nus-yam/ex-repair huggingface dataset:
Buggy code:
 int main ( int argc, char * * argv ) { setlocale ( LC_ALL, "" ) ; # if ENABLE_NLS bindtextdomain ( PACKAGE, LOCALEDIR ) ; textdomain ( PACKAGE ) ; # endif abrt_init ( argv ) ; const char * program_usage_string = _ ( "&   [-y]   [-i   BUILD_IDS_FILE|-i   -]   [-e   PATH[:PATH]...]\\n" "\\t[-r   REPO]\\n" "\\n" "Installs   debuginfo   packages   for   all   build-ids   listed   in   BUILD_IDS_FILE   to\\n" "ABRT   system   cache." ) ; enum { OPT_v = 1 << 0, OPT_y = 1 << 1, OPT_i = 1 << 2, OPT_e = 1 << 3, OPT_r = 1 << 4, OPT_s = 1 << 5, } ; const char * build_ids = "build_ids" ; const char * exact = NULL ; const char * repo = NULL ; const char * size_mb = NULL ; struct options program_options [ ] = { OPT__VERBOSE ( & g_verbose ), OPT_BOOL ( 'y', "yes", NULL, _ ( "Noninteractive,   assume   \'Yes\'   to   all   questions" ) ), OPT_STRING ( 'i', "ids", & build_ids, "BUILD_IDS_FILE", _ ( "-   means   STDIN,   default:   build_ids" ) ), OPT_STRING ( 'e', "exact", & exact, "EXACT", _ ( "Download   only   specified   files" ) ), OPT_STRING ( 'r', "repo", & repo, "REPO", _ ( "Pattern   to   use   when   searching   for   repos,   default:   *debug*" ) ), OPT_STRING ('s', "size_mb", & size_mb, "SIZE_MB", _ ( "Ignored   option" ) ), OPT_END ( ) } ; const unsigned opts = parse_opts ( argc, argv, program_options, program_usage_string ) ; const gid_t egid = getegid ( ) ; const gid_

Fix:
<S2SV_ModStart> ) ; } char tmp_directory [ ] = LARGE_DATA_TMP_DIR "//abrt-tmp-debuginfo.XXXXXX" ; if ( mkdtemp ( tmp_directory ) == NULL ) perror_msg_and_die ( "Failed <S2SV_blank> to <S2SV_blank> create <S2SV_blank> working <S2SV_blank> directory" ) ; log_info ( "Created <S2SV_blank> working <S2SV_blank> directory: <S2SV_blank> %s", tmp_directory ) ; const char * args [ 13 <S2SV_ModEnd> ] ; { <S2SV_ModStart> ++ ] = "--tmpdir" ; args [ i ++ ] = tmp_directory ; args [ i ++ ] = <S2SV_ModStart> ) ; } pid_t pid = fork ( ) ; if ( pid < 0 ) perror_msg_and_die ( "fork" ) ; if ( pid == 0 ) { <S2SV_ModStart> ) ; } int status ; if ( safe_waitpid ( pid, & status, 0 ) < 0 ) perror_msg_and_die ( "waitpid" ) ; if ( rmdir ( tmp_directory ) >= 0 ) log_info ( "Removed <S2SV_blank> working <S2SV_blank> directory: <S2SV_blank> %s", tmp_directory ) ; else if ( errno!= ENOENT ) perror_msg ( "Failed <S2SV_blank> to <S2SV_blank> remove
Buggy code:
 static Image * ReadAAIImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; register ssize_t x ; register PixelPacket * q ; register unsigned char * p ; size_t height, length, width ; ssize_t count, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } width = ReadBlobLSBLong ( image ) ; height = ReadBlobLSBLong ( image ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( ( width == 0UL ) || ( height == 0UL ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { image -> columns = width ; image -> rows = height ; image -> depth = 8 ; if ( ( image_info -> ping!= MagickFalse ) && ( image_info -> number_scenes!= 0 ) ) if ( image -> scene >= ( image_info -> scene + image_info -> number_scenes - 1 ) ) break ; <START_BUG> pixels = ( unsigned char * ) AcquireQuantumMemory ( image -> columns, <END_BUG> 4 * sizeof ( * pixels ) ) ; if ( pixels == ( unsigned char * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; length = ( size_t ) 4 * image -> columns ; for ( y = 0 ; y < ( ssize_t ) image -> rows ; y ++ ) { count = ReadBlob ( image, length, pixels ) ; if ( ( size_t ) count!= length ) ThrowReaderException ( CorruptImageError, "UnableToReadImageData

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static void thunar_transfer_job_copy_node ( ThunarTransferJob * job, ThunarTransferNode * node, GFile * target_file, GFile * target_parent_file, GList * * target_file_list_return, GError * * error ) { ThunarThumbnailCache * thumbnail_cache ; ThunarApplication * application ; ThunarJobResponse response ; GFileInfo * info ; GError * err = NULL ; GFile * real_target_file = NULL ; gchar * base_name ; _thunar_return_if_fail ( THUNAR_IS_TRANSFER_JOB ( job ) ) ; _thunar_return_if_fail ( node!= NULL && G_IS_FILE ( node -> source_file ) ) ; _thunar_return_if_fail ( target_file == NULL || node -> next == NULL ) ; _thunar_return_if_fail ( ( target_file == NULL && target_parent_file!= NULL ) || ( target_file!= NULL && target_parent_file == NULL ) ) ; _thunar_return_if_fail ( error == NULL || * error == NULL ) ; application = thunar_application_get ( ) ; thumbnail_cache = thunar_application_get_thumbnail_cache ( application ) ; g_object_unref ( application ) ; for ( ; err == NULL && node!= NULL ; node = node -> next ) { if ( G_LIKELY ( target_file == NULL ) ) { base_name = g_file_get_basename ( node -> source_file ) ; target_file = g_file_get_child ( target_parent_file, base_name ) ; g_free ( base_name ) ; } else target_file = g_object_ref ( target_file ) ; info = g_file_query_info ( node -> source_file, G_FILE_ATTRIBUTE_STANDARD_DISPLAY_NAME, G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS, exo_job_get_cancellable ( EXO_JOB ( job ) ), & err ) ; if ( info == NULL ) { g_object_unref ( target_file ) ; break ; } <START_BUG> exo_job_info_<END_BUG>

