nus-yam/ex-repair huggingface dataset:
Buggy code:
 opj_image_t * bmptoimage ( const char * filename, opj_cparameters_t * parameters ) { opj_image_cmptparm_t cmptparm [ 4 ] ; OPJ_UINT8 lut_R [ 256 ], lut_G [ 256 ], lut_B [ 256 ] ; OPJ_UINT8 const * pLUT [ 3 ] ; opj_image_t * image = NULL ; FILE * IN ; OPJ_BITMAPFILEHEADER File_h ; OPJ_BITMAPINFOHEADER Info_h ; OPJ_UINT32 i, palette_len, numcmpts = 1U ; OPJ_BOOL l_result = OPJ_FALSE ; OPJ_UINT8 * pData = NULL ; OPJ_UINT32 stride ; pLUT [ 0 ] = lut_R ; pLUT [ 1 ] = lut_G ; pLUT [ 2 ] = lut_B ; IN = fopen ( filename, "rb" ) ; if (! IN ) { fprintf ( stderr, "Failed   to   open   %s   for   reading  !!\\n", filename ) ; return NULL ; } if (! bmp_read_file_header ( IN, & File_h ) ) { fclose ( IN ) ; return NULL ; } if (! bmp_read_info_header ( IN, & Info_h ) ) { fclose ( IN ) ; return NULL ; } if ( Info_h. biBitCount <= 8U ) { memset ( & lut_R [ 0 ], 0, sizeof ( lut_R ) ) ; memset ( & lut_G [ 0 ], 0, sizeof ( lut_G ) ) ; memset ( & lut_B [ 0 ], 0, sizeof ( lut_B ) ) ; palette_len = Info_h. biClrUsed ; if ( ( palette_len == 0U ) && ( Info_h. biBitCount <= 8U ) ) { palette_len = ( 1U << Info_h. biBitCount ) ; } if ( palette_len > 256U ) { palette_len = 256U ; } if ( palette_len > 0U ) { OPJ_UINT8 has_color = 0U ; for ( i = 0U ; i < palette_len ; i

Fix:
<S2SV_ModStart> ; } } if ( Info_h. biWidth == 0 || Info_h. biHeight == 0 ) { fclose ( IN ) ; return NULL ; } if ( Info_h. biBitCount > ( ( ( OPJ_UINT32 ) - 1 ) - 31 ) // Info_h. biWidth ) { fclose ( IN ) ; return NULL ; } <S2SV_ModStart> 2 ) { if ( 8 > ( ( ( OPJ_UINT32 ) - 1 ) - 31 ) // Info_h. biWidth ) { fclose ( IN ) ; return NULL ; } <S2SV_ModStart> 4U ; } if ( stride > ( ( OPJ_UINT32 ) - 1 ) // sizeof ( OPJ_UINT8 ) // Info_h. biHeight ) { fclose ( IN ) ; return NULL ; }
Buggy code:
 static void create_watching_parent ( void ) { pid_t child ; sigset_t ourset ; struct sigaction oldact [ 3 ] ; int status = 0 ; int retval ; retval = pam_open_session ( pamh, 0 ) ; if ( is_pam_failure ( retval ) ) { cleanup_pam ( retval ) ; errx ( EXIT_FAILURE, _ ( "cannot   open   session:   %s" ), pam_strerror ( pamh, retval ) ) ; } else _pam_session_opened = 1 ; memset ( oldact, 0, sizeof ( oldact ) ) ; child = fork ( ) ; if ( child == ( pid_t ) - 1 ) { cleanup_pam ( PAM_ABORT ) ; err ( EXIT_FAILURE, _ ( "cannot   create   child   process" ) ) ; } if ( child == 0 ) return ; if ( chdir ( "//" )!= 0 ) warn ( _ ( "cannot   change   directory   to   %s" ), "//" ) ; sigfillset ( & ourset ) ; if ( sigprocmask ( SIG_BLOCK, & ourset, NULL ) ) { warn ( _ ( "cannot   block   signals" ) ) ; caught_signal = true ; } if (! caught_signal ) { struct sigaction action ; action. sa_handler = su_catch_sig ; sigemptyset ( & action. sa_mask ) ; action. sa_flags = 0 ; sigemptyset ( & ourset ) ; if (! same_session ) { if ( sigaddset ( & ourset, SIGINT ) || sigaddset ( & ourset, SIGQUIT ) ) { warn ( _ ( "cannot   set   signal   handler" ) ) ; caught_signal = true ; } } if (! caught_signal && ( sigaddset ( & ourset, SIGTERM ) || sigaddset ( & ourset, SIGALRM ) || sigaction ( SIGTERM, & action, & oldact [ 0 ] ) || sigprocmask ( SIG_UNBLOCK, & ourset, NULL ) ) ) { warn ( _ ( "cannot   set   signal   handler" ) ) ; caught_signal = true ; } if (! caught_signal &&! same_session && ( sigaction ( SIGINT, & action, & oldact

Fix:
<S2SV_ModStart> status ) ; child = ( pid_t ) - 1 ; <S2SV_ModStart> if ( caught_signal && child!= ( pid_t ) - 1 <S2SV_ModStart> caught_signal ) { if ( child!= ( pid_t ) - 1 ) { <S2SV_ModStart> ) ) ; }
Buggy code:
 static Image * ReadTGAImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; PixelInfo pixel ; Quantum index ; register Quantum * q ; register ssize_t i, x ; size_t base, flag, offset, real, skip ; ssize_t count, y ; TGAInfo tga_info ; unsigned char j, k, pixels [ 4 ], runlength ; unsigned int alpha_bits ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } count = ReadBlob ( image, 1, & tga_info. id_length ) ; tga_info. colormap_type = ( unsigned char ) ReadBlobByte ( image ) ; tga_info. image_type = ( TGAImageType ) ReadBlobByte ( image ) ; if ( ( count!= 1 ) || ( ( tga_info. image_type!= TGAColormap ) && ( tga_info. image_type!= TGARGB ) && ( tga_info. image_type!= TGAMonochrome ) && ( tga_info. image_type!= TGARLEColormap ) && ( tga_info. image_type!= TGARLERGB ) && ( tga_info. image_type!= TGARLEMonochrome ) ) || ( ( ( tga_info. image_type == TGAColormap ) || ( tga_info. image_type == TGARLEColormap ) ) && ( tga_info. colormap_type == 0 ) ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; tga_

Fix:
<S2SV_ModStart> 0 ) { if ( image -> colors < tga_info. colormap_index ) image -> colors = tga_info. colormap_index ;
Buggy code:
 static int raw_sendmsg ( struct sock * sk, struct msghdr * msg, size_t len ) { struct inet_sock * inet = inet_sk ( sk ) ; struct net * net = sock_net ( sk ) ; struct ipcm_cookie ipc ; struct rtable * rt = NULL ; struct flowi4 fl4 ; int free = 0 ; __be32 daddr ; __be32 saddr ; u8 tos ; int err ; struct ip_options_data opt_copy ; struct raw_frag_vec rfv ; <START_BUG> err = - EMSGSIZE ; <END_BUG> if ( len > 0xFFFF )  goto out ; <START_BUG> err = - EOPNOTSUPP ; if ( msg -> msg_flags & MSG_OOB ) goto out ; if ( msg -> msg_namelen ) { DECLARE_SOCKADDR ( struct sockaddr_in *, usin, msg -> msg_name ) ; err = - EINVAL ; if ( msg -> msg_namelen < sizeof ( * usin ) ) goto out ; if ( usin -> sin_family!= AF_INET ) { pr_info_once ( "%s:   %s   forgot   to   set   AF_INET.   Fix   it!\\n", __func__, current -> comm ) ; err = - EAFNOSUPPORT ; if ( usin -> sin_family ) goto out ; } daddr = usin -> sin_addr. s_addr ; } else { err = - EDESTADDRREQ ; if ( sk -> sk_state!= TCP_ESTABLISHED ) goto out ; daddr = inet -> inet_daddr ; } ipc. sockc. tsflags = sk -> sk_tsflags ; ipc. addr = inet -> inet_saddr ; ipc. opt = NULL ; ipc. tx_flags = 0 ; ipc. ttl = 0 ; ipc. tos = - 1 ; ipc. oif = sk -> sk_bound_dev_if ; if ( msg -> msg_controllen ) { err = ip_cmsg_send ( sk, msg, & ipc, false ) ; if ( unlikely ( err ) ) { kfree ( ipc. opt ) ; goto out ; } if ( ipc. opt ) free = 1 ; } saddr = ipc.<END_BUG>

