nus-yam/ex-repair huggingface dataset:
Buggy code:
 int __kvm_set_memory_region ( struct kvm * kvm, struct kvm_userspace_memory_region * mem, int user_alloc ) { int r ; gfn_t base_gfn ; unsigned long npages ; unsigned long i ; struct kvm_memory_slot * memslot ; struct kvm_memory_slot old, new ; struct kvm_memslots * slots, * old_memslots ; r = - EINVAL ; if ( mem -> memory_size & ( PAGE_SIZE - 1 ) ) goto out ; if ( mem -> guest_phys_addr & ( PAGE_SIZE - 1 ) ) goto out ; <START_BUG> if ( user_alloc && ( mem -> userspace_addr & ( PAGE_SIZE - 1 ) ) ) <END_BUG> goto out ; if ( mem -> slot >= KVM_MEMORY_SLOTS + KVM_PRIVATE_MEM_SLOTS ) goto out ; if ( mem -> guest_phys_addr + mem -> memory_size < mem -> guest_phys_addr ) goto out ; memslot = & kvm -> memslots -> memslots [ mem -> slot ] ; base_gfn = mem -> guest_phys_addr >> PAGE_SHIFT ; npages = mem -> memory_size >> PAGE_SHIFT ; r = - EINVAL ; if ( npages > KVM_MEM_MAX_NR_PAGES ) goto out ; if (! npages ) mem -> flags &= ~ KVM_MEM_LOG_DIRTY_PAGES ; new = old = * memslot ; new. id = mem -> slot ; new. base_gfn = base_gfn ; new. npages = npages ; new. flags = mem -> flags ; r = - EINVAL ; if ( npages && old. npages && npages!= old. npages ) goto out_free ; r = - EEXIST ; for ( i = 0 ; i < KVM_MEMORY_SLOTS ; ++ i ) { struct kvm_memory_slot * s = & kvm -> memslots -> memslots [ i ] ; if ( s == memslot ||! s -> npages ) continue ; if (! ( ( base_gfn + npages <= s -> base_gfn ) || ( base_gfn >= s -> base_gfn + s ->

Fix:
<S2SV_ModStart> ( user_alloc && ( <S2SV_ModStart> PAGE_SIZE - 1 ) ) ||! access_ok ( VERIFY_WRITE, mem -> userspace_addr, mem -> memory_size
Buggy code:
 static int ext4_show_options ( struct seq_file * seq, struct vfsmount * vfs ) { int def_errors ; unsigned long def_mount_opts ; struct super_block * sb = vfs -> mnt_sb ; struct ext4_sb_info * sbi = EXT4_SB ( sb ) ; struct ext4_super_block * es = sbi -> s_es ; def_mount_opts = le32_to_cpu ( es -> s_default_mount_opts ) ; def_errors = le16_to_cpu ( es -> s_errors ) ; if ( sbi -> s_sb_block!= 1 ) seq_printf ( seq, ",sb=%llu", sbi -> s_sb_block ) ; if ( test_opt ( sb, MINIX_DF ) ) seq_puts ( seq, ",minixdf" ) ; if ( test_opt ( sb, GRPID ) &&! ( def_mount_opts & EXT4_DEFM_BSDGROUPS ) ) seq_puts ( seq, ",grpid" ) ; if (! test_opt ( sb, GRPID ) && ( def_mount_opts & EXT4_DEFM_BSDGROUPS ) ) seq_puts ( seq, ",nogrpid" ) ; if ( sbi -> s_resuid!= EXT4_DEF_RESUID || le16_to_cpu ( es -> s_def_resuid )!= EXT4_DEF_RESUID ) { seq_printf ( seq, ",resuid=%u", sbi -> s_resuid ) ; } if ( sbi -> s_resgid!= EXT4_DEF_RESGID || le16_to_cpu ( es -> s_def_resgid )!= EXT4_DEF_RESGID ) { seq_printf ( seq, ",resgid=%u", sbi -> s_resgid ) ; } if ( test_opt ( sb, ERRORS_RO ) ) { if ( def_errors == EXT4_ERRORS_PANIC || def_errors == EXT4_ERRORS_CONTINUE ) { seq_puts ( seq, ",errors=remount-ro" ) ; } } if ( test_opt ( sb, ERRORS_CONT ) && def_errors!= EXT4_ERRORS_CONTINUE ) seq_puts ( seq, ",errors=

Fix:
<S2SV_ModStart> ",norecovery" ) ; if ( test_opt ( sb, DIOREAD_NOLOCK ) ) seq_puts ( seq, ",dioread_nolock" ) ;
Buggy code:
 static int mcryptd_create_hash ( struct crypto_template * tmpl, struct rtattr * * tb, struct mcryptd_queue * queue ) { struct hashd_instance_ctx * ctx ; struct ahash_instance * inst ; struct hash_alg_common * halg ; struct crypto_alg * alg ; u32 type = 0 ; u32 mask = 0 ; int err ; <START_BUG> mcryptd_check_internal ( tb, & type, & mask ) ; <END_BUG> halg = ahash_attr_alg ( tb [ 1 ], type, mask ) ; if ( IS_ERR ( halg ) ) return PTR_ERR ( halg ) ; alg = & halg -> base ; pr_debug ( "crypto:   mcryptd   hash   alg:   %s\\n", alg -> cra_name ) ; inst = mcryptd_alloc_instance ( alg, ahash_instance_headroom ( ), sizeof ( * ctx ) ) ; err = PTR_ERR ( inst ) ; if ( IS_ERR ( inst ) ) goto out_put_alg ; ctx = ahash_instance_ctx ( inst ) ; ctx -> queue = queue ; err = crypto_init_ahash_spawn ( & ctx -> spawn, halg, ahash_crypto_instance ( inst ) ) ; if ( err ) goto out_free_inst ; type = CRYPTO_ALG_ASYNC ; if ( alg -> cra_flags & CRYPTO_ALG_INTERNAL ) type |= CRYPTO_ALG_INTERNAL ; inst -> alg. halg. base. cra_flags = type ; inst -> alg. halg. digestsize = halg -> digestsize ; inst -> alg. halg. statesize = halg -> statesize ; inst -> alg. halg. base. cra_ctxsize = sizeof ( struct mcryptd_hash_ctx ) ; inst -> alg. halg. base. cra_init = mcryptd_hash_init_tfm ; inst -> alg. halg. base. cra_exit = mcryptd_hash_exit_tfm ; inst -> alg. init = mcryptd_hash_init_enqueue ; inst -> alg. update = mcryptd_hash_update_enqueue ; inst -> alg. final = mcryptd_hash_final_enqueue ; inst -> alg. finup

Fix:
<S2SV_ModStart> int err ; if (! <S2SV_ModStart> & mask ) ) return - EINVAL
Buggy code:
 static int rtmp_packet_read_one_chunk ( URLContext * h, RTMPPacket * p, int chunk_size, RTMPPacket * * prev_pkt_ptr, int * nb_prev_pkt, uint8_t hdr ) { uint8_t buf [ 16 ] ; int channel_id, timestamp, size ; uint32_t ts_field ; uint32_t extra = 0 ; enum RTMPPacketType type ; int written = 0 ; int ret, toread ; RTMPPacket * prev_pkt ; written ++ ; channel_id = hdr & 0x3F ; if ( channel_id < 2 ) { buf [ 1 ] = 0 ; if ( ffurl_read_complete ( h, buf, channel_id + 1 )!= channel_id + 1 ) return AVERROR ( EIO ) ; written += channel_id + 1 ; channel_id = AV_RL16 ( buf ) + 64 ; } if ( ( ret = ff_rtmp_check_alloc_array ( prev_pkt_ptr, nb_prev_pkt, channel_id ) ) < 0 ) return ret ; prev_pkt = * prev_pkt_ptr ; size = prev_pkt [ channel_id ]. size ; type = prev_pkt [ channel_id ]. type ; extra = prev_pkt [ channel_id ]. extra ; hdr >>= 6 ; if ( hdr == RTMP_PS_ONEBYTE ) { ts_field = prev_pkt [ channel_id ]. ts_field ; } else { if ( ffurl_read_complete ( h, buf, 3 )!= 3 ) return AVERROR ( EIO ) ; written += 3 ; ts_field = AV_RB24 ( buf ) ; if ( hdr!= RTMP_PS_FOURBYTES ) { if ( ffurl_read_complete ( h, buf, 3 )!= 3 ) return AVERROR ( EIO ) ; written += 3 ; size = AV_RB24 ( buf ) ; if ( ffurl_read_complete ( h, buf, 1 )!= 1 ) return AVERROR ( EIO ) ; written ++ ; type = buf [ 0 ] ; if ( hdr == RTMP_PS_TWELVEBYTES ) { if ( ffurl_read_complete ( h, buf, 4 )

