nus-yam/ex-repair huggingface dataset:
Buggy code:
 static ssize_t k90_show_macro_mode ( struct device * dev, struct device_attribute * attr, char * buf ) { int ret ; struct usb_interface * usbif = to_usb_interface ( dev -> parent ) ; struct usb_device * usbdev = interface_to_usbdev ( usbif ) ; const char * macro_mode ; <START_BUG> char data [ 8 ] ; <END_BUG> ret = usb_control_msg ( usbdev, usb_rcvctrlpipe ( usbdev, 0 ), K90_REQUEST_GET_MODE, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, 0, data, 2, USB_CTRL_SET_TIMEOUT ) ; if ( ret < 0 ) { dev_warn ( dev, "Failed   to   get   K90   initial   mode   (error   %d).\\n", ret ) ;  return - EIO ; <START_BUG> <END_BUG> }  switch ( data [ 0 ] ) { case K90_MACRO_MODE_HW : macro_mode = "HW" ; break ; case K90_MACRO_MODE_SW : macro_mode = "SW" ; break ; default : dev_warn ( dev, "K90   in   unknown   mode:   %02hhx.\\n", data [ 0 ] ) ; <START_BUG> return - EIO ; <END_BUG>  } <START_BUG> return snprintf ( buf, PAGE_SIZE, "%s\\n", macro_mode ) ; }<END_BUG>

Fix:
<S2SV_ModStart> macro_mode ; char * data ; data = kmalloc ( 2, GFP_KERNEL ) ; if (! data ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart> ret ) ; ret = <S2SV_ModEnd> - EIO ; <S2SV_ModStart> - EIO ; goto out ; <S2SV_ModStart> ] ) ; ret = <S2SV_ModEnd> - EIO ; <S2SV_ModStart> - EIO ; goto out ; } ret = snprintf ( buf, PAGE_SIZE, "%s\\n", macro_mode ) ; out : kfree ( data ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static void __inet_del_ifa ( struct in_device * in_dev, struct in_ifaddr * * ifap, int destroy, struct nlmsghdr * nlh, u32 portid ) { struct in_ifaddr * promote = NULL ; struct in_ifaddr * ifa, * ifa1 = * ifap ; struct in_ifaddr * last_prim = in_dev -> ifa_list ; struct in_ifaddr * prev_prom = NULL ; int do_promote = IN_DEV_PROMOTE_SECONDARIES ( in_dev ) ; ASSERT_RTNL ( ) ; <START_BUG> if (! ( ifa1 -> ifa_flags & IFA_F_SECONDARY ) ) { <END_BUG> struct in_ifaddr * * ifap1 = & ifa1 -> ifa_next ; while ( ( ifa = * ifap1 )!= NULL ) { if (! ( ifa -> ifa_flags & IFA_F_SECONDARY ) && ifa1 -> ifa_scope <= ifa -> ifa_scope ) last_prim = ifa ; if (! ( ifa -> ifa_flags & IFA_F_SECONDARY ) || ifa1 -> ifa_mask!= ifa -> ifa_mask ||! inet_ifa_match ( ifa1 -> ifa_address, ifa ) ) { ifap1 = & ifa -> ifa_next ; prev_prom = ifa ; continue ; } if (! do_promote ) { inet_hash_remove ( ifa ) ; * ifap1 = ifa -> ifa_next ; rtmsg_ifa ( RTM_DELADDR, ifa, nlh, portid ) ; blocking_notifier_call_chain ( & inetaddr_chain, NETDEV_DOWN, ifa ) ; inet_free_ifa ( ifa ) ; } else { promote = ifa ; break ; } } } for ( ifa = promote ; ifa ; ifa = ifa -> ifa_next ) { if ( ifa1 -> ifa_mask == ifa -> ifa_mask && inet_ifa_match ( ifa1 -> ifa_address, ifa ) ) fib_del_ifaddr ( ifa, ifa1 ) ;

Fix:
<S2SV_ModStart> ; if ( in_dev -> dead ) goto no_promotions ; if ( <S2SV_ModStart> ) ; } no_promotions :
Buggy code:
 static void update_layer_contexts ( VP8_COMP * cpi ) { VP8_CONFIG * oxcf = & cpi -> oxcf ; if ( oxcf -> number_of_layers > 1 ) { unsigned int i ; double prev_layer_framerate = 0 ; assert ( oxcf -> number_of_layers <= VPX_TS_MAX_LAYERS ) ; <START_BUG> for ( i = 0 ; i < oxcf -> number_of_layers ; i ++ ) <END_BUG> { LAYER_CONTEXT * lc = & cpi -> layer_context [ i ] ; lc -> framerate = cpi -> ref_framerate // oxcf -> rate_decimator [ i ] ; lc -> target_bandwidth = oxcf -> target_bitrate [ i ] * 1000 ; lc -> starting_buffer_level = rescale ( ( int ) oxcf -> starting_buffer_level_in_ms, lc -> target_bandwidth, 1000 ) ; if ( oxcf -> optimal_buffer_level == 0 ) lc -> optimal_buffer_level = lc -> target_bandwidth // 8 ; else lc -> optimal_buffer_level = rescale ( ( int ) oxcf -> optimal_buffer_level_in_ms, lc -> target_bandwidth, 1000 ) ; if ( oxcf -> maximum_buffer_size == 0 ) lc -> maximum_buffer_size = lc -> target_bandwidth // 8 ; else lc -> maximum_buffer_size = rescale ( ( int ) oxcf -> maximum_buffer_size_in_ms, lc -> target_bandwidth, 1000 ) ; if ( i > 0 ) lc -> avg_frame_size_for_layer = ( int ) ( ( oxcf -> target_bitrate [ i ] - oxcf -> target_bitrate [ i - 1 ] ) * 1000 // ( lc -> framerate - prev_layer_framerate ) ) ; prev_layer_framerate = lc -> framerate ; } } }

Fix:
<S2SV_ModStart> oxcf -> number_of_layers && i < VPX_TS_MAX_LAYERS ; ++ i <S2SV_ModEnd> ) { LAYER_CONTEXT
Buggy code:
 <START_BUG> static void <END_BUG> horDiff32 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { TIFFPredictorState * sp = PredictorState ( tif ) ; tmsize_t stride = sp -> stride ; uint32 * wp = ( uint32 * ) cp0 ; tmsize_t wc = cc // 4 ;  assert ( ( cc % ( 4 * stride ) ) == 0 ) ; <START_BUG> if ( wc > stride ) { wc -= stride ; wp += wc - 1 ; do { REPEAT4 ( stride, wp [ stride ] -= wp [ 0 ] ; wp -- ) wc -= stride ; } while ( wc > 0 ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> horDiff32 ( TIFF <S2SV_ModStart> // 4 ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> stride ) )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "horDiff32", "%s", "(cc%(4*stride))!=0" ) ; return 0 ; } <S2SV_ModEnd> if ( wc <S2SV_ModStart> ) ; } return 1 ;
Buggy code:
 void gtkui_conf_read ( void ) { FILE * fd ; const char * path ; char line [ 100 ], name [ 30 ] ; short value ; # ifdef OS_WINDOWS path = ec_win_get_user_dir ( ) ; # else <START_BUG> path = g_get_tmp_dir ( ) ; <END_BUG> # endif filename = g_build_filename ( path, ".ettercap_gtk", NULL ) ; DEBUG_MSG ( "gtkui_conf_read:   %s", filename ) ; fd = fopen ( filename, "r" ) ; if (! fd ) return ; while ( fgets ( line, 100, fd ) ) { sscanf ( line, "%s   =   %hd", name, & value ) ; gtkui_conf_set ( name, value ) ; } fclose ( fd ) ; }

