nus-yam/ex-repair huggingface dataset:
Buggy code:
 void silk_NLSF_stabilize ( opus_int16 * NLSF_Q15, const opus_int16 * NDeltaMin_Q15, const opus_int L ) { opus_int i, I = 0, k, loops ; opus_int16 center_freq_Q15 ; opus_int32 diff_Q15, min_diff_Q15, min_center_Q15, max_center_Q15 ; silk_assert ( NDeltaMin_Q15 [ L ] >= 1 ) ; for ( loops = 0 ; loops < MAX_LOOPS ; loops ++ ) { min_diff_Q15 = NLSF_Q15 [ 0 ] - NDeltaMin_Q15 [ 0 ] ; I = 0 ; for ( i = 1 ; i <= L - 1 ; i ++ ) { diff_Q15 = NLSF_Q15 [ i ] - ( NLSF_Q15 [ i - 1 ] + NDeltaMin_Q15 [ i ] ) ; if ( diff_Q15 < min_diff_Q15 ) { min_diff_Q15 = diff_Q15 ; I = i ; } } diff_Q15 = ( 1 << 15 ) - ( NLSF_Q15 [ L - 1 ] + NDeltaMin_Q15 [ L ] ) ; if ( diff_Q15 < min_diff_Q15 ) { min_diff_Q15 = diff_Q15 ; I = L ; } if ( min_diff_Q15 >= 0 ) { return ; } if ( I == 0 ) { NLSF_Q15 [ 0 ] = NDeltaMin_Q15 [ 0 ] ; } else if ( I == L ) { NLSF_Q15 [ L - 1 ] = ( 1 << 15 ) - NDeltaMin_Q15 [ L ] ; } else { min_center_Q15 = 0 ; for ( k = 0 ; k < I ; k ++ ) { min_center_Q15 += NDeltaMin_Q15 [ k ] ; } min_center_Q15 += silk_RSHIFT ( NDeltaMin_Q15 [ I ], 1 ) ; max_center_Q15 = 1 << 15 ; for ( k = L ; k > I ; k -- ) { max_center_Q15 -= NDeltaMin_Q15 [ k

Fix:
<S2SV_ModStart> i ], silk_ADD_SAT16 ( NLSF_Q15 [ i - 1 ], NDeltaMin_Q15 [ i ] ) <S2SV_ModEnd> ) ; NLSF_Q15
Buggy code:
 static void finish_process_as_req ( struct as_req_state * state, krb5_error_code errcode ) { krb5_key_data * server_key ; krb5_keyblock * as_encrypting_key = NULL ; krb5_data * response = NULL ; const char * emsg = 0 ; int did_log = 0 ; loop_respond_fn oldrespond ; void * oldarg ; kdc_realm_t * kdc_active_realm = state -> active_realm ; krb5_audit_state * au_state = state -> au_state ; assert ( state ) ; oldrespond = state -> respond ; oldarg = state -> arg ; if ( errcode ) goto egress ; au_state -> stage = ENCR_REP ; if ( ( errcode = validate_forwardable ( state -> request, * state -> client, * state -> server, state -> kdc_time, & state -> status ) ) ) { errcode += ERROR_TABLE_BASE_krb5 ; goto egress ; } errcode = check_indicators ( kdc_context, state -> server, state -> auth_indicators ) ; if ( errcode ) { state -> status = "HIGHER_AUTHENTICATION_REQUIRED" ; goto egress ; } state -> ticket_reply. enc_part2 = & state -> enc_tkt_reply ; if ( ( errcode = krb5_dbe_find_enctype ( kdc_context, state -> server, - 1, - 1, 0, & server_key ) ) ) { state -> status = "FINDING_SERVER_KEY" ; goto egress ; } if ( ( errcode = krb5_dbe_decrypt_key_data ( kdc_context, NULL, server_key, & state -> server_keyblock, NULL ) ) ) { state -> status = "DECRYPT_SERVER_KEY" ; goto egress ; } state -> reply. msg_type = KRB5_AS_REP ; state -> reply. client = state -> enc_tkt_reply. client ; state -> reply. ticket = & state -> ticket_reply ; state -> reply_encpart. session = & state -> session_key ; if ( ( errcode = fetch_last_req_info ( state -> client

Fix:
<S2SV_ModStart> errcode!= 0 && state -> status == NULL ) state -> status = "UNKNOWN_REASON" <S2SV_ModEnd> ; au_state ->
Buggy code:
 void Triangle ( double x1, double y1, double x2, double y2, double x3, double y3 ) { <START_BUG> outpos += <END_BUG> sprintf ( outpos, "\\n   %12.3f   %12.3f   m   %12.3f   %12.3f   l   %12.3f   %12.3f   l   h", x1, y1, x2, y2, x3, y3 ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> y3 ) { sprintf ( outputbuffer <S2SV_ModEnd>, "\\n <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> m <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> l <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> l <S2SV_blank> h", <S2SV_ModStart> y3 ) ; sendClean ( outputbuffer ) ;
Buggy code:
 static int try_read_command ( conn * c ) { assert ( c!= NULL ) ; assert ( c -> rcurr <= ( c -> rbuf + c -> rsize ) ) ; assert ( c -> rbytes > 0 ) ; if ( c -> protocol == negotiating_prot || c -> transport == udp_transport ) { if ( ( unsigned char ) c -> rbuf [ 0 ] == ( unsigned char ) PROTOCOL_BINARY_REQ ) { c -> protocol = binary_prot ; } else { c -> protocol = ascii_prot ; } if ( settings. verbose > 1 ) { fprintf ( stderr, "%d:   Client   using   the   %s   protocol\\n", c -> sfd, prot_text ( c -> protocol ) ) ; } } if ( c -> protocol == binary_prot ) { if ( c -> rbytes < sizeof ( c -> binary_header ) ) { return 0 ; } else { # ifdef NEED_ALIGN if ( ( ( long ) ( c -> rcurr ) ) % 8!= 0 ) { memmove ( c -> rbuf, c -> rcurr, c -> rbytes ) ; c -> rcurr = c -> rbuf ; if ( settings. verbose > 1 ) { fprintf ( stderr, "%d:   Realign   input   buffer\\n", c -> sfd ) ; } } # endif protocol_binary_request_header * req ; req = ( protocol_binary_request_header * ) c -> rcurr ; if ( settings. verbose > 1 ) { int ii ; fprintf ( stderr, "<%d   Read   binary   protocol   data:", c -> sfd ) ; for ( ii = 0 ; ii < sizeof ( req -> bytes ) ; ++ ii ) { if ( ii % 4 == 0 ) { fprintf ( stderr, "\\n<%d       ", c -> sfd ) ; } fprintf ( stderr, "   0x%02x", req -> bytes [ ii ] ) ; } fprintf ( stderr, "\\n" ) ; } c -> binary_header = * req ; c -> binary_header. request. keylen = ntohs ( req -> request. keylen ) ; c -> binary_header. request. bodylen = ntohl ( req -> request. bodylen ) ; c -> binary_header. request. cas = ntoh

Fix:
<S2SV_ModStart> } if ( ptr - c -> rcurr > 100 || ( strncmp ( ptr, "get <S2SV_blank> ", 4 ) && strncmp <S2SV_ModEnd> ( ptr, <S2SV_ModStart> ptr, "gets <S2SV_blank> ", 5 )
Buggy code:
 static int lookup1_values ( int entries, int dim ) { int r = ( int ) floor ( exp ( ( float ) log ( ( float ) entries ) // dim ) ) ; if ( ( int ) floor ( pow ( ( float ) r + 1, dim ) ) <= entries ) ++ r ; <START_BUG> assert ( pow ( ( float ) r + 1, dim ) > entries ) ; <END_BUG>  assert ( ( int ) floor ( pow ( ( float ) r, dim ) ) <= entries ) ; <START_BUG> return r ; }<END_BUG>

