nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int gemsafe_get_cert_len ( sc_card_t * card ) { int r ; u8 ibuf [ GEMSAFE_MAX_OBJLEN ] ; u8 * iptr ; struct sc_path path ; struct sc_file * file ; size_t objlen, certlen ; unsigned int ind, i = 0 ; sc_format_path ( GEMSAFE_PATH, & path ) ; r = sc_select_file ( card, & path, & file ) ; if ( r!= SC_SUCCESS ||! file ) return SC_ERROR_INTERNAL ; r = sc_read_binary ( card, 0, ibuf, GEMSAFE_READ_QUANTUM, 0 ) ; if ( r < 0 ) return SC_ERROR_INTERNAL ; objlen = ( ( ( size_t ) ibuf [ 0 ] ) << 8 ) | ibuf [ 1 ] ; sc_log ( card -> ctx, "Stored   object   is   of   size:   %" SC_FORMAT_LEN_SIZE_T "u", objlen ) ; if ( objlen < 1 || objlen > GEMSAFE_MAX_OBJLEN ) { sc_log ( card -> ctx, "Invalid   object   size:   %" SC_FORMAT_LEN_SIZE_T "u", objlen ) ; return SC_ERROR_INTERNAL ; } ind = 2 ; <START_BUG> while ( ibuf [ ind ] == 0x01 ) { <END_BUG> if ( ibuf [ ind + 1 ] == 0xFE ) { gemsafe_prkeys [ i ]. ref = ibuf [ ind + 4 ] ; sc_log ( card -> ctx, "Key   container   %d   is   allocated   and   uses   key_ref   %d", i + 1, gemsafe_prkeys [ i ]. ref ) ; ind += 9 ; } else { gemsafe_prkeys [ i ]. label = NULL ; gemsafe_cert [ i ]. label = NULL ; sc_log ( card -> ctx, "Key   container   %d   is   unallocated", i + 1 ) ; ind += 8 ; } i ++ ; } for ( ; i < gemsafe_cert_max ; i ++ ) { gemsafe_prkeys [ i ]. label = NULL ; gemsafe_cert [ i ]. label = NULL ; } iptr

Fix:
<S2SV_ModStart> ] == 0x01 && i < gemsafe_cert_max
Buggy code:
 void csync_daemon_session ( ) { static char line [ 4 * 4096 ] ; struct stat sb ; address_t peername = {. sa. sa_family = AF_UNSPEC, } ; socklen_t peerlen = sizeof ( peername ) ; char * peer = 0, * tag [ 32 ] ; int i ; if ( fstat ( 0, & sb ) ) csync_fatal ( "Can\'t   run   fstat   on   fd   0:   %s", strerror ( errno ) ) ; switch ( sb. st_mode & S_IFMT ) { case S_IFSOCK : if ( getpeername ( 0, & peername. sa, & peerlen ) == - 1 ) csync_fatal ( "Can\'t   run   getpeername   on   fd   0:   %s", strerror ( errno ) ) ; break ; case S_IFIFO : set_peername_from_env ( & peername, "SSH_CLIENT" ) ; break ; default : csync_fatal ( "I\'m   only   talking   to   sockets   or   pipes!   %x\\n", sb. st_mode & S_IFMT ) ; break ; } while ( conn_gets ( line, sizeof ( line ) ) ) { int cmdnr ; if (! setup_tag ( tag, line ) ) continue ; for ( cmdnr = 0 ; cmdtab [ cmdnr ]. text ; cmdnr ++ ) if (! strcasecmp ( cmdtab [ cmdnr ]. text, tag [ 0 ] ) ) break ; if (! cmdtab [ cmdnr ]. text ) { cmd_error = conn_response ( CR_ERR_UNKNOWN_COMMAND ) ; goto abort_cmd ; } cmd_error = 0 ; if ( cmdtab [ cmdnr ]. need_ident &&! peer ) { conn_printf ( "Dear   %s,   please   identify   first.\\n", csync_inet_ntop ( & peername )? : "stranger" ) ; goto next_cmd ; } if ( cmdtab [ cmdnr ]. check_perm ) on_cygwin_lowercase ( tag [ 2 ] ) ; if ( cmdtab [ cmdnr ]. check_perm ) { if ( cmdtab [ cmdnr ]

Fix:
<S2SV_ModStart> CR_ERR_SSL_EXPECTED ) ; peer = NULL ;
Buggy code:
 STATIC int xfs_attr_calc_size ( struct xfs_inode * ip, int namelen, int valuelen, int * local ) { struct xfs_mount * mp = ip -> i_mount ; int size ; int nblks ; size = xfs_attr_leaf_newentsize ( namelen, valuelen, mp -> m_sb. sb_blocksize, local ) ; nblks = XFS_DAENTER_SPACE_RES ( mp, XFS_ATTR_FORK ) ; if ( * local ) { if ( size > ( mp -> m_sb. sb_blocksize >> 1 ) ) { nblks *= 2 ; } } else { <START_BUG> uint dblocks = XFS_B_TO_FSB ( mp, valuelen ) ; <END_BUG> nblks += dblocks ; nblks += XFS_NEXTENTADD_SPACE_RES ( mp, dblocks, XFS_ATTR_FORK ) ; } return nblks ; }

Fix:
<S2SV_ModStart> uint dblocks = xfs_attr3_rmt_blocks <S2SV_ModEnd> ( mp,
Buggy code:
 int htc_connect_service ( struct htc_target * target, struct htc_service_connreq * service_connreq, enum htc_endpoint_id * conn_rsp_epid ) { struct sk_buff * skb ; struct htc_endpoint * endpoint ; struct htc_conn_svc_msg * conn_msg ; int ret ; unsigned long time_left ; endpoint = get_next_avail_ep ( target -> endpoint ) ; if (! endpoint ) { dev_err ( target -> dev, "Endpoint   is   not   available   for   service   %d\\n", service_connreq -> service_id ) ; return - EINVAL ; } endpoint -> service_id = service_connreq -> service_id ; endpoint -> max_txqdepth = service_connreq -> max_send_qdepth ; endpoint -> ul_pipeid = service_to_ulpipe ( service_connreq -> service_id ) ; endpoint -> dl_pipeid = service_to_dlpipe ( service_connreq -> service_id ) ; endpoint -> ep_callbacks = service_connreq -> ep_callbacks ; skb = alloc_skb ( sizeof ( struct htc_conn_svc_msg ) + sizeof ( struct htc_frame_hdr ), GFP_ATOMIC ) ; if (! skb ) { dev_err ( target -> dev, "Failed   to   allocate   buf   to   send" "service   connect   req\\n" ) ; return - ENOMEM ; } skb_reserve ( skb, sizeof ( struct htc_frame_hdr ) ) ; conn_msg = skb_put ( skb, sizeof ( struct htc_conn_svc_msg ) ) ; conn_msg -> service_id = cpu_to_be16 ( service_connreq -> service_id ) ; conn_msg -> msg_id = cpu_to_be16 ( HTC_MSG_CONNECT_SERVICE_ID ) ; conn_msg -> con_flags = cpu_to_be16 ( service_connreq -> con_flags ) ; conn_msg -> dl_pipeid = endpoint -> dl_pipeid ; conn_msg -> ul_pipeid = endpoint -> ul_pipeid ; ret = htc_issue_send ( target, skb, skb

Fix:
<S2SV_ModStart> service_id ) ; kfree_skb ( skb ) ;
Buggy code:
 static int nfc_genl_deactivate_target ( struct sk_buff * skb, struct genl_info * info ) { struct nfc_dev * dev ; u32 device_idx, target_idx ; int rc ; <START_BUG> if (! info -> attrs [ NFC_ATTR_DEVICE_INDEX ] ) <END_BUG> return - EINVAL ; device_idx = nla_get_u32 ( info -> attrs [ NFC_ATTR_DEVICE_INDEX ] ) ; dev = nfc_get_device ( device_idx ) ; if (! dev ) return - ENODEV ; target_idx = nla_get_u32 ( info -> attrs [ NFC_ATTR_TARGET_INDEX ] ) ; rc = nfc_deactivate_target ( dev, target_idx, NFC_TARGET_MODE_SLEEP ) ; nfc_put_device ( dev ) ; return rc ; }

