nus-yam/ex-repair huggingface dataset:
Buggy code:
 int vp9_rc_drop_frame ( VP9_COMP * cpi ) { <START_BUG> const VP9_CONFIG * oxcf = & cpi -> oxcf ; <END_BUG> RATE_CONTROL * const rc = & cpi -> rc ; if (! oxcf -> drop_frames_water_mark ) { return 0 ; } else { if ( rc -> buffer_level < 0 ) { return 1 ; } else { int drop_mark = ( int ) ( oxcf -> drop_frames_water_mark *  oxcf -> optimal_buffer_level // 100 ) ; <START_BUG> if ( ( rc -> buffer_level > drop_mark ) && ( rc -> decimation_factor > 0 ) ) { -- rc -> decimation_factor ; } else if ( rc -> buffer_level <= drop_mark && rc -> decimation_factor == 0 ) { rc -> decimation_factor = 1 ; } if ( rc -> decimation_factor > 0 ) { if ( rc -> decimation_count > 0 ) { -- rc -> decimation_count ; return 1 ; } else { rc -> decimation_count = rc -> decimation_factor ; return 0 ; } } else { rc -> decimation_count = 0 ; return 0 ; } } } }<END_BUG>

Fix:
<S2SV_ModStart> ) { const VP9EncoderConfig <S2SV_ModEnd> * oxcf = <S2SV_ModStart> -> drop_frames_water_mark * rc <S2SV_ModEnd> -> optimal_buffer_level //
Buggy code:
 static void process_secondary_order ( STREAM s ) { uint16 length ; uint16 flags ; uint8 type ; uint8 * next_order ; <START_BUG> in_uint16_le ( s, length ) ; <END_BUG> in_uint16_le ( s, flags ) ;  in_uint8 ( s, type ) ; <START_BUG> next_order = s -> p + ( sint16 ) length + 7 ; switch ( type ) { case RDP_ORDER_RAW_BMPCACHE : process_raw_bmpcache ( s ) ; break ; case RDP_ORDER_COLCACHE : process_colcache ( s ) ; break ; case RDP_ORDER_BMPCACHE : process_bmpcache ( s ) ; break ; case RDP_ORDER_FONTCACHE : process_fontcache ( s ) ; break ; case RDP_ORDER_RAW_BMPCACHE2 : process_bmpcache2 ( s, flags, False ) ; break ; case RDP_ORDER_BMPCACHE2 : process_bmpcache2 ( s, flags, True ) ; break ; case RDP_ORDER_BRUSHCACHE : process_brushcache ( s, flags ) ; break ; default : logger ( Graphics, Warning, "process_secondary_order(),   unhandled   secondary   order   %d", type ) ; } s -> p = next_order ; }<END_BUG>

Fix:
<S2SV_ModStart> * next_order ; struct stream packet = * s ; <S2SV_ModStart> type ) ; if (! s_check_rem ( s, length + 7 ) ) { rdp_protocol_error ( "process_secondary_order(), <S2SV_blank> next <S2SV_blank> order <S2SV_blank> pointer <S2SV_blank> would <S2SV_blank> overrun <S2SV_blank> stream", & packet ) ; }
Buggy code:
 char * _multi_string_alloc_and_copy ( LPCWSTR in ) { char * chr ; int len = 0 ; if (! in ) { <START_BUG> return in ; <END_BUG> } while ( in [ len ]!= 0 || in [ len + 1 ]!= 0 ) { len ++ ; } chr = malloc ( len + 2 ) ; len = 0 ; while ( in [ len ]!= 0 || in [ len + 1 ]!= 0 ) { chr [ len ] = 0xFF & in [ len ] ; len ++ ; } chr [ len ++ ] = '\\0' ; chr [ len ++ ] = '\\0' ; return chr ; }

Fix:
<S2SV_ModStart> ) { return NULL <S2SV_ModEnd> ; } while
Buggy code:
 static int dccp_v6_connect ( struct sock * sk, struct sockaddr * uaddr, int addr_len ) { struct sockaddr_in6 * usin = ( struct sockaddr_in6 * ) uaddr ; struct inet_connection_sock * icsk = inet_csk ( sk ) ; struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct dccp_sock * dp = dccp_sk ( sk ) ; <START_BUG> struct in6_addr * saddr = NULL, * final_p, final ; <END_BUG> struct flowi6 fl6 ; struct dst_entry * dst ; int addr_type ; int err ; dp -> dccps_role = DCCP_ROLE_CLIENT ; if ( addr_len < SIN6_LEN_RFC2133 ) return - EINVAL ; if ( usin -> sin6_family!= AF_INET6 ) return - EAFNOSUPPORT ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; if ( np -> sndflow ) { fl6. flowlabel = usin -> sin6_flowinfo & IPV6_FLOWINFO_MASK ; IP6_ECN_flow_init ( fl6. flowlabel ) ; if ( fl6. flowlabel & IPV6_FLOWLABEL_MASK ) { struct ip6_flowlabel * flowlabel ; flowlabel = fl6_sock_lookup ( sk, fl6. flowlabel ) ; if ( flowlabel == NULL ) return - EINVAL ; fl6_sock_release ( flowlabel ) ; } } if ( ipv6_addr_any ( & usin -> sin6_addr ) ) usin -> sin6_addr. s6_addr [ 15 ] = 1 ; addr_type = ipv6_addr_type ( & usin -> sin6_addr ) ; if ( addr_type & IPV6_ADDR_MULTICAST ) return - ENETUNREACH ; if ( addr_type & IPV6_ADDR_LINKLOCAL ) { if ( addr_len >= sizeof ( struct sockaddr_in6 ) && usin -> sin6_scope_id ) { if ( sk -> sk_bound_dev_if && sk -> sk_bound_dev_if!= usin ->

Fix:
<S2SV_ModStart> final_p, final ; struct ipv6_txoptions * opt <S2SV_ModStart> ) ) ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> & fl6, <S2SV_ModEnd> opt, & <S2SV_ModStart> ; if ( opt <S2SV_ModEnd> ) icsk -> <S2SV_ModStart> -> icsk_ext_hdr_len = <S2SV_ModEnd> opt -> opt_flen <S2SV_ModStart> -> opt_flen + <S2SV_ModEnd> opt -> opt_nflen <S2SV_ModStart> opt -> opt_nflen <S2SV_ModEnd> ; inet ->
Buggy code:
 int l2tp_recv ( int fd, struct l2tp_packet_t * * p, struct in_pktinfo * pkt_info, const char * secret, size_t secret_len ) { <START_BUG> int n, length ; <END_BUG> uint8_t * buf ; struct l2tp_hdr_t * hdr ; struct l2tp_avp_t * avp ;  struct l2tp_dict_attr_t * da ; <START_BUG> <END_BUG> struct l2tp_attr_t * attr, * RV = NULL ;  uint8_t * ptr ; struct l2tp_packet_t * pack ; struct sockaddr_in addr ; <START_BUG> socklen_t len = sizeof ( addr ) ; <END_BUG>  struct msghdr msg ; <START_BUG> char msg_control [ 128 ] ; <END_BUG> struct cmsghdr * cmsg ;  uint16_t orig_avp_len ; void * orig_avp_val ; * p = NULL ; if ( pkt_info ) { memset ( & msg, 0, sizeof ( msg ) ) ; msg. msg_control = msg_control ; <START_BUG> msg. msg_controllen = 128 ; <END_BUG> n = recvmsg ( fd, & msg, MSG_PEEK ) ; if ( n < 0 ) { if ( errno == EAGAIN ) return - 1 ; log_error ( "l2tp:   recvmsg:   %s\\n", strerror ( errno ) ) ; return 0 ; } for ( cmsg = CMSG_FIRSTHDR ( & msg ) ; cmsg!= NULL ; cmsg = CMSG_NXTHDR ( & msg, cmsg ) ) { if ( cmsg -> cmsg_level == IPPROTO_IP && cmsg -> cmsg_type == IP_PKTINFO ) { memcpy ( pkt_info, CMSG_DATA ( cmsg ), sizeof ( * pkt_info ) ) ; break ; } } } buf = mempool_alloc ( buf_pool ) ; if (! buf ) { log_emerg ( "l2tp:   out   of   memory\\n" ) ; return 0 ; } hdr = ( struct l2tp_hdr_t * ) buf ; ptr = ( uint8_t * ) ( hdr + 1 ) ;  n = recvfrom ( fd, buf, L2TP_MAX_PACKET_

