nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int cbor2json ( OSCTXT * pCborCtxt, OSCTXT * pJsonCtxt ) { int ret = 0 ; OSOCTET tag, ub ; ret = rtxReadBytes ( pCborCtxt, & ub, 1 ) ; if ( 0!= ret ) return LOG_RTERR ( pCborCtxt, ret ) ; tag = ub >> 5 ; switch ( tag ) { case OSRTCBOR_UINT : { OSUINTTYPE value ; ret = rtCborDecUInt ( pCborCtxt, ub, & value ) ; if ( 0!= ret ) return LOG_RTERR ( pCborCtxt, ret ) ; # ifndef _NO_INT64_SUPPORT ret = rtJsonEncUInt64Value ( pJsonCtxt, value ) ; # else ret = rtJsonEncUIntValue ( pJsonCtxt, value ) ; # endif if ( 0!= ret ) return LOG_RTERR ( pJsonCtxt, ret ) ; break ; } case OSRTCBOR_NEGINT : { OSINTTYPE value ; ret = rtCborDecInt ( pCborCtxt, ub, & value ) ; if ( 0!= ret ) return LOG_RTERR ( pCborCtxt, ret ) ; # ifndef _NO_INT64_SUPPORT ret = rtJsonEncInt64Value ( pJsonCtxt, value ) ; # else ret = rtJsonEncIntValue ( pJsonCtxt, value ) ; # endif if ( 0!= ret ) return LOG_RTERR ( pJsonCtxt, ret ) ; break ; } case OSRTCBOR_BYTESTR : { OSDynOctStr64 byteStr ; ret = rtCborDecDynByteStr ( pCborCtxt, ub, & byteStr ) ; if ( 0!= ret ) return LOG_RTERR ( pCborCtxt, ret ) ; ret = rtJsonEncHexStr ( pJsonCtxt, byteStr. numocts, byteStr. data ) ; rtxMemFreePtr ( pCborCtxt, byteStr. data ) ; if ( 0!= ret ) return LOG_RTERR ( pJsonCtxt, ret ) ; break ; } case OSRTCBOR_UTF8STR : { OSUTF8CHAR * utf8str ; <START_BUG> ret = rtCborDecDynUTF8Str ( pCborCtxt, ub, (<END_BUG>

Fix:
<S2SV_ModStart> ) & utf8str ) ; if ( 0!= ret ) return LOG_RTERR ( pCborCtxt, ret
Buggy code:
 static int llc_ui_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sockaddr_llc * uaddr = ( struct sockaddr_llc * ) msg -> msg_name ; const int nonblock = flags & MSG_DONTWAIT ; struct sk_buff * skb = NULL ; struct sock * sk = sock -> sk ; struct llc_sock * llc = llc_sk ( sk ) ; unsigned long cpu_flags ; size_t copied = 0 ; u32 peek_seq = 0 ; u32 * seq ; unsigned long used ; int target ; <START_BUG> long timeo ; <END_BUG> msg -> msg_namelen = 0 ; lock_sock ( sk ) ; copied = - ENOTCONN ; if ( unlikely ( sk -> sk_type == SOCK_STREAM && sk -> sk_state == TCP_LISTEN ) ) goto out ; timeo = sock_rcvtimeo ( sk, nonblock ) ; seq = & llc -> copied_seq ; if ( flags & MSG_PEEK ) { peek_seq = llc -> copied_seq ; seq = & peek_seq ; } target = sock_rcvlowat ( sk, flags & MSG_WAITALL, len ) ; copied = 0 ; do { u32 offset ; if ( signal_pending ( current ) ) { if ( copied ) break ; copied = timeo? sock_intr_errno ( timeo ) : - EAGAIN ; break ; } skb = skb_peek ( & sk -> sk_receive_queue ) ; if ( skb ) { offset = * seq ; goto found_ok_skb ; } if ( copied >= target &&! sk -> sk_backlog. tail ) break ; if ( copied ) { if ( sk -> sk_err || sk -> sk_state == TCP_CLOSE || ( sk -> sk_shutdown & RCV_SHUTDOWN ) ||! timeo || ( flags & MSG_PEEK ) ) break ; } else { if ( sock_flag ( sk, SOCK_DONE ) ) break ; if ( sk -> sk_err ) { copied = sock_error ( sk ) ; break ; } if ( sk -> sk_shutdown & RCV_SHUTDOWN ) break ; if ( sk -> sk_type == SOCK_

Fix:
<S2SV_ModStart> ; long timeo <S2SV_ModEnd> ; lock_sock (
Buggy code:
 static inline void schedule_debug ( struct task_struct * prev ) { # ifdef CONFIG_SCHED_STACK_END_CHECK <START_BUG> BUG_ON ( task_stack_end_corrupted ( prev ) ) ; <END_BUG> # endif if ( unlikely ( in_atomic_preempt_off ( ) ) ) { __schedule_bug ( prev ) ; preempt_count_set ( PREEMPT_DISABLED ) ; } rcu_sleep_check ( ) ; profile_hit ( SCHED_PROFILING, __builtin_return_address ( 0 ) ) ; schedstat_inc ( this_rq ( ), sched_count ) ; }

Fix:
<S2SV_ModStart> # ifdef CONFIG_SCHED_STACK_END_CHECK if <S2SV_ModEnd> ( task_stack_end_corrupted ( <S2SV_ModStart> ( prev ) ) panic ( "corrupted <S2SV_blank> stack <S2SV_blank> end <S2SV_blank> detected <S2SV_blank> inside <S2SV_blank> scheduler\\n"
Buggy code:
 static long __mptctl_ioctl ( struct file * file, unsigned int cmd, unsigned long arg ) { mpt_ioctl_header __user * uhdr = ( void __user * ) arg ; mpt_ioctl_header khdr ; int iocnum ; unsigned iocnumX ; int nonblock = ( file -> f_flags & O_NONBLOCK ) ; int ret ; MPT_ADAPTER * iocp = NULL ; if ( copy_from_user ( & khdr, uhdr, sizeof ( khdr ) ) ) { printk ( KERN_ERR MYNAM "%s::mptctl_ioctl()   @%d   -   " "Unable   to   copy   mpt_ioctl_header   data   @   %p\\n", __FILE__, __LINE__, uhdr ) ; return - EFAULT ; } ret = - ENXIO ; iocnumX = khdr. iocnum & 0xFF ; if ( ( ( iocnum = mpt_verify_adapter ( iocnumX, & iocp ) ) < 0 ) || ( iocp == NULL ) ) return - ENODEV ; if (! iocp -> active ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_ioctl()   @%d   -   Controller   disabled.\\n", __FILE__, __LINE__ ) ; return - EFAULT ; } if ( ( cmd & ~ IOCSIZE_MASK ) == ( MPTIOCINFO & ~ IOCSIZE_MASK ) ) { <START_BUG> return mptctl_getiocinfo ( arg, _IOC_SIZE ( cmd ) ) ; <END_BUG> } else if ( cmd == MPTTARGETINFO ) {  return mptctl_gettargetinfo ( arg ) ; <START_BUG> } else if ( cmd == MPTTEST ) { <END_BUG> return mptctl_readtest ( arg ) ;  } else if ( cmd == MPTEVENTQUERY ) { <START_BUG> return mptctl_eventquery ( arg ) ; <END_BUG> } else if ( cmd == MPTEVENTENABLE ) {  return mptctl_eventenable ( arg ) ; <START_BUG> } else if ( cmd == MPTEVENTREPORT ) { <END_BUG> return mptctl_eventreport ( arg ) ;  } else if ( cmd == MPTFWREPLACE ) { <START_BUG> return mptctl<END_BUG>

