nus-yam/ex-repair huggingface dataset:
Buggy code:
 static bool nested_vmx_exit_handled ( struct kvm_vcpu * vcpu ) { u32 intr_info = vmcs_read32 ( VM_EXIT_INTR_INFO ) ; struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; struct vmcs12 * vmcs12 = get_vmcs12 ( vcpu ) ; u32 exit_reason = vmx -> exit_reason ; trace_kvm_nested_vmexit ( kvm_rip_read ( vcpu ), exit_reason, vmcs_readl ( EXIT_QUALIFICATION ), vmx -> idt_vectoring_info, intr_info, vmcs_read32 ( VM_EXIT_INTR_ERROR_CODE ), KVM_ISA_VMX ) ; if ( vmx -> nested. nested_run_pending ) return false ; if ( unlikely ( vmx -> fail ) ) { pr_info_ratelimited ( "%s   failed   vm   entry   %x\\n", __func__, vmcs_read32 ( VM_INSTRUCTION_ERROR ) ) ; return true ; } switch ( exit_reason ) { case EXIT_REASON_EXCEPTION_NMI : <START_BUG> if (! is_exception ( intr_info ) ) <END_BUG> return false ; else if ( is_page_fault ( intr_info ) ) return enable_ept ; else if ( is_no_device ( intr_info ) &&! ( vmcs12 -> guest_cr0 & X86_CR0_TS ) ) return false ; else if ( is_debug ( intr_info ) && vcpu -> guest_debug & ( KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP ) ) return false ; else if ( is_breakpoint ( intr_info ) && vcpu -> guest_debug & KVM_GUESTDBG_USE_SW_BP ) return false ; return vmcs12 -> exception_bitmap & ( 1u << ( intr_info & INTR_INFO_VECTOR_MASK ) ) ; case EXIT_REASON_EXTERNAL_INTERRUPT : return false ; case EXIT_REASON_TRIPLE_FAULT : return true ; case EXIT_REASON_PENDING_INTERRUPT : return

Fix:
<S2SV_ModStart> : if ( is_nmi <S2SV_ModEnd> ( intr_info )
Buggy code:
 int main ( int argc, char * argv [ ] ) { int i, fd, swapped, pkthdrlen, ret, optct, backwards, caplentoobig ; struct pcap_file_header pcap_fh ; struct pcap_pkthdr pcap_ph ; struct pcap_sf_patched_pkthdr pcap_patched_ph ; char buf [ 10000 ] ; struct stat statinfo ; uint64_t pktcnt ; uint32_t readword ; int32_t last_sec, last_usec, caplen ; optct = optionProcess ( & tcpcapinfoOptions, argc, argv ) ; argc -= optct ; argv += optct ; # ifdef DEBUG if ( HAVE_OPT ( DBUG ) ) debug = OPT_VALUE_DBUG ; # endif for ( i = 0 ; i < argc ; i ++ ) { dbgx ( 1, "processing:     %s\\n", argv [ i ] ) ; if ( ( fd = open ( argv [ i ], O_RDONLY ) ) < 0 ) errx ( - 1, "Error   opening   file   %s:   %s", argv [ i ], strerror ( errno ) ) ; if ( fstat ( fd, & statinfo ) < 0 ) errx ( - 1, "Error   getting   file   stat   info   %s:   %s", argv [ i ], strerror ( errno ) ) ; printf ( "file   size       =   %" PRIu64 "   bytes\\n", ( uint64_t ) statinfo. st_size ) ; if ( ( ret = read ( fd, & buf, sizeof ( pcap_fh ) ) )!= sizeof ( pcap_fh ) ) errx ( - 1, "File   too   small.     Unable   to   read   pcap_file_header   from   %s", argv [ i ] ) ; dbgx ( 3, "Read   %d   bytes   for   file   header", ret ) ; swapped = 0 ; memcpy ( & pcap_fh, & buf, sizeof ( pcap_fh ) ) ; pkthdrlen = 16 ; switch ( pcap_fh. magic ) { case TCPD

Fix:
<S2SV_ModStart> } if ( caplentoobig ) { printf ( "\\n\\nCapture <S2SV_blank> file <S2SV_blank> appears <S2SV_blank> to <S2SV_blank> be <S2SV_blank> damaged <S2SV_blank> or <S2SV_blank> corrupt.\\n" "Contains <S2SV_blank> packet <S2SV_blank> of <S2SV_blank> size <S2SV_blank> %u, <S2SV_blank> bigger <S2SV_blank> than <S2SV_blank> snap <S2SV_blank> length <S2SV_blank> %u\\n", caplen, pcap_fh. snaplen ) ; close ( fd ) ; break ; } if ( <S2SV_ModStart> fd ) ; break <S2SV_ModEnd> ; } printf
Buggy code:
 int process ( register int code, unsigned char * * fill ) { int incode ; static unsigned char firstchar ; if ( code == clear ) { codesize = datasize + 1 ; codemask = ( 1 << codesize ) - 1 ; avail = clear + 2 ; oldcode = - 1 ; return 1 ; } if ( oldcode == - 1 ) { <START_BUG> * ( * fill ) ++ = suffix [ code ] ; <END_BUG> firstchar = oldcode = code ; return 1 ; } if ( code > avail ) { fprintf ( stderr, "code   %d   too   large   for   %d\\n", code, avail ) ; return 0 ; } incode = code ; if ( code == avail ) { * stackp ++ = firstchar ; code = oldcode ; } while ( code > clear ) { * stackp ++ = suffix [ code ] ; code = prefix [ code ] ; } * stackp ++ = firstchar = suffix [ code ] ; prefix [ avail ] = oldcode ; suffix [ avail ] = firstchar ; avail ++ ; if ( ( ( avail & codemask ) == 0 ) && ( avail < 4096 ) ) { codesize ++ ; codemask += avail ; } oldcode = incode ; do { * ( * fill ) ++ = * -- stackp ; } while ( stackp > stack ) ; return 1 ; }

Fix:
<S2SV_ModStart> 1 ) { if ( code >= clear ) { fprintf ( stderr, "bad <S2SV_blank> input: <S2SV_blank> code=%d <S2SV_blank> is <S2SV_blank> larger <S2SV_blank> than <S2SV_blank> clear=%d\\n", code, clear ) ; return 0 ; }
Buggy code:
 void vp8_dequant_idct_add_y_block_mmx ( short * q, short * dq, unsigned char * dst, int stride, char * eobs ) { int i ; for ( i = 0 ; i < 4 ; i ++ ) { if ( eobs [ 0 ] > 1 ) vp8_dequant_idct_add_mmx ( q, dq, dst, stride ) ; else if ( eobs [ 0 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 0 ] * dq [ 0 ], dst, stride, dst, stride ) ; <START_BUG> vpx_memset ( q, 0, 2 * sizeof ( q [ 0 ] ) ) ; <END_BUG> } if ( eobs [ 1 ] > 1 ) vp8_dequant_idct_add_mmx ( q + 16, dq, dst + 4, stride ) ; else if ( eobs [ 1 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 16 ] * dq [ 0 ], dst + 4, stride, dst + 4, stride ) ;  vpx_memset ( q + 16, 0, 2 * sizeof ( q [ 0 ] ) ) ; <START_BUG> } if ( eobs [ 2 ] > 1 ) vp8_dequant_idct_add_mmx ( q + 32, dq, dst + 8, stride ) ; else if ( eobs [ 2 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 32 ] * dq [ 0 ], dst + 8, stride, dst + 8, stride ) ; <END_BUG> vpx_memset ( q + 32, 0, 2 * sizeof ( q [ 0 ] ) ) ;  } if ( eobs [ 3 ] > 1 ) vp8_dequant_idct_add_mmx ( q + 48, dq, dst + 12, stride ) ; else if ( eobs [ 3 ] == 1 ) { vp8_dc_only_idct_add_mmx ( q [ 48 ] * dq [ 0 ], dst + 12, stride, dst + 12, stride ) ; <START_BUG> vpx_memset ( q + 48, 0, 2 * sizeof ( q [ 0 ] ) ) ; <END_BUG> } q += 64 ; dst +=

Fix:
<S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q, <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q + <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q + <S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q +
Buggy code:
 unsigned int get_random_int ( void ) { <START_BUG> struct keydata * keyptr ; <END_BUG> __u32 * hash = get_cpu_var ( get_random_int_hash ) ;  int ret ; <START_BUG> keyptr = get_keyptr ( ) ; hash [ 0 ] += current -> pid + jiffies + get_cycles ( ) ; <END_BUG> ret = half_md4_transform ( hash, keyptr -> secret ) ;  put_cpu_var ( get_random_int_hash ) ; return ret ; }

Fix:
<S2SV_ModStart> void ) { <S2SV_ModEnd> __u32 * hash <S2SV_ModStart> get_random_int_hash ) ; unsigned int ret <S2SV_ModEnd> ; hash [ <S2SV_ModStart> ( ) ; md5_transform <S2SV_ModEnd> ( hash, <S2SV_ModStart> ( hash, random_int_secret ) ; ret = hash [ 0 ] <S2SV_ModEnd> ; put_cpu_var (
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_update_entropy ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { int update = va_arg ( args, int ) ; vp8_update_entropy ( ctx -> cpi, update ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 void ParseNameValue ( const char * buffer, int bufsize, struct NameValueParserData * data ) { struct xmlparser parser ; <START_BUG> data -> l_head = NULL ; <END_BUG> data -> portListing = NULL ; data -> portListingLength = 0 ; parser. xmlstart = buffer ; parser. xmlsize = bufsize ; parser. data = data ; parser. starteltfunc = NameValueParserStartElt ; parser. endeltfunc = NameValueParserEndElt ; parser. datafunc = NameValueParserGetData ; parser. attfunc = 0 ; parsexml ( & parser ) ; }

Fix:
<S2SV_ModStart> xmlparser parser ; memset ( data, 0, sizeof ( struct NameValueParserData ) ) <S2SV_ModEnd> ; parser.
Buggy code:
 int megasas_alloc_cmds ( struct megasas_instance * instance ) { int i ; int j ; u16 max_cmd ; struct megasas_cmd * cmd ; max_cmd = instance -> max_mfi_cmds ; instance -> cmd_list = kcalloc ( max_cmd, sizeof ( struct megasas_cmd * ), GFP_KERNEL ) ; if (! instance -> cmd_list ) { dev_printk ( KERN_DEBUG, & instance -> pdev -> dev, "out   of   memory\\n" ) ; return - ENOMEM ; } memset ( instance -> cmd_list, 0, sizeof ( struct megasas_cmd * ) * max_cmd ) ; for ( i = 0 ; i < max_cmd ; i ++ ) { instance -> cmd_list [ i ] = kmalloc ( sizeof ( struct megasas_cmd ), GFP_KERNEL ) ; if (! instance -> cmd_list [ i ] ) { for ( j = 0 ; j < i ; j ++ ) kfree ( instance -> cmd_list [ j ] ) ; kfree ( instance -> cmd_list ) ; instance -> cmd_list = NULL ; return - ENOMEM ; } } for ( i = 0 ; i < max_cmd ; i ++ ) { cmd = instance -> cmd_list [ i ] ; memset ( cmd, 0, sizeof ( struct megasas_cmd ) ) ; cmd -> index = i ; cmd -> scmd = NULL ; cmd -> instance = instance ; list_add_tail ( & cmd -> list, & instance -> cmd_pool ) ; } if ( megasas_create_frame_pool ( instance ) ) { dev_printk ( KERN_DEBUG, & instance -> pdev -> dev, "Error   creating   frame   DMA   pool\\n" ) ; megasas_free_cmds ( instance ) ; <START_BUG> } <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> instance ) ; return - ENOMEM ; } return <S2SV_ModEnd> 0 ; }
Buggy code:
 int nfc_llcp_send_cc ( struct nfc_llcp_sock * sock ) { struct nfc_llcp_local * local ; struct sk_buff * skb ; u8 * miux_tlv = NULL, miux_tlv_length ; u8 * rw_tlv = NULL, rw_tlv_length, rw ; int err ; u16 size = 0 ; __be16 miux ; pr_debug ( "Sending   CC\\n" ) ; local = sock -> local ; if ( local == NULL ) return - ENODEV ; miux = be16_to_cpu ( sock -> miux ) > LLCP_MAX_MIUX? local -> miux : sock -> miux ; rw = sock -> rw > LLCP_MAX_RW? local -> rw : sock -> rw ; miux_tlv = nfc_llcp_build_tlv ( LLCP_TLV_MIUX, ( u8 * ) & miux, 0, & miux_tlv_length ) ; <START_BUG> size += miux_tlv_length ; <END_BUG> rw_tlv = nfc_llcp_build_tlv ( LLCP_TLV_RW, & rw, 0, & rw_tlv_length ) ;  size += rw_tlv_length ; <START_BUG> skb = llcp_allocate_pdu ( sock, LLCP_PDU_CC, size ) ; if ( skb == NULL ) { err = - ENOMEM ; goto error_tlv ; } llcp_add_tlv ( skb, miux_tlv, miux_tlv_length ) ; llcp_add_tlv ( skb, rw_tlv, rw_tlv_length ) ; skb_queue_tail ( & local -> tx_queue, skb ) ; err = 0 ; error_tlv : if ( err ) pr_err ( "error   %d\\n", err ) ; kfree ( miux_tlv ) ; kfree ( rw_tlv ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> miux_tlv_length ) ; if (! miux_tlv ) { err = - ENOMEM ; goto error_tlv ; } <S2SV_ModStart> rw_tlv_length ) ; if (! rw_tlv ) { err = - ENOMEM ; goto error_tlv ; }
Buggy code:
 av_cold void ff_mpv_idct_init ( MpegEncContext * s ) <START_BUG> { <END_BUG> ff_idctdsp_init ( & s -> idsp, s -> avctx ) ; if ( s -> alternate_scan ) { ff_init_scantable ( s -> idsp. idct_permutation, & s -> inter_scantable, ff_alternate_vertical_scan ) ; ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_scantable, ff_alternate_vertical_scan ) ; } else { ff_init_scantable ( s -> idsp. idct_permutation, & s -> inter_scantable, ff_zigzag_direct ) ; ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_scantable, ff_zigzag_direct ) ; } ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_h_scantable, ff_alternate_horizontal_scan ) ; ff_init_scantable ( s -> idsp. idct_permutation, & s -> intra_v_scantable, ff_alternate_vertical_scan ) ; }

