nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int futex_requeue ( u32 __user * uaddr1, unsigned int flags, u32 __user * uaddr2, int nr_wake, int nr_requeue, u32 * cmpval, int requeue_pi ) { union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT ; int drop_count = 0, task_count = 0, ret ; struct futex_pi_state * pi_state = NULL ; struct futex_hash_bucket * hb1, * hb2 ; struct futex_q * this, * next ; if ( requeue_pi ) { <START_BUG> if ( refill_pi_state_cache ( ) ) <END_BUG> return - ENOMEM ; if ( nr_wake!= 1 ) return - EINVAL ; } retry : if ( pi_state!= NULL ) { free_pi_state ( pi_state ) ; pi_state = NULL ; } ret = get_futex_key ( uaddr1, flags & FLAGS_SHARED, & key1, VERIFY_READ ) ; if ( unlikely ( ret!= 0 ) ) goto out ; ret = get_futex_key ( uaddr2, flags & FLAGS_SHARED, & key2, requeue_pi? VERIFY_WRITE : VERIFY_READ ) ; if ( unlikely ( ret!= 0 ) )  goto out_put_key1 ; <START_BUG> hb1 = hash_futex ( & key1 ) ; hb2 = hash_futex ( & key2 ) ; retry_private : hb_waiters_inc ( hb2 ) ; double_lock_hb ( hb1, hb2 ) ; if ( likely ( cmpval!= NULL ) ) { u32 curval ; ret = get_futex_value_locked ( & curval, uaddr1 ) ; if ( unlikely ( ret ) ) { double_unlock_hb ( hb1, hb2 ) ; hb_waiters_dec ( hb2 ) ; ret = get_user ( curval, uaddr1 ) ; if ( ret ) goto out_put_keys ; if (! ( flags & FLAGS_SHARED ) ) goto retry_private ; put_futex_key ( & key2 ) ; put_futex_key ( &<END_BUG>

Fix:
<S2SV_ModStart> { if ( uaddr1 == uaddr2 ) return - EINVAL ; if ( <S2SV_ModStart> goto out_put_key1 ; if ( requeue_pi && match_futex ( & key1, & key2 ) ) { ret = - EINVAL ; goto out_put_keys ; }
Buggy code:
 static void i8042_stop ( struct serio * serio ) { struct i8042_port * port = serio -> port_data ; <START_BUG> port -> exists = false ; <END_BUG> synchronize_irq ( I8042_AUX_IRQ ) ; synchronize_irq ( I8042_KBD_IRQ ) ;  port -> serio = NULL ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> -> port_data ; spin_lock_irq ( & i8042_lock ) ; <S2SV_ModStart> exists = false ; port -> serio = NULL ; spin_unlock_irq ( & i8042_lock ) <S2SV_ModStart> I8042_KBD_IRQ ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 void vp8_update_gf_useage_maps ( VP8_COMP * cpi, VP8_COMMON * cm, MACROBLOCK * x ) { int mb_row, mb_col ; MODE_INFO * this_mb_mode_info = cm -> mi ; x -> gf_active_ptr = ( signed char * ) cpi -> gf_active_flags ; if ( ( cm -> frame_type == KEY_FRAME ) || ( cm -> refresh_golden_frame ) ) { <START_BUG> vpx_memset ( cpi -> gf_active_flags, 1, ( cm -> mb_rows * cm -> mb_cols ) ) ; <END_BUG> cpi -> gf_active_count = cm -> mb_rows * cm -> mb_cols ; } else { for ( mb_row = 0 ; mb_row < cm -> mb_rows ; mb_row ++ ) { for ( mb_col = 0 ; mb_col < cm -> mb_cols ; mb_col ++ ) { if ( ( this_mb_mode_info -> mbmi. ref_frame == GOLDEN_FRAME ) || ( this_mb_mode_info -> mbmi. ref_frame == ALTREF_FRAME ) ) { if ( * ( x -> gf_active_ptr ) == 0 ) { * ( x -> gf_active_ptr ) = 1 ; cpi -> gf_active_count ++ ; } } else if ( ( this_mb_mode_info -> mbmi. mode!= ZEROMV ) && * ( x -> gf_active_ptr ) ) { * ( x -> gf_active_ptr ) = 0 ; cpi -> gf_active_count -- ; } x -> gf_active_ptr ++ ; this_mb_mode_info ++ ; } this_mb_mode_info ++ ; } } }

Fix:
<S2SV_ModStart> ) ) { memset <S2SV_ModEnd> ( cpi ->
Buggy code:
 static int wb_prep ( netdissect_options * ndo, const struct pkt_prep * prep, u_int len ) { int n ; const struct pgstate * ps ; const u_char * ep = ndo -> ndo_snapend ; ND_PRINT ( ( ndo, "   wb-prep:" ) ) ; if ( len < sizeof ( * prep ) ) { return ( - 1 ) ; } n = EXTRACT_32BITS ( & prep -> pp_n ) ; ps = ( const struct pgstate * ) ( prep + 1 ) ; <START_BUG> while ( -- n >= 0 &&! ND_TTEST ( * ps ) ) { <END_BUG> const struct id_off * io, * ie ; char c = '<' ; ND_PRINT ( ( ndo, "   %u//%s:%u", EXTRACT_32BITS ( & ps -> slot ), ipaddr_string ( ndo, & ps -> page. p_sid ), EXTRACT_32BITS ( & ps -> page. p_uid ) ) ) ; io = ( struct id_off * ) ( ps + 1 ) ;  for ( ie = io + ps -> nid ; io < ie &&! ND_TTEST ( * io ) ; ++ io ) { <START_BUG> ND_PRINT ( ( ndo, "%c%s:%u", c, ipaddr_string ( ndo, & io -> id ), EXTRACT_32BITS ( & io -> off ) ) ) ; c = ',' ; } ND_PRINT ( ( ndo, ">" ) ) ; ps = ( struct pgstate * ) io ; } return ( ( u_char * ) ps <= ep? 0 : - 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> >= 0 && <S2SV_ModEnd> ND_TTEST ( * <S2SV_ModStart> < ie && <S2SV_ModEnd> ND_TTEST ( *
Buggy code:
 void sctp_generate_proto_unreach_event ( unsigned long data ) { struct sctp_transport * transport = ( struct sctp_transport * ) data ; struct sctp_association * asoc = transport -> asoc ; <START_BUG> struct net * net = sock_net ( asoc -> base. sk ) ; <END_BUG>  bh_lock_sock ( asoc -> base. sk ) ; <START_BUG> <END_BUG> if ( sock_owned_by_user ( asoc -> base. sk ) ) {  pr_debug ( "%s:   sock   is   busy\\n", __func__ ) ; if (! mod_timer ( & transport -> proto_unreach_timer, jiffies + ( HZ // 20 ) ) ) sctp_association_hold ( asoc ) ; goto out_unlock ; } if ( asoc -> base. dead ) goto out_unlock ; sctp_do_sm ( net, SCTP_EVENT_T_OTHER, SCTP_ST_OTHER ( SCTP_EVENT_ICMP_PROTO_UNREACH ), asoc -> state, asoc -> ep, asoc, transport, GFP_ATOMIC ) ; out_unlock : <START_BUG> bh_unlock_sock ( asoc -> base. sk ) ; <END_BUG> sctp_association_put ( asoc ) ; }

