nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int cac_cac1_get_certificate ( sc_card_t * card, u8 * * out_buf, size_t * out_len ) { u8 buf [ CAC_MAX_SIZE ] ; u8 * out_ptr ; size_t size = 0 ; size_t left = 0 ; <START_BUG> size_t len, next_len ; <END_BUG> sc_apdu_t apdu ; int r = SC_SUCCESS ; SC_FUNC_CALLED ( card -> ctx, SC_LOG_DEBUG_VERBOSE ) ; size = left = * out_buf? * out_len : sizeof ( buf ) ; out_ptr = * out_buf? * out_buf : buf ; sc_format_apdu ( card, & apdu, SC_APDU_CASE_2_SHORT, CAC_INS_GET_CERTIFICATE, 0, 0 ) ;  next_len = MIN ( left, 100 ) ; <START_BUG> <END_BUG> for ( ; left > 0 ; left -= len, out_ptr += len ) {  len = next_len ; apdu. resp = out_ptr ; apdu. le = len ; apdu. resplen = left ; r = sc_transmit_apdu ( card, & apdu ) ; if ( r < 0 ) { break ; } if ( apdu. resplen == 0 ) { r = SC_ERROR_INTERNAL ; break ; } if ( apdu. sw1!= 0x63 || apdu. sw2 < 1 ) { r = sc_check_sw ( card, apdu. sw1, apdu. sw2 ) ; left -= len ; break ; } <START_BUG> next_len = MIN ( left, apdu. sw2 ) ; <END_BUG> } if ( r < 0 ) { SC_FUNC_RETURN ( card -> ctx, SC_LOG_DEBUG_VERBOSE, r ) ; } r = size - left ; if ( * out_buf == NULL ) { * out_buf = malloc ( r ) ; if ( * out_buf == NULL ) { SC_FUNC_RETURN ( card -> ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_OUT_OF_MEMORY ) ; } memcpy ( * out_buf, buf, r ) ; } * out_len = r ; SC_FUNC_RETURN ( card -> ctx, SC_LOG_DEBUG_VERBOSE, r ) ; }

Fix:
<S2SV_ModStart> ; size_t len <S2SV_ModEnd> ; sc_apdu_t apdu <S2SV_ModStart> 0 ) ; len <S2SV_ModEnd> = MIN ( <S2SV_ModStart> > 0 ; ) { <S2SV_ModEnd> apdu. resp <S2SV_ModStart> break ; } left -= len ; out_ptr += len ; len <S2SV_ModEnd> = MIN (
Buggy code:
 static Browser_Window * window_create ( const char * url ) { Browser_Window * app_data = malloc ( sizeof ( Browser_Window ) ) ; if (! app_data ) { info ( "ERROR:   could   not   create   browser   window.\\n" ) ; return NULL ; } app_data -> window = elm_win_add ( NULL, "minibrowser-window", ELM_WIN_BASIC ) ; elm_win_title_set ( app_data -> window, APP_NAME ) ; evas_object_smart_callback_add ( app_data -> window, "delete,request", on_window_deletion, & app_data ) ; Evas_Object * bg = elm_bg_add ( app_data -> window ) ; elm_bg_color_set ( bg, 193, 192, 191 ) ; evas_object_size_hint_weight_set ( bg, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND ) ; elm_win_resize_object_add ( app_data -> window, bg ) ; evas_object_show ( bg ) ; Evas_Object * vertical_layout = elm_box_add ( app_data -> window ) ; elm_box_padding_set ( vertical_layout, 0, 2 ) ; evas_object_size_hint_weight_set ( vertical_layout, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND ) ; elm_win_resize_object_add ( app_data -> window, vertical_layout ) ; evas_object_show ( vertical_layout ) ; Evas_Object * horizontal_layout = elm_box_add ( app_data -> window ) ; elm_box_horizontal_set ( horizontal_layout, EINA_TRUE ) ; evas_object_size_hint_weight_set ( horizontal_layout, EVAS_HINT_EXPAND, 0.0 ) ; evas_object_size_hint_align_set ( horizontal_layout, EVAS_HINT_FILL, 0.0 ) ; elm_box_pack_end ( vertical_layout, horizontal_layout ) ; evas_object_show ( horizontal_layout ) ; app_data -> back_button = create_toolbar_button

Fix:
<S2SV_ModStart> -> window, window_width, window_height <S2SV_ModEnd> ) ; evas_object_show
Buggy code:
 static int em_jmp_far ( struct x86_emulate_ctxt * ctxt ) { int rc ; <START_BUG> unsigned short sel ; <END_BUG> memcpy ( & sel, ctxt -> src. valptr + ctxt -> op_bytes, 2 ) ;  rc = load_segment_descriptor ( ctxt, sel, VCPU_SREG_CS ) ; <START_BUG> if ( rc!= X86EMUL_CONTINUE ) return rc ; <END_BUG> ctxt -> _eip = 0 ;  <START_BUG> memcpy ( & ctxt -> _eip, ctxt -> src. valptr, ctxt -> op_bytes ) ; <END_BUG>  return X86EMUL_CONTINUE ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> unsigned short sel, old_sel ; struct desc_struct old_desc, new_desc ; const struct x86_emulate_ops * ops = ctxt -> ops ; u8 cpl = ctxt -> ops -> cpl ( ctxt ) ; if ( ctxt -> mode == X86EMUL_MODE_PROT64 ) ops -> get_segment ( ctxt, & old_sel, & old_desc, NULL, VCPU_SREG_CS ) <S2SV_ModStart> ; rc = __load_segment_descriptor <S2SV_ModEnd> ( ctxt, <S2SV_ModStart> sel, VCPU_SREG_CS, cpl, false, & new_desc <S2SV_ModStart> return rc ; rc = assign_eip_far ( ctxt <S2SV_ModEnd>, ctxt -> <S2SV_ModStart> -> src. val, new_desc. l ) ; if ( rc!= X86EMUL_CONTINUE ) { WARN_ON (! ctxt -> mode!= X86EMUL_MODE_PROT64 ) ; ops -> set_segment ( ctxt, old_sel, & old_desc, 0, VCPU_SREG_CS <S2SV_ModEnd> ) ; return <S2SV_ModStart> ) ; return rc ; } return rc <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int oe_iov_sync ( const struct oe_iovec * iov, int iovcnt, const void * buf_, size_t buf_size ) { struct oe_iovec * buf = ( struct oe_iovec * ) buf_ ; int ret = - 1 ; int i ; size_t n ; if ( iovcnt < 0 || ( iovcnt > 0 &&! iov ) ) goto done ; for ( i = 0, n = buf_size ; i < iovcnt ; i ++ ) { if ( buf [ i ]. iov_len!= iov [ i ]. iov_len ) goto done ; if ( buf [ i ]. iov_len ) { if ( buf [ i ]. iov_base &&! iov [ i ]. iov_base ) goto done ; if (! buf [ i ]. iov_base && iov [ i ]. iov_base ) goto done ; if (! buf [ i ]. iov_base ) continue ; if ( n < buf [ i ]. iov_len ) goto done ; { uint8_t * src = ( uint8_t * ) buf [ i ]. iov_base + ( uint64_t ) buf ; size_t src_size = buf [ i ]. iov_len ; uint8_t * dest = ( uint8_t * ) iov [ i ]. iov_base ; size_t dest_size = iov [ i ]. iov_len ; if ( src_size!= dest_size ) goto done ; <START_BUG> if ( src < ( uint8_t * ) buf || src > ( uint8_t * ) buf + buf_size ) <END_BUG> goto done ; if ( oe_memcpy_s ( dest, dest_size, src, src_size )!= OE_OK ) goto done ; } } n -= buf [ i ]. iov_len ; } ret = 0 ; done : return ret ; }

