nus-yam/ex-repair huggingface dataset:
Buggy code:
 static Image * ReadSIXELImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char * sixel_buffer ; Image * image ; MagickBooleanType status ; register char * p ; register ssize_t x ; register Quantum * q ; size_t length ; ssize_t i, j, y ; unsigned char * sixel_pixels, * sixel_palette ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } length = MagickPathExtent ; sixel_buffer = ( char * ) AcquireQuantumMemory ( ( size_t ) length + MagickPathExtent, sizeof ( * sixel_buffer ) ) ; p = sixel_buffer ; if ( sixel_buffer!= ( char * ) NULL ) while ( ReadBlobString ( image, p )!= ( char * ) NULL ) { if ( ( * p == '#' ) && ( ( p == sixel_buffer ) || ( * ( p - 1 ) == '\\n' ) ) ) continue ; if ( ( * p == '}' ) && ( * ( p + 1 ) == ';' ) ) break ; p += strlen ( p ) ; if ( ( size_t ) ( p - sixel_buffer + MagickPathExtent + 1 ) < length ) continue ; length <<= 1 ; sixel_buffer = ( char * ) ResizeQuantumMemory ( sixel_buffer, length + MagickPathExtent + 1, sizeof ( * sixel_buffer ) ) ; if ( sixel_buffer == ( char * ) NULL ) break ; p = sixel_buffer + strlen ( sixel_buffer ) ; } if ( sixel_buffer == ( char * ) NULL ) ThrowReaderException ( ResourceLimitError, "

Fix:
<S2SV_ModStart> RelinquishMagickMemory ( sixel_buffer ) ; sixel_pixels = ( unsigned char * ) RelinquishMagickMemory ( sixel_pixels
Buggy code:
 SQLWCHAR * _multi_string_alloc_and_expand ( LPCSTR in ) { SQLWCHAR * chr ; int len = 0 ; if (! in ) { <START_BUG> return in ; <END_BUG> } while ( in [ len ]!= 0 || in [ len + 1 ]!= 0 ) { len ++ ; } chr = malloc ( sizeof ( SQLWCHAR ) * ( len + 2 ) ) ; len = 0 ; while ( in [ len ]!= 0 || in [ len + 1 ]!= 0 ) { chr [ len ] = in [ len ] ; len ++ ; } chr [ len ++ ] = 0 ; chr [ len ++ ] = 0 ; return chr ; }

Fix:
<S2SV_ModStart> ) { return NULL <S2SV_ModEnd> ; } while
Buggy code:
 static void prefetch_enc ( void ) { <START_BUG> prefetch_table ( ( const void * ) encT, sizeof ( encT ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> void ) { enc_tables. counter_head ++ ; enc_tables. counter_tail ++ ; <S2SV_ModStart> void * ) & enc_tables <S2SV_ModEnd>, sizeof ( <S2SV_ModStart>, sizeof ( enc_tables <S2SV_ModEnd> ) ) ;
Buggy code:
 static int daemon_AuthUserPwd ( char * username, char * password, char * errbuf ) { # ifdef _WIN32 HANDLE Token ; if ( LogonUser ( username, ".", password, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, & Token ) == 0 ) { pcap_fmt_errmsg_for_win32_err ( errbuf, PCAP_ERRBUF_SIZE, GetLastError ( ), "LogonUser()   failed" ) ; return - 1 ; } if ( ImpersonateLoggedOnUser ( Token ) == 0 ) { pcap_fmt_errmsg_for_win32_err ( errbuf, PCAP_ERRBUF_SIZE, GetLastError ( ), "ImpersonateLoggedOnUser()   failed" ) ; CloseHandle ( Token ) ; return - 1 ; } CloseHandle ( Token ) ; return 0 ; # else struct passwd * user ; char * user_password ; # ifdef HAVE_GETSPNAM struct spwd * usersp ; <START_BUG> # endif <END_BUG> if ( ( user = getpwnam ( username ) ) == NULL ) { pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed:   user   name   or   password   incorrect" ) ; return - 1 ; } # ifdef HAVE_GETSPNAM if ( ( usersp = getspnam ( username ) ) == NULL ) { pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed:   user   name   or   password   incorrect" ) ; return - 1 ; } user_password = usersp -> sp_pwdp ; # else user_password = user -> pw_passwd ; # endif  if ( strcmp ( user_password, ( char * ) crypt ( password, user_password ) )!= 0 ) <START_BUG> { pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication   failed:   user   name   or   password   incorrect" ) ; return - 1 ; } if ( setuid ( user -> pw_uid ) ) { pcap_fmt_errmsg_for_errno ( errbuf, PCAP_ERRBUF_SIZE, errno, "setuid" ) ; return - 1 ; } return 0 ; #<END_BUG>

Fix:
<S2SV_ModStart> ; # endif char * crypt_password ; <S2SV_ModStart> ; # endif crypt_password = crypt ( password, user_password ) ; if ( crypt_password == NULL ) { pcap_snprintf ( errbuf, PCAP_ERRBUF_SIZE, "Authentication <S2SV_blank> failed" ) ; return - 1 ; } <S2SV_ModStart> ( user_password, crypt_password <S2SV_ModEnd> )!= 0
Buggy code:
 static Image * ReadFAXImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> storage_class = PseudoClass ; if ( image -> columns == 0 ) image -> columns = 2592 ; if ( image -> rows == 0 ) image -> rows = 3508 ; image -> depth = 8 ; if ( AcquireImageColormap ( image, 2 ) == MagickFalse ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; image -> colormap [ 0 ]. red = QuantumRange ; image -> colormap [ 0 ]. green = QuantumRange ; image -> colormap [ 0 ]. blue = QuantumRange ; image -> colormap [ 1 ]. red = ( Quantum ) 0 ; image -> colormap [ 1 ]. green = ( Quantum ) 0 ; image -> colormap [ 1 ]. blue = ( Quantum ) 0 ; if ( image_info -> ping!= MagickFalse ) { ( void ) CloseBlob ( image ) ; return ( GetFirstImageInList ( image ) ) ; } <START_BUG> status = HuffmanDecodeImage ( image ) ; <END_BUG> if ( status == MagickFalse ) ThrowReaderException ( CorruptImageError, "UnableToReadImageData" ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; ( void ) CloseBlob ( image ) ; return ( GetFirstImageInList ( image ) ) ; }

Fix:
<S2SV_ModStart> } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; } status =
Buggy code:
 <START_BUG> static int set_registers ( rtl8150_t * dev, u16 indx, u16 size, void * data ) <END_BUG> {  return usb_control_msg ( dev -> udev, usb_sndctrlpipe ( dev -> udev, 0 ), <START_BUG> RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE, <END_BUG> indx, 0, data, size, 500 ) ;  <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> u16 size, const <S2SV_ModStart> data ) { void * buf ; int ret ; buf = kmemdup ( data, size, GFP_NOIO ) ; if (! buf ) return - ENOMEM ; ret = <S2SV_ModEnd> usb_control_msg ( dev <S2SV_ModStart>, 0, buf <S2SV_ModEnd>, size, <S2SV_ModStart> 500 ) ; kfree ( buf ) ; return ret ;
Buggy code:
 int get_evtchn_to_irq ( evtchn_port_t evtchn ) { if ( evtchn >= xen_evtchn_max_channels ( ) ) return - 1 ; if ( evtchn_to_irq [ EVTCHN_ROW ( evtchn ) ] == NULL ) return - 1 ; <START_BUG> return evtchn_to_irq [ EVTCHN_ROW ( evtchn ) ] [ EVTCHN_COL ( evtchn ) ] ; <END_BUG> }

