nus-yam/ex-repair huggingface dataset:
Buggy code:
 static Image * ReadHDRImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char format [ MaxTextExtent ], keyword [ MaxTextExtent ], tag [ MaxTextExtent ], value [ MaxTextExtent ] ; double gamma ; Image * image ; int c ; MagickBooleanType status, value_expected ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; ssize_t count, y ; unsigned char * end, pixel [ 4 ], * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> columns = 0 ; image -> rows = 0 ; * format = '\\0' ; c = ReadBlobByte ( image ) ; if ( c == EOF ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } while ( isgraph ( c ) && ( image -> columns == 0 ) && ( image -> rows == 0 ) ) { if ( c == ( int ) '#' ) { char * comment ; register char * p ; size_t length ; length = MaxTextExtent ; comment = AcquireString ( ( char * ) NULL ) ; for ( p = comment ; comment!= ( char * ) NULL ; p ++ ) { c = ReadBlobByte ( image ) ; if ( ( c == EOF ) || ( c == ( int ) '\\n' ) ) break ; if ( ( size_t ) ( p - comment + 1 ) >= length ) { * p = '\\0' ; length <<= 1 ; comment = ( char * ) ResizeQuantumMemory ( comment, length + MaxTextExtent, sizeof ( * comment ) ) ; if ( comment == ( char * ) NULL ) break ; p = comment + strlen ( comment

Fix:
<S2SV_ModStart>!= '\\0' ) && ( c!= EOF ) <S2SV_ModStart> 2 ] ; if ( <S2SV_ModEnd> sscanf ( value <S2SV_ModStart> 1 ] ) == 8 ) { <S2SV_ModEnd> image -> chromaticity <S2SV_ModStart> 1 ] ; } <S2SV_ModStart>, width ; if ( <S2SV_ModEnd> sscanf ( value <S2SV_ModStart> & width ) == 2 ) { <S2SV_ModEnd> image -> columns <S2SV_ModStart> ) height ; }
Buggy code:
 static int vol_prc_lib_release ( effect_handle_t handle ) { struct listnode * node, * temp_node_next ; vol_listener_context_t * context = NULL ; vol_listener_context_t * recv_contex = ( vol_listener_context_t * ) handle ; <START_BUG> int status = - 1 ; <END_BUG> bool recompute_flag = false ; int active_stream_count = 0 ;  ALOGV ( "%s   context   %p", __func__, handle ) ; <START_BUG> <END_BUG> pthread_mutex_lock ( & vol_listner_init_lock ) ;  list_for_each_safe ( node, temp_node_next, & vol_effect_list ) { context = node_to_item ( node, struct vol_listener_context_s, effect_list_node ) ; <START_BUG> if ( ( memcmp ( & ( context -> desc -> uuid ), & ( recv_contex -> desc -> uuid ), sizeof ( effect_uuid_t ) ) == 0 ) <END_BUG>  && ( context -> session_id == recv_contex -> session_id ) <START_BUG> <END_BUG> && ( context -> stream_type == recv_contex -> stream_type ) ) {  ALOGV ( "---   Found   something   to   remove   ---" ) ; <START_BUG> list_remove ( & context -> effect_list_node ) ; <END_BUG> PRINT_STREAM_TYPE ( context -> stream_type ) ; if ( context -> dev_id && AUDIO_DEVICE_OUT_SPEAKER ) { recompute_flag = true ; } free ( context ) ; status = 0 ; } else { ++ active_stream_count ; } } if ( status!= 0 ) { ALOGE ( "something   wrong  ...   <<<---   Found   NOTHING   to   remove  ...  ????   --->>>>>" ) ;  } <START_BUG> if ( active_stream_count == 0 ) { current_gain_dep_cal_level = - 1 ; current_vol = 0.0 ; } if ( recompute_flag ) { check_and_set_gain_dep_cal ( ) ; } if ( dumping_enabled ) { dump_list_l ( ) ; } pthread_mutex_unlock ( & vol_listner_init_lock ) ; return status ; }<END_BUG>

Fix:
<S2SV_ModStart> status = - EINVAL <S2SV_ModEnd> ; bool recompute_flag <S2SV_ModStart> = 0 ; uint32_t session_id ; uint32_t stream_type ; effect_uuid_t uuid ; <S2SV_ModStart> handle ) ; if ( recv_contex == NULL ) { return status ; } <S2SV_ModStart> & vol_listner_init_lock ) ; session_id = recv_contex -> session_id ; stream_type = recv_contex -> stream_type ; uuid = recv_contex -> desc -> uuid <S2SV_ModStart> ), & uuid <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> -> session_id == <S2SV_ModEnd> session_id ) && <S2SV_ModStart> -> stream_type == <S2SV_ModEnd> stream_type ) ) <S2SV_ModStart> ; list_remove ( node <S2SV_ModEnd> ) ; PRINT_STREAM_TYPE <S2SV_ModStart> "something <S2SV_blank> wrong <S2SV_blank>... <S2SV_blank> <<<--- <S2SV_blank> Found <S2SV_blank> NOTHING <S2SV_blank> to <S2SV_blank> remove <S2SV_blank>... <S2SV_blank>???? <S2SV_blank> --->>>>>" ) ; pthread_mutex_unlock ( & vol_listner_init_lock ) ; return status ;
Buggy code:
 static ssize_t f_hidg_write ( struct file * file, const char __user * buffer, size_t count, loff_t * offp ) { struct f_hidg * hidg = file -> private_data ; struct usb_request * req ; unsigned long flags ; ssize_t status = - ENOMEM ; if (! access_ok ( buffer, count ) ) return - EFAULT ; spin_lock_irqsave ( & hidg -> write_spinlock, flags ) ; # define WRITE_COND (! hidg -> write_pending ) try_again : while (! WRITE_COND ) { spin_unlock_irqrestore ( & hidg -> write_spinlock, flags ) ; if ( file -> f_flags & O_NONBLOCK ) return - EAGAIN ; if ( wait_event_interruptible_exclusive ( hidg -> write_queue, WRITE_COND ) ) return - ERESTARTSYS ; spin_lock_irqsave ( & hidg -> write_spinlock, flags ) ; } hidg -> write_pending = 1 ; req = hidg -> req ; count = min_t ( unsigned, count, hidg -> report_length ) ; spin_unlock_irqrestore ( & hidg -> write_spinlock, flags ) ; status = copy_from_user ( req -> buf, buffer, count ) ; if ( status!= 0 ) { ERROR ( hidg -> func. config -> cdev, "copy_from_user   error\\n" ) ; status = - EINVAL ; goto release_write_pending ; } spin_lock_irqsave ( & hidg -> write_spinlock, flags ) ; if (! hidg -> req ) { free_ep_req ( hidg -> in_ep, req ) ; goto try_again ; } req -> status = 0 ; req -> zero = 0 ; req -> length = count ; req -> complete = f_hidg_req_complete ; req -> context = hidg ; <START_BUG> status = usb_ep_queue ( hidg -> in_ep, req, GFP_ATOMIC ) ; <END_BUG> if ( status < 0 ) { ERROR ( hidg -> func. config -> cdev, "usb_ep

Fix:
<S2SV_ModStart> = hidg ; spin_unlock_irqrestore ( & hidg -> write_spinlock, flags ) ; <S2SV_ModStart> ) ; goto release_write_pending <S2SV_ModEnd> ; } else <S2SV_ModStart> count ; } <S2SV_ModEnd> return status ; <S2SV_ModStart> flags ) ; <S2SV_ModEnd> hidg -> write_pending
Buggy code:
 int nfsd_dispatch ( struct svc_rqst * rqstp, __be32 * statp ) { struct svc_procedure * proc ; kxdrproc_t xdr ; __be32 nfserr ; __be32 * nfserrp ; dprintk ( "nfsd_dispatch:   vers   %d   proc   %d\\n", rqstp -> rq_vers, rqstp -> rq_proc ) ; <START_BUG> proc = rqstp -> rq_procinfo ; <END_BUG> rqstp -> rq_cachetype = proc -> pc_cachetype ; xdr = proc -> pc_decode ; if ( xdr &&! xdr ( rqstp, ( __be32 * ) rqstp -> rq_arg. head [ 0 ]. iov_base, rqstp -> rq_argp ) ) { dprintk ( "nfsd:   failed   to   decode   arguments!\\n" ) ; * statp = rpc_garbage_args ; return 1 ; } switch ( nfsd_cache_lookup ( rqstp ) ) { case RC_DROPIT : return 0 ; case RC_REPLY : return 1 ; case RC_DOIT : ; } nfserrp = rqstp -> rq_res. head [ 0 ]. iov_base + rqstp -> rq_res. head [ 0 ]. iov_len ; rqstp -> rq_res. head [ 0 ]. iov_len += sizeof ( __be32 ) ; nfserr = proc -> pc_func ( rqstp, rqstp -> rq_argp, rqstp -> rq_resp ) ; nfserr = map_new_errors ( rqstp -> rq_vers, nfserr ) ; if ( nfserr == nfserr_dropit || test_bit ( RQ_DROPME, & rqstp -> rq_flags ) ) { dprintk ( "nfsd:   Dropping   request;   may   be   revisited   later\\n" ) ; nfsd_cache_update ( rqstp, RC_NOCACHE, NULL ) ; return 0 ; } if ( rqstp -> rq_proc!= 0 ) * nfserrp ++ = nfserr ; if (! ( nfserr && rqstp -> rq_vers == 2 ) ) { xdr = proc ->

Fix:
<S2SV_ModStart> -> rq_procinfo ; if ( nfs_request_too_big ( rqstp, proc ) ) { dprintk ( "nfsd: <S2SV_blank> NFSv%d <S2SV_blank> argument <S2SV_blank> too <S2SV_blank> large\\n", rqstp -> rq_vers ) ; * statp = rpc_garbage_args ; return 1 ; }
Buggy code:
 static PHP_NAMED_FUNCTION ( zif_zip_entry_read ) { zval * zip_entry ; zend_long len = 0 ; zip_read_rsrc * zr_rsrc ; zend_string * buffer ; int n = 0 ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ), "r|l", & zip_entry, & len ) == FAILURE ) { return ; } if ( ( zr_rsrc = ( zip_read_rsrc * ) zend_fetch_resource ( Z_RES_P ( zip_entry ), le_zip_entry_name, le_zip_entry ) ) == NULL ) { RETURN_FALSE ; } if ( len <= 0 ) { len = 1024 ; } if ( zr_rsrc -> zf ) { <START_BUG> buffer = zend_string_alloc ( len, 0 ) ; <END_BUG> n = zip_fread ( zr_rsrc -> zf, ZSTR_VAL ( buffer ), ZSTR_LEN ( buffer ) ) ; if ( n > 0 ) { ZSTR_VAL ( buffer ) [ n ] = '\\0' ; ZSTR_LEN ( buffer ) = n ; RETURN_NEW_STR ( buffer ) ; } else { zend_string_free ( buffer ) ; RETURN_EMPTY_STRING ( ) } } else { RETURN_FALSE ; } }

Fix:
<S2SV_ModStart> { buffer = zend_string_safe_alloc ( 1, len, 0 <S2SV_ModEnd>, 0 )
Buggy code:
 static int exif_data_load_data_entry ( ExifData * data, ExifEntry * entry, const unsigned char * d, unsigned int size, unsigned int offset ) { unsigned int s, doff ; entry -> tag = exif_get_short ( d + offset + 0, data -> priv -> order ) ; entry -> format = exif_get_short ( d + offset + 2, data -> priv -> order ) ; entry -> components = exif_get_long ( d + offset + 4, data -> priv -> order ) ; exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Loading   entry   0x%x   (\'%s\')...", entry -> tag, exif_tag_get_name ( entry -> tag ) ) ; s = exif_format_get_size ( entry -> format ) * entry -> components ; if ( ( s < entry -> components ) || ( s == 0 ) ) { return 0 ; } if ( s > 4 ) doff = exif_get_long ( d + offset + 8, data -> priv -> order ) ; else doff = offset + 8 ; <START_BUG> if ( ( doff + s < doff ) || ( doff + s < s ) || ( doff + s > size ) ) { <END_BUG> exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData",  "Tag   data   past   end   of   buffer   (%u   >   %u)", doff + s, size ) ; <START_BUG> return 0 ; } entry -> data = exif_data_alloc ( data, s ) ; if ( entry -> data ) { entry -> size = s ; memcpy ( entry -> data, d + doff, s ) ; } else { EXIF_LOG_NO_MEMORY ( data -> priv -> log, "ExifData", s ) ; return 0 ; } if ( entry -> tag == EXIF_TAG_MAKER_NOTE ) { if (! entry -> data ) { exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "MakerNote   found   with   empty   data" ) ; } else if ( entry -> size > 6 ) { exif_log ( data -> priv -><END_BUG>

Fix:
<S2SV_ModStart> ; if ( doff >= size ) { exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Tag <S2SV_blank> starts <S2SV_blank> past <S2SV_blank> end <S2SV_blank> of <S2SV_blank> buffer <S2SV_blank> (%u <S2SV_blank> > <S2SV_blank> %u)", doff, size ) ; return 0 ; } if ( <S2SV_ModEnd> s > size <S2SV_ModStart> s > size - doff <S2SV_ModEnd> ) { exif_log <S2SV_ModStart>, "ExifData", "Tag <S2SV_blank> data <S2SV_blank> goes <S2SV_blank> past <S2SV_blank> end <S2SV_blank> of <S2SV_blank> buffer <S2SV_blank> (%u <S2SV_blank> > <S2SV_blank> %u)" <S2SV_ModEnd>, doff +
Buggy code:
 static void clear_evtchn_to_irq_row ( unsigned row ) { unsigned col ; for ( col = 0 ; col < EVTCHN_PER_ROW ; col ++ ) <START_BUG> evtchn_to_irq [ row ] [ col ] = - 1 ; <END_BUG> }

Fix:
<S2SV_ModStart> col ++ ) WRITE_ONCE ( <S2SV_ModStart> [ col ], - 1 ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 SNDFILE * sf_open_fd ( int fd, int mode, SF_INFO * sfinfo, int close_desc ) { SF_PRIVATE * psf ; if ( ( SF_CONTAINER ( sfinfo -> format ) ) == SF_FORMAT_SD2 ) { sf_errno = SFE_SD2_FD_DISALLOWED ; return NULL ; } ; <START_BUG> if ( ( psf = calloc ( 1, sizeof ( SF_PRIVATE ) ) ) == NULL ) <END_BUG> { sf_errno = SFE_MALLOC_FAILED ; return NULL ; } ; psf_init_files ( psf ) ; copy_filename ( psf, "" ) ; psf -> file. mode = mode ; psf_set_file ( psf, fd ) ; psf -> is_pipe = psf_is_pipe ( psf ) ; psf -> fileoffset = psf_ftell ( psf ) ; if (! close_desc ) psf -> file. do_not_close_descriptor = SF_TRUE ; return psf_open_file ( psf, sfinfo ) ; }

Fix:
<S2SV_ModStart> ( psf = psf_allocate ( <S2SV_ModEnd> ) ) ==
Buggy code:
 static int cdrom_ioctl_media_changed ( struct cdrom_device_info * cdi, unsigned long arg ) { struct cdrom_changer_info * info ; int ret ; cd_dbg ( CD_DO_IOCTL, "entering   CDROM_MEDIA_CHANGED\\n" ) ; if (! CDROM_CAN ( CDC_MEDIA_CHANGED ) ) return - ENOSYS ; if (! CDROM_CAN ( CDC_SELECT_DISC ) || arg == CDSL_CURRENT ) return media_changed ( cdi, 1 ) ; <START_BUG> if ( ( unsigned int ) arg >= cdi -> capacity ) <END_BUG> return - EINVAL ; info = kmalloc ( sizeof ( * info ), GFP_KERNEL ) ; if (! info ) return - ENOMEM ; ret = cdrom_read_mech_status ( cdi, info ) ; if (! ret ) ret = info -> slots [ arg ]. change ; kfree ( info ) ; return ret ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> arg >= cdi
Buggy code:
 <START_BUG> void fdct16_8col ( __m128i * in ) { <END_BUG> __m128i i [ 8 ], s [ 8 ], p [ 8 ], t [ 8 ], u [ 16 ], v [ 16 ] ;  const __m128i k__cospi_p16_p16 = _mm_set1_epi16 ( cospi_16_64 ) ; <START_BUG> const __m128i k__cospi_p16_m16 = pair_set_epi16 ( cospi_16_64, - cospi_16_64 ) ; const __m128i k__cospi_m16_p16 = pair_set_epi16 ( - cospi_16_64, cospi_16_64 ) ; const __m128i k__cospi_p24_p08 = pair_set_epi16 ( cospi_24_64, cospi_8_64 ) ; <END_BUG> const __m128i k__cospi_m24_m08 = pair_set_epi16 ( - cospi_24_64, - cospi_8_64 ) ;  const __m128i k__cospi_m08_p24 = pair_set_epi16 ( - cospi_8_64, cospi_24_64 ) ; const __m128i k__cospi_p28_p04 = pair_set_epi16 ( cospi_28_64, cospi_4_64 ) ; const __m128i k__cospi_m04_p28 = pair_set_epi16 ( - cospi_4_64, cospi_28_64 ) ; const __m128i k__cospi_p12_p20 = pair_set_epi16 ( cospi_12_64, cospi_20_64 ) ; const __m128i k__cospi_m20_p12 = pair_set_epi16 ( - cospi_20_64, cospi_12_64 ) ; const __m128i k__cospi_p30_p02 = pair_set_epi16 ( cospi_30_64, cospi_2_64 ) ; const __m128i k__cospi_p14_p18 = pair_set_epi16 ( cospi_14_64,

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t ) <S2SV_ModStart> ; const __m128i k__cospi_p08_m24 <S2SV_ModEnd> = pair_set_epi16 ( <S2SV_ModStart> = pair_set_epi16 ( cospi_8_64, - cospi_24_64 <S2SV_ModEnd> ) ; const <S2SV_ModStart> 2 ], <S2SV_ModEnd> k__cospi_p24_p08 ) ; <S2SV_ModStart> ; v [ 3 ] = _mm_madd_epi16 ( u [ 3 <S2SV_ModEnd> ], k__cospi_p24_p08 <S2SV_ModStart> k__cospi_p24_p08 ) ; v [ 4 ] = _mm_madd_epi16 ( u [ 2 ], k__cospi_p08_m24 ) ; v [ 5 ] = _mm_madd_epi16 ( u [ 3 ], k__cospi_p08_m24 ) ; v [ 6 ] = _mm_madd_epi16 ( u [ 0 ], k__cospi_p24_p08 ) ; v [ 7 ] = _
Buggy code:
 static void build_y_mask ( const loop_filter_info_n * const lfi_n, const MODE_INFO * mi, const int shift_y, LOOP_FILTER_MASK * lfm ) { const MB_MODE_INFO * mbmi = & mi -> mbmi ; const BLOCK_SIZE block_size = mbmi -> sb_type ; const TX_SIZE tx_size_y = mbmi -> tx_size ; const int filter_level = get_filter_level ( lfi_n, mbmi ) ; uint64_t * const left_y = & lfm -> left_y [ tx_size_y ] ; uint64_t * const above_y = & lfm -> above_y [ tx_size_y ] ; uint64_t * const int_4x4_y = & lfm -> int_4x4_y ; int i ; if (! filter_level ) { return ; } else { const int w = num_8x8_blocks_wide_lookup [ block_size ] ; const int h = num_8x8_blocks_high_lookup [ block_size ] ; int index = shift_y ; for ( i = 0 ; i < h ; i ++ ) { <START_BUG> vpx_memset ( & lfm -> lfl_y [ index ], filter_level, w ) ; <END_BUG> index += 8 ; } } * above_y |= above_prediction_mask [ block_size ] << shift_y ; * left_y |= left_prediction_mask [ block_size ] << shift_y ; if ( mbmi -> skip && is_inter_block ( mbmi ) ) return ; * above_y |= ( size_mask [ block_size ] & above_64x64_txform_mask [ tx_size_y ] ) << shift_y ; * left_y |= ( size_mask [ block_size ] & left_64x64_txform_mask [ tx_size_y ] ) << shift_y ; if ( tx_size_y == TX_4X4 )  * int_4x4_y |= ( size_mask [ block_size ] & 0xffffffffffffffff ) << shift_y ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( & lfm <S2SV_ModStart> block_size ] & 0xffffffffffffffffULL <S2SV_ModEnd> ) << shift_y
Buggy code:
 void Huff_Compress ( msg_t * mbuf, int offset ) { int i, ch, size ; byte seq [ 65536 ] ; byte * buffer ; huff_t huff ; size = mbuf -> cursize - offset ; buffer = mbuf -> data + + offset ; if ( size <= 0 ) { return ; } Com_Memset ( & huff, 0, sizeof ( huff_t ) ) ; huff. tree = huff. lhead = huff. loc [ NYT ] = & ( huff. nodeList [ huff. blocNode ++ ] ) ; huff. tree -> symbol = NYT ; huff. tree -> weight = 0 ; huff. lhead -> next = huff. lhead -> prev = NULL ; huff. tree -> parent = huff. tree -> left = huff. tree -> right = NULL ; seq [ 0 ] = ( size >> 8 ) ; seq [ 1 ] = size & 0xff ; bloc = 16 ; for ( i = 0 ; i < size ; i ++ ) { ch = buffer [ i ] ; <START_BUG> Huff_transmit ( & huff, ch, seq ) ; <END_BUG> Huff_addRef ( & huff, ( byte ) ch ) ; } bloc += 8 ; mbuf -> cursize = ( bloc >> 3 ) + offset ; Com_Memcpy ( mbuf -> data + offset, seq, ( bloc >> 3 ) ) ; }

Fix:
<S2SV_ModStart> ch, seq, size << 3
Buggy code:
 CURLcode Curl_smtp_escape_eob ( struct connectdata * conn, const ssize_t nread ) { ssize_t i ; ssize_t si ; struct Curl_easy * data = conn -> data ; struct SMTP * smtp = data -> req. protop ; char * scratch = data -> state. scratch ; char * newscratch = NULL ; char * oldscratch = NULL ; size_t eob_sent ; if (! scratch || data -> set. crlf ) { oldscratch = scratch ; <START_BUG> scratch = newscratch = malloc ( 2 * data -> set. buffer_size ) ; <END_BUG> if (! newscratch ) { failf ( data, "Failed   to   alloc   scratch   buffer!" ) ; return CURLE_OUT_OF_MEMORY ; }  } <START_BUG> eob_sent = smtp -> eob ; for ( i = 0, si = 0 ; i < nread ; i ++ ) { if ( SMTP_EOB [ smtp -> eob ] == data -> req. upload_fromhere [ i ] ) { smtp -> eob ++ ; if ( 2 == smtp -> eob || SMTP_EOB_LEN == smtp -> eob ) smtp -> trailing_crlf = TRUE ; else smtp -> trailing_crlf = FALSE ; } else if ( smtp -> eob ) { memcpy ( & scratch [ si ], & SMTP_EOB [ eob_sent ], smtp -> eob - eob_sent ) ; si += smtp -> eob - eob_sent ; if ( SMTP_EOB [ 0 ] == data -> req. upload_fromhere [ i ] ) smtp -> eob = 1 ; else smtp -> eob = 0 ; eob_sent = 0 ; smtp -> trailing_crlf = FALSE ; } if ( SMTP_EOB_FIND_LEN == smtp -> eob ) { memcpy ( & scratch [ si ], & SMTP_EOB_REPL [ eob_sent ], SMTP_EOB_REPL_LEN - eob_sent ) ; si += SMTP_EOB_REPL_LEN - eob_sent ; smtp -> eob = 0 ; eob_sent = 0 ; } else if (! smtp -> eob ) scratch [ si ++ ] = data -> req. upload_from<END_BUG>

Fix:
<S2SV_ModStart> ( 2 * UPLOAD_BUFSIZE <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; } } DEBUGASSERT ( UPLOAD_BUFSIZE >= nread ) ;
Buggy code:
 WORD32 ih264d_cavlc_4x4res_block_totalcoeff_11to16 ( UWORD32 u4_isdc, UWORD32 u4_total_coeff_trail_one, dec_bit_stream_t * ps_bitstrm ) { UWORD32 u4_total_zeroes ; WORD32 i ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 u4_bitstream_offset = ps_bitstrm -> u4_ofst ; UWORD32 u4_trailing_ones = u4_total_coeff_trail_one & 0xFFFF ; UWORD32 u4_total_coeff = u4_total_coeff_trail_one >> 16 ; <START_BUG> WORD16 i2_level_arr [ 16 ] ; <END_BUG> tu_sblk4x4_coeff_data_t * ps_tu_4x4 ; WORD16 * pi2_coeff_data ; dec_struct_t * ps_dec = ( dec_struct_t * ) ps_bitstrm -> pv_codec_handle ; ps_tu_4x4 = ( tu_sblk4x4_coeff_data_t * ) ps_dec -> pv_parse_tu_coeff_data ; ps_tu_4x4 -> u2_sig_coeff_map = 0 ; pi2_coeff_data = & ps_tu_4x4 -> ai2_level [ 0 ] ; i = u4_total_coeff - 1 ; if ( u4_trailing_ones ) { UWORD32 u4_signs, u4_cnt = u4_trailing_ones ; WORD16 ( * ppi2_trlone_lkup ) [ 3 ] = ( WORD16 ( * ) [ 3 ] ) gai2_ih264d_trailing_one_level ; WORD16 * pi2_trlone_lkup ; GETBITS ( u4_signs, u4_bitstream_offset, pu4_bitstrm_buf, u4_cnt ) ; pi2_trlone_lkup = ppi2_trlone_lkup [ ( 1 << u4_cnt ) - 2 + u4_signs ] ; while

Fix:
<S2SV_ModStart> 16 ; WORD16 ai2_level_arr [ 19 ] ; WORD16 * i2_level_arr = & ai2_level_arr [ 3 <S2SV_ModEnd> ] ; tu_sblk4x4_coeff_data_t
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8_set_reference ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_ref_frame_t * data = va_arg ( args, vpx_ref_frame_t * ) ; if ( data &&! ctx -> yv12_frame_buffers. use_frame_threads ) { vpx_ref_frame_t * frame = ( vpx_ref_frame_t * ) data ; YV12_BUFFER_CONFIG sd ; image2yuvconfig ( & frame -> img, & sd ) ; return vp8dx_set_reference ( ctx -> yv12_frame_buffers. pbi [ 0 ], frame -> frame_type, & sd ) ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static int PredictorEncodeTile ( TIFF * tif, uint8 * bp0, tmsize_t cc0, uint16 s ) { static const char module [ ] = "PredictorEncodeTile" ; TIFFPredictorState * sp = PredictorState ( tif ) ; uint8 * working_copy ; tmsize_t cc = cc0, rowsize ; unsigned char * bp ; int result_code ; assert ( sp!= NULL ) ; assert ( sp -> encodepfunc!= NULL ) ; assert ( sp -> encodetile!= NULL ) ; working_copy = ( uint8 * ) _TIFFmalloc ( cc0 ) ; if ( working_copy == NULL ) { TIFFErrorExt ( tif -> tif_clientdata, module, "Out   of   memory   allocating   " TIFF_SSIZE_FORMAT "   byte   temp   buffer.", cc0 ) ; return 0 ; } memcpy ( working_copy, bp0, cc0 ) ; bp = working_copy ; rowsize = sp -> rowsize ; assert ( rowsize > 0 ) ; <START_BUG> assert ( ( cc0 % rowsize ) == 0 ) ; <END_BUG> while ( cc > 0 ) { ( * sp -> encodepfunc ) ( tif, bp, rowsize ) ; cc -= rowsize ; bp += rowsize ; } result_code = ( * sp -> encodetile ) ( tif, working_copy, cc0, s ) ; _TIFFfree ( working_copy ) ; return result_code ; }

Fix:
<S2SV_ModStart> 0 ) ; if <S2SV_ModEnd> ( ( cc0 <S2SV_ModStart> % rowsize )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "PredictorEncodeTile", "%s", "(cc0%rowsize)!=0" ) ; return 0 ; } <S2SV_ModEnd> while ( cc
Buggy code:
 static int jas_iccgetsint32 ( jas_stream_t * in, jas_iccsint32_t * val ) { <START_BUG> ulonglong tmp ; <END_BUG> if ( jas_iccgetuint ( in, 4, & tmp ) ) return - 1 ;  * val = ( tmp & 0x80000000 )? ( - JAS_CAST ( longlong, ( ( ( ~ tmp ) & <START_BUG> <END_BUG> 0x7fffffff ) + 1 ) ) ) : JAS_CAST ( longlong, tmp ) ;  return 0 ; }

Fix:
<S2SV_ModStart> val ) { jas_ulonglong <S2SV_ModEnd> tmp ; if <S2SV_ModStart> - JAS_CAST ( jas_longlong <S2SV_ModEnd>, ( ( <S2SV_ModStart> : JAS_CAST ( jas_longlong <S2SV_ModEnd>, tmp )
Buggy code:
 static int http_receive_data ( HTTPContext * c ) { HTTPContext * c1 ; int len, loop_run = 0 ; while ( c -> chunked_encoding &&! c -> chunk_size && c -> buffer_end > c -> buffer_ptr ) { len = recv ( c -> fd, c -> buffer_ptr, 1, 0 ) ; if ( len < 0 ) { if ( ff_neterrno ( )!= AVERROR ( EAGAIN ) && ff_neterrno ( )!= AVERROR ( EINTR ) ) goto fail ; return 0 ; } else if ( len == 0 ) { goto fail ; } else if ( c -> buffer_ptr - c -> buffer >= 2 &&! memcmp ( c -> buffer_ptr - 1, "\\r\\n", 2 ) ) { c -> chunk_size = strtol ( c -> buffer, 0, 16 ) ; <START_BUG> if ( c -> chunk_size == 0 ) <END_BUG> goto fail ; c -> buffer_ptr = c -> buffer ; break ; } else if ( ++ loop_run > 10 ) goto fail ; else c -> buffer_ptr ++ ; } if ( c -> buffer_end > c -> buffer_ptr ) { len = recv ( c -> fd, c -> buffer_ptr, FFMIN ( c -> chunk_size, c -> buffer_end - c -> buffer_ptr ), 0 ) ; if ( len < 0 ) { if ( ff_neterrno ( )!= AVERROR ( EAGAIN ) && ff_neterrno ( )!= AVERROR ( EINTR ) ) goto fail ; } else if ( len == 0 ) goto fail ;  else { <START_BUG> c -> chunk_size -= len ; c -> buffer_ptr += len ; c -> data_count += len ; update_datarate ( & c -> datarate, c -> data_count ) ; } } if ( c -> buffer_ptr - c -> buffer >= 2 && c -> data_count > FFM_PACKET_SIZE ) { if ( c -> buffer [ 0 ]!= 'f' || c -> buffer [ 1 ]!='m' ) { http_log ( "Feed   stream   has   become   desynchronized   --   disconnecting\\n" ) ; goto fail ; } } if ( c -> buffer_ptr >= c -> buffer_end ) { FFServerStream *<END_BUG>

Fix:
<S2SV_ModStart> c -> chunk_size <= 0 ) { c -> chunk_size = 0 ; goto fail ; } <S2SV_ModEnd> c -> buffer_ptr <S2SV_ModStart> ; else { av_assert0 ( len <= c -> chunk_size ) ;
Buggy code:
 mod_ty PyAST_obj2mod ( PyObject * ast, PyArena * arena, int mode ) { mod_ty res ; PyObject * req_type [ 3 ] ; <START_BUG> char * req_name [ ] = { "Module", "Expression", "Interactive" } ; <END_BUG> int isinstance ; req_type [ 0 ] = ( PyObject * ) Module_type ; req_type [ 1 ] = ( PyObject * ) Expression_type ; req_type [ 2 ] = ( PyObject * ) Interactive_type ;  assert ( 0 <= mode && mode <= 2 ) ; <START_BUG> if (! init_types ( ) ) return NULL ; isinstance = PyObject_IsInstance ( ast, req_type [ mode ] ) ; if ( isinstance == - 1 ) return NULL ; if (! isinstance ) { PyErr_Format ( PyExc_TypeError, "expected   %s   node,   got   %.400s", req_name [ mode ], Py_TYPE ( ast ) -> tp_name ) ; return NULL ; } if ( obj2ast_mod ( ast, & res, arena )!= 0 ) return NULL ; else return res ; }<END_BUG>

Fix:
<S2SV_ModStart> "Expression", "Interactive", "FunctionType" <S2SV_ModStart> && mode <= 3 <S2SV_ModEnd> ) ; if
Buggy code:
 int effect_command ( effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, void * pCmdData, uint32_t * replySize, void * pReplyData ) { effect_context_t * context = ( effect_context_t * ) self ; int retsize ; int status = 0 ; pthread_mutex_lock ( & lock ) ; if (! effect_exists ( context ) ) { status = - ENOSYS ; goto exit ; } if ( context == NULL || context -> state == EFFECT_STATE_UNINITIALIZED ) { status = - ENOSYS ; goto exit ; } switch ( cmdCode ) { case EFFECT_CMD_INIT : if ( pReplyData == NULL || * replySize!= sizeof ( int ) ) { status = - EINVAL ; goto exit ; } if ( context -> ops. init ) * ( int * ) pReplyData = context -> ops. init ( context ) ; else * ( int * ) pReplyData = 0 ; break ; case EFFECT_CMD_SET_CONFIG : if ( pCmdData == NULL || cmdSize!= sizeof ( effect_config_t ) || pReplyData == NULL || * replySize!= sizeof ( int ) ) { status = - EINVAL ; goto exit ; } * ( int * ) pReplyData = set_config ( context, ( effect_config_t * ) pCmdData ) ; break ; case EFFECT_CMD_GET_CONFIG : if ( pReplyData == NULL || * replySize!= sizeof ( effect_config_t ) ) { status = - EINVAL ; goto exit ; } if (! context -> offload_enabled ) { status = - EINVAL ; goto exit ; } get_config ( context, ( effect_config_t * ) pReplyData ) ; break ; case EFFECT_CMD_RESET : if ( context -> ops. reset ) context -> ops. reset ( context ) ; break ; case EFFECT_CMD_ENABLE : if ( pReplyData == NULL || * replySize!= sizeof ( int ) ) { status = - EINVAL ; goto exit ; } if ( context -> state!= EFFECT_STATE_INITIALIZED ) { status = - ENOSYS ; goto exit ; } context -> state = EFFECT_STATE_ACTIVE ; if ( context -> ops.

Fix:
<S2SV_ModStart> ( uint16_t ) ) || ( ( effect_param_t * ) pCmdData ) -> psize > * replySize - sizeof ( effect_param_t
Buggy code:
 int cib_remote_msg ( gpointer data ) { <START_BUG> const char * value = NULL ; <END_BUG> xmlNode * command = NULL ;  cib_client_t * client = data ; <START_BUG> crm_trace ( "%s   callback", client -> encrypted? "secure" : "clear-text" ) ; <END_BUG> command = crm_recv_remote_msg ( client -> session, client -> encrypted ) ;  if ( command == NULL ) { return - 1 ; } <START_BUG> value = crm_element_name ( command ) ; <END_BUG> if ( safe_str_neq ( value, "cib_command" ) ) { crm_log_xml_trace ( command, "Bad   command:   " ) ; goto bail ; } if ( client -> name == NULL ) { value = crm_element_value ( command, F_CLIENTNAME ) ; if ( value == NULL ) { client -> name = strdup ( client -> id ) ; } else { client -> name = strdup ( value ) ; } } if ( client -> callback_id == NULL ) { value = crm_element_value ( command, F_CIB_CALLBACK_TOKEN ) ; if ( value!= NULL ) { client -> callback_id = strdup ( value ) ; crm_trace ( "Callback   channel   for   %s   is   %s", client -> id, client -> callback_id ) ; } else { client -> callback_id = strdup ( client -> id ) ; } } xml_remove_prop ( command, F_ORIG ) ; xml_remove_prop ( command, F_CIB_HOST ) ; xml_remove_prop ( command, F_CIB_GLOBAL_UPDATE ) ; crm_xml_add ( command, F_TYPE, T_CIB ) ; crm_xml_add ( command, F_CIB_CLIENTID, client -> id ) ; crm_xml_add ( command, F_CIB_CLIENTNAME, client -> name ) ; # if ENABLE_ACL  crm_xml_add ( command, F_CIB_USER, client -> user ) ; <START_BUG> # endif if ( crm_element_value ( command, F_CIB_CALLID ) == NULL ) { char * call_uuid = crm_generate_uuid ( ) ; <END_BUG> crm_

Fix:
<S2SV_ModStart> data ) { <S2SV_ModEnd> xmlNode * command <S2SV_ModStart> client = data ; int disconnected = 0 ; int timeout = client -> remote_auth? - 1 : 1000 <S2SV_ModStart> "clear-text" ) ; # ifdef HAVE_GNUTLS_GNUTLS_H if ( client -> encrypted && ( client -> handshake_complete == FALSE ) ) { int rc = 0 ; do { rc = gnutls_handshake ( * <S2SV_ModEnd> client -> session <S2SV_ModStart> client -> session ) ; if ( rc < 0 && rc!= GNUTLS_E_AGAIN ) { crm_err ( "Remote <S2SV_blank> cib <S2SV_blank> tls <S2SV_blank> handshake <S2SV_blank> failed" ) ; <S2SV_ModEnd> return - 1 <S2SV_ModStart> 1 ; } } while ( rc == GNUTLS_E_INTERRUPTED ) ; if ( rc == 0 ) { crm_debug ( "Remote <S2SV_blank> cib <S2SV_blank> tls <S2SV_blank> handshake <S2SV_blank> completed" ) ; client -> handshake_complete = TRUE ; if ( client -> remote_auth_timeout ) { g_source_remove ( client -> remote_auth_timeout ) ; } client -> remote_auth_timeout = g_timeout_add ( REMOTE_AUTH_TIMEOUT, remote_auth_timeout_cb,
Buggy code:
 bool f2fs_init_extent_tree ( struct inode * inode, struct f2fs_extent * i_ext ) { <START_BUG> struct f2fs_sb_info * sbi = F2FS_I_SB ( inode ) ; <END_BUG> struct extent_tree * et ; struct extent_node * en ; struct extent_info ei ; if (! f2fs_may_extent_tree ( inode ) ) { if ( i_ext && i_ext -> len ) { i_ext -> len = 0 ; return true ; } return false ; } et = __grab_extent_tree ( inode ) ;  if (! i_ext ||! i_ext -> len ) <START_BUG> return false ; get_extent_info ( & ei, i_ext ) ; write_lock ( & et -> lock ) ; if ( atomic_read ( & et -> node_cnt ) ) goto out ; en = __init_extent_tree ( sbi, et, & ei ) ; if ( en ) { spin_lock ( & sbi -> extent_lock ) ; list_add_tail ( & en -> list, & sbi -> extent_list ) ; spin_unlock ( & sbi -> extent_lock ) ; } out : write_unlock ( & et -> lock ) ; <END_BUG> return false ;  }