Fix:
<S2SV_ModStart> return mptctl_getiocinfo ( iocp, <S2SV_ModStart> return mptctl_gettargetinfo ( iocp, <S2SV_ModStart> return mptctl_readtest ( iocp, <S2SV_ModStart> return mptctl_eventquery ( iocp, <S2SV_ModStart> return mptctl_eventenable ( iocp, <S2SV_ModStart> return mptctl_eventreport ( iocp, <S2SV_ModStart> return mptctl_replace_fw ( iocp, <S2SV_ModStart> = mptctl_fw_download ( iocp, <S2SV_ModStart> = mptctl_mpt_command ( iocp, <S2SV_ModStart> = mptctl_do_reset ( iocp, <S2SV_ModStart> = mptctl_hp_hostinfo ( iocp, <S2SV_ModStart> = mptctl_hp_targetinfo ( iocp,
Buggy code:
 static void xen_irq_lateeoi_locked ( struct irq_info * info ) { evtchn_port_t evtchn ; <START_BUG> evtchn = info -> evtchn ; <END_BUG>  if (! VALID_EVTCHN ( evtchn ) ) <START_BUG> return ; unmask_evtchn ( evtchn ) ; }<END_BUG>

Fix:
<S2SV_ModStart> evtchn_port_t evtchn ; unsigned int cpu ; <S2SV_ModStart> ( evtchn ) ||! list_empty ( & info -> eoi_list ) ) return ; cpu = info -> eoi_cpu ; if ( info -> eoi_time && info -> irq_epoch == per_cpu ( irq_epoch, cpu ) ) { lateeoi_list_add ( info ) ; return ; } info -> eoi_time = 0 <S2SV_ModEnd> ; unmask_evtchn (
Buggy code:
 int main ( int argc, char * * argv ) { int fmtid ; int id ; char * infile ; jas_stream_t * instream ; jas_image_t * image ; int width ; int height ; int depth ; int numcmpts ; int verbose ; char * fmtname ; int debug ; size_t max_mem ; <START_BUG> if ( jas_init ( ) ) { <END_BUG> abort ( ) ; } cmdname = argv [ 0 ] ;  infile = 0 ; <START_BUG> verbose = 0 ; debug = 0 ; # if defined ( JAS_DEFAULT_MAX_MEM_USAGE ) max_mem = JAS_DEFAULT_MAX_MEM_USAGE ; # endif while ( ( id = jas_getopt ( argc, argv, opts ) ) >= 0 ) { switch ( id ) { case OPT_VERBOSE : verbose = 1 ; break ; case OPT_VERSION : printf ( "%s\\n", JAS_VERSION ) ; exit ( EXIT_SUCCESS ) ; break ; case OPT_DEBUG : debug = atoi ( jas_optarg ) ; break ; case OPT_INFILE : infile = jas_optarg ; break ; <END_BUG> case OPT_MAXMEM :  max_mem = strtoull ( jas_optarg, 0, 10 ) ; break ; case OPT_HELP : default : usage ( ) ; break ; } } jas_setdbglevel ( debug ) ; # if defined ( JAS_DEFAULT_MAX_MEM_USAGE ) jas_set_max_mem_usage ( max_mem ) ; # endif if ( infile ) { if (! ( instream = jas_stream_fopen ( infile, "rb" ) ) ) { fprintf ( stderr, "cannot   open   input   image   file   %s\\n", infile ) ; exit ( EXIT_FAILURE ) ; } } else { if (! ( instream = jas_stream_fdopen ( 0, "rb" ) ) ) { fprintf ( stderr, "cannot   open   standard   input\\n" ) ; exit ( EXIT_FAILURE ) ; } } if ( ( fmtid = jas_image_getfmt ( instream ) ) < 0 ) { fprintf ( stderr, "unknown   image   format\\n" ) ; } <START_BUG> if (! ( image = jas_image_decode (<END_BUG>

Fix:
<S2SV_ModStart> size_t max_mem ; size_t max_samples ; char optstr [ 32 ] ; <S2SV_ModStart> 0 ] ; max_samples = 64 * JAS_MEBI ; <S2SV_ModStart> break ; case OPT_MAXSAMPLES : max_samples = strtoull ( jas_optarg, 0, 10 ) ; break ; case <S2SV_ModStart> ) ; } snprintf ( optstr, sizeof ( optstr ), "max_samples=%-zu", max_samples ) ; <S2SV_ModStart>, fmtid, optstr <S2SV_ModEnd> ) ) ) <S2SV_ModStart> (! ( fmtname = jas_image_fmttostr ( fmtid ) ) ) { jas_eprintf ( "format <S2SV_blank> name <S2SV_blank> lookup <S2SV_blank> failed\\n" ) ; return EXIT_FAILURE ; } if (! ( <S2SV_ModStart> 0 ; } printf ( "%s <S2SV_blank> %d <S2SV_blank> %d <S2SV_blank> %d <S2SV_blank> %d <S2SV_blank> %ld\\n", fmtname <S2SV_ModEnd>, numcmpts, <S2SV_ModStart>, depth, JAS_CAST ( long, <S2SV_ModEnd> jas_image_rawsize ( image <S2SV_ModStart> jas_image_rawsize ( image )
Buggy code:
 static krb5_error_code s4u_identify_user ( krb5_context context, krb5_creds * in_creds, krb5_data * subject_cert, krb5_principal * canon_user ) { krb5_error_code code ; krb5_preauthtype ptypes [ 1 ] = { KRB5_PADATA_S4U_X509_USER } ; krb5_creds creds ; int use_master = 0 ; krb5_get_init_creds_opt * opts = NULL ; krb5_principal_data client ; krb5_s4u_userid userid ; * canon_user = NULL ; if ( in_creds -> client == NULL && subject_cert == NULL ) { return EINVAL ; } if ( in_creds -> client!= NULL && in_creds -> client -> type!= KRB5_NT_ENTERPRISE_PRINCIPAL ) { int anonymous ; anonymous = krb5_principal_compare ( context, in_creds -> client, krb5_anonymous_principal ( ) ) ; return krb5_copy_principal ( context, anonymous? in_creds -> server : in_creds -> client, canon_user ) ; } memset ( & creds, 0, sizeof ( creds ) ) ; memset ( & userid, 0, sizeof ( userid ) ) ; if ( subject_cert!= NULL ) userid. subject_cert = * subject_cert ; code = krb5_get_init_creds_opt_alloc ( context, & opts ) ; if ( code!= 0 ) goto cleanup ; krb5_get_init_creds_opt_set_tkt_life ( opts, 15 ) ; krb5_get_init_creds_opt_set_renew_life ( opts, 0 ) ; krb5_get_init_creds_opt_set_forwardable ( opts, 0 ) ; krb5_get_init_creds_opt_set_proxiable ( opts, 0 ) ; krb5_get_init_creds_opt_set_canonicalize ( opts, 1 ) ; krb5_get_init_creds_opt_set_preauth_list ( opts, ptypes, 1 ) ; if ( in_creds -> client!= NULL ) { client =

Fix:
<S2SV_ModStart> ; if (! code <S2SV_ModEnd> || code == <S2SV_ModStart> code == KRB5_PREAUTH_FAILED || code == KRB5KDC_ERR_KEY_EXP
Buggy code:
 static int perf_trace_event_perm ( struct ftrace_event_call * tp_event, struct perf_event * p_event ) { if ( ftrace_event_is_function ( tp_event ) && <START_BUG> perf_paranoid_kernel ( ) &&! capable ( CAP_SYS_ADMIN ) ) <END_BUG> return - EPERM ; if (! ( p_event -> attr. sample_type & PERF_SAMPLE_RAW ) ) return 0 ; if ( p_event -> attach_state == PERF_ATTACH_TASK ) { if ( tp_event -> flags & TRACE_EVENT_FL_CAP_ANY ) return 0 ; } if ( perf_paranoid_tracepoint_raw ( ) &&! capable ( CAP_SYS_ADMIN ) ) return - EPERM ; return 0 ; }