Fix:
<S2SV_ModStart> ; if ( prev_pkt [ channel_id ]. read && size!= prev_pkt [ channel_id ]. size ) { av_log ( NULL, AV_LOG_ERROR, "RTMP <S2SV_blank> packet <S2SV_blank> size <S2SV_blank> mismatch <S2SV_blank> %d <S2SV_blank>!= <S2SV_blank> %d\\n", size, prev_pkt [ channel_id ]. size ) ; ff_rtmp_packet_destroy ( & prev_pkt [ channel_id ] ) ; prev_pkt [ channel_id ]. read = 0 ; } if (
Buggy code:
 uint16_t enc624j600ReadPhyReg ( NetInterface * interface, uint8_t address ) { <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_MIREGADR, MIREGADR_R8 | address ) ; <END_BUG>  enc624j600WriteReg ( interface, ENC624J600_REG_MICMD, MICMD_MIIRD ) ; <START_BUG> usleep ( 100 ) ; <END_BUG> while ( ( enc624j600ReadReg ( interface, ENC624J600_REG_MISTAT ) & MISTAT_BUSY )!= 0 )  <START_BUG> { <END_BUG> }  enc624j600WriteReg ( interface, ENC624J600_REG_MICMD, 0x00 ) ; <START_BUG> <END_BUG> return enc624j600ReadReg ( interface, ENC624J600_REG_MIRD ) ;  }

Fix:
<S2SV_ModStart> address ) { uint16_t status ; <S2SV_ModStart> ( interface, ENC624J600_MIREGADR, ENC624J600_MIREGADR_R12_8_DEFAULT <S2SV_ModEnd> | address ) <S2SV_ModStart> ( interface, ENC624J600_MICMD, ENC624J600_MICMD_MIIRD <S2SV_ModEnd> ) ; usleep <S2SV_ModStart> 100 ) ; do { status = <S2SV_ModEnd> enc624j600ReadReg ( interface <S2SV_ModStart> ( interface, ENC624J600_MISTAT ) ; } while ( ( status & ENC624J600_MISTAT_BUSY <S2SV_ModEnd> )!= 0 <S2SV_ModStart>!= 0 ) ; <S2SV_ModEnd> enc624j600WriteReg ( interface <S2SV_ModStart> ( interface, ENC624J600_MICMD <S2SV_ModEnd>, 0x00 ) <S2SV_ModStart> ( interface, ENC624J600_MIRD <S2SV_ModEnd> ) ; }
Buggy code:
 void set_cfg_option ( char * opt_string ) { char * sep, * sep2, szSec [ 1024 ], szKey [ 1024 ], szVal [ 1024 ] ; sep = strchr ( opt_string, ':' ) ; if (! sep ) { fprintf ( stderr, "Badly   formatted   option   %s   -   expected   Section:Name=Value\\n", opt_string ) ; return ; } { const size_t sepIdx = sep - opt_string ; <START_BUG> strncpy ( szSec, opt_string, sepIdx ) ; <END_BUG> szSec [ sepIdx ] = 0 ; } sep ++ ; sep2 = strchr ( sep, '=' ) ; if (! sep2 ) { fprintf ( stderr, "Badly   formatted   option   %s   -   expected   Section:Name=Value\\n", opt_string ) ; return ; } { const size_t sepIdx = sep2 - sep ;  strncpy ( szKey, sep, sepIdx ) ; <START_BUG> szKey [ sepIdx ] = 0 ; <END_BUG> strcpy ( szVal, sep2 + 1 ) ;  } if (! stricmp ( szKey, "*" ) ) { if ( stricmp ( szVal, "null" ) ) { fprintf ( stderr, "Badly   formatted   option   %s   -   expected   Section:*=null\\n", opt_string ) ; return ; } gf_cfg_del_section ( cfg_file, szSec ) ; return ; } if (! stricmp ( szVal, "null" ) ) { szVal [ 0 ] = 0 ; } gf_cfg_set_key ( cfg_file, szSec, szKey, szVal [ 0 ]? szVal : NULL ) ; }

Fix:
<S2SV_ModStart> - opt_string ; if ( sepIdx >= sizeof ( szSec ) ) { fprintf ( stderr, "Badly <S2SV_blank> formatted <S2SV_blank> option <S2SV_blank> %s <S2SV_blank> - <S2SV_blank> Section <S2SV_blank> name <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long\\n", opt_string ) ; return ; } <S2SV_ModStart> - sep ; if ( sepIdx >= sizeof ( szKey ) ) { fprintf ( stderr, "Badly <S2SV_blank> formatted <S2SV_blank> option <S2SV_blank> %s <S2SV_blank> - <S2SV_blank> key <S2SV_blank> name <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long\\n", opt_string ) ; return ; } <S2SV_ModStart> = 0 ; if ( strlen ( <S2SV_ModEnd> sep2 + 1 <S2SV_ModStart> + 1 ) >= sizeof ( szVal ) ) { fprintf ( stderr, "Badly <S2SV_blank> formatted <S2SV_blank> option <S2SV_blank> %s <S2SV_blank> - <S2SV_blank> value <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long\\n", opt_string ) ; return ; } strcpy ( szVal, sep2 + 1 )
Buggy code:
 static __inline__ void jiffies_to_compat_timeval ( unsigned long jiffies, struct compat_timeval * value ) { u64 nsec = ( u64 ) jiffies * TICK_NSEC ; <START_BUG> long rem ; <END_BUG>  value -> tv_sec = div_long_long_rem ( nsec, NSEC_PER_SEC, & rem ) ; <START_BUG> value -> tv_usec = rem // NSEC_PER_USEC ; }<END_BUG>

Fix:
<S2SV_ModStart> * TICK_NSEC ; u32 <S2SV_ModEnd> rem ; value <S2SV_ModStart> -> tv_sec = div_u64_rem <S2SV_ModEnd> ( nsec,
Buggy code:
 static Sdb * store_versioninfo_gnu_verdef ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { const char * section_name = "" ; const char * link_section_name = "" ; char * end = NULL ; Elf_ ( Shdr ) * link_shdr = NULL ; ut8 dfs [ sizeof ( Elf_ ( Verdef ) ) ] = { 0 } ; Sdb * sdb ; int cnt, i ; if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return false ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; if ( shdr -> sh_size < 1 ) { return false ; } Elf_ ( Verdef ) * defs = calloc ( shdr -> sh_size, sizeof ( char ) ) ; if (! defs ) { return false ; } if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( link_shdr && bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! defs ) { bprintf ( "Warning:   Cannot   allocate   memory   (Check   Elf_(Verdef))\\n" ) ; return NULL ; } sdb = sdb_new0 ( ) ; end = ( char * ) defs + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link, 0 ) ; sdb_set ( sdb, "link_section_name", link_section_name,

Fix:
<S2SV_ModStart>, j ) int vdaux = verdef -> vd_aux ; if ( vdaux < 1 ) { sdb_free ( sdb_verdef ) ; goto out_error ; } vstart += vdaux <S2SV_ModEnd> ; if (
Buggy code:
 void handle_usb_rx ( const void * msg, size_t len ) { if ( msg_tiny_flag ) { <START_BUG> uint8_t buf [ 64 ] ; <END_BUG> memcpy ( buf, msg, sizeof ( buf ) ) ; uint16_t msgId = buf [ 4 ] | ( ( uint16_t ) buf [ 3 ] ) << 8 ; uint32_t msgSize = buf [ 8 ] | ( ( uint32_t ) buf [ 7 ] ) << 8 | ( ( uint32_t ) buf [ 6 ] ) << 16 | ( ( uint32_t ) buf [ 5 ] ) << 24 ; if ( msgSize > 64 - 9 ) { ( * msg_failure ) ( FailureType_Failure_UnexpectedMessage, "Malformed   tiny   packet" ) ; return ; } const MessagesMap_t * entry = message_map_entry ( NORMAL_MSG, msgId, IN_MSG ) ; if (! entry ) { ( * msg_failure ) ( FailureType_Failure_UnexpectedMessage, "Unknown   message" ) ; return ; } tiny_dispatch ( entry, buf + 9, msgSize ) ; } else { usb_rx_helper ( msg, len, NORMAL_MSG ) ; } }