Fix:
<S2SV_ModStart> attrs [ NFC_ATTR_DEVICE_INDEX ] ||! info -> attrs [ NFC_ATTR_TARGET_INDEX
Buggy code:
 static int fallocate_chunk ( struct inode * inode, loff_t offset, loff_t len, int mode ) { struct gfs2_inode * ip = GFS2_I ( inode ) ; struct buffer_head * dibh ; int error ; <START_BUG> u64 start = offset >> PAGE_CACHE_SHIFT ; <END_BUG> unsigned int start_offset = offset & ~ PAGE_CACHE_MASK ;  u64 end = ( offset + len - 1 ) >> PAGE_CACHE_SHIFT ; <START_BUG> pgoff_t curr ; struct page * page ; unsigned int end_offset = ( offset + len ) & ~ PAGE_CACHE_MASK ; unsigned int from, to ; if (! end_offset ) end_offset = PAGE_CACHE_SIZE ; error = gfs2_meta_inode_buffer ( ip, & dibh ) ; if ( unlikely ( error ) ) goto out ; gfs2_trans_add_bh ( ip -> i_gl, dibh, 1 ) ; if ( gfs2_is_stuffed ( ip ) ) { error = gfs2_unstuff_dinode ( ip, NULL ) ; if ( unlikely ( error ) ) goto out ; } curr = start ; offset = start << PAGE_CACHE_SHIFT ; from = start_offset ; to = PAGE_CACHE_SIZE ; while ( curr <= end ) { page = grab_cache_page_write_begin ( inode -> i_mapping, curr, AOP_FLAG_NOFS ) ; if ( unlikely (! page ) ) { error = - ENOMEM ; goto out ; } if ( curr == end ) to = end_offset ; error = write_empty_blocks ( page, from, to, mode ) ; if (! error && offset + to > inode -> i_size && <END_BUG>! ( mode & FALLOC_FL_KEEP_SIZE ) ) {  <START_BUG> i_size_write ( inode, offset + to ) ; <END_BUG> } unlock_page ( page ) ; page_cache_release ( page ) ; if ( error ) goto out ; curr ++ ; offset += PAGE_CACHE_SIZE ; from = 0 ; }  mark_inode_dirty ( inode ) ; <START_BUG> brelse ( dibh ) ; out : <END_BUG> return error ;  }

Fix:
<S2SV_ModStart> int error ; unsigned int nr_blks ; sector_t lblock <S2SV_ModEnd> = offset >> <S2SV_ModStart> = offset >> inode -> i_blkbits ; error = gfs2_meta_inode_buffer ( ip, & dibh ) ; if ( unlikely ( error ) ) return error ; gfs2_trans_add_bh ( ip -> i_gl, dibh, 1 ) ; if ( gfs2_is_stuffed ( ip ) ) { error = gfs2_unstuff_dinode ( ip, NULL ) ; if ( unlikely ( error ) ) goto out ; } while ( len ) { struct buffer_head bh_map = {. b_state = 0,. b_blocknr = 0 } ; bh_map. b_size = len ; set_buffer_zeronew ( & bh_map ) ; error = gfs2_block_map ( inode, lblock, & bh_map, 1 ) ; if ( unlikely ( error ) ) goto out ; len -= bh_map. b_size ; nr_blks = bh_map. b_size >> inode -> i_blkbits ; lblock += nr
Buggy code:
 static int http_connect ( URLContext * h, const char * path, const char * local_path, const char * hoststr, const char * auth, const char * proxyauth, int * new_location ) { HTTPContext * s = h -> priv_data ; int post, err ; char headers [ HTTP_HEADERS_SIZE ] = "" ; char * authstr = NULL, * proxyauthstr = NULL ; <START_BUG> int64_t off = s -> off ; <END_BUG> int len = 0 ; const char * method ; int send_expect_100 = 0 ; post = h -> flags & AVIO_FLAG_WRITE ; if ( s -> post_data ) { post = 1 ; s -> chunked_post = 0 ; } if ( s -> method ) method = s -> method ; else method = post? "POST" : "GET" ; authstr = ff_http_auth_create_response ( & s -> auth_state, auth, local_path, method ) ; proxyauthstr = ff_http_auth_create_response ( & s -> proxy_auth_state, proxyauth, local_path, method ) ; if ( post &&! s -> post_data ) { send_expect_100 = s -> send_expect_100 ; if ( auth && * auth && s -> auth_state. auth_type == HTTP_AUTH_NONE && s -> http_code!= 401 ) send_expect_100 = 1 ; } # if FF_API_HTTP_USER_AGENT if ( strcmp ( s -> user_agent_deprecated, DEFAULT_USER_AGENT ) ) { av_log ( s, AV_LOG_WARNING, "the   user-agent   option   is   deprecated,   please   use   user_agent   option\\n" ) ; s -> user_agent = av_strdup ( s -> user_agent_deprecated ) ; } # endif if (! has_header ( s -> headers, "\\r\\nUser-Agent:   " ) ) len += av_strlcatf ( headers + len, sizeof ( headers ) - len, "User-Agent:   %s\\r\\n", s -> user_agent ) ; if (! has_header ( s -> headers, "\\r\\nAccept:   " ) ) len += av_strlcpy ( headers + len, "Accept:   *//

Fix:
<S2SV_ModStart> = NULL ; uint64_t <S2SV_ModEnd> off = s <S2SV_ModStart> len, "Range: <S2SV_blank> bytes=%" PRIu64 <S2SV_ModEnd> "-", s <S2SV_ModStart> -> filesize = UINT64_MAX <S2SV_ModEnd> ; s ->
Buggy code:
 static bool check_client_passwd ( PgSocket * client, const char * passwd ) { char md5 [ MD5_PASSWD_LEN + 1 ] ; const char * correct ; PgUser * user = client -> auth_user ; <START_BUG> if (! * passwd ||! * user -> passwd ) <END_BUG> return false ; switch ( cf_auth_type ) { case AUTH_PLAIN : return strcmp ( user -> passwd, passwd ) == 0 ; case AUTH_CRYPT : correct = crypt ( user -> passwd, ( char * ) client -> tmp_login_salt ) ; return correct && strcmp ( correct, passwd ) == 0 ; case AUTH_MD5 : if ( strlen ( passwd )!= MD5_PASSWD_LEN ) return false ; if (! isMD5 ( user -> passwd ) ) pg_md5_encrypt ( user -> passwd, user -> name, strlen ( user -> name ), user -> passwd ) ; pg_md5_encrypt ( user -> passwd + 3, ( char * ) client -> tmp_login_salt, 4, md5 ) ; return strcmp ( md5, passwd ) == 0 ; } return false ; }

Fix:
<S2SV_ModStart> if (! user ) { slog_error ( client, "Password <S2SV_blank> packet <S2SV_blank> before <S2SV_blank> auth <S2SV_blank> packet?" ) ; return false ; } if (!
Buggy code:
 int vis_emul ( struct pt_regs * regs, unsigned int insn ) { unsigned long pc = regs -> tpc ; unsigned int opf ; BUG_ON ( regs -> tstate & TSTATE_PRIV ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> if ( test_thread_flag ( TIF_32BIT ) ) pc = ( u32 ) pc ; if ( get_user ( insn, ( u32 __user * ) pc ) ) return - EFAULT ; save_and_clear_fpu ( ) ; opf = ( insn & VIS_OPF_MASK ) >> VIS_OPF_SHIFT ; switch ( opf ) { default : return - EINVAL ; case FPACK16_OPF : case FPACK32_OPF : case FPACKFIX_OPF : case FEXPAND_OPF : case FPMERGE_OPF : pformat ( regs, insn, opf ) ; break ; case FMUL8x16_OPF : case FMUL8x16AU_OPF : case FMUL8x16AL_OPF : case FMUL8SUx16_OPF : case FMUL8ULx16_OPF : case FMULD8SUx16_OPF : case FMULD8ULx16_OPF : pmul ( regs, insn, opf ) ; break ; case FCMPGT16_OPF : case FCMPGT32_OPF : case FCMPLE16_OPF : case FCMPLE32_OPF : case FCMPNE16_OPF : case FCMPNE32_OPF : case FCMPEQ16_OPF : case FCMPEQ32_OPF : pcmp ( regs, insn, opf ) ; break ; case EDGE8_OPF : case EDGE8N_OPF : case EDGE8L_OPF : case EDGE8LN_OPF : case EDGE16_OPF : case EDGE16N_OPF : case EDGE16L_OPF : case EDGE16LN_OPF : case EDGE32_OPF : case EDGE32N_OPF

