nus-yam/ex-repair huggingface dataset:
Buggy code:
 static OPJ_BOOL opj_pi_next_rpcl ( opj_pi_iterator_t * pi ) { opj_pi_comp_t * comp = NULL ; opj_pi_resolution_t * res = NULL ; OPJ_UINT32 index = 0 ; if (! pi -> first ) { goto LABEL_SKIP ; } else { OPJ_UINT32 compno, resno ; pi -> first = 0 ; pi -> dx = 0 ; pi -> dy = 0 ; for ( compno = 0 ; compno < pi -> numcomps ; compno ++ ) { comp = & pi -> comps [ compno ] ; for ( resno = 0 ; resno < comp -> numresolutions ; resno ++ ) { OPJ_UINT32 dx, dy ; res = & comp -> resolutions [ resno ] ; dx = comp -> dx * ( 1u << ( res -> pdx + comp -> numresolutions - 1 - resno ) ) ; dy = comp -> dy * ( 1u << ( res -> pdy + comp -> numresolutions - 1 - resno ) ) ; pi -> dx =! pi -> dx? dx : opj_uint_min ( pi -> dx, dx ) ; pi -> dy =! pi -> dy? dy : opj_uint_min ( pi -> dy, dy ) ; } } } if (! pi -> tp_on ) { pi -> poc. ty0 = pi -> ty0 ; pi -> poc. tx0 = pi -> tx0 ; pi -> poc. ty1 = pi -> ty1 ; pi -> poc. tx1 = pi -> tx1 ; } for ( pi -> resno = pi -> poc. resno0 ; pi -> resno < pi -> poc. resno1 ; pi -> resno ++ ) { for ( pi -> y = pi -> poc. ty0 ; pi -> y < pi -> poc. ty1 ; pi -> y += ( OPJ_INT32 ) ( pi -> dy - ( OPJ_UINT32 ) ( pi -> y % ( OPJ_INT32 ) pi -> dy ) ) ) { for ( pi -> x = pi -> poc. tx0 ; pi -> x < pi -> poc. tx1 ; pi -> x += ( OPJ_INT32 ) ( pi -> dx -

Fix:
<S2SV_ModStart> ; if ( rpx >= 31 || ( ( comp -> dx << rpx ) >> rpx )!= comp -> dx || rpy >= 31 || ( ( comp -> dy << rpy ) >> rpy )!= comp -> dy ) { continue ; } if (
Buggy code:
 static void optimize_mb ( MACROBLOCK * x ) { int b ; int type ; int has_2nd_order ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; <START_BUG> vpx_memcpy ( & t_above, x -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, x -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; has_2nd_order = ( x -> e_mbd. mode_info_context -> mbmi. mode!= B_PRED && x -> e_mbd. mode_info_context -> mbmi. mode!= SPLITMV ) ; type = has_2nd_order? PLANE_TYPE_Y_NO_DC : PLANE_TYPE_Y_WITH_DC ; for ( b = 0 ; b < 16 ; b ++ ) { optimize_b ( x, b, type, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; } for ( b = 16 ; b < 24 ; b ++ ) { optimize_b ( x, b, PLANE_TYPE_UV, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; } if ( has_2nd_order ) { b = 24 ; optimize_b ( x, b, PLANE_TYPE_Y2, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; check_reset_2nd_coeffs ( & x -> e_mbd, PLANE_TYPE_Y2, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> * tl ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left
Buggy code:
 <START_BUG> static void perf_event_output ( struct perf_event * event, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) { struct perf_output_handle handle ; struct perf_event_header header ; rcu_read_lock ( ) ; perf_prepare_sample ( & header, data, event, regs ) ;  if ( perf_output_begin ( & handle, event, header. size, nmi, 1 ) ) <START_BUG> goto exit ; perf_output_sample ( & handle, & header, data, event ) ; perf_output_end ( & handle ) ; exit : rcu_read_unlock ( ) ; }<END_BUG>

Fix:
<S2SV_ModStart> perf_event * event <S2SV_ModEnd>, struct perf_sample_data <S2SV_ModStart>. size, <S2SV_ModEnd> 1 ) )
Buggy code:
 void vp9_cyclic_refresh_setup ( VP9_COMP * const cpi ) { VP9_COMMON * const cm = & cpi -> common ; const RATE_CONTROL * const rc = & cpi -> rc ; CYCLIC_REFRESH * const cr = cpi -> cyclic_refresh ; struct segmentation * const seg = & cm -> seg ; <START_BUG> unsigned char * const seg_map = cpi -> segmentation_map ; <END_BUG>  const int apply_cyclic_refresh = apply_cyclic_refresh_bitrate ( cm, rc ) ; <START_BUG> if (! apply_cyclic_refresh || ( cm -> frame_type == KEY_FRAME ) || <END_BUG> ( cpi -> svc. temporal_layer_id > 0 ) ) {  vpx_memset ( seg_map, 0, cm -> mi_rows * cm -> mi_cols ) ; vp9_disable_segmentation ( & cm -> seg ) ; <START_BUG> if ( cm -> frame_type == KEY_FRAME ) <END_BUG>  cr -> sb_index = 0 ; <START_BUG> return ; } else { int qindex_delta = 0 ; <END_BUG> int i, block_count, bl_index, sb_rows, sb_cols, sbs_in_frame ;  int xmis, ymis, x, y, qindex2 ; <START_BUG> const float rate_ratio_qdelta = 2.0 ; <END_BUG> vp9_clear_system_state ( ) ; cr -> max_sbs_perframe = 10 ; cr -> max_qdelta_perc = 50 ; cr -> min_block_size = BLOCK_8X8 ; cr -> time_for_refresh = 1 ; cr -> thresh_rate_sb = ( rc -> sb64_target_rate * 256 ) >> 2 ; cr -> thresh_dist_sb = 8 * ( int ) ( vp9_convert_qindex_to_q ( cm -> base_qindex ) * vp9_convert_qindex_to_q ( cm -> base_qindex ) ) ; if ( cpi -> sf. use_nonrd_pick_mode ) { cr -> thresh_rate_sb = ( rc -> sb64_target_rate * 256 ) >> 3 ; cr -> thresh_dist_sb = 4 * ( int ) ( vp9_convert_qindex_to_q ( cm -> base_q

Fix:
<S2SV_ModStart> -> seg ; <S2SV_ModEnd> const int apply_cyclic_refresh <S2SV_ModStart>, rc ) ; if ( cm -> current_video_frame == 0 ) cr -> low_content_avg = 0.0 <S2SV_ModStart> > 0 ) || ( cpi -> svc. spatial_layer_id > 0 ) ) { unsigned char * const seg_map = cpi -> segmentation_map ; memset <S2SV_ModEnd> ( seg_map, <S2SV_ModStart> == KEY_FRAME ) { memset ( cr -> last_coded_q_map, MAXQ, cm -> mi_rows * cm -> mi_cols * sizeof ( * cr -> last_coded_q_map ) ) ; <S2SV_ModStart> = 0 ; } <S2SV_ModStart> 0 ; int <S2SV_ModEnd> qindex2 ; const <S2SV_ModStart> qindex2 ; const double q = vp9_convert_qindex_to_q ( cm -> base_qindex, cm -> bit_depth ) ; vpx_clear_system_state ( ) ; cr -> thresh_rate_sb = ( ( int64_t ) ( rc -> sb64_target_rate ) << 8 ) << 2 ; cr -> thresh_dist_sb = ( ( int64_t ) ( q * q ) ) << 2 ; vp9_
Buggy code:
 <START_BUG> static struct nfs4_state * nfs4_do_open ( struct inode * dir, struct path * path, int flags, struct iattr * sattr, struct rpc_cred * cred ) <END_BUG> { struct nfs4_exception exception = { } ; struct nfs4_state * res ; int status ; do {  status = _nfs4_do_open ( dir, path, flags, sattr, cred, & res ) ; <START_BUG> if ( status == 0 ) break ; if ( status == - NFS4ERR_BAD_SEQID ) { printk ( KERN_WARNING "NFS:   v4   server   %s   " "   returned   a   bad   sequence-id   error!\\n", NFS_SERVER ( dir ) -> nfs_client -> cl_hostname ) ; exception. retry = 1 ; continue ; } if ( status == - NFS4ERR_BAD_STATEID ) { exception. retry = 1 ; continue ; } if ( status == - EAGAIN ) { exception. retry = 1 ; continue ; } res = ERR_PTR ( nfs4_handle_exception ( NFS_SERVER ( dir ), status, & exception ) ) ; } while ( exception. retry ) ; return res ; }<END_BUG>

