nus-yam/ex-repair huggingface dataset:
Buggy code:
 char * rfbProcessFileTransferReadBuffer ( rfbClientPtr cl, uint32_t length ) { char * buffer = NULL ; int n = 0 ; FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN ( "", cl, NULL ) ; <START_BUG> if ( length == SIZE_MAX ) { <END_BUG> rfbErr ( "rfbProcessFileTransferReadBuffer:   too   big   file   transfer   length   requested:   %u", ( unsigned int ) length ) ; rfbCloseClient ( cl ) ; return NULL ; } if ( length > 0 ) { buffer = malloc ( ( size_t ) length + 1 ) ; if ( buffer!= NULL ) { if ( ( n = rfbReadExact ( cl, ( char * ) buffer, length ) ) <= 0 ) { if ( n!= 0 ) rfbLogPerror ( "rfbProcessFileTransferReadBuffer:   read" ) ; rfbCloseClient ( cl ) ; if ( buffer!= NULL ) free ( buffer ) ; return NULL ; } buffer [ length ] = 0 ; } } return buffer ; }

Fix:
<S2SV_ModStart> length == SIZE_MAX || length > INT_MAX
Buggy code:
 static int ghash_final ( struct shash_desc * desc, u8 * dst ) { struct ghash_desc_ctx * dctx = shash_desc_ctx ( desc ) ; struct ghash_ctx * ctx = crypto_shash_ctx ( desc -> tfm ) ; u8 * buf = dctx -> buffer ; <START_BUG> ghash_flush ( ctx, dctx ) ; <END_BUG> memcpy ( dst, buf, GHASH_BLOCK_SIZE ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> buffer ; if (! ctx -> gf128 ) return - ENOKEY ;
Buggy code:
 static ssize_t _hostsock_send ( oe_fd_t * sock_, const void * buf, size_t count, int flags ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_errno = 0 ; <START_BUG> if (! sock || ( count &&! buf ) ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( oe_syscall_send_ocall ( & ret, sock -> host_fd, buf, count, flags )!= OE_OK ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart>! buf ) || count > OE_SSIZE_MAX <S2SV_ModStart> OE_EINVAL ) ; if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 static void encode_frame_to_data_rate ( VP8_COMP * cpi, unsigned long * size, unsigned char * dest, unsigned char * dest_end, unsigned int * frame_flags ) { int Q ; int frame_over_shoot_limit ; int frame_under_shoot_limit ; int Loop = 0 ; int loop_count ; VP8_COMMON * cm = & cpi -> common ; int active_worst_qchanged = 0 ; # if! ( CONFIG_REALTIME_ONLY ) int q_low ; int q_high ; int zbin_oq_high ; int zbin_oq_low = 0 ; int top_index ; int bottom_index ; int overshoot_seen = 0 ; int undershoot_seen = 0 ; # endif int drop_mark = ( int ) ( cpi -> oxcf. drop_frames_water_mark * cpi -> oxcf. optimal_buffer_level // 100 ) ; int drop_mark75 = drop_mark * 2 // 3 ; int drop_mark50 = drop_mark // 4 ; int drop_mark25 = drop_mark // 8 ; vp8_clear_system_state ( ) ; # if CONFIG_MULTITHREAD if ( cpi -> b_lpf_running ) { sem_wait ( & cpi -> h_event_end_lpf ) ; cpi -> b_lpf_running = 0 ; } # endif if ( cpi -> force_next_frame_intra ) { cm -> frame_type = KEY_FRAME ; cpi -> force_next_frame_intra = 0 ; } # if! ( CONFIG_REALTIME_ONLY ) if ( cpi -> pass == 2 ) { if ( cpi -> common. refresh_alt_ref_frame ) { cpi -> per_frame_bandwidth = cpi -> twopass. gf_bits ; cpi -> target_bandwidth = ( int ) ( cpi -> twopass. gf_bits * cpi -> output_framerate ) ; } } else # endif cpi -> per_frame_bandwidth = ( int ) ( cpi -> target_bandwidth // cpi -> output_framerate ) ; cm -> copy_buffer_to_gf = 0 ; cm -> copy_buffer_to_ar

Fix:
<S2SV_ModStart> = KEY_FRAME ; # if CONFIG_TEMPORAL_DENOISING if ( cpi -> oxcf. noise_sensitivity == 4 ) { vp8_denoiser_set_parameters ( & cpi -> denoiser, kDenoiserOnYUV ) ; } # endif } # if <S2SV_ModEnd> CONFIG_MULTI_RES_ENCODING if ( <S2SV_ModStart> -> oxcf. mr_total_resolutions > 1 ) <S2SV_ModEnd> { LOWER_RES_FRAME_INFO * <S2SV_ModStart>. mr_low_res_mode_info ; if ( cpi -> oxcf. mr_encoder_id ) { <S2SV_ModStart> ] ) ; } } if ( cm -> frame_type == KEY_FRAME ) { if ( cpi -> oxcf. mr_encoder_id ) { if ( cpi -> common. current_video_frame == 0 && cpi -> buffer_level == 0 ) { unsigned int i ; cpi -> bits_off_target = cpi -> oxcf. starting_buffer_level ; cpi -> buffer_level = cpi -> oxcf. starting_buffer_level ; for ( i = 0 ; i < cpi -> oxcf.
Buggy code:
 static int adjust_ptr_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, const struct bpf_reg_state * ptr_reg, const struct bpf_reg_state * off_reg ) { struct bpf_reg_state * regs = cur_regs ( env ), * dst_reg ; bool known = tnum_is_const ( off_reg -> var_off ) ; s64 smin_val = off_reg -> smin_value, smax_val = off_reg -> smax_value, smin_ptr = ptr_reg -> smin_value, smax_ptr = ptr_reg -> smax_value ; u64 umin_val = off_reg -> umin_value, umax_val = off_reg -> umax_value, umin_ptr = ptr_reg -> umin_value, umax_ptr = ptr_reg -> umax_value ; u8 opcode = BPF_OP ( insn -> code ) ; u32 dst = insn -> dst_reg ; dst_reg = & regs [ dst ] ; if ( WARN_ON_ONCE ( known && ( smin_val!= smax_val ) ) ) { print_verifier_state ( env, env -> cur_state ) ; verbose ( env, "verifier   internal   error:   known   but   bad   sbounds\\n" ) ; return - EINVAL ; } if ( WARN_ON_ONCE ( known && ( umin_val!= umax_val ) ) ) { print_verifier_state ( env, env -> cur_state ) ; verbose ( env, "verifier   internal   error:   known   but   bad   ubounds\\n" ) ; return - EINVAL ; } if ( BPF_CLASS ( insn -> code )!= BPF_ALU64 ) { if (! env -> allow_ptr_leaks ) verbose ( env, "R%d   32-bit   pointer   arithmetic   prohibited\\n", dst ) ; return - EACCES ; } if ( ptr_reg -> type == PTR_TO_MAP_VALUE_OR_NULL ) { if (! env -> allow_ptr_leaks ) verbose ( env, "R%d   pointer

