SG_IO : if ( atomic_read ( & sdp -> detaching ) ) return - ENODEV ; if (! scsi_block_when_processing_errors ( sdp -> device ) ) return - ENXIO ; if (! access_ok ( VERIFY_WRITE, p, SZ_SG_IO_HDR ) ) return - EFAULT ; result = sg_new_write ( sfp, filp, p, SZ_SG_IO_HDR, 1, read_only, 1, & srp ) ; if ( result < 0 ) return result ; result = wait_event_interruptible ( sfp -> read_wait, ( srp_done ( sfp, srp ) || atomic_read ( & sdp -> detaching ) ) ) ; if ( atomic_read ( & sdp -> detaching ) ) return - ENODEV ; write_lock_irq ( & sfp -> rq_list_lock ) ; if ( srp -> done ) { srp -> done = 2 ; write_unlock_irq ( & sfp -> rq_list_lock ) ; result = sg_new_read ( sfp, p, SZ_SG_IO_HDR, srp ) ; return ( result < 0 )? result : 0 ; } srp -> orphan = 1 ; write_unlock_irq ( & sfp -> rq_

Fix:
<S2SV_ModStart> ; rinfo = kzalloc <S2SV_ModEnd> ( SZ_SG_REQ_INFO *
Buggy code:
 static void cs_cmd_flags ( sourceinfo_t * si, int parc, char * parv [ ] ) { chanacs_t * ca ; mowgli_node_t * n ; char * channel = parv [ 0 ] ; char * target = sstrdup ( parv [ 1 ] ) ; char * flagstr = parv [ 2 ] ; const char * str1 ; unsigned int addflags, removeflags, restrictflags ; hook_channel_acl_req_t req ; mychan_t * mc ; if ( parc < 1 ) { command_fail ( si, fault_needmoreparams, STR_INSUFFICIENT_PARAMS, "FLAGS" ) ; command_fail ( si, fault_needmoreparams, _ ( "Syntax:   FLAGS   <channel>   [target]   [flags]" ) ) ; return ; } mc = mychan_find ( channel ) ; if (! mc ) { command_fail ( si, fault_nosuch_target, _ ( "Channel   \\2%s\\2   is   not   registered." ), channel ) ; return ; } if ( metadata_find ( mc, "private:close:closer" ) && ( target ||! has_priv ( si, PRIV_CHAN_AUSPEX ) ) ) { command_fail ( si, fault_noprivs, _ ( "\\2%s\\2   is   closed." ), channel ) ; return ; } if (! target || ( target && target [ 0 ] == '+' && flagstr == NULL ) ) { unsigned int flags = ( target!= NULL )? flags_to_bitmask ( target, 0 ) : 0 ; do_list ( si, mc, flags ) ; return ; } <START_BUG> else if (! strcasecmp ( target, "LIST" ) && myentity_find_ext ( target ) == NULL ) <END_BUG> { do_list ( si, mc, 0 ) ; free ( target ) ; return ; }  else if (! strcasecmp ( target, "CLEAR" ) && myentity_find_ext ( target ) == NULL ) <START_BUG> { free ( target ) ; if (! chanacs_source_has_flag ( mc, si, CA_FOUNDER ) ) { command_fail ( si, fault_noprivs, "You   are   not  <END_BUG>