Fix:
<S2SV_ModStart> path * path, fmode_t fmode <S2SV_ModStart> dir, path, fmode
Buggy code:
 void * getHTTPResponse ( int s, int * size ) { char buf [ 2048 ] ; int n ; int endofheaders = 0 ; int chunked = 0 ; int content_length = - 1 ; unsigned int chunksize = 0 ; unsigned int bytestocopy = 0 ; char * header_buf ; unsigned int header_buf_len = 2048 ; unsigned int header_buf_used = 0 ; char * content_buf ; unsigned int content_buf_len = 2048 ; unsigned int content_buf_used = 0 ; char chunksize_buf [ 32 ] ; unsigned int chunksize_buf_index ; header_buf = malloc ( header_buf_len ) ; content_buf = malloc ( content_buf_len ) ; chunksize_buf [ 0 ] = '\\0' ; chunksize_buf_index = 0 ; while ( ( n = receivedata ( s, buf, 2048, 5000, NULL ) ) > 0 ) { if ( endofheaders == 0 ) { int i ; int linestart = 0 ; int colon = 0 ; int valuestart = 0 ; if ( header_buf_used + n > header_buf_len ) { header_buf = realloc ( header_buf, header_buf_used + n ) ; header_buf_len = header_buf_used + n ; } memcpy ( header_buf + header_buf_used, buf, n ) ; header_buf_used += n ; i = 0 ; while ( i < ( ( int ) header_buf_used - 1 ) && ( endofheaders == 0 ) ) { if ( header_buf [ i ] == '\\r' ) { i ++ ; if ( header_buf [ i ] == '\\n' ) { i ++ ; if ( i < ( int ) header_buf_used && header_buf [ i ] == '\\r' ) { i ++ ; if ( i < ( int ) header_buf_used && header_buf [ i ] == '\\n' ) { endofheaders = i + 1 ; } } } } else if ( header_buf [ i ] == '\\n' ) { i ++ ; if ( header_buf [ i ] == '\\n' ) { endofheaders = i + 1 ; } } i ++ ; } if ( endofheaders == 0 ) continue ; for ( i = 0 ; i < endofheaders - 1 ; i ++ )

Fix:
<S2SV_ModStart> } while ( ( i < ( int ) header_buf_used ) && ( <S2SV_ModStart> ] == '\\n' )
Buggy code:
 int validate_as_request ( kdc_realm_t * kdc_active_realm, register krb5_kdc_req * request, krb5_db_entry client, krb5_db_entry server, krb5_timestamp kdc_time, const char * * status, krb5_pa_data * * * e_data ) { int errcode ; krb5_error_code ret ; if ( request -> kdc_options & AS_INVALID_OPTIONS ) { * status = "INVALID   AS   OPTIONS" ; return KDC_ERR_BADOPTION ; } if ( client. expiration && client. expiration < kdc_time ) { * status = "CLIENT   EXPIRED" ; if ( vague_errors ) return ( KRB_ERR_GENERIC ) ; else return ( KDC_ERR_NAME_EXP ) ; } if ( client. pw_expiration && client. pw_expiration < kdc_time &&! isflagset ( server. attributes, KRB5_KDB_PWCHANGE_SERVICE ) ) { * status = "CLIENT   KEY   EXPIRED" ; if ( vague_errors ) return ( KRB_ERR_GENERIC ) ; else return ( KDC_ERR_KEY_EXP ) ; } if ( server. expiration && server. expiration < kdc_time ) { * status = "SERVICE   EXPIRED" ; return ( KDC_ERR_SERVICE_EXP ) ; } if ( isflagset ( client. attributes, KRB5_KDB_REQUIRES_PWCHANGE ) &&! isflagset ( server. attributes, KRB5_KDB_PWCHANGE_SERVICE ) ) { * status = "REQUIRED   PWCHANGE" ; return ( KDC_ERR_KEY_EXP ) ; } if ( ( isflagset ( request -> kdc_options, KDC_OPT_ALLOW_POSTDATE ) || isflagset ( request -> kdc_options, KDC_OPT_POSTDATED ) ) && ( isflagset ( client. attributes, KRB5_KDB_DISALLOW_POSTDATED ) || isflagset ( server. attributes, KRB5_KDB_DISALLOW_POSTDATED ) ) ) { * status = "POSTDATE   NOT   ALLOWED" ; return ( KDC_ERR_CANNOT_POST

Fix:
<S2SV_ModStart> ( kdc_active_realm, client. princ <S2SV_ModEnd>, request ->
Buggy code:
 OM_uint32 gss_krb5int_export_lucid_sec_context ( OM_uint32 * minor_status, const gss_ctx_id_t context_handle, const gss_OID desired_object, gss_buffer_set_t * data_set ) { krb5_error_code kret = 0 ; OM_uint32 retval ; krb5_gss_ctx_id_t ctx = ( krb5_gss_ctx_id_t ) context_handle ; void * lctx = NULL ; int version = 0 ; gss_buffer_desc rep ; retval = GSS_S_FAILURE ; * minor_status = 0 ; * data_set = GSS_C_NO_BUFFER_SET ; <START_BUG> retval = generic_gss_oid_decompose ( minor_status, <END_BUG> GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID, GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID_LENGTH, desired_object, & version ) ; if ( GSS_ERROR ( retval ) ) return retval ; switch ( version ) { case 1 : kret = make_external_lucid_ctx_v1 ( ( krb5_pointer ) ctx, version, & lctx ) ; break ; default : kret = ( OM_uint32 ) KG_LUCID_VERSION ; break ; } if ( kret ) goto error_out ; rep. value = & lctx ; rep. length = sizeof ( lctx ) ; retval = generic_gss_add_buffer_set_member ( minor_status, & rep, data_set ) ; if ( GSS_ERROR ( retval ) ) goto error_out ; error_out : if ( * minor_status == 0 ) * minor_status = ( OM_uint32 ) kret ; return ( retval ) ; }

Fix:
<S2SV_ModStart> = GSS_C_NO_BUFFER_SET ; if ( ctx -> terminated ||! ctx -> established ) { * minor_status = KG_CTX_INCOMPLETE ; return GSS_S_NO_CONTEXT ; }
Buggy code:
 int xfs_attr3_leaf_flipflags ( struct xfs_da_args * args ) { struct xfs_attr_leafblock * leaf1 ; struct xfs_attr_leafblock * leaf2 ; struct xfs_attr_leaf_entry * entry1 ; struct xfs_attr_leaf_entry * entry2 ; struct xfs_attr_leaf_name_remote * name_rmt ; struct xfs_buf * bp1 ; struct xfs_buf * bp2 ; int error ; # ifdef DEBUG struct xfs_attr3_icleaf_hdr ichdr1 ; struct xfs_attr3_icleaf_hdr ichdr2 ; xfs_attr_leaf_name_local_t * name_loc ; int namelen1, namelen2 ; char * name1, * name2 ; # endif trace_xfs_attr_leaf_flipflags ( args ) ; error = xfs_attr3_leaf_read ( args -> trans, args -> dp, args -> blkno, - 1, & bp1 ) ; if ( error ) return error ; if ( args -> blkno2!= args -> blkno ) { error = xfs_attr3_leaf_read ( args -> trans, args -> dp, args -> blkno2, - 1, & bp2 ) ; if ( error ) return error ; } else { bp2 = bp1 ; } leaf1 = bp1 -> b_addr ; entry1 = & xfs_attr3_leaf_entryp ( leaf1 ) [ args -> index ] ; leaf2 = bp2 -> b_addr ; entry2 = & xfs_attr3_leaf_entryp ( leaf2 ) [ args -> index2 ] ; # ifdef DEBUG xfs_attr3_leaf_hdr_from_disk ( & ichdr1, leaf1 ) ; ASSERT ( args -> index < ichdr1. count ) ; ASSERT ( args -> index >= 0 ) ; xfs_attr3_leaf_hdr_from_disk ( & ichdr2, leaf2 ) ; ASSERT ( args -> index2 < ichdr2. count ) ; ASSERT ( args -> index2 >= 0 ) ; if ( entry1 -> flags & XFS_ATTR_LOCAL ) { name_loc = xfs_attr3_leaf_