Fix:
<S2SV_ModStart> msg_tiny_flag ) { msg_read_tiny ( msg, len <S2SV_ModEnd> ) ; }
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { DelogoContext * s = inlink -> dst -> priv ; AVFilterLink * outlink = inlink -> dst -> outputs [ 0 ] ; const AVPixFmtDescriptor * desc = av_pix_fmt_desc_get ( inlink -> format ) ; AVFrame * out ; int hsub0 = desc -> log2_chroma_w ; int vsub0 = desc -> log2_chroma_h ; int direct = 0 ; int plane ; AVRational sar ; if ( av_frame_is_writable ( in ) ) { direct = 1 ; out = in ; } else { out = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; } sar = in -> sample_aspect_ratio ; if (! sar. num ) sar. num = sar. den = 1 ; <START_BUG> for ( plane = 0 ; plane < 4 && in -> data [ plane ] ; plane ++ ) { <END_BUG> int hsub = plane == 1 || plane == 2? hsub0 : 0 ; int vsub = plane == 1 || plane == 2? vsub0 : 0 ; apply_delogo ( out -> data [ plane ], out -> linesize [ plane ], in -> data [ plane ], in -> linesize [ plane ], FF_CEIL_RSHIFT ( inlink -> w, hsub ), FF_CEIL_RSHIFT ( inlink -> h, vsub ), sar, s -> x >> hsub, s -> y >> vsub, FF_CEIL_RSHIFT ( s -> w + ( s -> x & ( ( 1 << hsub ) - 1 ) ), hsub ), FF_CEIL_RSHIFT ( s -> h + ( s -> y & ( ( 1 << vsub ) - 1 ) ), vsub ), s -> band >> FFMIN ( hsub, vsub ), s -> show, direct ) ; } if (! direct ) av_frame_free ( & in ) ; return ff_filter_frame ( outlink, out ) ; }

Fix:
<S2SV_ModStart> in -> data [ plane ] && in -> linesize
Buggy code:
 static size_t optsize ( lua_State * L, char opt, const char * * fmt ) { switch ( opt ) { case 'B' : case 'b' : return sizeof ( char ) ; case 'H' : case 'h' : return sizeof ( short ) ; case 'L' : case 'l' : return sizeof ( long ) ; case 'T' : return sizeof ( size_t ) ; case 'f' : return sizeof ( float ) ; case 'd' : return sizeof ( double ) ; case 'x' : return 1 ; <START_BUG> case 'c' : return getnum ( fmt, 1 ) ; <END_BUG> case 'i' : case 'I' : {  int sz = getnum ( fmt, sizeof ( int ) ) ; <START_BUG> if ( sz > MAXINTSIZE ) luaL_error ( L, "integral   size   %d   is   larger   than   limit   of   %d", sz, MAXINTSIZE ) ; return sz ; } default : return 0 ; } }<END_BUG>

Fix:
<S2SV_ModStart> return getnum ( L, <S2SV_ModStart> = getnum ( L,
Buggy code:
 static int __dwc3_gadget_kick_transfer ( struct dwc3_ep * dep ) { struct dwc3_gadget_ep_cmd_params params ; struct dwc3_request * req ; int starting ; int ret ; u32 cmd ; if (! dwc3_calc_trbs_left ( dep ) ) return 0 ; starting =! ( dep -> flags & DWC3_EP_BUSY ) ; dwc3_prepare_trbs ( dep ) ; req = next_request ( & dep -> started_list ) ; if (! req ) { dep -> flags |= DWC3_EP_PENDING_REQUEST ; return 0 ; } memset ( & params, 0, sizeof ( params ) ) ; if ( starting ) { params. param0 = upper_32_bits ( req -> trb_dma ) ; params. param1 = lower_32_bits ( req -> trb_dma ) ; cmd = DWC3_DEPCMD_STARTTRANSFER ; if ( usb_endpoint_xfer_isoc ( dep -> endpoint. desc ) ) cmd |= DWC3_DEPCMD_PARAM ( dep -> frame_number ) ; } else { cmd = DWC3_DEPCMD_UPDATETRANSFER | DWC3_DEPCMD_PARAM ( dep -> resource_index ) ; } ret = dwc3_send_gadget_ep_cmd ( dep, cmd, & params ) ; if ( ret < 0 ) { if ( req -> trb ) memset ( req -> trb, 0, sizeof ( struct dwc3_trb ) ) ; dep -> queued_requests -- ; <START_BUG> dwc3_gadget_giveback ( dep, req, ret ) ; <END_BUG> return ret ; } dep -> flags |= DWC3_EP_BUSY ; if ( starting ) { dep -> resource_index = dwc3_gadget_ep_get_transfer_index ( dep ) ; WARN_ON_ONCE (! dep -> resource_index ) ; } return 0 ; }

Fix:
<S2SV_ModStart> queued_requests -- ; dwc3_gadget_del_and_unmap_request <S2SV_ModEnd> ( dep,
Buggy code:
 static int __br_mdb_del ( struct net_bridge * br, struct br_mdb_entry * entry ) { struct net_bridge_mdb_htable * mdb ; struct net_bridge_mdb_entry * mp ; struct net_bridge_port_group * p ; struct net_bridge_port_group __rcu * * pp ; struct br_ip ip ; int err = - EINVAL ; if (! netif_running ( br -> dev ) || br -> multicast_disabled ) return - EINVAL ; if ( timer_pending ( & br -> multicast_querier_timer ) ) return - EBUSY ; ip. proto = entry -> addr. proto ; if ( ip. proto == htons ( ETH_P_IP ) ) ip. u. ip4 = entry -> addr. u. ip4 ; # if IS_ENABLED ( CONFIG_IPV6 ) else ip. u. ip6 = entry -> addr. u. ip6 ; # endif spin_lock_bh ( & br -> multicast_lock ) ; mdb = mlock_dereference ( br -> mdb, br ) ; mp = br_mdb_ip_get ( mdb, & ip ) ; if (! mp ) goto unlock ; for ( pp = & mp -> ports ; ( p = mlock_dereference ( * pp, br ) )!= NULL ; pp = & p -> next ) { if (! p -> port || p -> port -> dev -> ifindex!= entry -> ifindex ) continue ; if ( p -> port -> state == BR_STATE_DISABLED ) goto unlock ; rcu_assign_pointer ( * pp, p -> next ) ; hlist_del_init ( & p -> mglist ) ; del_timer ( & p -> timer ) ; call_rcu_bh ( & p -> rcu, br_multicast_free_pg ) ; err = 0 ; <START_BUG> if (! mp -> ports &&! mp -> mglist && <END_BUG> netif_running ( br -> dev ) ) mod_timer ( & mp -> timer, jiffies ) ; break ; } unlock : spin_unlock_bh ( & br -> multicast_lock ) ; return err ; }