Fix:
<S2SV_ModStart> asoc ; struct sock * sk = asoc -> base. sk ; struct <S2SV_ModStart> = sock_net ( <S2SV_ModEnd> sk ) ; <S2SV_ModStart> ; bh_lock_sock ( <S2SV_ModEnd> sk ) ; <S2SV_ModStart> ( sock_owned_by_user ( <S2SV_ModEnd> sk ) ) <S2SV_ModStart> : bh_unlock_sock ( <S2SV_ModEnd> sk ) ;
Buggy code:
 void rrd_graph_options ( int argc, char * argv [ ], image_desc_t * im ) { int stroff ; char * parsetime_error = NULL ; char scan_gtm [ 12 ], scan_mtm [ 12 ], scan_ltm [ 12 ], col_nam [ 12 ] ; char double_str [ 20 ], double_str2 [ 20 ] ; time_t start_tmp = 0, end_tmp = 0 ; long long_tmp ; rrd_time_value_t start_tv, end_tv ; long unsigned int color ; # define LONGOPT_UNITS_SI 255 struct option long_options [ ] = { { "alt-autoscale", no_argument, 0, 'A' }, { "imgformat", required_argument, 0, 'a' }, { "font-smoothing-threshold", required_argument, 0, 'B' }, { "base", required_argument, 0, 'b' }, { "color", required_argument, 0, 'c' }, { "full-size-mode", no_argument, 0, 'D' }, { "daemon", required_argument, 0, 'd' }, { "slope-mode", no_argument, 0, 'E' }, { "end", required_argument, 0, 'e' }, { "force-rules-legend", no_argument, 0, 'F' }, { "imginfo", required_argument, 0, 'f' }, { "graph-render-mode", required_argument, 0, 'G' }, { "no-legend", no_argument, 0, 'g' }, { "height", required_argument, 0, 'h' }, { "no-minor", no_argument, 0, 'I' }, { "interlaced", no_argument, 0, 'i' }, { "alt-autoscale-min", no_argument, 0, 'J' }, { "only-graph", no_argument, 0, 'j' }, { "units-length", required_argument, 0, 'L' }, { "lower-limit", required_argument, 0,

Fix:
<S2SV_ModStart> : if ( bad_format_axis ( optarg ) ) { <S2SV_ModEnd> return ; } <S2SV_ModStart> : if ( bad_format_axis ( optarg ) ) { <S2SV_ModEnd> return ; }
Buggy code:
 static void do_viewlog ( HttpRequest req, HttpResponse res ) { if ( is_readonly ( req ) ) { send_error ( req, res, SC_FORBIDDEN, "You   do   not   have   sufficient   privileges   to   access   this   page" ) ; return ; } do_head ( res, "_viewlog", "View   log", 100 ) ; if ( ( Run. flags & Run_Log ) &&! ( Run. flags & Run_UseSyslog ) ) { FILE * f = fopen ( Run. files. log, "r" ) ; if ( f ) { size_t n ; char buf [ 512 ] ; StringBuffer_append ( res -> outputbuffer, "<br><p><form><textarea   cols=120   rows=30   readonly>" ) ; while ( ( n = fread ( buf, sizeof ( char ), sizeof ( buf ) - 1, f ) ) > 0 ) { buf [ n ] = 0 ; <START_BUG> StringBuffer_append ( res -> outputbuffer, "%s", buf ) ; <END_BUG> } fclose ( f ) ; StringBuffer_append ( res -> outputbuffer, "<//textarea><//form>" ) ; } else { StringBuffer_append ( res -> outputbuffer, "Error   opening   logfile:   %s", STRERROR ) ; } } else { StringBuffer_append ( res -> outputbuffer, "<b>Cannot   view   logfile:<//b><br>" ) ; if (! ( Run. flags & Run_Log ) ) StringBuffer_append ( res -> outputbuffer, "Monit   was   started   without   logging" ) ; else StringBuffer_append ( res -> outputbuffer, "Monit   uses   syslog" ) ; } do_foot ( res ) ; }

Fix:
<S2SV_ModStart> = 0 ; escapeHTML ( res -> outputbuffer <S2SV_ModEnd>, buf )
Buggy code:
 static char * get_pid_environ_val ( pid_t pid, char * val ) { <START_BUG> char temp [ 500 ] ; <END_BUG> int i = 0 ; int foundit = 0 ; FILE * fp ; sprintf ( temp, "//proc//%d//environ", pid ) ; fp = fopen ( temp, "r" ) ; if ( fp == NULL ) return NULL ; for ( ; ; ) {  temp [ i ] = fgetc ( fp ) ; <START_BUG> if ( foundit == 1 && ( temp [ i ] == 0 || temp [ i ] == '\\0' || temp [ i ] == EOF ) ) { char * ret ; temp [ i ] = 0 ; ret = malloc ( strlen ( temp ) + 10 ) ; sprintf ( ret, "%s", temp ) ; fclose ( fp ) ; return ret ; } switch ( temp [ i ] ) { case EOF : fclose ( fp ) ; return NULL ; case '=' : temp [ i ] = 0 ; if (! strcmp ( temp, val ) ) { foundit = 1 ; } i = 0 ; break ; case '\\0' : i = 0 ; break ; default : i ++ ; } } }<END_BUG>

Fix:
<S2SV_ModStart> val ) { int temp_size = 500 ; char * temp = malloc ( temp_size ) <S2SV_ModEnd> ; int i <S2SV_ModStart> ; ) { if ( i >= temp_size ) { temp_size *= 2 ; temp = realloc ( temp, temp_size ) ; }
Buggy code:
 static int xlate_to_uni ( const unsigned char * name, int len, unsigned char * outname, int * longlen, int * outlen, int escape, int utf8, struct nls_table * nls ) { const unsigned char * ip ; unsigned char nc ; unsigned char * op ; unsigned int ec ; int i, k, fill ; int charlen ; if ( utf8 ) { <START_BUG> * outlen = utf8s_to_utf16s ( name, len, ( wchar_t * ) outname ) ; <END_BUG> if ( * outlen < 0 ) return * outlen ; else if ( * outlen > FAT_LFN_LEN ) return - ENAMETOOLONG ; op = & outname [ * outlen * sizeof ( wchar_t ) ] ; } else { if ( nls ) { for ( i = 0, ip = name, op = outname, * outlen = 0 ; i < len && * outlen <= FAT_LFN_LEN ; * outlen += 1 ) { if ( escape && ( * ip == ':' ) ) { if ( i > len - 5 ) return - EINVAL ; ec = 0 ; for ( k = 1 ; k < 5 ; k ++ ) { nc = ip [ k ] ; ec <<= 4 ; if ( nc >= '0' && nc <= '9' ) { ec |= nc - '0' ; continue ; } if ( nc >= 'a' && nc <= 'f' ) { ec |= nc - ( 'a' - 10 ) ; continue ; } if ( nc >= 'A' && nc <= 'F' ) { ec |= nc - ( 'A' - 10 ) ; continue ; } return - EINVAL ; } * op ++ = ec & 0xFF ; * op ++ = ec >> 8 ; ip += 5 ; i += 5 ; } else { if ( ( charlen = nls -> char2uni ( ip, len - i, ( wchar_t * ) op ) ) < 0 ) return - EINVAL ; ip += charlen ; i += charlen ; op += 2 ; } } if ( i < len ) return - ENAMETOOLONG ; } else { for ( i = 0, ip = name, op = outname, * outlen = 0 ; i < len && * outlen <= FAT_LFN_LEN ;

Fix:
<S2SV_ModStart>, len, UTF16_HOST_ENDIAN, <S2SV_ModStart> * ) outname, FAT_LFN_LEN + 2
Buggy code:
 bool inode_owner_or_capable ( const struct inode * inode ) <START_BUG> { <END_BUG> if ( uid_eq ( current_fsuid ( ), inode -> i_uid ) ) return true ;  if ( inode_capable ( inode, CAP_FOWNER ) ) <START_BUG> return true ; return false ; }<END_BUG>