Fix:
<S2SV_ModStart> else if ( anope_flags_compat && <S2SV_ModStart> else if ( anope_flags_compat && <S2SV_ModStart> else if ( anope_flags_compat &&
Buggy code:
 void bpf_int_jit_compile ( struct bpf_prog * prog ) { struct bpf_binary_header * header = NULL ; int proglen, oldproglen = 0 ; struct jit_context ctx = { } ; u8 * image = NULL ; int * addrs ; int pass ; int i ; if (! bpf_jit_enable ) return ; if (! prog ||! prog -> len ) return ; addrs = kmalloc ( prog -> len * sizeof ( * addrs ), GFP_KERNEL ) ; if (! addrs ) return ; for ( proglen = 0, i = 0 ; i < prog -> len ; i ++ ) { proglen += 64 ; addrs [ i ] = proglen ; } ctx. cleanup_addr = proglen ; <START_BUG> for ( pass = 0 ; pass < 10 ; pass ++ ) { <END_BUG> proglen = do_jit ( prog, addrs, image, oldproglen, & ctx ) ; if ( proglen <= 0 ) { image = NULL ; if ( header ) bpf_jit_binary_free ( header ) ; goto out ; } if ( image ) { if ( proglen!= oldproglen ) { pr_err ( "bpf_jit:   proglen=%d  !=   oldproglen=%d\\n", proglen, oldproglen ) ; goto out ; } break ; } if ( proglen == oldproglen ) { header = bpf_jit_binary_alloc ( proglen, & image, 1, jit_fill_hole ) ; if (! header ) goto out ; } oldproglen = proglen ; } if ( bpf_jit_enable > 1 ) bpf_jit_dump ( prog -> len, proglen, 0, image ) ; if ( image ) { bpf_flush_icache ( header, image + proglen ) ; set_memory_ro ( ( unsigned long ) header, header -> pages ) ; prog -> bpf_func = ( void * ) image ; prog -> jited = true ; } out : kfree ( addrs ) ; }

Fix:
<S2SV_ModStart> pass < 10 || image
Buggy code:
 long jpc_bitstream_getbits ( jpc_bitstream_t * bitstream, int n ) { long v ; int u ; <START_BUG> assert ( n >= 0 && n < 32 ) ; <END_BUG> v = 0 ; while ( -- n >= 0 ) { if ( ( u = jpc_bitstream_getbit ( bitstream ) ) < 0 ) { return - 1 ; } v = ( v << 1 ) | u ; } return v ; }

Fix:
<S2SV_ModStart> int u ; if ( n < 0 || n >= 32 ) { return - 1 ; } <S2SV_ModEnd> v = 0
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 char magick [ 12 ] ; Image * image ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; Quantum index ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, number_planes, number_planes_filled, one, offset, pixel_info_length ; ssize_t count, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { image -> page. x = ReadBlobLSBShort ( image ) ; image -> page. y = ReadBlobLSBShort ( image ) ; image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> alpha_trait = flags & 0x04? BlendPixelTrait : Undefined

Fix:
<S2SV_ModStart> -> rows * MagickMax ( number_planes_filled, 4 ) <S2SV_ModEnd> * sizeof ( <S2SV_ModStart> -> rows * MagickMax ( number_planes_filled, 4 ) <S2SV_ModEnd> ; pixels =
Buggy code:
 void vqp_print ( netdissect_options * ndo, register const u_char * pptr, register u_int len ) { const struct vqp_common_header_t * vqp_common_header ; const struct vqp_obj_tlv_t * vqp_obj_tlv ; const u_char * tptr ; uint16_t vqp_obj_len ; uint32_t vqp_obj_type ; <START_BUG> int tlen ; <END_BUG> uint8_t nitems ; tptr = pptr ; tlen = len ; vqp_common_header = ( const struct vqp_common_header_t * ) pptr ;  ND_TCHECK ( * vqp_common_header ) ; <START_BUG> if ( VQP_EXTRACT_VERSION ( vqp_common_header -> version )!= VQP_VERSION ) { ND_PRINT ( ( ndo, "VQP   version   %u   packet   not   supported", VQP_EXTRACT_VERSION ( vqp_common_header -> version ) ) ) ; return ; } if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "VQPv%u   %s   Message,   error-code   %s   (%u),   length   %u", VQP_EXTRACT_VERSION ( vqp_common_header -> version ), tok2str ( vqp_msg_type_values, "unknown   (%u)", vqp_common_header -> msg_type ), tok2str ( vqp_error_code_values, "unknown   (%u)", vqp_common_header -> error_code ), vqp_common_header -> error_code, len ) ) ; return ; } nitems = vqp_common_header -> nitems ; ND_PRINT ( ( ndo, "\\n\\tVQPv%u,   %s   Message,   error-code   %s   (%u),   seq   0x%08x,   items   %u,   length   %u", VQP_EXTRACT_VERSION ( vqp_common_header -> version ), tok2str ( vqp_msg_type_values, "unknown   (%u)",<END_BUG>