Fix:
<S2SV_ModStart> ++ r ; if <S2SV_ModEnd> ( pow ( <S2SV_ModStart>, dim ) <= entries ) return - 1 ; if <S2SV_ModEnd> ( ( int <S2SV_ModStart> dim ) ) > entries ) return - 1 <S2SV_ModEnd> ; return r
Buggy code:
 <START_BUG> void validate_positive_rational ( const char * msg, <END_BUG> struct vpx_rational * rat ) { if ( rat -> den < 0 ) { rat -> num *= - 1 ; rat -> den *= - 1 ; } if ( rat -> num < 0 ) die ( "Error:   %s   must   be   positive\\n", msg ) ; if (! rat -> den ) die ( "Error:   %s   has   zero   denominator\\n", msg ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 void vp9_save_layer_context ( VP9_COMP * const cpi ) { <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG>  LAYER_CONTEXT * const lc = get_layer_context ( & cpi -> svc ) ; <START_BUG> lc -> rc = cpi -> rc ; lc -> twopass = cpi -> twopass ; lc -> target_bandwidth = ( int ) oxcf -> target_bandwidth ; <END_BUG> lc -> starting_buffer_level = oxcf -> starting_buffer_level ;  lc -> optimal_buffer_level = oxcf -> optimal_buffer_level ; lc -> maximum_buffer_size = oxcf -> maximum_buffer_size ; <START_BUG> lc -> framerate = cpi -> output_framerate ; <END_BUG> }

Fix:
<S2SV_ModStart> ) { const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> = get_layer_context ( cpi <S2SV_ModEnd> ) ; lc <S2SV_ModStart> ; lc -> alt_ref_source <S2SV_ModEnd> = cpi -> <S2SV_ModStart> = cpi -> alt_ref_source <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static bool parseOperands ( char * str, ArmOp * op ) { char * t = strdup ( str ) ; int operand = 0 ; char * token = t ; char * x ; int imm_count = 0 ; int mem_opt = 0 ; if (! token ) { return false ; } while ( token ) { char * next = strchr ( token, ',' ) ; if ( next ) { * next ++ = 0 ; } while ( token [ 0 ] ==' ') { <START_BUG> token ++ ; <END_BUG> } op -> operands [ operand ]. type = ARM_NOTYPE ; op -> operands [ operand ]. reg_type = ARM_UNDEFINED ; op -> operands [ operand ]. shift = ARM_NO_SHIFT ; while ( token [ 0 ] ==' '|| token [ 0 ] == '[' || token [ 0 ] == ']' ) { token ++ ; } if (! strncmp ( token, "lsl", 3 ) ) { op -> operands [ operand ]. shift = ARM_LSL ; } else if (! strncmp ( token, "lsr", 3 ) ) { op -> operands [ operand ]. shift = ARM_LSR ; } else if (! strncmp ( token, "asr", 3 ) ) { op -> operands [ operand ]. shift = ARM_ASR ; } if ( op -> operands [ operand ]. shift!= ARM_NO_SHIFT ) { op -> operands_count ++ ; op -> operands [ operand ]. shift_amount = r_num_math ( NULL, token + 4 ) ; if ( op -> operands [ operand ]. shift_amount > 63 ) { return false ; } operand ++ ; token = next ; continue ; } switch ( token [ 0 ] ) { case 'x' : x = strchr ( token, ',' ) ; if ( x ) { x [ 0 ] = '\\0' ; } op -> operands_count ++ ; op -> operands [ operand ]. type = ARM_GPR ; op -> operands [ operand ]. reg_type = ARM_REG64 ; op -> operands [ operand ]. reg = r_num_math ( NULL, token + 1 ) ; if ( op -> operands [ operand ]. reg > 31 ) { return false ; } break ; case 'w' : op -> operands_count ++

Fix:
<S2SV_ModStart> { token ++ ; } if ( operand >= MAX_OPERANDS ) { eprintf ( "Too <S2SV_blank> many <S2SV_blank> operands\\n" ) ; return false
Buggy code:
 error_t getHostByName ( NetInterface * interface, const char_t * name, IpAddr * ipAddr, uint_t flags ) { error_t error ; HostType type ; HostnameResolver protocol ; # if ( IPV4_SUPPORT == ENABLED ) type = HOST_TYPE_IPV4 ; # elif ( IPV6_SUPPORT == ENABLED ) type = HOST_TYPE_IPV6 ; # else type = HOST_TYPE_ANY ; # endif # if ( DNS_CLIENT_SUPPORT == ENABLED ) protocol = HOST_NAME_RESOLVER_DNS ; # elif ( MDNS_CLIENT_SUPPORT == ENABLED ) protocol = HOST_NAME_RESOLVER_MDNS ; # elif ( NBNS_CLIENT_SUPPORT == ENABLED ) protocol = HOST_NAME_RESOLVER_NBNS ; # elif ( LLMNR_CLIENT_SUPPORT == ENABLED ) protocol = HOST_NAME_RESOLVER_LLMNR ; # else protocol = HOST_NAME_RESOLVER_ANY ; # endif if ( name == NULL || ipAddr == NULL ) return ERROR_INVALID_PARAMETER ; if ( interface == NULL ) interface = netGetDefaultInterface ( ) ; error = ipStringToAddr ( name, ipAddr ) ; if ( error ) { if ( flags & HOST_TYPE_IPV4 ) type = HOST_TYPE_IPV4 ; else if ( flags & HOST_TYPE_IPV6 ) type = HOST_TYPE_IPV6 ; if ( flags & HOST_NAME_RESOLVER_DNS ) { protocol = HOST_NAME_RESOLVER_DNS ; } else if ( flags & HOST_NAME_RESOLVER_MDNS ) { protocol = HOST_NAME_RESOLVER_MDNS ; } else if ( flags & HOST_NAME_RESOLVER_NBNS ) { protocol = HOST_NAME_RESOLVER_NBNS ; } else if ( flags & HOST_NAME_RESOLVER_LLMNR ) { protocol = HOST_NAME_RESOLVER_LLMNR ; } else { size_t n = osStrlen ( name ) ; if ( n >= 6 &&! osStrcasecmp ( name + n - 6, ".local" ) ) { # if ( MDNS_CLIENT_SUPPORT == ENABLED ) protocol = HOST_NAME_RESOLVER_MDNS ; # endif } <START_BUG> else if ( n <= 15 &&! strchr ( name, '.' ) && type == HOST_<END_BUG>

Fix:
<S2SV_ModStart> 15 &&! osStrchr <S2SV_ModEnd> ( name, <S2SV_ModStart> if (! osStrchr <S2SV_ModEnd> ( name,
Buggy code:
 generic_ret * setv4key_principal_2_svc ( setv4key_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_SETKEY, arg -> princ, NULL ) ) { ret. code = kadm5_setv4key_principal ( ( void * ) handle, arg -> princ, arg -> keyblock ) ; } else { log_unauth ( "kadm5_setv4key_principal", prime_arg, & client_name, & service_name, rqstp ) ; ret. code = KADM5_AUTH_SETKEY ; } if ( ret. code!= KADM5_AUTH_SETKEY ) { if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_setv4key_principal", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ;

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 int obj2ast_expr ( PyObject * obj, expr_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; int lineno ; int col_offset ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_lineno ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_lineno ) ; <START_BUG> if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_int ( tmp, & lineno, arena ) ;  if ( res!= 0 ) goto failed ; <START_BUG> Py_CLEAR ( tmp ) ; <END_BUG> } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   expr" ) ; return 1 ; } if ( _PyObject_HasAttrId ( obj, & PyId_col_offset ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_col_offset ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_int ( tmp, & col_offset, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"col_offset\\"   missing   from   expr" ) ; return 1 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) BoolOp_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { boolop_ty op ; asdl_seq * values ;  if ( _PyObject_HasAttrId ( obj, & PyId_op ) ) { <START_BUG> int res ; <END_BUG> tmp = _PyObject_GetAttrId ( obj, & PyId_op ) ;  if ( tmp == NULL ) goto failed ; res = obj2ast_boolop ( tmp, & op, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"op\\"   missing   from   BoolOp" ) ; return 1 ; } if ( _PyObject_HasAttrId (

