nus-yam/ex-repair huggingface dataset:
Buggy code:
 void TEMPLATE ( process_block_dec ) ( decoder_info_t * decoder_info, int size, int yposY, int xposY, int sub ) { int width = decoder_info -> width ; int height = decoder_info -> height ; stream_t * stream = decoder_info -> stream ; frame_type_t frame_type = decoder_info -> frame_info. frame_type ; int split_flag = 0 ; if ( yposY >= height || xposY >= width ) return ; int decode_this_size = ( yposY + size <= height ) && ( xposY + size <= width ) ; int decode_rectangular_size =! decode_this_size && frame_type!= I_FRAME ; int bit_start = stream -> bitcnt ; int mode = MODE_SKIP ; block_context_t block_context ; TEMPLATE ( find_block_contexts ) ( yposY, xposY, height, width, size, decoder_info -> deblock_data, & block_context, decoder_info -> use_block_contexts ) ; decoder_info -> block_context = & block_context ; split_flag = decode_super_mode ( decoder_info, size, decode_this_size ) ; mode = decoder_info -> mode ; if ( size == ( 1 << decoder_info -> log2_sb_size ) && ( split_flag || mode!= MODE_SKIP ) && decoder_info -> max_delta_qp > 0 ) { int delta_qp = read_delta_qp ( stream ) ; int prev_qp ; if ( yposY == 0 && xposY == 0 ) prev_qp = decoder_info -> frame_info. qp ; else prev_qp = decoder_info -> frame_info. qpb ; decoder_info -> frame_info. qpb = prev_qp + delta_qp ; } decoder_info -> bit_count. super_mode [ decoder_info -> bit_count. stat_frame_type ] += ( stream -> bitcnt - bit_start ) ; <START_BUG> if ( split_flag ) { <END_BUG> int new_size = size // 2 ; TEMPLATE ( process_block_dec ) ( decoder_info, new_size, yposY + 0 * new_size, xposY + 0 * new_size, sub ) ; TEMPLATE ( process_block_dec ) ( decoder_info, new_size

Fix:
<S2SV_ModStart> if ( split_flag && size >= MIN_BLOCK_SIZE
Buggy code:
 <START_BUG> int hns_nic_net_xmit_hw ( struct net_device * ndev, <END_BUG> struct sk_buff * skb, struct hns_nic_ring_data * ring_data ) { struct hns_nic_priv * priv = netdev_priv ( ndev ) ; struct hnae_ring * ring = ring_data -> ring ; struct device * dev = ring_to_dev ( ring ) ; struct netdev_queue * dev_queue ; struct skb_frag_struct * frag ; int buf_num ; int seg_num ; dma_addr_t dma ; int size, next_to_use ; int i ; switch ( priv -> ops. maybe_stop_tx ( & skb, & buf_num, ring ) ) { case - EBUSY : ring -> stats. tx_busy ++ ; goto out_net_tx_busy ; case - ENOMEM : ring -> stats. sw_err_cnt ++ ; netdev_err ( ndev, "no   memory   to   xmit!\\n" ) ; goto out_err_tx_ok ; default : break ; } seg_num = skb_shinfo ( skb ) -> nr_frags + 1 ; next_to_use = ring -> next_to_use ; size = skb_headlen ( skb ) ; dma = dma_map_single ( dev, skb -> data, size, DMA_TO_DEVICE ) ; if ( dma_mapping_error ( dev, dma ) ) { netdev_err ( ndev, "TX   head   DMA   map   failed\\n" ) ; ring -> stats. sw_err_cnt ++ ; goto out_err_tx_ok ; } priv -> ops. fill_desc ( ring, skb, size, dma, seg_num == 1? 1 : 0, buf_num, DESC_TYPE_SKB, ndev -> mtu ) ; for ( i = 1 ; i < seg_num ; i ++ ) { frag = & skb_shinfo ( skb ) -> frags [ i - 1 ] ; size = skb_frag_size ( frag ) ; dma = skb_frag_dma_map ( dev, frag, 0, size, DMA_TO_DEVICE

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> netdev_tx_t <S2SV_ModEnd> hns_nic_net_xmit_hw ( struct <S2SV_ModStart> len ) ; netif_trans_update ( ndev ) ; ndev -> stats. tx_bytes += skb -> len ; ndev -> stats. tx_packets ++ ;
Buggy code:
 int dse_bind ( Slapi_PBlock * pb ) { ber_tag_t method ; struct berval * cred ; Slapi_Value * * bvals ; struct dse * pdse ; Slapi_Attr * attr ; Slapi_DN * sdn = NULL ; Slapi_Entry * ec = NULL ; if ( slapi_pblock_get ( pb, SLAPI_PLUGIN_PRIVATE, & pdse ) < 0 || slapi_pblock_get ( pb, SLAPI_BIND_TARGET_SDN, & sdn ) < 0 || slapi_pblock_get ( pb, SLAPI_BIND_METHOD, & method ) < 0 || slapi_pblock_get ( pb, SLAPI_BIND_CREDENTIALS, & cred ) < 0 ) { slapi_send_ldap_result ( pb, LDAP_OPERATIONS_ERROR, NULL, NULL, 0, NULL ) ; return SLAPI_BIND_FAIL ; } if ( method == LDAP_AUTH_SIMPLE && cred -> bv_len == 0 ) { slapi_send_ldap_result ( pb, LDAP_SUCCESS, NULL, NULL, 0, NULL ) ; return ( SLAPI_BIND_FAIL ) ; } ec = dse_get_entry_copy ( pdse, sdn, DSE_USE_LOCK ) ; if ( ec == NULL ) { <START_BUG> slapi_send_ldap_result ( pb, LDAP_NO_SUCH_OBJECT, NULL, NULL, 0, NULL ) ; <END_BUG> return ( SLAPI_BIND_FAIL ) ; } switch ( method ) { case LDAP_AUTH_SIMPLE : { Slapi_Value cv ; if ( slapi_entry_attr_find ( ec, "userpassword", & attr )!= 0 ) {  slapi_send_ldap_result ( pb, LDAP_INAPPROPRIATE_AUTH, NULL, NULL, 0, NULL ) ; <START_BUG> slapi_entry_free ( ec ) ; return SLAPI_BIND_FAIL ; } bvals = attr_get_present_values ( attr ) ; slapi_value_init_berval ( & cv, cred ) ; if ( slapi_pw_find_sv ( bvals, & cv )!= 0 ) { <END_BUG> slapi_send_ldap_result ( pb, LDAP_INVALID_