Fix:
<S2SV_ModStart> raw_frag_vec rfv ; int hdrincl ; <S2SV_ModStart> ) goto out ; hdrincl = inet -> hdrincl <S2SV_ModStart> ; if ( <S2SV_ModEnd> hdrincl ) goto <S2SV_ModStart>, RT_SCOPE_UNIVERSE, <S2SV_ModEnd> hdrincl? IPPROTO_RAW <S2SV_ModStart> ) | ( <S2SV_ModEnd> hdrincl? FLOWI_FLAG_KNOWN_NH <S2SV_ModStart> if (! <S2SV_ModEnd> hdrincl ) { <S2SV_ModStart> : if ( <S2SV_ModEnd> hdrincl ) err
Buggy code:
 static void filter_selectively_horiz ( uint8_t * s, int pitch, unsigned int mask_16x16, unsigned int mask_8x8, unsigned int mask_4x4, unsigned int mask_4x4_int, const loop_filter_info_n * lfi_n, const uint8_t * lfl ) { unsigned int mask ; int count ; for ( mask = mask_16x16 | mask_8x8 | mask_4x4 | mask_4x4_int ; mask ; mask >>= count ) { const loop_filter_thresh * lfi = lfi_n -> lfthr + * lfl ; count = 1 ; if ( mask & 1 ) { if ( mask_16x16 & 1 ) { if ( ( mask_16x16 & 3 ) == 3 ) { <START_BUG> vp9_lpf_horizontal_16 ( s, pitch, lfi -> mblim, lfi -> lim, <END_BUG> lfi -> hev_thr, 2 ) ; count = 2 ; } else {  vp9_lpf_horizontal_16 ( s, pitch, lfi -> mblim, lfi -> lim, <START_BUG> lfi -> hev_thr, 1 ) ; } } else if ( mask_8x8 & 1 ) { if ( ( mask_8x8 & 3 ) == 3 ) { const loop_filter_thresh * lfin = lfi_n -> lfthr + * ( lfl + 1 ) ; <END_BUG> vp9_lpf_horizontal_8_dual ( s, pitch, lfi -> mblim, lfi -> lim,  lfi -> hev_thr, lfin -> mblim, lfin -> lim, lfin -> hev_thr ) ; if ( ( mask_4x4_int & 3 ) == 3 ) { <START_BUG> vp9_lpf_horizontal_4_dual ( s + 4 * pitch, pitch, lfi -> mblim, <END_BUG> lfi -> lim, lfi -> hev_thr, lfin -> mblim, lfin -> lim, lfin -> hev_thr ) ; } else { if ( mask_4x4_int & 1 ) vp9_lpf_horizontal_4 ( s + 4 * pitch, pitch, lfi ->

Fix:
<S2SV_ModStart> 3 ) { vpx_lpf_horizontal_16 <S2SV_ModEnd> ( s, <S2SV_ModStart> } else { vpx_lpf_horizontal_16 <S2SV_ModEnd> ( s, <S2SV_ModStart> 1 ) ; vpx_lpf_horizontal_8_dual <S2SV_ModEnd> ( s, <S2SV_ModStart> 3 ) { vpx_lpf_horizontal_4_dual ( s + 4 * pitch, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr, lfin -> mblim, lfin -> lim, lfin -> hev_thr ) ; } else { if ( mask_4x4_int & 1 ) vpx_lpf_horizontal_4 <S2SV_ModEnd> ( s + <S2SV_ModStart> & 2 ) vpx_lpf_horizontal_4 <S2SV_ModEnd> ( s + <S2SV_ModStart> } else { vpx_lpf_horizontal_8 ( s, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr, 1 ) ; if ( mask_4x4_int & 1 ) vpx_lpf_horizontal_4 <S2SV_ModEnd> ( s + <S2SV_ModStart> 1 ) ; vpx_lpf_horizontal_4_dual <S2SV_ModEnd> ( s,
Buggy code:
 static Image * ReadSUNImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define RMT_EQUAL_RGB 1 # define RMT_NONE 0 # define RMT_RAW 2 # define RT_STANDARD 1 # define RT_ENCODED 2 # define RT_FORMAT_RGB 3 typedef struct _SUNInfo { unsigned int magic, width, height, depth, length, type, maptype, maplength ; } SUNInfo ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register IndexPacket * indexes ; register PixelPacket * q ; register ssize_t i, x ; register unsigned char * p ; size_t bytes_per_line, extent, height, pixels_length, quantum ; ssize_t count, y ; SUNInfo sun_info ; unsigned char * sun_data, * sun_pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & sun_info, 0, sizeof ( sun_info ) ) ; sun_info. magic = ReadBlobMSBLong ( image ) ; do { if ( sun_info. magic!= 0x59a66a95 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; sun_info. width = ReadBlobMSBLong ( image ) ; sun_info. height = ReadBlobMSBLong ( image ) ; sun_info. depth = ReadBlobMSBLong ( image ) ; sun_info. length = ReadBlobMSBLong ( image ) ; sun_info. type = ReadBlobMSBLong ( image ) ; sun_info. maptype = ReadBlobMSB

Fix:
<S2SV_ModStart> AcquireQuantumMemory ( pixels_length + image -> rows
Buggy code:
 <START_BUG> static inline int <END_BUG> addrs_in_same_network_family ( const tor_addr_t * a1, const tor_addr_t * a2 ) { return 0 == tor_addr_compare_masked ( a1, a2, 16, CMP_SEMANTIC ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> int addrs_in_same_network_family (
Buggy code:
 Datum lquery_in ( PG_FUNCTION_ARGS ) { char * buf = ( char * ) PG_GETARG_POINTER ( 0 ) ; char * ptr ; int num = 0, totallen = 0, numOR = 0 ; int state = LQPRS_WAITLEVEL ; lquery * result ; nodeitem * lptr = NULL ; lquery_level * cur, * curqlevel, * tmpql ; lquery_variant * lrptr = NULL ; bool hasnot = false ; bool wasbad = false ; int charlen ; int pos = 0 ; ptr = buf ; while ( * ptr ) { charlen = pg_mblen ( ptr ) ; if ( charlen == 1 ) { if ( t_iseq ( ptr, '.' ) ) num ++ ; else if ( t_iseq ( ptr, '|' ) ) numOR ++ ; } ptr += charlen ; } <START_BUG> num ++ ; <END_BUG> curqlevel = tmpql = ( lquery_level * ) palloc0 ( ITEMSIZE * num ) ; ptr = buf ; while ( * ptr ) { charlen = pg_mblen ( ptr ) ; if ( state == LQPRS_WAITLEVEL ) { if ( ISALNUM ( ptr ) ) { GETVAR ( curqlevel ) = lptr = ( nodeitem * ) palloc0 ( sizeof ( nodeitem ) * ( numOR + 1 ) ) ; lptr -> start = ptr ; state = LQPRS_WAITDELIM ; curqlevel -> numvar = 1 ; } else if ( charlen == 1 && t_iseq ( ptr, '!' ) ) { GETVAR ( curqlevel ) = lptr = ( nodeitem * ) palloc0 ( sizeof ( nodeitem ) * ( numOR + 1 ) ) ; lptr -> start = ptr + 1 ; state = LQPRS_WAITDELIM ; curqlevel -> numvar = 1 ; curqlevel -> flag |= LQL_NOT ; hasnot = true ; } else if ( charlen == 1 && t_iseq ( ptr, '*' ) ) state = LQPRS_WAITOPEN ; else UNCHAR ; } else if ( state == LQPRS_WAITVAR ) { if ( ISALNUM ( ptr ) ) { lptr ++ ; lptr -> start = ptr ; state = LQPRS_WAITDELIM ; curqlevel -> numvar

