nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void Sp_match ( js_State * J ) { js_Regexp * re ; const char * text ; int len ; const char * a, * b, * c, * e ; Resub m ; text = checkstring ( J, 0 ) ; if ( js_isregexp ( J, 1 ) ) js_copy ( J, 1 ) ; else if ( js_isundefined ( J, 1 ) ) js_newregexp ( J, "", 0 ) ; else js_newregexp ( J, js_tostring ( J, 1 ), 0 ) ; re = js_toregexp ( J, - 1 ) ; if (! ( re -> flags & JS_REGEXP_G ) ) { js_RegExp_prototype_exec ( J, re, text ) ; return ; } re -> last = 0 ; js_newarray ( J ) ; len = 0 ; a = text ; e = text + strlen ( text ) ; while ( a <= e ) { <START_BUG> if ( js_regexec ( re -> prog, a, & m, a > text? REG_NOTBOL : 0 ) ) <END_BUG> break ; b = m. sub [ 0 ]. sp ; c = m. sub [ 0 ]. ep ; js_pushlstring ( J, b, c - b ) ; js_setindex ( J, - 2, len ++ ) ; a = c ; if ( c - b == 0 ) ++ a ; } if ( len == 0 ) { js_pop ( J, 1 ) ; js_pushnull ( J ) ; } }

Fix:
<S2SV_ModStart> { if ( js_doregexec ( J, <S2SV_ModEnd> re -> prog
Buggy code:
 static int snd_ctl_elem_add ( struct snd_ctl_file * file, struct snd_ctl_elem_info * info, int replace ) { struct snd_card * card = file -> card ; struct snd_kcontrol kctl, * _kctl ; unsigned int access ; long private_size ; struct user_element * ue ; int idx, err ; if (! replace && card -> user_ctl_count >= MAX_USER_CONTROLS ) return - ENOMEM ; if ( info -> count < 1 ) return - EINVAL ; access = info -> access == 0? SNDRV_CTL_ELEM_ACCESS_READWRITE : ( info -> access & ( SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_INACTIVE | SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE ) ) ; info -> id. numid = 0 ; memset ( & kctl, 0, sizeof ( kctl ) ) ; down_write ( & card -> controls_rwsem ) ; _kctl = snd_ctl_find_id ( card, & info -> id ) ; err = 0 ; if ( _kctl ) { if ( replace ) err = snd_ctl_remove ( card, _kctl ) ; else err = - EBUSY ; } else { if ( replace ) err = - ENOENT ; } up_write ( & card -> controls_rwsem ) ; if ( err < 0 ) return err ; memcpy ( & kctl. id, & info -> id, sizeof ( info -> id ) ) ; kctl. count = info -> owner? info -> owner : 1 ; access |= SNDRV_CTL_ELEM_ACCESS_USER ; if ( info -> type == SNDRV_CTL_ELEM_TYPE_ENUMERATED ) kctl. info = snd_ctl_elem_user_enum_info ; else kctl. info = snd_ctl_elem_user_info ; if ( access & SNDRV_CTL_ELEM_ACCESS_READ ) kctl. get = snd_ctl_elem_user_get ; if ( access & SNDRV_CTL_ELEM_ACCESS_WRITE ) kctl. put = snd_ctl

Fix:
<S2SV_ModStart> ; ue -> card = card ; ue ->
Buggy code:
 tsize_t t2p_readwrite_pdf_image ( T2P * t2p, TIFF * input, TIFF * output ) { tsize_t written = 0 ; unsigned char * buffer = NULL ; unsigned char * samplebuffer = NULL ; tsize_t bufferoffset = 0 ; tsize_t samplebufferoffset = 0 ; tsize_t read = 0 ; tstrip_t i = 0 ; tstrip_t j = 0 ; tstrip_t stripcount = 0 ; tsize_t stripsize = 0 ; tsize_t sepstripcount = 0 ; tsize_t sepstripsize = 0 ; # ifdef OJPEG_SUPPORT toff_t inputoffset = 0 ; uint16 h_samp = 1 ; uint16 v_samp = 1 ; uint16 ri = 1 ; uint32 rows = 0 ; # endif # ifdef JPEG_SUPPORT unsigned char * jpt ; float * xfloatp ; uint64 * sbc ; unsigned char * stripbuffer ; tsize_t striplength = 0 ; uint32 max_striplength = 0 ; # endif if ( t2p -> t2p_error!= T2P_ERR_OK ) return ( 0 ) ; if ( t2p -> pdf_transcode == T2P_TRANSCODE_RAW ) { # ifdef CCITT_SUPPORT if ( t2p -> pdf_compression == T2P_COMPRESS_G4 ) { buffer = ( unsigned char * ) _TIFFmalloc ( t2p -> tiff_datasize ) ; if ( buffer == NULL ) { TIFFError ( TIFF2PDF_MODULE, "Can\'t   allocate   %lu   bytes   of   memory   for   " "t2p_readwrite_pdf_image,   %s", ( unsigned long ) t2p -> tiff_datasize, TIFFFileName ( input ) ) ; t2p -> t2p_error = T2P_ERR_ERROR ; return ( 0 ) ; } TIFFReadRawStrip ( input, 0, ( tdata_t ) buffer, t2p -> tiff_datasize ) ; if ( t2p -> tiff_fillorder == FILLORDER_LSB2MSB ) { TIFFReverseBits ( buffer, t2p -> tiff_datasize ) ; }

Fix:
<S2SV_ModStart>, buffer, t2p -> tiff_datasize,
Buggy code:
 static int tcp_v6_rcv ( struct sk_buff * skb ) { const struct tcphdr * th ; const struct ipv6hdr * hdr ; bool refcounted ; struct sock * sk ; int ret ; struct net * net = dev_net ( skb -> dev ) ; if ( skb -> pkt_type!= PACKET_HOST ) goto discard_it ; __TCP_INC_STATS ( net, TCP_MIB_INSEGS ) ; if (! pskb_may_pull ( skb, sizeof ( struct tcphdr ) ) ) goto discard_it ; th = ( const struct tcphdr * ) skb -> data ; if ( unlikely ( th -> doff < sizeof ( struct tcphdr ) // 4 ) ) goto bad_packet ; if (! pskb_may_pull ( skb, th -> doff * 4 ) ) goto discard_it ; if ( skb_checksum_init ( skb, IPPROTO_TCP, ip6_compute_pseudo ) ) goto csum_error ; th = ( const struct tcphdr * ) skb -> data ; hdr = ipv6_hdr ( skb ) ; lookup : sk = __inet6_lookup_skb ( & tcp_hashinfo, skb, __tcp_hdrlen ( th ), th -> source, th -> dest, inet6_iif ( skb ), & refcounted ) ; if (! sk ) goto no_tcp_socket ; process : if ( sk -> sk_state == TCP_TIME_WAIT ) goto do_time_wait ; if ( sk -> sk_state == TCP_NEW_SYN_RECV ) { struct request_sock * req = inet_reqsk ( sk ) ; struct sock * nsk ; sk = req -> rsk_listener ; tcp_v6_fill_cb ( skb, hdr, th ) ; if ( tcp_v6_inbound_md5_hash ( sk, skb ) ) { sk_drops_add ( sk, skb ) ; reqsk_put ( req ) ; goto discard_it ; } if ( unlikely ( sk -> sk_state!= TCP_LISTEN ) ) { inet_csk_reqsk_queue_drop_and_put ( sk, req ) ; goto lookup ; } sock_hold ( sk )

Fix:
<S2SV_ModStart> ; if ( tcp_filter <S2SV_ModEnd> ( sk, <S2SV_ModStart> ) goto discard_and_relse ; th = ( const struct tcphdr * ) skb -> data ; hdr = ipv6_hdr ( skb )
Buggy code:
 static void videobuf_vm_close ( struct vm_area_struct * vma ) { struct videobuf_mapping * map = vma -> vm_private_data ; struct videobuf_queue * q = map -> q ; int i ; <START_BUG> dprintk ( 2, "vm_close   %p   [count=%d,vma=%08lx-%08lx]\\n", map, <END_BUG> map -> count, vma -> vm_start, vma -> vm_end ) ; map -> count -- ; if ( 0 == map -> count ) { dprintk ( 1, "munmap   %p   q=%p\\n", map, q ) ; mutex_lock ( & q -> lock ) ; for ( i = 0 ; i < VIDEO_MAX_FRAME ; i ++ ) { if ( NULL == q -> bufs [ i ] ) continue ; if ( q -> bufs [ i ] -> map!= map ) continue ; q -> ops -> buf_release ( q, q -> bufs [ i ] ) ; q -> bufs [ i ] -> map = NULL ; q -> bufs [ i ] -> baddr = 0 ; } mutex_unlock ( & q -> lock ) ; kfree ( map ) ; } return ; }

Fix:
<S2SV_ModStart> ( 2, "vm_close <S2SV_blank> %p <S2SV_blank> [count=%u,vma=%08lx-%08lx]\\n" <S2SV_ModEnd>, map,
Buggy code:
 static int picolcd_raw_event ( struct hid_device * hdev, struct hid_report * report, u8 * raw_data, int size ) { struct picolcd_data * data = hid_get_drvdata ( hdev ) ; unsigned long flags ; int ret = 0 ; if (! data ) return 1 ; <START_BUG> if ( report -> id == REPORT_KEY_STATE ) { <END_BUG> if ( data -> input_keys ) ret = picolcd_raw_keypad ( data, report, raw_data + 1, size - 1 ) ; } else if ( report -> id == REPORT_IR_DATA ) { ret = picolcd_raw_cir ( data, report, raw_data + 1, size - 1 ) ; } else { spin_lock_irqsave ( & data -> lock, flags ) ; if ( data -> pending ) { memcpy ( data -> pending -> raw_data, raw_data + 1, size - 1 ) ; data -> pending -> raw_size = size - 1 ; data -> pending -> in_report = report ; complete ( & data -> pending -> ready ) ; } spin_unlock_irqrestore ( & data -> lock, flags ) ; } picolcd_debug_raw_event ( data, hdev, report, raw_data, size ) ; return 1 ; }

Fix:
<S2SV_ModStart> ; if ( size > 64 ) { hid_warn ( hdev, "invalid <S2SV_blank> size <S2SV_blank> value <S2SV_blank> (%d) <S2SV_blank> for <S2SV_blank> picolcd <S2SV_blank> raw <S2SV_blank> event\\n", size ) ; return 0 ; } if (
Buggy code:
 <START_BUG> int vp8_denoiser_allocate ( VP8_DENOISER * denoiser, int width, int height ) <END_BUG> { int i ;  assert ( denoiser ) ; <START_BUG> for ( i = 0 ; i < MAX_REF_FRAMES ; i ++ ) { denoiser -> yv12_running_avg [ i ]. flags = 0 ; if ( vp8_yv12_alloc_frame_buffer ( & ( denoiser -> yv12_running_avg [ i ] ), width, height, VP8BORDERINPIXELS ) < 0 ) { vp8_denoiser_free ( denoiser ) ; return 1 ; } <END_BUG> vpx_memset ( denoiser -> yv12_running_avg [ i ]. buffer_alloc, 0,  denoiser -> yv12_running_avg [ i ]. frame_size ) ; } denoiser -> yv12_mc_running_avg. flags = 0 ; if ( vp8_yv12_alloc_frame_buffer ( & ( denoiser -> yv12_mc_running_avg ), width, height, VP8BORDERINPIXELS ) < 0 ) { vp8_denoiser_free ( denoiser ) ; return 1 ; } <START_BUG> vpx_memset ( denoiser -> yv12_mc_running_avg. buffer_alloc, 0, <END_BUG> denoiser -> yv12_mc_running_avg. frame_size ) ;  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart>, int height, int num_mb_rows, int num_mb_cols, int mode <S2SV_ModStart> ( denoiser ) ; denoiser -> num_mb_cols = num_mb_cols <S2SV_ModStart> 1 ; } memset <S2SV_ModEnd> ( denoiser -> <S2SV_ModStart> 1 ; } memset <S2SV_ModEnd> ( denoiser -> <S2SV_ModStart> frame_size ) ; if ( vp8_yv12_alloc_frame_buffer ( & denoiser -> yv12_last_source, width, height, VP8BORDERINPIXELS ) < 0 ) { vp8_denoiser_free ( denoiser ) ; return 1 ; } memset ( denoiser -> yv12_last_source. buffer_alloc, 0, denoiser -> yv12_last_source. frame_size ) ; denoiser -> denoise_state = vpx_calloc ( ( num_mb_rows * num_mb_cols ), 1 ) ; memset ( denoiser -> denoise_state, 0, ( num_mb_rows * num_mb_cols ) ) ; vp8_denoiser_set_parameters ( denoiser, mode
Buggy code:
 static void Process_ipfix_template_add ( exporter_ipfix_domain_t * exporter, void * DataPtr, uint32_t size_left, FlowSource_t * fs ) { input_translation_t * translation_table ; ipfix_template_record_t * ipfix_template_record ; ipfix_template_elements_std_t * NextElement ; int i ; while ( size_left ) { uint32_t table_id, count, size_required ; uint32_t num_extensions = 0 ; <START_BUG> if ( size_left && size_left < 4 ) { <END_BUG> LogError ( "Process_ipfix   [%u]   Template   size   error   at   %s   line   %u", exporter -> info. id, __FILE__, __LINE__, strerror ( errno ) ) ; size_left = 0 ; continue ; } ipfix_template_record = ( ipfix_template_record_t * ) DataPtr ; size_left -= 4 ; table_id = ntohs ( ipfix_template_record -> TemplateID ) ; count = ntohs ( ipfix_template_record -> FieldCount ) ; dbg_printf ( "\\n[%u]   Template   ID:   %u\\n", exporter -> info. id, table_id ) ; dbg_printf ( "FieldCount:   %u   buffersize:   %u\\n", count, size_left ) ; memset ( ( void * ) cache. common_extensions, 0, ( Max_num_extensions + 1 ) * sizeof ( uint32_t ) ) ; memset ( ( void * ) cache. lookup_info, 0, 65536 * sizeof ( struct element_param_s ) ) ; for ( i = 1 ; ipfix_element_map [ i ]. id!= 0 ; i ++ ) { uint32_t Type = ipfix_element_map [ i ]. id ; if ( ipfix_element_map [ i ]. id == ipfix_element_map [ i - 1 ]. id ) continue ; cache. lookup_info [ Type ]. index = i ; } cache. input_order = calloc ( count, sizeof ( struct order_s ) ) ; if (! cache. input_order ) { LogError ( "Process_ipfix:   Panic!

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> size_left < 4
Buggy code:
 static int decode_slice_header ( H264Context * h, H264Context * h0 ) { unsigned int first_mb_in_slice ; unsigned int pps_id ; int ret ; unsigned int slice_type, tmp, i, j ; int last_pic_structure, last_pic_droppable ; int must_reinit ; int needs_reinit = 0 ; int field_pic_flag, bottom_field_flag ; h -> me. qpel_put = h -> h264qpel. put_h264_qpel_pixels_tab ; h -> me. qpel_avg = h -> h264qpel. avg_h264_qpel_pixels_tab ; first_mb_in_slice = get_ue_golomb_long ( & h -> gb ) ; if ( first_mb_in_slice == 0 ) { if ( h0 -> current_slice && FIELD_PICTURE ( h ) ) { field_end ( h, 1 ) ; } h0 -> current_slice = 0 ; if (! h0 -> first_field ) { if ( h -> cur_pic_ptr &&! h -> droppable ) { ff_thread_report_progress ( & h -> cur_pic_ptr -> tf, INT_MAX, h -> picture_structure == PICT_BOTTOM_FIELD ) ; } h -> cur_pic_ptr = NULL ; } } slice_type = get_ue_golomb_31 ( & h -> gb ) ; if ( slice_type > 9 ) { av_log ( h -> avctx, AV_LOG_ERROR, "slice   type   too   large   (%d)   at   %d   %d\\n", slice_type, h -> mb_x, h -> mb_y ) ; return AVERROR_INVALIDDATA ; } if ( slice_type > 4 ) { slice_type -= 5 ; h -> slice_type_fixed = 1 ; } else h -> slice_type_fixed = 0 ; slice_type = golomb_to_pict_type [ slice_type ] ; h -> slice_type = slice_type ; h -> slice_type_nos = slice_type & 3 ; h -> pict_type = h -> slice_type ; pps_id = get_ue_golomb ( &

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> h0 -> cur_pic_ptr <S2SV_ModStart> { if ( <S2SV_ModEnd> last_pic_structure!= PICT_FRAME <S2SV_ModStart> { if ( <S2SV_ModEnd> last_pic_structure!= PICT_FRAME
Buggy code:
 void monitor_apply_keystate ( struct monitor * pmonitor ) { struct ssh * ssh = active_state ; struct kex * kex ; int r ; debug3 ( "%s:   packet_set_state", __func__ ) ; if ( ( r = ssh_packet_set_state ( ssh, child_state ) )!= 0 ) fatal ( "%s:   packet_set_state:   %s", __func__, ssh_err ( r ) ) ; sshbuf_free ( child_state ) ; child_state = NULL ; if ( ( kex = ssh -> kex )!= NULL ) { # ifdef WITH_OPENSSL kex -> kex [ KEX_DH_GRP1_SHA1 ] = kexdh_server ; kex -> kex [ KEX_DH_GRP14_SHA1 ] = kexdh_server ; kex -> kex [ KEX_DH_GRP14_SHA256 ] = kexdh_server ; kex -> kex [ KEX_DH_GRP16_SHA512 ] = kexdh_server ; kex -> kex [ KEX_DH_GRP18_SHA512 ] = kexdh_server ; kex -> kex [ KEX_DH_GEX_SHA1 ] = kexgex_server ; kex -> kex [ KEX_DH_GEX_SHA256 ] = kexgex_server ; kex -> kex [ KEX_ECDH_SHA2 ] = kexecdh_server ; # endif kex -> kex [ KEX_C25519_SHA256 ] = kexc25519_server ; kex -> load_host_public_key = & get_hostkey_public_by_type ; kex -> load_host_private_key = & get_hostkey_private_by_type ; kex -> host_key_index = & get_hostkey_index ; kex -> sign = sshd_hostkey_sign ; } <START_BUG> if ( options. compression ) { <END_BUG> ssh_packet_set_compress_hooks ( ssh, pmonitor -> m_zlib, ( ssh_packet_comp_alloc_func * ) mm_zalloc, ( ssh_packet_comp_free_func * ) mm_zfree ) ; }

Fix:
<S2SV_ModStart> sshd_hostkey_sign ; } <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void get_nb10 ( ut8 * dbg_data, SCV_NB10_HEADER * res ) { const int nb10sz = 16 ; <START_BUG> memcpy ( res, dbg_data, nb10sz ) ; <END_BUG> res -> file_name = ( ut8 * ) strdup ( ( const char * ) dbg_data + nb10sz ) ; }

Fix:
<S2SV_ModStart> = 16 ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static struct rds_connection * __rds_conn_create ( struct net * net, __be32 laddr, __be32 faddr, struct rds_transport * trans, gfp_t gfp, int is_outgoing ) { struct rds_connection * conn, * parent = NULL ; struct hlist_head * head = rds_conn_bucket ( laddr, faddr ) ; struct rds_transport * loop_trans ; unsigned long flags ; int ret ; struct rds_transport * otrans = trans ; if (! is_outgoing && otrans -> t_type == RDS_TRANS_TCP ) goto new_conn ; rcu_read_lock ( ) ; conn = rds_conn_lookup ( net, head, laddr, faddr, trans ) ; if ( conn && conn -> c_loopback && conn -> c_trans!= & rds_loop_transport && laddr == faddr &&! is_outgoing ) { parent = conn ; conn = parent -> c_passive ; } rcu_read_unlock ( ) ; if ( conn ) goto out ; new_conn : conn = kmem_cache_zalloc ( rds_conn_slab, gfp ) ; if (! conn ) { conn = ERR_PTR ( - ENOMEM ) ; goto out ; } INIT_HLIST_NODE ( & conn -> c_hash_node ) ; conn -> c_laddr = laddr ; conn -> c_faddr = faddr ; spin_lock_init ( & conn -> c_lock ) ; conn -> c_next_tx_seq = 1 ; rds_conn_net_set ( conn, net ) ; init_waitqueue_head ( & conn -> c_waitq ) ; INIT_LIST_HEAD ( & conn -> c_send_queue ) ; INIT_LIST_HEAD ( & conn -> c_retrans ) ; ret = rds_cong_get_maps ( conn ) ; if ( ret ) { kmem_cache_free ( rds_conn_slab, conn ) ; conn = ERR_PTR ( ret ) ; goto out ; } loop_trans = rds_trans_get_preferred ( net, faddr ) ; if ( loop_trans ) { rds_trans_put ( loop_trans ) ; conn -> c_loopback = 1 ; if ( is_outgoing && trans -> t_

Fix:
<S2SV_ModStart> ; } } if ( trans == NULL ) { kmem_cache_free ( rds_conn_slab, conn ) ; conn = ERR_PTR ( - ENODEV ) ; goto out ; }
Buggy code:
 void irc_server_set_prefix_modes_chars ( struct t_irc_server * server, const char * prefix ) { char * pos ; <START_BUG> int i, length_modes, length_chars ; <END_BUG> if (! server ||! prefix )  return ; <START_BUG> if ( server -> prefix_modes ) { free ( server -> prefix_modes ) ; server -> prefix_modes = NULL ; } if ( server -> prefix_chars ) { free ( server -> prefix_chars ) ; server -> prefix_chars = NULL ; } pos = strchr ( prefix, ')' ) ; if ( pos ) { server -> prefix_modes = weechat_strndup ( prefix + 1, pos - prefix - 1 ) ; if ( server -> prefix_modes ) { pos ++ ; length_modes = strlen ( server -> prefix_modes ) ; length_chars = strlen ( pos ) ; server -> prefix_chars = malloc ( length_modes + 1 ) ; if ( server -> prefix_chars ) { for ( i = 0 ; i < length_modes ; i ++ ) { server -> prefix_chars [ i ] = ( i < length_chars )? pos [ i ] :' '; } server -> prefix_chars [ length_modes ] = '\\0' ; } else { free ( server -> prefix_modes ) ; server -> prefix_modes = NULL ; } } } <END_BUG> } 

Fix:
<S2SV_ModStart> int i, old_length_chars, <S2SV_ModStart> prefix ) return ; old_length_chars = ( server -> prefix_chars )? strlen ( server -> prefix_chars ) : 0 <S2SV_ModStart> } } } length_chars = ( server -> prefix_chars )? strlen ( server -> prefix_chars ) : 0 ; if ( server -> prefix_chars && ( length_chars!= old_length_chars ) ) irc_nick_realloc_prefixes ( server, old_length_chars, length_chars ) ;
Buggy code:
 static int _nfs4_do_open_reclaim ( struct nfs_open_context * ctx, struct nfs4_state * state ) { struct nfs_delegation * delegation ; struct nfs4_opendata * opendata ; <START_BUG> int delegation_type = 0 ; <END_BUG> int status ; opendata = nfs4_open_recoverdata_alloc ( ctx, state ) ; if ( IS_ERR ( opendata ) ) return PTR_ERR ( opendata ) ; opendata -> o_arg. claim = NFS4_OPEN_CLAIM_PREVIOUS ; opendata -> o_arg. fh = NFS_FH ( state -> inode ) ; rcu_read_lock ( ) ; delegation = rcu_dereference ( NFS_I ( state -> inode ) -> delegation ) ; if ( delegation!= NULL && test_bit ( NFS_DELEGATION_NEED_RECLAIM, & delegation -> flags )!= 0 ) delegation_type = delegation -> type ; rcu_read_unlock ( ) ; opendata -> o_arg. u. delegation_type = delegation_type ; status = nfs4_open_recover ( opendata, state ) ; nfs4_opendata_put ( opendata ) ; return status ; }

Fix:
<S2SV_ModStart> * opendata ; fmode_t <S2SV_ModEnd> delegation_type = 0
Buggy code:
 void nfsreq_print_noaddr ( netdissect_options * ndo, register const u_char * bp, u_int length, register const u_char * bp2 ) { register const struct sunrpc_msg * rp ; register const uint32_t * dp ; nfs_type type ; int v3 ; uint32_t proc ; uint32_t access_flags ; struct nfsv3_sattr sa3 ; ND_PRINT ( ( ndo, "%d", length ) ) ; nfserr = 0 ; rp = ( const struct sunrpc_msg * ) bp ; if (! xid_map_enter ( ndo, rp, bp2 ) ) goto trunc ; v3 = ( EXTRACT_32BITS ( & rp -> rm_call. cb_vers ) == NFS_VER3 ) ; proc = EXTRACT_32BITS ( & rp -> rm_call. cb_proc ) ; if (! v3 && proc < NFS_NPROCS ) proc = nfsv3_procid [ proc ] ; ND_PRINT ( ( ndo, "   %s", tok2str ( nfsproc_str, "proc-%u", proc ) ) ) ; switch ( proc ) { case NFSPROC_GETATTR : case NFSPROC_SETATTR : case NFSPROC_READLINK : case NFSPROC_FSSTAT : case NFSPROC_FSINFO : case NFSPROC_PATHCONF : if ( ( dp = parsereq ( ndo, rp, length ) )!= NULL && parsefh ( ndo, dp, v3 )!= NULL ) return ; break ; case NFSPROC_LOOKUP : case NFSPROC_CREATE : case NFSPROC_MKDIR : case NFSPROC_REMOVE : case NFSPROC_RMDIR : if ( ( dp = parsereq ( ndo, rp, length ) )!= NULL && parsefhn ( ndo, dp, v3 )!= NULL ) return ; break ; case NFSPROC_ACCESS : if ( ( dp = parsereq ( ndo, rp, length ) )!= NULL && ( dp = parsefh ( ndo, dp, v3 ) )!= NULL ) { ND_TCHECK (

Fix:
<S2SV_ModStart> ( dp [ 4 <S2SV_ModEnd> ] ) ; <S2SV_ModStart> ndo_vflag ) { ND_PRINT ( ( ndo, " <S2SV_blank> <%s>", tok2str ( nfsv3_writemodes, NULL, EXTRACT_32BITS ( & dp [ 3 ] <S2SV_ModEnd> ) ) )
Buggy code:
 struct dst_entry * fib6_rule_lookup ( struct net * net, struct flowi6 * fl6, const struct sk_buff * skb, int flags, pol_lookup_t lookup ) { struct rt6_info * rt ; rt = lookup ( net, net -> ipv6. fib6_main_tbl, fl6, skb, flags ) ; if ( rt -> dst. error == - EAGAIN ) { ip6_rt_put_flags ( rt, flags ) ; rt = net -> ipv6. ip6_null_entry ; <START_BUG> if (! ( flags | RT6_LOOKUP_F_DST_NOREF ) ) <END_BUG> dst_hold ( & rt -> dst ) ; } return & rt -> dst ; }

Fix:
<S2SV_ModStart>! ( flags & <S2SV_ModEnd> RT6_LOOKUP_F_DST_NOREF ) )
Buggy code:
 static gssize find_auth_end ( FlatpakProxyClient * client, Buffer * buffer ) { <START_BUG> guchar * match ; <END_BUG> int i ; if ( client -> auth_end_offset > 0 ) { gsize left = strlen ( AUTH_END_STRING ) - client -> auth_end_offset ;  gsize to_match = MIN ( left, buffer -> pos ) ; <START_BUG> <END_BUG> if ( memcmp ( buffer -> data, & AUTH_END_STRING [ client -> auth_end_offset ], to_match ) == 0 )  { client -> auth_end_offset += to_match ; if ( client -> auth_end_offset == strlen ( AUTH_END_STRING ) ) return to_match ; return - 1 ; } client -> auth_end_offset = - 1 ; } match = memmem ( buffer, buffer -> pos, AUTH_END_STRING, strlen ( AUTH_END_STRING ) ) ; if ( match!= NULL ) <START_BUG> return match - buffer -> data + strlen ( AUTH_END_STRING ) ; <END_BUG> for ( i = MIN ( strlen ( AUTH_END_STRING ) - 1, buffer -> pos ) ; i > 0 ; i -- ) { if ( memcmp ( buffer -> data + buffer -> pos - i, AUTH_END_STRING, i ) == 0 ) { client -> auth_end_offset = i ; break ; } } return - 1 ; }

Fix:
<S2SV_ModStart> buffer ) { goffset offset = 0 ; gsize original_size = client -> auth_buffer -> len ; g_byte_array_append ( client -> auth_buffer <S2SV_ModEnd>, buffer -> <S2SV_ModStart>, buffer -> data, buffer -> <S2SV_ModStart> pos ) ; while ( TRUE ) { guint8 * line_start = client -> auth_buffer <S2SV_ModEnd> -> data + <S2SV_ModStart> -> data + offset ; gsize remaining_data = client -> auth_buffer -> len - offset ; guint8 * line_end ; line_end = memmem ( line_start, remaining_data, AUTH_LINE_SENTINEL, strlen ( AUTH_LINE_SENTINEL ) ) ; if ( line_end ) { offset = ( line_end + strlen ( AUTH_LINE_SENTINEL ) - line_start ) ; if (! auth_line_is_valid ( line_start, line_end ) ) return FIND_AUTH_END_ABORT ; * line_end = 0 ; if ( auth_line_is_begin ( line_start ) ) return offset - original_size ; } else { g_byte_array_remove_range ( client -> auth_buffer, 0, offset ) ; if
Buggy code:
 static int __ip6_append_data ( struct sock * sk, struct flowi6 * fl6, struct sk_buff_head * queue, struct inet_cork * cork, struct inet6_cork * v6_cork, struct page_frag * pfrag, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int transhdrlen, unsigned int flags, struct ipcm6_cookie * ipc6, const struct sockcm_cookie * sockc ) { struct sk_buff * skb, * skb_prev = NULL ; unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu ; int exthdrlen = 0 ; int dst_exthdrlen = 0 ; int hh_len ; int copy ; int err ; int offset = 0 ; __u8 tx_flags = 0 ; u32 tskey = 0 ; struct rt6_info * rt = ( struct rt6_info * ) cork -> dst ; struct ipv6_txoptions * opt = v6_cork -> opt ; int csummode = CHECKSUM_NONE ; unsigned int maxnonfragsize, headersize ; skb = skb_peek_tail ( queue ) ; if (! skb ) { exthdrlen = opt? opt -> opt_flen : 0 ; dst_exthdrlen = rt -> dst. header_len - rt -> rt6i_nfheader_len ; } mtu = cork -> fragsize ; orig_mtu = mtu ; hh_len = LL_RESERVED_SPACE ( rt -> dst. dev ) ; fragheaderlen = sizeof ( struct ipv6hdr ) + rt -> rt6i_nfheader_len + ( opt? opt -> opt_nflen : 0 ) ; maxfraglen = ( ( mtu - fragheaderlen ) & ~ 7 ) + fragheaderlen - sizeof ( struct frag_hdr ) ; headersize = sizeof ( struct ipv6hdr ) + ( opt? opt -> opt_flen + opt -> opt_nflen : 0 ) + ( dst_allfrag ( & rt -> dst )? sizeof ( struct frag_hdr ) : 0 ) + rt -> rt6i_nfheader_

Fix:
<S2SV_ModStart> frag_hdr ) ; copy = datalen - transhdrlen - fraggap ; if ( copy < 0 ) { err = - EINVAL ; goto error ; } <S2SV_ModStart> ) ; } if ( copy > 0 && getfrag ( from, data + transhdrlen <S2SV_ModEnd>, offset,
Buggy code:
 fm_mgr_config_errno_t fm_mgr_config_mgr_connect ( fm_config_conx_hdl * hdl, fm_mgr_type_t mgr ) { char s_path [ 256 ] ; char c_path [ 256 ] ; char * mgr_prefix ; p_hsm_com_client_hdl_t * mgr_hdl ; <START_BUG> pid_t pid ; <END_BUG> memset ( s_path, 0, sizeof ( s_path ) ) ;  memset ( c_path, 0, sizeof ( c_path ) ) ; <START_BUG> pid = getpid ( ) ; switch ( mgr ) { case FM_MGR_SM : mgr_prefix = HSM_FM_SCK_SM ; mgr_hdl = & hdl -> sm_hdl ; break ; case FM_MGR_PM : mgr_prefix = HSM_FM_SCK_PM ; mgr_hdl = & hdl -> pm_hdl ; break ; case FM_MGR_FE : mgr_prefix = HSM_FM_SCK_FE ; mgr_hdl = & hdl -> fe_hdl ; break ; default : return FM_CONF_INIT_ERR ; } sprintf ( s_path, "%s%s%d", HSM_FM_SCK_PREFIX, mgr_prefix, hdl -> instance ) ; <END_BUG> sprintf ( c_path, "%s%s%d_C_%lu", HSM_FM_SCK_PREFIX, mgr_prefix,  <START_BUG> hdl -> instance, ( long unsigned ) pid ) ; <END_BUG> if ( * mgr_hdl == NULL ) { if ( hcom_client_init ( mgr_hdl, s_path, c_path, 32768 )!= HSM_COM_OK ) { return FM_CONF_INIT_ERR ; } } if ( hcom_client_connect ( * mgr_hdl ) == HSM_COM_OK ) { hdl -> conx_mask |= mgr ; return FM_CONF_OK ; } return FM_CONF_CONX_ERR ; }

Fix:
<S2SV_ModStart> * mgr_hdl ; <S2SV_ModEnd> memset ( s_path <S2SV_ModStart> ( c_path ) <S2SV_ModEnd> ) ; switch <S2SV_ModStart> ( c_path, "%s%s%d_C_XXXXXX" <S2SV_ModEnd>, HSM_FM_SCK_PREFIX, <S2SV_ModStart> hdl -> instance <S2SV_ModEnd> ) ; if
Buggy code:
 int ext2_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int name_index ; void * value = NULL ; size_t size = 0 ; int error ; switch ( type ) { case ACL_TYPE_ACCESS : name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> error = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG> if ( error < 0 ) return error ; else { inode -> i_ctime = CURRENT_TIME_SEC ; mark_inode_dirty ( inode ) ;  if ( error == 0 ) <START_BUG> acl = NULL ; } } break ; case ACL_TYPE_DEFAULT : name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT ; if (! S_ISDIR ( inode -> i_mode ) ) return acl? - EACCES : 0 ; break ; default : return - EINVAL ; } if ( acl ) { value = ext2_acl_to_disk ( acl, & size ) ; if ( IS_ERR ( value ) ) return ( int ) PTR_ERR ( value ) ; } error = ext2_xattr_set ( inode, name_index, "", value, size, 0 ) ; kfree ( value ) ; if (! error ) set_cached_acl ( inode, type, acl ) ; return error ; }<END_BUG>

Fix:
<S2SV_ModStart> { error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl ) ; if ( error ) return error ; <S2SV_ModEnd> inode -> i_ctime <S2SV_ModStart> inode ) ; <S2SV_ModEnd> } break ;
Buggy code:
 PHPAPI int php_var_unserialize ( UNSERIALIZE_PARAMETER ) { const unsigned char * cursor, * limit, * marker, * start ; zval * * rval_ref ; limit = max ; cursor = * p ; if ( YYCURSOR >= YYLIMIT ) { return 0 ; } if ( var_hash && cursor [ 0 ]!= 'R' ) { var_push ( var_hash, rval ) ; } start = cursor ; <START_BUG> # line 495 "ext//standard//var_unserializer.c" <END_BUG> { YYCTYPE yych ; static const unsigned char yybm [ ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128, 128, 128, 128, 128, 128, 128, 128, 128, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,

Fix:
<S2SV_ModStart> ; # line 496 <S2SV_ModEnd> "ext//standard//var_unserializer.c" { YYCTYPE <S2SV_ModStart> : # line 861 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { return <S2SV_ModStart> } # line 558 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy4 : <S2SV_ModStart> ; # line 855 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { php_error_docref <S2SV_ModStart> } # line 607 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy16 : <S2SV_ModStart> ; # line 708 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { size_t <S2SV_ModStart> } # line 785 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy25 : <S2SV_ModStart> ; # line 699 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { if <S2SV_ModStart> } # line 819 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy32 : <S2SV_ModStart> ; # line 678 <S2SV_ModEnd> "ext//standard//var_unserializer.re" { long <S2SV_ModStart> } # line 861 <S2SV_ModEnd> "ext//standard//var_unserializer.c" yy39 : <S2SV_ModStart> ; # line 643 <S2SV_ModEnd> "ext
Buggy code:
 static void ecryptfs_decode_from_filename ( unsigned char * dst, size_t * dst_size, const unsigned char * src, size_t src_size ) { u8 current_bit_offset = 0 ; size_t src_byte_offset = 0 ; size_t dst_byte_offset = 0 ; if ( dst == NULL ) { ( * dst_size ) = ecryptfs_max_decoded_size ( src_size ) ; goto out ; } while ( src_byte_offset < src_size ) { unsigned char src_byte = filename_rev_map [ ( int ) src [ src_byte_offset ] ] ; switch ( current_bit_offset ) { case 0 : dst [ dst_byte_offset ] = ( src_byte << 2 ) ; current_bit_offset = 6 ; break ; case 6 : dst [ dst_byte_offset ++ ] |= ( src_byte >> 4 ) ; dst [ dst_byte_offset ] = ( ( src_byte & 0xF ) << 4 ) ; current_bit_offset = 4 ; break ; case 4 : dst [ dst_byte_offset ++ ] |= ( src_byte >> 2 ) ; dst [ dst_byte_offset ] = ( src_byte << 6 ) ; current_bit_offset = 2 ; break ; case 2 : dst [ dst_byte_offset ++ ] |= ( src_byte ) ; <START_BUG> dst [ dst_byte_offset ] = 0 ; <END_BUG> current_bit_offset = 0 ; break ; } src_byte_offset ++ ; } ( * dst_size ) = dst_byte_offset ; out : return ; }

Fix:
<S2SV_ModStart> src_byte ) ; <S2SV_ModEnd> current_bit_offset = 0
Buggy code:
 static __net_init int setup_net ( struct net * net, struct user_namespace * user_ns ) { const struct pernet_operations * ops, * saved_ops ; int error = 0 ; LIST_HEAD ( net_exit_list ) ; refcount_set ( & net -> count, 1 ) ; refcount_set ( & net -> passive, 1 ) ; <START_BUG> net -> dev_base_seq = 1 ; <END_BUG> net -> user_ns = user_ns ; idr_init ( & net -> netns_ids ) ; spin_lock_init ( & net -> nsid_lock ) ; mutex_init ( & net -> ipv4. ra_mutex ) ; list_for_each_entry ( ops, & pernet_list, list ) { error = ops_init ( ops, net ) ; if ( error < 0 ) goto out_undo ; } down_write ( & net_rwsem ) ; list_add_tail_rcu ( & net -> list, & net_namespace_list ) ; up_write ( & net_rwsem ) ; out : return error ; out_undo : list_add ( & net -> exit_list, & net_exit_list ) ; saved_ops = ops ; list_for_each_entry_continue_reverse ( ops, & pernet_list, list ) ops_exit_list ( ops, & net_exit_list ) ; ops = saved_ops ; list_for_each_entry_continue_reverse ( ops, & pernet_list, list ) ops_free_list ( ops, & net_exit_list ) ; rcu_barrier ( ) ; goto out ; }

Fix:
<S2SV_ModStart> 1 ) ; get_random_bytes ( & net -> hash_mix, sizeof ( u32 ) ) ;
Buggy code:
 char * gf_text_get_utf8_line ( char * szLine, u32 lineSize, FILE * txt_in, s32 unicode_type ) { u32 i, j, len ; char * sOK ; char szLineConv [ 1024 ] ; unsigned short * sptr ; memset ( szLine, 0, sizeof ( char ) * lineSize ) ; sOK = fgets ( szLine, lineSize, txt_in ) ; if (! sOK ) return NULL ; if ( unicode_type <= 1 ) { j = 0 ; len = ( u32 ) strlen ( szLine ) ; for ( i = 0 ; i < len ; i ++ ) { if (! unicode_type && ( szLine [ i ] & 0x80 ) ) { if ( ( szLine [ i + 1 ] & 0xc0 )!= 0x80 ) { szLineConv [ j ] = 0xc0 | ( ( szLine [ i ] >> 6 ) & 0x3 ) ; j ++ ; szLine [ i ] &= 0xbf ; } else if ( ( szLine [ i ] & 0xe0 ) == 0xc0 ) { szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else if ( ( szLine [ i ] & 0xf0 ) == 0xe0 ) { szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else if ( ( szLine [ i ] & 0xf8 ) == 0xf0 ) { szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; szLineConv [ j ] = szLine [ i ] ; i ++ ; j ++ ; } else { i += 1 ; continue ; } } szLineConv [ j ] = szLine [ i ] ; j ++ ; } szLineConv [ j ] = 0 ; strcpy ( szLine, szLineConv ) ; return sOK ; } # ifdef GPAC_BIG_ENDIAN if ( unicode_type == 3 ) { # else if ( unicode_type == 2 ) { # endif i = 0 ; while ( 1 ) { char c ; if (! szLine [

Fix:
<S2SV_ModStart> sptr ) ; if ( i >= ( u32 ) ARRAY_LENGTH ( szLineConv ) ) return NULL ;
Buggy code:
 static unsigned long ioapic_read_indirect ( struct kvm_ioapic * ioapic, unsigned long addr, unsigned long length ) { unsigned long result = 0 ; switch ( ioapic -> ioregsel ) { case IOAPIC_REG_VERSION : result = ( ( ( ( IOAPIC_NUM_PINS - 1 ) & 0xff ) << 16 ) | ( IOAPIC_VERSION_ID & 0xff ) ) ; break ; case IOAPIC_REG_APIC_ID : case IOAPIC_REG_ARB_ID : result = ( ( ioapic -> id & 0xf ) << 24 ) ; break ; default : { u32 redir_index = ( ioapic -> ioregsel - 0x10 ) >> 1 ; u64 redir_content ; <START_BUG> ASSERT ( redir_index < IOAPIC_NUM_PINS ) ; <END_BUG>  redir_content = ioapic -> redirtbl [ redir_index ]. bits ; <START_BUG> result = ( ioapic -> ioregsel & 0x1 )? ( redir_content >> 32 ) & 0xffffffff : redir_content & 0xffffffff ; break ; } } return result ; }<END_BUG>

Fix:
<S2SV_ModStart> u64 redir_content ; if <S2SV_ModEnd> ( redir_index < <S2SV_ModStart> < IOAPIC_NUM_PINS ) <S2SV_ModEnd> redir_content = ioapic <S2SV_ModStart> ]. bits ; else redir_content = ~ 0ULL
Buggy code:
 static long snd_timer_user_ioctl ( struct file * file, unsigned int cmd, unsigned long arg ) { <START_BUG> struct snd_timer_user * tu ; <END_BUG> void __user * argp = ( void __user * ) arg ; int __user * p = argp ; tu = file -> private_data ;  switch ( cmd ) { <START_BUG> case SNDRV_TIMER_IOCTL_PVERSION : return put_user ( SNDRV_TIMER_VERSION, p )? - EFAULT : 0 ; case SNDRV_TIMER_IOCTL_NEXT_DEVICE : return snd_timer_user_next_device ( argp ) ; case SNDRV_TIMER_IOCTL_TREAD : { int xarg ; <END_BUG> mutex_lock ( & tu -> tread_sem ) ;  if ( tu -> timeri ) { mutex_unlock ( & tu -> tread_sem ) ; return - EBUSY ; } if ( get_user ( xarg, p ) ) { mutex_unlock ( & tu -> tread_sem ) ; return - EFAULT ; } tu -> tread = xarg? 1 : 0 ; <START_BUG> mutex_unlock ( & tu -> tread_sem ) ; <END_BUG>  return 0 ; <START_BUG> } case SNDRV_TIMER_IOCTL_GINFO : return snd_timer_user_ginfo ( file, argp ) ; case SNDRV_TIMER_IOCTL_GPARAMS : return snd_timer_user_gparams ( file, argp ) ; case SNDRV_TIMER_IOCTL_GSTATUS : return snd_timer_user_gstatus ( file, argp ) ; case SNDRV_TIMER_IOCTL_SELECT : return snd_timer_user_tselect ( file, argp ) ; case SNDRV_TIMER_IOCTL_INFO : return snd_timer_user_info ( file, argp ) ; case SNDRV_TIMER_IOCTL_PARAMS : return snd_timer_user_params ( file, argp ) ; case SNDRV_TIMER_IOCTL_STATUS : return snd_timer_user_status ( file, argp ) ; case SNDRV_TIMER_IOCTL<END_BUG>

Fix:
<S2SV_ModStart> snd_timer_user * tu <S2SV_ModEnd> = file -> <S2SV_ModStart> -> private_data ; long ret <S2SV_ModEnd> ; mutex_lock ( <S2SV_ModStart> & tu -> ioctl_lock ) ; ret = __snd_timer_user_ioctl ( file, cmd, arg ) <S2SV_ModEnd> ; mutex_unlock ( <S2SV_ModStart> & tu -> ioctl_lock <S2SV_ModEnd> ) ; return <S2SV_ModStart> ) ; return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 stmt_ty <START_BUG> Assign ( asdl_seq * targets, expr_ty value, int lineno, int col_offset, int <END_BUG> end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; if (! value ) { PyErr_SetString ( PyExc_ValueError, "field   value   is   required   for   Assign" ) ; return NULL ; } p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = Assign_kind ; p -> v. Assign. targets = targets ; p -> v. Assign. value = value ;  p -> lineno = lineno ; <START_BUG> p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> expr_ty value, string type_comment, <S2SV_ModStart> ; p -> v. Assign. type_comment = type_comment ; p ->
Buggy code:
 int my_redel ( const char * org_name, const char * tmp_name, time_t backup_time_stamp, myf MyFlags ) { int error = 1 ; DBUG_ENTER ( "my_redel" ) ; DBUG_PRINT ( "my", ( "org_name:   \'%s\'   tmp_name:   \'%s\'     MyFlags:   %d", org_name, tmp_name, MyFlags ) ) ; <START_BUG> if ( my_copystat ( org_name, tmp_name, MyFlags ) < 0 ) <END_BUG> goto end ; if ( MyFlags & MY_REDEL_MAKE_BACKUP ) { char name_buff [ FN_REFLEN + MY_BACKUP_NAME_EXTRA_LENGTH ] ; my_create_backup_name ( name_buff, org_name, backup_time_stamp ) ; if ( my_rename ( org_name, name_buff, MyFlags ) ) goto end ; } else if ( my_delete ( org_name, MyFlags ) ) goto end ; if ( my_rename ( tmp_name, org_name, MyFlags ) ) goto end ; error = 0 ; end : DBUG_RETURN ( error ) ; }

Fix:
<S2SV_ModStart> ; if (! my_disable_copystat_in_redel &&
Buggy code:
 static int jas_iccgetuint64 ( jas_stream_t * in, jas_iccuint64_t * val ) { <START_BUG> ulonglong tmp ; <END_BUG> if ( jas_iccgetuint ( in, 8, & tmp ) ) return - 1 ; * val = tmp ; return 0 ; }

Fix:
<S2SV_ModStart> val ) { jas_ulonglong <S2SV_ModEnd> tmp ; if
Buggy code:
 static void sas_init_port ( struct asd_sas_port * port, struct sas_ha_struct * sas_ha, int i ) { memset ( port, 0, sizeof ( * port ) ) ; port -> id = i ; INIT_LIST_HEAD ( & port -> dev_list ) ; INIT_LIST_HEAD ( & port -> disco_list ) ; INIT_LIST_HEAD ( & port -> destroy_list ) ; <START_BUG> spin_lock_init ( & port -> phy_list_lock ) ; <END_BUG> INIT_LIST_HEAD ( & port -> phy_list ) ; port -> ha = sas_ha ; spin_lock_init ( & port -> dev_list_lock ) ; }

Fix:
<S2SV_ModStart> destroy_list ) ; INIT_LIST_HEAD ( & port -> sas_port_del_list ) ;
Buggy code:
 static void <START_BUG> l2tp_bearer_cap_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint32_t * ptr = ( const uint32_t * ) dat ; <START_BUG> if ( EXTRACT_32BITS ( ptr ) & L2TP_BEARER_CAP_ANALOG_MASK ) { ND_PRINT ( ( ndo, "A" ) ) ; } if ( EXTRACT_32BITS ( ptr ) & L2TP_BEARER_CAP_DIGITAL_MASK ) { ND_PRINT ( ( ndo, "D" ) ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 char * suhosin_encrypt_single_cookie ( char * name, int name_len, char * value, int value_len, char * key TSRMLS_DC ) { <START_BUG> char buffer [ 4096 ] ; <END_BUG> char buffer2 [ 4096 ] ; char * buf = buffer, * buf2 = buffer2, * d, * d_url ; int l ;  if ( name_len > sizeof ( buffer ) - 2 ) { <START_BUG> buf = estrndup ( name, name_len ) ; <END_BUG> } else {  memcpy ( buf, name, name_len ) ; buf [ name_len ] = 0 ; } name_len = php_url_decode ( buf, name_len ) ; normalize_varname ( buf ) ; name_len = strlen ( buf ) ; if ( SUHOSIN_G ( cookie_plainlist ) ) { if ( zend_hash_exists ( SUHOSIN_G ( cookie_plainlist ), buf, name_len + 1 ) ) { encrypt_return_plain : <START_BUG> if ( buf!= buffer ) { <END_BUG> efree ( buf ) ; } return estrndup ( value, value_len ) ; } } else if ( SUHOSIN_G ( cookie_cryptlist ) ) { if (! zend_hash_exists ( SUHOSIN_G ( cookie_cryptlist ), buf, name_len + 1 ) ) { goto encrypt_return_plain ; } }  if ( strlen ( value ) <= sizeof ( buffer2 ) - 2 ) { <START_BUG> memcpy ( buf2, value, value_len ) ; buf2 [ value_len ] = 0 ; } else { buf2 = estrndup ( value, value_len ) ; } value_len = php_url_decode ( buf2, value_len ) ; d = suhosin_encrypt_string ( buf2, value_len, buf, name_len, key TSRMLS_CC ) ; d_url = php_url_encode ( d, strlen ( d ), & l ) ; efree ( d ) ; <END_BUG> if ( buf!= buffer ) {  efree ( buf ) ; } if ( buf2!= buffer2 ) { efree ( buf2 ) ; } return d_url ; }

Fix:
<S2SV_ModStart> ) { char * buf, * buf2 <S2SV_ModEnd>, * d <S2SV_ModStart> int l ; <S2SV_ModEnd> buf = estrndup <S2SV_ModStart> name_len ) ; <S2SV_ModEnd> name_len = php_url_decode <S2SV_ModStart> { encrypt_return_plain : efree ( buf ) ; <S2SV_ModEnd> return estrndup ( <S2SV_ModStart> ; } } buf2 = estrndup ( value, value_len ) ; <S2SV_ModEnd> value_len = php_url_decode <S2SV_ModStart> d ) ; efree ( buf ) ; efree ( buf2 ) ; <S2SV_ModEnd> return d_url ;
Buggy code:
 int expand_downwards ( struct vm_area_struct * vma, unsigned long address ) { struct mm_struct * mm = vma -> vm_mm ; struct vm_area_struct * prev ; <START_BUG> int error ; <END_BUG> address &= PAGE_MASK ;  error = security_mmap_addr ( address ) ; <START_BUG> if ( error ) return error ; prev = vma -> vm_prev ; if ( prev &&! ( prev -> vm_flags & VM_GROWSDOWN ) && ( prev -> vm_flags & ( VM_WRITE | VM_READ | VM_EXEC ) ) ) { if ( address - prev -> vm_end < stack_guard_gap ) return - ENOMEM ; } if ( unlikely ( anon_vma_prepare ( vma ) ) ) return - ENOMEM ; anon_vma_lock_write ( vma -> anon_vma ) ; if ( address < vma -> vm_start ) { unsigned long size, grow ; size = vma -> vm_end - address ; grow = ( vma -> vm_start - address ) >> PAGE_SHIFT ; error = - ENOMEM ; if ( grow <= vma -> vm_pgoff ) { error = acct_stack_growth ( vma, size, grow ) ; if (! error ) { spin_lock ( & mm -> page_table_lock ) ; if ( vma -> vm_flags & VM_LOCKED ) mm -> locked_vm += grow ; vm_stat_account ( mm, vma -> vm_flags, grow ) ; anon_vma_interval_tree_pre_update_vma ( vma ) ; vma -> vm_start = address ; vma -> vm_pgoff -= grow ; anon_vma_interval_tree_post_update_vma ( vma ) ; vma_gap_update ( vma ) ; spin_unlock ( & mm -> page_table_lock ) ; perf_event_mmap ( vma ) ; } } } anon_vma_unlock_write ( vma -> anon_vma ) ; khugepaged_enter_vma_merge ( vma, vma -> vm_flags ) ; validate_mm ( mm ) ; return error ; }<END_BUG>

Fix:
<S2SV_ModStart> ; int error = 0 <S2SV_ModStart> &= PAGE_MASK ; if ( address < mmap_min_addr ) return - EPERM <S2SV_ModEnd> ; prev =
Buggy code:
 static int check_stack_boundary ( struct bpf_verifier_env * env, int regno, int access_size, bool zero_size_allowed, struct bpf_call_arg_meta * meta ) { struct bpf_verifier_state * state = env -> cur_state ; struct bpf_reg_state * regs = state -> regs ; int off, i, slot, spi ; if ( regs [ regno ]. type!= PTR_TO_STACK ) { if ( zero_size_allowed && access_size == 0 && register_is_null ( regs [ regno ] ) ) return 0 ; verbose ( env, "R%d   type=%s   expected=%s\\n", regno, reg_type_str [ regs [ regno ]. type ], reg_type_str [ PTR_TO_STACK ] ) ; return - EACCES ; } if (! tnum_is_const ( regs [ regno ]. var_off ) ) { char tn_buf [ 48 ] ; tnum_strn ( tn_buf, sizeof ( tn_buf ), regs [ regno ]. var_off ) ; verbose ( env, "invalid   variable   stack   read   R%d   var_off=%s\\n", regno, tn_buf ) ; <START_BUG> } <END_BUG> off = regs [ regno ]. off + regs [ regno ]. var_off. value ; if ( off >= 0 || off < - MAX_BPF_STACK || off + access_size > 0 || access_size < 0 || ( access_size == 0 &&! zero_size_allowed ) ) { verbose ( env, "invalid   stack   type   R%d   off=%d   access_size=%d\\n", regno, off, access_size ) ; return - EACCES ; } if ( env -> prog -> aux -> stack_depth < - off ) env -> prog -> aux -> stack_depth = - off ; if ( meta && meta -> raw_mode ) { meta -> access_size = access_size ; meta -> regno = regno ; return 0 ; } for ( i = 0 ; i < access_size ; i ++ ) { slot = - ( off + i ) - 1 ; spi = slot // BPF_REG_SIZE ; if ( state -> allocated

Fix:
<S2SV_ModStart> tn_buf ) ; return - EACCES ;
Buggy code:
 static int webSocketsDecodeHybi ( rfbClientPtr cl, char * dst, int len ) { <START_BUG> char * buf, * payload ; <END_BUG> uint32_t * payload32 ;  int ret = - 1, result = - 1 ; <START_BUG> <END_BUG> int total = 0 ;  ws_mask_t mask ; ws_header_t * header ; int i ; unsigned char opcode ; ws_ctx_t * wsctx = ( ws_ctx_t * ) cl -> wsctx ; int flength, fhlen ; if ( wsctx -> readbuflen ) { if ( wsctx -> readbuflen > len ) { memcpy ( dst, wsctx -> readbuf + wsctx -> readbufstart, len ) ; result = len ; wsctx -> readbuflen -= len ; wsctx -> readbufstart += len ; } else { memcpy ( dst, wsctx -> readbuf + wsctx -> readbufstart, wsctx -> readbuflen ) ; result = wsctx -> readbuflen ; wsctx -> readbuflen = 0 ; wsctx -> readbufstart = 0 ; } goto spor ; } buf = wsctx -> codeBufDecode ; header = ( ws_header_t * ) wsctx -> codeBufDecode ; ret = ws_peek ( cl, buf, B64LEN ( len ) + WSHLENMAX ) ; if ( ret < 2 ) { if ( - 1 == ret ) { int olderrno = errno ; rfbErr ( "%s:   peek;   %m\\n", __func__ ) ; errno = olderrno ; <START_BUG> } else if ( 0 == ret ) { <END_BUG> result = 0 ; } else { errno = EAGAIN ; } goto spor ; } opcode = header -> b0 & 0x0f ; flength = header -> b1 & 0x7f ; if (! ( header -> b1 & 0x80 ) ) { rfbErr ( "%s:   got   frame   without   mask\\n", __func__, ret ) ; errno = EIO ; goto spor ; } if ( flength < 126 ) { fhlen = 2 ; mask = header -> u. m ; } else if ( flength == 126 && 4 <= ret ) { flength = WS_NTOH16 ( header -> u. s16. l16 ) ; fhlen = 4

Fix:
<S2SV_ModStart> len ) { int result <S2SV_ModEnd> = - 1 <S2SV_ModStart> = - 1 ; ws_ctx_t * wsctx = ( ws_ctx_t * ) cl -> wsctx ; rfbLog ( "%s_enter: <S2SV_blank> len=%d; <S2SV_blank> " "CTX: <S2SV_blank> readlen=%d <S2SV_blank> readPos=%p <S2SV_blank> " "writeTo=%p <S2SV_blank> " "state=%d <S2SV_blank> toRead=%d <S2SV_blank> remaining=%d <S2SV_blank> " " <S2SV_blank> nReadRaw=%d <S2SV_blank> carrylen=%d <S2SV_blank> carryBuf=%p\\n", __func__, len, wsctx -> readlen, wsctx -> readPos, wsctx -> writePos, wsctx -> hybiDecodeState, wsctx -> nToRead, hybiRemaining ( wsctx ), wsctx -> nReadRaw, wsctx -> carrylen, wsctx -> carryBuf ) ; switch ( wsctx -> hybiDecodeState ) { case WS_HYBI_STATE_HEADER_PENDING : wsctx -> hybiDecodeState = hybiReadHeader ( cl, & result ) ; if ( wsctx -> hybiDecodeState == WS_HYBI_STATE_ERR ) { goto spor ; } if ( wsctx ->
Buggy code:
 void PNGAPI png_info_init_3 ( png_infopp ptr_ptr, png_size_t png_info_struct_size ) { png_infop info_ptr = * ptr_ptr ; png_debug ( 1, "in   png_info_init_3" ) ; if ( info_ptr == NULL ) return ; if ( png_sizeof ( png_info ) > png_info_struct_size ) { png_destroy_struct ( info_ptr ) ; info_ptr = ( png_infop ) png_create_struct ( PNG_STRUCT_INFO ) ; * ptr_ptr = info_ptr ; <START_BUG> } <END_BUG> png_memset ( info_ptr, 0, png_sizeof ( png_info ) ) ; }

Fix:
<S2SV_ModStart> = info_ptr ; if ( info_ptr == NULL ) return ;
Buggy code:
 static vpx_image_t * img_alloc_helper ( vpx_image_t * img, vpx_img_fmt_t fmt, unsigned int d_w, unsigned int d_h, unsigned int buf_align, unsigned int stride_align, unsigned char * img_data ) { unsigned int h, w, s, xcs, ycs, bps ; unsigned int stride_in_bytes ; int align ; if (! buf_align ) buf_align = 1 ; if ( buf_align & ( buf_align - 1 ) ) goto fail ; if (! stride_align ) stride_align = 1 ; if ( stride_align & ( stride_align - 1 ) ) goto fail ; switch ( fmt ) { case VPX_IMG_FMT_RGB32 : case VPX_IMG_FMT_RGB32_LE : case VPX_IMG_FMT_ARGB : case VPX_IMG_FMT_ARGB_LE : bps = 32 ; break ; case VPX_IMG_FMT_RGB24 : case VPX_IMG_FMT_BGR24 : bps = 24 ; break ; case VPX_IMG_FMT_RGB565 : case VPX_IMG_FMT_RGB565_LE : case VPX_IMG_FMT_RGB555 : case VPX_IMG_FMT_RGB555_LE : case VPX_IMG_FMT_UYVY : case VPX_IMG_FMT_YUY2 : case VPX_IMG_FMT_YVYU : bps = 16 ; break ; case VPX_IMG_FMT_I420 : case VPX_IMG_FMT_YV12 : case VPX_IMG_FMT_VPXI420 : case VPX_IMG_FMT_VPXYV12 : bps = 12 ; break ; case VPX_IMG_FMT_I422 : case VPX_IMG_FMT_I440 : bps = 16 ; break ; case VPX_IMG_FMT_I444 : bps = 24

Fix:
<S2SV_ModStart> break ; } w = d_w ; h = d_h ; s = ( fmt & VPX_IMG_FMT_PLANAR )? w : bps * w // 8 ; s = ( s + stride_align - 1 ) & ~ ( stride_align - 1 ) ; stride_in_bytes = ( fmt & VPX_IMG_FMT_HIGHBITDEPTH )? s * 2 : s ; if (! img ) { img = ( vpx_image_t * ) calloc ( 1, sizeof ( vpx_image_t ) ) ; if (! img ) goto fail ; img -> self_allocd = 1 ; } else { memset ( img, 0, sizeof ( vpx_image_t ) ) ; } img -> img_data = img_data ; if (! img_data ) { uint64_t alloc_size ; <S2SV_ModStart> : s ; <S2SV_ModEnd> alloc_size = (
Buggy code:
 static void scsi_read_data ( SCSIRequest * req ) { SCSIDiskReq * r = DO_UPCAST ( SCSIDiskReq, req, req ) ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, r -> req. dev ) ; uint32_t n ; if ( r -> sector_count == ( uint32_t ) - 1 ) { DPRINTF ( "Read   buf_len=%zd\\n", r -> iov. iov_len ) ; r -> sector_count = 0 ; scsi_req_data ( & r -> req, r -> iov. iov_len ) ; return ; } DPRINTF ( "Read   sector_count=%d\\n", r -> sector_count ) ; if ( r -> sector_count == 0 ) { scsi_req_complete ( & r -> req, GOOD ) ; return ; } assert ( r -> req. aiocb == NULL ) ; if ( r -> req. cmd. mode == SCSI_XFER_TO_DEV ) { DPRINTF ( "Data   transfer   direction   invalid\\n" ) ; scsi_read_complete ( r, - EINVAL ) ; return ; } <START_BUG> n = r -> sector_count ; <END_BUG> if ( n > SCSI_DMA_BUF_SIZE // 512 ) n = SCSI_DMA_BUF_SIZE // 512 ; if ( s -> tray_open ) { scsi_read_complete ( r, - ENOMEDIUM ) ; }  r -> iov. iov_len = n * 512 ; <START_BUG> <END_BUG> qemu_iovec_init_external ( & r -> qiov, & r -> iov, 1 ) ;  bdrv_acct_start ( s -> bs, & r -> acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ ) ; <START_BUG> r -> req. aiocb = bdrv_aio_readv ( s -> bs, r -> sector, & r -> qiov, n, <END_BUG> scsi_read_complete, r ) ; if ( r -> req. aiocb == NULL ) { scsi_read_complete ( r, - EIO ) ; } }

Fix:
<S2SV_ModStart> return ; } <S2SV_ModEnd> if ( s <S2SV_ModStart> ) ; } n = scsi_init_iovec ( r ) ; bdrv_acct_start ( s -> bs, & r -> acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ ) ; r -> req. aiocb = bdrv_aio_readv ( s -> bs, r -> sector, <S2SV_ModEnd> & r -> <S2SV_ModStart> -> qiov, n, scsi_read_complete, r ) ; if ( <S2SV_ModEnd> r -> req <S2SV_ModStart> req. aiocb <S2SV_ModEnd> == NULL )