Fix:
<S2SV_ModStart> NULL ) { slapi_pblock_set ( pb, SLAPI_PB_RESULT_TEXT, "Entry <S2SV_blank> does <S2SV_blank> not <S2SV_blank> exist" ) ; slapi_send_ldap_result ( pb, LDAP_INVALID_CREDENTIALS <S2SV_ModEnd>, NULL, <S2SV_ModStart> 0 ) { slapi_pblock_set ( pb, SLAPI_PB_RESULT_TEXT, "Entry <S2SV_blank> does <S2SV_blank> not <S2SV_blank> have <S2SV_blank> userpassword <S2SV_blank> set" ) ; slapi_send_ldap_result ( pb, LDAP_INVALID_CREDENTIALS <S2SV_ModEnd>, NULL, <S2SV_ModStart> 0 ) { slapi_pblock_set ( pb, SLAPI_PB_RESULT_TEXT, "Invalid <S2SV_blank> credentials" ) ;
Buggy code:
 <START_BUG> static int try_filter_frame ( const YV12_BUFFER_CONFIG * sd, VP9_COMP * const cpi, <END_BUG> int filt_level, int partial_frame ) { VP9_COMMON * const cm = & cpi -> common ;  int filt_err ; <START_BUG> <END_BUG> vp9_loop_filter_frame ( cm, & cpi -> mb. e_mbd, filt_level, 1, partial_frame ) ;  <START_BUG> filt_err = vp9_get_y_sse ( sd, cm -> frame_to_show ) ; <END_BUG> vpx_yv12_copy_y ( & cpi -> last_frame_uf, cm -> frame_to_show ) ; return filt_err ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int64_t <S2SV_ModEnd> try_filter_frame ( const <S2SV_ModStart> -> common ; int64_t filt_err ; if ( cpi -> num_workers > 1 ) vp9_loop_filter_frame_mt ( cm -> frame_to_show, cm, cpi -> td. mb. e_mbd. plane, filt_level, 1, partial_frame, cpi -> workers, cpi -> num_workers, & cpi -> lf_row_sync ) ; else vp9_loop_filter_frame ( cm -> frame_to_show, <S2SV_ModEnd> cm, & <S2SV_ModStart> & cpi -> td. <S2SV_ModStart> partial_frame ) ; # if CONFIG_VP9_HIGHBITDEPTH if ( cm -> use_highbitdepth ) { filt_err = vp9_highbd_get_y_sse ( sd, cm -> frame_to_show ) ; } else { <S2SV_ModStart> frame_to_show ) ; } # else filt_err = vp9_get_y_sse ( sd, cm -> frame_to_show ) ; # endif
Buggy code:
 static void sycc422_to_rgb ( opj_image_t * img ) { int * d0, * d1, * d2, * r, * g, * b ; const int * y, * cb, * cr ; <START_BUG> unsigned int maxw, maxh, max ; <END_BUG> int offset, upb ;  unsigned int i, j ; <START_BUG> upb = ( int ) img -> comps [ 0 ]. prec ; offset = 1 << ( upb - 1 ) ; upb = ( 1 << upb ) - 1 ; <END_BUG> maxw = ( unsigned int ) img -> comps [ 0 ]. w ; maxh = ( unsigned int ) img -> comps [ 0 ]. h ;  max = maxw * maxh ; y = img -> comps [ 0 ]. data ; cb = img -> comps [ 1 ]. data ; cr = img -> comps [ 2 ]. data ; <START_BUG> d0 = r = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ; <END_BUG>  d1 = g = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ; <START_BUG> <END_BUG> d2 = b = ( int * ) malloc ( sizeof ( int ) * ( size_t ) max ) ;  if ( r == NULL || g == NULL || b == NULL ) goto fails ; <START_BUG> for ( i = 0U ; i < maxh ; ++ i ) <END_BUG> {  for ( j = 0U ; j < ( maxw & ~ ( unsigned int ) 1U ) ; j += 2U ) <START_BUG> { sycc_to_rgb ( offset, upb, * y, * cb, * cr, r, g, b ) ; ++ y ; ++ r ; ++ g ; ++ b ; sycc_to_rgb ( offset, upb, * y, * cb, * cr, r, g, b ) ; ++ y ; ++ r ; ++ g ; ++ b ; ++ cb ; ++ cr ; } <END_BUG> if ( j < maxw ) {  sycc_to_rgb ( offset, upb, * y, * cb, * cr, r, g, b ) ; ++ y ; ++ r ; ++ g ; ++ b ; ++ cb ; ++ cr ; } } free ( img -> comps [ 0 ]. data ) ; img -> comps [ 0 ]. data = d

Fix:
<S2SV_ModStart> * cr ; size_t <S2SV_ModEnd> maxw, maxh <S2SV_ModStart> maxh, max, offx, loopmaxw <S2SV_ModStart>, upb ; size_t i <S2SV_ModEnd> ; upb = <S2SV_ModStart> maxw = ( size_t <S2SV_ModEnd> ) img -> <S2SV_ModStart> maxh = ( size_t <S2SV_ModEnd> ) img -> <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> int ) * <S2SV_ModEnd> max ) ; <S2SV_ModStart> goto fails ; offx = img -> x0 & 1U ; loopmaxw = maxw - offx ; <S2SV_ModStart> i ) { size_t j ; if ( offx > 0U ) { sycc_to_rgb ( offset, upb, * y, 0, 0, r, g, b ) ; ++ y ; ++ r ; ++ g ; ++ b ; } <S2SV_ModStart> j < ( loopmaxw <S2SV_ModEnd> & ~ ( <S2SV_ModStart> & ~ ( size_t <S2SV_ModEnd> ) 1U ) <S2SV_ModStart> ( j < loopmaxw <S2SV_ModEnd> ) { sycc_to_rgb <S2SV_ModStart> = d2 ; <S2SV_ModEnd> img -> comps <S2SV_ModStart>. w = img -> comps [ 2 ]. w = img -> comps [ 0 ]. w ; <S2SV_ModEnd> img -> comps <S2SV_ModStart>. h = <S2SV_ModEnd> img -> comps <S2SV_ModStart> 2
Buggy code:
 int mutt_seqset_iterator_next ( struct SeqsetIterator * iter, unsigned int * next ) { if (! iter ||! next ) return - 1 ; if ( iter -> in_range ) { if ( ( iter -> down && ( iter -> range_cur == ( iter -> range_end - 1 ) ) ) || (! iter -> down && ( iter -> range_cur == ( iter -> range_end + 1 ) ) ) ) { iter -> in_range = 0 ; } } if (! iter -> in_range ) { iter -> substr_cur = iter -> substr_end ; if ( iter -> substr_cur == iter -> eostr ) return 1 ; <START_BUG> while (! * ( iter -> substr_cur ) ) <END_BUG> iter -> substr_cur ++ ; iter -> substr_end = strchr ( iter -> substr_cur, ',' ) ; if (! iter -> substr_end ) iter -> substr_end = iter -> eostr ; else * ( iter -> substr_end ) = '\\0' ; char * range_sep = strchr ( iter -> substr_cur, ':' ) ; if ( range_sep ) * range_sep ++ = '\\0' ; if ( mutt_str_atoui ( iter -> substr_cur, & iter -> range_cur )!= 0 ) return - 1 ; if ( range_sep ) { if ( mutt_str_atoui ( range_sep, & iter -> range_end )!= 0 ) return - 1 ; } else iter -> range_end = iter -> range_cur ; iter -> down = ( iter -> range_end < iter -> range_cur ) ; iter -> in_range = 1 ; } * next = iter -> range_cur ; if ( iter -> down ) iter -> range_cur -- ; else iter -> range_cur ++ ; return 0 ; }

Fix:
<S2SV_ModStart> return 1 ; iter -> substr_end = strchr ( iter -> substr_cur, ',' ) ; if (! iter -> substr_end ) iter -> substr_end = iter -> eostr ; else * ( iter -> substr_end ++ <S2SV_ModEnd> ) = '\\0'
Buggy code:
 int ext2_xattr_get ( struct inode * inode, int name_index, const char * name, void * buffer, size_t buffer_size ) { struct buffer_head * bh = NULL ; struct ext2_xattr_entry * entry ; size_t name_len, size ; char * end ; <START_BUG> int error ; <END_BUG> ea_idebug ( inode, "name=%d.%s,   buffer=%p,   buffer_size=%ld", name_index, name, buffer, ( long ) buffer_size ) ; if ( name == NULL ) return - EINVAL ; name_len = strlen ( name ) ; if ( name_len > 255 ) return - ERANGE ; down_read ( & EXT2_I ( inode ) -> xattr_sem ) ; error = - ENODATA ; if (! EXT2_I ( inode ) -> i_file_acl ) goto cleanup ; ea_idebug ( inode, "reading   block   %d", EXT2_I ( inode ) -> i_file_acl ) ; bh = sb_bread ( inode -> i_sb, EXT2_I ( inode ) -> i_file_acl ) ; error = - EIO ; if (! bh ) goto cleanup ; ea_bdebug ( bh, "b_count=%d,   refcount=%d", atomic_read ( & ( bh -> b_count ) ), le32_to_cpu ( HDR ( bh ) -> h_refcount ) ) ; end = bh -> b_data + bh -> b_size ; if ( HDR ( bh ) -> h_magic!= cpu_to_le32 ( EXT2_XATTR_MAGIC ) || HDR ( bh ) -> h_blocks!= cpu_to_le32 ( 1 ) ) { bad_block : ext2_error ( inode -> i_sb, "ext2_xattr_get", "inode   %ld:   bad   block   %d", inode -> i_ino, EXT2_I ( inode ) -> i_file_acl ) ; error = - EIO ; goto cleanup ; } entry = FIRST_ENTRY ( bh ) ; while (! IS_LAST_ENTRY ( entry ) ) { struct ext2_xattr_entry * next = EXT2_XATTR_NEXT ( entry ) ; if

