nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void set_source_var_based_partition ( VP9_COMP * cpi, const TileInfo * const tile, <START_BUG> MODE_INFO * * mi_8x8, <END_BUG> int mi_row, int mi_col ) { VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCK * x = & cpi -> mb ; <START_BUG> const int mis = cm -> mi_stride ; <END_BUG> int row8x8_remaining = tile -> mi_row_end - mi_row ;  <START_BUG> int col8x8_remaining = tile -> mi_col_end - mi_col ; <END_BUG>  int r, c ; <START_BUG> <END_BUG> MODE_INFO * mi_upper_left = cm -> mi + mi_row * mis + mi_col ;  assert ( ( row8x8_remaining > 0 ) && ( col8x8_remaining > 0 ) ) ; if ( ( col8x8_remaining >= MI_BLOCK_SIZE ) && ( row8x8_remaining >= MI_BLOCK_SIZE ) ) { <START_BUG> const int src_stride = x -> plane [ 0 ]. src. stride ; <END_BUG>  const int pre_stride = cpi -> Last_Source -> y_stride ; <START_BUG> const uint8_t * src = x -> plane [ 0 ]. src. buf ; const int pre_offset = ( mi_row * MI_SIZE ) * pre_stride + ( mi_col * MI_SIZE ) ; <END_BUG> const uint8_t * pre_src = cpi -> Last_Source -> y_buffer + pre_offset ;  const int thr_32x32 = cpi -> sf. source_var_thresh ; const int thr_64x64 = thr_32x32 << 1 ; int i, j ; int index ; diff d32 [ 4 ] ; int use16x16 = 0 ; <START_BUG> for ( i = 0 ; i < 4 ; i ++ ) { <END_BUG>  diff d16 [ 4 ] ; <START_BUG> for ( j = 0 ; j < 4 ; j ++ ) { int b_mi_row = coord_lookup [ i * 4 + j ]. row ; int b_mi_col = coord_lookup [ i * 4 + j ]. col ; int b_offset = b_mi_row * MI_SIZE * src_stride + b_mi_col * MI_SIZE<END_BUG>

Fix:
<S2SV_ModStart> const tile, MACROBLOCK * const x, <S2SV_ModStart> -> common ; <S2SV_ModEnd> const int mis <S2SV_ModStart> -> mi_stride ; const <S2SV_ModStart> - mi_row ; const <S2SV_ModStart> - mi_col ; <S2SV_ModEnd> MODE_INFO * mi_upper_left <S2SV_ModStart> mis + mi_col ; vp9_setup_src_planes ( x, cpi -> Source, mi_row, mi_col ) <S2SV_ModStart> ) ) { int i, j ; int index ; diff d32 [ 4 ] ; const int offset = ( mi_row >> 1 ) * cm -> mb_cols + ( mi_col >> 1 ) ; int is_larger_better = 0 ; int use32x32 = 0 ; unsigned int thr <S2SV_ModEnd> = cpi -> <S2SV_ModStart> = cpi -> source_var_thresh ; memset ( d32, 0, 4 * sizeof ( diff ) ) ; for ( i = 0 ; i < 4 ; i ++ ) { diff * d16 [ 4 ] ; for ( j = 0 ; j < 4 ; j ++ ) { int b_mi_row = coord_lookup [ i * 4 + j ]. row ; int b_mi_col = coord_lookup [ i * 4 + j ].
Buggy code:
 static int unmap_ref_private ( struct mm_struct * mm, struct vm_area_struct * vma, struct page * page, unsigned long address ) { struct hstate * h = hstate_vma ( vma ) ; struct vm_area_struct * iter_vma ; struct address_space * mapping ; struct prio_tree_iter iter ; pgoff_t pgoff ; address = address & huge_page_mask ( h ) ; pgoff = vma_hugecache_offset ( h, vma, address ) ; <START_BUG> mapping = ( struct address_space * ) page_private ( page ) ; <END_BUG> mutex_lock ( & mapping -> i_mmap_mutex ) ; vma_prio_tree_foreach ( iter_vma, & iter, & mapping -> i_mmap, pgoff, pgoff ) { if ( iter_vma == vma ) continue ; if (! is_vma_resv_set ( iter_vma, HPAGE_RESV_OWNER ) ) __unmap_hugepage_range ( iter_vma, address, address + huge_page_size ( h ), page ) ; } mutex_unlock ( & mapping -> i_mmap_mutex ) ; return 1 ; }

Fix:
<S2SV_ModStart> ; mapping = vma -> vm_file -> f_dentry -> d_inode -> i_mapping <S2SV_ModEnd> ; mutex_lock (
Buggy code:
 int ParseCaffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { uint32_t chan_chunk = 0, channel_layout = 0, bcount ; unsigned char * channel_identities = NULL ; unsigned char * channel_reorder = NULL ; int64_t total_samples = 0, infilesize ; CAFFileHeader caf_file_header ; CAFChunkHeader caf_chunk_header ; CAFAudioFormat caf_audio_format ; int i ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & caf_file_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & caf_file_header ) + 4, sizeof ( CAFFileHeader ) - 4, & bcount ) || bcount!= sizeof ( CAFFileHeader ) - 4 ) ) { error_line ( "%s   is   not   a   valid  .CAF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & caf_file_header, sizeof ( CAFFileHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } WavpackBigEndianToNative ( & caf_file_header, CAFFileHeaderFormat ) ; if ( caf_file_header. mFileVersion!= 1 ) { error_line ( "%s:   can\'t   handle   version   %d  .CAF   files!", infilename, caf_file_header. mFileVersion ) ; return WAVPACK_SOFT_ERROR ; } while ( 1 ) { if (! DoReadFile ( infile, & caf_chunk_header, sizeof ( CAFChunkHeader ), & bcount ) || bcount!= sizeof ( CAFChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .CAF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config

Fix:
<S2SV_ModStart> CAFChannelLayout * caf_channel_layout <S2SV_ModEnd> ; if ( <S2SV_ModStart> CAFChannelLayout ) || caf_chunk_header. mChunkSize > 1024 ) { error_line ( "this <S2SV_blank>.CAF <S2SV_blank> file <S2SV_blank> has <S2SV_blank> an <S2SV_blank> invalid <S2SV_blank> \'chan\' <S2SV_blank> chunk!" ) ; return WAVPACK_SOFT_ERROR ; } if ( debug_logging_mode ) error_line ( "\'chan\' <S2SV_blank> chunk <S2SV_blank> is <S2SV_blank> %d <S2SV_blank> bytes", ( int ) caf_chunk_header. mChunkSize ) ; caf_channel_layout = malloc ( ( size_t ) caf_chunk_header. mChunkSize ) ; if ( <S2SV_ModStart> } else { uint32_t <S2SV_ModEnd> bytes_to_copy = ( <S2SV_ModStart> ; char * buff ; if ( caf_chunk_header. mChunkSize < 0 || caf_chunk_header. mChunkSize > 1048576 ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.CAF <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; }
Buggy code:
 static Image * ReadARTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { const unsigned char * pixels ; Image * image ; QuantumInfo * quantum_info ; QuantumType quantum_type ; MagickBooleanType status ; size_t length ; ssize_t count, y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 1 ; image -> endian = MSBEndian ; ( void ) ReadBlobLSBShort ( image ) ; image -> columns = ( size_t ) ReadBlobLSBShort ( image ) ; ( void ) ReadBlobLSBShort ( image ) ; image -> rows = ( size_t ) ReadBlobLSBShort ( image ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( AcquireImageColormap ( image, 2 ) == MagickFalse ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; if ( image_info -> ping!= MagickFalse ) { ( void ) CloseBlob ( image ) ; return ( GetFirstImageInList ( image ) ) ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; } SetImageColorspace ( image, GRAYColorspace ) ; quantum_type = IndexQuantum ; quantum_info = AcquireQuantumInfo ( image_info, image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocation

Fix:
<S2SV_ModStart> ) length ) { quantum_info = DestroyQuantumInfo ( quantum_info ) ; <S2SV_ModStart> "UnableToReadImageData" ) ; }
Buggy code:
 static int caif_stream_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; int copied = 0 ; int target ; int err = 0 ; long timeo ; err = - EOPNOTSUPP ; if ( flags & MSG_OOB ) goto out ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> err = - EAGAIN ; if ( sk -> sk_state == CAIF_CONNECTING ) goto out ; caif_read_lock ( sk ) ; target = sock_rcvlowat ( sk, flags & MSG_WAITALL, size ) ; timeo = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; do { int chunk ; struct sk_buff * skb ; lock_sock ( sk ) ; skb = skb_dequeue ( & sk -> sk_receive_queue ) ; caif_check_flow_release ( sk ) ; if ( skb == NULL ) { if ( copied >= target ) goto unlock ; err = sock_error ( sk ) ; if ( err ) goto unlock ; err = - ECONNRESET ; if ( sk -> sk_shutdown & RCV_SHUTDOWN ) goto unlock ; err = - EPIPE ; if ( sk -> sk_state!= CAIF_CONNECTED ) goto unlock ; if ( sock_flag ( sk, SOCK_DEAD ) ) goto unlock ; release_sock ( sk ) ; err = - EAGAIN ; if (! timeo ) break ; caif_read_unlock ( sk ) ; timeo = caif_stream_data_wait ( sk, timeo ) ; if ( signal_pending ( current ) ) { err = sock_intr_errno ( timeo ) ; goto out ; } caif_read_lock ( sk ) ; continue ; unlock : release_sock ( sk ) ; break ; } release_sock ( sk ) ; chunk = min_t ( unsigned int, skb -> len, size ) ; if ( memcpy_toiovec ( msg -> msg_iov, skb -> data, chunk ) ) { skb_queue_head ( & sk -> sk_receive_queue, skb ) ; if ( copied == 0 ) copied = - EFAULT ; break ;

Fix:
<S2SV_ModStart> goto out ; <S2SV_ModEnd> err = -
Buggy code:
 static Image * ReadXBMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char buffer [ MagickPathExtent ], name [ MagickPathExtent ] ; Image * image ; int c ; MagickBooleanType status ; register ssize_t i, x ; register Quantum * q ; register unsigned char * p ; short int hex_digits [ 256 ] ; ssize_t y ; unsigned char * data ; unsigned int bit, byte, bytes_per_line, height, length, padding, version, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } width = 0 ; height = 0 ; * name = '\\0' ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) if ( sscanf ( buffer, "#define   %1024s   %u", name, & width ) == 2 ) if ( ( strlen ( name ) >= 6 ) && ( LocaleCompare ( name + strlen ( name ) - 6, "_width" ) == 0 ) ) break ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) if ( sscanf ( buffer, "#define   %1024s   %u", name, & height ) == 2 ) if ( ( strlen ( name ) >= 7 ) && ( LocaleCompare ( name + strlen ( name ) - 7, "_height" ) == 0 ) ) break ; image -> columns = width ; image -> rows = height ; image -> depth = 8 ; image -> storage_class = PseudoClass ; image -> colors = 2 ; version = 11 ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) { if ( sscanf ( buffer,

Fix:
<S2SV_ModStart> < 0 ) { data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; } <S2SV_ModEnd> * p ++ <S2SV_ModStart> < 0 ) { data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; } <S2SV_ModEnd> * p ++
Buggy code:
 error_t webSocketParseRequestLine ( WebSocket * webSocket, char_t * line ) { error_t error ; char_t * token ; char_t * p ; char_t * s ; TRACE_DEBUG ( "%s", line ) ; token = osStrtok_r ( line, "   \\r\\n", & p ) ; if ( token == NULL ) return ERROR_INVALID_REQUEST ; if ( osStrcasecmp ( token, "GET" ) ) return ERROR_INVALID_REQUEST ; token = osStrtok_r ( NULL, "   \\r\\n", & p ) ; if ( token == NULL ) return ERROR_INVALID_REQUEST ; <START_BUG> s = strchr ( token, '?' ) ; <END_BUG> if ( s!= NULL ) { * s = '\\0' ; error = webSocketDecodePercentEncodedString ( token, webSocket -> uri, WEB_SOCKET_URI_MAX_LEN ) ; if ( error ) return ERROR_INVALID_REQUEST ; if ( osStrlen ( s + 1 ) > WEB_SOCKET_QUERY_STRING_MAX_LEN ) return ERROR_INVALID_REQUEST ; osStrcpy ( webSocket -> queryString, s + 1 ) ; } else { error = webSocketDecodePercentEncodedString ( token, webSocket -> uri, WEB_SOCKET_URI_MAX_LEN ) ; if ( error ) return ERROR_INVALID_REQUEST ; webSocket -> queryString [ 0 ] = '\\0' ; } token = osStrtok_r ( NULL, "   \\r\\n", & p ) ; if ( token == NULL ) { webSocket -> handshakeContext. version = WS_HTTP_VERSION_0_9 ; webSocket -> handshakeContext. connectionClose = TRUE ; } else if (! osStrcasecmp ( token, "HTTP//1.0" ) ) { webSocket -> handshakeContext. version = WS_HTTP_VERSION_1_0 ; webSocket -> handshakeContext. connectionClose = TRUE ; } else if (! osStrcasecmp ( token, "HTTP//1.1" ) ) { webSocket -> handshakeContext. version = WS_HTTP_VERSION_1_1 ; webSocket -> handshakeContext. connectionClose = FALSE ; } else { return ERROR_INVALID_REQUEST ; } return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; s = osStrchr <S2SV_ModEnd> ( token,
Buggy code:
 static void define_gf_group ( VP8_COMP * cpi, FIRSTPASS_STATS * this_frame ) { FIRSTPASS_STATS next_frame ; FIRSTPASS_STATS * start_pos ; int i ; double r ; double boost_score = 0.0 ; double old_boost_score = 0.0 ; double gf_group_err = 0.0 ; double gf_first_frame_err = 0.0 ; double mod_frame_err = 0.0 ; double mv_ratio_accumulator = 0.0 ; double decay_accumulator = 1.0 ; double loop_decay_rate = 1.00 ; double this_frame_mv_in_out = 0.0 ; double mv_in_out_accumulator = 0.0 ; double abs_mv_in_out_accumulator = 0.0 ; double mod_err_per_mb_accumulator = 0.0 ; int max_bits = frame_max_bits ( cpi ) ; unsigned int allow_alt_ref = cpi -> oxcf. play_alternate && cpi -> oxcf. lag_in_frames ; int alt_boost = 0 ; int f_boost = 0 ; int b_boost = 0 ; int flash_detected ; cpi -> twopass. gf_group_bits = 0 ; cpi -> twopass. gf_decay_rate = 0 ; vp8_clear_system_state ( ) ; start_pos = cpi -> twopass. stats_in ; <START_BUG> vpx_memset ( & next_frame, 0, sizeof ( next_frame ) ) ; <END_BUG> mod_frame_err = calculate_modified_err ( cpi, this_frame ) ; gf_first_frame_err = mod_frame_err ; if ( cpi -> common. frame_type == KEY_FRAME ) gf_group_err -= gf_first_frame_err ; i = 0 ; while ( ( ( i < cpi -> twopass. static_scene_max_gf_interval ) || ( ( cpi -> twopass. frames_to_key - i ) < MIN_GF_INTERVAL ) ) && ( i < cpi -> twopass. frames_to_key ) ) { i ++ ; mod_frame_err = calculate_modified_err (