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, 0
Buggy code:
 static vpx_codec_err_t vp8_peek_si_internal ( const uint8_t * data, unsigned int data_sz, vpx_codec_stream_info_t * si, <START_BUG> vp8_decrypt_cb * decrypt_cb, <END_BUG> void * decrypt_state ) { vpx_codec_err_t res = VPX_CODEC_OK ; if ( data + data_sz <= data ) { res = VPX_CODEC_INVALID_PARAM ; } else { uint8_t clear_buffer [ 10 ] ; const uint8_t * clear = data ; if ( decrypt_cb ) {  int n = data_sz > 10? 10 : data_sz ; <START_BUG> decrypt_cb ( decrypt_state, data, clear_buffer, n ) ; clear = clear_buffer ; } si -> is_kf = 0 ; if ( data_sz >= 10 &&! ( clear [ 0 ] & 0x01 ) ) { si -> is_kf = 1 ; if ( clear [ 3 ]!= 0x9d || clear [ 4 ]!= 0x01 || clear [ 5 ]!= 0x2a ) <END_BUG> res = VPX_CODEC_UNSUP_BITSTREAM ;  si -> w = ( clear [ 6 ] | ( clear [ 7 ] << 8 ) ) & 0x3fff ; si -> h = ( clear [ 8 ] | ( clear [ 9 ] << 8 ) ) & 0x3fff ; if (! ( si -> h | si -> w ) ) res = VPX_CODEC_UNSUP_BITSTREAM ; } else { res = VPX_CODEC_UNSUP_BITSTREAM ; } } return res ; }

Fix:
<S2SV_ModStart> * si, vpx_decrypt_cb <S2SV_ModEnd> decrypt_cb, void <S2SV_ModStart> int n = MIN ( sizeof ( clear_buffer ), data_sz ) <S2SV_ModEnd> ; decrypt_cb ( <S2SV_ModStart>!= 0x2a ) return <S2SV_ModEnd> VPX_CODEC_UNSUP_BITSTREAM ; si
Buggy code:
 <START_BUG> static void <END_BUG> ip_printroute ( netdissect_options * ndo, register const u_char * cp, u_int length ) { register u_int ptr ; register u_int len ; if ( length < 3 ) { ND_PRINT ( ( ndo, "   [bad   length   %u]", length ) ) ;  return ; <START_BUG> } if ( ( length + 1 ) & 3 ) <END_BUG> ND_PRINT ( ( ndo, "   [bad   length   %u]", length ) ) ;  ptr = cp [ 2 ] - 1 ; if ( ptr < 3 || ( ( ptr + 1 ) & 3 ) || ptr > length + 1 ) ND_PRINT ( ( ndo, "   [bad   ptr   %u]", cp [ 2 ] ) ) ; for ( len = 3 ; len < length ; len += 4 ) { <START_BUG> ND_PRINT ( ( ndo, "   %s", ipaddr_string ( ndo, & cp [ len ] ) ) ) ; <END_BUG> if ( ptr > len ) ND_PRINT ( ( ndo, "," ) ) ;  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> ip_printroute ( netdissect_options <S2SV_ModStart> ) ; return ( 0 ) <S2SV_ModStart>, length ) ) ; ND_TCHECK ( cp [ 2 ] <S2SV_ModStart> 4 ) { ND_TCHECK2 ( cp [ len ], 4 ) ; <S2SV_ModStart> ) ; } return ( 0 ) ; trunc : return ( - 1 ) ;
Buggy code:
 static void stellaris_enet_class_init ( ObjectClass * klass, void * data ) { DeviceClass * dc = DEVICE_CLASS ( klass ) ; SysBusDeviceClass * k = SYS_BUS_DEVICE_CLASS ( klass ) ; k -> init = stellaris_enet_init ; dc -> unrealize = stellaris_enet_unrealize ; dc -> props = stellaris_enet_properties ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> = stellaris_enet_properties ; dc -> vmsd = & vmstate_stellaris_enet ;
Buggy code:
 static int do_ipv6_setsockopt ( struct sock * sk, int level, int optname, char __user * optval, unsigned int optlen ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct net * net = sock_net ( sk ) ; int val, valbool ; int retv = - ENOPROTOOPT ; bool needs_rtnl = setsockopt_needs_rtnl ( optname ) ; if (! optval ) val = 0 ; else { if ( optlen >= sizeof ( int ) ) { if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; } else val = 0 ; } valbool = ( val!= 0 ) ; if ( ip6_mroute_opt ( optname ) ) return ip6_mroute_setsockopt ( sk, optname, optval, optlen ) ; if ( needs_rtnl ) rtnl_lock ( ) ; lock_sock ( sk ) ; switch ( optname ) { case IPV6_ADDRFORM : if ( optlen < sizeof ( int ) ) goto e_inval ; if ( val == PF_INET ) { struct ipv6_txoptions * opt ; struct sk_buff * pktopt ; if ( sk -> sk_type == SOCK_RAW ) break ; if ( sk -> sk_protocol == IPPROTO_UDP || sk -> sk_protocol == IPPROTO_UDPLITE ) { struct udp_sock * up = udp_sk ( sk ) ; if ( up -> pending == AF_INET6 ) { retv = - EBUSY ; break ; } } else if ( sk -> sk_protocol!= IPPROTO_TCP ) break ; if ( sk -> sk_state!= TCP_ESTABLISHED ) { retv = - ENOTCONN ; break ; } if ( ipv6_only_sock ( sk ) ||! ipv6_addr_v4mapped ( & sk -> sk_v6_daddr ) ) { retv = - EADDRNOTAVAIL ; break ; } fl6_free_socklist ( sk ) ; ipv6_sock_mc_close ( sk ) ; sk_refcnt_debug_dec ( sk ) ; if ( sk -> sk_protocol == IPPROTO_TCP ) { struct inet_connection_sock * icsk = inet_cs

Fix:
<S2SV_ModStart> = xchg ( ( __force struct ipv6_txoptions * * ) <S2SV_ModStart> ( opt ) { atomic_sub ( opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt ) ; } <S2SV_ModEnd> pktopt = xchg <S2SV_ModStart> ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; opt = <S2SV_ModStart> ( sk, <S2SV_ModEnd> opt, optname <S2SV_ModStart> ( opt ) { atomic_sub ( opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt ) ; } <S2SV_ModEnd> break ; } <S2SV_ModStart> ) ) ; atomic_set ( & opt -> refcnt, 1 ) ; <S2SV_ModStart> ( opt ) { atomic_sub ( opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt ) ; } <S2SV_ModEnd> break ; }
Buggy code:
 int dccp_rcv_state_process ( struct sock * sk, struct sk_buff * skb, struct dccp_hdr * dh, unsigned int len ) { struct dccp_sock * dp = dccp_sk ( sk ) ; struct dccp_skb_cb * dcb = DCCP_SKB_CB ( skb ) ; const int old_state = sk -> sk_state ; int queued = 0 ; if ( sk -> sk_state == DCCP_LISTEN ) { if ( dh -> dccph_type == DCCP_PKT_REQUEST ) { if ( inet_csk ( sk ) -> icsk_af_ops -> conn_request ( sk, skb ) < 0 ) return 1 ; <START_BUG> goto discard ; <END_BUG> } if ( dh -> dccph_type == DCCP_PKT_RESET ) goto discard ; dcb -> dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION ; return 1 ; } else if ( sk -> sk_state == DCCP_CLOSED ) { dcb -> dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION ; return 1 ; } if ( sk -> sk_state!= DCCP_REQUESTING && dccp_check_seqno ( sk, skb ) ) goto discard ; if ( ( dp -> dccps_role!= DCCP_ROLE_CLIENT && dh -> dccph_type == DCCP_PKT_RESPONSE ) || ( dp -> dccps_role == DCCP_ROLE_CLIENT && dh -> dccph_type == DCCP_PKT_REQUEST ) || ( sk -> sk_state == DCCP_RESPOND && dh -> dccph_type == DCCP_PKT_DATA ) ) { dccp_send_sync ( sk, dcb -> dccpd_seq, DCCP_PKT_SYNC ) ; goto discard ; } if ( dccp_parse_options ( sk, NULL, skb ) ) return 1 ; if ( dh -> dccph_type == DCCP_PKT_RESET ) { dccp_rcv_reset ( sk, skb ) ; return 0 ; } else if ( dh -> dccph_type == DCCP_PKT_CLOSEREQ )

