nus-yam/ex-repair huggingface dataset:
Buggy code:
 void rdp_in_unistr ( STREAM s, int in_len, char * * string, uint32 * str_size ) { static iconv_t icv_utf16_to_local ; size_t ibl, obl ; <START_BUG> char * pin, * pout ; <END_BUG> if (! icv_utf16_to_local ) { icv_utf16_to_local = iconv_open ( g_codepage, WINDOWS_CODEPAGE ) ; if ( icv_utf16_to_local == ( iconv_t ) - 1 ) { logger ( Protocol, Error, "rdp_in_unistr(),   iconv_open[%s   ->   %s]   fail   %p", WINDOWS_CODEPAGE, g_codepage, icv_utf16_to_local ) ; abort ( ) ; } } if ( * string == NULL ) { * string = xmalloc ( in_len * 2 ) ; * str_size = in_len * 2 ; } ibl = in_len ; obl = * str_size - 1 ; pin = ( char * ) s -> p ; pout = * string ; if ( iconv ( icv_utf16_to_local, ( char * * ) & pin, & ibl, & pout, & obl ) == ( size_t ) - 1 ) { if ( errno == E2BIG ) { logger ( Protocol, Warning, "rdp_in_unistr(),   server   sent   an   unexpectedly   long   string,   truncating" ) ; } else { logger ( Protocol, Warning, "rdp_in_unistr(),   iconv   fail,   errno   %d", errno ) ; free ( * string ) ; * string = NULL ; * str_size = 0 ; } abort ( ) ; } s -> p += in_len ; * pout = 0 ; if ( * string ) * str_size = pout - * string ; }

Fix:
<S2SV_ModStart> * pout ; struct stream packet = * s ; if ( ( in_len < 0 ) || ( ( uint32 ) in_len >= ( RD_UINT32_MAX // 2 ) ) ) { logger ( Protocol, Error, "rdp_in_unistr(), <S2SV_blank> length <S2SV_blank> of <S2SV_blank> unicode <S2SV_blank> data <S2SV_blank> is <S2SV_blank> out <S2SV_blank> of <S2SV_blank> bounds." ) ; abort ( ) ; } if (! s_check_rem ( s, in_len ) ) { rdp_protocol_error ( "rdp_in_unistr(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> unicode <S2SV_blank> data <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; }
Buggy code:
 <START_BUG> void vp9_write_prob_diff_update ( vp9_writer * w, vp9_prob newp, vp9_prob oldp ) { <END_BUG> const int delp = remap_prob ( newp, oldp ) ; encode_term_subexp ( w, delp ) ; }

Fix:
<S2SV_ModStart> void vp9_write_prob_diff_update ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> * w, vpx_prob newp, vpx_prob <S2SV_ModEnd> oldp ) {
Buggy code:
 static struct net_device * _init_airo_card ( unsigned short irq, int port, int is_pcmcia, struct pci_dev * pci, struct device * dmdev ) { struct net_device * dev ; struct airo_info * ai ; int i, rc ; CapabilityRid cap_rid ; dev = alloc_netdev ( sizeof ( * ai ), "", ether_setup ) ; if (! dev ) { airo_print_err ( "", "Couldn\'t   alloc_etherdev" ) ; return NULL ; } ai = dev -> ml_priv = netdev_priv ( dev ) ; ai -> wifidev = NULL ; ai -> flags = 1 << FLAG_RADIO_DOWN ; ai -> jobs = 0 ; ai -> dev = dev ; if ( pci && ( pci -> device == 0x5000 || pci -> device == 0xa504 ) ) { airo_print_dbg ( "", "Found   an   MPI350   card" ) ; set_bit ( FLAG_MPI, & ai -> flags ) ; } spin_lock_init ( & ai -> aux_lock ) ; sema_init ( & ai -> sem, 1 ) ; ai -> config. len = 0 ; ai -> pci = pci ; init_waitqueue_head ( & ai -> thr_wait ) ; ai -> tfm = NULL ; add_airo_dev ( ai ) ; if ( airo_networks_allocate ( ai ) ) goto err_out_free ; airo_networks_initialize ( ai ) ; skb_queue_head_init ( & ai -> txq ) ; if ( test_bit ( FLAG_MPI, & ai -> flags ) ) dev -> netdev_ops = & mpi_netdev_ops ; else dev -> netdev_ops = & airo_netdev_ops ; dev -> wireless_handlers = & airo_handler_def ; ai -> wireless_data. spy_data = & ai -> spy_data ; dev -> wireless_data = & ai -> wireless_data ; dev -> irq = irq ; dev -> base_addr = port ; <START_BUG> SET_NETDEV_DEV ( dev, dmdev ) ; <END_BUG> reset_card ( dev, 1 ) ; msleep ( 400 ) ; if

Fix:
<S2SV_ModStart> = port ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ;
Buggy code:
 static int dnxhd_find_frame_end ( DNXHDParserContext * dctx, const uint8_t * buf, int buf_size ) { ParseContext * pc = & dctx -> pc ; uint64_t state = pc -> state64 ; int pic_found = pc -> frame_start_found ; int i = 0 ; if (! pic_found ) { for ( i = 0 ; i < buf_size ; i ++ ) { state = ( state << 8 ) | buf [ i ] ; if ( ff_dnxhd_check_header_prefix ( state & 0xffffffffff00LL )!= 0 ) { i ++ ; pic_found = 1 ; dctx -> cur_byte = 0 ; dctx -> remaining = 0 ; break ; } } } if ( pic_found &&! dctx -> remaining ) { if (! buf_size ) return 0 ; for ( ; i < buf_size ; i ++ ) { dctx -> cur_byte ++ ; state = ( state << 8 ) | buf [ i ] ; if ( dctx -> cur_byte == 24 ) { dctx -> h = ( state >> 32 ) & 0xFFFF ; } else if ( dctx -> cur_byte == 26 ) { dctx -> w = ( state >> 32 ) & 0xFFFF ; } else if ( dctx -> cur_byte == 42 ) { int cid = ( state >> 32 ) & 0xFFFFFFFF ; <START_BUG> if ( cid <= 0 ) <END_BUG> continue ;  dctx -> remaining = avpriv_dnxhd_get_frame_size ( cid ) ; <START_BUG> <END_BUG> if ( dctx -> remaining <= 0 ) {  <START_BUG> dctx -> remaining = dnxhd_get_hr_frame_size ( cid, dctx -> w, dctx -> h ) ; <END_BUG>  if ( dctx -> remaining <= 0 ) <START_BUG> <END_BUG> return dctx -> remaining ;  } if ( buf_size - i + 47 >= dctx -> remaining ) { int remaining = dctx -> remaining ; pc -> frame_start_found = 0 ; pc -> state64 = - 1 ; dctx -> cur_byte = 0 ; dctx -> remaining = 0 ; return remaining ; } else { dctx -> remaining -= buf_size ; } } } } else if ( pic_found ) { if ( dctx -> remaining > buf_size ) { dctx -> remaining

Fix:
<S2SV_ModStart> & 0xFFFFFFFF ; int remaining ; <S2SV_ModStart> ) continue ; <S2SV_ModEnd> remaining = avpriv_dnxhd_get_frame_size <S2SV_ModStart> ; if ( <S2SV_ModEnd> remaining <= 0 <S2SV_ModStart> 0 ) { <S2SV_ModEnd> remaining = dnxhd_get_hr_frame_size <S2SV_ModStart> ; if ( <S2SV_ModEnd> remaining <= 0 <S2SV_ModStart> <= 0 ) continue ; } dctx -> remaining = remaining ; <S2SV_ModEnd> if ( buf_size
Buggy code:
 int vmw_gb_surface_define_ioctl ( struct drm_device * dev, void * data, struct drm_file * file_priv ) { struct vmw_private * dev_priv = vmw_priv ( dev ) ; struct vmw_user_surface * user_srf ; struct vmw_surface * srf ; struct vmw_resource * res ; struct vmw_resource * tmp ; union drm_vmw_gb_surface_create_arg * arg = ( union drm_vmw_gb_surface_create_arg * ) data ; struct drm_vmw_gb_surface_create_req * req = & arg -> req ; struct drm_vmw_gb_surface_create_rep * rep = & arg -> rep ; struct ttm_object_file * tfile = vmw_fpriv ( file_priv ) -> tfile ; int ret ; uint32_t size ; <START_BUG> uint32_t backup_handle ; <END_BUG> if ( req -> multisample_count!= 0 ) return - EINVAL ; if ( req -> mip_levels > DRM_VMW_MAX_MIP_LEVELS ) return - EINVAL ; if ( unlikely ( vmw_user_surface_size == 0 ) ) vmw_user_surface_size = ttm_round_pot ( sizeof ( * user_srf ) ) + 128 ; size = vmw_user_surface_size + 128 ; ret = vmw_surface_gb_priv_define ( dev, size, req -> svga3d_flags, req -> format, req -> drm_surface_flags & drm_vmw_surface_flag_scanout, req -> mip_levels, req -> multisample_count, req -> array_size, req -> base_size, & srf ) ; if ( unlikely ( ret!= 0 ) ) return ret ; user_srf = container_of ( srf, struct vmw_user_surface, srf ) ; if ( drm_is_primary_client ( file_priv ) ) user_srf -> master = drm_master_get ( file_priv -> master ) ; ret = ttm_read_lock ( & dev_priv -> reservation_sem, true ) ; if ( unlikely ( ret!= 0 ) ) return

