nus-yam/ex-repair huggingface dataset:
Buggy code:
 asmlinkage long sys_oabi_semtimedop ( int semid, struct oabi_sembuf __user * tsops, unsigned nsops, const struct timespec __user * timeout ) { struct sembuf * sops ; struct timespec local_timeout ; long err ; int i ; <START_BUG> if ( nsops < 1 ) <END_BUG> return - EINVAL ; sops = kmalloc ( sizeof ( * sops ) * nsops, GFP_KERNEL ) ; if (! sops ) return - ENOMEM ; err = 0 ; for ( i = 0 ; i < nsops ; i ++ ) { __get_user_error ( sops [ i ]. sem_num, & tsops -> sem_num, err ) ; __get_user_error ( sops [ i ]. sem_op, & tsops -> sem_op, err ) ; __get_user_error ( sops [ i ]. sem_flg, & tsops -> sem_flg, err ) ; tsops ++ ; } if ( timeout ) { err |= copy_from_user ( & local_timeout, timeout, sizeof ( * timeout ) ) ; timeout = & local_timeout ; } if ( err ) { err = - EFAULT ; } else { mm_segment_t fs = get_fs ( ) ; set_fs ( KERNEL_DS ) ; err = sys_semtimedop ( semid, sops, nsops, timeout ) ; set_fs ( fs ) ; } kfree ( sops ) ; return err ; }

Fix:
<S2SV_ModStart> nsops < 1 || nsops > SEMOPM
Buggy code:
 void enc28j60EventHandler ( NetInterface * interface ) { error_t error ; uint16_t status ; uint16_t value ; <START_BUG> status = enc28j60ReadReg ( interface, ENC28J60_REG_EIR ) ; <END_BUG>  if ( ( status & EIR_LINKIF )!= 0 ) <START_BUG> { <END_BUG> enc28j60ReadPhyReg ( interface, ENC28J60_PHY_REG_PHIR ) ;  <START_BUG> enc28j60ClearBit ( interface, ENC28J60_REG_EIR, EIR_LINKIF ) ; <END_BUG>  value = enc28j60ReadPhyReg ( interface, ENC28J60_PHY_REG_PHSTAT2 ) ; <START_BUG> <END_BUG> if ( ( value & PHSTAT2_LSTAT )!= 0 )  { interface -> linkSpeed = NIC_LINK_SPEED_10MBPS ; # if ( ENC28J60_FULL_DUPLEX_SUPPORT == ENABLED ) interface -> duplexMode = NIC_FULL_DUPLEX_MODE ; # else interface -> duplexMode = NIC_HALF_DUPLEX_MODE ; # endif interface -> linkState = TRUE ; } else { interface -> linkState = FALSE ; } nicNotifyLinkChange ( interface ) ; } <START_BUG> if ( ( status & EIR_PKTIF )!= 0 ) <END_BUG> {  enc28j60ClearBit ( interface, ENC28J60_REG_EIR, EIR_PKTIF ) ; <START_BUG> do { error = enc28j60ReceivePacket ( interface ) ; } while ( error!= ERROR_BUFFER_EMPTY ) ; } <END_BUG> enc28j60SetBit ( interface, ENC28J60_REG_EIE, EIE_LINKIE | EIE_PKTIE ) ;  }

Fix:
<S2SV_ModStart> ( interface, ENC28J60_EIR <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( status & ENC28J60_EIR_LINKIF <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC28J60_PHIR <S2SV_ModEnd> ) ; enc28j60ClearBit <S2SV_ModStart> ( interface, ENC28J60_EIR, ENC28J60_EIR_LINKIF <S2SV_ModEnd> ) ; value <S2SV_ModStart> ( interface, ENC28J60_PHSTAT2 <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( value & ENC28J60_PHSTAT2_LSTAT <S2SV_ModEnd> )!= 0 <S2SV_ModStart> } if ( enc28j60ReadReg ( interface, ENC28J60_EPKTCNT <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, ENC28J60_EIR, ENC28J60_EIR_PKTIF <S2SV_ModEnd> ) ; do <S2SV_ModStart> ( interface, ENC28J60_EIE, ENC28J60_EIE_LINKIE | ENC28J60_EIE_PKTIE <S2SV_ModEnd> ) ; }
Buggy code:
 error_t tcpSendResetSegment ( NetInterface * interface, IpPseudoHeader * pseudoHeader, TcpHeader * segment, size_t length ) { error_t error ; size_t offset ; uint8_t flags ; uint32_t seqNum ; uint32_t ackNum ; NetBuffer * buffer ; TcpHeader * segment2 ; IpPseudoHeader pseudoHeader2 ; NetTxAncillary ancillary ; if ( segment -> flags & TCP_FLAG_ACK ) { flags = TCP_FLAG_RST ; seqNum = segment -> ackNum ; ackNum = 0 ; } else { flags = TCP_FLAG_RST | TCP_FLAG_ACK ; seqNum = 0 ; ackNum = segment -> seqNum + length ; if ( segment -> flags & TCP_FLAG_SYN ) <START_BUG> ackNum ++ ; <END_BUG>  if ( segment -> flags & TCP_FLAG_FIN ) <START_BUG> <END_BUG> ackNum ++ ;  } buffer = ipAllocBuffer ( sizeof ( TcpHeader ), & offset ) ; if ( buffer == NULL ) return ERROR_OUT_OF_MEMORY ; segment2 = netBufferAt ( buffer, offset ) ; segment2 -> srcPort = htons ( segment -> destPort ) ; segment2 -> destPort = htons ( segment -> srcPort ) ; segment2 -> seqNum = htonl ( seqNum ) ; segment2 -> ackNum = htonl ( ackNum ) ; segment2 -> reserved1 = 0 ; segment2 -> dataOffset = 5 ; segment2 -> flags = flags ; segment2 -> reserved2 = 0 ; segment2 -> window = 0 ; segment2 -> checksum = 0 ; segment2 -> urgentPointer = 0 ; # if ( IPV4_SUPPORT == ENABLED ) if ( pseudoHeader -> length == sizeof ( Ipv4PseudoHeader ) ) { pseudoHeader2. length = sizeof ( Ipv4PseudoHeader ) ; pseudoHeader2. ipv4Data. srcAddr = pseudoHeader -> ipv4Data. destAddr ; pseudoHeader2. ipv4Data. destAddr = pseudoHeader -> ipv4Data. srcAddr ; pseudoHeader2. ipv4Data. reserved = 0 ; pseudoHeader2. ipv4Data. protocol = IPV4_PROTOCOL_TCP ; pseudoHeader2. ipv4Data. length = HTONS ( sizeof ( TcpHeader ) ) ; segment2 -> checksum = ipCalcUpperLayerChecksumEx ( & pseudoHeader2.

