nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static void <END_BUG> horAcc16 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; uint16 * wp = ( uint16 * ) cp0 ; tmsize_t wc = cc // 2 ;  assert ( ( cc % ( 2 * stride ) ) == 0 ) ; <START_BUG> if ( wc > stride ) { wc -= stride ; do { REPEAT4 ( stride, wp [ stride ] = ( uint16 ) ( ( ( unsigned int ) wp [ stride ] + ( unsigned int ) wp [ 0 ] ) & 0xffff ) ; wp ++ ) wc -= stride ; } while ( wc > 0 ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> horAcc16 ( TIFF <S2SV_ModStart> // 2 ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> stride ) )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "horAcc16", "%s", "cc%(2*stride))!=0" ) ; return 0 ; } <S2SV_ModEnd> if ( wc <S2SV_ModStart> ) ; } return 1 ;
Buggy code:
 static void do_local_notify ( xmlNode * notify_src, const char * client_id, gboolean sync_reply, gboolean from_peer ) { cib_client_t * client_obj = NULL ; int local_rc = pcmk_ok ; if ( client_id!= NULL ) { client_obj = g_hash_table_lookup ( client_list, client_id ) ; } else { crm_trace ( "No   client   to   sent   the   response   to.   F_CIB_CLIENTID   not   set." ) ; } if ( client_obj == NULL ) { local_rc = - ECONNRESET ; } else { int rid = 0 ; if ( sync_reply ) { <START_BUG> CRM_LOG_ASSERT ( client_obj -> request_id ) ; <END_BUG> rid = client_obj -> request_id ; client_obj -> request_id = 0 ; crm_trace ( "Sending   response   %d   to   %s   %s",  rid, client_obj -> name, from_peer? "(originator   of   delegated   request)" : "" ) ; <START_BUG> } else { crm_trace ( "Sending   an   event   to   %s   %s", client_obj -> name, from_peer? "(originator   of   delegated   request)" : "" ) ; } if ( client_obj -> ipc && crm_ipcs_send ( client_obj -> ipc, rid, notify_src,! sync_reply ) < 0 ) { local_rc = - ENOMSG ; # ifdef HAVE_GNUTLS_GNUTLS_H } else if ( client_obj -> session ) { crm_send_remote_msg ( client_obj -> session, notify_src, client_obj -> encrypted ) ; # endif } else if ( client_obj -> ipc == NULL ) { crm_err ( "Unknown   transport   for   %s", client_obj -> name ) ; } } if ( local_rc!= pcmk_ok && client_obj!= NULL ) { crm_warn ( "%sSync   reply   to   %s   failed:   %s", sync_reply? "" : "A-", client_obj? client_obj -> name : "<<END_BUG>

Fix:
<S2SV_ModStart> sync_reply ) { if ( client_obj -> ipc ) { <S2SV_ModStart> "" ) ; } else { crm_trace ( "Sending <S2SV_blank> response <S2SV_blank> to <S2SV_blank> %s <S2SV_blank> %s", client_obj -> name, from_peer? "(originator <S2SV_blank> of <S2SV_blank> delegated <S2SV_blank> request)" : "" ) ; }
Buggy code:
 static PyObject * decode_bytes_with_escapes ( struct compiling * c, const node * n, const char * s, size_t len ) { <START_BUG> return PyBytes_DecodeEscape ( s, len, NULL, 0, NULL ) ; <END_BUG> }

Fix:
<S2SV_ModStart> len ) { const char * first_invalid_escape ; PyObject * result = _PyBytes_DecodeEscape <S2SV_ModEnd> ( s, <S2SV_ModStart> 0, NULL, & first_invalid_escape ) ; if ( result == NULL ) return NULL ; if ( first_invalid_escape!= NULL ) { if ( warn_invalid_escape_sequence ( c, n, * first_invalid_escape ) < 0 ) { Py_DECREF ( result ) ; return NULL ; } } return result <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void inet6_destroy_sock ( struct sock * sk ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sk_buff * skb ; struct ipv6_txoptions * opt ; skb = xchg ( & np -> pktoptions, NULL ) ; if ( skb ) kfree_skb ( skb ) ; skb = xchg ( & np -> rxpmtu, NULL ) ; if ( skb ) kfree_skb ( skb ) ; fl6_free_socklist ( sk ) ; <START_BUG> opt = xchg ( & np -> opt, NULL ) ; <END_BUG>  if ( opt ) <START_BUG> <END_BUG> sock_kfree_s ( sk, opt, opt -> tot_len ) ;  <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> = xchg ( ( __force struct ipv6_txoptions * * ) <S2SV_ModStart> ( opt ) { atomic_sub ( <S2SV_ModEnd> opt -> tot_len <S2SV_ModStart> opt -> tot_len, & sk -> sk_omem_alloc ) ; txopt_put ( opt <S2SV_ModStart> ) ; } }
Buggy code:
 static __u8 * nci_extract_rf_params_nfcf_passive_poll ( struct nci_dev * ndev, struct rf_tech_specific_params_nfcf_poll * nfcf_poll, __u8 * data ) { nfcf_poll -> bit_rate = * data ++ ; <START_BUG> nfcf_poll -> sensf_res_len = * data ++ ; <END_BUG> pr_debug ( "bit_rate   %d,   sensf_res_len   %d\\n", nfcf_poll -> bit_rate, nfcf_poll -> sensf_res_len ) ; memcpy ( nfcf_poll -> sensf_res, data, nfcf_poll -> sensf_res_len ) ; data += nfcf_poll -> sensf_res_len ; return data ; }

Fix:
<S2SV_ModStart> -> sensf_res_len = min_t ( __u8, <S2SV_ModStart> * data ++, NFC_SENSF_RES_MAXSIZE )
Buggy code:
 struct key * key_alloc ( struct key_type * type, const char * desc, kuid_t uid, kgid_t gid, const struct cred * cred, key_perm_t perm, unsigned long flags, struct key_restriction * restrict_link ) { struct key_user * user = NULL ; struct key * key ; size_t desclen, quotalen ; int ret ; key = ERR_PTR ( - EINVAL ) ; if (! desc ||! * desc ) goto error ; if ( type -> vet_description ) { ret = type -> vet_description ( desc ) ; if ( ret < 0 ) { key = ERR_PTR ( ret ) ; goto error ; } } desclen = strlen ( desc ) ; quotalen = desclen + 1 + type -> def_datalen ; user = key_user_lookup ( uid ) ; if (! user ) goto no_memory_1 ; if (! ( flags & KEY_ALLOC_NOT_IN_QUOTA ) ) { unsigned maxkeys = uid_eq ( uid, GLOBAL_ROOT_UID )? key_quota_root_maxkeys : key_quota_maxkeys ; unsigned maxbytes = uid_eq ( uid, GLOBAL_ROOT_UID )? key_quota_root_maxbytes : key_quota_maxbytes ; spin_lock ( & user -> lock ) ; if (! ( flags & KEY_ALLOC_QUOTA_OVERRUN ) ) { if ( user -> qnkeys + 1 >= maxkeys || user -> qnbytes + quotalen >= maxbytes || user -> qnbytes + quotalen < user -> qnbytes ) goto no_quota ; } user -> qnkeys ++ ; user -> qnbytes += quotalen ; spin_unlock ( & user -> lock ) ; } key = kmem_cache_zalloc ( key_jar, GFP_KERNEL ) ; if (! key ) goto no_memory_2 ; key -> index_key. desc_len = desclen ; key -> index_key. description = kmemdup ( desc, desclen + 1, GFP_KERNEL ) ; if (! key -> index_key. description ) goto no_memory_3 ; refcount_set ( & key -> usage, 1 ) ; init_rwsem ( & key -> sem ) ; lockdep_