Fix:
<S2SV_ModStart> inode ) { struct user_namespace * ns ; <S2SV_ModStart> return true ; ns = current_user_ns ( ) ; if ( ns_capable ( ns, CAP_FOWNER ) && kuid_has_mapping ( ns, inode -> i_uid <S2SV_ModEnd> ) ) return
Buggy code:
 static int FstringParser_ConcatFstring ( FstringParser * state, const char * * str, const char * end, int raw, int recurse_lvl, struct compiling * c, const node * n ) { FstringParser_check_invariants ( state ) ; <START_BUG> while ( 1 ) { <END_BUG> PyObject * literal = NULL ; expr_ty expression = NULL ; int result = fstring_find_literal_and_expr ( str, end, raw, recurse_lvl, & literal, & expression, c, n ) ; if ( result < 0 ) return - 1 ; if (! literal ) { } else if (! state -> last_str ) { state -> last_str = literal ; literal = NULL ; } else { assert ( PyUnicode_GET_LENGTH ( literal )!= 0 ) ; if ( FstringParser_ConcatAndDel ( state, literal ) < 0 ) return - 1 ; literal = NULL ; }  assert (! state -> last_str || <START_BUG> PyUnicode_GET_LENGTH ( state -> last_str )!= 0 ) ; assert ( literal == NULL ) ; if ( result == 1 ) continue ; if (! expression ) break ; if (! state -> last_str ) { } else { expr_ty str = make_str_node_and_del ( & state -> last_str, c, n ) ; if (! str || ExprList_Append ( & state -> expr_list, str ) < 0 ) return - 1 ; } if ( ExprList_Append ( & state -> expr_list, expression ) < 0 ) return - 1 ; } if ( recurse_lvl == 0 && * str < end - 1 ) { ast_error ( c, n, "f-string:   unexpected   end   of   string" ) ; return - 1 ; } if ( recurse_lvl!= 0 && * * str!= '}' ) { ast_error ( c, n, "f-string:   expecting   \'}\'" ) ; return - 1 ; } FstringParser_check_invariants ( state ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> state ) ; state -> fmode = 1 ; <S2SV_ModStart> } assert ( <S2SV_ModEnd> literal == NULL
Buggy code:
 static int ovl_fill_super ( struct super_block * sb, void * data, int silent ) { struct path lowerpath ; struct path upperpath ; struct path workpath ; struct inode * root_inode ; struct dentry * root_dentry ; struct ovl_entry * oe ; struct ovl_fs * ufs ; struct kstatfs statfs ; int err ; err = - ENOMEM ; ufs = kzalloc ( sizeof ( struct ovl_fs ), GFP_KERNEL ) ; if (! ufs ) goto out ; err = ovl_parse_opt ( ( char * ) data, & ufs -> config ) ; if ( err ) goto out_free_config ; err = - EINVAL ; if (! ufs -> config. upperdir ||! ufs -> config. lowerdir ||! ufs -> config. workdir ) { pr_err ( "overlayfs:   missing   upperdir   or   lowerdir   or   workdir\\n" ) ; goto out_free_config ; } err = - ENOMEM ; oe = ovl_alloc_entry ( ) ; if ( oe == NULL ) goto out_free_config ; err = ovl_mount_dir ( ufs -> config. upperdir, & upperpath ) ; if ( err ) goto out_free_oe ; err = ovl_mount_dir ( ufs -> config. lowerdir, & lowerpath ) ; if ( err ) goto out_put_upperpath ; err = ovl_mount_dir ( ufs -> config. workdir, & workpath ) ; if ( err ) goto out_put_lowerpath ; err = - EINVAL ; if (! S_ISDIR ( upperpath. dentry -> d_inode -> i_mode ) ||! S_ISDIR ( lowerpath. dentry -> d_inode -> i_mode ) ||! S_ISDIR ( workpath. dentry -> d_inode -> i_mode ) ) { pr_err ( "overlayfs:   upperdir   or   lowerdir   or   workdir   not   a   directory\\n" ) ; goto out_put_workpath ; } if ( upperpath. mnt!= workpath. mnt ) { pr_err ( "overlayfs:   workdir   and  

Fix:
<S2SV_ModStart>. f_namelen ; sb -> s_stack_depth = max ( upperpath. mnt -> mnt_sb -> s_stack_depth, lowerpath. mnt -> mnt_sb -> s_stack_depth ) + 1 ; err = - EINVAL ; if ( sb -> s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH ) { pr_err ( "overlayfs: <S2SV_blank> maximum <S2SV_blank> fs <S2SV_blank> stacking <S2SV_blank> depth <S2SV_blank> exceeded\\n" ) ; goto out_put_workpath ; }
Buggy code:
 <START_BUG> static inline void mcryptd_check_internal ( struct rtattr * * tb, u32 * type, <END_BUG> u32 * mask ) { struct crypto_attr_type * algt ; algt = crypto_get_attr_type ( tb ) ; if ( IS_ERR ( algt ) )  return ; <START_BUG> <END_BUG> if ( ( algt -> type & CRYPTO_ALG_INTERNAL ) )  * type |= CRYPTO_ALG_INTERNAL ; <START_BUG> if ( ( algt -> mask & CRYPTO_ALG_INTERNAL ) ) <END_BUG> * mask |= CRYPTO_ALG_INTERNAL ; }

Fix:
<S2SV_ModStart> <S2SV_null> static inline bool <S2SV_ModEnd> mcryptd_check_internal ( struct <S2SV_ModStart> ) ) return false ; * type |= <S2SV_ModEnd> algt -> type <S2SV_ModStart> type & CRYPTO_ALG_INTERNAL ; * mask |= algt -> mask & <S2SV_ModEnd> CRYPTO_ALG_INTERNAL ; if <S2SV_ModStart> ; if ( * type & * <S2SV_ModEnd> mask & CRYPTO_ALG_INTERNAL <S2SV_ModStart> & CRYPTO_ALG_INTERNAL ) return true ; else return false <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static ssize_t get_node_path_locked ( struct node * node, char * buf, size_t bufsize ) { const char * name ; size_t namelen ; if ( node -> graft_path ) { name = node -> graft_path ; namelen = node -> graft_pathlen ; } else if ( node -> actual_name ) { name = node -> actual_name ; namelen = node -> namelen ; } else { name = node -> name ; namelen = node -> namelen ; } if ( bufsize < namelen + 1 ) { return - 1 ; } ssize_t pathlen = 0 ; if ( node -> parent && node -> graft_path == NULL ) { <START_BUG> pathlen = get_node_path_locked ( node -> parent, buf, bufsize - namelen - 2 ) ; <END_BUG> if ( pathlen < 0 ) { return - 1 ; } buf [ pathlen ++ ] = '//' ; } memcpy ( buf + pathlen, name, namelen + 1 ) ; return pathlen + namelen ; }

Fix:
<S2SV_ModStart> - namelen - 1 <S2SV_ModEnd> ) ; if
Buggy code:
 u32 h264bsdActivateParamSets ( storage_t * pStorage, u32 ppsId, u32 isIdr ) { u32 tmp ; u32 flag ; ASSERT ( pStorage ) ; ASSERT ( ppsId < MAX_NUM_PIC_PARAM_SETS ) ; if ( ( pStorage -> pps [ ppsId ] == NULL ) || ( pStorage -> sps [ pStorage -> pps [ ppsId ] -> seqParameterSetId ] == NULL ) ) { return ( HANTRO_NOK ) ; } tmp = CheckPps ( pStorage -> pps [ ppsId ], pStorage -> sps [ pStorage -> pps [ ppsId ] -> seqParameterSetId ] ) ; if ( tmp!= HANTRO_OK ) return ( tmp ) ; if ( pStorage -> activePpsId == MAX_NUM_PIC_PARAM_SETS ) { pStorage -> activePpsId = ppsId ; pStorage -> activePps = pStorage -> pps [ ppsId ] ; pStorage -> activeSpsId = pStorage -> activePps -> seqParameterSetId ; pStorage -> activeSps = pStorage -> sps [ pStorage -> activeSpsId ] ; <START_BUG> pStorage -> picSizeInMbs = <END_BUG> pStorage -> activeSps -> picWidthInMbs *  pStorage -> activeSps -> picHeightInMbs ; <START_BUG> pStorage -> currImage -> width = pStorage -> activeSps -> picWidthInMbs ; pStorage -> currImage -> height = pStorage -> activeSps -> picHeightInMbs ; pStorage -> pendingActivation = HANTRO_TRUE ; } else if ( pStorage -> pendingActivation ) { pStorage -> pendingActivation = HANTRO_FALSE ; FREE ( pStorage -> mb ) ; FREE ( pStorage -> sliceGroupMap ) ; ALLOCATE ( pStorage -> mb, pStorage -> picSizeInMbs, mbStorage_t ) ; ALLOCATE ( pStorage -> sliceGroupMap, pStorage -> picSizeInMbs, u32 ) ; if ( pStorage -> mb == NULL || pStorage -> sliceGroupMap == NULL ) return ( MEMORY_ALLOCATION_ERROR ) ; H264SwDecMemset ( pStorage -> mb, 0, pStorage -> picSizeInMbs * sizeof ( mbStorage_<END_BUG>