Fix:
<S2SV_ModStart> } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"lineno\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> expr" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart> obj, & PyId_col_offset, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"col_offset\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> expr" ) ; return 1 ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> tmp, & col_offset <S2SV_ModEnd>, arena ) <S2SV_ModStart> ( tmp ) <S2SV_ModEnd> ; } isinstance <S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_op, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL
Buggy code:
 static void setup_features ( VP8_COMP * cpi ) { if ( cpi -> mb. e_mbd. segmentation_enabled ) { cpi -> mb. e_mbd. update_mb_segmentation_map = 1 ; cpi -> mb. e_mbd. update_mb_segmentation_data = 1 ; } else { cpi -> mb. e_mbd. update_mb_segmentation_map = 0 ; cpi -> mb. e_mbd. update_mb_segmentation_data = 0 ; } cpi -> mb. e_mbd. mode_ref_lf_delta_enabled = 0 ; cpi -> mb. e_mbd. mode_ref_lf_delta_update = 0 ; <START_BUG> vpx_memset ( cpi -> mb. e_mbd. ref_lf_deltas, 0, sizeof ( cpi -> mb. e_mbd. ref_lf_deltas ) ) ; <END_BUG>  vpx_memset ( cpi -> mb. e_mbd. mode_lf_deltas, 0, sizeof ( cpi -> mb. e_mbd. mode_lf_deltas ) ) ; <START_BUG> <END_BUG> vpx_memset ( cpi -> mb. e_mbd. last_ref_lf_deltas, 0, sizeof ( cpi -> mb. e_mbd. ref_lf_deltas ) ) ;  <START_BUG> vpx_memset ( cpi -> mb. e_mbd. last_mode_lf_deltas, 0, sizeof ( cpi -> mb. e_mbd. mode_lf_deltas ) ) ; <END_BUG> set_default_lf_deltas ( cpi ) ; }

Fix:
<S2SV_ModStart> = 0 ; memset <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( cpi ->
Buggy code:
 static void t1_check_unusual_charstring ( void ) { char * p = strstr ( t1_line_array, charstringname ) + strlen ( charstringname ) ; int i ; if ( sscanf ( p, "%i", & i )!= 1 ) { strcpy ( t1_buf_array, t1_line_array ) ; * ( strend ( t1_buf_array ) - 1 ) =' '; t1_getline ( ) ; <START_BUG> strcat ( t1_buf_array, t1_line_array ) ; <END_BUG> strcpy ( t1_line_array, t1_buf_array ) ; t1_line_ptr = eol ( t1_line_array ) ; } }

Fix:
<S2SV_ModStart> ( ) ; alloc_array ( t1_buf, strlen ( t1_line_array ) + strlen ( t1_buf_array ) + 1, T1_BUF_SIZE ) ; <S2SV_ModStart> t1_buf_array, t1_line_array ) ; alloc_array ( t1_line, strlen ( t1_buf_array ) + 1, T1_BUF_SIZE
Buggy code:
 static void setup_private_mount ( const char * snap_name ) { <START_BUG> uid_t uid = getuid ( ) ; <END_BUG> gid_t gid = getgid ( ) ; char tmpdir [ MAX_BUF ] = { 0 } ; sc_must_snprintf ( tmpdir, sizeof ( tmpdir ), "//tmp//snap.%s_XXXXXX", snap_name ) ; if ( mkdtemp ( tmpdir ) == NULL ) { die ( "cannot   create   temporary   directory   essential   for   private   //tmp" ) ; } mode_t old_mask = umask ( 0 ) ; char * d = sc_strdup ( tmpdir ) ; sc_must_snprintf ( tmpdir, sizeof ( tmpdir ), "%s//tmp", d ) ; free ( d ) ; if ( mkdir ( tmpdir, 01777 )!= 0 ) { die ( "cannot   create   temporary   directory   for   private   //tmp" ) ; } umask ( old_mask ) ; char * pwd = get_current_dir_name ( ) ; if ( pwd == NULL ) die ( "cannot   get   current   working   directory" ) ; if ( chdir ( "//" )!= 0 ) die ( "cannot   change   directory   to   \'//\'" ) ; sc_do_mount ( tmpdir, "//tmp", NULL, MS_BIND, NULL ) ; sc_do_mount ( "none", "//tmp", NULL, MS_PRIVATE, NULL ) ;  if ( chown ( "//tmp//", uid, gid ) < 0 ) { <START_BUG> die ( "cannot   change   ownership   of   //tmp" ) ; } if ( chdir ( pwd )!= 0 ) die ( "cannot   change   current   working   directory   to   the   original   directory" ) ; free ( pwd ) ; }<END_BUG>

Fix:
<S2SV_ModStart> snap_name ) { <S2SV_ModEnd> char tmpdir [ <S2SV_ModStart> ( "//tmp//", 0, 0 <S2SV_ModEnd> ) < 0
Buggy code:
 static void edge_bulk_in_callback ( struct urb * urb ) { struct edgeport_port * edge_port = urb -> context ; struct device * dev = & edge_port -> port -> dev ; unsigned char * data = urb -> transfer_buffer ; int retval = 0 ; int port_number ; int status = urb -> status ; switch ( status ) { case 0 : break ; case - ECONNRESET : case - ENOENT : case - ESHUTDOWN : dev_dbg ( & urb -> dev -> dev, "%s   -   urb   shutting   down   with   status:   %d\\n", __func__, status ) ; return ; default : dev_err ( & urb -> dev -> dev, "%s   -   nonzero   read   bulk   status   received:   %d\\n", __func__, status ) ; } if ( status == - EPIPE ) goto exit ; if ( status ) { dev_err ( & urb -> dev -> dev, "%s   -   stopping   read!\\n", __func__ ) ; return ; } port_number = edge_port -> port -> port_number ; <START_BUG> if ( edge_port -> lsr_event ) { <END_BUG> edge_port -> lsr_event = 0 ; dev_dbg ( dev, "%s   =====   Port   %u   LSR   Status   =   %02x,   Data   =   %02x   ======\\n", __func__, port_number, edge_port -> lsr_mask, * data ) ; handle_new_lsr ( edge_port, 1, edge_port -> lsr_mask, * data ) ; -- urb -> actual_length ; ++ data ; } if ( urb -> actual_length ) { usb_serial_debug_data ( dev, __func__, urb -> actual_length, data ) ; if ( edge_port -> close_pending ) dev_dbg ( dev, "%s   -   close   pending,   dropping   data   on   the   floor\\n", __func__ ) ; else edge_tty_recv ( edge_port -> port, data, urb -> actual_length ) ; edge_port -> port -> icount. rx += urb -> actual_length

Fix:
<S2SV_ModStart> ; if ( urb -> actual_length > 0 &&
Buggy code:
 static void sctp_sock_migrate ( struct sock * oldsk, struct sock * newsk, struct sctp_association * assoc, sctp_socket_type_t type ) { struct sctp_sock * oldsp = sctp_sk ( oldsk ) ; struct sctp_sock * newsp = sctp_sk ( newsk ) ; struct sctp_bind_bucket * pp ; struct sctp_endpoint * newep = newsp -> ep ; struct sk_buff * skb, * tmp ; struct sctp_ulpevent * event ; int flags = 0 ; newsk -> sk_sndbuf = oldsk -> sk_sndbuf ; newsk -> sk_rcvbuf = oldsk -> sk_rcvbuf ; inet_sk_copy_descendant ( newsk, oldsk ) ; newsp -> ep = newep ; newsp -> hmac = NULL ; pp = sctp_sk ( oldsk ) -> bind_hash ; sk_add_bind_node ( newsk, & pp -> owner ) ; sctp_sk ( newsk ) -> bind_hash = pp ; inet_sk ( newsk ) -> num = inet_sk ( oldsk ) -> num ; if ( PF_INET6 == assoc -> base. sk -> sk_family ) flags = SCTP_ADDR6_ALLOWED ; if ( assoc -> peer. ipv4_address ) flags |= SCTP_ADDR4_PEERSUPP ; if ( assoc -> peer. ipv6_address ) flags |= SCTP_ADDR6_PEERSUPP ; sctp_bind_addr_copy ( & newsp -> ep -> base. bind_addr, & oldsp -> ep -> base. bind_addr, SCTP_SCOPE_GLOBAL, GFP_KERNEL, flags ) ; sctp_skb_for_each ( skb, & oldsk -> sk_receive_queue, tmp ) { event = sctp_skb2event ( skb ) ; if ( event -> asoc == assoc ) { <START_BUG> sctp_sock_rfree ( skb ) ; <END_BUG> __skb_unlink ( skb, & oldsk -> sk_receive_queue ) ; __skb_queue_tail ( & newsk -> sk_receive_queue, skb ) ;  sctp_skb