Fix:
<S2SV_ModStart> secret_len ) { struct l2tp_packet_t * pack <S2SV_ModEnd> ; struct l2tp_hdr_t <S2SV_ModStart> avp ; struct l2tp_attr_t * <S2SV_ModEnd> RV = NULL <S2SV_ModStart> RV = NULL <S2SV_ModEnd> ; struct sockaddr_in <S2SV_ModStart> addr ; socklen_t addr_len ; uint16_t orig_avp_len ; void * orig_avp_val ; uint8_t * buf, * ptr ; int n, length ; * p = NULL ; if ( pkt_info ) { <S2SV_ModEnd> struct msghdr msg <S2SV_ModStart> struct msghdr msg ; struct cmsghdr * cmsg <S2SV_ModStart> 128 ] ; <S2SV_ModEnd> memset ( & <S2SV_ModStart>. msg_controllen = sizeof ( msg_control ) <S2SV_ModEnd> ; n = <S2SV_ModStart> 1 ) ; addr_len = sizeof ( addr ) ; <S2SV_ModStart> addr, & addr_len <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( n < sizeof ( * hdr ) <S2SV_ModEnd> ) { if <S2SV_ModStart> out_err_hdr ; } hdr -> flags = ntohs ( hdr -> flags ) ; if (! ( hdr -> flags & L2TP_FLAG_T ) <S2SV_ModEnd> ) goto out_err_hdr <S2SV_ModStart> goto out_err_hdr ; if (! ( hdr
Buggy code:
 static int validate_group ( struct perf_event * event ) { struct perf_event * sibling, * leader = event -> group_leader ; struct pmu_hw_events fake_pmu ; DECLARE_BITMAP ( fake_used_mask, ARMPMU_MAX_HWEVENTS ) ; memset ( fake_used_mask, 0, sizeof ( fake_used_mask ) ) ; fake_pmu. used_mask = fake_used_mask ; <START_BUG> if (! validate_event ( & fake_pmu, leader ) ) <END_BUG> return - EINVAL ; list_for_each_entry ( sibling, & leader -> sibling_list, group_entry ) {  if (! validate_event ( & fake_pmu, sibling ) ) <START_BUG> return - EINVAL ; } <END_BUG> if (! validate_event ( & fake_pmu, event ) )  return - EINVAL ; return 0 ; }

Fix:
<S2SV_ModStart>! validate_event ( event -> pmu, <S2SV_ModStart>! validate_event ( event -> pmu, <S2SV_ModStart>! validate_event ( event -> pmu,
Buggy code:
 l_int32 gplotAddPlot ( GPLOT * gplot, NUMA * nax, NUMA * nay, l_int32 plotstyle, const char * plottitle ) { <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> char emptystring [ ] = "" ; char * datastr, * title ; l_int32 n, i ; l_float32 valx, valy, startx, delx ; SARRAY * sa ; PROCNAME ( "gplotAddPlot" ) ; if (! gplot ) return ERROR_INT ( "gplot   not   defined", procName, 1 ) ; if (! nay ) return ERROR_INT ( "nay   not   defined", procName, 1 ) ; if ( plotstyle < 0 || plotstyle >= NUM_GPLOT_STYLES ) return ERROR_INT ( "invalid   plotstyle", procName, 1 ) ; if ( ( n = numaGetCount ( nay ) ) == 0 ) return ERROR_INT ( "no   points   to   plot", procName, 1 ) ; if ( nax && ( n!= numaGetCount ( nax ) ) ) return ERROR_INT ( "nax   and   nay   sizes   differ", procName, 1 ) ; if ( n == 1 && plotstyle == GPLOT_LINES ) { L_INFO ( "only   1   pt;   changing   style   to   points\\n", procName ) ; plotstyle = GPLOT_POINTS ; } numaGetParameters ( nay, & startx, & delx ) ; numaAddNumber ( gplot -> plotstyles, plotstyle ) ; if ( plottitle ) { title = stringNew ( plottitle ) ; sarrayAddString ( gplot -> plottitles, title, L_INSERT ) ; } else { sarrayAddString ( gplot -> plottitles, emptystring, L_COPY ) ; } gplot -> nplots ++ ;  snprintf ( buf, L_BUF_SIZE, "%s.data.%d", gplot -> rootname, gplot -> nplots ) ; <START_BUG> sarrayAddString ( gplot -> datanames, buf, L_COPY ) ; sa = sarrayCreate ( n ) ; for ( i = 0 ; i <<END_BUG>

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.data.%d", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%f <S2SV_blank> %f\\n",
Buggy code:
 int dsOpen ( void ) { struct stat sb ; int retval ; <START_BUG> char * path = server. diskstore_path ; <END_BUG> if ( ( retval = stat ( path, & sb ) == - 1 ) && errno!= ENOENT ) { redisLog ( REDIS_WARNING, "Error   opening   disk   store   at   %s:   %s", path, strerror ( errno ) ) ; return REDIS_ERR ; } if ( retval == 0 && S_ISDIR ( sb. st_mode ) ) return REDIS_OK ; if ( retval == 0 &&! S_ISDIR ( sb. st_mode ) ) { redisLog ( REDIS_WARNING, "Disk   store   at   %s   is   not   a   directory", path ) ; return REDIS_ERR ; } if ( mkdir ( path ) == - 1 ) { redisLog ( REDIS_WARNING, "Disk   store   init   failed   creating   dir   %s:   %s", path, strerror ( errno ) ) ; return REDIS_ERR ; } return REDIS_OK ; }

Fix:
<S2SV_ModStart> = server. ds_path <S2SV_ModEnd> ; if (
Buggy code:
 static int unix_dgram_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock_iocb * siocb = kiocb_to_siocb ( iocb ) ; struct scm_cookie tmp_scm ; struct sock * sk = sock -> sk ; struct unix_sock * u = unix_sk ( sk ) ; int noblock = flags & MSG_DONTWAIT ; struct sk_buff * skb ; int err ; int peeked, skip ; err = - EOPNOTSUPP ; if ( flags & MSG_OOB ) <START_BUG> goto out ; <END_BUG> msg -> msg_namelen = 0 ; err = mutex_lock_interruptible ( & u -> readlock ) ; if ( err ) { err = sock_intr_errno ( sock_rcvtimeo ( sk, noblock ) ) ; goto out ; } skip = sk_peek_offset ( sk, flags ) ; skb = __skb_recv_datagram ( sk, flags, & peeked, & skip, & err ) ; if (! skb ) { unix_state_lock ( sk ) ; if ( sk -> sk_type == SOCK_SEQPACKET && err == - EAGAIN && ( sk -> sk_shutdown & RCV_SHUTDOWN ) ) err = 0 ; unix_state_unlock ( sk ) ; goto out_unlock ; } wake_up_interruptible_sync_poll ( & u -> peer_wait, POLLOUT | POLLWRNORM | POLLWRBAND ) ; if ( msg -> msg_name ) unix_copy_addr ( msg, skb -> sk ) ; if ( size > skb -> len - skip ) size = skb -> len - skip ; else if ( size < skb -> len - skip ) msg -> msg_flags |= MSG_TRUNC ; err = skb_copy_datagram_iovec ( skb, skip, msg -> msg_iov, size ) ; if ( err ) goto out_free ; if ( sock_flag ( sk, SOCK_RCVTSTAMP ) ) __sock_recv_timestamp ( msg, sk, skb ) ; if (! siocb -> scm ) { siocb -> scm = &