Fix:
<S2SV_ModStart> activeSpsId ] ; if ( pStorage -> activeSps -> picWidthInMbs == 0 ) { pStorage -> picSizeInMbs = 0 ; } else if ( pStorage -> activeSps -> picHeightInMbs > UINT32_MAX // pStorage -> activeSps -> picWidthInMbs ) { return ( MEMORY_ALLOCATION_ERROR ) ; } else { <S2SV_ModStart> -> picHeightInMbs ; }
Buggy code:
 GF_Err tenc_box_read ( GF_Box * s, GF_BitStream * bs ) { u8 iv_size ; GF_TrackEncryptionBox * ptr = ( GF_TrackEncryptionBox * ) s ; ISOM_DECREASE_SIZE ( ptr, 3 ) ; gf_bs_read_u8 ( bs ) ; if (! ptr -> version ) { gf_bs_read_u8 ( bs ) ; } else { ptr -> crypt_byte_block = gf_bs_read_int ( bs, 4 ) ; ptr -> skip_byte_block = gf_bs_read_int ( bs, 4 ) ; } ptr -> isProtected = gf_bs_read_u8 ( bs ) ; ISOM_DECREASE_SIZE ( ptr, 17 ) ; ptr -> key_info [ 0 ] = 0 ; ptr -> key_info [ 1 ] = 0 ; ptr -> key_info [ 2 ] = 0 ; ptr -> key_info [ 3 ] = iv_size = gf_bs_read_u8 ( bs ) ; gf_bs_read_data ( bs, ptr -> key_info + 4, 16 ) ; if (! iv_size && ptr -> isProtected ) { ISOM_DECREASE_SIZE ( ptr, 1 ) ; iv_size = ptr -> key_info [ 20 ] = gf_bs_read_u8 ( bs ) ; ISOM_DECREASE_SIZE ( ptr, ptr -> key_info [ 20 ] ) ; <START_BUG> gf_bs_read_data ( bs, ptr -> key_info + 21, iv_size ) ; <END_BUG> }  return GF_OK ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ] ) ; if ( ( iv_size!= 8 ) && ( iv_size!= 16 ) ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_CONTAINER, ( "[iso <S2SV_blank> file] <S2SV_blank> Invalid <S2SV_blank> constant <S2SV_blank> IV <S2SV_blank> size <S2SV_blank> %d, <S2SV_blank> must <S2SV_blank> be <S2SV_blank> 8 <S2SV_blank> or <S2SV_blank> 16\\n", ( u32 ) iv_size ) ) ; ptr -> key_info [ 20 ] = 16 ; return GF_NON_COMPLIANT_BITSTREAM ; } <S2SV_ModStart> ) ; } else if ( ( iv_size!= 0 ) && ( iv_size!= 8 ) && ( iv_size!= 16 ) ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_CONTAINER, ( "[iso <S2SV_blank> file] <S2SV_blank> Invalid <S2SV_blank> IV <S2SV_blank> size <S2SV_blank> %d, <S2SV_blank> must <S2SV_blank> be <S2SV_blank> 0, <S2SV_blank> 8 <S2SV_blank> or <S2SV_blank> 16\\n", ( u32 ) iv_size ) ) ; return GF_NON_COMPLIANT_BITSTREAM ; }
Buggy code:
 static inline unsigned short ReadPropertyUnsignedShort ( const EndianType endian, const unsigned char * buffer ) { unsigned short value ; if ( endian == LSBEndian ) { <START_BUG> value = ( unsigned short ) ( ( buffer [ 1 ] << 8 ) | buffer [ 0 ] ) ; <END_BUG>  return ( ( unsigned short ) ( value & 0xffff ) ) ; <START_BUG> } <END_BUG> value = ( unsigned short ) ( ( ( ( unsigned char * ) buffer ) [ 0 ] << 8 ) |  ( ( unsigned char * ) buffer ) [ 1 ] ) ; <START_BUG> return ( ( unsigned short ) ( value & 0xffff ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> unsigned short ) <S2SV_ModEnd> buffer [ 1 <S2SV_ModStart> ] << 8 ; value |= ( unsigned short ) <S2SV_ModEnd> buffer [ 0 <S2SV_ModStart> [ 0 ] <S2SV_ModEnd> ; return ( <S2SV_ModStart> ; return ( <S2SV_ModEnd> value & 0xffff <S2SV_ModStart> value & 0xffff <S2SV_ModEnd> ) ; } <S2SV_ModStart> unsigned short ) buffer <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> ] << 8 ; value |= <S2SV_ModEnd> ( unsigned short <S2SV_ModStart> unsigned short ) buffer [ 1 ] ; return <S2SV_ModStart> & 0xffff ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 <START_BUG> static void update_mv_probs ( vp9_prob * p, int n, vp9_reader * r ) { <END_BUG> int i ; for ( i = 0 ; i < n ; ++ i )  if ( vp9_read ( r, MV_UPDATE_PROB ) ) <START_BUG> <END_BUG> p [ i ] = ( vp9_read_literal ( r, 7 ) << 1 ) | 1 ;  }

Fix:
<S2SV_ModStart> void update_mv_probs ( vpx_prob <S2SV_ModEnd> * p, <S2SV_ModStart> int n, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> ) if ( vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> ] = ( vpx_read_literal <S2SV_ModEnd> ( r,
Buggy code:
 static int ssl_scan_serverhello_tlsext ( SSL * s, PACKET * pkt, int * al ) { unsigned int length, type, size ; int tlsext_servername = 0 ; int renegotiate_seen = 0 ; # ifndef OPENSSL_NO_NEXTPROTONEG s -> s3 -> next_proto_neg_seen = 0 ; # endif s -> tlsext_ticket_expected = 0 ; OPENSSL_free ( s -> s3 -> alpn_selected ) ; s -> s3 -> alpn_selected = NULL ; # ifndef OPENSSL_NO_HEARTBEATS s -> tlsext_heartbeat &= ~ ( SSL_DTLSEXT_HB_ENABLED | SSL_DTLSEXT_HB_DONT_SEND_REQUESTS ) ; # endif <START_BUG> s -> s3 -> flags &= ~ TLS1_FLAGS_ENCRYPT_THEN_MAC ; <END_BUG> s -> s3 -> flags &= ~ TLS1_FLAGS_RECEIVED_EXTMS ; if (! PACKET_get_net_2 ( pkt, & length ) ) goto ri_check ; if ( PACKET_remaining ( pkt )!= length ) { * al = SSL_AD_DECODE_ERROR ; return 0 ; } if (! tls1_check_duplicate_extensions ( pkt ) ) { * al = SSL_AD_DECODE_ERROR ; return 0 ; } while ( PACKET_get_net_2 ( pkt, & type ) && PACKET_get_net_2 ( pkt, & size ) ) { const unsigned char * data ; PACKET spkt ; if (! PACKET_get_sub_packet ( pkt, & spkt, size ) ||! PACKET_peek_bytes ( & spkt, & data, size ) ) goto ri_check ; if ( s -> tlsext_debug_cb ) s -> tlsext_debug_cb ( s, 1, type, data, size, s -> tlsext_debug_arg ) ; if ( type == TLSEXT_TYPE_renegotiate ) { if (! ssl_parse_serverhello_renegotiate_ext ( s, & spkt, al ) ) return 0 ; renegotiate_seen = 1 ; } else if ( s -> version == SSL3_VERSION ) { } else

Fix:
<S2SV_ModStart> endif s -> tlsext_use_etm = 0 <S2SV_ModEnd> ; s -> <S2SV_ModStart> ) s -> tlsext_use_etm = 1 <S2SV_ModEnd> ; } else
Buggy code:
 void jas_matrix_setall ( jas_matrix_t * matrix, jas_seqent_t val ) { <START_BUG> int i ; <END_BUG> int j ; jas_seqent_t * rowstart ;  int rowstep ; <START_BUG> jas_seqent_t * data ; if ( jas_matrix_numrows ( matrix ) > 0 && jas_matrix_numcols ( matrix ) > 0 ) { assert ( matrix -> rows_ ) ; rowstep = jas_matrix_rowstep ( matrix ) ; for ( i = matrix -> numrows_, rowstart = matrix -> rows_ [ 0 ] ; i > 0 ; -- i, rowstart += rowstep ) { for ( j = matrix -> numcols_, data = rowstart ; j > 0 ; -- j, ++ data ) { * data = val ; } } } }<END_BUG>