Fix:
<S2SV_ModStart> assoc ) { sctp_sock_rfree_frag <S2SV_ModEnd> ( skb ) <S2SV_ModStart> skb ) ; sctp_skb_set_owner_r_frag <S2SV_ModEnd> ( skb, <S2SV_ModStart> assoc ) { sctp_sock_rfree_frag <S2SV_ModEnd> ( skb ) <S2SV_ModStart> skb ) ; sctp_skb_set_owner_r_frag <S2SV_ModEnd> ( skb, <S2SV_ModStart> sctp_clear_pd ( oldsk ) ; } sctp_skb_for_each ( skb, & assoc -> ulpq. reasm, tmp ) { sctp_sock_rfree_frag ( skb ) ; sctp_skb_set_owner_r_frag ( skb, newsk ) ; } sctp_skb_for_each ( skb, & assoc -> ulpq. lobby, tmp ) { sctp_sock_rfree_frag ( skb ) ; sctp_skb_set_owner_r_frag ( skb, newsk
Buggy code:
 static bool_t svcauth_gss_accept_sec_context ( struct svc_req * rqst, struct rpc_gss_init_res * gr ) { struct svc_rpc_gss_data * gd ; struct rpc_gss_cred * gc ; gss_buffer_desc recv_tok, seqbuf ; gss_OID mech ; OM_uint32 maj_stat = 0, min_stat = 0, ret_flags, seq ; log_debug ( "in   svcauth_gss_accept_context()" ) ; gd = SVCAUTH_PRIVATE ( rqst -> rq_xprt -> xp_auth ) ; gc = ( struct rpc_gss_cred * ) rqst -> rq_clntcred ; memset ( gr, 0, sizeof ( * gr ) ) ; memset ( & recv_tok, 0, sizeof ( recv_tok ) ) ; if (! svc_getargs ( rqst -> rq_xprt, xdr_rpc_gss_init_args, ( caddr_t ) & recv_tok ) ) return ( FALSE ) ; gr -> gr_major = gss_accept_sec_context ( & gr -> gr_minor, & gd -> ctx, svcauth_gss_creds, & recv_tok, GSS_C_NO_CHANNEL_BINDINGS, & gd -> client_name, & mech, & gr -> gr_token, & ret_flags, NULL, NULL ) ; svc_freeargs ( rqst -> rq_xprt, xdr_rpc_gss_init_args, ( caddr_t ) & recv_tok ) ; log_status ( "accept_sec_context", gr -> gr_major, gr -> gr_minor ) ; if ( gr -> gr_major!= GSS_S_COMPLETE && gr -> gr_major!= GSS_S_CONTINUE_NEEDED ) { badauth ( gr -> gr_major, gr -> gr_minor, rqst -> rq_xprt ) ; gd -> ctx = GSS_C_NO_CONTEXT ; goto errout ; } <START_BUG> if ( ( gr -> gr_ctx. value = mem_alloc ( sizeof ( gss_union_ctx_id_desc ) ) ) == NULL ) { <END_BUG> fprintf ( stderr, "svcauth_gss_accept_

Fix:
<S2SV_ModStart> errout ; } <S2SV_ModEnd> gr -> gr_ctx <S2SV_ModStart>. value = "xxxx" ; <S2SV_ModEnd> gr -> gr_ctx <S2SV_ModStart> -> gr_ctx. length = 4 <S2SV_ModEnd> ; gr ->
Buggy code:
 static Image * ReadCINImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define MonoColorType 1 # define RGBColorType 3 char property [ MaxTextExtent ] ; CINInfo cin ; Image * image ; MagickBooleanType status ; MagickOffsetType offset ; QuantumInfo * quantum_info ; QuantumType quantum_type ; register ssize_t i ; register PixelPacket * q ; size_t length ; ssize_t count, y ; unsigned char magick [ 4 ], * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } offset = 0 ; count = ReadBlob ( image, 4, magick ) ; offset += count ; if ( ( count!= 4 ) || ( ( LocaleNCompare ( ( char * ) magick, "\\200\\052\\137\\327", 4 )!= 0 ) ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; image -> endian = ( magick [ 0 ] == 0x80 ) && ( magick [ 1 ] == 0x2a ) && ( magick [ 2 ] == 0x5f ) && ( magick [ 3 ] == 0xd7 )? MSBEndian : LSBEndian ; cin. file. image_offset = ReadBlobLong ( image ) ; offset += 4 ; cin. file. generic_length = ReadBlobLong ( image ) ; offset += 4 ; cin. file. industry_length = ReadBlobLong ( image ) ; offset += 4 ; cin. file. user_length = ReadBlobLong ( image ) ; offset += 4 ; cin. file. file_size = ReadBlobLong ( image )

Fix:
<S2SV_ModStart> image_info -> ping!= MagickFalse <S2SV_ModStart> return ( image ) ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image )
Buggy code:
 int ping_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * isk = inet_sk ( sk ) ; <START_BUG> int family = sk -> sk_family ; <END_BUG> struct sockaddr_in * sin ; struct sockaddr_in6 * sin6 ; struct sk_buff * skb ; int copied, err ; pr_debug ( "ping_recvmsg(sk=%p,sk->num=%u)\\n", isk, isk -> inet_num ) ; err = - EOPNOTSUPP ; if ( flags & MSG_OOB ) goto out ;  if ( addr_len ) { <START_BUG> if ( family == AF_INET ) * addr_len = sizeof ( * sin ) ; else if ( family == AF_INET6 && addr_len ) * addr_len = sizeof ( * sin6 ) ; } if ( flags & MSG_ERRQUEUE ) { if ( family == AF_INET ) { return ip_recv_error ( sk, msg, len ) ; # if IS_ENABLED ( CONFIG_IPV6 ) } else if ( family == AF_INET6 ) { return pingv6_ops. ipv6_recv_error ( sk, msg, len ) ; # endif } } skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( copied > len ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto done ; sock_recv_timestamp ( msg, sk, skb ) ; if ( family == AF_INET ) { <END_BUG> sin = ( struct sockaddr_in * ) msg -> msg_name ;  sin -> sin_family = AF_INET ; sin -> sin_port = 0 ; sin -> sin_addr. s_addr = ip_hdr ( skb ) -> saddr ; memset ( sin -> sin_zero, 0, sizeof ( sin -> sin_zero ) ) ; <START_BUG> if ( isk -> cmsg_flags ) <END_BUG> ip