Fix:
<S2SV_ModStart>. stats_in ; memset <S2SV_ModEnd> ( & next_frame <S2SV_ModStart> break ; } memcpy <S2SV_ModEnd> ( this_frame,
Buggy code:
 int ff_mms_asf_header_parser ( MMSContext * mms ) { uint8_t * p = mms -> asf_header ; uint8_t * end ; int flags, stream_id ; mms -> stream_num = 0 ; if ( mms -> asf_header_size < sizeof ( ff_asf_guid ) * 2 + 22 || memcmp ( p, ff_asf_header, sizeof ( ff_asf_guid ) ) ) { av_log ( NULL, AV_LOG_ERROR, "Corrupt   stream   (invalid   ASF   header,   size=%d)\\n", mms -> asf_header_size ) ; return AVERROR_INVALIDDATA ; } end = mms -> asf_header + mms -> asf_header_size ; p += sizeof ( ff_asf_guid ) + 14 ; while ( end - p >= sizeof ( ff_asf_guid ) + 8 ) { uint64_t chunksize ; if (! memcmp ( p, ff_asf_data_header, sizeof ( ff_asf_guid ) ) ) { chunksize = 50 ; } else { chunksize = AV_RL64 ( p + sizeof ( ff_asf_guid ) ) ; } if (! chunksize || chunksize > end - p ) { av_log ( NULL, AV_LOG_ERROR, "Corrupt   stream   (header   chunksize   %" PRId64 "   is   invalid)\\n", chunksize ) ; return AVERROR_INVALIDDATA ; } if (! memcmp ( p, ff_asf_file_header, sizeof ( ff_asf_guid ) ) ) { if ( end - p > sizeof ( ff_asf_guid ) * 2 + 68 ) { mms -> asf_packet_len = AV_RL32 ( p + sizeof ( ff_asf_guid ) * 2 + 64 ) ; if ( mms -> asf_packet_len <= 0 || mms -> asf_packet_len > sizeof ( mms -> in_buffer ) ) { av_log ( NULL, AV_LOG_ERROR, "Corrupt   stream   (too   large   pkt_len   %d)\\n", mms -> asf_packet_len ) ; return A

Fix:
<S2SV_ModStart> ) ) { if ( end - p >= ( sizeof ( ff_asf_guid ) * 3 + 26 ) ) { <S2SV_ModStart> ; } } } <S2SV_ModStart> = 46 ; if ( chunksize > end - p ) { av_log ( NULL, AV_LOG_ERROR, "Corrupt <S2SV_blank> stream <S2SV_blank> (header <S2SV_blank> chunksize <S2SV_blank> %" PRId64 " <S2SV_blank> is <S2SV_blank> invalid)\\n", chunksize ) ; return AVERROR_INVALIDDATA ; }
Buggy code:
 int main ( int argc, char * * argv ) { FILE * infile, * outfile [ NUM_ENCODERS ] ; <START_BUG> vpx_codec_ctx_t codec [ NUM_ENCODERS ] ; <END_BUG> vpx_codec_enc_cfg_t cfg [ NUM_ENCODERS ] ;  vpx_codec_pts_t frame_cnt = 0 ; <START_BUG> vpx_image_t raw [ NUM_ENCODERS ] ; vpx_codec_err_t res [ NUM_ENCODERS ] ; int i ; long width ; long height ; <END_BUG> int frame_avail ;  int got_data ; int flags = 0 ; <START_BUG> int arg_deadline = VPX_DL_REALTIME ; <END_BUG> int show_psnr = 0 ;  uint64_t psnr_sse_total [ NUM_ENCODERS ] = { 0 } ; <START_BUG> uint64_t psnr_samples_total [ NUM_ENCODERS ] = { 0 } ; double psnr_totals [ NUM_ENCODERS ] [ 4 ] = { { 0, 0 } } ; <END_BUG> int psnr_count [ NUM_ENCODERS ] = { 0 } ;  unsigned int target_bitrate [ NUM_ENCODERS ] = { 1000, 500, 100 } ; int framerate = 30 ; vpx_rational_t dsf [ NUM_ENCODERS ] = { { 2, 1 }, { 2, 1 }, { 1, 1 } } ; <START_BUG> if ( argc!= ( 5 + NUM_ENCODERS ) ) <END_BUG>  die ( "Usage:   %s   <width>   <height>   <infile>   <outfile(s)>   <output   psnr?>\\n", <START_BUG> argv [ 0 ] ) ; printf ( "Using   %s\\n", vpx_codec_iface_name ( interface ) ) ; width = strtol ( argv [ 1 ], NULL, 0 ) ; <END_BUG> height = strtol ( argv [ 2 ], NULL, 0 ) ;  if ( width < 16 || width % 2 || height < 16 || height % 2 ) die ( "Invalid   resolution:   %ldx%ld", width, height ) ; <START_BUG> if (! ( infile = fopen ( argv [ 3 ], "rb" ) ) ) <END_BUG>  die (

