nus-yam/ex-repair huggingface dataset:
Buggy code:
 json_t * json_object ( void ) { json_object_t * object = jsonp_malloc ( sizeof ( json_object_t ) ) ; if (! object ) <START_BUG> return NULL ; <END_BUG> json_init ( & object -> json, JSON_OBJECT ) ; if ( hashtable_init ( & object -> hashtable ) ) { jsonp_free ( object ) ; return NULL ; } object -> serial = 0 ; object -> visited = 0 ; return & object -> json ; }

Fix:
<S2SV_ModStart> return NULL ; if (! hashtable_seed ) { json_object_seed ( 0 ) ; }
Buggy code:
 sctp_disposition_t sctp_sf_do_5_1D_ce ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * chunk = arg ; struct sctp_association * new_asoc ; sctp_init_chunk_t * peer_init ; struct sctp_chunk * repl ; struct sctp_ulpevent * ev, * ai_ev = NULL ; int error = 0 ; struct sctp_chunk * err_chk_p ; struct sock * sk ; if ( ep == sctp_sk ( net -> sctp. ctl_sock ) -> ep ) { SCTP_INC_STATS ( net, SCTP_MIB_OUTOFBLUES ) ; return sctp_sf_tabort_8_4_8 ( net, ep, asoc, type, arg, commands ) ; } if (! sctp_chunk_length_valid ( chunk, sizeof ( sctp_chunkhdr_t ) ) ) return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; sk = ep -> base. sk ; if (! sctp_sstate ( sk, LISTENING ) || ( sctp_style ( sk, TCP ) && sk_acceptq_is_full ( sk ) ) ) return sctp_sf_tabort_8_4_8 ( net, ep, asoc, type, arg, commands ) ; chunk -> subh. cookie_hdr = ( struct sctp_signed_cookie * ) chunk -> skb -> data ; if (! pskb_pull ( chunk -> skb, ntohs ( chunk -> chunk_hdr -> length ) - sizeof ( sctp_chunkhdr_t ) ) ) goto nomem ; new_asoc = sctp_unpack_cookie ( ep, asoc, chunk, GFP_ATOMIC, & error, & err_chk_p ) ; if (! new_asoc ) { switch ( error ) { case - SCTP_IERROR_NOMEM : goto nomem ; case - SCTP_IERROR_STALE_COOKIE : sctp_send_

Fix:
<S2SV_ModStart> sctp_ierror_t ret ; if (! net -> sctp. auth_enable ||! new_asoc -> peer. auth_capable ) { kfree_skb ( chunk -> auth_chunk ) ; sctp_association_free ( new_asoc ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; }
Buggy code:
 static void ov518_mode_init_regs ( struct sd * sd ) { struct gspca_dev * gspca_dev = ( struct gspca_dev * ) sd ; int hsegs, vsegs, packet_size ; struct usb_host_interface * alt ; struct usb_interface * intf ; intf = usb_ifnum_to_if ( sd -> gspca_dev. dev, sd -> gspca_dev. iface ) ; alt = usb_altnum_to_altsetting ( intf, sd -> gspca_dev. alt ) ; if (! alt ) { gspca_err ( gspca_dev, "Couldn\'t   get   altsetting\\n" ) ; sd -> gspca_dev. usb_err = - EIO ; return ; } <START_BUG> packet_size = le16_to_cpu ( alt -> endpoint [ 0 ]. desc. wMaxPacketSize ) ; <END_BUG> ov518_reg_w32 ( sd, R51x_FIFO_PSIZE, packet_size & ~ 7, 2 ) ; reg_w ( sd, 0x2b, 0 ) ; reg_w ( sd, 0x2c, 0 ) ; reg_w ( sd, 0x2d, 0 ) ; reg_w ( sd, 0x2e, 0 ) ; reg_w ( sd, 0x3b, 0 ) ; reg_w ( sd, 0x3c, 0 ) ; reg_w ( sd, 0x3d, 0 ) ; reg_w ( sd, 0x3e, 0 ) ; if ( sd -> bridge == BRIDGE_OV518 ) { reg_w_mask ( sd, 0x20, 0x08, 0x08 ) ; reg_w_mask ( sd, 0x28, 0x80, 0xf0 ) ; reg_w_mask ( sd, 0x38, 0x80, 0xf0 ) ; } else { reg_w ( sd, 0x28, 0x80 ) ; reg_w ( sd, 0x38, 0x80 ) ; } hsegs = sd -> gspca_dev. pixfmt. width // 16 ; vsegs = sd -> gspca_dev. pixfmt. height // 4 ; reg_w

Fix:
<S2SV_ModStart> return ; } if ( alt -> desc. bNumEndpoints < 1 ) { sd -> gspca_dev. usb_err = - ENODEV ; return ; }
Buggy code:
 int mem_check_range ( struct rxe_mem * mem, u64 iova, size_t length ) { switch ( mem -> type ) { case RXE_MEM_TYPE_DMA : return 0 ; case RXE_MEM_TYPE_MR : case RXE_MEM_TYPE_FMR : <START_BUG> return ( ( iova < mem -> iova ) || <END_BUG>  ( ( iova + length ) > ( mem -> iova + mem -> length ) ) )? <START_BUG> - EFAULT : 0 ; default : return - EFAULT ; } }<END_BUG>

Fix:
<S2SV_ModStart> case RXE_MEM_TYPE_FMR : if <S2SV_ModEnd> ( iova < <S2SV_ModStart> mem -> iova || length > mem -> length || iova > <S2SV_ModEnd> mem -> iova <S2SV_ModStart> mem -> length - length ) return - EFAULT ; return <S2SV_ModEnd> 0 ; default
Buggy code:
 static void is_skippable ( int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * argv ) { struct is_skippable_args * args = argv ; <START_BUG> args -> skippable [ 0 ] &= (! args -> x -> plane [ plane ]. eobs [ block ] ) ; <END_BUG> }

Fix:
<S2SV_ModStart> = argv ; ( void ) plane ; ( void ) plane_bsize ; ( void ) tx_size ; <S2SV_ModStart>! args -> <S2SV_ModEnd> eobs [ block
Buggy code:
 int mp_pack ( lua_State * L ) { int nargs = lua_gettop ( L ) ; int i ; mp_buf * buf ; if ( nargs == 0 ) return luaL_argerror ( L, 0, "MessagePack   pack   needs   input." ) ; if (! lua_checkstack ( L, nargs ) ) return luaL_argerror ( L, 0, "Too   many   arguments   for   MessagePack   pack." ) ; buf = mp_buf_new ( L ) ; for ( i = 1 ; i <= nargs ; i ++ ) { <START_BUG> lua_pushvalue ( L, i ) ; <END_BUG> mp_encode_lua_type ( L, buf, 0 ) ; lua_pushlstring ( L, ( char * ) buf -> b, buf -> len ) ; buf -> free += buf -> len ; buf -> len = 0 ; } mp_buf_free ( L, buf ) ; lua_concat ( L, nargs ) ; return 1 ; }

Fix:
<S2SV_ModStart> ++ ) { luaL_checkstack ( L, 1, "in <S2SV_blank> function <S2SV_blank> mp_check" ) ;
Buggy code:
 static int kvaser_usb_leaf_simple_cmd_async ( struct kvaser_usb_net_priv * priv, u8 cmd_id ) { struct kvaser_cmd * cmd ; int err ; <START_BUG> cmd = kmalloc ( sizeof ( * cmd ), GFP_ATOMIC ) ; <END_BUG> if (! cmd ) return - ENOMEM ; cmd -> len = CMD_HEADER_LEN + sizeof ( struct kvaser_cmd_simple ) ; cmd -> id = cmd_id ; cmd -> u. simple. channel = priv -> channel ; err = kvaser_usb_send_cmd_async ( priv, cmd, cmd -> len ) ; if ( err ) kfree ( cmd ) ; return err ; }

