nus-yam/ex-repair huggingface dataset:
Buggy code:
 static ssize_t _consolefs_readv ( oe_fd_t * desc, const struct oe_iovec * iov, int iovcnt ) { ssize_t ret = - 1 ; file_t * file = _cast_file ( desc ) ; void * buf = NULL ; <START_BUG> size_t buf_size = 0 ; <END_BUG> if (! file ||! iov || iovcnt < 0 || iovcnt > OE_IOV_MAX ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  if ( oe_iov_pack ( iov, iovcnt, & buf, & buf_size )!= 0 ) <START_BUG> <END_BUG> OE_RAISE_ERRNO ( OE_ENOMEM ) ;  if ( oe_syscall_readv_ocall ( & ret, file -> host_fd, buf, iovcnt, buf_size )!= OE_OK ) { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <START_BUG> if ( oe_iov_sync ( iov, iovcnt, buf, buf_size )!= 0 ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; done : if ( buf ) oe_free ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> ; size_t buf_size = 0 ; size_t data_size <S2SV_ModStart>, & buf_size, & data_size <S2SV_ModStart> OE_RAISE_ERRNO ( OE_ENOMEM ) ; if ( data_size > OE_SSIZE_MAX ) OE_RAISE_ERRNO ( OE_EINVAL <S2SV_ModStart> } if ( ret > ( ssize_t ) data_size ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; } if (
Buggy code:
 static void handle_ppp ( netdissect_options * ndo, u_int proto, const u_char * p, int length ) { if ( ( proto & 0xff00 ) == 0x7e00 ) { ppp_hdlc ( ndo, p - 1, length ) ; return ; } switch ( proto ) { case PPP_LCP : case PPP_IPCP : case PPP_OSICP : case PPP_MPLSCP : case PPP_IPV6CP : case PPP_CCP : case PPP_BACP : handle_ctrl_proto ( ndo, proto, p, length ) ; break ; case PPP_ML : handle_mlppp ( ndo, p, length ) ; break ; case PPP_CHAP : handle_chap ( ndo, p, length ) ; break ; case PPP_PAP : handle_pap ( ndo, p, length ) ; break ; case PPP_BAP : handle_bap ( ndo, p, length ) ; break ; case ETHERTYPE_IP : case PPP_VJNC : case PPP_IP : ip_print ( ndo, p, length ) ; break ; case ETHERTYPE_IPV6 : case PPP_IPV6 : ip6_print ( ndo, p, length ) ; break ; case ETHERTYPE_IPX : case PPP_IPX : ipx_print ( ndo, p, length ) ; break ; case PPP_OSI : <START_BUG> isoclns_print ( ndo, p, length, length ) ; <END_BUG> break ; case PPP_MPLS_UCAST : case PPP_MPLS_MCAST : mpls_print ( ndo, p, length ) ; break ; case PPP_COMP : ND_PRINT ( ( ndo, "compressed   PPP   data" ) ) ; break ; default : ND_PRINT ( ( ndo, "%s   ", tok2str ( ppptype2str, "unknown   PPP   protocol   (0x%04x)", proto ) ) ) ; print_unknown_data ( ndo, p, "\\n\\t", length ) ; break ; } }

Fix:
<S2SV_ModStart> p, length <S2SV_ModEnd> ) ; break
Buggy code:
 static int ext4_write_end ( struct file * file, struct address_space * mapping, loff_t pos, unsigned len, unsigned copied, struct page * page, void * fsdata ) { handle_t * handle = ext4_journal_current_handle ( ) ; struct inode * inode = mapping -> host ; loff_t old_size = inode -> i_size ; int ret = 0, ret2 ; int i_size_changed = 0 ; trace_ext4_write_end ( inode, pos, len, copied ) ; <START_BUG> if ( ext4_test_inode_state ( inode, EXT4_STATE_ORDERED_MODE ) ) { <END_BUG> ret = ext4_jbd2_file_inode ( handle, inode ) ; if ( ret ) { unlock_page ( page ) ; put_page ( page ) ; goto errout ; } } if ( ext4_has_inline_data ( inode ) ) { ret = ext4_write_inline_data_end ( inode, pos, len, copied, page ) ; if ( ret < 0 ) goto errout ; copied = ret ; } else copied = block_write_end ( file, mapping, pos, len, copied, page, fsdata ) ; i_size_changed = ext4_update_inode_size ( inode, pos + copied ) ; unlock_page ( page ) ; put_page ( page ) ; if ( old_size < pos ) pagecache_isize_extended ( inode, old_size, pos ) ; if ( i_size_changed ) ext4_mark_inode_dirty ( handle, inode ) ; if ( pos + len > inode -> i_size && ext4_can_truncate ( inode ) ) ext4_orphan_add ( handle, inode ) ; errout : ret2 = ext4_journal_stop ( handle ) ; if (! ret ) ret = ret2 ; if ( pos + len > inode -> i_size ) { ext4_truncate_failed_write ( inode ) ; if ( inode -> i_nlink ) ext4_orphan_del ( NULL, inode ) ; } return ret? ret : copied ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> ext4_has_inline_data ( inode
Buggy code:
 static RList * r_bin_wasm_get_global_entries ( RBinWasmObj * bin, RBinWasmSection * sec ) { RList * ret = NULL ; RBinWasmGlobalEntry * ptr = NULL ; <START_BUG> int buflen = bin -> buf -> length ; <END_BUG> if ( sec -> payload_data + 32 > buflen ) { return NULL ; } if (! ( ret = r_list_newf ( ( RListFree ) free ) ) ) { return NULL ; } ut8 * buf = bin -> buf -> buf + ( ut32 ) sec -> payload_data ; ut32 len = sec -> payload_len ; ut32 count = sec -> count ; ut32 i = 0, r = 0 ; while ( i < len && len < buflen && r < count ) { if (! ( ptr = R_NEW0 ( RBinWasmGlobalEntry ) ) ) { return ret ; } if ( len + 8 > buflen ||! ( consume_u8 ( buf + i, buf + len, ( ut8 * ) & ptr -> content_type, & i ) ) ) { goto beach ; } if ( len + 8 > buflen ||! ( consume_u8 ( buf + i, buf + len, & ptr -> mutability, & i ) ) ) { goto beach ; } if ( len + 8 > buflen ||! ( consume_init_expr ( buf + i, buf + len, R_BIN_WASM_END_OF_CODE, NULL, & i ) ) ) { goto beach ; } r_list_append ( ret, ptr ) ; r ++ ; } return ret ; beach : free ( ptr ) ; return ret ; }

Fix:
<S2SV_ModStart> = NULL ; if (! ( ret = r_list_newf ( ( RListFree ) free ) ) ) { return NULL ; } ut8 * buf = bin -> buf -> buf + ( ut32 ) sec -> payload_data ; <S2SV_ModStart> buf -> length - <S2SV_ModEnd> ( ut32 )
Buggy code:
 void mwifiex_set_uap_rates ( struct mwifiex_uap_bss_param * bss_cfg, struct cfg80211_ap_settings * params ) { struct ieee_types_header * rate_ie ; int var_offset = offsetof ( struct ieee80211_mgmt, u. beacon. variable ) ; const u8 * var_pos = params -> beacon. head + var_offset ; int len = params -> beacon. head_len - var_offset ; u8 rate_len = 0 ; rate_ie = ( void * ) cfg80211_find_ie ( WLAN_EID_SUPP_RATES, var_pos, len ) ; if ( rate_ie ) { <START_BUG> memcpy ( bss_cfg -> rates, rate_ie + 1, rate_ie -> len ) ; <END_BUG> rate_len = rate_ie -> len ; } rate_ie = ( void * ) cfg80211_find_ie ( WLAN_EID_EXT_SUPP_RATES, params -> beacon. tail, params -> beacon. tail_len ) ;  if ( rate_ie ) <START_BUG> <END_BUG> memcpy ( bss_cfg -> rates + rate_len, rate_ie + 1, rate_ie -> len ) ;  return ; }

Fix:
<S2SV_ModStart> rate_ie ) { if ( rate_ie -> len > MWIFIEX_SUPPORTED_RATES ) return ; <S2SV_ModStart> ( rate_ie ) { if ( rate_ie -> len > MWIFIEX_SUPPORTED_RATES - rate_len ) return ; <S2SV_ModStart> len ) ; }
Buggy code:
 static struct file * path_openat ( int dfd, struct filename * pathname, struct nameidata * nd, const struct open_flags * op, int flags ) { struct file * file ; struct path path ; int opened = 0 ; int error ; file = get_empty_filp ( ) ; if ( IS_ERR ( file ) ) return file ; file -> f_flags = op -> open_flag ; if ( unlikely ( file -> f_flags & __O_TMPFILE ) ) { error = do_tmpfile ( dfd, pathname, nd, flags, op, file, & opened ) ; <START_BUG> goto out ; <END_BUG> } error = path_init ( dfd, pathname, flags, nd ) ; if ( unlikely ( error ) ) goto out ; error = do_last ( nd, & path, file, op, & opened, pathname ) ; while ( unlikely ( error > 0 ) ) { struct path link = path ; void * cookie ; if (! ( nd -> flags & LOOKUP_FOLLOW ) ) { path_put_conditional ( & path, nd ) ; path_put ( & nd -> path ) ; error = - ELOOP ; break ; } error = may_follow_link ( & link, nd ) ; if ( unlikely ( error ) ) break ; nd -> flags |= LOOKUP_PARENT ; nd -> flags &= ~ ( LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_EXCL ) ; error = follow_link ( & link, nd, & cookie ) ; if ( unlikely ( error ) ) break ; error = do_last ( nd, & path, file, op, & opened, pathname ) ; put_link ( nd, & link, cookie ) ; } out : path_cleanup ( nd ) ;  if (! ( opened & FILE_OPENED ) ) { <START_BUG> BUG_ON (! error ) ; put_filp ( file ) ; } if ( unlikely ( error ) ) { if ( error == - EOPENSTALE ) { if ( flags & LOOKUP_RCU ) error = - ECHILD ; else error = - ESTALE ; } file = ERR_PTR ( error ) ; } return file ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ; goto out2 <S2SV_ModEnd> ; } error <S2SV_ModStart> nd ) ; out2 :
Buggy code:
 static int aiptek_probe ( struct usb_interface * intf, const struct usb_device_id * id ) { struct usb_device * usbdev = interface_to_usbdev ( intf ) ; struct usb_endpoint_descriptor * endpoint ; struct aiptek * aiptek ; struct input_dev * inputdev ; int i ; int speeds [ ] = { 0, AIPTEK_PROGRAMMABLE_DELAY_50, AIPTEK_PROGRAMMABLE_DELAY_400, AIPTEK_PROGRAMMABLE_DELAY_25, AIPTEK_PROGRAMMABLE_DELAY_100, AIPTEK_PROGRAMMABLE_DELAY_200, AIPTEK_PROGRAMMABLE_DELAY_300 } ; int err = - ENOMEM ; speeds [ 0 ] = programmableDelay ; aiptek = kzalloc ( sizeof ( struct aiptek ), GFP_KERNEL ) ; inputdev = input_allocate_device ( ) ; if (! aiptek ||! inputdev ) { dev_warn ( & intf -> dev, "cannot   allocate   memory   or   input   device\\n" ) ; goto fail1 ; } aiptek -> data = usb_alloc_coherent ( usbdev, AIPTEK_PACKET_LENGTH, GFP_ATOMIC, & aiptek -> data_dma ) ; if (! aiptek -> data ) { dev_warn ( & intf -> dev, "cannot   allocate   usb   buffer\\n" ) ; goto fail1 ; } aiptek -> urb = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! aiptek -> urb ) { dev_warn ( & intf -> dev, "cannot   allocate   urb\\n" ) ; goto fail2 ; } aiptek -> inputdev = inputdev ; aiptek -> usbdev = usbdev ; aiptek -> intf = intf ; aiptek -> ifnum = intf -> altsetting [ 0 ]. desc. bInterfaceNumber ; aiptek -> inDelay = 0 ; aiptek -> endDelay = 0 ; aiptek -> previousJitterable = 0 ; aiptek -> lastMacro = - 1 ; aiptek -> curSetting. pointerMode = AIPTEK_POINTER_EITHER

Fix:
<S2SV_ModStart> 0 ) ; if ( intf -> altsetting [ 0 ]. desc. bNumEndpoints < 1 ) { dev_err ( & intf -> dev, "interface <S2SV_blank> has <S2SV_blank> %d <S2SV_blank> endpoints, <S2SV_blank> but <S2SV_blank> must <S2SV_blank> have <S2SV_blank> minimum <S2SV_blank> 1\\n", intf -> altsetting [ 0 ]. desc. bNumEndpoints ) ; err = - EINVAL ; goto fail3 ; } <S2SV_ModStart> "Aiptek <S2SV_blank> tried <S2SV_blank> all <S2SV_blank> speeds, <S2SV_blank> no <S2SV_blank> sane <S2SV_blank> response\\n" ) ; err = - EINVAL ;
Buggy code:
 static int r_core_cmd_subst_i ( RCore * core, char * cmd, char * colon, bool * tmpseek ) { RList * tmpenvs = r_list_newf ( tmpenvs_free ) ; const char * quotestr = "`" ; const char * tick = NULL ; char * ptr, * ptr2, * str ; char * arroba = NULL ; char * grep = NULL ; RIODesc * tmpdesc = NULL ; int pamode =! core -> io -> va ; int i, ret = 0, pipefd ; bool usemyblock = false ; int scr_html = - 1 ; int scr_color = - 1 ; bool eos = false ; bool haveQuote = false ; bool oldfixedarch = core -> fixedarch ; bool oldfixedbits = core -> fixedbits ; bool cmd_tmpseek = false ; ut64 tmpbsz = core -> blocksize ; int cmd_ignbithints = - 1 ; if (! cmd ) { r_list_free ( tmpenvs ) ; return 0 ; } cmd = r_str_trim_head_tail ( cmd ) ; char * $0 = strstr ( cmd, "$(" ) ; if ( $0 ) { char * $1 = strchr ( $0 + 2, ')' ) ; if ( $1 ) { * $0 = '`' ; * $1 = '`' ; memmove ( $0 + 1, $0 + 2, strlen ( $0 + 2 ) + 1 ) ; } else { eprintf ( "Unterminated   $()   block\\n" ) ; } } switch ( * cmd ) { case '.' : if ( cmd [ 1 ] == \'"\' ) { r_list_free ( tmpenvs ) ; return r_cmd_call ( core -> rcmd, cmd ) ; } break ; case \'"\' : for ( ; * cmd ; ) { int pipefd = - 1 ; ut64 oseek = UT64_MAX ; char * line, * p ; haveQuote = * cmd == \'"\' ; if ( haveQuote ) { cmd ++ ; p = * cmd? find_eoq ( cmd ) : NULL ; if (! p ||! * p ) { eprintf ( "Missing   \\"   in   (%s).", cmd ) ; r_list_free ( tmpenvs ) ; return false ; } * p ++ = 0

Fix:
<S2SV_ModStart> continue ; } char op0 = 0 ; <S2SV_ModStart> q ) { op0 = * q ; <S2SV_ModStart> cmd = p <S2SV_ModEnd> ; } else <S2SV_ModStart> * p = op0 <S2SV_ModEnd> ; cmd =
Buggy code:
 static int get_rx_bufs ( struct vhost_virtqueue * vq, struct vring_used_elem * heads, int datalen, unsigned * iovcount, struct vhost_log * log, unsigned * log_num, unsigned int quota ) { unsigned int out, in ; int seg = 0 ; int headcount = 0 ; unsigned d ; int r, nlogs = 0 ; while ( datalen > 0 && headcount < quota ) { if ( unlikely ( seg >= UIO_MAXIOV ) ) { r = - ENOBUFS ; goto err ; } d = vhost_get_vq_desc ( vq -> dev, vq, vq -> iov + seg, ARRAY_SIZE ( vq -> iov ) - seg, & out, & in, log, log_num ) ; if ( d == vq -> num ) { r = 0 ; goto err ; } if ( unlikely ( out || in <= 0 ) ) { vq_err ( vq, "unexpected   descriptor   format   for   RX:   " "out   %d,   in   %d\\n", out, in ) ; r = - EINVAL ; goto err ; } if ( unlikely ( log ) ) { nlogs += * log_num ; log += * log_num ; } heads [ headcount ]. id = d ; heads [ headcount ]. len = iov_length ( vq -> iov + seg, in ) ; datalen -= heads [ headcount ]. len ; ++ headcount ; seg += in ; } heads [ headcount - 1 ]. len += datalen ; * iovcount = seg ; if ( unlikely ( log ) ) * log_num = nlogs ; <START_BUG> return headcount ; <END_BUG> err : vhost_discard_vq_desc ( vq, headcount ) ; return r ; }

Fix:
<S2SV_ModStart> = nlogs ; if ( unlikely ( datalen > 0 ) ) { r = UIO_MAXIOV + 1 ; goto err ; }
Buggy code:
 int vp8_hex_search ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int_mv * best_mv, int search_param, int sad_per_bit, const vp8_variance_fn_ptr_t * vfp, int * mvsadcost [ 2 ], int * mvcost [ 2 ], int_mv * center_mv ) { MV hex [ 6 ] = { { - 1, - 2 }, { 1, - 2 }, { 2, 0 }, { 1, 2 }, { - 1, 2 }, { - 2, 0 } } ; MV neighbors [ 4 ] = { { 0, - 1 }, { - 1, 0 }, { 1, 0 }, { 0, 1 } } ; int i, j ; unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; int what_stride = b -> src_stride ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; int br, bc ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; unsigned char * base_offset ; unsigned char * this_offset ; int k = - 1 ; int all_in ; int best_site = - 1 ; int hex_range = 127 ; int dia_range = 8 ; int_mv fcenter_mv ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; <START_BUG> vp8_clamp_mv ( ref_mv, x -> mv_col_min, x -> mv_col_max, x -> mv_row_min, x -> mv_row_max ) ; <END_BUG> br = ref_mv -> as_mv. row ; bc = ref_mv -> as_mv. col ; base_offset = ( unsigned char * ) ( base_pre + d -> offset ) ; this_offset = base_offset + ( br * ( pre_stride ) ) + bc ; this_mv. as_mv

Fix:
<S2SV_ModStart> >> 3 ; ( void ) mvcost ; <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> 8 ; # else ( void ) search_param ; # <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) ; CHECK_BETTER <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) ; CHECK_BETTER <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) ; CHECK_BETTER <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) ; CHECK_BETTER <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) ; CHECK_BETTER <S2SV_ModStart> this_offset, in_what_stride <S2SV_ModEnd> ) ; CHECK_BETTER
Buggy code:
 static int b_unpack ( lua_State * L ) { Header h ; const char * fmt = luaL_checkstring ( L, 1 ) ; size_t ld ; const char * data = luaL_checklstring ( L, 2, & ld ) ; size_t pos = luaL_optinteger ( L, 3, 1 ) - 1 ; <START_BUG> defaultoptions ( & h ) ; <END_BUG> lua_settop ( L, 2 ) ; while ( * fmt ) { int opt = * fmt ++ ; size_t size = optsize ( L, opt, & fmt ) ; pos += gettoalign ( pos, & h, opt, size ) ; luaL_argcheck ( L, pos + size <= ld, 2, "data   string   too   short" ) ;  luaL_checkstack ( L, 1, "too   many   results" ) ; <START_BUG> switch ( opt ) { case 'b' : case 'B' : case 'h' : case 'H' : case 'l' : case 'L' : case 'T' : case 'i' : case 'I' : { int issigned = islower ( opt ) ; lua_Number res = getinteger ( data + pos, h. endian, issigned, size ) ; <END_BUG> lua_pushnumber ( L, res ) ;  break ; } case 'x' : { break ; } case 'f' : { float f ; memcpy ( & f, data + pos, size ) ; correctbytes ( ( char * ) & f, sizeof ( f ), h. endian ) ; <START_BUG> lua_pushnumber ( L, f ) ; <END_BUG> break ; } case 'd' : { double d ; memcpy ( & d, data + pos, size ) ; correctbytes ( ( char * ) & d, sizeof ( d ), h. endian ) ;  lua_pushnumber ( L, d ) ; <START_BUG> break ; } case 'c' : { if ( size == 0 ) { <END_BUG> if (! lua_isnumber ( L, - 1 ) )  <START_BUG> luaL_error ( L, "format   `c0\'   needs   a   previous   size" ) ; <END_BUG> size = lua_tonumber ( L, - 1 ) ;  lua_pop ( L, 1 ) ; <START_BUG> <END_BUG> luaL_argcheck

Fix:
<S2SV_ModStart> - 1 ; int n = 0 ; <S2SV_ModStart> ( & h <S2SV_ModEnd> ) ; while <S2SV_ModStart> ( L, 2 <S2SV_ModEnd>, "too <S2SV_blank> many <S2SV_blank> results" ) <S2SV_ModStart> res ) ; n ++ ; <S2SV_ModStart> f ) ; n ++ ; <S2SV_ModStart> d ) ; n ++ ; <S2SV_ModStart> { if ( n == 0 || <S2SV_ModStart> ( L, "format <S2SV_blank> \'c0\' <S2SV_blank> needs <S2SV_blank> a <S2SV_blank> previous <S2SV_blank> size" <S2SV_ModEnd> ) ; size <S2SV_ModStart> 1 ) ; n -- ; <S2SV_ModStart> ( L, <S2SV_ModEnd> size <= ld <S2SV_ModStart> size <= ld && pos <= ld - size, <S2SV_ModEnd> 2, "data <S2SV_blank> string <S2SV_blank> too <S2SV_blank> short" <S2SV_ModStart>, size ) ; n ++ <S2SV_ModStart> 1 ) ; n ++ ; <S2SV_ModStart> ) ; return n + 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static const u_char * ikev2_t_print ( netdissect_options * ndo, int tcount, const struct isakmp_gen * ext, u_int item_len, const u_char * ep ) { const struct ikev2_t * p ; struct ikev2_t t ; uint16_t t_id ; const u_char * cp ; const char * idstr ; const struct attrmap * map ; size_t nmap ; const u_char * ep2 ; p = ( const struct ikev2_t * ) ext ; ND_TCHECK ( * p ) ; UNALIGNED_MEMCPY ( & t, ext, sizeof ( t ) ) ; ikev2_pay_print ( ndo, NPSTR ( ISAKMP_NPTYPE_T ), t. h. critical ) ; t_id = ntohs ( t. t_id ) ; map = NULL ; nmap = 0 ; switch ( t. t_type ) { case IV2_T_ENCR : idstr = STR_OR_ID ( t_id, esp_p_map ) ; map = encr_t_map ; nmap = sizeof ( encr_t_map ) // sizeof ( encr_t_map [ 0 ] ) ; break ; case IV2_T_PRF : idstr = STR_OR_ID ( t_id, prf_p_map ) ; break ; case IV2_T_INTEG : idstr = STR_OR_ID ( t_id, integ_p_map ) ; break ; case IV2_T_DH : idstr = STR_OR_ID ( t_id, dh_p_map ) ; break ; case IV2_T_ESN : idstr = STR_OR_ID ( t_id, esn_p_map ) ; break ; default : idstr = NULL ; break ; } if ( idstr ) ND_PRINT ( ( ndo, "   #%u   type=%s   id=%s   ", tcount, STR_OR_ID ( t. t_type, ikev2_t_type_map ), idstr ) ) ; else ND_PRINT ( ( ndo, "   #%u

Fix:
<S2SV_ModStart>, cp, ep2, map, nmap ) ; } else cp = ikev1_attr_print ( ndo, cp, ep2 ) ; if ( cp == NULL ) goto trunc ; } if <S2SV_ModStart> < ep2 ) <S2SV_ModEnd> ND_PRINT ( (
Buggy code:
 SQLITE_PRIVATE int sqlite3VtabEponymousTableInit ( Parse * pParse, Module * pMod ) { const sqlite3_module * pModule = pMod -> pModule ; Table * pTab ; char * zErr = 0 ; int rc ; sqlite3 * db = pParse -> db ; if ( pMod -> pEpoTab ) return 1 ; if ( pModule -> xCreate!= 0 && pModule -> xCreate!= pModule -> xConnect ) return 0 ; pTab = sqlite3DbMallocZero ( db, sizeof ( Table ) ) ; if ( pTab == 0 ) return 0 ; pTab -> zName = sqlite3DbStrDup ( db, pMod -> zName ) ; if ( pTab -> zName == 0 ) { sqlite3DbFree ( db, pTab ) ; return 0 ; } pMod -> pEpoTab = pTab ; pTab -> nTabRef = 1 ; pTab -> pSchema = db -> aDb [ 0 ]. pSchema ; assert ( pTab -> nModuleArg == 0 ) ; pTab -> iPKey = - 1 ; <START_BUG> addModuleArgument ( db, pTab, sqlite3DbStrDup ( db, pTab -> zName ) ) ; <END_BUG>  addModuleArgument ( db, pTab, 0 ) ; <START_BUG> <END_BUG> addModuleArgument ( db, pTab, sqlite3DbStrDup ( db, pTab -> zName ) ) ;  rc = vtabCallConstructor ( db, pTab, pMod, pModule -> xConnect, & zErr ) ; if ( rc ) { sqlite3ErrorMsg ( pParse, "%s", zErr ) ; sqlite3DbFree ( db, zErr ) ; sqlite3VtabEponymousTableClear ( db, pMod ) ; return 0 ; } return 1 ; }

Fix:
<S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pTab, <S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pTab, <S2SV_ModStart> ; addModuleArgument ( pParse <S2SV_ModEnd>, pTab,
Buggy code:
 void unix_notinflight ( struct file * fp ) { struct sock * s = unix_get_socket ( fp ) ; <START_BUG> if ( s ) { <END_BUG>  struct unix_sock * u = unix_sk ( s ) ; <START_BUG> spin_lock ( & unix_gc_lock ) ; BUG_ON ( list_empty ( & u -> link ) ) ; if ( atomic_long_dec_and_test ( & u -> inflight ) ) list_del_init ( & u -> link ) ; unix_tot_inflight -- ; <END_BUG> spin_unlock ( & unix_gc_lock ) ;  } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> fp ) ; spin_lock ( & unix_gc_lock ) ; <S2SV_ModStart> unix_sk ( s <S2SV_ModEnd> ) ; BUG_ON <S2SV_ModStart> unix_tot_inflight -- ; } fp -> f_cred -> user -> unix_inflight -- ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 struct pci_vdev * pci_get_vdev_info ( int slot ) { struct businfo * bi ; struct slotinfo * si ; struct pci_vdev * dev = NULL ; bi = pci_businfo [ 0 ] ; <START_BUG> assert ( bi!= NULL ) ; <END_BUG> si = & bi -> slotinfo [ slot ] ; if ( si!= NULL ) dev = si -> si_funcs [ 0 ]. fi_devi ; else fprintf ( stderr, "slot=%d   is   empty!\\n", slot ) ; return dev ; }

Fix:
<S2SV_ModStart> 0 ] ; if ( bi == NULL ) return NULL <S2SV_ModEnd> ; si =
Buggy code:
 <START_BUG> static int expandRegular ( rpmfi fi, const char * dest, rpmpsm psm, int nodigest, int nocontent ) <END_BUG> { FD_t wfd = NULL ; int rc = 0 ; { mode_t old_umask = umask ( 0577 ) ;  wfd = Fopen ( dest, "w.ufdio" ) ; <START_BUG> <END_BUG> umask ( old_umask ) ;  } if ( Ferror ( wfd ) ) { rc = RPMERR_OPEN_FAILED ; goto exit ; } if (! nocontent ) rc = rpmfiArchiveReadToFilePsm ( fi, wfd, nodigest, psm ) ; exit : if ( wfd ) { int myerrno = errno ; Fclose ( wfd ) ; errno = myerrno ; } return rc ; }

Fix:
<S2SV_ModStart>, rpmpsm psm, int exclusive <S2SV_ModStart> ( dest, exclusive? "wx.ufdio" : "a.ufdio" <S2SV_ModEnd> ) ; umask <S2SV_ModStart> old_umask ) ; if (! exclusive && wfd!= NULL &&! linkSane ( wfd, dest ) ) { rc = RPMERR_OPEN_FAILED ; goto exit ; }
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_slice_data ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 end_of_slice_flag = 0 ; sps_t * ps_sps ; pps_t * ps_pps ; slice_header_t * ps_slice_hdr ; WORD32 end_of_pic ; tile_t * ps_tile, * ps_tile_prev ; WORD32 i ; WORD32 ctb_addr ; WORD32 tile_idx ; WORD32 cabac_init_idc ; WORD32 ctb_size ; WORD32 num_ctb_in_row ; WORD32 num_min4x4_in_ctb ; WORD32 slice_qp ; WORD32 slice_start_ctb_idx ; WORD32 tile_start_ctb_idx ; ps_slice_hdr = ps_codec -> s_parse. ps_slice_hdr_base ; ps_pps = ps_codec -> s_parse. ps_pps_base ; ps_sps = ps_codec -> s_parse. ps_sps_base ; ps_slice_hdr += ( ps_codec -> s_parse. i4_cur_slice_idx & ( MAX_SLICE_HDR_CNT - 1 ) ) ; ps_pps += ps_slice_hdr -> i1_pps_id ; ps_sps += ps_pps -> i1_sps_id ; if ( 0!= ps_codec -> s_parse. i4_cur_slice_idx ) { if (! ps_slice_hdr -> i1_dependent_slice_flag ) { ps_codec -> s_parse. i4_cur_independent_slice_idx ++ ; if ( MAX_SLICE_HDR_CNT == ps_codec -> s_parse. i4_cur_independent_slice_idx ) ps_codec -> s_parse. i4_cur_independent_slice_idx = 0 ; } } ctb_size = 1 << ps_sps -> i1_log2_ctb_size ; num_min4x4_in_ctb = (

Fix:
<S2SV_ModStart> ) { WORD32 tu_coeff_data_reset_size ; <S2SV_ModEnd> ps_codec -> s_parse <S2SV_ModStart> i4_pic_pu_idx = i4_pic_pu_idx <S2SV_ModEnd> ; tu_coeff_data_reset_size = <S2SV_ModStart> ) pu1_tu_coeff_data ; ihevcd_set_ctb_skip ( ps_codec ) <S2SV_ModEnd> ; ps_codec -> <S2SV_ModStart> } else { ihevcd_set_ctb_skip ( ps_codec ) <S2SV_ModEnd> ; } if
Buggy code:
 static void record_and_restart ( struct perf_event * event, unsigned long val, <START_BUG> struct pt_regs * regs, int nmi ) <END_BUG> { u64 period = event -> hw. sample_period ; s64 prev, delta, left ; int record = 0 ; if ( event -> hw. state & PERF_HES_STOPPED ) { write_pmc ( event -> hw. idx, 0 ) ; return ; } prev = local64_read ( & event -> hw. prev_count ) ; delta = ( val - prev ) & 0xfffffffful ; local64_add ( delta, & event -> count ) ; val = 0 ; left = local64_read ( & event -> hw. period_left ) - delta ; if ( period ) { if ( left <= 0 ) { left += period ; if ( left <= 0 ) left = period ; record = 1 ; event -> hw. last_period = event -> hw. sample_period ; } if ( left < 0x80000000LL ) val = 0x80000000LL - left ; } write_pmc ( event -> hw. idx, val ) ; local64_set ( & event -> hw. prev_count, val ) ; local64_set ( & event -> hw. period_left, left ) ; perf_event_update_userpage ( event ) ; if ( record ) { struct perf_sample_data data ; perf_sample_data_init ( & data, 0 ) ; data. period = event -> hw. last_period ;  if ( perf_event_overflow ( event, nmi, & data, regs ) ) <START_BUG> fsl_emb_pmu_stop ( event, 0 ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> pt_regs * regs <S2SV_ModEnd> ) { u64 <S2SV_ModStart> ( event, <S2SV_ModEnd> & data,
Buggy code:
 static void emulate_load_store_insn ( struct pt_regs * regs, void __user * addr, unsigned int __user * pc ) { union mips_instruction insn ; unsigned long value ; unsigned int res ; perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, <START_BUG> 1, 0, regs, 0 ) ; <END_BUG> __get_user ( insn. word, pc ) ; switch ( insn. i_format. opcode ) { case ll_op : case lld_op : case sc_op : case scd_op : case ldl_op : case ldr_op : case lwl_op : case lwr_op : case sdl_op : case sdr_op : case swl_op : case swr_op : case lb_op : case lbu_op : case sb_op : goto sigbus ; case lh_op : if (! access_ok ( VERIFY_READ, addr, 2 ) ) goto sigbus ; __asm__ __volatile__ ( ".set\\tnoat\\n" # ifdef __BIG_ENDIAN "1:\\tlb\\t%0,   0(%2)\\n" "2:\\tlbu\\t$1,   1(%2)\\n\\t" # endif # ifdef __LITTLE_ENDIAN "1:\\tlb\\t%0,   1(%2)\\n" "2:\\tlbu\\t$1,   0(%2)\\n\\t" # endif "sll\\t%0,   0x8\\n\\t" "or\\t%0,   $1\\n\\t" "li\\t%1,   0\\n" "3:\\t.set\\tat\\n\\t" ".section\\t.fixup,\\"ax\\"\\n\\t" "4:\\tli\\t%1,   %3\\n\\t" "j\\t3b\\n\\t" ".previous\\n\\t" ".section\\t__ex_table,\\"a\\"\\n\\t" STR ( PTR ) "\\t1b,   4b\\n\\t" STR ( PTR ) "\\t2b,   4b\\n\\t" ".previous" : "=&r" (

Fix:
<S2SV_ModStart> PERF_COUNT_SW_EMULATION_FAULTS, 1 <S2SV_ModEnd>, regs,
Buggy code:
 static void put_crypt_info ( struct fscrypt_info * ci ) { if (! ci ) return ; <START_BUG> key_put ( ci -> ci_keyring_key ) ; <END_BUG> crypto_free_skcipher ( ci -> ci_ctfm ) ; kmem_cache_free ( fscrypt_info_cachep, ci ) ; }

Fix:
<S2SV_ModStart> ) return ; <S2SV_ModEnd> crypto_free_skcipher ( ci
Buggy code:
 static __inline__ int scm_check_creds ( struct ucred * creds ) { const struct cred * cred = current_cred ( ) ; kuid_t uid = make_kuid ( cred -> user_ns, creds -> uid ) ; kgid_t gid = make_kgid ( cred -> user_ns, creds -> gid ) ; if (! uid_valid ( uid ) ||! gid_valid ( gid ) ) return - EINVAL ; <START_BUG> if ( ( creds -> pid == task_tgid_vnr ( current ) || nsown_capable ( CAP_SYS_ADMIN ) ) && <END_BUG> ( ( uid_eq ( uid, cred -> uid ) || uid_eq ( uid, cred -> euid ) || uid_eq ( uid, cred -> suid ) ) || nsown_capable ( CAP_SETUID ) ) && ( ( gid_eq ( gid, cred -> gid ) || gid_eq ( gid, cred -> egid ) || gid_eq ( gid, cred -> sgid ) ) || nsown_capable ( CAP_SETGID ) ) ) { return 0 ; } return - EPERM ; }

Fix:
<S2SV_ModStart> current ) || ns_capable ( current -> nsproxy -> pid_ns -> user_ns, <S2SV_ModEnd> CAP_SYS_ADMIN ) )
Buggy code:
 static int rfcomm_sock_bind ( struct socket * sock, struct sockaddr * addr, int addr_len ) { <START_BUG> struct sockaddr_rc * sa = ( struct sockaddr_rc * ) addr ; <END_BUG> struct sock * sk = sock -> sk ;  int chan = sa -> rc_channel ; <START_BUG> <END_BUG> int err = 0 ;  BT_DBG ( "sk   %p   %pMR", sk, & sa -> rc_bdaddr ) ; if (! addr || addr -> sa_family!= AF_BLUETOOTH ) return - EINVAL ; <START_BUG> lock_sock ( sk ) ; <END_BUG> if ( sk -> sk_state!= BT_OPEN ) { err = - EBADFD ; goto done ; } if ( sk -> sk_type!= SOCK_STREAM ) { err = - EINVAL ; goto done ; } write_lock ( & rfcomm_sk_list. lock ) ;  if ( chan && __rfcomm_get_listen_sock_by_addr ( chan, & sa -> rc_bdaddr ) ) { <START_BUG> err = - EADDRINUSE ; } else { <END_BUG> bacpy ( & rfcomm_pi ( sk ) -> src, & sa -> rc_bdaddr ) ;  <START_BUG> rfcomm_pi ( sk ) -> channel = chan ; <END_BUG> sk -> sk_state = BT_BOUND ; } write_unlock ( & rfcomm_sk_list. lock ) ; done : release_sock ( sk ) ; return err ; }

Fix:
<S2SV_ModStart> { struct sockaddr_rc sa <S2SV_ModEnd> ; struct sock <S2SV_ModStart> sk ; int len, <S2SV_ModEnd> err = 0 <S2SV_ModStart> err = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> - EINVAL ; memset ( & sa, 0, sizeof ( sa ) ) ; len = min_t ( unsigned int, sizeof ( sa ), addr_len ) ; memcpy ( & sa, addr, len ) ; BT_DBG ( "sk <S2SV_blank> %p <S2SV_blank> %pMR", sk, & sa. rc_bdaddr ) ; <S2SV_ModStart> ; if ( sa. rc_channel <S2SV_ModEnd> && __rfcomm_get_listen_sock_by_addr ( <S2SV_ModStart> && __rfcomm_get_listen_sock_by_addr ( sa. rc_channel, & sa. <S2SV_ModEnd> rc_bdaddr ) ) <S2SV_ModStart>, & sa. <S2SV_ModEnd> rc_bdaddr ) ; <S2SV_ModStart> -> channel = sa. rc_channel <S2SV_ModEnd> ; sk ->
Buggy code:
 int compat_get_timex ( struct timex * txc, const struct compat_timex __user * utp ) { struct compat_timex tx32 ; <START_BUG> if ( copy_from_user ( & tx32, utp, sizeof ( struct compat_timex ) ) ) <END_BUG> return - EFAULT ; txc -> modes = tx32. modes ; txc -> offset = tx32. offset ; txc -> freq = tx32. freq ; txc -> maxerror = tx32. maxerror ; txc -> esterror = tx32. esterror ; txc -> status = tx32. status ; txc -> constant = tx32. constant ; txc -> precision = tx32. precision ; txc -> tolerance = tx32. tolerance ; txc -> time. tv_sec = tx32. time. tv_sec ; txc -> time. tv_usec = tx32. time. tv_usec ; txc -> tick = tx32. tick ; txc -> ppsfreq = tx32. ppsfreq ; txc -> jitter = tx32. jitter ; txc -> shift = tx32. shift ; txc -> stabil = tx32. stabil ; txc -> jitcnt = tx32. jitcnt ; txc -> calcnt = tx32. calcnt ; txc -> errcnt = tx32. errcnt ; txc -> stbcnt = tx32. stbcnt ; return 0 ; }

Fix:
<S2SV_ModStart> compat_timex tx32 ; memset ( txc, 0, sizeof ( struct timex ) ) ;
Buggy code:
 static inline void VectorClamp ( DDSVector4 * value ) { <START_BUG> value -> x = MinF ( 1.0f, MaxF ( 0.0f, value -> x ) ) ; <END_BUG>  value -> y = MinF ( 1.0f, MaxF ( 0.0f, value -> y ) ) ; <START_BUG> <END_BUG> value -> z = MinF ( 1.0f, MaxF ( 0.0f, value -> z ) ) ;  <START_BUG> value -> w = MinF ( 1.0f, MaxF ( 0.0f, value -> w ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> -> x = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f, <S2SV_ModStart> -> y = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f, <S2SV_ModStart> -> z = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f, <S2SV_ModStart> -> w = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f,
Buggy code:
 static int key_verify ( pam_handle_t * pamh, int flags, PKCS11_KEY * authkey ) { int ok = 0 ; unsigned char challenge [ 30 ] ; <START_BUG> unsigned char signature [ 256 ] ; <END_BUG>  unsigned int siglen = sizeof signature ; <START_BUG> const EVP_MD * md = EVP_sha1 ( ) ; EVP_MD_CTX * md_ctx = EVP_MD_CTX_new ( ) ; EVP_PKEY * privkey = PKCS11_get_private_key ( authkey ) ; EVP_PKEY * pubkey = PKCS11_get_public_key ( authkey ) ; <END_BUG> if ( 1!= randomize ( pamh, challenge, sizeof challenge ) ) {  goto err ; } if ( NULL == pubkey || NULL == privkey || NULL == md_ctx || NULL == md ||! EVP_SignInit ( md_ctx, md ) ||! EVP_SignUpdate ( md_ctx, challenge, sizeof challenge ) ||! EVP_SignFinal ( md_ctx, signature, & siglen, privkey ) ||! EVP_MD_CTX_reset ( md_ctx ) ||! EVP_VerifyInit ( md_ctx, md ) ||! EVP_VerifyUpdate ( md_ctx, challenge, sizeof challenge ) || 1!= EVP_VerifyFinal ( md_ctx, signature, siglen, pubkey ) ) { pam_syslog ( pamh, LOG_DEBUG, "Error   verifying   key:   %s\\n", ERR_reason_error_string ( ERR_get_error ( ) ) ) ; prompt ( flags, pamh, PAM_ERROR_MSG, NULL, _ ( "Error   verifying   key" ) ) ; goto err ; } ok = 1 ; <START_BUG> err : <END_BUG> if ( NULL!= pubkey ) EVP_PKEY_free ( pubkey ) ; if ( NULL!= privkey ) EVP_PKEY_free ( privkey ) ; if ( NULL!= md_ctx ) { EVP_MD_CTX_free ( md_ctx ) ; } return ok ; }

Fix:
<S2SV_ModStart> ; unsigned char * signature = NULL <S2SV_ModEnd> ; unsigned int <S2SV_ModStart> unsigned int siglen <S2SV_ModEnd> ; const EVP_MD <S2SV_ModStart> ; if ( NULL == privkey ) goto err ; siglen = EVP_PKEY_size ( privkey ) ; if ( siglen <= 0 ) goto err ; signature = malloc ( siglen ) ; if ( NULL == signature ) goto err ; if ( <S2SV_ModStart> ; err : free ( signature ) ;
Buggy code:
 static const u_char * ikev2_n_print ( netdissect_options * ndo, u_char tpay _U_, const struct isakmp_gen * ext, u_int item_len, const u_char * ep, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { const struct ikev2_n * p ; struct ikev2_n n ; const u_char * cp ; <START_BUG> u_char showspi, showdata, showsomedata ; <END_BUG> const char * notify_name ; uint32_t type ; p = ( const struct ikev2_n * ) ext ; ND_TCHECK ( * p ) ; UNALIGNED_MEMCPY ( & n, ext, sizeof ( n ) ) ; ikev2_pay_print ( ndo, NPSTR ( ISAKMP_NPTYPE_N ), n. h. critical ) ; showspi = 1 ;  showdata = 0 ; <START_BUG> showsomedata = 0 ; notify_name = NULL ; ND_PRINT ( ( ndo, "   prot_id=%s", PROTOIDSTR ( n. prot_id ) ) ) ; type = ntohs ( n. type ) ; switch ( type ) { case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD : notify_name = "unsupported_critical_payload" ; showspi = 0 ; break ; case IV2_NOTIFY_INVALID_IKE_SPI : notify_name = "invalid_ike_spi" ; showspi = 1 ; break ; case IV2_NOTIFY_INVALID_MAJOR_VERSION : notify_name = "invalid_major_version" ; showspi = 0 ; break ; case IV2_NOTIFY_INVALID_SYNTAX : notify_name = "invalid_syntax" ; showspi = 1 ; break ; case IV2_NOTIFY_INVALID_MESSAGE_ID : notify_name = "invalid_message_id" ; showspi = 1 ; break ; case IV2_NOTIFY_INVALID_SPI : notify_name = "invalid_spi" ; showspi = 1 ; break ; case IV2_NOTIFY_NO_PROPOSAL_CHOSEN<END_BUG>

Fix:
<S2SV_ModStart> ; u_char showspi <S2SV_ModEnd>, showsomedata ; <S2SV_ModStart> = 1 ; <S2SV_ModEnd> showsomedata = 0 <S2SV_ModStart> showsomedata = 1 <S2SV_ModEnd> ; break ; <S2SV_ModStart> ; if ( cp < ep ) { if ( <S2SV_ModEnd> ndo -> ndo_vflag <S2SV_ModStart> ndo -> ndo_vflag > 3 <S2SV_ModEnd> || ( showsomedata <S2SV_ModStart> 30 ) ) <S2SV_ModEnd> { ND_PRINT ( <S2SV_ModStart> if ( showsomedata <S2SV_ModEnd> ) { if <S2SV_ModStart> goto trunc ; }
Buggy code:
 int mk_request_error ( int http_status, struct client_session * cs, struct session_request * sr ) { int ret, fd ; mk_ptr_t message, * page = 0 ; struct error_page * entry ; struct mk_list * head ; struct file_info finfo ; mk_header_set_http_status ( sr, http_status ) ; if ( http_status!= MK_CLIENT_LENGTH_REQUIRED && http_status!= MK_CLIENT_BAD_REQUEST && http_status!= MK_CLIENT_REQUEST_ENTITY_TOO_LARGE ) { mk_list_foreach ( head, & sr -> host_conf -> error_pages ) { entry = mk_list_entry ( head, struct error_page, _head ) ; if ( entry -> status!= http_status ) { continue ; } ret = mk_file_get_info ( entry -> real_path, & finfo ) ; if ( ret == - 1 ) { break ; } fd = open ( entry -> real_path, config -> open_flags ) ; if ( fd == - 1 ) { break ; } sr -> fd_file = fd ; <START_BUG> sr -> bytes_to_send = finfo. size ; <END_BUG> sr -> headers. content_length = finfo. size ; sr -> headers. real_length = finfo. size ; memcpy ( & sr -> file_info, & finfo, sizeof ( struct file_info ) ) ; mk_header_send ( cs -> socket, cs, sr ) ; return mk_http_send_file ( cs, sr ) ; } } mk_ptr_reset ( & message ) ; switch ( http_status ) { case MK_CLIENT_BAD_REQUEST : page = mk_request_set_default_page ( "Bad   Request", sr -> uri, sr -> host_conf -> host_signature ) ; break ; case MK_CLIENT_FORBIDDEN : page = mk_request_set_default_page ( "Forbidden", sr -> uri, sr -> host_conf -> host_signature ) ; break ; case MK_CLIENT_NOT_FOUND : mk_string_build ( & message. data, & message. len, "The   requested   URL   was   not   found   on   this   server." ) ; page = mk_request_set_default_page ( "Not

Fix:
<S2SV_ModStart> ; sr -> fd_is_fdt = MK_FALSE ; sr ->
Buggy code:
 static void sample_to_timespec ( const clockid_t which_clock, union cpu_time_count cpu, struct timespec * tp ) { <START_BUG> if ( CPUCLOCK_WHICH ( which_clock ) == CPUCLOCK_SCHED ) { <END_BUG>  tp -> tv_sec = div_long_long_rem ( cpu. sched, <START_BUG> NSEC_PER_SEC, & tp -> tv_nsec ) ; } else { cputime_to_timespec ( cpu. cpu, tp ) ; } <END_BUG> } 

Fix:
<S2SV_ModStart> == CPUCLOCK_SCHED ) * tp = ns_to_timespec <S2SV_ModEnd> ( cpu. <S2SV_ModStart> cpu. sched ) ; else <S2SV_ModEnd> cputime_to_timespec ( cpu <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int next_state_val ( CClassNode * cc, OnigCodePoint * vs, OnigCodePoint v, int * vs_israw, int v_israw, enum CCVALTYPE intype, enum CCVALTYPE * type, enum CCSTATE * state, ScanEnv * env ) { int r ; switch ( * state ) { case CCS_VALUE : if ( * type == CCV_SB ) { <START_BUG> BITSET_SET_BIT ( cc -> bs, ( int ) ( * vs ) ) ; <END_BUG> } else if ( * type == CCV_CODE_POINT ) { r = add_code_range ( & ( cc -> mbuf ), env, * vs, * vs ) ; if ( r < 0 ) return r ; } break ; case CCS_RANGE : if ( intype == * type ) { if ( intype == CCV_SB ) { if ( * vs > 0xff || v > 0xff ) return ONIGERR_INVALID_CODE_POINT_VALUE ; if ( * vs > v ) { if ( IS_SYNTAX_BV ( env -> syntax, ONIG_SYN_ALLOW_EMPTY_RANGE_IN_CC ) ) goto ccs_range_end ; else return ONIGERR_EMPTY_RANGE_IN_CHAR_CLASS ; } bitset_set_range ( cc -> bs, ( int ) * vs, ( int ) v ) ; } else { r = add_code_range ( & ( cc -> mbuf ), env, * vs, v ) ; if ( r < 0 ) return r ; } } else { # if 0 if ( intype == CCV_CODE_POINT && * type == CCV_SB ) { # endif if ( * vs > v ) { if ( IS_SYNTAX_BV ( env -> syntax, ONIG_SYN_ALLOW_EMPTY_RANGE_IN_CC ) ) goto ccs_range_end ; else return ONIGERR_EMPTY_RANGE_IN_CHAR_CLASS ; } bitset_set_range ( cc -> bs, ( int ) * vs, ( int ) ( v < 0xff? v : 0xff ) ) ; r = add_code_range ( & ( cc -> mbuf ), env, ( OnigCodePoint ) * vs, v ) ; if ( r < 0 ) return r ; # if 0

Fix:
<S2SV_ModStart> CCV_SB ) { if ( * vs > 0xff ) return ONIGERR_INVALID_CODE_POINT_VALUE ;
Buggy code:
 SEL * selReadStream ( FILE * fp ) { char * selname ; <START_BUG> char linebuf [ L_BUF_SIZE ] ; <END_BUG> l_int32 sy, sx, cy, cx, i, j, version, ignore ; SEL * sel ; PROCNAME ( "selReadStream" ) ; if (! fp ) return ( SEL * ) ERROR_PTR ( "stream   not   defined", procName, NULL ) ; if ( fscanf ( fp, "     Sel   Version   %d\\n", & version )!= 1 ) return ( SEL * ) ERROR_PTR ( "not   a   sel   file", procName, NULL ) ; if ( version!= SEL_VERSION_NUMBER ) return ( SEL * ) ERROR_PTR ( "invalid   sel   version", procName, NULL ) ;  if ( fgets ( linebuf, L_BUF_SIZE, fp ) == NULL ) <START_BUG> return ( SEL * ) ERROR_PTR ( "error   reading   into   linebuf", procName, NULL ) ; selname = stringNew ( linebuf ) ; <END_BUG> sscanf ( linebuf, "     ------     %s     ------", selname ) ;  if ( fscanf ( fp, "     sy   =   %d,   sx   =   %d,   cy   =   %d,   cx   =   %d\\n", & sy, & sx, & cy, & cx )!= 4 ) { LEPT_FREE ( selname ) ; return ( SEL * ) ERROR_PTR ( "dimensions   not   read", procName, NULL ) ; } if ( ( sel = selCreate ( sy, sx, selname ) ) == NULL ) { LEPT_FREE ( selname ) ; return ( SEL * ) ERROR_PTR ( "sel   not   made", procName, NULL ) ; } selSetOrigin ( sel, cy, cx ) ; for ( i = 0 ; i < sy ; i ++ ) { ignore = fscanf ( fp, "         " ) ; for ( j = 0 ; j < sx ; j ++ ) ignore = fscanf ( fp, "%1d", & sel -> data [ i ] [ j ] ) ; ignore = fscanf ( fp, "\\n

Fix:
<S2SV_ModStart> char linebuf [ L_BUFSIZE <S2SV_ModEnd> ] ; l_int32 <S2SV_ModStart> ( linebuf, L_BUFSIZE <S2SV_ModEnd>, fp ) <S2SV_ModStart> ( linebuf, " <S2SV_blank> <S2SV_blank> ------ <S2SV_blank> <S2SV_blank> %200s <S2SV_blank> <S2SV_blank> ------" <S2SV_ModEnd>, selname )
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowDCMException ( exception, message ) { if ( data!= ( unsigned char * ) NULL ) data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; if ( stream_info!= ( DCMStreamInfo * ) NULL ) stream_info = ( DCMStreamInfo * ) RelinquishMagickMemory ( stream_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char explicit_vr [ MaxTextExtent ], implicit_vr [ MaxTextExtent ], magick [ MaxTextExtent ], photometric [ MaxTextExtent ] ; DCMInfo info ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, * redmap ; MagickBooleanType explicit_file, explicit_retry, sequence, use_explicit ; MagickOffsetType offset ; register unsigned char * p ; register ssize_t i ; size_t colors, height, length, number_scenes, quantum, status, width ; ssize_t count, scene ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 8UL ; image -> endian = LSBEndian ; data = ( unsigned char * ) NULL ; stream_info = ( DCMStreamInfo * ) AcquireMagickMemory ( sizeof ( * stream_info ) ) ; if ( stream_info == ( DCMStreamInfo * ) NULL ) ThrowDCMException ( ResourceLimitError, "MemoryAllocationFailed" ) ; ( void ) ResetMagickMemory (

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( data <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char explicit_vr [ <S2SV_ModStart> image ) ) ThrowDCMException <S2SV_ModEnd> ( CorruptImageError,
Buggy code:
 error_t ssiProcessIncludeCommand ( HttpConnection * connection, const char_t * tag, size_t length, const char_t * uri, uint_t level ) { error_t error ; char_t * separator ; char_t * attribute ; char_t * value ; char_t * path ; char_t * p ; if ( length < 7 || length >= HTTP_SERVER_BUFFER_SIZE ) return ERROR_INVALID_TAG ; osMemcpy ( connection -> buffer, tag + 7, length - 7 ) ; connection -> buffer [ length - 7 ] = '\\0' ; <START_BUG> separator = strchr ( connection -> buffer, '=' ) ; <END_BUG> if (! separator ) return ERROR_INVALID_TAG ; * separator = '\\0' ; attribute = strTrimWhitespace ( connection -> buffer ) ; value = strTrimWhitespace ( separator + 1 ) ; if ( value [ 0 ] == '\\'' || value [ 0 ] == \'\\"\' ) value ++ ; length = osStrlen ( value ) ; if ( length > 0 ) { if ( value [ length - 1 ] == '\\'' || value [ length - 1 ] == \'\\"\' ) value [ length - 1 ] = '\\0' ; } if ( osStrlen ( value ) > HTTP_SERVER_URI_MAX_LEN ) return ERROR_INVALID_TAG ; if (! osStrcasecmp ( attribute, "file" ) ) { path = osAllocMem ( osStrlen ( uri ) + osStrlen ( value ) + 1 ) ; if ( path == NULL ) return ERROR_OUT_OF_MEMORY ; osStrcpy ( path, uri ) ; p = strrchr ( path, '//' ) ; if ( p ) osStrcpy ( p + 1, value ) ; else osStrcpy ( path, value ) ; } else if (! osStrcasecmp ( attribute, "virtual" ) ) { path = strDuplicate ( value ) ; if ( path == NULL ) return ERROR_OUT_OF_MEMORY ; } else { return ERROR_INVALID_TAG ; } if ( httpCompExtension ( value, ".stm" ) || httpCompExtension ( value, ".shtm" ) || httpCompExtension ( value, ".shtml" ) ) { error = ssiExecuteScript ( connection, path, level + 1 ) ; } else { # if ( HTTP_SERVER_FS_SUPPORT == ENABLED ) Fs

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( connection ->
Buggy code:
 static int svc_can_register ( const uint16_t * name, size_t name_len, pid_t spid, uid_t uid ) { const char * perm = "add" ; <START_BUG> if ( uid >= AID_APP ) { <END_BUG> return 0 ; } return check_mac_perms_from_lookup ( spid, uid, perm, str8 ( name, name_len ) )? 1 : 0 ; }

Fix:
<S2SV_ModStart> ; if ( multiuser_get_app_id ( uid ) <S2SV_ModEnd> >= AID_APP )
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; PixelPacket * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; size_t Unknown6 ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; MATLAB_HDR. Version = ReadBlobLSBShort ( image ) ; if ( ReadBlob ( image, 2, ( unsigned char * ) & MATLAB_HDR. EndianIndicator )!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( logging ) ( void ) LogMagickEvent ( C

Fix:
<S2SV_ModStart>, sizeof ( double <S2SV_ModEnd> ) ) ;
Buggy code:
 void wb_print ( netdissect_options * ndo, register const void * hdr, register u_int len ) { register const struct pkt_hdr * ph ; ph = ( const struct pkt_hdr * ) hdr ; if ( len < sizeof ( * ph ) ||! ND_TTEST ( * ph ) ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return ; } len -= sizeof ( * ph ) ; if ( ph -> ph_flags ) ND_PRINT ( ( ndo, "*" ) ) ; switch ( ph -> ph_type ) { case PT_KILL : ND_PRINT ( ( ndo, "   wb-kill" ) ) ; return ; case PT_ID : if ( wb_id ( ndo, ( const struct pkt_id * ) ( ph + 1 ), len ) >= 0 ) return ; <START_BUG> break ; <END_BUG> case PT_RREQ : if ( wb_rreq ( ndo, ( const struct pkt_rreq * ) ( ph + 1 ), len ) >= 0 ) return ;  break ; <START_BUG> case PT_RREP : if ( wb_rrep ( ndo, ( const struct pkt_rrep * ) ( ph + 1 ), len ) >= 0 ) return ; <END_BUG> break ;  case PT_DRAWOP : if ( wb_drawop ( ndo, ( const struct pkt_dop * ) ( ph + 1 ), len ) >= 0 ) return ; <START_BUG> break ; <END_BUG> case PT_PREQ : if ( wb_preq ( ndo, ( const struct pkt_preq * ) ( ph + 1 ), len ) >= 0 ) return ;  break ; <START_BUG> case PT_PREP : if ( wb_prep ( ndo, ( const struct pkt_prep * ) ( ph + 1 ), len ) >= 0 ) <END_BUG> return ;  break ; default : ND_PRINT ( ( ndo, "   wb-%d!", ph -> ph_type ) ) ; return ; } }

Fix:
<S2SV_ModStart> ) return ; ND_PRINT ( ( ndo, "%s", tstr ) ) ; <S2SV_ModStart> ) return ; ND_PRINT ( ( ndo, "%s", tstr ) ) ; <S2SV_ModStart> ) return ; ND_PRINT ( ( ndo, "%s", tstr ) ) ; <S2SV_ModStart> ) return ; ND_PRINT ( ( ndo, "%s", tstr ) ) ; <S2SV_ModStart> ) return ; ND_PRINT ( ( ndo, "%s", tstr ) ) ; <S2SV_ModStart> 0 ) return ; ND_PRINT ( ( ndo, "%s", tstr ) )
Buggy code:
 int hfsplus_set_posix_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int err ; char * xattr_name ; size_t size = 0 ; char * value = NULL ; hfs_dbg ( ACL_MOD, "[%s]:   ino   %lu\\n", __func__, inode -> i_ino ) ; switch ( type ) { case ACL_TYPE_ACCESS : xattr_name = XATTR_NAME_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> err = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( err < 0 ) return err ; } err = 0 ; break ; case ACL_TYPE_DEFAULT : xattr_name = XATTR_NAME_POSIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } if ( acl ) { size = posix_acl_xattr_size ( acl -> a_count ) ; if ( unlikely ( size > HFSPLUS_MAX_INLINE_DATA_SIZE ) ) return - ENOMEM ; value = ( char * ) hfsplus_alloc_attr_entry ( ) ; if ( unlikely (! value ) ) return - ENOMEM ; err = posix_acl_to_xattr ( & init_user_ns, acl, value, size ) ; if ( unlikely ( err < 0 ) ) goto end_set_acl ; } err = __hfsplus_setxattr ( inode, xattr_name, value, size, 0 ) ; end_set_acl : hfsplus_destroy_attr_entry ( ( hfsplus_attr_entry * ) value ) ; if (! err ) set_cached_acl ( inode, type, acl ) ; return err ; }

Fix:
<S2SV_ModStart> { err = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( err <S2SV_ModEnd> ) return err