Fix:
<S2SV_ModStart> ( args -> rmtvaluelen <S2SV_ModEnd> ) ; xfs_trans_log_buf
Buggy code:
 VOID ixheaacd_shiftrountine_with_rnd_hq ( WORD32 * qmf_real, WORD32 * qmf_imag, WORD32 * filter_states, WORD32 len, WORD32 shift ) { WORD32 * filter_states_rev = filter_states + len ; WORD32 treal, timag ; WORD32 j ; for ( j = ( len - 1 ) ; j >= 0 ; j -= 2 ) { WORD32 r1, r2, i1, i2 ; i2 = qmf_imag [ j ] ; r2 = qmf_real [ j ] ; r1 = * qmf_real ++ ; i1 = * qmf_imag ++ ; <START_BUG> timag = ixheaacd_add32 ( i1, r1 ) ; <END_BUG> timag = ( ixheaacd_shl32_sat ( timag, shift ) ) ; filter_states_rev [ j ] = timag ;  treal = ixheaacd_sub32 ( i2, r2 ) ; <START_BUG> treal = ( ixheaacd_shl32_sat ( treal, shift ) ) ; filter_states [ j ] = treal ; treal = ixheaacd_sub32 ( i1, r1 ) ; treal = ( ixheaacd_shl32_sat ( treal, shift ) ) ; * filter_states ++ = treal ; timag = ixheaacd_add32 ( i2, r2 ) ; timag = ( ixheaacd_shl32_sat ( timag, shift ) ) ; * filter_states_rev ++ = timag ; } }<END_BUG>

Fix:
<S2SV_ModStart> ; timag = ixheaacd_add32_sat <S2SV_ModEnd> ( i1, <S2SV_ModStart> ; treal = ixheaacd_sub32_sat ( i2, r2 ) ; treal = ( ixheaacd_shl32_sat ( treal, shift ) ) ; filter_states [ j ] = treal ; treal = ixheaacd_sub32_sat ( i1, r1 ) ; treal = ( ixheaacd_shl32_sat ( treal, shift ) ) ; * filter_states ++ = treal ; timag = ixheaacd_add32_sat <S2SV_ModEnd> ( i2,
Buggy code:
 static struct ipv6_txoptions * ipv6_update_options ( struct sock * sk, struct ipv6_txoptions * opt ) { if ( inet_sk ( sk ) -> is_icsk ) { if ( opt &&! ( ( 1 << sk -> sk_state ) & ( TCPF_LISTEN | TCPF_CLOSE ) ) && inet_sk ( sk ) -> inet_daddr!= LOOPBACK4_IPV6 ) { struct inet_connection_sock * icsk = inet_csk ( sk ) ; icsk -> icsk_ext_hdr_len = opt -> opt_flen + opt -> opt_nflen ; icsk -> icsk_sync_mss ( sk, icsk -> icsk_pmtu_cookie ) ; } } <START_BUG> opt = xchg ( & inet6_sk ( sk ) -> opt, opt ) ; <END_BUG> sk_dst_reset ( sk ) ; return opt ; }

Fix:
<S2SV_ModStart> = xchg ( ( __force struct ipv6_txoptions * * )
Buggy code:
 <START_BUG> static int read_mv_component ( vp9_reader * r, <END_BUG> const nmv_component * mvcomp, int usehp ) { int mag, d, fr, hp ;  const int sign = vp9_read ( r, mvcomp -> sign ) ; <START_BUG> <END_BUG> const int mv_class = vp9_read_tree ( r, vp9_mv_class_tree, mvcomp -> classes ) ;  const int class0 = mv_class == MV_CLASS_0 ; if ( class0 ) { <START_BUG> d = vp9_read_tree ( r, vp9_mv_class0_tree, mvcomp -> class0 ) ; <END_BUG> } else { int i ; const int n = mv_class + CLASS0_BITS - 1 ; d = 0 ; for ( i = 0 ; i < n ; ++ i )  d |= vp9_read ( r, mvcomp -> bits [ i ] ) << i ; <START_BUG> <END_BUG> }  <START_BUG> fr = vp9_read_tree ( r, vp9_mv_fp_tree, class0? mvcomp -> class0_fp [ d ] <END_BUG> : mvcomp -> fp ) ;  hp = usehp? vp9_read ( r, class0? mvcomp -> class0_hp : mvcomp -> hp ) <START_BUG> : 1 ; <END_BUG> mag = vp9_get_mv_mag ( mv_class, ( d << 3 ) | ( fr << 1 ) | hp ) + 1 ;  return sign? - mag : mag ; }

Fix:
<S2SV_ModStart> int read_mv_component ( vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> int sign = vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> int mv_class = vpx_read_tree <S2SV_ModEnd> ( r, <S2SV_ModStart> { d = vpx_read_tree <S2SV_ModEnd> ( r, <S2SV_ModStart> -> class0 ) ; mag = 0 <S2SV_ModStart> ) d |= vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> << i ; mag = CLASS0_SIZE << ( mv_class + 2 ) ; <S2SV_ModStart> } fr = vpx_read_tree <S2SV_ModEnd> ( r, <S2SV_ModStart> = usehp? vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> 1 ; mag += ( <S2SV_ModEnd> ( d <<
Buggy code:
 <START_BUG> static void update_skip_probs ( VP9_COMMON * cm, vp9_writer * w ) { <END_BUG> int k ; for ( k = 0 ; k < SKIP_CONTEXTS ; ++ k )  vp9_cond_prob_diff_update ( w, & cm -> fc. skip_probs [ k ], cm -> counts. skip [ k ] ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * cm, vpx_writer * w, FRAME_COUNTS * counts <S2SV_ModEnd> ) { int <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> skip_probs [ k <S2SV_ModStart> k ], counts -> <S2SV_ModEnd> skip [ k
Buggy code:
 static PyObject * _pyfribidi_log2vis ( PyObject * self, PyObject * args, PyObject * kw ) { <START_BUG> PyObject * logical = NULL ; <END_BUG>  FriBidiParType base = FRIBIDI_TYPE_RTL ; <START_BUG> const char * encoding = "utf-8" ; int clean = 0 ; int reordernsm = 1 ; static char * kwargs [ ] = <END_BUG> { "logical", "base_direction", "encoding", "clean", "reordernsm", NULL } ;  <START_BUG> if (! PyArg_ParseTupleAndKeywords ( args, kw, "O|isii", kwargs, <END_BUG>  & logical, & base, & encoding, & clean, & reordernsm ) ) <START_BUG> <END_BUG> return NULL ;  if (! ( base == FRIBIDI_TYPE_RTL || <START_BUG> base == FRIBIDI_TYPE_LTR || base == FRIBIDI_TYPE_ON ) ) <END_BUG> return PyErr_Format ( PyExc_ValueError, "invalid   value   %d:   use   either   RTL,   LTR   or   ON", base ) ;  if ( PyUnicode_Check ( logical ) ) <START_BUG> return log2vis_unicode ( logical, base, clean, reordernsm ) ; <END_BUG> else if ( PyString_Check ( logical ) )  return log2vis_encoded_string ( logical, encoding, base, clean, reordernsm ) ; else return PyErr_Format ( PyExc_TypeError, "expected   unicode   or   str,   not   %s", logical -> ob_type -> tp_name ) ; }

