nus-yam/ex-repair huggingface dataset:
Buggy code:
 static ssize_t o2nm_node_num_store ( struct config_item * item, const char * page, size_t count ) { struct o2nm_node * node = to_o2nm_node ( item ) ; <START_BUG> struct o2nm_cluster * cluster = to_o2nm_cluster_from_node ( node ) ; <END_BUG> unsigned long tmp ; char * p = ( char * ) page ; int ret = 0 ; tmp = simple_strtoul ( p, & p, 0 ) ; if (! p || ( * p && ( * p!= '\\n' ) ) ) return - EINVAL ; if ( tmp >= O2NM_MAX_NODES ) return - ERANGE ; if (! test_bit ( O2NM_NODE_ATTR_ADDRESS, & node -> nd_set_attributes ) ||! test_bit ( O2NM_NODE_ATTR_PORT, & node -> nd_set_attributes ) ) return - EINVAL ;  write_lock ( & cluster -> cl_nodes_lock ) ; <START_BUG> if ( cluster -> cl_nodes [ tmp ] ) ret = - EEXIST ; else if ( test_and_set_bit ( O2NM_NODE_ATTR_NUM, & node -> nd_set_attributes ) ) ret = - EBUSY ; else { cluster -> cl_nodes [ tmp ] = node ; node -> nd_num = tmp ; set_bit ( tmp, cluster -> cl_nodes_bitmap ) ; } write_unlock ( & cluster -> cl_nodes_lock ) ; <END_BUG> if ( ret )  return ret ; return count ; }

Fix:
<S2SV_ModStart> o2nm_cluster * cluster <S2SV_ModEnd> ; unsigned long <S2SV_ModStart> - EINVAL ; o2nm_lock_subsystem ( ) ; cluster = to_o2nm_cluster_from_node ( node ) ; if (! cluster ) { o2nm_unlock_subsystem ( ) ; return - EINVAL ; } <S2SV_ModStart> cl_nodes_lock ) ; o2nm_unlock_subsystem ( ) ;
Buggy code:
 int ff_mpeg4_decode_picture_header ( Mpeg4DecContext * ctx, GetBitContext * gb ) { MpegEncContext * s = & ctx -> m ; unsigned startcode, v ; int ret ; int vol = 0 ; align_get_bits ( gb ) ; if (! s -> studio_profile && s -> avctx -> bits_per_raw_sample!= 8 ) s -> avctx -> bits_per_raw_sample = 0 ; if ( s -> codec_tag == AV_RL32 ( "WV1F" ) && show_bits ( gb, 24 ) == 0x575630 ) { skip_bits ( gb, 24 ) ; if ( get_bits ( gb, 8 ) == 0xF0 ) goto end ; } startcode = 0xff ; for ( ; ; ) { if ( get_bits_count ( gb ) >= gb -> size_in_bits ) { if ( gb -> size_in_bits == 8 && ( ctx -> divx_version >= 0 || ctx -> xvid_build >= 0 ) || s -> codec_tag == AV_RL32 ( "QMP4" ) ) { av_log ( s -> avctx, AV_LOG_VERBOSE, "frame   skip   %d\\n", gb -> size_in_bits ) ; return FRAME_SKIPPED ; } else return AVERROR_INVALIDDATA ; } v = get_bits ( gb, 8 ) ; startcode = ( ( startcode << 8 ) | v ) & 0xffffffff ; if ( ( startcode & 0xFFFFFF00 )!= 0x100 ) continue ; if ( s -> avctx -> debug & FF_DEBUG_STARTCODE ) { av_log ( s -> avctx, AV_LOG_DEBUG, "startcode:   %3X   ", startcode ) ; if ( startcode <= 0x11F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Video   Object   Start" ) ; else if ( startcode <= 0x12F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Video   Object   Layer   Start" ) ; else if ( startcode <= 0x13F ) av_log ( s -> avctx, AV_LOG_DEBUG, "Reserved" ) ; else if ( startcode <=

Fix:
<S2SV_ModStart> studio_profile ) { <S2SV_ModEnd> if (!
Buggy code:
 generic_ret * init_2_svc ( krb5_ui_4 * arg, struct svc_req * rqstp ) { static generic_ret ret ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; kadm5_server_handle_t handle ; OM_uint32 minor_stat ; const char * errmsg = NULL ; size_t clen, slen ; char * cdots, * sdots ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( * arg, rqstp, & handle ) ) ) goto exit_func ; if (! ( ret. code = check_handle ( ( void * ) handle ) ) ) { ret. api_version = handle -> api_version ; } free_server_handle ( handle ) ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( NULL, ret. code ) ; clen = client_name. length ; trunc_name ( & clen, & cdots ) ; slen = service_name. length ; trunc_name ( & slen, & sdots ) ; krb5_klog_syslog ( LOG_NOTICE, _ ( "Request:   kadm5_init,   %.*s%s,   %s,   " "client=%.*s%s,   service=%.*s%s,   addr=%s,   " "vers=%d,   flavor=%d" ), ( int ) clen, ( char * ) client_name. value, cdots, errmsg? errmsg : _ ( "success" ), ( int ) clen, ( char * ) client_name. value, cdots, ( int ) slen, ( char * ) service_name. value, sdots, client_addr ( rqstp -> rq_xprt ), ret. api_version & ~ ( KADM5_API_VERSION_MASK ), rqstp -> rq_cred. oa_flavor ) ; if ( errmsg!= NULL ) krb5_free_error_message ( NULL, errmsg ) ; 

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; kadm5_server_handle_t handle <S2SV_ModStart> errmsg ) ; exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> return ( &
Buggy code:
 void * leak_malloc ( size_t bytes ) { <START_BUG> void * base = dlmalloc ( bytes + sizeof ( AllocationEntry ) ) ; <END_BUG> if ( base!= NULL ) { pthread_mutex_lock ( & gAllocationsMutex ) ; intptr_t backtrace [ BACKTRACE_SIZE ] ; size_t numEntries = get_backtrace ( backtrace, BACKTRACE_SIZE ) ; AllocationEntry * header = ( AllocationEntry * ) base ; header -> entry = record_backtrace ( backtrace, numEntries, bytes ) ; header -> guard = GUARD ; base = ( AllocationEntry * ) base + 1 ; pthread_mutex_unlock ( & gAllocationsMutex ) ; } return base ; }