Fix:
<S2SV_ModStart> ; cmd = kzalloc <S2SV_ModEnd> ( sizeof (
Buggy code:
 static void doGet ( HttpRequest req, HttpResponse res ) { set_content_type ( res, "text//html" ) ; if ( ACTION ( HOME ) ) { LOCK ( Run. mutex ) do_home ( res ) ; END_LOCK ; <START_BUG> } else if ( ACTION ( RUN ) ) { <END_BUG>  handle_run ( req, res ) ; <START_BUG> } else if ( ACTION ( TEST ) ) { <END_BUG> is_monit_running ( res ) ;  } else if ( ACTION ( VIEWLOG ) ) { do_viewlog ( req, res ) ; } else if ( ACTION ( ABOUT ) ) { do_about ( res ) ; } else if ( ACTION ( FAVICON ) ) { printFavicon ( res ) ; } else if ( ACTION ( PING ) ) { do_ping ( res ) ; } else if ( ACTION ( GETID ) ) { do_getid ( res ) ; <START_BUG> } else if ( ACTION ( STATUS ) ) { <END_BUG> print_status ( req, res, 1 ) ; } else if ( ACTION ( STATUS2 ) ) { print_status ( req, res, 2 ) ; } else if ( ACTION ( SUMMARY ) ) { print_summary ( req, res ) ; } else if ( ACTION ( REPORT ) ) { _printReport ( req, res ) ; } else if ( ACTION ( DOACTION ) ) { handle_do_action ( req, res ) ; } else { handle_action ( req, res ) ; } }

Fix:
<S2SV_ModStart> ( ACTION ( RUNTIME <S2SV_ModEnd> ) ) { <S2SV_ModStart> ) ) { handle_runtime <S2SV_ModEnd> ( req, <S2SV_ModStart> { is_monit_running ( <S2SV_ModEnd> res ) ; <S2SV_ModStart> ; } else { handle_service <S2SV_ModEnd> ( req,
Buggy code:
 <START_BUG> static void write_selected_tx_size ( const VP9_COMP * cpi, <END_BUG> TX_SIZE tx_size, BLOCK_SIZE bsize,  vp9_writer * w ) { <START_BUG> const TX_SIZE max_tx_size = max_txsize_lookup [ bsize ] ; <END_BUG> const MACROBLOCKD * const xd = & cpi -> mb. e_mbd ;  const vp9_prob * const tx_probs = get_tx_probs2 ( max_tx_size, xd, <START_BUG> & cpi -> common. fc. tx_probs ) ; <END_BUG>  vp9_write ( w, tx_size!= TX_4X4, tx_probs [ 0 ] ) ; <START_BUG> if ( tx_size!= TX_4X4 && max_tx_size >= TX_16X16 ) { <END_BUG> vp9_write ( w, tx_size!= TX_8X8, tx_probs [ 1 ] ) ;  if ( tx_size!= TX_8X8 && max_tx_size >= TX_32X32 ) <START_BUG> vp9_write ( w, tx_size!= TX_16X16, tx_probs [ 2 ] ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> write_selected_tx_size ( const VP9_COMMON * cm, const MACROBLOCKD * xd, vpx_writer <S2SV_ModEnd> * w ) <S2SV_ModStart> w ) { TX_SIZE tx_size = xd -> mi [ 0 ] -> mbmi. tx_size ; BLOCK_SIZE bsize = xd -> mi [ 0 ] -> mbmi. sb_type ; <S2SV_ModStart> ] ; const vpx_prob <S2SV_ModEnd> * const tx_probs <S2SV_ModStart> xd, & cm -> fc -> <S2SV_ModEnd> tx_probs ) ; <S2SV_ModStart> tx_probs ) ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> TX_16X16 ) { vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> >= TX_32X32 ) vpx_write <S2SV_ModEnd> ( w,
Buggy code:
 long video_usercopy ( struct file * file, unsigned int cmd, unsigned long arg, v4l2_kioctl func ) { char sbuf [ 128 ] ; void * mbuf = NULL ; <START_BUG> void * parg = NULL ; <END_BUG> long err = - EINVAL ;  int is_ext_ctrl ; <START_BUG> size_t ctrls_size = 0 ; void __user * user_ptr = NULL ; is_ext_ctrl = ( cmd == VIDIOC_S_EXT_CTRLS || cmd == VIDIOC_G_EXT_CTRLS || cmd == VIDIOC_TRY_EXT_CTRLS ) ; switch ( _IOC_DIR ( cmd ) ) { <END_BUG> case _IOC_NONE :  parg = NULL ; break ; case _IOC_READ : <START_BUG> case _IOC_WRITE : <END_BUG> case ( _IOC_WRITE | _IOC_READ ) :  if ( _IOC_SIZE ( cmd ) <= sizeof ( sbuf ) ) { <START_BUG> parg = sbuf ; } else { mbuf = kmalloc ( _IOC_SIZE ( cmd ), GFP_KERNEL ) ; if ( NULL == mbuf ) return - ENOMEM ; parg = mbuf ; } err = - EFAULT ; if ( _IOC_DIR ( cmd ) & _IOC_WRITE ) if ( copy_from_user ( parg, ( void __user * ) arg, _IOC_SIZE ( cmd ) ) ) goto out ; break ; } if ( is_ext_ctrl ) { struct v4l2_ext_controls * p = parg ; p -> error_idx = p -> count ; user_ptr = ( void __user * ) p -> controls ; if ( p -> count ) { ctrls_size = sizeof ( struct v4l2_ext_control ) * p -> count ; mbuf = kmalloc ( ctrls_size, GFP_KERNEL ) ; err = - ENOMEM ; if ( NULL == mbuf ) goto out_ext_ctrl ; err = - EFAULT ; if ( copy_from_user ( mbuf, user_ptr, ctrls_size ) ) goto out_ext_ctrl ; p -> controls = mbuf ; } } err = func ( file, cmd, parg ) ; if ( err == - ENO<END_BUG>

Fix:
<S2SV_ModStart> * parg = ( void * ) arg ; long err = - EINVAL ; bool has_array_args ; size_t array_size = 0 ; void __user * user_ptr = NULL ; void * * kernel_ptr = NULL ; if ( _IOC_DIR ( cmd )!= _IOC_NONE ) { if ( _IOC_SIZE ( cmd ) <= sizeof ( sbuf ) ) { parg = sbuf ; } else { mbuf = kmalloc ( _IOC_SIZE ( cmd ), GFP_KERNEL ) ; if ( NULL == mbuf ) return - ENOMEM ; parg = mbuf ; } err = - EFAULT ; if ( _IOC_DIR ( cmd ) & _IOC_WRITE ) { unsigned long n = cmd_input_size ( cmd ) ; if ( copy_from_user ( parg, ( void __user * ) arg, n ) ) goto out ; if ( n < _IOC_SIZE ( cmd ) ) memset ( ( u8 * ) parg + n, 0, _IOC_SIZE ( cmd ) - n ) ; } else { memset ( parg, 0,
Buggy code:
 void bn_mul_comba4 ( BN_ULONG * r, BN_ULONG * a, BN_ULONG * b ) { <START_BUG> BN_ULONG t1, t2 ; <END_BUG> BN_ULONG c1, c2, c3 ; c1 = 0 ; c2 = 0 ; c3 = 0 ; mul_add_c ( a [ 0 ], b [ 0 ], c1, c2, c3 ) ; r [ 0 ] = c1 ; c1 = 0 ; mul_add_c ( a [ 0 ], b [ 1 ], c2, c3, c1 ) ; mul_add_c ( a [ 1 ], b [ 0 ], c2, c3, c1 ) ; r [ 1 ] = c2 ; c2 = 0 ; mul_add_c ( a [ 2 ], b [ 0 ], c3, c1, c2 ) ; mul_add_c ( a [ 1 ], b [ 1 ], c3, c1, c2 ) ; mul_add_c ( a [ 0 ], b [ 2 ], c3, c1, c2 ) ; r [ 2 ] = c3 ; c3 = 0 ; mul_add_c ( a [ 0 ], b [ 3 ], c1, c2, c3 ) ; mul_add_c ( a [ 1 ], b [ 2 ], c1, c2, c3 ) ; mul_add_c ( a [ 2 ], b [ 1 ], c1, c2, c3 ) ; mul_add_c ( a [ 3 ], b [ 0 ], c1, c2, c3 ) ; r [ 3 ] = c1 ; c1 = 0 ; mul_add_c ( a [ 3 ], b [ 1 ], c2, c3, c1 ) ; mul_add_c ( a [ 2 ], b [ 2 ], c2, c3, c1 ) ; mul_add_c ( a [ 1 ], b [ 3 ], c2, c3, c1 ) ; r [ 4 ] = c2 ; c2 = 0 ; mul_add_c ( a [ 2 ], b [ 3 ], c3, c1, c2 ) ; mul_

