nus-yam/ex-repair huggingface dataset:
Buggy code:
 int print_calc ( image_desc_t * im ) { long i, ii, validsteps ; double printval ; struct tm tmvdef ; int graphelement = 0 ; long vidx ; int max_ii ; double magfact = - 1 ; char * si_symb = "" ; char * percent_s ; int prline_cnt = 0 ; time_t now = time ( NULL ) ; localtime_r ( & now, & tmvdef ) ; for ( i = 0 ; i < im -> gdes_c ; i ++ ) { vidx = im -> gdes [ i ]. vidx ; switch ( im -> gdes [ i ]. gf ) { case GF_PRINT : case GF_GPRINT : if ( im -> gdes [ vidx ]. gf == GF_VDEF ) { printval = im -> gdes [ vidx ]. vf. val ; localtime_r ( & im -> gdes [ vidx ]. vf. when, & tmvdef ) ; } else { max_ii = ( ( im -> gdes [ vidx ]. end - im -> gdes [ vidx ]. start ) // im -> gdes [ vidx ]. step * im -> gdes [ vidx ]. ds_cnt ) ; printval = DNAN ; validsteps = 0 ; for ( ii = im -> gdes [ vidx ]. ds ; ii < max_ii ; ii += im -> gdes [ vidx ]. ds_cnt ) { if (! finite ( im -> gdes [ vidx ]. data [ ii ] ) ) continue ; if ( isnan ( printval ) ) { printval = im -> gdes [ vidx ]. data [ ii ] ; validsteps ++ ; continue ; } switch ( im -> gdes [ i ]. cf ) { case CF_HWPREDICT : case CF_MHWPREDICT : case CF_DEVPREDICT : case CF_DEVSEASONAL : case CF_SEASONAL : case CF_AVERAGE : validsteps ++ ; printval += im -> gdes [ vidx ]. data [ ii ] ; break ; case CF_MINIMUM : printval = min ( printval, im -> gdes [ vidx ]. data [ ii ] ) ; break ; case CF_FAILURES : case CF_MAX

Fix:
<S2SV_ModStart> else if ( bad_format_print <S2SV_ModEnd> ( im -> <S2SV_ModStart> ) ) { <S2SV_ModEnd> return - 1 <S2SV_ModStart> { if ( bad_format_print <S2SV_ModEnd> ( im -> <S2SV_ModStart> ) ) { <S2SV_ModEnd> return - 1
Buggy code:
 bool bt_att_cancel ( struct bt_att * att, unsigned int id ) { const struct queue_entry * entry ; struct att_send_op * op ; if (! att ||! id ) return false ; for ( entry = queue_get_entries ( att -> chans ) ; entry ; entry = entry -> next ) { struct bt_att_chan * chan = entry -> data ; if ( bt_att_chan_cancel ( chan, id ) ) return true ; } <START_BUG> op = queue_remove_if ( att -> req_queue, match_op_id, UINT_TO_PTR ( id ) ) ; <END_BUG> if ( op ) goto done ; op = queue_remove_if ( att -> ind_queue, match_op_id, UINT_TO_PTR ( id ) ) ; if ( op ) goto done ; op = queue_remove_if ( att -> write_queue, match_op_id, UINT_TO_PTR ( id ) ) ; if ( op ) goto done ; if (! op ) return false ; done : destroy_att_send_op ( op ) ; wakeup_writer ( att ) ; return true ; }

Fix:
<S2SV_ModStart> true ; } if ( att -> in_disc ) return bt_att_disc_cancel ( att, id ) ;
Buggy code:
 static void dispatch_cmd ( conn c ) { int r, i, timeout = - 1 ; size_t z ; unsigned int count ; job j ; unsigned char type ; char * size_buf, * delay_buf, * ttr_buf, * pri_buf, * end_buf, * name ; unsigned int pri, body_size ; usec delay, ttr ; uint64_t id ; tube t = NULL ; c -> cmd [ c -> cmd_len - 2 ] = '\\0' ; if ( strlen ( c -> cmd )!= c -> cmd_len - 2 ) { return reply_msg ( c, MSG_BAD_FORMAT ) ; } type = which_cmd ( c ) ; dprintf ( "got   %s   command:   \\"%s\\"\\n", op_names [ ( int ) type ], c -> cmd ) ; switch ( type ) { case OP_PUT : r = read_pri ( & pri, c -> cmd + 4, & delay_buf ) ; if ( r ) return reply_msg ( c, MSG_BAD_FORMAT ) ; r = read_delay ( & delay, delay_buf, & ttr_buf ) ; if ( r ) return reply_msg ( c, MSG_BAD_FORMAT ) ; r = read_ttr ( & ttr, ttr_buf, & size_buf ) ; if ( r ) return reply_msg ( c, MSG_BAD_FORMAT ) ; errno = 0 ; body_size = strtoul ( size_buf, & end_buf, 10 ) ; if ( errno ) return reply_msg ( c, MSG_BAD_FORMAT ) ; if ( body_size > job_data_size_limit ) { <START_BUG> return reply_msg ( c, MSG_JOB_TOO_BIG ) ; <END_BUG> } if ( end_buf [ 0 ]!= '\\0' ) return reply_msg ( c, MSG_BAD_FORMAT ) ; conn_set_producer ( c ) ; c -> in_job = make_job ( pri, delay, ttr? : 1, body_size + 2, c -> use ) ; if (! c -> in_job ) { twarnx ( "server   error:   " MSG_OUT_OF_MEMORY ) ; return skip ( c, body_size + 2, MSG_OUT_OF_MEMORY

Fix:
<S2SV_ModStart> ) { return skip ( c, body_size + 2 <S2SV_ModEnd>, MSG_JOB_TOO_BIG )
Buggy code:
 static vpx_codec_err_t ctrl_set_previewpp ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> # if CONFIG_VP9_POSTPROC  vp8_postproc_cfg_t * config = va_arg ( args, vp8_postproc_cfg_t * ) ; <START_BUG> ( void ) ctr_id ; if ( config!= NULL ) { ctx -> preview_ppcfg = * config ; return VPX_CODEC_OK ; } else { return VPX_CODEC_INVALID_PARAM ; } # else ( void ) ctx ; <END_BUG> ( void ) ctr_id ;  ( void ) args ; return VPX_CODEC_INCAPABLE ; # endif }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> vp8_postproc_cfg_t * ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( void ) <S2SV_ModEnd> args ; return
Buggy code:
 int yyparse ( void ) # else int yyparse ( ) # endif # endif { int yystate ; int yyerrstatus ; yytype_int16 yyssa [ YYINITDEPTH ] ; yytype_int16 * yyss ; yytype_int16 * yyssp ; YYSTYPE yyvsa [ YYINITDEPTH ] ; YYSTYPE * yyvs ; YYSTYPE * yyvsp ; YYSIZE_T yystacksize ; int yyn ; int yyresult ; int yytoken ; YYSTYPE yyval ; # if YYERROR_VERBOSE char yymsgbuf [ 128 ] ; char * yymsg = yymsgbuf ; YYSIZE_T yymsg_alloc = sizeof yymsgbuf ; # endif # define YYPOPSTACK ( N ) ( yyvsp -= ( N ), yyssp -= ( N ) ) int yylen = 0 ; yytoken = 0 ; yyss = yyssa ; yyvs = yyvsa ; yystacksize = YYINITDEPTH ; YYDPRINTF ( ( stderr, "Starting   parse\\n" ) ) ; yystate = 0 ; yyerrstatus = 0 ; yynerrs = 0 ; yychar = YYEMPTY ; yyssp = yyss ; yyvsp = yyvs ; goto yysetstate ; yynewstate : yyssp ++ ; yysetstate : * yyssp = yystate ; if ( yyss + yystacksize - 1 <= yyssp ) { YYSIZE_T yysize = yyssp - yyss + 1 ; # ifdef yyoverflow { YYSTYPE * yyvs1 = yyvs ; yytype_int16 * yyss1 = yyss ; yyoverflow ( YY_ ( "memory   exhausted" ), & yyss1, yysize * sizeof ( * yyssp ), & yyvs1, yysize * sizeof ( * yyvsp ), & yystacksize ) ; yyss = yyss1 ; yyvs = yyvs1 ; } # else # ifndef YYSTACK_RELOCATE goto yyexhaustedlab ; # else if ( YYMAXDEPTH <= yystacksize ) goto yyexhaustedlab ; yystacksize *= 2 ; if ( YYMAXDEPTH < yystacksize ) yystacksize = YYMAXDEPTH ; { yytype_int16 *

