nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int vc4_get_bcl ( struct drm_device * dev, struct vc4_exec_info * exec ) { struct drm_vc4_submit_cl * args = exec -> args ; void * temp = NULL ; void * bin ; int ret = 0 ; uint32_t bin_offset = 0 ; uint32_t shader_rec_offset = roundup ( bin_offset + args -> bin_cl_size, 16 ) ; uint32_t uniforms_offset = shader_rec_offset + args -> shader_rec_size ; uint32_t exec_size = uniforms_offset + args -> uniforms_size ; uint32_t temp_size = exec_size + ( sizeof ( struct vc4_shader_state ) * args -> shader_rec_count ) ; struct vc4_bo * bo ; <START_BUG> if ( uniforms_offset < shader_rec_offset || <END_BUG> exec_size < uniforms_offset || args -> shader_rec_count >= ( UINT_MAX // sizeof ( struct vc4_shader_state ) ) || temp_size < exec_size ) { DRM_ERROR ( "overflow   in   exec   arguments\\n" ) ; goto fail ; } temp = drm_malloc_ab ( temp_size, 1 ) ; if (! temp ) { DRM_ERROR ( "Failed   to   allocate   storage   for   copying   " "in   bin//render   CLs.\\n" ) ; ret = - ENOMEM ; goto fail ; } bin = temp + bin_offset ; exec -> shader_rec_u = temp + shader_rec_offset ; exec -> uniforms_u = temp + uniforms_offset ; exec -> shader_state = temp + exec_size ; exec -> shader_state_size = args -> shader_rec_count ; if ( copy_from_user ( bin, ( void __user * ) ( uintptr_t ) args -> bin_cl, args -> bin_cl_size ) ) { ret = - EFAULT ; goto fail ; } if ( copy_from_user ( exec -> shader_rec_u, ( void __user * ) ( uintptr_t ) args -> shader_rec, args -> shader_rec_size ) ) { ret = - EFAULT ; goto fail ; } if ( copy_from_user ( exec -> uniforms_u,

Fix:
<S2SV_ModStart> ; if ( shader_rec_offset < args -> bin_cl_size ||
Buggy code:
 static vpx_codec_err_t ctrl_update_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> const int ref_frame_flags = va_arg ( args, int ) ; vp9_update_reference ( ctx -> cpi, ref_frame_flags ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )
Buggy code:
 static PHP_MINIT_FUNCTION ( zip ) { # ifdef PHP_ZIP_USE_OO zend_class_entry ce ; memcpy ( & zip_object_handlers, zend_get_std_object_handlers ( ), sizeof ( zend_object_handlers ) ) ; zip_object_handlers. clone_obj = NULL ; zip_object_handlers. get_property_ptr_ptr = php_zip_get_property_ptr_ptr ; <START_BUG> zip_object_handlers. get_properties = php_zip_get_properties ; <END_BUG> zip_object_handlers. read_property = php_zip_read_property ; zip_object_handlers. has_property = php_zip_has_property ; INIT_CLASS_ENTRY ( ce, "ZipArchive", zip_class_functions ) ; ce. create_object = php_zip_object_new ; zip_class_entry = zend_register_internal_class ( & ce TSRMLS_CC ) ; zend_hash_init ( & zip_prop_handlers, 0, NULL, NULL, 1 ) ; php_zip_register_prop_handler ( & zip_prop_handlers, "status", php_zip_status, NULL, NULL, IS_LONG TSRMLS_CC ) ; php_zip_register_prop_handler ( & zip_prop_handlers, "statusSys", php_zip_status_sys, NULL, NULL, IS_LONG TSRMLS_CC ) ; php_zip_register_prop_handler ( & zip_prop_handlers, "numFiles", php_zip_get_num_files, NULL, NULL, IS_LONG TSRMLS_CC ) ; php_zip_register_prop_handler ( & zip_prop_handlers, "filename", NULL, NULL, php_zipobj_get_filename, IS_STRING TSRMLS_CC ) ; php_zip_register_prop_handler ( & zip_prop_handlers, "comment", NULL, php_zipobj_get_zip_comment, NULL, IS_STRING TSRMLS_CC ) ; REGISTER_ZIP_CLASS_CONST_LONG ( "CREATE", ZIP_CREATE ) ; REGISTER_ZIP_CLASS_CONST_LONG ( "EXCL", ZIP_EXCL ) ; REGISTER

Fix:
<S2SV_ModStart> ; zip_object_handlers. get_gc = php_zip_get_gc ; zip_object_handlers.
Buggy code:
 static int netbk_count_requests ( struct xenvif * vif, struct xen_netif_tx_request * first, struct xen_netif_tx_request * txp, int work_to_do ) { RING_IDX cons = vif -> tx. req_cons ; int frags = 0 ; if (! ( first -> flags & XEN_NETTXF_more_data ) ) return 0 ; do { if ( frags >= work_to_do ) { <START_BUG> netdev_dbg ( vif -> dev, "Need   more   frags\\n" ) ; <END_BUG> return - frags ; } if ( unlikely ( frags >= MAX_SKB_FRAGS ) ) {  netdev_dbg ( vif -> dev, "Too   many   frags\\n" ) ; <START_BUG> return - frags ; } memcpy ( txp, RING_GET_REQUEST ( & vif -> tx, cons + frags ), sizeof ( * txp ) ) ; if ( txp -> size > first -> size ) { <END_BUG> netdev_dbg ( vif -> dev, "Frags   galore\\n" ) ;  return - frags ; } first -> size -= txp -> size ; frags ++ ; if ( unlikely ( ( txp -> offset + txp -> size ) > PAGE_SIZE ) ) { <START_BUG> netdev_dbg ( vif -> dev, "txp->offset:   %x,   size:   %u\\n", <END_BUG>  txp -> offset, txp -> size ) ; <START_BUG> return - frags ; } } while ( ( txp ++ ) -> flags & XEN_NETTXF_more_data ) ; return frags ; }<END_BUG>

Fix:
<S2SV_ModStart> work_to_do ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> dev, "Need <S2SV_blank> more <S2SV_blank> frags\\n" ) ; netbk_fatal_tx_err ( vif <S2SV_ModStart> ) ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> dev, "Too <S2SV_blank> many <S2SV_blank> frags\\n" ) ; netbk_fatal_tx_err ( vif <S2SV_ModStart> size ) { netdev_err ( vif -> dev, "Frag <S2SV_blank> is <S2SV_blank> bigger <S2SV_blank> than <S2SV_blank> frame.\\n" ) ; netbk_fatal_tx_err ( vif <S2SV_ModEnd> ) ; return <S2SV_ModStart> ) ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> txp -> size ) ; netbk_fatal_tx_err ( vif
Buggy code:
 STATIC int xfs_attr_shortform_addname ( xfs_da_args_t * args ) { int newsize, forkoff, retval ; trace_xfs_attr_sf_addname ( args ) ; retval = xfs_attr_shortform_lookup ( args ) ; if ( ( args -> flags & ATTR_REPLACE ) && ( retval == - ENOATTR ) ) { return retval ; } else if ( retval == - EEXIST ) { if ( args -> flags & ATTR_CREATE ) return retval ; retval = xfs_attr_shortform_remove ( args ) ; <START_BUG> ASSERT ( retval == 0 ) ; <END_BUG> } if ( args -> namelen >= XFS_ATTR_SF_ENTSIZE_MAX || args -> valuelen >= XFS_ATTR_SF_ENTSIZE_MAX ) return - ENOSPC ; newsize = XFS_ATTR_SF_TOTSIZE ( args -> dp ) ; newsize += XFS_ATTR_SF_ENTSIZE_BYNAME ( args -> namelen, args -> valuelen ) ; forkoff = xfs_attr_shortform_bytesfit ( args -> dp, newsize ) ; if (! forkoff ) return - ENOSPC ; xfs_attr_shortform_add ( args, forkoff ) ; return 0 ; }

Fix:
<S2SV_ModStart> args ) ; if ( retval ) return retval ; args -> flags &= ~ ATTR_REPLACE <S2SV_ModEnd> ; } if
Buggy code:
 int nfssvc_decode_writeargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd_writeargs * args ) { unsigned int len, hdr, dlen ; struct kvec * head = rqstp -> rq_arg. head ; int v ; p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; p ++ ; args -> offset = ntohl ( * p ++ ) ; p ++ ; len = args -> len = ntohl ( * p ++ ) ; if ( len > NFSSVC_MAXBLKSIZE_V2 ) return 0 ; <START_BUG> hdr = ( void * ) p - head -> iov_base ; <END_BUG> dlen = head -> iov_len + rqstp -> rq_arg. page_len - hdr ; if ( dlen < XDR_QUADLEN ( len ) * 4 ) return 0 ; rqstp -> rq_vec [ 0 ]. iov_base = ( void * ) p ; rqstp -> rq_vec [ 0 ]. iov_len = head -> iov_len - hdr ; v = 0 ; while ( len > rqstp -> rq_vec [ v ]. iov_len ) { len -= rqstp -> rq_vec [ v ]. iov_len ; v ++ ; rqstp -> rq_vec [ v ]. iov_base = page_address ( rqstp -> rq_pages [ v ] ) ; rqstp -> rq_vec [ v ]. iov_len = PAGE_SIZE ; } rqstp -> rq_vec [ v ]. iov_len = len ; args -> vlen = v + 1 ; return 1 ; }

Fix:
<S2SV_ModStart> head -> iov_base ; if ( hdr > head -> iov_len ) return 0
Buggy code:
 <START_BUG> static int may_create_in_sticky ( struct dentry * const dir, <END_BUG> struct inode * const inode ) { if ( (! sysctl_protected_fifos && S_ISFIFO ( inode -> i_mode ) ) || (! sysctl_protected_regular && S_ISREG ( inode -> i_mode ) ) ||  likely (! ( dir -> d_inode -> i_mode & S_ISVTX ) ) || <START_BUG> <END_BUG> uid_eq ( inode -> i_uid, dir -> d_inode -> i_uid ) ||  uid_eq ( current_fsuid ( ), inode -> i_uid ) ) return 0 ; <START_BUG> if ( likely ( dir -> d_inode -> i_mode & 0002 ) || <END_BUG>  ( dir -> d_inode -> i_mode & 0020 && <START_BUG> ( ( sysctl_protected_fifos >= 2 && S_ISFIFO ( inode -> i_mode ) ) || ( sysctl_protected_regular >= 2 && S_ISREG ( inode -> i_mode ) ) ) ) ) { const char * operation = S_ISFIFO ( inode -> i_mode )? "sticky_create_fifo" : "sticky_create_regular" ; audit_log_path_denied ( AUDIT_ANOM_CREAT, operation ) ; return - EACCES ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> int may_create_in_sticky ( umode_t dir_mode, kuid_t dir_uid <S2SV_ModEnd>, struct inode <S2SV_ModStart> (! ( dir_mode <S2SV_ModEnd> & S_ISVTX ) <S2SV_ModStart> -> i_uid, dir_uid <S2SV_ModEnd> ) || uid_eq <S2SV_ModStart> ( likely ( dir_mode <S2SV_ModEnd> & 0002 ) <S2SV_ModStart> ) || ( dir_mode <S2SV_ModEnd> & 0020 &&
Buggy code:
 int rose_rx_call_request ( struct sk_buff * skb, struct net_device * dev, struct rose_neigh * neigh, unsigned int lci ) { struct sock * sk ; struct sock * make ; struct rose_sock * make_rose ; struct rose_facilities_struct facilities ; <START_BUG> int n, len ; <END_BUG> skb -> sk = NULL ;  memset ( & facilities, 0x00, sizeof ( struct rose_facilities_struct ) ) ; <START_BUG> len = ( ( ( skb -> data [ 3 ] >> 4 ) & 0x0F ) + 1 ) >> 1 ; len += ( ( ( skb -> data [ 3 ] >> 0 ) & 0x0F ) + 1 ) >> 1 ; <END_BUG> if (! rose_parse_facilities ( skb -> data + len + 4, & facilities ) ) {  rose_transmit_clear_request ( neigh, lci, ROSE_INVALID_FACILITY, 76 ) ; return 0 ; } sk = rose_find_listener ( & facilities. source_addr, & facilities. source_call ) ; if ( sk == NULL || sk_acceptq_is_full ( sk ) || ( make = rose_make_new ( sk ) ) == NULL ) { rose_transmit_clear_request ( neigh, lci, ROSE_NETWORK_CONGESTION, 120 ) ; return 0 ; } skb -> sk = make ; make -> sk_state = TCP_ESTABLISHED ; make_rose = rose_sk ( make ) ; make_rose -> lci = lci ; make_rose -> dest_addr = facilities. dest_addr ; make_rose -> dest_call = facilities. dest_call ; make_rose -> dest_ndigis = facilities. dest_ndigis ; for ( n = 0 ; n < facilities. dest_ndigis ; n ++ ) make_rose -> dest_digis [ n ] = facilities. dest_digis [ n ] ; make_rose -> source_addr = facilities. source_addr ; make_rose -> source_call = facilities. source_call ; make_rose -> source_ndigis = facilities.

Fix:
<S2SV_ModStart> ; int n <S2SV_ModEnd> ; skb -> <S2SV_ModStart> rose_facilities_struct ) ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> -> data + ROSE_CALL_REQ_FACILITIES_OFF, skb -> len - ROSE_CALL_REQ_FACILITIES_OFF, <S2SV_ModEnd> & facilities )
Buggy code:
 static ssize_t snd_timer_user_read ( struct file * file, char __user * buffer, size_t count, loff_t * offset ) { struct snd_timer_user * tu ; long result = 0, unit ; int qhead ; int err = 0 ; tu = file -> private_data ; unit = tu -> tread? sizeof ( struct snd_timer_tread ) : sizeof ( struct snd_timer_read ) ; <START_BUG> spin_lock_irq ( & tu -> qlock ) ; <END_BUG> while ( ( long ) count - result >= unit ) { while (! tu -> qused ) { wait_queue_t wait ; if ( ( file -> f_flags & O_NONBLOCK )!= 0 || result > 0 ) { err = - EAGAIN ; goto _error ; } set_current_state ( TASK_INTERRUPTIBLE ) ; init_waitqueue_entry ( & wait, current ) ; add_wait_queue ( & tu -> qchange_sleep, & wait ) ; spin_unlock_irq ( & tu -> qlock ) ;  schedule ( ) ; <START_BUG> spin_lock_irq ( & tu -> qlock ) ; remove_wait_queue ( & tu -> qchange_sleep, & wait ) ; if ( tu -> disconnected ) { err = - ENODEV ; goto _error ; } if ( signal_pending ( current ) ) { err = - ERESTARTSYS ; goto _error ; } } qhead = tu -> qhead ++ ; tu -> qhead %= tu -> queue_size ; tu -> qused -- ; spin_unlock_irq ( & tu -> qlock ) ; <END_BUG> mutex_lock ( & tu -> ioctl_lock ) ;  if ( tu -> tread ) { if ( copy_to_user ( buffer, & tu -> tqueue [ qhead ], sizeof ( struct snd_timer_tread ) ) ) err = - EFAULT ; } else { if ( copy_to_user ( buffer, & tu -> queue [ qhead ], sizeof ( struct snd_timer_read ) ) ) err = - EFAULT ; } <START_BUG> mutex_unlock ( & tu -> ioctl_lock ) ; <END_BUG> spin_lock_irq ( & tu -> qlock ) ; if ( err < 0 ) goto _error ; result += unit ; buffer += unit ; }

Fix:
<S2SV_ModStart> snd_timer_read ) ; mutex_lock ( & tu -> ioctl_lock ) ; <S2SV_ModStart> qlock ) ; mutex_unlock ( & tu -> ioctl_lock ) ; schedule ( ) ; mutex_lock ( & tu -> ioctl_lock <S2SV_ModEnd> ) ; spin_lock_irq <S2SV_ModStart> qlock ) ; <S2SV_ModEnd> if ( tu <S2SV_ModStart> EFAULT ; } <S2SV_ModEnd> spin_lock_irq ( & <S2SV_ModStart> qlock ) ; mutex_unlock ( & tu -> ioctl_lock ) ;
Buggy code:
 int ip_build_and_send_pkt ( struct sk_buff * skb, struct sock * sk, <START_BUG> __be32 saddr, __be32 daddr, struct ip_options * opt ) <END_BUG> { struct inet_sock * inet = inet_sk ( sk ) ; struct rtable * rt = skb_rtable ( skb ) ; struct iphdr * iph ;  skb_push ( skb, sizeof ( struct iphdr ) + ( opt? opt -> optlen : 0 ) ) ; <START_BUG> skb_reset_network_header ( skb ) ; iph = ip_hdr ( skb ) ; iph -> version = 4 ; iph -> ihl = 5 ; iph -> tos = inet -> tos ; if ( ip_dont_fragment ( sk, & rt -> dst ) ) iph -> frag_off = htons ( IP_DF ) ; else iph -> frag_off = 0 ; iph -> ttl = ip_select_ttl ( inet, & rt -> dst ) ; iph -> daddr = rt -> rt_dst ; iph -> saddr = rt -> rt_src ; iph -> protocol = sk -> sk_protocol ; ip_select_ident ( iph, & rt -> dst, sk ) ; <END_BUG> if ( opt && opt -> optlen ) {  <START_BUG> iph -> ihl += opt -> optlen >> 2 ; <END_BUG>  ip_options_build ( skb, opt, daddr, rt, 0 ) ; <START_BUG> } skb -> priority = sk -> sk_priority ; skb -> mark = sk -> sk_mark ; return ip_local_out ( skb ) ; }<END_BUG>

Fix:
<S2SV_ModStart> daddr, struct ip_options_rcu <S2SV_ModEnd> * opt ) <S2SV_ModStart>? opt -> opt. <S2SV_ModStart> && opt -> opt. <S2SV_ModStart> += opt -> opt. <S2SV_ModStart> ( skb, & opt ->
Buggy code:
 static int rawv6_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sockaddr_in6 * sin6 = ( struct sockaddr_in6 * ) msg -> msg_name ; struct sk_buff * skb ; size_t copied ; int err ; if ( flags & MSG_OOB ) <START_BUG> return - EOPNOTSUPP ; <END_BUG> if ( addr_len ) * addr_len = sizeof ( * sin6 ) ; if ( flags & MSG_ERRQUEUE ) return ipv6_recv_error ( sk, msg, len ) ; if ( np -> rxpmtu && np -> rxopt. bits. rxpmtu ) return ipv6_recv_rxpmtu ( sk, msg, len ) ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) goto out ; copied = skb -> len ; if ( copied > len ) { copied = len ; msg -> msg_flags |= MSG_TRUNC ; } if ( skb_csum_unnecessary ( skb ) ) { err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; } else if ( msg -> msg_flags & MSG_TRUNC ) { if ( __skb_checksum_complete ( skb ) ) goto csum_copy_err ; err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; } else { err = skb_copy_and_csum_datagram_iovec ( skb, 0, msg -> msg_iov ) ; if ( err == - EINVAL ) goto csum_copy_err ; } if ( err ) goto out_free ; if ( sin6 ) { sin6 -> sin6_family = AF_INET6 ; sin6 -> sin6_port = 0 ; sin6 -> sin6_addr = ipv6_hdr ( skb ) -> saddr ; sin6 -> sin6_flowinfo = 0 ; sin6 ->

Fix:
<S2SV_ModStart> return - EOPNOTSUPP <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) -> iif ) ; * addr_len = sizeof ( * sin6
Buggy code:
 static int PredictorDecodeTile ( TIFF * tif, uint8 * op0, tmsize_t occ0, uint16 s ) { TIFFPredictorState * sp = PredictorState ( tif ) ; assert ( sp!= NULL ) ; assert ( sp -> decodetile!= NULL ) ; if ( ( * sp -> decodetile ) ( tif, op0, occ0, s ) ) { tmsize_t rowsize = sp -> rowsize ; assert ( rowsize > 0 ) ; <START_BUG> assert ( ( occ0 % rowsize ) == 0 ) ; <END_BUG> assert ( sp -> decodepfunc!= NULL ) ; while ( occ0 > 0 ) {  ( * sp -> decodepfunc ) ( tif, op0, rowsize ) ; <START_BUG> occ0 -= rowsize ; op0 += rowsize ; } return 1 ; } else return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) ; if <S2SV_ModEnd> ( ( occ0 <S2SV_ModStart> % rowsize )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "PredictorDecodeTile", "%s", "occ0%rowsize <S2SV_blank>!= <S2SV_blank> 0" ) ; return 0 ; } <S2SV_ModEnd> assert ( sp <S2SV_ModStart> 0 ) { if (! <S2SV_ModStart>, rowsize ) ) return 0
Buggy code:
 static void init_config ( VP8_COMP * cpi, VP8_CONFIG * oxcf ) { VP8_COMMON * cm = & cpi -> common ; cpi -> oxcf = * oxcf ; cpi -> auto_gold = 1 ; cpi -> auto_adjust_gold_quantizer = 1 ; cm -> version = oxcf -> Version ; vp8_setup_version ( cm ) ; <START_BUG> cpi -> framerate = ( double ) ( oxcf -> timebase. den ) // <END_BUG>  ( double ) ( oxcf -> timebase. num ) ; <START_BUG> if ( cpi -> framerate > 180 ) cpi -> framerate = 30 ; cpi -> ref_framerate = cpi -> framerate ; <END_BUG> vp8_change_config ( cpi, oxcf ) ;  cpi -> active_worst_quality = cpi -> oxcf. worst_allowed_q ; cpi -> active_best_quality = cpi -> oxcf. best_allowed_q ; cpi -> avg_frame_qindex = cpi -> oxcf. worst_allowed_q ; cpi -> buffer_level = cpi -> oxcf. starting_buffer_level ; cpi -> bits_off_target = cpi -> oxcf. starting_buffer_level ; cpi -> rolling_target_bits = cpi -> av_per_frame_bandwidth ; cpi -> rolling_actual_bits = cpi -> av_per_frame_bandwidth ; cpi -> long_rolling_target_bits = cpi -> av_per_frame_bandwidth ; cpi -> long_rolling_actual_bits = cpi -> av_per_frame_bandwidth ; cpi -> total_actual_bits = 0 ; cpi -> total_target_vs_actual = 0 ; if ( cpi -> oxcf. number_of_layers > 1 ) { unsigned int i ; double prev_layer_framerate = 0 ; for ( i = 0 ; i < cpi -> oxcf. number_of_layers ; i ++ ) { init_temporal_layer_context ( cpi, oxcf, i, prev_layer_framerate ) ; prev_layer_framerate = cpi -> output_framerate

Fix:
<S2SV_ModStart> cm ) ; if ( oxcf -> timebase. num > 0 ) { <S2SV_ModStart> num ) ; } else { cpi -> framerate = 30 ; } <S2SV_ModStart> -> framerate ; cpi -> ref_frame_flags = VP8_ALTR_FRAME | VP8_GOLD_FRAME | VP8_LAST_FRAME ; cm -> refresh_golden_frame = 0 ; cm -> refresh_last_frame = 1 ; cm -> refresh_entropy_probs = 1 ;
Buggy code:
 static void sycc420_to_rgb ( opj_image_t * img ) { int * d0, * d1, * d2, * r, * g, * b, * nr, * ng, * nb ; const int * y, * cb, * cr, * ny ; <START_BUG> unsigned int maxw, maxh, max ; <END_BUG> int offset, upb ; unsigned int i, j ; upb = ( int ) img -> comps [ 0 ]. prec ; offset = 1 << ( upb - 1 ) ; upb = ( 1 << upb ) - 1 ;  maxw = ( unsigned int ) img -> comps [ 0 ]. w ; maxh = ( unsigned int ) img -> comps [ 0 ]. h ; <START_BUG> max = maxw * maxh ; y = img -> comps [ 0 ]. data ; cb = img -> comps [ 1 ]. data ; cr = img -> comps [ 2 ]. data ; <END_BUG> d0 = r = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ;  <START_BUG> d1 = g = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ; <END_BUG> d2 = b = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ; if ( r == NULL || g == NULL || b == NULL ) goto fails ;  for ( i = 0U ; i < ( maxh & ~ ( unsigned int ) 1U ) ; i += 2U ) <START_BUG> { <END_BUG> ny = y + maxw ;  nr = r + maxw ; ng = g + maxw ; nb = b + maxw ; <START_BUG> for ( j = 0 ; j < ( maxw & ~ ( unsigned int ) 1U ) ; j += 2U ) <END_BUG> { sycc_to_rgb ( offset, upb, * y, * cb, * cr, r, g, b ) ; ++ y ; ++ r ; ++ g ; ++ b ; sycc_to_rgb ( offset, upb, * y, * cb, * cr, r, g, b ) ; ++ y ; ++ r ; ++ g ; ++ b ; sycc_to_rgb ( offset, upb, * ny, * cb, * cr, nr, ng, nb ) ; ++ ny ; ++ nr ; ++ ng ; ++

Fix:
<S2SV_ModStart> * ny ; size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh ; int offset, upb ; size_t i <S2SV_ModEnd> ; upb = <S2SV_ModStart> maxw = ( size_t ) img -> comps [ 0 ]. w ; maxh = ( size_t ) img -> comps [ 0 ]. h ; max = maxw * maxh ; y = img -> comps [ 0 ]. data ; cb = img -> comps [ 1 ]. data ; cr = img -> comps [ 2 ]. data ; d0 = r = ( int * ) malloc ( sizeof ( int ) * max ) ; d1 = g <S2SV_ModEnd> = ( int <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> max ) ; d2 = b <S2SV_ModEnd> = ( int <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> goto fails ; offx = img -> x0 & 1U ; loopmaxw = maxw - offx ; offy = img -> y0 & 1U ; loopmaxh = maxh - offy ; if ( offy > 0U ) { size_t j ; for ( j = 0 ; j < maxw ; ++ j ) { sycc
Buggy code:
 static __be32 nfsd4_encode_fattr ( struct xdr_stream * xdr, struct svc_fh * fhp, struct svc_export * exp, struct dentry * dentry, u32 * bmval, struct svc_rqst * rqstp, int ignore_crossmnt ) { u32 bmval0 = bmval [ 0 ] ; u32 bmval1 = bmval [ 1 ] ; u32 bmval2 = bmval [ 2 ] ; struct kstat stat ; struct svc_fh * tempfh = NULL ; struct kstatfs statfs ; __be32 * p ; int starting_len = xdr -> buf -> len ; int attrlen_offset ; __be32 attrlen ; u32 dummy ; u64 dummy64 ; u32 rdattr_err = 0 ; __be32 status ; int err ; struct nfs4_acl * acl = NULL ; void * context = NULL ; int contextlen ; bool contextsupport = false ; struct nfsd4_compoundres * resp = rqstp -> rq_resp ; u32 minorversion = resp -> cstate. minorversion ; struct path path = {. mnt = exp -> ex_path. mnt,. dentry = dentry, } ; struct nfsd_net * nn = net_generic ( SVC_NET ( rqstp ), nfsd_net_id ) ; BUG_ON ( bmval1 & NFSD_WRITEONLY_ATTRS_WORD1 ) ; BUG_ON (! nfsd_attrs_supported ( minorversion, bmval ) ) ; if ( exp -> ex_fslocs. migrated ) { status = fattr_handle_absent_fs ( & bmval0, & bmval1, & bmval2, & rdattr_err ) ; if ( status ) goto out ; } err = vfs_getattr ( & path, & stat, STATX_BASIC_STATS, AT_STATX_SYNC_AS_STAT ) ; if ( err ) goto out_nfserr ; if ( ( bmval0 & ( FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME ) ) || ( bmval1 & ( FATTR4_WORD1

Fix:
<S2SV_ModStart> FATTR4_WORD2_SUPPATTR_EXCLCREAT ) { u32 supp [ 3 ] ; memcpy ( supp, nfsd_suppattrs [ minorversion ], sizeof ( supp ) ) ; supp [ 0 ] &= NFSD_SUPPATTR_EXCLCREAT_WORD0 ; supp [ 1 ] &= NFSD_SUPPATTR_EXCLCREAT_WORD1 ; supp [ 2 ] &= NFSD_SUPPATTR_EXCLCREAT_WORD2 ; <S2SV_ModStart> ( xdr, supp [ 0 ], supp [ 1 ], supp [ 2 ] <S2SV_ModEnd> ) ; if
Buggy code:
 static void print_maps ( struct pid_info_t * info ) { FILE * maps ; size_t offset ; char device [ 10 ] ; long int inode ; <START_BUG> char file [ PATH_MAX ] ; <END_BUG> strlcat ( info -> path, "maps", sizeof ( info -> path ) ) ; maps = fopen ( info -> path, "r" ) ; if (! maps ) goto out ;  while ( fscanf ( maps, "%*x-%*x   %*s   %zx   %s   %ld   %s\\n", & offset, device, & inode, <START_BUG> file ) == 4 ) { if ( inode == 0 ||! strcmp ( device, "00:00" ) ) continue ; printf ( "%-9s   %5d   %10s   %4s   %9s   %18s   %9zd   %10ld   %s\\n", info -> cmdline, info -> pid, info -> user, "mem", "???", device, offset, inode, file ) ; } fclose ( maps ) ; out : info -> path [ info -> parent_length ] = '\\0' ; }<END_BUG>

Fix:
<S2SV_ModStart> char file [ 1024 <S2SV_ModEnd> ] ; strlcat <S2SV_ModStart> ( maps, "%*x-%*x <S2SV_blank> %*s <S2SV_blank> %zx <S2SV_blank> %5s <S2SV_blank> %ld <S2SV_blank> %1023s\\n" <S2SV_ModEnd>, & offset
Buggy code:
 int x86_emulate_insn ( struct x86_emulate_ctxt * ctxt ) { const struct x86_emulate_ops * ops = ctxt -> ops ; int rc = X86EMUL_CONTINUE ; int saved_dst_type = ctxt -> dst. type ; ctxt -> mem_read. pos = 0 ; if ( ctxt -> lock_prefix && (! ( ctxt -> d & Lock ) || ctxt -> dst. type!= OP_MEM ) ) { rc = emulate_ud ( ctxt ) ; goto done ; } if ( ( ctxt -> d & SrcMask ) == SrcMemFAddr && ctxt -> src. type!= OP_MEM ) { rc = emulate_ud ( ctxt ) ; goto done ; } if ( unlikely ( ctxt -> d & ( No64 | Undefined | Sse | Mmx | Intercept | CheckPerm | Priv | Prot | String ) ) ) { if ( ( ctxt -> mode == X86EMUL_MODE_PROT64 && ( ctxt -> d & No64 ) ) || ( ctxt -> d & Undefined ) ) { rc = emulate_ud ( ctxt ) ; goto done ; } if ( ( ( ctxt -> d & ( Sse | Mmx ) ) && ( ( ops -> get_cr ( ctxt, 0 ) & X86_CR0_EM ) ) ) || ( ( ctxt -> d & Sse ) &&! ( ops -> get_cr ( ctxt, 4 ) & X86_CR4_OSFXSR ) ) ) { rc = emulate_ud ( ctxt ) ; goto done ; } if ( ( ctxt -> d & ( Sse | Mmx ) ) && ( ops -> get_cr ( ctxt, 0 ) & X86_CR0_TS ) ) { rc = emulate_nm ( ctxt ) ; goto done ; } if ( ctxt -> d & Mmx ) { rc = flush_pending_x87_faults ( ctxt ) ; if ( rc!= X86EMUL_CONTINUE ) goto done ; fetch_possible_mmx_operand ( ctxt, & ctxt -> src ) ; fetch_possible_mmx_operand ( ctxt, & ctxt -> src2 ) ; if (! ( ctxt -> d & Mov ) ) fetch_possible_mmx_operand ( ctxt, & ctxt -> dst ) ; } if ( unlikely ( ctxt -> guest_mode ) &&

Fix:
<S2SV_ModStart> eflags ) ) rc = <S2SV_ModStart> case 0xeb : rc = <S2SV_ModStart> eflags ) ) rc =
Buggy code:
 static int netbk_set_skb_gso ( struct xenvif * vif, struct sk_buff * skb, struct xen_netif_extra_info * gso ) { if (! gso -> u. gso. size ) { <START_BUG> netdev_dbg ( vif -> dev, "GSO   size   must   not   be   zero.\\n" ) ; <END_BUG> return - EINVAL ; } if ( gso -> u. gso. type!= XEN_NETIF_GSO_TYPE_TCPV4 ) {  netdev_dbg ( vif -> dev, "Bad   GSO   type   %d.\\n", gso -> u. gso. type ) ; <START_BUG> return - EINVAL ; } skb_shinfo ( skb ) -> gso_size = gso -> u. gso. size ; skb_shinfo ( skb ) -> gso_type = SKB_GSO_TCPV4 ; skb_shinfo ( skb ) -> gso_type |= SKB_GSO_DODGY ; skb_shinfo ( skb ) -> gso_segs = 0 ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> size ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> dev, "GSO <S2SV_blank> size <S2SV_blank> must <S2SV_blank> not <S2SV_blank> be <S2SV_blank> zero.\\n" ) ; netbk_fatal_tx_err ( vif <S2SV_ModStart> XEN_NETIF_GSO_TYPE_TCPV4 ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> gso. type ) ; netbk_fatal_tx_err ( vif
Buggy code:
 static void init_vmcb ( struct vcpu_svm * svm ) { struct vmcb_control_area * control = & svm -> vmcb -> control ; struct vmcb_save_area * save = & svm -> vmcb -> save ; svm -> vcpu. fpu_active = 1 ; svm -> vcpu. arch. hflags = 0 ; set_cr_intercept ( svm, INTERCEPT_CR0_READ ) ; set_cr_intercept ( svm, INTERCEPT_CR3_READ ) ; set_cr_intercept ( svm, INTERCEPT_CR4_READ ) ; set_cr_intercept ( svm, INTERCEPT_CR0_WRITE ) ; set_cr_intercept ( svm, INTERCEPT_CR3_WRITE ) ; set_cr_intercept ( svm, INTERCEPT_CR4_WRITE ) ; set_cr_intercept ( svm, INTERCEPT_CR8_WRITE ) ; set_dr_intercepts ( svm ) ; set_exception_intercept ( svm, PF_VECTOR ) ; set_exception_intercept ( svm, UD_VECTOR ) ; <START_BUG> set_exception_intercept ( svm, MC_VECTOR ) ; <END_BUG> set_intercept ( svm, INTERCEPT_INTR ) ; set_intercept ( svm, INTERCEPT_NMI ) ; set_intercept ( svm, INTERCEPT_SMI ) ; set_intercept ( svm, INTERCEPT_SELECTIVE_CR0 ) ; set_intercept ( svm, INTERCEPT_RDPMC ) ; set_intercept ( svm, INTERCEPT_CPUID ) ; set_intercept ( svm, INTERCEPT_INVD ) ; set_intercept ( svm, INTERCEPT_HLT ) ; set_intercept ( svm, INTERCEPT_INVLPG ) ; set_intercept ( svm, INTERCEPT_INVLPGA ) ; set_intercept ( svm, INTERCEPT_IOIO_PROT ) ; set_intercept ( svm, INTERCEPT_MSR_PROT ) ; set_intercept ( svm, INTERCEPT_TASK_SWITCH ) ; set_intercept ( svm, INTERCEPT_SHUTDOWN ) ; set_intercept ( svm, INTERCEPT_VMRUN ) ; set_intercept ( svm, INTERCEPT_

Fix:
<S2SV_ModStart> svm, MC_VECTOR ) ; set_exception_intercept ( svm, AC_VECTOR
Buggy code:
 static vpx_codec_err_t ctrl_get_last_ref_updates ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctrl_id, va_list args ) { <END_BUG> int * const update_info = va_arg ( args, int * ) ;  if ( update_info ) { <START_BUG> <END_BUG> if ( ctx -> pbi )  <START_BUG> * update_info = ctx -> pbi -> refresh_frame_flags ; <END_BUG> else return VPX_CODEC_ERROR ; return VPX_CODEC_OK ; } else {  return VPX_CODEC_INVALID_PARAM ; <START_BUG> } <END_BUG> } 

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> ; if ( ctx -> frame_parallel_decode ) { set_error_detail ( ctx, "Not <S2SV_blank> supported <S2SV_blank> in <S2SV_blank> frame <S2SV_blank> parallel <S2SV_blank> decode" ) ; return VPX_CODEC_INCAPABLE ; } if ( <S2SV_ModStart> ( ctx -> frame_workers ) { VPxWorker * const worker = ctx -> frame_workers ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; <S2SV_ModEnd> * update_info = <S2SV_ModStart> * update_info = frame_worker_data <S2SV_ModEnd> -> pbi -> <S2SV_ModStart> pbi -> refresh_frame_flags <S2SV_ModEnd> ; return VPX_CODEC_OK <S2SV_ModStart> else { return VPX_CODEC_ERROR <S2SV_ModEnd> ; } } <S2SV_ModStart> ; } } return VPX_CODEC_INVALID_PARAM ; }
Buggy code:
 static void tv_details_row_activated ( GtkTreeView * tree_view, GtkTreePath * tree_path_UNUSED, GtkTreeViewColumn * column, gpointer user_data ) { gchar * item_name ; struct problem_item * item = get_current_problem_item_or_NULL ( tree_view, & item_name ) ; if (! item ||! ( item -> flags & CD_FLAG_TXT ) ) goto ret ; if (! strchr ( item -> content, '\\n' ) ) goto ret ; gint exitcode ; gchar * arg [ 3 ] ; arg [ 0 ] = ( char * ) "xdg-open" ; arg [ 1 ] = concat_path_file ( g_dump_dir_name, item_name ) ; arg [ 2 ] = NULL ; const gboolean spawn_ret = g_spawn_sync ( NULL, arg, NULL, G_SPAWN_SEARCH_PATH | G_SPAWN_STDOUT_TO_DEV_NULL, NULL, NULL, NULL, NULL, & exitcode, NULL ) ; if ( spawn_ret == FALSE || exitcode!= EXIT_SUCCESS ) { GtkWidget * dialog = gtk_dialog_new_with_buttons ( _ ( "View//edit   a   text   file" ), GTK_WINDOW ( g_wnd_assistant ), GTK_DIALOG_MODAL | GTK_DIALOG_DESTROY_WITH_PARENT, NULL, NULL ) ; GtkWidget * vbox = gtk_dialog_get_content_area ( GTK_DIALOG ( dialog ) ) ; GtkWidget * scrolled = gtk_scrolled_window_new ( NULL, NULL ) ; GtkWidget * textview = gtk_text_view_new ( ) ; gtk_dialog_add_button ( GTK_DIALOG ( dialog ), _ ( "_Save" ), GTK_RESPONSE_OK ) ; gtk_dialog_add_button ( GTK_DIALOG ( dialog ), _ ( "_Cancel" ), GTK_RESPONSE_CANCEL ) ; gtk_box_pack_start ( GTK_BOX ( vbox ), scrolled, TRUE, TRUE, 0 ) ; gtk_widget_set_size_request ( scrolled, 640, 480 ) ; gtk_widget_show ( sc

Fix:
<S2SV_ModStart> == GTK_RESPONSE_OK ) { <S2SV_ModStart> item_name ) ; problem_data_reload_from_dump_dir ( ) ; update_gui_state_from_problem_data ( 0 ) ; }
Buggy code:
 GF_Err flac_dmx_process ( GF_Filter * filter ) { GF_FLACDmxCtx * ctx = gf_filter_get_udta ( filter ) ; GF_FilterPacket * pck, * dst_pck ; u8 * output ; u8 * start ; Bool final_flush = GF_FALSE ; u32 pck_size, remain, prev_pck_size ; u64 cts = GF_FILTER_NO_TS ; <START_BUG> FLACHeader hdr ; <END_BUG> if (! ctx -> duration. num ) flac_dmx_check_dur ( filter, ctx ) ; if ( ctx -> opid &&! ctx -> is_playing ) return GF_OK ; pck = gf_filter_pid_get_packet ( ctx -> ipid ) ; if (! pck ) { if ( gf_filter_pid_is_eos ( ctx -> ipid ) ) { if (! ctx -> flac_buffer_size ) { if ( ctx -> opid ) gf_filter_pid_set_eos ( ctx -> opid ) ; if ( ctx -> src_pck ) gf_filter_pck_unref ( ctx -> src_pck ) ; ctx -> src_pck = NULL ; return GF_EOS ; } final_flush = GF_TRUE ; } else { return GF_OK ; } } prev_pck_size = ctx -> flac_buffer_size ; if ( pck &&! ctx -> resume_from ) { u8 * data = ( u8 * ) gf_filter_pck_get_data ( pck, & pck_size ) ; if ( ctx -> byte_offset!= GF_FILTER_NO_BO ) { u64 byte_offset = gf_filter_pck_get_byte_offset ( pck ) ; if (! ctx -> flac_buffer_size ) { ctx -> byte_offset = byte_offset ; } else if ( ctx -> byte_offset + ctx -> flac_buffer_size!= byte_offset ) { ctx -> byte_offset = GF_FILTER_NO_BO ; if ( ( byte_offset!= GF_FILTER_NO_BO ) && ( byte_offset > ctx -> flac_buffer_size ) ) { ctx ->

Fix:
<S2SV_ModStart> ; FLACHeader hdr ; if ( ctx -> in_error ) return GF_NON_COMPLIANT_BITSTREAM <S2SV_ModStart> ) ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_PARSER, ( "[FLACDmx] <S2SV_blank> invalid <S2SV_blank> FLAC <S2SV_blank> magic\\n" ) ) ; ctx -> in_error = GF_TRUE ; ctx -> flac_buffer_size = 0 ; if ( pck ) gf_filter_pid_drop_packet ( ctx -> ipid ) ; return GF_NON_COMPLIANT_BITSTREAM ; <S2SV_ModStart> last ) break ; } if (! dsi_end ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_PARSER, ( "[FLACDmx] <S2SV_blank> invalid <S2SV_blank> FLAC <S2SV_blank> header\\n" ) ) ; ctx -> in_error = GF_TRUE ; ctx -> flac_buffer_size = 0 ; if ( pck ) gf_filter_pid_drop_packet ( ctx -> ipid ) ; return GF_NON_COMPLIANT_BITSTREAM
Buggy code:
 u_int chdlc_if_print ( netdissect_options * ndo, const struct pcap_pkthdr * h, register const u_char * p ) { <START_BUG> register u_int length = h -> len ; <END_BUG> register u_int caplen = h -> caplen ; if ( caplen < CHDLC_HDRLEN ) { ND_PRINT ( ( ndo, "[|chdlc]" ) ) ; return ( caplen ) ; }  return ( chdlc_print ( ndo, p, length ) ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> p ) { return <S2SV_ModEnd> chdlc_print ( ndo <S2SV_ModStart>, p, h -> len <S2SV_ModEnd> ) ; }
Buggy code:
 WORD32 ih264d_parse_decode_slice ( UWORD8 u1_is_idr_slice, UWORD8 u1_nal_ref_idc, dec_struct_t * ps_dec ) { dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; dec_pic_params_t * ps_pps ; dec_seq_params_t * ps_seq ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; pocstruct_t s_tmp_poc ; WORD32 i_delta_poc [ 2 ] ; WORD32 i4_poc = 0 ; UWORD16 u2_first_mb_in_slice, u2_frame_num ; UWORD8 u1_field_pic_flag, u1_redundant_pic_cnt = 0, u1_slice_type ; UWORD32 u4_idr_pic_id = 0 ; UWORD8 u1_bottom_field_flag, u1_pic_order_cnt_type ; UWORD8 u1_nal_unit_type ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; WORD8 i1_is_end_of_poc ; WORD32 ret, end_of_frame ; WORD32 prev_slice_err, num_mb_skipped ; UWORD8 u1_mbaff ; pocstruct_t * ps_cur_poc ; UWORD32 u4_temp ; WORD32 i_temp ; UWORD32 u4_call_end_of_pic = 0 ; ps_dec -> ps_dpb_cmds -> u1_dpb_commands_read_slc = 0 ; u2_first_mb_in_slice = ih264d_uev ( pu4_bitstrm_ofst, pu4_bitstrm_buf ) ; if ( u2_first_mb_in_slice > ( ps_dec -> u2_frm_ht_in_mbs * ps_dec -> u2_frm_

Fix:
<S2SV_ModStart> -> u1_first_slice_in_stream && <S2SV_ModEnd> ps_dec -> u4_first_slice_in_pic <S2SV_ModStart> ps_dec -> u4_first_slice_in_pic <S2SV_ModEnd> ) { pocstruct_t <S2SV_ModStart> ps_dec -> u4_first_slice_in_pic == 0 <S2SV_ModEnd> ) { i1_is_end_of_poc <S2SV_ModStart> ps_dec -> u4_first_slice_in_pic <S2SV_ModEnd> ) { if <S2SV_ModStart> } else { prev_slice_err = 2 <S2SV_ModEnd> ; num_mb_skipped = <S2SV_ModStart> ; num_mb_skipped = ( ps_dec -> u2_frm_ht_in_mbs * ps_dec -> u2_frm_wd_in_mbs ) - ps_dec -> u2_total_mbs_coded ; ps_cur_poc = & s_tmp_poc ; } } else { if ( ( <S2SV_ModStart> u2_first_mb_in_slice << u1_mbaff ) > ps_dec -> u2_total_mbs_coded ) <S2SV_ModEnd> { prev_slice_err = <S2SV_ModStart> ; num_mb_skipped = <S2SV_ModEnd> ( u2_
Buggy code:
 int main ( void ) { int fd, len, sock_opt ; int error ; struct cn_msg * message ; struct pollfd pfd ; struct nlmsghdr * incoming_msg ; struct cn_msg * incoming_cn_msg ; struct hv_kvp_msg * hv_msg ; char * p ; char * key_value ; char * key_name ; daemon ( 1, 0 ) ; openlog ( "KVP", 0, LOG_USER ) ; syslog ( LOG_INFO, "KVP   starting;   pid   is:%d", getpid ( ) ) ; kvp_get_os_info ( ) ; if ( kvp_file_init ( ) ) { syslog ( LOG_ERR, "Failed   to   initialize   the   pools" ) ; exit ( - 1 ) ; } fd = socket ( AF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR ) ; if ( fd < 0 ) { syslog ( LOG_ERR, "netlink   socket   creation   failed;   error:%d", fd ) ; exit ( - 1 ) ; } addr. nl_family = AF_NETLINK ; addr. nl_pad = 0 ; addr. nl_pid = 0 ; addr. nl_groups = CN_KVP_IDX ; error = bind ( fd, ( struct sockaddr * ) & addr, sizeof ( addr ) ) ; if ( error < 0 ) { syslog ( LOG_ERR, "bind   failed;   error:%d", error ) ; close ( fd ) ; exit ( - 1 ) ; } sock_opt = addr. nl_groups ; setsockopt ( fd, 270, 1, & sock_opt, sizeof ( sock_opt ) ) ; message = ( struct cn_msg * ) kvp_send_buffer ; message -> id. idx = CN_KVP_IDX ; message -> id. val = CN_KVP_VAL ; hv_msg = ( struct hv_kvp_msg * ) message -> data ; hv_msg -> kvp_hdr. operation = KVP_OP_REGISTER ; message -> ack = 0 ; message -> len = sizeof ( struct hv_kvp_msg ) ; len = netlink_send ( fd, message ) ; if ( len < 0 ) { syslog ( LOG_ERR, "netlink_send   failed;   error

Fix:
<S2SV_ModStart> 1 ) { struct sockaddr * addr_p = ( struct sockaddr * ) & addr ; socklen_t addr_l = sizeof ( addr ) ; <S2SV_ModStart> ; len = recvfrom <S2SV_ModEnd> ( fd, <S2SV_ModStart> ), 0, addr_p, & addr_l <S2SV_ModStart> len < 0 || addr. nl_pid <S2SV_ModStart> ( LOG_ERR, "recvfrom <S2SV_blank> failed; <S2SV_blank> pid:%u <S2SV_blank> error:%d <S2SV_blank> %s", addr. nl_pid, errno, strerror ( errno ) <S2SV_ModEnd> ) ; close
Buggy code:
 int git_delta_apply ( void * * out, size_t * out_len, const unsigned char * base, size_t base_len, const unsigned char * delta, size_t delta_len ) { const unsigned char * delta_end = delta + delta_len ; size_t base_sz, res_sz, alloc_sz ; unsigned char * res_dp ; * out = NULL ; * out_len = 0 ; if ( ( hdr_sz ( & base_sz, & delta, delta_end ) < 0 ) || ( base_sz!= base_len ) ) { giterr_set ( GITERR_INVALID, "failed   to   apply   delta:   base   size   does   not   match   given   data" ) ; return - 1 ; } if ( hdr_sz ( & res_sz, & delta, delta_end ) < 0 ) { giterr_set ( GITERR_INVALID, "failed   to   apply   delta:   base   size   does   not   match   given   data" ) ; return - 1 ; } GITERR_CHECK_ALLOC_ADD ( & alloc_sz, res_sz, 1 ) ; res_dp = git__malloc ( alloc_sz ) ; GITERR_CHECK_ALLOC ( res_dp ) ; res_dp [ res_sz ] = '\\0' ; * out = res_dp ; * out_len = res_sz ; while ( delta < delta_end ) { unsigned char cmd = * delta ++ ; if ( cmd & 0x80 ) { size_t off = 0, len = 0 ; <START_BUG> if ( cmd & 0x01 ) off = * delta ++ ; <END_BUG>  if ( cmd & 0x02 ) off |= * delta ++ << 8UL ; <START_BUG> <END_BUG> if ( cmd & 0x04 ) off |= * delta ++ << 16UL ;  <START_BUG> if ( cmd & 0x08 ) off |= ( ( unsigned ) * delta ++ << 24UL ) ; <END_BUG>  if ( cmd & 0x10 ) len = * delta ++ ; <START_BUG> <END_BUG> if ( cmd & 0x20 ) len |= * delta ++ << 8UL ;  <START_BUG> if ( cmd & 0x40 ) len |= * delta ++ << 16UL ; <END_BUG>  if (! len ) len = 0x10000 ; <START_BUG> if ( base_len < off + len<END_BUG>

Fix:
<S2SV_ModStart> = 0 ; # define ADD_DELTA ( o, shift ) { if ( delta < delta_end ) ( o ) |= ( ( unsigned ) <S2SV_ModEnd> * delta ++ <S2SV_ModStart> delta ++ << shift ) ; else goto fail ; } if ( cmd & 0x01 ) ADD_DELTA ( off, 0UL ) ; if ( cmd & 0x02 ) ADD_DELTA ( off, 8UL ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> & 0x04 ) ADD_DELTA ( off, 16UL ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> & 0x08 ) ADD_DELTA ( off, <S2SV_ModEnd> 24UL ) ; <S2SV_ModStart> & 0x10 ) ADD_DELTA ( len, 0UL ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> & 0x20 ) ADD_DELTA ( len, 8UL ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> & 0x40 ) ADD_DELTA ( len, 16UL ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> = 0x10000 ; # undef ADD_DELTA
Buggy code:
 static void gimp_write_and_read_file ( Gimp * gimp, gboolean with_unusual_stuff, gboolean compat_paths, gboolean use_gimp_2_8_features ) { GimpImage * image ; GimpImage * loaded_image ; GimpPlugInProcedure * proc ; <START_BUG> gchar * filename ; <END_BUG> GFile * file ; image = gimp_create_mainimage ( gimp, with_unusual_stuff, compat_paths, use_gimp_2_8_features ) ; gimp_assert_mainimage ( image, with_unusual_stuff, compat_paths, use_gimp_2_8_features ) ;  filename = g_build_filename ( g_get_tmp_dir ( ), "gimp-test.xcf", NULL ) ; <START_BUG> file = g_file_new_for_path ( filename ) ; g_free ( filename ) ; proc = gimp_plug_in_manager_file_procedure_find ( image -> gimp -> plug_in_manager, GIMP_FILE_PROCEDURE_GROUP_SAVE, file, NULL ) ; file_save ( gimp, image, NULL, file, proc, GIMP_RUN_NONINTERACTIVE, FALSE, FALSE, FALSE, NULL ) ; loaded_image = gimp_test_load_image ( image -> gimp, file ) ; gimp_assert_mainimage ( loaded_image, with_unusual_stuff, compat_paths, use_gimp_2_8_features ) ; g_file_delete ( file, NULL, NULL ) ; g_object_unref ( file ) ; }<END_BUG>

Fix:
<S2SV_ModStart> gchar * filename = NULL ; gint file_handle <S2SV_ModStart> use_gimp_2_8_features ) ; file_handle = g_file_open_tmp ( "gimp-test-XXXXXX.xcf", & filename, NULL ) ; g_assert ( file_handle!= - 1 ) ; close ( file_handle <S2SV_ModEnd> ) ; file
Buggy code:
 int tipc_nl_publ_dump ( struct sk_buff * skb, struct netlink_callback * cb ) { int err ; u32 tsk_portid = cb -> args [ 0 ] ; u32 last_publ = cb -> args [ 1 ] ; u32 done = cb -> args [ 2 ] ; struct net * net = sock_net ( skb -> sk ) ; struct tipc_sock * tsk ; if (! tsk_portid ) { struct nlattr * * attrs ; struct nlattr * sock [ TIPC_NLA_SOCK_MAX + 1 ] ; err = tipc_nlmsg_parse ( cb -> nlh, & attrs ) ; if ( err ) return err ; <START_BUG> err = nla_parse_nested ( sock, TIPC_NLA_SOCK_MAX, <END_BUG>  attrs [ TIPC_NLA_SOCK ], <START_BUG> tipc_nl_sock_policy ) ; if ( err ) return err ; if (! sock [ TIPC_NLA_SOCK_REF ] ) return - EINVAL ; <END_BUG> tsk_portid = nla_get_u32 ( sock [ TIPC_NLA_SOCK_REF ] ) ;  } if ( done ) return 0 ; tsk = tipc_sk_lookup ( net, tsk_portid ) ; if (! tsk ) return - EINVAL ; <START_BUG> lock_sock ( & tsk -> sk ) ; <END_BUG> err = __tipc_nl_list_sk_publ ( skb, cb, tsk, & last_publ ) ; if (! err ) done = 1 ; release_sock ( & tsk -> sk ) ; sock_put ( & tsk -> sk ) ; cb -> args [ 0 ] = tsk_portid ; cb -> args [ 1 ] = last_publ ; cb -> args [ 2 ] = done ; return skb -> len ; }

Fix:
<S2SV_ModStart> return err ; if (! <S2SV_ModEnd> attrs [ TIPC_NLA_SOCK <S2SV_ModStart> attrs [ TIPC_NLA_SOCK <S2SV_ModEnd> ] ) return <S2SV_ModStart> - EINVAL ; err = nla_parse_nested ( sock, TIPC_NLA_SOCK_MAX, attrs [ TIPC_NLA_SOCK ], tipc_nl_sock_policy ) ; if ( err ) return err ; if (! sock <S2SV_ModEnd> [ TIPC_NLA_SOCK_REF ] <S2SV_ModStart> [ TIPC_NLA_SOCK_REF ] <S2SV_ModEnd> ) return - <S2SV_ModStart> - EINVAL ; tsk_portid = nla_get_u32 ( sock [ TIPC_NLA_SOCK_REF ] ) ; } if ( done ) return 0 ; tsk = tipc_sk_lookup ( net, tsk_portid ) ; if (! tsk ) return - EINVAL ;
Buggy code:
 err_t verify_signed_hash ( const struct RSA_public_key * k, u_char * s, unsigned int s_max_octets, u_char * * psig, size_t hash_len, const u_char * sig_val, size_t sig_len ) { unsigned int padlen ; { chunk_t temp_s ; MP_INT c ; n_to_mpz ( & c, sig_val, sig_len ) ; oswcrypto. mod_exp ( & c, & c, & k -> e, & k -> n ) ; temp_s = mpz_to_n ( & c, sig_len ) ; if ( s_max_octets < sig_len ) { return "2" "exponentiation   failed;   too   many   octets" ; } memcpy ( s, temp_s. ptr, sig_len ) ; pfree ( temp_s. ptr ) ; mpz_clear ( & c ) ; } padlen = sig_len - 3 - hash_len ; DBG ( DBG_CRYPT, DBG_dump ( "verify_sh   decrypted   SIG1:", s, sig_len ) ) ; DBG ( DBG_CRYPT, DBG_log ( "pad_len   calculated:   %d   hash_len:   %d", padlen, ( int ) hash_len ) ) ; if ( s [ 0 ]!= 0x00 || s [ 1 ]!= 0x01 || s [ padlen + 2 ]!= 0x00 ) { return "3" "SIG   padding   does   not   check   out" ; } <START_BUG> s += padlen + 3 ; <END_BUG>  ( * psig ) = s ; <START_BUG> return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> "SIG <S2SV_blank> padding <S2SV_blank> does <S2SV_blank> not <S2SV_blank> check <S2SV_blank> out" ; } ( * psig ) = s + <S2SV_ModEnd> padlen + 3 <S2SV_ModStart> + 3 ; { const u_char * p ; size_t cnt_ffs = 0 ; for ( p = s + 2 ; p < s + padlen + 2 ; p ++ ) if ( * p == 0xFF ) cnt_ffs ++ ; if ( cnt_ffs!= padlen ) return "4" "invalid <S2SV_blank> Padding <S2SV_blank> String" ; } <S2SV_ModEnd> return NULL ;
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_slice_header ( codec_t * ps_codec, nal_header_t * ps_nal ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; WORD32 i ; WORD32 sps_id ; pps_t * ps_pps ; sps_t * ps_sps ; slice_header_t * ps_slice_hdr ; WORD32 disable_deblocking_filter_flag ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; WORD32 idr_pic_flag ; WORD32 pps_id ; WORD32 first_slice_in_pic_flag ; WORD32 no_output_of_prior_pics_flag = 0 ; WORD8 i1_nal_unit_type = ps_nal -> i1_nal_unit_type ; WORD32 num_poc_total_curr = 0 ; WORD32 slice_address ; if ( ps_codec -> i4_slice_error == 1 ) return ret ; idr_pic_flag = ( NAL_IDR_W_LP == i1_nal_unit_type ) || ( NAL_IDR_N_LP == i1_nal_unit_type ) ; BITS_PARSE ( "first_slice_in_pic_flag", first_slice_in_pic_flag, ps_bitstrm, 1 ) ; if ( ( NAL_BLA_W_LP <= i1_nal_unit_type ) && ( NAL_RSV_RAP_VCL23 >= i1_nal_unit_type ) ) { BITS_PARSE ( "no_output_of_prior_pics_flag", no_output_of_prior_pics_flag, ps_bitstrm, 1 ) ; } UEV_PARSE ( "pic_parameter_set_id", pps_id, ps_bitstrm ) ; pps_id = CLIP3 ( pps_id, 0, MAX_PPS_CNT - 2 ) ; ps_pps = ps_codec -> s_parse

Fix:
<S2SV_ModStart> } else { ret = <S2SV_ModStart> ps_slice_hdr ) ; if ( ( WORD32 ) IHEVCD_SUCCESS!= ret ) { return ret ; }
Buggy code:
 bool_t xdr_krb5_tl_data ( XDR * xdrs, krb5_tl_data * * tl_data_head ) { krb5_tl_data * tl, * tl2 ; bool_t more ; unsigned int len ; switch ( xdrs -> x_op ) { case XDR_FREE : tl = tl2 = * tl_data_head ; while ( tl ) { tl2 = tl -> tl_data_next ; free ( tl -> tl_data_contents ) ; free ( tl ) ; tl = tl2 ; } <START_BUG> break ; <END_BUG> case XDR_ENCODE : tl = * tl_data_head ; while ( 1 ) { more = ( tl!= NULL ) ; if (! xdr_bool ( xdrs, & more ) ) return FALSE ; if ( tl == NULL ) break ; if (! xdr_krb5_int16 ( xdrs, & tl -> tl_data_type ) ) return FALSE ; len = tl -> tl_data_length ; if (! xdr_bytes ( xdrs, ( char * * ) & tl -> tl_data_contents, & len, ~ 0 ) ) return FALSE ; tl = tl -> tl_data_next ; } break ; case XDR_DECODE : tl = NULL ; while ( 1 ) { if (! xdr_bool ( xdrs, & more ) ) return FALSE ; if ( more == FALSE ) break ; tl2 = ( krb5_tl_data * ) malloc ( sizeof ( krb5_tl_data ) ) ; if ( tl2 == NULL ) return FALSE ; memset ( tl2, 0, sizeof ( krb5_tl_data ) ) ; if (! xdr_krb5_int16 ( xdrs, & tl2 -> tl_data_type ) ) return FALSE ; if (! xdr_bytes ( xdrs, ( char * * ) & tl2 -> tl_data_contents, & len, ~ 0 ) ) return FALSE ; tl2 -> tl_data_length = len ; tl2 -> tl_data_next = tl ; tl = tl2 ; } * tl_data_head = tl ; break ; } return TRUE ; }

Fix:
<S2SV_ModStart> tl2 ; } * tl_data_head = NULL ;
Buggy code:
 static int ExecuteSQL ( SQLHDBC hDbc, char * szSQL, char cDelimiter, int bColumnNames, int bHTMLTable ) { SQLHSTMT hStmt ; SQLTCHAR szSepLine [ 32001 ] ; SQLTCHAR szUcSQL [ 32001 ] ; SQLSMALLINT cols ; SQLINTEGER ret ; SQLLEN nRows = 0 ; szSepLine [ 0 ] = 0 ; ansi_to_unicode ( szSQL, szUcSQL ) ; if ( SQLAllocStmt ( hDbc, & hStmt )!= SQL_SUCCESS ) { if ( bVerbose ) DumpODBCLog ( hEnv, hDbc, 0 ) ; fprintf ( stderr, "[ISQL]ERROR:   Could   not   SQLAllocStmt\\n" ) ; return 0 ; } if ( buseED ) { ret = SQLExecDirect ( hStmt, szUcSQL, SQL_NTS ) ; if ( ret == SQL_NO_DATA ) { fprintf ( stderr, "[ISQL]INFO:   SQLExecDirect   returned   SQL_NO_DATA\\n" ) ; } else if ( ret == SQL_SUCCESS_WITH_INFO ) { if ( bVerbose ) DumpODBCLog ( hEnv, hDbc, hStmt ) ; fprintf ( stderr, "[ISQL]INFO:   SQLExecDirect   returned   SQL_SUCCESS_WITH_INFO\\n" ) ; } else if ( ret!= SQL_SUCCESS ) { if ( bVerbose ) DumpODBCLog ( hEnv, hDbc, hStmt ) ; fprintf ( stderr, "[ISQL]ERROR:   Could   not   SQLExecDirect\\n" ) ; SQLFreeStmt ( hStmt, SQL_DROP ) ; <START_BUG> free ( szSepLine ) ; <END_BUG> return 0 ; } } else { if ( SQLPrepare ( hStmt, szUcSQL, SQL_NTS )!= SQL_SUCCESS ) { if ( bVerbose ) DumpODBCLog ( hEnv, hDbc, hStmt ) ; fprintf ( stderr, "[ISQL]ERROR:   Could   not   SQLPrepare\\n" ) ; SQLFreeStmt ( hStmt, SQL_DROP ) ; return 0 ; } ret = SQLExecute ( hStmt ) ; if ( ret == SQL_NO_DATA ) { fprintf ( stderr, "[ISQL]INFO:   SQLExecute  

Fix:
<S2SV_ModStart> SQL_DROP ) ; <S2SV_ModEnd> return 0 ;
Buggy code:
 static int print_ccp_config_options ( netdissect_options * ndo, const u_char * p, int length ) { int len, opt ; if ( length < 2 ) return 0 ; ND_TCHECK2 ( * p, 2 ) ; len = p [ 1 ] ; opt = p [ 0 ] ; if ( length < len ) return 0 ; if ( len < 2 ) { ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u   (length   bogus,   should   be   >=   2)", tok2str ( ccpconfopts_values, "Unknown", opt ), opt, len ) ) ; return 0 ; } ND_PRINT ( ( ndo, "\\n\\t     %s   Option   (0x%02x),   length   %u", tok2str ( ccpconfopts_values, "Unknown", opt ), opt, len ) ) ; switch ( opt ) { case CCPOPT_BSDCOMP : if ( len < 3 ) { ND_PRINT ( ( ndo, "   (length   bogus,   should   be   >=   3)" ) ) ; return len ; } <START_BUG> ND_TCHECK2 ( * ( p + 2 ), 1 ) ; <END_BUG> ND_PRINT ( ( ndo, ":   Version:   %u,   Dictionary   Bits:   %u", p [ 2 ] >> 5, p [ 2 ] & 0x1f ) ) ; break ; case CCPOPT_MVRCA : if ( len < 4 ) { ND_PRINT ( ( ndo, "   (length   bogus,   should   be   >=   4)" ) ) ; return len ; }  ND_TCHECK2 ( * ( p + 2 ), 1 ) ; <START_BUG> ND_PRINT ( ( ndo, ":   Features:   %u,   PxP:   %s,   History:   %u,   #CTX-ID:   %u", ( p [ 2 ] & 0xc0 ) >> 6, ( p [ 2 ] & 0x20 )? "Enabled" : "Disabled", p [ 2 ] & 0x1f, p [ 3 ] ) ) ; break<END_BUG>

Fix:
<S2SV_ModStart> len ; } ND_TCHECK ( p [ 2 ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> len ; } ND_TCHECK ( p [ 3 ] <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> len ; } ND_TCHECK ( p [ 3 ] <S2SV_ModEnd> ) ; ND_PRINT