nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int check_entry_size_and_hooks ( struct ip6t_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct ip6t_entry )!= 0 || ( unsigned char * ) e + sizeof ( struct ip6t_entry ) >= limit || ( unsigned char * ) e + e -> next_offset > limit ) { duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct ip6t_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } if (! ip6_checkentry ( & e -> ipv6 ) ) return - EINVAL ; <START_BUG> err = xt_check_entry_offsets ( e, e -> target_offset, e -> next_offset ) ; <END_BUG> if ( err ) return err ; for ( h = 0 ; h < NF_INET_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { pr_debug ( "Underflows   must   be   unconditional   and   " "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart>, e -> elems, e ->
Buggy code:
 error_t rawSocketSendIpPacket ( Socket * socket, const SocketMsg * message, uint_t flags ) { error_t error ; size_t offset ; NetBuffer * buffer ; NetInterface * interface ; IpPseudoHeader pseudoHeader ; NetTxAncillary ancillary ; <START_BUG> interface = socket -> interface ; <END_BUG> buffer = ipAllocBuffer ( 0, & offset ) ; if ( buffer == NULL ) return ERROR_OUT_OF_MEMORY ; do { error = netBufferAppend ( buffer, message -> data, message -> length ) ; if ( error ) break ; # if ( IPV4_SUPPORT == ENABLED ) if ( message -> destIpAddr. length == sizeof ( Ipv4Addr ) ) { Ipv4Addr srcIpAddr ; error = ipv4SelectSourceAddr ( & interface, message -> destIpAddr. ipv4Addr, & srcIpAddr ) ; if ( error ) break ; pseudoHeader. length = sizeof ( Ipv4PseudoHeader ) ; pseudoHeader. ipv4Data. srcAddr = srcIpAddr ; pseudoHeader. ipv4Data. destAddr = message -> destIpAddr. ipv4Addr ; pseudoHeader. ipv4Data. reserved = 0 ; pseudoHeader. ipv4Data. protocol = socket -> protocol ; pseudoHeader. ipv4Data. length = htons ( message -> length ) ; } else # endif # if ( IPV6_SUPPORT == ENABLED ) if ( message -> destIpAddr. length == sizeof ( Ipv6Addr ) ) { error = ipv6SelectSourceAddr ( & interface, & message -> destIpAddr. ipv6Addr, & pseudoHeader. ipv6Data. srcAddr ) ; if ( error ) break ; pseudoHeader. length = sizeof ( Ipv6PseudoHeader ) ; pseudoHeader. ipv6Data. destAddr = message -> destIpAddr. ipv6Addr ; pseudoHeader. ipv6Data. length = htonl ( message -> length ) ; pseudoHeader. ipv6Data. reserved [ 0 ] = 0 ; pseudoHeader. ipv6Data. reserved [ 1 ] = 0 ; pseudoHeader. ipv6Data. reserved [ 2 ] = 0 ; pseudoHeader. ipv6Data. nextHeader = socket -> protocol ; } else # endif { error = ERROR_FAILURE ; break ; } ancillary = NET_DEFAULT_TX_ANCILLARY ; if ( message -> ttl!= 0 ) { anc

Fix:
<S2SV_ModStart> NetTxAncillary ancillary ; if ( message -> interface!= NULL ) { interface = message -> interface ; } else { interface = socket -> interface ; } <S2SV_ModEnd> buffer = ipAllocBuffer
Buggy code:
 void rawSocketProcessEthPacket ( NetInterface * interface, EthHeader * header, const uint8_t * data, size_t length, NetRxAncillary * ancillary ) { uint_t i ; Socket * socket ; SocketQueueItem * queueItem ; NetBuffer * p ; for ( i = 0 ; i < SOCKET_MAX_COUNT ; i ++ ) { socket = socketTable + i ; if ( socket -> type!= SOCKET_TYPE_RAW_ETH ) continue ; if ( socket -> interface && socket -> interface!= interface ) continue ; if ( socket -> protocol == SOCKET_ETH_PROTO_ALL ) { } else if ( socket -> protocol == SOCKET_ETH_PROTO_LLC ) { if ( ntohs ( header -> type ) > ETH_MTU ) continue ; } else { if ( ntohs ( header -> type )!= socket -> protocol ) continue ; } break ; } if ( i >= SOCKET_MAX_COUNT ) return ; if ( socket -> receiveQueue == NULL ) { p = netBufferAlloc ( sizeof ( SocketQueueItem ) + sizeof ( EthHeader ) + length ) ; if ( p!= NULL ) { queueItem = netBufferAt ( p, 0 ) ; queueItem -> buffer = p ; socket -> receiveQueue = queueItem ; } else { queueItem = NULL ; } } else { queueItem = socket -> receiveQueue ; for ( i = 1 ; queueItem -> next ; i ++ ) { queueItem = queueItem -> next ; } if ( i >= RAW_SOCKET_RX_QUEUE_SIZE ) { MIB2_INC_COUNTER32 ( ifGroup. ifTable [ interface -> index ]. ifInDiscards, 1 ) ; IF_MIB_INC_COUNTER32 ( ifTable [ interface -> index ]. ifInDiscards, 1 ) ; return ; } p = netBufferAlloc ( sizeof ( SocketQueueItem ) + sizeof ( EthHeader ) + length ) ; if ( p!= NULL ) { queueItem -> next = netBufferAt ( p, 0 ) ; queueItem = queueItem -> next ; queueItem -> buffer = p ; } else { queueItem = NULL ; } } if ( queueItem == NULL ) { MIB2_INC_COUNTER32 ( ifGroup. ifTable [ interface -> index ]. ifInDiscards,

Fix:
<S2SV_ModStart> ; queueItem -> interface = interface ; queueItem ->
Buggy code:
 static void accumulate_frame_motion_stats ( VP8_COMP * cpi, FIRSTPASS_STATS * this_frame, double * this_frame_mv_in_out, double * mv_in_out_accumulator, double * abs_mv_in_out_accumulator, double * mv_ratio_accumulator ) { double this_frame_mvr_ratio ; double this_frame_mvc_ratio ; double motion_pct ; <START_BUG> motion_pct = this_frame -> pcnt_motion ; <END_BUG> * this_frame_mv_in_out = this_frame -> mv_in_out_count * motion_pct ; * mv_in_out_accumulator += this_frame -> mv_in_out_count * motion_pct ; * abs_mv_in_out_accumulator += fabs ( this_frame -> mv_in_out_count * motion_pct ) ; if ( motion_pct > 0.05 ) { this_frame_mvr_ratio = fabs ( this_frame -> mvr_abs ) // DOUBLE_DIVIDE_CHECK ( fabs ( this_frame -> MVr ) ) ; this_frame_mvc_ratio = fabs ( this_frame -> mvc_abs ) // DOUBLE_DIVIDE_CHECK ( fabs ( this_frame -> MVc ) ) ; * mv_ratio_accumulator += ( this_frame_mvr_ratio < this_frame -> mvr_abs )? ( this_frame_mvr_ratio * motion_pct ) : this_frame -> mvr_abs * motion_pct ; * mv_ratio_accumulator += ( this_frame_mvc_ratio < this_frame -> mvc_abs )? ( this_frame_mvc_ratio * motion_pct ) : this_frame -> mvc_abs * motion_pct ; } }

Fix:
<S2SV_ModStart> double motion_pct ; ( void ) cpi ;
Buggy code:
 static int btrfs_rename ( struct inode * old_dir, struct dentry * old_dentry, struct inode * new_dir, struct dentry * new_dentry ) { struct btrfs_trans_handle * trans ; struct btrfs_root * root = BTRFS_I ( old_dir ) -> root ; struct btrfs_root * dest = BTRFS_I ( new_dir ) -> root ; struct inode * new_inode = new_dentry -> d_inode ; struct inode * old_inode = old_dentry -> d_inode ; struct timespec ctime = CURRENT_TIME ; u64 index = 0 ; u64 root_objectid ; int ret ; u64 old_ino = btrfs_ino ( old_inode ) ; if ( btrfs_ino ( new_dir ) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID ) return - EPERM ; if ( old_ino!= BTRFS_FIRST_FREE_OBJECTID && root!= dest ) return - EXDEV ; if ( old_ino == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID || ( new_inode && btrfs_ino ( new_inode ) == BTRFS_FIRST_FREE_OBJECTID ) ) return - ENOTEMPTY ; if ( S_ISDIR ( old_inode -> i_mode ) && new_inode && new_inode -> i_size > BTRFS_EMPTY_DIR_SIZE ) return - ENOTEMPTY ; <START_BUG> if ( new_inode && S_ISREG ( old_inode -> i_mode ) && new_inode -> i_size && <END_BUG> old_inode -> i_size > BTRFS_ORDERED_OPERATIONS_FLUSH_LIMIT ) filemap_flush ( old_inode -> i_mapping ) ; if ( old_ino == BTRFS_FIRST_FREE_OBJECTID ) down_read ( & root -> fs_info -> subvol_sem ) ; trans = btrfs_start_transaction ( root, 20 ) ; if ( IS_ERR ( trans ) ) { ret = PTR_ERR ( trans ) ; goto out_notrans ; } if ( dest!= root ) btrfs_record_root_in_trans ( trans,

Fix:
<S2SV_ModStart> - ENOTEMPTY ; ret = btrfs_check_dir_item_collision ( root, new_dir -> i_ino, new_dentry -> d_name. name, new_dentry -> d_name. len ) ; if ( ret ) { if ( ret == - EEXIST ) { if (! new_inode ) { WARN_ON ( 1 ) ; return ret ; } } else { return ret ; } } ret = 0 ;
Buggy code:
 void vp8_alloc_compressor_data ( VP8_COMP * cpi ) { VP8_COMMON * cm = & cpi -> common ; int width = cm -> Width ; int height = cm -> Height ; if ( vp8_alloc_frame_buffers ( cm, width, height ) ) vpx_internal_error ( & cpi -> common. error, VPX_CODEC_MEM_ERROR, "Failed   to   allocate   frame   buffers" ) ; if ( vp8_alloc_partition_data ( cpi ) ) vpx_internal_error ( & cpi -> common. error, VPX_CODEC_MEM_ERROR, "Failed   to   allocate   partition   data" ) ; if ( ( width & 0xf )!= 0 ) width += 16 - ( width & 0xf ) ; if ( ( height & 0xf )!= 0 ) height += 16 - ( height & 0xf ) ; if ( vp8_yv12_alloc_frame_buffer ( & cpi -> pick_lf_lvl_frame, width, height, VP8BORDERINPIXELS ) ) vpx_internal_error ( & cpi -> common. error, VPX_CODEC_MEM_ERROR, "Failed   to   allocate   last   frame   buffer" ) ; if ( vp8_yv12_alloc_frame_buffer ( & cpi -> scaled_source, width, height, VP8BORDERINPIXELS ) ) vpx_internal_error ( & cpi -> common. error, VPX_CODEC_MEM_ERROR, "Failed   to   allocate   scaled   source   buffer" ) ; vpx_free ( cpi -> tok ) ; { # if CONFIG_REALTIME_ONLY & CONFIG_ONTHEFLY_BITPACKING unsigned int tokens = 8 * 24 * 16 ; # else unsigned int tokens = cm -> mb_rows * cm -> mb_cols * 24 * 16 ; # endif CHECK_MEM_ERROR ( cpi -> tok, vpx_calloc ( tokens, sizeof ( * cpi -> tok ) ) ) ; } cpi -> zeromv_count = 0 ; vpx_free ( cpi -> gf_active_flags ) ; CHECK_MEM_ERROR ( cpi -> gf_active_flags, vpx_

Fix:
<S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( cpi -> <S2SV_ModStart> ) ) ; # if CONFIG_TEMPORAL_DENOISING if ( cpi -> oxcf. noise_sensitivity > 0 ) { vp8_denoiser_free ( & cpi -> denoiser ) ; vp8_denoiser_allocate ( & cpi -> denoiser, width, height, cm -> mb_rows, cm -> mb_cols, cpi -> oxcf. noise_sensitivity ) ; } # endif
Buggy code:
 static int i915_gem_do_execbuffer ( struct drm_device * dev, void * data, struct drm_file * file, struct drm_i915_gem_execbuffer2 * args, struct drm_i915_gem_exec_object2 * exec ) { drm_i915_private_t * dev_priv = dev -> dev_private ; struct list_head objects ; struct eb_objects * eb ; struct drm_i915_gem_object * batch_obj ; struct drm_clip_rect * cliprects = NULL ; struct intel_ring_buffer * ring ; u32 exec_start, exec_len ; u32 seqno ; u32 mask ; int ret, mode, i ; if (! i915_gem_check_execbuffer ( args ) ) { DRM_DEBUG ( "execbuf   with   invalid   offset//length\\n" ) ; return - EINVAL ; } ret = validate_exec_list ( exec, args -> buffer_count ) ; if ( ret ) return ret ; switch ( args -> flags & I915_EXEC_RING_MASK ) { case I915_EXEC_DEFAULT : case I915_EXEC_RENDER : ring = & dev_priv -> ring [ RCS ] ; break ; case I915_EXEC_BSD : if (! HAS_BSD ( dev ) ) { DRM_DEBUG ( "execbuf   with   invalid   ring   (BSD)\\n" ) ; return - EINVAL ; } ring = & dev_priv -> ring [ VCS ] ; break ; case I915_EXEC_BLT : if (! HAS_BLT ( dev ) ) { DRM_DEBUG ( "execbuf   with   invalid   ring   (BLT)\\n" ) ; return - EINVAL ; } ring = & dev_priv -> ring [ BCS ] ; break ; default : DRM_DEBUG ( "execbuf   with   unknown   ring:   %d\\n", ( int ) ( args -> flags & I915_EXEC_RING_MASK ) ) ; return - EINVAL ; } mode = args -> flags & I915_EXEC_CONSTANTS_MASK ; mask = I915_EXEC_CONSTANTS_MASK ; switch ( mode

Fix:
<S2SV_ModStart> DRM_DEBUG ( "clip <S2SV_blank> rectangles <S2SV_blank> are <S2SV_blank> only <S2SV_blank> valid <S2SV_blank> with <S2SV_blank> the <S2SV_blank> render <S2SV_blank> ring\\n" ) ; return - EINVAL ; } if ( args -> num_cliprects > UINT_MAX // sizeof ( * cliprects ) ) { DRM_DEBUG ( "execbuf <S2SV_blank> with <S2SV_blank> %u <S2SV_blank> cliprects\\n", args -> num_cliprects
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_use_reference ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { int reference_flag = va_arg ( args, int ) ; vp8_use_as_reference ( ctx -> cpi, reference_flag ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 STREAM sec_recv ( RD_BOOL * is_fastpath ) { uint8 fastpath_hdr, fastpath_flags ; uint16 sec_flags ; uint16 channel ; STREAM s ; <START_BUG> while ( ( s = mcs_recv ( & channel, is_fastpath, & fastpath_hdr ) )!= NULL ) <END_BUG>  { <START_BUG> if ( * is_fastpath == True ) { fastpath_flags = ( fastpath_hdr & 0xC0 ) >> 6 ; if ( fastpath_flags & FASTPATH_OUTPUT_ENCRYPTED ) <END_BUG> {  in_uint8s ( s, 8 ) ; sec_decrypt ( s -> p, s -> end - s -> p ) ; } return s ; } if ( g_encryption || (! g_licence_issued &&! g_licence_error_result ) ) { in_uint16_le ( s, sec_flags ) ; in_uint8s ( s, 2 ) ; if ( g_encryption ) { if ( sec_flags & SEC_ENCRYPT ) { <START_BUG> in_uint8s ( s, 8 ) ; <END_BUG> sec_decrypt ( s -> p, s -> end - s -> p ) ; } if ( sec_flags & SEC_LICENSE_PKT ) { licence_process ( s ) ; continue ; } if ( sec_flags & SEC_REDIRECTION_PKT ) {  uint8 swapbyte ; <START_BUG> in_uint8s ( s, 8 ) ; sec_decrypt ( s -> p, s -> end - s -> p ) ; if ( s -> p [ 0 ] == 0 && s -> p [ 1 ] == 4 ) { swapbyte = s -> p [ 0 ] ; s -> p [ 0 ] = s -> p [ 2 ] ; s -> p [ 2 ] = swapbyte ; swapbyte = s -> p [ 1 ] ; s -> p [ 1 ] = s -> p [ 3 ] ; s -> p [ 3 ] = swapbyte ; swapbyte = s -> p [ 2 ] ; s -> p [ 2 ] = s -> p [ 3 ] ; s -> p [ 3 ] = swapbyte ; } } } else { if ( sec_flags & SEC_LICENSE_PKT ) { licence_process ( s ) ; continue ; } s -> p -= 4 ; } } if ( channel!= MCS_GLOBAL_CHANNEL )<END_BUG>