Fix:
<S2SV_ModStart> kw ) { PyUnicodeObject <S2SV_ModEnd> * logical = <S2SV_ModStart> base = FRIBIDI_TYPE_RTL <S2SV_ModEnd> ; int clean <S2SV_ModStart>, "base_direction", <S2SV_ModEnd> "clean", "reordernsm" <S2SV_ModStart>, kw, "U|iii" <S2SV_ModEnd>, kwargs, <S2SV_ModStart> base, & <S2SV_ModEnd> clean, & <S2SV_ModStart> reordernsm ) ) { <S2SV_ModStart> return NULL ; } <S2SV_ModStart> FRIBIDI_TYPE_ON ) ) { <S2SV_ModStart> base ) ; } return unicode_log2vis <S2SV_ModEnd> ( logical, <S2SV_ModStart> reordernsm ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static struct sock * dccp_v6_request_recv_sock ( const struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst, struct request_sock * req_unhash, bool * own_req ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; struct ipv6_pinfo * newnp ; const struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct ipv6_txoptions * opt ; struct inet_sock * newinet ; struct dccp6_sock * newdp6 ; struct sock * newsk ; if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = dccp_v4_request_recv_sock ( sk, skb, req, dst, req_unhash, own_req ) ; if ( newsk == NULL ) return NULL ; newdp6 = ( struct dccp6_sock * ) newsk ; newinet = inet_sk ( newsk ) ; newinet -> pinet6 = & newdp6 -> inet6 ; newnp = inet6_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; newnp -> saddr = newsk -> sk_v6_rcv_saddr ; inet_csk ( newsk ) -> icsk_af_ops = & dccp_ipv6_mapped ; newsk -> sk_backlog_rcv = dccp_v4_do_rcv ; newnp -> pktoptions = NULL ; newnp -> opt = NULL ; <START_BUG> newnp -> mcast_oif = inet6_iif ( skb ) ; <END_BUG> newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; dccp_sync_mss ( newsk, inet_csk ( newsk ) -> icsk_pmtu_cookie ) ; return newsk ; } if ( sk_acceptq_is_full ( sk ) ) goto out_overflow ; if (! dst ) { struct flowi6 fl6 ; dst = inet6_csk_route_req ( sk, & fl6, req, IPPROTO_DCCP

Fix:
<S2SV_ModStart> ; newnp -> ipv6_mc_list = NULL ; newnp -> ipv6_ac_list = NULL ; newnp -> ipv6_fl_list = NULL ; newnp -> <S2SV_ModStart> ; newnp -> ipv6_mc_list = NULL ; newnp -> ipv6_ac_list = NULL ; newnp -> ipv6_fl_list = NULL ; newnp ->
Buggy code:
 void * checked_xcalloc ( size_t num, size_t size ) { <START_BUG> alloc_limit_assert ( "checked_xcalloc", ( num * size ) ) ; <END_BUG> return xcalloc ( num, size ) ; }

Fix:
<S2SV_ModStart> size ) { size_t res ; if ( check_mul_overflow ( num, size, & res ) ) abort ( ) ; <S2SV_ModStart> "checked_xcalloc", ( res <S2SV_ModEnd> ) ) ;
Buggy code:
 static void update_mbgraph_frame_stats ( VP9_COMP * cpi, MBGRAPH_FRAME_STATS * stats, YV12_BUFFER_CONFIG * buf, YV12_BUFFER_CONFIG * golden_ref, YV12_BUFFER_CONFIG * alt_ref ) { <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; VP9_COMMON * const cm = & cpi -> common ; int mb_col, mb_row, offset = 0 ; int mb_y_offset = 0, arf_y_offset = 0, gld_y_offset = 0 ;  int_mv arf_top_mv, gld_top_mv ; <START_BUG> <END_BUG> MODE_INFO mi_local = { { 0 } } ;  arf_top_mv. as_int = 0 ; gld_top_mv. as_int = 0 ; x -> mv_row_min = - BORDER_MV_PIXELS_B16 ; x -> mv_row_max = ( cm -> mb_rows - 1 ) * 8 + BORDER_MV_PIXELS_B16 ; xd -> up_available = 0 ; xd -> plane [ 0 ]. dst. stride = buf -> y_stride ; xd -> plane [ 0 ]. pre [ 0 ]. stride = buf -> y_stride ; xd -> plane [ 1 ]. dst. stride = buf -> uv_stride ; xd -> mi [ 0 ] = & mi_local ; mi_local. mbmi. sb_type = BLOCK_16X16 ; mi_local. mbmi. ref_frame [ 0 ] = LAST_FRAME ; mi_local. mbmi. ref_frame [ 1 ] = NONE ; for ( mb_row = 0 ; mb_row < cm -> mb_rows ; mb_row ++ ) { <START_BUG> int_mv arf_left_mv, gld_left_mv ; <END_BUG> int mb_y_in_offset = mb_y_offset ; int arf_y_in_offset = arf_y_offset ;  int gld_y_in_offset = gld_y_offset ; <START_BUG> arf_left_mv. as_int = arf_top_mv. as_<END_BUG>

Fix:
<S2SV_ModStart> & cpi -> td. <S2SV_ModStart> = 0 ; MV gld_top_mv = { 0, 0 } <S2SV_ModEnd> ; MODE_INFO mi_local <S2SV_ModStart> ; MODE_INFO mi_local ; vp9_zero ( mi_local ) <S2SV_ModEnd> ; x -> <S2SV_ModStart> ++ ) { MV gld_left_mv = gld_top_mv <S2SV_ModEnd> ; int mb_y_in_offset <S2SV_ModStart> gld_y_in_offset = gld_y_offset <S2SV_ModEnd> ; x -> <S2SV_ModStart> mb_col ) ; gld_left_mv <S2SV_ModEnd> = mb_stats -> <S2SV_ModStart> -> ref [ GOLDEN_FRAME <S2SV_ModEnd> ]. m <S2SV_ModStart>. mv. as_mv ; if ( mb_col == 0 ) { gld_top_mv = gld_left_mv <S2SV_ModEnd> ; } xd
Buggy code:
 static ssize_t wdm_read ( struct file * file, char __user * buffer, size_t count, loff_t * ppos ) { int rv, cntr ; int i = 0 ; struct wdm_device * desc = file -> private_data ; rv = mutex_lock_interruptible ( & desc -> rlock ) ; if ( rv < 0 ) return - ERESTARTSYS ; cntr = ACCESS_ONCE ( desc -> length ) ; if ( cntr == 0 ) { desc -> read = 0 ; retry : if ( test_bit ( WDM_DISCONNECTING, & desc -> flags ) ) { rv = - ENODEV ; goto err ; } <START_BUG> i ++ ; <END_BUG> if ( file -> f_flags & O_NONBLOCK ) { if (! test_bit ( WDM_READ, & desc -> flags ) ) { rv = cntr? cntr : - EAGAIN ; goto err ; } rv = 0 ; } else { rv = wait_event_interruptible ( desc -> wait, test_bit ( WDM_READ, & desc -> flags ) ) ; } if ( test_bit ( WDM_DISCONNECTING, & desc -> flags ) ) { rv = - ENODEV ; goto err ; } if ( test_bit ( WDM_RESETTING, & desc -> flags ) ) { rv = - EIO ; goto err ; } usb_mark_last_busy ( interface_to_usbdev ( desc -> intf ) ) ; if ( rv < 0 ) { rv = - ERESTARTSYS ; goto err ; } spin_lock_irq ( & desc -> iuspin ) ; if ( desc -> rerr ) { desc -> rerr = 0 ; spin_unlock_irq ( & desc -> iuspin ) ; rv = - EIO ; goto err ; } if (! test_bit ( WDM_READ, & desc -> flags ) ) { spin_unlock_irq ( & desc -> iuspin ) ; goto retry ; } if (! desc -> reslength ) { dev_dbg ( & desc -> intf -> dev, "%s:   zero   length   -   clearing   WDM_READ\\n", __func__ ) ; clear_bit ( WDM_READ, & desc -> flags ) ; spin_unlock_irq ( &

Fix:
<S2SV_ModStart> err ; } if ( test_bit ( WDM_OVERFLOW, & desc -> flags ) ) { clear_bit ( WDM_OVERFLOW, & desc -> flags ) ; rv = - ENOBUFS ; goto err ; }
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG> fprintf ( stderr, "Usage:   %s   <infile>   <outfile>\\n", exec_name ) ; exit ( EXIT_FAILURE ) ; }

