nus-yam/ex-repair huggingface dataset:
Buggy code:
 static u_int16_t concat_hash_string ( struct ndpi_packet_struct * packet, char * buf, u_int8_t client_hash ) { u_int16_t offset = 22, buf_out_len = 0 ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; u_int32_t len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ; offset += 4 ; if ( ( offset >= packet -> payload_packet_len ) || ( len >= packet -> payload_packet_len - offset - 1 ) ) goto invalid_payload ; strncpy ( buf, ( const char * ) & packet -> payload [ offset ], buf_out_len = len ) ; buf [ buf_out_len ++ ] = ';' ; offset += len ; <START_BUG> len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ; <END_BUG>  offset += 4 + len ; <START_BUG> len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ; if ( client_hash ) { offset += 4 ; if ( ( offset >= packet -> payload_packet_len ) || ( len >= packet -> payload_packet_len - offset - 1 ) ) goto invalid_payload ; strncpy ( & buf [ buf_out_len ], ( const char * ) & packet -> payload [ offset ], len ) ; buf_out_len += len ; buf [ buf_out_len ++ ] = ';' ; offset += len ; } else offset += 4 + len ; <END_BUG> len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ;  if (! client_hash ) { offset += 4 ; if ( ( offset >= packet -> payload_packet_len ) || ( len >= packet -> payload_packet_len - offset - 1 ) ) goto invalid_payload ; strncpy ( & buf [ buf_out_len ], ( const char * ) & packet -> payload [ offset ], len ) ; buf_out_len += len ; buf [ buf_out_len ++ ] = ';' ; offset += len ; } else offset += 4 + len ; <START_BUG> len = nto<END_BUG>

Fix:
<S2SV_ModStart> += len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; <S2SV_ModStart> 4 + len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload <S2SV_ModStart> + len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; <S2SV_ModStart> + len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; <S2SV_ModStart> + len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; <S2SV_ModStart> 4 + len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload
Buggy code:
 <START_BUG> static int scsi_disk_emulate_command ( SCSIDiskReq * r, uint8_t * outbuf ) <END_BUG> { SCSIRequest * req = & r -> req ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, req -> dev ) ; uint64_t nb_sectors ; int buflen = 0 ; switch ( req -> cmd. buf [ 0 ] ) { case TEST_UNIT_READY : if ( s -> tray_open ||! bdrv_is_inserted ( s -> bs ) ) goto not_ready ; break ; case INQUIRY : buflen = scsi_disk_emulate_inquiry ( req, outbuf ) ; if ( buflen < 0 ) goto illegal_request ; break ; case MODE_SENSE : case MODE_SENSE_10 : buflen = scsi_disk_emulate_mode_sense ( r, outbuf ) ; if ( buflen < 0 ) goto illegal_request ; break ; case READ_TOC : buflen = scsi_disk_emulate_read_toc ( req, outbuf ) ; if ( buflen < 0 ) goto illegal_request ; break ; case RESERVE : if ( req -> cmd. buf [ 1 ] & 1 ) goto illegal_request ; break ; case RESERVE_10 : if ( req -> cmd. buf [ 1 ] & 3 ) goto illegal_request ; break ; case RELEASE : if ( req -> cmd. buf [ 1 ] & 1 ) goto illegal_request ; break ; case RELEASE_10 : if ( req -> cmd. buf [ 1 ] & 3 ) goto illegal_request ; break ; case START_STOP : if ( scsi_disk_emulate_start_stop ( r ) < 0 ) { return - 1 ; } break ; case ALLOW_MEDIUM_REMOVAL : s -> tray_locked = req -> cmd. buf [ 4 ] & 1 ; bdrv_lock_medium ( s -> bs, req -> cmd. buf [ 4 ] & 1 ) ; break ; case READ_CAPACITY_10 : memset ( outbuf, 0, 8 ) ; bdrv_get_geometry ( s -> bs, & nb_sectors ) ; if (! nb_sectors ) goto not_ready ;

Fix:
<S2SV_ModStart> SCSIDiskReq * r ) { SCSIRequest * req = & r -> req ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, req -> dev ) ; uint64_t nb_sectors ; <S2SV_ModEnd> uint8_t * outbuf <S2SV_ModStart> uint8_t * outbuf ; int buflen = 0 ; if (! r -> iov. iov_base ) { if ( req -> cmd. xfer > 65536 ) { goto illegal_request ; } r -> buflen = MAX ( 4096, req -> cmd. xfer ) ; r -> iov. iov_base = qemu_blockalign ( s -> bs, r -> buflen ) ; } outbuf = r -> iov. iov_base <S2SV_ModEnd> ; switch (
Buggy code:
 static int load_segment_descriptor ( struct x86_emulate_ctxt * ctxt, u16 selector, int seg ) { u8 cpl = ctxt -> ops -> cpl ( ctxt ) ; <START_BUG> return __load_segment_descriptor ( ctxt, selector, seg, cpl, false ) ; <END_BUG> }

Fix:
<S2SV_ModStart> cpl, false, NULL
Buggy code:
 int drm_mode_dirtyfb_ioctl ( struct drm_device * dev, void * data, struct drm_file * file_priv ) { struct drm_clip_rect __user * clips_ptr ; struct drm_clip_rect * clips = NULL ; struct drm_mode_fb_dirty_cmd * r = data ; struct drm_mode_object * obj ; struct drm_framebuffer * fb ; unsigned flags ; int num_clips ; int ret = 0 ; if (! drm_core_check_feature ( dev, DRIVER_MODESET ) ) return - EINVAL ; mutex_lock ( & dev -> mode_config. mutex ) ; obj = drm_mode_object_find ( dev, r -> fb_id, DRM_MODE_OBJECT_FB ) ; if (! obj ) { DRM_ERROR ( "invalid   framebuffer   id\\n" ) ; ret = - EINVAL ; goto out_err1 ; } fb = obj_to_fb ( obj ) ; num_clips = r -> num_clips ; clips_ptr = ( struct drm_clip_rect * ) ( unsigned long ) r -> clips_ptr ; if (! num_clips!=! clips_ptr ) { ret = - EINVAL ; goto out_err1 ; } flags = DRM_MODE_FB_DIRTY_FLAGS & r -> flags ; if ( flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && ( num_clips % 2 ) ) { ret = - EINVAL ; goto out_err1 ; } if ( num_clips && clips_ptr ) { <START_BUG> clips = kzalloc ( num_clips * sizeof ( * clips ), GFP_KERNEL ) ; <END_BUG> if (! clips ) { ret = - ENOMEM ; goto out_err1 ; } ret = copy_from_user ( clips, clips_ptr, num_clips * sizeof ( * clips ) ) ; if ( ret ) { ret = - EFAULT ; goto out_err2 ; } } if ( fb -> funcs -> dirty ) { ret = fb -> funcs -> dirty ( fb, file_priv, flags, r -> color, clips, num_clips ) ;

Fix:
<S2SV_ModStart> clips_ptr ) { if ( num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS ) { ret = - EINVAL ; goto out_err1 ; }
Buggy code:
 static int ccid3_hc_tx_getsockopt ( struct sock * sk, const int optname, int len, u32 __user * optval, int __user * optlen ) { const struct ccid3_hc_tx_sock * hc = ccid3_hc_tx_sk ( sk ) ; struct tfrc_tx_info tfrc ; const void * val ; switch ( optname ) { case DCCP_SOCKOPT_CCID_TX_INFO : if ( len < sizeof ( tfrc ) ) return - EINVAL ; <START_BUG> tfrc. tfrctx_x = hc -> tx_x ; <END_BUG> tfrc. tfrctx_x_recv = hc -> tx_x_recv ; tfrc. tfrctx_x_calc = hc -> tx_x_calc ; tfrc. tfrctx_rtt = hc -> tx_rtt ; tfrc. tfrctx_p = hc -> tx_p ; tfrc. tfrctx_rto = hc -> tx_t_rto ; tfrc. tfrctx_ipi = hc -> tx_t_ipi ; len = sizeof ( tfrc ) ; val = & tfrc ; break ; default : return - ENOPROTOOPT ; } if ( put_user ( len, optlen ) || copy_to_user ( optval, val, len ) ) return - EFAULT ; return 0 ; }