Fix:
<S2SV_ModStart> ptr_reg -> id ; if (! check_reg_sane_offset ( env, off_reg, ptr_reg -> type ) ||! check_reg_sane_offset ( env, ptr_reg, ptr_reg -> type ) ) return - EINVAL <S2SV_ModStart> EACCES ; } if (! check_reg_sane_offset ( env, dst_reg, ptr_reg -> type ) ) return - EINVAL ;
Buggy code:
 static int readSeparateStripsIntoBuffer ( TIFF * in, uint8 * obuf, uint32 length, uint32 width, uint16 spp, struct dump_opts * dump ) { <START_BUG> int i, j, bytes_per_sample, bytes_per_pixel, shift_width, result = 1 ; <END_BUG> int32 bytes_read = 0 ;  uint16 bps, nstrips, planar, strips_per_sample ; <START_BUG> uint32 src_rowsize, dst_rowsize, rows_processed, rps ; uint32 rows_this_strip = 0 ; tsample_t s ; tstrip_t strip ; tsize_t scanlinesize = TIFFScanlineSize ( in ) ; tsize_t stripsize = TIFFStripSize ( in ) ; unsigned char * srcbuffs [ MAX_SAMPLES ] ; unsigned char * buff = NULL ; unsigned char * dst = NULL ; if ( obuf == NULL ) { TIFFError ( "readSeparateStripsIntoBuffer", "Invalid   buffer   argument" ) ; return ( 0 ) ; } memset ( srcbuffs, '\\0', sizeof ( srcbuffs ) ) ; TIFFGetField ( in, TIFFTAG_BITSPERSAMPLE, & bps ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_PLANARCONFIG, & planar ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_ROWSPERSTRIP, & rps ) ; if ( rps > length ) rps = length ; bytes_per_sample = ( bps + 7 ) // 8 ; bytes_per_pixel = ( ( bps * spp ) + 7 ) // 8 ; if ( bytes_per_pixel < ( bytes_per_sample + 1 ) ) shift_width = bytes_per_pixel ; else shift_width = bytes_per_sample + 1 ; src_rowsize = ( ( bps * width ) + 7 ) // 8 ; dst_rowsize = ( ( bps * width * spp ) + 7 ) // 8 ; dst = obuf ; if ( ( dump -> infile!= NULL ) && ( dump -> level == 3 ) ) { dump_info ( dump -> infile, dump -> format, "", "Image   width   %d,   length   %d,   Scanline   size,   %4d   bytes", width<END_BUG>

Fix:
<S2SV_ModStart> int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1 ; uint32 j <S2SV_ModEnd> ; int32 bytes_read <S2SV_ModStart> uint16 bps, planar ; uint32 nstrips ; uint32 <S2SV_ModEnd> strips_per_sample ; uint32
Buggy code:
 int socket_accept ( int fd, uint16_t port ) { # ifdef WIN32 int addr_len ; # else socklen_t addr_len ; # endif int result ; struct sockaddr_in addr ; memset ( & addr, 0, sizeof ( addr ) ) ; addr. sin_family = AF_INET ; <START_BUG> addr. sin_addr. s_addr = htonl ( INADDR_ANY ) ; <END_BUG> addr. sin_port = htons ( port ) ; addr_len = sizeof ( addr ) ; result = accept ( fd, ( struct sockaddr * ) & addr, & addr_len ) ; return result ; }

Fix:
<S2SV_ModStart> = htonl ( INADDR_LOOPBACK <S2SV_ModEnd> ) ; addr
Buggy code:
 void vp9_cyclic_refresh_update_segment ( VP9_COMP * const cpi, MB_MODE_INFO * const mbmi, int mi_row, int mi_col, <START_BUG> BLOCK_SIZE bsize, int use_rd ) { <END_BUG> const VP9_COMMON * const cm = & cpi -> common ; CYCLIC_REFRESH * const cr = cpi -> cyclic_refresh ; const int bw = num_8x8_blocks_wide_lookup [ bsize ] ; const int bh = num_8x8_blocks_high_lookup [ bsize ] ; const int xmis = MIN ( cm -> mi_cols - mi_col, bw ) ; const int ymis = MIN ( cm -> mi_rows - mi_row, bh ) ; const int block_index = mi_row * cm -> mi_cols + mi_col ;  const int refresh_this_block = candidate_refresh_aq ( cr, mbmi, bsize, use_rd ) ; <START_BUG> int new_map_value = cr -> map [ block_index ] ; int x = 0 ; int y = 0 ; <END_BUG> if ( mbmi -> segment_id > 0 &&! refresh_this_block )  mbmi -> segment_id = 0 ; <START_BUG> if ( mbmi -> segment_id == 1 ) { <END_BUG> new_map_value = - cr -> time_for_refresh ; } else if ( refresh_this_block ) { if ( cr -> map [ block_index ] == 1 ) new_map_value = 0 ; } else { new_map_value = 1 ; } for ( y = 0 ; y < ymis ; y ++ ) for ( x = 0 ; x < xmis ; x ++ ) {  cr -> map [ block_index + y * cm -> mi_cols + x ] = new_map_value ; <START_BUG> <END_BUG> cpi -> segmentation_map [ block_index + y * cm -> mi_cols + x ] =  mbmi -> segment_id ; } if ( mbmi -> segment_id ) cr -> num_seg_blocks += xmis * ymis ; }

Fix:
<S2SV_ModStart> BLOCK_SIZE bsize, int64_t rate, int64_t dist, int skip <S2SV_ModEnd> ) { const <S2SV_ModStart>, mbmi, rate, dist, bsize <S2SV_ModEnd> ) ; int <S2SV_ModStart> ; if ( cyclic_refresh_segment_id_boosted ( mbmi -> segment_id ) ) { mbmi -> segment_id = refresh_this_block ; if ( skip ) mbmi -> segment_id = CR_SEGMENT_ID_BASE ; } if ( cyclic_refresh_segment_id_boosted ( mbmi -> segment_id ) ) { new_map_value = - cr -> time_for_refresh ; } else if ( refresh_this_block ) { if ( cr -> map [ block_index ] <S2SV_ModEnd> == 1 ) <S2SV_ModStart> == 1 ) <S2SV_ModEnd> new_map_value = 0 <S2SV_ModStart> ++ ) { int map_offset = <S2SV_ModEnd> block_index + y <S2SV_ModStart> mi_cols + x ; cr -> map [ map_offset <S2SV_ModStart> -> segmentation_map [ map_offset ] = mbmi -> segment_id ; if (! is_inter_block ( mbmi ) ||! skip ) cr -> last_coded_q_map [ map_offset ] = clamp ( cm -> base
Buggy code:
 static void save_text_if_changed ( const char * name, const char * new_value ) { if (! g_hash_table_lookup ( g_loaded_texts, name ) ) return ; const char * old_value = g_cd? problem_data_get_content_or_NULL ( g_cd, name ) : "" ; if (! old_value ) old_value = "" ; if ( strcmp ( new_value, old_value )!= 0 ) { struct dump_dir * dd = wizard_open_directory_for_writing ( g_dump_dir_name ) ; if ( dd ) dd_save_text ( dd, name, new_value ) ; dd_close ( dd ) ; <START_BUG> problem_data_reload_from_dump_dir ( ) ; <END_BUG> update_gui_state_from_problem_data ( 0 ) ; } }

Fix:
<S2SV_ModStart> dd ) ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 void vp8_default_bmode_probs ( vp8_prob p [ VP8_BINTRAMODES - 1 ] ) { <START_BUG> vpx_memcpy ( p, vp8_bmode_prob, sizeof ( vp8_bmode_prob ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ] ) { memcpy <S2SV_ModEnd> ( p,
Buggy code:
 static int validate_event ( struct pmu_hw_events * hw_events, struct perf_event * event ) { struct arm_pmu * armpmu = to_arm_pmu ( event -> pmu ) ; <START_BUG> struct pmu * leader_pmu = event -> group_leader -> pmu ; <END_BUG> if ( event -> pmu!= leader_pmu || event -> state < PERF_EVENT_STATE_OFF ) return 1 ; if ( event -> state == PERF_EVENT_STATE_OFF &&! event -> attr. enable_on_exec ) return 1 ; return armpmu -> get_event_idx ( hw_events, event ) >= 0 ; }