Fix:
<S2SV_ModStart> job ), "%s",
Buggy code:
 int imagetobmp ( opj_image_t * image, const char * outfile ) { int w, h ; int i, pad ; FILE * fdest = NULL ; int adjustR, adjustG, adjustB ; if ( image -> comps [ 0 ]. prec < 8 ) { fprintf ( stderr, "Unsupported   number   of   components:   %d\\n", image -> comps [ 0 ]. prec ) ; return 1 ; } if ( image -> numcomps >= 3 && image -> comps [ 0 ]. dx == image -> comps [ 1 ]. dx && image -> comps [ 1 ]. dx == image -> comps [ 2 ]. dx && image -> comps [ 0 ]. dy == image -> comps [ 1 ]. dy && image -> comps [ 1 ]. dy == image -> comps [ 2 ]. dy && image -> comps [ 0 ]. prec == image -> comps [ 1 ]. prec && image -> comps [ 1 ]. prec == image -> comps [ 2 ]. prec ) { fdest = fopen ( outfile, "wb" ) ; if (! fdest ) { fprintf ( stderr, "ERROR   ->   failed   to   open   %s   for   writing\\n", outfile ) ; return 1 ; } w = ( int ) image -> comps [ 0 ]. w ; h = ( int ) image -> comps [ 0 ]. h ; fprintf ( fdest, "BM" ) ; fprintf ( fdest, "%c%c%c%c", ( OPJ_UINT8 ) ( h * w * 3 + 3 * h * ( w % 2 ) + 54 ) & 0xff, ( OPJ_UINT8 ) ( ( h * w * 3 + 3 * h * ( w % 2 ) + 54 ) >> 8 ) & 0xff, ( OPJ_UINT8 ) ( ( h * w * 3 + 3 * h * ( w % 2 ) + 54 ) >> 16 ) & 0xff, ( OPJ_UINT8 ) ( ( h * w * 3 + 3 * h * ( w % 2 ) + 54 ) >> 24 ) & 0xff ) ; fprintf ( fdest, "%c%c%c%c", ( 0 ) & 0xff, ( ( 0 ) >> 8 ) & 0xff, ( ( 0 ) >> 16 ) & 0xff, (

Fix:
<S2SV_ModStart> { for ( pad = ( <S2SV_ModEnd> w % 4
Buggy code:
 static Channel * server_request_direct_streamlocal ( void ) { Channel * c = NULL ; char * target, * originator ; u_short originator_port ; target = packet_get_string ( NULL ) ; originator = packet_get_string ( NULL ) ; originator_port = packet_get_int ( ) ; packet_check_eom ( ) ; debug ( "server_request_direct_streamlocal:   originator   %s   port   %d,   target   %s", originator, originator_port, target ) ; if ( ( options. allow_streamlocal_forwarding & FORWARD_LOCAL )!= 0 && <START_BUG>! no_port_forwarding_flag &&! options. disable_forwarding ) { <END_BUG> c = channel_connect_to_path ( target, "direct-streamlocal@openssh.com", "direct-streamlocal" ) ; } else { logit ( "refused   streamlocal   port   forward:   " "originator   %s   port   %d,   target   %s", originator, originator_port, target ) ; } free ( originator ) ; free ( target ) ; return c ; }

Fix:
<S2SV_ModStart> options. disable_forwarding && use_privsep
Buggy code:
 void deinit_pci ( struct vmctx * ctx ) { struct pci_vdev_ops * ops ; struct businfo * bi ; struct slotinfo * si ; struct funcinfo * fi ; int bus, slot, func ; size_t lowmem ; struct mem_range mr ; bzero ( & mr, sizeof ( struct mem_range ) ) ; mr. name = "PCI   ECFG" ; mr. base = PCI_EMUL_ECFG_BASE ; mr. size = PCI_EMUL_ECFG_SIZE ; unregister_mem ( & mr ) ; lowmem = vm_get_lowmem_size ( ctx ) ; bzero ( & mr, sizeof ( struct mem_range ) ) ; mr. name = "PCI   hole   (32-bit)" ; mr. base = lowmem ; mr. size = ( 4ULL * 1024 * 1024 * 1024 ) - lowmem ; unregister_mem_fallback ( & mr ) ; bzero ( & mr, sizeof ( struct mem_range ) ) ; mr. name = "PCI   hole   (64-bit)" ; mr. base = PCI_EMUL_MEMBASE64 ; mr. size = PCI_EMUL_MEMLIMIT64 - PCI_EMUL_MEMBASE64 ; unregister_mem_fallback ( & mr ) ; for ( bus = 0 ; bus < MAXBUSES ; bus ++ ) { bi = pci_businfo [ bus ] ; if ( bi == NULL ) continue ; for ( slot = 0 ; slot < MAXSLOTS ; slot ++ ) { si = & bi -> slotinfo [ slot ] ; for ( func = 0 ; func < MAXFUNCS ; func ++ ) { fi = & si -> si_funcs [ func ] ; if ( fi -> fi_name == NULL ) continue ; ops = pci_emul_finddev ( fi -> fi_name ) ; <START_BUG> assert ( ops!= NULL ) ; <END_BUG> pr_notice ( "pci   deinit   %s\\n", fi -> fi_name ) ; pci_emul_deinit ( ctx, ops, bus, slot, func, fi ) ; } } } }

Fix:
<S2SV_ModStart> fi_name ) ; if (! ops ) { pr_warn ( "No <S2SV_blank> driver <S2SV_blank> for <S2SV_blank> device <S2SV_blank> [%s]\\n", fi -> fi_name ) ; continue ; } <S2SV_ModEnd> pr_notice ( "pci <S2SV_blank> deinit <S2SV_blank> %s\\n"
Buggy code:
 int check_user_token ( const char * authfile, const char * username, const char * otp_id, int verbose, FILE * debug_file ) { char buf [ 1024 ] ; char * s_user, * s_token ; int retval = AUTH_ERROR ; int fd ; struct stat st ; FILE * opwfile ; fd = open ( authfile, O_RDONLY, 0 ) ; if ( fd < 0 ) { if ( verbose ) D ( debug_file, "Cannot   open   file:   %s   (%s)", authfile, strerror ( errno ) ) ; return retval ; } if ( fstat ( fd, & st ) < 0 ) { if ( verbose ) D ( debug_file, "Cannot   stat   file:   %s   (%s)", authfile, strerror ( errno ) ) ; close ( fd ) ; return retval ; } if (! S_ISREG ( st. st_mode ) ) { if ( verbose ) D ( debug_file, "%s   is   not   a   regular   file", authfile ) ; close ( fd ) ; return retval ; } opwfile = fdopen ( fd, "r" ) ; if ( opwfile == NULL ) { if ( verbose ) D ( debug_file, "fdopen:   %s", strerror ( errno ) ) ; close ( fd ) ; return retval ; } retval = AUTH_NO_TOKENS ; while ( fgets ( buf, 1024, opwfile ) ) { char * saveptr = NULL ; if ( buf [ strlen ( buf ) - 1 ] == '\\n' ) buf [ strlen ( buf ) - 1 ] = '\\0' ; if ( buf [ 0 ] == '#' ) { if ( verbose ) D ( debug_file, "Skipping   comment   line:   %s", buf ) ; continue ; } if ( verbose ) D ( debug_file, "Authorization   line:   %s", buf ) ; s_user = strtok_r ( buf, ":", & saveptr ) ; if ( s_user && strcmp ( username, s_user ) == 0 ) { if ( verbose ) D ( debug_file, "Matched   user:   %s", s_user ) ; retval = AUTH_NOT_FOUND ; do { s_token = strtok_r ( NULL, ":"