Fix:
<S2SV_ModStart> - EINVAL ; memset ( & tfrc, 0, sizeof ( tfrc ) ) ;
Buggy code:
 error_t dm9000ReceivePacket ( NetInterface * interface ) { error_t error ; size_t i ; size_t n ; size_t length ; volatile uint8_t status ; volatile uint16_t data ; Dm9000Context * context ; context = ( Dm9000Context * ) interface -> nicContext ; <START_BUG> data = dm9000ReadReg ( DM9000_REG_MRCMDX ) ; <END_BUG>  DM9000_INDEX_REG = DM9000_REG_MRCMDX1 ; <START_BUG> status = LSB ( DM9000_DATA_REG ) ; if ( status == 0x01 ) { <END_BUG> DM9000_INDEX_REG = DM9000_REG_MRCMD ;  status = MSB ( DM9000_DATA_REG ) ; length = DM9000_DATA_REG ; n = MIN ( length, ETH_MAX_FRAME_SIZE ) ; i = 0 ; <START_BUG> if ( ( status & ( RSR_LCS | RSR_RWTO | RSR_PLE | RSR_AE | RSR_CE | RSR_FOE ) ) == 0 ) <END_BUG> { while ( ( i + 1 ) < n ) { data = DM9000_DATA_REG ; context -> rxBuffer [ i ++ ] = LSB ( data ) ; context -> rxBuffer [ i ++ ] = MSB ( data ) ; } if ( ( i + 1 ) == n ) { data = DM9000_DATA_REG ; context -> rxBuffer [ i ] = LSB ( data ) ; i += 2 ; } error = NO_ERROR ; } else { error = ERROR_INVALID_PACKET ; } while ( i < length ) { data = DM9000_DATA_REG ; i += 2 ; } } else { error = ERROR_BUFFER_EMPTY ; } if (! error ) { NetRxAncillary ancillary ; ancillary = NET_DEFAULT_RX_ANCILLARY ; nicProcessPacket ( interface, context -> rxBuffer, n, & ancillary ) ; } return error ; }

Fix:
<S2SV_ModStart> = dm9000ReadReg ( DM9000_MRCMDX <S2SV_ModEnd> ) ; DM9000_INDEX_REG <S2SV_ModStart> ; DM9000_INDEX_REG = DM9000_MRCMDX1 <S2SV_ModEnd> ; status = <S2SV_ModStart> { DM9000_INDEX_REG = DM9000_MRCMD <S2SV_ModEnd> ; status = <S2SV_ModStart> status & ( DM9000_RSR_LCS | DM9000_RSR_RWTO | DM9000_RSR_PLE | DM9000_RSR_AE | DM9000_RSR_CE | DM9000_RSR_FOE <S2SV_ModEnd> ) ) ==
Buggy code:
 static void http_splitheader ( struct http * hp, int req ) { char * p, * q, * * hh ; int n ; char buf [ 20 ] ; CHECK_OBJ_NOTNULL ( hp, HTTP_MAGIC ) ; if ( req ) { memset ( hp -> req, 0, sizeof hp -> req ) ; hh = hp -> req ; } else { memset ( hp -> resp, 0, sizeof hp -> resp ) ; hh = hp -> resp ; } n = 0 ; p = hp -> rxbuf ; while ( vct_islws ( * p ) ) p ++ ; hh [ n ++ ] = p ; while (! vct_islws ( * p ) ) p ++ ; <START_BUG> assert (! vct_iscrlf ( * p ) ) ; <END_BUG> * p ++ = '\\0' ; while ( vct_issp ( * p ) ) p ++ ;  assert (! vct_iscrlf ( * p ) ) ; <START_BUG> hh [ n ++ ] = p ; while (! vct_islws ( * p ) ) p ++ ; <END_BUG> if ( vct_iscrlf ( * p ) ) {  hh [ n ++ ] = NULL ; q = p ; p += vct_skipcrlf ( p ) ; * q = '\\0' ; } else { * p ++ = '\\0' ; while ( vct_issp ( * p ) ) p ++ ; hh [ n ++ ] = p ; <START_BUG> while (! vct_iscrlf ( * p ) ) <END_BUG> p ++ ; q = p ; p += vct_skipcrlf ( p ) ; * q = '\\0' ; } assert ( n == 3 ) ; while ( * p!= '\\0' ) { assert ( n < MAX_HDR ) ;  if ( vct_iscrlf ( * p ) ) <START_BUG> break ; hh [ n ++ ] = p ++ ; <END_BUG> while ( * p!= '\\0' &&! vct_iscrlf ( * p ) )  p ++ ; q = p ; p += vct_skipcrlf ( p ) ; * q = '\\0' ; } p += vct_skipcrlf ( p ) ; assert ( * p == '\\0' ) ; for ( n = 0 ; n < 3 || hh [ n

Fix:
<S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> p ) ) <S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> p ) ) <S2SV_ModStart> ( vct_iscrlf ( <S2SV_ModEnd> p ) ) <S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> p ) ) <S2SV_ModStart> ( vct_iscrlf ( <S2SV_ModEnd> p ) ) <S2SV_ModStart>! vct_iscrlf ( <S2SV_ModEnd> p ) )
Buggy code:
 int mobility_print ( netdissect_options * ndo, const u_char * bp, const u_char * bp2 _U_ ) { const struct ip6_mobility * mh ; const u_char * ep ; unsigned mhlen, hlen ; uint8_t type ; mh = ( const struct ip6_mobility * ) bp ; ep = ndo -> ndo_snapend ; if (! ND_TTEST ( mh -> ip6m_len ) ) { mhlen = ep - bp ; goto trunc ; } mhlen = ( mh -> ip6m_len + 1 ) << 3 ; ND_TCHECK ( mh -> ip6m_type ) ; type = mh -> ip6m_type ; if ( type <= IP6M_MAX && mhlen < ip6m_hdrlen [ type ] ) { ND_PRINT ( ( ndo, "(header   length   %u   is   too   small   for   type   %u)", mhlen, type ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "mobility:   %s", tok2str ( ip6m_str, "type-#%u", type ) ) ) ; switch ( type ) { case IP6M_BINDING_REQUEST : hlen = IP6M_MINLEN ; break ; case IP6M_HOME_TEST_INIT : case IP6M_CAREOF_TEST_INIT : hlen = IP6M_MINLEN ; if ( ndo -> ndo_vflag ) { ND_TCHECK2 ( * mh, hlen + 8 ) ; ND_PRINT ( ( ndo, "   %s   Init   Cookie=%08x:%08x", type == IP6M_HOME_TEST_INIT? "Home" : "Care-of", EXTRACT_32BITS ( & bp [ hlen ] ), EXTRACT_32BITS ( & bp [ hlen + 4 ] ) ) ) ; } hlen += 8 ; break ; case IP6M_HOME_TEST : case IP6M_CAREOF_TEST : ND_TCHECK ( mh -> ip6m_data16 [ 0 ] ) ; ND_PRINT ( ( ndo, "   nonce   id=0x%