Fix:
<S2SV_ModStart> << KEY_FLAG_BUILTIN ; if ( flags & KEY_ALLOC_UID_KEYRING ) key -> flags |= 1 << KEY_FLAG_UID_KEYRING ;
Buggy code:
 Datum hstore_from_array ( PG_FUNCTION_ARGS ) { ArrayType * in_array = PG_GETARG_ARRAYTYPE_P ( 0 ) ; int ndims = ARR_NDIM ( in_array ) ; int count ; int32 buflen ; HStore * out ; Pairs * pairs ; Datum * in_datums ; bool * in_nulls ; int in_count ; int i ; Assert ( ARR_ELEMTYPE ( in_array ) == TEXTOID ) ; switch ( ndims ) { case 0 : out = hstorePairs ( NULL, 0, 0 ) ; PG_RETURN_POINTER ( out ) ; case 1 : if ( ( ARR_DIMS ( in_array ) [ 0 ] ) % 2 ) ereport ( ERROR, ( errcode ( ERRCODE_ARRAY_SUBSCRIPT_ERROR ), errmsg ( "array   must   have   even   number   of   elements" ) ) ) ; break ; case 2 : if ( ( ARR_DIMS ( in_array ) [ 1 ] )!= 2 ) ereport ( ERROR, ( errcode ( ERRCODE_ARRAY_SUBSCRIPT_ERROR ), errmsg ( "array   must   have   two   columns" ) ) ) ; break ; default : ereport ( ERROR, ( errcode ( ERRCODE_ARRAY_SUBSCRIPT_ERROR ), errmsg ( "wrong   number   of   array   subscripts" ) ) ) ; } deconstruct_array ( in_array, TEXTOID, - 1, false, 'i', & in_datums, & in_nulls, & in_count ) ; count = in_count // 2 ; <START_BUG> pairs = palloc ( count * sizeof ( Pairs ) ) ; <END_BUG> for ( i = 0 ; i < count ; ++ i ) { if ( in_nulls [ i * 2 ] ) ereport ( ERROR, ( errcode ( ERRCODE_NULL_VALUE_NOT_ALLOWED ), errmsg ( "null   value   not   allowed   for   hstore   key" ) ) ) ; if ( in_nulls [ i * 2 + 1 ] ) { pairs [ i ]. key = VARDATA_ANY ( in_datums [ i * 2 ] ) ; pairs [ i ]. val = NULL ; pairs [ i ]. keylen = hstoreCheckKeyLen ( VARSIZE_ANY

Fix:
<S2SV_ModStart> // 2 ; if ( count > MaxAllocSize // sizeof ( Pairs ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> pairs <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", count, ( int ) ( MaxAllocSize // sizeof ( Pairs ) ) ) ) ) ;
Buggy code:
 static MagickBooleanType ReadUncompressedRGB ( Image * image, DDSInfo * dds_info, ExceptionInfo * exception ) { PixelPacket * q ; ssize_t x, y ; unsigned short color ; if ( dds_info -> pixelformat. rgb_bitcount == 8 ) ( void ) SetImageType ( image, GrayscaleType ) ; else if ( dds_info -> pixelformat. rgb_bitcount == 16 &&! IsBitMask ( dds_info -> pixelformat, 0xf800, 0x07e0, 0x001f, 0x0000 ) ) ThrowBinaryException ( CorruptImageError, "ImageTypeNotSupported", image -> filename ) ; for ( y = 0 ; y < ( ssize_t ) dds_info -> height ; y ++ ) { q = QueueAuthenticPixels ( image, 0, y, dds_info -> width, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) return MagickFalse ; for ( x = 0 ; x < ( ssize_t ) dds_info -> width ; x ++ ) { if ( dds_info -> pixelformat. rgb_bitcount == 8 ) SetPixelGray ( q, ScaleCharToQuantum ( ReadBlobByte ( image ) ) ) ; else if ( dds_info -> pixelformat. rgb_bitcount == 16 ) { color = ReadBlobShort ( image ) ; SetPixelRed ( q, ScaleCharToQuantum ( ( unsigned char ) ( ( ( color >> 11 ) // 31.0 ) * 255 ) ) ) ; SetPixelGreen ( q, ScaleCharToQuantum ( ( unsigned char ) ( ( ( ( unsigned short ) ( color << 5 ) >> 10 ) // 63.0 ) * 255 ) ) ) ; SetPixelBlue ( q, ScaleCharToQuantum ( ( unsigned char ) ( ( ( ( unsigned short ) ( color << 11 ) >> 11 ) // 31.0 ) * 255 ) ) ) ; } else { SetPixelBlue ( q, ScaleCharToQuantum ( ( unsigned char ) ReadBlobByte ( image ) ) ) ; SetPixelGreen ( q, ScaleCharToQuantum ( ( unsigned char ) ReadBlobByte ( image ) ) ) ; SetPixelRed ( q, ScaleCharToQuantum ( ( unsigned char ) ReadBlobByte ( image ) ) ) ; if ( dds_

Fix:
<S2SV_ModStart> MagickFalse ; } return ( <S2SV_ModStart> dds_info, 3, exception ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int sas_ex_revalidate_domain ( struct domain_device * port_dev ) { int res ; struct domain_device * dev = NULL ; res = sas_find_bcast_dev ( port_dev, & dev ) ; <START_BUG> while ( res == 0 && dev ) { <END_BUG> struct expander_device * ex = & dev -> ex_dev ; int i = 0, phy_id ; do { phy_id = - 1 ; res = sas_find_bcast_phy ( dev, & phy_id, i, true ) ; if ( phy_id == - 1 ) break ; res = sas_rediscover ( dev, phy_id ) ; i = phy_id + 1 ; } while ( i < ex -> num_phys ) ;  dev = NULL ; <START_BUG> res = sas_find_bcast_dev ( port_dev, & dev ) ; } return res ; }<END_BUG>

Fix:
<S2SV_ModStart> dev ) ; if <S2SV_ModEnd> ( res == <S2SV_ModStart> num_phys ) ; <S2SV_ModEnd> } return res
Buggy code:
 <START_BUG> int ntlm_read_message_header ( wStream * s, NTLM_MESSAGE_HEADER * header ) <END_BUG> { if ( Stream_GetRemainingLength ( s ) < 12 ) return - 1 ; Stream_Read ( s, header -> Signature, 8 ) ; Stream_Read_UINT32 ( s, header -> MessageType ) ; if ( strncmp ( ( char * ) header -> Signature, NTLM_SIGNATURE, 8 )!= 0 ) return - 1 ; return 1 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static void iriap_getvaluebyclass_indication ( struct iriap_cb * self, struct sk_buff * skb ) { struct ias_object * obj ; struct ias_attrib * attrib ; int name_len ; int attr_len ; char name [ IAS_MAX_CLASSNAME + 1 ] ; char attr [ IAS_MAX_ATTRIBNAME + 1 ] ; __u8 * fp ; int n ; IRDA_DEBUG ( 4, "%s()\\n", __func__ ) ; IRDA_ASSERT ( self!= NULL, return ; ) ; IRDA_ASSERT ( self -> magic == IAS_MAGIC, return ; ) ; IRDA_ASSERT ( skb!= NULL, return ; ) ; fp = skb -> data ; n = 1 ; name_len = fp [ n ++ ] ; <START_BUG> memcpy ( name, fp + n, name_len ) ; n += name_len ; <END_BUG> name [ name_len ] = '\\0' ;  attr_len = fp [ n ++ ] ; <START_BUG> memcpy ( attr, fp + n, attr_len ) ; n += attr_len ; attr [ attr_len ] = '\\0' ; IRDA_DEBUG ( 4, "LM-IAS:   Looking   up   %s:   %s\\n", name, attr ) ; obj = irias_find_object ( name ) ; if ( obj == NULL ) { IRDA_DEBUG ( 2, "LM-IAS:   Object   %s   not   found\\n", name ) ; iriap_getvaluebyclass_response ( self, 0x1235, IAS_CLASS_UNKNOWN, & irias_missing ) ; return ; } IRDA_DEBUG ( 4, "LM-IAS:   found   %s,   id=%d\\n", obj -> name, obj -> id ) ; attrib = irias_find_attrib ( obj, attr ) ; if ( attrib == NULL ) { IRDA_DEBUG ( 2, "LM-IAS:   Attribute   %s   not   found\\n", attr ) ; iriap_getvaluebyclass_response ( self, obj -> id, IAS_ATTRIB_UNKNOWN, & irias_missing ) ; return ; } iriap_getvaluebyclass_response ( self, obj -> id<END_BUG>