Fix:
<S2SV_ModStart> val ) { jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; jas_seqent_t <S2SV_ModStart> * rowstart ; jas_matind_t <S2SV_ModEnd> rowstep ; jas_seqent_t
Buggy code:
 <START_BUG> static int decode_term_subexp ( vp9_reader * r ) { <END_BUG>  if (! vp9_read_bit ( r ) ) <START_BUG> <END_BUG> return vp9_read_literal ( r, 4 ) ;  <START_BUG> if (! vp9_read_bit ( r ) ) <END_BUG>  return vp9_read_literal ( r, 4 ) + 16 ; <START_BUG> <END_BUG> if (! vp9_read_bit ( r ) )  <START_BUG> return vp9_read_literal ( r, 5 ) + 32 ; <END_BUG> return decode_uniform ( r ) + 64 ; }

Fix:
<S2SV_ModStart> int decode_term_subexp ( vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> if (! vpx_read_bit <S2SV_ModEnd> ( r ) <S2SV_ModStart> ) ) return vpx_read_literal <S2SV_ModEnd> ( r, <S2SV_ModStart> if (! vpx_read_bit <S2SV_ModEnd> ( r ) <S2SV_ModStart> ) ) return vpx_read_literal <S2SV_ModEnd> ( r, <S2SV_ModStart> if (! vpx_read_bit <S2SV_ModEnd> ( r ) <S2SV_ModStart> ) ) return vpx_read_literal <S2SV_ModEnd> ( r,
Buggy code:
 int _libssh2_packet_add ( LIBSSH2_SESSION * session, unsigned char * data, size_t datalen, int macstate ) { int rc = 0 ; <START_BUG> char * message = NULL ; <END_BUG>  char * language = NULL ; <START_BUG> size_t message_len = 0 ; size_t language_len = 0 ; LIBSSH2_CHANNEL * channelp = NULL ; size_t data_head = 0 ; unsigned char msg = data [ 0 ] ; switch ( session -> packAdd_state ) { case libssh2_NB_state_idle : _libssh2_debug ( session, LIBSSH2_TRACE_TRANS, "Packet   type   %d   received,   length=%d", ( int ) msg, ( int ) datalen ) ; if ( ( macstate == LIBSSH2_MAC_INVALID ) && (! session -> macerror || LIBSSH2_MACERROR ( session, ( char * ) data, datalen ) ) ) { LIBSSH2_FREE ( session, data ) ; return _libssh2_error ( session, LIBSSH2_ERROR_INVALID_MAC, "Invalid   MAC   received" ) ; } session -> packAdd_state = libssh2_NB_state_allocated ; break ; case libssh2_NB_state_jump1 : goto libssh2_packet_add_jump_point1 ; case libssh2_NB_state_jump2 : goto libssh2_packet_add_jump_point2 ; case libssh2_NB_state_jump3 : goto libssh2_packet_add_jump_point3 ; case libssh2_NB_state_jump4 : goto libssh2_packet_add_jump_point4 ; case libssh2_NB_state_jump5 : goto libssh2_packet_add_jump_point5 ; default : break ; } if ( session -> packAdd_state == libssh2_NB_state_allocated ) { switch ( msg ) { case SSH_MSG_DISCONNECT : if ( datalen >= 5 ) { <END_BUG> size_t reason = _libssh2_ntohu32 ( data + 1 ) ;  if ( datalen >= 9 ) { message_len = _libssh2_ntohu32 ( data + 5 ) ; if ( message_len < datalen - 13

Fix:
<S2SV_ModStart> = 0 ; unsigned <S2SV_ModStart> = NULL ; unsigned <S2SV_ModStart> 5 ) { uint32_t reason = 0 ; struct string_buf buf ; buf. data = ( unsigned <S2SV_ModEnd> char * ) <S2SV_ModStart> * ) data ; buf. dataptr = buf. data ; buf. len = datalen ; buf. dataptr ++ ; _libssh2_get_u32 ( & buf, & reason ) ; _libssh2_get_string ( & buf, & message, & message_len ) ; _libssh2_get_string ( & buf, & language, & language_len ) ; if ( session -> ssh_msg_disconnect ) { LIBSSH2_DISCONNECT ( session, reason, ( const <S2SV_ModEnd> char * ) <S2SV_ModStart> char * ) message, message_len, ( const char * ) language, <S2SV_ModEnd> language_len ) ; <S2SV_ModStart> 6 ) { struct string_buf buf ; buf. data = ( unsigned <S2SV_ModEnd> char * ) <S2SV_ModStart> * ) data ; buf. dataptr = buf. data ; buf. len = datalen ; buf. dataptr += 2 ; _libssh2_get_string ( & buf, & message, & message_len ) ; _libssh2_get_string ( &
Buggy code:
 DECLAREreadFunc ( readContigTilesIntoBuffer ) { int status = 1 ; tsize_t tilesize = TIFFTileSize ( in ) ; tdata_t tilebuf ; uint32 imagew = TIFFScanlineSize ( in ) ; uint32 tilew = TIFFTileRowSize ( in ) ; int iskew = imagew - tilew ; uint8 * bufp = ( uint8 * ) buf ; uint32 tw, tl ; uint32 row ; ( void ) spp ; tilebuf = _TIFFmalloc ( tilesize ) ; if ( tilebuf == 0 ) return 0 ; _TIFFmemset ( tilebuf, 0, tilesize ) ; ( void ) TIFFGetField ( in, TIFFTAG_TILEWIDTH, & tw ) ; ( void ) TIFFGetField ( in, TIFFTAG_TILELENGTH, & tl ) ; for ( row = 0 ; row < imagelength ; row += tl ) { uint32 nrow = ( row + tl > imagelength )? imagelength - row : tl ; uint32 colb = 0 ; uint32 col ; <START_BUG> for ( col = 0 ; col < imagewidth ; col += tw ) { <END_BUG> if ( TIFFReadTile ( in, tilebuf, col, row, 0, 0 ) < 0 &&! ignore ) { TIFFError ( TIFFFileName ( in ), "Error,   can\'t   read   tile   at   %lu   %lu", ( unsigned long ) col, ( unsigned long ) row ) ; status = 0 ; goto done ; } if ( colb + tilew > imagew ) { uint32 width = imagew - colb ; uint32 oskew = tilew - width ; cpStripToTile ( bufp + colb, tilebuf, nrow, width, oskew + iskew, oskew ) ; } else cpStripToTile ( bufp + colb, tilebuf, nrow, tilew, iskew, 0 ) ; colb += tilew ; } bufp += imagew * nrow ; } done : _TIFFfree ( tilebuf ) ; return status ; }

Fix:
<S2SV_ModStart> col < imagewidth && colb < imagew
Buggy code:
 static int pci_emul_mem_handler ( struct vmctx * ctx, int vcpu, int dir, uint64_t addr, int size, uint64_t * val, void * arg1, long arg2 ) { struct pci_vdev * pdi = arg1 ; struct pci_vdev_ops * ops = pdi -> dev_ops ; uint64_t offset ; int bidx = ( int ) arg2 ; <START_BUG> assert ( bidx <= PCI_BARMAX ) ; <END_BUG>  assert ( pdi -> bar [ bidx ]. type == PCIBAR_MEM32 || <START_BUG> <END_BUG> pdi -> bar [ bidx ]. type == PCIBAR_MEM64 ) ;  assert ( addr >= pdi -> bar [ bidx ]. addr && addr + size <= pdi -> bar [ bidx ]. addr + pdi -> bar [ bidx ]. size ) ; offset = addr - pdi -> bar [ bidx ]. addr ; if ( dir == MEM_F_WRITE ) { if ( size == 8 ) { ( * ops -> vdev_barwrite ) ( ctx, vcpu, pdi, bidx, offset, 4, * val & 0xffffffff ) ; ( * ops -> vdev_barwrite ) ( ctx, vcpu, pdi, bidx, offset + 4, 4, * val >> 32 ) ; } else { ( * ops -> vdev_barwrite ) ( ctx, vcpu, pdi, bidx, offset, size, bar_value ( size, * val ) ) ; } } else { if ( size == 8 ) { uint64_t val_lo, val_hi ; val_lo = ( * ops -> vdev_barread ) ( ctx, vcpu, pdi, bidx, offset, 4 ) ; val_lo = bar_value ( 4, val_lo ) ; val_hi = ( * ops -> vdev_barread ) ( ctx, vcpu, pdi, bidx, offset + 4, 4 ) ; * val = val_lo | ( val_hi << 32 ) ; } else { * val = ( * ops -> vdev_barread ) ( ctx, vcpu, pdi, bidx, offset, size ) ; * val = bar_value ( size, * val ) ; } } return 0 ;