Fix:
<S2SV_ModStart> bytes ) { size_t size = bytes + sizeof ( AllocationEntry ) ; if ( size < bytes ) { return NULL ; } <S2SV_ModStart> = dlmalloc ( size <S2SV_ModEnd> ) ; if
Buggy code:
 static int wb_id ( netdissect_options * ndo, const struct pkt_id * id, u_int len ) { int i ; const char * cp ; const struct id_off * io ; char c ; int nid ; ND_PRINT ( ( ndo, "   wb-id:" ) ) ; if ( len < sizeof ( * id ) ||! ND_TTEST ( * id ) ) return ( - 1 ) ; len -= sizeof ( * id ) ; ND_PRINT ( ( ndo, "   %u//%s:%u   (max   %u//%s:%u)   ", EXTRACT_32BITS ( & id -> pi_ps. slot ), ipaddr_string ( ndo, & id -> pi_ps. page. p_sid ), EXTRACT_32BITS ( & id -> pi_ps. page. p_uid ), EXTRACT_32BITS ( & id -> pi_mslot ), ipaddr_string ( ndo, & id -> pi_mpage. p_sid ), EXTRACT_32BITS ( & id -> pi_mpage. p_uid ) ) ) ; nid = EXTRACT_16BITS ( & id -> pi_ps. nid ) ; len -= sizeof ( * io ) * nid ; io = ( struct id_off * ) ( id + 1 ) ; cp = ( char * ) ( io + nid ) ; <START_BUG> if (! ND_TTEST2 ( cp, len ) ) { <END_BUG> ND_PRINT ( ( ndo, "\\"" ) ) ; fn_print ( ndo, ( u_char * ) cp, ( u_char * ) cp + len ) ; ND_PRINT ( ( ndo, "\\"" ) ) ; } c = '<' ; for ( i = 0 ; i < nid && ND_TTEST ( * io ) ; ++ io, ++ i ) { ND_PRINT ( ( ndo, "%c%s:%u", c, ipaddr_string ( ndo, & io -> id ), EXTRACT_32BITS ( & io -> off ) ) ) ; c = ',' ; } if ( i >= nid ) { ND_PRINT ( ( ndo, ">" ) ) ; return ( 0 ) ; } return ( - 1 ) ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> ND_TTEST2 ( cp
Buggy code:
 static int mobility_opt_print ( netdissect_options * ndo, const u_char * bp, const unsigned len ) { unsigned i, optlen ; for ( i = 0 ; i < len ; i += optlen ) { ND_TCHECK ( bp [ i ] ) ; if ( bp [ i ] == IP6MOPT_PAD1 ) optlen = 1 ; else { if ( i + 1 < len ) { ND_TCHECK ( bp [ i + 1 ] ) ; optlen = bp [ i + 1 ] + 2 ; } else goto trunc ; } if ( i + optlen > len ) goto trunc ; ND_TCHECK ( bp [ i + optlen ] ) ; switch ( bp [ i ] ) { case IP6MOPT_PAD1 : ND_PRINT ( ( ndo, "(pad1)" ) ) ; break ; case IP6MOPT_PADN : if ( len - i < IP6MOPT_MINLEN ) { ND_PRINT ( ( ndo, "(padn:   trunc)" ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "(padn)" ) ) ; break ; case IP6MOPT_REFRESH : if ( len - i < IP6MOPT_REFRESH_MINLEN ) { ND_PRINT ( ( ndo, "(refresh:   trunc)" ) ) ; goto trunc ; } <START_BUG> ND_PRINT ( ( ndo, "(refresh:   %u)", <END_BUG> EXTRACT_16BITS ( & bp [ i + 2 ] ) << 2 ) ) ; break ; case IP6MOPT_ALTCOA : if ( len - i < IP6MOPT_ALTCOA_MINLEN ) { ND_PRINT ( ( ndo, "(altcoa:   trunc)" ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "(alt-CoA:   %s)", ip6addr_string ( ndo, & bp [ i + 2 ] ) ) ) ; break ; case IP6MOPT_NONCEID : if ( len - i < IP6MOPT_NONCEID_MINLEN ) { ND_PRINT ( ( ndo, "(ni:   trunc)" ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "(ni:   ho=0x

Fix:
<S2SV_ModStart> trunc ; } ND_TCHECK_16BITS ( & bp [ i + 2 ] ) ;
Buggy code:
 static int rsi_send_beacon ( struct rsi_common * common ) { struct sk_buff * skb = NULL ; u8 dword_align_bytes = 0 ; skb = dev_alloc_skb ( MAX_MGMT_PKT_SIZE ) ; if (! skb ) return - ENOMEM ; memset ( skb -> data, 0, MAX_MGMT_PKT_SIZE ) ; dword_align_bytes = ( ( unsigned long ) skb -> data & 0x3f ) ; if ( dword_align_bytes ) skb_pull ( skb, ( 64 - dword_align_bytes ) ) ; if ( rsi_prepare_beacon ( common, skb ) ) { rsi_dbg ( ERR_ZONE, "Failed   to   prepare   beacon\\n" ) ; <START_BUG> return - EINVAL ; <END_BUG> } skb_queue_tail ( & common -> tx_queue [ MGMT_BEACON_Q ], skb ) ; rsi_set_event ( & common -> tx_thread. event ) ; rsi_dbg ( DATA_TX_ZONE, "%s:   Added   to   beacon   queue\\n", __func__ ) ; return 0 ; }

Fix:
<S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> prepare <S2SV_blank> beacon\\n" ) ; dev_kfree_skb ( skb ) ;
Buggy code:
 static long madvise_willneed ( struct vm_area_struct * vma, struct vm_area_struct * * prev, unsigned long start, unsigned long end ) { struct file * file = vma -> vm_file ; <START_BUG> # ifdef CONFIG_SWAP <END_BUG> if (! file ) {  * prev = vma ; <START_BUG> force_swapin_readahead ( vma, start, end ) ; return 0 ; } if ( shmem_mapping ( file -> f_mapping ) ) { <END_BUG> * prev = vma ;  force_shm_swapin_readahead ( vma, start, end, file -> f_mapping ) ; return 0 ; } # else if (! file ) return - EBADF ; # endif if ( IS_DAX ( file_inode ( file ) ) ) { return 0 ; } <START_BUG> * prev = vma ; <END_BUG> start = ( ( start - vma -> vm_start ) >> PAGE_SHIFT ) + vma -> vm_pgoff ; if ( end > vma -> vm_end ) end = vma -> vm_end ; end = ( ( end - vma -> vm_start ) >> PAGE_SHIFT ) + vma -> vm_pgoff ; force_page_cache_readahead ( file -> f_mapping, file, start, end - start ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> vm_file ; * prev = vma ; <S2SV_ModStart> file ) { <S2SV_ModEnd> force_swapin_readahead ( vma <S2SV_ModStart> ) ) { <S2SV_ModEnd> force_shm_swapin_readahead ( vma <S2SV_ModStart> 0 ; } <S2SV_ModEnd> start = (
Buggy code:
 static struct mnt_namespace * alloc_mnt_ns ( struct user_namespace * user_ns ) { struct mnt_namespace * new_ns ; struct ucounts * ucounts ; int ret ; ucounts = inc_mnt_namespaces ( user_ns ) ; if (! ucounts ) return ERR_PTR ( - ENOSPC ) ; new_ns = kmalloc ( sizeof ( struct mnt_namespace ), GFP_KERNEL ) ; if (! new_ns ) { dec_mnt_namespaces ( ucounts ) ; return ERR_PTR ( - ENOMEM ) ; } ret = ns_alloc_inum ( & new_ns -> ns ) ; if ( ret ) { kfree ( new_ns ) ; dec_mnt_namespaces ( ucounts ) ; return ERR_PTR ( ret ) ; } new_ns -> ns. ops = & mntns_operations ; new_ns -> seq = atomic64_add_return ( 1, & mnt_ns_seq ) ; atomic_set ( & new_ns -> count, 1 ) ; new_ns -> root = NULL ; INIT_LIST_HEAD ( & new_ns -> list ) ; init_waitqueue_head ( & new_ns -> poll ) ; new_ns -> event = 0 ; new_ns -> user_ns = get_user_ns ( user_ns ) ; new_ns -> ucounts = ucounts ; <START_BUG> return new_ns ; <END_BUG> }

Fix:
<S2SV_ModStart> = ucounts ; new_ns -> mounts = 0 ; new_ns -> pending_mounts = 0 ;
Buggy code:
 <START_BUG> int xmkstemp ( char * * tmpname, char * dir ) <END_BUG> { char * localtmp ;  char * tmpenv ; <START_BUG> mode_t old_mode ; int fd, rc ; <END_BUG> if ( dir!= NULL )  <START_BUG> tmpenv = dir ; <END_BUG> else tmpenv = getenv ( "TMPDIR" ) ;  if ( tmpenv ) <START_BUG> rc = asprintf ( & localtmp, "%s//%s.XXXXXX", tmpenv, <END_BUG> program_invocation_short_name ) ;  else rc = asprintf ( & localtmp, "%s//%s.XXXXXX", _PATH_TMP, program_invocation_short_name ) ; if ( rc < 0 ) return - 1 ; old_mode = umask ( 077 ) ; fd = mkostemp ( localtmp, O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC ) ; umask ( old_mode ) ; if ( fd == - 1 ) { free ( localtmp ) ; localtmp = NULL ; } * tmpname = localtmp ; return fd ; }

