nus-yam/ex-repair huggingface dataset:
Buggy code:
 static ngx_int_t <START_BUG> ngx_http_lua_copy_request_headers ( ngx_http_request_t * sr, ngx_http_request_t * r ) <END_BUG> {  ngx_table_elt_t * header ; <START_BUG> ngx_list_part_t * part ; <END_BUG> ngx_uint_t i ;  if ( ngx_list_init ( & sr -> headers_in. headers, sr -> pool, 20, sizeof ( ngx_table_elt_t ) )!= NGX_OK ) { return NGX_ERROR ; } <START_BUG> dd ( "before:   parent   req   headers   count:   %d", <END_BUG>  ( int ) r -> headers_in. headers. part. nelts ) ; <START_BUG> part = & r -> headers_in. headers. part ; header = part -> elts ; for ( i = 0 ; ; i ++ ) { if ( i >= part -> nelts ) { <END_BUG> if ( part -> next == NULL ) {  break ; } part = part -> next ; header = part -> elts ; i = 0 ; } dd ( "setting   request   header   %.*s:   %.*s", ( int ) header [ i ]. key. len, header [ i ]. key. data, ( int ) header [ i ]. value. len, header [ i ]. value. data ) ; if ( ngx_http_lua_set_input_header ( sr, header [ i ]. key, header [ i ]. value, 0 ) == NGX_ERROR ) { return NGX_ERROR ; } <START_BUG> } <END_BUG> dd ( "after:   parent   req   headers   count:   %d",  ( int ) r -> headers_in. headers. part. nelts ) ; <START_BUG> return NGX_OK ; }<END_BUG>

Fix:
<S2SV_ModStart>, ngx_http_request_t * pr, int pr_not_chunked <S2SV_ModEnd> ) { ngx_table_elt_t <S2SV_ModStart> { ngx_table_elt_t * clh, * <S2SV_ModStart> ; ngx_uint_t i ; u_char * p ; off_t len ; dd ( "before: <S2SV_blank> parent <S2SV_blank> req <S2SV_blank> headers <S2SV_blank> count: <S2SV_blank> %d", ( int ) pr -> headers_in. headers. part. nelts ) <S2SV_ModStart> NGX_ERROR ; } if ( sr -> request_body &&! pr_not_chunked ) { len = sr -> request_body -> buf? ngx_buf_size ( sr -> request_body -> buf ) : 0 ; clh = ngx_list_push ( & sr <S2SV_ModEnd> -> headers_in. <S2SV_ModStart> headers_in. headers ) ; if ( clh <S2SV_ModEnd> == NULL ) <S2SV_ModStart> == NULL ) <S2SV_ModEnd> { return NGX_ERROR <S2SV_ModStart> NGX_ERROR ; } clh -> hash = ngx_http_lua_content_length_hash ; clh -> key = ngx_http_lua_content_length_header_key ; clh -> lowcase_
Buggy code:
 static int jpc_ppm_putparms ( jpc_ms_t * ms, jpc_cstate_t * cstate, jas_stream_t * out ) { jpc_ppm_t * ppm = & ms -> parms. ppm ; cstate = 0 ; <START_BUG> if ( JAS_CAST ( uint, jas_stream_write ( out, ( char * ) ppm -> data, ppm -> len ) )!= ppm -> len ) { <END_BUG> return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> ( JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_stream_write (
Buggy code:
 void set_content_type ( HttpResponse res, const char * mime ) { <START_BUG> set_header ( res, "Content-Type", mime ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, "Content-Type", "%s",
Buggy code:
 static int em_sysexit ( struct x86_emulate_ctxt * ctxt ) { const struct x86_emulate_ops * ops = ctxt -> ops ; struct desc_struct cs, ss ; <START_BUG> u64 msr_data ; <END_BUG> int usermode ; u16 cs_sel = 0, ss_sel = 0 ; if ( ctxt -> mode == X86EMUL_MODE_REAL || ctxt -> mode == X86EMUL_MODE_VM86 ) return emulate_gp ( ctxt, 0 ) ; setup_syscalls_segments ( ctxt, & cs, & ss ) ; if ( ( ctxt -> rex_prefix & 0x8 )!= 0x0 ) usermode = X86EMUL_MODE_PROT64 ; else usermode = X86EMUL_MODE_PROT32 ;  cs. dpl = 3 ; <START_BUG> ss. dpl = 3 ; ops -> get_msr ( ctxt, MSR_IA32_SYSENTER_CS, & msr_data ) ; switch ( usermode ) { case X86EMUL_MODE_PROT32 : cs_sel = ( u16 ) ( msr_data + 16 ) ; if ( ( msr_data & 0xfffc ) == 0x0 ) return emulate_gp ( ctxt, 0 ) ; ss_sel = ( u16 ) ( msr_data + 24 ) ; break ; case X86EMUL_MODE_PROT64 : cs_sel = ( u16 ) ( msr_data + 32 ) ; if ( msr_data == 0x0 ) return emulate_gp ( ctxt, 0 ) ; ss_sel = cs_sel + 8 ; cs. d = 0 ; cs. l = 1 ; <END_BUG> break ;  } cs_sel |= SELECTOR_RPL_MASK ; ss_sel |= SELECTOR_RPL_MASK ; ops -> set_segment ( ctxt, cs_sel, & cs, 0, VCPU_SREG_CS ) ; ops -> set_segment ( ctxt, ss_sel, & ss, 0, VCPU_SREG_SS ) ; <START_BUG> ctxt -> _eip = reg_read ( ctxt, VCPU_REGS_RDX ) ; <END_BUG>  * reg_write ( ctxt, VCPU_REGS_RSP ) = reg_read ( ctxt, VCPU_

Fix:
<S2SV_ModStart> ; u64 msr_data, rcx, rdx <S2SV_ModStart> = X86EMUL_MODE_PROT32 ; rcx = reg_read ( ctxt, VCPU_REGS_RCX ) ; rdx = reg_read ( ctxt, VCPU_REGS_RDX ) ; <S2SV_ModStart> = 1 ; if ( is_noncanonical_address ( rcx ) || is_noncanonical_address ( rdx ) ) return emulate_gp ( ctxt, 0 ) ; <S2SV_ModStart> -> _eip = rdx <S2SV_ModEnd> ; * reg_write <S2SV_ModStart> VCPU_REGS_RSP ) = rcx <S2SV_ModEnd> ; return X86EMUL_CONTINUE
Buggy code:
 static ssize_t sg_write ( struct file * filp, const char __user * buf, size_t count, loff_t * ppos ) { int mxsize, cmd_size, k ; int input_size, blocking ; unsigned char opcode ; Sg_device * sdp ; Sg_fd * sfp ; Sg_request * srp ; struct sg_header old_hdr ; sg_io_hdr_t * hp ; unsigned char cmnd [ SG_MAX_CDB_SIZE ] ; <START_BUG> if ( (! ( sfp = ( Sg_fd * ) filp -> private_data ) ) || (! ( sdp = sfp -> parentdp ) ) ) <END_BUG> return - ENXIO ; SCSI_LOG_TIMEOUT ( 3, sg_printk ( KERN_INFO, sdp, "sg_write:   count=%d\\n", ( int ) count ) ) ; if ( atomic_read ( & sdp -> detaching ) ) return - ENODEV ; if (! ( ( filp -> f_flags & O_NONBLOCK ) || scsi_block_when_processing_errors ( sdp -> device ) ) ) return - ENXIO ; if (! access_ok ( VERIFY_READ, buf, count ) ) return - EFAULT ; if ( count < SZ_SG_HEADER ) return - EIO ; if ( __copy_from_user ( & old_hdr, buf, SZ_SG_HEADER ) ) return - EFAULT ; blocking =! ( filp -> f_flags & O_NONBLOCK ) ; if ( old_hdr. reply_len < 0 ) return sg_new_write ( sfp, filp, buf, count, blocking, 0, 0, NULL ) ; if ( count < ( SZ_SG_HEADER + 6 ) ) return - EIO ; if (! ( srp = sg_add_request ( sfp ) ) ) { SCSI_LOG_TIMEOUT ( 1, sg_printk ( KERN_INFO, sdp, "sg_write:   queue   full\\n" ) ) ; return - EDOM ; } buf += SZ_SG_HEADER ; __get_user ( opcode, buf ) ; if ( sfp -> next_cmd_len > 0 ) { cmd_size = sfp ->