Fix:
<S2SV_ModStart> ) arg2 ; if ( addr + size > <S2SV_ModEnd> pdi -> bar <S2SV_ModStart> bidx ]. addr + <S2SV_ModEnd> pdi -> bar <S2SV_ModStart> bidx ]. size ) { printf ( "%s, <S2SV_blank> Out <S2SV_blank> of <S2SV_blank> emulated <S2SV_blank> memory <S2SV_blank> range.\\n", __func__ ) ; return - ESRCH ; } <S2SV_ModEnd> offset = addr
Buggy code:
 static void copy_to_user_policy ( struct xfrm_policy * xp, struct xfrm_userpolicy_info * p, int dir ) <START_BUG> { <END_BUG> memcpy ( & p -> sel, & xp -> selector, sizeof ( p -> sel ) ) ; memcpy ( & p -> lft, & xp -> lft, sizeof ( p -> lft ) ) ; memcpy ( & p -> curlft, & xp -> curlft, sizeof ( p -> curlft ) ) ; p -> priority = xp -> priority ; p -> index = xp -> index ; p -> sel. family = xp -> family ; p -> dir = dir ; p -> action = xp -> action ; p -> flags = xp -> flags ; p -> share = XFRM_SHARE_ANY ; }

Fix:
<S2SV_ModStart> dir ) { memset ( p, 0, sizeof ( * p ) ) ;
Buggy code:
 struct timespec ns_to_timespec ( const s64 nsec ) { <START_BUG> struct timespec ts ; <END_BUG> if (! nsec ) return ( struct timespec ) { 0, 0 } ;  ts. tv_sec = div_long_long_rem_signed ( nsec, NSEC_PER_SEC, & ts. tv_nsec ) ; <START_BUG> <END_BUG> if ( unlikely ( nsec < 0 ) )  <START_BUG> set_normalized_timespec ( & ts, ts. tv_sec, ts. tv_nsec ) ; <END_BUG> return ts ; }

Fix:
<S2SV_ModStart> struct timespec ts ; s32 rem <S2SV_ModStart>. tv_sec = div_s64_rem <S2SV_ModEnd> ( nsec, <S2SV_ModStart> NSEC_PER_SEC, & rem <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( unlikely ( rem <S2SV_ModEnd> < 0 ) <S2SV_ModStart> 0 ) ) { <S2SV_ModEnd> ts. tv_sec <S2SV_ModStart> ts. tv_sec -- ; rem += NSEC_PER_SEC ; } <S2SV_ModEnd> ts. tv_nsec <S2SV_ModStart> ts. tv_nsec = rem <S2SV_ModEnd> ; return ts
Buggy code:
 static void m_stop ( struct seq_file * m, void * v ) { struct proc_maps_private * priv = m -> private ; struct vm_area_struct * vma = v ; <START_BUG> vma_stop ( priv, vma ) ; <END_BUG> if ( priv -> task ) put_task_struct ( priv -> task ) ; }

Fix:
<S2SV_ModStart> = v ; if (! IS_ERR ( vma ) )
Buggy code:
 <START_BUG> double GetGPMFSampleRate ( size_t handle, uint32_t fourcc, uint32_t flags ) <END_BUG> { mp4object * mp4 = ( mp4object * ) handle ; if ( mp4 == NULL ) return 0.0 ; GPMF_stream metadata_stream, * ms = & metadata_stream ; uint32_t teststart = 0 ; uint32_t testend = mp4 -> indexcount ;  double rate = 0.0 ; <START_BUG> if ( mp4 -> indexcount < 1 ) return 0.0 ; <END_BUG> if ( mp4 -> indexcount > 3 )  { teststart ++ ; <START_BUG> testend -- ; <END_BUG>  } <START_BUG> <END_BUG> uint32_t * payload = GetPayload ( handle, NULL, teststart ) ;  <START_BUG> uint32_t payloadsize = GetPayloadSize ( handle, teststart ) ; <END_BUG> int32_t ret = GPMF_Init ( ms, payload, payloadsize ) ;  if ( ret!= GPMF_OK ) <START_BUG> goto cleanup ; { uint32_t startsamples = 0 ; uint32_t endsamples = 0 ; uint32_t missing_samples = 0 ; while ( ret == GPMF_OK && GPMF_OK!= GPMF_FindNext ( ms, fourcc, GPMF_RECURSE_LEVELS ) ) <END_BUG> {  missing_samples = 1 ; teststart ++ ; <START_BUG> payload = GetPayload ( handle, payload, teststart ) ; <END_BUG>  payloadsize = GetPayloadSize ( handle, teststart ) ; <START_BUG> <END_BUG> ret = GPMF_Init ( ms, payload, payloadsize ) ;  } if ( missing_samples ) { teststart ++ ; payload = GetPayload ( handle, payload, teststart ) ; payloadsize = GetPayloadSize ( handle, teststart ) ; ret = GPMF_Init ( ms, payload, payloadsize ) ; } if ( ret == GPMF_OK ) { <START_BUG> uint32_t samples = GPMF_Repeat ( ms ) ; <END_BUG> GPMF_stream find_stream ; GPMF_CopyState ( ms, & find_stream ) ;  if (! ( flags & GPMF_SAMPLE_RATE_PRECISE ) && GPMF_OK == GPMF_FindPrev ( & find_stream, GPMF_KEY_TOTAL_SAMPLES, GPMF_CURRENT_LEVEL ) ) <START_BUG> { startsamples = BYTES<END_BUG>

Fix:
<S2SV_ModStart>, uint32_t flags, double * firstsampletime, double * lastsampletime <S2SV_ModStart> rate = 0.0 ; uint32_t * payload ; uint32_t payloadsize ; int32_t ret <S2SV_ModStart> return 0.0 ; payload = GetPayload ( handle, NULL, teststart ) ; payloadsize = GetPayloadSize ( handle, teststart ) ; ret = GPMF_Init ( ms, payload, payloadsize ) ; if ( ret!= GPMF_OK ) goto cleanup ; { uint64_t minimumtimestamp = 0 ; uint64_t starttimestamp = 0 ; uint64_t endtimestamp = 0 ; uint32_t startsamples = 0 ; uint32_t endsamples = 0 ; double intercept = 0.0 ; while ( teststart < <S2SV_ModEnd> mp4 -> indexcount <S2SV_ModStart> mp4 -> indexcount && ret == GPMF_OK && GPMF_OK!= GPMF_FindNext ( ms, fourcc, GPMF_RECURSE_LEVELS ) <S2SV_ModEnd> ) { teststart <S2SV_ModStart> teststart ++ ; payload = GetPayload ( handle, payload, teststart ) ; payloadsize = GetPayloadSize ( handle, teststart ) ; ret = GPMF_Init ( ms
Buggy code:
 static int search_impl ( i_ctx_t * i_ctx_p, bool forward ) { os_ptr op = osp ; os_ptr op1 = op - 1 ; uint size = r_size ( op ) ; uint count ; byte * pat ; byte * ptr ; byte ch ; int incr = forward? 1 : - 1 ; check_read_type ( * op1, t_string ) ; check_read_type ( * op, t_string ) ; if ( size > r_size ( op1 ) ) { make_false ( op ) ; return 0 ; } count = r_size ( op1 ) - size ; ptr = op1 -> value. bytes ; if ( size == 0 ) goto found ; if (! forward ) ptr += count ; pat = op -> value. bytes ; ch = pat [ 0 ] ; do { if ( * ptr == ch && ( size == 1 ||! memcmp ( ptr, pat, size ) ) ) goto found ; ptr += incr ; } while ( count -- ) ; make_false ( op ) ; return 0 ; found : op -> tas. type_attrs = op1 -> tas. type_attrs ; op -> value. bytes = ptr ; <START_BUG> r_set_size ( op, size ) ; <END_BUG> push ( 2 ) ; op [ - 1 ] = * op1 ;  r_set_size ( op - 1, ptr - op [ - 1 ]. value. bytes ) ; <START_BUG> op1 -> value. bytes = ptr + size ; <END_BUG> r_set_size ( op1, count + (! forward? ( size - 1 ) : 0 ) ) ;  make_true ( op ) ; return 0 ; }