Fix:
<S2SV_ModStart> ++ ] ; IRDA_ASSERT ( name_len < IAS_MAX_CLASSNAME + 1, return ; ) ; <S2SV_ModStart> n ++ ] ; IRDA_ASSERT ( attr_len < IAS_MAX_ATTRIBNAME + 1, return ; )
Buggy code:
 asmlinkage void do_ade ( struct pt_regs * regs ) { unsigned int __user * pc ; mm_segment_t seg ; perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, <START_BUG> 1, 0, regs, regs -> cp0_badvaddr ) ; <END_BUG> if ( ( regs -> cp0_badvaddr == regs -> cp0_epc ) || ( regs -> cp0_epc & 0x1 ) ) goto sigbus ; pc = ( unsigned int __user * ) exception_epc ( regs ) ; if ( user_mode ( regs ) &&! test_thread_flag ( TIF_FIXADE ) ) goto sigbus ; if ( unaligned_action == UNALIGNED_ACTION_SIGNAL ) goto sigbus ; else if ( unaligned_action == UNALIGNED_ACTION_SHOW ) show_registers ( regs ) ; seg = get_fs ( ) ; if (! user_mode ( regs ) ) set_fs ( KERNEL_DS ) ; emulate_load_store_insn ( regs, ( void __user * ) regs -> cp0_badvaddr, pc ) ; set_fs ( seg ) ; return ; sigbus : die_if_kernel ( "Kernel   unaligned   instruction   access", regs ) ; force_sig ( SIGBUS, current ) ; }

Fix:
<S2SV_ModStart> PERF_COUNT_SW_ALIGNMENT_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 WORD32 ih264d_cavlc_4x4res_block_totalcoeff_2to10 ( UWORD32 u4_isdc, UWORD32 u4_total_coeff_trail_one, dec_bit_stream_t * ps_bitstrm ) { UWORD32 u4_total_zeroes ; WORD32 i ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 u4_bitstream_offset = ps_bitstrm -> u4_ofst ; UWORD32 u4_trailing_ones = u4_total_coeff_trail_one & 0xFFFF ; UWORD32 u4_total_coeff = u4_total_coeff_trail_one >> 16 ; <START_BUG> WORD16 i2_level_arr [ 16 ] ; <END_BUG> tu_sblk4x4_coeff_data_t * ps_tu_4x4 ; WORD16 * pi2_coeff_data ; dec_struct_t * ps_dec = ( dec_struct_t * ) ps_bitstrm -> pv_codec_handle ; ps_tu_4x4 = ( tu_sblk4x4_coeff_data_t * ) ps_dec -> pv_parse_tu_coeff_data ; ps_tu_4x4 -> u2_sig_coeff_map = 0 ; pi2_coeff_data = & ps_tu_4x4 -> ai2_level [ 0 ] ; i = u4_total_coeff - 1 ; if ( u4_trailing_ones ) { UWORD32 u4_signs, u4_cnt = u4_trailing_ones ; WORD16 ( * ppi2_trlone_lkup ) [ 3 ] = ( WORD16 ( * ) [ 3 ] ) gai2_ih264d_trailing_one_level ; WORD16 * pi2_trlone_lkup ; GETBITS ( u4_signs, u4_bitstream_offset, pu4_bitstrm_buf, u4_cnt ) ; pi2_trlone_lkup = ppi2_trlone_lkup [ ( 1 << u4_cnt ) - 2 + u4_signs ] ; while

Fix:
<S2SV_ModStart> 16 ; WORD16 ai2_level_arr [ 19 ] ; WORD16 * i2_level_arr = & ai2_level_arr [ 3 <S2SV_ModEnd> ] ; tu_sblk4x4_coeff_data_t
Buggy code:
 int check_restricted ( void ) { if ( restricted ) { <START_BUG> emsg ( _ ( "E145:   Shell   commands   not   allowed   in   rvim" ) ) ; <END_BUG> return TRUE ; } return FALSE ; }

Fix:
<S2SV_ModStart> ( _ ( "E145: <S2SV_blank> Shell <S2SV_blank> commands <S2SV_blank> and <S2SV_blank> some <S2SV_blank> functionality <S2SV_blank> not <S2SV_blank> allowed <S2SV_blank> in <S2SV_blank> rvim" <S2SV_ModEnd> ) ) ;
Buggy code:
 static int gs_can_open ( struct net_device * netdev ) { struct gs_can * dev = netdev_priv ( netdev ) ; struct gs_usb * parent = dev -> parent ; int rc, i ; struct gs_device_mode * dm ; u32 ctrlmode ; rc = open_candev ( netdev ) ; if ( rc ) return rc ; if ( atomic_add_return ( 1, & parent -> active_channels ) == 1 ) { for ( i = 0 ; i < GS_MAX_RX_URBS ; i ++ ) { struct urb * urb ; u8 * buf ; urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! urb ) return - ENOMEM ; buf = usb_alloc_coherent ( dev -> udev, sizeof ( struct gs_host_frame ), GFP_KERNEL, & urb -> transfer_dma ) ; if (! buf ) { netdev_err ( netdev, "No   memory   left   for   USB   buffer\\n" ) ; usb_free_urb ( urb ) ; return - ENOMEM ; } usb_fill_bulk_urb ( urb, dev -> udev, usb_rcvbulkpipe ( dev -> udev, GSUSB_ENDPOINT_IN ), buf, sizeof ( struct gs_host_frame ), gs_usb_receive_bulk_callback, parent ) ; urb -> transfer_flags |= URB_NO_TRANSFER_DMA_MAP ; usb_anchor_urb ( urb, & parent -> rx_submitted ) ; rc = usb_submit_urb ( urb, GFP_KERNEL ) ; if ( rc ) { if ( rc == - ENODEV ) netif_device_detach ( dev -> netdev ) ; netdev_err ( netdev, "usb_submit   failed   (err=%d)\\n", rc ) ; <START_BUG> usb_unanchor_urb ( urb ) ; <END_BUG> break ; } usb_free_urb ( urb ) ; } } dm = kmalloc ( sizeof ( * dm ), GFP_KERNEL ) ; if (! dm ) return - ENOMEM ; ctrlmode = dev -> can. ctrlmode ; dm -> flags = 0 ; if ( ctrlmode

Fix:
<S2SV_ModStart> ) ; usb_unanchor_urb ( urb ) ; usb_free_urb
Buggy code:
 static int _hostsock_getsockopt ( oe_fd_t * sock_, int level, int optname, void * optval, oe_socklen_t * optlen ) { int ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_socklen_t optlen_in = 0 ; <START_BUG> oe_errno = 0 ; <END_BUG>  if (! sock ) <START_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; <END_BUG> if ( optlen )  optlen_in = * optlen ; if ( oe_syscall_getsockopt_ocall ( <START_BUG> & ret, sock -> host_fd, level, optname, optval, optlen_in, optlen )!= <END_BUG> OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; }  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; oe_socklen_t optlen_out = 0 ; <S2SV_ModStart> (! sock ||! optval ||! optlen <S2SV_ModStart> OE_EINVAL ) ; <S2SV_ModEnd> optlen_in = * <S2SV_ModStart>, optlen_in, & optlen_out <S2SV_ModEnd> )!= OE_OK <S2SV_ModStart> ) ; } if ( optlen_out > optlen_in ) optlen_out = optlen_in ; * optlen = optlen_out ;
Buggy code:
 const u_char * ns_nprint ( netdissect_options * ndo, register const u_char * cp, register const u_char * bp ) { register u_int i, l ; register const u_char * rp = NULL ; register int compress = 0 ; <START_BUG> int chars_processed ; <END_BUG> int elt ;  int data_size = ndo -> ndo_snapend - bp ; <START_BUG> if ( ( l = labellen ( ndo, cp ) ) == ( u_int ) - 1 ) return ( NULL ) ; if (! ND_TTEST2 ( * cp, 1 ) ) return ( NULL ) ; <END_BUG> chars_processed = 1 ;  if ( ( ( i = * cp ++ ) & INDIR_MASK )!= INDIR_MASK ) { compress = 0 ; rp = cp + l ; } if ( i!= 0 ) while ( i && cp < ndo -> ndo_snapend ) { if ( ( i & INDIR_MASK ) == INDIR_MASK ) { if (! compress ) { rp = cp + 1 ; compress = 1 ; } if (! ND_TTEST2 ( * cp, 1 ) ) return ( NULL ) ; <START_BUG> cp = bp + ( ( ( i << 8 ) | * cp ) & 0x3fff ) ; <END_BUG> if ( ( l = labellen ( ndo, cp ) ) == ( u_int ) - 1 ) return ( NULL ) ; if (! ND_TTEST2 ( * cp, 1 ) ) return ( NULL ) ; i = * cp ++ ;  chars_processed ++ ; <START_BUG> if ( chars_processed >= data_size ) { ND_PRINT ( ( ndo, "<LOOP>" ) ) ; return ( NULL ) ; } continue ; } if ( ( i & INDIR_MASK ) == EDNS0_MASK ) { elt = ( i & ~ INDIR_MASK ) ; switch ( elt ) { case EDNS0_ELT_BITLABEL : if ( blabel_print ( ndo, cp ) == NULL ) return ( NULL ) ; break ; default : ND_PRINT ( ( ndo, "<ELT   %d>", elt ) ) ; return ( NULL ) ; } } else { if ( fn_printn ( ndo, cp, l, ndo -> ndo_snapend ) ) return ( NULL )<END_BUG>

