nus-yam/ex-repair huggingface dataset:
Buggy code:
 int net_get ( int s, void * arg, int * len ) { struct net_hdr nh ; int plen ; if ( net_read_exact ( s, & nh, sizeof ( nh ) ) == - 1 ) { return - 1 ; } plen = ntohl ( nh. nh_len ) ; if (! ( plen <= * len ) ) printf ( "PLEN   %d   type   %d   len   %d\\n", plen, nh. nh_type, * len ) ; <START_BUG> assert ( plen <= * len ) ; <END_BUG> * len = plen ; if ( ( * len ) && ( net_read_exact ( s, arg, * len ) == - 1 ) ) { return - 1 ; } return nh. nh_type ; }

Fix:
<S2SV_ModStart> <= * len && plen > 0
Buggy code:
 static int snd_ctl_elem_user_tlv ( struct snd_kcontrol * kcontrol, int op_flag, unsigned int size, unsigned int __user * tlv ) { struct user_element * ue = kcontrol -> private_data ; int change = 0 ; void * new_data ; if ( op_flag > 0 ) { if ( size > 1024 * 128 ) return - EINVAL ; new_data = memdup_user ( tlv, size ) ; if ( IS_ERR ( new_data ) ) return PTR_ERR ( new_data ) ; <START_BUG> change = ue -> tlv_data_size!= size ; <END_BUG> if (! change ) change = memcmp ( ue -> tlv_data, new_data, size ) ; kfree ( ue -> tlv_data ) ; ue -> tlv_data = new_data ; ue -> tlv_data_size = size ;  } else { <START_BUG> if (! ue -> tlv_data_size ||! ue -> tlv_data ) <END_BUG> return - ENXIO ;  <START_BUG> if ( size < ue -> tlv_data_size ) <END_BUG>  return - ENOSPC ; <START_BUG> <END_BUG> if ( copy_to_user ( tlv, ue -> tlv_data, ue -> tlv_data_size ) )  <START_BUG> return - EFAULT ; <END_BUG>  } <START_BUG> return change ; }<END_BUG>

Fix:
<S2SV_ModStart> new_data ) ; mutex_lock ( & ue -> card -> user_ctl_lock ) ; <S2SV_ModStart> = size ; mutex_unlock ( & ue -> card -> user_ctl_lock ) ; <S2SV_ModStart> } else { int ret = 0 ; mutex_lock ( & ue -> card -> user_ctl_lock ) ; <S2SV_ModStart> -> tlv_data ) { ret = <S2SV_ModEnd> - ENXIO ; <S2SV_ModStart> - ENXIO ; goto err_unlock ; } <S2SV_ModStart> -> tlv_data_size ) { ret = <S2SV_ModEnd> - ENOSPC ; <S2SV_ModStart> - ENOSPC ; goto err_unlock ; } <S2SV_ModStart> tlv_data_size ) ) ret = <S2SV_ModEnd> - EFAULT ; <S2SV_ModStart> - EFAULT ; err_unlock : mutex_unlock ( & ue -> card -> user_ctl_lock ) ; if ( ret ) return ret ;
Buggy code:
 static enum hrtimer_restart posix_timer_fn ( struct hrtimer * timer ) { struct k_itimer * timr ; unsigned long flags ; int si_private = 0 ; enum hrtimer_restart ret = HRTIMER_NORESTART ; timr = container_of ( timer, struct k_itimer, it. real. timer ) ; spin_lock_irqsave ( & timr -> it_lock, flags ) ; timr -> it_active = 0 ; if ( timr -> it_interval!= 0 ) si_private = ++ timr -> it_requeue_pending ; if ( posix_timer_event ( timr, si_private ) ) { if ( timr -> it_interval!= 0 ) { ktime_t now = hrtimer_cb_get_time ( timer ) ; # ifdef CONFIG_HIGH_RES_TIMERS { ktime_t kj = NSEC_PER_SEC // HZ ; if ( timr -> it_interval < kj ) now = ktime_add ( now, kj ) ; } # endif <START_BUG> timr -> it_overrun += ( unsigned int ) <END_BUG> hrtimer_forward ( timer, now, timr -> it_interval ) ; ret = HRTIMER_RESTART ; ++ timr -> it_requeue_pending ; timr -> it_active = 1 ; } } unlock_timer ( timr, flags ) ; return ret ; }

Fix:
<S2SV_ModStart> -> it_overrun += <S2SV_ModEnd> hrtimer_forward ( timer
Buggy code:
 int sbusfb_ioctl_helper ( unsigned long cmd, unsigned long arg, struct fb_info * info, int type, int fb_depth, unsigned long fb_size ) { switch ( cmd ) { case FBIOGTYPE : { struct fbtype __user * f = ( struct fbtype __user * ) arg ; if ( put_user ( type, & f -> fb_type ) || __put_user ( info -> var. yres, & f -> fb_height ) || __put_user ( info -> var. xres, & f -> fb_width ) || __put_user ( fb_depth, & f -> fb_depth ) || __put_user ( 0, & f -> fb_cmsize ) || __put_user ( fb_size, & f -> fb_cmsize ) ) return - EFAULT ; return 0 ; } case FBIOPUTCMAP_SPARC : { struct fbcmap __user * c = ( struct fbcmap __user * ) arg ; struct fb_cmap cmap ; u16 red, green, blue ; u8 red8, green8, blue8 ; unsigned char __user * ured ; unsigned char __user * ugreen ; unsigned char __user * ublue ; <START_BUG> int index, count, i ; <END_BUG> if ( get_user ( index, & c -> index ) || __get_user ( count, & c -> count ) || __get_user ( ured, & c -> red ) || __get_user ( ugreen, & c -> green ) || __get_user ( ublue, & c -> blue ) ) return - EFAULT ; cmap. len = 1 ; cmap. red = & red ; cmap. green = & green ; cmap. blue = & blue ; cmap. transp = NULL ; for ( i = 0 ; i < count ; i ++ ) { int err ; if ( get_user ( red8, & ured [ i ] ) || get_user ( green8, & ugreen [ i ] ) || get_user ( blue8, & ublue [ i ] ) ) return - EFAULT ; red = red8 << 8 ; green = green8 << 8 ; blue = blue8 << 8 ; cmap. start = index + i ; err = fb_set_cmap ( & cmap, info ) ; if ( err ) return err ; }

Fix:
<S2SV_ModStart> * ublue ; unsigned <S2SV_ModStart> -> cmap ; unsigned
Buggy code:
 static int gtStripContig ( TIFFRGBAImage * img, uint32 * raster, uint32 w, uint32 h ) { TIFF * tif = img -> tif ; tileContigRoutine put = img -> put. contig ; uint32 row, y, nrow, nrowsub, rowstoread ; tmsize_t pos ; unsigned char * buf = NULL ; uint32 rowsperstrip ; uint16 subsamplinghor, subsamplingver ; uint32 imagewidth = img -> width ; tmsize_t scanline ; int32 fromskew, toskew ; int ret = 1, flip ; tmsize_t maxstripsize ; TIFFGetFieldDefaulted ( tif, TIFFTAG_YCBCRSUBSAMPLING, & subsamplinghor, & subsamplingver ) ; if ( subsamplingver == 0 ) { TIFFErrorExt ( tif -> tif_clientdata, TIFFFileName ( tif ), "Invalid   vertical   YCbCr   subsampling" ) ; return ( 0 ) ; } maxstripsize = TIFFStripSize ( tif ) ; flip = setorientation ( img ) ; if ( flip & FLIP_VERTICALLY ) { y = h - 1 ; toskew = - ( int32 ) ( w + w ) ; } else { y = 0 ; toskew = - ( int32 ) ( w - w ) ; } TIFFGetFieldDefaulted ( tif, TIFFTAG_ROWSPERSTRIP, & rowsperstrip ) ; scanline = TIFFScanlineSize ( tif ) ; fromskew = ( w < imagewidth? imagewidth - w : 0 ) ; for ( row = 0 ; row < h ; row += nrow ) <START_BUG> { <END_BUG> rowstoread = rowsperstrip - ( row + img -> row_offset ) % rowsperstrip ; nrow = ( row + rowstoread > h? h - row : rowstoread ) ; nrowsub = nrow ; if ( ( nrowsub % subsamplingver )!= 0 ) nrowsub += subsamplingver - nrowsub % subsamplingver ;  if ( _TIFFReadEncodedStripAndAllocBuffer ( tif, <START_BUG> TIFFComputeStrip ( tif, row + img -> row_offset, 0 ), ( void * * ) ( & buf ), maxstripsize<END_BUG>

Fix:
<S2SV_ModStart> nrow ) { uint32 temp ; <S2SV_ModStart> % subsamplingver ; temp = ( row + img -> row_offset ) % rowsperstrip + nrowsub ; if ( scanline > 0 && temp > ( size_t ) ( TIFF_TMSIZE_T_MAX // scanline ) ) { TIFFErrorExt ( tif -> tif_clientdata, TIFFFileName ( tif ), "Integer <S2SV_blank> overflow <S2SV_blank> in <S2SV_blank> gtStripContig" ) ; return 0 ; } <S2SV_ModStart>, maxstripsize, temp <S2SV_ModEnd> * scanline )
Buggy code:
 <START_BUG> static void <END_BUG> swabHorDiff16 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { uint16 * wp = ( uint16 * ) cp0 ; tmsize_t wc = cc // 2 ;  horDiff16 ( tif, cp0, cc ) ; <START_BUG> TIFFSwabArrayOfShort ( wp, wc ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> swabHorDiff16 ( TIFF <S2SV_ModStart> // 2 ; if (! <S2SV_ModStart>, cc ) ) return 0 <S2SV_ModStart> wc ) ; return 1 ;
Buggy code:
 <START_BUG> static struct fsnotify_group * inotify_new_group ( struct user_struct * user, unsigned int max_events ) <END_BUG> { struct fsnotify_group * group ; group = fsnotify_alloc_group ( & inotify_fsnotify_ops ) ; if ( IS_ERR ( group ) ) return group ; group -> max_events = max_events ; spin_lock_init ( & group -> inotify_data. idr_lock ) ; idr_init ( & group -> inotify_data. idr ) ; group -> inotify_data. last_wd = 0 ;  group -> inotify_data. user = user ; <START_BUG> <END_BUG> group -> inotify_data. fa = NULL ;  return group ; }

Fix:
<S2SV_ModStart> * inotify_new_group ( <S2SV_ModEnd> unsigned int max_events <S2SV_ModStart> -> inotify_data. fa = NULL <S2SV_ModEnd> ; group -> <S2SV_ModStart> -> inotify_data. user = get_current_user ( ) ; if ( atomic_inc_return ( & group -> inotify_data. user -> inotify_devs ) > inotify_max_user_instances ) { fsnotify_put_group ( group ) ; return ERR_PTR ( - EMFILE ) ; } <S2SV_ModEnd> return group ;
Buggy code:
 <START_BUG> static void set_segment_id ( VP9_COMMON * cm, BLOCK_SIZE bsize, <END_BUG> int mi_row, int mi_col, int segment_id ) {  const int mi_offset = mi_row * cm -> mi_cols + mi_col ; <START_BUG> const int bw = num_8x8_blocks_wide_lookup [ bsize ] ; const int bh = num_8x8_blocks_high_lookup [ bsize ] ; const int xmis = MIN ( cm -> mi_cols - mi_col, bw ) ; const int ymis = MIN ( cm -> mi_rows - mi_row, bh ) ; int x, y ; assert ( segment_id >= 0 && segment_id < MAX_SEGMENTS ) ; <END_BUG> for ( y = 0 ; y < ymis ; y ++ )  <START_BUG> for ( x = 0 ; x < xmis ; x ++ ) <END_BUG>  cm -> last_frame_seg_map [ mi_offset + y * cm -> mi_cols + x ] = segment_id ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * cm, int mi_offset, int x_mis, int y_mis <S2SV_ModEnd>, int segment_id <S2SV_ModStart> segment_id ) { <S2SV_ModEnd> int x, <S2SV_ModStart> ; y < y_mis <S2SV_ModEnd> ; y ++ <S2SV_ModStart> ; x < x_mis <S2SV_ModEnd> ; x ++ <S2SV_ModStart> ) cm -> current_frame_seg_map <S2SV_ModEnd> [ mi_offset +
Buggy code:
 static int translate_hex_string ( char * s, char * saved_orphan ) { int c1 = * saved_orphan ; char * start = s ; char * t = s ; for ( ; * s ; s ++ ) { <START_BUG> if ( isspace ( * s ) ) <END_BUG> continue ; if ( c1 ) { * t ++ = ( hexval ( c1 ) << 4 ) + hexval ( * s ) ; c1 = 0 ; } else c1 = * s ; } * saved_orphan = c1 ; return t - start ; }

Fix:
<S2SV_ModStart> ( isspace ( ( unsigned char )
Buggy code:
 static int sd_ioctl ( struct block_device * bdev, fmode_t mode, unsigned int cmd, unsigned long arg ) { struct gendisk * disk = bdev -> bd_disk ; struct scsi_disk * sdkp = scsi_disk ( disk ) ; struct scsi_device * sdp = sdkp -> device ; void __user * p = ( void __user * ) arg ; int error ; SCSI_LOG_IOCTL ( 1, sd_printk ( KERN_INFO, sdkp, "sd_ioctl:   disk=%s,   " "cmd=0x%x\\n", disk -> disk_name, cmd ) ) ; <START_BUG> error = scsi_nonblockable_ioctl ( sdp, cmd, p, <END_BUG> ( mode & FMODE_NDELAY )!= 0 ) ; if (! scsi_block_when_processing_errors ( sdp ) ||! error ) goto out ; switch ( cmd ) { case SCSI_IOCTL_GET_IDLUN : case SCSI_IOCTL_GET_BUS_NUMBER : error = scsi_ioctl ( sdp, cmd, p ) ; break ; default : error = scsi_cmd_blk_ioctl ( bdev, mode, cmd, p ) ; if ( error!= - ENOTTY ) break ; error = scsi_ioctl ( sdp, cmd, p ) ; break ; } out : return error ; }

Fix:
<S2SV_ModStart> ; error = scsi_verify_blk_ioctl ( bdev, cmd ) ; if ( error < 0 ) return error ; error =
Buggy code:
 static vpx_image_t * encoder_get_preview ( vpx_codec_alg_priv_t * ctx ) { YV12_BUFFER_CONFIG sd ; <START_BUG> vp9_ppflags_t flags = { 0 } ; <END_BUG> if ( ctx -> preview_ppcfg. post_proc_flag ) { flags. post_proc_flag = ctx -> preview_ppcfg. post_proc_flag ; flags. deblocking_level = ctx -> preview_ppcfg. deblocking_level ; flags. noise_level = ctx -> preview_ppcfg. noise_level ; } if ( vp9_get_preview_raw_frame ( ctx -> cpi, & sd, & flags ) == 0 ) { yuvconfig2image ( & ctx -> preview_img, & sd, NULL ) ; return & ctx -> preview_img ; } else { return NULL ; } }

Fix:
<S2SV_ModStart> ; vp9_ppflags_t flags ; vp9_zero ( flags ) <S2SV_ModEnd> ; if (
Buggy code:
 static int whereIndexExprTransColumn ( Walker * p, Expr * pExpr ) { if ( pExpr -> op == TK_COLUMN ) { IdxExprTrans * pX = p -> u. pIdxTrans ; if ( pExpr -> iTable == pX -> iTabCur && pExpr -> iColumn == pX -> iTabCol ) { <START_BUG> pExpr -> iTable = pX -> iIdxCur ; <END_BUG> pExpr -> iColumn = pX -> iIdxCol ; pExpr -> y. pTab = 0 ; } } return WRC_Continue ; }

Fix:
<S2SV_ModStart> iTabCol ) { assert ( pExpr -> y. pTab!= 0 ) ; pExpr -> affExpr = sqlite3TableColumnAffinity ( pExpr -> y. pTab, pExpr -> iColumn ) ;
Buggy code:
 TEE_Result syscall_cryp_derive_key ( unsigned long state, const struct utee_attribute * usr_params, unsigned long param_count, unsigned long derived_key ) { TEE_Result res = TEE_ERROR_NOT_SUPPORTED ; struct tee_ta_session * sess ; struct tee_obj * ko ; struct tee_obj * so ; struct tee_cryp_state * cs ; struct tee_cryp_obj_secret * sk ; const struct tee_cryp_obj_type_props * type_props ; TEE_Attribute * params = NULL ; struct user_ta_ctx * utc ; res = tee_ta_get_current_session ( & sess ) ; if ( res!= TEE_SUCCESS ) return res ; utc = to_user_ta_ctx ( sess -> ctx ) ; res = tee_svc_cryp_get_state ( sess, tee_svc_uref_to_vaddr ( state ), & cs ) ; if ( res!= TEE_SUCCESS ) return res ; <START_BUG> params = malloc ( sizeof ( TEE_Attribute ) * param_count ) ; <END_BUG> if (! params ) return TEE_ERROR_OUT_OF_MEMORY ; res = copy_in_attrs ( utc, usr_params, param_count, params ) ; if ( res!= TEE_SUCCESS ) goto out ; res = tee_obj_get ( utc, cs -> key1, & ko ) ; if ( res!= TEE_SUCCESS ) goto out ; res = tee_obj_get ( utc, tee_svc_uref_to_vaddr ( derived_key ), & so ) ; if ( res!= TEE_SUCCESS ) goto out ; sk = so -> attr ; type_props = tee_svc_find_type_props ( so -> info. objectType ) ; if (! type_props ) { res = TEE_ERROR_NOT_SUPPORTED ; goto out ; } if ( cs -> algo == TEE_ALG_DH_DERIVE_SHARED_SECRET ) { size_t alloc_size ; struct bignum * pub ; struct bignum * ss ; if ( param_count!= 1 || params [ 0 ]. attributeID!= TEE_ATTR_DH_PUBLIC_VALUE

Fix:
<S2SV_ModStart> return res ; size_t alloc_size = 0 ; if ( MUL_OVERFLOW ( sizeof ( TEE_Attribute ), param_count, & alloc_size ) ) return TEE_ERROR_OVERFLOW ; <S2SV_ModStart> = malloc ( alloc_size <S2SV_ModEnd> ) ; if
Buggy code:
 static vpx_codec_err_t ctrl_set_scale_mode ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> vpx_scaling_mode_t * const mode = va_arg ( args, vpx_scaling_mode_t * ) ; if ( mode ) { const int res = vp9_set_internal_size ( ctx -> cpi, ( VPX_SCALING ) mode -> h_scaling_mode, ( VPX_SCALING ) mode -> v_scaling_mode ) ; return ( res == 0 )? VPX_CODEC_OK : VPX_CODEC_INVALID_PARAM ; } else { return VPX_CODEC_INVALID_PARAM ; } }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )
Buggy code:
 static void ikev2_parent_inR1outI2_continue ( struct pluto_crypto_req_cont * pcrc, struct pluto_crypto_req * r, err_t ugh ) { struct dh_continuation * dh = ( struct dh_continuation * ) pcrc ; struct msg_digest * md = dh -> md ; struct state * const st = md -> st ; stf_status e ; DBG ( DBG_CONTROLMORE, DBG_log ( "ikev2   parent   inR1outI2:   calculating   g^{xy},   sending   I2" ) ) ; if ( st == NULL ) { loglog ( RC_LOG_SERIOUS, "%s:   Request   was   disconnected   from   state", __FUNCTION__ ) ; if ( dh -> md ) release_md ( dh -> md ) ; return ; } passert ( ugh == NULL ) ; passert ( cur_state == NULL ) ; passert ( st!= NULL ) ; passert ( st -> st_suspended_md == dh -> md ) ; set_suspended ( st, NULL ) ; set_cur_state ( st ) ; st -> st_calculating = FALSE ; e = ikev2_parent_inR1outI2_tail ( pcrc, r ) ; if ( dh -> md!= NULL ) { complete_v2_state_transition ( & dh -> md, e ) ; if ( dh -> md ) release_md ( dh -> md ) ; } reset_globals ( ) ; <START_BUG> passert ( GLOBALS_ARE_RESET ( ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 cJSON * cJSON_DetachItemFromArray ( cJSON * array, int which ) { cJSON * c = array -> child ; <START_BUG> while ( c && which > 0 ) { <END_BUG>  c = c -> next ; <START_BUG> -- which ; } if (! c ) return 0 ; if ( c -> prev ) c -> prev -> next = c -> next ; if ( c -> next ) c -> next -> prev = c -> prev ; if ( c == array -> child ) array -> child = c -> next ; c -> prev = c -> next = 0 ; return c ; }<END_BUG>

Fix:
<S2SV_ModStart> > 0 ) <S2SV_ModEnd> c = c <S2SV_ModStart> c -> next, which -- ; <S2SV_ModEnd> if (!
Buggy code:
 static void ip_cmsg_recv_checksum ( struct msghdr * msg, struct sk_buff * skb, int tlen, int offset ) { __wsum csum = skb -> csum ; if ( skb -> ip_summed!= CHECKSUM_COMPLETE ) return ; <START_BUG> if ( offset!= 0 ) <END_BUG> csum = csum_sub ( csum,  csum_partial ( skb_transport_header ( skb ) + tlen, <START_BUG> <END_BUG> offset, 0 ) ) ;  put_cmsg ( msg, SOL_IP, IP_CHECKSUM, sizeof ( __wsum ), & csum ) ; }

Fix:
<S2SV_ModStart>!= 0 ) { int tend_off = skb_transport_offset ( skb ) + tlen ; <S2SV_ModStart> ( csum, skb_checksum ( skb, tend_off, <S2SV_ModEnd> offset, 0 <S2SV_ModStart> ) ) ; }
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 char magick [ 12 ] ; Image * image ; IndexPacket index ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; register IndexPacket * indexes ; register ssize_t x ; register PixelPacket * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, number_planes, number_planes_filled, one, offset, pixel_info_length ; ssize_t count, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { image -> page. x = ReadBlobLSBShort ( image ) ; image -> page. y = ReadBlobLSBShort ( image ) ; image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> matte = flags & 0x04? MagickTrue : MagickFalse

Fix:
<S2SV_ModStart> -> rows * MagickMax ( number_planes_filled, 4 ) <S2SV_ModEnd> * sizeof ( <S2SV_ModStart> -> rows * MagickMax ( number_planes_filled, 4 ) <S2SV_ModEnd> ; pixels =
Buggy code:
 static void kvp_respond_to_host ( char * key, char * value, int error ) { struct hv_kvp_msg * kvp_msg ; struct hv_kvp_msg_enumerate * kvp_data ; char * key_name ; struct icmsg_hdr * icmsghdrp ; int keylen, valuelen ; u32 buf_len ; struct vmbus_channel * channel ; u64 req_id ; if (! kvp_transaction. active ) { pr_warn ( "KVP:   Transaction   not   active\\n" ) ; return ; } buf_len = kvp_transaction. recv_len ; channel = kvp_transaction. recv_channel ; req_id = kvp_transaction. recv_req_id ; kvp_transaction. active = false ; if ( channel -> onchannel_callback == NULL ) return ; icmsghdrp = ( struct icmsg_hdr * ) & recv_buffer [ sizeof ( struct vmbuspipe_hdr ) ] ; kvp_msg = ( struct hv_kvp_msg * ) & recv_buffer [ sizeof ( struct vmbuspipe_hdr ) + sizeof ( struct icmsg_hdr ) ] ; kvp_data = & kvp_msg -> kvp_data ; key_name = key ; if ( error ) { icmsghdrp -> status = HV_E_FAIL ; goto response_done ; } <START_BUG> keylen = utf8s_to_utf16s ( key_name, strlen ( key_name ), <END_BUG>  ( wchar_t * ) kvp_data -> data. key ) ; <START_BUG> kvp_data -> data. key_size = 2 * ( keylen + 1 ) ; <END_BUG> valuelen = utf8s_to_utf16s ( value, strlen ( value ),  <START_BUG> ( wchar_t * ) kvp_data -> data. value ) ; <END_BUG> kvp_data -> data. value_size = 2 * ( valuelen + 1 ) ; kvp_data -> data. value_type = REG_SZ ; icmsghdrp -> status = HV_S_OK ; response_done : icmsghdrp -> icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE ; vmbus_sendpacket ( channel

Fix:
<S2SV_ModStart> key_name ), UTF16_HOST_ENDIAN, <S2SV_ModStart> data. key, HV_KVP_EXCHANGE_MAX_KEY_SIZE // 2 <S2SV_ModStart> value ), UTF16_HOST_ENDIAN, <S2SV_ModStart> data. value, HV_KVP_EXCHANGE_MAX_VALUE_SIZE // 2
Buggy code:
 static int unix_dgram_sendmsg ( struct socket * sock, struct msghdr * msg, size_t len ) { struct sock * sk = sock -> sk ; struct net * net = sock_net ( sk ) ; struct unix_sock * u = unix_sk ( sk ) ; DECLARE_SOCKADDR ( struct sockaddr_un *, sunaddr, msg -> msg_name ) ; struct sock * other = NULL ; int namelen = 0 ; int err ; unsigned int hash ; struct sk_buff * skb ; long timeo ; struct scm_cookie scm ; int max_level ; int data_len = 0 ; <START_BUG> wait_for_unix_gc ( ) ; <END_BUG> err = scm_send ( sock, msg, & scm, false ) ; if ( err < 0 ) return err ; err = - EOPNOTSUPP ; if ( msg -> msg_flags & MSG_OOB ) goto out ; if ( msg -> msg_namelen ) { err = unix_mkname ( sunaddr, msg -> msg_namelen, & hash ) ; if ( err < 0 ) goto out ; namelen = err ; } else { sunaddr = NULL ; err = - ENOTCONN ; other = unix_peer_get ( sk ) ; if (! other ) goto out ; } if ( test_bit ( SOCK_PASSCRED, & sock -> flags ) &&! u -> addr && ( err = unix_autobind ( sock ) )!= 0 ) goto out ; err = - EMSGSIZE ; if ( len > sk -> sk_sndbuf - 32 ) goto out ; if ( len > SKB_MAX_ALLOC ) { data_len = min_t ( size_t, len - SKB_MAX_ALLOC, MAX_SKB_FRAGS * PAGE_SIZE ) ; data_len = PAGE_ALIGN ( data_len ) ; BUILD_BUG_ON ( SKB_MAX_ALLOC < PAGE_SIZE ) ; } skb = sock_alloc_send_pskb ( sk, len - data_len, data_len, msg -> msg_flags & MSG_DONTWAIT, & err, PAGE_ALLOC_COSTLY_ORDER ) ; if ( skb == NULL ) goto out ; err = unix_scm_to_skb ( & scm, sk

Fix:
<S2SV_ModStart> = 0 ; int sk_locked ; <S2SV_ModStart> out_free ; } sk_locked = 0 ; <S2SV_ModStart> other ) ; restart_locked : <S2SV_ModStart> ; if ( unlikely ( <S2SV_ModStart> SOCK_DEAD ) ) ) <S2SV_ModStart> other ) ; if (! sk_locked ) unix_state_lock ( sk ) ; <S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( unix_peer <S2SV_ModStart> ) = NULL ; unix_dgram_peer_wake_disconnect_wakeup ( sk, other ) <S2SV_ModStart> } if ( unlikely ( <S2SV_ModStart> other ) ) ) { if ( timeo ) { timeo = unix_wait_for_peer ( other, timeo ) ; err = sock_intr_errno ( timeo ) ; if ( signal_pending ( current ) ) goto out_free ; goto restart ; } <S2SV_ModEnd> if (! <S2SV_ModStart> if (! sk_locked ) { unix_state_unlock ( other ) ; unix_state_double_lock ( sk, other ) ; } if ( unix_peer ( sk )!= other || unix_dgram_peer_wake_me ( sk, other ) <S2SV_ModEnd> ) { err <S2SV_ModStart> - EAGAIN ; sk_locked = 1 ; <S2SV_ModStart> out_unlock ; } if (! sk
Buggy code:
 static void * btif_hl_select_thread ( void * arg ) { fd_set org_set, curr_set ; int r, max_curr_s, max_org_s ; UNUSED ( arg ) ; BTIF_TRACE_DEBUG ( "entered   btif_hl_select_thread" ) ; FD_ZERO ( & org_set ) ; max_org_s = btif_hl_select_wakeup_init ( & org_set ) ; BTIF_TRACE_DEBUG ( "max_s=%d   ", max_org_s ) ; for ( ; ; ) { r = 0 ; BTIF_TRACE_DEBUG ( "set   curr_set   =   org_set   " ) ; curr_set = org_set ; max_curr_s = max_org_s ; <START_BUG> int ret = select ( ( max_curr_s + 1 ), & curr_set, NULL, NULL, NULL ) ; <END_BUG> BTIF_TRACE_DEBUG ( "select   unblocked   ret=%d", ret ) ; if ( ret == - 1 ) { BTIF_TRACE_DEBUG ( "select()   ret   -1,   exit   the   thread" ) ; btif_hl_thread_cleanup ( ) ; select_thread_id = - 1 ; return 0 ; } else if ( ret ) { BTIF_TRACE_DEBUG ( "btif_hl_select_wake_signaled,   signal   ret=%d", ret ) ; if ( btif_hl_select_wake_signaled ( & curr_set ) ) { r = btif_hl_select_wake_reset ( ) ; BTIF_TRACE_DEBUG ( "btif_hl_select_wake_signaled,   signal:%d", r ) ; if ( r == btif_hl_signal_select_wakeup || r == btif_hl_signal_select_close_connected ) { btif_hl_select_wakeup_callback ( & org_set, r ) ; } else if ( r == btif_hl_signal_select_exit ) { btif_hl_thread_cleanup ( ) ; BTIF_TRACE_DEBUG ( "Exit   hl_select_thread   for  

Fix:
<S2SV_ModStart> int ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, NULL ) )
Buggy code:
 static SSL * open_ssl_connection ( rfbClient * client, int sockfd, rfbBool anonTLS, rfbCredential * cred ) { SSL_CTX * ssl_ctx = NULL ; SSL * ssl = NULL ; int n, finished = 0 ; X509_VERIFY_PARAM * param ; <START_BUG> uint8_t verify_crls = cred -> x509Credential. x509CrlVerifyMode ; <END_BUG> if (! ( ssl_ctx = SSL_CTX_new ( SSLv23_client_method ( ) ) ) ) { rfbClientLog ( "Could   not   create   new   SSL   context.\\n" ) ; return NULL ; } param = X509_VERIFY_PARAM_new ( ) ; if (! anonTLS )  { <START_BUG> if ( cred -> x509Credential. x509CACertFile ) { if (! SSL_CTX_load_verify_locations ( ssl_ctx, cred -> x509Credential. x509CACertFile, NULL ) ) { rfbClientLog ( "Failed   to   load   CA   certificate   from   %s.\\n", cred -> x509Credential. x509CACertFile ) ; goto error_free_ctx ; } } else { rfbClientLog ( "Using   default   paths   for   certificate   verification.\\n" ) ; SSL_CTX_set_default_verify_paths ( ssl_ctx ) ; } if ( cred -> x509Credential. x509CACrlFile ) { if (! load_crls_from_file ( cred -> x509Credential. x509CACrlFile, ssl_ctx ) ) { rfbClientLog ( "CRLs   could   not   be   loaded.\\n" ) ; goto error_free_ctx ; } if ( verify_crls == rfbX509CrlVerifyNone ) verify_crls = rfbX509CrlVerifyAll ; } if ( cred -> x509Credential. x509ClientCertFile && cred -> x509Credential. x509ClientKeyFile ) { if ( SSL_CTX_use_certificate_chain_file ( ssl_ctx, cred -> x509Credential. x509ClientCertFile )!= 1 ) { rfbClientLog ( "Client   certificate   could   not   be   loaded.\\n" ) ; goto error_free_<END_BUG>

Fix:
<S2SV_ModStart> ; uint8_t verify_crls <S2SV_ModEnd> ; if ( <S2SV_ModStart> anonTLS ) { verify_crls = cred -> x509Credential. x509CrlVerifyMode ;
Buggy code:
 static int nl80211_trigger_scan ( struct sk_buff * skb, struct genl_info * info ) { struct cfg80211_registered_device * rdev = info -> user_ptr [ 0 ] ; struct net_device * dev = info -> user_ptr [ 1 ] ; struct cfg80211_scan_request * request ; struct nlattr * attr ; struct wiphy * wiphy ; int err, tmp, n_ssids = 0, n_channels, i ; enum ieee80211_band band ; size_t ie_len ; if (! is_valid_ie_attr ( info -> attrs [ NL80211_ATTR_IE ] ) ) return - EINVAL ; wiphy = & rdev -> wiphy ; if (! rdev -> ops -> scan ) return - EOPNOTSUPP ; if ( rdev -> scan_req ) return - EBUSY ; if ( info -> attrs [ NL80211_ATTR_SCAN_FREQUENCIES ] ) { n_channels = validate_scan_freqs ( info -> attrs [ NL80211_ATTR_SCAN_FREQUENCIES ] ) ; if (! n_channels ) return - EINVAL ; } else { n_channels = 0 ; for ( band = 0 ; band < IEEE80211_NUM_BANDS ; band ++ ) if ( wiphy -> bands [ band ] ) n_channels += wiphy -> bands [ band ] -> n_channels ; } if ( info -> attrs [ NL80211_ATTR_SCAN_SSIDS ] ) nla_for_each_nested ( attr, info -> attrs [ NL80211_ATTR_SCAN_SSIDS ], tmp ) n_ssids ++ ; if ( n_ssids > wiphy -> max_scan_ssids ) return - EINVAL ; if ( info -> attrs [ NL80211_ATTR_IE ] ) ie_len = nla_len ( info -> attrs [ NL80211_ATTR_IE ] ) ; else ie_len = 0 ; if ( ie_len > wiphy -> max_scan_ie_len ) return - EINVAL ; request = kzalloc ( sizeof ( * request ) + sizeof ( * request -> ssids ) * n_ssids +

Fix:
<S2SV_ModStart> tmp ) { request -> ssids [ i ]. ssid_len = nla_len ( attr ) ; <S2SV_ModStart> ) ) ; <S2SV_ModEnd> i ++ ;
Buggy code:
 <START_BUG> static inline bool unconditional ( const struct ipt_ip * ip ) <END_BUG> { static const struct ipt_ip uncond ;  return memcmp ( ip, & uncond, sizeof ( uncond ) ) == 0 ; <START_BUG> # undef FWINV }<END_BUG>

Fix:
<S2SV_ModStart> ( const struct ipt_entry * e <S2SV_ModEnd> ) { static <S2SV_ModStart> uncond ; return e -> target_offset == sizeof ( struct ipt_entry ) && memcmp ( & e -> <S2SV_ModEnd> ip, &
Buggy code:
 static int mincore_pte_range ( pmd_t * pmd, unsigned long addr, unsigned long end, struct mm_walk * walk ) { spinlock_t * ptl ; struct vm_area_struct * vma = walk -> vma ; pte_t * ptep ; unsigned char * vec = walk -> private ; int nr = ( end - addr ) >> PAGE_SHIFT ; ptl = pmd_trans_huge_lock ( pmd, vma ) ; if ( ptl ) { memset ( vec, 1, nr ) ; spin_unlock ( ptl ) ; goto out ; } if ( pmd_trans_unstable ( pmd ) ) { <START_BUG> __mincore_unmapped_range ( addr, end, vma, vec ) ; <END_BUG> goto out ; } ptep = pte_offset_map_lock ( walk -> mm, pmd, addr, & ptl ) ; for ( ; addr!= end ; ptep ++, addr += PAGE_SIZE ) { pte_t pte = * ptep ; if ( pte_none ( pte ) )  __mincore_unmapped_range ( addr, addr + PAGE_SIZE, <START_BUG> vma, vec ) ; else if ( pte_present ( pte ) ) * vec = 1 ; else { swp_entry_t entry = pte_to_swp_entry ( pte ) ; <END_BUG> if ( non_swap_entry ( entry ) ) {  * vec = 1 ; } else { # ifdef CONFIG_SWAP * vec = mincore_page ( swap_address_space ( entry ), swp_offset ( entry ) ) ; # else WARN_ON ( 1 ) ; * vec = 1 ; # endif } } vec ++ ; } pte_unmap_unlock ( ptep - 1, ptl ) ; out : walk -> private += nr ; cond_resched ( ) ; return 0 ; }

Fix:
<S2SV_ModStart> ) ) { memset ( vec, 1, nr <S2SV_ModEnd> ) ; goto <S2SV_ModStart> pte ) ) * vec = 0 <S2SV_ModEnd> ; else if <S2SV_ModStart> pte ) ; * vec =!! <S2SV_ModEnd> non_swap_entry ( entry <S2SV_ModStart> ( entry ) ; <S2SV_ModEnd> } vec ++
Buggy code:
 int ssl3_read_n ( SSL * s, int n, int max, int extend ) { int i, len, left ; long align = 0 ; unsigned char * pkt ; SSL3_BUFFER * rb ; if ( n <= 0 ) return n ; rb = & ( s -> s3 -> rbuf ) ; if ( rb -> buf == NULL ) if (! ssl3_setup_read_buffer ( s ) ) return - 1 ; left = rb -> left ; # if defined ( SSL3_ALIGN_PAYLOAD ) && SSL3_ALIGN_PAYLOAD!= 0 align = ( long ) rb -> buf + SSL3_RT_HEADER_LENGTH ; align = ( - align ) & ( SSL3_ALIGN_PAYLOAD - 1 ) ; # endif if (! extend ) { if ( left == 0 ) rb -> offset = align ; else if ( align!= 0 && left >= SSL3_RT_HEADER_LENGTH ) { pkt = rb -> buf + rb -> offset ; if ( pkt [ 0 ] == SSL3_RT_APPLICATION_DATA && ( pkt [ 3 ] << 8 | pkt [ 4 ] ) >= 128 ) { memmove ( rb -> buf + align, pkt, left ) ; rb -> offset = align ; } } s -> packet = rb -> buf + rb -> offset ; s -> packet_length = 0 ; } if ( SSL_IS_DTLS ( s ) ) { <START_BUG> if ( left > 0 && n > left ) <END_BUG> n = left ; } if ( left >= n ) { s -> packet_length += n ; rb -> left = left - n ; rb -> offset += n ; return ( n ) ; } len = s -> packet_length ; pkt = rb -> buf + align ; if ( s -> packet!= pkt ) { memmove ( pkt, s -> packet, len + left ) ; s -> packet = pkt ; rb -> offset = len + align ; } if ( n > ( int ) ( rb -> len - rb -> offset ) ) { SSLerr ( SSL_F_SSL3_READ_N, ERR_R_INTERNAL_ERROR ) ; return - 1 ; } if (! s -> read_ahead ) max = n ; else { if ( max < n ) max = n ; if ( max > ( int ) ( rb -> len - rb -> offset ) ) max = rb -> len - rb -> offset ; } while ( left

Fix:
<S2SV_ModStart> if ( left == 0 && extend ) return 0 ; if ( left
Buggy code:
 static int find_high_bit ( unsigned int x ) { int i ; for ( i = 31 ; i >= 0 ; i -- ) { <START_BUG> if ( x & ( 1 << i ) ) return i ; <END_BUG> } return 0 ; }

Fix:
<S2SV_ModStart> x & ( 1U << ( unsigned int ) <S2SV_ModEnd> i ) )
Buggy code:
 static ssize_t aio_setup_single_vector ( struct kiocb * kiocb, int rw, char __user * buf, unsigned long * nr_segs, struct iovec * iovec ) { <START_BUG> if ( unlikely (! access_ok (! rw, buf, kiocb -> ki_nbytes ) ) ) <END_BUG> return - EFAULT ; iovec -> iov_base = buf ;  iovec -> iov_len = kiocb -> ki_nbytes ; <START_BUG> * nr_segs = 1 ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> iovec ) { size_t len = kiocb -> ki_nbytes ; if ( len > MAX_RW_COUNT ) len = MAX_RW_COUNT ; <S2SV_ModStart>, buf, len <S2SV_ModEnd> ) ) ) <S2SV_ModStart> -> iov_len = len <S2SV_ModEnd> ; * nr_segs
Buggy code:
 <START_BUG> static void write_segment_id ( vp9_writer * w, const struct segmentation * seg, <END_BUG> int segment_id ) { if ( seg -> enabled && seg -> update_map ) vp9_write_tree ( w, vp9_segment_tree, seg -> tree_probs, segment_id, 3, 0 ) ; }

Fix:
<S2SV_ModStart> void write_segment_id ( vpx_writer <S2SV_ModEnd> * w,
Buggy code:
 char * messageFindArgument ( const message * m, const char * variable ) { int i ; size_t len ; assert ( m!= NULL ) ; assert ( variable!= NULL ) ; len = strlen ( variable ) ; for ( i = 0 ; i < m -> numberOfArguments ; i ++ ) { const char * ptr ; ptr = messageGetArgument ( m, i ) ; if ( ( ptr == NULL ) || ( * ptr == '\\0' ) ) continue ; # ifdef CL_DEBUG cli_dbgmsg ( "messageFindArgument:   compare   %lu   bytes   of   %s   with   %s\\n", ( unsigned long ) len, variable, ptr ) ; # endif if ( strncasecmp ( ptr, variable, len ) == 0 ) { ptr = & ptr [ len ] ; while ( isspace ( * ptr ) ) ptr ++ ; if ( * ptr!= '=' ) { cli_dbgmsg ( "messageFindArgument:   no   \'=\'   sign   found   in   MIME   header   \'%s\'   (%s)\\n", variable, messageGetArgument ( m, i ) ) ; return NULL ; } <START_BUG> if ( ( * ++ ptr == \'"\' ) && ( strchr ( & ptr [ 1 ], \'"\' )!= NULL ) ) { <END_BUG> char * ret = cli_strdup ( ++ ptr ) ; char * p ; if ( ret == NULL ) return NULL ; if ( ( p = strchr ( ret, \'"\' ) )!= NULL ) { ret [ strlen ( ret ) - 1 ] = '\\0' ; * p = '\\0' ; } return ret ; } return cli_strdup ( ptr ) ; } } return NULL ; }

Fix:
<S2SV_ModStart> if ( ( strlen ( ptr ) > 2 ) && (
Buggy code:
 int hugepage_madvise ( struct vm_area_struct * vma, unsigned long * vm_flags, int advice ) { switch ( advice ) { case MADV_HUGEPAGE : if ( * vm_flags & ( VM_HUGEPAGE | <START_BUG> VM_SHARED | VM_MAYSHARE | <END_BUG> VM_PFNMAP | VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE | VM_MIXEDMAP | VM_SAO ) ) return - EINVAL ; * vm_flags &= ~ VM_NOHUGEPAGE ; * vm_flags |= VM_HUGEPAGE ; if ( unlikely ( khugepaged_enter_vma_merge ( vma ) ) ) return - ENOMEM ; break ; case MADV_NOHUGEPAGE : if ( * vm_flags & ( VM_NOHUGEPAGE |  VM_SHARED | VM_MAYSHARE | <START_BUG> VM_PFNMAP | VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE | VM_MIXEDMAP | VM_SAO ) ) return - EINVAL ; * vm_flags &= ~ VM_HUGEPAGE ; * vm_flags |= VM_NOHUGEPAGE ; break ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ( VM_HUGEPAGE | VM_NO_THP <S2SV_ModEnd> ) ) return <S2SV_ModStart> ( VM_NOHUGEPAGE | VM_NO_THP <S2SV_ModEnd> ) ) return
Buggy code:
 static int get_default_root ( pool * p, int allow_symlinks, char * * root ) { config_rec * c = NULL ; char * dir = NULL ; int res ; c = find_config ( main_server -> conf, CONF_PARAM, "DefaultRoot", FALSE ) ; while ( c ) { pr_signals_handle ( ) ; if ( c -> argc < 2 ) { dir = c -> argv [ 0 ] ; break ; } res = pr_expr_eval_group_and ( ( ( char * * ) c -> argv ) + 1 ) ; if ( res ) { dir = c -> argv [ 0 ] ; break ; } c = find_config_next ( c, c -> next, CONF_PARAM, "DefaultRoot", FALSE ) ; } if ( dir ) { char * new_dir ; new_dir = path_subst_uservar ( p, & dir ) ; if ( new_dir!= NULL ) { dir = new_dir ; } if ( strncmp ( dir, "//", 2 ) == 0 ) { dir = NULL ; } else { char * realdir ; int xerrno = 0 ; if ( allow_symlinks == FALSE ) { char * path, target_path [ PR_TUNABLE_PATH_MAX + 1 ] ; <START_BUG> struct stat st ; <END_BUG> size_t pathlen ; path = dir ; if ( * path!= '//' ) { if ( * path == '~' ) { if ( pr_fs_interpolate ( dir, target_path, sizeof ( target_path ) - 1 ) < 0 ) { return - 1 ; } path = target_path ; } } pathlen = strlen ( path ) ; if ( pathlen > 1 && path [ pathlen - 1 ] == '//' ) { path [ pathlen - 1 ] = '\\0' ; }  pr_fs_clear_cache ( ) ; <START_BUG> res = pr_fsio_lstat ( path, & st ) ; if ( res < 0 ) { <END_BUG> xerrno = errno ;  <START_BUG> pr_log_pri ( PR_LOG_WARNING, "error:   unable   to   check   %s:   %s", path, <END_BUG> strerror ( xerrno ) ) ; errno = xerrno ; return - 1 ; } if ( S_ISLNK ( st. st_mode ) ) { pr_log

Fix:
<S2SV_ModStart> 1 ] ; <S2SV_ModEnd> size_t pathlen ; <S2SV_ModStart> '\\0' ; } res = is_symlink_path ( p, path, pathlen <S2SV_ModEnd> ) ; if <S2SV_ModStart> 0 ) { if ( errno == EPERM ) { <S2SV_ModEnd> pr_log_pri ( PR_LOG_WARNING <S2SV_ModStart> ( PR_LOG_WARNING, "error: <S2SV_blank> DefaultRoot <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> a <S2SV_blank> symlink <S2SV_blank> " "(denied <S2SV_blank> by <S2SV_blank> AllowChrootSymlinks <S2SV_blank> config)", path ) ; } <S2SV_ModEnd> errno = EPERM
Buggy code:
 <START_BUG> static int svc_log ( SvcContext * svc_ctx, int level, const char * fmt,... ) { <END_BUG> char buf [ 512 ] ; int retval = 0 ; va_list ap ;  SvcInternal * const si = get_svc_internal ( svc_ctx ) ; <START_BUG> if ( level > svc_ctx -> log_level ) { return retval ; } va_start ( ap, fmt ) ; retval = vsnprintf ( buf, sizeof ( buf ), fmt, ap ) ; va_end ( ap ) ; if ( svc_ctx -> log_print ) { printf ( "%s", buf ) ; } else { strncat ( si -> message_buffer, buf, sizeof ( si -> message_buffer ) - strlen ( si -> message_buffer ) - 1 ) ; } if ( level == SVC_LOG_ERROR ) { si -> codec_ctx -> err_detail = si -> message_buffer ; } return retval ; }<END_BUG>

Fix:
<S2SV_ModStart> * svc_ctx, SVC_LOG_LEVEL <S2SV_ModEnd> level, const <S2SV_ModStart> va_list ap ; SvcInternal_t <S2SV_ModEnd> * const si
Buggy code:
 char * Util_urlDecode ( char * url ) { if ( url && * url ) { register int x, y ; for ( x = 0, y = 0 ; url [ y ] ; x ++, y ++ ) { <START_BUG> if ( ( url [ x ] = url [ y ] ) == '+' ) <END_BUG> url [ x ] =' ';  else if ( url [ x ] == '%' ) { <START_BUG> <END_BUG> if (! ( url [ x + 1 ] && url [ x + 2 ] ) )  break ; <START_BUG> url [ x ] = x2c ( url + y + 1 ) ; <END_BUG>  y += 2 ; <START_BUG> } } url [ x ] = 0 ; } return url ; }<END_BUG>

Fix:
<S2SV_ModStart> { if ( <S2SV_ModEnd> url [ y <S2SV_ModStart> [ y ] <S2SV_ModEnd> == '+' ) <S2SV_ModStart> == '+' ) { <S2SV_ModStart> ='<S2SV_blank>'; } <S2SV_ModStart> ( url [ y <S2SV_ModEnd> ] == '%' <S2SV_ModStart> if (! url [ y <S2SV_ModEnd> + 1 ] <S2SV_ModStart> + 1 ] ||! url [ y <S2SV_ModEnd> + 2 ] <S2SV_ModStart> + 2 ] <S2SV_ModEnd> ) break ; <S2SV_ModStart> x ] = _x2c <S2SV_ModEnd> ( url + <S2SV_ModStart> y += 2 ; } else { url [ x ] = url [ y ]
Buggy code:
 static int session_new ( nghttp2_session * * session_ptr, const nghttp2_session_callbacks * callbacks, void * user_data, int server, const nghttp2_option * option, nghttp2_mem * mem ) { int rv ; size_t nbuffer ; size_t max_deflate_dynamic_table_size = NGHTTP2_HD_DEFAULT_MAX_DEFLATE_BUFFER_SIZE ; if ( mem == NULL ) { mem = nghttp2_mem_default ( ) ; } * session_ptr = nghttp2_mem_calloc ( mem, 1, sizeof ( nghttp2_session ) ) ; if ( * session_ptr == NULL ) { rv = NGHTTP2_ERR_NOMEM ; goto fail_session ; } ( * session_ptr ) -> mem = * mem ; mem = & ( * session_ptr ) -> mem ; nghttp2_stream_init ( & ( * session_ptr ) -> root, 0, NGHTTP2_STREAM_FLAG_NONE, NGHTTP2_STREAM_IDLE, NGHTTP2_DEFAULT_WEIGHT, 0, 0, NULL, mem ) ; ( * session_ptr ) -> remote_window_size = NGHTTP2_INITIAL_CONNECTION_WINDOW_SIZE ; ( * session_ptr ) -> recv_window_size = 0 ; ( * session_ptr ) -> consumed_size = 0 ; ( * session_ptr ) -> recv_reduction = 0 ; ( * session_ptr ) -> local_window_size = NGHTTP2_INITIAL_CONNECTION_WINDOW_SIZE ; ( * session_ptr ) -> goaway_flags = NGHTTP2_GOAWAY_NONE ; ( * session_ptr ) -> local_last_stream_id = ( 1u << 31 ) - 1 ; ( * session_ptr ) -> remote_last_stream_id = ( 1u << 31 ) - 1 ; ( * session_ptr ) -> pending_local_max_concurrent_stream = NGHTTP2_DEFAULT_MAX_CONCURRENT_STREAMS ; ( * session_ptr ) -> pending_enable_push = 1 ; if ( server ) { ( * session_ptr ) -> server = 1 ; } init_settings ( & ( * session_ptr ) -> remote_settings ) ; init_settings

Fix:
<S2SV_ModStart> = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM ; ( * session_ptr ) -> max_settings = NGHTTP2_DEFAULT_MAX_SETTINGS ; <S2SV_ModStart> max_outbound_ack ; } if ( ( option -> opt_set_mask & NGHTTP2_OPT_MAX_SETTINGS ) && option -> max_settings ) { ( * session_ptr ) -> max_settings = option -> max_settings ; }
Buggy code:
 void vlan_setup ( struct net_device * dev ) { ether_setup ( dev ) ; dev -> priv_flags |= IFF_802_1Q_VLAN ; <START_BUG> dev -> priv_flags &= ~ IFF_XMIT_DST_RELEASE ; <END_BUG> dev -> tx_queue_len = 0 ; dev -> netdev_ops = & vlan_netdev_ops ; dev -> destructor = free_netdev ; dev -> ethtool_ops = & vlan_ethtool_ops ; memset ( dev -> broadcast, 0, ETH_ALEN ) ; }

Fix:
<S2SV_ModStart> priv_flags &= ~ ( IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING ) <S2SV_ModEnd> ; dev ->
Buggy code:
 int prepareForShutdown ( ) { redisLog ( REDIS_WARNING, "User   requested   shutdown,   saving   DB..." ) ; if ( server. bgsavechildpid!= - 1 ) { redisLog ( REDIS_WARNING, "There   is   a   live   saving   child.   Killing   it!" ) ; kill ( server. bgsavechildpid, SIGKILL ) ; rdbRemoveTempFile ( server. bgsavechildpid ) ; } if ( server. appendonly ) { <START_BUG> aof_fsync ( server. appendfd ) ; <END_BUG> if ( server. vm_enabled ) unlink ( server. vm_swap_file ) ; } else if ( server. saveparamslen > 0 ) { if ( rdbSave ( server. dbfilename )!= REDIS_OK ) { redisLog ( REDIS_WARNING, "Error   trying   to   save   the   DB,   can\'t   exit" ) ; return REDIS_ERR ; } } else { redisLog ( REDIS_WARNING, "Not   saving   DB." ) ; } if ( server. daemonize ) unlink ( server. pidfile ) ; redisLog ( REDIS_WARNING, "Server   exit   now,   bye   bye..." ) ; return REDIS_OK ; }

Fix:
<S2SV_ModStart> server. appendfd <S2SV_ModEnd> ) ; }
Buggy code:
 void nlmsvc_grant_reply ( struct nlm_cookie * cookie, __be32 status ) { struct nlm_block * block ; dprintk ( "grant_reply:   looking   for   cookie   %x,   s=%d   \\n", * ( unsigned int * ) ( cookie -> data ), status ) ; if (! ( block = nlmsvc_find_block ( cookie ) ) ) return ; <START_BUG> if ( block ) { <END_BUG> if ( status == nlm_lck_denied_grace_period ) { nlmsvc_insert_block ( block, 10 * HZ ) ; } else { nlmsvc_unlink_block ( block ) ; }  } <START_BUG> nlmsvc_release_block ( block ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> status == nlm_lck_denied_grace_period <S2SV_ModStart> ) ; } <S2SV_ModEnd> nlmsvc_release_block ( block
Buggy code:
 static int count_comp_fors ( struct compiling * c, const node * n ) { int n_fors = 0 ; <START_BUG> int is_async ; <END_BUG> count_comp_for : is_async = 0 ; n_fors ++ ; REQ ( n, comp_for ) ;  if ( TYPE ( CHILD ( n, 0 ) ) == ASYNC ) { <START_BUG> is_async = 1 ; } <END_BUG> if ( NCH ( n ) == ( 5 + is_async ) ) {  <START_BUG> n = CHILD ( n, 4 + is_async ) ; <END_BUG> } else { return n_fors ; } count_comp_iter : REQ ( n, comp_iter ) ; n = CHILD ( n, 0 ) ; if ( TYPE ( n ) == comp_for ) goto count_comp_for ; else if ( TYPE ( n ) == comp_if ) { if ( NCH ( n ) == 3 ) { n = CHILD ( n, 2 ) ; goto count_comp_iter ; } else return n_fors ;  } <START_BUG> PyErr_SetString ( PyExc_SystemError, "logic   error   in   count_comp_fors" ) ; return - 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; count_comp_for : <S2SV_ModEnd> n_fors ++ ; <S2SV_ModStart> ; if ( NCH ( n ) == 2 ) { REQ ( CHILD ( n, 0 ), NAME ) ; assert ( strcmp ( STR ( CHILD ( n, 0 ) ), "async" ) == 0 ) ; n = CHILD ( n, 1 ) ; } else if ( NCH ( n ) == 1 ) { n = CHILD ( n, 0 ) ; } else { goto error <S2SV_ModEnd> ; } if <S2SV_ModStart> == ( 5 <S2SV_ModEnd> ) ) { <S2SV_ModStart> n, 4 <S2SV_ModEnd> ) ; } <S2SV_ModStart> n_fors ; } error :
Buggy code:
 void gdImageFillToBorder ( gdImagePtr im, int x, int y, int border, int color ) { int lastBorder ; int leftLimit = - 1, rightLimit ; int i, restoreAlphaBlending = 0 ; <START_BUG> if ( border < 0 ) { <END_BUG> return ; } if (! im -> trueColor ) { if ( ( color > ( im -> colorsTotal - 1 ) ) || ( border > ( im -> colorsTotal - 1 ) ) || ( color < 0 ) ) { return ; } } restoreAlphaBlending = im -> alphaBlendingFlag ; im -> alphaBlendingFlag = 0 ; if ( x >= im -> sx ) { x = im -> sx - 1 ; } else if ( x < 0 ) { x = 0 ; } if ( y >= im -> sy ) { y = im -> sy - 1 ; } else if ( y < 0 ) { y = 0 ; } for ( i = x ; i >= 0 ; i -- ) { if ( gdImageGetPixel ( im, i, y ) == border ) { break ; } gdImageSetPixel ( im, i, y, color ) ; leftLimit = i ; } if ( leftLimit == - 1 ) { im -> alphaBlendingFlag = restoreAlphaBlending ; return ; } rightLimit = x ; for ( i = ( x + 1 ) ; i < im -> sx ; i ++ ) { if ( gdImageGetPixel ( im, i, y ) == border ) { break ; } gdImageSetPixel ( im, i, y, color ) ; rightLimit = i ; } if ( y > 0 ) { lastBorder = 1 ; for ( i = leftLimit ; i <= rightLimit ; i ++ ) { int c = gdImageGetPixel ( im, i, y - 1 ) ; if ( lastBorder ) { if ( ( c!= border ) && ( c!= color ) ) { gdImageFillToBorder ( im, i, y - 1, border, color ) ; lastBorder = 0 ; } } else if ( ( c == border ) || ( c == color ) ) { lastBorder = 1 ; } } } if ( y < ( ( im -> sy ) - 1 ) ) { lastBorder = 1 ; for ( i = leftLimit ; i <= rightLimit ; i ++ ) { int c = gdImageGetPixel ( im, i, y + 1 ) ; if (

Fix:
<S2SV_ModStart> border < 0 || color < 0
Buggy code:
 static void * etm_setup_aux ( int event_cpu, void * * pages, int nr_pages, bool overwrite ) { int cpu ; cpumask_t * mask ; struct coresight_device * sink ; struct etm_event_data * event_data = NULL ; event_data = alloc_event_data ( event_cpu ) ; if (! event_data ) return NULL ; sink = coresight_get_enabled_sink ( true ) ; if (! sink ) goto err ; INIT_WORK ( & event_data -> work, free_event_data ) ; mask = & event_data -> mask ; for_each_cpu ( cpu, mask ) { struct coresight_device * csdev ; csdev = per_cpu ( csdev_src, cpu ) ; if (! csdev ) goto err ; event_data -> path [ cpu ] = coresight_build_path ( csdev, sink ) ; if ( IS_ERR ( event_data -> path [ cpu ] ) ) goto err ; } if (! sink_ops ( sink ) -> alloc_buffer ) goto err ; <START_BUG> event_data -> snk_config = <END_BUG> sink_ops ( sink ) -> alloc_buffer ( sink, cpu, pages, nr_pages, overwrite ) ; if (! event_data -> snk_config ) goto err ; out : return event_data ; err : etm_free_aux ( event_data ) ; event_data = NULL ; goto out ; }

Fix:
<S2SV_ModStart> goto err ; cpu = cpumask_first ( mask ) ;
Buggy code:
 int btrfs_init_dev_replace ( struct btrfs_fs_info * fs_info ) { struct btrfs_key key ; struct btrfs_root * dev_root = fs_info -> dev_root ; struct btrfs_dev_replace * dev_replace = & fs_info -> dev_replace ; struct extent_buffer * eb ; int slot ; int ret = 0 ; struct btrfs_path * path = NULL ; int item_size ; struct btrfs_dev_replace_item * ptr ; u64 src_devid ; path = btrfs_alloc_path ( ) ; if (! path ) { ret = - ENOMEM ; goto out ; } key. objectid = 0 ; key. type = BTRFS_DEV_REPLACE_KEY ; key. offset = 0 ; ret = btrfs_search_slot ( NULL, dev_root, & key, path, 0, 0 ) ; if ( ret ) { no_valid_dev_replace_entry_found : ret = 0 ; dev_replace -> replace_state = BTRFS_DEV_REPLACE_ITEM_STATE_NEVER_STARTED ; dev_replace -> cont_reading_from_srcdev_mode = BTRFS_DEV_REPLACE_ITEM_CONT_READING_FROM_SRCDEV_MODE_ALWAYS ; dev_replace -> time_started = 0 ; dev_replace -> time_stopped = 0 ; atomic64_set ( & dev_replace -> num_write_errors, 0 ) ; atomic64_set ( & dev_replace -> num_uncorrectable_read_errors, 0 ) ; dev_replace -> cursor_left = 0 ; dev_replace -> committed_cursor_left = 0 ; dev_replace -> cursor_left_last_write_of_item = 0 ; dev_replace -> cursor_right = 0 ; dev_replace -> srcdev = NULL ; dev_replace -> tgtdev = NULL ; dev_replace -> is_valid = 0 ; dev_replace -> item_needs_writeback = 0 ; goto out ; } slot = path -> slots [ 0 ] ; eb = path -> nodes [ 0 ] ; item_size = btrfs_item_size_nr ( eb, slot ) ; ptr = btrfs_item_ptr ( eb, slot, struct btr

Fix:
<S2SV_ModStart> NULL, NULL, true <S2SV_ModStart> NULL, NULL, true
Buggy code:
 static struct buffer_head * ext2_xattr_cache_find ( struct inode * inode, struct ext2_xattr_header * header ) { __u32 hash = le32_to_cpu ( header -> h_hash ) ; <START_BUG> struct mb_cache_entry * ce ; <END_BUG> if (! header -> h_hash ) return NULL ; ea_idebug ( inode, "looking   for   cached   blocks   [%x]", ( int ) hash ) ; again :  ce = mb_cache_entry_find_first ( ext2_xattr_cache, inode -> i_sb -> s_bdev, <START_BUG> hash ) ; while ( ce ) { struct buffer_head * bh ; if ( IS_ERR ( ce ) ) { if ( PTR_ERR ( ce ) == - EAGAIN ) goto again ; <END_BUG> break ;  } bh = sb_bread ( inode -> i_sb, ce -> e_block ) ; if (! bh ) { ext2_error ( inode -> i_sb, "ext2_xattr_cache_find", "inode   %ld:   block   %ld   read   error", <START_BUG> inode -> i_ino, ( unsigned long ) ce -> e_block ) ; <END_BUG> } else { lock_buffer ( bh ) ; if ( le32_to_cpu ( HDR ( bh ) -> h_refcount ) > EXT2_XATTR_REFCOUNT_MAX ) { ea_idebug ( inode, "block   %ld   refcount   %d>%d", ( unsigned long ) ce -> e_block, le32_to_cpu ( HDR ( bh ) -> h_refcount ), EXT2_XATTR_REFCOUNT_MAX ) ; } else if (! ext2_xattr_cmp ( header, HDR ( bh ) ) ) { ea_bdebug ( bh, "b_count=%d", atomic_read ( & ( bh -> b_count ) ) ) ;  mb_cache_entry_release ( ce ) ; <START_BUG> return bh ; } unlock_buffer ( bh ) ; brelse ( bh ) ; } <END_BUG> ce = mb_cache_entry_find_next ( ce, inode -> i_sb -> s_bdev, hash ) ;  } return NULL ; }

Fix:
<S2SV_ModStart> ) ; struct mb2_cache_entry * ce ; struct mb2_cache * ext2_mb_cache = EXT2_SB ( inode -> i_sb ) -> s_mb_cache <S2SV_ModEnd> ; if ( <S2SV_ModStart> : ce = mb2_cache_entry_find_first ( ext2_mb_cache, hash ) ; while ( ce ) { struct buffer_head * bh ; bh = sb_bread ( <S2SV_ModEnd> inode -> i_sb <S2SV_ModStart> inode -> i_sb, ce -> e_block ) ; if (! bh ) { ext2_error ( inode -> i_sb, "ext2_xattr_cache_find", "inode <S2SV_blank> %ld: <S2SV_blank> block <S2SV_blank> %ld <S2SV_blank> read <S2SV_blank> error", inode -> i_ino, ( unsigned long ) ce -> e_block ) ; } else { lock_buffer ( bh ) ; if ( hlist_bl_unhashed ( & ce -> e_hash_list ) ) { mb2_cache_entry_put ( ext2_mb_cache, ce ) ; unlock_buffer ( bh ) ; brelse ( bh ) ; <S2SV_ModEnd> goto again ; <S2SV_ModStart> goto again ; } else