Fix:
<S2SV_ModStart> uint32_t vqp_obj_type ; u_int <S2SV_ModEnd> tlen ; uint8_t <S2SV_ModStart> * vqp_common_header ) ; if ( sizeof ( struct vqp_common_header_t ) > tlen ) goto trunc <S2SV_ModStart> ) tptr ; ND_TCHECK ( * vqp_obj_tlv ) ; if ( sizeof ( struct vqp_obj_tlv_t ) > tlen ) goto trunc ; <S2SV_ModStart> vqp_obj_len ) ; if ( vqp_obj_len > tlen ) goto trunc ; <S2SV_ModStart> case VQP_OBJ_IP_ADDRESS : if ( vqp_obj_len!= 4 ) goto trunc ; <S2SV_ModStart> case VQP_OBJ_MAC_NULL : if ( vqp_obj_len!= ETHER_ADDR_LEN ) goto trunc ;
Buggy code:
 <START_BUG> void * zrealloc ( void * ptr, size_t size ) { <END_BUG> # ifndef HAVE_MALLOC_SIZE void * realptr ; # endif size_t oldsize ; void * newptr ; if ( size == 0 && ptr!= NULL ) { zfree ( ptr ) ; return NULL ; } if ( ptr == NULL ) return zmalloc ( size ) ; # ifdef HAVE_MALLOC_SIZE oldsize = zmalloc_size ( ptr ) ; newptr = realloc ( ptr, size ) ; if (! newptr ) zmalloc_oom_handler ( size ) ; update_zmalloc_stat_free ( oldsize ) ; update_zmalloc_stat_alloc ( zmalloc_size ( newptr ) ) ; return newptr ; # else realptr = ( char * ) ptr - PREFIX_SIZE ; oldsize = * ( ( size_t * ) realptr ) ; newptr = realloc ( realptr, size + PREFIX_SIZE ) ; if (! newptr ) zmalloc_oom_handler ( size ) ; * ( ( size_t * ) newptr ) = size ; update_zmalloc_stat_free ( oldsize + PREFIX_SIZE ) ; update_zmalloc_stat_alloc ( size + PREFIX_SIZE ) ; return ( char * ) newptr + PREFIX_SIZE ; # endif }

Fix:
<S2SV_ModStart> size ) { ASSERT_NO_SIZE_OVERFLOW ( size ) ;
Buggy code:
 <START_BUG> uint32_t _WM_SetupMidiEvent ( struct _mdi * mdi, uint8_t * event_data, uint8_t running_event ) { <END_BUG> uint32_t ret_cnt = 0 ; uint8_t command = 0 ; uint8_t channel = 0 ; uint8_t data_1 = 0 ; uint8_t data_2 = 0 ; char * text = NULL ;  if ( event_data [ 0 ] >= 0x80 ) { <START_BUG> command = * event_data & 0xf0 ; channel = * event_data ++ & 0x0f ; <END_BUG> ret_cnt ++ ;  } else { command = running_event & 0xf0 ; channel = running_event & 0x0f ; } switch ( command ) { case 0x80 : _SETUP_NOTEOFF : <START_BUG> data_1 = * event_data ++ ; <END_BUG> data_2 = * event_data ++ ; _WM_midi_setup_noteoff ( mdi, channel, data_1, data_2 ) ; ret_cnt += 2 ; break ; case 0x90 : if ( event_data [ 1 ] == 0 ) goto _SETUP_NOTEOFF ;  data_1 = * event_data ++ ; <START_BUG> data_2 = * event_data ++ ; midi_setup_noteon ( mdi, channel, data_1, data_2 ) ; ret_cnt += 2 ; break ; case 0xa0 : <END_BUG> data_1 = * event_data ++ ;  data_2 = * event_data ++ ; midi_setup_aftertouch ( mdi, channel, data_1, data_2 ) ; ret_cnt += 2 ; break ; case 0xb0 : <START_BUG> data_1 = * event_data ++ ; <END_BUG> data_2 = * event_data ++ ; midi_setup_control ( mdi, channel, data_1, data_2 ) ; ret_cnt += 2 ; break ; case 0xc0 : data_1 = * event_data ++ ; midi_setup_patch ( mdi, channel, data_1 ) ; ret_cnt ++ ; break ; case 0xd0 : data_1 = * event_data ++ ; midi_setup_channel_pressure ( mdi, channel, data_1 ) ; ret_cnt ++ ; break ; case