Fix:
<S2SV_ModStart> ; if ( unlikely ( segment_eq ( get_fs ( ), KERNEL_DS ) ) ) return - EINVAL ; if (
Buggy code:
 static void unix_release_sock ( struct sock * sk, int embrion ) { struct unix_sock * u = unix_sk ( sk ) ; struct path path ; struct sock * skpair ; struct sk_buff * skb ; int state ; unix_remove_socket ( sk ) ; unix_state_lock ( sk ) ; sock_orphan ( sk ) ; sk -> sk_shutdown = SHUTDOWN_MASK ; path = u -> path ; u -> path. dentry = NULL ; u -> path. mnt = NULL ; state = sk -> sk_state ; sk -> sk_state = TCP_CLOSE ; unix_state_unlock ( sk ) ; wake_up_interruptible_all ( & u -> peer_wait ) ; skpair = unix_peer ( sk ) ; if ( skpair!= NULL ) { if ( sk -> sk_type == SOCK_STREAM || sk -> sk_type == SOCK_SEQPACKET ) { unix_state_lock ( skpair ) ; skpair -> sk_shutdown = SHUTDOWN_MASK ; if (! skb_queue_empty ( & sk -> sk_receive_queue ) || embrion ) skpair -> sk_err = ECONNRESET ; unix_state_unlock ( skpair ) ; skpair -> sk_state_change ( skpair ) ; sk_wake_async ( skpair, SOCK_WAKE_WAITD, POLL_HUP ) ; } <START_BUG> sock_put ( skpair ) ; <END_BUG> unix_peer ( sk ) = NULL ; } while ( ( skb = skb_dequeue ( & sk -> sk_receive_queue ) )!= NULL ) { if ( state == TCP_LISTEN ) unix_release_sock ( skb -> sk, 1 ) ; UNIXCB ( skb ). consumed = skb -> len ; kfree_skb ( skb ) ; } if ( path. dentry ) path_put ( & path ) ; sock_put ( sk ) ; if ( unix_tot_inflight ) unix_gc ( ) ; }

Fix:
<S2SV_ModStart> ) ; } unix_dgram_peer_wake_disconnect ( sk, skpair ) ;
Buggy code:
 static int send_client_reply_packet ( MCPVIO_EXT * mpvio, const uchar * data, int data_len ) { MYSQL * mysql = mpvio -> mysql ; NET * net = & mysql -> net ; char * buff, * end ; size_t buff_size ; size_t connect_attrs_len = ( mysql -> server_capabilities & CLIENT_CONNECT_ATTRS && mysql -> options. extension )? mysql -> options. extension -> connection_attributes_length : 0 ; DBUG_ASSERT ( connect_attrs_len < MAX_CONNECTION_ATTR_STORAGE_LENGTH ) ; buff_size = 33 + USERNAME_LENGTH + data_len + 9 + NAME_LEN + NAME_LEN + connect_attrs_len + 9 ; buff = my_alloca ( buff_size ) ; mysql -> client_flag |= mysql -> options. client_flag ; mysql -> client_flag |= CLIENT_CAPABILITIES ; if ( mysql -> client_flag & CLIENT_MULTI_STATEMENTS ) mysql -> client_flag |= CLIENT_MULTI_RESULTS ; # if defined ( HAVE_OPENSSL ) &&! defined ( EMBEDDED_LIBRARY ) if ( mysql -> options. ssl_key || mysql -> options. ssl_cert || mysql -> options. ssl_ca || mysql -> options. ssl_capath || mysql -> options. ssl_cipher || ( mysql -> options. extension && mysql -> options. extension -> ssl_crl ) || <START_BUG> ( mysql -> options. extension && mysql -> options. extension -> ssl_crlpath ) ) <END_BUG>  mysql -> options. use_ssl = 1 ; <START_BUG> if ( mysql -> options. use_ssl ) mysql -> client_flag |= CLIENT_SSL ; # endif if ( mpvio -> db ) mysql -> client_flag |= CLIENT_CONNECT_WITH_DB ; else mysql -> client_flag &= ~ CLIENT_CONNECT_WITH_DB ; mysql -> client_flag = mysql -> client_flag & ( ~ ( CLIENT_COMPRESS | CLIENT_SSL | CLIENT_PROTOCOL_41 ) | mysql -> server_capabilities ) ; # ifndef HAVE_COMPRESS mysql -> client_flag &= ~ CLIENT_COMPRESS ; # endif if ( mysql -> client_flag & CLIENT_PROTOCOL_41 ) { int4store ( buff, mysql -> client_flag ) ; int4store ( buff +<END_BUG>

Fix:
<S2SV_ModStart> -> ssl_crlpath ) || ( mysql -> options. extension && mysql -> options. extension -> ssl_enforce ) <S2SV_ModStart>. use_ssl = TRUE <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( mysql -> options. extension && mysql -> options. extension -> ssl_enforce ) { DBUG_ASSERT ( mysql -> options. use_ssl ) ; if (! ( mysql -> server_capabilities & CLIENT_SSL ) ) { set_mysql_extended_error ( mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate, ER ( CR_SSL_CONNECTION_ERROR ), "SSL <S2SV_blank> is <S2SV_blank> required <S2SV_blank> but <S2SV_blank> the <S2SV_blank> server <S2SV_blank> doesn\'t <S2SV_blank> " "support <S2SV_blank> it" ) ; goto error ; } } if ( ( mysql -> server_capabilities & CLIENT_SSL ) && mysql -> options. use_ssl <S2SV_ModEnd> ) { struct <S2SV_ModStart> long ssl_error ; if (! mysql -> options. ssl_cipher ) { SET_OPTION ( ssl_cipher, default_ssl_cipher ) ; }
Buggy code:
 static inline int add_post_vars ( zval * arr, post_var_data_t * vars, zend_bool eof TSRMLS_DC ) { uint64_t max_vars = PG ( max_input_vars ) ; vars -> ptr = vars -> str. c ; vars -> end = vars -> str. c + vars -> str. len ; while ( add_post_var ( arr, vars, eof TSRMLS_CC ) ) { if ( ++ vars -> cnt > max_vars ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Input   variables   exceeded   %" PRIu64 ".   " "To   increase   the   limit   change   max_input_vars   in   php.ini.", max_vars ) ; return FAILURE ; } } <START_BUG> if (! eof ) { <END_BUG> memmove ( vars -> str. c, vars -> ptr, vars -> str. len = vars -> end - vars -> ptr ) ; } return SUCCESS ; }

Fix:
<S2SV_ModStart> (! eof && vars -> str. c!= vars -> ptr
Buggy code:
 int nntp_open_connection ( struct NntpAccountData * adata ) { struct Connection * conn = adata -> conn ; char buf [ 256 ] ; int cap ; bool posting = false, auth = true ; if ( adata -> status == NNTP_OK ) return 0 ; if ( adata -> status == NNTP_BYE ) return - 1 ; adata -> status = NNTP_NONE ; if ( mutt_socket_open ( conn ) < 0 ) return - 1 ; if ( mutt_socket_readln ( buf, sizeof ( buf ), conn ) < 0 ) return nntp_connect_error ( adata ) ; if ( mutt_str_startswith ( buf, "200", CASE_MATCH ) ) posting = true ; else if (! mutt_str_startswith ( buf, "201", CASE_MATCH ) ) { mutt_socket_close ( conn ) ; mutt_str_remove_trailing_ws ( buf ) ; mutt_error ( "%s", buf ) ; return - 1 ; } cap = nntp_capabilities ( adata ) ; if ( cap < 0 ) return - 1 ; if ( cap > 0 ) { if ( ( mutt_socket_send ( conn, "MODE   READER\\r\\n" ) < 0 ) || ( mutt_socket_readln ( buf, sizeof ( buf ), conn ) < 0 ) ) { return nntp_connect_error ( adata ) ; } if ( mutt_str_startswith ( buf, "200", CASE_MATCH ) ) posting = true ; else if ( mutt_str_startswith ( buf, "201", CASE_MATCH ) ) posting = false ; else if ( adata -> hasCAPABILITIES ) { mutt_socket_close ( conn ) ; mutt_error ( _ ( "Could   not   switch   to   reader   mode" ) ) ; return - 1 ; } if ( adata -> hasCAPABILITIES ) { cap = nntp_capabilities ( adata ) ; if ( cap < 0 ) return - 1 ; } } mutt_message ( _ ( "Connected   to   %s.   %s" ), conn -> account. host, posting? _ ( "Posting   is   ok" ) : _ ( "Post