Fix:
<S2SV_ModStart> & TCP_FLAG_SYN ) { <S2SV_ModStart> ackNum ++ ; } <S2SV_ModStart> & TCP_FLAG_FIN ) { <S2SV_ModStart> ackNum ++ ; }
Buggy code:
 void vp9_set_contexts ( const MACROBLOCKD * xd, struct macroblockd_plane * pd, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, int has_eob, int aoff, int loff ) { ENTROPY_CONTEXT * const a = pd -> above_context + aoff ; ENTROPY_CONTEXT * const l = pd -> left_context + loff ; const int tx_size_in_blocks = 1 << tx_size ; if ( has_eob && xd -> mb_to_right_edge < 0 ) { int i ; const int blocks_wide = num_4x4_blocks_wide_lookup [ plane_bsize ] + ( xd -> mb_to_right_edge >> ( 5 + pd -> subsampling_x ) ) ; int above_contexts = tx_size_in_blocks ; if ( above_contexts + aoff > blocks_wide ) above_contexts = blocks_wide - aoff ; for ( i = 0 ; i < above_contexts ; ++ i ) a [ i ] = has_eob ; for ( i = above_contexts ; i < tx_size_in_blocks ; ++ i ) a [ i ] = 0 ; } else { <START_BUG> vpx_memset ( a, has_eob, sizeof ( ENTROPY_CONTEXT ) * tx_size_in_blocks ) ; <END_BUG> } if ( has_eob && xd -> mb_to_bottom_edge < 0 ) { int i ; const int blocks_high = num_4x4_blocks_high_lookup [ plane_bsize ] + ( xd -> mb_to_bottom_edge >> ( 5 + pd -> subsampling_y ) ) ; int left_contexts = tx_size_in_blocks ; if ( left_contexts + loff > blocks_high ) left_contexts = blocks_high - loff ; for ( i = 0 ; i < left_contexts ; ++ i ) l [ i ] = has_eob ; for ( i = left_contexts ; i < tx_size_in_blocks ; ++ i ) l [ i ] = 0 ; } else {  vpx_memset ( l, has_eob, sizeof ( ENTROPY_CONTEXT ) * tx_size_in_blocks ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> } else { memset <S2SV_ModEnd> ( a, <S2SV_ModStart> } else { memset <S2SV_ModEnd> ( l,
Buggy code:
 static void y4m_convert_mono_420jpeg ( y4m_input * _y4m, unsigned char * _dst, unsigned char * _aux ) { <START_BUG> int c_sz ; <END_BUG> _dst += _y4m -> pic_w * _y4m -> pic_h ; c_sz = ( ( _y4m -> pic_w + _y4m -> dst_c_dec_h - 1 ) // _y4m -> dst_c_dec_h ) * ( ( _y4m -> pic_h + _y4m -> dst_c_dec_v - 1 ) // _y4m -> dst_c_dec_v ) ; memset ( _dst, 128, c_sz * 2 ) ; }

Fix:
<S2SV_ModStart> { int c_sz ; ( void ) _aux
Buggy code:
 static bool blk_kick_flush ( struct request_queue * q, struct blk_flush_queue * fq ) { struct list_head * pending = & fq -> flush_queue [ fq -> flush_pending_idx ] ; struct request * first_rq = list_first_entry ( pending, struct request, flush. list ) ; struct request * flush_rq = fq -> flush_rq ; if ( fq -> flush_pending_idx!= fq -> flush_running_idx || list_empty ( pending ) ) return false ; if (! list_empty ( & fq -> flush_data_in_flight ) && time_before ( jiffies, fq -> flush_pending_since + FLUSH_PENDING_TIMEOUT ) ) return false ; fq -> flush_pending_idx ^= 1 ; blk_rq_init ( q, flush_rq ) ; if ( q -> mq_ops ) { <START_BUG> flush_rq -> mq_ctx = first_rq -> mq_ctx ; <END_BUG>  flush_rq -> tag = first_rq -> tag ; <START_BUG> } flush_rq -> cmd_type = REQ_TYPE_FS ; flush_rq -> cmd_flags = WRITE_FLUSH | REQ_FLUSH_SEQ ; flush_rq -> rq_disk = first_rq -> rq_disk ; flush_rq -> end_io = flush_end_io ; return blk_flush_queue_rq ( flush_rq, false ) ; }<END_BUG>

Fix:
<S2SV_ModStart> mq_ops ) { struct blk_mq_hw_ctx * hctx ; <S2SV_ModStart> first_rq -> tag ; fq -> orig_rq = first_rq ; hctx = q -> mq_ops -> map_queue ( q, first_rq -> mq_ctx -> cpu ) ; blk_mq_tag_set_rq ( hctx, first_rq -> tag, flush_rq )
Buggy code:
 static void <START_BUG> sraSpanRemove ( sraSpan * span ) { <END_BUG> span -> _prev -> _next = span -> _next ; span -> _next -> _prev = span -> _prev ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> ( sraSpan * span ) { if ( <S2SV_ModStart> _prev ; } }
Buggy code:
 chrand_ret * chrand_principal3_2_svc ( chrand3_arg * arg, struct svc_req * rqstp ) { static chrand_ret ret ; krb5_keyblock * k ; int nkeys ; char * prime_arg, * funcname ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_chrand_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; funcname = "kadm5_randkey_principal" ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if ( cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) ) { ret. code = randkey_principal_wrapper_3 ( ( void * ) handle, arg -> princ, arg -> keepold, arg -> n_ks_tuple, arg -> ks_tuple, & k, & nkeys ) ; } else if (! ( CHANGEPW_SERVICE ( rqstp ) ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_CHANGEPW, arg -> princ, NULL ) ) { ret. code = kadm5_randkey_principal_3 ( ( void * ) handle, arg -> princ, arg -> keepold, arg -> n_ks_tuple, arg -> ks_tuple, & k, & nkeys ) ; } else { log_unauth ( funcname, prime_arg, & client_name, & service_

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static vpx_codec_err_t decoder_init ( vpx_codec_ctx_t * ctx, vpx_codec_priv_enc_mr_cfg_t * data ) { <START_BUG> if (! ctx -> priv ) { <END_BUG>  vpx_codec_alg_priv_t * alg_priv = vpx_memalign ( 32, sizeof ( * alg_priv ) ) ; <START_BUG> <END_BUG> if ( alg_priv == NULL )  <START_BUG> return VPX_CODEC_MEM_ERROR ; <END_BUG> vp9_zero ( * alg_priv ) ;  ctx -> priv = ( vpx_codec_priv_t * ) alg_priv ; <START_BUG> ctx -> priv -> sz = sizeof ( * ctx -> priv ) ; ctx -> priv -> iface = ctx -> iface ; ctx -> priv -> alg_priv = alg_priv ; ctx -> priv -> alg_priv -> si. sz = sizeof ( ctx -> priv -> alg_priv -> si ) ; ctx -> priv -> init_flags = ctx -> init_flags ; <END_BUG> if ( ctx -> config. dec ) {  <START_BUG> ctx -> priv -> alg_priv -> cfg = * ctx -> config. dec ; <END_BUG>  ctx -> config. dec = & ctx -> priv -> alg_priv -> cfg ; <START_BUG> } } return VPX_CODEC_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> data ) { ( void ) data ; <S2SV_ModStart> { vpx_codec_alg_priv_t * const priv = vpx_calloc ( 1 <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> sizeof ( * priv <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ; if ( priv <S2SV_ModEnd> == NULL ) <S2SV_ModStart> ) return VPX_CODEC_MEM_ERROR <S2SV_ModEnd> ; ctx -> <S2SV_ModStart> vpx_codec_priv_t * ) priv <S2SV_ModEnd> ; ctx -> <S2SV_ModStart> -> init_flags ; priv -> si. sz = sizeof ( priv -> si ) ; priv -> flushed = 0 ; priv -> frame_parallel_decode = ( ctx -> config. dec && ( ctx -> config. dec -> threads > 1 ) && ( ctx -> init_flags & VPX_CODEC_USE_FRAME_THREADING ) )? 1 : 0 ; <S2SV_ModStart> dec ) { priv <S2SV_ModEnd> -> cfg = <S2SV_ModStart> dec = & priv <S2SV_ModEnd> -> cfg ;
Buggy code:
 static bool access_pmu_evcntr ( struct kvm_vcpu * vcpu, struct sys_reg_params * p, const struct sys_reg_desc * r ) { u64 idx ; if (! kvm_arm_pmu_v3_ready ( vcpu ) ) return trap_raz_wi ( vcpu, p, r ) ; if ( r -> CRn == 9 && r -> CRm == 13 ) { if ( r -> Op2 == 2 ) { if ( pmu_access_event_counter_el0_disabled ( vcpu ) ) return false ; idx = vcpu_sys_reg ( vcpu, PMSELR_EL0 ) & ARMV8_PMU_COUNTER_MASK ; } else if ( r -> Op2 == 0 ) { if ( pmu_access_cycle_counter_el0_disabled ( vcpu ) ) return false ; idx = ARMV8_PMU_CYCLE_IDX ; } else { <START_BUG> BUG ( ) ; <END_BUG> } } else if ( r -> CRn == 14 && ( r -> CRm & 12 ) == 8 ) { if ( pmu_access_event_counter_el0_disabled ( vcpu ) ) return false ; idx = ( ( r -> CRm & 3 ) << 3 ) | ( r -> Op2 & 7 ) ; } else {  BUG ( ) ; <START_BUG> } if (! pmu_counter_idx_valid ( vcpu, idx ) ) return false ; if ( p -> is_write ) { if ( pmu_access_el0_disabled ( vcpu ) ) return false ; kvm_pmu_set_counter_value ( vcpu, idx, p -> regval ) ; } else { p -> regval = kvm_pmu_get_counter_value ( vcpu, idx ) ; } return true ; }<END_BUG>