Fix:
<S2SV_ModStart> * event_data, uint32_t siz, <S2SV_ModStart> ; if (! siz ) goto shortbuf ; if ( <S2SV_ModStart> ; ret_cnt ++ ; if ( -- siz == 0 ) goto shortbuf <S2SV_ModStart> : _SETUP_NOTEOFF : if ( siz < 2 ) goto shortbuf ; <S2SV_ModStart> goto _SETUP_NOTEOFF ; if ( siz < 2 ) goto shortbuf ; <S2SV_ModStart> case 0xa0 : if ( siz < 2 ) goto shortbuf ; <S2SV_ModStart> case 0xb0 : if ( siz < 2 ) goto shortbuf ; <S2SV_ModStart> case 0xe0 : if ( siz < 2 ) goto shortbuf ; <S2SV_ModStart> ) ) { if ( siz < 4 ) goto shortbuf ; <S2SV_ModStart> ; if ( -- siz && <S2SV_ModStart> { do { if (! siz ) break ; <S2SV_ModStart> event_data ++ ; siz -- ; <S2SV_ModStart> ) ; } if (! siz ) goto shortbuf ; <S2SV_ModStart> ret_cnt ++ ; if ( -- siz < tmp_length ) goto shortbuf ; if (! tmp_length ) break ; <S2SV_ModStart> ; if ( -- siz && <S2SV_ModStart> { do { if (! siz ) break ; <S2SV_ModStart> event_data ++ ; siz --
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char * pixels ; unsigned long

