nus-yam/ex-repair huggingface dataset:
Buggy code:
 int usbip_recv_xbuff ( struct usbip_device * ud, struct urb * urb ) { int ret ; int size ; if ( ud -> side == USBIP_STUB ) { if ( usb_pipein ( urb -> pipe ) ) return 0 ; size = urb -> transfer_buffer_length ; } else { if ( usb_pipeout ( urb -> pipe ) ) return 0 ; size = urb -> actual_length ; } if (! ( size > 0 ) ) return 0 ; <START_BUG> ret = usbip_recv ( ud -> tcp_socket, urb -> transfer_buffer, size ) ; <END_BUG> if ( ret!= size ) { dev_err ( & urb -> dev -> dev, "recv   xbuf,   %d\\n", ret ) ; if ( ud -> side == USBIP_STUB ) { usbip_event_add ( ud, SDEV_EVENT_ERROR_TCP ) ;  } else { <START_BUG> usbip_event_add ( ud, VDEV_EVENT_ERROR_TCP ) ; return - EPIPE ; } } <END_BUG> return ret ;  }

Fix:
<S2SV_ModStart> return 0 ; if ( size > urb -> transfer_buffer_length ) { <S2SV_ModEnd> if ( ud <S2SV_ModStart> SDEV_EVENT_ERROR_TCP ) ; return 0 ; <S2SV_ModStart> ; } } ret = usbip_recv ( ud -> tcp_socket, urb -> transfer_buffer, size ) ; if ( ret!= size ) { dev_err ( & urb -> dev -> dev, "recv <S2SV_blank> xbuf, <S2SV_blank> %d\\n", ret ) ; if ( ud -> side == USBIP_STUB ) { usbip_event_add ( ud, SDEV_EVENT_ERROR_TCP ) ; } else { usbip_event_add ( ud, VDEV_EVENT_ERROR_TCP ) ; return - EPIPE ; } }
Buggy code:
 static CURLcode imap_parse_url_path ( struct connectdata * conn ) { struct imap_conn * imapc = & conn -> proto. imapc ; struct SessionHandle * data = conn -> data ; const char * path = data -> state. path ; <START_BUG> int len ; <END_BUG> if (! * path ) path = "INBOX" ;  imapc -> mailbox = curl_easy_unescape ( data, path, 0, & len ) ; <START_BUG> <END_BUG> if (! imapc -> mailbox )  return CURLE_OUT_OF_MEMORY ; return CURLE_OK ; }

Fix:
<S2SV_ModStart>. path ; <S2SV_ModEnd> if (! <S2SV_ModStart> = "INBOX" ; return Curl_urldecode <S2SV_ModEnd> ( data, <S2SV_ModStart> 0, & <S2SV_ModEnd> imapc -> mailbox <S2SV_ModStart> imapc -> mailbox, NULL, TRUE ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int bmp_validate ( jas_stream_t * in ) { int n ; int i ; <START_BUG> uchar buf [ 2 ] ; <END_BUG> assert ( JAS_STREAM_MAXPUTBACK >= 2 ) ; if ( ( n = jas_stream_read ( in, ( char * ) buf, 2 ) ) < 0 ) { return - 1 ; } for ( i = n - 1 ; i >= 0 ; -- i ) { if ( jas_stream_ungetc ( in, buf [ i ] ) == EOF ) { return - 1 ; } } if ( n < 2 ) { return - 1 ; } if ( buf [ 0 ] == ( BMP_MAGIC & 0xff ) && buf [ 1 ] == ( BMP_MAGIC >> 8 ) ) { return 0 ; } return - 1 ; }

Fix:
<S2SV_ModStart> int i ; jas_uchar <S2SV_ModEnd> buf [ 2
Buggy code:
 int git_delta_apply ( void * * out, size_t * out_len, const unsigned char * base, size_t base_len, const unsigned char * delta, size_t delta_len ) { const unsigned char * delta_end = delta + delta_len ; size_t base_sz, res_sz, alloc_sz ; unsigned char * res_dp ; * out = NULL ; * out_len = 0 ; if ( ( hdr_sz ( & base_sz, & delta, delta_end ) < 0 ) || ( base_sz!= base_len ) ) { giterr_set ( GITERR_INVALID, "failed   to   apply   delta:   base   size   does   not   match   given   data" ) ; return - 1 ; } if ( hdr_sz ( & res_sz, & delta, delta_end ) < 0 ) { giterr_set ( GITERR_INVALID, "failed   to   apply   delta:   base   size   does   not   match   given   data" ) ; return - 1 ; } GITERR_CHECK_ALLOC_ADD ( & alloc_sz, res_sz, 1 ) ; res_dp = git__malloc ( alloc_sz ) ; GITERR_CHECK_ALLOC ( res_dp ) ; res_dp [ res_sz ] = '\\0' ; * out = res_dp ; * out_len = res_sz ; while ( delta < delta_end ) { unsigned char cmd = * delta ++ ; if ( cmd & 0x80 ) { size_t off = 0, len = 0 ; if ( cmd & 0x01 ) off = * delta ++ ; if ( cmd & 0x02 ) off |= * delta ++ << 8UL ; if ( cmd & 0x04 ) off |= * delta ++ << 16UL ; <START_BUG> if ( cmd & 0x08 ) off |= * delta ++ << 24UL ; <END_BUG> if ( cmd & 0x10 ) len = * delta ++ ; if ( cmd & 0x20 ) len |= * delta ++ << 8UL ; if ( cmd & 0x40 ) len |= * delta ++ << 16UL ; if (! len ) len = 0x10000 ; if ( base_len < off + len || res_sz < len ) goto fail ; memcpy ( res_dp, base

Fix:
<S2SV_ModStart> ) off |= ( ( unsigned ) <S2SV_ModStart> ++ << 24UL )
Buggy code:
 char * suhosin_decrypt_single_cookie ( char * name, int name_len, char * value, int value_len, char * key, char * * where TSRMLS_DC ) { <START_BUG> char buffer [ 4096 ] ; <END_BUG> char buffer2 [ 4096 ] ; int o_name_len = name_len ;  char * buf = buffer, * buf2 = buffer2, * d, * d_url ; <START_BUG> int l ; <END_BUG> if ( name_len > sizeof ( buffer ) - 2 ) {  buf = estrndup ( name, name_len ) ; <START_BUG> } else { <END_BUG> memcpy ( buf, name, name_len ) ; buf [ name_len ] = 0 ; } name_len = php_url_decode ( buf, name_len ) ; normalize_varname ( buf ) ; name_len = strlen ( buf ) ; if ( SUHOSIN_G ( cookie_plainlist ) ) { if ( zend_hash_exists ( SUHOSIN_G ( cookie_plainlist ), buf, name_len + 1 ) ) { decrypt_return_plain :  if ( buf!= buffer ) { <START_BUG> efree ( buf ) ; } memcpy ( * where, name, o_name_len ) ; * where += o_name_len ; * * where = '=' ; * where += 1 ; memcpy ( * where, value, value_len ) ; * where += value_len ; return * where ; } } else if ( SUHOSIN_G ( cookie_cryptlist ) ) { if (! zend_hash_exists ( SUHOSIN_G ( cookie_cryptlist ), buf, name_len + 1 ) ) { goto decrypt_return_plain ; } } <END_BUG> if ( strlen ( value ) <= sizeof ( buffer2 ) - 2 ) {  memcpy ( buf2, value, value_len ) ; buf2 [ value_len ] = 0 ; } else { buf2 = estrndup ( value, value_len ) ; } value_len = php_url_decode ( buf2, value_len ) ; d = suhosin_decrypt_string ( buf2, value_len, buf, name_len, key, & l, SUHOSIN_G ( cookie_checkraddr ) TSRML