Fix:
<S2SV_ModStart> NUM_ENCODERS ] ; FILE * downsampled_input [ NUM_ENCODERS - 1 ] ; char filename [ 50 ] ; <S2SV_ModStart> NUM_ENCODERS ] ; int <S2SV_ModEnd> frame_cnt = 0 <S2SV_ModStart> height ; int length_frame ; int <S2SV_ModStart> 0 ; int layer_id = 0 ; int layer_flags [ VPX_TS_MAX_PERIODICITY * NUM_ENCODERS ] = { 0 } ; int flag_periodicity ; int <S2SV_ModStart> = 0 ; int key_frame_insert = 0 ; <S2SV_ModStart> { 0 } ; double cx_time = 0 ; struct timeval tv1, tv2, difftv <S2SV_ModStart> } } ; unsigned int num_temporal_layers [ NUM_ENCODERS ] = { 3, 3, 3 } ; <S2SV_ModStart> argc!= ( 7 + 3 * <S2SV_ModEnd> NUM_ENCODERS ) ) <S2SV_ModStart> ) die ( "Usage: <S2SV_blank> %s <S2SV_blank> <width> <S2SV_blank> <height> <S2SV_blank> <frame_rate> <S2SV_blank> <S2SV_blank> <infile> <S2SV_blank> <outfile(s)> <S2SV_blank> " "<rate_encoder(s)> <S2SV_blank> <temporal_layer(s)> <S2SV_blank> <key_frame_insert> <S2SV_blank> <output <S2SV_blank> psnr
Buggy code:
 static guint32 parse_wbxml_tag ( proto_tree * tree, tvbuff_t * tvb, guint32 offset, guint32 str_tbl, guint8 * level, guint8 * codepage_stag, guint8 * codepage_attr ) { guint32 tvb_len = tvb_reported_length ( tvb ) ; <START_BUG> guint32 off = offset ; <END_BUG> guint32 len ; guint str_len ; guint32 ent ; guint32 idx ; guint8 peek ; guint32 tag_len ; guint8 tag_save_known = 0 ; guint8 tag_new_known = 0 ; const char * tag_save_literal ; const char * tag_new_literal ; char * tag_save_buf = NULL ; char * tag_new_buf = NULL ; guint8 parsing_tag_content = FALSE ; tag_save_literal = NULL ;  DebugLog ( ( "parse_wbxml_tag   (level   =   %u,   offset   =   %u)\\n", * level, offset ) ) ; <START_BUG> while ( off < tvb_len ) { peek = tvb_get_guint8 ( tvb, off ) ; DebugLog ( ( "STAG:   (top   of   while)   level   =   %3u,   peek   =   0x%02X,   off   =   %u,   tvb_len   =   %u\\n", * level, peek, off, tvb_len ) ) ; if ( ( peek & 0x3F ) < 4 ) switch ( peek ) { case 0x00 : * codepage_stag = tvb_get_guint8 ( tvb, off + 1 ) ; proto_tree_add_text ( tree, tvb, off, 2, "             |   Tag       |   T   -->%3d   " "|   SWITCH_PAGE   (Tag   code   page)           " "|", * codepage_stag ) ; off += 2 ; break ; case 0x01 : if ( tag_save_known ) { proto_tree_add_text ( tree, tvb, off, 1, "     %3d  <END_BUG>

Fix:
<S2SV_ModStart> off = offset, last_off <S2SV_ModStart> offset ) ) ; last_off = off <S2SV_ModStart> ; } } if ( off < last_off ) { THROW ( ReportedBoundsError ) ; } last_off = off ;
Buggy code:
 static void mldv2_report_print ( netdissect_options * ndo, const u_char * bp, u_int len ) { const struct icmp6_hdr * icp = ( const struct icmp6_hdr * ) bp ; u_int group, nsrcs, ngroups ; u_int i, j ; if ( len < 8 ) { ND_PRINT ( ( ndo, "   [invalid   len   %d]", len ) ) ; return ; } ND_TCHECK ( icp -> icmp6_data16 [ 1 ] ) ; ngroups = EXTRACT_16BITS ( & icp -> icmp6_data16 [ 1 ] ) ; ND_PRINT ( ( ndo, ",   %d   group   record(s)", ngroups ) ) ; if ( ndo -> ndo_vflag > 0 ) { group = 8 ; for ( i = 0 ; i < ngroups ; i ++ ) { if ( len < group + 20 ) { ND_PRINT ( ( ndo, "   [invalid   number   of   groups]" ) ) ; return ; } ND_TCHECK2 ( bp [ group + 4 ], sizeof ( struct in6_addr ) ) ; ND_PRINT ( ( ndo, "   [gaddr   %s", ip6addr_string ( ndo, & bp [ group + 4 ] ) ) ) ; ND_PRINT ( ( ndo, "   %s", tok2str ( mldv2report2str, "   [v2-report-#%d]", bp [ group ] ) ) ) ; nsrcs = ( bp [ group + 2 ] << 8 ) + bp [ group + 3 ] ; if ( len < group + 20 + ( nsrcs * sizeof ( struct in6_addr ) ) ) { ND_PRINT ( ( ndo, "   [invalid   number   of   sources   %d]", nsrcs ) ) ; return ; } if ( ndo -> ndo_vflag == 1 ) ND_PRINT ( ( ndo, ",   %d   source(s)", nsrcs ) ) ; else { ND_PRINT ( ( ndo, "   {" ) ) ; for ( j = 0 ; j < nsrcs ; j ++

Fix:
<S2SV_ModStart> ( ndo, "%s", mldv2_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 void unix_inflight ( struct file * fp ) { struct sock * s = unix_get_socket ( fp ) ; <START_BUG> if ( s ) { <END_BUG>  struct unix_sock * u = unix_sk ( s ) ; <START_BUG> spin_lock ( & unix_gc_lock ) ; if ( atomic_long_inc_return ( & u -> inflight ) == 1 ) { BUG_ON (! list_empty ( & u -> link ) ) ; list_add_tail ( & u -> link, & gc_inflight_list ) ; } else { BUG_ON ( list_empty ( & u -> link ) ) ; } unix_tot_inflight ++ ; <END_BUG> spin_unlock ( & unix_gc_lock ) ;  } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> fp ) ; spin_lock ( & unix_gc_lock ) ; <S2SV_ModStart> unix_sk ( s <S2SV_ModEnd> ) ; if <S2SV_ModStart> unix_tot_inflight ++ ; } fp -> f_cred -> user -> unix_inflight ++ ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int udp_recvmsg ( struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; DECLARE_SOCKADDR ( struct sockaddr_in *, sin, msg -> msg_name ) ; struct sk_buff * skb ; unsigned int ulen, copied ; int peeked, off = 0 ; int err ; <START_BUG> int is_udplite = IS_UDPLITE ( sk ) ; <END_BUG> bool slow ; if ( flags & MSG_ERRQUEUE ) return ip_recv_error ( sk, msg, len, addr_len ) ; try_again : skb = __skb_recv_datagram ( sk, flags | ( noblock? MSG_DONTWAIT : 0 ), & peeked, & off, & err ) ; if (! skb ) goto out ; ulen = skb -> len - sizeof ( struct udphdr ) ; copied = len ; if ( copied > ulen ) copied = ulen ; else if ( copied < ulen ) msg -> msg_flags |= MSG_TRUNC ; if ( copied < ulen || UDP_SKB_CB ( skb ) -> partial_cov ) {  if ( udp_lib_checksum_complete ( skb ) ) <START_BUG> goto csum_copy_err ; } <END_BUG> if ( skb_csum_unnecessary ( skb ) )  err = skb_copy_datagram_msg ( skb, sizeof ( struct udphdr ), msg, copied ) ; else { err = skb_copy_and_csum_datagram_msg ( skb, sizeof ( struct udphdr ), msg ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( unlikely ( err ) ) { trace_kfree_skb ( skb, udp_recvmsg ) ; if (! peeked ) { atomic_inc ( & sk -> sk_drops ) ; UDP_INC_STATS_USER ( sock_net ( sk ), UDP_MIB_INERRORS, is_udplite ) ; } goto out_free ; } if (! peeked ) UDP_INC_STATS_USER ( sock_net ( sk ), UDP_

