nus-yam/ex-repair huggingface dataset:
Buggy code:
 int nfs3svc_decode_readlinkargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd3_readlinkargs * args ) { p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; <START_BUG> args -> buffer = page_address ( * ( rqstp -> rq_next_page ++ ) ) ; <END_BUG>  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> return 0 ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 ; <S2SV_ModStart> ) ; return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 WORD32 ih264d_parse_islice_data_cavlc ( dec_struct_t * ps_dec, dec_slice_params_t * ps_slice, UWORD16 u2_first_mb_in_slice ) { UWORD8 uc_more_data_flag ; UWORD8 u1_num_mbs, u1_mb_idx ; dec_mb_info_t * ps_cur_mb_info ; deblk_mb_t * ps_cur_deblk_mb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD16 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; WORD16 i2_cur_mb_addr ; UWORD8 u1_mbaff ; UWORD8 u1_num_mbs_next, u1_end_of_row, u1_tfr_n_mb ; WORD32 ret = OK ; ps_dec -> u1_qp = ps_slice -> u1_slice_qp ; ih264d_update_qp ( ps_dec, 0 ) ; u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; u1_mb_idx = ps_dec -> u1_mb_idx ; u1_num_mbs = u1_mb_idx ; uc_more_data_flag = 1 ; i2_cur_mb_addr = u2_first_mb_in_slice << u1_mbaff ; do { UWORD8 u1_mb_type ; ps_dec -> pv_prev_mb_parse_tu_coeff_data = ps_dec -> pv_parse_tu_coeff_data ; if ( i2_cur_mb_addr > ps_dec -> ps_cur_sps -> u2_max_mb_addr ) { ret = ERROR_MB_ADDRESS_T ; break ; } ps_cur_mb_info = ps

Fix:
<S2SV_ModStart> ps_cur_mb_info ) ; if (! uc_more_data_flag && ( 0 == ( i2_cur_mb_addr & 1 ) ) ) { return ERROR_EOB_FLUSHBITS_T ; }
Buggy code:
 PHP_FUNCTION ( msgfmt_format_message ) { zval * args ; UChar * spattern = NULL ; int spattern_len = 0 ; char * pattern = NULL ; int pattern_len = 0 ; const char * slocale = NULL ; int slocale_len = 0 ; MessageFormatter_object mf = { 0 } ; MessageFormatter_object * mfo = & mf ; if ( zend_parse_method_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, getThis ( ), "ssa", & slocale, & slocale_len, & pattern, & pattern_len, & args ) == FAILURE ) { intl_error_set ( NULL, U_ILLEGAL_ARGUMENT_ERROR, "msgfmt_format_message:   unable   to   parse   input   params", 0 TSRMLS_CC ) ; RETURN_FALSE ; <START_BUG> } <END_BUG> msgformat_data_init ( & mfo -> mf_data TSRMLS_CC ) ; if ( pattern && pattern_len ) { intl_convert_utf8_to_utf16 ( & spattern, & spattern_len, pattern, pattern_len, & INTL_DATA_ERROR_CODE ( mfo ) ) ; if ( U_FAILURE ( INTL_DATA_ERROR_CODE ( ( mfo ) ) ) ) { intl_error_set ( NULL, U_ILLEGAL_ARGUMENT_ERROR, "msgfmt_format_message:   error   converting   pattern   to   UTF-16", 0 TSRMLS_CC ) ; RETURN_FALSE ; } } else { spattern_len = 0 ; spattern = NULL ; } if ( slocale_len == 0 ) { slocale = intl_locale_get_default ( TSRMLS_C ) ; } # ifdef MSG_FORMAT_QUOTE_APOS if ( msgformat_fix_quotes ( & spattern, & spattern_len, & INTL_DATA_ERROR_CODE ( mfo ) )!= SUCCESS ) { intl_error_set ( NULL, U_INVALID_FORMAT_ERROR, "msgfmt_format_message:   error   converting   pattern   to   quote-friendly   format", 0 TSRMLS_CC ) ; RETURN_FALSE ; } # endif MSG

Fix:
<S2SV_ModStart> RETURN_FALSE ; } INTL_CHECK_LOCALE_LEN ( slocale_len ) ;
Buggy code:
 void * Sys_LoadDll ( const char * name, qboolean useSystemLib ) { <START_BUG> void * dllhandle ; <END_BUG> if ( useSystemLib ) Com_Printf ( "Trying   to   load   \\"%s\\"...\\n", name ) ; if (! useSystemLib ||! ( dllhandle = Sys_LoadLibrary ( name ) ) ) { const char * topDir ; char libPath [ MAX_OSPATH ] ; topDir = Sys_BinaryPath ( ) ; if (! * topDir ) topDir = "." ; Com_Printf ( "Trying   to   load   \\"%s\\"   from   \\"%s\\"...\\n", name, topDir ) ; Com_sprintf ( libPath, sizeof ( libPath ), "%s%c%s", topDir, PATH_SEP, name ) ; if (! ( dllhandle = Sys_LoadLibrary ( libPath ) ) ) { const char * basePath = Cvar_VariableString ( "fs_basepath" ) ; if (! basePath ||! * basePath ) basePath = "." ; if ( FS_FilenameCompare ( topDir, basePath ) ) { Com_Printf ( "Trying   to   load   \\"%s\\"   from   \\"%s\\"...\\n", name, basePath ) ; Com_sprintf ( libPath, sizeof ( libPath ), "%s%c%s", basePath, PATH_SEP, name ) ; dllhandle = Sys_LoadLibrary ( libPath ) ; } if (! dllhandle ) Com_Printf ( "Loading   \\"%s\\"   failed\\n", name ) ; } } return dllhandle ; }

Fix:
<S2SV_ModStart> * dllhandle ; if ( COM_CompareExtension ( name, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", name ) ; return NULL ; }
Buggy code:
 int keepalived_main ( int argc, char * * argv ) { bool report_stopped = true ; struct utsname uname_buf ; char * end ; set_time_now ( ) ; save_cmd_line_options ( argc, argv ) ; debug = 0 ; # ifndef _DEBUG_ prog_type = PROG_TYPE_PARENT ; # endif # ifdef _WITH_VRRP_ __set_bit ( DAEMON_VRRP, & daemon_mode ) ; # endif # ifdef _WITH_LVS_ __set_bit ( DAEMON_CHECKERS, & daemon_mode ) ; # endif # ifdef _WITH_BFD_ __set_bit ( DAEMON_BFD, & daemon_mode ) ; <START_BUG> # endif <END_BUG> openlog ( PACKAGE_NAME, LOG_PID, log_facility ) ; # ifdef _MEM_CHECK_ mem_log_init ( PACKAGE_NAME, "Parent   process" ) ; # endif if ( uname ( & uname_buf ) ) log_message ( LOG_INFO, "Unable   to   get   uname()   information   -   error   %d", errno ) ; else { os_major = ( unsigned ) strtoul ( uname_buf. release, & end, 10 ) ; if ( * end!= '.' ) os_major = 0 ; else { os_minor = ( unsigned ) strtoul ( end + 1, & end, 10 ) ; if ( * end!= '.' ) os_major = 0 ; else { if (! isdigit ( end [ 1 ] ) ) os_major = 0 ; else os_release = ( unsigned ) strtoul ( end + 1, & end, 10 ) ; } } if (! os_major ) log_message ( LOG_INFO, "Unable   to   parse   kernel   version   %s", uname_buf. release ) ; if (! config_id ) { end = strchrnul ( uname_buf. nodename, '.' ) ; config_id = MALLOC ( ( size_t ) ( end - uname_buf. nodename ) + 1 ) ; strncpy ( config_id, uname_buf. nodename, ( size_t ) ( end - uname_buf. nodename ) ) ; config_id [ end -

