nus-yam/ex-repair huggingface dataset:
Buggy code:
 static u32 apic_get_tmcct ( struct kvm_lapic * apic ) { ktime_t remaining ; s64 ns ; u32 tmcct ; ASSERT ( apic!= NULL ) ; <START_BUG> if ( kvm_apic_get_reg ( apic, APIC_TMICT ) == 0 ) <END_BUG> return 0 ; remaining = hrtimer_get_remaining ( & apic -> lapic_timer. timer ) ; if ( ktime_to_ns ( remaining ) < 0 ) remaining = ktime_set ( 0, 0 ) ; ns = mod_64 ( ktime_to_ns ( remaining ), apic -> lapic_timer. period ) ; tmcct = div64_u64 ( ns, ( APIC_BUS_CYCLE_NS * apic -> divide_count ) ) ; return tmcct ; }

Fix:
<S2SV_ModStart>, APIC_TMICT ) == 0 || apic -> lapic_timer. period
Buggy code:
 static int SMB2_sess_establish_session ( struct SMB2_sess_data * sess_data ) { int rc = 0 ; struct cifs_ses * ses = sess_data -> ses ; mutex_lock ( & ses -> server -> srv_mutex ) ; <START_BUG> if ( ses -> server -> sign && ses -> server -> ops -> generate_signingkey ) { <END_BUG>  rc = ses -> server -> ops -> generate_signingkey ( ses ) ; <START_BUG> kfree ( ses -> auth_key. response ) ; ses -> auth_key. response = NULL ; if ( rc ) { cifs_dbg ( FYI, "SMB3   session   key   generation   failed\\n" ) ; mutex_unlock ( & ses -> server -> srv_mutex ) ; <END_BUG> goto keygen_exit ;  } } if (! ses -> server -> session_estab ) { ses -> server -> sequence_number = 0x2 ; ses -> server -> session_estab = true ; } mutex_unlock ( & ses -> server -> srv_mutex ) ; cifs_dbg ( FYI, "SMB2//3   session   established   successfully\\n" ) ; spin_lock ( & GlobalMid_Lock ) ; ses -> status = CifsGood ; ses -> need_reconnect = false ; spin_unlock ( & GlobalMid_Lock ) ; <START_BUG> keygen_exit : <END_BUG> if (! ses -> server -> sign ) { kfree ( ses -> auth_key. response ) ; ses -> auth_key. response = NULL ; } return rc ; }

Fix:
<S2SV_ModStart> -> server -> <S2SV_ModEnd> ops -> generate_signingkey <S2SV_ModStart> ( ses ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> srv_mutex ) ; return rc <S2SV_ModEnd> ; } } <S2SV_ModStart> GlobalMid_Lock ) ; <S2SV_ModEnd> return rc ;
Buggy code:
 int xstateregs_set ( struct task_struct * target, const struct user_regset * regset, unsigned int pos, unsigned int count, const void * kbuf, const void __user * ubuf ) { struct fpu * fpu = & target -> thread. fpu ; struct xregs_state * xsave ; int ret ; if (! boot_cpu_has ( X86_FEATURE_XSAVE ) ) return - ENODEV ; if ( ( pos!= 0 ) || ( count < fpu_user_xstate_size ) ) return - EFAULT ; xsave = & fpu -> state. xsave ; fpu__activate_fpstate_write ( fpu ) ; if ( boot_cpu_has ( X86_FEATURE_XSAVES ) ) { if ( kbuf ) ret = copy_kernel_to_xstate ( xsave, kbuf ) ; else ret = copy_user_to_xstate ( xsave, ubuf ) ; } else { ret = user_regset_copyin ( & pos, & count, & kbuf, & ubuf, xsave, 0, - 1 ) ; <START_BUG> } <END_BUG> if ( ret ) fpstate_init ( & fpu -> state ) ; xsave -> i387. mxcsr &= mxcsr_feature_mask ; xsave -> header. xfeatures &= xfeatures_mask ; memset ( & xsave -> header. reserved, 0, 48 ) ; return ret ; }

Fix:
<S2SV_ModStart> 1 ) ; if (! ret && xsave -> header. xcomp_bv ) ret = - EINVAL ;
Buggy code:
 static int msg_cache_check ( const char * id, struct BodyCache * bcache, void * data ) { struct Context * ctx = ( struct Context * ) data ; if (! ctx ) return - 1 ; struct PopData * pop_data = ( struct PopData * ) ctx -> data ; if (! pop_data ) return - 1 ; # ifdef USE_HCACHE if ( strcmp ( HC_FNAME "." HC_FEXT, id ) == 0 ) return 0 ; # endif for ( int i = 0 ; i < ctx -> msgcount ; i ++ ) { if ( ctx -> hdrs [ i ] -> data && ( mutt_str_strcmp ( ctx -> hdrs [ i ] -> data, id ) == 0 ) ) return 0 ; } <START_BUG> return mutt_bcache_del ( bcache, id ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( bcache, cache_id ( id ) <S2SV_ModEnd> ) ; }
Buggy code:
 static char * get_icu_value_internal ( const char * loc_name, char * tag_name, int * result, int fromParseLocale ) { char * tag_value = NULL ; int32_t tag_value_len = 512 ; int singletonPos = 0 ; char * mod_loc_name = NULL ; int grOffset = 0 ; int32_t buflen = 512 ; UErrorCode status = U_ZERO_ERROR ; if ( strcmp ( tag_name, LOC_CANONICALIZE_TAG )!= 0 ) { grOffset = findOffset ( LOC_GRANDFATHERED, loc_name ) ; if ( grOffset >= 0 ) { if ( strcmp ( tag_name, LOC_LANG_TAG ) == 0 ) { return estrdup ( loc_name ) ; } else { return NULL ; } } if ( fromParseLocale == 1 ) { if ( strcmp ( tag_name, LOC_LANG_TAG ) == 0 ) { if ( strlen ( loc_name ) > 1 && ( isIDPrefix ( loc_name ) == 1 ) ) { return estrdup ( loc_name ) ; } } singletonPos = getSingletonPos ( loc_name ) ; if ( singletonPos == 0 ) { return NULL ; } else if ( singletonPos > 0 ) { mod_loc_name = estrndup ( loc_name, singletonPos - 1 ) ; } } } if ( mod_loc_name == NULL ) { mod_loc_name = estrdup ( loc_name ) ; } do { tag_value = erealloc ( tag_value, buflen ) ; tag_value_len = buflen ; if ( strcmp ( tag_name, LOC_SCRIPT_TAG ) == 0 ) { buflen = uloc_getScript ( mod_loc_name, tag_value, tag_value_len, & status ) ; } if ( strcmp ( tag_name, LOC_LANG_TAG ) == 0 ) { buflen = uloc_getLanguage ( mod_loc_name, tag_value, tag_value_len, & status ) ; } if ( strcmp ( tag_name, LOC_REGION_TAG ) == 0 ) { buflen = uloc_getCountry ( mod_loc_name, tag_value, tag_value_len, & status ) ; }

Fix:
<S2SV_ModStart> = U_ZERO_ERROR ; buflen ++ ;
Buggy code:
 <START_BUG> void unix_notinflight ( struct file * fp ) <END_BUG> { struct sock * s = unix_get_socket ( fp ) ; spin_lock ( & unix_gc_lock ) ; if ( s ) { struct unix_sock * u = unix_sk ( s ) ; BUG_ON ( list_empty ( & u -> link ) ) ; if ( atomic_long_dec_and_test ( & u -> inflight ) ) list_del_init ( & u -> link ) ; unix_tot_inflight -- ; }  fp -> f_cred -> user -> unix_inflight -- ; <START_BUG> spin_unlock ( & unix_gc_lock ) ; }<END_BUG>

Fix:
<S2SV_ModStart> void unix_notinflight ( struct user_struct * user, <S2SV_ModStart> -- ; } <S2SV_ModEnd> user -> unix_inflight
Buggy code:
 static VTermState * vterm_state_new ( VTerm * vt ) { <START_BUG> VTermState * state = vterm_allocator_malloc ( vt, sizeof ( VTermState ) ) ; <END_BUG> state -> vt = vt ; state -> rows = vt -> rows ; state -> cols = vt -> cols ; state -> mouse_col = 0 ; state -> mouse_row = 0 ; state -> mouse_buttons = 0 ; state -> mouse_protocol = MOUSE_X10 ; state -> callbacks = NULL ; state -> cbdata = NULL ; vterm_state_newpen ( state ) ; state -> bold_is_highbright = 0 ; return state ; }