Fix:
<S2SV_ModStart> == VFF_TYP_BIT ) { if ( CheckMemoryOverflow <S2SV_ModEnd> ( ( image <S2SV_ModStart> ) >> 3UL, <S2SV_ModEnd> image -> rows <S2SV_ModStart> image -> rows )!= MagickFalse ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; max_packets = ( ( image -> columns + 7UL ) >> 3UL ) * image -> rows ; } else { if ( CheckMemoryOverflow ( number_pixels, viff_info. number_data_bands )!= MagickFalse ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; <S2SV_ModEnd> max_packets = ( <S2SV_ModStart> number_data_bands ) ; }
Buggy code:
 static int dhcpv6_print ( netdissect_options * ndo, const u_char * cp, u_int length, int indent ) { u_int i, t ; const u_char * tlv, * value ; uint16_t type, optlen ; i = 0 ; while ( i < length ) { <START_BUG> tlv = cp + i ; <END_BUG> type = EXTRACT_16BITS ( tlv ) ; optlen = EXTRACT_16BITS ( tlv + 2 ) ; value = tlv + 4 ; ND_PRINT ( ( ndo, "\\n" ) ) ; for ( t = indent ; t > 0 ; t -- ) ND_PRINT ( ( ndo, "\\t" ) ) ; ND_PRINT ( ( ndo, "%s", tok2str ( dh6opt_str, "Unknown", type ) ) ) ;  ND_PRINT ( ( ndo, "   (%u)", optlen + 4 ) ) ; <START_BUG> switch ( type ) { case DH6OPT_DNS_SERVERS : case DH6OPT_SNTP_SERVERS : { if ( optlen % 16!= 0 ) { ND_PRINT ( ( ndo, "   %s", istr ) ) ; return - 1 ; } for ( t = 0 ; t < optlen ; t += 16 ) ND_PRINT ( ( ndo, "   %s", ip6addr_string ( ndo, value + t ) ) ) ; } break ; case DH6OPT_DOMAIN_LIST : { const u_char * tp = value ; while ( tp < value + optlen ) { ND_PRINT ( ( ndo, "   " ) ) ; if ( ( tp = ns_nprint ( ndo, tp, value + optlen ) ) == NULL ) return - 1 ; } } break ; } i += 4 + optlen ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> length ) { if ( i + 4 > length ) return - 1 ; <S2SV_ModStart> 4 ) ) ; if ( i + 4 + optlen > length ) return - 1
Buggy code:
 int udpv6_recvmsg ( struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct sk_buff * skb ; unsigned int ulen, copied ; int peeked, off = 0 ; int err ; int is_udplite = IS_UDPLITE ( sk ) ; int is_udp4 ; bool slow ; if ( flags & MSG_ERRQUEUE ) return ipv6_recv_error ( sk, msg, len, addr_len ) ; if ( np -> rxpmtu && np -> rxopt. bits. rxpmtu ) return ipv6_recv_rxpmtu ( sk, msg, len, addr_len ) ; try_again : skb = __skb_recv_datagram ( sk, flags | ( noblock? MSG_DONTWAIT : 0 ), & peeked, & off, & err ) ; if (! skb ) goto out ; ulen = skb -> len - sizeof ( struct udphdr ) ; copied = len ; if ( copied > ulen ) copied = ulen ; else if ( copied < ulen ) msg -> msg_flags |= MSG_TRUNC ; is_udp4 = ( skb -> protocol == htons ( ETH_P_IP ) ) ; if ( copied < ulen || UDP_SKB_CB ( skb ) -> partial_cov ) { if ( udp_lib_checksum_complete ( skb ) ) goto csum_copy_err ; } if ( skb_csum_unnecessary ( skb ) ) err = skb_copy_datagram_msg ( skb, sizeof ( struct udphdr ), msg, copied ) ; else { err = skb_copy_and_csum_datagram_msg ( skb, sizeof ( struct udphdr ), msg ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( unlikely ( err ) ) { trace_kfree_skb ( skb, udpv6_recvmsg ) ; if (! peeked ) { atomic_inc ( & sk -> sk_

Fix:
<S2SV_ModStart> slow ) ; cond_resched ( ) <S2SV_ModEnd> ; msg ->
Buggy code:
 int git_pkt_parse_line ( git_pkt * * head, const char * line, const char * * out, size_t bufflen ) { int ret ; int32_t len ; if ( bufflen > 0 && bufflen < PKT_LEN_SIZE ) return GIT_EBUFS ; len = parse_len ( line ) ; if ( len < 0 ) { if ( bufflen >= 4 &&! git__prefixcmp ( line, "PACK" ) ) { giterr_clear ( ) ; * out = line ; return pack_pkt ( head ) ; } return ( int ) len ; } if ( bufflen > 0 && bufflen < ( size_t ) len ) return GIT_EBUFS ; if ( len!= 0 && len < PKT_LEN_SIZE ) return GIT_ERROR ; line += PKT_LEN_SIZE ; if ( len == PKT_LEN_SIZE ) { <START_BUG> * head = NULL ; <END_BUG> * out = line ; return 0 ; } if ( len == 0 ) { * out = line ; return flush_pkt ( head ) ; } len -= PKT_LEN_SIZE ; if ( * line == GIT_SIDE_BAND_DATA ) ret = data_pkt ( head, line, len ) ; else if ( * line == GIT_SIDE_BAND_PROGRESS ) ret = sideband_progress_pkt ( head, line, len ) ; else if ( * line == GIT_SIDE_BAND_ERROR ) ret = sideband_error_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "ACK" ) ) ret = ack_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "NAK" ) ) ret = nak_pkt ( head ) ; else if (! git__prefixcmp ( line, "ERR   " ) ) ret = err_pkt ( head, line, len ) ; else if ( * line == '#' ) ret = comment_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "ok" ) ) ret = ok_pkt ( head, line, len ) ; else if (! git__prefixcmp ( line, "ng" ) ) ret = ng