Fix:
<S2SV_ModStart> ) { BN_ULONG <S2SV_ModEnd> c1, c2
Buggy code:
 static const uint32_t * parserep ( netdissect_options * ndo, register const struct sunrpc_msg * rp, register u_int length ) { register const uint32_t * dp ; u_int len ; enum sunrpc_accept_stat astat ; dp = ( ( const uint32_t * ) & rp -> rm_reply ) + 1 ; ND_TCHECK ( dp [ 1 ] ) ; len = EXTRACT_32BITS ( & dp [ 1 ] ) ; if ( len >= length ) return ( NULL ) ; dp += ( len + ( 2 * sizeof ( uint32_t ) + 3 ) ) // sizeof ( uint32_t ) ; <START_BUG> ND_TCHECK2 ( dp [ 0 ], 0 ) ; <END_BUG> astat = ( enum sunrpc_accept_stat ) EXTRACT_32BITS ( dp ) ; if ( astat!= SUNRPC_SUCCESS ) { ND_PRINT ( ( ndo, "   %s", tok2str ( sunrpc_str, "ar_stat   %d", astat ) ) ) ; nfserr = 1 ; return ( NULL ) ; } ND_TCHECK2 ( * dp, sizeof ( astat ) ) ; return ( ( const uint32_t * ) ( sizeof ( astat ) + ( ( const char * ) dp ) ) ) ; trunc : return ( 0 ) ; }

Fix:
<S2SV_ModStart> uint32_t ) ; ND_TCHECK <S2SV_ModEnd> ( dp [ <S2SV_ModStart> [ 0 ] <S2SV_ModEnd> ) ; astat
Buggy code:
 sds sdsMakeRoomFor ( sds s, size_t addlen ) { void * sh, * newsh ; size_t avail = sdsavail ( s ) ; size_t len, newlen ; char type, oldtype = s [ - 1 ] & SDS_TYPE_MASK ; int hdrlen ; if ( avail >= addlen ) return s ; len = sdslen ( s ) ; sh = ( char * ) s - sdsHdrSize ( oldtype ) ; newlen = ( len + addlen ) ; <START_BUG> if ( newlen < SDS_MAX_PREALLOC ) <END_BUG> newlen *= 2 ; else newlen += SDS_MAX_PREALLOC ; type = sdsReqType ( newlen ) ; if ( type == SDS_TYPE_5 ) type = SDS_TYPE_8 ;  hdrlen = sdsHdrSize ( type ) ; <START_BUG> if ( oldtype == type ) { newsh = s_realloc ( sh, hdrlen + newlen + 1 ) ; if ( newsh == NULL ) return NULL ; s = ( char * ) newsh + hdrlen ; } else { newsh = s_malloc ( hdrlen + newlen + 1 ) ; if ( newsh == NULL ) return NULL ; memcpy ( ( char * ) newsh + hdrlen, s, len + 1 ) ; s_free ( sh ) ; s = ( char * ) newsh + hdrlen ; s [ - 1 ] = type ; sdssetlen ( s, len ) ; } sdssetalloc ( s, newlen ) ; return s ; }<END_BUG>

Fix:
<S2SV_ModStart> addlen ) ; assert ( newlen > len ) ; <S2SV_ModStart> sdsHdrSize ( type ) ; assert ( hdrlen + newlen + 1 > len
Buggy code:
 int vcc_getsockopt ( struct socket * sock, int level, int optname, char __user * optval, int __user * optlen ) { struct atm_vcc * vcc ; int len ; if ( get_user ( len, optlen ) ) return - EFAULT ; if ( __SO_LEVEL_MATCH ( optname, level ) && len!= __SO_SIZE ( optname ) ) return - EINVAL ; vcc = ATM_SD ( sock ) ; switch ( optname ) { case SO_ATMQOS : if (! test_bit ( ATM_VF_HASQOS, & vcc -> flags ) ) return - EINVAL ; return copy_to_user ( optval, & vcc -> qos, sizeof ( vcc -> qos ) )? - EFAULT : 0 ; case SO_SETCLP : return put_user ( vcc -> atm_options & ATM_ATMOPT_CLP? 1 : 0, ( unsigned long __user * ) optval )? - EFAULT : 0 ; case SO_ATMPVC : { struct sockaddr_atmpvc pvc ; if (! vcc -> dev ||! test_bit ( ATM_VF_ADDR, & vcc -> flags ) ) return - ENOTCONN ; <START_BUG> pvc. sap_family = AF_ATMPVC ; <END_BUG> pvc. sap_addr. itf = vcc -> dev -> number ; pvc. sap_addr. vpi = vcc -> vpi ; pvc. sap_addr. vci = vcc -> vci ; return copy_to_user ( optval, & pvc, sizeof ( pvc ) )? - EFAULT : 0 ; } default : if ( level == SOL_SOCKET ) return - EINVAL ; break ; } if (! vcc -> dev ||! vcc -> dev -> ops -> getsockopt ) return - EINVAL ; return vcc -> dev -> ops -> getsockopt ( vcc, level, optname, optval, len ) ; }

Fix:
<S2SV_ModStart> - ENOTCONN ; memset ( & pvc, 0, sizeof ( pvc ) ) ;
Buggy code:
 static inline int check_sticky ( struct inode * dir, struct inode * inode ) { kuid_t fsuid = current_fsuid ( ) ; if (! ( dir -> i_mode & S_ISVTX ) ) return 0 ; if ( uid_eq ( inode -> i_uid, fsuid ) ) return 0 ; if ( uid_eq ( dir -> i_uid, fsuid ) ) return 0 ; <START_BUG> return! inode_capable ( inode, CAP_FOWNER ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ; return! capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode,
Buggy code:
 static void start_daemon ( ) { struct usb_sock_t * usb_sock ; if ( g_options. noprinter_mode == 0 ) { usb_sock = usb_open ( ) ; if ( usb_sock == NULL ) goto cleanup_usb ; } else usb_sock = NULL ; uint16_t desired_port = g_options. desired_port ; <START_BUG> struct tcp_sock_t * tcp_socket ; <END_BUG>  while ( ( tcp_socket = tcp_open ( desired_port ) ) == NULL && <START_BUG> <END_BUG> g_options. only_desired_port == 0 ) {  desired_port ++ ; if ( desired_port == 1 || desired_port == 0 ) desired_port = 49152 ; <START_BUG> } <END_BUG> if ( tcp_socket == NULL ) goto cleanup_tcp ;  uint16_t real_port = tcp_port_number_get ( tcp_socket ) ; <START_BUG> if ( desired_port!= 0 && g_options. only_desired_port == 1 && desired_port!= real_port ) { ERR ( "Received   port   number   did   not   match   requested   port   number." "   The   requested   port   number   may   be   too   high." ) ; goto cleanup_tcp ; } printf ( "%u|", real_port ) ; fflush ( stdout ) ; <END_BUG> uint16_t pid ;  if (! g_options. nofork_mode && ( pid = fork ( ) ) > 0 ) { printf ( "%u|", pid ) ; exit ( 0 ) ; } if ( usb_can_callback ( usb_sock ) ) usb_register_callback ( usb_sock ) ; for ( ; ; ) { struct service_thread_param * args = calloc ( 1, sizeof ( * args ) ) ; if ( args == NULL ) { ERR ( "Failed   to   alloc   space   for   thread   args" ) ; goto cleanup_thread ; } args -> usb_sock = usb_sock ; <START_BUG> args -> tcp = tcp_conn_accept ( tcp_socket ) ; <END_BUG> if ( args -> tcp == NULL ) { ERR ( "Failed   to   open   tcp   connection" ) ; goto cleanup_thread ; } int status = pthread_create ( & args -> thread_handle, NULL, & service_connection, args ) ; if ( status ) { ERR