Fix:
<S2SV_ModStart> ( sk ) ; bool checksum_valid = false <S2SV_ModStart> partial_cov ) { checksum_valid =! <S2SV_ModEnd> udp_lib_checksum_complete ( skb <S2SV_ModStart> ( skb ) ; if (! checksum_valid <S2SV_ModStart> } if ( checksum_valid ||
Buggy code:
 static Image * ReadCUTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowCUTReaderException ( severity, tag ) { if ( palette!= NULL ) palette = DestroyImage ( palette ) ; if ( clone_info!= NULL ) clone_info = DestroyImageInfo ( clone_info ) ; ThrowReaderException ( severity, tag ) ; } <END_BUG> Image * image, * palette ; ImageInfo * clone_info ; MagickBooleanType status ; MagickOffsetType offset ; size_t EncodedByte ; unsigned char RunCount, RunValue, RunCountMasked ; CUTHeader Header ; CUTPalHeader PalHeader ; ssize_t depth ; ssize_t i, j ; ssize_t ldblk ; unsigned char * BImgBuff = NULL, * ptrB ; register Quantum * q ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } palette = NULL ; clone_info = NULL ; Header. Width = ReadBlobLSBShort ( image ) ; Header. Height = ReadBlobLSBShort ( image ) ; Header. Reserved = ReadBlobLSBShort ( image ) ; if ( Header. Width == 0 || Header. Height == 0 || Header. Reserved!= 0 ) CUT_KO : ThrowCUTReaderException ( CorruptImageError, "ImproperImageHeader" ) ; EncodedByte = ReadBlobLSBShort ( image ) ; RunCount = ( unsigned char ) ReadBlobByte ( image ) ; RunCountMasked = RunCount & 0x7F ; ldblk = 0 ; while ( ( int ) RunCountMasked!= 0 ) { i = 1 ; if ( ( int ) RunCount < 0x80 ) i =

Fix:
<S2SV_ModStart>, tag ) \\\n{ <S2SV_ModEnd> if ( palette <S2SV_ModStart> tag ) ; \\\n} <S2SV_ModEnd> Image * image <S2SV_ModStart> goto NoMemory ; ( void ) memset ( BImgBuff, 0, ( size_t ) ldblk * sizeof ( * BImgBuff ) ) ;
Buggy code:
 void update_rate_histogram ( struct rate_hist * hist, const vpx_codec_enc_cfg_t * cfg, const vpx_codec_cx_pkt_t * pkt ) { int i ; int64_t then = 0 ; int64_t avg_bitrate = 0 ; int64_t sum_sz = 0 ; const int64_t now = pkt -> data. frame. pts * 1000 * ( uint64_t ) cfg -> g_timebase. num // ( uint64_t ) cfg -> g_timebase. den ; int idx = hist -> frames ++ % hist -> samples ; hist -> pts [ idx ] = now ; hist -> sz [ idx ] = ( int ) pkt -> data. frame. sz ; if ( now < cfg -> rc_buf_initial_sz ) return ; <START_BUG> then = now ; <END_BUG> for ( i = hist -> frames ; i > 0 && hist -> frames - i < hist -> samples ; i -- ) { const int i_idx = ( i - 1 ) % hist -> samples ; then = hist -> pts [ i_idx ] ; if ( now - then > cfg -> rc_buf_sz ) break ; sum_sz += hist -> sz [ i_idx ] ; } if ( now == then ) return ; avg_bitrate = sum_sz * 8 * 1000 // ( now - then ) ; idx = ( int ) ( avg_bitrate * ( RATE_BINS // 2 ) // ( cfg -> rc_target_bitrate * 1000 ) ) ; if ( idx < 0 ) idx = 0 ; if ( idx > RATE_BINS - 1 ) idx = RATE_BINS - 1 ; if ( hist -> bucket [ idx ]. low > avg_bitrate ) hist -> bucket [ idx ]. low = ( int ) avg_bitrate ; if ( hist -> bucket [ idx ]. high < avg_bitrate ) hist -> bucket [ idx ]. high = ( int ) avg_bitrate ; hist -> bucket [ idx ]. count ++ ; hist -> total ++ ; }

Fix:
<S2SV_ModStart> ) return ; if (! cfg -> rc_target_bitrate ) return ;
Buggy code:
 static void nlmclnt_unlock_callback ( struct rpc_task * task, void * data ) { struct nlm_rqst * req = data ; u32 status = ntohl ( req -> a_res. status ) ; if ( RPC_ASSASSINATED ( task ) ) goto die ; if ( task -> tk_status < 0 ) { dprintk ( "lockd:   unlock   failed   (err   =   %d)\\n", - task -> tk_status ) ; <START_BUG> goto retry_rebind ; <END_BUG> } if ( status == NLM_LCK_DENIED_GRACE_PERIOD ) { rpc_delay ( task, NLMCLNT_GRACE_WAIT ) ; goto retry_unlock ; } if ( status!= NLM_LCK_GRANTED ) printk ( KERN_WARNING "lockd:   unexpected   unlock   status:   %d\\n", status ) ; die : return ; retry_rebind : nlm_rebind_host ( req -> a_host ) ; retry_unlock : rpc_restart_call ( task ) ; }

Fix:
<S2SV_ModStart> tk_status ) ; switch ( task -> tk_status ) { case - EACCES : case - EIO : goto die ; default : <S2SV_ModStart> goto retry_rebind ; }
Buggy code:
 static int check_entry_size_and_hooks ( struct ip6t_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct ip6t_entry )!= 0 || <START_BUG> ( unsigned char * ) e + sizeof ( struct ip6t_entry ) >= limit ) { <END_BUG> duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct ip6t_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } err = check_entry ( e ) ; if ( err ) return err ; for ( h = 0 ; h < NF_INET_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { pr_err ( "Underflows   must   be   unconditional   and   " "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> ip6t_entry ) >= limit || ( unsigned char * ) e + e -> next_offset >
Buggy code:
 <START_BUG> int vp9_decode_block_tokens ( VP9_COMMON * cm, MACROBLOCKD * xd, <END_BUG>  int plane, int block, BLOCK_SIZE plane_bsize, <START_BUG> <END_BUG> int x, int y, TX_SIZE tx_size, vp9_reader * r ) {  <START_BUG> struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <END_BUG> const int ctx = get_entropy_context ( tx_size, pd -> above_context + x, pd -> left_context + y ) ;  const scan_order * so = get_scan ( xd, tx_size, pd -> plane_type, block ) ; <START_BUG> <END_BUG> const int eob = decode_coefs ( cm, xd, pd -> plane_type,  <START_BUG> BLOCK_OFFSET ( pd -> dqcoeff, block ), tx_size, <END_BUG>  pd -> dequant, ctx, so -> scan, so -> neighbors, r ) ; <START_BUG> <END_BUG> vp9_set_contexts ( xd, pd, plane_bsize, tx_size, eob > 0, x, y ) ;  return eob ; }