Fix:
<S2SV_ModStart> ) ; } mutt_socket_empty ( conn ) ;
Buggy code:
 void fslib_copy_libs ( const char * full_path ) { assert ( full_path ) ; if ( arg_debug || arg_debug_private_lib ) printf ( "         fslib_copy_libs   %s\\n", full_path ) ; if ( access ( full_path, R_OK ) ) { if ( arg_debug || arg_debug_private_lib ) printf ( "cannot   find   %s   for   private-lib,   skipping...\\n", full_path ) ; return ; } unlink ( RUN_LIB_FILE ) ; create_empty_file_as_root ( RUN_LIB_FILE, 0644 ) ; if ( chown ( RUN_LIB_FILE, getuid ( ), getgid ( ) ) ) errExit ( "chown" ) ; if ( arg_debug || arg_debug_private_lib ) printf ( "         running   fldd   %s\\n", full_path ) ; sbox_run ( SBOX_USER | SBOX_SECCOMP | SBOX_CAPS_NONE, 3, PATH_FLDD, full_path, RUN_LIB_FILE ) ; FILE * fp = fopen ( RUN_LIB_FILE, "r" ) ; if (! fp ) errExit ( "fopen" ) ; char buf [ MAXBUF ] ; while ( fgets ( buf, MAXBUF, fp ) ) { char * ptr = strchr ( buf, '\\n' ) ; if ( ptr ) * ptr = '\\0' ; fslib_duplicate ( buf ) ; } fclose ( fp ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> fp ) ; unlink ( RUN_LIB_FILE ) ;
Buggy code:
 static int rfcomm_sock_getsockopt ( struct socket * sock, int level, int optname, char __user * optval, int __user * optlen ) { struct sock * sk = sock -> sk ; struct bt_security sec ; int len, err = 0 ; BT_DBG ( "sk   %p", sk ) ; if ( level == SOL_RFCOMM ) return rfcomm_sock_getsockopt_old ( sock, optname, optval, optlen ) ; if ( level!= SOL_BLUETOOTH ) return - ENOPROTOOPT ; if ( get_user ( len, optlen ) ) return - EFAULT ; lock_sock ( sk ) ; switch ( optname ) { case BT_SECURITY : if ( sk -> sk_type!= SOCK_STREAM ) { err = - EINVAL ; break ; } sec. level = rfcomm_pi ( sk ) -> sec_level ; <START_BUG> len = min_t ( unsigned int, len, sizeof ( sec ) ) ; <END_BUG> if ( copy_to_user ( optval, ( char * ) & sec, len ) ) err = - EFAULT ; break ; case BT_DEFER_SETUP : if ( sk -> sk_state!= BT_BOUND && sk -> sk_state!= BT_LISTEN ) { err = - EINVAL ; break ; } if ( put_user ( test_bit ( BT_SK_DEFER_SETUP, & bt_sk ( sk ) -> flags ), ( u32 __user * ) optval ) ) err = - EFAULT ; break ; default : err = - ENOPROTOOPT ; break ; } release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> -> sec_level ; sec. key_size = 0 ;
Buggy code:
 static expr_ty <START_BUG> ast_for_call ( struct compiling * c, const node * n, expr_ty func ) <END_BUG> {  int i, nargs, nkeywords, ngens ; <START_BUG> int ndoublestars ; asdl_seq * args ; asdl_seq * keywords ; REQ ( n, arglist ) ; nargs = 0 ; nkeywords = 0 ; <END_BUG> ngens = 0 ;  for ( i = 0 ; i < NCH ( n ) ; i ++ ) { node * ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == argument ) { if ( NCH ( ch ) == 1 ) nargs ++ ; else if ( TYPE ( CHILD ( ch, 1 ) ) == comp_for ) <START_BUG> ngens ++ ; <END_BUG> else if ( TYPE ( CHILD ( ch, 0 ) ) == STAR ) nargs ++ ; else nkeywords ++ ; } }  if ( ngens > 1 || ( ngens && ( nargs || nkeywords ) ) ) { <START_BUG> ast_error ( c, n, "Generator   expression   must   be   parenthesized   " "if   not   sole   argument" ) ; return NULL ; } if ( nargs + nkeywords + ngens > 255 ) { ast_error ( c, n, "more   than   255   arguments" ) ; return NULL ; } args = _Ta3_asdl_seq_new ( nargs + ngens, c -> c_arena ) ; if (! args ) return NULL ; keywords = _Ta3_asdl_seq_new ( nkeywords, c -> c_arena ) ; if (! keywords ) return NULL ; nargs = 0 ; nkeywords = 0 ; ndoublestars = 0 ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { node * ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == argument ) { expr_ty e ; node * chch = CHILD ( ch, 0 ) ; if ( NCH ( ch ) == 1 ) { if ( nkeywords ) { if ( ndoublestars ) { ast_error ( c, chch, "positional   argument   follows   " "keyword   argument   unpacking" ) ; } else { ast_error ( c, chch, "positional   argument   follows   " "<END_BUG>

Fix:
<S2SV_ModStart>, expr_ty func, bool allowgen <S2SV_ModStart> nargs, nkeywords <S2SV_ModEnd> ; int ndoublestars <S2SV_ModStart> = 0 ; <S2SV_ModEnd> for ( i <S2SV_ModStart> == comp_for ) { nargs ++ ; if (! allowgen ) { ast_error ( c, ch, "invalid <S2SV_blank> syntax" ) ; return NULL ; } if ( NCH ( n ) > 1 ) { ast_error ( c, ch, "Generator <S2SV_blank> expression <S2SV_blank> must <S2SV_blank> be <S2SV_blank> parenthesized" ) ; return NULL ; } } <S2SV_ModEnd> else if ( <S2SV_ModStart> ; } } args = _Ta3_asdl_seq_new ( nargs <S2SV_ModEnd>, c ->
Buggy code:
 static irqreturn_t i8042_interrupt ( int irq, void * dev_id ) { struct i8042_port * port ; struct serio * serio ; unsigned long flags ; unsigned char str, data ; unsigned int dfl ; unsigned int port_no ; bool filtered ; int ret = 1 ; spin_lock_irqsave ( & i8042_lock, flags ) ; str = i8042_read_status ( ) ; if ( unlikely ( ~ str & I8042_STR_OBF ) ) { spin_unlock_irqrestore ( & i8042_lock, flags ) ; if ( irq ) dbg ( "Interrupt   %d,   without   any   data\\n", irq ) ; ret = 0 ; goto out ; } data = i8042_read_data ( ) ; if ( i8042_mux_present && ( str & I8042_STR_AUXDATA ) ) { static unsigned long last_transmit ; static unsigned char last_str ; dfl = 0 ; if ( str & I8042_STR_MUXERR ) { dbg ( "MUX   error,   status   is   %02x,   data   is   %02x\\n", str, data ) ; switch ( data ) { default : if ( time_before ( jiffies, last_transmit + HZ // 10 ) ) { str = last_str ; break ; } case 0xfc : case 0xfd : case 0xfe : dfl = SERIO_TIMEOUT ; data = 0xfe ; break ; case 0xff : dfl = SERIO_PARITY ; data = 0xfe ; break ; } } port_no = I8042_MUX_PORT_NO + ( ( str >> 6 ) & 3 ) ; last_str = str ; last_transmit = jiffies ; } else { dfl = ( ( str & I8042_STR_PARITY )? SERIO_PARITY : 0 ) | ( ( str & I8042_STR_TIMEOUT &&! i8042_notimeout )? SERIO_TIMEOUT : 0 ) ; port_no = ( str & I8042_STR_AUXDATA )? I8042_AU

