nus-yam/ex-repair huggingface dataset:
Buggy code:
 static Image * ReadGRAYImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * canvas_image, * image ; MagickBooleanType status ; MagickOffsetType scene ; QuantumInfo * quantum_info ; QuantumType quantum_type ; size_t length ; ssize_t count, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( OptionError, "MustSpecifyImageSize" ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } if ( DiscardBlobBytes ( image, ( size_t ) image -> offset ) == MagickFalse ) ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; SetImageColorspace ( image, GRAYColorspace ) ; canvas_image = CloneImage ( image, image -> extract_info. width, 1, MagickFalse, exception ) ; ( void ) SetImageVirtualPixelMethod ( canvas_image, BlackVirtualPixelMethod ) ; quantum_type = GrayQuantum ; quantum_info = AcquireQuantumInfo ( image_info, canvas_image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; pixels = GetQuantumPixels ( quantum_info ) ; if ( image_info -> number_scenes!= 0 ) while ( image -> scene < image_info -> scene ) { image -> scene ++ ; length = GetQuantumExtent ( canvas_image, quantum_info, quantum_type ) ; for ( y = 0 ; y < ( ssize_t ) image -> rows ;

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static void write_modes_b ( VP9_COMP * cpi, const TileInfo * const tile, <START_BUG> vp9_writer * w, TOKENEXTRA * * tok, TOKENEXTRA * tok_end, <END_BUG> int mi_row, int mi_col ) {  VP9_COMMON * const cm = & cpi -> common ; <START_BUG> <END_BUG> MACROBLOCKD * const xd = & cpi -> mb. e_mbd ;  MODE_INFO * m ; xd -> mi = cm -> mi_grid_visible + ( mi_row * cm -> mi_stride + mi_col ) ; m = xd -> mi [ 0 ] ; <START_BUG> set_mi_row_col ( xd, tile, <END_BUG> mi_row, num_8x8_blocks_high_lookup [ m -> mbmi. sb_type ], mi_col, num_8x8_blocks_wide_lookup [ m -> mbmi. sb_type ], cm -> mi_rows, cm -> mi_cols ) ; if ( frame_is_intra_only ( cm ) ) {  write_mb_modes_kf ( cpi, xd -> mi, w ) ; <START_BUG> } else { pack_inter_mode_mvs ( cpi, m, w ) ; } assert ( * tok < tok_end ) ; <END_BUG> pack_mb_tokens ( w, tok, tok_end ) ;  }

Fix:
<S2SV_ModStart> const tile, vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> * tok, const TOKENEXTRA * const <S2SV_ModEnd> tok_end, int <S2SV_ModStart> mi_col ) { const <S2SV_ModStart> & cpi -> td. <S2SV_ModStart> 0 ] ; cpi -> td. mb. mbmi_ext = cpi -> td. mb. mbmi_ext_base + ( mi_row * cm -> mi_cols + mi_col ) ; <S2SV_ModStart> { write_mb_modes_kf ( cm, xd <S2SV_ModEnd>, xd -> <S2SV_ModStart> tok, tok_end, cm -> bit_depth
Buggy code:
 static int parse_token ( char * * name, char * * value, char * * cp ) { char * end ; if (! name ||! value ||! cp ) return - BLKID_ERR_PARAM ; if (! ( * value = strchr ( * cp, '=' ) ) ) return 0 ; * * value = '\\0' ; * name = strip_line ( * cp ) ; * value = skip_over_blank ( * value + 1 ) ; if ( * * value == \'"\' ) { <START_BUG> end = strchr ( * value + 1, \'"\' ) ; <END_BUG> if (! end ) { DBG ( READ, ul_debug ( "unbalanced   quotes   at:   %s", * value ) ) ; * cp = * value ; return - BLKID_ERR_CACHE ; } ( * value ) ++ ; * end = '\\0' ;  end ++ ; <START_BUG> } else { end = skip_over_word ( * value ) ; if ( * end ) { * end = '\\0' ; end ++ ; } } * cp = end ; return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> \'"\' ) { char * p = end = <S2SV_ModEnd> * value + <S2SV_ModStart> value + 1 ; while ( * p ) { if ( * p == '\\\\' ) { p ++ ; * end = * p ; } else { * end = * p ; if ( * p == \'"\' ) break ; } p ++ ; end ++ ; } if ( * end!= \'"\' <S2SV_ModEnd> ) { DBG <S2SV_ModStart> '\\0' ; end = ++ p <S2SV_ModEnd> ; } else
Buggy code:
 static int sd2_parse_rsrc_fork ( SF_PRIVATE * psf ) { SD2_RSRC rsrc ; int k, marker, error = 0 ; psf_use_rsrc ( psf, SF_TRUE ) ; memset ( & rsrc, 0, sizeof ( rsrc ) ) ; rsrc. rsrc_len = psf_get_filelen ( psf ) ; psf_log_printf ( psf, "Resource   length   :   %d   (0x%04X)\\n", rsrc. rsrc_len, rsrc. rsrc_len ) ; if ( rsrc. rsrc_len > SIGNED_SIZEOF ( psf -> header ) ) { rsrc. rsrc_data = calloc ( 1, rsrc. rsrc_len ) ; rsrc. need_to_free_rsrc_data = SF_TRUE ; } else { rsrc. rsrc_data = psf -> header ; rsrc. need_to_free_rsrc_data = SF_FALSE ; } ; psf_fread ( rsrc. rsrc_data, rsrc. rsrc_len, 1, psf ) ; psf -> headindex = psf -> headend = rsrc. rsrc_len ; rsrc. data_offset = read_rsrc_int ( & rsrc, 0 ) ; rsrc. map_offset = read_rsrc_int ( & rsrc, 4 ) ; rsrc. data_length = read_rsrc_int ( & rsrc, 8 ) ; rsrc. map_length = read_rsrc_int ( & rsrc, 12 ) ; if ( rsrc. data_offset == 0x51607 && rsrc. map_offset == 0x20000 ) { psf_log_printf ( psf, "Trying   offset   of   0x52   bytes.\\n" ) ; rsrc. data_offset = read_rsrc_int ( & rsrc, 0x52 + 0 ) + 0x52 ; rsrc. map_offset = read_rsrc_int ( & rsrc, 0x52 + 4 ) + 0x52 ; rsrc. data_length = read_rsrc_int ( & rsrc, 0x52 + 8 ) ; rsrc. map_length = read_rsrc_int

Fix:
<S2SV_ModStart> + 30 ; if ( rsrc. map_offset + 28 > rsrc. rsrc_len ) { psf_log_printf ( psf, "Bad <S2SV_blank> map <S2SV_blank> offset.\\n" ) ; goto parse_rsrc_fork_cleanup ; } ; <S2SV_ModStart> ++ ) { if ( <S2SV_ModEnd> rsrc. type_offset <S2SV_ModStart> k * 8 > rsrc. rsrc_len ) { psf_log_printf ( psf, "Bad <S2SV_blank> rsrc <S2SV_blank> marker.\\n" ) ; goto parse_rsrc_fork_cleanup ; } ; marker = read_rsrc_marker ( & rsrc, rsrc. type_offset + k * 8
Buggy code:
 static int userfaultfd_unregister ( struct userfaultfd_ctx * ctx, unsigned long arg ) { struct mm_struct * mm = ctx -> mm ; struct vm_area_struct * vma, * prev, * cur ; int ret ; struct uffdio_range uffdio_unregister ; unsigned long new_flags ; bool found ; unsigned long start, end, vma_end ; const void __user * buf = ( void __user * ) arg ; ret = - EFAULT ; if ( copy_from_user ( & uffdio_unregister, buf, sizeof ( uffdio_unregister ) ) ) goto out ; ret = validate_range ( mm, uffdio_unregister. start, uffdio_unregister. len ) ; if ( ret ) goto out ; start = uffdio_unregister. start ; end = start + uffdio_unregister. len ; ret = - ENOMEM ; if (! mmget_not_zero ( mm ) ) goto out ; down_write ( & mm -> mmap_sem ) ; vma = find_vma_prev ( mm, start, & prev ) ; if (! vma ) goto out_unlock ; ret = - EINVAL ; if ( vma -> vm_start >= end ) goto out_unlock ; if ( is_vm_hugetlb_page ( vma ) ) { unsigned long vma_hpagesize = vma_kernel_pagesize ( vma ) ; if ( start & ( vma_hpagesize - 1 ) ) goto out_unlock ; } found = false ; ret = - EINVAL ; for ( cur = vma ; cur && cur -> vm_start < end ; cur = cur -> vm_next ) { cond_resched ( ) ; BUG_ON (!! cur -> vm_userfaultfd_ctx. ctx ^!! ( cur -> vm_flags & ( VM_UFFD_MISSING | VM_UFFD_WP ) ) ) ; if (! vma_can_userfault ( cur ) ) goto out_unlock ; found = true ; } BUG_ON (! found ) ; if ( vma -> vm_start < start ) prev = vma ; ret = 0 ; do { cond_resched ( ) ; BU

Fix:
<S2SV_ModStart> ) ) ; WARN_ON (! ( vma -> vm_flags & VM_MAYWRITE ) ) ;
Buggy code:
 static inline int object_common2 ( UNSERIALIZE_PARAMETER, long elements ) { zval * retval_ptr = NULL ; zval fname ; if ( Z_TYPE_PP ( rval )!= IS_OBJECT ) { return 0 ; } if (! process_nested_data ( UNSERIALIZE_PASSTHRU, Z_OBJPROP_PP ( rval ), elements, 1 ) ) { if ( Z_TYPE_PP ( rval ) == IS_OBJECT ) { zend_hash_clean ( Z_OBJPROP_PP ( rval ) ) ; <START_BUG> } <END_BUG> ZVAL_NULL ( * rval ) ; return 0 ; } if ( Z_TYPE_PP ( rval )!= IS_OBJECT ) { return 0 ; } if ( Z_OBJCE_PP ( rval )!= PHP_IC_ENTRY && zend_hash_exists ( & Z_OBJCE_PP ( rval ) -> function_table, "__wakeup", sizeof ( "__wakeup" ) ) ) { INIT_PZVAL ( & fname ) ; ZVAL_STRINGL ( & fname, "__wakeup", sizeof ( "__wakeup" ) - 1, 0 ) ; BG ( serialize_lock ) ++ ; call_user_function_ex ( CG ( function_table ), rval, & fname, & retval_ptr, 0, 0, 1, NULL TSRMLS_CC ) ; BG ( serialize_lock ) -- ; } if ( retval_ptr ) { zval_ptr_dtor ( & retval_ptr ) ; } if ( EG ( exception ) ) { return 0 ; } return finish_nested_data ( UNSERIALIZE_PASSTHRU ) ; }

Fix:
<S2SV_ModStart> ) ) ; zend_object_store_ctor_failed ( * rval TSRMLS_CC ) ;
Buggy code:
 static int parse_rock_ridge_inode_internal ( struct iso_directory_record * de, struct inode * inode, int flags ) { int symlink_len = 0 ; int cnt, sig ; unsigned int reloc_block ; struct inode * reloc ; struct rock_ridge * rr ; int rootflag ; struct rock_state rs ; int ret = 0 ; if (! ISOFS_SB ( inode -> i_sb ) -> s_rock ) return 0 ; init_rock_state ( & rs, inode ) ; setup_rock_ridge ( de, inode, & rs ) ; if ( flags & RR_REGARD_XA ) { rs. chr += 14 ; rs. len -= 14 ; if ( rs. len < 0 ) rs. len = 0 ; } repeat : while ( rs. len > 2 ) { rr = ( struct rock_ridge * ) rs. chr ; if ( rr -> len < 3 ) goto out ; sig = isonum_721 ( rs. chr ) ; if ( rock_check_overflow ( & rs, sig ) ) goto eio ; rs. chr += rr -> len ; rs. len -= rr -> len ; if ( rs. len < 0 ) goto out ; switch ( sig ) { # ifndef CONFIG_ZISOFS case SIG ( 'R', 'R' ) : if ( ( rr -> u. RR. flags [ 0 ] & ( RR_PX | RR_TF | RR_SL | RR_CL ) ) == 0 ) goto out ; break ; # endif case SIG ( 'S', 'P' ) : if ( check_sp ( rr, inode ) ) goto out ; break ; case SIG ( 'C', 'E' ) : rs. cont_extent = isonum_733 ( rr -> u. CE. extent ) ; rs. cont_offset = isonum_733 ( rr -> u. CE. offset ) ; rs. cont_size = isonum_733 ( rr -> u. CE. size ) ; break ; case SIG ( 'E', 'R' ) : <START_BUG> ISOFS_SB ( inode -> i_sb ) -> s_rock = 1 ; <END_BUG> printk ( KERN_DEBUG "ISO   9660   Extensions:   " ) ; { int p ; for ( p = 0 ; p < rr -> u. ER.

Fix:
<S2SV_ModStart> 'R' ) : if ( rr -> u. ER. len_id + offsetof ( struct rock_ridge, u. ER. data ) > rr -> len ) goto out ;
Buggy code:
 static int cdf_check_stream_offset ( const cdf_stream_t * sst, const cdf_header_t * h, const void * p, size_t tail, int line ) { const char * b = ( const char * ) sst -> sst_tab ; const char * e = ( ( const char * ) p ) + tail ; <START_BUG> ( void ) & line ; <END_BUG>  if ( e >= b && ( size_t ) ( e - b ) <= CDF_SEC_SIZE ( h ) * sst -> sst_len ) <START_BUG> return 0 ; DPRINTF ( ( "%d:   offset   begin   %p   <   end   %p   ||   %" SIZE_T_FORMAT "u" "   >   %" SIZE_T_FORMAT "u   [%" SIZE_T_FORMAT "u   %" SIZE_T_FORMAT "u]\\n", line, b, e, ( size_t ) ( e - b ), <END_BUG> CDF_SEC_SIZE ( h ) * sst -> sst_len, CDF_SEC_SIZE ( h ), sst -> sst_len ) ) ;  errno = EFTYPE ; return - 1 ; }

Fix:
<S2SV_ModStart> + tail ; size_t ss = sst -> sst_dirlen < h -> h_min_size_standard_stream? CDF_SHORT_SEC_SIZE ( h ) : CDF_SEC_SIZE ( h ) ; <S2SV_ModStart> b ) <= ss <S2SV_ModEnd> * sst -> <S2SV_ModStart> b ), ss <S2SV_ModEnd> * sst -> <S2SV_ModStart> -> sst_len, ss <S2SV_ModEnd>, sst ->
Buggy code:
 static void parse_content_range ( URLContext * h, const char * p ) { HTTPContext * s = h -> priv_data ; const char * slash ; if (! strncmp ( p, "bytes   ", 6 ) ) { p += 6 ; <START_BUG> s -> off = strtoll ( p, NULL, 10 ) ; <END_BUG> if ( ( slash = strchr ( p, '//' ) ) && strlen ( slash ) > 0 )  s -> filesize = strtoll ( slash + 1, NULL, 10 ) ; <START_BUG> } if ( s -> seekable == - 1 && (! s -> is_akamai || s -> filesize!= 2147483647 ) ) h -> is_streamed = 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> off = strtoull <S2SV_ModEnd> ( p, <S2SV_ModStart> -> filesize = strtoull <S2SV_ModEnd> ( slash +
Buggy code:
 static void bt_for_each ( struct blk_mq_hw_ctx * hctx, struct blk_mq_bitmap_tags * bt, unsigned int off, busy_iter_fn * fn, void * data, bool reserved ) { struct request * rq ; int bit, i ; for ( i = 0 ; i < bt -> map_nr ; i ++ ) { struct blk_align_bitmap * bm = & bt -> map [ i ] ; for ( bit = find_first_bit ( & bm -> word, bm -> depth ) ; bit < bm -> depth ; bit = find_next_bit ( & bm -> word, bm -> depth, bit + 1 ) ) { <START_BUG> rq = blk_mq_tag_to_rq ( hctx -> tags, off + bit ) ; <END_BUG> if ( rq -> q == hctx -> queue ) fn ( hctx, rq, data, reserved ) ; } off += ( 1 << bt -> bits_per_word ) ; } }

Fix:
<S2SV_ModStart> { rq = <S2SV_ModEnd> hctx -> tags <S2SV_ModStart> hctx -> tags -> rqs [ <S2SV_ModEnd> off + bit <S2SV_ModStart> off + bit ] <S2SV_ModEnd> ; if (
Buggy code:
 <START_BUG> static void kiocb_batch_free ( struct kiocb_batch * batch ) <END_BUG> {  struct kiocb * req, * n ; <START_BUG> list_for_each_entry_safe ( req, n, & batch -> head, ki_batch ) { list_del ( & req -> ki_batch ) ; <END_BUG> kmem_cache_free ( kiocb_cachep, req ) ;  <START_BUG> } <END_BUG> }

Fix:
<S2SV_ModStart> void kiocb_batch_free ( struct kioctx * ctx, <S2SV_ModStart>, * n ; if ( list_empty ( & batch -> head ) ) return ; spin_lock_irq ( & ctx -> ctx_lock ) <S2SV_ModStart> ki_batch ) ; list_del ( & req -> ki_list ) ; <S2SV_ModStart> req ) ; ctx -> reqs_active -- ; } spin_unlock_irq ( & ctx -> ctx_lock ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static bool snd_ctl_remove_numid_conflict ( struct snd_card * card, unsigned int count ) { <START_BUG> struct snd_kcontrol * kctl ; <END_BUG> list_for_each_entry ( kctl, & card -> controls, list ) { if ( kctl -> id. numid < card -> last_numid + 1 + count && kctl -> id. numid + kctl -> count > card -> last_numid + 1 ) { card -> last_numid = kctl -> id. numid + kctl -> count - 1 ; return true ; } } return false ; }

Fix:
<S2SV_ModStart> snd_kcontrol * kctl ; if ( card -> last_numid >= UINT_MAX - count ) card -> last_numid = 0
Buggy code:
 int mif_validate ( jas_stream_t * in ) { <START_BUG> uchar buf [ MIF_MAGICLEN ] ; <END_BUG> uint_fast32_t magic ; int i ; int n ; assert ( JAS_STREAM_MAXPUTBACK >= MIF_MAGICLEN ) ; if ( ( n = jas_stream_read ( in, buf, MIF_MAGICLEN ) ) < 0 ) { return - 1 ; } for ( i = n - 1 ; i >= 0 ; -- i ) { if ( jas_stream_ungetc ( in, buf [ i ] ) == EOF ) { return - 1 ; } } if ( n < MIF_MAGICLEN ) { return - 1 ; } magic = ( JAS_CAST ( uint_fast32_t, buf [ 0 ] ) << 24 ) | ( JAS_CAST ( uint_fast32_t, buf [ 1 ] ) << 16 ) | ( JAS_CAST ( uint_fast32_t, buf [ 2 ] ) << 8 ) | buf [ 3 ] ; if ( magic!= MIF_MAGIC ) { return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> in ) { jas_uchar <S2SV_ModEnd> buf [ MIF_MAGICLEN
Buggy code:
 static VTermScreen * screen_new ( VTerm * vt ) { VTermState * state = vterm_obtain_state ( vt ) ; VTermScreen * screen ; int rows, cols ; <START_BUG> if (! state ) <END_BUG> return NULL ;  screen = vterm_allocator_malloc ( vt, sizeof ( VTermScreen ) ) ; <START_BUG> vterm_get_size ( vt, & rows, & cols ) ; screen -> vt = vt ; screen -> state = state ; screen -> damage_merge = VTERM_DAMAGE_CELL ; screen -> damaged. start_row = - 1 ; screen -> pending_scrollrect. start_row = - 1 ; screen -> rows = rows ; screen -> cols = cols ; screen -> callbacks = NULL ; screen -> cbdata = NULL ; screen -> buffers [ 0 ] = realloc_buffer ( screen, NULL, rows, cols ) ; screen -> buffer = screen -> buffers [ 0 ] ; screen -> sb_buffer = vterm_allocator_malloc ( screen -> vt, sizeof ( VTermScreenCell ) * cols ) ; <END_BUG> vterm_state_set_callbacks ( screen -> state, & state_cbs, screen ) ;  return screen ; }

Fix:
<S2SV_ModStart> ; if ( state == NULL <S2SV_ModEnd> ) return NULL <S2SV_ModStart> VTermScreen ) ) ; if ( screen == NULL ) return NULL <S2SV_ModStart> cols ) ; if ( screen -> buffer == NULL || screen -> sb_buffer == NULL ) { vterm_screen_free ( screen ) ; return NULL ; }
Buggy code:
 static bool parse_cmdline ( int argc, char * * argv ) { int c ; bool reopen_log = false ; int signum ; struct utsname uname_buf ; int longindex ; int curind ; bool bad_option = false ; unsigned facility ; mode_t new_umask_val ; struct option long_options [ ] = { { "use-file", required_argument, NULL, 'f' }, # if defined _WITH_VRRP_ && defined _WITH_LVS_ { "vrrp", no_argument, NULL, 'P' }, { "check", no_argument, NULL, 'C' }, # endif # ifdef _WITH_BFD_ { "no_bfd", no_argument, NULL, 'B' }, # endif { "all", no_argument, NULL, 3 }, { "log-console", no_argument, NULL, 'l' }, { "log-detail", no_argument, NULL, 'D' }, { "log-facility", required_argument, NULL, 'S' }, { "log-file", optional_argument, NULL, 'g' }, { "flush-log-file", no_argument, NULL, 2 }, { "no-syslog", no_argument, NULL, 'G' }, { "umask", required_argument, NULL, 'u' }, # ifdef _WITH_VRRP_ { "release-vips", no_argument, NULL, 'X' }, { "dont-release-vrrp", no_argument, NULL, 'V' }, # endif # ifdef _WITH_LVS_ { "dont-release-ipvs", no_argument, NULL, 'I' }, # endif { "dont-respawn", no_argument, NULL, 'R' }, { "dont-fork", no_argument, NULL, 'n' }, { "dump-conf", no_argument, NULL, 'd' }, { "pid", required_argument, NULL, 'p' }, # ifdef _WITH_VRRP_ { "vrrp_pid", required_argument, NULL, 'r'

Fix:
<S2SV_ModStart> O_APPEND | O_CREAT | O_NOFOLLOW
Buggy code:
 int ConnectClientToUnixSock ( const char * sockFile ) { # ifdef WIN32 rfbClientErr ( "Windows   doesn\'t   support   UNIX   sockets\\n" ) ; return - 1 ; # else int sock ; struct sockaddr_un addr ; <START_BUG> addr. sun_family = AF_UNIX ; <END_BUG> strcpy ( addr. sun_path, sockFile ) ; sock = socket ( AF_UNIX, SOCK_STREAM, 0 ) ; if ( sock < 0 ) { rfbClientErr ( "ConnectToUnixSock:   socket   (%s)\\n", strerror ( errno ) ) ; return - 1 ; } if ( connect ( sock, ( struct sockaddr * ) & addr, sizeof ( addr. sun_family ) + strlen ( addr. sun_path ) ) < 0 ) { rfbClientErr ( "ConnectToUnixSock:   connect\\n" ) ; close ( sock ) ; return - 1 ; } return sock ; # endif }

Fix:
<S2SV_ModStart> = AF_UNIX ; if ( strlen ( sockFile ) + 1 > sizeof ( addr. sun_path ) ) { rfbClientErr ( "ConnectToUnixSock: <S2SV_blank> socket <S2SV_blank> file <S2SV_blank> name <S2SV_blank> too <S2SV_blank> long\\n" ) ; return - 1 ; }
Buggy code:
 static int xdp_umem_reg ( struct xdp_umem * umem, struct xdp_umem_reg * mr ) { bool unaligned_chunks = mr -> flags & XDP_UMEM_UNALIGNED_CHUNK_FLAG ; u32 chunk_size = mr -> chunk_size, headroom = mr -> headroom ; unsigned int chunks, chunks_per_page ; u64 addr = mr -> addr, size = mr -> len ; <START_BUG> int size_chk, err ; <END_BUG> if ( chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE ) { return - EINVAL ; } if ( mr -> flags & ~ ( XDP_UMEM_UNALIGNED_CHUNK_FLAG | XDP_UMEM_USES_NEED_WAKEUP ) ) return - EINVAL ; if (! unaligned_chunks &&! is_power_of_2 ( chunk_size ) ) return - EINVAL ; if (! PAGE_ALIGNED ( addr ) ) { return - EINVAL ; } if ( ( addr + size ) < addr ) return - EINVAL ; chunks = ( unsigned int ) div_u64 ( size, chunk_size ) ; if ( chunks == 0 ) return - EINVAL ; if (! unaligned_chunks ) { chunks_per_page = PAGE_SIZE // chunk_size ; if ( chunks < chunks_per_page || chunks % chunks_per_page ) return - EINVAL ; }  size_chk = chunk_size - headroom - XDP_PACKET_HEADROOM ; <START_BUG> if ( size_chk < 0 ) return - EINVAL ; umem -> address = ( unsigned long ) addr ; umem -> chunk_mask = unaligned_chunks? XSK_UNALIGNED_BUF_ADDR_MASK : ~ ( ( u64 ) chunk_size - 1 ) ; umem -> size = size ; umem -> headroom = headroom ; umem -> chunk_size_nohr = chunk_size - headroom ; umem -> npgs = size // PAGE_SIZE ; umem -> pgs = NULL ; umem -> user = NULL ; umem -> flags = mr -> flags ; INIT_LIST_HEAD ( & umem -> xsk_list ) ; spin_lock<END_BUG>

Fix:
<S2SV_ModStart> len ; int <S2SV_ModEnd> err ; if <S2SV_ModStart> EINVAL ; } if ( headroom >= chunk_size - XDP_PACKET_HEADROOM <S2SV_ModEnd> ) return -
Buggy code:
 static bool parseOperands ( char * str, ArmOp * op ) { char * t = strdup ( str ) ; int operand = 0 ; char * token = t ; char * x ; int imm_count = 0 ; int mem_opt = 0 ; if (! token ) { return false ; } while ( token ) { char * next = strchr ( token, ',' ) ; if ( next ) { * next ++ = 0 ; } while ( token [ 0 ] ==' ') { token ++ ; } if ( operand >= MAX_OPERANDS ) { eprintf ( "Too   many   operands\\n" ) ; return false ; } op -> operands [ operand ]. type = ARM_NOTYPE ; op -> operands [ operand ]. reg_type = ARM_UNDEFINED ; op -> operands [ operand ]. shift = ARM_NO_SHIFT ; while ( token [ 0 ] ==' '|| token [ 0 ] == '[' || token [ 0 ] == ']' ) { token ++ ; } if (! strncmp ( token, "lsl", 3 ) ) { op -> operands [ operand ]. shift = ARM_LSL ; } else if (! strncmp ( token, "lsr", 3 ) ) { op -> operands [ operand ]. shift = ARM_LSR ; } else if (! strncmp ( token, "asr", 3 ) ) { op -> operands [ operand ]. shift = ARM_ASR ; } <START_BUG> if ( op -> operands [ operand ]. shift!= ARM_NO_SHIFT ) { <END_BUG> op -> operands_count ++ ; op -> operands [ operand ]. shift_amount = r_num_math ( NULL, token + 4 ) ; if ( op -> operands [ operand ]. shift_amount > 63 ) { return false ; } operand ++ ; token = next ; continue ; } switch ( token [ 0 ] ) { case 'x' : x = strchr ( token, ',' ) ; if ( x ) { x [ 0 ] = '\\0' ; } op -> operands_count ++ ; op -> operands [ operand ]. type = ARM_GPR ; op -> operands [ operand ]. reg_type = ARM_REG64 ; op -> operands [ operand ]. reg = r_num_math ( NULL, token + 1 ) ; if

Fix:
<S2SV_ModStart> } if ( strlen ( token ) > 4 &&
Buggy code:
 crm_client_t * crm_client_new ( qb_ipcs_connection_t * c, uid_t uid_client, gid_t gid_client ) { <START_BUG> static uid_t uid_server = 0 ; <END_BUG> static gid_t gid_cluster = 0 ; crm_client_t * client = NULL ; CRM_LOG_ASSERT ( c ) ; if ( c == NULL ) { return NULL ; } if ( gid_cluster == 0 ) {  uid_server = getuid ( ) ; <START_BUG> if ( crm_user_lookup ( CRM_DAEMON_USER, NULL, & gid_cluster ) < 0 ) { static bool have_error = FALSE ; if ( have_error == FALSE ) { crm_warn ( "Could   not   find   group   for   user   %s", CRM_DAEMON_USER ) ; have_error = TRUE ; } } } <END_BUG> if ( gid_cluster!= 0 && gid_client!= 0 ) {  uid_t best_uid = - 1 ; if ( uid_client == 0 || uid_server == 0 ) { best_uid = QB_MAX ( uid_client, uid_server ) ; crm_trace ( "Allowing   user   %u   to   clean   up   after   disconnect", best_uid ) ; } crm_trace ( "Giving   access   to   group   %u", gid_cluster ) ; qb_ipcs_connection_auth_set ( c, best_uid, gid_cluster, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP ) ; } crm_client_init ( ) ; client = calloc ( 1, sizeof ( crm_client_t ) ) ; client -> ipcs = c ; client -> kind = CRM_CLIENT_IPC ; client -> pid = crm_ipcs_client_pid ( c ) ; client -> id = crm_generate_uuid ( ) ; crm_debug ( "Connecting   %p   for   uid=%d   gid=%d   pid=%u   id=%s", c, uid_client, gid_client, client -> pid, client -> id ) ; # if ENABLE_ACL client -> user = uid2username ( uid_

Fix:
<S2SV_ModStart> ) { static <S2SV_ModEnd> gid_t gid_cluster = <S2SV_ModStart> 0 ) { <S2SV_ModEnd> if ( crm_user_lookup <S2SV_ModStart> } if ( uid_client!= 0 ) { crm_trace ( "Giving <S2SV_blank> access <S2SV_blank> to <S2SV_blank> group <S2SV_blank> %u", gid_cluster ) ; qb_ipcs_connection_auth_set ( c, - 1 <S2SV_ModEnd>, gid_cluster,
Buggy code:
 static INLINE void add_token_no_extra ( TOKENEXTRA * * t, <START_BUG> const vp9_prob * context_tree, <END_BUG> uint8_t token, uint8_t skip_eob_node, unsigned int * counts ) { ( * t ) -> token = token ; ( * t ) -> context_tree = context_tree ; ( * t ) -> skip_eob_node = skip_eob_node ; ( * t ) ++ ; ++ counts [ token ] ; }

Fix:
<S2SV_ModStart> t, const vpx_prob <S2SV_ModEnd> * context_tree,
Buggy code:
 static int dccp_print_option ( netdissect_options * ndo, const u_char * option, u_int hlen ) { uint8_t optlen, i ; ND_TCHECK ( * option ) ; if ( * option >= 32 ) { ND_TCHECK ( * ( option + 1 ) ) ; optlen = * ( option + 1 ) ; if ( optlen < 2 ) { if ( * option >= 128 ) ND_PRINT ( ( ndo, "CCID   option   %u   optlen   too   short", * option ) ) ; else ND_PRINT ( ( ndo, "%s   optlen   too   short", tok2str ( dccp_option_values, "Option   %u", * option ) ) ) ; return 0 ; } } else optlen = 1 ; if ( hlen < optlen ) { if ( * option >= 128 ) ND_PRINT ( ( ndo, "CCID   option   %u   optlen   goes   past   header   length", * option ) ) ; else ND_PRINT ( ( ndo, "%s   optlen   goes   past   header   length", tok2str ( dccp_option_values, "Option   %u", * option ) ) ) ; return 0 ; } ND_TCHECK2 ( * option, optlen ) ; if ( * option >= 128 ) { ND_PRINT ( ( ndo, "CCID   option   %d", * option ) ) ; switch ( optlen ) { case 4 : ND_PRINT ( ( ndo, "   %u", EXTRACT_16BITS ( option + 2 ) ) ) ; break ; case 6 : ND_PRINT ( ( ndo, "   %u", EXTRACT_32BITS ( option + 2 ) ) ) ; break ; default : break ; } } else { ND_PRINT ( ( ndo, "%s", tok2str ( dccp_option_values, "Option   %u", * option ) ) ) ; switch ( * option ) { case 32 : case 33 : case 34 : case 35 : if ( optlen < 3 ) { ND_PRINT ( ( ndo, "   optlen   too   short" ) )

Fix:
<S2SV_ModStart> ( optlen == 6 <S2SV_ModEnd> ) ND_PRINT ( <S2SV_ModStart> ( ndo, " <S2SV_blank> [optlen <S2SV_blank>!= <S2SV_blank> 6]" <S2SV_ModEnd> ) ) ; <S2SV_ModStart> case 42 : switch ( optlen ) { case 6 : ND_PRINT ( ( ndo, " <S2SV_blank> %u", EXTRACT_32BITS ( option + 2 ) ) ) ; break ; case 8 : ND_PRINT ( ( ndo, " <S2SV_blank> %u", EXTRACT_32BITS ( option + 2 ) ) ) ; ND_PRINT ( ( ndo, " <S2SV_blank> (elapsed <S2SV_blank> time <S2SV_blank> %u)", EXTRACT_16BITS ( option + 6 ) ) ) ; break ; case 10 : ND_PRINT ( ( ndo, " <S2SV_blank> %u", EXTRACT_32BITS ( option + 2 ) ) ) ; ND_PRINT ( ( ndo, " <S2SV_blank> (elapsed <S2SV_blank> time <S2SV_blank> %u)", EXTRACT_32BITS ( option + 6 ) ) ) ; break ; default : ND_PRINT ( ( ndo, " <S2SV_blank> [optlen <S2SV_blank>!= <S2SV_blank> 6 <S2SV_blank> or <S2SV_blank> 8 <S2SV_blank> or <S2SV_blank> 10]" ) ) ; break ; } break ; case 43 : if ( optlen ==
Buggy code:
 int sas_discover_sata ( struct domain_device * dev ) { int res ; if ( dev -> dev_type == SAS_SATA_PM ) return - ENODEV ; dev -> sata_dev. class = sas_get_ata_command_set ( dev ) ; sas_fill_in_rphy ( dev, dev -> rphy ) ; res = sas_notify_lldd_dev_found ( dev ) ; if ( res ) return res ; <START_BUG> sas_discover_event ( dev -> port, DISCE_PROBE ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> return res ; <S2SV_ModEnd> return 0 ;
Buggy code:
 PyMODINIT_FUNC PyInit__ast ( void ) { PyObject * m, * d ; if (! init_types ( ) ) return NULL ; m = PyModule_Create ( & _astmodule ) ; if (! m ) return NULL ; d = PyModule_GetDict ( m ) ; if ( PyDict_SetItemString ( d, "AST", ( PyObject * ) & AST_type ) < 0 ) return NULL ; if ( PyModule_AddIntMacro ( m, PyCF_ONLY_AST ) < 0 ) return NULL ; <START_BUG> if ( PyDict_SetItemString ( d, "mod", ( PyObject * ) mod_type ) < 0 ) return NULL ; <END_BUG> if ( PyDict_SetItemString ( d, "Module", ( PyObject * ) Module_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "Interactive", ( PyObject * ) Interactive_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "Expression", ( PyObject * ) Expression_type ) < 0 ) return NULL ;  if ( PyDict_SetItemString ( d, "Suite", ( PyObject * ) Suite_type ) < 0 ) return <START_BUG> NULL ; if ( PyDict_SetItemString ( d, "stmt", ( PyObject * ) stmt_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "FunctionDef", ( PyObject * ) FunctionDef_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "AsyncFunctionDef", ( PyObject * ) AsyncFunctionDef_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "ClassDef", ( PyObject * ) ClassDef_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "Return", ( PyObject * ) Return_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "Delete", ( PyObject * ) Delete_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "Assign", ( PyObject * ) Assign_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d,<END_BUG>

Fix:
<S2SV_ModStart> ; if ( PyModule_AddIntMacro ( m, PyCF_TYPE_COMMENTS ) < 0 ) return NULL ; if ( <S2SV_ModStart> ( d, "FunctionType", ( PyObject * ) FunctionType_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, <S2SV_ModStart> * ) withitem_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "type_ignore", ( PyObject * ) type_ignore_type ) < 0 ) return NULL ; if ( PyDict_SetItemString ( d, "TypeIgnore", ( PyObject * ) TypeIgnore_type
Buggy code:
 static void gsm_xsmp_client_disconnect ( GsmXSMPClient * client ) { if ( client -> priv -> watch_id > 0 ) { g_source_remove ( client -> priv -> watch_id ) ; } if ( client -> priv -> conn!= NULL ) { SmsCleanUp ( client -> priv -> conn ) ; } if ( client -> priv -> ice_connection!= NULL ) { IceSetShutdownNegotiation ( client -> priv -> ice_connection, FALSE ) ; IceCloseConnection ( client -> priv -> ice_connection ) ; } <START_BUG> if ( client -> priv -> protocol_timeout > 0 ) { <END_BUG> g_source_remove ( client -> priv -> protocol_timeout ) ; } }

Fix:
<S2SV_ModStart> ) ; } <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static int timer_start ( Unit * u ) { Timer * t = TIMER ( u ) ; TimerValue * v ; assert ( t ) ; assert ( t -> state == TIMER_DEAD || t -> state == TIMER_FAILED ) ; if ( UNIT_TRIGGER ( u ) -> load_state!= UNIT_LOADED ) return - ENOENT ; t -> last_trigger = DUAL_TIMESTAMP_NULL ; LIST_FOREACH ( value, v, t -> values ) if ( v -> base == TIMER_ACTIVE ) v -> disabled = false ; if ( t -> stamp_path ) { struct stat st ; if ( stat ( t -> stamp_path, & st ) >= 0 ) t -> last_trigger. realtime = timespec_load ( & st. st_atim ) ; else if ( errno == ENOENT ) <START_BUG> touch_file ( t -> stamp_path, true, USEC_INFINITY, UID_INVALID, GID_INVALID, 0 ) ; <END_BUG> } t -> result = TIMER_SUCCESS ; timer_enter_waiting ( t, true ) ; return 1 ; }

Fix:
<S2SV_ModStart>, GID_INVALID, MODE_INVALID <S2SV_ModEnd> ) ; }
Buggy code:
 static void add_bytes_c ( uint8_t * dst, uint8_t * src, int w ) { long i ; <START_BUG> for ( i = 0 ; i <= w - sizeof ( long ) ; i += sizeof ( long ) ) { <END_BUG> long a = * ( long * ) ( src + i ) ; long b = * ( long * ) ( dst + i ) ; * ( long * ) ( dst + i ) = ( ( a & pb_7f ) + ( b & pb_7f ) ) ^ ( ( a ^ b ) & pb_80 ) ; } for ( ; i < w ; i ++ ) dst [ i + 0 ] += src [ i + 0 ] ; }

Fix:
<S2SV_ModStart> <= w - ( int )
Buggy code:
 static long mem_seek ( jas_stream_obj_t * obj, long offset, int origin ) { jas_stream_memobj_t * m = ( jas_stream_memobj_t * ) obj ; <START_BUG> long newpos ; <END_BUG> JAS_DBGLOG ( 100, ( "mem_seek(%p,   %ld,   %d)\\n", obj, offset, origin ) ) ; switch ( origin ) { case SEEK_SET : newpos = offset ; break ; case SEEK_END : newpos = m -> len_ - offset ; break ; case SEEK_CUR : newpos = m -> pos_ + offset ; break ; default : abort ( ) ; break ; } if ( newpos < 0 ) { return - 1 ; } m -> pos_ = newpos ; return m -> pos_ ; }

Fix:
<S2SV_ModStart> ) obj ; size_t <S2SV_ModEnd> newpos ; JAS_DBGLOG
Buggy code:
 static int efx_register_netdev ( struct efx_nic * efx ) { struct net_device * net_dev = efx -> net_dev ; struct efx_channel * channel ; int rc ; net_dev -> watchdog_timeo = 5 * HZ ; net_dev -> irq = efx -> pci_dev -> irq ; net_dev -> netdev_ops = & efx_netdev_ops ; SET_ETHTOOL_OPS ( net_dev, & efx_ethtool_ops ) ; <START_BUG> efx -> mac_op -> update_stats ( efx ) ; <END_BUG> memset ( & efx -> mac_stats, 0, sizeof ( efx -> mac_stats ) ) ; rtnl_lock ( ) ; rc = dev_alloc_name ( net_dev, net_dev -> name ) ; if ( rc < 0 ) goto fail_locked ; efx_update_name ( efx ) ; rc = register_netdevice ( net_dev ) ; if ( rc ) goto fail_locked ; efx_for_each_channel ( channel, efx ) { struct efx_tx_queue * tx_queue ; efx_for_each_channel_tx_queue ( tx_queue, channel ) efx_init_tx_queue_core_txq ( tx_queue ) ; } netif_carrier_off ( efx -> net_dev ) ; rtnl_unlock ( ) ; rc = device_create_file ( & efx -> pci_dev -> dev, & dev_attr_phy_type ) ; if ( rc ) { netif_err ( efx, drv, efx -> net_dev, "failed   to   init   net   dev   attributes\\n" ) ; goto fail_registered ; } return 0 ; fail_locked : rtnl_unlock ( ) ; netif_err ( efx, drv, efx -> net_dev, "could   not   register   net   dev\\n" ) ; return rc ; fail_registered : unregister_netdev ( net_dev ) ; return rc ; }

Fix:
<S2SV_ModStart> efx_ethtool_ops ) ; net_dev -> gso_max_segs = EFX_TSO_MAX_SEGS ;
Buggy code:
 int mwifiex_ret_wmm_get_status ( struct mwifiex_private * priv, const struct host_cmd_ds_command * resp ) { u8 * curr = ( u8 * ) & resp -> params. get_wmm_status ; uint16_t resp_len = le16_to_cpu ( resp -> size ), tlv_len ; int mask = IEEE80211_WMM_IE_AP_QOSINFO_PARAM_SET_CNT_MASK ; bool valid = true ; struct mwifiex_ie_types_data * tlv_hdr ; struct mwifiex_ie_types_wmm_queue_status * tlv_wmm_qstatus ; struct ieee_types_wmm_parameter * wmm_param_ie = NULL ; struct mwifiex_wmm_ac_status * ac_status ; mwifiex_dbg ( priv -> adapter, INFO, "info:   WMM:   WMM_GET_STATUS   cmdresp   received:   %d\\n", resp_len ) ; while ( ( resp_len >= sizeof ( tlv_hdr -> header ) ) && valid ) { tlv_hdr = ( struct mwifiex_ie_types_data * ) curr ; tlv_len = le16_to_cpu ( tlv_hdr -> header. len ) ; if ( resp_len < tlv_len + sizeof ( tlv_hdr -> header ) ) break ; switch ( le16_to_cpu ( tlv_hdr -> header. type ) ) { case TLV_TYPE_WMMQSTATUS : tlv_wmm_qstatus = ( struct mwifiex_ie_types_wmm_queue_status * ) tlv_hdr ; mwifiex_dbg ( priv -> adapter, CMD, "info:   CMD_RESP:   WMM_GET_STATUS:\\t" "QSTATUS   TLV:   %d,   %d,   %d\\n", tlv_wmm_qstatus -> queue_index, tlv_wmm_qstatus -> flow_required, tlv_wmm_qstatus -> disabled ) ; ac_status = & priv -> wmm. ac_status [ tlv_wmm_qstatus -> queue

Fix:
<S2SV_ModStart> mask ) ; if ( wmm_param_ie -> vend_hdr. len + 2 > sizeof ( struct ieee_types_wmm_parameter ) ) break ;
Buggy code:
 static vpx_codec_err_t ctrl_update_entropy ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> const int update = va_arg ( args, int ) ; vp9_update_entropy ( ctx -> cpi, update ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )
Buggy code:
 static void set_fixed_partitioning ( VP9_COMP * cpi, const TileInfo * const tile, MODE_INFO * * mi_8x8, int mi_row, int mi_col, BLOCK_SIZE bsize ) { VP9_COMMON * const cm = & cpi -> common ; const int mis = cm -> mi_stride ; <START_BUG> int row8x8_remaining = tile -> mi_row_end - mi_row ; <END_BUG>  int col8x8_remaining = tile -> mi_col_end - mi_col ; <START_BUG> int block_row, block_col ; MODE_INFO * mi_upper_left = cm -> mi + mi_row * mis + mi_col ; int bh = num_8x8_blocks_high_lookup [ bsize ] ; int bw = num_8x8_blocks_wide_lookup [ bsize ] ; assert ( ( row8x8_remaining > 0 ) && ( col8x8_remaining > 0 ) ) ; if ( ( col8x8_remaining >= MI_BLOCK_SIZE ) && ( row8x8_remaining >= MI_BLOCK_SIZE ) ) { for ( block_row = 0 ; block_row < MI_BLOCK_SIZE ; block_row += bh ) { for ( block_col = 0 ; block_col < MI_BLOCK_SIZE ; block_col += bw ) { int index = block_row * mis + block_col ; mi_8x8 [ index ] = mi_upper_left + index ; mi_8x8 [ index ] -> mbmi. sb_type = bsize ; } } } else { <END_BUG> for ( block_row = 0 ; block_row < MI_BLOCK_SIZE ; block_row += bh ) {  for ( block_col = 0 ; block_col < MI_BLOCK_SIZE ; block_col += bw ) { int index = block_row * mis + block_col ; bsize = find_partition_size ( bsize, ( row8x8_remaining - block_row ), ( col8x8_remaining - block_col ), & bh, & bw ) ; mi_8x8 [ index ] = mi_upper_left + index ; mi_8x8 [ index ] -> mbmi. sb_type = bsize ; } } } }

Fix:
<S2SV_ModStart> -> mi_stride ; const <S2SV_ModStart> - mi_row ; const <S2SV_ModStart> } else { set_partial_b64x64_partition ( mi_upper_left, mis, bh, bw, row8x8_remaining, col8x8_remaining, bsize, mi_8x8 ) ; <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 <START_BUG> static inline void jmp_rel ( struct x86_emulate_ctxt * ctxt, int rel ) <END_BUG> {  assign_eip_near ( ctxt, ctxt -> _eip + rel ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> static inline int <S2SV_ModEnd> jmp_rel ( struct <S2SV_ModStart> rel ) { return
Buggy code:
 int jas_stream_write ( jas_stream_t * stream, const void * buf, int cnt ) { int n ; <START_BUG> const char * bufptr ; <END_BUG> bufptr = buf ; n = 0 ; while ( n < cnt ) { if ( jas_stream_putc ( stream, * bufptr ) == EOF ) { return n ; } ++ bufptr ; ++ n ; } return n ; }

Fix:
<S2SV_ModStart> * bufptr ; if ( cnt < 0 ) { jas_deprecated ( "negative <S2SV_blank> count <S2SV_blank> for <S2SV_blank> jas_stream_write" ) ; }
Buggy code:
 struct sock * dccp_v4_request_recv_sock ( struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst ) { struct inet_request_sock * ireq ; struct inet_sock * newinet ; struct sock * newsk ; if ( sk_acceptq_is_full ( sk ) ) goto exit_overflow ; if ( dst == NULL && ( dst = inet_csk_route_req ( sk, req ) ) == NULL ) goto exit ; newsk = dccp_create_openreq_child ( sk, req, skb ) ; if ( newsk == NULL ) goto exit_nonewsk ; sk_setup_caps ( newsk, dst ) ; newinet = inet_sk ( newsk ) ; ireq = inet_rsk ( req ) ; newinet -> inet_daddr = ireq -> rmt_addr ; newinet -> inet_rcv_saddr = ireq -> loc_addr ; newinet -> inet_saddr = ireq -> loc_addr ; <START_BUG> newinet -> opt = ireq -> opt ; <END_BUG> ireq -> opt = NULL ; newinet -> mc_index = inet_iif ( skb ) ; newinet -> mc_ttl = ip_hdr ( skb ) -> ttl ; newinet -> inet_id = jiffies ; dccp_sync_mss ( newsk, dst_mtu ( dst ) ) ; if ( __inet_inherit_port ( sk, newsk ) < 0 ) { sock_put ( newsk ) ; goto exit ; } __inet_hash_nolisten ( newsk, NULL ) ; return newsk ; exit_overflow : NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_LISTENOVERFLOWS ) ; exit_nonewsk : dst_release ( dst ) ; exit : NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_LISTENDROPS ) ; return NULL ; }

Fix:
<S2SV_ModStart> ; newinet -> inet_opt <S2SV_ModEnd> = ireq ->
Buggy code:
 static int xfrm_dump_policy ( struct sk_buff * skb, struct netlink_callback * cb ) { struct net * net = sock_net ( skb -> sk ) ; <START_BUG> struct xfrm_policy_walk * walk = ( struct xfrm_policy_walk * ) & cb -> args [ 1 ] ; <END_BUG>  struct xfrm_dump_info info ; <START_BUG> BUILD_BUG_ON ( sizeof ( struct xfrm_policy_walk ) > sizeof ( cb -> args ) - sizeof ( cb -> args [ 0 ] ) ) ; info. in_skb = cb -> skb ; info. out_skb = skb ; info. nlmsg_seq = cb -> nlh -> nlmsg_seq ; info. nlmsg_flags = NLM_F_MULTI ; <END_BUG> if (! cb -> args [ 0 ] ) {  cb -> args [ 0 ] = 1 ; xfrm_policy_walk_init ( walk, XFRM_POLICY_TYPE_ANY ) ; } ( void ) xfrm_policy_walk ( net, walk, dump_one_policy, & info ) ; return skb -> len ; }

Fix:
<S2SV_ModStart> xfrm_policy_walk * ) <S2SV_ModEnd> cb -> args <S2SV_ModStart> cb -> args <S2SV_ModEnd> ; struct xfrm_dump_info <S2SV_ModStart> struct xfrm_dump_info info <S2SV_ModEnd> ; info. <S2SV_ModStart> = NLM_F_MULTI ; <S2SV_ModEnd> ( void )
Buggy code:
 static int pci_emul_alloc_resource ( uint64_t * baseptr, uint64_t limit, uint64_t size, uint64_t * addr ) { uint64_t base ; <START_BUG> assert ( ( size & ( size - 1 ) ) == 0 ) ; <END_BUG> base = roundup2 ( * baseptr, size ) ; if ( base + size <= limit ) { * addr = base ; * baseptr = base + size ; return 0 ; } else return - 1 ; }

Fix:
<S2SV_ModStart> uint64_t base ; if <S2SV_ModEnd> ( ( size <S2SV_ModStart> 1 ) )!= 0 ) { pr_err ( "%s: <S2SV_blank> Cannot <S2SV_blank> alloc <S2SV_blank> invalid <S2SV_blank> size <S2SV_blank> %lld <S2SV_blank> resource\\n", __func__, size ) ; return - 1 ; } <S2SV_ModEnd> base = roundup2
Buggy code:
 static krb5_error_code kdc_process_s4u_x509_user ( krb5_context context, krb5_kdc_req * request, krb5_pa_data * pa_data, krb5_keyblock * tgs_subkey, krb5_keyblock * tgs_session, krb5_pa_s4u_x509_user * * s4u_x509_user, const char * * status ) { krb5_error_code code ; krb5_data req_data ; req_data. length = pa_data -> length ; req_data. data = ( char * ) pa_data -> contents ; code = decode_krb5_pa_s4u_x509_user ( & req_data, s4u_x509_user ) ; if ( code ) <START_BUG> return code ; <END_BUG> code = verify_s4u_x509_user_checksum ( context, tgs_subkey? tgs_subkey : tgs_session, & req_data, request -> nonce, * s4u_x509_user ) ; if ( code ) { * status = "INVALID_S4U2SELF_CHECKSUM" ; krb5_free_pa_s4u_x509_user ( context, * s4u_x509_user ) ; * s4u_x509_user = NULL ; return code ; } if ( krb5_princ_size ( context, ( * s4u_x509_user ) -> user_id. user ) == 0 || ( * s4u_x509_user ) -> user_id. subject_cert. length!= 0 ) { * status = "INVALID_S4U2SELF_REQUEST" ; krb5_free_pa_s4u_x509_user ( context, * s4u_x509_user ) ; * s4u_x509_user = NULL ; return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN ; } return 0 ; }

Fix:
<S2SV_ModStart> ( code ) { * status = "DECODE_PA_S4U_X509_USER" ; return code ; } <S2SV_ModEnd> code = verify_s4u_x509_user_checksum
Buggy code:
 static void vmx_set_constant_host_state ( struct vcpu_vmx * vmx ) { u32 low32, high32 ; unsigned long tmpl ; struct desc_ptr dt ; <START_BUG> vmcs_writel ( HOST_CR0, read_cr0 ( ) & ~ X86_CR0_TS ) ; <END_BUG>  vmcs_writel ( HOST_CR4, read_cr4 ( ) ) ; <START_BUG> vmcs_writel ( HOST_CR3, read_cr3 ( ) ) ; vmcs_write16 ( HOST_CS_SELECTOR, __KERNEL_CS ) ; # ifdef CONFIG_X86_64 vmcs_write16 ( HOST_DS_SELECTOR, 0 ) ; vmcs_write16 ( HOST_ES_SELECTOR, 0 ) ; # else vmcs_write16 ( HOST_DS_SELECTOR, __KERNEL_DS ) ; vmcs_write16 ( HOST_ES_SELECTOR, __KERNEL_DS ) ; # endif vmcs_write16 ( HOST_SS_SELECTOR, __KERNEL_DS ) ; vmcs_write16 ( HOST_TR_SELECTOR, GDT_ENTRY_TSS * 8 ) ; native_store_idt ( & dt ) ; vmcs_writel ( HOST_IDTR_BASE, dt. address ) ; vmx -> host_idt_base = dt. address ; vmcs_writel ( HOST_RIP, vmx_return ) ; rdmsr ( MSR_IA32_SYSENTER_CS, low32, high32 ) ; vmcs_write32 ( HOST_IA32_SYSENTER_CS, low32 ) ; rdmsrl ( MSR_IA32_SYSENTER_EIP, tmpl ) ; vmcs_writel ( HOST_IA32_SYSENTER_EIP, tmpl ) ; if ( vmcs_config. vmexit_ctrl & VM_EXIT_LOAD_IA32_PAT ) { rdmsr ( MSR_IA32_CR_PAT, low32, high32 ) ; vmcs_write64 ( HOST_IA32_PAT, low32 | ( ( u64 ) high32 << 32 ) ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> desc_ptr dt ; unsigned long cr4 ; <S2SV_ModStart> ; vmcs_writel ( HOST_CR3, read_cr3 ( ) ) ; cr4 = read_cr4 ( ) ; vmcs_writel ( HOST_CR4, cr4 ) ; vmx -> host_state. vmcs_host_cr4 = cr4 <S2SV_ModEnd> ; vmcs_write16 (
Buggy code:
 PHYSICALPATH_FUNC ( mod_alias_physical_handler ) { plugin_data * p = p_d ; int uri_len, basedir_len ; char * uri_ptr ; size_t k ; if ( buffer_is_empty ( con -> physical. path ) ) return HANDLER_GO_ON ; mod_alias_patch_connection ( srv, con, p ) ; basedir_len = buffer_string_length ( con -> physical. basedir ) ; if ( '//' == con -> physical. basedir -> ptr [ basedir_len - 1 ] ) -- basedir_len ; uri_len = buffer_string_length ( con -> physical. path ) - basedir_len ; uri_ptr = con -> physical. path -> ptr + basedir_len ; for ( k = 0 ; k < p -> conf. alias -> used ; k ++ ) { data_string * ds = ( data_string * ) p -> conf. alias -> data [ k ] ; int alias_len = buffer_string_length ( ds -> key ) ; if ( alias_len > uri_len ) continue ; if ( buffer_is_empty ( ds -> key ) ) continue ; if ( 0 == ( con -> conf. force_lowercase_filenames? strncasecmp ( uri_ptr, ds -> key -> ptr, alias_len ) : strncmp ( uri_ptr, ds -> key -> ptr, alias_len ) ) ) { <START_BUG> buffer_copy_buffer ( con -> physical. basedir, ds -> value ) ; <END_BUG> buffer_copy_buffer ( srv -> tmp_buf, ds -> value ) ; buffer_append_string ( srv -> tmp_buf, uri_ptr + alias_len ) ; buffer_copy_buffer ( con -> physical. path, srv -> tmp_buf ) ; return HANDLER_GO_ON ; } } return HANDLER_GO_ON ; }

Fix:
<S2SV_ModStart> ) ) { if ( uri_ptr [ alias_len ] == '.' ) { char * s = uri_ptr + alias_len + 1 ; if ( * s == '.' ) ++ s ; if ( * s == '//' || * s == '\\0' ) { size_t vlen = buffer_string_length ( ds -> value ) ; if ( 0!= alias_len && ds -> key -> ptr [ alias_len - 1 ]!= '//' && 0!= vlen && ds -> value -> ptr [ vlen - 1 ] == '//' ) { con -> http_status = 403 ; return HANDLER_FINISHED ; } } }
Buggy code:
 static void mem_cgroup_usage_unregister_event ( struct cgroup * cgrp, struct cftype * cft, struct eventfd_ctx * eventfd ) { struct mem_cgroup * memcg = mem_cgroup_from_cont ( cgrp ) ; struct mem_cgroup_thresholds * thresholds ; struct mem_cgroup_threshold_ary * new ; int type = MEMFILE_TYPE ( cft -> private ) ; u64 usage ; int i, j, size ; mutex_lock ( & memcg -> thresholds_lock ) ; if ( type == _MEM ) thresholds = & memcg -> thresholds ; else if ( type == _MEMSWAP ) thresholds = & memcg -> memsw_thresholds ; else BUG ( ) ; <START_BUG> BUG_ON (! thresholds ) ; <END_BUG> usage = mem_cgroup_usage ( memcg, type == _MEMSWAP ) ; __mem_cgroup_threshold ( memcg, type == _MEMSWAP ) ; size = 0 ; for ( i = 0 ; i < thresholds -> primary -> size ; i ++ ) { if ( thresholds -> primary -> entries [ i ]. eventfd!= eventfd ) size ++ ; } new = thresholds -> spare ; if (! size ) { kfree ( new ) ; new = NULL ; goto swap_buffers ; } new -> size = size ; new -> current_threshold = - 1 ; for ( i = 0, j = 0 ; i < thresholds -> primary -> size ; i ++ ) { if ( thresholds -> primary -> entries [ i ]. eventfd == eventfd ) continue ; new -> entries [ j ] = thresholds -> primary -> entries [ i ] ; if ( new -> entries [ j ]. threshold < usage ) { ++ new -> current_threshold ; } j ++ ; } swap_buffers : thresholds -> spare = thresholds -> primary ; rcu_assign_pointer ( thresholds -> primary, new ) ; synchronize_rcu ( ) ;  mutex_unlock ( & memcg -> thresholds_lock ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart>! thresholds ) ; if (! thresholds -> primary ) goto unlock <S2SV_ModStart> ( ) ; unlock :
Buggy code:
 l_int32 gplotAddPlot ( GPLOT * gplot, NUMA * nax, NUMA * nay, l_int32 plotstyle, const char * plottitle ) { <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> char emptystring [ ] = "" ; char * datastr, * title ; l_int32 n, i ; l_float32 valx, valy, startx, delx ; SARRAY * sa ; PROCNAME ( "gplotAddPlot" ) ; if (! gplot ) return ERROR_INT ( "gplot   not   defined", procName, 1 ) ; if (! nay ) return ERROR_INT ( "nay   not   defined", procName, 1 ) ; if ( plotstyle < 0 || plotstyle >= NUM_GPLOT_STYLES ) return ERROR_INT ( "invalid   plotstyle", procName, 1 ) ; if ( ( n = numaGetCount ( nay ) ) == 0 ) return ERROR_INT ( "no   points   to   plot", procName, 1 ) ; if ( nax && ( n!= numaGetCount ( nax ) ) ) return ERROR_INT ( "nax   and   nay   sizes   differ", procName, 1 ) ; if ( n == 1 && plotstyle == GPLOT_LINES ) { L_INFO ( "only   1   pt;   changing   style   to   points\\n", procName ) ; plotstyle = GPLOT_POINTS ; } numaGetParameters ( nay, & startx, & delx ) ; numaAddNumber ( gplot -> plotstyles, plotstyle ) ; if ( plottitle ) { title = stringNew ( plottitle ) ; sarrayAddString ( gplot -> plottitles, title, L_INSERT ) ; } else { sarrayAddString ( gplot -> plottitles, emptystring, L_COPY ) ; } gplot -> nplots ++ ;  snprintf ( buf, L_BUF_SIZE, "%s.data.%d", gplot -> rootname, gplot -> nplots ) ; <START_BUG> sarrayAddString ( gplot -> datanames, buf, L_COPY ) ; sa = sarrayCreate ( n ) ; for ( i = 0 ; i<END_BUG>

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; char <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.data.%d", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%f <S2SV_blank> %f\\n",
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_slice ( dec_state_t * ps_dec ) { stream_t * ps_stream ; UWORD32 u4_slice_vertical_position ; UWORD32 u4_slice_vertical_position_extension ; IMPEG2D_ERROR_CODES_T e_error ; ps_stream = & ps_dec -> s_bit_stream ; impeg2d_bit_stream_flush ( ps_stream, START_CODE_PREFIX_LEN ) ; u4_slice_vertical_position = impeg2d_bit_stream_get ( ps_stream, 8 ) ; if ( u4_slice_vertical_position > 2800 ) { u4_slice_vertical_position_extension = impeg2d_bit_stream_get ( ps_stream, 3 ) ; u4_slice_vertical_position += ( u4_slice_vertical_position_extension << 7 ) ; } if ( ( u4_slice_vertical_position > ps_dec -> u2_num_vert_mb ) || ( u4_slice_vertical_position == 0 ) ) { return IMPEG2D_INVALID_VERT_SIZE ; } u4_slice_vertical_position -- ; if ( ps_dec -> u2_mb_y!= u4_slice_vertical_position ) { ps_dec -> u2_mb_y = u4_slice_vertical_position ; ps_dec -> u2_mb_x = 0 ; } ps_dec -> u2_first_mb = 1 ; { UWORD16 u2_quant_scale_code ; u2_quant_scale_code = impeg2d_bit_stream_get ( ps_stream, 5 ) ; ps_dec -> u1_quant_scale = ( ps_dec -> u2_q_scale_type )? gau1_impeg2_non_linear_quant_scale [ u2_quant_scale_code ] : ( u2_quant_scale_code << 1 ) ; } if ( impeg2d_bit_stream_nxt ( ps_stream, 1 ) == 1 ) { impeg2d_bit_stream_flush ( ps_stream, 9 ) ; <START_BUG> while ( impeg2d_bit_stream_<END_BUG>

Fix:
<S2SV_ModStart> ) == 1 && ps_stream -> u4_offset < ps_stream -> u4_max_offset