Fix:
<S2SV_ModStart> tcp_sock_t * tcp_socket = NULL, * tcp6_socket = NULL ; for ( ; ; ) { <S2SV_ModEnd> tcp_socket = tcp_open <S2SV_ModStart> ( desired_port ) ; tcp6_socket = tcp6_open ( desired_port ) ; if ( tcp_socket || tcp6_socket || <S2SV_ModEnd> g_options. only_desired_port <S2SV_ModStart> g_options. only_desired_port ) break ; <S2SV_ModEnd> desired_port ++ ; <S2SV_ModStart> = 49152 ; NOTE ( "Access <S2SV_blank> to <S2SV_blank> desired <S2SV_blank> port <S2SV_blank> failed, <S2SV_blank> trying <S2SV_blank> alternative <S2SV_blank> port <S2SV_blank> %d", desired_port ) ; } if ( tcp_socket == NULL && tcp6_socket <S2SV_ModEnd> == NULL ) <S2SV_ModStart> ; uint16_t real_port ; if ( tcp_socket ) real_port <S2SV_ModStart> tcp_port_number_get ( tcp_socket ) ; else real_port = tcp_port_number_get ( tcp6_socket <S2SV_ModStart> stdout ) ; NOTE ( "Port: <S2SV_blank> %d, <S2SV_blank> IPv4 <S2SV_blank> %savailable, <S2SV_blank> IPv6 <S2SV_blank> %savailable", real_port, tcp_socket? "" : "not <S2SV_blank> ", tcp6_socket? "" : "not <S2SV_blank>
Buggy code:
 int install_user_keyrings ( void ) { struct user_struct * user ; const struct cred * cred ; struct key * uid_keyring, * session_keyring ; key_perm_t user_keyring_perm ; char buf [ 20 ] ; int ret ; uid_t uid ; user_keyring_perm = ( KEY_POS_ALL & ~ KEY_POS_SETATTR ) | KEY_USR_ALL ; cred = current_cred ( ) ; user = cred -> user ; uid = from_kuid ( cred -> user_ns, user -> uid ) ; kenter ( "%p{%u}", user, uid ) ; if ( user -> uid_keyring && user -> session_keyring ) { kleave ( "   =   0   [exist]" ) ; return 0 ; } mutex_lock ( & key_user_keyring_mutex ) ; ret = 0 ; if (! user -> uid_keyring ) { sprintf ( buf, "_uid.%u", uid ) ; uid_keyring = find_keyring_by_name ( buf, true ) ; if ( IS_ERR ( uid_keyring ) ) { uid_keyring = keyring_alloc ( buf, user -> uid, INVALID_GID, cred, user_keyring_perm, <START_BUG> KEY_ALLOC_IN_QUOTA, <END_BUG> NULL, NULL ) ; if ( IS_ERR ( uid_keyring ) ) { ret = PTR_ERR ( uid_keyring ) ; goto error ; } } sprintf ( buf, "_uid_ses.%u", uid ) ; session_keyring = find_keyring_by_name ( buf, true ) ; if ( IS_ERR ( session_keyring ) ) { session_keyring = keyring_alloc ( buf, user -> uid, INVALID_GID, cred, user_keyring_perm,  KEY_ALLOC_IN_QUOTA, <START_BUG> NULL, NULL ) ; if ( IS_ERR ( session_keyring ) ) { ret = PTR_ERR ( session_keyring ) ; goto error_release ; } ret = key_link ( session_keyring, uid_keyring ) ; if ( ret < 0 ) goto error_release_both ; } user -> uid_keyring = uid_keyring ; user -> session_keyring = session_keyring ;<END_BUG>

Fix:
<S2SV_ModStart>, user_keyring_perm, KEY_ALLOC_UID_KEYRING | <S2SV_ModStart>, user_keyring_perm, KEY_ALLOC_UID_KEYRING |
Buggy code:
 <START_BUG> static int cost_segmap ( int * segcounts, vp9_prob * probs ) { <END_BUG> const int c01 = segcounts [ 0 ] + segcounts [ 1 ] ; const int c23 = segcounts [ 2 ] + segcounts [ 3 ] ; const int c45 = segcounts [ 4 ] + segcounts [ 5 ] ; const int c67 = segcounts [ 6 ] + segcounts [ 7 ] ; const int c0123 = c01 + c23 ; const int c4567 = c45 + c67 ; int cost = c0123 * vp9_cost_zero ( probs [ 0 ] ) + c4567 * vp9_cost_one ( probs [ 0 ] ) ; if ( c0123 > 0 ) { cost += c01 * vp9_cost_zero ( probs [ 1 ] ) + c23 * vp9_cost_one ( probs [ 1 ] ) ; if ( c01 > 0 ) cost += segcounts [ 0 ] * vp9_cost_zero ( probs [ 3 ] ) + segcounts [ 1 ] * vp9_cost_one ( probs [ 3 ] ) ; if ( c23 > 0 ) cost += segcounts [ 2 ] * vp9_cost_zero ( probs [ 4 ] ) + segcounts [ 3 ] * vp9_cost_one ( probs [ 4 ] ) ; } if ( c4567 > 0 ) { cost += c45 * vp9_cost_zero ( probs [ 2 ] ) + c67 * vp9_cost_one ( probs [ 2 ] ) ; if ( c45 > 0 ) cost += segcounts [ 4 ] * vp9_cost_zero ( probs [ 5 ] ) + segcounts [ 5 ] * vp9_cost_one ( probs [ 5 ] ) ; if ( c67 > 0 ) cost += segcounts [ 6 ] * vp9_cost_zero ( probs [ 6 ] ) + segcounts [ 7 ] * vp9_cost_one ( probs [ 6 ] ) ; } return cost ; }

Fix:
<S2SV_ModStart> * segcounts, vpx_prob <S2SV_ModEnd> * probs )
Buggy code:
 TSQuery parse_tsquery ( char * buf, PushFunction pushval, Datum opaque, bool isplain ) { struct TSQueryParserStateData state ; int i ; TSQuery query ; int commonlen ; QueryItem * ptr ; ListCell * cell ; state. buffer = buf ; state. buf = buf ; state. state = ( isplain )? WAITSINGLEOPERAND : WAITFIRSTOPERAND ; state. count = 0 ; state. polstr = NIL ; state. valstate = init_tsvector_parser ( state. buffer, true, true ) ; state. sumlen = 0 ; state. lenop = 64 ; state. curop = state. op = ( char * ) palloc ( state. lenop ) ; * ( state. curop ) = '\\0' ; makepol ( & state, pushval, opaque ) ; close_tsvector_parser ( state. valstate ) ; if ( list_length ( state. polstr ) == 0 ) { ereport ( NOTICE, ( errmsg ( "text-search   query   doesn\'t   contain   lexemes:   \\"%s\\"", state. buffer ) ) ) ; query = ( TSQuery ) palloc ( HDRSIZETQ ) ; SET_VARSIZE ( query, HDRSIZETQ ) ; query -> size = 0 ; return query ; <START_BUG> } <END_BUG> commonlen = COMPUTESIZE ( list_length ( state. polstr ), state. sumlen ) ; query = ( TSQuery ) palloc0 ( commonlen ) ; SET_VARSIZE ( query, commonlen ) ; query -> size = list_length ( state. polstr ) ; ptr = GETQUERY ( query ) ; i = 0 ; foreach ( cell, state. polstr ) { QueryItem * item = ( QueryItem * ) lfirst ( cell ) ; switch ( item -> type ) { case QI_VAL : memcpy ( & ptr [ i ], item, sizeof ( QueryOperand ) ) ; break ; case QI_VALSTOP : ptr [ i ]. type = QI_VALSTOP ; break ; case QI_OPR : memcpy ( & ptr [ i ], item, sizeof ( QueryOperator ) ) ; break ; default : elog ( ERROR, "unrecognized   QueryItem   type:   %d", item -> type ) ; } i ++

Fix:
<S2SV_ModStart> query ; } if ( TSQUERY_TOO_BIG ( list_length ( state. polstr ), state. sumlen ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "tsquery <S2SV_blank> is <S2SV_blank> too <S2SV_blank> large" ) ) ) ;
Buggy code:
 int i2400m_op_rfkill_sw_toggle ( struct wimax_dev * wimax_dev, enum wimax_rf_state state ) { int result ; struct i2400m * i2400m = wimax_dev_to_i2400m ( wimax_dev ) ; struct device * dev = i2400m_dev ( i2400m ) ; struct sk_buff * ack_skb ; struct { struct i2400m_l3l4_hdr hdr ; struct i2400m_tlv_rf_operation sw_rf ; } __packed * cmd ; char strerr [ 32 ] ; d_fnstart ( 4, dev, "(wimax_dev   %p   state   %d)\\n", wimax_dev, state ) ; result = - ENOMEM ; cmd = kzalloc ( sizeof ( * cmd ), GFP_KERNEL ) ; if ( cmd == NULL ) goto error_alloc ; cmd -> hdr. type = cpu_to_le16 ( I2400M_MT_CMD_RF_CONTROL ) ; cmd -> hdr. length = sizeof ( cmd -> sw_rf ) ; cmd -> hdr. version = cpu_to_le16 ( I2400M_L3L4_VERSION ) ; cmd -> sw_rf. hdr. type = cpu_to_le16 ( I2400M_TLV_RF_OPERATION ) ; cmd -> sw_rf. hdr. length = cpu_to_le16 ( sizeof ( cmd -> sw_rf. status ) ) ; switch ( state ) { case WIMAX_RF_OFF : cmd -> sw_rf. status = cpu_to_le32 ( 2 ) ; break ; case WIMAX_RF_ON : cmd -> sw_rf. status = cpu_to_le32 ( 1 ) ; break ; default : BUG ( ) ; } ack_skb = i2400m_msg_to_dev ( i2400m, cmd, sizeof ( * cmd ) ) ; result = PTR_ERR ( ack_skb ) ; if ( IS_ERR ( ack_skb ) ) { dev_err ( dev, "Failed   to   issue   \'RF   Control\'   command:   %d\\n", result ) ; goto error