Fix:
<S2SV_ModStart> ; # endif umask ( 022 ) ; <S2SV_ModStart> ( ) ; global_data -> umask = umask_val ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> # ifdef _MEM_CHECK_
Buggy code:
 static void inf_gtk_certificate_manager_certificate_func ( InfXmppConnection * connection, gnutls_session_t session, InfCertificateChain * chain, gpointer user_data ) { InfGtkCertificateManager * manager ; InfGtkCertificateManagerPrivate * priv ; InfGtkCertificateDialogFlags flags ; gnutls_x509_crt_t presented_cert ; gnutls_x509_crt_t known_cert ; gchar * hostname ; gboolean match_hostname ; gboolean issuer_known ; gnutls_x509_crt_t root_cert ; int ret ; unsigned int verify ; GHashTable * table ; gboolean cert_equal ; time_t expiration_time ; InfGtkCertificateManagerQuery * query ; gchar * text ; GtkWidget * vbox ; GtkWidget * label ; GError * error ; manager = INF_GTK_CERTIFICATE_MANAGER ( user_data ) ; priv = INF_GTK_CERTIFICATE_MANAGER_PRIVATE ( manager ) ; g_object_get ( G_OBJECT ( connection ), "remote-hostname", & hostname, NULL ) ; presented_cert = inf_certificate_chain_get_own_certificate ( chain ) ; match_hostname = gnutls_x509_crt_check_hostname ( presented_cert, hostname ) ; ret = gnutls_certificate_verify_peers2 ( session, & verify ) ; error = NULL ; if ( ret!= GNUTLS_E_SUCCESS ) inf_gnutls_set_error ( & error, ret ) ; if ( error == NULL ) { issuer_known = TRUE ; if ( verify & GNUTLS_CERT_SIGNER_NOT_FOUND ) { issuer_known = FALSE ; root_cert = inf_certificate_chain_get_root_certificate ( chain ) ; ret = gnutls_x509_crt_list_verify ( inf_certificate_chain_get_raw ( chain ), inf_certificate_chain_get_n_certificates ( chain ), & root_cert, 1, NULL, 0, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, & verify ) ; if ( ret!= GNUTLS_E_SUCCESS ) inf_gnutls_set_error ( & error, ret

Fix:
<S2SV_ModStart> ret ) ; } if ( error == NULL ) <S2SV_ModEnd> if ( verify <S2SV_ModStart> verify ) ; <S2SV_ModEnd> } table =
Buggy code:
 unsigned int arpt_do_table ( struct sk_buff * skb, const struct nf_hook_state * state, struct xt_table * table ) { unsigned int hook = state -> hook ; static const char nulldevname [ IFNAMSIZ ] __attribute__ ( ( aligned ( sizeof ( long ) ) ) ) ; unsigned int verdict = NF_DROP ; const struct arphdr * arp ; struct arpt_entry * e, * * jumpstack ; const char * indev, * outdev ; const void * table_base ; unsigned int cpu, stackidx = 0 ; const struct xt_table_info * private ; struct xt_action_param acpar ; unsigned int addend ; if (! pskb_may_pull ( skb, arp_hdr_len ( skb -> dev ) ) ) return NF_DROP ; indev = state -> in? state -> in -> name : nulldevname ; outdev = state -> out? state -> out -> name : nulldevname ; local_bh_disable ( ) ; addend = xt_write_recseq_begin ( ) ; private = READ_ONCE ( table -> private ) ; cpu = smp_processor_id ( ) ; table_base = private -> entries ; jumpstack = ( struct arpt_entry * * ) private -> jumpstack [ cpu ] ; e = get_entry ( table_base, private -> hook_entry [ hook ] ) ; acpar. state = state ; acpar. hotdrop = false ; arp = arp_hdr ( skb ) ; do { const struct xt_entry_target * t ; struct xt_counters * counter ; if (! arp_packet_match ( arp, skb -> dev, indev, outdev, & e -> arp ) ) { e = arpt_next_entry ( e ) ; continue ; } counter = xt_get_this_cpu_counter ( & e -> counters ) ; ADD_COUNTER ( * counter, arp_hdr_len ( skb -> dev ), 1 ) ; t = arpt_get_target_c ( e ) ; if (! t -> u. kernel. target -> target ) { int v ; v = ( ( struct xt_standard_target * ) t ) -> verdict ; if ( v < 0 ) { if ( v!= XT_RETURN

Fix:
<S2SV_ModStart> ) ) { if ( unlikely ( stackidx >= private -> stacksize ) ) { verdict = NF_DROP ; break ; }
Buggy code:
 static inline void get_conn_text ( const conn * c, const int af, char * addr, struct sockaddr * sock_addr ) { char addr_text [ MAXPATHLEN ] ; addr_text [ 0 ] = '\\0' ; const char * protoname = "?" ; unsigned short port = 0 ; <START_BUG> switch ( af ) { <END_BUG> case AF_INET : ( void ) inet_ntop ( af, & ( ( struct sockaddr_in * ) sock_addr ) -> sin_addr, addr_text, sizeof ( addr_text ) - 1 ) ; port = ntohs ( ( ( struct sockaddr_in * ) sock_addr ) -> sin_port ) ; protoname = IS_UDP ( c -> transport )? "udp" : "tcp" ; break ; case AF_INET6 : addr_text [ 0 ] = '[' ; addr_text [ 1 ] = '\\0' ; if ( inet_ntop ( af, & ( ( struct sockaddr_in6 * ) sock_addr ) -> sin6_addr, addr_text + 1, sizeof ( addr_text ) - 2 ) ) { strcat ( addr_text, "]" ) ; } port = ntohs ( ( ( struct sockaddr_in6 * ) sock_addr ) -> sin6_port ) ; protoname = IS_UDP ( c -> transport )? "udp6" : "tcp6" ; break ; case AF_UNIX :  strncpy ( addr_text, <START_BUG> <END_BUG> ( ( struct sockaddr_un * ) sock_addr ) -> sun_path,  sizeof ( addr_text ) - 1 ) ; addr_text [ sizeof ( addr_text ) - 1 ] = '\\0' ; protoname = "unix" ; break ; } if ( strlen ( addr_text ) < 2 ) { sprintf ( addr_text, "<AF   %d>", af ) ; } if ( port ) { sprintf ( addr, "%s:%s:%u", protoname, addr_text, port ) ; } else { sprintf ( addr, "%s:%s", protoname, addr_text ) ; } }

Fix:
<S2SV_ModStart> = 0 ; size_t pathlen = 0 ; <S2SV_ModStart> case AF_UNIX : pathlen = sizeof ( <S2SV_ModEnd> ( ( struct <S2SV_ModStart> ) -> sun_path ) ; if ( MAXPATHLEN <= pathlen ) { pathlen = MAXPATHLEN - 1 ; } strncpy ( addr_text, ( ( struct sockaddr_un * ) sock_addr ) -> sun_path, pathlen ) ; addr_text [ pathlen <S2SV_ModEnd> ] = '\\0'
Buggy code:
 static int <START_BUG> mptctl_fw_download ( unsigned long arg ) <END_BUG> { struct mpt_fw_xfer __user * ufwdl = ( void __user * ) arg ; struct mpt_fw_xfer kfwdl ; if ( copy_from_user ( & kfwdl, ufwdl, sizeof ( struct mpt_fw_xfer ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::_ioctl_fwdl   -   " "Unable   to   copy   mpt_fw_xfer   struct   @   %p\\n", __FILE__, __LINE__, ufwdl ) ; return - EFAULT ; }  return mptctl_do_fw_download ( kfwdl. iocnum, kfwdl. bufp, kfwdl. fwlen ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> int mptctl_fw_download ( MPT_ADAPTER * iocp, <S2SV_ModStart> return mptctl_do_fw_download ( iocp <S2SV_ModEnd>, kfwdl.
Buggy code:
 static int cmd_mount ( void * data, const char * _input ) { ut64 off = 0 ; char * input, * oinput, * ptr, * ptr2 ; RList * list ; RListIter * iter ; RFSFile * file ; RFSRoot * root ; RFSPlugin * plug ; RFSPartition * part ; RCore * core = ( RCore * ) data ; if (! strncmp ( "kdir", _input, 4 ) ) { return cmd_mkdir ( data, _input ) ; } if (! strncmp ( "v", _input, 1 ) ) { return cmd_mv ( data, _input ) ; } input = oinput = strdup ( _input ) ; switch ( * input ) { case' ': input ++ ; if ( input [ 0 ] ==' ') <START_BUG> input ++ ; <END_BUG> ptr = strchr ( input,' ') ; if ( ptr ) { * ptr = 0 ; ptr ++ ; ptr2 = strchr ( ptr,' ') ; if ( ptr2 ) { * ptr2 = 0 ; off = r_num_math ( core -> num, ptr2 + 1 ) ; }  if (! r_fs_mount ( core -> fs, ptr, input, off ) ) <START_BUG> eprintf ( "Cannot   mount   %s\\n", input ) ; <END_BUG> } else {  <START_BUG> if (! ( ptr = r_fs_name ( core -> fs, core -> offset ) ) ) <END_BUG> eprintf ( "Unknown   filesystem   type\\n" ) ;  else if (! r_fs_mount ( core -> fs, ptr, input, core -> offset ) ) <START_BUG> <END_BUG> eprintf ( "Cannot   mount   %s\\n", input ) ;  free ( ptr ) ; } break ; case '-' : r_fs_umount ( core -> fs, input + 1 ) ; break ; case '*' : eprintf ( "List   commands   in   radare   format\\n" ) ; r_list_foreach ( core -> fs -> roots, iter, root ) { r_cons_printf ( "m   %s   %s   0x%" PFMT64x "\\n", root -> path, root -> p -> name, root -> delta ) ; } break ; case '\\0' : r_list_foreach (