Fix:
<S2SV_ModStart> group_leader -> pmu ; if ( is_software_event ( event ) ) return 1
Buggy code:
 static int muscle_list_files ( sc_card_t * card, u8 * buf, size_t bufLen ) { muscle_private_t * priv = MUSCLE_DATA ( card ) ; mscfs_t * fs = priv -> fs ; int x ; int count = 0 ; mscfs_check_cache ( priv -> fs ) ; for ( x = 0 ; x < fs -> cache. size ; x ++ ) { u8 * oid = fs -> cache. array [ x ]. objectId. id ; <START_BUG> sc_debug ( card -> ctx, SC_LOG_DEBUG_NORMAL, <END_BUG> "FILE:   %02X%02X%02X%02X\\n", oid [ 0 ], oid [ 1 ], oid [ 2 ], oid [ 3 ] ) ; if ( 0 == memcmp ( fs -> currentPath, oid, 2 ) ) { buf [ 0 ] = oid [ 2 ] ; buf [ 1 ] = oid [ 3 ] ; if ( buf [ 0 ] == 0x00 && buf [ 1 ] == 0x00 ) continue ; buf += 2 ; count += 2 ;  } <START_BUG> } return count ; }<END_BUG>

Fix:
<S2SV_ModStart>. id ; if ( bufLen < 2 ) break ; <S2SV_ModStart> += 2 ; bufLen -= 2 ;
Buggy code:
 const char * vpx_svc_get_message ( const SvcContext * svc_ctx ) { <START_BUG> const SvcInternal * const si = get_const_svc_internal ( svc_ctx ) ; <END_BUG> if ( svc_ctx == NULL || si == NULL ) return NULL ; return si -> message_buffer ; }

Fix:
<S2SV_ModStart> ) { const SvcInternal_t <S2SV_ModEnd> * const si
Buggy code:
 static void process_open ( u_int32_t id ) { u_int32_t pflags ; Attrib a ; char * name ; int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE ; if ( ( r = sshbuf_get_cstring ( iqueue, & name, NULL ) )!= 0 || ( r = sshbuf_get_u32 ( iqueue, & pflags ) )!= 0 || ( r = decode_attrib ( iqueue, & a ) )!= 0 ) fatal ( "%s:   buffer   error:   %s", __func__, ssh_err ( r ) ) ; debug3 ( "request   %u:   open   flags   %d", id, pflags ) ; flags = flags_from_portable ( pflags ) ; mode = ( a. flags & SSH2_FILEXFER_ATTR_PERMISSIONS )? a. perm : 0666 ; logit ( "open   \\"%s\\"   flags   %s   mode   0%o", name, string_from_portable ( pflags ), mode ) ; if ( readonly && <START_BUG> ( ( flags & O_ACCMODE ) == O_WRONLY || <END_BUG>  ( flags & O_ACCMODE ) == O_RDWR ) ) { <START_BUG> verbose ( "Refusing   open   request   in   read-only   mode" ) ; status = SSH2_FX_PERMISSION_DENIED ; } else { fd = open ( name, flags, mode ) ; if ( fd < 0 ) { status = errno_to_portable ( errno ) ; } else { handle = handle_new ( HANDLE_FILE, name, fd, flags, NULL ) ; if ( handle < 0 ) { close ( fd ) ; } else { send_handle ( id, handle ) ; status = SSH2_FX_OK ; } } } if ( status!= SSH2_FX_OK ) send_status ( id, status ) ; free ( name ) ; }<END_BUG>

Fix:
<S2SV_ModStart> & O_ACCMODE )!= O_RDONLY <S2SV_ModEnd> || ( flags <S2SV_ModStart> ( flags & ( O_CREAT | O_TRUNC ) )!= 0 <S2SV_ModEnd> ) ) {
Buggy code:
 static void sctp_close ( struct sock * sk, long timeout ) { struct net * net = sock_net ( sk ) ; struct sctp_endpoint * ep ; struct sctp_association * asoc ; struct list_head * pos, * temp ; unsigned int data_was_unread ; pr_debug ( "%s:   sk:%p,   timeout:%ld\\n", __func__, sk, timeout ) ; lock_sock ( sk ) ; sk -> sk_shutdown = SHUTDOWN_MASK ; sk -> sk_state = SCTP_SS_CLOSING ; ep = sctp_sk ( sk ) -> ep ; data_was_unread = sctp_queue_purge_ulpevents ( & sk -> sk_receive_queue ) ; data_was_unread += sctp_queue_purge_ulpevents ( & sctp_sk ( sk ) -> pd_lobby ) ; list_for_each_safe ( pos, temp, & ep -> asocs ) { asoc = list_entry ( pos, struct sctp_association, asocs ) ; if ( sctp_style ( sk, TCP ) ) { if ( sctp_state ( asoc, CLOSED ) ) { sctp_unhash_established ( asoc ) ; sctp_association_free ( asoc ) ; continue ; } } if ( data_was_unread ||! skb_queue_empty ( & asoc -> ulpq. lobby ) ||! skb_queue_empty ( & asoc -> ulpq. reasm ) || ( sock_flag ( sk, SOCK_LINGER ) &&! sk -> sk_lingertime ) ) { struct sctp_chunk * chunk ; chunk = sctp_make_abort_user ( asoc, NULL, 0 ) ; if ( chunk ) sctp_primitive_ABORT ( net, asoc, chunk ) ; } else sctp_primitive_SHUTDOWN ( net, asoc, NULL ) ; } if ( sctp_style ( sk, TCP ) && timeout ) sctp_wait_for_close ( sk, timeout ) ; release_sock ( sk ) ; <START_BUG> local_bh_disable ( ) ; <END_BUG> bh_lock_sock ( sk ) ; sock_hold ( sk ) ; sk_common_

Fix:
<S2SV_ModStart> sk ) ; spin_lock_bh ( & net -> sctp. addr_wq_lock <S2SV_ModEnd> ) ; bh_lock_sock <S2SV_ModStart> sk ) ; spin_unlock_bh ( & net -> sctp. addr_wq_lock <S2SV_ModEnd> ) ; sock_put
Buggy code:
 void flush_tlb_mm_range ( struct mm_struct * mm, unsigned long start, unsigned long end, unsigned long vmflag ) { unsigned long addr ; unsigned long base_pages_to_flush = TLB_FLUSH_ALL ; preempt_disable ( ) ; <START_BUG> if ( current -> active_mm!= mm ) <END_BUG>  goto out ; <START_BUG> if (! current -> mm ) { leave_mm ( smp_processor_id ( ) ) ; <END_BUG> goto out ;  } if ( ( end!= TLB_FLUSH_ALL ) &&! ( vmflag & VM_HUGETLB ) ) base_pages_to_flush = ( end - start ) >> PAGE_SHIFT ; if ( base_pages_to_flush > tlb_single_page_flush_ceiling ) { base_pages_to_flush = TLB_FLUSH_ALL ; count_vm_tlb_event ( NR_TLB_LOCAL_FLUSH_ALL ) ; local_flush_tlb ( ) ; } else { for ( addr = start ; addr < end ; addr += PAGE_SIZE ) { count_vm_tlb_event ( NR_TLB_LOCAL_FLUSH_ONE ) ; __flush_tlb_single ( addr ) ; } } trace_tlb_flush ( TLB_LOCAL_MM_SHOOTDOWN, base_pages_to_flush ) ; out : if ( base_pages_to_flush == TLB_FLUSH_ALL ) { start = 0UL ; end = TLB_FLUSH_ALL ; } if ( cpumask_any_but ( mm_cpumask ( mm ), smp_processor_id ( ) ) < nr_cpu_ids ) flush_tlb_others ( mm_cpumask ( mm ), mm, start, end ) ; preempt_enable ( ) ; }

