nus-yam/ex-repair huggingface dataset:
Buggy code:
 static MagickBooleanType ReadDXT5 ( Image * image, DDSInfo * dds_info, ExceptionInfo * exception ) { DDSColors colors ; ssize_t j, y ; MagickSizeType alpha_bits ; PixelPacket * q ; register ssize_t i, x ; unsigned char a0, a1 ; size_t alpha, bits, code, alpha_code ; unsigned short c0, c1 ; for ( y = 0 ; y < ( ssize_t ) dds_info -> height ; y += 4 ) { for ( x = 0 ; x < ( ssize_t ) dds_info -> width ; x += 4 ) { <START_BUG> q = QueueAuthenticPixels ( image, x, y, Min ( 4, dds_info -> width - x ), <END_BUG>  Min ( 4, dds_info -> height - y ), exception ) ; <START_BUG> if ( q == ( PixelPacket * ) NULL ) return MagickFalse ; a0 = ( unsigned char ) ReadBlobByte ( image ) ; a1 = ( unsigned char ) ReadBlobByte ( image ) ; alpha_bits = ( MagickSizeType ) ReadBlobLSBLong ( image ) ; alpha_bits = alpha_bits | ( ( MagickSizeType ) ReadBlobLSBShort ( image ) << 32 ) ; c0 = ReadBlobLSBShort ( image ) ; c1 = ReadBlobLSBShort ( image ) ; bits = ReadBlobLSBLong ( image ) ; CalculateColors ( c0, c1, & colors, MagickTrue ) ; for ( j = 0 ; j < 4 ; j ++ ) { for ( i = 0 ; i < 4 ; i ++ ) { if ( ( x + i ) < ( ssize_t ) dds_info -> width && ( y + j ) < ( ssize_t ) dds_info -> height ) { code = ( bits >> ( ( 4 * j + i ) * 2 ) ) & 0x3 ; SetPixelRed ( q, ScaleCharToQuantum ( colors. r [ code ] ) ) ; SetPixelGreen ( q, ScaleCharToQuantum ( colors. g [ code ] ) ) ; SetPixelBlue ( q, ScaleCharToQuantum ( colors. b [ code ] ) ) ; alpha_code = ( size_t ) ( alpha_bits >> ( 3 *<END_BUG>

Fix:
<S2SV_ModStart>, y, MagickMin <S2SV_ModEnd> ( 4, <S2SV_ModStart> x ), MagickMin <S2SV_ModEnd> ( 4, <S2SV_ModStart> ; } } return ( <S2SV_ModStart> dds_info, 16, exception ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int qeth_snmp_command ( struct qeth_card * card, char __user * udata ) { struct qeth_cmd_buffer * iob ; struct qeth_ipa_cmd * cmd ; struct qeth_snmp_ureq * ureq ; <START_BUG> int req_len ; <END_BUG> struct qeth_arp_query_info qinfo = { 0, } ; int rc = 0 ; QETH_CARD_TEXT ( card, 3, "snmpcmd" ) ; if ( card -> info. guestlan ) return - EOPNOTSUPP ; if ( (! qeth_adp_supported ( card, IPA_SETADP_SET_SNMP_CONTROL ) ) && (! card -> options. layer2 ) ) { return - EOPNOTSUPP ; } if ( copy_from_user ( & req_len, udata + sizeof ( int ), sizeof ( int ) ) )  return - EFAULT ; <START_BUG> ureq = memdup_user ( udata, req_len + sizeof ( struct qeth_snmp_ureq_hdr ) ) ; if ( IS_ERR ( ureq ) ) { QETH_CARD_TEXT ( card, 2, "snmpnome" ) ; return PTR_ERR ( ureq ) ; } qinfo. udata_len = ureq -> hdr. data_len ; qinfo. udata = kzalloc ( qinfo. udata_len, GFP_KERNEL ) ; if (! qinfo. udata ) { kfree ( ureq ) ; return - ENOMEM ; } qinfo. udata_offset = sizeof ( struct qeth_snmp_ureq_hdr ) ; iob = qeth_get_adapter_cmd ( card, IPA_SETADP_SET_SNMP_CONTROL, QETH_SNMP_SETADP_CMDLENGTH + req_len ) ; cmd = ( struct qeth_ipa_cmd * ) ( iob -> data + IPA_PDU_HEADER_SIZE ) ; memcpy ( & cmd -> data. setadapterparms. data. snmp, & ureq -> cmd, req_len ) ; rc = qeth_send_ipa_snmp_cmd ( card, iob, QETH_SETADP_BASE_LEN + req_len, q<END_BUG>

Fix:
<S2SV_ModStart> * ureq ; unsigned <S2SV_ModStart> return - EFAULT ; if ( req_len > ( QETH_BUFSIZE - IPA_PDU_HEADER_SIZE - sizeof ( struct qeth_ipacmd_hdr ) - sizeof ( struct qeth_ipacmd_setadpparms_hdr ) ) ) return - EINVAL
Buggy code:
 static int ca8210_probe ( struct spi_device * spi_device ) { struct ca8210_priv * priv ; struct ieee802154_hw * hw ; struct ca8210_platform_data * pdata ; int ret ; dev_info ( & spi_device -> dev, "Inserting   ca8210\\n" ) ; hw = ieee802154_alloc_hw ( sizeof ( struct ca8210_priv ), & ca8210_phy_ops ) ; if (! hw ) { dev_crit ( & spi_device -> dev, "ieee802154_alloc_hw   failed\\n" ) ; ret = - ENOMEM ; goto error ; } priv = hw -> priv ; priv -> hw = hw ; priv -> spi = spi_device ; hw -> parent = & spi_device -> dev ; spin_lock_init ( & priv -> lock ) ; priv -> async_tx_pending = false ; priv -> hw_registered = false ; priv -> sync_up = 0 ; priv -> sync_down = 0 ; priv -> promiscuous = false ; priv -> retries = 0 ; init_completion ( & priv -> ca8210_is_awake ) ; init_completion ( & priv -> spi_transfer_complete ) ; init_completion ( & priv -> sync_exchange_complete ) ; spi_set_drvdata ( priv -> spi, priv ) ; if ( IS_ENABLED ( CONFIG_IEEE802154_CA8210_DEBUGFS ) ) { cascoda_api_upstream = ca8210_test_int_driver_write ; ca8210_test_interface_init ( priv ) ; } else { cascoda_api_upstream = NULL ; } ca8210_hw_setup ( hw ) ; ieee802154_random_extended_addr ( & hw -> phy -> perm_extended_addr ) ; pdata = kmalloc ( sizeof ( * pdata ), GFP_KERNEL ) ; if (! pdata ) { ret = - ENOMEM ; goto error ; } <START_BUG> ret = ca8210_get_platform_data ( priv -> spi, pdata ) ; <END_BUG> if ( ret ) { dev_crit ( & spi_device -> dev, "ca8210_get_platform_data   failed\\n" ) ; goto error ; } priv ->

Fix:
<S2SV_ModStart> error ; } <S2SV_ModEnd> priv -> spi <S2SV_ModStart> ; ret = ca8210_get_platform_data ( priv -> spi, pdata ) ; if ( ret ) { dev_crit ( & spi_device -> dev, "ca8210_get_platform_data <S2SV_blank> failed\\n" ) ; goto error ; } ret =
Buggy code:
 static OM_uint32 acc_ctx_new ( OM_uint32 * minor_status, gss_buffer_t buf, gss_ctx_id_t * ctx, spnego_gss_cred_id_t spcred, gss_buffer_t * mechToken, gss_buffer_t * mechListMIC, OM_uint32 * negState, send_token_flag * return_token ) { OM_uint32 tmpmin, ret, req_flags ; gss_OID_set supported_mechSet, mechTypes ; gss_buffer_desc der_mechTypes ; gss_OID mech_wanted ; spnego_gss_ctx_id_t sc = NULL ; ret = GSS_S_DEFECTIVE_TOKEN ; der_mechTypes. length = 0 ; der_mechTypes. value = NULL ; * mechToken = * mechListMIC = GSS_C_NO_BUFFER ; supported_mechSet = mechTypes = GSS_C_NO_OID_SET ; * return_token = ERROR_TOKEN_SEND ; * negState = REJECT ; * minor_status = 0 ; ret = get_negTokenInit ( minor_status, buf, & der_mechTypes, & mechTypes, & req_flags, mechToken, mechListMIC ) ; if ( ret!= GSS_S_COMPLETE ) { goto cleanup ; } ret = get_negotiable_mechs ( minor_status, spcred, GSS_C_ACCEPT, & supported_mechSet ) ; if ( ret!= GSS_S_COMPLETE ) { * return_token = NO_TOKEN_SEND ; goto cleanup ; } mech_wanted = negotiate_mech ( supported_mechSet, mechTypes, negState ) ; if ( * negState == REJECT ) { ret = GSS_S_BAD_MECH ; goto cleanup ; } sc = ( spnego_gss_ctx_id_t ) * ctx ; if ( sc!= NULL ) { gss_release_buffer ( & tmpmin, & sc -> DER_mechTypes ) ; assert ( mech_wanted!= GSS_C_NO_OID ) ; } else <START_BUG> sc = create_spnego_ctx ( ) ; <END_BUG> if ( sc