Fix:
<S2SV_ModStart> =='<S2SV_blank>') { input ++ ; } <S2SV_ModEnd> ptr = strchr <S2SV_ModStart> off ) ) { <S2SV_ModStart> ) ; } } <S2SV_ModStart> ) ) ) { <S2SV_ModStart> "Unknown <S2SV_blank> filesystem <S2SV_blank> type\\n" ) ; } <S2SV_ModStart> offset ) ) { <S2SV_ModStart> input ) ; }
Buggy code:
 static int ospf6_decode_v3 ( netdissect_options * ndo, register const struct ospf6hdr * op, register const u_char * dataend ) { register const rtrid_t * ap ; register const struct lsr6 * lsrp ; register const struct lsa6_hdr * lshp ; register const struct lsa6 * lsap ; register int i ; switch ( op -> ospf6_type ) { case OSPF_TYPE_HELLO : { <START_BUG> register const struct hello6 * hellop = ( const struct hello6 * ) ( ( const uint8_t * ) op + OSPF6HDR_LEN ) ; <END_BUG> ND_PRINT ( ( ndo, "\\n\\tOptions   [%s]", bittok2str ( ospf6_option_values, "none", EXTRACT_32BITS ( & hellop -> hello_options ) ) ) ) ; ND_TCHECK ( hellop -> hello_deadint ) ; ND_PRINT ( ( ndo, "\\n\\t     Hello   Timer   %us,   Dead   Timer   %us,   Interface-ID   %s,   Priority   %u", EXTRACT_16BITS ( & hellop -> hello_helloint ), EXTRACT_16BITS ( & hellop -> hello_deadint ), ipaddr_string ( ndo, & hellop -> hello_ifid ), hellop -> hello_priority ) ) ; ND_TCHECK ( hellop -> hello_dr ) ; if ( EXTRACT_32BITS ( & hellop -> hello_dr )!= 0 ) ND_PRINT ( ( ndo, "\\n\\t     Designated   Router   %s", ipaddr_string ( ndo, & hellop -> hello_dr ) ) ) ; ND_TCHECK ( hellop -> hello_bdr ) ; if ( EXTRACT_32BITS ( & hellop -> hello_bdr )!= 0 ) ND_PRINT ( ( ndo, ",   Backup   Designated   Router   %s", ipaddr_string ( ndo, & hellop -> hello_bdr ) ) ) ; if ( ndo -> ndo_vflag > 1 ) { ND_PRINT ( ( ndo, "\\n\\t     Neighbor   List:"

Fix:
<S2SV_ModStart> op + OSPF6HDR_LEN ) ; ND_TCHECK_32BITS ( & hellop -> hello_options
Buggy code:
 int sshkey_load_file ( int fd, struct sshbuf * blob ) { u_char buf [ 1024 ] ; size_t len ; struct stat st ; <START_BUG> int r ; <END_BUG> if ( fstat ( fd, & st ) < 0 ) return SSH_ERR_SYSTEM_ERROR ; if ( ( st. st_mode & ( S_IFSOCK | S_IFCHR | S_IFIFO ) ) == 0 && st. st_size > MAX_KEY_FILE_SIZE ) return SSH_ERR_INVALID_FORMAT ;  for ( ; ; ) { <START_BUG> if ( ( len = atomicio ( read, fd, buf, sizeof ( buf ) ) ) == 0 ) { if ( errno == EPIPE ) break ; r = SSH_ERR_SYSTEM_ERROR ; goto out ; } if ( ( r = sshbuf_put ( blob, buf, len ) )!= 0 ) goto out ; if ( sshbuf_len ( blob ) > MAX_KEY_FILE_SIZE ) { r = SSH_ERR_INVALID_FORMAT ; goto out ; } } if ( ( st. st_mode & ( S_IFSOCK | S_IFCHR | S_IFIFO ) ) == 0 && st. st_size!= ( off_t ) sshbuf_len ( blob ) ) { r = SSH_ERR_FILE_CHANGED ; goto out ; } r = 0 ; out : explicit_bzero ( buf, sizeof ( buf ) ) ; if ( r!= 0 ) sshbuf_reset ( blob ) ; return r ; }<END_BUG>

Fix:
<S2SV_ModStart> ; int r, dontmax = 0 <S2SV_ModStart> return SSH_ERR_INVALID_FORMAT ; if ( ( st. st_mode & S_IFREG ) == 0 || st. st_size <= 0 ) { st. st_size = 64 * 1024 ; dontmax = 1 ; } if ( ( r = sshbuf_allocate ( blob, st. st_size ) )!= 0 || ( dontmax && ( r = sshbuf_set_max_size ( blob, st. st_size ) )!= 0 ) ) return r ;
Buggy code:
 static void nfnetlink_rcv_batch ( struct sk_buff * skb, struct nlmsghdr * nlh, u_int16_t subsys_id ) { struct sk_buff * oskb = skb ; struct net * net = sock_net ( skb -> sk ) ; const struct nfnetlink_subsystem * ss ; const struct nfnl_callback * nc ; static LIST_HEAD ( err_list ) ; u32 status ; int err ; if ( subsys_id >= NFNL_SUBSYS_COUNT ) return netlink_ack ( skb, nlh, - EINVAL ) ; replay : status = 0 ; skb = netlink_skb_clone ( oskb, GFP_KERNEL ) ; if (! skb ) return netlink_ack ( oskb, nlh, - ENOMEM ) ; nfnl_lock ( subsys_id ) ; ss = nfnl_dereference_protected ( subsys_id ) ; if (! ss ) { # ifdef CONFIG_MODULES nfnl_unlock ( subsys_id ) ; request_module ( "nfnetlink-subsys-%d", subsys_id ) ; nfnl_lock ( subsys_id ) ; ss = nfnl_dereference_protected ( subsys_id ) ; if (! ss ) # endif { nfnl_unlock ( subsys_id ) ; netlink_ack ( oskb, nlh, - EOPNOTSUPP ) ; return kfree_skb ( skb ) ; } } if (! ss -> commit ||! ss -> abort ) { nfnl_unlock ( subsys_id ) ; netlink_ack ( oskb, nlh, - EOPNOTSUPP ) ; return kfree_skb ( skb ) ; } while ( skb -> len >= nlmsg_total_size ( 0 ) ) { int msglen, type ; nlh = nlmsg_hdr ( skb ) ; err = 0 ; <START_BUG> if ( nlmsg_len ( nlh ) < sizeof ( struct nfgenmsg ) || <END_BUG> skb -> len < nlh -> nlmsg_len ) { err = - EINVAL ; goto ack ; } if (! ( nlh -> nlmsg_flags & NLM_F_REQUEST ) ) {

Fix:
<S2SV_ModStart> ; if ( nlh -> nlmsg_len < NLMSG_HDRLEN || skb -> len < nlh -> nlmsg_len || <S2SV_ModStart> struct nfgenmsg ) ) { nfnl_err_reset ( & err_list ) ; status |= NFNL_BATCH_FAILURE ; goto done <S2SV_ModEnd> ; } if
Buggy code:
 static void sg_fill_request_table ( Sg_fd * sfp, sg_req_info_t * rinfo ) { Sg_request * srp ; int val ; unsigned int ms ; val = 0 ; list_for_each_entry ( srp, & sfp -> rq_list, entry ) { if ( val > SG_MAX_QUEUE ) break ; <START_BUG> memset ( & rinfo [ val ], 0, SZ_SG_REQ_INFO ) ; <END_BUG> rinfo [ val ]. req_state = srp -> done + 1 ; rinfo [ val ]. problem = srp -> header. masked_status & srp -> header. host_status & srp -> header. driver_status ; if ( srp -> done ) rinfo [ val ]. duration = srp -> header. duration ; else { ms = jiffies_to_msecs ( jiffies ) ; rinfo [ val ]. duration = ( ms > srp -> header. duration )? ( ms - srp -> header. duration ) : 0 ; } rinfo [ val ]. orphan = srp -> orphan ; rinfo [ val ]. sg_io_owned = srp -> sg_io_owned ; rinfo [ val ]. pack_id = srp -> header. pack_id ; rinfo [ val ]. usr_ptr = srp -> header. usr_ptr ; val ++ ; } }