Fix:
<S2SV_ModStart> ) goto out <S2SV_ModEnd> ; err =
Buggy code:
 static Image * ReadCALSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char filename [ MagickPathExtent ], header [ MagickPathExtent ], message [ MagickPathExtent ] ; FILE * file ; Image * image ; ImageInfo * read_info ; int c, unique_file ; MagickBooleanType status ; register ssize_t i ; unsigned long density, direction, height, orientation, pel_path, type, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) memset ( header, 0, sizeof ( header ) ) ; density = 0 ; direction = 0 ; orientation = 1 ; pel_path = 0 ; type = 1 ; width = 0 ; height = 0 ; for ( i = 0 ; i < 16 ; i ++ ) { if ( ReadBlob ( image, 128, ( unsigned char * ) header )!= 128 ) break ; switch ( * header ) { case 'R' : case 'r' : { if ( LocaleNCompare ( header, "rdensty:", 8 ) == 0 ) { ( void ) sscanf ( header + 8, "%lu", & density ) ; break ; } if ( LocaleNCompare ( header, "rpelcnt:", 8 ) == 0 ) { ( void ) sscanf ( header + 8, "%lu,%lu", & width, & height ) ; break ; } if ( LocaleNCompare ( header, "rorient:", 8 ) == 0 ) { ( void ) sscanf ( header + 8, "%lu,%lu", & pel_path, & direction ) ; if ( pel_path == 90 ) orientation = 5 ; else if ( pel

Fix:
<S2SV_ModStart>!= EOF ) if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 static int handle_keywordonly_args ( struct compiling * c, const node * n, int start, asdl_seq * kwonlyargs, asdl_seq * kwdefaults ) { PyObject * argname ; node * ch ; expr_ty expression, annotation ; arg_ty arg ; int i = start ; int j = 0 ; if ( kwonlyargs == NULL ) { ast_error ( c, CHILD ( n, start ), "named   arguments   must   follow   bare   *" ) ; return - 1 ; } assert ( kwdefaults!= NULL ) ; while ( i < NCH ( n ) ) { ch = CHILD ( n, i ) ; switch ( TYPE ( ch ) ) { case vfpdef : case tfpdef : if ( i + 1 < NCH ( n ) && TYPE ( CHILD ( n, i + 1 ) ) == EQUAL ) { expression = ast_for_expr ( c, CHILD ( n, i + 2 ) ) ; if (! expression ) goto error ; asdl_seq_SET ( kwdefaults, j, expression ) ; i += 2 ; } else { asdl_seq_SET ( kwdefaults, j, NULL ) ; } if ( NCH ( ch ) == 3 ) { annotation = ast_for_expr ( c, CHILD ( ch, 2 ) ) ; if (! annotation ) goto error ; } else { annotation = NULL ; } ch = CHILD ( ch, 0 ) ; argname = NEW_IDENTIFIER ( ch ) ; if (! argname ) goto error ; if ( forbidden_name ( c, argname, ch, 0 ) ) goto error ; arg = arg ( argname, annotation, NULL, LINENO ( ch ), ch -> n_col_offset, c -> c_arena ) ; if (! arg ) goto error ; asdl_seq_SET ( kwonlyargs, j ++, arg ) ; i += 1 ; <START_BUG> if ( i < NCH ( n ) && TYPE ( CHILD ( n, i ) ) == COMMA ) <END_BUG> i += 1 ; break ; case TYPE_COMMENT : arg -> type_comment = NEW_TYPE_COMMENT ( ch ) ; i += 1 ; break ; case DOUBLESTAR : return i ; default : ast_error ( c, ch, "unexpected   node" ) ; goto error ; } } return i ; error

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> TYPE ( CHILD
Buggy code:
 static void atmarp_print ( netdissect_options * ndo, const u_char * bp, u_int length, u_int caplen ) { const struct atmarp_pkthdr * ap ; u_short pro, hrd, op ; ap = ( const struct atmarp_pkthdr * ) bp ; ND_TCHECK ( * ap ) ; hrd = ATMHRD ( ap ) ; pro = ATMPRO ( ap ) ; op = ATMOP ( ap ) ; if (! ND_TTEST2 ( * aar_tpa ( ap ), ATMTPROTO_LEN ( ap ) ) ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; ND_DEFAULTPRINT ( ( const u_char * ) ap, length ) ; return ; } if (! ndo -> ndo_eflag ) { ND_PRINT ( ( ndo, "ARP,   " ) ) ; } if ( ( pro!= ETHERTYPE_IP && pro!= ETHERTYPE_TRAIL ) || ATMSPROTO_LEN ( ap )!= 4 || ATMTPROTO_LEN ( ap )!= 4 || ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, "%s,   %s   (len   %u//%u)", tok2str ( arphrd_values, "Unknown   Hardware   (%u)", hrd ), tok2str ( ethertype_values, "Unknown   Protocol   (0x%04x)", pro ), ATMSPROTO_LEN ( ap ), ATMTPROTO_LEN ( ap ) ) ) ; if (! ndo -> ndo_vflag ) { goto out ; } } ND_PRINT ( ( ndo, "%s%s   ", ndo -> ndo_vflag? ",   " : "", tok2str ( arpop_values, "Unknown   (%u)", op ) ) ) ; switch ( op ) { case ARPOP_REQUEST : <START_BUG> ND_PRINT ( ( ndo, "who-has   %s", ipaddr_string ( ndo, ATMTPA ( ap ) ) ) ) ; <END_BUG> if ( ATMTHRD_LEN ( ap )!= 0 ) { ND_PRINT (

Fix:
<S2SV_ModStart> ( ndo, "who-has <S2SV_blank> " ) ) ; atmarp_tpaddr_print ( ndo, ap, pro <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( ndo, " <S2SV_blank> tell <S2SV_blank> " ) ) ; atmarp_spaddr_print ( ndo, ap, pro <S2SV_ModEnd> ) ; break <S2SV_ModStart> case ARPOP_REPLY : atmarp_spaddr_print ( ndo, ap, pro ) ; ND_PRINT ( ( ndo, " <S2SV_blank> is-at <S2SV_blank> " <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( ndo, "at <S2SV_blank> " ) ) ; atmarp_spaddr_print ( ndo, ap, pro <S2SV_ModEnd> ) ; break <S2SV_ModStart> ( ndo, "for <S2SV_blank> " ) ) ; atmarp_spaddr_print ( ndo, ap, pro <S2SV_ModEnd> ) ; break
Buggy code:
 static struct dentry * aio_mount ( struct file_system_type * fs_type, int flags, const char * dev_name, void * data ) { static const struct dentry_operations ops = {. d_dname = simple_dname, } ; <START_BUG> return mount_pseudo ( fs_type, "aio:", NULL, & ops, AIO_RING_MAGIC ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>, } ; struct dentry * root = <S2SV_ModEnd> mount_pseudo ( fs_type <S2SV_ModStart> AIO_RING_MAGIC ) ; if (! IS_ERR ( root ) ) root -> d_sb -> s_iflags |= SB_I_NOEXEC ; return root ;
Buggy code:
 static int crypto_report_cipher ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_cipher rcipher ; <START_BUG> strlcpy ( rcipher. type, "cipher", sizeof ( rcipher. type ) ) ; <END_BUG> rcipher. blocksize = alg -> cra_blocksize ; rcipher. min_keysize = alg -> cra_cipher. cia_min_keysize ; rcipher. max_keysize = alg -> cra_cipher. cia_max_keysize ; if ( nla_put ( skb, CRYPTOCFGA_REPORT_CIPHER, sizeof ( struct crypto_report_cipher ), & rcipher ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_cipher rcipher ; strncpy <S2SV_ModEnd> ( rcipher.
Buggy code:
 static Bool FFD_CanHandleURL ( GF_InputService * plug, const char * url ) { Bool has_audio, has_video ; s32 i ; AVFormatContext * ctx ; AVOutputFormat * fmt_out ; Bool ret = GF_FALSE ; <START_BUG> char * ext, szName [ 1000 ], szExt [ 20 ] ; <END_BUG> const char * szExtList ; FFDemux * ffd ; if (! plug ||! url ) return GF_FALSE ; if (! strnicmp ( url, "rtsp:////", 7 ) ) return GF_FALSE ; if (! strnicmp ( url, "rtspu:////", 8 ) ) return GF_FALSE ; if (! strnicmp ( url, "rtp:////", 6 ) ) return GF_FALSE ; if (! strnicmp ( url, "plato:////", 8 ) ) return GF_FALSE ; if (! strnicmp ( url, "udp:////", 6 ) ) return GF_FALSE ; if (! strnicmp ( url, "tcp:////", 6 ) ) return GF_FALSE ; if (! strnicmp ( url, "data:", 5 ) ) return GF_FALSE ; ffd = ( FFDemux * ) plug -> priv ;  strcpy ( szName, url ) ; <START_BUG> ext = strrchr ( szName, '#' ) ; if ( ext ) ext [ 0 ] = 0 ; ext = strrchr ( szName, '?' ) ; if ( ext ) ext [ 0 ] = 0 ; ext = strrchr ( szName, '.' ) ; if ( ext && strlen ( ext ) > 19 ) ext = NULL ; <END_BUG> if ( ext && strlen ( ext ) > 1 ) {  strcpy ( szExt, & ext [ 1 ] ) ; strlwr ( szExt ) ; # ifndef FFMPEG_DEMUX_ENABLE_MPEG2TS if ( strstr ( "ts   m2t   mts   dmb   trp", szExt ) ) return GF_FALSE ; # endif if (! strcmp ( szExt, "mp4" ) ||! strcmp ( szExt, "mpg4" ) ||! strcmp ( szExt, "m4a" ) ||! strcmp ( szExt, "m21" ) ||! strcmp ( szExt, "