Fix:
<S2SV_ModStart> else path = g_get_home_dir <S2SV_ModEnd> ( ) ;
Buggy code:
 static x86newTokenType getToken ( const char * str, size_t * begin, size_t * end ) { <START_BUG> while ( begin && isspace ( ( ut8 ) str [ * begin ] ) ) { <END_BUG> ++ ( * begin ) ; } if (! str [ * begin ] ) { * end = * begin ; return TT_EOF ;  } else if ( isalpha ( ( ut8 ) str [ * begin ] ) ) { <START_BUG> * end = * begin ; <END_BUG> while ( end && isalnum ( ( ut8 ) str [ * end ] ) ) {  ++ ( * end ) ; } return TT_WORD ; <START_BUG> } else if ( isdigit ( ( ut8 ) str [ * begin ] ) ) { <END_BUG> * end = * begin ; while ( end && isalnum ( ( ut8 ) str [ * end ] ) ) { ++ ( * end ) ; } return TT_NUMBER ; } else { * end = * begin + 1 ; return TT_SPECIAL ; } }

Fix:
<S2SV_ModStart> end ) { if ( * begin > strlen ( str ) ) { return TT_EOF ; } <S2SV_ModStart> ( begin && str [ * begin ] && <S2SV_ModStart> TT_EOF ; } <S2SV_ModEnd> if ( isalpha <S2SV_ModStart> ( end && str [ * end ] && <S2SV_ModStart> TT_WORD ; } <S2SV_ModEnd> if ( isdigit
Buggy code:
 const char * string_of_NPPVariable ( int variable ) { const char * str ; switch ( variable ) { # define _ ( VAL ) case VAL : str = # VAL ; break ; _ ( NPPVpluginNameString ) ; _ ( NPPVpluginDescriptionString ) ; _ ( NPPVpluginWindowBool ) ; _ ( NPPVpluginTransparentBool ) ; _ ( NPPVjavaClass ) ; _ ( NPPVpluginWindowSize ) ; _ ( NPPVpluginTimerInterval ) ; _ ( NPPVpluginScriptableInstance ) ; _ ( NPPVpluginScriptableIID ) ; _ ( NPPVjavascriptPushCallerBool ) ; _ ( NPPVpluginKeepLibraryInMemory ) ; _ ( NPPVpluginNeedsXEmbed ) ; _ ( NPPVpluginScriptableNPObject ) ; _ ( NPPVformValue ) ; <START_BUG> # undef _ <END_BUG> default : switch ( variable & 0xff ) { # define _ ( VAL, VAR ) case VAL : str = # VAR ; break _ ( 10, NPPVpluginScriptableInstance ) ; # undef _ default : str = "<unknown   variable>" ; break ; } break ; } return str ; }

Fix:
<S2SV_ModStart> NPPVformValue ) ; _ ( NPPVpluginUrlRequestsDisplayedBool ) ; _ ( NPPVpluginWantsAllNetworkStreams ) ; _ ( NPPVpluginNativeAccessibleAtkPlugId ) ; _ ( NPPVpluginCancelSrcStream ) ; _ ( NPPVSupportsAdvancedKeyHandling ) ;
Buggy code:
 static int check_submodule_url ( const char * url ) { const char * curl_url ; if ( looks_like_command_line_option ( url ) ) return - 1 ; if ( submodule_url_is_relative ( url ) ) { <START_BUG> char * decoded = url_decode ( url ) ; <END_BUG>  int has_nl =!! strchr ( decoded, '\\n' ) ; <START_BUG> free ( decoded ) ; <END_BUG> if ( has_nl )  return - 1 ; } else if ( url_to_curl_url ( url, & curl_url ) ) { struct credential c = CREDENTIAL_INIT ; int ret = credential_from_url_gently ( & c, curl_url, 1 ) ; credential_clear ( & c ) ; return ret ; } return 0 ; }