Fix:
<S2SV_ModStart> s ) { if ( s -> codec_id == AV_CODEC_ID_MPEG4 ) s -> idsp. mpeg4_studio_profile = s -> studio_profile ;
Buggy code:
 struct clock_source * dce100_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( struct dce110_clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dce110_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;
Buggy code:
 bool CompileKeymap ( XkbFile * file, struct xkb_keymap * keymap, enum merge_mode merge ) { bool ok ; XkbFile * files [ LAST_KEYMAP_FILE_TYPE + 1 ] = { NULL } ; enum xkb_file_type type ; struct xkb_context * ctx = keymap -> ctx ; for ( file = ( XkbFile * ) file -> defs ; file ; file = ( XkbFile * ) file -> common. next ) { if ( file -> file_type < FIRST_KEYMAP_FILE_TYPE || file -> file_type > LAST_KEYMAP_FILE_TYPE ) { <START_BUG> log_err ( ctx, "Cannot   define   %s   in   a   keymap   file\\n", <END_BUG>  xkb_file_type_to_string ( file -> file_type ) ) ; <START_BUG> continue ; } if ( files [ file -> file_type ] ) { log_err ( ctx, "More   than   one   %s   section   in   keymap   file;   " "All   sections   after   the   first   ignored\\n", xkb_file_type_to_string ( file -> file_type ) ) ; continue ; } files [ file -> file_type ] = file ; } ok = true ; for ( type = FIRST_KEYMAP_FILE_TYPE ; type <= LAST_KEYMAP_FILE_TYPE ; type ++ ) { if ( files [ type ] == NULL ) { log_err ( ctx, "Required   section   %s   missing   from   keymap\\n", xkb_file_type_to_string ( type ) ) ; ok = false ; } } if (! ok ) return false ; for ( type = FIRST_KEYMAP_FILE_TYPE ; type <= LAST_KEYMAP_FILE_TYPE ; type ++ ) { log_dbg ( ctx, "Compiling   %s   \\"%s\\"\\n", xkb_file_type_to_string ( type ), files [ type ] -> name ) ; ok = compile_file_fns [ type ] ( files [ type ], keymap, merge ) ; if (! ok ) { log_err ( ctx, "Failed   to   compile   %s\\n", xkb_file_type_to_string<END_BUG>

Fix:
<S2SV_ModStart> LAST_KEYMAP_FILE_TYPE ) { if ( file -> file_type == FILE_TYPE_GEOMETRY ) { log_vrb ( ctx, 1, "Geometry <S2SV_blank> sections <S2SV_blank> are <S2SV_blank> not <S2SV_blank> supported; <S2SV_blank> ignoring\\n" ) ; } else { <S2SV_ModStart> ) ) ; }
Buggy code:
 int rxrpc_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct rxrpc_skb_priv * sp ; struct rxrpc_call * call = NULL, * continue_call = NULL ; struct rxrpc_sock * rx = rxrpc_sk ( sock -> sk ) ; struct sk_buff * skb ; long timeo ; int copy, ret, ullen, offset, copied = 0 ; u32 abort_code ; DEFINE_WAIT ( wait ) ; _enter ( ",,,%zu,%d", len, flags ) ; if ( flags & ( MSG_OOB | MSG_TRUNC ) ) return - EOPNOTSUPP ; ullen = msg -> msg_flags & MSG_CMSG_COMPAT? 4 : sizeof ( unsigned long ) ; timeo = sock_rcvtimeo ( & rx -> sk, flags & MSG_DONTWAIT ) ; msg -> msg_flags |= MSG_MORE ; lock_sock ( & rx -> sk ) ; for ( ; ; ) { if ( RB_EMPTY_ROOT ( & rx -> calls ) ) { if ( copied ) goto out ; if ( rx -> sk. sk_state!= RXRPC_SERVER_LISTENING ) { release_sock ( & rx -> sk ) ; if ( continue_call ) rxrpc_put_call ( continue_call ) ; return - ENODATA ; } } skb = skb_peek ( & rx -> sk. sk_receive_queue ) ; if (! skb ) { if ( copied && ( msg -> msg_flags & MSG_PEEK || timeo == 0 ) ) goto out ; release_sock ( & rx -> sk ) ; prepare_to_wait_exclusive ( sk_sleep ( & rx -> sk ), & wait, TASK_INTERRUPTIBLE ) ; ret = sock_error ( & rx -> sk ) ; if ( ret ) goto wait_error ; if ( skb_queue_empty ( & rx -> sk. sk_receive_queue ) ) { if ( signal_pending ( current ) ) goto wait_interrupted ; timeo = schedule_timeout ( timeo ) ; } finish_wait ( sk_sleep ( & rx -> sk ), & wait ) ; lock_sock ( & rx ->

Fix:
<S2SV_ModStart> msg -> msg_name ) { size_t len = sizeof ( call -> conn -> trans -> peer -> srx ) ; memcpy ( msg -> msg_name, & call -> conn -> trans -> peer -> srx, len ) ; <S2SV_ModEnd> msg -> msg_namelen <S2SV_ModStart> msg -> msg_namelen = len ; } <S2SV_ModEnd> sock_recv_ts_and_drops ( msg
Buggy code:
 static Image * ReadPWPImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char filename [ MagickPathExtent ] ; FILE * file ; Image * image, * next_image, * pwp_image ; ImageInfo * read_info ; int c, unique_file ; MagickBooleanType status ; register Image * p ; register ssize_t i ; size_t filesize, length ; ssize_t count ; unsigned char magick [ MagickPathExtent ] ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } pwp_image = image ; memset ( magick, 0, sizeof ( magick ) ) ; count = ReadBlob ( pwp_image, 5, magick ) ; if ( ( count!= 5 ) || ( LocaleNCompare ( ( char * ) magick, "SFW95", 5 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; read_info = CloneImageInfo ( image_info ) ; ( void ) SetImageInfoProgressMonitor ( read_info, ( MagickProgressMonitor ) NULL, ( void * ) NULL ) ; SetImageInfoBlob ( read_info, ( void * ) NULL, 0 ) ; unique_file = AcquireUniqueFileResource ( filename ) ; ( void ) FormatLocaleString ( read_info -> filename, MagickPathExtent, "sfw:%s", filename ) ; for ( ; ; ) { ( void ) memset ( magick, 0, sizeof ( magick ) ) ; for ( c = ReadBlobByte ( pwp_image ) ; c!= EOF ; c = ReadBlobByte ( pwp_image ) ) { for ( i = 0 ; i

Fix:
<S2SV_ModStart> ) break ; if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 void flush_tlb_page ( struct vm_area_struct * vma, unsigned long start ) { struct mm_struct * mm = vma -> vm_mm ; preempt_disable ( ) ; if ( current -> active_mm == mm ) { <START_BUG> if ( current -> mm ) <END_BUG> __flush_tlb_one ( start ) ;  else <START_BUG> <END_BUG> leave_mm ( smp_processor_id ( ) ) ;  } if ( cpumask_any_but ( mm_cpumask ( mm ), smp_processor_id ( ) ) < nr_cpu_ids ) flush_tlb_others ( mm_cpumask ( mm ), mm, start, 0UL ) ; preempt_enable ( ) ; }