Fix:
<S2SV_ModStart>, szName [ 1024 <S2SV_ModEnd> ], szExt <S2SV_ModStart> -> priv ; if ( strlen ( url ) >= sizeof ( szName ) ) return GF_FALSE ; <S2SV_ModStart> ) > 1 && strlen ( ext ) <= sizeof ( szExt )
Buggy code:
 int jpc_bitstream_putbits ( jpc_bitstream_t * bitstream, int n, long v ) { int m ; <START_BUG> assert ( n >= 0 && n < 32 ) ; <END_BUG> assert (! ( v & ( ~ JAS_ONES ( n ) ) ) ) ; m = n - 1 ; while ( -- n >= 0 ) { if ( jpc_bitstream_putbit ( bitstream, ( v >> m ) & 1 ) == EOF ) { return EOF ; } v <<= 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> int m ; if ( n < 0 || n >= 32 ) { return EOF ; } <S2SV_ModEnd> assert (!
Buggy code:
 static void fillrd ( struct postproc_state * state, int q, int a ) { char char_dist [ 300 ] ; double sigma ; int i ; vp8_clear_system_state ( ) ; sigma = a +.5 +.6 * ( 63 - q ) // 63.0 ; { int next, j ; next = 0 ; for ( i = - 32 ; i < 32 ; i ++ ) { <START_BUG> const int v = ( int ) (.5 + 256 * vp8_gaussian ( sigma, 0, i ) ) ; <END_BUG> if ( v ) { for ( j = 0 ; j < v ; j ++ ) { char_dist [ next + j ] = ( char ) i ; } next = next + j ; } } for ( ; next < 256 ; next ++ ) char_dist [ next ] = 0 ; } for ( i = 0 ; i < 3072 ; i ++ ) { state -> noise [ i ] = char_dist [ rand ( ) & 0xff ] ; } for ( i = 0 ; i < 16 ; i ++ ) { state -> blackclamp [ i ] = - char_dist [ 0 ] ; state -> whiteclamp [ i ] = - char_dist [ 0 ] ; state -> bothclamp [ i ] = - 2 * char_dist [ 0 ] ; } state -> last_q = q ; state -> last_noise = a ; }

Fix:
<S2SV_ModStart> + 256 * gaussian <S2SV_ModEnd> ( sigma,
Buggy code:
 static int jp2_cmap_getdata ( jp2_box_t * box, jas_stream_t * in ) { jp2_cmap_t * cmap = & box -> data. cmap ; jp2_cmapent_t * ent ; <START_BUG> unsigned int i ; <END_BUG> cmap -> numchans = ( box -> datalen ) // 4 ; if (! ( cmap -> ents = jas_alloc2 ( cmap -> numchans, sizeof ( jp2_cmapent_t ) ) ) ) { return - 1 ; } for ( i = 0 ; i < cmap -> numchans ; ++ i ) { ent = & cmap -> ents [ i ] ; if ( jp2_getuint16 ( in, & ent -> cmptno ) || jp2_getuint8 ( in, & ent -> map ) || jp2_getuint8 ( in, & ent -> pcol ) ) { return - 1 ; } } return 0 ; }

Fix:
<S2SV_ModStart> unsigned int i ; cmap -> ents = 0
Buggy code:
 void openscript ( char_u * name, int directly ) { if ( curscript + 1 == NSCRIPT ) { emsg ( _ ( e_nesting ) ) ; return ; <START_BUG> } <END_BUG> # ifdef FEAT_EVAL if ( ignore_script ) return ; # endif if ( scriptin [ curscript ]!= NULL ) ++ curscript ; expand_env ( name, NameBuff, MAXPATHL ) ; if ( ( scriptin [ curscript ] = mch_fopen ( ( char * ) NameBuff, READBIN ) ) == NULL ) { semsg ( _ ( e_notopen ), name ) ; if ( curscript ) -- curscript ; return ; } if ( save_typebuf ( ) == FAIL ) return ; if ( directly ) { oparg_T oa ; int oldcurscript ; int save_State = State ; int save_restart_edit = restart_edit ; int save_insertmode = p_im ; int save_finish_op = finish_op ; int save_msg_scroll = msg_scroll ; State = NORMAL ; msg_scroll = FALSE ; restart_edit = 0 ; p_im = FALSE ; clear_oparg ( & oa ) ; finish_op = FALSE ; oldcurscript = curscript ; do { update_topline_cursor ( ) ; normal_cmd ( & oa, FALSE ) ; vpeekc ( ) ; } while ( scriptin [ oldcurscript ]!= NULL ) ; State = save_State ; msg_scroll = save_msg_scroll ; restart_edit = save_restart_edit ; p_im = save_insertmode ; finish_op = save_finish_op ; } }

Fix:
<S2SV_ModStart> return ; } if ( check_secure ( ) ) return ;
Buggy code:
 <START_BUG> static int read_frame_stats ( const struct twopass_rc * p, <END_BUG> FIRSTPASS_STATS * frame_stats, int offset ) {  const FIRSTPASS_STATS * fps_ptr = p -> stats_in ; <START_BUG> <END_BUG> if ( offset >= 0 ) {  <START_BUG> if ( & fps_ptr [ offset ] >= p -> stats_in_end ) <END_BUG> return EOF ;  } else if ( offset < 0 ) { <START_BUG> <END_BUG> if ( & fps_ptr [ offset ] < p -> stats_in_start )  return EOF ; } * frame_stats = fps_ptr [ offset ] ; <START_BUG> return 1 ; <END_BUG> }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static const FIRSTPASS_STATS * <S2SV_ModEnd> read_frame_stats ( const <S2SV_ModStart> read_frame_stats ( const TWO_PASS * p <S2SV_ModEnd>, int offset <S2SV_ModStart> offset ) { if ( <S2SV_ModEnd> ( offset >= <S2SV_ModStart> offset >= 0 && p -> stats_in + offset <S2SV_ModEnd> >= p -> <S2SV_ModStart> -> stats_in_end ) || <S2SV_ModEnd> ( offset < <S2SV_ModStart> offset < 0 && p -> stats_in + offset <S2SV_ModEnd> < p -> <S2SV_ModStart> -> stats_in_start ) ) { return NULL ; } return & p -> stats_in <S2SV_ModEnd> [ offset ] <S2SV_ModStart> offset ] ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 <START_BUG> static int test_candidate_kf ( struct twopass_rc * twopass, <END_BUG> const FIRSTPASS_STATS * last_frame, const FIRSTPASS_STATS * this_frame, const FIRSTPASS_STATS * next_frame ) { int is_viable_kf = 0 ;  if ( ( this_frame -> pcnt_second_ref < 0.10 ) && <START_BUG> <END_BUG> ( next_frame -> pcnt_second_ref < 0.10 ) &&  ( ( this_frame -> pcnt_inter < 0.05 ) || ( ( ( this_frame -> pcnt_inter - this_frame -> pcnt_neutral ) < 0.35 ) && ( ( this_frame -> intra_error // <START_BUG> DOUBLE_DIVIDE_CHECK ( this_frame -> coded_error ) ) < 2.5 ) && <END_BUG> ( ( fabs ( last_frame -> coded_error - this_frame -> coded_error ) //  DOUBLE_DIVIDE_CHECK ( this_frame -> coded_error ) > 0.40 ) || <START_BUG> ( fabs ( last_frame -> intra_error - this_frame -> intra_error ) // <END_BUG> DOUBLE_DIVIDE_CHECK ( this_frame -> intra_error ) > 0.40 ) ||  ( ( next_frame -> intra_error // <START_BUG> DOUBLE_DIVIDE_CHECK ( next_frame -> coded_error ) ) > 3.5 ) ) ) ) ) { <END_BUG> int i ; const FIRSTPASS_STATS * start_pos = twopass -> stats_in ; FIRSTPASS_STATS local_next_frame = * next_frame ; double boost_score = 0.0 ; double old_boost_score = 0.0 ; double decay_accumulator = 1.0 ; for ( i = 0 ; i < 16 ; ++ i ) {  double next_iiratio = ( IIKFACTOR1 * local_next_frame. intra_error // <START_BUG> DOUBLE_DIVIDE_CHECK ( local_next_frame. coded_error ) ) ; <END_BUG> if ( next_iiratio > RMAX )  next_iiratio = RMAX ; if ( local_next_frame. pcnt_inter > 0.85 ) decay_accumulator *= local_next_frame. pcnt_inter ; else decay_accumulator *= ( 0.85 + local_