Fix:
<S2SV_ModStart> char * decoded ; const char * next ; int has_nl ; decoded <S2SV_ModStart> url ) ; <S2SV_ModEnd> has_nl =! <S2SV_ModStart> if ( has_nl ) return - 1 ; if ( count_leading_dotdots ( url, & next ) > 0 && * next == ':'
Buggy code:
 void pointZZ_pAdd ( PointZZ_p * rop, const PointZZ_p * op1, const PointZZ_p * op2, const CurveZZ_p * curve ) { <START_BUG> mpz_t xdiff, ydiff, lambda ; <END_BUG> mpz_inits ( xdiff, ydiff, lambda, NULL ) ; mpz_sub ( ydiff, op2 -> y, op1 -> y ) ; mpz_sub ( xdiff, op2 -> x, op1 -> x ) ; mpz_invert ( xdiff, xdiff, curve -> p ) ; mpz_mul ( lambda, ydiff, xdiff ) ; mpz_mod ( lambda, lambda, curve -> p ) ; mpz_mul ( rop -> x, lambda, lambda ) ; mpz_sub ( rop -> x, rop -> x, op1 -> x ) ; mpz_sub ( rop -> x, rop -> x, op2 -> x ) ; mpz_mod ( rop -> x, rop -> x, curve -> p ) ; mpz_sub ( rop -> y, op1 -> x, rop -> x ) ; mpz_mul ( rop -> y, lambda, rop -> y ) ; mpz_sub ( rop -> y, rop -> y, op1 -> y ) ; mpz_mod ( rop -> y, rop -> y, curve -> p ) ;  mpz_clears ( xdiff, ydiff, lambda, NULL ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> curve ) { if ( pointZZ_pIsIdentityElement ( op1 ) && pointZZ_pIsIdentityElement ( op2 ) ) { return pointZZ_pSetToIdentityElement ( rop ) ; } else if ( pointZZ_pIsIdentityElement ( op1 ) ) { mpz_set ( rop -> x, op2 -> x ) ; mpz_set ( rop -> y, op2 -> y ) ; return ; } else if ( pointZZ_pIsIdentityElement ( op2 ) ) { mpz_set ( rop -> x, op1 -> x ) ; mpz_set ( rop -> y, op1 -> y ) ; return ; } if ( pointZZ_pEqual ( op1, op2 ) ) { pointZZ_pDouble ( rop, op1, curve ) ; return ; } mpz_t negy ; mpz_init ( negy ) ; mpz_sub ( negy, curve -> p, op2 -> y ) ; if ( mpz_cmp ( op1 -> x, op2 -> x ) == 0 && mpz_cmp ( op1 -> y, negy ) == 0 ) { mp
Buggy code:
 PyObject * ast2obj_withitem ( void * _o ) { withitem_ty o = ( withitem_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } result = PyType_GenericNew ( withitem_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_expr ( o -> context_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_context_expr, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> optional_vars ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_optional_vars, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } result
Buggy code:
 static int fst_get_iface ( struct fst_card_info * card, struct fst_port_info * port, struct ifreq * ifr ) { sync_serial_settings sync ; int i ; switch ( port -> hwif ) { case E1 : ifr -> ifr_settings. type = IF_IFACE_E1 ; break ; case T1 : ifr -> ifr_settings. type = IF_IFACE_T1 ; break ; case V35 : ifr -> ifr_settings. type = IF_IFACE_V35 ; break ; case V24 : ifr -> ifr_settings. type = IF_IFACE_V24 ; break ; case X21D : ifr -> ifr_settings. type = IF_IFACE_X21D ; break ; case X21 : default : ifr -> ifr_settings. type = IF_IFACE_X21 ; break ; } if ( ifr -> ifr_settings. size == 0 ) { return 0 ; } if ( ifr -> ifr_settings. size < sizeof ( sync ) ) { return - ENOMEM ; } i = port -> index ; <START_BUG> sync. clock_rate = FST_RDL ( card, portConfig [ i ]. lineSpeed ) ; <END_BUG> sync. clock_type = FST_RDB ( card, portConfig [ i ]. internalClock ) == INTCLK? CLOCK_INT : CLOCK_EXT ; sync. loopback = 0 ; if ( copy_to_user ( ifr -> ifr_settings. ifs_ifsu. sync, & sync, sizeof ( sync ) ) ) { return - EFAULT ; } ifr -> ifr_settings. size = sizeof ( sync ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> index ; memset ( & sync, 0, sizeof ( sync ) ) ;
Buggy code:
 <START_BUG> static void optimize_b ( int plane, int block, BLOCK_SIZE plane_bsize, <END_BUG>  TX_SIZE tx_size, MACROBLOCK * mb, <START_BUG> ENTROPY_CONTEXT * a, ENTROPY_CONTEXT * l ) { MACROBLOCKD * const xd = & mb -> e_mbd ; <END_BUG> struct macroblock_plane * p = & mb -> plane [ plane ] ;  <START_BUG> struct macroblockd_plane * pd = & xd -> plane [ plane ] ; <END_BUG> const int ref = is_inter_block ( & xd -> mi [ 0 ] -> mbmi ) ; vp9_token_state tokens [ 1025 ] [ 2 ] ; unsigned best_index [ 1025 ] [ 2 ] ;  const int16_t * coeff = BLOCK_OFFSET ( mb -> plane [ plane ]. coeff, block ) ; <START_BUG> <END_BUG> int16_t * qcoeff = BLOCK_OFFSET ( p -> qcoeff, block ) ;  <START_BUG> int16_t * dqcoeff = BLOCK_OFFSET ( pd -> dqcoeff, block ) ; <END_BUG>  int eob = p -> eobs [ block ], final_eob, sz = 0 ; <START_BUG> const int i0 = 0 ; int rc, x, next, i ; int64_t rdmult, rddiv, rd_cost0, rd_cost1 ; int rate0, rate1, error0, error1, t0, t1 ; int best, band, pt ; <END_BUG> PLANE_TYPE type = pd -> plane_type ;  int err_mult = plane_rd_mult [ type ] ; const int default_eob = 16 << ( tx_size << 1 ) ; const int mul = 1 + ( tx_size == TX_32X32 ) ; <START_BUG> uint8_t token_cache [ 1024 ] ; <END_BUG>  const int16_t * dequant_ptr = pd -> dequant ; <START_BUG> const uint8_t * const band_translate = get_band_translate ( tx_size ) ; const scan_order * so = get_scan ( xd, tx_size, type, block ) ; <END_BUG> const int16_t * scan = so -> scan ;  const int16_t * nb = so -> neighbors ; assert ( (! type &&! plane ) || ( type && plane ) ) ; assert ( eob <= default_eob ) ; <START_BUG> rd<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int optimize_b ( MACROBLOCK * mb, <S2SV_ModEnd> int plane, <S2SV_ModStart> int block, <S2SV_ModEnd> TX_SIZE tx_size, <S2SV_ModStart> TX_SIZE tx_size, int ctx <S2SV_ModEnd> ) { MACROBLOCKD <S2SV_ModStart> struct macroblock_plane * const <S2SV_ModStart> struct macroblockd_plane * const <S2SV_ModStart> 2 ] ; uint8_t token_cache [ 1024 ] ; const tran_low_t * const <S2SV_ModEnd> coeff = BLOCK_OFFSET <S2SV_ModStart> block ) ; tran_low_t * const <S2SV_ModEnd> qcoeff = BLOCK_OFFSET <S2SV_ModStart> block ) ; tran_low_t * const <S2SV_ModEnd> dqcoeff = BLOCK_OFFSET <S2SV_ModStart> block ) ; const <S2SV_ModStart> [ block ] ; const <S2SV_ModEnd> PLANE_TYPE type = <S2SV_ModStart> pd -> plane_type <S2SV_ModEnd> ; const int <S2SV_ModStart> TX_32X32 ) ; const int16_t * dequant_ptr = pd -> dequant ; const uint8_t * const band_translate = get_band_translate ( tx_size ) ; const scan_order * const so = get_scan ( xd, tx_size, type, block ) <S2SV_ModEnd> ; const int16_t <S2SV_ModStart> const int16_t *
Buggy code:
 static int fetch_uidl ( char * line, void * data ) { int i, index ; struct Context * ctx = ( struct Context * ) data ; struct PopData * pop_data = ( struct PopData * ) ctx -> data ; char * endp = NULL ; errno = 0 ; index = strtol ( line, & endp, 10 ) ; if ( errno ) return - 1 ; while ( * endp ==' ') endp ++ ; memmove ( line, endp, strlen ( endp ) + 1 ) ; <START_BUG> for ( i = 0 ; i < ctx -> msgcount ; i ++ ) <END_BUG> if ( mutt_str_strcmp ( line, ctx -> hdrs [ i ] -> data ) == 0 ) break ; if ( i == ctx -> msgcount ) { mutt_debug ( 1, "new   header   %d   %s\\n", index, line ) ; if ( i >= ctx -> hdrmax ) mx_alloc_memory ( ctx ) ; ctx -> msgcount ++ ; ctx -> hdrs [ i ] = mutt_header_new ( ) ; ctx -> hdrs [ i ] -> data = mutt_str_strdup ( line ) ; } else if ( ctx -> hdrs [ i ] -> index!= index - 1 ) pop_data -> clear_cache = true ; ctx -> hdrs [ i ] -> refno = index ; ctx -> hdrs [ i ] -> index = index - 1 ; return 0 ; }

Fix:
<S2SV_ModStart> 1 ) ; if ( strlen ( line ) == 0 ) return - 1 ;
Buggy code:
 int ASN1_item_verify ( const ASN1_ITEM * it, X509_ALGOR * a, ASN1_BIT_STRING * signature, void * asn, EVP_PKEY * pkey ) { EVP_MD_CTX ctx ; unsigned char * buf_in = NULL ; int ret = - 1, inl ; int mdnid, pknid ; if (! pkey ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ERR_R_PASSED_NULL_PARAMETER ) ; return - 1 ; } if ( signature -> type == V_ASN1_BIT_STRING && signature -> flags & 0x7 ) { <START_BUG> ASN1err ( ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT ) ; <END_BUG> return - 1 ; } EVP_MD_CTX_init ( & ctx ) ; if (! OBJ_find_sigid_algs ( OBJ_obj2nid ( a -> algorithm ), & mdnid, & pknid ) ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM ) ; goto err ; } if ( mdnid == NID_undef ) { if (! pkey -> ameth ||! pkey -> ameth -> item_verify ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM ) ; goto err ; } ret = pkey -> ameth -> item_verify ( & ctx, it, asn, a, signature, pkey ) ; if ( ret!= 2 ) goto err ; ret = - 1 ; } else { const EVP_MD * type ; type = EVP_get_digestbynid ( mdnid ) ; if ( type == NULL ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ) ; goto err ; } if ( EVP_PKEY_type ( pknid )!= pkey -> ameth -> pkey_id ) { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_WRONG_PUBLIC_KEY_TYPE ) ; goto err ; } if (! EVP_DigestVerifyInit ( & ctx

Fix:
<S2SV_ModStart> { ASN1err ( ASN1_F_ASN1_ITEM_VERIFY <S2SV_ModEnd>, ASN1_R_INVALID_BIT_STRING_BITS_LEFT )
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * inpic ) { KerndeintContext * kerndeint = inlink -> dst -> priv ; AVFilterLink * outlink = inlink -> dst -> outputs [ 0 ] ; AVFrame * outpic ; const uint8_t * prvp ; const uint8_t * prvpp ; const uint8_t * prvpn ; const uint8_t * prvppp ; const uint8_t * prvpnn ; const uint8_t * prvp4p ; const uint8_t * prvp4n ; const uint8_t * srcp ; const uint8_t * srcpp ; const uint8_t * srcpn ; const uint8_t * srcppp ; const uint8_t * srcpnn ; const uint8_t * srcp3p ; const uint8_t * srcp3n ; const uint8_t * srcp4p ; const uint8_t * srcp4n ; uint8_t * dstp, * dstp_saved ; const uint8_t * srcp_saved ; int src_linesize, psrc_linesize, dst_linesize, bwidth ; int x, y, plane, val, hi, lo, g, h, n = kerndeint -> frame ++ ; double valf ; const int thresh = kerndeint -> thresh ; const int order = kerndeint -> order ; const int map = kerndeint -> map ; const int sharp = kerndeint -> sharp ; const int twoway = kerndeint -> twoway ; const int is_packed_rgb = kerndeint -> is_packed_rgb ; outpic = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! outpic ) { av_frame_free ( & inpic ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( outpic, inpic ) ; outpic -> interlaced_frame = 0 ; <START_BUG> for ( plane = 0 ; inpic -> data [ plane ] && plane < 4 ; plane ++ ) { <END_BUG> h = plane == 0? inlink -> h : FF_CEIL_RSHIFT ( inlink -> h, kerndeint -> v

