nus-yam/ex-repair huggingface dataset:
Buggy code:
 BOOL SQLWriteFileDSN ( LPCSTR pszFileName, LPCSTR pszAppName, LPCSTR pszKeyName, LPCSTR pszString ) { HINI hIni ; char szFileName [ ODBC_FILENAME_MAX + 1 ] ; if ( pszFileName [ 0 ] == '//' ) { <START_BUG> strncpy ( szFileName, sizeof ( szFileName ) - 5, pszFileName ) ; <END_BUG> } else { char szPath [ ODBC_FILENAME_MAX + 1 ] ; * szPath = '\\0' ; _odbcinst_FileINI ( szPath ) ; snprintf ( szFileName, sizeof ( szFileName ) - 5, "%s//%s", szPath, pszFileName ) ; } if ( strlen ( szFileName ) < 4 || strcmp ( szFileName + strlen ( szFileName ) - 4, ".dsn" ) ) { strcat ( szFileName, ".dsn" ) ; } # ifdef __OS2__ if ( iniOpen ( & hIni, szFileName, "#;", '[', ']', '=', TRUE, 0L )!= INI_SUCCESS ) # else if ( iniOpen ( & hIni, szFileName, "#;", '[', ']', '=', TRUE )!= INI_SUCCESS ) # endif { inst_logPushMsg ( __FILE__, __FILE__, __LINE__, LOG_CRITICAL, ODBC_ERROR_INVALID_PATH, "" ) ; return FALSE ; } if ( pszString == NULL && pszKeyName == NULL ) { if ( iniObjectSeek ( hIni, ( char * ) pszAppName ) == INI_SUCCESS ) { iniObjectDelete ( hIni ) ; } } else if ( pszString == NULL ) { if ( iniPropertySeek ( hIni, ( char * ) pszAppName, ( char * ) pszKeyName, "" ) == INI_SUCCESS ) { iniPropertyDelete ( hIni ) ; } } else { if ( iniObjectSeek ( hIni, ( char * ) pszAppName )!= INI_SUCCESS ) { iniObjectInsert ( hIni, ( char * ) pszAppName ) ; } if ( iniPropertySeek ( hIni, ( char * ) pszAppName, ( char * ) pszKeyName, "" ) == INI_SUCCESS ) { iniObjectSeek ( hIni, ( char * )

Fix:
<S2SV_ModStart> ( szFileName, pszFileName, <S2SV_ModStart> ) - 5 <S2SV_ModEnd> ) ; }
Buggy code:
 int vp8_yv12_realloc_frame_buffer ( YV12_BUFFER_CONFIG * ybf, int width, int height, int border ) { if ( ybf ) { int aligned_width = ( width + 15 ) & ~ 15 ; int aligned_height = ( height + 15 ) & ~ 15 ; int y_stride = ( ( aligned_width + 2 * border ) + 31 ) & ~ 31 ; int yplane_size = ( aligned_height + 2 * border ) * y_stride ; int uv_width = aligned_width >> 1 ; int uv_height = aligned_height >> 1 ; int uv_stride = y_stride >> 1 ; int uvplane_size = ( uv_height + border ) * uv_stride ; const int frame_size = yplane_size + 2 * uvplane_size ; if (! ybf -> buffer_alloc ) { ybf -> buffer_alloc = ( uint8_t * ) vpx_memalign ( 32, frame_size ) ; ybf -> buffer_alloc_sz = frame_size ; } if (! ybf -> buffer_alloc || ybf -> buffer_alloc_sz < frame_size ) return - 1 ; if ( border & 0x1f ) return - 3 ; ybf -> y_crop_width = width ; ybf -> y_crop_height = height ; ybf -> y_width = aligned_width ; ybf -> y_height = aligned_height ; ybf -> y_stride = y_stride ; <START_BUG> ybf -> uv_width = uv_width ; <END_BUG> ybf -> uv_height = uv_height ; ybf -> uv_stride = uv_stride ; ybf -> alpha_width = 0 ; ybf -> alpha_height = 0 ; ybf -> alpha_stride = 0 ; ybf -> border = border ; ybf -> frame_size = frame_size ; ybf -> y_buffer = ybf -> buffer_alloc + ( border * y_stride ) + border ; ybf -> u_buffer = ybf -> buffer_alloc + yplane_size + ( border // 2 * uv_stride ) + border // 2 ; ybf -> v_buffer = ybf -> buffer_alloc + yplane_size + uvplane_size + ( border // 2 * uv_stride ) + border // 2 ; ybf ->

Fix:
<S2SV_ModStart> ; ybf -> uv_crop_width = ( width + 1 ) // 2 ; ybf -> uv_crop_height = ( height + 1 ) // 2 ; ybf ->
Buggy code:
 static int em_call_far ( struct x86_emulate_ctxt * ctxt ) { u16 sel, old_cs ; ulong old_eip ; int rc ; <START_BUG> old_cs = get_segment_selector ( ctxt, VCPU_SREG_CS ) ; <END_BUG> old_eip = ctxt -> _eip ; memcpy ( & sel, ctxt -> src. valptr + ctxt -> op_bytes, 2 ) ;  if ( load_segment_descriptor ( ctxt, sel, VCPU_SREG_CS ) ) <START_BUG> return X86EMUL_CONTINUE ; <END_BUG> ctxt -> _eip = 0 ;  memcpy ( & ctxt -> _eip, ctxt -> src. valptr, ctxt -> op_bytes ) ; ctxt -> src. val = old_cs ; rc = em_push ( ctxt ) ; if ( rc!= X86EMUL_CONTINUE ) return rc ; ctxt -> src. val = old_eip ; return em_push ( ctxt ) ; }

Fix:
<S2SV_ModStart> int rc ; struct desc_struct old_desc, new_desc ; const struct x86_emulate_ops * ops = ctxt -> ops ; int cpl = ctxt -> ops -> cpl ( ctxt ) ; old_eip = ctxt -> _eip ; ops -> get_segment ( ctxt, & old_cs, & old_desc, NULL <S2SV_ModEnd>, VCPU_SREG_CS ) <S2SV_ModStart>, VCPU_SREG_CS ) <S2SV_ModEnd> ; memcpy ( <S2SV_ModStart> 2 ) ; rc = __load_segment_descriptor <S2SV_ModEnd> ( ctxt, <S2SV_ModStart> sel, VCPU_SREG_CS, cpl, false, & new_desc ) ; if ( rc!= X86EMUL_CONTINUE <S2SV_ModEnd> ) return X86EMUL_CONTINUE <S2SV_ModStart> return X86EMUL_CONTINUE ; rc = assign_eip_far ( ctxt, ctxt -> src. val, new_desc. l ) ; if ( rc!= X86EMUL_CONTINUE ) goto fail ; ctxt -> src. val = old_cs ; rc = em_push ( ctxt ) ; if ( rc!= X86EMUL_CONTINUE ) goto fail ; ctxt -> src. val = old_eip
Buggy code:
 static struct super_block * alloc_super ( struct file_system_type * type, int flags ) { struct super_block * s = kzalloc ( sizeof ( struct super_block ), GFP_USER ) ; static const struct super_operations default_op ; int i ; if (! s ) return NULL ; if ( security_sb_alloc ( s ) ) goto fail ; <START_BUG> # ifdef CONFIG_SMP <END_BUG> s -> s_files = alloc_percpu ( struct list_head ) ; if (! s -> s_files ) goto fail ;  for_each_possible_cpu ( i ) <START_BUG> INIT_LIST_HEAD ( per_cpu_ptr ( s -> s_files, i ) ) ; # else INIT_LIST_HEAD ( & s -> s_files ) ; # endif for ( i = 0 ; i < SB_FREEZE_LEVELS ; i ++ ) { if ( percpu_counter_init ( & s -> s_writers. counter [ i ], 0 ) < 0 ) goto fail ; <END_BUG> lockdep_init_map ( & s -> s_writers. lock_map [ i ], sb_writers_name [ i ],  & type -> s_writers_key [ i ], 0 ) ; } init_waitqueue_head ( & s -> s_writers. wait ) ; init_waitqueue_head ( & s -> s_writers. wait_unfrozen ) ; s -> s_flags = flags ; s -> s_bdi = & default_backing_dev_info ; INIT_HLIST_NODE ( & s -> s_instances ) ; INIT_HLIST_BL_HEAD ( & s -> s_anon ) ; INIT_LIST_HEAD ( & s -> s_inodes ) ; <START_BUG> if ( list_lru_init ( & s -> s_dentry_lru ) ) <END_BUG> goto fail ;  if ( list_lru_init ( & s -> s_inode_lru ) ) <START_BUG> goto fail ; INIT_LIST_HEAD ( & s -> s_mounts ) ; init_rwsem ( & s -> s_umount ) ; lockdep_set_class ( & s -> s_umount, & type -> s_umount_key ) ; down_write_nested ( & s -> s<END_BUG>