Fix:
<S2SV_ModStart> -> mm ) { <S2SV_ModStart> start ) ; } else { <S2SV_ModEnd> leave_mm ( smp_processor_id <S2SV_ModStart> ) ) ; smp_mb ( ) ; }
Buggy code:
 stmt_ty AsyncFunctionDef ( identifier name, arguments_ty args, asdl_seq * body, asdl_seq <START_BUG> * decorator_list, expr_ty returns, int lineno, int col_offset, <END_BUG> int end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; if (! name ) { PyErr_SetString ( PyExc_ValueError, "field   name   is   required   for   AsyncFunctionDef" ) ; return NULL ; } if (! args ) { PyErr_SetString ( PyExc_ValueError, "field   args   is   required   for   AsyncFunctionDef" ) ; return NULL ; } p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = AsyncFunctionDef_kind ; p -> v. AsyncFunctionDef. name = name ; p -> v. AsyncFunctionDef. args = args ; p -> v. AsyncFunctionDef. body = body ; p -> v. AsyncFunctionDef. decorator_list = decorator_list ;  p -> v. AsyncFunctionDef. returns = returns ; <START_BUG> p -> lineno = lineno ; p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> expr_ty returns, string type_comment, int <S2SV_ModEnd> lineno, int <S2SV_ModStart> returns = returns ; p -> v. AsyncFunctionDef. type_comment = type_comment
Buggy code:
 static int mpeg4video_probe ( AVProbeData * probe_packet ) { uint32_t temp_buffer = - 1 ; int VO = 0, VOL = 0, VOP = 0, VISO = 0, res = 0 ; int i ; for ( i = 0 ; i < probe_packet -> buf_size ; i ++ ) { temp_buffer = ( temp_buffer << 8 ) + probe_packet -> buf [ i ] ; <START_BUG> if ( ( temp_buffer & 0xffffff00 )!= 0x100 ) <END_BUG> continue ; if ( temp_buffer == VOP_START_CODE ) VOP ++ ; else if ( temp_buffer == VISUAL_OBJECT_START_CODE ) VISO ++ ;  else if ( temp_buffer < 0x120 ) <START_BUG> VO ++ ; <END_BUG> else if ( temp_buffer < 0x130 )  VOL ++ ; else if (! ( 0x1AF < temp_buffer && temp_buffer < 0x1B7 ) &&! ( 0x1B9 < temp_buffer && temp_buffer < 0x1C4 ) ) res ++ ; } if ( VOP >= VISO && VOP >= VOL && VO >= VOL && VOL > 0 && res == 0 ) return AVPROBE_SCORE_EXTENSION ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( temp_buffer & 0xfffffe00 ) continue ; if ( temp_buffer < 2 <S2SV_ModEnd> ) continue ; <S2SV_ModStart> if ( temp_buffer >= 0x100 && temp_buffer <S2SV_ModStart> else if ( temp_buffer >= 0x120 &&
Buggy code:
 static Image * ReadLABELImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char geometry [ MagickPathExtent ], * property ; const char * label ; DrawInfo * draw_info ; Image * image ; MagickBooleanType status ; TypeMetric metrics ; size_t height, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; ( void ) ResetImagePage ( image, "0x0+0+0" ) ; property = InterpretImageProperties ( ( ImageInfo * ) image_info, image, image_info -> filename, exception ) ; ( void ) SetImageProperty ( image, "label", property, exception ) ; property = DestroyString ( property ) ; label = GetImageProperty ( image, "label", exception ) ; draw_info = CloneDrawInfo ( image_info, ( DrawInfo * ) NULL ) ; draw_info -> text = ConstantString ( label ) ; metrics. width = 0 ; metrics. ascent = 0.0 ; status = GetMultilineTypeMetrics ( image, draw_info, & metrics, exception ) ; if ( ( image -> columns == 0 ) && ( image -> rows == 0 ) ) { <START_BUG> image -> columns = ( size_t ) ( metrics. width + draw_info -> stroke_width + 0.5 ) ; <END_BUG> image -> rows = ( size_t ) floor ( metrics. height + draw_info -> stroke_width + 0.5 ) ; } else if ( ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) || ( fabs ( image_info -> pointsize ) < MagickEpsilon ) ) { double high, low ; for ( ; ; draw_info -> pointsize *= 2.0 ) { ( void ) FormatLocaleString ( geometry, MagickPathExtent, "%+g%+g", - metrics. bounds. x1, metrics. ascent ) ; if ( draw_info -> gravity

