nus-yam/ex-repair huggingface dataset:
Buggy code:
 static inline int ip6_ufo_append_data ( struct sock * sk, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int hh_len, int fragheaderlen, <START_BUG> int transhdrlen, int mtu, unsigned int flags ) <END_BUG> { struct sk_buff * skb ; int err ; if ( ( skb = skb_peek_tail ( & sk -> sk_write_queue ) ) == NULL ) { skb = sock_alloc_send_skb ( sk, hh_len + fragheaderlen + transhdrlen + 20, ( flags & MSG_DONTWAIT ), & err ) ; if ( skb == NULL ) return - ENOMEM ; skb_reserve ( skb, hh_len ) ; skb_put ( skb, fragheaderlen + transhdrlen ) ; skb_reset_network_header ( skb ) ; skb -> transport_header = skb -> network_header + fragheaderlen ; skb -> ip_summed = CHECKSUM_PARTIAL ; skb -> csum = 0 ; } err = skb_append_datato_frags ( sk, skb, getfrag, from, ( length - transhdrlen ) ) ; if (! err ) { struct frag_hdr fhdr ; skb_shinfo ( skb ) -> gso_size = ( mtu - fragheaderlen - sizeof ( struct frag_hdr ) ) & ~ 7 ; skb_shinfo ( skb ) -> gso_type = SKB_GSO_UDP ;  ipv6_select_ident ( & fhdr ) ; <START_BUG> skb_shinfo ( skb ) -> ip6_frag_id = fhdr. identification ; __skb_queue_tail ( & sk -> sk_write_queue, skb ) ; return 0 ; } kfree_skb ( skb ) ; return err ; }<END_BUG>

Fix:
<S2SV_ModStart> unsigned int flags, struct rt6_info * rt <S2SV_ModStart> ( & fhdr, rt
Buggy code:
 static AVFrame * get_video_buffer ( AVFilterLink * inlink, int w, int h ) { PadContext * s = inlink -> dst -> priv ; AVFrame * frame = ff_get_video_buffer ( inlink -> dst -> outputs [ 0 ], w + ( s -> w - s -> in_w ), h + ( s -> h - s -> in_h ) ) ; int plane ; if (! frame ) return NULL ; frame -> width = w ; frame -> height = h ; <START_BUG> for ( plane = 0 ; plane < 4 && frame -> data [ plane ] ; plane ++ ) { <END_BUG> int hsub = s -> draw. hsub [ plane ] ; int vsub = s -> draw. vsub [ plane ] ; frame -> data [ plane ] += ( s -> x >> hsub ) * s -> draw. pixelstep [ plane ] + ( s -> y >> vsub ) * frame -> linesize [ plane ] ; } return frame ; }

Fix:
<S2SV_ModStart> [ plane ] && frame -> linesize [ plane ]
Buggy code:
 static __latent_entropy struct task_struct * copy_process ( struct pid * pid, int trace, int node, struct kernel_clone_args * args ) { int pidfd = - 1, retval ; struct task_struct * p ; struct multiprocess_signals delayed ; struct file * pidfile = NULL ; u64 clone_flags = args -> flags ; struct nsproxy * nsp = current -> nsproxy ; if ( ( clone_flags & ( CLONE_NEWNS | CLONE_FS ) ) == ( CLONE_NEWNS | CLONE_FS ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & ( CLONE_NEWUSER | CLONE_FS ) ) == ( CLONE_NEWUSER | CLONE_FS ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_THREAD ) &&! ( clone_flags & CLONE_SIGHAND ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_SIGHAND ) &&! ( clone_flags & CLONE_VM ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_PARENT ) && current -> signal -> flags & SIGNAL_UNKILLABLE ) return ERR_PTR ( - EINVAL ) ; if ( clone_flags & CLONE_THREAD ) { if ( ( clone_flags & ( CLONE_NEWUSER | CLONE_NEWPID ) ) || ( task_active_pid_ns ( current )!= nsp -> pid_ns_for_children ) ) return ERR_PTR ( - EINVAL ) ; } if ( clone_flags & ( CLONE_THREAD | CLONE_VM ) ) { if ( nsp -> time_ns!= nsp -> time_ns_for_children ) return ERR_PTR ( - EINVAL ) ; } if ( clone_flags & CLONE_PIDFD ) { if ( clone_flags & ( CLONE_DETACHED | CLONE_THREAD ) ) return ERR_PTR ( - EINVAL ) ; } sigemptyset ( & delayed. signal ) ; INIT_HLIST_NODE ( & delayed. node ) ; spin_lock_irq ( & current -> sighand -> siglock ) ; if (! ( clone

Fix:
<S2SV_ModStart> { p -> <S2SV_ModEnd> group_leader = current <S2SV_ModStart> } else { <S2SV_ModEnd> p -> group_leader <S2SV_ModStart> -> parent_exec_id ; if ( clone_flags & CLONE_THREAD ) p -> exit_signal = - 1 ; else p -> exit_signal = current -> group_leader -> exit_signal ; <S2SV_ModStart> -> self_exec_id ; p -> exit_signal = args -> exit_signal ;
Buggy code:
 static uint64_t calc_plane_error ( unsigned char * orig, int orig_stride, unsigned char * recon, int recon_stride, unsigned int cols, unsigned int rows ) { unsigned int row, col ; uint64_t total_sse = 0 ; int diff ; for ( row = 0 ; row + 16 <= rows ; row += 16 ) { for ( col = 0 ; col + 16 <= cols ; col += 16 ) { unsigned int sse ; <START_BUG> vp8_mse16x16 ( orig + col, orig_stride, <END_BUG> recon + col, recon_stride, & sse ) ; total_sse += sse ; } if ( col < cols ) { unsigned int border_row, border_col ; unsigned char * border_orig = orig ; unsigned char * border_recon = recon ; for ( border_row = 0 ; border_row < 16 ; border_row ++ ) { for ( border_col = col ; border_col < cols ; border_col ++ ) { diff = border_orig [ border_col ] - border_recon [ border_col ] ; total_sse += diff * diff ; } border_orig += orig_stride ; border_recon += recon_stride ; } } orig += orig_stride * 16 ; recon += recon_stride * 16 ; } for ( ; row < rows ; row ++ ) { for ( col = 0 ; col < cols ; col ++ ) { diff = orig [ col ] - recon [ col ] ; total_sse += diff * diff ; } orig += orig_stride ; recon += recon_stride ; } vp8_clear_system_state ( ) ; return total_sse ; }

Fix:
<S2SV_ModStart> int sse ; vpx_mse16x16 <S2SV_ModEnd> ( orig +
Buggy code:
 static int aa_read_header ( AVFormatContext * s ) { int i, j, idx, largest_idx = - 1 ; uint32_t nkey, nval, toc_size, npairs, header_seed = 0, start ; char key [ 128 ], val [ 128 ], codec_name [ 64 ] = { 0 } ; uint8_t output [ 24 ], dst [ 8 ], src [ 8 ] ; int64_t largest_size = - 1, current_size = - 1, chapter_pos ; struct toc_entry { uint32_t offset ; uint32_t size ; } TOC [ MAX_TOC_ENTRIES ] ; uint32_t header_key_part [ 4 ] ; uint8_t header_key [ 16 ] = { 0 } ; AADemuxContext * c = s -> priv_data ; AVIOContext * pb = s -> pb ; AVStream * st ; <START_BUG> avio_skip ( pb, 4 ) ; <END_BUG> avio_skip ( pb, 4 ) ; toc_size = avio_rb32 ( pb ) ; avio_skip ( pb, 4 ) ; if ( toc_size > MAX_TOC_ENTRIES ) return AVERROR_INVALIDDATA ; for ( i = 0 ; i < toc_size ; i ++ ) { avio_skip ( pb, 4 ) ; TOC [ i ]. offset = avio_rb32 ( pb ) ; TOC [ i ]. size = avio_rb32 ( pb ) ; } avio_skip ( pb, 24 ) ; npairs = avio_rb32 ( pb ) ; if ( npairs > MAX_DICTIONARY_ENTRIES ) return AVERROR_INVALIDDATA ; for ( i = 0 ; i < npairs ; i ++ ) { memset ( val, 0, sizeof ( val ) ) ; memset ( key, 0, sizeof ( key ) ) ; avio_skip ( pb, 1 ) ; nkey = avio_rb32 ( pb ) ; nval = avio_rb32 ( pb ) ; avio_get_str ( pb, nkey, key, sizeof ( key ) ) ; avio_get_str ( pb, nval,