Fix:
<S2SV_ModStart> { char prefix <S2SV_ModEnd> ; char * <S2SV_ModStart> char * type ; switch ( <S2SV_ModEnd> ( yyvsp [ <S2SV_ModStart>. String ) [ 0 ] ) { case '+' : case '-' : case '=' : prefix = ( yyvsp [ ( 1 ) - ( 1 ) ]. String ) [ 0 ] ; type = ( yyvsp [ ( 1 ) - ( 1 ) ]. String ) <S2SV_ModStart> + 1 ; break ; default : prefix = '=' ; type = ( yyvsp [ ( 1 ) - ( 1 ) ]. String ) ; } ( yyval. Attr_val ) = create_attr_sval ( prefix, estrdup ( type ) ) ; YYFREE ( ( yyvsp [ ( 1 ) - ( 1 ) ]. String ) ) ; } break ; case 216 : # line 1022 "ntp_parser.y" { enqueue ( cfgt. nic_rules, create_nic_rule_node ( ( yyvsp [ ( 3 ) - ( 3 ) ]. Integer ), NULL, ( yyvsp [ ( 2 ) - ( 3 ) ]. Integer ) ) ) ; } break ; case 217 : # line 1027 "ntp_parser.y" {
Buggy code:
 static int scm_fp_copy ( struct cmsghdr * cmsg, struct scm_fp_list * * fplp ) { int * fdp = ( int * ) CMSG_DATA ( cmsg ) ; struct scm_fp_list * fpl = * fplp ; struct file * * fpp ; int i, num ; num = ( cmsg -> cmsg_len - CMSG_ALIGN ( sizeof ( struct cmsghdr ) ) ) // sizeof ( int ) ; if ( num <= 0 ) return 0 ; if ( num > SCM_MAX_FD ) return - EINVAL ; if (! fpl ) { fpl = kmalloc ( sizeof ( struct scm_fp_list ), GFP_KERNEL ) ; if (! fpl ) return - ENOMEM ; * fplp = fpl ; fpl -> count = 0 ; fpl -> max = SCM_MAX_FD ; <START_BUG> } <END_BUG> fpp = & fpl -> fp [ fpl -> count ] ; if ( fpl -> count + num > fpl -> max ) return - EINVAL ; for ( i = 0 ; i < num ; i ++ ) { int fd = fdp [ i ] ; struct file * file ; if ( fd < 0 ||! ( file = fget_raw ( fd ) ) ) return - EBADF ; * fpp ++ = file ; fpl -> count ++ ; }  return num ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> = SCM_MAX_FD ; fpl -> user = NULL ; <S2SV_ModStart> ++ ; } if (! fpl -> user ) fpl -> user = get_uid ( current_user ( ) ) ;
Buggy code:
 int vp9_prob_diff_update_savings_search ( const unsigned int * ct, <START_BUG> vp9_prob oldp, vp9_prob * bestp, <END_BUG>  vp9_prob upd ) { <START_BUG> const int old_b = cost_branch256 ( ct, oldp ) ; int bestsavings = 0 ; <END_BUG> vp9_prob newp, bestnewp = oldp ;  const int step = * bestp > oldp? - 1 : 1 ; for ( newp = * bestp ; newp!= oldp ; newp += step ) { const int new_b = cost_branch256 ( ct, newp ) ; const int update_b = prob_diff_update_cost ( newp, oldp ) + vp9_cost_upd256 ; const int savings = old_b - new_b - update_b ; if ( savings > bestsavings ) { bestsavings = savings ; bestnewp = newp ; } } * bestp = bestnewp ; return bestsavings ; }

Fix:
<S2SV_ModStart> * ct, vpx_prob oldp, vpx_prob <S2SV_ModEnd> * bestp, <S2SV_ModStart> * bestp, vpx_prob <S2SV_ModEnd> upd ) { <S2SV_ModStart> = 0 ; vpx_prob <S2SV_ModEnd> newp, bestnewp
Buggy code:
 static int _hostsock_getsockname ( oe_fd_t * sock_, struct oe_sockaddr * addr, oe_socklen_t * addrlen ) { int ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_socklen_t addrlen_in = 0 ; <START_BUG> oe_errno = 0 ; <END_BUG>  if (! sock ) <START_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; <END_BUG> if ( addrlen )  addrlen_in = * addrlen ; if ( oe_syscall_getsockname_ocall ( & ret, sock -> host_fd, <START_BUG> ( struct oe_sockaddr * ) addr, <END_BUG> addrlen_in,  addrlen )!= OE_OK ) <START_BUG> { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <END_BUG> done :  return ret ; }

Fix:
<S2SV_ModStart> = 0 ; oe_socklen_t addrlen_out = 0 ; <S2SV_ModStart> (! sock ||! addr ||! addrlen ) OE_RAISE_ERRNO ( OE_EINVAL ) ; addrlen_in = * addrlen ; if ( addrlen_in < 0 <S2SV_ModStart> ; if ( <S2SV_ModEnd> oe_syscall_getsockname_ocall ( & <S2SV_ModStart> -> host_fd, <S2SV_ModEnd> addr, addrlen_in <S2SV_ModStart>, addrlen_in, & addrlen_out <S2SV_ModEnd> )!= OE_OK <S2SV_ModStart> ) ; } if ( addrlen_out > sizeof ( struct oe_sockaddr_storage ) ) OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( addrlen_in >= addrlen_out ) * addrlen = addrlen_out ;
Buggy code:
 int pdf_is_pdf ( FILE * fp ) { <START_BUG> int is_pdf ; <END_BUG> char * header ;  header = get_header ( fp ) ; <START_BUG> <END_BUG> if ( header && strstr ( header, "%PDF-" ) )  is_pdf = 1 ; else is_pdf = 0 ; free ( header ) ; return is_pdf ; }

Fix:
<S2SV_ModStart> fp ) { <S2SV_ModEnd> char * header <S2SV_ModStart> * header ; if (! ( <S2SV_ModStart> ( fp ) ) ) return 0 ; const char * c = <S2SV_ModEnd> strstr ( header <S2SV_ModStart>, "%PDF-" ) ; const int is_pdf = c && ( ( c - header + strlen ( "%PDF-M.m" ) ) < 1024 ) <S2SV_ModEnd> ; free (
Buggy code:
 void jas_matrix_asl ( jas_matrix_t * matrix, int n ) { <START_BUG> int i ; <END_BUG> int j ; jas_seqent_t * rowstart ;  int rowstep ; <START_BUG> jas_seqent_t * data ; if ( jas_matrix_numrows ( matrix ) > 0 && jas_matrix_numcols ( matrix ) > 0 ) { assert ( matrix -> rows_ ) ; rowstep = jas_matrix_rowstep ( matrix ) ; for ( i = matrix -> numrows_, rowstart = matrix -> rows_ [ 0 ] ; i > 0 ; -- i, rowstart += rowstep ) { for ( j = matrix -> numcols_, data = rowstart ; j > 0 ; -- j, ++ data ) { * data = jas_seqent_asl ( * data, n ) ; } } } }<END_BUG>

Fix:
<S2SV_ModStart> n ) { jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; jas_seqent_t <S2SV_ModStart> * rowstart ; jas_matind_t <S2SV_ModEnd> rowstep ; jas_seqent_t
Buggy code:
 struct dentry * debugfs_rename ( struct dentry * old_dir, struct dentry * old_dentry, struct dentry * new_dir, const char * new_name ) { int error ; struct dentry * dentry = NULL, * trap ; <START_BUG> const char * old_name ; <END_BUG> trap = lock_rename ( new_dir, old_dir ) ; if ( d_really_is_negative ( old_dir ) || d_really_is_negative ( new_dir ) ) goto exit ; if ( d_really_is_negative ( old_dentry ) || old_dentry == trap || d_mountpoint ( old_dentry ) ) goto exit ; dentry = lookup_one_len ( new_name, new_dir, strlen ( new_name ) ) ; if ( IS_ERR ( dentry ) || dentry == trap || d_really_is_positive ( dentry ) ) goto exit ;  old_name = fsnotify_oldname_init ( old_dentry -> d_name. name ) ; <START_BUG> error = simple_rename ( d_inode ( old_dir ), old_dentry, d_inode ( new_dir ), dentry, 0 ) ; if ( error ) { fsnotify_oldname_free ( old_name ) ; goto exit ; } d_move ( old_dentry, dentry ) ; fsnotify_move ( d_inode ( old_dir ), d_inode ( new_dir ), old_name, d_is_dir ( old_dentry ), NULL, old_dentry ) ; <END_BUG> fsnotify_oldname_free ( old_name ) ;  unlock_rename ( new_dir, old_dir ) ; dput ( dentry ) ; return old_dentry ; exit : if ( dentry &&! IS_ERR ( dentry ) ) dput ( dentry ) ; unlock_rename ( new_dir, old_dir ) ; return NULL ; }

Fix:
<S2SV_ModStart> * trap ; struct name_snapshot <S2SV_ModEnd> old_name ; trap <S2SV_ModStart> goto exit ; take_dentry_name_snapshot ( & old_name, old_dentry ) ; error = simple_rename ( d_inode ( old_dir ), old_dentry, d_inode ( new_dir ), dentry, 0 ) ; if ( error ) { release_dentry_name_snapshot ( & old_name ) ; goto exit ; } d_move ( old_dentry, dentry ) ; fsnotify_move ( d_inode ( old_dir ), d_inode ( new_dir ), old_name. name <S2SV_ModEnd>, d_is_dir ( <S2SV_ModStart> old_dentry ) ; release_dentry_name_snapshot ( & <S2SV_ModEnd> old_name ) ;
Buggy code:
 static void l2tp_avp_print ( netdissect_options * ndo, const u_char * dat, int length ) { u_int len ; const uint16_t * ptr = ( const uint16_t * ) dat ; uint16_t attr_type ; int hidden = FALSE ; if ( length <= 0 ) { return ; } ND_PRINT ( ( ndo, "   " ) ) ; ND_TCHECK ( * ptr ) ; len = EXTRACT_16BITS ( ptr ) & L2TP_AVP_HDR_LEN_MASK ; if ( len < 6 ) goto trunc ; if ( len > ( u_int ) length ) goto trunc ; ND_TCHECK2 ( * ptr, len ) ; if ( EXTRACT_16BITS ( ptr ) & L2TP_AVP_HDR_FLAG_MANDATORY ) { ND_PRINT ( ( ndo, "*" ) ) ; } if ( EXTRACT_16BITS ( ptr ) & L2TP_AVP_HDR_FLAG_HIDDEN ) { hidden = TRUE ; ND_PRINT ( ( ndo, "?" ) ) ; } ptr ++ ; if ( EXTRACT_16BITS ( ptr ) ) { ND_PRINT ( ( ndo, "VENDOR%04x:", EXTRACT_16BITS ( ptr ) ) ) ; ptr ++ ; ND_PRINT ( ( ndo, "ATTR%04x", EXTRACT_16BITS ( ptr ) ) ) ; ptr ++ ; ND_PRINT ( ( ndo, "(" ) ) ; print_octets ( ndo, ( const u_char * ) ptr, len - 6 ) ; ND_PRINT ( ( ndo, ")" ) ) ; } else { ptr ++ ; attr_type = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "%s", tok2str ( l2tp_avp2str, "AVP-#%u", attr_type ) ) ) ; ND_PRINT ( ( ndo, "(" ) ) ; if ( hidden ) { ND_PRINT ( ( ndo, "???" ) ) ; } else { switch ( attr_type ) { case L2TP_AVP_MSGTYPE : <START_BUG> l2tp_msgtype_print ( ndo, (<END_BUG>

Fix:
<S2SV_ModStart> * ) ptr, len - 6 <S2SV_ModStart> ndo, ptr, len - 6 <S2SV_ModStart> * ) ptr, len - 6 <S2SV_ModStart> * ) ptr, len - 6 <S2SV_ModStart> case L2TP_AVP_TIE_BREAKER : if ( len - 6 < 8 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; break ; } <S2SV_ModStart> case L2TP_AVP_ASSND_SESS_ID : if ( len - 6 < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; break ; } <S2SV_ModStart> case L2TP_AVP_CHALLENGE_RESP : if ( len - 6 < 16 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; break ; } <S2SV_ModStart> case L2TP_AVP_RX_CONN_SPEED : if ( len - 6 < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; break ; } <S2SV_ModStart> * ) ptr, len - 6 <S2SV_ModStart> * ) ptr, len - 6 <S2SV_ModStart> * ) ptr, len - 6 <S2SV_ModStart> * )
Buggy code:
 error_t ksz8851UpdateMacAddrFilter ( NetInterface * interface ) { uint_t i ; uint_t k ; uint32_t crc ; uint16_t hashTable [ 4 ] ; MacFilterEntry * entry ; TRACE_DEBUG ( "Updating   MAC   filter...\\r\\n" ) ; osMemset ( hashTable, 0, sizeof ( hashTable ) ) ; for ( i = 0 ; i < MAC_ADDR_FILTER_SIZE ; i ++ ) { entry = & interface -> macAddrFilter [ i ] ; if ( entry -> refCount > 0 ) { crc = ksz8851CalcCrc ( & entry -> addr, sizeof ( MacAddr ) ) ; k = ( crc >> 26 ) & 0x3F ; hashTable [ k // 16 ] |= ( 1 << ( k % 16 ) ) ; } } <START_BUG> ksz8851WriteReg ( interface, KSZ8851_REG_MAHTR0, hashTable [ 0 ] ) ; <END_BUG> ksz8851WriteReg ( interface, KSZ8851_REG_MAHTR1, hashTable [ 1 ] ) ;  ksz8851WriteReg ( interface, KSZ8851_REG_MAHTR2, hashTable [ 2 ] ) ; <START_BUG> <END_BUG> ksz8851WriteReg ( interface, KSZ8851_REG_MAHTR3, hashTable [ 3 ] ) ;  <START_BUG> TRACE_DEBUG ( "     MAHTR0   =   %04" PRIX16 "\\r\\n", ksz8851ReadReg ( interface, KSZ8851_REG_MAHTR0 ) ) ; <END_BUG>  TRACE_DEBUG ( "     MAHTR1   =   %04" PRIX16 "\\r\\n", ksz8851ReadReg ( interface, KSZ8851_REG_MAHTR1 ) ) ; <START_BUG> <END_BUG> TRACE_DEBUG ( "     MAHTR2   =   %04" PRIX16 "\\r\\n", ksz8851ReadReg ( interface, KSZ8851_REG_MAHTR2 ) ) ;  <START_BUG> TRACE_DEBUG ( "     MAHTR3   =   %04" PRIX16 "\\r\\n", ksz8851ReadReg ( interface, KSZ8851_REG_MAHTR3 ) ) ; <END_BUG> return NO_

Fix:
<S2SV_ModStart> ( interface, KSZ8851_MAHTR0, hashTable [ 0 ] ) ; ksz8851WriteReg ( interface, KSZ8851_MAHTR1 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, KSZ8851_MAHTR2 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, KSZ8851_MAHTR3 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, KSZ8851_MAHTR0 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, KSZ8851_MAHTR1 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, KSZ8851_MAHTR2 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, KSZ8851_MAHTR3 <S2SV_ModEnd> ) ) ;
Buggy code:
 static int pb0100_start ( struct sd * sd ) { int err, packet_size, max_packet_size ; struct usb_host_interface * alt ; struct usb_interface * intf ; struct gspca_dev * gspca_dev = ( struct gspca_dev * ) sd ; struct cam * cam = & sd -> gspca_dev. cam ; u32 mode = cam -> cam_mode [ sd -> gspca_dev. curr_mode ]. priv ; intf = usb_ifnum_to_if ( sd -> gspca_dev. dev, sd -> gspca_dev. iface ) ; alt = usb_altnum_to_altsetting ( intf, sd -> gspca_dev. alt ) ; <START_BUG> if (! alt ) <END_BUG> return - ENODEV ; packet_size = le16_to_cpu ( alt -> endpoint [ 0 ]. desc. wMaxPacketSize ) ; max_packet_size = sd -> sensor -> max_packet_size [ sd -> gspca_dev. curr_mode ] ; if ( packet_size < max_packet_size ) stv06xx_write_sensor ( sd, PB_ROWSPEED, BIT ( 4 ) | BIT ( 3 ) | BIT ( 1 ) ) ; else stv06xx_write_sensor ( sd, PB_ROWSPEED, BIT ( 5 ) | BIT ( 3 ) | BIT ( 1 ) ) ; if ( mode & PB0100_CROP_TO_VGA ) { stv06xx_write_sensor ( sd, PB_RSTART, 30 ) ; stv06xx_write_sensor ( sd, PB_CSTART, 20 ) ; stv06xx_write_sensor ( sd, PB_RWSIZE, 240 - 1 ) ; stv06xx_write_sensor ( sd, PB_CWSIZE, 320 - 1 ) ; } else { stv06xx_write_sensor ( sd, PB_RSTART, 8 ) ; stv06xx_write_sensor ( sd, PB_CSTART, 4 ) ; stv06xx_write_sensor ( sd, PB_RWSIZE, 288 - 1 ) ; stv06xx_write_sensor ( sd, PB_CWSIZE, 352 - 1 ) ; } if ( mode & PB0100_SUB

Fix:
<S2SV_ModStart> (! alt ) return - ENODEV ; if ( alt -> desc. bNumEndpoints < 1
Buggy code:
 static void urlParsePostBody ( struct URL * url, const struct HttpConnection * http, const char * buf, int len ) { struct HashMap contentType ; initHashMap ( & contentType, urlDestroyHashMapEntry, NULL ) ; const char * ctHeader = getFromHashMap ( & http -> header, "content-type" ) ; urlParseHeaderLine ( & contentType, ctHeader, ctHeader? strlen ( ctHeader ) : 0 ) ; if ( getRefFromHashMap ( & contentType, "application//x-www-form-urlencoded" ) ) { urlParseQueryString ( & url -> args, buf, len ) ; } else if ( getRefFromHashMap ( & contentType, "multipart//form-data" ) ) { const char * boundary = getFromHashMap ( & contentType, "boundary" ) ; if ( boundary && * boundary ) { const char * lastPart = NULL ; for ( const char * part = buf ; len > 0 ; ) { const char * ptr ; if ( ( part == buf && ( ptr = urlMemstr ( part, len, "--" ) )!= NULL ) || ( ptr = urlMemstr ( part, len, "\\r\\n--" ) )!= NULL ) { len -= ptr - part + ( part == buf? 2 : 4 ) ; part = ptr + ( part == buf? 2 : 4 ) ; if (! urlMemcmp ( part, len, boundary ) ) { int i = strlen ( boundary ) ; len -= i ; part += i ; if (! urlMemcmp ( part, len, "\\r\\n" ) ) { len -= 2 ; part += 2 ; if ( lastPart ) { urlParsePart ( url, lastPart, ptr - lastPart ) ; } else { if ( ptr!= buf ) { info ( "[http]   Ignoring   prologue   before   \\"multipart//form-data\\"!" ) ; } } lastPart = part ; } else if (! urlMemcmp ( part, len, "--\\r\\n" ) ) { len -= 4 ; part += 4 ; urlParsePart ( url, lastPart, ptr - lastPart ) ; lastPart = NULL ; if ( len > 0 ) { info ( "[http]   Ignoring   epilogue   past   end   of   \\"multipart//" "form-data\\"!" ) ; } } } } <START_BUG> } <END_BUG> if ( lastPart ) {  warn ( "[http]  

Fix:
<S2SV_ModStart> } } } else <S2SV_ModEnd> { warn ( <S2SV_ModStart> { warn ( "[http] <S2SV_blank> Ignorning <S2SV_blank> broken <S2SV_blank> multipart//form-data" ) ; break ; } } if ( lastPart ) { warn (
Buggy code:
 static int install_process_keyring ( void ) { struct cred * new ; int ret ; new = prepare_creds ( ) ; if (! new ) return - ENOMEM ; ret = install_process_keyring_to_cred ( new ) ; if ( ret < 0 ) { abort_creds ( new ) ; <START_BUG> return ret!= - EEXIST? ret : 0 ; <END_BUG> } return commit_creds ( new ) ; }

Fix:
<S2SV_ModStart> ; return ret <S2SV_ModEnd> ; } return
Buggy code:
 struct sctp_chunk * sctp_process_asconf ( struct sctp_association * asoc, struct sctp_chunk * asconf ) { <START_BUG> sctp_addiphdr_t * hdr ; <END_BUG> union sctp_addr_param * addr_param ; sctp_addip_param_t * asconf_param ; struct sctp_chunk * asconf_ack ; __be16 err_code ; int length = 0 ; int chunk_len ; __u32 serial ;  int all_param_pass = 1 ; <START_BUG> chunk_len = ntohs ( asconf -> chunk_hdr -> length ) - sizeof ( sctp_chunkhdr_t ) ; hdr = ( sctp_addiphdr_t * ) asconf -> skb -> data ; serial = ntohl ( hdr -> serial ) ; length = sizeof ( sctp_addiphdr_t ) ; addr_param = ( union sctp_addr_param * ) ( asconf -> skb -> data + length ) ; chunk_len -= length ; length = ntohs ( addr_param -> p. length ) ; asconf_param = ( void * ) addr_param + length ; chunk_len -= length ; asconf_ack = sctp_make_asconf_ack ( asoc, serial, chunk_len * 4 ) ; if (! asconf_ack ) goto done ; <END_BUG> while ( chunk_len > 0 ) {  err_code = sctp_process_asconf_param ( asoc, asconf, <START_BUG> asconf_param ) ; <END_BUG> if ( SCTP_ERROR_NO_ERROR!= err_code )  all_param_pass = 0 ; <START_BUG> if (! all_param_pass ) sctp_add_asconf_response ( asconf_ack, <END_BUG> asconf_param -> crr_id, err_code,  asconf_param ) ; if ( SCTP_ERROR_RSRC_LOW == err_code ) goto done ; <START_BUG> length = ntohs ( asconf_param -> param_hdr. length ) ; <END_BUG> asconf_param = ( void * ) asconf_param + length ; chunk_len -= length ; } done : asoc -> peer. addip_serial ++ ; if ( asconf_ack ) { sctp_chunk_hold ( asconf_ack

Fix:
<S2SV_ModStart> asconf ) { sctp_addip_chunk_t * addip = ( sctp_addip_chunk_t * ) asconf -> chunk_hdr ; bool all_param_pass = true ; union sctp_params param ; <S2SV_ModStart> __u32 serial ; <S2SV_ModEnd> chunk_len = ntohs <S2SV_ModStart> goto done ; sctp_walk_params ( param, addip, addip_hdr. params ) { if ( param. p -> type == SCTP_PARAM_IPV4_ADDRESS || param. p -> type == SCTP_PARAM_IPV6_ADDRESS ) continue ; <S2SV_ModEnd> err_code = sctp_process_asconf_param <S2SV_ModStart>, asconf, param. addip ) ; if ( err_code!= SCTP_ERROR_NO_ERROR <S2SV_ModEnd> ) all_param_pass = <S2SV_ModStart> ) all_param_pass = false <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( asconf_ack, param. addip <S2SV_ModEnd> -> crr_id, <S2SV_ModStart> -> crr_id, err_code, param. addip ) ; if ( err_code == SCTP_ERROR_RSRC_LOW <S2SV_ModEnd> ) goto done <S2SV_ModStart> goto done ; <S2SV_ModEnd> } done
Buggy code:
 static inline int xfrm_replay_verify_len ( struct xfrm_replay_state_esn * replay_esn, struct nlattr * rp ) { struct xfrm_replay_state_esn * up ; int ulen ; if (! replay_esn ||! rp ) return 0 ; up = nla_data ( rp ) ; ulen = xfrm_replay_state_esn_len ( up ) ; <START_BUG> if ( nla_len ( rp ) < ulen || xfrm_replay_state_esn_len ( replay_esn )!= ulen ) <END_BUG> return - EINVAL ; if ( up -> replay_window > up -> bmp_len * sizeof ( __u32 ) * 8 ) return - EINVAL ; return 0 ; }

Fix:
<S2SV_ModStart> )!= ulen || replay_esn -> bmp_len!= up -> bmp_len
Buggy code:
 static av_cold int rl2_read_header ( AVFormatContext * s ) { AVIOContext * pb = s -> pb ; AVStream * st ; unsigned int frame_count ; unsigned int audio_frame_counter = 0 ; unsigned int video_frame_counter = 0 ; unsigned int back_size ; unsigned short sound_rate ; unsigned short rate ; unsigned short channels ; unsigned short def_sound_size ; unsigned int signature ; unsigned int pts_den = 11025 ; unsigned int pts_num = 1103 ; unsigned int * chunk_offset = NULL ; int * chunk_size = NULL ; int * audio_size = NULL ; int i ; int ret = 0 ; avio_skip ( pb, 4 ) ; back_size = avio_rl32 ( pb ) ; signature = avio_rb32 ( pb ) ; avio_skip ( pb, 4 ) ; frame_count = avio_rl32 ( pb ) ; if ( back_size > INT_MAX // 2 || frame_count > INT_MAX // sizeof ( uint32_t ) ) return AVERROR_INVALIDDATA ; avio_skip ( pb, 2 ) ; sound_rate = avio_rl16 ( pb ) ; rate = avio_rl16 ( pb ) ; channels = avio_rl16 ( pb ) ; def_sound_size = avio_rl16 ( pb ) ; st = avformat_new_stream ( s, NULL ) ; if (! st ) return AVERROR ( ENOMEM ) ; st -> codecpar -> codec_type = AVMEDIA_TYPE_VIDEO ; st -> codecpar -> codec_id = AV_CODEC_ID_RL2 ; st -> codecpar -> codec_tag = 0 ; st -> codecpar -> width = 320 ; st -> codecpar -> height = 200 ; st -> codecpar -> extradata_size = EXTRADATA1_SIZE ; if ( signature == RLV3_TAG && back_size > 0 ) st -> codecpar -> extradata_size += back_size ; if ( ff_get_extradata ( s, st -> codecpar, pb, st -> codecpar -> extradata_size ) < 0 ) return AVERROR ( ENOMEM ) ; if ( sound_rate ) { if (!

Fix:
<S2SV_ModStart> i ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> pb ) ; } <S2SV_ModStart> i ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> pb ) ; } <S2SV_ModStart> i ++ ) { if ( avio_feof ( pb ) ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> & 0xFFFF ; }
Buggy code:
 <START_BUG> static void buffer_pipe_buf_get ( struct pipe_inode_info * pipe, <END_BUG> struct pipe_buffer * buf ) { struct buffer_ref * ref = ( struct buffer_ref * ) buf -> private ;  ref -> ref ++ ; <START_BUG> <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static bool <S2SV_ModEnd> buffer_pipe_buf_get ( struct <S2SV_ModStart> -> private ; if ( ref -> ref > INT_MAX // 2 ) return false ; <S2SV_ModStart> ref ++ ; return true ;
Buggy code:
 <START_BUG> static void encode_sb ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> TOKENEXTRA * * tp, int mi_row, int mi_col,  int output_enabled, BLOCK_SIZE bsize ) { <START_BUG> VP9_COMMON * const cm = & cpi -> common ; <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  MACROBLOCKD * const xd = & x -> e_mbd ; <START_BUG> const int bsl = b_width_log2 ( bsize ), hbs = ( 1 << bsl ) // 4 ; <END_BUG> int ctx ; PARTITION_TYPE partition ;  BLOCK_SIZE subsize ; <START_BUG> if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; if ( bsize >= BLOCK_8X8 ) { ctx = partition_plane_context ( xd, mi_row, mi_col, bsize ) ; <END_BUG> subsize = * get_sb_partitioning ( x, bsize ) ;  } else { ctx = 0 ; subsize = BLOCK_4X4 ; } <START_BUG> partition = partition_lookup [ bsl ] [ subsize ] ; <END_BUG> switch ( partition ) { case PARTITION_NONE :  if ( output_enabled && bsize >= BLOCK_8X8 ) <START_BUG> cm -> counts. partition [ ctx ] [ PARTITION_NONE ] ++ ; <END_BUG> encode_b ( cpi, tile, tp, mi_row, mi_col, output_enabled, subsize ) ;  break ; case PARTITION_VERT : <START_BUG> if ( output_enabled ) <END_BUG> cm -> counts. partition [ ctx ] [ PARTITION_VERT ] ++ ; * get_sb_index ( x, subsize ) = 0 ; encode_b ( cpi, tile, tp, mi_row, mi_col, output_enabled, subsize ) ;  if ( mi_col + hbs < cm -> mi_cols ) { <START_BUG> * get_sb_index ( x, subsize ) = 1 ; encode_b ( cpi, tile, tp, mi_row, mi_col + hbs, output_enabled, subsize ) ; } break ; case PARTITION_HORZ : <END_BUG> if ( output_enabled )  cm -> counts. partition [ ctx ] [ PARTITION_HORZ ] ++ ; * get

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, <S2SV_ModStart>, BLOCK_SIZE bsize, PC_TREE * pc_tree <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> int bsl = b_width_log2_lookup [ bsize ] <S2SV_ModEnd>, hbs = <S2SV_ModStart> ; BLOCK_SIZE subsize = bsize <S2SV_ModStart> ; subsize = get_subsize ( bsize, pc_tree -> partitioning <S2SV_ModEnd> ) ; } <S2SV_ModStart> [ subsize ] ; if ( output_enabled && bsize!= BLOCK_4X4 ) td -> counts -> partition [ ctx ] [ partition ] ++ <S2SV_ModStart> case PARTITION_NONE : <S2SV_ModEnd> encode_b ( cpi <S2SV_ModStart>, tile, td, tp, mi_row, mi_col, output_enabled, subsize, & pc_tree -> none <S2SV_ModEnd> ) ; break <S2SV_ModStart> case PARTITION_VERT : encode_b ( cpi, tile, td, tp, mi_row, mi_col, output_enabled, subsize, & pc_tree -> vertical [ 0 ] <S2SV_ModEnd> ) ; if <S2SV_ModStart> cm -> mi_cols && bsize > BLOCK_8X8 ) { encode_b ( cpi, tile, td, tp, mi_row, mi_col
Buggy code:
 int X509_cmp_time ( const ASN1_TIME * ctm, time_t * cmp_time ) { char * str ; ASN1_TIME atm ; long offset ; char buff1 [ 24 ], buff2 [ 24 ], * p ; <START_BUG> int i, j ; <END_BUG> p = buff1 ;  i = ctm -> length ; <START_BUG> str = ( char * ) ctm -> data ; if ( ctm -> type == V_ASN1_UTCTIME ) { <END_BUG> if ( ( i < 11 ) || ( i > 17 ) )  return 0 ; memcpy ( p, str, 10 ) ; p += 10 ; str += 10 ; <START_BUG> } else { <END_BUG>  if ( i < 13 ) <START_BUG> return 0 ; memcpy ( p, str, 12 ) ; p += 12 ; str += 12 ; <END_BUG> }  if ( ( * str == 'Z' ) || ( * str == '-' ) || ( * str == '+' ) ) { * ( p ++ ) = '0' ; * ( p ++ ) = '0' ; } else { <START_BUG> * ( p ++ ) = * ( str ++ ) ; <END_BUG> * ( p ++ ) = * ( str ++ ) ; if ( * str == '.' ) { str ++ ;  while ( ( * str >= '0' ) && ( * str <= '9' ) ) <START_BUG> str ++ ; } } * ( p ++ ) = 'Z' ; * ( p ++ ) = '\\0' ; <END_BUG> if ( * str == 'Z' )  offset = 0 ; <START_BUG> else { <END_BUG>  if ( ( * str!= '+' ) && ( * str!= '-' ) ) <START_BUG> return 0 ; offset = ( ( str [ 1 ] - '0' ) * 10 + ( str [ 2 ] - '0' ) ) * 60 ; offset += ( str [ 3 ] - '0' ) * 10 + ( str [ 4 ] - '0' ) ; if ( * str == '-' ) offset = - offset ; } atm. type = ctm -> type ; atm. flags = 0 ; atm. length = sizeof ( buff2 ) ; atm. data = ( unsigned char * ) buff2 ; if ( X509_time_adj ( & atm, offset * 60, cmp_time ) == NULL ) return 0 ; if ( ctm -> type == V_ASN1_UTCTIME<END_BUG>

Fix:
<S2SV_ModStart> i, j, remaining <S2SV_ModStart> = buff1 ; remaining <S2SV_ModEnd> = ctm -> <S2SV_ModStart> V_ASN1_UTCTIME ) { int min_length = sizeof ( "YYMMDDHHMMZ" ) - 1 ; int max_length = sizeof ( "YYMMDDHHMMSS+hhmm" ) - 1 ; if ( remaining < min_length || remaining > max_length <S2SV_ModEnd> ) return 0 <S2SV_ModStart> += 10 ; remaining -= 10 ; <S2SV_ModStart> } else { int min_length = sizeof ( "YYYYMMDDHHMMZ" ) - 1 ; int max_length = sizeof ( "YYYYMMDDHHMMSS.fff+hhmm" ) - 1 ; if ( remaining < min_length || remaining > max_length <S2SV_ModEnd> ) return 0 <S2SV_ModStart> += 12 ; remaining -= 12 ; <S2SV_ModStart> } else { if ( remaining < 2 ) return 0 ; * ( p ++ ) = * ( str ++ ) ; * ( p ++ ) = * ( str ++ ) ; remaining -= 2 ; if ( remaining && <S2SV_ModEnd> * str == <S2SV_ModStart> str ++ ; remaining -- ; for ( i = 0 ; i < 3 && remaining ; i ++, str ++, remaining -- ) { if ( * str < '0'
Buggy code:
 NORET_TYPE void do_exit ( long code ) { struct task_struct * tsk = current ; int group_dead ; profile_task_exit ( tsk ) ; WARN_ON ( atomic_read ( & tsk -> fs_excl ) ) ; if ( unlikely ( in_interrupt ( ) ) ) panic ( "Aiee,   killing   interrupt   handler!" ) ; if ( unlikely (! tsk -> pid ) ) panic ( "Attempted   to   kill   the   idle   task!" ) ; tracehook_report_exit ( & code ) ; validate_creds_for_do_exit ( tsk ) ; if ( unlikely ( tsk -> flags & PF_EXITING ) ) { printk ( KERN_ALERT "Fixing   recursive   fault   but   reboot   is   needed!\\n" ) ; tsk -> flags |= PF_EXITPIDONE ; set_current_state ( TASK_UNINTERRUPTIBLE ) ; schedule ( ) ; } exit_irq_thread ( ) ; exit_signals ( tsk ) ; smp_mb ( ) ; spin_unlock_wait ( & tsk -> pi_lock ) ; if ( unlikely ( in_atomic ( ) ) ) printk ( KERN_INFO "note:   %s[%d]   exited   with   preempt_count   %d\\n", current -> comm, task_pid_nr ( current ), preempt_count ( ) ) ; acct_update_integrals ( tsk ) ; group_dead = atomic_dec_and_test ( & tsk -> signal -> live ) ; if ( group_dead ) { hrtimer_cancel ( & tsk -> signal -> real_timer ) ; exit_itimers ( tsk -> signal ) ; if ( tsk -> mm ) setmax_mm_hiwater_rss ( & tsk -> signal -> maxrss, tsk -> mm ) ; } acct_collect ( code, group_dead ) ; if ( group_dead ) tty_audit_exit ( ) ; if ( unlikely ( tsk -> audit_context ) ) audit_free ( tsk ) ; tsk -> exit_code = code ; taskstats_exit ( tsk, group_dead ) ; exit_mm ( tsk ) ; if ( group_dead

Fix:
<S2SV_ModStart> ) exit_io_context ( tsk
Buggy code:
 static int list_tables ( MYSQL * mysql, const char * db, const char * table ) { const char * header ; uint head_length, counter = 0 ; <START_BUG> char query [ 255 ], rows [ NAME_LEN ], fields [ 16 ] ; <END_BUG> MYSQL_FIELD * field ; MYSQL_RES * result ; MYSQL_ROW row, rrow ; if ( mysql_select_db ( mysql, db ) ) { fprintf ( stderr, "%s:   Cannot   connect   to   db   %s:   %s\\n", my_progname, db, mysql_error ( mysql ) ) ; return 1 ; } if ( table ) { mysql_real_escape_string ( mysql, rows, table, ( unsigned long ) strlen ( table ) ) ; my_snprintf ( query, sizeof ( query ), "show%s   tables   like   \'%s\'", opt_table_type? "   full" : "", rows ) ; } else my_snprintf ( query, sizeof ( query ), "show%s   tables", opt_table_type? "   full" : "" ) ; if ( mysql_query ( mysql, query ) ||! ( result = mysql_store_result ( mysql ) ) ) { fprintf ( stderr, "%s:   Cannot   list   tables   in   %s:   %s\\n", my_progname, db, mysql_error ( mysql ) ) ; exit ( 1 ) ; } printf ( "Database:   %s", db ) ; if ( table ) printf ( "     Wildcard:   %s", table ) ; putchar ( '\\n' ) ; header = "Tables" ; head_length = ( uint ) strlen ( header ) ; field = mysql_fetch_field ( result ) ; if ( head_length < field -> max_length ) head_length = field -> max_length ; if ( opt_table_type ) { if (! opt_verbose ) print_header ( header, head_length, "table_type", 10, NullS ) ; else if ( opt_verbose == 1 ) print_header ( header, head_length, "table_type", 10, "Columns", 8, NullS ) ; else { print_header ( header, head_length, "table_type", 10, "Columns

Fix:
<S2SV_ModStart> char query [ NAME_LEN + 100 <S2SV_ModEnd> ], rows <S2SV_ModStart> 1 ) { my_snprintf <S2SV_ModEnd> ( query, <S2SV_ModStart> ( query, sizeof ( query ),
Buggy code:
 char * rfbProcessFileTransferReadBuffer ( rfbClientPtr cl, uint32_t length ) { char * buffer = NULL ; int n = 0 ; FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN ( "", cl, NULL ) ; <START_BUG> if ( length > 0 ) { <END_BUG>  buffer = malloc ( ( uint64_t ) length + 1 ) ; <START_BUG> if ( buffer!= NULL ) { if ( ( n = rfbReadExact ( cl, ( char * ) buffer, length ) ) <= 0 ) { if ( n!= 0 ) rfbLogPerror ( "rfbProcessFileTransferReadBuffer:   read" ) ; rfbCloseClient ( cl ) ; if ( buffer!= NULL ) free ( buffer ) ; return NULL ; } buffer [ length ] = 0 ; } } return buffer ; }<END_BUG>

Fix:
<S2SV_ModStart> if ( length == SIZE_MAX ) { rfbErr ( "rfbProcessFileTransferReadBuffer: <S2SV_blank> too <S2SV_blank> big <S2SV_blank> file <S2SV_blank> transfer <S2SV_blank> length <S2SV_blank> requested: <S2SV_blank> %u", ( unsigned int ) length ) ; rfbCloseClient ( cl ) ; return NULL ; } if ( length <S2SV_ModStart> malloc ( ( size_t <S2SV_ModEnd> ) length +
Buggy code:
 int main ( int argc, char * * argv ) { int fmtid ; int id ; char * infile ; jas_stream_t * instream ; jas_image_t * image ; int width ; int height ; int depth ; int numcmpts ; int verbose ; <START_BUG> char * fmtname ; <END_BUG> if ( jas_init ( ) ) { abort ( ) ; } cmdname = argv [ 0 ] ; infile = 0 ; verbose = 0 ;  while ( ( id = jas_getopt ( argc, argv, opts ) ) >= 0 ) { <START_BUG> switch ( id ) { case OPT_VERBOSE : verbose = 1 ; break ; case OPT_VERSION : printf ( "%s\\n", JAS_VERSION ) ; exit ( EXIT_SUCCESS ) ; break ; <END_BUG> case OPT_INFILE :  infile = jas_optarg ; break ; case OPT_HELP : default : usage ( ) ; break ; } } <START_BUG> if ( infile ) { <END_BUG> if (! ( instream = jas_stream_fopen ( infile, "rb" ) ) ) { fprintf ( stderr, "cannot   open   input   image   file   %s\\n", infile ) ; exit ( EXIT_FAILURE ) ; } } else { if (! ( instream = jas_stream_fdopen ( 0, "rb" ) ) ) { fprintf ( stderr, "cannot   open   standard   input\\n" ) ; exit ( EXIT_FAILURE ) ; } } if ( ( fmtid = jas_image_getfmt ( instream ) ) < 0 ) { fprintf ( stderr, "unknown   image   format\\n" ) ; }  if (! ( image = jas_image_decode ( instream, fmtid, 0 ) ) ) { <START_BUG> fprintf ( stderr, "cannot   load   image\\n" ) ; return EXIT_FAILURE ; } jas_stream_close ( instream ) ; numcmpts = jas_image_numcmpts ( image ) ; width = jas_image_cmptwidth ( image, 0 ) ; height = jas_image_cmptheight ( image, 0 ) ; depth = jas_image_cmptprec ( image, 0 ) ; if (! ( fmtname = jas_image_fmttostr ( fmtid ) ) ) { abort<END_BUG>

Fix:
<S2SV_ModStart> char * fmtname ; int debug <S2SV_ModStart> = 0 ; debug = 0 ; <S2SV_ModStart> break ; case OPT_DEBUG : debug = atoi ( jas_optarg ) ; break ; case <S2SV_ModStart> ; } } jas_setdbglevel ( debug ) ; <S2SV_ModStart> ) ) { jas_stream_close ( instream ) ;
Buggy code:
 static void exif_mnote_data_pentax_load ( ExifMnoteData * en, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataPentax * n = ( ExifMnoteDataPentax * ) en ; size_t i, tcount, o, datao, base = 0 ; ExifShort c ; if (! n ||! buf ||! buf_size ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataPentax", "Short   MakerNote" ) ; return ; } datao = 6 + n -> offset ; <START_BUG> if ( ( datao + 8 < datao ) || ( datao + 8 < 8 ) || ( datao + 8 > buf_size ) ) { <END_BUG> exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataPentax", "Short   MakerNote" ) ; return ; } if (! memcmp ( buf + datao, "AOC", 4 ) ) { if ( ( buf [ datao + 4 ] == 'I' ) && ( buf [ datao + 5 ] == 'I' ) ) { n -> version = pentaxV3 ; n -> order = EXIF_BYTE_ORDER_INTEL ; } else if ( ( buf [ datao + 4 ] == 'M' ) && ( buf [ datao + 5 ] == 'M' ) ) { n -> version = pentaxV3 ; n -> order = EXIF_BYTE_ORDER_MOTOROLA ; } else { n -> version = pentaxV2 ; } exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataPentax", "Parsing   Pentax   maker   note   v%d...", ( int ) n -> version ) ; datao += 4 + 2 ; base = MNOTE_PENTAX2_TAG_BASE ; } else if (! memcmp ( buf + datao, "QVC", 4 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataPentax", "Parsing   Casio

Fix:
<S2SV_ModStart> ; if ( CHECKOVERFLOW ( datao, buf_size, 8 <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; if ( CHECKOVERFLOW ( o, buf_size, 12 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataPentax", "Short <S2SV_blank> MakerNote" ) ; break ; } n -> entries [ tcount ]. tag = exif_get_short ( buf + o + 0, n -> order ) + base ; n -> entries [ tcount ]. format = exif_get_short ( buf + o + 2, n -> order ) ; n -> entries [ tcount ]. components = exif_get_long ( buf + o + 4, n -> order ) ; n -> entries [ tcount ]. order = n -> order ; exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnotePentax", "Loading <S2SV_blank> entry <S2SV_blank> 0x%x <S2SV_blank> (\'%s\')...", n -> entries [ tcount ]. tag, mnote_pentax_tag_get_name ( n -> entries [ tcount ]. tag
Buggy code:
 static guint32 parse_wbxml_attribute_list ( proto_tree * tree, tvbuff_t * tvb, guint32 offset, guint32 str_tbl, guint8 level, guint8 * codepage_attr ) { guint32 tvb_len = tvb_reported_length ( tvb ) ; <START_BUG> guint32 off = offset ; <END_BUG> guint32 len ; guint str_len ; guint32 ent ; guint32 idx ; guint8 peek ;  DebugLog ( ( "parse_wbxml_attr   (level   =   %u,   offset   =   %u)\\n", level, offset ) ) ; <START_BUG> while ( off < tvb_len ) { peek = tvb_get_guint8 ( tvb, off ) ; DebugLog ( ( "ATTR:   (top   of   while)   level   =   %3u,   peek   =   0x%02X,   " "off   =   %u,   tvb_len   =   %u\\n", level, peek, off, tvb_len ) ) ; if ( ( peek & 0x3F ) < 5 ) switch ( peek ) { case 0x00 : * codepage_attr = tvb_get_guint8 ( tvb, off + 1 ) ; proto_tree_add_text ( tree, tvb, off, 2, "             |     Attr   |   A   -->%3d   " "|   SWITCH_PAGE   (Attr   code   page)         |", * codepage_attr ) ; off += 2 ; break ; case 0x01 : off ++ ; DebugLog ( ( "ATTR:   level   =   %u,   Return:   len   =   %u\\n", level, off - offset ) ) ; return ( off - offset ) ; case 0x02 : ent = tvb_get_guintvar ( tvb, off + 1, & len ) ; proto_tree_add_text ( tree, tvb, off, 1 + len, "     %3d   |     Attr   |   A   %3d         " "|   ENTITY                            <END_BUG>

Fix:
<S2SV_ModStart> off = offset, last_off <S2SV_ModStart> offset ) ) ; last_off = off <S2SV_ModStart> ; } } if ( off < last_off ) { THROW ( ReportedBoundsError ) ; } last_off = off ;
Buggy code:
 WORD32 ih264d_parse_sps ( dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm ) { UWORD8 i ; dec_seq_params_t * ps_seq = NULL ; UWORD8 u1_profile_idc, u1_level_idc, u1_seq_parameter_set_id ; UWORD16 i2_max_frm_num ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD8 u1_frm, uc_constraint_set0_flag, uc_constraint_set1_flag ; UWORD32 u4_temp ; WORD32 pic_height_in_map_units_minus1 = 0 ; UWORD32 u2_pic_wd = 0 ; UWORD32 u2_pic_ht = 0 ; UWORD32 u2_frm_wd_y = 0 ; UWORD32 u2_frm_ht_y = 0 ; UWORD32 u2_frm_wd_uv = 0 ; UWORD32 u2_frm_ht_uv = 0 ; UWORD32 u2_crop_offset_y = 0 ; UWORD32 u2_crop_offset_uv = 0 ; WORD32 ret ; WORD32 i4_i ; UWORD8 u1_frame_cropping_flag, u1_frame_cropping_rect_left_ofst, u1_frame_cropping_rect_right_ofst, u1_frame_cropping_rect_top_ofst, u1_frame_cropping_rect_bottom_ofst ; SWITCHONTRACE ; u1_profile_idc = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ; COPYTHECONTEXT ( "SPS:   profile_idc", u1_profile_idc ) ; uc_constraint_set0_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; uc_constraint_set1_flag = ih264d_get_bit_h264 ( ps_bitstrm

Fix:
<S2SV_ModStart> IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED ; } if ( ( u2_pic_wd << ps_seq -> u1_mb_aff_flag ) > H264_MAX_FRAME_WIDTH ) { return IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED ; }
Buggy code:
 int ip_forward ( struct sk_buff * skb ) { u32 mtu ; struct iphdr * iph ; struct rtable * rt ; struct ip_options * opt = & ( IPCB ( skb ) -> opt ) ; if ( skb -> pkt_type!= PACKET_HOST ) goto drop ; if ( skb_warn_if_lro ( skb ) ) goto drop ; if (! xfrm4_policy_check ( NULL, XFRM_POLICY_FWD, skb ) ) goto drop ; if ( IPCB ( skb ) -> opt. router_alert && ip_call_ra_chain ( skb ) ) return NET_RX_SUCCESS ; skb_forward_csum ( skb ) ; if ( ip_hdr ( skb ) -> ttl <= 1 ) goto too_many_hops ; if (! xfrm4_route_forward ( skb ) ) goto drop ; rt = skb_rtable ( skb ) ; if ( opt -> is_strictroute && rt -> rt_uses_gateway ) goto sr_failed ; IPCB ( skb ) -> flags |= IPSKB_FORWARDED ; mtu = ip_dst_mtu_maybe_forward ( & rt -> dst, true ) ; if (! ip_may_fragment ( skb ) && ip_exceeds_mtu ( skb, mtu ) ) { IP_INC_STATS ( dev_net ( rt -> dst. dev ), IPSTATS_MIB_FRAGFAILS ) ; icmp_send ( skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl ( mtu ) ) ; goto drop ; } if ( skb_cow ( skb, LL_RESERVED_SPACE ( rt -> dst. dev ) + rt -> dst. header_len ) ) goto drop ; iph = ip_hdr ( skb ) ; ip_decrease_ttl ( iph ) ; <START_BUG> if ( rt -> rt_flags & RTCF_DOREDIRECT &&! opt -> srr &&! skb_sec_path ( skb ) ) <END_BUG> ip_rt_send_redirect ( skb ) ; skb -> priority = rt_tos2priority ( iph -> tos ) ; return NF_HOOK ( N

Fix:
<S2SV_ModStart> ; if ( IPCB ( skb ) -> flags & IPSKB_DOREDIRECT <S2SV_ModEnd> &&! opt
Buggy code:
 static int name_parse ( u8 * packet, int length, int * idx, char * name_out, int name_out_len ) { int name_end = - 1 ; int j = * idx ; int ptr_count = 0 ; # define GET32 ( x ) do { if ( j + 4 > length ) goto err ; memcpy ( & t32_, packet + j, 4 ) ; j += 4 ; x = ntohl ( t32_ ) ; } while ( 0 ) # define GET16 ( x ) do { if ( j + 2 > length ) goto err ; memcpy ( & t_, packet + j, 2 ) ; j += 2 ; x = ntohs ( t_ ) ; } while ( 0 ) # define GET8 ( x ) do { if ( j >= length ) goto err ; x = packet [ j ++ ] ; } while ( 0 ) char * cp = name_out ; const char * const end = name_out + name_out_len ; for ( ; ; ) { u8 label_len ; <START_BUG> if ( j >= length ) return - 1 ; <END_BUG> GET8 ( label_len ) ; if (! label_len ) break ; if ( label_len & 0xc0 ) { u8 ptr_low ; GET8 ( ptr_low ) ; if ( name_end < 0 ) name_end = j ; j = ( ( ( int ) label_len & 0x3f ) << 8 ) + ptr_low ; if ( j < 0 || j >= length ) return - 1 ; if ( ++ ptr_count > length ) return - 1 ; continue ; } if ( label_len > 63 ) return - 1 ; if ( cp!= name_out ) { if ( cp + 1 >= end ) return - 1 ; * cp ++ = '.' ; } if ( cp + label_len >= end ) return - 1 ;  memcpy ( cp, packet + j, label_len ) ; <START_BUG> cp += label_len ; j += label_len ; } if ( cp >= end ) return - 1 ; * cp = '\\0' ; if ( name_end < 0 ) * idx = j ; else * idx = name_end ; return 0 ; err : return - 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> u8 label_len ; <S2SV_ModEnd> GET8 ( label_len <S2SV_ModStart> - 1 ; if ( j + label_len > length ) return - 1 ;
Buggy code:
 uint32_t virtio_config_readl ( VirtIODevice * vdev, uint32_t addr ) { VirtioDeviceClass * k = VIRTIO_DEVICE_GET_CLASS ( vdev ) ; uint32_t val ; <START_BUG> k -> get_config ( vdev, vdev -> config ) ; <END_BUG> if ( addr > ( vdev -> config_len - sizeof ( val ) ) ) return ( uint32_t ) - 1 ; val = ldl_p ( vdev -> config + addr ) ; return val ; }

Fix:
<S2SV_ModStart> uint32_t val ; if ( addr + sizeof ( val ) > vdev -> config_len ) { return ( uint32_t ) - 1 ; } <S2SV_ModStart> -> config ) <S2SV_ModEnd> ; val =
Buggy code:
 static int set_geometry ( unsigned int cmd, struct floppy_struct * g, int drive, int type, struct block_device * bdev ) { int cnt ; <START_BUG> if ( g -> sect <= 0 || <END_BUG>  g -> head <= 0 || <START_BUG> ( unsigned char ) ( ( g -> sect << 2 ) >> FD_SIZECODE ( g ) ) == 0 || g -> track <= 0 || g -> track > UDP -> tracks >> STRETCH ( g ) || ( g -> stretch & ~ ( FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK ) )!= 0 ) return - EINVAL ; if ( type ) { if (! capable ( CAP_SYS_ADMIN ) ) return - EPERM ; mutex_lock ( & open_lock ) ; if ( lock_fdc ( drive ) ) { mutex_unlock ( & open_lock ) ; return - EINTR ; } floppy_type [ type ] = * g ; floppy_type [ type ]. name = "user   format" ; for ( cnt = type << 2 ; cnt < ( type << 2 ) + 4 ; cnt ++ ) floppy_sizes [ cnt ] = floppy_sizes [ cnt + 0x80 ] = floppy_type [ type ]. size + 1 ; process_fd_request ( ) ; for ( cnt = 0 ; cnt < N_DRIVE ; cnt ++ ) { struct block_device * bdev = opened_bdev [ cnt ] ; if (! bdev || ITYPE ( drive_state [ cnt ]. fd_device )!= type ) continue ; __invalidate_device ( bdev, true ) ; } mutex_unlock ( & open_lock ) ; } else { int oldStretch ; if ( lock_fdc ( drive ) ) return - EINTR ; if ( cmd!= FDDEFPRM ) { if ( poll_drive ( true, FD_RAW_NEED_DISK ) == - EINTR ) return - EINTR ; } oldStretch = g -> stretch ; user_params [ drive ] = * g ; if ( buffer_drive == drive ) SUPBOUND ( buffer_max, user_params [ drive ]. sect ) ; current_type [ drive ] = & user_params [ drive ] ; floppy_<END_BUG>

Fix:
<S2SV_ModStart> ; if ( ( int ) <S2SV_ModStart> <= 0 || ( int ) <S2SV_ModStart> g -> head <= 0 || ( int ) ( g -> sect * g -> head )
Buggy code:
 static int virtnet_probe ( struct virtio_device * vdev ) { int i, err ; struct net_device * dev ; struct virtnet_info * vi ; u16 max_queue_pairs ; if (! vdev -> config -> get ) { dev_err ( & vdev -> dev, "%s   failure:   config   access   disabled\\n", __func__ ) ; return - EINVAL ; } if (! virtnet_validate_features ( vdev ) ) return - EINVAL ; err = virtio_cread_feature ( vdev, VIRTIO_NET_F_MQ, struct virtio_net_config, max_virtqueue_pairs, & max_queue_pairs ) ; if ( err || max_queue_pairs < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN || max_queue_pairs > VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX ||! virtio_has_feature ( vdev, VIRTIO_NET_F_CTRL_VQ ) ) max_queue_pairs = 1 ; dev = alloc_etherdev_mq ( sizeof ( struct virtnet_info ), max_queue_pairs ) ; if (! dev ) return - ENOMEM ; dev -> priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE ; dev -> netdev_ops = & virtnet_netdev ; dev -> features = NETIF_F_HIGHDMA ; dev -> ethtool_ops = & virtnet_ethtool_ops ; SET_NETDEV_DEV ( dev, & vdev -> dev ) ; if ( virtio_has_feature ( vdev, VIRTIO_NET_F_CSUM ) ) { <START_BUG> dev -> hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_FRAGLIST ; <END_BUG> if ( csum )  dev -> features |= NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_FRAGLIST ; <START_BUG> if ( virtio_has_feature ( vdev, VIRTIO_NET_F_G<END_BUG>

Fix:
<S2SV_ModStart> NETIF_F_HW_CSUM | NETIF_F_SG <S2SV_ModEnd> ; if ( <S2SV_ModStart> NETIF_F_HW_CSUM | NETIF_F_SG <S2SV_ModEnd> ; if (