Fix:
<S2SV_ModStart> = ptr ; op -> tas. rsize = size <S2SV_ModEnd> ; push ( <S2SV_ModStart> * op1 ; op [ - 3 ]. <S2SV_ModEnd> value. bytes <S2SV_ModStart> + size ; if ( forward ) { op [ - 1 ]. tas. rsize = ptr - op [ - 1 ]. value. bytes ; op [ - 3 ]. tas. rsize = count ; } else { op [ - 1 ]. tas. rsize = count ; op [ - 3 ]. tas. rsize -= count + size ; } <S2SV_ModEnd> make_true ( op
Buggy code:
 <START_BUG> static void evtchn_2l_handle_events ( unsigned cpu ) <END_BUG> { int irq ; xen_ulong_t pending_words ; xen_ulong_t pending_bits ; int start_word_idx, start_bit_idx ; int word_idx, bit_idx ; int i ; struct shared_info * s = HYPERVISOR_shared_info ; struct vcpu_info * vcpu_info = __this_cpu_read ( xen_vcpu ) ; irq = irq_from_virq ( cpu, VIRQ_TIMER ) ; if ( irq!= - 1 ) { evtchn_port_t evtchn = evtchn_from_irq ( irq ) ; word_idx = evtchn // BITS_PER_LONG ; bit_idx = evtchn % BITS_PER_LONG ; if ( active_evtchns ( cpu, s, word_idx ) & ( 1ULL << bit_idx ) ) generic_handle_irq ( irq ) ; } pending_words = xchg_xen_ulong ( & vcpu_info -> evtchn_pending_sel, 0 ) ; start_word_idx = __this_cpu_read ( current_word_idx ) ; start_bit_idx = __this_cpu_read ( current_bit_idx ) ; word_idx = start_word_idx ; for ( i = 0 ; pending_words!= 0 ; i ++ ) { xen_ulong_t words ; words = MASK_LSBS ( pending_words, word_idx ) ; if ( words == 0 ) { word_idx = 0 ; bit_idx = 0 ; continue ; } word_idx = EVTCHN_FIRST_BIT ( words ) ; pending_bits = active_evtchns ( cpu, s, word_idx ) ; bit_idx = 0 ; if ( word_idx == start_word_idx ) { if ( i == 0 ) bit_idx = start_bit_idx ; } do { xen_ulong_t bits ; evtchn_port_t port ; bits = MASK_LSBS ( pending_bits, bit_idx ) ; if ( bits == 0 ) break ; bit_idx = EVTCHN_FIRST_BIT ( bits ) ; port = (

Fix:
<S2SV_ModStart> ( unsigned cpu, struct evtchn_loop_ctrl * ctrl <S2SV_ModStart> + bit_idx ; handle_irq_for_port ( port, ctrl <S2SV_ModEnd> ) ; bit_idx
Buggy code:
 <START_BUG> static void rd_pick_sb_modes ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> int mi_row, int mi_col,  int * totalrate, int64_t * totaldist, <START_BUG> BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx, int64_t best_rd ) { VP9_COMMON * const cm = & cpi -> common ; <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  MACROBLOCKD * const xd = & x -> e_mbd ; MB_MODE_INFO * mbmi ; struct macroblock_plane * const p = x -> plane ; struct macroblockd_plane * const pd = xd -> plane ; const AQ_MODE aq_mode = cpi -> oxcf. aq_mode ; int i, orig_rdmult ; <START_BUG> double rdmult_ratio ; <END_BUG> vp9_clear_system_state ( ) ; rdmult_ratio = 1.0 ; x -> use_lp32x32fdct = 1 ;  if ( bsize < BLOCK_8X8 ) { <START_BUG> if ( x -> ab_index!= 0 ) { * totalrate = 0 ; * totaldist = 0 ; return ; } } <END_BUG> set_offsets ( cpi, tile, mi_row, mi_col, bsize ) ;  mbmi = & xd -> mi [ 0 ] -> mbmi ; mbmi -> sb_type = bsize ; for ( i = 0 ; i < MAX_MB_PLANE ; ++ i ) { p [ i ]. coeff = ctx -> coeff_pbuf [ i ] [ 0 ] ; p [ i ]. qcoeff = ctx -> qcoeff_pbuf [ i ] [ 0 ] ; pd [ i ]. dqcoeff = ctx -> dqcoeff_pbuf [ i ] [ 0 ] ; p [ i ]. eobs = ctx -> eobs_pbuf [ i ] [ 0 ] ; } ctx -> is_coded = 0 ; <START_BUG> x -> skip_recode = 0 ; <END_BUG> mbmi -> skip = 0 ;  x -> source_variance = get_sby_perpixel_variance ( cpi, x, bsize ) ; <START_BUG> if ( aq_mode == VARIANCE_AQ ) { const int energy = bsize <= BLOCK_16X16<END_BUG>

Fix:
<S2SV_ModStart> * cpi, TileDataEnc * tile_data, MACROBLOCK * const x <S2SV_ModEnd>, int mi_row <S2SV_ModStart> int mi_col, RD_COST * rd_cost <S2SV_ModEnd>, BLOCK_SIZE bsize <S2SV_ModStart> -> common ; TileInfo * const tile_info = & tile_data -> tile_info <S2SV_ModEnd> ; MACROBLOCKD * <S2SV_ModStart>, orig_rdmult ; vpx_clear_system_state ( ) <S2SV_ModEnd> ; x -> <S2SV_ModStart> = 1 ; <S2SV_ModEnd> set_offsets ( cpi <S2SV_ModStart> ( cpi, tile_info, x <S2SV_ModEnd>, mi_row, <S2SV_ModStart> = 0 ; ctx -> skippable = 0 ; ctx -> pred_pixel_ready = 0 ; <S2SV_ModStart> = 0 ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { <S2SV_ModStart> -> source_variance = vp9_high_get_sby_perpixel_variance ( cpi, & x -> plane [ 0 ]. src, bsize, xd -> bd ) ; } else { x -> source_variance = vp9_get_sby_perpixel_variance ( cpi, & x -> plane [ 0 ]. src,
Buggy code:
 gprincs_ret * get_princs_2_svc ( gprincs_arg * arg, struct svc_req * rqstp ) { static gprincs_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_gprincs_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } prime_arg = arg -> exp ; if ( prime_arg == NULL ) prime_arg = "*" ; if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_LIST, NULL, NULL ) ) { ret. code = KADM5_AUTH_LIST ; log_unauth ( "kadm5_get_principals", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_get_principals ( ( void * ) handle, arg -> exp, & ret. princs, & ret. count ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_get_principals", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; }  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_release_buffer ( & minor_stat, & service_name ) ; exit_func : free<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static int <START_BUG> mptctl_readtest ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_test __user * uarg = ( void __user * ) arg ; struct mpt_ioctl_test karg ;  MPT_ADAPTER * ioc ; <START_BUG> int iocnum ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_test ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_readtest   -   " "Unable   to   read   in   mpt_ioctl_test   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; return - EFAULT ; } <END_BUG> if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) ||  ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_readtest()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_readtest   called.\\n", ioc -> name ) ) ; # ifdef MFCNT karg. chip_type = ioc -> mfcnt ; # else karg. chip_type = ioc -> pcidev -> device ; # endif strncpy ( karg. name, ioc -> name, MPT_MAX_NAME ) ; karg. name [ MPT_MAX_NAME - 1 ] = '\\0' ; strncpy ( karg. product, ioc -> prod_name, MPT_PRODUCT_LENGTH ) ; karg. product [ MPT_PRODUCT_LENGTH - 1 ] = '\\0' ; if ( copy_to_user ( ( char __user * ) arg, & karg, sizeof ( struct mpt_ioctl_test ) ) ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_readtest   -   " "Unable   to   write   out   mpt_ioctl_test   struct  