Fix:
<S2SV_ModStart> = create_spnego_ctx ( 0
Buggy code:
 static int snd_timer_user_params ( struct file * file, struct snd_timer_params __user * _params ) { struct snd_timer_user * tu ; struct snd_timer_params params ; struct snd_timer * t ; struct snd_timer_read * tr ; struct snd_timer_tread * ttr ; int err ; tu = file -> private_data ; if (! tu -> timeri ) return - EBADFD ; t = tu -> timeri -> timer ; if (! t ) return - EBADFD ; if ( copy_from_user ( & params, _params, sizeof ( params ) ) ) return - EFAULT ; if (! ( t -> hw. flags & SNDRV_TIMER_HW_SLAVE ) && params. ticks < 1 ) { err = - EINVAL ; goto _end ; } if ( params. queue_size > 0 && ( params. queue_size < 32 || params. queue_size > 1024 ) ) { err = - EINVAL ; goto _end ; } if ( params. filter & ~ ( ( 1 << SNDRV_TIMER_EVENT_RESOLUTION ) | ( 1 << SNDRV_TIMER_EVENT_TICK ) | ( 1 << SNDRV_TIMER_EVENT_START ) | ( 1 << SNDRV_TIMER_EVENT_STOP ) | ( 1 << SNDRV_TIMER_EVENT_CONTINUE ) | ( 1 << SNDRV_TIMER_EVENT_PAUSE ) | ( 1 << SNDRV_TIMER_EVENT_SUSPEND ) | ( 1 << SNDRV_TIMER_EVENT_RESUME ) | ( 1 << SNDRV_TIMER_EVENT_MSTART ) | ( 1 << SNDRV_TIMER_EVENT_MSTOP ) | ( 1 << SNDRV_TIMER_EVENT_MCONTINUE ) | ( 1 << SNDRV_TIMER_EVENT_MPAUSE ) | ( 1 << SNDRV_TIMER_EVENT_MSUSPEND ) | ( 1 << SNDRV_TIMER_EVENT_MRESUME ) ) ) { err = - EINVAL ; goto _end ; } snd_timer_stop ( tu -> timeri ) ; spin_

Fix:
<S2SV_ModStart> snd_timer_tread tread ; memset ( & tread, 0, sizeof ( tread ) ) ;
Buggy code:
 SecureElementStatus_t SecureElementProcessJoinAccept ( JoinReqIdentifier_t joinReqType, uint8_t * joinEui, uint16_t devNonce, uint8_t * encJoinAccept, uint8_t encJoinAcceptSize, uint8_t * decJoinAccept, uint8_t * versionMinor ) { SecureElementStatus_t status = SECURE_ELEMENT_ERROR ; if ( ( encJoinAccept == NULL ) || ( decJoinAccept == NULL ) || ( versionMinor == NULL ) ) { <START_BUG> return SECURE_ELEMENT_ERROR_NPE ; <END_BUG> } KeyIdentifier_t encKeyID = NWK_KEY ; if ( joinReqType!= JOIN_REQ ) { encKeyID = J_S_ENC_KEY ; } uint8_t micHeader10 [ 1 ] = { 0x20 } ; lr1110_crypto_process_join_accept ( & LR1110, ( lr1110_crypto_status_t * ) & status, convert_key_id_from_se_to_lr1110 ( encKeyID ), convert_key_id_from_se_to_lr1110 ( NWK_KEY ), ( lr1110_crypto_lorawan_version_t ) 0, micHeader10, encJoinAccept + 1, encJoinAcceptSize - 1, decJoinAccept + 1 ) ; if ( status == SECURE_ELEMENT_SUCCESS ) { * versionMinor = ( ( decJoinAccept [ 11 ] & 0x80 ) == 0x80 )? 1 : 0 ; if ( * versionMinor == 0 ) { return SECURE_ELEMENT_SUCCESS ; } } # if ( USE_LRWAN_1_1_X_CRYPTO == 1 ) uint8_t micHeader11 [ JOIN_ACCEPT_MIC_COMPUTATION_OFFSET ] = { 0 } ; uint16_t bufItr = 0 ; micHeader11 [ bufItr ++ ] = ( uint8_t ) joinReqType ; memcpyr ( micHeader11 + bufItr, joinEui, LORAMAC_JOIN_EUI_FIELD_SIZE ) ; bufItr += LORAMAC_JOIN_EUI_FIELD_SIZE ; micHeader11 [ bufItr ++ ] = devNonce & 0xFF ; micHeader11 [ bufItr ++ ] = (

Fix:
<S2SV_ModStart> { return SECURE_ELEMENT_ERROR_NPE ; } if ( encJoinAcceptSize > LORAMAC_JOIN_ACCEPT_FRAME_MAX_SIZE ) { return SECURE_ELEMENT_ERROR_BUF_SIZE
Buggy code:
 static int target_xcopy_parse_target_descriptors ( struct se_cmd * se_cmd, struct xcopy_op * xop, unsigned char * p, unsigned short tdll, sense_reason_t * sense_ret ) { struct se_device * local_dev = se_cmd -> se_dev ; unsigned char * desc = p ; int offset = tdll % XCOPY_TARGET_DESC_LEN, rc ; unsigned short cscd_index = 0 ; unsigned short start = 0 ; * sense_ret = TCM_INVALID_PARAMETER_LIST ; if ( offset!= 0 ) { pr_err ( "XCOPY   target   descriptor   list   length   is   not" "   multiple   of   %d\\n", XCOPY_TARGET_DESC_LEN ) ; * sense_ret = TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE ; return - EINVAL ; } if ( tdll > RCR_OP_MAX_TARGET_DESC_COUNT * XCOPY_TARGET_DESC_LEN ) { pr_err ( "XCOPY   target   descriptor   supports   a   maximum" "   two   src//dest   descriptors,   tdll:   %hu   too   large..\\n", tdll ) ; * sense_ret = TCM_TOO_MANY_TARGET_DESCS ; return - EINVAL ; } memset ( & xop -> local_dev_wwn [ 0 ], 0, XCOPY_NAA_IEEE_REGEX_LEN ) ; target_xcopy_gen_naa_ieee ( local_dev, & xop -> local_dev_wwn [ 0 ] ) ; while ( start < tdll ) { switch ( desc [ 0 ] ) { case 0xe4 : rc = target_xcopy_parse_tiddesc_e4 ( se_cmd, xop, & desc [ 0 ], cscd_index ) ; if ( rc!= 0 ) goto out ; start += XCOPY_TARGET_DESC_LEN ; desc += XCOPY_TARGET_DESC_LEN ; cscd_index ++ ; break ; default : pr_err ( "XCOPY   unsupported   descriptor   type   code:" "   0x%02x\\n", desc [ 0 ] ) ; * sense_ret = T