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> plane < 4 <S2SV_ModStart> plane < 4 && inpic -> data [ plane ] && inpic -> linesize [ plane ]
Buggy code:
 static BOOL rdp_read_font_capability_set ( wStream * s, UINT16 length, rdpSettings * settings ) { WINPR_UNUSED ( settings ) ; <START_BUG> if ( length > 4 ) <END_BUG> Stream_Seek_UINT16 ( s ) ;  if ( length > 6 ) <START_BUG> Stream_Seek_UINT16 ( s ) ; return TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> ( length > 5 <S2SV_ModEnd> ) Stream_Seek_UINT16 ( <S2SV_ModStart> ( length > 7 <S2SV_ModEnd> ) Stream_Seek_UINT16 (
Buggy code:
 static int decode_nal_unit ( HEVCContext * s, const H2645NAL * nal ) { HEVCLocalContext * lc = s -> HEVClc ; GetBitContext * gb = & lc -> gb ; int ctb_addr_ts, ret ; * gb = nal -> gb ; s -> nal_unit_type = nal -> type ; s -> temporal_id = nal -> temporal_id ; switch ( s -> nal_unit_type ) { case HEVC_NAL_VPS : if ( s -> avctx -> hwaccel && s -> avctx -> hwaccel -> decode_params ) { ret = s -> avctx -> hwaccel -> decode_params ( s -> avctx, nal -> type, nal -> raw_data, nal -> raw_size ) ; if ( ret < 0 ) goto fail ; } ret = ff_hevc_decode_nal_vps ( gb, s -> avctx, & s -> ps ) ; if ( ret < 0 ) goto fail ; break ; case HEVC_NAL_SPS : if ( s -> avctx -> hwaccel && s -> avctx -> hwaccel -> decode_params ) { ret = s -> avctx -> hwaccel -> decode_params ( s -> avctx, nal -> type, nal -> raw_data, nal -> raw_size ) ; if ( ret < 0 ) goto fail ; } ret = ff_hevc_decode_nal_sps ( gb, s -> avctx, & s -> ps, s -> apply_defdispwin ) ; if ( ret < 0 ) goto fail ; break ; case HEVC_NAL_PPS : if ( s -> avctx -> hwaccel && s -> avctx -> hwaccel -> decode_params ) { ret = s -> avctx -> hwaccel -> decode_params ( s -> avctx, nal -> type, nal -> raw_data, nal -> raw_size ) ; if ( ret < 0 ) goto fail ; } ret = ff_hevc_decode_nal_pps ( gb, s -> avctx, & s -> ps ) ; if ( ret < 0 ) goto fail ; break ; case HEVC_NAL_SEI_PREFIX : case HEVC_NAL_SEI_SUFFIX : if (

Fix:
<S2SV_ModStart> return ret ; if ( ret == 1 ) { ret = AVERROR_INVALIDDATA ; goto fail ; } <S2SV_ModStart> ( s -> <S2SV_ModEnd> max_ra == INT_MAX
Buggy code:
 <START_BUG> static int shash_no_setkey ( struct crypto_shash * tfm, const u8 * key, <END_BUG> unsigned int keylen ) { return - ENOSYS ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> int shash_no_setkey (
Buggy code:
 GF_Err HintFile ( GF_ISOFile * file, u32 MTUSize, u32 max_ptime, u32 rtp_rate, u32 base_flags, Bool copy_data, Bool interleave, Bool regular_iod, Bool single_group, Bool hint_no_offset ) { GF_ESD * esd ; GF_InitialObjectDescriptor * iod ; u32 i, val, res, streamType ; u32 sl_mode, prev_ocr, single_ocr, nb_done, tot_bw, bw, flags, spec_type ; GF_Err e ; char szPayload [ 30 ] ; GF_RTPHinter * hinter ; Bool copy, has_iod, single_av ; u8 init_payt = BASE_PAYT ; u32 mtype ; GF_SDP_IODProfile iod_mode = GF_SDP_IOD_NONE ; u32 media_group = 0 ; u8 media_prio = 0 ; tot_bw = 0 ; prev_ocr = 0 ; single_ocr = 1 ; has_iod = 1 ; iod = ( GF_InitialObjectDescriptor * ) gf_isom_get_root_od ( file ) ; if (! iod ) has_iod = 0 ; else { if (! gf_list_count ( iod -> ESDescriptors ) ) has_iod = 0 ; gf_odf_desc_del ( ( GF_Descriptor * ) iod ) ; } spec_type = gf_isom_guess_specification ( file ) ; single_av = single_group? 1 : gf_isom_is_single_av ( file ) ; for ( i = 0 ; i < gf_isom_get_track_count ( file ) ; i ++ ) { res = gf_isom_get_media_type ( file, i + 1 ) ; if ( ( res == GF_ISOM_MEDIA_SCENE ) || ( res == GF_ISOM_MEDIA_OD ) ) { if ( gf_isom_is_track_in_root_od ( file, i + 1 ) ) { gf_isom_set_default_sync_track ( file, i + 1 ) ; break ; } } } nb_done =

Fix:
<S2SV_ModStart> if ( esd && esd -> decoderConfig
Buggy code:
 static int wdm_post_reset ( struct usb_interface * intf ) { struct wdm_device * desc = wdm_find_device ( intf ) ; <START_BUG> int rv ; <END_BUG> clear_bit ( WDM_RESETTING, & desc -> flags ) ; rv = recover_from_urb_loss ( desc ) ; mutex_unlock ( & desc -> wlock ) ; mutex_unlock ( & desc -> rlock ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; int rv ; clear_bit ( WDM_OVERFLOW, & desc -> flags )
Buggy code:
 static void tree_to_node ( void * data, BLOCK_SIZE bsize, variance_node * node ) { int i ; <START_BUG> switch ( bsize ) { <END_BUG> case BLOCK_64X64 : { v64x64 * vt = ( v64x64 * ) data ; node -> part_variances = & vt -> part_variances ; for ( i = 0 ; i < 4 ; i ++ ) node -> split [ i ] = & vt -> split [ i ]. part_variances. none ; break ; } case BLOCK_32X32 : { v32x32 * vt = ( v32x32 * ) data ; node -> part_variances = & vt -> part_variances ; for ( i = 0 ; i < 4 ; i ++ ) node -> split [ i ] = & vt -> split [ i ]. part_variances. none ; break ; } case BLOCK_16X16 : { v16x16 * vt = ( v16x16 * ) data ; node -> part_variances = & vt -> part_variances ; for ( i = 0 ; i < 4 ; i ++ ) node -> split [ i ] = & vt -> split [ i ]. part_variances. none ; break ; } case BLOCK_8X8 : { v8x8 * vt = ( v8x8 * ) data ; node -> part_variances = & vt -> part_variances ; for ( i = 0 ; i < 4 ; i ++ )  node -> split [ i ] = & vt -> split [ i ] ; <START_BUG> break ; } default : { assert ( 0 ) ; <END_BUG> }  } }

