nus-yam/ex-repair huggingface dataset:
Buggy code:
 static Image * ReadPSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BoundingBox "BoundingBox:" # define BeginDocument "BeginDocument:" # define BeginXMPPacket "<?xpacket   begin=" # define EndXMPPacket "<?xpacket   end=" # define ICCProfile "BeginICCProfile:" # define CMYKCustomColor "CMYKCustomColor:" # define CMYKProcessColor "CMYKProcessColor:" # define DocumentMedia "DocumentMedia:" # define DocumentCustomColors "DocumentCustomColors:" # define DocumentProcessColors "DocumentProcessColors:" # define EndDocument "EndDocument:" # define HiResBoundingBox "HiResBoundingBox:" # define ImageData "ImageData:" # define PageBoundingBox "PageBoundingBox:" # define LanguageLevel "LanguageLevel:" # define PageMedia "PageMedia:" # define Pages "Pages:" # define PhotoshopProfile "BeginPhotoshop:" # define PostscriptLevel "!PS-" # define RenderPostscriptText "     Rendering   Postscript...     " # define SpotColor "+   " char command [ MagickPathExtent ], * density, filename [ MagickPathExtent ], geometry [ MagickPathExtent ], input_filename [ MagickPathExtent ], message [ MagickPathExtent ], * options, postscript_filename [ MagickPathExtent ] ; const char * option ; const DelegateInfo * delegate_info ; GeometryInfo geometry_info ; Image * image, * next, * postscript_image ; ImageInfo * read_info ; int c, file ; MagickBooleanType cmyk, fitPage, skip, status ; MagickStatusType flags ; PointInfo delta, resolution ; RectangleInfo page ; register char * p ; register ssize_t i ; SegmentInfo bounds, hires_bounds ; short int hex_digits [ 256 ] ; size_t length ; ssize_t count, priority ; StringInfo * profile ; unsigned long columns, extent, language_level, pages, rows, scene, spotcolor ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo

Fix:
<S2SV_ModStart> = extent ; if ( length > GetBlobSize ( image ) ) ThrowReaderException ( CorruptImageError, "InsufficientImageDataInFile" ) ;
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image2 ; goto END_OF_READING ; } MAT

Fix:
<S2SV_ModStart> "MemoryAllocationFailed" ) ; ( void ) ResetMagickMemory ( BImgBuff, 0, ldblk * sizeof ( double ) ) ;
Buggy code:
 static int read_new_config_info ( WavpackContext * wpc, WavpackMetadata * wpmd ) { int bytecnt = wpmd -> byte_length ; unsigned char * byteptr = wpmd -> data ; wpc -> version_five = 1 ; wpc -> file_format = wpc -> config. qmode = wpc -> channel_layout = 0 ; if ( wpc -> channel_reordering ) { free ( wpc -> channel_reordering ) ; wpc -> channel_reordering = NULL ; } <START_BUG> if ( bytecnt ) { <END_BUG> wpc -> file_format = * byteptr ++ ; wpc -> config. qmode = ( wpc -> config. qmode & ~ 0xff ) | * byteptr ++ ; bytecnt -= 2 ; if ( bytecnt ) { int nchans, i ; wpc -> channel_layout = ( int32_t ) * byteptr ++ << 16 ; bytecnt -- ; if ( bytecnt ) { wpc -> channel_layout += nchans = * byteptr ++ ; bytecnt -- ; if ( bytecnt ) { if ( bytecnt > nchans ) return FALSE ; wpc -> channel_reordering = malloc ( nchans ) ; if ( wpc -> channel_reordering ) { for ( i = 0 ; i < nchans ; ++ i ) if ( bytecnt ) { wpc -> channel_reordering [ i ] = * byteptr ++ ;  bytecnt -- ; <START_BUG> } else wpc -> channel_reordering [ i ] = i ; } } } else wpc -> channel_layout += wpc -> config. num_channels ; } } return TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> if ( bytecnt >= 2 <S2SV_ModStart> byteptr ++ ; if ( wpc -> channel_reordering [ i ] >= nchans ) wpc -> channel_reordering [ i ] = 0 ;
Buggy code:
 int main ( int argc, char * * argv ) { int frame_cnt = 0 ; FILE * outfile = NULL ; vpx_codec_ctx_t codec ; VpxVideoReader * reader = NULL ; const VpxVideoInfo * info = NULL ; const VpxInterface * decoder = NULL ; exec_name = argv [ 0 ] ; if ( argc!= 3 ) die ( "Invalid   number   of   arguments." ) ; reader = vpx_video_reader_open ( argv [ 1 ] ) ; if (! reader ) die ( "Failed   to   open   %s   for   reading.", argv [ 1 ] ) ; if (! ( outfile = fopen ( argv [ 2 ], "wb" ) ) ) die ( "Failed   to   open   %s   for   writing.", argv [ 2 ] ) ; info = vpx_video_reader_get_info ( reader ) ; decoder = get_vpx_decoder_by_fourcc ( info -> codec_fourcc ) ; if (! decoder ) die ( "Unknown   input   codec." ) ; <START_BUG> printf ( "Using   %s\\n", vpx_codec_iface_name ( decoder -> interface ( ) ) ) ; <END_BUG>  if ( vpx_codec_dec_init ( & codec, decoder -> interface ( ), NULL, 0 ) ) <START_BUG> die_codec ( & codec, "Failed   to   initialize   decoder" ) ; while ( vpx_video_reader_read_frame ( reader ) ) { vpx_codec_iter_t iter = NULL ; vpx_image_t * img = NULL ; size_t frame_size = 0 ; const unsigned char * frame = vpx_video_reader_get_frame ( reader, & frame_size ) ; if ( vpx_codec_decode ( & codec, frame, ( unsigned int ) frame_size, NULL, 0 ) ) die_codec ( & codec, "Failed   to   decode   frame" ) ; while ( ( img = vpx_codec_get_frame ( & codec, & iter ) )!= NULL ) { unsigned char digest [ 16 ] ; get_image_md5 ( img, digest ) ; print_md5 ( outfile, digest ) ; fprintf ( outfile, "     img-%dx%d-%04d.i420\\<END_BUG>

Fix:
<S2SV_ModStart> ( decoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart>, decoder -> codec_interface <S2SV_ModEnd> ( ),
Buggy code:
 static void stellaris_enet_unrealize ( DeviceState * dev, Error * * errp ) { stellaris_enet_state * s = STELLARIS_ENET ( dev ) ; <START_BUG> unregister_savevm ( DEVICE ( s ), "stellaris_enet", s ) ; <END_BUG> memory_region_destroy ( & s -> mmio ) ; }

Fix:
<S2SV_ModStart> dev ) ; <S2SV_ModEnd> memory_region_destroy ( &
Buggy code:
 void * vips_tracked_malloc ( size_t size ) { void * buf ; vips_tracked_init ( ) ; size += 16 ; <START_BUG> if (! ( buf = g_try_malloc ( size ) ) ) { <END_BUG> # ifdef DEBUG g_assert_not_reached ( ) ; # endif vips_error ( "vips_tracked", _ ( "out   of   memory   ---   size   ==   %dMB" ), ( int ) ( size // ( 1024.0 * 1024.0 ) ) ) ; g_warning ( _ ( "out   of   memory   ---   size   ==   %dMB" ), ( int ) ( size // ( 1024.0 * 1024.0 ) ) ) ; return ( NULL ) ; } g_mutex_lock ( vips_tracked_mutex ) ; * ( ( size_t * ) buf ) = size ; buf = ( void * ) ( ( char * ) buf + 16 ) ; vips_tracked_mem += size ; if ( vips_tracked_mem > vips_tracked_mem_highwater ) vips_tracked_mem_highwater = vips_tracked_mem ; vips_tracked_allocs += 1 ; # ifdef DEBUG_VERBOSE printf ( "vips_tracked_malloc:   %p,   %zd   bytes\\n", buf, size ) ; # endif g_mutex_unlock ( vips_tracked_mutex ) ; VIPS_GATE_MALLOC ( size ) ; return ( buf ) ; }