Fix:
<S2SV_ModStart> buf || src + src_size < src || src + src_size
Buggy code:
 <START_BUG> static void mark_object ( struct object * obj, struct strbuf * path, <END_BUG> const char * name, void * data ) { update_progress ( data ) ; }

Fix:
<S2SV_ModStart> * obj, <S2SV_ModEnd> const char *
Buggy code:
 static int hash_recvmsg ( struct kiocb * unused, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct alg_sock * ask = alg_sk ( sk ) ; struct hash_ctx * ctx = ask -> private ; unsigned ds = crypto_ahash_digestsize ( crypto_ahash_reqtfm ( & ctx -> req ) ) ; int err ; if ( len > ds ) len = ds ; else if ( len < ds ) msg -> msg_flags |= MSG_TRUNC ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> lock_sock ( sk ) ; if ( ctx -> more ) { ctx -> more = 0 ; ahash_request_set_crypt ( & ctx -> req, NULL, ctx -> result, 0 ) ; err = af_alg_wait_for_completion ( crypto_ahash_final ( & ctx -> req ), & ctx -> completion ) ; if ( err ) goto unlock ; } err = memcpy_toiovec ( msg -> msg_iov, ctx -> result, len ) ; unlock : release_sock ( sk ) ; return err? : len ; }

Fix:
<S2SV_ModStart> |= MSG_TRUNC ; <S2SV_ModEnd> lock_sock ( sk
Buggy code:
 qboolean S_AL_Init ( soundInterface_t * si ) { # ifdef USE_OPENAL const char * device = NULL ; const char * inputdevice = NULL ; int i ; if (! si ) { return qfalse ; } for ( i = 0 ; i < MAX_RAW_STREAMS ; i ++ ) { streamSourceHandles [ i ] = - 1 ; streamPlaying [ i ] = qfalse ; streamSources [ i ] = 0 ; streamNumBuffers [ i ] = 0 ; streamBufIndex [ i ] = 0 ; } s_alPrecache = Cvar_Get ( "s_alPrecache", "1", CVAR_ARCHIVE ) ; s_alGain = Cvar_Get ( "s_alGain", "1.0", CVAR_ARCHIVE ) ; s_alSources = Cvar_Get ( "s_alSources", "96", CVAR_ARCHIVE ) ; s_alDopplerFactor = Cvar_Get ( "s_alDopplerFactor", "1.0", CVAR_ARCHIVE ) ; s_alDopplerSpeed = Cvar_Get ( "s_alDopplerSpeed", "9000", CVAR_ARCHIVE ) ; s_alMinDistance = Cvar_Get ( "s_alMinDistance", "120", CVAR_CHEAT ) ; s_alMaxDistance = Cvar_Get ( "s_alMaxDistance", "1024", CVAR_CHEAT ) ; s_alRolloff = Cvar_Get ( "s_alRolloff", "2", CVAR_CHEAT ) ; s_alGraceDistance = Cvar_Get ( "s_alGraceDistance", "512", CVAR_CHEAT ) ; <START_BUG> s_alDriver = Cvar_Get ( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH ) ; <END_BUG> s_alInputDevice = Cvar_Get ( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_LATCH ) ;  s_alDevice = Cvar_Get ( "s_alDevice", "", CVAR_ARCHIVE | CVAR_LATCH ) ;

Fix:
<S2SV_ModStart> CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED <S2SV_ModStart> CVAR_LATCH ) ; if ( COM_CompareExtension ( s_alDriver -> string, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", s_alDriver -> string ) ; return qfalse ; }
Buggy code:
 void device_init ( ) { <START_BUG> hw_init ( LOW_FREQUENCY ) ; <END_BUG> if (! tsc_sensor_exists ( ) ) { _NFC_status = nfc_init ( ) ; } if ( _NFC_status == NFC_IS_ACTIVE ) { printf1 ( TAG_NFC, "Have   NFC\\r\\n" ) ; isLowFreq = 1 ; IS_BUTTON_PRESSED = is_physical_button_pressed ; } else { printf1 ( TAG_NFC, "Have   NO   NFC\\r\\n" ) ; hw_init ( HIGH_FREQUENCY ) ; isLowFreq = 0 ; device_init_button ( ) ; } usbhid_init ( ) ; ctaphid_init ( ) ; ctap_init ( ) ; device_migrate ( ) ;  # if BOOT_TO_DFU <START_BUG> flash_option_bytes_init ( 1 ) ; # else flash_option_bytes_init ( 0 ) ; # endif }<END_BUG>

Fix:
<S2SV_ModStart> LOW_FREQUENCY ) ; # if BOOT_TO_DFU flash_option_bytes_init ( 1 ) ; # else flash_option_bytes_init ( 0 ) ; # endif <S2SV_ModStart> ( ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int create_user_ns ( struct cred * new ) { struct user_namespace * ns, * parent_ns = new -> user_ns ; kuid_t owner = new -> euid ; kgid_t group = new -> egid ; <START_BUG> int ret ; <END_BUG> if (! kuid_has_mapping ( parent_ns, owner ) ||! kgid_has_mapping ( parent_ns, group ) ) return - EPERM ; ns = kmem_cache_zalloc ( user_ns_cachep, GFP_KERNEL ) ; if (! ns ) return - ENOMEM ; ret = proc_alloc_inum ( & ns -> proc_inum ) ; if ( ret ) { kmem_cache_free ( user_ns_cachep, ns ) ; return ret ; } atomic_set ( & ns -> count, 1 ) ; ns -> parent = parent_ns ; ns -> owner = owner ; ns -> group = group ; set_cred_user_ns ( new, ns ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; int ret ; if ( current_chrooted ( ) ) return - EPERM
Buggy code:
 static int rose_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct rose_sock * rose = rose_sk ( sk ) ; struct sockaddr_rose * srose = ( struct sockaddr_rose * ) msg -> msg_name ; size_t copied ; unsigned char * asmptr ; struct sk_buff * skb ; int n, er, qbit ; if ( sk -> sk_state!= TCP_ESTABLISHED ) return - ENOTCONN ; if ( ( skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & er ) ) == NULL ) return er ; qbit = ( skb -> data [ 0 ] & ROSE_Q_BIT ) == ROSE_Q_BIT ; skb_pull ( skb, ROSE_MIN_LEN ) ; if ( rose -> qbitincl ) { asmptr = skb_push ( skb, 1 ) ; * asmptr = qbit ; } skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( srose!= NULL ) { <START_BUG> srose -> srose_family = AF_ROSE ; <END_BUG> srose -> srose_addr = rose -> dest_addr ; srose -> srose_call = rose -> dest_call ; srose -> srose_ndigis = rose -> dest_ndigis ; if ( msg -> msg_namelen >= sizeof ( struct full_sockaddr_rose ) ) { struct full_sockaddr_rose * full_srose = ( struct full_sockaddr_rose * ) msg -> msg_name ; for ( n = 0 ; n < rose -> dest_ndigis ; n ++ ) full_srose -> srose_digis [ n ] = rose -> dest_dig

Fix:
<S2SV_ModStart> NULL ) { memset ( srose, 0, msg -> msg_namelen ) ;
Buggy code:
 long pipe_fcntl ( struct file * file, unsigned int cmd, unsigned long arg ) { struct pipe_inode_info * pipe ; long ret ; pipe = get_pipe_info ( file ) ; if (! pipe ) return - EBADF ; __pipe_lock ( pipe ) ; switch ( cmd ) { case F_SETPIPE_SZ : { unsigned int size, nr_pages ; size = round_pipe_size ( arg ) ; nr_pages = size >> PAGE_SHIFT ; ret = - EINVAL ; if (! nr_pages ) goto out ; if (! capable ( CAP_SYS_RESOURCE ) && size > pipe_max_size ) { ret = - EPERM ; goto out ; <START_BUG> } <END_BUG> ret = pipe_set_size ( pipe, nr_pages ) ; break ; } case F_GETPIPE_SZ : ret = pipe -> buffers * PAGE_SIZE ; break ; default : ret = - EINVAL ; break ; } out : __pipe_unlock ( pipe ) ; return ret ; }

