nus-yam/ex-repair huggingface dataset:
Buggy code:
 int wasm_dis ( WasmOp * op, const unsigned char * buf, int buf_len ) { op -> len = 1 ; op -> op = buf [ 0 ] ; <START_BUG> if ( op -> op > 0xbf ) return 1 ; <END_BUG> WasmOpDef * opdef = & opcodes [ op -> op ] ; switch ( op -> op ) { case WASM_OP_TRAP : case WASM_OP_NOP : case WASM_OP_ELSE : case WASM_OP_RETURN : case WASM_OP_DROP : case WASM_OP_SELECT : case WASM_OP_I32EQZ : case WASM_OP_I32EQ : case WASM_OP_I32NE : case WASM_OP_I32LTS : case WASM_OP_I32LTU : case WASM_OP_I32GTS : case WASM_OP_I32GTU : case WASM_OP_I32LES : case WASM_OP_I32LEU : case WASM_OP_I32GES : case WASM_OP_I32GEU : case WASM_OP_I64EQZ : case WASM_OP_I64EQ : case WASM_OP_I64NE : case WASM_OP_I64LTS : case WASM_OP_I64LTU : case WASM_OP_I64GTS : case WASM_OP_I64GTU : case WASM_OP_I64LES : case WASM_OP_I64LEU : case WASM_OP_I64GES : case WASM_OP_I64GEU : case WASM_OP_F32EQ : case WASM_OP_F32NE : case WASM_OP_F32LT : case WASM_OP_F32GT : case WASM_OP_F32LE : case WASM_OP_F32GE : case WASM_OP_F64EQ : case WASM_OP_F64NE : case WASM_OP_F64LT : case WASM_OP_F64GT : case WAS

Fix:
<S2SV_ModStart> > 0xbf ) { <S2SV_ModStart> return 1 ; } <S2SV_ModStart> buf_len ) ) { <S2SV_ModStart> goto err ; } <S2SV_ModStart> ) ) ) { <S2SV_ModStart> goto err ; } <S2SV_ModStart> buf_len ) ) { <S2SV_ModStart> goto beach ; } <S2SV_ModStart> buf_len ) ) { <S2SV_ModStart> goto beach ; } <S2SV_ModStart> -> txt ) + 10 <S2SV_ModStart> ++ ) { int optxtlen = strlen ( op -> txt ) ; <S2SV_ModStart> -> txt + optxtlen, R_ASM_BUFSIZE - optxtlen <S2SV_ModEnd>, "%d <S2SV_blank> ",
Buggy code:
 static int mem_write ( jas_stream_obj_t * obj, char * buf, int cnt ) { <START_BUG> int n ; <END_BUG> int ret ; jas_stream_memobj_t * m = ( jas_stream_memobj_t * ) obj ;  long newbufsize ; <START_BUG> long newpos ; assert ( buf ) ; assert ( cnt >= 0 ) ; JAS_DBGLOG ( 100, ( "mem_write(%p,   %p,   %d)\\n", obj, buf, cnt ) ) ; newpos = m -> pos_ + cnt ; if ( newpos > m -> bufsize_ && m -> growable_ ) { newbufsize = m -> bufsize_ ; while ( newbufsize < newpos ) { <END_BUG> newbufsize <<= 1 ;  assert ( newbufsize >= 0 ) ; } <START_BUG> JAS_DBGLOG ( 100, ( "mem_write   resizing   from   %d   to   %z\\n", m -> bufsize_, <END_BUG> newbufsize ) ) ; JAS_DBGLOG ( 100, ( "mem_write   resizing   from   %d   to   %ul\\n", m -> bufsize_, JAS_CAST ( unsigned long, newbufsize ) ) ) ; if ( mem_resize ( m, newbufsize ) ) { return - 1 ; } }  if ( m -> pos_ > m -> len_ ) { <START_BUG> n = JAS_MIN ( m -> pos_, m -> bufsize_ ) - m -> len_ ; if ( n > 0 ) { memset ( & m -> buf_ [ m -> len_ ], 0, n ) ; m -> len_ += n ; } if ( m -> pos_!= m -> len_ ) { return 0 ; } } n = m -> bufsize_ - m -> pos_ ; ret = JAS_MIN ( n, cnt ) ; if ( ret > 0 ) { memcpy ( & m -> buf_ [ m -> pos_ ], buf, ret ) ; m -> pos_ += ret ; } if ( m -> pos_ > m -> len_ ) { m -> len_ = m -> pos_ ; } assert ( ret == cnt ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> cnt ) { size_t <S2SV_ModEnd> n ; int <S2SV_ModStart> ) obj ; size_t newbufsize ; size_t <S2SV_ModEnd> newpos ; assert <S2SV_ModStart> newpos ) { if (! jas_safe_size_mul ( newbufsize, 2, & newbufsize ) ) { <S2SV_ModEnd> JAS_DBGLOG ( 100 <S2SV_ModStart> 100, ( "new <S2SV_blank> buffer <S2SV_blank> size <S2SV_blank> would <S2SV_blank> cause <S2SV_blank> overflow\\n" ) ) ; <S2SV_ModEnd> return - 1 <S2SV_ModStart> ; } } JAS_DBGLOG ( 100, ( "mem_write <S2SV_blank> resizing <S2SV_blank> from <S2SV_blank> %d <S2SV_blank> to <S2SV_blank> %zu\\n", m -> bufsize_, newbufsize ) ) ; assert ( newbufsize > 0 ) ; if ( mem_resize ( m, newbufsize ) ) { return - 1 ; } }
Buggy code:
 static void dissect_pktap ( tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree ) { proto_tree * pktap_tree = NULL ; proto_item * ti = NULL ; tvbuff_t * next_tvb ; int offset = 0 ; guint32 pkt_len, rectype, dlt ; <START_BUG> col_set_str ( pinfo -> cinfo, COL_PROTOCOL, "PKTAP" ) ; <END_BUG> col_clear ( pinfo -> cinfo, COL_INFO ) ; pkt_len = tvb_get_letohl ( tvb, offset ) ; col_add_fstr ( pinfo -> cinfo, COL_INFO, "PKTAP,   %u   byte   header", pkt_len ) ; ti = proto_tree_add_item ( tree, proto_pktap, tvb, offset, pkt_len, ENC_NA ) ; pktap_tree = proto_item_add_subtree ( ti, ett_pktap ) ; proto_tree_add_item ( pktap_tree, hf_pktap_hdrlen, tvb, offset, 4, ENC_LITTLE_ENDIAN ) ; if ( pkt_len < MIN_PKTAP_HDR_LEN ) { proto_tree_add_expert ( tree, pinfo, & ei_pktap_hdrlen_too_short, tvb, offset, 4 ) ; return ; } offset += 4 ; proto_tree_add_item ( pktap_tree, hf_pktap_rectype, tvb, offset, 4, ENC_LITTLE_ENDIAN ) ; rectype = tvb_get_letohl ( tvb, offset ) ; offset += 4 ; proto_tree_add_item ( pktap_tree, hf_pktap_dlt, tvb, offset, 4, ENC_LITTLE_ENDIAN ) ; dlt = tvb_get_letohl ( tvb, offset ) ; offset += 4 ; proto_tree_add_item ( pktap_tree, hf_pktap_ifname, tvb, offset, 24, ENC_ASCII | ENC_NA ) ; offset += 24 ; proto_tree_add_item ( pktap_tree,