Fix:
<S2SV_ModStart> STREAM s ; struct stream packet ; <S2SV_ModStart> NULL ) { packet = * s ; <S2SV_ModStart> FASTPATH_OUTPUT_ENCRYPTED ) { if (! s_check_rem ( s, 8 ) ) { rdp_protocol_error ( "sec_recv(), <S2SV_blank> consume <S2SV_blank> fastpath <S2SV_blank> signature <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } <S2SV_ModStart> SEC_ENCRYPT ) { if (! s_check_rem ( s, 8 ) ) { rdp_protocol_error ( "sec_recv(), <S2SV_blank> consume <S2SV_blank> encrypt <S2SV_blank> signature <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } <S2SV_ModStart> uint8 swapbyte ; if (! s_check_rem ( s, 8 ) ) { rdp_protocol_error ( "sec_recv(), <S2SV_blank> consume <S2SV_blank> redirect <S2SV_blank> signature <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 static int dccp_v6_send_response ( const struct sock * sk, struct request_sock * req ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sk_buff * skb ; struct in6_addr * final_p, final ; struct flowi6 fl6 ; int err = - 1 ; struct dst_entry * dst ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; fl6. flowi6_proto = IPPROTO_DCCP ; fl6. daddr = ireq -> ir_v6_rmt_addr ; fl6. saddr = ireq -> ir_v6_loc_addr ; fl6. flowlabel = 0 ; fl6. flowi6_oif = ireq -> ir_iif ; fl6. fl6_dport = ireq -> ir_rmt_port ; fl6. fl6_sport = htons ( ireq -> ir_num ) ; security_req_classify_flow ( req, flowi6_to_flowi ( & fl6 ) ) ; <START_BUG> final_p = fl6_update_dst ( & fl6, np -> opt, & final ) ; <END_BUG> dst = ip6_dst_lookup_flow ( sk, & fl6, final_p ) ; if ( IS_ERR ( dst ) ) { err = PTR_ERR ( dst ) ; dst = NULL ; goto done ; } skb = dccp_make_response ( sk, dst, req ) ; if ( skb!= NULL ) { struct dccp_hdr * dh = dccp_hdr ( skb ) ; dh -> dccph_checksum = dccp_v6_csum_finish ( skb, & ireq -> ir_v6_loc_addr, & ireq -> ir_v6_rmt_addr ) ; fl6. daddr = ireq -> ir_v6_rmt_addr ;  err = ip6_xmit ( sk, skb, & fl6, np -> opt, np -> tclass ) ; <START_BUG> err = net_xmit_eval ( err ) ; } done : dst_release ( dst ) ; return err<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; rcu_read_lock ( ) ; <S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ) <S2SV_ModStart>, & final ) ; rcu_read_unlock ( <S2SV_ModStart> -> ir_v6_rmt_addr ; rcu_read_lock ( ) ; <S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ), <S2SV_ModEnd> np -> tclass <S2SV_ModStart> np -> tclass ) ; rcu_read_unlock (
Buggy code:
 asmlinkage void kernel_unaligned_trap ( struct pt_regs * regs, unsigned int insn ) { enum direction dir = decode_direction ( insn ) ; int size = decode_access_size ( regs, insn ) ; int orig_asi, asi ; current_thread_info ( ) -> kern_una_regs = regs ; current_thread_info ( ) -> kern_una_insn = insn ; orig_asi = asi = decode_asi ( insn, regs ) ; if ( asi == ASI_AIUS ) { kernel_mna_trap_fault ( 0 ) ; return ; } log_unaligned ( regs ) ; if (! ok_for_kernel ( insn ) || dir == both ) { printk ( "Unsupported   unaligned   load//store   trap   for   kernel   " "at   <%016lx>.\\n", regs -> tpc ) ; unaligned_panic ( "Kernel   does   fpu//atomic   " "unaligned   load//store.", regs ) ; kernel_mna_trap_fault ( 0 ) ; } else { unsigned long addr, * reg_addr ; int err ; addr = compute_effective_address ( regs, insn, ( ( insn >> 25 ) & 0x1f ) ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, addr ) ; <END_BUG> switch ( asi ) { case ASI_NL : case ASI_AIUPL : case ASI_AIUSL : case ASI_PL : case ASI_SL : case ASI_PNFL : case ASI_SNFL : asi &= ~ 0x08 ; break ; } switch ( dir ) { case load : reg_addr = fetch_reg_addr ( ( ( insn >> 25 ) & 0x1f ), regs ) ; err = do_int_load ( reg_addr, size, ( unsigned long * ) addr, decode_signedness ( insn ), asi ) ; if ( likely (! err ) && unlikely ( asi!= orig_asi ) ) { unsigned long val_in = * reg_addr ; switch ( size ) { case 2 : val_in = swab16 ( val_in ) ; break ; case 4 : val_in = swab32 (

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, addr
Buggy code:
 EXPORTED const char * dlist_reserve_path ( const char * part, int isarchive, const struct message_guid * guid ) { static char buf [ MAX_MAILBOX_PATH ] ; <START_BUG> const char * base ; <END_BUG> if ( strchr ( part, '//' ) ) { base = part ; } else { base = isarchive? config_archivepartitiondir ( part ) : config_partitiondir ( part ) ;  } <START_BUG> assert ( base!= NULL ) ; snprintf ( buf, MAX_MAILBOX_PATH, "%s//sync.//%lu//%s", base, ( unsigned long ) getpid ( ), message_guid_encode ( guid ) ) ; if ( cyrus_mkdir ( buf, 0755 ) ) { syslog ( LOG_ERR, "IOERROR:   failed   to   create   %s//sync.//%lu//   for   reserve:   %m", base, ( unsigned long ) getpid ( ) ) ; } return buf ; }<END_BUG>

Fix:
<S2SV_ModStart> char * base <S2SV_ModEnd> = isarchive? <S2SV_ModStart> part ) ; <S2SV_ModEnd> assert ( base
Buggy code:
 static my_bool get_one_option ( int optid, const struct my_option * opt, char * argument ) { my_bool add_option = TRUE ; switch ( optid ) { case '?' : printf ( "%s     Ver   %s   Distrib   %s,   for   %s   (%s)\\n", my_progname, VER, MYSQL_SERVER_VERSION, SYSTEM_TYPE, MACHINE_TYPE ) ; puts ( ORACLE_WELCOME_COPYRIGHT_NOTICE ( "2000" ) ) ; puts ( "MySQL   utility   for   upgrading   databases   to   new   MySQL   versions.\\n" ) ; my_print_help ( my_long_options ) ; exit ( 0 ) ; break ; case '#' : DBUG_PUSH ( argument? argument : default_dbug_option ) ; add_option = FALSE ; debug_check_flag = 1 ; break ; case 'p' : if ( argument == disabled_my_option ) argument = ( char * ) "" ; tty_password = 1 ; add_option = FALSE ; if ( argument ) { add_one_option ( & ds_args, opt, argument ) ; while ( * argument ) * argument ++ = 'x' ; tty_password = 0 ; } break ; case 't' : my_stpnmov ( opt_tmpdir, argument, sizeof ( opt_tmpdir ) ) ; add_option = FALSE ; break ; case 'k' : case 'v' : case 'f' : case's' : case OPT_WRITE_BINLOG : add_option = FALSE ; break ; <START_BUG> case 'h' : <END_BUG> case 'W' : case 'P' : case 'S' : case OPT_MYSQL_PROTOCOL : case OPT_SHARED_MEMORY_BASE_NAME : case OPT_PLUGIN_DIR : case OPT_DEFAULT_AUTH : add_one_option ( & conn_args, opt, argument ) ; break ; } if ( add_option ) { add_one_option ( & ds_args, opt, argument ) ; } return 0 ; }