Fix:
<S2SV_ModStart> * tmpname, const <S2SV_ModStart> char * dir, const char * prefix <S2SV_ModStart> * localtmp ; const <S2SV_ModStart>, rc ; <S2SV_ModEnd> tmpenv = dir <S2SV_ModStart> tmpenv = dir? dir : <S2SV_ModEnd> getenv ( "TMPDIR" <S2SV_ModStart> ; if (! tmpenv ) tmpenv = _PATH_TMP ; <S2SV_ModEnd> rc = asprintf <S2SV_ModStart>, tmpenv, prefix <S2SV_ModEnd> ) ; if
Buggy code:
 jas_image_t * jp2_decode ( jas_stream_t * in, char * optstr ) { jp2_box_t * box ; int found ; jas_image_t * image ; jp2_dec_t * dec ; bool samedtype ; int dtype ; unsigned int i ; jp2_cmap_t * cmapd ; jp2_pclr_t * pclrd ; jp2_cdef_t * cdefd ; unsigned int channo ; int newcmptno ; int_fast32_t * lutents ; # if 0 jp2_cdefchan_t * cdefent ; int cmptno ; # endif jp2_cmapent_t * cmapent ; jas_icchdr_t icchdr ; jas_iccprof_t * iccprof ; dec = 0 ; box = 0 ; image = 0 ; if (! ( dec = jp2_dec_create ( ) ) ) { goto error ; } if (! ( box = jp2_box_get ( in ) ) ) { jas_eprintf ( "error:   cannot   get   box\\n" ) ; goto error ; } if ( box -> type!= JP2_BOX_JP ) { jas_eprintf ( "error:   expecting   signature   box\\n" ) ; goto error ; } if ( box -> data. jp. magic!= JP2_JP_MAGIC ) { jas_eprintf ( "incorrect   magic   number\\n" ) ; goto error ; } jp2_box_destroy ( box ) ; box = 0 ; if (! ( box = jp2_box_get ( in ) ) ) { goto error ; } if ( box -> type!= JP2_BOX_FTYP ) { jas_eprintf ( "expecting   file   type   box\\n" ) ; goto error ; } jp2_box_destroy ( box ) ; box = 0 ; found = 0 ; while ( ( box = jp2_box_get ( in ) ) ) { if ( jas_getdbglevel ( ) >= 1 ) { <START_BUG> jas_eprintf ( "box   type   %s\\n", box -> info -> name ) ; <END_BUG> } switch ( box -> type ) { case JP

Fix:
<S2SV_ModStart> { jas_eprintf ( "got <S2SV_blank> box <S2SV_blank> type <S2SV_blank> %s\\n" <S2SV_ModEnd>, box ->
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_slice_header ( codec_t * ps_codec, nal_header_t * ps_nal ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; WORD32 i, j ; WORD32 sps_id ; pps_t * ps_pps ; sps_t * ps_sps ; slice_header_t * ps_slice_hdr ; WORD32 disable_deblocking_filter_flag ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; WORD32 idr_pic_flag ; WORD32 pps_id ; WORD32 first_slice_in_pic_flag ; WORD32 no_output_of_prior_pics_flag = 0 ; WORD8 i1_nal_unit_type = ps_nal -> i1_nal_unit_type ; WORD32 num_poc_total_curr = 0 ; <START_BUG> WORD32 slice_address ; <END_BUG> if ( ps_codec -> i4_slice_error == 1 ) return ret ; idr_pic_flag = ( NAL_IDR_W_LP == i1_nal_unit_type ) || ( NAL_IDR_N_LP == i1_nal_unit_type ) ; BITS_PARSE ( "first_slice_in_pic_flag", first_slice_in_pic_flag, ps_bitstrm, 1 ) ; if ( ( NAL_BLA_W_LP <= i1_nal_unit_type ) && ( NAL_RSV_RAP_VCL23 >= i1_nal_unit_type ) ) { BITS_PARSE ( "no_output_of_prior_pics_flag", no_output_of_prior_pics_flag, ps_bitstrm, 1 ) ; } UEV_PARSE ( "pic_parameter_set_id", pps_id, ps_bitstrm ) ; pps_id = CLIP3 ( pps_id, 0, MAX_PPS_CNT - 2 ) ; ps_pps = ps_codec ->

Fix:
<S2SV_ModStart> ; WORD32 slice_address ; WORD32 prev_slice_incomplete_flag = 0 <S2SV_ModStart> i4_pic_present ) { prev_slice_incomplete_flag = 1 <S2SV_ModEnd> ; } else <S2SV_ModStart> ) ) ; prev_slice_incomplete_flag = 1 ; ASSERT ( ps_codec -> s_parse. i4_cur_slice_idx == 1 ) <S2SV_ModEnd> ; ps_slice_hdr_prev -> <S2SV_ModStart> ; } } if ( prev_slice_incomplete_flag ) { ps_codec -> i4_slice_error = 1 ; ps_codec -> s_parse. i4_cur_slice_idx -- ; if ( ps_codec -> s_parse. i4_cur_slice_idx < 0 ) ps_codec -> s_parse. i4_cur_slice_idx = 0 ; }
Buggy code:
 static int snd_ctl_tlv_ioctl ( struct snd_ctl_file * file, struct snd_ctl_tlv __user * _tlv, int op_flag ) { struct snd_card * card = file -> card ; struct snd_ctl_tlv tlv ; struct snd_kcontrol * kctl ; struct snd_kcontrol_volatile * vd ; unsigned int len ; int err = 0 ; if ( copy_from_user ( & tlv, _tlv, sizeof ( tlv ) ) ) return - EFAULT ; if ( tlv. length < sizeof ( unsigned int ) * 2 ) return - EINVAL ; down_read ( & card -> controls_rwsem ) ; kctl = snd_ctl_find_numid ( card, tlv. numid ) ; if ( kctl == NULL ) { err = - ENOENT ; goto __kctl_end ; } if ( kctl -> tlv. p == NULL ) { err = - ENXIO ; goto __kctl_end ; } vd = & kctl -> vd [ tlv. numid - kctl -> id. numid ] ; if ( ( op_flag == 0 && ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_READ ) == 0 ) || ( op_flag > 0 && ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE ) == 0 ) || ( op_flag < 0 && ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND ) == 0 ) ) { err = - ENXIO ; goto __kctl_end ; } if ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK ) { if ( vd -> owner!= NULL && vd -> owner!= file ) { err = - EPERM ; goto __kctl_end ; } err = kctl -> tlv. c ( kctl, op_flag, tlv. length, _tlv -> tlv ) ; if ( err > 0 ) { <START_BUG> up_read ( & card -> controls_rwsem ) ; <END_BUG>  snd_ctl_notify ( card, SNDRV_CTL_EVENT_MASK_TLV, & kctl -> id ) ; <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> 0 ) { struct snd_ctl_elem_id id = kctl -> id ; <S2SV_ModStart> SNDRV_CTL_EVENT_MASK_TLV, & <S2SV_ModEnd> id ) ;
Buggy code:
 <START_BUG> void usage_exit ( ) { <END_BUG> fprintf ( stderr, "Usage:   %s   <codec>   <width>   <height>   <infile>   <outfile>\\n", exec_name ) ; exit ( EXIT_FAILURE ) ; }

Fix:
<S2SV_ModStart> void usage_exit ( void
Buggy code:
 <START_BUG> jas_iccprof_t * jas_iccprof_createfrombuf ( uchar * buf, int len ) <END_BUG> { jas_stream_t * in ; jas_iccprof_t * prof ; if (! ( in = jas_stream_memopen ( JAS_CAST ( char *, buf ), len ) ) ) goto error ; if (! ( prof = jas_iccprof_load ( in ) ) ) goto error ; jas_stream_close ( in ) ; return prof ; error : if ( in ) jas_stream_close ( in ) ; return 0 ; }

Fix:
<S2SV_ModStart> * jas_iccprof_createfrombuf ( jas_uchar <S2SV_ModEnd> * buf,
Buggy code:
 int rpc_type_of_NPNVariable ( int variable ) { int type ; switch ( variable ) { case NPNVjavascriptEnabledBool : case NPNVasdEnabledBool : case NPNVisOfflineBool : case NPNVSupportsXEmbedBool : <START_BUG> case NPNVSupportsWindowless : <END_BUG> type = RPC_TYPE_BOOLEAN ; break ; case NPNVToolkit : case NPNVnetscapeWindow : type = RPC_TYPE_UINT32 ; break ; case NPNVWindowNPObject : case NPNVPluginElementNPObject : type = RPC_TYPE_NP_OBJECT ; break ; default : type = RPC_ERROR_GENERIC ; break ; } return type ; }