Fix:
<S2SV_ModStart> void usage_exit ( void
Buggy code:
 static struct o2nm_cluster * to_o2nm_cluster_from_node ( struct o2nm_node * node ) { <START_BUG> return to_o2nm_cluster ( node -> nd_item. ci_parent -> ci_parent ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> node ) { if ( node -> nd_item. ci_parent ) <S2SV_ModStart> ci_parent ) ; else return NULL ;
Buggy code:
 static TEE_Result set_rmem_param ( const struct optee_msg_param_rmem * rmem, struct param_mem * mem ) <START_BUG> { <END_BUG> uint64_t shm_ref = READ_ONCE ( rmem -> shm_ref ) ; mem -> mobj = mobj_reg_shm_get_by_cookie ( shm_ref ) ; if (! mem -> mobj ) return TEE_ERROR_BAD_PARAMETERS ; mem -> offs = READ_ONCE ( rmem -> offs ) ; mem -> size = READ_ONCE ( rmem -> size ) ;  return TEE_SUCCESS ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> mem ) { size_t req_size = 0 ; <S2SV_ModStart> size ) ; if ( ADD_OVERFLOW ( mem -> offs, mem -> size, & req_size ) || mem -> mobj -> size < req_size ) return TEE_ERROR_SECURITY ;
Buggy code:
 av_cold void ff_idctdsp_init ( IDCTDSPContext * c, AVCodecContext * avctx ) { const unsigned high_bit_depth = avctx -> bits_per_raw_sample > 8 ; if ( avctx -> lowres == 1 ) { c -> idct_put = ff_jref_idct4_put ; c -> idct_add = ff_jref_idct4_add ; c -> idct = ff_j_rev_dct4 ; c -> perm_type = FF_IDCT_PERM_NONE ; } else if ( avctx -> lowres == 2 ) { c -> idct_put = ff_jref_idct2_put ; c -> idct_add = ff_jref_idct2_add ; c -> idct = ff_j_rev_dct2 ; c -> perm_type = FF_IDCT_PERM_NONE ; } else if ( avctx -> lowres == 3 ) { c -> idct_put = ff_jref_idct1_put ; c -> idct_add = ff_jref_idct1_add ; c -> idct = ff_j_rev_dct1 ; c -> perm_type = FF_IDCT_PERM_NONE ; } else { if ( avctx -> bits_per_raw_sample == 10 || avctx -> bits_per_raw_sample == 9 ) { <START_BUG> if ( avctx -> codec_id == AV_CODEC_ID_MPEG4 && avctx -> profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO ) <END_BUG> c -> idct_put = ff_simple_idct_put_int32_10bit ; else { c -> idct_put = ff_simple_idct_put_int16_10bit ; c -> idct_add = ff_simple_idct_add_int16_10bit ; c -> idct = ff_simple_idct_int16_10bit ; } c -> perm_type = FF_IDCT_PERM_NONE ; } else if ( avctx -> bits_per_raw_sample == 12 ) { c -> idct_put = ff_simple_idct_put_int16_12

Fix:
<S2SV_ModStart> { if ( c -> mpeg4_studio_profile <S2SV_ModEnd> ) c ->
Buggy code:
 void dwg_free_object ( Dwg_Object * obj ) { int error = 0 ; long unsigned int j ; Dwg_Data * dwg ; Bit_Chain * dat = & pdat ; if ( obj && obj -> parent ) { dwg = obj -> parent ; dat -> version = dwg -> header. version ; } else return ; if ( obj -> type == DWG_TYPE_FREED || obj -> tio. object == NULL ) return ; dat -> from_version = dat -> version ; if ( obj -> supertype == DWG_SUPERTYPE_UNKNOWN ) goto unhandled ; switch ( obj -> type ) { case DWG_TYPE_TEXT : dwg_free_TEXT ( dat, obj ) ; break ; case DWG_TYPE_ATTRIB : dwg_free_ATTRIB ( dat, obj ) ; break ; case DWG_TYPE_ATTDEF : dwg_free_ATTDEF ( dat, obj ) ; break ; case DWG_TYPE_BLOCK : dwg_free_BLOCK ( dat, obj ) ; break ; case DWG_TYPE_ENDBLK : dwg_free_ENDBLK ( dat, obj ) ; break ; case DWG_TYPE_SEQEND : dwg_free_SEQEND ( dat, obj ) ; break ; case DWG_TYPE_INSERT : dwg_free_INSERT ( dat, obj ) ; break ; case DWG_TYPE_MINSERT : dwg_free_MINSERT ( dat, obj ) ; break ; case DWG_TYPE_VERTEX_2D : dwg_free_VERTEX_2D ( dat, obj ) ; break ; case DWG_TYPE_VERTEX_3D : dwg_free_VERTEX_3D ( dat, obj ) ; break ; case DWG_TYPE_VERTEX_MESH : dwg_free_VERTEX_MESH ( dat, obj ) ; break ; case DWG_TYPE_VERTEX_PFACE : dwg_free_VERTEX_PFACE ( dat, obj ) ; break ; case DWG_TYPE_VERTEX_PFACE_FACE : dwg_free_VERTEX_PFACE_FACE ( dat, obj ) ; break ; case DWG_TYPE_POLYLINE_2D : dwg_free_POLY

Fix:
<S2SV_ModStart> DWG_ERR_UNHANDLEDCLASS ) { unhandled : <S2SV_ModEnd> if ( obj <S2SV_ModStart> -> fixedtype == DWG_TYPE_UNKNOWN_ENT ) <S2SV_ModEnd> dwg_free_UNKNOWN_ENT ( dat <S2SV_ModStart> obj ) ; <S2SV_ModEnd> else if ( <S2SV_ModStart> -> fixedtype == DWG_TYPE_UNKNOWN_OBJ ) <S2SV_ModEnd> dwg_free_UNKNOWN_OBJ ( dat <S2SV_ModStart> obj ) ; <S2SV_ModEnd> } } if
Buggy code:
 Datum poly_in ( PG_FUNCTION_ARGS ) { char * str = PG_GETARG_CSTRING ( 0 ) ; POLYGON * poly ; int npts ; int size ; <START_BUG> int isopen ; <END_BUG> char * s ; if ( ( npts = pair_count ( str, ',' ) ) <= 0 ) ereport ( ERROR, ( errcode ( ERRCODE_INVALID_TEXT_REPRESENTATION ), errmsg ( "invalid   input   syntax   for   type   polygon:   \\"%s\\"", str ) ) ) ;  size = offsetof ( POLYGON, p [ 0 ] ) + sizeof ( poly -> p [ 0 ] ) * npts ; <START_BUG> poly = ( POLYGON * ) palloc0 ( size ) ; SET_VARSIZE ( poly, size ) ; poly -> npts = npts ; if ( (! path_decode ( FALSE, npts, str, & isopen, & s, & ( poly -> p [ 0 ] ) ) ) || ( * s!= '\\0' ) ) ereport ( ERROR, ( errcode ( ERRCODE_INVALID_TEXT_REPRESENTATION ), errmsg ( "invalid   input   syntax   for   type   polygon:   \\"%s\\"", str ) ) ) ; make_bound_box ( poly ) ; PG_RETURN_POLYGON_P ( poly ) ; }<END_BUG>

Fix:
<S2SV_ModStart> size ; int base_size ; int <S2SV_ModStart> ) ) ; base_size = sizeof ( poly -> p [ 0 ] ) * npts ; <S2SV_ModStart> ] ) + base_size ; if ( base_size // npts!= <S2SV_ModStart> 0 ] ) || size <= base_size ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "too <S2SV_blank> many <S2SV_blank> points <S2SV_blank> requested" ) ) ) <S2SV_ModEnd> ; poly =
Buggy code:
 static vpx_codec_err_t decoder_peek_si_internal ( const uint8_t * data, unsigned int data_sz, vpx_codec_stream_info_t * si, int * is_intra_only, vpx_decrypt_cb decrypt_cb, void * decrypt_state ) { int intra_only_flag = 0 ; <START_BUG> uint8_t clear_buffer [ 9 ] ; <END_BUG> if ( data + data_sz <= data ) return VPX_CODEC_INVALID_PARAM ; si -> is_kf = 0 ; si -> w = si -> h = 0 ; if ( decrypt_cb ) { data_sz = VPXMIN ( sizeof ( clear_buffer ), data_sz ) ; decrypt_cb ( decrypt_state, data, clear_buffer, data_sz ) ; data = clear_buffer ;  } <START_BUG> { int show_frame ; int error_resilient ; struct vpx_read_bit_buffer rb = { data, data + data_sz, 0, NULL, NULL } ; const int frame_marker = vpx_rb_read_literal ( & rb, 2 ) ; const BITSTREAM_PROFILE profile = vp9_read_profile ( & rb ) ; if ( frame_marker!= VP9_FRAME_MARKER ) return VPX_CODEC_UNSUP_BITSTREAM ; if ( profile >= MAX_PROFILES ) return VPX_CODEC_UNSUP_BITSTREAM ; <END_BUG> if ( ( profile >= 2 && data_sz <= 1 ) || data_sz < 1 )  return VPX_CODEC_UNSUP_BITSTREAM ; if ( vpx_rb_read_bit ( & rb ) ) { vpx_rb_read_literal ( & rb, 3 ) ; return VPX_CODEC_OK ; } <START_BUG> if ( data_sz <= 8 ) <END_BUG> return VPX_CODEC_UNSUP_BITSTREAM ; si -> is_kf =! vpx_rb_read_bit ( & rb ) ; show_frame = vpx_rb_read_bit ( & rb ) ; error_resilient = vpx_rb_read_bit ( & rb ) ; if ( si -> is_kf ) { if (! vp9_read_sync_code ( & rb ) )