Fix:
<S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor
Buggy code:
 static int ext4_get_block_write ( struct inode * inode, sector_t iblock, struct buffer_head * bh_result, int create ) { <START_BUG> handle_t * handle = NULL ; <END_BUG> int ret = 0 ; unsigned max_blocks = bh_result -> b_size >> inode -> i_blkbits ; int dio_credits ;  ext4_debug ( "ext4_get_block_write:   inode   %lu,   create   flag   %d\\n", <START_BUG> inode -> i_ino, create ) ; <END_BUG> create = EXT4_GET_BLOCKS_IO_CREATE_EXT ;  if ( max_blocks > DIO_MAX_BLOCKS ) max_blocks = DIO_MAX_BLOCKS ; dio_credits = ext4_chunk_trans_blocks ( inode, max_blocks ) ; handle = ext4_journal_start ( inode, dio_credits ) ; if ( IS_ERR ( handle ) ) { ret = PTR_ERR ( handle ) ; goto out ; } <START_BUG> ret = ext4_get_blocks ( handle, inode, iblock, max_blocks, bh_result, <END_BUG> create ) ; if ( ret > 0 ) { bh_result -> b_size = ( ret << inode -> i_blkbits ) ; ret = 0 ;  } <START_BUG> ext4_journal_stop ( handle ) ; out : return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> * handle = ext4_journal_current_handle ( ) <S2SV_ModEnd> ; int ret <S2SV_ModStart> int dio_credits ; int started = 0 ; <S2SV_ModStart> = EXT4_GET_BLOCKS_IO_CREATE_EXT ; if (! handle ) { <S2SV_ModStart> out ; } started = 1 ; } <S2SV_ModStart> 0 ; } if ( started )
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG> int i ; fprintf ( stderr, "Usage:   %s   <options>   filename\\n\\n" "Options:\\n", exec_name ) ; arg_show_usage ( stderr, all_args ) ; # if CONFIG_VP8_DECODER fprintf ( stderr, "\\nVP8   Postprocessing   Options:\\n" ) ; arg_show_usage ( stderr, vp8_pp_args ) ; # endif fprintf ( stderr, "\\nOutput   File   Patterns:\\n\\n" "     The   -o   argument   specifies   the   name   of   the   file(s)   to   " "write   to.   If   the\\n     argument   does   not   include   any   escape   " "characters,   the   output   will   be\\n     written   to   a   single   file.   " "Otherwise,   the   filename   will   be   calculated   by\\n     expanding   " "the   following   escape   characters:\\n" ) ; fprintf ( stderr, "\\n\\t%%w       -   Frame   width" "\\n\\t%%h       -   Frame   height" "\\n\\t%%<n>   -   Frame   number,   zero   padded   to   <n>   places   (1..9)" "\\n\\n     Pattern   arguments   are   only   supported   in   conjunction   " "with   the   --yv12   and\\n     --i420   options.   If   the   -o   option   is   " "not   specified,   the   output   will   be\\n     directed   to   stdout.\\n" ) ; fprintf ( stderr, "\\nIncluded   decoders:\\n\\n" ) ; for ( i = 0 ; i < get_vpx_decoder_count ( ) ; ++ i ) { const VpxInterface * const decoder = get_vpx_decoder_by_index ( i ) ; fprintf ( stderr, "         %-6s   -   %s\\n",  decoder -> name, vpx_codec_iface_name ( decoder -> interface ( ) ) ) ; <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> void usage_exit ( void <S2SV_ModStart> ( decoder -> codec_interface <S2SV_ModEnd> ( ) )
Buggy code:
 static unsigned int help ( struct sk_buff * skb, enum ip_conntrack_info ctinfo, unsigned int protoff, unsigned int matchoff, unsigned int matchlen, struct nf_conntrack_expect * exp ) { char buffer [ sizeof ( "4294967296   65635" ) ] ; <START_BUG> u_int16_t port ; <END_BUG>  unsigned int ret ; <START_BUG> exp -> saved_proto. tcp. port = exp -> tuple. dst. u. tcp. port ; exp -> dir = IP_CT_DIR_REPLY ; exp -> expectfn = nf_nat_follow_master ; for ( port = ntohs ( exp -> saved_proto. tcp. port ) ; port!= 0 ; port ++ ) { int ret ; exp -> tuple. dst. u. tcp. port = htons ( port ) ; ret = nf_ct_expect_related ( exp ) ; if ( ret == 0 ) break ; else if ( ret!= - EBUSY ) { port = 0 ; break ; } } if ( port == 0 ) { <END_BUG> nf_ct_helper_log ( skb, exp -> master, "all   ports   in   use" ) ;  return NF_DROP ; } <START_BUG> ret = nf_nat_mangle_tcp_packet ( skb, exp -> master, ctinfo, <END_BUG> protoff, matchoff, matchlen, buffer, strlen ( buffer ) ) ; if ( ret!= NF_ACCEPT ) {  nf_ct_helper_log ( skb, exp -> master, "cannot   mangle   packet" ) ; <START_BUG> nf_ct_unexpect_related ( exp ) ; } return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ] ; struct nf_conn * ct = exp -> master ; union nf_inet_addr newaddr ; <S2SV_ModStart> unsigned int ret ; newaddr = ct -> tuplehash [ IP_CT_DIR_REPLY ]. tuple. dst. u3 <S2SV_ModStart> ( skb, ct <S2SV_ModEnd>, "all <S2SV_blank> ports <S2SV_blank> in <S2SV_blank> use" ) <S2SV_ModStart> NF_DROP ; } snprintf ( buffer, sizeof ( buffer ), "%u <S2SV_blank> %u", ntohl ( newaddr. ip ), port ) ; pr_debug ( "nf_nat_irc: <S2SV_blank> inserting <S2SV_blank> \'%s\' <S2SV_blank> == <S2SV_blank> %pI4, <S2SV_blank> port <S2SV_blank> %u\\n", buffer, & newaddr. ip, port ) ; <S2SV_ModStart> ( skb, ct <S2SV_ModEnd>, ctinfo, <S2SV_ModStart> ( skb, ct <S2SV_ModEnd>, "cannot <S2SV_blank> mangle <S2SV_blank> packet" )
Buggy code:
 static ExprList * exprListAppendList ( Parse * pParse, ExprList * pList, ExprList * pAppend, int bIntToNull ) { if ( pAppend ) { int i ; int nInit = pList? pList -> nExpr : 0 ; for ( i = 0 ; i < pAppend -> nExpr ; i ++ ) { Expr * pDup = sqlite3ExprDup ( pParse -> db, pAppend -> a [ i ]. pExpr, 0 ) ; <START_BUG> if ( bIntToNull && pDup && pDup -> op == TK_INTEGER ) { <END_BUG> pDup -> op = TK_NULL ;  pDup -> flags &= ~ ( EP_IntValue | EP_IsTrue | EP_IsFalse ) ; <START_BUG> } pList = sqlite3ExprListAppend ( pParse, pList, pDup ) ; if ( pList ) pList -> a [ nInit + i ]. sortFlags = pAppend -> a [ i ]. sortFlags ; } } return pList ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) ; assert ( pDup == 0 ||! ExprHasProperty ( pDup, EP_MemToken ) ) ; <S2SV_ModStart> | EP_IsFalse ) ; pDup -> u. zToken = 0
Buggy code:
 error_t enc28j60Init ( NetInterface * interface ) { uint8_t revisionId ; Enc28j60Context * context ; TRACE_INFO ( "Initializing   ENC28J60   Ethernet   controller...\\r\\n" ) ; interface -> spiDriver -> init ( ) ; interface -> extIntDriver -> init ( ) ; enc28j60SoftReset ( interface ) ; sleep ( 10 ) ; context = ( Enc28j60Context * ) interface -> nicContext ; context -> currentBank = UINT16_MAX ; context -> nextPacket = ENC28J60_RX_BUFFER_START ; context -> rxBuffer = memPoolAlloc ( ETH_MAX_FRAME_SIZE ) ; if ( context -> rxBuffer == NULL ) { return ERROR_OUT_OF_MEMORY ; } <START_BUG> revisionId = enc28j60ReadReg ( interface, ENC28J60_REG_EREVID ) ; <END_BUG> TRACE_INFO ( "ENC28J60   revision   ID:   0x%02X\\r\\n", revisionId ) ;  enc28j60WriteReg ( interface, ENC28J60_REG_ECOCON, 0x00 ) ; <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MAADR1, interface -> macAddr. b [ 0 ] ) ; <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MAADR2, interface -> macAddr. b [ 1 ] ) ;  <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MAADR3, interface -> macAddr. b [ 2 ] ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_MAADR4, interface -> macAddr. b [ 3 ] ) ; <START_BUG> <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MAADR5, interface -> macAddr. b [ 4 ] ) ;  <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MAADR6, interface -> macAddr. b [ 5 ] ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_ERXSTL, LSB ( ENC28J60_RX_BUFFER_START ) ) ; <START_BUG> <END_BUG> enc

Fix:
<S2SV_ModStart> ( interface, ENC28J60_EREVID <S2SV_ModEnd> ) ; TRACE_INFO <S2SV_ModStart> ( interface, ENC28J60_ECOCON, ENC28J60_ECOCON_COCON_DISABLED ) ; enc28j60WriteReg ( interface, ENC28J60_MAADR5 <S2SV_ModEnd>, interface -> <S2SV_ModStart> ( interface, ENC28J60_MAADR4 <S2SV_ModEnd>, interface -> <S2SV_ModStart> ( interface, ENC28J60_MAADR3 <S2SV_ModEnd>, interface -> <S2SV_ModStart> ( interface, ENC28J60_MAADR2 <S2SV_ModEnd>, interface -> <S2SV_ModStart> ( interface, ENC28J60_MAADR1 <S2SV_ModEnd>, interface -> <S2SV_ModStart> ( interface, ENC28J60_MAADR0 <S2SV_ModEnd>, interface -> <S2SV_ModStart> ( interface, ENC28J60_ERXSTL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_ERXSTH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_ERXNDL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_ERXNDH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_ERXRDPTL <S2SV_ModEnd>,
Buggy code:
 agooCon agoo_con_create ( agooErr err, int sock, uint64_t id, agooBind b ) { agooCon c ; if ( NULL == ( c = ( agooCon ) AGOO_CALLOC ( 1, sizeof ( struct _agooCon ) ) ) ) { AGOO_ERR_MEM ( err, "Connection" ) ; } else { <START_BUG> c -> sock = sock ; <END_BUG> c -> id = id ; c -> timeout = dtime ( ) + CON_TIMEOUT ; c -> bind = b ; c -> loop = NULL ; pthread_mutex_init ( & c -> res_lock, 0 ) ; } return c ; }

