nus-yam/ex-repair huggingface dataset:
Buggy code:
 static char * get_next_file ( FILE * VFile, char * ptr ) { <START_BUG> char * ret ; <END_BUG> ret = fgets ( ptr, PATH_MAX, VFile ) ; if (! ret ) return NULL ;  if ( ptr [ strlen ( ptr ) - 1 ] == '\\n' ) <START_BUG> <END_BUG> ptr [ strlen ( ptr ) - 1 ] = '\\0' ;  return ret ; }

Fix:
<S2SV_ModStart> char * ret ; size_t len <S2SV_ModStart> return NULL ; len = <S2SV_ModEnd> strlen ( ptr <S2SV_ModStart> ( ptr ) ; if ( len > 0 && ptr [ len <S2SV_ModStart> ) ptr [ len <S2SV_ModEnd> - 1 ]
Buggy code:
 int init_pci ( struct vmctx * ctx ) { struct mem_range mr ; struct pci_vdev_ops * ops ; struct businfo * bi ; struct slotinfo * si ; struct funcinfo * fi ; size_t lowmem ; int bus, slot, func ; int success_cnt = 0 ; int error ; pci_emul_iobase = PCI_EMUL_IOBASE ; pci_emul_membase32 = vm_get_lowmem_limit ( ctx ) ; pci_emul_membase64 = PCI_EMUL_MEMBASE64 ; create_gsi_sharing_groups ( ) ; for ( bus = 0 ; bus < MAXBUSES ; bus ++ ) { bi = pci_businfo [ bus ] ; if ( bi == NULL ) continue ; bi -> iobase = pci_emul_iobase ; bi -> membase32 = pci_emul_membase32 ; bi -> membase64 = pci_emul_membase64 ; for ( slot = 0 ; slot < MAXSLOTS ; slot ++ ) { si = & bi -> slotinfo [ slot ] ; for ( func = 0 ; func < MAXFUNCS ; func ++ ) { fi = & si -> si_funcs [ func ] ; if ( fi -> fi_name == NULL ) continue ; ops = pci_emul_finddev ( fi -> fi_name ) ; <START_BUG> assert ( ops!= NULL ) ; <END_BUG> pr_notice ( "pci   init   %s\\r\\n", fi -> fi_name ) ; error = pci_emul_init ( ctx, ops, bus, slot, func, fi ) ; if ( error ) { pr_err ( "pci   %s   init   failed\\n", fi -> fi_name ) ; goto pci_emul_init_fail ; } success_cnt ++ ; } } pci_emul_iobase += BUSIO_ROUNDUP ; pci_emul_iobase = roundup2 ( pci_emul_iobase, BUSIO_ROUNDUP ) ; bi -> iolimit = pci_emul_iobase ; pci_emul_membase32 += BUSMEM_ROUNDUP ; pci

Fix:
<S2SV_ModStart> fi_name ) ; if (! ops ) { pr_warn ( "No <S2SV_blank> driver <S2SV_blank> for <S2SV_blank> device <S2SV_blank> [%s]\\n", fi -> fi_name ) ; continue ; } <S2SV_ModEnd> pr_notice ( "pci <S2SV_blank> init <S2SV_blank> %s\\r\\n" <S2SV_ModStart> mr ) ; if ( error!= 0 ) goto pci_emul_init_fail <S2SV_ModEnd> ; bzero ( <S2SV_ModStart> mr ) ; if ( error!= 0 ) goto pci_emul_init_fail <S2SV_ModEnd> ; bzero ( <S2SV_ModStart> mr ) ; if ( error!= 0 ) goto pci_emul_init_fail <S2SV_ModEnd> ; return 0 <S2SV_ModStart> fi_name ) ; if (! ops ) { pr_warn ( "No <S2SV_blank> driver <S2SV_blank> for <S2SV_blank> device <S2SV_blank> [%s]\\n", fi -> fi_name ) ; continue ; } <S2SV_ModEnd> pci_emul_deinit ( ctx
Buggy code:
 static void handle_PORT ( ctrl_t * ctrl, char * str ) { int a, b, c, d, e, f ; char addr [ INET_ADDRSTRLEN ] ; struct sockaddr_in sin ; if ( ctrl -> data_sd > 0 ) { uev_io_stop ( & ctrl -> data_watcher ) ; close ( ctrl -> data_sd ) ; ctrl -> data_sd = - 1 ; } sscanf ( str, "%d,%d,%d,%d,%d,%d", & a, & b, & c, & d, & e, & f ) ; <START_BUG> sprintf ( addr, "%d.%d.%d.%d", a, b, c, d ) ; <END_BUG> if (! inet_aton ( addr, & ( sin. sin_addr ) ) ) { ERR ( 0, "Invalid   address   \'%s\'   given   to   PORT   command", addr ) ; send_msg ( ctrl -> sd, "500   Illegal   PORT   command.\\r\\n" ) ; return ; } strlcpy ( ctrl -> data_address, addr, sizeof ( ctrl -> data_address ) ) ; ctrl -> data_port = e * 256 + f ; DBG ( "Client   PORT   command   accepted   for   %s:%d", ctrl -> data_address, ctrl -> data_port ) ; send_msg ( ctrl -> sd, "200   PORT   command   successful.\\r\\n" ) ; }

Fix:
<S2SV_ModStart> f ) ; snprintf ( addr, sizeof ( addr ) <S2SV_ModEnd>, "%d.%d.%d.%d",
Buggy code:
 PHP_FUNCTION ( imageaffine ) { zval * IM ; gdImagePtr src ; gdImagePtr dst ; gdRect rect ; gdRectPtr pRect = NULL ; zval * z_rect = NULL ; zval * z_affine ; zval * * tmp ; double affine [ 6 ] ; int i, nelems ; zval * * zval_affine_elem = NULL ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "ra|a", & IM, & z_affine, & z_rect ) == FAILURE ) { return ; } ZEND_FETCH_RESOURCE ( src, gdImagePtr, & IM, - 1, "Image", le_gd ) ; if ( ( nelems = zend_hash_num_elements ( Z_ARRVAL_P ( z_affine ) ) )!= 6 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Affine   array   must   have   six   elements" ) ; RETURN_FALSE ; } for ( i = 0 ; i < nelems ; i ++ ) { if ( zend_hash_index_find ( Z_ARRVAL_P ( z_affine ), i, ( void * * ) & zval_affine_elem ) == SUCCESS ) { switch ( Z_TYPE_PP ( zval_affine_elem ) ) { case IS_LONG : affine [ i ] = Z_LVAL_PP ( zval_affine_elem ) ; break ; case IS_DOUBLE : affine [ i ] = Z_DVAL_PP ( zval_affine_elem ) ; break ; case IS_STRING : <START_BUG> convert_to_double_ex ( zval_affine_elem ) ; <END_BUG>  affine [ i ] = Z_DVAL_PP ( zval_affine_elem ) ; <START_BUG> break ; default : php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Invalid   type   for   element   %i", i ) ; RETURN_FALSE ; } } } if ( z_rect!= NULL ) { if ( zend_hash_find ( HASH_OF ( z_rect ), "x", sizeof ( "x" ), ( void<END_BUG>

