nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void exif_mnote_data_olympus_load ( ExifMnoteData * en, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataOlympus * n = ( ExifMnoteDataOlympus * ) en ; ExifShort c ; size_t i, tcount, o, o2, datao = 6, base = 0 ; if (! n ||! buf ||! buf_size ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataOlympus", "Short   MakerNote" ) ; return ; } o2 = 6 + n -> offset ; <START_BUG> if ( ( o2 + 10 < o2 ) || ( o2 + 10 < 10 ) || ( o2 + 10 > buf_size ) ) { <END_BUG> exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataOlympus", "Short   MakerNote" ) ; return ; } n -> version = exif_mnote_data_olympus_identify_variant ( buf + o2, buf_size - o2 ) ; switch ( n -> version ) { case olympusV1 : case sanyoV1 : case epsonV1 : exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus", "Parsing   Olympus//Sanyo//Epson   maker   note   v1..." ) ; if ( buf [ o2 + 6 ] == 1 ) n -> order = EXIF_BYTE_ORDER_INTEL ; else if ( buf [ o2 + 6 + 1 ] == 1 ) n -> order = EXIF_BYTE_ORDER_MOTOROLA ; o2 += 8 ; c = exif_get_short ( buf + o2, n -> order ) ; if ( (! ( c & 0xFF ) ) && ( c > 0x500 ) ) { if ( n -> order == EXIF_BYTE_ORDER_INTEL ) { n -> order = EXIF_BYTE_ORDER_MOTOROLA ; } else { n -> order = EXIF_BYTE_ORDER_INTEL

Fix:
<S2SV_ModStart> ; if ( CHECKOVERFLOW ( o2, buf_size, 10 <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; if ( CHECKOVERFLOW ( o2, buf_size, 4 <S2SV_ModEnd> ) ) return <S2SV_ModStart> ; if ( CHECKOVERFLOW ( o2, buf_size, 12 <S2SV_ModEnd> ) ) return <S2SV_ModStart> } if ( CHECKOVERFLOW ( o2, buf_size, 2 <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; if ( CHECKOVERFLOW ( o, buf_size, 12 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteOlympus", "Short <S2SV_blank> MakerNote" ) ; break ; } n -> entries [ tcount ]. tag = exif_get_short ( buf + o, n -> order ) + base ; n -> entries [ tcount ]. format = exif_get_short ( buf + o + 2, n -> order ) ; n -> entries [ tcount ]. components = exif_get_long ( buf + o + 4, n -> order ) ; n -> entries [ tcount ]. order = n -> order ; exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "
Buggy code:
 void LineTo ( double x1, double y1 ) { <START_BUG> outpos += <END_BUG> sprintf ( outpos, "\\n   %12.3f   %12.3f   l", x1, y1 ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> y1 ) { sprintf ( outputbuffer <S2SV_ModEnd>, "\\n <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> l", <S2SV_ModStart> y1 ) ; sendClean ( outputbuffer ) ;
Buggy code:
 <START_BUG> static void set_rt_speed_feature ( VP9_COMMON * cm, SPEED_FEATURES * sf, <END_BUG>  int speed ) { <START_BUG> sf -> static_segmentation = 0 ; sf -> adaptive_rd_thresh = 1 ; <END_BUG> sf -> encode_breakout_thresh = 1 ;  sf -> use_fast_coef_costing = 1 ; <START_BUG> if ( speed == 1 ) { <END_BUG> sf -> use_square_partition_only =! frame_is_intra_only ( cm ) ; sf -> less_rectangular_check = 1 ; sf -> tx_size_search_method = frame_is_intra_only ( cm )? USE_FULL_RD : USE_LARGESTALL ;  if ( MIN ( cm -> width, cm -> height ) >= 720 ) <START_BUG> sf -> disable_split_mask = cm -> show_frame? DISABLE_ALL_SPLIT : DISABLE_ALL_INTER_SPLIT ; else sf -> disable_split_mask = DISABLE_COMPOUND_SPLIT ; sf -> use_rd_breakout = 1 ; sf -> adaptive_motion_search = 1 ; sf -> adaptive_pred_interp_filter = 1 ; <END_BUG> sf -> auto_mv_step_size = 1 ;  sf -> adaptive_rd_thresh = 2 ; sf -> intra_y_mode_mask [ TX_32X32 ] = INTRA_DC_H_V ; sf -> intra_uv_mode_mask [ TX_32X32 ] = INTRA_DC_H_V ; <START_BUG> sf -> intra_uv_mode_mask [ TX_16X16 ] = INTRA_DC_H_V ; <END_BUG> sf -> encode_breakout_thresh = 8 ; } if ( speed >= 2 ) {  sf -> use_square_partition_only =! frame_is_intra_only ( cm ) ; <START_BUG> sf -> less_rectangular_check = 1 ; sf -> tx_size_search_method = frame_is_intra_only ( cm )? USE_FULL_RD : USE_LARGESTALL ; if ( MIN ( cm -> width, cm -> height ) >= 720 ) sf -> disable_split_mask = cm -> show_frame? DISABLE_ALL_SPLIT : DISABLE_ALL_INTER_SPLIT ;<END_BUG>

Fix:
<S2SV_ModStart> void set_rt_speed_feature ( VP9_COMP * cpi <S2SV_ModEnd>, SPEED_FEATURES * <S2SV_ModStart>, int speed, vp9e_tune_content content ) { VP9_COMMON * const cm = & cpi -> common ; const int is_keyframe = cm -> frame_type == KEY_FRAME ; const int frames_since_key = is_keyframe? 0 : cpi -> rc. frames_since_key ; <S2SV_ModEnd> sf -> static_segmentation <S2SV_ModStart> ; sf -> <S2SV_ModEnd> use_fast_coef_costing = 1 <S2SV_ModStart> if ( speed >= <S2SV_ModEnd> 1 ) { <S2SV_ModStart> : USE_LARGESTALL ; <S2SV_ModEnd> sf -> use_rd_breakout <S2SV_ModStart> ; sf -> mv. <S2SV_ModStart> ] = INTRA_DC_H_V <S2SV_ModEnd> ; } if <S2SV_ModStart> { sf -> mode_search_skip_flags = ( cm -> frame_type == KEY_FRAME )? 0 : <S2SV_ModEnd> FLAG_SKIP_INTRA_DIRMISMATCH | FLAG_SKIP_INTRA_BESTINTER <S2SV_ModStart> ; sf -> <S2SV_ModEnd> adaptive_pred_interp_filter = 2 <S2SV_ModStart> ; sf -> reference_masking = ( cpi -> oxcf. resize_
Buggy code:
 <START_BUG> void vp9_idct8x8_add ( const int16_t * input, uint8_t * dest, int stride, int eob ) { <END_BUG> if ( eob == 1 )  vp9_idct8x8_1_add ( input, dest, stride ) ; <START_BUG> <END_BUG> else if ( eob <= 10 )  vp9_idct8x8_10_add ( input, dest, stride ) ; else <START_BUG> vp9_idct8x8_64_add ( input, dest, stride ) ; <END_BUG> }