Fix:
<S2SV_ModStart> = target_xcopy_locate_se_dev_e4 ( se_cmd -> se_sess, <S2SV_ModStart> xop -> dst_dev, & xop -> remote_lun_ref <S2SV_ModStart> = target_xcopy_locate_se_dev_e4 ( se_cmd -> se_sess, <S2SV_ModStart> xop -> src_dev, & xop -> remote_lun_ref
Buggy code:
 static int newseg ( struct ipc_namespace * ns, struct ipc_params * params ) { key_t key = params -> key ; int shmflg = params -> flg ; size_t size = params -> u. size ; int error ; struct shmid_kernel * shp ; size_t numpages = ( size + PAGE_SIZE - 1 ) >> PAGE_SHIFT ; struct file * file ; char name [ 13 ] ; int id ; vm_flags_t acctflag = 0 ; if ( size < SHMMIN || size > ns -> shm_ctlmax ) return - EINVAL ; if ( numpages << PAGE_SHIFT < size ) return - ENOSPC ; if ( ns -> shm_tot + numpages < ns -> shm_tot || ns -> shm_tot + numpages > ns -> shm_ctlall ) return - ENOSPC ; shp = ipc_rcu_alloc ( sizeof ( * shp ) ) ; if (! shp ) return - ENOMEM ; shp -> shm_perm. key = key ; shp -> shm_perm. mode = ( shmflg & S_IRWXUGO ) ; shp -> mlock_user = NULL ; shp -> shm_perm. security = NULL ; error = security_shm_alloc ( shp ) ; if ( error ) { ipc_rcu_putref ( shp, ipc_rcu_free ) ; return error ; } sprintf ( name, "SYSV%08x", key ) ; if ( shmflg & SHM_HUGETLB ) { struct hstate * hs ; size_t hugesize ; hs = hstate_sizelog ( ( shmflg >> SHM_HUGE_SHIFT ) & SHM_HUGE_MASK ) ; if (! hs ) { error = - EINVAL ; goto no_file ; } hugesize = ALIGN ( size, huge_page_size ( hs ) ) ; if ( shmflg & SHM_NORESERVE ) acctflag = VM_NORESERVE ; file = hugetlb_file_setup ( name, hugesize, acctflag, & shp -> mlock_user, HUGETLB_SHMFS_INODE, ( shmflg >> SH

Fix:
<S2SV_ModStart> goto no_file ; shp -> shm_cprid = task_tgid_vnr ( current ) ; shp -> shm_lprid = 0 ; shp -> shm_atim = shp -> shm_dtim = 0 ; shp -> shm_ctim = get_seconds ( ) ; shp -> shm_segsz = size ; shp -> shm_nattch = 0 ; shp -> shm_file = file ; shp -> shm_creator = current ; <S2SV_ModStart> no_id ; } <S2SV_ModEnd> list_add ( &
Buggy code:
 static int smbhash ( unsigned char * out, const unsigned char * in, unsigned char * key ) { <START_BUG> int rc ; <END_BUG> unsigned char key2 [ 8 ] ;  struct crypto_skcipher * tfm_des ; <START_BUG> struct scatterlist sgin, sgout ; struct skcipher_request * req ; str_to_key ( key, key2 ) ; <END_BUG> tfm_des = crypto_alloc_skcipher ( "ecb(des)", 0, CRYPTO_ALG_ASYNC ) ;  if ( IS_ERR ( tfm_des ) ) { <START_BUG> rc = PTR_ERR ( tfm_des ) ; <END_BUG> cifs_dbg ( VFS, "could   not   allocate   des   crypto   API\\n" ) ;  goto smbhash_err ; <START_BUG> } req = skcipher_request_alloc ( tfm_des, GFP_KERNEL ) ; if (! req ) { rc = - ENOMEM ; cifs_dbg ( VFS, "could   not   allocate   des   crypto   API\\n" ) ; goto smbhash_free_skcipher ; } crypto_skcipher_setkey ( tfm_des, key2, 8 ) ; <END_BUG> sg_init_one ( & sgin, in, 8 ) ;  sg_init_one ( & sgout, out, 8 ) ; skcipher_request_set_callback ( req, 0, NULL, NULL ) ; skcipher_request_set_crypt ( req, & sgin, & sgout, 8, NULL ) ; rc = crypto_skcipher_encrypt ( req ) ; if ( rc ) cifs_dbg ( VFS, "could   not   encrypt   crypt   key   rc:   %d\\n", rc ) ; skcipher_request_free ( req ) ; smbhash_free_skcipher : crypto_free_skcipher ( tfm_des ) ; <START_BUG> smbhash_err : <END_BUG> return rc ; }

Fix:
<S2SV_ModStart> key ) { <S2SV_ModEnd> unsigned char key2 <S2SV_ModStart> ] ; struct crypto_cipher * tfm_des <S2SV_ModEnd> ; str_to_key ( <S2SV_ModStart> ; tfm_des = crypto_alloc_cipher ( "des" <S2SV_ModEnd>, 0, <S2SV_ModStart>, 0, 0 <S2SV_ModEnd> ) ; if <S2SV_ModStart> ) ) { <S2SV_ModEnd> cifs_dbg ( VFS <S2SV_ModStart> "could <S2SV_blank> not <S2SV_blank> allocate <S2SV_blank> des <S2SV_blank> crypto <S2SV_blank> API\\n" ) ; return PTR_ERR ( tfm_des ) ; } crypto_cipher_setkey <S2SV_ModEnd> ( tfm_des, <S2SV_ModStart> 8 ) ; crypto_cipher_encrypt_one ( tfm_des, out, in ) ; crypto_free_cipher <S2SV_ModEnd> ( tfm_des ) <S2SV_ModStart> tfm_des ) ; return 0 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int read_fru_area_section ( struct ipmi_intf * intf, struct fru_info * fru, uint8_t id, uint32_t offset, uint32_t length, uint8_t * frubuf ) { static uint32_t fru_data_rqst_size = 20 ; <START_BUG> uint32_t off = offset, tmp, finish ; <END_BUG> struct ipmi_rs * rsp ; struct ipmi_rq req ; uint8_t msg_data [ 4 ] ; if ( offset > fru -> size ) { lprintf ( LOG_ERR, "Read   FRU   Area   offset   incorrect:   %d   >   %d", offset, fru -> size ) ; return - 1 ; } finish = offset + length ; if ( finish > fru -> size ) {  finish = fru -> size ; <START_BUG> lprintf ( LOG_NOTICE, "Read   FRU   Area   length   %d   too   large,   " "Adjusting   to   %d", <END_BUG> offset + length, finish - offset ) ;  } memset ( & req, 0, sizeof ( req ) ) ; req. msg. netfn = IPMI_NETFN_STORAGE ; req. msg. cmd = GET_FRU_DATA ; req. msg. data = msg_data ; req. msg. data_len = 4 ; # ifdef LIMIT_ALL_REQUEST_SIZE if ( fru_data_rqst_size > 16 ) # else if ( fru -> access && fru_data_rqst_size > 16 ) # endif fru_data_rqst_size = 16 ; <START_BUG> do { <END_BUG> tmp = fru -> access? off >> 1 : off ; msg_data [ 0 ] = id ; msg_data [ 1 ] = ( uint8_t ) ( tmp & 0xff ) ; msg_data [ 2 ] = ( uint8_t ) ( tmp >> 8 ) ; tmp = finish - off ; if ( tmp > fru_data_rqst_size ) msg_data [ 3 ] = ( uint8_t ) fru_data_rqst_size ; else msg_data [ 3 ] = ( uint8_t ) tmp ; rsp = intf -> sendrecv ( intf, & req ) ; if (!

Fix:
<S2SV_ModStart> off = offset ; uint32_t tmp, finish ; uint32_t size_left_in_buffer <S2SV_ModEnd> ; struct ipmi_rs <S2SV_ModStart> size ) { memset ( frubuf + fru -> size, 0, length - fru -> size ) ; <S2SV_ModStart> - offset ) ; length = finish - offset <S2SV_ModStart> = 16 ; size_left_in_buffer = length ; <S2SV_ModStart> 0 ] ; if ( rsp -> data_len < 1 || tmp > rsp -> data_len - 1 || tmp > size_left_in_buffer ) { printf ( " <S2SV_blank> Not <S2SV_blank> enough <S2SV_blank> buffer <S2SV_blank> size" ) ; return - 1 ; } <S2SV_ModStart> += tmp ; size_left_in_buffer -= tmp ;
Buggy code:
 static int parse_rock_ridge_inode_internal ( struct iso_directory_record * de, <START_BUG> struct inode * inode, int regard_xa ) <END_BUG> { int symlink_len = 0 ;  int cnt, sig ; <START_BUG> struct inode * reloc ; struct rock_ridge * rr ; int rootflag ; struct rock_state rs ; int ret = 0 ; if (! ISOFS_SB ( inode -> i_sb ) -> s_rock ) return 0 ; init_rock_state ( & rs, inode ) ; setup_rock_ridge ( de, inode, & rs ) ; <END_BUG> if ( regard_xa ) {  rs. chr += 14 ; rs. len -= 14 ; if ( rs. len < 0 ) rs. len = 0 ; } repeat : while ( rs. len > 2 ) { rr = ( struct rock_ridge * ) rs. chr ; if ( rr -> len < 3 ) goto out ; sig = isonum_721 ( rs. chr ) ; if ( rock_check_overflow ( & rs, sig ) ) goto eio ; rs. chr += rr -> len ; rs. len -= rr -> len ; if ( rs. len < 0 ) goto out ; switch ( sig ) { # ifndef CONFIG_ZISOFS case SIG ( 'R', 'R' ) : if ( ( rr -> u. RR. flags [ 0 ] & ( RR_PX | RR_TF | RR_SL | RR_CL ) ) == 0 ) goto out ; break ; # endif case SIG ( 'S', 'P' ) : if ( check_sp ( rr, inode ) ) goto out ; break ; case SIG ( 'C', 'E' ) : rs. cont_extent = isonum_733 ( rr -> u. CE. extent ) ; rs. cont_offset = isonum_733 ( rr -> u. CE. offset ) ; rs. cont_size = isonum_733 ( rr -> u. CE. size ) ; break ; case SIG ( 'E', 'R' ) : ISOFS_SB ( inode -> i_sb ) -> s_rock = 1 ; printk ( KERN_DEBUG "ISO   9660   Extensions:   " ) ; { int p ; for ( p = 0 ; p < rr -> u. ER. len_id ; p ++