Fix:
<S2SV_ModStart> * st ; int ret ; <S2SV_ModStart> val ) ; ret = <S2SV_ModStart> ] ) ; if ( ret!= 4 ) return AVERROR_INVALIDDATA ;
Buggy code:
 void fmtutil_macbitmap_read_pixmap_only_fields ( deark * c, dbuf * f, struct fmtutil_macbitmap_info * bi, i64 pos ) { i64 pixmap_version ; i64 pack_size ; i64 plane_bytes ; i64 n ; de_dbg ( c, "additional   PixMap   header   fields,   at   %d", ( int ) pos ) ; de_dbg_indent ( c, 1 ) ; pixmap_version = dbuf_getu16be ( f, pos + 0 ) ; de_dbg ( c, "pixmap   version:   %d", ( int ) pixmap_version ) ; bi -> packing_type = dbuf_getu16be ( f, pos + 2 ) ; de_dbg ( c, "packing   type:   %d", ( int ) bi -> packing_type ) ; pack_size = dbuf_getu32be ( f, pos + 4 ) ; de_dbg ( c, "pixel   data   length:   %d", ( int ) pack_size ) ; bi -> hdpi = pict_read_fixed ( f, pos + 8 ) ; bi -> vdpi = pict_read_fixed ( f, pos + 12 ) ; de_dbg ( c, "dpi:   %.2f" DE_CHAR_TIMES "%.2f", bi -> hdpi, bi -> vdpi ) ; bi -> pixeltype = dbuf_getu16be ( f, pos + 16 ) ; bi -> pixelsize = dbuf_getu16be ( f, pos + 18 ) ; bi -> cmpcount = dbuf_getu16be ( f, pos + 20 ) ; bi -> cmpsize = dbuf_getu16be ( f, pos + 22 ) ; de_dbg ( c, "pixel   type=%d,   bits//pixel=%d,   components//pixel=%d,   bits//comp=%d", ( int ) bi -> pixeltype, ( int ) bi -> pixelsize, ( int ) bi -> cmpcount, ( int ) bi -> cmpsize ) ; <START_BUG> bi -> pdwidth = ( bi -> rowbytes * 8 ) // bi -> pixelsize ; <END_BUG>  if (

Fix:
<S2SV_ModStart> cmpsize ) ; if ( bi -> pixelsize > 0 ) { <S2SV_ModStart> -> pixelsize ; }
Buggy code:
 static int ape_decode_frame ( AVCodecContext * avctx, void * data, int * got_frame_ptr, AVPacket * avpkt ) { AVFrame * frame = data ; const uint8_t * buf = avpkt -> data ; APEContext * s = avctx -> priv_data ; uint8_t * sample8 ; int16_t * sample16 ; int32_t * sample24 ; int i, ch, ret ; <START_BUG> int blockstodecode ; <END_BUG> av_assert0 ( s -> samples >= 0 ) ; if (! s -> samples ) { uint32_t nblocks, offset ; int buf_size ; if (! avpkt -> size ) { * got_frame_ptr = 0 ; return 0 ; } if ( avpkt -> size < 8 ) { av_log ( avctx, AV_LOG_ERROR, "Packet   is   too   small\\n" ) ; return AVERROR_INVALIDDATA ; } buf_size = avpkt -> size & ~ 3 ; if ( buf_size!= avpkt -> size ) { av_log ( avctx, AV_LOG_WARNING, "packet   size   is   not   a   multiple   of   4.   " "extra   bytes   at   the   end   will   be   skipped.\\n" ) ; } if ( s -> fileversion < 3950 ) buf_size += 2 ; av_fast_padded_malloc ( & s -> data, & s -> data_size, buf_size ) ; if (! s -> data ) return AVERROR ( ENOMEM ) ; s -> bdsp. bswap_buf ( ( uint32_t * ) s -> data, ( const uint32_t * ) buf, buf_size >> 2 ) ; memset ( s -> data + ( buf_size & ~ 3 ), 0, buf_size & 3 ) ; s -> ptr = s -> data ; s -> data_end = s -> data + buf_size ; nblocks = bytestream_get_be32 ( & s -> ptr ) ; offset = bytestream_get_be32 ( & s -> ptr ) ; if ( s -> fileversion >= 3900 ) { if ( offset > 3 ) { av_log ( avctx, AV_LOG_ERROR, "Incorrect  

Fix:
<S2SV_ModStart> ; int blockstodecode ; uint64_t decoded_buffer_size <S2SV_ModStart> nblocks > INT_MAX // 2 // sizeof ( * s -> decoded_buffer ) - 8 <S2SV_ModStart> -> samples ; decoded_buffer_size = 2LL * FFALIGN ( blockstodecode, 8 ) * sizeof ( * s -> decoded_buffer ) ; av_assert0 ( decoded_buffer_size <= INT_MAX ) ; <S2SV_ModStart> -> decoded_size, decoded_buffer_size <S2SV_ModEnd> ) ; if
Buggy code:
 int main ( ) { <START_BUG> gdImagePtr im ; <END_BUG> char * buffer ; size_t size ; size = read_test_file ( & buffer, "heap_overflow.tga" ) ; im = gdImageCreateFromTgaPtr ( size, ( void * ) buffer ) ; gdTestAssert ( im == NULL ) ; free ( buffer ) ; return gdNumFailures ( ) ; }

Fix:
<S2SV_ModStart> ( ) { check_file ( "heap_overflow_1.tga" ) ; check_file ( "heap_overflow_2.tga" <S2SV_ModEnd> ) ; return
Buggy code:
 static int pvc_getname ( struct socket * sock, struct sockaddr * sockaddr, int * sockaddr_len, int peer ) { struct sockaddr_atmpvc * addr ; struct atm_vcc * vcc = ATM_SD ( sock ) ; if (! vcc -> dev ||! test_bit ( ATM_VF_ADDR, & vcc -> flags ) ) return - ENOTCONN ; * sockaddr_len = sizeof ( struct sockaddr_atmpvc ) ; addr = ( struct sockaddr_atmpvc * ) sockaddr ; <START_BUG> addr -> sap_family = AF_ATMPVC ; <END_BUG> addr -> sap_addr. itf = vcc -> dev -> number ; addr -> sap_addr. vpi = vcc -> vpi ; addr -> sap_addr. vci = vcc -> vci ; return 0 ; }

Fix:
<S2SV_ModStart> ) sockaddr ; memset ( addr, 0, sizeof ( * addr ) ) ;
Buggy code:
 static cJSON * create_reference ( cJSON * item ) { <START_BUG> cJSON * ref ; <END_BUG>  if (! ( ref = cJSON_New_Item ( ) ) ) <START_BUG> return 0 ; memcpy ( ref, item, sizeof ( cJSON ) ) ; ref -> string = 0 ; ref -> type |= cJSON_IsReference ; ref -> next = ref -> prev = 0 ; return ref ; }<END_BUG>