Fix:
<S2SV_ModStart> ; int error ; struct mb2_cache * ext2_mb_cache = EXT2_SB ( inode -> i_sb ) -> s_mb_cache <S2SV_ModStart> ( ext2_xattr_cache_insert ( ext2_mb_cache, <S2SV_ModStart> ( ext2_xattr_cache_insert ( ext2_mb_cache,
Buggy code:
 static int cleanup_pathname ( struct archive_write_disk * a ) { char * dest, * src ; char separator = '\\0' ; dest = src = a -> name ; if ( * src == '\\0' ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, "Invalid   empty   pathname" ) ; return ( ARCHIVE_FAILED ) ; } # if defined ( __CYGWIN__ ) cleanup_pathname_win ( a ) ; # endif if ( * src == '//' ) <START_BUG> separator = * src ++ ; <END_BUG> for ( ; ; ) { if ( src [ 0 ] == '\\0' ) { break ; } else if ( src [ 0 ] == '//' ) { src ++ ; continue ; } else if ( src [ 0 ] == '.' ) { if ( src [ 1 ] == '\\0' ) { break ; } else if ( src [ 1 ] == '//' ) { src += 2 ; continue ; } else if ( src [ 1 ] == '.' ) { if ( src [ 2 ] == '//' || src [ 2 ] == '\\0' ) { if ( a -> flags & ARCHIVE_EXTRACT_SECURE_NODOTDOT ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, "Path   contains   \'..\'" ) ; return ( ARCHIVE_FAILED ) ; } } } } if ( separator ) * dest ++ = '//' ; while ( * src!= '\\0' && * src!= '//' ) { * dest ++ = * src ++ ; } if ( * src == '\\0' ) break ; separator = * src ++ ; } if ( dest == a -> name ) { if ( separator ) * dest ++ = '//' ; else * dest ++ = '.' ; } * dest = '\\0' ; return ( ARCHIVE_OK ) ; }

Fix:
<S2SV_ModStart> == '//' ) { if ( a -> flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS ) { archive_set_error ( & a -> archive, ARCHIVE_ERRNO_MISC, "Path <S2SV_blank> is <S2SV_blank> absolute" ) ; return ( ARCHIVE_FAILED ) ; } separator = * src ++ ; } <S2SV_ModEnd> for ( ;
Buggy code:
 void dwc3_gadget_giveback ( struct dwc3_ep * dep, struct dwc3_request * req, int status ) { struct dwc3 * dwc = dep -> dwc ; <START_BUG> req -> started = false ; <END_BUG> list_del ( & req -> list ) ; req -> remaining = 0 ; if ( req -> request. status == - EINPROGRESS ) req -> request. status = status ; if ( req -> trb ) usb_gadget_unmap_request_by_dev ( dwc -> sysdev, & req -> request, req -> direction ) ; req -> trb = NULL ; trace_dwc3_gadget_giveback ( req ) ; spin_unlock ( & dwc -> lock ) ; usb_gadget_giveback_request ( & dep -> endpoint, & req -> request ) ; spin_lock ( & dwc -> lock ) ;  if ( dep -> number > 1 ) <START_BUG> pm_runtime_put ( dwc -> dev ) ; }<END_BUG>

Fix:
<S2SV_ModStart> -> dwc ; dwc3_gadget_del_and_unmap_request ( dep, req, status <S2SV_ModEnd> ) ; spin_unlock <S2SV_ModStart> lock ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void perf_event_interrupt ( struct pt_regs * regs ) { int i ; struct cpu_hw_events * cpuhw = & __get_cpu_var ( cpu_hw_events ) ; struct perf_event * event ; unsigned long val ; int found = 0 ; int nmi ; nmi = perf_intr_is_nmi ( regs ) ; if ( nmi ) nmi_enter ( ) ; else irq_enter ( ) ; for ( i = 0 ; i < ppmu -> n_counter ; ++ i ) { event = cpuhw -> event [ i ] ; val = read_pmc ( i ) ; if ( ( int ) val < 0 ) { if ( event ) { found = 1 ; <START_BUG> record_and_restart ( event, val, regs, nmi ) ; <END_BUG> } else { write_pmc ( i, 0 ) ; } } } mtmsr ( mfmsr ( ) | MSR_PMM ) ; mtpmr ( PMRN_PMGC0, PMGC0_PMIE | PMGC0_FCECE ) ; isync ( ) ; if ( nmi ) nmi_exit ( ) ; else irq_exit ( ) ; }

Fix:
<S2SV_ModStart> val, regs <S2SV_ModEnd> ) ; }
Buggy code:
 static int crypto_rng_init_tfm ( struct crypto_tfm * tfm ) { <START_BUG> struct crypto_rng * rng = __crypto_rng_cast ( tfm ) ; <END_BUG> struct rng_alg * alg = crypto_rng_alg ( rng ) ; struct old_rng_alg * oalg = crypto_old_rng_alg ( rng ) ; if ( oalg -> rng_make_random ) { rng -> generate = generate ; rng -> seed = rngapi_reset ; rng -> seedsize = oalg -> seedsize ; return 0 ; } rng -> generate = alg -> generate ; rng -> seed = alg -> seed ; rng -> seedsize = alg -> seedsize ; return 0 ; }

Fix:
<S2SV_ModStart> tfm ) { <S2SV_ModEnd> return 0 ;
Buggy code:
 GF_Err cat_multiple_files ( GF_ISOFile * dest, char * fileName, u32 import_flags, Double force_fps, u32 frames_per_sample, char * tmp_dir, Bool force_cat, Bool align_timelines, Bool allow_add_in_command ) { CATEnum cat_enum ; char * sep ; cat_enum. dest = dest ; cat_enum. import_flags = import_flags ; cat_enum. force_fps = force_fps ; cat_enum. frames_per_sample = frames_per_sample ; cat_enum. tmp_dir = tmp_dir ; cat_enum. force_cat = force_cat ; cat_enum. align_timelines = align_timelines ; cat_enum. allow_add_in_command = allow_add_in_command ; <START_BUG> strcpy ( cat_enum. szPath, fileName ) ; <END_BUG> sep = strrchr ( cat_enum. szPath, GF_PATH_SEPARATOR ) ; if (! sep ) sep = strrchr ( cat_enum. szPath, '//' ) ; if (! sep ) { strcpy ( cat_enum. szPath, "." ) ;  strcpy ( cat_enum. szRad1, fileName ) ; <START_BUG> } else { <END_BUG> strcpy ( cat_enum. szRad1, sep + 1 ) ;  sep [ 0 ] = 0 ; } <START_BUG> sep = strchr ( cat_enum. szRad1, '*' ) ; <END_BUG>  strcpy ( cat_enum. szRad2, sep + 1 ) ; <START_BUG> sep [ 0 ] = 0 ; <END_BUG> sep = strchr ( cat_enum. szRad2, '%' ) ;  if (! sep ) sep = strchr ( cat_enum. szRad2, '#' ) ; if (! sep ) sep = strchr ( cat_enum. szRad2, ':' ) ; strcpy ( cat_enum. szOpt, "" ) ; <START_BUG> if ( sep ) { <END_BUG> strcpy ( cat_enum. szOpt, sep ) ; sep [ 0 ] = 0 ; } return gf_enum_directory ( cat_enum. szPath, 0, cat_enumerate, & cat_enum, NULL ) ; }