Fix:
<S2SV_ModStart>, dlt ; int wtap_encap ; struct eth_phdr eth ; void * phdr ; <S2SV_ModStart> pkt_len ) ; wtap_encap = wtap_pcap_encap_to_wtap_encap ( dlt ) ; switch ( wtap_encap ) { case WTAP_ENCAP_ETHERNET : eth. fcs_len = - 1 ; phdr = & eth ; break ; default : phdr = NULL ; break ; } dissector_try_uint_new <S2SV_ModEnd> ( wtap_encap_dissector_table, <S2SV_ModStart> ( wtap_encap_dissector_table, wtap_encap <S2SV_ModEnd>, next_tvb, <S2SV_ModStart> pinfo, tree, TRUE, phdr
Buggy code:
 static void parse_cfg ( int flags, int argc, const char * * argv, cfg_t * cfg ) { <START_BUG> int i ; <END_BUG> memset ( cfg, 0, sizeof ( cfg_t ) ) ; cfg -> debug_file = stderr ; for ( i = 0 ; i < argc ; i ++ ) { if ( strncmp ( argv [ i ], "max_devices=", 12 ) == 0 ) sscanf ( argv [ i ], "max_devices=%u", & cfg -> max_devs ) ; if ( strcmp ( argv [ i ], "manual" ) == 0 ) cfg -> manual = 1 ; if ( strcmp ( argv [ i ], "debug" ) == 0 ) cfg -> debug = 1 ; if ( strcmp ( argv [ i ], "nouserok" ) == 0 ) cfg -> nouserok = 1 ; if ( strcmp ( argv [ i ], "openasuser" ) == 0 ) cfg -> openasuser = 1 ; if ( strcmp ( argv [ i ], "alwaysok" ) == 0 ) cfg -> alwaysok = 1 ; if ( strcmp ( argv [ i ], "interactive" ) == 0 ) cfg -> interactive = 1 ; if ( strcmp ( argv [ i ], "cue" ) == 0 ) cfg -> cue = 1 ; if ( strcmp ( argv [ i ], "nodetect" ) == 0 ) cfg -> nodetect = 1 ; if ( strncmp ( argv [ i ], "authfile=", 9 ) == 0 ) cfg -> auth_file = argv [ i ] + 9 ; if ( strncmp ( argv [ i ], "authpending_file=", 17 ) == 0 ) cfg -> authpending_file = argv [ i ] + 17 ; if ( strncmp ( argv [ i ], "origin=", 7 ) == 0 ) cfg -> origin = argv [ i ] + 7 ; if ( strncmp ( argv [ i ], "appid=", 6 ) == 0 ) cfg -> appid = argv [ i ] + 6 ; if ( strncmp ( argv [ i ], "prompt=", 7 ) == 0 ) cfg -> prompt = argv [ i ] + 7 ; if ( strncmp ( argv [ i ], "debug_file=", 11 ) == 0 ) { const char * filename = argv [ i ] + 11

Fix:
<S2SV_ModStart> cfg ) { struct stat st ; FILE * file = NULL ; int fd = - 1 ; <S2SV_ModStart> } else { fd = open ( filename, O_WRONLY | O_APPEND | O_CLOEXEC | O_NOFOLLOW | O_NOCTTY ) ; if ( fd >= 0 && ( fstat ( fd <S2SV_ModEnd>, & st <S2SV_ModStart> == 0 ) && <S2SV_ModEnd> S_ISREG ( st <S2SV_ModStart> { file = fdopen ( fd <S2SV_ModEnd>, "a" ) <S2SV_ModStart> = file ; cfg -> is_custom_debug_file = 1 ; file = NULL ; fd = - 1 ; <S2SV_ModEnd> } } } <S2SV_ModStart> ) ; } if ( fd!= - 1 ) close ( fd ) ; if ( file!= NULL ) fclose ( file ) ;
Buggy code:
 static void my_free ( void * ptr ) { <START_BUG> free_called += 1 ; <END_BUG> free ( ptr ) ; }

Fix:
<S2SV_ModStart> ) { free_called = <S2SV_ModEnd> 1 ; free
Buggy code:
 static int iwl_process_add_sta_resp ( struct iwl_priv * priv, struct iwl_addsta_cmd * addsta, struct iwl_rx_packet * pkt ) { u8 sta_id = addsta -> sta. sta_id ; unsigned long flags ; int ret = - EIO ; if ( pkt -> hdr. flags & IWL_CMD_FAILED_MSK ) { IWL_ERR ( priv, "Bad   return   from   REPLY_ADD_STA   (0x%08X)\\n", pkt -> hdr. flags ) ; return ret ; } IWL_DEBUG_INFO ( priv, "Processing   response   for   adding   station   %u\\n", sta_id ) ; spin_lock_irqsave ( & priv -> shrd -> sta_lock, flags ) ; switch ( pkt -> u. add_sta. status ) { case ADD_STA_SUCCESS_MSK : IWL_DEBUG_INFO ( priv, "REPLY_ADD_STA   PASSED\\n" ) ; <START_BUG> iwl_sta_ucode_activate ( priv, sta_id ) ; <END_BUG> ret = 0 ; break ; case ADD_STA_NO_ROOM_IN_TABLE : IWL_ERR ( priv, "Adding   station   %d   failed,   no   room   in   table.\\n", sta_id ) ; break ; case ADD_STA_NO_BLOCK_ACK_RESOURCE : IWL_ERR ( priv, "Adding   station   %d   failed,   no   block   ack   " "resource.\\n", sta_id ) ; break ; case ADD_STA_MODIFY_NON_EXIST_STA : IWL_ERR ( priv, "Attempting   to   modify   non-existing   station   %d\\n", sta_id ) ; break ; default : IWL_DEBUG_ASSOC ( priv, "Received   REPLY_ADD_STA:(0x%08X)\\n", pkt -> u. add_sta. status ) ; break ; } IWL_DEBUG_INFO ( priv, "%s   station   id   %u   addr

Fix:
<S2SV_ModStart> "REPLY_ADD_STA <S2SV_blank> PASSED\\n" ) ; ret = iwl_sta_ucode_activate ( priv, sta_id ) <S2SV_ModEnd> ; break ;
Buggy code:
 static int do_video_set_spu_palette ( unsigned int fd, unsigned int cmd, struct compat_video_spu_palette __user * up ) { struct video_spu_palette __user * up_native ; compat_uptr_t palp ; int length, err ; err = get_user ( palp, & up -> palette ) ; <START_BUG> err |= get_user ( length, & up -> length ) ; <END_BUG> up_native = compat_alloc_user_space ( sizeof ( struct video_spu_palette ) ) ; err = put_user ( compat_ptr ( palp ), & up_native -> palette ) ; err |= put_user ( length, & up_native -> length ) ; if ( err ) return - EFAULT ; err = sys_ioctl ( fd, cmd, ( unsigned long ) up_native ) ; return err ; }

Fix:
<S2SV_ModStart> -> length ) ; if ( err ) return - EFAULT
Buggy code:
 void grubfs_free ( GrubFS * gf ) { if ( gf ) { <START_BUG> if ( gf -> file && gf -> file -> device ) <END_BUG>  free ( gf -> file -> device -> disk ) ; <START_BUG> free ( gf -> file ) ; free ( gf ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> -> device ) { <S2SV_ModStart> disk ) ; }
Buggy code:
 static size_t write_compressed_header ( VP9_COMP * cpi, uint8_t * data ) { VP9_COMMON * const cm = & cpi -> common ; <START_BUG> MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; <END_BUG>  FRAME_CONTEXT * const fc = & cm -> fc ; <START_BUG> vp9_writer header_bc ; vp9_start_encode ( & header_bc, data ) ; if ( xd -> lossless ) cm -> tx_mode = ONLY_4X4 ; else <END_BUG> encode_txfm_probs ( cm, & header_bc ) ;  update_coef_probs ( cpi, & header_bc ) ; <START_BUG> update_skip_probs ( cm, & header_bc ) ; <END_BUG> if (! frame_is_intra_only ( cm ) ) { int i ; for ( i = 0 ; i < INTER_MODE_CONTEXTS ; ++ i )  prob_diff_update ( vp9_inter_mode_tree, cm -> fc. inter_mode_probs [ i ], <START_BUG> <END_BUG> cm -> counts. inter_mode [ i ], INTER_MODES, & header_bc ) ;  vp9_zero ( cm -> counts. inter_mode ) ; if ( cm -> interp_filter == SWITCHABLE ) <START_BUG> update_switchable_interp_probs ( cm, & header_bc ) ; <END_BUG> for ( i = 0 ; i < INTRA_INTER_CONTEXTS ; i ++ ) vp9_cond_prob_diff_update ( & header_bc, & fc -> intra_inter_prob [ i ],  cm -> counts. intra_inter [ i ] ) ; <START_BUG> <END_BUG> if ( cm -> allow_comp_inter_inter ) {  const int use_compound_pred = cm -> reference_mode!= SINGLE_REFERENCE ; const int use_hybrid_pred = cm -> reference_mode == REFERENCE_MODE_SELECT ; <START_BUG> vp9_write_bit ( & header_bc, use_compound_pred ) ; <END_BUG> if ( use_compound_pred ) {  vp9_write_bit ( & header_bc, use_hybrid_pred ) ; <START_BUG> if ( use_hybrid_pred ) for ( i = 0 ; i < COMP_INTER_CONTEXTS ; i ++ ) vp9_cond_<END_BUG>

Fix:
<S2SV_ModStart> & cpi -> td. <S2SV_ModStart> const fc = cm -> fc ; FRAME_COUNTS * counts = cpi -> td. counts ; vpx_writer header_bc ; vpx_start_encode <S2SV_ModEnd> ( & header_bc <S2SV_ModStart>, & header_bc, counts <S2SV_ModStart>, & header_bc, counts <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> inter_mode_probs [ i <S2SV_ModStart> i ], counts -> <S2SV_ModEnd> inter_mode [ i <S2SV_ModStart>, & header_bc <S2SV_ModEnd> ) ; if <S2SV_ModStart>, & header_bc, counts <S2SV_ModStart> i ], counts -> <S2SV_ModEnd> intra_inter [ i <S2SV_ModStart> ; if ( cpi <S2SV_ModEnd> -> allow_comp_inter_inter ) <S2SV_ModStart> == REFERENCE_MODE_SELECT ; vpx_write_bit <S2SV_ModEnd> ( & header_bc <S2SV_ModStart> use_compound_pred ) { vpx_write_bit <S2SV_ModEnd> ( & header_bc <S2SV_ModStart> i ], counts -> <S2SV_ModEnd> comp_inter [ i <S2SV_ModStart> 0 ], counts -> <S2SV_ModEnd> single_ref [ i <S2SV_ModStart> 1 ], counts -> <S2SV_ModEnd> single_ref [ i <S2SV_ModStart> i ], counts -> <S2SV_ModEnd> comp_ref [ i <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> y_mode_prob [ i <S2SV_ModStart> i ], counts -> <S2SV_ModEnd> y_mode [ i <S2SV_ModStart> i ],
Buggy code:
 long arch_ptrace ( struct task_struct * child, long request, unsigned long addr, unsigned long data ) { int ret ; unsigned long __user * datap = ( unsigned long __user * ) data ; switch ( request ) { case PTRACE_PEEKUSR : ret = ptrace_read_user ( child, addr, datap ) ; break ; case PTRACE_POKEUSR : ret = ptrace_write_user ( child, addr, data ) ; break ; case PTRACE_GETREGS : ret = copy_regset_to_user ( child, & user_arm_view, REGSET_GPR, 0, sizeof ( struct pt_regs ), datap ) ; break ; case PTRACE_SETREGS : ret = copy_regset_from_user ( child, & user_arm_view, REGSET_GPR, 0, sizeof ( struct pt_regs ), datap ) ; break ; case PTRACE_GETFPREGS : ret = copy_regset_to_user ( child, & user_arm_view, REGSET_FPR, 0, sizeof ( union fp_state ), datap ) ; break ; case PTRACE_SETFPREGS : ret = copy_regset_from_user ( child, & user_arm_view, REGSET_FPR, 0, sizeof ( union fp_state ), datap ) ; break ; # ifdef CONFIG_IWMMXT case PTRACE_GETWMMXREGS : ret = ptrace_getwmmxregs ( child, datap ) ; break ; case PTRACE_SETWMMXREGS : ret = ptrace_setwmmxregs ( child, datap ) ; break ; # endif case PTRACE_GET_THREAD_AREA : <START_BUG> ret = put_user ( task_thread_info ( child ) -> tp_value, <END_BUG> datap ) ; break ; case PTRACE_SET_SYSCALL : task_thread_info ( child ) -> syscall = data ; ret = 0 ; break ; # ifdef CONFIG_CRUNCH case PTRACE_GETCRUNCHREGS : ret = ptrace_getcrunchregs ( child, datap ) ; break ; case PTRACE_SETCRUNCHREGS : ret = ptrace_setcrunchre

Fix:
<S2SV_ModStart> ) -> tp_value [ 0 ]
Buggy code:
 int res_inverse ( vorbis_dsp_state * vd, vorbis_info_residue * info, ogg_int32_t * * in, int * nonzero, int ch ) { int i, j, k, s, used = 0 ; codec_setup_info * ci = ( codec_setup_info * ) vd -> vi -> codec_setup ; codebook * phrasebook = ci -> book_param + info -> groupbook ; int samples_per_partition = info -> grouping ; int partitions_per_word = phrasebook -> dim ; int pcmend = ci -> blocksizes [ vd -> W ] ; if ( info -> type < 2 ) { int max = pcmend >> 1 ; int end = ( info -> end < max? info -> end : max ) ; int n = end - info -> begin ; if ( n > 0 ) { int partvals = n // samples_per_partition ; int partwords = ( partvals + partitions_per_word - 1 ) // partitions_per_word ; for ( i = 0 ; i < ch ; i ++ ) if ( nonzero [ i ] ) in [ used ++ ] = in [ i ] ; ch = used ; if ( used ) { char * * partword = ( char * * ) alloca ( ch * sizeof ( * partword ) ) ; for ( j = 0 ; j < ch ; j ++ ) partword [ j ] = ( char * ) alloca ( partwords * partitions_per_word * sizeof ( * partword [ j ] ) ) ; for ( s = 0 ; s < info -> stages ; s ++ ) { for ( i = 0 ; i < partvals ; ) { if ( s == 0 ) { partword [ 0 ] [ i + partitions_per_word - 1 ] = 1 ; for ( k = partitions_per_word - 2 ; k >= 0 ; k -- ) partword [ 0 ] [ i + k ] = partword [ 0 ] [ i + k + 1 ] * info -> partitions ; for ( j = 1 ; j < ch ; j ++ ) for ( k = partitions_per_word - 1 ; k >= 0 ; k -- ) partword [ j ] [ i + k ] = partword [ j - 1 ] [ i + k ] ; for ( j = 0 ; j < ch ; j ++ ) { int

Fix:
<S2SV_ModStart> * samples_per_partition ; int idx = ( int ) partword [ j ] [ i ] ; if ( idx < info -> partitions && <S2SV_ModEnd> info -> stagemasks <S2SV_ModStart> -> stagemasks [ idx <S2SV_ModEnd> ] & (
Buggy code:
 <START_BUG> static int getnum ( lua_State * L, const char * * fmt, int df ) { <END_BUG> if (! isdigit ( * * fmt ) ) return df ; else { int a = 0 ; do {  if ( a > ( INT_MAX // 10 ) || a * 10 > ( INT_MAX - ( * * fmt - '0' ) ) ) <START_BUG> luaL_error ( L, "integral   size   overflow" ) ; a = a * 10 + * ( ( * fmt ) ++ ) - '0' ; } while ( isdigit ( * * fmt ) ) ; return a ; } }<END_BUG>

Fix:
<S2SV_ModStart> int getnum ( <S2SV_ModEnd> const char * <S2SV_ModStart> ; do { <S2SV_ModEnd> a = a
Buggy code:
 static int rd_pick_intra4x4mby_modes ( MACROBLOCK * mb, int * Rate, int * rate_y, int * Distortion, int best_rd ) { MACROBLOCKD * const xd = & mb -> e_mbd ; int i ; int cost = mb -> mbmode_cost [ xd -> frame_type ] [ B_PRED ] ; int distortion = 0 ; int tot_rate_y = 0 ; int64_t total_rd = 0 ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; const int * bmode_costs ; <START_BUG> vpx_memcpy ( & t_above, mb -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, mb -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; intra_prediction_down_copy ( xd, xd -> dst. y_buffer - xd -> dst. y_stride + 16 ) ; bmode_costs = mb -> inter_bmode_costs ; for ( i = 0 ; i < 16 ; i ++ ) { MODE_INFO * const mic = xd -> mode_info_context ; const int mis = xd -> mode_info_stride ; B_PREDICTION_MODE UNINITIALIZED_IS_SAFE ( best_mode ) ; int UNINITIALIZED_IS_SAFE ( r ), UNINITIALIZED_IS_SAFE ( ry ), UNINITIALIZED_IS_SAFE ( d ) ; if ( mb -> e_mbd. frame_type == KEY_FRAME ) { const B_PREDICTION_MODE A = above_block_mode ( mic, i, mis ) ; const B_PREDICTION_MODE L = left_block_mode ( mic, i ) ; bmode_costs = mb -> bmode_costs [ A ] [ L ] ; } total_rd += rd_pick_intra4x4block ( mb, mb -><END_BUG>

Fix:
<S2SV_ModStart> * bmode_costs ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left
Buggy code:
 <START_BUG> static void udf_pc_to_char ( struct super_block * sb, unsigned char * from, <END_BUG>  int fromlen, unsigned char * to ) <START_BUG> { struct pathComponent * pc ; int elen = 0 ; <END_BUG> unsigned char * p = to ;  while ( elen < fromlen ) { pc = ( struct pathComponent * ) ( from + elen ) ; switch ( pc -> componentType ) { case 1 : if ( pc -> lengthComponentIdent > 0 ) break ; case 2 : <START_BUG> p = to ; <END_BUG> * p ++ = '//' ;  break ; <START_BUG> case 3 : memcpy ( p, "..//", 3 ) ; p += 3 ; <END_BUG> break ;  case 4 : <START_BUG> memcpy ( p, ".//", 2 ) ; <END_BUG> p += 2 ;  break ; <START_BUG> case 5 : <END_BUG> p += udf_get_filename ( sb, pc -> componentIdent, p,  pc -> lengthComponentIdent ) ; <START_BUG> * p ++ = '//' ; <END_BUG> break ; } elen += sizeof ( struct pathComponent ) + pc -> lengthComponentIdent ; } if ( p > to + 1 ) p [ - 1 ] = '\\0' ; else p [ 0 ] = '\\0' ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> udf_pc_to_char ( struct <S2SV_ModStart> char * to, int tolen <S2SV_ModStart> = 0 ; int comp_len ; <S2SV_ModStart> p = to ; tolen -- <S2SV_ModStart> case 2 : if ( tolen == 0 ) return - ENAMETOOLONG ; <S2SV_ModStart> = '//' ; tolen -- ; break ; case 3 : if ( tolen < 3 ) return - ENAMETOOLONG ; <S2SV_ModEnd> memcpy ( p <S2SV_ModStart> += 3 ; tolen -= 3 ; <S2SV_ModStart> case 4 : if ( tolen < 2 ) return - ENAMETOOLONG ; <S2SV_ModStart> += 2 ; tolen -= 2 ; <S2SV_ModStart> case 5 : comp_len = udf_get_filename ( sb, pc -> componentIdent, pc -> lengthComponentIdent, p, tolen ) ; p += comp_len ; tolen -= comp_len ; if ( tolen == 0 ) return - ENAMETOOLONG <S2SV_ModEnd> ; * p <S2SV_ModStart> ++ = '//' ; tolen -- <S2SV_ModStart> = '\\0' ; return 0 ;
Buggy code:
 static int connect_to_db ( char * host, char * user, char * passwd ) { char buff [ 20 + FN_REFLEN ] ; DBUG_ENTER ( "connect_to_db" ) ; verbose_msg ( "--   Connecting   to   %s...\\n", host? host : "localhost" ) ; mysql_init ( & mysql_connection ) ; if ( opt_compress ) mysql_options ( & mysql_connection, MYSQL_OPT_COMPRESS, NullS ) ; <START_BUG> # ifdef HAVE_OPENSSL <END_BUG> if ( opt_use_ssl ) { mysql_ssl_set ( & mysql_connection, opt_ssl_key, opt_ssl_cert, opt_ssl_ca, opt_ssl_capath, opt_ssl_cipher ) ; mysql_options ( & mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl ) ; mysql_options ( & mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath ) ; } mysql_options ( & mysql_connection, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, ( char * ) & opt_ssl_verify_server_cert ) ; # endif if ( opt_protocol ) mysql_options ( & mysql_connection, MYSQL_OPT_PROTOCOL, ( char * ) & opt_protocol ) ; if ( opt_bind_addr ) mysql_options ( & mysql_connection, MYSQL_OPT_BIND, opt_bind_addr ) ; # if defined ( _WIN32 ) &&! defined ( EMBEDDED_LIBRARY ) if ( shared_memory_base_name ) mysql_options ( & mysql_connection, MYSQL_SHARED_MEMORY_BASE_NAME, shared_memory_base_name ) ; # endif mysql_options ( & mysql_connection, MYSQL_SET_CHARSET_NAME, default_charset ) ; if ( opt_plugin_dir && * opt_plugin_dir ) mysql_options ( & mysql_connection, MYSQL_PLUGIN_DIR, opt_plugin_dir ) ; if ( opt_default_auth && * opt_default_auth ) mysql_options ( & mysql_connection, MYSQL_DEFAULT_AUTH, opt_default_auth ) ; mysql_options ( & mysql_connection, MYSQL_OPT_CONNECT_ATTR_RESET, 0 ) ; mysql_options

Fix:
<S2SV_ModStart> NullS ) ; SSL_SET_OPTIONS ( & mysql_connection ) ; <S2SV_ModEnd> if ( opt_protocol
Buggy code:
 struct l2tp_packet_t * l2tp_packet_alloc ( int ver, int msg_type, const struct sockaddr_in * addr, int H, const char * secret, size_t secret_len ) { struct l2tp_packet_t * pack = mempool_alloc ( pack_pool ) ; if (! pack ) return NULL ; memset ( pack, 0, sizeof ( * pack ) ) ; INIT_LIST_HEAD ( & pack -> attrs ) ; <START_BUG> pack -> hdr. ver = ver ; <END_BUG> pack -> hdr. T = 1 ; pack -> hdr. L = 1 ; pack -> hdr. S = 1 ; memcpy ( & pack -> addr, addr, sizeof ( * addr ) ) ; pack -> hide_avps = H ; pack -> secret = secret ; pack -> secret_len = secret_len ; if ( msg_type ) { if ( l2tp_packet_add_int16 ( pack, Message_Type, msg_type, 1 ) ) { mempool_free ( pack ) ; return NULL ; } } return pack ; }

Fix:
<S2SV_ModStart> -> hdr. flags = L2TP_FLAG_T | L2TP_FLAG_L | L2TP_FLAG_S | ( ver & L2TP_VER_MASK ) <S2SV_ModEnd> ; memcpy (
Buggy code:
 int obj2ast_comprehension ( PyObject * obj, comprehension_ty * out, PyArena * arena ) { PyObject * tmp = NULL ; expr_ty target ; expr_ty iter ; asdl_seq * ifs ; int is_async ; <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_target ) ) { <END_BUG> int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_target ) ;  if ( tmp == NULL ) goto failed ; <START_BUG> res = obj2ast_expr ( tmp, & target, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <END_BUG> } else {  PyErr_SetString ( PyExc_TypeError, "required   field   \\"target\\"   missing   from   comprehension" ) ; return 1 ; } <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_iter ) ) { <END_BUG> int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_iter ) ;  if ( tmp == NULL ) goto failed ; <START_BUG> res = obj2ast_expr ( tmp, & iter, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <END_BUG> } else {  PyErr_SetString ( PyExc_TypeError, "required   field   \\"iter\\"   missing   from   comprehension" ) ; return 1 ; } if ( _PyObject_HasAttrId ( obj, & PyId_ifs ) ) { int res ; Py_ssize_t len ; <START_BUG> Py_ssize_t i ; <END_BUG> tmp = _PyObject_GetAttrId ( obj, & PyId_ifs ) ; if ( tmp == NULL ) goto failed ; if (! PyList_Check ( tmp ) ) { PyErr_Format ( PyExc_TypeError, "comprehension   field   \\"ifs\\"   must   be   a   list,   not   a   %.200s", tmp -> ob_type -> tp_name ) ; goto failed ; } len = PyList_GET_SIZE ( tmp ) ; ifs = _Ta3_asdl_seq_new ( len, arena ) ; if ( ifs == NULL ) goto failed ; for ( i = 0

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_target, & tmp ) < 0 ) { return 1 ; } <S2SV_ModEnd> if ( tmp <S2SV_ModStart> == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"target\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> comprehension" ) ; return 1 ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> ) ; } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_iter, & tmp ) < 0 ) { return 1 ; } <S2SV_ModEnd> if ( tmp <S2SV_ModStart> == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"iter\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> comprehension" ) ; return 1 ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> ) ; } if ( lookup_attr_id ( obj, & PyId_ifs, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"ifs\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> comprehension" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> ; Py_ssize
Buggy code:
 static noinline int hiddev_ioctl_usage ( struct hiddev * hiddev, unsigned int cmd, void __user * user_arg ) { struct hid_device * hid = hiddev -> hid ; struct hiddev_report_info rinfo ; struct hiddev_usage_ref_multi * uref_multi = NULL ; struct hiddev_usage_ref * uref ; struct hid_report * report ; struct hid_field * field ; int i ; uref_multi = kmalloc ( sizeof ( struct hiddev_usage_ref_multi ), GFP_KERNEL ) ; if (! uref_multi ) return - ENOMEM ; uref = & uref_multi -> uref ; if ( cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES ) { if ( copy_from_user ( uref_multi, user_arg, sizeof ( * uref_multi ) ) ) goto fault ; } else { if ( copy_from_user ( uref, user_arg, sizeof ( * uref ) ) ) goto fault ; } switch ( cmd ) { case HIDIOCGUCODE : rinfo. report_type = uref -> report_type ; rinfo. report_id = uref -> report_id ; if ( ( report = hiddev_lookup_report ( hid, & rinfo ) ) == NULL ) goto inval ; if ( uref -> field_index >= report -> maxfield ) goto inval ; field = report -> field [ uref -> field_index ] ; if ( uref -> usage_index >= field -> maxusage ) goto inval ; uref -> usage_code = field -> usage [ uref -> usage_index ]. hid ; if ( copy_to_user ( user_arg, uref, sizeof ( * uref ) ) ) goto fault ; goto goodreturn ; default : if ( cmd!= HIDIOCGUSAGE && cmd!= HIDIOCGUSAGES && uref -> report_type == HID_REPORT_TYPE_INPUT ) goto inval ; if ( uref -> report_id == HID_REPORT_ID_UNKNOWN ) { field = hiddev_lookup_usage ( hid, uref ) ; if ( field == NULL ) goto inval ;

Fix:
<S2SV_ModStart> goto inval ; } <S2SV_ModEnd> if ( ( <S2SV_ModStart> goto inval ; <S2SV_ModEnd> switch ( cmd
Buggy code:
 struct ipv6_txoptions * ipv6_dup_options ( struct sock * sk, struct ipv6_txoptions * opt ) { struct ipv6_txoptions * opt2 ; opt2 = sock_kmalloc ( sk, opt -> tot_len, GFP_ATOMIC ) ; if ( opt2 ) { long dif = ( char * ) opt2 - ( char * ) opt ; memcpy ( opt2, opt, opt -> tot_len ) ; if ( opt2 -> hopopt ) * ( ( char * * ) & opt2 -> hopopt ) += dif ; if ( opt2 -> dst0opt ) * ( ( char * * ) & opt2 -> dst0opt ) += dif ; if ( opt2 -> dst1opt ) * ( ( char * * ) & opt2 -> dst1opt ) += dif ; if ( opt2 -> srcrt ) * ( ( char * * ) & opt2 -> srcrt ) += dif ; <START_BUG> } <END_BUG> return opt2 ; }

Fix:
<S2SV_ModStart> += dif ; atomic_set ( & opt2 -> refcnt, 1 ) ;
Buggy code:
 static int parse_elements ( netdissect_options * ndo, struct mgmt_body_t * pbody, const u_char * p, int offset, u_int length ) { u_int elementlen ; struct ssid_t ssid ; struct challenge_t challenge ; struct rates_t rates ; struct ds_t ds ; struct cf_t cf ; struct tim_t tim ; pbody -> challenge_present = 0 ; pbody -> ssid_present = 0 ; pbody -> rates_present = 0 ; pbody -> ds_present = 0 ; pbody -> cf_present = 0 ; pbody -> tim_present = 0 ; while ( length!= 0 ) { if (! ND_TTEST2 ( * ( p + offset ), 2 ) ) return 0 ; if ( length < 2 ) return 0 ; elementlen = * ( p + offset + 1 ) ; if (! ND_TTEST2 ( * ( p + offset + 2 ), elementlen ) ) return 0 ; if ( length < elementlen + 2 ) return 0 ; switch ( * ( p + offset ) ) { case E_SSID : memcpy ( & ssid, p + offset, 2 ) ; offset += 2 ; length -= 2 ; if ( ssid. length!= 0 ) { if ( ssid. length > sizeof ( ssid. ssid ) - 1 ) return 0 ; if (! ND_TTEST2 ( * ( p + offset ), ssid. length ) ) return 0 ; if ( length < ssid. length ) return 0 ; memcpy ( & ssid. ssid, p + offset, ssid. length ) ; offset += ssid. length ; length -= ssid. length ; } ssid. ssid [ ssid. length ] = '\\0' ; if (! pbody -> ssid_present ) { pbody -> ssid = ssid ; pbody -> ssid_present = 1 ; } break ; case E_CHALLENGE : memcpy ( & challenge, p + offset, 2 ) ; offset += 2 ; length -= 2 ; if ( challenge. length!= 0 ) { if ( challenge. length > sizeof ( challenge. text ) - 1 ) return 0 ; if (! ND_TTEST2 ( * ( p + offset ), challenge. length ) ) return 0 ; if

Fix:
<S2SV_ModStart>, p + offset + 3, <S2SV_ModEnd> tim. length <S2SV_ModStart> - 3 ) ; offset += <S2SV_ModEnd> tim. length <S2SV_ModStart> length - 3 ; length -= <S2SV_ModEnd> tim. length <S2SV_ModStart> - 3 ; <S2SV_ModEnd> if (!
Buggy code:
 BOOL nsc_process_message ( NSC_CONTEXT * context, UINT16 bpp, UINT32 width, UINT32 height, const BYTE * data, UINT32 length, BYTE * pDstData, UINT32 DstFormat, UINT32 nDstStride, UINT32 nXDst, UINT32 nYDst, UINT32 nWidth, UINT32 nHeight, UINT32 flip ) { wStream * s ; BOOL ret ; s = Stream_New ( ( BYTE * ) data, length ) ; if (! s ) return FALSE ; if ( nDstStride == 0 ) nDstStride = nWidth * GetBytesPerPixel ( DstFormat ) ; switch ( bpp ) { case 32 : context -> format = PIXEL_FORMAT_BGRA32 ; break ; case 24 : context -> format = PIXEL_FORMAT_BGR24 ; break ; case 16 : context -> format = PIXEL_FORMAT_BGR16 ; break ; case 8 : context -> format = PIXEL_FORMAT_RGB8 ; break ; case 4 : context -> format = PIXEL_FORMAT_A4 ; break ; default : Stream_Free ( s, TRUE ) ; return FALSE ; } context -> width = width ; context -> height = height ; ret = nsc_context_initialize ( context, s ) ; Stream_Free ( s, FALSE ) ; if (! ret ) return FALSE ; <START_BUG> PROFILER_ENTER ( context -> priv -> prof_nsc_rle_decompress_data ) <END_BUG>  nsc_rle_decompress_data ( context ) ; <START_BUG> PROFILER_EXIT ( context -> priv -> prof_nsc_rle_decompress_data ) <END_BUG> PROFILER_ENTER ( context -> priv -> prof_nsc_decode )  <START_BUG> context -> decode ( context ) ; <END_BUG>  PROFILER_EXIT ( context -> priv -> prof_nsc_decode ) <START_BUG> if (! freerdp_image_copy ( pDstData, DstFormat, nDstStride, nXDst, nYDst, width, height, context -> BitmapData, PIXEL_FORMAT_BGRA32, 0, 0, 0, NULL, flip ) ) return FALSE ; return TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> return FALSE ; { BOOL rc ; <S2SV_ModStart> -> prof_nsc_rle_decompress_data ) rc = <S2SV_ModStart> -> prof_nsc_rle_decompress_data ) if (! rc ) return FALSE ; } { BOOL rc ; <S2SV_ModStart> -> prof_nsc_decode ) rc = <S2SV_ModStart> -> prof_nsc_decode ) if (! rc ) return FALSE ; }
Buggy code:
 static void rpl_print ( netdissect_options * ndo, const struct icmp6_hdr * hdr, const u_char * bp, u_int length ) { int secured = hdr -> icmp6_code & 0x80 ; int basecode = hdr -> icmp6_code & 0x7f ; if ( secured ) { ND_PRINT ( ( ndo, ",   (SEC)   [worktodo]" ) ) ; return ; } else { ND_PRINT ( ( ndo, ",   (CLR)" ) ) ; } switch ( basecode ) { case ND_RPL_DAG_IS : ND_PRINT ( ( ndo, "DODAG   Information   Solicitation" ) ) ; if ( ndo -> ndo_vflag ) { } break ; case ND_RPL_DAG_IO : ND_PRINT ( ( ndo, "DODAG   Information   Object" ) ) ; if ( ndo -> ndo_vflag ) { rpl_dio_print ( ndo, bp, length ) ; } break ; case ND_RPL_DAO : ND_PRINT ( ( ndo, "Destination   Advertisement   Object" ) ) ; if ( ndo -> ndo_vflag ) { rpl_dao_print ( ndo, bp, length ) ; } break ; case ND_RPL_DAO_ACK : ND_PRINT ( ( ndo, "Destination   Advertisement   Object   Ack" ) ) ; if ( ndo -> ndo_vflag ) { rpl_daoack_print ( ndo, bp, length ) ; } break ; default : ND_PRINT ( ( ndo, "RPL   message,   unknown   code   %u", hdr -> icmp6_code ) ) ; break ; } return ; # if 0 trunc : <START_BUG> ND_PRINT ( ( ndo, "   [|truncated]" ) ) ; <END_BUG> return ; # endif }

Fix:
<S2SV_ModStart> ( ndo, "%s", rpl_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 static int sockfs_setattr ( struct dentry * dentry, struct iattr * iattr ) { int err = simple_setattr ( dentry, iattr ) ; if (! err && ( iattr -> ia_valid & ATTR_UID ) ) { struct socket * sock = SOCKET_I ( d_inode ( dentry ) ) ; <START_BUG> sock -> sk -> sk_uid = iattr -> ia_uid ; <END_BUG>  } <START_BUG> return err ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; if ( sock -> sk ) <S2SV_ModStart> -> ia_uid ; else err = - ENOENT ;
Buggy code:
 static void cliprdr_process ( STREAM s ) { uint16 type, status ; uint32 length, format ; uint8 * data ; <START_BUG> in_uint16_le ( s, type ) ; <END_BUG> in_uint16_le ( s, status ) ; in_uint32_le ( s, length ) ; data = s -> p ; logger ( Clipboard, Debug, "cliprdr_process(),   type=%d,   status=%d,   length=%d", type, status, length ) ;  if ( status == CLIPRDR_ERROR ) <START_BUG> { switch ( type ) { case CLIPRDR_FORMAT_ACK : cliprdr_send_native_format_announce ( last_formats, last_formats_length ) ; break ; case CLIPRDR_DATA_RESPONSE : ui_clip_request_failed ( ) ; break ; default : logger ( Clipboard, Warning, "cliprdr_process(),   unhandled   error   (type=%d)", type ) ; } return ; } switch ( type ) { case CLIPRDR_CONNECT : ui_clip_sync ( ) ; break ; case CLIPRDR_FORMAT_ANNOUNCE : ui_clip_format_announce ( data, length ) ; cliprdr_send_packet ( CLIPRDR_FORMAT_ACK, CLIPRDR_RESPONSE, NULL, 0 ) ; return ; case CLIPRDR_FORMAT_ACK : break ; case CLIPRDR_DATA_REQUEST : in_uint32_le ( s, format ) ; ui_clip_request_data ( format ) ; break ; case CLIPRDR_DATA_RESPONSE : ui_clip_handle_data ( data, length ) ; break ; case 7 : break ; default : logger ( Clipboard, Warning, "cliprdr_process(),   unhandled   packet   type   %d", type ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> * data ; struct stream packet = * s ; <S2SV_ModStart> ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "cliprdr_process(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> packet <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } if (
Buggy code:
 static int DecodeNumberField ( int len, char * str, int fmask, int * tmask, struct tm * tm, fsec_t * fsec, int * is2digits ) { char * cp ; if ( ( cp = strchr ( str, '.' ) )!= NULL ) { # ifdef HAVE_INT64_TIMESTAMP <START_BUG> char fstr [ MAXDATELEN + 1 ] ; <END_BUG> strcpy ( fstr, ( cp + 1 ) ) ; strcpy ( fstr + strlen ( fstr ), "000000" ) ; * ( fstr + 6 ) = '\\0' ; * fsec = strtol ( fstr, NULL, 10 ) ; # else * fsec = strtod ( cp, NULL ) ; # endif * cp = '\\0' ; len = strlen ( str ) ; } else if ( ( fmask & DTK_DATE_M )!= DTK_DATE_M ) { if ( len == 8 ) { * tmask = DTK_DATE_M ; tm -> tm_mday = atoi ( str + 6 ) ; * ( str + 6 ) = '\\0' ; tm -> tm_mon = atoi ( str + 4 ) ; * ( str + 4 ) = '\\0' ; tm -> tm_year = atoi ( str + 0 ) ; return DTK_DATE ; } else if ( len == 6 ) { * tmask = DTK_DATE_M ; tm -> tm_mday = atoi ( str + 4 ) ; * ( str + 4 ) = '\\0' ; tm -> tm_mon = atoi ( str + 2 ) ; * ( str + 2 ) = '\\0' ; tm -> tm_year = atoi ( str + 0 ) ; * is2digits = TRUE ; return DTK_DATE ; } else if ( len == 5 ) { * tmask = DTK_DATE_M ; tm -> tm_mday = atoi ( str + 2 ) ; * ( str + 2 ) = '\\0' ; tm -> tm_mon = 1 ; tm -> tm_year = atoi ( str + 0 ) ; * is2digits = TRUE ; return DTK_DATE ; } } if ( ( fmask & DTK_TIME_M )!= DTK_TIME_M ) { if ( len == 6 ) { * tmask = DTK_

Fix:
<S2SV_ModStart> char fstr [ 7 ] ; int i ; cp ++ ; for ( i = 0 ; i < 6 ; i ++ ) fstr [ i ] = * cp!= '\\0'? * cp ++ : '0' ; fstr [ i ] <S2SV_ModEnd> = '\\0' ;
Buggy code:
 void pim_print ( netdissect_options * ndo, register const u_char * bp, register u_int len, const u_char * bp2 ) { <START_BUG> register const u_char * ep ; <END_BUG>  register const struct pim * pim = ( const struct pim * ) bp ; <START_BUG> ep = ( const u_char * ) ndo -> ndo_snapend ; if ( bp >= ep ) return ; # ifdef notyet ND_TCHECK ( pim -> pim_rsv ) ; # endif <END_BUG> switch ( PIM_VER ( pim -> pim_typever ) ) {  case 2 : if (! ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, "PIMv%u,   %s,   length   %u", PIM_VER ( pim -> pim_typever ), tok2str ( pimv2_type_values, "Unknown   Type", PIM_TYPE ( pim -> pim_typever ) ), len ) ) ; return ; } else { ND_PRINT ( ( ndo, "PIMv%u,   length   %u\\n\\t%s", PIM_VER ( pim -> pim_typever ), len, tok2str ( pimv2_type_values, "Unknown   Type", PIM_TYPE ( pim -> pim_typever ) ) ) ) ; pimv2_print ( ndo, bp, len, bp2 ) ; } break ; default : ND_PRINT ( ( ndo, "PIMv%u,   length   %u", PIM_VER ( pim -> pim_typever ), len ) ) ; break ; } return ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> { register const <S2SV_ModEnd> struct pim * <S2SV_ModStart> * ) bp <S2SV_ModEnd> ; # ifdef <S2SV_ModStart> ; # endif ND_TCHECK ( pim -> pim_typever ) ; <S2SV_ModStart> } return ; trunc : ND_PRINT ( ( ndo, "[|pim]" ) ) ; return ;
Buggy code:
 static int parseuid ( const char * s, uid_t * uid ) { struct passwd * pw ; <START_BUG> const char * errstr ; <END_BUG> if ( ( pw = getpwnam ( s ) )!= NULL ) { * uid = pw -> pw_uid ; return 0 ; } # if! defined ( __linux__ ) &&! defined ( __NetBSD__ ) * uid = strtonum ( s, 0, UID_MAX, & errstr ) ;  # else <START_BUG> sscanf ( s, "%d", uid ) ; <END_BUG> # endif  if ( errstr ) return - 1 ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> * pw ; # if! defined ( __linux__ ) &&! defined ( __NetBSD__ ) <S2SV_ModStart> char * errstr = NULL ; # else int status ; # endif <S2SV_ModEnd> if ( ( <S2SV_ModStart> errstr ) ; if ( errstr ) return - 1 ; # else status = <S2SV_ModEnd> sscanf ( s <S2SV_ModStart> uid ) ; if ( status!= 1 <S2SV_ModEnd> ) return - <S2SV_ModStart> - 1 ; # endif
Buggy code:
 static int apply_cyclic_refresh_bitrate ( const VP9_COMMON * cm, const RATE_CONTROL * rc ) { <START_BUG> const float factor = 0.5 ; <END_BUG> const int number_blocks = cm -> mi_rows * cm -> mi_cols ;  if ( rc -> av_per_frame_bandwidth < factor * number_blocks || <START_BUG> number_blocks // 64 < 5 ) return 0 ; else return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> float factor = 0.25 <S2SV_ModEnd> ; const int <S2SV_ModStart> ( rc -> avg_frame_bandwidth <S2SV_ModEnd> < factor *
Buggy code:
 static void dex_parse_debug_item ( RBinFile * binfile, RBinDexObj * bin, RBinDexClass * c, int MI, int MA, int paddr, int ins_size, int insns_size, char * class_name, int regsz, int debug_info_off ) { struct r_bin_t * rbin = binfile -> rbin ; const ut8 * p4 = r_buf_get_at ( binfile -> buf, debug_info_off, NULL ) ; const ut8 * p4_end = p4 + binfile -> buf -> length - debug_info_off ; ut64 line_start ; ut64 parameters_size ; ut64 param_type_idx ; ut16 argReg = regsz - ins_size ; ut64 source_file_idx = c -> source_file ; RList * params, * debug_positions, * emitted_debug_locals = NULL ; bool keep = true ; <START_BUG> if ( argReg >= regsz ) { <END_BUG> } p4 = r_uleb128 ( p4, p4_end - p4, & line_start ) ; p4 = r_uleb128 ( p4, p4_end - p4, & parameters_size ) ; ut32 address = 0 ; ut32 line = line_start ; if (! ( debug_positions = r_list_newf ( ( RListFree ) free ) ) ) { return ; } if (! ( emitted_debug_locals = r_list_newf ( ( RListFree ) free ) ) ) { r_list_free ( debug_positions ) ; return ; } struct dex_debug_local_t debug_locals [ regsz ] ; memset ( debug_locals, 0, sizeof ( struct dex_debug_local_t ) * regsz ) ; if (! ( MA & 0x0008 ) ) { debug_locals [ argReg ]. name = "this" ; debug_locals [ argReg ]. descriptor = r_str_newf ( "%s;", class_name ) ; debug_locals [ argReg ]. startAddress = 0 ; debug_locals [ argReg ]. signature = NULL ; debug_locals [ argReg ]. live = true ; argReg ++ ; } if (! ( params = dex

Fix:
<S2SV_ModStart> if ( argReg > <S2SV_ModEnd> regsz ) { <S2SV_ModStart> regsz ) { return ;
Buggy code:
 static int bgp_attr_print ( netdissect_options * ndo, u_int atype, const u_char * pptr, u_int len ) { int i ; uint16_t af ; uint8_t safi, snpa, nhlen ; union { float f ; uint32_t i ; } bw ; int advance ; u_int tlen ; const u_char * tptr ; char buf [ MAXHOSTNAMELEN + 100 ] ; int as_size ; tptr = pptr ; tlen = len ; switch ( atype ) { case BGPTYPE_ORIGIN : if ( len!= 1 ) ND_PRINT ( ( ndo, "invalid   len" ) ) ; else { ND_TCHECK ( * tptr ) ; ND_PRINT ( ( ndo, "%s", tok2str ( bgp_origin_values, "Unknown   Origin   Typecode", tptr [ 0 ] ) ) ) ; } break ; case BGPTYPE_AS4_PATH : case BGPTYPE_AS_PATH : if ( len % 2 ) { ND_PRINT ( ( ndo, "invalid   len" ) ) ; break ; } if (! len ) { ND_PRINT ( ( ndo, "empty" ) ) ; break ; } as_size = bgp_attr_get_as_size ( ndo, atype, pptr, len ) ; while ( tptr < pptr + len ) { ND_TCHECK ( tptr [ 0 ] ) ; ND_PRINT ( ( ndo, "%s", tok2str ( bgp_as_path_segment_open_values, "?", tptr [ 0 ] ) ) ) ; ND_TCHECK ( tptr [ 1 ] ) ; for ( i = 0 ; i < tptr [ 1 ] * as_size ; i += as_size ) { ND_TCHECK2 ( tptr [ 2 + i ], as_size ) ; ND_PRINT ( ( ndo, "%s   ", as_printf ( ndo, astostr, sizeof ( astostr ), as_size == 2? EXTRACT_16BITS ( & tptr [ 2 + i ] ) : EXTRACT_32BITS ( & tptr [ 2 + i ] ) ) ) ) ; } ND_TCHECK ( t

Fix:
<S2SV_ModStart>, flags ; ND_TCHECK2 ( tptr [ 0 ], 5 ) ; <S2SV_ModStart> tlen = len <S2SV_ModEnd> ; ND_PRINT (
Buggy code:
 int sas_discover_end_dev ( struct domain_device * dev ) { int res ; res = sas_notify_lldd_dev_found ( dev ) ; if ( res ) return res ; <START_BUG> sas_discover_event ( dev -> port, DISCE_PROBE ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> return res ; <S2SV_ModEnd> return 0 ;
Buggy code:
 <START_BUG> static void nsc_encode_sse2 ( NSC_CONTEXT * context, const BYTE * data, <END_BUG> UINT32 scanline ) { nsc_encode_argb_to_aycocg_sse2 ( context, data, scanline ) ; if ( context -> ChromaSubsamplingLevel > 0 ) { nsc_encode_subsampling_sse2 ( context ) ; }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> nsc_encode_sse2 ( NSC_CONTEXT <S2SV_ModStart> ) ; } return TRUE ;
Buggy code:
 static int mp_get_count ( struct sb_uart_state * state, struct serial_icounter_struct * icnt ) { <START_BUG> struct serial_icounter_struct icount ; <END_BUG> struct sb_uart_icount cnow ; struct sb_uart_port * port = state -> port ; spin_lock_irq ( & port -> lock ) ; memcpy ( & cnow, & port -> icount, sizeof ( struct sb_uart_icount ) ) ; spin_unlock_irq ( & port -> lock ) ; icount. cts = cnow. cts ; icount. dsr = cnow. dsr ; icount. rng = cnow. rng ; icount. dcd = cnow. dcd ; icount. rx = cnow. rx ; icount. tx = cnow. tx ; icount. frame = cnow. frame ; icount. overrun = cnow. overrun ; icount. parity = cnow. parity ; icount. brk = cnow. brk ; icount. buf_overrun = cnow. buf_overrun ; return copy_to_user ( icnt, & icount, sizeof ( icount ) )? - EFAULT : 0 ; }

Fix:
<S2SV_ModStart> struct serial_icounter_struct icount = { }
Buggy code:
 int generic_permission ( struct inode * inode, int mask ) { int ret ; ret = acl_permission_check ( inode, mask ) ; if ( ret!= - EACCES ) return ret ; if ( S_ISDIR ( inode -> i_mode ) ) { <START_BUG> if ( inode_capable ( inode, CAP_DAC_OVERRIDE ) ) <END_BUG> return 0 ; if (! ( mask & MAY_WRITE ) )  if ( inode_capable ( inode, CAP_DAC_READ_SEARCH ) ) <START_BUG> return 0 ; return - EACCES ; } if (! ( mask & MAY_EXEC ) || ( inode -> i_mode & S_IXUGO ) ) <END_BUG> if ( inode_capable ( inode, CAP_DAC_OVERRIDE ) )  return 0 ; mask &= MAY_READ | MAY_WRITE | MAY_EXEC ; if ( mask == MAY_READ ) <START_BUG> if ( inode_capable ( inode, CAP_DAC_READ_SEARCH ) ) <END_BUG> return 0 ; return - EACCES ; }

Fix:
<S2SV_ModStart> { if ( capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode, <S2SV_ModStart> ) if ( capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode, <S2SV_ModStart> ) if ( capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode, <S2SV_ModStart> ) if ( capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode,
Buggy code:
 <START_BUG> static void write_sync_code ( struct vp9_write_bit_buffer * wb ) { <END_BUG>  vp9_wb_write_literal ( wb, VP9_SYNC_CODE_0, 8 ) ; <START_BUG> <END_BUG> vp9_wb_write_literal ( wb, VP9_SYNC_CODE_1, 8 ) ;  <START_BUG> vp9_wb_write_literal ( wb, VP9_SYNC_CODE_2, 8 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> write_sync_code ( struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> wb ) { vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 8 ) ; vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 8 ) ; vpx_wb_write_literal <S2SV_ModEnd> ( wb,
Buggy code:
 static int nested_vmx_check_permission ( struct kvm_vcpu * vcpu ) <START_BUG> { <END_BUG> if (! to_vmx ( vcpu ) -> nested. vmxon ) { kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 0 ; } return 1 ; }

Fix:
<S2SV_ModStart> vcpu ) { if ( vmx_get_cpl ( vcpu ) ) { kvm_queue_exception ( vcpu, UD_VECTOR ) ; return 0 ; }
Buggy code:
 static void encode_frame_internal ( VP9_COMP * cpi ) { SPEED_FEATURES * const sf = & cpi -> sf ; <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ;  xd -> mi = cm -> mi_grid_visible ; <START_BUG> xd -> mi [ 0 ] = cm -> mi ; <END_BUG> vp9_zero ( cm -> counts ) ;  <START_BUG> vp9_zero ( cpi -> coef_counts ) ; <END_BUG>  vp9_zero ( cpi -> tx_stepdown_count ) ; <START_BUG> <END_BUG> vp9_zero ( cpi -> rd_comp_pred_diff ) ;  vp9_zero ( cpi -> rd_filter_diff ) ; vp9_zero ( cpi -> rd_tx_select_diff ) ; vp9_zero ( cpi -> rd_tx_select_threshes ) ; cm -> tx_mode = select_tx_mode ( cpi ) ; cpi -> mb. e_mbd. lossless = cm -> base_qindex == 0 && cm -> y_dc_delta_q == 0 && cm -> uv_dc_delta_q == 0 && cm -> uv_ac_delta_q == 0 ; <START_BUG> switch_lossless_mode ( cpi, cpi -> mb. e_mbd. lossless ) ; <END_BUG> vp9_frame_init_quantizer ( cpi ) ; vp9_initialize_rd_consts ( cpi ) ;  vp9_initialize_me_consts ( cpi, cm -> base_qindex ) ; <START_BUG> init_encode_frame_mb_context ( cpi ) ; <END_BUG> if ( cpi -> oxcf. tuning == VP8_TUNE_SSIM )  build_activity_map ( cpi ) ; <START_BUG> cm -> prev_mi = get_prev_mi ( cm ) ; <END_BUG> if ( sf -> use_nonrd_pick_mode ) { int i ; struct macroblock_plane * const p = x -> plane ; struct macroblockd_plane * const pd = xd -> plane ;  PICK_MODE_CONTEXT * ctx = & cpi -> mb. sb64_context ; <START_BUG> for ( i =<END_BUG>

Fix:
<S2SV_ModStart> -> sf ; ThreadData * const td = & cpi -> td ; <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> -> e_mbd ; RD_COUNTS * const rdc = & cpi -> td. rd_counts ; <S2SV_ModStart> ; vp9_zero ( * td <S2SV_ModEnd> -> counts ) <S2SV_ModStart> ; vp9_zero ( rdc <S2SV_ModEnd> -> coef_counts ) <S2SV_ModStart> ; vp9_zero ( rdc -> comp_pred_diff <S2SV_ModEnd> ) ; vp9_zero <S2SV_ModStart> ; vp9_zero ( rdc -> filter_diff ) ; xd -> <S2SV_ModEnd> lossless = cm <S2SV_ModStart> == 0 ; # if CONFIG_VP9_HIGHBITDEPTH if ( cm -> use_highbitdepth ) x -> fwd_txm4x4 = xd -> lossless? vp9_highbd_fwht4x4 : vpx_highbd_fdct4x4 ; else x -> fwd_txm4x4 = xd -> lossless? vp9_fwht4x4 : vpx_fdct4x4 ; x -> highbd_itxm_add = xd -> lossless? vp9_highbd_iwht4x4_add :
Buggy code:
 static void chase_port ( struct edgeport_port * port, unsigned long timeout, int flush ) { int baud_rate ; struct tty_struct * tty = tty_port_tty_get ( & port -> port -> port ) ; struct usb_serial * serial = port -> port -> serial ; wait_queue_t wait ; <START_BUG> unsigned long flags ; <END_BUG> if (! timeout ) timeout = ( HZ * EDGE_CLOSING_WAIT ) // 100 ; spin_lock_irqsave ( & port -> ep_lock, flags ) ; init_waitqueue_entry ( & wait, current ) ; add_wait_queue ( & tty -> write_wait, & wait ) ; for ( ; ; ) { set_current_state ( TASK_INTERRUPTIBLE ) ; if ( kfifo_len ( & port -> write_fifo ) == 0 || timeout == 0 || signal_pending ( current ) || serial -> disconnected ) break ; spin_unlock_irqrestore ( & port -> ep_lock, flags ) ; timeout = schedule_timeout ( timeout ) ; spin_lock_irqsave ( & port -> ep_lock, flags ) ; } set_current_state ( TASK_RUNNING ) ; remove_wait_queue ( & tty -> write_wait, & wait ) ; if ( flush ) kfifo_reset_out ( & port -> write_fifo ) ; spin_unlock_irqrestore ( & port -> ep_lock, flags ) ; tty_kref_put ( tty ) ; timeout += jiffies ; while ( ( long ) ( jiffies - timeout ) < 0 &&! signal_pending ( current ) &&! serial -> disconnected ) { if (! tx_active ( port ) ) break ; msleep ( 10 ) ; } if ( serial -> disconnected ) return ; baud_rate = port -> baud_rate ; if ( baud_rate == 0 ) baud_rate = 50 ; msleep ( max ( 1, DIV_ROUND_UP ( 10000, baud_rate ) ) ) ; }

Fix:
<S2SV_ModStart> unsigned long flags ; if (! tty ) return
Buggy code:
 CURLcode Curl_urldecode ( struct SessionHandle * data, const char * string, size_t length, char * * ostring, size_t * olen, bool reject_ctrl ) { size_t alloc = ( length? length : strlen ( string ) ) + 1 ; char * ns = malloc ( alloc ) ; unsigned char in ; size_t strindex = 0 ; unsigned long hex ; CURLcode res ; if (! ns ) return CURLE_OUT_OF_MEMORY ; while ( -- alloc > 0 ) { in = * string ; <START_BUG> if ( ( '%' == in ) && ISXDIGIT ( string [ 1 ] ) && ISXDIGIT ( string [ 2 ] ) ) { <END_BUG> char hexstr [ 3 ] ; char * ptr ; hexstr [ 0 ] = string [ 1 ] ; hexstr [ 1 ] = string [ 2 ] ; hexstr [ 2 ] = 0 ; hex = strtoul ( hexstr, & ptr, 16 ) ; in = curlx_ultouc ( hex ) ; res = Curl_convert_from_network ( data, & in, 1 ) ; if ( res ) { free ( ns ) ; return res ; } string += 2 ; alloc -= 2 ; } if ( reject_ctrl && ( in < 0x20 ) ) { free ( ns ) ; return CURLE_URL_MALFORMAT ; } ns [ strindex ++ ] = in ; string ++ ; } ns [ strindex ] = 0 ; if ( olen ) * olen = strindex ; if ( ostring ) * ostring = ns ; return CURLE_OK ; }

Fix:
<S2SV_ModStart> in ) && ( alloc > 2 ) &&