Fix:
<S2SV_ModStart> ( buf = g_try_malloc0 <S2SV_ModEnd> ( size )
Buggy code:
 static int em_loop ( struct x86_emulate_ctxt * ctxt ) <START_BUG> { <END_BUG> register_address_increment ( ctxt, reg_rmw ( ctxt, VCPU_REGS_RCX ), - 1 ) ; if ( ( address_mask ( ctxt, reg_read ( ctxt, VCPU_REGS_RCX ) )!= 0 ) && ( ctxt -> b == 0xe2 || test_cc ( ctxt -> b ^ 0x5, ctxt -> eflags ) ) )  jmp_rel ( ctxt, ctxt -> src. val ) ; <START_BUG> <END_BUG> return X86EMUL_CONTINUE ;  }

Fix:
<S2SV_ModStart> ctxt ) { int rc = X86EMUL_CONTINUE ; <S2SV_ModStart> ) ) ) rc = <S2SV_ModStart> ) ; return rc <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void oz_usb_rx ( struct oz_pd * pd, struct oz_elt * elt ) { struct oz_usb_hdr * usb_hdr = ( struct oz_usb_hdr * ) ( elt + 1 ) ; struct oz_usb_ctx * usb_ctx ; spin_lock_bh ( & pd -> app_lock [ OZ_APPID_USB ] ) ; usb_ctx = ( struct oz_usb_ctx * ) pd -> app_ctx [ OZ_APPID_USB ] ; if ( usb_ctx ) oz_usb_get ( usb_ctx ) ; spin_unlock_bh ( & pd -> app_lock [ OZ_APPID_USB ] ) ; if ( usb_ctx == NULL ) return ; if ( usb_ctx -> stopped ) goto done ; if ( usb_hdr -> elt_seq_num!= 0 ) { if ( ( ( usb_ctx -> rx_seq_num - usb_hdr -> elt_seq_num ) & 0x80 ) == 0 ) goto done ; } usb_ctx -> rx_seq_num = usb_hdr -> elt_seq_num ; switch ( usb_hdr -> type ) { case OZ_GET_DESC_RSP : { struct oz_get_desc_rsp * body = ( struct oz_get_desc_rsp * ) usb_hdr ; <START_BUG> int data_len = elt -> length - <END_BUG>  sizeof ( struct oz_get_desc_rsp ) + 1 ; <START_BUG> u16 offs = le16_to_cpu ( get_unaligned ( & body -> offset ) ) ; u16 total_size = le16_to_cpu ( get_unaligned ( & body -> total_size ) ) ; oz_dbg ( ON, "USB_REQ_GET_DESCRIPTOR   -   cnf\\n" ) ; oz_hcd_get_desc_cnf ( usb_ctx -> hport, body -> req_id, body -> rcode, body -> data, data_len, offs, total_size ) ; } break ; case OZ_SET_CONFIG_RSP : { struct oz_set_config_rsp * body = ( struct oz_set_config_rsp * ) usb_hdr ; oz_hcd<END_BUG>

Fix:
<S2SV_ModStart> ) usb_hdr ; u16 offs, total_size ; u8 data_len ; if ( elt -> length < sizeof ( struct oz_get_desc_rsp ) - 1 ) break ; <S2SV_ModEnd> data_len = elt <S2SV_ModStart> -> length - ( <S2SV_ModStart> ( struct oz_get_desc_rsp ) - 1 ) ; offs = le16_to_cpu ( get_unaligned ( & body -> offset ) ) ; total_size = le16_to_cpu ( get_unaligned ( & body -> total_size ) ) ; oz_dbg ( ON, "USB_REQ_GET_DESCRIPTOR <S2SV_blank> - <S2SV_blank> cnf\\n" ) ; oz_hcd_get_desc_cnf ( usb_ctx -> hport, body -> req_id, body -> rcode, body -> data, data_len, offs, total_size ) ; } break ; case OZ_SET_CONFIG_RSP : { struct oz_set_config_rsp * body = ( struct oz_set_config_rsp * ) usb_hdr ; oz_hcd_control_cnf ( usb_ctx -> hport,
Buggy code:
 ssize_t tcp_splice_read ( struct socket * sock, loff_t * ppos, struct pipe_inode_info * pipe, size_t len, unsigned int flags ) { struct sock * sk = sock -> sk ; struct tcp_splice_state tss = {. pipe = pipe,. len = len,. flags = flags, } ; long timeo ; ssize_t spliced ; int ret ; sock_rps_record_flow ( sk ) ; if ( unlikely ( * ppos ) ) return - ESPIPE ; ret = spliced = 0 ; lock_sock ( sk ) ; timeo = sock_rcvtimeo ( sk, sock -> file -> f_flags & O_NONBLOCK ) ; while ( tss. len ) { ret = __tcp_splice_read ( sk, & tss ) ; if ( ret < 0 ) break ; else if (! ret ) { if ( spliced ) break ; if ( sock_flag ( sk, SOCK_DONE ) ) break ; if ( sk -> sk_err ) { ret = sock_error ( sk ) ; break ; } if ( sk -> sk_shutdown & RCV_SHUTDOWN ) break ; if ( sk -> sk_state == TCP_CLOSE ) { if (! sock_flag ( sk, SOCK_DONE ) ) ret = - ENOTCONN ; break ; } if (! timeo ) { ret = - EAGAIN ; break ; } <START_BUG> sk_wait_data ( sk, & timeo, NULL ) ; <END_BUG> if ( signal_pending ( current ) ) { ret = sock_intr_errno ( timeo ) ; break ; } continue ; } tss. len -= ret ; spliced += ret ; if (! timeo ) break ; release_sock ( sk ) ; lock_sock ( sk ) ; if ( sk -> sk_err || sk -> sk_state == TCP_CLOSE || ( sk -> sk_shutdown & RCV_SHUTDOWN ) || signal_pending ( current ) ) break ; } release_sock ( sk ) ; if ( spliced ) return spliced ; return ret ; }

Fix:
<S2SV_ModStart> break ; } if (! skb_queue_empty ( & sk -> sk_receive_queue ) ) break ;
Buggy code:
 static inline int r_sys_mkdirp ( char * dir ) { int ret = 1 ; const char slash = DIRSEP ; char * path = dir ; char * ptr = path ; if ( * ptr == slash ) { ptr ++ ; } # if __SDB_WINDOWS__ char * p = strstr ( ptr, ":\\\\" ) ; if ( p ) { <START_BUG> ptr = p + 2 ; <END_BUG> } # endif while ( ( ptr = strchr ( ptr, slash ) ) ) { * ptr = 0 ; if (! r_sys_mkdir ( path ) && r_sys_mkdir_failed ( ) ) { eprintf ( "r_sys_mkdirp:   fail   \'%s\'   of   \'%s\'\\n", path, dir ) ; * ptr = slash ; return 0 ; } * ptr = slash ; ptr ++ ; } return ret ; }

Fix:
<S2SV_ModStart> = p + 3 <S2SV_ModEnd> ; } #
Buggy code:
 void ourWriteOut ( CURL * curl, struct OutStruct * outs, const char * writeinfo ) { FILE * stream = stdout ; const char * ptr = writeinfo ; char * stringp = NULL ; long longinfo ; double doubleinfo ; while ( ptr && * ptr ) { <START_BUG> if ( '%' == * ptr ) { <END_BUG> if ( '%' == ptr [ 1 ] ) { fputc ( '%', stream ) ; ptr += 2 ; } else { char * end ; char keepit ; int i ; if ( '{' == ptr [ 1 ] ) { bool match = FALSE ; end = strchr ( ptr, '}' ) ; ptr += 2 ; if (! end ) { fputs ( "%{", stream ) ; continue ; } keepit = * end ; * end = 0 ; for ( i = 0 ; replacements [ i ]. name ; i ++ ) { if ( curl_strequal ( ptr, replacements [ i ]. name ) ) { match = TRUE ; switch ( replacements [ i ]. id ) { case VAR_EFFECTIVE_URL : if ( ( CURLE_OK == curl_easy_getinfo ( curl, CURLINFO_EFFECTIVE_URL, & stringp ) ) && stringp ) fputs ( stringp, stream ) ; break ; case VAR_HTTP_CODE : if ( CURLE_OK == curl_easy_getinfo ( curl, CURLINFO_RESPONSE_CODE, & longinfo ) ) fprintf ( stream, "%03ld", longinfo ) ; break ; case VAR_HTTP_CODE_PROXY : if ( CURLE_OK == curl_easy_getinfo ( curl, CURLINFO_HTTP_CONNECTCODE, & longinfo ) ) fprintf ( stream, "%03ld", longinfo ) ; break ; case VAR_HEADER_SIZE : if ( CURLE_OK == curl_easy_getinfo ( curl, CURLINFO_HEADER_SIZE, & longinfo ) ) fprintf ( stream, "%ld", longinfo ) ; break ; case VAR_REQUEST_SIZE : if ( CURLE_OK == curl_easy_getinfo ( curl, CURLINFO_REQUEST_SIZE, & longinfo ) ) fprintf ( stream, "%ld", longinfo ) ; break ; case VAR_NUM_CONNECTS : if ( CURLE_OK == curl_easy_getinfo ( curl, CURLINFO_NUM_CONNECTS, & longinfo ) ) f