Fix:
<S2SV_ModStart> } else { return false ; } } else if ( r -> CRn == 0 && r -> CRm == 9 ) { if ( pmu_access_event_counter_el0_disabled ( vcpu ) ) return false ; idx = ARMV8_PMU_CYCLE_IDX ; <S2SV_ModEnd> } else if <S2SV_ModStart> } else { return false <S2SV_ModEnd> ; } if
Buggy code:
 static int do_check ( struct bpf_verifier_env * env ) { struct bpf_verifier_state * state ; struct bpf_insn * insns = env -> prog -> insnsi ; struct bpf_reg_state * regs ; int insn_cnt = env -> prog -> len, i ; int insn_processed = 0 ; bool do_print_state = false ; env -> prev_linfo = NULL ; state = kzalloc ( sizeof ( struct bpf_verifier_state ), GFP_KERNEL ) ; if (! state ) return - ENOMEM ; state -> curframe = 0 ; <START_BUG> state -> frame [ 0 ] = kzalloc ( sizeof ( struct bpf_func_state ), GFP_KERNEL ) ; <END_BUG> if (! state -> frame [ 0 ] ) { kfree ( state ) ; return - ENOMEM ; } env -> cur_state = state ; init_func_state ( env, state -> frame [ 0 ], BPF_MAIN_FUNC, 0, 0 ) ; for ( ; ; ) { struct bpf_insn * insn ; u8 class ; int err ; if ( env -> insn_idx >= insn_cnt ) { verbose ( env, "invalid   insn   idx   %d   insn_cnt   %d\\n", env -> insn_idx, insn_cnt ) ; return - EFAULT ; } insn = & insns [ env -> insn_idx ] ; class = BPF_CLASS ( insn -> code ) ; if ( ++ insn_processed > BPF_COMPLEXITY_LIMIT_INSNS ) { verbose ( env, "BPF   program   is   too   large.   Processed   %d   insn\\n", insn_processed ) ; return - E2BIG ; } err = is_state_visited ( env, env -> insn_idx ) ; if ( err < 0 ) return err ; if ( err == 1 ) { if ( env -> log. level ) { if ( do_print_state )  verbose ( env, "\\nfrom   %d   to   %d:   safe\\n", <START_BUG> <END_BUG> env -> prev_insn_idx, env -> insn_idx ) ;  else verbose ( env, "%d:   safe\\n", env -> insn_idx ) ; } goto process

Fix:
<S2SV_ModStart> ; state -> speculative = false ; state -> <S2SV_ModStart> ( env, "\\nfrom <S2SV_blank> %d <S2SV_blank> to <S2SV_blank> %d%s: <S2SV_blank> safe\\n" <S2SV_ModEnd>, env -> <S2SV_ModStart> env -> insn_idx, env -> cur_state -> speculative? " <S2SV_blank> (speculative <S2SV_blank> execution)" : "" <S2SV_ModStart> ( env, "\\nfrom <S2SV_blank> %d <S2SV_blank> to <S2SV_blank> %d%s:" <S2SV_ModEnd>, env -> <S2SV_ModStart> env -> insn_idx, env -> cur_state -> speculative? " <S2SV_blank> (speculative <S2SV_blank> execution)" : ""
Buggy code:
 int ext4_setattr ( struct dentry * dentry, struct iattr * attr ) { struct inode * inode = d_inode ( dentry ) ; int error, rc = 0 ; int orphan = 0 ; const unsigned int ia_valid = attr -> ia_valid ; error = inode_change_ok ( inode, attr ) ; if ( error ) return error ; if ( is_quota_modification ( inode, attr ) ) { error = dquot_initialize ( inode ) ; if ( error ) return error ; } if ( ( ia_valid & ATTR_UID &&! uid_eq ( attr -> ia_uid, inode -> i_uid ) ) || ( ia_valid & ATTR_GID &&! gid_eq ( attr -> ia_gid, inode -> i_gid ) ) ) { handle_t * handle ; handle = ext4_journal_start ( inode, EXT4_HT_QUOTA, ( EXT4_MAXQUOTAS_INIT_BLOCKS ( inode -> i_sb ) + EXT4_MAXQUOTAS_DEL_BLOCKS ( inode -> i_sb ) ) + 3 ) ; if ( IS_ERR ( handle ) ) { error = PTR_ERR ( handle ) ; goto err_out ; } error = dquot_transfer ( inode, attr ) ; if ( error ) { ext4_journal_stop ( handle ) ; return error ; } if ( attr -> ia_valid & ATTR_UID ) inode -> i_uid = attr -> ia_uid ; if ( attr -> ia_valid & ATTR_GID ) inode -> i_gid = attr -> ia_gid ; error = ext4_mark_inode_dirty ( handle, inode ) ; ext4_journal_stop ( handle ) ; } if ( attr -> ia_valid & ATTR_SIZE ) { handle_t * handle ; loff_t oldsize = inode -> i_size ; int shrink = ( attr -> ia_size <= inode -> i_size ) ; if (! ( ext4_test_inode_flag ( inode, EXT4_INODE_EXTENTS ) ) ) { struct ext4_sb_info * sbi = EXT4_SB ( inode -> i_sb ) ; if ( attr -> ia_size > sbi -> s_bitmap_maxbytes ) return - EFBIG ; } if (! S_

Fix:
<S2SV_ModStart> ) ; } down_write ( & EXT4_I ( inode ) -> i_mmap_sem ) ; <S2SV_ModStart> ext4_truncate ( inode ) ; up_write ( & EXT4_I ( inode ) -> i_mmap_sem
Buggy code:
 int WriteRiffHeader ( FILE * outfile, WavpackContext * wpc, int64_t total_samples, int qmode ) { <START_BUG> int do_rf64 = 0, write_junk = 1 ; <END_BUG> ChunkHeader ds64hdr, datahdr, fmthdr ; RiffChunkHeader riffhdr ;  DS64Chunk ds64_chunk ; <START_BUG> JunkChunk junkchunk ; WaveHeader wavhdr ; uint32_t bcount ; int64_t total_data_bytes, total_riff_bytes ; int num_channels = WavpackGetNumChannels ( wpc ) ; int32_t channel_mask = WavpackGetChannelMask ( wpc ) ; int32_t sample_rate = WavpackGetSampleRate ( wpc ) ; int bytes_per_sample = WavpackGetBytesPerSample ( wpc ) ; int bits_per_sample = WavpackGetBitsPerSample ( wpc ) ; int format = WavpackGetFloatNormExp ( wpc )? 3 : 1 ; int wavhdrsize = 16 ; if ( format == 3 && WavpackGetFloatNormExp ( wpc )!= 127 ) { error_line ( "can\'t   create   valid   RIFF   wav   header   for   non-normalized   floating   data!" ) ; return FALSE ; } if ( total_samples == - 1 ) total_samples = 0x7ffff000 // ( bytes_per_sample * num_channels ) ; total_data_bytes = total_samples * bytes_per_sample * num_channels ; if ( total_data_bytes > 0xff000000 ) { if ( debug_logging_mode ) error_line ( "total_data_bytes   =   %lld,   so   rf64", total_data_bytes ) ; write_junk = 0 ; do_rf64 = 1 ; } else if ( debug_logging_mode ) error_line ( "total_data_bytes   =   %lld,   so   riff", total_data_bytes ) ; CLEAR ( wavhdr ) ; wavhdr. FormatTag = format ; wavhdr. NumChannels = num_channels ; wavhdr. SampleRate = sample_rate ; wavhdr. BytesPerSecond = sample_rate * num_channels * bytes_per_sample ;<END_BUG>