Fix:
<S2SV_ModStart> ; return ( - 1 <S2SV_ModEnd> ) ; }
Buggy code:
 static HB_Bool myanmar_shape_syllable ( HB_Bool openType, HB_ShaperItem * item, HB_Bool invalid ) { # ifndef NO_OPENTYPE const int availableGlyphs = item -> num_glyphs ; # endif const HB_UChar16 * uc = item -> string + item -> item. pos ; int vowel_e = - 1 ; int kinzi = - 1 ; int medial_ra = - 1 ; int base = - 1 ; int i ; int len = 0 ; unsigned short reordered [ 32 ] ; unsigned char properties [ 32 ] ; enum { AboveForm = 0x01, PreForm = 0x02, PostForm = 0x04, BelowForm = 0x08 } ; HB_Bool lastWasVirama = FALSE ; int basePos = - 1 ; memset ( properties, 0, 32 * sizeof ( unsigned char ) ) ; assert ( item -> item. length < 32 ) ; # ifdef MYANMAR_DEBUG printf ( "original:" ) ; for ( i = 0 ; i < ( int ) item -> item. length ; i ++ ) { printf ( "         %d:   %4x", i, uc [ i ] ) ; } # endif for ( i = 0 ; i < ( int ) item -> item. length ; ++ i ) { HB_UChar16 chr = uc [ i ] ; if ( chr == Mymr_C_VOWEL_E ) { vowel_e = i ; continue ; } if ( i == 0 && chr == Mymr_C_NGA && i + 2 < ( int ) item -> item. length && uc [ i + 1 ] == Mymr_C_VIRAMA ) { int mc = getMyanmarCharClass ( uc [ i + 2 ] ) ; if ( ( mc & Mymr_CF_CONSONANT ) == Mymr_CF_CONSONANT ) { kinzi = i ; continue ; } } if ( base >= 0 && chr == Mymr_C_VIRAMA && i + 1 < ( int ) item -> item. length && uc [ i + 1 ] == Mymr_C_RA ) { medial_ra = i ; continue ; } if ( base < 0 )

Fix:
<S2SV_ModStart> = Mymr_C_VIRAMA ; if ( len > 0 )
Buggy code:
 void lmp_print ( netdissect_options * ndo, register const u_char * pptr, register u_int len ) { const struct lmp_common_header * lmp_com_header ; const struct lmp_object_header * lmp_obj_header ; const u_char * tptr, * obj_tptr ; u_int tlen, lmp_obj_len, lmp_obj_ctype, obj_tlen ; int hexdump, ret ; u_int offset ; u_int link_type ; union { float f ; uint32_t i ; } bw ; tptr = pptr ; lmp_com_header = ( const struct lmp_common_header * ) pptr ; ND_TCHECK ( * lmp_com_header ) ; if ( LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] )!= LMP_VERSION ) { ND_PRINT ( ( ndo, "LMP   version   %u   packet   not   supported", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ) ) ) ; return ; } if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "LMPv%u   %s   Message,   length:   %u", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ), tok2str ( lmp_msg_type_values, "unknown   (%u)", lmp_com_header -> msg_type ), len ) ) ; return ; } tlen = EXTRACT_16BITS ( lmp_com_header -> length ) ; ND_PRINT ( ( ndo, "\\n\\tLMPv%u,   msg-type:   %s,   Flags:   [%s],   length:   %u", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ), tok2str ( lmp_msg_type_values, "unknown,   type:   %u", lmp_com_header -> msg_type ), bittok2str ( lmp_header_flag_values, "none", lmp_

Fix:
<S2SV_ModStart> ( ndo, "%s", tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 int vpx_img_set_rect ( vpx_image_t * img, unsigned int x, unsigned int y, unsigned int w, unsigned int h ) { unsigned char * data ; if ( x + w <= img -> w && y + h <= img -> h ) { img -> d_w = w ; img -> d_h = h ; if (! ( img -> fmt & VPX_IMG_FMT_PLANAR ) ) { img -> planes [ VPX_PLANE_PACKED ] = img -> img_data + x * img -> bps // 8 + y * img -> stride [ VPX_PLANE_PACKED ] ; } else { <START_BUG> data = img -> img_data ; <END_BUG> if ( img -> fmt & VPX_IMG_FMT_HAS_ALPHA ) { img -> planes [ VPX_PLANE_ALPHA ] =  data + x + y * img -> stride [ VPX_PLANE_ALPHA ] ; <START_BUG> data += img -> h * img -> stride [ VPX_PLANE_ALPHA ] ; } <END_BUG> img -> planes [ VPX_PLANE_Y ] = data + x + y * img -> stride [ VPX_PLANE_Y ] ;  data += img -> h * img -> stride [ VPX_PLANE_Y ] ; if (! ( img -> fmt & VPX_IMG_FMT_UV_FLIP ) ) { <START_BUG> img -> planes [ VPX_PLANE_U ] = data <END_BUG> + ( x >> img -> x_chroma_shift )  + ( y >> img -> y_chroma_shift ) * img -> stride [ VPX_PLANE_U ] ; <START_BUG> data += ( img -> h >> img -> y_chroma_shift ) * img -> stride [ VPX_PLANE_U ] ; <END_BUG> img -> planes [ VPX_PLANE_V ] = data  + ( x >> img -> x_chroma_shift ) <START_BUG> + ( y >> img -> y_chroma_shift ) * img -> stride [ VPX_PLANE_V ] ; <END_BUG> } else {  img -> planes [ VPX_PLANE_V ] = data <START_BUG> +<END_BUG>

Fix:
<S2SV_ModStart> } else { const int bytes_per_sample = ( img -> fmt & VPX_IMG_FMT_HIGHBITDEPTH )? 2 : 1 ; <S2SV_ModStart> data + x * bytes_per_sample <S2SV_ModStart> data + x * bytes_per_sample + <S2SV_ModEnd> y * img <S2SV_ModStart> VPX_PLANE_U ] = data <S2SV_ModEnd> + ( x <S2SV_ModStart> -> x_chroma_shift ) * bytes_per_sample + <S2SV_ModEnd> ( y >> <S2SV_ModStart> VPX_PLANE_V ] = data <S2SV_ModEnd> + ( x <S2SV_ModStart> -> x_chroma_shift ) * bytes_per_sample + <S2SV_ModEnd> ( y >> <S2SV_ModStart> VPX_PLANE_V ] = data <S2SV_ModEnd> + ( x <S2SV_ModStart> -> x_chroma_shift ) * bytes_per_sample + <S2SV_ModEnd> ( y >> <S2SV_ModStart> VPX_PLANE_U ] = data <S2SV_ModEnd> + ( x <S2SV_ModStart> -> x_chroma_shift ) * bytes_per_sample + <S2SV_ModEnd> ( y >>
Buggy code:
 static int crypto_report ( struct sk_buff * in_skb, struct nlmsghdr * in_nlh, struct nlattr * * attrs ) { struct net * net = sock_net ( in_skb -> sk ) ; struct crypto_user_alg * p = nlmsg_data ( in_nlh ) ; struct crypto_alg * alg ; struct sk_buff * skb ; struct crypto_dump_info info ; int err ; if (! null_terminated ( p -> cru_name ) ||! null_terminated ( p -> cru_driver_name ) ) return - EINVAL ; alg = crypto_alg_match ( p, 0 ) ; if (! alg ) return - ENOENT ; err = - ENOMEM ; skb = nlmsg_new ( NLMSG_DEFAULT_SIZE, GFP_KERNEL ) ; if (! skb ) goto drop_alg ; info. in_skb = in_skb ; info. out_skb = skb ; info. nlmsg_seq = in_nlh -> nlmsg_seq ; info. nlmsg_flags = 0 ; err = crypto_report_alg ( alg, & info ) ; drop_alg : crypto_mod_put ( alg ) ; if ( err ) <START_BUG> return err ; <END_BUG> return nlmsg_unicast ( net -> crypto_nlsk, skb, NETLINK_CB ( in_skb ). portid ) ; }