Fix:
<S2SV_ModStart> goto fail ; for ( i = 0 ; i < SB_FREEZE_LEVELS ; i ++ ) { if ( percpu_counter_init ( & s -> s_writers. counter [ i ], 0 ) < 0 <S2SV_ModEnd> ) goto fail <S2SV_ModStart> goto fail ; lockdep_init_map ( & s -> s_writers. lock_map [ i ], sb_writers_name [ i ], & type -> s_writers_key [ i ], 0 ) ; } init_waitqueue_head ( & s -> s_writers. wait ) ; init_waitqueue_head ( & s -> s_writers. wait_unfrozen ) ; s -> s_flags = flags ; s -> s_bdi = & default_backing_dev_info ; INIT_HLIST_NODE ( & s -> s_instances ) ; INIT_HLIST_BL_HEAD ( & s -> s_anon ) ; INIT_LIST_HEAD ( & s -> s_inodes ) ; if ( list_lru_init ( & s -> s_dentry_lru ) <S2SV_ModEnd> ) goto fail <S2SV_ModStart> goto fail ; <S2SV_ModEnd> if (
Buggy code:
 void vpx_img_write ( const vpx_image_t * img, FILE * file ) { int plane ; for ( plane = 0 ; plane < 3 ; ++ plane ) { const unsigned char * buf = img -> planes [ plane ] ; const int stride = img -> stride [ plane ] ; <START_BUG> const int w = vpx_img_plane_width ( img, plane ) ; <END_BUG> const int h = vpx_img_plane_height ( img, plane ) ; int y ; for ( y = 0 ; y < h ; ++ y ) { fwrite ( buf, 1, w, file ) ; buf += stride ; } } }

Fix:
<S2SV_ModStart>, plane ) * ( ( img -> fmt & VPX_IMG_FMT_HIGHBITDEPTH )? 2 : 1 )
Buggy code:
 <START_BUG> void ntlm_populate_message_header ( NTLM_MESSAGE_HEADER * header, UINT32 MessageType ) <END_BUG> { CopyMemory ( header -> Signature, NTLM_SIGNATURE, sizeof ( NTLM_SIGNATURE ) ) ; header -> MessageType = MessageType ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; one = 1 ; image = AcquireImage ( image_info ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImage

Fix:
<S2SV_ModStart> ) // 3 ) ThrowReaderException ( CorruptImageError, "InvalidColormapIndex" ) ; if ( WPG_Palette. StartIndex > WPG_Palette. NumOfEntries
Buggy code:
 static void exif_mnote_data_canon_load ( ExifMnoteData * ne, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataCanon * n = ( ExifMnoteDataCanon * ) ne ; ExifShort c ; size_t i, tcount, o, datao ; if (! n ||! buf ||! buf_size ) { exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteCanon", "Short   MakerNote" ) ; return ; } datao = 6 + n -> offset ; if ( CHECKOVERFLOW ( datao, buf_size, 2 ) ) { exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteCanon", "Short   MakerNote" ) ; return ; } c = exif_get_short ( buf + datao, n -> order ) ; datao += 2 ; exif_mnote_data_canon_clear ( n ) ; n -> entries = exif_mem_alloc ( ne -> mem, sizeof ( MnoteCanonEntry ) * c ) ; if (! n -> entries ) { EXIF_LOG_NO_MEMORY ( ne -> log, "ExifMnoteCanon", sizeof ( MnoteCanonEntry ) * c ) ; return ; } tcount = 0 ; for ( i = c, o = datao ; i ; -- i, o += 12 ) { size_t s ; <START_BUG> if ( CHECKOVERFLOW ( o, buf_size, 12 ) ) { <END_BUG> exif_log ( ne -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteCanon", "Short   MakerNote" ) ; break ; } n -> entries [ tcount ]. tag = exif_get_short ( buf + o, n -> order ) ; n -> entries [ tcount ]. format = exif_get_short ( buf + o + 2, n -> order ) ; n -> entries [ tcount ]. components = exif_get_long ( buf + o + 4, n -> order ) ; n -> entries [ tcount ]. order = n -> order ; exif_log ( ne -> log, EXIF_LOG_CODE_

Fix:
<S2SV_ModStart> size_t s ; memset ( & n -> entries [ tcount ], 0, sizeof ( MnoteCanonEntry ) ) ;
Buggy code:
 bool_t enc624j600IrqHandler ( NetInterface * interface ) { bool_t flag ; uint16_t status ; flag = FALSE ; <START_BUG> enc624j600ClearBit ( interface, ENC624J600_REG_EIE, EIE_INTIE ) ; <END_BUG>  status = enc624j600ReadReg ( interface, ENC624J600_REG_EIR ) ; <START_BUG> <END_BUG> if ( ( status & EIR_LINKIF )!= 0 )  { <START_BUG> enc624j600ClearBit ( interface, ENC624J600_REG_EIE, EIE_LINKIE ) ; <END_BUG> interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; }  if ( ( status & EIR_PKTIF )!= 0 ) <START_BUG> { <END_BUG> enc624j600ClearBit ( interface, ENC624J600_REG_EIE, EIE_PKTIE ) ;  interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; } <START_BUG> if ( ( status & ( EIR_TXIF | EIR_TXABTIF ) )!= 0 ) <END_BUG> {  enc624j600ClearBit ( interface, ENC624J600_REG_EIR, EIR_TXIF | EIR_TXABTIF ) ; <START_BUG> flag |= osSetEventFromIsr ( & interface -> nicTxEvent ) ; } <END_BUG> enc624j600SetBit ( interface, ENC624J600_REG_EIE, EIE_INTIE ) ;  return flag ; }

Fix:
<S2SV_ModStart> ( interface, ENC624J600_EIE, ENC624J600_EIE_INTIE <S2SV_ModEnd> ) ; status <S2SV_ModStart> ( interface, ENC624J600_EIR <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( status & ENC624J600_EIR_LINKIF <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC624J600_EIE, ENC624J600_EIE_LINKIE <S2SV_ModEnd> ) ; interface <S2SV_ModStart> ( status & ENC624J600_EIR_PKTIF <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC624J600_EIE, ENC624J600_EIE_PKTIE <S2SV_ModEnd> ) ; interface <S2SV_ModStart> status & ( ENC624J600_EIR_TXIF | ENC624J600_EIR_TXABTIF <S2SV_ModEnd> ) )!= <S2SV_ModStart> ( interface, ENC624J600_EIR, ENC624J600_EIR_TXIF | ENC624J600_EIR_TXABTIF <S2SV_ModEnd> ) ; flag <S2SV_ModStart> ( interface, ENC624J600_EIE, ENC624J600_EIE_INT
Buggy code:
 <START_BUG> void * zmalloc ( size_t size ) { <END_BUG> void * ptr = malloc ( size + PREFIX_SIZE ) ; if (! ptr ) zmalloc_oom_handler ( size ) ; # ifdef HAVE_MALLOC_SIZE update_zmalloc_stat_alloc ( zmalloc_size ( ptr ) ) ; return ptr ; # else * ( ( size_t * ) ptr ) = size ; update_zmalloc_stat_alloc ( size + PREFIX_SIZE ) ; return ( char * ) ptr + PREFIX_SIZE ; # endif }