Fix:
<S2SV_ModStart> uint8_t clear_buffer [ 10 <S2SV_ModEnd> ] ; if <S2SV_ModStart> clear_buffer ; } if ( data_sz < 1 ) return VPX_CODEC_UNSUP_BITSTREAM ; <S2SV_ModStart> ; if ( vpx_rb_read_bit ( & rb ) ) { if ( profile > <S2SV_ModEnd> 2 && data_sz <S2SV_ModStart> 2 && data_sz < 2 ) return VPX_CODEC_UNSUP_BITSTREAM ; <S2SV_ModEnd> vpx_rb_read_literal ( & <S2SV_ModStart> if ( data_sz < 10 <S2SV_ModEnd> ) return VPX_CODEC_UNSUP_BITSTREAM
Buggy code:
 void SetGray ( double grayscale, int par ) { if ( par == STROKING ) { <START_BUG> outpos += sprintf ( outpos, "   %12.3f   G", grayscale ) ; <END_BUG> } else {  outpos += sprintf ( outpos, "   %12.3f   g", grayscale ) ; <START_BUG> } <END_BUG> } 

Fix:
<S2SV_ModStart> STROKING ) { sprintf ( outputbuffer <S2SV_ModEnd>, " <S2SV_blank> %12.3f <S2SV_blank> G", <S2SV_ModStart> } else { sprintf ( outputbuffer <S2SV_ModEnd>, " <S2SV_blank> %12.3f <S2SV_blank> g", <S2SV_ModStart> ) ; } sendClean ( outputbuffer ) ;
Buggy code:
 static int get_refresh_mask ( VP9_COMP * cpi ) { <START_BUG> # if CONFIG_MULTIPLE_ARF <END_BUG> if (! cpi -> multi_arf_enabled && cpi -> refresh_golden_frame &&! cpi -> refresh_alt_ref_frame ) { # else if ( cpi -> refresh_golden_frame &&! cpi -> refresh_alt_ref_frame &&! cpi -> use_svc ) { # endif return ( cpi -> refresh_last_frame << cpi -> lst_fb_idx ) | ( cpi -> refresh_golden_frame << cpi -> alt_fb_idx ) ; } else { int arf_idx = cpi -> alt_fb_idx ;  # if CONFIG_MULTIPLE_ARF <START_BUG> <END_BUG> if ( cpi -> multi_arf_enabled ) {  int sn = cpi -> sequence_number ; <START_BUG> arf_idx = ( cpi -> frame_coding_order [ sn ] < 0 )? <END_BUG> cpi -> arf_buffer_idx [ sn + 1 ] : cpi -> arf_buffer_idx [ sn ] ; }  # endif <START_BUG> return ( cpi -> refresh_last_frame << cpi -> lst_fb_idx ) | ( cpi -> refresh_golden_frame << cpi -> gld_fb_idx ) | ( cpi -> refresh_alt_ref_frame << arf_idx ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> cpi ) { if ( vp9_preserve_existing_gf ( cpi ) ) { <S2SV_ModEnd> return ( cpi <S2SV_ModStart> -> alt_fb_idx ; if ( <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ( cpi -> oxcf. pass == 2 ) && cpi -> multi_arf_allowed ) { const GF_GROUP * const gf_group = & cpi -> twopass. gf_group <S2SV_ModEnd> ; arf_idx = <S2SV_ModStart> ; arf_idx = gf_group -> arf_update_idx [ gf_group -> index <S2SV_ModEnd> ] ; } <S2SV_ModStart> ] ; } <S2SV_ModEnd> return ( cpi
Buggy code:
 static int do_ip_vs_set_ctl ( struct sock * sk, int cmd, void __user * user, unsigned int len ) { int ret ; unsigned char arg [ MAX_ARG_LEN ] ; struct ip_vs_service_user * usvc_compat ; struct ip_vs_service_user_kern usvc ; struct ip_vs_service * svc ; struct ip_vs_dest_user * udest_compat ; struct ip_vs_dest_user_kern udest ; if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; <START_BUG> if ( len!= set_arglen [ SET_CMDID ( cmd ) ] ) { <END_BUG> pr_err ( "set_ctl:   len   %u  !=   %u\\n", len, set_arglen [ SET_CMDID ( cmd ) ] ) ; return - EINVAL ; } if ( copy_from_user ( arg, user, len )!= 0 ) return - EFAULT ; ip_vs_use_count_inc ( ) ; if ( mutex_lock_interruptible ( & __ip_vs_mutex ) ) { ret = - ERESTARTSYS ; goto out_dec ; } if ( cmd == IP_VS_SO_SET_FLUSH ) { ret = ip_vs_flush ( ) ; goto out_unlock ; } else if ( cmd == IP_VS_SO_SET_TIMEOUT ) { ret = ip_vs_set_timeout ( ( struct ip_vs_timeout_user * ) arg ) ; goto out_unlock ; } else if ( cmd == IP_VS_SO_SET_STARTDAEMON ) { struct ip_vs_daemon_user * dm = ( struct ip_vs_daemon_user * ) arg ; ret = start_sync_thread ( dm -> state, dm -> mcast_ifn, dm -> syncid ) ; goto out_unlock ; } else if ( cmd == IP_VS_SO_SET_STOPDAEMON ) { struct ip_vs_daemon_user * dm = ( struct ip_vs_daemon_user * ) arg ; ret = stop_sync_thread ( dm -> state ) ; goto out_unlock ; } usvc_compat = ( struct ip_vs_service_user * ) arg ; udest_compat = ( struct ip_

Fix:
<S2SV_ModStart> ; if ( cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX ) return - EINVAL ; if ( len < 0 || len > MAX_ARG_LEN ) return - EINVAL ; if (
Buggy code:
 int luaopen_x509 ( lua_State * L ) { auxiliar_newclass ( L, "openssl.x509", x509_funcs ) ; lua_newtable ( L ) ; luaL_setfuncs ( L, R, 0 ) ; openssl_register_xname ( L ) ; lua_setfield ( L, - 2, "name" ) ; openssl_register_xattribute ( L ) ; lua_setfield ( L, - 2, "attribute" ) ; openssl_register_xextension ( L ) ; lua_setfield ( L, - 2, "extension" ) ; openssl_register_xstore ( L ) ; lua_setfield ( L, - 2, "store" ) ; openssl_register_xalgor ( L ) ; lua_setfield ( L, - 2, "algor" ) ; luaopen_x509_req ( L ) ; lua_setfield ( L, - 2, "req" ) ; luaopen_x509_crl ( L ) ; lua_setfield ( L, - 2, "crl" ) ; lua_pushliteral ( L, "version" ) ; lua_pushliteral ( L, MYVERSION ) ; lua_settable ( L, - 3 ) ; <START_BUG> return 1 ; <END_BUG> }