Fix:
<S2SV_ModStart> ; break ; # include < sslopt - case. h >
Buggy code:
 void posixtimer_rearm ( struct siginfo * info ) { struct k_itimer * timr ; unsigned long flags ; timr = lock_timer ( info -> si_tid, & flags ) ; if (! timr ) return ; if ( timr -> it_requeue_pending == info -> si_sys_private ) { timr -> kclock -> timer_rearm ( timr ) ; timr -> it_active = 1 ; timr -> it_overrun_last = timr -> it_overrun ; <START_BUG> timr -> it_overrun = - 1 ; <END_BUG> ++ timr -> it_requeue_pending ;  info -> si_overrun += timr -> it_overrun_last ; <START_BUG> } unlock_timer ( timr, flags ) ; }<END_BUG>

Fix:
<S2SV_ModStart> it_overrun = - 1LL <S2SV_ModEnd> ; ++ timr <S2SV_ModStart> info -> si_overrun = timer_overrun_to_int ( timr, info -> si_overrun ) <S2SV_ModEnd> ; } unlock_timer
Buggy code:
 void ArrowHead ( ) { int k ; double length ; SaveGraphicsState ; if ( flip ) length = - arrow. length ; else length = arrow. length ; SetDashSize ( 0, 0 ) ; if ( arrow. stroke ) { SetLineWidth ( arrow. stroke ) ; for ( k = 1 ; k <= 2 ; k ++ ) { SaveGraphicsState ; MoveTo ( length * 0.5, 0 ) ; LineTo ( - length * 0.5, arrow. width ) ; LineTo ( - length * 0.5 + length * arrow. inset, 0 ) ; LineTo ( - length * 0.5, - arrow. width ) ; if ( k == 1 ) { SetBackgroundColor ( NONSTROKING ) ; <START_BUG> outpos += sprintf ( outpos, "   h   f" ) ; <END_BUG> } else {  outpos += sprintf ( outpos, "   s" ) ; <START_BUG> } RestoreGraphicsState ; } } else { MoveTo ( length * 0.5, 0 ) ; LineTo ( - length * 0.5, arrow. width ) ; LineTo ( - length * 0.5 + length * arrow. inset, 0 ) ; LineTo ( - length * 0.5, - arrow. width ) ; <END_BUG> outpos += sprintf ( outpos, "   h   f" ) ;  } RestoreGraphicsState ; }

Fix:
<S2SV_ModStart> NONSTROKING ) ; send ( <S2SV_ModEnd> " <S2SV_blank> h <S2SV_blank> f" ) ; <S2SV_ModStart> } else { send ( <S2SV_ModEnd> " <S2SV_blank> s" ) ; <S2SV_ModStart> width ) ; send ( <S2SV_ModEnd> " <S2SV_blank> h <S2SV_blank> f" ) ;
Buggy code:
 static int tipc_nl_compat_link_dump ( struct tipc_nl_compat_msg * msg, struct nlattr * * attrs ) { struct nlattr * link [ TIPC_NLA_LINK_MAX + 1 ] ; struct tipc_link_info link_info ; int err ; if (! attrs [ TIPC_NLA_LINK ] ) return - EINVAL ; err = nla_parse_nested ( link, TIPC_NLA_LINK_MAX, attrs [ TIPC_NLA_LINK ], NULL ) ; if ( err ) return err ; link_info. dest = nla_get_flag ( link [ TIPC_NLA_LINK_DEST ] ) ; link_info. up = htonl ( nla_get_flag ( link [ TIPC_NLA_LINK_UP ] ) ) ; <START_BUG> strcpy ( link_info. str, nla_data ( link [ TIPC_NLA_LINK_NAME ] ) ) ; <END_BUG> return tipc_add_tlv ( msg -> rep, TIPC_TLV_LINK_INFO, & link_info, sizeof ( link_info ) ) ; }

Fix:
<S2SV_ModStart> ) ) ; nla_strlcpy <S2SV_ModEnd> ( link_info. <S2SV_ModStart> TIPC_NLA_LINK_NAME ] ), TIPC_MAX_LINK_NAME
Buggy code:
 static void command_port_read_callback ( struct urb * urb ) { struct usb_serial_port * command_port = urb -> context ; struct whiteheat_command_private * command_info ; int status = urb -> status ; unsigned char * data = urb -> transfer_buffer ; int result ; command_info = usb_get_serial_port_data ( command_port ) ; if (! command_info ) { dev_dbg ( & urb -> dev -> dev, "%s   -   command_info   is   NULL,   exiting.\\n", __func__ ) ; return ; } <START_BUG> if ( status ) { <END_BUG> dev_dbg ( & urb -> dev -> dev, "%s   -   nonzero   urb   status:   %d\\n", __func__, status ) ; if ( status!= - ENOENT ) command_info -> command_finished = WHITEHEAT_CMD_FAILURE ; wake_up ( & command_info -> wait_command ) ; return ; } usb_serial_debug_data ( & command_port -> dev, __func__, urb -> actual_length, data ) ; if ( data [ 0 ] == WHITEHEAT_CMD_COMPLETE ) { command_info -> command_finished = WHITEHEAT_CMD_COMPLETE ; wake_up ( & command_info -> wait_command ) ; } else if ( data [ 0 ] == WHITEHEAT_CMD_FAILURE ) { command_info -> command_finished = WHITEHEAT_CMD_FAILURE ; wake_up ( & command_info -> wait_command ) ; } else if ( data [ 0 ] == WHITEHEAT_EVENT ) { dev_dbg ( & urb -> dev -> dev, "%s   -   event   received\\n", __func__ ) ;  } else if ( data [ 0 ] == WHITEHEAT_GET_DTR_RTS ) { <START_BUG> memcpy ( command_info -> result_buffer, & data [ 1 ], <END_BUG> urb -> actual_length - 1 ) ;  command_info -> command_finished = WHITEHEAT_CMD_COMPLETE ; wake_up ( & command_info -> wait_command ) ; } else dev_dbg ( & urb -> dev -> dev, "%s   -   bad   reply   from   firmware\\n"

Fix:
<S2SV_ModStart> } if (! urb -> actual_length ) { dev_dbg ( & urb -> dev -> dev, "%s <S2SV_blank> - <S2SV_blank> empty <S2SV_blank> response, <S2SV_blank> exiting.\\n", __func__ ) ; return ; } if ( <S2SV_ModStart> else if ( ( <S2SV_ModStart> == WHITEHEAT_GET_DTR_RTS ) && ( <S2SV_ModEnd> urb -> actual_length <S2SV_ModStart> actual_length - 1 <= sizeof ( command_info -> result_buffer ) ) ) { memcpy ( command_info -> result_buffer, & data [ 1 ], urb -> actual_length - 1
Buggy code:
 static void process_lru_command ( conn * c, token_t * tokens, const size_t ntokens ) { uint32_t pct_hot ; uint32_t pct_warm ; double hot_factor ; int32_t ttl ; double factor ; set_noreply_maybe ( c, tokens, ntokens ) ; if ( strcmp ( tokens [ 1 ]. value, "tune" ) == 0 && ntokens >= 7 ) { if (! safe_strtoul ( tokens [ 2 ]. value, & pct_hot ) ||! safe_strtoul ( tokens [ 3 ]. value, & pct_warm ) ||! safe_strtod ( tokens [ 4 ]. value, & hot_factor ) ||! safe_strtod ( tokens [ 5 ]. value, & factor ) ) { out_string ( c, "ERROR" ) ; } else { if ( pct_hot + pct_warm > 80 ) { out_string ( c, "ERROR   hot   and   warm   pcts   must   not   exceed   80" ) ; } else if ( factor <= 0 || hot_factor <= 0 ) { out_string ( c, "ERROR   hot//warm   age   factors   must   be   greater   than   0" ) ; } else { settings. hot_lru_pct = pct_hot ; settings. warm_lru_pct = pct_warm ; settings. hot_max_factor = hot_factor ; settings. warm_max_factor = factor ; out_string ( c, "OK" ) ; } } <START_BUG> } else if ( strcmp ( tokens [ 1 ]. value, "mode" ) == 0 && ntokens >= 3 && <END_BUG> settings. lru_maintainer_thread ) { if ( strcmp ( tokens [ 2 ]. value, "flat" ) == 0 ) { settings. lru_segmented = false ; out_string ( c, "OK" ) ; } else if ( strcmp ( tokens [ 2 ]. value, "segmented" ) == 0 ) { settings. lru_segmented = true ; out_string ( c, "OK" ) ; } else { out_string ( c, "ERROR" ) ; }  } else if ( strcmp ( tokens [ 1 ]. value, "temp_ttl" ) == 0 && ntokens >= 3

Fix:
<S2SV_ModStart> && ntokens >= 4 <S2SV_ModEnd> && settings. <S2SV_ModStart> && ntokens >= 4 <S2SV_ModEnd> && settings.
Buggy code:
 static int do_timer_create ( clockid_t which_clock, struct sigevent * event, timer_t __user * created_timer_id ) { const struct k_clock * kc = clockid_to_kclock ( which_clock ) ; struct k_itimer * new_timer ; int error, new_timer_id ; int it_id_set = IT_ID_NOT_SET ; if (! kc ) return - EINVAL ; if (! kc -> timer_create ) return - EOPNOTSUPP ; new_timer = alloc_posix_timer ( ) ; if ( unlikely (! new_timer ) ) return - EAGAIN ; spin_lock_init ( & new_timer -> it_lock ) ; new_timer_id = posix_timer_add ( new_timer ) ; if ( new_timer_id < 0 ) { error = new_timer_id ; goto out ; } it_id_set = IT_ID_SET ; new_timer -> it_id = ( timer_t ) new_timer_id ; new_timer -> it_clock = which_clock ; new_timer -> kclock = kc ; <START_BUG> new_timer -> it_overrun = - 1 ; <END_BUG> if ( event ) { rcu_read_lock ( ) ; new_timer -> it_pid = get_pid ( good_sigevent ( event ) ) ; rcu_read_unlock ( ) ; if (! new_timer -> it_pid ) { error = - EINVAL ; goto out ; } new_timer -> it_sigev_notify = event -> sigev_notify ; new_timer -> sigq -> info. si_signo = event -> sigev_signo ; new_timer -> sigq -> info. si_value = event -> sigev_value ; } else { new_timer -> it_sigev_notify = SIGEV_SIGNAL ; new_timer -> sigq -> info. si_signo = SIGALRM ; memset ( & new_timer -> sigq -> info. si_value, 0, sizeof ( sigval_t ) ) ; new_timer -> sigq -> info. si_value. sival_int = new_timer -> it_id ; new_timer -> it_pid = get_pid ( task_tgid ( current

Fix:
<S2SV_ModStart> it_overrun = - 1LL <S2SV_ModEnd> ; if (
Buggy code:
 void decnet_print ( netdissect_options * ndo, register const u_char * ap, register u_int length, register u_int caplen ) { register const union routehdr * rhp ; register int mflags ; int dst, src, hops ; u_int nsplen, pktlen ; const u_char * nspp ; if ( length < sizeof ( struct shorthdr ) ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } ND_TCHECK2 ( * ap, sizeof ( short ) ) ; pktlen = EXTRACT_LE_16BITS ( ap ) ; if ( pktlen < sizeof ( struct shorthdr ) ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } if ( pktlen > length ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } length = pktlen ; rhp = ( const union routehdr * ) & ( ap [ sizeof ( short ) ] ) ; ND_TCHECK ( rhp -> rh_short. sh_flags ) ; mflags = EXTRACT_LE_8BITS ( rhp -> rh_short. sh_flags ) ; if ( mflags & RMF_PAD ) { u_int padlen = mflags & RMF_PADMASK ; if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "[pad:%d]   ", padlen ) ) ; if ( length < padlen + 2 ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } ND_TCHECK2 ( ap [ sizeof ( short ) ], padlen ) ; ap += padlen ; length -= padlen ; caplen -= padlen ; rhp = ( const union routehdr * ) & ( ap [ sizeof ( short ) ] ) ; <START_BUG> mflags = EXTRACT_LE_8BITS ( rhp -> rh_short. sh_flags ) ; <END_BUG> } if ( mflags & RMF_FVER ) { ND_PRINT ( ( ndo, "future-version-decnet" ) ) ; ND_DEFAULTPRINT ( ap, min ( length, caplen ) ) ; return ; } if ( mflags & RMF_CTLMSG

Fix:
<S2SV_ModStart> ] ) ; ND_TCHECK ( rhp -> rh_short. sh_flags ) ;
Buggy code:
 static unsigned int do_decrypt ( const RIJNDAEL_context * ctx, unsigned char * bx, const unsigned char * ax ) { # ifdef USE_AMD64_ASM return _gcry_aes_amd64_decrypt_block ( ctx -> keyschdec, bx, ax, ctx -> rounds, <START_BUG> & dec_tables ) ; <END_BUG> # elif defined ( USE_ARM_ASM ) return _gcry_aes_arm_decrypt_block ( ctx -> keyschdec, bx, ax, ctx -> rounds,  & dec_tables ) ; <START_BUG> # else return do_decrypt_fn ( ctx, bx, ax ) ; # endif }<END_BUG>

Fix:
<S2SV_ModStart> -> rounds, dec_tables. T <S2SV_ModEnd> ) ; # <S2SV_ModStart> -> rounds, dec_tables. T <S2SV_ModEnd> ) ; #
Buggy code:
 STATIC struct posix_acl * xfs_acl_from_disk ( struct xfs_acl * aclp ) { struct posix_acl_entry * acl_e ; struct posix_acl * acl ; struct xfs_acl_entry * ace ; int count, i ; <START_BUG> count = be32_to_cpu ( aclp -> acl_cnt ) ; <END_BUG> acl = posix_acl_alloc ( count, GFP_KERNEL ) ; if (! acl ) return ERR_PTR ( - ENOMEM ) ; for ( i = 0 ; i < count ; i ++ ) { acl_e = & acl -> a_entries [ i ] ; ace = & aclp -> acl_entry [ i ] ; acl_e -> e_tag = be32_to_cpu ( ace -> ae_tag ) ; acl_e -> e_perm = be16_to_cpu ( ace -> ae_perm ) ; switch ( acl_e -> e_tag ) { case ACL_USER : case ACL_GROUP : acl_e -> e_id = be32_to_cpu ( ace -> ae_id ) ; break ; case ACL_USER_OBJ : case ACL_GROUP_OBJ : case ACL_MASK : case ACL_OTHER : acl_e -> e_id = ACL_UNDEFINED_ID ; break ; default : goto fail ; } } return acl ; fail : posix_acl_release ( acl ) ; return ERR_PTR ( - EINVAL ) ; }

Fix:
<S2SV_ModStart> aclp -> acl_cnt ) ; if ( count > XFS_ACL_MAX_ENTRIES ) return ERR_PTR ( - EFSCORRUPTED
Buggy code:
 <START_BUG> static void <END_BUG> _copy_from_pages ( char * p, struct page * * pages, size_t pgbase, size_t len ) { struct page * * pgfrom ; char * vfrom ; size_t copy ; pgfrom = pages + ( pgbase >> PAGE_CACHE_SHIFT ) ; pgbase &= ~ PAGE_CACHE_MASK ; do { copy = PAGE_CACHE_SIZE - pgbase ; if ( copy > len ) copy = len ; vfrom = kmap_atomic ( * pgfrom, KM_USER0 ) ; memcpy ( p, vfrom + pgbase, copy ) ; kunmap_atomic ( vfrom, KM_USER0 ) ; pgbase += copy ; if ( pgbase == PAGE_CACHE_SIZE ) { pgbase = 0 ; pgfrom ++ ; } p += copy ; } while ( ( len -= copy )!= 0 ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> void _copy_from_pages (
Buggy code:
 int pdf_load_xrefs ( FILE * fp, pdf_t * pdf ) { int i, ver, is_linear ; long pos, pos_count ; char x, * c, buf [ 256 ] ; c = NULL ; pdf -> n_xrefs = 0 ; fseek ( fp, 0, SEEK_SET ) ; while ( get_next_eof ( fp ) >= 0 ) ++ pdf -> n_xrefs ; if (! pdf -> n_xrefs ) return 0 ; fseek ( fp, 0, SEEK_SET ) ; <START_BUG> pdf -> xrefs = calloc ( 1, sizeof ( xref_t ) * pdf -> n_xrefs ) ; <END_BUG> ver = 1 ; for ( i = 0 ; i < pdf -> n_xrefs ; i ++ ) { if ( ( pos = get_next_eof ( fp ) ) < 0 ) break ; pdf -> xrefs [ i ]. version = ver ++ ; pos_count = 0 ; while ( SAFE_F ( fp, ( ( x = fgetc ( fp ) )!= 'f' ) ) ) fseek ( fp, pos - ( ++ pos_count ), SEEK_SET ) ; if ( pos_count >= sizeof ( buf ) ) { ERR ( "Failed   to   locate   the   startxref   token.   " "This   might   be   a   corrupt   PDF.\\n" ) ; return - 1 ; } memset ( buf, 0, sizeof ( buf ) ) ; SAFE_E ( fread ( buf, 1, pos_count, fp ), pos_count, "Failed   to   read   startxref.\\n" ) ; c = buf ; while ( * c ==' '|| * c == '\\n' || * c == '\\r' ) ++ c ; pdf -> xrefs [ i ]. start = atol ( c ) ; if ( pdf -> xrefs [ i ]. start == 0 ) get_xref_linear_skipped ( fp, & pdf -> xrefs [ i ] ) ; else { pos = ftell ( fp ) ; fseek ( fp, pdf -> xrefs [ i ]. start, SEEK_SET ) ; pdf -> xrefs [ i ]. end = get_next_eof ( fp ) ; fseek ( fp, pos, SEEK_SET ) ; } if (! is_valid_xref ( fp,

Fix:
<S2SV_ModStart> -> xrefs = safe_calloc ( <S2SV_ModEnd> sizeof ( xref_t
Buggy code:
 static int dissect_usb_ms_bulk ( tvbuff_t * tvb, packet_info * pinfo, proto_tree * parent_tree, void * data ) { usb_conv_info_t * usb_conv_info ; usb_ms_conv_info_t * usb_ms_conv_info ; proto_tree * tree ; proto_item * ti ; guint32 signature = 0 ; int offset = 0 ; gboolean is_request ; itl_nexus_t * itl ; itlq_nexus_t * itlq ; if ( data == NULL ) return 0 ; usb_conv_info = ( usb_conv_info_t * ) data ; usb_ms_conv_info = ( usb_ms_conv_info_t * ) usb_conv_info -> class_data ; if (! usb_ms_conv_info ) { usb_ms_conv_info = wmem_new ( wmem_file_scope ( ), usb_ms_conv_info_t ) ; usb_ms_conv_info -> itl = wmem_tree_new ( wmem_file_scope ( ) ) ; usb_ms_conv_info -> itlq = wmem_tree_new ( wmem_file_scope ( ) ) ; usb_conv_info -> class_data = usb_ms_conv_info ; <START_BUG> } <END_BUG> is_request = ( pinfo -> srcport == NO_ENDPOINT ) ; col_set_str ( pinfo -> cinfo, COL_PROTOCOL, "USBMS" ) ; col_clear ( pinfo -> cinfo, COL_INFO ) ; ti = proto_tree_add_protocol_format ( parent_tree, proto_usb_ms, tvb, 0, - 1, "USB   Mass   Storage" ) ; tree = proto_item_add_subtree ( ti, ett_usb_ms ) ; signature = tvb_get_letohl ( tvb, offset ) ; if ( is_request && ( signature == 0x43425355 ) && ( tvb_reported_length ( tvb ) == 31 ) ) { tvbuff_t * cdb_tvb ; int cdbrlen, cdblen ; guint8 lun, flags ; guint32 datalen ; proto_tree

Fix:
<S2SV_ModStart> = usb_ms_conv_info ; usb_conv_info -> class_data_type = USB_CONV_MASS_STORAGE ; } else if ( usb_conv_info -> class_data_type!= USB_CONV_MASS_STORAGE ) { return 0 ;
Buggy code:
 void bn_sqr_comba4 ( BN_ULONG * r, const BN_ULONG * a ) { <START_BUG> BN_ULONG t1, t2 ; <END_BUG> BN_ULONG c1, c2, c3 ; c1 = 0 ; c2 = 0 ; c3 = 0 ; sqr_add_c ( a, 0, c1, c2, c3 ) ; r [ 0 ] = c1 ; c1 = 0 ; sqr_add_c2 ( a, 1, 0, c2, c3, c1 ) ; r [ 1 ] = c2 ; c2 = 0 ; sqr_add_c ( a, 1, c3, c1, c2 ) ; sqr_add_c2 ( a, 2, 0, c3, c1, c2 ) ; r [ 2 ] = c3 ; c3 = 0 ; sqr_add_c2 ( a, 3, 0, c1, c2, c3 ) ; sqr_add_c2 ( a, 2, 1, c1, c2, c3 ) ; r [ 3 ] = c1 ; c1 = 0 ; sqr_add_c ( a, 2, c2, c3, c1 ) ; sqr_add_c2 ( a, 3, 1, c2, c3, c1 ) ; r [ 4 ] = c2 ; c2 = 0 ; sqr_add_c2 ( a, 3, 2, c3, c1, c2 ) ; r [ 5 ] = c3 ; c3 = 0 ; sqr_add_c ( a, 3, c1, c2, c3 ) ; r [ 6 ] = c1 ; r [ 7 ] = c2 ; }

Fix:
<S2SV_ModStart> ) { BN_ULONG <S2SV_ModEnd> c1, c2
Buggy code:
 static void update_bar_address ( struct vmctx * ctx, struct pci_vdev * dev, uint64_t addr, int idx, int type, bool ignore_reg_unreg ) { bool decode = false ; uint64_t orig_addr = dev -> bar [ idx ]. addr ; if (! ignore_reg_unreg ) { if ( dev -> bar [ idx ]. type == PCIBAR_IO ) decode = porten ( dev ) ; else decode = memen ( dev ) ; } if ( decode ) unregister_bar ( dev, idx ) ; switch ( type ) { case PCIBAR_IO : case PCIBAR_MEM32 : dev -> bar [ idx ]. addr = addr ; break ; case PCIBAR_MEM64 : dev -> bar [ idx ]. addr &= ~ 0xffffffffUL ; dev -> bar [ idx ]. addr |= addr ; break ; case PCIBAR_MEMHI64 : dev -> bar [ idx ]. addr &= 0xffffffff ; dev -> bar [ idx ]. addr |= addr ; break ; default : <START_BUG> assert ( 0 ) ; <END_BUG> } if ( decode ) register_bar ( dev, idx ) ; if ( dev -> dev_ops -> vdev_update_bar_map && decode ) dev -> dev_ops -> vdev_update_bar_map ( ctx, dev, idx, orig_addr ) ; }

Fix:
<S2SV_ModStart> ; default : pr_err ( "%s: <S2SV_blank> invalid <S2SV_blank> bar <S2SV_blank> type <S2SV_blank> %d\\n", __func__, type ) ; return <S2SV_ModEnd> ; } if
Buggy code:
 <START_BUG> static void init_decoder ( vpx_codec_alg_priv_t * ctx ) { <END_BUG>  VP9D_CONFIG oxcf ; <START_BUG> oxcf. width = ctx -> si. w ; oxcf. height = ctx -> si. h ; oxcf. version = 9 ; <END_BUG> oxcf. max_threads = ctx -> cfg. threads ;  oxcf. inv_tile_order = ctx -> invert_tile_order ; <START_BUG> ctx -> pbi = vp9_decoder_create ( & oxcf ) ; <END_BUG> if ( ctx -> pbi == NULL )  return ; <START_BUG> vp9_initialize_dec ( ) ; if (! ctx -> postproc_cfg_set && ( ctx -> base. init_flags & VPX_CODEC_USE_POSTPROC ) ) set_default_ppflags ( & ctx -> postproc_cfg ) ; init_buffer_callbacks ( ctx ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static vpx_codec_err_t <S2SV_ModEnd> init_decoder ( vpx_codec_alg_priv_t <S2SV_ModStart> ctx ) { int i ; const VPxWorkerInterface * const winterface = vpx_get_worker_interface ( ) ; ctx -> last_show_frame = - 1 ; ctx -> next_submit_worker_id = 0 ; ctx -> last_submit_worker_id = 0 ; ctx -> next_output_worker_id = 0 ; ctx -> frame_cache_read = 0 ; ctx -> frame_cache_write = 0 ; ctx -> num_cache_frames = 0 ; ctx -> need_resync = 1 ; ctx -> num_frame_workers = ( ctx -> frame_parallel_decode == 1 )? <S2SV_ModEnd> ctx -> cfg <S2SV_ModStart> cfg. threads : 1 ; if ( ctx -> num_frame_workers > MAX_DECODE_THREADS ) ctx -> num_frame_workers = MAX_DECODE_THREADS ; ctx -> available_threads = ctx -> num_frame_workers ; ctx -> flushed = 0 ; ctx -> buffer_pool = ( BufferPool * ) vpx_calloc
Buggy code:
 static void tcp_send_challenge_ack ( struct sock * sk, const struct sk_buff * skb ) { static u32 challenge_timestamp ; static unsigned int challenge_count ; struct tcp_sock * tp = tcp_sk ( sk ) ; <START_BUG> u32 now ; <END_BUG> if ( tcp_oow_rate_limited ( sock_net ( sk ), skb, LINUX_MIB_TCPACKSKIPPEDCHALLENGE, & tp -> last_oow_ack_time ) ) return ; now = jiffies // HZ ; if ( now!= challenge_timestamp ) {  challenge_timestamp = now ; <START_BUG> <END_BUG> challenge_count = 0 ;  } if ( ++ challenge_count <= sysctl_tcp_challenge_ack_limit ) { NET_INC_STATS ( sock_net ( sk ), LINUX_MIB_TCPCHALLENGEACK ) ; tcp_send_ack ( sk ) ; } }

Fix:
<S2SV_ModStart> ) ; u32 count, <S2SV_ModStart> challenge_timestamp ) { u32 half = ( sysctl_tcp_challenge_ack_limit + 1 ) >> 1 ; <S2SV_ModStart> = now ; WRITE_ONCE ( challenge_count, half + prandom_u32_max ( sysctl_tcp_challenge_ack_limit ) ) ; } count = READ_ONCE ( challenge_count ) ; if ( count > 0 ) { WRITE_ONCE ( challenge_count, count - 1 ) ; <S2SV_ModEnd> NET_INC_STATS ( sock_net
Buggy code:
 static bcon_error_t bson_append_bcon_with_state ( bson * b, const bcon * bc, bcon_state_t start_state ) { bcon_error_t ret = BCON_OK ; bcon_state_t state = start_state ; char * key = 0 ; char * typespec = 0 ; unsigned char doc_stack [ DOC_STACK_SIZE ] ; size_t doc_stack_pointer = 0 ; size_t array_index = 0 ; <START_BUG> unsigned int array_index_stack [ ARRAY_INDEX_STACK_SIZE ] ; <END_BUG> size_t array_index_stack_pointer = 0 ; char array_index_buffer [ ARRAY_INDEX_BUFFER_SIZE ] ; int end_of_data ; const bcon * bcp ; for ( end_of_data = 0, bcp = bc ; ret == BCON_OK &&! end_of_data ; bcp ++ ) { bcon bci = * bcp ; char * s = bci. s ; switch ( state ) { case State_Element : switch ( bcon_token ( s ) ) { case Token_CloseBrace : bson_append_finish_object ( b ) ; DOC_POP_STATE ; break ; case Token_End : end_of_data = 1 ; break ; default : key = s ; state = State_DocSpecValue ; break ; } break ; case State_DocSpecValue : switch ( bcon_token ( s ) ) { case Token_Typespec : typespec = s ; state = State_DocValue ; break ; case Token_OpenBrace : bson_append_start_object ( b, key ) ; DOC_PUSH_STATE ( State_Element ) ; state = State_Element ; break ; case Token_OpenBracket : bson_append_start_array ( b, key ) ; ARRAY_PUSH_RESET_INDEX_STATE ( State_Element ) ; state = State_ArraySpecValue ; break ; case Token_End : end_of_data = 1 ; break ; default : ret = bson_bcon_key_value ( b, key, typespec, bci ) ; state = State_Element ; break ; } break ; case State_DocValue : ret = bson_bcon_key_value ( b, key, typespec, bci ) ; state

Fix:
<S2SV_ModStart> = 0 ; size_t <S2SV_ModEnd> array_index_stack [ ARRAY_INDEX_STACK_SIZE
Buggy code:
 static int http_RecvPostMessage ( http_parser_t * parser, SOCKINFO * info, char * filename, struct SendInstruction * Instr ) { size_t Data_Buf_Size = 1024 ; char Buf [ 1024 ] ; int Timeout = - 1 ; FILE * Fp ; parse_status_t status = PARSE_OK ; int ok_on_close = FALSE ; size_t entity_offset = 0 ; int num_read = 0 ; int ret_code = HTTP_OK ; if ( Instr && Instr -> IsVirtualFile ) { Fp = ( virtualDirCallback. open ) ( filename, UPNP_WRITE ) ; if ( Fp == NULL ) return HTTP_INTERNAL_SERVER_ERROR ; } else { <START_BUG> Fp = fopen ( filename, "wb" ) ; <END_BUG> if ( Fp == NULL )  return HTTP_UNAUTHORIZED ; <START_BUG> } parser -> position = POS_ENTITY ; do { if ( parser -> position!= POS_COMPLETE ) status = parser_parse_entity ( parser ) ; if ( status == PARSE_INCOMPLETE_ENTITY ) { ok_on_close = TRUE ; } else if ( ( status!= PARSE_SUCCESS ) && ( status!= PARSE_CONTINUE_1 ) && ( status!= PARSE_INCOMPLETE ) ) { ret_code = HTTP_BAD_REQUEST ; goto ExitFunction ; } while ( entity_offset + Data_Buf_Size > parser -> msg. entity. length && parser -> position!= POS_COMPLETE ) { num_read = sock_read ( info, Buf, sizeof ( Buf ), & Timeout ) ; if ( num_read > 0 ) { if ( membuffer_append ( & parser -> msg. msg, Buf, ( size_t ) num_read )!= 0 ) { parser -> http_error_code = HTTP_INTERNAL_SERVER_ERROR ; ret_code = HTTP_INTERNAL_SERVER_ERROR ; goto ExitFunction ; } status = parser_parse_entity ( parser ) ; if ( status == PARSE_INCOMPLETE_ENTITY ) { ok_on_close = TRUE ; } else if ( ( status!= PARSE_SUCCESS ) && ( status!= PARSE_CONTINUE_1 ) && ( status!= PARSE_INCOMPLETE ) ) { ret_code = HTTP_BAD_REQUEST ; goto ExitFunction ; } } else if ( num_read == 0 ) { if ( ok_<END_BUG>

Fix:
<S2SV_ModStart> } else { # ifdef UPNP_ENABLE_POST_WRITE <S2SV_ModStart> return HTTP_UNAUTHORIZED ; # else return HTTP_NOT_FOUND ; # endif
Buggy code:
 int main ( int argc, char * * argv ) { mode_t old_umask ; cleanup_free char * base_path = NULL ; int clone_flags ; char * old_cwd = NULL ; pid_t pid ; int event_fd = - 1 ; int child_wait_fd = - 1 ; const char * new_cwd ; uid_t ns_uid ; gid_t ns_gid ; struct stat sbuf ; uint64_t val ; int res UNUSED ; real_uid = getuid ( ) ; real_gid = getgid ( ) ; acquire_privs ( ) ; if ( prctl ( PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0 ) < 0 ) die_with_error ( "prctl(PR_SET_NO_NEW_CAPS)   failed" ) ; read_overflowids ( ) ; argv0 = argv [ 0 ] ; if ( isatty ( 1 ) ) host_tty_dev = ttyname ( 1 ) ; argv ++ ; argc -- ; if ( argc == 0 ) usage ( EXIT_FAILURE, stderr ) ; parse_args ( & argc, & argv ) ; if (! is_privileged && getuid ( )!= 0 ) opt_unshare_user = TRUE ; if ( opt_unshare_user_try && stat ( "//proc//self//ns//user", & sbuf ) == 0 ) { bool disabled = FALSE ; if ( stat ( "//sys//module//user_namespace//parameters//enable", & sbuf ) == 0 ) { cleanup_free char * enable = NULL ; enable = load_file_at ( AT_FDCWD, "//sys//module//user_namespace//parameters//enable" ) ; if ( enable!= NULL && enable [ 0 ] == 'N' ) disabled = TRUE ; } if (! disabled ) opt_unshare_user = TRUE ; } if ( argc == 0 ) usage ( EXIT_FAILURE, stderr ) ; __debug__ ( ( "Creating   root   mount   point\\n" ) ) ; if ( opt_sandbox_uid == - 1 ) opt_sandbox_uid = real_uid ; if ( opt_sandbox_gid == - 1 ) opt_sandbox_gid = real_gid ; if (! opt_unshare_user && opt_sandbox_uid!=

Fix:
<S2SV_ModStart> ; if ( setsid ( ) == ( pid_t ) - 1 ) die_with_error ( "setsid" ) ; if (
Buggy code:
 <START_BUG> static void encode_share_access ( struct xdr_stream * xdr, int open_flags ) <END_BUG> { __be32 * p ; RESERVE_SPACE ( 8 ) ;  switch ( open_flags & ( FMODE_READ | FMODE_WRITE ) ) { <START_BUG> case FMODE_READ : WRITE32 ( NFS4_SHARE_ACCESS_READ ) ; break ; case FMODE_WRITE : WRITE32 ( NFS4_SHARE_ACCESS_WRITE ) ; break ; case FMODE_READ | FMODE_WRITE : WRITE32 ( NFS4_SHARE_ACCESS_BOTH ) ; break ; default : <END_BUG> BUG ( ) ;  } WRITE32 ( 0 ) ; }

Fix:
<S2SV_ModStart> * xdr, fmode_t fmode <S2SV_ModEnd> ) { __be32 <S2SV_ModStart> ; switch ( fmode <S2SV_ModEnd> & ( FMODE_READ <S2SV_ModStart> ; default : WRITE32 ( 0 <S2SV_ModEnd> ) ; }
Buggy code:
 <START_BUG> void <END_BUG> crm_send_remote_msg ( void * session, xmlNode * msg, gboolean encrypted ) {  if ( encrypted ) { <START_BUG> # ifdef HAVE_GNUTLS_GNUTLS_H cib_send_tls ( session, msg ) ; <END_BUG> # else  CRM_ASSERT ( encrypted == FALSE ) ; # endif } else { <START_BUG> cib_send_plaintext ( GPOINTER_TO_INT ( session ), msg ) ; <END_BUG> }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> int <S2SV_ModEnd> crm_send_remote_msg ( void <S2SV_ModStart> encrypted ) { int rc = - 1 ; char * xml_text = NULL ; int len = 0 ; xml_text = dump_xml_unformatted ( <S2SV_ModEnd> msg ) ; <S2SV_ModStart> msg ) ; if ( xml_text ) { len = strlen ( xml_text ) ; <S2SV_ModEnd> } else { <S2SV_ModStart> } else { crm_err ( "Invalid <S2SV_blank> XML, <S2SV_blank> can <S2SV_blank> not <S2SV_blank> send <S2SV_blank> msg" ) ; return - 1 ; } rc = crm_send_remote_msg_raw ( session, xml_text, len, encrypted ) ; if ( rc < 0 ) { goto done ; } rc = crm_send_remote_msg_raw ( session, REMOTE_MSG_TERMINATOR, strlen ( REMOTE_MSG_TERMINATOR ), encrypted ) ; done : if ( rc < 0 ) { crm_err ( "Failed <S2SV_blank> to <S2SV_blank> send <S2SV_blank> remote <S2SV_blank> msg, <S2SV_blank> rc <S2SV_blank> = <S2SV_blank> %d", rc <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } free ( xml_text ) ; return rc ;
Buggy code:
 void migrate_page_copy ( struct page * newpage, struct page * page ) { int cpupid ; if ( PageHuge ( page ) || PageTransHuge ( page ) ) copy_huge_page ( newpage, page ) ; else copy_highpage ( newpage, page ) ; if ( PageError ( page ) ) SetPageError ( newpage ) ; if ( PageReferenced ( page ) ) SetPageReferenced ( newpage ) ; if ( PageUptodate ( page ) ) SetPageUptodate ( newpage ) ; if ( TestClearPageActive ( page ) ) { VM_BUG_ON_PAGE ( PageUnevictable ( page ), page ) ; SetPageActive ( newpage ) ; } else if ( TestClearPageUnevictable ( page ) ) SetPageUnevictable ( newpage ) ; if ( PageChecked ( page ) ) SetPageChecked ( newpage ) ; if ( PageMappedToDisk ( page ) ) SetPageMappedToDisk ( newpage ) ; <START_BUG> if ( PageDirty ( page ) ) { <END_BUG> clear_page_dirty_for_io ( page ) ; if ( PageSwapBacked ( page ) ) SetPageDirty ( newpage ) ;  else <START_BUG> __set_page_dirty_nobuffers ( newpage ) ; } if ( page_is_young ( page ) ) set_page_young ( newpage ) ; if ( page_is_idle ( page ) ) set_page_idle ( newpage ) ; cpupid = page_cpupid_xchg_last ( page, - 1 ) ; page_cpupid_xchg_last ( newpage, cpupid ) ; ksm_migrate_page ( newpage, page ) ; if ( PageSwapCache ( page ) ) ClearPageSwapCache ( page ) ; ClearPagePrivate ( page ) ; set_page_private ( page, 0 ) ; if ( PageWriteback ( newpage ) ) end_page_writeback ( newpage ) ; }<END_BUG>

Fix:
<S2SV_ModStart> page ) ) <S2SV_ModEnd> SetPageDirty ( newpage <S2SV_ModStart> newpage ) ; <S2SV_ModEnd> if ( page_is_young
Buggy code:
 static vpx_codec_err_t ctrl_set_postproc ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> # if CONFIG_VP9_POSTPROC vp8_postproc_cfg_t * data = va_arg ( args, vp8_postproc_cfg_t * ) ; if ( data ) { ctx -> postproc_cfg_set = 1 ; ctx -> postproc_cfg = * ( ( vp8_postproc_cfg_t * ) data ) ; return VPX_CODEC_OK ; } else { return VPX_CODEC_INVALID_PARAM ; } # else  return VPX_CODEC_INCAPABLE ; <START_BUG> # endif }<END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> } # else ( void ) ctx ; ( void ) args ;