Fix:
<S2SV_ModStart> ; uint32_t backup_handle = 0 <S2SV_ModStart> ret == 0 ) { if ( <S2SV_ModEnd> res -> backup <S2SV_ModStart> goto out_unlock ; } else { backup_handle = req -> buffer_handle ; }
Buggy code:
 <START_BUG> static void read_inter_mode_probs ( FRAME_CONTEXT * fc, vp9_reader * r ) { <END_BUG> int i, j ; for ( i = 0 ; i < INTER_MODE_CONTEXTS ; ++ i ) for ( j = 0 ; j < INTER_MODES - 1 ; ++ j ) vp9_diff_update_prob ( r, & fc -> inter_mode_probs [ i ] [ j ] ) ; }

Fix:
<S2SV_ModStart> * fc, vpx_reader <S2SV_ModEnd> * r )
Buggy code:
 void vp8_first_pass ( VP8_COMP * cpi ) { int mb_row, mb_col ; MACROBLOCK * const x = & cpi -> mb ; VP8_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; int recon_yoffset, recon_uvoffset ; YV12_BUFFER_CONFIG * lst_yv12 = & cm -> yv12_fb [ cm -> lst_fb_idx ] ; YV12_BUFFER_CONFIG * new_yv12 = & cm -> yv12_fb [ cm -> new_fb_idx ] ; YV12_BUFFER_CONFIG * gld_yv12 = & cm -> yv12_fb [ cm -> gld_fb_idx ] ; int recon_y_stride = lst_yv12 -> y_stride ; int recon_uv_stride = lst_yv12 -> uv_stride ; int64_t intra_error = 0 ; int64_t coded_error = 0 ; int sum_mvr = 0, sum_mvc = 0 ; int sum_mvr_abs = 0, sum_mvc_abs = 0 ; int sum_mvrs = 0, sum_mvcs = 0 ; int mvcount = 0 ; int intercount = 0 ; int second_ref_count = 0 ; int intrapenalty = 256 ; int neutral_count = 0 ; int new_mv_count = 0 ; int sum_in_vectors = 0 ; uint32_t lastmv_as_int = 0 ; int_mv zero_ref_mv ; zero_ref_mv. as_int = 0 ; vp8_clear_system_state ( ) ; x -> src = * cpi -> Source ; xd -> pre = * lst_yv12 ; xd -> dst = * new_yv12 ; x -> partition_info = x -> pi ; xd -> mode_info_context = cm -> mi ; if (! cm -> use_bilinear_mc_filter ) { xd -> subpixel_predict = vp8_sixtap_predict4x4 ; xd -> subpixel_predict8x4 = vp8_sixtap_predict8x4 ; xd -> subpixel_predict8x8 =

Fix:
<S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( cm ->
Buggy code:
 error_t rawSocketSendEthPacket ( Socket * socket, const SocketMsg * message, uint_t flags ) { error_t error ; # if ( ETH_SUPPORT == ENABLED ) size_t length ; NetBuffer * buffer ; NetInterface * interface ; <START_BUG> if ( socket -> interface!= NULL ) <END_BUG> { interface = socket -> interface ; } else { interface = netGetDefaultInterface ( ) ; } interface = nicGetPhysicalInterface ( interface ) ; if ( interface -> nicDriver!= NULL && interface -> nicDriver -> type == NIC_TYPE_ETHERNET ) { buffer = netBufferAlloc ( 0 ) ; if ( buffer == NULL ) return ERROR_OUT_OF_MEMORY ; length = message -> length ; error = netBufferAppend ( buffer, message -> data, length ) ; if (! error ) { if (! interface -> nicDriver -> autoPadding ) { if ( length < ( ETH_MIN_FRAME_SIZE - ETH_CRC_SIZE ) ) { size_t n ; n = ( ETH_MIN_FRAME_SIZE - ETH_CRC_SIZE ) - length ; error = netBufferAppend ( buffer, ethPadding, n ) ; length += n ; } } } if (! error ) { if (! interface -> nicDriver -> autoCrcCalc ) { uint32_t crc ; crc = ethCalcCrcEx ( buffer, 0, length ) ; crc = htole32 ( crc ) ; error = netBufferAppend ( buffer, & crc, sizeof ( crc ) ) ; length += sizeof ( crc ) ; } } if (! error ) { NetTxAncillary ancillary ; ancillary = NET_DEFAULT_TX_ANCILLARY ; # if ( ETH_PORT_TAGGING_SUPPORT == ENABLED ) ancillary. port = message -> switchPort ; # endif # if ( ETH_TIMESTAMP_SUPPORT == ENABLED ) ancillary. timestampId = message -> timestampId ; # endif TRACE_DEBUG ( "Sending   raw   Ethernet   frame   (%" PRIuSIZE "   bytes)...\\r\\n", length ) ; error = nicSendPacket ( interface, buffer, 0, & ancillary ) ; } netBufferFree ( buffer ) ; } else # endif { error = ERROR_INVALID_INTERFACE ; } return error ; }

Fix:
<S2SV_ModStart> * interface ; if ( message -> interface!= NULL ) { interface = message -> interface ; } else
Buggy code:
 static long vhost_net_set_backend ( struct vhost_net * n, unsigned index, int fd ) { struct socket * sock, * oldsock ; struct vhost_virtqueue * vq ; struct vhost_net_virtqueue * nvq ; struct vhost_net_ubuf_ref * ubufs, * oldubufs = NULL ; int r ; mutex_lock ( & n -> dev. mutex ) ; r = vhost_dev_check_owner ( & n -> dev ) ; if ( r ) goto err ; if ( index >= VHOST_NET_VQ_MAX ) { r = - ENOBUFS ; goto err ; } vq = & n -> vqs [ index ]. vq ; nvq = & n -> vqs [ index ] ; mutex_lock ( & vq -> mutex ) ; if (! vhost_vq_access_ok ( vq ) ) { r = - EFAULT ; goto err_vq ; } sock = get_socket ( fd ) ; if ( IS_ERR ( sock ) ) { r = PTR_ERR ( sock ) ; goto err_vq ; } oldsock = rcu_dereference_protected ( vq -> private_data, lockdep_is_held ( & vq -> mutex ) ) ; if ( sock!= oldsock ) { ubufs = vhost_net_ubuf_alloc ( vq, sock && vhost_sock_zcopy ( sock ) ) ; if ( IS_ERR ( ubufs ) ) { r = PTR_ERR ( ubufs ) ; goto err_ubufs ; } vhost_net_disable_vq ( n, vq ) ; rcu_assign_pointer ( vq -> private_data, sock ) ; r = vhost_init_used ( vq ) ; if ( r ) goto err_used ; r = vhost_net_enable_vq ( n, vq ) ; if ( r ) goto err_used ; oldubufs = nvq -> ubufs ; nvq -> ubufs = ubufs ; n -> tx_packets = 0 ; n -> tx_zcopy_err = 0 ; n -> tx_flush = false ; } mutex_unlock ( & vq -> mutex ) ; if ( oldubufs ) { <START_BUG> vhost_net_ubuf_<END_BUG>