Fix:
<S2SV_ModStart> 0 ; int elt ; u_int offset, max_offset ; if ( ( l = labellen ( ndo, cp ) ) == ( u_int ) - 1 ) return ( NULL ) ; if (! ND_TTEST2 ( * cp, 1 ) ) return ( NULL ) ; max_offset = ( u_int ) ( cp - bp ) ; if ( ( ( i = * cp ++ ) & INDIR_MASK )!= INDIR_MASK ) { compress = 0 ; rp = cp + l ; } if ( i!= 0 ) while ( i && cp < <S2SV_ModEnd> ndo -> ndo_snapend <S2SV_ModStart> ndo -> ndo_snapend ) { if ( ( i & INDIR_MASK ) == INDIR_MASK ) { if (! compress ) { rp = cp + 1 ; compress = 1 ; } <S2SV_ModEnd> if (! <S2SV_ModStart> NULL ) ; offset = ( ( ( i << 8 ) | * cp ) & 0x3fff ) ; if ( offset >= max_offset ) { ND_PRINT ( ( ndo, "<BAD <S2SV_blank> PTR>" ) ) ; return ( NULL ) ; } max_offset = offset ; cp = bp + offset ; if (
Buggy code:
 struct sock * cookie_v6_check ( struct sock * sk, struct sk_buff * skb ) { struct tcp_options_received tcp_opt ; struct inet_request_sock * ireq ; struct tcp_request_sock * treq ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct tcp_sock * tp = tcp_sk ( sk ) ; const struct tcphdr * th = tcp_hdr ( skb ) ; __u32 cookie = ntohl ( th -> ack_seq ) - 1 ; struct sock * ret = sk ; struct request_sock * req ; int mss ; struct dst_entry * dst ; __u8 rcv_wscale ; if (! sysctl_tcp_syncookies ||! th -> ack || th -> rst ) goto out ; if ( tcp_synq_no_recent_overflow ( sk ) ) goto out ; mss = __cookie_v6_check ( ipv6_hdr ( skb ), th, cookie ) ; if ( mss == 0 ) { NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_SYNCOOKIESFAILED ) ; goto out ; } NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_SYNCOOKIESRECV ) ; memset ( & tcp_opt, 0, sizeof ( tcp_opt ) ) ; tcp_parse_options ( skb, & tcp_opt, 0, NULL ) ; if (! cookie_timestamp_decode ( & tcp_opt ) ) goto out ; ret = NULL ; req = inet_reqsk_alloc ( & tcp6_request_sock_ops, sk, false ) ; if (! req ) goto out ; ireq = inet_rsk ( req ) ; treq = tcp_rsk ( req ) ; treq -> tfo_listener = false ; if ( security_inet_conn_request ( sk, skb, req ) ) goto out_free ; req -> mss = mss ; ireq -> ir_rmt_port = th -> source ; ireq -> ir_num = ntohs ( th -> dest ) ; ireq -> ir_v6_rmt_addr = ipv6_hdr ( skb ) -> saddr ;

Fix:
<S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt )
Buggy code:
 void sas_unregister_dev ( struct asd_sas_port * port, struct domain_device * dev ) { if (! test_bit ( SAS_DEV_DESTROY, & dev -> state ) &&! list_empty ( & dev -> disco_list_node ) ) { list_del_init ( & dev -> disco_list_node ) ; sas_rphy_free ( dev -> rphy ) ; sas_unregister_common_dev ( port, dev ) ; return ; } if (! test_and_set_bit ( SAS_DEV_DESTROY, & dev -> state ) ) { sas_rphy_unlink ( dev -> rphy ) ; list_move_tail ( & dev -> disco_list_node, & port -> destroy_list ) ; <START_BUG> sas_discover_event ( dev -> port, DISCE_DESTRUCT ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> destroy_list ) ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 static int l2cap_sock_listen ( struct socket * sock, int backlog ) { struct sock * sk = sock -> sk ; int err = 0 ; BT_DBG ( "sk   %p   backlog   %d", sk, backlog ) ; lock_sock ( sk ) ; if ( sk -> sk_state!= BT_BOUND || sock -> type!= SOCK_SEQPACKET ) { err = - EBADFD ; goto done ; } switch ( l2cap_pi ( sk ) -> mode ) { case L2CAP_MODE_BASIC : break ; case L2CAP_MODE_ERTM : <START_BUG> if ( enable_ertm ) <END_BUG> break ; default : err = - ENOTSUPP ; goto done ; } if (! l2cap_pi ( sk ) -> psm ) { bdaddr_t * src = & bt_sk ( sk ) -> src ; u16 psm ; err = - EINVAL ; write_lock_bh ( & l2cap_sk_list. lock ) ; for ( psm = 0x1001 ; psm < 0x1100 ; psm += 2 ) if (! __l2cap_get_sock_by_addr ( cpu_to_le16 ( psm ), src ) ) { l2cap_pi ( sk ) -> psm = cpu_to_le16 ( psm ) ; l2cap_pi ( sk ) -> sport = cpu_to_le16 ( psm ) ; err = 0 ; break ; } write_unlock_bh ( & l2cap_sk_list. lock ) ; if ( err < 0 ) goto done ; } sk -> sk_max_ack_backlog = backlog ; sk -> sk_ack_backlog = 0 ; sk -> sk_state = BT_LISTEN ; done : release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> case L2CAP_MODE_ERTM : case L2CAP_MODE_STREAMING :
Buggy code:
 void imap_munge_mbox_name ( struct ImapData * idata, char * dest, size_t dlen, const char * src ) { char * buf = mutt_str_strdup ( src ) ; imap_utf_encode ( idata, & buf ) ; <START_BUG> imap_quote_string ( dest, dlen, buf ) ; <END_BUG> FREE ( & buf ) ; }

Fix:
<S2SV_ModStart> dlen, buf, false
Buggy code:
 sctp_disposition_t sctp_sf_do_5_1D_ce ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * chunk = arg ; struct sctp_association * new_asoc ; sctp_init_chunk_t * peer_init ; struct sctp_chunk * repl ; struct sctp_ulpevent * ev, * ai_ev = NULL ; int error = 0 ; struct sctp_chunk * err_chk_p ; struct sock * sk ; if ( ep == sctp_sk ( net -> sctp. ctl_sock ) -> ep ) { SCTP_INC_STATS ( net, SCTP_MIB_OUTOFBLUES ) ; return sctp_sf_tabort_8_4_8 ( net, ep, asoc, type, arg, commands ) ; } if (! sctp_chunk_length_valid ( chunk, sizeof ( sctp_chunkhdr_t ) ) ) return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; sk = ep -> base. sk ; if (! sctp_sstate ( sk, LISTENING ) || ( sctp_style ( sk, TCP ) && sk_acceptq_is_full ( sk ) ) ) return sctp_sf_tabort_8_4_8 ( net, ep, asoc, type, arg, commands ) ; chunk -> subh. cookie_hdr = ( struct sctp_signed_cookie * ) chunk -> skb -> data ; if (! pskb_pull ( chunk -> skb, ntohs ( chunk -> chunk_hdr -> length ) - sizeof ( sctp_chunkhdr_t ) ) ) goto nomem ; new_asoc = sctp_unpack_cookie ( ep, asoc, chunk, GFP_ATOMIC, & error, & err_chk_p ) ; if (! new_asoc ) { switch ( error ) { case - SCTP_IERROR_NOMEM : goto nomem ; case - SCTP_IERROR_STALE_COOKIE : sctp_send