Fix:
<S2SV_ModStart> { cJSON * <S2SV_ModEnd> ref = cJSON_New_Item <S2SV_ModStart> cJSON_New_Item ( ) ; if (! ref ) <S2SV_ModEnd> return 0 ;
Buggy code:
 int touch_file ( const char * path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode ) { _cleanup_close_ int fd ; int r ; assert ( path ) ; if ( parents ) mkdir_parents ( path, 0755 ) ; <START_BUG> fd = open ( path, O_WRONLY | O_CREAT | O_CLOEXEC | O_NOCTTY, mode > 0? mode : 0644 ) ; <END_BUG> if ( fd < 0 ) return - errno ; if ( mode!= MODE_INVALID ) { r = fchmod ( fd, mode ) ; if ( r < 0 ) return - errno ; } if ( uid!= UID_INVALID || gid!= GID_INVALID ) { r = fchown ( fd, uid, gid ) ; if ( r < 0 ) return - errno ; } if ( stamp!= USEC_INFINITY ) { struct timespec ts [ 2 ] ; timespec_store ( & ts [ 0 ], stamp ) ; ts [ 1 ] = ts [ 0 ] ; r = futimens ( fd, ts ) ; } else r = futimens ( fd, NULL ) ; if ( r < 0 ) return - errno ; return 0 ; }

Fix:
<S2SV_ModStart> | O_NOCTTY, ( mode == 0 || mode == MODE_INVALID )? 0644 : mode <S2SV_ModEnd> ) ; if
Buggy code:
 mod_ty Ta3AST_FromNodeObject ( const node * n, PyCompilerFlags * flags, PyObject * filename, int feature_version, PyArena * arena ) { int i, j, k, num ; asdl_seq * stmts = NULL ; asdl_seq * type_ignores = NULL ; stmt_ty s ; node * ch ; struct compiling c ; mod_ty res = NULL ; asdl_seq * argtypes = NULL ; expr_ty ret, arg ; c. c_arena = arena ; c. c_filename = filename ; c. c_normalize = NULL ; <START_BUG> c. c_normalize_args = NULL ; <END_BUG> c. c_feature_version = feature_version ; if ( TYPE ( n ) == encoding_decl ) n = CHILD ( n, 0 ) ; k = 0 ; switch ( TYPE ( n ) ) { case file_input : stmts = _Ta3_asdl_seq_new ( num_stmts ( n ), arena ) ; if (! stmts ) goto out ; for ( i = 0 ; i < NCH ( n ) - 1 ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == NEWLINE ) continue ; REQ ( ch, stmt ) ; num = num_stmts ( ch ) ; if ( num == 1 ) { s = ast_for_stmt ( & c, ch ) ; if (! s ) goto out ; asdl_seq_SET ( stmts, k ++, s ) ; } else { ch = CHILD ( ch, 0 ) ; REQ ( ch, simple_stmt ) ; for ( j = 0 ; j < num ; j ++ ) { s = ast_for_stmt ( & c, CHILD ( ch, j * 2 ) ) ; if (! s ) goto out ; asdl_seq_SET ( stmts, k ++, s ) ; } } } ch = CHILD ( n, NCH ( n ) - 1 ) ; REQ ( ch, ENDMARKER ) ; num = NCH ( ch ) ; type_ignores = _Ta3_asdl_seq_new ( num, arena ) ; if (! type_ignores ) goto out ; for ( i = 0 ; i < num ; i ++ ) { type_ignore_ty ti = Type

Fix:
<S2SV_ModStart> ; c. <S2SV_ModEnd> c_feature_version = feature_version <S2SV_ModStart> c_normalize ) ; <S2SV_ModEnd> } return res
Buggy code:
 static int decode_cblk ( Jpeg2000DecoderContext * s, Jpeg2000CodingStyle * codsty, Jpeg2000T1Context * t1, Jpeg2000Cblk * cblk, int width, int height, int bandpos ) { int passno = cblk -> npasses, pass_t = 2, bpno = cblk -> nonzerobits - 1, y ; int clnpass_cnt = 0 ; int bpass_csty_symbol = codsty -> cblk_style & JPEG2000_CBLK_BYPASS ; <START_BUG> int vert_causal_ctx_csty_symbol = codsty -> cblk_style & JPEG2000_CBLK_VSC ; <END_BUG> for ( y = 0 ; y < height ; y ++ ) memset ( t1 -> data [ y ], 0, width * sizeof ( * * t1 -> data ) ) ; if (! cblk -> length ) return 0 ; for ( y = 0 ; y < height + 2 ; y ++ ) memset ( t1 -> flags [ y ], 0, ( width + 2 ) * sizeof ( * * t1 -> flags ) ) ; cblk -> data [ cblk -> length ] = 0xff ; cblk -> data [ cblk -> length + 1 ] = 0xff ; ff_mqc_initdec ( & t1 -> mqc, cblk -> data ) ; while ( passno -- ) { switch ( pass_t ) { case 0 : decode_sigpass ( t1, width, height, bpno + 1, bandpos, bpass_csty_symbol && ( clnpass_cnt >= 4 ), vert_causal_ctx_csty_symbol ) ; break ; case 1 : decode_refpass ( t1, width, height, bpno + 1 ) ; if ( bpass_csty_symbol && clnpass_cnt >= 4 ) ff_mqc_initdec ( & t1 -> mqc, cblk -> data ) ; break ; case 2 : decode_clnpass ( s, t1, width, height, bpno + 1, bandpos, codsty -> cblk_style & JPEG2000_CBLK_SEGSYM, vert

Fix:
<S2SV_ModStart> cblk_style & JPEG2000_CBLK_VSC ; av_assert0 ( width <= JPEG2000_MAX_CBLKW ) ; av_assert0 ( height <= JPEG2000_MAX_CBLKH )
Buggy code:
 static int cdrom_ioctl_select_disc ( struct cdrom_device_info * cdi, unsigned long arg ) { cd_dbg ( CD_DO_IOCTL, "entering   CDROM_SELECT_DISC\\n" ) ; if (! CDROM_CAN ( CDC_SELECT_DISC ) ) return - ENOSYS ; if ( arg!= CDSL_CURRENT && arg!= CDSL_NONE ) { <START_BUG> if ( ( int ) arg >= cdi -> capacity ) <END_BUG> return - EINVAL ; } if ( cdi -> ops -> select_disc ) return cdi -> ops -> select_disc ( cdi, arg ) ; cd_dbg ( CD_CHANGER, "Using   generic   cdrom_select_disc()\\n" ) ; return cdrom_select_disc ( cdi, arg ) ; }

Fix:
<S2SV_ModStart> { if ( <S2SV_ModEnd> arg >= cdi
Buggy code:
 static int ape_read_header ( AVFormatContext * s, AVFormatParameters * ap ) { AVIOContext * pb = s -> pb ; APEContext * ape = s -> priv_data ; AVStream * st ; uint32_t tag ; int i ; int total_blocks ; int64_t pts ; ape -> junklength = 0 ; tag = avio_rl32 ( pb ) ; if ( tag!= MKTAG ( 'M', 'A', 'C',' ') ) return - 1 ; ape -> fileversion = avio_rl16 ( pb ) ; if ( ape -> fileversion < APE_MIN_VERSION || ape -> fileversion > APE_MAX_VERSION ) { av_log ( s, AV_LOG_ERROR, "Unsupported   file   version   -   %d.%02d\\n", ape -> fileversion // 1000, ( ape -> fileversion % 1000 ) // 10 ) ; return - 1 ; } if ( ape -> fileversion >= 3980 ) { ape -> padding1 = avio_rl16 ( pb ) ; ape -> descriptorlength = avio_rl32 ( pb ) ; ape -> headerlength = avio_rl32 ( pb ) ; ape -> seektablelength = avio_rl32 ( pb ) ; ape -> wavheaderlength = avio_rl32 ( pb ) ; ape -> audiodatalength = avio_rl32 ( pb ) ; ape -> audiodatalength_high = avio_rl32 ( pb ) ; ape -> wavtaillength = avio_rl32 ( pb ) ; avio_read ( pb, ape -> md5, 16 ) ; if ( ape -> descriptorlength > 52 ) avio_seek ( pb, ape -> descriptorlength - 52, SEEK_CUR ) ; ape -> compressiontype = avio_rl16 ( pb ) ; ape -> formatflags = avio_rl16 ( pb ) ; ape -> blocksperframe = avio_rl32 ( pb ) ; ape -> finalframeblocks = avio_rl32 ( pb ) ; ape -> totalframes = avio_rl32 ( pb ) ; ape