Fix:
<S2SV_ModStart> oldubufs ) { vhost_net_ubuf_put_wait_and_free <S2SV_ModEnd> ( oldubufs ) <S2SV_ModStart> ( ubufs ) vhost_net_ubuf_put_wait_and_free <S2SV_ModEnd> ( ubufs )
Buggy code:
 long keyctl_set_reqkey_keyring ( int reqkey_defl ) { struct cred * new ; int ret, old_setting ; old_setting = current_cred_xxx ( jit_keyring ) ; if ( reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE ) return old_setting ; new = prepare_creds ( ) ; if (! new ) return - ENOMEM ; switch ( reqkey_defl ) { case KEY_REQKEY_DEFL_THREAD_KEYRING : ret = install_thread_keyring_to_cred ( new ) ; if ( ret < 0 ) goto error ; goto set ; case KEY_REQKEY_DEFL_PROCESS_KEYRING : ret = install_process_keyring_to_cred ( new ) ; <START_BUG> if ( ret < 0 ) { <END_BUG> if ( ret!= - EEXIST ) goto error ; ret = 0 ; } goto set ; case KEY_REQKEY_DEFL_DEFAULT : case KEY_REQKEY_DEFL_SESSION_KEYRING : case KEY_REQKEY_DEFL_USER_KEYRING : case KEY_REQKEY_DEFL_USER_SESSION_KEYRING : case KEY_REQKEY_DEFL_REQUESTOR_KEYRING : goto set ; case KEY_REQKEY_DEFL_NO_CHANGE : case KEY_REQKEY_DEFL_GROUP_KEYRING : default : ret = - EINVAL ; goto error ; } set : new -> jit_keyring = reqkey_defl ; commit_creds ( new ) ; return old_setting ; error : abort_creds ( new ) ; return ret ; }

Fix:
<S2SV_ModStart> < 0 ) goto error ; <S2SV_ModEnd> goto set ;
Buggy code:
 void * gstd_accept ( int fd, char * * display_creds, char * * export_name, char * * mech ) { gss_name_t client ; gss_OID mech_oid ; struct gstd_tok * tok ; gss_ctx_id_t ctx = GSS_C_NO_CONTEXT ; gss_buffer_desc in, out ; OM_uint32 maj, min ; int ret ; * display_creds = NULL ; * export_name = NULL ; out. length = 0 ; in. length = 0 ; read_packet ( fd, & in, 60000, 1 ) ; again : while ( ( ret = read_packet ( fd, & in, 60000, 0 ) ) == - 2 ) ; if ( ret < 1 ) return NULL ; maj = gss_accept_sec_context ( & min, & ctx, GSS_C_NO_CREDENTIAL, & in, GSS_C_NO_CHANNEL_BINDINGS, & client, & mech_oid, & out, NULL, <START_BUG> NULL, NULL ) ; <END_BUG> if ( out. length && write_packet ( fd, & out ) ) { gss_release_buffer ( & min, & out ) ; return NULL ; }  GSTD_GSS_ERROR ( maj, min, NULL, "gss_accept_sec_context" ) ; <START_BUG> if ( maj & GSS_S_CONTINUE_NEEDED ) goto again ; * display_creds = gstd_get_display_name ( client ) ; * export_name = gstd_get_export_name ( client ) ; * mech = gstd_get_mech ( mech_oid ) ; gss_release_name ( & min, & client ) ; SETUP_GSTD_TOK ( tok, ctx, fd, "gstd_accept" ) ; return tok ; }<END_BUG>

Fix:
<S2SV_ModStart> NULL, NULL ) ; gss_release_buffer ( & min, & in <S2SV_ModStart> NULL ; } gss_release_buffer ( & min, & out ) ;
Buggy code:
 void * jas_malloc ( size_t size ) { void * result ; <START_BUG> JAS_DBGLOG ( 101, ( "jas_malloc   called   with   %zu\\n", size ) ) ; <END_BUG> result = malloc ( size ) ; JAS_DBGLOG ( 100, ( "jas_malloc(%zu)   ->   %p\\n", size, result ) ) ; return result ; }

Fix:
<S2SV_ModStart> 101, ( "jas_malloc(%zu)\\n" <S2SV_ModEnd>, size )
Buggy code:
 static Image * ReadSIXELImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char * sixel_buffer ; Image * image ; MagickBooleanType status ; register char * p ; register ssize_t x ; register Quantum * q ; size_t length ; ssize_t i, j, y ; unsigned char * sixel_pixels, * sixel_palette ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } length = MagickPathExtent ; sixel_buffer = ( char * ) AcquireQuantumMemory ( ( size_t ) length + MagickPathExtent, sizeof ( * sixel_buffer ) ) ; p = sixel_buffer ; if ( sixel_buffer!= ( char * ) NULL ) while ( ReadBlobString ( image, p )!= ( char * ) NULL ) { if ( ( * p == '#' ) && ( ( p == sixel_buffer ) || ( * ( p - 1 ) == '\\n' ) ) ) continue ; if ( ( * p == '}' ) && ( * ( p + 1 ) == ';' ) ) break ; p += strlen ( p ) ; if ( ( size_t ) ( p - sixel_buffer + MagickPathExtent + 1 ) < length ) continue ; length <<= 1 ; sixel_buffer = ( char * ) ResizeQuantumMemory ( sixel_buffer, length + MagickPathExtent + 1, sizeof ( * sixel_buffer ) ) ; if ( sixel_buffer == ( char * ) NULL ) break ; p = sixel_buffer + strlen ( sixel_buffer ) ; } if ( sixel_buffer == ( char * ) NULL ) ThrowReaderException ( ResourceLimitError,

Fix:
<S2SV_ModStart> RelinquishMagickMemory ( sixel_buffer ) ; sixel_pixels = ( unsigned char * ) RelinquishMagickMemory ( sixel_pixels
Buggy code:
 static void icmp_reply ( struct icmp_bxm * icmp_param, struct sk_buff * skb ) { struct ipcm_cookie ipc ; struct rtable * rt = skb_rtable ( skb ) ; struct net * net = dev_net ( rt -> dst. dev ) ; struct sock * sk ; struct inet_sock * inet ; __be32 daddr ; <START_BUG> if ( ip_options_echo ( & icmp_param -> replyopts, skb ) ) <END_BUG> return ; sk = icmp_xmit_lock ( net ) ; if ( sk == NULL ) return ; inet = inet_sk ( sk ) ; icmp_param -> data. icmph. checksum = 0 ; inet -> tos = ip_hdr ( skb ) -> tos ; daddr = ipc. addr = rt -> rt_src ; ipc. opt = NULL ; ipc. tx_flags = 0 ;  if ( icmp_param -> replyopts. optlen ) { <START_BUG> <END_BUG> ipc. opt = & icmp_param -> replyopts ;  if ( ipc. opt -> srr ) <START_BUG> daddr = icmp_param -> replyopts. faddr ; <END_BUG> } { struct flowi4 fl4 = {. daddr = daddr,. saddr = rt -> rt_spec_dst,. flowi4_tos = RT_TOS ( ip_hdr ( skb ) -> tos ),. flowi4_proto = IPPROTO_ICMP, } ; security_skb_classify_flow ( skb, flowi4_to_flowi ( & fl4 ) ) ; rt = ip_route_output_key ( net, & fl4 ) ; if ( IS_ERR ( rt ) ) goto out_unlock ; } if ( icmpv4_xrlim_allow ( net, rt, icmp_param -> data. icmph. type, icmp_param -> data. icmph. code ) ) icmp_push_reply ( icmp_param, & ipc, & rt ) ; ip_rt_put ( rt ) ; out_unlock : icmp_xmit_unlock ( sk ) ; }