Fix:
<S2SV_ModStart> int mptctl_readtest ( MPT_ADAPTER * ioc, <S2SV_ModStart> mpt_ioctl_test karg ; <S2SV_ModEnd> if ( copy_from_user <S2SV_ModStart> EFAULT ; } <S2SV_ModEnd> dctlprintk ( ioc
Buggy code:
 static int dissect_spoolss_keybuffer ( tvbuff_t * tvb, int offset, packet_info * pinfo, proto_tree * tree, dcerpc_info * di, guint8 * drep ) { guint32 size ; int end_offset ; if ( di -> conformant_run ) return offset ; offset = dissect_ndr_uint32 ( tvb, offset, pinfo, tree, di, drep, hf_keybuffer_size, & size ) ; end_offset = offset + ( size * 2 ) ; if ( end_offset < offset ) { end_offset = tvb_reported_length_remaining ( tvb, offset ) + 1 ; } <START_BUG> while ( offset < end_offset ) <END_BUG> offset = dissect_spoolss_uint16uni ( tvb, offset, pinfo, tree, drep, NULL, hf_keybuffer ) ;  return offset ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> while ( offset > 0 && offset <S2SV_ModStart> < end_offset ) { <S2SV_ModStart> hf_keybuffer ) ; }
Buggy code:
 static gint dissect_ac_if_hdr_body ( tvbuff_t * tvb, gint offset, packet_info * pinfo _U_, proto_tree * tree, usb_conv_info_t * usb_conv_info ) { gint offset_start ; guint16 bcdADC ; guint8 ver_major ; double ver ; guint8 if_in_collection, i ; audio_conv_info_t * audio_conv_info ; offset_start = offset ; bcdADC = tvb_get_letohs ( tvb, offset ) ; ver_major = USB_AUDIO_BCD44_TO_DEC ( bcdADC >> 8 ) ; ver = ver_major + USB_AUDIO_BCD44_TO_DEC ( bcdADC & 0xFF ) // 100.0 ; proto_tree_add_double_format_value ( tree, hf_ac_if_hdr_ver, tvb, offset, 2, ver, "%2.2f", ver ) ; audio_conv_info = ( audio_conv_info_t * ) usb_conv_info -> class_data ; if (! audio_conv_info ) { audio_conv_info = wmem_new ( wmem_file_scope ( ), audio_conv_info_t ) ; usb_conv_info -> class_data = audio_conv_info ; <START_BUG> } <END_BUG> audio_conv_info -> ver_major = ver_major ; offset += 2 ; if ( ver_major == 1 ) { proto_tree_add_item ( tree, hf_ac_if_hdr_total_len, tvb, offset, 2, ENC_LITTLE_ENDIAN ) ; offset += 2 ; if_in_collection = tvb_get_guint8 ( tvb, offset ) ; proto_tree_add_item ( tree, hf_ac_if_hdr_bInCollection, tvb, offset, 1, ENC_LITTLE_ENDIAN ) ; offset ++ ; for ( i = 0 ; i < if_in_collection ; i ++ ) { proto_tree_add_item ( tree, hf_ac_if_hdr_if_num, tvb, offset, 1

Fix:
<S2SV_ModStart> = audio_conv_info ; usb_conv_info -> class_data_type = USB_CONV_AUDIO ; } else if ( usb_conv_info -> class_data_type!= USB_CONV_AUDIO ) { return 0 ;
Buggy code:
 int do_adjtimex ( struct timex * txc ) { <START_BUG> long mtemp, save_adjust, rem ; <END_BUG> s64 freq_adj ; int result ; if ( txc -> modes &&! capable ( CAP_SYS_TIME ) ) return - EPERM ; if ( ( txc -> modes & ADJ_OFFSET_SINGLESHOT ) == ADJ_OFFSET_SINGLESHOT ) { if ( txc -> modes!= ADJ_OFFSET_SINGLESHOT && txc -> modes!= ADJ_OFFSET_SS_READ ) return - EINVAL ; } if ( txc -> modes!= ADJ_OFFSET_SINGLESHOT && ( txc -> modes & ADJ_OFFSET ) ) if ( txc -> offset <= - MAXPHASE || txc -> offset >= MAXPHASE ) return - EINVAL ; if ( txc -> modes & ADJ_TICK ) if ( txc -> tick < 900000 // USER_HZ || txc -> tick > 1100000 // USER_HZ ) return - EINVAL ; write_seqlock_irq ( & xtime_lock ) ; result = time_state ; save_adjust = time_adjust ; # if 0 time_status &= ~ STA_CLOCKERR ; # endif if ( txc -> modes ) { if ( txc -> modes & ADJ_STATUS ) time_status = ( txc -> status & ~ STA_RONLY ) | ( time_status & STA_RONLY ) ; if ( txc -> modes & ADJ_FREQUENCY ) { if ( txc -> freq > MAXFREQ || txc -> freq < - MAXFREQ ) { result = - EINVAL ; goto leave ; } time_freq = ( ( s64 ) txc -> freq * NSEC_PER_USEC ) >> ( SHIFT_USEC - SHIFT_NSEC ) ; } if ( txc -> modes & ADJ_MAXERROR ) { if ( txc -> maxerror < 0 || txc -> maxerror >= NTP_PHASE_LIMIT ) { result = - EINVAL ; goto leave ; } time_maxerror = txc -> maxerror ; } if ( txc -> modes & ADJ_ESTERROR ) { if ( txc -> esterror < 0 || txc -> esterror >= NTP_PHASE_LIMIT ) {

Fix:
<S2SV_ModStart> mtemp, save_adjust <S2SV_ModEnd> ; s64 freq_adj <S2SV_ModStart> ; time_offset = div_s64 <S2SV_ModEnd> ( time_offset, <S2SV_ModStart> time_offset, NTP_INTERVAL_FREQ <S2SV_ModEnd> ) ; time_offset
Buggy code:
 static void uv__process_child_init ( const uv_process_options_t * options, int stdio_count, int ( * pipes ) [ 2 ], int error_fd ) { int close_fd ; int use_fd ; int fd ; if ( options -> flags & UV_PROCESS_DETACHED ) setsid ( ) ; for ( fd = 0 ; fd < stdio_count ; fd ++ ) { close_fd = pipes [ fd ] [ 0 ] ; use_fd = pipes [ fd ] [ 1 ] ; if ( use_fd < 0 ) { if ( fd >= 3 ) continue ; else { use_fd = open ( "//dev//null", fd == 0? O_RDONLY : O_RDWR ) ; close_fd = use_fd ; if ( use_fd == - 1 ) { uv__write_int ( error_fd, - errno ) ; perror ( "failed   to   open   stdio" ) ; _exit ( 127 ) ; } } } if ( fd == use_fd ) uv__cloexec ( use_fd, 0 ) ; else dup2 ( use_fd, fd ) ; if ( fd <= 2 ) uv__nonblock ( fd, 0 ) ; if ( close_fd!= - 1 ) uv__close ( close_fd ) ; } for ( fd = 0 ; fd < stdio_count ; fd ++ ) { use_fd = pipes [ fd ] [ 1 ] ; if ( use_fd >= 0 && fd!= use_fd ) close ( use_fd ) ; } if ( options -> cwd!= NULL && chdir ( options -> cwd ) ) { uv__write_int ( error_fd, - errno ) ; perror ( "chdir()" ) ; _exit ( 127 ) ; } <START_BUG> if ( ( options -> flags & UV_PROCESS_SETGID ) && setgid ( options -> gid ) ) { <END_BUG> uv__write_int ( error_fd, - errno ) ; perror ( "setgid()" ) ; _exit ( 127 ) ; } if ( ( options -> flags & UV_PROCESS_SETUID ) && setuid ( options -> uid ) ) { uv__write_int ( error_fd, - errno ) ; perror ( "setuid()" ) ; _exit ( 127 ) ; } if ( options -> env!= NULL ) { environ = options ->

Fix:
<S2SV_ModStart> } if ( options -> flags & ( UV_PROCESS_SETUID | UV_PROCESS_SETGID ) ) { SAVE_ERRNO ( setgroups ( 0, NULL ) ) ; } if (