Fix:
<S2SV_ModStart> sk -> sk_family <S2SV_ModEnd> ; struct sk_buff <S2SV_ModStart> goto out ; <S2SV_ModEnd> if ( flags <S2SV_ModStart> AF_INET ) { struct sockaddr_in * <S2SV_ModStart> ) ) ; * addr_len = sizeof ( * sin ) ; <S2SV_ModStart> skb ) ; <S2SV_ModEnd> struct sockaddr_in6 * <S2SV_ModStart> struct sockaddr_in6 * sin6 = ( struct sockaddr_in6 * <S2SV_ModStart> ) -> iif ) ; * addr_len = sizeof ( * sin6
Buggy code:
 static inline rsRetVal processBatchMultiRuleset ( batch_t * pBatch ) { ruleset_t * currRuleset ; batch_t snglRuleBatch ; int i ; int iStart ; int iNew ; <START_BUG> DEFiRet ; <END_BUG> CHKiRet ( batchInit ( & snglRuleBatch, pBatch -> nElem ) ) ; snglRuleBatch. pbShutdownImmediate = pBatch -> pbShutdownImmediate ;  while ( 1 ) { <START_BUG> for ( iStart = 0 ; iStart < pBatch -> nElem && pBatch -> pElem [ iStart ]. state == BATCH_STATE_DISC ; ++ iStart ) ; if ( iStart == pBatch -> nElem ) FINALIZE ; currRuleset = batchElemGetRuleset ( pBatch, iStart ) ; iNew = 0 ; for ( i = iStart ; i < pBatch -> nElem ; ++ i ) { if ( batchElemGetRuleset ( pBatch, i ) == currRuleset ) { batchCopyElem ( & ( snglRuleBatch. pElem [ iNew ++ ] ), & ( pBatch -> pElem [ i ] ) ) ; pBatch -> pElem [ i ]. state = BATCH_STATE_DISC ; } } snglRuleBatch. nElem = iNew ; batchSetSingleRuleset ( & snglRuleBatch, 1 ) ; processBatch ( & snglRuleBatch ) ; } batchFree ( & snglRuleBatch ) ; finalize_it : RETiRet ; }<END_BUG>

Fix:
<S2SV_ModStart> int iNew ; int bHaveUnprocessed ; DEFiRet ; do { bHaveUnprocessed = 0 ; for ( iStart = 0 ; iStart < pBatch -> nElem && pBatch -> pElem [ iStart ]. state == BATCH_STATE_DISC ; ++ iStart ) ; if ( iStart == pBatch -> nElem ) break ; <S2SV_ModEnd> CHKiRet ( batchInit <S2SV_ModStart> -> pbShutdownImmediate ; currRuleset = batchElemGetRuleset ( pBatch, iStart ) ; iNew = 0 ; for ( i = iStart ; i < pBatch -> nElem ; ++ i ) { if ( batchElemGetRuleset ( pBatch, i ) == currRuleset ) { snglRuleBatch. pElem [ iNew ]. pUsrp = pBatch -> pElem [ i ]. pUsrp ; snglRuleBatch. pElem [ iNew ]. state = pBatch -> pElem [ i ]. state ; ++ iNew ; pBatch -> pElem [ i ]. state = BATCH_STATE_DISC ; } else { bHaveUnprocessed = 1 ; } } snglRuleBatch. nElem = iNew
Buggy code:
 static void mt_decode_macroblock ( VP8D_COMP * pbi, MACROBLOCKD * xd, unsigned int mb_idx ) { MB_PREDICTION_MODE mode ; int i ; # if CONFIG_ERROR_CONCEALMENT int corruption_detected = 0 ; <START_BUG> # endif <END_BUG> if ( xd -> mode_info_context -> mbmi. mb_skip_coeff ) { vp8_reset_mb_tokens_context ( xd ) ; } else if (! vp8dx_bool_error ( xd -> current_bc ) ) { int eobtotal ; eobtotal = vp8_decode_mb_tokens ( pbi, xd ) ; xd -> mode_info_context -> mbmi. mb_skip_coeff = ( eobtotal == 0 ) ; } mode = xd -> mode_info_context -> mbmi. mode ; if ( xd -> segmentation_enabled ) vp8_mb_init_dequantizer ( pbi, xd ) ; # if CONFIG_ERROR_CONCEALMENT if ( pbi -> ec_active ) { int throw_residual ; throw_residual = (! pbi -> independent_partitions && pbi -> frame_corrupt_residual ) ; throw_residual = ( throw_residual || vp8dx_bool_error ( xd -> current_bc ) ) ; if ( ( mb_idx >= pbi -> mvs_corrupt_from_mb || throw_residual ) ) { pbi -> frame_corrupt_residual = 1 ;  vpx_memset ( xd -> qcoeff, 0, sizeof ( xd -> qcoeff ) ) ; <START_BUG> vp8_conceal_corrupt_mb ( xd ) ; corruption_detected = 1 ; <END_BUG> vpx_memset ( xd -> eobs, 0, 25 ) ;  } } # endif if ( xd -> mode_info_context -> mbmi. ref_frame == INTRA_FRAME ) { vp8_build_intra_predictors_mbuv_s ( xd, xd -> recon_above [ 1 ], xd -> recon_above [ 2 ], xd -> recon_left [ 1 ], xd -> recon_left [ 2 ], xd -> recon_left_stride [ 1 ], xd -> dst. u_buffer, xd -> dst. v_buffer, xd

Fix:
<S2SV_ModStart> 0 ; # else ( void ) mb_idx ; # <S2SV_ModStart> = 1 ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> = 1 ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart>. mb_skip_coeff ) memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> dst_stride ) ; memset <S2SV_ModEnd> ( b -> <S2SV_ModStart> qcoeff ) ; memset <S2SV_ModEnd> ( b -> <S2SV_ModStart> qcoeff ) ; memset <S2SV_ModEnd> ( b ->
Buggy code:
 static int key_notify_policy_flush ( const struct km_event * c ) { struct sk_buff * skb_out ; struct sadb_msg * hdr ; skb_out = alloc_skb ( sizeof ( struct sadb_msg ) + 16, GFP_ATOMIC ) ; if (! skb_out ) return - ENOBUFS ; hdr = ( struct sadb_msg * ) skb_put ( skb_out, sizeof ( struct sadb_msg ) ) ; hdr -> sadb_msg_type = SADB_X_SPDFLUSH ; hdr -> sadb_msg_seq = c -> seq ; hdr -> sadb_msg_pid = c -> portid ; hdr -> sadb_msg_version = PF_KEY_V2 ; hdr -> sadb_msg_errno = ( uint8_t ) 0 ; hdr -> sadb_msg_satype = SADB_SATYPE_UNSPEC ; hdr -> sadb_msg_len = ( sizeof ( struct sadb_msg ) // sizeof ( uint64_t ) ) ; <START_BUG> pfkey_broadcast ( skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c -> net ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; hdr -> sadb_msg_reserved = 0 ;
Buggy code:
 static int64_t handle_inter_mode ( VP9_COMP * cpi, MACROBLOCK * x, <START_BUG> const TileInfo * const tile, <END_BUG> BLOCK_SIZE bsize,  int64_t txfm_cache [ ], <START_BUG> <END_BUG> int * rate2, int64_t * distortion,  <START_BUG> int * skippable, <END_BUG> int * rate_y, int64_t * distortion_y,  int * rate_uv, int64_t * distortion_uv, <START_BUG> int * mode_excluded, int * disable_skip, INTERP_FILTER * best_filter, int_mv ( * mode_mv ) [ MAX_REF_FRAMES ], int mi_row, int mi_col, <END_BUG> int_mv single_newmv [ MAX_REF_FRAMES ],  int64_t * psse, <START_BUG> const int64_t ref_best_rd ) { <END_BUG> VP9_COMMON * cm = & cpi -> common ; MACROBLOCKD * xd = & x -> e_mbd ;  MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; <START_BUG> const int is_comp_pred = has_second_ref ( mbmi ) ; <END_BUG> const int num_refs = is_comp_pred? 2 : 1 ;  const int this_mode = mbmi -> mode ; int_mv * frame_mv = mode_mv [ this_mode ] ; int i ; int refs [ 2 ] = { mbmi -> ref_frame [ 0 ], ( mbmi -> ref_frame [ 1 ] < 0? 0 : mbmi -> ref_frame [ 1 ] ) } ; int_mv cur_mv [ 2 ] ; <START_BUG> int64_t this_rd = 0 ; <END_BUG>  DECLARE_ALIGNED_ARRAY ( 16, uint8_t, tmp_buf, MAX_MB_PLANE * 64 * 64 ) ; <START_BUG> int pred_exists = 0 ; int intpel_mv ; <END_BUG> int64_t rd, best_rd = INT64_MAX ;  int best_needs_copy = 0 ; uint8_t * orig_dst [ MAX_MB_PLANE ] ; int orig_dst_stride [ MAX_MB_PLANE ] ; <START_BUG> int rs = 0 ; <END_BUG> if ( is_comp_pred