Fix:
<S2SV_ModStart> ; error_cmd : kfree_skb ( ack_skb ) ; error_msg_to_dev : error_alloc : d_fnend ( 4, dev, "(wimax_dev <S2SV_blank> %p <S2SV_blank> state <S2SV_blank> %d) <S2SV_blank> = <S2SV_blank> %d\\n", wimax_dev, state, result ) ; <S2SV_ModStart> kfree ( cmd <S2SV_ModEnd> ) ; return
Buggy code:
 static void fill_variance_tree ( void * data, BLOCK_SIZE bsize ) { <START_BUG> variance_node node ; <END_BUG> tree_to_node ( data, bsize, & node ) ; sum_2_variances ( node. split [ 0 ], node. split [ 1 ], & node. part_variances -> horz [ 0 ] ) ; sum_2_variances ( node. split [ 2 ], node. split [ 3 ], & node. part_variances -> horz [ 1 ] ) ; sum_2_variances ( node. split [ 0 ], node. split [ 2 ], & node. part_variances -> vert [ 0 ] ) ; sum_2_variances ( node. split [ 1 ], node. split [ 3 ], & node. part_variances -> vert [ 1 ] ) ; sum_2_variances ( & node. part_variances -> vert [ 0 ], & node. part_variances -> vert [ 1 ], & node. part_variances -> none ) ; }

Fix:
<S2SV_ModStart> { variance_node node ; memset ( & node, 0, sizeof ( node ) )
Buggy code:
 static void fanout_release ( struct sock * sk ) { struct packet_sock * po = pkt_sk ( sk ) ; struct packet_fanout * f ; <START_BUG> f = po -> fanout ; <END_BUG>  if (! f ) <START_BUG> return ; mutex_lock ( & fanout_mutex ) ; po -> fanout = NULL ; if ( atomic_dec_and_test ( & f -> sk_ref ) ) { list_del ( & f -> list ) ; dev_remove_pack ( & f -> prot_hook ) ; fanout_release_data ( f ) ; kfree ( f ) ; } <END_BUG> mutex_unlock ( & fanout_mutex ) ;  if ( po -> rollover ) kfree_rcu ( po -> rollover, rcu ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> * f ; mutex_lock ( & fanout_mutex ) ; <S2SV_ModStart> ; if ( f ) { <S2SV_ModEnd> po -> fanout <S2SV_ModStart> ) ; } <S2SV_ModEnd> if ( po <S2SV_ModStart> ) ; } mutex_unlock ( & fanout_mutex ) ; }
Buggy code:
 static int _gd2GetHeader ( gdIOCtxPtr in, int * sx, int * sy, int * cs, int * vers, int * fmt, int * ncx, int * ncy, t_chunk_info * * chunkIdx ) { int i ; int ch ; char id [ 5 ] ; t_chunk_info * cidx ; int sidx ; int nc ; GD2_DBG ( php_gd_error ( "Reading   gd2   header   info" ) ) ; for ( i = 0 ; i < 4 ; i ++ ) { ch = gdGetC ( in ) ; if ( ch == EOF ) { goto fail1 ; } id [ i ] = ch ; } id [ 4 ] = 0 ; GD2_DBG ( php_gd_error ( "Got   file   code:   %s", id ) ) ; if ( strcmp ( id, GD2_ID )!= 0 ) { GD2_DBG ( php_gd_error ( "Not   a   valid   gd2   file" ) ) ; goto fail1 ; } if ( gdGetWord ( vers, in )!= 1 ) { goto fail1 ; } GD2_DBG ( php_gd_error ( "Version:   %d", * vers ) ) ; if ( ( * vers!= 1 ) && ( * vers!= 2 ) ) { GD2_DBG ( php_gd_error ( "Bad   version:   %d", * vers ) ) ; goto fail1 ; } if (! gdGetWord ( sx, in ) ) { GD2_DBG ( php_gd_error ( "Could   not   get   x-size" ) ) ; goto fail1 ; } if (! gdGetWord ( sy, in ) ) { GD2_DBG ( php_gd_error ( "Could   not   get   y-size" ) ) ; goto fail1 ; } GD2_DBG ( php_gd_error ( "Image   is   %dx%d", * sx, * sy ) ) ; if ( gdGetWord ( cs, in )!= 1 ) { goto fail1 ; } GD2_DBG ( php_gd_error ( "ChunkSize:   %d", * cs ) ) ; if ( ( * cs < GD2_CHUNKSIZE_MIN ) || ( *

Fix:
<S2SV_ModStart> ) ) ; if ( overflow2 ( sidx, nc ) ) { goto fail1 ; } <S2SV_ModStart> 1 ) ; if ( cidx == NULL ) { goto fail1 ; }
Buggy code:
 static int crypto_ccm_auth ( struct aead_request * req, struct scatterlist * plain, unsigned int cryptlen ) { struct crypto_ccm_req_priv_ctx * pctx = crypto_ccm_reqctx ( req ) ; struct crypto_aead * aead = crypto_aead_reqtfm ( req ) ; struct crypto_ccm_ctx * ctx = crypto_aead_ctx ( aead ) ; AHASH_REQUEST_ON_STACK ( ahreq, ctx -> mac ) ; unsigned int assoclen = req -> assoclen ; struct scatterlist sg [ 3 ] ; <START_BUG> u8 odata [ 16 ] ; <END_BUG> u8 idata [ 16 ] ; int ilen, err ; err = format_input ( odata, req, cryptlen ) ; if ( err ) goto out ; sg_init_table ( sg, 3 ) ; sg_set_buf ( & sg [ 0 ], odata, 16 ) ; if ( assoclen ) { ilen = format_adata ( idata, assoclen ) ; sg_set_buf ( & sg [ 1 ], idata, ilen ) ; sg_chain ( sg, 3, req -> src ) ; } else { ilen = 0 ; sg_chain ( sg, 2, req -> src ) ; } ahash_request_set_tfm ( ahreq, ctx -> mac ) ; ahash_request_set_callback ( ahreq, pctx -> flags, NULL, NULL ) ; ahash_request_set_crypt ( ahreq, sg, NULL, assoclen + ilen + 16 ) ; err = crypto_ahash_init ( ahreq ) ; if ( err ) goto out ; err = crypto_ahash_update ( ahreq ) ; if ( err ) goto out ; ilen = 16 - ( assoclen + ilen ) % 16 ; if ( ilen < 16 ) { memset ( idata, 0, ilen ) ; sg_init_table ( sg, 2 ) ; sg_set_buf ( & sg [ 0 ], idata, ilen ) ; if ( plain ) sg_chain ( sg, 2, plain ) ; plain = sg ; cryptlen += ilen ; } ahash_request_set_crypt ( ahreq, plain, pctx -> odata, crypt