Fix:
<S2SV_ModStart> 1 ; return READ_ONCE ( <S2SV_ModStart> evtchn ) ] )
Buggy code:
 static noinline int btrfs_mksubvol ( struct path * parent, char * name, int namelen, struct btrfs_root * snap_src, u64 * async_transid, bool readonly, struct btrfs_qgroup_inherit * * inherit ) { struct inode * dir = parent -> dentry -> d_inode ; struct dentry * dentry ; int error ; mutex_lock_nested ( & dir -> i_mutex, I_MUTEX_PARENT ) ; dentry = lookup_one_len ( name, parent -> dentry, namelen ) ; error = PTR_ERR ( dentry ) ; if ( IS_ERR ( dentry ) ) goto out_unlock ; error = - EEXIST ; if ( dentry -> d_inode ) goto out_dput ; error = btrfs_may_create ( dir, dentry ) ; if ( error ) goto out_dput ; <START_BUG> down_read ( & BTRFS_I ( dir ) -> root -> fs_info -> subvol_sem ) ; <END_BUG> if ( btrfs_root_refs ( & BTRFS_I ( dir ) -> root -> root_item ) == 0 ) goto out_up_read ; if ( snap_src ) { error = create_snapshot ( snap_src, dentry, name, namelen, async_transid, readonly, inherit ) ; } else { error = create_subvol ( BTRFS_I ( dir ) -> root, dentry, name, namelen, async_transid, inherit ) ; } if (! error ) fsnotify_mkdir ( dir, dentry ) ; out_up_read : up_read ( & BTRFS_I ( dir ) -> root -> fs_info -> subvol_sem ) ; out_dput : dput ( dentry ) ; out_unlock : mutex_unlock ( & dir -> i_mutex ) ; return error ; }

Fix:
<S2SV_ModStart> goto out_dput ; error = btrfs_check_dir_item_collision ( BTRFS_I ( dir ) -> root, dir -> i_ino, name, namelen ) ; if ( error ) goto out_dput ;
Buggy code:
 static void request_key_auth_describe ( const struct key * key, struct seq_file * m ) { struct request_key_auth * rka = key -> payload. data [ 0 ] ; seq_puts ( m, "key:" ) ; seq_puts ( m, key -> description ) ; <START_BUG> if ( key_is_instantiated ( key ) ) <END_BUG> seq_printf ( m, "   pid:%d   ci:%zu", rka -> pid, rka -> callout_len ) ; }

Fix:
<S2SV_ModStart> ; if ( key_is_positive <S2SV_ModEnd> ( key )
Buggy code:
 static int rc_pick_q_and_bounds_one_pass_cbr ( const VP9_COMP * cpi, int * bottom_index, int * top_index ) { const VP9_COMMON * const cm = & cpi -> common ; const RATE_CONTROL * const rc = & cpi -> rc ; int active_best_quality ; int active_worst_quality = calc_active_worst_quality_one_pass_cbr ( cpi ) ; int q ; <START_BUG> if ( frame_is_intra_only ( cm ) ) { <END_BUG> active_best_quality = rc -> best_quality ; if ( rc -> this_key_frame_forced ) { int qindex = rc -> last_boosted_qindex ;  double last_boosted_q = vp9_convert_qindex_to_q ( qindex ) ; <START_BUG> int delta_qindex = vp9_compute_qdelta ( rc, last_boosted_q, <END_BUG> ( last_boosted_q * 0.75 ) ) ;  active_best_quality = MAX ( qindex + delta_qindex, rc -> best_quality ) ; } else if ( cm -> current_video_frame > 0 ) { double q_adj_factor = 1.0 ; double q_val ; <START_BUG> active_best_quality = get_active_quality ( rc -> avg_frame_qindex [ KEY_FRAME ], <END_BUG>  rc -> kf_boost, <START_BUG> kf_low, kf_high, kf_low_motion_minq, kf_high_motion_minq ) ; if ( ( cm -> width * cm -> height ) <= ( 352 * 288 ) ) { q_adj_factor -= 0.25 ; } <END_BUG> q_val = vp9_convert_qindex_to_q ( active_best_quality ) ;  active_best_quality += vp9_compute_qdelta ( rc, q_val, <START_BUG> q_val * q_adj_factor ) ; <END_BUG> } } else if (! rc -> is_src_frame_alt_ref &&! cpi -> use_svc && ( cpi -> refresh_golden_frame || cpi -> refresh_alt_ref_frame ) ) { if ( rc -> frames_since_key >

Fix:
<S2SV_ModStart> int q ; int * rtc_minq ; ASSIGN_MINQ_TABLE ( cm -> bit_depth, rtc_minq ) ; <S2SV_ModStart> vp9_convert_qindex_to_q ( qindex, cm -> bit_depth <S2SV_ModStart> * 0.75 ), cm -> bit_depth <S2SV_ModStart> ; active_best_quality = get_kf_active_quality ( rc, <S2SV_ModEnd> rc -> avg_frame_qindex <S2SV_ModStart> KEY_FRAME ], cm -> bit_depth <S2SV_ModEnd> ) ; if <S2SV_ModStart> vp9_convert_qindex_to_q ( active_best_quality, cm -> bit_depth <S2SV_ModStart> q_val * q_adj_factor, cm -> bit_depth <S2SV_ModStart> } active_best_quality = get_gf_active_quality ( rc, q, cm -> bit_depth <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) active_best_quality = rtc_minq <S2SV_ModEnd> [ rc -> <S2SV_ModStart> else active_best_quality = rtc_minq <S2SV_ModEnd> [ active_worst_quality ] <S2SV_ModStart> ) active_best_quality = rtc_minq <S2SV_ModEnd> [ rc -> <S2SV_ModStart> else active_best_quality = rtc_minq <S2SV_ModEnd> [ active_wor
Buggy code:
 sctp_disposition_t sctp_sf_ootb ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * chunk = arg ; struct sk_buff * skb = chunk -> skb ; sctp_chunkhdr_t * ch ; sctp_errhdr_t * err ; __u8 * ch_end ; int ootb_shut_ack = 0 ; int ootb_cookie_ack = 0 ; SCTP_INC_STATS ( net, SCTP_MIB_OUTOFBLUES ) ; ch = ( sctp_chunkhdr_t * ) chunk -> chunk_hdr ; do { if ( ntohs ( ch -> length ) < sizeof ( sctp_chunkhdr_t ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ; <START_BUG> if ( SCTP_CID_SHUTDOWN_ACK == ch -> type ) <END_BUG> ootb_shut_ack = 1 ; if ( SCTP_CID_ABORT == ch -> type ) return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; if ( SCTP_CID_COOKIE_ACK == ch -> type ) ootb_cookie_ack = 1 ; if ( SCTP_CID_ERROR == ch -> type ) { sctp_walk_errors ( err, ch ) { if ( SCTP_ERROR_STALE_COOKIE == err -> cause ) { ootb_cookie_ack = 1 ; break ; } } } ch_end = ( ( __u8 * ) ch ) + SCTP_PAD4 ( ntohs ( ch -> length ) ) ; if ( ch_end > skb_tail_pointer ( skb ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ;  ch = ( sctp_chunkhdr_t * ) ch_end ; <START_BUG> } while ( ch_end < skb_tail_pointer ( skb ) ) ; if ( ootb_shut_ack )<END_BUG>

Fix:
<S2SV_ModStart> commands ) ; <S2SV_ModEnd> ch_end = ( <S2SV_ModStart> commands ) ; if ( SCTP_CID_SHUTDOWN_ACK == ch -> type ) ootb_shut_ack = 1 ; if ( SCTP_CID_ABORT == ch -> type ) return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; if ( SCTP_CID_COOKIE_ACK == ch -> type ) ootb_cookie_ack = 1 ; if ( SCTP_CID_ERROR == ch -> type ) { sctp_walk_errors ( err, ch ) { if ( SCTP_ERROR_STALE_COOKIE == err -> cause ) { ootb_cookie_ack = 1 ; break ; } } }
Buggy code:
 static int ssl_verify_cert ( struct tunnel * tunnel ) { int ret = - 1 ; int cert_valid = 0 ; unsigned char digest [ SHA256LEN ] ; unsigned int len ; struct x509_digest * elem ; char digest_str [ SHA256STRLEN ], * subject, * issuer ; char * line ; int i ; X509_NAME * subj ; SSL_set_verify ( tunnel -> ssl_handle, SSL_VERIFY_PEER, NULL ) ; X509 * cert = SSL_get_peer_certificate ( tunnel -> ssl_handle ) ; if ( cert == NULL ) { log_error ( "Unable   to   get   gateway   certificate.\\n" ) ; return 1 ; } subj = X509_get_subject_name ( cert ) ; # ifdef HAVE_X509_CHECK_HOST if ( X509_check_host ( cert, tunnel -> config -> gateway_host, 0, 0, NULL ) == 1 ) cert_valid = 1 ; # else <START_BUG> char common_name [ FIELD_SIZE + 1 ] ; <END_BUG> if ( subj && X509_NAME_get_text_by_NID ( subj, NID_commonName, common_name, FIELD_SIZE ) > 0 && strncasecmp ( common_name, tunnel -> config -> gateway_host,  FIELD_SIZE ) == 0 ) <START_BUG> cert_valid = 1 ; # endif if ( cert_valid && SSL_get_verify_result ( tunnel -> ssl_handle ) == X509_V_OK ) { log_debug ( "Gateway   certificate   validation   succeeded.\\n" ) ; ret = 0 ; goto free_cert ; } log_debug ( "Gateway   certificate   validation   failed.\\n" ) ; if ( X509_digest ( cert, EVP_sha256 ( ), digest, & len ) <= 0 || len!= SHA256LEN ) { log_error ( "Could   not   compute   certificate   sha256   digest.\\n" ) ; goto free_cert ; } for ( i = 0 ; i < SHA256LEN ; i ++ ) sprintf ( & digest_str [ 2 * i ], "%02x", digest [ i ] ) ; digest_str [ SHA256STRLEN - 1 ] = '\\0' ; for ( elem = tunnel -> config -> cert_whitelist ; elem!= NULL ; elem<END_BUG>

Fix:
<S2SV_ModStart> ; # else if ( validate_hostname ( <S2SV_ModEnd> tunnel -> config <S2SV_ModStart> -> gateway_host, cert ) == MatchFound <S2SV_ModEnd> ) cert_valid =
Buggy code:
 int ext4_ext_insert_extent ( handle_t * handle, struct inode * inode, struct ext4_ext_path * path, struct ext4_extent * newext, int flag ) { struct ext4_extent_header * eh ; struct ext4_extent * ex, * fex ; struct ext4_extent * nearex ; struct ext4_ext_path * npath = NULL ; int depth, len, err ; ext4_lblk_t next ; unsigned uninitialized = 0 ; BUG_ON ( ext4_ext_get_actual_len ( newext ) == 0 ) ; depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; BUG_ON ( path [ depth ]. p_hdr == NULL ) ; <START_BUG> if ( ex && ( flag!= EXT4_GET_BLOCKS_PRE_IO ) <END_BUG> && ext4_can_extents_be_merged ( inode, ex, newext ) ) { ext_debug ( "append   [%d]%d   block   to   %d:[%d]%d   (from   %llu)\\n", ext4_ext_is_uninitialized ( newext ), ext4_ext_get_actual_len ( newext ), le32_to_cpu ( ex -> ee_block ), ext4_ext_is_uninitialized ( ex ), ext4_ext_get_actual_len ( ex ), ext_pblock ( ex ) ) ; err = ext4_ext_get_access ( handle, inode, path + depth ) ; if ( err ) return err ; if ( ext4_ext_is_uninitialized ( ex ) ) uninitialized = 1 ; ex -> ee_len = cpu_to_le16 ( ext4_ext_get_actual_len ( ex ) + ext4_ext_get_actual_len ( newext ) ) ; if ( uninitialized ) ext4_ext_mark_uninitialized ( ex ) ; eh = path [ depth ]. p_hdr ; nearex = ex ; goto merge ; } repeat : depth = ext_depth ( inode ) ; eh = path [ depth ]. p_hdr ; if ( le16_to_cpu ( eh -> eh_entries ) < le16_to_cpu ( eh

Fix:
<S2SV_ModStart> ( ex &&! ( flag & <S2SV_ModEnd> EXT4_GET_BLOCKS_PRE_IO ) && <S2SV_ModStart> : if (! ( flag & EXT4_GET_BLOCKS_PRE_IO ) <S2SV_ModEnd> ) ext4_ext_try_to_merge (
Buggy code:
 static RD_BOOL mcs_recv_connect_response ( STREAM mcs_data ) { UNUSED ( mcs_data ) ; uint8 result ; <START_BUG> int length ; <END_BUG>  STREAM s ; <START_BUG> RD_BOOL is_fastpath ; uint8 fastpath_hdr ; logger ( Protocol, Debug, "%s()", __func__ ) ; s = iso_recv ( & is_fastpath, & fastpath_hdr ) ; if ( s == NULL ) return False ; <END_BUG> ber_parse_header ( s, MCS_CONNECT_RESPONSE, & length ) ;  ber_parse_header ( s, BER_TAG_RESULT, & length ) ; in_uint8 ( s, result ) ; if ( result!= 0 ) { logger ( Protocol, Error, "mcs_recv_connect_response(),   result=%d", result ) ; return False ; } ber_parse_header ( s, BER_TAG_INTEGER, & length ) ; in_uint8s ( s, length ) ; <START_BUG> mcs_parse_domain_params ( s ) ; <END_BUG> ber_parse_header ( s, BER_TAG_OCTET_STRING, & length ) ; sec_process_mcs_data ( s ) ; return s_check_end ( s ) ; }

Fix:
<S2SV_ModStart> uint8 result ; uint32 <S2SV_ModEnd> length ; STREAM <S2SV_ModStart> ; STREAM s ; struct stream packet <S2SV_ModStart> return False ; packet = * s ; <S2SV_ModStart> length ) ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "mcs_recv_connect_response(), <S2SV_blank> consume <S2SV_blank> connect <S2SV_blank> id <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 <START_BUG> static void __evtchn_fifo_handle_events ( unsigned cpu, bool drop ) <END_BUG> { struct evtchn_fifo_control_block * control_block ; unsigned long ready ; unsigned q ; control_block = per_cpu ( cpu_control_block, cpu ) ; ready = xchg ( & control_block -> ready, 0 ) ; while ( ready ) { q = find_first_bit ( & ready, EVTCHN_FIFO_MAX_QUEUES ) ;  consume_one_event ( cpu, control_block, q, & ready, drop ) ; <START_BUG> ready |= xchg ( & control_block -> ready, 0 ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> unsigned cpu, struct evtchn_loop_ctrl * ctrl <S2SV_ModEnd> ) { struct <S2SV_ModStart> ( cpu, ctrl, <S2SV_ModStart>, & ready <S2SV_ModEnd> ) ; ready
Buggy code:
 <START_BUG> void vp9_iwht4x4_add ( const int16_t * input, uint8_t * dest, int stride, int eob ) { <END_BUG> if ( eob > 1 )  vp9_iwht4x4_16_add ( input, dest, stride ) ; <START_BUG> else <END_BUG> vp9_iwht4x4_1_add ( input, dest, stride ) ;  }

Fix:
<S2SV_ModStart> vp9_iwht4x4_add ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> > 1 ) vpx_iwht4x4_16_add <S2SV_ModEnd> ( input, <S2SV_ModStart> ) ; else vpx_iwht4x4_1_add <S2SV_ModEnd> ( input,
Buggy code:
 void snd_timer_interrupt ( struct snd_timer * timer, unsigned long ticks_left ) { struct snd_timer_instance * ti, * ts, * tmp ; unsigned long resolution, ticks ; struct list_head * p, * ack_list_head ; unsigned long flags ; int use_tasklet = 0 ; if ( timer == NULL ) return ; spin_lock_irqsave ( & timer -> lock, flags ) ; if ( timer -> hw. c_resolution ) resolution = timer -> hw. c_resolution ( timer ) ; else resolution = timer -> hw. resolution ; list_for_each_entry_safe ( ti, tmp, & timer -> active_list_head, active_list ) { if (! ( ti -> flags & SNDRV_TIMER_IFLG_RUNNING ) ) continue ; ti -> pticks += ticks_left ; ti -> resolution = resolution ; if ( ti -> cticks < ticks_left ) ti -> cticks = 0 ; else ti -> cticks -= ticks_left ; if ( ti -> cticks ) continue ; if ( ti -> flags & SNDRV_TIMER_IFLG_AUTO ) { ti -> cticks = ti -> ticks ; } else { ti -> flags &= ~ SNDRV_TIMER_IFLG_RUNNING ; if ( -- timer -> running ) <START_BUG> list_del ( & ti -> active_list ) ; <END_BUG> } if ( ( timer -> hw. flags & SNDRV_TIMER_HW_TASKLET ) || ( ti -> flags & SNDRV_TIMER_IFLG_FAST ) ) ack_list_head = & timer -> ack_list_head ; else ack_list_head = & timer -> sack_list_head ; if ( list_empty ( & ti -> ack_list ) ) list_add_tail ( & ti -> ack_list, ack_list_head ) ; list_for_each_entry ( ts, & ti -> slave_active_head, active_list ) { ts -> pticks = ti -> pticks ; ts -> resolution = resolution ; if ( list_empty ( & ts -> ack_list ) ) list_add_tail ( & ts -> ack_list, ack_list_head ) ; } } if ( timer -> flags & SNDRV_TIMER_FL

Fix:
<S2SV_ModStart> -> running ) list_del_init <S2SV_ModEnd> ( & ti
Buggy code:
 int wasm_dis ( WasmOp * op, const unsigned char * buf, int buf_len ) { op -> len = 1 ; op -> op = buf [ 0 ] ; if ( op -> op > 0xbf ) { return 1 ; } WasmOpDef * opdef = & opcodes [ op -> op ] ; switch ( op -> op ) { case WASM_OP_TRAP : case WASM_OP_NOP : case WASM_OP_ELSE : case WASM_OP_RETURN : case WASM_OP_DROP : case WASM_OP_SELECT : case WASM_OP_I32EQZ : case WASM_OP_I32EQ : case WASM_OP_I32NE : case WASM_OP_I32LTS : case WASM_OP_I32LTU : case WASM_OP_I32GTS : case WASM_OP_I32GTU : case WASM_OP_I32LES : case WASM_OP_I32LEU : case WASM_OP_I32GES : case WASM_OP_I32GEU : case WASM_OP_I64EQZ : case WASM_OP_I64EQ : case WASM_OP_I64NE : case WASM_OP_I64LTS : case WASM_OP_I64LTU : case WASM_OP_I64GTS : case WASM_OP_I64GTU : case WASM_OP_I64LES : case WASM_OP_I64LEU : case WASM_OP_I64GES : case WASM_OP_I64GEU : case WASM_OP_F32EQ : case WASM_OP_F32NE : case WASM_OP_F32LT : case WASM_OP_F32GT : case WASM_OP_F32LE : case WASM_OP_F32GE : case WASM_OP_F64EQ : case WASM_OP_F64NE : case WASM_OP_F64LT : case WASM_OP_F64GT : case WAS

Fix:
<S2SV_ModStart> count ) ; char * txt = op -> txt ; int txtLen = strlen ( op -> txt ) ; int txtLeft = R_ASM_BUFSIZE - txtLen ; txt += txtLen ; <S2SV_ModStart> < count && txtLen <S2SV_ModEnd> + 10 < <S2SV_ModStart> ++ ) { snprintf ( txt, txtLeft <S2SV_ModEnd>, "%d <S2SV_blank> ", <S2SV_ModStart> ] ) ; txtLen = strlen ( txt ) ; txt += txtLen ; txtLeft -= txtLen ; <S2SV_ModStart> } snprintf ( txt, txtLeft - 1 <S2SV_ModEnd>, "%d",
Buggy code:
 long keyctl_update_key ( key_serial_t id, const void __user * _payload, size_t plen ) { key_ref_t key_ref ; void * payload ; long ret ; ret = - EINVAL ; if ( plen > PAGE_SIZE ) goto error ; payload = NULL ; <START_BUG> if ( _payload ) { <END_BUG> ret = - ENOMEM ; payload = kmalloc ( plen, GFP_KERNEL ) ; if (! payload ) goto error ; ret = - EFAULT ; if ( copy_from_user ( payload, _payload, plen )!= 0 ) goto error2 ; } key_ref = lookup_user_key ( id, 0, KEY_NEED_WRITE ) ; if ( IS_ERR ( key_ref ) ) { ret = PTR_ERR ( key_ref ) ; goto error2 ; } ret = key_update ( key_ref, payload, plen ) ; key_ref_put ( key_ref ) ; error2 : kfree ( payload ) ; error : return ret ; }

Fix:
<S2SV_ModStart> ; if ( plen <S2SV_ModEnd> ) { ret
Buggy code:
 static int do_remount ( struct path * path, int flags, int mnt_flags, void * data ) { int err ; struct super_block * sb = path -> mnt -> mnt_sb ; struct mount * mnt = real_mount ( path -> mnt ) ; if (! check_mnt ( mnt ) ) return - EINVAL ; if ( path -> dentry!= path -> mnt -> mnt_root ) return - EINVAL ; if ( ( mnt -> mnt. mnt_flags & MNT_LOCK_READONLY ) &&! ( mnt_flags & MNT_READONLY ) ) { return - EPERM ; } <START_BUG> err = security_sb_remount ( sb, data ) ; <END_BUG> if ( err ) return err ; down_write ( & sb -> s_umount ) ; if ( flags & MS_BIND ) err = change_mount_flags ( path -> mnt, flags ) ; else if (! capable ( CAP_SYS_ADMIN ) ) err = - EPERM ; else err = do_remount_sb ( sb, flags, data, 0 ) ; if (! err ) { lock_mount_hash ( ) ; mnt_flags |= mnt -> mnt. mnt_flags & ~ MNT_USER_SETTABLE_MASK ; mnt -> mnt. mnt_flags = mnt_flags ; touch_mnt_namespace ( mnt -> mnt_ns ) ; unlock_mount_hash ( ) ; } up_write ( & sb -> s_umount ) ; return err ; }

Fix:
<S2SV_ModStart> EPERM ; } if ( ( mnt -> mnt. mnt_flags & MNT_LOCK_NODEV ) &&! ( mnt_flags & MNT_NODEV ) ) { return - EPERM ; } if ( ( mnt -> mnt. mnt_flags & MNT_LOCK_NOSUID ) &&! ( mnt_flags & MNT_NOSUID ) ) { return - EPERM ; } if ( ( mnt -> mnt. mnt_flags & MNT_LOCK_NOEXEC ) &&! ( mnt_flags & MNT_NOEXEC ) ) { return - EPERM ; } if ( ( mnt -> mnt. mnt_flags & MNT_LOCK_ATIME ) && ( ( mnt -> mnt. mnt_flags & MNT_ATIME_MASK )!= ( mnt_flags & MNT_ATIME_MASK ) ) ) { return - EPERM ; }
Buggy code:
 static inline int check_pmd_range ( struct vm_area_struct * vma, pud_t * pud, unsigned long addr, unsigned long end, const nodemask_t * nodes, unsigned long flags, void * private ) { pmd_t * pmd ; unsigned long next ; pmd = pmd_offset ( pud, addr ) ; do { next = pmd_addr_end ( addr, end ) ; split_huge_page_pmd ( vma -> vm_mm, pmd ) ; <START_BUG> if ( pmd_none_or_clear_bad ( pmd ) ) <END_BUG> continue ; if ( check_pte_range ( vma, pmd, addr, next, nodes, flags, private ) ) return - EIO ; } while ( pmd ++, addr = next, addr!= end ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( pmd_none_or_trans_huge_or_clear_bad <S2SV_ModEnd> ( pmd )
Buggy code:
 int main ( int argc, char * argv [ ] ) { int i, c ; FILE * ifp = 0, * ofp = 0 ; const char * ifp_filename = "<stdin>" ; const char * ofp_filename = "<stdout>" ; const char * set_font_name = 0 ; struct font_reader fr ; uint32_t rfork_len ; int raw = 0, macbinary = 1, applesingle = 0, appledouble = 0, binhex = 0 ; Clp_Parser * clp = Clp_NewParser ( argc, ( const char * const * ) argv, sizeof ( options ) // sizeof ( options [ 0 ] ), options ) ; program_name = Clp_ProgramName ( clp ) ; while ( 1 ) { int opt = Clp_Next ( clp ) ; switch ( opt ) { case RAW_OPT : raw = 1 ; macbinary = applesingle = appledouble = binhex = 0 ; break ; case MACBINARY_OPT : macbinary = 1 ; raw = applesingle = appledouble = binhex = 0 ; break ; case APPLESINGLE_OPT : applesingle = 1 ; raw = macbinary = appledouble = binhex = 0 ; break ; case APPLEDOUBLE_OPT : appledouble = 1 ; raw = macbinary = applesingle = binhex = 0 ; break ; case BINHEX_OPT : binhex = 1 ; raw = macbinary = applesingle = appledouble = 0 ; break ; output_file : case OUTPUT_OPT : if ( ofp ) fatal_error ( "output   file   already   specified" ) ; if ( strcmp ( clp -> vstr, "-" ) == 0 ) ofp = stdout ; else { ofp_filename = clp -> vstr ; ofp = fopen ( ofp_filename, "wb" ) ; if (! ofp ) fatal_error ( "%s:   %s", ofp_filename, strerror ( errno ) ) ; } break ; case FILENAME_OPT : if ( set_font_name ) fatal_error ( "Macintosh   font   filename   already   specified" ) ; set_font_name = clp -> vstr ; break ; case HELP_OPT : usage ( ) ; exit ( 0 ) ;

Fix:
<S2SV_ModStart> ; printf ( "Copyright <S2SV_blank> (C) <S2SV_blank> 2000-2010 <S2SV_blank> Eddie <S2SV_blank> Kohler <S2SV_blank> et <S2SV_blank> al.\\n\\\nThis <S2SV_blank> is <S2SV_blank> free <S2SV_blank> software; <S2SV_blank> see <S2SV_blank> the <S2SV_blank> source <S2SV_blank> for <S2SV_blank> copying <S2SV_blank> conditions.\\n\\\nThere <S2SV_blank> is <S2SV_blank> NO <S2SV_blank> warranty, <S2SV_blank> not <S2SV_blank> even <S2SV_blank> for <S2SV_blank> merchantability <S2SV_blank> or <S2SV_blank> fitness <S2SV_blank> for <S2SV_blank> a\\n\\\nparticular <S2SV_blank> purpose.\\n" <S2SV_ModEnd> ) ; exit <S2SV_ModStart> ( isupper ( ( unsigned char ) <S2SV_ModStart> || isdigit ( ( unsigned char ) <S2SV_ModStart> ( islower ( ( unsigned char )
Buggy code:
 int ParseCaffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { <START_BUG> uint32_t chan_chunk = 0, channel_layout = 0, bcount ; <END_BUG> unsigned char * channel_identities = NULL ; unsigned char * channel_reorder = NULL ; int64_t total_samples = 0, infilesize ; CAFFileHeader caf_file_header ; CAFChunkHeader caf_chunk_header ; CAFAudioFormat caf_audio_format ; int i ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & caf_file_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & caf_file_header ) + 4, sizeof ( CAFFileHeader ) - 4, & bcount ) || bcount!= sizeof ( CAFFileHeader ) - 4 ) ) { error_line ( "%s   is   not   a   valid  .CAF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & caf_file_header, sizeof ( CAFFileHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } WavpackBigEndianToNative ( & caf_file_header, CAFFileHeaderFormat ) ; if ( caf_file_header. mFileVersion!= 1 ) { error_line ( "%s:   can\'t   handle   version   %d  .CAF   files!", infilename, caf_file_header. mFileVersion ) ; return WAVPACK_SOFT_ERROR ; } while ( 1 ) { if (! DoReadFile ( infile, & caf_chunk_header, sizeof ( CAFChunkHeader ), & bcount ) || bcount!= sizeof ( CAFChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .CAF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (

Fix:
<S2SV_ModStart> { uint32_t chan_chunk = 0, desc_chunk <S2SV_ModStart>, CAFAudioFormatFormat ) ; desc_chunk = 1 <S2SV_ModStart> if (! desc_chunk ||!
Buggy code:
 static int raptor_rss_parse_start ( raptor_parser * rdf_parser ) { raptor_uri * uri = rdf_parser -> base_uri ; raptor_rss_parser * rss_parser = ( raptor_rss_parser * ) rdf_parser -> context ; int n ; if (! uri ) return 1 ; for ( n = 0 ; n < RAPTOR_RSS_NAMESPACES_SIZE ; n ++ ) rss_parser -> nspaces_seen [ n ] = 'N' ; raptor_sax2_set_option ( rss_parser -> sax2, RAPTOR_OPTION_NO_NET, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_NO_NET ) ) ; raptor_sax2_set_option ( rss_parser -> sax2, RAPTOR_OPTION_NO_FILE, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_NO_FILE ) ) ; <START_BUG> if ( rdf_parser -> uri_filter ) <END_BUG> raptor_sax2_set_uri_filter ( rss_parser -> sax2, rdf_parser -> uri_filter, rdf_parser -> uri_filter_user_data ) ; raptor_sax2_parse_start ( rss_parser -> sax2, uri ) ; return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; raptor_sax2_set_option ( rss_parser -> sax2, RAPTOR_OPTION_LOAD_EXTERNAL_ENTITIES, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_LOAD_EXTERNAL_ENTITIES ) ) ;
Buggy code:
 static void update_mbgraph_mb_stats ( VP9_COMP * cpi, MBGRAPH_MB_STATS * stats, YV12_BUFFER_CONFIG * buf, int mb_y_offset, YV12_BUFFER_CONFIG * golden_ref, <START_BUG> int_mv * prev_golden_ref_mv, <END_BUG> YV12_BUFFER_CONFIG * alt_ref, int mb_row, int mb_col ) {  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; int intra_error ; VP9_COMMON * cm = & cpi -> common ; x -> plane [ 0 ]. src. buf = buf -> y_buffer + mb_y_offset ; x -> plane [ 0 ]. src. stride = buf -> y_stride ; xd -> plane [ 0 ]. dst. buf = get_frame_new_buffer ( cm ) -> y_buffer + mb_y_offset ; xd -> plane [ 0 ]. dst. stride = get_frame_new_buffer ( cm ) -> y_stride ; intra_error = find_best_16x16_intra ( cpi, & stats -> ref [ INTRA_FRAME ]. m. mode ) ; if ( intra_error <= 0 ) intra_error = 1 ; stats -> ref [ INTRA_FRAME ]. err = intra_error ; if ( golden_ref ) { int g_motion_error ; xd -> plane [ 0 ]. pre [ 0 ]. buf = golden_ref -> y_buffer + mb_y_offset ; xd -> plane [ 0 ]. pre [ 0 ]. stride = golden_ref -> y_stride ; g_motion_error = do_16x16_motion_search ( cpi, prev_golden_ref_mv, & stats -> ref [ GOLDEN_FRAME ]. m. mv, mb_row, mb_col ) ; stats -> ref [ GOLDEN_FRAME ]. err = g_motion_error ; } else { stats -> ref [ GOLDEN_FRAME ]. err = INT_MAX ; stats -> ref [ GOLDEN_FRAME ]. m. mv. as_int = 0 ; } if ( alt_<END_BUG>

Fix:
<S2SV_ModStart> * golden_ref, const MV <S2SV_ModEnd> * prev_golden_ref_mv, <S2SV_ModStart> & cpi -> td.
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_sps ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; WORD32 i ; WORD32 vps_id ; WORD32 sps_max_sub_layers ; WORD32 sps_id ; WORD32 sps_temporal_id_nesting_flag ; sps_t * ps_sps ; profile_tier_lvl_info_t s_ptl ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; BITS_PARSE ( "video_parameter_set_id", value, ps_bitstrm, 4 ) ; vps_id = value ; vps_id = CLIP3 ( vps_id, 0, MAX_VPS_CNT - 1 ) ; BITS_PARSE ( "sps_max_sub_layers_minus1", value, ps_bitstrm, 3 ) ; sps_max_sub_layers = value + 1 ; sps_max_sub_layers = CLIP3 ( sps_max_sub_layers, 1, 7 ) ; BITS_PARSE ( "sps_temporal_id_nesting_flag", value, ps_bitstrm, 1 ) ; sps_temporal_id_nesting_flag = value ; ret = ihevcd_profile_tier_level ( ps_bitstrm, & ( s_ptl ), 1, ( sps_max_sub_layers - 1 ) ) ; UEV_PARSE ( "seq_parameter_set_id", value, ps_bitstrm ) ; sps_id = value ; if ( ( sps_id >= MAX_SPS_CNT ) || ( sps_id < 0 ) ) { if ( ps_codec -> i4_sps_done ) return IHEVCD_UNSUPPORTED_SPS_ID ; else sps_id = 0 ; } ps_sps = ( ps_codec -> s_parse. ps_sps_base + MAX_SPS_CNT - 1 ) ; ps_sps ->

Fix:
<S2SV_ModStart> + 1 ; if ( ps_sps -> ai1_sps_max_dec_pic_buffering [ i ] > MAX_DPB_SIZE ) { return IHEVCD_INVALID_PARAMETER ; } <S2SV_ModStart> = value ; if ( ps_sps -> ai1_sps_max_num_reorder_pics [ i ] > ps_sps -> ai1_sps_max_dec_pic_buffering [ i ] ) { return IHEVCD_INVALID_PARAMETER ; }
Buggy code:
 static int jpc_pi_nextpcrl ( register jpc_pi_t * pi ) { int rlvlno ; jpc_pirlvl_t * pirlvl ; jpc_pchg_t * pchg ; int prchind ; int prcvind ; int * prclyrno ; int compno ; jpc_picomp_t * picomp ; int xstep ; int ystep ; uint_fast32_t trx0 ; uint_fast32_t try0 ; uint_fast32_t r ; uint_fast32_t rpx ; uint_fast32_t rpy ; pchg = pi -> pchg ; if (! pi -> prgvolfirst ) { goto skip ; } else { pi -> xstep = 0 ; pi -> ystep = 0 ; for ( compno = 0, picomp = pi -> picomps ; compno < pi -> numcomps ; ++ compno, ++ picomp ) { for ( rlvlno = 0, pirlvl = picomp -> pirlvls ; rlvlno < picomp -> numrlvls ; ++ rlvlno, ++ pirlvl ) { <START_BUG> xstep = picomp -> hsamp * ( 1 << <END_BUG> ( pirlvl -> prcwidthexpn + picomp -> numrlvls - rlvlno - 1 ) ) ;  ystep = picomp -> vsamp * ( 1 << <START_BUG> ( pirlvl -> prcheightexpn + picomp -> numrlvls - rlvlno - 1 ) ) ; pi -> xstep = (! pi -> xstep )? xstep : JAS_MIN ( pi -> xstep, xstep ) ; pi -> ystep = (! pi -> ystep )? ystep : JAS_MIN ( pi -> ystep, ystep ) ; } } pi -> prgvolfirst = 0 ; } for ( pi -> y = pi -> ystart ; pi -> y < pi -> yend ; pi -> y += pi -> ystep - ( pi -> y % pi -> ystep ) ) { for ( pi -> x = pi -> xstart ; pi -> x < pi -> xend ; pi -> x += pi -> xstep - ( pi -> x % pi -> xstep ) ) { for ( pi -> compno = pchg -> compnostart<END_BUG>

Fix:
<S2SV_ModStart> pirlvl ) { if ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls > JAS_UINTFAST32_NUMBITS - 2 || pirlvl -> prcheightexpn + pi -> picomp -> numrlvls > JAS_UINTFAST32_NUMBITS - 2 ) { return - 1 ; } <S2SV_ModStart> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << ( pirlvl <S2SV_ModStart> vsamp * ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << ( pirlvl <S2SV_ModStart> ) % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpx ) <S2SV_ModStart> ) % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpy )
Buggy code:
 static void nick_hash_remove ( CHANNEL_REC * channel, NICK_REC * nick ) { <START_BUG> NICK_REC * list ; <END_BUG> list = g_hash_table_lookup ( channel -> nicks, nick -> nick ) ; if ( list == NULL ) return ;  if ( list == nick || list -> next == NULL ) { <START_BUG> g_hash_table_remove ( channel -> nicks, nick -> nick ) ; if ( list -> next!= NULL ) { <END_BUG> g_hash_table_insert ( channel -> nicks, nick -> next -> nick,  nick -> next ) ; } <START_BUG> } else { <END_BUG> while ( list -> next!= nick ) list = list -> next ; list -> next = nick -> next ; }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> NICK_REC * list, * newlist <S2SV_ModStart> list == nick ) { newlist = <S2SV_ModEnd> nick -> next <S2SV_ModStart> nick -> next ; <S2SV_ModEnd> } else { <S2SV_ModStart> } else { newlist = list ; <S2SV_ModStart> next ; } g_hash_table_remove ( channel -> nicks, nick -> nick ) ; if ( newlist!= NULL ) { g_hash_table_insert ( channel -> nicks, newlist -> nick, newlist ) ; }
Buggy code:
 static ScreenCell * realloc_buffer ( VTermScreen * screen, ScreenCell * buffer, int new_rows, int new_cols ) { ScreenCell * new_buffer = vterm_allocator_malloc ( screen -> vt, sizeof ( ScreenCell ) * new_rows * new_cols ) ; int row, col ; for ( row = 0 ; row < new_rows ; row ++ ) { for ( col = 0 ; col < new_cols ; col ++ ) { ScreenCell * new_cell = new_buffer + row * new_cols + col ; if ( buffer && row < screen -> rows && col < screen -> cols ) * new_cell = buffer [ row * screen -> cols + col ] ; else { new_cell -> chars [ 0 ] = 0 ; new_cell -> pen = screen -> pen ; } } } <START_BUG> if ( buffer ) <END_BUG> vterm_allocator_free ( screen -> vt, buffer ) ; return new_buffer ; }

Fix:
<S2SV_ModStart> } } } <S2SV_ModEnd> vterm_allocator_free ( screen
Buggy code:
 static int magicmouse_raw_event ( struct hid_device * hdev, struct hid_report * report, u8 * data, int size ) { struct magicmouse_sc * msc = hid_get_drvdata ( hdev ) ; struct input_dev * input = msc -> input ; int x = 0, y = 0, ii, clicks = 0, npoints ; switch ( data [ 0 ] ) { case TRACKPAD_REPORT_ID : if ( size < 4 || ( ( size - 4 ) % 9 )!= 0 ) return 0 ; npoints = ( size - 4 ) // 9 ; <START_BUG> msc -> ntouches = 0 ; <END_BUG> for ( ii = 0 ; ii < npoints ; ii ++ ) magicmouse_emit_touch ( msc, ii, data + ii * 9 + 4 ) ; clicks = data [ 1 ] ; break ; case MOUSE_REPORT_ID : if ( size < 6 || ( ( size - 6 ) % 8 )!= 0 ) return 0 ;  npoints = ( size - 6 ) // 8 ; <START_BUG> msc -> ntouches = 0 ; for ( ii = 0 ; ii < npoints ; ii ++ ) magicmouse_emit_touch ( msc, ii, data + ii * 8 + 6 ) ; x = ( int ) ( ( ( data [ 3 ] & 0x0c ) << 28 ) | ( data [ 1 ] << 22 ) ) >> 22 ; y = ( int ) ( ( ( data [ 3 ] & 0x30 ) << 26 ) | ( data [ 2 ] << 22 ) ) >> 22 ; clicks = data [ 3 ] ; break ; case DOUBLE_REPORT_ID : magicmouse_raw_event ( hdev, report, data + 2, data [ 1 ] ) ; magicmouse_raw_event ( hdev, report, data + 2 + data [ 1 ], size - 2 - data [ 1 ] ) ; break ; default : return 0 ; } if ( input -> id. product == USB_DEVICE_ID_APPLE_MAGICMOUSE ) { magicmouse_emit_buttons ( msc, clicks & 3 ) ; input_report_rel ( input, REL_X, x ) ; input_report_rel ( input, REL_Y, y ) ; } else { input_report_key ( input, B<END_BUG>

Fix:
<S2SV_ModStart> // 9 ; if ( npoints > 15 ) { hid_warn ( hdev, "invalid <S2SV_blank> size <S2SV_blank> value <S2SV_blank> (%d) <S2SV_blank> for <S2SV_blank> TRACKPAD_REPORT_ID\\n", size ) ; return 0 ; } <S2SV_ModStart> // 8 ; if ( npoints > 15 ) { hid_warn ( hdev, "invalid <S2SV_blank> size <S2SV_blank> value <S2SV_blank> (%d) <S2SV_blank> for <S2SV_blank> MOUSE_REPORT_ID\\n", size ) ; return 0 ; }
Buggy code:
 static void bump_cpu_timer ( struct k_itimer * timer, u64 now ) { int i ; u64 delta, incr ; if ( timer -> it. cpu. incr == 0 ) return ; if ( now < timer -> it. cpu. expires ) return ; incr = timer -> it. cpu. incr ; delta = now + incr - timer -> it. cpu. expires ; for ( i = 0 ; incr < delta - incr ; i ++ ) incr = incr << 1 ; for ( ; i >= 0 ; incr >>= 1, i -- ) { if ( delta < incr ) continue ; timer -> it. cpu. expires += incr ; <START_BUG> timer -> it_overrun += 1 << i ; <END_BUG> delta -= incr ; } }

Fix:
<S2SV_ModStart> -> it_overrun += 1LL <S2SV_ModEnd> << i ;
Buggy code:
 __visible __notrace_funcgraph struct task_struct * __switch_to ( struct task_struct * prev_p, struct task_struct * next_p ) { struct thread_struct * prev = & prev_p -> thread ; struct thread_struct * next = & next_p -> thread ; int cpu = smp_processor_id ( ) ; struct tss_struct * tss = & per_cpu ( init_tss, cpu ) ; unsigned fsindex, gsindex ; fpu_switch_t fpu ; fpu = switch_fpu_prepare ( prev_p, next_p, cpu ) ; load_sp0 ( tss, next ) ; <START_BUG> savesegment ( es, prev -> es ) ; <END_BUG> if ( unlikely ( next -> es | prev -> es ) ) loadsegment ( es, next -> es ) ; savesegment ( ds, prev -> ds ) ; if ( unlikely ( next -> ds | prev -> ds ) )  loadsegment ( ds, next -> ds ) ; <START_BUG> savesegment ( fs, fsindex ) ; savesegment ( gs, gsindex ) ; load_TLS ( next, cpu ) ; arch_end_context_switch ( next_p ) ; if ( unlikely ( fsindex | next -> fsindex | prev -> fs ) ) { loadsegment ( fs, next -> fsindex ) ; if ( fsindex ) prev -> fs = 0 ; } if ( next -> fs ) wrmsrl ( MSR_FS_BASE, next -> fs ) ; prev -> fsindex = fsindex ; if ( unlikely ( gsindex | next -> gsindex | prev -> gs ) ) { load_gs_index ( next -> gsindex ) ; if ( gsindex ) prev -> gs = 0 ; } if ( next -> gs ) wrmsrl ( MSR_KERNEL_GS_BASE, next -> gs ) ; prev -> gsindex = gsindex ; switch_fpu_finish ( next_p, fpu ) ; prev -> usersp = this_cpu_read ( old_rsp ) ; this_cpu_write ( old_rsp, next -> usersp ) ; this_cpu_write ( current_task, next_p ) ; task_thread_info ( prev_p ) -> saved_preempt_count = this_cpu_read ( __preempt_count ) ; this_cpu_write<END_BUG>

Fix:
<S2SV_ModStart> ; savesegment ( fs, fsindex ) ; savesegment ( gs, gsindex ) ; load_TLS ( next, cpu ) ; arch_end_context_switch ( next_p ) ; savesegment ( <S2SV_ModStart> next -> ds <S2SV_ModEnd> ) ; if
Buggy code:
 static void php_imagepolygon ( INTERNAL_FUNCTION_PARAMETERS, int filled ) { zval * IM, * POINTS ; long NPOINTS, COL ; zval * * var = NULL ; gdImagePtr im ; gdPointPtr points ; int npoints, col, nelem, i ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "rall", & IM, & POINTS, & NPOINTS, & COL ) == FAILURE ) { return ; } ZEND_FETCH_RESOURCE ( im, gdImagePtr, & IM, - 1, "Image", le_gd ) ; npoints = NPOINTS ; col = COL ; nelem = zend_hash_num_elements ( Z_ARRVAL_P ( POINTS ) ) ; if ( nelem < 6 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "You   must   have   at   least   3   points   in   your   array" ) ; RETURN_FALSE ; } if ( npoints <= 0 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "You   must   give   a   positive   number   of   points" ) ; RETURN_FALSE ; } if ( nelem < npoints * 2 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Trying   to   use   %d   points   in   array   with   only   %d   points", npoints, nelem // 2 ) ; RETURN_FALSE ; } points = ( gdPointPtr ) safe_emalloc ( npoints, sizeof ( gdPoint ), 0 ) ; for ( i = 0 ; i < npoints ; i ++ ) { if ( zend_hash_index_find ( Z_ARRVAL_P ( POINTS ), ( i * 2 ), ( void * * ) & var ) == SUCCESS ) { <START_BUG> SEPARATE_ZVAL ( ( var ) ) ; <END_BUG>  convert_to_long ( * var ) ; <START_BUG> <END_BUG> points [ i ]. x = Z_LVAL_PP ( var ) ;  } if ( zend_hash_index_find ( Z_ARRVAL_P