Fix:
<S2SV_ModStart> } else { struct sockaddr_storage addr ; socklen_t len = sizeof ( addr ) ; getpeername ( sock, ( struct sockaddr * ) & addr, & len ) ; if ( addr. ss_family == AF_INET ) { struct sockaddr_in * s = ( struct sockaddr_in * ) & addr ; inet_ntop ( AF_INET, & s -> sin_addr, c -> remote, sizeof ( c -> remote ) ) ; } else { struct sockaddr_in6 * s = ( struct sockaddr_in6 * ) & addr ; inet_ntop ( AF_INET6, & s -> sin6_addr, c -> remote, sizeof ( c -> remote ) ) ; }
Buggy code:
 matvar_t * Mat_VarReadNextInfo4 ( mat_t * mat ) { int M, O, data_type, class_type ; mat_int32_t tmp ; long nBytes ; size_t readresult ; matvar_t * matvar = NULL ; union { mat_uint32_t u ; mat_uint8_t c [ 4 ] ; } endian ; if ( mat == NULL || mat -> fp == NULL ) return NULL ; else if ( NULL == ( matvar = Mat_VarCalloc ( ) ) ) return NULL ; readresult = fread ( & tmp, sizeof ( int ), 1, ( FILE * ) mat -> fp ) ; if ( 1!= readresult ) { Mat_VarFree ( matvar ) ; return NULL ; } endian. u = 0x01020304 ; if ( tmp < 0 || tmp > 4052 ) { if ( Mat_int32Swap ( & tmp ) > 4052 ) { Mat_VarFree ( matvar ) ; return NULL ; } } M = ( int ) floor ( tmp // 1000.0 ) ; switch ( M ) { case 0 : mat -> byteswap = endian. c [ 0 ]!= 4 ; break ; case 1 : mat -> byteswap = endian. c [ 0 ]!= 1 ; break ; default : Mat_VarFree ( matvar ) ; return NULL ; } tmp -= M * 1000 ; O = ( int ) floor ( tmp // 100.0 ) ; if ( 0!= O ) { Mat_VarFree ( matvar ) ; return NULL ; } tmp -= O * 100 ; data_type = ( int ) floor ( tmp // 10.0 ) ; switch ( data_type ) { case 0 : matvar -> data_type = MAT_T_DOUBLE ; break ; case 1 : matvar -> data_type = MAT_T_SINGLE ; break ; case 2 : matvar -> data_type = MAT_T_INT32 ; break ; case 3 : matvar -> data_type = MAT_T_INT16 ; break ; case 4 : matvar -> data_type = MAT_T_UINT16 ; break ; case 5 : matvar -> data_type = MAT_T_UINT8 ; break ; default : Mat_VarFree ( matvar ) ; return NULL ; } tmp -= data_type * 10

Fix:
<S2SV_ModStart> NULL ; } else { matvar -> name [ tmp - 1 ] = '\\0' ; }
Buggy code:
 static void ptrace_link ( struct task_struct * child, struct task_struct * new_parent ) { <START_BUG> rcu_read_lock ( ) ; <END_BUG>  __ptrace_link ( child, new_parent, __task_cred ( new_parent ) ) ; <START_BUG> rcu_read_unlock ( ) ; }<END_BUG>

Fix:
<S2SV_ModStart> new_parent ) { <S2SV_ModEnd> __ptrace_link ( child <S2SV_ModStart>, new_parent, current_cred ( ) <S2SV_ModEnd> ) ; }
Buggy code:
 static void slc_bump ( struct slcan * sl ) { struct sk_buff * skb ; struct can_frame cf ; int i, tmp ; u32 tmpid ; char * cmd = sl -> rbuff ; <START_BUG> cf. can_id = 0 ; <END_BUG> switch ( * cmd ) { case 'r' : cf. can_id = CAN_RTR_FLAG ; case 't' : cf. can_dlc = sl -> rbuff [ SLC_CMD_LEN + SLC_SFF_ID_LEN ] ; sl -> rbuff [ SLC_CMD_LEN + SLC_SFF_ID_LEN ] = 0 ; cmd += SLC_CMD_LEN + SLC_SFF_ID_LEN + 1 ; break ; case 'R' : cf. can_id = CAN_RTR_FLAG ; case 'T' : cf. can_id |= CAN_EFF_FLAG ; cf. can_dlc = sl -> rbuff [ SLC_CMD_LEN + SLC_EFF_ID_LEN ] ; sl -> rbuff [ SLC_CMD_LEN + SLC_EFF_ID_LEN ] = 0 ; cmd += SLC_CMD_LEN + SLC_EFF_ID_LEN + 1 ; break ; default : return ; } if ( kstrtou32 ( sl -> rbuff + SLC_CMD_LEN, 16, & tmpid ) ) return ; cf. can_id |= tmpid ; if ( cf. can_dlc >= '0' && cf. can_dlc < '9' ) cf. can_dlc -= '0' ; else return ;  * ( u64 * ) ( & cf. data ) = 0 ; <START_BUG> if (! ( cf. can_id & CAN_RTR_FLAG ) ) { for ( i = 0 ; i < cf. can_dlc ; i ++ ) { tmp = hex_to_bin ( * cmd ++ ) ; if ( tmp < 0 ) return ; cf. data [ i ] = ( tmp << 4 ) ; tmp = hex_to_bin ( * cmd ++ ) ; if ( tmp < 0 ) return ; cf. data [ i ] |= tmp ; } } skb = dev_alloc_skb ( sizeof ( struct can_frame ) + sizeof ( struct can_skb_priv ) ) ;<END_BUG>

Fix:
<S2SV_ModStart> -> rbuff ; memset ( & cf, 0, sizeof ( cf ) ) <S2SV_ModEnd> ; switch ( <S2SV_ModStart> else return ; <S2SV_ModEnd> if (!
Buggy code:
 static int forward_search_range ( regex_t * reg, const UChar * str, const UChar * end, UChar * s, UChar * range, UChar * * low, UChar * * high, UChar * * low_prev ) { UChar * p, * pprev = ( UChar * ) NULL ; # ifdef ONIG_DEBUG_SEARCH fprintf ( stderr, "forward_search_range:   str:   %d,   end:   %d,   s:   %d,   range:   %d\\n", ( int ) str, ( int ) end, ( int ) s, ( int ) range ) ; # endif p = s ; if ( reg -> dmin > 0 ) { if ( ONIGENC_IS_SINGLEBYTE ( reg -> enc ) ) { p += reg -> dmin ; } else { UChar * q = p + reg -> dmin ; if ( q >= end ) return 0 ; while ( p < q ) p += enclen ( reg -> enc, p ) ; } } retry : switch ( reg -> optimize ) { case ONIG_OPTIMIZE_EXACT : p = slow_search ( reg -> enc, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_EXACT_IC : p = slow_search_ic ( reg -> enc, reg -> case_fold_flag, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_EXACT_BM : p = bm_search ( reg, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_EXACT_BM_NOT_REV : p = bm_search_notrev ( reg, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_MAP : p = map_search ( reg -> enc, reg -> map, p, range ) ; break ; } if ( p && p < range ) { if ( p - reg -> dmin < s ) { retry_gate : pprev = p ; p += enclen ( reg -> enc, p ) ; goto retry ; } if ( reg ->

Fix:
<S2SV_ModStart> ONIG_INFINITE_DISTANCE ) { if ( p - str < reg -> dmax ) { * low = ( UChar * ) str ; if ( low_prev ) * low_prev = onigenc_get_prev_char_head ( reg -> enc, str, * low ) ; } else { <S2SV_ModStart> low ) ; }
Buggy code:
 static int skcipher_accept_parent ( void * private, struct sock * sk ) { struct skcipher_ctx * ctx ; struct alg_sock * ask = alg_sk ( sk ) ; <START_BUG> unsigned int len = sizeof ( * ctx ) + crypto_skcipher_reqsize ( private ) ; <END_BUG> ctx = sock_kmalloc ( sk, len, GFP_KERNEL ) ; if (! ctx ) return - ENOMEM ;  ctx -> iv = sock_kmalloc ( sk, crypto_skcipher_ivsize ( private ), <START_BUG> GFP_KERNEL ) ; if (! ctx -> iv ) { sock_kfree_s ( sk, ctx, len ) ; return - ENOMEM ; } <END_BUG> memset ( ctx -> iv, 0, crypto_skcipher_ivsize ( private ) ) ;  INIT_LIST_HEAD ( & ctx -> tsgl ) ; ctx -> len = len ; ctx -> used = 0 ; ctx -> more = 0 ; ctx -> merge = 0 ; ctx -> enc = 0 ; atomic_set ( & ctx -> inflight, 0 ) ; af_alg_init_completion ( & ctx -> completion ) ; ask -> private = ctx ; <START_BUG> skcipher_request_set_tfm ( & ctx -> req, private ) ; <END_BUG> skcipher_request_set_callback ( & ctx -> req, CRYPTO_TFM_REQ_MAY_BACKLOG, af_alg_complete, & ctx -> completion ) ; sk -> sk_destruct = skcipher_sock_destruct ; return 0 ; }

Fix:
<S2SV_ModStart> sk ) ; struct skcipher_tfm * tfm = private ; struct crypto_skcipher * skcipher = tfm -> skcipher ; <S2SV_ModStart> + crypto_skcipher_reqsize ( skcipher ) ; if (! tfm -> has_key ) return - ENOKEY <S2SV_ModEnd> ; ctx = <S2SV_ModStart>, crypto_skcipher_ivsize ( skcipher <S2SV_ModEnd> ), GFP_KERNEL <S2SV_ModStart>, crypto_skcipher_ivsize ( skcipher ) ) ; INIT_LIST_HEAD ( & ctx -> tsgl ) ; ctx -> len = len ; ctx -> used = 0 ; ctx -> more = 0 ; ctx -> merge = 0 ; ctx -> enc = 0 ; atomic_set ( & ctx -> inflight, 0 ) ; af_alg_init_completion ( & ctx -> completion ) ; ask -> private <S2SV_ModEnd> = ctx ; <S2SV_ModStart> -> req, skcipher <S2SV_ModEnd> ) ; skcipher_request_set_callback
Buggy code:
 static u_int16_t concat_hash_string ( struct ndpi_packet_struct * packet, char * buf, u_int8_t client_hash ) { <START_BUG> u_int16_t offset = 22, buf_out_len = 0 ; <END_BUG> if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; u_int32_t len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ; offset += 4 ; if ( ( offset >= packet -> payload_packet_len ) || ( len >= packet -> payload_packet_len - offset - 1 ) ) goto invalid_payload ; strncpy ( buf, ( const char * ) & packet -> payload [ offset ], buf_out_len = len ) ; buf [ buf_out_len ++ ] = ';' ; offset += len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ;  offset += 4 + len ; <START_BUG> if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ; <END_BUG> if ( client_hash ) {  <START_BUG> offset += 4 ; <END_BUG> if ( ( offset >= packet -> payload_packet_len ) || ( len >= packet -> payload_packet_len - offset - 1 ) ) goto invalid_payload ; strncpy ( & buf [ buf_out_len ], ( const char * ) & packet -> payload [ offset ], len ) ; buf_out_len += len ; buf [ buf_out_len ++ ] = ';' ;  offset += len ; <START_BUG> } else offset += 4 + len ; if ( offset + sizeof ( u_int32_t ) >= packet -> payload_packet_len ) goto invalid_payload ; len = ntohl ( * ( u_int32_t * ) & packet -> payload [ offset ] ) ; <END_BUG> if (! client_hash ) {  <START_BUG> offset += 4 ; <END_BUG> if ( ( offset >= packet -> payload_packet_len )

Fix:
<S2SV_ModStart> client_hash ) { u_int32_t <S2SV_ModEnd> offset = 22 <S2SV_ModStart> ] ) ; if ( len > UINT32_MAX - 4 - offset ) goto invalid_payload ; <S2SV_ModStart> ] ) ; offset += 4 ; <S2SV_ModStart> client_hash ) { <S2SV_ModEnd> if ( ( <S2SV_ModStart> = ';' ; } if ( len > UINT32_MAX - offset ) goto invalid_payload ; offset += <S2SV_ModEnd> len ; if <S2SV_ModStart> ] ) ; offset += 4 ; <S2SV_ModStart> client_hash ) { <S2SV_ModEnd> if ( ( <S2SV_ModStart> = ';' ; } if ( len > UINT32_MAX - offset ) goto invalid_payload ; offset += <S2SV_ModEnd> len ; if <S2SV_ModStart> ] ) ; offset += 4 ; <S2SV_ModStart> client_hash ) { <S2SV_ModEnd> if ( ( <S2SV_ModStart> = ';' ; } if ( len > UINT32_MAX - offset ) goto invalid_payload ; offset += <S2SV_ModEnd> len ; if <S2SV_ModStart> ] ) ; offset += 4 ; <S2SV_ModStart> client_hash ) { <S2SV_ModEnd> if ( ( <S2SV_ModStart> = ';' ; } if ( len > UINT32_MAX - offset ) goto invalid_payload ; offset += <S2SV_ModEnd> len ; if <S2SV_ModStart> ] ) ; offset += 4 ; <S2SV_ModStart> client_hash ) { <S2SV_ModEnd> if ( ( <S2SV_ModStart> += len ; } if ( len > UINT32_MAX - offset ) goto
Buggy code:
 static int perf_swevent_init ( struct perf_event * event ) { <START_BUG> int event_id = event -> attr. config ; <END_BUG> if ( event -> attr. type!= PERF_TYPE_SOFTWARE ) return - ENOENT ; if ( has_branch_stack ( event ) ) return - EOPNOTSUPP ; switch ( event_id ) { case PERF_COUNT_SW_CPU_CLOCK : case PERF_COUNT_SW_TASK_CLOCK : return - ENOENT ; default : break ; } if ( event_id >= PERF_COUNT_SW_MAX ) return - ENOENT ; if (! event -> parent ) { int err ; err = swevent_hlist_get ( event ) ; if ( err ) return err ; static_key_slow_inc ( & perf_swevent_enabled [ event_id ] ) ; event -> destroy = sw_perf_event_destroy ; } return 0 ; }

Fix:
<S2SV_ModStart> event ) { u64 <S2SV_ModEnd> event_id = event
Buggy code:
 static int adis_update_scan_mode_burst ( struct iio_dev * indio_dev, const unsigned long * scan_mask ) { struct adis * adis = iio_device_get_drvdata ( indio_dev ) ; unsigned int burst_length ; u8 * tx ; burst_length = ( indio_dev -> num_channels - 1 ) * sizeof ( u16 ) ; burst_length += adis -> burst -> extra_len ; adis -> xfer = kcalloc ( 2, sizeof ( * adis -> xfer ), GFP_KERNEL ) ; if (! adis -> xfer ) return - ENOMEM ; adis -> buffer = kzalloc ( burst_length + sizeof ( u16 ), GFP_KERNEL ) ; <START_BUG> if (! adis -> buffer ) <END_BUG> return - ENOMEM ;  tx = adis -> buffer + burst_length ; <START_BUG> tx [ 0 ] = ADIS_READ_REG ( adis -> burst -> reg_cmd ) ; tx [ 1 ] = 0 ; adis -> xfer [ 0 ]. tx_buf = tx ; adis -> xfer [ 0 ]. bits_per_word = 8 ; adis -> xfer [ 0 ]. len = 2 ; adis -> xfer [ 1 ]. rx_buf = adis -> buffer ; adis -> xfer [ 1 ]. bits_per_word = 8 ; adis -> xfer [ 1 ]. len = burst_length ; spi_message_init ( & adis -> msg ) ; spi_message_add_tail ( & adis -> xfer [ 0 ], & adis -> msg ) ; spi_message_add_tail ( & adis -> xfer [ 1 ], & adis -> msg ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> buffer ) { kfree ( adis -> xfer ) ; adis -> xfer = NULL ; <S2SV_ModStart> - ENOMEM ; }
Buggy code:
 rfbBool HandleRFBServerMessage ( rfbClient * client ) { rfbServerToClientMsg msg ; if ( client -> serverPort == - 1 ) client -> vncRec -> readTimestamp = TRUE ; if (! ReadFromRFBServer ( client, ( char * ) & msg, 1 ) ) return FALSE ; switch ( msg. type ) { case rfbSetColourMapEntries : { break ; } case rfbFramebufferUpdate : { rfbFramebufferUpdateRectHeader rect ; int linesToRead ; int bytesPerLine ; int i ; if (! ReadFromRFBServer ( client, ( ( char * ) & msg. fu ) + 1, sz_rfbFramebufferUpdateMsg - 1 ) ) return FALSE ; msg. fu. nRects = rfbClientSwap16IfLE ( msg. fu. nRects ) ; for ( i = 0 ; i < msg. fu. nRects ; i ++ ) { if (! ReadFromRFBServer ( client, ( char * ) & rect, sz_rfbFramebufferUpdateRectHeader ) ) return FALSE ; rect. encoding = rfbClientSwap32IfLE ( rect. encoding ) ; if ( rect. encoding == rfbEncodingLastRect ) break ; rect. r. x = rfbClientSwap16IfLE ( rect. r. x ) ; rect. r. y = rfbClientSwap16IfLE ( rect. r. y ) ; rect. r. w = rfbClientSwap16IfLE ( rect. r. w ) ; rect. r. h = rfbClientSwap16IfLE ( rect. r. h ) ; if ( rect. encoding == rfbEncodingXCursor || rect. encoding == rfbEncodingRichCursor ) { if (! HandleCursorShape ( client, rect. r. x, rect. r. y, rect. r. w, rect. r. h, rect. encoding ) ) { return FALSE ; } continue ; } if ( rect. encoding == rfbEncodingPointerPos ) { if (! client -> HandleCursorPos ( client, rect. r. x, rect. r. y ) ) { return FALSE ; } continue ; } if ( rect. encoding == rfbEncodingKeyboardLedState ) { client -> KeyboardLedStateEnabled = 1 ; if ( client -> HandleKeyboardLedState!= NULL ) client -> HandleKeyboardLedState ( client, rect. r.

