nus-yam/ex-repair huggingface dataset:
Buggy code:
 LIBXSMM_API_INTERN void libxsmm_sparse_csc_reader ( libxsmm_generated_code * io_generated_code, const char * i_csc_file_in, unsigned int * * o_row_idx, unsigned int * * o_column_idx, double * * o_values, unsigned int * o_row_count, unsigned int * o_column_count, unsigned int * o_element_count ) { FILE * l_csc_file_handle ; const unsigned int l_line_length = 512 ; char l_line [ 512 + 1 ] ; unsigned int l_header_read = 0 ; unsigned int * l_column_idx_id = NULL ; unsigned int l_i = 0 ; l_csc_file_handle = fopen ( i_csc_file_in, "r" ) ; if ( l_csc_file_handle == NULL ) { LIBXSMM_HANDLE_ERROR ( io_generated_code, LIBXSMM_ERR_CSC_INPUT ) ; return ; } while ( fgets ( l_line, l_line_length, l_csc_file_handle )!= NULL ) { if ( strlen ( l_line ) == l_line_length ) { free ( * o_row_idx ) ; free ( * o_column_idx ) ; free ( * o_values ) ; free ( l_column_idx_id ) ; * o_row_idx = 0 ; * o_column_idx = 0 ; * o_values = 0 ; fclose ( l_csc_file_handle ) ; LIBXSMM_HANDLE_ERROR ( io_generated_code, LIBXSMM_ERR_CSC_READ_LEN ) ; return ; } if ( l_line [ 0 ] == '%' ) { continue ; } else { if ( l_header_read == 0 ) { <START_BUG> if ( sscanf ( l_line, "%u   %u   %u", o_row_count, o_column_count, o_element_count ) == 3 ) { <END_BUG> * o_row_idx = ( unsigned int * ) malloc ( sizeof ( unsigned int ) * ( * o_element_count ) ) ; * o_column_idx = ( unsigned int * ) malloc

Fix:
<S2SV_ModStart> { if ( 3 == <S2SV_ModStart>, o_element_count ) && 0!= * o_row_count && 0!= * o_column_count && 0!= * o_element_count ) <S2SV_ModEnd> { * o_row_idx <S2SV_ModStart> return ; } LIBXSMM_ASSERT ( 0!= l_row && 0!= l_column ) ;
Buggy code:
 static void bt_tags_for_each ( struct blk_mq_tags * tags, struct blk_mq_bitmap_tags * bt, unsigned int off, busy_tag_iter_fn * fn, void * data, bool reserved ) { struct request * rq ; int bit, i ; if (! tags -> rqs ) return ; for ( i = 0 ; i < bt -> map_nr ; i ++ ) { struct blk_align_bitmap * bm = & bt -> map [ i ] ; for ( bit = find_first_bit ( & bm -> word, bm -> depth ) ; bit < bm -> depth ; bit = find_next_bit ( & bm -> word, bm -> depth, bit + 1 ) ) { <START_BUG> rq = blk_mq_tag_to_rq ( tags, off + bit ) ; <END_BUG> fn ( rq, data, reserved ) ; } off += ( 1 << bt -> bits_per_word ) ; } }

Fix:
<S2SV_ModStart> { rq = tags -> rqs [ <S2SV_ModEnd> off + bit <S2SV_ModStart> off + bit ] <S2SV_ModEnd> ; fn (
Buggy code:
 <START_BUG> static bool <END_BUG> ChunkedDecode ( Request * reqPtr, bool update ) { const Tcl_DString * bufPtr ; const char * end, * chunkStart ;  bool success = NS_TRUE ; <START_BUG> NS_NONNULL_ASSERT ( reqPtr!= NULL ) ; bufPtr = & reqPtr -> buffer ; end = bufPtr -> string + bufPtr -> length ; chunkStart = bufPtr -> string + reqPtr -> chunkStartOff ; while ( reqPtr -> chunkStartOff < ( size_t ) bufPtr -> length ) { char * p = strstr ( chunkStart, "\\r\\n" ) ; <END_BUG> size_t chunk_length ;  if ( p == NULL ) { Ns_Log ( DriverDebug, "ChunkedDecode:   chunk   did   not   find   end-of-line" ) ; <START_BUG> success = NS_FALSE ; <END_BUG> break ; } * p = '\\0' ;  chunk_length = ( size_t ) strtol ( chunkStart, NULL, 16 ) ; <START_BUG> * p = '\\r' ; <END_BUG> if ( p + 2 + chunk_length > end ) {  Ns_Log ( DriverDebug, "ChunkedDecode:   chunk   length   past   end   of   buffer" ) ; <START_BUG> success = NS_FALSE ; <END_BUG> break ; } if ( update ) { char * writeBuffer = bufPtr -> string + reqPtr -> chunkWriteOff ;  memmove ( writeBuffer, p + 2, chunk_length ) ; <START_BUG> <END_BUG> reqPtr -> chunkWriteOff += chunk_length ;  <START_BUG> * ( writeBuffer + chunk_length ) = '\\0' ; <END_BUG> }  reqPtr -> chunkStartOff += ( size_t ) ( p - chunkStart ) + 4u + chunk_length ; <START_BUG> chunkStart = bufPtr -> string + reqPtr -> chunkStartOff ; } <END_BUG> return success ;  }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static SockState <S2SV_ModEnd> ChunkedDecode ( Request <S2SV_ModStart> * chunkStart ; SockState result = SOCK_READY <S2SV_ModEnd> ; NS_NONNULL_ASSERT ( <S2SV_ModStart> "\\r\\n" ) ; long chunkLength <S2SV_ModEnd> ; if ( <S2SV_ModStart> "ChunkedDecode: <S2SV_blank> chunk <S2SV_blank> did <S2SV_blank> not <S2SV_blank> find <S2SV_blank> end-of-line" ) ; result = SOCK_MORE <S2SV_ModEnd> ; break ; <S2SV_ModStart> = '\\0' ; chunkLength = <S2SV_ModEnd> strtol ( chunkStart <S2SV_ModStart> ; if ( chunkLength < 0 ) { Ns_Log ( Warning, "ChunkedDecode: <S2SV_blank> negative <S2SV_blank> chunk <S2SV_blank> length" ) ; result = SOCK_BADREQUEST ; break ; } * p = '\\r' ; if ( <S2SV_ModStart> + 2 + chunkLength <S2SV_ModEnd> > end ) <S2SV_ModStart> "ChunkedDecode: <S2SV_blank> chunk <S2SV_blank> length <S2SV_blank> past <S2SV_blank> end <S2SV_blank> of <S2SV_blank> buffer" ) ; result = SOCK_MORE <S2SV_ModEnd> ; break ; <S2SV_ModStart> + 2, ( size_t ) chunkLength <S2SV_ModEnd> ) ; reqPtr <S2SV_ModStart> -> chunkWriteOff += ( size_t ) chunkLength <S2SV_ModEnd> ; * ( <S2SV_ModStart> ( writeBuffer + chunkLength <S2SV_ModEnd> ) = '\\0' <S2SV_ModStart> + 4u + ( size
Buggy code:
 static int header_gets ( SF_PRIVATE * psf, char * ptr, int bufsize ) { int k ; <START_BUG> for ( k = 0 ; k < bufsize - 1 ; k ++ ) <END_BUG>  { if ( psf -> headindex < psf -> headend ) <START_BUG> { ptr [ k ] = psf -> header [ psf -> headindex ] ; psf -> headindex ++ ; } else <END_BUG> { psf -> headend += psf_fread ( psf -> header + psf -> headend, 1, 1, psf ) ;  <START_BUG> ptr [ k ] = psf -> header [ psf -> headindex ] ; <END_BUG> psf -> headindex = psf -> headend ; } ; if ( ptr [ k ] == '\\n' ) break ; } ; ptr [ k ] = 0 ; return k ; }