Fix:
<S2SV_ModStart> SUCCESS ) { if ( Z_TYPE_PP ( var )!= IS_LONG ) { zval lval ; lval = * * var ; zval_copy_ctor ( & lval <S2SV_ModEnd> ) ; convert_to_long <S2SV_ModStart> ; convert_to_long ( & lval <S2SV_ModEnd> ) ; points <S2SV_ModStart>. x = Z_LVAL ( lval ) ; } else { points [ i ]. x = <S2SV_ModStart> var ) ; } <S2SV_ModStart> SUCCESS ) { if ( Z_TYPE_PP ( var )!= IS_LONG ) { zval lval ; lval = * * var ; zval_copy_ctor ( & lval <S2SV_ModEnd> ) ; convert_to_long <S2SV_ModStart> ; convert_to_long ( & lval <S2SV_ModEnd> ) ; points <S2SV_ModStart>. y = Z_LVAL ( lval ) ; } else { points [ i ]. y = <S2SV_ModStart> ; } } }
Buggy code:
 static Image * ReadDIBImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { DIBInfo dib_info ; Image * image ; IndexPacket index ; ssize_t bit, y ; MagickBooleanType status ; MemoryInfo * pixel_info ; register IndexPacket * indexes ; register ssize_t x ; register PixelPacket * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_line, length ; ssize_t count ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & dib_info, 0, sizeof ( dib_info ) ) ; dib_info. size = ReadBlobLSBLong ( image ) ; if ( dib_info. size!= 40 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; dib_info. width = ( short ) ReadBlobLSBLong ( image ) ; dib_info. height = ( short ) ReadBlobLSBLong ( image ) ; dib_info. planes = ReadBlobLSBShort ( image ) ; dib_info. bits_per_pixel = ReadBlobLSBShort ( image ) ; dib_info. compression = ReadBlobLSBLong ( image ) ; dib_info. image_size = ReadBlobLSBLong ( image ) ; dib_info. x_pixels = ReadBlobLSBLong ( image ) ; dib_info. y_pixels = ReadBlobLSBLong ( image ) ; dib_info. number_colors = ReadBlobLSBLong ( image ) ; dib_info. colors_important = ReadBlobLSBLong

Fix:
<S2SV_ModStart> height ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 <START_BUG> void vp9_fht4x4_sse2 ( const int16_t * input, int16_t * output, <END_BUG> int stride, int tx_type ) { __m128i in [ 4 ] ; switch ( tx_type ) { case DCT_DCT :  vp9_fdct4x4_sse2 ( input, output, stride ) ; <START_BUG> break ; case ADST_DCT : load_buffer_4x4 ( input, in, stride ) ; fadst4_sse2 ( in ) ; fdct4_sse2 ( in ) ; write_buffer_4x4 ( output, in ) ; break ; case DCT_ADST : load_buffer_4x4 ( input, in, stride ) ; fdct4_sse2 ( in ) ; fadst4_sse2 ( in ) ; write_buffer_4x4 ( output, in ) ; break ; case ADST_ADST : load_buffer_4x4 ( input, in, stride ) ; fadst4_sse2 ( in ) ; fadst4_sse2 ( in ) ; write_buffer_4x4 ( output, in ) ; break ; default : assert ( 0 ) ; break ; } }<END_BUG>

Fix:
<S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> case DCT_DCT : vpx_fdct4x4_sse2 <S2SV_ModEnd> ( input,
Buggy code:
 static int set_evtchn_to_irq ( evtchn_port_t evtchn, unsigned int irq ) { unsigned row ; unsigned col ; if ( evtchn >= xen_evtchn_max_channels ( ) ) return - EINVAL ; row = EVTCHN_ROW ( evtchn ) ; col = EVTCHN_COL ( evtchn ) ; if ( evtchn_to_irq [ row ] == NULL ) { if ( irq == - 1 ) return 0 ; evtchn_to_irq [ row ] = ( int * ) get_zeroed_page ( GFP_KERNEL ) ; if ( evtchn_to_irq [ row ] == NULL ) return - ENOMEM ; clear_evtchn_to_irq_row ( row ) ; } <START_BUG> evtchn_to_irq [ row ] [ col ] = irq ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ) ; } WRITE_ONCE ( <S2SV_ModStart> [ col ], irq ) <S2SV_ModEnd> ; return 0
Buggy code:
 int mobility_print ( netdissect_options * ndo, const u_char * bp, const u_char * bp2 _U_ ) { const struct ip6_mobility * mh ; const u_char * ep ; unsigned mhlen, hlen ; uint8_t type ; mh = ( const struct ip6_mobility * ) bp ; ep = ndo -> ndo_snapend ; if (! ND_TTEST ( mh -> ip6m_len ) ) { mhlen = ep - bp ; goto trunc ; } mhlen = ( mh -> ip6m_len + 1 ) << 3 ; ND_TCHECK ( mh -> ip6m_type ) ; type = mh -> ip6m_type ; if ( type <= IP6M_MAX && mhlen < ip6m_hdrlen [ type ] ) { ND_PRINT ( ( ndo, "(header   length   %u   is   too   small   for   type   %u)", mhlen, type ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "mobility:   %s", tok2str ( ip6m_str, "type-#%u", type ) ) ) ; switch ( type ) { case IP6M_BINDING_REQUEST : hlen = IP6M_MINLEN ; break ; case IP6M_HOME_TEST_INIT : case IP6M_CAREOF_TEST_INIT : hlen = IP6M_MINLEN ; if ( ndo -> ndo_vflag ) { <START_BUG> ND_TCHECK2 ( * mh, hlen + 8 ) ; <END_BUG> ND_PRINT ( ( ndo, "   %s   Init   Cookie=%08x:%08x", type == IP6M_HOME_TEST_INIT? "Home" : "Care-of", EXTRACT_32BITS ( & bp [ hlen ] ), EXTRACT_32BITS ( & bp [ hlen + 4 ] ) ) ) ; } hlen += 8 ; break ; case IP6M_HOME_TEST : case IP6M_CAREOF_TEST : ND_TCHECK ( mh -> ip6m_data16 [ 0 ] ) ; ND_PRINT ( ( ndo, "   nonce   id=0x%

Fix:
<S2SV_ModStart> ndo_vflag ) { ND_TCHECK_32BITS ( & bp [ hlen + 4 ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> ndo_vflag ) { ND_TCHECK_32BITS ( & bp [ hlen + 4 ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> ndo_vflag ) { ND_TCHECK_32BITS ( & bp [ hlen + 4 ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> = IP6M_MINLEN ; ND_TCHECK_16BITS ( & bp [ hlen ] <S2SV_ModEnd> ) ; if <S2SV_ModStart> & 0xf0 ) { <S2SV_ModStart> ) ) ; } <S2SV_ModStart> += 1 ; ND_TCHECK_16BITS ( & bp [ hlen ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> ) ) ; ND_TCHECK <S2SV_ModEnd> ( mh -> <S2SV_ModStart> [ 1 ] ) ; if ( mh -> ip6m_data8 [ 1 ] <S2SV_ModStart> = IP6M_MINLEN ; ND_TCHECK_16BITS ( & bp [ hlen ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> += 2 ; ND_TCHECK_16BITS ( & bp [ hlen ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart>