nus-yam/ex-repair huggingface dataset:
Buggy code:
 int encode_msg ( struct sip_msg * msg, char * payload, int len ) { int i, j, k, u, request ; unsigned short int h ; struct hdr_field * hf ; struct msg_start * ms ; struct sip_uri miuri ; char * myerror = NULL ; ptrdiff_t diff ; if ( len < MAX_ENCODED_MSG + MAX_MESSAGE_LEN ) return - 1 ; if ( parse_headers ( msg, HDR_EOH_F, 0 ) < 0 ) { myerror = "in   parse_headers" ; goto error ; } memset ( payload, 0, len ) ; ms = & msg -> first_line ; if ( ms -> type == SIP_REQUEST ) request = 1 ; else if ( ms -> type == SIP_REPLY ) request = 0 ; else { myerror = "message   is   neither   request   nor   response" ; goto error ; } if ( request ) { for ( h = 0 ; h < 32 ; j = ( 0x01 << h ), h ++ ) if ( j & ms -> u. request. method_value ) break ; } else { h = ( unsigned short ) ( ms -> u. reply. statuscode ) ; } if ( h == 32 ) { myerror = "unknown   message   type\\n" ; goto error ; } h = htons ( h ) ; memcpy ( payload, & h, 2 ) ; h = htons ( ( unsigned short int ) msg -> len ) ; memcpy ( & payload [ MSG_LEN_IDX ], & h, 2 ) ; if ( 0 > ( diff = ( get_body ( msg ) - ( msg -> buf ) ) ) ) { myerror = "body   starts   before   the   message   (uh  ?)" ; goto error ; } else h = htons ( ( unsigned short int ) diff ) ; memcpy ( payload + CONTENT_IDX, & h, 2 ) ; payload [ METHOD_CODE_IDX ] = ( unsigned char ) ( request? ( ms -> u. request. method. s - msg -> buf ) : ( ms -> u. reply. status. s - msg -> buf ) ) ; payload [ METHOD_CODE_IDX + 1 ] = ( unsigned char ) ( request? ( ms -> u. request.

Fix:
<S2SV_ModStart> j ) ; if ( len < j + msg -> len + 1 ) { LM_ERR ( "not <S2SV_blank> enough <S2SV_blank> space <S2SV_blank> to <S2SV_blank> encode <S2SV_blank> sip <S2SV_blank> message\\n" ) ; return - 1 ; }
Buggy code:
 static void unqueue_me_pi ( struct futex_q * q ) { WARN_ON ( plist_node_empty ( & q -> list ) ) ; plist_del ( & q -> list, & q -> list. plist ) ; BUG_ON (! q -> pi_state ) ; free_pi_state ( q -> pi_state ) ; q -> pi_state = NULL ; spin_unlock ( q -> lock_ptr ) ; <START_BUG> drop_futex_key_refs ( & q -> key ) ; <END_BUG> }

Fix:
<S2SV_ModStart> lock_ptr ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int ip6_find_1stfragopt ( struct sk_buff * skb, u8 * * nexthdr ) { <START_BUG> u16 offset = sizeof ( struct ipv6hdr ) ; <END_BUG> struct ipv6_opt_hdr * exthdr = ( struct ipv6_opt_hdr * ) ( ipv6_hdr ( skb ) + 1 ) ; unsigned int packet_len = skb_tail_pointer ( skb ) - skb_network_header ( skb ) ; int found_rhdr = 0 ; * nexthdr = & ipv6_hdr ( skb ) -> nexthdr ;  while ( offset + 1 <= packet_len ) { <START_BUG> <END_BUG> switch ( * * nexthdr ) {  case NEXTHDR_HOP : break ; case NEXTHDR_ROUTING : found_rhdr = 1 ; break ; case NEXTHDR_DEST : # if IS_ENABLED ( CONFIG_IPV6_MIP6 ) if ( ipv6_find_tlv ( skb, offset, IPV6_TLV_HAO ) >= 0 ) break ; # endif if ( found_rhdr ) return offset ; break ; default : return offset ; } <START_BUG> offset += ipv6_optlen ( exthdr ) ; <END_BUG> * nexthdr = & exthdr -> nexthdr ;  exthdr = ( struct ipv6_opt_hdr * ) ( skb_network_header ( skb ) + <START_BUG> offset ) ; } return offset ; }<END_BUG>

Fix:
<S2SV_ModStart> ( struct ipv6hdr <S2SV_ModEnd> ) ; unsigned <S2SV_ModStart> while ( offset <S2SV_ModEnd> <= packet_len ) <S2SV_ModStart> packet_len ) { struct ipv6_opt_hdr * exthdr ; <S2SV_ModStart> offset ; } if ( offset + sizeof ( struct ipv6_opt_hdr ) > packet_len ) return - EINVAL ; exthdr = ( struct ipv6_opt_hdr * ) ( skb_network_header ( skb ) + offset ) ; <S2SV_ModStart> -> nexthdr ; } return - EINVAL <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static uint32_t color_string_to_rgba ( const char * p, int len ) { uint32_t ret = 0xFF000000 ; const ColorEntry * entry ; char color_name [ 100 ] ; <START_BUG> if ( * p == '#' ) { <END_BUG> p ++ ; len -- ; if ( len == 3 ) { ret |= ( hex_char_to_number ( p [ 2 ] ) << 4 ) | ( hex_char_to_number ( p [ 1 ] ) << 12 ) | ( hex_char_to_number ( p [ 0 ] ) << 20 ) ; } else if ( len == 4 ) { ret = ( hex_char_to_number ( p [ 3 ] ) << 4 ) | ( hex_char_to_number ( p [ 2 ] ) << 12 ) | ( hex_char_to_number ( p [ 1 ] ) << 20 ) | ( hex_char_to_number ( p [ 0 ] ) << 28 ) ; } else if ( len == 6 ) { ret |= hex_char_to_number ( p [ 5 ] ) | ( hex_char_to_number ( p [ 4 ] ) << 4 ) | ( hex_char_to_number ( p [ 3 ] ) << 8 ) | ( hex_char_to_number ( p [ 2 ] ) << 12 ) | ( hex_char_to_number ( p [ 1 ] ) << 16 ) | ( hex_char_to_number ( p [ 0 ] ) << 20 ) ; } else if ( len == 8 ) { ret = hex_char_to_number ( p [ 7 ] ) | ( hex_char_to_number ( p [ 6 ] ) << 4 ) | ( hex_char_to_number ( p [ 5 ] ) << 8 ) | ( hex_char_to_number ( p [ 4 ] ) << 12 ) | ( hex_char_to_number ( p [ 3 ] ) << 16 ) | ( hex_char_to_number ( p [ 2 ] ) << 20 ) | ( hex_char_to_number ( p [ 1 ] ) << 24 ) | ( hex_char_to_number ( p [ 0 ] ) << 28 ) ; } } else { strncpy ( color_name, p, len ) ; color_name [ len ] = '\\0' ; entry = bsearch

Fix:
<S2SV_ModStart> 100 ] ; len = FFMIN ( FFMAX ( len, 0 ), sizeof ( color_name ) - 1 ) ;
Buggy code:
 static vpx_codec_err_t decoder_decode ( vpx_codec_alg_priv_t * ctx, const uint8_t * data, unsigned int data_sz, void * user_priv, long deadline ) { const uint8_t * data_start = data ; <START_BUG> const uint8_t * data_end = data + data_sz ; <END_BUG>  vpx_codec_err_t res = VPX_CODEC_OK ; <START_BUG> uint32_t sizes [ 8 ] ; <END_BUG> int frames_this_pts, frame_count = 0 ;  <START_BUG> if ( data == NULL || data_sz == 0 ) <END_BUG>  return VPX_CODEC_INVALID_PARAM ; <START_BUG> <END_BUG> parse_superframe_index ( data, data_sz, sizes, & frames_this_pts ) ;  do { if ( data_sz && ( * data_start & 0xe0 ) == 0xc0 ) { <START_BUG> const uint8_t marker = * data_start ; <END_BUG> const uint32_t frames = ( marker & 0x7 ) + 1 ; const uint32_t mag = ( ( marker >> 3 ) & 0x3 ) + 1 ; const uint32_t index_sz = 2 + mag * frames ; if ( data_sz >= index_sz && data_start [ index_sz - 1 ] == marker ) { data_start += index_sz ; data_sz -= index_sz ; if ( data_start < data_end ) continue ; else break ; } } if ( frames_this_pts ) { uint32_t this_sz = sizes [ frame_count ] ; if ( data_sz < this_sz ) { ctx -> base. err_detail = "Invalid   frame   size   in   index" ; return VPX_CODEC_CORRUPT_FRAME ; } data_sz = this_sz ; frame_count ++ ; } res = decode_one ( ctx, & data_start, data_sz, user_priv, deadline ) ; assert ( data_start >= data ) ; assert ( data_start <= data_end ) ; if ( res ) break ; while ( data_start < data_end && * data_start == 0 ) data_start ++ ; data_sz = ( unsigned int ) ( data_end - data_start ) ; } while ( data_start

Fix:
<S2SV_ModStart> const uint8_t * const <S2SV_ModStart> ; vpx_codec_err_t res ; uint32_t frame_sizes <S2SV_ModEnd> [ 8 ] <S2SV_ModStart> ] ; int frame_count <S2SV_ModEnd> ; if ( <S2SV_ModStart> data == NULL && <S2SV_ModEnd> data_sz == 0 <S2SV_ModStart> == 0 ) { ctx -> flushed = 1 ; return VPX_CODEC_OK ; } ctx -> flushed = 0 ; if ( ctx -> frame_workers == NULL ) { const vpx_codec_err_t res = init_decoder ( ctx ) ; if ( res!= VPX_CODEC_OK ) return res ; } res = vp9_parse_superframe_index <S2SV_ModEnd> ( data, <S2SV_ModStart>, data_sz, frame_sizes, & frame_count, ctx -> decrypt_cb, ctx -> decrypt_state ) ; if ( res!= VPX_CODEC_OK ) return res ; if ( ctx -> frame_parallel_decode ) { if ( frame_count > 0 ) { int i ; for ( i = 0 ; i < frame_count ; ++ i ) { const uint8_t * data_start_copy = data_start ; const uint32_t frame_size = frame_sizes [
Buggy code:
 static gboolean parse_netscreen_packet ( FILE_T fh, struct wtap_pkthdr * phdr, Buffer * buf, char * line, int * err, gchar * * err_info ) { <START_BUG> int sec ; <END_BUG> int dsec ; char cap_int [ NETSCREEN_MAX_INT_NAME_LENGTH ] ; char direction [ 2 ] ;  guint pkt_len ; <START_BUG> char cap_src [ 13 ] ; char cap_dst [ 13 ] ; guint8 * pd ; gchar * p ; int n, i = 0 ; <END_BUG> guint offset = 0 ;  gchar dststr [ 13 ] ; phdr -> rec_type = REC_TYPE_PACKET ; phdr -> presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN ; <START_BUG> if ( sscanf ( line, "%9d.%9d:   %15[a-z0-9//:.-](%1[io])   len=%9u:%12s->%12s//", <END_BUG> & sec, & dsec, cap_int, direction, & pkt_len, cap_src, cap_dst ) < 5 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "netscreen:   Can\'t   parse   packet-header" ) ;  return - 1 ; <START_BUG> } if ( pkt_len > WTAP_MAX_PACKET_SIZE ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup_printf ( "netscreen:   File   has   %u-byte   packet,   bigger   than   maximum   of   %u", pkt_len, WTAP_MAX_PACKET_SIZE ) ; return FALSE ; } phdr -> ts. secs = sec ; phdr -> ts. nsecs = dsec * 100000000 ; phdr -> len = pkt_len ; ws_buffer_assure_space ( buf, pkt_len ) ; pd = ws_buffer_start_ptr ( buf ) ; while ( 1 ) { if ( file_gets ( line, NETSCREEN_LINE_LENGTH, fh ) == NULL ) { break ; } for ( p = & line [ 0 ] ; g_ascii_isspace ( * p<END_BUG>

Fix:
<S2SV_ModStart> ) { int pkt_len ; int <S2SV_ModStart> 2 ] ; <S2SV_ModEnd> char cap_src [ <S2SV_ModStart> = 0 ; int <S2SV_ModEnd> offset = 0 <S2SV_ModStart> ( line, "%9d.%9d: <S2SV_blank> %15[a-z0-9//:.-](%1[io]) <S2SV_blank> len=%9d:%12s->%12s//" <S2SV_ModEnd>, & sec <S2SV_ModStart> return - 1 ; } if ( pkt_len < 0 ) { * err = WTAP_ERR_BAD_FILE ; * err_info = g_strdup ( "netscreen: <S2SV_blank> packet <S2SV_blank> header <S2SV_blank> has <S2SV_blank> a <S2SV_blank> negative <S2SV_blank> packet <S2SV_blank> length" ) ; return FALSE
Buggy code:
 void faad_resetbits ( bitfile * ld, int bits ) { uint32_t tmp ; int words = bits >> 5 ; int remainder = bits & 0x1F ; <START_BUG> ld -> bytes_left = ld -> buffer_size - words * 4 ; <END_BUG> if ( ld -> bytes_left >= 4 ) { tmp = getdword ( & ld -> start [ words ] ) ; ld -> bytes_left -= 4 ; } else { tmp = getdword_n ( & ld -> start [ words ], ld -> bytes_left ) ; ld -> bytes_left = 0 ; } ld -> bufa = tmp ; if ( ld -> bytes_left >= 4 ) { tmp = getdword ( & ld -> start [ words + 1 ] ) ; ld -> bytes_left -= 4 ; } else { tmp = getdword_n ( & ld -> start [ words + 1 ], ld -> bytes_left ) ; ld -> bytes_left = 0 ; } ld -> bufb = tmp ; ld -> bits_left = 32 - remainder ; ld -> tail = & ld -> start [ words + 2 ] ; ld -> error = 0 ; }

Fix:
<S2SV_ModStart> & 0x1F ; if ( ld -> buffer_size < words * 4 ) ld -> bytes_left = 0 ; else
Buggy code:
 static int dhcpv4_print ( netdissect_options * ndo, const u_char * cp, u_int length, int indent ) { u_int i, t ; const u_char * tlv, * value ; uint8_t type, optlen ; i = 0 ; while ( i < length ) { <START_BUG> tlv = cp + i ; <END_BUG> type = ( uint8_t ) tlv [ 0 ] ; optlen = ( uint8_t ) tlv [ 1 ] ; value = tlv + 2 ; ND_PRINT ( ( ndo, "\\n" ) ) ; for ( t = indent ; t > 0 ; t -- ) ND_PRINT ( ( ndo, "\\t" ) ) ; ND_PRINT ( ( ndo, "%s", tok2str ( dh4opt_str, "Unknown", type ) ) ) ;  ND_PRINT ( ( ndo, "   (%u)", optlen + 2 ) ) ; <START_BUG> switch ( type ) { case DH4OPT_DNS_SERVERS : case DH4OPT_NTP_SERVERS : { if ( optlen < 4 || optlen % 4!= 0 ) { return - 1 ; } for ( t = 0 ; t < optlen ; t += 4 ) ND_PRINT ( ( ndo, "   %s", ipaddr_string ( ndo, value + t ) ) ) ; } break ; case DH4OPT_DOMAIN_SEARCH : { const u_char * tp = value ; while ( tp < value + optlen ) { ND_PRINT ( ( ndo, "   " ) ) ; if ( ( tp = ns_nprint ( ndo, tp, value + optlen ) ) == NULL ) return - 1 ; } } break ; } i += 2 + optlen ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> length ) { if ( i + 2 > length ) return - 1 ; <S2SV_ModStart> 2 ) ) ; if ( i + 2 + optlen > length ) return - 1
Buggy code:
 static void hugetlbfs_put_super ( struct super_block * sb ) { struct hugetlbfs_sb_info * sbi = HUGETLBFS_SB ( sb ) ; if ( sbi ) { sb -> s_fs_info = NULL ; <START_BUG> kfree ( sbi ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> = NULL ; if ( sbi -> spool ) hugepage_put_subpool ( sbi -> spool ) ;
Buggy code:
 void vp9_subtract_plane ( MACROBLOCK * x, BLOCK_SIZE bsize, int plane ) { struct macroblock_plane * const p = & x -> plane [ plane ] ; const struct macroblockd_plane * const pd = & x -> e_mbd. plane [ plane ] ; const BLOCK_SIZE plane_bsize = get_plane_block_size ( bsize, pd ) ; const int bw = 4 * num_4x4_blocks_wide_lookup [ plane_bsize ] ; const int bh = 4 * num_4x4_blocks_high_lookup [ plane_bsize ] ; <START_BUG> vp9_subtract_block ( bh, bw, p -> src_diff, bw, p -> src. buf, p -> src. stride, <END_BUG> pd -> dst. buf, pd -> dst. stride ) ; }

Fix:
<S2SV_ModStart> plane_bsize ] ; # if CONFIG_VP9_HIGHBITDEPTH if ( x -> e_mbd. cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { vpx_highbd_subtract_block ( bh, bw, p -> src_diff, bw, p -> src. buf, p -> src. stride, pd -> dst. buf, pd -> dst. stride, x -> e_mbd. bd ) ; return ; } # endif vpx_subtract_block <S2SV_ModEnd> ( bh,
Buggy code:
 int main ( int argc, char * argv [ ] ) { struct mschm_decompressor * chmd ; struct mschmd_header * chm ; struct mschmd_file * file, * * f ; unsigned int numf, i ; setbuf ( stdout, NULL ) ; setbuf ( stderr, NULL ) ; user_umask = umask ( 0 ) ; umask ( user_umask ) ; MSPACK_SYS_SELFTEST ( i ) ; if ( i ) return 0 ; if ( ( chmd = mspack_create_chm_decompressor ( NULL ) ) ) { for ( argv ++ ; * argv ; argv ++ ) { printf ( "%s\\n", * argv ) ; if ( ( chm = chmd -> open ( chmd, * argv ) ) ) { for ( numf = 0, file = chm -> files ; file ; file = file -> next ) numf ++ ; if ( ( f = ( struct mschmd_file * * ) calloc ( numf, sizeof ( struct mschmd_file * ) ) ) ) { for ( i = 0, file = chm -> files ; file ; file = file -> next ) f [ i ++ ] = file ; qsort ( f, numf, sizeof ( struct mschmd_file * ), & sortfunc ) ; for ( i = 0 ; i < numf ; i ++ ) { <START_BUG> char * outname = create_output_name ( ( unsigned char * ) f [ i ] -> filename, NULL, 0, 1, 0 ) ; <END_BUG> printf ( "Extracting   %s\\n", outname ) ; ensure_filepath ( outname ) ; if ( chmd -> extract ( chmd, f [ i ], outname ) ) { printf ( "%s:   extract   error   on   \\"%s\\":   %s\\n", * argv, f [ i ] -> filename, ERROR ( chmd ) ) ; } free ( outname ) ; } free ( f ) ; } chmd -> close ( chmd, chm ) ; } else { printf ( "%s:   can\'t   open   --   %s\\n", * argv, ERROR ( chmd ) ) ; } } mspack_destroy_chm_decompressor ( chmd ) ; } return 0 ; }

Fix:
<S2SV_ModStart> = create_output_name ( <S2SV_ModEnd> f [ i <S2SV_ModStart> ] -> filename <S2SV_ModEnd> ) ; printf
Buggy code:
 <START_BUG> void fdct16_sse2 ( __m128i * in0, __m128i * in1 ) { <END_BUG> fdct16_8col ( in0 ) ; fdct16_8col ( in1 ) ; array_transpose_16x16 ( in0, in1 ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static int ras_getdatastd ( jas_stream_t * in, ras_hdr_t * hdr, ras_cmap_t * cmap, jas_image_t * image ) { int pad ; int nz ; int z ; int c ; int y ; int x ; int v ; int i ; jas_matrix_t * data [ 3 ] ; cmap = 0 ; <START_BUG> for ( i = 0 ; i < jas_image_numcmpts ( image ) ; ++ i ) { <END_BUG>  data [ i ] = jas_matrix_create ( 1, jas_image_width ( image ) ) ; <START_BUG> assert ( data [ i ] ) ; } pad = RAS_ROWSIZE ( hdr ) - ( hdr -> width * hdr -> depth + 7 ) // 8 ; for ( y = 0 ; y < hdr -> height ; y ++ ) { nz = 0 ; z = 0 ; for ( x = 0 ; x < hdr -> width ; x ++ ) { while ( nz < hdr -> depth ) { if ( ( c = jas_stream_getc ( in ) ) == EOF ) { <END_BUG> return - 1 ;  } <START_BUG> z = ( z << 8 ) | c ; <END_BUG> nz += 8 ; } v = ( z >> ( nz - hdr -> depth ) ) & RAS_ONES ( hdr -> depth ) ; z &= RAS_ONES ( nz - hdr -> depth ) ; nz -= hdr -> depth ; if ( jas_image_numcmpts ( image ) == 3 ) { jas_matrix_setv ( data [ 0 ], x, ( RAS_GETRED ( v ) ) ) ; jas_matrix_setv ( data [ 1 ], x, ( RAS_GETGREEN ( v ) ) ) ; jas_matrix_setv ( data [ 2 ], x, ( RAS_GETBLUE ( v ) ) ) ; } else { jas_matrix_setv ( data [ 0 ], x, ( v ) ) ; } } if ( pad ) { if ( ( c = jas_stream_getc ( in ) ) == EOF ) { return - 1 ; } } for ( i = 0 ; i < jas_image_numcmpts ( image ) ; ++ i ) { if ( jas_image_writecmpt ( image, i, 0

Fix:
<S2SV_ModStart> = 0 ; assert ( <S2SV_ModEnd> jas_image_numcmpts ( image <S2SV_ModStart> ( image ) <= 3 ) ; for ( i = 0 ; i < 3 ; ++ i ) { data [ i ] = 0 ; } for ( i = 0 ; i < jas_image_numcmpts ( image ) ; ++ i ) { if (! ( <S2SV_ModEnd> data [ i <S2SV_ModStart> image ) ) ) ) { goto error ; } <S2SV_ModEnd> } pad = <S2SV_ModStart> EOF ) { goto error ; } z = ( z << 8 ) | c ; nz += 8 ; } v = ( z >> ( nz - hdr -> depth ) ) & RAS_ONES ( hdr -> depth ) ; z &= RAS_ONES ( nz - hdr -> depth ) ; nz -= hdr -> depth ; if ( jas_image_numcmpts ( image ) == 3 ) { jas_matrix_setv ( data [ 0 ], x, ( RAS_GETRED ( v ) ) ) ; jas_matrix_setv ( data [ 1 ], x, ( RAS_GETGREEN ( v ) ) ) ; jas_matrix_setv ( data [ 2 ], x, ( RAS_GET
Buggy code:
 static void output_stats ( FIRSTPASS_STATS * stats, struct vpx_codec_pkt_list * pktlist ) { struct vpx_codec_cx_pkt pkt ; pkt. kind = VPX_CODEC_STATS_PKT ; pkt. data. twopass_stats. buf = stats ; pkt. data. twopass_stats. sz = sizeof ( FIRSTPASS_STATS ) ; vpx_codec_pkt_list_add ( pktlist, & pkt ) ; # if OUTPUT_FPF { FILE * fpfile ; fpfile = fopen ( "firstpass.stt", "a" ) ; <START_BUG> fprintf ( fpfile, "%12.0f   %12.0f   %12.0f   %12.0f   %12.0f   %12.4f   %12.4f" <END_BUG> "%12.4f   %12.4f   %12.4f   %12.4f   %12.4f   %12.4f   %12.4f" "%12.0f   %12.0f   %12.4f   %12.0f   %12.0f   %12.4f\\n", stats -> frame,  stats -> intra_error, <START_BUG> stats -> coded_error, stats -> sr_coded_error, <END_BUG> stats -> ssim_weighted_pred_err,  stats -> pcnt_inter, stats -> pcnt_motion, stats -> pcnt_second_ref, <START_BUG> stats -> pcnt_neutral, <END_BUG> stats -> MVr, stats -> mvr_abs, stats -> MVc, stats -> mvc_abs, stats -> MVrv, stats -> MVcv, stats -> mv_in_out_count, stats -> new_mv_count, stats -> count, stats -> duration ) ; fclose ( fpfile ) ; } # endif }

Fix:
<S2SV_ModStart> ( fpfile, "%12.0lf <S2SV_blank> %12.4lf <S2SV_blank> %12.0lf <S2SV_blank> %12.0lf <S2SV_blank> %12.0lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf" "%12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.4lf" "%12.4lf <S2SV_blank> %12.4lf <S2SV_blank> %12.0lf <S2SV_blank> %12.0lf <S2SV_blank> %12.0lf <S2SV_blank> %12.4lf\\n" <S2SV_ModEnd>, stats -> <S2SV_ModStart>, stats -> weight, stats -> <S2SV_ModStart>, stats -> <S2SV_ModEnd> pcnt_inter, stats <S2SV_ModStart> stats -> pcnt_neutral, stats -> intra_skip_pct, stats -> inactive_zone_rows, stats -> inactive_zone_cols
Buggy code:
 static int get_siz ( Jpeg2000DecoderContext * s ) { int i ; int ncomponents ; uint32_t log2_chroma_wh = 0 ; const enum AVPixelFormat * possible_fmts = NULL ; int possible_fmts_nb = 0 ; if ( bytestream2_get_bytes_left ( & s -> g ) < 36 ) return AVERROR_INVALIDDATA ; s -> avctx -> profile = bytestream2_get_be16u ( & s -> g ) ; s -> width = bytestream2_get_be32u ( & s -> g ) ; s -> height = bytestream2_get_be32u ( & s -> g ) ; s -> image_offset_x = bytestream2_get_be32u ( & s -> g ) ; s -> image_offset_y = bytestream2_get_be32u ( & s -> g ) ; s -> tile_width = bytestream2_get_be32u ( & s -> g ) ; s -> tile_height = bytestream2_get_be32u ( & s -> g ) ; s -> tile_offset_x = bytestream2_get_be32u ( & s -> g ) ; s -> tile_offset_y = bytestream2_get_be32u ( & s -> g ) ; <START_BUG> ncomponents = bytestream2_get_be16u ( & s -> g ) ; <END_BUG> if ( ncomponents <= 0 ) { av_log ( s -> avctx, AV_LOG_ERROR, "Invalid   number   of   components:   %d\\n", s -> ncomponents ) ; return AVERROR_INVALIDDATA ; } if ( ncomponents > 4 ) { avpriv_request_sample ( s -> avctx, "Support   for   %d   components", s -> ncomponents ) ; return AVERROR_PATCHWELCOME ; } s -> ncomponents = ncomponents ; if ( s -> tile_width <= 0 || s -> tile_height <= 0 ) { av_log ( s -> avctx, AV_LOG_ERROR, "Invalid   tile   dimension   %dx%d.\\n", s -> tile_width, s -> tile_height ) ; return AVERROR_INVALIDDATA ; }

Fix:
<S2SV_ModStart> g ) ; if ( s -> image_offset_x || s -> image_offset_y ) { avpriv_request_sample ( s -> avctx, "Support <S2SV_blank> for <S2SV_blank> image <S2SV_blank> offsets" ) ; return AVERROR_PATCHWELCOME ; }
Buggy code:
 static int nfs_can_extend_write ( struct file * file, struct page * page, struct inode * inode ) { if ( file -> f_flags & O_DSYNC ) return 0 ; <START_BUG> if ( NFS_PROTO ( inode ) -> have_delegation ( inode, FMODE_WRITE ) ) <END_BUG> return 1 ;  if ( nfs_write_pageuptodate ( page, inode ) && ( inode -> i_flock == NULL || <START_BUG> ( inode -> i_flock -> fl_start == 0 && inode -> i_flock -> fl_end == OFFSET_MAX && <END_BUG> inode -> i_flock -> fl_type!= F_RDLCK ) ) )  return 1 ; return 0 ; }

Fix:
<S2SV_ModStart> ; if (! nfs_write_pageuptodate ( page, inode ) ) return 0 ; if ( <S2SV_ModStart> ; if ( <S2SV_ModEnd> inode -> i_flock <S2SV_ModStart> F_RDLCK ) ) <S2SV_ModEnd> return 1 ;
Buggy code:
 static av_cold int vqa_decode_init ( AVCodecContext * avctx ) { VqaContext * s = avctx -> priv_data ; int i, j, codebook_index, ret ; s -> avctx = avctx ; avctx -> pix_fmt = AV_PIX_FMT_PAL8 ; if ( s -> avctx -> extradata_size!= VQA_HEADER_SIZE ) { av_log ( s -> avctx, AV_LOG_ERROR, "expected   extradata   size   of   %d\\n", VQA_HEADER_SIZE ) ; return AVERROR ( EINVAL ) ; } s -> vqa_version = s -> avctx -> extradata [ 0 ] ; switch ( s -> vqa_version ) { case 1 : case 2 : break ; case 3 : avpriv_report_missing_feature ( avctx, "VQA   Version   %d", s -> vqa_version ) ; return AVERROR_PATCHWELCOME ; default : avpriv_request_sample ( avctx, "VQA   Version   %i", s -> vqa_version ) ; return AVERROR_PATCHWELCOME ; } s -> width = AV_RL16 ( & s -> avctx -> extradata [ 6 ] ) ; s -> height = AV_RL16 ( & s -> avctx -> extradata [ 8 ] ) ; <START_BUG> if ( ( ret = av_image_check_size ( s -> width, s -> height, 0, avctx ) ) < 0 ) { <END_BUG> s -> width = s -> height = 0 ; return ret ; } s -> vector_width = s -> avctx -> extradata [ 10 ] ; s -> vector_height = s -> avctx -> extradata [ 11 ] ; s -> partial_count = s -> partial_countdown = s -> avctx -> extradata [ 13 ] ; if ( ( s -> vector_width!= 4 ) || ( ( s -> vector_height!= 2 ) && ( s -> vector_height!= 4 ) ) ) { return AVERROR_INVALIDDATA ; } if ( s -> width % s -> vector_width || s -> height % s -> vector_height ) { av_log ( avctx, AV_LOG_ERROR, "Image   size

Fix:
<S2SV_ModStart> ( ret = ff_set_dimensions ( avctx, <S2SV_ModEnd> s -> width <S2SV_ModStart> s -> height <S2SV_ModEnd> ) ) <
Buggy code:
 static int rd_build_device_space ( struct rd_dev * rd_dev ) { <START_BUG> u32 i = 0, j, page_offset = 0, sg_per_table, sg_tables, total_sg_needed ; <END_BUG> u32 max_sg_per_table = ( RD_MAX_ALLOCATION_SIZE // sizeof ( struct scatterlist ) ) ;  struct rd_dev_sg_table * sg_table ; <START_BUG> struct page * pg ; struct scatterlist * sg ; if ( rd_dev -> rd_page_count <= 0 ) { pr_err ( "Illegal   page   count:   %u   for   Ramdisk   device\\n", rd_dev -> rd_page_count ) ; return - EINVAL ; } if ( rd_dev -> rd_flags & RDF_NULLIO ) return 0 ; total_sg_needed = rd_dev -> rd_page_count ; sg_tables = ( total_sg_needed // max_sg_per_table ) + 1 ; sg_table = kzalloc ( sg_tables * sizeof ( struct rd_dev_sg_table ), GFP_KERNEL ) ; if (! sg_table ) { pr_err ( "Unable   to   allocate   memory   for   Ramdisk" "   scatterlist   tables\\n" ) ; return - ENOMEM ; } rd_dev -> sg_table_array = sg_table ; rd_dev -> sg_table_count = sg_tables ; <END_BUG> while ( total_sg_needed ) {  sg_per_table = ( total_sg_needed > max_sg_per_table )? max_sg_per_table : total_sg_needed ; sg = kzalloc ( sg_per_table * sizeof ( struct scatterlist ), GFP_KERNEL ) ; if (! sg ) { pr_err ( "Unable   to   allocate   scatterlist   array" "   for   struct   rd_dev\\n" ) ; return - ENOMEM ; } sg_init_table ( sg, sg_per_table ) ; sg_table [ i ]. sg_table = sg ; sg_table [ i ]. rd_sg_count = sg_per_table ; sg_table [ i ]. page_start_offset = page_

Fix:
<S2SV_ModStart> rd_dev ) { struct rd_dev_sg_table * sg_table ; u32 <S2SV_ModEnd> sg_tables, total_sg_needed <S2SV_ModStart> ) ) ; int rc <S2SV_ModEnd> ; if ( <S2SV_ModStart> = sg_tables ; rc = rd_allocate_sgl_table ( rd_dev, sg_table, total_sg_needed, 0x00 ) ; if ( rc ) return rc ; <S2SV_ModEnd> pr_debug ( "CORE_RD[%u] <S2SV_blank> - <S2SV_blank> Built <S2SV_blank> Ramdisk <S2SV_blank> Device <S2SV_blank> ID: <S2SV_blank> %u <S2SV_blank> space <S2SV_blank> of"
Buggy code:
 static int vp8_rd_pick_best_mbsegmentation ( VP8_COMP * cpi, MACROBLOCK * x, int_mv * best_ref_mv, int best_rd, int * mdcounts, int * returntotrate, int * returnyrate, int * returndistortion, int mvthresh ) { int i ; BEST_SEG_INFO bsi ; <START_BUG> vpx_memset ( & bsi, 0, sizeof ( bsi ) ) ; <END_BUG> bsi. segment_rd = best_rd ; bsi. ref_mv = best_ref_mv ; bsi. mvp. as_int = best_ref_mv -> as_int ; bsi. mvthresh = mvthresh ; bsi. mdcounts = mdcounts ; for ( i = 0 ; i < 16 ; i ++ ) { bsi. modes [ i ] = ZERO4X4 ; } if ( cpi -> compressor_speed == 0 ) { rd_check_segment ( cpi, x, & bsi, BLOCK_16X8 ) ; rd_check_segment ( cpi, x, & bsi, BLOCK_8X16 ) ; rd_check_segment ( cpi, x, & bsi, BLOCK_8X8 ) ; rd_check_segment ( cpi, x, & bsi, BLOCK_4X4 ) ; } else { int sr ; rd_check_segment ( cpi, x, & bsi, BLOCK_8X8 ) ; if ( bsi. segment_rd < best_rd ) { int col_min = ( ( best_ref_mv -> as_mv. col + 7 ) >> 3 ) - MAX_FULL_PEL_VAL ; int row_min = ( ( best_ref_mv -> as_mv. row + 7 ) >> 3 ) - MAX_FULL_PEL_VAL ; int col_max = ( best_ref_mv -> as_mv. col >> 3 ) + MAX_FULL_PEL_VAL ; int row_max = ( best_ref_mv -> as_mv. row >> 3 ) + MAX_FULL_PEL_VAL ; int tmp_col_min = x -> mv_col_min ; int tmp_col_max = x -> mv_col_max ; int tmp_row_min = x

Fix:
<S2SV_ModStart> BEST_SEG_INFO bsi ; memset <S2SV_ModEnd> ( & bsi
Buggy code:
 static void pimv2_print ( netdissect_options * ndo, register const u_char * bp, register u_int len, const u_char * bp2 ) { register const u_char * ep ; register const struct pim * pim = ( const struct pim * ) bp ; int advance ; enum checksum_status cksum_status ; ep = ( const u_char * ) ndo -> ndo_snapend ; if ( bp >= ep ) return ; if ( ep > bp + len ) ep = bp + len ; ND_TCHECK ( pim -> pim_rsv ) ; pimv2_addr_len = pim -> pim_rsv ; if ( pimv2_addr_len!= 0 ) ND_PRINT ( ( ndo, ",   RFC2117-encoding" ) ) ; ND_PRINT ( ( ndo, ",   cksum   0x%04x   ", EXTRACT_16BITS ( & pim -> pim_cksum ) ) ) ; if ( EXTRACT_16BITS ( & pim -> pim_cksum ) == 0 ) { ND_PRINT ( ( ndo, "(unverified)" ) ) ; } else { if ( PIM_TYPE ( pim -> pim_typever ) == PIMV2_TYPE_REGISTER ) { cksum_status = pimv2_check_checksum ( ndo, bp, bp2, 8 ) ; if ( cksum_status == INCORRECT ) { cksum_status = pimv2_check_checksum ( ndo, bp, bp2, len ) ; } } else { cksum_status = pimv2_check_checksum ( ndo, bp, bp2, len ) ; } switch ( cksum_status ) { case CORRECT : ND_PRINT ( ( ndo, "(correct)" ) ) ; break ; case INCORRECT : ND_PRINT ( ( ndo, "(incorrect)" ) ) ; break ; case UNVERIFIED : ND_PRINT ( ( ndo, "(unverified)" ) ) ; break ; } } switch ( PIM_TYPE ( pim -> pim_typever ) ) { case PIMV2_TYPE_HELLO : { uint16_t otype, olen ; bp +=

Fix:
<S2SV_ModStart> case PIMV2_HELLO_OPTION_HOLDTIME : if ( olen!= 2 ) { ND_PRINT ( ( ndo, "ERROR: <S2SV_blank> Option <S2SV_blank> Length <S2SV_blank>!= <S2SV_blank> 2 <S2SV_blank> Bytes <S2SV_blank> (%u)", olen ) ) ; } else { <S2SV_ModStart> ) ) ; } <S2SV_ModStart> case PIMV2_HELLO_OPTION_GENID : if ( olen!= 4 ) { ND_PRINT ( ( ndo, "ERROR: <S2SV_blank> Option <S2SV_blank> Length <S2SV_blank>!= <S2SV_blank> 4 <S2SV_blank> Bytes <S2SV_blank> (%u)", olen ) ) ; } else { <S2SV_ModStart> ) ) ; } <S2SV_ModStart> case PIMV2_HELLO_OPTION_REFRESH_CAP : if ( olen!= 4 ) { ND_PRINT ( ( ndo, "ERROR: <S2SV_blank> Option <S2SV_blank> Length <S2SV_blank>!= <S2SV_blank> 4 <S2SV_blank> Bytes <S2SV_blank> (%u)", olen ) ) ; } else { <S2SV_ModStart> ) ) ; }
Buggy code:
 <START_BUG> TPM_RC tpm_kdfa ( TSS2_SYS_CONTEXT * sapi_context, TPMI_ALG_HASH hashAlg, <END_BUG> TPM2B * key, char * label, TPM2B * contextU, TPM2B * contextV, UINT16 bits, TPM2B_MAX_BUFFER * resultKey ) {  TPM2B_DIGEST tmpResult ; <START_BUG> TPM2B_DIGEST tpm2bLabel, tpm2bBits, tpm2b_i_2 ; UINT8 * tpm2bBitsPtr = & tpm2bBits. t. buffer [ 0 ] ; UINT8 * tpm2b_i_2Ptr = & tpm2b_i_2. t. buffer [ 0 ] ; TPM2B_DIGEST * bufferList [ 8 ] ; UINT32 bitsSwizzled, i_Swizzled ; <END_BUG> TPM_RC rval ;  int i, j ; UINT16 bytes = bits // 8 ; resultKey -> t. size = 0 ; tpm2b_i_2. t. size = 4 ; tpm2bBits. t. size = 4 ; bitsSwizzled = string_bytes_endian_convert_32 ( bits ) ; * ( UINT32 * ) tpm2bBitsPtr = bitsSwizzled ; for ( i = 0 ; label [ i ]!= 0 ; i ++ ) ; tpm2bLabel. t. size = i + 1 ; for ( i = 0 ; i < tpm2bLabel. t. size ; i ++ ) { tpm2bLabel. t. buffer [ i ] = label [ i ] ; } resultKey -> t. size = 0 ; i = 1 ; <START_BUG> while ( resultKey -> t. size < bytes ) <END_BUG> {  i_Swizzled = string_bytes_endian_convert_32 ( i ) ; <START_BUG> * ( UINT32 * ) tpm2b_i_2Ptr = i_Swizzled ; j = 0 ; bufferList [ j ++ ] = ( TPM2B_DIGEST * ) & ( tpm2b_i_2. b ) ; bufferList [ j ++ ] = ( TPM2B_DIGEST * ) & ( tpm2bLabel. b ) ; bufferList [ j ++ ]<END_BUG>

Fix:
<S2SV_ModStart> TPM_RC tpm_kdfa ( <S2SV_ModEnd> TPMI_ALG_HASH hashAlg, <S2SV_ModStart> ) { TPM2B_DIGEST <S2SV_ModEnd> tpm2bLabel, tpm2bBits <S2SV_ModStart> ; TPM_RC rval = TPM_RC_SUCCESS <S2SV_ModStart> = 1 ; const EVP_MD * md = tpm_algorithm_to_openssl_digest ( hashAlg ) ; if (! md ) { LOG_ERR ( "Algorithm <S2SV_blank> not <S2SV_blank> supported <S2SV_blank> for <S2SV_blank> hmac: <S2SV_blank> %x", hashAlg ) ; return TPM_RC_HASH ; } HMAC_CTX ctx ; HMAC_CTX_init ( & ctx ) ; int rc = HMAC_Init_ex ( & ctx, key -> buffer, key -> size, md, NULL ) ; if (! rc ) { LOG_ERR ( "HMAC <S2SV_blank> Init <S2SV_blank> failed: <S2SV_blank> %s", ERR_error_string ( rc, NULL ) ) ; return TPM_RC_MEMORY ; } <S2SV_ModStart> bytes ) { TPM2B_DIGEST tmpResult ; <S2SV_ModStart> bufferList [ j ] = ( TPM2B_DIGEST * ) 0 ; int c ; for ( c = 0 ; c <
Buggy code:
 static VALUE ossl_cipher_set_key ( VALUE self, VALUE key ) { EVP_CIPHER_CTX * ctx ; int key_len ; StringValue ( key ) ; GetCipher ( self, ctx ) ; key_len = EVP_CIPHER_CTX_key_length ( ctx ) ; if ( RSTRING_LEN ( key )!= key_len ) ossl_raise ( rb_eArgError, "key   must   be   %d   bytes", key_len ) ; if ( EVP_CipherInit_ex ( ctx, NULL, NULL, ( unsigned char * ) RSTRING_PTR ( key ), NULL, - 1 )!= 1 ) ossl_raise ( eCipherError, NULL ) ; <START_BUG> return key ; <END_BUG> }

Fix:
<S2SV_ModStart> NULL ) ; rb_ivar_set ( self, id_key_set, Qtrue ) ;
Buggy code:
 BOOL license_read_scope_list ( wStream * s, SCOPE_LIST * scopeList ) { UINT32 i ; UINT32 scopeCount ; if ( Stream_GetRemainingLength ( s ) < 4 ) return FALSE ; <START_BUG> Stream_Read_UINT32 ( s, scopeCount ) ; <END_BUG> scopeList -> count = scopeCount ; scopeList -> array = ( LICENSE_BLOB * ) malloc ( sizeof ( LICENSE_BLOB ) * scopeCount ) ; for ( i = 0 ; i < scopeCount ; i ++ ) { scopeList -> array [ i ]. type = BB_SCOPE_BLOB ; if (! license_read_binary_blob ( s, & scopeList -> array [ i ] ) ) return FALSE ; } return TRUE ; }

Fix:
<S2SV_ModStart>, scopeCount ) ; if ( Stream_GetRemainingLength ( s ) // sizeof ( LICENSE_BLOB ) < scopeCount ) return FALSE
Buggy code:
 static vpx_codec_err_t vp8_peek_si_internal ( const uint8_t * data, unsigned int data_sz, vpx_codec_stream_info_t * si, vpx_decrypt_cb decrypt_cb, void * decrypt_state ) { vpx_codec_err_t res = VPX_CODEC_OK ; if ( data + data_sz <= data ) { res = VPX_CODEC_INVALID_PARAM ; } else { uint8_t clear_buffer [ 10 ] ; const uint8_t * clear = data ; if ( decrypt_cb ) { int n = MIN ( sizeof ( clear_buffer ), data_sz ) ; decrypt_cb ( decrypt_state, data, clear_buffer, n ) ; clear = clear_buffer ; } si -> is_kf = 0 ; if ( data_sz >= 10 &&! ( clear [ 0 ] & 0x01 ) ) { si -> is_kf = 1 ; if ( clear [ 3 ]!= 0x9d || clear [ 4 ]!= 0x01 || clear [ 5 ]!= 0x2a ) return VPX_CODEC_UNSUP_BITSTREAM ; si -> w = ( clear [ 6 ] | ( clear [ 7 ] << 8 ) ) & 0x3fff ; si -> h = ( clear [ 8 ] | ( clear [ 9 ] << 8 ) ) & 0x3fff ; <START_BUG> if (! ( si -> h | si -> w ) ) <END_BUG>  res = VPX_CODEC_UNSUP_BITSTREAM ; <START_BUG> } <END_BUG> else  { res = VPX_CODEC_UNSUP_BITSTREAM ; } } return res ; }

Fix:
<S2SV_ModStart> si -> h && <S2SV_ModEnd> si -> w <S2SV_ModStart> ) res = VPX_CODEC_CORRUPT_FRAME ; } else { res = <S2SV_ModStart> VPX_CODEC_UNSUP_BITSTREAM ; } <S2SV_ModEnd> } return res
Buggy code:
 <START_BUG> static void consume_one_event ( unsigned cpu, <END_BUG> struct evtchn_fifo_control_block * control_block,  unsigned priority, unsigned long * ready, <START_BUG> bool drop ) { struct evtchn_fifo_queue * q = & per_cpu ( cpu_queue, cpu ) ; uint32_t head ; evtchn_port_t port ; event_word_t * word ; head = q -> head [ priority ] ; if ( head == 0 ) { virt_rmb ( ) ; head = control_block -> head [ priority ] ; } port = head ; word = event_word_from_port ( port ) ; head = clear_linked ( word ) ; if ( head == 0 ) clear_bit ( priority, ready ) ; if ( evtchn_fifo_is_pending ( port ) &&! evtchn_fifo_is_masked ( port ) ) { <END_BUG> if ( unlikely ( drop ) )  pr_warn ( "Dropping   pending   event   for   port   %u\\n", port ) ; else <START_BUG> handle_irq_for_port ( port ) ; <END_BUG> } q -> head [ priority ] = head ; }

Fix:
<S2SV_ModStart> ( unsigned cpu, struct evtchn_loop_ctrl * ctrl <S2SV_ModStart> long * ready <S2SV_ModEnd> ) { struct <S2SV_ModStart> ( unlikely (! ctrl <S2SV_ModEnd> ) ) pr_warn <S2SV_ModStart> handle_irq_for_port ( port, ctrl
Buggy code:
 static bool parse_reconnect ( struct pool * pool, json_t * val ) { char * sockaddr_url, * stratum_port, * tmp ; char * url, * port, address [ 256 ] ; memset ( address, 0, 255 ) ; url = ( char * ) json_string_value ( json_array_get ( val, 0 ) ) ; if (! url ) url = pool -> sockaddr_url ; else { char * dot_pool, * dot_reconnect ; dot_pool = strchr ( pool -> sockaddr_url, '.' ) ; if (! dot_pool ) { applog ( LOG_ERR, "Denied   stratum   reconnect   request   for   pool   without   domain   \'%s\'", pool -> sockaddr_url ) ; return false ; } dot_reconnect = strchr ( url, '.' ) ; if (! dot_reconnect ) { applog ( LOG_ERR, "Denied   stratum   reconnect   request   to   url   without   domain   \'%s\'", url ) ; return false ; } if ( strcmp ( dot_pool, dot_reconnect ) ) { applog ( LOG_ERR, "Denied   stratum   reconnect   request   to   non-matching   domain   url   \'%s\'", pool -> sockaddr_url ) ; return false ; } } port = ( char * ) json_string_value ( json_array_get ( val, 1 ) ) ; if (! port ) port = pool -> stratum_port ; <START_BUG> sprintf ( address, "%s:%s", url, port ) ; <END_BUG> if (! extract_sockaddr ( address, & sockaddr_url, & stratum_port ) ) return false ; applog ( LOG_WARNING, "Stratum   reconnect   requested   from   pool   %d   to   %s", pool -> pool_no, address ) ; clear_pool_work ( pool ) ; mutex_lock ( & pool -> stratum_lock ) ; __suspend_stratum ( pool ) ; tmp = pool -> sockaddr_url ; pool -> sockaddr_url = sockaddr_url ; pool -> stratum_url = pool -> sockaddr_url ; free ( tmp ) ; tmp = pool -> stratum_port ; pool ->

Fix:
<S2SV_ModStart> -> stratum_port ; snprintf ( address, 254 <S2SV_ModEnd>, "%s:%s",
Buggy code:
 int CIFSFindNext ( const int xid, struct cifs_tcon * tcon, __u16 searchHandle, struct cifs_search_info * psrch_inf ) { TRANSACTION2_FNEXT_REQ * pSMB = NULL ; TRANSACTION2_FNEXT_RSP * pSMBr = NULL ; T2_FNEXT_RSP_PARMS * parms ; char * response_data ; int rc = 0 ; <START_BUG> int bytes_returned, name_len ; <END_BUG> __u16 params, byte_count ; cFYI ( 1, "In   FindNext" ) ; if ( psrch_inf -> endOfSearch ) return - ENOENT ; rc = smb_init ( SMB_COM_TRANSACTION2, 15, tcon, ( void * * ) & pSMB, ( void * * ) & pSMBr ) ; if ( rc ) return rc ; params = 14 ; byte_count = 0 ; pSMB -> TotalDataCount = 0 ; pSMB -> MaxParameterCount = cpu_to_le16 ( 8 ) ; pSMB -> MaxDataCount = cpu_to_le16 ( ( tcon -> ses -> server -> maxBuf - MAX_CIFS_HDR_SIZE ) & 0xFFFFFF00 ) ; pSMB -> MaxSetupCount = 0 ; pSMB -> Reserved = 0 ; pSMB -> Flags = 0 ; pSMB -> Timeout = 0 ; pSMB -> Reserved2 = 0 ; pSMB -> ParameterOffset = cpu_to_le16 ( offsetof ( struct smb_com_transaction2_fnext_req, SearchHandle ) - 4 ) ; pSMB -> DataCount = 0 ; pSMB -> DataOffset = 0 ; pSMB -> SetupCount = 1 ; pSMB -> Reserved3 = 0 ; pSMB -> SubCommand = cpu_to_le16 ( TRANS2_FIND_NEXT ) ; pSMB -> SearchHandle = searchHandle ; pSMB -> SearchCount = cpu_to_le16 ( CIFSMaxBufSize // sizeof ( FILE_UNIX_INFO ) ) ; pSMB -> InformationLevel = cpu_to_le16 ( psrch_inf -> info_level ) ; pSMB -> ResumeKey = psrch_inf -> resume_key ; pSMB -> SearchFlags = cpu_to_le

Fix:
<S2SV_ModStart> ; int bytes_returned ; unsigned int <S2SV_ModEnd> name_len ; __u16
Buggy code:
 static int handle_emulation_failure ( struct kvm_vcpu * vcpu ) <START_BUG> { <END_BUG> ++ vcpu -> stat. insn_emulation_fail ;  trace_kvm_emulate_insn_failed ( vcpu ) ; <START_BUG> vcpu -> run -> exit_reason = KVM_EXIT_INTERNAL_ERROR ; vcpu -> run -> internal. suberror = KVM_INTERNAL_ERROR_EMULATION ; vcpu -> run -> internal. ndata = 0 ; <END_BUG> kvm_queue_exception ( vcpu, UD_VECTOR ) ;  <START_BUG> return EMULATE_FAIL ; <END_BUG> }

Fix:
<S2SV_ModStart> vcpu ) { int r = EMULATE_DONE ; <S2SV_ModStart> vcpu ) ; if (! is_guest_mode ( vcpu ) ) { <S2SV_ModStart> = 0 ; r = EMULATE_FAIL ; } <S2SV_ModStart> ) ; return r <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int valid_host ( cupsd_client_t * con ) { cupsd_alias_t * a ; cupsd_netif_t * netif ; const char * end ; char * ptr ; strlcpy ( con -> clientname, httpGetField ( con -> http, HTTP_FIELD_HOST ), sizeof ( con -> clientname ) ) ; if ( ( ptr = strrchr ( con -> clientname, ':' ) )!= NULL &&! strchr ( ptr, ']' ) ) { * ptr ++ = '\\0' ; con -> clientport = atoi ( ptr ) ; } else con -> clientport = con -> serverport ; if ( httpAddrLocalhost ( httpGetAddress ( con -> http ) ) ) { return (! _cups_strcasecmp ( con -> clientname, "localhost" ) ||! _cups_strcasecmp ( con -> clientname, "localhost." ) || <START_BUG> # ifdef __linux <END_BUG>! _cups_strcasecmp ( con -> clientname, "localhost.localdomain" ) || # endif! strcmp ( con -> clientname, "127.0.0.1" ) ||! strcmp ( con -> clientname, "[::1]" ) ) ; } # if defined ( HAVE_DNSSD ) || defined ( HAVE_AVAHI ) if ( ( end = strrchr ( con -> clientname, '.' ) )!= NULL && end > con -> clientname &&! end [ 1 ] ) { for ( end -- ; end > con -> clientname && * end!= '.' ; end -- ) ; } if ( end && (! _cups_strcasecmp ( end, ".local" ) ||! _cups_strcasecmp ( end, ".local." ) ) ) return ( 1 ) ; # endif if ( isdigit ( con -> clientname [ 0 ] & 255 ) || con -> clientname [ 0 ] == '[' ) { http_addrlist_t * addrlist ; if ( ( addrlist = httpAddrGetList ( con -> clientname, AF_UNSPEC, NULL ) )!= NULL ) { httpAddrFreeList ( addrlist ) ; return ( 1 ) ; } } for ( a = ( cupsd_alias_t * ) cupsArrayFirst ( ServerAlias ) ; a ; a = ( cupsd_alias_t * ) cupsArrayNext ( ServerAlias )

Fix:
<S2SV_ModStart> "localhost." ) || <S2SV_ModEnd>! strcmp (
Buggy code:
 <START_BUG> int mongo_env_read_socket ( mongo * conn, void * buf, int len ) { <END_BUG> char * cbuf = buf ; while ( len ) {  int sent = recv ( conn -> sock, cbuf, len, 0 ) ; <START_BUG> if ( sent == 0 || sent == - 1 ) { __mongo_set_error ( conn, MONGO_IO_ERROR, strerror ( errno ), errno ) ; return MONGO_ERROR ; } cbuf += sent ; len -= sent ; } return MONGO_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> * buf, size_t <S2SV_ModEnd> len ) { <S2SV_ModStart> len ) { size_t <S2SV_ModEnd> sent = recv
Buggy code:
 static int java_switch_op ( RAnal * anal, RAnalOp * op, ut64 addr, const ut8 * data, int len ) { ut8 op_byte = data [ 0 ] ; ut64 offset = addr - java_get_method_start ( ) ; ut8 pos = ( offset + 1 ) % 4? 1 + 4 - ( offset + 1 ) % 4 : 1 ; if ( op_byte == 0xaa ) { <START_BUG> if ( pos + 8 > len ) { <END_BUG> return op -> size ; }  int min_val = ( ut32 ) ( UINT ( data, pos + 4 ) ), <START_BUG> max_val = ( ut32 ) ( UINT ( data, pos + 8 ) ) ; ut32 default_loc = ( ut32 ) ( UINT ( data, pos ) ), cur_case = 0 ; op -> switch_op = r_anal_switch_op_new ( addr, min_val, default_loc ) ; RAnalCaseOp * caseop = NULL ; pos += 12 ; if ( max_val > min_val && ( ( max_val - min_val ) < ( UT16_MAX // 4 ) ) ) { for ( cur_case = 0 ; cur_case <= max_val - min_val ; pos += 4, cur_case ++ ) { if ( pos + 4 >= len ) { break ; } int offset = ( int ) ( ut32 ) ( R_BIN_JAVA_UINT ( data, pos ) ) ; caseop = r_anal_switch_op_add_case ( op -> switch_op, addr + pos, cur_case + min_val, addr + offset ) ; if ( caseop ) { caseop -> bb_ref_to = addr + offset ; caseop -> bb_ref_from = addr ; } } } else { eprintf ( "Invalid   switch   boundaries   at   0x%" PFMT64x "\\n", addr ) ; } } op -> size = pos ; return op -> size ; }<END_BUG>

Fix:
<S2SV_ModStart> pos + 8 + 8 <S2SV_ModStart> size ; } const <S2SV_ModStart> 4 ) ) ; const int <S2SV_ModEnd> max_val = (
Buggy code:
 jp2_box_t * jp2_box_get ( jas_stream_t * in ) { jp2_box_t * box ; jp2_boxinfo_t * boxinfo ; jas_stream_t * tmpstream ; uint_fast32_t len ; uint_fast64_t extlen ; bool dataflag ; box = 0 ; tmpstream = 0 ; if (! ( box = jas_malloc ( sizeof ( jp2_box_t ) ) ) ) { goto error ; } box -> ops = & jp2_boxinfo_unk. ops ; if ( jp2_getuint32 ( in, & len ) || jp2_getuint32 ( in, & box -> type ) ) { goto error ; } boxinfo = jp2_boxinfolookup ( box -> type ) ; <START_BUG> box -> info = boxinfo ; <END_BUG> box -> ops = & boxinfo -> ops ; box -> len = len ; JAS_DBGLOG ( 10, ( "preliminary   processing   of   JP2   box:   type=%c%s%c   (0x%08x);   length=%d\\n", \'"\', boxinfo -> name, \'"\', box -> type, box -> len ) ) ; if ( box -> len == 1 ) { if ( jp2_getuint64 ( in, & extlen ) ) { goto error ; } if ( extlen > 0xffffffffUL ) { jas_eprintf ( "warning:   cannot   handle   large   64-bit   box   length\\n" ) ; extlen = 0xffffffffUL ; } box -> len = extlen ; box -> datalen = extlen - JP2_BOX_HDRLEN ( true ) ; } else { box -> datalen = box -> len - JP2_BOX_HDRLEN ( false ) ; } if ( box -> len!= 0 && box -> len < 8 ) { goto error ; } dataflag =! ( box -> info -> flags & ( JP2_BOX_SUPER | JP2_BOX_NODATA ) ) ; if ( dataflag ) { if (! ( tmpstream = jas_stream_memopen ( 0, 0 ) ) ) { goto error ; } if ( jas_stream_copy ( tmpstream, in, box ->

Fix:
<S2SV_ModStart> info = boxinfo <S2SV_ModEnd> ; box -> <S2SV_ModStart> ) ) { <S2SV_ModEnd> jas_eprintf ( "cannot <S2SV_blank> copy <S2SV_blank> box <S2SV_blank> data\\n" <S2SV_ModStart> ( tmpstream ) ; box -> ops = & boxinfo -> ops
Buggy code:
 static int download ( struct SPDBDownloader * pd ) { SPDBDownloaderOpt * opt = pd -> opt ; <START_BUG> char * curl_cmd = NULL ; <END_BUG> char * extractor_cmd = NULL ; char * abspath_to_archive = NULL ; char * abspath_to_file = NULL ; char * archive_name = NULL ; size_t archive_name_len = 0 ; char * symbol_store_path = NULL ; char * dbg_file = NULL ; char * guid = NULL ; char * archive_name_escaped = NULL ; char * user_agent = NULL ; char * symbol_server = NULL ; int res = 0 ; int cmd_ret ; if (! opt -> dbg_file ||! * opt -> dbg_file ) { return 0 ; }  if (! checkCurl ( ) ) { <START_BUG> return 0 ; } archive_name_len = strlen ( opt -> dbg_file ) ; archive_name = malloc ( archive_name_len + 1 ) ; if (! archive_name ) { return 0 ; } memcpy ( archive_name, opt -> dbg_file, archive_name_len + 1 ) ; archive_name [ archive_name_len - 1 ] = '_' ; <END_BUG> symbol_store_path = r_str_escape ( opt -> symbol_store_path ) ;  dbg_file = r_str_escape ( opt -> dbg_file ) ; guid = r_str_escape ( opt -> guid ) ; archive_name_escaped = r_str_escape ( archive_name ) ; user_agent = r_str_escape ( opt -> user_agent ) ; symbol_server = r_str_escape ( opt -> symbol_server ) ; <START_BUG> abspath_to_archive = r_str_newf ( "%s%s%s%s%s%s%s", <END_BUG> symbol_store_path, R_SYS_DIR, dbg_file, R_SYS_DIR, guid, R_SYS_DIR, archive_name_escaped ) ; abspath_to_file = strdup ( abspath_to_archive ) ; abspath_to_file [ strlen ( abspath_to_file ) - 1 ] = 'b' ; if ( r_file_exists ( abspath_to_file ) ) { eprintf ( "File   already   downloaded.\\n" ) ; R_