Fix:
<S2SV_ModStart> write_junk = 1, table_length = 0 <S2SV_ModStart> ; DS64Chunk ds64_chunk ; CS64Chunk cs64_chunk <S2SV_ModStart> ds64_chunk ) ; total_riff_bytes += table_length * sizeof ( CS64Chunk ) ; if ( write_junk ) total_riff_bytes += <S2SV_ModEnd> sizeof ( junkchunk <S2SV_ModStart> ( ds64_chunk ) + ( table_length * sizeof ( CS64Chunk ) ) <S2SV_ModStart> sampleCount64 = total_samples ; ds64_chunk. tableLength = table_length <S2SV_ModStart> total_data_bytes ; } if ( table_length ) { strncpy ( cs64_chunk. ckID, "dmmy", sizeof ( cs64_chunk. ckID ) ) ; cs64_chunk. chunkSize64 = 12345678 ; WavpackNativeToLittleEndian ( & cs64_chunk, CS64ChunkFormat ) ; } <S2SV_ModStart> ) ) ) ) { error_line ( "can\'t <S2SV_blank> write <S2SV_blank>.WAV <S2SV_blank> data, <S2SV_blank> disk <S2SV_blank> probably <S2SV_blank> full!" ) ; return FALSE ; } while ( table_length -- ) if (! DoWriteFile ( outfile, & cs64_chunk, sizeof (
Buggy code:
 static void skel ( const char * homedir, uid_t u, gid_t g ) { char * fname ; if (! arg_shell_none && ( strcmp ( cfg. shell, "//usr//bin//zsh" ) == 0 || strcmp ( cfg. shell, "//bin//zsh" ) == 0 ) ) { if ( asprintf ( & fname, "%s//.zshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; <START_BUG> if ( stat ( "//etc//skel//.zshrc", & s ) == 0 ) { <END_BUG>  copy_file ( "//etc//skel//.zshrc", fname, u, g, 0644 ) ; <START_BUG> fs_logger ( "clone   //etc//skel//.zshrc" ) ; } else { touch_file_as_user ( fname, u, g, 0644 ) ; fs_logger2 ( "touch", fname ) ; } free ( fname ) ; } else if (! arg_shell_none && strcmp ( cfg. shell, "//bin//csh" ) == 0 ) { if ( asprintf ( & fname, "%s//.cshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; <END_BUG> if ( stat ( "//etc//skel//.cshrc", & s ) == 0 ) {  <START_BUG> copy_file ( "//etc//skel//.cshrc", fname, u, g, 0644 ) ; <END_BUG> fs_logger ( "clone   //etc//skel//.cshrc" ) ; } else { touch_file_as_user ( fname, u, g, 0644 ) ; fs_logger2 ( "touch", fname ) ; } free ( fname ) ; } else { if ( asprintf ( & fname, "%s//.bashrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ;  if ( stat ( "//etc//skel//.bashrc", & s ) == 0 ) { <START_BUG> <END_BUG> copy_file ( "//etc//skel//.bashrc", fname

Fix:
<S2SV_ModStart> ; if ( is_link ( fname ) ) { fprintf ( stderr, "Error: <S2SV_blank> invalid <S2SV_blank> %s <S2SV_blank> file\\n", fname ) ; exit ( 1 ) ; } if ( <S2SV_ModStart> 0 ) { copy_file_as_user <S2SV_ModEnd> ( "//etc//skel//.zshrc", <S2SV_ModStart> ; if ( is_link ( fname ) ) { fprintf ( stderr, "Error: <S2SV_blank> invalid <S2SV_blank> %s <S2SV_blank> file\\n", fname ) ; exit ( 1 ) ; } if ( <S2SV_ModStart> 0 ) { copy_file_as_user <S2SV_ModEnd> ( "//etc//skel//.cshrc", <S2SV_ModStart> ; if ( is_link ( fname ) ) { fprintf ( stderr, "Error: <S2SV_blank> invalid <S2SV_blank> %s <S2SV_blank> file\\n", fname ) ; exit ( 1 ) ; } if ( <S2SV_ModStart> 0 ) { copy_file_as_user <S2SV_ModEnd> ( "//etc//skel//.bashrc",
Buggy code:
 static int snd_seq_ioctl_remove_events ( struct snd_seq_client * client, void __user * arg ) { struct snd_seq_remove_events info ; if ( copy_from_user ( & info, arg, sizeof ( info ) ) ) return - EFAULT ; if ( info. remove_mode & SNDRV_SEQ_REMOVE_INPUT ) { <START_BUG> if ( client -> type == USER_CLIENT ) <END_BUG> snd_seq_fifo_clear ( client -> data. user. fifo ) ; } if ( info. remove_mode & SNDRV_SEQ_REMOVE_OUTPUT ) snd_seq_queue_remove_cells ( client -> number, & info ) ; return 0 ; }

Fix:
<S2SV_ModStart> type == USER_CLIENT && client -> data. user. fifo
Buggy code:
 static int command_read ( struct pci_dev * dev, int offset, u16 * value, void * data ) { <START_BUG> int i ; <END_BUG> int ret ;  ret = xen_pcibk_read_config_word ( dev, offset, value, data ) ; <START_BUG> if (! pci_is_enabled ( dev ) ) return ret ; for ( i = 0 ; i < PCI_ROM_RESOURCE ; i ++ ) { if ( dev -> resource [ i ]. flags & IORESOURCE_IO ) <END_BUG> * value |= PCI_COMMAND_IO ;  if ( dev -> resource [ i ]. flags & IORESOURCE_MEM ) * value |= PCI_COMMAND_MEMORY ; } return ret ; }

Fix:
<S2SV_ModStart> ) { int ret = pci_read_config_word <S2SV_ModEnd> ( dev, <S2SV_ModStart> offset, value ) ; const struct pci_cmd_info * cmd = data ; * value &= PCI_COMMAND_GUEST ; <S2SV_ModEnd> * value |= <S2SV_ModStart> * value |= cmd -> val & ~ PCI_COMMAND_GUEST ; <S2SV_ModEnd> return ret ;
Buggy code:
 void ndpi_search_oracle ( struct ndpi_detection_module_struct * ndpi_struct, struct ndpi_flow_struct * flow ) { struct ndpi_packet_struct * packet = & flow -> packet ; u_int16_t dport = 0, sport = 0 ; NDPI_LOG_DBG ( ndpi_struct, "search   ORACLE\\n" ) ; if ( packet -> tcp!= NULL ) { sport = ntohs ( packet -> tcp -> source ), dport = ntohs ( packet -> tcp -> dest ) ; NDPI_LOG_DBG2 ( ndpi_struct, "calculating   ORACLE   over   tcp\\n" ) ; if ( ( dport == 1521 || sport == 1521 ) <START_BUG> && ( ( ( packet -> payload [ 0 ] == 0x07 ) && ( packet -> payload [ 1 ] == 0xff ) && ( packet -> payload [ 2 ] == 0x00 ) ) <END_BUG> || ( ( packet -> payload_packet_len >= 232 ) && ( ( packet -> payload [ 0 ] == 0x00 ) || ( packet -> payload [ 0 ] == 0x01 ) ) && ( packet -> payload [ 1 ]!= 0x00 ) && ( packet -> payload [ 2 ] == 0x00 ) && ( packet -> payload [ 3 ] == 0x00 ) ) ) ) { NDPI_LOG_INFO ( ndpi_struct, "found   oracle\\n" ) ; ndpi_int_oracle_add_connection ( ndpi_struct, flow ) ; } else if ( packet -> payload_packet_len == 213 && packet -> payload [ 0 ] == 0x00 && packet -> payload [ 1 ] == 0xd5 && packet -> payload [ 2 ] == 0x00 && packet -> payload [ 3 ] == 0x00 ) { NDPI_LOG_INFO ( ndpi_struct, "found   oracle\\n" ) ; ndpi_int_oracle_add_connection ( ndpi_struct, flow ) ; } } else { NDPI_EXCLUDE_PROTO ( ndpi_struct, flow ) ; } }