Fix:
<S2SV_ModStart>!= mm ) { smp_mb ( ) ; <S2SV_ModStart> goto out ; } <S2SV_ModStart> ) ) ; smp_mb ( ) ;
Buggy code:
 static inline int do_exception ( struct pt_regs * regs, int access, unsigned long trans_exc_code ) { struct task_struct * tsk ; struct mm_struct * mm ; struct vm_area_struct * vma ; unsigned long address ; unsigned int flags ; int fault ; if ( notify_page_fault ( regs ) ) return 0 ; tsk = current ; mm = tsk -> mm ; fault = VM_FAULT_BADCONTEXT ; if ( unlikely (! user_space_fault ( trans_exc_code ) || in_atomic ( ) ||! mm ) ) goto out ; address = trans_exc_code & __FAIL_ADDR_MASK ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address ) ; <END_BUG> flags = FAULT_FLAG_ALLOW_RETRY ; if ( access == VM_WRITE || ( trans_exc_code & store_indication ) == 0x400 ) flags |= FAULT_FLAG_WRITE ; retry : down_read ( & mm -> mmap_sem ) ; fault = VM_FAULT_BADMAP ; vma = find_vma ( mm, address ) ; if (! vma ) goto out_up ; if ( unlikely ( vma -> vm_start > address ) ) { if (! ( vma -> vm_flags & VM_GROWSDOWN ) ) goto out_up ; if ( expand_stack ( vma, address ) ) goto out_up ; } fault = VM_FAULT_BADACCESS ; if ( unlikely (! ( vma -> vm_flags & access ) ) ) goto out_up ; if ( is_vm_hugetlb_page ( vma ) ) address &= HPAGE_MASK ; fault = handle_mm_fault ( mm, vma, address, flags ) ; if ( unlikely ( fault & VM_FAULT_ERROR ) ) goto out_up ; if ( flags & FAULT_FLAG_ALLOW_RETRY ) { if ( fault & VM_FAULT_MAJOR ) { tsk -> maj_flt ++ ;  perf_sw_event ( PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0, <START_BUG> regs, address ) ; } else { tsk -> min_flt ++ ; <END_BUG> perf_sw_event ( PERF_COUNT_SW_PAGE_FAULT

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address <S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address <S2SV_ModStart> PERF_COUNT_SW_PAGE_FAULTS_MIN, 1 <S2SV_ModEnd>, regs,
Buggy code:
 static void show_object ( struct object * obj, <START_BUG> struct strbuf * path, const char * last, <END_BUG> void * data ) {  char * name = path_name ( path, last ) ; <START_BUG> add_preferred_base_object ( name ) ; add_object_entry ( obj -> oid. hash, obj -> type, name, 0 ) ; obj -> flags |= OBJECT_ADDED ; <END_BUG> free ( ( char * ) name ) ;  }

Fix:
<S2SV_ModStart> * obj, <S2SV_ModEnd> const char * <S2SV_ModStart> const char * name <S2SV_ModEnd>, void * <S2SV_ModStart> data ) { <S2SV_ModEnd> add_preferred_base_object ( name <S2SV_ModStart> |= OBJECT_ADDED ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void do_service ( Socket_T s ) { volatile HttpResponse res = create_HttpResponse ( s ) ; volatile HttpRequest req = create_HttpRequest ( s ) ; if ( res && req ) { if ( Run. httpd. flags & Httpd_Ssl ) set_header ( res, "Strict-Transport-Security", "max-age=63072000;   includeSubdomains;   preload" ) ; <START_BUG> if ( is_authenticated ( req, res ) ) { <END_BUG> if ( IS ( req -> method, METHOD_GET ) ) Impl. doGet ( req, res ) ; else if ( IS ( req -> method, METHOD_POST ) ) Impl. doPost ( req, res ) ; else send_error ( req, res, SC_NOT_IMPLEMENTED, "Method   not   implemented" ) ; } send_response ( req, res ) ; } done ( req, res ) ; }

Fix:
<S2SV_ModStart> ) ) { set_header ( res, "Set-Cookie", "securitytoken=%s; <S2SV_blank> Max-Age=600; <S2SV_blank> HttpOnly; <S2SV_blank> SameSite=strict%s", res -> token, Run. httpd. flags & Httpd_Ssl? "; <S2SV_blank> Secure" : "" ) ;
Buggy code:
 static int get_siz ( Jpeg2000DecoderContext * s ) { int i ; int ncomponents ; uint32_t log2_chroma_wh = 0 ; const enum AVPixelFormat * possible_fmts = NULL ; int possible_fmts_nb = 0 ; if ( bytestream2_get_bytes_left ( & s -> g ) < 36 ) return AVERROR_INVALIDDATA ; s -> avctx -> profile = bytestream2_get_be16u ( & s -> g ) ; s -> width = bytestream2_get_be32u ( & s -> g ) ; s -> height = bytestream2_get_be32u ( & s -> g ) ; s -> image_offset_x = bytestream2_get_be32u ( & s -> g ) ; s -> image_offset_y = bytestream2_get_be32u ( & s -> g ) ; s -> tile_width = bytestream2_get_be32u ( & s -> g ) ; s -> tile_height = bytestream2_get_be32u ( & s -> g ) ; s -> tile_offset_x = bytestream2_get_be32u ( & s -> g ) ; s -> tile_offset_y = bytestream2_get_be32u ( & s -> g ) ; ncomponents = bytestream2_get_be16u ( & s -> g ) ; if ( ncomponents <= 0 ) { av_log ( s -> avctx, AV_LOG_ERROR, "Invalid   number   of   components:   %d\\n", s -> ncomponents ) ; return AVERROR_INVALIDDATA ; } if ( ncomponents > 4 ) { avpriv_request_sample ( s -> avctx, "Support   for   %d   components", s -> ncomponents ) ; return AVERROR_PATCHWELCOME ; } s -> ncomponents = ncomponents ; if ( s -> tile_width <= 0 || s -> tile_height <= 0 ) { av_log ( s -> avctx, AV_LOG_ERROR, "Invalid   tile   dimension   %dx%d.\\n", s -> tile_width, s -> tile_height ) ; return AVERROR_INVALIDDATA ; } if (

Fix:
<S2SV_ModStart> i ] || s -> cdx [ i ] == 3 || s -> cdx [ i ] > 4 || <S2SV_ModStart> [ i ] || s -> cdy [ i ] == 3 || s -> cdy [ i ] > 4
Buggy code:
 WORD32 ihevcd_decode ( iv_obj_t * ps_codec_obj, void * pv_api_ip, void * pv_api_op ) { WORD32 ret = IV_SUCCESS ; codec_t * ps_codec = ( codec_t * ) ( ps_codec_obj -> pv_codec_handle ) ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; WORD32 proc_idx = 0 ; WORD32 prev_proc_idx = 0 ; ps_codec -> i4_error_code = 0 ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } if ( ps_codec -> i4_init_done!= 1 ) { ps_dec_op -> u4_error_code |= 1 << IVD_FATALERROR ; ps_dec_op -> u4_error_code |= IHEVCD_INIT_NOT_DONE ; return IV_FAIL ; } if ( ps_codec -> u4_pic_cnt >= NUM_FRAMES_LIMIT ) { ps_dec_op -> u4_error_code |= 1 << IVD_FATALERROR ; ps_dec_op -> u4_error_code |= IHEVCD_NUM_FRAMES_LIMIT_REACHED ; return IV_FAIL ; } if ( ps_codec -> i4_reset_flag ) { ps_codec -> i4_flush_mode = 1 ; } if ( 0 == ps_codec -> i4_flush_mode ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_BS_BUF_NULL