Fix:
<S2SV_ModStart> sctp_ierror_t ret ; if (! net -> sctp. auth_enable ||! new_asoc -> peer. auth_capable ) { kfree_skb ( chunk -> auth_chunk ) ; sctp_association_free ( new_asoc ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; }
Buggy code:
 static void videobuf_vm_open ( struct vm_area_struct * vma ) { struct videobuf_mapping * map = vma -> vm_private_data ; <START_BUG> dprintk ( 2, "vm_open   %p   [count=%d,vma=%08lx-%08lx]\\n", map, <END_BUG> map -> count, vma -> vm_start, vma -> vm_end ) ; map -> count ++ ; }

Fix:
<S2SV_ModStart> ( 2, "vm_open <S2SV_blank> %p <S2SV_blank> [count=%u,vma=%08lx-%08lx]\\n" <S2SV_ModEnd>, map,
Buggy code:
 static const ut8 * r_bin_dwarf_parse_attr_value ( const ut8 * obuf, int obuf_len, RBinDwarfAttrSpec * spec, RBinDwarfAttrValue * value, const RBinDwarfCompUnitHdr * hdr, const ut8 * debug_str, size_t debug_str_len ) { const ut8 * buf = obuf ; const ut8 * buf_end = obuf + obuf_len ; size_t j ; <START_BUG> if (! spec ||! value ||! hdr ||! obuf || obuf_len < 0 ) { <END_BUG> return NULL ; } value -> form = spec -> attr_form ; value -> name = spec -> attr_name ; value -> encoding. block. data = NULL ; value -> encoding. str_struct. string = NULL ; value -> encoding. str_struct. offset = 0 ; switch ( spec -> attr_form ) { case DW_FORM_addr : switch ( hdr -> pointer_size ) { case 1 : value -> encoding. address = READ ( buf, ut8 ) ; break ; case 2 : value -> encoding. address = READ ( buf, ut16 ) ; break ; case 4 : value -> encoding. address = READ ( buf, ut32 ) ; break ; case 8 : value -> encoding. address = READ ( buf, ut64 ) ; break ; default : eprintf ( "DWARF:   Unexpected   pointer   size:   %u\\n", ( unsigned ) hdr -> pointer_size ) ; return NULL ; } break ; case DW_FORM_block2 : value -> encoding. block. length = READ ( buf, ut16 ) ; if ( value -> encoding. block. length > 0 ) { value -> encoding. block. data = calloc ( sizeof ( ut8 ), value -> encoding. block. length ) ; for ( j = 0 ; j < value -> encoding. block. length ; j ++ ) { value -> encoding. block. data [ j ] = READ ( buf, ut8 ) ; } } break ; case DW_FORM_block4 : value -> encoding. block. length = READ ( buf, ut32 ) ; if ( value -> encoding. block. length > 0 ) { ut8 * data = calloc ( sizeof ( ut8 ), value -> encoding. block. length ) ; if

Fix:
<S2SV_ModStart> || obuf_len < 1 <S2SV_ModEnd> ) { return <S2SV_ModStart> } break ; # if 0 <S2SV_ModStart> ; break ; # endif <S2SV_ModStart> length ) ; if ( value -> encoding. block. data ) { <S2SV_ModStart> ut8 ) ; } <S2SV_ModStart> 1 ) ; if ( value -> encoding. block. data ) { <S2SV_ModStart> ut8 ) ; }
Buggy code:
 int sock_setsockopt ( struct socket * sock, int level, int optname, char __user * optval, unsigned int optlen ) { struct sock * sk = sock -> sk ; int val ; int valbool ; struct linger ling ; int ret = 0 ; if ( optname == SO_BINDTODEVICE ) return sock_bindtodevice ( sk, optval, optlen ) ; if ( optlen < sizeof ( int ) ) return - EINVAL ; if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; valbool = val? 1 : 0 ; lock_sock ( sk ) ; switch ( optname ) { case SO_DEBUG : if ( val &&! capable ( CAP_NET_ADMIN ) ) ret = - EACCES ; else sock_valbool_flag ( sk, SOCK_DBG, valbool ) ; break ; case SO_REUSEADDR : sk -> sk_reuse = ( valbool? SK_CAN_REUSE : SK_NO_REUSE ) ; break ; case SO_TYPE : case SO_PROTOCOL : case SO_DOMAIN : case SO_ERROR : ret = - ENOPROTOOPT ; break ; case SO_DONTROUTE : sock_valbool_flag ( sk, SOCK_LOCALROUTE, valbool ) ; break ; case SO_BROADCAST : sock_valbool_flag ( sk, SOCK_BROADCAST, valbool ) ; break ; case SO_SNDBUF : <START_BUG> if ( val > sysctl_wmem_max ) <END_BUG> val = sysctl_wmem_max ; set_sndbuf : sk -> sk_userlocks |= SOCK_SNDBUF_LOCK ;  if ( ( val * 2 ) < SOCK_MIN_SNDBUF ) <START_BUG> sk -> sk_sndbuf = SOCK_MIN_SNDBUF ; else sk -> sk_sndbuf = val * 2 ; sk -> sk_write_space ( sk ) ; break ; case SO_SNDBUFFORCE : if (! capable ( CAP_NET_ADMIN ) ) { ret = - EPERM ; break ; } goto set_sndbuf ; case SO_RCVBUF : <END_BUG> if ( val > sysctl_rmem_max )  val = sysctl_rmem_max ; set

Fix:
<S2SV_ModStart> case SO_SNDBUF : val = min_t ( u32, val, sysctl_wmem_max ) <S2SV_ModEnd> ; set_sndbuf : <S2SV_ModStart> |= SOCK_SNDBUF_LOCK ; sk -> sk_sndbuf = max_t ( u32, <S2SV_ModEnd> val * 2 <S2SV_ModStart> val * 2, SOCK_MIN_SNDBUF ) <S2SV_ModEnd> ; sk -> <S2SV_ModStart> case SO_RCVBUF : val = min_t ( u32, val, sysctl_rmem_max ) <S2SV_ModEnd> ; set_rcvbuf : <S2SV_ModStart> |= SOCK_RCVBUF_LOCK ; sk -> sk_rcvbuf = max_t ( u32, <S2SV_ModEnd> val * 2 <S2SV_ModStart> val * 2, SOCK_MIN_RCVBUF ) <S2SV_ModEnd> ; break ;
Buggy code:
 static int decode_frame ( AVCodecContext * avctx, void * data, int * got_frame, AVPacket * avpkt ) { EXRContext * s = avctx -> priv_data ; ThreadFrame frame = {. f = data } ; AVFrame * picture = data ; uint8_t * ptr ; int i, y, ret, ymax ; int planes ; int out_line_size ; int nb_blocks ; uint64_t start_offset_table ; uint64_t start_next_scanline ; PutByteContext offset_table_writer ; bytestream2_init ( & s -> gb, avpkt -> data, avpkt -> size ) ; if ( ( ret = decode_header ( s, picture ) ) < 0 ) return ret ; switch ( s -> pixel_type ) { case EXR_FLOAT : case EXR_HALF : if ( s -> channel_offsets [ 3 ] >= 0 ) { if (! s -> is_luma ) { avctx -> pix_fmt = AV_PIX_FMT_GBRAPF32 ; } else { avctx -> pix_fmt = AV_PIX_FMT_GBRAPF32 ; } } else { if (! s -> is_luma ) { avctx -> pix_fmt = AV_PIX_FMT_GBRPF32 ; } else { avctx -> pix_fmt = AV_PIX_FMT_GRAYF32 ; } } break ; case EXR_UINT : if ( s -> channel_offsets [ 3 ] >= 0 ) { if (! s -> is_luma ) { avctx -> pix_fmt = AV_PIX_FMT_RGBA64 ; } else { avctx -> pix_fmt = AV_PIX_FMT_YA16 ; } } else { if (! s -> is_luma ) { avctx -> pix_fmt = AV_PIX_FMT_RGB48 ; } else { avctx -> pix_fmt = AV_PIX_FMT_GRAY16 ; } } break ; default : av_log ( avctx, AV_LOG_ERROR, "Missing   channel   list.\\n" ) ; return AVERROR_INVALIDDATA ; } if ( s -> apply_trc_type!= AVCOL_TRC_UNSPECIFIED