Fix:
<S2SV_ModStart> = allow_add_in_command ; if ( strlen ( fileName ) >= sizeof <S2SV_ModEnd> ( cat_enum. <S2SV_ModStart> cat_enum. szPath ) ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_CONTAINER, ( "File <S2SV_blank> name <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long.\\n", fileName ) ) ; return GF_NOT_SUPPORTED ; } strcpy ( cat_enum. szPath <S2SV_ModStart> "." ) ; if ( strlen ( fileName ) >= sizeof <S2SV_ModEnd> ( cat_enum. <S2SV_ModStart> cat_enum. szRad1 ) ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_CONTAINER, ( "File <S2SV_blank> name <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> too <S2SV_blank> long.\\n", fileName ) ) ; return GF_NOT_SUPPORTED ; } strcpy ( cat_enum. szRad1 <S2SV_ModStart> } else { if ( strlen ( <S2SV_ModEnd> sep + 1 <S2SV_ModStart> + 1 ) >= sizeof <S2SV_ModEnd> ( cat_enum. <S2SV_ModStart> cat_enum. szRad1 ) ) { GF_LOG ( GF_LOG_ERROR, GF_LOG_CONTAINER, ( "File <S2SV_blank> name <S2SV_blank> %s <S2SV_blank> is <S2SV_blank> too <S2SV_blank>
Buggy code:
 int key_reject_and_link ( struct key * key, unsigned timeout, unsigned error, struct key * keyring, struct key * authkey ) { struct assoc_array_edit * edit ; struct timespec now ; int ret, awaken, link_ret = 0 ; key_check ( key ) ; key_check ( keyring ) ; awaken = 0 ; ret = - EBUSY ; if ( keyring ) { if ( keyring -> restrict_link ) return - EPERM ; link_ret = __key_link_begin ( keyring, & key -> index_key, & edit ) ; } mutex_lock ( & key_construction_mutex ) ; if (! test_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ) { atomic_inc ( & key -> user -> nikeys ) ; key -> reject_error = - error ; smp_wmb ( ) ; set_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ; set_bit ( KEY_FLAG_INSTANTIATED, & key -> flags ) ; now = current_kernel_time ( ) ; key -> expiry = now. tv_sec + timeout ; key_schedule_gc ( key -> expiry + key_gc_delay ) ; if ( test_and_clear_bit ( KEY_FLAG_USER_CONSTRUCT, & key -> flags ) ) awaken = 1 ; ret = 0 ; if ( keyring && link_ret == 0 ) __key_link ( key, & edit ) ; if ( authkey ) key_revoke ( authkey ) ; } mutex_unlock ( & key_construction_mutex ) ; <START_BUG> if ( keyring ) <END_BUG> __key_link_end ( keyring, & key -> index_key, edit ) ; if ( awaken ) wake_up_bit ( & key -> flags, KEY_FLAG_USER_CONSTRUCT ) ; return ret == 0? link_ret : ret ; }

Fix:
<S2SV_ModStart> if ( keyring && link_ret == 0
Buggy code:
 <START_BUG> int vp9_compute_qdelta ( const RATE_CONTROL * rc, double qstart, double qtarget ) { <END_BUG> int start_index = rc -> worst_quality ; int target_index = rc -> worst_quality ; int i ; for ( i = rc -> best_quality ; i < rc -> worst_quality ; ++ i ) { start_index = i ;  if ( vp9_convert_qindex_to_q ( i ) >= qstart ) <START_BUG> break ; } for ( i = rc -> best_quality ; i < rc -> worst_quality ; ++ i ) { target_index = i ; <END_BUG> if ( vp9_convert_qindex_to_q ( i ) >= qtarget )  break ; } return target_index - start_index ; }

Fix:
<S2SV_ModStart>, double qtarget, vpx_bit_depth_t bit_depth <S2SV_ModStart> vp9_convert_qindex_to_q ( i, bit_depth <S2SV_ModStart> vp9_convert_qindex_to_q ( i, bit_depth
Buggy code:
 static const char * parse_scheme ( struct parse_state * state ) { size_t mb ; const char * tmp = state -> ptr ; do { switch ( * state -> ptr ) { case ':' : state -> url. scheme = & state -> buffer [ 0 ] ; state -> buffer [ state -> offset ++ ] = 0 ; return ++ state -> ptr ; case '0' : case '1' : case '2' : case '3' : case '4' : case '5' : case '6' : case '7' : case '8' : case '9' : case '+' : case '-' : case '.' : if ( state -> ptr == tmp ) { <START_BUG> return tmp ; <END_BUG> } case 'A' : case 'B' : case 'C' : case 'D' : case 'E' : case 'F' : case 'G' : case 'H' : case 'I' : case 'J' : case 'K' : case 'L' : case 'M' : case 'N' : case 'O' : case 'P' : case 'Q' : case 'R' : case 'S' : case 'T' : case 'U' : case 'V' : case 'W' : case 'X' : case 'Y' : case 'Z' : case 'a' : case 'b' : case 'c' : case 'd' : case 'e' : case 'f' : case 'g' : case 'h' : case 'i' : case 'j' : case 'k' : case 'l' : case'm' : case 'n' : case 'o' : case 'p' : case 'q' : case 'r' : case's' : case 't' : case 'u' : case 'v' : case 'w' : case 'x' : case 'y' : case 'z' : state -> buffer [ state -> offset ++ ] = * state -> ptr ; break ; default : if (! ( mb = parse_mb ( state, PARSE_SCHEME, state -> ptr, state -> end, tmp, 1 ) ) ) {  return tmp ; <START_BUG> } state -> ptr += mb - 1 ; } } while ( ++ state -> ptr!= state -> end ) ; <END_BUG> return state -> ptr = tmp ;  }

Fix:
<S2SV_ModStart> tmp ) { goto softfail <S2SV_ModEnd> ; } case <S2SV_ModStart> ) ) { goto softfail <S2SV_ModEnd> ; } state <S2SV_ModStart> end ) ; softfail : state -> offset = 0 ;
Buggy code:
 void ssh_kex2 ( char * host, struct sockaddr * hostaddr, u_short port ) { char * myproposal [ PROPOSAL_MAX ] = { KEX_CLIENT } ; char * s ; struct kex * kex ; int r ; xxx_host = host ; xxx_hostaddr = hostaddr ; if ( ( s = kex_names_cat ( options. kex_algorithms, "ext-info-c" ) ) == NULL ) fatal ( "%s:   kex_names_cat", __func__ ) ; myproposal [ PROPOSAL_KEX_ALGS ] = compat_kex_proposal ( s ) ; myproposal [ PROPOSAL_ENC_ALGS_CTOS ] = compat_cipher_proposal ( options. ciphers ) ; myproposal [ PROPOSAL_ENC_ALGS_STOC ] = compat_cipher_proposal ( options. ciphers ) ; myproposal [ PROPOSAL_COMP_ALGS_CTOS ] = myproposal [ PROPOSAL_COMP_ALGS_STOC ] = options. compression? <START_BUG> "zlib@openssh.com,zlib,none" : "none,zlib@openssh.com,zlib" ; <END_BUG> myproposal [ PROPOSAL_MAC_ALGS_CTOS ] = myproposal [ PROPOSAL_MAC_ALGS_STOC ] = options. macs ; if ( options. hostkeyalgorithms!= NULL ) { if ( kex_assemble_names ( KEX_DEFAULT_PK_ALG, & options. hostkeyalgorithms )!= 0 ) fatal ( "%s:   kex_assemble_namelist", __func__ ) ; myproposal [ PROPOSAL_SERVER_HOST_KEY_ALGS ] = compat_pkalg_proposal ( options. hostkeyalgorithms ) ; } else { options. hostkeyalgorithms = xstrdup ( KEX_DEFAULT_PK_ALG ) ; myproposal [ PROPOSAL_SERVER_HOST_KEY_ALGS ] = compat_pkalg_proposal ( order_hostkeyalgs ( host, hostaddr, port ) ) ; } if ( options. rekey_limit || options. rekey_interval ) packet_set_rekey_limits ( (

Fix:
<S2SV_ModStart>. compression? "zlib@openssh.com,none" : "none,zlib@openssh.com" <S2SV_ModEnd> ; myproposal [
Buggy code:
 static VALUE cState_indent_set ( VALUE self, VALUE indent ) { unsigned long len ; GET_STATE ( self ) ; Check_Type ( indent, T_STRING ) ; len = RSTRING_LEN ( indent ) ; if ( len == 0 ) { if ( state -> indent ) { ruby_xfree ( state -> indent ) ; state -> indent = NULL ; state -> indent_len = 0 ; } } else { if ( state -> indent ) ruby_xfree ( state -> indent ) ; <START_BUG> state -> indent = strdup ( RSTRING_PTR ( indent ) ) ; <END_BUG> state -> indent_len = len ; } return Qnil ; }