Fix:
<S2SV_ModStart> tp_event ) && perf_paranoid_tracepoint_raw <S2SV_ModEnd> ( ) &&
Buggy code:
 Imaging ImagingResampleHorizontal ( Imaging imIn, int xsize, int filter ) { ImagingSectionCookie cookie ; Imaging imOut ; struct filter * filterp ; float support, scale, filterscale ; float center, ww, ss, ss0, ss1, ss2, ss3 ; int xx, yy, x, kmax, xmin, xmax ; int * xbounds ; float * k, * kk ; switch ( filter ) { case IMAGING_TRANSFORM_LANCZOS : filterp = & LANCZOS ; break ; case IMAGING_TRANSFORM_BILINEAR : filterp = & BILINEAR ; break ; case IMAGING_TRANSFORM_BICUBIC : filterp = & BICUBIC ; break ; default : return ( Imaging ) ImagingError_ValueError ( "unsupported   resampling   filter" ) ; } filterscale = scale = ( float ) imIn -> xsize // xsize ; support = filterp -> support ; if ( filterscale < 1.0 ) { filterscale = 1.0 ; } support = support * filterscale ; kmax = ( int ) ceil ( support ) * 2 + 1 ; <START_BUG> kk = malloc ( xsize * kmax * sizeof ( float ) ) ; <END_BUG>  if (! kk ) <START_BUG> return ( Imaging ) ImagingError_MemoryError ( ) ; xbounds = malloc ( xsize * 2 * sizeof ( int ) ) ; if (! xbounds ) { free ( kk ) ; return ( Imaging ) ImagingError_MemoryError ( ) ; } for ( xx = 0 ; xx < xsize ; xx ++ ) { k = & kk [ xx * kmax ] ; center = ( xx + 0.5 ) * scale ; ww = 0.0 ; ss = 1.0 // filterscale ; xmin = ( int ) floor ( center - support ) ; if ( xmin < 0 ) xmin = 0 ; xmax = ( int ) ceil ( center + support ) ; if ( xmax > imIn -> xsize ) xmax = imIn -> xsize ; for ( x = xmin ; x < xmax ; x ++ ) { float w = filterp -> filter ( ( x - center + 0.5 ) * ss ) * ss ; k [ x - xmin ] = w ; ww += w ; } for ( x = 0 ; x < xmax - xmin ; x<END_BUG>

Fix:
<S2SV_ModStart> + 1 ; if ( kmax > 0 && xsize > SIZE_MAX // kmax ) return ( Imaging ) ImagingError_MemoryError ( ) ; if ( xsize * kmax > SIZE_MAX // sizeof ( float ) ) return ( Imaging ) ImagingError_MemoryError ( ) ; <S2SV_ModStart> (! kk ) return ( Imaging ) ImagingError_MemoryError ( ) ; if ( xsize > SIZE_MAX // ( 2 * sizeof ( int ) )
Buggy code:
 static int fetch_token ( OnigToken * tok, UChar * * src, UChar * end, ScanEnv * env ) { int r, num ; OnigCodePoint c ; OnigEncoding enc = env -> enc ; OnigSyntaxType * syn = env -> syntax ; UChar * prev ; UChar * p = * src ; PFETCH_READY ; start : if ( PEND ) { tok -> type = TK_EOT ; return tok -> type ; } tok -> type = TK_STRING ; tok -> base = 0 ; tok -> backp = p ; PFETCH ( c ) ; if ( IS_MC_ESC_CODE ( c, syn ) ) { if ( PEND ) return ONIGERR_END_PATTERN_AT_ESCAPE ; tok -> backp = p ; PFETCH ( c ) ; tok -> u. c = c ; tok -> escaped = 1 ; switch ( c ) { case '*' : if (! IS_SYNTAX_OP ( syn, ONIG_SYN_OP_ESC_ASTERISK_ZERO_INF ) ) break ; tok -> type = TK_OP_REPEAT ; tok -> u. repeat. lower = 0 ; tok -> u. repeat. upper = REPEAT_INFINITE ; goto greedy_check ; break ; case '+' : if (! IS_SYNTAX_OP ( syn, ONIG_SYN_OP_ESC_PLUS_ONE_INF ) ) break ; tok -> type = TK_OP_REPEAT ; tok -> u. repeat. lower = 1 ; tok -> u. repeat. upper = REPEAT_INFINITE ; goto greedy_check ; break ; case '?' : if (! IS_SYNTAX_OP ( syn, ONIG_SYN_OP_ESC_QMARK_ZERO_ONE ) ) break ; tok -> type = TK_OP_REPEAT ; tok -> u. repeat. lower = 0 ; tok -> u. repeat. upper = 1 ; greedy_check : if (! PEND && PPEEK_IS ( '?' ) && IS_SYNTAX_OP ( syn, ONIG_SYN_OP_QMARK_NON_GREEDY ) ) { PFETCH ( c ) ; tok -> u. repeat. greedy = 0 ; tok -> u. repeat. possessive = 0 ;

Fix:
<S2SV_ModStart> num < 0 || num >= 256
Buggy code:
 static void * arm_coherent_dma_alloc ( struct device * dev, size_t size, dma_addr_t * handle, gfp_t gfp, struct dma_attrs * attrs ) { <START_BUG> pgprot_t prot = __get_dma_pgprot ( attrs, pgprot_kernel ) ; <END_BUG> void * memory ; if ( dma_alloc_from_coherent ( dev, size, handle, & memory ) ) return memory ; return __dma_alloc ( dev, size, handle, gfp, prot, true, __builtin_return_address ( 0 ) ) ; }

Fix:
<S2SV_ModStart> ( attrs, PAGE_KERNEL <S2SV_ModEnd> ) ; void
Buggy code:
 static void ipv6_select_ident ( struct frag_hdr * fhdr, struct rt6_info * rt ) { static u32 ip6_idents_hashrnd __read_mostly ; <START_BUG> u32 hash, id ; <END_BUG>  net_get_random_once ( & ip6_idents_hashrnd, sizeof ( ip6_idents_hashrnd ) ) ; <START_BUG> hash = __ipv6_addr_jhash ( & rt -> rt6i_dst. addr, ip6_idents_hashrnd ) ; hash = __ipv6_addr_jhash ( & rt -> rt6i_src. addr, hash ) ; <END_BUG> id = ip_idents_reserve ( hash, 1 ) ;  fhdr -> identification = htonl ( id ) ; }

Fix:
<S2SV_ModStart> ip6_idents_hashrnd __read_mostly ; static u32 ip6_idents_hashrnd_extra __read_mostly ; <S2SV_ModStart> sizeof ( ip6_idents_hashrnd ) ) ; net_get_random_once ( & ip6_idents_hashrnd_extra, sizeof ( ip6_idents_hashrnd_extra <S2SV_ModStart> hash ) ; hash = jhash_1word ( hash, ip6_idents_hashrnd_extra ) ;
Buggy code:
 static int xen_netbk_tx_check_gop ( struct xen_netbk * netbk, struct sk_buff * skb, struct gnttab_copy * * gopp ) { struct gnttab_copy * gop = * gopp ; u16 pending_idx = * ( ( u16 * ) skb -> data ) ; <START_BUG> struct pending_tx_info * pending_tx_info = netbk -> pending_tx_info ; <END_BUG> struct xenvif * vif = pending_tx_info [ pending_idx ]. vif ; struct xen_netif_tx_request * txp ; struct skb_shared_info * shinfo = skb_shinfo ( skb ) ; int nr_frags = shinfo -> nr_frags ; int i, err, start ; err = gop -> status ;  if ( unlikely ( err ) ) { <START_BUG> pending_ring_idx_t index ; index = pending_index ( netbk -> pending_prod ++ ) ; txp = & pending_tx_info [ pending_idx ]. req ; make_tx_response ( vif, txp, XEN_NETIF_RSP_ERROR ) ; <END_BUG> netbk -> pending_ring [ index ] = pending_idx ;  xenvif_put ( vif ) ; } start = ( frag_get_pending_idx ( & shinfo -> frags [ 0 ] ) == pending_idx ) ; for ( i = start ; i < nr_frags ; i ++ ) { int j, newerr ; <START_BUG> pending_ring_idx_t index ; <END_BUG> pending_idx = frag_get_pending_idx ( & shinfo -> frags [ i ] ) ; newerr = ( ++ gop ) -> status ; if ( likely (! newerr ) ) { if ( unlikely ( err ) )  xen_netbk_idx_release ( netbk, pending_idx ) ; <START_BUG> continue ; } <END_BUG> txp = & netbk -> pending_tx_info [ pending_idx ]. req ;  make_tx_response ( vif, txp, XEN_NETIF_RSP_ERROR ) ; <START_BUG> index = pending_index ( netbk -> pending_prod ++ ) ; <END_BUG> netbk -> pending_ring [ index ] = pending_idx ; xenvif_put ( vif ) ; if ( err