Fix:
<S2SV_ModStart> case IS_STRING : { zval dval ; dval = * * zval_affine_elem ; zval_copy_ctor ( & dval ) ; convert_to_double ( & dval <S2SV_ModEnd> ) ; affine <S2SV_ModStart> i ] = Z_DVAL ( dval ) ; } <S2SV_ModEnd> break ; default <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_LONG ) { zval lval ; lval = * * tmp ; zval_copy_ctor ( & lval ) ; convert_to_long ( & lval <S2SV_ModEnd> ) ; rect <S2SV_ModStart>. x = Z_LVAL ( lval ) ; } else { rect. x = <S2SV_ModStart> ) ; } } <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_LONG ) { zval lval ; lval = * * tmp ; zval_copy_ctor ( & lval ) ; convert_to_long ( & lval <S2SV_ModEnd> ) ; rect <S2SV_ModStart>. y = Z_LVAL ( lval ) ; } else { rect. y = <S2SV_ModStart> ) ; } } <S2SV_ModStart> FAILURE ) { if ( Z_TYPE_PP ( tmp )!= IS_LONG ) { zval
Buggy code:
 static Image * ReadTXTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char colorspace [ MaxTextExtent ], text [ MaxTextExtent ] ; Image * image ; IndexPacket * indexes ; long x_offset, y_offset ; MagickBooleanType status ; MagickPixelPacket pixel ; QuantumAny range ; register ssize_t i, x ; register PixelPacket * q ; ssize_t count, type, y ; unsigned long depth, height, max_value, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( text, 0, sizeof ( text ) ) ; ( void ) ReadBlobString ( image, text ) ; if ( LocaleNCompare ( ( char * ) text, MagickID, strlen ( MagickID ) )!= 0 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { width = 0 ; height = 0 ; max_value = 0 ; * colorspace = '\\0' ; count = ( ssize_t ) sscanf ( text + 32, "%lu,%lu,%lu,%s", & width, & height, & max_value, colorspace ) ; if ( ( count!= 4 ) || ( width == 0 ) || ( height == 0 ) || ( max_value == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; image -> columns = width ; image -> rows = height ; <START_BUG> for ( depth = 1 ; ( GetQuantumRange ( depth ) + 1 ) < max_value ; depth ++ ) <END_BUG>  if ( depth >= 64 ) <START_BUG> break ; image -> depth = depth ; status = SetImageExtent ( image, image -><END_BUG>

Fix:
<S2SV_ModStart> = height ; if ( ( max_value == 0 ) || ( max_value > 4294967295 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; <S2SV_ModStart> depth ++ ) <S2SV_ModEnd> ; image ->
Buggy code:
 static int tga_readheader ( FILE * fp, unsigned int * bits_per_pixel, unsigned int * width, unsigned int * height, int * flip_image ) { int palette_size ; unsigned char tga [ TGA_HEADER_SIZE ] ; unsigned char id_len, image_type ; unsigned char pixel_depth, image_desc ; unsigned short cmap_len, cmap_entry_size ; unsigned short image_w, image_h ; if (! bits_per_pixel ||! width ||! height ||! flip_image ) { return 0 ; } if ( fread ( tga, TGA_HEADER_SIZE, 1, fp )!= 1 ) { fprintf ( stderr, "\\nError:   fread   return   a   number   of   element   different   from   the   expected.\\n" ) ; return 0 ; } id_len = tga [ 0 ] ; image_type = tga [ 2 ] ; <START_BUG> cmap_len = get_ushort ( & tga [ 5 ] ) ; <END_BUG> cmap_entry_size = tga [ 7 ] ; # if 0  x_origin = get_ushort ( & tga [ 8 ] ) ; <START_BUG> <END_BUG> y_origin = get_ushort ( & tga [ 10 ] ) ;  # endif <START_BUG> image_w = get_ushort ( & tga [ 12 ] ) ; <END_BUG>  image_h = get_ushort ( & tga [ 14 ] ) ; <START_BUG> pixel_depth = tga [ 16 ] ; image_desc = tga [ 17 ] ; * bits_per_pixel = ( unsigned int ) pixel_depth ; * width = ( unsigned int ) image_w ; * height = ( unsigned int ) image_h ; if ( id_len ) { unsigned char * id = ( unsigned char * ) malloc ( id_len ) ; if ( id == 0 ) { fprintf ( stderr, "tga_readheader:   memory   out\\n" ) ; return 0 ; } if (! fread ( id, id_len, 1, fp ) ) { fprintf ( stderr, "\\nError:   fread   return   a   number   of   element   different   from   the   expected.\\n" ) ; free ( id ) ; return 0 ; } free ( id ) ; } if ( image_type ><END_BUG>

Fix:
<S2SV_ModStart> ; cmap_len = get_tga_ushort <S2SV_ModEnd> ( & tga <S2SV_ModStart> 0 x_origin = get_tga_ushort <S2SV_ModEnd> ( & tga <S2SV_ModStart> ; y_origin = get_tga_ushort <S2SV_ModEnd> ( & tga <S2SV_ModStart> endif image_w = get_tga_ushort <S2SV_ModEnd> ( & tga <S2SV_ModStart> ; image_h = get_tga_ushort <S2SV_ModEnd> ( & tga
Buggy code:
 char * _single_string_alloc_and_copy ( LPCWSTR in ) { char * chr ; int len = 0 ; if (! in ) { <START_BUG> return in ; <END_BUG> } while ( in [ len ]!= 0 ) { len ++ ; } chr = malloc ( len + 1 ) ; len = 0 ; while ( in [ len ]!= 0 ) { chr [ len ] = 0xFF & in [ len ] ; len ++ ; } chr [ len ++ ] = '\\0' ; return chr ; }

Fix:
<S2SV_ModStart> ) { return NULL <S2SV_ModEnd> ; } while
Buggy code:
 static int pci_emul_dinit ( struct vmctx * ctx, struct pci_vdev * dev, char * opts ) { <START_BUG> int error ; <END_BUG> struct pci_emul_dummy * dummy ; dummy = calloc ( 1, sizeof ( struct pci_emul_dummy ) ) ; dev -> arg = dummy ; pci_set_cfgdata16 ( dev, PCIR_DEVICE, 0x0001 ) ; pci_set_cfgdata16 ( dev, PCIR_VENDOR, 0x10DD ) ; pci_set_cfgdata8 ( dev, PCIR_CLASS, 0x02 ) ;  error = pci_emul_add_msicap ( dev, PCI_EMUL_MSI_MSGS ) ; <START_BUG> assert ( error == 0 ) ; <END_BUG> error = pci_emul_alloc_bar ( dev, 0, PCIBAR_IO, DIOSZ ) ;  assert ( error == 0 ) ; <START_BUG> error = pci_emul_alloc_bar ( dev, 1, PCIBAR_MEM32, DMEMSZ ) ; <END_BUG> assert ( error == 0 ) ; error = pci_emul_alloc_bar ( dev, 2, PCIBAR_MEM32, DMEMSZ ) ;  assert ( error == 0 ) ; <START_BUG> return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> opts ) { <S2SV_ModEnd> struct pci_emul_dummy * <S2SV_ModStart> 0x02 ) ; return <S2SV_ModEnd> pci_emul_add_msicap ( dev <S2SV_ModStart>, PCI_EMUL_MSI_MSGS ) || <S2SV_ModEnd> pci_emul_alloc_bar ( dev <S2SV_ModStart>, DIOSZ ) || <S2SV_ModEnd> pci_emul_alloc_bar ( dev <S2SV_ModStart>, DMEMSZ ) || <S2SV_ModEnd> pci_emul_alloc_bar ( dev <S2SV_ModStart> DMEMSZ ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static future_t * init ( void ) { pthread_mutex_init ( & lock, NULL ) ; config = config_new ( CONFIG_FILE_PATH ) ; if (! config ) { LOG_WARN ( "%s   unable   to   load   config   file;   attempting   to   transcode   legacy   file.", __func__ ) ; config = btif_config_transcode ( LEGACY_CONFIG_FILE_PATH ) ; if (! config ) { LOG_WARN ( "%s   unable   to   transcode   legacy   file,   starting   unconfigured.", __func__ ) ; config = config_new_empty ( ) ; if (! config ) { LOG_ERROR ( "%s   unable   to   allocate   a   config   object.", __func__ ) ; goto error ; } } if ( config_save ( config, CONFIG_FILE_PATH ) ) unlink ( LEGACY_CONFIG_FILE_PATH ) ; } btif_config_remove_unpaired ( config ) ; <START_BUG> alarm_timer = alarm_new ( ) ; <END_BUG> if (! alarm_timer ) { LOG_ERROR ( "%s   unable   to   create   alarm.", __func__ ) ; goto error ; } return future_new_immediate ( FUTURE_SUCCESS ) ; error : ; alarm_free ( alarm_timer ) ; config_free ( config ) ; pthread_mutex_destroy ( & lock ) ; alarm_timer = NULL ; config = NULL ; return future_new_immediate ( FUTURE_FAIL ) ; }