Fix:
<S2SV_ModStart> int i ; node -> part_variances = NULL ; <S2SV_ModStart> [ i ]. part_variances. none ; break ; } case BLOCK_4X4 : { v4x4 * vt = ( v4x4 * ) data ; node -> part_variances = & vt -> part_variances ; for ( i = 0 ; i < 4 ; i ++ ) node -> split [ i ] = & vt -> split [ i ] <S2SV_ModStart> 0 ) ; break ;
Buggy code:
 static int sco_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct sco_pinfo * pi = sco_pi ( sk ) ; lock_sock ( sk ) ; if ( sk -> sk_state == BT_CONNECT2 && test_bit ( BT_SK_DEFER_SETUP, & bt_sk ( sk ) -> flags ) ) { hci_conn_accept ( pi -> conn -> hcon, 0 ) ; sk -> sk_state = BT_CONFIG ; <START_BUG> release_sock ( sk ) ; <END_BUG> return 0 ; } release_sock ( sk ) ; return bt_sock_recvmsg ( iocb, sock, msg, len, flags ) ; }

Fix:
<S2SV_ModStart> = BT_CONFIG ; msg -> msg_namelen = 0 ;
Buggy code:
 static int init_items ( struct MACH0_ ( obj_t ) * bin ) { struct load_command lc = { 0, 0 } ; ut8 loadc [ sizeof ( struct load_command ) ] = { 0 } ; bool is_first_thread = true ; ut64 off = 0LL ; int i, len ; bin -> uuidn = 0 ; bin -> os = 0 ; bin -> has_crypto = 0 ; if ( bin -> hdr. sizeofcmds > bin -> size ) { bprintf ( "Warning:   chopping   hdr.sizeofcmds\\n" ) ; bin -> hdr. sizeofcmds = bin -> size - 128 ; } for ( i = 0, off = sizeof ( struct MACH0_ ( mach_header ) ) ; i < bin -> hdr. ncmds ; i ++, off += lc. cmdsize ) { if ( off > bin -> size || off + sizeof ( struct load_command ) > bin -> size ) { bprintf ( "mach0:   out   of   bounds   command\\n" ) ; return false ; } len = r_buf_read_at ( bin -> b, off, loadc, sizeof ( struct load_command ) ) ; if ( len < 1 ) { bprintf ( "Error:   read   (lc)   at   0x%08" PFMT64x "\\n", off ) ; return false ; } lc. cmd = r_read_ble32 ( & loadc [ 0 ], bin -> big_endian ) ; lc. cmdsize = r_read_ble32 ( & loadc [ 4 ], bin -> big_endian ) ; if ( lc. cmdsize < 1 || off + lc. cmdsize > bin -> size ) { bprintf ( "Warning:   mach0_header   %d   =   cmdsize<1.\\n", i ) ; break ; } sdb_num_set ( bin -> kv, sdb_fmt ( 0, "mach0_cmd_%d.offset", i ), off, 0 ) ; sdb_set ( bin -> kv, sdb_fmt ( 0, "mach0_cmd_%d.format", i ), "xd   cmd   size", 0 ) ; switch ( lc. cmd ) { case LC_DATA_IN_CODE : sdb

Fix:
<S2SV_ModStart> -> dyld_info = calloc ( 1, <S2SV_ModEnd> sizeof ( struct <S2SV_ModStart> ; if ( bin -> dyld_info ) { if ( <S2SV_ModStart> "Cannot <S2SV_blank> parse <S2SV_blank> dyldinfo\\n" ) ; R_FREE <S2SV_ModEnd> ( bin -> <S2SV_ModStart> ; } } }
Buggy code:
 static void free_huge_page ( struct page * page ) { struct hstate * h = page_hstate ( page ) ; int nid = page_to_nid ( page ) ; <START_BUG> struct address_space * mapping ; <END_BUG> mapping = ( struct address_space * ) page_private ( page ) ; set_page_private ( page, 0 ) ; page -> mapping = NULL ; BUG_ON ( page_count ( page ) ) ; BUG_ON ( page_mapcount ( page ) ) ; INIT_LIST_HEAD ( & page -> lru ) ; spin_lock ( & hugetlb_lock ) ; if ( h -> surplus_huge_pages_node [ nid ] && huge_page_order ( h ) < MAX_ORDER ) { update_and_free_page ( h, page ) ; h -> surplus_huge_pages -- ; h -> surplus_huge_pages_node [ nid ] -- ; } else { enqueue_huge_page ( h, page ) ; } spin_unlock ( & hugetlb_lock ) ;  if ( mapping ) <START_BUG> hugetlb_put_quota ( mapping, 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ; struct hugepage_subpool * spool = ( struct hugepage_subpool <S2SV_ModEnd> * ) page_private <S2SV_ModStart> hugetlb_lock ) ; hugepage_subpool_put_pages ( spool <S2SV_ModEnd>, 1 )
Buggy code:
 static void ndisc_router_discovery ( struct sk_buff * skb ) { struct ra_msg * ra_msg = ( struct ra_msg * ) skb_transport_header ( skb ) ; struct neighbour * neigh = NULL ; struct inet6_dev * in6_dev ; struct rt6_info * rt = NULL ; int lifetime ; struct ndisc_options ndopts ; int optlen ; unsigned int pref = 0 ; __u8 * opt = ( __u8 * ) ( ra_msg + 1 ) ; optlen = ( skb_tail_pointer ( skb ) - skb_transport_header ( skb ) ) - sizeof ( struct ra_msg ) ; ND_PRINTK ( 2, info, "RA:   %s,   dev:   %s\\n", __func__, skb -> dev -> name ) ; if (! ( ipv6_addr_type ( & ipv6_hdr ( skb ) -> saddr ) & IPV6_ADDR_LINKLOCAL ) ) { ND_PRINTK ( 2, warn, "RA:   source   address   is   not   link-local\\n" ) ; return ; } if ( optlen < 0 ) { ND_PRINTK ( 2, warn, "RA:   packet   too   short\\n" ) ; return ; } # ifdef CONFIG_IPV6_NDISC_NODETYPE if ( skb -> ndisc_nodetype == NDISC_NODETYPE_HOST ) { ND_PRINTK ( 2, warn, "RA:   from   host   or   unauthorized   router\\n" ) ; return ; } # endif in6_dev = __in6_dev_get ( skb -> dev ) ; if ( in6_dev == NULL ) { ND_PRINTK ( 0, err, "RA:   can\'t   find   inet6   device   for   %s\\n", skb -> dev -> name ) ; return ; } if (! ndisc_parse_options ( opt, optlen, & ndopts ) ) { ND_PRINTK ( 2, warn, "RA:   invalid   ND   options\\n" ) ; return ; } if (! ipv6_accept_ra ( in6_dev ) ) {

Fix:
<S2SV_ModStart> icmp6_hop_limit ) { if ( <S2SV_ModStart> cnf. hop_limit < <S2SV_ModEnd> ra_msg -> icmph <S2SV_ModStart> icmph. icmp6_hop_limit ) { in6_dev -> cnf. hop_limit = ra_msg -> icmph. icmp6_hop_limit ; } else { ND_PRINTK ( 2, warn, "RA: <S2SV_blank> Got <S2SV_blank> route <S2SV_blank> advertisement <S2SV_blank> with <S2SV_blank> lower <S2SV_blank> hop_limit <S2SV_blank> than <S2SV_blank> current\\n" ) ; } <S2SV_ModEnd> if ( rt
Buggy code:
 static PyMemoTable * PyMemoTable_Copy ( PyMemoTable * self ) { <START_BUG> Py_ssize_t i ; <END_BUG> PyMemoTable * new = PyMemoTable_New ( ) ; if ( new == NULL ) return NULL ; new -> mt_used = self -> mt_used ; new -> mt_allocated = self -> mt_allocated ; new -> mt_mask = self -> mt_mask ; PyMem_FREE ( new -> mt_table ) ; new -> mt_table = PyMem_NEW ( PyMemoEntry, self -> mt_allocated ) ; if ( new -> mt_table == NULL ) { PyMem_FREE ( new ) ; PyErr_NoMemory ( ) ; return NULL ; }  for ( i = 0 ; i < self -> mt_allocated ; i ++ ) { <START_BUG> Py_XINCREF ( self -> mt_table [ i ]. me_key ) ; } memcpy ( new -> mt_table, self -> mt_table, sizeof ( PyMemoEntry ) * self -> mt_allocated ) ; return new ; }<END_BUG>

Fix:
<S2SV_ModStart> self ) { <S2SV_ModEnd> PyMemoTable * new <S2SV_ModStart> } for ( size_t
Buggy code:
 static apr_byte_t oidc_validate_post_logout_url ( request_rec * r, const char * url, char * * err_str, char * * err_desc ) { apr_uri_t uri ; const char * c_host = NULL ; if ( apr_uri_parse ( r -> pool, url, & uri )!= APR_SUCCESS ) { * err_str = apr_pstrdup ( r -> pool, "Malformed   URL" ) ; * err_desc = apr_psprintf ( r -> pool, "Logout   URL   malformed:   %s", url ) ; oidc_error ( r, "%s:   %s", * err_str, * err_desc ) ; return FALSE ; } c_host = oidc_get_current_url_host ( r ) ; if ( ( uri. hostname!= NULL ) && ( ( strstr ( c_host, uri. hostname ) == NULL ) || ( strstr ( uri. hostname, c_host ) == NULL ) ) ) { * err_str = apr_pstrdup ( r -> pool, "Invalid   Request" ) ; * err_desc = apr_psprintf ( r -> pool, "logout   value   \\"%s\\"   does   not   match   the   hostname   of   the   current   request   \\"%s\\"", apr_uri_unparse ( r -> pool, & uri, 0 ), c_host ) ; oidc_error ( r, "%s:   %s", * err_str, * err_desc ) ; return FALSE ; <START_BUG> } else if ( strstr ( url, "//" )!= url ) { <END_BUG> * err_str = apr_pstrdup ( r -> pool, "Malformed   URL" ) ; * err_desc = apr_psprintf ( r -> pool, "No   hostname   was   parsed   and   it   does   not   seem   to   be   relative,   i.e   starting   with   \'//\':   %s", url ) ; oidc_error ( r, "%s:   %s", * err_str, * err_desc ) ; return FALSE ; } if ( ( ( strstr ( url, "\\n" )!= NULL ) || strstr ( url

Fix:
<S2SV_ModStart> else if ( ( uri. hostname == NULL ) && ( <S2SV_ModStart>!= url ) )
Buggy code:
 static vpx_codec_err_t ctrl_get_display_size ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctrl_id, va_list args ) { <END_BUG> int * const display_size = va_arg ( args, int * ) ;  if ( display_size ) { <START_BUG> <END_BUG> if ( ctx -> pbi ) {  <START_BUG> const VP9_COMMON * const cm = & ctx -> pbi -> common ; <END_BUG> display_size [ 0 ] = cm -> display_width ; display_size [ 1 ] = cm -> display_height ;  } else { <START_BUG> return VPX_CODEC_ERROR ; } <END_BUG> return VPX_CODEC_OK ;  } else { return VPX_CODEC_INVALID_PARAM ; } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> ; if ( ctx -> frame_parallel_decode ) { set_error_detail ( ctx, "Not <S2SV_blank> supported <S2SV_blank> in <S2SV_blank> frame <S2SV_blank> parallel <S2SV_blank> decode" ) ; return VPX_CODEC_INCAPABLE ; } if ( <S2SV_ModStart> ( ctx -> frame_workers ) { VPxWorker * const worker = ctx -> frame_workers ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; <S2SV_ModEnd> const VP9_COMMON * <S2SV_ModStart> cm = & frame_worker_data <S2SV_ModEnd> -> pbi -> <S2SV_ModStart> -> display_height ; return VPX_CODEC_OK ; <S2SV_ModStart> VPX_CODEC_ERROR ; } } <S2SV_ModEnd> return VPX_CODEC_INVALID_PARAM ; <S2SV_ModStart> VPX_CODEC_INVALID_PARAM ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static void br_multicast_del_pg ( struct net_bridge * br, struct net_bridge_port_group * pg ) { struct net_bridge_mdb_htable * mdb ; struct net_bridge_mdb_entry * mp ; struct net_bridge_port_group * p ; struct net_bridge_port_group __rcu * * pp ; mdb = mlock_dereference ( br -> mdb, br ) ; mp = br_mdb_ip_get ( mdb, & pg -> addr ) ; if ( WARN_ON (! mp ) ) return ; for ( pp = & mp -> ports ; ( p = mlock_dereference ( * pp, br ) )!= NULL ; pp = & p -> next ) { if ( p!= pg ) continue ; rcu_assign_pointer ( * pp, p -> next ) ; hlist_del_init ( & p -> mglist ) ; del_timer ( & p -> timer ) ; call_rcu_bh ( & p -> rcu, br_multicast_free_pg ) ; <START_BUG> if (! mp -> ports &&! mp -> mglist && <END_BUG> netif_running ( br -> dev ) ) mod_timer ( & mp -> timer, jiffies ) ; return ; } WARN_ON ( 1 ) ; }

Fix:
<S2SV_ModStart> -> mglist && mp -> timer_armed &&
Buggy code:
 static Image * ReadDDSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status, cubemap = MagickFalse, volume = MagickFalse, matte ; CompressionType compression ; DDSInfo dds_info ; DDSDecoder * decoder ; size_t n, num_images ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } if ( ReadDDSInfo ( image, & dds_info )!= MagickTrue ) { ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; } if ( dds_info. ddscaps2 & DDSCAPS2_CUBEMAP ) cubemap = MagickTrue ; if ( dds_info. ddscaps2 & DDSCAPS2_VOLUME && dds_info. depth > 0 ) volume = MagickTrue ; ( void ) SeekBlob ( image, 128, SEEK_SET ) ; if ( dds_info. pixelformat. flags & DDPF_RGB ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { matte = MagickTrue ; decoder = ReadUncompressedRGBA ; } else { matte = MagickTrue ; decoder = ReadUncompressedRGB ; } } else if ( dds_info. pixelformat. flags & DDPF_LUMINANCE ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { ThrowReaderException ( CorruptImageError, "ImageTypeNotSupported" ) ; } else { matte = MagickFalse ; decoder = ReadUn

Fix:
<S2SV_ModStart> 0 ) { if ( EOFBlob ( image )!= MagickFalse ) ThrowReaderException ( CorruptImageError, "UnexpectedEndOfFile" ) ;
Buggy code:
 static Image * ReadHALDImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; size_t cube_size, level ; ssize_t y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; level = 0 ; if ( * image_info -> filename!= '\\0' ) level = StringToUnsignedLong ( image_info -> filename ) ; if ( level < 2 ) level = 8 ; status = MagickTrue ; cube_size = level * level ; image -> columns = ( size_t ) ( level * cube_size ) ; image -> rows = ( size_t ) ( level * cube_size ) ; <START_BUG> for ( y = 0 ; y < ( ssize_t ) image -> rows ; y += ( ssize_t ) level ) <END_BUG> { ssize_t blue, green, red ; register PixelPacket * restrict q ; if ( status == MagickFalse ) continue ; q = QueueAuthenticPixels ( image, 0, y, image -> columns, ( size_t ) level, exception ) ; if ( q == ( PixelPacket * ) NULL ) { status = MagickFalse ; continue ; } blue = y // ( ssize_t ) level ; for ( green = 0 ; green < ( ssize_t ) cube_size ; green ++ ) { for ( red = 0 ; red < ( ssize_t ) cube_size ; red ++ ) { SetPixelRed ( q, ClampToQuantum ( ( MagickRealType ) ( QuantumRange * red // ( cube_size - 1.0 ) ) ) ) ; SetPixelGreen ( q, ClampToQuantum ( ( MagickRealType ) ( QuantumRange * green // ( cube_size - 1.0 ) ) ) ) ; SetPixelBlue ( q, ClampToQuantum ( ( MagickRealType ) ( QuantumRange * blue // ( cube

Fix:
<S2SV_ModStart> cube_size ) ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 unsigned int ip6t_do_table ( struct sk_buff * skb, const struct nf_hook_state * state, struct xt_table * table ) { unsigned int hook = state -> hook ; static const char nulldevname [ IFNAMSIZ ] __attribute__ ( ( aligned ( sizeof ( long ) ) ) ) ; unsigned int verdict = NF_DROP ; const char * indev, * outdev ; const void * table_base ; struct ip6t_entry * e, * * jumpstack ; unsigned int stackidx, cpu ; const struct xt_table_info * private ; struct xt_action_param acpar ; unsigned int addend ; stackidx = 0 ; indev = state -> in? state -> in -> name : nulldevname ; outdev = state -> out? state -> out -> name : nulldevname ; acpar. hotdrop = false ; acpar. state = state ; WARN_ON (! ( table -> valid_hooks & ( 1 << hook ) ) ) ; local_bh_disable ( ) ; addend = xt_write_recseq_begin ( ) ; private = READ_ONCE ( table -> private ) ; cpu = smp_processor_id ( ) ; table_base = private -> entries ; jumpstack = ( struct ip6t_entry * * ) private -> jumpstack [ cpu ] ; if ( static_key_false ( & xt_tee_enabled ) ) jumpstack += private -> stacksize * __this_cpu_read ( nf_skb_duplicated ) ; e = get_entry ( table_base, private -> hook_entry [ hook ] ) ; do { const struct xt_entry_target * t ; const struct xt_entry_match * ematch ; struct xt_counters * counter ; WARN_ON (! e ) ; acpar. thoff = 0 ; if (! ip6_packet_match ( skb, indev, outdev, & e -> ipv6, & acpar. thoff, & acpar. fragoff, & acpar. hotdrop ) ) { no_match : e = ip6t_next_entry ( e ) ; continue ; } xt_ematch_foreach ( ematch, e ) { acpar. match = ematch -> u. kernel. match ; acpar. matchinfo = ematch -> data ;

Fix:
<S2SV_ModStart> ) ) { if ( unlikely ( stackidx >= private -> stacksize ) ) { verdict = NF_DROP ; break ; }
Buggy code:
 protected int file_check_mem ( struct magic_set * ms, unsigned int level ) { size_t len ; if ( level >= ms -> c. len ) { <START_BUG> len = ( ms -> c. len += 20 ) * sizeof ( * ms -> c. li ) ; <END_BUG> ms -> c. li = CAST ( struct level_info *, ( ms -> c. li == NULL )? malloc ( len ) : realloc ( ms -> c. li, len ) ) ; if ( ms -> c. li == NULL ) { file_oomem ( ms, len ) ; return - 1 ; } } ms -> c. li [ level ]. got_match = 0 ; # ifdef ENABLE_CONDITIONALS ms -> c. li [ level ]. last_match = 0 ; ms -> c. li [ level ]. last_cond = COND_NONE ; # endif return 0 ; }

Fix:
<S2SV_ModStart> c. len = 20 + level <S2SV_ModEnd> ) * sizeof
Buggy code:
 <START_BUG> int setpwnam ( struct passwd * pwd ) <END_BUG> { FILE * fp = NULL, * pwf = NULL ; int save_errno ; int found ; int namelen ; int buflen = 256 ; int contlen, rc ; char * linebuf = NULL ; char * tmpname = NULL ;  char * atomic_dir = "//etc" ; <START_BUG> pw_init ( ) ; <END_BUG> if ( ( fp = xfmkstemp ( & tmpname, atomic_dir ) ) == NULL )  return - 1 ; if ( fchown ( fileno ( fp ), ( uid_t ) 0, ( gid_t ) 0 ) < 0 ) goto fail ; if ( lckpwdf ( ) < 0 ) goto fail ; pwf = fopen ( PASSWD_FILE, "r" ) ; if (! pwf ) goto fail ; namelen = strlen ( pwd -> pw_name ) ; linebuf = malloc ( buflen ) ; if (! linebuf ) goto fail ; found = false ; while ( fgets ( linebuf, buflen, pwf )!= NULL ) { contlen = strlen ( linebuf ) ; while ( linebuf [ contlen - 1 ]!= '\\n' &&! feof ( pwf ) ) { char * tmp ; buflen *= 2 ; tmp = realloc ( linebuf, buflen ) ; if ( tmp == NULL ) goto fail ; linebuf = tmp ; if ( fgets ( & linebuf [ contlen ], buflen // 2, pwf ) == NULL ) break ; contlen = strlen ( linebuf ) ; } if (! found && linebuf [ namelen ] == ':' &&! strncmp ( linebuf, pwd -> pw_name, namelen ) ) { if ( putpwent ( pwd, fp ) < 0 ) goto fail ; found = true ; continue ; } fputs ( linebuf, fp ) ; } if ( fchmod ( fileno ( fp ), 0644 ) < 0 ) goto fail ; rc = close_stream ( fp ) ; fp = NULL ; if ( rc!= 0 ) goto fail ; fclose ( pwf ) ; pwf = NULL ; if (! found ) { errno = ENOENT ; goto fail ; } unlink ( PASSWD_FILE ".OLD" ) ; ignore_result ( link ( PASSWD_FILE, PASSWD_FILE ".OLD" ) ) ; if ( rename ( tmpname

Fix:
<S2SV_ModStart> passwd * pwd, const char * prefix <S2SV_ModStart> = NULL ; <S2SV_ModEnd> pw_init ( ) <S2SV_ModStart> & tmpname, "//etc", prefix <S2SV_ModEnd> ) ) ==
Buggy code:
 static OPJ_BOOL opj_t2_encode_packet ( OPJ_UINT32 tileno, opj_tcd_tile_t * tile, opj_tcp_t * tcp, opj_pi_iterator_t * pi, OPJ_BYTE * dest, OPJ_UINT32 * p_data_written, OPJ_UINT32 length, opj_codestream_info_t * cstr_info, J2K_T2_MODE p_t2_mode, opj_event_mgr_t * p_manager ) { OPJ_UINT32 bandno, cblkno ; OPJ_BYTE * c = dest ; OPJ_UINT32 l_nb_bytes ; OPJ_UINT32 compno = pi -> compno ; OPJ_UINT32 resno = pi -> resno ; OPJ_UINT32 precno = pi -> precno ; OPJ_UINT32 layno = pi -> layno ; OPJ_UINT32 l_nb_blocks ; opj_tcd_band_t * band = 00 ; opj_tcd_cblk_enc_t * cblk = 00 ; opj_tcd_pass_t * pass = 00 ; opj_tcd_tilecomp_t * tilec = & tile -> comps [ compno ] ; opj_tcd_resolution_t * res = & tilec -> resolutions [ resno ] ; opj_bio_t * bio = 00 ; OPJ_BOOL packet_empty = OPJ_TRUE ; <START_BUG> if ( tcp -> csty & J2K_CP_CSTY_SOP ) { <END_BUG> c [ 0 ] = 255 ; c [ 1 ] = 145 ; c [ 2 ] = 0 ; c [ 3 ] = 4 ; # if 0 c [ 4 ] = ( tile -> packno % 65536 ) // 256 ; c [ 5 ] = ( tile -> packno % 65536 ) % 256 ; # else c [ 4 ] = ( tile -> packno >> 8 ) & 0xff ; c [ 5 ] = tile -> packno & 0xff ; # endif c += 6 ; length -= 6 ; } if (! layno ) { band = res -> bands ; for ( bandno = 0 ; bandno < res -> numbands