Fix:
<S2SV_ModStart> otp_id ) ; fclose ( opwfile ) ;
Buggy code:
 generic_ret * create_policy_2_svc ( cpol_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } prime_arg = arg -> rec. policy ; if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_ADD, NULL, NULL ) ) { ret. code = KADM5_AUTH_ADD ; log_unauth ( "kadm5_create_policy", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_create_policy ( ( void * ) handle, & arg -> rec, arg -> mask ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_create_policy", ( ( prime_arg == NULL )? "(null)" : prime_arg ), errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; }  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_release_buffer ( & minor_stat, & service_name ) ; exit_func : free_server_handle ( handle ) ; return & ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static ngx_int_t ngx_http_lua_adjust_subrequest ( ngx_http_request_t * sr, ngx_uint_t method, int always_forward_body, ngx_http_request_body_t * body, unsigned vars_action, ngx_array_t * extra_vars ) { ngx_http_request_t * r ; <START_BUG> ngx_int_t rc ; <END_BUG> ngx_http_core_main_conf_t * cmcf ;  size_t size ; <START_BUG> r = sr -> parent ; sr -> header_in = r -> header_in ; if ( body ) { sr -> request_body = body ; <END_BUG> rc = ngx_http_lua_set_content_length_header ( sr,  body -> buf? ngx_buf_size ( body -> buf ) : 0 ) ; if ( rc!= NGX_OK ) { return NGX_ERROR ; } } else if (! always_forward_body && method!= NGX_HTTP_PUT && method!= NGX_HTTP_POST && r -> headers_in. content_length_n > 0 ) { <START_BUG> rc = ngx_http_lua_set_content_length_header ( sr, 0 ) ; <END_BUG> if ( rc!= NGX_OK ) { return NGX_ERROR ; }  # if 1 <START_BUG> sr -> request_body = NULL ; # endif } else { <END_BUG> if ( ngx_http_lua_copy_request_headers ( sr, r )!= NGX_OK ) {  return NGX_ERROR ; <START_BUG> } <END_BUG> if ( sr -> request_body ) { if ( sr -> request_body -> temp_file ) { if ( ngx_http_lua_copy_in_file_request_body ( sr )!= NGX_OK ) { return NGX_ERROR ; } } } } sr -> method = method ; switch ( method ) { case NGX_HTTP_GET : sr -> method_name = ngx_http_lua_get_method ; break ; case NGX_HTTP_POST : sr -> method_name = ngx_http_lua_post_method ; break ; case NGX_HTTP_PUT : sr -> method_name

Fix:
<S2SV_ModStart> * r ; <S2SV_ModEnd> ngx_http_core_main_conf_t * cmcf <S2SV_ModStart> * cmcf ; int pr_not_chunked = 0 ; <S2SV_ModStart> = body ; <S2SV_ModEnd> } else if <S2SV_ModStart> 0 ) { sr -> request_body = NULL ; } else { if (! r -> headers_in. chunked ) { pr_not_chunked = 1 ; } if ( sr -> request_body && sr -> request_body -> temp_file ) { if ( ngx_http_lua_copy_in_file_request_body ( sr ) <S2SV_ModEnd>!= NGX_OK ) <S2SV_ModStart> NGX_ERROR ; } } } <S2SV_ModEnd> if ( ngx_http_lua_copy_request_headers <S2SV_ModStart> sr, r, pr_not_chunked <S2SV_ModStart> return NGX_ERROR ; <S2SV_ModEnd> } sr ->
Buggy code:
 <START_BUG> static void <END_BUG> swabHorAcc16 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { uint16 * wp = ( uint16 * ) cp0 ; tmsize_t wc = cc // 2 ; TIFFSwabArrayOfShort ( wp, wc ) ;  horAcc16 ( tif, cp0, cc ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> swabHorAcc16 ( TIFF <S2SV_ModStart> wc ) ; return
Buggy code:
 <START_BUG> static void <END_BUG> pci_msix_table_init ( struct pci_vdev * dev, int table_entries ) {  int i, table_size ; <START_BUG> assert ( table_entries > 0 ) ; assert ( table_entries <= MAX_MSIX_TABLE_ENTRIES ) ; table_size = table_entries * MSIX_TABLE_ENTRY_SIZE ; dev -> msix. table = calloc ( 1, table_size ) ; <END_BUG> assert ( dev -> msix. table!= NULL ) ;  for ( i = 0 ; i < table_entries ; i ++ ) dev -> msix. table [ i ]. vector_control |= PCIM_MSIX_VCTRL_MASK ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> pci_msix_table_init ( struct <S2SV_ModStart> i, table_size <S2SV_ModEnd> ; table_size = <S2SV_ModStart> table_size ) ; if (! <S2SV_ModEnd> dev -> msix <S2SV_ModStart> msix. table ) { pr_err ( "%s: <S2SV_blank> Cannot <S2SV_blank> alloc <S2SV_blank> memory!\\n", __func__ ) ; return - 1 ; } <S2SV_ModEnd> for ( i <S2SV_ModStart> |= PCIM_MSIX_VCTRL_MASK ; return 0 ;
Buggy code:
 static int packet_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct sk_buff * skb ; <START_BUG> int copied, err ; <END_BUG> struct sockaddr_ll * sll ; int vnet_hdr_len = 0 ; err = - EINVAL ; if ( flags & ~ ( MSG_PEEK | MSG_DONTWAIT | MSG_TRUNC | MSG_CMSG_COMPAT | MSG_ERRQUEUE ) ) goto out ; # if 0 if ( pkt_sk ( sk ) -> ifindex < 0 ) return - ENODEV ; # endif if ( flags & MSG_ERRQUEUE ) { err = sock_recv_errqueue ( sk, msg, len, SOL_PACKET, PACKET_TX_TIMESTAMP ) ; goto out ; } skb = skb_recv_datagram ( sk, flags, flags & MSG_DONTWAIT, & err ) ; if ( skb == NULL ) goto out ; if ( pkt_sk ( sk ) -> has_vnet_hdr ) { struct virtio_net_hdr vnet_hdr = { 0 } ; err = - EINVAL ; vnet_hdr_len = sizeof ( vnet_hdr ) ; if ( len < vnet_hdr_len ) goto out_free ; len -= vnet_hdr_len ; if ( skb_is_gso ( skb ) ) { struct skb_shared_info * sinfo = skb_shinfo ( skb ) ; vnet_hdr. hdr_len = skb_headlen ( skb ) ; vnet_hdr. gso_size = sinfo -> gso_size ; if ( sinfo -> gso_type & SKB_GSO_TCPV4 ) vnet_hdr. gso_type = VIRTIO_NET_HDR_GSO_TCPV4 ; else if ( sinfo -> gso_type & SKB_GSO_TCPV6 ) vnet_hdr. gso_type = VIRTIO_NET_HDR_GSO_TCPV6 ; else if ( sinfo -> gso_type & SKB_GSO_UDP ) vnet_hdr. gso_type = V

Fix:
<S2SV_ModStart> copied, err <S2SV_ModEnd> ; int vnet_hdr_len <S2SV_ModStart> out_free ; } copied = skb -> len ; if ( copied > len ) { copied = len ; msg -> msg_flags |= MSG_TRUNC ; } err = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( err ) goto out_free ; sock_recv_ts_and_drops ( msg, sk, skb ) ; if ( msg -> msg_name ) { <S2SV_ModEnd> if ( sock <S2SV_ModStart> == SOCK_PACKET ) { <S2SV_ModStart> sockaddr_pkt ) ; } else { struct sockaddr_ll * sll = & PACKET_SKB_CB ( skb ) -> sa. ll ; <S2SV_ModEnd> msg -> msg_namelen <S2SV_ModStart> sll_addr ) ; } memcpy <S2SV_ModEnd> ( msg -> <S2SV_ModStart> msg -> msg_name <S2SV_ModEnd>, & PACKET_SKB_CB <S2SV_ModStart> msg_namelen ) ; }
Buggy code:
 <START_BUG> static int input_stats ( struct twopass_rc * p, FIRSTPASS_STATS * fps ) { <END_BUG> if ( p -> stats_in >= p -> stats_in_end ) return EOF ; * fps = * p -> stats_in ; ++ p -> stats_in ; return 1 ; }