Fix:
<S2SV_ModStart> ] ; u8 * odata = pctx -> odata ; u8 * idata = pctx -> idata <S2SV_ModEnd> ; int ilen
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_ext_data ( dec_state_t * ps_dec ) { stream_t * ps_stream ; UWORD32 u4_start_code ; IMPEG2D_ERROR_CODES_T e_error ; e_error = ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE ; ps_stream = & ps_dec -> s_bit_stream ; u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; while ( ( u4_start_code == EXTENSION_START_CODE || u4_start_code == USER_DATA_START_CODE ) && <START_BUG> ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE == e_error ) <END_BUG> { if ( u4_start_code == USER_DATA_START_CODE ) { impeg2d_dec_user_data ( ps_dec ) ; } else { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, EXT_ID_LEN ) ; switch ( u4_start_code ) { case QUANT_MATRIX_EXT_ID : impeg2d_dec_quant_matrix_ext ( ps_dec ) ; break ; case COPYRIGHT_EXT_ID : impeg2d_dec_copyright_ext ( ps_dec ) ; break ; case PIC_DISPLAY_EXT_ID : impeg2d_dec_pic_disp_ext ( ps_dec ) ; break ; case CAMERA_PARAM_EXT_ID : impeg2d_dec_cam_param_ext ( ps_dec ) ; break ; case ITU_T_EXT_ID : impeg2d_dec_itu_t_ext ( ps_dec ) ; break ; case PIC_SPATIAL_SCALABLE_EXT_ID : case PIC_TEMPORAL_SCALABLE_EXT_ID : e_error = IMPEG2D_SCALABLITY_NOT_SUP ; break ; default : impeg2d_bit_stream_flush (

Fix:
<S2SV_ModStart> IVD_ERROR_NONE == e_error && ( ps_stream -> u4_offset < ps_stream -> u4_max_offset )
Buggy code:
 static int lz4_uncompress ( const char * source, char * dest, int osize ) { const BYTE * ip = ( const BYTE * ) source ; const BYTE * ref ; BYTE * op = ( BYTE * ) dest ; BYTE * const oend = op + osize ; BYTE * cpy ; unsigned token ; size_t length ; size_t dec32table [ ] = { 0, 3, 2, 3, 0, 0, 0, 0 } ; # if LZ4_ARCH64 size_t dec64table [ ] = { 0, 0, 0, - 1, 0, 1, 2, 3 } ; # endif while ( 1 ) { token = * ip ++ ; length = ( token >> ML_BITS ) ; if ( length == RUN_MASK ) { size_t len ; len = * ip ++ ; for ( ; len == 255 ; length += 255 ) len = * ip ++ ; <START_BUG> length += len ; <END_BUG> } cpy = op + length ; if ( unlikely ( cpy > oend - COPYLENGTH ) ) { if ( cpy!= oend ) goto _output_error ; memcpy ( op, ip, length ) ; ip += length ; break ; } LZ4_WILDCOPY ( ip, op, cpy ) ; ip -= ( op - cpy ) ; op = cpy ; LZ4_READ_LITTLEENDIAN_16 ( ref, cpy, ip ) ; ip += 2 ; if ( unlikely ( ref < ( BYTE * const ) dest ) ) goto _output_error ; length = token & ML_MASK ; if ( length == ML_MASK ) { for ( ; * ip == 255 ; length += 255 ) ip ++ ; length += * ip ++ ; } if ( unlikely ( ( op - ref ) < STEPSIZE ) ) { # if LZ4_ARCH64 size_t dec64 = dec64table [ op - ref ] ; # else const int dec64 = 0 ; # endif op [ 0 ] = ref [ 0 ] ; op [ 1 ] = ref [ 1 ] ; op [ 2 ] = ref [ 2 ] ; op [ 3 ] = ref [ 3 ] ; op += 4 ; ref += 4 ; ref -= dec32table [ op - ref ] ; PUT4 ( ref, op ) ; op += STEPSIZE - 4 ; ref -= dec64 ; } else { LZ4_COPYSTEP ( ref,

Fix:
<S2SV_ModStart> ip ++ ; if ( unlikely ( length > ( size_t ) ( length + len ) ) ) goto _output_error ;
Buggy code:
 SYSCALL_DEFINE1 ( timer_getoverrun, timer_t, timer_id ) { struct k_itimer * timr ; int overrun ; unsigned long flags ; timr = lock_timer ( timer_id, & flags ) ; if (! timr ) return - EINVAL ; <START_BUG> overrun = timr -> it_overrun_last ; <END_BUG> unlock_timer ( timr, flags ) ; return overrun ; }

Fix:
<S2SV_ModStart> ; overrun = timer_overrun_to_int ( timr, 0 ) <S2SV_ModEnd> ; unlock_timer (
Buggy code:
 int ip6_append_data ( struct sock * sk, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int transhdrlen, int hlimit, int tclass, struct ipv6_txoptions * opt, struct flowi6 * fl6, struct rt6_info * rt, unsigned int flags, int dontfrag ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct inet_cork * cork ; struct sk_buff * skb, * skb_prev = NULL ; unsigned int maxfraglen, fragheaderlen, mtu ; int exthdrlen ; int dst_exthdrlen ; int hh_len ; int copy ; int err ; int offset = 0 ; __u8 tx_flags = 0 ; if ( flags & MSG_PROBE ) return 0 ; cork = & inet -> cork. base ; if ( skb_queue_empty ( & sk -> sk_write_queue ) ) { if ( opt ) { if ( WARN_ON ( np -> cork. opt ) ) return - EINVAL ; np -> cork. opt = kzalloc ( opt -> tot_len, sk -> sk_allocation ) ; if ( unlikely ( np -> cork. opt == NULL ) ) return - ENOBUFS ; np -> cork. opt -> tot_len = opt -> tot_len ; np -> cork. opt -> opt_flen = opt -> opt_flen ; np -> cork. opt -> opt_nflen = opt -> opt_nflen ; np -> cork. opt -> dst0opt = ip6_opt_dup ( opt -> dst0opt, sk -> sk_allocation ) ; if ( opt -> dst0opt &&! np -> cork. opt -> dst0opt ) return - ENOBUFS ; np -> cork. opt -> dst1opt = ip6_opt_dup ( opt -> dst1opt, sk -> sk_allocation ) ; if ( opt -> dst1opt &&! np -> cork. opt -> dst1opt ) return - ENOBUFS ; np -> cork. opt -> hopopt = ip6_opt_dup (

Fix:
<S2SV_ModStart> tx_flags ) ; if ( <S2SV_ModEnd> ( length > <S2SV_ModStart> > mtu ) && <S2SV_ModEnd> dontfrag && ( <S2SV_ModStart> dontfrag && ( sk -> sk_protocol <S2SV_ModEnd> == IPPROTO_UDP || <S2SV_ModStart> == IPPROTO_UDP || sk -> sk_protocol <S2SV_ModEnd> == IPPROTO_RAW ) <S2SV_ModStart> EMSGSIZE ; } skb = skb_peek_tail ( & sk -> sk_write_queue ) ; cork -> length += length ; if ( ( ( length > mtu ) || ( skb && skb_is_gso ( skb ) ) ) && ( sk -> sk_protocol == IPPROTO_UDP ) <S2SV_ModEnd> && ( rt <S2SV_ModStart> 0 ; } if (! skb <S2SV_ModEnd> ) goto alloc_new_skb
Buggy code:
 static int ext4_convert_unwritten_extents_endio ( handle_t * handle, struct inode * inode, <START_BUG> struct ext4_ext_path * path ) <END_BUG> {  struct ext4_extent * ex ; <START_BUG> int depth ; int err = 0 ; depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; <END_BUG> ext_debug ( "ext4_convert_unwritten_extents_endio:   inode   %lu,   logical"  "block   %llu,   max_blocks   %u\\n", inode -> i_ino, <START_BUG> ( unsigned long long ) le32_to_cpu ( ex -> ee_block ), <END_BUG> ext4_ext_get_actual_len ( ex ) ) ; err = ext4_ext_get_access ( handle, inode, path + depth ) ; if ( err ) goto out ; ext4_ext_mark_initialized ( ex ) ; ext4_ext_try_to_merge ( handle, inode, path, ex ) ; err = ext4_ext_dirty ( handle, inode, path + path -> p_depth ) ; out : ext4_ext_show_leaf ( inode, path ) ; return err ; }