Fix:
<S2SV_ModStart> ( packet -> payload_packet_len >= 3 && packet ->
Buggy code:
 static ssize_t perf_read ( struct file * file, char __user * buf, size_t count, loff_t * ppos ) { struct perf_event * event = file -> private_data ; <START_BUG> return perf_read_hw ( event, buf, count ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> -> private_data ; struct perf_event_context * ctx ; int ret ; ctx = perf_event_ctx_lock ( event ) ; ret = <S2SV_ModEnd> perf_read_hw ( event <S2SV_ModStart> count ) ; perf_event_ctx_unlock ( event, ctx ) ; return ret ;
Buggy code:
 <START_BUG> static void read_quant_matrix_ext ( MpegEncContext * s, GetBitContext * gb ) <END_BUG> { int i, j, v ;  if ( get_bits1 ( gb ) ) { <START_BUG> for ( i = 0 ; i < 64 ; i ++ ) { v = get_bits ( gb, 8 ) ; j = s -> idsp. idct_permutation [ ff_zigzag_direct [ i ] ] ; s -> intra_matrix [ j ] = v ; s -> chroma_intra_matrix [ j ] = v ; } } if ( get_bits1 ( gb ) ) { <END_BUG> for ( i = 0 ; i < 64 ; i ++ ) {  get_bits ( gb, 8 ) ; } } <START_BUG> if ( get_bits1 ( gb ) ) { <END_BUG> for ( i = 0 ; i < 64 ; i ++ ) { v = get_bits ( gb, 8 ) ; j = s -> idsp. idct_permutation [ ff_zigzag_direct [ i ] ] ; s -> chroma_intra_matrix [ j ] = v ; } } if ( get_bits1 ( gb ) ) {  for ( i = 0 ; i < 64 ; i ++ ) { <START_BUG> get_bits ( gb, 8 ) ; } } next_start_code_studio ( gb ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> read_quant_matrix_ext ( MpegEncContext <S2SV_ModStart> ) ) { if ( get_bits_left ( gb ) < 64 * 8 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> ) ) { if ( get_bits_left ( gb ) < 64 * 8 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> ) ) { if ( get_bits_left ( gb ) < 64 * 8 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> ) ) { if ( get_bits_left ( gb ) < 64 * 8 ) return AVERROR_INVALIDDATA ; <S2SV_ModStart> gb ) ; return 0 ;
Buggy code:
 void vp9_rc_get_svc_params ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; RATE_CONTROL * const rc = & cpi -> rc ; <START_BUG> int target = rc -> av_per_frame_bandwidth ; <END_BUG> if ( ( cm -> current_video_frame == 0 ) ||  ( cm -> frame_flags & FRAMEFLAGS_KEY ) || <START_BUG> ( cpi -> oxcf. auto_key && ( rc -> frames_since_key % <END_BUG> cpi -> key_frame_frequency == 0 ) ) ) {  cm -> frame_type = KEY_FRAME ; rc -> source_alt_ref_active = 0 ; <START_BUG> if ( cpi -> pass == 0 && cpi -> oxcf. end_usage == USAGE_STREAM_FROM_SERVER ) { <END_BUG> target = calc_iframe_target_size_one_pass_cbr ( cpi ) ; } } else { cm -> frame_type = INTER_FRAME ; if ( cpi -> pass == 0 && cpi -> oxcf. end_usage == USAGE_STREAM_FROM_SERVER ) { target = calc_pframe_target_size_one_pass_cbr ( cpi ) ; } } vp9_rc_set_frame_target ( cpi, target ) ; rc -> frames_till_gf_update_due = INT_MAX ; rc -> baseline_gf_interval = INT_MAX ; }

Fix:
<S2SV_ModStart> = rc -> avg_frame_bandwidth ; const int layer = LAYER_IDS_TO_IDX ( cpi -> svc. spatial_layer_id, cpi -> svc. temporal_layer_id, cpi -> svc. number_temporal_layers ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) || ( cpi <S2SV_ModEnd> -> frame_flags & <S2SV_ModStart> % cpi -> oxcf. key_freq <S2SV_ModEnd> == 0 ) <S2SV_ModStart> ; if ( is_two_pass_svc ( cpi ) ) { cpi -> svc. layer_context [ layer ]. is_key_frame = 1 ; cpi -> ref_frame_flags &= ( ~ VP9_LAST_FLAG & ~ VP9_GOLD_FLAG & ~ VP9_ALT_FLAG ) ; } else if ( is_one_pass_cbr_svc ( cpi ) ) { cpi -> svc. layer_context [ layer ]. is_key_frame = 1 ; reset_temporal_layer_to_zero ( cpi ) ; cpi -> ref_frame_flags &= ( ~ VP9_LAST_FLAG & ~ VP9_GOLD_FLAG & ~ VP9_
Buggy code:
 static int raw_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct inet_sock * inet = inet_sk ( sk ) ; size_t copied = 0 ; int err = - EOPNOTSUPP ; struct sockaddr_in * sin = ( struct sockaddr_in * ) msg -> msg_name ; struct sk_buff * skb ; if ( flags & MSG_OOB ) <START_BUG> goto out ; <END_BUG> if ( addr_len ) * addr_len = sizeof ( * sin ) ; if ( flags & MSG_ERRQUEUE ) { err = ip_recv_error ( sk, msg, len ) ; goto out ; } skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( len < copied ) { msg -> msg_flags |= MSG_TRUNC ; copied = len ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto done ; sock_recv_ts_and_drops ( msg, sk, skb ) ; if ( sin ) { sin -> sin_family = AF_INET ; sin -> sin_addr. s_addr = ip_hdr ( skb ) -> saddr ; sin -> sin_port = 0 ; memset ( & sin -> sin_zero, 0, sizeof ( sin -> sin_zero ) ) ;  } <START_BUG> if ( inet -> cmsg_flags ) ip_cmsg_recv ( msg, skb ) ; if ( flags & MSG_TRUNC ) copied = skb -> len ; done : skb_free_datagram ( sk, skb ) ; out : if ( err ) return err ; return copied ; }<END_BUG>

Fix:
<S2SV_ModStart> ) goto out <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) ; * addr_len = sizeof ( * sin ) ;
Buggy code:
 error_t dm9000SendPacket ( NetInterface * interface, const NetBuffer * buffer, size_t offset, NetTxAncillary * ancillary ) { size_t i ; size_t length ; uint16_t * p ; Dm9000Context * context ; context = ( Dm9000Context * ) interface -> nicContext ; length = netBufferGetLength ( buffer ) - offset ; if ( length > ETH_MAX_FRAME_SIZE ) { osSetEvent ( & interface -> nicTxEvent ) ; return ERROR_INVALID_LENGTH ; } netBufferRead ( context -> txBuffer, buffer, offset, length ) ; <START_BUG> dm9000WriteReg ( DM9000_REG_MWCMDX, 0 ) ; <END_BUG>  DM9000_INDEX_REG = DM9000_REG_MWCMD ; <START_BUG> p = ( uint16_t * ) context -> txBuffer ; for ( i = length ; i > 1 ; i -= 2 ) { DM9000_DATA_REG = * ( p ++ ) ; } if ( i > 0 ) { DM9000_DATA_REG = * ( ( uint8_t * ) p ) ; } <END_BUG> dm9000WriteReg ( DM9000_REG_TXPLL, LSB ( length ) ) ;  <START_BUG> dm9000WriteReg ( DM9000_REG_TXPLH, MSB ( length ) ) ; <END_BUG>  dm9000WriteReg ( DM9000_REG_ISR, ISR_PT ) ; <START_BUG> dm9000WriteReg ( DM9000_REG_TCR, TCR_TXREQ ) ; context -> queuedPackets ++ ; return NO_ERROR ; }<END_BUG>

Fix:
<S2SV_ModStart> ; dm9000WriteReg ( DM9000_MWCMDX <S2SV_ModEnd>, 0 ) <S2SV_ModStart> ; DM9000_INDEX_REG = DM9000_MWCMD <S2SV_ModEnd> ; p = <S2SV_ModStart> } dm9000WriteReg ( DM9000_TXPLL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ; dm9000WriteReg ( DM9000_TXPLH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ; dm9000WriteReg ( DM9000_ISR, DM9000_ISR_PT ) ; dm9000WriteReg ( DM9000_TCR, DM9000_TCR_TXREQ <S2SV_ModEnd> ) ; context
Buggy code:
 static int bmpr_read_rle ( struct iwbmprcontext * rctx ) { int retval = 0 ; if (! ( rctx -> compression == IWBMP_BI_RLE8 && rctx -> bitcount == 8 ) &&! ( rctx -> compression == IWBMP_BI_RLE4 && rctx -> bitcount == 4 ) ) { iw_set_error ( rctx -> ctx, "Compression   type   incompatible   with   image   type" ) ; <START_BUG> } <END_BUG> if ( rctx -> topdown ) {  iw_set_error ( rctx -> ctx, "Compression   not   allowed   with   top-down   images" ) ; <START_BUG> } rctx -> img -> imgtype = IW_IMGTYPE_RGBA ; rctx -> img -> bit_depth = 8 ; rctx -> img -> bpr = iw_calc_bytesperrow ( rctx -> width, 32 ) ; rctx -> img -> pixels = ( iw_byte * ) iw_malloc_large ( rctx -> ctx, rctx -> img -> bpr, rctx -> img -> height ) ; if (! rctx -> img -> pixels ) goto done ; if (! bmpr_read_rle_internal ( rctx ) ) goto done ; if (! bmpr_has_transparency ( rctx -> img ) ) { bmpr_strip_alpha ( rctx -> img ) ; } retval = 1 ; done : return retval ; }<END_BUG>

Fix:
<S2SV_ModStart> "Compression <S2SV_blank> type <S2SV_blank> incompatible <S2SV_blank> with <S2SV_blank> image <S2SV_blank> type" ) ; goto done ; <S2SV_ModStart>, "Compression <S2SV_blank> not <S2SV_blank> allowed <S2SV_blank> with <S2SV_blank> top-down <S2SV_blank> images" ) ; goto done
Buggy code:
 PTA * ptaReadStream ( FILE * fp ) { char typestr [ 128 ] ; l_int32 i, n, ix, iy, type, version ; l_float32 x, y ; PTA * pta ; PROCNAME ( "ptaReadStream" ) ; if (! fp ) return ( PTA * ) ERROR_PTR ( "stream   not   defined", procName, NULL ) ; if ( fscanf ( fp, "\\n   Pta   Version   %d\\n", & version )!= 1 ) return ( PTA * ) ERROR_PTR ( "not   a   pta   file", procName, NULL ) ; if ( version!= PTA_VERSION_NUMBER ) return ( PTA * ) ERROR_PTR ( "invalid   pta   version", procName, NULL ) ; <START_BUG> if ( fscanf ( fp, "   Number   of   pts   =   %d;   format   =   %s\\n", & n, typestr )!= 2 ) <END_BUG> return ( PTA * ) ERROR_PTR ( "not   a   pta   file", procName, NULL ) ; if (! strcmp ( typestr, "float" ) ) type = 0 ; else type = 1 ; if ( ( pta = ptaCreate ( n ) ) == NULL ) return ( PTA * ) ERROR_PTR ( "pta   not   made", procName, NULL ) ; for ( i = 0 ; i < n ; i ++ ) { if ( type == 0 ) { if ( fscanf ( fp, "       (%f,   %f)\\n", & x, & y )!= 2 ) { ptaDestroy ( & pta ) ; return ( PTA * ) ERROR_PTR ( "error   reading   floats", procName, NULL ) ; } ptaAddPt ( pta, x, y ) ; } else { if ( fscanf ( fp, "       (%d,   %d)\\n", & ix, & iy )!= 2 ) { ptaDestroy ( & pta ) ; return ( PTA * ) ERROR_PTR ( "error   reading   ints", procName, NULL ) ; } ptaAddPt ( pta, ix,

Fix:
<S2SV_ModStart> ( fp, " <S2SV_blank> Number <S2SV_blank> of <S2SV_blank> pts <S2SV_blank> = <S2SV_blank> %d; <S2SV_blank> format <S2SV_blank> = <S2SV_blank> %127s\\n" <S2SV_ModEnd>, & n
Buggy code:
 static struct sk_buff * udp6_ufo_fragment ( struct sk_buff * skb, u32 features ) { struct sk_buff * segs = ERR_PTR ( - EINVAL ) ; unsigned int mss ; unsigned int unfrag_ip6hlen, unfrag_len ; struct frag_hdr * fptr ; u8 * mac_start, * prevhdr ; u8 nexthdr ; u8 frag_hdr_sz = sizeof ( struct frag_hdr ) ; int offset ; __wsum csum ; mss = skb_shinfo ( skb ) -> gso_size ; if ( unlikely ( skb -> len <= mss ) ) goto out ; if ( skb_gso_ok ( skb, features | NETIF_F_GSO_ROBUST ) ) { int type = skb_shinfo ( skb ) -> gso_type ; if ( unlikely ( type & ~ ( SKB_GSO_UDP | SKB_GSO_DODGY ) ||! ( type & ( SKB_GSO_UDP ) ) ) ) goto out ; skb_shinfo ( skb ) -> gso_segs = DIV_ROUND_UP ( skb -> len, mss ) ; segs = NULL ; goto out ; } offset = skb_checksum_start_offset ( skb ) ; csum = skb_checksum ( skb, offset, skb -> len - offset, 0 ) ; offset += skb -> csum_offset ; * ( __sum16 * ) ( skb -> data + offset ) = csum_fold ( csum ) ; skb -> ip_summed = CHECKSUM_NONE ; if ( ( skb_mac_header ( skb ) < skb -> head + frag_hdr_sz ) && pskb_expand_head ( skb, frag_hdr_sz, 0, GFP_ATOMIC ) ) goto out ; unfrag_ip6hlen = ip6_find_1stfragopt ( skb, & prevhdr ) ; nexthdr = * prevhdr ; * prevhdr = NEXTHDR_FRAGMENT ; unfrag_len = skb_network_header ( skb ) - skb_mac_header ( skb ) + unfrag_ip6hlen ; mac_start = skb_

Fix:
<S2SV_ModStart> ipv6_select_ident ( fptr, ( struct rt6_info * ) skb_dst ( skb )
Buggy code:
 <START_BUG> void Huff_offsetTransmit ( huff_t * huff, int ch, byte * fout, int * offset ) { <END_BUG> bloc = * offset ;  send ( huff -> loc [ ch ], NULL, fout ) ; <START_BUG> * offset = bloc ; }<END_BUG>

Fix:
<S2SV_ModStart> int * offset, int maxoffset <S2SV_ModStart> NULL, fout, maxoffset
Buggy code:
 static int nfs4_xdr_dec_getacl ( struct rpc_rqst * rqstp, struct xdr_stream * xdr, struct nfs_getaclres * res ) { struct compound_hdr hdr ; int status ; status = decode_compound_hdr ( xdr, & hdr ) ; if ( status ) goto out ; status = decode_sequence ( xdr, & res -> seq_res, rqstp ) ; if ( status ) goto out ; status = decode_putfh ( xdr ) ; if ( status ) goto out ; <START_BUG> status = decode_getacl ( xdr, rqstp, & res -> acl_len ) ; <END_BUG> out : return status ; }

Fix:
<S2SV_ModStart>, rqstp, res <S2SV_ModEnd> ) ; out
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_hdr ( dec_state_t * ps_dec ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; UWORD16 u2_height ; UWORD16 u2_width ; if ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN )!= SEQUENCE_HEADER_CODE ) { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; return IMPEG2D_FRM_HDR_START_CODE_NOT_FOUND ; } impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; u2_width = impeg2d_bit_stream_get ( ps_stream, 12 ) ; u2_height = impeg2d_bit_stream_get ( ps_stream, 12 ) ; if ( 0 == u2_width || 0 == u2_height ) { IMPEG2D_ERROR_CODES_T e_error = IMPEG2D_FRM_HDR_DECODE_ERR ; return e_error ; } if ( ( u2_width!= ps_dec -> u2_horizontal_size ) || ( u2_height!= ps_dec -> u2_vertical_size ) ) { if ( 0 == ps_dec -> u2_header_done ) { ps_dec -> u2_horizontal_size = u2_width ; ps_dec -> u2_vertical_size = u2_height ; <START_BUG> if ( 0 == ps_dec -> u4_frm_buf_stride ) <END_BUG> { ps_dec -> u4_frm_buf_stride = ( UWORD32 ) ( u2_width ) ; } } else { if ( 0 == ps_dec -> i4_pic_count ) { return ( IMPEG2D_ERROR_CODES_T ) IMPEG2D_FRM_HDR_DECODE_ERR ; }  else if ( ( u2_width > ps_dec -> u2_create_max_width ) <START_BUG> <END_BUG> || ( u2_height > ps_dec -> u2_create_max_height ) )  { IMPEG2D_ERROR