Fix:
<S2SV_ModStart> i_ext ) { bool ret = __f2fs_init_extent_tree ( inode, i_ext <S2SV_ModEnd> ) ; if <S2SV_ModStart> if (! F2FS_I ( inode ) -> extent_tree ) set_inode_flag ( inode, FI_NO_EXTENT <S2SV_ModEnd> ) ; return <S2SV_ModStart> ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 bool adapter_enable_disable ( ) { int error ; <START_BUG> CALL_AND_WAIT ( error = bt_interface -> enable ( ), adapter_state_changed ) ; <END_BUG> TASSERT ( error == BT_STATUS_SUCCESS, "Error   enabling   Bluetooth:   %d", error ) ; TASSERT ( adapter_get_state ( ) == BT_STATE_ON, "Adapter   did   not   turn   on." ) ; CALL_AND_WAIT ( error = bt_interface -> disable ( ), adapter_state_changed ) ; TASSERT ( error == BT_STATUS_SUCCESS, "Error   disabling   Bluetooth:   %d", error ) ; TASSERT ( adapter_get_state ( ) == BT_STATE_OFF, "Adapter   did   not   turn   off." ) ; return true ; }

Fix:
<S2SV_ModStart> -> enable ( false
Buggy code:
 <START_BUG> static struct desc_struct * get_desc ( unsigned short sel ) <END_BUG> { struct desc_ptr gdt_desc = { 0, 0 } ; unsigned long desc_base ; # ifdef CONFIG_MODIFY_LDT_SYSCALL if ( ( sel & SEGMENT_TI_MASK ) == SEGMENT_LDT ) {  struct desc_struct * desc = NULL ; <START_BUG> struct ldt_struct * ldt ; sel >>= 3 ; mutex_lock ( & current -> active_mm -> context. lock ) ; ldt = current -> active_mm -> context. ldt ; <END_BUG> if ( ldt && sel < ldt -> nr_entries )  <START_BUG> desc = & ldt -> entries [ sel ] ; <END_BUG> mutex_unlock ( & current -> active_mm -> context. lock ) ;  return desc ; <START_BUG> } # endif native_store_gdt ( & gdt_desc ) ; desc_base = sel & ~ ( SEGMENT_RPL_MASK | SEGMENT_TI_MASK ) ; if ( desc_base > gdt_desc. size ) <END_BUG> return NULL ;  return ( struct desc_struct * ) ( gdt_desc. address + desc_base ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static bool get_desc ( <S2SV_ModStart> struct desc_struct * out, <S2SV_ModEnd> unsigned short sel <S2SV_ModStart> SEGMENT_LDT ) { bool success = false <S2SV_ModEnd> ; struct ldt_struct <S2SV_ModStart> -> nr_entries ) { * out = <S2SV_ModEnd> ldt -> entries <S2SV_ModStart> sel ] ; success = true ; } <S2SV_ModStart> ) ; return success <S2SV_ModEnd> ; } # <S2SV_ModStart> size ) return false ; * out = * <S2SV_ModEnd> ( struct desc_struct <S2SV_ModStart> desc_base ) ; return true ;
Buggy code:
 int do_ssl3_write ( SSL * s, int type, const unsigned char * buf, unsigned int * pipelens, unsigned int numpipes, int create_empty_fragment ) { unsigned char * outbuf [ SSL_MAX_PIPELINES ], * plen [ SSL_MAX_PIPELINES ] ; SSL3_RECORD wr [ SSL_MAX_PIPELINES ] ; int i, mac_size, clear = 0 ; int prefix_len = 0 ; int eivlen ; size_t align = 0 ; SSL3_BUFFER * wb ; SSL_SESSION * sess ; unsigned int totlen = 0 ; unsigned int j ; for ( j = 0 ; j < numpipes ; j ++ ) totlen += pipelens [ j ] ; if ( RECORD_LAYER_write_pending ( & s -> rlayer ) ) return ( ssl3_write_pending ( s, type, buf, totlen ) ) ; if ( s -> s3 -> alert_dispatch ) { i = s -> method -> ssl_dispatch_alert ( s ) ; if ( i <= 0 ) return ( i ) ; } if ( s -> rlayer. numwpipes < numpipes ) if (! ssl3_setup_write_buffer ( s, numpipes, 0 ) ) return - 1 ; if ( totlen == 0 &&! create_empty_fragment ) return 0 ; sess = s -> session ; if ( ( sess == NULL ) || ( s -> enc_write_ctx == NULL ) || ( EVP_MD_CTX_md ( s -> write_hash ) == NULL ) ) { clear = s -> enc_write_ctx? 0 : 1 ; mac_size = 0 ; } else { mac_size = EVP_MD_CTX_size ( s -> write_hash ) ; if ( mac_size < 0 ) goto err ; } if (! clear &&! create_empty_fragment &&! s -> s3 -> empty_fragment_done ) { if ( s -> s3 -> need_empty_fragments && type == SSL3_RT_APPLICATION_DATA ) { unsigned int tmppipelen = 0 ; prefix_len = do_ssl3_write ( s, type, buf, & tmppipelen, 1, 1 ) ; if ( prefix_len <= 0 ) goto err ; if ( prefix_len >

Fix:
<S2SV_ModStart> if (! SSL_WRITE_ETM <S2SV_ModEnd> ( s ) <S2SV_ModStart> { if ( SSL_WRITE_ETM <S2SV_ModEnd> ( s )
Buggy code:
 static bool cgroupfs_mount_cgroup ( void * hdata, const char * root, int type ) { size_t bufsz = strlen ( root ) + sizeof ( "//sys//fs//cgroup" ) ; char * path = NULL ; char * * parts = NULL ; char * dirname = NULL ; char * abs_path = NULL ; char * abs_path2 = NULL ; struct cgfs_data * cgfs_d ; struct cgroup_process_info * info, * base_info ; int r, saved_errno = 0 ; cgfs_d = hdata ; if (! cgfs_d ) return false ; base_info = cgfs_d -> info ; if ( type == LXC_AUTO_CGROUP_FULL_NOSPEC ) type = LXC_AUTO_CGROUP_FULL_MIXED ; else if ( type == LXC_AUTO_CGROUP_NOSPEC ) type = LXC_AUTO_CGROUP_MIXED ; if ( type < LXC_AUTO_CGROUP_RO || type > LXC_AUTO_CGROUP_FULL_MIXED ) { ERROR ( "could   not   mount   cgroups   into   container:   invalid   type   specified   internally" ) ; errno = EINVAL ; return false ; } path = calloc ( 1, bufsz ) ; if (! path ) return false ; snprintf ( path, bufsz, "%s//sys//fs//cgroup", root ) ; <START_BUG> r = mount ( "cgroup_root", path, "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_RELATIME, "size=10240k,mode=755" ) ; <END_BUG> if ( r < 0 ) { SYSERROR ( "could   not   mount   tmpfs   to   //sys//fs//cgroup   in   the   container" ) ; return false ; } for ( info = base_info ; info ; info = info -> next ) { size_t subsystem_count, i ; struct cgroup_mount_point * mp = info -> designated_mount_point ; if (! mp ) mp = lxc_cgroup_find_mount_point ( info -> hierarchy, info -> cgroup_path, true ) ; if (! mp ) {

Fix:
<S2SV_ModStart> ; r = safe_mount <S2SV_ModEnd> ( "cgroup_root", <S2SV_ModStart> MS_RELATIME, "size=10240k,mode=755", root
Buggy code:
 int main ( int argc, char * * argv ) { FILE * infile = NULL ; <START_BUG> vpx_codec_ctx_t codec = { 0 } ; <END_BUG>  vpx_codec_enc_cfg_t cfg = { 0 } ; <START_BUG> int frame_count = 0 ; <END_BUG> vpx_image_t raw = { 0 } ;  vpx_codec_err_t res ; <START_BUG> VpxVideoInfo info = { 0 } ; <END_BUG> VpxVideoWriter * writer = NULL ; const VpxInterface * encoder = NULL ; const int fps = 2 ; const double bits_per_pixel_per_frame = 0.067 ; exec_name = argv [ 0 ] ; if ( argc!= 6 ) die ( "Invalid   number   of   arguments" ) ;  encoder = get_vpx_encoder_by_name ( argv [ 1 ] ) ; <START_BUG> <END_BUG> if (! encoder )  <START_BUG> die ( "Unsupported   codec." ) ; <END_BUG> info. codec_fourcc = encoder -> fourcc ; info. frame_width = strtol ( argv [ 2 ], NULL, 0 ) ; info. frame_height = strtol ( argv [ 3 ], NULL, 0 ) ; info. time_base. numerator = 1 ; info. time_base. denominator = fps ; if ( info. frame_width <= 0 || info. frame_height <= 0 || ( info. frame_width % 2 )!= 0 || ( info. frame_height % 2 )!= 0 ) { die ( "Invalid   frame   size:   %dx%d", info. frame_width, info. frame_height ) ; } if (! vpx_img_alloc ( & raw, VPX_IMG_FMT_I420, info. frame_width, info. frame_height, 1 ) ) { die ( "Failed   to   allocate   image." ) ; }  printf ( "Using   %s\\n", vpx_codec_iface_name ( encoder -> interface ( ) ) ) ; <START_BUG> <END_BUG> res = vpx_codec_enc_config_default ( encoder -> interface ( ), & cfg, 0 ) ;  if ( res ) die_codec ( & codec, "Failed   to   get   default   codec   config." ) ; cfg. g_w = info. frame_width ; cfg. g_

Fix:
<S2SV_ModStart> ; vpx_codec_ctx_t codec <S2SV_ModEnd> ; vpx_codec_enc_cfg_t cfg <S2SV_ModStart> ; vpx_codec_enc_cfg_t cfg <S2SV_ModEnd> ; int frame_count <S2SV_ModStart> ; vpx_image_t raw <S2SV_ModEnd> ; vpx_codec_err_t res <S2SV_ModStart> ; VpxVideoInfo info <S2SV_ModEnd> ; VpxVideoWriter * <S2SV_ModStart> "Invalid <S2SV_blank> number <S2SV_blank> of <S2SV_blank> arguments" ) ; memset ( & info, 0, sizeof ( info ) ) ; <S2SV_ModStart> ; if ( encoder == NULL ) { <S2SV_ModEnd> die ( "Unsupported <S2SV_blank> codec." <S2SV_ModStart> die ( "Unsupported <S2SV_blank> codec." ) ; } assert ( encoder!= NULL <S2SV_ModStart> ( encoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart> ( encoder -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart>, encoder -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart> ) ; } while ( <S2SV_ModStart>, writer ) ) { } <S2SV_ModEnd> printf ( "\\n"
Buggy code:
 static void fifo_open ( notify_fifo_t * fifo, int ( * script_exit ) ( thread_t * ), const char * type ) { int ret ; int sav_errno ; if ( fifo -> name ) { sav_errno = 0 ; if (! ( ret = mkfifo ( fifo -> name, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH ) ) ) fifo -> created_fifo = true ; else { sav_errno = errno ; if ( sav_errno!= EEXIST ) log_message ( LOG_INFO, "Unable   to   create   %snotify   fifo   %s", type, fifo -> name ) ; } if (! sav_errno || sav_errno == EEXIST ) { if ( fifo -> script ) notify_fifo_exec ( master, script_exit, fifo, fifo -> script ) ; <START_BUG> if ( ( fifo -> fd = open ( fifo -> name, O_RDWR | O_CLOEXEC | O_NONBLOCK ) ) == - 1 ) { <END_BUG> log_message ( LOG_INFO, "Unable   to   open   %snotify   fifo   %s   -   errno   %d", type, fifo -> name, errno ) ; if ( fifo -> created_fifo ) { unlink ( fifo -> name ) ; fifo -> created_fifo = false ; } } } if ( fifo -> fd == - 1 ) { FREE ( fifo -> name ) ; fifo -> name = NULL ; } } }

Fix:
<S2SV_ModStart> O_CLOEXEC | O_NONBLOCK | O_NOFOLLOW
Buggy code:
 <START_BUG> static void count_segs ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG>  MODE_INFO * * mi_8x8, <START_BUG> int * no_pred_segcounts, int ( * temporal_predictor_count ) [ 2 ], int * t_unpred_seg_counts, int bw, int bh, int mi_row, int mi_col ) { <END_BUG> VP9_COMMON * const cm = & cpi -> common ;  MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; int segment_id ; if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; <START_BUG> xd -> mi = mi_8x8 ; <END_BUG> segment_id = xd -> mi [ 0 ] -> mbmi. segment_id ; set_mi_row_col ( xd, tile, mi_row, bh, mi_col, bw, cm -> mi_rows, cm -> mi_cols ) ; no_pred_segcounts [ segment_id ] ++ ; if ( cm -> frame_type!= KEY_FRAME ) {  const BLOCK_SIZE bsize = mi_8x8 [ 0 ] -> mbmi. sb_type ; <START_BUG> <END_BUG> const int pred_segment_id = vp9_get_segment_id ( cm, cm -> last_frame_seg_map,  bsize, mi_row, mi_col ) ; const int pred_flag = pred_segment_id == segment_id ; const int pred_context = vp9_get_pred_context_seg_id ( xd ) ; xd -> mi [ 0 ] -> mbmi. seg_id_predicted = pred_flag ; temporal_predictor_count [ pred_context ] [ pred_flag ] ++ ; if (! pred_flag ) t_unpred_seg_counts [ segment_id ] ++ ; } }

Fix:
<S2SV_ModStart> void count_segs ( const VP9_COMMON * cm, MACROBLOCKD * xd, <S2SV_ModEnd> const TileInfo * <S2SV_ModStart> const TileInfo * <S2SV_ModEnd> tile, MODE_INFO <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd>, int * <S2SV_ModStart> mi_col ) { <S2SV_ModEnd> int segment_id ; <S2SV_ModStart> -> mi = mi <S2SV_ModEnd> ; segment_id = <S2SV_ModStart> BLOCK_SIZE bsize = xd -> mi <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> int pred_segment_id = get_segment_id <S2SV_ModEnd> ( cm,
Buggy code:
 static int fpDiff ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; uint32 bps = tif -> tif_dir. td_bitspersample // 8 ; tmsize_t wc = cc // bps ; tmsize_t count ; uint8 * cp = ( uint8 * ) cp0 ; <START_BUG> uint8 * tmp = ( uint8 * ) _TIFFmalloc ( cc ) ; <END_BUG> if ( ( cc % ( bps * stride ) )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "fpDiff", "%s", "(cc%(bps*stride))!=0" ) ; return 0 ; }  if (! tmp ) <START_BUG> return 0 ; _TIFFmemcpy ( tmp, cp0, cc ) ; for ( count = 0 ; count < wc ; count ++ ) { uint32 byte ; for ( byte = 0 ; byte < bps ; byte ++ ) { # if WORDS_BIGENDIAN cp [ byte * wc + count ] = tmp [ bps * count + byte ] ; # else cp [ ( bps - byte - 1 ) * wc + count ] = tmp [ bps * count + byte ] ; # endif } } _TIFFfree ( tmp ) ; cp = ( uint8 * ) cp0 ; cp += cc - stride - 1 ; for ( count = cc ; count > stride ; count -= stride ) REPEAT4 ( stride, cp [ stride ] = ( unsigned char ) ( ( cp [ stride ] - cp [ 0 ] ) & 0xff ) ; cp -- ) return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> uint8 * tmp <S2SV_ModEnd> ; if ( <S2SV_ModStart> 0 ; } tmp = ( uint8 * ) _TIFFmalloc ( cc ) ;
Buggy code:
 <START_BUG> void fdct8_sse2 ( __m128i * in ) { <END_BUG>  const __m128i k__cospi_p16_p16 = _mm_set1_epi16 ( cospi_16_64 ) ; <START_BUG> const __m128i k__cospi_p16_m16 = pair_set_epi16 ( cospi_16_64, - cospi_16_64 ) ; const __m128i k__cospi_p24_p08 = pair_set_epi16 ( cospi_24_64, cospi_8_64 ) ; const __m128i k__cospi_m08_p24 = pair_set_epi16 ( - cospi_8_64, cospi_24_64 ) ; const __m128i k__cospi_p28_p04 = pair_set_epi16 ( cospi_28_64, cospi_4_64 ) ; const __m128i k__cospi_m04_p28 = pair_set_epi16 ( - cospi_4_64, cospi_28_64 ) ; const __m128i k__cospi_p12_p20 = pair_set_epi16 ( cospi_12_64, cospi_20_64 ) ; const __m128i k__cospi_m20_p12 = pair_set_epi16 ( - cospi_20_64, cospi_12_64 ) ; const __m128i k__DCT_CONST_ROUNDING = _mm_set1_epi32 ( DCT_CONST_ROUNDING ) ; __m128i u0, u1, u2, u3, u4, u5, u6, u7 ; __m128i v0, v1, v2, v3, v4, v5, v6, v7 ; __m128i s0, s1, s2, s3, s4, s5, s6, s7 ; s0 = _mm_add_epi16 ( in [ 0 ], in [ 7 ] ) ; s1 = _mm_add_epi16 ( in [ 1 ], in [ 6 ] ) ; s2 = _mm_add_epi16 ( in [ 2 ], in [ 5 ] )<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t )
Buggy code:
 static int blosc_c ( struct thread_context * thread_context, int32_t bsize, <START_BUG> int32_t leftoverblock, int32_t ntbytes, int32_t maxbytes, <END_BUG> const uint8_t * src, const int32_t offset, uint8_t * dest, uint8_t * tmp, uint8_t * tmp2 ) { blosc2_context * context = thread_context -> parent_context ; int dont_split = ( context -> header_flags & 0x10 ) >> 4 ; int dict_training = context -> use_dict && context -> dict_cdict == NULL ; int32_t j, neblock, nstreams ; int32_t cbytes ; int32_t ctbytes = 0 ; int64_t maxout ; int32_t typesize = context -> typesize ; const char * compname ; int accel ; const uint8_t * _src ; uint8_t * _tmp = tmp, * _tmp2 = tmp2 ; uint8_t * _tmp3 = thread_context -> tmp4 ; int last_filter_index = last_filter ( context -> filters, 'c' ) ; bool memcpyed = context -> header_flags & ( uint8_t ) BLOSC_MEMCPYED ; if ( last_filter_index >= 0 || context -> prefilter!= NULL ) { if ( memcpyed && context -> prefilter!= NULL ) { _src = pipeline_c ( thread_context, bsize, src, offset, dest, _tmp2, _tmp3 ) ; if ( _src == NULL ) { return - 9 ; } return bsize ; } _src = pipeline_c ( thread_context, bsize, src, offset, _tmp, _tmp2, _tmp3 ) ; if ( _src == NULL ) { return - 9 ; } } else { _src = src + offset ; } assert ( context -> clevel > 0 ) ; accel = get_accel ( context ) ; if (! dont_split &&! leftoverblock &&! dict_training ) { nstreams = ( int32_t ) typesize ; } else { nstreams = 1 ; } neblock = bsize // nstreams ; for ( j = 0 ; j < nstreams ; j ++ ) { if (!

Fix:
<S2SV_ModStart> ntbytes, int32_t destsize <S2SV_ModEnd>, const uint8_t <S2SV_ModStart> neblock ] ; if ( ntbytes > destsize ) { return - 1 ; } <S2SV_ModStart> + maxout > destsize <S2SV_ModEnd> ) { maxout <S2SV_ModStart> ( int64_t ) destsize <S2SV_ModEnd> - ( int64_t <S2SV_ModStart> neblock ) > destsize <S2SV_ModEnd> ) { return
Buggy code:
 static void voutf ( struct GlobalConfig * config, const char * prefix, const char * fmt, va_list ap ) { size_t width = ( 79 - strlen ( prefix ) ) ; if (! config -> mute ) { size_t len ; char * ptr ; char * print_buffer ; print_buffer = curlx_mvaprintf ( fmt, ap ) ; if (! print_buffer ) return ; len = strlen ( print_buffer ) ; ptr = print_buffer ; while ( len > 0 ) { fputs ( prefix, config -> errors ) ; if ( len > width ) { size_t cut = width - 1 ; while (! ISSPACE ( ptr [ cut ] ) && cut ) { cut -- ; } if ( 0 == cut ) cut = width - 1 ; ( void ) fwrite ( ptr, cut + 1, 1, config -> errors ) ; fputs ( "\\n", config -> errors ) ; ptr += cut + 1 ; <START_BUG> len -= cut ; <END_BUG> } else { fputs ( ptr, config -> errors ) ; len = 0 ; } } curl_free ( print_buffer ) ; } }

Fix:
<S2SV_ModStart> len -= cut + 1
Buggy code:
 static void write_modes ( VP9_COMP * cpi, const TileInfo * const tile, <START_BUG> vp9_writer * w, TOKENEXTRA * * tok, TOKENEXTRA * tok_end ) { <END_BUG>  int mi_row, mi_col ; <START_BUG> for ( mi_row = tile -> mi_row_start ; mi_row < tile -> mi_row_end ; mi_row += MI_BLOCK_SIZE ) { <END_BUG> vp9_zero ( cpi -> mb. e_mbd. left_seg_context ) ;  for ( mi_col = tile -> mi_col_start ; mi_col < tile -> mi_col_end ; mi_col += MI_BLOCK_SIZE ) write_modes_sb ( cpi, tile, w, tok, tok_end, mi_row, mi_col, BLOCK_64X64 ) ; } }

Fix:
<S2SV_ModStart> const tile, vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> * tok, const TOKENEXTRA * const <S2SV_ModEnd> tok_end ) { <S2SV_ModStart> tok_end ) { const VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & cpi -> td. mb. e_mbd ; <S2SV_ModStart> mi_row, mi_col ; set_partition_probs ( cm, xd ) <S2SV_ModStart> { vp9_zero ( xd -> <S2SV_ModEnd> left_seg_context ) ;
Buggy code:
 static int snd_compr_allocate_buffer ( struct snd_compr_stream * stream, struct snd_compr_params * params ) { unsigned int buffer_size ; <START_BUG> void * buffer ; <END_BUG> buffer_size = params -> buffer. fragment_size * params -> buffer. fragments ; if ( stream -> ops -> copy ) { buffer = NULL ; } else { buffer = kmalloc ( buffer_size, GFP_KERNEL ) ; if (! buffer ) return - ENOMEM ; } stream -> runtime -> fragment_size = params -> buffer. fragment_size ; stream -> runtime -> fragments = params -> buffer. fragments ; stream -> runtime -> buffer = buffer ; stream -> runtime -> buffer_size = buffer_size ; return 0 ; }

Fix:
<S2SV_ModStart> void * buffer ; if ( params -> buffer. fragment_size == 0 || params -> buffer. fragments > SIZE_MAX // params -> buffer. fragment_size ) return - EINVAL
Buggy code:
 int ParseWave64HeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t total_samples = 0, infilesize ; Wave64ChunkHeader chunk_header ; Wave64FileHeader filehdr ; WaveHeader WaveHeader ; int format_chunk = 0 ; <START_BUG> uint32_t bcount ; <END_BUG> infilesize = DoGetFileSize ( infile ) ; memcpy ( & filehdr, fourcc, 4 ) ; if (! DoReadFile ( infile, ( ( char * ) & filehdr ) + 4, sizeof ( Wave64FileHeader ) - 4, & bcount ) || bcount!= sizeof ( Wave64FileHeader ) - 4 || memcmp ( filehdr. ckID, riff_guid, sizeof ( riff_guid ) ) || memcmp ( filehdr. formType, wave_guid, sizeof ( wave_guid ) ) ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & filehdr, sizeof ( filehdr ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackLittleEndianToNative ( & filehdr, Wave64ChunkHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && filehdr. ckSize && filehdr. ckSize + 1 && filehdr. ckSize!= infilesize ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } # endif while ( 1 ) { if (! DoReadFile ( infile, & chunk_header, sizeof ( Wave64ChunkHeader ), & bcount ) || bcount!= sizeof ( Wave64ChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .W64   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! (

Fix:
<S2SV_ModStart> ; uint32_t bcount ; CLEAR ( WaveHeader )