Fix:
<S2SV_ModStart> } num ++ ; if ( num > MaxAllocSize // ITEMSIZE ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> levels <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", num, ( int ) ( MaxAllocSize // ITEMSIZE ) ) ) )
Buggy code:
 static int isis_print_is_reach_subtlv ( netdissect_options * ndo, const uint8_t * tptr, u_int subt, u_int subl, const char * ident ) { u_int te_class, priority_level, gmpls_switch_cap ; union { float f ; uint32_t i ; } bw ; ND_PRINT ( ( ndo, "%s%s   subTLV   #%u,   length:   %u", ident, tok2str ( isis_ext_is_reach_subtlv_values, "unknown", subt ), subt, subl ) ) ; ND_TCHECK2 ( * tptr, subl ) ; switch ( subt ) { case ISIS_SUBTLV_EXT_IS_REACH_ADMIN_GROUP : case ISIS_SUBTLV_EXT_IS_REACH_LINK_LOCAL_REMOTE_ID : case ISIS_SUBTLV_EXT_IS_REACH_LINK_REMOTE_ID : if ( subl >= 4 ) { ND_PRINT ( ( ndo, ",   0x%08x", EXTRACT_32BITS ( tptr ) ) ) ; if ( subl == 8 ) ND_PRINT ( ( ndo, ",   0x%08x", EXTRACT_32BITS ( tptr + 4 ) ) ) ; } break ; case ISIS_SUBTLV_EXT_IS_REACH_IPV4_INTF_ADDR : case ISIS_SUBTLV_EXT_IS_REACH_IPV4_NEIGHBOR_ADDR : if ( subl >= sizeof ( struct in_addr ) ) ND_PRINT ( ( ndo, ",   %s", ipaddr_string ( ndo, tptr ) ) ) ; break ; case ISIS_SUBTLV_EXT_IS_REACH_MAX_LINK_BW : case ISIS_SUBTLV_EXT_IS_REACH_RESERVABLE_BW : if ( subl >= 4 ) { bw. i = EXTRACT_32BITS ( tptr ) ; ND_PRINT ( ( ndo, ",   %.3f   Mbps", bw. f * 8 // 1000000 ) ) ; } break ; case ISIS_SUBTLV

Fix:
<S2SV_ModStart> case ISIS_SUBTLV_EXT_IS_REACH_BW_CONSTRAINTS_OLD : if ( subl == 0 ) break ; <S2SV_ModStart> ++ ) { <S2SV_ModEnd> bw. i
Buggy code:
 static void nhmldump_send_header ( GF_NHMLDumpCtx * ctx ) { GF_FilterPacket * dst_pck ; char nhml [ 1024 ] ; u32 size ; u8 * output ; const GF_PropertyValue * p ; ctx -> szRootName = "NHNTStream" ; if ( ctx -> dims ) { ctx -> szRootName = "DIMSStream" ; } if (! ctx -> filep ) { sprintf ( nhml, "<?xml   version=\\"1.0\\"   encoding=\\"UTF-8\\"  ?>\\n" ) ; gf_bs_write_data ( ctx -> bs_w, nhml, ( u32 ) strlen ( nhml ) ) ; } sprintf ( nhml, "<%s   version=\\"1.0\\"   ", ctx -> szRootName ) ; gf_bs_write_data ( ctx -> bs_w, nhml, ( u32 ) strlen ( nhml ) ) ; NHML_PRINT_UINT ( GF_PROP_PID_ID, NULL, "trackID" ) NHML_PRINT_UINT ( GF_PROP_PID_TIMESCALE, NULL, "timeScale" ) p = gf_filter_pid_get_property ( ctx -> ipid, GF_PROP_PID_IN_IOD ) ; if ( p && p -> value. boolean ) { sprintf ( nhml, "inRootOD=\\"yes\\"   " ) ; gf_bs_write_data ( ctx -> bs_w, nhml, ( u32 ) strlen ( nhml ) ) ; } if ( ctx -> oti && ( ctx -> oti < GF_CODECID_LAST_MPEG4_MAPPING ) ) { sprintf ( nhml, "streamType=\\"%d\\"   objectTypeIndication=\\"%d\\"   ", ctx -> streamtype, ctx -> oti ) ; gf_bs_write_data ( ctx -> bs_w, nhml, ( u32 ) strlen ( nhml ) ) ; } else { p = gf_filter_pid_get_property ( ctx -> ipid, GF_PROP_PID_SUBTYPE ) ; if ( p ) { sprintf ( nhml, "%s=\\"%s\\"   ", "mediaType", gf_4cc_

Fix:
<S2SV_ModStart> GF_PROP_PID_AUDIO_FORMAT ) ; if ( p )
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } quantum_info = ( QuantumInfo * ) NULL ; clone_info = ( ImageInfo * ) NULL ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image

Fix:
<S2SV_ModStart> 6 ) ) { MATLAB_KO : clone_info = DestroyImageInfo ( clone_info ) ; <S2SV_ModEnd> ThrowReaderException ( CorruptImageError <S2SV_ModStart> "ImproperImageHeader" ) ; }
Buggy code:
 qboolean S_AL_Init ( soundInterface_t * si ) { # ifdef USE_OPENAL const char * device = NULL ; const char * inputdevice = NULL ; int i ; if (! si ) { return qfalse ; } for ( i = 0 ; i < MAX_RAW_STREAMS ; i ++ ) { streamSourceHandles [ i ] = - 1 ; streamPlaying [ i ] = qfalse ; streamSources [ i ] = 0 ; streamNumBuffers [ i ] = 0 ; streamBufIndex [ i ] = 0 ; } s_alPrecache = Cvar_Get ( "s_alPrecache", "1", CVAR_ARCHIVE ) ; s_alGain = Cvar_Get ( "s_alGain", "1.0", CVAR_ARCHIVE ) ; s_alSources = Cvar_Get ( "s_alSources", "128", CVAR_ARCHIVE ) ; s_alDopplerFactor = Cvar_Get ( "s_alDopplerFactor", "1.0", CVAR_ARCHIVE ) ; s_alDopplerSpeed = Cvar_Get ( "s_alDopplerSpeed", "9000", CVAR_ARCHIVE ) ; s_alMinDistance = Cvar_Get ( "s_alMinDistance", "256", CVAR_ARCHIVE ) ; s_alMaxDistance = Cvar_Get ( "s_alMaxDistance", "1024", CVAR_ARCHIVE ) ; s_alRolloff = Cvar_Get ( "s_alRolloff", "1.3", CVAR_ARCHIVE ) ; s_alGraceDistance = Cvar_Get ( "s_alGraceDistance", "512", CVAR_ARCHIVE ) ; s_alTalkAnims = Cvar_Get ( "s_alTalkAnims", "160", CVAR_ARCHIVE ) ; <START_BUG> s_alDriver = Cvar_Get ( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH ) ; <END_BUG> s_alInputDevice = Cvar_Get ( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_

Fix:
<S2SV_ModStart> CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED <S2SV_ModStart> CVAR_LATCH ) ; if ( COM_CompareExtension ( s_alDriver -> string, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", s_alDriver -> string ) ; return qfalse ; }
Buggy code:
 void handle_ld_nf ( u32 insn, struct pt_regs * regs ) { int rd = ( ( insn >> 25 ) & 0x1f ) ; int from_kernel = ( regs -> tstate & TSTATE_PRIV )!= 0 ; unsigned long * reg ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, 0 ) ; <END_BUG> maybe_flush_windows ( 0, 0, rd, from_kernel ) ; reg = fetch_reg_addr ( rd, regs ) ; if ( from_kernel || rd < 16 ) { reg [ 0 ] = 0 ; if ( ( insn & 0x780000 ) == 0x180000 ) reg [ 1 ] = 0 ; } else if ( test_thread_flag ( TIF_32BIT ) ) { put_user ( 0, ( int __user * ) reg ) ; if ( ( insn & 0x780000 ) == 0x180000 ) put_user ( 0, ( ( int __user * ) reg ) + 1 ) ; } else { put_user ( 0, ( unsigned long __user * ) reg ) ; if ( ( insn & 0x780000 ) == 0x180000 ) put_user ( 0, ( unsigned long __user * ) reg + 1 ) ; } advance ( regs ) ; }

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, 0
Buggy code:
 <START_BUG> static void vp8_init_ctx ( vpx_codec_ctx_t * ctx, const vpx_codec_mmap_t * mmap ) <END_BUG> { int i ;  ctx -> priv = mmap -> base ; <START_BUG> ctx -> priv -> sz = sizeof ( * ctx -> priv ) ; ctx -> priv -> iface = ctx -> iface ; ctx -> priv -> alg_priv = mmap -> base ; for ( i = 0 ; i < NELEMENTS ( ctx -> priv -> alg_priv -> mmaps ) ; i ++ ) ctx -> priv -> alg_priv -> mmaps [ i ]. id = vp8_mem_req_segs [ i ]. id ; ctx -> priv -> alg_priv -> mmaps [ 0 ] = * mmap ; ctx -> priv -> alg_priv -> si. sz = sizeof ( ctx -> priv -> alg_priv -> si ) ; ctx -> priv -> alg_priv -> decrypt_cb = NULL ; ctx -> priv -> alg_priv -> decrypt_state = NULL ; ctx -> priv -> init_flags = ctx -> init_flags ; <END_BUG> if ( ctx -> config. dec )  { <START_BUG> ctx -> priv -> alg_priv -> cfg = * ctx -> config. dec ; <END_BUG>  ctx -> config. dec = & ctx -> priv -> alg_priv -> cfg ; <START_BUG> } }<END_BUG>

Fix:
<S2SV_ModStart> vpx_codec_ctx_t * ctx ) { vpx_codec_alg_priv_t * priv = ( vpx_codec_alg_priv_t * ) vpx_calloc ( 1, sizeof ( * priv ) ) <S2SV_ModEnd> ; ctx -> <S2SV_ModStart> -> priv = ( vpx_codec_priv_t * ) priv <S2SV_ModEnd> ; ctx -> <S2SV_ModStart> -> init_flags ; priv -> si. sz = sizeof ( priv -> si ) ; priv -> decrypt_cb = NULL ; priv -> decrypt_state = NULL ; <S2SV_ModStart> dec ) { priv <S2SV_ModEnd> -> cfg = <S2SV_ModStart> dec = & priv <S2SV_ModEnd> -> cfg ;
Buggy code:
 void Bezier ( double x1, double y1, double x2, double y2, double x3, double y3 ) { <START_BUG> outpos += <END_BUG> sprintf ( outpos, "\\n   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   c", x1, y1, x2, y2, x3, y3 ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> y3 ) { sprintf ( outputbuffer <S2SV_ModEnd>, "\\n <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> c", <S2SV_ModStart> y3 ) ; sendClean ( outputbuffer ) ;
Buggy code:
 int vp9_get_qindex ( const struct segmentation * seg, int segment_id, int base_qindex ) { <START_BUG> if ( vp9_segfeature_active ( seg, segment_id, SEG_LVL_ALT_Q ) ) { <END_BUG>  const int data = vp9_get_segdata ( seg, segment_id, SEG_LVL_ALT_Q ) ; <START_BUG> const int seg_qindex = seg -> abs_delta == SEGMENT_ABSDATA? data : base_qindex + data ; return clamp ( seg_qindex, 0, MAXQ ) ; } else { return base_qindex ; } }<END_BUG>

Fix:
<S2SV_ModStart> { if ( segfeature_active <S2SV_ModEnd> ( seg, <S2SV_ModStart> int data = get_segdata <S2SV_ModEnd> ( seg,
Buggy code:
 int virtio_gpu_object_create ( struct virtio_gpu_device * vgdev, unsigned long size, bool kernel, bool pinned, struct virtio_gpu_object * * bo_ptr ) { struct virtio_gpu_object * bo ; enum ttm_bo_type type ; size_t acc_size ; int ret ; if ( kernel ) type = ttm_bo_type_kernel ; else type = ttm_bo_type_device ; * bo_ptr = NULL ; acc_size = ttm_bo_dma_acc_size ( & vgdev -> mman. bdev, size, sizeof ( struct virtio_gpu_object ) ) ; bo = kzalloc ( sizeof ( struct virtio_gpu_object ), GFP_KERNEL ) ; if ( bo == NULL ) return - ENOMEM ; size = roundup ( size, PAGE_SIZE ) ; ret = drm_gem_object_init ( vgdev -> ddev, & bo -> gem_base, size ) ; if ( ret!= 0 ) <START_BUG> return ret ; <END_BUG> bo -> dumb = false ; virtio_gpu_init_ttm_placement ( bo, pinned ) ; ret = ttm_bo_init ( & vgdev -> mman. bdev, & bo -> tbo, size, type, & bo -> placement, 0,! kernel, NULL, acc_size, NULL, NULL, & virtio_gpu_ttm_bo_destroy ) ; if ( ret!= 0 ) return ret ; * bo_ptr = bo ; return 0 ; }

Fix:
<S2SV_ModStart>!= 0 ) { kfree ( bo ) ; return ret ; } <S2SV_ModEnd> bo -> dumb
Buggy code:
 int ParseDateTime ( char * timestr, char * lowstr, char * * field, int * ftype, int * numfields, char * * endstr ) { int nf = 0 ; char * lp = lowstr ; * endstr = timestr ; while ( * ( * endstr )!= '\\0' ) { <START_BUG> field [ nf ] = lp ; <END_BUG> if ( isdigit ( ( unsigned char ) * ( * endstr ) ) ) { * lp ++ = * ( * endstr ) ++ ; while ( isdigit ( ( unsigned char ) * ( * endstr ) ) ) * lp ++ = * ( * endstr ) ++ ; if ( * ( * endstr ) == ':' ) { ftype [ nf ] = DTK_TIME ; * lp ++ = * ( * endstr ) ++ ; while ( isdigit ( ( unsigned char ) * ( * endstr ) ) || ( * ( * endstr ) == ':' ) || ( * ( * endstr ) == '.' ) ) * lp ++ = * ( * endstr ) ++ ; } else if ( * ( * endstr ) == '-' || * ( * endstr ) == '//' || * ( * endstr ) == '.' ) { char * dp = ( * endstr ) ; * lp ++ = * ( * endstr ) ++ ; if ( isdigit ( ( unsigned char ) * ( * endstr ) ) ) { ftype [ nf ] = ( * dp == '.' )? DTK_NUMBER : DTK_DATE ; while ( isdigit ( ( unsigned char ) * ( * endstr ) ) ) * lp ++ = * ( * endstr ) ++ ; if ( * ( * endstr ) == * dp ) { ftype [ nf ] = DTK_DATE ; * lp ++ = * ( * endstr ) ++ ; while ( isdigit ( ( unsigned char ) * ( * endstr ) ) || ( * ( * endstr ) == * dp ) ) * lp ++ = * ( * endstr ) ++ ; } } else { ftype [ nf ] = DTK_DATE ; while ( isalnum ( ( unsigned char ) * ( * endstr ) ) || ( * ( * endstr ) == * dp ) ) * lp ++ = pg_tolower ( ( unsigned char ) * ( * endstr ) ++ ) ; } } else ftype [ nf ] = DTK_NUMBER ; } else if ( * ( * endstr ) == '.' ) {

Fix:
<S2SV_ModStart> ] = lp ; if ( nf >= MAXDATEFIELDS ) return - 1 <S2SV_ModStart> nf ++ ; <S2SV_ModEnd> } * numfields
Buggy code:
 static int jpc_siz_getparms ( jpc_ms_t * ms, jpc_cstate_t * cstate, jas_stream_t * in ) { jpc_siz_t * siz = & ms -> parms. siz ; unsigned int i ; uint_fast8_t tmp ; cstate = 0 ; if ( jpc_getuint16 ( in, & siz -> caps ) || jpc_getuint32 ( in, & siz -> width ) || jpc_getuint32 ( in, & siz -> height ) || jpc_getuint32 ( in, & siz -> xoff ) || jpc_getuint32 ( in, & siz -> yoff ) || jpc_getuint32 ( in, & siz -> tilewidth ) || jpc_getuint32 ( in, & siz -> tileheight ) || jpc_getuint32 ( in, & siz -> tilexoff ) || jpc_getuint32 ( in, & siz -> tileyoff ) || jpc_getuint16 ( in, & siz -> numcomps ) ) { return - 1 ; } if (! siz -> width ||! siz -> height ||! siz -> tilewidth ||! siz -> tileheight ||! siz -> numcomps ) { return - 1 ; } if (! ( siz -> comps = jas_alloc2 ( siz -> numcomps, sizeof ( jpc_sizcomp_t ) ) ) ) { return - 1 ; } for ( i = 0 ; i < siz -> numcomps ; ++ i ) { if ( jpc_getuint8 ( in, & tmp ) || jpc_getuint8 ( in, & siz -> comps [ i ]. hsamp ) || jpc_getuint8 ( in, & siz -> comps [ i ]. vsamp ) ) { jas_free ( siz -> comps ) ; return - 1 ; } <START_BUG> siz -> comps [ i ]. sgnd = ( tmp >> 7 ) & 1 ; <END_BUG> siz -> comps [ i ]. prec = ( tmp & 0x7f ) + 1 ; } if ( jas_stream_eof ( in ) ) { jas_free ( siz -> comps ) ; return - 1 ; } return 0

Fix:
<S2SV_ModStart> 1 ; } if ( siz -> comps [ i ]. hsamp == 0 || siz -> comps [ i ]. hsamp > 255 ) { jas_eprintf ( "invalid <S2SV_blank> XRsiz <S2SV_blank> value <S2SV_blank> %d\\n", siz -> comps [ i ]. hsamp ) ; jas_free ( siz -> comps ) ; return - 1 ; } if ( siz -> comps [ i ]. vsamp == 0 || siz -> comps [ i ]. vsamp > 255 ) { jas_eprintf ( "invalid <S2SV_blank> YRsiz <S2SV_blank> value <S2SV_blank> %d\\n", siz -> comps [ i ]. vsamp ) ; jas_free ( siz -> comps ) ; return - 1 ; }
Buggy code:
 static int cacheDirective ( MaState * state, cchar * key, cchar * value ) { MprTicks lifespan, clientLifespan, serverLifespan ; char * option, * ovalue, * tok ; char * methods, * extensions, * types, * uris ; int flags ; flags = 0 ; lifespan = clientLifespan = serverLifespan = 0 ; methods = uris = extensions = types = 0 ; for ( option = stok ( sclone ( value ), "   \\t", & tok ) ; option ; option = stok ( 0, "   \\t", & tok ) ) { if ( * option == '//' ) { uris = option ; if ( tok ) { tok [ - 1 ] = ',' ; } break ; } <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if ( ( int ) isdigit ( ( uchar ) * option ) ) { lifespan = httpGetTicks ( option ) ; } else if ( smatch ( option, "client" ) ) { flags |= HTTP_CACHE_CLIENT ; if ( ovalue ) { clientLifespan = httpGetTicks ( ovalue ) ; } } else if ( smatch ( option, "server" ) ) { flags |= HTTP_CACHE_SERVER ; if ( ovalue ) { serverLifespan = httpGetTicks ( ovalue ) ; } } else if ( smatch ( option, "extensions" ) ) { extensions = ovalue ; } else if ( smatch ( option, "types" ) ) { types = ovalue ; } else if ( smatch ( option, "unique" ) ) { flags |= HTTP_CACHE_UNIQUE ; } else if ( smatch ( option, "manual" ) ) { flags |= HTTP_CACHE_MANUAL ; } else if ( smatch ( option, "methods" ) ) { methods = ovalue ; } else { mprLog ( "error   appweb   config", 0, "Unknown   Cache   option   \'%s\'", option ) ; return MPR_ERR_BAD_SYNTAX ; } } if ( lifespan > 0 &&! uris &&! extensions &&! types &&! methods ) { state -> route -> lifes

Fix:
<S2SV_ModStart> } option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 static int do_ip_getsockopt ( struct sock * sk, int level, int optname, char __user * optval, int __user * optlen ) { struct inet_sock * inet = inet_sk ( sk ) ; int val ; int len ; if ( level!= SOL_IP ) return - EOPNOTSUPP ; if ( ip_mroute_opt ( optname ) ) return ip_mroute_getsockopt ( sk, optname, optval, optlen ) ; if ( get_user ( len, optlen ) ) return - EFAULT ; if ( len < 0 ) return - EINVAL ; lock_sock ( sk ) ; switch ( optname ) { case IP_OPTIONS : { unsigned char optbuf [ sizeof ( struct ip_options ) + 40 ] ; struct ip_options * opt = ( struct ip_options * ) optbuf ; <START_BUG> opt -> optlen = 0 ; <END_BUG>  if ( inet -> opt ) <START_BUG> memcpy ( optbuf, inet -> opt, sizeof ( struct ip_options ) + inet -> opt -> optlen ) ; release_sock ( sk ) ; if ( opt -> optlen == 0 ) return put_user ( 0, optlen ) ; ip_options_undo ( opt ) ; len = min_t ( unsigned int, len, opt -> optlen ) ; if ( put_user ( len, optlen ) ) return - EFAULT ; if ( copy_to_user ( optval, opt -> __data, len ) ) return - EFAULT ; return 0 ; } case IP_PKTINFO : val = ( inet -> cmsg_flags & IP_CMSG_PKTINFO )!= 0 ; break ; case IP_RECVTTL : val = ( inet -> cmsg_flags & IP_CMSG_TTL )!= 0 ; break ; case IP_RECVTOS : val = ( inet -> cmsg_flags & IP_CMSG_TOS )!= 0 ; break ; case IP_RECVOPTS : val = ( inet -> cmsg_flags & IP_CMSG_RECVOPTS )!= 0 ; break ; case IP_RETOPTS : val = ( inet -> cmsg_flags & IP_CMSG_RETOPTS )!= 0 ; break ; case IP_PASSSEC : val = ( inet -> cmsg_flags & IP_C<END_BUG>

Fix:
<S2SV_ModStart> ) optbuf ; struct ip_options_rcu * inet_opt ; inet_opt = rcu_dereference_protected ( inet -> inet_opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> ; if ( inet_opt ) memcpy ( optbuf, & inet_opt -> opt, sizeof ( struct ip_options ) + inet_opt -> opt. <S2SV_ModEnd> optlen ) ;
Buggy code:
 void pci_lintr_request ( struct pci_vdev * dev ) { struct businfo * bi ; struct slotinfo * si ; int bestpin, bestcount, pin ; bi = pci_businfo [ dev -> bus ] ; <START_BUG> assert ( bi!= NULL ) ; <END_BUG> si = & bi -> slotinfo [ dev -> slot ] ; bestpin = 0 ; bestcount = si -> si_intpins [ 0 ]. ii_count ; for ( pin = 1 ; pin < 4 ; pin ++ ) { if ( si -> si_intpins [ pin ]. ii_count < bestcount ) { bestpin = pin ; bestcount = si -> si_intpins [ pin ]. ii_count ; } } si -> si_intpins [ bestpin ]. ii_count ++ ; dev -> lintr. pin = bestpin + 1 ; pci_set_cfgdata8 ( dev, PCIR_INTPIN, bestpin + 1 ) ; }

Fix:
<S2SV_ModStart> bus ] ; if ( bi == NULL ) { pr_err ( "%s: <S2SV_blank> pci <S2SV_blank> [%s] <S2SV_blank> has <S2SV_blank> wrong <S2SV_blank> bus <S2SV_blank> %d <S2SV_blank> info!\\n", __func__, dev -> name, dev -> bus ) ; return ; } <S2SV_ModEnd> si = &
Buggy code:
 static int userauth_pubkey ( struct ssh * ssh ) { Authctxt * authctxt = ssh -> authctxt ; struct passwd * pw = authctxt -> pw ; <START_BUG> struct sshbuf * b ; <END_BUG> struct sshkey * key = NULL ;  char * pkalg, * userstyle = NULL, * key_s = NULL, * ca_s = NULL ; <START_BUG> <END_BUG> u_char * pkblob, * sig, have_sig ;  size_t blen, slen ; int r, pktype ; int authenticated = 0 ; struct sshauthopt * authopts = NULL ; <START_BUG> if (! authctxt -> valid ) { <END_BUG> debug2 ( "%s:   disabled   because   of   invalid   user", __func__ ) ; return 0 ; } if ( ( r = sshpkt_get_u8 ( ssh, & have_sig ) )!= 0 || ( r = sshpkt_get_cstring ( ssh, & pkalg, NULL ) )!= 0 || ( r = sshpkt_get_string ( ssh, & pkblob, & blen ) )!= 0 ) fatal ( "%s:   parse   request   failed:   %s", __func__, ssh_err ( r ) ) ; pktype = sshkey_type_from_name ( pkalg ) ; if ( pktype == KEY_UNSPEC ) { verbose ( "%s:   unsupported   public   key   algorithm:   %s", __func__, pkalg ) ; goto done ; } if ( ( r = sshkey_from_blob ( pkblob, blen, & key ) )!= 0 ) { error ( "%s:   could   not   parse   key:   %s", __func__, ssh_err ( r ) ) ; goto done ; } if ( key == NULL ) { error ( "%s:   cannot   decode   key:   %s", __func__, pkalg ) ; goto done ; } if ( key -> type!= pktype ) { error ( "%s:   type   mismatch   for   decoded   key   " "(received   %d,   expected   %d)", __func__, key -> type, pktype ) ; goto done ; } if ( sshkey_type_plain ( key -> type ) == KEY_RSA && ( ssh -> compat & SSH_BUG_RSASIG

Fix:
<S2SV_ModStart> sshbuf * b = NULL <S2SV_ModStart> char * pkalg = NULL <S2SV_ModStart> u_char * pkblob = NULL <S2SV_ModStart>, * sig = NULL <S2SV_ModStart> ; if ( <S2SV_ModEnd> ( r = <S2SV_ModStart> r ) ) ; } if (! authctxt -> valid || authctxt -> user == NULL ) { debug2 ( "%s: <S2SV_blank> disabled <S2SV_blank> because <S2SV_blank> of <S2SV_blank> invalid <S2SV_blank> user", __func__ ) ; goto done <S2SV_ModStart> b ) ; <S2SV_ModEnd> auth2_record_key ( authctxt <S2SV_ModStart> ) ) ; if (! authctxt -> valid || authctxt -> user == NULL ) { debug2 ( "%s: <S2SV_blank> disabled <S2SV_blank> because <S2SV_blank> of <S2SV_blank> invalid <S2SV_blank> user", __func__ ) ; goto done ; } <S2SV_ModStart> ca_s ) ; free ( sig ) ;
Buggy code:
 static void icmp6_rrenum_print ( netdissect_options * ndo, const u_char * bp, const u_char * ep ) { const struct icmp6_router_renum * rr6 ; const char * cp ; const struct rr_pco_match * match ; const struct rr_pco_use * use ; char hbuf [ NI_MAXHOST ] ; int n ; if ( ep < bp ) return ; rr6 = ( const struct icmp6_router_renum * ) bp ; cp = ( const char * ) ( rr6 + 1 ) ; ND_TCHECK ( rr6 -> rr_reserved ) ; switch ( rr6 -> rr_code ) { case ICMP6_ROUTER_RENUMBERING_COMMAND : ND_PRINT ( ( ndo, "router   renum:   command" ) ) ; break ; case ICMP6_ROUTER_RENUMBERING_RESULT : ND_PRINT ( ( ndo, "router   renum:   result" ) ) ; break ; case ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET : ND_PRINT ( ( ndo, "router   renum:   sequence   number   reset" ) ) ; break ; default : ND_PRINT ( ( ndo, "router   renum:   code-#%d", rr6 -> rr_code ) ) ; break ; } ND_PRINT ( ( ndo, ",   seq=%u", EXTRACT_32BITS ( & rr6 -> rr_seqnum ) ) ) ; if ( ndo -> ndo_vflag ) { # define F ( x, y ) ( ( rr6 -> rr_flags ) & ( x )? ( y ) : "" ) ND_PRINT ( ( ndo, "[" ) ) ; if ( rr6 -> rr_flags ) { ND_PRINT ( ( ndo, "%s%s%s%s%s,", F ( ICMP6_RR_FLAGS_TEST, "T" ), F ( ICMP6_RR_FLAGS_REQRESULT, "R" ), F ( ICMP6_RR_FLAGS_FORCEAPPLY, "A" ), F ( ICMP6_RR_FLAGS_SPECSITE, "S" ), F (

Fix:
<S2SV_ModStart> ( ndo, "%s", icmp6_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 static void output_stats ( const VP8_COMP * cpi, struct vpx_codec_pkt_list * pktlist, FIRSTPASS_STATS * stats ) { struct vpx_codec_cx_pkt pkt ; <START_BUG> pkt. kind = VPX_CODEC_STATS_PKT ; <END_BUG> pkt. data. twopass_stats. buf = stats ; pkt. data. twopass_stats. sz = sizeof ( FIRSTPASS_STATS ) ; vpx_codec_pkt_list_add ( pktlist, & pkt ) ; # if OUTPUT_FPF { FILE * fpfile ; fpfile = fopen ( "firstpass.stt", "a" ) ; fprintf ( fpfile, "%12.0f   %12.0f   %12.0f   %12.4f   %12.4f   %12.4f   %12.4f" "   %12.4f   %12.4f   %12.4f   %12.4f   %12.4f   %12.4f   %12.4f   %12.4f" "   %12.0f   %12.0f   %12.4f\\n", stats -> frame, stats -> intra_error, stats -> coded_error, stats -> ssim_weighted_pred_err, stats -> pcnt_inter, stats -> pcnt_motion, stats -> pcnt_second_ref, stats -> pcnt_neutral, stats -> MVr, stats -> mvr_abs, stats -> MVc, stats -> mvc_abs, stats -> MVrv, stats -> MVcv, stats -> mv_in_out_count, stats -> new_mv_count, stats -> count, stats -> duration ) ; fclose ( fpfile ) ; } # endif }

Fix:
<S2SV_ModStart> vpx_codec_cx_pkt pkt ; ( void ) cpi ;
Buggy code:
 <START_BUG> static inline void assign_eip_near ( struct x86_emulate_ctxt * ctxt, ulong dst ) <END_BUG> {  switch ( ctxt -> op_bytes ) { <START_BUG> case 2 : ctxt -> _eip = ( u16 ) dst ; break ; case 4 : ctxt -> _eip = ( u32 ) dst ; break ; case 8 : ctxt -> _eip = dst ; break ; default : WARN ( 1, "unsupported   eip   assignment   size\\n" ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> static inline int <S2SV_ModEnd> assign_eip_near ( struct <S2SV_ModStart> dst ) { return assign_eip_far ( ctxt, dst, ctxt -> mode == X86EMUL_MODE_PROT64 <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static void * load_bytes ( RBinFile * arch, const ut8 * buf, ut64 sz, ut64 loaddr, Sdb * sdb ) { if (! buf ||! sz || sz == UT64_MAX ) { return NULL ; } RBuffer * tbuf = r_buf_new ( ) ; <START_BUG> r_buf_set_bytes ( tbuf, buf, sz ) ; <END_BUG> struct r_bin_bflt_obj * res = r_bin_bflt_new_buf ( tbuf ) ; r_buf_free ( tbuf ) ; return res? res : NULL ; }

Fix:
<S2SV_ModStart> ( ) ; if (! tbuf ) { return NULL ; }
Buggy code:
 void vp8_setup_intra_recon ( YV12_BUFFER_CONFIG * ybf ) { int i ; <START_BUG> vpx_memset ( ybf -> y_buffer - 1 - ybf -> y_stride, 127, ybf -> y_width + 5 ) ; <END_BUG> for ( i = 0 ; i < ybf -> y_height ; i ++ ) ybf -> y_buffer [ ybf -> y_stride * i - 1 ] = ( unsigned char ) 129 ;  vpx_memset ( ybf -> u_buffer - 1 - ybf -> uv_stride, 127, ybf -> uv_width + 5 ) ; <START_BUG> for ( i = 0 ; i < ybf -> uv_height ; i ++ ) ybf -> u_buffer [ ybf -> uv_stride * i - 1 ] = ( unsigned char ) 129 ; <END_BUG> vpx_memset ( ybf -> v_buffer - 1 - ybf -> uv_stride, 127, ybf -> uv_width + 5 ) ;  for ( i = 0 ; i < ybf -> uv_height ; i ++ ) ybf -> v_buffer [ ybf -> uv_stride * i - 1 ] = ( unsigned char ) 129 ; }

Fix:
<S2SV_ModStart> int i ; memset <S2SV_ModEnd> ( ybf -> <S2SV_ModStart> ) 129 ; memset <S2SV_ModEnd> ( ybf -> <S2SV_ModStart> ) 129 ; memset <S2SV_ModEnd> ( ybf ->
Buggy code:
 static int inet6_create ( struct net * net, struct socket * sock, int protocol, int kern ) { struct inet_sock * inet ; struct ipv6_pinfo * np ; struct sock * sk ; struct inet_protosw * answer ; struct proto * answer_prot ; unsigned char answer_flags ; int try_loading_module = 0 ; <START_BUG> int err ; <END_BUG> lookup_protocol : err = - ESOCKTNOSUPPORT ; rcu_read_lock ( ) ; list_for_each_entry_rcu ( answer, & inetsw6 [ sock -> type ], list ) { err = 0 ; if ( protocol == answer -> protocol ) { if ( protocol!= IPPROTO_IP ) break ; } else { if ( IPPROTO_IP == protocol ) { protocol = answer -> protocol ; break ; } if ( IPPROTO_IP == answer -> protocol ) break ; } err = - EPROTONOSUPPORT ; } if ( err ) { if ( try_loading_module < 2 ) { rcu_read_unlock ( ) ; if ( ++ try_loading_module == 1 ) request_module ( "net-pf-%d-proto-%d-type-%d", PF_INET6, protocol, sock -> type ) ; else request_module ( "net-pf-%d-proto-%d", PF_INET6, protocol ) ; goto lookup_protocol ; } else goto out_rcu_unlock ; } err = - EPERM ; if ( sock -> type == SOCK_RAW &&! kern &&! ns_capable ( net -> user_ns, CAP_NET_RAW ) ) goto out_rcu_unlock ; sock -> ops = answer -> ops ; answer_prot = answer -> prot ; answer_flags = answer -> flags ; rcu_read_unlock ( ) ; WARN_ON (! answer_prot -> slab ) ; err = - ENOBUFS ; sk = sk_alloc ( net, PF_INET6, GFP_KERNEL, answer_prot, kern ) ; if (! sk ) goto out ; sock_init_data ( sock, sk ) ; err = 0 ; if ( INET_PROTOSW_REUSE & answer_flags ) sk -> sk_reuse = SK_CAN_REUSE ; inet = inet_sk ( sk ) ; inet ->

Fix:
<S2SV_ModStart> ; int err ; if ( protocol < 0 || protocol >= IPPROTO_MAX ) return - EINVAL
Buggy code:
 static Image * ReadXBMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char buffer [ MagickPathExtent ], name [ MagickPathExtent ] ; Image <START_BUG> * image ; <END_BUG> MagickBooleanType status ; register ssize_t i, x ; register Quantum * q ; register unsigned char * p ; short int hex_digits [ 256 ] ; ssize_t y ; unsigned char * data ; unsigned int bit, byte, bytes_per_line, height, length, padding,  value, <START_BUG> version, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } width = 0 ; height = 0 ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) if ( sscanf ( buffer, "#define   %32s   %u", name, & width ) == 2 ) if ( ( strlen ( name ) >= 6 ) && ( LocaleCompare ( name + strlen ( name ) - 6, "_width" ) == 0 ) ) break ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) if ( sscanf ( buffer, "#define   %32s   %u", name, & height ) == 2 ) if ( ( strlen ( name ) >= 7 ) && ( LocaleCompare ( name + strlen ( name ) - 7, "_height" ) == 0 ) ) break ; image -> columns = width ; image -> rows = height ; image -> depth = 8 ; image -> storage_class = PseudoClass ; image -> colors = 2 ; version = 11 ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) { if ( sscanf ( buffer, "static   short  <END_BUG>

Fix:
<S2SV_ModStart> Image * image ; int c <S2SV_ModStart>, padding, <S2SV_ModEnd> version, width <S2SV_ModStart>. red = ( MagickRealType ) <S2SV_ModStart>. green = ( MagickRealType ) <S2SV_ModStart>. blue = ( MagickRealType ) <S2SV_ModStart>. red = 0.0 <S2SV_ModEnd> ; image -> <S2SV_ModStart>. green = 0.0 <S2SV_ModEnd> ; image -> <S2SV_ModStart>. blue = 0.0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) { c <S2SV_ModEnd> = XBMInteger ( <S2SV_ModStart>, hex_digits ) ; if ( c < 0 ) break <S2SV_ModStart> unsigned char ) c <S2SV_ModEnd> ; if ( <S2SV_ModStart> char ) ( c <S2SV_ModEnd> >> 8 ) <S2SV_ModStart> ++ ) { c <S2SV_ModEnd> = XBMInteger ( <S2SV_ModStart>, hex_digits ) ; if ( c < 0 ) break <S2SV_ModStart> unsigned char ) c ; } if ( EOFBlob ( image )!= MagickFalse ) { data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; ThrowReaderException ( CorruptImageError, "UnexpectedEndOfFile" ) <S2SV_ModEnd> ; } p <S2SV_ModStart> byte = ( unsigned int <S2SV_ModEnd> ) ( *
Buggy code:
 kadm5_ret_t kadm5_modify_principal ( void * server_handle, kadm5_principal_ent_t entry, long mask ) { int ret, ret2, i ; kadm5_policy_ent_rec pol ; krb5_boolean have_pol = FALSE ; krb5_db_entry * kdb ; krb5_tl_data * tl_data_orig ; osa_princ_ent_rec adb ; kadm5_server_handle_t handle = server_handle ; CHECK_HANDLE ( server_handle ) ; krb5_clear_error_message ( handle -> context ) ; <START_BUG> if ( ( mask & KADM5_PRINCIPAL ) || ( mask & KADM5_LAST_PWD_CHANGE ) || <END_BUG> ( mask & KADM5_MOD_TIME ) || ( mask & KADM5_MOD_NAME ) || ( mask & KADM5_MKVNO ) || ( mask & KADM5_AUX_ATTRIBUTES ) || ( mask & KADM5_KEY_DATA ) || ( mask & KADM5_LAST_SUCCESS ) || ( mask & KADM5_LAST_FAILED ) ) return KADM5_BAD_MASK ; if ( ( mask & ~ ALL_PRINC_MASK ) ) return KADM5_BAD_MASK ;  if ( ( mask & KADM5_POLICY ) && ( mask & KADM5_POLICY_CLR ) ) <START_BUG> return KADM5_BAD_MASK ; <END_BUG> if ( entry == ( kadm5_principal_ent_t ) NULL )  return EINVAL ; if ( mask & KADM5_TL_DATA ) { tl_data_orig = entry -> tl_data ; while ( tl_data_orig ) { if ( tl_data_orig -> tl_data_type < 256 ) return KADM5_BAD_TL_TYPE ; tl_data_orig = tl_data_orig -> tl_data_next ; } } ret = kdb_get_entry ( handle, entry -> principal, & kdb, & adb ) ; if ( ret ) return ( ret ) ; if ( ( mask & KADM5_POLICY ) ) { ret = get_policy ( handle, entry -> policy,

Fix:
<S2SV_ModStart> ; if ( entry == NULL ) return EINVAL ; if ( <S2SV_ModStart> KADM5_POLICY ) && entry -> policy == NULL <S2SV_ModEnd> ) return KADM5_BAD_MASK <S2SV_ModStart> ; if ( ( mask & KADM5_POLICY ) && ( mask & KADM5_POLICY_CLR ) ) return KADM5_BAD_MASK <S2SV_ModEnd> ; if (
Buggy code:
 static void rd_check_segment ( VP8_COMP * cpi, MACROBLOCK * x, BEST_SEG_INFO * bsi, unsigned int segmentation ) { int i ; int const * labels ; int br = 0 ; int bd = 0 ; B_PREDICTION_MODE this_mode ; int label_count ; int this_segment_rd = 0 ; int label_mv_thresh ; int rate = 0 ; int sbr = 0 ; int sbd = 0 ; int segmentyrate = 0 ; vp8_variance_fn_ptr_t * v_fn_ptr ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; ENTROPY_CONTEXT_PLANES t_above_b, t_left_b ; ENTROPY_CONTEXT * ta_b ; ENTROPY_CONTEXT * tl_b ; <START_BUG> vpx_memcpy ( & t_above, x -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, x -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; ta_b = ( ENTROPY_CONTEXT * ) & t_above_b ; tl_b = ( ENTROPY_CONTEXT * ) & t_left_b ; br = 0 ; bd = 0 ; v_fn_ptr = & cpi -> fn_ptr [ segmentation ] ; labels = vp8_mbsplits [ segmentation ] ; label_count = vp8_mbsplit_count [ segmentation ] ; label_mv_thresh = 1 * bsi -> mvthresh // label_count ; rate = vp8_cost_token ( vp8_mbsplit_tree, vp8_mbsplit_probs, vp8_mbsplit_encodings + segmentation ) ; rate += vp8_cost_mv_ref ( SPLITMV, bsi -> mdcounts ) ; this_segment_rd += RDCOST ( x -> rdmult, x -> rddiv, rate, 0 ) ; br<END_BUG>

Fix:
<S2SV_ModStart> * tl_b ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left <S2SV_ModStart> * tl_s ; memcpy <S2SV_ModEnd> ( & t_above_s <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left_s <S2SV_ModStart> = this_rd ; memcpy <S2SV_ModEnd> ( ta_b, <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( tl_b, <S2SV_ModStart> ; } } memcpy <S2SV_ModEnd> ( ta, <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( tl,
Buggy code:
 static int g2m_init_buffers ( G2MContext * c ) { int aligned_height ; if (! c -> framebuf || c -> old_width < c -> width || c -> old_height < c -> height ) { c -> framebuf_stride = FFALIGN ( c -> width * 3, 16 ) ; aligned_height = FFALIGN ( c -> height, 16 ) ; av_free ( c -> framebuf ) ; c -> framebuf = av_mallocz ( c -> framebuf_stride * aligned_height ) ; if (! c -> framebuf ) return AVERROR ( ENOMEM ) ; } if (! c -> synth_tile ||! c -> jpeg_tile || c -> old_tile_w < c -> tile_width || c -> old_tile_h < c -> tile_height ) { <START_BUG> c -> tile_stride = FFALIGN ( c -> tile_width * 3, 16 ) ; <END_BUG> aligned_height = FFALIGN ( c -> tile_height, 16 ) ; av_free ( c -> synth_tile ) ; av_free ( c -> jpeg_tile ) ; av_free ( c -> kempf_buf ) ; av_free ( c -> kempf_flags ) ; c -> synth_tile = av_mallocz ( c -> tile_stride * aligned_height ) ; c -> jpeg_tile = av_mallocz ( c -> tile_stride * aligned_height ) ; c -> kempf_buf = av_mallocz ( ( c -> tile_width + 1 ) * aligned_height + FF_INPUT_BUFFER_PADDING_SIZE ) ; c -> kempf_flags = av_mallocz ( c -> tile_width * aligned_height ) ; if (! c -> synth_tile ||! c -> jpeg_tile ||! c -> kempf_buf ||! c -> kempf_flags ) return AVERROR ( ENOMEM ) ; } return 0 ; }

Fix:
<S2SV_ModStart> c -> tile_width <S2SV_ModEnd>, 16 ) <S2SV_ModStart>, 16 ) * 3
Buggy code:
 struct pipe_inode_info * alloc_pipe_info ( void ) { struct pipe_inode_info * pipe ; pipe = kzalloc ( sizeof ( struct pipe_inode_info ), GFP_KERNEL ) ; if ( pipe ) { <START_BUG> pipe -> bufs = kzalloc ( sizeof ( struct pipe_buffer ) * PIPE_DEF_BUFFERS, GFP_KERNEL ) ; <END_BUG> if ( pipe -> bufs ) { init_waitqueue_head ( & pipe -> wait ) ; pipe -> r_counter = pipe -> w_counter = 1 ;  pipe -> buffers = PIPE_DEF_BUFFERS ; <START_BUG> mutex_init ( & pipe -> mutex ) ; return pipe ; } <END_BUG> kfree ( pipe ) ;  } return NULL ; }

Fix:
<S2SV_ModStart> pipe ) { unsigned long pipe_bufs = PIPE_DEF_BUFFERS ; struct user_struct * user = get_current_user ( ) ; if (! too_many_pipe_buffers_hard ( user ) ) { if ( too_many_pipe_buffers_soft ( user ) ) pipe_bufs = 1 ; <S2SV_ModStart> pipe_buffer ) * pipe_bufs <S2SV_ModEnd>, GFP_KERNEL ) <S2SV_ModStart> GFP_KERNEL ) ; } <S2SV_ModStart> -> buffers = pipe_bufs ; pipe -> user = user ; account_pipe_buffers ( pipe, 0, pipe_bufs ) <S2SV_ModEnd> ; mutex_init ( <S2SV_ModStart> pipe ; } free_uid ( user ) ;
Buggy code:
 static int snd_ctl_elem_user_put ( struct snd_kcontrol * kcontrol, struct snd_ctl_elem_value * ucontrol ) { int change ; <START_BUG> struct user_element * ue = kcontrol -> private_data ; <END_BUG> change = memcmp ( & ucontrol -> value, ue -> elem_data, ue -> elem_data_size )!= 0 ; if ( change ) memcpy ( ue -> elem_data, & ucontrol -> value, ue -> elem_data_size ) ;  return change ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> kcontrol -> private_data ; mutex_lock ( & ue -> card -> user_ctl_lock ) <S2SV_ModStart> elem_data_size ) ; mutex_unlock ( & ue -> card -> user_ctl_lock ) ;