Fix:
<S2SV_ModStart> return 1 ; consume_skb ( skb ) ; return 0 <S2SV_ModEnd> ; } if
Buggy code:
 kadm5_ret_t kadm5_randkey_principal_3 ( void * server_handle, krb5_principal principal, krb5_boolean keepold, int n_ks_tuple, krb5_key_salt_tuple * ks_tuple, krb5_keyblock * * keyblocks, int * n_keys ) { krb5_db_entry * kdb ; osa_princ_ent_rec adb ; krb5_int32 now ; kadm5_policy_ent_rec pol ; <START_BUG> int ret, last_pwd ; <END_BUG> krb5_boolean have_pol = FALSE ; kadm5_server_handle_t handle = server_handle ; krb5_keyblock * act_mkey ; krb5_kvno act_kvno ; int new_n_ks_tuple = 0 ; krb5_key_salt_tuple * new_ks_tuple = NULL ; if ( keyblocks ) * keyblocks = NULL ; CHECK_HANDLE ( server_handle ) ; krb5_clear_error_message ( handle -> context ) ; if ( principal == NULL ) return EINVAL ; if ( ( ret = kdb_get_entry ( handle, principal, & kdb, & adb ) ) ) return ( ret ) ; ret = apply_keysalt_policy ( handle, adb. policy, n_ks_tuple, ks_tuple, & new_n_ks_tuple, & new_ks_tuple ) ; if ( ret ) goto done ; if ( krb5_principal_compare ( handle -> context, principal, hist_princ ) ) { if ( keepold ) return KADM5_PROTECT_PRINCIPAL ; new_n_ks_tuple = 1 ; } ret = kdb_get_active_mkey ( handle, & act_kvno, & act_mkey ) ; if ( ret ) goto done ; ret = krb5_dbe_crk ( handle -> context, act_mkey, new_ks_tuple, new_n_ks_tuple, keepold, kdb ) ; if ( ret ) goto done ; ret = krb5_dbe_update_mkvno ( handle -> context, kdb, act_kvno ) ; if ( ret ) goto done ;

Fix:
<S2SV_ModStart> ret, last_pwd, n_new_keys <S2SV_ModStart> keyblocks ) { n_new_keys = count_new_keys ( kdb -> n_key_data, kdb -> key_data ) ; <S2SV_ModStart> -> context, n_new_keys <S2SV_ModEnd>, kdb ->
Buggy code:
 static gboolean side_in_cb ( GSocket * socket, GIOCondition condition, gpointer user_data ) { ProxySide * side = user_data ; FlatpakProxyClient * client = side -> client ; GError * error = NULL ; Buffer * buffer ; gboolean retval = G_SOURCE_CONTINUE ; g_object_ref ( client ) ; while (! side -> closed ) { if (! side -> got_first_byte ) buffer = buffer_new ( 1, NULL ) ; else if (! client -> authenticated ) buffer = buffer_new ( 64, NULL ) ; else buffer = side -> current_read_buffer ; if (! buffer_read ( side, buffer, socket ) ) { if ( buffer!= side -> current_read_buffer ) buffer_unref ( buffer ) ; break ; } if (! client -> authenticated ) { if ( buffer -> pos > 0 ) { gboolean found_auth_end = FALSE ; gsize extra_data ; buffer -> size = buffer -> pos ; if (! side -> got_first_byte ) { buffer -> send_credentials = TRUE ; side -> got_first_byte = TRUE ; } else if ( side == & client -> client_side ) { gssize auth_end = find_auth_end ( client, buffer ) ; if ( auth_end >= 0 ) { found_auth_end = TRUE ; buffer -> size = auth_end ; extra_data = buffer -> pos - buffer -> size ; if ( extra_data > 0 ) side -> extra_input_data = g_bytes_new ( buffer -> data + buffer -> size, extra_data ) ; } <START_BUG> } <END_BUG> got_buffer_from_side ( side, buffer ) ; if ( found_auth_end ) client -> authenticated = TRUE ; } else { buffer_unref ( buffer ) ; } } else if ( buffer -> pos == buffer -> size ) { if ( buffer == & side -> header_buffer ) { gssize required ; required = g_dbus_message_bytes_needed ( buffer -> data, buffer -> size, & error ) ; if ( required < 0 ) { g_warning ( "Invalid   message   header   read" ) ; side_closed ( side ) ; } else { side -> current_read_buffer = buffer_new ( required, buffer ) ; } } else { got_buffer

Fix:
<S2SV_ModStart> ) ; } else if ( auth_end == FIND_AUTH_END_ABORT ) { buffer_unref ( buffer ) ; if ( client -> proxy -> log_messages ) g_print ( "Invalid <S2SV_blank> AUTH <S2SV_blank> line, <S2SV_blank> aborting\\n" ) ; side_closed ( side ) ; break ; }
Buggy code:
 int sock_queue_err_skb ( struct sock * sk, struct sk_buff * skb ) { if ( atomic_read ( & sk -> sk_rmem_alloc ) + skb -> truesize >= ( unsigned int ) sk -> sk_rcvbuf ) return - ENOMEM ; skb_orphan ( skb ) ; skb -> sk = sk ; skb -> destructor = sock_rmem_free ; atomic_add ( skb -> truesize, & sk -> sk_rmem_alloc ) ; <START_BUG> skb_dst_force ( skb ) ; <END_BUG> skb_queue_tail ( & sk -> sk_error_queue, skb ) ; if (! sock_flag ( sk, SOCK_DEAD ) ) sk -> sk_data_ready ( sk ) ; return 0 ; }

Fix:
<S2SV_ModStart> sk_rmem_alloc ) ; skb_set_err_queue ( skb ) ;
Buggy code:
 static void FstringParser_Init ( FstringParser * state ) { state -> last_str = NULL ; <START_BUG> ExprList_Init ( & state -> expr_list ) ; <END_BUG> FstringParser_check_invariants ( state ) ; }

Fix:
<S2SV_ModStart> = NULL ; state -> fmode = 0 ;
Buggy code:
 static Image * ReadMPCImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char cache_filename [ MagickPathExtent ], id [ MagickPathExtent ], keyword [ MagickPathExtent ], * options ; const unsigned char * p ; GeometryInfo geometry_info ; Image * image ; int c ; LinkedListInfo * profiles ; MagickBooleanType status ; MagickOffsetType offset ; MagickStatusType flags ; register ssize_t i ; size_t depth, length ; ssize_t count ; StringInfo * profile ; unsigned int signature ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) CopyMagickString ( cache_filename, image -> filename, MagickPathExtent ) ; AppendImageFormat ( "cache", cache_filename ) ; c = ReadBlobByte ( image ) ; if ( c == EOF ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } * id = '\\0' ; ( void ) ResetMagickMemory ( keyword, 0, sizeof ( keyword ) ) ; offset = 0 ; do { profiles = ( LinkedListInfo * ) NULL ; length = MagickPathExtent ; options = AcquireString ( ( char * ) NULL ) ; signature = GetMagickSignature ( ( const StringInfo * ) NULL ) ; image -> depth = 8 ; image -> compression = NoCompression ; while ( ( isgraph ( c )!= MagickFalse ) && ( c!= ( int ) ':' ) ) { register char * p ; if ( c == ( int ) '{' ) { char * comment ; length = MagickPathExtent ; comment = AcquireString ( ( char * ) NULL ) ; for ( p = comment ; comment!= ( char *