Fix:
<S2SV_ModStart> { ps_codec -> s_parse. i4_cur_slice_idx = MAX ( 0, ( ps_codec -> s_parse. i4_cur_slice_idx - 1 ) ) ; ps_codec ->
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_set_activemap ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_active_map_t * data = va_arg ( args, vpx_active_map_t * ) ; if ( data ) { vpx_active_map_t * map = ( vpx_active_map_t * ) data ; if (! vp8_set_active_map ( ctx -> cpi, map -> active_map, map -> rows, map -> cols ) ) return VPX_CODEC_OK ; else return VPX_CODEC_INVALID_PARAM ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static int ext4_ext_handle_uninitialized_extents ( handle_t * handle, struct inode * inode, ext4_lblk_t iblock, unsigned int max_blocks, struct ext4_ext_path * path, int flags, unsigned int allocated, struct buffer_head * bh_result, ext4_fsblk_t newblock ) { int ret = 0 ; int err = 0 ; ext4_io_end_t * io = EXT4_I ( inode ) -> cur_aio_dio ; ext_debug ( "ext4_ext_handle_uninitialized_extents:   inode   %lu,   logical" "block   %llu,   max_blocks   %u,   flags   %d,   allocated   %u", inode -> i_ino, ( unsigned long long ) iblock, max_blocks, flags, allocated ) ; ext4_ext_show_leaf ( inode, path ) ; <START_BUG> if ( flags == EXT4_GET_BLOCKS_PRE_IO ) { <END_BUG> ret = ext4_split_unwritten_extents ( handle, inode, path, iblock, max_blocks, flags ) ; if ( io ) io -> flag = EXT4_IO_UNWRITTEN ; else  ext4_set_inode_state ( inode, EXT4_STATE_DIO_UNWRITTEN ) ; <START_BUG> goto out ; } <END_BUG> if ( flags == EXT4_GET_BLOCKS_CONVERT ) {  ret = ext4_convert_unwritten_extents_endio ( handle, inode, path ) ; if ( ret >= 0 ) ext4_update_inode_fsync_trans ( handle, inode, 1 ) ; goto out2 ; } if ( flags & EXT4_GET_BLOCKS_UNINIT_EXT ) goto map_out ; if ( ( flags & EXT4_GET_BLOCKS_CREATE ) == 0 ) { set_buffer_unwritten ( bh_result ) ; goto out1 ; } ret = ext4_ext_convert_to_initialized ( handle, inode, path, iblock, max_blocks ) ; if ( ret >= 0 ) ext4_update_inode_fsync_trans ( handle, inode, 1 ) ; out : if ( ret <= 0 ) { err = ret ;

Fix:
<S2SV_ModStart> ; if ( ( flags & EXT4_GET_BLOCKS_PRE_IO ) ) <S2SV_ModEnd> { ret = <S2SV_ModStart> inode, EXT4_STATE_DIO_UNWRITTEN ) ; if ( ext4_should_dioread_nolock ( inode ) ) set_buffer_uninit ( bh_result <S2SV_ModStart> } if ( ( flags & EXT4_GET_BLOCKS_CONVERT ) <S2SV_ModEnd> ) { ret
Buggy code:
 static netdev_tx_t veth_xmit ( struct sk_buff * skb, struct net_device * dev ) { struct net_device * rcv = NULL ; struct veth_priv * priv, * rcv_priv ; struct veth_net_stats * stats, * rcv_stats ; int length ; priv = netdev_priv ( dev ) ; rcv = priv -> peer ; rcv_priv = netdev_priv ( rcv ) ; stats = this_cpu_ptr ( priv -> stats ) ; rcv_stats = this_cpu_ptr ( rcv_priv -> stats ) ; if (! ( rcv -> flags & IFF_UP ) ) goto tx_drop ; if ( dev -> features & NETIF_F_NO_CSUM ) skb -> ip_summed = rcv_priv -> ip_summed ; length = skb -> len + ETH_HLEN ; if ( dev_forward_skb ( rcv, skb )!= NET_RX_SUCCESS ) goto rx_drop ; stats -> tx_bytes += length ; stats -> tx_packets ++ ; rcv_stats -> rx_bytes += length ; rcv_stats -> rx_packets ++ ; return NETDEV_TX_OK ; tx_drop : kfree_skb ( skb ) ; stats -> tx_dropped ++ ; return NETDEV_TX_OK ; rx_drop : <START_BUG> kfree_skb ( skb ) ; <END_BUG> rcv_stats -> rx_dropped ++ ; return NETDEV_TX_OK ; }

Fix:
<S2SV_ModStart> ; rx_drop : <S2SV_ModEnd> rcv_stats -> rx_dropped
Buggy code:
 WORD32 ih264d_mark_err_slice_skip ( dec_struct_t * ps_dec, WORD32 num_mb_skip, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num, pocstruct_t * ps_cur_poc, WORD32 prev_slice_err ) { WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2 ; UWORD32 u1_mb_idx = ps_dec -> u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end ; UWORD32 u1_tfr_n_mb ; UWORD32 u1_decode_nmb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD16 u2_total_mbs_coded ; UWORD32 u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; parse_part_params_t * ps_part_info ; WORD32 ret ; if ( ps_dec -> ps_dec_err_status -> u1_err_flag & REJECT_CUR_PIC ) { ih264d_err_pic_dispbuf_mgr ( ps_dec )

Fix:
<S2SV_ModStart> ) { return ERROR_INV_SLICE_HDR_T <S2SV_ModEnd> ; } if
Buggy code:
 int pci_emul_add_capability ( struct pci_vdev * dev, u_char * capdata, int caplen ) { int i, capoff, reallen ; uint16_t sts ; <START_BUG> assert ( caplen > 0 ) ; <END_BUG> reallen = roundup2 ( caplen, 4 ) ; sts = pci_get_cfgdata16 ( dev, PCIR_STATUS ) ; if ( ( sts & PCIM_STATUS_CAPPRESENT ) == 0 ) capoff = CAP_START_OFFSET ; else capoff = dev -> capend + 1 ; if ( capoff + reallen > PCI_REGMAX + 1 ) return - 1 ; if ( ( sts & PCIM_STATUS_CAPPRESENT ) == 0 ) { pci_set_cfgdata8 ( dev, PCIR_CAP_PTR, capoff ) ; pci_set_cfgdata16 ( dev, PCIR_STATUS, sts | PCIM_STATUS_CAPPRESENT ) ; } else pci_set_cfgdata8 ( dev, dev -> prevcap + 1, capoff ) ; for ( i = 0 ; i < caplen ; i ++ ) pci_set_cfgdata8 ( dev, capoff + i, capdata [ i ] ) ; pci_set_cfgdata8 ( dev, capoff + 1, 0 ) ; dev -> prevcap = capoff ; dev -> capend = capoff + reallen - 1 ; return 0 ; }

Fix:
<S2SV_ModStart> uint16_t sts ; <S2SV_ModEnd> reallen = roundup2
Buggy code:
 static gboolean cosine_read ( wtap * wth, int * err, gchar * * err_info, gint64 * data_offset ) { <START_BUG> gint64 offset ; <END_BUG> int pkt_len ; char line [ COSINE_LINE_LENGTH ] ; offset = cosine_seek_next_packet ( wth, err, err_info, line ) ; if ( offset < 0 ) return FALSE ; * data_offset = offset ;  pkt_len = parse_cosine_rec_hdr ( & wth -> phdr, line, err, err_info ) ; <START_BUG> if ( pkt_len == - 1 ) return FALSE ; <END_BUG> return parse_cosine_hex_dump ( wth -> fh, & wth -> phdr, pkt_len,  <START_BUG> wth -> frame_buffer, err, err_info ) ; <END_BUG> }

Fix:
<S2SV_ModStart> { gint64 offset <S2SV_ModEnd> ; char line <S2SV_ModStart> = offset ; return parse_cosine_packet <S2SV_ModEnd> ( wth -> <S2SV_ModStart> -> phdr, <S2SV_ModEnd> wth -> frame_buffer <S2SV_ModStart> wth -> frame_buffer, line
Buggy code:
 int sandbox ( void * sandbox_arg ) { ( void ) sandbox_arg ; pid_t child_pid = getpid ( ) ; if ( arg_debug ) printf ( "Initializing   child   process\\n" ) ; close ( parent_to_child_fds [ 1 ] ) ; close ( child_to_parent_fds [ 0 ] ) ; wait_for_other ( parent_to_child_fds [ 0 ] ) ; if ( arg_debug && child_pid == 1 ) printf ( "PID   namespace   installed\\n" ) ; if ( cfg. hostname ) { if ( sethostname ( cfg. hostname, strlen ( cfg. hostname ) ) < 0 ) errExit ( "sethostname" ) ; } if ( mount ( NULL, "//", NULL, MS_SLAVE | MS_REC, NULL ) < 0 ) { chk_chroot ( ) ; } preproc_mount_mnt_dir ( ) ; if ( mount ( LIBDIR "//firejail", RUN_FIREJAIL_LIB_DIR, "none", MS_BIND, NULL ) < 0 ) errExit ( "mounting   " RUN_FIREJAIL_LIB_DIR ) ; if ( cfg. name ) fs_logger2 ( "sandbox   name:", cfg. name ) ; fs_logger2int ( "sandbox   pid:", ( int ) sandbox_pid ) ; if ( cfg. chrootdir ) fs_logger ( "sandbox   filesystem:   chroot" ) ; else if ( arg_overlay ) fs_logger ( "sandbox   filesystem:   overlay" ) ; else fs_logger ( "sandbox   filesystem:   local" ) ; fs_logger ( "install   mount   namespace" ) ; if ( arg_netfilter && any_bridge_configured ( ) ) { netfilter ( arg_netfilter_file ) ; } if ( arg_netfilter6 && any_bridge_configured ( ) ) { netfilter6 ( arg_netfilter6_file ) ; } int gw_cfg_failed = 0 ; if ( arg_nonetwork ) { net_if_up ( "lo" ) ; if ( arg_debug ) printf ( "Network   namespace   enabled,   only   loopback   interface   available\\n" ) ; } else if ( arg_netns ) { netns ( arg_