Fix:
<S2SV_ModStart> config ) ; if (! is_restricted_mode ( ) ) btif_config_remove_restricted ( config ) ;
Buggy code:
 void vp8_dequant_idct_add_y_block_c ( short * q, short * dq, unsigned char * dst, int stride, char * eobs ) { int i, j ; for ( i = 0 ; i < 4 ; i ++ ) { for ( j = 0 ; j < 4 ; j ++ ) { if ( * eobs ++ > 1 ) vp8_dequant_idct_add_c ( q, dq, dst, stride ) ; else { vp8_dc_only_idct_add_c ( q [ 0 ] * dq [ 0 ], dst, stride, dst, stride ) ; <START_BUG> vpx_memset ( q, 0, 2 * sizeof ( q [ 0 ] ) ) ; <END_BUG> } q += 16 ; dst += 4 ; } dst += 4 * stride - 16 ; } }

Fix:
<S2SV_ModStart> stride ) ; memset <S2SV_ModEnd> ( q,
Buggy code:
 int ssh_packet_get_state ( struct ssh * ssh, struct sshbuf * m ) { struct session_state * state = ssh -> state ; u_char * p ; size_t slen, rlen ; int r, ssh1cipher ; if (! compat20 ) { ssh1cipher = cipher_ctx_get_number ( state -> receive_context ) ; slen = cipher_get_keyiv_len ( state -> send_context ) ; rlen = cipher_get_keyiv_len ( state -> receive_context ) ; if ( ( r = sshbuf_put_u32 ( m, state -> remote_protocol_flags ) )!= 0 || ( r = sshbuf_put_u32 ( m, ssh1cipher ) )!= 0 || ( r = sshbuf_put_string ( m, state -> ssh1_key, state -> ssh1_keylen ) )!= 0 || ( r = sshbuf_put_u32 ( m, slen ) )!= 0 || ( r = sshbuf_reserve ( m, slen, & p ) )!= 0 || ( r = cipher_get_keyiv ( state -> send_context, p, slen ) )!= 0 || ( r = sshbuf_put_u32 ( m, rlen ) )!= 0 || ( r = sshbuf_reserve ( m, rlen, & p ) )!= 0 || ( r = cipher_get_keyiv ( state -> receive_context, p, rlen ) )!= 0 ) return r ; } else { if ( ( r = kex_to_blob ( m, ssh -> kex ) )!= 0 || ( r = newkeys_to_blob ( m, ssh, MODE_OUT ) )!= 0 || ( r = newkeys_to_blob ( m, ssh, MODE_IN ) )!= 0 || ( r = sshbuf_put_u64 ( m, state -> rekey_limit ) )!= 0 || ( r = sshbuf_put_u32 ( m, state -> rekey_interval ) )!= 0 || ( r = sshbuf_put_u32 ( m, state -> p_send. seqnr ) )!= 0 || ( r = sshbuf_put_u64 ( m, state -> p_send. blocks ) )!= 0 || ( r = sshbuf

Fix:
<S2SV_ModStart> ( r = <S2SV_ModEnd> sshbuf_put_stringb ( m
Buggy code:
 php_stream * php_stream_url_wrap_http_ex ( php_stream_wrapper * wrapper, const char * path, const char * mode, int options, char * * opened_path, php_stream_context * context, int redirect_max, int flags STREAMS_DC TSRMLS_DC ) { php_stream * stream = NULL ; php_url * resource = NULL ; int use_ssl ; int use_proxy = 0 ; char * scratch = NULL ; char * tmp = NULL ; char * ua_str = NULL ; zval * * ua_zval = NULL, * * tmpzval = NULL, * ssl_proxy_peer_name = NULL ; int scratch_len = 0 ; int body = 0 ; char location [ HTTP_HEADER_BLOCK_SIZE ] ; zval * response_header = NULL ; int reqok = 0 ; char * http_header_line = NULL ; char tmp_line [ 128 ] ; size_t chunk_size = 0, file_size = 0 ; int eol_detect = 0 ; char * transport_string, * errstr = NULL ; int transport_len, have_header = 0, request_fulluri = 0, ignore_errors = 0 ; char * protocol_version = NULL ; int protocol_version_len = 3 ; struct timeval timeout ; char * user_headers = NULL ; int header_init = ( ( flags & HTTP_WRAPPER_HEADER_INIT )!= 0 ) ; int redirected = ( ( flags & HTTP_WRAPPER_REDIRECTED )!= 0 ) ; int follow_location = 1 ; php_stream_filter * transfer_encoding = NULL ; int response_code ; tmp_line [ 0 ] = '\\0' ; if ( redirect_max < 1 ) { php_stream_wrapper_log_error ( wrapper, options TSRMLS_CC, "Redirection   limit   reached,   aborting" ) ; return NULL ; } resource = php_url_parse ( path ) ; if ( resource == NULL ) { return NULL ; } if ( strncasecmp ( resource -> scheme, "http", sizeof ( "http" ) ) && strncasecmp ( resource -> scheme, "https", sizeof ( "https" ) ) ) { if (! context || php_stream_context_get_option ( context, wrapper -> wops -> label,

Fix:
<S2SV_ModStart> } if ( tmp_line_len >= 1 && <S2SV_ModStart> ; if ( tmp_line_len >= 1 && <S2SV_ModStart> ; } } \\\n} <S2SV_ModEnd> if ( strncasecmp
Buggy code:
 static void finish_object ( struct object * obj, <START_BUG> struct strbuf * path, const char * name, <END_BUG> void * cb_data ) { struct rev_list_info * info = cb_data ; if ( obj -> type == OBJ_BLOB &&! has_object_file ( & obj -> oid ) ) die ( "missing   blob   object   \'%s\'", oid_to_hex ( & obj -> oid ) ) ; if ( info -> revs -> verify_objects &&! obj -> parsed && obj -> type!= OBJ_COMMIT ) parse_object ( obj -> oid. hash ) ; }

Fix:
<S2SV_ModStart> * obj, <S2SV_ModEnd> const char *
Buggy code:
 <START_BUG> static struct ip_options * tcp_v4_save_options ( struct sock * sk, <END_BUG> struct sk_buff * skb ) {  struct ip_options * opt = & ( IPCB ( skb ) -> opt ) ; <START_BUG> <END_BUG> struct ip_options * dopt = NULL ;  if ( opt && opt -> optlen ) { <START_BUG> int opt_size = optlength ( opt ) ; <END_BUG> dopt = kmalloc ( opt_size, GFP_ATOMIC ) ; if ( dopt ) {  if ( ip_options_echo ( dopt, skb ) ) { <START_BUG> kfree ( dopt ) ; dopt = NULL ; } } } return dopt ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> static struct ip_options_rcu <S2SV_ModEnd> * tcp_v4_save_options ( <S2SV_ModStart> skb ) { const <S2SV_ModStart> ) ; struct ip_options_rcu <S2SV_ModEnd> * dopt = <S2SV_ModStart> int opt_size = sizeof ( * dopt ) + opt -> optlen <S2SV_ModEnd> ; dopt = <S2SV_ModStart> ( ip_options_echo ( & dopt -> opt <S2SV_ModEnd>, skb )
Buggy code:
 static Image * ReadMATImageV4 ( const ImageInfo * image_info, Image * image, ExceptionInfo * exception ) { typedef struct { unsigned char Type [ 4 ] ; unsigned int nRows ; unsigned int nCols ; unsigned int imagf ; unsigned int nameLen ; } MAT4_HDR ; long ldblk ; EndianType endian ; Image * rotate_image ; MagickBooleanType status ; MAT4_HDR HDR ; QuantumInfo * quantum_info ; QuantumFormatType format_type ; register ssize_t i ; ssize_t count, y ; unsigned char * pixels ; unsigned int depth ; <START_BUG> ( void ) SeekBlob ( image, 0, SEEK_SET ) ; <END_BUG> while ( EOFBlob ( image )!= MagickFalse ) { ldblk = ReadBlobLSBLong ( image ) ; if ( ( ldblk > 9999 ) || ( ldblk < 0 ) ) break ; HDR. Type [ 3 ] = ldblk % 10 ; ldblk //= 10 ; HDR. Type [ 2 ] = ldblk % 10 ; ldblk //= 10 ; HDR. Type [ 1 ] = ldblk % 10 ; ldblk //= 10 ; HDR. Type [ 0 ] = ldblk ; if ( HDR. Type [ 3 ]!= 0 ) break ; if ( HDR. Type [ 2 ]!= 0 ) break ; if ( HDR. Type [ 0 ] == 0 ) { HDR. nRows = ReadBlobLSBLong ( image ) ; HDR. nCols = ReadBlobLSBLong ( image ) ; HDR. imagf = ReadBlobLSBLong ( image ) ; HDR. nameLen = ReadBlobLSBLong ( image ) ; endian = LSBEndian ; } else { HDR. nRows = ReadBlobMSBLong ( image ) ; HDR. nCols = ReadBlobMSBLong ( image ) ; HDR. imagf = ReadBlobMSBLong ( image ) ; HDR. nameLen = ReadBlobMSBLong ( image ) ; endian = MSBEndian ; } if ( ( HDR. imagf!= 0 ) && ( HDR. imagf!= 1 ) ) break ; if ( HDR. nameLen > 0xFFFF ) return ( ( Image * ) NULL