Fix:
<S2SV_ModStart> = u2_height ; } else { <S2SV_ModStart> == ps_dec -> i4_pic_count ) { return ( IMPEG2D_ERROR_CODES_T ) IMPEG2D_FRM_HDR_DECODE_ERR ; } else if ( ( u2_width > ps_dec -> u2_create_max_width ) || ( u2_height > ps_dec -> u2_create_max_height ) ) { IMPEG2D_ERROR_CODES_T e_error = IMPEG2D_UNSUPPORTED_DIMENSIONS ; ps_dec -> u2_reinit_max_height = u2_height ; ps_dec -> u2_reinit_max_width = u2_width ; return e_error <S2SV_ModEnd> ; } else <S2SV_ModStart> if ( ( ps_dec -> u2_horizontal_size < MIN_WIDTH <S2SV_ModEnd> ) || ( <S2SV_ModStart> ) || ( ps_dec -> u2_vertical_size < MIN_HEIGHT ) ) { return IMPEG2D_UNSUPPORTED_DIMENSIONS <S2SV_ModEnd> ; } else <S2SV_ModStart> ; return e_error ; } if ( ( ps_dec -> u2_horizontal_size
Buggy code:
 static bool r_bin_mdmp_init_directory ( struct r_bin_mdmp_obj * obj ) { int i ; <START_BUG> ut8 * directory_base ; <END_BUG> struct minidump_directory * entry ; directory_base = obj -> b -> buf + obj -> hdr -> stream_directory_rva ; sdb_num_set ( obj -> kv, "mdmp_directory.offset", obj -> hdr -> stream_directory_rva, 0 ) ; sdb_set ( obj -> kv, "mdmp_directory.format", "[4]E?   " "(mdmp_stream_type)StreamType   " "(mdmp_location_descriptor)Location", 0 ) ;  for ( i = 0 ; i < ( int ) obj -> hdr -> number_of_streams ; i ++ ) { <START_BUG> <END_BUG> entry = ( struct minidump_directory * ) ( directory_base + ( i * sizeof ( struct minidump_directory ) ) ) ;  <START_BUG> r_bin_mdmp_init_directory_entry ( obj, entry ) ; <END_BUG> } return true ; }

Fix:
<S2SV_ModStart> int i ; struct minidump_directory entry <S2SV_ModEnd> ; sdb_num_set ( <S2SV_ModStart> 0 ) ; ut64 rvadir = obj -> hdr -> stream_directory_rva ; <S2SV_ModStart> ++ ) { ut32 delta = <S2SV_ModEnd> i * sizeof <S2SV_ModStart> struct minidump_directory ) ; int r = r_buf_read_at ( obj -> b, rvadir + delta, ( ut8 * ) & entry, sizeof ( struct minidump_directory <S2SV_ModStart> ) ) ; if ( r ) { <S2SV_ModStart> ( obj, & <S2SV_ModStart> entry ) ; }
Buggy code:
 static float * get_window ( vorb * f, int len ) { len <<= 1 ; if ( len == f -> blocksize_0 ) return f -> window [ 0 ] ; if ( len == f -> blocksize_1 ) return f -> window [ 1 ] ; <START_BUG> assert ( 0 ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> 1 ] ; <S2SV_ModEnd> return NULL ;
Buggy code:
 static int crypto_report_akcipher ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_akcipher rakcipher ; <START_BUG> strlcpy ( rakcipher. type, "akcipher", sizeof ( rakcipher. type ) ) ; <END_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_AKCIPHER, sizeof ( struct crypto_report_akcipher ), & rakcipher ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_akcipher rakcipher ; strncpy <S2SV_ModEnd> ( rakcipher.
Buggy code:
 void initServer ( ) { int j ; signal ( SIGHUP, SIG_IGN ) ; signal ( SIGPIPE, SIG_IGN ) ; setupSigSegvAction ( ) ; if ( server. syslog_enabled ) { openlog ( server. syslog_ident, LOG_PID | LOG_NDELAY | LOG_NOWAIT, server. syslog_facility ) ; } server. mainthread = pthread_self ( ) ; server. clients = listCreate ( ) ; server. slaves = listCreate ( ) ; server. monitors = listCreate ( ) ; server. unblocked_clients = listCreate ( ) ; createSharedObjects ( ) ; server. el = aeCreateEventLoop ( ) ; server. db = zmalloc ( sizeof ( redisDb ) * server. dbnum ) ; server. ipfd = anetTcpServer ( server. neterr, server. port, server. bindaddr ) ; if ( server. ipfd == ANET_ERR ) { redisLog ( REDIS_WARNING, "Opening   port:   %s", server. neterr ) ; exit ( 1 ) ; } if ( server. unixsocket!= NULL ) { unlink ( server. unixsocket ) ; server. sofd = anetUnixServer ( server. neterr, server. unixsocket ) ; if ( server. sofd == ANET_ERR ) { redisLog ( REDIS_WARNING, "Opening   socket:   %s", server. neterr ) ; exit ( 1 ) ; } } if ( server. ipfd < 0 && server. sofd < 0 ) { redisLog ( REDIS_WARNING, "Configured   to   not   listen   anywhere,   exiting." ) ; exit ( 1 ) ; } for ( j = 0 ; j < server. dbnum ; j ++ ) { server. db [ j ]. dict = dictCreate ( & dbDictType, NULL ) ; server. db [ j ]. expires = dictCreate ( & keyptrDictType, NULL ) ; server. db [ j ]. blocking_keys = dictCreate ( & keylistDictType, NULL ) ; server. db [ j ]. watched_keys = dictCreate ( & keylistDictType, NULL ) ; <START_BUG> if ( server. vm_enabled ) <END_BUG> server. db [ j ]. io_keys = dictCreate ( & keylistDictType, NULL )

Fix:
<S2SV_ModStart> ( server. ds_enabled <S2SV_ModEnd> ) server. <S2SV_ModStart> ( server. ds_enabled ) dsInit <S2SV_ModEnd> ( ) ;
Buggy code:
 error_t udpProcessDatagram ( NetInterface * interface, IpPseudoHeader * pseudoHeader, const NetBuffer * buffer, size_t offset, NetRxAncillary * ancillary ) { error_t error ; uint_t i ; size_t length ; UdpHeader * header ; Socket * socket ; SocketQueueItem * queueItem ; NetBuffer * p ; length = netBufferGetLength ( buffer ) - offset ; if ( length < sizeof ( UdpHeader ) ) { MIB2_INC_COUNTER32 ( udpGroup. udpInErrors, 1 ) ; UDP_MIB_INC_COUNTER32 ( udpInErrors, 1 ) ; return ERROR_INVALID_HEADER ; } header = netBufferAt ( buffer, offset ) ; if ( header == NULL ) return ERROR_FAILURE ; TRACE_INFO ( "UDP   datagram   received   (%" PRIuSIZE "   bytes)...\\r\\n", length ) ; udpDumpHeader ( header ) ; if ( header -> checksum!= 0x0000 || pseudoHeader -> length == sizeof ( Ipv6PseudoHeader ) ) { if ( ipCalcUpperLayerChecksumEx ( pseudoHeader -> data, pseudoHeader -> length, buffer, offset, length )!= 0x0000 ) { TRACE_WARNING ( "Wrong   UDP   header   checksum!\\r\\n" ) ; MIB2_INC_COUNTER32 ( udpGroup. udpInErrors, 1 ) ; UDP_MIB_INC_COUNTER32 ( udpInErrors, 1 ) ; return ERROR_WRONG_CHECKSUM ; } } for ( i = 0 ; i < SOCKET_MAX_COUNT ; i ++ ) { socket = socketTable + i ; if ( socket -> type!= SOCKET_TYPE_DGRAM ) continue ; if ( socket -> interface && socket -> interface!= interface ) continue ; if ( socket -> localPort == 0 || socket -> localPort!= ntohs ( header -> destPort ) ) continue ; if ( socket -> remotePort!= 0 && socket -> remotePort!= ntohs ( header -> srcPort ) ) continue ; # if ( IPV4_SUPPORT == ENABLED ) if ( pseudoHeader -> length == sizeof ( Ipv4PseudoHeader ) ) { if ( socket -> localIpAddr. length!= 0 ) { if ( socket -> localIpAddr. length!= sizeof ( Ipv4Addr ) ) continue ; if