Fix:
<S2SV_ModStart> icmp_param -> replyopts. opt. opt <S2SV_ModStart> -> replyopts. opt. opt. <S2SV_ModStart> icmp_param -> replyopts. opt ; if ( ipc. opt -> opt. <S2SV_ModEnd> srr ) daddr <S2SV_ModStart> icmp_param -> replyopts. opt. opt
Buggy code:
 __be32 nfsd4_set_nfs4_acl ( struct svc_rqst * rqstp, struct svc_fh * fhp, struct nfs4_acl * acl ) { __be32 error ; int host_error ; struct dentry * dentry ; struct inode * inode ; struct posix_acl * pacl = NULL, * dpacl = NULL ; unsigned int flags = 0 ; error = fh_verify ( rqstp, fhp, 0, NFSD_MAY_SATTR ) ; if ( error ) return error ; dentry = fhp -> fh_dentry ; inode = d_inode ( dentry ) ; <START_BUG> if (! inode -> i_op -> set_acl ||! IS_POSIXACL ( inode ) ) <END_BUG> return nfserr_attrnotsupp ; if ( S_ISDIR ( inode -> i_mode ) ) flags = NFS4_ACL_DIR ; host_error = nfs4_acl_nfsv4_to_posix ( acl, & pacl, & dpacl, flags ) ; if ( host_error == - EINVAL ) return nfserr_attrnotsupp ; if ( host_error < 0 ) goto out_nfserr ;  host_error = inode -> i_op -> set_acl ( inode, pacl, ACL_TYPE_ACCESS ) ; <START_BUG> if ( host_error < 0 ) <END_BUG> goto out_release ;  if ( S_ISDIR ( inode -> i_mode ) ) { <START_BUG> host_error = inode -> i_op -> set_acl ( inode, dpacl, <END_BUG> ACL_TYPE_DEFAULT ) ; }  out_release : <START_BUG> posix_acl_release ( pacl ) ; posix_acl_release ( dpacl ) ; out_nfserr : if ( host_error == - EOPNOTSUPP ) return nfserr_attrnotsupp ; else return nfserrno ( host_error ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> S_ISDIR ( inode <S2SV_ModStart> goto out_nfserr ; fh_lock ( fhp ) ; host_error = set_posix_acl ( inode, ACL_TYPE_ACCESS, pacl <S2SV_ModEnd> ) ; if <S2SV_ModStart> 0 ) goto out_drop_lock <S2SV_ModEnd> ; if ( <S2SV_ModStart> { host_error = set_posix_acl ( inode, ACL_TYPE_DEFAULT, dpacl <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } out_drop_lock : fh_unlock ( fhp ) ; <S2SV_ModEnd> posix_acl_release ( pacl
Buggy code:
 SYSCALL_DEFINE3 ( osf_sysinfo, int, command, char __user *, buf, long, count ) { const char * sysinfo_table [ ] = { utsname ( ) -> sysname, utsname ( ) -> nodename, utsname ( ) -> release, utsname ( ) -> version, utsname ( ) -> machine, "alpha", "dummy", "dummy", "dummy", } ; unsigned long offset ; const char * res ; long len, err = - EINVAL ; offset = command - 1 ; if ( offset >= ARRAY_SIZE ( sysinfo_table ) ) { printk ( "sysinfo(%d)", command ) ; goto out ; } down_read ( & uts_sem ) ; res = sysinfo_table [ offset ] ; len = strlen ( res ) + 1 ; <START_BUG> if ( len > count ) <END_BUG> len = count ; if ( copy_to_user ( buf, res, len ) ) err = - EFAULT ; else err = 0 ; up_read ( & uts_sem ) ; out : return err ; }

Fix:
<S2SV_ModStart> ; if ( ( unsigned long ) len > ( unsigned long ) <S2SV_ModEnd> count ) len
Buggy code:
 static inline void handle_socket_receive_known ( fastd_socket_t * sock, const fastd_peer_address_t * local_addr, const fastd_peer_address_t * remote_addr, fastd_peer_t * peer, fastd_buffer_t * buffer ) { if (! fastd_peer_may_connect ( peer ) ) { fastd_buffer_free ( buffer ) ; return ; } const uint8_t * packet_type = buffer -> data ; switch ( * packet_type ) { case PACKET_DATA : if (! fastd_peer_is_established ( peer ) ||! fastd_peer_address_equal ( & peer -> local_address, local_addr ) ) { fastd_buffer_free ( buffer ) ; if (! backoff_unknown ( remote_addr ) ) { pr_debug ( "unexpectedly   received   payload   data   from   %P[%I]", peer, remote_addr ) ; conf. protocol -> handshake_init ( sock, local_addr, remote_addr, NULL ) ; } return ; } conf. protocol -> handle_recv ( peer, buffer ) ; break ; case PACKET_HANDSHAKE : fastd_handshake_handle ( sock, local_addr, remote_addr, peer, buffer ) ; <START_BUG> } <END_BUG> }

Fix:
<S2SV_ModStart> buffer ) ; break ; default : fastd_buffer_free ( buffer ) ; pr_debug ( "received <S2SV_blank> packet <S2SV_blank> with <S2SV_blank> invalid <S2SV_blank> type <S2SV_blank> from <S2SV_blank> %P[%I]", peer, remote_addr ) ;
Buggy code:
 SNDFILE * sf_open_virtual ( SF_VIRTUAL_IO * sfvirtual, int mode, SF_INFO * sfinfo, void * user_data ) { SF_PRIVATE * psf ; if ( sfvirtual -> get_filelen == NULL || sfvirtual -> seek == NULL || sfvirtual -> tell == NULL ) { sf_errno = SFE_BAD_VIRTUAL_IO ; snprintf ( sf_parselog, sizeof ( sf_parselog ), "Bad   vio_get_filelen   //   vio_seek   //   vio_tell   in   SF_VIRTUAL_IO   struct.\\n" ) ; return NULL ; } ; if ( ( mode == SFM_READ || mode == SFM_RDWR ) && sfvirtual -> read == NULL ) { sf_errno = SFE_BAD_VIRTUAL_IO ; snprintf ( sf_parselog, sizeof ( sf_parselog ), "Bad   vio_read   in   SF_VIRTUAL_IO   struct.\\n" ) ; return NULL ; } ; if ( ( mode == SFM_WRITE || mode == SFM_RDWR ) && sfvirtual -> write == NULL ) { sf_errno = SFE_BAD_VIRTUAL_IO ; snprintf ( sf_parselog, sizeof ( sf_parselog ), "Bad   vio_write   in   SF_VIRTUAL_IO   struct.\\n" ) ; return NULL ; } ; <START_BUG> if ( ( psf = calloc ( 1, sizeof ( SF_PRIVATE ) ) ) == NULL ) <END_BUG> { sf_errno = SFE_MALLOC_FAILED ; return NULL ; } ; psf_init_files ( psf ) ; psf -> virtual_io = SF_TRUE ; psf -> vio = * sfvirtual ; psf -> vio_user_data = user_data ; psf -> file. mode = mode ; return psf_open_file ( psf, sfinfo ) ; }

Fix:
<S2SV_ModStart> ( psf = psf_allocate ( <S2SV_ModEnd> ) ) ==
Buggy code:
 <START_BUG> cJSON * cJSON_CreateIntArray ( int64_t * numbers, int count ) <END_BUG> { int i ; cJSON * n = 0, * p = 0, * a = cJSON_CreateArray ( ) ;  for ( i = 0 ; a && i < count ; ++ i ) { <START_BUG> <END_BUG> n = cJSON_CreateInt ( numbers [ i ] ) ;  <START_BUG> if (! i ) <END_BUG> a -> child = n ; else suffix_object ( p, n ) ; p = n ; } return a ; }

Fix:
<S2SV_ModStart> * cJSON_CreateIntArray ( const int <S2SV_ModEnd> * numbers, <S2SV_ModStart> < count ; i ++ <S2SV_ModEnd> ) { n <S2SV_ModStart> { n = cJSON_CreateNumber <S2SV_ModEnd> ( numbers [ <S2SV_ModStart> ] ) ; if (! n ) { cJSON_Delete ( a ) ; return 0 ; }
Buggy code:
 void cJSON_Delete ( cJSON * c ) { cJSON * next ; while ( c ) { next = c -> next ; if (! ( c -> type & cJSON_IsReference ) && c -> child ) cJSON_Delete ( c -> child ) ; if (! ( c -> type & cJSON_IsReference ) && c -> valuestring ) cJSON_free ( c -> valuestring ) ; <START_BUG> if ( c -> string ) <END_BUG> cJSON_free ( c -> string ) ; cJSON_free ( c ) ; c = next ; } }

Fix:
<S2SV_ModStart> ; if (! ( c -> type & cJSON_StringIsConst ) &&
Buggy code:
 struct scm_fp_list * scm_fp_dup ( struct scm_fp_list * fpl ) { struct scm_fp_list * new_fpl ; int i ; if (! fpl ) return NULL ; new_fpl = kmemdup ( fpl, offsetof ( struct scm_fp_list, fp [ fpl -> count ] ), GFP_KERNEL ) ; if ( new_fpl ) { for ( i = 0 ; i < fpl -> count ; i ++ ) get_file ( fpl -> fp [ i ] ) ; new_fpl -> max = new_fpl -> count ; <START_BUG> } <END_BUG> return new_fpl ; }

Fix:
<S2SV_ModStart> -> count ; new_fpl -> user = get_uid ( fpl -> user ) ;
Buggy code:
 static VarBit * bit_catenate ( VarBit * arg1, VarBit * arg2 ) { VarBit * result ; int bitlen1, bitlen2, bytelen, bit1pad, bit2shift ; bits8 * pr, * pa ; bitlen1 = VARBITLEN ( arg1 ) ; <START_BUG> bitlen2 = VARBITLEN ( arg2 ) ; <END_BUG> bytelen = VARBITTOTALLEN ( bitlen1 + bitlen2 ) ; result = ( VarBit * ) palloc ( bytelen ) ; SET_VARSIZE ( result, bytelen ) ; VARBITLEN ( result ) = bitlen1 + bitlen2 ; memcpy ( VARBITS ( result ), VARBITS ( arg1 ), VARBITBYTES ( arg1 ) ) ; bit1pad = VARBITPAD ( arg1 ) ; if ( bit1pad == 0 ) { memcpy ( VARBITS ( result ) + VARBITBYTES ( arg1 ), VARBITS ( arg2 ), VARBITBYTES ( arg2 ) ) ; } else if ( bitlen2 > 0 ) { bit2shift = BITS_PER_BYTE - bit1pad ; pr = VARBITS ( result ) + VARBITBYTES ( arg1 ) - 1 ; for ( pa = VARBITS ( arg2 ) ; pa < VARBITEND ( arg2 ) ; pa ++ ) { * pr |= ( ( * pa >> bit2shift ) & BITMASK ) ; pr ++ ; if ( pr < VARBITEND ( result ) ) * pr = ( * pa << bit1pad ) & BITMASK ; } } return result ; }

Fix:
<S2SV_ModStart> VARBITLEN ( arg2 ) ; if ( bitlen1 > VARBITMAXLEN - bitlen2 ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "bit <S2SV_blank> string <S2SV_blank> length <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", VARBITMAXLEN ) )
Buggy code:
 error_t mqttSnClientSubscribe ( MqttSnClientContext * context, const char_t * topicName, MqttSnQosLevel qos ) { error_t error ; systime_t time ; if ( context == NULL || topicName == NULL ) return ERROR_INVALID_PARAMETER ; error = NO_ERROR ; while (! error ) { time = osGetSystemTime ( ) ; if ( context -> state == MQTT_SN_CLIENT_STATE_ACTIVE ) { mqttSnClientGenerateMessageId ( context ) ; context -> startTime = time ; error = mqttSnClientSendSubscribe ( context, topicName, qos ) ; } else if ( context -> state == MQTT_SN_CLIENT_STATE_SENDING_REQ ) { if ( timeCompare ( time, context -> startTime + context -> timeout ) >= 0 ) { context -> state = MQTT_SN_CLIENT_STATE_DISCONNECTING ; error = ERROR_TIMEOUT ; } else if ( timeCompare ( time, context -> retransmitStartTime + MQTT_SN_CLIENT_RETRY_TIMEOUT ) >= 0 ) { error = mqttSnClientSendSubscribe ( context, topicName, qos ) ; } else { error = mqttSnClientProcessEvents ( context, MQTT_SN_CLIENT_TICK_INTERVAL ) ; } } else if ( context -> state == MQTT_SN_CLIENT_STATE_RESP_RECEIVED ) { context -> state = MQTT_SN_CLIENT_STATE_ACTIVE ; if ( context -> msgType == MQTT_SN_MSG_TYPE_SUBACK ) { if ( context -> returnCode == MQTT_SN_RETURN_CODE_ACCEPTED ) { <START_BUG> if ( strchr ( topicName, '#' ) == NULL && strchr ( topicName, '+' ) == NULL ) <END_BUG> { error = mqttSnClientAddTopic ( context, topicName, context -> topicId ) ; } break ; } else { error = ERROR_REQUEST_REJECTED ; } } else { error = ERROR_UNEXPECTED_RESPONSE ; } } else { error = ERROR_NOT_CONNECTED ; } } return error ; }

Fix:
<S2SV_ModStart> { if ( osStrchr <S2SV_ModEnd> ( topicName, <S2SV_ModStart> == NULL && osStrchr <S2SV_ModEnd> ( topicName,
Buggy code:
 PHP_FUNCTION ( imageaffinematrixconcat ) { double m1 [ 6 ] ; double m2 [ 6 ] ; double mr [ 6 ] ; zval * * tmp ; zval * z_m1 ; zval * z_m2 ; int i, nelems ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ) TSRMLS_CC, "aa", & z_m1, & z_m2 ) == FAILURE ) { return ; } if ( ( ( nelems = zend_hash_num_elements ( Z_ARRVAL_P ( z_m1 ) ) )!= 6 ) || ( nelems = zend_hash_num_elements ( Z_ARRVAL_P ( z_m2 ) ) )!= 6 ) { php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Affine   arrays   must   have   six   elements" ) ; RETURN_FALSE ; } for ( i = 0 ; i < 6 ; i ++ ) { if ( zend_hash_index_find ( Z_ARRVAL_P ( z_m1 ), i, ( void * * ) & tmp ) == SUCCESS ) { switch ( Z_TYPE_PP ( tmp ) ) { case IS_LONG : m1 [ i ] = Z_LVAL_PP ( tmp ) ; break ; case IS_DOUBLE : m1 [ i ] = Z_DVAL_PP ( tmp ) ; break ; case IS_STRING : <START_BUG> convert_to_double_ex ( tmp ) ; <END_BUG>  m1 [ i ] = Z_DVAL_PP ( tmp ) ; <START_BUG> break ; default : php_error_docref ( NULL TSRMLS_CC, E_WARNING, "Invalid   type   for   element   %i", i ) ; RETURN_FALSE ; } } if ( zend_hash_index_find ( Z_ARRVAL_P ( z_m2 ), i, ( void * * ) & tmp ) == SUCCESS ) { switch ( Z_TYPE_PP ( tmp ) ) { case IS_LONG : m2 [ i ] = Z_LVAL_PP ( tmp ) ; break ; case IS_DOUBLE : m2 [ i ] = Z_DVAL_PP ( tmp ) ; break ; case IS_STRING<END_BUG>

Fix:
<S2SV_ModStart> case IS_STRING : { zval dval ; dval = * * tmp ; zval_copy_ctor ( & dval ) ; convert_to_double ( & dval <S2SV_ModEnd> ) ; m1 <S2SV_ModStart> i ] = Z_DVAL ( dval ) ; } <S2SV_ModEnd> break ; default <S2SV_ModStart> case IS_STRING : { zval dval ; dval = * * tmp ; zval_copy_ctor ( & dval ) ; convert_to_double ( & dval <S2SV_ModEnd> ) ; m2 <S2SV_ModStart> i ] = Z_DVAL ( dval ) ; } <S2SV_ModEnd> break ; default
Buggy code:
 static int xen_netbk_get_extras ( struct xenvif * vif, struct xen_netif_extra_info * extras, int work_to_do ) { struct xen_netif_extra_info extra ; RING_IDX cons = vif -> tx. req_cons ; do { if ( unlikely ( work_to_do -- <= 0 ) ) { <START_BUG> netdev_dbg ( vif -> dev, "Missing   extra   info\\n" ) ; <END_BUG> return - EBADR ; } memcpy ( & extra, RING_GET_REQUEST ( & vif -> tx, cons ), sizeof ( extra ) ) ; if ( unlikely (! extra. type || extra. type >= XEN_NETIF_EXTRA_TYPE_MAX ) ) { vif -> tx. req_cons = ++ cons ;  netdev_dbg ( vif -> dev, <START_BUG> <END_BUG> "Invalid   extra   type:   %d\\n", extra. type ) ;  return - EINVAL ; } memcpy ( & extras [ extra. type - 1 ], & extra, sizeof ( extra ) ) ; vif -> tx. req_cons = ++ cons ; } while ( extra. flags & XEN_NETIF_EXTRA_FLAG_MORE ) ; return work_to_do ; }

Fix:
<S2SV_ModStart> ) ) { netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> dev, "Missing <S2SV_blank> extra <S2SV_blank> info\\n" ) ; netbk_fatal_tx_err ( vif <S2SV_ModStart> ++ cons ; netdev_err <S2SV_ModEnd> ( vif -> <S2SV_ModStart> extra. type ) ; netbk_fatal_tx_err ( vif
Buggy code:
 <START_BUG> static INLINE void right_shift_8x8 ( __m128i * res, int const bit ) { <END_BUG> const __m128i kOne = _mm_set1_epi16 ( 1 ) ; const int bit_m02 = bit - 2 ; __m128i sign0 = _mm_srai_epi16 ( res [ 0 ], 15 ) ; __m128i sign1 = _mm_srai_epi16 ( res [ 1 ], 15 ) ; __m128i sign2 = _mm_srai_epi16 ( res [ 2 ], 15 ) ; __m128i sign3 = _mm_srai_epi16 ( res [ 3 ], 15 ) ; __m128i sign4 = _mm_srai_epi16 ( res [ 4 ], 15 ) ; __m128i sign5 = _mm_srai_epi16 ( res [ 5 ], 15 ) ; __m128i sign6 = _mm_srai_epi16 ( res [ 6 ], 15 ) ; __m128i sign7 = _mm_srai_epi16 ( res [ 7 ], 15 ) ;  if ( bit_m02 >= 0 ) { <START_BUG> __m128i k_const_rounding = _mm_slli_epi16 ( kOne, bit_m02 ) ; res [ 0 ] = _mm_add_epi16 ( res [ 0 ], k_const_rounding ) ; res [ 1 ] = _mm_add_epi16 ( res [ 1 ], k_const_rounding ) ; res [ 2 ] = _mm_add_epi16 ( res [ 2 ], k_const_rounding ) ; res [ 3 ] = _mm_add_epi16 ( res [ 3 ], k_const_rounding ) ; res [ 4 ] = _mm_add_epi16 ( res [ 4 ], k_const_rounding ) ; res [ 5 ] = _mm_add_epi16 ( res [ 5 ], k_const_rounding ) ; res [ 6 ] = _mm_add_epi16 ( res [ 6 ], k_const_rounding ) ; res [ 7 ] = _mm_add_epi16 ( res [ 7 ], k_const_rounding ) ; } res [ 0 ] = _mm_<END_BUG>

Fix:
<S2SV_ModStart> * res, const int bit ) { <S2SV_ModEnd> __m128i sign0 = <S2SV_ModStart> ; if ( bit == 2 ) { const __m128i const_rounding = _mm_set1_epi16 ( 1 ) ; res [ 0 ] = _mm_add_epi16 ( res [ 0 ], const_rounding ) ; res [ 1 ] = _mm_add_epi16 ( res [ 1 ], const_rounding ) ; res [ 2 ] = _mm_add_epi16 ( res [ 2 ], const_rounding ) ; res [ 3 ] = _mm_add_epi16 ( res [ 3 ], const_rounding ) ; res [ 4 ] = _mm_add_epi16 ( res [ 4 ], const_rounding ) ; res [ 5 ] = _mm_add_epi16 ( res [ 5 ], const_rounding ) ; res [ 6 ] = _mm_add_epi16 ( res [ 6 ], const_rounding ) ; res [ 7 ] = _mm_add_epi16 ( res [ 7 ], const_rounding <S2SV_ModEnd> ) ; } <S2SV_ModStart> sign7 ) ; if ( bit == 1 ) { res [ 0 ] = _mm_s
Buggy code:
 static void copy_xauthority ( void ) { char * src = RUN_XAUTHORITY_FILE ; char * dest ; if ( asprintf ( & dest, "%s//.Xauthority", cfg. homedir ) == - 1 ) errExit ( "asprintf" ) ; if ( is_link ( dest ) ) { fprintf ( stderr, "Error:   %s   is   a   symbolic   link\\n", dest ) ; exit ( 1 ) ; } <START_BUG> pid_t child = fork ( ) ; <END_BUG> if ( child < 0 ) errExit ( "fork" ) ; if ( child == 0 ) { drop_privs ( 0 ) ; int rv = copy_file ( src, dest, getuid ( ), getgid ( ), S_IRUSR | S_IWUSR ) ;  if ( rv ) <START_BUG> fprintf ( stderr, "Warning:   cannot   transfer  .Xauthority   in   private   home   directory\\n" ) ; else { <END_BUG> fs_logger2 ( "clone", dest ) ;  } _exit ( 0 ) ; } waitpid ( child, NULL, 0 ) ; unlink ( src ) ; }

Fix:
<S2SV_ModStart> ) ; } copy_file_as_user <S2SV_ModEnd> ( src, <S2SV_ModStart> S_IWUSR ) ; <S2SV_ModEnd> fs_logger2 ( "clone" <S2SV_ModStart> "clone", dest <S2SV_ModEnd> ) ; unlink
Buggy code:
 static int __mkroute_input ( struct sk_buff * skb, const struct fib_result * res, struct in_device * in_dev, __be32 daddr, __be32 saddr, u32 tos ) { struct fib_nh_exception * fnhe ; struct rtable * rth ; int err ; struct in_device * out_dev ; unsigned int flags = 0 ; bool do_cache ; u32 itag = 0 ; out_dev = __in_dev_get_rcu ( FIB_RES_DEV ( * res ) ) ; if ( out_dev == NULL ) { net_crit_ratelimited ( "Bug   in   ip_route_input_slow().   Please   report.\\n" ) ; return - EINVAL ; } err = fib_validate_source ( skb, saddr, daddr, tos, FIB_RES_OIF ( * res ), in_dev -> dev, in_dev, & itag ) ; if ( err < 0 ) { ip_handle_martian_source ( in_dev -> dev, in_dev, skb, daddr, saddr ) ; goto cleanup ; } do_cache = res -> fi &&! itag ; if ( out_dev == in_dev && err && IN_DEV_TX_REDIRECTS ( out_dev ) && <START_BUG> ( IN_DEV_SHARED_MEDIA ( out_dev ) || <END_BUG>  inet_addr_onlink ( out_dev, saddr, FIB_RES_GW ( * res ) ) ) ) { <START_BUG> flags |= RTCF_DOREDIRECT ; do_cache = false ; } if ( skb -> protocol!= htons ( ETH_P_IP ) ) { if ( out_dev == in_dev && IN_DEV_PROXY_ARP_PVLAN ( in_dev ) == 0 ) { err = - EINVAL ; goto cleanup ; } } fnhe = find_exception ( & FIB_RES_NH ( * res ), daddr ) ; if ( do_cache ) { if ( fnhe!= NULL ) rth = rcu_dereference ( fnhe -> fnhe_rth_input ) ; else rth = rcu_dereference ( FIB_RES_NH ( *<END_BUG>

Fix:
<S2SV_ModStart> out_dev ) && skb -> protocol == htons ( ETH_P_IP ) && <S2SV_ModStart> ) ) ) IPCB ( skb ) -> flags |= IPSKB_DOREDIRECT ; <S2SV_ModEnd> if ( skb
Buggy code:
 int bpf_check ( struct bpf_prog * * prog, union bpf_attr * attr ) { struct bpf_verifier_env * env ; struct bpf_verifer_log * log ; int ret = - EINVAL ; if ( ARRAY_SIZE ( bpf_verifier_ops ) == 0 ) return - EINVAL ; env = kzalloc ( sizeof ( struct bpf_verifier_env ), GFP_KERNEL ) ; if (! env ) return - ENOMEM ; log = & env -> log ; env -> insn_aux_data = vzalloc ( sizeof ( struct bpf_insn_aux_data ) * ( * prog ) -> len ) ; ret = - ENOMEM ; if (! env -> insn_aux_data ) goto err_free_env ; env -> prog = * prog ; env -> ops = bpf_verifier_ops [ env -> prog -> type ] ; mutex_lock ( & bpf_verifier_lock ) ; if ( attr -> log_level || attr -> log_buf || attr -> log_size ) { log -> level = attr -> log_level ; log -> ubuf = ( char __user * ) ( unsigned long ) attr -> log_buf ; log -> len_total = attr -> log_size ; ret = - EINVAL ; if ( log -> len_total < 128 || log -> len_total > UINT_MAX >> 8 ||! log -> level ||! log -> ubuf ) goto err_unlock ; } env -> strict_alignment =!! ( attr -> prog_flags & BPF_F_STRICT_ALIGNMENT ) ; if (! IS_ENABLED ( CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS ) ) env -> strict_alignment = true ; if ( env -> prog -> aux -> offload ) { ret = bpf_prog_offload_verifier_prep ( env ) ; if ( ret ) goto err_unlock ; } ret = replace_map_fd_with_map_ptr ( env ) ; if ( ret < 0 ) goto skip_full_check ; env -> explored_states = kcalloc ( env -> prog -> len, sizeof ( struct bpf_verifier_state_list * ), GFP_USER ) ; ret = - ENOMEM ; if (! env -> explored_states ) goto skip_full

Fix:
<S2SV_ModStart> == 0 ) sanitize_dead_code ( env ) ; if ( ret == 0 )
Buggy code:
 <START_BUG> static UINT32 nsc_rle_encode ( BYTE * in, BYTE * out, UINT32 originalSize ) <END_BUG> { UINT32 left ; UINT32 runlength = 1 ; UINT32 planeSize = 0 ; left = originalSize ; while ( left > 4 && planeSize < originalSize - 4 ) { if ( left > 5 && * in == * ( in + 1 ) ) { runlength ++ ; } else if ( runlength == 1 ) { * out ++ = * in ; planeSize ++ ; } else if ( runlength < 256 ) { * out ++ = * in ; * out ++ = * in ; * out ++ = runlength - 2 ; runlength = 1 ; planeSize += 3 ; } else { * out ++ = * in ; * out ++ = * in ; * out ++ = 0xFF ; * out ++ = ( runlength & 0x000000FF ) ; * out ++ = ( runlength & 0x0000FF00 ) >> 8 ; * out ++ = ( runlength & 0x00FF0000 ) >> 16 ; * out ++ = ( runlength & 0xFF000000 ) >> 24 ; runlength = 1 ; planeSize += 7 ; } in ++ ; left -- ; } if ( planeSize < originalSize - 4 ) CopyMemory ( out, in, 4 ) ; planeSize += 4 ; return planeSize ; }

Fix:
<S2SV_ModStart> UINT32 nsc_rle_encode ( const
Buggy code:
 WORD32 ih264d_parse_islice_data_cabac ( dec_struct_t * ps_dec, dec_slice_params_t * ps_slice, UWORD16 u2_first_mb_in_slice ) { UWORD8 uc_more_data_flag ; UWORD8 u1_num_mbs, u1_mb_idx ; dec_mb_info_t * ps_cur_mb_info ; deblk_mb_t * ps_cur_deblk_mb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; UWORD16 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; WORD16 i2_cur_mb_addr ; UWORD8 u1_mbaff ; UWORD8 u1_num_mbs_next, u1_end_of_row, u1_tfr_n_mb ; WORD32 ret = OK ; ps_dec -> u1_qp = ps_slice -> u1_slice_qp ; ih264d_update_qp ( ps_dec, 0 ) ; u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; if ( ps_bitstrm -> u4_ofst & 0x07 ) { ps_bitstrm -> u4_ofst += 8 ; ps_bitstrm -> u4_ofst &= 0xFFFFFFF8 ; } ret = ih264d_init_cabac_dec_envirnoment ( & ( ps_dec -> s_cab_dec_env ), ps_bitstrm ) ; if ( ret!= OK ) return ret ; ih264d_init_cabac_contexts ( I_SLICE, ps_dec ) ; ps_dec -> i1_prev_mb_qp_delta = 0 ; u1_mb_idx = ps_dec -> u1_mb_idx ; u1_num_mbs = u1_mb_idx ; uc_more_data_flag = 1 ; i2_cur_mb_addr = u2_first_mb_in_slice << u1_mbaff ; do { UWORD16 u2_

Fix:
<S2SV_ModStart> ; } u1_num_mbs <S2SV_ModEnd> ++ ; } <S2SV_ModStart> ) ; } ps_dec -> u2_total_mbs_coded += u1_num_mbs ;
Buggy code:
 static __u8 * ch_report_fixup ( struct hid_device * hdev, __u8 * rdesc, unsigned int * rsize ) { <START_BUG> if ( * rsize >= 17 && rdesc [ 11 ] == 0x3c && rdesc [ 12 ] == 0x02 ) { <END_BUG> hid_info ( hdev, "fixing   up   Cherry   Cymotion   report   descriptor\\n" ) ; rdesc [ 11 ] = rdesc [ 16 ] = 0xff ; rdesc [ 12 ] = rdesc [ 17 ] = 0x03 ; } return rdesc ; }

Fix:
<S2SV_ModStart> * rsize >= 18 <S2SV_ModEnd> && rdesc [
Buggy code:
 static mrb_value fiber_switch ( mrb_state * mrb, mrb_value self, mrb_int len, const mrb_value * a, mrb_bool resume, mrb_bool vmexec ) { struct mrb_context * c = fiber_check ( mrb, self ) ; struct mrb_context * old_c = mrb -> c ; <START_BUG> mrb_value value ; <END_BUG>  fiber_check_cfunc ( mrb, c ) ; <START_BUG> <END_BUG> if ( resume && c -> status == MRB_FIBER_TRANSFERRED ) {  mrb_raise ( mrb, E_FIBER_ERROR, "resuming   transferred   fiber" ) ; } <START_BUG> if ( c -> status == MRB_FIBER_RUNNING || c -> status == MRB_FIBER_RESUMED ) { <END_BUG> mrb_raise ( mrb, E_FIBER_ERROR, "double   resume   (fib)" ) ; }  if ( c -> status == MRB_FIBER_TERMINATED ) { <START_BUG> mrb_raise ( mrb, E_FIBER_ERROR, "resuming   dead   fiber" ) ; } <END_BUG> mrb -> c -> status = resume? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED ;  c -> prev = resume? mrb -> c : ( c -> prev? c -> prev : mrb -> root_c ) ; <START_BUG> if ( c -> status == MRB_FIBER_CREATED ) { <END_BUG> mrb_value * b, * e ;  if ( len >= c -> stend - c -> stack ) { <START_BUG> mrb_raise ( mrb, E_FIBER_ERROR, "too   many   arguments   to   fiber" ) ; } b = c -> stack + 1 ; e = b + len ; while ( b < e ) { * b ++ = * a ++ ; } c -> cibase -> argc = ( int ) len ; value = c -> stack [ 0 ] = MRB_PROC_ENV ( c -> ci -> proc ) -> stack [ 0 ] ; } else { value = fiber_result ( mrb, a, len ) ; } <END_BUG> fiber_switch_context ( mrb, c ) ;  if ( vmexec ) { c

Fix:
<S2SV_ModStart> -> c ; enum mrb_fiber_state status ; <S2SV_ModStart>, c ) ; status = c -> status <S2SV_ModStart> ( resume && <S2SV_ModEnd> status == MRB_FIBER_TRANSFERRED <S2SV_ModStart> } if ( <S2SV_ModEnd> status == MRB_FIBER_RUNNING <S2SV_ModStart> == MRB_FIBER_RUNNING || <S2SV_ModEnd> status == MRB_FIBER_RESUMED <S2SV_ModStart> } if ( <S2SV_ModEnd> status == MRB_FIBER_TERMINATED <S2SV_ModStart> ) ; } old_c <S2SV_ModEnd> -> status = <S2SV_ModStart> root_c ) ; fiber_switch_context ( mrb, c ) ; if ( <S2SV_ModEnd> status == MRB_FIBER_CREATED <S2SV_ModStart> * e ; mrb_stack_extend ( mrb, len + 2 ) ; <S2SV_ModEnd> b = c <S2SV_ModStart> ) ; } <S2SV_ModEnd> if ( vmexec
Buggy code:
 static int cib_tls_close ( cib_t * cib ) { <START_BUG> cib_remote_opaque_t * private = cib -> variant_opaque ; <END_BUG> shutdown ( private -> command. socket, SHUT_RDWR ) ; shutdown ( private -> callback. socket, SHUT_RDWR ) ; close ( private -> command. socket ) ; close ( private -> callback. socket ) ; # ifdef HAVE_GNUTLS_GNUTLS_H if ( private -> command. encrypted ) {  gnutls_bye ( * ( private -> command. session ), GNUTLS_SHUT_RDWR ) ; <START_BUG> gnutls_deinit ( * ( private -> command. session ) ) ; gnutls_free ( private -> command. session ) ; <END_BUG> gnutls_bye ( * ( private -> callback. session ), GNUTLS_SHUT_RDWR ) ;  gnutls_deinit ( * ( private -> callback. session ) ) ; gnutls_free ( private -> callback. session ) ; <START_BUG> gnutls_anon_free_client_credentials ( anon_cred_c ) ; <END_BUG>  gnutls_global_deinit ( ) ; <START_BUG> } # endif <END_BUG> return 0 ;  }

Fix:
<S2SV_ModStart> cib -> variant_opaque <S2SV_ModEnd> ; # ifdef <S2SV_ModStart> encrypted ) { if ( private -> command. session ) { <S2SV_ModStart> session ) ; } if ( private -> callback. session ) { <S2SV_ModStart> session ) ; } private -> command. session = NULL ; private -> callback. session = NULL ; if ( remote_gnutls_credentials_init ) { <S2SV_ModStart> ( ) ; remote_gnutls_credentials_init = FALSE ; } <S2SV_ModStart> } # endif if ( private -> command. socket ) { shutdown ( private -> command. socket, SHUT_RDWR ) ; close ( private -> command. socket ) ; } if ( private -> callback. socket ) { shutdown ( private -> callback. socket, SHUT_RDWR ) ; close ( private -> callback. socket ) ; } private -> command. socket = 0 ; private -> callback. socket = 0 ; free ( private -> command. recv_buf ) ; free ( private -> callback. recv_buf ) ; private -> command. recv_buf = NULL ; private -> callback. recv_buf = NULL ;
Buggy code:
 static int propagate_one ( struct mount * m ) { struct mount * child ; int type ; if ( IS_MNT_NEW ( m ) ) return 0 ; if (! is_subdir ( mp -> m_dentry, m -> mnt. mnt_root ) ) return 0 ; if ( peers ( m, last_dest ) ) { type = CL_MAKE_SHARED ; } else { struct mount * n, * p ; bool done ; for ( n = m ; ; n = p ) { p = n -> mnt_master ; if ( p == dest_master || IS_MNT_MARKED ( p ) ) break ; } do { struct mount * parent = last_source -> mnt_parent ; if ( last_source == first_source ) break ; done = parent -> mnt_master == p ; if ( done && peers ( n, parent ) ) break ; last_source = last_source -> mnt_master ; } while (! done ) ; type = CL_SLAVE ; if ( IS_MNT_SHARED ( m ) ) type |= CL_MAKE_SHARED ; } if ( m -> mnt_ns -> user_ns!= user_ns ) type |= CL_UNPRIVILEGED ; child = copy_tree ( last_source, last_source -> mnt. mnt_root, type ) ; if ( IS_ERR ( child ) ) return PTR_ERR ( child ) ; child -> mnt. mnt_flags &= ~ MNT_LOCKED ; mnt_set_mountpoint ( m, mp, child ) ; last_dest = m ; last_source = child ; if ( m -> mnt_master!= dest_master ) { read_seqlock_excl ( & mount_lock ) ; SET_MNT_MARK ( m -> mnt_master ) ; read_sequnlock_excl ( & mount_lock ) ; } hlist_add_head ( & child -> mnt_hash, list ) ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return count_mounts ( m -> mnt_ns, child ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 asmlinkage void do_sparc_fault ( struct pt_regs * regs, int text_fault, int write, unsigned long address ) { struct vm_area_struct * vma ; struct task_struct * tsk = current ; struct mm_struct * mm = tsk -> mm ; unsigned int fixup ; unsigned long g2 ; int from_user =! ( regs -> psr & PSR_PS ) ; int fault, code ; if ( text_fault ) address = regs -> pc ; code = SEGV_MAPERR ; if (! ARCH_SUN4C && address >= TASK_SIZE ) goto vmalloc_fault ; if ( in_atomic ( ) ||! mm ) goto no_context ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address ) ; <END_BUG> down_read ( & mm -> mmap_sem ) ; if (! from_user && address >= PAGE_OFFSET ) goto bad_area ; vma = find_vma ( mm, address ) ; if (! vma ) goto bad_area ; if ( vma -> vm_start <= address ) goto good_area ; if (! ( vma -> vm_flags & VM_GROWSDOWN ) ) goto bad_area ; if ( expand_stack ( vma, address ) ) goto bad_area ; good_area : code = SEGV_ACCERR ; if ( write ) { if (! ( vma -> vm_flags & VM_WRITE ) ) goto bad_area ; } else { if (! ( vma -> vm_flags & ( VM_READ | VM_EXEC ) ) ) goto bad_area ; } fault = handle_mm_fault ( mm, vma, address, write? FAULT_FLAG_WRITE : 0 ) ; if ( unlikely ( fault & VM_FAULT_ERROR ) ) { if ( fault & VM_FAULT_OOM ) goto out_of_memory ; else if ( fault & VM_FAULT_SIGBUS ) goto do_sigbus ; BUG ( ) ; } if ( fault & VM_FAULT_MAJOR ) { current -> maj_flt ++ ;  perf_sw_event ( PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0, <START_BUG> regs, address ) ; } else { current -> min_flt<END_BUG>

Fix:
<S2SV_ModStart> PERF_COUNT_SW_PAGE_FAULTS, 1 <S2SV_ModEnd>, regs, <S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address <S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 <START_BUG> int ntlm_read_message_fields ( wStream * s, NTLM_MESSAGE_FIELDS * fields ) <END_BUG> { if ( Stream_GetRemainingLength ( s ) < 8 ) return - 1 ; Stream_Read_UINT16 ( s, fields -> Len ) ; Stream_Read_UINT16 ( s, fields -> MaxLen ) ; Stream_Read_UINT32 ( s, fields -> BufferOffset ) ; return 1 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static const u_char * <START_BUG> ikev1_attr_print ( netdissect_options * ndo, const u_char * p, const u_char * ep ) <END_BUG> { int totlen ; uint32_t t ;  if ( p [ 0 ] & 0x80 ) <START_BUG> totlen = 4 ; <END_BUG> else  totlen = 4 + EXTRACT_16BITS ( & p [ 2 ] ) ; <START_BUG> if ( ep < p + totlen ) { <END_BUG> ND_PRINT ( ( ndo, "[|attr]" ) ) ;  return ep + 1 ; <START_BUG> <END_BUG> }  ND_PRINT ( ( ndo, "(" ) ) ; t = EXTRACT_16BITS ( & p [ 0 ] ) & 0x7fff ; ND_PRINT ( ( ndo, "type=#%d   ", t ) ) ; if ( p [ 0 ] & 0x80 ) { ND_PRINT ( ( ndo, "value=" ) ) ; t = p [ 2 ] ; <START_BUG> rawprint ( ndo, ( const uint8_t * ) & p [ 2 ], 2 ) ; <END_BUG> } else {  ND_PRINT ( ( ndo, "len=%d   value=", EXTRACT_16BITS ( & p [ 2 ] ) ) ) ; <START_BUG> <END_BUG> rawprint ( ndo, ( const uint8_t * ) & p [ 4 ], EXTRACT_16BITS ( & p [ 2 ] ) ) ;  } ND_PRINT ( ( ndo, ")" ) ) ; <START_BUG> return p + totlen ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> const u_char * ep2 <S2SV_ModEnd> ) { int <S2SV_ModStart> uint32_t t ; ND_TCHECK ( p [ 0 ] ) ; <S2SV_ModStart> 4 ; else { ND_TCHECK_16BITS ( & p [ 2 ] ) ; <S2SV_ModStart> ] ) ; } if ( ep2 <S2SV_ModEnd> < p + <S2SV_ModStart> ) ; return ep2 <S2SV_ModEnd> + 1 ; <S2SV_ModStart> 1 ; } ND_TCHECK_16BITS ( & p [ 0 ] ) ; <S2SV_ModStart> 2 ] ; if (! <S2SV_ModStart>, 2 ) ) { ND_PRINT ( ( ndo, ")" ) ) ; goto trunc ; } <S2SV_ModEnd> } else { <S2SV_ModStart>, "len=%d <S2SV_blank> value=", totlen - 4 ) ) ; if (! <S2SV_ModEnd> rawprint ( ndo <S2SV_ModStart> 4 ], totlen - 4 ) ) { <S2SV_ModEnd> ND_PRINT ( ( <S2SV_ModStart> ) ) ; goto trunc ; } } ND_PRINT ( ( ndo, ")" ) ) ; <S2SV_ModStart> + totlen ; trunc : return NULL ;