Fix:
<S2SV_ModStart> 3 ) ; # if OPENSSL_VERSION_NUMBER > 0x10002000L lua_pushliteral ( L, "check_flag" ) ; lua_newtable ( L ) ; auxiliar_enumerate ( L, - 1, check_flags_const ) ; lua_settable ( L, - 3 ) ; # endif
Buggy code:
 int __sys_recvmmsg ( int fd, struct mmsghdr __user * mmsg, unsigned int vlen, unsigned int flags, struct timespec * timeout ) { int fput_needed, err, datagrams ; struct socket * sock ; struct mmsghdr __user * entry ; struct compat_mmsghdr __user * compat_entry ; struct msghdr msg_sys ; struct timespec end_time ; if ( timeout && poll_select_set_timeout ( & end_time, timeout -> tv_sec, timeout -> tv_nsec ) ) return - EINVAL ; datagrams = 0 ; sock = sockfd_lookup_light ( fd, & err, & fput_needed ) ; if (! sock ) return err ; err = sock_error ( sock -> sk ) ; if ( err ) goto out_put ; entry = mmsg ; compat_entry = ( struct compat_mmsghdr __user * ) mmsg ; while ( datagrams < vlen ) { if ( MSG_CMSG_COMPAT & flags ) { err = ___sys_recvmsg ( sock, ( struct user_msghdr __user * ) compat_entry, & msg_sys, flags & ~ MSG_WAITFORONE, datagrams ) ; if ( err < 0 ) break ; err = __put_user ( err, & compat_entry -> msg_len ) ; ++ compat_entry ; } else { err = ___sys_recvmsg ( sock, ( struct user_msghdr __user * ) entry, & msg_sys, flags & ~ MSG_WAITFORONE, datagrams ) ; if ( err < 0 ) break ; err = put_user ( err, & entry -> msg_len ) ; ++ entry ; } if ( err ) break ; ++ datagrams ; if ( flags & MSG_WAITFORONE ) flags |= MSG_DONTWAIT ; if ( timeout ) { ktime_get_ts ( timeout ) ; * timeout = timespec_sub ( end_time, * timeout ) ; if ( timeout -> tv_sec < 0 ) { timeout -> tv_sec = timeout -> tv_nsec = 0 ; break ; } if ( timeout -> tv_nsec == 0 && timeout -> tv_sec == 0 ) break ; } if ( msg_sys. msg_flags & MSG_OOB ) break ; cond_resched

Fix:
<S2SV_ModStart> ) ; } if ( err == 0 ) goto out_put ; if ( datagrams <S2SV_ModEnd> == 0 ) <S2SV_ModStart> == 0 ) { datagrams = err ; goto out_put ; } <S2SV_ModEnd> if ( err <S2SV_ModStart> err ; } out_put : fput_light ( sock -> file, fput_needed ) ; <S2SV_ModStart> datagrams ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int f2fs_mpage_readpages ( struct address_space * mapping, struct list_head * pages, struct page * page, unsigned nr_pages, bool is_readahead ) { struct bio * bio = NULL ; sector_t last_block_in_bio = 0 ; struct inode * inode = mapping -> host ; struct f2fs_map_blocks map ; int ret = 0 ; map. m_pblk = 0 ; map. m_lblk = 0 ; map. m_len = 0 ; map. m_flags = 0 ; map. m_next_pgofs = NULL ; map. m_next_extent = NULL ; map. m_seg_type = NO_CHECK_TYPE ; map. m_may_create = false ; for ( ; nr_pages ; nr_pages -- ) { if ( pages ) { page = list_last_entry ( pages, struct page, lru ) ; prefetchw ( & page -> flags ) ; list_del ( & page -> lru ) ; if ( add_to_page_cache_lru ( page, mapping, <START_BUG> page -> index, <END_BUG> readahead_gfp_mask ( mapping ) ) ) goto next_page ; } ret = f2fs_read_single_page ( inode, page, nr_pages, & map, & bio, & last_block_in_bio, is_readahead ) ; if ( ret ) { SetPageError ( page ) ; zero_user_segment ( page, 0, PAGE_SIZE ) ; unlock_page ( page ) ; } next_page : if ( pages ) put_page ( page ) ; } BUG_ON ( pages &&! list_empty ( pages ) ) ; if ( bio ) __submit_bio ( F2FS_I_SB ( inode ), bio, DATA ) ; return pages? 0 : ret ; }

Fix:
<S2SV_ModStart>, mapping, page_index ( page ) <S2SV_ModEnd>, readahead_gfp_mask (
Buggy code:
 <START_BUG> static int <END_BUG>  rpki_rtr_pdu_print ( netdissect_options * ndo, const u_char * tptr, u_int indent ) <START_BUG> { const rpki_rtr_pdu * pdu_header ; u_int pdu_type, pdu_len, hexdump ; const u_char * msg ; <END_BUG> pdu_header = ( const rpki_rtr_pdu * ) tptr ;  pdu_type = pdu_header -> pdu_type ; pdu_len = EXTRACT_32BITS ( pdu_header -> length ) ; <START_BUG> ND_TCHECK2 ( * tptr, pdu_len ) ; <END_BUG> hexdump = FALSE ; ND_PRINT ( ( ndo, "%sRPKI-RTRv%u,   %s   PDU   (%u),   length:   %u", indent_string ( 8 ), pdu_header -> version, tok2str ( rpki_rtr_pdu_values, "Unknown", pdu_type ),  pdu_type, pdu_len ) ) ; <START_BUG> switch ( pdu_type ) { case RPKI_RTR_SERIAL_NOTIFY_PDU : case RPKI_RTR_SERIAL_QUERY_PDU : <END_BUG> case RPKI_RTR_END_OF_DATA_PDU :  msg = ( const u_char * ) ( pdu_header + 1 ) ; ND_PRINT ( ( ndo, "%sSession   ID:   0x%04x,   Serial:   %u", indent_string ( indent + 2 ), EXTRACT_16BITS ( pdu_header -> u. session_id ), EXTRACT_32BITS ( msg ) ) ) ; break ; case RPKI_RTR_RESET_QUERY_PDU : case RPKI_RTR_CACHE_RESET_PDU : <START_BUG> break ; <END_BUG>  case RPKI_RTR_CACHE_RESPONSE_PDU : <START_BUG> ND_PRINT ( ( ndo, "%sSession   ID:   0x%04x", indent_string ( indent + 2 ), EXTRACT_16BITS ( pdu_header -> u. session_id ) ) ) ; break ; case RPKI_RTR_IPV4_PREFIX_PDU :<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static u_int <S2SV_ModEnd> rpki_rtr_pdu_print ( netdissect_options <S2SV_ModStart> * tptr, const u_int len, const u_char recurse, const <S2SV_ModStart> * msg ; ND_TCHECK_8BITS ( tptr ) ; if ( * tptr!= 0 ) { ND_PRINT ( ( ndo, "%sRPKI-RTRv%u <S2SV_blank> (unknown)", indent_string ( 8 ), * tptr ) ) ; return len ; } if ( len < sizeof ( rpki_rtr_pdu ) ) { ND_PRINT ( ( ndo, "(%u <S2SV_blank> bytes <S2SV_blank> is <S2SV_blank> too <S2SV_blank> few <S2SV_blank> to <S2SV_blank> decode)", len ) ) ; goto invalid ; } ND_TCHECK2 ( * tptr, sizeof ( rpki_rtr_pdu ) ) ; <S2SV_ModStart> length ) ; <S2SV_ModEnd> hexdump = FALSE <S2SV_ModStart> pdu_len ) ) ; if ( pdu_len < sizeof ( rpki_rtr_pdu ) || pdu_len > len ) goto invalid <S2SV_ModStart> case RPKI_RTR_
Buggy code:
 struct snd_seq_client_port * snd_seq_create_port ( struct snd_seq_client * client, int port ) { unsigned long flags ; struct snd_seq_client_port * new_port, * p ; int num = - 1 ; if ( snd_BUG_ON (! client ) ) return NULL ; if ( client -> num_ports >= SNDRV_SEQ_MAX_PORTS ) { pr_warn ( "ALSA:   seq:   too   many   ports   for   client   %d\\n", client -> number ) ; return NULL ; } new_port = kzalloc ( sizeof ( * new_port ), GFP_KERNEL ) ; if (! new_port ) return NULL ; new_port -> addr. client = client -> number ; new_port -> addr. port = - 1 ; new_port -> owner = THIS_MODULE ; sprintf ( new_port -> name, "port-%d", num ) ; snd_use_lock_init ( & new_port -> use_lock ) ; port_subs_info_init ( & new_port -> c_src ) ; port_subs_info_init ( & new_port -> c_dest ) ; <START_BUG> num = port >= 0? port : 0 ; <END_BUG> mutex_lock ( & client -> ports_mutex ) ; write_lock_irqsave ( & client -> ports_lock, flags ) ; list_for_each_entry ( p, & client -> ports_list_head, list ) { if ( p -> addr. port > num ) break ; if ( port < 0 ) num = p -> addr. port + 1 ; } list_add_tail ( & new_port -> list, & p -> list ) ; client -> num_ports ++ ; new_port -> addr. port = num ;  write_unlock_irqrestore ( & client -> ports_lock, flags ) ; <START_BUG> <END_BUG> mutex_unlock ( & client -> ports_mutex ) ;  sprintf ( new_port -> name, "port-%d", num ) ; return new_port ; }