Fix:
<S2SV_ModStart> } if (! ape -> totalframes ) { av_log ( s, AV_LOG_ERROR, "No <S2SV_blank> frames <S2SV_blank> in <S2SV_blank> the <S2SV_blank> file!\\n" ) ; return AVERROR ( EINVAL ) ; } if (
Buggy code:
 static int oidc_handle_session_management_iframe_rp ( request_rec * r, oidc_cfg * c, oidc_session_t * session, const char * client_id, const char * check_session_iframe ) { oidc_debug ( r, "enter" ) ; const char * java_script = "         <script   type=\\"text//javascript\\">\\n" "             var   targetOrigin     =   \'%s\';\\n" "             var   message   =   \'%s\'   +   \'   \'   +   \'%s\';\\n" "\t       var   timerID;\\n" "\\n" "             function   checkSession()   {\\n" "                 console.debug(\'checkSession:   posting   \'   +   message   +   \'   to   \'   +   targetOrigin);\\n" "                 var   win   =   window.parent.document.getElementById(\'%s\').contentWindow;\\n" "                 win.postMessage(   message,   targetOrigin);\\n" "             }\\n" "\\n" "             function   setTimer()   {\\n" "                 checkSession();\\n" <START_BUG> "                 timerID   =   setInterval(\'checkSession()\',   %s);\\n" <END_BUG> "             }\\n" "\\n" "             function   receiveMessage(e)   {\\n" "                 console.debug(\'receiveMessage:   \'   +   e.data   +   \'   from   \'   +   e.origin);\\n" "                 if   (e.origin  !==   targetOrigin   )   {\\n" "                     console.debug(\'receiveMessage:   cross-site   scripting   attack?\');\\n" "                     return

Fix:
<S2SV_ModStart> "\\n" " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> function <S2SV_blank> setTimer() <S2SV_blank> {\\n" " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> checkSession();\\n" " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> timerID <S2SV_blank> = <S2SV_blank> setInterval(\'checkSession()\', <S2SV_blank> %d);\\n" <S2SV_ModEnd> " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> }\\n" "\\n" " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> function <S2SV_blank> receiveMessage(e) <S2SV_blank> {\\n" <S2SV_ModStart> s_poll_interval ) ; int poll_interval = s_poll_interval? strtol ( s_poll_interval, NULL, 10 ) : 0 ; if ( ( poll_interval <= 0 ) || ( poll_interval > 3600 * 24 ) ) poll_interval = 3000 <S2SV_ModEnd> ; const char <S2SV_ModStart>, op_iframe_id, poll_interval <S2SV_ModEnd>, redirect_uri,
Buggy code:
 static int key_notify_sa_flush ( const struct km_event * c ) { struct sk_buff * skb ; struct sadb_msg * hdr ; skb = alloc_skb ( sizeof ( struct sadb_msg ) + 16, GFP_ATOMIC ) ; if (! skb ) return - ENOBUFS ; hdr = ( struct sadb_msg * ) skb_put ( skb, sizeof ( struct sadb_msg ) ) ; hdr -> sadb_msg_satype = pfkey_proto2satype ( c -> data. proto ) ; hdr -> sadb_msg_type = SADB_FLUSH ; hdr -> sadb_msg_seq = c -> seq ; hdr -> sadb_msg_pid = c -> portid ; hdr -> sadb_msg_version = PF_KEY_V2 ; hdr -> sadb_msg_errno = ( uint8_t ) 0 ; hdr -> sadb_msg_len = ( sizeof ( struct sadb_msg ) // sizeof ( uint64_t ) ) ; <START_BUG> pfkey_broadcast ( skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c -> net ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; hdr -> sadb_msg_reserved = 0 ;
Buggy code:
 static int set_core_reg ( struct kvm_vcpu * vcpu, const struct kvm_one_reg * reg ) { __u32 __user * uaddr = ( __u32 __user * ) ( unsigned long ) reg -> addr ; struct kvm_regs * regs = vcpu_gp_regs ( vcpu ) ; int nr_regs = sizeof ( * regs ) // sizeof ( __u32 ) ; __uint128_t tmp ; void * valp = & tmp ; u64 off ; int err = 0 ; off = core_reg_offset_from_id ( reg -> id ) ; if ( off >= nr_regs || ( off + ( KVM_REG_SIZE ( reg -> id ) // sizeof ( __u32 ) ) ) >= nr_regs ) return - ENOENT ; if ( validate_core_offset ( reg ) ) return - EINVAL ; if ( KVM_REG_SIZE ( reg -> id ) > sizeof ( tmp ) ) return - EINVAL ; if ( copy_from_user ( valp, uaddr, KVM_REG_SIZE ( reg -> id ) ) ) { err = - EFAULT ; goto out ; } if ( off == KVM_REG_ARM_CORE_REG ( regs. pstate ) ) { <START_BUG> u32 mode = ( * ( u32 * ) valp ) & PSR_AA32_MODE_MASK ; <END_BUG> switch ( mode ) { case PSR_AA32_MODE_USR :  case PSR_AA32_MODE_FIQ : <START_BUG> case PSR_AA32_MODE_IRQ : case PSR_AA32_MODE_SVC : case PSR_AA32_MODE_ABT : case PSR_AA32_MODE_UND : <END_BUG> case PSR_MODE_EL0t :  case PSR_MODE_EL1t : <START_BUG> case PSR_MODE_EL1h : <END_BUG> break ; default : err = - EINVAL ; goto out ; } } memcpy ( ( u32 * ) regs + off, valp, KVM_REG_SIZE ( reg -> id ) ) ; out : return err ; }

Fix:
<S2SV_ModStart> ) ) { u64 <S2SV_ModEnd> mode = ( <S2SV_ModStart> ( * ( u64 <S2SV_ModEnd> * ) valp <S2SV_ModStart> case PSR_AA32_MODE_USR : if (! system_supports_32bit_el0 ( ) ) return - EINVAL ; break ; <S2SV_ModStart> case PSR_AA32_MODE_UND : if (! vcpu_el1_is_32bit ( vcpu ) ) return - EINVAL ; break ; <S2SV_ModStart> case PSR_MODE_EL1h : if ( vcpu_el1_is_32bit ( vcpu ) ) return - EINVAL ;
Buggy code:
 int sanity_check_ckpt ( struct f2fs_sb_info * sbi ) { unsigned int total, fsmeta ; struct f2fs_super_block * raw_super = F2FS_RAW_SUPER ( sbi ) ; struct f2fs_checkpoint * ckpt = F2FS_CKPT ( sbi ) ; unsigned int ovp_segments, reserved_segments ; <START_BUG> total = le32_to_cpu ( raw_super -> segment_count ) ; <END_BUG> fsmeta = le32_to_cpu ( raw_super -> segment_count_ckpt ) ; fsmeta += le32_to_cpu ( raw_super -> segment_count_sit ) ; fsmeta += le32_to_cpu ( raw_super -> segment_count_nat ) ; fsmeta += le32_to_cpu ( ckpt -> rsvd_segment_count ) ; fsmeta += le32_to_cpu ( raw_super -> segment_count_ssa ) ; if ( unlikely ( fsmeta >= total ) ) return 1 ; ovp_segments = le32_to_cpu ( ckpt -> overprov_segment_count ) ; reserved_segments = le32_to_cpu ( ckpt -> rsvd_segment_count ) ; if ( unlikely ( fsmeta < F2FS_MIN_SEGMENTS || ovp_segments == 0 || reserved_segments == 0 ) ) { f2fs_msg ( sbi -> sb, KERN_ERR, "Wrong   layout:   check   mkfs.f2fs   version" ) ; return 1 ; }  if ( unlikely ( f2fs_cp_error ( sbi ) ) ) { <START_BUG> f2fs_msg ( sbi -> sb, KERN_ERR, "A   bug   case:   need   to   run   fsck" ) ; return 1 ; } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart>, reserved_segments ; unsigned int main_segs, blocks_per_seg ; int i ; <S2SV_ModStart> 1 ; } main_segs = le32_to_cpu ( raw_super -> segment_count_main ) ; blocks_per_seg = sbi -> blocks_per_seg ; for ( i = 0 ; i < NR_CURSEG_NODE_TYPE ; i ++ ) { if ( le32_to_cpu ( ckpt -> cur_node_segno [ i ] ) >= main_segs || le16_to_cpu ( ckpt -> cur_node_blkoff [ i ] ) >= blocks_per_seg ) return 1 ; } for ( i = 0 ; i < NR_CURSEG_DATA_TYPE ; i ++ ) { if ( le32_to_cpu ( ckpt -> cur_data_segno [ i ] ) >= main_segs || le16_to_cpu ( ckpt -> cur_data_blkoff [ i ] ) >= blocks_per_seg ) return 1 ; }
Buggy code:
 GPLOT * gplotCreate ( const char * rootname, l_int32 outformat, const char * title, const char * xlabel, const char * ylabel ) { char * newroot ; <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> l_int32 badchar ; GPLOT * gplot ; PROCNAME ( "gplotCreate" ) ; if (! rootname ) return ( GPLOT * ) ERROR_PTR ( "rootname   not   defined", procName, NULL ) ; if ( outformat!= GPLOT_PNG && outformat!= GPLOT_PS && outformat!= GPLOT_EPS && outformat!= GPLOT_LATEX ) return ( GPLOT * ) ERROR_PTR ( "outformat   invalid", procName, NULL ) ; stringCheckForChars ( rootname, "`;&|><\\"?*", & badchar ) ; if ( badchar ) return ( GPLOT * ) ERROR_PTR ( "invalid   rootname", procName, NULL ) ; if ( ( gplot = ( GPLOT * ) LEPT_CALLOC ( 1, sizeof ( GPLOT ) ) ) == NULL ) return ( GPLOT * ) ERROR_PTR ( "gplot   not   made", procName, NULL ) ; gplot -> cmddata = sarrayCreate ( 0 ) ; gplot -> datanames = sarrayCreate ( 0 ) ; gplot -> plotdata = sarrayCreate ( 0 ) ; gplot -> plottitles = sarrayCreate ( 0 ) ; gplot -> plotstyles = numaCreate ( 0 ) ; newroot = genPathname ( rootname, NULL ) ; gplot -> rootname = newroot ; gplot -> outformat = outformat ;  snprintf ( buf, L_BUF_SIZE, "%s.cmd", rootname ) ; <START_BUG> gplot -> cmdname = stringNew ( buf ) ; if ( outformat == GPLOT_PNG ) <END_BUG> snprintf ( buf, L_BUF_SIZE, "%s.png", newroot ) ;  else if ( outformat == GPLOT_PS ) <START_BUG> snprintf ( buf, L_BUF_SIZE, "%s.ps", newroot ) ; <END_BUG> else if ( outformat == GPLOT_EPS )

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; l_int32 <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.cmd", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.png", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.ps", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.eps", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "%s.tex",
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_hdr ( dec_state_t * ps_dec ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; UWORD16 u2_height ; UWORD16 u2_width ; if ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN )!= SEQUENCE_HEADER_CODE ) { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; return IMPEG2D_FRM_HDR_START_CODE_NOT_FOUND ; } impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; u2_width = impeg2d_bit_stream_get ( ps_stream, 12 ) ; u2_height = impeg2d_bit_stream_get ( ps_stream, 12 ) ; if ( ( u2_width!= ps_dec -> u2_horizontal_size ) || ( u2_height!= ps_dec -> u2_vertical_size ) ) { if ( 0 == ps_dec -> u2_header_done ) { ps_dec -> u2_horizontal_size = u2_width ; ps_dec -> u2_vertical_size = u2_height ; if ( 0 == ps_dec -> u4_frm_buf_stride ) { ps_dec -> u4_frm_buf_stride = ( UWORD32 ) ALIGN16 ( u2_width ) ; } } else { if ( ( u2_width > ps_dec -> u2_create_max_width ) || ( u2_height > ps_dec -> u2_create_max_height ) ) { IMPEG2D_ERROR_CODES_T e_error = IMPEG2D_UNSUPPORTED_DIMENSIONS ; ps_dec -> u2_reinit_max_height = u2_height ; ps_dec -> u2_reinit_max_width = u2_width ; return e_error ; } else { return ( IMPEG2D_ERROR_CODES_T ) IVD_RES_CHANGED ; } } } if ( ( ps_dec -> u2_horizontal_size >

Fix:
<S2SV_ModStart> 4 ) ; if ( ps_dec -> u2_frame_rate_code > MPEG2_MAX_FRAME_RATE_CODE ) { return IMPEG2D_FRM_HDR_DECODE_ERR ; }
Buggy code:
 static const char * parse_number ( cJSON * item, const char * num ) { <START_BUG> int64_t i = 0 ; <END_BUG> double f = 0 ;  int isint = 1 ; <START_BUG> int sign = 1, scale = 0, subscale = 0, signsubscale = 1 ; if ( * num == '-' ) { sign = - 1 ; ++ num ; } if ( * num == '0' ) ++ num ; if ( * num >= '1' && * num <= '9' ) { do { i = ( i * 10 ) + ( * num - '0' ) ; <END_BUG> f = ( f * 10.0 ) + ( * num - '0' ) ;  ++ num ; } while ( * num >= '0' && * num <= '9' ) ; } if ( * num == '.' && num [ 1 ] >= '0' && num [ 1 ] <= '9' ) { isint = 0 ; ++ num ; do { f = ( f * 10.0 ) + ( * num ++ - '0' ) ; scale -- ; <START_BUG> } while ( * num >= '0' && * num <= '9' ) ; <END_BUG> } if ( * num == 'e' || * num == 'E' ) {  isint = 0 ; <START_BUG> ++ num ; if ( * num == '+' ) <END_BUG> ++ num ;  <START_BUG> else if ( * num == '-' ) { <END_BUG>  signsubscale = - 1 ; <START_BUG> ++ num ; } while ( * num >= '0' && * num <= '9' ) subscale = ( subscale * 10 ) + ( * num ++ - '0' ) ; } if ( isint ) { <END_BUG> i = sign * i ;  <START_BUG> item -> valueint = i ; <END_BUG> item -> valuefloat = i ; } else { f = sign * f * ipow ( 10.0, scale + subscale * signsubscale ) ; item -> valueint = f ; item -> valuefloat = f ; } item -> type = cJSON_Number ; return num ; }

Fix:
<S2SV_ModStart> num ) { double n = 0, sign = 1, scale <S2SV_ModEnd> = 0 ; <S2SV_ModStart> 0 ; int subscale = 0, signsubscale = 1 ; if ( * num == '-' ) sign = - 1, num ++ ; if ( * num == '0' ) num ++ ; if ( * num >= '1' && * num <= '9' ) do n = ( n * 10.0 ) + ( * num ++ - '0' ) ; while ( * num >= '0' && * num <= '9' ) ; if ( * num == '.' && num [ 1 ] >= '0' && num [ 1 ] <= '9' ) { num ++ ; do n = ( n <S2SV_ModEnd> * 10.0 ) <S2SV_ModStart> ( * num ++ - '0' ), <S2SV_ModEnd> scale -- ; <S2SV_ModStart> scale -- ; <S2SV_ModEnd> while ( * <S2SV_ModStart> 'E' ) { num ++ ; <S2SV_ModEnd> if ( * <S2SV_ModStart> == '+' ) num ++ ; <S2SV_ModEnd> else if ( <S2SV_ModStart> == '-' ) <S2SV_ModEnd> signsubscale = - <S2SV_ModStart> = - 1, num ++ ; while ( * num >= '0' && * num <= '9' ) subscale = ( subscale * 10 ) + ( * num ++ - '0' )
Buggy code:
 <START_BUG> void <END_BUG> byteSwap ( UWORD32 * buf, unsigned words ) { md5byte * p ; int i = 1 ; if ( * ( char * ) & i == 1 ) return ; p = ( md5byte * ) buf ; do { * buf ++ = ( UWORD32 ) ( ( unsigned ) p [ 3 ] << 8 | p [ 2 ] ) << 16 | ( ( unsigned ) p [ 1 ] << 8 | p [ 0 ] ) ; p += 4 ; } while ( -- words ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 void btif_config_flush ( void ) { assert ( config!= NULL ) ; assert ( alarm_timer!= NULL ) ; alarm_cancel ( alarm_timer ) ; <START_BUG> pthread_mutex_lock ( & lock ) ; <END_BUG> config_save ( config, CONFIG_FILE_PATH ) ; pthread_mutex_unlock ( & lock ) ; }

Fix:
<S2SV_ModStart> alarm_timer ) ; btif_config_write ( <S2SV_ModEnd> ) ; }
Buggy code:
 static void r_bin_dwarf_dump_debug_info ( FILE * f, const RBinDwarfDebugInfo * inf ) { size_t i, j, k ; RBinDwarfDIE * dies ; RBinDwarfAttrValue * values ; if (! inf ||! f ) { return ; } for ( i = 0 ; i < inf -> length ; i ++ ) { fprintf ( f, "     Compilation   Unit   @   offset   0x%" PFMT64x ":\\n", inf -> comp_units [ i ]. offset ) ; fprintf ( f, "       Length:                 0x%x\\n", inf -> comp_units [ i ]. hdr. length ) ; fprintf ( f, "       Version:               %d\\n", inf -> comp_units [ i ]. hdr. version ) ; fprintf ( f, "       Abbrev   Offset:   0x%x\\n", inf -> comp_units [ i ]. hdr. abbrev_offset ) ; fprintf ( f, "       Pointer   Size:     %d\\n", inf -> comp_units [ i ]. hdr. pointer_size ) ; dies = inf -> comp_units [ i ]. dies ; for ( j = 0 ; j < inf -> comp_units [ i ]. length ; j ++ ) { fprintf ( f, "         Abbrev   Number:   %" PFMT64u "   ", dies [ j ]. abbrev_code ) ; if ( dies [ j ]. tag && dies [ j ]. tag <= DW_TAG_volatile_type && dwarf_tag_name_encodings [ dies [ j ]. tag ] ) { fprintf ( f, "(%s)\\n", dwarf_tag_name_encodings [ dies [ j ]. tag ] ) ; } else { fprintf ( f, "(Unknown   abbrev   tag)\\n" ) ; } if (! dies [ j ]. abbrev_code ) { continue ; } values = dies [ j ]. attr_values ; for ( k = 0 ; k < dies [ j ]. length ; k

Fix:
<S2SV_ModStart>. name ) { continue ; } <S2SV_ModEnd> if ( values
Buggy code:
 static void Process_ipfix_template_withdraw ( exporter_ipfix_domain_t * exporter, void * DataPtr, uint32_t size_left, FlowSource_t * fs ) { ipfix_template_record_t * ipfix_template_record ; while ( size_left ) { <START_BUG> uint32_t id ; <END_BUG> ipfix_template_record = ( ipfix_template_record_t * ) DataPtr ; size_left -= 4 ; id = ntohs ( ipfix_template_record -> TemplateID ) ; if ( id == IPFIX_TEMPLATE_FLOWSET_ID ) { remove_all_translation_tables ( exporter ) ; ReInitExtensionMapList ( fs ) ; } else { remove_translation_table ( fs, exporter, id ) ; } DataPtr = DataPtr + 4 ; if ( size_left < 4 ) { dbg_printf ( "Skip   %u   bytes   padding\\n", size_left ) ; size_left = 0 ; } } }

Fix:
<S2SV_ModStart> uint32_t id ; if ( size_left < 4 ) { LogError ( "Process_ipfix <S2SV_blank> [%u] <S2SV_blank> Template <S2SV_blank> withdraw <S2SV_blank> size <S2SV_blank> error <S2SV_blank> at <S2SV_blank> %s <S2SV_blank> line <S2SV_blank> %u", exporter -> info. id, __FILE__, __LINE__, strerror ( errno ) ) ; size_left = 0 ; continue ; }
Buggy code:
 static void seamless_process ( STREAM s ) { unsigned int pkglen ; <START_BUG> char * buf ; <END_BUG> pkglen = s -> end - s -> p ; buf = xmalloc ( pkglen + 1 ) ; STRNCPY ( buf, ( char * ) s -> p, pkglen + 1 ) ; str_handle_lines ( buf, & seamless_rest, seamless_line_handler, NULL ) ; xfree ( buf ) ; }

Fix:
<S2SV_ModStart> * buf ; struct stream packet = * s ; if (! s_check ( s ) ) { rdp_protocol_error ( "seamless_process(), <S2SV_blank> stream <S2SV_blank> is <S2SV_blank> in <S2SV_blank> unstable <S2SV_blank> state", & packet ) ; }
Buggy code:
 krb5_error_code kdc_process_s4u2self_req ( kdc_realm_t * kdc_active_realm, krb5_kdc_req * request, krb5_const_principal client_princ, krb5_const_principal header_srv_princ, krb5_boolean issuing_referral, const krb5_db_entry * server, krb5_keyblock * tgs_subkey, krb5_keyblock * tgs_session, krb5_timestamp kdc_time, krb5_pa_s4u_x509_user * * s4u_x509_user, krb5_db_entry * * princ_ptr, const char * * status ) { krb5_error_code code ; krb5_boolean is_local_tgt ; krb5_pa_data * pa_data ; int flags ; krb5_db_entry * princ ; * princ_ptr = NULL ; pa_data = krb5int_find_pa_data ( kdc_context, request -> padata, KRB5_PADATA_S4U_X509_USER ) ; if ( pa_data!= NULL ) { code = kdc_process_s4u_x509_user ( kdc_context, request, pa_data, tgs_subkey, tgs_session, s4u_x509_user, status ) ; if ( code!= 0 ) return code ; } else { pa_data = krb5int_find_pa_data ( kdc_context, request -> padata, KRB5_PADATA_FOR_USER ) ; if ( pa_data!= NULL ) { code = kdc_process_for_user ( kdc_active_realm, pa_data, tgs_session, s4u_x509_user, status ) ; if ( code!= 0 ) return code ; } else return 0 ; } flags = 0 ; switch ( krb5_princ_type ( kdc_context, request -> server ) ) { case KRB5_NT_SRV_HST : if ( krb5_princ_size ( kdc_context, request -> server ) == 2 ) flags |=

Fix:
<S2SV_ModStart> ) ) ; princ -> pw_expiration = 0 ; clear ( princ -> attributes, KRB5_KDB_REQUIRES_PWCHANGE ) ;
Buggy code:
 error_t httpClientFormatAuthorizationField ( HttpClientContext * context ) { size_t n ; char_t * p ; HttpClientAuthParams * authParams ; if ( context -> bufferLen < 2 || context -> bufferLen > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_INVALID_SYNTAX ; authParams = & context -> authParams ; # if ( HTTP_CLIENT_BASIC_AUTH_SUPPORT == ENABLED ) if ( authParams -> mode == HTTP_AUTH_MODE_BASIC ) { size_t k ; size_t m ; n = osStrlen ( authParams -> username ) + osStrlen ( authParams -> password ) ; if ( ( context -> bufferLen + n + 22 ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; p = context -> buffer + context -> bufferLen - 2 ; n = osSprintf ( p, "Authorization:   Basic   " ) ; m = osSprintf ( p + n, "%s:%s", authParams -> username, authParams -> password ) ; base64Encode ( p + n, m, NULL, & k ) ; if ( ( context -> bufferLen + n + k ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; base64Encode ( p + n, m, p + n, & k ) ; n += k ; if ( ( context -> bufferLen + n + 2 ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; osSprintf ( p + n, "\\r\\n\\r\\n" ) ; context -> bufferLen = context -> bufferLen + n + 2 ; } else # endif # if ( HTTP_CLIENT_DIGEST_AUTH_SUPPORT == ENABLED ) if ( authParams -> mode == HTTP_AUTH_MODE_DIGEST ) { error_t error ; const char_t * q ; const char_t * uri ; size_t uriLen ; char_t response [ HTTP_CLIENT_MAX_RESPONSE_LEN + 1 ] ; context -> buffer [ context -> bufferLen ] = '\\0' ; <START_BUG> q = strchr ( context -> buffer,' ') ; <END_BUG> if ( q == NULL ) return ERROR_INVALID_SYNTAX ; uri = q + 1 ;  q = strchr ( uri,' ') ; <START_BUG> if ( q == NULL ) return ERROR_INVALID_<END_BUG>

Fix:
<S2SV_ModStart> ; q = osStrchr <S2SV_ModEnd> ( context -> <S2SV_ModStart> ; q = osStrchr <S2SV_ModEnd> ( uri,
Buggy code:
 char * gf_text_get_utf8_line ( char * szLine, u32 lineSize, FILE * txt_in, s32 unicode_type ) { u32 i, j, len ; char * sOK ; char szLineConv [ 1024 ] ; unsigned short * sptr ; memset ( szLine, 0, sizeof ( char ) * lineSize ) ; sOK = fgets ( szLine, lineSize, txt_in ) ; if (! sOK ) return NULL ; if ( unicode_type <= 1 ) { j = 0 ; len = ( u32 ) strlen ( szLine ) ; <START_BUG> for ( i = 0 ; i < len ; i ++ ) { <END_BUG> if (! unicode_type && ( szLine [ i ] & 0x80 ) ) { if ( ( szLine [ i + 1 ] & 0xc0 )!= 0x80 ) {  szLineConv [ j ] = 0xc0 | ( ( szLine [ i ] >> 6 ) & 0x3 ) ; <START_BUG> j ++ ; szLine [ i ] &= 0xbf ; } <END_BUG> else if ( ( szLine [ i ] & 0xe0 ) == 0xc0 ) {  <START_BUG> szLineConv [ j ] = szLine [ i ] ; <END_BUG> i ++ ; j ++ ; } else if ( ( szLine [ i ] & 0xf0 ) == 0xe0 ) {  szLineConv [ j ] = szLine [ i ] ; <START_BUG> i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else if ( ( szLine [ i ] & 0xf8 ) == 0xf0 ) { <END_BUG> szLineConv [ j ] = szLine [ i ] ;  i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else { i += 1 ; continue ; } } <START_BUG> szLineConv [ j ] = szLine [ i ] ; <END_BUG> j ++ ; } szLineConv [ j ] = 0 ; strcpy ( szLine, szLineConv ) ; return sOK ; } # ifdef GPAC_BIG_ENDIAN if ( unicode_type == 3 ) { # else if ( unicode_type == 2 ) { # endif i = 0 ;

Fix:
<S2SV_ModStart> i < len && j < sizeof ( szLineConv ) - 1 ; i ++, j <S2SV_ModEnd> ++ ) { <S2SV_ModStart> 0x80 ) { if ( j + 1 < sizeof ( szLineConv ) - 1 ) { <S2SV_ModStart> ; } else break ; } else <S2SV_ModStart> 0xc0 ) { if ( j + 1 < sizeof ( szLineConv ) - 1 && i + 1 < len ) { szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else { break ; } <S2SV_ModEnd> } else if <S2SV_ModStart> 0xe0 ) { if ( j + 2 < sizeof ( szLineConv ) - 1 && i + 2 < len ) { szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else { break ; } <S2SV_ModEnd> } else if <S2SV_ModStart> 0xf0 ) { if ( j + 3 < sizeof ( szLineConv ) - 1 && i + 3 < len ) { szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; sz
Buggy code:
 static int pimv2_addr_print ( netdissect_options * ndo, <START_BUG> const u_char * bp, enum pimv2_addrtype at, int silent ) <END_BUG> { int af ;  int len, hdrlen ; <START_BUG> <END_BUG> ND_TCHECK ( bp [ 0 ] ) ;  if ( pimv2_addr_len == 0 ) { ND_TCHECK ( bp [ 1 ] ) ; switch ( bp [ 0 ] ) { case 1 : af = AF_INET ; <START_BUG> len = sizeof ( struct in_addr ) ; <END_BUG> break ; case 2 : af = AF_INET6 ;  len = sizeof ( struct in6_addr ) ; <START_BUG> break ; default : return - 1 ; } if ( bp [ 1 ]!= 0 ) return - 1 ; hdrlen = 2 ; } else { <END_BUG> switch ( pimv2_addr_len ) {  case sizeof ( struct in_addr ) : af = AF_INET ; break ; case sizeof ( struct in6_addr ) : af = AF_INET6 ; break ; default : return - 1 ; break ; } <START_BUG> len = pimv2_addr_len ; <END_BUG> hdrlen = 0 ; } bp += hdrlen ;  switch ( at ) { <START_BUG> case pimv2_unicast : <END_BUG> ND_TCHECK2 ( bp [ 0 ], len ) ;  if ( af == AF_INET ) { if (! silent ) ND_PRINT ( ( ndo, "%s", ipaddr_string ( ndo, bp ) ) ) ; } else if ( af == AF_INET6 ) { if (! silent ) ND_PRINT ( ( ndo, "%s", ip6addr_string ( ndo, bp ) ) ) ; } <START_BUG> return hdrlen + len ; <END_BUG> case pimv2_group : case pimv2_source :  ND_TCHECK2 ( bp [ 0 ], len + 2 ) ; <START_BUG> if ( af == AF_INET ) { if (! silent ) { ND_PRINT ( ( ndo, "%s", ipaddr_string ( ndo, bp + 2 ) ) ) ; if ( bp [ 1 ]!= 32 ) ND_PRINT ( ( ndo, "//%u", bp [ 1 ] ) ) ; } } else if ( af == AF_<END_BUG>

Fix:
<S2SV_ModStart> * bp, u_int len, <S2SV_ModStart> pimv2_addrtype at, u_int addr_len, <S2SV_ModStart> af ; int hdrlen ; if ( addr_len == 0 ) { if ( len < 2 ) goto trunc <S2SV_ModEnd> ; ND_TCHECK ( <S2SV_ModStart> ( bp [ <S2SV_ModEnd> 1 ] ) <S2SV_ModStart> = AF_INET ; addr_len = ( u_int ) <S2SV_ModEnd> sizeof ( struct <S2SV_ModStart> = AF_INET6 ; addr_len = ( u_int ) <S2SV_ModEnd> sizeof ( struct <S2SV_ModStart> { switch ( addr_len <S2SV_ModEnd> ) { case <S2SV_ModStart> break ; } <S2SV_ModEnd> hdrlen = 0 <S2SV_ModStart> += hdrlen ; len -= hdrlen ; <S2SV_ModStart> case pimv2_unicast : if ( len < addr_len ) goto trunc ; <S2SV_ModStart> 0 ], addr_len <S2SV_ModEnd> ) ; if <S2SV_ModStart> return hdrlen + addr_len <S2SV_ModEnd> ; case pimv2_group <S2SV_ModStart> case pimv2_source : if ( len < addr_len + 2 ) goto trunc ; <S2SV_ModStart> 0 ], addr_len <S2SV_ModEnd> + 2 ) <S2SV_ModStart> + 2 + addr_len <S2SV_ModEnd> ; default :
Buggy code:
 static int iucv_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { int noblock = flags & MSG_DONTWAIT ; struct sock * sk = sock -> sk ; struct iucv_sock * iucv = iucv_sk ( sk ) ; unsigned int copied, rlen ; struct sk_buff * skb, * rskb, * cskb ; int err = 0 ; <START_BUG> u32 offset ; <END_BUG> msg -> msg_namelen = 0 ; if ( ( sk -> sk_state == IUCV_DISCONN ) && skb_queue_empty ( & iucv -> backlog_skb_q ) && skb_queue_empty ( & sk -> sk_receive_queue ) && list_empty ( & iucv -> message_q. list ) ) return 0 ; if ( flags & ( MSG_OOB ) ) return - EOPNOTSUPP ; skb = skb_recv_datagram ( sk, flags, noblock, & err ) ; if (! skb ) { if ( sk -> sk_shutdown & RCV_SHUTDOWN ) return 0 ; return err ; } offset = IUCV_SKB_CB ( skb ) -> offset ; rlen = skb -> len - offset ; copied = min_t ( unsigned int, rlen, len ) ; if (! rlen ) sk -> sk_shutdown = sk -> sk_shutdown | RCV_SHUTDOWN ; cskb = skb ; if ( skb_copy_datagram_iovec ( cskb, offset, msg -> msg_iov, copied ) ) { if (! ( flags & MSG_PEEK ) ) skb_queue_head ( & sk -> sk_receive_queue, skb ) ; return - EFAULT ; } if ( sk -> sk_type == SOCK_SEQPACKET ) { if ( copied < rlen ) msg -> msg_flags |= MSG_TRUNC ; msg -> msg_flags |= MSG_EOR ; } err = put_cmsg ( msg, SOL_IUCV, SCM_IUCV_TRGCLS, sizeof ( IUCV_SKB_CB ( skb ) -> class ), ( void * ) & I

Fix:
<S2SV_ModStart> ; u32 offset <S2SV_ModEnd> ; if (
Buggy code:
 gprinc_ret * get_principal_2_svc ( gprinc_arg * arg, struct svc_req * rqstp ) { static gprinc_ret ret ; char * prime_arg, * funcname ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_gprinc_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; funcname = "kadm5_get_principal" ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if (! cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) && ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_INQUIRE, arg -> princ, NULL ) ) ) { ret. code = KADM5_AUTH_GET ; log_unauth ( funcname, prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_get_principal ( handle, arg -> princ, & ret. rec, arg -> mask ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( funcname, prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 void test_re ( ) { assert_true_rule ( "rule   test   {   strings:   $a   =   //ssi//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //ssi(s|p)//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //ssim*//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //ssa?//   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //Miss//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //(M|N)iss//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //[M-N]iss//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississippi" ) ; assert_true_rule ( "rule   test   {   strings:   $a   =   //(Mi|ssi)ssippi//   nocase   condition:   $a   }", "mississippi\\tmississippi.mississippi\\nmississ

Fix:
<S2SV_ModStart> "a\\0x\\0x\\0b\\0" ) ; assert_true_rule_blob ( "rule <S2SV_blank> test <S2SV_blank> { <S2SV_blank> strings: <S2SV_blank> $a <S2SV_blank> = <S2SV_blank> //\\\\babc// <S2SV_blank> wide <S2SV_blank> condition: <S2SV_blank> $a <S2SV_blank> }", "a\\0b\\0c\\0" ) ; assert_true_rule_blob ( "rule <S2SV_blank> test <S2SV_blank> { <S2SV_blank> strings: <S2SV_blank> $a <S2SV_blank> = <S2SV_blank> //\\\\babc// <S2SV_blank> wide <S2SV_blank> condition: <S2SV_blank> $a <S2SV_blank> }", "\\0a\\0b\\0c\\0" ) ; assert_true_rule_blob ( "rule <S2SV_blank> test <S2SV_blank> { <S2SV_blank> strings: <S2SV_blank> $a <S2SV_blank> = <S2SV_blank> //\\\\babc// <S2SV_blank> wide <S2SV_blank> condition: <S2SV_blank> $a <S2SV_blank> }", "\\ta\\0b\\0c\\0" ) ; assert_false_rule_blob ( "rule <S2SV_blank> test <S2SV_blank> { <S2SV_blank> strings: <S2SV_blank> $a <S2SV_blank> = <S2SV_blank> //\\\\babc// <S2SV_blank> wide <S2SV_blank> condition: <S2SV_blank> $a <S2SV_blank> }", "x\\0a\\0b\\0c\\0" ) ; assert_true_rule_blob ( "rule <S2SV_blank> test <S2SV_blank> { <S2SV_blank> strings: <S2SV_blank> $a <S2SV_blank> = <S2SV_blank> //\\\\
Buggy code:
 int vfs_open ( const struct path * path, struct file * file, const struct cred * cred ) { <START_BUG> struct dentry * dentry = path -> dentry ; <END_BUG>  struct inode * inode = dentry -> d_inode ; <START_BUG> file -> f_path = * path ; if ( dentry -> d_flags & DCACHE_OP_SELECT_INODE ) { inode = dentry -> d_op -> d_select_inode ( dentry, file -> f_flags ) ; if ( IS_ERR ( inode ) ) return PTR_ERR ( inode ) ; <END_BUG> }  return do_dentry_open ( file, inode, NULL, cred ) ; }

Fix:
<S2SV_ModStart> ) { struct <S2SV_ModEnd> inode * inode <S2SV_ModStart> * inode = vfs_select_inode ( path -> <S2SV_ModEnd> dentry, file <S2SV_ModStart> inode ) ; file -> f_path = * path ; <S2SV_ModEnd> return do_dentry_open (
Buggy code:
 <START_BUG> static void get_sb_partition_size_range ( VP9_COMP * cpi, MODE_INFO * * mi_8x8, <END_BUG> BLOCK_SIZE * min_block_size,  BLOCK_SIZE * max_block_size ) { <START_BUG> MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; int sb_width_in_blocks = MI_BLOCK_SIZE ; int sb_height_in_blocks = MI_BLOCK_SIZE ; int i, j ; int index = 0 ; for ( i = 0 ; i < sb_height_in_blocks ; ++ i ) { for ( j = 0 ; j < sb_width_in_blocks ; ++ j ) { MODE_INFO * mi = mi_8x8 [ index + j ] ; BLOCK_SIZE sb_type = mi? mi -> mbmi. sb_type : 0 ; <END_BUG> * min_block_size = MIN ( * min_block_size, sb_type ) ;  * max_block_size = MAX ( * max_block_size, sb_type ) ; } index += xd -> mi_stride ; } }

Fix:
<S2SV_ModStart> void get_sb_partition_size_range ( MACROBLOCKD * xd <S2SV_ModEnd>, MODE_INFO * <S2SV_ModStart> BLOCK_SIZE * max_block_size, int bs_hist [ BLOCK_SIZES ] ) { <S2SV_ModEnd> int sb_width_in_blocks = <S2SV_ModStart> : 0 ; bs_hist [ sb_type ] ++ ;
Buggy code:
 char * guestfs___first_line_of_file ( guestfs_h * g, const char * filename ) { <START_BUG> CLEANUP_FREE char * * lines = NULL ; <END_BUG> int64_t size ; char * ret ; size = guestfs_filesize ( g, filename ) ; if ( size == - 1 ) return NULL ; if ( size > MAX_SMALL_FILE_SIZE ) { error ( g, _ ( "size   of   %s   is   unreasonably   large   (%" PRIi64 "   bytes)" ), filename, size ) ; return NULL ; } lines = guestfs_head_n ( g, 1, filename ) ; if ( lines == NULL ) return NULL ; if ( lines [ 0 ] == NULL ) { guestfs___free_string_list ( lines ) ; return safe_strdup ( g, "" ) ; } ret = lines [ 0 ] ;  return ret ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> filename ) { <S2SV_ModEnd> char * * <S2SV_ModStart> 0 ] ; free ( lines ) ;