Fix:
<S2SV_ModStart> ; y < FFMIN ( <S2SV_ModStart> s -> ymin, s -> h )
Buggy code:
 int xfs_setattr_nonsize ( struct xfs_inode * ip, struct iattr * iattr, int flags ) { xfs_mount_t * mp = ip -> i_mount ; struct inode * inode = VFS_I ( ip ) ; int mask = iattr -> ia_valid ; xfs_trans_t * tp ; int error ; kuid_t uid = GLOBAL_ROOT_UID, iuid = GLOBAL_ROOT_UID ; kgid_t gid = GLOBAL_ROOT_GID, igid = GLOBAL_ROOT_GID ; struct xfs_dquot * udqp = NULL, * gdqp = NULL ; struct xfs_dquot * olddquot1 = NULL, * olddquot2 = NULL ; ASSERT ( ( mask & ATTR_SIZE ) == 0 ) ; if ( XFS_IS_QUOTA_ON ( mp ) && ( mask & ( ATTR_UID | ATTR_GID ) ) ) { uint qflags = 0 ; if ( ( mask & ATTR_UID ) && XFS_IS_UQUOTA_ON ( mp ) ) { uid = iattr -> ia_uid ; qflags |= XFS_QMOPT_UQUOTA ; } else { uid = inode -> i_uid ; } if ( ( mask & ATTR_GID ) && XFS_IS_GQUOTA_ON ( mp ) ) { gid = iattr -> ia_gid ; qflags |= XFS_QMOPT_GQUOTA ; } else { gid = inode -> i_gid ; } ASSERT ( udqp == NULL ) ; ASSERT ( gdqp == NULL ) ; error = xfs_qm_vop_dqalloc ( ip, xfs_kuid_to_uid ( uid ), xfs_kgid_to_gid ( gid ), xfs_get_projid ( ip ), qflags, & udqp, & gdqp, NULL ) ; if ( error ) return error ; } error = xfs_trans_alloc ( mp, & M_RES ( mp ) -> tr_ichange, 0, 0, 0, & tp ) ; if ( error ) goto out_dqrele ; xfs_ilock ( ip, XFS_ILOCK_EXCL ) ; xfs_trans_ijoin ( tp, ip, 0 ) ; if ( mask

Fix:
<S2SV_ModStart> tp ) ; xfs_iunlock ( ip, XFS_ILOCK_EXCL ) ;
Buggy code:
 static int cine_read_header ( AVFormatContext * avctx ) { AVIOContext * pb = avctx -> pb ; AVStream * st ; unsigned int version, compression, offImageHeader, offSetup, offImageOffsets, biBitCount, length, CFA ; int vflip ; char * description ; uint64_t i ; st = avformat_new_stream ( avctx, NULL ) ; if (! st ) return AVERROR ( ENOMEM ) ; st -> codecpar -> codec_type = AVMEDIA_TYPE_VIDEO ; st -> codecpar -> codec_id = AV_CODEC_ID_RAWVIDEO ; st -> codecpar -> codec_tag = 0 ; avio_skip ( pb, 4 ) ; compression = avio_rl16 ( pb ) ; version = avio_rl16 ( pb ) ; if ( version!= 1 ) { avpriv_request_sample ( avctx, "unknown   version   %i", version ) ; return AVERROR_INVALIDDATA ; } avio_skip ( pb, 12 ) ; st -> duration = avio_rl32 ( pb ) ; offImageHeader = avio_rl32 ( pb ) ; offSetup = avio_rl32 ( pb ) ; offImageOffsets = avio_rl32 ( pb ) ; avio_skip ( pb, 8 ) ; avio_seek ( pb, offImageHeader, SEEK_SET ) ; avio_skip ( pb, 4 ) ; st -> codecpar -> width = avio_rl32 ( pb ) ; st -> codecpar -> height = avio_rl32 ( pb ) ; if ( avio_rl16 ( pb )!= 1 ) return AVERROR_INVALIDDATA ; biBitCount = avio_rl16 ( pb ) ; if ( biBitCount!= 8 && biBitCount!= 16 && biBitCount!= 24 && biBitCount!= 48 ) { avpriv_request_sample ( avctx, "unsupported   biBitCount   %i", biBitCount ) ; return AVERROR_INVALIDDATA ; } switch ( avio_rl32 ( pb ) ) { case BMP_RGB : vflip = 0 ; break ; case 0x100 : st -> codecpar -> codec_tag = MKTAG (

Fix:
<S2SV_ModStart> i ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> AVINDEX_KEYFRAME ) ; }
Buggy code:
 static int handle_exception ( struct kvm_vcpu * vcpu ) { struct vcpu_vmx * vmx = to_vmx ( vcpu ) ; struct kvm_run * kvm_run = vcpu -> run ; u32 intr_info, ex_no, error_code ; unsigned long cr2, rip, dr6 ; u32 vect_info ; enum emulation_result er ; vect_info = vmx -> idt_vectoring_info ; intr_info = vmx -> exit_intr_info ; if ( is_machine_check ( intr_info ) ) return handle_machine_check ( vcpu ) ; if ( ( intr_info & INTR_INFO_INTR_TYPE_MASK ) == INTR_TYPE_NMI_INTR ) return 1 ; if ( is_no_device ( intr_info ) ) { vmx_fpu_activate ( vcpu ) ; return 1 ; } if ( is_invalid_opcode ( intr_info ) ) { if ( is_guest_mode ( vcpu ) ) { kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 1 ; } er = emulate_instruction ( vcpu, EMULTYPE_TRAP_UD ) ; if ( er!= EMULATE_DONE ) kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 1 ; } error_code = 0 ; if ( intr_info & INTR_INFO_DELIVER_CODE_MASK ) error_code = vmcs_read32 ( VM_EXIT_INTR_ERROR_CODE ) ; if ( ( vect_info & VECTORING_INFO_VALID_MASK ) &&! ( is_page_fault ( intr_info ) &&! ( error_code & PFERR_RSVD_MASK ) ) ) { vcpu -> run -> exit_reason = KVM_EXIT_INTERNAL_ERROR ; vcpu -> run -> internal. suberror = KVM_INTERNAL_ERROR_SIMUL_EX ; vcpu -> run -> internal. ndata = 3 ; vcpu -> run -> internal. data [ 0 ] = vect_info ; vcpu -> run -> internal. data [ 1 ] = intr_info ; vcpu -> run -> internal. data [ 2 ] = error_code ; return

Fix:
<S2SV_ModStart> ) { case AC_VECTOR : kvm_queue_exception_e ( vcpu, AC_VECTOR, error_code ) ; return 1 ; case
Buggy code:
 size_t jsuGetFreeStack ( ) { # ifdef ARM void * frame = __builtin_frame_address ( 0 ) ; size_t stackPos = ( size_t ) ( ( char * ) frame ) ; size_t stackEnd = ( size_t ) ( ( char * ) & LINKER_END_VAR ) ; if ( stackPos < stackEnd ) return 0 ; return stackPos - stackEnd ; # elif defined ( LINUX ) char ptr ; extern void * STACK_BASE ; uint32_t count = ( uint32_t ) ( ( size_t ) STACK_BASE - ( size_t ) & ptr ) ; <START_BUG> return 1000000 - count ; <END_BUG> # else return 1000000 ; # endif }