Fix:
<S2SV_ModStart> ) break ; <S2SV_ModEnd> rinfo [ val
Buggy code:
 int nfs3svc_decode_readdirargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd3_readdirargs * args ) { p = decode_fh ( p, & args -> fh ) ; if (! p ) return 0 ; p = xdr_decode_hyper ( p, & args -> cookie ) ; args -> verf = p ; p += 2 ; args -> dircount = ~ 0 ; args -> count = ntohl ( * p ++ ) ; <START_BUG> args -> count = min_t ( u32, args -> count, PAGE_SIZE ) ; <END_BUG> args -> buffer = page_address ( * ( rqstp -> rq_next_page ++ ) ) ;  return xdr_argsize_check ( rqstp, p ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ++ ) ; if (! xdr_argsize_check ( rqstp, p ) ) return 0 ; <S2SV_ModStart> ) ; return 1 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int _lldp_send ( struct lldpd * global, struct lldpd_hardware * hardware, u_int8_t c_id_subtype, char * c_id, int c_id_len, u_int8_t p_id_subtype, char * p_id, int p_id_len, int shutdown ) { struct lldpd_port * port ; struct lldpd_chassis * chassis ; struct lldpd_frame * frame ; int length ; u_int8_t * packet, * pos, * tlv ; struct lldpd_mgmt * mgmt ; int proto ; u_int8_t mcastaddr [ ] = LLDP_MULTICAST_ADDR ; # ifdef ENABLE_DOT1 const u_int8_t dot1 [ ] = LLDP_TLV_ORG_DOT1 ; struct lldpd_vlan * vlan ; struct lldpd_ppvid * ppvid ; struct lldpd_pi * pi ; # endif # ifdef ENABLE_DOT3 const u_int8_t dot3 [ ] = LLDP_TLV_ORG_DOT3 ; # endif # ifdef ENABLE_LLDPMED int i ; const u_int8_t med [ ] = LLDP_TLV_ORG_MED ; # endif # ifdef ENABLE_CUSTOM struct lldpd_custom * custom ; # endif port = & hardware -> h_lport ; chassis = port -> p_chassis ; length = hardware -> h_mtu ; if ( ( packet = ( u_int8_t * ) calloc ( 1, length ) ) == NULL ) return ENOMEM ; pos = packet ; if (! ( POKE_BYTES ( mcastaddr, sizeof ( mcastaddr ) ) && POKE_BYTES ( & hardware -> h_lladdr, ETHER_ADDR_LEN ) && POKE_UINT16 ( ETHERTYPE_LLDP ) ) ) goto toobig ; if (! ( POKE_START_LLDP_TLV ( LLDP_TLV_CHASSIS_ID ) && POKE_UINT8 ( c_id_subtype ) && POKE_BYTES ( c_id, c_id_len ) && POKE_END_LLDP_

Fix:
<S2SV_ModStart> m_family ) ; if ( proto == LLDP_MGMT_ADDR_NONE ) continue <S2SV_ModEnd> ; if (
Buggy code:
 struct clock_source * dcn10_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( struct dce110_clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dce112_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;
Buggy code:
 static bool write_hci_command ( hci_packet_t type, const void * packet, size_t length ) { int sock = socket ( AF_INET, SOCK_STREAM, IPPROTO_TCP ) ; if ( sock == INVALID_FD ) goto error ; struct sockaddr_in addr ; addr. sin_family = AF_INET ; addr. sin_addr. s_addr = htonl ( 0x7F000001 ) ; addr. sin_port = htons ( 8873 ) ; <START_BUG> if ( connect ( sock, ( const struct sockaddr * ) & addr, sizeof ( addr ) ) == - 1 ) <END_BUG> goto error ;  if ( send ( sock, & type, 1, 0 )!= 1 ) <START_BUG> goto error ; <END_BUG> if ( send ( sock, & length, 2, 0 )!= 2 )  goto error ; <START_BUG> if ( send ( sock, packet, length, 0 )!= ( ssize_t ) length ) <END_BUG> goto error ; close ( sock ) ; return true ; error : ; close ( sock ) ; return false ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> addr ) ) ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> 2, 0 ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> length, 0 )
Buggy code:
 static void diff_bytes_c ( uint8_t * dst, const uint8_t * src1, const uint8_t * src2, int w ) { long i ; # if! HAVE_FAST_UNALIGNED if ( ( long ) src2 & ( sizeof ( long ) - 1 ) ) { for ( i = 0 ; i + 7 < w ; i += 8 ) { dst [ i + 0 ] = src1 [ i + 0 ] - src2 [ i + 0 ] ; dst [ i + 1 ] = src1 [ i + 1 ] - src2 [ i + 1 ] ; dst [ i + 2 ] = src1 [ i + 2 ] - src2 [ i + 2 ] ; dst [ i + 3 ] = src1 [ i + 3 ] - src2 [ i + 3 ] ; dst [ i + 4 ] = src1 [ i + 4 ] - src2 [ i + 4 ] ; dst [ i + 5 ] = src1 [ i + 5 ] - src2 [ i + 5 ] ; dst [ i + 6 ] = src1 [ i + 6 ] - src2 [ i + 6 ] ; dst [ i + 7 ] = src1 [ i + 7 ] - src2 [ i + 7 ] ; } } else # endif <START_BUG> for ( i = 0 ; i <= w - sizeof ( long ) ; i += sizeof ( long ) ) { <END_BUG> long a = * ( long * ) ( src1 + i ) ; long b = * ( long * ) ( src2 + i ) ; * ( long * ) ( dst + i ) = ( ( a | pb_80 ) - ( b & pb_7f ) ) ^ ( ( a ^ b ^ pb_80 ) & pb_80 ) ; } for ( ; i < w ; i ++ ) dst [ i + 0 ] = src1 [ i + 0 ] - src2 [ i + 0 ] ; }

Fix:
<S2SV_ModStart> <= w - ( int )
Buggy code:
 int main ( int argc, char * * argv ) { int c ; bool lock_memory = false ; bool do_daemonize = false ; bool preallocate = false ; int maxcore = 0 ; char * username = NULL ; char * pid_file = NULL ; struct passwd * pw ; struct rlimit rlim ; char * buf ; char unit = '\\0' ; int size_max = 0 ; int retval = EXIT_SUCCESS ; static int * l_socket = NULL ; static int * u_socket = NULL ; bool protocol_specified = false ; bool tcp_specified = false ; bool udp_specified = false ; bool start_lru_maintainer = true ; bool start_lru_crawler = true ; bool start_assoc_maint = true ; enum hashfunc_type hash_type = MURMUR3_HASH ; uint32_t tocrawl ; uint32_t slab_sizes [ MAX_NUMBER_OF_SLAB_CLASSES ] ; bool use_slab_sizes = false ; char * slab_sizes_unparsed = NULL ; bool slab_chunk_size_changed = false ; # ifdef EXTSTORE void * storage = NULL ; char * storage_file = NULL ; struct extstore_conf ext_cf ; # endif char * subopts, * subopts_orig ; char * subopts_value ; enum { MAXCONNS_FAST = 0, HASHPOWER_INIT, NO_HASHEXPAND, SLAB_REASSIGN, SLAB_AUTOMOVE, SLAB_AUTOMOVE_RATIO, SLAB_AUTOMOVE_WINDOW, TAIL_REPAIR_TIME, HASH_ALGORITHM, LRU_CRAWLER, LRU_CRAWLER_SLEEP, LRU_CRAWLER_TOCRAWL, LRU_MAINTAINER, HOT_LRU_PCT, WARM_LRU_PCT, HOT_MAX_FACTOR, WARM_MAX_FACTOR, TEMPORARY_TTL, IDLE_TIMEOUT, WATCHER_LOGBUF_SIZE, WORKER_LOGBUF_SIZE, SLAB_SIZES, SLAB_CHUNK_MAX, TRACK_SIZES, NO_INLINE_ASCII_RESP, MODERN, NO_MODER