Fix:
<S2SV_ModStart> * x, <S2SV_ModEnd> BLOCK_SIZE bsize, <S2SV_ModStart> BLOCK_SIZE bsize, int * rate2, int64_t * distortion <S2SV_ModEnd>, int * <S2SV_ModStart>, int * skippable <S2SV_ModEnd>, int * <S2SV_ModStart>, int * rate_y, int * rate_uv <S2SV_ModEnd>, int * <S2SV_ModStart>, int * disable_skip <S2SV_ModEnd>, int_mv ( <S2SV_ModStart>, int_mv single_newmv [ MAX_REF_FRAMES ], INTERP_FILTER ( * single_filter ) [ MAX_REF_FRAMES ], int ( * single_skippable ) <S2SV_ModStart> const int64_t ref_best_rd, int64_t * mask_filter, int64_t filter_cache [ ] <S2SV_ModStart> ] -> mbmi ; MB_MODE_INFO_EXT * const mbmi_ext = x -> mbmi_ext <S2SV_ModStart> ; const int <S2SV_ModEnd> this_mode = mbmi <S2SV_ModStart> 2 ] ; # if CONFIG_VP9_HIGHBITDEPTH DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> ( 16, uint16_t, tmp_buf16 [ MAX_MB_PLANE * 64 * 64 ] ) ; uint8_t * tmp_buf ; # else DECLARE_ALIGN
Buggy code:
 void jpc_qmfb_split_colres ( jpc_fix_t * a, int numrows, int numcols, int stride, int parity ) { int bufsize = JPC_CEILDIVPOW2 ( numrows, 1 ) ; jpc_fix_t splitbuf [ QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE ] ; jpc_fix_t * buf = splitbuf ; jpc_fix_t * srcptr ; jpc_fix_t * dstptr ; register jpc_fix_t * srcptr2 ; register jpc_fix_t * dstptr2 ; register int n ; register int i ; int m ; int hstartcol ; if ( bufsize > QMFB_SPLITBUFSIZE ) { <START_BUG> if (! ( buf = jas_alloc2 ( bufsize, sizeof ( jpc_fix_t ) ) ) ) { <END_BUG> abort ( ) ; } } if ( numrows >= 2 ) { hstartcol = ( numrows + 1 - parity ) >> 1 ; m = numrows - hstartcol ; n = m ; dstptr = buf ; srcptr = & a [ ( 1 - parity ) * stride ] ; while ( n -- > 0 ) { dstptr2 = dstptr ; srcptr2 = srcptr ; for ( i = 0 ; i < numcols ; ++ i ) { * dstptr2 = * srcptr2 ; ++ dstptr2 ; ++ srcptr2 ; } dstptr += numcols ; srcptr += stride << 1 ; } dstptr = & a [ ( 1 - parity ) * stride ] ; srcptr = & a [ ( 2 - parity ) * stride ] ; n = numrows - m - (! parity ) ; while ( n -- > 0 ) { dstptr2 = dstptr ; srcptr2 = srcptr ; for ( i = 0 ; i < numcols ; ++ i ) { * dstptr2 = * srcptr2 ; ++ dstptr2 ; ++ srcptr2 ; } dstptr += stride ; srcptr += stride << 1 ; } dstptr = & a [ hstartcol * stride ] ; srcptr = buf ; n = m ; while ( n -- > 0 ) { dstptr2 = dstptr ; srcptr2 = srcptr ; for ( i = 0 ; i < numcols

Fix:
<S2SV_ModStart> ( buf = jas_alloc3 ( bufsize, numcols <S2SV_ModEnd>, sizeof (
Buggy code:
 <START_BUG> static void predict_and_reconstruct_intra_block ( int plane, int block, <END_BUG> BLOCK_SIZE plane_bsize,  TX_SIZE tx_size, void * arg ) { <START_BUG> struct intra_args * const args = ( struct intra_args * ) arg ; VP9_COMMON * const cm = args -> cm ; MACROBLOCKD * const xd = args -> xd ; struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <END_BUG> MODE_INFO * const mi = xd -> mi [ 0 ] ;  <START_BUG> const MB_PREDICTION_MODE mode = ( plane == 0 )? get_y_mode ( mi, block ) <END_BUG> : mi -> mbmi. uv_mode ; int x, y ; uint8_t * dst ;  txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & x, & y ) ; <START_BUG> <END_BUG> dst = & pd -> dst. buf [ 4 * y * pd -> dst. stride + 4 * x ] ;  <START_BUG> vp9_predict_intra_block ( xd, block >> ( tx_size << 1 ), <END_BUG> b_width_log2 ( plane_bsize ), tx_size, mode, dst, pd -> dst. stride, dst, pd -> dst. stride, x, y, plane ) ;  if (! mi -> mbmi. skip ) { <START_BUG> <END_BUG> const int eob = vp9_decode_block_tokens ( cm, xd, plane, block,  plane_bsize, x, y, tx_size, args -> r ) ; inverse_transform_block ( xd, plane, block, tx_size, dst, pd -> dst. stride, eob ) ; } }

Fix:
<S2SV_ModStart> void predict_and_reconstruct_intra_block ( MACROBLOCKD * const xd, vpx_reader * r, MB_MODE_INFO * const mbmi, int plane, int row, int col <S2SV_ModEnd>, TX_SIZE tx_size <S2SV_ModStart>, TX_SIZE tx_size ) { <S2SV_ModEnd> struct macroblockd_plane * <S2SV_ModStart> plane ] ; PREDICTION_MODE <S2SV_ModEnd> mode = ( <S2SV_ModStart> 0 )? mbmi -> mode : mbmi -> uv_mode ; <S2SV_ModEnd> uint8_t * dst <S2SV_ModStart> * dst ; <S2SV_ModEnd> dst = & <S2SV_ModStart> [ 4 * row <S2SV_ModEnd> * pd -> <S2SV_ModStart> + 4 * col ] ; if ( mbmi -> sb_type < BLOCK_8X8 ) if ( plane == 0 ) mode = xd -> mi [ 0 ] -> bmi [ ( row <S2SV_ModEnd> << 1 ) <S2SV_ModStart> << 1 ) + col ]. as_mode ; vp9_predict_intra_block ( xd, pd -> n4_wl, tx_size, mode, dst, pd -> dst. stride, dst, pd -> dst. stride, col, row <S2SV_ModEnd>, plane ) <S2SV_ModStart> if (! mbmi -> <S2SV_ModEnd> skip ) { <S2SV_ModStart> ) { const TX_TYPE tx_type =
Buggy code:
 static int64_t rd_pick_intra_sbuv_mode ( VP9_COMP * cpi, MACROBLOCK * x, PICK_MODE_CONTEXT * ctx, int * rate, int * rate_tokenonly, int64_t * distortion, int * skippable, BLOCK_SIZE bsize, TX_SIZE max_tx_size ) { MACROBLOCKD * xd = & x -> e_mbd ; <START_BUG> MB_PREDICTION_MODE mode ; <END_BUG> MB_PREDICTION_MODE mode_selected = DC_PRED ; int64_t best_rd = INT64_MAX, this_rd ; int this_rate_tokenonly, this_rate, s ;  int64_t this_distortion, this_sse ; <START_BUG> for ( mode = DC_PRED ; mode <= TM_PRED ; ++ mode ) { if (! ( cpi -> sf. intra_uv_mode_mask [ max_tx_size ] & ( 1 << mode ) ) ) continue ; xd -> mi [ 0 ] -> mbmi. uv_mode = mode ; <END_BUG> super_block_uvrd ( cpi, x, & this_rate_tokenonly,  <START_BUG> & this_distortion, & s, & this_sse, bsize, best_rd ) ; <END_BUG> if ( this_rate_tokenonly == INT_MAX ) continue ; this_rate = this_rate_tokenonly +  x -> intra_uv_mode_cost [ cpi -> common. frame_type ] [ mode ] ; <START_BUG> this_rd = RDCOST ( x -> rdmult, x -> rddiv, this_rate, this_distortion ) ; if ( this_rd < best_rd ) { mode_selected = mode ; best_rd = this_rd ; * rate = this_rate ; * rate_tokenonly = this_rate_tokenonly ; * distortion = this_distortion ; * skippable = s ; <END_BUG> if (! x -> select_txfm_size ) {  int i ; struct macroblock_plane * const p = x -> plane ; struct macroblockd_plane * const pd = xd -> plane ; for ( i = 1 ; i < MAX_MB_PLANE ; ++ i ) { p [ i ]. coeff = ctx -> coeff_pbuf [