Fix:
<S2SV_ModStart> c_dest ) ; snd_use_lock_use ( & new_port -> use_lock ) ; <S2SV_ModStart> = num ; sprintf ( new_port -> name, "port-%d", num ) ; <S2SV_ModStart> client -> ports_mutex <S2SV_ModEnd> ) ; return
Buggy code:
 void lmp_print ( netdissect_options * ndo, register const u_char * pptr, register u_int len ) { const struct lmp_common_header * lmp_com_header ; const struct lmp_object_header * lmp_obj_header ; const u_char * tptr, * obj_tptr ; <START_BUG> int tlen, lmp_obj_len, lmp_obj_ctype, obj_tlen ; <END_BUG> int hexdump ;  int offset, subobj_type, subobj_len, total_subobj_len ; <START_BUG> int link_type ; union { float f ; uint32_t i ; } bw ; tptr = pptr ; lmp_com_header = ( const struct lmp_common_header * ) pptr ; ND_TCHECK ( * lmp_com_header ) ; if ( LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] )!= LMP_VERSION ) { ND_PRINT ( ( ndo, "LMP   version   %u   packet   not   supported", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ) ) ) ; return ; } if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "LMPv%u   %s   Message,   length:   %u", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ), tok2str ( lmp_msg_type_values, "unknown   (%u)", lmp_com_header -> msg_type ), len ) ) ; return ; } tlen = EXTRACT_16BITS ( lmp_com_header -> length ) ; ND_PRINT ( ( ndo, "\\n\\tLMPv%u,   msg-type:   %s,   Flags:   [%s],   length:   %u", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ), tok2str ( lmp_msg_type_values, "unknown,   type:   %u", lmp_com_header -> msg_type ), bittok2str ( lmp_<END_BUG>

Fix:
<S2SV_ModStart> * obj_tptr ; u_int <S2SV_ModEnd> tlen, lmp_obj_len <S2SV_ModStart> int hexdump ; u_int offset ; u_int <S2SV_ModEnd> link_type ; union <S2SV_ModStart> ) ) ; if ( tlen < sizeof ( const struct lmp_common_header ) ) { ND_PRINT ( ( ndo, " <S2SV_blank> (too <S2SV_blank> short)" ) ) ; return ; } if ( tlen > len ) { ND_PRINT ( ( ndo, " <S2SV_blank> (too <S2SV_blank> long)" ) ) ; tlen = len ; } <S2SV_ModStart> & 0x7f ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ) ) ; if ( lmp_obj_len < 4 ) { ND_PRINT ( ( ndo, " <S2SV_blank> (too <S2SV_blank> short)" ) ) ; return ; } if ( ( lmp_obj_len % 4 )!= 0 ) { ND_PRINT ( ( ndo, " <S2SV_blank> (not <S2SV_blank> a <S2SV_blank> multiple <S2SV_blank> of <S2SV_blank> 4)" ) ) ; return ; } <S2SV_ModStart> case LMP_CTYPE_RMT : if ( obj_tlen!= 4 ) { ND_PRINT ( ( ndo, " <S2SV_blank> (not <S2SV_blank> correct <S2SV_blank> for <S2SV_blank> object)" ) ) ; break ;
Buggy code:
 void vp8_init_mbmode_probs ( VP8_COMMON * x ) { <START_BUG> vpx_memcpy ( x -> fc. ymode_prob, vp8_ymode_prob, sizeof ( vp8_ymode_prob ) ) ; <END_BUG>  vpx_memcpy ( x -> fc. uv_mode_prob, vp8_uv_mode_prob, sizeof ( vp8_uv_mode_prob ) ) ; <START_BUG> <END_BUG> vpx_memcpy ( x -> fc. sub_mv_ref_prob, sub_mv_ref_prob, sizeof ( sub_mv_ref_prob ) ) ;  }

Fix:
<S2SV_ModStart> x ) { memcpy <S2SV_ModEnd> ( x -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( x -> <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( x ->
Buggy code:
 static struct rtable * icmp_route_lookup ( struct net * net, struct sk_buff * skb_in, const struct iphdr * iph, __be32 saddr, u8 tos, int type, int code, struct icmp_bxm * param ) { struct flowi4 fl4 = { <START_BUG>. daddr = ( param -> replyopts. srr? <END_BUG>  param -> replyopts. faddr : iph -> saddr ), <START_BUG>. saddr = saddr,. flowi4_tos = RT_TOS ( tos ),. flowi4_proto = IPPROTO_ICMP,. fl4_icmp_type = type,. fl4_icmp_code = code, } ; struct rtable * rt, * rt2 ; int err ; security_skb_classify_flow ( skb_in, flowi4_to_flowi ( & fl4 ) ) ; rt = __ip_route_output_key ( net, & fl4 ) ; if ( IS_ERR ( rt ) ) return rt ; rt2 = rt ; if (! fl4. saddr ) fl4. saddr = rt -> rt_src ; rt = ( struct rtable * ) xfrm_lookup ( net, & rt -> dst, flowi4_to_flowi ( & fl4 ), NULL, 0 ) ; if (! IS_ERR ( rt ) ) { if ( rt!= rt2 ) return rt ; } else if ( PTR_ERR ( rt ) == - EPERM ) { rt = NULL ; } else return rt ; err = xfrm_decode_session_reverse ( skb_in, flowi4_to_flowi ( & fl4 ), AF_INET ) ; if ( err ) goto relookup_failed ; if ( inet_addr_type ( net, fl4. saddr ) == RTN_LOCAL ) { rt2 = __ip_route_output_key ( net, & fl4 ) ; if ( IS_ERR ( rt2 ) ) err = PTR_ERR ( rt2 ) ; } else { struct flowi4 fl4_2 = { } ; unsigned long orefdst ; fl4_2. daddr = fl4. saddr ; rt2 = ip_route_output_key<END_BUG>

Fix:
<S2SV_ModStart> -> replyopts. opt. opt. <S2SV_ModStart> param -> replyopts. opt. opt
Buggy code:
 static int sc_pkcs15emu_esteid_init ( sc_pkcs15_card_t * p15card ) { sc_card_t * card = p15card -> card ; unsigned char buff [ 128 ] ; int r, i ; size_t field_length = 0, modulus_length = 0 ; sc_path_t tmppath ; set_string ( & p15card -> tokeninfo -> label, "ID-kaart" ) ; set_string ( & p15card -> tokeninfo -> manufacturer_id, "AS   Sertifitseerimiskeskus" ) ; sc_format_path ( "3f00eeee5044", & tmppath ) ; r = sc_select_file ( card, & tmppath, NULL ) ; SC_TEST_RET ( card -> ctx, SC_LOG_DEBUG_NORMAL, r, "select   esteid   PD   failed" ) ; r = sc_read_record ( card, SC_ESTEID_PD_DOCUMENT_NR, buff, sizeof ( buff ), SC_RECORD_BY_REC_NR ) ; SC_TEST_RET ( card -> ctx, SC_LOG_DEBUG_NORMAL, r, "read   document   number   failed" ) ; <START_BUG> buff [ r ] = '\\0' ; <END_BUG> set_string ( & p15card -> tokeninfo -> serial_number, ( const char * ) buff ) ; p15card -> tokeninfo -> flags = SC_PKCS15_TOKEN_PRN_GENERATION | SC_PKCS15_TOKEN_EID_COMPLIANT | SC_PKCS15_TOKEN_READONLY ; for ( i = 0 ; i < 2 ; i ++ ) { static const char * esteid_cert_names [ 2 ] = { "Isikutuvastus", "Allkirjastamine" } ; static char const * esteid_cert_paths [ 2 ] = { "3f00eeeeaace", "3f00eeeeddce" } ; static int esteid_cert_ids [ 2 ] = { 1, 2 } ; struct sc_pkcs15_cert_info cert_info ; struct sc_pkcs15_object cert_obj ; memset ( & cert_info, 0, sizeof ( cert_

Fix:
<S2SV_ModStart> ; buff [ MIN ( ( size_t ) r, ( sizeof buff ) - 1 ) <S2SV_ModEnd> ] = '\\0'