Fix:
<S2SV_ModStart> TSRMLS_DC ) { <S2SV_ModEnd> int o_name_len = <S2SV_ModStart> char * buf, * buf2 <S2SV_ModEnd>, * d <S2SV_ModStart> int l ; <S2SV_ModEnd> buf = estrndup <S2SV_ModStart> name_len ) ; <S2SV_ModEnd> name_len = php_url_decode <S2SV_ModStart> { decrypt_return_plain : efree ( buf ) ; <S2SV_ModEnd> memcpy ( * <S2SV_ModStart> ; } } buf2 = estrndup ( value, value_len ) ; <S2SV_ModEnd> value_len = php_url_decode <S2SV_ModStart> ; skip_cookie : efree ( buf ) ; efree ( buf2 ) ; <S2SV_ModEnd> return * where
Buggy code:
 static void <START_BUG> l2tp_framing_type_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint32_t * ptr = ( const uint32_t * ) dat ; <START_BUG> if ( EXTRACT_32BITS ( ptr ) & L2TP_FRAMING_TYPE_ASYNC_MASK ) { ND_PRINT ( ( ndo, "A" ) ) ; } if ( EXTRACT_32BITS ( ptr ) & L2TP_FRAMING_TYPE_SYNC_MASK ) { ND_PRINT ( ( ndo, "S" ) ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 static unsigned int do_encrypt ( const RIJNDAEL_context * ctx, unsigned char * bx, const unsigned char * ax ) { # ifdef USE_AMD64_ASM return _gcry_aes_amd64_encrypt_block ( ctx -> keyschenc, bx, ax, ctx -> rounds, <START_BUG> encT ) ; <END_BUG> # elif defined ( USE_ARM_ASM )  return _gcry_aes_arm_encrypt_block ( ctx -> keyschenc, bx, ax, ctx -> rounds, encT ) ; <START_BUG> # else return do_encrypt_fn ( ctx, bx, ax ) ; # endif }<END_BUG>

Fix:
<S2SV_ModStart> -> rounds, enc_tables. T <S2SV_ModEnd> ) ; # <S2SV_ModStart> -> rounds, enc_tables. T <S2SV_ModEnd> ) ; #
Buggy code:
 static int do_last ( struct nameidata * nd, struct file * file, const struct open_flags * op ) { <START_BUG> struct dentry * dir = nd -> path. dentry ; <END_BUG> int open_flag = op -> open_flag ; bool will_truncate = ( open_flag & O_TRUNC )!= 0 ; bool got_write = false ; int acc_mode = op -> acc_mode ; unsigned seq ; struct inode * inode ; struct path path ; int error ; nd -> flags &= ~ LOOKUP_PARENT ; nd -> flags |= op -> intent ; if ( nd -> last_type!= LAST_NORM ) { error = handle_dots ( nd, nd -> last_type ) ; if ( unlikely ( error ) ) return error ; goto finish_open ; } if (! ( open_flag & O_CREAT ) ) { if ( nd -> last. name [ nd -> last. len ] ) nd -> flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY ; error = lookup_fast ( nd, & path, & inode, & seq ) ; if ( likely ( error > 0 ) ) goto finish_lookup ; if ( error < 0 ) return error ; BUG_ON ( nd -> inode!= dir -> d_inode ) ; BUG_ON ( nd -> flags & LOOKUP_RCU ) ; } else { error = complete_walk ( nd ) ; if ( error ) return error ; audit_inode ( nd -> name, dir, AUDIT_INODE_PARENT ) ; if ( unlikely ( nd -> last. name [ nd -> last. len ] ) ) return - EISDIR ; } if ( open_flag & ( O_CREAT | O_TRUNC | O_WRONLY | O_RDWR ) ) { error = mnt_want_write ( nd -> path. mnt ) ; if (! error ) got_write = true ; } if ( open_flag & O_CREAT ) inode_lock ( dir -> d_inode ) ; else inode_lock_shared ( dir -> d_inode ) ; error = lookup_open ( nd, & path, file, op, got_write ) ; if ( open_flag & O_CREAT ) inode_unlock ( dir -> d_inode ) ; else inode_unlock_shared ( dir -> d_inode ) ;

Fix:
<S2SV_ModStart> path. dentry ; kuid_t dir_uid = dir -> d_inode -> i_uid ; umode_t dir_mode = dir -> d_inode -> i_mode <S2SV_ModStart> = may_create_in_sticky ( dir_mode, dir_uid <S2SV_ModEnd>, d_backing_inode (
Buggy code:
 static char * fstrndup ( const char * ptr, unsigned long len ) { char * result ; if ( len <= 0 ) return NULL ; result = ALLOC_N ( char, len ) ; <START_BUG> memccpy ( result, ptr, 0, len ) ; <END_BUG> return result ; }

Fix:
<S2SV_ModStart> len ) ; memcpy <S2SV_ModEnd> ( result, <S2SV_ModStart> result, ptr <S2SV_ModEnd>, len )
Buggy code:
 static stmt_ty ast_for_async_funcdef ( struct compiling * c, const node * n, asdl_seq * decorator_seq ) { REQ ( n, async_funcdef ) ; <START_BUG> REQ ( CHILD ( n, 0 ), ASYNC ) ; <END_BUG> REQ ( CHILD ( n, 1 ), funcdef ) ;  return ast_for_funcdef_impl ( c, CHILD ( n, 1 ), decorator_seq, <START_BUG> <END_BUG> 1 ) ;  }

Fix:
<S2SV_ModStart> 0 ), NAME ) ; assert ( strcmp ( STR ( CHILD ( n, 0 ) ), "async" ) == 0 <S2SV_ModEnd> ) ; REQ <S2SV_ModStart> ( c, n <S2SV_ModEnd>, decorator_seq, <S2SV_ModStart>, decorator_seq, true <S2SV_ModEnd> ) ; }
Buggy code:
 static void l2tp_result_code_print ( netdissect_options * ndo, const u_char * dat, u_int length ) { const uint16_t * ptr = ( const uint16_t * ) dat ; <START_BUG> ND_PRINT ( ( ndo, "%u", EXTRACT_16BITS ( ptr ) ) ) ; ptr ++ ; <END_BUG>  if ( length > 2 ) { <START_BUG> ND_PRINT ( ( ndo, "//%u", EXTRACT_16BITS ( ptr ) ) ) ; ptr ++ ; <END_BUG> }  <START_BUG> if ( length > 4 ) { <END_BUG> ND_PRINT ( ( ndo, "   " ) ) ;  print_string ( ndo, ( const u_char * ) ptr, length - 4 ) ; <START_BUG> } <END_BUG> } 

Fix:
<S2SV_ModStart> ) dat ; if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } <S2SV_ModStart> ; ptr ++ ; length -= 2 <S2SV_ModStart> if ( length == 0 ) return ; if ( length < <S2SV_ModEnd> 2 ) { <S2SV_ModStart> 2 ) { ND_PRINT ( ( ndo, " <S2SV_blank> AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } <S2SV_ModStart> ptr ++ ; length -= 2 ; <S2SV_ModEnd> if ( length <S2SV_ModStart> if ( length == 0 ) return ; <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ptr, length <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int next_state_class ( CClassNode * cc, OnigCodePoint * vs, enum CCVALTYPE * type, enum CCSTATE * state, ScanEnv * env ) { int r ; if ( * state == CCS_RANGE ) return ONIGERR_CHAR_CLASS_VALUE_AT_END_OF_RANGE ; if ( * state == CCS_VALUE && * type!= CCV_CLASS ) { if ( * type == CCV_SB ) BITSET_SET_BIT ( cc -> bs, ( int ) ( * vs ) ) ; else if ( * type == CCV_CODE_POINT ) { r = add_code_range ( & ( cc -> mbuf ), env, * vs, * vs ) ; if ( r < 0 ) return r ; } } <START_BUG> * state = CCS_VALUE ; <END_BUG> * type = CCV_CLASS ; return 0 ; }

Fix:
<S2SV_ModStart> ; } } if ( * state!= CCS_START )
Buggy code:
 <START_BUG> static int ion_handle_put ( struct ion_handle * handle ) <END_BUG> { struct ion_client * client = handle -> client ; int ret ; mutex_lock ( & client -> lock ) ;  ret = kref_put ( & handle -> ref, ion_handle_destroy ) ; <START_BUG> mutex_unlock ( & client -> lock ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> int ion_handle_put ( <S2SV_ModStart> ; ret = ion_handle_put_nolock ( handle <S2SV_ModEnd> ) ; mutex_unlock
Buggy code:
 INTERNAL void vterm_allocator_free ( VTerm * vt, void * ptr ) <START_BUG> { <END_BUG> ( * vt -> allocator -> free ) ( ptr, vt -> allocdata ) ; }