Fix:
<S2SV_ModStart> PseudoClass ) { image -> colormap = ( PixelInfo * ) AcquireQuantumMemory ( <S2SV_ModEnd> image -> colors <S2SV_ModStart> image -> colors + 1, sizeof ( * image -> colormap ) ) ; if ( image -> colormap == ( PixelInfo * ) NULL <S2SV_ModEnd> ) ThrowReaderException ( <S2SV_ModStart> ) break ; if ( ( AcquireMagickResource ( WidthResource <S2SV_ModEnd>, image -> <S2SV_ModStart> image -> columns ) == MagickFalse ) || ( AcquireMagickResource ( HeightResource <S2SV_ModStart> image -> rows ) <S2SV_ModEnd> == MagickFalse ) <S2SV_ModStart> == MagickFalse ) ) ThrowReaderException ( ImageError, "WidthOrHeightExceedsLimit" <S2SV_ModEnd> ) ; status
Buggy code:
 static void sync_lockstate_on_connect ( btif_hh_device_t * p_dev ) { int keylockstates ; BTIF_TRACE_EVENT ( "%s:   Syncing   keyboard   lock   states   after   " "reconnect...", __FUNCTION__ ) ; update_keyboard_lockstates ( p_dev ) ; keylockstates = get_keylockstates ( ) ; if ( keylockstates ) { BTIF_TRACE_DEBUG ( "%s:   Sending   hid   report   to   kernel   " "indicating   lock   key   state   0x%x", __FUNCTION__, keylockstates ) ; <START_BUG> usleep ( 200000 ) ; <END_BUG> toggle_os_keylockstates ( p_dev -> fd, keylockstates ) ; } else { BTIF_TRACE_DEBUG ( "%s:   NOT   sending   hid   report   to   kernel   " "indicating   lock   key   state   0x%x", __FUNCTION__, keylockstates ) ; } }

Fix:
<S2SV_ModStart> keylockstates ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 200000 )
Buggy code:
 static void * proc_pid_follow_link ( struct dentry * dentry, struct nameidata * nd ) { struct inode * inode = dentry -> d_inode ; int error = - EACCES ; path_put ( & nd -> path ) ; if (! proc_fd_access_allowed ( inode ) ) goto out ; error = PROC_I ( inode ) -> op. proc_get_link ( inode, & nd -> path ) ; <START_BUG> nd -> last_type = LAST_BIND ; <END_BUG> out : return ERR_PTR ( error ) ; }

Fix:
<S2SV_ModStart> path ) ; <S2SV_ModEnd> out : return
Buggy code:
 static int ext4_fill_super ( struct super_block * sb, void * data, int silent ) { char * orig_data = kstrdup ( data, GFP_KERNEL ) ; struct buffer_head * bh ; struct ext4_super_block * es = NULL ; struct ext4_sb_info * sbi = kzalloc ( sizeof ( * sbi ), GFP_KERNEL ) ; ext4_fsblk_t block ; ext4_fsblk_t sb_block = get_sb_block ( & data ) ; ext4_fsblk_t logical_sb_block ; unsigned long offset = 0 ; unsigned long journal_devnum = 0 ; unsigned long def_mount_opts ; struct inode * root ; const char * descr ; int ret = - ENOMEM ; int blocksize, clustersize ; unsigned int db_count ; unsigned int i ; int needs_recovery, has_huge_files, has_bigalloc ; __u64 blocks_count ; int err = 0 ; unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO ; ext4_group_t first_not_zeroed ; if ( ( data &&! orig_data ) ||! sbi ) goto out_free_base ; sbi -> s_blockgroup_lock = kzalloc ( sizeof ( struct blockgroup_lock ), GFP_KERNEL ) ; if (! sbi -> s_blockgroup_lock ) goto out_free_base ; sb -> s_fs_info = sbi ; sbi -> s_sb = sb ; sbi -> s_inode_readahead_blks = EXT4_DEF_INODE_READAHEAD_BLKS ; sbi -> s_sb_block = sb_block ; if ( sb -> s_bdev -> bd_part ) sbi -> s_sectors_written_start = part_stat_read ( sb -> s_bdev -> bd_part, sectors [ 1 ] ) ; strreplace ( sb -> s_id, '//', '!' ) ; ret = - EINVAL ; blocksize = sb_min_blocksize ( sb, EXT4_MIN_BLOCK_SIZE ) ; if (! blocksize ) { ext4_msg ( sb, KERN_ERR, "unable  

Fix:
<S2SV_ModStart> sb ) ; if ( ext4_has_feature_meta_bg ( sb ) ) { if ( le32_to_cpu ( es -> s_first_meta_bg ) >= db_count ) { ext4_msg ( sb, KERN_WARNING, "first <S2SV_blank> meta <S2SV_blank> block <S2SV_blank> group <S2SV_blank> too <S2SV_blank> large: <S2SV_blank> %u <S2SV_blank> " "(group <S2SV_blank> descriptor <S2SV_blank> block <S2SV_blank> count <S2SV_blank> %u)", le32_to_cpu ( es -> s_first_meta_bg ), db_count ) ; goto failed_mount ; } }
Buggy code:
 timestamp PGTYPEStimestamp_from_asc ( char * str, char * * endptr ) { timestamp result ; # ifdef HAVE_INT64_TIMESTAMP int64 noresult = 0 ; # else double noresult = 0.0 ; # endif fsec_t fsec ; struct tm tt, * tm = & tt ; int dtype ; int nf ; char * field [ MAXDATEFIELDS ] ; int ftype [ MAXDATEFIELDS ] ; char lowstr [ MAXDATELEN + MAXDATEFIELDS ] ; char * realptr ; char * * ptr = ( endptr!= NULL )? endptr : & realptr ; <START_BUG> if ( strlen ( str ) >= sizeof ( lowstr ) ) <END_BUG> { errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; }  if ( ParseDateTime ( str, lowstr, field, ftype, & nf, ptr )!= 0 || <START_BUG> DecodeDateTime ( field, ftype, nf, & dtype, tm, & fsec, 0 )!= 0 ) { errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; } switch ( dtype ) { case DTK_DATE : if ( tm2timestamp ( tm, fsec, NULL, & result )!= 0 ) { errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; } break ; case DTK_EPOCH : result = SetEpochTimestamp ( ) ; break ; case DTK_LATE : TIMESTAMP_NOEND ( result ) ; break ; case DTK_EARLY : TIMESTAMP_NOBEGIN ( result ) ; break ; case DTK_INVALID : errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; default : errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; } errno = 0 ; return result ; }<END_BUG>

Fix:
<S2SV_ModStart> ( str ) > MAXDATELEN ) { errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; } if ( ParseDateTime ( str, lowstr, field, ftype, & nf, ptr )!= 0 || DecodeDateTime ( field, ftype, nf, & dtype, tm, & fsec, 0 )!= 0 ) { errno = PGTYPES_TS_BAD_TIMESTAMP ; return ( noresult ) ; } switch ( dtype ) { case DTK_DATE : if ( tm2timestamp ( tm, fsec, NULL, & result <S2SV_ModEnd> )!= 0 <S2SV_ModStart> )!= 0 <S2SV_ModEnd> ) { errno
Buggy code:
 static PyMemoEntry * _PyMemoTable_Lookup ( PyMemoTable * self, PyObject * key ) { size_t i ; size_t perturb ; <START_BUG> size_t mask = ( size_t ) self -> mt_mask ; <END_BUG> PyMemoEntry * table = self -> mt_table ; PyMemoEntry * entry ; Py_hash_t hash = ( Py_hash_t ) key >> 3 ; i = hash & mask ; entry = & table [ i ] ; if ( entry -> me_key == NULL || entry -> me_key == key ) return entry ; for ( perturb = hash ; ; perturb >>= PERTURB_SHIFT ) { i = ( i << 2 ) + i + perturb + 1 ; entry = & table [ i & mask ] ; if ( entry -> me_key == NULL || entry -> me_key == key ) return entry ; } Py_UNREACHABLE ( ) ; }