Fix:
<S2SV_ModStart> -> indent = fstrndup <S2SV_ModEnd> ( RSTRING_PTR ( <S2SV_ModStart> ( indent ), len
Buggy code:
 static int bin_symbols ( RCore * r, int mode, ut64 laddr, int va, ut64 at, const char * name, bool exponly, const char * args ) { RBinInfo * info = r_bin_get_info ( r -> bin ) ; RList * entries = r_bin_get_entries ( r -> bin ) ; RBinSymbol * symbol ; RBinAddr * entry ; RListIter * iter ; bool firstexp = true ; bool printHere = false ; int i = 0, lastfs ='s' ; bool bin_demangle = r_config_get_i ( r -> config, "bin.demangle" ) ; if (! info ) { return 0 ; } if ( args && * args == '.' ) { printHere = true ; } bool is_arm = info && info -> arch &&! strncmp ( info -> arch, "arm", 3 ) ; const char * lang = bin_demangle? r_config_get ( r -> config, "bin.lang" ) : NULL ; RList * symbols = r_bin_get_symbols ( r -> bin ) ; r_spaces_push ( & r -> anal -> meta_spaces, "bin" ) ; if ( IS_MODE_JSON ( mode ) &&! printHere ) { r_cons_printf ( "[" ) ; } else if ( IS_MODE_SET ( mode ) ) { r_flag_space_set ( r -> flags, R_FLAGS_FS_SYMBOLS ) ; } else if (! at && exponly ) { if ( IS_MODE_RAD ( mode ) ) { r_cons_printf ( "fs   exports\\n" ) ; } else if ( IS_MODE_NORMAL ( mode ) ) { r_cons_printf ( printHere? "" : "[Exports]\\n" ) ; } } else if (! at &&! exponly ) { if ( IS_MODE_RAD ( mode ) ) { r_cons_printf ( "fs   symbols\\n" ) ; } else if ( IS_MODE_NORMAL ( mode ) ) { r_cons_printf ( printHere? "" : "[Symbols]\\n" ) ; } } if ( IS_MODE_NORMAL ( mode ) ) { r_cons_printf ( "Num   Paddr             Vaddr  

Fix:
<S2SV_ModStart> { r_cons_printf ( "\\"k <S2SV_blank> bin//pe//%s//%d=%s.%s\\"\\n" <S2SV_ModEnd>, module, <S2SV_ModStart> { r_cons_printf ( "\\"k <S2SV_blank> bin//pe//%s//%d=%s\\"\\n" <S2SV_ModEnd>, module,
Buggy code:
 static int sco_sock_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t len, int flags ) { struct sock * sk = sock -> sk ; struct sco_pinfo * pi = sco_pi ( sk ) ; lock_sock ( sk ) ; if ( sk -> sk_state == BT_CONNECT2 && test_bit ( BT_SK_DEFER_SETUP, & bt_sk ( sk ) -> flags ) ) { sco_conn_defer_accept ( pi -> conn -> hcon, pi -> setting ) ; sk -> sk_state = BT_CONFIG ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> release_sock ( sk ) ; return 0 ; } release_sock ( sk ) ; return bt_sock_recvmsg ( iocb, sock, msg, len, flags ) ; }

Fix:
<S2SV_ModStart> = BT_CONFIG ; <S2SV_ModEnd> release_sock ( sk
Buggy code:
 <START_BUG> static const char * parse_array ( cJSON * item, const char * value ) <END_BUG> { cJSON * child ; if ( * value!= '[' ) {  ep = value ; <START_BUG> return 0 ; } item -> type = cJSON_Array ; value = skip ( value + 1 ) ; if ( * value == ']' ) <END_BUG> return value + 1 ;  <START_BUG> if (! ( item -> child = child = cJSON_New_Item ( ) ) ) <END_BUG> return 0 ;  if (! ( value = skip ( parse_value ( child, skip ( value ) ) ) ) ) <START_BUG> return 0 ; while ( * value == ',' ) { cJSON * new_item ; if (! ( new_item = cJSON_New_Item ( ) ) ) return 0 ; child -> next = new_item ; new_item -> prev = child ; <END_BUG> child = new_item ;  <START_BUG> if (! ( value = skip ( parse_value ( child, skip ( value + 1 ) ) ) ) ) <END_BUG> return 0 ; } if ( * value == ']' )  return value + 1 ; <START_BUG> ep = value ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> char * value, const char * * ep <S2SV_ModStart> '[' ) { * ep = value ; return 0 ; <S2SV_ModEnd> } item -> <S2SV_ModStart> == ']' ) return value + 1 ; <S2SV_ModEnd> item -> child <S2SV_ModStart> cJSON_New_Item ( ) ; if (! item -> child ) return 0 ; <S2SV_ModEnd> value = skip <S2SV_ModStart> ( value ), ep ) ) ; if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> = child ; child = new_item ; <S2SV_ModEnd> value = skip <S2SV_ModStart> + 1 ), ep ) ) ; if (! value ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> == ']' ) return value + 1 ; * ep = value ; <S2SV_ModEnd> return 0 ;
Buggy code:
 int main ( int argc, char * argv [ ] ) { FILE * iplist = NULL ; plist_t root_node = NULL ; char * plist_out = NULL ; uint32_t size = 0 ; int read_size = 0 ; char * plist_entire = NULL ; struct stat filestats ; options_t * options = parse_arguments ( argc, argv ) ; if (! options ) { print_usage ( argc, argv ) ; return 0 ; } iplist = fopen ( options -> in_file, "rb" ) ; if (! iplist ) { free ( options ) ; return 1 ; } <START_BUG> stat ( options -> in_file, & filestats ) ; <END_BUG> plist_entire = ( char * ) malloc ( sizeof ( char ) * ( filestats. st_size + 1 ) ) ; read_size = fread ( plist_entire, sizeof ( char ), filestats. st_size, iplist ) ; fclose ( iplist ) ; if ( memcmp ( plist_entire, "bplist00", 8 ) == 0 ) { plist_from_bin ( plist_entire, read_size, & root_node ) ; plist_to_xml ( root_node, & plist_out, & size ) ; } else { plist_from_xml ( plist_entire, read_size, & root_node ) ; plist_to_bin ( root_node, & plist_out, & size ) ; } plist_free ( root_node ) ; free ( plist_entire ) ; if ( plist_out ) { if ( options -> out_file!= NULL ) { FILE * oplist = fopen ( options -> out_file, "wb" ) ; if (! oplist ) { free ( options ) ; return 1 ; } fwrite ( plist_out, size, sizeof ( char ), oplist ) ; fclose ( oplist ) ; } else fwrite ( plist_out, size, sizeof ( char ), stdout ) ; free ( plist_out ) ; } else printf ( "ERROR:   Failed   to   convert   input   file.\\n" ) ; free ( options ) ; return 0 ; }

Fix:
<S2SV_ModStart> filestats ) ; if ( filestats. st_size < 8 ) { printf ( "ERROR: <S2SV_blank> Input <S2SV_blank> file <S2SV_blank> is <S2SV_blank> too <S2SV_blank> small <S2SV_blank> to <S2SV_blank> contain <S2SV_blank> valid <S2SV_blank> plist <S2SV_blank> data.\\n" ) ; return - 1 ; }
Buggy code:
 static __u8 * mr_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { <START_BUG> if ( * rsize >= 30 && rdesc [ 29 ] == 0x05 && rdesc [ 30 ] == 0x09 ) { <END_BUG> hid_info ( hdev, "fixing   up   button//consumer   in   HID   report   descriptor\\n" ) ; rdesc [ 30 ] = 0x0c ; } return rdesc ; }

Fix:
<S2SV_ModStart> * rsize >= 31 <S2SV_ModEnd> && rdesc [
Buggy code:
 static int b_unpack ( lua_State * L ) { Header h ; const char * fmt = luaL_checkstring ( L, 1 ) ; size_t ld ; const char * data = luaL_checklstring ( L, 2, & ld ) ; <START_BUG> size_t pos = luaL_optinteger ( L, 3, 1 ) - 1 ; <END_BUG> int n = 0 ; defaultoptions ( & h ) ; while ( * fmt ) { int opt = * fmt ++ ; size_t size = optsize ( L, opt, & fmt ) ; pos += gettoalign ( pos, & h, opt, size ) ;  luaL_argcheck ( L, pos + size <= ld, 2, "data   string   too   short" ) ; <START_BUG> luaL_checkstack ( L, 2, "too   many   results" ) ; switch ( opt ) { case 'b' : case 'B' : case 'h' : case 'H' : case 'l' : case 'L' : case 'T' : case 'i' : case 'I' : { int issigned = islower ( opt ) ; lua_Number res = getinteger ( data + pos, h. endian, issigned, size ) ; lua_pushnumber ( L, res ) ; n ++ ; break ; } case 'x' : { break ; } case 'f' : { float f ; memcpy ( & f, data + pos, size ) ; correctbytes ( ( char * ) & f, sizeof ( f ), h. endian ) ; lua_pushnumber ( L, f ) ; n ++ ; break ; } case 'd' : { double d ; memcpy ( & d, data + pos, size ) ; correctbytes ( ( char * ) & d, sizeof ( d ), h. endian ) ; lua_pushnumber ( L, d ) ; n ++ ; break ; } case 'c' : { if ( size == 0 ) { if ( n == 0 ||! lua_isnumber ( L, - 1 ) ) luaL_error ( L, "format   \'c0\'   needs   a   previous   size" ) ; size = lua_tonumber ( L, - 1 ) ; lua_pop ( L, 1 ) ; n -- ; luaL_argcheck ( L, size <= ld && pos<END_BUG>