Fix:
<S2SV_ModStart> int test_candidate_kf ( TWO_PASS <S2SV_ModEnd> * twopass, <S2SV_ModStart> = 0 ; double pcnt_intra = 1.0 - this_frame -> pcnt_inter ; double modified_pcnt_inter = this_frame -> pcnt_inter - this_frame -> pcnt_neutral ; <S2SV_ModStart> -> pcnt_second_ref < SECOND_REF_USEAGE_THRESH <S2SV_ModEnd> ) && ( <S2SV_ModStart> -> pcnt_second_ref < SECOND_REF_USEAGE_THRESH ) && ( ( this_frame -> pcnt_inter < VERY_LOW_INTER_THRESH ) || ( ( pcnt_intra > MIN_INTRA_LEVEL ) && ( pcnt_intra > ( INTRA_VS_INTER_THRESH * modified_pcnt_inter ) <S2SV_ModEnd> ) && ( <S2SV_ModStart> ) ) < KF_II_ERR_THRESHOLD <S2SV_ModEnd> ) && ( <S2SV_ModStart> coded_error ) > ERR_CHANGE_THRESHOLD <S2SV_ModEnd> ) || ( <S2SV_ModStart> intra_error ) > ERR_CHANGE_THRESHOLD <S2SV_ModEnd> ) || ( <S2SV_ModStart> ) ) > II_IMPROVEMENT_THRESHOLD <S2SV_ModEnd> ) ) ) <S2SV_ModStart> next_iiratio = ( BOOST_
Buggy code:
 static MagickBooleanType EncodeImage ( const ImageInfo * image_info, Image * image, const size_t data_size, ExceptionInfo * exception ) { # define MaxCode ( number_bits ) ( ( one << ( number_bits ) ) - 1 ) # define MaxHashTable 5003 # define MaxGIFBits 12UL # define MaxGIFTable ( 1UL << MaxGIFBits ) <START_BUG> # define GIFOutputCode ( code ) { if ( bits > 0 ) datum |= ( size_t ) ( code ) << bits ; else datum = ( size_t ) ( code ) ; bits += number_bits ; while ( bits >= 8 ) { packet [ length ++ ] = ( unsigned char ) ( datum & 0xff ) ; if ( length >= 254 ) { ( void ) WriteBlobByte ( image, ( unsigned char ) length ) ; ( void ) WriteBlob ( image, length, packet ) ; length = 0 ; } datum >>= 8 ; bits -= 8 ; } if ( free_code > max_code ) { number_bits ++ ; if ( number_bits == MaxGIFBits ) max_code = MaxGIFTable ; else max_code = MaxCode ( number_bits ) ; } } <END_BUG> Quantum index ; short * hash_code, * hash_prefix, waiting_code ; size_t bits, clear_code, datum, end_of_information_code, free_code, length, max_code, next_pixel, number_bits, one, pass ; ssize_t displacement, offset, k, y ; unsigned char * packet, * hash_suffix ; assert ( image!= ( Image * ) NULL ) ; one = 1 ; packet = ( unsigned char * ) AcquireQuantumMemory ( 256, sizeof ( * packet ) ) ; hash_code = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_code ) ) ; hash_prefix = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_prefix ) ) ; hash_suffix = ( unsigned char * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_suffix ) ) ; if ( ( packet == ( unsigned char * ) NULL ) || ( hash_code == ( short * ) NULL ) || ( hash_prefix == ( short * ) NULL ) || ( hash_suffix == ( unsigned char * ) NULL )

Fix:
<S2SV_ModStart> ( code ) \\\n{ <S2SV_ModEnd> if ( bits <S2SV_ModStart> ) ; } \\\n} <S2SV_ModEnd> Quantum index ; <S2SV_ModStart> ++ ) { next_pixel = MagickFalse ; displacement = 1 ; <S2SV_ModStart> -= MaxHashTable ; if ( k < 0 ) continue <S2SV_ModEnd> ; if (
Buggy code:
 int btrfs_truncate_inode_items ( struct btrfs_trans_handle * trans, struct btrfs_root * root, struct inode * inode, u64 new_size, u32 min_type ) { struct btrfs_path * path ; struct extent_buffer * leaf ; struct btrfs_file_extent_item * fi ; struct btrfs_key key ; struct btrfs_key found_key ; u64 extent_start = 0 ; u64 extent_num_bytes = 0 ; u64 extent_offset = 0 ; u64 item_end = 0 ; u64 last_size = new_size ; u32 found_type = ( u8 ) - 1 ; int found_extent ; int del_item ; int pending_del_nr = 0 ; int pending_del_slot = 0 ; int extent_type = - 1 ; int ret ; int err = 0 ; u64 ino = btrfs_ino ( inode ) ; u64 bytes_deleted = 0 ; bool be_nice = 0 ; bool should_throttle = 0 ; bool should_end = 0 ; BUG_ON ( new_size > 0 && min_type!= BTRFS_EXTENT_DATA_KEY ) ; if (! btrfs_is_free_space_inode ( inode ) && test_bit ( BTRFS_ROOT_REF_COWS, & root -> state ) ) be_nice = 1 ; path = btrfs_alloc_path ( ) ; if (! path ) return - ENOMEM ; path -> reada = - 1 ; if ( test_bit ( BTRFS_ROOT_REF_COWS, & root -> state ) || root == root -> fs_info -> tree_root ) btrfs_drop_extent_cache ( inode, ALIGN ( new_size, root -> sectorsize ), ( u64 ) - 1, 0 ) ; if ( min_type == 0 && root == BTRFS_I ( inode ) -> root ) btrfs_kill_delayed_inode_items ( inode ) ; key. objectid = ino ; key. offset = ( u64 ) - 1 ; key. type = ( u8 ) - 1 ; search_again : if ( be_nice && bytes_deleted > 32 * 1024 * 1024 ) {

Fix:
<S2SV_ModStart>! del_item && btrfs_file_extent_encryption ( leaf, fi ) == 0 && btrfs_file_extent_other_encoding ( leaf, fi ) == 0 ) { if ( <S2SV_ModStart>, fi )!= BTRFS_COMPRESS_NONE && pending_del_nr ) { err = btrfs_del_items ( trans, root, path, pending_del_slot, pending_del_nr ) ; if ( err ) { btrfs_abort_transaction ( trans, root, err ) ; goto error ; } pending_del_nr = 0 ; } err = truncate_inline_extent ( inode, path, & found_key, item_end, new_size ) ; if ( err ) { btrfs_abort_transaction ( trans, root, err ) ; goto error ; } } else <S2SV_ModEnd> if ( test_bit <S2SV_ModStart> state ) ) { <S2SV_ModStart> 1 - new_size <S2SV_ModEnd> ) ; }
Buggy code:
 int vcc_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct atm_vcc * vcc ; struct sk_buff * skb ; <START_BUG> int copied, error = - EINVAL ; <END_BUG> if ( sock -> state!= SS_CONNECTED ) return - ENOTCONN ; if ( flags & ~ ( MSG_DONTWAIT | MSG_PEEK ) ) return - EOPNOTSUPP ; vcc = ATM_SD ( sock ) ; if ( test_bit ( ATM_VF_RELEASED, & vcc -> flags ) || test_bit ( ATM_VF_CLOSE, & vcc -> flags ) ||! test_bit ( ATM_VF_READY, & vcc -> flags ) ) return 0 ; skb = skb_recv_datagram ( sk, flags, flags & MSG_DONTWAIT, & error ) ; if (! skb ) return error ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } error = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( error ) return error ; sock_recv_ts_and_drops ( msg, sk, skb ) ; if (! ( flags & MSG_PEEK ) ) { pr_debug ( "%d   -=   %d\\n", atomic_read ( & sk -> sk_rmem_alloc ), skb -> truesize ) ; atm_return ( vcc, skb -> truesize ) ; } skb_free_datagram ( sk, skb ) ; return copied ; }

Fix:
<S2SV_ModStart> = - EINVAL ; msg -> msg_namelen = 0
Buggy code:
 static void exif_mnote_data_pentax_load ( ExifMnoteData * en, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataPentax * n = ( ExifMnoteDataPentax * ) en ; size_t i, tcount, o, datao, base = 0 ; ExifShort c ; if (! n ||! buf ||! buf_size ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataPentax", "Short   MakerNote" ) ; return ; } datao = 6 + n -> offset ; if ( CHECKOVERFLOW ( datao, buf_size, 8 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataPentax", "Short   MakerNote" ) ; return ; } if (! memcmp ( buf + datao, "AOC", 4 ) ) { if ( ( buf [ datao + 4 ] == 'I' ) && ( buf [ datao + 5 ] == 'I' ) ) { n -> version = pentaxV3 ; n -> order = EXIF_BYTE_ORDER_INTEL ; } else if ( ( buf [ datao + 4 ] == 'M' ) && ( buf [ datao + 5 ] == 'M' ) ) { n -> version = pentaxV3 ; n -> order = EXIF_BYTE_ORDER_MOTOROLA ; } else { n -> version = pentaxV2 ; } exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataPentax", "Parsing   Pentax   maker   note   v%d...", ( int ) n -> version ) ; datao += 4 + 2 ; base = MNOTE_PENTAX2_TAG_BASE ; } else if (! memcmp ( buf + datao, "QVC", 4 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataPentax", "Parsing   Casio   maker   note   v2..." ) ; n -> version = casioV2

Fix:
<S2SV_ModStart> size_t s ; memset ( & n -> entries [ tcount ], 0, sizeof ( MnotePentaxEntry ) ) ;
Buggy code:
 static struct dst_entry * inet6_csk_route_socket ( struct sock * sk, struct flowi6 * fl6 ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct in6_addr * final_p, final ; struct dst_entry * dst ; memset ( fl6, 0, sizeof ( * fl6 ) ) ; fl6 -> flowi6_proto = sk -> sk_protocol ; fl6 -> daddr = sk -> sk_v6_daddr ; fl6 -> saddr = np -> saddr ; fl6 -> flowlabel = np -> flow_label ; IP6_ECN_flow_xmit ( sk, fl6 -> flowlabel ) ; fl6 -> flowi6_oif = sk -> sk_bound_dev_if ; fl6 -> flowi6_mark = sk -> sk_mark ; fl6 -> fl6_sport = inet -> inet_sport ; fl6 -> fl6_dport = inet -> inet_dport ; security_sk_classify_flow ( sk, flowi6_to_flowi ( fl6 ) ) ; <START_BUG> final_p = fl6_update_dst ( fl6, np -> opt, & final ) ; <END_BUG>  dst = __inet6_csk_dst_check ( sk, np -> dst_cookie ) ; <START_BUG> if (! dst ) { dst = ip6_dst_lookup_flow ( sk, fl6, final_p ) ; if (! IS_ERR ( dst ) ) __inet6_csk_dst_store ( sk, dst, NULL, NULL ) ; } return dst ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; rcu_read_lock ( ) ; <S2SV_ModStart> ( fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ) <S2SV_ModStart> final ) ; rcu_read_unlock ( ) ;
Buggy code:
 jas_image_t * bmp_decode ( jas_stream_t * in, char * optstr ) { jas_image_t * image ; bmp_hdr_t hdr ; bmp_info_t * info ; uint_fast16_t cmptno ; jas_image_cmptparm_t cmptparms [ 3 ] ; jas_image_cmptparm_t * cmptparm ; uint_fast16_t numcmpts ; long n ; if ( optstr ) { jas_eprintf ( "warning:   ignoring   BMP   decoder   options\\n" ) ; } jas_eprintf ( "THE   BMP   FORMAT   IS   NOT   FULLY   SUPPORTED!\\n" "THAT   IS,   THE   JASPER   SOFTWARE   CANNOT   DECODE   ALL   TYPES   OF   BMP   DATA.\\n" "IF   YOU   HAVE   ANY   PROBLEMS,   PLEASE   TRY   CONVERTING   YOUR   IMAGE   DATA\\n" "TO   THE   PNM   FORMAT,   AND   USING   THIS   FORMAT   INSTEAD.\\n" ) ; if ( bmp_gethdr ( in, & hdr ) ) { jas_eprintf ( "cannot   get   header\\n" ) ; return 0 ; } <START_BUG> if (! ( info = bmp_getinfo ( in ) ) ) { <END_BUG> jas_eprintf ( "cannot   get   info\\n" ) ; return 0 ;  } <START_BUG> if (! bmp_issupported ( & hdr, info ) ) { jas_eprintf ( "error:   unsupported   BMP   encoding\\n" ) ; bmp_info_destroy ( info ) ; return 0 ; } if ( ( n = hdr. off - ( BMP_HDRLEN + BMP_INFOLEN + BMP_PALLEN ( info ) ) ) < 0 ) { jas_eprintf ( "error:   possibly   bad   bitmap   offset?\\n" ) ; return 0 ; } if ( n > 0 ) { jas_eprintf ( "skipping   unknown   data   in   BMP   file\\n" ) ; if ( bmp_g<END_BUG>

Fix:
<S2SV_ModStart> 0 ; } JAS_DBGLOG ( 1, ( "BMP <S2SV_blank> header: <S2SV_blank> magic <S2SV_blank> 0x%x; <S2SV_blank> siz <S2SV_blank> %d; <S2SV_blank> res1 <S2SV_blank> %d; <S2SV_blank> res2 <S2SV_blank> %d; <S2SV_blank> off <S2SV_blank> %d\\n", hdr. magic, hdr. siz, hdr. reserved1, hdr. reserved2, hdr. off ) ) ; <S2SV_ModStart> 0 ; } JAS_DBGLOG ( 1, ( "BMP <S2SV_blank> information: <S2SV_blank> len <S2SV_blank> %d; <S2SV_blank> width <S2SV_blank> %d; <S2SV_blank> height <S2SV_blank> %d; <S2SV_blank> numplanes <S2SV_blank> %d; <S2SV_blank> " "depth <S2SV_blank> %d; <S2SV_blank> enctype <S2SV_blank> %d; <S2SV_blank> siz <S2SV_blank> %d; <S2SV_blank> hres <S2SV_blank> %d; <S2SV_blank> vres <S2SV_blank> %d; <S2SV_blank> numcolors <S2SV_blank> %d; <S2SV_blank> " "mincolors <S2SV_blank> %d\\n", info -> len, info -> width, info -> height, info -> numplanes, info -> depth, info -> enctype, info -> siz, info -> hres, info -> vres, info -> numcolors, info -> mincolors ) ) ;
Buggy code:
 static int au1200fb_fb_mmap ( struct fb_info * info, struct vm_area_struct * vma ) { <START_BUG> unsigned int len ; <END_BUG> unsigned long start = 0, off ;  struct au1200fb_device * fbdev = info -> par ; <START_BUG> if ( vma -> vm_pgoff > ( ~ 0UL >> PAGE_SHIFT ) ) { return - EINVAL ; } start = fbdev -> fb_phys & PAGE_MASK ; len = PAGE_ALIGN ( ( start & ~ PAGE_MASK ) + fbdev -> fb_len ) ; off = vma -> vm_pgoff << PAGE_SHIFT ; if ( ( vma -> vm_end - vma -> vm_start + off ) > len ) { return - EINVAL ; } off += start ; vma -> vm_pgoff = off >> PAGE_SHIFT ; vma -> vm_page_prot = pgprot_noncached ( vma -> vm_page_prot ) ; pgprot_val ( vma -> vm_page_prot ) |= _CACHE_MASK ; <END_BUG> return io_remap_pfn_range ( vma, vma -> vm_start, off >> PAGE_SHIFT,  vma -> vm_end - vma -> vm_start, vma -> vm_page_prot ) ; }

Fix:
<S2SV_ModStart> vma ) { <S2SV_ModEnd> struct au1200fb_device * <S2SV_ModStart> info -> par <S2SV_ModEnd> ; vma -> <S2SV_ModStart> _CACHE_MASK ; return vm_iomap_memory <S2SV_ModEnd> ( vma, <S2SV_ModStart> ( vma, fbdev -> fb_phys, fbdev -> fb_len <S2SV_ModEnd> ) ; }
Buggy code:
 static inline struct futex_hash_bucket * queue_lock ( struct futex_q * q ) { <START_BUG> struct futex_hash_bucket * hb ; <END_BUG> get_futex_key_refs ( & q -> key ) ; hb = hash_futex ( & q -> key ) ; q -> lock_ptr = & hb -> lock ; spin_lock ( & hb -> lock ) ; return hb ; }

Fix:
<S2SV_ModStart> futex_hash_bucket * hb <S2SV_ModEnd> ; hb =
Buggy code:
 static node * parsetok ( struct tok_state * tok, grammar * g, int start, perrdetail * err_ret, int * flags ) { parser_state * ps ; node * n ; int started = 0 ; <START_BUG> int col_offset, end_col_offset ; <END_BUG> if ( ( ps = PyParser_New ( g, start ) ) == NULL ) { err_ret -> error = E_NOMEM ; PyTokenizer_Free ( tok ) ; return NULL ; } # ifdef PY_PARSER_REQUIRES_FUTURE_KEYWORD if ( * flags & PyPARSE_BARRY_AS_BDFL )  ps -> p_flags |= CO_FUTURE_BARRY_AS_BDFL ; <START_BUG> # endif for ( ; ; ) { char * a, * b ; int type ; size_t len ; char * str ; col_offset = - 1 ; int lineno ; const char * line_start ; type = PyTokenizer_Get ( tok, & a, & b ) ; if ( type == ERRORTOKEN ) { err_ret -> error = tok -> done ; break ; } if ( type == ENDMARKER && started ) { type = NEWLINE ; started = 0 ; if ( tok -> indent &&! ( * flags & PyPARSE_DONT_IMPLY_DEDENT ) ) { tok -> pendin = - tok -> indent ; tok -> indent = 0 ; } } else started = 1 ; len = ( a!= NULL && b!= NULL )? b - a : 0 ; str = ( char * ) PyObject_MALLOC ( len + 1 ) ; if ( str == NULL ) { err_ret -> error = E_NOMEM ; break ; } if ( len > 0 ) strncpy ( str, a, len ) ; str [ len ] = '\\0' ; # ifdef PY_PARSER_REQUIRES_FUTURE_KEYWORD if ( type == NOTEQUAL ) { if (! ( ps -> p_flags & CO_FUTURE_BARRY_AS_BDFL ) && strcmp ( str, "!=" ) ) { PyObject_FREE ( str ) ; err_ret -> error = E_SYNTAX ; break ; } else if ( ( ps -> p_flags & CO_FUTURE_BARRY_AS_BDFL ) && strcmp ( str, "<>" ) ) {<END_BUG>

Fix:
<S2SV_ModStart>, end_col_offset ; growable_int_array type_ignores ; if (! growable_int_array_init ( & type_ignores, 10 ) ) { err_ret -> error = E_NOMEM ; PyTokenizer_Free ( tok ) ; return NULL ; } <S2SV_ModStart> p_flags |= CO_FUTURE_BARRY_AS_BDFL ; if ( * flags & PyPARSE_TYPE_COMMENTS ) ps -> p_flags |= PyCF_TYPE_COMMENTS <S2SV_ModStart> } if ( type == TYPE_IGNORE ) { if (! growable_int_array_add ( & type_ignores, tok -> lineno ) ) { err_ret -> error = E_NOMEM ; break ; } continue ; } if ( <S2SV_ModStart> p_tree = NULL ; if ( n -> n_type == file_input ) { int num ; node * ch ; size_t i ; num = NCH ( n ) ; ch = CHILD ( n, num - 1 ) ; REQ ( ch, ENDMARKER ) ; for ( i = 0 ; i < type_ignores. num_items ; i ++ ) { PyNode_AddChild ( ch,
Buggy code:
 static UINT parallel_process_irp_create ( PARALLEL_DEVICE * parallel, IRP * irp ) { char * path = NULL ; int status ; <START_BUG> UINT32 PathLength ; <END_BUG>  Stream_Seek ( irp -> input, 28 ) ; <START_BUG> Stream_Read_UINT32 ( irp -> input, PathLength ) ; <END_BUG> status = ConvertFromUnicode ( CP_UTF8, 0, ( WCHAR * ) Stream_Pointer ( irp -> input ), PathLength // 2,  & path, 0, NULL, NULL ) ; if ( status < 1 ) if (! ( path = ( char * ) calloc ( 1, 1 ) ) ) { WLog_ERR ( TAG, "calloc   failed!" ) ; return CHANNEL_RC_NO_MEMORY ; } parallel -> id = irp -> devman -> id_sequence ++ ; parallel -> file = open ( parallel -> path, O_RDWR ) ; if ( parallel -> file < 0 ) { irp -> IoStatus = STATUS_ACCESS_DENIED ; parallel -> id = 0 ; } else { if ( fcntl ( parallel -> file, F_SETFL, O_NONBLOCK ) == - 1 ) { } } Stream_Write_UINT32 ( irp -> output, parallel -> id ) ; Stream_Write_UINT8 ( irp -> output, 0 ) ; free ( path ) ; return irp -> Complete ( irp ) ; }

Fix:
<S2SV_ModStart> int status ; WCHAR * ptr ; <S2SV_ModStart> UINT32 PathLength ; if (! Stream_SafeSeek <S2SV_ModEnd> ( irp -> <S2SV_ModStart>, 28 ) ) return ERROR_INVALID_DATA ; if ( Stream_GetRemainingLength ( irp -> input ) < 4 ) return ERROR_INVALID_DATA <S2SV_ModStart> PathLength ) ; ptr = ( WCHAR * ) Stream_Pointer ( irp -> input ) ; if (! Stream_SafeSeek ( irp -> input, PathLength ) ) return ERROR_INVALID_DATA ; <S2SV_ModStart>, 0, ptr <S2SV_ModEnd>, PathLength //
Buggy code:
 static int mlx5_fpga_conn_create_cq ( struct mlx5_fpga_conn * conn, int cq_size ) { struct mlx5_fpga_device * fdev = conn -> fdev ; struct mlx5_core_dev * mdev = fdev -> mdev ; u32 temp_cqc [ MLX5_ST_SZ_DW ( cqc ) ] = { 0 } ; u32 out [ MLX5_ST_SZ_DW ( create_cq_out ) ] ; struct mlx5_wq_param wqp ; struct mlx5_cqe64 * cqe ; int inlen, err, eqn ; unsigned int irqn ; void * cqc, * in ; __be64 * pas ; u32 i ; cq_size = roundup_pow_of_two ( cq_size ) ; MLX5_SET ( cqc, temp_cqc, log_cq_size, ilog2 ( cq_size ) ) ; wqp. buf_numa_node = mdev -> priv. numa_node ; wqp. db_numa_node = mdev -> priv. numa_node ; err = mlx5_cqwq_create ( mdev, & wqp, temp_cqc, & conn -> cq. wq, & conn -> cq. wq_ctrl ) ; if ( err ) return err ; for ( i = 0 ; i < mlx5_cqwq_get_size ( & conn -> cq. wq ) ; i ++ ) { cqe = mlx5_cqwq_get_wqe ( & conn -> cq. wq, i ) ; cqe -> op_own = MLX5_CQE_INVALID << 4 | MLX5_CQE_OWNER_MASK ; } inlen = MLX5_ST_SZ_BYTES ( create_cq_in ) + sizeof ( u64 ) * conn -> cq. wq_ctrl. buf. npages ; in = kvzalloc ( inlen, GFP_KERNEL ) ; if (! in ) { err = - ENOMEM ; goto err_cqwq ; } err =