Fix:
<S2SV_ModStart> ( err ) { kfree_skb ( skb ) ; return err ; } <S2SV_ModEnd> return nlmsg_unicast (
Buggy code:
 int vcc_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct atm_vcc * vcc ; struct sk_buff * skb ; <START_BUG> int copied, error = - EINVAL ; <END_BUG> msg -> msg_namelen = 0 ; if ( sock -> state!= SS_CONNECTED ) return - ENOTCONN ; if ( flags & ~ ( MSG_DONTWAIT | MSG_PEEK ) ) return - EOPNOTSUPP ; vcc = ATM_SD ( sock ) ; if ( test_bit ( ATM_VF_RELEASED, & vcc -> flags ) || test_bit ( ATM_VF_CLOSE, & vcc -> flags ) ||! test_bit ( ATM_VF_READY, & vcc -> flags ) ) return 0 ; skb = skb_recv_datagram ( sk, flags, flags & MSG_DONTWAIT, & error ) ; if (! skb ) return error ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } error = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( error ) return error ; sock_recv_ts_and_drops ( msg, sk, skb ) ; if (! ( flags & MSG_PEEK ) ) { pr_debug ( "%d   -=   %d\\n", atomic_read ( & sk -> sk_rmem_alloc ), skb -> truesize ) ; atm_return ( vcc, skb -> truesize ) ; } skb_free_datagram ( sk, skb ) ; return copied ; }

Fix:
<S2SV_ModStart> = - EINVAL <S2SV_ModEnd> ; if (
Buggy code:
 int ping_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * isk = inet_sk ( sk ) ; int family = sk -> sk_family ; struct sk_buff * skb ; int copied, err ; pr_debug ( "ping_recvmsg(sk=%p,sk->num=%u)\\n", isk, isk -> inet_num ) ; err = - EOPNOTSUPP ; if ( flags & MSG_OOB ) goto out ; if ( flags & MSG_ERRQUEUE ) { if ( family == AF_INET ) { return ip_recv_error ( sk, msg, len ) ; # if IS_ENABLED ( CONFIG_IPV6 ) } else if ( family == AF_INET6 ) { return pingv6_ops. ipv6_recv_error ( sk, msg, len ) ; # endif } } skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( copied > len ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto done ; sock_recv_timestamp ( msg, sk, skb ) ; if ( family == AF_INET ) { struct sockaddr_in * sin = ( struct sockaddr_in * ) msg -> msg_name ; <START_BUG> sin -> sin_family = AF_INET ; <END_BUG> sin -> sin_port = 0 ; sin -> sin_addr. s_addr = ip_hdr ( skb ) -> saddr ; memset ( sin -> sin_zero, 0, sizeof ( sin -> sin_zero ) ) ; * addr_len = sizeof ( * sin ) ;  if ( isk -> cmsg_flags ) <START_BUG> ip_cmsg_recv ( msg, skb ) ; # if IS_ENABLED ( CONFIG_IPV6 ) } else if ( family == AF_INET6 ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct ipv6hdr * ip<END_BUG>

Fix:
<S2SV_ModStart> -> msg_name ; if ( sin ) { <S2SV_ModStart> sin ) ; } <S2SV_ModStart> -> msg_name ; if ( sin6 ) { <S2SV_ModStart> sin6 ) ; }
Buggy code:
 void pci_lintr_deassert ( struct pci_vdev * dev ) { <START_BUG> assert ( dev -> lintr. pin > 0 ) ; <END_BUG> pthread_mutex_lock ( & dev -> lintr. lock ) ; if ( dev -> lintr. state == ASSERTED ) { dev -> lintr. state = IDLE ; pci_irq_deassert ( dev ) ; } else if ( dev -> lintr. state == PENDING ) dev -> lintr. state = IDLE ; pthread_mutex_unlock ( & dev -> lintr. lock ) ; }

Fix:
<S2SV_ModStart> dev ) { if <S2SV_ModEnd> ( dev -> <S2SV_ModStart> lintr. pin <= 0 ) { pr_warn ( "%s: <S2SV_blank> Invalid <S2SV_blank> intr <S2SV_blank> pin <S2SV_blank> on <S2SV_blank> dev <S2SV_blank> [%s]\\n", __func__, dev -> name ) ; return ; } <S2SV_ModEnd> pthread_mutex_lock ( &
Buggy code:
 SYSCALL_DEFINE4 ( osf_wait4, pid_t, pid, int __user *, ustatus, int, options, struct rusage32 __user *, ur ) { struct rusage r ; long ret, err ; <START_BUG> mm_segment_t old_fs ; <END_BUG> if (! ur ) return sys_wait4 ( pid, ustatus, options, NULL ) ; old_fs = get_fs ( ) ; set_fs ( KERNEL_DS ) ;  ret = sys_wait4 ( pid, ustatus, options, ( struct rusage __user * ) & r ) ; <START_BUG> set_fs ( old_fs ) ; if (! access_ok ( VERIFY_WRITE, ur, sizeof ( * ur ) ) ) return - EFAULT ; err = 0 ; <END_BUG> err |= __put_user ( r. ru_utime. tv_sec, & ur -> ru_utime. tv_sec ) ;  err |= __put_user ( r. ru_utime. tv_usec, & ur -> ru_utime. tv_usec ) ; err |= __put_user ( r. ru_stime. tv_sec, & ur -> ru_stime. tv_sec ) ; err |= __put_user ( r. ru_stime. tv_usec, & ur -> ru_stime. tv_usec ) ; err |= __put_user ( r. ru_maxrss, & ur -> ru_maxrss ) ; err |= __put_user ( r. ru_ixrss, & ur -> ru_ixrss ) ; err |= __put_user ( r. ru_idrss, & ur -> ru_idrss ) ; err |= __put_user ( r. ru_isrss, & ur -> ru_isrss ) ; err |= __put_user ( r. ru_minflt, & ur -> ru_minflt ) ; err |= __put_user ( r. ru_majflt, & ur -> ru_majflt ) ; err |= __put_user ( r. ru_nswap, & ur -> ru_nswap ) ; err |= __put_user ( r. ru_inblock, & ur -> ru_inblock ) ; err |= __put_user ( r. ru_oublock, &

Fix:
<S2SV_ModStart>, err ; unsigned int status = 0 ; <S2SV_ModStart> ( pid, ( unsigned int __user * ) & status <S2SV_ModEnd>, options, <S2SV_ModStart> ; err |= put_user ( status, ustatus ) ; err |=
Buggy code:
 struct json_object * json_tokener_parse_ex ( struct json_tokener * tok, const char * str, int len ) { struct json_object * obj = NULL ; char c = '\\1' ; # ifdef HAVE_SETLOCALE char * oldlocale = NULL, * tmplocale ; tmplocale = setlocale ( LC_NUMERIC, NULL ) ; if ( tmplocale ) oldlocale = strdup ( tmplocale ) ; setlocale ( LC_NUMERIC, "C" ) ; # endif tok -> char_offset = 0 ; <START_BUG> tok -> err = json_tokener_success ; <END_BUG> while ( PEEK_CHAR ( c, tok ) ) { redo_char : switch ( state ) { case json_tokener_state_eatws : while ( isspace ( ( int ) c ) ) { if ( (! ADVANCE_CHAR ( str, tok ) ) || (! PEEK_CHAR ( c, tok ) ) ) goto out ; } if ( c == '//' &&! ( tok -> flags & JSON_TOKENER_STRICT ) ) { printbuf_reset ( tok -> pb ) ; printbuf_memappend_fast ( tok -> pb, & c, 1 ) ; state = json_tokener_state_comment_start ; } else { state = saved_state ; goto redo_char ; } break ; case json_tokener_state_start : switch ( c ) { case '{' : state = json_tokener_state_eatws ; saved_state = json_tokener_state_object_field_start ; current = json_object_new_object ( ) ; break ; case '[' : state = json_tokener_state_eatws ; saved_state = json_tokener_state_array ; current = json_object_new_array ( ) ; break ; case 'I' : case 'i' : state = json_tokener_state_inf ; printbuf_reset ( tok -> pb ) ; tok -> st_pos = 0 ; goto redo_char ; case 'N' : case 'n' : state = json_tokener_state_null ; printbuf_reset ( tok -> pb ) ; tok -> st_pos = 0 ; goto redo_char ; case '\\'' : if ( tok -> flags & JSON_TOKENER_STRICT ) { tok -> err = json_tok

Fix:
<S2SV_ModStart> = json_tokener_success ; if ( ( len < - 1 ) || ( len == - 1 && strlen ( str ) > INT32_MAX ) ) { tok -> err = json_tokener_error_size ; return NULL ; }
Buggy code:
 void comps_mrtree_unite ( COMPS_MRTree * rt1, COMPS_MRTree * rt2 ) { COMPS_HSList * tmplist, * tmp_subnodes ; COMPS_HSListItem * it, * it2 ; struct Pair { COMPS_HSList * subnodes ; char * key ; <START_BUG> char added ; <END_BUG> } * pair, * parent_pair ; pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = rt2 -> subnodes ; pair -> key = NULL ; tmplist = comps_hslist_create ( ) ; comps_hslist_init ( tmplist, NULL, NULL, & free ) ; comps_hslist_append ( tmplist, pair, 0 ) ; while ( tmplist -> first!= NULL ) { it = tmplist -> first ; comps_hslist_remove ( tmplist, tmplist -> first ) ; tmp_subnodes = ( ( struct Pair * ) it -> data ) -> subnodes ; parent_pair = ( struct Pair * ) it -> data ; free ( it ) ;  pair -> added = 0 ; <START_BUG> for ( it = tmp_subnodes -> first ; it!= NULL ; it = it -> next ) { pair = malloc ( sizeof ( struct Pair ) ) ; pair -> subnodes = ( ( COMPS_MRTreeData * ) it -> data ) -> subnodes ; if ( parent_pair -> key!= NULL ) { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_MRTreeData * ) it -> data ) -> key ) + strlen ( parent_pair -> key ) + 1 ) ) ; memcpy ( pair -> key, parent_pair -> key, sizeof ( char ) * strlen ( parent_pair -> key ) ) ; memcpy ( pair -> key + strlen ( parent_pair -> key ), ( ( COMPS_MRTreeData * ) it -> data ) -> key, sizeof ( char ) * ( strlen ( ( ( COMPS_MRTreeData * ) it -> data ) -> key ) + 1 ) ) ; } else { pair -> key = malloc ( sizeof ( char ) * ( strlen ( ( ( COMPS_MRTreeData * ) it -> data ) -> key ) + 1 ) ) ; memcpy ( pair -> key, ( ( COMPS_MRTreeData * ) it -> data<END_BUG>

Fix:
<S2SV_ModStart> * key ; <S2SV_ModEnd> } * pair <S2SV_ModStart> it ) ; <S2SV_ModEnd> for ( it
Buggy code:
 static cmsPipeline * DefaultICCintents ( cmsContext ContextID, cmsUInt32Number nProfiles, cmsUInt32Number TheIntents [ ], cmsHPROFILE hProfiles [ ], cmsBool BPC [ ], cmsFloat64Number AdaptationStates [ ], cmsUInt32Number dwFlags ) { cmsPipeline * Lut = NULL ; cmsPipeline * Result ; cmsHPROFILE hProfile ; cmsMAT3 m ; cmsVEC3 off ; cmsColorSpaceSignature ColorSpaceIn, ColorSpaceOut, CurrentColorSpace ; cmsProfileClassSignature ClassSig ; cmsUInt32Number i, Intent ; if ( nProfiles == 0 ) return NULL ; Result = cmsPipelineAlloc ( ContextID, 0, 0 ) ; if ( Result == NULL ) return NULL ; CurrentColorSpace = cmsGetColorSpace ( hProfiles [ 0 ] ) ; for ( i = 0 ; i < nProfiles ; i ++ ) { cmsBool lIsDeviceLink, lIsInput ; hProfile = hProfiles [ i ] ; ClassSig = cmsGetDeviceClass ( hProfile ) ; lIsDeviceLink = ( ClassSig == cmsSigLinkClass || ClassSig == cmsSigAbstractClass ) ; if ( ( i == 0 ) &&! lIsDeviceLink ) { lIsInput = TRUE ; } else { lIsInput = ( CurrentColorSpace!= cmsSigXYZData ) && ( CurrentColorSpace!= cmsSigLabData ) ; } Intent = TheIntents [ i ] ; if ( lIsInput || lIsDeviceLink ) { ColorSpaceIn = cmsGetColorSpace ( hProfile ) ; ColorSpaceOut = cmsGetPCS ( hProfile ) ; } else { ColorSpaceIn = cmsGetPCS ( hProfile ) ; ColorSpaceOut = cmsGetColorSpace ( hProfile ) ; } if (! ColorSpaceIsCompatible ( ColorSpaceIn, CurrentColorSpace ) ) { cmsSignalError ( ContextID, cmsERROR_COLORSPACE_CHECK, "ColorSpace   mismatch" ) ; goto Error ; } if ( lIsDeviceLink || ( ( ClassSig == cmsSigNamedColorClass ) && ( nProfiles == 1 ) ) ) { Lut = _cmsReadDevicelinkLUT ( hProfile, Intent ) ; if ( Lut == NULL ) goto Error ; if ( ClassSig == cmsSigAbstractClass && i > 0 ) { if (! ComputeConversion ( i, hProfiles, Intent, B

Fix:
<S2SV_ModStart> Lut ) ; Lut = NULL ; <S2SV_ModStart> ; Error : if ( Lut!= NULL )
Buggy code:
 int SMB2_write ( const unsigned int xid, struct cifs_io_parms * io_parms, unsigned int * nbytes, struct kvec * iov, int n_vec ) { struct smb_rqst rqst ; int rc = 0 ; struct smb2_write_req * req = NULL ; struct smb2_write_rsp * rsp = NULL ; int resp_buftype ; struct kvec rsp_iov ; int flags = 0 ; unsigned int total_len ; * nbytes = 0 ; if ( n_vec < 1 ) return rc ; rc = smb2_plain_req_init ( SMB2_WRITE, io_parms -> tcon, ( void * * ) & req, & total_len ) ; if ( rc ) return rc ; if ( io_parms -> tcon -> ses -> server == NULL ) return - ECONNABORTED ; if ( smb3_encryption_required ( io_parms -> tcon ) ) flags |= CIFS_TRANSFORM_REQ ; req -> sync_hdr. ProcessId = cpu_to_le32 ( io_parms -> pid ) ; req -> PersistentFileId = io_parms -> persistent_fid ; req -> VolatileFileId = io_parms -> volatile_fid ; req -> WriteChannelInfoOffset = 0 ; req -> WriteChannelInfoLength = 0 ; req -> Channel = 0 ; req -> Length = cpu_to_le32 ( io_parms -> length ) ; req -> Offset = cpu_to_le64 ( io_parms -> offset ) ; req -> DataOffset = cpu_to_le16 ( offsetof ( struct smb2_write_req, Buffer ) ) ; req -> RemainingBytes = 0 ; trace_smb3_write_enter ( xid, io_parms -> persistent_fid, io_parms -> tcon -> tid, io_parms -> tcon -> ses -> Suid, io_parms -> offset, io_parms -> length ) ; iov [ 0 ]. iov_base = ( char * ) req ; iov [ 0 ]. iov_len = total_len - 1 ; memset ( & rqst, 0, sizeof ( struct smb_rqst ) ) ; rqst. rq_iov = iov ; rqst. rq_nvec = n_vec + 1 ; rc = cifs

Fix:
<S2SV_ModStart> rsp_iov ) ; <S2SV_ModEnd> rsp = ( <S2SV_ModStart> ) ; } cifs_small_buf_release ( req ) ;
Buggy code:
 static MagickBooleanType Get8BIMProperty ( const Image * image, const char * key, ExceptionInfo * exception ) { char * attribute, format [ MagickPathExtent ], name [ MagickPathExtent ], * resource ; const StringInfo * profile ; const unsigned char * info ; long start, stop ; MagickBooleanType status ; register ssize_t i ; size_t length ; ssize_t count, id, sub_number ; profile = GetImageProfile ( image, "8bim" ) ; if ( profile == ( StringInfo * ) NULL ) return ( MagickFalse ) ; count = ( ssize_t ) sscanf ( key, "8BIM:%ld,%ld:%1024[^\\n]\\n%1024[^\\n]", & start, & stop, name, format ) ; if ( ( count!= 2 ) && ( count!= 3 ) && ( count!= 4 ) ) return ( MagickFalse ) ; if ( count < 4 ) ( void ) CopyMagickString ( format, "SVG", MagickPathExtent ) ; if ( count < 3 ) * name = '\\0' ; sub_number = 1 ; if ( * name == '#' ) sub_number = ( ssize_t ) StringToLong ( & name [ 1 ] ) ; sub_number = MagickMax ( sub_number, 1L ) ; resource = ( char * ) NULL ; status = MagickFalse ; length = GetStringInfoLength ( profile ) ; info = GetStringInfoDatum ( profile ) ; while ( ( length > 0 ) && ( status == MagickFalse ) ) { if ( ReadPropertyByte ( & info, & length )!= ( unsigned char ) '8' ) continue ; if ( ReadPropertyByte ( & info, & length )!= ( unsigned char ) 'B' ) continue ; if ( ReadPropertyByte ( & info, & length )!= ( unsigned char ) 'I' ) continue ; if ( ReadPropertyByte ( & info, & length )!= ( unsigned char ) 'M' ) continue ; id = ( ssize_t ) ReadPropertyMSBShort ( & info, & length ) ; if ( id < ( ssize_t ) start ) continue ; if ( id > ( ssize_t ) stop ) continue ; if ( resource!= ( char * ) NULL ) resource = DestroyString ( resource ) ; count = (

Fix:
<S2SV_ModStart> if ( ( count < 0 ) || ( ( size_t ) count > length ) ) { length = 0 ; continue ; } if ( (
Buggy code:
 static int cit_get_packet_size ( struct gspca_dev * gspca_dev ) { struct usb_host_interface * alt ; struct usb_interface * intf ; intf = usb_ifnum_to_if ( gspca_dev -> dev, gspca_dev -> iface ) ; alt = usb_altnum_to_altsetting ( intf, gspca_dev -> alt ) ; if (! alt ) { pr_err ( "Couldn\'t   get   altsetting\\n" ) ; return - EIO ; } <START_BUG> return le16_to_cpu ( alt -> endpoint [ 0 ]. desc. wMaxPacketSize ) ; <END_BUG> }

Fix:
<S2SV_ModStart> EIO ; } if ( alt -> desc. bNumEndpoints < 1 ) return - ENODEV ;
Buggy code:
 static void snd_timer_user_tinterrupt ( struct snd_timer_instance * timeri, unsigned long resolution, unsigned long ticks ) { struct snd_timer_user * tu = timeri -> callback_data ; struct snd_timer_tread * r, r1 ; struct timespec tstamp ; int prev, append = 0 ; memset ( & tstamp, 0, sizeof ( tstamp ) ) ; spin_lock ( & tu -> qlock ) ; if ( ( tu -> filter & ( ( 1 << SNDRV_TIMER_EVENT_RESOLUTION ) | ( 1 << SNDRV_TIMER_EVENT_TICK ) ) ) == 0 ) { spin_unlock ( & tu -> qlock ) ; return ; } if ( tu -> last_resolution!= resolution || ticks > 0 ) { if ( timer_tstamp_monotonic ) ktime_get_ts ( & tstamp ) ; else getnstimeofday ( & tstamp ) ; } if ( ( tu -> filter & ( 1 << SNDRV_TIMER_EVENT_RESOLUTION ) ) && tu -> last_resolution!= resolution ) { <START_BUG> r1. event = SNDRV_TIMER_EVENT_RESOLUTION ; <END_BUG> r1. tstamp = tstamp ; r1. val = resolution ; snd_timer_user_append_to_tqueue ( tu, & r1 ) ; tu -> last_resolution = resolution ; append ++ ; } if ( ( tu -> filter & ( 1 << SNDRV_TIMER_EVENT_TICK ) ) == 0 ) goto __wake ; if ( ticks == 0 ) goto __wake ; if ( tu -> qused > 0 ) { prev = tu -> qtail == 0? tu -> queue_size - 1 : tu -> qtail - 1 ; r = & tu -> tqueue [ prev ] ; if ( r -> event == SNDRV_TIMER_EVENT_TICK ) { r -> tstamp = tstamp ; r -> val += ticks ; append ++ ; goto __wake ; } } r1. event = SNDRV_TIMER_EVENT_TICK ; r1. tstamp = tstamp ; r1. val = ticks ; snd_timer_user_append_to_tqueue ( tu, & r1 ) ; append ++ ; __wake :

Fix:
<S2SV_ModStart> resolution ) { memset ( & r1, 0, sizeof ( r1 ) ) ;
Buggy code:
 asmlinkage void user_unaligned_trap ( struct pt_regs * regs, unsigned int insn ) { enum direction dir ; if (! ( current -> thread. flags & SPARC_FLAG_UNALIGNED ) || ( ( ( insn >> 30 ) & 3 )!= 3 ) ) goto kill_user ; dir = decode_direction ( insn ) ; if (! ok_for_user ( regs, insn, dir ) ) { goto kill_user ; } else { int err, size = decode_access_size ( insn ) ; unsigned long addr ; if ( floating_point_load_or_store_p ( insn ) ) { printk ( "User   FPU   load//store   unaligned   unsupported.\\n" ) ; goto kill_user ; } addr = compute_effective_address ( regs, insn ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, addr ) ; <END_BUG> switch ( dir ) { case load : err = do_int_load ( fetch_reg_addr ( ( ( insn >> 25 ) & 0x1f ), regs ), size, ( unsigned long * ) addr, decode_signedness ( insn ) ) ; break ; case store : err = do_int_store ( ( ( insn >> 25 ) & 0x1f ), size, ( unsigned long * ) addr, regs ) ; break ; case both : printk ( "Unaligned   SWAP   unsupported.\\n" ) ; err = - EFAULT ; break ; default : unaligned_panic ( "Impossible   user   unaligned   trap." ) ; goto out ; } if ( err ) goto kill_user ; else advance ( regs ) ; goto out ; } kill_user : user_mna_trap_fault ( regs, insn ) ; out : ; }

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, addr
Buggy code:
 static int futex_wait_requeue_pi ( u32 __user * uaddr, unsigned int flags, u32 val, ktime_t * abs_time, u32 bitset, u32 __user * uaddr2 ) { struct hrtimer_sleeper timeout, * to = NULL ; struct rt_mutex_waiter rt_waiter ; struct rt_mutex * pi_mutex = NULL ; struct futex_hash_bucket * hb ; union futex_key key2 = FUTEX_KEY_INIT ; struct futex_q q = futex_q_init ; <START_BUG> int res, ret ; <END_BUG> if (! bitset ) return - EINVAL ; if ( abs_time ) { to = & timeout ; hrtimer_init_on_stack ( & to -> timer, ( flags & FLAGS_CLOCKRT )? CLOCK_REALTIME : CLOCK_MONOTONIC, HRTIMER_MODE_ABS ) ; hrtimer_init_sleeper ( to, current ) ; hrtimer_set_expires_range_ns ( & to -> timer, * abs_time, current -> timer_slack_ns ) ; } debug_rt_mutex_init_waiter ( & rt_waiter ) ; rt_waiter. task = NULL ; ret = get_futex_key ( uaddr2, flags & FLAGS_SHARED, & key2, VERIFY_WRITE ) ; if ( unlikely ( ret!= 0 ) ) goto out ; q. bitset = bitset ; q. rt_waiter = & rt_waiter ; q. requeue_pi_key = & key2 ; ret = futex_wait_setup ( uaddr, val, flags, & q, & hb ) ; if ( ret ) goto out_key2 ; futex_wait_queue_me ( hb, & q, to ) ; spin_lock ( & hb -> lock ) ; ret = handle_early_requeue_pi_wakeup ( hb, & q, & key2, to ) ; spin_unlock ( & hb -> lock ) ; if ( ret ) goto out_put_keys ; if (! q. rt_waiter ) { if ( q. pi_state && ( q. pi_state -> owner!= current ) ) { spin_lock ( q. lock

Fix:
<S2SV_ModStart> res, ret ; if ( uaddr == uaddr2 ) return - EINVAL
Buggy code:
 static int misaligned_fpu_store ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift, int do_paired_load ) { int error ; int srcreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, address ) ; <END_BUG> srcreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; __u32 buflo = 0xffffffffUL, bufhi = 0xffffffffUL ; if (! access_ok ( VERIFY_WRITE, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } if ( last_task_used_math == current ) { enable_fpu ( ) ; save_fpu ( current ) ; disable_fpu ( ) ; last_task_used_math = NULL ; regs -> sr |= SR_FD ; } switch ( width_shift ) { case 2 : buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; break ; case 3 : if ( do_paired_load ) { buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; bufhi = current -> thread. xstate -> hardfpu. fp_regs [ srcreg + 1 ] ; } else { # if defined ( CONFIG_CPU_LITTLE_ENDIAN ) bufhi = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg + 1 ] ; # else buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; bufhi = current -> thread. xstate -> hardfpu. fp_regs [ srcreg + 1 ] ; # endif } break ; default : printk ( "Unexpected   width_shift   %d   in   misaligned_fpu_store,   PC=%08lx\\

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 int copy_creds ( struct task_struct * p, unsigned long clone_flags ) { # ifdef CONFIG_KEYS struct thread_group_cred * tgcred ; # endif struct cred * new ; int ret ; <START_BUG> if ( <END_BUG> # ifdef CONFIG_KEYS! p -> cred -> thread_keyring && # endif clone_flags & CLONE_THREAD ) { p -> real_cred = get_cred ( p -> cred ) ; get_cred ( p -> cred ) ; alter_cred_subscribers ( p -> cred, 2 ) ; kdebug ( "share_creds(%p{%d,%d})", p -> cred, atomic_read ( & p -> cred -> usage ), read_cred_subscribers ( p -> cred ) ) ; atomic_inc ( & p -> cred -> user -> processes ) ; return 0 ; } new = prepare_creds ( ) ; if (! new ) return - ENOMEM ; if ( clone_flags & CLONE_NEWUSER ) { ret = create_user_ns ( new ) ; if ( ret < 0 ) goto error_put ; } new -> user_ns = new -> user -> user_ns ; # ifdef CONFIG_KEYS if ( new -> thread_keyring ) { key_put ( new -> thread_keyring ) ; new -> thread_keyring = NULL ; if ( clone_flags & CLONE_THREAD ) install_thread_keyring_to_cred ( new ) ; } if (! ( clone_flags & CLONE_THREAD ) ) { tgcred = kmalloc ( sizeof ( * tgcred ), GFP_KERNEL ) ; if (! tgcred ) { ret = - ENOMEM ; goto error_put ; } atomic_set ( & tgcred -> usage, 1 ) ; spin_lock_init ( & tgcred -> lock ) ; tgcred -> process_keyring = NULL ; tgcred -> session_keyring = key_get ( new -> tgcred -> session_keyring ) ; release_tgcred ( new ) ; new -> tgcred = tgcred ; } # endif atomic_inc ( & new -> user -> processes ) ; p -> cred = p -> real_cred = get_cred ( new ) ; alter_cred_subscribers ( new, 2 ) ; validate_creds ( new ) ; return 0 ; error

Fix:
<S2SV_ModStart> int ret ; p -> replacement_session_keyring = NULL ;
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char * pixels ; unsigned long ls

Fix:
<S2SV_ModStart> NULL ) { status = MagickFalse ; break <S2SV_ModEnd> ; } image
Buggy code:
 bool ExprResolveLhs ( struct xkb_context * ctx, const ExprDef * expr, const char * * elem_rtrn, const char * * field_rtrn, ExprDef * * index_rtrn ) { switch ( expr -> expr. op ) { case EXPR_IDENT : * elem_rtrn = NULL ; * field_rtrn = xkb_atom_text ( ctx, expr -> ident. ident ) ; * index_rtrn = NULL ; <START_BUG> return true ; <END_BUG> case EXPR_FIELD_REF : * elem_rtrn = xkb_atom_text ( ctx, expr -> field_ref. element ) ; * field_rtrn = xkb_atom_text ( ctx, expr -> field_ref. field ) ; * index_rtrn = NULL ; return true ; case EXPR_ARRAY_REF : * elem_rtrn = xkb_atom_text ( ctx, expr -> array_ref. element ) ; * field_rtrn = xkb_atom_text ( ctx, expr -> array_ref. field ) ; * index_rtrn = expr -> array_ref. entry ; return true ; default : break ; } log_wsgo ( ctx, "Unexpected   operator   %d   in   ResolveLhs\\n", expr -> expr. op ) ; return false ; }

Fix:
<S2SV_ModStart> NULL ; return ( * field_rtrn!= NULL ) <S2SV_ModEnd> ; case EXPR_FIELD_REF
Buggy code:
 void * xcalloc ( size_t num, size_t size ) { <START_BUG> void * ptr = malloc ( num * size ) ; <END_BUG> if ( ptr ) {  memset ( ptr, '\\0', ( num * size ) ) ; <START_BUG> } return ptr ; }<END_BUG>