Fix:
<S2SV_ModStart> : case NPNVSupportsWindowless : case NPNVprivateModeBool : case NPNVsupportsAdvancedKeyHandling
Buggy code:
 int equalizer_get_parameter ( effect_context_t * context, effect_param_t * p, uint32_t * size ) { equalizer_context_t * eq_ctxt = ( equalizer_context_t * ) context ; int voffset = ( ( p -> psize - 1 ) // sizeof ( int32_t ) + 1 ) * sizeof ( int32_t ) ; int32_t * param_tmp = ( int32_t * ) p -> data ; int32_t param = * param_tmp ++ ; int32_t param2 ; char * name ; void * value = p -> data + voffset ; int i ; ALOGV ( "%s", __func__ ) ; p -> status = 0 ; switch ( param ) { case EQ_PARAM_NUM_BANDS : case EQ_PARAM_CUR_PRESET : case EQ_PARAM_GET_NUM_OF_PRESETS : case EQ_PARAM_BAND_LEVEL : case EQ_PARAM_GET_BAND : if ( p -> vsize < sizeof ( int16_t ) ) p -> status = - EINVAL ; p -> vsize = sizeof ( int16_t ) ; break ; case EQ_PARAM_LEVEL_RANGE : if ( p -> vsize < 2 * sizeof ( int16_t ) ) p -> status = - EINVAL ; p -> vsize = 2 * sizeof ( int16_t ) ; break ; case EQ_PARAM_BAND_FREQ_RANGE : if ( p -> vsize < 2 * sizeof ( int32_t ) ) p -> status = - EINVAL ; p -> vsize = 2 * sizeof ( int32_t ) ; break ; case EQ_PARAM_CENTER_FREQ : if ( p -> vsize < sizeof ( int32_t ) ) p -> status = - EINVAL ; p -> vsize = sizeof ( int32_t ) ; break ; case EQ_PARAM_GET_PRESET_NAME : break ; case EQ_PARAM_PROPERTIES : if ( p -> vsize < ( 2 + NUM_EQ_BANDS ) * sizeof ( uint16_t ) ) p -> status = - EINVAL ; p -> vsize = ( 2 + NUM_EQ_BANDS ) * sizeof ( uint16_t ) ; break ; default : p

Fix:
<S2SV_ModStart> if ( param2 < 0 || param2 <S2SV_ModStart> - EINVAL ; if ( param2 < 0 ) { android_errorWriteLog ( 0x534e4554, "32438598" ) ; ALOGW ( "\\tERROR <S2SV_blank> EQ_PARAM_BAND_LEVEL <S2SV_blank> band <S2SV_blank> %d", param2 ) ; } <S2SV_ModStart> ; if ( param2 < 0 || <S2SV_ModStart> - EINVAL ; if ( param2 < 0 ) { android_errorWriteLog ( 0x534e4554, "32436341" ) ; ALOGW ( "\\tERROR <S2SV_blank> EQ_PARAM_CENTER_FREQ <S2SV_blank> band <S2SV_blank> %d", param2 ) ; } <S2SV_ModStart> ; if ( param2 < 0 || <S2SV_ModStart> - EINVAL ; if ( param2 < 0 ) { android_errorWriteLog ( 0x534e4554, "32247948" ) ; ALOGW ( "\\tERROR <S2SV_blank> EQ_PARAM_BAND_FREQ_RANGE <S2SV_blank> band <S2SV_blank> %d", param2 ) ; }
Buggy code:
 static int get_cox ( Jpeg2000DecoderContext * s, Jpeg2000CodingStyle * c ) { uint8_t byte ; if ( bytestream2_get_bytes_left ( & s -> g ) < 5 ) return AVERROR_INVALIDDATA ; c -> nreslevels = bytestream2_get_byteu ( & s -> g ) + 1 ; if ( c -> nreslevels >= JPEG2000_MAX_RESLEVELS ) { av_log ( s -> avctx, AV_LOG_ERROR, "nreslevels   %d   is   invalid\\n", c -> nreslevels ) ; return AVERROR_INVALIDDATA ; } if ( c -> nreslevels < s -> reduction_factor ) c -> nreslevels2decode = 1 ; else c -> nreslevels2decode = c -> nreslevels - s -> reduction_factor ; c -> log2_cblk_width = ( bytestream2_get_byteu ( & s -> g ) & 15 ) + 2 ; c -> log2_cblk_height = ( bytestream2_get_byteu ( & s -> g ) & 15 ) + 2 ; if ( c -> log2_cblk_width > 10 || c -> log2_cblk_height > 10 || c -> log2_cblk_width + c -> log2_cblk_height > 12 ) { av_log ( s -> avctx, AV_LOG_ERROR, "cblk   size   invalid\\n" ) ; return AVERROR_INVALIDDATA ; } <START_BUG> c -> cblk_style = bytestream2_get_byteu ( & s -> g ) ; <END_BUG> if ( c -> cblk_style!= 0 ) { av_log ( s -> avctx, AV_LOG_WARNING, "extra   cblk   styles   %X\\n", c -> cblk_style ) ; } c -> transform = bytestream2_get_byteu ( & s -> g ) ; if ( ( s -> avctx -> flags & CODEC_FLAG_BITEXACT ) && ( c -> transform == FF_DWT97 ) ) c -> transform = FF_DWT97_INT ; if ( c -> csty & JPEG2000_CSTY_

Fix:
<S2SV_ModStart> AVERROR_INVALIDDATA ; } if ( c -> log2_cblk_width > 6 || c -> log2_cblk_height > 6 ) { avpriv_request_sample ( s -> avctx, "cblk <S2SV_blank> size <S2SV_blank> > <S2SV_blank> 64" ) ; return AVERROR_PATCHWELCOME ; }
Buggy code:
 static Image * ReadPICTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowPICTException ( exception, message ) { if ( tile_image!= ( Image * ) NULL ) tile_image = DestroyImage ( tile_image ) ; if ( read_info!= ( ImageInfo * ) NULL ) read_info = DestroyImageInfo ( read_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char geometry [ MagickPathExtent ], header_ole [ 4 ] ; Image * image, * tile_image ; ImageInfo * read_info ; int c, code ; MagickBooleanType jpeg, status ; PICTRectangle frame ; PICTPixmap pixmap ; Quantum index ; register Quantum * q ; register ssize_t i, x ; size_t extent, length ; ssize_t count, flags, j, version, y ; StringInfo * profile ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } read_info = ( ImageInfo * ) NULL ; tile_image = ( Image * ) NULL ; pixmap. bits_per_pixel = 0 ; pixmap. component_count = 0 ; header_ole [ 0 ] = ReadBlobByte ( image ) ; header_ole [ 1 ] = ReadBlobByte ( image ) ; header_ole [ 2 ] = ReadBlobByte ( image ) ; header_ole [ 3 ] = ReadBlobByte ( image ) ; if (! ( ( header_ole [ 0 ] == 0x50 ) && ( header_ole [ 1 ] == 0x49 ) && ( header_ole [ 2 ] == 0x43 ) && ( header_ole [ 3 ] == 0x