Fix:
<S2SV_ModStart> length ) ; if ( msg. sct. length > 1 << 20 ) { rfbClientErr ( "Ignoring <S2SV_blank> too <S2SV_blank> big <S2SV_blank> cut <S2SV_blank> text <S2SV_blank> length <S2SV_blank> sent <S2SV_blank> by <S2SV_blank> server: <S2SV_blank> %u <S2SV_blank> B <S2SV_blank> > <S2SV_blank> 1 <S2SV_blank> MB\\n", ( unsigned int ) msg. sct. length ) ; return FALSE ; }
Buggy code:
 static int nci_extract_activation_params_iso_dep ( struct nci_dev * ndev, struct nci_rf_intf_activated_ntf * ntf, __u8 * data ) { struct activation_params_nfca_poll_iso_dep * nfca_poll ; struct activation_params_nfcb_poll_iso_dep * nfcb_poll ; switch ( ntf -> activation_rf_tech_and_mode ) { case NCI_NFC_A_PASSIVE_POLL_MODE : nfca_poll = & ntf -> activation_params. nfca_poll_iso_dep ; <START_BUG> nfca_poll -> rats_res_len = * data ++ ; <END_BUG> pr_debug ( "rats_res_len   %d\\n", nfca_poll -> rats_res_len ) ; if ( nfca_poll -> rats_res_len > 0 ) { memcpy ( nfca_poll -> rats_res, data, nfca_poll -> rats_res_len ) ; } break ; case NCI_NFC_B_PASSIVE_POLL_MODE : nfcb_poll = & ntf -> activation_params. nfcb_poll_iso_dep ;  nfcb_poll -> attrib_res_len = * data ++ ; <START_BUG> pr_debug ( "attrib_res_len   %d\\n", nfcb_poll -> attrib_res_len ) ; if ( nfcb_poll -> attrib_res_len > 0 ) { memcpy ( nfcb_poll -> attrib_res, data, nfcb_poll -> attrib_res_len ) ; } break ; default : pr_err ( "unsupported   activation_rf_tech_and_mode   0x%x\\n", ntf -> activation_rf_tech_and_mode ) ; return NCI_STATUS_RF_PROTOCOL_ERROR ; } return NCI_STATUS_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> -> rats_res_len = min_t ( __u8, <S2SV_ModStart> * data ++, 20 ) <S2SV_ModStart> -> attrib_res_len = min_t ( __u8, <S2SV_ModStart> * data ++, 50 )
Buggy code:
 void mpls_print ( netdissect_options * ndo, const u_char * bp, u_int length ) { const u_char * p ; uint32_t label_entry ; uint16_t label_stack_depth = 0 ; enum mpls_packet_type pt = PT_UNKNOWN ; p = bp ; ND_PRINT ( ( ndo, "MPLS" ) ) ; do { ND_TCHECK2 ( * p, sizeof ( label_entry ) ) ; if ( length < sizeof ( label_entry ) ) { ND_PRINT ( ( ndo, "[|MPLS],   length   %u", length ) ) ; return ; } label_entry = EXTRACT_32BITS ( p ) ; ND_PRINT ( ( ndo, "%s(label   %u", ( label_stack_depth && ndo -> ndo_vflag )? "\\n\\t" : "   ", MPLS_LABEL ( label_entry ) ) ) ; label_stack_depth ++ ; if ( ndo -> ndo_vflag && MPLS_LABEL ( label_entry ) < sizeof ( mpls_labelname ) // sizeof ( mpls_labelname [ 0 ] ) ) ND_PRINT ( ( ndo, "   (%s)", mpls_labelname [ MPLS_LABEL ( label_entry ) ] ) ) ; ND_PRINT ( ( ndo, ",   exp   %u", MPLS_EXP ( label_entry ) ) ) ; if ( MPLS_STACK ( label_entry ) ) ND_PRINT ( ( ndo, ",   [S]" ) ) ; ND_PRINT ( ( ndo, ",   ttl   %u)", MPLS_TTL ( label_entry ) ) ) ; p += sizeof ( label_entry ) ; length -= sizeof ( label_entry ) ; } while (! MPLS_STACK ( label_entry ) ) ; switch ( MPLS_LABEL ( label_entry ) ) { case 0 : case 3 : pt = PT_IPV4 ; break ; case 2 : pt = PT_IPV6 ; break ; default : ND_TCHECK ( * p ) ; if ( length < 1 ) { return ; } switch ( * p ) { case 0x45 : case 0x46 : case 0x47

Fix:
<S2SV_ModStart> p, length <S2SV_ModEnd> ) ; break
Buggy code:
 static Image * ReadFITSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct _FITSInfo { MagickBooleanType extend, simple ; int bits_per_pixel, columns, rows, number_axes, number_planes ; double min_data, max_data, zero, scale ; EndianType endian ; } FITSInfo ; char * comment, keyword [ 9 ], property [ MaxTextExtent ], value [ 73 ] ; double pixel, scale ; FITSInfo fits_info ; Image * image ; int c ; MagickBooleanType status ; MagickSizeType number_pixels ; register ssize_t i, x ; register PixelPacket * q ; ssize_t count, scene, y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & fits_info, 0, sizeof ( fits_info ) ) ; fits_info. extend = MagickFalse ; fits_info. simple = MagickFalse ; fits_info. bits_per_pixel = 8 ; fits_info. columns = 1 ; fits_info. rows = 1 ; fits_info. rows = 1 ; fits_info. number_planes = 1 ; fits_info. min_data = 0.0 ; fits_info. max_data = 0.0 ; fits_info. zero = 0.0 ; fits_info. scale = 1.0 ; fits_info. endian = MSBEndian ; for ( comment = ( char * ) NULL ; EOFBlob ( image ) == MagickFalse ; ) { for ( ; EOFBlob ( image ) == MagickFalse ; ) { register char * p ; count = ReadBlob ( image, 8, ( unsigned char

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }