nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int read_packet ( int fd, gss_buffer_t buf, int timeout, int first ) { int ret ; static uint32_t len = 0 ; static char len_buf [ 4 ] ; static int len_buf_pos = 0 ; static char * tmpbuf = 0 ; static int tmpbuf_pos = 0 ; if ( first ) { len_buf_pos = 0 ; return - 2 ; } if ( len_buf_pos < 4 ) { ret = timed_read ( fd, & len_buf [ len_buf_pos ], 4 - len_buf_pos, timeout ) ; if ( ret == - 1 ) { if ( errno == EINTR || errno == EAGAIN ) return - 2 ; LOG ( LOG_ERR, ( "%s", strerror ( errno ) ) ) ; <START_BUG> return - 1 ; <END_BUG> } if ( ret == 0 ) { if ( len_buf_pos == 0 ) return 0 ; LOG ( LOG_INFO, ( "EOF   reading   packet   len" ) ) ;  return - 1 ; <START_BUG> } len_buf_pos += ret ; } if ( len_buf_pos!= 4 ) return - 2 ; len = ntohl ( * ( uint32_t * ) len_buf ) ; if ( len > GSTD_MAXPACKETCONTENTS + 512 ) { LOG ( LOG_ERR, ( "ridiculous   length,   %ld", len ) ) ; <END_BUG> return - 1 ;  } if (! tmpbuf ) { if ( ( tmpbuf = malloc ( len ) ) == NULL ) { LOG ( LOG_CRIT, ( "malloc   failure,   %ld   bytes", len ) ) ; <START_BUG> return - 1 ; <END_BUG> } } ret = timed_read ( fd, tmpbuf + tmpbuf_pos, len - tmpbuf_pos, timeout ) ; if ( ret == - 1 ) { if ( errno == EINTR || errno == EAGAIN ) return - 2 ; LOG ( LOG_ERR, ( "%s", strerror ( errno ) ) ) ;  return - 1 ; <START_BUG> } if ( ret == 0 ) { LOG ( LOG_ERR, ( "EOF   while   reading   packet   (len=%d)", len ) ) ; <END_BUG> return - 1 ;  } tmpbuf_pos += ret ; if ( tmpbuf_

Fix:
<S2SV_ModStart> ) ) ; goto bail <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) ; goto bail <S2SV_ModEnd> ; } len_buf_pos <S2SV_ModStart> ) ) ; goto bail <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) ; goto bail <S2SV_ModEnd> ; } } <S2SV_ModStart> ) ) ; goto bail <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ) ; goto bail <S2SV_ModEnd> ; } tmpbuf_pos <S2SV_ModStart> - 2 ; bail : free ( tmpbuf ) ; tmpbuf = NULL ; return - 1 ;
Buggy code:
 static int su3000_i2c_transfer ( struct i2c_adapter * adap, struct i2c_msg msg [ ], int num ) { struct dvb_usb_device * d = i2c_get_adapdata ( adap ) ; <START_BUG> u8 obuf [ 0x40 ], ibuf [ 0x40 ] ; <END_BUG> if (! d ) return - ENODEV ;  if ( mutex_lock_interruptible ( & d -> i2c_mutex ) < 0 ) <START_BUG> return - EAGAIN ; <END_BUG> switch ( num ) {  case 1 : switch ( msg [ 0 ]. addr ) { case SU3000_STREAM_CTRL : <START_BUG> obuf [ 0 ] = msg [ 0 ]. buf [ 0 ] + 0x36 ; <END_BUG>  obuf [ 1 ] = 3 ; <START_BUG> <END_BUG> obuf [ 2 ] = 0 ;  <START_BUG> if ( dvb_usb_generic_rw ( d, obuf, 3, ibuf, 0, 0 ) < 0 ) <END_BUG> err ( "i2c   transfer   failed." ) ; break ; case DW2102_RC_QUERY :  obuf [ 0 ] = 0x10 ; <START_BUG> <END_BUG> if ( dvb_usb_generic_rw ( d, obuf, 1, ibuf, 2, 0 ) < 0 )  err ( "i2c   transfer   failed." ) ; <START_BUG> msg [ 0 ]. buf [ 1 ] = ibuf [ 0 ] ; <END_BUG>  msg [ 0 ]. buf [ 0 ] = ibuf [ 1 ] ; <START_BUG> break ; default : <END_BUG> obuf [ 0 ] = 0x08 ;  <START_BUG> obuf [ 1 ] = msg [ 0 ]. addr ; <END_BUG>  obuf [ 2 ] = msg [ 0 ]. len ; <START_BUG> <END_BUG> memcpy ( & obuf [ 3 ], msg [ 0 ]. buf, msg [ 0 ]. len ) ;  <START_BUG> if ( dvb_usb_generic_rw ( d, obuf, msg [ 0 ]. len + 3, <END_BUG>  ibuf, 1, 0 ) < 0 ) <START_BUG> err ( "i2c   transfer   failed." ) ; } break ; case 2 : <END_BUG> obuf [ 0 ] = 0x09 ;  <START_BUG> obuf [ 1 ] = msg [ 0 ]. len ; <END_BUG> obuf [ 2 ] = msg [ 1

Fix:
<S2SV_ModStart> adap ) ; struct dw2102_state * state <S2SV_ModEnd> ; if ( <S2SV_ModStart> - ENODEV ; state = d -> priv ; <S2SV_ModStart> - EAGAIN ; if ( mutex_lock_interruptible ( & d -> data_mutex ) < 0 ) { mutex_unlock ( & d -> i2c_mutex ) ; return - EAGAIN ; } <S2SV_ModStart> case SU3000_STREAM_CTRL : state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> + 0x36 ; state -> data <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> = 3 ; state -> data <S2SV_ModEnd> [ 2 ] <S2SV_ModStart> ( d, state -> data <S2SV_ModEnd>, 3, <S2SV_ModStart>, 3, state -> data <S2SV_ModEnd>, 0, <S2SV_ModStart> case DW2102_RC_QUERY : state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> ( d, state -> data, 1, state -> data <S2SV_ModEnd>, 2, <S2SV_ModStart> 1 ] = state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> 0 ] = state -> data <S2SV_ModEnd> [ 1 ] <S2SV_ModStart> ; default : state -> data <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = 0x08 ; state -> data <S2SV_ModEnd> [ 1 ] <S2SV_ModStart>. addr ; state -> data <S2SV_ModEnd> [ 2 ] <S2SV_ModStart> memcpy ( & state -> data <S2SV_ModEnd> [ 3 ] <S2SV_ModStart> ( d, state -> data <S2SV_ModEnd>,
Buggy code:
 static void setup_remaining_vcs ( int src_fd, unsigned src_idx, bool utf8 ) { struct console_font_op cfo = {. op = KD_FONT_OP_GET,. width = UINT_MAX,. height = UINT_MAX,. charcount = UINT_MAX, } ; struct unimapinit adv = { } ; struct unimapdesc unimapd ; _cleanup_free_ struct unipair * unipairs = NULL ; _cleanup_free_ void * fontbuf = NULL ; unsigned i ; int r ; unipairs = new ( struct unipair, USHRT_MAX ) ; if (! unipairs ) { log_oom ( ) ; return ; } r = ioctl ( src_fd, KDFONTOP, & cfo ) ; if ( r < 0 ) log_warning_errno ( errno, "KD_FONT_OP_GET   failed   while   trying   to   get   the   font   metadata:   %m" ) ; else { if ( cfo. width > 32 || cfo. height > 32 || cfo. charcount > 512 ) log_warning ( "Invalid   font   metadata   -   width:   %u   (max   32),   height:   %u   (max   32),   count:   %u   (max   512)", cfo. width, cfo. height, cfo. charcount ) ; else { fontbuf = malloc_multiply ( ( cfo. width + 7 ) // 8 * 32, cfo. charcount ) ; if (! fontbuf ) { log_oom ( ) ; return ; } cfo. data = fontbuf ; r = ioctl ( src_fd, KDFONTOP, & cfo ) ; if ( r < 0 ) log_warning_errno ( errno, "KD_FONT_OP_GET   failed   while   trying   to   read   the   font   data:   %m" ) ; else { unimapd. entries = unipairs ; unimapd. entry_ct = USHRT_MAX ; r = ioctl ( src_fd, GIO_UNIMAP, & unimapd ) ; if ( r < 0 ) log_warning_errno ( errno, "GIO_UNIM