Fix:
<S2SV_ModStart> out ; } else if ( ( too_many_pipe_buffers_hard ( pipe -> user ) || too_many_pipe_buffers_soft ( pipe -> user ) ) &&! capable ( CAP_SYS_RESOURCE ) &&! capable ( CAP_SYS_ADMIN ) ) { ret = - EPERM ; goto out ; }
Buggy code:
 static int find_low_bit ( unsigned int x ) { int i ; for ( i = 0 ; i <= 31 ; i ++ ) { <START_BUG> if ( x & ( 1 << i ) ) return i ; <END_BUG> } return 0 ; }

Fix:
<S2SV_ModStart> x & ( 1U << ( unsigned int ) <S2SV_ModEnd> i ) )
Buggy code:
 static int ext4_xattr_block_get ( struct inode * inode, int name_index, const char * name, void * buffer, size_t buffer_size ) { struct buffer_head * bh = NULL ; struct ext4_xattr_entry * entry ; size_t size ; int error ; <START_BUG> struct mb_cache * ext4_mb_cache = EXT4_GET_MB_CACHE ( inode ) ; <END_BUG> ea_idebug ( inode, "name=%d.%s,   buffer=%p,   buffer_size=%ld", name_index, name, buffer, ( long ) buffer_size ) ; error = - ENODATA ; if (! EXT4_I ( inode ) -> i_file_acl ) goto cleanup ; ea_idebug ( inode, "reading   block   %llu", ( unsigned long long ) EXT4_I ( inode ) -> i_file_acl ) ; bh = sb_bread ( inode -> i_sb, EXT4_I ( inode ) -> i_file_acl ) ; if (! bh ) goto cleanup ; ea_bdebug ( bh, "b_count=%d,   refcount=%d", atomic_read ( & ( bh -> b_count ) ), le32_to_cpu ( BHDR ( bh ) -> h_refcount ) ) ; if ( ext4_xattr_check_block ( inode, bh ) ) { bad_block : EXT4_ERROR_INODE ( inode, "bad   block   %llu", EXT4_I ( inode ) -> i_file_acl ) ; error = - EFSCORRUPTED ; goto cleanup ; } ext4_xattr_cache_insert ( ext4_mb_cache, bh ) ; entry = BFIRST ( bh ) ; error = ext4_xattr_find_entry ( & entry, name_index, name, bh -> b_size, 1 ) ; if ( error == - EFSCORRUPTED ) goto bad_block ; if ( error ) goto cleanup ; size = le32_to_cpu ( entry -> e_value_size ) ; if ( buffer ) { error = - ERANGE ; if ( size > buffer_size ) goto cleanup ; memcpy ( buffer, bh -> b_data + le16_to_cpu ( entry ->

Fix:
<S2SV_ModStart> error ; struct mb2_cache <S2SV_ModEnd> * ext4_mb_cache =
Buggy code:
 static void hugetlb_vm_op_close ( struct vm_area_struct * vma ) { struct hstate * h = hstate_vma ( vma ) ; <START_BUG> struct resv_map * reservations = vma_resv_map ( vma ) ; <END_BUG> unsigned long reserve ; unsigned long start ; unsigned long end ; if ( reservations ) { start = vma_hugecache_offset ( h, vma, vma -> vm_start ) ; end = vma_hugecache_offset ( h, vma, vma -> vm_end ) ; reserve = ( end - start ) - region_count ( & reservations -> regions, start, end ) ; kref_put ( & reservations -> refs, resv_map_release ) ; if ( reserve ) { hugetlb_acct_memory ( h, - reserve ) ;  hugetlb_put_quota ( vma -> vm_file -> f_mapping, reserve ) ; <START_BUG> } } }<END_BUG>

Fix:
<S2SV_ModStart> reservations = vma_resv_map ( vma ) ; struct hugepage_subpool * spool = subpool_vma <S2SV_ModStart> reserve ) ; hugepage_subpool_put_pages ( spool <S2SV_ModEnd>, reserve )
Buggy code:
 static int pppol2tp_setsockopt ( struct socket * sock, int level, int optname, char __user * optval, unsigned int optlen ) { struct sock * sk = sock -> sk ; struct l2tp_session * session ; struct l2tp_tunnel * tunnel ; struct pppol2tp_session * ps ; int val ; int err ; if ( level!= SOL_PPPOL2TP ) <START_BUG> return udp_prot. setsockopt ( sk, level, optname, optval, optlen ) ; <END_BUG> if ( optlen < sizeof ( int ) ) return - EINVAL ; if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; err = - ENOTCONN ; if ( sk -> sk_user_data == NULL ) goto end ; err = - EBADF ; session = pppol2tp_sock_to_session ( sk ) ; if ( session == NULL ) goto end ; ps = l2tp_session_priv ( session ) ; if ( ( session -> session_id == 0 ) && ( session -> peer_session_id == 0 ) ) { err = - EBADF ; tunnel = l2tp_sock_to_tunnel ( ps -> tunnel_sock ) ; if ( tunnel == NULL ) goto end_put_sess ; err = pppol2tp_tunnel_setsockopt ( sk, tunnel, optname, val ) ; sock_put ( ps -> tunnel_sock ) ; } else err = pppol2tp_session_setsockopt ( sk, session, optname, val ) ; err = 0 ; end_put_sess : sock_put ( sk ) ; end : return err ; }

Fix:
<S2SV_ModStart> SOL_PPPOL2TP ) return - EINVAL <S2SV_ModEnd> ; if (
Buggy code:
 <START_BUG> static void send ( node_t * node, node_t * child, byte * fout ) { <END_BUG> if ( node -> parent ) {  send ( node -> parent, node, fout ) ; <START_BUG> } <END_BUG> if ( child ) {  if ( node -> right == child ) { add_bit ( 1, fout ) ; } else { add_bit ( 0, fout ) ; } } }

Fix:
<S2SV_ModStart> byte * fout, int maxoffset <S2SV_ModStart> node, fout, maxoffset <S2SV_ModStart> child ) { if ( bloc >= maxoffset ) { bloc = maxoffset + 1 ; return ; }
Buggy code:
 void vp8_set_speed_features ( VP8_COMP * cpi ) { SPEED_FEATURES * sf = & cpi -> sf ; int Mode = cpi -> compressor_speed ; int Speed = cpi -> Speed ; int i ; VP8_COMMON * cm = & cpi -> common ; int last_improved_quant = sf -> improved_quant ; int ref_frames ; for ( i = 0 ; i < MAX_MODES ; i ++ ) { cpi -> mode_check_freq [ i ] = 0 ; } cpi -> mb. mbs_tested_so_far = 0 ; <START_BUG> sf -> RD = 1 ; <END_BUG> sf -> search_method = NSTEP ; sf -> improved_quant = 1 ; sf -> improved_dct = 1 ; sf -> auto_filter = 1 ; sf -> recode_loop = 1 ; sf -> quarter_pixel_search = 1 ; sf -> half_pixel_search = 1 ; sf -> iterative_sub_pixel = 1 ; sf -> optimize_coefficients = 1 ; sf -> use_fastquant_for_pick = 0 ; sf -> no_skip_block4x4_search = 1 ; sf -> first_step = 0 ; sf -> max_step_search_steps = MAX_MVSEARCH_STEPS ; sf -> improved_mv_pred = 1 ; for ( i = 0 ; i < MAX_MODES ; i ++ ) sf -> thresh_mult [ i ] = 0 ; ref_frames = 1 ; if ( cpi -> ref_frame_flags & VP8_LAST_FRAME ) ref_frames ++ ; if ( cpi -> ref_frame_flags & VP8_GOLD_FRAME ) ref_frames ++ ; if ( cpi -> ref_frame_flags & VP8_ALTR_FRAME ) ref_frames ++ ; if ( Mode == 0 ) Speed = 0 ; else if ( Mode == 2 ) Speed = RT ( Speed ) ; else { if ( Speed > 5 ) Speed = 5 ; Speed = GOOD ( Speed ) ; } sf -> thresh_mult [ THR_ZERO1 ] = sf -> thresh_mult [ THR_NEAREST1 ] = sf -> thresh_mult [ THR_NEAR1 ] = sf