Fix:
<S2SV_ModStart> == * ptr && ptr [ 1 ]
Buggy code:
 static int jpc_dec_tileinit ( jpc_dec_t * dec, jpc_dec_tile_t * tile ) { jpc_dec_tcomp_t * tcomp ; int compno ; int rlvlno ; jpc_dec_rlvl_t * rlvl ; jpc_dec_band_t * band ; jpc_dec_prc_t * prc ; int bndno ; jpc_tsfb_band_t * bnd ; int bandno ; jpc_dec_ccp_t * ccp ; int prccnt ; jpc_dec_cblk_t * cblk ; int cblkcnt ; uint_fast32_t tlprcxstart ; uint_fast32_t tlprcystart ; uint_fast32_t brprcxend ; uint_fast32_t brprcyend ; uint_fast32_t tlcbgxstart ; uint_fast32_t tlcbgystart ; uint_fast32_t brcbgxend ; uint_fast32_t brcbgyend ; uint_fast32_t cbgxstart ; uint_fast32_t cbgystart ; uint_fast32_t cbgxend ; uint_fast32_t cbgyend ; uint_fast32_t tlcblkxstart ; uint_fast32_t tlcblkystart ; uint_fast32_t brcblkxend ; uint_fast32_t brcblkyend ; uint_fast32_t cblkxstart ; uint_fast32_t cblkystart ; uint_fast32_t cblkxend ; uint_fast32_t cblkyend ; uint_fast32_t tmpxstart ; uint_fast32_t tmpystart ; uint_fast32_t tmpxend ; uint_fast32_t tmpyend ; jpc_dec_cp_t * cp ; <START_BUG> jpc_tsfb_band_t bnds [ 64 ] ; <END_BUG> jpc_pchg_t * pchg ; int pchgno ; jpc_dec_cmpt_t * cmpt ; cp = tile -> cp ; tile -> realmode = 0 ; if ( cp -> m

Fix:
<S2SV_ModStart> jpc_tsfb_band_t bnds [ JPC_MAXBANDS <S2SV_ModEnd> ] ; jpc_pchg_t
Buggy code:
 CURLcode Curl_close ( struct Curl_easy * data ) { struct Curl_multi * m ; if (! data ) return CURLE_OK ; Curl_expire_clear ( data ) ; m = data -> multi ; if ( m ) curl_multi_remove_handle ( data -> multi, data ) ; <START_BUG> if ( data -> multi_easy ) <END_BUG>  curl_multi_cleanup ( data -> multi_easy ) ; <START_BUG> Curl_llist_destroy ( & data -> state. timeoutlist, NULL ) ; data -> magic = 0 ; if ( data -> state. rangestringalloc ) free ( data -> state. range ) ; Curl_free_request_state ( data ) ; Curl_ssl_close_all ( data ) ; Curl_safefree ( data -> state. first_host ) ; Curl_safefree ( data -> state. scratch ) ; Curl_ssl_free_certinfo ( data ) ; free ( data -> req. newurl ) ; data -> req. newurl = NULL ; if ( data -> change. referer_alloc ) { Curl_safefree ( data -> change. referer ) ; data -> change. referer_alloc = FALSE ; } data -> change. referer = NULL ; Curl_up_free ( data ) ; Curl_safefree ( data -> state. buffer ) ; Curl_safefree ( data -> state. headerbuff ) ; Curl_safefree ( data -> state. ulbuf ) ; Curl_flush_cookies ( data, 1 ) ; Curl_digest_cleanup ( data ) ; Curl_safefree ( data -> info. contenttype ) ; Curl_safefree ( data -> info. wouldredirect ) ; Curl_resolver_cleanup ( data -> state. resolver ) ; Curl_http2_cleanup_dependencies ( data ) ; Curl_convert_close ( data ) ; if ( data -> share ) { Curl_share_lock ( data, CURL_LOCK_DATA_SHARE, CURL_LOCK_ACCESS_SINGLE ) ; data -> share -> dirty -- ; Curl_share_unlock ( data, CURL_LOCK_DATA_SHARE ) ; } Curl_wildcard_dtor ( & data -> wildcard ) ; Curl_freeset ( data ) ; free ( data ) ; return CURLE_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> -> multi_easy ) { <S2SV_ModStart> multi_easy ) ; data -> multi_easy = NULL ; }
Buggy code:
 static int load_misc_binary ( struct linux_binprm * bprm ) { Node * fmt ; struct file * interp_file = NULL ; char iname [ BINPRM_BUF_SIZE ] ; const char * iname_addr = iname ; int retval ; int fd_binary = - 1 ; retval = - ENOEXEC ; if (! enabled ) goto _ret ; read_lock ( & entries_lock ) ; fmt = check_file ( bprm ) ; if ( fmt ) strlcpy ( iname, fmt -> interpreter, BINPRM_BUF_SIZE ) ; read_unlock ( & entries_lock ) ; if (! fmt ) goto _ret ; if (! ( fmt -> flags & MISC_FMT_PRESERVE_ARGV0 ) ) { retval = remove_arg_zero ( bprm ) ; if ( retval ) goto _ret ; } if ( fmt -> flags & MISC_FMT_OPEN_BINARY ) { fd_binary = get_unused_fd ( ) ; if ( fd_binary < 0 ) { retval = fd_binary ; goto _ret ; } fd_install ( fd_binary, bprm -> file ) ; would_dump ( bprm, bprm -> file ) ; allow_write_access ( bprm -> file ) ; bprm -> file = NULL ; bprm -> interp_flags |= BINPRM_FLAGS_EXECFD ; bprm -> interp_data = fd_binary ; } else { allow_write_access ( bprm -> file ) ; fput ( bprm -> file ) ; bprm -> file = NULL ; } retval = copy_strings_kernel ( 1, & bprm -> interp, bprm ) ; if ( retval < 0 ) goto _error ; bprm -> argc ++ ; retval = copy_strings_kernel ( 1, & iname_addr, bprm ) ; if ( retval < 0 ) goto _error ; bprm -> argc ++ ; <START_BUG> bprm -> interp = iname ; <END_BUG> interp_file = open_exec ( iname ) ; retval = PTR_ERR ( interp_file ) ; if ( IS_ERR ( interp_file ) ) goto _error ; bprm -> file = interp_file ; if ( fmt -> flags & MISC

Fix:
<S2SV_ModStart> argc ++ ; retval = bprm_change_interp ( iname, bprm ) ; if ( retval < 0 ) goto _error <S2SV_ModEnd> ; interp_file =
Buggy code:
 static void nfs4_open_confirm_release ( void * calldata ) { struct nfs4_opendata * data = calldata ; struct nfs4_state * state = NULL ; if ( data -> cancelled == 0 ) goto out_free ; if (! data -> rpc_done ) goto out_free ; state = nfs4_opendata_to_nfs4_state ( data ) ; if (! IS_ERR ( state ) ) <START_BUG> nfs4_close_state ( & data -> path, state, data -> o_arg. open_flags ) ; <END_BUG> out_free : nfs4_opendata_put ( data ) ; }