Fix:
<S2SV_ModStart> int depth ; quantum_info = ( QuantumInfo * ) NULL ; <S2SV_ModStart> ) ; } if ( quantum_info!= ( QuantumInfo * ) NULL )
Buggy code:
 char * * glob_vector ( pat, dir, flags ) char * pat ; char * dir ; int flags ; { DIR * d ; register struct dirent * dp ; struct globval * lastlink, * e, * dirlist ; register struct globval * nextlink ; register char * nextname, * npat, * subdir ; unsigned int count ; int lose, skip, ndirs, isdir, sdlen, add_current, patlen ; register char * * name_vector ; register unsigned int i ; int mflags ; int pflags ; <START_BUG> int nalloca ; <END_BUG> struct globval * firstmalloc, * tmplink ; char * convfn ; lastlink = 0 ; count = lose = skip = add_current = 0 ; firstmalloc = 0 ; nalloca = 0 ; name_vector = NULL ; if ( pat == 0 || * pat == '\\0' ) { if ( glob_testdir ( dir, 0 ) < 0 ) return ( ( char * * ) & glob_error_return ) ; nextlink = ( struct globval * ) alloca ( sizeof ( struct globval ) ) ; if ( nextlink == NULL ) return ( ( char * * ) NULL ) ; nextlink -> next = ( struct globval * ) 0 ; nextname = ( char * ) malloc ( 1 ) ; if ( nextname == 0 ) lose = 1 ; else { lastlink = nextlink ; nextlink -> name = nextname ; nextname [ 0 ] = '\\0' ; count = 1 ; } skip = 1 ; } patlen = ( pat && * pat )? strlen ( pat ) : 0 ;  if ( skip == 0 && glob_pattern_p ( pat ) == 0 ) <START_BUG> { int dirlen ; struct stat finfo ; if ( glob_testdir ( dir, 0 ) < 0 ) return ( ( char * * ) & glob_error_return ) ; dirlen = strlen ( dir ) ; nextname = ( char * ) malloc ( dirlen + patlen + 2 ) ; npat = ( char * ) malloc ( patlen + 1 ) ; if ( nextname == 0 || npat == 0 ) { FREE ( nextname ) ; FREE ( npat ) ; lose = 1 ; } else { strcpy ( npat, pat ) ; dequote_pathname ( npat ) ; strcpy ( nextname,<END_BUG>

Fix:
<S2SV_ModStart> pflags ; int hasglob ; int <S2SV_ModStart> : 0 ; hasglob = 0 ; <S2SV_ModStart> == 0 && ( hasglob = <S2SV_ModStart> ( pat ) ) == 0 || hasglob == 2 <S2SV_ModEnd> ) { int
Buggy code:
 STATIC int xfs_attr3_leaf_add_work ( struct xfs_buf * bp, struct xfs_attr3_icleaf_hdr * ichdr, struct xfs_da_args * args, int mapindex ) { struct xfs_attr_leafblock * leaf ; struct xfs_attr_leaf_entry * entry ; struct xfs_attr_leaf_name_local * name_loc ; struct xfs_attr_leaf_name_remote * name_rmt ; struct xfs_mount * mp ; int tmp ; int i ; trace_xfs_attr_leaf_add_work ( args ) ; leaf = bp -> b_addr ; ASSERT ( mapindex >= 0 && mapindex < XFS_ATTR_LEAF_MAPSIZE ) ; ASSERT ( args -> index >= 0 && args -> index <= ichdr -> count ) ; entry = & xfs_attr3_leaf_entryp ( leaf ) [ args -> index ] ; if ( args -> index < ichdr -> count ) { tmp = ichdr -> count - args -> index ; tmp *= sizeof ( xfs_attr_leaf_entry_t ) ; memmove ( entry + 1, entry, tmp ) ; xfs_trans_log_buf ( args -> trans, bp, XFS_DA_LOGRANGE ( leaf, entry, tmp + sizeof ( * entry ) ) ) ; } ichdr -> count ++ ; mp = args -> trans -> t_mountp ; ASSERT ( ichdr -> freemap [ mapindex ]. base < XFS_LBSIZE ( mp ) ) ; ASSERT ( ( ichdr -> freemap [ mapindex ]. base & 0x3 ) == 0 ) ; ASSERT ( ichdr -> freemap [ mapindex ]. size >= xfs_attr_leaf_newentsize ( args -> namelen, args -> valuelen, mp -> m_sb. sb_blocksize, NULL ) ) ; ASSERT ( ichdr -> freemap [ mapindex ]. size < XFS_LBSIZE ( mp ) ) ; ASSERT ( ( ichdr -> freemap [ mapindex ]. size & 0x3 ) == 0 ) ; ichdr -> freemap [ mapindex ]. size -= xfs_attr_leaf_newentsize ( args -> namelen

Fix:
<S2SV_ModStart> valuelen ) ; args -> rmtvaluelen = args -> valuelen ;
Buggy code:
 static int mount_autodev ( const char * name, const struct lxc_rootfs * rootfs, const char * lxcpath ) { int ret ; size_t clen ; char * path ; INFO ( "Mounting   container   //dev" ) ; clen = ( rootfs -> path? strlen ( rootfs -> mount ) : 0 ) + 9 ; path = alloca ( clen ) ; ret = snprintf ( path, clen, "%s//dev", rootfs -> path? rootfs -> mount : "" ) ; if ( ret < 0 || ret >= clen ) return - 1 ; if (! dir_exists ( path ) ) { WARN ( "No   //dev   in   container." ) ; WARN ( "Proceeding   without   autodev   setup" ) ; return 0 ; } <START_BUG> if ( mount ( "none", path, "tmpfs", 0, "size=100000,mode=755" ) ) { <END_BUG> SYSERROR ( "Failed   mounting   tmpfs   onto   %s\\n", path ) ; return false ; } INFO ( "Mounted   tmpfs   onto   %s", path ) ; ret = snprintf ( path, clen, "%s//dev//pts", rootfs -> path? rootfs -> mount : "" ) ; if ( ret < 0 || ret >= clen ) return - 1 ; if (! dir_exists ( path ) ) { ret = mkdir ( path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH ) ; if ( ret ) { SYSERROR ( "Failed   to   create   //dev//pts   in   container" ) ; return - 1 ; } } INFO ( "Mounted   container   //dev" ) ; return 0 ; }