Fix:
<S2SV_ModStart> VTermState ) ) ; if ( state == NULL ) return NULL
Buggy code:
 static void cliRefreshPrompt ( void ) { <START_BUG> int len ; <END_BUG> if ( config. eval_ldb ) return ;  if ( config. hostsocket!= NULL ) <START_BUG> <END_BUG> len = snprintf ( config. prompt, sizeof ( config. prompt ), "redis   %s",  config. hostsocket ) ; else len = anetFormatAddr ( config. prompt, sizeof ( config. prompt ), config. hostip, config. hostport ) ; if ( config. dbnum!= 0 ) len += snprintf ( config. prompt + len, sizeof ( config. prompt ) - len, "[%d]", config. dbnum ) ; snprintf ( config. prompt + len, sizeof ( config. prompt ) - len, ">   " ) ; }

Fix:
<S2SV_ModStart> void ) { <S2SV_ModEnd> if ( config <S2SV_ModStart> ) return ; sds prompt = sdsempty ( ) ; <S2SV_ModStart>!= NULL ) { prompt = sdscatfmt ( prompt, "redis <S2SV_blank> %s", config. hostsocket ) ; } else { char addr [ 256 ] ; anetFormatAddr ( addr, sizeof ( addr ), config. hostip, config. hostport ) ; prompt = sdscatlen ( prompt, addr, strlen ( addr ) ) ; } if ( config. dbnum!= 0 ) prompt = sdscatfmt ( prompt, "[%i]", config. dbnum ) ; prompt = sdscatlen ( prompt, "> <S2SV_blank> ", 2 ) ; <S2SV_ModEnd> snprintf ( config <S2SV_ModStart> prompt ), "%s", prompt ) ; sdsfree ( prompt <S2SV_ModEnd> ) ; }
Buggy code:
 static int snd_timer_user_open ( struct inode * inode, struct file * file ) { struct snd_timer_user * tu ; int err ; err = nonseekable_open ( inode, file ) ; if ( err < 0 ) return err ; tu = kzalloc ( sizeof ( * tu ), GFP_KERNEL ) ; if ( tu == NULL ) return - ENOMEM ; spin_lock_init ( & tu -> qlock ) ; init_waitqueue_head ( & tu -> qchange_sleep ) ; <START_BUG> mutex_init ( & tu -> tread_sem ) ; <END_BUG> tu -> ticks = 1 ; tu -> queue_size = 128 ; tu -> queue = kmalloc ( tu -> queue_size * sizeof ( struct snd_timer_read ), GFP_KERNEL ) ; if ( tu -> queue == NULL ) { kfree ( tu ) ; return - ENOMEM ; } file -> private_data = tu ; return 0 ; }

Fix:
<S2SV_ModStart> & tu -> ioctl_lock <S2SV_ModEnd> ) ; tu
Buggy code:
 static int setup_ttydir_console ( const struct lxc_rootfs * rootfs, const struct lxc_console * console, char * ttydir ) { char path [ MAXPATHLEN ], lxcpath [ MAXPATHLEN ] ; int ret ; ret = snprintf ( path, sizeof ( path ), "%s//dev//%s", rootfs -> mount, ttydir ) ; if ( ret >= sizeof ( path ) ) return - 1 ; ret = mkdir ( path, 0755 ) ; if ( ret && errno!= EEXIST ) { SYSERROR ( "failed   with   errno   %d   to   create   %s", errno, path ) ; return - 1 ; } INFO ( "created   %s", path ) ; ret = snprintf ( lxcpath, sizeof ( lxcpath ), "%s//dev//%s//console", rootfs -> mount, ttydir ) ; if ( ret >= sizeof ( lxcpath ) ) { ERROR ( "console   path   too   long" ) ; return - 1 ; } snprintf ( path, sizeof ( path ), "%s//dev//console", rootfs -> mount ) ; ret = unlink ( path ) ; if ( ret && errno!= ENOENT ) { SYSERROR ( "error   unlinking   %s", path ) ; return - 1 ; } ret = creat ( lxcpath, 0660 ) ; if ( ret == - 1 && errno!= EEXIST ) { SYSERROR ( "error   %d   creating   %s", errno, lxcpath ) ; return - 1 ; } if ( ret >= 0 ) close ( ret ) ; if ( console -> master < 0 ) { INFO ( "no   console" ) ; return 0 ; } <START_BUG> if ( mount ( console -> name, lxcpath, "none", MS_BIND, 0 ) ) { <END_BUG> ERROR ( "failed   to   mount   \'%s\'   on   \'%s\'", console -> name, lxcpath ) ; return - 1 ; } ret = snprintf ( lxcpath, sizeof ( lxcpath ), "%s//console", ttydir ) ; if ( ret >= sizeof ( lxcpath ) ) { ERROR ( "lxc//console   path   too   long" ) ; return - 1 ; } ret = symlink ( lxcpath, path )

Fix:
<S2SV_ModStart> } if ( safe_mount ( console -> name, lxcpath, "none", MS_BIND, 0, rootfs -> mount ) ) { ERROR ( "failed <S2SV_blank> to <S2SV_blank> mount <S2SV_blank> \'%s\' <S2SV_blank> on <S2SV_blank> \'%s\'", <S2SV_ModEnd> console -> name <S2SV_ModStart> name, lxcpath ) ; return - 1 ; } ret = snprintf ( lxcpath, sizeof ( lxcpath ), "%s//console", ttydir ) ; if ( ret >= sizeof ( lxcpath ) ) { ERROR ( "lxc//console <S2SV_blank> path <S2SV_blank> too <S2SV_blank> long" ) ; return - 1 ; } ret = symlink ( lxcpath, path ) ; if ( ret ) { SYSERROR ( "failed <S2SV_blank> to <S2SV_blank> create <S2SV_blank> symlink <S2SV_blank> for <S2SV_blank> console" ) ; return - 1 ; } INFO ( "console <S2SV_blank> has <S2SV_blank> been <S2SV_blank> setup <S2SV_blank> on <S2SV_blank> %s", lxcpath ) ; return 0 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 Datum txid_current_snapshot ( PG_FUNCTION_ARGS ) { TxidSnapshot * snap ; uint32 nxip, i, size ; TxidEpoch state ; Snapshot cur ; cur = GetActiveSnapshot ( ) ; if ( cur == NULL ) elog ( ERROR, "no   active   snapshot   set" ) ; <START_BUG> load_xid_epoch ( & state ) ; <END_BUG> nxip = cur -> xcnt ; size = TXID_SNAPSHOT_SIZE ( nxip ) ; snap = palloc ( size ) ; SET_VARSIZE ( snap, size ) ; snap -> xmin = convert_xid ( cur -> xmin, & state ) ; snap -> xmax = convert_xid ( cur -> xmax, & state ) ; snap -> nxip = nxip ; for ( i = 0 ; i < nxip ; i ++ ) snap -> xip [ i ] = convert_xid ( cur -> xip [ i ], & state ) ; sort_snapshot ( snap ) ; PG_RETURN_POINTER ( snap ) ; }

Fix:
<S2SV_ModStart> ( & state ) ; StaticAssertStmt ( MAX_BACKENDS * 2 <= TXID_SNAPSHOT_MAX_NXIP, "possible <S2SV_blank> overflow <S2SV_blank> in <S2SV_blank> txid_current_snapshot()"
Buggy code:
 void vp9_setup_mask ( VP9_COMMON * const cm, const int mi_row, const int mi_col, <START_BUG> MODE_INFO * * mi_8x8, const int mode_info_stride, <END_BUG> LOOP_FILTER_MASK * lfm ) { int idx_32, idx_16, idx_8 ; const loop_filter_info_n * const lfi_n = & cm -> lf_info ;  MODE_INFO * * mip = mi_8x8 ; <START_BUG> <END_BUG> MODE_INFO * * mip2 = mi_8x8 ;  const int offset_32 [ ] = { 4, ( mode_info_stride << 2 ) - 4, 4, - ( mode_info_stride << 2 ) - 4 } ; const int offset_16 [ ] = { 2, ( mode_info_stride << 1 ) - 2, 2, - ( mode_info_stride << 1 ) - 2 } ; const int offset [ ] = { 1, mode_info_stride - 1, 1, - mode_info_stride - 1 } ; const int shift_32_y [ ] = { 0, 4, 32, 36 } ; const int shift_16_y [ ] = { 0, 2, 16, 18 } ; const int shift_8_y [ ] = { 0, 1, 8, 9 } ; const int shift_32_uv [ ] = { 0, 2, 8, 10 } ; const int shift_16_uv [ ] = { 0, 1, 4, 5 } ; int i ; const int max_rows = ( mi_row + MI_BLOCK_SIZE > cm -> mi_rows? cm -> mi_rows - mi_row : MI_BLOCK_SIZE ) ; const int max_cols = ( mi_col + MI_BLOCK_SIZE > cm -> mi_cols? cm -> mi_cols - mi_col : MI_BLOCK_SIZE ) ; <START_BUG> vp9_zero ( * lfm ) ; <END_BUG> switch ( mip [ 0 ] -> mbmi. sb_type ) { case BLOCK_64X64 : build_masks ( lfi_n, mip [ 0 ], 0, 0, lfm ) ; break ; case BLOCK_64X32 : build_masks ( lfi_n, mip [ 0 ], 0, 0, lf

Fix:
<S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd>, const int <S2SV_ModStart> * mip = mi <S2SV_ModEnd> ; MODE_INFO * <S2SV_ModStart> * mip2 = mi <S2SV_ModEnd> ; const int <S2SV_ModStart> ( * lfm ) ; assert ( mip [ 0 ]!= NULL <S2SV_ModStart> ) ) * 0x0101010101010101ULL <S2SV_ModEnd> ; const uint16_t <S2SV_ModStart> i ] &= 0xfefefefefefefefeULL <S2SV_ModEnd> ; lfm ->
Buggy code:
 static int tiffcp ( TIFF * in, TIFF * out ) { <START_BUG> uint16 bitspersample, samplesperpixel = 1 ; <END_BUG> uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK ; copyFunc cf ; uint32 width, length ; struct cpTag * p ; CopyField ( TIFFTAG_IMAGEWIDTH, width ) ; CopyField ( TIFFTAG_IMAGELENGTH, length ) ; CopyField ( TIFFTAG_BITSPERSAMPLE, bitspersample ) ; CopyField ( TIFFTAG_SAMPLESPERPIXEL, samplesperpixel ) ; if ( compression!= ( uint16 ) - 1 ) TIFFSetField ( out, TIFFTAG_COMPRESSION, compression ) ; else CopyField ( TIFFTAG_COMPRESSION, compression ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_COMPRESSION, & input_compression ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_PHOTOMETRIC, & input_photometric ) ; if ( input_compression == COMPRESSION_JPEG ) { TIFFSetField ( in, TIFFTAG_JPEGCOLORMODE, JPEGCOLORMODE_RGB ) ; } else if ( input_photometric == PHOTOMETRIC_YCBCR ) { uint16 subsamplinghor, subsamplingver ; TIFFGetFieldDefaulted ( in, TIFFTAG_YCBCRSUBSAMPLING, & subsamplinghor, & subsamplingver ) ; if ( subsamplinghor!= 1 || subsamplingver!= 1 ) { fprintf ( stderr, "tiffcp:   %s:   Can\'t   copy//convert   subsampled   image.\\n", TIFFFileName ( in ) ) ; return FALSE ; } } if ( compression == COMPRESSION_JPEG ) { if ( input_photometric == PHOTOMETRIC_RGB && jpegcolormode == JPEGCOLORMODE_RGB ) TIFFSetField ( out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR ) ; else TIFFSetField ( out, TIFFTAG_PHOTOMETRIC, input_photometric ) ; } else if ( compression == COMPRESSION_SGILOG || compression == COMPRESSION_SGILOG24 ) TIFFSetField ( out, TIFFTAG_PHOTOMETRIC, samplesperpixel == 1? PHOTOMETRIC_LOGL : PHOTOMETRIC_LOGLU

Fix:
<S2SV_ModStart> { uint16 bitspersample = 1
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { GradFunContext * s = inlink -> dst -> priv ; AVFilterLink * outlink = inlink -> dst -> outputs [ 0 ] ; AVFrame * out ; int p, direct ; if ( av_frame_is_writable ( in ) ) { direct = 1 ; out = in ; } else { direct = 0 ; out = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; } <START_BUG> for ( p = 0 ; p < 4 && in -> data [ p ] ; p ++ ) { <END_BUG> int w = inlink -> w ; int h = inlink -> h ; int r = s -> radius ; if ( p ) { w = s -> chroma_w ; h = s -> chroma_h ; r = s -> chroma_r ; } if ( FFMIN ( w, h ) > 2 * r ) filter ( s, out -> data [ p ], in -> data [ p ], w, h, out -> linesize [ p ], in -> linesize [ p ], r ) ; else if ( out -> data [ p ]!= in -> data [ p ] ) av_image_copy_plane ( out -> data [ p ], out -> linesize [ p ], in -> data [ p ], in -> linesize [ p ], w, h ) ; } if (! direct ) av_frame_free ( & in ) ; return ff_filter_frame ( outlink, out ) ; }

Fix:
<S2SV_ModStart> [ p ] && in -> linesize [ p ]
Buggy code:
 static krb5_int32 prep_reprocess_req ( krb5_kdc_req * request, krb5_principal * krbtgt_princ ) { krb5_error_code retval = KRB5KRB_AP_ERR_BADMATCH ; char * * realms, * * cpp, * temp_buf = NULL ; krb5_data * comp1 = NULL, * comp2 = NULL ; char * comp1_str = NULL ; if ( isflagset ( request -> kdc_options, KDC_OPT_CANONICALIZE ) &&! isflagset ( request -> kdc_options, KDC_OPT_ENC_TKT_IN_SKEY ) && krb5_princ_size ( kdc_context, request -> server ) == 2 ) { comp1 = krb5_princ_component ( kdc_context, request -> server, 0 ) ; comp2 = krb5_princ_component ( kdc_context, request -> server, 1 ) ; comp1_str = calloc ( 1, comp1 -> length + 1 ) ; if (! comp1_str ) { retval = ENOMEM ; goto cleanup ; } <START_BUG> strlcpy ( comp1_str, comp1 -> data, comp1 -> length + 1 ) ; <END_BUG>  if ( ( krb5_princ_type ( kdc_context, request -> server ) == KRB5_NT_SRV_HST || <START_BUG> krb5_princ_type ( kdc_context, request -> server ) == KRB5_NT_SRV_INST || ( krb5_princ_type ( kdc_context, request -> server ) == KRB5_NT_UNKNOWN && kdc_active_realm -> realm_host_based_services!= NULL && ( krb5_match_config_pattern ( kdc_active_realm -> realm_host_based_services, comp1_str ) == TRUE || krb5_match_config_pattern ( kdc_active_realm -> realm_host_based_services, KRB5_CONF_ASTERISK ) == TRUE ) ) ) && ( kdc_active_realm -> realm_no_host_referral == NULL || ( krb5_match_config_pattern ( k<END_BUG>

Fix:
<S2SV_ModStart> cleanup ; } if ( <S2SV_ModEnd> comp1 -> data <S2SV_ModStart> comp1 -> data!= NULL ) memcpy ( comp1_str, comp1 -> data, comp1 -> length ) ; if ( ( krb5_princ_type ( kdc_context, request -> server ) == KRB5_NT_SRV_HST || krb5_princ_type ( kdc_context, request -> server ) == KRB5_NT_SRV_INST || ( krb5_princ_type ( kdc_context, request -> server ) == KRB5_NT_UNKNOWN && kdc_active_realm -> realm_host_based_services!= NULL && ( krb5_match_config_pattern ( kdc_active_realm -> realm_host_based_services, comp1_str ) == TRUE || krb5_match_config_pattern ( kdc_active_realm -> realm_host_based_services, KRB5_CONF_ASTERISK ) == TRUE ) ) ) && ( kdc_active_realm -> realm_no_host_referral == NULL || ( krb5_match_config_pattern ( k
Buggy code:
 static void l2tp_q931_cc_print ( netdissect_options * ndo, const u_char * dat, u_int length ) <START_BUG> { <END_BUG> print_16bits_val ( ndo, ( const uint16_t * ) dat ) ; ND_PRINT ( ( ndo, ",   %02x", dat [ 2 ] ) ) ;  if ( length > 3 ) { <START_BUG> ND_PRINT ( ( ndo, "   " ) ) ; <END_BUG> print_string ( ndo, dat + 3, length - 3 ) ;  } }