Fix:
<S2SV_ModStart> ( ) ; <S2SV_ModEnd> save_cpu ( ) <S2SV_ModStart> rv ; } fs_rdonly ( RUN_SECCOMP_DIR ) ; # endif set_caps ( ) ; <S2SV_ModEnd> FILE * rj
Buggy code:
 static Sdb * store_versioninfo_gnu_verneed ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { ut8 * end, * need = NULL ; const char * section_name = "" ; Elf_ ( Shdr ) * link_shdr = NULL ; const char * link_section_name = "" ; Sdb * sdb_vernaux = NULL ; Sdb * sdb_version = NULL ; Sdb * sdb = NULL ; int i, cnt ; if (! bin ||! bin -> dynstr ) { return NULL ; } if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return NULL ; } <START_BUG> if ( shdr -> sh_size < 1 ) { <END_BUG> return NULL ; } sdb = sdb_new0 ( ) ; if (! sdb ) { return NULL ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! ( need = ( ut8 * ) calloc ( R_MAX ( 1, shdr -> sh_size ), sizeof ( ut8 ) ) ) ) { bprintf ( "Warning:   Cannot   allocate   memory   for   Elf_(Verneed)\\n" ) ; goto beach ; } end = need + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "num_entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link,

Fix:
<S2SV_ModStart> sh_size < 1 || shdr -> sh_size > SIZE_MAX
Buggy code:
 static BOOL update_read_icon_info ( wStream * s, ICON_INFO * iconInfo ) { BYTE * newBitMask ; if ( Stream_GetRemainingLength ( s ) < 8 ) return FALSE ; Stream_Read_UINT16 ( s, iconInfo -> cacheEntry ) ; Stream_Read_UINT8 ( s, iconInfo -> cacheId ) ; Stream_Read_UINT8 ( s, iconInfo -> bpp ) ; if ( ( iconInfo -> bpp < 1 ) || ( iconInfo -> bpp > 32 ) ) { WLog_ERR ( TAG, "invalid   bpp   value   %" PRIu32 "", iconInfo -> bpp ) ; return FALSE ; } Stream_Read_UINT16 ( s, iconInfo -> width ) ; Stream_Read_UINT16 ( s, iconInfo -> height ) ; switch ( iconInfo -> bpp ) { case 1 : case 4 : case 8 : if ( Stream_GetRemainingLength ( s ) < 2 ) return FALSE ; Stream_Read_UINT16 ( s, iconInfo -> cbColorTable ) ; break ; default : iconInfo -> cbColorTable = 0 ; break ; } if ( Stream_GetRemainingLength ( s ) < 4 ) return FALSE ; Stream_Read_UINT16 ( s, iconInfo -> cbBitsMask ) ; Stream_Read_UINT16 ( s, iconInfo -> cbBitsColor ) ; <START_BUG> if ( Stream_GetRemainingLength ( s ) < iconInfo -> cbBitsMask + iconInfo -> cbBitsColor ) <END_BUG> return FALSE ; newBitMask = ( BYTE * ) realloc ( iconInfo -> bitsMask, iconInfo -> cbBitsMask ) ; if (! newBitMask ) { free ( iconInfo -> bitsMask ) ; iconInfo -> bitsMask = NULL ; return FALSE ; } iconInfo -> bitsMask = newBitMask ; Stream_Read ( s, iconInfo -> bitsMask, iconInfo -> cbBitsMask ) ; if ( iconInfo -> colorTable == NULL ) { if ( iconInfo -> cbColorTable ) { iconInfo -> colorTable = ( BYTE * ) malloc ( iconInfo -> cbColorTable ) ; if (! iconInfo -> colorTable ) return FALSE ; } } else if ( iconInfo -> cbColorTable ) { BYTE * new_tab ; new_tab = ( BYTE * ) realloc ( iconInfo -> colorTable

Fix:
<S2SV_ModStart> cbBitsColor ) ; newBitMask = ( BYTE * ) realloc ( iconInfo -> bitsMask, iconInfo -> cbBitsMask ) ; if (! newBitMask ) { free ( iconInfo -> bitsMask ) ; iconInfo -> bitsMask = NULL ; return FALSE ; } iconInfo -> bitsMask = newBitMask ; <S2SV_ModStart> iconInfo -> cbBitsMask ) return FALSE <S2SV_ModEnd> ; Stream_Read ( <S2SV_ModStart> -> colorTable ) { if ( Stream_GetRemainingLength ( s ) < iconInfo -> cbColorTable ) return FALSE ; <S2SV_ModStart> cbColorTable ) ; } <S2SV_ModStart> = newBitMask ; if ( Stream_GetRemainingLength ( s ) < iconInfo -> cbBitsColor ) return FALSE ;
Buggy code:
 static int tls_construct_cke_ecdhe ( SSL * s, unsigned char * * p, int * len, int * al ) { # ifndef OPENSSL_NO_EC unsigned char * encodedPoint = NULL ; int encoded_pt_len = 0 ; EVP_PKEY * ckey = NULL, * skey = NULL ; skey = s -> s3 -> peer_tmp ; if ( skey == NULL ) { SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR ) ; return 0 ; } ckey = ssl_generate_pkey ( skey ) ; <START_BUG> if ( ssl_derive ( s, ckey, skey ) == 0 ) { <END_BUG> SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EVP_LIB ) ; goto err ; } encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint ( ckey, & encodedPoint ) ; if ( encoded_pt_len == 0 ) { SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EC_LIB ) ; goto err ; } EVP_PKEY_free ( ckey ) ; ckey = NULL ; * len = encoded_pt_len ; * * p = * len ; * p += 1 ; memcpy ( * p, encodedPoint, * len ) ; * len += 1 ; OPENSSL_free ( encodedPoint ) ; return 1 ; err : EVP_PKEY_free ( ckey ) ; return 0 ; # else SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR ) ; * al = SSL_AD_INTERNAL_ERROR ; return 0 ; # endif }

Fix:
<S2SV_ModStart> ; if ( ckey == NULL ) { SSLerr ( SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR ) ; goto err ; } if (
Buggy code:
 static void __net_random_once_deferred ( struct work_struct * w ) { struct __net_random_once_work * work = container_of ( w, struct __net_random_once_work, work ) ; <START_BUG> if (! static_key_enabled ( work -> key ) ) <END_BUG> static_key_slow_inc ( work -> key ) ; kfree ( work ) ; }