Fix:
<S2SV_ModStart> } if ( safe_mount <S2SV_ModEnd> ( "none", <S2SV_ModStart> 0, "size=100000,mode=755", rootfs -> path? rootfs -> mount : NULL
Buggy code:
 static void accumulate_frame_motion_stats ( <START_BUG> FIRSTPASS_STATS * this_frame, <END_BUG>  double * this_frame_mv_in_out, <START_BUG> double * mv_in_out_accumulator, double * abs_mv_in_out_accumulator, double * mv_ratio_accumulator ) { <END_BUG> double motion_pct ;  motion_pct = this_frame -> pcnt_motion ; <START_BUG> * this_frame_mv_in_out = this_frame -> mv_in_out_count * motion_pct ; <END_BUG>  * mv_in_out_accumulator += this_frame -> mv_in_out_count * motion_pct ; <START_BUG> <END_BUG> * abs_mv_in_out_accumulator += fabs ( this_frame -> mv_in_out_count * motion_pct ) ;  <START_BUG> if ( motion_pct > 0.05 ) { <END_BUG>  const double this_frame_mvr_ratio = fabs ( this_frame -> mvr_abs ) // <START_BUG> <END_BUG> DOUBLE_DIVIDE_CHECK ( fabs ( this_frame -> MVr ) ) ;  <START_BUG> const double this_frame_mvc_ratio = fabs ( this_frame -> mvc_abs ) // <END_BUG>  DOUBLE_DIVIDE_CHECK ( fabs ( this_frame -> MVc ) ) ; <START_BUG> <END_BUG> * mv_ratio_accumulator += ( this_frame_mvr_ratio < this_frame -> mvr_abs )  <START_BUG>? ( this_frame_mvr_ratio * motion_pct ) <END_BUG> : this_frame -> mvr_abs * motion_pct ;  * mv_ratio_accumulator += ( this_frame_mvc_ratio < this_frame -> mvc_abs ) <START_BUG> <END_BUG>? ( this_frame_mvc_ratio * motion_pct )  : this_frame -> mvc_abs * motion_pct ; } }

Fix:
<S2SV_ModStart> void accumulate_frame_motion_stats ( const FIRSTPASS_STATS * stats <S2SV_ModEnd>, double * <S2SV_ModStart>, double * mv_in_out <S2SV_ModEnd>, double * <S2SV_ModStart> mv_ratio_accumulator ) { const double pct = stats <S2SV_ModEnd> -> pcnt_motion ; <S2SV_ModStart> pcnt_motion ; * mv_in_out = stats <S2SV_ModEnd> -> mv_in_out_count * <S2SV_ModStart> -> mv_in_out_count * pct <S2SV_ModEnd> ; * mv_in_out_accumulator <S2SV_ModStart> * mv_in_out_accumulator += * mv_in_out <S2SV_ModEnd> ; * abs_mv_in_out_accumulator <S2SV_ModStart> += fabs ( * mv_in_out <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; if ( pct <S2SV_ModEnd> > 0.05 ) <S2SV_ModStart> { const double mvr_ratio <S2SV_ModEnd> = fabs ( <S2SV_ModStart> = fabs ( stats <S2SV_ModEnd> -> mvr_abs ) <S2SV_ModStart> ( fabs ( stats <S2SV_ModEnd> -> MVr ) <S2SV_ModStart> ; const double mvc_ratio <S2SV_ModEnd> = fabs ( <S2SV_ModStart> = fabs ( stats <S2SV_ModEnd> -> mvc_abs ) <S2SV_ModStart> ( fabs ( stats <S2SV_ModEnd> -> MVc ) <S2SV_ModStart> * mv_ratio_accumulator += pct * ( mvr_ratio < stats -> mvr_abs? mvr
Buggy code:
 static void xen_irq_init ( unsigned irq ) { struct irq_info * info ; # ifdef CONFIG_SMP cpumask_copy ( irq_get_affinity_mask ( irq ), cpumask_of ( 0 ) ) ; # endif info = kzalloc ( sizeof ( * info ), GFP_KERNEL ) ; if ( info == NULL ) panic ( "Unable   to   allocate   metadata   for   IRQ%d\\n", irq ) ; info -> type = IRQT_UNBOUND ; info -> refcnt = - 1 ; set_info_for_irq ( irq, info ) ; <START_BUG> list_add_tail ( & info -> list, & xen_irq_list_head ) ; <END_BUG> }

Fix:
<S2SV_ModStart> info ) ; INIT_LIST_HEAD ( & info -> eoi_list ) ;
Buggy code:
 void recovery_cipher_finalize ( void ) <START_BUG> { <END_BUG> static char CONFIDENTIAL new_mnemonic [ MNEMONIC_BUF ] = "" ; static char CONFIDENTIAL temp_word [ CURRENT_WORD_BUF ] ; volatile bool auto_completed = true ; char * tok = strtok ( mnemonic, "   " ) ; while ( tok ) { strlcpy ( temp_word, tok, CURRENT_WORD_BUF ) ; auto_completed &= attempt_auto_complete ( temp_word ) ; strlcat ( new_mnemonic, temp_word, MNEMONIC_BUF ) ; strlcat ( new_mnemonic, "   ", MNEMONIC_BUF ) ; tok = strtok ( NULL, "   " ) ; } memzero ( temp_word, sizeof ( temp_word ) ) ; if (! auto_completed &&! enforce_wordlist ) { if (! dry_run ) { storage_reset ( ) ; } fsm_sendFailure ( FailureType_Failure_SyntaxError, "Words   were   not   entered   correctly.   Make   sure   you   are   using   the   substition   cipher." ) ; awaiting_character = false ; layoutHome ( ) ; return ; }  new_mnemonic [ strlen ( new_mnemonic ) - 1 ] = '\\0' ; <START_BUG> if (! dry_run && (! enforce_wordlist || mnemonic_check ( new_mnemonic ) ) ) { storage_setMnemonic ( new_mnemonic ) ; memzero ( new_mnemonic, sizeof ( new_mnemonic ) ) ; if (! enforce_wordlist ) { storage_setImported ( true ) ; } storage_commit ( ) ; fsm_sendSuccess ( "Device   recovered" ) ; } else if ( dry_run ) { bool match = storage_isInitialized ( ) && storage_containsMnemonic ( new_mnemonic ) ; if ( match ) { review ( ButtonRequestType_ButtonRequest_Other, "Recovery   Dry   Run", "The   seed   is   valid   and   MATCHES   the   one   in   the   device." ) ; fsm_sendSuccess ( "The   seed   is   valid   and   matches   the   one   in   the   device." ) ; }<END_BUG>

Fix:
<S2SV_ModStart> void ) { if (! recovery_started ) { recovery_abort ( ) ; fsm_sendFailure ( FailureType_Failure_UnexpectedMessage, "Not <S2SV_blank> in <S2SV_blank> Recovery <S2SV_blank> mode" ) ; layoutHome ( ) ; return ; } <S2SV_ModStart> } new_mnemonic [ MAX ( 0u, strnlen ( new_mnemonic, sizeof ( new_mnemonic ) <S2SV_ModEnd> ) - 1 <S2SV_ModStart> ) - 1 )
Buggy code:
 static Image * ReadSUNImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define RMT_EQUAL_RGB 1 # define RMT_NONE 0 # define RMT_RAW 2 # define RT_STANDARD 1 # define RT_ENCODED 2 # define RT_FORMAT_RGB 3 typedef struct _SUNInfo { unsigned int magic, width, height, depth, length, type, maptype, maplength ; } SUNInfo ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bytes_per_line, extent, <START_BUG> height, <END_BUG> length ; ssize_t count, y ; SUNInfo sun_info ; unsigned char * sun_data, * sun_pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & sun_info, 0, sizeof ( sun_info ) ) ; sun_info. magic = ReadBlobMSBLong ( image ) ; do { if ( sun_info. magic!= 0x59a66a95 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; sun_info. width = ReadBlobMSBLong ( image ) ; sun_info. height = ReadBlobMSBLong ( image ) ; sun_info. depth = ReadBlobMSBLong ( image ) ; sun_info. length = ReadBlobMSBLong ( image ) ; sun_info. type = ReadBlobMSBLong ( image ) ; sun_info. maptype = ReadBlobMSBLong ( image ) ; sun

Fix:
<S2SV_ModStart> extent, height <S2SV_ModEnd> ; ssize_t count <S2SV_ModStart> PseudoClass ) { for ( y = 0 ; y < ( ssize_t ) image -> rows ; y ++ ) { q = QueueAuthenticPixels ( image, 0, y, <S2SV_ModEnd> image -> columns <S2SV_ModStart> image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) break ; for ( x = 0 ; x < ( ssize_t ) <S2SV_ModEnd> image -> columns <S2SV_ModStart> image -> columns ; x ++ ) { SetPixelIndex ( image, * p ++, q ) ; q += GetPixelChannels ( image ) ; } if ( ( <S2SV_ModEnd> image -> columns <S2SV_ModStart> % 2 )!= 0 ) p ++ ; if ( SyncAuthenticPixels ( image, exception ) == MagickFalse ) break ; if ( image -> previous == ( Image * ) NULL ) { status = SetImageProgress ( image, LoadImageTag, ( MagickOffsetType ) y, image -> rows ) ; if ( status == MagickFalse ) break ; } } } else { size_t bytes_per_pixel ; bytes_per_pixel = 3 ; if ( image -> alpha_trait!= UndefinedPixelTrait ) bytes_per_pixel ++ ; if
Buggy code:
 static int Downmix_Command ( effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, void * pCmdData, uint32_t * replySize, void * pReplyData ) { downmix_module_t * pDwmModule = ( downmix_module_t * ) self ; downmix_object_t * pDownmixer ; if ( pDwmModule == NULL || pDwmModule -> context. state == DOWNMIX_STATE_UNINITIALIZED ) { return - EINVAL ; } pDownmixer = ( downmix_object_t * ) & pDwmModule -> context ; ALOGV ( "Downmix_Command   command   %" PRIu32 "   cmdSize   %" PRIu32, cmdCode, cmdSize ) ; switch ( cmdCode ) { case EFFECT_CMD_INIT : if ( pReplyData == NULL || replySize == NULL || * replySize!= sizeof ( int ) ) { return - EINVAL ; } * ( int * ) pReplyData = Downmix_Init ( pDwmModule ) ; break ; case EFFECT_CMD_SET_CONFIG : if ( pCmdData == NULL || cmdSize!= sizeof ( effect_config_t ) || pReplyData == NULL || replySize == NULL || * replySize!= sizeof ( int ) ) { return - EINVAL ; } * ( int * ) pReplyData = Downmix_Configure ( pDwmModule, ( effect_config_t * ) pCmdData, false ) ; break ; case EFFECT_CMD_RESET : Downmix_Reset ( pDownmixer, false ) ; break ; case EFFECT_CMD_GET_PARAM : ALOGV ( "Downmix_Command   EFFECT_CMD_GET_PARAM   pCmdData   %p,   *replySize   %" PRIu32 ",   pReplyData:   %p", pCmdData, * replySize, pReplyData ) ; if ( pCmdData == NULL || cmdSize < ( int ) ( sizeof ( effect_param_t ) + sizeof ( int32_t ) ) || pReplyData == NULL || replySize == NULL || * replySize < ( int ) sizeof ( effect_param_t ) + 2 * sizeof ( int32_t )

Fix:
<S2SV_ModStart> ) pCmdData ; if ( cmd -> psize!= sizeof ( int32_t ) ) { android_errorWriteLog ( 0x534e4554, "63662938" ) ; return - EINVAL ; }
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_vld_decode ( dec_state_t * ps_dec, WORD16 * pi2_outAddr, const UWORD8 * pu1_scan, UWORD8 * pu1_pos, UWORD16 u2_intra_flag, UWORD16 u2_chroma_flag, UWORD16 u2_d_picture, UWORD16 u2_intra_vlc_format, UWORD16 u2_mpeg2, WORD32 * pi4_num_coeffs ) { UWORD32 u4_sym_len ; UWORD32 u4_decoded_value ; UWORD32 u4_level_first_byte ; WORD32 u4_level ; UWORD32 u4_run, u4_numCoeffs ; UWORD32 u4_buf ; UWORD32 u4_buf_nxt ; UWORD32 u4_offset ; UWORD32 * pu4_buf_aligned ; UWORD32 u4_bits ; stream_t * ps_stream = & ps_dec -> s_bit_stream ; WORD32 u4_pos ; UWORD32 u4_nz_cols ; UWORD32 u4_nz_rows ; * pi4_num_coeffs = 0 ; ps_dec -> u4_non_zero_cols = 0 ; ps_dec -> u4_non_zero_rows = 0 ; u4_nz_cols = ps_dec -> u4_non_zero_cols ; u4_nz_rows = ps_dec -> u4_non_zero_rows ; GET_TEMP_STREAM_DATA ( u4_buf, u4_buf_nxt, u4_offset, pu4_buf_aligned, ps_stream ) if ( u2_intra_flag ) { WORD32 dc_size ; WORD32 dc_diff ; WORD32 maxLen ; WORD32 idx ; maxLen = MPEG2_DCT_DC_SIZE_LEN ; idx = 0 ; if ( u2_chroma_flag!= 0 ) { maxLen += 1 ; idx ++ ; } { WORD16 end = 0 ; UWORD32 maxLen_tmp = maxLen ; UWORD16 m_iBit ; IBITS_NXT ( u4_buf, u4_buf_nxt, u

Fix:
<S2SV_ModStart> 0x3 ) ; <S2SV_ModEnd> if ( u4_numCoeffs <S2SV_ModStart> IMPEG2D_MB_TEX_DECODE_ERR ; } } IBITS_GET ( u4_buf, u4_buf_nxt, u4_offset, u4_bits, pu4_buf_aligned, u4_sym_len ) <S2SV_ModStart> 0x3 ) ; <S2SV_ModEnd> if ( u4_numCoeffs <S2SV_ModStart> return IMPEG2D_MB_TEX_DECODE_ERR ; }
Buggy code:
 static int read_inter_segment_id ( VP9_COMMON * const cm, MACROBLOCKD * const xd, <START_BUG> int mi_row, int mi_col, vp9_reader * r ) { <END_BUG> struct segmentation * const seg = & cm -> seg ; MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ;  const BLOCK_SIZE bsize = mbmi -> sb_type ; <START_BUG> int predicted_segment_id, segment_id ; if (! seg -> enabled ) return 0 ; <END_BUG> predicted_segment_id = vp9_get_segment_id ( cm, cm -> last_frame_seg_map,  bsize, mi_row, mi_col ) ; <START_BUG> if (! seg -> update_map ) <END_BUG> return predicted_segment_id ;  if ( seg -> temporal_update ) { <START_BUG> <END_BUG> const vp9_prob pred_prob = vp9_get_pred_prob_seg_id ( seg, xd ) ;  <START_BUG> mbmi -> seg_id_predicted = vp9_read ( r, pred_prob ) ; <END_BUG> segment_id = mbmi -> seg_id_predicted? predicted_segment_id : read_segment_id ( r, seg ) ; } else { segment_id = read_segment_id ( r, seg ) ; }  set_segment_id ( cm, bsize, mi_row, mi_col, segment_id ) ; <START_BUG> return segment_id ; }<END_BUG>

Fix:
<S2SV_ModStart> int mi_col, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> -> mbmi ; int predicted_segment_id, segment_id ; const int mi_offset = mi_row * cm -> mi_cols + mi_col ; const int bw = xd -> plane [ 0 ]. n4_w >> 1 ; const int bh = xd -> plane [ 0 ]. n4_h >> 1 ; const int x_mis = MIN ( cm -> mi_cols - mi_col, bw ) ; const int y_mis = MIN ( cm -> mi_rows - mi_row, bh ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; predicted_segment_id = <S2SV_ModEnd> cm -> last_frame_seg_map <S2SV_ModStart> cm -> last_frame_seg_map? dec_get_segment_id ( cm, cm -> last_frame_seg_map, mi_offset, x_mis, y_mis ) : 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> -> update_map ) { copy_segment_id ( cm, cm -> last_frame_seg_map, cm -> current_frame_seg_map, mi_offset, x_mis, y_mis ) ; <S2SV_ModStart> return predicted_segment_id ;
Buggy code:
 mod_ty PyAST_FromNodeObject ( const node * n, PyCompilerFlags * flags, PyObject * filename, PyArena * arena ) { int i, j, k, num ; asdl_seq * stmts = NULL ; <START_BUG> stmt_ty s ; <END_BUG> node * ch ; struct compiling c ;  mod_ty res = NULL ; <START_BUG> c. c_arena = arena ; c. c_filename = filename ; c. c_normalize = NULL ; if ( TYPE ( n ) == encoding_decl ) n = CHILD ( n, 0 ) ; k = 0 ; switch ( TYPE ( n ) ) { case file_input : stmts = _Py_asdl_seq_new ( num_stmts ( n ), arena ) ; if (! stmts ) goto out ; for ( i = 0 ; i < NCH ( n ) - 1 ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == NEWLINE ) continue ; REQ ( ch, stmt ) ; num = num_stmts ( ch ) ; if ( num == 1 ) { s = ast_for_stmt ( & c, ch ) ; if (! s ) goto out ; asdl_seq_SET ( stmts, k ++, s ) ; } else { ch = CHILD ( ch, 0 ) ; REQ ( ch, simple_stmt ) ; for ( j = 0 ; j < num ; j ++ ) { s = ast_for_stmt ( & c, CHILD ( ch, j * 2 ) ) ; if (! s ) goto out ; asdl_seq_SET ( stmts, k ++, s ) ; } } } <END_BUG> res = Module ( stmts, arena ) ;  break ; case eval_input : { expr_ty testlist_ast ; testlist_ast = ast_for_testlist ( & c, CHILD ( n, 0 ) ) ; if (! testlist_ast ) goto out ; res = Expression ( testlist_ast, arena ) ; break ; } case single_input : if ( TYPE ( CHILD ( n, 0 ) ) == NEWLINE ) { stmts = _Py_asdl_seq_new ( 1, arena ) ; if (! stmts ) goto out ; asdl_seq_SET ( stmts, 0, Pass ( n -> n_lineno, n ->

Fix:
<S2SV_ModStart> = NULL ; asdl_seq * type_ignores = NULL ; <S2SV_ModStart> res = NULL ; asdl_seq * argtypes = NULL ; expr_ty ret, arg <S2SV_ModStart> } } } ch = CHILD ( n, NCH ( n ) - 1 ) ; REQ ( ch, ENDMARKER ) ; num = NCH ( ch ) ; type_ignores = _Py_asdl_seq_new ( num, arena ) ; if (! type_ignores ) goto out ; for ( i = 0 ; i < num ; i ++ ) { type_ignore_ty ti = TypeIgnore ( LINENO ( CHILD ( ch, i ) ), arena ) ; if (! ti ) goto out ; asdl_seq_SET ( type_ignores, i, ti ) ; } <S2SV_ModStart> Module ( stmts, type_ignores <S2SV_ModStart> } break ; case func_type_input : n = CHILD ( n, 0 ) ; REQ ( n, func_type ) ; if ( TYPE ( CHILD ( n, 1 ) ) == typelist ) { ch = CHILD ( n, 1 ) ; num = 0 ; for ( i = 0 ; i < N
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } quantum_info = ( QuantumInfo * ) NULL ; clone_info = ( ImageInfo * ) NULL ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image

Fix:
<S2SV_ModStart> ; END_OF_READING : <S2SV_ModEnd> CloseBlob ( image <S2SV_ModStart> -> previous ; if ( tmp == image2 ) image2 = ( Image * ) NULL ;
Buggy code:
 <START_BUG> static void sas_probe_devices ( struct work_struct * work ) <END_BUG> {  struct domain_device * dev, * n ; <START_BUG> struct sas_discovery_event * ev = to_sas_discovery_event ( work ) ; struct asd_sas_port * port = ev -> port ; clear_bit ( DISCE_PROBE, & port -> disc. pending ) ; list_for_each_entry ( dev, & port -> disco_list, disco_list_node ) { spin_lock_irq ( & port -> dev_list_lock ) ; list_add_tail ( & dev -> dev_list_node, & port -> dev_list ) ; spin_unlock_irq ( & port -> dev_list_lock ) ; } sas_probe_sata ( port ) ; list_for_each_entry_safe ( dev, n, & port -> disco_list, disco_list_node ) { int err ; err = sas_rphy_add ( dev -> rphy ) ; if ( err ) sas_fail_probe ( dev, __func__, err ) ; else list_del_init ( & dev -> disco_list_node ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> sas_probe_devices ( struct asd_sas_port * port <S2SV_ModEnd> ) { struct <S2SV_ModStart>, * n <S2SV_ModEnd> ; list_for_each_entry (
Buggy code:
 static int rose_parse_national ( unsigned char * p, struct rose_facilities_struct * facilities, int len ) { unsigned char * pt ; unsigned char l, lg, n = 0 ; int fac_national_digis_received = 0 ; do { switch ( * p & 0xC0 ) { case 0x00 : <START_BUG> p += 2 ; <END_BUG> n += 2 ; len -= 2 ; break ; case 0x40 :  if ( * p == FAC_NATIONAL_RAND ) <START_BUG> facilities -> rand = ( ( p [ 1 ] << 8 ) & 0xFF00 ) + ( ( p [ 2 ] << 0 ) & 0x00FF ) ; p += 3 ; n += 3 ; len -= 3 ; break ; case 0x80 : <END_BUG> p += 4 ;  n += 4 ; len -= 4 ; break ; case 0xC0 : <START_BUG> l = p [ 1 ] ; <END_BUG> if ( * p == FAC_NATIONAL_DEST_DIGI ) { if (! fac_national_digis_received ) {  memcpy ( & facilities -> source_digis [ 0 ], p + 2, AX25_ADDR_LEN ) ; <START_BUG> facilities -> source_ndigis = 1 ; } } else if ( * p == FAC_NATIONAL_SRC_DIGI ) { if (! fac_national_digis_received ) { <END_BUG> memcpy ( & facilities -> dest_digis [ 0 ], p + 2, AX25_ADDR_LEN ) ;  facilities -> dest_ndigis = 1 ; } } else if ( * p == FAC_NATIONAL_FAIL_CALL ) { <START_BUG> memcpy ( & facilities -> fail_call, p + 2, AX25_ADDR_LEN ) ; <END_BUG> } else if ( * p == FAC_NATIONAL_FAIL_ADD ) {  memcpy ( & facilities -> fail_addr, p + 3, ROSE_ADDR_LEN ) ; <START_BUG> } <END_BUG> else if ( * p == FAC_NATIONAL_DIGIS ) {  fac_national_digis_received = 1 ; facilities -> source_ndigis = 0 ; facilities -> dest_ndigis = 0 ; for ( pt = p + 2, lg = 0 ;

Fix:
<S2SV_ModStart> case 0x00 : if ( len < 2 ) return - 1 ; <S2SV_ModStart> : if ( len < 3 ) return - 1 ; if ( <S2SV_ModStart> case 0x80 : if ( len < 4 ) return - 1 ; <S2SV_ModStart> case 0xC0 : if ( len < 2 ) return - 1 ; l = p [ 1 ] ; if ( len < 2 + l ) return - 1 <S2SV_ModEnd> ; if ( <S2SV_ModStart> fac_national_digis_received ) { if ( l < AX25_ADDR_LEN ) return - 1 ; <S2SV_ModStart> fac_national_digis_received ) { if ( l < AX25_ADDR_LEN ) return - 1 ; <S2SV_ModStart> FAC_NATIONAL_FAIL_CALL ) { if ( l < AX25_ADDR_LEN ) return - 1 ; <S2SV_ModStart> FAC_NATIONAL_FAIL_ADD ) { if ( l < 1 + ROSE_ADDR_LEN ) return - 1 ; <S2SV_ModStart> FAC_NATIONAL_DIGIS ) { if ( l % AX25_ADDR_LEN ) return - 1 ;
Buggy code:
 int id3_skip ( SF_PRIVATE * psf ) { unsigned char buf [ 10 ] ; memset ( buf, 0, sizeof ( buf ) ) ; psf_binheader_readf ( psf, "pb", 0, buf, 10 ) ; if ( buf [ 0 ] == 'I' && buf [ 1 ] == 'D' && buf [ 2 ] == '3' ) { int offset = buf [ 6 ] & 0x7f ; offset = ( offset << 7 ) | ( buf [ 7 ] & 0x7f ) ; offset = ( offset << 7 ) | ( buf [ 8 ] & 0x7f ) ; offset = ( offset << 7 ) | ( buf [ 9 ] & 0x7f ) ; psf_log_printf ( psf, "ID3   length   :   %d\\n--------------------\\n", offset ) ; if ( offset < 0 ) return 0 ; psf -> fileoffset += offset + 10 ; <START_BUG> psf_binheader_readf ( psf, "p", psf -> fileoffset ) ; <END_BUG> return 1 ; } ;  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> + 10 ; if ( psf -> fileoffset < psf -> filelength ) { <S2SV_ModStart> ; } ; } ;
Buggy code:
 static int isofs_export_encode_fh ( struct inode * inode, __u32 * fh32, int * max_len, struct inode * parent ) { struct iso_inode_info * ei = ISOFS_I ( inode ) ; int len = * max_len ; int type = 1 ; __u16 * fh16 = ( __u16 * ) fh32 ; if ( parent && ( len < 5 ) ) { * max_len = 5 ; return 255 ; } else if ( len < 3 ) { * max_len = 3 ; return 255 ; } len = 3 ; fh32 [ 0 ] = ei -> i_iget5_block ; fh16 [ 2 ] = ( __u16 ) ei -> i_iget5_offset ; <START_BUG> fh32 [ 2 ] = inode -> i_generation ; <END_BUG> if ( parent ) { struct iso_inode_info * eparent ; eparent = ISOFS_I ( parent ) ; fh32 [ 3 ] = eparent -> i_iget5_block ; fh16 [ 3 ] = ( __u16 ) eparent -> i_iget5_offset ; fh32 [ 4 ] = parent -> i_generation ; len = 5 ; type = 2 ; } * max_len = len ; return type ; }

Fix:
<S2SV_ModStart> -> i_iget5_offset ; fh16 [ 3 ] = 0 ;
Buggy code:
 int ext4_orphan_del ( handle_t * handle, struct inode * inode ) { struct list_head * prev ; struct ext4_inode_info * ei = EXT4_I ( inode ) ; struct ext4_sb_info * sbi ; __u32 ino_next ; struct ext4_iloc iloc ; int err = 0 ; <START_BUG> if ( handle &&! ext4_handle_valid ( handle ) ) <END_BUG> return 0 ; mutex_lock ( & EXT4_SB ( inode -> i_sb ) -> s_orphan_lock ) ; if ( list_empty ( & ei -> i_orphan ) ) goto out ; ino_next = NEXT_ORPHAN ( inode ) ; prev = ei -> i_orphan. prev ; sbi = EXT4_SB ( inode -> i_sb ) ; jbd_debug ( 4, "remove   inode   %lu   from   orphan   list\\n", inode -> i_ino ) ; list_del_init ( & ei -> i_orphan ) ;  if ( sbi -> s_journal &&! handle ) <START_BUG> goto out ; err = ext4_reserve_inode_write ( handle, inode, & iloc ) ; if ( err ) goto out_err ; if ( prev == & sbi -> s_orphan ) { jbd_debug ( 4, "superblock   will   point   to   %u\\n", ino_next ) ; BUFFER_TRACE ( sbi -> s_sbh, "get_write_access" ) ; err = ext4_journal_get_write_access ( handle, sbi -> s_sbh ) ; if ( err ) goto out_brelse ; sbi -> s_es -> s_last_orphan = cpu_to_le32 ( ino_next ) ; err = ext4_handle_dirty_super ( handle, inode -> i_sb ) ; } else { struct ext4_iloc iloc2 ; struct inode * i_prev = & list_entry ( prev, struct ext4_inode_info, i_orphan ) -> vfs_inode ; jbd_debug ( 4, "orphan   inode   %lu   will   point   to   %u\\n", i_prev -> i_ino<END_BUG>

Fix:
<S2SV_ModStart> ; if (! EXT4_SB ( inode -> i_sb ) -> s_journal <S2SV_ModEnd> ) return 0 <S2SV_ModStart> ; if ( <S2SV_ModEnd>! handle )
Buggy code:
 error_t enc28j60ReceivePacket ( NetInterface * interface ) { error_t error ; <START_BUG> uint16_t n ; <END_BUG> uint16_t status ;  Enc28j60Context * context ; <START_BUG> context = ( Enc28j60Context * ) interface -> nicContext ; <END_BUG> if ( enc28j60ReadReg ( interface, ENC28J60_REG_EPKTCNT ) )  { enc28j60WriteReg ( interface, ENC28J60_REG_ERDPTL, LSB ( context -> nextPacket ) ) ; <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_ERDPTH, MSB ( context -> nextPacket ) ) ; <END_BUG>  enc28j60ReadBuffer ( interface, ( uint8_t * ) & context -> nextPacket, sizeof ( uint16_t ) ) ; <START_BUG> enc28j60ReadBuffer ( interface, ( uint8_t * ) & n, sizeof ( uint16_t ) ) ; enc28j60ReadBuffer ( interface, ( uint8_t * ) & status, sizeof ( uint16_t ) ) ; <END_BUG> if ( ( status & RSV_RECEIVED_OK )!= 0 )  { <START_BUG> n = MIN ( n, ETH_MAX_FRAME_SIZE ) ; <END_BUG>  enc28j60ReadBuffer ( interface, context -> rxBuffer, n ) ; <START_BUG> error = NO_ERROR ; } else { error = ERROR_INVALID_PACKET ; } if ( context -> nextPacket == ENC28J60_RX_BUFFER_START ) { <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_ERXRDPTL, LSB ( ENC28J60_RX_BUFFER_STOP ) ) ;  <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_ERXRDPTH, MSB ( ENC28J60_RX_BUFFER_STOP ) ) ; <END_BUG> } else {  enc28j60WriteReg ( interface, ENC28J60_REG_ERXRDPTL, LSB ( context -> nextPacket - 1 ) ) ; <START_BUG> <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_ERXRDPTH, MSB ( context -> nextPacket - 1 ) ) ;  } <START_BUG> enc28j60Set<END_BUG>

Fix:
<S2SV_ModStart> error ; uint16_t length <S2SV_ModEnd> ; uint16_t status <S2SV_ModStart> uint16_t status ; uint8_t header [ 6 ] ; <S2SV_ModStart> ( interface, ENC28J60_EPKTCNT )!= 0 ) { enc28j60WriteReg ( interface, ENC28J60_ERDPTL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_ERDPTH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, header <S2SV_ModEnd>, sizeof ( <S2SV_ModStart>, sizeof ( header ) ) ; context -> nextPacket = LOAD16LE ( header ) ; length = LOAD16LE ( header + 2 ) ; status = LOAD16LE ( header + 4 <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( status & ENC28J60_RSV_RECEIVED_OK <S2SV_ModEnd> )!= 0 <S2SV_ModStart> 0 ) { length <S2SV_ModEnd> = MIN ( <S2SV_ModStart> = MIN ( length <S2SV_ModEnd>, ETH_MAX_FRAME_SIZE ) <S2SV_ModStart> -> rxBuffer, length <S2SV_ModEnd> ) ; error <S2SV_ModStart> ( interface, ENC28J60_ERXRDPTL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_ERXRDPTH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_ERXRDPT