Fix:
<S2SV_ModStart>, 1 ) ; luaL_argcheck ( L, pos > 0, 3, "offset <S2SV_blank> must <S2SV_blank> be <S2SV_blank> 1 <S2SV_blank> or <S2SV_blank> greater" ) ; pos -- <S2SV_ModEnd> ; int n <S2SV_ModStart> ( L, <S2SV_ModEnd> size <= ld <S2SV_ModStart> size <= ld && pos <= ld - size, <S2SV_ModEnd> 2, "data <S2SV_blank> string <S2SV_blank> too <S2SV_blank> short"
Buggy code:
 static void emulate_load_store_insn ( struct pt_regs * regs, void __user * addr, unsigned int __user * pc ) { union mips_instruction insn ; unsigned long value ; unsigned int res ; perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, <START_BUG> 1, 0, regs, 0 ) ; <END_BUG> __get_user ( insn. word, pc ) ; switch ( insn. i_format. opcode ) { case ll_op : case lld_op : case sc_op : case scd_op : case ldl_op : case ldr_op : case lwl_op : case lwr_op : case sdl_op : case sdr_op : case swl_op : case swr_op : case lb_op : case lbu_op : case sb_op : goto sigbus ; case lh_op : if (! access_ok ( VERIFY_READ, addr, 2 ) ) goto sigbus ; __asm__ __volatile__ ( ".set\\tnoat\\n" # ifdef __BIG_ENDIAN "1:\\tlb\\t%0,   0(%2)\\n" "2:\\tlbu\\t$1,   1(%2)\\n\\t" # endif # ifdef __LITTLE_ENDIAN "1:\\tlb\\t%0,   1(%2)\\n" "2:\\tlbu\\t$1,   0(%2)\\n\\t" # endif "sll\\t%0,   0x8\\n\\t" "or\\t%0,   $1\\n\\t" "li\\t%1,   0\\n" "3:\\t.set\\tat\\n\\t" ".section\\t.fixup,\\"ax\\"\\n\\t" "4:\\tli\\t%1,   %3\\n\\t" "j\\t3b\\n\\t" ".previous\\n\\t" ".section\\t__ex_table,\\"a\\"\\n\\t" STR ( PTR ) "\\t1b,   4b\\n\\t" STR ( PTR ) "\\t2b,   4b\\n\\t" ".previous" : "=&r"

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 static bool check_underflow ( const struct ipt_entry * e ) { const struct xt_entry_target * t ; unsigned int verdict ; <START_BUG> if (! unconditional ( & e -> ip ) ) <END_BUG> return false ; t = ipt_get_target_c ( e ) ; if ( strcmp ( t -> u. user. name, XT_STANDARD_TARGET )!= 0 ) return false ; verdict = ( ( struct xt_standard_target * ) t ) -> verdict ; verdict = - verdict - 1 ; return verdict == NF_DROP || verdict == NF_ACCEPT ; }

Fix:
<S2SV_ModStart>! unconditional ( e <S2SV_ModEnd> ) ) return
Buggy code:
 <START_BUG> void vp9_rc_init_minq_luts ( ) { <END_BUG> int i ; for ( i = 0 ; i < QINDEX_RANGE ; i ++ ) { const double maxq = vp9_convert_qindex_to_q ( i ) ; kf_low_motion_minq [ i ] = get_minq_index ( maxq, 0.000001, - 0.0004, 0.15 ) ; kf_high_motion_minq [ i ] = get_minq_index ( maxq, 0.000002, - 0.0012, 0.50 ) ; gf_low_motion_minq [ i ] = get_minq_index ( maxq, 0.0000015, - 0.0009, 0.32 ) ; gf_high_motion_minq [ i ] = get_minq_index ( maxq, 0.0000021, - 0.00125, 0.50 ) ; afq_low_motion_minq [ i ] = get_minq_index ( maxq, 0.0000015, - 0.0009, 0.33 ) ; afq_high_motion_minq [ i ] = get_minq_index ( maxq, 0.0000021, - 0.00125, 0.55 ) ; inter_minq [ i ] = get_minq_index ( maxq, 0.00000271, - 0.00113, 0.75 ) ; } }

Fix:
<S2SV_ModStart> void vp9_rc_init_minq_luts ( void ) { init_minq_luts ( kf_low_motion_minq_8, kf_high_motion_minq_8, arfgf_low_motion_minq_8, arfgf_high_motion_minq_8, inter_minq_8, rtc_minq_8, VPX_BITS_8 ) ; # if CONFIG_VP9_HIGHBITDEPTH init_minq_luts ( kf_low_motion_minq_10, kf_high_motion_minq_10, arfgf_low_motion_minq_10, arfgf_high_motion_minq_10, inter_minq_10, rtc_minq_10, VPX_BITS_10 ) ; init_minq_luts ( kf_low_motion_minq_12, kf_high_motion_minq_12, arfgf_low_motion_minq_12, arfgf_high_motion_minq_
Buggy code:
 static void set_own_dir ( const char * argv0 ) { size_t l = strlen ( argv0 ) ; while ( l && argv0 [ l - 1 ]!= '//' ) l -- ; if ( l == 0 ) <START_BUG> memcpy ( own_dir, ".", 2 ) ; <END_BUG> else { memcpy ( own_dir, argv0, l - 1 ) ; own_dir [ l ] = 0 ; } }

Fix:
<S2SV_ModStart> == 0 ) # ifdef SUPER_SECURE memcpy ( own_dir, "//dev//null//", 2 ) ; # else <S2SV_ModStart> 2 ) ; # endif
Buggy code:
 <START_BUG> static void write_inter_mode ( vp9_writer * w, MB_PREDICTION_MODE mode, <END_BUG>  const vp9_prob * probs ) { <START_BUG> assert ( is_inter_mode ( mode ) ) ; vp9_write_token ( w, vp9_inter_mode_tree, probs, & inter_mode_encodings [ INTER_OFFSET ( mode ) ] ) ; }<END_BUG>

Fix:
<S2SV_ModStart> void write_inter_mode ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> * w, PREDICTION_MODE <S2SV_ModEnd> mode, const <S2SV_ModStart> mode, const vpx_prob <S2SV_ModEnd> * probs )
Buggy code:
 <START_BUG> void vp9_fht8x8_c ( const int16_t * input, int16_t * output, <END_BUG> int stride, int tx_type ) { if ( tx_type == DCT_DCT ) {  vp9_fdct8x8_c ( input, output, stride ) ; <START_BUG> } else { <END_BUG> int16_t out [ 64 ] ;  <START_BUG> int16_t * outptr = & out [ 0 ] ; <END_BUG> int i, j ;  int16_t temp_in [ 8 ], temp_out [ 8 ] ; <START_BUG> const transform_2d ht = FHT_8 [ tx_type ] ; for ( i = 0 ; i < 8 ; ++ i ) { for ( j = 0 ; j < 8 ; ++ j ) temp_in [ j ] = input [ j * stride + i ] * 4 ; ht. cols ( temp_in, temp_out ) ; for ( j = 0 ; j < 8 ; ++ j ) <END_BUG> outptr [ j * 8 + i ] = temp_out [ j ] ;  } for ( i = 0 ; i < 8 ; ++ i ) { for ( j = 0 ; j < 8 ; ++ j ) temp_in [ j ] = out [ j + i * 8 ] ; ht. rows ( temp_in, temp_out ) ; for ( j = 0 ; j < 8 ; ++ j ) output [ j + i * 8 ] = ( temp_out [ j ] + ( temp_out [ j ] < 0 ) ) >> 1 ; } } }

Fix:
<S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output, <S2SV_ModStart> DCT_DCT ) { vpx_fdct8x8_c <S2SV_ModEnd> ( input, <S2SV_ModStart> } else { tran_low_t <S2SV_ModEnd> out [ 64 <S2SV_ModStart> 64 ] ; <S2SV_ModEnd> int i, <S2SV_ModStart>, j ; tran_low_t <S2SV_ModEnd> temp_in [ 8 <S2SV_ModStart> ++ j ) out <S2SV_ModEnd> [ j *
Buggy code:
 <START_BUG> static void reconstruct_inter_block ( int plane, int block, <END_BUG> BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * arg ) { struct inter_args * args = ( struct inter_args * ) arg ; VP9_COMMON * const cm = args -> cm ;  MACROBLOCKD * const xd = args -> xd ; <START_BUG> struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <END_BUG> int x, y, eob ;  txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & x, & y ) ; <START_BUG> eob = vp9_decode_block_tokens ( cm, xd, plane, block, plane_bsize, x, y, <END_BUG> tx_size, args -> r ) ;  inverse_transform_block ( xd, plane, block, tx_size, <START_BUG> <END_BUG> & pd -> dst. buf [ 4 * y * pd -> dst. stride + 4 * x ],  pd -> dst. stride, eob ) ; <START_BUG> * args -> eobtotal += eob ; <END_BUG> }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int reconstruct_inter_block ( <S2SV_ModEnd> MACROBLOCKD * const <S2SV_ModStart> * const xd, vpx_reader * r, MB_MODE_INFO * const mbmi, int plane, int row, int col, TX_SIZE tx_size ) { <S2SV_ModEnd> struct macroblockd_plane * <S2SV_ModStart> plane ] ; const scan_order * sc = & vp9_default_scan_orders [ tx_size ] ; const int <S2SV_ModEnd> eob = vp9_decode_block_tokens <S2SV_ModStart> eob = vp9_decode_block_tokens <S2SV_ModEnd> ( xd, <S2SV_ModStart>, plane, sc, col, row, tx_size, r, mbmi -> segment_id ) ; inverse_transform_block_inter ( xd, plane <S2SV_ModEnd>, tx_size, <S2SV_ModStart> [ 4 * row <S2SV_ModEnd> * pd -> <S2SV_ModStart> + 4 * col <S2SV_ModEnd> ], pd <S2SV_ModStart> eob ) ; return <S2SV_ModEnd> eob ; }
Buggy code:
 static int myrecvfrom6 ( int sockfd, void * buf, size_t * buflen, int flags, <START_BUG> struct in6_addr * addr, uint32_t * ifindex ) <END_BUG> { struct sockaddr_in6 sin6 ;  unsigned char cbuf [ CMSG_SPACE ( sizeof ( struct in6_pktinfo ) ) ] ; <START_BUG> struct iovec iovec ; struct msghdr msghdr ; struct cmsghdr * cmsghdr ; ssize_t len ; iovec. iov_len = * buflen ; iovec. iov_base = buf ; memset ( & msghdr, 0, sizeof ( msghdr ) ) ; msghdr. msg_name = & sin6 ; msghdr. msg_namelen = sizeof ( sin6 ) ; msghdr. msg_iov = & iovec ; msghdr. msg_iovlen = 1 ; msghdr. msg_control = cbuf ; msghdr. msg_controllen = sizeof ( cbuf ) ; len = recvmsg ( sockfd, & msghdr, flags ) ; if ( len == - 1 ) return - errno ; * buflen = len ; * ifindex = sin6. sin6_scope_id ; for ( cmsghdr = CMSG_FIRSTHDR ( & msghdr ) ; cmsghdr ; cmsghdr = CMSG_NXTHDR ( & msghdr, cmsghdr ) ) { <END_BUG> if ( cmsghdr -> cmsg_level == IPPROTO_IPV6 &&  <START_BUG> cmsghdr -> cmsg_type == IPV6_PKTINFO && <END_BUG> cmsghdr -> cmsg_len == CMSG_LEN ( sizeof ( struct in6_pktinfo ) ) ) { struct in6_pktinfo * pktinfo ; pktinfo = ( struct in6_pktinfo * ) CMSG_DATA ( cmsghdr ) ; * ifindex = pktinfo -> ipi6_ifindex ; }  } <START_BUG> * addr = sin6. sin6_addr ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> uint32_t * ifindex, int * hoplimit <S2SV_ModStart> char cbuf [ 2 * <S2SV_ModStart> cmsghdr -> cmsg_level!= IPPROTO_IPV6 ) continue ; switch ( <S2SV_ModEnd> cmsghdr -> cmsg_type <S2SV_ModStart> cmsghdr -> cmsg_type ) { case IPV6_PKTINFO : if ( <S2SV_ModEnd> cmsghdr -> cmsg_len <S2SV_ModStart> ipi6_ifindex ; } break ; case IPV6_HOPLIMIT : if ( cmsghdr -> cmsg_len == CMSG_LEN ( sizeof ( int ) ) ) { int * val ; val = ( int * ) CMSG_DATA ( cmsghdr ) ; * hoplimit = * val ; } break ; }
Buggy code:
 static void bgp_capabilities_print ( netdissect_options * ndo, const u_char * opt, int caps_len ) { int cap_type, cap_len, tcap_len, cap_offset ; int i = 0 ; while ( i < caps_len ) { ND_TCHECK2 ( opt [ i ], BGP_CAP_HEADER_SIZE ) ; cap_type = opt [ i ] ; cap_len = opt [ i + 1 ] ; tcap_len = cap_len ; ND_PRINT ( ( ndo, "\\n\\t             %s   (%u),   length:   %u", tok2str ( bgp_capcode_values, "Unknown", cap_type ), cap_type, cap_len ) ) ; ND_TCHECK2 ( opt [ i + 2 ], cap_len ) ; switch ( cap_type ) { <START_BUG> case BGP_CAPCODE_MP : <END_BUG> ND_PRINT ( ( ndo, "\\n\\t\\tAFI   %s   (%u),   SAFI   %s   (%u)", tok2str ( af_values, "Unknown", EXTRACT_16BITS ( opt + i + 2 ) ), EXTRACT_16BITS ( opt + i + 2 ), tok2str ( bgp_safi_values, "Unknown", opt [ i + 5 ] ), opt [ i + 5 ] ) ) ; break ; case BGP_CAPCODE_RESTART : ND_TCHECK_16BITS ( opt + i + 2 ) ; ND_PRINT ( ( ndo, "\\n\\t\\tRestart   Flags:   [%s],   Restart   Time   %us", ( ( opt [ i + 2 ] ) & 0x80 )? "R" : "none", EXTRACT_16BITS ( opt + i + 2 ) & 0xfff ) ) ; tcap_len -= 2 ; cap_offset = 4 ; while ( tcap_len >= 4 ) { ND_PRINT ( ( ndo, "\\n\\t\\t     AFI   %s   (%u),   SAFI   %s   (%u),   Forwarding   state   preserved:   %s", tok2str ( af_values, "Unknown", EXTRACT_16

Fix:
<S2SV_ModStart> case BGP_CAPCODE_MP : ND_TCHECK_8BITS ( opt + i + 5 ) ;
Buggy code:
 int mpi_powm ( MPI res, MPI base, MPI exp, MPI mod ) { mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL ; mpi_ptr_t xp_marker = NULL ; mpi_ptr_t tspace = NULL ; mpi_ptr_t rp, ep, mp, bp ; mpi_size_t esize, msize, bsize, rsize ; int esign, msign, bsign, rsign ; mpi_size_t size ; int mod_shift_cnt ; int negative_result ; int assign_rp = 0 ; mpi_size_t tsize = 0 ; int rc = - ENOMEM ; esize = exp -> nlimbs ; msize = mod -> nlimbs ; size = 2 * msize ; esign = exp -> sign ; msign = mod -> sign ; rp = res -> d ; ep = exp -> d ; if (! msize ) return - EINVAL ; if (! esize ) { <START_BUG> rp [ 0 ] = 1 ; <END_BUG>  res -> nlimbs = ( msize == 1 && mod -> d [ 0 ] == 1 )? 0 : 1 ; <START_BUG> res -> sign = 0 ; goto leave ; } mp = mp_marker = mpi_alloc_limb_space ( msize ) ; if (! mp ) goto enomem ; mod_shift_cnt = count_leading_zeros ( mod -> d [ msize - 1 ] ) ; if ( mod_shift_cnt ) mpihelp_lshift ( mp, mod -> d, msize, mod_shift_cnt ) ; else MPN_COPY ( mp, mod -> d, msize ) ; bsize = base -> nlimbs ; bsign = base -> sign ; if ( bsize > msize ) { bp = bp_marker = mpi_alloc_limb_space ( bsize + 1 ) ; if (! bp ) goto enomem ; MPN_COPY ( bp, base -> d, bsize ) ; mpihelp_divrem ( bp + msize, 0, bp, bsize, mp, msize ) ; bsize = msize ; MPN_NORMALIZE ( bp, bsize ) ; } else bp = base -> d ; if (! bsize<END_BUG>

Fix:
<S2SV_ModStart> esize ) { <S2SV_ModEnd> res -> nlimbs <S2SV_ModStart> : 1 ; if ( res -> nlimbs ) { if ( mpi_resize ( res, 1 ) < 0 ) goto enomem ; rp = res -> d ; rp [ 0 ] = 1 ; }
Buggy code:
 static arg_ty ast_for_arg ( struct compiling * c, const node * n ) { identifier name ; expr_ty annotation = NULL ; node * ch ; arg_ty ret ; assert ( TYPE ( n ) == tfpdef || TYPE ( n ) == vfpdef ) ; ch = CHILD ( n, 0 ) ; name = NEW_IDENTIFIER ( ch ) ; if (! name ) return NULL ; if ( forbidden_name ( c, name, ch, 0 ) ) return NULL ; if ( NCH ( n ) == 3 && TYPE ( CHILD ( n, 1 ) ) == COLON ) { annotation = ast_for_expr ( c, CHILD ( n, 2 ) ) ; if (! annotation ) return NULL ; } <START_BUG> ret = arg ( name, annotation, LINENO ( n ), n -> n_col_offset, <END_BUG> n -> n_end_lineno, n -> n_end_col_offset, c -> c_arena ) ; if (! ret ) return NULL ; return ret ; }

Fix:
<S2SV_ModStart>, annotation, NULL,
Buggy code:
 static int init_device ( u2fh_devs * devs, struct u2fdevice * dev ) { unsigned char resp [ 1024 ] ; unsigned char nonce [ 8 ] ; if ( obtain_nonce ( nonce )!= 0 ) { return U2FH_TRANSPORT_ERROR ; } size_t resplen = sizeof ( resp ) ; dev -> cid = CID_BROADCAST ; if ( u2fh_sendrecv ( devs, dev -> id, U2FHID_INIT, nonce, sizeof ( nonce ), resp, & resplen ) == U2FH_OK ) { <START_BUG> U2FHID_INIT_RESP initresp ; <END_BUG>  if ( resplen > sizeof ( initresp ) ) <START_BUG> { return U2FH_MEMORY_ERROR ; } memcpy ( & initresp, resp, resplen ) ; <END_BUG> dev -> cid = initresp. cid ;  <START_BUG> dev -> versionInterface = initresp. versionInterface ; <END_BUG>  dev -> versionMajor = initresp. versionMajor ; <START_BUG> <END_BUG> dev -> versionMinor = initresp. versionMinor ;  <START_BUG> dev -> capFlags = initresp. capFlags ; <END_BUG> } else { return U2FH_TRANSPORT_ERROR ; } return U2FH_OK ; }

Fix:
<S2SV_ModStart> U2FH_OK ) { int offs = sizeof ( nonce ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> if ( resplen < 17 ) { return U2FH_SIZE_ERROR ; } if ( memcmp ( nonce, resp, sizeof ( nonce ) )!= 0 ) { return U2FH_TRANSPORT_ERROR ; } <S2SV_ModEnd> dev -> cid <S2SV_ModStart> -> cid = resp [ offs ] << 24 | resp [ offs + 1 ] << 16 | resp [ offs + 2 ] << 8 | resp [ offs + 3 ] ; offs += 4 <S2SV_ModEnd> ; dev -> <S2SV_ModStart> -> versionInterface = resp [ offs ++ ] <S2SV_ModEnd> ; dev -> <S2SV_ModStart> -> versionMajor = resp [ offs ++ ] <S2SV_ModEnd> ; dev -> <S2SV_ModStart> -> versionMinor = resp [ offs ++ ] ; dev -> versionBuild = resp [ offs ++ ] <S2SV_ModEnd> ; dev -> <S2SV_ModStart> -> capFlags = resp [ offs ++ ] <S2SV_ModEnd> ; } else
Buggy code:
 void initServerConfig ( ) { server. port = REDIS_SERVERPORT ; server. bindaddr = NULL ; server. unixsocket = NULL ; server. ipfd = - 1 ; server. sofd = - 1 ; server. dbnum = REDIS_DEFAULT_DBNUM ; server. verbosity = REDIS_VERBOSE ; server. maxidletime = REDIS_MAXIDLETIME ; server. saveparams = NULL ; server. loading = 0 ; server. logfile = NULL ; server. syslog_enabled = 0 ; server. syslog_ident = zstrdup ( "redis" ) ; server. syslog_facility = LOG_LOCAL0 ; server. glueoutputbuf = 1 ; server. daemonize = 0 ; server. appendonly = 0 ; server. appendfsync = APPENDFSYNC_EVERYSEC ; server. no_appendfsync_on_rewrite = 0 ; server. lastfsync = time ( NULL ) ; server. appendfd = - 1 ; server. appendseldb = - 1 ; server. pidfile = zstrdup ( "//var//run//redis.pid" ) ; server. dbfilename = zstrdup ( "dump.rdb" ) ; server. appendfilename = zstrdup ( "appendonly.aof" ) ; server. requirepass = NULL ; server. rdbcompression = 1 ; server. activerehashing = 1 ; server. maxclients = 0 ; server. bpop_blocked_clients = 0 ; server. maxmemory = 0 ; server. maxmemory_policy = REDIS_MAXMEMORY_VOLATILE_LRU ; server. maxmemory_samples = 3 ; <START_BUG> server. vm_enabled = 0 ; <END_BUG>  server. vm_swap_file = zstrdup ( "//tmp//redis-%p.vm" ) ; <START_BUG> server. vm_page_size = 256 ; server. vm_pages = 1024 * 1024 * 100 ; <END_BUG> server. vm_max_memory = 1024LL * 1024 * 1024 * 1 ;  server. vm_max_threads = 4 ; server. vm_blocked_clients = 0 ; server. hash_max_zipmap_entries = REDIS_HASH_MAX_ZIPMAP_ENTRIES ; server. hash_max_zipmap_value = REDIS_HASH_MAX_ZIPMAP_VALUE ; server. list_max_ziplist_entries = REDIS_

Fix:
<S2SV_ModStart> ; server. ds_enabled = 0 ; server. ds_path <S2SV_ModEnd> = zstrdup ( <S2SV_ModStart> = zstrdup ( "//tmp//redis.ds" ) ; server. cache_max_memory = 64LL <S2SV_ModEnd> * 1024 * <S2SV_ModStart> 1024 * 1024 ; server. cache_blocked_clients <S2SV_ModEnd> = 0 ;
Buggy code:
 static void exif_data_load_data_thumbnail ( ExifData * data, const unsigned char * d, unsigned int ds, ExifLong o, ExifLong s ) { <START_BUG> if ( ( o + s < o ) || ( o + s < s ) || ( o + s > ds ) || ( o > ds ) ) { <END_BUG>  exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", <START_BUG> "Bogus   thumbnail   offset   (%u)   or   size   (%u).", o, s ) ; return ; } if ( data -> data ) exif_mem_free ( data -> priv -> mem, data -> data ) ; if (! ( data -> data = exif_data_alloc ( data, s ) ) ) { EXIF_LOG_NO_MEMORY ( data -> priv -> log, "ExifData", s ) ; data -> size = 0 ; return ; } data -> size = s ; memcpy ( data -> data, d + o, s ) ; }<END_BUG>

Fix:
<S2SV_ModStart> { if ( o >= ds <S2SV_ModEnd> ) { exif_log <S2SV_ModStart>, "ExifData", "Bogus <S2SV_blank> thumbnail <S2SV_blank> offset <S2SV_blank> (%u).", o ) ; return ; } if ( s > ds - o ) { exif_log ( data -> priv -> log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus <S2SV_blank> thumbnail <S2SV_blank> size <S2SV_blank> (%u), <S2SV_blank> max <S2SV_blank> would <S2SV_blank> be <S2SV_blank> %u.", s, ds - o <S2SV_ModEnd> ) ; return