Fix:
<S2SV_ModStart> inode, struct ext4_map_blocks * map, struct <S2SV_ModStart> ext4_extent * ex ; ext4_lblk_t ee_block ; unsigned int ee_len <S2SV_ModStart>. p_ext ; ee_block = le32_to_cpu ( ex -> ee_block ) ; ee_len = ext4_ext_get_actual_len ( ex ) ; <S2SV_ModStart> long long ) ee_block, ee_len ) ; if ( ee_block!= map -> m_lblk || ee_len > map -> m_len ) { err = ext4_split_unwritten_extents ( handle, inode, map, path, EXT4_GET_BLOCKS_CONVERT ) ; if ( err < 0 ) goto out ; ext4_ext_drop_refs ( path ) ; path = ext4_ext_find_extent ( inode, map -> m_lblk, path ) ; if ( IS_ERR ( path ) ) { err = PTR_ERR ( path ) ; goto out ; } depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; } <S2SV_ModEnd> err = ext4_ext_get_access
Buggy code:
 static cupsd_job_t * add_job ( cupsd_client_t * con, cupsd_printer_t * printer, mime_type_t * filetype ) { http_status_t status ; ipp_attribute_t * attr, * auth_info ; const char * mandatory ; const char * val ; int priority ; cupsd_job_t * job ; char job_uri [ HTTP_MAX_URI ] ; int kbytes ; int i ; int lowerpagerange ; int exact ; ipp_attribute_t * media_col, * media_margin ; ipp_t * unsup_col ; static const char * const readonly [ ] = { "date-time-at-completed", "date-time-at-creation", "date-time-at-processing", "job-detailed-status-messages", "job-document-access-errors", "job-id", "job-impressions-completed", "job-k-octets-completed", "job-media-sheets-completed", "job-pages-completed", "job-printer-up-time", "job-printer-uri", "job-state", "job-state-message", "job-state-reasons", "job-uri", "number-of-documents", "number-of-intervening-jobs", "output-device-assigned", "time-at-completed", "time-at-creation", "time-at-processing" } ; cupsdLogMessage ( CUPSD_LOG_DEBUG2, "add_job(%p[%d],   %p(%s),   %p(%s//%s))", con, con -> number, printer, printer -> name, filetype, filetype? filetype -> super : "none", filetype? filetype -> type : "none" ) ; if (! printer -> shared && _cups_strcasecmp ( con -> http -> hostname, "localhost" ) && _cups_strcasecmp ( con -> http -> hostname, ServerName ) ) { send_ipp_status ( con, IPP_NOT_AUTHORIZED, _ ( "The   printer   or   class   is   not   shared." ) ) ; return ( NULL ) ; } auth_info

Fix:
<S2SV_ModStart> ) ; } attr = ippFindAttribute ( con -> request, "requesting-user-name", IPP_TAG_NAME ) ; if ( attr &&! ippValidateAttribute ( attr ) ) { send_ipp_status ( con, IPP_ATTRIBUTES, _ ( "Bad <S2SV_blank> requesting-user-name <S2SV_blank> value: <S2SV_blank> %s" ), cupsLastErrorString ( ) ) ; if ( ( attr = ippCopyAttribute ( con -> response, attr, 0 ) )!= NULL ) attr -> group_tag = IPP_TAG_UNSUPPORTED_GROUP ; return ( NULL ) ; } <S2SV_ModStart> printer, job <S2SV_ModEnd> ) ; if
Buggy code:
 static int crypto_report_cipher ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_cipher rcipher ; <START_BUG> snprintf ( rcipher. type, CRYPTO_MAX_ALG_NAME, "%s", "cipher" ) ; <END_BUG> rcipher. blocksize = alg -> cra_blocksize ; rcipher. min_keysize = alg -> cra_cipher. cia_min_keysize ; rcipher. max_keysize = alg -> cra_cipher. cia_max_keysize ; if ( nla_put ( skb, CRYPTOCFGA_REPORT_CIPHER, sizeof ( struct crypto_report_cipher ), & rcipher ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_cipher rcipher ; strncpy <S2SV_ModEnd> ( rcipher. <S2SV_ModStart>. type, "cipher", sizeof ( rcipher. type ) <S2SV_ModEnd> ) ; rcipher
Buggy code:
 int MSG_ReadBits ( msg_t * msg, int bits ) { int value ; int get ; qboolean sgn ; int i, nbits ; <START_BUG> value = 0 ; <END_BUG> if ( bits < 0 ) { bits = - bits ; sgn = qtrue ; } else { sgn = qfalse ; }  if ( msg -> oob ) { <START_BUG> if ( bits == 8 ) { value = msg -> data [ msg -> readcount ] ; msg -> readcount += 1 ; msg -> bit += 8 ; } else if ( bits == 16 ) { short temp ; CopyLittleShort ( & temp, & msg -> data [ msg -> readcount ] ) ; value = temp ; msg -> readcount += 2 ; msg -> bit += 16 ; } else if ( bits == 32 ) { CopyLittleLong ( & value, & msg -> data [ msg -> readcount ] ) ; msg -> readcount += 4 ; msg -> bit += 32 ; } else Com_Error ( ERR_DROP, "can\'t   read   %d   bits", bits ) ; } else { nbits = 0 ; if ( bits & 7 ) { <END_BUG> nbits = bits & 7 ;  for ( i = 0 ; i < nbits ; i ++ ) { value |= ( Huff_getBit ( msg -> data, & msg -> bit ) << i ) ; } bits = bits - nbits ; } if ( bits ) { for ( i = 0 ; i < bits ; i += 8 ) { <START_BUG> Huff_offsetReceive ( msgHuff. decompressor. tree, & get, msg -> data, & msg -> bit ) ; <END_BUG>  value |= ( get << ( i + nbits ) ) ; <START_BUG> } } msg -> readcount = ( msg -> bit >> 3 ) + 1 ; } if ( sgn && bits > 0 && bits < 32 ) { if ( value & ( 1 << ( bits - 1 ) ) ) { value |= - 1 ^ ( ( 1 << bits ) - 1 ) ; } } return value ; }<END_BUG>

Fix:
<S2SV_ModStart>, nbits ; if ( msg -> readcount > msg -> cursize ) { return 0 ; } <S2SV_ModStart> oob ) { if ( msg -> readcount + ( bits >> 3 ) > msg -> cursize ) { msg -> readcount = msg -> cursize + 1 ; return 0 ; } <S2SV_ModStart> & 7 ; if ( msg -> bit + nbits > msg -> cursize << 3 ) { msg -> readcount = msg -> cursize + 1 ; return 0 ; } <S2SV_ModStart> msg -> bit, msg -> cursize << 3 <S2SV_ModStart> ) ) ; if ( msg -> bit > msg -> cursize << 3 ) { msg -> readcount = msg -> cursize + 1 ; return 0 ; }
Buggy code:
 static int caif_seqpkt_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct sk_buff * skb ; int ret ; int copylen ; ret = - EOPNOTSUPP ; if ( m -> msg_flags & MSG_OOB ) goto read_error ; <START_BUG> skb = skb_recv_datagram ( sk, flags, 0, & ret ) ; <END_BUG> if (! skb ) goto read_error ; copylen = skb -> len ; if ( len < copylen ) { m -> msg_flags |= MSG_TRUNC ; copylen = len ; } ret = skb_copy_datagram_iovec ( skb, 0, m -> msg_iov, copylen ) ; if ( ret ) goto out_free ; ret = ( flags & MSG_TRUNC )? skb -> len : copylen ; out_free : skb_free_datagram ( sk, skb ) ; caif_check_flow_release ( sk ) ; return ret ; read_error : return ret ; }

Fix:
<S2SV_ModStart> goto read_error ; m -> msg_namelen = 0 ;
Buggy code:
 int do_remount_sb ( struct super_block * sb, int flags, void * data, int force ) { int retval ; int remount_ro ; if ( sb -> s_writers. frozen!= SB_UNFROZEN ) return - EBUSY ; # ifdef CONFIG_BLOCK if (! ( flags & MS_RDONLY ) && bdev_read_only ( sb -> s_bdev ) ) return - EACCES ; # endif if ( flags & MS_RDONLY ) acct_auto_close ( sb ) ; shrink_dcache_sb ( sb ) ; sync_filesystem ( sb ) ; remount_ro = ( flags & MS_RDONLY ) &&! ( sb -> s_flags & MS_RDONLY ) ; if ( remount_ro ) { if ( force ) { <START_BUG> mark_files_ro ( sb ) ; <END_BUG> } else { retval = sb_prepare_remount_readonly ( sb ) ; if ( retval ) return retval ; } } if ( sb -> s_op -> remount_fs ) { retval = sb -> s_op -> remount_fs ( sb, & flags, data ) ; if ( retval ) { if (! force ) goto cancel_readonly ; WARN ( 1, "forced   remount   of   a   %s   fs   returned   %i\\n", sb -> s_type -> name, retval ) ; } } sb -> s_flags = ( sb -> s_flags & ~ MS_RMT_MASK ) | ( flags & MS_RMT_MASK ) ; smp_wmb ( ) ; sb -> s_readonly_remount = 0 ; if ( remount_ro && sb -> s_bdev ) invalidate_bdev ( sb -> s_bdev ) ; return 0 ; cancel_readonly : sb -> s_readonly_remount = 0 ; return retval ; }