Fix:
<S2SV_ModStart> work ) ; BUG_ON <S2SV_ModEnd> (! static_key_enabled <S2SV_ModStart> key ) ) ; static_key_slow_dec <S2SV_ModEnd> ( work ->
Buggy code:
 static struct se_portal_group * vhost_scsi_make_tpg ( struct se_wwn * wwn, struct config_group * group, const char * name ) { struct vhost_scsi_tport * tport = container_of ( wwn, struct vhost_scsi_tport, tport_wwn ) ; struct vhost_scsi_tpg * tpg ; <START_BUG> unsigned long tpgt ; <END_BUG> int ret ; if ( strstr ( name, "tpgt_" )!= name ) return ERR_PTR ( - EINVAL ) ;  if ( kstrtoul ( name + 5, 10, & tpgt ) || tpgt > UINT_MAX ) <START_BUG> return ERR_PTR ( - EINVAL ) ; tpg = kzalloc ( sizeof ( struct vhost_scsi_tpg ), GFP_KERNEL ) ; if (! tpg ) { pr_err ( "Unable   to   allocate   struct   vhost_scsi_tpg" ) ; return ERR_PTR ( - ENOMEM ) ; } mutex_init ( & tpg -> tv_tpg_mutex ) ; INIT_LIST_HEAD ( & tpg -> tv_tpg_list ) ; tpg -> tport = tport ; tpg -> tport_tpgt = tpgt ; ret = core_tpg_register ( & vhost_scsi_fabric_configfs -> tf_ops, wwn, & tpg -> se_tpg, tpg, TRANSPORT_TPG_TYPE_NORMAL ) ; if ( ret < 0 ) { kfree ( tpg ) ; return NULL ; } mutex_lock ( & vhost_scsi_mutex ) ; list_add_tail ( & tpg -> tv_tpg_list, & vhost_scsi_list ) ; mutex_unlock ( & vhost_scsi_mutex ) ; return & tpg -> se_tpg ; }<END_BUG>

Fix:
<S2SV_ModStart> * tpg ; u16 <S2SV_ModEnd> tpgt ; int <S2SV_ModStart> ; if ( kstrtou16 <S2SV_ModEnd> ( name + <S2SV_ModStart> ) || tpgt >= VHOST_SCSI_MAX_TARGET <S2SV_ModEnd> ) return ERR_PTR
Buggy code:
 char * Ta3Tokenizer_FindEncodingFilename ( int fd, PyObject * filename ) { struct tok_state * tok ; FILE * fp ; char * p_start = NULL, * p_end = NULL, * encoding = NULL ; # ifndef PGEN <START_BUG> # if PY_MINOR_VERSION >= 4 <END_BUG> fd = _Py_dup ( fd ) ;  # endif <START_BUG> # else fd = dup ( fd ) ; # endif if ( fd < 0 ) { return NULL ; } fp = fdopen ( fd, "r" ) ; if ( fp == NULL ) { return NULL ; } tok = Ta3Tokenizer_FromFile ( fp, NULL, NULL, NULL ) ; if ( tok == NULL ) { fclose ( fp ) ; return NULL ; } # ifndef PGEN if ( filename!= NULL ) { Py_INCREF ( filename ) ; tok -> filename = filename ; } else { tok -> filename = PyUnicode_FromString ( "<string>" ) ; if ( tok -> filename == NULL ) { fclose ( fp ) ; Ta3Tokenizer_Free ( tok ) ; return encoding ; } } # endif while ( tok -> lineno < 2 && tok -> done == E_OK ) { Ta3Tokenizer_Get ( tok, & p_start, & p_end ) ; } fclose ( fp ) ; if ( tok -> encoding ) { encoding = ( char * ) PyMem_MALLOC ( strlen ( tok -> encoding ) + 1 ) ; if ( encoding ) strcpy ( encoding, tok -> encoding ) ; } Ta3Tokenizer_Free ( tok ) ; return encoding ; }<END_BUG>

Fix:
<S2SV_ModStart> # ifndef PGEN <S2SV_ModEnd> fd = _Py_dup <S2SV_ModStart> fd ) ; <S2SV_ModEnd> # else fd
Buggy code:
 void * pvPortMalloc ( size_t xWantedSize ) { BlockLink_t * pxBlock, * pxPreviousBlock, * pxNewBlockLink ; static BaseType_t xHeapHasBeenInitialised = pdFALSE ; void * pvReturn = NULL ; vTaskSuspendAll ( ) ; { if ( xHeapHasBeenInitialised == pdFALSE ) { prvHeapInit ( ) ; xHeapHasBeenInitialised = pdTRUE ; } <START_BUG> if ( xWantedSize > 0 ) <END_BUG> { xWantedSize += heapSTRUCT_SIZE ;  if ( ( xWantedSize & portBYTE_ALIGNMENT_MASK )!= 0 ) <START_BUG> { xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ; <END_BUG> }  } <START_BUG> if ( ( xWantedSize > 0 ) && ( xWantedSize < configADJUSTED_HEAP_SIZE ) ) <END_BUG> { pxPreviousBlock = & xStart ; pxBlock = xStart. pxNextFreeBlock ; while ( ( pxBlock -> xBlockSize < xWantedSize ) && ( pxBlock -> pxNextFreeBlock!= NULL ) ) { pxPreviousBlock = pxBlock ; pxBlock = pxBlock -> pxNextFreeBlock ; } if ( pxBlock!= & xEnd ) { pvReturn = ( void * ) ( ( ( uint8_t * ) pxPreviousBlock -> pxNextFreeBlock ) + heapSTRUCT_SIZE ) ; pxPreviousBlock -> pxNextFreeBlock = pxBlock -> pxNextFreeBlock ; if ( ( pxBlock -> xBlockSize - xWantedSize ) > heapMINIMUM_BLOCK_SIZE ) { pxNewBlockLink = ( void * ) ( ( ( uint8_t * ) pxBlock ) + xWantedSize ) ; pxNewBlockLink -> xBlockSize = pxBlock -> xBlockSize - xWantedSize ; pxBlock -> xBlockSize = xWantedSize ; prvInsertBlockIntoFreeList ( ( pxNewBlockLink ) ) ; } xFreeBytesRemaining -= pxBlock -> xBlockSize ; } } traceMALLOC ( pvReturn, xWantedSize ) ; } ( void ) xTaskResumeAll ( ) ; # if ( configUSE_MALLOC_FAILED_HOOK == 1 ) { if ( pvReturn == NULL )

Fix:
<S2SV_ModStart> } if ( ( <S2SV_ModStart> > 0 ) && ( ( xWantedSize + heapSTRUCT_SIZE ) > xWantedSize ) ) <S2SV_ModStart> ( ( xWantedSize + ( portBYTE_ALIGNMENT - ( xWantedSize <S2SV_ModStart> & portBYTE_ALIGNMENT_MASK ) ) ) > xWantedSize <S2SV_ModEnd> ) { xWantedSize <S2SV_ModStart> ) ) ; configASSERT ( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) == 0 ) ; } else { xWantedSize = 0 ; } } else { xWantedSize = 0 ; <S2SV_ModEnd> } if ( <S2SV_ModStart> && ( xWantedSize <= xFreeBytesRemaining <S2SV_ModEnd> ) ) {
Buggy code:
 void vp8_decoder_remove_threads ( VP8D_COMP * pbi ) { if ( pbi -> b_multithreaded_rd ) { int i ; pbi -> b_multithreaded_rd = 0 ; <START_BUG> for ( i = 0 ; i < pbi -> allocated_decoding_thread_count ; i ++ ) <END_BUG> { sem_post ( & pbi -> h_event_start_decoding [ i ] ) ; pthread_join ( pbi -> h_decoding_thread [ i ], NULL ) ; }  for ( i = 0 ; i < pbi -> allocated_decoding_thread_count ; i ++ ) <START_BUG> { sem_destroy ( & pbi -> h_event_start_decoding [ i ] ) ; } sem_destroy ( & pbi -> h_event_end_decoding ) ; vpx_free ( pbi -> h_decoding_thread ) ; pbi -> h_decoding_thread = NULL ; vpx_free ( pbi -> h_event_start_decoding ) ; pbi -> h_event_start_decoding = NULL ; vpx_free ( pbi -> mb_row_di ) ; pbi -> mb_row_di = NULL ; vpx_free ( pbi -> de_thread_data ) ; pbi -> de_thread_data = NULL ; <END_BUG> }  }