Fix:
<S2SV_ModStart> -> e_mbd ; PREDICTION_MODE mode ; PREDICTION_MODE <S2SV_ModEnd> mode_selected = DC_PRED <S2SV_ModStart> this_distortion, this_sse ; memset ( x -> skip_txfm, SKIP_TXFM_NONE, sizeof ( x -> skip_txfm ) ) <S2SV_ModStart> = mode ; if (! <S2SV_ModStart>, best_rd ) <S2SV_ModEnd> ) continue ; <S2SV_ModStart> = this_rate_tokenonly + cpi <S2SV_ModEnd> -> intra_uv_mode_cost [ <S2SV_ModStart>! x -> select_tx_size ) swap_block_ptr ( x, ctx, 2, 0, 1, MAX_MB_PLANE ) ; <S2SV_ModEnd> } } xd
Buggy code:
 static void prefetch_dec ( void ) <START_BUG> { <END_BUG> prefetch_table ( ( const void * ) & dec_tables, sizeof ( dec_tables ) ) ; }

Fix:
<S2SV_ModStart> void ) { dec_tables. counter_head ++ ; dec_tables. counter_tail ++ ;
Buggy code:
 void cisco_autorp_print ( netdissect_options * ndo, register const u_char * bp, register u_int len ) { int type ; int numrps ; int hold ; <START_BUG> ND_TCHECK ( bp [ 0 ] ) ; <END_BUG> ND_PRINT ( ( ndo, "   auto-rp   " ) ) ; type = bp [ 0 ] ; switch ( type ) { case 0x11 : ND_PRINT ( ( ndo, "candidate-advert" ) ) ; break ; case 0x12 : ND_PRINT ( ( ndo, "mapping" ) ) ; break ; default : ND_PRINT ( ( ndo, "type-0x%02x", type ) ) ; break ; } ND_TCHECK ( bp [ 1 ] ) ; numrps = bp [ 1 ] ; ND_TCHECK2 ( bp [ 2 ], 2 ) ; ND_PRINT ( ( ndo, "   Hold   " ) ) ; hold = EXTRACT_16BITS ( & bp [ 2 ] ) ; if ( hold ) unsigned_relts_print ( ndo, EXTRACT_16BITS ( & bp [ 2 ] ) ) ; else ND_PRINT ( ( ndo, "FOREVER" ) ) ; bp += 8 ; len -= 8 ; while ( numrps -- ) { int nentries ; char s ;  ND_TCHECK2 ( bp [ 0 ], 4 ) ; <START_BUG> ND_PRINT ( ( ndo, "   RP   %s", ipaddr_string ( ndo, bp ) ) ) ; <END_BUG> ND_TCHECK ( bp [ 4 ] ) ;  <START_BUG> switch ( bp [ 4 ] & 0x3 ) { <END_BUG> case 0 : ND_PRINT ( ( ndo, "   PIMv?" ) ) ; break ; case 1 : ND_PRINT ( ( ndo, "   PIMv1" ) ) ; break ; case 2 : ND_PRINT ( ( ndo, "   PIMv2" ) ) ; break ; case 3 : ND_PRINT ( ( ndo, "   PIMv1+2" ) ) ; break ; }  if ( bp [ 4 ] & 0xfc ) <START_BUG> <END_BUG> ND_PRINT ( ( ndo, "   [rsvd=0x%02x]", bp

Fix:
<S2SV_ModStart> int hold ; if ( len < 8 ) goto trunc ; <S2SV_ModStart> char s ; if ( len < 4 ) goto trunc ; <S2SV_ModStart> ) ) ; bp += 4 ; len -= 4 ; if ( len < 1 ) goto trunc ; <S2SV_ModStart> ( bp [ 0 <S2SV_ModEnd> ] ) ; <S2SV_ModStart> ( bp [ 0 <S2SV_ModEnd> ] & 0x3 <S2SV_ModStart> ( bp [ 0 <S2SV_ModEnd> ] & 0xfc <S2SV_ModStart>, bp [ 0 <S2SV_ModEnd> ] & 0xfc <S2SV_ModStart> ) ) ; bp += 1 ; len -= 1 ; if ( len < 1 ) goto trunc ; <S2SV_ModStart> ( bp [ 0 <S2SV_ModEnd> ] ) ; <S2SV_ModStart> = bp [ 0 <S2SV_ModEnd> ] ; bp <S2SV_ModStart> ; bp += 1 ; len -= 1 <S2SV_ModEnd> ; s = <S2SV_ModStart> -- ) { if ( len < 6 ) goto trunc ;
Buggy code:
 static stmt_ty <START_BUG> ast_for_with_stmt ( struct compiling * c, const node * n, int is_async ) <END_BUG>  { <START_BUG> int i, n_items, nch_minus_type, has_type_comment ; asdl_seq * items, * body ; string type_comment ; if ( is_async && c -> c_feature_version < 5 ) { ast_error ( c, n, "Async   with   statements   are   only   supported   in   Python   3.5   and   greater" ) ; return NULL ; } REQ ( n, with_stmt ) ; has_type_comment = TYPE ( CHILD ( n, NCH ( n ) - 2 ) ) == TYPE_COMMENT ; nch_minus_type = NCH ( n ) - has_type_comment ; n_items = ( nch_minus_type - 2 ) // 2 ; items = _Ta3_asdl_seq_new ( n_items, c -> c_arena ) ; if (! items ) return NULL ; for ( i = 1 ; i < nch_minus_type - 2 ; i += 2 ) { withitem_ty item = ast_for_with_item ( c, CHILD ( n, i ) ) ; if (! item ) return NULL ; asdl_seq_SET ( items, ( i - 1 ) // 2, item ) ; } body = ast_for_suite ( c, CHILD ( n, NCH ( n ) - 1 ) ) ; if (! body ) return NULL ; if ( has_type_comment ) type_comment = NEW_TYPE_COMMENT ( CHILD ( n, NCH ( n ) - 2 ) ) ; else type_comment = NULL ; if ( is_async ) <END_BUG> return AsyncWith ( items, body, type_comment, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ;  else return With ( items, body, type_comment, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; }