Fix:
<S2SV_ModStart> -> mglist && mp -> timer_armed &&
Buggy code:
 static vpx_codec_err_t ctrl_set_dbg_options ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctrl_id, va_list args ) { <END_BUG>  # if CONFIG_POSTPROC_VISUALIZER && CONFIG_POSTPROC <START_BUG> int data = va_arg ( args, int ) ; # define MAP ( id, var ) case id : var = data ; break ; switch ( ctrl_id ) { MAP ( VP8_SET_DBG_COLOR_REF_FRAME, ctx -> dbg_color_ref_frame_flag ) ; MAP ( VP8_SET_DBG_COLOR_MB_MODES, ctx -> dbg_color_mb_modes_flag ) ; MAP ( VP8_SET_DBG_COLOR_B_MODES, ctx -> dbg_color_b_modes_flag ) ; MAP ( VP8_SET_DBG_DISPLAY_MV, ctx -> dbg_display_mv_flag ) ; } return VPX_CODEC_OK ; # else return VPX_CODEC_INCAPABLE ; <END_BUG> # endif  }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> args ) { ( void ) ctx ; ( void ) args ; <S2SV_ModEnd> return VPX_CODEC_INCAPABLE ; <S2SV_ModStart> return VPX_CODEC_INCAPABLE ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int nfc_llcp_send_connect ( struct nfc_llcp_sock * sock ) { struct nfc_llcp_local * local ; struct sk_buff * skb ; u8 * service_name_tlv = NULL, service_name_tlv_length ; u8 * miux_tlv = NULL, miux_tlv_length ; u8 * rw_tlv = NULL, rw_tlv_length, rw ; int err ; u16 size = 0 ; __be16 miux ; pr_debug ( "Sending   CONNECT\\n" ) ; local = sock -> local ; if ( local == NULL ) return - ENODEV ; if ( sock -> service_name!= NULL ) { service_name_tlv = nfc_llcp_build_tlv ( LLCP_TLV_SN, sock -> service_name, sock -> service_name_len, & service_name_tlv_length ) ; <START_BUG> size += service_name_tlv_length ; <END_BUG> } miux = be16_to_cpu ( sock -> miux ) > LLCP_MAX_MIUX? local -> miux : sock -> miux ; rw = sock -> rw > LLCP_MAX_RW? local -> rw : sock -> rw ; miux_tlv = nfc_llcp_build_tlv ( LLCP_TLV_MIUX, ( u8 * ) & miux, 0, & miux_tlv_length ) ;  size += miux_tlv_length ; <START_BUG> rw_tlv = nfc_llcp_build_tlv ( LLCP_TLV_RW, & rw, 0, & rw_tlv_length ) ; <END_BUG> size += rw_tlv_length ;  pr_debug ( "SKB   size   %d   SN   length   %zu\\n", size, sock -> service_name_len ) ; skb = llcp_allocate_pdu ( sock, LLCP_PDU_CONNECT, size ) ; if ( skb == NULL ) { err = - ENOMEM ; goto error_tlv ; } llcp_add_tlv ( skb, service_name_tlv, service_name_tlv_length ) ; llcp_add_tlv ( sk

Fix:
<S2SV_ModStart> service_name_tlv_length ) ; if (! service_name_tlv ) { err = - ENOMEM ; goto error_tlv ; } <S2SV_ModStart> miux_tlv_length ) ; if (! miux_tlv ) { err = - ENOMEM ; goto error_tlv ; } <S2SV_ModStart> rw_tlv_length ) ; if (! rw_tlv ) { err = - ENOMEM ; goto error_tlv ; }
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_set_roi_map ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_roi_map_t * data = va_arg ( args, vpx_roi_map_t * ) ; if ( data ) { vpx_roi_map_t * roi = ( vpx_roi_map_t * ) data ; if (! vp8_set_roimap ( ctx -> cpi, roi -> roi_map, roi -> rows, roi -> cols, roi -> delta_q, roi -> delta_lf, roi -> static_threshold ) ) return VPX_CODEC_OK ; else return VPX_CODEC_INVALID_PARAM ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 int cifs_mount ( struct super_block * sb, struct cifs_sb_info * cifs_sb, char * mount_data_global, const char * devname ) { int rc ; int xid ; struct smb_vol * volume_info ; struct cifsSesInfo * pSesInfo ; struct cifsTconInfo * tcon ; struct TCP_Server_Info * srvTcp ; char * full_path ; char * mount_data = mount_data_global ; struct tcon_link * tlink ; # ifdef CONFIG_CIFS_DFS_UPCALL struct dfs_info3_param * referrals = NULL ; unsigned int num_referrals = 0 ; int referral_walks_count = 0 ; try_mount_again : # endif rc = 0 ; tcon = NULL ; pSesInfo = NULL ; srvTcp = NULL ; full_path = NULL ; tlink = NULL ; xid = GetXid ( ) ; volume_info = kzalloc ( sizeof ( struct smb_vol ), GFP_KERNEL ) ; if (! volume_info ) { rc = - ENOMEM ; goto out ; } if ( cifs_parse_mount_options ( mount_data, devname, volume_info ) ) { rc = - EINVAL ; goto out ; } if ( volume_info -> nullauth ) { cFYI ( 1, "null   user" ) ; volume_info -> username = "" ; } else if ( volume_info -> username ) { cFYI ( 1, "Username:   %s", volume_info -> username ) ; } else { cifserror ( "No   username   specified" ) ; rc = - EINVAL ; goto out ; } if ( volume_info -> iocharset == NULL ) { volume_info -> local_nls = load_nls_default ( ) ; } else { volume_info -> local_nls = load_nls ( volume_info -> iocharset ) ; if ( volume_info -> local_nls == NULL ) { cERROR ( 1, "CIFS   mount   error:   iocharset   %s   not   found", volume_info -> iocharset ) ; rc = - ELIBACC ; goto out ; } } cifs_sb -> local_nls = volume

Fix:
<S2SV_ModStart> (! rc <S2SV_ModEnd> && tcon )
Buggy code:
 static int __reiserfs_set_acl ( struct reiserfs_transaction_handle * th, struct inode * inode, int type, struct posix_acl * acl ) { char * name ; void * value = NULL ; size_t size = 0 ; int error ; switch ( type ) { case ACL_TYPE_ACCESS : name = XATTR_NAME_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> error = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( error < 0 ) return error ; else { if ( error == 0 ) acl = NULL ; } } break ; case ACL_TYPE_DEFAULT : name = XATTR_NAME_POSIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } if ( acl ) { value = reiserfs_posix_acl_to_disk ( acl, & size ) ; if ( IS_ERR ( value ) ) return ( int ) PTR_ERR ( value ) ; } error = reiserfs_xattr_set_handle ( th, inode, name, value, size, 0 ) ; if ( error == - ENODATA ) { error = 0 ; if ( type == ACL_TYPE_ACCESS ) { inode -> i_ctime = CURRENT_TIME_SEC ; mark_inode_dirty ( inode ) ; } } kfree ( value ) ; if (! error ) set_cached_acl ( inode, type, acl ) ; return error ; }

Fix:
<S2SV_ModStart> { error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( error ) return error ; <S2SV_ModEnd> } break ;
Buggy code:
 int xfs_attr_shortform_to_leaf ( struct xfs_da_args * args, struct xfs_buf * * leaf_bp ) { xfs_inode_t * dp ; xfs_attr_shortform_t * sf ; xfs_attr_sf_entry_t * sfe ; xfs_da_args_t nargs ; char * tmpbuffer ; int error, i, size ; xfs_dablk_t blkno ; struct xfs_buf * bp ; xfs_ifork_t * ifp ; trace_xfs_attr_sf_to_leaf ( args ) ; dp = args -> dp ; ifp = dp -> i_afp ; sf = ( xfs_attr_shortform_t * ) ifp -> if_u1. if_data ; size = be16_to_cpu ( sf -> hdr. totsize ) ; tmpbuffer = kmem_alloc ( size, KM_SLEEP ) ; ASSERT ( tmpbuffer!= NULL ) ; memcpy ( tmpbuffer, ifp -> if_u1. if_data, size ) ; sf = ( xfs_attr_shortform_t * ) tmpbuffer ; xfs_idata_realloc ( dp, - size, XFS_ATTR_FORK ) ; xfs_bmap_local_to_extents_empty ( dp, XFS_ATTR_FORK ) ; bp = NULL ; error = xfs_da_grow_inode ( args, & blkno ) ; if ( error ) { if ( error == - EIO ) goto out ; xfs_idata_realloc ( dp, size, XFS_ATTR_FORK ) ; memcpy ( ifp -> if_u1. if_data, tmpbuffer, size ) ; goto out ; } ASSERT ( blkno == 0 ) ; error = xfs_attr3_leaf_create ( args, blkno, & bp ) ; if ( error ) { <START_BUG> error = xfs_da_shrink_inode ( args, 0, bp ) ; <END_BUG> bp = NULL ; if ( error ) goto out ; xfs_idata_realloc ( dp, size, XFS_ATTR_FORK ) ; memcpy ( ifp -> if_u1. if_

Fix:
<S2SV_ModStart> error ) { if ( bp && ( <S2SV_ModEnd> xfs_da_shrink_inode ( args <S2SV_ModStart>, bp )!= 0 ) <S2SV_ModEnd> ) goto out
Buggy code:
 static GsfInfileTar * tar_directory_for_file ( GsfInfileTar * dir, const char * name, gboolean last ) { const char * s = name ; while ( 1 ) { const char * s0 = s ; char * dirname ; while ( 1 ) { if ( * s == 0 ) { if ( last && s!= s0 ) break ; else return dir ; } if ( * s == '//' ) break ; s ++ ; } dirname = g_strndup ( s0, s - s0 ) ; while ( * s == '//' ) s ++ ; if ( strcmp ( dirname, "." )!= 0 ) { GsfInput * subdir = gsf_infile_child_by_name ( GSF_INFILE ( dir ), dirname ) ; if ( subdir ) { <START_BUG> g_object_unref ( subdir ) ; <END_BUG>  dir = GSF_INFILE_TAR ( subdir ) ; <START_BUG> } else dir = tar_create_dir ( dir, dirname ) ; } g_free ( dirname ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> subdir ) { dir = GSF_IS_INFILE_TAR ( subdir )? GSF_INFILE_TAR ( subdir ) : dir ; <S2SV_ModStart> subdir ) ; <S2SV_ModEnd> } else dir
Buggy code:
 u_int ieee802_15_4_if_print ( netdissect_options * ndo, const struct pcap_pkthdr * h, const u_char * p ) { u_int caplen = h -> caplen ; <START_BUG> int hdrlen ; <END_BUG> uint16_t fc ; uint8_t seq ;  if ( caplen < 3 ) { <START_BUG> ND_PRINT ( ( ndo, "[|802.15.4]   %x", caplen ) ) ; return caplen ; } fc = EXTRACT_LE_16BITS ( p ) ; hdrlen = extract_header_length ( fc ) ; seq = EXTRACT_LE_8BITS ( p + 2 ) ; p += 3 ; caplen -= 3 ; ND_PRINT ( ( ndo, "IEEE   802.15.4   %s   packet   ", ftypes [ fc & 0x7 ] ) ) ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "seq   %02x   ", seq ) ) ; if ( hdrlen == - 1 ) { ND_PRINT ( ( ndo, "invalid!   " ) ) ; return caplen ; } if (! ndo -> ndo_vflag ) { p += hdrlen ; caplen -= hdrlen ; } else { uint16_t panid = 0 ; <END_BUG> switch ( ( fc >> 10 ) & 0x3 ) {  case 0x00 : ND_PRINT ( ( ndo, "none   " ) ) ; break ; case 0x01 : ND_PRINT ( ( ndo, "reserved   destination   addressing   mode" ) ) ; return 0 ; case 0x02 : panid = EXTRACT_LE_16BITS ( p ) ; p += 2 ; <START_BUG> ND_PRINT ( ( ndo, "%04x:%04x   ", panid, EXTRACT_LE_16BITS ( p ) ) ) ; <END_BUG> p += 2 ; break ;  case 0x03 : <START_BUG> panid = EXTRACT_LE_16BITS ( p ) ; p += 2 ; <END_BUG> ND_PRINT ( ( ndo, "%04x:%s   ", panid, le64addr_string ( ndo, p ) ) ) ;  p += 8 ; <START_BUG> break ; <END_BUG>

Fix:
<S2SV_ModStart> -> caplen ; u_int <S2SV_ModEnd> hdrlen ; uint16_t <S2SV_ModStart> uint8_t seq ; <S2SV_ModEnd> uint16_t panid = <S2SV_ModStart> = 0 ; if ( caplen < 3 ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return caplen ; } hdrlen = 3 ; fc = EXTRACT_LE_16BITS ( p ) ; seq = EXTRACT_LE_8BITS ( p + 2 ) ; p += 3 ; caplen -= 3 ; ND_PRINT ( ( ndo, "IEEE <S2SV_blank> 802.15.4 <S2SV_blank> %s <S2SV_blank> packet <S2SV_blank> ", ftypes [ FC_FRAME_TYPE ( fc ) ] ) ) ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "seq <S2SV_blank> %02x <S2SV_blank> ", seq ) ) ; switch ( FC_DEST_ADDRESSING_MODE ( fc ) ) { case FC_ADDRESSING_MODE_NONE : if ( fc & FC_PAN_ID_COMPRESSION ) { ND_PRINT ( ( ndo, "[|802.15.4]" ) ) ; return hdrlen
Buggy code:
 SEL * selReadStream ( FILE * fp ) { char * selname ; <START_BUG> char linebuf [ L_BUF_SIZE ] ; <END_BUG> l_int32 sy, sx, cy, cx, i, j, version, ignore ; SEL * sel ; PROCNAME ( "selReadStream" ) ; if (! fp ) return ( SEL * ) ERROR_PTR ( "stream   not   defined", procName, NULL ) ; if ( fscanf ( fp, "     Sel   Version   %d\\n", & version )!= 1 ) return ( SEL * ) ERROR_PTR ( "not   a   sel   file", procName, NULL ) ; if ( version!= SEL_VERSION_NUMBER ) return ( SEL * ) ERROR_PTR ( "invalid   sel   version", procName, NULL ) ;  if ( fgets ( linebuf, L_BUF_SIZE, fp ) == NULL ) <START_BUG> return ( SEL * ) ERROR_PTR ( "error   reading   into   linebuf", procName, NULL ) ; selname = stringNew ( linebuf ) ; <END_BUG> sscanf ( linebuf, "     ------     %s     ------", selname ) ;  if ( fscanf ( fp, "     sy   =   %d,   sx   =   %d,   cy   =   %d,   cx   =   %d\\n", & sy, & sx, & cy, & cx )!= 4 ) { LEPT_FREE ( selname ) ; return ( SEL * ) ERROR_PTR ( "dimensions   not   read", procName, NULL ) ; } if ( ( sel = selCreate ( sy, sx, selname ) ) == NULL ) { LEPT_FREE ( selname ) ; return ( SEL * ) ERROR_PTR ( "sel   not   made", procName, NULL ) ; } selSetOrigin ( sel, cy, cx ) ; for ( i = 0 ; i < sy ; i ++ ) { ignore = fscanf ( fp, "         " ) ; for ( j = 0 ; j < sx ; j ++ ) ignore = fscanf ( fp, "%1d", & sel -> data [ i ] [ j ] ) ; ignore = fscanf ( fp, "\\n"

Fix:
<S2SV_ModStart> char linebuf [ L_BUFSIZE <S2SV_ModEnd> ] ; l_int32 <S2SV_ModStart> ( linebuf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( linebuf, " <S2SV_blank> <S2SV_blank> ------ <S2SV_blank> <S2SV_blank> %200s <S2SV_blank> <S2SV_blank> ------" <S2SV_ModEnd>, selname )
Buggy code:
 int jas_stream_gobble ( jas_stream_t * stream, int n ) { <START_BUG> int m ; <END_BUG> m = n ; for ( m = n ; m > 0 ; -- m ) { if ( jas_stream_getc ( stream ) == EOF ) { return n - m ; } } return n ; }

Fix:
<S2SV_ModStart> int m ; if ( n < 0 ) { jas_deprecated ( "negative <S2SV_blank> count <S2SV_blank> for <S2SV_blank> jas_stream_gobble" ) ; }
Buggy code:
 static int ext4_write_begin ( struct file * file, struct address_space * mapping, loff_t pos, unsigned len, unsigned flags, struct page * * pagep, void * * fsdata ) { struct inode * inode = mapping -> host ; int ret, needed_blocks ; handle_t * handle ; int retries = 0 ; struct page * page ; pgoff_t index ; unsigned from, to ; trace_ext4_write_begin ( inode, pos, len, flags ) ; needed_blocks = ext4_writepage_trans_blocks ( inode ) + 1 ; index = pos >> PAGE_CACHE_SHIFT ; from = pos & ( PAGE_CACHE_SIZE - 1 ) ; to = from + len ; retry : handle = ext4_journal_start ( inode, needed_blocks ) ; if ( IS_ERR ( handle ) ) { ret = PTR_ERR ( handle ) ; goto out ; } flags |= AOP_FLAG_NOFS ; page = grab_cache_page_write_begin ( mapping, index, flags ) ; if (! page ) { ext4_journal_stop ( handle ) ; ret = - ENOMEM ; goto out ; } * pagep = page ; <START_BUG> ret = block_write_begin ( file, mapping, pos, len, flags, pagep, fsdata, <END_BUG>  ext4_get_block ) ; <START_BUG> if (! ret && ext4_should_journal_data ( inode ) ) { ret = walk_page_buffers ( handle, page_buffers ( page ), from, to, NULL, do_journal_get_write_access ) ; } if ( ret ) { unlock_page ( page ) ; page_cache_release ( page ) ; if ( pos + len > inode -> i_size && ext4_can_truncate ( inode ) ) ext4_orphan_add ( handle, inode ) ; ext4_journal_stop ( handle ) ; if ( pos + len > inode -> i_size ) { ext4_truncate_failed_write ( inode ) ; if ( inode -> i_nlink ) ext4_orphan_del ( NULL, inode ) ; } } if ( ret == - ENOSPC && ext4_should_retry_alloc ( inode -> i_sb, & retries ) ) goto retry ; out : return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> = page ; if ( ext4_should_dioread_nolock ( inode ) ) <S2SV_ModStart>, fsdata, ext4_get_block_write ) ; else ret = block_write_begin ( file, mapping, pos, len, flags, pagep, fsdata,
Buggy code:
 static __u8 * lg_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { struct lg_drv_data * drv_data = hid_get_drvdata ( hdev ) ; struct usb_device_descriptor * udesc ; __u16 bcdDevice, rev_maj, rev_min ; <START_BUG> if ( ( drv_data -> quirks & LG_RDESC ) && * rsize >= 90 && rdesc [ 83 ] == 0x26 && <END_BUG> rdesc [ 84 ] == 0x8c && rdesc [ 85 ] == 0x02 ) { hid_info ( hdev, "fixing   up   Logitech   keyboard   report   descriptor\\n" ) ; rdesc [ 84 ] = rdesc [ 89 ] = 0x4d ; rdesc [ 85 ] = rdesc [ 90 ] = 0x10 ; }  if ( ( drv_data -> quirks & LG_RDESC_REL_ABS ) && * rsize >= 50 && <START_BUG> rdesc [ 32 ] == 0x81 && rdesc [ 33 ] == 0x06 && rdesc [ 49 ] == 0x81 && rdesc [ 50 ] == 0x06 ) { hid_info ( hdev, "fixing   up   rel//abs   in   Logitech   report   descriptor\\n" ) ; rdesc [ 33 ] = rdesc [ 50 ] = 0x02 ; } switch ( hdev -> product ) { case USB_DEVICE_ID_LOGITECH_WHEEL : udesc = & ( hid_to_usb_dev ( hdev ) -> descriptor ) ; if (! udesc ) { hid_err ( hdev, "NULL   USB   device   descriptor\\n" ) ; break ; } bcdDevice = le16_to_cpu ( udesc -> bcdDevice ) ; rev_maj = bcdDevice >> 8 ; rev_min = bcdDevice & 0xff ; if ( rev_maj == 1 && rev_min == 2 && * rsize == DF_RDESC_ORIG_SIZE ) { hid_info ( hdev, "fixing   up   Logitech   Driving   Force   report   descriptor\\n" ) ; rdesc =<END_BUG>

Fix:
<S2SV_ModStart> * rsize >= 91 <S2SV_ModEnd> && rdesc [ <S2SV_ModStart> * rsize >= 51 <S2SV_ModEnd> && rdesc [
Buggy code:
 error_t dm9000Init ( NetInterface * interface ) { uint_t i ; uint16_t vendorId ; uint16_t productId ; <START_BUG> uint8_t chipRevision ; <END_BUG> Dm9000Context * context ; TRACE_INFO ( "Initializing   DM9000   Ethernet   controller...\\r\\n" ) ; interface -> extIntDriver -> init ( ) ; context = ( Dm9000Context * ) interface -> nicContext ; context -> queuedPackets = 0 ; context -> txBuffer = memPoolAlloc ( ETH_MAX_FRAME_SIZE ) ; context -> rxBuffer = memPoolAlloc ( ETH_MAX_FRAME_SIZE ) ; if ( context -> txBuffer == NULL || context -> rxBuffer == NULL ) { memPoolFree ( context -> txBuffer ) ; memPoolFree ( context -> rxBuffer ) ; return ERROR_OUT_OF_MEMORY ; }  vendorId = ( dm9000ReadReg ( DM9000_REG_VIDH ) << 8 ) | dm9000ReadReg ( DM9000_REG_VIDL ) ; <START_BUG> <END_BUG> productId = ( dm9000ReadReg ( DM9000_REG_PIDH ) << 8 ) | dm9000ReadReg ( DM9000_REG_PIDL ) ;  <START_BUG> chipRevision = dm9000ReadReg ( DM9000_REG_CHIPR ) ; <END_BUG> if ( vendorId!= DM9000_VID || productId!= DM9000_PID ) { return ERROR_WRONG_IDENTIFIER ; }  if ( chipRevision!= DM9000A_CHIP_REV && chipRevision!= DM9000B_CHIP_REV ) <START_BUG> { return ERROR_WRONG_IDENTIFIER ; } <END_BUG> dm9000WriteReg ( DM9000_REG_GPR, 0x00 ) ;  sleep ( 10 ) ; <START_BUG> dm9000WriteReg ( DM9000_REG_NCR, NCR_RST ) ; <END_BUG>  while ( ( dm9000ReadReg ( DM9000_REG_NCR ) & NCR_RST )!= 0 ) <START_BUG> { } <END_BUG> dm9000WritePhyReg ( DM9000_PHY_REG_BMCR, BMCR_RST ) ;  <START_BUG> while ( ( dm9000ReadPhyReg ( DM9000_PHY_REG_BMCR ) & BMCR_<END_BUG>

Fix:
<S2SV_ModStart> productId ; uint8_t chipRev <S2SV_ModEnd> ; Dm9000Context * <S2SV_ModStart> ( dm9000ReadReg ( DM9000_VIDH <S2SV_ModEnd> ) << 8 <S2SV_ModStart> | dm9000ReadReg ( DM9000_VIDL <S2SV_ModEnd> ) ; productId <S2SV_ModStart> ( dm9000ReadReg ( DM9000_PIDH <S2SV_ModEnd> ) << 8 <S2SV_ModStart> | dm9000ReadReg ( DM9000_PIDL ) ; chipRev <S2SV_ModEnd> = dm9000ReadReg ( <S2SV_ModStart> = dm9000ReadReg ( DM9000_CHIPR <S2SV_ModEnd> ) ; if <S2SV_ModStart> } if ( chipRev!= DM9000_CHIPR_REV_A && chipRev!= DM9000_CHIPR_REV_B <S2SV_ModEnd> ) { return <S2SV_ModStart> } dm9000WriteReg ( DM9000_GPR <S2SV_ModEnd>, 0x00 ) <S2SV_ModStart> ; dm9000WriteReg ( DM9000_NCR, DM9000_NCR_RST <S2SV_ModEnd> ) ; while <S2SV_ModStart> ( dm9000ReadReg ( DM9000_NCR ) & DM9000_NCR_RST <S2SV_ModEnd> )!= 0 <S2SV_ModStart> } dm9000WritePhyReg ( DM9000_BMCR, DM9000_B
Buggy code:
 static FILE * open_outfile ( const char * name ) { if ( strcmp ( "-", name ) == 0 ) { set_binary_mode ( stdout ) ; return stdout ; } else { FILE * file = fopen ( name, "wb" ) ; if (! file ) <START_BUG> fatal ( "Failed   to   output   file   %s", name ) ; <END_BUG> return file ; } }

Fix:
<S2SV_ModStart> ) fatal ( "Failed <S2SV_blank> to <S2SV_blank> open <S2SV_blank> output <S2SV_blank> file <S2SV_blank> \'%s\'" <S2SV_ModEnd>, name )
Buggy code:
 static enum hrtimer_restart perf_swevent_hrtimer ( struct hrtimer * hrtimer ) { enum hrtimer_restart ret = HRTIMER_RESTART ; struct perf_sample_data data ; struct pt_regs * regs ; struct perf_event * event ; u64 period ; event = container_of ( hrtimer, struct perf_event, hw. hrtimer ) ; if ( event -> state!= PERF_EVENT_STATE_ACTIVE ) return HRTIMER_NORESTART ; event -> pmu -> read ( event ) ; perf_sample_data_init ( & data, 0 ) ; data. period = event -> hw. last_period ; regs = get_irq_regs ( ) ; if ( regs &&! perf_exclude_event ( event, regs ) ) { if (! ( event -> attr. exclude_idle && current -> pid == 0 ) ) <START_BUG> if ( perf_event_overflow ( event, 0, & data, regs ) ) <END_BUG> ret = HRTIMER_NORESTART ; } period = max_t ( u64, 10000, event -> hw. sample_period ) ; hrtimer_forward_now ( hrtimer, ns_to_ktime ( period ) ) ; return ret ; }

Fix:
<S2SV_ModStart> ( event, <S2SV_ModEnd> & data,
Buggy code:
 SYSCALL_DEFINE5 ( add_key, const char __user *, _type, const char __user *, _description, const void __user *, _payload, size_t, plen, key_serial_t, ringid ) { key_ref_t keyring_ref, key_ref ; char type [ 32 ], * description ; void * payload ; long ret ; ret = - EINVAL ; if ( plen > 1024 * 1024 - 1 ) goto error ; ret = key_get_type_from_user ( type, _type, sizeof ( type ) ) ; if ( ret < 0 ) goto error ; description = NULL ; if ( _description ) { description = strndup_user ( _description, KEY_MAX_DESC_SIZE ) ; if ( IS_ERR ( description ) ) { ret = PTR_ERR ( description ) ; goto error ; } if (! * description ) { kfree ( description ) ; description = NULL ; } else if ( ( description [ 0 ] == '.' ) && ( strncmp ( type, "keyring", 7 ) == 0 ) ) { ret = - EPERM ; goto error2 ; } } payload = NULL ; <START_BUG> if ( _payload ) { <END_BUG> ret = - ENOMEM ; payload = kvmalloc ( plen, GFP_KERNEL ) ; if (! payload ) goto error2 ; ret = - EFAULT ; if ( copy_from_user ( payload, _payload, plen )!= 0 ) goto error3 ; } keyring_ref = lookup_user_key ( ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE ) ; if ( IS_ERR ( keyring_ref ) ) { ret = PTR_ERR ( keyring_ref ) ; goto error3 ; } key_ref = key_create_or_update ( keyring_ref, type, description, payload, plen, KEY_PERM_UNDEF, KEY_ALLOC_IN_QUOTA ) ; if (! IS_ERR ( key_ref ) ) { ret = key_ref_to_ptr ( key_ref ) -> serial ; key_ref_put ( key_ref ) ; } else { ret = PTR_ERR ( key_ref ) ; } key_ref_put ( keyring_ref ) ; error3 : kvfree ( payload )

Fix:
<S2SV_ModStart> ; if ( plen <S2SV_ModEnd> ) { ret
Buggy code:
 static int print_ipcp_config_options ( netdissect_options * ndo, const u_char * p, int length ) { int len, opt ; u_int compproto, ipcomp_subopttotallen, ipcomp_subopt, ipcomp_suboptlen ; if ( length < 2 ) return 0 ; ND_TCHECK2 ( * p, 2 ) ; len = p [ 1 ] ; opt = p [ 0 ] ; if ( length < len ) return 0 ; if ( len < 2 ) { ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u   (length   bogus,   should   be   >=   2)", tok2str ( ipcpopt_values, "unknown", opt ), opt, len ) ) ; return 0 ; } ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u", tok2str ( ipcpopt_values, "unknown", opt ), opt, len ) ) ; switch ( opt ) { case IPCPOPT_2ADDR : if ( len!= 10 ) { ND_PRINT ( ( ndo, "   (length   bogus,   should   be   =   10)" ) ) ; return len ; } ND_TCHECK2 ( * ( p + 6 ), 4 ) ; ND_PRINT ( ( ndo, ":   src   %s,   dst   %s", ipaddr_string ( ndo, p + 2 ), ipaddr_string ( ndo, p + 6 ) ) ) ; break ; case IPCPOPT_IPCOMP : if ( len < 4 ) { ND_PRINT ( ( ndo, "   (length   bogus,   should   be   >=   4)" ) ) ; return 0 ; } <START_BUG> ND_TCHECK2 ( * ( p + 2 ), 2 ) ; <END_BUG> compproto = EXTRACT_16BITS ( p + 2 ) ; ND_PRINT ( ( ndo, ":   %s   (0x%02x):", tok2str ( ipcpopt_compproto_values, "Unknown", compproto ), compproto ) )

Fix:
<S2SV_ModStart> 0 ; } ND_TCHECK_16BITS ( p + <S2SV_ModEnd> 2 ) ;
Buggy code:
 int sr_do_ioctl ( Scsi_CD * cd, struct packet_command * cgc ) { struct scsi_device * SDev ; struct scsi_sense_hdr sshdr ; int result, err = 0, retries = 0 ; <START_BUG> SDev = cd -> device ; <END_BUG> retry : if (! scsi_block_when_processing_errors ( SDev ) ) { err = - ENODEV ; goto out ; } result = scsi_execute ( SDev, cgc -> cmd, cgc -> data_direction, cgc -> buffer, cgc -> buflen,  ( unsigned char * ) cgc -> sense, & sshdr, <START_BUG> cgc -> timeout, IOCTL_RETRIES, 0, 0, NULL ) ; if ( driver_byte ( result )!= 0 ) { switch ( sshdr. sense_key ) { case UNIT_ATTENTION : SDev -> changed = 1 ; if (! cgc -> quiet ) sr_printk ( KERN_INFO, cd, "disc   change   detected.\\n" ) ; if ( retries ++ < 10 ) goto retry ; err = - ENOMEDIUM ; break ; case NOT_READY : if ( sshdr. asc == 0x04 && sshdr. ascq == 0x01 ) { if (! cgc -> quiet ) sr_printk ( KERN_INFO, cd, "CDROM   not   ready   yet.\\n" ) ; if ( retries ++ < 10 ) { ssleep ( 2 ) ; goto retry ; } else { err = - ENOMEDIUM ; break ; } } if (! cgc -> quiet ) sr_printk ( KERN_INFO, cd, "CDROM   not   ready.     Make   sure   there   " "is   a   disc   in   the   drive.\\n" ) ; err = - ENOMEDIUM ; break ; case ILLEGAL_REQUEST : err = - EIO ; if ( sshdr. asc == 0x20 && sshdr. ascq == 0x00 ) err = - EDRIVE_CANT_DO_THIS ; break ; default : err = - EIO ; } } out : cgc -> stat = err ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; unsigned char sense_buffer [ SCSI_SENSE_BUFFERSIZE ], * senseptr = NULL ; <S2SV_ModStart> cd -> device ; if ( cgc -> sense ) senseptr = sense_buffer <S2SV_ModStart> -> buflen, senseptr, & sshdr, cgc -> timeout, IOCTL_RETRIES, 0, 0, NULL ) ; if ( cgc -> sense ) memcpy ( cgc -> sense, sense_buffer, sizeof ( * <S2SV_ModEnd> cgc -> sense <S2SV_ModStart> cgc -> sense ) <S2SV_ModEnd> ) ; if
Buggy code:
 static OPJ_BOOL opj_pi_next_cprl ( opj_pi_iterator_t * pi ) { opj_pi_comp_t * comp = NULL ; opj_pi_resolution_t * res = NULL ; OPJ_UINT32 index = 0 ; if (! pi -> first ) { comp = & pi -> comps [ pi -> compno ] ; goto LABEL_SKIP ; } else { pi -> first = 0 ; } for ( pi -> compno = pi -> poc. compno0 ; pi -> compno < pi -> poc. compno1 ; pi -> compno ++ ) { OPJ_UINT32 resno ; comp = & pi -> comps [ pi -> compno ] ; pi -> dx = 0 ; pi -> dy = 0 ; for ( resno = 0 ; resno < comp -> numresolutions ; resno ++ ) { OPJ_UINT32 dx, dy ; res = & comp -> resolutions [ resno ] ; dx = comp -> dx * ( 1u << ( res -> pdx + comp -> numresolutions - 1 - resno ) ) ; dy = comp -> dy * ( 1u << ( res -> pdy + comp -> numresolutions - 1 - resno ) ) ; pi -> dx =! pi -> dx? dx : opj_uint_min ( pi -> dx, dx ) ; pi -> dy =! pi -> dy? dy : opj_uint_min ( pi -> dy, dy ) ; } if (! pi -> tp_on ) { pi -> poc. ty0 = pi -> ty0 ; pi -> poc. tx0 = pi -> tx0 ; pi -> poc. ty1 = pi -> ty1 ; pi -> poc. tx1 = pi -> tx1 ; } for ( pi -> y = pi -> poc. ty0 ; pi -> y < pi -> poc. ty1 ; pi -> y += ( OPJ_INT32 ) ( pi -> dy - ( OPJ_UINT32 ) ( pi -> y % ( OPJ_INT32 ) pi -> dy ) ) ) { for ( pi -> x = pi -> poc. tx0 ; pi -> x < pi -> poc. tx1 ; pi -> x += ( OPJ_INT32 ) ( pi -> dx - ( OPJ_UINT32 )

Fix:
<S2SV_ModStart> ; if ( rpx >= 31 || ( ( comp -> dx << rpx ) >> rpx )!= comp -> dx || rpy >= 31 || ( ( comp -> dy << rpy ) >> rpy )!= comp -> dy ) { continue ; } if (
Buggy code:
 static int journal_unmap_buffer ( journal_t * journal, struct buffer_head * bh ) { transaction_t * transaction ; struct journal_head * jh ; int may_free = 1 ; int ret ; BUFFER_TRACE ( bh, "entry" ) ; if (! buffer_jbd ( bh ) ) goto zap_buffer_unlocked ; write_lock ( & journal -> j_state_lock ) ; jbd_lock_bh_state ( bh ) ; spin_lock ( & journal -> j_list_lock ) ; jh = jbd2_journal_grab_journal_head ( bh ) ; if (! jh ) goto zap_buffer_no_jh ; transaction = jh -> b_transaction ; if ( transaction == NULL ) { if (! jh -> b_cp_transaction ) { JBUFFER_TRACE ( jh, "not   on   any   transaction:   zap" ) ; goto zap_buffer ; } if (! buffer_dirty ( bh ) ) { goto zap_buffer ; } if ( journal -> j_running_transaction ) { JBUFFER_TRACE ( jh, "checkpointed:   add   to   BJ_Forget" ) ; ret = __dispose_buffer ( jh, journal -> j_running_transaction ) ; jbd2_journal_put_journal_head ( jh ) ; spin_unlock ( & journal -> j_list_lock ) ; jbd_unlock_bh_state ( bh ) ; write_unlock ( & journal -> j_state_lock ) ; return ret ; } else { if ( journal -> j_committing_transaction ) { JBUFFER_TRACE ( jh, "give   to   committing   trans" ) ; ret = __dispose_buffer ( jh, journal -> j_committing_transaction ) ; jbd2_journal_put_journal_head ( jh ) ; spin_unlock ( & journal -> j_list_lock ) ; jbd_unlock_bh_state ( bh ) ; write_unlock ( & journal -> j_state_lock ) ; return ret ; } else { clear_buffer_jbddirty ( bh ) ; goto zap_buffer ; } } } else if ( transaction == journal -> j_committing_transaction ) { JBUFFER_TRACE ( jh,

Fix:
<S2SV_ModStart> bh ) ; clear_buffer_delay ( bh ) ; clear_buffer_unwritten ( bh ) ;
Buggy code:
 <START_BUG> static unsigned int XBMInteger ( Image * image, short int * hex_digits ) <END_BUG> { int c ; unsigned int value ; do { c = ReadBlobByte ( image ) ; if ( c == EOF )  return ( 0 ) ; <START_BUG> } while ( ( c ==' ') || ( c == '\\t' ) || ( c == '\\n' ) || ( c == '\\r' ) ) ; value = 0 ; do { if ( value > ( unsigned int ) ( INT_MAX // 10 ) ) break ; value *= 16 ; c &= 0xff ; if ( value > ( unsigned int ) ( INT_MAX - hex_digits [ c ] ) ) break ; value += hex_digits [ c ] ; c = ReadBlobByte ( image ) ; if ( c == EOF ) <END_BUG> return ( 0 ) ;  } while ( hex_digits [ c ] >= 0 ) ; <START_BUG> return ( value ) ; <END_BUG> }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static <S2SV_ModEnd> int XBMInteger ( <S2SV_ModStart> ) return ( - 1 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) return ( - 1 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ; return ( ( int )
Buggy code:
 static BOOL GetStartupData ( HANDLE pipe, STARTUP_DATA * sud ) { size_t size, len ; <START_BUG> BOOL ret = FALSE ; <END_BUG> WCHAR * data = NULL ; DWORD bytes, read ; bytes = PeekNamedPipeAsync ( pipe, 1, & exit_event ) ; if ( bytes == 0 ) { MsgToEventLog ( M_SYSERR, TEXT ( "PeekNamedPipeAsync   failed" ) ) ; ReturnLastError ( pipe, L"PeekNamedPipeAsync" ) ;  goto out ; <START_BUG> } size = bytes // sizeof ( * data ) ; if ( size == 0 ) { MsgToEventLog ( M_SYSERR, TEXT ( "malformed   startup   data:   1   byte   received" ) ) ; ReturnError ( pipe, ERROR_STARTUP_DATA, L"GetStartupData", 1, & exit_event ) ; <END_BUG> goto out ;  } data = malloc ( bytes ) ; if ( data == NULL ) { MsgToEventLog ( M_SYSERR, TEXT ( "malloc   failed" ) ) ; ReturnLastError ( pipe, L"malloc" ) ; <START_BUG> goto out ; <END_BUG> } read = ReadPipeAsync ( pipe, data, bytes, 1, & exit_event ) ; if ( bytes!= read ) { MsgToEventLog ( M_SYSERR, TEXT ( "ReadPipeAsync   failed" ) ) ; ReturnLastError ( pipe, L"ReadPipeAsync" ) ;  goto out ; <START_BUG> } if ( data [ size - 1 ]!= 0 ) { MsgToEventLog ( M_ERR, TEXT ( "Startup   data   is   not   NULL   terminated" ) ) ; ReturnError ( pipe, ERROR_STARTUP_DATA, L"GetStartupData", 1, & exit_event ) ; <END_BUG> goto out ;  } sud -> directory = data ; len = wcslen ( sud -> directory ) + 1 ; size -= len ; if ( size <= 0 ) { MsgToEventLog ( M_ERR, TEXT ( "Startup   data   ends   at   working   directory" ) ) ; ReturnError ( pipe, ERROR_STARTUP_DATA, L"GetStartupData", 1, & exit_event ) ; <START_BUG> goto out ; <END_BUG> } sud -> options = sud -> directory + len ; len

Fix:
<S2SV_ModStart>, len ; <S2SV_ModEnd> WCHAR * data <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } size <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } data <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } read <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } if <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } sud <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } sud <S2SV_ModStart> ) ; goto err <S2SV_ModEnd> ; } sud <S2SV_ModStart> + len ; return TRUE ; err : sud -> directory <S2SV_ModEnd> = NULL ; <S2SV_ModStart> = NULL ; <S2SV_ModEnd> free ( data <S2SV_ModStart> ) ; return FALSE <S2SV_ModEnd> ; } <S2SV_null>