Fix:
<S2SV_ModStart> size ) { ASSERT_NO_SIZE_OVERFLOW ( size ) ;
Buggy code:
 WORD32 ih264d_parse_sei_message ( dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm ) { UWORD32 ui4_payload_type, ui4_payload_size ; UWORD32 u4_bits ; WORD32 i4_status = 0 ; do { ui4_payload_type = 0 ; u4_bits = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ; <START_BUG> while ( 0xff == u4_bits ) <END_BUG> { u4_bits = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ; ui4_payload_type += 255 ; } ui4_payload_type += u4_bits ; ui4_payload_size = 0 ; u4_bits = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ;  while ( 0xff == u4_bits ) <START_BUG> { u4_bits = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ; ui4_payload_size += 255 ; } ui4_payload_size += u4_bits ; i4_status = ih264d_parse_sei_payload ( ps_bitstrm, ui4_payload_type, ui4_payload_size, ps_dec ) ; if ( i4_status == - 1 ) { i4_status = 0 ; break ; } if ( i4_status!= OK ) return i4_status ; if ( ih264d_check_byte_aligned ( ps_bitstrm ) == 0 ) { u4_bits = ih264d_get_bit_h264 ( ps_bitstrm ) ; if ( 0 == u4_bits ) { H264_DEC_DEBUG_PRINT ( "\\nError   in   parsing   SEI   message" ) ; } <END_BUG> while ( 0 == ih264d_check_byte_aligned ( ps_bitstrm ) )  { u4_bits = ih264d_get_bit_h264 ( ps_bitstrm ) ; if ( u4_bits ) { H264_DEC_DEBUG_PRINT ( "\\nError   in   parsing   SEI   message" ) ; } } } } while (

Fix:
<S2SV_ModStart> 0xff == u4_bits &&! EXCEED_OFFSET ( ps_bitstrm ) <S2SV_ModStart> 0xff == u4_bits &&! EXCEED_OFFSET ( ps_bitstrm ) <S2SV_ModStart> 0 == ih264d_check_byte_aligned ( ps_bitstrm ) &&! EXCEED_OFFSET
Buggy code:
 bool radeon_atom_get_tv_timings ( struct radeon_device * rdev, int index, struct drm_display_mode * mode ) { struct radeon_mode_info * mode_info = & rdev -> mode_info ; ATOM_ANALOG_TV_INFO * tv_info ; ATOM_ANALOG_TV_INFO_V1_2 * tv_info_v1_2 ; ATOM_DTD_FORMAT * dtd_timings ; int data_index = GetIndexIntoMasterTable ( DATA, AnalogTV_Info ) ; u8 frev, crev ; u16 data_offset, misc ; if (! atom_parse_data_header ( mode_info -> atom_context, data_index, NULL, & frev, & crev, & data_offset ) ) return false ; switch ( crev ) { case 1 : tv_info = ( ATOM_ANALOG_TV_INFO * ) ( mode_info -> atom_context -> bios + data_offset ) ; <START_BUG> if ( index > MAX_SUPPORTED_TV_TIMING ) <END_BUG> return false ; mode -> crtc_htotal = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_Total ) ; mode -> crtc_hdisplay = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_Disp ) ; mode -> crtc_hsync_start = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_SyncStart ) ; mode -> crtc_hsync_end = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_SyncStart ) + le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_H_SyncWidth ) ; mode -> crtc_vtotal = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_V_Total ) ; mode -> crtc_vdisplay = le16_to_cpu ( tv_info -> aModeTimings [ index ]. usCRTC_V_Disp ) ; mode -> crtc_vsync

Fix:
<S2SV_ModStart> if ( index >= <S2SV_ModEnd> MAX_SUPPORTED_TV_TIMING ) return <S2SV_ModStart> if ( index >= <S2SV_ModEnd> MAX_SUPPORTED_TV_TIMING_V1_2 ) return
Buggy code:
 int inet_sk_rebuild_header ( struct sock * sk ) { struct inet_sock * inet = inet_sk ( sk ) ; struct rtable * rt = ( struct rtable * ) __sk_dst_check ( sk, 0 ) ; __be32 daddr ; <START_BUG> int err ; <END_BUG> if ( rt ) return 0 ;  daddr = inet -> inet_daddr ; <START_BUG> <END_BUG> if ( inet -> opt && inet -> opt -> srr )  daddr = inet -> opt -> faddr ; rt = ip_route_output_ports ( sock_net ( sk ), sk, daddr, inet -> inet_saddr, inet -> inet_dport, inet -> inet_sport, sk -> sk_protocol, RT_CONN_FLAGS ( sk ), sk -> sk_bound_dev_if ) ; if (! IS_ERR ( rt ) ) { err = 0 ; sk_setup_caps ( sk, & rt -> dst ) ; } else { err = PTR_ERR ( rt ) ; sk -> sk_route_caps = 0 ; if (! sysctl_ip_dynaddr || sk -> sk_state!= TCP_SYN_SENT || ( sk -> sk_userlocks & SOCK_BINDADDR_LOCK ) || ( err = inet_sk_reselect_saddr ( sk ) )!= 0 ) sk -> sk_err_soft = - err ; } return err ; }

Fix:
<S2SV_ModStart> __be32 daddr ; struct ip_options_rcu * inet_opt ; <S2SV_ModStart> return 0 ; rcu_read_lock ( ) ; inet_opt = rcu_dereference ( inet -> inet_opt ) ; <S2SV_ModStart> ; if ( inet_opt && inet_opt -> opt. srr ) daddr = inet_opt -> opt. faddr ; rcu_read_unlock ( ) <S2SV_ModEnd> ; rt =
Buggy code:
 void vp9_temporal_filter_apply_c ( uint8_t * frame1, unsigned int stride, uint8_t * frame2, <START_BUG> unsigned int block_size, <END_BUG> int strength, int filter_weight, unsigned int * accumulator, uint16_t * count ) { unsigned int i, j, k ; int modifier ; int byte = 0 ;  for ( i = 0, k = 0 ; i < block_size ; i ++ ) { <START_BUG> <END_BUG> for ( j = 0 ; j < block_size ; j ++, k ++ ) {  int src_byte = frame1 [ byte ] ; int pixel_value = * frame2 ++ ; modifier = src_byte - pixel_value ; modifier *= modifier ; modifier *= 3 ; <START_BUG> modifier += 1 << ( strength - 1 ) ; <END_BUG> modifier >>= strength ; if ( modifier > 16 ) modifier = 16 ; modifier = 16 - modifier ; modifier *= filter_weight ; count [ k ] += modifier ; accumulator [ k ] += modifier * pixel_value ; byte ++ ; }  byte += stride - block_size ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart>, unsigned int block_width, unsigned int block_height <S2SV_ModEnd>, int strength <S2SV_ModStart> = 0 ; const int rounding = strength > 0? 1 << ( strength - 1 ) : 0 ; <S2SV_ModStart> ; i < block_height <S2SV_ModEnd> ; i ++ <S2SV_ModStart> ; j < block_width <S2SV_ModEnd> ; j ++ <S2SV_ModStart> ; modifier += rounding <S2SV_ModEnd> ; modifier >>= <S2SV_ModStart> += stride - block_width <S2SV_ModEnd> ; } }
Buggy code:
 static int kvm_vm_ioctl_create_vcpu ( struct kvm * kvm, u32 id ) { int r ; struct kvm_vcpu * vcpu, * v ; <START_BUG> vcpu = kvm_arch_vcpu_create ( kvm, id ) ; <END_BUG> if ( IS_ERR ( vcpu ) ) return PTR_ERR ( vcpu ) ; preempt_notifier_init ( & vcpu -> preempt_notifier, & kvm_preempt_ops ) ; r = kvm_arch_vcpu_setup ( vcpu ) ; if ( r ) goto vcpu_destroy ; mutex_lock ( & kvm -> lock ) ; if (! kvm_vcpu_compatible ( vcpu ) ) { r = - EINVAL ; goto unlock_vcpu_destroy ; } if ( atomic_read ( & kvm -> online_vcpus ) == KVM_MAX_VCPUS ) { r = - EINVAL ; goto unlock_vcpu_destroy ; } kvm_for_each_vcpu ( r, v, kvm ) if ( v -> vcpu_id == id ) { r = - EEXIST ; goto unlock_vcpu_destroy ; } BUG_ON ( kvm -> vcpus [ atomic_read ( & kvm -> online_vcpus ) ] ) ; kvm_get_kvm ( kvm ) ; r = create_vcpu_fd ( vcpu ) ; if ( r < 0 ) { kvm_put_kvm ( kvm ) ; goto unlock_vcpu_destroy ; } kvm -> vcpus [ atomic_read ( & kvm -> online_vcpus ) ] = vcpu ; smp_wmb ( ) ; atomic_inc ( & kvm -> online_vcpus ) ; mutex_unlock ( & kvm -> lock ) ; kvm_arch_vcpu_postcreate ( vcpu ) ; return r ; unlock_vcpu_destroy : mutex_unlock ( & kvm -> lock ) ; vcpu_destroy : kvm_arch_vcpu_destroy ( vcpu ) ; return r ; }

Fix:
<S2SV_ModStart> * v ; if ( id >= KVM_MAX_VCPUS ) return - EINVAL ;
Buggy code:
 void rs_filter_graph ( RSFilter * filter ) { <START_BUG> g_return_if_fail ( RS_IS_FILTER ( filter ) ) ; <END_BUG> GString * str = g_string_new ( "digraph   G   {\\n" ) ; rs_filter_graph_helper ( str, filter ) ; g_string_append_printf ( str, "}\\n" ) ;  g_file_set_contents ( "//tmp//rs-filter-graph", str -> str, str -> len, NULL ) ; <START_BUG> <END_BUG> if ( 0!= system ( "dot   -Tpng   >//tmp//rs-filter-graph.png   <//tmp//rs-filter-graph" ) )  g_warning ( "Calling   dot   failed" ) ; <START_BUG> if ( 0!= system ( "gnome-open   //tmp//rs-filter-graph.png" ) ) <END_BUG>  g_warning ( "Calling   gnome-open   failed." ) ; <START_BUG> g_string_free ( str, TRUE ) ; }<END_BUG>

Fix:
<S2SV_ModStart> filter ) ) ; gchar * dot_filename ; gchar * png_filename ; gchar * command_line <S2SV_ModStart> "}\\n" ) ; dot_filename = g_strdup_printf ( "//tmp//rs-filter-graph.%u", g_random_int ( ) ) ; png_filename = g_strdup_printf ( "%s.%u.png", dot_filename, g_random_int ( ) ) ; g_file_set_contents ( dot_filename <S2SV_ModEnd>, str -> <S2SV_ModStart> NULL ) ; command_line = g_strdup_printf ( "dot <S2SV_blank> -Tpng <S2SV_blank> >%s <S2SV_blank> <%s", png_filename, dot_filename ) ; <S2SV_ModStart>!= system ( command_line <S2SV_ModEnd> ) ) g_warning <S2SV_ModStart> "Calling <S2SV_blank> dot <S2SV_blank> failed" ) ; g_free ( command_line ) ; command_line = g_strdup_printf ( "gnome-open <S2SV_blank> %s", png_filename ) ; <S2SV_ModStart>!= system ( command_line <S2SV_ModEnd> ) ) g_warning <S2SV_ModStart> g_warning ( "Calling <S2SV_blank> gnome-open <S2SV_blank> failed." ) ; g_free ( command_line ) ; g_free (
Buggy code:
 static ALGobject * ALGnew ( PyObject * self, PyObject * args, PyObject * kwdict ) { unsigned char * key, * IV ; ALGobject * new = NULL ; int keylen, IVlen = 0, mode = MODE_ECB, segment_size = 0 ; PyObject * counter = NULL ; int counter_shortcut = 0 ; # ifdef PCT_ARC2_MODULE int effective_keylen = 1024 ; # endif if (! PyArg_ParseTupleAndKeywords ( args, kwdict, "s#|is#Oi" # ifdef PCT_ARC2_MODULE "i" # endif, kwlist, & key, & keylen, & mode, & IV, & IVlen, & counter, & segment_size # ifdef PCT_ARC2_MODULE, & effective_keylen # endif ) ) { return NULL ; } if ( mode < MODE_ECB || mode > MODE_CTR ) { PyErr_Format ( PyExc_ValueError, "Unknown   cipher   feedback   mode   %i", mode ) ; return NULL ; } if ( mode == MODE_PGP ) { PyErr_Format ( PyExc_ValueError, "MODE_PGP   is   not   supported   anymore" ) ; return NULL ; } if ( KEY_SIZE!= 0 && keylen!= KEY_SIZE ) { PyErr_Format ( PyExc_ValueError, "Key   must   be   %i   bytes   long,   not   %i", KEY_SIZE, keylen ) ; return NULL ; } if ( KEY_SIZE == 0 && keylen == 0 ) { PyErr_SetString ( PyExc_ValueError, <START_BUG> "Key   cannot   be   the   null   string" ) ; <END_BUG> return NULL ; } if ( IVlen!= BLOCK_SIZE && mode!= MODE_ECB && mode!= MODE_CTR ) { PyErr_Format ( PyExc_ValueError, "IV   must   be   %i   bytes   long", BLOCK_SIZE ) ; return NULL ; } if ( mode == MODE_CFB ) { if ( segment_size == 0 ) segment_size = 8 ; if ( segment_size < 1 || segment_size > BLOCK_SIZE * 8 || ( ( segment_size & 7 )!= 0 ) ) { PyErr_Format ( PyExc_ValueError, "

Fix:
<S2SV_ModStart> PyExc_ValueError, "Key <S2SV_blank> cannot <S2SV_blank> be <S2SV_blank> the <S2SV_blank> null <S2SV_blank> string" ) ; return NULL ; } if ( IVlen!= 0 && mode == MODE_ECB ) { PyErr_Format ( PyExc_ValueError, "ECB <S2SV_blank> mode <S2SV_blank> does <S2SV_blank> not <S2SV_blank> use <S2SV_blank> IV" ) ; return NULL ; } if ( IVlen!= 0 && mode == MODE_CTR ) { PyErr_Format ( PyExc_ValueError, "CTR <S2SV_blank> mode <S2SV_blank> needs <S2SV_blank> counter <S2SV_blank> parameter, <S2SV_blank> not <S2SV_blank> IV"
Buggy code:
 static void de_dotdot ( char * file ) { char * cp ; char * cp2 ; int l ; while ( ( cp = strstr ( file, "////" ) )!= ( char * ) 0 ) { for ( cp2 = cp + 2 ; * cp2 == '//' ; ++ cp2 ) continue ; ( void ) strcpy ( cp + 1, cp2 ) ; } while ( strncmp ( file, ".//", 2 ) == 0 ) ( void ) memmove ( file, file + 2, strlen ( file ) - 1 ) ; while ( ( cp = strstr ( file, "//.//" ) )!= ( char * ) 0 ) <START_BUG> ( void ) memmove ( cp, cp + 2, strlen ( file ) - 1 ) ; <END_BUG> for ( ; ; ) { while ( strncmp ( file, "..//", 3 ) == 0 ) ( void ) memmove ( file, file + 3, strlen ( file ) - 2 ) ; cp = strstr ( file, "//..//" ) ; if ( cp == ( char * ) 0 ) break ; for ( cp2 = cp - 1 ; cp2 >= file && * cp2!= '//' ; -- cp2 ) continue ; ( void ) strcpy ( cp2 + 1, cp + 4 ) ; } while ( ( l = strlen ( file ) ) > 3 && strcmp ( ( cp = file + l - 3 ), "//.." ) == 0 ) { for ( cp2 = cp - 1 ; cp2 >= file && * cp2!= '//' ; -- cp2 ) continue ; if ( cp2 < file ) break ; * cp2 = '\\0' ; } }

Fix:
<S2SV_ModStart>, strlen ( cp <S2SV_ModEnd> ) - 1
Buggy code:
 <START_BUG> static int cipso_v4_delopt ( struct ip_options * * opt_ptr ) <END_BUG> { int hdr_delta = 0 ;  struct ip_options * opt = * opt_ptr ; <START_BUG> <END_BUG> if ( opt -> srr || opt -> rr || opt -> ts || opt -> router_alert ) {  u8 cipso_len ; u8 cipso_off ; unsigned char * cipso_ptr ; int iter ; int optlen_new ; <START_BUG> cipso_off = opt -> cipso - sizeof ( struct iphdr ) ; <END_BUG>  cipso_ptr = & opt -> __data [ cipso_off ] ; <START_BUG> cipso_len = cipso_ptr [ 1 ] ; <END_BUG> if ( opt -> srr > opt -> cipso )  opt -> srr -= cipso_len ; <START_BUG> if ( opt -> rr > opt -> cipso ) <END_BUG> opt -> rr -= cipso_len ;  if ( opt -> ts > opt -> cipso ) <START_BUG> opt -> ts -= cipso_len ; <END_BUG> if ( opt -> router_alert > opt -> cipso )  opt -> router_alert -= cipso_len ; <START_BUG> opt -> cipso = 0 ; <END_BUG> memmove ( cipso_ptr, cipso_ptr + cipso_len,  opt -> optlen - cipso_off - cipso_len ) ; <START_BUG> iter = 0 ; optlen_new = 0 ; <END_BUG> while ( iter < opt -> optlen )  if ( opt -> __data [ iter ]!= IPOPT_NOP ) { <START_BUG> iter += opt -> __data [ iter + 1 ] ; <END_BUG> optlen_new = iter ; } else iter ++ ;  hdr_delta = opt -> optlen ; <START_BUG> opt -> optlen = ( optlen_new + 3 ) & ~ 3 ; <END_BUG> hdr_delta -= opt -> optlen ;  } else { * opt_ptr = NULL ; <START_BUG> hdr_delta = opt -> optlen ; <END_BUG> kfree ( opt ) ; } return hdr_delta ; }

Fix:
<S2SV_ModStart> cipso_v4_delopt ( struct ip_options_rcu <S2SV_ModEnd> * * opt_ptr <S2SV_ModStart> 0 ; struct ip_options_rcu <S2SV_ModEnd> * opt = <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> || opt -> opt. <S2SV_ModStart> || opt -> opt. <S2SV_ModStart> || opt -> opt. <S2SV_ModStart> = opt -> opt. <S2SV_ModStart> & opt -> opt. <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> > opt -> opt. cipso ) opt -> opt. <S2SV_ModEnd> srr -= cipso_len <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> > opt -> opt. cipso ) opt -> opt. <S2SV_ModEnd> rr -= cipso_len <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> > opt -> opt. cipso ) opt -> opt. <S2SV_ModEnd> ts -= cipso_len <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> > opt -> opt. cipso ) opt -> opt. <S2SV_ModEnd> router_alert -= cipso_len <S2SV_ModStart> ; opt -> opt. <S2SV_ModStart>, opt -> opt. <S2SV_ModStart> < opt -> opt. optlen ) if ( opt -> opt. <S2SV_ModEnd> __data [ iter <S2SV_ModStart> += opt -> opt. <S2SV_ModStart> = opt -> opt. optlen ; opt -> opt. <S2SV_ModEnd> optlen = ( <S2SV_ModStart> -= opt -> opt. <S2SV_ModStart> =
Buggy code:
 static int <START_BUG> _PyMemoTable_ResizeTable ( PyMemoTable * self, Py_ssize_t min_size ) <END_BUG> { PyMemoEntry * oldtable = NULL ; PyMemoEntry * oldentry, * newentry ;  Py_ssize_t new_size = MT_MINSIZE ; <START_BUG> <END_BUG> Py_ssize_t to_process ;  assert ( min_size > 0 ) ; <START_BUG> while ( new_size < min_size && new_size > 0 ) <END_BUG> new_size <<= 1 ; if ( new_size <= 0 ) { PyErr_NoMemory ( ) ; return - 1 ; } assert ( ( new_size & ( new_size - 1 ) ) == 0 ) ; oldtable = self -> mt_table ; self -> mt_table = PyMem_NEW ( PyMemoEntry, new_size ) ; if ( self -> mt_table == NULL ) { self -> mt_table = oldtable ; PyErr_NoMemory ( ) ; return - 1 ; } self -> mt_allocated = new_size ; self -> mt_mask = new_size - 1 ; memset ( self -> mt_table, 0, sizeof ( PyMemoEntry ) * new_size ) ; to_process = self -> mt_used ; for ( oldentry = oldtable ; to_process > 0 ; oldentry ++ ) { if ( oldentry -> me_key!= NULL ) { to_process -- ; newentry = _PyMemoTable_Lookup ( self, oldentry -> me_key ) ; newentry -> me_key = oldentry -> me_key ; newentry -> me_value = oldentry -> me_value ; } } PyMem_FREE ( oldtable ) ; return 0 ; }

Fix:
<S2SV_ModStart> * self, size_t <S2SV_ModEnd> min_size ) { <S2SV_ModStart> * newentry ; size_t <S2SV_ModEnd> new_size = MT_MINSIZE <S2SV_ModStart> = MT_MINSIZE ; size_t <S2SV_ModEnd> to_process ; assert <S2SV_ModStart> 0 ) ; if ( min_size > PY_SSIZE_T_MAX ) { PyErr_NoMemory ( ) ; return - 1 ; } <S2SV_ModStart> new_size < min_size ) { new_size <<= <S2SV_ModEnd> 1 ; }
Buggy code:
 static int userauth_hostbased ( struct ssh * ssh ) { Authctxt * authctxt = ssh -> authctxt ; struct sshbuf * b ; struct sshkey * key = NULL ; char * pkalg, * cuser, * chost ; u_char * pkblob, * sig ; size_t alen, blen, slen ; int r, pktype, authenticated = 0 ; <START_BUG> if (! authctxt -> valid ) { <END_BUG> debug2 ( "%s:   disabled   because   of   invalid   user", __func__ ) ; return 0 ; } if ( ( r = sshpkt_get_cstring ( ssh, & pkalg, & alen ) )!= 0 || ( r = sshpkt_get_string ( ssh, & pkblob, & blen ) )!= 0 || ( r = sshpkt_get_cstring ( ssh, & chost, NULL ) )!= 0 || ( r = sshpkt_get_cstring ( ssh, & cuser, NULL ) )!= 0 || ( r = sshpkt_get_string ( ssh, & sig, & slen ) )!= 0 ) fatal ( "%s:   packet   parsing:   %s", __func__, ssh_err ( r ) ) ; debug ( "%s:   cuser   %s   chost   %s   pkalg   %s   slen   %zu", __func__, cuser, chost, pkalg, slen ) ; # ifdef DEBUG_PK debug ( "signature:" ) ; sshbuf_dump_data ( sig, siglen, stderr ) ; # endif pktype = sshkey_type_from_name ( pkalg ) ; if ( pktype == KEY_UNSPEC ) { logit ( "%s:   unsupported   public   key   algorithm:   %s", __func__, pkalg ) ; goto done ; } if ( ( r = sshkey_from_blob ( pkblob, blen, & key ) )!= 0 ) { error ( "%s:   key_from_blob:   %s", __func__, ssh_err ( r ) ) ; goto done ; } if ( key == NULL ) { error ( "%s:   cannot   decode   key:   %s", __func__, pkalg ) ; goto done

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( ( <S2SV_ModStart> } if (! authctxt -> valid || authctxt -> user == NULL ) { debug2 ( "%s: <S2SV_blank> disabled <S2SV_blank> because <S2SV_blank> of <S2SV_blank> invalid <S2SV_blank> user", __func__ ) ; goto done ; } if (
Buggy code:
 void xmlParsePEReference ( xmlParserCtxtPtr ctxt ) { const xmlChar * name ; xmlEntityPtr entity = NULL ; xmlParserInputPtr input ; if ( RAW!= '%' ) return ; NEXT ; name = xmlParseName ( ctxt ) ; if ( name == NULL ) { xmlFatalErrMsg ( ctxt, XML_ERR_NAME_REQUIRED, "xmlParsePEReference:   no   name\\n" ) ; return ; } if ( RAW!= ';' ) { xmlFatalErr ( ctxt, XML_ERR_ENTITYREF_SEMICOL_MISSING, NULL ) ; return ; } NEXT ; ctxt -> nbentities ++ ; if ( ( ctxt -> sax!= NULL ) && ( ctxt -> sax -> getParameterEntity!= NULL ) ) entity = ctxt -> sax -> getParameterEntity ( ctxt -> userData, name ) ; if ( ctxt -> instate == XML_PARSER_EOF ) return ; if ( entity == NULL ) { if ( ( ctxt -> standalone == 1 ) || ( ( ctxt -> hasExternalSubset == 0 ) && ( ctxt -> hasPErefs == 0 ) ) ) { xmlFatalErrMsgStr ( ctxt, XML_ERR_UNDECLARED_ENTITY, "PEReference:   %%%s;   not   found\\n", name ) ; } else { xmlWarningMsg ( ctxt, XML_WAR_UNDECLARED_ENTITY, "PEReference:   %%%s;   not   found\\n", name, NULL ) ; ctxt -> valid = 0 ; } xmlParserEntityCheck ( ctxt, 0, NULL, 0 ) ; } else { if ( ( entity -> etype!= XML_INTERNAL_PARAMETER_ENTITY ) && ( entity -> etype!= XML_EXTERNAL_PARAMETER_ENTITY ) ) { xmlWarningMsg ( ctxt, XML_WAR_UNDECLARED_ENTITY, "Internal:   %%%s;   is   not   a   parameter   entity\\n", name, NULL ) ; } else if ( ctxt -> input -> free!= deallocblankswrapper ) { input = xmlNewBlanksWrapperInputStream ( ctxt, entity ) ; if ( xmlPushInput ( ctxt, input ) < 0 ) return ; } else { <START_BUG> input = xmlNewEntityInputStream ( ctxt, entity ) ; <END_BUG> if ( xmlPushInput ( ctxt, input ) < 0 ) return ; if ( ( entity -> etype == XML_EXTERNAL_PARAMETER_ENTITY ) && ( CMP5 ( CUR

Fix:
<S2SV_ModStart> } else { if ( ( entity -> etype == XML_EXTERNAL_PARAMETER_ENTITY ) && ( ( ctxt -> options & XML_PARSE_NOENT ) == 0 ) && ( ( ctxt -> options & XML_PARSE_DTDVALID ) == 0 ) && ( ( ctxt -> options & XML_PARSE_DTDLOAD ) == 0 ) && ( ( ctxt -> options & XML_PARSE_DTDATTR ) == 0 ) && ( ctxt -> replaceEntities == 0 ) && ( ctxt -> validate == 0 ) ) return ;
Buggy code:
 static ssize_t macvtap_get_user ( struct macvtap_queue * q, struct msghdr * m, const struct iovec * iv, unsigned long total_len, size_t count, int noblock ) { struct sk_buff * skb ; struct macvlan_dev * vlan ; unsigned long len = total_len ; int err ; struct virtio_net_hdr vnet_hdr = { 0 } ; int vnet_hdr_len = 0 ; <START_BUG> int copylen ; <END_BUG> bool zerocopy = false ; if ( q -> flags & IFF_VNET_HDR ) { vnet_hdr_len = q -> vnet_hdr_sz ; err = - EINVAL ; if ( len < vnet_hdr_len ) goto err ; len -= vnet_hdr_len ; err = memcpy_fromiovecend ( ( void * ) & vnet_hdr, iv, 0, sizeof ( vnet_hdr ) ) ; if ( err < 0 ) goto err ; if ( ( vnet_hdr. flags & VIRTIO_NET_HDR_F_NEEDS_CSUM ) && vnet_hdr. csum_start + vnet_hdr. csum_offset + 2 > vnet_hdr. hdr_len ) vnet_hdr. hdr_len = vnet_hdr. csum_start + vnet_hdr. csum_offset + 2 ; err = - EINVAL ; if ( vnet_hdr. hdr_len > len ) goto err ; } err = - EINVAL ; if ( unlikely ( len < ETH_HLEN ) ) goto err ;  if ( m && m -> msg_control && sock_flag ( & q -> sk, SOCK_ZEROCOPY ) ) <START_BUG> zerocopy = true ; if ( zerocopy ) { <END_BUG> copylen = vnet_hdr. hdr_len ;  if (! copylen ) copylen = GOODCOPY_LEN ; } else copylen = len ; skb = macvtap_alloc_skb ( & q -> sk, NET_IP_ALIGN, copylen, vnet_hdr. hdr_len, noblock, & err ) ; if (! skb ) goto err ; if ( zerocopy ) err = zerocopy

Fix:
<S2SV_ModStart> ; int copylen = 0 <S2SV_ModStart> goto err ; err = - EMSGSIZE ; if ( unlikely ( count > UIO_MAXIOV ) ) goto err ; <S2SV_ModStart> zerocopy ) { if ( count > MAX_SKB_FRAGS ) { copylen = iov_length ( iv, count - MAX_SKB_FRAGS ) ; if ( copylen < vnet_hdr_len ) copylen = 0 ; else copylen -= vnet_hdr_len ; } if ( copylen < vnet_hdr. hdr_len )
Buggy code:
 static PyTypeObject * make_type ( char * type, PyTypeObject * base, char * * fields, int num_fields ) <START_BUG> { <END_BUG> PyObject * fnames, * result ; int i ; fnames = PyTuple_New ( num_fields ) ; if (! fnames ) return NULL ; for ( i = 0 ; i < num_fields ; i ++ ) { PyObject * field = PyUnicode_FromString ( fields [ i ] ) ; if (! field ) { Py_DECREF ( fnames ) ; return NULL ; } PyTuple_SET_ITEM ( fnames, i, field ) ; }  result = PyObject_CallFunction ( ( PyObject * ) & PyType_Type, "s(O){sOss}", <START_BUG> <END_BUG> type, base, "_fields", fnames, "__module__", "_ast3" ) ;  Py_DECREF ( fnames ) ; return ( PyTypeObject * ) result ; }

Fix:
<S2SV_ModStart> num_fields ) { _Py_IDENTIFIER ( __module__ ) ; _Py_IDENTIFIER ( _ast3 ) ; <S2SV_ModStart> & PyType_Type, "s(O){OOOO}" <S2SV_ModEnd>, type, <S2SV_ModStart>, base, _PyUnicode_FromId ( & PyId__fields ) <S2SV_ModEnd>, fnames, <S2SV_ModStart>, fnames, _PyUnicode_FromId ( & PyId___module__ ), _PyUnicode_FromId ( & PyId__ast3 ) <S2SV_ModEnd> ) ; Py_DECREF
Buggy code:
 static vpx_codec_err_t validate_img ( vpx_codec_alg_priv_t * ctx, const vpx_image_t * img ) { switch ( img -> fmt ) { case VPX_IMG_FMT_YV12 : case VPX_IMG_FMT_I420 : <START_BUG> case VPX_IMG_FMT_I422 : <END_BUG>  case VPX_IMG_FMT_I444 : <START_BUG> break ; default : ERROR ( "Invalid   image   format.   Only   YV12,   I420,   I422,   I444   images   are   " <END_BUG> "supported." ) ;  } if ( img -> d_w!= ctx -> cfg. g_w || img -> d_h!= ctx -> cfg. g_h ) ERROR ( "Image   size   must   match   encoder   init   configuration   size" ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> VPX_IMG_FMT_I420 : case VPX_IMG_FMT_I42016 : break ; case <S2SV_ModStart> case VPX_IMG_FMT_I444 : case VPX_IMG_FMT_I440 : if ( ctx -> cfg. g_profile!= ( unsigned int ) PROFILE_1 ) { ERROR ( "Invalid <S2SV_blank> image <S2SV_blank> format. <S2SV_blank> I422, <S2SV_blank> I444, <S2SV_blank> I440 <S2SV_blank> images <S2SV_blank> are <S2SV_blank> " "not <S2SV_blank> supported <S2SV_blank> in <S2SV_blank> profile." ) ; } break ; case VPX_IMG_FMT_I42216 : case VPX_IMG_FMT_I44416 : case VPX_IMG_FMT_I44016 : if ( ctx -> cfg. g_profile!= ( unsigned int ) PROFILE_1 && ctx -> cfg. g_profile!= ( unsigned int ) PROFILE_3 ) { ERROR ( "Invalid <S2SV_blank> image <S2SV_blank> format. <S2SV_blank> 16-bit <S2SV_blank> I422, <S2SV_blank> I444, <S2SV_blank> I440 <S2SV_blank> images <S2SV_blank> are <S2SV_blank> " "not <S2SV_blank> supported <S2SV_blank> in <S2SV_blank> profile." ) ;
Buggy code:
 static void set_offsets ( VP9_COMP * cpi, const TileInfo * const tile, <START_BUG> int mi_row, int mi_col, BLOCK_SIZE bsize ) { <END_BUG>  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; MB_MODE_INFO * mbmi ; const int mi_width = num_8x8_blocks_wide_lookup [ bsize ] ; const int mi_height = num_8x8_blocks_high_lookup [ bsize ] ; <END_BUG> const int mb_row = mi_row >> 1 ;  const int mb_col = mi_col >> 1 ; const int idx_map = mb_row * cm -> mb_cols + mb_col ; const struct segmentation * const seg = & cm -> seg ; set_skip_context ( xd, mi_row, mi_col ) ; <START_BUG> x -> mb_activity_ptr = & cpi -> mb_activity_map [ idx_map ] ; <END_BUG> x -> in_active_map = check_active_map ( cpi, x, mi_row, mi_col, bsize ) ; set_modeinfo_offsets ( cm, xd, mi_row, mi_col ) ; mbmi = & xd -> mi [ 0 ] -> mbmi ;  vp9_setup_dst_planes ( xd, get_frame_new_buffer ( cm ), mi_row, mi_col ) ; <START_BUG> x -> mv_row_min = - ( ( ( mi_row + mi_height ) * MI_SIZE ) + VP9_INTERP_EXTEND ) ; x -> mv_col_min = - ( ( ( mi_col + mi_width ) * MI_SIZE ) + VP9_INTERP_EXTEND ) ; x -> mv_row_max = ( cm -> mi_rows - mi_row ) * MI_SIZE + VP9_INTERP_EXTEND ; x -> mv_col_max = ( cm -> mi_cols - mi_col ) * MI_SIZE + VP9_INTERP_EXTEND ; assert (! ( mi_col & ( mi_width - 1 ) ) &&! ( mi_row & ( mi<END_BUG>

Fix:
<S2SV_ModStart> const tile, MACROBLOCK * const x, <S2SV_ModStart> bsize ) { <S2SV_ModEnd> VP9_COMMON * const <S2SV_ModStart> ] ; const <S2SV_ModEnd> struct segmentation * <S2SV_ModStart> mi_col ) ; set_mode_info_offsets ( cm, x <S2SV_ModEnd>, xd, <S2SV_ModStart> vp9_setup_dst_planes ( xd -> plane <S2SV_ModStart> = cpi -> rd. <S2SV_ModStart> = cpi -> rd. <S2SV_ModStart> -> segment_id = get_segment_id <S2SV_ModEnd> ( cm, <S2SV_ModStart> encode_breakout ; } xd -> tile = * tile ;
Buggy code:
 <START_BUG> int release_vp9_frame_buffer ( void * cb_priv, <END_BUG> vpx_codec_frame_buffer_t * fb ) { struct ExternalFrameBuffer * const ext_fb = ( struct ExternalFrameBuffer * ) fb -> priv ; ( void ) cb_priv ; ext_fb -> in_use = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static const ut8 * r_bin_dwarf_parse_comp_unit ( Sdb * s, const ut8 * obuf, RBinDwarfCompUnit * cu, const RBinDwarfDebugAbbrev * da, size_t offset, const ut8 * debug_str, size_t debug_str_len ) { const ut8 * buf = obuf, * buf_end = obuf + ( cu -> hdr. length - 7 ) ; ut64 abbr_code ; size_t i ; if ( cu -> hdr. length > debug_str_len ) { return NULL ; } while ( buf && buf < buf_end && buf >= obuf ) { if ( cu -> length && cu -> capacity == cu -> length ) { r_bin_dwarf_expand_cu ( cu ) ; } buf = r_uleb128 ( buf, buf_end - buf, & abbr_code ) ; if ( abbr_code > da -> length ||! buf ) { return NULL ; } r_bin_dwarf_init_die ( & cu -> dies [ cu -> length ] ) ; if (! abbr_code ) { cu -> dies [ cu -> length ]. abbrev_code = 0 ; cu -> length ++ ; buf ++ ; continue ; } cu -> dies [ cu -> length ]. abbrev_code = abbr_code ; cu -> dies [ cu -> length ]. tag = da -> decls [ abbr_code - 1 ]. tag ; abbr_code += offset ; if ( da -> capacity < abbr_code ) { return NULL ; } for ( i = 0 ; i < da -> decls [ abbr_code - 1 ]. length ; i ++ ) { if ( cu -> dies [ cu -> length ]. length == cu -> dies [ cu -> length ]. capacity ) { r_bin_dwarf_expand_die ( & cu -> dies [ cu -> length ] ) ; } if ( i >= cu -> dies [ cu -> length ]. capacity || i >= da -> decls [ abbr_code - 1 ]. capacity ) { eprintf ( "Warning:   malformed   dwarf   attribute   capacity   doesn\'t   match   length\\n" ) ; break ; } memset ( & cu -> dies [ cu -> length ]. attr_values [ i ], 0

Fix:
<S2SV_ModStart>. string ; if ( name > 1024 ) { <S2SV_ModStart> ) ; } else { eprintf ( "Invalid <S2SV_blank> string <S2SV_blank> pointer <S2SV_blank> at <S2SV_blank> %p\\n", name ) ; } }
Buggy code:
 static ssize_t _consolefs_read ( oe_fd_t * file_, void * buf, size_t count ) { ssize_t ret = - 1 ; file_t * file = _cast_file ( file_ ) ; <START_BUG> if (! file ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( oe_syscall_read_ocall ( & ret, file -> host_fd, buf, count )!= OE_OK ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> (! file || count > OE_SSIZE_MAX <S2SV_ModStart> OE_EINVAL ) ; if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 static long vop_ioctl ( struct file * f, unsigned int cmd, unsigned long arg ) { struct vop_vdev * vdev = f -> private_data ; struct vop_info * vi = vdev -> vi ; void __user * argp = ( void __user * ) arg ; int ret ; switch ( cmd ) { case MIC_VIRTIO_ADD_DEVICE : { struct mic_device_desc dd, * dd_config ; if ( copy_from_user ( & dd, argp, sizeof ( dd ) ) ) return - EFAULT ; if ( mic_aligned_desc_size ( & dd ) > MIC_MAX_DESC_BLK_SIZE || dd. num_vq > MIC_MAX_VRINGS ) return - EINVAL ; dd_config = kzalloc ( mic_desc_size ( & dd ), GFP_KERNEL ) ; if (! dd_config ) return - ENOMEM ; if ( copy_from_user ( dd_config, argp, mic_desc_size ( & dd ) ) ) { ret = - EFAULT ; goto free_ret ; } <START_BUG> mutex_lock ( & vdev -> vdev_mutex ) ; <END_BUG> mutex_lock ( & vi -> vop_mutex ) ; ret = vop_virtio_add_device ( vdev, dd_config ) ; if ( ret ) goto unlock_ret ; list_add_tail ( & vdev -> list, & vi -> vdev_list ) ; unlock_ret : mutex_unlock ( & vi -> vop_mutex ) ; mutex_unlock ( & vdev -> vdev_mutex ) ; free_ret : kfree ( dd_config ) ; return ret ; } case MIC_VIRTIO_COPY_DESC : { struct mic_copy_desc copy ; mutex_lock ( & vdev -> vdev_mutex ) ; ret = vop_vdev_inited ( vdev ) ; if ( ret ) goto _unlock_ret ; if ( copy_from_user ( & copy, argp, sizeof ( copy ) ) ) { ret = - EFAULT ; goto _unlock_ret ; } ret = vop_virtio_copy_desc ( vdev, & copy ) ; if ( ret < 0 ) goto _unlock_ret ; if (

Fix:
<S2SV_ModStart> free_ret ; } if ( memcmp ( & dd, dd_config, sizeof ( dd ) ) ) { ret = - EINVAL ; goto free_ret ; }
Buggy code:
 long keyctl_read_key ( key_serial_t keyid, char __user * buffer, size_t buflen ) { struct key * key ; key_ref_t key_ref ; long ret ; key_ref = lookup_user_key ( keyid, 0, 0 ) ; if ( IS_ERR ( key_ref ) ) { ret = - ENOKEY ; goto error ; } key = key_ref_to_ptr ( key_ref ) ; ret = key_permission ( key_ref, KEY_NEED_READ ) ; if ( ret == 0 ) goto can_read_key ; if ( ret!= - EACCES ) goto error ; if (! is_key_possessed ( key_ref ) ) { ret = - EACCES ; goto error2 ; } can_read_key : <START_BUG> ret = key_validate ( key ) ; <END_BUG>  if ( ret == 0 ) { <START_BUG> ret = - EOPNOTSUPP ; <END_BUG> if ( key -> type -> read ) {  down_read ( & key -> sem ) ; <START_BUG> ret = key -> type -> read ( key, buffer, buflen ) ; <END_BUG> up_read ( & key -> sem ) ; } } error2 : key_put ( key ) ; error : return ret ; }

Fix:
<S2SV_ModStart> : ret = - EOPNOTSUPP ; if ( key -> type -> read ) { down_read ( & key -> sem ) ; ret = <S2SV_ModStart> == 0 ) ret = <S2SV_ModEnd> key -> type <S2SV_ModStart> type -> read ( key, buffer, buflen ) ; up_read <S2SV_ModEnd> ( & key <S2SV_ModStart> sem ) ; <S2SV_ModEnd> } error2 :
Buggy code:
 static int temporal_filter_find_matching_mb_c ( VP9_COMP * cpi, uint8_t * arf_frame_buf, uint8_t * frame_ptr_buf, int stride ) { <START_BUG> MACROBLOCK * x = & cpi -> mb ; <END_BUG> MACROBLOCKD * const xd = & x -> e_mbd ;  int step_param ; <START_BUG> int sadpb = x -> sadperbit16 ; <END_BUG> int bestsme = INT_MAX ;  MV best_ref_mv1 = { 0, 0 } ; MV best_ref_mv1_full ; MV * ref_mv = & x -> e_mbd. mi [ 0 ] -> bmi [ 0 ]. as_mv [ 0 ]. as_mv ; struct buf_2d src = x -> plane [ 0 ]. src ; struct buf_2d pre = xd -> plane [ 0 ]. pre [ 0 ] ; best_ref_mv1_full. col = best_ref_mv1. col >> 3 ; best_ref_mv1_full. row = best_ref_mv1. row >> 3 ; x -> plane [ 0 ]. src. buf = arf_frame_buf ; x -> plane [ 0 ]. src. stride = stride ; xd -> plane [ 0 ]. pre [ 0 ]. buf = frame_ptr_buf ; xd -> plane [ 0 ]. pre [ 0 ]. stride = stride ; <START_BUG> if ( cpi -> speed < 8 ) <END_BUG> step_param = cpi -> sf. reduce_first_step_size + ( ( cpi -> speed > 5 )? 1 : 0 ) ; else step_param = cpi -> sf. reduce_first_step_size + 2 ;  step_param = MIN ( step_param, ( cpi -> sf. max_step_search_steps - 2 ) ) ; <START_BUG> vp9_hex_search ( x, & best_ref_mv1_full, step_param, sadpb, 1, <END_BUG> & cpi -> fn_ptr [ BLOCK_16X16 ], 0, & best_ref_mv1, ref_mv ) ;  <START_BUG> { <END_BUG> int distortion ; unsigned int sse ; bestsme = cpi -> find_fractional_mv_step ( x, ref_mv, &

Fix:
<S2SV_ModStart> { MACROBLOCK * const x = & cpi -> td. <S2SV_ModEnd> mb ; MACROBLOCKD <S2SV_ModStart> -> e_mbd ; const MV_SPEED_FEATURES * const mv_sf = & cpi -> sf. mv ; <S2SV_ModStart> bestsme = INT_MAX ; int distortion ; unsigned int sse ; int cost_list [ 5 ] <S2SV_ModStart> = stride ; step_param = mv_sf -> reduce_first_step_size ; step_param = MIN ( step_param, MAX_MVSEARCH_STEPS <S2SV_ModEnd> - 2 ) <S2SV_ModStart> - 2 ) <S2SV_ModEnd> ; vp9_hex_search ( <S2SV_ModStart>, 1, cond_cost_list ( cpi, cost_list ), <S2SV_ModStart> ref_mv ) ; bestsme = cpi -> find_fractional_mv_step ( x, ref_mv, & best_ref_mv1, cpi -> common. allow_high_precision_mv, x -> errorperbit, & cpi -> fn_ptr [ BLOCK_16X16 ], 0, mv_sf -> subpel_iters_per_step, cond_cost_list ( cpi, cost_list ), NULL, NULL, &
Buggy code:
 <START_BUG> INST_HANDLER ( sts ) { <END_BUG> int r = ( ( buf [ 0 ] >> 4 ) & 0xf ) | ( ( buf [ 1 ] & 0x1 ) << 4 ) ; int k = ( buf [ 3 ] << 8 ) | buf [ 2 ] ; op -> ptr = k ; ESIL_A ( "r%d,", r ) ; __generic_ld_st ( op, "ram", 0, 1, 0, k, 1 ) ; op -> cycles = 2 ; }

Fix:
<S2SV_ModStart> sts ) { if ( len < 4 ) { return ; }
Buggy code:
 long kvm_arch_vm_ioctl ( struct file * filp, unsigned int ioctl, unsigned long arg ) { struct kvm * kvm = filp -> private_data ; void __user * argp = ( void __user * ) arg ; int r = - ENOTTY ; union { struct kvm_pit_state ps ; struct kvm_pit_state2 ps2 ; struct kvm_pit_config pit_config ; } u ; switch ( ioctl ) { case KVM_SET_TSS_ADDR : r = kvm_vm_ioctl_set_tss_addr ( kvm, arg ) ; if ( r < 0 ) goto out ; break ; case KVM_SET_IDENTITY_MAP_ADDR : { u64 ident_addr ; r = - EFAULT ; if ( copy_from_user ( & ident_addr, argp, sizeof ident_addr ) ) goto out ; r = kvm_vm_ioctl_set_identity_map_addr ( kvm, ident_addr ) ; if ( r < 0 ) goto out ; break ; } case KVM_SET_NR_MMU_PAGES : r = kvm_vm_ioctl_set_nr_mmu_pages ( kvm, arg ) ; if ( r ) goto out ; break ; case KVM_GET_NR_MMU_PAGES : r = kvm_vm_ioctl_get_nr_mmu_pages ( kvm ) ; break ; case KVM_CREATE_IRQCHIP : { struct kvm_pic * vpic ; mutex_lock ( & kvm -> lock ) ; r = - EEXIST ; if ( kvm -> arch. vpic ) goto create_irqchip_unlock ; <START_BUG> r = - ENOMEM ; <END_BUG> vpic = kvm_create_pic ( kvm ) ; if ( vpic ) { r = kvm_ioapic_init ( kvm ) ; if ( r ) { mutex_lock ( & kvm -> slots_lock ) ; kvm_io_bus_unregister_dev ( kvm, KVM_PIO_BUS, & vpic -> dev_master ) ; kvm_io_bus_unregister_dev ( kvm, KVM_PIO_BUS,

Fix:
<S2SV_ModStart> r = - EINVAL ; if ( atomic_read ( & kvm -> online_vcpus ) ) goto create_irqchip_unlock ; r = -