Fix:
<S2SV_ModStart> ; queueItem -> interface = interface ; queueItem ->
Buggy code:
 static void llc_cmsg_rcv ( struct msghdr * msg, struct sk_buff * skb ) { struct llc_sock * llc = llc_sk ( skb -> sk ) ; if ( llc -> cmsg_flags & LLC_CMSG_PKTINFO ) { <START_BUG> struct llc_pktinfo info ; <END_BUG> info. lpi_ifindex = llc_sk ( skb -> sk ) -> dev -> ifindex ; llc_pdu_decode_dsap ( skb, & info. lpi_sap ) ; llc_pdu_decode_da ( skb, info. lpi_mac ) ; put_cmsg ( msg, SOL_LLC, LLC_OPT_PKTINFO, sizeof ( info ), & info ) ; } }

Fix:
<S2SV_ModStart> struct llc_pktinfo info ; memset ( & info, 0, sizeof ( info ) )
Buggy code:
 static int process_one_ticket ( struct ceph_auth_client * ac, struct ceph_crypto_key * secret, <START_BUG> void * * p, void * end, <END_BUG> void * dbuf, void * ticket_buf ) { struct ceph_x_info * xi = ac -> private ; int type ; u8 tkt_struct_v, blob_struct_v ; struct ceph_x_ticket_handler * th ;  void * dp, * dend ; <START_BUG> int dlen ; char is_enc ; struct timespec validity ; <END_BUG> struct ceph_crypto_key old_key ;  void * tp, * tpend ; struct ceph_timespec new_validity ; struct ceph_crypto_key new_session_key ; struct ceph_buffer * new_ticket_blob ; unsigned long new_expires, new_renew_after ; u64 new_secret_id ; int ret ; ceph_decode_need ( p, end, sizeof ( u32 ) + 1, bad ) ; type = ceph_decode_32 ( p ) ; dout ( "   ticket   type   %d   %s\\n", type, ceph_entity_type_name ( type ) ) ; tkt_struct_v = ceph_decode_8 ( p ) ; if ( tkt_struct_v!= 1 ) goto bad ; th = get_ticket_handler ( ac, type ) ; if ( IS_ERR ( th ) ) { ret = PTR_ERR ( th ) ; goto out ; } <START_BUG> dlen = ceph_x_decrypt ( secret, p, end, dbuf, <END_BUG> TEMP_TICKET_BUF_LEN ) ; if ( dlen <= 0 ) { ret = dlen ; goto out ; } dout ( "   decrypted   %d   bytes\\n", dlen ) ; dp = dbuf ; dend = dp + dlen ; tkt_struct_v = ceph_decode_8 ( & dp ) ; if ( tkt_struct_v!= 1 ) goto bad ; memcpy ( & old_key, & th -> session_key, sizeof ( old_key ) ) ; ret = ceph_crypto_key_decode ( & new_session_key, & dp, dend ) ; if ( ret ) goto out ; ceph

Fix:
<S2SV_ModStart> void * end <S2SV_ModEnd> ) { struct <S2SV_ModStart> ; void * dbuf = NULL ; void * <S2SV_ModStart> struct ceph_crypto_key old_key ; void * ticket_buf = NULL <S2SV_ModStart>, end, & dbuf, 0 <S2SV_ModEnd> ) ; if <S2SV_ModStart> bad ) ; if ( is_enc ) { dout ( " <S2SV_blank> encrypted <S2SV_blank> ticket\\n" ) ; dlen = ceph_x_decrypt ( & old_key, p, end, & ticket_buf, 0 <S2SV_ModEnd> ) ; if <S2SV_ModStart> out ; } tp = ticket_buf ; <S2SV_ModStart> bad ) ; ticket_buf = kmalloc ( dlen, GFP_NOFS ) ; if (! ticket_buf ) { ret = - ENOMEM ; goto out ; } tp = ticket_buf ; <S2SV_ModStart> ; out : kfree ( ticket_buf ) ; kfree ( dbuf ) ;
Buggy code:
 static int logi_dj_ll_raw_request ( struct hid_device * hid, unsigned char reportnum, __u8 * buf, size_t count, unsigned char report_type, int reqtype ) { struct dj_device * djdev = hid -> driver_data ; struct dj_receiver_dev * djrcv_dev = djdev -> dj_receiver_dev ; u8 * out_buf ; int ret ; if ( buf [ 0 ]!= REPORT_TYPE_LEDS ) return - EINVAL ; out_buf = kzalloc ( DJREPORT_SHORT_LENGTH, GFP_ATOMIC ) ; if (! out_buf ) return - ENOMEM ; <START_BUG> if ( count < DJREPORT_SHORT_LENGTH - 2 ) <END_BUG> count = DJREPORT_SHORT_LENGTH - 2 ; out_buf [ 0 ] = REPORT_ID_DJ_SHORT ; out_buf [ 1 ] = djdev -> device_index ; memcpy ( out_buf + 2, buf, count ) ; ret = hid_hw_raw_request ( djrcv_dev -> hdev, out_buf [ 0 ], out_buf, DJREPORT_SHORT_LENGTH, report_type, reqtype ) ; kfree ( out_buf ) ; return ret ; }

Fix:
<S2SV_ModStart> if ( count > <S2SV_ModEnd> DJREPORT_SHORT_LENGTH - 2
Buggy code:
 static int em_syscall ( struct x86_emulate_ctxt * ctxt ) { struct x86_emulate_ops * ops = ctxt -> ops ; struct desc_struct cs, ss ; u64 msr_data ; u16 cs_sel, ss_sel ; u64 efer = 0 ; if ( ctxt -> mode == X86EMUL_MODE_REAL || ctxt -> mode == X86EMUL_MODE_VM86 ) return emulate_ud ( ctxt ) ; <START_BUG> ops -> get_msr ( ctxt, MSR_EFER, & efer ) ; <END_BUG>  setup_syscalls_segments ( ctxt, & cs, & ss ) ; <START_BUG> ops -> get_msr ( ctxt, MSR_STAR, & msr_data ) ; msr_data >>= 32 ; cs_sel = ( u16 ) ( msr_data & 0xfffc ) ; ss_sel = ( u16 ) ( msr_data + 8 ) ; if ( efer & EFER_LMA ) { cs. d = 0 ; cs. l = 1 ; } ops -> set_segment ( ctxt, cs_sel, & cs, 0, VCPU_SREG_CS ) ; ops -> set_segment ( ctxt, ss_sel, & ss, 0, VCPU_SREG_SS ) ; ctxt -> regs [ VCPU_REGS_RCX ] = ctxt -> _eip ; if ( efer & EFER_LMA ) { # ifdef CONFIG_X86_64 ctxt -> regs [ VCPU_REGS_R11 ] = ctxt -> eflags & ~ EFLG_RF ; ops -> get_msr ( ctxt, ctxt -> mode == X86EMUL_MODE_PROT64? MSR_LSTAR : MSR_CSTAR, & msr_data ) ; ctxt -> _eip = msr_data ; ops -> get_msr ( ctxt, MSR_SYSCALL_MASK, & msr_data ) ; ctxt -> eflags &= ~ ( msr_data | EFLG_RF ) ; # endif } else { ops -> get_msr ( ctxt, MSR_STAR, & msr_data ) ; ctxt -> _eip = ( u32 ) msr_data ; ctxt -> eflags &= ~ ( EFLG_VM | EF<END_BUG>

Fix:
<S2SV_ModStart> ctxt ) ; if (! ( em_syscall_is_enabled ( ctxt ) ) ) return emulate_ud ( ctxt ) ; <S2SV_ModStart>, & ss ) ; if (! ( efer & EFER_SCE ) ) return emulate_ud ( ctxt