Fix:
<S2SV_ModStart> -> o_arg. fmode <S2SV_ModEnd> ) ; out_free
Buggy code:
 static void handle_rx ( struct vhost_net * net ) { struct vhost_net_virtqueue * nvq = & net -> vqs [ VHOST_NET_VQ_RX ] ; struct vhost_virtqueue * vq = & nvq -> vq ; unsigned uninitialized_var ( in ), log ; struct vhost_log * vq_log ; struct msghdr msg = {. msg_name = NULL,. msg_namelen = 0,. msg_control = NULL,. msg_controllen = 0,. msg_iov = vq -> iov,. msg_flags = MSG_DONTWAIT, } ; struct virtio_net_hdr_mrg_rxbuf hdr = {. hdr. flags = 0,. hdr. gso_type = VIRTIO_NET_HDR_GSO_NONE } ; size_t total_len = 0 ; int err, mergeable ; s16 headcount ; size_t vhost_hlen, sock_hlen ; size_t vhost_len, sock_len ; struct socket * sock ; mutex_lock ( & vq -> mutex ) ; sock = vq -> private_data ; if (! sock ) goto out ; vhost_disable_notify ( & net -> dev, vq ) ; vhost_hlen = nvq -> vhost_hlen ; sock_hlen = nvq -> sock_hlen ; vq_log = unlikely ( vhost_has_feature ( & net -> dev, VHOST_F_LOG_ALL ) )? vq -> log : NULL ; mergeable = vhost_has_feature ( & net -> dev, VIRTIO_NET_F_MRG_RXBUF ) ; while ( ( sock_len = peek_head_len ( sock -> sk ) ) ) { sock_len += sock_hlen ; vhost_len = sock_len + vhost_hlen ; headcount = get_rx_bufs ( vq, vq -> heads, vhost_len, & in, vq_log, & log, likely ( mergeable )? UIO_MAXIOV : 1 ) ; if ( unlikely ( headcount < 0 ) ) break ; <START_BUG> if (! headcount ) { <END_BUG> if ( unlikely ( vhost_enable_notify ( & net -> dev, vq

Fix:
<S2SV_ModStart> ; if ( unlikely ( headcount > UIO_MAXIOV ) ) { <S2SV_ModEnd> msg. msg_iovlen <S2SV_ModStart>. msg_iovlen = 1 <S2SV_ModEnd> ; err = <S2SV_ModStart> & msg, 1 <S2SV_ModEnd>, MSG_DONTWAIT | <S2SV_ModStart> MSG_TRUNC ) ; pr_debug ( "Discarded <S2SV_blank> rx <S2SV_blank> packet: <S2SV_blank> len <S2SV_blank> %zd\\n", sock_len ) ; continue ; } if (! headcount ) { if ( unlikely ( vhost_enable_notify ( & net -> dev, vq ) ) ) { vhost_disable_notify ( & net -> dev, vq ) ; continue ; } break ; } if ( unlikely ( ( vhost_hlen ) ) ) move_iovec_hdr ( vq -> iov, nvq -> hdr, vhost_hlen, in ) ; else copy_iovec_hdr ( vq -> iov, nvq -> hdr, sock_hlen, in ) ; msg. msg_iovlen = in ; err = sock -> ops -> recvmsg ( NULL, sock, & msg, sock_len, MSG_DONTWAIT | MSG_TRUNC ) ;
Buggy code:
 void Init_ossl_cipher ( void ) { # if 0 mOSSL = rb_define_module ( "OpenSSL" ) ; eOSSLError = rb_define_class_under ( mOSSL, "OpenSSLError", rb_eStandardError ) ; # endif cCipher = rb_define_class_under ( mOSSL, "Cipher", rb_cObject ) ; eCipherError = rb_define_class_under ( cCipher, "CipherError", eOSSLError ) ; rb_define_alloc_func ( cCipher, ossl_cipher_alloc ) ; rb_define_copy_func ( cCipher, ossl_cipher_copy ) ; rb_define_module_function ( cCipher, "ciphers", ossl_s_ciphers, 0 ) ; rb_define_method ( cCipher, "initialize", ossl_cipher_initialize, 1 ) ; rb_define_method ( cCipher, "reset", ossl_cipher_reset, 0 ) ; rb_define_method ( cCipher, "encrypt", ossl_cipher_encrypt, - 1 ) ; rb_define_method ( cCipher, "decrypt", ossl_cipher_decrypt, - 1 ) ; rb_define_method ( cCipher, "pkcs5_keyivgen", ossl_cipher_pkcs5_keyivgen, - 1 ) ; rb_define_method ( cCipher, "update", ossl_cipher_update, - 1 ) ; rb_define_method ( cCipher, "final", ossl_cipher_final, 0 ) ; rb_define_method ( cCipher, "name", ossl_cipher_name, 0 ) ; rb_define_method ( cCipher, "key=", ossl_cipher_set_key, 1 ) ; rb_define_method ( cCipher, "auth_data=", ossl_cipher_set_auth_data, 1 ) ; rb_define_method ( cCipher, "auth_tag=", ossl_cipher_set_auth_tag, 1 ) ; rb_define_method ( cCipher, "auth_tag", ossl_cipher_get_auth_tag, - 1 ) ; rb_define_method ( cCipher, "auth_

Fix:
<S2SV_ModStart> "auth_tag_len" ) ; id_key_set = rb_intern_const ( "key_set" ) ;
Buggy code:
 static MagickBooleanType ReadPSDLayersInternal ( Image * image, const ImageInfo * image_info, const PSDInfo * psd_info, const MagickBooleanType skip_layers, ExceptionInfo * exception ) { char type [ 4 ] ; LayerInfo * layer_info ; MagickSizeType size ; MagickBooleanType status ; register ssize_t i ; ssize_t count, j, number_layers ; size = GetPSDSize ( psd_info, image ) ; if ( size == 0 ) { ( void ) ReadBlobLong ( image ) ; count = ReadBlob ( image, 4, ( unsigned char * ) type ) ; ReversePSDString ( image, type, 4 ) ; status = MagickFalse ; if ( ( count == 0 ) || ( LocaleNCompare ( type, "8BIM", 4 )!= 0 ) ) return ( MagickTrue ) ; else { count = ReadBlob ( image, 4, ( unsigned char * ) type ) ; ReversePSDString ( image, type, 4 ) ; if ( ( count!= 0 ) && ( LocaleNCompare ( type, "Lr16", 4 ) == 0 ) ) size = GetPSDSize ( psd_info, image ) ; else return ( MagickTrue ) ; } } status = MagickTrue ; if ( size!= 0 ) { layer_info = ( LayerInfo * ) NULL ; number_layers = ( short ) ReadBlobShort ( image ) ; if ( number_layers < 0 ) { number_layers = MagickAbsoluteValue ( number_layers ) ; if ( image -> debug!= MagickFalse ) ( void ) LogMagickEvent ( CoderEvent, GetMagickModule ( ), "     negative   layer   count   corrected   for" ) ; image -> alpha_trait = BlendPixelTrait ; } if ( skip_layers!= MagickFalse ) return ( MagickTrue ) ; if ( image -> debug!= MagickFalse ) ( void ) LogMagickEvent ( CoderEvent, GetMagickModule ( ), "     image   contains   %.20g   layers", ( double ) number_layers ) ; if ( number_layers == 0 ) ThrowBinaryException ( CorruptImageError, "InvalidNumberOfLayers", image -> filename ) ; layer_info = ( LayerInfo * ) AcquireQuantumMemory ( ( size_t