Fix:
<S2SV_ModStart> size_t mask = <S2SV_ModEnd> self -> mt_mask
Buggy code:
 int main ( int argc, char * argv [ ] ) { OM_uint32 minor, major ; gss_ctx_id_t context ; gss_union_ctx_id_desc uctx ; krb5_gss_ctx_id_rec kgctx ; krb5_key k1, k2 ; krb5_keyblock kb1, kb2 ; gss_buffer_desc in, out ; unsigned char k1buf [ 32 ], k2buf [ 32 ], outbuf [ 44 ] ; size_t i ; context = ( gss_ctx_id_t ) & uctx ; uctx. mech_type = & mech_krb5 ; uctx. internal_ctx_id = ( gss_ctx_id_t ) & kgctx ; kgctx. k5_context = NULL ; <START_BUG> kgctx. have_acceptor_subkey = 1 ; <END_BUG> kb1. contents = k1buf ; kb2. contents = k2buf ; for ( i = 0 ; i < sizeof ( tests ) // sizeof ( * tests ) ; i ++ ) { kb1. enctype = tests [ i ]. enctype ; kb1. length = fromhex ( tests [ i ]. key1, k1buf ) ; check_k5err ( NULL, "create_key", krb5_k_create_key ( NULL, & kb1, & k1 ) ) ; kgctx. subkey = k1 ; kb2. enctype = tests [ i ]. enctype ; kb2. length = fromhex ( tests [ i ]. key2, k2buf ) ; check_k5err ( NULL, "create_key", krb5_k_create_key ( NULL, & kb2, & k2 ) ) ; kgctx. acceptor_subkey = k2 ; in. length = 0 ; in. value = NULL ; major = gss_pseudo_random ( & minor, context, GSS_C_PRF_KEY_PARTIAL, & in, 44, & out ) ; check_gsserr ( "gss_pseudo_random", major, minor ) ; ( void ) fromhex ( tests [ i ]. out1, outbuf ) ; assert ( out. length == 44 && memcmp ( out.

Fix:
<S2SV_ModStart> ; kgctx. established = 1 ; kgctx.
Buggy code:
 static ssize_t qib_write ( struct file * fp, const char __user * data, size_t count, loff_t * off ) { const struct qib_cmd __user * ucmd ; struct qib_ctxtdata * rcd ; const void __user * src ; size_t consumed, copy = 0 ; struct qib_cmd cmd ; ssize_t ret = 0 ; void * dest ; <START_BUG> if ( count < sizeof ( cmd. type ) ) { <END_BUG> ret = - EINVAL ; goto bail ; } ucmd = ( const struct qib_cmd __user * ) data ; if ( copy_from_user ( & cmd. type, & ucmd -> type, sizeof ( cmd. type ) ) ) { ret = - EFAULT ; goto bail ; } consumed = sizeof ( cmd. type ) ; switch ( cmd. type ) { case QIB_CMD_ASSIGN_CTXT : case QIB_CMD_USER_INIT : copy = sizeof ( cmd. cmd. user_info ) ; dest = & cmd. cmd. user_info ; src = & ucmd -> cmd. user_info ; break ; case QIB_CMD_RECV_CTRL : copy = sizeof ( cmd. cmd. recv_ctrl ) ; dest = & cmd. cmd. recv_ctrl ; src = & ucmd -> cmd. recv_ctrl ; break ; case QIB_CMD_CTXT_INFO : copy = sizeof ( cmd. cmd. ctxt_info ) ; dest = & cmd. cmd. ctxt_info ; src = & ucmd -> cmd. ctxt_info ; break ; case QIB_CMD_TID_UPDATE : case QIB_CMD_TID_FREE : copy = sizeof ( cmd. cmd. tid_info ) ; dest = & cmd. cmd. tid_info ; src = & ucmd -> cmd. tid_info ; break ; case QIB_CMD_SET_PART_KEY : copy = sizeof ( cmd. cmd. part_key ) ; dest = & cmd. cmd. part_key ; src = & ucmd -> cmd. part_key ; break ; case QIB_CMD_DISARM_BUFS : case QIB_CMD_PIOAVAILUPD : copy = 0 ; src = NULL ; dest = NULL ; break ; case QIB_CMD_POLL_TYPE : copy =

Fix:
<S2SV_ModStart> ; if ( WARN_ON_ONCE (! ib_safe_file_access ( fp ) ) ) return - EACCES ; if (
Buggy code:
 rfbBool ReadFromRFBServer ( rfbClient * client, char * out, unsigned int n ) <START_BUG> { <END_BUG> # undef DEBUG_READ_EXACT # ifdef DEBUG_READ_EXACT char * oout = out ; unsigned int nn = n ; rfbClientLog ( "ReadFromRFBServer   %d   bytes\\n", n ) ; # endif if (! out ) return FALSE ; if ( client -> serverPort == - 1 ) { rfbVNCRec * rec = client -> vncRec ; struct timeval tv ; if ( rec -> readTimestamp ) { rec -> readTimestamp = FALSE ; if (! fread ( & tv, sizeof ( struct timeval ), 1, rec -> file ) ) return FALSE ; tv. tv_sec = rfbClientSwap32IfLE ( tv. tv_sec ) ; tv. tv_usec = rfbClientSwap32IfLE ( tv. tv_usec ) ; if ( rec -> tv. tv_sec!= 0 &&! rec -> doNotSleep ) { struct timeval diff ; diff. tv_sec = tv. tv_sec - rec -> tv. tv_sec ; diff. tv_usec = tv. tv_usec - rec -> tv. tv_usec ; if ( diff. tv_usec < 0 ) { diff. tv_sec -- ; diff. tv_usec += 1000000 ; } # ifndef WIN32 sleep ( diff. tv_sec ) ; usleep ( diff. tv_usec ) ; # else Sleep ( diff. tv_sec * 1000 + diff. tv_usec // 1000 ) ; # endif } rec -> tv = tv ; } return ( fread ( out, 1, n, rec -> file )!= n? FALSE : TRUE ) ; } if ( n <= client -> buffered ) { memcpy ( out, client -> bufoutptr, n ) ; client -> bufoutptr += n ; client -> buffered -= n ; # ifdef DEBUG_READ_EXACT goto hexdump ; # endif return TRUE ; } memcpy ( out, client -> bufoutptr, client -> buffered ) ; out += client -> buffered ; n -= client -> buffered ; client -> bufoutptr = client -> buf ; client -> buffered = 0 ; if ( n <= RFB_BUF_SIZE ) { while ( client -> buffered

Fix:
<S2SV_ModStart> n ) { const int USECS_WAIT_PER_RETRY = 100000 ; int retries = 0 ; <S2SV_ModStart> EAGAIN ) { if ( client -> readTimeout > 0 && ++ retries > ( client -> readTimeout * 1000 * 1000 // USECS_WAIT_PER_RETRY ) ) { rfbClientLog ( "Connection <S2SV_blank> timed <S2SV_blank> out\\n" ) ; return FALSE ; } <S2SV_ModStart> ( client, USECS_WAIT_PER_RETRY <S2SV_ModEnd> ) ; i <S2SV_ModStart> EAGAIN ) { if ( client -> readTimeout > 0 && ++ retries > ( client -> readTimeout * 1000 * 1000 // USECS_WAIT_PER_RETRY ) ) { rfbClientLog ( "Connection <S2SV_blank> timed <S2SV_blank> out\\n" ) ; return FALSE ; } <S2SV_ModStart> ( client, USECS_WAIT_PER_RETRY <S2SV_ModEnd> ) ; i
Buggy code:
 static int misaligned_load ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift, int do_sign_extend ) { int error ; int destreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, address ) ; <END_BUG> destreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; if (! access_ok ( VERIFY_READ, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } if ( __copy_user ( & buffer, ( const void * ) ( int ) address, ( 1 << width_shift ) ) > 0 ) { return - 1 ; } switch ( width_shift ) { case 1 : if ( do_sign_extend ) { regs -> regs [ destreg ] = ( __u64 ) ( __s64 ) * ( __s16 * ) & buffer ; } else { regs -> regs [ destreg ] = ( __u64 ) * ( __u16 * ) & buffer ; } break ; case 2 : regs -> regs [ destreg ] = ( __u64 ) ( __s64 ) * ( __s32 * ) & buffer ; break ; case 3 : regs -> regs [ destreg ] = buffer ; break ; default : printk ( "Unexpected   width_shift   %d   in   misaligned_load,   PC=%08lx\\n", width_shift, ( unsigned long ) regs -> pc ) ; break ; } } else { __u64 lo, hi ; switch ( width_shift ) { case 1 : misaligned_kernel_word_load ( address, do_sign_extend, & regs -> regs [ destreg ] ) ; break ; case 2 : asm ( "ldlo.l   %1,   0,   %0" : "=r" ( lo ) : "r" ( address ) ) ; asm ( "ldhi.l   %1,   3,   %0" : "=r" ( hi ) : "