Fix:
<S2SV_ModStart> inode, int flags <S2SV_ModEnd> ) { int <S2SV_ModStart> cnt, sig ; unsigned int reloc_block <S2SV_ModStart> ; if ( flags & RR_REGARD_XA <S2SV_ModEnd> ) { rs <S2SV_ModStart> 'L' ) : if ( flags & RR_RELOC_DE ) { printk ( KERN_ERR "ISOFS: <S2SV_blank> Recursive <S2SV_blank> directory <S2SV_blank> relocation <S2SV_blank> " "is <S2SV_blank> not <S2SV_blank> supported\\n" ) ; goto eio ; } reloc_block = isonum_733 ( rr -> u. CL. location ) ; if ( reloc_block == <S2SV_ModStart> inode ) -> i_iget5_block && ISOFS_I ( inode ) -> i_iget5_offset == 0 ) { printk ( KERN_ERR "ISOFS: <S2SV_blank> Directory <S2SV_blank> relocation <S2SV_blank> points <S2SV_blank> to <S2SV_blank> " "itself\\n" ) ; goto eio ; } ISOFS_I ( inode ) -> i_first_extent = reloc_block <S2SV_ModEnd> ; reloc = <S2SV_ModStart> ; reloc = isofs_iget_reloc <S2SV_ModEnd> ( inode -> <S2SV_ModStart> -> i_sb, reloc_block, <S2SV_ModEnd> 0 ) ;
Buggy code:
 static int mISDN_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sk_buff * skb ; <START_BUG> struct sock * sk = sock -> sk ; <END_BUG> struct sockaddr_mISDN * maddr ; int copied, err ; if ( * debug & DEBUG_SOCKET ) printk ( KERN_DEBUG "%s:   len   %d,   flags   %x   ch.nr   %d,   proto   %x\\n", __func__, ( int ) len, flags, _pms ( sk ) -> ch. nr, sk -> sk_protocol ) ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; if ( sk -> sk_state == MISDN_CLOSED ) return 0 ; skb = skb_recv_datagram ( sk, flags, flags & MSG_DONTWAIT, & err ) ; if (! skb ) return err ;  if ( msg -> msg_namelen >= sizeof ( struct sockaddr_mISDN ) ) { <START_BUG> msg -> msg_namelen = sizeof ( struct sockaddr_mISDN ) ; maddr = ( struct sockaddr_mISDN * ) msg -> msg_name ; maddr -> family = AF_ISDN ; maddr -> dev = _pms ( sk ) -> dev -> id ; if ( ( sk -> sk_protocol == ISDN_P_LAPD_TE ) || ( sk -> sk_protocol == ISDN_P_LAPD_NT ) ) { maddr -> channel = ( mISDN_HEAD_ID ( skb ) >> 16 ) & 0xff ; maddr -> tei = ( mISDN_HEAD_ID ( skb ) >> 8 ) & 0xff ; maddr -> sapi = mISDN_HEAD_ID ( skb ) & 0xff ; } else { maddr -> channel = _pms ( sk ) -> ch. nr ; maddr -> sapi = _pms ( sk ) -> ch. addr & 0xFF ; maddr -> tei = ( _pms ( sk ) -> ch. addr >> 8 ) & 0xFF ; } <END_BUG> } else {  <START_BUG> if ( msg -> msg_namelen ) <END_BUG> printk (

Fix:
<S2SV_ModStart> sock -> sk <S2SV_ModEnd> ; int copied <S2SV_ModStart> ( msg -> msg_name ) { struct sockaddr_mISDN * maddr = <S2SV_ModEnd> msg -> msg_name <S2SV_ModStart> 0xFF ; } <S2SV_ModEnd> msg -> msg_namelen <S2SV_ModStart> msg -> msg_namelen = sizeof ( * maddr ) <S2SV_ModEnd> ; } copied
Buggy code:
 static int rfcomm_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct rfcomm_dlc * d = rfcomm_pi ( sk ) -> dlc ; int len ; if ( test_and_clear_bit ( RFCOMM_DEFER_SETUP, & d -> flags ) ) { <START_BUG> rfcomm_dlc_accept ( d ) ; <END_BUG> msg -> msg_namelen = 0 ; return 0 ; } len = bt_sock_stream_recvmsg ( iocb, sock, msg, size, flags ) ; lock_sock ( sk ) ; if (! ( flags & MSG_PEEK ) && len > 0 ) atomic_sub ( len, & sk -> sk_rmem_alloc ) ; if ( atomic_read ( & sk -> sk_rmem_alloc ) <= ( sk -> sk_rcvbuf >> 2 ) ) rfcomm_dlc_unthrottle ( rfcomm_pi ( sk ) -> dlc ) ; release_sock ( sk ) ; return len ; }

Fix:
<S2SV_ModStart> ( d ) <S2SV_ModEnd> ; return 0
Buggy code:
 void vp8_second_pass ( VP8_COMP * cpi ) { int tmp_q ; int frames_left = ( int ) ( cpi -> twopass. total_stats. count - cpi -> common. current_video_frame ) ; FIRSTPASS_STATS this_frame = { 0 } ; FIRSTPASS_STATS this_frame_copy ; double this_frame_intra_error ; double this_frame_coded_error ; int overhead_bits ; if (! cpi -> twopass. stats_in ) { return ; } vp8_clear_system_state ( ) ; if ( EOF == input_stats ( cpi, & this_frame ) ) return ; this_frame_intra_error = this_frame. intra_error ; this_frame_coded_error = this_frame. coded_error ; if ( cpi -> twopass. frames_to_key == 0 ) { <START_BUG> vpx_memcpy ( & this_frame_copy, & this_frame, sizeof ( this_frame ) ) ; <END_BUG> find_next_key_frame ( cpi, & this_frame_copy ) ; if ( cpi -> oxcf. error_resilient_mode ) { cpi -> twopass. gf_group_bits = cpi -> twopass. kf_group_bits ; cpi -> twopass. gf_group_error_left = ( int ) cpi -> twopass. kf_group_error_left ; cpi -> baseline_gf_interval = cpi -> twopass. frames_to_key ; cpi -> frames_till_gf_update_due = cpi -> baseline_gf_interval ; cpi -> source_alt_ref_pending = 0 ; } } if ( cpi -> frames_till_gf_update_due == 0 ) {  vpx_memcpy ( & this_frame_copy, & this_frame, sizeof ( this_frame ) ) ; <START_BUG> define_gf_group ( cpi, & this_frame_copy ) ; if ( cpi -> source_alt_ref_pending && ( cpi -> common. frame_type!= KEY_FRAME ) ) { int bak = cpi -> per_frame_bandwidth ; <END_BUG> vpx_memc

Fix:
<S2SV_ModStart> 0 ) { memcpy <S2SV_ModEnd> ( & this_frame_copy <S2SV_ModStart> 0 ) { memcpy <S2SV_ModEnd> ( & this_frame_copy <S2SV_ModStart> -> per_frame_bandwidth ; memcpy <S2SV_ModEnd> ( & this_frame_copy <S2SV_ModStart> KEY_FRAME ) { memcpy <S2SV_ModEnd> ( & this_frame_copy <S2SV_ModStart> } else { memcpy <S2SV_ModEnd> ( & this_frame_copy
Buggy code:
 void bdt_enable ( void ) { bdt_log ( "ENABLE   BT" ) ; if ( bt_enabled ) { bdt_log ( "Bluetooth   is   already   enabled" ) ; return ; } <START_BUG> status = sBtInterface -> enable ( ) ; <END_BUG> check_return_status ( status ) ; }