Fix:
<S2SV_ModStart> } if ( vt_verify_kbmode <S2SV_ModEnd> ( fd_d )
Buggy code:
 int fpm_log_write ( char * log_format ) { char * s, * b ; char buffer [ FPM_LOG_BUFFER + 1 ] ; int token, test ; size_t len, len2 ; struct fpm_scoreboard_proc_s proc, * proc_p ; struct fpm_scoreboard_s * scoreboard ; char tmp [ 129 ] ; char format [ 129 ] ; time_t now_epoch ; # ifdef HAVE_TIMES clock_t tms_total ; # endif if (! log_format && (! fpm_log_format || fpm_log_fd == - 1 ) ) { return - 1 ; } if (! log_format ) { log_format = fpm_log_format ; test = 0 ; } else { test = 1 ; } now_epoch = time ( NULL ) ; if (! test ) { scoreboard = fpm_scoreboard_get ( ) ; if (! scoreboard ) { zlog ( ZLOG_WARNING, "unable   to   get   scoreboard   while   preparing   the   access   log" ) ; return - 1 ; } proc_p = fpm_scoreboard_proc_acquire ( NULL, - 1, 0 ) ; if (! proc_p ) { zlog ( ZLOG_WARNING, "[pool   %s]   Unable   to   acquire   shm   slot   while   preparing   the   access   log", scoreboard -> pool ) ; return - 1 ; } proc = * proc_p ; fpm_scoreboard_proc_release ( proc_p ) ; } token = 0 ; memset ( buffer, '\\0', sizeof ( buffer ) ) ; b = buffer ; len = 0 ; s = log_format ; while ( * s!= '\\0' ) { if ( len >= FPM_LOG_BUFFER ) { zlog ( ZLOG_NOTICE, "the   log   buffer   is   full   (%d).   The   access   log   request   has   been   truncated.", FPM_LOG_BUFFER ) ; len = FPM_LOG_BUFFER ; break ; } if (! token && * s == '%' ) { token = 1 ; memset ( format, '\\0', sizeof ( format ) ) ; s ++ ; continue ; }

Fix:
<S2SV_ModStart> len2 ; } if ( len >= FPM_LOG_BUFFER ) { zlog ( ZLOG_NOTICE, "the <S2SV_blank> log <S2SV_blank> buffer <S2SV_blank> is <S2SV_blank> full <S2SV_blank> (%d). <S2SV_blank> The <S2SV_blank> access <S2SV_blank> log <S2SV_blank> request <S2SV_blank> has <S2SV_blank> been <S2SV_blank> truncated.", FPM_LOG_BUFFER ) ; len = FPM_LOG_BUFFER ; break ; }
Buggy code:
 static vpx_codec_err_t vp8e_destroy ( vpx_codec_alg_priv_t * ctx ) { # if CONFIG_MULTI_RES_ENCODING if ( ctx -> oxcf. mr_total_resolutions > 0 && ( ctx -> oxcf. mr_encoder_id == ctx -> oxcf. mr_total_resolutions - 1 ) ) { LOWER_RES_FRAME_INFO * shared_mem_loc = ( LOWER_RES_FRAME_INFO * ) ctx -> oxcf. mr_low_res_mode_info ; free ( shared_mem_loc -> mb_info ) ; free ( ctx -> oxcf. mr_low_res_mode_info ) ; } # endif free ( ctx -> cx_data ) ; vp8_remove_compressor ( & ctx -> cpi ) ; <START_BUG> free ( ctx ) ; <END_BUG> return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> cpi ) ; vpx_free <S2SV_ModEnd> ( ctx )
Buggy code:
 static void ParseCommon ( map_string_t * settings, const char * conf_filename ) { const char * value ; value = get_map_string_item_or_NULL ( settings, "WatchCrashdumpArchiveDir" ) ; if ( value ) { g_settings_sWatchCrashdumpArchiveDir = xstrdup ( value ) ; remove_map_string_item ( settings, "WatchCrashdumpArchiveDir" ) ; } value = get_map_string_item_or_NULL ( settings, "MaxCrashReportsSize" ) ; if ( value ) { char * end ; errno = 0 ; unsigned long ul = strtoul ( value, & end, 10 ) ; if ( errno || end == value || * end!= '\\0' || ul > INT_MAX ) error_msg ( "Error   parsing   %s   setting:   \'%s\'", "MaxCrashReportsSize", value ) ; else g_settings_nMaxCrashReportsSize = ul ; remove_map_string_item ( settings, "MaxCrashReportsSize" ) ; } value = get_map_string_item_or_NULL ( settings, "DumpLocation" ) ; if ( value ) { g_settings_dump_location = xstrdup ( value ) ; remove_map_string_item ( settings, "DumpLocation" ) ; } else g_settings_dump_location = xstrdup ( DEFAULT_DUMP_LOCATION ) ; value = get_map_string_item_or_NULL ( settings, "DeleteUploaded" ) ; if ( value ) { g_settings_delete_uploaded = string_to_bool ( value ) ; remove_map_string_item ( settings, "DeleteUploaded" ) ; } value = get_map_string_item_or_NULL ( settings, "AutoreportingEnabled" ) ; if ( value ) { g_settings_autoreporting = string_to_bool ( value ) ; remove_map_string_item ( settings, "AutoreportingEnabled" ) ; } value = get_map_string_item_or_NULL ( settings, "AutoreportingEvent" ) ; if ( value ) { g_settings_autoreporting_event = xstrdup ( value ) ; remove_map_string_item ( settings, "

Fix:
<S2SV_ModStart> = 0 ; value = get_map_string_item_or_NULL ( settings, "PrivateReports" ) ; if ( value ) { g_settings_privatereports = string_to_bool ( value ) ; remove_map_string_item ( settings, "PrivateReports" ) ; }
Buggy code:
 int table_regex_match ( const char * string, const char * pattern ) { regex_t preg ; <START_BUG> int cflags = REG_EXTENDED | REG_NOSUB ; <END_BUG> if ( strncmp ( pattern, "(?i)", 4 ) == 0 ) { cflags |= REG_ICASE ; pattern += 4 ; } if ( regcomp ( & preg, pattern, cflags )!= 0 ) return ( 0 ) ;  if ( regexec ( & preg, string, 0, NULL, 0 )!= 0 ) <START_BUG> return ( 0 ) ; return ( 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> REG_EXTENDED | REG_NOSUB ; int ret <S2SV_ModStart> 0 ) ; ret = <S2SV_ModEnd> regexec ( & <S2SV_ModStart>, 0 ) ; regfree ( & preg ) ; if ( ret
Buggy code:
 static int check_mem_access ( struct bpf_verifier_env * env, int insn_idx, u32 regno, int off, int bpf_size, enum bpf_access_type t, int value_regno ) { struct bpf_verifier_state * state = env -> cur_state ; struct bpf_reg_state * regs = cur_regs ( env ) ; struct bpf_reg_state * reg = regs + regno ; int size, err = 0 ; size = bpf_size_to_bytes ( bpf_size ) ; if ( size < 0 ) return size ; err = check_ptr_alignment ( env, reg, off, size ) ; if ( err ) return err ; off += reg -> off ; if ( reg -> type == PTR_TO_MAP_VALUE ) { if ( t == BPF_WRITE && value_regno >= 0 && is_pointer_value ( env, value_regno ) ) { verbose ( env, "R%d   leaks   addr   into   map\\n", value_regno ) ; return - EACCES ; } err = check_map_access ( env, regno, off, size, false ) ; if (! err && t == BPF_READ && value_regno >= 0 ) mark_reg_unknown ( env, regs, value_regno ) ; } else if ( reg -> type == PTR_TO_CTX ) { enum bpf_reg_type reg_type = SCALAR_VALUE ; if ( t == BPF_WRITE && value_regno >= 0 && is_pointer_value ( env, value_regno ) ) { verbose ( env, "R%d   leaks   addr   into   ctx\\n", value_regno ) ; return - EACCES ; } if ( reg -> off ) { verbose ( env, "dereference   of   modified   ctx   ptr   R%d   off=%d+%d,   ctx+const   is   allowed,   ctx+const+const   is   not\\n", regno, reg -> off, off - reg -> off ) ; return - EACCES ; } if (! tnum_is_const ( reg -> var_off ) || reg -> var_off. value )

Fix:
<S2SV_ModStart> SCALAR_VALUE ) { coerce_reg_to_size ( & <S2SV_ModStart> [ value_regno ], size <S2SV_ModEnd> ) ; }
Buggy code:
 WORD32 ih264d_mark_err_slice_skip ( dec_struct_t * ps_dec, WORD32 num_mb_skip, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num, pocstruct_t * ps_cur_poc, WORD32 prev_slice_err ) { WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2 ; UWORD32 u1_mb_idx = ps_dec -> u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end ; UWORD32 u1_tfr_n_mb ; UWORD32 u1_decode_nmb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD16 u2_total_mbs_coded ; UWORD32 u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; parse_part_params_t * ps_part_info ; WORD32 ret ; if ( ps_dec -> ps_dec_err_status -> u1_err_flag & REJECT_CUR_PIC ) { ih264d_err_pic_dispbuf_mgr ( ps_dec )

Fix:
<S2SV_ModStart> } } } ps_dec -> u4_first_slice_in_pic = 0 ; <S2SV_ModStart> u4_mbs_in_slice ) ; if ( ps_dec -> u4_first_slice_in_pic!= 0 ) { ps_dec -> ps_parse_cur_slice ++ ; <S2SV_ModStart> u2_cur_slice_num ++ ; } <S2SV_ModEnd> ps_dec -> i2_prev_slice_mbx
Buggy code:
 static int process_cmd_sock ( int h ) { sock_cmd_t cmd = { - 1, 0, 0, 0, 0 } ; int fd = ts [ h ]. cmd_fdr ; <START_BUG> if ( recv ( fd, & cmd, sizeof ( cmd ), MSG_WAITALL )!= sizeof ( cmd ) ) <END_BUG> { APPL_TRACE_ERROR ( "recv   cmd   errno:%d", errno ) ; return FALSE ; } APPL_TRACE_DEBUG ( "cmd.id:%d", cmd. id ) ; switch ( cmd. id ) { case CMD_ADD_FD : add_poll ( h, cmd. fd, cmd. type, cmd. flags, cmd. user_id ) ; break ; case CMD_REMOVE_FD : for ( int i = 1 ; i < MAX_POLL ; ++ i ) { poll_slot_t * poll_slot = & ts [ h ]. ps [ i ] ; if ( poll_slot -> pfd. fd == cmd. fd ) { remove_poll ( h, poll_slot, poll_slot -> flags ) ; break ; } } close ( cmd. fd ) ; break ; case CMD_WAKEUP : break ; case CMD_USER_PRIVATE : asrt ( ts [ h ]. cmd_callback ) ; if ( ts [ h ]. cmd_callback ) ts [ h ]. cmd_callback ( fd, cmd. type, cmd. flags, cmd. user_id ) ; break ; case CMD_EXIT : return FALSE ; default : APPL_TRACE_DEBUG ( "unknown   cmd:   %d", cmd. id ) ; break ; } return TRUE ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> ), MSG_WAITALL )
Buggy code:
 static void define_gf_group ( VP9_COMP * cpi, FIRSTPASS_STATS * this_frame ) { <START_BUG> RATE_CONTROL * const rc = & cpi -> rc ; <END_BUG>  VP9_CONFIG * const oxcf = & cpi -> oxcf ; <START_BUG> <END_BUG> struct twopass_rc * const twopass = & cpi -> twopass ;  <START_BUG> FIRSTPASS_STATS next_frame = { 0 } ; <END_BUG>  const FIRSTPASS_STATS * start_pos ; <START_BUG> int i ; double boost_score = 0.0 ; double old_boost_score = 0.0 ; double gf_group_err = 0.0 ; <END_BUG> double gf_first_frame_err = 0.0 ;  double mod_frame_err = 0.0 ; double mv_ratio_accumulator = 0.0 ; double decay_accumulator = 1.0 ; double zero_motion_accumulator = 1.0 ; double loop_decay_rate = 1.00 ; double last_loop_decay_rate = 1.00 ; double this_frame_mv_in_out = 0.0 ; double mv_in_out_accumulator = 0.0 ; double abs_mv_in_out_accumulator = 0.0 ; double mv_ratio_accumulator_thresh ; <START_BUG> const int max_bits = frame_max_bits ( rc, oxcf ) ; <END_BUG> unsigned int allow_alt_ref = oxcf -> play_alternate && oxcf -> lag_in_frames ; int f_boost = 0 ; int b_boost = 0 ; int flash_detected ; int active_max_gf_interval ; twopass -> gf_group_bits = 0 ; vp9_clear_system_state ( ) ; start_pos = twopass -> stats_in ; mod_frame_err = calculate_modified_err ( cpi, this_frame ) ; gf_first_frame_err = mod_frame_err ; if ( cpi -> common. frame_type == KEY_FRAME || rc -> source_alt_ref_active ) gf_group_err -= gf_first_frame_err ;  mv_ratio_accumulator_thresh = ( cpi -> common. width + cpi -> common. height ) // 10.0 ; <START_BUG> active_max_<END_BUG>

Fix:
<S2SV_ModStart> this_frame ) { VP9_COMMON * const cm = & cpi -> common ; <S2SV_ModStart> -> rc ; VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> -> oxcf ; TWO_PASS <S2SV_ModEnd> * const twopass <S2SV_ModStart> ; FIRSTPASS_STATS next_frame <S2SV_ModEnd> ; const FIRSTPASS_STATS <S2SV_ModStart> const FIRSTPASS_STATS * const start_pos = twopass -> stats_in <S2SV_ModEnd> ; int i <S2SV_ModStart> = 0.0 ; # if GROUP_ADAPTIVE_MAXQ double gf_group_raw_error = 0.0 ; # endif double gf_group_skip_pct = 0.0 ; double gf_group_inactive_zone_rows = 0.0 ; <S2SV_ModStart> double mv_ratio_accumulator_thresh ; unsigned int allow_alt_ref = is_altref_enabled ( cpi ) ; int f_boost = 0 ; int b_boost = 0 ; int flash_detected ; int active_max_gf_interval ; int active_min_gf_interval ; int64_t gf_group_bits ; double gf_group_error_left ; int gf_arf_bits ; const int is_key
Buggy code:
 void WT_InterpolateNoLoop ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_PCM * pOutputBuffer ; EAS_I32 phaseInc ; EAS_I32 phaseFrac ; EAS_I32 acc0 ; const EAS_SAMPLE * pSamples ; EAS_I32 samp1 ; EAS_I32 samp2 ; EAS_I32 numSamples ; <START_BUG> numSamples = pWTIntFrame -> numSamples ; <END_BUG> pOutputBuffer = pWTIntFrame -> pAudioBuffer ; phaseInc = pWTIntFrame -> frame. phaseIncrement ; pSamples = ( const EAS_SAMPLE * ) pWTVoice -> phaseAccum ; phaseFrac = ( EAS_I32 ) pWTVoice -> phaseFrac ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif while ( numSamples -- ) { acc0 = samp2 - samp1 ; acc0 = acc0 * phaseFrac ; acc0 = samp1 + ( acc0 >> NUM_PHASE_FRAC_BITS ) ; * pOutputBuffer ++ = ( EAS_I16 ) ( acc0 >> 2 ) ; phaseFrac += phaseInc ; acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS ; if ( acc0 > 0 ) { pSamples += acc0 ; phaseFrac = ( EAS_I32 ) ( ( EAS_U32 ) phaseFrac & PHASE_FRAC_MASK ) ; # if defined ( _8_BIT_SAMPLES ) samp1 = pSamples [ 0 ] << 8 ; samp2 = pSamples [ 1 ] << 8 ; # else samp1 = pSamples [ 0 ] ; samp2 = pSamples [ 1 ] ; # endif } } pWTVoice -> phaseAccum = ( EAS_U32 ) pSamples ; pWTVoice -> phaseFrac = ( EAS_U32 ) phaseFrac ; }

Fix:
<S2SV_ModStart> -> numSamples ; if ( numSamples <= 0 ) { ALOGE ( "b//26366256" ) ; return ; }
Buggy code:
 static UINT printer_process_irp_write ( PRINTER_DEVICE * printer_dev, IRP * irp ) { UINT32 Length ; UINT64 Offset ; rdpPrintJob * printjob = NULL ; UINT error = CHANNEL_RC_OK ; <START_BUG> Stream_Read_UINT32 ( irp -> input, Length ) ; <END_BUG> Stream_Read_UINT64 ( irp -> input, Offset ) ; Stream_Seek ( irp -> input, 20 ) ;  if ( printer_dev -> printer ) <START_BUG> printjob = printer_dev -> printer -> FindPrintJob ( printer_dev -> printer, irp -> FileId ) ; if (! printjob ) { irp -> IoStatus = STATUS_UNSUCCESSFUL ; Length = 0 ; } else { <END_BUG> error = printjob -> Write ( printjob, Stream_Pointer ( irp -> input ), Length ) ;  } if ( error ) { WLog_ERR ( TAG, "printjob->Write   failed   with   error   %" PRIu32 "!", error ) ; return error ; } Stream_Write_UINT32 ( irp -> output, Length ) ; Stream_Write_UINT8 ( irp -> output, 0 ) ; return irp -> Complete ( irp ) ; }

Fix:
<S2SV_ModStart> = CHANNEL_RC_OK ; void * ptr ; if ( Stream_GetRemainingLength ( irp -> input ) < 32 ) return ERROR_INVALID_DATA ; <S2SV_ModStart> 20 ) ; ptr = Stream_Pointer ( irp -> input ) ; if (! Stream_SafeSeek ( irp -> input, Length ) ) return ERROR_INVALID_DATA ; <S2SV_ModStart> ( printjob, ptr <S2SV_ModEnd>, Length )
Buggy code:
 int srs_timestamp_check ( srs_t * srs, const char * stamp ) { const char * sp ; char * bp ; int off ; time_t now ; <START_BUG> time_t then ; <END_BUG> then = 0 ; for ( sp = stamp ; * sp ; sp ++ ) { bp = strchr ( SRS_TIME_BASECHARS, toupper ( * sp ) ) ; if ( bp == NULL ) return SRS_EBADTIMESTAMPCHAR ; off = bp - SRS_TIME_BASECHARS ; then = ( then << SRS_TIME_BASEBITS ) | off ; } time ( & now ) ; now = ( now // SRS_TIME_PRECISION ) % SRS_TIME_SLOTS ; while ( now < then ) now = now + SRS_TIME_SLOTS ; if ( now <= then + srs -> maxage ) return SRS_SUCCESS ; return SRS_ETIMESTAMPOUTOFDATE ; }

Fix:
<S2SV_ModStart> ; time_t then ; if ( strlen ( stamp )!= 2 ) return SRS_ETIMESTAMPOUTOFDATE
Buggy code:
 <START_BUG> void vp9_write_nmv_probs ( VP9_COMMON * cm, int usehp, vp9_writer * w ) { <END_BUG> int i, j ;  nmv_context * const mvc = & cm -> fc. nmvc ; <START_BUG> nmv_context_counts * const counts = & cm -> counts. mv ; write_mv_update ( vp9_mv_joint_tree, mvc -> joints, counts -> joints, MV_JOINTS, w ) ; for ( i = 0 ; i < 2 ; ++ i ) { nmv_component * comp = & mvc -> comps [ i ] ; nmv_component_counts * comp_counts = & counts -> comps [ i ] ; update_mv ( w, comp_counts -> sign, & comp -> sign, MV_UPDATE_PROB ) ; write_mv_update ( vp9_mv_class_tree, comp -> classes, comp_counts -> classes, MV_CLASSES, w ) ; write_mv_update ( vp9_mv_class0_tree, comp -> class0, comp_counts -> class0, CLASS0_SIZE, w ) ; for ( j = 0 ; j < MV_OFFSET_BITS ; ++ j ) update_mv ( w, comp_counts -> bits [ j ], & comp -> bits [ j ], MV_UPDATE_PROB ) ; } for ( i = 0 ; i < 2 ; ++ i ) { for ( j = 0 ; j < CLASS0_SIZE ; ++ j ) write_mv_update ( vp9_mv_fp_tree, mvc -> comps [ i ]. class0_fp [ j ], counts -> comps [ i ]. class0_fp [ j ], MV_FP_SIZE, w ) ; write_mv_update ( vp9_mv_fp_tree, mvc -> comps [ i ]. fp, counts -> comps [ i ]. fp, MV_FP_SIZE, w ) ; } if ( usehp ) { for ( i = 0 ; i < 2 ; ++ i ) { update_mv ( w, counts -> comps [ i ]. class0_hp, & mvc -> comps [ i ]. class0_hp, MV_UPDATE_PROB ) ; update_mv ( w, counts -> comps [ i ]. hp, &<END_BUG>

Fix:
<S2SV_ModStart> int usehp, vpx_writer * w, nmv_context_counts * const counts <S2SV_ModEnd> ) { int <S2SV_ModStart> cm -> fc -> nmvc ; <S2SV_ModEnd> write_mv_update ( vp9_mv_joint_tree
Buggy code:
 int _yr_scan_match_callback ( uint8_t * match_data, int32_t match_length, int flags, void * args ) { CALLBACK_ARGS * callback_args = ( CALLBACK_ARGS * ) args ; YR_STRING * string = callback_args -> string ; YR_MATCH * new_match ; int result = ERROR_SUCCESS ; int tidx = callback_args -> context -> tidx ; size_t match_offset = match_data - callback_args -> data ; <START_BUG> match_length += callback_args -> forward_matches ; <END_BUG> if ( callback_args -> full_word ) { if ( flags & RE_FLAGS_WIDE ) { if ( match_offset >= 2 && * ( match_data - 1 ) == 0 && isalnum ( * ( match_data - 2 ) ) ) return ERROR_SUCCESS ; if ( match_offset + match_length + 1 < callback_args -> data_size && * ( match_data + match_length + 1 ) == 0 && isalnum ( * ( match_data + match_length ) ) ) return ERROR_SUCCESS ; } else { if ( match_offset >= 1 && isalnum ( * ( match_data - 1 ) ) ) return ERROR_SUCCESS ; if ( match_offset + match_length < callback_args -> data_size && isalnum ( * ( match_data + match_length ) ) ) return ERROR_SUCCESS ; } } if ( STRING_IS_CHAIN_PART ( string ) ) { result = _yr_scan_verify_chained_string_match ( string, callback_args -> context, match_data, callback_args -> data_base, match_offset, match_length ) ; } else { if ( string -> matches [ tidx ]. count == 0 ) { FAIL_ON_ERROR ( yr_arena_write_data ( callback_args -> context -> matching_strings_arena, & string, sizeof ( string ), NULL ) ) ; } FAIL_ON_ERROR ( yr_arena_allocate_memory ( callback_args -> context -> matches_arena, sizeof ( YR_MATCH ), ( void * * ) & new_match ) ) ; new_match -> data_length = yr_min ( match_length, MAX_MATCH_DATA ) ; FAIL_ON_

Fix:
<S2SV_ModStart> callback_args -> forward_matches ; assert ( match_offset + match_length <= callback_args -> data_size )
Buggy code:
 gboolean _pango_emoji_iter_next ( PangoEmojiIter * iter ) { PangoEmojiType current_emoji_type = PANGO_EMOJI_TYPE_INVALID ; if ( iter -> end == iter -> text_end ) return FALSE ; iter -> start = iter -> end ; for ( ; iter -> end < iter -> text_end ; iter -> end = g_utf8_next_char ( iter -> end ) ) { gunichar ch = g_utf8_get_char ( iter -> end ) ; if ( (! ( ch == kZeroWidthJoinerCharacter &&! iter -> is_emoji ) && ch!= kVariationSelector15Character && ch!= kVariationSelector16Character && ch!= kCombiningEnclosingCircleBackslashCharacter &&! _pango_Is_Regional_Indicator ( ch ) &&! ( ( ch == kLeftSpeechBubbleCharacter || ch == kRainbowCharacter || ch == kMaleSignCharacter || ch == kFemaleSignCharacter || ch == kStaffOfAesculapiusCharacter ) &&! iter -> is_emoji ) ) || current_emoji_type == PANGO_EMOJI_TYPE_INVALID ) { current_emoji_type = _pango_get_emoji_type ( ch ) ; } if ( g_utf8_next_char ( iter -> end ) < iter -> text_end ) { gunichar peek_char = g_utf8_get_char ( g_utf8_next_char ( iter -> end ) ) ; if ( current_emoji_type == PANGO_EMOJI_TYPE_EMOJI_EMOJI && peek_char == kVariationSelector15Character ) { current_emoji_type = PANGO_EMOJI_TYPE_EMOJI_TEXT ; } if ( ( current_emoji_type == PANGO_EMOJI_TYPE_EMOJI_TEXT || _pango_Is_Emoji_Keycap_Base ( ch ) ) && peek_char == kVariationSelector16Character ) { current_emoji_type = PANGO_EMOJI_TYPE_EMOJI_EMOJI ; } if ( _pango_Is_Emoji_Keycap_Base ( ch ) && peek_char == kCombining

Fix:
<S2SV_ModStart> current_emoji_type ) ; if ( iter -> start == iter -> end ) iter -> end = g_utf8_next_char ( iter -> end ) ;
Buggy code:
 static int http_connect ( http_subtransport * t ) { int error ; char * proxy_url ; if ( t -> connected && http_should_keep_alive ( & t -> parser ) && t -> parse_finished ) return 0 ; if ( t -> io ) { git_stream_close ( t -> io ) ; git_stream_free ( t -> io ) ; t -> io = NULL ; t -> connected = 0 ; } if ( t -> connection_data. use_ssl ) { error = git_tls_stream_new ( & t -> io, t -> connection_data. host, t -> connection_data. port ) ; } else { # ifdef GIT_CURL error = git_curl_stream_new ( & t -> io, t -> connection_data. host, t -> connection_data. port ) ; # else error = git_socket_stream_new ( & t -> io, t -> connection_data. host, t -> connection_data. port ) ; # endif } if ( error < 0 ) return error ; GITERR_CHECK_VERSION ( t -> io, GIT_STREAM_VERSION, "git_stream" ) ; if ( git_stream_supports_proxy ( t -> io ) &&! git_remote__get_http_proxy ( t -> owner -> owner,!! t -> connection_data. use_ssl, & proxy_url ) ) { error = git_stream_set_proxy ( t -> io, proxy_url ) ; git__free ( proxy_url ) ; if ( error < 0 ) return error ; } error = git_stream_connect ( t -> io ) ; # if defined ( GIT_OPENSSL ) || defined ( GIT_SECURE_TRANSPORT ) || defined ( GIT_CURL ) if ( (! error || error == GIT_ECERTIFICATE ) && t -> owner -> certificate_check_cb!= NULL && git_stream_is_encrypted ( t -> io ) ) { git_cert * cert ; <START_BUG> int is_valid ; <END_BUG> if ( ( error = git_stream_certificate ( & cert, t -> io ) ) < 0 ) return error ;  giterr_clear ( ) ; <START_BUG> is_valid = error!= GIT_ECERTIFICATE ; error = t -> owner -> certificate_check_cb ( cert, is_valid,<END_BUG>

Fix:
<S2SV_ModStart> ; int is_valid = ( error == GIT_OK ) <S2SV_ModStart> giterr_clear ( ) <S2SV_ModEnd> ; error =
Buggy code:
 static int php_var_unserialize_internal ( UNSERIALIZE_PARAMETER ) { const unsigned char * cursor, * limit, * marker, * start ; zval * rval_ref ; limit = max ; cursor = * p ; if ( YYCURSOR >= YYLIMIT ) { return 0 ; } if ( var_hash && ( * p ) [ 0 ]!= 'R' ) { var_push ( var_hash, rval ) ; } start = cursor ; <START_BUG> # line 585 "ext//standard//var_unserializer.c" <END_BUG> { YYCTYPE yych ; static const unsigned char yybm [ ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128, 128, 128, 128, 128, 128, 128, 128, 128, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,

Fix:
<S2SV_ModStart> ; # line 576 <S2SV_ModEnd> "ext//standard//var_unserializer.c" { YYCTYPE <S2SV_ModStart> 'O' : goto yy4 <S2SV_ModEnd> ; case 'N' <S2SV_ModStart> 'R' : goto yy6 <S2SV_ModEnd> ; case 'S' <S2SV_ModStart> 'S' : goto yy7 <S2SV_ModEnd> ; case 'a' <S2SV_ModStart> 'a' : goto yy8 <S2SV_ModEnd> ; case 'b' <S2SV_ModStart> 'b' : goto yy9 <S2SV_ModEnd> ; case 'd' <S2SV_ModStart> 'd' : goto yy10 <S2SV_ModEnd> ; case 'i' <S2SV_ModStart> 'i' : goto yy11 <S2SV_ModEnd> ; case 'o' <S2SV_ModStart> 'r' : goto yy13 <S2SV_ModEnd> ; case's' <S2SV_ModStart>'s' : goto yy14 <S2SV_ModEnd> ; case '}' <S2SV_ModStart> '}' : goto yy15 <S2SV_ModEnd> ; default : <S2SV_ModStart> default : goto yy2 ; } yy2 : ++ YYCURSOR <S2SV_ModEnd> ; yy3 : <S2SV_ModStart> : # line 951 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { return <S2SV_ModStart> } # line 636 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy4 : <S2SV_ModStart> ':' ) goto yy17 <S2SV_ModEnd> ; goto yy3 <S2SV_ModStart> ';' ) goto yy19 <S2SV_ModEnd> ; goto yy3 <S2SV_ModStart> ':' ) goto yy21 <S2SV_ModEnd> ;
Buggy code:
 static HttpResponse create_HttpResponse ( Socket_T S ) { HttpResponse res = NULL ; NEW ( res ) ; res -> S = S ; res -> status = SC_OK ; res -> outputbuffer = StringBuffer_create ( 256 ) ; res -> is_committed = false ; res -> protocol = SERVER_PROTOCOL ; res -> status_msg = get_status_string ( SC_OK ) ; <START_BUG> return res ; <END_BUG> }

Fix:
<S2SV_ModStart> SC_OK ) ; Util_getToken ( res -> token ) ;
Buggy code:
 int iwl_pcie_ctxt_info_gen3_init ( struct iwl_trans * trans, const struct fw_img * fw ) { struct iwl_trans_pcie * trans_pcie = IWL_TRANS_GET_PCIE_TRANS ( trans ) ; struct iwl_context_info_gen3 * ctxt_info_gen3 ; struct iwl_prph_scratch * prph_scratch ; struct iwl_prph_scratch_ctrl_cfg * prph_sc_ctrl ; struct iwl_prph_info * prph_info ; void * iml_img ; u32 control_flags = 0 ; int ret ; int cmdq_size = max_t ( u32, IWL_CMD_QUEUE_SIZE, trans -> cfg -> min_txq_size ) ; prph_scratch = dma_alloc_coherent ( trans -> dev, sizeof ( * prph_scratch ), & trans_pcie -> prph_scratch_dma_addr, GFP_KERNEL ) ; if (! prph_scratch ) return - ENOMEM ; prph_sc_ctrl = & prph_scratch -> ctrl_cfg ; prph_sc_ctrl -> version. version = 0 ; prph_sc_ctrl -> version. mac_id = cpu_to_le16 ( ( u16 ) iwl_read32 ( trans, CSR_HW_REV ) ) ; prph_sc_ctrl -> version. size = cpu_to_le16 ( sizeof ( * prph_scratch ) // 4 ) ; control_flags = IWL_PRPH_SCRATCH_RB_SIZE_4K | IWL_PRPH_SCRATCH_MTR_MODE | ( IWL_PRPH_MTR_FORMAT_256B & IWL_PRPH_SCRATCH_MTR_FORMAT ) | IWL_PRPH_SCRATCH_EARLY_DEBUG_EN | IWL_PRPH_SCRATCH_EDBG_DEST_DRAM ; prph_sc_ctrl -> control. control_flags = cpu_to_le32 ( control_flags ) ; prph_sc_ctrl -> rbd_cfg. free_rb

Fix:
<S2SV_ModStart> ( ret ) goto err_free_prph_scratch ; <S2SV_ModEnd> prph_info = dma_alloc_coherent <S2SV_ModStart> (! prph_info ) { ret = - ENOMEM ; goto err_free_prph_scratch ; } ctxt_info_gen3 = dma_alloc_coherent ( trans -> dev, sizeof ( * ctxt_info_gen3 ), & trans_pcie -> ctxt_info_dma_addr, GFP_KERNEL ) ; if (! ctxt_info_gen3 ) { ret = - ENOMEM ; goto err_free_prph_info ; } ctxt_info_gen3 -> prph_info_base_addr = cpu_to_le64 ( trans_pcie -> prph_info_dma_addr ) ; ctxt_info_gen3 -> prph_scratch_base_addr = cpu_to_le64 ( trans_pcie -> prph_scratch_dma_addr ) ; ctxt_info_gen3 -> prph_scratch_size = cpu_to_le32 ( sizeof ( * prph_scratch ) ) ; ctxt_info
Buggy code:
 png_charp PNGAPI png_get_copyright ( png_structp png_ptr ) { PNG_UNUSED ( png_ptr ) # ifdef PNG_STRING_COPYRIGHT return PNG_STRING_COPYRIGHT # else # ifdef __STDC__ <START_BUG> return ( ( png_charp ) PNG_STRING_NEWLINE "libpng   version   1.2.52   -   November   20,   2014" PNG_STRING_NEWLINE "Copyright   (c)   1998-2014   Glenn   Randers-Pehrson" PNG_STRING_NEWLINE "Copyright   (c)   1996-1997   Andreas   Dilger" PNG_STRING_NEWLINE "Copyright   (c)   1995-1996   Guy   Eric   Schalnat,   Group   42,   Inc." PNG_STRING_NEWLINE ) ; <END_BUG> # else  return ( ( png_charp ) "libpng   version   1.2.52   -   November   20,   2014\\\n               Copyright   (c)   1998-2014   Glenn   Randers-Pehrson\\\n               Copyright   (c)   1996-1997   Andreas   Dilger\\\n               Copyright   (c)   1995-1996   Guy   Eric   Schalnat,   Group   42,   Inc." ) ; <START_BUG> # endif # endif }<END_BUG>

Fix:
<S2SV_ModStart> png_charp ) PNG_STRING_NEWLINE "libpng <S2SV_blank> version <S2SV_blank> 1.2.54 <S2SV_blank> - <S2SV_blank> November <S2SV_blank> 12, <S2SV_blank> 2015" PNG_STRING_NEWLINE "Copyright <S2SV_blank> (c) <S2SV_blank> 1998-2015 <S2SV_blank> Glenn <S2SV_blank> Randers-Pehrson" <S2SV_ModEnd> PNG_STRING_NEWLINE "Copyright <S2SV_blank> (c) <S2SV_blank> 1996-1997 <S2SV_blank> Andreas <S2SV_blank> Dilger" PNG_STRING_NEWLINE <S2SV_ModStart> ( png_charp ) "libpng <S2SV_blank> version <S2SV_blank> 1.2.54 <S2SV_blank> - <S2SV_blank> November <S2SV_blank> 12, <S2SV_blank> 2015\\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> Copyright <S2SV_blank> (c) <S2SV_blank> 1998-2015 <S2SV_blank> Glenn <S2SV_blank> Randers-Pehrson\\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> Copyright <S2SV_blank> (c) <S2SV_blank> 1996-1997 <S2SV_blank> Andreas <S2SV_blank> Dilger\\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> Copyright <S2SV_blank> (c) <S2SV_blank> 1995-1996 <S2SV_blank> Guy <S2SV_blank> Eric <S2SV_blank> Schalnat, <S2SV_blank> Group <S2SV_blank> 42, <S2SV_blank> Inc." <S2SV_ModEnd> ) ; #
Buggy code:
 void init_rc ( void ) { int i ; struct stat st ; FILE * f ; if ( rc_dir!= NULL ) goto open_rc ; rc_dir = expandPath ( RC_DIR ) ; i = strlen ( rc_dir ) ; if ( i > 1 && rc_dir [ i - 1 ] == '//' ) rc_dir [ i - 1 ] = '\\0' ; # ifdef USE_M17N display_charset_str = wc_get_ces_list ( ) ; document_charset_str = display_charset_str ; system_charset_str = display_charset_str ; # endif if ( stat ( rc_dir, & st ) < 0 ) { if ( errno == ENOENT ) { if ( do_mkdir ( rc_dir, 0700 ) < 0 ) { goto rc_dir_err ; } else { stat ( rc_dir, & st ) ; } } else { goto rc_dir_err ; } } if (! S_ISDIR ( st. st_mode ) ) { goto rc_dir_err ; } if (! ( st. st_mode & S_IWUSR ) ) { goto rc_dir_err ; } no_rc_dir = FALSE ; tmp_dir = rc_dir ; if ( config_file == NULL ) config_file = rcFile ( CONFIG_FILE ) ; create_option_search_table ( ) ; open_rc : if ( ( f = fopen ( etcFile ( W3MCONFIG ), "rt" ) )!= NULL ) { interpret_rc ( f ) ; fclose ( f ) ; } if ( ( f = fopen ( confFile ( CONFIG_FILE ), "rt" ) )!= NULL ) { interpret_rc ( f ) ; fclose ( f ) ; } if ( config_file && ( f = fopen ( config_file, "rt" ) )!= NULL ) { interpret_rc ( f ) ; fclose ( f ) ; } return ; rc_dir_err : no_rc_dir = TRUE ; if ( ( ( tmp_dir = getenv ( "TMPDIR" ) ) == NULL || * tmp_dir == '\\0' ) && ( ( tmp_dir = getenv ( "TMP" ) ) == NULL || * tmp_dir == '\\0' ) && ( ( tmp_dir = getenv ( "TEMP" ) ) == NULL || * tmp