Fix:
<S2SV_ModStart> force ) { sb -> s_readonly_remount = 1 ; smp_wmb ( <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> static void follow_dotdot ( struct nameidata * nd ) <END_BUG> { if (! nd -> root. mnt ) set_root ( nd ) ; while ( 1 ) { struct dentry * old = nd -> path. dentry ; if ( nd -> path. dentry == nd -> root. dentry && nd -> path. mnt == nd -> root. mnt ) { break ; } if ( nd -> path. dentry!= nd -> path. mnt -> mnt_root ) { nd -> path. dentry = dget_parent ( nd -> path. dentry ) ; dput ( old ) ;  break ; <START_BUG> } if (! follow_up ( & nd -> path ) ) break ; } follow_mount ( & nd -> path ) ; nd -> inode = nd -> path. dentry -> d_inode ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> follow_dotdot ( struct <S2SV_ModStart> old ) ; if ( unlikely (! path_connected ( & nd -> path ) ) ) return - ENOENT ; <S2SV_ModStart> -> d_inode ; return 0 ;
Buggy code:
 void vp8_rtcd ( ) { <START_BUG> vpx_scale_rtcd ( ) ; <END_BUG> once ( setup_rtcd_internal ) ; }

Fix:
<S2SV_ModStart> ( ) { <S2SV_ModEnd> once ( setup_rtcd_internal
Buggy code:
 static void check_1_6_dummy ( kadm5_principal_ent_t entry, long mask, int n_ks_tuple, krb5_key_salt_tuple * ks_tuple, char * * passptr ) { int i ; char * password = * passptr ; <START_BUG> if (! ( mask & KADM5_ATTRIBUTES ) || <END_BUG>! ( entry -> attributes & KRB5_KDB_DISALLOW_ALL_TIX ) ) return ; for ( i = 0 ; ( unsigned char ) password [ i ] == i + 1 ; i ++ ) ; if ( password [ i ]!= '\\0' || i!= 255 ) return ; * passptr = NULL ; }

Fix:
<S2SV_ModStart> ; if ( password == NULL ||
Buggy code:
 static void find_next_key_frame ( VP8_COMP * cpi, FIRSTPASS_STATS * this_frame ) { int i, j ; FIRSTPASS_STATS last_frame ; FIRSTPASS_STATS first_frame ; FIRSTPASS_STATS next_frame ; FIRSTPASS_STATS * start_position ; double decay_accumulator = 1.0 ; double boost_score = 0 ; double old_boost_score = 0.0 ; double loop_decay_rate ; double kf_mod_err = 0.0 ; double kf_group_err = 0.0 ; double kf_group_intra_err = 0.0 ; double kf_group_coded_err = 0.0 ; double recent_loop_decay [ 8 ] = { 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0 } ; <START_BUG> vpx_memset ( & next_frame, 0, sizeof ( next_frame ) ) ; <END_BUG> vp8_clear_system_state ( ) ; start_position = cpi -> twopass. stats_in ; cpi -> common. frame_type = KEY_FRAME ; cpi -> this_key_frame_forced = cpi -> next_key_frame_forced ; cpi -> source_alt_ref_active = 0 ; cpi -> frames_till_gf_update_due = 0 ; cpi -> twopass. frames_to_key = 1 ;  vpx_memcpy ( & first_frame, this_frame, sizeof ( * this_frame ) ) ; <START_BUG> cpi -> twopass. kf_group_bits = 0 ; cpi -> twopass. kf_group_error_left = 0 ; kf_mod_err = calculate_modified_err ( cpi, this_frame ) ; i = 0 ; while ( cpi -> twopass. stats_in < cpi -> twopass. stats_in_end ) { kf_group_err += calculate_modified_err ( cpi, this_frame ) ; kf_group_intra_err += this_frame -> intra_error ; kf_group_coded_err += this_frame -> coded_error ; <END_BUG> vpx_memcpy ( & last_frame, this_frame, sizeof

Fix:
<S2SV_ModStart> 1.0 } ; memset <S2SV_ModEnd> ( & next_frame <S2SV_ModStart> = 1 ; memcpy <S2SV_ModEnd> ( & first_frame <S2SV_ModStart> -> coded_error ; memcpy <S2SV_ModEnd> ( & last_frame <S2SV_ModStart> //= 2 ; memcpy <S2SV_ModEnd> ( & tmp_frame <S2SV_ModStart> boost_score = 0.0 <S2SV_ModEnd> ; for ( <S2SV_ModStart> ; int projected_buffer_level <S2SV_ModEnd> ; int tmp_q
Buggy code:
 int unshare_userns ( unsigned long unshare_flags, struct cred * * new_cred ) { <START_BUG> struct cred * cred ; <END_BUG> if (! ( unshare_flags & CLONE_NEWUSER ) ) return 0 ; cred = prepare_creds ( ) ;  if (! cred ) <START_BUG> return - ENOMEM ; * new_cred = cred ; <END_BUG> return create_user_ns ( cred ) ;  }

Fix:
<S2SV_ModStart> cred * cred ; int err = - ENOMEM <S2SV_ModStart> ; if ( cred ) { err = create_user_ns ( cred ) ; if ( err ) put_cred ( cred ) ; else <S2SV_ModEnd> * new_cred = <S2SV_ModStart> = cred ; } return err <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 grub_ssize_t grub_fshelp_read_file ( grub_disk_t disk, grub_fshelp_node_t node, void ( * read_hook ) ( grub_disk_addr_t sector, unsigned offset, unsigned length, void * closure ), void * closure, int flags, grub_off_t pos, grub_size_t len, char * buf, grub_disk_addr_t ( * get_block ) ( grub_fshelp_node_t node, grub_disk_addr_t block ), grub_off_t filesize, int log2blocksize ) { grub_disk_addr_t i, blockcnt ; int blocksize = 1 << ( log2blocksize + GRUB_DISK_SECTOR_BITS ) ; if ( pos + len > filesize ) len = filesize - pos ; <START_BUG> blockcnt = ( ( len + pos ) + blocksize - 1 ) >> <END_BUG> ( log2blocksize + GRUB_DISK_SECTOR_BITS ) ; for ( i = pos >> ( log2blocksize + GRUB_DISK_SECTOR_BITS ) ; i < blockcnt ; i ++ ) { grub_disk_addr_t blknr ; int blockoff = pos & ( blocksize - 1 ) ; int blockend = blocksize ; int skipfirst = 0 ; blknr = get_block ( node, i ) ; if ( grub_errno ) return - 1 ; blknr = blknr << log2blocksize ; if ( i == blockcnt - 1 ) { blockend = ( len + pos ) & ( blocksize - 1 ) ; if (! blockend ) blockend = blocksize ; } if ( i == ( pos >> ( log2blocksize + GRUB_DISK_SECTOR_BITS ) ) ) { skipfirst = blockoff ; blockend -= skipfirst ; } if ( blknr ) { disk -> read_hook = read_hook ; disk -> closure = closure ; grub_hack_lastoff = blknr * 512 ; grub_disk_read_ex ( disk, blknr, skipfirst, blockend, buf, flags ) ; disk -> read_hook = 0 ; if ( grub_errno ) return - 1 ; } else if ( buf ) grub_memset ( buf,

Fix:
<S2SV_ModStart> - pos ; if ( len < 1 || len == 0xffffffff ) { return - 1 ; }
Buggy code:
 static struct mobj * alloc_ta_mem ( size_t size ) { # ifdef CFG_PAGED_USER_TA return mobj_paged_alloc ( size ) ; # else struct mobj * mobj = mobj_mm_alloc ( mobj_sec_ddr, size, & tee_mm_sec_ddr ) ; <START_BUG> if ( mobj ) <END_BUG>  memset ( mobj_get_va ( mobj, 0 ), 0, size ) ; <START_BUG> return mobj ; # endif }<END_BUG>

Fix:
<S2SV_ModStart> ( mobj ) { size_t granularity = BIT ( tee_mm_sec_ddr. shift ) ; <S2SV_ModStart>, 0, ROUNDUP ( size, granularity ) ) ; } <S2SV_ModEnd> return mobj ;
Buggy code:
 static vpx_codec_err_t ctrl_use_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> const int reference_flag = va_arg ( args, int ) ; vp9_use_as_reference ( ctx -> cpi, reference_flag ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )