nus-yam/ex-repair huggingface dataset:
Buggy code:
 void ngx_gmtime ( time_t t, ngx_tm_t * tp ) { ngx_int_t yday ; ngx_uint_t sec, min, hour, mday, mon, year, wday, days, leap ; if ( t < 0 ) { t = 0 ; } days = t // 86400 ; <START_BUG> sec = t % 86400 ; <END_BUG> wday = ( 4 + days ) % 7 ; hour = sec // 3600 ; sec %= 3600 ; min = sec // 60 ; sec %= 60 ; days = days - ( 31 + 28 ) + 719527 ; year = ( days + 2 ) * 400 // ( 365 * 400 + 100 - 4 + 1 ) ; yday = days - ( 365 * year + year // 4 - year // 100 + year // 400 ) ; if ( yday < 0 ) { leap = ( year % 4 == 0 ) && ( year % 100 || ( year % 400 == 0 ) ) ; yday = 365 + leap + yday ; year -- ; } mon = ( yday + 31 ) * 10 // 306 ; mday = yday - ( 367 * mon // 12 - 30 ) + 1 ; if ( yday >= 306 ) { year ++ ; mon -= 10 ; } else { mon += 2 ; } tp -> ngx_tm_sec = ( ngx_tm_sec_t ) sec ; tp -> ngx_tm_min = ( ngx_tm_min_t ) min ; tp -> ngx_tm_hour = ( ngx_tm_hour_t ) hour ; tp -> ngx_tm_mday = ( ngx_tm_mday_t ) mday ; tp -> ngx_tm_mon = ( ngx_tm_mon_t ) mon ; tp -> ngx_tm_year = ( ngx_tm_year_t ) year ; tp -> ngx_tm_wday = ( ngx_tm_wday_t ) wday ; }

Fix:
<S2SV_ModStart> % 86400 ; if ( days > 2932896 ) { days = 2932896 ; sec = 86399 ; }
Buggy code:
 char * logger_get_mask_expanded ( struct t_gui_buffer * buffer, const char * mask ) { <START_BUG> char * mask2, * mask_decoded, * mask_decoded2, * mask_decoded3, * mask_decoded4 ; <END_BUG> char * mask_decoded5 ; const char * dir_separator ; int length ; time_t seconds ; struct tm * date_tmp ; mask2 = NULL ;  mask_decoded = NULL ; <START_BUG> mask_decoded2 = NULL ; mask_decoded3 = NULL ; mask_decoded4 = NULL ; mask_decoded5 = NULL ; dir_separator = weechat_info_get ( "dir_separator", "" ) ; if (! dir_separator ) return NULL ; <END_BUG> mask2 = weechat_string_replace ( mask, dir_separator, "\\01" ) ;  if (! mask2 ) goto end ; mask_decoded = weechat_buffer_string_replace_local_var ( buffer, mask2 ) ; if (! mask_decoded ) goto end ; mask_decoded2 = weechat_string_replace ( mask_decoded, dir_separator, weechat_config_string ( logger_config_file_replacement_char ) ) ; if (! mask_decoded2 ) goto end ; # ifdef __CYGWIN__ mask_decoded3 = weechat_string_replace ( mask_decoded2, "\\\\", weechat_config_string ( logger_config_file_replacement_char ) ) ; # else mask_decoded3 = strdup ( mask_decoded2 ) ; # endif if (! mask_decoded3 ) goto end ; mask_decoded4 = weechat_string_replace ( mask_decoded3, "\\01", dir_separator ) ; if (! mask_decoded4 ) goto end ; length = strlen ( mask_decoded4 ) + 256 + 1 ; <START_BUG> mask_decoded5 = malloc ( length ) ; <END_BUG>  if (! mask_decoded5 ) <START_BUG> goto end ; seconds = time ( NULL ) ; date_tmp = localtime ( & seconds ) ; <END_BUG> mask_decoded5 [ 0 ] = '\\0' ;  <START_BUG> strftime ( mask_decoded5, length - 1, mask_decoded4, date_tmp ) ; <END_BUG> if ( weechat_config_boolean ( logger_config_file_name_

Fix:
<S2SV_ModStart> mask2, * mask3, * mask4, * mask5, * mask6, * mask7 <S2SV_ModEnd> ; const char <S2SV_ModStart> = NULL ; mask3 = NULL ; mask4 = NULL ; mask5 = NULL ; mask6 = NULL ; mask7 <S2SV_ModEnd> = NULL ; <S2SV_ModStart> return NULL ; length = strlen ( mask <S2SV_ModEnd> ) + 256 <S2SV_ModStart> + 1 ; mask2 <S2SV_ModEnd> = malloc ( <S2SV_ModStart> if (! mask2 <S2SV_ModEnd> ) goto end <S2SV_ModStart> seconds ) ; mask2 <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = '\\0' ; if ( strftime ( mask2 <S2SV_ModEnd>, length - <S2SV_ModStart> - 1, mask <S2SV_ModEnd>, date_tmp ) <S2SV_ModStart>, date_tmp ) == 0 ) mask2 [ 0 ] = '\\0' ; mask3 = weechat_string_replace ( mask2, dir_separator, "\\01" ) ; if (! mask3 ) goto end ; mask4 = weechat_buffer_string_replace_local_var ( buffer, mask3 ) ; if (! mask4 ) goto end ; mask5 = weechat_string_replace ( mask4, dir_separator, weechat_config_string ( logger_config_file_replacement_char ) ) ; if (! mask5
Buggy code:
 static int nl80211_get_ftm_responder_stats ( struct sk_buff * skb, struct genl_info * info ) { struct cfg80211_registered_device * rdev = info -> user_ptr [ 0 ] ; struct net_device * dev = info -> user_ptr [ 1 ] ; struct wireless_dev * wdev = dev -> ieee80211_ptr ; struct cfg80211_ftm_responder_stats ftm_stats = { } ; struct sk_buff * msg ; void * hdr ; struct nlattr * ftm_stats_attr ; int err ; if ( wdev -> iftype!= NL80211_IFTYPE_AP ||! wdev -> beacon_interval ) return - EOPNOTSUPP ; err = rdev_get_ftm_responder_stats ( rdev, dev, & ftm_stats ) ; if ( err ) return err ; if (! ftm_stats. filled ) return - ENODATA ; msg = nlmsg_new ( NLMSG_DEFAULT_SIZE, GFP_KERNEL ) ; if (! msg ) return - ENOMEM ; hdr = nl80211hdr_put ( msg, info -> snd_portid, info -> snd_seq, 0, NL80211_CMD_GET_FTM_RESPONDER_STATS ) ; if (! hdr ) <START_BUG> return - ENOBUFS ; <END_BUG> if ( nla_put_u32 ( msg, NL80211_ATTR_IFINDEX, dev -> ifindex ) ) goto nla_put_failure ; ftm_stats_attr = nla_nest_start_noflag ( msg, NL80211_ATTR_FTM_RESPONDER_STATS ) ; if (! ftm_stats_attr ) goto nla_put_failure ; # define SET_FTM ( field, name, type ) do { if ( ( ftm_stats. filled & BIT ( NL80211_FTM_STATS_ ## name ) ) && nla_put_ ## type ( msg, NL80211_FTM_STATS_ ## name, ftm_stats. field ) ) goto nla_put_failure ; } while ( 0 ) # define SET_FTM_U64 ( field, name ) do { if ( ( ftm_stats. filled & BIT

Fix:
<S2SV_ModStart>! hdr ) goto nla_put_failure <S2SV_ModEnd> ; if (
Buggy code:
 void wiki_handle_http_request ( HttpRequest * req ) { HttpResponse * res = http_response_new ( req ) ; char * page = http_request_get_path_info ( req ) ; char * command = http_request_get_query_string ( req ) ; char * wikitext = "" ; util_dehttpize ( page ) ; if (! strcmp ( page, "//" ) ) { if ( access ( "WikiHome", R_OK )!= 0 ) wiki_redirect ( res, "//WikiHome?create" ) ; page = "//WikiHome" ; } if (! strcmp ( page, "//styles.css" ) ) { http_response_set_content_type ( res, "text//css" ) ; http_response_printf ( res, "%s", CssData ) ; http_response_send ( res ) ; exit ( 0 ) ; } if (! strcmp ( page, "//favicon.ico" ) ) { http_response_set_content_type ( res, "image//ico" ) ; http_response_set_data ( res, FaviconData, FaviconDataLen ) ; http_response_send ( res ) ; exit ( 0 ) ; } page = page + 1 ; if (! strncmp ( page, "api//", 4 ) ) { char * p ; page += 4 ; for ( p = page ; * p!= '\\0' ; p ++ ) if ( * p == '?' ) { * p = '\\0' ; break ; } wiki_handle_rest_call ( req, res, page ) ; exit ( 0 ) ; } <START_BUG> if ( strchr ( page, '//' ) ) <END_BUG> { http_response_set_status ( res, 404, "Not   Found" ) ; http_response_printf ( res, "<html><body>404   Not   Found<//body><//html>\\n" ) ; http_response_send ( res ) ; exit ( 0 ) ; } if (! strcmp ( page, "Changes" ) ) { wiki_show_changes_page ( res ) ; } else if (! strcmp ( page, "ChangesRss" ) ) { wiki_show_changes_page_rss ( res ) ; } else if (! strcmp ( page, "Search" ) ) { wiki_show_search_results_page ( res

Fix:
<S2SV_ModStart> } if (! page_name_is_good ( page <S2SV_ModEnd> ) ) {
Buggy code:
 static int pop_fetch_message ( struct Context * ctx, struct Message * msg, int msgno ) { void * uidl = NULL ; char buf [ LONG_STRING ] ; char path [ PATH_MAX ] ; struct Progress progressbar ; struct PopData * pop_data = ( struct PopData * ) ctx -> data ; struct PopCache * cache = NULL ; struct Header * h = ctx -> hdrs [ msgno ] ; unsigned short bcache = 1 ; <START_BUG> msg -> fp = mutt_bcache_get ( pop_data -> bcache, h -> data ) ; <END_BUG> if ( msg -> fp ) return 0 ; cache = & pop_data -> cache [ h -> index % POP_CACHE_LEN ] ; if ( cache -> path ) { if ( cache -> index == h -> index ) { msg -> fp = fopen ( cache -> path, "r" ) ; if ( msg -> fp ) return 0 ; mutt_perror ( cache -> path ) ; return - 1 ; } else { unlink ( cache -> path ) ; FREE ( & cache -> path ) ; } } while ( true ) { if ( pop_reconnect ( ctx ) < 0 ) return - 1 ; if ( h -> refno < 0 ) { mutt_error ( _ ( "The   message   index   is   incorrect.   Try   reopening   the   mailbox." ) ) ; return - 1 ; } mutt_progress_init ( & progressbar, _ ( "Fetching   message..." ), MUTT_PROGRESS_SIZE, NetInc, h -> content -> length + h -> content -> offset - 1 ) ;  msg -> fp = mutt_bcache_put ( pop_data -> bcache, h -> data ) ; <START_BUG> if (! msg -> fp ) { bcache = 0 ; mutt_mktemp ( path, sizeof ( path ) ) ; msg -> fp = mutt_file_fopen ( path, "w+" ) ; if (! msg -> fp ) { mutt_perror ( path ) ; return - 1 ; } } snprintf ( buf, sizeof ( buf ), "RETR   %d\\r\\n", h -> refno ) ; const int ret = pop_fetch_data ( pop_data, buf, & progressbar, fetch_message, msg -> fp ) ; if ( ret == 0 ) break ; mutt_file<END_BUG>

Fix:
<S2SV_ModStart> -> bcache, cache_id ( <S2SV_ModStart> h -> data ) <S2SV_ModStart> -> bcache, cache_id ( <S2SV_ModStart> h -> data ) <S2SV_ModStart> -> bcache, cache_id ( <S2SV_ModStart> h -> data )
Buggy code:
 int cipso_v4_validate ( const struct sk_buff * skb, unsigned char * * option ) { unsigned char * opt = * option ; unsigned char * tag ; unsigned char opt_iter ; unsigned char err_offset = 0 ; u8 opt_len ; u8 tag_len ; struct cipso_v4_doi * doi_def = NULL ; u32 tag_iter ; opt_len = opt [ 1 ] ; if ( opt_len < 8 ) { err_offset = 1 ; goto validate_return ; } rcu_read_lock ( ) ; doi_def = cipso_v4_doi_search ( get_unaligned_be32 ( & opt [ 2 ] ) ) ; if ( doi_def == NULL ) { err_offset = 2 ; goto validate_return_locked ; } opt_iter = CIPSO_V4_HDR_LEN ; tag = opt + opt_iter ; while ( opt_iter < opt_len ) { for ( tag_iter = 0 ; doi_def -> tags [ tag_iter ]!= tag [ 0 ] ; ) if ( doi_def -> tags [ tag_iter ] == CIPSO_V4_TAG_INVALID || ++ tag_iter == CIPSO_V4_TAG_MAXCNT ) { err_offset = opt_iter ; goto validate_return_locked ; } tag_len = tag [ 1 ] ; if ( tag_len > ( opt_len - opt_iter ) ) { err_offset = opt_iter + 1 ; goto validate_return_locked ; } switch ( tag [ 0 ] ) { case CIPSO_V4_TAG_RBITMAP : if ( tag_len < CIPSO_V4_TAG_RBM_BLEN ) { err_offset = opt_iter + 1 ; goto validate_return_locked ; } if ( cipso_v4_rbm_strictvalid ) { if ( cipso_v4_map_lvl_valid ( doi_def, tag [ 3 ] ) < 0 ) { err_offset = opt_iter + 3 ; goto validate_return_locked ; } if ( tag_len > CIPSO_V4_TAG_RBM_BLEN && cipso_v4_map_cat_rbm_valid ( doi_

Fix:
<S2SV_ModStart> : if ( skb == NULL ||
Buggy code:
 <START_BUG> static void atomic2gen ( lua_State * L, global_State * g ) { <END_BUG> sweep2old ( L, & g -> allgc ) ; g -> reallyold = g -> old = g -> survival = g -> allgc ; sweep2old ( L, & g -> finobj ) ; g -> finobjrold = g -> finobjold = g -> finobjsur = g -> finobj ; sweep2old ( L, & g -> tobefnz ) ; g -> gckind = KGC_GEN ; g -> lastatomic = 0 ; g -> GCestimate = gettotalbytes ( g ) ; finishgencycle ( L, g ) ; }

Fix:
<S2SV_ModStart> g ) { g -> gcstate = GCSswpallgc ;
Buggy code:
 static int adjust_insn_aux_data ( struct bpf_verifier_env * env, u32 prog_len, u32 off, u32 cnt ) { <START_BUG> struct bpf_insn_aux_data * new_data, * old_data = env -> insn_aux_data ; <END_BUG> if ( cnt == 1 ) return 0 ; new_data = vzalloc ( sizeof ( struct bpf_insn_aux_data ) * prog_len ) ; if (! new_data ) return - ENOMEM ; memcpy ( new_data, old_data, sizeof ( struct bpf_insn_aux_data ) * off ) ; memcpy ( new_data + off + cnt - 1, old_data + off, sizeof ( struct bpf_insn_aux_data ) * ( prog_len - off - cnt + 1 ) ) ;  env -> insn_aux_data = new_data ; <START_BUG> vfree ( old_data ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> env -> insn_aux_data ; int i <S2SV_ModStart> ) ) ; for ( i = off ; i < off + cnt - 1 ; i ++ ) new_data [ i ]. seen = true ;
Buggy code:
 static void y4m_convert_null ( y4m_input * _y4m, unsigned char * _dst, unsigned char * _aux ) { <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> _aux ) { ( void ) _y4m ; ( void ) _dst ; ( void ) _aux ;
Buggy code:
 CURLcode Curl_auth_create_plain_message ( struct Curl_easy * data, const char * userp, const char * passwdp, char * * outptr, size_t * outlen ) { CURLcode result ; char * plainauth ; size_t ulen ; size_t plen ; size_t plainlen ; * outlen = 0 ; * outptr = NULL ; ulen = strlen ( userp ) ; plen = strlen ( passwdp ) ; <START_BUG> if ( ( ulen > SIZE_T_MAX // 2 ) || ( plen > ( SIZE_T_MAX // 2 - 2 ) ) ) <END_BUG> return CURLE_OUT_OF_MEMORY ; plainlen = 2 * ulen + plen + 2 ; plainauth = malloc ( plainlen ) ; if (! plainauth ) return CURLE_OUT_OF_MEMORY ; memcpy ( plainauth, userp, ulen ) ; plainauth [ ulen ] = '\\0' ; memcpy ( plainauth + ulen + 1, userp, ulen ) ; plainauth [ 2 * ulen + 1 ] = '\\0' ; memcpy ( plainauth + 2 * ulen + 2, passwdp, plen ) ; result = Curl_base64_encode ( data, plainauth, plainlen, outptr, outlen ) ; free ( plainauth ) ; return result ; }

Fix:
<S2SV_ModStart> > SIZE_T_MAX // 4 <S2SV_ModEnd> ) || (
Buggy code:
 <START_BUG> void vp9_iht4x4_add ( TX_TYPE tx_type, const int16_t * input, uint8_t * dest, <END_BUG> int stride, int eob ) { if ( tx_type == DCT_DCT ) vp9_idct4x4_add ( input, dest, stride, eob ) ; else vp9_iht4x4_16_add ( input, dest, stride, tx_type ) ; }

Fix:
<S2SV_ModStart> tx_type, const tran_low_t <S2SV_ModEnd> * input,
Buggy code:
 static VALUE cState_space_set ( VALUE self, VALUE space ) { unsigned long len ; GET_STATE ( self ) ; Check_Type ( space, T_STRING ) ; len = RSTRING_LEN ( space ) ; if ( len == 0 ) { if ( state -> space ) { ruby_xfree ( state -> space ) ; state -> space = NULL ; state -> space_len = 0 ; } } else { if ( state -> space ) ruby_xfree ( state -> space ) ; <START_BUG> state -> space = strdup ( RSTRING_PTR ( space ) ) ; <END_BUG> state -> space_len = len ; } return Qnil ; }

Fix:
<S2SV_ModStart> -> space = fstrndup <S2SV_ModEnd> ( RSTRING_PTR ( <S2SV_ModStart> ( space ), len
Buggy code:
 <START_BUG> static void read_frame_reference_mode_probs ( VP9_COMMON * cm, vp9_reader * r ) { <END_BUG>  FRAME_CONTEXT * const fc = & cm -> fc ; <START_BUG> int i ; if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) for ( i = 0 ; i < COMP_INTER_CONTEXTS ; ++ i ) vp9_diff_update_prob ( r, & fc -> comp_inter_prob [ i ] ) ; if ( cm -> reference_mode!= COMPOUND_REFERENCE ) for ( i = 0 ; i < REF_CONTEXTS ; ++ i ) { vp9_diff_update_prob ( r, & fc -> single_ref_prob [ i ] [ 0 ] ) ; vp9_diff_update_prob ( r, & fc -> single_ref_prob [ i ] [ 1 ] ) ; } if ( cm -> reference_mode!= SINGLE_REFERENCE ) for ( i = 0 ; i < REF_CONTEXTS ; ++ i ) vp9_diff_update_prob ( r, & fc -> comp_ref_prob [ i ] ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * cm, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> const fc = <S2SV_ModEnd> cm -> fc
Buggy code:
 void vp8_create_common ( VP8_COMMON * oci ) { vp8_machine_specific_config ( oci ) ; vp8_init_mbmode_probs ( oci ) ; vp8_default_bmode_probs ( oci -> fc. bmode_prob ) ; oci -> mb_no_coeff_skip = 1 ; oci -> no_lpf = 0 ; oci -> filter_type = NORMAL_LOOPFILTER ; oci -> use_bilinear_mc_filter = 0 ; oci -> full_pixel = 0 ; oci -> multi_token_partition = ONE_PARTITION ; oci -> clamp_type = RECON_CLAMP_REQUIRED ; <START_BUG> vpx_memset ( oci -> ref_frame_sign_bias, 0, sizeof ( oci -> ref_frame_sign_bias ) ) ; <END_BUG> oci -> copy_buffer_to_gf = 0 ; oci -> copy_buffer_to_arf = 0 ; }

Fix:
<S2SV_ModStart> = RECON_CLAMP_REQUIRED ; memset <S2SV_ModEnd> ( oci ->
Buggy code:
 protected struct magic_set * file_ms_alloc ( int flags ) { struct magic_set * ms ; size_t i, len ; if ( ( ms = CAST ( struct magic_set *, calloc ( ( size_t ) 1, sizeof ( struct magic_set ) ) ) ) == NULL ) return NULL ; if ( magic_setflags ( ms, flags ) == - 1 ) { errno = EINVAL ; goto free ; } ms -> o. buf = ms -> o. pbuf = NULL ; len = ( ms -> c. len = 10 ) * sizeof ( * ms -> c. li ) ; if ( ( ms -> c. li = CAST ( struct level_info *, malloc ( len ) ) ) == NULL ) goto free ; ms -> event_flags = 0 ; ms -> error = - 1 ; for ( i = 0 ; i < MAGIC_SETS ; i ++ ) ms -> mlist [ i ] = NULL ; ms -> file = "unknown" ; ms -> line = 0 ; ms -> indir_max = FILE_INDIR_MAX ; ms -> name_max = FILE_NAME_MAX ; ms -> elf_shnum_max = FILE_ELF_SHNUM_MAX ; ms -> elf_phnum_max = FILE_ELF_PHNUM_MAX ; <START_BUG> return ms ; <END_BUG> free : free ( ms ) ; return NULL ; }

Fix:
<S2SV_ModStart> = FILE_ELF_PHNUM_MAX ; ms -> elf_notes_max = FILE_ELF_NOTES_MAX ;
Buggy code:
 static int fscrypt_d_revalidate ( struct dentry * dentry, unsigned int flags ) { <START_BUG> struct dentry * dir ; <END_BUG> struct fscrypt_info * ci ; int dir_has_key, cached_with_key ; if ( flags & LOOKUP_RCU ) return - ECHILD ; dir = dget_parent ( dentry ) ; if (! d_inode ( dir ) -> i_sb -> s_cop -> is_encrypted ( d_inode ( dir ) ) ) { dput ( dir ) ; return 0 ; }  ci = d_inode ( dir ) -> i_crypt_info ; <START_BUG> if ( ci && ci -> ci_keyring_key && ( ci -> ci_keyring_key -> flags & ( ( 1 << KEY_FLAG_INVALIDATED ) | ( 1 << KEY_FLAG_REVOKED ) | ( 1 << KEY_FLAG_DEAD ) ) ) ) ci = NULL ; spin_lock ( & dentry -> d_lock ) ; cached_with_key = dentry -> d_flags & DCACHE_ENCRYPTED_WITH_KEY ; spin_unlock ( & dentry -> d_lock ) ; <END_BUG> dir_has_key = ( ci!= NULL ) ;  dput ( dir ) ; if ( (! cached_with_key && d_is_negative ( dentry ) ) || (! cached_with_key && dir_has_key ) || ( cached_with_key &&! dir_has_key ) ) return 0 ; return 1 ; }

Fix:
<S2SV_ModStart> dentry * dir <S2SV_ModEnd> ; int dir_has_key <S2SV_ModStart> 0 ; } <S2SV_ModEnd> spin_lock ( & <S2SV_ModStart> dir_has_key = ( d_inode ( dir ) -> i_crypt_info <S2SV_ModEnd>!= NULL )
Buggy code:
 <START_BUG> static void update_stats ( VP9_COMP * cpi ) { <END_BUG> VP9_COMMON * const cm = & cpi -> common ; const MACROBLOCK * const x = & cpi -> mb ; const MACROBLOCKD * const xd = & x -> e_mbd ; const MODE_INFO * const mi = xd -> mi [ 0 ] ; const MB_MODE_INFO * const mbmi = & mi -> mbmi ;  if (! frame_is_intra_only ( cm ) ) { <START_BUG> <END_BUG> const int seg_ref_active = vp9_segfeature_active ( & cm -> seg, mbmi -> segment_id,  SEG_LVL_REF_FRAME ) ; if (! seg_ref_active ) { <START_BUG> FRAME_COUNTS * const counts = & cm -> counts ; <END_BUG> const int inter_block = is_inter_block ( mbmi ) ; counts -> intra_inter [ vp9_get_intra_inter_context ( xd ) ] [ inter_block ] ++ ; if ( inter_block ) { const MV_REFERENCE_FRAME ref0 = mbmi -> ref_frame [ 0 ] ; if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) counts -> comp_inter [ vp9_get_reference_mode_context ( cm, xd ) ] [ has_second_ref ( mbmi ) ] ++ ; if ( has_second_ref ( mbmi ) ) { counts -> comp_ref [ vp9_get_pred_context_comp_ref_p ( cm, xd ) ] [ ref0 == GOLDEN_FRAME ] ++ ; } else { counts -> single_ref [ vp9_get_pred_context_single_ref_p1 ( xd ) ] [ 0 ] [ ref0!= LAST_FRAME ] ++ ; if ( ref0!= LAST_FRAME ) counts -> single_ref [ vp9_get_pred_context_single_ref_p2 ( xd ) ] [ 1 ] [ ref0!= GOLDEN_FRAME ] ++ ; } } }  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> void update_stats ( VP9_COMMON * cm, ThreadData * td ) { const MACROBLOCK * x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> -> mbmi ; const MB_MODE_INFO_EXT * const mbmi_ext = x -> mbmi_ext ; const BLOCK_SIZE bsize = mbmi -> sb_type ; <S2SV_ModStart> ) ) { FRAME_COUNTS * const counts = td -> counts ; const int inter_block = is_inter_block ( mbmi ) ; <S2SV_ModStart> int seg_ref_active = segfeature_active <S2SV_ModEnd> ( & cm <S2SV_ModStart> seg_ref_active ) { <S2SV_ModEnd> counts -> intra_inter <S2SV_ModStart> } } } if ( inter_block &&! segfeature_active ( & cm -> seg, mbmi -> segment_id, SEG_LVL_SKIP ) ) { const int mode_ctx = mbmi_ext -> mode_context [ mbmi -> ref_frame [ 0 ] ] ; if ( bsize >= BLOCK_8X8 ) { const PREDICTION_MODE mode = mbmi -> mode ; ++ counts -> inter_mode [ mode_ctx ] [ INTER_OFFSET ( mode ) ] ; } else { const int num_
Buggy code:
 TEE_Result syscall_asymm_verify ( unsigned long state, const struct utee_attribute * usr_params, size_t num_params, const void * data, size_t data_len, const void * sig, size_t sig_len ) { TEE_Result res ; struct tee_cryp_state * cs ; struct tee_ta_session * sess ; struct tee_obj * o ; size_t hash_size ; int salt_len = 0 ; TEE_Attribute * params = NULL ; uint32_t hash_algo ; struct user_ta_ctx * utc ; res = tee_ta_get_current_session ( & sess ) ; if ( res!= TEE_SUCCESS ) return res ; utc = to_user_ta_ctx ( sess -> ctx ) ; res = tee_svc_cryp_get_state ( sess, tee_svc_uref_to_vaddr ( state ), & cs ) ; if ( res!= TEE_SUCCESS ) return res ; if ( cs -> mode!= TEE_MODE_VERIFY ) return TEE_ERROR_BAD_PARAMETERS ; res = tee_mmu_check_access_rights ( utc, TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER, ( uaddr_t ) data, data_len ) ; if ( res!= TEE_SUCCESS ) return res ; res = tee_mmu_check_access_rights ( utc, TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER, ( uaddr_t ) sig, sig_len ) ; if ( res!= TEE_SUCCESS ) return res ; <START_BUG> params = malloc ( sizeof ( TEE_Attribute ) * num_params ) ; <END_BUG> if (! params ) return TEE_ERROR_OUT_OF_MEMORY ; res = copy_in_attrs ( utc, usr_params, num_params, params ) ; if ( res!= TEE_SUCCESS ) goto out ; res = tee_obj_get ( utc, cs -> key1, & o ) ; if ( res!= TEE_SUCCESS ) goto out ; if ( ( o -> info. handleFlags & TEE_HANDLE_FLAG_INITIALIZED ) == 0 ) { res = TEE_ERROR_BAD

Fix:
<S2SV_ModStart> return res ; size_t alloc_size = 0 ; if ( MUL_OVERFLOW ( sizeof ( TEE_Attribute ), num_params, & alloc_size ) ) return TEE_ERROR_OVERFLOW ; <S2SV_ModStart> = malloc ( alloc_size <S2SV_ModEnd> ) ; if
Buggy code:
 int write_output ( void ) { int fd ; struct filter_op * fop ; struct filter_header fh ; size_t ninst, i ; u_char * data ; ninst = compile_tree ( & fop ) ; if ( fop == NULL ) <START_BUG> return - E_NOTHANDLED ; <END_BUG> fd = open ( EF_GBL_OPTIONS -> output_file, O_CREAT | O_RDWR | O_TRUNC | O_BINARY, 0644 ) ; ON_ERROR ( fd, - 1, "Can\'t   create   file   %s", EF_GBL_OPTIONS -> output_file ) ; fprintf ( stdout, "   Writing   output   to   \\\'%s\\\'   ", EF_GBL_OPTIONS -> output_file ) ; fflush ( stdout ) ; fh. magic = htons ( EC_FILTER_MAGIC ) ; strncpy ( fh. version, EC_VERSION, sizeof ( fh. version ) ) ; fh. data = sizeof ( fh ) ; data = create_data_segment ( & fh, fop, ninst ) ; write ( fd, & fh, sizeof ( struct filter_header ) ) ; write ( fd, data, fh. code - fh. data ) ; for ( i = 0 ; i <= ninst ; i ++ ) { print_progress_bar ( & fop [ i ] ) ; write ( fd, & fop [ i ], sizeof ( struct filter_op ) ) ; } close ( fd ) ; fprintf ( stdout, "   done.\\n\\n" ) ; fprintf ( stdout, "   ->   Script   encoded   into   %d   instructions.\\n\\n", ( int ) ( i - 1 ) ) ; return E_SUCCESS ; }

Fix:
<S2SV_ModStart> return - E_NOTHANDLED ; if ( ninst == 0 ) return - E_INVALID
Buggy code:
 int exfat_mount ( struct exfat * ef, const char * spec, const char * options ) { int rc ; enum exfat_mode mode ; exfat_tzset ( ) ; memset ( ef, 0, sizeof ( struct exfat ) ) ; parse_options ( ef, options ) ; if ( match_option ( options, "ro" ) ) mode = EXFAT_MODE_RO ; else if ( match_option ( options, "ro_fallback" ) ) mode = EXFAT_MODE_ANY ; else mode = EXFAT_MODE_RW ; ef -> dev = exfat_open ( spec, mode ) ; if ( ef -> dev == NULL ) return - EIO ; if ( exfat_get_mode ( ef -> dev ) == EXFAT_MODE_RO ) { if ( mode == EXFAT_MODE_ANY ) ef -> ro = - 1 ; else ef -> ro = 1 ; } ef -> sb = malloc ( sizeof ( struct exfat_super_block ) ) ; if ( ef -> sb == NULL ) { exfat_close ( ef -> dev ) ; exfat_error ( "failed   to   allocate   memory   for   the   super   block" ) ; return - ENOMEM ; } memset ( ef -> sb, 0, sizeof ( struct exfat_super_block ) ) ; if ( exfat_pread ( ef -> dev, ef -> sb, sizeof ( struct exfat_super_block ), 0 ) < 0 ) { exfat_close ( ef -> dev ) ; free ( ef -> sb ) ; exfat_error ( "failed   to   read   boot   sector" ) ; return - EIO ; } if ( memcmp ( ef -> sb -> oem_name, "EXFAT       ", 8 )!= 0 ) { exfat_close ( ef -> dev ) ; free ( ef -> sb ) ; <START_BUG> exfat_error ( "exFAT   file   system   is   not   found" ) ; <END_BUG> return - EIO ; } ef -> zero_cluster = malloc ( CLUSTER_SIZE ( * ef -> sb ) ) ; if ( ef -> zero_cluster == NULL ) { exfat_close ( ef -> dev ) ; free ( ef ->

Fix:
<S2SV_ModStart> exfat_error ( "exFAT <S2SV_blank> file <S2SV_blank> system <S2SV_blank> is <S2SV_blank> not <S2SV_blank> found" ) ; return - EIO ; } if ( ef -> sb -> sector_bits < 9 ) { exfat_close ( ef -> dev ) ; exfat_error ( "too <S2SV_blank> small <S2SV_blank> sector <S2SV_blank> size: <S2SV_blank> 2^%hhd", ef -> sb -> sector_bits ) ; free ( ef -> sb ) ; return - EIO ; } if ( ( int ) ef -> sb -> sector_bits + ( int ) ef -> sb -> spc_bits > 25 ) { exfat_close ( ef -> dev ) ; exfat_error ( "too <S2SV_blank> big <S2SV_blank> cluster <S2SV_blank> size: <S2SV_blank> 2^(%hhd+%hhd)", ef -> sb -> sector_bits, ef -> sb -> spc_bits ) ; free ( ef -> sb <S2SV_ModStart> } if ( <S2SV_ModEnd> le64_to_cpu ( ef
Buggy code:
 static int jpc_pi_nextcprl ( register jpc_pi_t * pi ) { int rlvlno ; jpc_pirlvl_t * pirlvl ; jpc_pchg_t * pchg ; int prchind ; int prcvind ; int * prclyrno ; uint_fast32_t trx0 ; uint_fast32_t try0 ; uint_fast32_t r ; uint_fast32_t rpx ; uint_fast32_t rpy ; pchg = pi -> pchg ; if (! pi -> prgvolfirst ) { goto skip ; } else { pi -> prgvolfirst = 0 ; } for ( pi -> compno = pchg -> compnostart, pi -> picomp = & pi -> picomps [ pi -> compno ] ; pi -> compno < JAS_CAST ( int, pchg -> compnoend ) && pi -> compno < pi -> numcomps ; ++ pi -> compno, ++ pi -> picomp ) { <START_BUG> pirlvl = pi -> picomp -> pirlvls ; <END_BUG> pi -> xstep = pi -> picomp -> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls - 1 ) ) ; pi -> ystep = pi -> picomp -> vsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << ( pirlvl -> prcheightexpn + pi -> picomp -> numrlvls - 1 ) ) ; for ( rlvlno = 1, pirlvl = & pi -> picomp -> pirlvls [ 1 ] ; rlvlno < pi -> picomp -> numrlvls ; ++ rlvlno, ++ pirlvl ) { pi -> xstep = JAS_MIN ( pi -> xstep, pi -> picomp -> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls - rlvlno - 1 ) ) ) ; pi -> ystep = JAS_MIN ( pi -> ystep, pi -> picomp -> vsamp * ( JAS_CAST ( uint_

Fix:
<S2SV_ModStart> -> pirlvls ; if ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls > JAS_UINTFAST32_NUMBITS - 2 || pirlvl -> prcheightexpn + pi -> picomp -> numrlvls > JAS_UINTFAST32_NUMBITS - 2 ) { return - 1 ; } <S2SV_ModStart> ) % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpx ) <S2SV_ModStart> ) % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpy )
Buggy code:
 static void scsi_dma_restart_bh ( void * opaque ) { SCSIDiskState * s = opaque ; SCSIRequest * req ; SCSIDiskReq * r ; qemu_bh_delete ( s -> bh ) ; s -> bh = NULL ; QTAILQ_FOREACH ( req, & s -> qdev. requests, next ) { r = DO_UPCAST ( SCSIDiskReq, req, req ) ; if ( r -> status & SCSI_REQ_STATUS_RETRY ) { int status = r -> status ; int ret ; r -> status &= ~ ( SCSI_REQ_STATUS_RETRY | SCSI_REQ_STATUS_RETRY_TYPE_MASK ) ; switch ( status & SCSI_REQ_STATUS_RETRY_TYPE_MASK ) { case SCSI_REQ_STATUS_RETRY_READ : scsi_read_data ( & r -> req ) ; break ; case SCSI_REQ_STATUS_RETRY_WRITE : scsi_write_data ( & r -> req ) ; break ; case SCSI_REQ_STATUS_RETRY_FLUSH : <START_BUG> ret = scsi_disk_emulate_command ( r, r -> iov. iov_base ) ; <END_BUG> if ( ret == 0 ) { scsi_req_complete ( & r -> req, GOOD ) ; } } } } }

Fix:
<S2SV_ModStart> scsi_disk_emulate_command ( r <S2SV_ModEnd> ) ; if
Buggy code:
 DH * get_dh2048 ( void ) { static unsigned char dhp_2048 [ ] = { <START_BUG> 0xD5, 0x75, 0xF1, 0x23, 0xC1, 0x81, 0x4B, 0x44, 0x23, 0xBE, <END_BUG> 0x97, 0x81, 0x7A, 0xDA, 0x97, 0x1F, 0x1F, 0x0D, 0xD5, 0xEC,  0xC5, 0x5F, 0x86, 0x42, 0x7F, 0x38, 0xA3, 0x95, 0xEE, 0xA0, <START_BUG> 0x52, 0x2C, 0xB7, 0x20, 0x29, 0xC1, 0xC7, 0xE6, 0x8E, 0x6F, 0xE5, 0xC1, 0x0D, 0xDD, 0x8A, 0xEF, 0x8D, 0xE7, 0xA8, 0x63, 0xB4, 0xF7, 0x58, 0x32, 0x0E, 0x24, 0xAC, 0x30, 0x94, 0xF5, 0xC7, 0x02, 0x81, 0x1B, 0xC7, 0x68, 0xE5, 0x71, 0xD7, 0x1E, 0x3D, 0xE4, 0x2E, 0x2F, 0xC0, 0x0A, 0xED, 0x34, 0xAC, 0xC0, 0x1F, 0x0A, 0x56, 0xA4, 0x12, 0x02, 0xFD, 0x68, 0xD2, 0x4D, 0x5E, 0x0A, 0x5D, 0x78, 0xE3, 0xA0, 0x85, 0x75, 0xD2, 0xA9, 0xC1, 0xF2, 0xAD, 0x65, 0x11, 0xDE, 0xE8, 0x05, 0x68, 0x36, 0x4C, 0x92, 0x99,<END_BUG>

Fix:
<S2SV_ModStart> ] = { 0xCF, 0x9F, 0x3A, 0x9C, 0xC5, 0xA5, 0x89, 0x27, 0x6D, 0x2C, 0x2C, 0xF3, 0xA6, 0x00, 0xD2, 0x7C, 0xEA, 0xFA, 0xF2, 0x43, 0x4F, 0x49, 0x0A, 0xFC, 0xA6, 0xE7, 0x75, 0xCA, 0x07, 0xDC, 0xA5, 0xF2, 0x83, 0x4E, 0x5A, 0xA0, 0xA0, 0xF5, 0x9C, 0xFD, 0x02, 0xE6, 0x9E, 0xFC, 0x01, 0x59, 0xD7, 0xB6, 0xC1, 0x4E, 0xC0, 0xB6, 0x71, 0x49, 0xF0, 0xC7, 0xD5, 0x2F, 0x8
Buggy code:
 static void __xen_evtchn_do_upcall ( void ) { struct vcpu_info * vcpu_info = __this_cpu_read ( xen_vcpu ) ; int cpu = smp_processor_id ( ) ; <START_BUG> read_lock ( & evtchn_rwlock ) ; <END_BUG> do { vcpu_info -> evtchn_upcall_pending = 0 ;  xen_evtchn_handle_events ( cpu ) ; <START_BUG> BUG_ON (! irqs_disabled ( ) ) ; virt_rmb ( ) ; } while ( vcpu_info -> evtchn_upcall_pending ) ; read_unlock ( & evtchn_rwlock ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> ( ) ; struct evtchn_loop_ctrl ctrl = { 0 } ; <S2SV_ModStart> xen_evtchn_handle_events ( cpu, & ctrl <S2SV_ModStart> evtchn_rwlock ) ; __this_cpu_inc ( irq_epoch ) ;
Buggy code:
 static int sco_sock_getsockopt_old ( struct socket * sock, int optname, char __user * optval, int __user * optlen ) { struct sock * sk = sock -> sk ; struct sco_options opts ; struct sco_conninfo cinfo ; int len, err = 0 ; BT_DBG ( "sk   %p", sk ) ; if ( get_user ( len, optlen ) ) return - EFAULT ; lock_sock ( sk ) ; switch ( optname ) { case SCO_OPTIONS : if ( sk -> sk_state!= BT_CONNECTED ) { err = - ENOTCONN ; break ; } opts. mtu = sco_pi ( sk ) -> conn -> mtu ; BT_DBG ( "mtu   %d", opts. mtu ) ; len = min_t ( unsigned int, len, sizeof ( opts ) ) ; if ( copy_to_user ( optval, ( char * ) & opts, len ) ) err = - EFAULT ; break ; case SCO_CONNINFO : if ( sk -> sk_state!= BT_CONNECTED ) { err = - ENOTCONN ; break ; } <START_BUG> cinfo. hci_handle = sco_pi ( sk ) -> conn -> hcon -> handle ; <END_BUG> memcpy ( cinfo. dev_class, sco_pi ( sk ) -> conn -> hcon -> dev_class, 3 ) ; len = min_t ( unsigned int, len, sizeof ( cinfo ) ) ; if ( copy_to_user ( optval, ( char * ) & cinfo, len ) ) err = - EFAULT ; break ; default : err = - ENOPROTOOPT ; break ; } release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> break ; } memset ( & cinfo, 0, sizeof ( cinfo ) ) ;
Buggy code:
 void luaV_execute ( lua_State * L, CallInfo * ci ) { LClosure * cl ; TValue * k ; StkId base ; const Instruction * pc ; int trap ; # if LUA_USE_JUMPTABLE # include "ljumptab.h" # endif tailcall : trap = L -> hookmask ; cl = clLvalue ( s2v ( ci -> func ) ) ; k = cl -> p -> k ; pc = ci -> u. l. savedpc ; if ( trap ) { if ( cl -> p -> is_vararg ) trap = 0 ; else if ( pc == cl -> p -> code ) luaD_hookcall ( L, ci ) ; ci -> u. l. trap = 1 ; } base = ci -> func + 1 ; for ( ; ; ) { Instruction i ; StkId ra ; vmfetch ( ) ; lua_assert ( base == ci -> func + 1 ) ; lua_assert ( base <= L -> top && L -> top < L -> stack + L -> stacksize ) ; lua_assert ( isIT ( i ) || ( cast_void ( L -> top = base ), 1 ) ) ; vmdispatch ( GET_OPCODE ( i ) ) { vmcase ( OP_MOVE ) { setobjs2s ( L, ra, RB ( i ) ) ; vmbreak ; } vmcase ( OP_LOADI ) { lua_Integer b = GETARG_sBx ( i ) ; setivalue ( s2v ( ra ), b ) ; vmbreak ; } vmcase ( OP_LOADF ) { int b = GETARG_sBx ( i ) ; setfltvalue ( s2v ( ra ), cast_num ( b ) ) ; vmbreak ; } vmcase ( OP_LOADK ) { TValue * rb = k + GETARG_Bx ( i ) ; setobj2s ( L, ra, rb ) ; vmbreak ; } vmcase ( OP_LOADKX ) { TValue * rb ; rb = k + GETARG_Ax ( * pc ) ; pc ++ ; setobj2s ( L, ra, rb ) ; vmbreak ; } vmcase ( OP_LOADFALSE ) { setbfvalue ( s2v ( ra ) ) ; vmbreak ; } vmcase ( OP_

Fix:
<S2SV_ModStart> -> oldpc = <S2SV_ModEnd> 1 ; }
Buggy code:
 static unsigned int do_16x16_motion_iteration ( VP9_COMP * cpi, const MV * ref_mv, MV * dst_mv, int mb_row, int mb_col ) { <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> MACROBLOCKD * const xd = & x -> e_mbd ;  vp9_variance_fn_ptr_t v_fn_ptr = cpi -> fn_ptr [ BLOCK_16X16 ] ; <START_BUG> const int tmp_col_min = x -> mv_col_min ; const int tmp_col_max = x -> mv_col_max ; const int tmp_row_min = x -> mv_row_min ; const int tmp_row_max = x -> mv_row_max ; MV ref_full ; <END_BUG> int step_param = cpi -> sf. reduce_first_step_size +  ( cpi -> speed < 8? ( cpi -> speed > 5? 1 : 0 ) : 2 ) ; <START_BUG> step_param = MIN ( step_param, ( cpi -> sf. max_step_search_steps - 2 ) ) ; <END_BUG> vp9_set_mv_search_range ( x, ref_mv ) ; ref_full. col = ref_mv -> col >> 3 ; ref_full. row = ref_mv -> row >> 3 ;  vp9_hex_search ( x, & ref_full, step_param, x -> errorperbit, 0, & v_fn_ptr, 0, <START_BUG> ref_mv, dst_mv ) ; { int distortion ; unsigned int sse ; cpi -> find_fractional_mv_step ( x, dst_mv, ref_mv, cpi -> common. allow_high_precision_mv, x -> errorperbit, <END_BUG> & v_fn_ptr, 0, cpi -> sf. subpel_iters_per_step, NULL, NULL, & distortion,  <START_BUG> & sse ) ; <END_BUG> } xd -> mi [ 0 ] -> mbmi. mode = NEWMV ; xd -> mi [ 0 ] -> mbmi. mv [ 0 ]. as_mv = * dst_mv ; vp9_build_inter_predictors_sby ( xd, mb_row, mb_col, BLOCK_16X16 ) ;

Fix:
<S2SV_ModStart> & cpi -> td. <S2SV_ModStart> -> e_mbd ; const MV_SPEED_FEATURES * const mv_sf = & cpi -> sf. mv ; const <S2SV_ModStart> ref_full ; int cost_list [ 5 ] ; int step_param = mv_sf -> reduce_first_step_size <S2SV_ModEnd> ; step_param = <S2SV_ModStart> ( step_param, MAX_MVSEARCH_STEPS - 2 <S2SV_ModEnd> ) ; vp9_set_mv_search_range <S2SV_ModStart>, 0, cond_cost_list ( cpi, cost_list ), <S2SV_ModStart>, 0, mv_sf -> subpel_iters_per_step, cond_cost_list ( cpi, cost_list ), <S2SV_ModEnd> NULL, NULL <S2SV_ModStart>, & sse, NULL, 0, 0 <S2SV_ModStart> tmp_row_max ; return vpx_sad16x16 <S2SV_ModEnd> ( x -> <S2SV_ModStart> dst. stride <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> static void <END_BUG> ast_clear ( AST_object * self ) { Py_CLEAR ( self -> dict ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> ast_clear ( AST_object <S2SV_ModStart> dict ) ; return 0 ;
Buggy code:
 static ngx_int_t ngx_http_send_error_page ( ngx_http_request_t * r, ngx_http_err_page_t * err_page ) { ngx_int_t overwrite ; ngx_str_t uri, args ; ngx_table_elt_t * location ; ngx_http_core_loc_conf_t * clcf ; overwrite = err_page -> overwrite ; if ( overwrite && overwrite!= NGX_HTTP_OK ) { r -> expect_tested = 1 ; } if ( overwrite >= 0 ) { r -> err_status = overwrite ; } if ( ngx_http_complex_value ( r, & err_page -> value, & uri )!= NGX_OK ) { return NGX_ERROR ; } if ( uri. len && uri. data [ 0 ] == '//' ) { if ( err_page -> value. lengths ) { ngx_http_split_args ( r, & uri, & args ) ; } else { args = err_page -> args ; } if ( r -> method!= NGX_HTTP_HEAD ) { r -> method = NGX_HTTP_GET ; r -> method_name = ngx_http_core_get_method ; } return ngx_http_internal_redirect ( r, & uri, & args ) ; } if ( uri. len && uri. data [ 0 ] == '@' ) { return ngx_http_named_location ( r, & uri ) ; } <START_BUG> location = ngx_list_push ( & r -> headers_out. headers ) ; <END_BUG> if ( location == NULL ) { return NGX_ERROR ; } if ( overwrite!= NGX_HTTP_MOVED_PERMANENTLY && overwrite!= NGX_HTTP_MOVED_TEMPORARILY && overwrite!= NGX_HTTP_SEE_OTHER && overwrite!= NGX_HTTP_TEMPORARY_REDIRECT && overwrite!= NGX_HTTP_PERMANENT_REDIRECT ) { r -> err_status = NGX_HTTP_MOVED_TEMPORARILY ; } location -> hash = 1 ; ngx_str_set ( & location -> key, "Location" ) ; location -> value = uri ; ngx_http_clear_location ( r

Fix:
<S2SV_ModStart> ) ; } r -> expect_tested = 1 ; if ( ngx_http_discard_request_body ( r )!= NGX_OK ) { r -> keepalive = 0 ; }
Buggy code:
 void send_file_direct ( char * file_name ) { int fh, i, length, delta ; char str [ MAX_PATH_LENGTH ], dir [ MAX_PATH_LENGTH ], charset [ 80 ] ; getcwd ( dir, sizeof ( dir ) ) ; fh = open ( file_name, O_RDONLY | O_BINARY ) ; if ( fh > 0 ) { lseek ( fh, 0, SEEK_END ) ; length = TELL ( fh ) ; lseek ( fh, 0, SEEK_SET ) ; rsprintf ( "HTTP//1.1   200   Document   follows\\r\\n" ) ; rsprintf ( "Server:   ELOG   HTTP   %s-%s\\r\\n", VERSION, git_revision ( ) ) ; rsprintf ( "Accept-Ranges:   bytes\\r\\n" ) ; if ( isparam ( "thumb" ) ) { rsprintf ( "Pragma:   no-cache\\r\\n" ) ; rsprintf ( "Cache-control:   private,   max-age=0,   no-cache,   no-store\\r\\n" ) ; } else { rsprintf ( "Cache-control:   public,   max-age=86400\\r\\n" ) ; } if ( keep_alive ) { rsprintf ( "Connection:   Keep-Alive\\r\\n" ) ; rsprintf ( "Keep-Alive:   timeout=60,   max=10\\r\\n" ) ; } for ( i = 0 ; i < ( int ) strlen ( file_name ) ; i ++ ) str [ i ] = toupper ( file_name [ i ] ) ; str [ i ] = 0 ; for ( i = 0 ; filetype [ i ]. ext [ 0 ] ; i ++ ) if ( chkext ( str, filetype [ i ]. ext ) ) break ; if (! getcfg ( "global", "charset", charset, sizeof ( charset ) ) ) strcpy ( charset, DEFAULT_HTTP_CHARSET ) ; if ( filetype [ i ]. ext [ 0 ] ) { if ( strncmp ( filetype [ i ]. type, "text", 4 ) == 0 ) rsprintf ( "Content-Type:   %s;charset=%s\\r\\n", filetype [ i ]. type, charset

Fix:
<S2SV_ModStart> charset ) ; else if ( strcmp ( filetype [ i ]. ext, ".SVG" ) == 0 ) { rsprintf ( "Content-Type: <S2SV_blank> %s\\r\\n", filetype [ i ]. type ) ; if ( strrchr ( file_name, '//' ) ) strlcpy ( str, strrchr ( file_name, '//' ) + 1, sizeof ( str ) ) ; else strlcpy ( str, file_name, sizeof ( str ) ) ; if ( str [ 6 ] == '_' && str [ 13 ] == '_' ) rsprintf ( "Content-Disposition: <S2SV_blank> attachment; <S2SV_blank> filename=\\"%s\\"\\r\\n", str + 14 ) ; else rsprintf ( "Content-Disposition: <S2SV_blank> attachment; <S2SV_blank> filename=\\"%s\\"\\r\\n", str ) ; }
Buggy code:
 static void sas_resume_port ( struct asd_sas_phy * phy ) { struct domain_device * dev ; struct asd_sas_port * port = phy -> port ; struct sas_ha_struct * sas_ha = phy -> ha ; struct sas_internal * si = to_sas_internal ( sas_ha -> core. shost -> transportt ) ; if ( si -> dft -> lldd_port_formed ) si -> dft -> lldd_port_formed ( phy ) ; if ( port -> suspended ) port -> suspended = 0 ; else { return ; } list_for_each_entry ( dev, & port -> dev_list, dev_list_node ) { int i, rc ; rc = sas_notify_lldd_dev_found ( dev ) ; if ( rc ) { <START_BUG> sas_unregister_dev ( port, dev ) ; <END_BUG> continue ; } if ( dev -> dev_type == SAS_EDGE_EXPANDER_DEVICE || dev -> dev_type == SAS_FANOUT_EXPANDER_DEVICE ) { dev -> ex_dev. ex_change_count = - 1 ; for ( i = 0 ; i < dev -> ex_dev. num_phys ; i ++ ) { struct ex_phy * phy = & dev -> ex_dev. ex_phy [ i ] ; phy -> phy_change_count = - 1 ; } } } sas_discover_event ( port, DISCE_RESUME ) ; }

Fix:
<S2SV_ModStart> port, dev ) ; sas_destruct_devices ( port
Buggy code:
 int ssl3_get_cert_verify ( SSL * s ) { EVP_PKEY * pkey = NULL ; unsigned char * p ; int al, ok, ret = 0 ; long n ; int type = 0, i, j ; X509 * peer ; const EVP_MD * md = NULL ; EVP_MD_CTX mctx ; EVP_MD_CTX_init ( & mctx ) ; n = s -> method -> ssl_get_message ( s, SSL3_ST_SR_CERT_VRFY_A, SSL3_ST_SR_CERT_VRFY_B, - 1, SSL3_RT_MAX_PLAIN_LENGTH, & ok ) ; if (! ok ) return ( ( int ) n ) ; if ( s -> session -> peer!= NULL ) { peer = s -> session -> peer ; pkey = X509_get_pubkey ( peer ) ; type = X509_certificate_type ( peer, pkey ) ; } else { peer = NULL ; pkey = NULL ; } if ( s -> s3 -> tmp. message_type!= SSL3_MT_CERTIFICATE_VERIFY ) { s -> s3 -> tmp. reuse_message = 1 ; <START_BUG> if ( ( peer!= NULL ) && ( type & EVP_PKT_SIGN ) ) <END_BUG> { al = SSL_AD_UNEXPECTED_MESSAGE ; SSLerr ( SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_MISSING_VERIFY_MESSAGE ) ; goto f_err ; } ret = 1 ; goto end ; } if ( peer == NULL ) { SSLerr ( SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_NO_CLIENT_CERT_RECEIVED ) ; al = SSL_AD_UNEXPECTED_MESSAGE ; goto f_err ; } if (! ( type & EVP_PKT_SIGN ) ) { SSLerr ( SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE ) ; al = SSL_AD_ILLEGAL_PARAMETER ; goto f_err ; } if ( s -> s3 -> change_cipher_spec ) { SSLerr ( SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_CCS_RECEIVED_EARLY ) ; al = SSL_AD_UN

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> peer!= NULL <S2SV_ModStart> peer!= NULL <S2SV_ModEnd> ) { al
Buggy code:
 <START_BUG> static void <END_BUG> fpDiff ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; uint32 bps = tif -> tif_dir. td_bitspersample // 8 ; tmsize_t wc = cc // bps ; tmsize_t count ; uint8 * cp = ( uint8 * ) cp0 ; uint8 * tmp = ( uint8 * ) _TIFFmalloc ( cc ) ;  assert ( ( cc % ( bps * stride ) ) == 0 ) ; <START_BUG> if (! tmp ) <END_BUG> return ;  _TIFFmemcpy ( tmp, cp0, cc ) ; for ( count = 0 ; count < wc ; count ++ ) { uint32 byte ; for ( byte = 0 ; byte < bps ; byte ++ ) { # if WORDS_BIGENDIAN cp [ byte * wc + count ] = tmp [ bps * count + byte ] ; # else cp [ ( bps - byte - 1 ) * wc + count ] = tmp [ bps * count + byte ] ; # endif } } _TIFFfree ( tmp ) ; cp = ( uint8 * ) cp0 ; cp += cc - stride - 1 ; for ( count = cc ; count > stride ; count -= stride ) REPEAT4 ( stride, cp [ stride ] = ( unsigned char ) ( ( cp [ stride ] - cp [ 0 ] ) & 0xff ) ; cp -- ) <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> fpDiff ( TIFF <S2SV_ModStart> cc ) ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> stride ) )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "fpDiff", "%s", "(cc%(bps*stride))!=0" ) ; return 0 ; } <S2SV_ModEnd> if (! <S2SV_ModStart> tmp ) return 0 <S2SV_ModStart> cp -- ) return 1 ;
Buggy code:
 int sock_setsockopt ( struct socket * sock, int level, int optname, char __user * optval, unsigned int optlen ) { struct sock * sk = sock -> sk ; int val ; int valbool ; struct linger ling ; int ret = 0 ; if ( optname == SO_BINDTODEVICE ) return sock_bindtodevice ( sk, optval, optlen ) ; if ( optlen < sizeof ( int ) ) return - EINVAL ; if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; valbool = val? 1 : 0 ; lock_sock ( sk ) ; switch ( optname ) { case SO_DEBUG : if ( val &&! capable ( CAP_NET_ADMIN ) ) ret = - EACCES ; else sock_valbool_flag ( sk, SOCK_DBG, valbool ) ; break ; case SO_REUSEADDR : sk -> sk_reuse = ( valbool? SK_CAN_REUSE : SK_NO_REUSE ) ; break ; case SO_TYPE : case SO_PROTOCOL : case SO_DOMAIN : case SO_ERROR : ret = - ENOPROTOOPT ; break ; case SO_DONTROUTE : sock_valbool_flag ( sk, SOCK_LOCALROUTE, valbool ) ; break ; case SO_BROADCAST : sock_valbool_flag ( sk, SOCK_BROADCAST, valbool ) ; break ; case SO_SNDBUF : val = min_t ( u32, val, sysctl_wmem_max ) ; set_sndbuf : sk -> sk_userlocks |= SOCK_SNDBUF_LOCK ; sk -> sk_sndbuf = max_t ( u32, val * 2, SOCK_MIN_SNDBUF ) ; sk -> sk_write_space ( sk ) ; break ; case SO_SNDBUFFORCE : if (! capable ( CAP_NET_ADMIN ) ) { ret = - EPERM ; break ; } goto set_sndbuf ; case SO_RCVBUF : val = min_t ( u32, val, sysctl_rmem_max ) ; set_rcvbuf : sk -> sk_userlocks |= SOCK_RCVBUF_LOCK ; sk -> sk_rcvbuf