Fix:
<S2SV_ModStart> -> allocated_decoding_thread_count ; ++ i <S2SV_ModEnd> ) { sem_post <S2SV_ModStart> -> allocated_decoding_thread_count ; ++ i <S2SV_ModEnd> ) { sem_destroy <S2SV_ModStart> = NULL ; vp8mt_de_alloc_temp_buffers ( pbi, pbi -> common. mb_rows ) ;
Buggy code:
 static enum try_read_result try_read_network ( conn * c ) { enum try_read_result gotdata = READ_NO_DATA_RECEIVED ; int res ; <START_BUG> assert ( c!= NULL ) ; <END_BUG> if ( c -> rcurr!= c -> rbuf ) { if ( c -> rbytes!= 0 ) memmove ( c -> rbuf, c -> rcurr, c -> rbytes ) ; c -> rcurr = c -> rbuf ; } while ( 1 ) {  if ( c -> rbytes >= c -> rsize ) { <START_BUG> char * new_rbuf = realloc ( c -> rbuf, c -> rsize * 2 ) ; if (! new_rbuf ) { if ( settings. verbose > 0 ) fprintf ( stderr, "Couldn\'t   realloc   input   buffer\\n" ) ; c -> rbytes = 0 ; out_string ( c, "SERVER_ERROR   out   of   memory   reading   request" ) ; c -> write_and_go = conn_closing ; return READ_MEMORY_ERROR ; } c -> rcurr = c -> rbuf = new_rbuf ; c -> rsize *= 2 ; } int avail = c -> rsize - c -> rbytes ; res = read ( c -> sfd, c -> rbuf + c -> rbytes, avail ) ; if ( res > 0 ) { pthread_mutex_lock ( & c -> thread -> stats. mutex ) ; c -> thread -> stats. bytes_read += res ; pthread_mutex_unlock ( & c -> thread -> stats. mutex ) ; gotdata = READ_DATA_RECEIVED ; c -> rbytes += res ; if ( res == avail ) { continue ; } else { break ; } } if ( res == 0 ) { return READ_ERROR ; } if ( res == - 1 ) { if ( errno == EAGAIN || errno == EWOULDBLOCK ) { break ; } return READ_ERROR ; } } return gotdata ; }<END_BUG>

Fix:
<S2SV_ModStart> int res ; int num_allocs = 0 ; <S2SV_ModStart> rsize ) { if ( num_allocs == 4 ) { return gotdata ; } ++ num_allocs ;
Buggy code:
 static int shm_create ( XShmSegmentInfo * shm, XImage * * ximg_ptr, int w, int h, char * name ) { XImage * xim ; static int reported_flip = 0 ; int db = 0 ; shm -> shmid = - 1 ; shm -> shmaddr = ( char * ) - 1 ; * ximg_ptr = NULL ; if ( nofb ) { return 1 ; } X_LOCK ; if (! using_shm || xform24to32 || raw_fb ) { xim = XCreateImage_wr ( dpy, default_visual, depth, ZPixmap, 0, NULL, w, h, raw_fb? 32 : BitmapPad ( dpy ), 0 ) ; X_UNLOCK ; if ( xim == NULL ) { rfbErr ( "XCreateImage(%s)   failed.\\n", name ) ; if ( quiet ) { fprintf ( stderr, "XCreateImage(%s)   failed.\\n", name ) ; } return 0 ; } if ( db ) fprintf ( stderr, "shm_create   simple   %d   %d\\t%p   %s\\n", w, h, ( void * ) xim, name ) ; xim -> data = ( char * ) malloc ( xim -> bytes_per_line * xim -> height ) ; if ( xim -> data == NULL ) { rfbErr ( "XCreateImage(%s)   data   malloc   failed.\\n", name ) ; if ( quiet ) { fprintf ( stderr, "XCreateImage(%s)   data   malloc" "   failed.\\n", name ) ; } return 0 ; } if ( flip_byte_order ) { char * order = flip_ximage_byte_order ( xim ) ; if (! reported_flip &&! quiet ) { rfbLog ( "Changing   XImage   byte   order" "   to   %s\\n", order ) ; reported_flip = 1 ; } } * ximg_ptr = xim ; return 1 ; } if (! dpy ) { X_UNLOCK ; return 0 ; } xim = XShmCreateImage_wr ( dpy, default_visual, depth,

Fix:
<S2SV_ModStart>, IPC_CREAT | 0600 <S2SV_ModEnd> ) ; if
Buggy code:
 static CURLcode smtp_connect ( struct connectdata * conn, bool * done ) { CURLcode result ; struct smtp_conn * smtpc = & conn -> proto. smtpc ; struct SessionHandle * data = conn -> data ; struct pingpong * pp = & smtpc -> pp ; <START_BUG> const char * path = conn -> data -> state. path ; <END_BUG> int len ; char localhost [ HOSTNAME_MAX + 1 ] ; * done = FALSE ; Curl_reset_reqproto ( conn ) ; result = smtp_init ( conn ) ; if ( CURLE_OK!= result ) return result ; conn -> bits. close = FALSE ; pp -> response_time = RESP_TIMEOUT ; pp -> statemach_act = smtp_statemach_act ; pp -> endofresp = smtp_endofresp ; pp -> conn = conn ; if ( conn -> bits. tunnel_proxy && conn -> bits. httpproxy ) { struct HTTP http_proxy ; struct FTP * smtp_save ; smtp_save = data -> state. proto. smtp ; memset ( & http_proxy, 0, sizeof ( http_proxy ) ) ; data -> state. proto. http = & http_proxy ; result = Curl_proxyCONNECT ( conn, FIRSTSOCKET, conn -> host. name, conn -> remote_port ) ; data -> state. proto. smtp = smtp_save ; if ( CURLE_OK!= result ) return result ; } if ( ( conn -> handler -> protocol & CURLPROTO_SMTPS ) && data -> state. used_interface!= Curl_if_multi ) { result = Curl_ssl_connect ( conn, FIRSTSOCKET ) ; if ( result ) return result ; } Curl_pp_init ( pp ) ; pp -> response_time = RESP_TIMEOUT ; pp -> statemach_act = smtp_statemach_act ; pp -> endofresp = smtp_endofresp ; pp -> conn = conn ; if (! * path ) { if (! Curl_gethostname ( localhost, sizeof localhost ) ) path = localhost ; else path = "localhost" ; }  smtpc -> domain = curl_easy_unescape ( conn -> data, path, 0, & len ) ; <START_BUG> if (! smtpc -> domain ) return CURLE_OUT_OF_MEMORY ; state ( conn, SMTP_SERVERGREET<END_BUG>

Fix:
<S2SV_ModStart> state. path <S2SV_ModEnd> ; char localhost <S2SV_ModStart> "localhost" ; } result = Curl_urldecode ( conn -> data, path, 0, & <S2SV_ModStart> smtpc -> domain, NULL, TRUE ) ; if ( result ) return result <S2SV_ModEnd> ; state (
Buggy code:
 pdf_t * pdf_new ( const char * name ) { const char * n ; pdf_t * pdf ; <START_BUG> pdf = calloc ( 1, sizeof ( pdf_t ) ) ; <END_BUG> if ( name ) { if ( ( n = strrchr ( name, '//' ) ) ) ++ n ; else n = name ;  pdf -> name = malloc ( strlen ( n ) + 1 ) ; <START_BUG> strcpy ( pdf -> name, n ) ; } else { <END_BUG> pdf -> name = malloc ( strlen ( "Unknown" ) + 1 ) ;  strcpy ( pdf -> name, "Unknown" ) ; } return pdf ; }

Fix:
<S2SV_ModStart> ; pdf = safe_calloc ( <S2SV_ModEnd> sizeof ( pdf_t <S2SV_ModStart> -> name = safe_calloc <S2SV_ModEnd> ( strlen ( <S2SV_ModStart> -> name = safe_calloc <S2SV_ModEnd> ( strlen (