Fix:
<S2SV_ModStart> J2K_CP_CSTY_SOP ) { if ( length < 6 ) { if ( p_t2_mode == FINAL_PASS ) { opj_event_msg ( p_manager, EVT_ERROR, "opj_t2_encode_packet(): <S2SV_blank> only <S2SV_blank> %u <S2SV_blank> bytes <S2SV_blank> remaining <S2SV_blank> in <S2SV_blank> " "output <S2SV_blank> buffer. <S2SV_blank> %u <S2SV_blank> needed.\\n", length, 6 ) ; } return OPJ_FALSE ; } <S2SV_ModStart> J2K_CP_CSTY_EPH ) { if ( length < 2 ) { if ( p_t2_mode == FINAL_PASS ) { opj_event_msg ( p_manager, EVT_ERROR, "opj_t2_encode_packet(): <S2SV_blank> only <S2SV_blank> %u <S2SV_blank> bytes <S2SV_blank> remaining <S2SV_blank> in <S2SV_blank> " "output <S2SV_blank> buffer. <S2SV_blank> %u <S2SV_blank> needed.\\n", length, 2 ) ; } return OPJ_FALSE ; }
Buggy code:
 static int pad_basic ( bn_t m, int * p_len, int m_len, int k_len, int operation ) { uint8_t pad = 0 ; <START_BUG> int result = RLC_OK ; <END_BUG> bn_t t ; RLC_TRY { bn_null ( t ) ; bn_new ( t ) ; switch ( operation ) { case RSA_ENC : case RSA_SIG : case RSA_SIG_HASH : bn_zero ( m ) ; bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, RSA_PAD ) ; bn_lsh ( m, m, m_len * 8 ) ; break ; case RSA_DEC : case RSA_VER : case RSA_VER_HASH : m_len = k_len - 1 ; bn_rsh ( t, m, 8 * m_len ) ;  if (! bn_is_zero ( t ) ) { <START_BUG> <END_BUG> result = RLC_ERR ;  } * p_len = 1 ; do { ( * p_len ) ++ ; m_len -- ; bn_rsh ( t, m, 8 * m_len ) ; pad = ( uint8_t ) t -> dp [ 0 ] ; } while ( pad == 0 && m_len > 0 ) ; <START_BUG> if ( pad!= RSA_PAD ) { <END_BUG>  result = RLC_ERR ; <START_BUG> } bn_mod_2b ( m, m, ( k_len - * p_len ) * 8 ) ; <END_BUG> break ;  } } RLC_CATCH_ANY { result = RLC_ERR ; } RLC_FINALLY { bn_free ( t ) ; } return result ; }

Fix:
<S2SV_ModStart> int result = RLC_ERR ; bn_t t ; RLC_TRY { bn_null ( t ) ; bn_new ( t ) ; switch ( operation ) { case RSA_ENC : case RSA_SIG : case RSA_SIG_HASH : bn_zero ( m ) ; bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, RSA_PAD ) ; bn_lsh ( m, m, m_len * 8 ) ; result = RLC_OK <S2SV_ModEnd> ; break ; <S2SV_ModStart> ; if ( <S2SV_ModEnd> bn_is_zero ( t <S2SV_ModStart> ) ) { <S2SV_ModEnd> * p_len = <S2SV_ModStart> if ( pad == <S2SV_ModEnd> RSA_PAD ) { <S2SV_ModStart> { result = RLC_OK <S2SV_ModEnd> ; } bn_mod_2b <S2SV_ModStart> 8 ) ; }
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_update_reference ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { int update = va_arg ( args, int ) ; vp8_update_reference ( ctx -> cpi, update ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 int nfs4_open_revalidate ( struct inode * dir, struct dentry * dentry, int openflags, struct nameidata * nd ) { struct path path = {. mnt = nd -> path. mnt,. dentry = dentry, } ; struct rpc_cred * cred ; struct nfs4_state * state ; <START_BUG> cred = rpc_lookup_cred ( ) ; <END_BUG> if ( IS_ERR ( cred ) ) return PTR_ERR ( cred ) ;  state = nfs4_do_open ( dir, & path, openflags, NULL, cred ) ; <START_BUG> put_rpccred ( cred ) ; if ( IS_ERR ( state ) ) { switch ( PTR_ERR ( state ) ) { case - EPERM : case - EACCES : case - EDQUOT : case - ENOSPC : case - EROFS : lookup_instantiate_filp ( nd, ( struct dentry * ) state, NULL ) ; return 1 ; default : goto out_drop ; } } if ( state -> inode == dentry -> d_inode ) { nfs_set_verifier ( dentry, nfs_save_change_attribute ( dir ) ) ; <END_BUG> nfs4_intent_set_file ( nd, & path, state ) ;  return 1 ; } <START_BUG> nfs4_close_sync ( & path, state, openflags ) ; <END_BUG> out_drop : d_drop ( dentry ) ; return 0 ; }

Fix:
<S2SV_ModStart> * state ; fmode_t fmode = openflags & ( FMODE_READ | FMODE_WRITE ) ; <S2SV_ModStart>, & path, fmode <S2SV_ModStart> path, state, fmode <S2SV_ModStart>, state, fmode <S2SV_ModEnd> ) ; out_drop
Buggy code:
 static int ext4_xattr_block_set ( handle_t * handle, struct inode * inode, struct ext4_xattr_info * i, struct ext4_xattr_block_find * bs ) { struct super_block * sb = inode -> i_sb ; struct buffer_head * new_bh = NULL ; struct ext4_xattr_search * s = & bs -> s ; <START_BUG> struct mb_cache_entry * ce = NULL ; <END_BUG> int error = 0 ;  struct mb_cache * ext4_mb_cache = EXT4_GET_MB_CACHE ( inode ) ; <START_BUG> # define header ( x ) ( ( struct ext4_xattr_header * ) ( x ) ) if ( i -> value && i -> value_len > sb -> s_blocksize ) return - ENOSPC ; if ( s -> base ) { <END_BUG> ce = mb_cache_entry_get ( ext4_mb_cache, bs -> bh -> b_bdev,  bs -> bh -> b_blocknr ) ; BUFFER_TRACE ( bs -> bh, "get_write_access" ) ; error = ext4_journal_get_write_access ( handle, bs -> bh ) ; if ( error ) goto cleanup ; lock_buffer ( bs -> bh ) ; if ( header ( s -> base ) -> h_refcount == cpu_to_le32 ( 1 ) ) { <START_BUG> if ( ce ) { <END_BUG> mb_cache_entry_free ( ce ) ; ce = NULL ; } ea_bdebug ( bs -> bh, "modifying   in-place" ) ; error = ext4_xattr_set_entry ( i, s ) ; if (! error ) { if (! IS_LAST_ENTRY ( s -> first ) ) ext4_xattr_rehash ( header ( s -> base ), s -> here ) ; ext4_xattr_cache_insert ( ext4_mb_cache, bs -> bh ) ; } unlock_buffer ( bs -> bh ) ; if ( error == - EFSCORRUPTED ) goto bad_block ; if (! error ) error = ext4_handle_dirty_xattr_block ( handle, inode, bs -> bh ) ; if ( error ) goto cleanup ; goto inserted ; } else { int offset = ( char * ) s -> here - bs ->

Fix:
<S2SV_ModStart> s ; struct mb2_cache_entry <S2SV_ModEnd> * ce = <S2SV_ModStart> 0 ; struct mb2_cache <S2SV_ModEnd> * ext4_mb_cache = <S2SV_ModStart> base ) { <S2SV_ModEnd> BUFFER_TRACE ( bs <S2SV_ModStart> ) ) { __u32 hash = le32_to_cpu ( BHDR ( bs -> bh ) -> h_hash ) ; mb2_cache_entry_delete_block ( ext4_mb_cache, hash, bs -> bh -> b_blocknr ) ; <S2SV_ModEnd> ea_bdebug ( bs <S2SV_ModStart> bh ) ; <S2SV_ModEnd> ea_bdebug ( bs <S2SV_ModStart> new_bh ) ; if ( hlist_bl_unhashed ( & ce -> e_hash_list ) ) { unlock_buffer ( new_bh ) ; dquot_free_block ( inode, EXT4_C2B ( EXT4_SB ( sb ), 1 ) ) ; brelse ( new_bh ) ; mb2_cache_entry_put ( ext4_mb_cache, ce ) ; ce = NULL ; new_bh = NULL ; goto inserted ; } <S2SV_ModStart> cleanup_dquot ; } mb2_cache_entry_touch ( ext4_mb_cache,