Fix:
<S2SV_ModStart> vp9_idct8x8_add ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> == 1 ) vpx_idct8x8_1_add <S2SV_ModEnd> ( input, <S2SV_ModStart> ( eob <= 12 ) vpx_idct8x8_12_add <S2SV_ModEnd> ( input, <S2SV_ModStart> ) ; else vpx_idct8x8_64_add <S2SV_ModEnd> ( input,
Buggy code:
 WORD32 ih264d_parse_decode_slice ( UWORD8 u1_is_idr_slice, UWORD8 u1_nal_ref_idc, dec_struct_t * ps_dec ) { dec_bit_stream_t * ps_bitstrm = ps_dec -> ps_bitstrm ; dec_pic_params_t * ps_pps ; dec_seq_params_t * ps_seq ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; pocstruct_t s_tmp_poc ; WORD32 i_delta_poc [ 2 ] ; WORD32 i4_poc = 0 ; UWORD16 u2_first_mb_in_slice, u2_frame_num ; UWORD8 u1_field_pic_flag, u1_redundant_pic_cnt = 0, u1_slice_type ; UWORD32 u4_idr_pic_id = 0 ; UWORD8 u1_bottom_field_flag, u1_pic_order_cnt_type ; UWORD8 u1_nal_unit_type ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; WORD8 i1_is_end_of_poc ; WORD32 ret, end_of_frame ; WORD32 prev_slice_err, num_mb_skipped ; UWORD8 u1_mbaff ; pocstruct_t * ps_cur_poc ; UWORD32 u4_temp ; WORD32 i_temp ; UWORD32 u4_call_end_of_pic = 0 ; ps_dec -> ps_dpb_cmds -> u1_dpb_commands_read_slc = 0 ; u2_first_mb_in_slice = ih264d_uev ( pu4_bitstrm_ofst, pu4_bitstrm_buf ) ; if ( u2_first_mb_in_slice > ( ps_dec -> u2_frm_ht_in_mbs * ps_dec -> u2_frm_

Fix:
<S2SV_ModStart> == 0 ) { <S2SV_ModStart> ps_parse_cur_slice ++ ; ps_dec -> u2_cur_slice_num ++ ; } <S2SV_ModStart> ; ps_dec -> <S2SV_ModEnd> i2_prev_slice_mbx = ps_dec
Buggy code:
 int au1100fb_fb_mmap ( struct fb_info * fbi, struct vm_area_struct * vma ) { struct au1100fb_device * fbdev ; <START_BUG> unsigned int len ; <END_BUG> unsigned long start = 0, off ;  fbdev = to_au1100fb_device ( fbi ) ; <START_BUG> if ( vma -> vm_pgoff > ( ~ 0UL >> PAGE_SHIFT ) ) { return - EINVAL ; } start = fbdev -> fb_phys & PAGE_MASK ; len = PAGE_ALIGN ( ( start & ~ PAGE_MASK ) + fbdev -> fb_len ) ; off = vma -> vm_pgoff << PAGE_SHIFT ; if ( ( vma -> vm_end - vma -> vm_start + off ) > len ) { return - EINVAL ; } off += start ; vma -> vm_pgoff = off >> PAGE_SHIFT ; vma -> vm_page_prot = pgprot_noncached ( vma -> vm_page_prot ) ; pgprot_val ( vma -> vm_page_prot ) |= ( 6 << 9 ) ; <END_BUG> if ( io_remap_pfn_range ( vma, vma -> vm_start, off >> PAGE_SHIFT,  vma -> vm_end - vma -> vm_start, vma -> vm_page_prot ) ) { return - EAGAIN ; } return 0 ; }

Fix:
<S2SV_ModStart> * fbdev ; <S2SV_ModEnd> fbdev = to_au1100fb_device <S2SV_ModStart> ( fbi ) <S2SV_ModEnd> ; vma -> <S2SV_ModStart> 9 ) ; return vm_iomap_memory <S2SV_ModEnd> ( vma, <S2SV_ModStart> ( vma, fbdev -> fb_phys, fbdev -> fb_len ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 long do_shmat ( int shmid, char __user * shmaddr, int shmflg, ulong * raddr, unsigned long shmlba ) { struct shmid_kernel * shp ; unsigned long addr ; unsigned long size ; struct file * file ; int err ; unsigned long flags ; unsigned long prot ; int acc_mode ; struct ipc_namespace * ns ; struct shm_file_data * sfd ; struct path path ; fmode_t f_mode ; unsigned long populate = 0 ; err = - EINVAL ; if ( shmid < 0 ) goto out ; else if ( ( addr = ( ulong ) shmaddr ) ) { if ( addr & ( shmlba - 1 ) ) { if ( shmflg & SHM_RND ) addr &= ~ ( shmlba - 1 ) ; else # ifndef __ARCH_FORCE_SHMLBA if ( addr & ~ PAGE_MASK ) # endif goto out ; } flags = MAP_SHARED | MAP_FIXED ; } else { if ( ( shmflg & SHM_REMAP ) ) goto out ; flags = MAP_SHARED ; } if ( shmflg & SHM_RDONLY ) { prot = PROT_READ ; acc_mode = S_IRUGO ; f_mode = FMODE_READ ; } else { prot = PROT_READ | PROT_WRITE ; acc_mode = S_IRUGO | S_IWUGO ; f_mode = FMODE_READ | FMODE_WRITE ; } if ( shmflg & SHM_EXEC ) { prot |= PROT_EXEC ; acc_mode |= S_IXUGO ; } ns = current -> nsproxy -> ipc_ns ; rcu_read_lock ( ) ; shp = shm_obtain_object_check ( ns, shmid ) ; if ( IS_ERR ( shp ) ) { err = PTR_ERR ( shp ) ; goto out_unlock ; } err = - EACCES ; if ( ipcperms ( ns, & shp -> shm_perm, acc_mode ) ) goto out_unlock ; err = security_shm_shmat ( shp, shmaddr, shmflg ) ; if ( err ) goto out_unlock ; <START_BUG> ipc_lock_object (<END_BUG>

Fix:
<S2SV_ModStart> shm_perm ) ; if ( shp -> shm_file == NULL ) { ipc_unlock_object ( & shp -> shm_perm ) ; err = - EIDRM ; goto out_unlock ; }
Buggy code:
 int add_control_packet ( struct mt_packet * packet, enum mt_cptype cptype, void * cpdata, unsigned short data_len ) { unsigned char * data = packet -> data + packet -> size ; unsigned int act_size = data_len + ( cptype == MT_CPTYPE_PLAINDATA? 0 : MT_CPHEADER_LEN ) ; <START_BUG> if ( packet -> size + act_size > MT_PACKET_LEN ) { <END_BUG> fprintf ( stderr, _ ( "add_control_packet:   ERROR,   too   large   packet.   Exceeds   %d   bytes\\n" ), MT_PACKET_LEN ) ; return - 1 ; } if ( cptype == MT_CPTYPE_PLAINDATA ) { memcpy ( data, cpdata, data_len ) ; packet -> size += data_len ; return data_len ; } memcpy ( data, mt_mactelnet_cpmagic, sizeof ( mt_mactelnet_cpmagic ) ) ; data [ 4 ] = cptype ; # if BYTE_ORDER == LITTLE_ENDIAN { unsigned int templen ; templen = htonl ( data_len ) ; memcpy ( data + 5, & templen, sizeof ( templen ) ) ; } # else memcpy ( data + 5, & data_len, sizeof ( data_len ) ) ; # endif if ( data_len > 0 ) { memcpy ( data + MT_CPHEADER_LEN, cpdata, data_len ) ; } packet -> size += act_size ; return act_size ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> act_size > MT_PACKET_LEN <S2SV_ModStart> act_size > MT_PACKET_LEN - packet -> size
Buggy code:
 static int snd_ctl_tlv_ioctl ( struct snd_ctl_file * file, struct snd_ctl_tlv __user * _tlv, int op_flag ) { struct snd_card * card = file -> card ; struct snd_ctl_tlv tlv ; struct snd_kcontrol * kctl ; struct snd_kcontrol_volatile * vd ; unsigned int len ; int err = 0 ; if ( copy_from_user ( & tlv, _tlv, sizeof ( tlv ) ) ) return - EFAULT ; if ( tlv. length < sizeof ( unsigned int ) * 2 ) return - EINVAL ; down_read ( & card -> controls_rwsem ) ; kctl = snd_ctl_find_numid ( card, tlv. numid ) ; if ( kctl == NULL ) { err = - ENOENT ; goto __kctl_end ; } if ( kctl -> tlv. p == NULL ) { err = - ENXIO ; goto __kctl_end ; } vd = & kctl -> vd [ tlv. numid - kctl -> id. numid ] ; if ( ( op_flag == 0 && ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_READ ) == 0 ) || ( op_flag > 0 && ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE ) == 0 ) || ( op_flag < 0 && ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND ) == 0 ) ) { err = - ENXIO ; goto __kctl_end ; } if ( vd -> access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK ) { if ( vd -> owner!= NULL && vd -> owner!= file ) { err = - EPERM ; goto __kctl_end ; } err = kctl -> tlv. c ( kctl, op_flag, tlv. length, _tlv -> tlv ) ; if ( err > 0 ) { <START_BUG> up_read ( & card -> controls_rwsem ) ; <END_BUG>  snd_ctl_notify ( card, SNDRV_CTL_EVENT_MASK_TLV, & kctl -> id ) ;

Fix:
<S2SV_ModStart> 0 ) { struct snd_ctl_elem_id id = kctl -> id ; <S2SV_ModStart> SNDRV_CTL_EVENT_MASK_TLV, & <S2SV_ModEnd> id ) ;
Buggy code:
 void main_cleanup ( ) { # ifdef USE_OS_THREADS CLI * c ; unsigned i, threads ; THREAD_ID * thread_list ; CRYPTO_THREAD_write_lock ( stunnel_locks [ LOCK_THREAD_LIST ] ) ; threads = 0 ; for ( c = thread_head ; c ; c = c -> thread_next ) threads ++ ; thread_list = str_alloc ( ( threads + 1 ) * sizeof ( THREAD_ID ) ) ; i = 0 ; for ( c = thread_head ; c ; c = c -> thread_next ) { thread_list [ i ++ ] = c -> thread_id ; s_log ( LOG_DEBUG, "Terminating   a   thread   for   [%s]", c -> opt -> servname ) ; } if ( cron_thread_id ) { thread_list [ threads ++ ] = cron_thread_id ; s_log ( LOG_DEBUG, "Terminating   the   cron   thread" ) ; } CRYPTO_THREAD_unlock ( stunnel_locks [ LOCK_THREAD_LIST ] ) ; if ( threads ) { s_log ( LOG_NOTICE, "Terminating   %u   service   thread(s)", threads ) ; writesocket ( terminate_pipe [ 1 ], "", 1 ) ; for ( i = 0 ; i < threads ; ++ i ) { # ifdef USE_PTHREAD if ( pthread_join ( thread_list [ i ], NULL ) ) s_log ( LOG_ERR, "pthread_join()   failed" ) ; # endif # ifdef USE_WIN32 if ( WaitForSingleObject ( thread_list [ i ], INFINITE ) == WAIT_FAILED ) ioerror ( "WaitForSingleObject" ) ; if (! CloseHandle ( thread_list [ i ] ) ) ioerror ( "CloseHandle" ) ; # endif } s_log ( LOG_NOTICE, "Service   threads   terminated" ) ; } str_free ( thread_list ) ; # endif unbind_ports ( ) ; s_poll_free ( fds ) ; fds = NULL ; # if 0 str_stats ( ) ; # endif <START_BUG> log_flush ( LOG_MODE_ERROR ) ; <END_BUG> log_close ( SINK_SYSLOG | SINK_OUTFILE ) ; }

Fix:
<S2SV_ModStart> endif log_flush ( LOG_MODE_BUFFER <S2SV_ModEnd> ) ; log_close
Buggy code:
 static void yv12_extend_frame_top_c ( YV12_BUFFER_CONFIG * ybf ) { int i ; unsigned char * src_ptr1 ; unsigned char * dest_ptr1 ; unsigned int Border ; int plane_stride ; Border = ybf -> border ; plane_stride = ybf -> y_stride ; src_ptr1 = ybf -> y_buffer - Border ; dest_ptr1 = src_ptr1 - ( Border * plane_stride ) ; for ( i = 0 ; i < ( int ) Border ; i ++ ) { <START_BUG> vpx_memcpy ( dest_ptr1, src_ptr1, plane_stride ) ; <END_BUG> dest_ptr1 += plane_stride ; } plane_stride = ybf -> uv_stride ; Border //= 2 ; src_ptr1 = ybf -> u_buffer - Border ; dest_ptr1 = src_ptr1 - ( Border * plane_stride ) ; for ( i = 0 ; i < ( int ) ( Border ) ; i ++ ) {  vpx_memcpy ( dest_ptr1, src_ptr1, plane_stride ) ; <START_BUG> dest_ptr1 += plane_stride ; } src_ptr1 = ybf -> v_buffer - Border ; dest_ptr1 = src_ptr1 - ( Border * plane_stride ) ; for ( i = 0 ; i < ( int ) ( Border ) ; i ++ ) { <END_BUG> vpx_memcpy ( dest_ptr1, src_ptr1, plane_stride ) ;  dest_ptr1 += plane_stride ; } }

Fix:
<S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr1, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr1, <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( dest_ptr1,
Buggy code:
 static gboolean netscreen_read ( wtap * wth, int * err, gchar * * err_info, gint64 * data_offset ) { gint64 offset ; <START_BUG> int pkt_len ; <END_BUG>  char line [ NETSCREEN_LINE_LENGTH ] ; <START_BUG> char cap_int [ NETSCREEN_MAX_INT_NAME_LENGTH ] ; gboolean cap_dir ; char cap_dst [ 13 ] ; offset = netscreen_seek_next_packet ( wth, err, err_info, line ) ; if ( offset < 0 ) return FALSE ; <END_BUG> pkt_len = parse_netscreen_rec_hdr ( & wth -> phdr, line, cap_int, & cap_dir,  cap_dst, err, err_info ) ; if ( pkt_len == - 1 ) return FALSE ; <START_BUG> if (! parse_netscreen_hex_dump ( wth -> fh, pkt_len, cap_int, <END_BUG>  cap_dst, & wth -> phdr, wth -> frame_buffer, err, err_info ) ) <START_BUG> return FALSE ; if ( wth -> file_encap == WTAP_ENCAP_UNKNOWN ) wth -> file_encap = wth -> phdr. pkt_encap ; else { if ( wth -> file_encap!= wth -> phdr. pkt_encap ) wth -> file_encap = WTAP_ENCAP_PER_PACKET ; } * data_offset = offset ; return TRUE ; }<END_BUG>

Fix:
<S2SV_ModStart> gint64 offset ; <S2SV_ModEnd> char line [ <S2SV_ModStart> line [ NETSCREEN_LINE_LENGTH <S2SV_ModEnd> ] ; offset <S2SV_ModStart> return FALSE ; <S2SV_ModEnd> if (! <S2SV_ModStart> if (! parse_netscreen_packet <S2SV_ModEnd> ( wth -> <S2SV_ModStart> wth -> fh <S2SV_ModEnd>, & wth <S2SV_ModStart> wth -> frame_buffer, line
Buggy code:
 static void scsi_write_data ( SCSIRequest * req ) { SCSIDiskReq * r = DO_UPCAST ( SCSIDiskReq, req, req ) ; SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, r -> req. dev ) ; uint32_t n ; assert ( r -> req. aiocb == NULL ) ; if ( r -> req. cmd. mode!= SCSI_XFER_TO_DEV ) { DPRINTF ( "Data   transfer   direction   invalid\\n" ) ; scsi_write_complete ( r, - EINVAL ) ; return ; } <START_BUG> n = r -> iov. iov_len // 512 ; <END_BUG> if ( n ) { if ( s -> tray_open ) { scsi_write_complete ( r, - ENOMEDIUM ) ; }  qemu_iovec_init_external ( & r -> qiov, & r -> iov, 1 ) ; <START_BUG> bdrv_acct_start ( s -> bs, & r -> acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_WRITE ) ; r -> req. aiocb = bdrv_aio_writev ( s -> bs, r -> sector, & r -> qiov, n, scsi_write_complete, r ) ; if ( r -> req. aiocb == NULL ) { scsi_write_complete ( r, - ENOMEM ) ; } } else { scsi_write_complete ( r, 0 ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> = r -> qiov. size <S2SV_ModEnd> // 512 ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> bdrv_acct_start ( s
Buggy code:
 <START_BUG> static void InsertRow ( Image * image, ssize_t depth, unsigned char * p, ssize_t y, <END_BUG> ExceptionInfo * exception ) {  size_t bit ; ssize_t x ; <START_BUG> <END_BUG> register Quantum * q ;  Quantum index ; index = 0 ; <START_BUG> switch ( depth ) <END_BUG> { case 1 : {  q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; <START_BUG> if ( q == ( Quantum * ) NULL ) break ; for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 7 ) ; x += 8 ) { for ( bit = 0 ; bit < 8 ; bit ++ ) { <END_BUG> index = ( Quantum ) ( ( ( ( * p ) & ( 0x80 >> bit ) )!= 0 )? 0x01 : 0x00 ) ;  SetPixelIndex ( image, index, q ) ; <START_BUG> q += GetPixelChannels ( image ) ; <END_BUG> } p ++ ; } if ( ( image -> columns % 8 )!= 0 ) {  for ( bit = 0 ; bit < ( image -> columns % 8 ) ; bit ++ ) <START_BUG> { <END_BUG> index = ( Quantum ) ( ( ( ( * p ) & ( 0x80 >> bit ) )!= 0 )? 0x01 : 0x00 ) ;  SetPixelIndex ( image, index, q ) ; <START_BUG> q += GetPixelChannels ( image ) ; <END_BUG> } p ++ ; }  ( void ) SyncAuthenticPixels ( image, exception ) ; <START_BUG> break ; } case 2 : { <END_BUG> q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ;  <START_BUG> if ( q == ( Quantum * ) NULL ) <END_BUG> break ; for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 1 ) ; x += 2 ) {  index = ConstrainColormapIndex ( image, ( * p >> 6 ) & 0x3, exception ) ; <START_BUG> SetPixelIndex ( image, index, q ) ; <END_BUG> q += GetPixelChannels ( image ) ;  <START_BUG> index = ConstrainColormapIndex ( image, ( * p >> 4 ) & 0x3, exception ) ; <END_BUG> SetPixelIndex ( image, index, q ) ;  q += GetPixelChannels ( image ) ; <START_BUG> index<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static MagickBooleanType <S2SV_ModEnd> InsertRow ( Image <S2SV_ModStart> image, ssize_t bpp <S2SV_ModEnd>, unsigned char <S2SV_ModStart> exception ) { int bit ; Quantum index <S2SV_ModEnd> ; register Quantum <S2SV_ModStart> ; register Quantum * q ; ssize_t x ; q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( Quantum * ) NULL ) return ( MagickFalse ) <S2SV_ModEnd> ; switch ( <S2SV_ModStart> ; switch ( bpp <S2SV_ModEnd> ) { case <S2SV_ModStart> 1 : { <S2SV_ModEnd> for ( x <S2SV_ModStart> index = ( <S2SV_ModEnd> ( * p <S2SV_ModStart> 0x80 >> bit <S2SV_ModEnd> )? 0x01 <S2SV_ModStart> q ) ; if ( index < image -> colors ) SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; <S2SV_ModStart> bit < ( ssize_t ) ( <S2SV_ModStart> index = ( <S2SV_ModEnd> ( * p <S2SV_ModStart> 0x80 >> bit <S2SV_ModEnd> )? 0x01 <S2SV_ModStart> q ) ; if ( index < image -> colors ) SetPixelViaPixelInfo ( image, image -> colormap + ( ssize_t ) index, q ) ; SetPixel
Buggy code:
 static int8_t parse_ext_option ( uint16_t * dst, uint8_t * * packet_data_pptr, uint8_t * packet_data_start_ptr, uint16_t packet_len, uint16_t * message_left ) { uint16_t option_number = * dst ; if ( option_number == 13 ) { uint8_t option_ext ; int8_t read_result = sn_coap_parser_read_packet_u8 ( & option_ext, * packet_data_pptr, packet_data_start_ptr, packet_len ) ; if ( read_result!= 0 ) { tr_error ( "sn_coap_parser_options_parse   -   **packet_data_pptr   overflow  !" ) ; return - 1 ; } else { <START_BUG> option_number += option_ext ; <END_BUG> * message_left = sn_coap_parser_move_packet_ptr ( packet_data_pptr, packet_data_start_ptr, packet_len, 1 ) ; } } else if ( option_number == 14 ) { int8_t read_result = sn_coap_parser_read_packet_u16 ( & option_number, * packet_data_pptr, packet_data_start_ptr, packet_len ) ; if ( read_result!= 0 ) { tr_error ( "sn_coap_parser_options_parse   -   **packet_data_pptr   overflow  !" ) ; return - 1 ; } else {  option_number += 269 ; <START_BUG> * message_left = sn_coap_parser_move_packet_ptr ( packet_data_pptr, packet_data_start_ptr, packet_len, 2 ) ; } } else if ( option_number == 15 ) { tr_error ( "sn_coap_parser_options_parse   -   invalid   option   number(15)!" ) ; return - 1 ; } * dst = option_number ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> } else { if ( sn_coap_parser_add_u16_limit ( option_number, option_ext, & option_number )!= 0 ) { return - 1 ; } <S2SV_ModEnd> * message_left = <S2SV_ModStart> } else { if ( sn_coap_parser_add_u16_limit ( option_number, 269, & option_number )!= 0 ) { return - 1 ; } <S2SV_ModEnd> * message_left =
Buggy code:
 GF_Err audio_sample_entry_Read ( GF_Box * s, GF_BitStream * bs ) { GF_MPEGAudioSampleEntryBox * ptr ; char * data ; u8 a, b, c, d ; u32 i, size, v, nb_alnum ; GF_Err e ; u64 pos, start ; ptr = ( GF_MPEGAudioSampleEntryBox * ) s ; start = gf_bs_get_position ( bs ) ; gf_bs_seek ( bs, start + 8 ) ; v = gf_bs_read_u16 ( bs ) ; if ( v ) ptr -> is_qtff = 1 ; if ( v == 1 ) { gf_bs_seek ( bs, start + 8 + 20 + 4 ) ; a = gf_bs_read_u8 ( bs ) ; b = gf_bs_read_u8 ( bs ) ; c = gf_bs_read_u8 ( bs ) ; d = gf_bs_read_u8 ( bs ) ; nb_alnum = 0 ; if ( isalnum ( a ) ) nb_alnum ++ ; if ( isalnum ( b ) ) nb_alnum ++ ; if ( isalnum ( c ) ) nb_alnum ++ ; if ( isalnum ( d ) ) nb_alnum ++ ; if ( nb_alnum > 2 ) ptr -> is_qtff = 0 ; } gf_bs_seek ( bs, start ) ; e = gf_isom_audio_sample_entry_read ( ( GF_AudioSampleEntryBox * ) s, bs ) ; if ( e ) return e ; pos = gf_bs_get_position ( bs ) ; size = ( u32 ) s -> size ; if ( gf_bs_get_cookie ( bs ) ) { ptr -> is_qtff |= 1 << 16 ; } e = gf_isom_box_array_read ( s, bs, audio_sample_entry_AddBox ) ; if (! e ) return GF_OK ; if ( size < 8 ) return GF_ISOM_INVALID_FILE ; gf_bs_seek ( bs, pos ) ; data = ( char * ) gf_malloc ( sizeof ( char ) * size ) ; gf_bs_read_data ( bs

Fix:
<S2SV_ModStart> GF_ISOM_BOX_TYPE_ESDS ) { extern Bool use_dump_mode ; <S2SV_ModStart> esd ) { if (! use_dump_mode )
Buggy code:
 SQLITE_PRIVATE int sqlite3VdbeSorterWrite ( const VdbeCursor * pCsr, Mem * pVal ) { VdbeSorter * pSorter ; int rc = SQLITE_OK ; SorterRecord * pNew ; int bFlush ; int nReq ; int nPMA ; int t ; assert ( pCsr -> eCurType == CURTYPE_SORTER ) ; pSorter = pCsr -> uc. pSorter ; getVarint32 ( ( const u8 * ) & pVal -> z [ 1 ], t ) ; if ( t > 0 && t < 10 && t!= 7 ) { pSorter -> typeMask &= SORTER_TYPE_INTEGER ; } else if ( t > 10 && ( t & 0x01 ) ) { pSorter -> typeMask &= SORTER_TYPE_TEXT ; } else { pSorter -> typeMask = 0 ; } assert ( pSorter ) ; nReq = pVal -> n + sizeof ( SorterRecord ) ; nPMA = pVal -> n + sqlite3VarintLen ( pVal -> n ) ; if ( pSorter -> mxPmaSize ) { if ( pSorter -> list. aMemory ) { bFlush = pSorter -> iMemory && ( pSorter -> iMemory + nReq ) > pSorter -> mxPmaSize ; } else { bFlush = ( ( pSorter -> list. szPMA > pSorter -> mxPmaSize ) || ( pSorter -> list. szPMA > pSorter -> mnPmaSize && sqlite3HeapNearlyFull ( ) ) ) ; } if ( bFlush ) { rc = vdbeSorterFlushPMA ( pSorter ) ; pSorter -> list. szPMA = 0 ; pSorter -> iMemory = 0 ; assert ( rc!= SQLITE_OK || pSorter -> list. pList == 0 ) ; } } pSorter -> list. szPMA += nPMA ; if ( nPMA > pSorter -> mxKeysize ) { pSorter -> mxKeysize = nPMA ; } if ( pSorter -> list. aMemory ) { int nMin = pSorter -> iMemory + nReq ; if ( nMin > pSorter -> nMemory ) { u8 * aNew ; int iListOff = ( u8 * ) pSorter -> list. pList - pSorter -> list. aMemory

Fix:
<S2SV_ModStart>. aMemory ; sqlite3_int64 nNew = 2 * ( sqlite3_int64 ) <S2SV_ModEnd> pSorter -> nMemory <S2SV_ModStart> pSorter -> nMemory <S2SV_ModEnd> ; while (
Buggy code:
 static void pack_inter_mode_mvs ( VP9_COMP * cpi, const MODE_INFO * mi, <START_BUG> vp9_writer * w ) { <END_BUG> VP9_COMMON * const cm = & cpi -> common ;  const nmv_context * nmvc = & cm -> fc. nmvc ; <START_BUG> const MACROBLOCK * const x = & cpi -> mb ; const MACROBLOCKD * const xd = & x -> e_mbd ; const struct segmentation * const seg = & cm -> seg ; const MB_MODE_INFO * const mbmi = & mi -> mbmi ; <END_BUG> const MB_PREDICTION_MODE mode = mbmi -> mode ;  const int segment_id = mbmi -> segment_id ; const BLOCK_SIZE bsize = mbmi -> sb_type ; const int allow_hp = cm -> allow_high_precision_mv ; const int is_inter = is_inter_block ( mbmi ) ; const int is_compound = has_second_ref ( mbmi ) ; int skip, ref ; if ( seg -> update_map ) { if ( seg -> temporal_update ) { const int pred_flag = mbmi -> seg_id_predicted ; <START_BUG> vp9_prob pred_prob = vp9_get_pred_prob_seg_id ( seg, xd ) ; <END_BUG>  vp9_write ( w, pred_flag, pred_prob ) ; <START_BUG> if (! pred_flag ) write_segment_id ( w, seg, segment_id ) ; } else { write_segment_id ( w, seg, segment_id ) ; } } <END_BUG> skip = write_skip ( cpi, segment_id, mi, w ) ;  <START_BUG> if (! vp9_segfeature_active ( seg, segment_id, SEG_LVL_REF_FRAME ) ) <END_BUG>  vp9_write ( w, is_inter, vp9_get_intra_inter_prob ( cm, xd ) ) ; <START_BUG> if ( bsize >= BLOCK_8X8 && cm -> tx_mode == TX_MODE_SELECT &&! ( is_inter && <END_BUG> ( skip || vp9_segfeature_active ( seg, segment_id, SEG_LVL_SKIP ) ) ) ) {  <START_BUG> write_selected_tx_size ( cpi, mbmi -><END_BUG>

Fix:
<S2SV_ModStart> * mi, vpx_writer <S2SV_ModEnd> * w ) <S2SV_ModStart> cm -> fc -> nmvc ; const MACROBLOCK * const x = & cpi -> td. <S2SV_ModEnd> mb ; const <S2SV_ModStart> mbmi ; const MB_MODE_INFO_EXT * const mbmi_ext = x -> mbmi_ext ; const PREDICTION_MODE <S2SV_ModEnd> mode = mbmi <S2SV_ModStart> -> seg_id_predicted ; vpx_prob <S2SV_ModEnd> pred_prob = vp9_get_pred_prob_seg_id <S2SV_ModStart> xd ) ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> = write_skip ( cm, xd <S2SV_ModEnd>, segment_id, <S2SV_ModStart> if (! segfeature_active <S2SV_ModEnd> ( seg, <S2SV_ModStart> SEG_LVL_REF_FRAME ) ) vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> ( is_inter && skip <S2SV_ModEnd> ) ) { <S2SV_ModStart> { write_selected_tx_size ( cm, xd <S2SV_ModEnd>, w ) <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> y_mode_prob [ size_group_lookup <S2SV_ModStart> ) { const PREDICTION_MODE <S2SV_ModEnd> b_mode = mi <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> y_mode_prob [ 0 <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> uv_mode_prob [ mode <S2SV_ModStart> int mode
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; ps_dec -> process_called = 1 ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code

Fix:
<S2SV_ModStart> - 1 ; <S2SV_ModEnd> ps_dec -> u4_slice_start_code_found <S2SV_ModStart> ps_dec ) ; <S2SV_ModEnd> } if ( <S2SV_ModStart> ; } } if ( ( TOP_FIELD_ONLY | BOT_FIELD_ONLY ) == ps_dec -> u1_top_bottom_decoded ) { ps_dec -> u1_top_bottom_decoded = 0 ; } if ( ps_dec -> u4_pic_buf_got == 1 ) { if ( 1 == ps_dec -> u1_last_pic_not_decoded ) { ret = ih264d_end_of_pic_dispbuf_mgr ( ps_dec ) ; if ( ret!= OK ) return ret ; ret = ih264d_end_of_pic ( ps_dec ) ; if ( ret!= OK ) return ret ; } else { ret = ih264d_end_of_pic ( ps_dec ) ; if ( ret!= OK ) return ret ; } }
Buggy code:
 <START_BUG> static void restore_context ( VP9_COMP * cpi, int mi_row, int mi_col, <END_BUG> ENTROPY_CONTEXT a [ 16 * MAX_MB_PLANE ], ENTROPY_CONTEXT l [ 16 * MAX_MB_PLANE ], PARTITION_CONTEXT sa [ 8 ], PARTITION_CONTEXT sl [ 8 ], BLOCK_SIZE bsize ) {  MACROBLOCK * const x = & cpi -> mb ; <START_BUG> MACROBLOCKD * const xd = & x -> e_mbd ; int p ; const int num_4x4_blocks_wide = num_4x4_blocks_wide_lookup [ bsize ] ; const int num_4x4_blocks_high = num_4x4_blocks_high_lookup [ bsize ] ; int mi_width = num_8x8_blocks_wide_lookup [ bsize ] ; int mi_height = num_8x8_blocks_high_lookup [ bsize ] ; for ( p = 0 ; p < MAX_MB_PLANE ; p ++ ) { <END_BUG> vpx_memcpy (  xd -> above_context [ p ] + ( ( mi_col * 2 ) >> xd -> plane [ p ]. subsampling_x ), a + num_4x4_blocks_wide * p, ( sizeof ( ENTROPY_CONTEXT ) * num_4x4_blocks_wide ) >> xd -> plane [ p ]. subsampling_x ) ; <START_BUG> vpx_memcpy ( <END_BUG> xd -> left_context [ p ] + ( ( mi_row & MI_MASK ) * 2 >> xd -> plane [ p ]. subsampling_y ), l + num_4x4_blocks_high * p, ( sizeof ( ENTROPY_CONTEXT ) * num_4x4_blocks_high ) >> xd -> plane [ p ]. subsampling_y ) ; }  vpx_memcpy ( xd -> above_seg_context + mi_col, sa, <START_BUG> sizeof ( * xd -> above_seg_context ) * mi_width ) ; <END_BUG> vpx_memcpy ( xd -> left_seg_context + ( mi_row & MI_MASK ), sl,  sizeof ( xd -> left_seg_context [ 0 ] ) *

Fix:
<S2SV_ModStart> void restore_context ( MACROBLOCK * const x <S2SV_ModEnd>, int mi_row <S2SV_ModStart> bsize ) { <S2SV_ModEnd> MACROBLOCKD * const <S2SV_ModStart> ++ ) { memcpy <S2SV_ModEnd> ( xd -> <S2SV_ModStart> subsampling_x ) ; memcpy <S2SV_ModEnd> ( xd -> <S2SV_ModStart> ) ; } memcpy <S2SV_ModEnd> ( xd -> <S2SV_ModStart> mi_width ) ; memcpy <S2SV_ModEnd> ( xd ->
Buggy code:
 static int ext4_fill_super ( struct super_block * sb, void * data, int silent ) { char * orig_data = kstrdup ( data, GFP_KERNEL ) ; struct buffer_head * bh ; struct ext4_super_block * es = NULL ; struct ext4_sb_info * sbi ; ext4_fsblk_t block ; ext4_fsblk_t sb_block = get_sb_block ( & data ) ; ext4_fsblk_t logical_sb_block ; unsigned long offset = 0 ; unsigned long journal_devnum = 0 ; unsigned long def_mount_opts ; struct inode * root ; const char * descr ; int ret = - ENOMEM ; int blocksize, clustersize ; unsigned int db_count ; unsigned int i ; int needs_recovery, has_huge_files, has_bigalloc ; __u64 blocks_count ; int err = 0 ; unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO ; ext4_group_t first_not_zeroed ; sbi = kzalloc ( sizeof ( * sbi ), GFP_KERNEL ) ; if (! sbi ) goto out_free_orig ; sbi -> s_blockgroup_lock = kzalloc ( sizeof ( struct blockgroup_lock ), GFP_KERNEL ) ; if (! sbi -> s_blockgroup_lock ) { kfree ( sbi ) ; goto out_free_orig ; } sb -> s_fs_info = sbi ; sbi -> s_sb = sb ; sbi -> s_inode_readahead_blks = EXT4_DEF_INODE_READAHEAD_BLKS ; sbi -> s_sb_block = sb_block ; if ( sb -> s_bdev -> bd_part ) sbi -> s_sectors_written_start = part_stat_read ( sb -> s_bdev -> bd_part, sectors [ 1 ] ) ; strreplace ( sb -> s_id, '//', '!' ) ; ret = - EINVAL ; blocksize = sb_min_blocksize ( sb, EXT4_MIN_BLOCK_SIZE ) ; if (! blocksize ) { ext4_msg ( sb, KERN_ERR,

Fix:
<S2SV_ModStart> = ext4_xattr_create_cache ( <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; failed_mount_wq : if ( sbi -> s_mb_cache ) { ext4_xattr_destroy_cache ( sbi -> s_mb_cache ) ; sbi -> s_mb_cache = NULL ; }
Buggy code:
 static int skt_read ( int fd, void * p, size_t len ) { int read ; struct pollfd pfd ; struct timespec ts ; FNLOG ( ) ; ts_log ( "skt_read   recv", len, NULL ) ; <START_BUG> if ( ( read = recv ( fd, p, len, MSG_NOSIGNAL ) ) == - 1 ) <END_BUG> { ERROR ( "write   failed   with   errno=%d\\n", errno ) ; return - 1 ; } return read ; }

Fix:
<S2SV_ModStart> ( read = TEMP_FAILURE_RETRY ( <S2SV_ModStart> len, MSG_NOSIGNAL )
Buggy code:
 static ssize_t map_write ( struct file * file, const char __user * buf, size_t count, loff_t * ppos, int cap_setid, struct uid_gid_map * map, struct uid_gid_map * parent_map ) { struct seq_file * seq = file -> private_data ; struct user_namespace * ns = seq -> private ; struct uid_gid_map new_map ; unsigned idx ; struct uid_gid_extent extent ; char * kbuf = NULL, * pos, * next_line ; ssize_t ret ; if ( ( * ppos!= 0 ) || ( count >= PAGE_SIZE ) ) return - EINVAL ; kbuf = memdup_user_nul ( buf, count ) ; if ( IS_ERR ( kbuf ) ) return PTR_ERR ( kbuf ) ; mutex_lock ( & userns_state_mutex ) ; memset ( & new_map, 0, sizeof ( struct uid_gid_map ) ) ; ret = - EPERM ; if ( map -> nr_extents!= 0 ) goto out ; if ( cap_valid ( cap_setid ) &&! file_ns_capable ( file, ns, CAP_SYS_ADMIN ) ) goto out ; ret = - EINVAL ; pos = kbuf ; for ( ; pos ; pos = next_line ) { next_line = strchr ( pos, '\\n' ) ; if ( next_line ) { * next_line = '\\0' ; next_line ++ ; if ( * next_line == '\\0' ) next_line = NULL ; } pos = skip_spaces ( pos ) ; extent. first = simple_strtoul ( pos, & pos, 10 ) ; if (! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; extent. lower_first = simple_strtoul ( pos, & pos, 10 ) ; if (! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; extent. count = simple_strtoul ( pos, & pos, 10 ) ; if ( * pos &&! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; if ( * pos!= '\\0' ) goto out ; if ( ( extent. first

Fix:
<S2SV_ModStart> & new_map ) <S2SV_ModEnd> ) goto out <S2SV_ModStart> lower_first ; } ret = sort_idmaps ( & new_map ) ; if ( ret < 0 ) goto out ;
Buggy code:
 static void skel ( const char * homedir, uid_t u, gid_t g ) { char * fname ; if ( arg_zsh ) { if ( asprintf ( & fname, "%s//.zshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; <START_BUG> if ( stat ( "//etc//skel//.zshrc", & s ) == 0 ) { <END_BUG>  if ( is_link ( "//etc//skel//.zshrc" ) ) { <START_BUG> <END_BUG> fprintf ( stderr, "Error:   invalid   //etc//skel//.zshrc   file\\n" ) ;  exit ( 1 ) ; } <START_BUG> if ( copy_file ( "//etc//skel//.zshrc", fname ) == 0 ) { <END_BUG> if ( chown ( fname, u, g ) == - 1 )  errExit ( "chown" ) ; <START_BUG> <END_BUG> fs_logger ( "clone   //etc//skel//.zshrc" ) ;  } } else { FILE * fp = fopen ( fname, "w" ) ; if ( fp ) { fprintf ( fp, "\\n" ) ; fclose ( fp ) ; if ( chown ( fname, u, g ) == - 1 ) errExit ( "chown" ) ; if ( chmod ( fname, S_IRUSR | S_IWUSR ) < 0 ) errExit ( "chown" ) ; fs_logger2 ( "touch", fname ) ; } } free ( fname ) ; } <START_BUG> else if ( arg_csh ) { <END_BUG> if ( asprintf ( & fname, "%s//.cshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; if ( stat ( "//etc//skel//.cshrc", & s ) == 0 ) { if ( is_link ( "//etc//skel//.cshrc" ) ) { fprintf ( stderr, "Error:   invalid   //etc//skel//.cshrc   file\\n" ) ; exit ( 1 ) ; } if ( copy_file ( "//etc//skel//.cshrc", fname ) == 0 ) { if

Fix:
<S2SV_ModStart> ; if ( is_link ( fname ) ) { fprintf ( stderr, "Error: <S2SV_blank> invalid <S2SV_blank> %s <S2SV_blank> file\\n", fname ) ; exit ( 1 ) ; } if ( <S2SV_ModStart> 0 ) { copy_file_as_user ( "//etc//skel//.zshrc", fname, u, g, 0644 ) ; fs_logger ( "clone <S2SV_blank> //etc//skel//.zshrc" ) ; } else { touch_file_as_user ( fname, u, g, 0644 ) ; fs_logger2 ( "touch", fname ) ; } free ( fname ) ; } else if ( arg_csh ) { if ( asprintf ( & fname, "%s//.cshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; <S2SV_ModStart> ( is_link ( fname <S2SV_ModEnd> ) ) { <S2SV_ModStart> ( stderr, "Error: <S2SV_blank> invalid <S2SV_blank> %s <S2SV_blank> file\\n", fname <S2SV_ModEnd> ) ; exit <S2SV_ModStart> } if ( stat ( "//etc//skel//.cshrc", & s ) == 0 ) { copy_file_as
Buggy code:
 vpx_codec_err_t vpx_codec_enc_config_set ( vpx_codec_ctx_t * ctx, const vpx_codec_enc_cfg_t * cfg ) { vpx_codec_err_t res ; if (! ctx ||! ctx -> iface ||! ctx -> priv ||! cfg ) res = VPX_CODEC_INVALID_PARAM ; else if (! ( ctx -> iface -> caps & VPX_CODEC_CAP_ENCODER ) ) res = VPX_CODEC_INCAPABLE ; else <START_BUG> res = ctx -> iface -> enc. cfg_set ( ctx -> priv -> alg_priv, cfg ) ; <END_BUG> return SAVE_STATUS ( ctx, res ) ; }

Fix:
<S2SV_ModStart>. cfg_set ( get_alg_priv ( ctx ) <S2SV_ModEnd>, cfg )
Buggy code:
 png_charp PNGAPI png_convert_to_rfc1123 ( png_structp png_ptr, png_timep ptime ) { static PNG_CONST char short_months [ 12 ] [ 4 ] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" } ; if ( png_ptr == NULL ) return ( NULL ) ; if ( png_ptr -> time_buffer == NULL ) { png_ptr -> time_buffer = ( png_charp ) png_malloc ( png_ptr, ( png_uint_32 ) ( 29 * png_sizeof ( char ) ) ) ; } # ifdef _WIN32_WCE { wchar_t time_buf [ 29 ] ; wsprintf ( time_buf, TEXT ( "%d   %S   %d   %02d:%02d:%02d   +0000" ), <START_BUG> ptime -> day % 32, short_months [ ( ptime -> month - 1 ) % 12 ], <END_BUG> ptime -> year, ptime -> hour % 24, ptime -> minute % 60, ptime -> second % 61 ) ; WideCharToMultiByte ( CP_ACP, 0, time_buf, - 1, png_ptr -> time_buffer, 29, NULL, NULL ) ; } # else # ifdef USE_FAR_KEYWORD { char near_time_buf [ 29 ] ; png_snprintf6 ( near_time_buf, 29, "%d   %s   %d   %02d:%02d:%02d   +0000",  ptime -> day % 32, short_months [ ( ptime -> month - 1 ) % 12 ], <START_BUG> ptime -> year, ptime -> hour % 24, ptime -> minute % 60, ptime -> second % 61 ) ; png_memcpy ( png_ptr -> time_buffer, near_time_buf, 29 * png_sizeof ( char ) ) ; } # else png_snprintf6 ( png_ptr -> time_buffer, 29, "%d   %s   %d   %02d:%02d:%02d   +0000", <END_BUG> ptime -> day % 32, short

Fix:
<S2SV_ModStart> -> month - 1U <S2SV_ModEnd> ) % 12 <S2SV_ModStart> -> month - 1U <S2SV_ModEnd> ) % 12 <S2SV_ModStart> -> month - 1U <S2SV_ModEnd> ) % 12
Buggy code:
 static long ec_device_ioctl_xcmd ( struct cros_ec_dev * ec, void __user * arg ) { long ret ; struct cros_ec_command u_cmd ; struct cros_ec_command * s_cmd ; if ( copy_from_user ( & u_cmd, arg, sizeof ( u_cmd ) ) ) return - EFAULT ; if ( ( u_cmd. outsize > EC_MAX_MSG_BYTES ) || ( u_cmd. insize > EC_MAX_MSG_BYTES ) ) return - EINVAL ; s_cmd = kmalloc ( sizeof ( * s_cmd ) + max ( u_cmd. outsize, u_cmd. insize ), GFP_KERNEL ) ; if (! s_cmd ) return - ENOMEM ; if ( copy_from_user ( s_cmd, arg, sizeof ( * s_cmd ) + u_cmd. outsize ) ) { ret = - EFAULT ; goto exit ; } <START_BUG> s_cmd -> command += ec -> cmd_offset ; <END_BUG> ret = cros_ec_cmd_xfer ( ec -> ec_dev, s_cmd ) ; if ( ret < 0 ) goto exit ;  if ( copy_to_user ( arg, s_cmd, sizeof ( * s_cmd ) + u_cmd. insize ) ) <START_BUG> ret = - EFAULT ; exit : kfree ( s_cmd ) ; return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> exit ; } if ( u_cmd. outsize!= s_cmd -> outsize || u_cmd. insize!= s_cmd -> insize ) { ret = - EINVAL ; goto exit ; } <S2SV_ModStart> s_cmd ) + s_cmd -> <S2SV_ModEnd> insize ) )
Buggy code:
 static int kwajd_read_headers ( struct mspack_system * sys, struct mspack_file * fh, struct mskwajd_header * hdr ) { unsigned char buf [ 16 ] ; int i ; if ( sys -> read ( fh, & buf [ 0 ], kwajh_SIZEOF )!= kwajh_SIZEOF ) { return MSPACK_ERR_READ ; } if ( ( ( unsigned int ) EndGetI32 ( & buf [ kwajh_Signature1 ] )!= 0x4A41574B ) || ( ( unsigned int ) EndGetI32 ( & buf [ kwajh_Signature2 ] )!= 0xD127F088 ) ) { return MSPACK_ERR_SIGNATURE ; } hdr -> comp_type = EndGetI16 ( & buf [ kwajh_CompMethod ] ) ; hdr -> data_offset = EndGetI16 ( & buf [ kwajh_DataOffset ] ) ; hdr -> headers = EndGetI16 ( & buf [ kwajh_Flags ] ) ; hdr -> length = 0 ; hdr -> filename = NULL ; hdr -> extra = NULL ; hdr -> extra_length = 0 ; if ( hdr -> headers & MSKWAJ_HDR_HASLENGTH ) { if ( sys -> read ( fh, & buf [ 0 ], 4 )!= 4 ) return MSPACK_ERR_READ ; hdr -> length = EndGetI32 ( & buf [ 0 ] ) ; } if ( hdr -> headers & MSKWAJ_HDR_HASUNKNOWN1 ) { if ( sys -> read ( fh, & buf [ 0 ], 2 )!= 2 ) return MSPACK_ERR_READ ; } if ( hdr -> headers & MSKWAJ_HDR_HASUNKNOWN2 ) { if ( sys -> read ( fh, & buf [ 0 ], 2 )!= 2 ) return MSPACK_ERR_READ ; i = EndGetI16 ( & buf [ 0 ] ) ; if ( sys -> seek ( fh, ( off_t ) i, MSPACK_SYS_SEEK_CUR ) ) return MSPACK_ERR_SEEK ; } if ( hdr -> headers & ( MSKWAJ_HDR_HASFILENAME | MSKWAJ_HDR_HASFILEEXT ) ) { <START_BUG> off_t pos = sys -> tell ( fh ) ; <END_BUG> char *

Fix:
<S2SV_ModStart> ) ) { int len <S2SV_ModEnd> ; char * <S2SV_ModStart> if (! ( hdr -> filename = fn ) ) <S2SV_ModEnd> return MSPACK_ERR_NOMEMORY ; <S2SV_ModStart> return MSPACK_ERR_NOMEMORY ; <S2SV_ModEnd> if ( hdr <S2SV_ModStart> { if ( ( len = <S2SV_ModStart>, 9 ) ) < 2 <S2SV_ModEnd> ) return MSPACK_ERR_READ <S2SV_ModStart> ; i < len <S2SV_ModEnd> ; i ++ <S2SV_ModStart> ; i ++ ) if (! ( * fn ++ <S2SV_ModEnd> = buf [ <S2SV_ModStart> ) break ; if ( i == 9 && buf [ 8 ]!= '\\0' ) return MSPACK_ERR_DATAFORMAT ; if ( sys -> seek ( fh, ( off_t ) ( <S2SV_ModEnd> i + 1 <S2SV_ModStart> i + 1 - len ), MSPACK_SYS_SEEK_CUR <S2SV_ModEnd> ) ) return <S2SV_ModStart> ) return MSPACK_ERR_SEEK ; fn -- <S2SV_ModStart> ; if ( ( len = <S2SV_ModStart>, 4 ) ) < 2 <S2SV_ModEnd> ) return MSPACK_ERR_READ <S2SV_ModStart> ; i < len <S2SV_ModEnd> ; i ++ <S2SV_ModStart> ; i ++ ) if (! ( * fn ++ <S2SV_ModEnd> = buf [ <S2SV_ModStart> ) break ; if ( i == 4 && buf [ 3 ]!= '\\0' ) return MSPACK_ERR_DATAFORMAT ; if ( sys ->
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8e_set_reference ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_ref_frame_t * data = va_arg ( args, vpx_ref_frame_t * ) ; if ( data ) { vpx_ref_frame_t * frame = ( vpx_ref_frame_t * ) data ; YV12_BUFFER_CONFIG sd ; image2yuvconfig ( & frame -> img, & sd ) ; vp8_set_reference ( ctx -> cpi, frame -> frame_type, & sd ) ; return VPX_CODEC_OK ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static int jpeg2000_decode_tile ( Jpeg2000DecoderContext * s, Jpeg2000Tile * tile, AVFrame * picture ) { int compno, reslevelno, bandno ; int x, y ; uint8_t * line ; Jpeg2000T1Context t1 ; for ( compno = 0 ; compno < s -> ncomponents ; compno ++ ) { Jpeg2000Component * comp = tile -> comp + compno ; Jpeg2000CodingStyle * codsty = tile -> codsty + compno ; for ( reslevelno = 0 ; reslevelno < codsty -> nreslevels2decode ; reslevelno ++ ) { Jpeg2000ResLevel * rlevel = comp -> reslevel + reslevelno ; for ( bandno = 0 ; bandno < rlevel -> nbands ; bandno ++ ) { int nb_precincts, precno ; Jpeg2000Band * band = rlevel -> band + bandno ; int cblkno = 0, bandpos ; bandpos = bandno + ( reslevelno > 0 ) ; if ( band -> coord [ 0 ] [ 0 ] == band -> coord [ 0 ] [ 1 ] || band -> coord [ 1 ] [ 0 ] == band -> coord [ 1 ] [ 1 ] ) continue ; nb_precincts = rlevel -> num_precincts_x * rlevel -> num_precincts_y ; for ( precno = 0 ; precno < nb_precincts ; precno ++ ) { Jpeg2000Prec * prec = band -> prec + precno ; for ( cblkno = 0 ; cblkno < prec -> nb_codeblocks_width * prec -> nb_codeblocks_height ; cblkno ++ ) { int x, y ; Jpeg2000Cblk * cblk = prec -> cblk + cblkno ; decode_cblk ( s, codsty, & t1, cblk, cblk -> coord [ 0 ] [ 1 ] - cblk -> coord [ 0 ] [ 0 ], cblk -> coord [ 1 ] [ 1 ] - cblk -> coord [ 1 ] [ 0 ], bandpos ) ; x = cblk -> coord [ 0 ] [ 0 ] ; y = cblk -> coord [ 1 ] [ 0 ] ;

Fix:
<S2SV_ModStart> ] + y // s -> cdy [ compno ] <S2SV_ModStart> line + x // s -> cdx [ compno ] <S2SV_ModStart> ] + y // s -> cdy [ compno ] <S2SV_ModStart> + ( x // s -> cdx [ compno ]
Buggy code:
 static int recv_stream ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t buf_len, int flags ) { struct sock * sk = sock -> sk ; struct tipc_port * tport = tipc_sk_port ( sk ) ; struct sk_buff * buf ; struct tipc_msg * msg ; long timeout ; unsigned int sz ; int sz_to_copy, target, needed ; int sz_copied = 0 ; u32 err ; int res = 0 ; if ( unlikely (! buf_len ) ) return - EINVAL ; lock_sock ( sk ) ; if ( unlikely ( ( sock -> state == SS_UNCONNECTED ) ) ) { res = - ENOTCONN ; goto exit ; } <START_BUG> m -> msg_namelen = 0 ; <END_BUG> target = sock_rcvlowat ( sk, flags & MSG_WAITALL, buf_len ) ; timeout = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; restart : while ( skb_queue_empty ( & sk -> sk_receive_queue ) ) { if ( sock -> state == SS_DISCONNECTING ) { res = - ENOTCONN ; goto exit ; } if ( timeout <= 0L ) { res = timeout? timeout : - EWOULDBLOCK ; goto exit ; } release_sock ( sk ) ; timeout = wait_event_interruptible_timeout ( * sk_sleep ( sk ), tipc_rx_ready ( sock ), timeout ) ; lock_sock ( sk ) ; } buf = skb_peek ( & sk -> sk_receive_queue ) ; msg = buf_msg ( buf ) ; sz = msg_data_sz ( msg ) ; err = msg_errcode ( msg ) ; if ( (! sz ) && (! err ) ) { advance_rx_queue ( sk ) ; goto restart ; } if ( sz_copied == 0 ) { set_orig_addr ( m, msg ) ; res = anc_data_recv ( m, msg, tport ) ; if ( res ) goto exit ; } if (! err ) { u32 offset = ( u32 ) ( unsigned long ) ( TIPC_SKB_CB ( buf ) -> handle ) ; sz -= offset ; needed = ( buf_len - sz_cop

Fix:
<S2SV_ModStart> exit ; } <S2SV_ModEnd> target = sock_rcvlowat
Buggy code:
 static krb5_error_code krb5_ldap_get_password_policy_from_dn ( krb5_context context, char * pol_name, char * pol_dn, osa_policy_ent_t * policy ) { krb5_error_code st = 0, tempst = 0 ; LDAP * ld = NULL ; LDAPMessage * result = NULL, * ent = NULL ; kdb5_dal_handle * dal_handle = NULL ; krb5_ldap_context * ldap_context = NULL ; krb5_ldap_server_handle * ldap_server_handle = NULL ; krb5_clear_error_message ( context ) ; if ( pol_dn == NULL ) return EINVAL ; * policy = NULL ; SETUP_CONTEXT ( ) ; GET_HANDLE ( ) ; * ( policy ) = ( osa_policy_ent_t ) malloc ( sizeof ( osa_policy_ent_rec ) ) ; if ( * policy == NULL ) { st = ENOMEM ; goto cleanup ; } memset ( * policy, 0, sizeof ( osa_policy_ent_rec ) ) ; LDAP_SEARCH ( pol_dn, LDAP_SCOPE_BASE, "(objectclass=krbPwdPolicy)", password_policy_attributes ) ; ent = ldap_first_entry ( ld, result ) ; <START_BUG> if ( ent!= NULL ) { <END_BUG> if ( ( st = populate_policy ( context, ld, ent, pol_name, * policy ) )!= 0 ) goto cleanup ; }  cleanup : <START_BUG> ldap_msgfree ( result ) ; if ( st!= 0 ) { if ( * policy!= NULL ) { krb5_ldap_free_password_policy ( context, * policy ) ; * policy = NULL ; } } krb5_ldap_put_handle_to_pool ( ldap_context, ldap_server_handle ) ; return st ; }<END_BUG>

Fix:
<S2SV_ModStart> if ( ent == NULL ) { st = KRB5_KDB_NOENTRY ; <S2SV_ModEnd> goto cleanup ; <S2SV_ModStart> cleanup ; } st = populate_policy ( context, ld, ent, pol_name, * policy ) ;