Fix:
<S2SV_ModStart> length ) { if ( length < 3 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } <S2SV_ModStart> ) ) ; dat += 3 ; length -= 3 ; <S2SV_ModStart> if ( length!= 0 <S2SV_ModEnd> ) { ND_PRINT <S2SV_ModStart> ndo, dat, length <S2SV_ModEnd> ) ; }
Buggy code:
 static int get_registers ( rtl8150_t * dev, u16 indx, u16 size, void * data ) { <START_BUG> return usb_control_msg ( dev -> udev, usb_rcvctrlpipe ( dev -> udev, 0 ), <END_BUG> RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,  indx, 0, data, size, 500 ) ; <START_BUG> <END_BUG> } 

Fix:
<S2SV_ModStart> data ) { void * buf ; int ret ; buf = kmalloc ( size, GFP_NOIO ) ; if (! buf ) return - ENOMEM ; ret = <S2SV_ModEnd> usb_control_msg ( dev <S2SV_ModStart>, 0, buf <S2SV_ModEnd>, size, <S2SV_ModStart> 500 ) ; if ( ret > 0 && ret <= size ) memcpy ( data, buf, ret ) ; kfree ( buf ) ; return ret ;
Buggy code:
 static void print_buttons ( HttpRequest req, HttpResponse res, Service_T s ) { if ( is_readonly ( req ) ) { return ; } StringBuffer_append ( res -> outputbuffer, "<table   id=\'buttons\'><tr>" ) ; if ( s -> start ) StringBuffer_append ( res -> outputbuffer, <START_BUG> "<td><form   method=POST   action=%s>" <END_BUG> "<input   type=hidden   value=\'start\'   name=action>" "<input   type=submit   value=\'Start   service\'><//form><//td>", s -> name ) ; if ( s -> stop ) StringBuffer_append ( res -> outputbuffer,  "<td><form   method=POST   action=%s>" <START_BUG> "<input   type=hidden   value=\'stop\'   name=action>" "<input   type=submit   value=\'Stop   service\'><//form><//td>", s -> name ) ; if ( ( s -> start && s -> stop ) || s -> restart ) StringBuffer_append ( res -> outputbuffer, <END_BUG> "<td><form   method=POST   action=%s>"  "<input   type=hidden   value=\'restart\'   name=action>" "<input   type=submit   value=\'Restart   service\'><//form><//td>", s -> name ) ; StringBuffer_append ( res -> outputbuffer, "<td><form   method=POST   action=%s>" "<input   type=hidden   value=\'%s\'   name=action>" "<input   type=submit   value=\'%s\'><//form><//td><//tr><//table>", s -> name, s -> monitor? "unmonitor" : "monitor", s -> monitor? "Disable   monitoring" : "Enable   monitoring" ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> -> outputbuffer, "<td>" "<form <S2SV_blank> method=POST <S2SV_blank> action=%s>" "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'securitytoken\' <S2SV_blank> value=\'%s\'>" "<input <S2SV_blank> type=hidden <S2SV_blank> value=\'start\' <S2SV_blank> name=action>" "<input <S2SV_blank> type=submit <S2SV_blank> value=\'Start <S2SV_blank> service\'>" "<//form>" "<//td>", s -> name, res -> token <S2SV_ModEnd> ) ; if <S2SV_ModStart> -> outputbuffer, "<td>" "<form <S2SV_blank> method=POST <S2SV_blank> action=%s>" "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'securitytoken\' <S2SV_blank> value=\'%s\'>" "<input <S2SV_blank> type=hidden <S2SV_blank> value=\'stop\' <S2SV_blank> name=action>" "<input <S2SV_blank> type=submit <S2SV_blank> value=\'Stop <S2SV_blank> service\'>" "<//form>" "<//td>", s -> name, res -> token <S2SV_ModEnd> ) ; if <S2SV_ModStart> -> outputbuffer, "<td>" "<form <S2SV_blank> method=POST <S2SV_blank> action=%s>" "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'securitytoken\' <S2SV_blank> value=\'%s\'>" "<input <S2SV_blank> type=hidden <S2SV_blank> value=\'restart\' <S2SV_blank> name=action>" "<input <S2SV_blank> type=submit <S2SV_blank> value=\'Restart <S2SV_blank> service\'>" "<//form>" "<//td>", s -> name, res -> token
Buggy code:
 PS_SERIALIZER_DECODE_FUNC ( php ) { const char * p, * q ; char * name ; const char * endptr = val + vallen ; zval * current ; int namelen ; int has_value ; php_unserialize_data_t var_hash ; <START_BUG> PHP_VAR_UNSERIALIZE_INIT ( var_hash ) ; <END_BUG> p = val ; while ( p < endptr ) { zval * * tmp ;  q = p ; <START_BUG> while ( * q!= PS_DELIMITER ) { if ( ++ q >= endptr ) goto break_outer_loop ; } if ( p [ 0 ] == PS_UNDEF_MARKER ) { p ++ ; has_value = 0 ; } else { has_value = 1 ; } namelen = q - p ; name = estrndup ( p, namelen ) ; q ++ ; if ( zend_hash_find ( & EG ( symbol_table ), name, namelen + 1, ( void * * ) & tmp ) == SUCCESS ) { if ( ( Z_TYPE_PP ( tmp ) == IS_ARRAY && Z_ARRVAL_PP ( tmp ) == & EG ( symbol_table ) ) || * tmp == PS ( http_session_vars ) ) { <END_BUG> goto skip ;  } } if ( has_value ) { ALLOC_INIT_ZVAL ( current ) ; if ( php_var_unserialize ( & current, ( const unsigned char * * ) & q, ( const unsigned char * ) endptr, & var_hash TSRMLS_CC ) ) { <START_BUG> php_set_session_var ( name, namelen, current, & var_hash TSRMLS_CC ) ; <END_BUG> } else { var_push_dtor_no_addref ( & var_hash, & current ) ; efree ( name ) ; PHP_VAR_UNSERIALIZE_DESTROY ( var_hash ) ; return FAILURE ; } var_push_dtor_no_addref ( & var_hash, & current ) ; }  PS_ADD_VARL ( name, namelen ) ; <START_BUG> skip : efree ( name ) ; p = q ; } break_outer_loop : PHP_VAR_UNSERIALIZE_DESTROY ( var_hash ) ;<END_BUG>

Fix:
<S2SV_ModStart> php_unserialize_data_t var_hash ; int skip = 0 ; <S2SV_ModStart> q = p ; skip = 0 <S2SV_ModStart> ) ) { skip = 1 <S2SV_ModEnd> ; } } <S2SV_ModStart> ) ) { if (! skip ) { <S2SV_ModStart> TSRMLS_CC ) ; } <S2SV_ModStart> ) ; } if (! skip ) { <S2SV_ModStart> namelen ) ; }
Buggy code:
 void update_process_times ( int user_tick ) { struct task_struct * p = current ; account_process_tick ( p, user_tick ) ; run_local_timers ( ) ; rcu_sched_clock_irq ( user_tick ) ; # ifdef CONFIG_IRQ_WORK if ( in_irq ( ) ) irq_work_tick ( ) ; # endif scheduler_tick ( ) ; if ( IS_ENABLED ( CONFIG_POSIX_TIMERS ) ) run_posix_cpu_timers ( ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> ( ) ; this_cpu_add ( net_rand_state. s1, rol32 ( jiffies, 24 ) + user_tick ) ;
Buggy code:
 WORD32 ih264d_read_mmco_commands ( struct _DecStruct * ps_dec ) { dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; <START_BUG> dpb_commands_t * ps_dpb_cmds = ps_dec -> ps_dpb_cmds ; <END_BUG> dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; WORD32 j ; UWORD8 u1_buf_mode ; struct MMCParams * ps_mmc_params ; UWORD32 * pu4_bitstrm_buf = ps_dec -> ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD32 u4_bit_ofst = ps_dec -> ps_bitstrm -> u4_ofst ; ps_slice -> u1_mmco_equalto5 = 0 ; { if ( ps_dec -> u1_nal_unit_type == IDR_SLICE_NAL ) { ps_slice -> u1_no_output_of_prior_pics_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; COPYTHECONTEXT ( "SH:   no_output_of_prior_pics_flag", ps_slice -> u1_no_output_of_prior_pics_flag ) ; ps_slice -> u1_long_term_reference_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; COPYTHECONTEXT ( "SH:   long_term_reference_flag", ps_slice -> u1_long_term_reference_flag ) ; ps_dpb_cmds -> u1_idr_pic = 1 ; ps_dpb_cmds -> u1_no_output_of_prior_pics_flag = ps_slice -> u1_no_output_of_prior_pics_flag ; ps_dpb_cmds -> u1_long_term_reference_flag = ps_slice -> u1_long_term_reference_flag ; } else { u1_buf_mode = ih264d_get_bit_