Fix:
<S2SV_ModStart> = 0 ; cpi -> mb. mbs_zero_last_dot_suppress = 0 ; <S2SV_ModStart> thresh_mult_map_split2 ) ; if ( ( cpi -> Speed <= 6 ) && ( cpi -> oxcf. number_of_layers > 1 ) && ( cpi -> ref_frame_flags & VP8_LAST_FRAME ) && ( cpi -> ref_frame_flags & VP8_GOLD_FRAME ) ) { if ( cpi -> closest_reference_frame == GOLDEN_FRAME ) { sf -> thresh_mult [ THR_ZERO2 ] = sf -> thresh_mult [ THR_ZERO2 ] >> 3 ; sf -> thresh_mult [ THR_NEAREST2 ] = sf -> thresh_mult [ THR_NEAREST2 ] >> 3 ; sf -> thresh_mult [ THR_NEAR2 ] = sf -> thresh_mult [ THR_NEAR2 ] >> 3 ; } else { sf -> thresh_mult [ THR_ZERO2 ] = sf -> thresh_mult [ THR_ZERO2 ] >> 1 ; sf -> thresh_mult [ THR_NEAREST2
Buggy code:
 NOEXPORT void print_cipher ( CLI * c ) { SSL_CIPHER * cipher ; # ifndef OPENSSL_NO_COMP const COMP_METHOD * compression, * expansion ; # endif if ( c -> opt -> log_level < LOG_INFO ) return ; s_log ( LOG_INFO, "TLS   %s:   %s", c -> opt -> option. client? "connected" : "accepted", SSL_session_reused ( c -> ssl ) &&! c -> flag. psk? "previous   session   reused" : "new   session   negotiated" ) ; cipher = ( SSL_CIPHER * ) SSL_get_current_cipher ( c -> ssl ) ; s_log ( LOG_INFO, "%s   ciphersuite:   %s   (%d-bit   encryption)", SSL_get_version ( c -> ssl ), SSL_CIPHER_get_name ( cipher ), SSL_CIPHER_get_bits ( cipher, NULL ) ) ; <START_BUG> # ifndef OPENSSL_NO_COMP <END_BUG> compression = SSL_get_current_compression ( c -> ssl ) ; expansion = SSL_get_current_expansion ( c -> ssl ) ; s_log ( compression || expansion? LOG_INFO : LOG_DEBUG, "Compression:   %s,   expansion:   %s", compression? SSL_COMP_get_name ( compression ) : "null", expansion? SSL_COMP_get_name ( expansion ) : "null" ) ; # endif }

Fix:
<S2SV_ModStart> ) ; # if OPENSSL_VERSION_NUMBER >= 0x10101000L print_tmp_key ( c -> ssl ) ; # endif #
Buggy code:
 int vp9_compute_qdelta_by_rate ( const RATE_CONTROL * rc, FRAME_TYPE frame_type, <START_BUG> int qindex, double rate_target_ratio ) { <END_BUG> int target_index = rc -> worst_quality ; int i ;  const int base_bits_per_mb = vp9_rc_bits_per_mb ( frame_type, qindex, 1.0 ) ; <START_BUG> const int target_bits_per_mb = ( int ) ( rate_target_ratio * base_bits_per_mb ) ; for ( i = rc -> best_quality ; i < rc -> worst_quality ; ++ i ) { <END_BUG> target_index = i ;  <START_BUG> if ( vp9_rc_bits_per_mb ( frame_type, i, 1.0 ) <= target_bits_per_mb ) <END_BUG> break ; } return target_index - qindex ; }

Fix:
<S2SV_ModStart>, double rate_target_ratio, vpx_bit_depth_t bit_depth <S2SV_ModStart> qindex, 1.0, bit_depth <S2SV_ModStart> i ) { <S2SV_ModEnd> if ( vp9_rc_bits_per_mb <S2SV_ModStart> i, 1.0, bit_depth <S2SV_ModStart> <= target_bits_per_mb ) { target_index = i ; break ; } <S2SV_ModEnd> } return target_index
Buggy code:
 <START_BUG> static unsigned int stack_maxrandom_size ( void ) <END_BUG> {  unsigned int max = 0 ; <START_BUG> if ( ( current -> flags & PF_RANDOMIZE ) &&! ( current -> personality & ADDR_NO_RANDOMIZE ) ) { <END_BUG> max = ( ( - 1U ) & STACK_RND_MASK ) << PAGE_SHIFT ;  } return max ; }

Fix:
<S2SV_ModStart> <S2SV_null> static unsigned long <S2SV_ModEnd> stack_maxrandom_size ( void <S2SV_ModStart> ) { unsigned long <S2SV_ModEnd> max = 0 <S2SV_ModStart> ( ( - 1UL <S2SV_ModEnd> ) & STACK_RND_MASK
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; one = 1 ; image = AcquireImage ( image_info, exception ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) {

Fix:
<S2SV_ModStart> size_t ) ldblk + 1
Buggy code:
 <START_BUG> static void cancel_att_send_op ( struct att_send_op * op ) <END_BUG> { if ( op -> destroy ) op -> destroy ( op -> user_data ) ; op -> user_data = NULL ; op -> callback = NULL ; op -> destroy = NULL ; }

Fix:
<S2SV_ModStart> void cancel_att_send_op ( void * data ) { <S2SV_ModStart> att_send_op * op = data ; <S2SV_ModEnd> if ( op
Buggy code:
 WORD32 ih264d_parse_inter_slice_data_cavlc ( dec_struct_t * ps_dec, dec_slice_params_t * ps_slice, UWORD16 u2_first_mb_in_slice ) { UWORD32 uc_more_data_flag ; WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2, u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_read_mb_type ; UWORD32 u1_mbaff ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end = 0 ; UWORD32 u1_tfr_n_mb = 0 ; UWORD32 u1_decode_nmb = 0 ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data = ps_dec -> ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD32 u1_mb_threshold ; WORD32 ret = OK ; if ( ps_slice -> u1_slice_type == P_SLICE ) { u1_inter_mb_type = P_MB ; u1_deblk_mb_type = D_INTER_MB ; u1_mb_threshold = 5 ; } else { u1_inter_mb_type = B_MB ; u1_deblk_mb_type = D_B_SLI

Fix:
<S2SV_ModStart> ps_cur_mb_info ) ; if (! uc_more_data_flag &&! i2_mb_skip_run && ( 0 == ( i2_cur_mb_addr & 1 ) ) ) { return ERROR_EOB_FLUSHBITS_T ; }
Buggy code:
 int ssl_hook_Access ( request_rec * r ) { SSLDirConfigRec * dc = myDirConfig ( r ) ; SSLSrvConfigRec * sc = mySrvConfig ( r -> server ) ; SSLConnRec * sslconn = myConnConfig ( r -> connection ) ; SSL * ssl = sslconn? sslconn -> ssl : NULL ; server_rec * handshakeserver = sslconn? sslconn -> server : NULL ; SSLSrvConfigRec * hssc = handshakeserver? mySrvConfig ( handshakeserver ) : NULL ; SSL_CTX * ctx = NULL ; apr_array_header_t * requires ; ssl_require_t * ssl_requires ; int ok, i ; BOOL renegotiate = FALSE, renegotiate_quick = FALSE ; X509 * cert ; X509 * peercert ; X509_STORE * cert_store = NULL ; X509_STORE_CTX * cert_store_ctx ; STACK_OF ( SSL_CIPHER ) * cipher_list_old = NULL, * cipher_list = NULL ; const SSL_CIPHER * cipher = NULL ; int depth, verify_old, verify, n, is_slave = 0 ; const char * ncipher_suite ; if (! ( sslconn && ssl ) && r -> connection -> master ) { sslconn = myConnConfig ( r -> connection -> master ) ; ssl = sslconn? sslconn -> ssl : NULL ; handshakeserver = sslconn? sslconn -> server : NULL ; hssc = handshakeserver? mySrvConfig ( handshakeserver ) : NULL ; is_slave = 1 ; } if ( ssl ) { if (! SSL_is_init_finished ( ssl ) ) { return HTTP_FORBIDDEN ; } ctx = SSL_get_SSL_CTX ( ssl ) ; } if ( dc -> bSSLRequired &&! ssl ) { if ( ( sc -> enabled == SSL_ENABLED_OPTIONAL ) &&! is_slave ) { apr_table_setn ( r -> err_headers_out, "Upgrade", "TLS//1.0,   HTTP//1.1" ) ; apr_table_setn ( r -> err_headers_out, "Connection", "Upgrade" ) ; return HTTP_UPGRADE_REQUIRED ; } ap_log_rerror

Fix:
<S2SV_ModStart> "verify-client" ) ; SSL_set_verify ( ssl, verify_old, ssl_callback_SSLVerify ) ;
Buggy code:
 static void renameColumnFunc ( sqlite3_context * context, int NotUsed, sqlite3_value * * argv ) { sqlite3 * db = sqlite3_context_db_handle ( context ) ; RenameCtx sCtx ; const char * zSql = ( const char * ) sqlite3_value_text ( argv [ 0 ] ) ; const char * zDb = ( const char * ) sqlite3_value_text ( argv [ 3 ] ) ; const char * zTable = ( const char * ) sqlite3_value_text ( argv [ 4 ] ) ; int iCol = sqlite3_value_int ( argv [ 5 ] ) ; const char * zNew = ( const char * ) sqlite3_value_text ( argv [ 6 ] ) ; int bQuote = sqlite3_value_int ( argv [ 7 ] ) ; int bTemp = sqlite3_value_int ( argv [ 8 ] ) ; const char * zOld ; int rc ; Parse sParse ; Walker sWalker ; Index * pIdx ; int i ; Table * pTab ; # ifndef SQLITE_OMIT_AUTHORIZATION sqlite3_xauth xAuth = db -> xAuth ; # endif UNUSED_PARAMETER ( NotUsed ) ; if ( zSql == 0 ) return ; if ( zTable == 0 ) return ; if ( zNew == 0 ) return ; if ( iCol < 0 ) return ; sqlite3BtreeEnterAll ( db ) ; pTab = sqlite3FindTable ( db, zTable, zDb ) ; if ( pTab == 0 || iCol >= pTab -> nCol ) { sqlite3BtreeLeaveAll ( db ) ; return ; } zOld = pTab -> aCol [ iCol ]. zName ; memset ( & sCtx, 0, sizeof ( sCtx ) ) ; sCtx. iCol = ( ( iCol == pTab -> iPKey )? - 1 : iCol ) ; # ifndef SQLITE_OMIT_AUTHORIZATION db -> xAuth = 0 ; # endif rc = renameParseSql ( & sParse, zDb, 0, db, zSql, bTemp ) ; memset ( & sWalker, 0, sizeof ( Walker ) ) ; sWalker. pParse = & sParse ; sWalker. xExprCallback = renameColumnExprCb ; sWalker. xSelectCallback = renameColumn

Fix:
<S2SV_ModStart> pSelect ) { pSelect -> selFlags &= ~ SF_View ; <S2SV_ModStart> & sParse, <S2SV_ModEnd> pSelect, 0
Buggy code:
 static int candidate_refresh_aq ( const CYCLIC_REFRESH * cr, const MB_MODE_INFO * mbmi, <START_BUG> BLOCK_SIZE bsize, int use_rd ) { <END_BUG> if ( use_rd ) { if ( cr -> projected_rate_sb < cr -> thresh_rate_sb ) return 1 ; else if ( bsize < cr -> min_block_size ||  ( mbmi -> mv [ 0 ]. as_int!= 0 && <START_BUG> <END_BUG> cr -> projected_dist_sb > cr -> thresh_dist_sb ) ||  <START_BUG>! is_inter_block ( mbmi ) ) <END_BUG> return 0 ; else return 1 ; } else {  if ( bsize < cr -> min_block_size || <START_BUG> <END_BUG> mbmi -> mv [ 0 ]. as_int!= 0 || ! is_inter_block ( mbmi ) ) return 0 ; else <START_BUG> return 1 ; <END_BUG> } }

Fix:
<S2SV_ModStart> * mbmi, int64_t rate, int64_t dist, int bsize ) { MV mv = <S2SV_ModEnd> mbmi -> mv <S2SV_ModStart> 0 ]. as_mv ; if ( dist <S2SV_ModEnd> > cr -> <S2SV_ModStart> cr -> thresh_dist_sb && ( mv. row > cr -> motion_thresh || mv. row < - cr -> motion_thresh || mv. col > cr -> motion_thresh || mv. col < - cr -> motion_thresh <S2SV_ModEnd> ||! is_inter_block <S2SV_ModStart> mbmi ) ) ) return CR_SEGMENT_ID_BASE ; else <S2SV_ModEnd> if ( bsize <S2SV_ModStart> if ( bsize >= BLOCK_16X16 && rate <S2SV_ModStart> < cr -> thresh_rate_sb && is_inter_block ( mbmi ) && <S2SV_ModEnd> mbmi -> mv <S2SV_ModStart> ]. as_int == 0 && cr -> rate_boost_fac > 10 ) return CR_SEGMENT_ID_BOOST2 <S2SV_ModEnd> ; else return <S2SV_ModStart> ; else return CR_SEGMENT_ID_BOOST1 ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 STATIC int xfs_attr_leaf_addname ( xfs_da_args_t * args ) { xfs_inode_t * dp ; struct xfs_buf * bp ; int retval, error, committed, forkoff ; trace_xfs_attr_leaf_addname ( args ) ; dp = args -> dp ; args -> blkno = 0 ; error = xfs_attr3_leaf_read ( args -> trans, args -> dp, args -> blkno, - 1, & bp ) ; if ( error ) return error ; retval = xfs_attr3_leaf_lookup_int ( bp, args ) ; if ( ( args -> flags & ATTR_REPLACE ) && ( retval == ENOATTR ) ) { xfs_trans_brelse ( args -> trans, bp ) ; return retval ; } else if ( retval == EEXIST ) { if ( args -> flags & ATTR_CREATE ) { xfs_trans_brelse ( args -> trans, bp ) ; return retval ; } trace_xfs_attr_leaf_replace ( args ) ; args -> op_flags |= XFS_DA_OP_RENAME ; args -> blkno2 = args -> blkno ; args -> index2 = args -> index ; args -> rmtblkno2 = args -> rmtblkno ; args -> rmtblkcnt2 = args -> rmtblkcnt ; <START_BUG> } <END_BUG> retval = xfs_attr3_leaf_add ( bp, args ) ; if ( retval == ENOSPC ) { xfs_bmap_init ( args -> flist, args -> firstblock ) ; error = xfs_attr3_leaf_to_node ( args ) ; if (! error ) { error = xfs_bmap_finish ( & args -> trans, args -> flist, & committed ) ; } if ( error ) { ASSERT ( committed ) ; args -> trans = NULL ; xfs_bmap_cancel ( args -> flist ) ; return ( error ) ; } if ( committed ) xfs_trans_ijoin ( args -> trans, dp, 0 ) ; error = xfs_trans_roll ( & args -> trans, dp ) ; if ( error ) return ( error ) ; error = xfs_attr_node_addname ( args ) ; return ( error ) ; } error = x

Fix:
<S2SV_ModStart> -> rmtblkcnt ; args -> rmtvaluelen2 = args -> rmtvaluelen ; args -> rmtblkno = 0 ; args -> rmtblkcnt = 0 ; args -> rmtvaluelen = 0 ; <S2SV_ModStart> -> rmtblkcnt2 ; args -> rmtvaluelen = args -> rmtvaluelen2 ;
Buggy code:
 bool_t dm9000IrqHandler ( NetInterface * interface ) { bool_t flag ; uint8_t status ; uint8_t mask ; Dm9000Context * context ; flag = FALSE ; context = ( Dm9000Context * ) interface -> nicContext ; <START_BUG> status = dm9000ReadReg ( DM9000_REG_ISR ) ; <END_BUG> if ( ( status & ISR_LNKCHG )!= 0 ) { mask = dm9000ReadReg ( DM9000_REG_IMR ) ;  dm9000WriteReg ( DM9000_REG_IMR, mask & ~ IMR_LNKCHGI ) ; <START_BUG> interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; } <END_BUG> if ( ( status & ISR_PT )!= 0 )  { if ( dm9000ReadReg ( DM9000_REG_NSR ) & ( NSR_TX2END | NSR_TX1END ) ) { if ( context -> queuedPackets > 0 ) { context -> queuedPackets -- ; } flag |= osSetEventFromIsr ( & interface -> nicTxEvent ) ; } <START_BUG> dm9000WriteReg ( DM9000_REG_ISR, ISR_PT ) ; <END_BUG> } if ( ( status & ISR_PR )!= 0 ) { mask = dm9000ReadReg ( DM9000_REG_IMR ) ;  dm9000WriteReg ( DM9000_REG_IMR, mask & ~ IMR_PRI ) ; <START_BUG> interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; } return flag ; }<END_BUG>

Fix:
<S2SV_ModStart> = dm9000ReadReg ( DM9000_ISR ) ; if ( ( status & DM9000_ISR_LNKCHG )!= 0 ) { mask = dm9000ReadReg ( DM9000_IMR <S2SV_ModEnd> ) ; dm9000WriteReg <S2SV_ModStart> ; dm9000WriteReg ( DM9000_IMR <S2SV_ModEnd>, mask & <S2SV_ModStart> mask & ~ DM9000_IMR_LNKCHGI <S2SV_ModEnd> ) ; interface <S2SV_ModStart> ( status & DM9000_ISR_PT )!= 0 ) { if ( ( dm9000ReadReg ( DM9000_NSR ) & ( DM9000_NSR_TX2END | DM9000_NSR_TX1END ) )!= 0 <S2SV_ModEnd> ) { if <S2SV_ModStart> } dm9000WriteReg ( DM9000_ISR, DM9000_ISR_PT ) ; } if ( ( status & DM9000_ISR_PR )!= 0 ) { mask = dm9000ReadReg ( DM9000_IMR <S2SV_ModEnd> ) ; dm9000WriteReg <S2SV_ModStart> ; dm9000WriteReg ( DM9000_IMR <S2SV_ModEnd>, mask & <S2SV_ModStart> mask & ~ DM9000_
Buggy code:
 int jffs2_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int rc, xprefix ; switch ( type ) { case ACL_TYPE_ACCESS : xprefix = JFFS2_XPREFIX_ACL_ACCESS ; if ( acl ) { <START_BUG> umode_t mode = inode -> i_mode ; <END_BUG>  rc = posix_acl_equiv_mode ( acl, & mode ) ; <START_BUG> if ( rc < 0 ) return rc ; if ( inode -> i_mode!= mode ) { struct iattr attr ; attr. ia_valid = ATTR_MODE | ATTR_CTIME ; attr. ia_mode = mode ; attr. ia_ctime = CURRENT_TIME_SEC ; rc = jffs2_do_setattr ( inode, & attr ) ; if ( rc < 0 ) return rc ; } <END_BUG> if ( rc == 0 )  acl = NULL ; } break ; case ACL_TYPE_DEFAULT : xprefix = JFFS2_XPREFIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } rc = __jffs2_set_acl ( inode, xprefix, acl ) ; if (! rc ) set_cached_acl ( inode, type, acl ) ; return rc ; }

Fix:
<S2SV_ModStart> { umode_t mode ; rc = posix_acl_update_mode ( inode <S2SV_ModEnd>, & mode <S2SV_ModStart>, & mode, & acl ) ; if ( rc <S2SV_ModEnd> ) return rc <S2SV_ModStart> rc ; } <S2SV_ModEnd> } break ;
Buggy code:
 bool copyaudiodata ( AFfilehandle infile, AFfilehandle outfile, int trackid ) { int frameSize = afGetVirtualFrameSize ( infile, trackid, 1 ) ; <START_BUG> const int kBufferFrameCount = 65536 ; <END_BUG>  void * buffer = malloc ( kBufferFrameCount * frameSize ) ; <START_BUG> AFframecount totalFrames = afGetFrameCount ( infile, AF_DEFAULT_TRACK ) ; AFframecount totalFramesWritten = 0 ; bool success = true ; while ( totalFramesWritten < totalFrames ) { AFframecount framesToRead = totalFrames - totalFramesWritten ; if ( framesToRead > kBufferFrameCount ) framesToRead = kBufferFrameCount ; AFframecount framesRead = afReadFrames ( infile, trackid, buffer, framesToRead ) ; if ( framesRead < framesToRead ) { fprintf ( stderr, "Bad   read   of   audio   track   data.\\n" ) ; success = false ; break ; } AFframecount framesWritten = afWriteFrames ( outfile, trackid, buffer, framesRead ) ; if ( framesWritten < framesRead ) { fprintf ( stderr, "Bad   write   of   audio   track   data.\\n" ) ; success = false ; break ; } totalFramesWritten += framesWritten ; } free ( buffer ) ; return success ; }<END_BUG>