Fix:
<S2SV_ModStart> -> enable ( false
Buggy code:
 static bool disconnect_cb ( struct io * io, void * user_data ) { struct bt_att_chan * chan = user_data ; struct bt_att * att = chan -> att ; int err ; socklen_t len ; len = sizeof ( err ) ; if ( getsockopt ( chan -> fd, SOL_SOCKET, SO_ERROR, & err, & len ) < 0 ) { util_debug ( chan -> att -> debug_callback, chan -> att -> debug_data, "(chan   %p)   Failed   to   obtain   disconnect" "   error:   %s", chan, strerror ( errno ) ) ; err = 0 ; } util_debug ( chan -> att -> debug_callback, chan -> att -> debug_data, "Channel   %p   disconnected:   %s", chan, strerror ( err ) ) ; queue_remove ( att -> chans, chan ) ; <START_BUG> queue_remove_all ( att -> req_queue, NULL, NULL, disc_att_send_op ) ; <END_BUG> queue_remove_all ( att -> ind_queue, NULL, NULL, disc_att_send_op ) ; queue_remove_all ( att -> write_queue, NULL, NULL, disc_att_send_op ) ; if ( chan -> pending_req ) { disc_att_send_op ( chan -> pending_req ) ; chan -> pending_req = NULL ; } if ( chan -> pending_ind ) { disc_att_send_op ( chan -> pending_ind ) ; chan -> pending_ind = NULL ; } bt_att_chan_free ( chan ) ; if (! queue_isempty ( att -> chans ) ) return false ; bt_att_ref ( att ) ;  queue_foreach ( att -> disconn_list, disconn_handler, INT_TO_PTR ( err ) ) ; <START_BUG> bt_att_unregister_all ( att ) ; bt_att_unref ( att ) ; return false ; }<END_BUG>

Fix:
<S2SV_ModStart> chan ) ; <S2SV_ModEnd> if ( chan <S2SV_ModStart> att ) ; att -> in_disc = true ; queue_remove_all ( att -> req_queue, NULL, NULL, disc_att_send_op ) ; queue_remove_all ( att -> ind_queue, NULL, NULL, disc_att_send_op ) ; queue_remove_all ( att -> write_queue, NULL, NULL, disc_att_send_op ) ; att -> in_disc = false ;
Buggy code:
 static int nr_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct sockaddr_ax25 * sax = ( struct sockaddr_ax25 * ) msg -> msg_name ; size_t copied ; struct sk_buff * skb ; int er ; lock_sock ( sk ) ; if ( sk -> sk_state!= TCP_ESTABLISHED ) { release_sock ( sk ) ; return - ENOTCONN ; } if ( ( skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & er ) ) == NULL ) { release_sock ( sk ) ; return er ; } skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } er = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( er < 0 ) { skb_free_datagram ( sk, skb ) ; release_sock ( sk ) ; return er ; } if ( sax!= NULL ) { <START_BUG> sax -> sax25_family = AF_NETROM ; <END_BUG> skb_copy_from_linear_data_offset ( skb, 7, sax -> sax25_call. ax25_call, AX25_ADDR_LEN ) ; } msg -> msg_namelen = sizeof ( * sax ) ; skb_free_datagram ( sk, skb ) ; release_sock ( sk ) ; return copied ; }

Fix:
<S2SV_ModStart> NULL ) { memset ( sax, 0, sizeof ( sax ) ) ;
Buggy code:
 int read_escaped_char ( yyscan_t yyscanner, uint8_t * escaped_char ) { char text [ 4 ] = { 0, 0, 0, 0 } ; text [ 0 ] = '\\\\' ; text [ 1 ] = RE_YY_INPUT ( yyscanner ) ; <START_BUG> if ( text [ 1 ] == EOF ) <END_BUG> return 0 ; if ( text [ 1 ] == 'x' ) { text [ 2 ] = RE_YY_INPUT ( yyscanner ) ;  if ( text [ 2 ] == EOF ) <START_BUG> return 0 ; text [ 3 ] = RE_YY_INPUT ( yyscanner ) ; <END_BUG> if ( text [ 3 ] == EOF )  return 0 ; } * escaped_char = escaped_char_value ( text ) ; return 1 ; }

Fix:
<S2SV_ModStart> ] == EOF || text [ 1 ] == 0 <S2SV_ModStart> ; if (! isxdigit ( <S2SV_ModStart> [ 2 ] ) <S2SV_ModEnd> ) return 0 <S2SV_ModStart> ; if (! isxdigit ( <S2SV_ModStart> [ 3 ] ) <S2SV_ModEnd> ) return 0
Buggy code:
 WORD32 ih264d_end_of_pic ( dec_struct_t * ps_dec, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num ) { dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; <START_BUG> WORD32 ret ; <END_BUG> ps_dec -> u1_first_pb_nal_in_pic = 1 ; ps_dec -> u2_mbx = 0xffff ; ps_dec -> u2_mby = 0 ; { dec_err_status_t * ps_err = ps_dec -> ps_dec_err_status ; if ( ps_err -> u1_err_flag & REJECT_CUR_PIC ) { ih264d_err_pic_dispbuf_mgr ( ps_dec ) ; return ERROR_NEW_FRAME_EXPECTED ; } } H264_MUTEX_LOCK ( & ps_dec -> process_disp_mutex ) ; ret = ih264d_end_of_pic_processing ( ps_dec ) ; if ( ret!= OK ) return ret ; ps_dec -> u2_total_mbs_coded = 0 ; { pocstruct_t * ps_prev_poc = & ps_dec -> s_prev_pic_poc ; pocstruct_t * ps_cur_poc = & ps_dec -> s_cur_pic_poc ; if ( ( 0 == u1_is_idr_slice ) && ps_cur_slice -> u1_nal_ref_idc ) ps_dec -> u2_prev_ref_frame_num = ps_cur_slice -> u2_frame_num ; if ( u1_is_idr_slice || ps_cur_slice -> u1_mmco_equalto5 ) ps_dec -> u2_prev_ref_frame_num = 0 ; if ( ps_dec -> ps_cur_sps -> u1_gaps_in_frame_num_value_allowed_flag ) { ret = ih264d_decode_gaps_in_frame_num ( ps_dec, u2_frame_num ) ; if ( ret!= OK ) return ret ; } ps_prev_poc -> i4_prev_frame

Fix:
<S2SV_ModStart> ; WORD32 ret <S2SV_ModEnd> ; ps_dec ->
Buggy code:
 void read_sequence_header ( decoder_info_t * decoder_info, stream_t * stream ) { decoder_info -> width = get_flc ( 16, stream ) ; decoder_info -> height = get_flc ( 16, stream ) ; <START_BUG> decoder_info -> log2_sb_size = get_flc ( 3, stream ) ; <END_BUG> decoder_info -> pb_split = get_flc ( 1, stream ) ; decoder_info -> tb_split_enable = get_flc ( 1, stream ) ; decoder_info -> max_num_ref = get_flc ( 2, stream ) + 1 ; decoder_info -> interp_ref = get_flc ( 2, stream ) ; decoder_info -> max_delta_qp = get_flc ( 1, stream ) ; decoder_info -> deblocking = get_flc ( 1, stream ) ; decoder_info -> clpf = get_flc ( 1, stream ) ; decoder_info -> use_block_contexts = get_flc ( 1, stream ) ; decoder_info -> bipred = get_flc ( 2, stream ) ; decoder_info -> qmtx = get_flc ( 1, stream ) ; if ( decoder_info -> qmtx ) { decoder_info -> qmtx_offset = get_flc ( 6, stream ) - 32 ; } decoder_info -> subsample = get_flc ( 2, stream ) ; decoder_info -> subsample = ( decoder_info -> subsample & 1 ) * 20 + ( decoder_info -> subsample & 2 ) * 22 + ( ( decoder_info -> subsample & 3 ) == 3 ) * 2 + 400 ; decoder_info -> num_reorder_pics = get_flc ( 4, stream ) ; if ( decoder_info -> subsample!= 400 ) { decoder_info -> cfl_intra = get_flc ( 1, stream ) ; decoder_info -> cfl_inter = get_flc ( 1, stream ) ; } decoder_info -> bitdepth = get_flc ( 1, stream )? 10 : 8 ; if ( decoder_info -> bitdepth == 10 ) decoder_info -> bitdepth += 2 * get_flc ( 1, stream ) ; decoder_info -> input_bitdepth = get_flc (

Fix:
<S2SV_ModStart> 3, stream ) ; decoder_info -> log2_sb_size = clip ( decoder_info -> log2_sb_size, log2i ( MIN_BLOCK_SIZE ), log2i ( MAX_SB_SIZE )
Buggy code:
 static int asymmetric_key_match_preparse ( struct key_match_data * match_data ) { match_data -> lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> = KEYRING_SEARCH_LOOKUP_ITERATE ; match_data -> cmp = asymmetric_key_cmp ;
Buggy code:
 SYSCALL_DEFINE3 ( rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t __user *, uinfo ) { siginfo_t info ; if ( copy_from_user ( & info, uinfo, sizeof ( siginfo_t ) ) ) return - EFAULT ; <START_BUG> if ( info. si_code >= 0 ) <END_BUG>  return - EPERM ; <START_BUG> info. si_signo = sig ; return kill_proc_info ( sig, & info, pid ) ; }<END_BUG>

Fix:
<S2SV_ModStart> info. si_code!= SI_QUEUE ) { WARN_ON_ONCE ( info. si_code < 0 ) ; <S2SV_ModEnd> return - EPERM <S2SV_ModStart> - EPERM ; }
Buggy code:
 <START_BUG> static char * print_string_ptr ( const char * str ) <END_BUG> { const char * ptr ;  char * ptr2, * out ; <START_BUG> <END_BUG> int len = 0 ;  unsigned char token ; if (! str ) <START_BUG> return cJSON_strdup ( "" ) ; <END_BUG> ptr = str ; while ( ( token = * ptr ) && ++ len ) { if ( strchr ( "\\"\\\\\\b\\f\\n\\r\\t", token ) )  ++ len ; <START_BUG> else if ( token < 32 ) len += 5 ; <END_BUG> ++ ptr ;  } <START_BUG> if (! ( out = ( char * ) cJSON_malloc ( len + 3 ) ) ) <END_BUG> return 0 ; ptr2 = out ; ptr = str ; * ptr2 ++ = \'\\"\' ; while ( * ptr ) { if ( ( unsigned char ) * ptr > 31 && * ptr!= \'\\"\' && * ptr!= '\\\\' ) * ptr2 ++ = * ptr ++ ; else { * ptr2 ++ = '\\\\' ; switch ( token = * ptr ++ ) { case '\\\\' : * ptr2 ++ = '\\\\' ; break ; case \'\\"\' : * ptr2 ++ = \'\\"\' ; break ; case '\\b' : * ptr2 ++ = 'b' ; break ; case '\\f' : * ptr2 ++ = 'f' ; break ; case '\\n' : * ptr2 ++ = 'n' ; break ; case '\\r' : * ptr2 ++ = 'r' ; break ; case '\\t' : * ptr2 ++ = 't' ; break ; default : sprintf ( ptr2, "u%04x", token ) ; ptr2 += 5 ;  break ; <START_BUG> } } } * ptr2 ++ = \'\\"\' ; * ptr2 ++ = 0 ; return out ; }<END_BUG>

Fix:
<S2SV_ModStart> char * str, printbuffer * p <S2SV_ModStart> * ptr ; char * ptr2, * out ; <S2SV_ModEnd> int len = <S2SV_ModStart> len = 0, flag = 0 ; <S2SV_ModEnd> unsigned char token <S2SV_ModStart>! str ) { if ( p ) out = ensure ( p, 3 ) ; else out = ( char * ) cJSON_malloc ( 3 ) ; if (! out ) return 0 ; strcpy ( out, "\\"\\"" ) ; return out ; } for ( ptr = str ; * ptr ; ptr ++ ) flag |= ( ( * ptr > 0 && * ptr < 32 ) || ( * ptr == \'\\"\' ) || ( * ptr == '\\\\' ) )? 1 : 0 ; if (! flag ) { len = ptr - str ; if ( p ) out = ensure ( p, len + 3 ) ; else out = ( char * ) cJSON_malloc ( len + 3 ) ; if (! out ) return 0 ; ptr2 = out ; * ptr2 ++ = \'\\"\' ; strcpy ( ptr2, str ) ; ptr2 [ len ] = \'\\"\' ; ptr2 [ len + 1 ] = 0 ; return out ; } ptr = str ; <S2SV_ModEnd> while ( ( <S2SV_ModStart> token
Buggy code:
 void exif_data_load_data ( ExifData * data, const unsigned char * d_orig, unsigned int ds ) { unsigned int l ; ExifLong offset ; ExifShort n ; const unsigned char * d = d_orig ; unsigned int len, fullds ; if (! data ||! data -> priv ||! d ||! ds ) return ; exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Parsing   %i   byte(s)   EXIF   data...\\n", ds ) ; if ( ds < 6 ) { LOG_TOO_SMALL ; return ; } if (! memcmp ( d, ExifHeader, 6 ) ) { exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Found   EXIF   header   at   start." ) ; } else { while ( ds >= 3 ) { while ( ds && ( d [ 0 ] == 0xff ) ) { d ++ ; ds -- ; } if ( ds && d [ 0 ] == JPEG_MARKER_SOI ) { d ++ ; ds -- ; continue ; } if ( ds && d [ 0 ] == JPEG_MARKER_APP1 ) break ; if ( ds >= 3 && d [ 0 ] >= 0xe0 && d [ 0 ] <= 0xef ) { d ++ ; ds -- ; l = ( d [ 0 ] << 8 ) | d [ 1 ] ; if ( l > ds ) return ; d += l ; ds -= l ; continue ; } exif_log ( data -> priv -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", _ ( "EXIF   marker   not   found." ) ) ; return ; } if ( ds < 3 ) { LOG_TOO_SMALL ; return ; } d ++ ; ds -- ; len = ( d [ 0 ] << 8 ) | d [ 1 ] ; exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "We   have   to   deal   with   %i   byte(s)   of   EXIF   data.", len ) ; d += 2 ; ds -= 2 ; } if ( ds < 6 ) { LOG_TOO_SMALL ; return ;

Fix:
<S2SV_ModStart> offset > ds - 6 <S2SV_ModEnd> ) { exif_log
Buggy code:
 static int parseFileInner ( MaState * state, cchar * path ) { MaDirective * directive ; char * tok, * key, * line, * value ; assert ( state ) ; assert ( path && * path ) ; if ( openConfig ( state, path ) < 0 ) { return MPR_ERR_CANT_OPEN ; } for ( state -> lineNumber = 1 ; state -> file && ( line = mprReadLine ( state -> file, 0, NULL ) )!= 0 ; state -> lineNumber ++ ) { for ( tok = line ; isspace ( ( uchar ) * tok ) ; tok ++ ) ; if ( * tok == '\\0' || * tok == '#' ) { continue ; } state -> key = 0 ; <START_BUG> key = getDirective ( line, & value ) ; <END_BUG> if (! state -> enabled ) { if ( key [ 0 ]!= '<' ) { continue ; } } if ( ( directive = mprLookupKey ( directives, key ) ) == 0 ) { mprLog ( "error   appweb   config", 0, "Unknown   directive   \\"%s\\".   At   line   %d   in   %s", key, state -> lineNumber, state -> filename ) ; return MPR_ERR_BAD_SYNTAX ; } state -> key = key ; mprPauseGC ( ) ; if ( ( * directive ) ( state, key, value ) < 0 ) { mprResumeGC ( ) ; mprLog ( "error   appweb   config", 0, "Error   with   directive   \\"%s\\".   At   line   %d   in   %s", state -> key, state -> lineNumber, state -> filename ) ; return MPR_ERR_BAD_SYNTAX ; } mprResumeGC ( ) ; mprYield ( 0 ) ; state = state -> top -> current ; } if ( state -> prev && state -> file == state -> prev -> file ) { mprLog ( "error   appweb   config", 0, "Unclosed   directives   in   %s", state -> filename ) ; while ( state -> prev && state -> file == state -> prev -> file ) { state = state -> prev ; } } mprCloseFile ( state -> file ) ; return 0 ; }

Fix:
<S2SV_ModStart> = 0 ; if ( ( <S2SV_ModStart> & value ) ) == 0 ) { continue ; } <S2SV_ModEnd> if (!
Buggy code:
 static int packet_do_bind ( struct sock * sk, const char * name, int ifindex, __be16 proto ) { struct packet_sock * po = pkt_sk ( sk ) ; struct net_device * dev_curr ; __be16 proto_curr ; bool need_rehook ; struct net_device * dev = NULL ; int ret = 0 ; bool unlisted = false ; <START_BUG> if ( po -> fanout ) <END_BUG>  return - EINVAL ; <START_BUG> <END_BUG> lock_sock ( sk ) ;  spin_lock ( & po -> bind_lock ) ; rcu_read_lock ( ) ; if ( name ) { dev = dev_get_by_name_rcu ( sock_net ( sk ), name ) ; if (! dev ) { ret = - ENODEV ; goto out_unlock ; } } else if ( ifindex ) { dev = dev_get_by_index_rcu ( sock_net ( sk ), ifindex ) ; if (! dev ) { ret = - ENODEV ; goto out_unlock ; } } if ( dev ) dev_hold ( dev ) ; proto_curr = po -> prot_hook. type ; dev_curr = po -> prot_hook. dev ; need_rehook = proto_curr!= proto || dev_curr!= dev ; if ( need_rehook ) { if ( po -> running ) { rcu_read_unlock ( ) ; __unregister_prot_hook ( sk, true ) ; rcu_read_lock ( ) ; dev_curr = po -> prot_hook. dev ; if ( dev ) unlisted =! dev_get_by_index_rcu ( sock_net ( sk ), dev -> ifindex ) ; } po -> num = proto ; po -> prot_hook. type = proto ; if ( unlikely ( unlisted ) ) { dev_put ( dev ) ; po -> prot_hook. dev = NULL ; po -> ifindex = - 1 ; packet_cached_dev_reset ( po ) ; } else { po -> prot_hook. dev = dev ; po -> ifindex = dev? dev -> ifindex : 0 ; packet_cached_dev_assign ( po, dev ) ; } } if ( dev_curr ) dev_put ( dev_curr ) ; if ( proto == 0 ||! need_rehook ) goto out

Fix:
<S2SV_ModStart> = false ; lock_sock ( sk ) ; spin_lock ( & po -> bind_lock ) ; rcu_read_lock ( ) ; <S2SV_ModStart> -> fanout ) { ret = <S2SV_ModEnd> - EINVAL ; <S2SV_ModStart> - EINVAL ; goto out_unlock ; } <S2SV_ModEnd> if ( name
Buggy code:
 static __init int sctp_init ( void ) { int i ; int status = - EINVAL ; unsigned long goal ; unsigned long limit ; int max_share ; int order ; sock_skb_cb_check_size ( sizeof ( struct sctp_ulpevent ) ) ; status = - ENOBUFS ; sctp_bucket_cachep = kmem_cache_create ( "sctp_bind_bucket", sizeof ( struct sctp_bind_bucket ), 0, SLAB_HWCACHE_ALIGN, NULL ) ; if (! sctp_bucket_cachep ) goto out ; sctp_chunk_cachep = kmem_cache_create ( "sctp_chunk", sizeof ( struct sctp_chunk ), 0, SLAB_HWCACHE_ALIGN, NULL ) ; if (! sctp_chunk_cachep ) goto err_chunk_cachep ; status = percpu_counter_init ( & sctp_sockets_allocated, 0, GFP_KERNEL ) ; if ( status ) goto err_percpu_counter_init ; sctp_max_instreams = SCTP_DEFAULT_INSTREAMS ; sctp_max_outstreams = SCTP_DEFAULT_OUTSTREAMS ; idr_init ( & sctp_assocs_id ) ; limit = nr_free_buffer_pages ( ) // 8 ; limit = max ( limit, 128UL ) ; sysctl_sctp_mem [ 0 ] = limit // 4 * 3 ; sysctl_sctp_mem [ 1 ] = limit ; sysctl_sctp_mem [ 2 ] = sysctl_sctp_mem [ 0 ] * 2 ; limit = ( sysctl_sctp_mem [ 1 ] ) << ( PAGE_SHIFT - 7 ) ; max_share = min ( 4UL * 1024 * 1024, limit ) ; sysctl_sctp_rmem [ 0 ] = SK_MEM_QUANTUM ; sysctl_sctp_rmem [ 1 ] = 1500 * SKB_TRUESIZE ( 1 ) ; sysctl_sctp_rmem [ 2 ] = max ( sysctl_sctp_rmem [ 1 ], max_share ) ; sysctl_sctp_wmem [ 0 ]

Fix:
<S2SV_ModStart> ; status = register_pernet_subsys ( & sctp_defaults_ops ) ; if ( status ) goto err_register_defaults ; status = <S2SV_ModStart> register_pernet_subsys ( & sctp_ctrlsock_ops ) ; if ( status ) goto err_register_ctrlsock <S2SV_ModEnd> ; status = <S2SV_ModStart> unregister_pernet_subsys ( & sctp_ctrlsock_ops ) ; err_register_ctrlsock <S2SV_ModEnd> : sctp_v6_protosw_exit ( <S2SV_ModStart> ) ; err_protosw_init : unregister_pernet_subsys ( & sctp_defaults_ops ) ; err_register_defaults
Buggy code:
 static bool check_underflow ( const struct arpt_entry * e ) { const struct xt_entry_target * t ; unsigned int verdict ; <START_BUG> if (! unconditional ( & e -> arp ) ) <END_BUG> return false ; t = arpt_get_target_c ( e ) ; if ( strcmp ( t -> u. user. name, XT_STANDARD_TARGET )!= 0 ) return false ; verdict = ( ( struct xt_standard_target * ) t ) -> verdict ; verdict = - verdict - 1 ; return verdict == NF_DROP || verdict == NF_ACCEPT ; }

Fix:
<S2SV_ModStart>! unconditional ( e <S2SV_ModEnd> ) ) return
Buggy code:
 static OPJ_BOOL bmp_read_rle8_data ( FILE * IN, OPJ_UINT8 * pData, OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height ) { <START_BUG> OPJ_UINT32 x, y ; <END_BUG> OPJ_UINT8 * pix ; const OPJ_UINT8 * beyond ; beyond = pData + stride * height ; pix = pData ;  x = y = 0U ; <START_BUG> while ( y < height ) { int c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } if ( c ) { int j, c1_int ; OPJ_UINT8 c1 ; c1_int = getc ( IN ) ; if ( c1_int == EOF ) { return OPJ_FALSE ; } c1 = ( OPJ_UINT8 ) c1_int ; for ( j = 0 ; ( j < c ) && ( x < width ) && ( ( OPJ_SIZE_T ) pix < ( OPJ_SIZE_T ) beyond ) ; j ++, x ++, pix ++ ) { <END_BUG> * pix = c1 ;  } } else { c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } if ( c == 0x00 ) { x = 0 ; ++ y ; pix = pData + y * stride + x ; } else if ( c == 0x01 ) { break ; } else if ( c == 0x02 ) { c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } x += ( OPJ_UINT32 ) c ; c = getc ( IN ) ; if ( c == EOF ) { return OPJ_FALSE ; } y += ( OPJ_UINT32 ) c ; pix = pData + y * stride + x ; } else { int j ; for ( j = 0 ; ( j < c ) && ( x < width ) && ( ( OPJ_SIZE_T ) pix < ( OPJ_SIZE_T ) beyond ) ; j ++, x ++, pix ++ ) { int c1_int ; OPJ_UINT8 c1 ; c1_int = getc ( IN ) ; if ( c1_

Fix:
<S2SV_ModStart> x, y, written <S2SV_ModStart> = y = written = <S2SV_ModStart> pix = c1 ; written ++ <S2SV_ModStart> = c1 ; written ++ ; <S2SV_ModStart> } } } if ( written!= width * height ) { fprintf ( stderr, "warning, <S2SV_blank> image\'s <S2SV_blank> actual <S2SV_blank> size <S2SV_blank> does <S2SV_blank> not <S2SV_blank> match <S2SV_blank> advertized <S2SV_blank> one\\n" ) ; return OPJ_FALSE ; }
Buggy code:
 static void rdpsnd_process_training ( STREAM in ) { uint16 tick ; uint16 packsize ; <START_BUG> STREAM out ; <END_BUG> in_uint16_le ( in, tick ) ; in_uint16_le ( in, packsize ) ; logger ( Sound, Debug, "rdpsnd_process_training(),   tick=0x%04x", ( unsigned ) tick ) ; out = rdpsnd_init_packet ( SNDC_TRAINING, 4 ) ; out_uint16_le ( out, tick ) ; out_uint16_le ( out, packsize ) ; s_mark_end ( out ) ; rdpsnd_send ( out ) ; }

Fix:
<S2SV_ModStart> STREAM out ; struct stream packet = * in ; if (! s_check_rem ( in, 4 ) ) { rdp_protocol_error ( "rdpsnd_process_training(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> training <S2SV_blank> data <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 static char * get_object ( FILE * fp, int obj_id, const xref_t * xref, size_t * size, int * is_stream ) { static const int blk_sz = 256 ; int i, total_sz, read_sz, n_blks, search, stream ; size_t obj_sz ; char * c, * data ; long start ; const xref_entry_t * entry ; if ( size ) * size = 0 ; if ( is_stream ) * is_stream = 0 ; start = ftell ( fp ) ; entry = NULL ; for ( i = 0 ; i < xref -> n_entries ; i ++ ) if ( xref -> entries [ i ]. obj_id == obj_id ) { entry = & xref -> entries [ i ] ; break ; } if (! entry ) return NULL ; fseek ( fp, entry -> offset, SEEK_SET ) ; obj_sz = 0 ; total_sz = 0 ; n_blks = 1 ; <START_BUG> data = malloc ( blk_sz * n_blks ) ; <END_BUG> memset ( data, 0, blk_sz * n_blks ) ; stream = 0 ; while ( ( read_sz = fread ( data + total_sz, 1, blk_sz - 1, fp ) ) &&! ferror ( fp ) ) { total_sz += read_sz ; * ( data + total_sz ) = '\\0' ; if ( total_sz + blk_sz >= ( blk_sz * n_blks ) ) data = realloc ( data, blk_sz * ( ++ n_blks ) ) ; search = total_sz - read_sz ; if ( search < 0 ) search = 0 ; if ( ( c = strstr ( data + search, "endobj" ) ) ) { * ( c + strlen ( "endobj" ) + 1 ) = '\\0' ; obj_sz = ( void * ) strstr ( data + search, "endobj" ) - ( void * ) data ; obj_sz += strlen ( "endobj" ) + 1 ; break ; } else if ( strstr ( data, "stream" ) ) stream = 1 ; } clearerr ( fp ) ; fseek ( fp, start, SEEK_SET ) ; if ( size ) * size = obj_sz ; if ( is_stream ) * is_stream =

Fix:
<S2SV_ModStart> ; data = safe_calloc ( <S2SV_ModEnd> blk_sz * n_blks
Buggy code:
 static bool _bson_iter_next_internal ( bson_iter_t * iter, uint32_t next_keylen, const char * * key, uint32_t * bson_type, bool * unsupported ) { const uint8_t * data ; uint32_t o ; unsigned int len ; BSON_ASSERT ( iter ) ; * unsupported = false ; if (! iter -> raw ) { * key = NULL ; * bson_type = BSON_TYPE_EOD ; return false ; } data = iter -> raw ; len = iter -> len ; iter -> off = iter -> next_off ; iter -> type = iter -> off ; iter -> key = iter -> off + 1 ; iter -> d1 = 0 ; iter -> d2 = 0 ; iter -> d3 = 0 ; iter -> d4 = 0 ; if ( next_keylen == 0 ) { for ( o = iter -> key ; o < len ; o ++ ) { if (! data [ o ] ) { iter -> d1 = ++ o ; goto fill_data_fields ; } } } else { o = iter -> key + next_keylen + 1 ; iter -> d1 = o ; goto fill_data_fields ; } goto mark_invalid ; fill_data_fields : * key = bson_iter_key_unsafe ( iter ) ; * bson_type = ITER_TYPE ( iter ) ; switch ( * bson_type ) { case BSON_TYPE_DATE_TIME : case BSON_TYPE_DOUBLE : case BSON_TYPE_INT64 : case BSON_TYPE_TIMESTAMP : iter -> next_off = o + 8 ; break ; case BSON_TYPE_CODE : case BSON_TYPE_SYMBOL : case BSON_TYPE_UTF8 : { uint32_t l ; if ( ( o + 4 ) >= len ) { iter -> err_off = o ; goto mark_invalid ; } iter -> d2 = o + 4 ; memcpy ( & l, iter -> raw + iter -> d1, sizeof ( l ) ) ; l = BSON_UINT32_FROM_LE ( l ) ; if ( l > ( len - ( o + 4 ) ) ) { iter -> err_off = o ; goto mark_invalid ; } iter -> next_off = o + 4 + l ; if ( BSON_UNLIKELY ( ( l == 0 )

Fix:
<S2SV_ModStart> len - o - 4
Buggy code:
 static void write_frame_size_with_refs ( VP9_COMP * cpi, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG> VP9_COMMON * const cm = & cpi -> common ; int found = 0 ; MV_REFERENCE_FRAME ref_frame ; for ( ref_frame = LAST_FRAME ; ref_frame <= ALTREF_FRAME ; ++ ref_frame ) { YV12_BUFFER_CONFIG * cfg = get_ref_frame_buffer ( cpi, ref_frame ) ;  found = cm -> width == cfg -> y_crop_width && <START_BUG> cm -> height == cfg -> y_crop_height ; <END_BUG> if ( cpi -> use_svc ) {  found = 0 ; } vp9_wb_write_bit ( wb, found ) ; if ( found ) { break ; } } if (! found ) { <START_BUG> vp9_wb_write_literal ( wb, cm -> width - 1, 16 ) ; <END_BUG>  vp9_wb_write_literal ( wb, cm -> height - 1, 16 ) ; <START_BUG> } write_display_size ( cm, wb ) ; }<END_BUG>

Fix:
<S2SV_ModStart> cpi, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> ref_frame ) ; if ( cpi -> use_svc && ( ( cpi -> svc. number_temporal_layers > 1 && cpi -> oxcf. rc_mode == VPX_CBR ) || ( cpi -> svc. number_spatial_layers > 1 && cpi -> svc. layer_context [ cpi -> svc. spatial_layer_id ]. is_key_frame ) || ( is_two_pass_svc ( cpi ) && cpi -> svc. encode_empty_frame_state == ENCODING && cpi -> svc. layer_context [ 0 ]. frames_from_key_frame < cpi -> svc. number_temporal_layers + 1 ) ) ) { found = 0 ; } else if ( cfg!= NULL ) { <S2SV_ModStart> -> y_crop_height ; } vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> found ) { vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 16 ) ; vpx_wb_write_literal <S2SV_ModEnd> ( wb,
Buggy code:
 void bootp_print ( netdissect_options * ndo, register const u_char * cp, u_int length ) { register const struct bootp * bp ; static const u_char vm_cmu [ 4 ] = VM_CMU ; static const u_char vm_rfc1048 [ 4 ] = VM_RFC1048 ; bp = ( const struct bootp * ) cp ; ND_TCHECK ( bp -> bp_op ) ; ND_PRINT ( ( ndo, "BOOTP//DHCP,   %s", tok2str ( bootp_op_values, "unknown   (0x%02x)", bp -> bp_op ) ) ) ; ND_TCHECK ( bp -> bp_hlen ) ; if ( bp -> bp_htype == 1 && bp -> bp_hlen == 6 && bp -> bp_op == BOOTPREQUEST ) { ND_TCHECK2 ( bp -> bp_chaddr [ 0 ], 6 ) ; ND_PRINT ( ( ndo, "   from   %s", etheraddr_string ( ndo, bp -> bp_chaddr ) ) ) ; } ND_PRINT ( ( ndo, ",   length   %u", length ) ) ; if (! ndo -> ndo_vflag ) return ; ND_TCHECK ( bp -> bp_secs ) ; if ( bp -> bp_htype!= 1 ) ND_PRINT ( ( ndo, ",   htype   %d", bp -> bp_htype ) ) ; if ( bp -> bp_htype!= 1 || bp -> bp_hlen!= 6 ) ND_PRINT ( ( ndo, ",   hlen   %d", bp -> bp_hlen ) ) ; if ( bp -> bp_hops ) ND_PRINT ( ( ndo, ",   hops   %d", bp -> bp_hops ) ) ; if ( EXTRACT_32BITS ( & bp -> bp_xid ) ) ND_PRINT ( ( ndo, ",   xid   0x%x", EXTRACT_32BITS ( & bp -> bp_xid ) ) ) ; if ( EXTRACT_16BITS ( & bp -> bp_secs ) ) ND_PRINT ( ( ndo, ",   secs   %d"

Fix:
<S2SV_ModStart> ) ) ; ND_TCHECK ( bp -> bp_flags ) ;