Fix:
<S2SV_ModStart> ptr ) ; const uint32_t max_stack = 1000000 ; if ( count > max_stack ) return 0 ; return max_stack <S2SV_ModEnd> - count ;
Buggy code:
 static int xid_map_enter ( netdissect_options * ndo, const struct sunrpc_msg * rp, const u_char * bp ) { const struct ip * ip = NULL ; const struct ip6_hdr * ip6 = NULL ; struct xid_map_entry * xmep ; if (! ND_TTEST ( rp -> rm_call. cb_vers ) ) return ( 0 ) ; switch ( IP_V ( ( const struct ip * ) bp ) ) { case 4 : ip = ( const struct ip * ) bp ; break ; case 6 : ip6 = ( const struct ip6_hdr * ) bp ; break ; default : return ( 1 ) ; } xmep = & xid_map [ xid_map_next ] ; if ( ++ xid_map_next >= XIDMAPSIZE ) xid_map_next = 0 ; UNALIGNED_MEMCPY ( & xmep -> xid, & rp -> rm_xid, sizeof ( xmep -> xid ) ) ; if ( ip ) { xmep -> ipver = 4 ; UNALIGNED_MEMCPY ( & xmep -> client, & ip -> ip_src, sizeof ( ip -> ip_src ) ) ; UNALIGNED_MEMCPY ( & xmep -> server, & ip -> ip_dst, sizeof ( ip -> ip_dst ) ) ; } else if ( ip6 ) { xmep -> ipver = 6 ; UNALIGNED_MEMCPY ( & xmep -> client, & ip6 -> ip6_src, sizeof ( ip6 -> ip6_src ) ) ; UNALIGNED_MEMCPY ( & xmep -> server, & ip6 -> ip6_dst, sizeof ( ip6 -> ip6_dst ) ) ; } <START_BUG> xmep -> proc = EXTRACT_32BITS ( & rp -> rm_call. cb_proc ) ; <END_BUG> xmep -> vers = EXTRACT_32BITS ( & rp -> rm_call. cb_vers ) ; return ( 1 ) ; }

Fix:
<S2SV_ModStart> ) ; } if (! ND_TTEST ( rp -> rm_call. cb_proc ) ) return ( 0 ) ; <S2SV_ModStart> rm_call. cb_proc ) ; if (! ND_TTEST ( rp -> rm_call. cb_vers ) ) return ( 0
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register IndexPacket * indexes ; register ssize_t x ; register PixelPacket * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char *

Fix:
<S2SV_ModStart> ) AcquireQuantumMemory ( MagickMax ( number_pixels, max_packets ), <S2SV_ModEnd> bytes_per_pixel * sizeof
Buggy code:
 <START_BUG> void vp9_iht4x4_16_add_c ( const int16_t * input, uint8_t * dest, int stride, <END_BUG> int tx_type ) { const transform_2d IHT_4 [ ] = {  { idct4, idct4 }, <START_BUG> { iadst4, idct4 }, { idct4, iadst4 }, { iadst4, iadst4 } } ; int i, j ; <END_BUG> int16_t out [ 4 * 4 ] ;  <START_BUG> int16_t * outptr = out ; <END_BUG>  int16_t temp_in [ 4 ], temp_out [ 4 ] ; <START_BUG> for ( i = 0 ; i < 4 ; ++ i ) { IHT_4 [ tx_type ]. rows ( input, outptr ) ; input += 4 ; outptr += 4 ; } for ( i = 0 ; i < 4 ; ++ i ) { for ( j = 0 ; j < 4 ; ++ j ) temp_in [ j ] = out [ j * 4 + i ] ; IHT_4 [ tx_type ]. cols ( temp_in, temp_out ) ; <END_BUG> for ( j = 0 ; j < 4 ; ++ j )  <START_BUG> dest [ j * stride + i ] = clip_pixel ( ROUND_POWER_OF_TWO ( temp_out [ j ], 4 ) <END_BUG>  + dest [ j * stride + i ] ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> vp9_iht4x4_16_add_c ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> = { { idct4_c, idct4_c }, { iadst4_c, idct4_c }, { idct4_c, iadst4_c }, { iadst4_c, iadst4_c <S2SV_ModEnd> } } ; <S2SV_ModStart>, j ; tran_low_t <S2SV_ModEnd> out [ 4 <S2SV_ModStart> 4 ] ; tran_low_t <S2SV_ModEnd> * outptr = <S2SV_ModStart> = out ; tran_low_t <S2SV_ModEnd> temp_in [ 4 <S2SV_ModStart> ++ j ) { <S2SV_ModStart> i ] = clip_pixel_add ( <S2SV_ModEnd> dest [ j <S2SV_ModStart> + i ], ROUND_POWER_OF_TWO ( temp_out [ j ], 4 ) ) ; } <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 static int encrypted_update ( struct key * key, struct key_preparsed_payload * prep ) { struct encrypted_key_payload * epayload = key -> payload. data [ 0 ] ; struct encrypted_key_payload * new_epayload ; char * buf ; char * new_master_desc = NULL ; const char * format = NULL ; size_t datalen = prep -> datalen ; int ret = 0 ; <START_BUG> if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) <END_BUG> return - ENOKEY ; if ( datalen <= 0 || datalen > 32767 ||! prep -> data ) return - EINVAL ; buf = kmalloc ( datalen + 1, GFP_KERNEL ) ; if (! buf ) return - ENOMEM ; buf [ datalen ] = 0 ; memcpy ( buf, prep -> data, datalen ) ; ret = datablob_parse ( buf, & format, & new_master_desc, NULL, NULL ) ; if ( ret < 0 ) goto out ; ret = valid_master_desc ( new_master_desc, epayload -> master_desc ) ; if ( ret < 0 ) goto out ; new_epayload = encrypted_key_alloc ( key, epayload -> format, new_master_desc, epayload -> datalen ) ; if ( IS_ERR ( new_epayload ) ) { ret = PTR_ERR ( new_epayload ) ; goto out ; } __ekey_init ( new_epayload, epayload -> format, new_master_desc, epayload -> datalen ) ; memcpy ( new_epayload -> iv, epayload -> iv, ivsize ) ; memcpy ( new_epayload -> payload_data, epayload -> payload_data, epayload -> payload_datalen ) ; rcu_assign_keypointer ( key, new_epayload ) ; call_rcu ( & epayload -> rcu, encrypted_rcu_free ) ; out : kzfree ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> ; if ( key_is_negative ( key <S2SV_ModEnd> ) ) return
Buggy code:
 static int atusb_get_and_show_build ( struct atusb * atusb ) { struct usb_device * usb_dev = atusb -> usb_dev ; <START_BUG> char build [ ATUSB_BUILD_SIZE + 1 ] ; <END_BUG>  int ret ; <START_BUG> ret = atusb_control_msg ( atusb, usb_rcvctrlpipe ( usb_dev, 0 ), ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000 ) ; if ( ret >= 0 ) { build [ ret ] = 0 ; dev_info ( & usb_dev -> dev, "Firmware:   build   %s\\n", build ) ; } <END_BUG> return ret ;  }

Fix:
<S2SV_ModStart> usb_dev ; char * build <S2SV_ModEnd> ; int ret <S2SV_ModStart> ; int ret ; build = kmalloc ( ATUSB_BUILD_SIZE + 1, GFP_KERNEL ) ; if (! build ) return - ENOMEM <S2SV_ModStart> ) ; } kfree ( build ) ;
Buggy code:
 static void smp_task_done ( struct sas_task * task ) { <START_BUG> if (! del_timer ( & task -> slow_task -> timer ) ) <END_BUG> return ; complete ( & task -> slow_task -> completion ) ; }