Fix:
<S2SV_ModStart> 1 ) ; <S2SV_ModEnd> int kBufferFrameCount = <S2SV_ModStart> kBufferFrameCount = 65536 ; int bufferSize ; while ( multiplyCheckOverflow ( kBufferFrameCount, frameSize, & bufferSize ) ) kBufferFrameCount //= 2 <S2SV_ModStart> = malloc ( bufferSize <S2SV_ModEnd> ) ; AFframecount
Buggy code:
 static int kvm_vm_ioctl_set_pit ( struct kvm * kvm, struct kvm_pit_state * ps ) <START_BUG> { <END_BUG> mutex_lock ( & kvm -> arch. vpit -> pit_state. lock ) ; memcpy ( & kvm -> arch. vpit -> pit_state, ps, sizeof ( struct kvm_pit_state ) ) ;  kvm_pit_load_count ( kvm, 0, ps -> channels [ 0 ]. count, 0 ) ; <START_BUG> mutex_unlock ( & kvm -> arch. vpit -> pit_state. lock ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ps ) { int i ; <S2SV_ModStart> ) ) ; for ( i = 0 ; i < 3 ; i ++ ) <S2SV_ModStart> ( kvm, i <S2SV_ModEnd>, ps -> <S2SV_ModStart> -> channels [ i <S2SV_ModEnd> ]. count
Buggy code:
 int ParseRiffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { <START_BUG> int is_rf64 =! strncmp ( fourcc, "RF64", 4 ), got_ds64 = 0 ; <END_BUG> int64_t total_samples = 0, infilesize ; RiffChunkHeader riff_chunk_header ; ChunkHeader chunk_header ; WaveHeader WaveHeader ; DS64Chunk ds64_chunk ; uint32_t bcount ; CLEAR ( WaveHeader ) ; CLEAR ( ds64_chunk ) ; infilesize = DoGetFileSize ( infile ) ; if (! is_rf64 && infilesize >= 4294967296LL &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) ) { error_line ( "can\'t   handle  .WAV   files   larger   than   4   GB   (non-standard)!" ) ; return WAVPACK_SOFT_ERROR ; } memcpy ( & riff_chunk_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & riff_chunk_header ) + 4, sizeof ( RiffChunkHeader ) - 4, & bcount ) || bcount!= sizeof ( RiffChunkHeader ) - 4 || strncmp ( riff_chunk_header. formType, "WAVE", 4 ) ) ) { error_line ( "%s   is   not   a   valid  .WAV   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & riff_chunk_header, sizeof ( RiffChunkHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } while ( 1 ) { if (! DoReadFile ( infile, & chunk_header, sizeof ( ChunkHeader ), & bcount ) || bcount!= sizeof ( ChunkHeader ) ) { error_line ( "%s   is   not   a   valid  .WAV   file!", infilename ) ; return WAV

Fix:
<S2SV_ModStart> ), got_ds64 = 0, format_chunk <S2SV_ModStart>, format ; if ( format_chunk ++ ) { error_line ( "%s <S2SV_blank> is <S2SV_blank> not <S2SV_blank> a <S2SV_blank> valid <S2SV_blank>.WAV <S2SV_blank> file!", infilename ) ; return WAVPACK_SOFT_ERROR ; }
Buggy code:
 <START_BUG> static inline __u32 dccp_v6_init_sequence ( struct sk_buff * skb ) <END_BUG> { return secure_dccpv6_sequence_number ( ipv6_hdr ( skb ) -> daddr. s6_addr32, ipv6_hdr ( skb ) -> saddr. s6_addr32, dccp_hdr ( skb ) -> dccph_dport, dccp_hdr ( skb ) -> dccph_sport ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> static inline __u64 <S2SV_ModEnd> dccp_v6_init_sequence ( struct
Buggy code:
 static void cpStripToTile ( uint8 * out, uint8 * in, <START_BUG> uint32 rows, uint32 cols, int outskew, int inskew ) <END_BUG> { while ( rows -- > 0 ) { uint32 j = cols ; while ( j -- > 0 ) * out ++ = * in ++ ; out += outskew ; in += inskew ; } }

Fix:
<S2SV_ModStart> int outskew, int64 <S2SV_ModEnd> inskew ) {
Buggy code:
 int yr_execute_code ( YR_RULES * rules, YR_SCAN_CONTEXT * context, int timeout, time_t start_time ) { int64_t mem [ MEM_SIZE ] ; int32_t sp = 0 ; uint8_t * ip = rules -> code_start ; YR_VALUE args [ MAX_FUNCTION_ARGS ] ; YR_VALUE * stack ; YR_VALUE r1 ; YR_VALUE r2 ; YR_VALUE r3 ; # ifdef PROFILING_ENABLED YR_RULE * current_rule = NULL ; # endif YR_RULE * rule ; YR_MATCH * match ; YR_OBJECT_FUNCTION * function ; char * identifier ; char * args_fmt ; int i ; int found ; int count ; int result = ERROR_SUCCESS ; int stop = FALSE ; int cycle = 0 ; int tidx = context -> tidx ; int stack_size ; # ifdef PROFILING_ENABLED clock_t start = clock ( ) ; # endif yr_get_configuration ( YR_CONFIG_STACK_SIZE, ( void * ) & stack_size ) ; stack = ( YR_VALUE * ) yr_malloc ( stack_size * sizeof ( YR_VALUE ) ) ; if ( stack == NULL ) return ERROR_INSUFFICIENT_MEMORY ; while (! stop ) { switch ( * ip ) { case OP_HALT : assert ( sp == 0 ) ; stop = TRUE ; break ; case OP_PUSH : r1. i = * ( uint64_t * ) ( ip + 1 ) ; ip += sizeof ( uint64_t ) ; push ( r1 ) ; break ; case OP_POP : pop ( r1 ) ; break ; case OP_CLEAR_M : r1. i = * ( uint64_t * ) ( ip + 1 ) ; ip += sizeof ( uint64_t ) ; mem [ r1. i ] = 0 ; break ; case OP_ADD_M : r1. i = * ( uint64_t * ) ( ip + 1 ) ; ip += sizeof ( uint64_t ) ; pop ( r2 ) ; if (! is_undef ( r2 ) ) mem [ r1. i ] += r2. i ; break ; case OP_INCR_M : r1

Fix:
<S2SV_ModStart> -> length, 0,
Buggy code:
 ssize_t socket_bytes_available ( const socket_t * socket ) { assert ( socket!= NULL ) ; int size = 0 ; <START_BUG> if ( ioctl ( socket -> fd, FIONREAD, & size ) == - 1 ) <END_BUG> return - 1 ; return size ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & size )
Buggy code:
 static void Scale2D ( unsigned char * source, int source_pitch, unsigned int source_width, unsigned int source_height, unsigned char * dest, int dest_pitch, unsigned int dest_width, unsigned int dest_height, unsigned char * temp_area, unsigned char temp_area_height, unsigned int hscale, unsigned int hratio, unsigned int vscale, unsigned int vratio, unsigned int interlaced ) { int i, j, k ; int bands ; int dest_band_height ; int source_band_height ; typedef void ( * Scale1D ) ( const unsigned char * source, int source_step, unsigned int source_scale, unsigned int source_length, unsigned char * dest, int dest_step, unsigned int dest_scale, unsigned int dest_length ) ; Scale1D Scale1Dv = scale1d_c ; Scale1D Scale1Dh = scale1d_c ; void ( * horiz_line_scale ) ( const unsigned char *, unsigned int, unsigned char *, unsigned int ) = NULL ; void ( * vert_band_scale ) ( unsigned char *, unsigned int, unsigned char *, unsigned int, unsigned int ) = NULL ; int ratio_scalable = 1 ; int interpolation = 0 ; unsigned char * source_base ; unsigned char * line_src ; source_base = ( unsigned char * ) source ; if ( source_pitch < 0 ) { int offset ; offset = ( source_height - 1 ) ; offset *= source_pitch ; source_base += offset ; } switch ( hratio * 10 // hscale ) { case 8 : horiz_line_scale = vp8_horizontal_line_5_4_scale ; break ; case 6 : horiz_line_scale = vp8_horizontal_line_5_3_scale ; break ; case 5 : horiz_line_scale = vp8_horizontal_line_2_1_scale ; break ; default : ratio_scalable = 0 ; break ; } switch ( vratio * 10 // vscale ) { case 8 : vert_band_scale = vp8_vertical_band_5_4_scale ; source_band_height = 5 ; dest_band_height = 4 ; break ; case 6 : vert_band_scale = vp8_vertical_band_5_3_scale ;

Fix:
<S2SV_ModStart> ( interpolation ) memcpy <S2SV_ModEnd> ( temp_area, <S2SV_ModStart> } else { memcpy <S2SV_ModEnd> ( temp_area + <S2SV_ModStart> ) ; } memcpy <S2SV_ModEnd> ( temp_area,
Buggy code:
 error_t tcpCheckSeqNum ( Socket * socket, TcpHeader * segment, size_t length ) { bool_t acceptable = FALSE ; if (! length &&! socket -> rcvWnd ) { if ( segment -> seqNum == socket -> rcvNxt ) { acceptable = TRUE ; } } else if (! length && socket -> rcvWnd ) { if ( TCP_CMP_SEQ ( segment -> seqNum, socket -> rcvNxt ) >= 0 && TCP_CMP_SEQ ( segment -> seqNum, socket -> rcvNxt + socket -> rcvWnd ) < 0 ) { acceptable = TRUE ; } } else if ( length && socket -> rcvWnd ) { if ( TCP_CMP_SEQ ( segment -> seqNum, socket -> rcvNxt ) >= 0 && TCP_CMP_SEQ ( segment -> seqNum, socket -> rcvNxt + socket -> rcvWnd ) < 0 ) { acceptable = TRUE ; } else if ( TCP_CMP_SEQ ( segment -> seqNum + length - 1, socket -> rcvNxt ) >= 0 && TCP_CMP_SEQ ( segment -> seqNum + length - 1, socket -> rcvNxt + socket -> rcvWnd ) < 0 ) { acceptable = TRUE ; } } if (! acceptable ) { TRACE_WARNING ( "Sequence   number   is   not   acceptable!\\r\\n" ) ; if (! ( segment -> flags & TCP_FLAG_RST ) ) <START_BUG> tcpSendSegment ( socket, TCP_FLAG_ACK, socket -> sndNxt, socket -> rcvNxt, 0, FALSE ) ; <END_BUG> return ERROR_FAILURE ; } return NO_ERROR ; }

Fix:
<S2SV_ModStart> TCP_FLAG_RST ) ) { <S2SV_ModStart> FALSE ) ; }
Buggy code:
 static int airspy_probe ( struct usb_interface * intf, const struct usb_device_id * id ) { struct airspy * s ; int ret ; u8 u8tmp, buf [ BUF_SIZE ] ; s = kzalloc ( sizeof ( struct airspy ), GFP_KERNEL ) ; if ( s == NULL ) { dev_err ( & intf -> dev, "Could   not   allocate   memory   for   state\\n" ) ; return - ENOMEM ; } mutex_init ( & s -> v4l2_lock ) ; mutex_init ( & s -> vb_queue_lock ) ; spin_lock_init ( & s -> queued_bufs_lock ) ; INIT_LIST_HEAD ( & s -> queued_bufs ) ; s -> dev = & intf -> dev ; s -> udev = interface_to_usbdev ( intf ) ; s -> f_adc = bands [ 0 ]. rangelow ; s -> f_rf = bands_rf [ 0 ]. rangelow ; s -> pixelformat = formats [ 0 ]. pixelformat ; s -> buffersize = formats [ 0 ]. buffersize ; ret = airspy_ctrl_msg ( s, CMD_BOARD_ID_READ, 0, 0, & u8tmp, 1 ) ; if ( ret == 0 ) ret = airspy_ctrl_msg ( s, CMD_VERSION_STRING_READ, 0, 0, buf, BUF_SIZE ) ; if ( ret ) { dev_err ( s -> dev, "Could   not   detect   board\\n" ) ; goto err_free_mem ; } buf [ BUF_SIZE - 1 ] = '\\0' ; dev_info ( s -> dev, "Board   ID:   %02x\\n", u8tmp ) ; dev_info ( s -> dev, "Firmware   version:   %s\\n", buf ) ; s -> vb_queue. type = V4L2_BUF_TYPE_SDR_CAPTURE ; s -> vb_queue. io_modes = VB2_MMAP | VB2_USERPTR | VB2_READ ; s -> vb_queue. drv_priv = s ; s -> vb_queue. buf_struct_size = sizeof ( struct airspy_

Fix:
<S2SV_ModStart> ) ; goto err_free_controls <S2SV_ModEnd> ; } dev_info <S2SV_ModStart> hdl ) ; <S2SV_ModEnd> v4l2_device_unregister ( &
Buggy code:
 int crypto_reportstat ( struct sk_buff * in_skb, struct nlmsghdr * in_nlh, struct nlattr * * attrs ) { struct net * net = sock_net ( in_skb -> sk ) ; struct crypto_user_alg * p = nlmsg_data ( in_nlh ) ; struct crypto_alg * alg ; struct sk_buff * skb ; struct crypto_dump_info info ; int err ; if (! null_terminated ( p -> cru_name ) ||! null_terminated ( p -> cru_driver_name ) ) return - EINVAL ; alg = crypto_alg_match ( p, 0 ) ; if (! alg ) return - ENOENT ; err = - ENOMEM ; skb = nlmsg_new ( NLMSG_DEFAULT_SIZE, GFP_ATOMIC ) ; if (! skb ) goto drop_alg ; info. in_skb = in_skb ; info. out_skb = skb ; info. nlmsg_seq = in_nlh -> nlmsg_seq ; info. nlmsg_flags = 0 ; err = crypto_reportstat_alg ( alg, & info ) ; drop_alg : crypto_mod_put ( alg ) ; if ( err ) <START_BUG> return err ; <END_BUG> return nlmsg_unicast ( net -> crypto_nlsk, skb, NETLINK_CB ( in_skb ). portid ) ; }

Fix:
<S2SV_ModStart> ( err ) { kfree_skb ( skb ) ; return err ; } <S2SV_ModEnd> return nlmsg_unicast (
Buggy code:
 jp2_box_t * jp2_box_get ( jas_stream_t * in ) { jp2_box_t * box ; jp2_boxinfo_t * boxinfo ; jas_stream_t * tmpstream ; uint_fast32_t len ; uint_fast64_t extlen ; bool dataflag ; box = 0 ; tmpstream = 0 ; if (! ( box = jas_malloc ( sizeof ( jp2_box_t ) ) ) ) { goto error ; } box -> ops = & jp2_boxinfo_unk. ops ; if ( jp2_getuint32 ( in, & len ) || jp2_getuint32 ( in, & box -> type ) ) { goto error ; } boxinfo = jp2_boxinfolookup ( box -> type ) ; box -> info = boxinfo ; box -> ops = & boxinfo -> ops ; <START_BUG> box -> len = len ; <END_BUG> if ( box -> len == 1 ) { if ( jp2_getuint64 ( in, & extlen ) ) { goto error ; } if ( extlen > 0xffffffffUL ) { jas_eprintf ( "warning:   cannot   handle   large   64-bit   box   length\\n" ) ; extlen = 0xffffffffUL ; } box -> len = extlen ; box -> datalen = extlen - JP2_BOX_HDRLEN ( true ) ; } else { box -> datalen = box -> len - JP2_BOX_HDRLEN ( false ) ; } if ( box -> len!= 0 && box -> len < 8 ) { goto error ; } dataflag =! ( box -> info -> flags & ( JP2_BOX_SUPER | JP2_BOX_NODATA ) ) ; if ( dataflag ) { if (! ( tmpstream = jas_stream_memopen ( 0, 0 ) ) ) { goto error ; } if ( jas_stream_copy ( tmpstream, in, box -> datalen ) ) {  jas_eprintf ( "cannot   copy   box   data\\n" ) ; <START_BUG> goto error ; } jas_stream_rewind ( tmpstream ) ; if ( box -> ops -> getdata ) { if ( ( * box -> ops -> getdata ) ( box, tmpstream ) )<END_BUG>

Fix:
<S2SV_ModStart> len = len ; JAS_DBGLOG ( 10, ( "preliminary <S2SV_blank> processing <S2SV_blank> of <S2SV_blank> JP2 <S2SV_blank> box: <S2SV_blank> type=%c%s%c <S2SV_blank> (0x%08x); <S2SV_blank> length=%d\\n", \'"\', boxinfo -> name, \'"\', box -> type, box -> len ) ) <S2SV_ModStart> ) ) { box -> ops = & jp2_boxinfo_unk. ops ;