Fix:
<S2SV_ModStart> * ps_dpb_cmds = & ( ps_dec -> s_dpb_cmds_scratch ) <S2SV_ModEnd> ; dec_slice_params_t *
Buggy code:
 static VALUE cState_object_nl_set ( VALUE self, VALUE object_nl ) { unsigned long len ; GET_STATE ( self ) ; Check_Type ( object_nl, T_STRING ) ; len = RSTRING_LEN ( object_nl ) ; if ( len == 0 ) { if ( state -> object_nl ) { ruby_xfree ( state -> object_nl ) ; state -> object_nl = NULL ; } } else { if ( state -> object_nl ) ruby_xfree ( state -> object_nl ) ; <START_BUG> state -> object_nl = strdup ( RSTRING_PTR ( object_nl ) ) ; <END_BUG> state -> object_nl_len = len ; } return Qnil ; }

Fix:
<S2SV_ModStart> -> object_nl = fstrndup <S2SV_ModEnd> ( RSTRING_PTR ( <S2SV_ModStart> ( object_nl ), len
Buggy code:
 <START_BUG> static void <END_BUG> horDiff8 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { TIFFPredictorState * sp = PredictorState ( tif ) ; tmsize_t stride = sp -> stride ; unsigned char * cp = ( unsigned char * ) cp0 ;  assert ( ( cc % stride ) == 0 ) ; <START_BUG> if ( cc > stride ) { cc -= stride ; if ( stride == 3 ) { unsigned int r1, g1, b1 ; unsigned int r2 = cp [ 0 ] ; unsigned int g2 = cp [ 1 ] ; unsigned int b2 = cp [ 2 ] ; do { r1 = cp [ 3 ] ; cp [ 3 ] = ( unsigned char ) ( ( r1 - r2 ) & 0xff ) ; r2 = r1 ; g1 = cp [ 4 ] ; cp [ 4 ] = ( unsigned char ) ( ( g1 - g2 ) & 0xff ) ; g2 = g1 ; b1 = cp [ 5 ] ; cp [ 5 ] = ( unsigned char ) ( ( b1 - b2 ) & 0xff ) ; b2 = b1 ; cp += 3 ; } while ( ( cc -= 3 ) > 0 ) ; } else if ( stride == 4 ) { unsigned int r1, g1, b1, a1 ; unsigned int r2 = cp [ 0 ] ; unsigned int g2 = cp [ 1 ] ; unsigned int b2 = cp [ 2 ] ; unsigned int a2 = cp [ 3 ] ; do { r1 = cp [ 4 ] ; cp [ 4 ] = ( unsigned char ) ( ( r1 - r2 ) & 0xff ) ; r2 = r1 ; g1 = cp [ 5 ] ; cp [ 5 ] = ( unsigned char ) ( ( g1 - g2 ) & 0xff ) ; g2 = g1 ; b1 = cp [ 6 ] ; cp [ 6 ] = ( unsigned char ) ( ( b1 - b2 ) & 0xff ) ; b2 = b1 ; a1 = cp [ 7 ] ; cp [ 7 ] = ( unsigned char ) ( ( a1 - a2 ) & 0xff ) ; a2 = a1 ; cp += 4 ; } while ( ( cc -= 4 ) > 0 ) ; } else { cp += cc - 1 ; do { REPEAT4 (<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> horDiff8 ( TIFF <S2SV_ModStart> ) cp0 ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> % stride )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "horDiff8", "%s", "(cc%stride)!=0" ) ; return 0 ; } <S2SV_ModEnd> if ( cc <S2SV_ModStart> ; } } return 1 ;
Buggy code:
 int lxc_attach ( const char * name, const char * lxcpath, lxc_attach_exec_t exec_function, void * exec_payload, lxc_attach_options_t * options, pid_t * attached_process ) { int ret, status ; pid_t init_pid, pid, attached_pid, expected ; struct lxc_proc_context_info * init_ctx ; char * cwd ; char * new_cwd ; int ipc_sockets [ 2 ] ; <START_BUG> int procfd ; <END_BUG> signed long personality ; if (! options ) options = & attach_static_default_options ; init_pid = lxc_cmd_get_init_pid ( name, lxcpath ) ; if ( init_pid < 0 ) { ERROR ( "failed   to   get   the   init   pid" ) ; return - 1 ; } init_ctx = lxc_proc_get_context_info ( init_pid ) ; if (! init_ctx ) { ERROR ( "failed   to   get   context   of   the   init   process,   pid   =   %ld", ( long ) init_pid ) ; return - 1 ; } personality = get_personality ( name, lxcpath ) ; if ( init_ctx -> personality < 0 ) { ERROR ( "Failed   to   get   personality   of   the   container" ) ; lxc_proc_put_context_info ( init_ctx ) ; return - 1 ; } init_ctx -> personality = personality ; init_ctx -> container = lxc_container_new ( name, lxcpath ) ; if (! init_ctx -> container ) return - 1 ; if (! fetch_seccomp ( init_ctx -> container, options ) ) WARN ( "Failed   to   get   seccomp   policy" ) ; if (! no_new_privs ( init_ctx -> container, options ) ) WARN ( "Could   not   determine   whether   PR_SET_NO_NEW_PRIVS   is   set." ) ; cwd = getcwd ( NULL, 0 ) ; if ( options -> namespaces == - 1 ) { options -> namespaces = lxc_cmd_get_clone_flags ( name, lxcpath ) ; if ( options -> namespaces == - 1 ) { ERROR ( "failed

Fix:
<S2SV_ModStart> 2 ] ; <S2SV_ModEnd> signed long personality <S2SV_ModStart> pid ) { int procfd = - 1 ; <S2SV_ModStart> cleanup_error ; } procfd = open ( "//proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC ) ; if ( procfd < 0 ) { SYSERROR ( "Unable <S2SV_blank> to <S2SV_blank> open <S2SV_blank> //proc." <S2SV_ModEnd> ) ; goto <S2SV_ModStart> cleanup_error ; } status = 0 ; ret = lxc_write_nointr ( ipc_sockets [ 0 ], & status <S2SV_ModEnd>, sizeof ( <S2SV_ModStart>, sizeof ( status ) <S2SV_ModEnd> ) ; if <S2SV_ModStart> 0 ) { ERROR ( "error <S2SV_blank> using <S2SV_blank> IPC <S2SV_blank> to <S2SV_blank> notify <S2SV_blank> attached <S2SV_blank> process <S2SV_blank> for <S2SV_blank> initialization <S2SV_blank> (0)" <S2SV_ModEnd> ) ; goto <S2SV_ModStart> cleanup_error ; } ret = lxc_read_nointr_expect ( ipc_sockets [ 0 ], & attached_pid, sizeof ( attached_pid ), NULL ) ; if ( ret <= 0 ) { if ( ret!= 0 ) ERROR ( "error <S2SV_blank> using <S2SV_blank> IPC <S2SV_blank> to <S2SV_blank> receive <S2SV_blank> pid <S2SV_blank> of <S2SV_blank> attached <S2SV_blank> process" ) ; goto cleanup_error ; } <S2SV_ModStart> ) ERROR ( "error <S2SV_blank> using <S2SV_blank> IPC <S2SV_blank>
Buggy code:
 TpktState CotpConnection_readToTpktBuffer ( CotpConnection * self ) { uint8_t * buffer = self -> readBuffer -> buffer ; int bufferSize = self -> readBuffer -> maxSize ; int bufPos = self -> readBuffer -> size ; assert ( bufferSize > 4 ) ; int readBytes ; if ( bufPos < 4 ) { readBytes = readFromSocket ( self, buffer + bufPos, 4 - bufPos ) ; if ( readBytes < 0 ) goto exit_closed ; if ( DEBUG_COTP ) { if ( readBytes > 0 ) printf ( "TPKT:   read   %i   bytes   from   socket\\n", readBytes ) ; } bufPos += readBytes ; if ( bufPos == 4 ) { if ( ( buffer [ 0 ] == 3 ) && ( buffer [ 1 ] == 0 ) ) { self -> packetSize = ( buffer [ 2 ] * 0x100 ) + buffer [ 3 ] ; if ( DEBUG_COTP ) printf ( "TPKT:   header   complete   (msg   size   =   %i)\\n", self -> packetSize ) ; if ( self -> packetSize > bufferSize ) { if ( DEBUG_COTP ) printf ( "TPKT:   packet   too   large\\n" ) ; goto exit_error ; } } else { if ( DEBUG_COTP ) printf ( "TPKT:   failed   to   decode   TPKT   header.\\n" ) ; goto exit_error ; } } else goto exit_waiting ; } <START_BUG> readBytes = readFromSocket ( self, buffer + bufPos, self -> packetSize - bufPos ) ; <END_BUG> if ( readBytes < 0 ) goto exit_closed ; bufPos += readBytes ; if ( bufPos < self -> packetSize ) goto exit_waiting ; if ( DEBUG_COTP ) printf ( "TPKT:   message   complete   (size   =   %i)\\n", self -> packetSize ) ; self -> readBuffer -> size = bufPos ; return TPKT_PACKET_COMPLETE ; exit_closed : if ( DEBUG_COTP ) printf ( "TPKT:   socket   closed   or   socket   error\\n" ) ; return TPKT_ERROR ; exit_error : if ( DEBUG_COTP ) printf ( "TPKT:   Error   parsing   message\\n" )

Fix:
<S2SV_ModStart> exit_waiting ; } if ( self -> packetSize <= bufPos ) goto exit_error ;
Buggy code:
 static void cmdloop ( void ) { int c ; int usinguid, havepartition, havenamespace, recursive ; static struct buf tag, cmd, arg1, arg2, arg3 ; char * p, shut [ MAX_MAILBOX_PATH + 1 ], cmdname [ 100 ] ; const char * err ; const char * commandmintimer ; double commandmintimerd = 0.0 ; struct sync_reserve_list * reserve_list = sync_reserve_list_create ( SYNC_MESSAGE_LIST_HASH_SIZE ) ; struct applepushserviceargs applepushserviceargs ; prot_printf ( imapd_out, "*   OK   [CAPABILITY   " ) ; capa_response ( CAPA_PREAUTH ) ; prot_printf ( imapd_out, "]" ) ; if ( config_serverinfo ) prot_printf ( imapd_out, "   %s", config_servername ) ; if ( config_serverinfo == IMAP_ENUM_SERVERINFO_ON ) { prot_printf ( imapd_out, "   Cyrus   IMAP   %s", cyrus_version ( ) ) ; } prot_printf ( imapd_out, "   server   ready\\r\\n" ) ; cmd_cancelled ( ) ; motd_file ( ) ; commandmintimer = config_getstring ( IMAPOPT_COMMANDMINTIMER ) ; cmdtime_settimer ( commandmintimer? 1 : 0 ) ; if ( commandmintimer ) { commandmintimerd = atof ( commandmintimer ) ; } for ( ; ; ) { index_release ( imapd_index ) ; prot_flush ( imapd_out ) ; if ( backend_current ) prot_flush ( backend_current -> out ) ; proc_register ( config_ident, imapd_clienthost, imapd_userid, index_mboxname ( imapd_index ), NULL ) ; if (! imapd_userisadmin && imapd_userid && ( shutdown_file ( shut, sizeof ( shut ) ) || userdeny ( imapd_userid, config_ident, shut, sizeof ( shut ) ) ) ) { for ( p = shut ; * p == '[' ; p ++ ) ; prot_printf ( imapd_out, "*   BYE   [AL

Fix:
<S2SV_ModStart> ) ) { if (! imapd_userisadmin ) goto badcmd ; <S2SV_ModStart> ) ) { if (! imapd_userisadmin ) goto badcmd ; <S2SV_ModStart> { if (! imapd_userisadmin ) goto badcmd ; if ( <S2SV_ModStart> ) ) { if (! imapd_userisadmin ) goto badcmd ;
Buggy code:
 static long aio_read_events_ring ( struct kioctx * ctx, struct io_event __user * event, long nr ) { struct aio_ring * ring ; unsigned head, tail, pos ; long ret = 0 ; int copy_ret ; mutex_lock ( & ctx -> ring_lock ) ; ring = kmap_atomic ( ctx -> ring_pages [ 0 ] ) ; head = ring -> head ; tail = ring -> tail ; kunmap_atomic ( ring ) ; pr_debug ( "h%u   t%u   m%u\\n", head, tail, ctx -> nr_events ) ; if ( head == tail ) goto out ; <START_BUG> while ( ret < nr ) { <END_BUG> long avail ; struct io_event * ev ; struct page * page ; avail = ( head <= tail? tail : ctx -> nr_events ) - head ; if ( head == tail ) break ; avail = min ( avail, nr - ret ) ; avail = min_t ( long, avail, AIO_EVENTS_PER_PAGE - ( ( head + AIO_EVENTS_OFFSET ) % AIO_EVENTS_PER_PAGE ) ) ; pos = head + AIO_EVENTS_OFFSET ; page = ctx -> ring_pages [ pos // AIO_EVENTS_PER_PAGE ] ; pos %= AIO_EVENTS_PER_PAGE ; ev = kmap ( page ) ; copy_ret = copy_to_user ( event + ret, ev + pos, sizeof ( * ev ) * avail ) ; kunmap ( page ) ; if ( unlikely ( copy_ret ) ) { ret = - EFAULT ; goto out ; } ret += avail ; head += avail ; head %= ctx -> nr_events ; } ring = kmap_atomic ( ctx -> ring_pages [ 0 ] ) ; ring -> head = head ; kunmap_atomic ( ring ) ; flush_dcache_page ( ctx -> ring_pages [ 0 ] ) ; pr_debug ( "%li     h%u   t%u\\n", ret, head, tail ) ; out : mutex_unlock ( & ctx -> ring_lock ) ; return ret ; }

Fix:
<S2SV_ModStart> goto out ; head %= ctx -> nr_events ; tail %= ctx -> nr_events ;
Buggy code:
 static void usage ( void ) { fprintf ( stderr, "usage:   ssh-agent   [-c   |   -s]   [-Dd]   [-a   bind_address]   [-E   fingerprint_hash]\\n" <START_BUG> "                                   [-t   life]   [command   [arg  ...]]\\n" <END_BUG> "               ssh-agent   [-c   |   -s]   -k\\n" ) ; exit ( 1 ) ; }

Fix:
<S2SV_ModStart> stderr, "usage: <S2SV_blank> ssh-agent <S2SV_blank> [-c <S2SV_blank> | <S2SV_blank> -s] <S2SV_blank> [-Dd] <S2SV_blank> [-a <S2SV_blank> bind_address] <S2SV_blank> [-E <S2SV_blank> fingerprint_hash]\\n" " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> [-P <S2SV_blank> pkcs11_whitelist] <S2SV_blank> [-t <S2SV_blank> life] <S2SV_blank> [command <S2SV_blank> [arg <S2SV_blank>...]]\\n" <S2SV_ModEnd> " <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> ssh-agent <S2SV_blank> [-c <S2SV_blank> | <S2SV_blank> -s] <S2SV_blank> -k\\n" ) ;
Buggy code:
 struct _mdi * _WM_ParseNewXmi ( uint8_t * xmi_data, uint32_t xmi_size ) { struct _mdi * xmi_mdi = NULL ; uint32_t xmi_tmpdata = 0 ; uint8_t xmi_formcnt = 0 ; uint32_t xmi_catlen = 0 ; uint32_t xmi_subformlen = 0 ; uint32_t i = 0 ; uint32_t j = 0 ; uint32_t xmi_evntlen = 0 ; uint32_t xmi_divisions = 60 ; uint32_t xmi_tempo = 500000 ; uint32_t xmi_sample_count = 0 ; float xmi_sample_count_f = 0.0 ; float xmi_sample_remainder = 0.0 ; float xmi_samples_per_delta_f = 0.0 ; uint8_t xmi_ch = 0 ; uint8_t xmi_note = 0 ; uint32_t * xmi_notelen = NULL ; uint32_t setup_ret = 0 ; uint32_t xmi_delta = 0 ; uint32_t xmi_lowestdelta = 0 ; uint32_t xmi_evnt_cnt = 0 ; if ( memcmp ( xmi_data, "FORM", 4 ) ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0 ) ; return NULL ; } xmi_data += 4 ; xmi_size -= 4 ; xmi_tmpdata = * xmi_data ++ << 24 ; xmi_tmpdata |= * xmi_data ++ << 16 ; xmi_tmpdata |= * xmi_data ++ << 8 ; xmi_tmpdata |= * xmi_data ++ ; xmi_size -= 4 ; if ( memcmp ( xmi_data, "XDIRINFO", 8 ) ) { _WM_GLOBAL_ERROR ( __FUNCTION__, __LINE__, WM_ERR_NOT_XMI, NULL, 0 ) ; return NULL ; } xmi_data += 8 ; xmi_size -= 8 ; xmi_data += 4 ; xmi_size -= 4 ; xmi_form

Fix:
<S2SV_ModStart>, xmi_data, xmi_size,
Buggy code:
 static int do_hidp_sock_ioctl ( struct socket * sock, unsigned int cmd, void __user * argp ) { struct hidp_connadd_req ca ; struct hidp_conndel_req cd ; struct hidp_connlist_req cl ; struct hidp_conninfo ci ; struct socket * csock ; struct socket * isock ; int err ; BT_DBG ( "cmd   %x   arg   %p", cmd, argp ) ; switch ( cmd ) { case HIDPCONNADD : if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; if ( copy_from_user ( & ca, argp, sizeof ( ca ) ) ) return - EFAULT ; csock = sockfd_lookup ( ca. ctrl_sock, & err ) ; if (! csock ) return err ; isock = sockfd_lookup ( ca. intr_sock, & err ) ; if (! isock ) { sockfd_put ( csock ) ; return err ; <START_BUG> } <END_BUG> err = hidp_connection_add ( & ca, csock, isock ) ; if (! err && copy_to_user ( argp, & ca, sizeof ( ca ) ) ) err = - EFAULT ; sockfd_put ( csock ) ; sockfd_put ( isock ) ; return err ; case HIDPCONNDEL : if (! capable ( CAP_NET_ADMIN ) ) return - EPERM ; if ( copy_from_user ( & cd, argp, sizeof ( cd ) ) ) return - EFAULT ; return hidp_connection_del ( & cd ) ; case HIDPGETCONNLIST : if ( copy_from_user ( & cl, argp, sizeof ( cl ) ) ) return - EFAULT ; if ( cl. cnum <= 0 ) return - EINVAL ; err = hidp_get_connlist ( & cl ) ; if (! err && copy_to_user ( argp, & cl, sizeof ( cl ) ) ) return - EFAULT ; return err ; case HIDPGETCONNINFO : if ( copy_from_user ( & ci, argp, sizeof ( ci ) ) ) return - EFAULT ; err = hidp_get_conninfo ( & ci

Fix:
<S2SV_ModStart> err ; } ca. name [ sizeof ( ca. name ) - 1 ] = 0 ;
Buggy code:
 static vpx_codec_err_t decoder_peek_si ( const uint8_t * data, unsigned int data_sz, vpx_codec_stream_info_t * si ) { <START_BUG> if ( data_sz <= 8 ) <END_BUG> return VPX_CODEC_UNSUP_BITSTREAM ; if ( data + data_sz <= data ) return VPX_CODEC_INVALID_PARAM ; si -> is_kf = 0 ; si -> w = si -> h = 0 ; {  struct vp9_read_bit_buffer rb = { data, data + data_sz, 0, NULL, NULL } ; <START_BUG> const int frame_marker = vp9_rb_read_literal ( & rb, 2 ) ; const int version = vp9_rb_read_bit ( & rb ) ; ( void ) vp9_rb_read_bit ( & rb ) ; if ( frame_marker!= VP9_FRAME_MARKER ) return VPX_CODEC_UNSUP_BITSTREAM ; if ( version > 1 ) return VPX_CODEC_UNSUP_BITSTREAM ; if ( vp9_rb_read_bit ( & rb ) ) { return VPX_CODEC_OK ; } si -> is_kf =! vp9_rb_read_bit ( & rb ) ; if ( si -> is_kf ) { const int sRGB = 7 ; int colorspace ; rb. bit_offset += 1 ; rb. bit_offset += 1 ; if ( vp9_rb_read_literal ( & rb, 8 )!= VP9_SYNC_CODE_0 || vp9_rb_read_literal ( & rb, 8 )!= VP9_SYNC_CODE_1 || vp9_rb_read_literal ( & rb, 8 )!= VP9_SYNC_CODE_2 ) { return VPX_CODEC_UNSUP_BITSTREAM ; } colorspace = vp9_rb_read_literal ( & rb, 3 ) ; if ( colorspace!= sRGB ) { rb. bit_offset += 1 ; if ( version == 1 ) { rb. bit_offset += 2 ; rb. bit_offset += 1 ; } } else { if ( version == 1 ) { rb. bit_offset += 1 ; } else { return VPX_CODEC<END_BUG>

Fix:
<S2SV_ModStart> si ) { return decoder_peek_si_internal ( data, data_sz, si <S2SV_ModEnd>, NULL, <S2SV_ModStart> NULL, NULL, NULL ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void queue_push ( register Queue * qp, size_t extra_length, char const * info ) { register char * cp ; size_t memory_length ; size_t available_length ; size_t begin_length ; size_t n_begin ; size_t q_length ; if (! extra_length ) return ; memory_length = qp -> d_memory_end - qp -> d_memory ; q_length = qp -> d_read <= qp -> d_write? ( size_t ) ( qp -> d_write - qp -> d_read ) : memory_length - ( qp -> d_read - qp -> d_write ) ; available_length = memory_length - q_length - 1 ; if ( message_show ( MSG_INFO ) ) message ( "push_front   %u   bytes   in   `%s\'", ( unsigned ) extra_length, info ) ; if ( extra_length > available_length ) { <START_BUG> memory_length += extra_length - available_length + BLOCK_QUEUE ; <END_BUG> cp = new_memory ( memory_length, sizeof ( char ) ) ; if ( message_show ( MSG_INFO ) ) message ( "Reallocating   queue   at   %p   to   %p", qp -> d_memory, cp ) ; if ( qp -> d_read > qp -> d_write ) { size_t tail_len = qp -> d_memory_end - qp -> d_read ; memcpy ( cp, qp -> d_read, tail_len ) ; memcpy ( cp + tail_len, qp -> d_memory, ( size_t ) ( qp -> d_write - qp -> d_memory ) ) ; qp -> d_write = cp + q_length ; qp -> d_read = cp ; } else {  memcpy ( cp, qp -> d_memory, memory_length ) ; <START_BUG> qp -> d_read = cp + ( qp -> d_read - qp -> d_memory ) ; qp -> d_write = cp + ( qp -> d_write - qp -> d_memory ) ; } free ( qp -> d_memory ) ; qp -> d_memory_end = cp + memory_length ; qp -> d_memory = cp ; } begin_length = qp -> d_read - qp -> d_memory<END_BUG>

Fix:
<S2SV_ModStart> available_length ) { size_t original_length = memory_length ; <S2SV_ModStart> -> d_memory, original_length <S2SV_ModEnd> ) ; qp
Buggy code:
 static void jpc_undo_roi ( jas_matrix_t * x, int roishift, int bgshift, int numbps ) { int i ; int j ; int thresh ; jpc_fix_t val ; jpc_fix_t mag ; bool warn ; uint_fast32_t mask ; <START_BUG> if ( roishift == 0 && bgshift == 0 ) { <END_BUG> return ; } thresh = 1 << roishift ; warn = false ; for ( i = 0 ; i < jas_matrix_numrows ( x ) ; ++ i ) { for ( j = 0 ; j < jas_matrix_numcols ( x ) ; ++ j ) { val = jas_matrix_get ( x, i, j ) ; mag = JAS_ABS ( val ) ; if ( mag >= thresh ) { mag >>= roishift ; val = ( val < 0 )? ( - mag ) : mag ; jas_matrix_set ( x, i, j, val ) ; } else { mag <<= bgshift ;  mask = ( 1 << numbps ) - 1 ; <START_BUG> if ( mag & ( ~ mask ) ) { if (! warn ) { jas_eprintf ( "warning:   possibly   corrupt   code   stream\\n" ) ; warn = true ; } mag &= mask ; } val = ( val < 0 )? ( - mag ) : mag ; jas_matrix_set ( x, i, j, val ) ; } } } }<END_BUG>

Fix:
<S2SV_ModStart> if ( roishift < 0 ) { jas_eprintf ( "warning: <S2SV_blank> forcing <S2SV_blank> negative <S2SV_blank> ROI <S2SV_blank> shift <S2SV_blank> to <S2SV_blank> zero <S2SV_blank> " "(bitstream <S2SV_blank> is <S2SV_blank> probably <S2SV_blank> corrupt)\\n" ) ; roishift = 0 ; } if ( roishift <S2SV_ModStart> mask = ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << numbps )
Buggy code:
 static int tok_get ( struct tok_state * tok, char * * p_start, char * * p_end ) { int c ; int blankline, nonascii ; * p_start = * p_end = NULL ; nextline : tok -> start = NULL ; blankline = 0 ; if ( tok -> atbol ) { int col = 0 ; int altcol = 0 ; tok -> atbol = 0 ; for ( ; ; ) { c = tok_nextc ( tok ) ; if ( c ==' ') { col ++, altcol ++ ; } else if ( c == '\\t' ) { col = ( col // tok -> tabsize + 1 ) * tok -> tabsize ; altcol = ( altcol // ALTTABSIZE + 1 ) * ALTTABSIZE ; } else if ( c == '\\014' ) { col = altcol = 0 ; } else { break ; } } tok_backup ( tok, c ) ; if ( c == '#' || c == '\\n' ) { if ( col == 0 && c == '\\n' && tok -> prompt!= NULL ) { blankline = 0 ; } else { blankline = 1 ; } } if (! blankline && tok -> level == 0 ) { if ( col == tok -> indstack [ tok -> indent ] ) { if ( altcol!= tok -> altindstack [ tok -> indent ] ) { return indenterror ( tok ) ; } } else if ( col > tok -> indstack [ tok -> indent ] ) { if ( tok -> indent + 1 >= MAXINDENT ) { tok -> done = E_TOODEEP ; tok -> cur = tok -> inp ; return ERRORTOKEN ; } if ( altcol <= tok -> altindstack [ tok -> indent ] ) { return indenterror ( tok ) ; } tok -> pendin ++ ; tok -> indstack [ ++ tok -> indent ] = col ; tok -> altindstack [ tok -> indent ] = altcol ; } else { while ( tok -> indent > 0 && col < tok -> indstack [ tok -> indent ] ) { tok -> pendin -- ; tok -> indent -- ; } if ( col!= tok -> indstack [ tok -> indent ] ) { tok -> done = E_DEDENT ; tok -> cur = tok -> inp ; return ERRORTOKEN ; } if ( altcol!= tok -> altindstack [ tok -> indent ] )

Fix:
<S2SV_ModStart> '#' ) { const char * prefix, * p, * type_start ; <S2SV_ModStart> tok ) ; } if ( tok -> type_comments ) { p = tok -> start ; prefix = type_comment_prefix ; while ( * prefix && p < tok -> cur ) { if ( * prefix =='<S2SV_blank>') { while ( * p =='<S2SV_blank>'|| * p == '\\t' ) { p ++ ; } } else if ( * prefix == * p ) { p ++ ; } else { break ; } prefix ++ ; } if (! * prefix ) { int is_type_ignore = 1 ; tok_backup ( tok, c ) ; type_start = p ; is_type_ignore = tok -> cur >= p + 6 && memcmp ( p, "ignore", 6 ) == 0 ; p += 6 ; while ( is_type_ignore && p < tok -> cur ) { if ( * p == '#' ) break ; is_type_ignore = is_type_ignore && ( * p =='<S2SV_blank>'|| * p == '\\t' ) ; p ++ ; } if ( is_type_ignore ) { if ( blankline ) { tok_nextc ( tok )
Buggy code:
 static int kvm_set_guest_paused ( struct kvm_vcpu * vcpu ) { <START_BUG> if (! vcpu -> arch. time_page ) <END_BUG> return - EINVAL ; vcpu -> arch. pvclock_set_guest_stopped_request = true ; kvm_make_request ( KVM_REQ_CLOCK_UPDATE, vcpu ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> arch. pv_time_enabled <S2SV_ModEnd> ) return -
Buggy code:
 struct r_bin_dyldcache_obj_t * r_bin_dyldcache_from_bytes_new ( const ut8 * buf, ut64 size ) { <START_BUG> struct r_bin_dyldcache_obj_t * bin ; <END_BUG>  if (! ( bin = malloc ( sizeof ( struct r_bin_dyldcache_obj_t ) ) ) ) { <START_BUG> return NULL ; } <END_BUG> memset ( bin, 0, sizeof ( struct r_bin_dyldcache_obj_t ) ) ;  if (! buf ) { return r_bin_dyldcache_free ( bin ) ; } bin -> b = r_buf_new ( ) ; <START_BUG> if (! r_buf_set_bytes ( bin -> b, buf, size ) ) { <END_BUG> return r_bin_dyldcache_free ( bin ) ; } if (! r_bin_dyldcache_init ( bin ) ) { return r_bin_dyldcache_free ( bin ) ; } bin -> size = size ; return bin ; }

Fix:
<S2SV_ModStart> r_bin_dyldcache_obj_t * bin = R_NEW0 ( struct r_bin_dyldcache_obj_t ) <S2SV_ModStart> if (! bin <S2SV_ModEnd> ) { return <S2SV_ModStart> NULL ; } <S2SV_ModEnd> if (! <S2SV_ModStart> ; if (! bin -> b ||
Buggy code:
 int prepare_binprm ( struct linux_binprm * bprm ) { <START_BUG> struct inode * inode = file_inode ( bprm -> file ) ; <END_BUG> umode_t mode = inode -> i_mode ; int retval ;  bprm -> cred -> euid = current_euid ( ) ; <START_BUG> bprm -> cred -> egid = current_egid ( ) ; if (! ( bprm -> file -> f_path. mnt -> mnt_flags & MNT_NOSUID ) &&! task_no_new_privs ( current ) && kuid_has_mapping ( bprm -> cred -> user_ns, inode -> i_uid ) && kgid_has_mapping ( bprm -> cred -> user_ns, inode -> i_gid ) ) { if ( mode & S_ISUID ) { bprm -> per_clear |= PER_CLEAR_ON_SETID ; bprm -> cred -> euid = inode -> i_uid ; } if ( ( mode & ( S_ISGID | S_IXGRP ) ) == ( S_ISGID | S_IXGRP ) ) { bprm -> per_clear |= PER_CLEAR_ON_SETID ; bprm -> cred -> egid = inode -> i_gid ; } } retval = security_bprm_set_creds ( bprm ) ; if ( retval ) return retval ; bprm -> cred_prepared = 1 ; memset ( bprm -> buf, 0, BINPRM_BUF_SIZE ) ; return kernel_read ( bprm -> file, 0, bprm -> buf, BINPRM_BUF_SIZE ) ; }<END_BUG>

Fix:
<S2SV_ModStart> bprm ) { <S2SV_ModEnd> int retval ; <S2SV_ModStart> int retval ; bprm_fill_uid ( bprm ) ; <S2SV_ModEnd> retval = security_bprm_set_creds