Fix:
<S2SV_ModStart> ptr ) { if ( ptr )
Buggy code:
 static int vsock_stream_recvmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk ; struct vsock_sock * vsk ; int err ; size_t target ; ssize_t copied ; long timeout ; struct vsock_transport_recv_notify_data recv_data ; DEFINE_WAIT ( wait ) ; sk = sock -> sk ; vsk = vsock_sk ( sk ) ; err = 0 ; <START_BUG> lock_sock ( sk ) ; <END_BUG> if ( sk -> sk_state!= SS_CONNECTED ) { if ( sock_flag ( sk, SOCK_DONE ) ) err = 0 ; else err = - ENOTCONN ; goto out ; } if ( flags & MSG_OOB ) { err = - EOPNOTSUPP ; goto out ; } if ( sk -> sk_shutdown & RCV_SHUTDOWN ) { err = 0 ; goto out ; } if (! len ) { err = 0 ; goto out ; } target = sock_rcvlowat ( sk, flags & MSG_WAITALL, len ) ; if ( target >= transport -> stream_rcvhiwat ( vsk ) ) { err = - ENOMEM ; goto out ; } timeout = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; copied = 0 ; err = transport -> notify_recv_init ( vsk, target, & recv_data ) ; if ( err < 0 ) goto out ; prepare_to_wait ( sk_sleep ( sk ), & wait, TASK_INTERRUPTIBLE ) ; while ( 1 ) { s64 ready = vsock_stream_has_data ( vsk ) ; if ( ready < 0 ) { err = - ENOMEM ; goto out_wait ; } else if ( ready > 0 ) { ssize_t read ; err = transport -> notify_recv_pre_dequeue ( vsk, target, & recv_data ) ; if ( err < 0 ) break ; read = transport -> stream_dequeue ( vsk, msg -> msg_iov, len - copied, flags ) ; if ( read < 0 ) { err = - ENOMEM ; break ; } copied += read ; err = transport -> notify_recv_post_dequeue ( vsk, target, read

Fix:
<S2SV_ModStart> = 0 ; msg -> msg_namelen = 0 ;
Buggy code:
 void lzxd_free ( struct lzxd_stream * lzx ) { struct mspack_system * sys ; if ( lzx ) { sys = lzx -> sys ; <START_BUG> sys -> free ( lzx -> inbuf ) ; <END_BUG> sys -> free ( lzx -> window ) ; sys -> free ( lzx ) ; } }

Fix:
<S2SV_ModStart> -> sys ; if ( lzx -> inbuf ) <S2SV_ModStart> inbuf ) ; if ( lzx -> window )
Buggy code:
 static Image * ExtractPostscript ( Image * image, const ImageInfo * image_info, MagickOffsetType PS_Offset, ssize_t PS_Size, ExceptionInfo * exception ) { char postscript_file [ MaxTextExtent ] ; const MagicInfo * magic_info ; FILE * ps_file ; ImageInfo * clone_info ; Image * image2 ; unsigned char magick [ 2 * MaxTextExtent ] ; if ( ( clone_info = CloneImageInfo ( image_info ) ) == NULL ) return ( image ) ; clone_info -> blob = ( void * ) NULL ; clone_info -> length = 0 ; ( void ) AcquireUniqueFilename ( postscript_file ) ; ps_file = fopen_utf8 ( postscript_file, "wb" ) ; if ( ps_file == ( FILE * ) NULL ) goto FINISH ; ( void ) SeekBlob ( image, PS_Offset, SEEK_SET ) ; ( void ) ReadBlob ( image, 2 * MaxTextExtent, magick ) ; ( void ) SeekBlob ( image, PS_Offset, SEEK_SET ) ; while ( PS_Size -- > 0 ) { ( void ) fputc ( ReadBlobByte ( image ), ps_file ) ; } ( void ) fclose ( ps_file ) ; magic_info = GetMagicInfo ( magick, 2 * MaxTextExtent, exception ) ; if ( magic_info == ( const MagicInfo * ) NULL ) goto FINISH_UNL ; if ( exception -> severity!= UndefinedException ) goto FINISH_UNL ; if ( magic_info -> name == ( char * ) NULL ) goto FINISH_UNL ; <START_BUG> ( void ) strncpy ( clone_info -> magick, magic_info -> name, MaxTextExtent ) ; <END_BUG> FormatLocaleString ( clone_info -> filename, MaxTextExtent, "%s", postscript_file ) ; image2 = ReadImage ( clone_info, exception ) ; if (! image2 ) goto FINISH_UNL ; ( void ) CopyMagickString ( image2 -> filename, image -> filename, MaxTextExtent ) ; ( void ) CopyMagickString ( image2 -> magick_filename, image -> magick_filename, MaxTextExtent ) ; ( void ) CopyMagickString ( image2 -> magick, image -> magick, MaxTextExtent ) ; image2 -> depth = image -> depth

Fix:
<S2SV_ModStart> name, MaxTextExtent - 1
Buggy code:
 static int do_anonymous_page ( struct mm_struct * mm, struct vm_area_struct * vma, unsigned long address, pte_t * page_table, pmd_t * pmd, unsigned int flags ) { struct mem_cgroup * memcg ; struct page * page ; spinlock_t * ptl ; pte_t entry ; pte_unmap ( page_table ) ; <START_BUG> if ( check_stack_guard_page ( vma, address ) < 0 ) <END_BUG> return VM_FAULT_SIGSEGV ; if (! ( flags & FAULT_FLAG_WRITE ) &&! mm_forbids_zeropage ( mm ) ) { entry = pte_mkspecial ( pfn_pte ( my_zero_pfn ( address ), vma -> vm_page_prot ) ) ; page_table = pte_offset_map_lock ( mm, pmd, address, & ptl ) ; if (! pte_none ( * page_table ) ) goto unlock ; goto setpte ; } if ( unlikely ( anon_vma_prepare ( vma ) ) ) goto oom ; page = alloc_zeroed_user_highpage_movable ( vma, address ) ; if (! page ) goto oom ; if ( mem_cgroup_try_charge ( page, mm, GFP_KERNEL, & memcg ) ) goto oom_free_page ; __SetPageUptodate ( page ) ; entry = mk_pte ( page, vma -> vm_page_prot ) ; if ( vma -> vm_flags & VM_WRITE ) entry = pte_mkwrite ( pte_mkdirty ( entry ) ) ; page_table = pte_offset_map_lock ( mm, pmd, address, & ptl ) ; if (! pte_none ( * page_table ) ) goto release ; inc_mm_counter_fast ( mm, MM_ANONPAGES ) ; page_add_new_anon_rmap ( page, vma, address ) ; mem_cgroup_commit_charge ( page, memcg, false ) ; lru_cache_add_active_or_unevictable ( page, vma ) ; setpte : set_pte_at ( mm