Fix:
<S2SV_ModStart> PKT_LEN_SIZE ) { giterr_set_str ( GITERR_NET, "Invalid <S2SV_blank> empty <S2SV_blank> packet" ) ; return GIT_ERROR <S2SV_ModEnd> ; } if
Buggy code:
 static int crypto_report_one ( struct crypto_alg * alg, struct crypto_user_alg * ualg, struct sk_buff * skb ) { <START_BUG> memcpy ( & ualg -> cru_name, & alg -> cra_name, sizeof ( ualg -> cru_name ) ) ; <END_BUG>  memcpy ( & ualg -> cru_driver_name, & alg -> cra_driver_name, <START_BUG> sizeof ( ualg -> cru_driver_name ) ) ; <END_BUG> memcpy ( & ualg -> cru_module_name, module_name ( alg -> cra_module ),  <START_BUG> CRYPTO_MAX_ALG_NAME ) ; <END_BUG> ualg -> cru_flags = alg -> cra_flags ; ualg -> cru_refcnt = atomic_read ( & alg -> cra_refcnt ) ; if ( nla_put_u32 ( skb, CRYPTOCFGA_PRIORITY_VAL, alg -> cra_priority ) ) goto nla_put_failure ; if ( alg -> cra_flags & CRYPTO_ALG_LARVAL ) { struct crypto_report_larval rl ;  snprintf ( rl. type, CRYPTO_MAX_ALG_NAME, "%s", "larval" ) ; <START_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_LARVAL, sizeof ( struct crypto_report_larval ), & rl ) ) goto nla_put_failure ; goto out ; } if ( alg -> cra_type && alg -> cra_type -> report ) { if ( alg -> cra_type -> report ( skb, alg ) ) goto nla_put_failure ; goto out ; } switch ( alg -> cra_flags & ( CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_LARVAL ) ) { case CRYPTO_ALG_TYPE_CIPHER : if ( crypto_report_cipher ( skb, alg ) ) goto nla_put_failure ; break ; case CRYPTO_ALG_TYPE_COMPRESS : if ( crypto_report_comp ( skb, alg ) ) goto nla_put_failure ; break ; } out : return 0 ; nla_put_failure : return - EMSG<END_BUG>

Fix:
<S2SV_ModStart> skb ) { strncpy ( <S2SV_ModEnd> ualg -> cru_name <S2SV_ModStart> -> cru_name, <S2SV_ModEnd> alg -> cra_name <S2SV_ModStart> ) ) ; strncpy ( <S2SV_ModEnd> ualg -> cru_driver_name <S2SV_ModStart> -> cru_driver_name, <S2SV_ModEnd> alg -> cra_driver_name <S2SV_ModStart> ) ) ; strncpy ( <S2SV_ModEnd> ualg -> cru_module_name <S2SV_ModStart> cra_module ), sizeof ( ualg -> cru_module_name ) ) ; ualg -> cru_type = 0 ; ualg -> cru_mask = 0 <S2SV_ModEnd> ; ualg -> <S2SV_ModStart> crypto_report_larval rl ; strncpy <S2SV_ModEnd> ( rl. <S2SV_ModStart>. type, "larval", sizeof ( rl. type ) <S2SV_ModEnd> ) ; if