Fix:
<S2SV_ModStart> } if ( <S2SV_ModEnd> udp_specified && settings
Buggy code:
 static int write_superframe_index ( vpx_codec_alg_priv_t * ctx ) { uint8_t marker = 0xc0 ; unsigned int mask ; int mag, index_sz ; assert ( ctx -> pending_frame_count ) ; assert ( ctx -> pending_frame_count <= 8 ) ; marker |= ctx -> pending_frame_count - 1 ; for ( mag = 0, mask = 0xff ; mag < 4 ; mag ++ ) { if ( ctx -> pending_frame_magnitude < mask ) break ; mask <<= 8 ; mask |= 0xff ; } marker |= mag << 3 ; index_sz = 2 + ( mag + 1 ) * ctx -> pending_frame_count ; if ( ctx -> pending_cx_data_sz + index_sz < ctx -> cx_data_sz ) { uint8_t * x = ctx -> pending_cx_data + ctx -> pending_cx_data_sz ; <START_BUG> int i, j ; <END_BUG> * x ++ = marker ; for ( i = 0 ; i < ctx -> pending_frame_count ; i ++ ) { unsigned int this_sz = ( unsigned int ) ctx -> pending_frame_sizes [ i ] ; for ( j = 0 ; j <= mag ; j ++ ) { * x ++ = this_sz & 0xff ; this_sz >>= 8 ; } } * x ++ = marker ; ctx -> pending_cx_data_sz += index_sz ;  } <START_BUG> return index_sz ; }<END_BUG>

Fix:
<S2SV_ModStart>, j ; # ifdef TEST_SUPPLEMENTAL_SUPERFRAME_DATA uint8_t marker_test = 0xc0 ; int mag_test = 2 ; int frames_test = 4 ; int index_sz_test = 2 + mag_test * frames_test ; marker_test |= frames_test - 1 ; marker_test |= ( mag_test - 1 ) << 3 ; * x ++ = marker_test ; for ( i = 0 ; i < mag_test * frames_test ; ++ i ) * x ++ = 0 ; * x ++ = marker_test ; ctx -> pending_cx_data_sz += index_sz_test ; printf ( "Added <S2SV_blank> supplemental <S2SV_blank> superframe <S2SV_blank> data\\n" ) ; # endif <S2SV_ModStart> += index_sz ; # ifdef TEST_SUPPLEMENTAL_SUPERFRAME_DATA index_sz += index_sz_test ; # endif
Buggy code:
 static grub_err_t find_file ( const char * currpath, grub_fshelp_node_t currroot, grub_fshelp_node_t * currfound, struct grub_fshelp_find_file_closure * c ) { <START_BUG> # ifndef _MSC_VER <END_BUG>  char fpath [ grub_strlen ( currpath ) + 1 ] ; <START_BUG> # else char * fpath = grub_malloc ( grub_strlen ( currpath ) + 1 ) ; <END_BUG> # endif  char * name = fpath ; char * next ; enum grub_fshelp_filetype type = GRUB_FSHELP_DIR ; grub_fshelp_node_t currnode = currroot ; grub_fshelp_node_t oldnode = currroot ; c -> currroot = currroot ; grub_strncpy ( fpath, currpath, grub_strlen ( currpath ) + 1 ) ; while ( * name == '//' ) name ++ ; if (! * name ) { <START_BUG> * currfound = currnode ; <END_BUG> return 0 ; } for ( ; ; ) { int found ; struct find_file_closure cc ; next = grub_strchr ( name, '//' ) ; if ( next ) { while ( * next == '//' ) * ( next ++ ) = '\\0' ; } if ( type!= GRUB_FSHELP_DIR ) { free_node ( currnode, c ) ;  return grub_error ( GRUB_ERR_BAD_FILE_TYPE, "not   a   directory" ) ; <START_BUG> } cc. name = name ; cc. type = & type ; cc. oldnode = & oldnode ; cc. currnode = & currnode ; found = c -> iterate_dir ( currnode, iterate, & cc ) ; if (! found ) { <END_BUG> if ( grub_errno )  <START_BUG> return grub_errno ; <END_BUG> break ; } if ( type == GRUB_FSHELP_SYMLINK ) { char * symlink ; if ( ++ ( c -> symlinknest ) == 8 ) { free_node ( currnode, c ) ; free_node ( oldnode, c ) ;  return grub_error ( GRUB_ERR_SYMLINK_LOOP, <START_BUG> "too   deep   nesting   of<END_BUG>

Fix:
<S2SV_ModStart> c ) { char * fpath = grub_malloc ( <S2SV_ModEnd> grub_strlen ( currpath <S2SV_ModStart> ) + 1 ) ; char * name = fpath ; char * next ; enum grub_fshelp_filetype type = GRUB_FSHELP_DIR ; grub_fshelp_node_t currnode = currroot ; grub_fshelp_node_t oldnode = currroot ; c -> currroot = currroot ; grub_strncpy ( fpath, currpath, <S2SV_ModEnd> grub_strlen ( currpath <S2SV_ModStart> 1 ) ; <S2SV_ModEnd> while ( * <S2SV_ModStart> currfound = currnode ; free ( fpath ) <S2SV_ModStart> c ) ; free ( fpath ) ; <S2SV_ModStart> ( grub_errno ) { free ( fpath ) ; <S2SV_ModStart> return grub_errno ; } <S2SV_ModStart> c ) ; free ( fpath ) ; <S2SV_ModStart> oldnode, c ) ; free ( fpath <S2SV_ModStart> c ) ; free ( fpath ) ; <S2SV_ModStart> = type ; free ( fpath ) ; <S2SV_ModStart> next ; } free ( fpath ) ;
Buggy code:
 int ip6_fragment ( struct net * net, struct sock * sk, struct sk_buff * skb, int ( * output ) ( struct net *, struct sock *, struct sk_buff * ) ) { struct sk_buff * frag ; struct rt6_info * rt = ( struct rt6_info * ) skb_dst ( skb ) ; struct ipv6_pinfo * np = skb -> sk &&! dev_recursion_level ( )? inet6_sk ( skb -> sk ) : NULL ; struct ipv6hdr * tmp_hdr ; struct frag_hdr * fh ; unsigned int mtu, hlen, left, len ; int hroom, troom ; __be32 frag_id ; int ptr, offset = 0, err = 0 ; u8 * prevhdr, nexthdr = 0 ; <START_BUG> hlen = ip6_find_1stfragopt ( skb, & prevhdr ) ; <END_BUG> nexthdr = * prevhdr ; mtu = ip6_skb_dst_mtu ( skb ) ; if ( unlikely (! skb -> ignore_df && skb -> len > mtu ) ) goto fail_toobig ; if ( IP6CB ( skb ) -> frag_max_size ) { if ( IP6CB ( skb ) -> frag_max_size > mtu ) goto fail_toobig ; mtu = IP6CB ( skb ) -> frag_max_size ; if ( mtu < IPV6_MIN_MTU ) mtu = IPV6_MIN_MTU ; } if ( np && np -> frag_size < mtu ) { if ( np -> frag_size ) mtu = np -> frag_size ; } if ( mtu < hlen + sizeof ( struct frag_hdr ) + 8 ) goto fail_toobig ; mtu -= hlen + sizeof ( struct frag_hdr ) ; frag_id = ipv6_select_ident ( net, & ipv6_hdr ( skb ) -> daddr, & ipv6_hdr ( skb ) -> saddr ) ; if ( skb -> ip_summed == CHECKSUM_PARTIAL && ( err = skb_checksum_help ( skb ) ) ) goto fail ; hroom = LL_RESERVED_SPACE ( rt -> dst. dev ) ; if ( skb_has

Fix:
<S2SV_ModStart> prevhdr ) ; if ( hlen < 0 ) { err = hlen ; goto fail ; }
Buggy code:
 <START_BUG> int vp8_denoiser_filter_sse2 ( YV12_BUFFER_CONFIG * mc_running_avg, <END_BUG> YV12_BUFFER_CONFIG * running_avg, MACROBLOCK * signal, unsigned int motion_magnitude, int y_offset, int uv_offset ) {  unsigned char * sig = signal -> thismb ; <START_BUG> int sig_stride = 16 ; <END_BUG> unsigned char * mc_running_avg_y = mc_running_avg -> y_buffer + y_offset ;  int mc_avg_y_stride = mc_running_avg -> y_stride ; <START_BUG> unsigned char * running_avg_y = running_avg -> y_buffer + y_offset ; <END_BUG> int avg_y_stride = running_avg -> y_stride ; int r ;  __m128i acc_diff = _mm_setzero_si128 ( ) ; <START_BUG> const __m128i k_0 = _mm_setzero_si128 ( ) ; const __m128i k_4 = _mm_set1_epi8 ( 4 ) ; const __m128i k_8 = _mm_set1_epi8 ( 8 ) ; const __m128i k_16 = _mm_set1_epi8 ( 16 ) ; const __m128i l3 = _mm_set1_epi8 ( <END_BUG> ( motion_magnitude <= MOTION_MAGNITUDE_THRESHOLD )? 7 : 6 ) ;  const __m128i l32 = _mm_set1_epi8 ( 2 ) ; const __m128i l21 = _mm_set1_epi8 ( 1 ) ; for ( r = 0 ; r < 16 ; ++ r ) { const __m128i v_sig = _mm_loadu_si128 ( ( __m128i * ) ( & sig [ 0 ] ) ) ; const __m128i v_mc_running_avg_y = _mm_loadu_si128 ( ( __m128i * ) ( & mc_running_avg_y [ 0 ] ) ) ; __m128i v_running_avg_y ; const __m128i pdiff = _mm_subs_epu8 ( v_mc_running_avg_y, v_sig ) ; const __m128i ndiff = _mm_subs

Fix:
<S2SV_ModStart> int vp8_denoiser_filter_sse2 ( <S2SV_ModEnd> unsigned char * <S2SV_ModStart> unsigned char * mc_running_avg_y, int mc_avg_y_stride, <S2SV_ModEnd> unsigned char * <S2SV_ModStart> unsigned char * running_avg_y, int avg_y_stride, <S2SV_ModEnd> unsigned char * <S2SV_ModStart> unsigned char * sig, int sig_stride, unsigned int motion_magnitude, int increase_denoising ) { unsigned char * running_avg_y_start = running_avg_y ; unsigned char * sig_start = sig ; unsigned int sum_diff_thresh <S2SV_ModEnd> ; int r <S2SV_ModStart> int r ; int shift_inc = ( increase_denoising && <S2SV_ModEnd> motion_magnitude <= MOTION_MAGNITUDE_THRESHOLD <S2SV_ModStart> MOTION_MAGNITUDE_THRESHOLD )? 1 : 0 ; __m128i acc_diff = _mm_setzero_si128 ( ) ; const __m128i k_0 = _mm_setzero_si128 ( ) ; const __m128i k_4 = _mm_set1_epi8 ( 4 + shift_inc ) ; const __m128i k_8 = _mm_set1
Buggy code:
 void vp9_rd_pick_intra_mode_sb ( VP9_COMP * cpi, MACROBLOCK * x, <START_BUG> int * returnrate, int64_t * returndist, <END_BUG> BLOCK_SIZE bsize, PICK_MODE_CONTEXT * ctx, int64_t best_rd ) { VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ;  int rate_y = 0, rate_uv = 0, rate_y_tokenonly = 0, rate_uv_tokenonly = 0 ; <START_BUG> int y_skip = 0, uv_skip = 0 ; <END_BUG> int64_t dist_y = 0, dist_uv = 0, tx_cache [ TX_MODES ] = { 0 } ;  TX_SIZE max_uv_tx_size ; x -> skip_encode = 0 ; ctx -> skip = 0 ; xd -> mi [ 0 ] -> mbmi. ref_frame [ 0 ] = INTRA_FRAME ; <START_BUG> if ( bsize >= BLOCK_8X8 ) { <END_BUG> if ( rd_pick_intra_sby_mode ( cpi, x, & rate_y, & rate_y_tokenonly,  & dist_y, & y_skip, bsize, tx_cache, <START_BUG> best_rd ) >= best_rd ) { <END_BUG> * returnrate = INT_MAX ;  <START_BUG> return ; <END_BUG> }  max_uv_tx_size = get_uv_tx_size_impl ( xd -> mi [ 0 ] -> mbmi. tx_size, bsize ) ; <START_BUG> rd_pick_intra_sbuv_mode ( cpi, x, ctx, & rate_uv, & rate_uv_tokenonly, <END_BUG> & dist_uv, & uv_skip, bsize, max_uv_tx_size ) ;  <START_BUG> } else { <END_BUG> y_skip = 0 ; if ( rd_pick_intra_sub_8x8_y_mode ( cpi, x, & rate_y, & rate_y_tokenonly, & dist_y, best_rd ) >= best_rd ) { * returnrate = INT_MAX ; return ; } max_uv_tx_size = get_uv_tx_size_impl ( xd -> mi [

Fix:
<S2SV_ModStart> * x, RD_COST * rd_cost, <S2SV_ModEnd> BLOCK_SIZE bsize, <S2SV_ModStart> -> e_mbd ; struct macroblockd_plane * const pd = xd -> plane ; <S2SV_ModStart> dist_uv = 0 <S2SV_ModEnd> ; TX_SIZE max_uv_tx_size <S2SV_ModStart> = INTRA_FRAME ; xd -> mi [ 0 ] -> mbmi. ref_frame [ 1 ] = NONE ; <S2SV_ModStart>, bsize, <S2SV_ModEnd> best_rd ) >= <S2SV_ModStart> best_rd ) { rd_cost -> rate <S2SV_ModEnd> = INT_MAX ; <S2SV_ModStart> ; return ; } } else { y_skip = 0 ; if ( rd_pick_intra_sub_8x8_y_mode ( cpi, x, & rate_y, & rate_y_tokenonly, & dist_y, best_rd ) >= best_rd ) { rd_cost -> rate = INT_MAX ; return ; } <S2SV_ModStart> tx_size, bsize, pd [ 1 ]. subsampling_x, pd [ 1 ]. subsampling_y <S2SV_ModStart> & uv_skip, MAX ( BLOCK_8X8, bsize ), <S2SV_ModEnd> max_uv_tx_size ) ; <S2SV_ModStart> max_uv_tx_
Buggy code:
 int main ( int argc, char * * argv ) { FILE * infile = NULL ; vpx_codec_ctx_t codec ; vpx_codec_enc_cfg_t cfg ; int frame_count = 0 ; vpx_image_t raw ; vpx_codec_err_t res ; VpxVideoInfo info = { 0 } ; VpxVideoWriter * writer = NULL ; const VpxInterface * encoder = NULL ; const int fps = 30 ; const int bitrate = 200 ; int keyframe_interval = 0 ; const char * codec_arg = NULL ; const char * width_arg = NULL ; const char * height_arg = NULL ; const char * infile_arg = NULL ; const char * outfile_arg = NULL ; const char * keyframe_interval_arg = NULL ; exec_name = argv [ 0 ] ; if ( argc < 7 ) die ( "Invalid   number   of   arguments" ) ; codec_arg = argv [ 1 ] ; width_arg = argv [ 2 ] ; height_arg = argv [ 3 ] ; infile_arg = argv [ 4 ] ; outfile_arg = argv [ 5 ] ; keyframe_interval_arg = argv [ 6 ] ; encoder = get_vpx_encoder_by_name ( codec_arg ) ; if (! encoder ) die ( "Unsupported   codec." ) ; info. codec_fourcc = encoder -> fourcc ; info. frame_width = strtol ( width_arg, NULL, 0 ) ; info. frame_height = strtol ( height_arg, NULL, 0 ) ; info. time_base. numerator = 1 ; info. time_base. denominator = fps ; if ( info. frame_width <= 0 || info. frame_height <= 0 || ( info. frame_width % 2 )!= 0 || ( info. frame_height % 2 )!= 0 ) { die ( "Invalid   frame   size:   %dx%d", info. frame_width, info. frame_height ) ; } if (! vpx_img_alloc ( & raw, VPX_IMG_FMT_I420, info. frame_width, info. frame_height, 1 ) ) { die ( "Failed   to   allocate   image." ) ; } keyframe_interval = strtol ( keyframe_interval_arg, NULL, 0 ) ; if (

Fix:
<S2SV_ModStart> ( encoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart> ( encoder -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart>, encoder -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart> ) ; } while ( <S2SV_ModStart>, writer ) ) { }
Buggy code:
 int socket_create ( uint16_t port ) { int sfd = - 1 ; int yes = 1 ; # ifdef WIN32 WSADATA wsa_data ; if (! wsa_init ) { if ( WSAStartup ( MAKEWORD ( 2, 2 ), & wsa_data )!= ERROR_SUCCESS ) { fprintf ( stderr, "WSAStartup   failed!\\n" ) ; ExitProcess ( - 1 ) ; } wsa_init = 1 ; } # endif struct sockaddr_in saddr ; if ( 0 > ( sfd = socket ( PF_INET, SOCK_STREAM, IPPROTO_TCP ) ) ) { perror ( "socket()" ) ; return - 1 ; } if ( setsockopt ( sfd, SOL_SOCKET, SO_REUSEADDR, ( void * ) & yes, sizeof ( int ) ) == - 1 ) { perror ( "setsockopt()" ) ; socket_close ( sfd ) ; return - 1 ; } memset ( ( void * ) & saddr, 0, sizeof ( saddr ) ) ; saddr. sin_family = AF_INET ; <START_BUG> saddr. sin_addr. s_addr = htonl ( INADDR_ANY ) ; <END_BUG> saddr. sin_port = htons ( port ) ; if ( 0 > bind ( sfd, ( struct sockaddr * ) & saddr, sizeof ( saddr ) ) ) { perror ( "bind()" ) ; socket_close ( sfd ) ; return - 1 ; } if ( listen ( sfd, 1 ) == - 1 ) { perror ( "listen()" ) ; socket_close ( sfd ) ; return - 1 ; } return sfd ; }

Fix:
<S2SV_ModStart> = htonl ( INADDR_LOOPBACK <S2SV_ModEnd> ) ; saddr
Buggy code:
 SYSCALL_DEFINE6 ( sendto, int, fd, void __user *, buff, size_t, len, unsigned int, flags, struct sockaddr __user *, addr, int, addr_len ) { struct socket * sock ; struct sockaddr_storage address ; int err ; struct msghdr msg ; struct iovec iov ; int fput_needed ; if ( len > INT_MAX ) <START_BUG> len = INT_MAX ; <END_BUG> sock = sockfd_lookup_light ( fd, & err, & fput_needed ) ; if (! sock ) goto out ; iov. iov_base = buff ; iov. iov_len = len ; msg. msg_name = NULL ; iov_iter_init ( & msg. msg_iter, WRITE, & iov, 1, len ) ; msg. msg_control = NULL ; msg. msg_controllen = 0 ; msg. msg_namelen = 0 ; if ( addr ) { err = move_addr_to_kernel ( addr, addr_len, & address ) ; if ( err < 0 ) goto out_put ; msg. msg_name = ( struct sockaddr * ) & address ; msg. msg_namelen = addr_len ; } if ( sock -> file -> f_flags & O_NONBLOCK ) flags |= MSG_DONTWAIT ; msg. msg_flags = flags ; err = sock_sendmsg ( sock, & msg, len ) ; out_put : fput_light ( sock -> file, fput_needed ) ; out : return err ; }

Fix:
<S2SV_ModStart> len = INT_MAX ; if ( unlikely (! access_ok ( VERIFY_READ, buff, len ) ) ) return - EFAULT
Buggy code:
 static Sdb * store_versioninfo_gnu_verneed ( ELFOBJ * bin, Elf_ ( Shdr ) * shdr, int sz ) { ut8 * end, * need = NULL ; const char * section_name = "" ; Elf_ ( Shdr ) * link_shdr = NULL ; const char * link_section_name = "" ; Sdb * sdb_vernaux = NULL ; Sdb * sdb_version = NULL ; Sdb * sdb = NULL ; int i, cnt ; if (! bin ||! bin -> dynstr ) { return NULL ; } if ( shdr -> sh_link > bin -> ehdr. e_shnum ) { return NULL ; } if ( shdr -> sh_size < 1 ) { return NULL ; } sdb = sdb_new0 ( ) ; if (! sdb ) { return NULL ; } link_shdr = & bin -> shdr [ shdr -> sh_link ] ; if ( bin -> shstrtab && shdr -> sh_name < bin -> shstrtab_size ) { section_name = & bin -> shstrtab [ shdr -> sh_name ] ; } if ( bin -> shstrtab && link_shdr -> sh_name < bin -> shstrtab_size ) { link_section_name = & bin -> shstrtab [ link_shdr -> sh_name ] ; } if (! ( need = ( ut8 * ) calloc ( R_MAX ( 1, shdr -> sh_size ), sizeof ( ut8 ) ) ) ) { bprintf ( "Warning:   Cannot   allocate   memory   for   Elf_(Verneed)\\n" ) ; goto beach ; } end = need + shdr -> sh_size ; sdb_set ( sdb, "section_name", section_name, 0 ) ; sdb_num_set ( sdb, "num_entries", shdr -> sh_info, 0 ) ; sdb_num_set ( sdb, "addr", shdr -> sh_addr, 0 ) ; sdb_num_set ( sdb, "offset", shdr -> sh_offset, 0 ) ; sdb_num_set ( sdb, "link", shdr -> sh_link, 0 )

Fix:
<S2SV_ModStart> 0 ) ; st32 vnaux = entry -> vn_aux ; if ( vnaux < 1 ) { goto beach ; } vstart += vnaux <S2SV_ModEnd> ; for (
Buggy code:
 static int chmd_read_headers ( struct mspack_system * sys, struct mspack_file * fh, struct mschmd_header * chm, int entire ) { unsigned int section, name_len, x, errors, num_chunks ; unsigned char buf [ 0x54 ], * chunk = NULL, * name, * p, * end ; struct mschmd_file * fi, * link = NULL ; off_t offset, length ; int num_entries ; chm -> files = NULL ; chm -> sysfiles = NULL ; chm -> chunk_cache = NULL ; chm -> sec0. base. chm = chm ; chm -> sec0. base. id = 0 ; chm -> sec1. base. chm = chm ; chm -> sec1. base. id = 1 ; chm -> sec1. content = NULL ; chm -> sec1. control = NULL ; chm -> sec1. spaninfo = NULL ; chm -> sec1. rtable = NULL ; if ( sys -> read ( fh, & buf [ 0 ], chmhead_SIZEOF )!= chmhead_SIZEOF ) { return MSPACK_ERR_READ ; } if ( EndGetI32 ( & buf [ chmhead_Signature ] )!= 0x46535449 ) { return MSPACK_ERR_SIGNATURE ; } if ( mspack_memcmp ( & buf [ chmhead_GUID1 ], & guids [ 0 ], 32L )!= 0 ) { D ( ( "incorrect   GUIDs" ) ) return MSPACK_ERR_SIGNATURE ; } chm -> version = EndGetI32 ( & buf [ chmhead_Version ] ) ; chm -> timestamp = EndGetM32 ( & buf [ chmhead_Timestamp ] ) ; chm -> language = EndGetI32 ( & buf [ chmhead_LanguageID ] ) ; if ( chm -> version > 3 ) { sys -> message ( fh, "WARNING;   CHM   version   >   3" ) ; } if ( sys -> read ( fh, & buf [ 0 ], chmhst3_SIZEOF )!= chmhst3_SIZEOF ) { return MSPACK_ERR_READ ; } if ( read_off64 ( & offset, & buf [ chmhst_

Fix:
<S2SV_ModStart> goto chunk_end ; <S2SV_ModEnd> name = p <S2SV_ModStart> ( length ) ; if ( name_len < 2 ||! name [ 0 ] ||! name [ 1 ] ) continue
Buggy code:
 static int input_default_setkeycode ( struct input_dev * dev, const struct input_keymap_entry * ke, unsigned int * old_keycode ) { unsigned int index ; int error ; int i ; if (! dev -> keycodesize ) return - EINVAL ; if ( ke -> flags & INPUT_KEYMAP_BY_INDEX ) { index = ke -> index ; } else { error = input_scancode_to_scalar ( ke, & index ) ; if ( error ) return error ; } if ( index >= dev -> keycodemax ) return - EINVAL ; if ( dev -> keycodesize < sizeof ( ke -> keycode ) && ( ke -> keycode >> ( dev -> keycodesize * 8 ) ) ) return - EINVAL ; switch ( dev -> keycodesize ) { case 1 : { u8 * k = ( u8 * ) dev -> keycode ; * old_keycode = k [ index ] ; k [ index ] = ke -> keycode ; break ; } case 2 : { u16 * k = ( u16 * ) dev -> keycode ; * old_keycode = k [ index ] ; k [ index ] = ke -> keycode ; break ; } default : { u32 * k = ( u32 * ) dev -> keycode ; * old_keycode = k [ index ] ; k [ index ] = ke -> keycode ; break ; } } <START_BUG> __clear_bit ( * old_keycode, dev -> keybit ) ; <END_BUG>  __set_bit ( ke -> keycode, dev -> keybit ) ; <START_BUG> <END_BUG> for ( i = 0 ; i < dev -> keycodemax ; i ++ ) {  if ( input_fetch_keycode ( dev, i ) == * old_keycode ) { __set_bit ( * old_keycode, dev -> keybit ) ; break ; } } return 0 ; }

Fix:
<S2SV_ModStart> ; } } if ( * old_keycode <= KEY_MAX ) { <S2SV_ModStart> keybit ) ; for ( i = 0 ; i < dev -> keycodemax ; i ++ ) { if ( input_fetch_keycode ( dev, i ) == * old_keycode ) { __set_bit ( * old_keycode <S2SV_ModEnd>, dev -> <S2SV_ModStart> keybit ) ; break ; } } } __set_bit ( ke -> keycode, dev -> keybit ) ; return 0 ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 void vp9_init_second_pass_spatial_svc ( VP9_COMP * cpi ) { SVC * const svc = & cpi -> svc ; int i ; for ( i = 0 ; i < svc -> number_spatial_layers ; ++ i ) { <START_BUG> struct twopass_rc * const twopass = & svc -> layer_context [ i ]. twopass ; <END_BUG> svc -> spatial_layer_id = i ; vp9_init_second_pass ( cpi ) ; twopass -> total_stats. spatial_layer_id = i ; twopass -> total_left_stats. spatial_layer_id = i ; } svc -> spatial_layer_id = 0 ; }

Fix:
<S2SV_ModStart> i ) { TWO_PASS <S2SV_ModEnd> * const twopass
Buggy code:
 void rpki_rtr_print ( netdissect_options * ndo, register const u_char * pptr, register u_int len ) { <START_BUG> u_int tlen, pdu_type, pdu_len ; <END_BUG> const u_char * tptr ; const rpki_rtr_pdu * pdu_header ; tptr = pptr ; tlen = len ; if (! ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, ",   RPKI-RTR" ) ) ; return ; }  while ( tlen >= sizeof ( rpki_rtr_pdu ) ) { <START_BUG> ND_TCHECK2 ( * tptr, sizeof ( rpki_rtr_pdu ) ) ; pdu_header = ( const rpki_rtr_pdu * ) tptr ; pdu_type = pdu_header -> pdu_type ; pdu_len = EXTRACT_32BITS ( pdu_header -> length ) ; ND_TCHECK2 ( * tptr, pdu_len ) ; if (! pdu_type ||! pdu_len ) { break ; } if ( tlen < pdu_len ) { goto trunc ; } <END_BUG> if ( rpki_rtr_pdu_print ( ndo, tptr, 8 ) )  goto trunc ; tlen -= pdu_len ; <START_BUG> tptr += pdu_len ; <END_BUG> }  return ; <START_BUG> trunc : ND_PRINT ( ( ndo, "\\n\\t%s", tstr ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> len ) { <S2SV_ModEnd> if (! <S2SV_ModStart> } while ( len ) { u_int pdu_len = <S2SV_ModEnd> rpki_rtr_pdu_print ( ndo <S2SV_ModStart> ( ndo, pptr, len, 1 <S2SV_ModEnd>, 8 ) <S2SV_ModStart>, 8 ) ; len <S2SV_ModEnd> -= pdu_len ; <S2SV_ModStart> -= pdu_len ; pptr <S2SV_ModEnd> += pdu_len ; <S2SV_ModStart> pdu_len ; } <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void initialize_encoder ( struct stream_state * stream, struct VpxEncoderConfig * global ) { int i ; int flags = 0 ; flags |= global -> show_psnr? VPX_CODEC_USE_PSNR : 0 ; flags |= global -> out_part? VPX_CODEC_USE_OUTPUT_PARTITION : 0 ; <START_BUG> vpx_codec_enc_init ( & stream -> encoder, global -> codec -> interface ( ), <END_BUG> & stream -> config. cfg, flags ) ; ctx_exit_on_error ( & stream -> encoder, "Failed   to   initialize   encoder" ) ; for ( i = 0 ; i < stream -> config. arg_ctrl_cnt ; i ++ ) { int ctrl = stream -> config. arg_ctrls [ i ] [ 0 ] ; int value = stream -> config. arg_ctrls [ i ] [ 1 ] ; if ( vpx_codec_control_ ( & stream -> encoder, ctrl, value ) ) fprintf ( stderr, "Error:   Tried   to   set   control   %d   =   %d\\n", ctrl, value ) ; ctx_exit_on_error ( & stream -> encoder, "Failed   to   control   codec" ) ; } # if CONFIG_DECODERS if ( global -> test_decode!= TEST_DECODE_OFF ) { const VpxInterface * decoder = get_vpx_decoder_by_name ( global -> codec -> name ) ;  vpx_codec_dec_init ( & stream -> decoder, decoder -> interface ( ), NULL, 0 ) ; <START_BUG> } # endif }<END_BUG>

Fix:
<S2SV_ModStart> : 0 ; # if CONFIG_VP9_HIGHBITDEPTH flags |= stream -> config. use_16bit_internal? VPX_CODEC_USE_HIGHBITDEPTH : 0 ; # endif <S2SV_ModStart> -> codec -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart>, decoder -> codec_interface <S2SV_ModEnd> ( ),
Buggy code:
 static TX_SIZE read_selected_tx_size ( VP9_COMMON * cm, MACROBLOCKD * xd, <START_BUG> TX_SIZE max_tx_size, vp9_reader * r ) { <END_BUG>  const int ctx = vp9_get_tx_size_context ( xd ) ; <START_BUG> <END_BUG> const vp9_prob * tx_probs = get_tx_probs ( max_tx_size, ctx, & cm -> fc. tx_probs ) ;  <START_BUG> int tx_size = vp9_read ( r, tx_probs [ 0 ] ) ; <END_BUG> if ( tx_size!= TX_4X4 && max_tx_size >= TX_16X16 ) {  tx_size += vp9_read ( r, tx_probs [ 1 ] ) ; <START_BUG> if ( tx_size!= TX_8X8 && max_tx_size >= TX_32X32 ) <END_BUG> tx_size += vp9_read ( r, tx_probs [ 2 ] ) ;  } <START_BUG> if (! cm -> frame_parallel_decoding_mode ) <END_BUG>  ++ get_tx_counts ( max_tx_size, ctx, & cm -> counts. tx ) [ tx_size ] ; <START_BUG> return ( TX_SIZE ) tx_size ; }<END_BUG>

Fix:
<S2SV_ModStart> TX_SIZE max_tx_size, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> r ) { FRAME_COUNTS * counts = xd -> counts ; <S2SV_ModStart> int ctx = get_tx_size_context <S2SV_ModEnd> ( xd ) <S2SV_ModStart> ) ; const vpx_prob <S2SV_ModEnd> * tx_probs = <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> tx_probs ) ; <S2SV_ModStart> int tx_size = vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> { tx_size += vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> ) tx_size += vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> } if ( counts <S2SV_ModEnd> ) ++ get_tx_counts <S2SV_ModStart> ctx, & counts -> <S2SV_ModEnd> tx ) [
Buggy code:
 unsigned int oom_badness ( struct task_struct * p, struct mem_cgroup * mem, const nodemask_t * nodemask, unsigned long totalpages ) { <START_BUG> int points ; <END_BUG> if ( oom_unkillable_task ( p, mem, nodemask ) ) return 0 ; p = find_lock_task_mm ( p ) ; if (! p ) return 0 ; if ( atomic_read ( & p -> mm -> oom_disable_count ) ) { task_unlock ( p ) ; return 0 ; } if (! totalpages ) totalpages = 1 ; points = get_mm_rss ( p -> mm ) + p -> mm -> nr_ptes ; points += get_mm_counter ( p -> mm, MM_SWAPENTS ) ; points *= 1000 ; points //= totalpages ; task_unlock ( p ) ; if ( has_capability_noaudit ( p, CAP_SYS_ADMIN ) ) points -= 30 ; points += p -> signal -> oom_score_adj ; if ( points <= 0 ) return 1 ; return ( points < 1000 )? points : 1000 ; }

Fix:
<S2SV_ModStart> totalpages ) { long <S2SV_ModEnd> points ; if