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( tile_image <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char geometry [ <S2SV_ModStart> if ( length > GetBlobSize ( image ) ) ThrowPICTException ( CorruptImageError, "InsufficientImageDataInFile" ) ; if ( length <S2SV_ModStart> ; if ( length > GetBlobSize ( image ) ) ThrowPICTException ( CorruptImageError, "InsufficientImageDataInFile" ) ; if ( <S2SV_ModStart> ReadBlobMSBShort ( image ) ; if ( length > GetBlobSize ( image ) ) ThrowPICTException ( CorruptImageError, "InsufficientImageDataInFile" <S2SV_ModStart> ReadBlobMSBShort ( image ) ; if ( length > GetBlobSize ( image ) ) ThrowPICTException ( CorruptImageError, "InsufficientImageDataInFile" <S2SV_ModStart> ReadBlobMSBShort ( image ) ; if ( length > GetBlobSize ( image ) ) ThrowPICTException ( CorruptImageError, "InsufficientImageDataInFile" <S2SV_ModStart> if ( length > GetBlobSize ( image ) ) ThrowPICTException ( CorruptImageError, "InsufficientImageDataInFile" ) ; if ( length <S2SV_ModStart> ( length > GetBlob
Buggy code:
 static void DefragTrackerInit ( DefragTracker * dt, Packet * p ) { COPY_ADDRESS ( & p -> src, & dt -> src_addr ) ; COPY_ADDRESS ( & p -> dst, & dt -> dst_addr ) ; if ( PKT_IS_IPV4 ( p ) ) { dt -> id = ( int32_t ) IPV4_GET_IPID ( p ) ; dt -> af = AF_INET ; } else { dt -> id = ( int32_t ) IPV6_EXTHDR_GET_FH_ID ( p ) ; dt -> af = AF_INET6 ; } <START_BUG> dt -> vlan_id [ 0 ] = p -> vlan_id [ 0 ] ; <END_BUG> dt -> vlan_id [ 1 ] = p -> vlan_id [ 1 ] ; dt -> policy = DefragGetOsPolicy ( p ) ; dt -> host_timeout = DefragPolicyGetHostTimeout ( p ) ; dt -> remove = 0 ; dt -> seen_last = 0 ; TAILQ_INIT ( & dt -> frags ) ; ( void ) DefragTrackerIncrUsecnt ( dt ) ; }

Fix:
<S2SV_ModStart> } dt -> proto = IP_GET_IPPROTO ( p ) ; dt ->
Buggy code:
 static int decode_multicast_vpn ( netdissect_options * ndo, const u_char * pptr, char * buf, u_int buflen ) { uint8_t route_type, route_length, addr_length, sg_length ; u_int offset ; ND_TCHECK2 ( pptr [ 0 ], 2 ) ; route_type = * pptr ++ ; route_length = * pptr ++ ; snprintf ( buf, buflen, "Route-Type:   %s   (%u),   length:   %u", tok2str ( bgp_multicast_vpn_route_type_values, "Unknown", route_type ), route_type, route_length ) ; switch ( route_type ) { case BGP_MULTICAST_VPN_ROUTE_TYPE_INTRA_AS_I_PMSI : ND_TCHECK2 ( pptr [ 0 ], BGP_VPN_RD_LEN ) ; offset = strlen ( buf ) ; snprintf ( buf + offset, buflen - offset, ",   RD:   %s,   Originator   %s", bgp_vpn_rd_print ( ndo, pptr ), bgp_vpn_ip_print ( ndo, pptr + BGP_VPN_RD_LEN, ( route_length - BGP_VPN_RD_LEN ) << 3 ) ) ; break ; case BGP_MULTICAST_VPN_ROUTE_TYPE_INTER_AS_I_PMSI : ND_TCHECK2 ( pptr [ 0 ], BGP_VPN_RD_LEN + 4 ) ; offset = strlen ( buf ) ; snprintf ( buf + offset, buflen - offset, ",   RD:   %s,   Source-AS   %s", bgp_vpn_rd_print ( ndo, pptr ), as_printf ( ndo, astostr, sizeof ( astostr ), EXTRACT_32BITS ( pptr + BGP_VPN_RD_LEN ) ) ) ; break ; case BGP_MULTICAST_VPN_ROUTE_TYPE_S_PMSI : ND_TCHECK2 ( pptr [ 0 ], BGP_VPN_RD_LEN ) ; offset = strlen ( buf ) ; snprintf ( buf + offset, buflen -

Fix:
<S2SV_ModStart> ], BGP_VPN_RD_LEN + 4 <S2SV_ModStart> pptr += BGP_VPN_RD_LEN + 4
Buggy code:
 void * arm_dma_alloc ( struct device * dev, size_t size, dma_addr_t * handle, gfp_t gfp, struct dma_attrs * attrs ) { <START_BUG> pgprot_t prot = __get_dma_pgprot ( attrs, pgprot_kernel ) ; <END_BUG> void * memory ; if ( dma_alloc_from_coherent ( dev, size, handle, & memory ) ) return memory ; return __dma_alloc ( dev, size, handle, gfp, prot, false, __builtin_return_address ( 0 ) ) ; }

Fix:
<S2SV_ModStart> ( attrs, PAGE_KERNEL <S2SV_ModEnd> ) ; void
Buggy code:
 static void save_bt_to_dump_dir ( const char * bt, const char * exe, const char * reason ) { time_t t = time ( NULL ) ; const char * iso_date = iso_date_string ( & t ) ; uid_t my_euid = ( uid_t ) - 1L ; mode_t mode = DEFAULT_DUMP_DIR_MODE | S_IROTH ; if (! ( g_opts & OPT_x ) ) { mode = DEFAULT_DUMP_DIR_MODE ; my_euid = geteuid ( ) ; } <START_BUG> pid_t my_pid = getpid ( ) ; <END_BUG> char base [ sizeof ( "xorg-YYYY-MM-DD-hh:mm:ss-%lu-%lu" ) + 2 * sizeof ( long ) * 3 ] ; sprintf ( base, "xorg-%s-%lu-%u", iso_date, ( long ) my_pid, g_bt_count ) ; char * path = concat_path_file ( debug_dumps_dir, base ) ; struct dump_dir * dd = dd_create ( path, my_euid, mode ) ; if ( dd ) { dd_create_basic_files ( dd, my_euid, NULL ) ; dd_save_text ( dd, FILENAME_ABRT_VERSION, VERSION ) ; dd_save_text ( dd, FILENAME_ANALYZER, "xorg" ) ; dd_save_text ( dd, FILENAME_TYPE, "xorg" ) ; dd_save_text ( dd, FILENAME_REASON, reason ) ; dd_save_text ( dd, FILENAME_BACKTRACE, bt ) ; if (! exe ) { exe = "//usr//bin//X" ; if ( access ( "//usr//bin//Xorg", X_OK ) == 0 ) exe = "//usr//bin//Xorg" ; } dd_save_text ( dd, FILENAME_EXECUTABLE, exe ) ; dd_close ( dd ) ; notify_new_path ( path ) ; } free ( path ) ; }

Fix:
<S2SV_ModStart> ) ; } if ( g_settings_privatereports ) { if ( ( g_opts & OPT_x ) ) log ( "Not <S2SV_blank> going <S2SV_blank> to <S2SV_blank> make <S2SV_blank> dump <S2SV_blank> directories <S2SV_blank> world <S2SV_blank> readable <S2SV_blank> because <S2SV_blank> PrivateReports <S2SV_blank> is <S2SV_blank> on" ) ; mode = DEFAULT_DUMP_DIR_MODE ; my_euid = 0 ; }
Buggy code:
 static void srpt_handle_tsk_mgmt ( struct srpt_rdma_ch * ch, struct srpt_recv_ioctx * recv_ioctx, struct srpt_send_ioctx * send_ioctx ) { struct srp_tsk_mgmt * srp_tsk ; struct se_cmd * cmd ; struct se_session * sess = ch -> sess ; uint64_t unpacked_lun ; <START_BUG> uint32_t tag = 0 ; <END_BUG> int tcm_tmr ; int rc ; BUG_ON (! send_ioctx ) ; srp_tsk = recv_ioctx -> ioctx. buf ; cmd = & send_ioctx -> cmd ; pr_debug ( "recv   tsk_mgmt   fn   %d   for   task_tag   %lld   and   cmd   tag   %lld" "   cm_id   %p   sess   %p\\n", srp_tsk -> tsk_mgmt_func, srp_tsk -> task_tag, srp_tsk -> tag, ch -> cm_id, ch -> sess ) ; srpt_set_cmd_state ( send_ioctx, SRPT_STATE_MGMT ) ; send_ioctx -> cmd. tag = srp_tsk -> tag ; tcm_tmr = srp_tmr_to_tcm ( srp_tsk -> tsk_mgmt_func ) ;  if ( tcm_tmr < 0 ) { <START_BUG> send_ioctx -> cmd. se_tmr_req -> response = TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED ; goto fail ; } unpacked_lun = srpt_unpack_lun ( ( uint8_t * ) & srp_tsk -> lun, sizeof ( srp_tsk -> lun ) ) ; if ( srp_tsk -> tsk_mgmt_func == SRP_TSK_ABORT_TASK ) { <END_BUG> rc = srpt_rx_mgmt_fn_tag ( send_ioctx, srp_tsk -> task_tag ) ;  if ( rc < 0 ) { send_ioctx -> cmd. se_tmr_req -> response = TMR_TASK_DOES_NOT_EXIST ; goto fail ; } tag