Fix:
<S2SV_ModStart> int vp9_decode_block_tokens ( <S2SV_ModEnd> MACROBLOCKD * xd <S2SV_ModStart> int plane, const scan_order * sc <S2SV_ModEnd>, int x <S2SV_ModStart> TX_SIZE tx_size, vpx_reader * r, int seg_id <S2SV_ModEnd> ) { struct <S2SV_ModStart> plane [ plane ] ; const int16_t * const dequant = pd -> seg_dequant [ seg_id <S2SV_ModStart> ) ; const <S2SV_ModEnd> int eob = <S2SV_ModStart> = decode_coefs ( <S2SV_ModEnd> xd, pd <S2SV_ModStart> -> plane_type, <S2SV_ModEnd> pd -> dqcoeff <S2SV_ModStart> -> dqcoeff, tx_size, <S2SV_ModEnd> dequant, ctx <S2SV_ModStart>, ctx, sc <S2SV_ModEnd> -> scan, <S2SV_ModStart> -> scan, sc <S2SV_ModEnd> -> neighbors, <S2SV_ModStart> r ) ; dec_set_contexts <S2SV_ModEnd> ( xd, <S2SV_ModStart> xd, pd <S2SV_ModEnd>, tx_size,
Buggy code:
 static int mem_resize ( jas_stream_memobj_t * m, int bufsize ) { <START_BUG> unsigned char * buf ; <END_BUG> assert ( m -> buf_ ) ; assert ( bufsize >= 0 ) ;  if (! ( buf = jas_realloc2 ( m -> buf_, bufsize, sizeof ( unsigned char ) ) ) ) { <START_BUG> return - 1 ; } m -> buf_ = buf ; m -> bufsize_ = bufsize ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> char * buf <S2SV_ModEnd> ; assert ( <S2SV_ModStart> ) ) ) && bufsize
Buggy code:
 void dm9000WritePhyReg ( uint8_t address, uint16_t data ) { <START_BUG> dm9000WriteReg ( DM9000_REG_EPAR, 0x40 | address ) ; <END_BUG>  dm9000WriteReg ( DM9000_REG_EPDRL, LSB ( data ) ) ; <START_BUG> <END_BUG> dm9000WriteReg ( DM9000_REG_EPDRH, MSB ( data ) ) ;  <START_BUG> dm9000WriteReg ( DM9000_REG_EPCR, EPCR_EPOS | EPCR_ERPRW ) ; <END_BUG>  while ( ( dm9000ReadReg ( DM9000_REG_EPCR ) & EPCR_ERRE )!= 0 ) <START_BUG> { } usleep ( 5 ) ; <END_BUG> dm9000WriteReg ( DM9000_REG_EPCR, EPCR_EPOS ) ;  }

Fix:
<S2SV_ModStart> { dm9000WriteReg ( DM9000_EPAR <S2SV_ModEnd>, 0x40 | <S2SV_ModStart> ; dm9000WriteReg ( DM9000_EPDRL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ; dm9000WriteReg ( DM9000_EPDRH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ; dm9000WriteReg ( DM9000_EPCR, DM9000_EPCR_EPOS | DM9000_EPCR_ERPRW <S2SV_ModEnd> ) ; while <S2SV_ModStart> ( dm9000ReadReg ( DM9000_EPCR ) & DM9000_EPCR_ERRE <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ; dm9000WriteReg ( DM9000_EPCR, DM9000_EPCR_EPOS <S2SV_ModEnd> ) ; }
Buggy code:
 static struct dentry * ecryptfs_mount ( struct file_system_type * fs_type, int flags, const char * dev_name, void * raw_data ) { struct super_block * s ; struct ecryptfs_sb_info * sbi ; struct ecryptfs_dentry_info * root_info ; const char * err = "Getting   sb   failed" ; struct inode * inode ; struct path path ; uid_t check_ruid ; int rc ; sbi = kmem_cache_zalloc ( ecryptfs_sb_info_cache, GFP_KERNEL ) ; if (! sbi ) { rc = - ENOMEM ; goto out ; } rc = ecryptfs_parse_options ( sbi, raw_data, & check_ruid ) ; if ( rc ) { err = "Error   parsing   options" ; goto out ; } s = sget ( fs_type, NULL, set_anon_super, flags, NULL ) ; if ( IS_ERR ( s ) ) { rc = PTR_ERR ( s ) ; goto out ; } rc = bdi_setup_and_register ( & sbi -> bdi, "ecryptfs", BDI_CAP_MAP_COPY ) ; if ( rc ) goto out1 ; ecryptfs_set_superblock_private ( s, sbi ) ; s -> s_bdi = & sbi -> bdi ; sbi = NULL ; s -> s_op = & ecryptfs_sops ; s -> s_d_op = & ecryptfs_dops ; err = "Reading   sb   failed" ; rc = kern_path ( dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, & path ) ; if ( rc ) { ecryptfs_printk ( KERN_WARNING, "kern_path()   failed\\n" ) ; goto out1 ; } if ( path. dentry -> d_sb -> s_type == & ecryptfs_fs_type ) { rc = - EINVAL ; printk ( KERN_ERR "Mount   on   filesystem   of   type   " "eCryptfs   explicitly   disallowed   due   to   " "known   incompatibilities\\n" ) ; goto out_free ; } if

Fix:
<S2SV_ModStart> = ECRYPTFS_SUPER_MAGIC ; s -> s_stack_depth = path. dentry -> d_sb -> s_stack_depth + 1 ; rc = - EINVAL ; if ( s -> s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH ) { pr_err ( "eCryptfs: <S2SV_blank> maximum <S2SV_blank> fs <S2SV_blank> stacking <S2SV_blank> depth <S2SV_blank> exceeded\\n" ) ; goto out_free ; }
Buggy code:
 void * gdImageWBMPPtr ( gdImagePtr im, int * size, int fg ) { void * rv ; gdIOCtx * out = gdNewDynamicCtx ( 2048, NULL ) ; <START_BUG> gdImageWBMPCtx ( im, fg, out ) ; <END_BUG>  rv = gdDPExtractData ( out, size ) ; <START_BUG> out -> gd_free ( out ) ; return rv ; }<END_BUG>

Fix:
<S2SV_ModStart> NULL ) ; if (! _gdImageWBMPCtx <S2SV_ModEnd> ( im, <S2SV_ModStart>, out ) ) { <S2SV_ModEnd> rv = gdDPExtractData <S2SV_ModStart> size ) ; } else { rv = NULL ; }
Buggy code:
 qboolean S_AL_Init ( soundInterface_t * si ) { # ifdef USE_OPENAL const char * device = NULL ; const char * inputdevice = NULL ; int i ; if (! si ) { return qfalse ; } for ( i = 0 ; i < MAX_RAW_STREAMS ; i ++ ) { streamSourceHandles [ i ] = - 1 ; streamPlaying [ i ] = qfalse ; streamSources [ i ] = 0 ; streamNumBuffers [ i ] = 0 ; streamBufIndex [ i ] = 0 ; } s_alPrecache = Cvar_Get ( "s_alPrecache", "1", CVAR_ARCHIVE ) ; s_alGain = Cvar_Get ( "s_alGain", "1.0", CVAR_ARCHIVE ) ; s_alSources = Cvar_Get ( "s_alSources", "96", CVAR_ARCHIVE ) ; s_alDopplerFactor = Cvar_Get ( "s_alDopplerFactor", "1.0", CVAR_ARCHIVE ) ; s_alDopplerSpeed = Cvar_Get ( "s_alDopplerSpeed", "9000", CVAR_ARCHIVE ) ; s_alMinDistance = Cvar_Get ( "s_alMinDistance", "120", CVAR_CHEAT ) ; s_alMaxDistance = Cvar_Get ( "s_alMaxDistance", "1024", CVAR_CHEAT ) ; s_alRolloff = Cvar_Get ( "s_alRolloff", "2", CVAR_CHEAT ) ; s_alGraceDistance = Cvar_Get ( "s_alGraceDistance", "512", CVAR_CHEAT ) ; <START_BUG> s_alDriver = Cvar_Get ( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH ) ; <END_BUG> s_alInputDevice = Cvar_Get ( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_LATCH ) ;  s_alDevice = Cvar_Get ( "s_alDevice", "", CVAR_ARCHIVE | CVAR_LATCH )

Fix:
<S2SV_ModStart> CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED <S2SV_ModStart> CVAR_LATCH ) ; if ( COM_CompareExtension ( s_alDriver -> string, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", s_alDriver -> string ) ; return qfalse ; }
Buggy code:
 static MagickBooleanType EncodeImage ( const ImageInfo * image_info, Image * image, const size_t data_size, ExceptionInfo * exception ) { # define MaxCode ( number_bits ) ( ( one << ( number_bits ) ) - 1 ) # define MaxHashTable 5003 # define MaxGIFBits 12UL # define MaxGIFTable ( 1UL << MaxGIFBits ) <START_BUG> # define GIFOutputCode ( code ) { if ( bits > 0 ) datum |= ( size_t ) ( code ) << bits ; else datum = ( size_t ) ( code ) ; bits += number_bits ; while ( bits >= 8 ) { packet [ length ++ ] = ( unsigned char ) ( datum & 0xff ) ; if ( length >= 254 ) { ( void ) WriteBlobByte ( image, ( unsigned char ) length ) ; ( void ) WriteBlob ( image, length, packet ) ; length = 0 ; } datum >>= 8 ; bits -= 8 ; } if ( free_code > max_code ) { number_bits ++ ; if ( number_bits == MaxGIFBits ) max_code = MaxGIFTable ; else max_code = MaxCode ( number_bits ) ; } } <END_BUG> Quantum index ; short * hash_code, * hash_prefix, waiting_code ; size_t bits, clear_code, datum, end_of_information_code, free_code, length, max_code, next_pixel, number_bits, one, pass ; ssize_t displacement, offset, k, y ; unsigned char * packet, * hash_suffix ; assert ( image!= ( Image * ) NULL ) ; one = 1 ; packet = ( unsigned char * ) AcquireQuantumMemory ( 256, sizeof ( * packet ) ) ; hash_code = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_code ) ) ; hash_prefix = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_prefix ) ) ; hash_suffix = ( unsigned char * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_suffix ) ) ; if ( ( packet == ( unsigned char * ) NULL ) || ( hash_code == ( short * ) NULL ) || ( hash_prefix == ( short * ) NULL ) || ( hash_suffix == ( unsigned char * ) NULL

Fix:
<S2SV_ModStart> ( code ) \\\n{ <S2SV_ModEnd> if ( bits <S2SV_ModStart> ) ; } \\\n} <S2SV_ModEnd> Quantum index ; <S2SV_ModStart> ++ ) { next_pixel = MagickFalse ; displacement = 1 ; <S2SV_ModStart> -= MaxHashTable ; if ( k < 0 ) continue <S2SV_ModEnd> ; if (
Buggy code:
 static int64_t rd_pick_intra_sub_8x8_y_mode ( VP9_COMP * cpi, MACROBLOCK * mb, int * rate, int * rate_y, int64_t * distortion, int64_t best_rd ) { int i, j ; const MACROBLOCKD * const xd = & mb -> e_mbd ; MODE_INFO * const mic = xd -> mi [ 0 ] ; <START_BUG> const MODE_INFO * above_mi = xd -> mi [ - xd -> mi_stride ] ; <END_BUG>  const MODE_INFO * left_mi = xd -> left_available? xd -> mi [ - 1 ] : NULL ; <START_BUG> const BLOCK_SIZE bsize = xd -> mi [ 0 ] -> mbmi. sb_type ; const int num_4x4_blocks_wide = num_4x4_blocks_wide_lookup [ bsize ] ; const int num_4x4_blocks_high = num_4x4_blocks_high_lookup [ bsize ] ; int idx, idy ; int cost = 0 ; int64_t total_distortion = 0 ; int tot_rate_y = 0 ; int64_t total_rd = 0 ; ENTROPY_CONTEXT t_above [ 4 ], t_left [ 4 ] ; <END_BUG> const int * bmode_costs = mb -> mbmode_cost ;  <START_BUG> vpx_memcpy ( t_above, xd -> plane [ 0 ]. above_context, sizeof ( t_above ) ) ; <END_BUG>  vpx_memcpy ( t_left, xd -> plane [ 0 ]. left_context, sizeof ( t_left ) ) ; <START_BUG> for ( idy = 0 ; idy < 2 ; idy += num_4x4_blocks_high ) { for ( idx = 0 ; idx < 2 ; idx += num_4x4_blocks_wide ) { <END_BUG> MB_PREDICTION_MODE best_mode = DC_PRED ;  int r = INT_MAX, ry = INT_MAX ; int64_t d = INT64_MAX, this_rd = INT64_MAX ; i = idy * 2 + idx ; if ( cpi -> common. frame_type == KEY_FRAME ) { <START_BUG> const MB_PREDICTION_MODE A =<END_BUG>

Fix:
<S2SV_ModStart> = xd -> above_mi <S2SV_ModEnd> ; const MODE_INFO <S2SV_ModStart> = xd -> left_mi <S2SV_ModEnd> ; const BLOCK_SIZE <S2SV_ModStart> * bmode_costs = cpi <S2SV_ModEnd> -> mbmode_cost ; <S2SV_ModStart> -> mbmode_cost ; memcpy <S2SV_ModEnd> ( t_above, <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( t_left, <S2SV_ModStart> num_4x4_blocks_wide ) { PREDICTION_MODE <S2SV_ModEnd> best_mode = DC_PRED <S2SV_ModStart> ) { const PREDICTION_MODE <S2SV_ModEnd> A = vp9_above_block_mode <S2SV_ModStart> ) ; const PREDICTION_MODE <S2SV_ModEnd> L = vp9_left_block_mode <S2SV_ModStart> ; bmode_costs = cpi -> y_mode_costs [ A ] [ L ] ; } this_rd = rd_pick_intra4x4block ( cpi, mb, idy, idx <S2SV_ModEnd>, & best_mode
Buggy code:
 static int fsck_gitmodules_fn ( const char * var, const char * value, void * vdata ) { struct fsck_gitmodules_data * data = vdata ; const char * subsection, * key ; int subsection_len ; char * name ; if ( parse_config_key ( var, "submodule", & subsection, & subsection_len, & key ) < 0 ||! subsection ) return 0 ; name = xmemdupz ( subsection, subsection_len ) ; if ( check_submodule_name ( name ) < 0 ) data -> ret |= report ( data -> options, data -> obj, FSCK_MSG_GITMODULES_NAME, "disallowed   submodule   name:   %s", name ) ; if (! strcmp ( key, "url" ) && value && looks_like_command_line_option ( value ) ) data -> ret |= report ( data -> options, data -> obj, FSCK_MSG_GITMODULES_URL, "disallowed   submodule   url:   %s", value ) ; <START_BUG> free ( name ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> value ) ; if (! strcmp ( key, "path" ) && value && looks_like_command_line_option ( value ) ) data -> ret |= report ( data -> options, data -> obj, FSCK_MSG_GITMODULES_PATH, "disallowed <S2SV_blank> submodule <S2SV_blank> path: <S2SV_blank> %s", value ) ;
Buggy code:
 static Image * ReadPALMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; IndexPacket index ; MagickBooleanType status ; MagickOffsetType totalOffset, seekNextDepth ; MagickPixelPacket transpix ; register IndexPacket * indexes ; register ssize_t i, x ; register PixelPacket * q ; size_t bytes_per_row, flags, bits_per_pixel, version, nextDepthOffset, transparentIndex, compressionType, byte, mask, redbits, greenbits, bluebits, one, pad, size, bit ; ssize_t count, y ; unsigned char <START_BUG> * lastrow, <END_BUG> * one_row, * ptr ; unsigned short color16 ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { ( void ) DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } totalOffset = 0 ; do { image -> columns = ReadBlobMSBShort ( image ) ; image -> rows = ReadBlobMSBShort ( image ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( CorruptImageError, "NegativeOrZeroImageSize" ) ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; } bytes_per_row = ReadBlobMSBShort ( image ) ; flags = ReadBlobMSBShort ( image ) ; bits_per_pixel = ( size_t ) ReadBlobByte ( image ) ; if ( ( bits_per_pixel!= 1 ) && (