Fix:
<S2SV_ModStart> ( likely ( serio <S2SV_ModEnd> &&! filtered
Buggy code:
 static int ip_setup_cork ( struct sock * sk, struct inet_cork * cork, struct ipcm_cookie * ipc, struct rtable * * rtp ) { struct inet_sock * inet = inet_sk ( sk ) ; <START_BUG> struct ip_options * opt ; <END_BUG> struct rtable * rt ; opt = ipc -> opt ; if ( opt ) { if ( cork -> opt == NULL ) { cork -> opt = kmalloc ( sizeof ( struct ip_options ) + 40, sk -> sk_allocation ) ; if ( unlikely ( cork -> opt == NULL ) ) return - ENOBUFS ; }  memcpy ( cork -> opt, opt, sizeof ( struct ip_options ) + opt -> optlen ) ; <START_BUG> cork -> flags |= IPCORK_OPT ; cork -> addr = ipc -> addr ; } rt = * rtp ; if ( unlikely (! rt ) ) return - EFAULT ; * rtp = NULL ; cork -> fragsize = inet -> pmtudisc == IP_PMTUDISC_PROBE? rt -> dst. dev -> mtu : dst_mtu ( rt -> dst. path ) ; cork -> dst = & rt -> dst ; cork -> length = 0 ; cork -> tx_flags = ipc -> tx_flags ; cork -> page = NULL ; cork -> off = 0 ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ; struct ip_options_rcu <S2SV_ModEnd> * opt ; <S2SV_ModStart> -> opt, & opt -> <S2SV_ModStart> + opt -> opt.
Buggy code:
 enum ImapAuthRes imap_auth_login ( struct ImapData * idata, const char * method ) { char q_user [ SHORT_STRING ], q_pass [ SHORT_STRING ] ; char buf [ STRING ] ; int rc ; if ( mutt_bit_isset ( idata -> capabilities, LOGINDISABLED ) ) { mutt_message ( _ ( "LOGIN   disabled   on   this   server." ) ) ; return IMAP_AUTH_UNAVAIL ; } if ( mutt_account_getuser ( & idata -> conn -> account ) < 0 ) return IMAP_AUTH_FAILURE ; if ( mutt_account_getpass ( & idata -> conn -> account ) < 0 ) return IMAP_AUTH_FAILURE ; mutt_message ( _ ( "Logging   in..." ) ) ; <START_BUG> imap_quote_string ( q_user, sizeof ( q_user ), idata -> conn -> account. user ) ; <END_BUG>  imap_quote_string ( q_pass, sizeof ( q_pass ), idata -> conn -> account. pass ) ; <START_BUG> if ( DebugLevel < IMAP_LOG_PASS ) mutt_debug ( 2, "Sending   LOGIN   command   for   %s...\\n", idata -> conn -> account. user ) ; snprintf ( buf, sizeof ( buf ), "LOGIN   %s   %s", q_user, q_pass ) ; rc = imap_exec ( idata, buf, IMAP_CMD_FAIL_OK | IMAP_CMD_PASS ) ; if (! rc ) { mutt_clear_error ( ) ; return IMAP_AUTH_SUCCESS ; } mutt_error ( _ ( "Login   failed." ) ) ; return IMAP_AUTH_FAILURE ; }<END_BUG>

Fix:
<S2SV_ModStart> account. user, false <S2SV_ModStart> account. pass, false
Buggy code:
 static MagickBooleanType ConcatenateImages ( int argc, char * * argv, ExceptionInfo * exception ) { FILE * input, * output ; <START_BUG> int <END_BUG> c ; register ssize_t i ; if ( ExpandFilenames ( & argc, & argv ) == MagickFalse ) ThrowFileException ( exception, ResourceLimitError, "MemoryAllocationFailed", GetExceptionMessage ( errno ) ) ; output = fopen_utf8 ( argv [ argc - 1 ], "wb" ) ; if ( output == ( FILE * ) NULL ) { ThrowFileException ( exception, FileOpenError, "UnableToOpenFile", argv [ argc - 1 ] ) ; return ( MagickFalse ) ; }  for ( i = 2 ; i < ( ssize_t ) ( argc - 1 ) ; i ++ ) { <START_BUG> # if 0 fprintf ( stderr, "DEBUG:   Concatenate   Image:   \\"%s\\"\\n", argv [ i ] ) ; # endif input = fopen_utf8 ( argv [ i ], "rb" ) ; if ( input == ( FILE * ) NULL ) { ThrowFileException ( exception, FileOpenError, "UnableToOpenFile", argv [ i ] ) ; continue ; } for ( c = fgetc ( input ) ; c!= EOF ; c = fgetc ( input ) ) <END_BUG> ( void ) fputc ( ( char ) c, output ) ;  <START_BUG> ( void ) fclose ( input ) ; <END_BUG> ( void ) remove_utf8 ( argv [ i ] ) ; } ( void ) fclose ( output ) ;  return ( MagickTrue ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * output ; MagickBooleanType status ; <S2SV_ModStart> ) ; } status = MagickTrue ; <S2SV_ModStart> i ++ ) { <S2SV_ModEnd> input = fopen_utf8 <S2SV_ModStart> input ) ) if ( fputc ( ( char ) c, output )!= c ) status = MagickFalse ; <S2SV_ModStart> ( void ) fclose ( input <S2SV_ModEnd> ) ; ( <S2SV_ModStart> ( void ) remove_utf8 ( argv [ i ] ) ; } ( void ) fclose ( <S2SV_ModEnd> output ) ; <S2SV_ModStart> ; return ( status <S2SV_ModEnd> ) ; }
Buggy code:
 int wait_for_key_construction ( struct key * key, bool intr ) { int ret ; ret = wait_on_bit ( & key -> flags, KEY_FLAG_USER_CONSTRUCT, intr? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE ) ; if ( ret ) return - ERESTARTSYS ; <START_BUG> if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) { <END_BUG> smp_rmb ( ) ; return key -> reject_error ; } return key_validate ( key ) ; }

Fix:
<S2SV_ModStart> - ERESTARTSYS ; ret = key_read_state ( key ) ; if ( ret < 0 ) return ret ; <S2SV_ModEnd> return key_validate (
Buggy code:
 static int set_core_reg ( struct kvm_vcpu * vcpu, const struct kvm_one_reg * reg ) { __u32 __user * uaddr = ( __u32 __user * ) ( unsigned long ) reg -> addr ; struct kvm_regs * regs = vcpu_gp_regs ( vcpu ) ; int nr_regs = sizeof ( * regs ) // sizeof ( __u32 ) ; __uint128_t tmp ; void * valp = & tmp ; u64 off ; int err = 0 ; off = core_reg_offset_from_id ( reg -> id ) ; if ( off >= nr_regs || ( off + ( KVM_REG_SIZE ( reg -> id ) // sizeof ( __u32 ) ) ) >= nr_regs ) return - ENOENT ; <START_BUG> if ( KVM_REG_SIZE ( reg -> id ) > sizeof ( tmp ) ) <END_BUG> return - EINVAL ; if ( copy_from_user ( valp, uaddr, KVM_REG_SIZE ( reg -> id ) ) ) { err = - EFAULT ; goto out ; } if ( off == KVM_REG_ARM_CORE_REG ( regs. pstate ) ) { u32 mode = ( * ( u32 * ) valp ) & PSR_AA32_MODE_MASK ; switch ( mode ) { case PSR_AA32_MODE_USR : case PSR_AA32_MODE_FIQ : case PSR_AA32_MODE_IRQ : case PSR_AA32_MODE_SVC : case PSR_AA32_MODE_ABT : case PSR_AA32_MODE_UND : case PSR_MODE_EL0t : case PSR_MODE_EL1t : case PSR_MODE_EL1h : break ; default : err = - EINVAL ; goto out ; } } memcpy ( ( u32 * ) regs + off, valp, KVM_REG_SIZE ( reg -> id ) ) ; out : return err ; }

Fix:
<S2SV_ModStart> ; if ( validate_core_offset ( reg ) ) return - EINVAL ; if (
Buggy code:
 static bool ndp_msg_check_valid ( struct ndp_msg * msg ) { size_t len = ndp_msg_payload_len ( msg ) ; enum ndp_msg_type msg_type = ndp_msg_type ( msg ) ; if ( len < ndp_msg_type_info ( msg_type ) -> raw_struct_size ) return false ; <START_BUG> return true ; <END_BUG> }

Fix:
<S2SV_ModStart> return false ; if ( ndp_msg_type_info ( msg_type ) -> addrto_validate ) return ndp_msg_type_info ( msg_type ) -> addrto_validate ( & msg -> addrto ) ; else
Buggy code:
 static Sdb * store_versioninfo_gnu_verdef ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { const char * section_name = "" ; const char * link_section_name = "" ; char * end = NULL ; Elf_ ( Shdr ) * link_shdr = NULL ; ut8 dfs [ sizeof ( Elf_ ( Verdef ) ) ] = { 0 } ; Sdb * sdb ; int cnt, i ; if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return false ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; if ( shdr -> sh_size < 1 || shdr -> sh_size > SIZE_MAX ) { return false ; } Elf_ ( Verdef ) * defs = calloc ( shdr -> sh_size, sizeof ( char ) ) ; if (! defs ) { return false ; } if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( link_shdr && bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! defs ) { bprintf ( "Warning:   Cannot   allocate   memory   (Check   Elf_(Verdef))\\n" ) ; return NULL ; } sdb = sdb_new0 ( ) ; end = ( char * ) defs + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link, 0 ) ; sdb_set ( sdb, "link

Fix:
<S2SV_ModStart> sh_info && ( end - <S2SV_ModStart> * ) defs > i <S2SV_ModEnd> ) ; ++ <S2SV_ModStart> vdaux < 1 || ( char * ) UINTPTR_MAX - vstart < vdaux <S2SV_ModStart> > end || end - vstart < <S2SV_ModEnd> sizeof ( Elf_ <S2SV_ModStart> Verdaux ) ) <S2SV_ModEnd> ) { sdb_free <S2SV_ModStart> > end || end - vstart < <S2SV_ModEnd> sizeof ( Elf_ <S2SV_ModStart> Verdaux ) ) <S2SV_ModEnd> ) { sdb_free
Buggy code:
 <START_BUG> int64_t vp9_rd_pick_inter_mode_sb ( VP9_COMP * cpi, MACROBLOCK * x, <END_BUG>  const TileInfo * const tile, <START_BUG> int mi_row, int mi_col, <END_BUG> int * returnrate,  int64_t * returndistortion, BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx, int64_t best_rd_so_far ) { VP9_COMMON * const cm = & cpi -> common ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; <END_BUG>  MB_MODE_INFO * const mbmi = & xd -> mi [ 0 ] -> mbmi ; <START_BUG> const struct segmentation * const seg = & cm -> seg ; <END_BUG> MB_PREDICTION_MODE this_mode ;  MV_REFERENCE_FRAME ref_frame, second_ref_frame ; unsigned char segment_id = mbmi -> segment_id ; <START_BUG> int comp_pred, i ; <END_BUG> int_mv frame_mv [ MB_MODE_COUNT ] [ MAX_REF_FRAMES ] ; struct buf_2d yv12_mb [ 4 ] [ MAX_MB_PLANE ] ;  int_mv single_newmv [ MAX_REF_FRAMES ] = { { 0 } } ; <START_BUG> static const int flag_list [ 4 ] = { 0, VP9_LAST_FLAG, VP9_GOLD_FLAG, VP9_ALT_FLAG } ; int64_t best_rd = best_rd_so_far ; <END_BUG> int64_t best_tx_rd [ TX_MODES ] ;  int64_t best_tx_diff [ TX_MODES ] ; int64_t best_pred_diff [ REFERENCE_MODES ] ; int64_t best_pred_rd [ REFERENCE_MODES ] ; int64_t best_filter_rd [ SWITCHABLE_FILTER_CONTEXTS ] ; int64_t best_filter_diff [ SWITCHABLE_FILTER_CONTEXTS ] ; <START_BUG> MB_MODE_INFO best_mbmode = { 0 } ; <END_BUG>  int mode_index, best_mode_index = 0 ; <START_BUG> unsigned int ref_costs_single [ MAX_REF_FRAMES ], ref_costs_comp [ MAX_REF_<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> void <S2SV_ModEnd> vp9_rd_pick_inter_mode_sb ( VP9_COMP <S2SV_ModStart> * cpi, TileDataEnc * tile_data, <S2SV_ModStart> * x, <S2SV_ModEnd> int mi_row, <S2SV_ModStart> int mi_col, RD_COST * rd_cost, <S2SV_ModEnd> BLOCK_SIZE bsize, <S2SV_ModStart> -> common ; TileInfo * const tile_info = & tile_data -> tile_info ; RD_OPT * const rd_opt = & cpi -> rd ; SPEED_FEATURES * const sf = & cpi -> sf ; <S2SV_ModStart> ] -> mbmi ; MB_MODE_INFO_EXT * const mbmi_ext = x -> mbmi_ext <S2SV_ModStart> -> seg ; PREDICTION_MODE <S2SV_ModEnd> this_mode ; MV_REFERENCE_FRAME <S2SV_ModStart> comp_pred, i, k <S2SV_ModStart> 0 } } ; INTERP_FILTER single_inter_filter [ MB_MODE_COUNT ] [ MAX_REF_FRAMES ] ; int single_skippable [ MB_MODE_COUNT ] [ MAX_REF_FRAMES ] <S2SV_ModStart> best_rd_so_far ; int64
Buggy code:
 NTSTATUS ProcessMainDeviceControlIrp ( PDEVICE_OBJECT DeviceObject, PEXTENSION Extension, PIRP Irp ) { PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation ( Irp ) ; NTSTATUS ntStatus ; switch ( irpSp -> Parameters. DeviceIoControl. IoControlCode ) { case TC_IOCTL_GET_DRIVER_VERSION : case TC_IOCTL_LEGACY_GET_DRIVER_VERSION : if ( ValidateIOBufferSize ( Irp, sizeof ( LONG ), ValidateOutput ) ) { LONG tmp = VERSION_NUM ; memcpy ( Irp -> AssociatedIrp. SystemBuffer, & tmp, 4 ) ; Irp -> IoStatus. Information = sizeof ( LONG ) ; Irp -> IoStatus. Status = STATUS_SUCCESS ; } break ; case TC_IOCTL_GET_DEVICE_REFCOUNT : if ( ValidateIOBufferSize ( Irp, sizeof ( int ), ValidateOutput ) ) { * ( int * ) Irp -> AssociatedIrp. SystemBuffer = DeviceObject -> ReferenceCount ; Irp -> IoStatus. Information = sizeof ( int ) ; Irp -> IoStatus. Status = STATUS_SUCCESS ; } break ; case TC_IOCTL_IS_DRIVER_UNLOAD_DISABLED : if ( ValidateIOBufferSize ( Irp, sizeof ( int ), ValidateOutput ) ) { LONG deviceObjectCount = 0 ; * ( int * ) Irp -> AssociatedIrp. SystemBuffer = DriverUnloadDisabled ; if ( IoEnumerateDeviceObjectList ( TCDriverObject, NULL, 0, & deviceObjectCount ) == STATUS_BUFFER_TOO_SMALL && deviceObjectCount > 1 ) * ( int * ) Irp -> AssociatedIrp. SystemBuffer = TRUE ; Irp -> IoStatus. Information = sizeof ( int ) ; Irp -> IoStatus. Status = STATUS_SUCCESS ; } break ; case TC_IOCTL_IS_ANY_VOLUME_MOUNTED : if ( ValidateIOBufferSize ( Irp, sizeof ( int ), ValidateOutput ) ) { int drive ; * ( int * ) Irp -> AssociatedIrp. SystemBuffer = 0 ; for ( drive = MIN_MOUNTED_VOLUME_DRIVE_NUMBER ; drive <= MAX_MOUNTED_VOLUME_DRIVE_NUMBER ; ++ drive ) { if ( Get

Fix:
<S2SV_ModStart> LARGE_INTEGER offset ; size_t devicePathLen = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) break ; if (! NT_SUCCESS ( RtlUnalignedStringCchLengthW ( request -> DevicePath, TC_MAX_PATH, & devicePathLen ) ) || ( devicePathLen < 28 ) || ( devicePathLen > 30 ) || ( memcmp ( request -> DevicePath, L"\\\\Device\\\\Harddisk", 16 * sizeof ( WCHAR ) ) ) || ( memcmp ( & request -> DevicePath [ devicePathLen - 11 ], L"\\\\Partition0", 11 * sizeof ( WCHAR ) ) ) ) { Irp -> IoStatus. Status = STATUS_INVALID_PARAMETER ; Irp -> IoStatus. Information = 0 ; break ; } <S2SV_ModStart> ) ) { byte * readBuffer = TCalloc ( TC_MAX_VOLUME_SECTOR_SIZE ) ; if (! readBuffer ) { Irp -> IoStatus. Status = STATUS_INSUFFICIENT_RESOURCES ; Irp -> IoStatus. Information = 0 ; } else { <S2SV_ModStart>, readBuffer, TC_MAX_VOLUME_SECTOR_SIZE <S2SV_ModEnd>, & offset <S2SV_ModStart> ( ntStatus )
Buggy code:
 static int lldp_private_8023_print ( netdissect_options * ndo, const u_char * tptr, u_int tlv_len ) { int subtype, hexdump = FALSE ; if ( tlv_len < 4 ) { return hexdump ; } subtype = * ( tptr + 3 ) ; ND_PRINT ( ( ndo, "\\n\\t     %s   Subtype   (%u)", tok2str ( lldp_8023_subtype_values, "unknown", subtype ), subtype ) ) ; switch ( subtype ) { case LLDP_PRIVATE_8023_SUBTYPE_MACPHY : if ( tlv_len < 9 ) { return hexdump ; } ND_PRINT ( ( ndo, "\\n\\t         autonegotiation   [%s]   (0x%02x)", bittok2str ( lldp_8023_autonegotiation_values, "none", * ( tptr + 4 ) ), * ( tptr + 4 ) ) ) ; ND_PRINT ( ( ndo, "\\n\\t         PMD   autoneg   capability   [%s]   (0x%04x)", bittok2str ( lldp_pmd_capability_values, "unknown", EXTRACT_16BITS ( tptr + 5 ) ), EXTRACT_16BITS ( tptr + 5 ) ) ) ; ND_PRINT ( ( ndo, "\\n\\t         MAU   type   %s   (0x%04x)", tok2str ( lldp_mau_types_values, "unknown", EXTRACT_16BITS ( tptr + 7 ) ), EXTRACT_16BITS ( tptr + 7 ) ) ) ; break ; case LLDP_PRIVATE_8023_SUBTYPE_MDIPOWER : if ( tlv_len < 7 ) { return hexdump ; } ND_PRINT ( ( ndo, "\\n\\t         MDI   power   support   [%s],   power   pair   %s,   power   class   %s", bittok2str ( lldp_mdi_values, "none", * ( tptr + 4 ) ), tok2str ( lldp_md

Fix:
<S2SV_ModStart> case LLDP_PRIVATE_8023_SUBTYPE_MTU : if ( tlv_len < 6 ) { return hexdump ; }
Buggy code:
 static int test_candidate_kf ( VP8_COMP * cpi, FIRSTPASS_STATS * last_frame, FIRSTPASS_STATS * this_frame, FIRSTPASS_STATS * next_frame ) { int is_viable_kf = 0 ; if ( ( this_frame -> pcnt_second_ref < 0.10 ) && ( next_frame -> pcnt_second_ref < 0.10 ) && ( ( this_frame -> pcnt_inter < 0.05 ) || ( ( ( this_frame -> pcnt_inter - this_frame -> pcnt_neutral ) <.25 ) && ( ( this_frame -> intra_error // DOUBLE_DIVIDE_CHECK ( this_frame -> coded_error ) ) < 2.5 ) && ( ( fabs ( last_frame -> coded_error - this_frame -> coded_error ) // DOUBLE_DIVIDE_CHECK ( this_frame -> coded_error ) >.40 ) || ( fabs ( last_frame -> intra_error - this_frame -> intra_error ) // DOUBLE_DIVIDE_CHECK ( this_frame -> intra_error ) >.40 ) || ( ( next_frame -> intra_error // DOUBLE_DIVIDE_CHECK ( next_frame -> coded_error ) ) > 3.5 ) ) ) ) ) { int i ; FIRSTPASS_STATS * start_pos ; FIRSTPASS_STATS local_next_frame ; double boost_score = 0.0 ; double old_boost_score = 0.0 ; double decay_accumulator = 1.0 ; double next_iiratio ; <START_BUG> vpx_memcpy ( & local_next_frame, next_frame, sizeof ( * next_frame ) ) ; <END_BUG> start_pos = cpi -> twopass. stats_in ; for ( i = 0 ; i < 16 ; i ++ ) { next_iiratio = ( IIKFACTOR1 * local_next_frame. intra_error // DOUBLE_DIVIDE_CHECK ( local_next_frame. coded_error ) ) ; if ( next_iiratio > RMAX ) next_iiratio = RMAX ; if ( local_next_frame. pcnt_inter > 0.85 ) decay_accumulator = decay_accumulator * local_next_frame. pcnt_

Fix:
<S2SV_ModStart> double next_iiratio ; memcpy <S2SV_ModEnd> ( & local_next_frame
Buggy code:
 static OM_uint32 init_ctx_reselect ( OM_uint32 * minor_status, spnego_gss_ctx_id_t sc, OM_uint32 acc_negState, gss_OID supportedMech, gss_buffer_t * responseToken, gss_buffer_t * mechListMIC, OM_uint32 * negState, send_token_flag * tokflag ) { OM_uint32 tmpmin ; <START_BUG> size_t i ; <END_BUG> generic_gss_release_oid ( & tmpmin, & sc -> internal_mech ) ; gss_delete_sec_context ( & tmpmin, & sc -> ctx_handle, GSS_C_NO_BUFFER ) ; for ( i = 0 ; i < sc -> mech_set -> count ; i ++ ) { if ( g_OID_equal ( supportedMech, & sc -> mech_set -> elements [ i ] ) ) break ; } if ( i == sc -> mech_set -> count ) return GSS_S_DEFECTIVE_TOKEN ; sc -> internal_mech = & sc -> mech_set -> elements [ i ] ; if ( acc_negState!= REQUEST_MIC ) return GSS_S_DEFECTIVE_TOKEN ; sc -> mech_complete = 0 ; sc -> mic_reqd = 1 ; * negState = REQUEST_MIC ; * tokflag = CONT_TOKEN_SEND ; return GSS_S_CONTINUE_NEEDED ; }

Fix:
<S2SV_ModStart> ; size_t i <S2SV_ModEnd> ; gss_delete_sec_context (
Buggy code:
 SPL_METHOD ( SplObjectStorage, unserialize ) { spl_SplObjectStorage * intern = Z_SPLOBJSTORAGE_P ( getThis ( ) ) ; char * buf ; size_t buf_len ; const unsigned char * p, * s ; php_unserialize_data_t var_hash ; zval entry, inf ; zval * pcount, * pmembers ; spl_SplObjectStorageElement * element ; zend_long count ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ), "s", & buf, & buf_len ) == FAILURE ) { return ; } if ( buf_len == 0 ) { return ; } s = p = ( const unsigned char * ) buf ; PHP_VAR_UNSERIALIZE_INIT ( var_hash ) ; if ( * p!= 'x' || * ++ p!= ':' ) { goto outexcept ; } ++ p ; pcount = var_tmp_var ( & var_hash ) ; if (! php_var_unserialize ( pcount, & p, s + buf_len, & var_hash ) || Z_TYPE_P ( pcount )!= IS_LONG ) { goto outexcept ; } -- p ; <START_BUG> count = Z_LVAL_P ( pcount ) ; <END_BUG> while ( count -- > 0 ) { spl_SplObjectStorageElement * pelement ; zend_string * hash ; if ( * p!= ';' ) { goto outexcept ; } ++ p ; if ( * p!= 'O' && * p!= 'C' && * p!= 'r' ) { goto outexcept ; } if (! php_var_unserialize ( & entry, & p, s + buf_len, & var_hash ) ) { goto outexcept ; }  if ( Z_TYPE ( entry )!= IS_OBJECT ) { <START_BUG> zval_ptr_dtor ( & entry ) ; goto outexcept ; } if ( * p == ',' ) { ++ p ; if (! php_var_unserialize ( & inf, & p, s + buf_len, & var_hash ) ) { zval_ptr_dtor ( & entry ) ; goto outexcept ; } <END_BUG> } else {  ZVAL_UNDEF ( & inf ) ; } hash = spl_object_storage_get_hash ( intern, getThis ( ), &

Fix:
<S2SV_ModStart> Z_LVAL_P ( pcount ) ; ZVAL_UNDEF ( & entry ) ; ZVAL_UNDEF ( & inf <S2SV_ModStart> } if ( <S2SV_ModEnd> * p == <S2SV_ModStart> ; } } if ( Z_TYPE ( entry )!= IS_OBJECT ) { zval_ptr_dtor ( & entry ) ; zval_ptr_dtor ( & inf ) ; goto outexcept <S2SV_ModEnd> ; } hash
Buggy code:
 int obj2ast_arguments ( PyObject * obj, arguments_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; asdl_seq * args ; arg_ty vararg ; asdl_seq * kwonlyargs ; asdl_seq * kw_defaults ; arg_ty kwarg ; asdl_seq * defaults ; <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_args ) ) { <END_BUG> int res ; Py_ssize_t len ;  Py_ssize_t i ; <START_BUG> tmp = _PyObject_GetAttrId ( obj, & PyId_args ) ; if ( tmp == NULL ) goto failed ; if (! PyList_Check ( tmp ) ) { PyErr_Format ( PyExc_TypeError, "arguments   field   \\"args\\"   must   be   a   list,   not   a   %.200s", tmp -> ob_type -> tp_name ) ; goto failed ; } len = PyList_GET_SIZE ( tmp ) ; args = _Ta3_asdl_seq_new ( len, arena ) ; if ( args == NULL ) goto failed ; for ( i = 0 ; i < len ; i ++ ) { <END_BUG> arg_ty value ;  <START_BUG> res = obj2ast_arg ( PyList_GET_ITEM ( tmp, i ), & value, arena ) ; <END_BUG> if ( res!= 0 ) goto failed ; if ( len!= PyList_GET_SIZE ( tmp ) ) { PyErr_SetString ( PyExc_RuntimeError, "arguments   field   \\"args\\"   changed   size   during   iteration" ) ; goto failed ; }  asdl_seq_SET ( args, i, value ) ; <START_BUG> } Py_CLEAR ( tmp ) ; <END_BUG> } else {  PyErr_SetString ( PyExc_TypeError, "required   field   \\"args\\"   missing   from   arguments" ) ; return 1 ; } <START_BUG> if ( exists_not_none ( obj, & PyId_vararg ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_vararg ) ; <START_BUG> if ( tmp == NULL ) goto failed ; res = obj2ast_arg ( tmp, & vararg, arena ) ; if ( res!= 0 ) goto failed ;<END_BUG>

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_args, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"args\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> arguments" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> ; Py_ssize_t i <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) { arg_ty val <S2SV_ModEnd> ; res = <S2SV_ModStart> ), & val <S2SV_ModEnd>, arena ) <S2SV_ModStart>, i, val <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } if ( lookup_attr_id ( obj, & PyId_vararg, & tmp ) < 0 ) { <S2SV_ModEnd> return 1 ; <S2SV_ModStart> } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; vararg = NULL ; } else { int res ; res = obj2ast_arg ( tmp, & vararg, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart> obj, & PyId_kwonlyargs, & tmp ) < 0 ) { return 1 ; } if
Buggy code:
 void luaV_execute ( lua_State * L, CallInfo * ci ) { LClosure * cl ; TValue * k ; StkId base ; const Instruction * pc ; int trap ; # if LUA_USE_JUMPTABLE # include "ljumptab.h" # endif tailcall : trap = L -> hookmask ; cl = clLvalue ( s2v ( ci -> func ) ) ; k = cl -> p -> k ; pc = ci -> u. l. savedpc ; if ( trap ) { if ( cl -> p -> is_vararg ) trap = 0 ; else if ( pc == cl -> p -> code ) luaD_hookcall ( L, ci ) ; ci -> u. l. trap = 1 ; } base = ci -> func + 1 ; for ( ; ; ) { Instruction i ; StkId ra ; vmfetch ( ) ; lua_assert ( base == ci -> func + 1 ) ; lua_assert ( base <= L -> top && L -> top < L -> stack + L -> stacksize ) ; lua_assert ( isIT ( i ) || ( cast_void ( L -> top = base ), 1 ) ) ; vmdispatch ( GET_OPCODE ( i ) ) { vmcase ( OP_MOVE ) { setobjs2s ( L, ra, RB ( i ) ) ; vmbreak ; } vmcase ( OP_LOADI ) { lua_Integer b = GETARG_sBx ( i ) ; setivalue ( s2v ( ra ), b ) ; vmbreak ; } vmcase ( OP_LOADF ) { int b = GETARG_sBx ( i ) ; setfltvalue ( s2v ( ra ), cast_num ( b ) ) ; vmbreak ; } vmcase ( OP_LOADK ) { TValue * rb = k + GETARG_Bx ( i ) ; setobj2s ( L, ra, rb ) ; vmbreak ; } vmcase ( OP_LOADKX ) { TValue * rb ; rb = k + GETARG_Ax ( * pc ) ; pc ++ ; setobj2s ( L, ra, rb ) ; vmbreak ; } vmcase ( OP_LOADFALSE ) { setbfvalue ( s2v ( ra ) ) ; vmbreak ; } vmcase ( OP

Fix:
<S2SV_ModStart> b ++ ; checkstackGCp <S2SV_ModEnd> ( L,
Buggy code:
 int snd_card_new ( struct device * parent, int idx, const char * xid, struct module * module, int extra_size, struct snd_card * * card_ret ) { struct snd_card * card ; int err ; if ( snd_BUG_ON (! card_ret ) ) return - EINVAL ; * card_ret = NULL ; if ( extra_size < 0 ) extra_size = 0 ; card = kzalloc ( sizeof ( * card ) + extra_size, GFP_KERNEL ) ; if (! card ) return - ENOMEM ; if ( extra_size > 0 ) card -> private_data = ( char * ) card + sizeof ( struct snd_card ) ; if ( xid ) strlcpy ( card -> id, xid, sizeof ( card -> id ) ) ; err = 0 ; mutex_lock ( & snd_card_mutex ) ; if ( idx < 0 ) idx = get_slot_from_bitmask ( idx, module_slot_match, module ) ; if ( idx < 0 ) idx = get_slot_from_bitmask ( idx, check_empty_slot, module ) ; if ( idx < 0 ) err = - ENODEV ; else if ( idx < snd_ecards_limit ) { if ( test_bit ( idx, snd_cards_lock ) ) err = - EBUSY ; } else if ( idx >= SNDRV_CARDS ) err = - ENODEV ; if ( err < 0 ) { mutex_unlock ( & snd_card_mutex ) ; dev_err ( parent, "cannot   find   the   slot   for   index   %d   (range   0-%i),   error:   %d\\n", idx, snd_ecards_limit - 1, err ) ; kfree ( card ) ; return err ; } set_bit ( idx, snd_cards_lock ) ; if ( idx >= snd_ecards_limit ) snd_ecards_limit = idx + 1 ; mutex_unlock ( & snd_card_mutex ) ; card -> dev = parent ; card -> number = idx ; card -> module = module ; INIT_LIST_HEAD ( & card -> devices ) ; init_rwsem ( & card -> controls_rwsem ) ; rwlock_init ( & card -> ctl_files_

Fix:
<S2SV_ModStart> ctl_files_rwlock ) ; mutex_init ( & card -> user_ctl_lock ) ;
Buggy code:
 int verify_iovec ( struct msghdr * m, struct iovec * iov, struct sockaddr_storage * address, int mode ) { int size, ct, err ; if ( m -> msg_namelen ) { if ( mode == VERIFY_READ ) { void __user * namep ; namep = ( void __user __force * ) m -> msg_name ; err = move_addr_to_kernel ( namep, m -> msg_namelen, address ) ; if ( err < 0 ) return err ; } <START_BUG> m -> msg_name = address ; <END_BUG> } else { m -> msg_name = NULL ; } size = m -> msg_iovlen * sizeof ( struct iovec ) ; if ( copy_from_user ( iov, ( void __user __force * ) m -> msg_iov, size ) ) return - EFAULT ; m -> msg_iov = iov ; err = 0 ; for ( ct = 0 ; ct < m -> msg_iovlen ; ct ++ ) { size_t len = iov [ ct ]. iov_len ; if ( len > INT_MAX - err ) { len = INT_MAX - err ; iov [ ct ]. iov_len = len ; } err += len ; } return err ; }

Fix:
<S2SV_ModStart> err ; } if ( m -> msg_name )
Buggy code:
 static int lha_read_file_header_1 ( struct archive_read * a, struct lha * lha ) { const unsigned char * p ; size_t extdsize ; int i, err, err2 ; int namelen, padding ; unsigned char headersum, sum_calculated ; err = ARCHIVE_OK ; if ( ( p = __archive_read_ahead ( a, H1_FIXED_SIZE, NULL ) ) == NULL ) return ( truncated_error ( a ) ) ; lha -> header_size = p [ H1_HEADER_SIZE_OFFSET ] + 2 ; headersum = p [ H1_HEADER_SUM_OFFSET ] ; lha -> compsize = archive_le32dec ( p + H1_COMP_SIZE_OFFSET ) ; lha -> origsize = archive_le32dec ( p + H1_ORIG_SIZE_OFFSET ) ; lha -> mtime = lha_dos_time ( p + H1_DOS_TIME_OFFSET ) ; namelen = p [ H1_NAME_LEN_OFFSET ] ; padding = ( ( int ) lha -> header_size ) - H1_FIXED_SIZE - namelen ; if ( namelen > 230 || padding < 0 ) goto invalid ; if ( ( p = __archive_read_ahead ( a, lha -> header_size, NULL ) ) == NULL ) return ( truncated_error ( a ) ) ; for ( i = 0 ; i < namelen ; i ++ ) { if ( p [ i + H1_FILE_NAME_OFFSET ] == 0xff ) goto invalid ; } archive_strncpy ( & lha -> filename, p + H1_FILE_NAME_OFFSET, namelen ) ; lha -> crc = archive_le16dec ( p + H1_FILE_NAME_OFFSET + namelen ) ; lha -> setflag |= CRC_IS_SET ; sum_calculated = lha_calcsum ( 0, p, 2, lha -> header_size - 2 ) ; __archive_read_consume ( a, lha -> header_size - 2 ) ; err2 = lha_read_file_extended_header ( a, lha, NULL, 2, ( size_t ) ( lha -> compsize + 2 ), & extdsize

Fix:
<S2SV_ModStart> ; if ( lha -> compsize < 0 ) goto invalid ; if (
Buggy code:
 int vp9_rc_clamp_iframe_target_size ( const VP9_COMP * const cpi, int target ) { const RATE_CONTROL * rc = & cpi -> rc ; <START_BUG> const VP9_CONFIG * oxcf = & cpi -> oxcf ; <END_BUG> if ( oxcf -> rc_max_intra_bitrate_pct ) {  const int max_rate = rc -> av_per_frame_bandwidth * <START_BUG> oxcf -> rc_max_intra_bitrate_pct // 100 ; target = MIN ( target, max_rate ) ; } if ( target > rc -> max_frame_bandwidth ) target = rc -> max_frame_bandwidth ; return target ; }<END_BUG>

Fix:
<S2SV_ModStart> rc ; const VP9EncoderConfig <S2SV_ModEnd> * oxcf = <S2SV_ModStart> = rc -> avg_frame_bandwidth <S2SV_ModEnd> * oxcf ->
Buggy code:
 int auth_password ( Authctxt * authctxt, const char * password ) { struct passwd * pw = authctxt -> pw ; int result, ok = authctxt -> valid ; # if defined ( USE_SHADOW ) && defined ( HAS_SHADOW_EXPIRE ) static int expire_checked = 0 ; <START_BUG> # endif <END_BUG> # ifndef HAVE_CYGWIN if ( pw -> pw_uid == 0 && options. permit_root_login!= PERMIT_YES ) ok = 0 ; # endif if ( * password == '\\0' && options. permit_empty_passwd == 0 ) return 0 ; # ifdef KRB5 if ( options. kerberos_authentication == 1 ) { int ret = auth_krb5_password ( authctxt, password ) ; if ( ret == 1 || ret == 0 ) return ret && ok ; } # endif # ifdef HAVE_CYGWIN { HANDLE hToken = cygwin_logon_user ( pw, password ) ; if ( hToken == INVALID_HANDLE_VALUE ) return 0 ; cygwin_set_impersonation_token ( hToken ) ; return ok ; } # endif # ifdef USE_PAM if ( options. use_pam ) return ( sshpam_auth_passwd ( authctxt, password ) && ok ) ; # endif # if defined ( USE_SHADOW ) && defined ( HAS_SHADOW_EXPIRE ) if (! expire_checked ) { expire_checked = 1 ; if ( auth_shadow_pwexpired ( authctxt ) ) authctxt -> force_pwchange = 1 ; } # endif result = sys_auth_passwd ( authctxt, password ) ; if ( authctxt -> force_pwchange ) disable_forwarding ( ) ; return ( result && ok ) ; }

Fix:
<S2SV_ModStart> ; # endif if ( strlen ( password ) > MAX_PASSWORD_LEN ) return 0 ;
Buggy code:
 <START_BUG> void ptrace_triggered ( struct perf_event * bp, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) { struct perf_event_attr attr ; attr = bp -> attr ; attr. disabled = true ; modify_user_hw_breakpoint ( bp, & attr ) ; }

Fix:
<S2SV_ModStart> perf_event * bp <S2SV_ModEnd>, struct perf_sample_data
Buggy code:
 static void flatpak_proxy_client_init ( FlatpakProxyClient * client ) { init_side ( client, & client -> client_side ) ; init_side ( client, & client -> bus_side ) ; <START_BUG> client -> auth_end_offset = AUTH_END_INIT_OFFSET ; <END_BUG> client -> rewrite_reply = g_hash_table_new_full ( g_direct_hash, g_direct_equal, NULL, g_object_unref ) ; client -> get_owner_reply = g_hash_table_new_full ( g_direct_hash, g_direct_equal, NULL, g_free ) ; client -> unique_id_policy = g_hash_table_new_full ( g_str_hash, g_str_equal, g_free, NULL ) ; }

Fix:
<S2SV_ModStart> ; client -> auth_buffer = g_byte_array_new ( ) <S2SV_ModEnd> ; client ->
Buggy code:
 <START_BUG> static int m88rs2000_frontend_attach ( struct dvb_usb_adapter * d ) <END_BUG> { u8 obuf [ ] = { 0x51 } ; u8 ibuf [ ] = { 0 } ;  if ( dvb_usb_generic_rw ( d -> dev, obuf, 1, ibuf, 1, 0 ) < 0 ) <START_BUG> err ( "command   0x51   transfer   failed." ) ; <END_BUG> d -> fe_adap [ 0 ]. fe = dvb_attach ( m88rs2000_attach, & s421_m88rs2000_config,  <START_BUG> & d -> dev -> i2c_adap ) ; <END_BUG>  if ( d -> fe_adap [ 0 ]. fe == NULL ) <START_BUG> return - EIO ; <END_BUG> if ( dvb_attach ( ts2020_attach, d -> fe_adap [ 0 ]. fe,  & dw2104_ts2020_config, <START_BUG> & d -> dev -> i2c_adap ) ) { <END_BUG> info ( "Attached   RS2000//TS2020!" ) ; return 0 ; } info ( "Failed   to   attach   RS2000//TS2020!" ) ; return - EIO ; }

Fix:
<S2SV_ModStart> struct dvb_usb_adapter * adap ) { struct dvb_usb_device * d = adap -> dev ; struct dw2102_state * state = d -> priv ; mutex_lock ( & d -> data_mutex ) ; state -> data [ 0 ] = 0x51 <S2SV_ModEnd> ; if ( <S2SV_ModStart> dvb_usb_generic_rw ( d, state -> data <S2SV_ModEnd>, 1, <S2SV_ModStart>, 1, state -> data <S2SV_ModEnd>, 1, <S2SV_ModStart> "command <S2SV_blank> 0x51 <S2SV_blank> transfer <S2SV_blank> failed." ) ; mutex_unlock ( & d -> data_mutex ) ; adap <S2SV_ModEnd> -> fe_adap [ <S2SV_ModStart> & d -> <S2SV_ModEnd> i2c_adap ) ; <S2SV_ModStart> ; if ( adap <S2SV_ModEnd> -> fe_adap [ <S2SV_ModStart> ( ts2020_attach, adap <S2SV_ModEnd> -> fe_adap [ <S2SV_ModStart>, & d <S2SV_ModEnd> -> i2c_adap )