Fix:
<S2SV_ModStart> size ) { size_t res ; if ( check_mul_overflow ( num, size, & res ) ) abort ( ) ; void * ptr ; <S2SV_ModEnd> ptr = malloc <S2SV_ModStart> = malloc ( res <S2SV_ModEnd> ) ; if <S2SV_ModStart> '\\0', ( res <S2SV_ModEnd> ) ) ;
Buggy code:
 static int __btrfs_set_acl ( struct btrfs_trans_handle * trans, struct inode * inode, struct posix_acl * acl, int type ) { int ret, size = 0 ; const char * name ; char * value = NULL ; switch ( type ) { case ACL_TYPE_ACCESS : name = XATTR_NAME_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> ret = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( ret < 0 ) return ret ; if ( ret == 0 ) acl = NULL ; } ret = 0 ; break ; case ACL_TYPE_DEFAULT : if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EINVAL : 0 ; name = XATTR_NAME_POSIX_ACL_DEFAULT ; break ; default : return - EINVAL ; } if ( acl ) { size = posix_acl_xattr_size ( acl -> a_count ) ; value = kmalloc ( size, GFP_KERNEL ) ; if (! value ) { ret = - ENOMEM ; goto out ; } ret = posix_acl_to_xattr ( & init_user_ns, acl, value, size ) ; if ( ret < 0 ) goto out ; } ret = __btrfs_setxattr ( trans, inode, name, value, size, 0 ) ; out : kfree ( value ) ; if (! ret ) set_cached_acl ( inode, type, acl ) ; return ret ; }

Fix:
<S2SV_ModStart> { ret = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( ret ) return ret <S2SV_ModEnd> ; } ret
Buggy code:
 static int dgram_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { size_t copied = 0 ; int err = - EOPNOTSUPP ; struct sk_buff * skb ; struct sockaddr_ieee802154 * saddr ; saddr = ( struct sockaddr_ieee802154 * ) msg -> msg_name ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto done ; sock_recv_ts_and_drops ( msg, sk, skb ) ; if ( saddr ) { saddr -> family = AF_IEEE802154 ; saddr -> addr = mac_cb ( skb ) -> sa ; <START_BUG> } <END_BUG> if ( addr_len ) * addr_len = sizeof ( * saddr ) ; if ( flags & MSG_TRUNC ) copied = skb -> len ; done : skb_free_datagram ( sk, skb ) ; out : if ( err ) return err ; return copied ; }

Fix:
<S2SV_ModStart> -> sa ; * addr_len = sizeof ( * saddr ) ; } <S2SV_ModEnd> if ( flags
Buggy code:
 static struct sock * tcp_v6_syn_recv_sock ( struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst ) { struct inet6_request_sock * treq ; struct ipv6_pinfo * newnp, * np = inet6_sk ( sk ) ; struct tcp6_sock * newtcp6sk ; struct inet_sock * newinet ; struct tcp_sock * newtp ; struct sock * newsk ; struct ipv6_txoptions * opt ; # ifdef CONFIG_TCP_MD5SIG struct tcp_md5sig_key * key ; # endif if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = tcp_v4_syn_recv_sock ( sk, skb, req, dst ) ; if ( newsk == NULL ) return NULL ; newtcp6sk = ( struct tcp6_sock * ) newsk ; inet_sk ( newsk ) -> pinet6 = & newtcp6sk -> inet6 ; newinet = inet_sk ( newsk ) ; newnp = inet6_sk ( newsk ) ; newtp = tcp_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; ipv6_addr_set_v4mapped ( newinet -> inet_daddr, & newnp -> daddr ) ; ipv6_addr_set_v4mapped ( newinet -> inet_saddr, & newnp -> saddr ) ; ipv6_addr_copy ( & newnp -> rcv_saddr, & newnp -> saddr ) ; inet_csk ( newsk ) -> icsk_af_ops = & ipv6_mapped ; newsk -> sk_backlog_rcv = tcp_v4_do_rcv ; # ifdef CONFIG_TCP_MD5SIG newtp -> af_specific = & tcp_sock_ipv6_mapped_specific ; # endif newnp -> pktoptions = NULL ; newnp -> opt = NULL ; newnp -> mcast_oif = inet6_iif ( skb ) ; newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; tcp_sync_mss ( newsk,

Fix:
<S2SV_ModStart> ; newinet -> inet_opt <S2SV_ModEnd> = NULL ;
Buggy code:
 SYSCALL_DEFINE5 ( perf_event_open, struct perf_event_attr __user *, attr_uptr, pid_t, pid, int, cpu, int, group_fd, unsigned long, flags ) { struct perf_event * group_leader = NULL, * output_event = NULL ; struct perf_event * event, * sibling ; struct perf_event_attr attr ; <START_BUG> struct perf_event_context * ctx ; <END_BUG> struct file * event_file = NULL ; struct fd group = { NULL, 0 } ; struct task_struct * task = NULL ; struct pmu * pmu ; int event_fd ; int move_group = 0 ; int err ; int f_flags = O_RDWR ; if ( flags & ~ PERF_FLAG_ALL ) return - EINVAL ; err = perf_copy_attr ( attr_uptr, & attr ) ; if ( err ) return err ; if (! attr. exclude_kernel ) { if ( perf_paranoid_kernel ( ) &&! capable ( CAP_SYS_ADMIN ) ) return - EACCES ; } if ( attr. freq ) { if ( attr. sample_freq > sysctl_perf_event_sample_rate ) return - EINVAL ; } else { if ( attr. sample_period & ( 1ULL << 63 ) ) return - EINVAL ; } if ( ( flags & PERF_FLAG_PID_CGROUP ) && ( pid == - 1 || cpu == - 1 ) ) return - EINVAL ; if ( flags & PERF_FLAG_FD_CLOEXEC ) f_flags |= O_CLOEXEC ; event_fd = get_unused_fd_flags ( f_flags ) ; if ( event_fd < 0 ) return event_fd ; if ( group_fd!= - 1 ) { err = perf_fget_light ( group_fd, & group ) ; if ( err ) goto err_fd ; group_leader = group. file -> private_data ; if ( flags & PERF_FLAG_FD_OUTPUT ) output_event = group_leader ; if ( flags & PERF_FLAG_FD_NO_GROUP ) group_leader = NULL ; } if ( pid!= - 1 &&! ( flags & PERF_FLAG_PID_CGROUP ) ) { task = find_lively_task_

Fix:
<S2SV_ModStart> perf_event_context * ctx, * uninitialized_var ( gctx ) <S2SV_ModStart> move_group ) { <S2SV_ModEnd> gctx = group_leader <S2SV_ModStart> -> ctx ; mutex_lock_double ( & gctx -> mutex, & ctx -> mutex ) ; perf_remove_from_context ( group_leader, false ) ; perf_event__state_init ( group_leader ) ; list_for_each_entry ( sibling, & group_leader -> sibling_list, group_entry ) { perf_remove_from_context ( sibling, false ) ; perf_event__state_init ( sibling ) ; put_ctx ( gctx ) ; } } else { <S2SV_ModStart> mutex_lock ( & ctx -> mutex ) ; } WARN_ON_ONCE ( ctx -> parent_ctx ) ; if ( move_group ) { synchronize_rcu ( ) ; perf_install_in_context ( ctx, group_leader, group_leader -> cpu ) ; get_ctx ( ctx ) ; list_for_each_entry ( sibling, & group_leader -> sibling_list, group_entry ) { perf_install_in_context ( ctx, sibling, sibling -> cpu ) ; get_ctx (