Fix:
<S2SV_ModStart> -> opt ; <S2SV_ModEnd> int res = <S2SV_ModStart> 0 ; } char * abspath_to_file = r_str_newf ( "%s%s%s%s%s%s%s", opt -> symbol_store_path, R_SYS_DIR, opt -> dbg_file, R_SYS_DIR, opt -> guid, R_SYS_DIR, opt -> dbg_file ) ; if ( r_file_exists ( abspath_to_file ) ) { eprintf ( "File <S2SV_blank> already <S2SV_blank> downloaded.\\n" ) ; free ( abspath_to_file ) ; return 1 ; } if ( checkExtract ( ) || opt -> extract == 0 ) { char * extractor_cmd = NULL ; char * archive_name = strdup ( opt -> dbg_file ) ; archive_name [ strlen ( archive_name ) <S2SV_ModEnd> - 1 ] <S2SV_ModStart> = '_' ; char * abspath_to_archive = r_str_newf ( "%s%s%s%s%s%s%s", opt -> symbol_store_path, R_SYS_DIR, opt -> dbg_file, R_SYS_DIR, opt -> guid, R_SYS_DIR,
Buggy code:
 OM_uint32 kg_seal_iov ( OM_uint32 * minor_status, gss_ctx_id_t context_handle, int conf_req_flag, gss_qop_t qop_req, int * conf_state, gss_iov_buffer_desc * iov, int iov_count, int toktype ) { krb5_gss_ctx_id_rec * ctx ; krb5_error_code code ; krb5_context context ; if ( qop_req!= 0 ) { * minor_status = ( OM_uint32 ) G_UNKNOWN_QOP ; return GSS_S_FAILURE ; } ctx = ( krb5_gss_ctx_id_rec * ) context_handle ; <START_BUG> if (! ctx -> established ) { <END_BUG> * minor_status = KG_CTX_INCOMPLETE ; return GSS_S_NO_CONTEXT ; } if ( conf_req_flag && kg_integ_only_iov ( iov, iov_count ) ) { conf_req_flag = FALSE ; } context = ctx -> k5_context ; switch ( ctx -> proto ) { case 0 : code = make_seal_token_v1_iov ( context, ctx, conf_req_flag, conf_state, iov, iov_count, toktype ) ; break ; case 1 : code = gss_krb5int_make_seal_token_v3_iov ( context, ctx, conf_req_flag, conf_state, iov, iov_count, toktype ) ; break ; default : code = G_UNKNOWN_QOP ; break ; } if ( code!= 0 ) { * minor_status = code ; save_error_info ( * minor_status, context ) ; return GSS_S_FAILURE ; } * minor_status = 0 ; return GSS_S_COMPLETE ; }

Fix:
<S2SV_ModStart> ; if ( ctx -> terminated ||
Buggy code:
 struct resource_pool * dcn10_create_resource_pool ( const struct dc_init_data * init_data, struct dc * dc ) { struct dcn10_resource_pool * pool = kzalloc ( sizeof ( struct dcn10_resource_pool ), GFP_KERNEL ) ; if (! pool ) return NULL ; if ( construct ( init_data -> num_virtual_links, dc, pool ) ) return & pool -> base ; <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> -> base ; kfree ( pool ) ;
Buggy code:
 static int http_rxchunk ( struct http * hp ) { char * q ; int l, i ; l = hp -> prxbuf ; do ( void ) http_rxchar ( hp, 1, 0 ) ; while ( hp -> rxbuf [ hp -> prxbuf - 1 ]!= '\\n' ) ; vtc_dump ( hp -> vl, 4, "len", hp -> rxbuf + l, - 1 ) ; i = strtoul ( hp -> rxbuf + l, & q, 16 ) ; bprintf ( hp -> chunklen, "%d", i ) ; if ( ( q == hp -> rxbuf + l ) || ( * q!= '\\0' &&! vct_islws ( * q ) ) ) { vtc_log ( hp -> vl, hp -> fatal, "chunked   fail   %02x   @   %d", * q, q - ( hp -> rxbuf + l ) ) ; } assert ( q!= hp -> rxbuf + l ) ; assert ( * q == '\\0' || vct_islws ( * q ) ) ; hp -> prxbuf = l ; if ( i > 0 ) { ( void ) http_rxchar ( hp, i, 0 ) ; vtc_dump ( hp -> vl, 4, "chunk", hp -> rxbuf + l, i ) ; } l = hp -> prxbuf ; ( void ) http_rxchar ( hp, 2, 0 ) ; <START_BUG> if (! vct_iscrlf ( hp -> rxbuf [ l ] ) ) <END_BUG> vtc_log ( hp -> vl, hp -> fatal, "Wrong   chunk   tail[0]   =   %02x", hp -> rxbuf [ l ] & 0xff ) ;  if (! vct_iscrlf ( hp -> rxbuf [ l + 1 ] ) ) <START_BUG> vtc_log ( hp -> vl, hp -> fatal, "Wrong   chunk   tail[1]   =   %02x", hp -> rxbuf [ l + 1 ] & 0xff ) ; hp -> prxbuf = l ; hp -> rxbuf [ l ] = '\\0' ; return ( i ) ; }<END_BUG>

Fix:
<S2SV_ModStart>! vct_iscrlf ( & <S2SV_ModStart>! vct_iscrlf ( &
Buggy code:
 int kvm_set_msr_common ( struct kvm_vcpu * vcpu, struct msr_data * msr_info ) { bool pr = false ; u32 msr = msr_info -> index ; u64 data = msr_info -> data ; switch ( msr ) { case MSR_AMD64_NB_CFG : case MSR_IA32_UCODE_REV : case MSR_IA32_UCODE_WRITE : case MSR_VM_HSAVE_PA : case MSR_AMD64_PATCH_LOADER : case MSR_AMD64_BU_CFG2 : break ; case MSR_EFER : return set_efer ( vcpu, data ) ; case MSR_K7_HWCR : data &= ~ ( u64 ) 0x40 ; data &= ~ ( u64 ) 0x100 ; data &= ~ ( u64 ) 0x8 ; if ( data!= 0 ) { vcpu_unimpl ( vcpu, "unimplemented   HWCR   wrmsr:   0x%llx\\n", data ) ; return 1 ; } break ; case MSR_FAM10H_MMIO_CONF_BASE : if ( data!= 0 ) { vcpu_unimpl ( vcpu, "unimplemented   MMIO_CONF_BASE   wrmsr:   " "0x%llx\\n", data ) ; return 1 ; } break ; case MSR_IA32_DEBUGCTLMSR : if (! data ) { break ; } else if ( data & ~ ( DEBUGCTLMSR_LBR | DEBUGCTLMSR_BTF ) ) { return 1 ; } vcpu_unimpl ( vcpu, "%s:   MSR_IA32_DEBUGCTLMSR   0x%llx,   nop\\n", __func__, data ) ; break ; case 0x200... 0x2ff : return set_msr_mtrr ( vcpu, msr, data ) ; case MSR_IA32_APICBASE : kvm_set_apic_base ( vcpu, data ) ; break ; case APIC_BASE_MSR... APIC_BASE_MSR + 0x3ff : return kvm_x

Fix:
<S2SV_ModStart> MSR_KVM_SYSTEM_TIME : { u64 gpa_offset ; <S2SV_ModStart> ) break ; gpa_offset <S2SV_ModEnd> = data & <S2SV_ModStart> ; if ( gpa_offset <S2SV_ModEnd> & ( sizeof <S2SV_ModStart> ) break ; if ( kvm_gfn_to_hva_cache_init <S2SV_ModEnd> ( vcpu -> <S2SV_ModStart> -> kvm, & vcpu -> arch. pv_time, data & ~ 1ULL ) ) vcpu -> arch. pv_time_enabled = false ; else vcpu -> arch. pv_time_enabled = true <S2SV_ModEnd> ; break ;
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG> fprintf ( stderr, "Usage:   %s   <infile>   <outfile>   <N-M|N//M>\\n", exec_name ) ; exit ( EXIT_FAILURE ) ; }

Fix:
<S2SV_ModStart> void usage_exit ( void