Fix:
<S2SV_ModStart> ; if ( vma -> vm_flags & VM_SHARED ) return VM_FAULT_SIGBUS ; if (
Buggy code:
 static int kvm_vm_ioctl_set_pit2 ( struct kvm * kvm, struct kvm_pit_state2 * ps ) { <START_BUG> int start = 0 ; <END_BUG> u32 prev_legacy, cur_legacy ; mutex_lock ( & kvm -> arch. vpit -> pit_state. lock ) ; prev_legacy = kvm -> arch. vpit -> pit_state. flags & KVM_PIT_FLAGS_HPET_LEGACY ; cur_legacy = ps -> flags & KVM_PIT_FLAGS_HPET_LEGACY ; if (! prev_legacy && cur_legacy ) start = 1 ; memcpy ( & kvm -> arch. vpit -> pit_state. channels, & ps -> channels, sizeof ( kvm -> arch. vpit -> pit_state. channels ) ) ; kvm -> arch. vpit -> pit_state. flags = ps -> flags ;  kvm_pit_load_count ( kvm, 0, kvm -> arch. vpit -> pit_state. channels [ 0 ]. count, start ) ; <START_BUG> mutex_unlock ( & kvm -> arch. vpit -> pit_state. lock ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> start = 0 ; int i <S2SV_ModStart> -> flags ; for ( i = 0 ; i < 3 ; i ++ ) <S2SV_ModStart> ( kvm, i <S2SV_ModEnd>, kvm -> <S2SV_ModStart>. channels [ i <S2SV_ModEnd> ]. count
Buggy code:
 void WT_NoiseGenerator ( S_WT_VOICE * pWTVoice, S_WT_INT_FRAME * pWTIntFrame ) { EAS_PCM * pOutputBuffer ; EAS_I32 phaseInc ; EAS_I32 tmp0 ; EAS_I32 tmp1 ; EAS_I32 nInterpolatedSample ; EAS_I32 numSamples ; <START_BUG> numSamples = pWTIntFrame -> numSamples ; <END_BUG> pOutputBuffer = pWTIntFrame -> pAudioBuffer ; phaseInc = pWTIntFrame -> frame. phaseIncrement ; tmp0 = ( EAS_I32 ) ( pWTVoice -> phaseAccum ) >> 18 ; tmp1 = ( EAS_I32 ) ( pWTVoice -> loopEnd ) >> 18 ; while ( numSamples -- ) { nInterpolatedSample = MULT_AUDIO_COEF ( tmp0, ( PHASE_ONE - pWTVoice -> phaseFrac ) ) ; nInterpolatedSample += MULT_AUDIO_COEF ( tmp1, pWTVoice -> phaseFrac ) ; * pOutputBuffer ++ = ( EAS_PCM ) nInterpolatedSample ; pWTVoice -> phaseFrac += ( EAS_U32 ) phaseInc ; if ( GET_PHASE_INT_PART ( pWTVoice -> phaseFrac ) ) { tmp0 = tmp1 ; pWTVoice -> phaseAccum = pWTVoice -> loopEnd ; pWTVoice -> loopEnd = ( 5 * pWTVoice -> loopEnd + 1 ) ; tmp1 = ( EAS_I32 ) ( pWTVoice -> loopEnd ) >> 18 ; pWTVoice -> phaseFrac = GET_PHASE_FRAC_PART ( pWTVoice -> phaseFrac ) ; } } }

Fix:
<S2SV_ModStart> -> numSamples ; if ( numSamples <= 0 ) { ALOGE ( "b//26366256" ) ; return ; }
Buggy code:
 void vp8mt_decode_mb_rows ( VP8D_COMP * pbi, MACROBLOCKD * xd ) { VP8_COMMON * pc = & pbi -> common ; unsigned int i ; int j ; int filter_level = pc -> filter_level ; YV12_BUFFER_CONFIG * yv12_fb_new = pbi -> dec_fb_ref [ INTRA_FRAME ] ; if ( filter_level ) { <START_BUG> vpx_memset ( pbi -> mt_yabove_row [ 0 ] + VP8BORDERINPIXELS - 1, 127, yv12_fb_new -> y_width + 5 ) ; <END_BUG>  vpx_memset ( pbi -> mt_uabove_row [ 0 ] + ( VP8BORDERINPIXELS >> 1 ) - 1, 127, ( yv12_fb_new -> y_width >> 1 ) + 5 ) ; <START_BUG> <END_BUG> vpx_memset ( pbi -> mt_vabove_row [ 0 ] + ( VP8BORDERINPIXELS >> 1 ) - 1, 127, ( yv12_fb_new -> y_width >> 1 ) + 5 ) ;  for ( j = 1 ; j < pc -> mb_rows ; j ++ ) { <START_BUG> vpx_memset ( pbi -> mt_yabove_row [ j ] + VP8BORDERINPIXELS - 1, ( unsigned char ) 129, 1 ) ; <END_BUG>  vpx_memset ( pbi -> mt_uabove_row [ j ] + ( VP8BORDERINPIXELS >> 1 ) - 1, ( unsigned char ) 129, 1 ) ; <START_BUG> <END_BUG> vpx_memset ( pbi -> mt_vabove_row [ j ] + ( VP8BORDERINPIXELS >> 1 ) - 1, ( unsigned char ) 129, 1 ) ;  } for ( j = 0 ; j < pc -> mb_rows ; j ++ ) { <START_BUG> vpx_memset ( pbi -> mt_yleft_col [ j ], ( unsigned char ) 129, 16 ) ; <END_BUG>  vpx_memset ( pbi -> mt_uleft_col [ j ], ( unsigned char ) 129, 8 ) ; <START_BUG> <END_BUG> vpx_

Fix:
<S2SV_ModStart> filter_level ) { memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> 5 ) ; memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> 5 ) ; memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> 1 ) ; memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> 1 ) ; memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> 16 ) ; memset <S2SV_ModEnd> ( pbi -> <S2SV_ModStart> 8 ) ; memset <S2SV_ModEnd> ( pbi ->
Buggy code:
 static int check_line_charstring ( void ) { char * p = line ; <START_BUG> while ( isspace ( * p ) ) <END_BUG> p ++ ; return ( * p == '//' || ( p [ 0 ] == 'd' && p [ 1 ] == 'u' && p [ 2 ] == 'p' ) ) ; }

Fix:
<S2SV_ModStart> ( isspace ( ( unsigned char )
Buggy code:
 sctp_disposition_t sctp_sf_do_asconf_ack ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { struct sctp_chunk * asconf_ack = arg ; struct sctp_chunk * last_asconf = asoc -> addip_last_asconf ; struct sctp_chunk * abort ; struct sctp_paramhdr * err_param = NULL ; sctp_addiphdr_t * addip_hdr ; __u32 sent_serial, rcvd_serial ; if (! sctp_vtag_verify ( asconf_ack, asoc ) ) { sctp_add_cmd_sf ( commands, SCTP_CMD_REPORT_BAD_TAG, SCTP_NULL ( ) ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; } if (! net -> sctp. addip_noauth &&! asconf_ack -> auth ) return sctp_sf_discard_chunk ( net, ep, asoc, type, arg, commands ) ; if (! sctp_chunk_length_valid ( asconf_ack, sizeof ( sctp_addip_chunk_t ) ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ; addip_hdr = ( sctp_addiphdr_t * ) asconf_ack -> skb -> data ; rcvd_serial = ntohl ( addip_hdr -> serial ) ; if (! sctp_verify_asconf ( asoc, <START_BUG> ( sctp_paramhdr_t * ) addip_hdr -> params, <END_BUG> ( void * ) asconf_ack -> chunk_end, & err_param ) ) return sctp_sf_violation_paramlen ( net, ep, asoc, type, arg, ( void * ) err_param, commands ) ; if ( last_asconf ) { addip_hdr = ( sctp_addiphdr_t * ) last_asconf -> subh. addip_hdr ; sent_serial = ntohl ( addip_

Fix:
<S2SV_ModStart> ( asoc, asconf_ack, false, <S2SV_ModEnd> & err_param )
Buggy code:
 static void dump_completed_IO ( struct inode * inode ) { # ifdef EXT4_DEBUG struct list_head * cur, * before, * after ; ext4_io_end_t * io, * io0, * io1 ; <START_BUG> if ( list_empty ( & EXT4_I ( inode ) -> i_completed_io_list ) ) { <END_BUG> ext4_debug ( "inode   %lu   completed_io   list   is   empty\\n", inode -> i_ino ) ; return ; }  ext4_debug ( "Dump   inode   %lu   completed_io   list   \\n", inode -> i_ino ) ; <START_BUG> list_for_each_entry ( io, & EXT4_I ( inode ) -> i_completed_io_list, list ) { cur = & io -> list ; before = cur -> prev ; io0 = container_of ( before, ext4_io_end_t, list ) ; after = cur -> next ; io1 = container_of ( after, ext4_io_end_t, list ) ; ext4_debug ( "io   0x%p   from   inode   %lu,prev   0x%p,next   0x%p\\n", io, inode -> i_ino, io0, io1 ) ; } <END_BUG> # endif  }

Fix:
<S2SV_ModStart> * io1 ; unsigned long flags ; <S2SV_ModStart> inode -> i_ino ) ; spin_lock_irqsave ( & EXT4_I ( inode ) -> i_completed_io_lock, flags <S2SV_ModStart> ) ; } spin_unlock_irqrestore ( & EXT4_I ( inode ) -> i_completed_io_lock, flags ) ;
Buggy code:
 int main ( int argc, char * * argv ) { MYSQL mysql ; option_string * eptr ; MY_INIT ( argv [ 0 ] ) ; my_getopt_use_args_separator = TRUE ; if ( load_defaults ( "my", load_default_groups, & argc, & argv ) ) { my_end ( 0 ) ; exit ( 1 ) ; } my_getopt_use_args_separator = FALSE ; defaults_argv = argv ; if ( get_options ( & argc, & argv ) ) { free_defaults ( defaults_argv ) ; my_end ( 0 ) ; exit ( 1 ) ; } if ( auto_generate_sql ) srandom ( ( uint ) time ( NULL ) ) ; delimiter_length = strlen ( delimiter ) ; if ( argc > 2 ) { fprintf ( stderr, "%s:   Too   many   arguments\\n", my_progname ) ; free_defaults ( defaults_argv ) ; my_end ( 0 ) ; exit ( 1 ) ; } mysql_init ( & mysql ) ; if ( opt_compress ) mysql_options ( & mysql, MYSQL_OPT_COMPRESS, NullS ) ; <START_BUG> # ifdef HAVE_OPENSSL <END_BUG> if ( opt_use_ssl ) { mysql_ssl_set ( & mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca, opt_ssl_capath, opt_ssl_cipher ) ; mysql_options ( & mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl ) ; mysql_options ( & mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath ) ; } # endif if ( opt_protocol ) mysql_options ( & mysql, MYSQL_OPT_PROTOCOL, ( char * ) & opt_protocol ) ; # if defined ( _WIN32 ) &&! defined ( EMBEDDED_LIBRARY ) if ( shared_memory_base_name ) mysql_options ( & mysql, MYSQL_SHARED_MEMORY_BASE_NAME, shared_memory_base_name ) ; # endif mysql_options ( & mysql, MYSQL_SET_CHARSET_NAME, default_charset ) ; if ( opt_plugin_dir && * opt_plugin_dir ) mysql_options ( & mysql, MYSQL_PLUGIN_DIR, opt_plugin_

Fix:
<S2SV_ModStart> NullS ) ; SSL_SET_OPTIONS ( & mysql ) ; <S2SV_ModEnd> if ( opt_protocol
Buggy code:
 int config__parse_args ( struct mosquitto_db * db, struct mosquitto__config * config, int argc, char * argv [ ] ) { int i ; int port_tmp ; for ( i = 1 ; i < argc ; i ++ ) { if (! strcmp ( argv [ i ], "-c" ) ||! strcmp ( argv [ i ], "--config-file" ) ) { if ( i < argc - 1 ) { db -> config_file = argv [ i + 1 ] ; if ( config__read ( db, config, false ) ) { log__printf ( NULL, MOSQ_LOG_ERR, "Error:   Unable   to   open   configuration   file." ) ; return MOSQ_ERR_INVAL ; } } else { log__printf ( NULL, MOSQ_LOG_ERR, "Error:   -c   argument   given,   but   no   config   file   specified." ) ; return MOSQ_ERR_INVAL ; } i ++ ; } else if (! strcmp ( argv [ i ], "-d" ) ||! strcmp ( argv [ i ], "--daemon" ) ) { config -> daemon = true ; } else if (! strcmp ( argv [ i ], "-h" ) ||! strcmp ( argv [ i ], "--help" ) ) { print_usage ( ) ; return MOSQ_ERR_INVAL ; } else if (! strcmp ( argv [ i ], "-p" ) ||! strcmp ( argv [ i ], "--port" ) ) { if ( i < argc - 1 ) { port_tmp = atoi ( argv [ i + 1 ] ) ; if ( port_tmp < 1 || port_tmp > 65535 ) { log__printf ( NULL, MOSQ_LOG_ERR, "Error:   Invalid   port   specified   (%d).", port_tmp ) ; return MOSQ_ERR_INVAL ; } else { if ( config -> default_listener. port ) { log__printf ( NULL, MOSQ_LOG_WARNING, "Warning:   Default   listener   port   specified   multiple   times.   Only   the   latest   will   be   used." ) ; } config -> default_listener. port = port_tmp ; } } else { log__printf ( NULL,

Fix:
<S2SV_ModStart>. security_options. acl_file = config -> default_listener. security_options. acl_file ; config -> listeners [ config -> listener_count - 1 ]. security_options.
Buggy code:
 static void a2dp_open_ctrl_path ( struct a2dp_stream_common * common ) { int i ; for ( i = 0 ; i < CTRL_CHAN_RETRY_COUNT ; i ++ ) { if ( ( common -> ctrl_fd = skt_connect ( A2DP_CTRL_PATH, common -> buffer_sz ) ) > 0 ) { if ( check_a2dp_ready ( common ) == 0 ) break ; ERROR ( "error   :   a2dp   not   ready,   wait   250   ms   and   retry" ) ; <START_BUG> usleep ( 250000 ) ; <END_BUG> skt_disconnect ( common -> ctrl_fd ) ; common -> ctrl_fd = AUDIO_SKT_DISCONNECTED ; }  usleep ( 250000 ) ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> "error <S2SV_blank> : <S2SV_blank> a2dp <S2SV_blank> not <S2SV_blank> ready, <S2SV_blank> wait <S2SV_blank> 250 <S2SV_blank> ms <S2SV_blank> and <S2SV_blank> retry" ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 250000 ) <S2SV_ModStart> AUDIO_SKT_DISCONNECTED ; } TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 250000 )
Buggy code:
 static void ttm_put_pages ( struct page * * pages, unsigned npages, int flags, enum ttm_caching_state cstate ) { struct ttm_page_pool * pool = ttm_get_pool ( flags, false, cstate ) ; # ifdef CONFIG_TRANSPARENT_HUGEPAGE struct ttm_page_pool * huge = ttm_get_pool ( flags, true, cstate ) ; # endif unsigned long irq_flags ; unsigned i ; if ( pool == NULL ) { i = 0 ; while ( i < npages ) { # ifdef CONFIG_TRANSPARENT_HUGEPAGE struct page * p = pages [ i ] ; # endif unsigned order = 0, j ; if (! pages [ i ] ) { ++ i ; continue ; } # ifdef CONFIG_TRANSPARENT_HUGEPAGE <START_BUG> if (! ( flags & TTM_PAGE_FLAG_DMA32 ) ) { <END_BUG> for ( j = 0 ; j < HPAGE_PMD_NR ; ++ j ) if ( p ++!= pages [ i + j ] ) break ; if ( j == HPAGE_PMD_NR ) order = HPAGE_PMD_ORDER ; } # endif if ( page_count ( pages [ i ] )!= 1 ) pr_err ( "Erroneous   page   count.   Leaking   pages.\\n" ) ; __free_pages ( pages [ i ], order ) ; j = 1 << order ; while ( j ) { pages [ i ++ ] = NULL ; -- j ; } } return ; } i = 0 ; # ifdef CONFIG_TRANSPARENT_HUGEPAGE if ( huge ) { unsigned max_size, n2free ; spin_lock_irqsave ( & huge -> lock, irq_flags ) ;  while ( i < npages ) { <START_BUG> struct page * p = pages [ i ] ; unsigned j ; if (! p ) break ; for ( j = 0 ; j < HPAGE_PMD_NR ; ++ j ) if ( p ++!= pages [ i + j ] ) break ; if ( j!= HPAGE_PMD_NR ) break ; list_add_tail ( & pages [ i ] -> lru, & huge -> list ) ; for (<END_BUG>