Fix:
<S2SV_ModStart> ) ) ; if ( DiscardBlobBytes ( image, length ) == <S2SV_ModEnd> MagickFalse ) { <S2SV_ModStart> ( CorruptImageError, "UnexpectedEndOfFile" <S2SV_ModEnd>, image -> <S2SV_ModStart> image -> filename <S2SV_ModEnd> ) ; }
Buggy code:
 static __inline__ int scm_check_creds ( struct ucred * creds ) { const struct cred * cred = current_cred ( ) ; kuid_t uid = make_kuid ( cred -> user_ns, creds -> uid ) ; kgid_t gid = make_kgid ( cred -> user_ns, creds -> gid ) ; if (! uid_valid ( uid ) ||! gid_valid ( gid ) ) return - EINVAL ; if ( ( creds -> pid == task_tgid_vnr ( current ) || <START_BUG> ns_capable ( current -> nsproxy -> pid_ns -> user_ns, CAP_SYS_ADMIN ) ) && <END_BUG> ( ( uid_eq ( uid, cred -> uid ) || uid_eq ( uid, cred -> euid ) || uid_eq ( uid, cred -> suid ) ) || nsown_capable ( CAP_SETUID ) ) && ( ( gid_eq ( gid, cred -> gid ) || gid_eq ( gid, cred -> egid ) || gid_eq ( gid, cred -> sgid ) ) || nsown_capable ( CAP_SETGID ) ) ) { return 0 ; } return - EPERM ; }

Fix:
<S2SV_ModStart> || ns_capable ( task_active_pid_ns ( current ) <S2SV_ModEnd> -> user_ns,
Buggy code:
 static int ext4_split_unwritten_extents ( handle_t * handle, struct inode * inode, struct ext4_map_blocks * map, struct ext4_ext_path * path, int flags ) { <START_BUG> struct ext4_extent * ex, newex, orig_ex ; <END_BUG> struct ext4_extent * ex1 = NULL ; struct ext4_extent * ex2 = NULL ; struct ext4_extent * ex3 = NULL ; ext4_lblk_t ee_block, eof_block ;  unsigned int allocated, ee_len, depth ; <START_BUG> ext4_fsblk_t newblock ; int err = 0 ; int may_zeroout ; ext_debug ( "ext4_split_unwritten_extents:   inode   %lu,   logical" "block   %llu,   max_blocks   %u\\n", inode -> i_ino, ( unsigned long long ) map -> m_lblk, map -> m_len ) ; eof_block = ( inode -> i_size + inode -> i_sb -> s_blocksize - 1 ) >> inode -> i_sb -> s_blocksize_bits ; if ( eof_block < map -> m_lblk + map -> m_len ) eof_block = map -> m_lblk + map -> m_len ; depth = ext_depth ( inode ) ; ex = path [ depth ]. p_ext ; ee_block = le32_to_cpu ( ex -> ee_block ) ; ee_len = ext4_ext_get_actual_len ( ex ) ; <END_BUG> allocated = ee_len - ( map -> m_lblk - ee_block ) ;  newblock = map -> m_lblk - ee_block + ext4_ext_pblock ( ex ) ; ex2 = ex ; orig_ex. ee_block = ex -> ee_block ; orig_ex. ee_len = cpu_to_le16 ( ee_len ) ; ext4_ext_store_pblock ( & orig_ex, ext4_ext_pblock ( ex ) ) ; <START_BUG> may_zeroout = ee_block + ee_len <= eof_block ; <END_BUG> if ( ( map -> m_lblk == ee_block ) && ( allocated <= map -> m_len ) ) return allocated ; 

Fix:
<S2SV_ModStart> flags ) { ext4_lblk_t eof_block ; ext4_lblk_t ee_block ; <S2SV_ModStart> ext4_extent * ex <S2SV_ModEnd> ; unsigned int <S2SV_ModStart> ; unsigned int ee_len ; int split_flag = 0, depth <S2SV_ModEnd> ; ext_debug ( <S2SV_ModStart> ex ) ; split_flag |= <S2SV_ModEnd> ee_block + ee_len <S2SV_ModStart> ee_len <= eof_block? EXT4_EXT_MAY_ZEROOUT : 0 ; split_flag |= EXT4_EXT_MARK_UNINIT2 ; flags |= EXT4_GET_BLOCKS_PRE_IO ; return ext4_split_extent <S2SV_ModEnd> ( handle, <S2SV_ModStart> inode, path, map, split_flag <S2SV_ModEnd>, flags ) <S2SV_ModStart>, flags ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int netlink_sendmsg ( struct kiocb * kiocb, struct socket * sock, struct msghdr * msg, size_t len ) { struct sock_iocb * siocb = kiocb_to_siocb ( kiocb ) ; struct sock * sk = sock -> sk ; struct netlink_sock * nlk = nlk_sk ( sk ) ; struct sockaddr_nl * addr = msg -> msg_name ; u32 dst_pid ; u32 dst_group ; struct sk_buff * skb ; int err ; struct scm_cookie scm ; if ( msg -> msg_flags & MSG_OOB ) return - EOPNOTSUPP ; if ( NULL == siocb -> scm ) siocb -> scm = & scm ; <START_BUG> err = scm_send ( sock, msg, siocb -> scm ) ; <END_BUG> if ( err < 0 ) return err ; if ( msg -> msg_namelen ) { err = - EINVAL ; if ( addr -> nl_family!= AF_NETLINK ) goto out ; dst_pid = addr -> nl_pid ; dst_group = ffs ( addr -> nl_groups ) ; err = - EPERM ; if ( dst_group &&! netlink_capable ( sock, NL_NONROOT_SEND ) ) goto out ; } else { dst_pid = nlk -> dst_pid ; dst_group = nlk -> dst_group ; } if (! nlk -> pid ) { err = netlink_autobind ( sock ) ; if ( err ) goto out ; } err = - EMSGSIZE ; if ( len > sk -> sk_sndbuf - 32 ) goto out ; err = - ENOBUFS ; skb = alloc_skb ( len, GFP_KERNEL ) ; if ( skb == NULL ) goto out ; NETLINK_CB ( skb ). pid = nlk -> pid ; NETLINK_CB ( skb ). dst_group = dst_group ; memcpy ( NETLINK_CREDS ( skb ), & siocb -> scm -> creds, sizeof ( struct ucred ) ) ; err = - EFAULT ; if ( memcpy_fromiovec ( skb_put ( skb, len ), msg -> msg_iov, len ) ) { kfree_sk

Fix:
<S2SV_ModStart> siocb -> scm, true
Buggy code:
 SecureElementStatus_t SecureElementProcessJoinAccept ( JoinReqIdentifier_t joinReqType, uint8_t * joinEui, uint16_t devNonce, uint8_t * encJoinAccept, uint8_t encJoinAcceptSize, uint8_t * decJoinAccept, uint8_t * versionMinor ) { if ( ( encJoinAccept == NULL ) || ( decJoinAccept == NULL ) || ( versionMinor == NULL ) ) { <START_BUG> return SECURE_ELEMENT_ERROR_NPE ; <END_BUG> } KeyIdentifier_t encKeyID = NWK_KEY ; if ( joinReqType!= JOIN_REQ ) { encKeyID = J_S_ENC_KEY ; } memcpy1 ( decJoinAccept, encJoinAccept, encJoinAcceptSize ) ; if ( SecureElementAesEncrypt ( encJoinAccept + LORAMAC_MHDR_FIELD_SIZE, encJoinAcceptSize - LORAMAC_MHDR_FIELD_SIZE, encKeyID, decJoinAccept + LORAMAC_MHDR_FIELD_SIZE )!= SECURE_ELEMENT_SUCCESS ) { return SECURE_ELEMENT_FAIL_ENCRYPT ; } * versionMinor = ( ( decJoinAccept [ 11 ] & 0x80 ) == 0x80 )? 1 : 0 ; uint32_t mic = 0 ; mic = ( ( uint32_t ) decJoinAccept [ encJoinAcceptSize - LORAMAC_MIC_FIELD_SIZE ] << 0 ) ; mic |= ( ( uint32_t ) decJoinAccept [ encJoinAcceptSize - LORAMAC_MIC_FIELD_SIZE + 1 ] << 8 ) ; mic |= ( ( uint32_t ) decJoinAccept [ encJoinAcceptSize - LORAMAC_MIC_FIELD_SIZE + 2 ] << 16 ) ; mic |= ( ( uint32_t ) decJoinAccept [ encJoinAcceptSize - LORAMAC_MIC_FIELD_SIZE + 3 ] << 24 ) ; if ( * versionMinor == 0 ) { if ( SecureElementVerifyAesCmac ( decJoinAccept, ( encJoinAcceptSize - LORAMAC_MIC_FIELD_SIZE ), mic, NWK_KEY )!= SECURE_ELEMENT_SUCCESS ) { return SECURE_ELEMENT_FAIL_CMAC ; } } # if ( USE

Fix:
<S2SV_ModStart> { return SECURE_ELEMENT_ERROR_NPE ; } if ( encJoinAcceptSize > LORAMAC_JOIN_ACCEPT_FRAME_MAX_SIZE ) { return SECURE_ELEMENT_ERROR_BUF_SIZE
Buggy code:
 static pfn_t kvm_pin_pages ( struct kvm_memory_slot * slot, gfn_t gfn, <START_BUG> unsigned long size ) <END_BUG> { gfn_t end_gfn ; pfn_t pfn ; pfn = gfn_to_pfn_memslot ( slot, gfn ) ;  end_gfn = gfn + ( size >> PAGE_SHIFT ) ; <START_BUG> gfn += 1 ; if ( is_error_noslot_pfn ( pfn ) ) return pfn ; while ( gfn < end_gfn ) gfn_to_pfn_memslot ( slot, gfn ++ ) ; return pfn ; }<END_BUG>

Fix:
<S2SV_ModStart>, unsigned long npages <S2SV_ModEnd> ) { gfn_t <S2SV_ModStart> = gfn + npages <S2SV_ModEnd> ; gfn +=
Buggy code:
 jas_image_t * bmp_decode ( jas_stream_t * in, char * optstr ) { jas_image_t * image ; bmp_hdr_t hdr ; bmp_info_t * info ; uint_fast16_t cmptno ; jas_image_cmptparm_t cmptparms [ 3 ] ; jas_image_cmptparm_t * cmptparm ; uint_fast16_t numcmpts ; long n ; <START_BUG> image = 0 ; <END_BUG> info = 0 ; if ( optstr ) { jas_eprintf ( "warning:   ignoring   BMP   decoder   options\\n" ) ; } jas_eprintf ( "THE   BMP   FORMAT   IS   NOT   FULLY   SUPPORTED!\\n" "THAT   IS,   THE   JASPER   SOFTWARE   CANNOT   DECODE   ALL   TYPES   OF   BMP   DATA.\\n" "IF   YOU   HAVE   ANY   PROBLEMS,   PLEASE   TRY   CONVERTING   YOUR   IMAGE   DATA\\n" "TO   THE   PNM   FORMAT,   AND   USING   THIS   FORMAT   INSTEAD.\\n" ) ; if ( bmp_gethdr ( in, & hdr ) ) { jas_eprintf ( "cannot   get   header\\n" ) ; goto error ; } JAS_DBGLOG ( 1, ( "BMP   header:   magic   0x%x;   siz   %d;   res1   %d;   res2   %d;   off   %d\\n", hdr. magic, hdr. siz, hdr. reserved1, hdr. reserved2, hdr. off ) ) ; if (! ( info = bmp_getinfo ( in ) ) ) { jas_eprintf ( "cannot   get   info\\n" ) ; goto error ; } JAS_DBGLOG ( 1, ( "BMP   information:   len   %ld;   width   %ld;   height   %ld;   numplanes   %d;   " "depth   %d;   enctype   %ld;   siz   %ld;   hres   %ld;  

Fix:
<S2SV_ModStart> long n ; bmp_dec_importopts_t opts ; size_t num_samples ; image = 0 ; info = 0 ; if ( bmp_dec_parseopts ( optstr, & opts ) ) { goto error <S2SV_ModEnd> ; } jas_eprintf <S2SV_ModStart> jas_eprintf ( "corrupt <S2SV_blank> bit <S2SV_blank> stream\\n" ) ; goto error ; } if (! jas_safe_size_mul3 ( info -> width, info -> height, info -> numplanes, & num_samples ) ) { jas_eprintf ( "image <S2SV_blank> size <S2SV_blank> too <S2SV_blank> large\\n" ) ; goto error ; } if ( opts. max_samples > 0 && num_samples > opts. max_samples ) { jas_eprintf ( "maximum <S2SV_blank> number <S2SV_blank> of <S2SV_blank> pixels <S2SV_blank> exceeded <S2SV_blank> (%zu)\\n", opts. max_samples
Buggy code:
 void * gdImageGifPtr ( gdImagePtr im, int * size ) { void * rv ; gdIOCtx * out = gdNewDynamicCtx ( 2048, NULL ) ; <START_BUG> gdImageGifCtx ( im, out ) ; <END_BUG>  rv = gdDPExtractData ( out, size ) ; <START_BUG> out -> gd_free ( out ) ; return rv ; }<END_BUG>

Fix:
<S2SV_ModStart> NULL ) ; if (! _gdImageGifCtx <S2SV_ModEnd> ( im, <S2SV_ModStart>, out ) ) { <S2SV_ModEnd> rv = gdDPExtractData <S2SV_ModStart> size ) ; } else { rv = NULL ; }
Buggy code:
 <START_BUG> int mutt_b64_decode ( char * out, const char * in ) <END_BUG> { int len = 0 ; unsigned char digit4 ; do { const unsigned char digit1 = in [ 0 ] ; if ( ( digit1 > 127 ) || ( base64val ( digit1 ) == BAD ) ) return - 1 ; const unsigned char digit2 = in [ 1 ] ; if ( ( digit2 > 127 ) || ( base64val ( digit2 ) == BAD ) ) return - 1 ; const unsigned char digit3 = in [ 2 ] ; if ( ( digit3 > 127 ) || ( ( digit3!= '=' ) && ( base64val ( digit3 ) == BAD ) ) ) return - 1 ; digit4 = in [ 3 ] ; if ( ( digit4 > 127 ) || ( ( digit4!= '=' ) && ( base64val ( digit4 ) == BAD ) ) ) return - 1 ; in += 4 ;  * out ++ = ( base64val ( digit1 ) << 2 ) | ( base64val ( digit2 ) >> 4 ) ; <START_BUG> len ++ ; if ( digit3!= '=' ) { <END_BUG> * out ++ = ( ( base64val ( digit2 ) << 4 ) & 0xf0 ) | ( base64val ( digit3 ) >> 2 ) ;  len ++ ; if ( digit4!= '=' ) { <START_BUG> * out ++ = ( ( base64val ( digit3 ) << 6 ) & 0xc0 ) | base64val ( digit4 ) ; <END_BUG> len ++ ; } } } while ( * in && digit4!= '=' ) ; return len ; }

Fix:
<S2SV_ModStart> char * in, size_t olen <S2SV_ModStart> += 4 ; if ( len == olen ) return len ; <S2SV_ModStart> '=' ) { if ( len == olen ) return len ; <S2SV_ModStart> '=' ) { if ( len == olen ) return len ;
Buggy code:
 int rds_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int msg_flags ) { struct sock * sk = sock -> sk ; struct rds_sock * rs = rds_sk_to_rs ( sk ) ; long timeo ; int ret = 0, nonblock = msg_flags & MSG_DONTWAIT ; struct sockaddr_in * sin ; struct rds_incoming * inc = NULL ; timeo = sock_rcvtimeo ( sk, nonblock ) ; <START_BUG> rdsdebug ( "size   %zu   flags   0x%x   timeo   %ld\\n", size, msg_flags, timeo ) ; <END_BUG> if ( msg_flags & MSG_OOB ) goto out ; while ( 1 ) { if (! list_empty ( & rs -> rs_notify_queue ) ) { ret = rds_notify_queue_get ( rs, msg ) ; break ; } if ( rs -> rs_cong_notify ) { ret = rds_notify_cong ( rs, msg ) ; break ; } if (! rds_next_incoming ( rs, & inc ) ) { if ( nonblock ) { ret = - EAGAIN ; break ; } timeo = wait_event_interruptible_timeout ( * sk_sleep ( sk ), (! list_empty ( & rs -> rs_notify_queue ) || rs -> rs_cong_notify || rds_next_incoming ( rs, & inc ) ), timeo ) ; rdsdebug ( "recvmsg   woke   inc   %p   timeo   %ld\\n", inc, timeo ) ; if ( timeo > 0 || timeo == MAX_SCHEDULE_TIMEOUT ) continue ; ret = timeo ; if ( ret == 0 ) ret = - ETIMEDOUT ; break ; } rdsdebug ( "copying   inc   %p   from   %pI4:%u   to   user\\n", inc, & inc -> i_conn -> c_faddr, ntohs ( inc -> i_hdr. h_sport ) ) ; ret = inc -> i_conn -> c_trans -> inc_copy_to_user ( inc, msg -> msg_iov, size ) ; if ( ret < 0 ) break ; if (

Fix:
<S2SV_ModStart>, timeo ) ; msg -> msg_namelen = 0 <S2SV_ModStart> ) ) ; msg -> msg_namelen = sizeof ( * sin ) ;
Buggy code:
 static int jpg_dec_parseopts ( char * optstr, jpg_dec_importopts_t * opts ) { jas_tvparser_t * tvp ; <START_BUG> opts -> max_size = 0 ; <END_BUG> if (! ( tvp = jas_tvparser_create ( optstr? optstr : "" ) ) ) { return - 1 ; } while (! jas_tvparser_next ( tvp ) ) { switch ( jas_taginfo_nonull ( jas_taginfos_lookup ( decopts, jas_tvparser_gettag ( tvp ) ) ) -> id ) { case OPT_MAXSIZE :  opts -> max_size = atoi ( jas_tvparser_getval ( tvp ) ) ; <START_BUG> break ; default : jas_eprintf ( "warning:   ignoring   invalid   option   %s\\n", jas_tvparser_gettag ( tvp ) ) ; break ; } } jas_tvparser_destroy ( tvp ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; opts -> max_samples = 64 * JAS_MEBI <S2SV_ModEnd> ; if ( <S2SV_ModStart> : opts -> max_samples <S2SV_ModEnd> = atoi (
Buggy code:
 static ltxtquery * queryin ( char * buf ) { QPRS_STATE state ; int32 i ; ltxtquery * query ; int32 commonlen ; ITEM * ptr ; NODE * tmp ; int32 pos = 0 ; # ifdef BS_DEBUG char pbuf [ 16384 ], * cur ; # endif state. buf = buf ; state. state = WAITOPERAND ; state. count = 0 ; state. num = 0 ; state. str = NULL ; state. sumlen = 0 ; state. lenop = 64 ; state. curop = state. op = ( char * ) palloc ( state. lenop ) ; * ( state. curop ) = '\\0' ; makepol ( & state ) ; if (! state. num ) ereport ( ERROR, ( errcode ( ERRCODE_SYNTAX_ERROR ), errmsg ( "syntax   error" ), errdetail ( "Empty   query." ) ) ) ; <START_BUG> commonlen = COMPUTESIZE ( state. num, state. sumlen ) ; <END_BUG> query = ( ltxtquery * ) palloc ( commonlen ) ; SET_VARSIZE ( query, commonlen ) ; query -> size = state. num ; ptr = GETQUERY ( query ) ; for ( i = 0 ; i < state. num ; i ++ ) { ptr [ i ]. type = state. str -> type ; ptr [ i ]. val = state. str -> val ; ptr [ i ]. distance = state. str -> distance ; ptr [ i ]. length = state. str -> length ; ptr [ i ]. flag = state. str -> flag ; tmp = state. str -> next ; pfree ( state. str ) ; state. str = tmp ; } memcpy ( ( void * ) GETOPERAND ( query ), ( void * ) state. op, state. sumlen ) ; pfree ( state. op ) ; pos = 0 ; findoprnd ( ptr, & pos ) ; return query ; }

Fix:
<S2SV_ModStart> ) ) ; if ( LTXTQUERY_TOO_BIG ( state. num, state. sumlen ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "ltxtquery <S2SV_blank> is <S2SV_blank> too <S2SV_blank> large" ) ) ) ;
Buggy code:
 inline void update_rq_clock ( struct rq * rq ) <START_BUG> { <END_BUG> if (! rq -> skip_clock_update ) { int cpu = cpu_of ( rq ) ;  u64 irq_time ; <START_BUG> rq -> clock = sched_clock_cpu ( cpu ) ; irq_time = irq_time_cpu ( cpu ) ; if ( rq -> clock - irq_time > rq -> clock_task ) rq -> clock_task = rq -> clock - irq_time ; sched_irq_time_avg_update ( rq, irq_time ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> * rq ) <S2SV_ModEnd> { int cpu <S2SV_ModStart> ; u64 irq_time ; if ( rq -> skip_clock_update ) return <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 void * vips_malloc ( VipsObject * object, size_t size ) { void * buf ; <START_BUG> buf = g_malloc ( size ) ; <END_BUG> if ( object ) { g_signal_connect ( object, "postclose", G_CALLBACK ( vips_malloc_cb ), buf ) ; object -> local_memory += size ; } return ( buf ) ; }

Fix:
<S2SV_ModStart> ; buf = g_malloc0 <S2SV_ModEnd> ( size )
Buggy code:
 static int read_header ( struct archive_read * a, struct archive_entry * entry, char head_type ) { const void * h ; const char * p, * endp ; struct rar * rar ; struct rar_header rar_header ; struct rar_file_header file_header ; int64_t header_size ; unsigned filename_size, end ; char * filename ; char * strp ; char packed_size [ 8 ] ; char unp_size [ 8 ] ; int ttime ; struct archive_string_conv * sconv, * fn_sconv ; unsigned long crc32_val ; int ret = ( ARCHIVE_OK ), ret2 ; rar = ( struct rar * ) ( a -> format -> data ) ; sconv = rar -> opt_sconv ; if ( sconv == NULL ) { if (! rar -> init_default_conversion ) { rar -> sconv_default = archive_string_default_conversion_for_read ( & ( a -> archive ) ) ; rar -> init_default_conversion = 1 ; } sconv = rar -> sconv_default ; } if ( ( h = __archive_read_ahead ( a, 7, NULL ) ) == NULL ) return ( ARCHIVE_FATAL ) ; p = h ; memcpy ( & rar_header, p, sizeof ( rar_header ) ) ; rar -> file_flags = archive_le16dec ( rar_header. flags ) ; header_size = archive_le16dec ( rar_header. size ) ; if ( header_size < ( int64_t ) sizeof ( file_header ) + 7 ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_FILE_FORMAT, "Invalid   header   size" ) ; return ( ARCHIVE_FATAL ) ; } crc32_val = crc32 ( 0, ( const unsigned char * ) p + 2, 7 - 2 ) ; __archive_read_consume ( a, 7 ) ; if (! ( rar -> file_flags & FHD_SOLID ) ) { rar -> compression_method = 0 ; rar -> packed_size = 0 ; rar -> unp_size = 0 ; rar -> mtime = 0 ; rar -> ctime =

Fix:
<S2SV_ModStart> filename [ filename_size <S2SV_ModEnd> ] = '\\0'
Buggy code:
 static int sctp_wait_for_sndbuf ( struct sctp_association * asoc, long * timeo_p, size_t msg_len ) { struct sock * sk = asoc -> base. sk ; int err = 0 ; long current_timeo = * timeo_p ; DEFINE_WAIT ( wait ) ; pr_debug ( "%s:   asoc:%p,   timeo:%ld,   msg_len:%zu\\n", __func__, asoc, * timeo_p, msg_len ) ; sctp_association_hold ( asoc ) ; for ( ; ; ) { prepare_to_wait_exclusive ( & asoc -> wait, & wait, TASK_INTERRUPTIBLE ) ; if (! * timeo_p ) goto do_nonblock ; if ( sk -> sk_err || asoc -> state >= SCTP_STATE_SHUTDOWN_PENDING || asoc -> base. dead ) goto do_error ; if ( signal_pending ( current ) ) goto do_interrupted ; if ( msg_len <= sctp_wspace ( asoc ) ) break ; release_sock ( sk ) ; current_timeo = schedule_timeout ( current_timeo ) ; <START_BUG> if ( sk!= asoc -> base. sk ) <END_BUG> goto do_error ; lock_sock ( sk ) ; * timeo_p = current_timeo ; } out : finish_wait ( & asoc -> wait, & wait ) ; sctp_association_put ( asoc ) ; return err ; do_error : err = - EPIPE ; goto out ; do_interrupted : err = sock_intr_errno ( * timeo_p ) ; goto out ; do_nonblock : err = - EAGAIN ; goto out ; }

Fix:
<S2SV_ModStart> current_timeo ) ; <S2SV_ModEnd> lock_sock ( sk
Buggy code:
 void vp9_rc_compute_frame_size_bounds ( const VP9_COMP * cpi, <START_BUG> int this_frame_target, <END_BUG> int * frame_under_shoot_limit, int * frame_over_shoot_limit ) {  if ( cpi -> oxcf. end_usage == USAGE_CONSTANT_QUALITY ) { <START_BUG> * frame_under_shoot_limit = 0 ; * frame_over_shoot_limit = INT_MAX ; } else { <END_BUG> int recode_tolerance =  <START_BUG> ( cpi -> sf. recode_tolerance * this_frame_target ) // 100 ; <END_BUG>  * frame_over_shoot_limit = this_frame_target + recode_tolerance ; <START_BUG> * frame_under_shoot_limit = this_frame_target - recode_tolerance ; <END_BUG> * frame_over_shoot_limit += 200 ;  * frame_under_shoot_limit -= 200 ; if ( * frame_under_shoot_limit < 0 ) * frame_under_shoot_limit = 0 ; <START_BUG> if ( * frame_over_shoot_limit > cpi -> rc. max_frame_bandwidth ) { <END_BUG> * frame_over_shoot_limit = cpi -> rc. max_frame_bandwidth ; } }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> cpi, int frame_target <S2SV_ModEnd>, int * <S2SV_ModStart> -> oxcf. rc_mode == VPX_Q <S2SV_ModEnd> ) { * <S2SV_ModStart> } else { const int tolerance <S2SV_ModEnd> = ( cpi <S2SV_ModStart>. recode_tolerance * frame_target <S2SV_ModEnd> ) // 100 <S2SV_ModStart> 100 ; * frame_under_shoot_limit = MAX ( frame_target - tolerance - 200, 0 ) <S2SV_ModEnd> ; * frame_over_shoot_limit <S2SV_ModStart> ; * frame_over_shoot_limit = MIN ( frame_target + tolerance + 200, <S2SV_ModEnd> cpi -> rc <S2SV_ModStart>. max_frame_bandwidth ) <S2SV_ModEnd> ; } } <S2SV_ModStart> ; } } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static stmt_ty ast_for_funcdef ( struct compiling * c, const node * n, asdl_seq * decorator_seq ) { return ast_for_funcdef_impl ( c, n, decorator_seq, <START_BUG> 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, decorator_seq, false <S2SV_ModEnd> ) ; }
Buggy code:
 IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_hdr ( dec_state_t * ps_dec ) { stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; impeg2d_bit_stream_get ( ps_stream, 10 ) ; ps_dec -> e_pic_type = ( e_pic_type_t ) impeg2d_bit_stream_get ( ps_stream, 3 ) ; if ( ( ps_dec -> e_pic_type < I_PIC ) || ( ps_dec -> e_pic_type > D_PIC ) ) { impeg2d_next_code ( ps_dec, PICTURE_START_CODE ) ; return IMPEG2D_INVALID_PIC_TYPE ; } impeg2d_bit_stream_get ( ps_stream, 16 ) ; if ( ps_dec -> e_pic_type == P_PIC || ps_dec -> e_pic_type == B_PIC ) { ps_dec -> u2_full_pel_forw_vector = impeg2d_bit_stream_get_bit ( ps_stream ) ; ps_dec -> u2_forw_f_code = impeg2d_bit_stream_get ( ps_stream, 3 ) ; } if ( ps_dec -> e_pic_type == B_PIC ) { ps_dec -> u2_full_pel_back_vector = impeg2d_bit_stream_get_bit ( ps_stream ) ; ps_dec -> u2_back_f_code = impeg2d_bit_stream_get ( ps_stream, 3 ) ; } if ( ps_dec -> u2_is_mpeg2 == 0 ) { ps_dec -> au2_f_code [ 0 ] [ 0 ] = ps_dec -> au2_f_code [ 0 ] [ 1 ] = ps_dec -> u2_forw_f_code ; ps_dec -> au2_f_code [ 1 ] [ 0 ] = ps_dec -> au2_f_code [ 1 ] [ 1 ] = ps_dec -> u

Fix:
<S2SV_ModStart> ) == 1 && ps_stream -> u4_offset < ps_stream -> u4_max_offset
Buggy code:
 static int linear_ioctl ( struct dm_target * ti, unsigned int cmd, unsigned long arg ) { struct linear_c * lc = ( struct linear_c * ) ti -> private ; <START_BUG> return __blkdev_driver_ioctl ( lc -> dev -> bdev, lc -> dev -> mode, cmd, arg ) ; <END_BUG> }

Fix:
<S2SV_ModStart> -> private ; struct dm_dev * dev = lc -> dev ; int r = 0 ; if <S2SV_ModEnd> ( lc -> <S2SV_ModStart> ( lc -> start || ti -> len!= i_size_read ( dev -> bdev -> bd_inode ) >> SECTOR_SHIFT ) r = scsi_verify_blk_ioctl ( NULL, cmd ) ; return r? : __blkdev_driver_ioctl ( <S2SV_ModStart> -> bdev, <S2SV_ModEnd> dev -> mode
Buggy code:
 static int sdp_parse_fmtp_config_h264 ( AVFormatContext * s, AVStream * stream, PayloadContext * h264_data, const char * attr, const char * value ) { AVCodecParameters * par = stream -> codecpar ; if (! strcmp ( attr, "packetization-mode" ) ) { av_log ( s, AV_LOG_DEBUG, "RTP   Packetization   Mode:   %d\\n", atoi ( value ) ) ; h264_data -> packetization_mode = atoi ( value ) ; if ( h264_data -> packetization_mode > 1 ) av_log ( s, AV_LOG_ERROR, "Interleaved   RTP   mode   is   not   supported   yet.\\n" ) ; } else if (! strcmp ( attr, "profile-level-id" ) ) { if ( strlen ( value ) == 6 ) parse_profile_level_id ( s, h264_data, value ) ; } else if (! strcmp ( attr, "sprop-parameter-sets" ) ) { int ret ; <START_BUG> if ( value [ strlen ( value ) - 1 ] == ',' ) { <END_BUG> av_log ( s, AV_LOG_WARNING, "Missing   PPS   in   sprop-parameter-sets,   ignoring\\n" ) ; return 0 ; } par -> extradata_size = 0 ; av_freep ( & par -> extradata ) ; ret = ff_h264_parse_sprop_parameter_sets ( s, & par -> extradata, & par -> extradata_size, value ) ; av_log ( s, AV_LOG_DEBUG, "Extradata   set   to   %p   (size:   %d)\\n", par -> extradata, par -> extradata_size ) ; return ret ; } return 0 ; }

Fix:
<S2SV_ModStart> ; if ( * value == 0 ||
Buggy code:
 static int ssh_packet_set_postauth ( struct ssh * ssh ) { <START_BUG> struct sshcomp * comp ; <END_BUG> int r, mode ; debug ( "%s:   called", __func__ ) ; ssh -> state -> after_authentication = 1 ; ssh -> state -> rekeying = 0 ;  for ( mode = 0 ; mode < MODE_MAX ; mode ++ ) { <START_BUG> if ( ssh -> state -> newkeys [ mode ] == NULL ) continue ; comp = & ssh -> state -> newkeys [ mode ] -> comp ; if ( comp && comp -> enabled && <END_BUG> ( r = ssh_packet_init_compression ( ssh ) )!= 0 )  return r ; <START_BUG> } <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ssh ) { int r <S2SV_ModEnd> ; debug ( <S2SV_ModStart> = 0 ; if ( <S2SV_ModEnd> ( r = <S2SV_ModStart> ( r = ssh_packet_enable_delayed_compress <S2SV_ModEnd> ( ssh ) <S2SV_ModStart> return r ; <S2SV_ModEnd> return 0 ;