Fix:
<S2SV_ModStart> ( err ) { kvfree ( in ) ; <S2SV_ModStart> goto err_cqwq ; }
Buggy code:
 static void on_read ( h2o_socket_t * sock, int status ) { h2o_http2_conn_t * conn = sock -> data ; if ( status!= 0 ) { h2o_socket_read_stop ( conn -> sock ) ; close_connection ( conn ) ; return ; } update_idle_timeout ( conn ) ; <START_BUG> parse_input ( conn ) ; <END_BUG> if ( h2o_timeout_is_linked ( & conn -> _write. timeout_entry ) ) { h2o_timeout_unlink ( & conn -> _write. timeout_entry ) ; do_emit_writereq ( conn ) ; } }

Fix:
<S2SV_ModStart> conn ) ; if ( <S2SV_ModStart> ( conn )!= 0 ) return
Buggy code:
 int wc_SignatureGenerateHash ( enum wc_HashType hash_type, enum wc_SignatureType sig_type, const byte * hash_data, word32 hash_len, byte * sig, word32 * sig_len, const void * key, word32 key_len, WC_RNG * rng ) { <START_BUG> int ret ; <END_BUG> ( void ) rng ; if ( hash_data == NULL || hash_len <= 0 || sig == NULL || sig_len == NULL || * sig_len <= 0 || key == NULL || key_len <= 0 ) { return BAD_FUNC_ARG ; }  if ( ( int ) * sig_len < wc_SignatureGetSize ( sig_type, key, key_len ) ) { <START_BUG> WOLFSSL_MSG ( "wc_SignatureGenerate:   Invalid   sig   type//len" ) ; return BAD_FUNC_ARG ; } ret = wc_HashGetDigestSize ( hash_type ) ; if ( ret < 0 ) { WOLFSSL_MSG ( "wc_SignatureGenerate:   Invalid   hash   type//len" ) ; return ret ; } ret = 0 ; switch ( sig_type ) { case WC_SIGNATURE_TYPE_ECC : # if defined ( HAVE_ECC ) && defined ( HAVE_ECC_SIGN ) do { # ifdef WOLFSSL_ASYNC_CRYPT ret = wc_AsyncWait ( ret, & ( ( ecc_key * ) key ) -> asyncDev, WC_ASYNC_FLAG_CALL_AGAIN ) ; # endif if ( ret >= 0 ) ret = wc_ecc_sign_hash ( hash_data, hash_len, sig, sig_len, rng, ( ecc_key * ) key ) ; <END_BUG> } while ( ret == WC_PENDING_E ) ;  # else ret = SIG_TYPE_E ; # endif break ; case WC_SIGNATURE_TYPE_RSA_W_ENC : case WC_SIGNATURE_TYPE_RSA : # if! defined ( NO_RSA ) &&! defined ( WOLFSSL_RSA_PUBLIC_ONLY ) do { # ifdef WOLFSSL_ASYNC_CRYPT ret = wc_AsyncWait ( ret, & ( ( RsaKey * ) key ) -> asyncDev, WC_ASYNC_FLAG_CALL_AGAIN

Fix:
<S2SV_ModStart> rng ) { return wc_SignatureGenerateHash_ex ( hash_type, sig_type, hash_data, hash_len, sig, sig_len <S2SV_ModEnd>, key, <S2SV_ModStart> key, key_len, rng, 1 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int ext4_ext_grow_indepth ( handle_t * handle, struct inode * inode, unsigned int flags ) { struct ext4_extent_header * neh ; struct buffer_head * bh ; ext4_fsblk_t newblock, goal = 0 ; struct ext4_super_block * es = EXT4_SB ( inode -> i_sb ) -> s_es ; int err = 0 ; <START_BUG> if ( ext_depth ( inode ) ) <END_BUG> goal = ext4_idx_pblock ( EXT_FIRST_INDEX ( ext_inode_hdr ( inode ) ) ) ; if ( goal > le32_to_cpu ( es -> s_first_data_block ) ) { flags |= EXT4_MB_HINT_TRY_GOAL ; goal -- ; } else goal = ext4_inode_to_goal_block ( inode ) ; newblock = ext4_new_meta_blocks ( handle, inode, goal, flags, NULL, & err ) ; if ( newblock == 0 ) return err ; bh = sb_getblk_gfp ( inode -> i_sb, newblock, __GFP_MOVABLE | GFP_NOFS ) ; if ( unlikely (! bh ) ) return - ENOMEM ; lock_buffer ( bh ) ; err = ext4_journal_get_create_access ( handle, bh ) ; if ( err ) { unlock_buffer ( bh ) ; goto out ; }  memmove ( bh -> b_data, EXT4_I ( inode ) -> i_data, <START_BUG> <END_BUG> sizeof ( EXT4_I ( inode ) -> i_data ) ) ;  neh = ext_block_hdr ( bh ) ; if ( ext_depth ( inode ) ) neh -> eh_max = cpu_to_le16 ( ext4_ext_space_block_idx ( inode, 0 ) ) ; else neh -> eh_max = cpu_to_le16 ( ext4_ext_space_block ( inode, 0 ) ) ; neh -> eh_magic = EXT4_EXT_MAGIC ; ext4_extent_block_csum_set ( inode, neh ) ; set_buffer_uptodate ( bh ) ; unlock_buffer ( bh ) ; err = ext4_handle_dirty_metadata ( handle, inode

Fix:
<S2SV_ModStart> = 0 ; size_t ext_size = 0 ; <S2SV_ModStart> out ; } ext_size = sizeof ( EXT4_I ( inode ) -> i_data ) ; <S2SV_ModStart> -> i_data, ext_size ) ; memset ( bh -> b_data + ext_size, 0, inode -> i_sb -> s_blocksize - ext_size <S2SV_ModEnd> ) ; neh
Buggy code:
 static int ovl_copy_up_locked ( struct dentry * workdir, struct dentry * upperdir, struct dentry * dentry, struct path * lowerpath, struct kstat * stat, struct iattr * attr, const char * link ) { struct inode * wdir = workdir -> d_inode ; struct inode * udir = upperdir -> d_inode ; struct dentry * newdentry = NULL ; struct dentry * upper = NULL ; umode_t mode = stat -> mode ; int err ; newdentry = ovl_lookup_temp ( workdir, dentry ) ; err = PTR_ERR ( newdentry ) ; if ( IS_ERR ( newdentry ) ) goto out ; upper = lookup_one_len ( dentry -> d_name. name, upperdir, dentry -> d_name. len ) ; err = PTR_ERR ( upper ) ; if ( IS_ERR ( upper ) ) goto out1 ; stat -> mode &= S_IFMT ; err = ovl_create_real ( wdir, newdentry, stat, link, NULL, true ) ; stat -> mode = mode ; if ( err ) goto out2 ; if ( S_ISREG ( stat -> mode ) ) { struct path upperpath ; ovl_path_upper ( dentry, & upperpath ) ; BUG_ON ( upperpath. dentry!= NULL ) ; upperpath. dentry = newdentry ; err = ovl_copy_up_data ( lowerpath, & upperpath, stat -> size ) ; if ( err ) goto out_cleanup ; } err = ovl_copy_xattr ( lowerpath -> dentry, newdentry ) ; if ( err ) goto out_cleanup ; mutex_lock ( & newdentry -> d_inode -> i_mutex ) ; err = ovl_set_attr ( newdentry, stat ) ; if (! err && attr ) err = notify_change ( newdentry, attr, NULL ) ; mutex_unlock ( & newdentry -> d_inode -> i_mutex ) ; if ( err ) goto out_cleanup ; err = ovl_do_rename ( wdir, newdentry, udir, upper, 0 ) ; if ( err ) goto out_cleanup ; ovl_dentry_update ( dentry

Fix:
<S2SV_ModStart> ) ; goto out2 <S2SV_ModEnd> ; } <S2SV_null>