Fix:
<S2SV_ModStart> uint64_t unpacked_lun ; <S2SV_ModEnd> int tcm_tmr ; <S2SV_ModStart> tsk_mgmt_func ) ; unpacked_lun = srpt_unpack_lun ( ( uint8_t * ) & srp_tsk -> lun, sizeof ( srp_tsk -> lun ) ) ; rc = target_submit_tmr ( & send_ioctx -> cmd, sess, NULL, unpacked_lun, srp_tsk, tcm_tmr, GFP_KERNEL <S2SV_ModEnd>, srp_tsk -> <S2SV_ModStart> srp_tsk -> task_tag <S2SV_ModEnd>, TARGET_SCF_ACK_KREF )
Buggy code:
 int ParseDsdiffHeaderConfig ( FILE * infile, char * infilename, char * fourcc, WavpackContext * wpc, WavpackConfig * config ) { int64_t infilesize, total_samples ; DFFFileHeader dff_file_header ; DFFChunkHeader dff_chunk_header ; uint32_t bcount ; infilesize = DoGetFileSize ( infile ) ; memcpy ( & dff_file_header, fourcc, 4 ) ; if ( (! DoReadFile ( infile, ( ( char * ) & dff_file_header ) + 4, sizeof ( DFFFileHeader ) - 4, & bcount ) || bcount!= sizeof ( DFFFileHeader ) - 4 ) || strncmp ( dff_file_header. formType, "DSD   ", 4 ) ) { error_line ( "%s   is   not   a   valid  .DFF   file!", infilename ) ; return WAVPACK_SOFT_ERROR ; } else if (! ( config -> qmode & QMODE_NO_STORE_WRAPPER ) &&! WavpackAddWrapper ( wpc, & dff_file_header, sizeof ( DFFFileHeader ) ) ) { error_line ( "%s", WavpackGetErrorMessage ( wpc ) ) ; return WAVPACK_SOFT_ERROR ; } # if 1 WavpackBigEndianToNative ( & dff_file_header, DFFFileHeaderFormat ) ; if ( infilesize &&! ( config -> qmode & QMODE_IGNORE_LENGTH ) && dff_file_header. ckDataSize && dff_file_header. ckDataSize + 1 && dff_file_header. ckDataSize + 12!= infilesize ) { error_line ( "%s   is   not   a   valid  .DFF   file   (by   total   size)!", infilename ) ; return WAVPACK_SOFT_ERROR ; } if ( debug_logging_mode ) error_line ( "file   header   indicated   length   =   %lld", dff_file_header. ckDataSize ) ; # endif while ( 1 ) { if (! DoReadFile ( infile, & dff_chunk_header, sizeof ( DFFChunkHeader ), & bcount )

Fix:
<S2SV_ModStart> ; uint32_t sampleRate = 0 <S2SV_ModStart> config -> num_channels ||! config -> sample_rate
Buggy code:
 static int __ext4_expand_extra_isize ( struct inode * inode, unsigned int new_extra_isize, struct ext4_iloc * iloc, handle_t * handle, int * no_expand ) { struct ext4_inode * raw_inode ; struct ext4_xattr_ibody_header * header ; <START_BUG> int error ; <END_BUG> raw_inode = ext4_raw_inode ( iloc ) ; header = IHDR ( inode, raw_inode ) ; if (! ext4_test_inode_state ( inode, EXT4_STATE_XATTR ) || header -> h_magic!= cpu_to_le32 ( EXT4_XATTR_MAGIC ) ) { memset ( ( void * ) raw_inode + EXT4_GOOD_OLD_INODE_SIZE + EXT4_I ( inode ) -> i_extra_isize, 0, new_extra_isize - EXT4_I ( inode ) -> i_extra_isize ) ; EXT4_I ( inode ) -> i_extra_isize = new_extra_isize ; return 0 ; } error = ext4_expand_extra_isize_ea ( inode, new_extra_isize, raw_inode, handle ) ; if ( error ) { * no_expand = 1 ; } return error ; }

Fix:
<S2SV_ModStart> * header ; unsigned int inode_size = EXT4_INODE_SIZE ( inode -> i_sb ) ; struct ext4_inode_info * ei = EXT4_I ( inode ) ; int error ; if ( ( EXT4_GOOD_OLD_INODE_SIZE + ei -> i_extra_isize > inode_size ) || ( ei -> i_extra_isize & 3 ) ) { EXT4_ERROR_INODE ( inode, "bad <S2SV_blank> extra_isize <S2SV_blank> %u <S2SV_blank> (inode <S2SV_blank> size <S2SV_blank> %u)", ei -> i_extra_isize, EXT4_INODE_SIZE ( inode -> i_sb ) ) ; return - EFSCORRUPTED ; } if ( ( new_extra_isize < ei -> i_extra_isize ) || ( new_extra_isize < 4 ) || ( new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE ) ) return - EINVAL <S2SV_ModEnd> ; raw_inode =
Buggy code:
 int dwg_decode_add_object ( Dwg_Data * restrict dwg, Bit_Chain * dat, Bit_Chain * hdl_dat, long unsigned int address ) { long unsigned int objpos, restartpos ; Bit_Chain abs_dat = { NULL } ; unsigned char previous_bit ; Dwg_Object * restrict obj ; BITCODE_BL num = dwg -> num_objects ; int error = 0 ; int realloced = 0 ; abs_dat = * dat ; dat -> byte = address ; dat -> bit = 0 ; realloced = dwg_add_object ( dwg ) ; if ( realloced > 0 ) { * dat = abs_dat ; return realloced ; } obj = & dwg -> object [ num ] ; LOG_INFO ( "==========================================\\n" "Object   number:   %lu//%lX", ( unsigned long ) num, ( unsigned long ) num ) obj -> size = bit_read_MS ( dat ) ; LOG_INFO ( ",   Size:   %d   [MS]", obj -> size ) SINCE ( R_2010 ) { obj -> handlestream_size = bit_read_UMC ( dat ) ; LOG_INFO ( ",   Hdlsize:   " FORMAT_UMC "   [UMC]   ", obj -> handlestream_size ) ; obj -> bitsize = obj -> size * 8 - obj -> handlestream_size ; } objpos = bit_position ( dat ) ; obj -> address = dat -> byte ; bit_reset_chain ( dat ) ; if ( obj -> size > dat -> size ) { LOG_ERROR ( "\\nInvalid   object   size.   Would   overflow" ) ; * dat = abs_dat ; return DWG_ERR_VALUEOUTOFBOUNDS ; } dat -> size = obj -> size ; SINCE ( R_2010 ) { obj -> type = bit_read_BOT ( dat ) ; } else { obj -> type = bit_read_BS ( dat ) ; } LOG_INFO ( ",   Type:   %d   [%s]\\n", obj -> type, dat -> version >= R_2010? "BOT" : "BS" ) ; restartpos = bit_position ( dat ) ; switch ( obj -> type ) { case DWG

Fix:
<S2SV_ModStart>, restartpos ) ; obj -> supertype = DWG_SUPERTYPE_UNKNOWN <S2SV_ModStart> } obj -> <S2SV_ModEnd> type = 0 <S2SV_ModStart> } if ( is_entity ) error |= dwg_decode_UNKNOWN_ENT ( dat, obj ) ; else error |= dwg_decode_UNKNOWN_OBJ ( dat, obj ) ; if (! <S2SV_ModEnd> dat ) return <S2SV_ModStart> ; if ( error <S2SV_ModEnd> >= DWG_ERR_CRITICAL ) <S2SV_ModStart> = abs_dat ; <S2SV_ModEnd> } } if
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 char magick [ 12 ] ; Image * image ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; Quantum index ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, <START_BUG> number_planes, <END_BUG> one, offset, pixel_info_length ; ssize_t count, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { image -> page. x = ReadBlobLSBShort ( image ) ; image -> page. y = ReadBlobLSBShort ( image ) ; image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> alpha_trait = flags & 0x04? BlendPixelTrait : UndefinedPixelTrait ; number_

Fix:
<S2SV_ModStart> number_colormaps, number_planes, number_planes_filled <S2SV_ModStart> -> rows ; number_planes_filled = ( number_planes % 2 == 0 )? number_planes : number_planes + 1 ; <S2SV_ModStart> ( number_pixels * number_planes_filled <S2SV_ModEnd> )!= ( <S2SV_ModStart> ( number_pixels * number_planes_filled <S2SV_ModEnd> ) ) ThrowReaderException <S2SV_ModStart> -> rows * number_planes_filled <S2SV_ModEnd> ; pixel_info =
Buggy code:
 static void free_user ( struct kref * ref ) { struct ipmi_user * user = container_of ( ref, struct ipmi_user, refcount ) ; <START_BUG> kfree ( user ) ; <END_BUG> }

Fix:
<S2SV_ModStart> refcount ) ; cleanup_srcu_struct ( & user -> release_barrier ) ;
Buggy code:
 static void btif_fetch_local_bdaddr ( bt_bdaddr_t * local_addr ) { char val [ PROPERTY_VALUE_MAX ] = { 0 } ; uint8_t valid_bda = FALSE ; int val_size = 0 ; const uint8_t null_bdaddr [ BD_ADDR_LEN ] = { 0, 0, 0, 0, 0, 0 } ; if ( property_get ( PROPERTY_BT_BDADDR_PATH, val, NULL ) ) { int addr_fd ; BTIF_TRACE_DEBUG ( "%s,   local   bdaddr   is   stored   in   %s", __func__, val ) ; <START_BUG> if ( ( addr_fd = open ( val, O_RDONLY ) )!= - 1 ) <END_BUG> { memset ( val, 0, sizeof ( val ) ) ;  read ( addr_fd, val, FACTORY_BT_BDADDR_STORAGE_LEN ) ; <START_BUG> if ( ( string_to_bdaddr ( val, local_addr ) ) && ( memcmp ( local_addr -> address, null_bdaddr, BD_ADDR_LEN )!= 0 ) ) { valid_bda = TRUE ; BTIF_TRACE_DEBUG ( "%s:   Got   Factory   BDA   %s", __func__, val ) ; } close ( addr_fd ) ; } } if (! valid_bda ) { val_size = sizeof ( val ) ; if ( btif_config_get_str ( "Adapter", "Address", val, & val_size ) ) { string_to_bdaddr ( val, local_addr ) ; BTIF_TRACE_DEBUG ( "local   bdaddr   from   bt_config.xml   is     %s", val ) ; return ; } } if (! valid_bda ) { valid_bda = btif_fetch_property ( PERSIST_BDADDR_PROPERTY, local_addr ) ; } if (! valid_bda ) { valid_bda = btif_fetch_property ( FACTORY_BT_ADDR_PROPERTY, local_addr ) ; } if (! valid_bda ) { bdstr_t bdstr ; srand ( ( unsigned int ) ( time ( 0 ) ) ) ; local_addr -><END_BUG>

Fix:
<S2SV_ModStart> ( addr_fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart> val, O_RDONLY ) <S2SV_ModStart> ) ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> val, FACTORY_BT_BDADDR_STORAGE_LEN )
Buggy code:
 static inline int ip_ufo_append_data ( struct sock * sk, struct sk_buff_head * queue, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int hh_len, int fragheaderlen, int transhdrlen, int maxfraglen, unsigned int flags ) { struct sk_buff * skb ; int err ; if ( ( skb = skb_peek_tail ( queue ) ) == NULL ) { skb = sock_alloc_send_skb ( sk, hh_len + fragheaderlen + transhdrlen + 20, ( flags & MSG_DONTWAIT ), & err ) ; if ( skb == NULL ) return err ; skb_reserve ( skb, hh_len ) ; skb_put ( skb, fragheaderlen + transhdrlen ) ; skb_reset_network_header ( skb ) ; skb -> transport_header = skb -> network_header + fragheaderlen ; <START_BUG> skb -> ip_summed = CHECKSUM_PARTIAL ; <END_BUG> skb -> csum = 0 ; skb_shinfo ( skb ) -> gso_size = maxfraglen - fragheaderlen ; skb_shinfo ( skb ) -> gso_type = SKB_GSO_UDP ;  __skb_queue_tail ( queue, skb ) ; <START_BUG> } return skb_append_datato_frags ( sk, skb, getfrag, from, ( length - transhdrlen ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; skb -> csum = 0 ; __skb_queue_tail ( queue, skb ) ; } else if ( skb_is_gso ( skb ) ) { goto append ; } skb -> <S2SV_ModStart> ip_summed = CHECKSUM_PARTIAL <S2SV_ModEnd> ; skb_shinfo ( <S2SV_ModStart> = SKB_GSO_UDP ; append : <S2SV_ModEnd> return skb_append_datato_frags (
Buggy code:
 static int cms_copy_content ( BIO * out, BIO * in, unsigned int flags ) { unsigned char buf [ 4096 ] ; int r = 0, i ; <START_BUG> BIO * tmpout = NULL ; <END_BUG> if ( out == NULL ) tmpout = BIO_new ( BIO_s_null ( ) ) ; else if ( flags & CMS_TEXT ) {  tmpout = BIO_new ( BIO_s_mem ( ) ) ; <START_BUG> BIO_set_mem_eof_return ( tmpout, 0 ) ; } else tmpout = out ; if (! tmpout ) { CMSerr ( CMS_F_CMS_COPY_CONTENT, ERR_R_MALLOC_FAILURE ) ; goto err ; } for ( ; ; ) { i = BIO_read ( in, buf, sizeof ( buf ) ) ; if ( i <= 0 ) { if ( BIO_method_type ( in ) == BIO_TYPE_CIPHER ) { if (! BIO_get_cipher_status ( in ) ) goto err ; } if ( i < 0 ) goto err ; break ; } if ( tmpout && ( BIO_write ( tmpout, buf, i )!= i ) ) goto err ; } if ( flags & CMS_TEXT ) { if (! SMIME_text ( tmpout, out ) ) { CMSerr ( CMS_F_CMS_COPY_CONTENT, CMS_R_SMIME_TEXT_ERROR ) ; goto err ; } } r = 1 ; err : if ( tmpout && ( tmpout!= out ) ) BIO_free ( tmpout ) ; return r ; }<END_BUG>

Fix:
<S2SV_ModStart> BIO * tmpout ; tmpout = cms_get_text_bio ( out, flags ) ; if (! tmpout ) { CMSerr ( CMS_F_CMS_COPY_CONTENT, ERR_R_MALLOC_FAILURE ) ; goto err ; } for ( ; ; ) { i = BIO_read ( in, buf, sizeof ( buf ) ) ; if ( i <= 0 ) { if ( BIO_method_type ( in ) == BIO_TYPE_CIPHER ) { if (! BIO_get_cipher_status ( in ) ) goto err ; } if ( i < 0 ) goto err ; break ; } if ( tmpout && ( BIO_write ( tmpout, buf, i )!= i ) ) goto err ; } <S2SV_ModEnd> if ( flags <S2SV_ModStart> CMS_TEXT ) { <S2SV_ModEnd> if (!
Buggy code:
 <START_BUG> static inline bool unconditional ( const struct arpt_arp * arp ) <END_BUG> { static const struct arpt_arp uncond ;  return memcmp ( arp, & uncond, sizeof ( uncond ) ) == 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ( const struct arpt_entry * e <S2SV_ModEnd> ) { static <S2SV_ModStart> uncond ; return e -> target_offset == sizeof ( struct arpt_entry ) && memcmp ( & e -> <S2SV_ModEnd> arp, &
Buggy code:
 static int decode_frame_common ( AVCodecContext * avctx, PNGDecContext * s, AVFrame * p, AVPacket * avpkt ) { AVDictionary * metadata = NULL ; uint32_t tag, length ; int decode_next_dat = 0 ; int ret ; for ( ; ; ) { length = bytestream2_get_bytes_left ( & s -> gb ) ; if ( length <= 0 ) { if ( avctx -> codec_id == AV_CODEC_ID_PNG && avctx -> skip_frame == AVDISCARD_ALL ) { av_frame_set_metadata ( p, metadata ) ; return 0 ; } if ( CONFIG_APNG_DECODER && avctx -> codec_id == AV_CODEC_ID_APNG && length == 0 ) { if (! ( s -> state & PNG_IDAT ) ) return 0 ; else goto exit_loop ; } av_log ( avctx, AV_LOG_ERROR, "%d   bytes   left\\n", length ) ; if ( s -> state & PNG_ALLIMAGE && avctx -> strict_std_compliance <= FF_COMPLIANCE_NORMAL ) goto exit_loop ; ret = AVERROR_INVALIDDATA ; goto fail ; } length = bytestream2_get_be32 ( & s -> gb ) ; if ( length > 0x7fffffff || length > bytestream2_get_bytes_left ( & s -> gb ) ) { av_log ( avctx, AV_LOG_ERROR, "chunk   too   big\\n" ) ; ret = AVERROR_INVALIDDATA ; goto fail ; } tag = bytestream2_get_le32 ( & s -> gb ) ; if ( avctx -> debug & FF_DEBUG_STARTCODE ) av_log ( avctx, AV_LOG_DEBUG, "png:   tag=%c%c%c%c   length=%u\\n", ( tag & 0xff ), ( ( tag >> 8 ) & 0xff ), ( ( tag >> 16 ) & 0xff ), ( ( tag >> 24 ) & 0xff ), length ) ; if ( avctx -> codec_id == AV_CODEC_ID_PNG && avctx -> skip_frame == AVDISCARD_ALL ) { switch ( tag

Fix:
<S2SV_ModStart>, y ; av_assert0 ( s -> bit_depth > 1 ) ;
Buggy code:
 static struct sock * dccp_v6_request_recv_sock ( const struct sock * sk, struct sk_buff * skb, struct request_sock * req, struct dst_entry * dst, struct request_sock * req_unhash, bool * own_req ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; struct ipv6_pinfo * newnp ; <START_BUG> const struct ipv6_pinfo * np = inet6_sk ( sk ) ; <END_BUG> struct inet_sock * newinet ; struct dccp6_sock * newdp6 ; struct sock * newsk ; if ( skb -> protocol == htons ( ETH_P_IP ) ) { newsk = dccp_v4_request_recv_sock ( sk, skb, req, dst, req_unhash, own_req ) ; if ( newsk == NULL ) return NULL ; newdp6 = ( struct dccp6_sock * ) newsk ; newinet = inet_sk ( newsk ) ; newinet -> pinet6 = & newdp6 -> inet6 ; newnp = inet6_sk ( newsk ) ; memcpy ( newnp, np, sizeof ( struct ipv6_pinfo ) ) ; newnp -> saddr = newsk -> sk_v6_rcv_saddr ; inet_csk ( newsk ) -> icsk_af_ops = & dccp_ipv6_mapped ; newsk -> sk_backlog_rcv = dccp_v4_do_rcv ; newnp -> pktoptions = NULL ; newnp -> opt = NULL ; newnp -> mcast_oif = inet6_iif ( skb ) ; newnp -> mcast_hops = ipv6_hdr ( skb ) -> hop_limit ; dccp_sync_mss ( newsk, inet_csk ( newsk ) -> icsk_pmtu_cookie ) ; return newsk ; } if ( sk_acceptq_is_full ( sk ) ) goto out_overflow ; if (! dst ) { struct flowi6 fl6 ; dst = inet6_csk_route_req ( sk, & fl6, req, IPPROTO_DCCP ) ; if (! dst ) goto

Fix:
<S2SV_ModStart> ( sk ) ; struct ipv6_txoptions * opt <S2SV_ModStart> -> hop_limit ; opt = rcu_dereference <S2SV_ModEnd> ( np -> <S2SV_ModStart> np -> opt ) ; if ( opt ) { <S2SV_ModEnd> opt = ipv6_dup_options <S2SV_ModStart> ( newsk, opt ) ; RCU_INIT_POINTER ( newnp -> opt, opt ) ; } <S2SV_ModEnd> inet_csk ( newsk <S2SV_ModStart> ; if ( opt <S2SV_ModEnd> ) inet_csk ( <S2SV_ModStart> -> icsk_ext_hdr_len = <S2SV_ModEnd> opt -> opt_nflen <S2SV_ModStart> -> opt_nflen + <S2SV_ModEnd> opt -> opt_flen <S2SV_ModStart> opt -> opt_flen <S2SV_ModEnd> ; dccp_sync_mss (
Buggy code:
 static int apparmor_setprocattr ( struct task_struct * task, char * name, void * value, size_t size ) { char * command, * args = value ; size_t arg_size ; int error ; if ( size == 0 ) return - EINVAL ; if ( args [ size - 1 ]!= '\\0' ) { if ( size == PAGE_SIZE ) return - EINVAL ; args [ size ] = '\\0' ; } if ( current!= task ) return - EACCES ; args = value ; args = strim ( args ) ; command = strsep ( & args, "   " ) ; if (! args ) return - EINVAL ; args = skip_spaces ( args ) ; if (! * args ) return - EINVAL ; arg_size = size - ( args - ( char * ) value ) ; if ( strcmp ( name, "current" ) == 0 ) { if ( strcmp ( command, "changehat" ) == 0 ) { error = aa_setprocattr_changehat ( args, arg_size,! AA_DO_TEST ) ; } else if ( strcmp ( command, "permhat" ) == 0 ) { error = aa_setprocattr_changehat ( args, arg_size, AA_DO_TEST ) ; } else if ( strcmp ( command, "changeprofile" ) == 0 ) { error = aa_setprocattr_changeprofile ( args,! AA_ONEXEC,! AA_DO_TEST ) ; } else if ( strcmp ( command, "permprofile" ) == 0 ) { error = aa_setprocattr_changeprofile ( args,! AA_ONEXEC, AA_DO_TEST ) ; } else if ( strcmp ( command, "permipc" ) == 0 ) { error = aa_setprocattr_permipc ( args ) ; } else { struct common_audit_data sa ; COMMON_AUDIT_DATA_INIT ( & sa, NONE ) ; sa. aad. op = OP_SETPROCATTR ; sa. aad. info = name ; sa. aad. error = - EINVAL ; <START_BUG> return aa_audit ( AUDIT_APPARMOR_DENIED, NULL, GFP_KERNEL, <END_BUG> & sa, NULL ) ; } } else if ( strcmp ( name,

Fix:
<S2SV_ModStart> ( AUDIT_APPARMOR_DENIED, __aa_current_profile ( ), GFP_KERNEL, & sa, NULL <S2SV_ModEnd> ) ; }
Buggy code:
 int vp8_diamond_search_sad_c ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int_mv * best_mv, int search_param, int sad_per_bit, int * num00, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { int i, j, step ; unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; int what_stride = b -> src_stride ; unsigned char * in_what ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; unsigned char * best_address ; int tot_steps ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int best_site = 0 ; int last_site = 0 ; int ref_row ; int ref_col ; int this_row_offset ; int this_col_offset ; search_site * ss ; unsigned char * check_here ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; vp8_clamp_mv ( ref_mv, x -> mv_col_min, x -> mv_col_max, x -> mv_row_min, x -> mv_row_max ) ; ref_row = ref_mv -> as_mv. row ; ref_col = ref_mv -> as_mv. col ; * num00 = 0 ; best_mv -> as_mv. row = ref_row ; best_mv -> as_mv. col = ref_col ; in_what = ( unsigned char * ) ( base_pre + d -> offset + ( ref_row * pre_stride

Fix:
<S2SV_ModStart> in_what, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; if