Fix:
<S2SV_ModStart> const node * n0, bool <S2SV_ModEnd> is_async ) { <S2SV_ModStart> is_async ) { const node * const n = is_async? CHILD ( n0, 1 ) : n0 ; <S2SV_ModStart>, LINENO ( n0 ), n0 <S2SV_ModEnd> -> n_col_offset,
Buggy code:
 void vp9_rc_get_one_pass_vbr_params ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; RATE_CONTROL * const rc = & cpi -> rc ; int target ; if (! cpi -> refresh_alt_ref_frame && ( cm -> current_video_frame == 0 || <START_BUG> ( cm -> frame_flags & FRAMEFLAGS_KEY ) || <END_BUG> rc -> frames_to_key == 0 ||  ( cpi -> oxcf. auto_key && test_for_kf_one_pass ( cpi ) ) ) ) { <START_BUG> cm -> frame_type = KEY_FRAME ; rc -> this_key_frame_forced = cm -> current_video_frame!= 0 && rc -> frames_to_key == 0 ; <END_BUG> rc -> frames_to_key = cpi -> key_frame_frequency ;  rc -> kf_boost = DEFAULT_KF_BOOST ; rc -> source_alt_ref_active = 0 ; } else { cm -> frame_type = INTER_FRAME ; } if ( rc -> frames_till_gf_update_due == 0 ) { <START_BUG> rc -> baseline_gf_interval = DEFAULT_GF_INTERVAL ; <END_BUG> rc -> frames_till_gf_update_due = rc -> baseline_gf_interval ; if ( rc -> frames_till_gf_update_due > rc -> frames_to_key )  rc -> frames_till_gf_update_due = rc -> frames_to_key ; <START_BUG> cpi -> refresh_golden_frame = 1 ; rc -> source_alt_ref_pending = USE_ALTREF_FOR_ONE_PASS ; rc -> gfu_boost = DEFAULT_GF_BOOST ; } if ( cm -> frame_type == KEY_FRAME ) target = calc_iframe_target_size_one_pass_vbr ( cpi ) ; else target = calc_pframe_target_size_one_pass_vbr ( cpi ) ; vp9_rc_set_frame_target ( cpi, target ) ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 || ( cpi <S2SV_ModEnd> -> frame_flags & <S2SV_ModStart>. auto_key && 0 <S2SV_ModEnd> ) ) ) <S2SV_ModStart> = cpi -> oxcf. key_freq <S2SV_ModEnd> ; rc -> <S2SV_ModStart> -> baseline_gf_interval = ( rc -> min_gf_interval + rc -> max_gf_interval ) // 2 <S2SV_ModEnd> ; rc -> <S2SV_ModStart> -> frames_to_key ) { rc -> frames_till_gf_update_due = rc -> frames_to_key ; rc -> constrained_gf_group = 1 ; } else { rc -> constrained_gf_group = 0 ; } <S2SV_ModEnd> cpi -> refresh_golden_frame
Buggy code:
 static void babel_print_v2 ( netdissect_options * ndo, const u_char * cp, u_int length ) { u_int i ; u_short bodylen ; u_char v4_prefix [ 16 ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF, 0, 0, 0, 0 } ; u_char v6_prefix [ 16 ] = { 0 } ; ND_TCHECK2 ( * cp, 4 ) ; if ( length < 4 ) goto invalid ; bodylen = EXTRACT_16BITS ( cp + 2 ) ; ND_PRINT ( ( ndo, "   (%u)", bodylen ) ) ; i = 0 ; while ( i < bodylen ) { const u_char * message ; u_int type, len ; message = cp + 4 + i ; ND_TCHECK2 ( * message, 1 ) ; if ( ( type = message [ 0 ] ) == MESSAGE_PAD1 ) { ND_PRINT ( ( ndo, ndo -> ndo_vflag? "\\n\\tPad   1" : "   pad1" ) ) ; i += 1 ; continue ; } ND_TCHECK2 ( * message, 2 ) ; ICHECK ( i, 2 ) ; len = message [ 1 ] ; ND_TCHECK2 ( * message, 2 + len ) ; ICHECK ( i, 2 + len ) ; switch ( type ) { case MESSAGE_PADN : { if (! ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "   padN" ) ) ; else ND_PRINT ( ( ndo, "\\n\\tPad   %d", len + 2 ) ) ; } break ; case MESSAGE_ACK_REQ : { u_short nonce, interval ; if (! ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "   ack-req" ) ) ; else { ND_PRINT ( ( ndo, "\\n\\tAcknowledgment   Request   " ) ) ; if ( len < 6 ) goto invalid ; nonce = EXTRACT_16BITS ( message + 4 ) ; interval = EXTRACT_16BITS ( message + 6 ) ; ND_PRINT ( ( ndo, "%04

Fix:
<S2SV_ModStart> ( len < 10 <S2SV_ModEnd> ) ND_PRINT (
Buggy code:
 static unsigned int get_sby_perpixel_diff_variance ( VP9_COMP * cpi, <START_BUG> MACROBLOCK * x, <END_BUG> int mi_row, int mi_col, BLOCK_SIZE bs ) {  const YV12_BUFFER_CONFIG * yv12 = get_ref_frame_buffer ( cpi, LAST_FRAME ) ; <START_BUG> <END_BUG> int offset = ( mi_row * MI_SIZE ) * yv12 -> y_stride + ( mi_col * MI_SIZE ) ;  unsigned int var, sse ; <START_BUG> var = cpi -> fn_ptr [ bs ]. vf ( x -> plane [ 0 ]. src. buf, <END_BUG> x -> plane [ 0 ]. src. stride, yv12 -> y_buffer + offset, yv12 -> y_stride, & sse ) ; return ROUND_POWER_OF_TWO ( var, num_pels_log2_lookup [ bs ] ) ; }

Fix:
<S2SV_ModStart> * cpi, const struct buf_2d * ref <S2SV_ModEnd>, int mi_row <S2SV_ModStart> bs ) { unsigned int sse, var ; uint8_t * last_y ; <S2SV_ModStart> const YV12_BUFFER_CONFIG * last <S2SV_ModEnd> = get_ref_frame_buffer ( <S2SV_ModStart> LAST_FRAME ) ; assert ( last!= NULL ) ; last_y = & last -> y_buffer [ <S2SV_ModEnd> mi_row * MI_SIZE <S2SV_ModStart> mi_row * MI_SIZE * last <S2SV_ModEnd> -> y_stride + <S2SV_ModStart> -> y_stride + <S2SV_ModEnd> mi_col * MI_SIZE <S2SV_ModStart> mi_col * MI_SIZE ] <S2SV_ModEnd> ; var = <S2SV_ModStart>. vf ( ref -> buf, ref -> stride, last_y, last <S2SV_ModEnd> -> y_stride,
Buggy code:
 rfbBool HandleCursorShape ( rfbClient * client, int xhot, int yhot, int width, int height, uint32_t enc ) { int bytesPerPixel ; size_t bytesPerRow, bytesMaskData ; rfbXCursorColors rgb ; uint32_t colors [ 2 ] ; char * buf ; uint8_t * ptr ; int x, y, b ; bytesPerPixel = client -> format. bitsPerPixel // 8 ; bytesPerRow = ( width + 7 ) // 8 ; bytesMaskData = bytesPerRow * height ; if ( width * height == 0 ) return TRUE ; <START_BUG> if ( client -> rcSource ) <END_BUG> free ( client -> rcSource ) ; client -> rcSource = malloc ( width * height * bytesPerPixel ) ; if ( client -> rcSource == NULL ) return FALSE ; buf = malloc ( bytesMaskData ) ; if ( buf == NULL ) { free ( client -> rcSource ) ; client -> rcSource = NULL ; return FALSE ; } if ( enc == rfbEncodingXCursor ) { if (! ReadFromRFBServer ( client, ( char * ) & rgb, sz_rfbXCursorColors ) ) { free ( client -> rcSource ) ; client -> rcSource = NULL ; free ( buf ) ; return FALSE ; } colors [ 0 ] = RGB24_TO_PIXEL ( 32, rgb. backRed, rgb. backGreen, rgb. backBlue ) ; colors [ 1 ] = RGB24_TO_PIXEL ( 32, rgb. foreRed, rgb. foreGreen, rgb. foreBlue ) ; if (! ReadFromRFBServer ( client, buf, bytesMaskData ) ) { free ( client -> rcSource ) ; client -> rcSource = NULL ; free ( buf ) ; return FALSE ; } ptr = client -> rcSource ; for ( y = 0 ; y < height ; y ++ ) { for ( x = 0 ; x < width // 8 ; x ++ ) { for ( b = 7 ; b >= 0 ; b -- ) { * ptr = buf [ y * bytesPerRow + x ] >> b & 1 ; ptr += bytesPerPixel ; } } for ( b = 7 ; b > 7 - width % 8 ; b -- ) { * ptr = buf [ y * bytesPerRow + x ] >> b & 1 ; ptr += bytesPerPixel ; } } switch ( bytesPerPixel ) { case 1 : for ( x = 0 ; x

Fix:
<S2SV_ModStart> ; if ( width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE ) return FALSE ; if (