Fix:
<S2SV_ModStart> = "//tmp" ; # ifdef HAVE_MKDTEMP tmp_dir = mkdtemp ( Strnew_m_charp ( tmp_dir, "//w3m-XXXXXX", NULL ) -> ptr ) ; if ( tmp_dir == NULL ) tmp_dir = rc_dir ; # endif
Buggy code:
 static int aac_send_raw_srb ( struct aac_dev * dev, void __user * arg ) { struct fib * srbfib ; int status ; struct aac_srb * srbcmd = NULL ; struct user_aac_srb * user_srbcmd = NULL ; struct user_aac_srb __user * user_srb = arg ; struct aac_srb_reply __user * user_reply ; struct aac_srb_reply * reply ; u32 fibsize = 0 ; u32 flags = 0 ; s32 rcode = 0 ; u32 data_dir ; void __user * sg_user [ 32 ] ; void * sg_list [ 32 ] ; u32 sg_indx = 0 ; u32 byte_count = 0 ; u32 actual_fibsize64, actual_fibsize = 0 ; int i ; if ( dev -> in_reset ) { dprintk ( ( KERN_DEBUG "aacraid:   send   raw   srb   -EBUSY\\n" ) ) ; return - EBUSY ; } if (! capable ( CAP_SYS_ADMIN ) ) { dprintk ( ( KERN_DEBUG "aacraid:   No   permission   to   send   raw   srb\\n" ) ) ; return - EPERM ; } if (! ( srbfib = aac_fib_alloc ( dev ) ) ) { return - ENOMEM ; } aac_fib_init ( srbfib ) ; srbfib -> hw_fib_va -> header. XferState &= ~ cpu_to_le32 ( FastResponseCapable ) ; srbcmd = ( struct aac_srb * ) fib_data ( srbfib ) ; memset ( sg_list, 0, sizeof ( sg_list ) ) ; if ( copy_from_user ( & fibsize, & user_srb -> count, sizeof ( u32 ) ) ) { dprintk ( ( KERN_DEBUG "aacraid:   Could   not   copy   data   size   from   user\\n" ) ) ; rcode = - EFAULT ; goto cleanup ; } <START_BUG> if ( fibsize > ( dev -> max_f<END_BUG>

Fix:
<S2SV_ModStart> } if ( ( fibsize < ( sizeof ( struct user_aac_srb ) - sizeof ( struct user_sgentry ) ) ) || ( <S2SV_ModStart> ( struct aac_fibhdr )
Buggy code:
 int touch ( const char * path ) { <START_BUG> return touch_file ( path, false, USEC_INFINITY, UID_INVALID, GID_INVALID, 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, GID_INVALID, MODE_INVALID <S2SV_ModEnd> ) ; }
Buggy code:
 WORD32 ih264d_mark_err_slice_skip ( dec_struct_t * ps_dec, WORD32 num_mb_skip, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num, pocstruct_t * ps_cur_poc, WORD32 prev_slice_err ) { WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2 ; UWORD32 u1_mb_idx = ps_dec -> u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end ; UWORD32 u1_tfr_n_mb ; UWORD32 u1_decode_nmb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD16 u2_total_mbs_coded ; UWORD32 u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; parse_part_params_t * ps_part_info ; WORD32 ret ; if ( ps_dec -> ps_dec_err_status -> u1_err_flag & REJECT_CUR_PIC ) { ih264d_err_pic_dispbuf_mgr ( ps_dec )

Fix:
<S2SV_ModStart> i ; { ps_dec -> ps_cur_slice -> u1_bottom_field_flag = 0 ; ps_dec -> ps_cur_slice -> u1_field_pic_flag = 0 ; ps_dec -> ps_cur_slice -> u1_slice_type = P_SLICE ; ps_dec -> ps_cur_slice -> u1_nal_ref_idc = 1 ; ps_dec -> ps_cur_slice -> u1_nal_unit_type = 1 ; <S2SV_ModStart> << u1_mbaff ; ps_dec -> ps_cur_slice -> i1_slice_alpha_c0_offset = 0 ; ps_dec -> ps_cur_slice -> i1_slice_beta_offset = 0 ;
Buggy code:
 void enc624j600UpdateMacConfig ( NetInterface * interface ) { uint16_t duplexMode ; <START_BUG> duplexMode = enc624j600ReadReg ( interface, ENC624J600_REG_ESTAT ) & ESTAT_PHYDPX ; <END_BUG> if ( duplexMode ) {  enc624j600WriteReg ( interface, ENC624J600_REG_MACON2, MACON2_DEFER | <START_BUG> MACON2_PADCFG2 | MACON2_PADCFG0 | MACON2_TXCRCEN | MACON2_R1 | MACON2_FULDPX ) ; <END_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_MABBIPG, 0x15 ) ;  } else { <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_MACON2, MACON2_DEFER | <END_BUG> MACON2_PADCFG2 | MACON2_PADCFG0 | MACON2_TXCRCEN | MACON2_R1 ) ;  enc624j600WriteReg ( interface, ENC624J600_REG_MABBIPG, 0x12 ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> ( interface, ENC624J600_ESTAT ) & ENC624J600_ESTAT_PHYDPX <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( interface, ENC624J600_MACON2, ENC624J600_MACON2_DEFER | ENC624J600_MACON2_PADCFG_AUTO | ENC624J600_MACON2_TXCRCEN | ENC624J600_MACON2_R1_DEFAULT | ENC624J600_MACON2_FULDPX <S2SV_ModEnd> ) ; enc624j600WriteReg <S2SV_ModStart> ( interface, ENC624J600_MABBIPG, ENC624J600_MABBIPG_BBIPG_DEFAULT_FD <S2SV_ModEnd> ) ; } <S2SV_ModStart> ( interface, ENC624J600_MACON2, ENC624J600_MACON2_DEFER | ENC624J600_MACON2_PADCFG_AUTO | ENC624J600_MACON2_TXCRCEN | ENC624J600_MACON2_R1_DEFAULT <S2SV_ModEnd> ) ; enc
Buggy code:
 static void filter_session_io ( struct io * io, int evt, void * arg ) { struct filter_session * fs = arg ; char * line = NULL ; ssize_t len ; log_trace ( TRACE_IO, "filter   session:   %p:   %s   %s", fs, io_strevent ( evt ), io_strio ( io ) ) ; switch ( evt ) { case IO_DATAIN : nextline : line = io_getline ( fs -> io, & len ) ; if ( line == NULL ) return ; filter_data ( fs -> id, line ) ; goto nextline ; <START_BUG> case IO_DISCONNECTED : <END_BUG> io_free ( fs -> io ) ; fs -> io = NULL ; break ; } }

Fix:
<S2SV_ModStart> goto nextline ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 static int vorbis_finish_frame ( stb_vorbis * f, int len, int left, int right ) { int prev, i, j ; if ( f -> previous_length ) { int i, j, n = f -> previous_length ; <START_BUG> float * w = get_window ( f, n ) ; <END_BUG> for ( i = 0 ; i < f -> channels ; ++ i ) { for ( j = 0 ; j < n ; ++ j ) f -> channel_buffers [ i ] [ left + j ] = f -> channel_buffers [ i ] [ left + j ] * w [ j ] + f -> previous_window [ i ] [ j ] * w [ n - 1 - j ] ; } } prev = f -> previous_length ; f -> previous_length = len - right ; for ( i = 0 ; i < f -> channels ; ++ i ) for ( j = 0 ; right + j < len ; ++ j ) f -> previous_window [ i ] [ j ] = f -> channel_buffers [ i ] [ right + j ] ; if (! prev ) return 0 ; if ( len < right ) right = len ; f -> samples_output += right - left ; return right - left ; }

Fix:
<S2SV_ModStart>, n ) ; if ( w == NULL ) return 0
Buggy code:
 int use_conf ( char * test_path ) { int ret ; size_t flags = 0 ; char filename [ 1024 ], errstr [ 1024 ] ; char * buffer ; FILE * infile, * conffile ; json_t * json ; json_error_t error ; sprintf ( filename, "%s%cinput", test_path, dir_sep ) ; if (! ( infile = fopen ( filename, "rb" ) ) ) { fprintf ( stderr, "Could   not   open   \\"%s\\"\\n", filename ) ; return 2 ; } sprintf ( filename, "%s%cenv", test_path, dir_sep ) ; conffile = fopen ( filename, "rb" ) ; if ( conffile ) { read_conf ( conffile ) ; fclose ( conffile ) ; } if ( conf. indent < 0 || conf. indent > 255 ) { fprintf ( stderr, "invalid   value   for   JSON_INDENT:   %d\\n", conf. indent ) ; return 2 ; } if ( conf. indent ) flags |= JSON_INDENT ( conf. indent ) ; if ( conf. compact ) flags |= JSON_COMPACT ; if ( conf. ensure_ascii ) flags |= JSON_ENSURE_ASCII ; if ( conf. preserve_order ) flags |= JSON_PRESERVE_ORDER ; if ( conf. sort_keys ) flags |= JSON_SORT_KEYS ; <START_BUG> if ( conf. strip ) { <END_BUG> buffer = loadfile ( infile ) ; json = json_loads ( strip ( buffer ), 0, & error ) ; free ( buffer ) ; } else json = json_loadf ( infile, 0, & error ) ; fclose ( infile ) ; if (! json ) { sprintf ( errstr, "%d   %d   %d\\n%s\\n", error. line, error. column, error. position, error. text ) ; ret = cmpfile ( errstr, test_path, "error" ) ; return ret ; } buffer = json_dumps ( json, flags ) ; ret = cmpfile ( buffer, test_path, "output" ) ; free ( buffer ) ; json_decref ( json ) ; return ret ; }

Fix:
<S2SV_ModStart> ( conf. have_hashseed ) json_object_seed ( conf. hashseed ) ; if ( conf.
Buggy code:
 static int __f2fs_set_acl ( struct inode * inode, int type, struct posix_acl * acl, struct page * ipage ) { int name_index ; void * value = NULL ; size_t size = 0 ; int error ; switch ( type ) { case ACL_TYPE_ACCESS : name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> error = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( error < 0 ) return error ;  set_acl_inode ( inode, inode -> i_mode ) ; <START_BUG> if ( error == 0 ) acl = NULL ; } break ; case ACL_TYPE_DEFAULT : name_index = F2FS_XATTR_INDEX_POSIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } if ( acl ) { value = f2fs_acl_to_disk ( acl, & size ) ; if ( IS_ERR ( value ) ) { clear_inode_flag ( inode, FI_ACL_MODE ) ; return ( int ) PTR_ERR ( value ) ; } } error = f2fs_setxattr ( inode, name_index, "", value, size, ipage, 0 ) ; kfree ( value ) ; if (! error ) set_cached_acl ( inode, type, acl ) ; clear_inode_flag ( inode, FI_ACL_MODE ) ; return error ; }<END_BUG>

Fix:
<S2SV_ModStart> { error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( error <S2SV_ModEnd> ) return error <S2SV_ModStart> -> i_mode ) <S2SV_ModEnd> ; } break
Buggy code:
 static int amd_gpio_probe ( struct platform_device * pdev ) { int ret = 0 ; int irq_base ; struct resource * res ; struct amd_gpio * gpio_dev ; gpio_dev = devm_kzalloc ( & pdev -> dev, sizeof ( struct amd_gpio ), GFP_KERNEL ) ; if (! gpio_dev ) return - ENOMEM ; spin_lock_init ( & gpio_dev -> lock ) ; res = platform_get_resource ( pdev, IORESOURCE_MEM, 0 ) ; if (! res ) { dev_err ( & pdev -> dev, "Failed   to   get   gpio   io   resource.\\n" ) ; return - EINVAL ; } gpio_dev -> base = devm_ioremap_nocache ( & pdev -> dev, res -> start, resource_size ( res ) ) ; if (! gpio_dev -> base ) return - ENOMEM ; irq_base = platform_get_irq ( pdev, 0 ) ; if ( irq_base < 0 ) { dev_err ( & pdev -> dev, "Failed   to   get   gpio   IRQ.\\n" ) ; return - EINVAL ; } gpio_dev -> pdev = pdev ; gpio_dev -> gc. direction_input = amd_gpio_direction_input ; gpio_dev -> gc. direction_output = amd_gpio_direction_output ; gpio_dev -> gc. get = amd_gpio_get_value ; gpio_dev -> gc. set = amd_gpio_set_value ; gpio_dev -> gc. set_debounce = amd_gpio_set_debounce ; gpio_dev -> gc. dbg_show = amd_gpio_dbg_show ; gpio_dev -> gc. base = 0 ; gpio_dev -> gc. label = pdev -> name ; gpio_dev -> gc. owner = THIS_MODULE ; gpio_dev -> gc. parent = & pdev -> dev ; gpio_dev -> gc. ngpio = TOTAL_NUMBER_OF_PINS ; # if defined ( CONFIG_OF_GPIO ) gpio_dev -> gc. of_node = pdev -> dev. of_

Fix:
<S2SV_ModStart> -> pctrl = devm_pinctrl_register ( & pdev -> dev, <S2SV_ModEnd> & amd_pinctrl_desc, <S2SV_ModStart> & amd_pinctrl_desc, <S2SV_ModEnd> gpio_dev ) ; <S2SV_ModStart> ( ret ) return ret <S2SV_ModEnd> ; ret = <S2SV_ModStart> gc ) ; <S2SV_ModEnd> return ret ;
Buggy code:
 static Image * ReadCINImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define MonoColorType 1 # define RGBColorType 3 char property [ MagickPathExtent ] ; CINInfo cin ; const unsigned char * pixels ; Image * image ; MagickBooleanType status ; MagickOffsetType offset ; QuantumInfo * quantum_info ; QuantumType quantum_type ; register ssize_t i ; register Quantum * q ; size_t length ; ssize_t count, y ; unsigned char magick [ 4 ] ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } offset = 0 ; count = ReadBlob ( image, 4, magick ) ; offset += count ; if ( ( count!= 4 ) || ( ( LocaleNCompare ( ( char * ) magick, "\\200\\052\\137\\327", 4 )!= 0 ) ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; memset ( & cin, 0, sizeof ( cin ) ) ; image -> endian = ( magick [ 0 ] == 0x80 ) && ( magick [ 1 ] == 0x2a ) && ( magick [ 2 ] == 0x5f ) && ( magick [ 3 ] == 0xd7 )? MSBEndian : LSBEndian ; cin. file. image_offset = ReadBlobLong ( image ) ; offset += 4 ; cin. file. generic_length = ReadBlobLong ( image ) ; offset += 4 ; cin. file. industry_length = ReadBlobLong ( image ) ; offset += 4 ; cin. file. user_length = Read

Fix:
<S2SV_ModStart> ) ; } if ( ( ( MagickSizeType ) image -> columns * image -> rows ) > GetBlobSize ( image ) ) ThrowReaderException ( CorruptImageError, "InsufficientImageDataInFile" ) ;
Buggy code:
 static struct key * construct_key_and_link ( struct keyring_search_context * ctx, const char * callout_info, size_t callout_len, void * aux, struct key * dest_keyring, unsigned long flags ) { struct key_user * user ; struct key * key ; int ret ; kenter ( "" ) ; <START_BUG> user = key_user_lookup ( current_fsuid ( ) ) ; <END_BUG> if (! user ) return ERR_PTR ( - ENOMEM ) ; construct_get_dest_keyring ( & dest_keyring ) ; ret = construct_alloc_key ( ctx, dest_keyring, flags, user, & key ) ; key_user_put ( user ) ; if ( ret == 0 ) { ret = construct_key ( key, callout_info, callout_len, aux, dest_keyring ) ; if ( ret < 0 ) { kdebug ( "cons   failed" ) ; goto construction_failed ; } } else if ( ret == - EINPROGRESS ) { ret = 0 ; } else { goto couldnt_alloc_key ; } key_put ( dest_keyring ) ; kleave ( "   =   key   %d", key_serial ( key ) ) ; return key ; construction_failed : key_negate_and_link ( key, key_negative_timeout, NULL, NULL ) ; key_put ( key ) ; couldnt_alloc_key : key_put ( dest_keyring ) ; kleave ( "   =   %d", ret ) ; return ERR_PTR ( ret ) ; }

Fix:
<S2SV_ModStart> "" ) ; if ( ctx -> index_key. type == & key_type_keyring ) return ERR_PTR ( - EPERM ) ;