Fix:
<S2SV_ModStart> & TTM_PAGE_FLAG_DMA32 ) && ( npages - i ) >= HPAGE_PMD_NR <S2SV_ModStart> ; while ( ( npages - i ) >= HPAGE_PMD_NR <S2SV_ModEnd> ) { struct
Buggy code:
 void vp9_xform_quant ( MACROBLOCK * x, int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size ) { MACROBLOCKD * const xd = & x -> e_mbd ; const struct macroblock_plane * const p = & x -> plane [ plane ] ; const struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; const scan_order * const scan_order = & vp9_default_scan_orders [ tx_size ] ; <START_BUG> int16_t * const coeff = BLOCK_OFFSET ( p -> coeff, block ) ; <END_BUG>  int16_t * const qcoeff = BLOCK_OFFSET ( p -> qcoeff, block ) ; <START_BUG> <END_BUG> int16_t * const dqcoeff = BLOCK_OFFSET ( pd -> dqcoeff, block ) ;  uint16_t * const eob = & p -> eobs [ block ] ; const int diff_stride = 4 * num_4x4_blocks_wide_lookup [ plane_bsize ] ; int i, j ; const int16_t * src_diff ; txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & i, & j ) ; src_diff = & p -> src_diff [ 4 * ( j * diff_stride + i ) ] ; <START_BUG> switch ( tx_size ) { <END_BUG> case TX_32X32 :  fdct32x32 ( x -> use_lp32x32fdct, src_diff, coeff, diff_stride ) ; <START_BUG> <END_BUG> vp9_quantize_b_32x32 ( coeff, 1024, x -> skip_block, p -> zbin, p -> round,  <START_BUG> p -> quant, p -> quant_shift, qcoeff, dqcoeff, <END_BUG>  pd -> dequant, p -> zbin_extra, eob, scan_order -> scan, <START_BUG> scan_order -> iscan ) ; break ; case TX_16X16 : <END_BUG> vp9_fdct16x16 ( src_diff, coeff, diff_stride ) ;  vp9_quantize_b ( coeff, 256, x -> skip_block, p -> zbin, p -> round, p -> quant, p -> quant_shift, qcoeff, dqcoeff, <START_BUG> pd -> dequant, p -> z<END_BUG>

Fix:
<S2SV_ModStart> tx_size ] ; tran_low_t <S2SV_ModEnd> * const coeff <S2SV_ModStart> block ) ; tran_low_t <S2SV_ModEnd> * const qcoeff <S2SV_ModStart> block ) ; tran_low_t <S2SV_ModEnd> * const dqcoeff <S2SV_ModStart> ) ] ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { <S2SV_ModStart> case TX_32X32 : highbd_fdct32x32 <S2SV_ModEnd> ( x -> <S2SV_ModStart> diff_stride ) ; vpx_highbd_quantize_b_32x32 <S2SV_ModEnd> ( coeff, <S2SV_ModStart>, qcoeff, dqcoeff, <S2SV_ModEnd> pd -> dequant <S2SV_ModStart> -> dequant, eob, <S2SV_ModEnd> scan_order -> scan <S2SV_ModStart> case TX_16X16 : vpx_highbd_fdct16x16 ( src_diff, coeff, diff_stride ) ; vpx_highbd_quantize_b <S2SV_ModEnd> ( coeff, <S2SV_ModStart> pd -> dequant <S2SV_ModEnd>, eob, <S2SV_ModStart> case TX_8X8 : vpx_highbd_fdct8x8 ( src_diff, coeff, diff_stride ) ; vpx_highbd_quantize_b <S2SV_ModEnd> ( coeff,
Buggy code:
 void vtp_print ( netdissect_options * ndo, const u_char * pptr, u_int length ) { int type, len, tlv_len, tlv_value, mgmtd_len ; const u_char * tptr ; const struct vtp_vlan_ * vtp_vlan ; if ( length < VTP_HEADER_LEN ) goto trunc ; tptr = pptr ; ND_TCHECK2 ( * tptr, VTP_HEADER_LEN ) ; type = * ( tptr + 1 ) ; ND_PRINT ( ( ndo, "VTPv%u,   Message   %s   (0x%02x),   length   %u", * tptr, tok2str ( vtp_message_type_values, "Unknown   message   type", type ), type, length ) ) ; if ( ndo -> ndo_vflag < 1 ) { return ; } ND_PRINT ( ( ndo, "\\n\\tDomain   name:   " ) ) ; mgmtd_len = * ( tptr + 3 ) ; if ( mgmtd_len < 1 || mgmtd_len > 32 ) { ND_PRINT ( ( ndo, "   [invalid   MgmtD   Len   %d]", mgmtd_len ) ) ; return ; } fn_printzp ( ndo, tptr + 4, mgmtd_len, NULL ) ; ND_PRINT ( ( ndo, ",   %s:   %u", tok2str ( vtp_header_values, "Unknown", type ), * ( tptr + 2 ) ) ) ; tptr += VTP_HEADER_LEN ; switch ( type ) { case VTP_SUMMARY_ADV : ND_TCHECK2 ( * tptr, 8 ) ; ND_PRINT ( ( ndo, "\\n\\t     Config   Rev   %x,   Updater   %s", EXTRACT_32BITS ( tptr ), ipaddr_string ( ndo, tptr + 4 ) ) ) ; tptr += 8 ; ND_TCHECK2 ( * tptr, VTP_UPDATE_TIMESTAMP_LEN ) ; ND_PRINT ( ( ndo, ",   Timestamp   0x%08x   0x%08x  

Fix:
<S2SV_ModStart> case VTP_SUBSET_ADV : ND_TCHECK_32BITS ( tptr ) ; <S2SV_ModStart> ) ) { ND_TCHECK_8BITS ( tptr ) ;
Buggy code:
 <START_BUG> int mongo_env_write_socket ( mongo * conn, const void * buf, int len ) { <END_BUG> const char * cbuf = buf ; # ifdef __APPLE__ int flags = 0 ; # else int flags = MSG_NOSIGNAL ; # endif while ( len ) {  int sent = send ( conn -> sock, cbuf, len, flags ) ; <START_BUG> if ( sent == - 1 ) { if ( errno == EPIPE ) conn -> connected = 0 ; __mongo_set_error ( conn, MONGO_IO_ERROR, strerror ( errno ), errno ) ; return MONGO_ERROR ; } cbuf += sent ; len -= sent ; } return MONGO_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> * buf, size_t <S2SV_ModEnd> len ) { <S2SV_ModStart> len ) { size_t <S2SV_ModEnd> sent = send
Buggy code:
 int sc_file_set_sec_attr ( sc_file_t * file, const u8 * sec_attr, size_t sec_attr_len ) { u8 * tmp ; if (! sc_file_valid ( file ) ) { return SC_ERROR_INVALID_ARGUMENTS ; } <START_BUG> if ( sec_attr == NULL ) { <END_BUG> if ( file -> sec_attr!= NULL ) free ( file -> sec_attr ) ; file -> sec_attr = NULL ; file -> sec_attr_len = 0 ; return 0 ; } tmp = ( u8 * ) realloc ( file -> sec_attr, sec_attr_len ) ; if (! tmp ) { if ( file -> sec_attr ) free ( file -> sec_attr ) ; file -> sec_attr = NULL ; file -> sec_attr_len = 0 ; return SC_ERROR_OUT_OF_MEMORY ; } file -> sec_attr = tmp ; memcpy ( file -> sec_attr, sec_attr, sec_attr_len ) ; file -> sec_attr_len = sec_attr_len ; return 0 ; }

Fix:
<S2SV_ModStart> sec_attr == NULL || sec_attr_len
Buggy code:
 <START_BUG> static double calc_frame_boost ( VP9_COMP * cpi, FIRSTPASS_STATS * this_frame, <END_BUG>  double this_frame_mv_in_out ) { <START_BUG> double frame_boost ; <END_BUG> if ( this_frame -> intra_error > cpi -> twopass. gf_intra_err_min )  <START_BUG> frame_boost = ( IIFACTOR * this_frame -> intra_error // <END_BUG>  DOUBLE_DIVIDE_CHECK ( this_frame -> coded_error ) ) ; <START_BUG> else frame_boost = ( IIFACTOR * cpi -> twopass. gf_intra_err_min // DOUBLE_DIVIDE_CHECK ( this_frame -> coded_error ) ) ; if ( this_frame_mv_in_out > 0.0 ) frame_boost += frame_boost * ( this_frame_mv_in_out * 2.0 ) ; else frame_boost += frame_boost * ( this_frame_mv_in_out // 2.0 ) ; <END_BUG> return MIN ( frame_boost, GF_RMAX ) ;  }