Fix:
<S2SV_ModStart> ) ; struct <S2SV_ModEnd> skb_shared_info * shinfo <S2SV_ModStart> err ) ) xen_netbk_idx_release ( netbk, pending_idx <S2SV_ModEnd>, XEN_NETIF_RSP_ERROR ) <S2SV_ModStart> XEN_NETIF_RSP_ERROR ) ; <S2SV_ModEnd> start = ( <S2SV_ModStart>, newerr ; <S2SV_ModEnd> pending_idx = frag_get_pending_idx <S2SV_ModStart> netbk, pending_idx, XEN_NETIF_RSP_OKAY <S2SV_ModStart> continue ; } xen_netbk_idx_release ( netbk, pending_idx <S2SV_ModEnd>, XEN_NETIF_RSP_ERROR ) <S2SV_ModStart> XEN_NETIF_RSP_ERROR ) ; <S2SV_ModEnd> if ( err <S2SV_ModStart> netbk, pending_idx, XEN_NETIF_RSP_OKAY <S2SV_ModStart> netbk, pending_idx, XEN_NETIF_RSP_OKAY
Buggy code:
 static int jp2_cdef_getdata ( jp2_box_t * box, jas_stream_t * in ) { jp2_cdef_t * cdef = & box -> data. cdef ; jp2_cdefchan_t * chan ; <START_BUG> unsigned int channo ; <END_BUG> if ( jp2_getuint16 ( in, & cdef -> numchans ) ) { return - 1 ; } if (! ( cdef -> ents = jas_alloc2 ( cdef -> numchans, sizeof ( jp2_cdefchan_t ) ) ) ) { return - 1 ; } for ( channo = 0 ; channo < cdef -> numchans ; ++ channo ) { chan = & cdef -> ents [ channo ] ; if ( jp2_getuint16 ( in, & chan -> channo ) || jp2_getuint16 ( in, & chan -> type ) || jp2_getuint16 ( in, & chan -> assoc ) ) { return - 1 ; } } return 0 ; }

Fix:
<S2SV_ModStart> unsigned int channo ; cdef -> ents = 0
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_init_video_state ( dec_state_t * ps_dec, e_video_type_t e_video_type ) { if ( e_video_type == MPEG_1_VIDEO ) { ps_dec -> u2_is_mpeg2 = 0 ; ps_dec -> u2_progressive_sequence = 1 ; ps_dec -> u2_intra_dc_precision = 0 ; ps_dec -> u2_picture_structure = FRAME_PICTURE ; ps_dec -> u2_frame_pred_frame_dct = 1 ; ps_dec -> u2_concealment_motion_vectors = 0 ; ps_dec -> u2_q_scale_type = 0 ; ps_dec -> u2_intra_vlc_format = 0 ; ps_dec -> u2_alternate_scan = 0 ; ps_dec -> u2_repeat_first_field = 0 ; ps_dec -> u2_progressive_frame = 1 ; ps_dec -> u2_frame_rate_extension_n = 0 ; ps_dec -> u2_frame_rate_extension_d = 0 ; <START_BUG> ps_dec -> pf_vld_inv_quant = impeg2d_vld_inv_quant_mpeg1 ; <END_BUG> } else { ps_dec -> u2_is_mpeg2 = 1 ; ps_dec -> u2_full_pel_forw_vector = 0 ; ps_dec -> u2_forw_f_code = 7 ; ps_dec -> u2_full_pel_back_vector = 0 ; ps_dec -> u2_back_f_code = 7 ; ps_dec -> pf_vld_inv_quant = impeg2d_vld_inv_quant_mpeg2 ; } impeg2d_init_function_ptr ( ps_dec ) ; ps_dec -> u2_frame_height = ALIGN16 ( ps_dec -> u2_vertical_size ) ; ps_dec -> u2_frame_width = ALIGN16 ( ps_dec -> u2_horizontal_size ) ; ps_dec -> u2_num_horiz_mb = ( ps_dec -> u2_horizontal_size +

Fix:
<S2SV_ModStart> ; ps_dec -> u2_forw_f_code = 7 ; ps_dec -> u2_back_f_code = 7 ; ps_dec ->
Buggy code:
 static int cmd_handle_untagged ( struct ImapData * idata ) { unsigned int count = 0 ; char * s = imap_next_word ( idata -> buf ) ; char * pn = imap_next_word ( s ) ; if ( ( idata -> state >= IMAP_SELECTED ) && isdigit ( ( unsigned char ) * s ) ) { pn = s ; s = imap_next_word ( s ) ; if ( mutt_str_strncasecmp ( "EXISTS", s, 6 ) == 0 ) { mutt_debug ( 2, "Handling   EXISTS\\n" ) ; if ( mutt_str_atoui ( pn, & count ) < 0 ) { mutt_debug ( 1, "Malformed   EXISTS:   \'%s\'\\n", pn ) ; } if (! ( idata -> reopen & IMAP_EXPUNGE_PENDING ) && count < idata -> max_msn ) { mutt_debug ( 1, "Message   count   is   out   of   sync\\n" ) ; return 0 ; } else if ( count == idata -> max_msn ) mutt_debug ( 3, "superfluous   EXISTS   message.\\n" ) ; else { if (! ( idata -> reopen & IMAP_EXPUNGE_PENDING ) ) { mutt_debug ( 2, "New   mail   in   %s   -   %d   messages   total.\\n", idata -> mailbox, count ) ; idata -> reopen |= IMAP_NEWMAIL_PENDING ; } idata -> new_mail_count = count ; } } else if ( mutt_str_strncasecmp ( "EXPUNGE", s, 7 ) == 0 ) cmd_parse_expunge ( idata, pn ) ; else if ( mutt_str_strncasecmp ( "FETCH", s, 5 ) == 0 ) cmd_parse_fetch ( idata, pn ) ; } else if ( mutt_str_strncasecmp ( "CAPABILITY", s, 10 ) == 0 ) cmd_parse_capability ( idata, s ) ; else if ( mutt_str_strncasecmp ( "OK   [CAPABILITY", s, 14 ) == 0 ) cmd_parse_capability ( idata, pn )