Fix:
<S2SV_ModStart> int input_stats ( TWO_PASS <S2SV_ModEnd> * p,
Buggy code:
 int tcp_test ( const char * ip_str, const short port ) { int sock, i ; struct sockaddr_in s_in ; int packetsize = 1024 ; unsigned char packet [ packetsize ] ; struct timeval tv, tv2, tv3 ; int caplen = 0 ; int times [ REQUESTS ] ; int min, avg, max, len ; struct net_hdr nh ; tv3. tv_sec = 0 ; tv3. tv_usec = 1 ; s_in. sin_family = PF_INET ; s_in. sin_port = htons ( port ) ; if (! inet_aton ( ip_str, & s_in. sin_addr ) ) return - 1 ; if ( ( sock = socket ( s_in. sin_family, SOCK_STREAM, IPPROTO_TCP ) ) == - 1 ) return - 1 ; if ( fcntl ( sock, F_SETFL, O_NONBLOCK ) < 0 ) { perror ( "fcntl(O_NONBLOCK)   failed" ) ; return ( 1 ) ; } gettimeofday ( & tv, NULL ) ; while ( 1 ) { if ( connect ( sock, ( struct sockaddr * ) & s_in, sizeof ( s_in ) ) == - 1 ) { if ( errno!= EINPROGRESS && errno!= EALREADY ) { perror ( "connect" ) ; close ( sock ) ; printf ( "Failed   to   connect\\n" ) ; return - 1 ; } } else { gettimeofday ( & tv2, NULL ) ; break ; } gettimeofday ( & tv2, NULL ) ; if ( ( ( tv2. tv_sec * 1000000 - tv. tv_sec * 1000000 ) + ( tv2. tv_usec - tv. tv_usec ) ) > ( 3000 * 1000 ) ) { printf ( "Connection   timed   out\\n" ) ; close ( sock ) ; return ( - 1 ) ; } usleep ( 10 ) ; } PCT ; printf ( "TCP   connection   successful\\n" ) ; memset ( & nh, 0, sizeof ( nh ) ) ; nh. nh_type = 2 ; nh. nh_len = htonl ( 0 ) ; if ( send ( sock, & nh, sizeof ( nh ), 0 )!= sizeof ( nh ) ) {

Fix:
<S2SV_ModStart> ; if ( len > 1024 || len < 0 ) continue ; if (
Buggy code:
 char * path_name ( const struct name_path * path, const char * name ) { const struct name_path * p ; char * n, * m ; int nlen = strlen ( name ) ; int len = nlen + 1 ; for ( p = path ; p ; p = p -> up ) { if ( p -> elem_len ) len += p -> elem_len + 1 ; } n = xmalloc ( len ) ; m = n + len - ( nlen + 1 ) ; <START_BUG> strcpy ( m, name ) ; <END_BUG> for ( p = path ; p ; p = p -> up ) { if ( p -> elem_len ) { m -= p -> elem_len + 1 ; memcpy ( m, p -> elem, p -> elem_len ) ; m [ p -> elem_len ] = '//' ; } } return n ; }

Fix:
<S2SV_ModStart> 1 ) ; memcpy <S2SV_ModEnd> ( m, <S2SV_ModStart> m, name, nlen + 1
Buggy code:
 static int calc_pframe_target_size_one_pass_cbr ( const VP9_COMP * cpi ) { <START_BUG> const VP9_CONFIG * oxcf = & cpi -> oxcf ; <END_BUG> const RATE_CONTROL * rc = & cpi -> rc ; const SVC * const svc = & cpi -> svc ;  const int64_t diff = oxcf -> optimal_buffer_level - rc -> buffer_level ; <START_BUG> <END_BUG> const int64_t one_pct_bits = 1 + oxcf -> optimal_buffer_level // 100 ;  <START_BUG> int min_frame_target = MAX ( rc -> av_per_frame_bandwidth >> 4, <END_BUG> FRAME_OVERHEAD_BITS ) ;  int target = rc -> av_per_frame_bandwidth ; <START_BUG> <END_BUG> if ( svc -> number_temporal_layers > 1 &&  oxcf -> end_usage == USAGE_STREAM_FROM_SERVER ) { int current_temporal_layer = svc -> temporal_layer_id ; <START_BUG> const LAYER_CONTEXT * lc = & svc -> layer_context [ current_temporal_layer ] ; <END_BUG> target = lc -> avg_frame_size ; min_frame_target = MAX ( lc -> avg_frame_size >> 4, FRAME_OVERHEAD_BITS ) ; } if ( diff > 0 ) { const int pct_low = ( int ) MIN ( diff // one_pct_bits, oxcf -> under_shoot_pct ) ; target -= ( target * pct_low ) // 200 ; } else if ( diff < 0 ) { const int pct_high = ( int ) MIN ( - diff // one_pct_bits, oxcf -> over_shoot_pct ) ; target += ( target * pct_high ) // 200 ; }  return MAX ( min_frame_target, target ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ) { const VP9EncoderConfig <S2SV_ModEnd> * oxcf = <S2SV_ModStart> int64_t diff = rc <S2SV_ModEnd> -> optimal_buffer_level - <S2SV_ModStart> = 1 + rc <S2SV_ModEnd> -> optimal_buffer_level // <S2SV_ModStart> ( rc -> avg_frame_bandwidth <S2SV_ModEnd> >> 4, <S2SV_ModStart> ; int target ; if ( oxcf -> gf_cbr_boost_pct ) { const int af_ratio_pct = oxcf -> gf_cbr_boost_pct + 100 ; target = cpi -> refresh_golden_frame? ( rc -> avg_frame_bandwidth * rc -> baseline_gf_interval * af_ratio_pct ) // ( rc -> baseline_gf_interval * 100 + af_ratio_pct - 100 ) : ( rc -> avg_frame_bandwidth * rc -> baseline_gf_interval * 100 ) // ( rc -> baseline_gf_interval * 100 + af_ratio_pct - 100 ) ; } else { target = rc -> avg_frame_bandwidth ; } if ( is_one_pass_cbr_svc ( cpi ) ) { int layer = LAYER_IDS_TO_IDX ( svc -> spatial_layer_id,
Buggy code:
 static ssize_t _hostsock_sendto ( oe_fd_t * sock_, const void * buf, size_t count, int flags, const struct oe_sockaddr * dest_addr, oe_socklen_t addrlen ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_errno = 0 ; <START_BUG> if (! sock || ( count &&! buf ) ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( oe_syscall_sendto_ocall ( & ret, sock -> host_fd, buf, count, flags, ( struct oe_sockaddr * ) dest_addr, addrlen )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; }  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart>! buf ) || count > OE_SSIZE_MAX <S2SV_ModStart> ) ; } if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 long kernel_wait4 ( pid_t upid, int __user * stat_addr, int options, struct rusage * ru ) { struct wait_opts wo ; struct pid * pid = NULL ; enum pid_type type ; long ret ; if ( options & ~ ( WNOHANG | WUNTRACED | WCONTINUED | __WNOTHREAD | __WCLONE | __WALL ) ) return - EINVAL ; <START_BUG> if ( upid == - 1 ) <END_BUG> type = PIDTYPE_MAX ; else if ( upid < 0 ) { type = PIDTYPE_PGID ; pid = find_get_pid ( - upid ) ; } else if ( upid == 0 ) { type = PIDTYPE_PGID ; pid = get_task_pid ( current, PIDTYPE_PGID ) ; } else { type = PIDTYPE_PID ; pid = find_get_pid ( upid ) ; } wo. wo_type = type ; wo. wo_pid = pid ; wo. wo_flags = options | WEXITED ; wo. wo_info = NULL ; wo. wo_stat = 0 ; wo. wo_rusage = ru ; ret = do_wait ( & wo ) ; put_pid ( pid ) ; if ( ret > 0 && stat_addr && put_user ( wo. wo_stat, stat_addr ) ) ret = - EFAULT ; return ret ; }

Fix:
<S2SV_ModStart> ( upid == INT_MIN ) return - ESRCH ; if ( upid ==
Buggy code:
 void sas_init_disc ( struct sas_discovery * disc, struct asd_sas_port * port ) { int i ; static const work_func_t sas_event_fns [ DISC_NUM_EVENTS ] = { [ DISCE_DISCOVER_DOMAIN ] = sas_discover_domain, [ DISCE_REVALIDATE_DOMAIN ] = sas_revalidate_domain, <START_BUG> [ DISCE_PROBE ] = sas_probe_devices, <END_BUG> [ DISCE_SUSPEND ] = sas_suspend_devices,  [ DISCE_RESUME ] = sas_resume_devices, <START_BUG> [ DISCE_DESTRUCT ] = sas_destruct_devices, } ; disc -> pending = 0 ; for ( i = 0 ; i < DISC_NUM_EVENTS ; i ++ ) { INIT_SAS_WORK ( & disc -> disc_work [ i ]. work, sas_event_fns [ i ] ) ; disc -> disc_work [ i ]. port = port ; } }<END_BUG>

Fix:
<S2SV_ModStart> sas_revalidate_domain, [ <S2SV_ModEnd> DISCE_SUSPEND ] = <S2SV_ModStart> ] = sas_resume_devices <S2SV_ModEnd>, } ;
Buggy code:
 static Image * ReadDDSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status, cubemap = MagickFalse, volume = MagickFalse, matte ; CompressionType compression ; DDSInfo dds_info ; DDSDecoder * decoder ; size_t n, num_images ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } <START_BUG> if ( ReadDDSInfo ( image, & dds_info )!= MagickTrue ) { <END_BUG> ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ;  } <START_BUG> if ( dds_info. ddscaps2 & DDSCAPS2_CUBEMAP ) cubemap = MagickTrue ; if ( dds_info. ddscaps2 & DDSCAPS2_VOLUME && dds_info. depth > 0 ) volume = MagickTrue ; ( void ) SeekBlob ( image, 128, SEEK_SET ) ; if ( dds_info. pixelformat. flags & DDPF_RGB ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { matte = MagickTrue ; decoder = ReadUncompressedRGBA ; } else { matte = MagickTrue ; decoder = ReadUncompressedRGB ; } } else if ( dds_info. pixelformat. flags & DDPF_LUMINANCE ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { ThrowReaderException ( CorruptImageError, "ImageTypeNotSupported" ) ; } else { matte = MagickFalse ;<END_BUG>

Fix:
<S2SV_ModStart>!= MagickTrue ) <S2SV_ModEnd> ThrowReaderException ( CorruptImageError <S2SV_ModStart> "ImproperImageHeader" ) ; <S2SV_ModEnd> if ( dds_info <S2SV_ModStart>. depth ; if ( num_images < 1 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ;
Buggy code:
 static int sof_set_get_large_ctrl_data ( struct snd_sof_dev * sdev, struct sof_ipc_ctrl_data * cdata, struct sof_ipc_ctrl_data_params * sparams, bool send ) { struct sof_ipc_ctrl_data * partdata ; size_t send_bytes ; size_t offset = 0 ; size_t msg_bytes ; size_t pl_size ; int err ; int i ; partdata = kzalloc ( SOF_IPC_MSG_MAX_SIZE, GFP_KERNEL ) ; if (! partdata ) return - ENOMEM ; if ( send ) err = sof_get_ctrl_copy_params ( cdata -> type, cdata, partdata, sparams ) ; else err = sof_get_ctrl_copy_params ( cdata -> type, partdata, cdata, sparams ) ; <START_BUG> if ( err < 0 ) <END_BUG>  return err ; <START_BUG> msg_bytes = sparams -> msg_bytes ; pl_size = sparams -> pl_size ; memcpy ( partdata, cdata, sparams -> hdr_bytes ) ; mutex_lock ( & sdev -> ipc -> tx_mutex ) ; for ( i = 0 ; i < sparams -> num_msg ; i ++ ) { send_bytes = min ( msg_bytes, pl_size ) ; partdata -> num_elems = send_bytes ; partdata -> rhdr. hdr. size = sparams -> hdr_bytes + send_bytes ; partdata -> msg_index = i ; msg_bytes -= send_bytes ; partdata -> elems_remaining = msg_bytes ; if ( send ) memcpy ( sparams -> dst, sparams -> src + offset, send_bytes ) ; err = sof_ipc_tx_message_unlocked ( sdev -> ipc, partdata -> rhdr. hdr. cmd, partdata, partdata -> rhdr. hdr. size, partdata, partdata -> rhdr. hdr. size ) ; if ( err < 0 ) break ; if (! send ) memcpy ( sparams -> dst + offset, sparams -> src, send_bytes ) ; offset += pl_size ; } mutex_unlock ( & sdev -> ipc -> tx_mutex ) ; k<END_BUG>

Fix:
<S2SV_ModStart> < 0 ) { kfree ( partdata ) ; <S2SV_ModStart> return err ; }
Buggy code:
 int xfs_attr3_leaf_list_int ( struct xfs_buf * bp, struct xfs_attr_list_context * context ) { struct attrlist_cursor_kern * cursor ; struct xfs_attr_leafblock * leaf ; struct xfs_attr3_icleaf_hdr ichdr ; struct xfs_attr_leaf_entry * entries ; struct xfs_attr_leaf_entry * entry ; int retval ; int i ; trace_xfs_attr_list_leaf ( context ) ; leaf = bp -> b_addr ; xfs_attr3_leaf_hdr_from_disk ( & ichdr, leaf ) ; entries = xfs_attr3_leaf_entryp ( leaf ) ; cursor = context -> cursor ; cursor -> initted = 1 ; if ( context -> resynch ) { entry = & entries [ 0 ] ; for ( i = 0 ; i < ichdr. count ; entry ++, i ++ ) { if ( be32_to_cpu ( entry -> hashval ) == cursor -> hashval ) { if ( cursor -> offset == context -> dupcnt ) { context -> dupcnt = 0 ; break ; } context -> dupcnt ++ ; } else if ( be32_to_cpu ( entry -> hashval ) > cursor -> hashval ) { context -> dupcnt = 0 ; break ; } } if ( i == ichdr. count ) { trace_xfs_attr_list_notfound ( context ) ; return 0 ; } } else { entry = & entries [ 0 ] ; i = 0 ; } context -> resynch = 0 ; retval = 0 ; for ( ; i < ichdr. count ; entry ++, i ++ ) { if ( be32_to_cpu ( entry -> hashval )!= cursor -> hashval ) { cursor -> hashval = be32_to_cpu ( entry -> hashval ) ; cursor -> offset = 0 ; } if ( entry -> flags & XFS_ATTR_INCOMPLETE ) continue ; if ( entry -> flags & XFS_ATTR_LOCAL ) { xfs_attr_leaf_name_local_t * name_loc = xfs_attr3_leaf_name_local ( leaf, i ) ; retval = context -> put_listent ( context, entry -> flags, name_loc -> nameval, ( int ) name_

Fix:
<S2SV_ModStart> ; args. rmtvaluelen = valuelen ; args.
Buggy code:
 static irqreturn_t sunkbd_interrupt ( struct serio * serio, unsigned char data, unsigned int flags ) { struct sunkbd * sunkbd = serio_get_drvdata ( serio ) ; if ( sunkbd -> reset <= - 1 ) { sunkbd -> reset = data ; wake_up_interruptible ( & sunkbd -> wait ) ; goto out ; } if ( sunkbd -> layout == - 1 ) { sunkbd -> layout = data ; wake_up_interruptible ( & sunkbd -> wait ) ; goto out ; } switch ( data ) { case SUNKBD_RET_RESET : <START_BUG> schedule_work ( & sunkbd -> tq ) ; <END_BUG> sunkbd -> reset = - 1 ; break ; case SUNKBD_RET_LAYOUT : sunkbd -> layout = - 1 ; break ; case SUNKBD_RET_ALLUP : break ; default : if (! sunkbd -> enabled ) break ; if ( sunkbd -> keycode [ data & SUNKBD_KEY ] ) { input_report_key ( sunkbd -> dev, sunkbd -> keycode [ data & SUNKBD_KEY ],! ( data & SUNKBD_RELEASE ) ) ; input_sync ( sunkbd -> dev ) ; } else { printk ( KERN_WARNING "sunkbd.c:   Unknown   key   (scancode   %#x)   %s.\\n", data & SUNKBD_KEY, data & SUNKBD_RELEASE? "released" : "pressed" ) ; } } out : return IRQ_HANDLED ; }

Fix:
<S2SV_ModStart> case SUNKBD_RET_RESET : if ( sunkbd -> enabled )
Buggy code:
 static struct dentry * ecryptfs_mount ( struct file_system_type * fs_type, int flags, const char * dev_name, void * raw_data ) { struct super_block * s ; struct ecryptfs_sb_info * sbi ; struct ecryptfs_dentry_info * root_info ; const char * err = "Getting   sb   failed" ; struct inode * inode ; struct path path ; <START_BUG> int rc ; <END_BUG> sbi = kmem_cache_zalloc ( ecryptfs_sb_info_cache, GFP_KERNEL ) ; if (! sbi ) { rc = - ENOMEM ; goto out ; }  rc = ecryptfs_parse_options ( sbi, raw_data ) ; <START_BUG> if ( rc ) { err = "Error   parsing   options" ; goto out ; } s = sget ( fs_type, NULL, set_anon_super, NULL ) ; if ( IS_ERR ( s ) ) { rc = PTR_ERR ( s ) ; goto out ; } s -> s_flags = flags ; rc = bdi_setup_and_register ( & sbi -> bdi, "ecryptfs", BDI_CAP_MAP_COPY ) ; if ( rc ) goto out1 ; ecryptfs_set_superblock_private ( s, sbi ) ; s -> s_bdi = & sbi -> bdi ; sbi = NULL ; s -> s_op = & ecryptfs_sops ; s -> s_d_op = & ecryptfs_dops ; err = "Reading   sb   failed" ; rc = kern_path ( dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, & path ) ; if ( rc ) { ecryptfs_printk ( KERN_WARNING, "kern_path()   failed\\n" ) ; goto out1 ; } if ( path. dentry -> d_sb -> s_type == & ecryptfs_fs_type ) { rc = - EINVAL ; printk ( KERN_ERR "Mount   on   filesystem   of   type   " "eCryptfs   explicitly   disallowed   due   to   " "known   incompatibilities\\n" ) ; goto out_free ; } <END_BUG> ecryptfs_

Fix:
<S2SV_ModStart> path path ; uid_t check_ruid ; <S2SV_ModStart> sbi, raw_data, & check_ruid <S2SV_ModStart> out_free ; } if ( check_ruid && path. dentry -> d_inode -> i_uid!= current_uid ( ) ) { rc = - EPERM ; printk ( KERN_ERR "Mount <S2SV_blank> of <S2SV_blank> device <S2SV_blank> (uid: <S2SV_blank> %d) <S2SV_blank> not <S2SV_blank> owned <S2SV_blank> by <S2SV_blank> " "requested <S2SV_blank> user <S2SV_blank> (uid: <S2SV_blank> %d)\\n", path. dentry -> d_inode -> i_uid, current_uid ( ) ) ; goto out_free ; }
Buggy code:
 <START_BUG> static void read_switchable_interp_probs ( FRAME_CONTEXT * fc, vp9_reader * r ) { <END_BUG> int i, j ; for ( j = 0 ; j < SWITCHABLE_FILTER_CONTEXTS ; ++ j ) for ( i = 0 ; i < SWITCHABLE_FILTERS - 1 ; ++ i ) vp9_diff_update_prob ( r, & fc -> switchable_interp_prob [ j ] [ i ] ) ; }

Fix:
<S2SV_ModStart> * fc, vpx_reader <S2SV_ModEnd> * r )
Buggy code:
 static Image * ReadPDBImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { unsigned char attributes, tag [ 3 ] ; Image * image ; IndexPacket index ; MagickBooleanType status ; PDBImage pdb_image ; PDBInfo pdb_info ; register IndexPacket * indexes ; register ssize_t x ; register PixelPacket * q ; register unsigned char * p ; size_t bits_per_pixel, num_pad_bytes, one, packets ; ssize_t count, img_offset, comment_offset = 0, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } count = ReadBlob ( image, sizeof ( pdb_info. name ), ( unsigned char * ) pdb_info. name ) ; if ( count!= sizeof ( pdb_info. name ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; pdb_info. attributes = ( short ) ReadBlobMSBShort ( image ) ; pdb_info. version = ( short ) ReadBlobMSBShort ( image ) ; pdb_info. create_time = ReadBlobMSBLong ( image ) ; pdb_info. modify_time = ReadBlobMSBLong ( image ) ; pdb_info. archive_time = ReadBlobMSBLong ( image ) ; pdb_info. modify_number = ReadBlobMSBLong ( image ) ; pdb_info. application_info = ReadBlobMSBLong ( image ) ; pdb_info. sort_info = ReadBlobMSBLong ( image ) ; ( void ) ReadBlob ( image, 4, ( unsigned char * ) pdb_info. type ) ; ( void ) ReadBlob ( image, 4, ( unsigned char * ) pdb

Fix:
<S2SV_ModStart> ( packets + 257UL <S2SV_ModEnd>, image ->
Buggy code:
 RCMS * r_pkcs7_parse_cms ( const ut8 * buffer, ut32 length ) { RASN1Object * object ; RCMS * container ; if (! buffer ||! length ) { return NULL ; } container = R_NEW0 ( RCMS ) ; if (! container ) { return NULL ; } object = r_asn1_create_object ( buffer, length ) ; <START_BUG> if (! object || object -> list. length!= 2 ||! object -> list. objects [ 0 ] || object -> list. objects [ 1 ] -> list. length!= 1 ) { <END_BUG> r_asn1_free_object ( object ) ; free ( container ) ; return NULL ; } container -> contentType = r_asn1_stringify_oid ( object -> list. objects [ 0 ] -> sector, object -> list. objects [ 0 ] -> length ) ; r_pkcs7_parse_signeddata ( & container -> signedData, object -> list. objects [ 1 ] -> list. objects [ 0 ] ) ; r_asn1_free_object ( object ) ; return container ; }

Fix:
<S2SV_ModStart> list. objects ||! object -> list. objects [ 0 ] ||! object -> list. objects [ 1 ] || <S2SV_ModEnd> object -> list
Buggy code:
 int CMS_verify ( CMS_ContentInfo * cms, STACK_OF ( X509 ) * certs, X509_STORE * store, BIO * dcont, BIO * out, unsigned int flags ) { CMS_SignerInfo * si ; STACK_OF ( CMS_SignerInfo ) * sinfos ; STACK_OF ( X509 ) * cms_certs = NULL ; STACK_OF ( X509_CRL ) * crls = NULL ; X509 * signer ; int i, scount = 0, ret = 0 ; <START_BUG> BIO * cmsbio = NULL, * tmpin = NULL ; <END_BUG> if (! dcont &&! check_content ( cms ) ) return 0 ; sinfos = CMS_get0_SignerInfos ( cms ) ; if ( sk_CMS_SignerInfo_num ( sinfos ) <= 0 ) { CMSerr ( CMS_F_CMS_VERIFY, CMS_R_NO_SIGNERS ) ; goto err ; } for ( i = 0 ; i < sk_CMS_SignerInfo_num ( sinfos ) ; i ++ ) { si = sk_CMS_SignerInfo_value ( sinfos, i ) ; CMS_SignerInfo_get0_algs ( si, NULL, & signer, NULL, NULL ) ; if ( signer ) scount ++ ; } if ( scount!= sk_CMS_SignerInfo_num ( sinfos ) ) scount += CMS_set1_signers_certs ( cms, certs, flags ) ; if ( scount!= sk_CMS_SignerInfo_num ( sinfos ) ) { CMSerr ( CMS_F_CMS_VERIFY, CMS_R_SIGNER_CERTIFICATE_NOT_FOUND ) ; goto err ; } if (! ( flags & CMS_NO_SIGNER_CERT_VERIFY ) ) { cms_certs = CMS_get1_certs ( cms ) ; if (! ( flags & CMS_NOCRL ) ) crls = CMS_get1_crls ( cms ) ; for ( i = 0 ; i < sk_CMS_SignerInfo_num ( sinfos ) ; i ++ ) { si = sk_CMS_SignerInfo_value ( sinfos, i ) ; if (! cms_signerinfo_verify_cert ( si, store, cms_certs, crls, flags ) ) goto err ; } } if (! ( flags & CMS_NO_

Fix:
<S2SV_ModStart>, * tmpin = NULL, * tmpout <S2SV_ModStart> = dcont ; if (! ( flags & SMIME_BINARY ) && dcont ) { tmpout = cms_get_text_bio ( out, flags ) ; if (! tmpout ) { CMSerr ( CMS_F_CMS_VERIFY, ERR_R_MALLOC_FAILURE ) ; goto err ; } <S2SV_ModStart> ( cms, tmpout ) ; if (! cmsbio ) goto err ; SMIME_crlf_copy ( dcont, cmsbio, flags & ~ SMIME_TEXT ) ; if ( flags & CMS_TEXT ) { if (! SMIME_text ( tmpout, out ) ) { CMSerr ( CMS_F_CMS_VERIFY, CMS_R_SMIME_TEXT_ERROR ) ; goto err ; } } } else { cmsbio = CMS_dataInit ( cms, <S2SV_ModStart> goto err ; } <S2SV_ModStart> : if (! ( flags & SMIME_BINARY ) && dcont ) { do_free_upto ( cmsbio, tmpout ) ; if ( tmpin!= dcont ) BIO_free ( tmpin ) ; } else { if ( <S2SV_ModStart> cmsbio ) ; } if
Buggy code:
 <START_BUG> int read_frame ( struct VpxInputContext * input_ctx, vpx_image_t * img ) { <END_BUG> FILE * f = input_ctx -> file ; y4m_input * y4m = & input_ctx -> y4m ; int shortread = 0 ; if ( input_ctx -> file_type == FILE_TYPE_Y4M ) { if ( y4m_input_fetch_frame ( y4m, f, img ) < 1 ) return 0 ; } else { shortread = read_yuv_frame ( input_ctx, img ) ; } return! shortread ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static void yydestruct ( const char * yymsg, int yytype, YYSTYPE * yyvaluep, void * yyscanner, HEX_LEX_ENVIRONMENT * lex_env ) { YYUSE ( yyvaluep ) ; YYUSE ( yyscanner ) ; YYUSE ( lex_env ) ; if (! yymsg ) yymsg = "Deleting" ; YY_SYMBOL_PRINT ( yymsg, yytype, yyvaluep, yylocationp ) ; YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN switch ( yytype ) { case 16 : <START_BUG> # line 94 "hex_grammar.y" <END_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1023 "hex_grammar.c" break ; case 17 :  # line 95 "hex_grammar.y" <START_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1029 "hex_grammar.c" break ; case 18 : <END_BUG> # line 96 "hex_grammar.y"  { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1035 "hex_grammar.c" break ; case 19 : <START_BUG> # line 97 "hex_grammar.y" <END_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1041 "hex_grammar.c" break ; case 21 :  # line 100 "hex_grammar.y" <START_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1047 "hex_grammar.c" break ; case 22 : <END_BUG> # line 99 "hex_grammar.y"  { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1053 "hex_grammar.c" break ; case 23 : <START_BUG> # line 98 "hex_grammar.y" <END_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1059 "hex_grammar.c" break ; default : break ; } YY_IGNORE_MAYBE_UNINITIALIZED_

Fix:
<S2SV_ModStart> : # line 101 "hex_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1030 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 102 "hex_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1036 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 103 "hex_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1042 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 104 "hex_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1048 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> : # line 107 "hex_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1054 <S2SV_ModEnd> "hex_grammar.c" break ; <S2SV_ModStart> :
Buggy code:
 int fscrypt_setup_filename ( struct inode * dir, const struct qstr * iname, int lookup, struct fscrypt_name * fname ) { int ret = 0, bigname = 0 ; memset ( fname, 0, sizeof ( struct fscrypt_name ) ) ; fname -> usr_fname = iname ; if (! dir -> i_sb -> s_cop -> is_encrypted ( dir ) || fscrypt_is_dot_dotdot ( iname ) ) { fname -> disk_name. name = ( unsigned char * ) iname -> name ; fname -> disk_name. len = iname -> len ; return 0 ; } <START_BUG> ret = fscrypt_get_crypt_info ( dir ) ; <END_BUG> if ( ret && ret!= - EOPNOTSUPP ) return ret ; if ( dir -> i_crypt_info ) { ret = fscrypt_fname_alloc_buffer ( dir, iname -> len, & fname -> crypto_buf ) ; if ( ret ) return ret ; ret = fname_encrypt ( dir, iname, & fname -> crypto_buf ) ; if ( ret ) goto errout ; fname -> disk_name. name = fname -> crypto_buf. name ; fname -> disk_name. len = fname -> crypto_buf. len ; return 0 ; } if (! lookup ) return - ENOKEY ; if ( iname -> name [ 0 ] == '_' ) bigname = 1 ; if ( ( bigname && ( iname -> len!= 33 ) ) || (! bigname && ( iname -> len > 43 ) ) ) return - ENOENT ; fname -> crypto_buf. name = kmalloc ( 32, GFP_KERNEL ) ; if ( fname -> crypto_buf. name == NULL ) return - ENOMEM ; ret = digest_decode ( iname -> name + bigname, iname -> len - bigname, fname -> crypto_buf. name ) ; if ( ret < 0 ) { ret = - ENOENT ; goto errout ; } fname -> crypto_buf. len = ret ; if ( bigname ) { memcpy ( & fname -> hash, fname -> crypto_buf. name, 4 ) ; memcpy ( & fname -> minor_hash, fname -> crypto_buf. name + 4, 4 ) ; } else { fname -> disk_name. name = fname

Fix:
<S2SV_ModStart> } ret = fscrypt_get_encryption_info <S2SV_ModEnd> ( dir )
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; one = 1 ; image = AcquireImage ( image_info, exception ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) {

Fix:
<S2SV_ModStart> ) // 3 ) ThrowReaderException ( CorruptImageError, "InvalidColormapIndex" ) ; if ( WPG_Palette. StartIndex > WPG_Palette. NumOfEntries
Buggy code:
 static void f2fs_put_super ( struct super_block * sb ) { struct f2fs_sb_info * sbi = F2FS_SB ( sb ) ; int i ; f2fs_quota_off_umount ( sb ) ; mutex_lock ( & sbi -> umount_mutex ) ; if ( is_sbi_flag_set ( sbi, SBI_IS_DIRTY ) ||! is_set_ckpt_flags ( sbi, CP_UMOUNT_FLAG ) ) { struct cp_control cpc = {. reason = CP_UMOUNT, } ; write_checkpoint ( sbi, & cpc ) ; } <START_BUG> f2fs_wait_discard_bios ( sbi ) ; <END_BUG> if ( f2fs_discard_en ( sbi ) &&! sbi -> discard_blks ) { struct cp_control cpc = {. reason = CP_UMOUNT | CP_TRIMMED, } ; write_checkpoint ( sbi, & cpc ) ; } f2fs_destroy_stats ( sbi ) ; release_ino_entry ( sbi, true ) ; f2fs_leave_shrinker ( sbi ) ; mutex_unlock ( & sbi -> umount_mutex ) ; f2fs_flush_merged_writes ( sbi ) ; iput ( sbi -> node_inode ) ; iput ( sbi -> meta_inode ) ; destroy_node_manager ( sbi ) ; destroy_segment_manager ( sbi ) ; kfree ( sbi -> ckpt ) ; f2fs_unregister_sysfs ( sbi ) ; sb -> s_fs_info = NULL ; if ( sbi -> s_chksum_driver ) crypto_free_shash ( sbi -> s_chksum_driver ) ; kfree ( sbi -> raw_super ) ; destroy_device_list ( sbi ) ; mempool_destroy ( sbi -> write_io_dummy ) ; # ifdef CONFIG_QUOTA for ( i = 0 ; i < MAXQUOTAS ; i ++ ) kfree ( sbi -> s_qf_names [ i ] ) ; # endif destroy_percpu_info ( sbi ) ; for ( i = 0 ; i < NR_PAGE_TYPE ; i

Fix:
<S2SV_ModStart> f2fs_wait_discard_bios ( sbi, true
Buggy code:
 static int tok_get ( struct tok_state * tok, char * * p_start, char * * p_end ) { int c ; int blankline, nonascii ; * p_start = * p_end = NULL ; nextline : tok -> start = NULL ; blankline = 0 ; if ( tok -> atbol ) { int col = 0 ; int altcol = 0 ; tok -> atbol = 0 ; for ( ; ; ) { c = tok_nextc ( tok ) ; if ( c ==' ') { col ++, altcol ++ ; } else if ( c == '\\t' ) { col = ( col // tok -> tabsize + 1 ) * tok -> tabsize ; <START_BUG> altcol = ( altcol // tok -> alttabsize + 1 ) <END_BUG>  * tok -> alttabsize ; <START_BUG> } else if ( c == '\\014' ) { col = altcol = 0 ; } else { break ; } } tok_backup ( tok, c ) ; if ( c == '#' || c == '\\n' ) { if ( col == 0 && c == '\\n' && tok -> prompt!= NULL ) { blankline = 0 ; } else { blankline = 1 ; } } if (! blankline && tok -> level == 0 ) { if ( col == tok -> indstack [ tok -> indent ] ) { if ( altcol!= tok -> altindstack [ tok -> indent ] ) { <END_BUG> if ( indenterror ( tok ) ) {  return ERRORTOKEN ; } } } else if ( col > tok -> indstack [ tok -> indent ] ) { if ( tok -> indent + 1 >= MAXINDENT ) { tok -> done = E_TOODEEP ; tok -> cur = tok -> inp ; return ERRORTOKEN ; } if ( altcol <= tok -> altindstack [ tok -> indent ] ) { <START_BUG> if ( indenterror ( tok ) ) { <END_BUG> return ERRORTOKEN ; } } tok -> pendin ++ ; tok -> indstack [ ++ tok -> indent ] = col ; tok -> altindstack [ tok -> indent ] = altcol ; } else { while ( tok -> indent > 0 && col < tok -> indstack [ tok -> indent ] ) { tok -> pendin -- ; tok -> indent -- ; } if ( col!= tok -> indstack [ tok -> indent ] ) { tok -> done = E_DEDENT ; tok -> cur

Fix:
<S2SV_ModStart> ( altcol // ALTTABSIZE <S2SV_ModEnd> + 1 ) <S2SV_ModStart> + 1 ) * ALTTABSIZE <S2SV_ModEnd> ; } else <S2SV_ModStart> ] ) { return <S2SV_ModEnd> indenterror ( tok <S2SV_ModStart> ( tok ) ; <S2SV_ModEnd> } } else <S2SV_ModStart> ] ) { return <S2SV_ModEnd> indenterror ( tok <S2SV_ModStart> ( tok ) ; <S2SV_ModEnd> } tok -> <S2SV_ModStart> ] ) { return <S2SV_ModEnd> indenterror ( tok <S2SV_ModStart> ( tok ) ; <S2SV_ModEnd> } } } <S2SV_ModStart> { if ( tok -> async_always ||