Fix:
<S2SV_ModStart> task ) { <S2SV_ModEnd> del_timer ( & <S2SV_ModStart> -> timer ) <S2SV_ModEnd> ; complete (
Buggy code:
 int DecodeTime ( char * str, int * tmask, struct tm * tm, fsec_t * fsec ) { char * cp ; * tmask = DTK_TIME_M ; tm -> tm_hour = strtol ( str, & cp, 10 ) ; if ( * cp!= ':' ) return - 1 ; str = cp + 1 ; tm -> tm_min = strtol ( str, & cp, 10 ) ; if ( * cp == '\\0' ) { tm -> tm_sec = 0 ; * fsec = 0 ; } else if ( * cp!= ':' ) return - 1 ; else { str = cp + 1 ; tm -> tm_sec = strtol ( str, & cp, 10 ) ; if ( * cp == '\\0' ) * fsec = 0 ; else if ( * cp == '.' ) { # ifdef HAVE_INT64_TIMESTAMP <START_BUG> char fstr [ MAXDATELEN + 1 ] ; <END_BUG> strncpy ( fstr, ( cp + 1 ), 7 ) ; strcpy ( fstr + strlen ( fstr ), "000000" ) ; * ( fstr + 6 ) = '\\0' ; * fsec = strtol ( fstr, & cp, 10 ) ; # else str = cp ; * fsec = strtod ( str, & cp ) ; # endif if ( * cp!= '\\0' ) return - 1 ; } else return - 1 ; } # ifdef HAVE_INT64_TIMESTAMP if ( tm -> tm_hour < 0 || tm -> tm_min < 0 || tm -> tm_min > 59 || tm -> tm_sec < 0 || tm -> tm_sec > 59 || * fsec >= USECS_PER_SEC ) return - 1 ; # else if ( tm -> tm_hour < 0 || tm -> tm_min < 0 || tm -> tm_min > 59 || tm -> tm_sec < 0 || tm -> tm_sec > 59 || * fsec >= 1 ) return - 1 ; # endif return 0 ; }

Fix:
<S2SV_ModStart> char fstr [ 7 ] ; int i ; cp ++ ; for ( i = 0 ; i < 6 ; i ++ ) fstr [ i ] = * cp!= '\\0'? * cp ++ : '0' ; fstr [ i ] <S2SV_ModEnd> = '\\0' ;
Buggy code:
 static int tls_construct_cke_dhe ( SSL * s, unsigned char * * p, int * len, int * al ) { # ifndef OPENSSL_NO_DH DH * dh_clnt = NULL ; const BIGNUM * pub_key ; EVP_PKEY * ckey = NULL, * skey = NULL ; skey = s -> s3 -> peer_tmp ; if ( skey == NULL ) { SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR ) ; return 0 ; } ckey = ssl_generate_pkey ( skey ) ; <START_BUG> dh_clnt = EVP_PKEY_get0_DH ( ckey ) ; <END_BUG> if ( dh_clnt == NULL || ssl_derive ( s, ckey, skey ) == 0 ) { SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR ) ; EVP_PKEY_free ( ckey ) ; return 0 ; } DH_get0_key ( dh_clnt, & pub_key, NULL ) ; * len = BN_num_bytes ( pub_key ) ; s2n ( * len, * p ) ; BN_bn2bin ( pub_key, * p ) ; * len += 2 ; EVP_PKEY_free ( ckey ) ; return 1 ; # else SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR ) ; * al = SSL_AD_INTERNAL_ERROR ; return 0 ; # endif }

Fix:
<S2SV_ModStart> skey ) ; if ( ckey == NULL ) { SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR ) ; return 0 ; }
Buggy code:
 static void <START_BUG> l2tp_bearer_type_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint32_t * ptr = ( const uint32_t * ) dat ; <START_BUG> if ( EXTRACT_32BITS ( ptr ) & L2TP_BEARER_TYPE_ANALOG_MASK ) { ND_PRINT ( ( ndo, "A" ) ) ; } if ( EXTRACT_32BITS ( ptr ) & L2TP_BEARER_TYPE_DIGITAL_MASK ) { ND_PRINT ( ( ndo, "D" ) ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 int vp8_get_preview_raw_frame ( VP8_COMP * cpi, YV12_BUFFER_CONFIG * dest, vp8_ppflags_t * flags ) { if ( cpi -> common. refresh_alt_ref_frame ) return - 1 ; else { int ret ; # if CONFIG_MULTITHREAD if ( cpi -> b_lpf_running ) { sem_wait ( & cpi -> h_event_end_lpf ) ; cpi -> b_lpf_running = 0 ; } # endif # if CONFIG_POSTPROC cpi -> common. show_frame_mi = cpi -> common. mi ; ret = vp8_post_proc_frame ( & cpi -> common, dest, flags ) ; # else <START_BUG> if ( cpi -> common. frame_to_show ) <END_BUG> { * dest = * cpi -> common. frame_to_show ; dest -> y_width = cpi -> common. Width ; dest -> y_height = cpi -> common. Height ; dest -> uv_height = cpi -> common. Height // 2 ; ret = 0 ; } else { ret = - 1 ; } # endif vp8_clear_system_state ( ) ; return ret ; } }

Fix:
<S2SV_ModStart> ; # else ( void ) flags ;
Buggy code:
 static int jpc_siz_getparms ( jpc_ms_t * ms, jpc_cstate_t * cstate, jas_stream_t * in ) { jpc_siz_t * siz = & ms -> parms. siz ; unsigned int i ; uint_fast8_t tmp ; cstate = 0 ; if ( jpc_getuint16 ( in, & siz -> caps ) || jpc_getuint32 ( in, & siz -> width ) || jpc_getuint32 ( in, & siz -> height ) || jpc_getuint32 ( in, & siz -> xoff ) || jpc_getuint32 ( in, & siz -> yoff ) || jpc_getuint32 ( in, & siz -> tilewidth ) || jpc_getuint32 ( in, & siz -> tileheight ) || jpc_getuint32 ( in, & siz -> tilexoff ) || jpc_getuint32 ( in, & siz -> tileyoff ) || jpc_getuint16 ( in, & siz -> numcomps ) ) { return - 1 ; } if (! siz -> width ||! siz -> height ||! siz -> tilewidth ||! siz -> tileheight ||! siz -> numcomps || siz -> numcomps > 16384 ) { return - 1 ; } <START_BUG> if (! ( siz -> comps = jas_alloc2 ( siz -> numcomps, sizeof ( jpc_sizcomp_t ) ) ) ) { <END_BUG> return - 1 ; } for ( i = 0 ; i < siz -> numcomps ; ++ i ) { if ( jpc_getuint8 ( in, & tmp ) || jpc_getuint8 ( in, & siz -> comps [ i ]. hsamp ) || jpc_getuint8 ( in, & siz -> comps [ i ]. vsamp ) ) { jas_free ( siz -> comps ) ; return - 1 ; } if ( siz -> comps [ i ]. hsamp == 0 || siz -> comps [ i ]. hsamp > 255 ) { jas_eprintf ( "invalid   XRsiz   value   %d\\n", siz -> comps [ i ]. hsamp ) ; jas_

Fix:
<S2SV_ModStart> } if ( siz -> tilexoff >= siz -> width || siz -> tileyoff >= siz -> height ) { jas_eprintf ( "all <S2SV_blank> tiles <S2SV_blank> are <S2SV_blank> outside <S2SV_blank> the <S2SV_blank> image <S2SV_blank> area\\n" ) ; return - 1 ; } if (
Buggy code:
 static int rawsock_create ( struct net * net, struct socket * sock, const struct nfc_protocol * nfc_proto, int kern ) { struct sock * sk ; pr_debug ( "sock=%p\\n", sock ) ; if ( ( sock -> type!= SOCK_SEQPACKET ) && ( sock -> type!= SOCK_RAW ) ) return - ESOCKTNOSUPPORT ; <START_BUG> if ( sock -> type == SOCK_RAW ) <END_BUG> sock -> ops = & rawsock_raw_ops ;  else <START_BUG> <END_BUG> sock -> ops = & rawsock_ops ;  sk = sk_alloc ( net, PF_NFC, GFP_ATOMIC, nfc_proto -> proto, kern ) ; if (! sk ) return - ENOMEM ; sock_init_data ( sock, sk ) ; sk -> sk_protocol = nfc_proto -> id ; sk -> sk_destruct = rawsock_destruct ; sock -> state = SS_UNCONNECTED ; if ( sock -> type == SOCK_RAW ) nfc_sock_link ( & raw_sk_list, sk ) ; else { INIT_WORK ( & nfc_rawsock ( sk ) -> tx_work, rawsock_tx_work ) ; nfc_rawsock ( sk ) -> tx_work_scheduled = false ; } return 0 ; }

Fix:
<S2SV_ModStart> == SOCK_RAW ) { if (! capable ( CAP_NET_RAW ) ) return - EPERM ; <S2SV_ModStart> & rawsock_raw_ops ; } else { <S2SV_ModEnd> sock -> ops <S2SV_ModStart> & rawsock_ops ; }