Fix:
<S2SV_ModStart>, s + 2 <S2SV_ModEnd> ) ; }
Buggy code:
 WORD32 ihevcd_decode ( iv_obj_t * ps_codec_obj, void * pv_api_ip, void * pv_api_op ) { WORD32 ret = IV_SUCCESS ; codec_t * ps_codec = ( codec_t * ) ( ps_codec_obj -> pv_codec_handle ) ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; WORD32 proc_idx = 0 ; WORD32 prev_proc_idx = 0 ; ps_codec -> i4_error_code = 0 ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } if ( ps_codec -> i4_init_done!= 1 ) { ps_dec_op -> u4_error_code |= 1 << IVD_FATALERROR ; ps_dec_op -> u4_error_code |= IHEVCD_INIT_NOT_DONE ; return IV_FAIL ; } if ( ps_codec -> u4_pic_cnt >= NUM_FRAMES_LIMIT ) { ps_dec_op -> u4_error_code |= 1 << IVD_FATALERROR ; ps_dec_op -> u4_error_code |= IHEVCD_NUM_FRAMES_LIMIT_REACHED ; return IV_FAIL ; } if ( ps_codec -> i4_reset_flag ) { ps_codec -> i4_flush_mode = 1 ; } if ( 0 == ps_codec -> i4_flush_mode ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_BS_BUF_

Fix:
<S2SV_ModStart> { ps_codec -> <S2SV_ModEnd> pu1_inp_bitsbuf += (
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowDCMException ( exception, message ) { if ( info. scale!= ( Quantum * ) NULL ) info. scale = ( Quantum * ) RelinquishMagickMemory ( info. scale ) ; if ( data!= ( unsigned char * ) NULL ) data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; if ( graymap!= ( int * ) NULL ) graymap = ( int * ) RelinquishMagickMemory ( graymap ) ; if ( bluemap!= ( int * ) NULL ) bluemap = ( int * ) RelinquishMagickMemory ( bluemap ) ; if ( greenmap!= ( int * ) NULL ) greenmap = ( int * ) RelinquishMagickMemory ( greenmap ) ; if ( redmap!= ( int * ) NULL ) redmap = ( int * ) RelinquishMagickMemory ( redmap ) ; if ( stream_info -> offsets!= ( ssize_t * ) NULL ) stream_info -> offsets = ( ssize_t * ) RelinquishMagickMemory ( stream_info -> offsets ) ; if ( stream_info!= ( DCMStreamInfo * ) NULL ) stream_info = ( DCMStreamInfo * ) RelinquishMagickMemory ( stream_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char explicit_vr [ MagickPathExtent ], implicit_vr [ MagickPathExtent ], magick [ MagickPathExtent ], photometric [ MagickPathExtent ] ; DCMInfo info ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, * redmap ; MagickBooleanType explicit_file, explicit_retry, use_explicit ; MagickOffsetType offset ; register unsigned char * p ; register ssize_t i ; size_t colors, height, length, number_scenes, quantum, status, width ; ssize_t count, scene ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( info <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char explicit_vr [ <S2SV_ModStart> break ; } if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 WORD32 ih264d_parse_inter_slice_data_cabac ( dec_struct_t * ps_dec, dec_slice_params_t * ps_slice, UWORD16 u2_first_mb_in_slice ) { UWORD32 uc_more_data_flag ; WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2, u1_mb_idx ; UWORD32 u1_mbaff ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD16 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end = 0 ; UWORD32 u1_tfr_n_mb = 0 ; UWORD32 u1_decode_nmb = 0 ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data = ps_dec -> ps_parse_mb_data ; UWORD32 u1_inter_mb_skip_type ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD32 u1_mb_threshold ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; WORD32 ret = OK ; if ( ps_slice -> u1_slice_type == P_SLICE ) { u1_inter_mb_skip_type = CAB_P_SKIP ; u1_inter_mb_type = P_MB ; u1_deblk_mb_type = D_INTER_MB ; u1_mb_threshold = 5 ; } else { u1_inter_mb_skip_type = CAB_B_SKIP ; u1_inter_mb_type = B_MB ; u1_deblk_mb_type = D_B_SLICE ; u1_mb_threshold = 23 ; } i2_cur_mb_addr = u2_first

Fix:
<S2SV_ModStart> u1_num_mbs ++ ; <S2SV_ModEnd> u1_num_mbsNby2 ++ ; <S2SV_ModStart> ) ; } ps_dec -> u2_total_mbs_coded += u1_num_mbs ;
Buggy code:
 void l2tp_packet_print ( const struct l2tp_packet_t * pack, void ( * print ) ( const char * fmt,... ) ) { const struct l2tp_attr_t * attr ; const struct l2tp_dict_value_t * val ; <START_BUG> if ( pack -> hdr. ver == 2 ) { <END_BUG> print ( "[L2TP   tid=%u   sid=%u", ntohs ( pack -> hdr. tid ), ntohs ( pack -> hdr. sid ) ) ; log_ppp_debug ( "   Ns=%u   Nr=%u", ntohs ( pack -> hdr. Ns ), ntohs ( pack -> hdr. Nr ) ) ;  } else { <START_BUG> print ( "[L2TP   cid=%u", pack -> hdr. cid ) ; <END_BUG> log_ppp_debug ( "   Ns=%u   Nr=%u", ntohs ( pack -> hdr. Ns ), ntohs ( pack -> hdr. Nr ) ) ;  } list_for_each_entry ( attr, & pack -> attrs, entry ) { print ( "   <%s", attr -> attr -> name ) ; val = l2tp_dict_find_value ( attr -> attr, attr -> val ) ; if ( val ) print ( "   %s", val -> name ) ; else if ( attr -> H ) print ( "   (hidden,   %hu   bytes)", attr -> length ) ; else { switch ( attr -> attr -> type ) { case ATTR_TYPE_INT16 : print ( "   %i", attr -> val. int16 ) ; break ; case ATTR_TYPE_INT32 : print ( "   %i", attr -> val. int32 ) ; break ; case ATTR_TYPE_STRING : print ( "   %s", attr -> val. string ) ; break ; } } print ( ">" ) ; } print ( "]\\n" ) ; }

Fix:
<S2SV_ModStart> * val ; switch ( pack -> hdr. flags & L2TP_VER_MASK ) { case 2 : <S2SV_ModEnd> print ( "[L2TP <S2SV_blank> tid=%u <S2SV_blank> sid=%u" <S2SV_ModStart> ) ) ; break ; case 3 : <S2SV_ModEnd> print ( "[L2TP <S2SV_blank> cid=%u" <S2SV_ModStart> Nr ) ) ; break ; default : print ( "[L2TP <S2SV_blank> unknown <S2SV_blank> version]\\n" ) ; return
Buggy code:
 error_t ftpClientParseDirEntry ( char_t * line, FtpDirEntry * dirEntry ) { uint_t i ; size_t n ; char_t * p ; char_t * token ; static const char_t months [ 13 ] [ 4 ] = { "       ", "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" } ; token = osStrtok_r ( line, "   \\t", & p ) ; if ( token == NULL ) return ERROR_INVALID_SYNTAX ; if ( osIsdigit ( token [ 0 ] ) ) { if ( osStrlen ( token ) == 8 && token [ 2 ] == '-' && token [ 5 ] == '-' ) { dirEntry -> modified. month = ( uint8_t ) osStrtoul ( token, NULL, 10 ) ; dirEntry -> modified. day = ( uint8_t ) osStrtoul ( token + 3, NULL, 10 ) ; dirEntry -> modified. year = ( uint16_t ) osStrtoul ( token + 6, NULL, 10 ) + 2000 ; } else if ( osStrlen ( token ) == 10 && token [ 2 ] == '//' && token [ 5 ] == '//' ) { dirEntry -> modified. month = ( uint8_t ) osStrtoul ( token, NULL, 10 ) ; dirEntry -> modified. day = ( uint8_t ) osStrtoul ( token + 3, NULL, 10 ) ; dirEntry -> modified. year = ( uint16_t ) osStrtoul ( token + 6, NULL, 10 ) ; } else { return ERROR_INVALID_SYNTAX ; } token = osStrtok_r ( NULL, "   ", & p ) ; if ( token == NULL ) return ERROR_INVALID_SYNTAX ; if ( osStrlen ( token ) >= 5 && token [ 2 ] == ':' ) { dirEntry -> modified. hours = ( uint8_t ) osStrtoul ( token, NULL, 10 ) ; dirEntry -> modified. minutes = ( uint8_t ) osStrtoul ( token + 3, NULL, 10 ) ; <START_BUG> if ( strstr ( token<END_BUG>