Fix:
<S2SV_ModStart> * cpi, const <S2SV_ModStart>, double this_frame_mv_in_out, double max_boost <S2SV_ModStart> double frame_boost ; const double lq = vp9_convert_qindex_to_q ( cpi -> rc. avg_frame_qindex [ INTER_FRAME ], cpi -> common. bit_depth ) ; const double boost_q_correction = MIN ( ( 0.5 + ( lq * 0.015 ) ), 1.5 ) ; int num_mbs = ( cpi -> oxcf. resize_mode!= RESIZE_NONE )? cpi -> initial_mbs : cpi -> common. MBs ; num_mbs = ( int ) MAX ( 1, num_mbs * calculate_active_area ( cpi, this_frame ) ) ; <S2SV_ModEnd> frame_boost = ( <S2SV_ModStart> frame_boost = ( BASELINE_ERR_PER_MB * num_mbs ) <S2SV_ModEnd> // DOUBLE_DIVIDE_CHECK ( <S2SV_ModStart> -> coded_error ) ; frame_boost = frame_boost * BOOST_FACTOR * boost_q_correction <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( frame_boost, max_boost * boost_q_correction
Buggy code:
 R_API char * r_socket_http_get ( const char * url, int * code, int * rlen ) { <START_BUG> char * curl_env = r_sys_getenv ( "R2_CURL" ) ; <END_BUG> if ( curl_env && * curl_env ) { char * encoded_url = r_str_escape ( url ) ; char * res = r_sys_cmd_strf ( "curl   \'%s\'", encoded_url ) ; free ( encoded_url ) ; if ( res ) { if ( code ) { * code = 200 ; } if ( rlen ) { * rlen = strlen ( res ) ; }  } <START_BUG> free ( curl_env ) ; return res ; } free ( curl_env ) ; RSocket * s ; int ssl = r_str_startswith ( url, "https:////" ) ; char * response, * host, * path, * port = "80" ; char * uri = strdup ( url ) ; if (! uri ) { return NULL ; } if ( code ) { * code = 0 ; } if ( rlen ) { * rlen = 0 ; } host = strstr ( uri, ":////" ) ; if (! host ) { free ( uri ) ; eprintf ( "r_socket_http_get:   Invalid   URI" ) ; return NULL ; } host += 3 ; port = strchr ( host, ':' ) ; if (! port ) { port = ssl? "443" : "80" ; path = host ; } else { * port ++ = 0 ; path = port ; } path = strchr ( path, '//' ) ; if (! path ) { path = "" ; } else { * path ++ = 0 ; } s = r_socket_new ( ssl ) ; if (! s ) { eprintf ( "r_socket_http_get:   Cannot   create   socket\\n" ) ; free ( uri ) ; return NULL ; } if ( r_socket_connect_tcp ( s, host, port, 0 ) ) { r_socket_printf ( s, "GET   //%s   HTTP//1.1\\r\\n" "User-Agent:   radare2   " R2_VERSION "\\r\\n" "Accept:   *//*\\r\\n" "Host:   %s:%s\\<END_BUG>

Fix:
<S2SV_ModStart> rlen ) { return socket_http_get_recursive ( url, code, rlen, SOCKET_HTTP_MAX_REDIRECTS <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int obj2ast_keyword ( PyObject * obj, keyword_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; identifier arg ; expr_ty value ; <START_BUG> if ( exists_not_none ( obj, & PyId_arg ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_arg ) ; <START_BUG> if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_identifier ( tmp, & arg, arena ) ;  if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <START_BUG> } else { <END_BUG> arg = NULL ; } if ( _PyObject_HasAttrId ( obj, & PyId_value ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_value ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_expr ( tmp, & value, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"value\\"   missing   from   keyword" ) ; return 1 ; } * out = keyword ( arg, value, arena ) ; return 0 ; failed : Py_XDECREF ( tmp ) ; return 1 ; }

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_arg, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; arg = NULL ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; res = obj2ast_identifier ( tmp, & arg, arena ) ; if ( res!= 0 <S2SV_ModEnd> ) goto failed <S2SV_ModStart> goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id ( obj, & PyId_value, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"value\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> keyword" ) ; return 1 ; } else { int res ; res = obj2ast_expr ( tmp, & value <S2SV_ModEnd>, arena ) <S2SV_ModStart> ) ; } <S2SV_ModEnd> * out =
Buggy code:
 static int fsl_lpspi_probe ( struct platform_device * pdev ) { struct device_node * np = pdev -> dev. of_node ; struct fsl_lpspi_data * fsl_lpspi ; struct spi_controller * controller ; struct spi_imx_master * lpspi_platform_info = dev_get_platdata ( & pdev -> dev ) ; struct resource * res ; int i, ret, irq ; u32 temp ; bool is_slave ; is_slave = of_property_read_bool ( ( & pdev -> dev ) -> of_node, "spi-slave" ) ; if ( is_slave ) controller = spi_alloc_slave ( & pdev -> dev, sizeof ( struct fsl_lpspi_data ) ) ; else controller = spi_alloc_master ( & pdev -> dev, sizeof ( struct fsl_lpspi_data ) ) ; if (! controller ) return - ENOMEM ; platform_set_drvdata ( pdev, controller ) ; fsl_lpspi = spi_controller_get_devdata ( controller ) ; fsl_lpspi -> dev = & pdev -> dev ; fsl_lpspi -> is_slave = is_slave ; if (! fsl_lpspi -> is_slave ) { for ( i = 0 ; i < controller -> num_chipselect ; i ++ ) { int cs_gpio = of_get_named_gpio ( np, "cs-gpios", i ) ; if (! gpio_is_valid ( cs_gpio ) && lpspi_platform_info ) cs_gpio = lpspi_platform_info -> chipselect [ i ] ; fsl_lpspi -> chipselect [ i ] = cs_gpio ; if (! gpio_is_valid ( cs_gpio ) ) continue ; ret = devm_gpio_request ( & pdev -> dev, fsl_lpspi -> chipselect [ i ], DRIVER_NAME ) ; if ( ret ) { dev_err ( & pdev -> dev, "can\'t   get   cs   gpios\\n" ) ; goto out_controller_put ; } } controller -> cs_gpios = fsl_lps

Fix:
<S2SV_ModStart> "failed <S2SV_blank> to <S2SV_blank> enable <S2SV_blank> clock\\n" ) ; goto out_controller_put <S2SV_ModEnd> ; } temp
Buggy code:
 <START_BUG> static int override_release ( char __user * release, int len ) <END_BUG> {  int ret = 0 ; <START_BUG> char buf [ 65 ] ; if ( current -> personality & UNAME26 ) { <END_BUG> char * rest = UTS_RELEASE ;  int ndots = 0 ; <START_BUG> unsigned v ; <END_BUG> while ( * rest ) { if ( * rest == '.' && ++ ndots >= 3 ) break ; if (! isdigit ( * rest ) && * rest!= '.' ) break ; rest ++ ; } v = ( ( LINUX_VERSION_CODE >> 8 ) & 0xff ) + 40 ;  snprintf ( buf, len, "2.6.%u%s", v, rest ) ; <START_BUG> <END_BUG> ret = copy_to_user ( release, buf, len ) ;  } return ret ; }