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 bool radeon_atom_get_tv_timings ( struct radeon_device * rdev, int index, struct drm_display_mode * mode ) { struct radeon_mode_info * mode_info = & rdev -> mode_info ; ATOM_ANALOG_TV_INFO * tv_info ; ATOM_ANALOG_TV_INFO_V1_2 * tv_info_v1_2 ; ATOM_DTD_FORMAT * dtd_timings ; int data_index = GetIndexIntoMasterTable ( DATA, AnalogTV_Info ) ; u8 frev, crev ; u16 data_offset, misc ; if (! atom_parse_data_header ( mode_info -> atom_context, data_index, NULL, & frev, & crev, & data_offset ) ) return false ; switch ( crev ) { case 1 : tv_info = ( ATOM_ANALOG_TV_INFO * ) ( mode_info -> atom_context -> bios + data_offset ) ; <START_BUG> if ( index > MAX_SUPPORTED_TV_TIMING ) <END_BUG> return false ; mode -> crtc_htotal = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_Total ) ; mode -> crtc_hdisplay = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_Disp ) ; mode -> crtc_hsync_start = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_SyncStart ) ; mode -> crtc_hsync_end = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_SyncStart ) + le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_SyncWidth ) ; mode -> crtc_vtotal = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_V_Total ) ; mode -> crtc_vdisplay = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_V_Disp ) ; mode -> crtc_vsync_

Fix:
<S2SV_ModStart> if ( index >= <S2SV_ModEnd> MAX_SUPPORTED_TV_TIMING ) return <S2SV_ModStart> if ( index >= <S2SV_ModEnd> MAX_SUPPORTED_TV_TIMING_V1_2 ) return
Buggy code:
 static sent_status_t send_data_to_app ( int fd, BT_HDR * p_buf ) { if ( p_buf -> len == 0 ) return SENT_ALL ; <START_BUG> ssize_t sent = send ( fd, p_buf -> data + p_buf -> offset, p_buf -> len, MSG_DONTWAIT ) ; <END_BUG> if ( sent == - 1 ) { if ( errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR ) return SENT_NONE ; LOG_ERROR ( "%s   error   writing   RFCOMM   data   back   to   app:   %s", __func__, strerror ( errno ) ) ; return SENT_FAILED ; } if ( sent == 0 ) return SENT_FAILED ; if ( sent == p_buf -> len ) return SENT_ALL ; p_buf -> offset += sent ; p_buf -> len -= sent ; return SENT_PARTIAL ; }

Fix:
<S2SV_ModStart> ssize_t sent = TEMP_FAILURE_RETRY ( <S2SV_ModStart> len, MSG_DONTWAIT )
Buggy code:
 void loadServerConfigFromString ( char * config ) { char * err = NULL ; int linenum = 0, totlines, i ; int slaveof_linenum = 0 ; sds * lines ; lines = sdssplitlen ( config, strlen ( config ), "\\n", 1, & totlines ) ; for ( i = 0 ; i < totlines ; i ++ ) { sds * argv ; int argc ; linenum = i + 1 ; lines [ i ] = sdstrim ( lines [ i ], "   \\t\\r\\n" ) ; if ( lines [ i ] [ 0 ] == '#' || lines [ i ] [ 0 ] == '\\0' ) continue ; argv = sdssplitargs ( lines [ i ], & argc ) ; if ( argv == NULL ) { err = "Unbalanced   quotes   in   configuration   line" ; goto loaderr ; } if ( argc == 0 ) { sdsfreesplitres ( argv, argc ) ; continue ; } sdstolower ( argv [ 0 ] ) ; if (! strcasecmp ( argv [ 0 ], "timeout" ) && argc == 2 ) { server. maxidletime = atoi ( argv [ 1 ] ) ; if ( server. maxidletime < 0 ) { err = "Invalid   timeout   value" ; goto loaderr ; } } else if (! strcasecmp ( argv [ 0 ], "tcp-keepalive" ) && argc == 2 ) { server. tcpkeepalive = atoi ( argv [ 1 ] ) ; if ( server. tcpkeepalive < 0 ) { err = "Invalid   tcp-keepalive   value" ; goto loaderr ; } } else if (! strcasecmp ( argv [ 0 ], "protected-mode" ) && argc == 2 ) { if ( ( server. protected_mode = yesnotoi ( argv [ 1 ] ) ) == - 1 ) { err = "argument   must   be   \'yes\'   or   \'no\'" ; goto loaderr ; } } else if (! strcasecmp ( argv [ 0 ], "port" ) && argc == 2 ) { server. port = atoi ( argv [ 1 ] ) ; if ( server. port < 0 || server. port > 65535 ) { err = "Invalid   port" ; goto loaderr ; } } else if

Fix:
<S2SV_ModStart> == - 1 || class == CLIENT_TYPE_MASTER ) { err = "Unrecognized <S2SV_blank> client <S2SV_blank> limit <S2SV_blank> class: <S2SV_blank> the <S2SV_blank> user <S2SV_blank> specified <S2SV_blank> " "an <S2SV_blank> invalid <S2SV_blank> one, <S2SV_blank> or <S2SV_blank> \'master\' <S2SV_blank> which <S2SV_blank> has <S2SV_blank> no <S2SV_blank> buffer <S2SV_blank> limits." <S2SV_ModEnd> ; goto loaderr
Buggy code:
 static void set_rate_correction_factor ( VP9_COMP * cpi, double factor ) { <START_BUG> if ( cpi -> common. frame_type == KEY_FRAME ) { <END_BUG>  cpi -> rc. key_frame_rate_correction_factor = factor ; <START_BUG> } else { if ( ( cpi -> refresh_alt_ref_frame || cpi -> refresh_golden_frame ) && <END_BUG>! cpi -> rc. is_src_frame_alt_ref &&  <START_BUG>! ( cpi -> use_svc && cpi -> oxcf. end_usage == USAGE_STREAM_FROM_SERVER ) ) <END_BUG> cpi -> rc. gf_rate_correction_factor = factor ; else  cpi -> rc. rate_correction_factor = factor ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> factor ) { RATE_CONTROL * const rc = & cpi -> rc ; factor //= rcf_mult [ cpi -> rc. frame_size_selector ] ; factor = fclamp ( factor, MIN_BPB_FACTOR, MAX_BPB_FACTOR ) ; <S2SV_ModStart> KEY_FRAME ) { rc -> rate_correction_factors [ KF_STD ] = factor ; } else if ( cpi -> oxcf. pass == 2 ) { RATE_FACTOR_LEVEL rf_lvl = cpi -> twopass. gf_group. rf_level [ cpi -> twopass. gf_group. index ] ; rc -> rate_correction_factors [ rf_lvl ] <S2SV_ModEnd> = factor ; <S2SV_ModStart> ) &&! rc -> <S2SV_ModEnd> is_src_frame_alt_ref &&! <S2SV_ModStart> is_src_frame_alt_ref &&! <S2SV_ModEnd> cpi -> use_svc <S2SV_ModStart> -> use_svc && ( <S2SV_ModStart> -> oxcf. rc_mode!= VPX_CBR || cpi -> oxcf. gf_cbr_boost_pct > 20 ) ) rc -> rate_correction_factors [ GF_ARF_STD ] <S2SV_ModEnd> = factor
Buggy code:
 struct sk_buff * sock_alloc_send_pskb ( struct sock * sk, unsigned long header_len, unsigned long data_len, int noblock, int * errcode ) { struct sk_buff * skb ; gfp_t gfp_mask ; long timeo ; int err ; <START_BUG> gfp_mask = sk -> sk_allocation ; <END_BUG> if ( gfp_mask & __GFP_WAIT ) gfp_mask |= __GFP_REPEAT ; timeo = sock_sndtimeo ( sk, noblock ) ; while ( 1 ) { err = sock_error ( sk ) ; if ( err!= 0 ) goto failure ; err = - EPIPE ; if ( sk -> sk_shutdown & SEND_SHUTDOWN ) goto failure ; if ( atomic_read ( & sk -> sk_wmem_alloc ) < sk -> sk_sndbuf ) { skb = alloc_skb ( header_len, gfp_mask ) ; if ( skb ) {  int npages ; <START_BUG> int i ; if (! data_len ) <END_BUG> break ;  npages = ( data_len + ( PAGE_SIZE - 1 ) ) >> PAGE_SHIFT ; skb -> truesize += data_len ; skb_shinfo ( skb ) -> nr_frags = npages ; for ( i = 0 ; i < npages ; i ++ ) { struct page * page ; page = alloc_pages ( sk -> sk_allocation, 0 ) ; if (! page ) { err = - ENOBUFS ; skb_shinfo ( skb ) -> nr_frags = i ; kfree_skb ( skb ) ; goto failure ; } __skb_fill_page_desc ( skb, i, page, 0, ( data_len >= PAGE_SIZE? PAGE_SIZE : data_len ) ) ; data_len -= PAGE_SIZE ; } break ; } err = - ENOBUFS ; goto failure ; } set_bit ( SOCK_ASYNC_NOSPACE, & sk -> sk_socket -> flags ) ; set_bit ( SOCK_NOSPACE, & sk -> sk_socket -> flags ) ; err = - EAGAIN ; if (! timeo ) goto failure ; if ( signal_pending ( current ) ) goto interrupted ; timeo = sock_wait_for_wmem (