Fix:
<S2SV_ModStart> unsigned char * last_row <S2SV_ModEnd>, * one_row <S2SV_ModStart> "MemoryAllocationFailed" ) ; last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> PALM_COMPRESSION_SCANLINE ) { last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> sizeof ( * last_row ) ) ; if ( last_row <S2SV_ModEnd> == ( unsigned <S2SV_ModStart> bit ] = last_row <S2SV_ModEnd> [ i + <S2SV_ModStart> ) CopyMagickMemory ( last_row <S2SV_ModEnd>, one_row, <S2SV_ModStart> == PALM_COMPRESSION_SCANLINE ) last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> ) RelinquishMagickMemory ( last_row <S2SV_ModEnd> ) ; ThrowReaderException <S2SV_ModStart> == PALM_COMPRESSION_SCANLINE ) last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> ) RelinquishMagickMemory ( last_row <S2SV_ModEnd> ) ; ThrowReaderException <S2SV_ModStart> == PALM_COMPRESSION_SCANLINE ) last_row <S2SV_ModEnd> = ( unsigned <S2SV_ModStart> ) RelinquishMagickMemory ( last_row <S2SV_ModEnd> ) ; if
Buggy code:
 static int dissect_u3v ( tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void * data ) { gint offset = 0 ; proto_tree * u3v_tree = NULL, * ccd_tree_flag, * u3v_telegram_tree = NULL, * ccd_tree = NULL ; gint data_length = 0 ; gint req_id = 0 ; gint command_id = - 1 ; gint status = 0 ; guint prefix = 0 ; proto_item * ti = NULL ; proto_item * item = NULL ; const char * command_string ; usb_conv_info_t * usb_conv_info ; gint stream_detected = FALSE ; gint control_detected = FALSE ; u3v_conv_info_t * u3v_conv_info = NULL ; gencp_transaction_t * gencp_trans = NULL ; usb_conv_info = ( usb_conv_info_t * ) data ; u3v_conv_info = ( u3v_conv_info_t * ) usb_conv_info -> class_data ; if (! u3v_conv_info ) { u3v_conv_info = wmem_new0 ( wmem_file_scope ( ), u3v_conv_info_t ) ; <START_BUG> usb_conv_info -> class_data = u3v_conv_info ; <END_BUG> } prefix = tvb_get_letohl ( tvb, 0 ) ; if ( ( tvb_reported_length ( tvb ) >= 4 ) && ( ( U3V_CONTROL_PREFIX == prefix ) || ( U3V_EVENT_PREFIX == prefix ) ) ) { control_detected = TRUE ; } if ( ( ( tvb_reported_length ( tvb ) >= 4 ) && ( ( U3V_STREAM_LEADER_PREFIX == prefix ) || ( U3V_STREAM_TRAILER_PREFIX == prefix ) ) ) || ( usb_conv_info -> endpoint == u3v_conv_info -> ep_stream ) ) { stream_detected = TRUE ; } if ( control_detected || stream_detected ) { if ( usb_conv_info -> interfaceClass == IF_CLASS

Fix:
<S2SV_ModStart> class_data = u3v_conv_info ; usb_conv_info -> class_data_type = USB_CONV_U3V ; } else if ( usb_conv_info -> class_data_type!= USB_CONV_U3V ) { return 0
Buggy code:
 static int start_decoder ( vorb * f ) { uint8 header [ 6 ], x, y ; int len, i, j, k, max_submaps = 0 ; int longest_floorlist = 0 ; if (! start_page ( f ) ) return FALSE ; if (! ( f -> page_flag & PAGEFLAG_first_page ) ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> page_flag & PAGEFLAG_last_page ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> page_flag & PAGEFLAG_continued_packet ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> segment_count!= 1 ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> segments [ 0 ]!= 30 ) { if ( f -> segments [ 0 ] == 64 && getn ( f, header, 6 ) && header [ 0 ] == 'f' && header [ 1 ] == 'i' && header [ 2 ] =='s' && header [ 3 ] == 'h' && header [ 4 ] == 'e' && header [ 5 ] == 'a' && get8 ( f ) == 'd' && get8 ( f ) == '\\0' ) return error ( f, VORBIS_ogg_skeleton_not_supported ) ; else return error ( f, VORBIS_invalid_first_page ) ; } if ( get8 ( f )!= VORBIS_packet_id ) return error ( f, VORBIS_invalid_first_page ) ; if (! getn ( f, header, 6 ) ) return error ( f, VORBIS_unexpected_eof ) ; if (! vorbis_validate ( header ) ) return error ( f, VORBIS_invalid_first_page ) ; if ( get32 ( f )!= 0 ) return error ( f, VORBIS_invalid_first_page ) ; f -> channels = get8 ( f ) ; if (! f -> channels ) return error ( f, VORBIS_invalid_first_page ) ; if ( f -> channels > STB_VORBIS_MAX_CHANNELS )

Fix:
<S2SV_ModStart> ; if ( current_length >= 32 ) return error ( f, VORBIS_invalid_setup ) ; if ( <S2SV_ModStart> 1 ) { int values = lookup1_values ( c -> entries, c -> dimensions ) ; if ( values < 0 ) return error ( f, VORBIS_invalid_setup ) ; <S2SV_ModStart> -> lookup_values = ( uint32 ) values <S2SV_ModEnd> ; } else <S2SV_ModStart> g -> values - 1 ; ++ j ) if ( p [ j ]. x == p [ j + 1 ]. x ) return error ( f, VORBIS_invalid_setup ) ; for ( j = 0 ; j < g -> values <S2SV_ModStart> ) + 1 ; if ( m -> coupling_steps > f -> channels ) return error ( f, VORBIS_invalid_setup )