Fix:
<S2SV_ModStart> * release, size_t <S2SV_ModEnd> len ) { <S2SV_ModStart> ret = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> UNAME26 ) { const <S2SV_ModStart> rest = UTS_RELEASE ; char buf [ 65 ] = { 0 } <S2SV_ModStart> ; unsigned v ; size_t copy <S2SV_ModStart> + 40 ; copy = min ( sizeof ( buf ), max_t ( size_t, 1, len ) ) ; copy = scnprintf <S2SV_ModEnd> ( buf, <S2SV_ModStart> ( buf, copy <S2SV_ModEnd>, "2.6.%u%s", <S2SV_ModStart>, buf, copy + 1 <S2SV_ModEnd> ) ; }
Buggy code:
 u_int ieee802_15_4_if_print ( netdissect_options * ndo, const struct pcap_pkthdr * h, const u_char * p ) { u_int caplen = h -> caplen ; u_int hdrlen ; uint16_t fc ; uint8_t seq ; uint16_t panid = 0 ; if ( caplen < 3 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return caplen ; } hdrlen = 3 ; fc = EXTRACT_LE_16BITS ( p ) ; seq = EXTRACT_LE_8BITS ( p + 2 ) ; p += 3 ; caplen -= 3 ; ND_PRINT ( ( ndo, "IEEE   802.15.4   %s   packet   ", ftypes [ FC_FRAME_TYPE ( fc ) ] ) ) ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "seq   %02x   ", seq ) ) ; switch ( FC_DEST_ADDRESSING_MODE ( fc ) ) { case FC_ADDRESSING_MODE_NONE : if ( fc & FC_PAN_ID_COMPRESSION ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen ; } if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "none   " ) ) ; break ; case FC_ADDRESSING_MODE_RESERVED : if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "reserved   destination   addressing   mode" ) ) ; return hdrlen ; case FC_ADDRESSING_MODE_SHORT : if ( caplen < 2 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen ; } panid = EXTRACT_LE_16BITS ( p ) ; p += 2 ; caplen -= 2 ; hdrlen += 2 ; if ( caplen < 2 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen ; } if ( ndo -> ndo_vflag ) ND_PRINT ( (

Fix:
<S2SV_ModStart> ndo, p <S2SV_ModEnd> ) ) )
Buggy code:
 static gboolean handle_spawn ( PortalFlatpak * object, GDBusMethodInvocation * invocation, GUnixFDList * fd_list, const gchar * arg_cwd_path, const gchar * const * arg_argv, GVariant * arg_fds, GVariant * arg_envs, guint arg_flags, GVariant * arg_options ) { g_autoptr ( GError ) error = NULL ; ChildSetupData child_setup_data = { NULL } ; GPid pid ; PidData * pid_data ; InstanceIdReadData * instance_id_read_data = NULL ; gsize i, j, n_fds, n_envs ; const gint * fds = NULL ; gint fds_len = 0 ; g_autofree FdMapEntry * fd_map = NULL ; gchar * * env ; gint32 max_fd ; GKeyFile * app_info ; g_autoptr ( GPtrArray ) flatpak_argv = g_ptr_array_new_with_free_func ( g_free ) ; g_autofree char * app_id = NULL ; g_autofree char * branch = NULL ; g_autofree char * arch = NULL ; g_autofree char * app_commit = NULL ; g_autofree char * runtime_ref = NULL ; g_auto ( GStrv ) runtime_parts = NULL ; g_autofree char * runtime_commit = NULL ; g_autofree char * instance_path = NULL ; g_auto ( GStrv ) extra_args = NULL ; g_auto ( GStrv ) shares = NULL ; g_auto ( GStrv ) sockets = NULL ; g_auto ( GStrv ) devices = NULL ; g_auto ( GStrv ) sandbox_expose = NULL ; g_auto ( GStrv ) sandbox_expose_ro = NULL ; g_autoptr ( GVariant ) sandbox_expose_fd = NULL ; g_autoptr ( GVariant ) sandbox_expose_fd_ro = NULL ; g_autoptr ( GOutputStream ) instance_id_out_stream = NULL ; guint sandbox_flags = 0 ; gboolean sandboxed ; gboolean expose_pids ; gboolean share_pids ; gboolean notify_

Fix:
<S2SV_ModStart> val ) ; if ( var [ 0 ] == '\\0' ) { g_dbus_method_invocation_return_error ( invocation, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS, "Environment <S2SV_blank> variable <S2SV_blank> cannot <S2SV_blank> have <S2SV_blank> empty <S2SV_blank> name" ) ; return G_DBUS_METHOD_INVOCATION_HANDLED ; } if ( strchr ( var, '=' )!= NULL ) { g_dbus_method_invocation_return_error ( invocation, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS, "Environment <S2SV_blank> variable <S2SV_blank> name <S2SV_blank> cannot <S2SV_blank> contain <S2SV_blank> \'=\'" ) ; return G_DBUS_METHOD_INVOCATION_HANDLED ; } g_string_append ( env_string, var ) ; g_string_append_c ( env_string, '=' ) ; g_string_append ( env_string, val ) ; g_string_append_c ( env_string, '\\0' <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> int lsm_set_label_at ( int procfd, int on_exec, char * lsm_label ) { <END_BUG>  int labelfd = - 1 ; <START_BUG> int ret = 0 ; const char * name ; char * command = NULL ; name = lsm_name ( ) ; if ( strcmp ( name, "nop" ) == 0 ) <END_BUG> goto out ;  if ( strcmp ( name, "none" ) == 0 ) <START_BUG> goto out ; <END_BUG> if ( strcmp ( name, "AppArmor" ) == 0 ) on_exec = 0 ;  if ( on_exec ) { <START_BUG> labelfd = openat ( procfd, "self//attr//exec", O_RDWR ) ; } else { labelfd = openat ( procfd, "self//attr//current", O_RDWR ) ; } if ( labelfd < 0 ) { SYSERROR ( "Unable   to   open   LSM   label" ) ; ret = - 1 ; goto out ; } if ( strcmp ( name, "AppArmor" ) == 0 ) { int size ; command = malloc ( strlen ( lsm_label ) + strlen ( "changeprofile   " ) + 1 ) ; if (! command ) { SYSERROR ( "Failed   to   write   apparmor   profile" ) ; <END_BUG> ret = - 1 ;  goto out ; } size = sprintf ( command, "changeprofile   %s", lsm_label ) ; if ( size < 0 ) { SYSERROR ( "Failed   to   write   apparmor   profile" ) ; <START_BUG> ret = - 1 ; <END_BUG> goto out ; }  if ( write ( labelfd, command, size + 1 ) < 0 ) { <START_BUG> <END_BUG> SYSERROR ( "Unable   to   set   LSM   label" ) ;  <START_BUG> ret = - 1 ; <END_BUG> goto out ; } } else if ( strcmp ( name, "SELinux" ) == 0 ) { if ( write ( labelfd, lsm_label, strlen ( lsm_label ) + 1 ) < 0 ) { SYSERROR ( "Unable   to   set   LSM   label" ) ; ret = - 1 ; goto out ; } } else { ERROR ( "Unable   to   restore   label   for   unknown   LSM:   %s", name

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> lsm_set_label_at ( int lsm_labelfd <S2SV_ModEnd>, int on_exec <S2SV_ModStart> * lsm_label ) { int fret <S2SV_ModEnd> = - 1 <S2SV_ModStart> = - 1 <S2SV_ModEnd> ; const char <S2SV_ModStart> == 0 ) return 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> == 0 ) return 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( strcmp <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> write <S2SV_blank> apparmor <S2SV_blank> profile" ) ; <S2SV_ModEnd> goto out ; <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> write <S2SV_blank> apparmor <S2SV_blank> profile" ) ; <S2SV_ModEnd> goto out ; <S2SV_ModStart> ( write ( lsm_labelfd <S2SV_ModEnd>, command, <S2SV_ModStart> { SYSERROR ( "Unable <S2SV_blank> to <S2SV_blank> set <S2SV_blank> LSM <S2SV_blank> label: <S2SV_blank> %s.", command ) ; goto out ; } INFO ( "Set <S2SV_blank> LSM <S2SV_blank> label <S2SV_blank> to: <S2SV_blank> %s.", command ) ; } else if ( strcmp ( name, "SELinux" ) == 0 ) { if ( write ( lsm_labelfd, lsm_label, strlen ( lsm_label ) + 1 ) < 0 ) { SYSERROR ( <S2SV_ModStart>