Fix:
<S2SV_ModStart> int err ; int npages = ( data_len + ( PAGE_SIZE - 1 ) ) >> PAGE_SHIFT ; err = - EMSGSIZE ; if ( npages > MAX_SKB_FRAGS ) goto failure ; <S2SV_ModStart> ) { int <S2SV_ModEnd> i ; if <S2SV_ModStart> data_len ) break <S2SV_ModEnd> ; skb ->
Buggy code:
 static expr_ty ast_for_trailer ( struct compiling * c, const node * n, expr_ty left_expr ) { REQ ( n, trailer ) ; if ( TYPE ( CHILD ( n, 0 ) ) == LPAR ) { if ( NCH ( n ) == 2 ) return Call ( left_expr, NULL, NULL, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; else <START_BUG> return ast_for_call ( c, CHILD ( n, 1 ), left_expr ) ; <END_BUG> } else if ( TYPE ( CHILD ( n, 0 ) ) == DOT ) { PyObject * attr_id = NEW_IDENTIFIER ( CHILD ( n, 1 ) ) ; if (! attr_id ) return NULL ; return Attribute ( left_expr, attr_id, Load, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } else { REQ ( CHILD ( n, 0 ), LSQB ) ; REQ ( CHILD ( n, 2 ), RSQB ) ; n = CHILD ( n, 1 ) ; if ( NCH ( n ) == 1 ) { slice_ty slc = ast_for_slice ( c, CHILD ( n, 0 ) ) ; if (! slc ) return NULL ; return Subscript ( left_expr, slc, Load, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } else { int j ; slice_ty slc ; expr_ty e ; int simple = 1 ; asdl_seq * slices, * elts ; slices = _Ta3_asdl_seq_new ( ( NCH ( n ) + 1 ) // 2, c -> c_arena ) ; if (! slices ) return NULL ; for ( j = 0 ; j < NCH ( n ) ; j += 2 ) { slc = ast_for_slice ( c, CHILD ( n, j ) ) ; if (! slc ) return NULL ; if ( slc -> kind!= Index_kind ) simple = 0 ; asdl_seq_SET ( slices, j // 2, slc ) ; } if (! simple ) { return Subscript ( left_expr, ExtSlice ( slices, c -> c_

Fix:
<S2SV_ModStart> ), left_expr, true
Buggy code:
 <START_BUG> static INLINE void write_buffer_8x8 ( int16_t * output, __m128i * res, int stride ) { <END_BUG>  _mm_store_si128 ( ( __m128i * ) ( output + 0 * stride ), res [ 0 ] ) ; <START_BUG> <END_BUG> _mm_store_si128 ( ( __m128i * ) ( output + 1 * stride ), res [ 1 ] ) ;  <START_BUG> _mm_store_si128 ( ( __m128i * ) ( output + 2 * stride ), res [ 2 ] ) ; <END_BUG>  _mm_store_si128 ( ( __m128i * ) ( output + 3 * stride ), res [ 3 ] ) ; <START_BUG> <END_BUG> _mm_store_si128 ( ( __m128i * ) ( output + 4 * stride ), res [ 4 ] ) ;  <START_BUG> _mm_store_si128 ( ( __m128i * ) ( output + 5 * stride ), res [ 5 ] ) ; <END_BUG>  _mm_store_si128 ( ( __m128i * ) ( output + 6 * stride ), res [ 6 ] ) ; <START_BUG> <END_BUG> _mm_store_si128 ( ( __m128i * ) ( output + 7 * stride ), res [ 7 ] ) ;  }

Fix:
<S2SV_ModStart> void write_buffer_8x8 ( tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> stride ) { store_output ( & res [ 0 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 1 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 2 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 3 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 4 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 5 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 6 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) ) ; store_output ( & res [ 7 ], <S2SV_ModEnd> ( output + <S2SV_ModStart> * stride ) <S2SV_ModEnd> ) ; }
Buggy code:
 int X509_verify ( X509 * a, EVP_PKEY * r ) <START_BUG> { <END_BUG> return ( ASN1_item_verify ( ASN1_ITEM_rptr ( X509_CINF ), a -> sig_alg, a -> signature, a -> cert_info, r ) ) ; }

Fix:
<S2SV_ModStart> r ) { if ( X509_ALGOR_cmp ( a -> sig_alg, a -> cert_info -> signature ) ) return 0 ;
Buggy code:
 static inline unsigned long zap_pmd_range ( struct mmu_gather * tlb, struct vm_area_struct * vma, pud_t * pud, unsigned long addr, unsigned long end, struct zap_details * details ) { pmd_t * pmd ; unsigned long next ; pmd = pmd_offset ( pud, addr ) ; do { next = pmd_addr_end ( addr, end ) ; if ( pmd_trans_huge ( * pmd ) ) { if ( next - addr!= HPAGE_PMD_SIZE ) { VM_BUG_ON (! rwsem_is_locked ( & tlb -> mm -> mmap_sem ) ) ; split_huge_page_pmd ( vma -> vm_mm, pmd ) ; } else if ( zap_huge_pmd ( tlb, vma, pmd, addr ) ) <START_BUG> continue ; <END_BUG> }  if ( pmd_none_or_clear_bad ( pmd ) ) <START_BUG> <END_BUG> continue ;  <START_BUG> next = zap_pte_range ( tlb, vma, pmd, addr, next, details ) ; <END_BUG> cond_resched ( ) ; } while ( pmd ++, addr = next, addr!= end ) ; return addr ; }

Fix:
<S2SV_ModStart> addr ) ) goto next <S2SV_ModEnd> ; } if <S2SV_ModStart> } if ( pmd_none_or_trans_huge_or_clear_bad <S2SV_ModEnd> ( pmd ) <S2SV_ModStart> pmd ) ) goto next <S2SV_ModEnd> ; next = <S2SV_ModStart> details ) ; next :