Fix:
<S2SV_ModStart> ; if ( osStrstr <S2SV_ModEnd> ( token, <S2SV_ModStart>!= NULL ) { <S2SV_ModStart> 12 ; } } <S2SV_ModStart> { if ( osStrchr <S2SV_ModEnd> ( token, <S2SV_ModStart>!= NULL ) { <S2SV_ModStart> |= FTP_FILE_ATTR_DIRECTORY ; } if ( osStrchr <S2SV_ModEnd> ( token, <S2SV_ModStart> == NULL ) { <S2SV_ModStart> |= FTP_FILE_ATTR_READ_ONLY ; }
Buggy code:
 <START_BUG> void ntlm_write_message_fields ( wStream * s, NTLM_MESSAGE_FIELDS * fields ) <END_BUG> { if ( fields -> MaxLen < 1 ) fields -> MaxLen = fields -> Len ; Stream_Write_UINT16 ( s, fields -> Len ) ; Stream_Write_UINT16 ( s, fields -> MaxLen ) ; Stream_Write_UINT32 ( s, fields -> BufferOffset ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 <START_BUG> static int read_intra_segment_id ( VP9_COMMON * const cm, MACROBLOCKD * const xd, <END_BUG> int mi_row, int mi_col, vp9_reader * r ) {  struct segmentation * const seg = & cm -> seg ; <START_BUG> const BLOCK_SIZE bsize = xd -> mi [ 0 ] -> mbmi. sb_type ; int segment_id ; if (! seg -> enabled ) return 0 ; <END_BUG> if (! seg -> update_map )  <START_BUG> return 0 ; <END_BUG> segment_id = read_segment_id ( r, seg ) ;  set_segment_id ( cm, bsize, mi_row, mi_col, segment_id ) ; <START_BUG> return segment_id ; }<END_BUG>

Fix:
<S2SV_ModStart> const cm, int mi_offset, int x_mis, int y_mis, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> cm -> seg <S2SV_ModEnd> ; int segment_id <S2SV_ModStart> -> update_map ) { copy_segment_id ( cm, cm -> last_frame_seg_map, cm -> current_frame_seg_map, mi_offset, x_mis, y_mis ) ; <S2SV_ModStart> return 0 ; } <S2SV_ModStart> ( cm, mi_offset, x_mis, y_mis <S2SV_ModEnd>, segment_id )
Buggy code:
 struct _mdi * _WM_ParseNewHmi ( uint8_t * hmi_data, uint32_t hmi_size ) { uint32_t hmi_tmp = 0 ; uint8_t * hmi_base = hmi_data ; <START_BUG> uint16_t hmi_bpm = 0 ; <END_BUG> uint16_t hmi_division = 0 ; uint32_t hmi_track_cnt = 0 ; uint32_t * hmi_track_offset = NULL ; uint32_t i = 0 ; uint32_t j = 0 ; uint8_t * hmi_addr = NULL ; uint32_t * hmi_track_header_length = NULL ; struct _mdi * hmi_mdi = NULL ; uint32_t tempo_f = 5000000.0 ; uint32_t * hmi_track_end = NULL ; uint8_t hmi_tracks_ended = 0 ; uint8_t * hmi_running_event = NULL ; uint32_t setup_ret = 0 ; uint32_t * hmi_delta = NULL ; uint32_t smallest_delta = 0 ; uint32_t subtract_delta = 0 ; uint32_t sample_count = 0 ; float sample_count_f = 0 ; float sample_remainder = 0 ; float samples_per_delta_f = 0.0 ; struct _note { uint32_t length ; uint8_t channel ;  } * note ; <START_BUG> UNUSED ( hmi_size ) ; if ( memcmp ( hmi_data, "HMI-MIDISONG061595", 18 ) ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_HMI, NULL, 0 ) ; return NULL ; } hmi_bpm = hmi_data [ 212 ] ; hmi_division = 60 ; hmi_track_cnt = hmi_data [ 228 ] ; hmi_mdi = _WM_initMDI ( ) ; _WM_midi_setup_divisions ( hmi_mdi, hmi_division ) ; if ( ( _WM_MixerOptions & WM_MO_ROUNDTEMPO ) ) { tempo_f = ( float ) (<END_BUG>

Fix:
<S2SV_ModStart> = hmi_data ; uint32_t data_siz ; <S2SV_ModStart> } * note <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; if ( hmi_track_offset [ i ] >= hmi_size ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_HMI, "file <S2SV_blank> too <S2SV_blank> short", 0 ) ; goto _hmi_end ; } data_siz = hmi_size - hmi_track_offset [ i ] ; if ( <S2SV_ModStart> += hmi_tmp ; hmi_tmp += 4 ; <S2SV_ModStart> += 4 ; hmi_tmp = 8 ; } else { hmi_tmp = 4 ; } hmi_data <S2SV_ModEnd> += 4 ; <S2SV_ModStart> += 4 ; hmi_track_offset [ i ] += 4 ; if ( hmi_tmp > data_siz ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_HMI, "file <S2SV_blank> too <S2SV_blank> short", 0 ) ; goto _hmi_end ; } data_siz -= hmi_tmp ; <S2SV_ModStart> hmi_mdi, hmi_data, data
Buggy code:
 void rfbReleaseClientIterator ( rfbClientIteratorPtr iterator ) { <START_BUG> if ( iterator -> next ) rfbDecrClientRef ( iterator -> next ) ; <END_BUG> free ( iterator ) ; }

Fix:
<S2SV_ModStart> { if ( iterator &&
Buggy code:
 bgp_attr_parse_ret_t bgp_attr_parse ( struct peer * peer, struct attr * attr, bgp_size_t size, struct bgp_nlri * mp_update, struct bgp_nlri * mp_withdraw ) { bgp_attr_parse_ret_t ret ; uint8_t flag = 0 ; uint8_t type = 0 ; bgp_size_t length ; uint8_t * startp, * endp ; uint8_t * attr_endp ; uint8_t seen [ BGP_ATTR_BITMAP_SIZE ] ; struct aspath * as4_path = NULL ; as_t as4_aggregator = 0 ; struct in_addr as4_aggregator_addr = {. s_addr = 0 } ; memset ( seen, 0, BGP_ATTR_BITMAP_SIZE ) ; endp = BGP_INPUT_PNT ( peer ) + size ; while ( BGP_INPUT_PNT ( peer ) < endp ) { if ( endp - BGP_INPUT_PNT ( peer ) < BGP_ATTR_MIN_LEN ) { flog_warn ( EC_BGP_ATTRIBUTE_TOO_SMALL, "%s:   error   BGP   attribute   length   %lu   is   smaller   than   min   len", peer -> host, ( unsigned long ) ( endp - stream_pnt ( BGP_INPUT ( peer ) ) ) ) ; bgp_notify_send ( peer, BGP_NOTIFY_UPDATE_ERR, BGP_NOTIFY_UPDATE_ATTR_LENG_ERR ) ; return BGP_ATTR_PARSE_ERROR ; } startp = BGP_INPUT_PNT ( peer ) ; flag = 0xF0 & stream_getc ( BGP_INPUT ( peer ) ) ; type = stream_getc ( BGP_INPUT ( peer ) ) ; if ( CHECK_FLAG ( flag, BGP_ATTR_FLAG_EXTLEN ) && ( ( endp - startp ) < ( BGP_ATTR_MIN_LEN + 1 ) ) ) { flog_warn ( EC_BGP_EXT_ATTRIBUTE_TOO_SMALL, "%s:   Extended   length   set,   but   just   %lu   bytes   of   attr   header", peer -> host, ( unsigned long ) ( endp - stream_pnt ( BGP

Fix:
<S2SV_ModStart> ; # if ENABLE_BGP_VNC_ATTR <S2SV_ModEnd> case BGP_ATTR_VNC :
Buggy code:
 static int snd_ctl_elem_add ( struct snd_ctl_file * file, struct snd_ctl_elem_info * info, int replace ) { struct snd_card * card = file -> card ; struct snd_kcontrol kctl, * _kctl ; unsigned int access ; long private_size ; struct user_element * ue ; int idx, err ; <START_BUG> if (! replace && card -> user_ctl_count >= MAX_USER_CONTROLS ) <END_BUG>  return - ENOMEM ; <START_BUG> if ( info -> count < 1 ) return - EINVAL ; access = info -> access == 0? SNDRV_CTL_ELEM_ACCESS_READWRITE : ( info -> access & ( SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_INACTIVE | SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE ) ) ; info -> id. numid = 0 ; memset ( & kctl, 0, sizeof ( kctl ) ) ; down_write ( & card -> controls_rwsem ) ; _kctl = snd_ctl_find_id ( card, & info -> id ) ; err = 0 ; if ( _kctl ) { if ( replace ) err = snd_ctl_remove ( card, _kctl ) ; else err = - EBUSY ; } else { if ( replace ) err = - ENOENT ; } up_write ( & card -> controls_rwsem ) ; if ( err < 0 ) return err ; memcpy ( & kctl. id, & info -> id, sizeof ( info -> id ) ) ; kctl. count = info -> owner? info -> owner : 1 ; access |= SNDRV_CTL_ELEM_ACCESS_USER ; if ( info -> type == SNDRV_CTL_ELEM_TYPE_ENUMERATED ) kctl. info = snd_ctl_elem_user_enum_info ; else kctl. info = snd_ctl_elem_user_info ; if ( access & SNDRV_CTL_ELEM_ACCESS_READ ) kctl. get = snd_ctl_elem_user_get ; if ( access & SNDRV_CTL_ELEM_ACCESS_WRITE ) kctl. put =<END_BUG>

Fix:
<S2SV_ModStart> ; if ( info -> count < 1 ) return - EINVAL ; access = info -> access == 0? SNDRV_CTL_ELEM_ACCESS_READWRITE : ( info -> access & ( SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_INACTIVE | SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE ) ) ; info -> id. numid = 0 ; memset ( & kctl, 0, sizeof ( kctl ) ) ; if ( replace ) { err = snd_ctl_remove_user_ctl ( file, & info -> id ) ; if ( err ) return err ; } if ( <S2SV_ModEnd> card -> user_ctl_count <S2SV_ModStart> return - ENOMEM <S2SV_ModEnd> ; memcpy (
Buggy code:
 static int proc_sys_readdir ( struct file * file, struct dir_context * ctx ) { struct ctl_table_header * head = grab_header ( file_inode ( file ) ) ; struct ctl_table_header * h = NULL ; struct ctl_table * entry ; struct ctl_dir * ctl_dir ; unsigned long pos ; if ( IS_ERR ( head ) ) return PTR_ERR ( head ) ; ctl_dir = container_of ( head, struct ctl_dir, header ) ; if (! dir_emit_dots ( file, ctx ) ) <START_BUG> return 0 ; <END_BUG> pos = 2 ; for ( first_entry ( ctl_dir, & h, & entry ) ; h ; next_entry ( & h, & entry ) ) { if (! scan ( h, entry, & pos, file, ctx ) ) { sysctl_head_finish ( h ) ; break ; } }  sysctl_head_finish ( head ) ; <START_BUG> return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ctx ) ) goto out <S2SV_ModEnd> ; pos = <S2SV_ModStart> ; } } out :
Buggy code:
 int phar_parse_zipfile ( php_stream * fp, char * fname, int fname_len, char * alias, int alias_len, phar_archive_data * * pphar, char * * error ) { phar_zip_dir_end locator ; char buf [ sizeof ( locator ) + 65536 ] ; zend_long size ; php_uint16 i ; phar_archive_data * mydata = NULL ; phar_entry_info entry = { 0 } ; char * p = buf, * ext, * actual_alias = NULL ; char * metadata = NULL ; size = php_stream_tell ( fp ) ; if ( size > sizeof ( locator ) + 65536 ) { size = sizeof ( locator ) + 65536 ; if ( FAILURE == php_stream_seek ( fp, - size, SEEK_END ) ) { php_stream_close ( fp ) ; if ( error ) { spprintf ( error, 4096, "phar   error:   unable   to   search   for   end   of   central   directory   in   zip-based   phar   \\"%s\\"", fname ) ; } return FAILURE ; } } else { php_stream_seek ( fp, 0, SEEK_SET ) ; } if (! php_stream_read ( fp, buf, size ) ) { php_stream_close ( fp ) ; if ( error ) { spprintf ( error, 4096, "phar   error:   unable   to   read   in   data   to   search   for   end   of   central   directory   in   zip-based   phar   \\"%s\\"", fname ) ; } return FAILURE ; } while ( ( p = ( char * ) memchr ( p + 1, 'P', ( size_t ) ( size - ( p + 1 - buf ) ) ) )!= NULL ) { if ( ( p - buf ) + sizeof ( locator ) <= size &&! memcmp ( p + 1, "K\\5\\6", 3 ) ) { memcpy ( ( void * ) & locator, ( void * ) p, sizeof ( locator ) ) ; if ( PHAR_GET_16 ( locator. centraldisk )!= 0 || PHAR_GET_16 ( locator. disknumber )!= 0 ) { php_stream_close ( fp ) ; if ( error ) { sp

Fix:
<S2SV_ModStart> entry. uncompressed_filesize || read <= 8
Buggy code:
 static int __load_segment_descriptor ( struct x86_emulate_ctxt * ctxt, <START_BUG> u16 selector, int seg, u8 cpl, bool in_task_switch ) <END_BUG> { struct desc_struct seg_desc, old_desc ; u8 dpl, rpl ; unsigned err_vec = GP_VECTOR ; u32 err_code = 0 ; bool null_selector =! ( selector & ~ 0x3 ) ; ulong desc_addr ; int ret ; u16 dummy ; u32 base3 = 0 ; memset ( & seg_desc, 0, sizeof seg_desc ) ; if ( ctxt -> mode == X86EMUL_MODE_REAL ) { ctxt -> ops -> get_segment ( ctxt, & dummy, & seg_desc, NULL, seg ) ; set_desc_base ( & seg_desc, selector << 4 ) ; goto load ; } else if ( seg <= VCPU_SREG_GS && ctxt -> mode == X86EMUL_MODE_VM86 ) { set_desc_base ( & seg_desc, selector << 4 ) ; set_desc_limit ( & seg_desc, 0xffff ) ; seg_desc. type = 3 ; seg_desc. p = 1 ; seg_desc. s = 1 ; seg_desc. dpl = 3 ; goto load ; } rpl = selector & 3 ; if ( ( seg == VCPU_SREG_CS || ( seg == VCPU_SREG_SS && ( ctxt -> mode!= X86EMUL_MODE_PROT64 || rpl!= cpl ) ) || seg == VCPU_SREG_TR ) && null_selector ) goto exception ; if ( seg == VCPU_SREG_TR && ( selector & ( 1 << 2 ) ) ) goto exception ; if ( null_selector ) goto load ; ret = read_segment_descriptor ( ctxt, selector, & seg_desc, & desc_addr ) ; if ( ret!= X86EMUL_CONTINUE ) return ret ; err_code = selector & 0xfffc ; err_vec = in_task_switch? TS_VECTOR : GP_VECTOR ; if ( seg <= VCPU_SREG_GS &&! seg_desc. s ) goto exception ; if (! seg_desc. p ) { err_vec = ( seg == VCPU_SREG_

Fix:
<S2SV_ModStart>, bool in_task_switch, struct desc_struct * desc <S2SV_ModStart> seg ) ; if ( desc ) * desc = seg_desc ;
Buggy code:
 int obj2ast_stmt ( PyObject * obj, stmt_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; int lineno ; int col_offset ; int end_lineno ; int end_col_offset ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } if ( _PyObject_LookupAttrId ( obj, & PyId_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   stmt" ) ; return 1 ; } else { int res ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_col_offset, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required   field   \\"col_offset\\"   missing   from   stmt" ) ; return 1 ; } else { int res ; res = obj2ast_int ( tmp, & col_offset, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_end_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; end_lineno = 0 ; } else { int res ; res = obj2ast_int ( tmp, & end_lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_end_col_offset, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; end_col_offset = 0 ; } else { int res ; res = obj2ast_int ( tmp, & end_col_offset, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } isinstance

Fix:
<S2SV_ModStart> ; expr_ty returns ; string type_comment <S2SV_ModStart> ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_type_comment, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; type_comment = NULL ; } else { int res ; res = obj2ast_string ( tmp, & type_comment, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } <S2SV_ModStart>, returns, type_comment, <S2SV_ModStart> ; expr_ty returns ; string type_comment <S2SV_ModStart> ) ; } if ( _PyObject_LookupAttrId ( obj, & PyId_type_comment, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; type_comment = NULL ; } else { int res ; res = obj2ast_string ( tmp, & type_comment, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } <S2SV_ModStart>, returns, type_comment, <S2SV_ModStart> expr_ty value ;
Buggy code:
 static struct vm_area_struct * vma_to_resize ( unsigned long addr, unsigned long old_len, unsigned long new_len, unsigned long * p ) { struct mm_struct * mm = current -> mm ; struct vm_area_struct * vma = find_vma ( mm, addr ) ; if (! vma || vma -> vm_start > addr ) goto Efault ; if ( is_vm_hugetlb_page ( vma ) ) goto Einval ; if ( old_len > vma -> vm_end - addr ) goto Efault ; <START_BUG> if ( vma -> vm_flags & ( VM_DONTEXPAND | VM_PFNMAP ) ) { <END_BUG> if ( new_len > old_len ) goto Efault ; } if ( vma -> vm_flags & VM_LOCKED ) { unsigned long locked, lock_limit ; locked = mm -> locked_vm << PAGE_SHIFT ; lock_limit = rlimit ( RLIMIT_MEMLOCK ) ; locked += new_len - old_len ; if ( locked > lock_limit &&! capable ( CAP_IPC_LOCK ) ) goto Eagain ; } if (! may_expand_vm ( mm, ( new_len - old_len ) >> PAGE_SHIFT ) ) goto Enomem ; if ( vma -> vm_flags & VM_ACCOUNT ) { unsigned long charged = ( new_len - old_len ) >> PAGE_SHIFT ; if ( security_vm_enough_memory ( charged ) ) goto Efault ; * p = charged ; } return vma ; Efault : return ERR_PTR ( - EFAULT ) ; Einval : return ERR_PTR ( - EINVAL ) ; Enomem : return ERR_PTR ( - ENOMEM ) ; Eagain : return ERR_PTR ( - EAGAIN ) ; }

Fix:
<S2SV_ModStart> ; if ( new_len > old_len ) { unsigned long pgoff ; if ( <S2SV_ModStart> VM_PFNMAP ) ) goto Efault ; pgoff = ( addr - vma -> vm_start ) >> PAGE_SHIFT ; pgoff += vma -> vm_pgoff ; if ( pgoff + ( new_len >> PAGE_SHIFT ) < pgoff ) goto Einval <S2SV_ModEnd> ; } if
Buggy code:
 void vp8_copy_mem8x8_c ( unsigned char * src, int src_stride, unsigned char * dst, int dst_stride ) { int r ; for ( r = 0 ; r < 8 ; r ++ ) { <START_BUG> # if! ( CONFIG_FAST_UNALIGNED ) <END_BUG> dst [ 0 ] = src [ 0 ] ; dst [ 1 ] = src [ 1 ] ; dst [ 2 ] = src [ 2 ] ; dst [ 3 ] = src [ 3 ] ; dst [ 4 ] = src [ 4 ] ; dst [ 5 ] = src [ 5 ] ; dst [ 6 ] = src [ 6 ] ; dst [ 7 ] = src [ 7 ] ; # else ( ( uint32_t * ) dst ) [ 0 ] = ( ( uint32_t * ) src ) [ 0 ] ; ( ( uint32_t * ) dst ) [ 1 ] = ( ( uint32_t * ) src ) [ 1 ] ; # endif src += src_stride ; dst += dst_stride ; } }

Fix:
<S2SV_ModStart> ++ ) { memcpy ( dst, src, 8 ) ; <S2SV_ModEnd> src += src_stride
Buggy code:
 <START_BUG> static void oidc_scrub_headers ( request_rec * r ) { <END_BUG> oidc_cfg * cfg = ap_get_module_config ( r -> server -> module_config, & auth_openidc_module ) ; if ( cfg -> scrub_request_headers!= 0 ) { oidc_scrub_request_headers ( r, OIDC_DEFAULT_HEADER_PREFIX, oidc_cfg_dir_authn_header ( r ) ) ; if ( ( strstr ( cfg -> claim_prefix, OIDC_DEFAULT_HEADER_PREFIX )!= cfg -> claim_prefix ) ) { oidc_scrub_request_headers ( r, cfg -> claim_prefix, NULL ) ; } } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> void oidc_scrub_headers (
Buggy code:
 void mono_runtime_shutdown ( void ) { mono_domain_foreach ( fire_process_exit_event, NULL ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> NULL ) ; mono_reflection_shutdown ( ) ;
Buggy code:
 static int pop_fetch_headers ( struct Context * ctx ) { struct PopData * pop_data = ( struct PopData * ) ctx -> data ; struct Progress progress ; # ifdef USE_HCACHE header_cache_t * hc = pop_hcache_open ( pop_data, ctx -> path ) ; # endif time ( & pop_data -> check_time ) ; pop_data -> clear_cache = false ; for ( int i = 0 ; i < ctx -> msgcount ; i ++ ) ctx -> hdrs [ i ] -> refno = - 1 ; const int old_count = ctx -> msgcount ; int ret = pop_fetch_data ( pop_data, "UIDL\\r\\n", NULL, fetch_uidl, ctx ) ; const int new_count = ctx -> msgcount ; ctx -> msgcount = old_count ; if ( pop_data -> cmd_uidl == 2 ) { if ( ret == 0 ) { pop_data -> cmd_uidl = 1 ; mutt_debug ( 1, "set   UIDL   capability\\n" ) ; } if ( ret == - 2 && pop_data -> cmd_uidl == 2 ) { pop_data -> cmd_uidl = 0 ; mutt_debug ( 1, "unset   UIDL   capability\\n" ) ; snprintf ( pop_data -> err_msg, sizeof ( pop_data -> err_msg ), "%s", _ ( "Command   UIDL   is   not   supported   by   server." ) ) ; } } if (! ctx -> quiet ) { mutt_progress_init ( & progress, _ ( "Fetching   message   headers..." ), MUTT_PROGRESS_MSG, ReadInc, new_count - old_count ) ; } if ( ret == 0 ) { int i, deleted ; for ( i = 0, deleted = 0 ; i < old_count ; i ++ ) { if ( ctx -> hdrs [ i ] -> refno == - 1 ) { ctx -> hdrs [ i ] -> deleted = true ; deleted ++ ; } } if ( deleted > 0 ) { mutt_error ( ngettext ( "%d   message   has   been   lost.   Try   reopening   the   mailbox.", "%d   messages   have   been   lost.   Try   re

Fix:
<S2SV_ModStart> -> bcache, cache_id ( ctx -> hdrs [ i ] -> data ) <S2SV_ModEnd> ) == 0