Fix:
<S2SV_ModStart> sk_protocol == IPPROTO_TCP && sk -> sk_type == SOCK_STREAM
Buggy code:
 static int rds_ib_laddr_check ( __be32 addr ) { int ret ; struct rdma_cm_id * cm_id ; struct sockaddr_in sin ; cm_id = rdma_create_id ( NULL, NULL, RDMA_PS_TCP, IB_QPT_RC ) ; if ( IS_ERR ( cm_id ) ) return PTR_ERR ( cm_id ) ; memset ( & sin, 0, sizeof ( sin ) ) ; sin. sin_family = AF_INET ; sin. sin_addr. s_addr = addr ; ret = rdma_bind_addr ( cm_id, ( struct sockaddr * ) & sin ) ; <START_BUG> if ( ret || cm_id -> device -> node_type!= RDMA_NODE_IB_CA ) <END_BUG> ret = - EADDRNOTAVAIL ; rdsdebug ( "addr   %pI4   ret   %d   node   type   %d\\n", & addr, ret, cm_id -> device? cm_id -> device -> node_type : - 1 ) ; rdma_destroy_id ( cm_id ) ; return ret ; }

Fix:
<S2SV_ModStart> ( ret ||! cm_id -> device ||
Buggy code:
 static void encode_loopfilter ( struct loopfilter * lf, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG> int i ;  vp9_wb_write_literal ( wb, lf -> filter_level, 6 ) ; <START_BUG> <END_BUG> vp9_wb_write_literal ( wb, lf -> sharpness_level, 3 ) ;  <START_BUG> vp9_wb_write_bit ( wb, lf -> mode_ref_delta_enabled ) ; <END_BUG> if ( lf -> mode_ref_delta_enabled ) {  vp9_wb_write_bit ( wb, lf -> mode_ref_delta_update ) ; <START_BUG> if ( lf -> mode_ref_delta_update ) { for ( i = 0 ; i < MAX_REF_LF_DELTAS ; i ++ ) { const int delta = lf -> ref_deltas [ i ] ; const int changed = delta!= lf -> last_ref_deltas [ i ] ; <END_BUG> vp9_wb_write_bit ( wb, changed ) ;  if ( changed ) { lf -> last_ref_deltas [ i ] = delta ; <START_BUG> vp9_wb_write_literal ( wb, abs ( delta ) & 0x3F, 6 ) ; <END_BUG>  vp9_wb_write_bit ( wb, delta < 0 ) ; <START_BUG> } } for ( i = 0 ; i < MAX_MODE_LF_DELTAS ; i ++ ) { const int delta = lf -> mode_deltas [ i ] ; const int changed = delta!= lf -> last_mode_deltas [ i ] ; <END_BUG> vp9_wb_write_bit ( wb, changed ) ;  if ( changed ) { lf -> last_mode_deltas [ i ] = delta ; <START_BUG> vp9_wb_write_literal ( wb, abs ( delta ) & 0x3F, 6 ) ; <END_BUG>  vp9_wb_write_bit ( wb, delta < 0 ) ; <START_BUG> } } } } }<END_BUG>

Fix:
<S2SV_ModStart> lf, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> int i ; vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 6 ) ; vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 3 ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> mode_ref_delta_enabled ) { vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> i ] ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> = delta ; vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 6 ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> i ] ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> = delta ; vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 6 ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb,
Buggy code:
 int WavpackVerifySingleBlock ( unsigned char * buffer, int verify_checksum ) { WavpackHeader * wphdr = ( WavpackHeader * ) buffer ; uint32_t checksum_passed = 0, bcount, meta_bc ; unsigned char * dp, meta_id, c1, c2 ; if ( strncmp ( wphdr -> ckID, "wvpk", 4 ) || wphdr -> ckSize + 8 < sizeof ( WavpackHeader ) ) return FALSE ; bcount = wphdr -> ckSize - sizeof ( WavpackHeader ) + 8 ; dp = ( unsigned char * ) ( wphdr + 1 ) ; while ( bcount >= 2 ) { meta_id = * dp ++ ; c1 = * dp ++ ; meta_bc = c1 << 1 ; bcount -= 2 ; if ( meta_id & ID_LARGE ) { if ( bcount < 2 ) return FALSE ; c1 = * dp ++ ; c2 = * dp ++ ; meta_bc += ( ( uint32_t ) c1 << 9 ) + ( ( uint32_t ) c2 << 17 ) ; bcount -= 2 ; } if ( bcount < meta_bc ) return FALSE ; if ( verify_checksum && ( meta_id & ID_UNIQUE ) == ID_BLOCK_CHECKSUM ) { # ifdef BITSTREAM_SHORTS uint16_t * csptr = ( uint16_t * ) buffer ; # else unsigned char * csptr = buffer ; # endif int wcount = ( int ) ( dp - 2 - buffer ) >> 1 ; uint32_t csum = ( uint32_t ) - 1 ; if ( ( meta_id & ID_ODD_SIZE ) || meta_bc < 2 || meta_bc > 4 ) return FALSE ; # ifdef BITSTREAM_SHORTS while ( wcount -- ) csum = ( csum * 3 ) + * csptr ++ ; # else WavpackNativeToLittleEndian ( ( WavpackHeader * ) buffer, WavpackHeaderFormat ) ; while ( wcount -- ) { csum = ( csum * 3 ) + csptr [ 0 ] + ( csptr [ 1 ] << 8 ) ; csptr += 2 ; } WavpackLittleEndianToNative ( ( WavpackHeader * ) buffer, WavpackHeaderFormat

Fix:
<S2SV_ModStart> ( * dp <S2SV_ModEnd>!= ( csum <S2SV_ModStart> 0xff ) || dp [ 1 ] <S2SV_ModEnd>!= ( ( <S2SV_ModStart> 0xff ) || dp [ 2 ] <S2SV_ModEnd>!= ( ( <S2SV_ModStart> 0xff ) || dp [ 3 ] <S2SV_ModEnd>!= ( ( <S2SV_ModStart> ( * dp <S2SV_ModEnd>!= ( csum <S2SV_ModStart> 0xff ) || dp [ 1 ] <S2SV_ModEnd>!= ( (
Buggy code:
 static void ffs_user_copy_worker ( struct work_struct * work ) { struct ffs_io_data * io_data = container_of ( work, struct ffs_io_data, work ) ; int ret = io_data -> req -> status? io_data -> req -> status : io_data -> req -> actual ; <START_BUG> if ( io_data -> read && ret > 0 ) { <END_BUG> use_mm ( io_data -> mm ) ; ret = copy_to_iter ( io_data -> buf, ret, & io_data -> data ) ; if ( iov_iter_count ( & io_data -> data ) ) ret = - EFAULT ; unuse_mm ( io_data -> mm ) ; } io_data -> kiocb -> ki_complete ( io_data -> kiocb, ret, ret ) ; if ( io_data -> ffs -> ffs_eventfd && ! ( io_data -> kiocb -> ki_flags & IOCB_EVENTFD ) ) <START_BUG> eventfd_signal ( io_data -> ffs -> ffs_eventfd, 1 ) ; <END_BUG> usb_ep_free_request ( io_data -> ep, io_data -> req ) ;  io_data -> kiocb -> private = NULL ; if ( io_data -> read ) kfree ( io_data -> to_free ) ; kfree ( io_data -> buf ) ; kfree ( io_data ) ; }

Fix:
<S2SV_ModStart> -> actual ; bool kiocb_has_eventfd = <S2SV_ModEnd> io_data -> kiocb <S2SV_ModStart> ki_flags & IOCB_EVENTFD ; if ( io_data -> read && ret > 0 ) { use_mm ( io_data -> mm ) ; ret = copy_to_iter ( io_data -> buf, ret, & io_data -> data ) ; if ( iov_iter_count ( & io_data -> data ) ) ret = - EFAULT ; unuse_mm ( io_data -> mm ) ; } io_data -> kiocb -> ki_complete ( io_data -> kiocb, ret, ret ) ; if ( io_data -> ffs -> ffs_eventfd &&! kiocb_has_eventfd <S2SV_ModEnd> ) eventfd_signal ( <S2SV_ModStart> -> req ) <S2SV_ModEnd> ; if (