Fix:
<S2SV_ModStart> int k ; if ( psf -> header. indx + bufsize >= psf -> header. len && psf_bump_header_allocation ( psf, bufsize ) ) return 0 ; <S2SV_ModStart> ( psf -> header. indx <S2SV_ModEnd> < psf -> <S2SV_ModStart> < psf -> header. end ) { ptr [ k ] = psf -> header. ptr [ psf -> header. indx ] ; psf -> header. indx <S2SV_ModEnd> ++ ; } <S2SV_ModStart> { psf -> header. end <S2SV_ModEnd> += psf_fread ( <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> + psf -> header. end <S2SV_ModEnd>, 1, <S2SV_ModStart> psf -> header. ptr [ psf -> header. indx ] ; psf -> header. indx = psf -> header. end <S2SV_ModEnd> ; } ;
Buggy code:
 static struct ib_ucontext * hns_roce_alloc_ucontext ( struct ib_device * ib_dev, struct ib_udata * udata ) { int ret = 0 ; struct hns_roce_ucontext * context ; <START_BUG> struct hns_roce_ib_alloc_ucontext_resp resp ; <END_BUG> struct hns_roce_dev * hr_dev = to_hr_dev ( ib_dev ) ; resp. qp_tab_size = hr_dev -> caps. num_qps ; context = kmalloc ( sizeof ( * context ), GFP_KERNEL ) ; if (! context ) return ERR_PTR ( - ENOMEM ) ; ret = hns_roce_uar_alloc ( hr_dev, & context -> uar ) ; if ( ret ) goto error_fail_uar_alloc ; if ( hr_dev -> caps. flags & HNS_ROCE_CAP_FLAG_RECORD_DB ) { INIT_LIST_HEAD ( & context -> page_list ) ; mutex_init ( & context -> page_mutex ) ; } ret = ib_copy_to_udata ( udata, & resp, sizeof ( resp ) ) ; if ( ret ) goto error_fail_copy_to_udata ; return & context -> ibucontext ; error_fail_copy_to_udata : hns_roce_uar_free ( hr_dev, & context -> uar ) ; error_fail_uar_alloc : kfree ( context ) ; return ERR_PTR ( ret ) ; }

Fix:
<S2SV_ModStart> struct hns_roce_ib_alloc_ucontext_resp resp = { }
Buggy code:
 jp2_box_t * jp2_box_create ( int type ) { jp2_box_t * box ; jp2_boxinfo_t * boxinfo ; <START_BUG> if (! ( box = jas_malloc ( sizeof ( jp2_box_t ) ) ) ) { <END_BUG> return 0 ; }  memset ( box, 0, sizeof ( jp2_box_t ) ) ; <START_BUG> box -> type = type ; box -> len = 0 ; if (! ( boxinfo = jp2_boxinfolookup ( type ) ) ) { return 0 ; } box -> info = boxinfo ; box -> ops = & boxinfo -> ops ; return box ; }<END_BUG>

Fix:
<S2SV_ModStart> ( box = jp2_box_create0 ( <S2SV_ModEnd> ) ) ) <S2SV_ModStart> 0 ; } <S2SV_ModEnd> box -> type
Buggy code:
 static const char * escape_xml ( const char * text ) { static char * escaped ; static size_t escaped_size ; char * out ; size_t len ; <START_BUG> for ( out = escaped, len = 0 ; * text ; ++ len, ++ out, ++ text ) { <END_BUG> if ( ( len + 8 ) > escaped_size ) { char * bigger_escaped ; escaped_size += 128 ; bigger_escaped = realloc ( escaped, escaped_size ) ; if (! bigger_escaped ) { free ( escaped ) ; escaped = NULL ; escaped_size = 0 ; return ">>>   out   of   memory   <<<" ; } out = bigger_escaped + len ; escaped = bigger_escaped ; } switch ( * text ) { case '&' : strcpy ( out, "&amp;" ) ; len += strlen ( out ) - 1 ; out = escaped + len ; break ; case '<' : strcpy ( out, "&lt;" ) ; len += strlen ( out ) - 1 ; out = escaped + len ; break ; case '>' : strcpy ( out, "&gt;" ) ; len += strlen ( out ) - 1 ; out = escaped + len ; break ; default : * out = * text ; break ; } } * out = '\\x0' ; return escaped ; }

Fix:
<S2SV_ModStart> size_t len ; if (! strlen ( text ) ) return "empty <S2SV_blank> string" ;
Buggy code:
 void set_fat ( DOS_FS * fs, uint32_t cluster, int32_t new ) { unsigned char * data = NULL ; int size ; loff_t offs ; if ( new == - 1 ) new = FAT_EOF ( fs ) ; else if ( ( long ) new == - 2 ) new = FAT_BAD ( fs ) ; switch ( fs -> fat_bits ) { case 12 : data = fs -> fat + cluster * 3 // 2 ; offs = fs -> fat_start + cluster * 3 // 2 ; if ( cluster & 1 ) { FAT_ENTRY prevEntry ; get_fat ( & prevEntry, fs -> fat, cluster - 1, fs ) ; data [ 0 ] = ( ( new & 0xf ) << 4 ) | ( prevEntry. value >> 8 ) ; data [ 1 ] = new >> 4 ; } else { FAT_ENTRY subseqEntry ; <START_BUG> if ( cluster!= fs -> clusters - 1 ) <END_BUG> get_fat ( & subseqEntry, fs -> fat, cluster + 1, fs ) ; else subseqEntry. value = 0 ; data [ 0 ] = new & 0xff ; data [ 1 ] = ( new >> 8 ) | ( ( 0xff & subseqEntry. value ) << 4 ) ; } size = 2 ; break ; case 16 : data = fs -> fat + cluster * 2 ; offs = fs -> fat_start + cluster * 2 ; * ( unsigned short * ) data = htole16 ( new ) ; size = 2 ; break ; case 32 : { FAT_ENTRY curEntry ; get_fat ( & curEntry, fs -> fat, cluster, fs ) ; data = fs -> fat + cluster * 4 ; offs = fs -> fat_start + cluster * 4 ; * ( uint32_t * ) data = htole32 ( ( new & 0xfffffff ) | ( curEntry. reserved << 28 ) ) ; size = 4 ; } break ; default : die ( "Bad   FAT   entry   size:   %d   bits.", fs -> fat_bits ) ; } fs_write ( offs, size, data ) ; if ( fs -> nfats > 1 ) { fs_write ( offs + fs -> fat_size, size, data ) ; } }

Fix:
<S2SV_ModStart> fs -> clusters + <S2SV_ModEnd> 1 ) get_fat
Buggy code:
 static int sg_common_write ( Sg_fd * sfp, Sg_request * srp, unsigned char * cmnd, int timeout, int blocking ) { int k, at_head ; Sg_device * sdp = sfp -> parentdp ; sg_io_hdr_t * hp = & srp -> header ; srp -> data. cmd_opcode = cmnd [ 0 ] ; hp -> status = 0 ; hp -> masked_status = 0 ; hp -> msg_status = 0 ; hp -> info = 0 ; hp -> host_status = 0 ; hp -> driver_status = 0 ; hp -> resid = 0 ; SCSI_LOG_TIMEOUT ( 4, sg_printk ( KERN_INFO, sfp -> parentdp, "sg_common_write:     scsi   opcode=0x%02x,   cmd_size=%d\\n", ( int ) cmnd [ 0 ], ( int ) hp -> cmd_len ) ) ; k = sg_start_req ( srp, cmnd ) ; if ( k ) { SCSI_LOG_TIMEOUT ( 1, sg_printk ( KERN_INFO, sfp -> parentdp, "sg_common_write:   start_req   err=%d\\n", k ) ) ; sg_finish_rem_req ( srp ) ; return k ; } if ( atomic_read ( & sdp -> detaching ) ) { <START_BUG> if ( srp -> bio ) <END_BUG>  blk_end_request_all ( srp -> rq, - EIO ) ; <START_BUG> sg_finish_rem_req ( srp ) ; return - ENODEV ; } hp -> duration = jiffies_to_msecs ( jiffies ) ; if ( hp -> interface_id!= '\\0' && ( SG_FLAG_Q_AT_TAIL & hp -> flags ) ) at_head = 0 ; else at_head = 1 ; srp -> rq -> timeout = timeout ; kref_get ( & sfp -> f_ref ) ; blk_execute_rq_nowait ( sdp -> device -> request_queue, sdp -> disk, srp -> rq, at_head, sg_rq_end_io ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> -> bio ) { if ( srp -> rq -> cmd!= srp -> rq -> __cmd ) kfree ( srp -> rq -> cmd ) ; <S2SV_ModStart> EIO ) ; srp -> rq = NULL ; }
Buggy code:
 static int <START_BUG> mptctl_eventquery ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_eventquery __user * uarg = ( void __user * ) arg ;  struct mpt_ioctl_eventquery karg ; <START_BUG> MPT_ADAPTER * ioc ; int iocnum ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_eventquery ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_eventquery   -   " "Unable   to   read   in   mpt_ioctl_eventquery   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; <END_BUG> return - EFAULT ;  } if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_eventquery()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_eventquery   called.\\n", ioc -> name ) ) ; karg. eventEntries = MPTCTL_EVENT_LOG_SIZE ; karg. eventTypes = ioc -> eventTypes ; if ( copy_to_user ( ( char __user * ) arg, & karg, sizeof ( struct mpt_ioctl_eventquery ) ) ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_eventquery   -   " "Unable   to   write   out   mpt_ioctl_eventquery   struct   @   %p\\n", ioc -> name, __FILE__, __LINE__, uarg ) ; return - EFAULT ; } return 0 ; }

Fix:
<S2SV_ModStart> int mptctl_eventquery ( MPT_ADAPTER * ioc, <S2SV_ModStart> struct mpt_ioctl_eventquery karg <S2SV_ModEnd> ; if ( <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; } dctlprintk
Buggy code:
 gpols_ret * get_pols_2_svc ( gpols_arg * arg, struct svc_req * rqstp ) { static gpols_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_gpols_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } prime_arg = arg -> exp ; if ( prime_arg == NULL ) prime_arg = "*" ; if ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_LIST, NULL, NULL ) ) { ret. code = KADM5_AUTH_LIST ; log_unauth ( "kadm5_get_policies", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_get_policies ( ( void * ) handle, arg -> exp, & ret. pols, & ret. count ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_get_policies", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle -> context, errmsg ) ; }  gss_release_buffer ( & minor_stat, & client_name ) ; <START_BUG> gss_release_buffer ( & minor_stat, & service_name ) ; exit_func : free_server_handle ( handle ) ; return & ret ; }<END_BUG>

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 int vp9_rc_bits_per_mb ( FRAME_TYPE frame_type, int qindex, <START_BUG> double correction_factor ) { <END_BUG>  const double q = vp9_convert_qindex_to_q ( qindex ) ; <START_BUG> <END_BUG> int enumerator = frame_type == KEY_FRAME? 3300000 : 2250000 ;  enumerator += ( int ) ( enumerator * q ) >> 12 ; <START_BUG> return ( int ) ( 0.5 + ( enumerator * correction_factor // q ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart>, double correction_factor, vpx_bit_depth_t bit_depth <S2SV_ModStart> vp9_convert_qindex_to_q ( qindex, bit_depth <S2SV_ModStart> == KEY_FRAME? 2700000 : 1800000 ; assert ( correction_factor <= MAX_BPB_FACTOR && correction_factor >= MIN_BPB_FACTOR ) <S2SV_ModEnd> ; enumerator += <S2SV_ModStart> int ) ( <S2SV_ModEnd> enumerator * correction_factor <S2SV_ModStart> // q ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 TEE_Result syscall_asymm_operate ( unsigned long state, const struct utee_attribute * usr_params, size_t num_params, const void * src_data, size_t src_len, void * dst_data, uint64_t * dst_len ) { TEE_Result res ; struct tee_cryp_state * cs ; struct tee_ta_session * sess ; uint64_t dlen64 ; size_t dlen ; struct tee_obj * o ; void * label = NULL ; size_t label_len = 0 ; size_t n ; int salt_len ; TEE_Attribute * params = NULL ; struct user_ta_ctx * utc ; res = tee_ta_get_current_session ( & sess ) ; if ( res!= TEE_SUCCESS ) return res ; utc = to_user_ta_ctx ( sess -> ctx ) ; res = tee_svc_cryp_get_state ( sess, tee_svc_uref_to_vaddr ( state ), & cs ) ; if ( res!= TEE_SUCCESS ) return res ; res = tee_mmu_check_access_rights ( utc, TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER, ( uaddr_t ) src_data, src_len ) ; if ( res!= TEE_SUCCESS ) return res ; res = tee_svc_copy_from_user ( & dlen64, dst_len, sizeof ( dlen64 ) ) ; if ( res!= TEE_SUCCESS ) return res ; dlen = dlen64 ; res = tee_mmu_check_access_rights ( utc, TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_WRITE | TEE_MEMORY_ACCESS_ANY_OWNER, ( uaddr_t ) dst_data, dlen ) ; if ( res!= TEE_SUCCESS ) return res ; <START_BUG> params = malloc ( sizeof ( TEE_Attribute ) * num_params ) ; <END_BUG> if (! params ) return TEE_ERROR_OUT_OF_MEMORY ; res = copy_in_attrs ( utc, usr_params, num_params, params ) ; if ( res!= TEE_SUCCESS ) goto out ; res = t

Fix:
<S2SV_ModStart> return res ; size_t alloc_size = 0 ; if ( MUL_OVERFLOW ( sizeof ( TEE_Attribute ), num_params, & alloc_size ) ) return TEE_ERROR_OVERFLOW ; <S2SV_ModStart> = malloc ( alloc_size <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> void kvm_lapic_set_vapic_addr ( struct kvm_vcpu * vcpu, gpa_t vapic_addr ) <END_BUG> {  vcpu -> arch. apic -> vapic_addr = vapic_addr ; <START_BUG> if ( vapic_addr ) __set_bit ( KVM_APIC_CHECK_VAPIC, & vcpu -> arch. apic_attention ) ; <END_BUG> else  __clear_bit ( KVM_APIC_CHECK_VAPIC, & vcpu -> arch. apic_attention ) ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> int <S2SV_ModEnd> kvm_lapic_set_vapic_addr ( struct <S2SV_ModStart> vapic_addr ) { if ( vapic_addr ) { if ( kvm_gfn_to_hva_cache_init ( vcpu -> kvm, & <S2SV_ModStart>. apic -> vapic_cache, vapic_addr, sizeof ( u32 ) ) ) return - EINVAL ; <S2SV_ModEnd> __set_bit ( KVM_APIC_CHECK_VAPIC <S2SV_ModStart> apic_attention ) ; } else { <S2SV_ModEnd> __clear_bit ( KVM_APIC_CHECK_VAPIC <S2SV_ModStart> ) ; } vcpu -> arch. apic -> vapic_addr = vapic_addr ; return 0 ; }
Buggy code:
 int r_bin_pdb_download ( RCore * core, int isradjson, int * actions_done, SPDBOptions * options ) { int ret ; SPDBDownloaderOpt opt ; SPDBDownloader pdb_downloader ; RBinInfo * info = r_bin_get_info ( core -> bin ) ; if (! info ||! info -> debug_file_name ) { <START_BUG> eprintf ( "Can\'t   find   debug   filename\\n" ) ; <END_BUG> return 1 ; } if (! options ||! options -> symbol_server ||! options -> user_agent ) { eprintf ( "Can\'t   retrieve   pdb   configurations\\n" ) ; return 1 ; } opt. dbg_file = ( char * ) r_file_basename ( info -> debug_file_name ) ; opt. guid = info -> guid ; opt. symbol_server = options -> symbol_server ; opt. user_agent = options -> user_agent ; opt. symbol_store_path = options -> symbol_store_path ; opt. extract = options -> extract ; init_pdb_downloader ( & opt, & pdb_downloader ) ; ret = pdb_downloader. download? pdb_downloader. download ( & pdb_downloader ) : 0 ; if ( isradjson && actions_done ) { printf ( "%s\\"pdb\\":{\\"file\\":\\"%s\\",\\"download\\":%s}", * actions_done? "," : "", opt. dbg_file, ret? "true" : "false" ) ; } else { printf ( "PDB   \\"%s\\"   download   %s\\n", opt. dbg_file, ret? "success" : "failed" ) ; } if ( actions_done ) { ( * actions_done ) ++ ; } deinit_pdb_downloader ( & pdb_downloader ) ; return 0 ; }

Fix:
<S2SV_ModStart> eprintf ( "Can\'t <S2SV_blank> find <S2SV_blank> debug <S2SV_blank> filename\\n" ) ; return 1 ; } if (! is_valid_guid ( info -> guid ) ) { eprintf ( "Invalid <S2SV_blank> GUID <S2SV_blank> for <S2SV_blank> file\\n"
Buggy code:
 static int get_debug_info ( struct PE_ ( r_bin_pe_obj_t ) * bin, PE_ ( image_debug_directory_entry ) * dbg_dir_entry, ut8 * dbg_data, int dbg_data_len, SDebugInfo * res ) { # define SIZEOF_FILE_NAME 255 int i = 0 ; const char * basename ; if (! dbg_data ) { return 0 ; } switch ( dbg_dir_entry -> Type ) { case IMAGE_DEBUG_TYPE_CODEVIEW : if (! strncmp ( ( char * ) dbg_data, "RSDS", 4 ) ) { SCV_RSDS_HEADER rsds_hdr ; init_rsdr_hdr ( & rsds_hdr ) ; if (! get_rsds ( dbg_data, dbg_data_len, & rsds_hdr ) ) { bprintf ( "Warning:   Cannot   read   PE   debug   info\\n" ) ; return 0 ; } snprintf ( res -> guidstr, GUIDSTR_LEN, "%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x%x", rsds_hdr. guid. data1, rsds_hdr. guid. data2, rsds_hdr. guid. data3, rsds_hdr. guid. data4 [ 0 ], rsds_hdr. guid. data4 [ 1 ], rsds_hdr. guid. data4 [ 2 ], rsds_hdr. guid. data4 [ 3 ], rsds_hdr. guid. data4 [ 4 ], rsds_hdr. guid. data4 [ 5 ], rsds_hdr. guid. data4 [ 6 ], rsds_hdr. guid. data4 [ 7 ], rsds_hdr. age ) ; basename = r_file_basename ( ( char * ) rsds_hdr. file_name ) ; strncpy ( res -> file_name, ( const char * ) basename, sizeof ( res -> file_name ) ) ; res -> file_name [ sizeof ( res -> file_name ) - 1 ] = 0 ; rsds_hdr. free ( ( struct SCV_RSDS_HEADER * ) & rsds_hdr ) ; } else if

Fix:
<S2SV_ModStart> 0 ) { if ( dbg_data_len < 20 ) { eprintf ( "Truncated <S2SV_blank> NB10 <S2SV_blank> entry, <S2SV_blank> not <S2SV_blank> enough <S2SV_blank> data <S2SV_blank> to <S2SV_blank> parse\\n" ) ; return 0 ; } SCV_NB10_HEADER nb10_hdr = { { 0 } } <S2SV_ModEnd> ; init_cv_nb10_header ( <S2SV_ModStart> age ) ; res -> file_name [ 0 ] = 0 ; if ( nb10_hdr. file_name ) { <S2SV_ModStart> 1 ) ; }
Buggy code:
 void vp9_encode_frame ( VP9_COMP * cpi ) { VP9_COMMON * const cm = & cpi -> common ; if (! frame_is_intra_only ( cm ) ) { if ( ( cm -> ref_frame_sign_bias [ ALTREF_FRAME ] == cm -> ref_frame_sign_bias [ GOLDEN_FRAME ] ) || ( cm -> ref_frame_sign_bias [ ALTREF_FRAME ] == cm -> ref_frame_sign_bias [ LAST_FRAME ] ) ) { <START_BUG> cm -> allow_comp_inter_inter = 0 ; <END_BUG> } else {  cm -> allow_comp_inter_inter = 1 ; <START_BUG> cm -> comp_fixed_ref = ALTREF_FRAME ; cm -> comp_var_ref [ 0 ] = LAST_FRAME ; cm -> comp_var_ref [ 1 ] = GOLDEN_FRAME ; } } if ( cpi -> sf. frame_parameter_update ) { <END_BUG> int i ;  const MV_REFERENCE_FRAME frame_type = get_frame_type ( cpi ) ; <START_BUG> const int64_t * mode_thresh = cpi -> rd_prediction_type_threshes [ frame_type ] ; <END_BUG>  const int64_t * filter_thresh = cpi -> rd_filter_threshes [ frame_type ] ; <START_BUG> <END_BUG> if ( frame_type == ALTREF_FRAME ||! cm -> allow_comp_inter_inter )  cm -> reference_mode = SINGLE_REFERENCE ; <START_BUG> else if ( mode_thresh [ COMPOUND_REFERENCE ] > mode_thresh [ SINGLE_REFERENCE ] && <END_BUG>  mode_thresh [ COMPOUND_REFERENCE ] > <START_BUG> <END_BUG> mode_thresh [ REFERENCE_MODE_SELECT ] &&  check_dual_ref_flags ( cpi ) && cpi -> static_mb_pct == 100 ) cm -> reference_mode = COMPOUND_REFERENCE ; <START_BUG> else if ( mode_thresh [ SINGLE_REFERENCE ] > mode_thresh [ REFERENCE_MODE_SELECT ] ) <END_BUG> cm -> reference_mode = SINGLE_REFERENCE ; else cm -> reference_mode = REFERENCE_MODE_SELECT ;  if ( cm -> interp_filter == SWITCHABLE ) { <START_BUG> if ( frame_type!= ALTREF_FRAME && filter_thresh [ EIGHTTAP_SMOOTH ] > filter_thresh<END_BUG>

Fix:
<S2SV_ModStart> ) ) { cpi <S2SV_ModEnd> -> allow_comp_inter_inter = <S2SV_ModStart> } else { cpi <S2SV_ModEnd> -> allow_comp_inter_inter = <S2SV_ModStart> { int i ; RD_OPT * const rd_opt = & cpi -> rd ; FRAME_COUNTS * counts = cpi -> td. counts ; RD_COUNTS * const rdc = & cpi -> td. rd_counts <S2SV_ModStart> cpi ) ; int64_t * const mode_thrs = rd_opt -> prediction_type_threshes <S2SV_ModEnd> [ frame_type ] <S2SV_ModStart> frame_type ] ; int64_t * const filter_thrs = rd_opt -> filter_threshes <S2SV_ModEnd> [ frame_type ] <S2SV_ModStart> frame_type ] ; const int is_alt_ref = <S2SV_ModEnd> frame_type == ALTREF_FRAME <S2SV_ModStart> frame_type == ALTREF_FRAME ; if ( is_alt_ref ||! cpi <S2SV_ModEnd> -> allow_comp_inter_inter ) <S2SV_ModStart> else if ( mode_thrs <S2SV_ModEnd> [ COMPOUND_REFERENCE ] <S2SV_ModStart> COMPOUND_REFERENCE ] > mode_thrs <S2SV_ModEnd> [ SINGLE_REFERENCE ] <S2SV_ModStart> SINGLE_REFERENCE ] && mode_thrs <S2SV_ModEnd> [ COMPOUND_REFERENCE
Buggy code:
 static int swp_handler ( struct pt_regs * regs, unsigned int instr ) { unsigned int address, destreg, data, type ; unsigned int res = 0 ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, regs -> ARM_pc ) ; <END_BUG> if ( current -> pid!= previous_pid ) { pr_debug ( "\\"%s\\"   (%ld)   uses   deprecated   SWP{B}   instruction\\n", current -> comm, ( unsigned long ) current -> pid ) ; previous_pid = current -> pid ; } address = regs -> uregs [ EXTRACT_REG_NUM ( instr, RN_OFFSET ) ] ; data = regs -> uregs [ EXTRACT_REG_NUM ( instr, RT2_OFFSET ) ] ; destreg = EXTRACT_REG_NUM ( instr, RT_OFFSET ) ; type = instr & TYPE_SWPB ; pr_debug ( "addr   in   r%d->0x%08x,   dest   is   r%d,   source   in   r%d->0x%08x)\\n", EXTRACT_REG_NUM ( instr, RN_OFFSET ), address, destreg, EXTRACT_REG_NUM ( instr, RT2_OFFSET ), data ) ; if (! access_ok ( VERIFY_WRITE, ( address & ~ 3 ), 4 ) ) { pr_debug ( "SWP{B}   emulation:   access   to   %p   not   allowed!\\n", ( void * ) address ) ; res = - EFAULT ; } else { res = emulate_swpX ( address, & data, type ) ; } if ( res == 0 ) { regs -> ARM_pc += 4 ; regs -> uregs [ destreg ] = data ; } else if ( res == - EFAULT ) { set_segfault ( regs, address ) ; } return 0 ; }

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, regs
Buggy code:
 int nfs3svc_decode_symlinkargs ( struct svc_rqst * rqstp, __be32 * p, struct nfsd3_symlinkargs * args ) { unsigned int len, avail ; char * old, * new ; struct kvec * vec ; if (! ( p = decode_fh ( p, & args -> ffh ) ) ||! ( p = decode_filename ( p, & args -> fname, & args -> flen ) ) ) return 0 ; p = decode_sattr3 ( p, & args -> attrs ) ; len = ntohl ( * p ++ ) ; if ( len == 0 || len > NFS3_MAXPATHLEN || len >= PAGE_SIZE ) return 0 ; args -> tname = new = page_address ( * ( rqstp -> rq_next_page ++ ) ) ; args -> tlen = len ; old = ( char * ) p ; vec = & rqstp -> rq_arg. head [ 0 ] ; <START_BUG> avail = vec -> iov_len - ( old - ( char * ) vec -> iov_base ) ; <END_BUG> while ( len && avail && * old ) { * new ++ = * old ++ ; len -- ; avail -- ; } if ( len &&! avail && rqstp -> rq_arg. page_len ) { avail = min_t ( unsigned int, rqstp -> rq_arg. page_len, PAGE_SIZE ) ; old = page_address ( rqstp -> rq_arg. pages [ 0 ] ) ; } while ( len && avail && * old ) { * new ++ = * old ++ ; len -- ; avail -- ; } * new = '\\0' ; if ( len ) return 0 ; return 1 ; }

Fix:
<S2SV_ModStart> 0 ] ; if ( ( void * ) old > vec -> iov_base + vec -> iov_len ) return 0 ;
Buggy code:
 static void store_coding_context ( MACROBLOCK * x, PICK_MODE_CONTEXT * ctx, int mode_index, <START_BUG> int_mv * ref_mv, <END_BUG> int_mv * second_ref_mv, int64_t comp_pred_diff [ REFERENCE_MODES ],  int64_t tx_size_diff [ TX_MODES ], <START_BUG> <END_BUG> int64_t best_filter_diff [ SWITCHABLE_FILTER_CONTEXTS ] ) {  MACROBLOCKD * const xd = & x -> e_mbd ; ctx -> skip = x -> skip ; <START_BUG> ctx -> best_mode_index = mode_index ; <END_BUG> ctx -> mic = * xd -> mi [ 0 ] ;  ctx -> best_ref_mv [ 0 ]. as_int = ref_mv -> as_int ; <START_BUG> ctx -> best_ref_mv [ 1 ]. as_int = second_ref_mv -> as_int ; ctx -> single_pred_diff = ( int ) comp_pred_diff [ SINGLE_REFERENCE ] ; ctx -> comp_pred_diff = ( int ) comp_pred_diff [ COMPOUND_REFERENCE ] ; ctx -> hybrid_pred_diff = ( int ) comp_pred_diff [ REFERENCE_MODE_SELECT ] ; <END_BUG> vpx_memcpy ( ctx -> tx_rd_diff, tx_size_diff, sizeof ( ctx -> tx_rd_diff ) ) ;  vpx_memcpy ( ctx -> best_filter_diff, best_filter_diff, sizeof ( * best_filter_diff ) * SWITCHABLE_FILTER_CONTEXTS ) ; }

Fix:
<S2SV_ModStart> int mode_index, <S2SV_ModEnd> int64_t comp_pred_diff [ <S2SV_ModStart> ], int64_t <S2SV_ModEnd> best_filter_diff [ SWITCHABLE_FILTER_CONTEXTS <S2SV_ModStart> [ SWITCHABLE_FILTER_CONTEXTS ], int skippable <S2SV_ModStart> ; ctx -> skippable = skippable ; ctx -> <S2SV_ModStart> ; ctx -> mbmi_ext = * x -> mbmi_ext <S2SV_ModEnd> ; ctx -> <S2SV_ModStart> REFERENCE_MODE_SELECT ] ; memcpy <S2SV_ModEnd> ( ctx ->
Buggy code:
 static void do_free_upto ( BIO * f, BIO * upto ) { if ( upto ) { BIO * tbio ; do { tbio = BIO_pop ( f ) ; BIO_free ( f ) ; f = tbio ; } <START_BUG> while ( f!= upto ) ; <END_BUG> } else BIO_free_all ( f ) ; }

Fix:
<S2SV_ModStart> while ( f && f
Buggy code:
 int obj2ast_stmt ( PyObject * obj, stmt_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; int lineno ; int col_offset ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } <START_BUG> if ( _PyObject_HasAttrId ( obj, & PyId_lineno ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_lineno ) ; <START_BUG> if ( tmp == NULL ) goto failed ; <END_BUG> res = obj2ast_int ( tmp, & lineno, arena ) ;  if ( res!= 0 ) goto failed ; <START_BUG> Py_CLEAR ( tmp ) ; <END_BUG> } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"lineno\\"   missing   from   stmt" ) ; return 1 ; } if ( _PyObject_HasAttrId ( obj, & PyId_col_offset ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_col_offset ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_int ( tmp, & col_offset, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { PyErr_SetString ( PyExc_TypeError, "required   field   \\"col_offset\\"   missing   from   stmt" ) ; return 1 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) FunctionDef_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { identifier name ; arguments_ty args ; asdl_seq * body ; asdl_seq * decorator_list ; expr_ty returns ; string type_comment ;  if ( _PyObject_HasAttrId ( obj, & PyId_name ) ) { <START_BUG> int res ; <END_BUG> tmp = _PyObject_GetAttrId ( obj, & PyId_name ) ;  if ( tmp == NULL ) goto failed ; res = obj2ast_identifier ( tmp, & name, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <START_BUG> } else { <END_BUG> PyErr_SetString ( PyExc_TypeError, "required   field   \\"name\\"   missing

Fix:
<S2SV_ModStart> } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_lineno, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"lineno\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> stmt" ) ; return 1 ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; res = obj2ast_int ( tmp, & lineno, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart> obj, & PyId_col_offset, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"col_offset\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> stmt" ) ; return 1 ; } else { int res <S2SV_ModEnd> ; res = <S2SV_ModStart> tmp, & col_offset <S2SV_ModEnd>, arena ) <S2SV_ModStart> ( tmp ) <S2SV_ModEnd> ; } isinstance <S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_name, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL
Buggy code:
 void uwbd_stop ( struct uwb_rc * rc ) <START_BUG> { <END_BUG> kthread_stop ( rc -> uwbd. task ) ; uwbd_flush ( rc ) ; }

Fix:
<S2SV_ModStart> rc ) { if ( rc -> uwbd. task )
Buggy code:
 <START_BUG> xmlNode * <END_BUG>  crm_recv_remote_msg ( void * session, gboolean encrypted ) <START_BUG> { char * reply = NULL ; <END_BUG> xmlNode * xml = NULL ;  <START_BUG> if ( encrypted ) { <END_BUG> # ifdef HAVE_GNUTLS_GNUTLS_H reply = cib_recv_tls ( session ) ; # else CRM_ASSERT ( encrypted == FALSE ) ; # endif } else { reply = cib_recv_plaintext ( GPOINTER_TO_INT ( session ) ) ; } if ( reply == NULL || strlen ( reply ) == 0 ) { crm_trace ( "Empty   reply" ) ; } else { xml = string2xml ( reply ) ; if ( xml == NULL ) { crm_err ( "Couldn\'t   parse:   \'%.120s\'", reply ) ; } } free ( reply ) ; return xml ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> gboolean <S2SV_ModEnd> crm_recv_remote_msg ( void <S2SV_ModStart> void * session, char * * recv_buf <S2SV_ModStart>, gboolean encrypted, int total_timeout, int * disconnected ) { int ret ; size_t request_len = 0 ; time_t start = time ( NULL ) ; char * raw_request <S2SV_ModEnd> = NULL ; <S2SV_ModStart> = NULL ; int remaining_timeout = 0 ; if ( total_timeout == 0 ) { total_timeout = 10000 ; } else if ( total_timeout < 0 ) { total_timeout = 60000 ; } * disconnected = 0 ; remaining_timeout = total_timeout ; while ( ( remaining_timeout > 0 ) &&! ( * disconnected ) ) { crm_trace ( "waiting <S2SV_blank> to <S2SV_blank> receive <S2SV_blank> remote <S2SV_blank> msg, <S2SV_blank> starting <S2SV_blank> timeout <S2SV_blank> %d, <S2SV_blank> remaining_timeout <S2SV_blank> %d", total_timeout, remaining_timeout ) ; ret = crm_recv_remote_ready ( session, encrypted, remaining_timeout ) ; raw_request <S2SV_ModEnd> = NULL ; <S2SV_ModStart> ; if ( ret == 0 ) { crm_err ( "poll <S2SV_blank>
Buggy code:
 static int crossOriginDirective ( MaState * state, cchar * key, cchar * value ) { HttpRoute * route ; char * option, * ovalue, * tok ; route = state -> route ; tok = sclone ( value ) ; while ( ( option = maGetNextArg ( tok, & tok ) )!= 0 ) { <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if ( scaselessmatch ( option, "origin" ) ) { route -> corsOrigin = sclone ( ovalue ) ; } else if ( scaselessmatch ( option, "credentials" ) ) { route -> corsCredentials = httpGetBoolToken ( ovalue ) ; } else if ( scaselessmatch ( option, "headers" ) ) { route -> corsHeaders = sclone ( ovalue ) ; } else if ( scaselessmatch ( option, "age" ) ) { route -> corsAge = atoi ( ovalue ) ; } else { mprLog ( "error   appweb   config", 0, "Unknown   CrossOrigin   option   %s", option ) ; return MPR_ERR_BAD_SYNTAX ; } } # if KEEP if ( smatch ( route -> corsOrigin, "*" ) && route -> corsCredentials ) { mprLog ( "error   appweb   config", 0, "CrossOrigin:   Cannot   use   wildcard   Origin   if   allowing   credentials" ) ; return MPR_ERR_BAD_STATE ; } # endif httpAddRouteMethods ( route, "OPTIONS" ) ; route -> flags |= HTTP_ROUTE_CORS ; return 0 ; }

Fix:
<S2SV_ModStart> { option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 <START_BUG> static void sas_destruct_devices ( struct work_struct * work ) <END_BUG> {  struct domain_device * dev, * n ; <START_BUG> struct sas_discovery_event * ev = to_sas_discovery_event ( work ) ; struct asd_sas_port * port = ev -> port ; clear_bit ( DISCE_DESTRUCT, & port -> disc. pending ) ; list_for_each_entry_safe ( dev, n, & port -> destroy_list, disco_list_node ) { list_del_init ( & dev -> disco_list_node ) ; sas_remove_children ( & dev -> rphy -> dev ) ; sas_rphy_delete ( dev -> rphy ) ; sas_unregister_common_dev ( port, dev ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> void sas_destruct_devices ( <S2SV_ModStart> sas_destruct_devices ( struct asd_sas_port * port <S2SV_ModEnd> ) { struct <S2SV_ModStart>, * n <S2SV_ModEnd> ; list_for_each_entry_safe (
Buggy code:
 static int stv06xx_start ( struct gspca_dev * gspca_dev ) { struct sd * sd = ( struct sd * ) gspca_dev ; struct usb_host_interface * alt ; struct usb_interface * intf ; int err, packet_size ; intf = usb_ifnum_to_if ( sd -> gspca_dev. dev, sd -> gspca_dev. iface ) ; alt = usb_altnum_to_altsetting ( intf, sd -> gspca_dev. alt ) ; if (! alt ) { gspca_err ( gspca_dev, "Couldn\'t   get   altsetting\\n" ) ; return - EIO ; } <START_BUG> packet_size = le16_to_cpu ( alt -> endpoint [ 0 ]. desc. wMaxPacketSize ) ; <END_BUG> err = stv06xx_write_bridge ( sd, STV_ISO_SIZE_L, packet_size ) ; if ( err < 0 ) return err ; err = sd -> sensor -> start ( sd ) ; if ( err < 0 ) goto out ; err = stv06xx_write_bridge ( sd, STV_ISO_ENABLE, 1 ) ; out : if ( err < 0 ) gspca_dbg ( gspca_dev, D_STREAM, "Starting   stream   failed\\n" ) ; else gspca_dbg ( gspca_dev, D_STREAM, "Started   streaming\\n" ) ; return ( err < 0 )? err : 0 ; }

Fix:
<S2SV_ModStart> EIO ; } if ( alt -> desc. bNumEndpoints < 1 ) return - ENODEV ;
Buggy code:
 int main ( int argc, char * * argv ) { char * s, * inbuffer ; int length, error = 0 ; long num, i ; Inivars ( ) ; argc -- ; axohelp = * argv ++ ; if ( argc <= 0 ) { PrintHelp ( axohelp ) ; <START_BUG> return - 1 ; <END_BUG> } while ( ( * argv ) [ 0 ] == '-' ) { s = * argv ; if ( s [ 1 ] == '-' ) { s ++ ; } if ( ( strcmp ( s, "-h" ) == 0 ) || ( strcmp ( s, "-help" ) == 0 ) ) { PrintHelp ( axohelp ) ; return 0 ; } else if ( ( strcmp ( s, "-v" ) == 0 ) || ( strcmp ( s, "-version" ) == 0 ) ) { fprintf ( stderr, "%s   %d.%d\\n(release   date   %s)\\n" "Copyright   2018   John   Collins   and   Jos   Vermaseren.\\n" "License   GPLv3+:   GNU   GPL   version   3   or   later   <https:////gnu.org//licenses//gpl.html>.\\n" "There   is   NO   WARRANTY,   to   the   extent   permitted   by   law.\\n", axohelp, VERSION, SUBVERSION, VERSIONDATE ) ; return 0 ; } else if ( strcmp ( s, "-V" ) == 0 ) { VerboseFlag = 1 ; } else { fprintf ( stderr, "%s:   Illegal   option   %s\\n", axohelp, * argv ) ; PrintHelpPrompt ( axohelp ) ;  return - 1 ; <START_BUG> } argc -- ; argv ++ ; if ( argc <= 0 ) { fprintf ( stderr, "%s:   Not   enough   arguments\\n", axohelp ) ; PrintHelpPrompt ( axohelp ) ; <END_BUG> return - 1 ;  } } if ( argc!= 1 ) { fprintf ( stderr, "%s:   Too   many   arguments\\n", axohelp ) ; PrintHelpPrompt ( axohelp ) ; <START_BUG> return - 1 ; <END_BUG> } s = * argv ; length = strlen ( s ) ; inname = strcpy (

Fix:
<S2SV_ModStart> ) ; return <S2SV_ModEnd> 1 ; } <S2SV_ModStart> ) ; return <S2SV_ModEnd> 1 ; } <S2SV_ModStart> ) ; return <S2SV_ModEnd> 1 ; } <S2SV_ModStart> ) ; return <S2SV_ModEnd> 1 ; } <S2SV_ModStart> ) return ( <S2SV_ModEnd> 1 ) ; <S2SV_ModStart> ; exit ( <S2SV_ModEnd> 1 ) ; <S2SV_ModStart> ; return ( <S2SV_ModEnd> 1 ) ;
Buggy code:
 struct mnt_namespace * copy_mnt_ns ( unsigned long flags, struct mnt_namespace * ns, struct user_namespace * user_ns, struct fs_struct * new_fs ) { struct mnt_namespace * new_ns ; struct vfsmount * rootmnt = NULL, * pwdmnt = NULL ; struct mount * p, * q ; struct mount * old ; struct mount * new ; int copy_flags ; BUG_ON (! ns ) ; if ( likely (! ( flags & CLONE_NEWNS ) ) ) { get_mnt_ns ( ns ) ; return ns ; } old = ns -> root ; new_ns = alloc_mnt_ns ( user_ns ) ; if ( IS_ERR ( new_ns ) ) return new_ns ; namespace_lock ( ) ; copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE ; if ( user_ns!= ns -> user_ns ) copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED ; new = copy_tree ( old, old -> mnt. mnt_root, copy_flags ) ; if ( IS_ERR ( new ) ) { namespace_unlock ( ) ; free_mnt_ns ( new_ns ) ; return ERR_CAST ( new ) ; } new_ns -> root = new ; list_add_tail ( & new_ns -> list, & new -> mnt_list ) ; p = old ; q = new ; while ( p ) { q -> mnt_ns = new_ns ; <START_BUG> if ( new_fs ) { <END_BUG> if ( & p -> mnt == new_fs -> root. mnt ) { new_fs -> root. mnt = mntget ( & q -> mnt ) ; rootmnt = & p -> mnt ; } if ( & p -> mnt == new_fs -> pwd. mnt ) { new_fs -> pwd. mnt = mntget ( & q -> mnt ) ; pwdmnt = & p -> mnt ; } } p = next_mnt ( p, old ) ; q = next_mnt ( q, new ) ; if (! q ) break ; while ( p -> mnt. mnt_root!= q -> mnt. mnt_root ) p = next_mnt ( p, old ) ;

Fix:
<S2SV_ModStart> = new_ns ; new_ns -> mounts ++ ;
Buggy code:
 <START_BUG> static void write_mv_update ( const vp9_tree_index * tree, <END_BUG>  vp9_prob probs [ ], <START_BUG> const unsigned int counts [ ], <END_BUG> int n, vp9_writer * w ) {  int i ; unsigned int branch_ct [ 32 ] [ 2 ] ; assert ( n <= 32 ) ; vp9_tree_probs_from_distribution ( tree, branch_ct, counts ) ; for ( i = 0 ; i < n - 1 ; ++ i ) update_mv ( w, branch_ct [ i ], & probs [ i ], MV_UPDATE_PROB ) ; }

Fix:
<S2SV_ModStart> write_mv_update ( const vpx_tree_index <S2SV_ModEnd> * tree, <S2SV_ModStart> * tree, vpx_prob <S2SV_ModEnd> probs [ ] <S2SV_ModStart> int n, vpx_writer <S2SV_ModEnd> * w )
Buggy code:
 <START_BUG> static bool tailmatch ( const char * little, const char * bigone ) <END_BUG> {  size_t littlelen = strlen ( little ) ; <START_BUG> <END_BUG> size_t biglen = strlen ( bigone ) ;  <START_BUG> if ( littlelen > biglen ) <END_BUG> return FALSE ;  return Curl_raw_equal ( little, bigone + biglen - littlelen )? TRUE : FALSE ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> const char * cooke_domain <S2SV_ModEnd>, const char <S2SV_ModStart> const char * hostname <S2SV_ModEnd> ) { size_t <S2SV_ModStart> ) { size_t cookie_domain_len <S2SV_ModEnd> = strlen ( <S2SV_ModStart> = strlen ( cooke_domain <S2SV_ModEnd> ) ; size_t <S2SV_ModStart> ) ; size_t hostname_len <S2SV_ModEnd> = strlen ( <S2SV_ModStart> = strlen ( hostname <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; if ( hostname_len < cookie_domain_len <S2SV_ModEnd> ) return FALSE <S2SV_ModStart> return FALSE ; if (! Curl_raw_equal ( cooke_domain, hostname + hostname_len - cookie_domain_len ) ) return FALSE ; if ( hostname_len == cookie_domain_len ) return TRUE ; if ( '.' == * ( hostname + hostname_len - cookie_domain_len - 1 ) ) return TRUE ; return <S2SV_ModEnd> FALSE ; }
Buggy code:
 static int ims_pcu_parse_cdc_data ( struct usb_interface * intf, struct ims_pcu * pcu ) { const struct usb_cdc_union_desc * union_desc ; struct usb_host_interface * alt ; union_desc = ims_pcu_get_cdc_union_desc ( intf ) ; if (! union_desc ) return - EINVAL ; pcu -> ctrl_intf = usb_ifnum_to_if ( pcu -> udev, union_desc -> bMasterInterface0 ) ; <START_BUG> alt = pcu -> ctrl_intf -> cur_altsetting ; <END_BUG> pcu -> ep_ctrl = & alt -> endpoint [ 0 ]. desc ; pcu -> max_ctrl_size = usb_endpoint_maxp ( pcu -> ep_ctrl ) ; pcu -> data_intf = usb_ifnum_to_if ( pcu -> udev, union_desc -> bSlaveInterface0 ) ;  alt = pcu -> data_intf -> cur_altsetting ; <START_BUG> if ( alt -> desc. bNumEndpoints!= 2 ) { dev_err ( pcu -> dev, "Incorrect   number   of   endpoints   on   data   interface   (%d)\\n", alt -> desc. bNumEndpoints ) ; return - EINVAL ; } pcu -> ep_out = & alt -> endpoint [ 0 ]. desc ; if (! usb_endpoint_is_bulk_out ( pcu -> ep_out ) ) { dev_err ( pcu -> dev, "First   endpoint   on   data   interface   is   not   BULK   OUT\\n" ) ; return - EINVAL ; } pcu -> max_out_size = usb_endpoint_maxp ( pcu -> ep_out ) ; if ( pcu -> max_out_size < 8 ) { dev_err ( pcu -> dev, "Max   OUT   packet   size   is   too   small   (%zd)\\n", pcu -> max_out_size ) ; return - EINVAL ; } pcu -> ep_in = & alt -> endpoint [ 1 ]. desc ; if (! usb_endpoint_is_bulk_in ( pcu -> ep_in ) ) { dev_err ( pcu -> dev, "Second<END_BUG>

Fix:
<S2SV_ModStart> bMasterInterface0 ) ; if (! pcu -> ctrl_intf ) return - EINVAL ; <S2SV_ModStart> bSlaveInterface0 ) ; if (! pcu -> data_intf ) return - EINVAL ;
Buggy code:
 int simple_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int error ; if ( type == ACL_TYPE_ACCESS ) { <START_BUG> error = posix_acl_equiv_mode ( acl, & inode -> i_mode ) ; <END_BUG>  if ( error < 0 ) <START_BUG> return 0 ; if ( error == 0 ) acl = NULL ; } inode -> i_ctime = current_time ( inode ) ; set_cached_acl ( inode, type, acl ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> { error = posix_acl_update_mode ( inode <S2SV_ModEnd>, & inode <S2SV_ModStart> inode -> i_mode, & acl <S2SV_ModStart> if ( error ) return error <S2SV_ModEnd> ; } inode
Buggy code:
 static av_cold int xpm_decode_close ( AVCodecContext * avctx ) { XPMDecContext * x = avctx -> priv_data ; av_freep ( & x -> pixels ) ; <START_BUG> return 0 ; <END_BUG> }

Fix:
<S2SV_ModStart> pixels ) ; av_freep ( & x -> buf ) ; x -> buf_size = 0 ;
Buggy code:
 <START_BUG> static void nsc_encode_subsampling ( NSC_CONTEXT * context ) <END_BUG> { UINT16 x ; UINT16 y ;  BYTE * co_dst ; <START_BUG> BYTE * cg_dst ; INT8 * co_src0 ; INT8 * co_src1 ; INT8 * cg_src0 ; INT8 * cg_src1 ; UINT32 tempWidth ; <END_BUG> UINT32 tempHeight ;  tempWidth = ROUND_UP_TO ( context -> width, 8 ) ; tempHeight = ROUND_UP_TO ( context -> height, 2 ) ; <START_BUG> for ( y = 0 ; y < tempHeight >> 1 ; y ++ ) <END_BUG> {  co_dst = context -> priv -> PlaneBuffers [ 1 ] + y * ( tempWidth >> 1 ) ; <START_BUG> <END_BUG> cg_dst = context -> priv -> PlaneBuffers [ 2 ] + y * ( tempWidth >> 1 ) ;  <START_BUG> co_src0 = ( INT8 * ) context -> priv -> PlaneBuffers [ 1 ] + ( y << 1 ) * tempWidth ; <END_BUG>  co_src1 = co_src0 + tempWidth ; <START_BUG> <END_BUG> cg_src0 = ( INT8 * ) context -> priv -> PlaneBuffers [ 2 ] + ( y << 1 ) * tempWidth ;  <START_BUG> cg_src1 = cg_src0 + tempWidth ; <END_BUG> for ( x = 0 ; x < tempWidth >> 1 ; x ++ ) { * co_dst ++ = ( BYTE ) ( ( ( INT16 ) * co_src0 + ( INT16 ) * ( co_src0 + 1 ) + ( INT16 ) * co_src1 + ( INT16 ) * ( co_src1 + 1 ) ) >> 2 ) ; * cg_dst ++ = ( BYTE ) ( ( ( INT16 ) * cg_src0 + ( INT16 ) * ( cg_src0 + 1 ) + ( INT16 ) * cg_src1 + ( INT16 ) * ( cg_src1 + 1 ) ) >> 2 ) ; co_src0 += 2 ; co_src1 += 2 ; cg_src0 += 2 ; cg_src1 += 2 ; } }  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> nsc_encode_subsampling ( NSC_CONTEXT <S2SV_ModStart> UINT16 y ; <S2SV_ModEnd> UINT32 tempWidth ; <S2SV_ModStart> ; UINT32 tempHeight ; if (! context ) return FALSE <S2SV_ModStart> 2 ) ; if ( tempHeight == 0 ) return FALSE ; if ( tempWidth > context -> priv -> PlaneBuffersLength // tempHeight ) return FALSE ; <S2SV_ModStart> ++ ) { BYTE * <S2SV_ModStart> 1 ) ; BYTE * <S2SV_ModStart> 1 ) ; const INT8 * <S2SV_ModStart> * tempWidth ; const INT8 * <S2SV_ModStart> + tempWidth ; const INT8 * <S2SV_ModStart> * tempWidth ; const INT8 * <S2SV_ModStart> ; } } return TRUE ;
Buggy code:
 static int oidc_handle_logout ( request_rec * r, oidc_cfg * c, oidc_session_t * session ) { oidc_provider_t * provider = NULL ; char * url = NULL ; <START_BUG> oidc_util_get_request_parameter ( r, OIDC_REDIRECT_URI_REQUEST_LOGOUT, & url ) ; <END_BUG> oidc_debug ( r, "enter   (url=%s)", url ) ; if ( oidc_is_front_channel_logout ( url ) ) { return oidc_handle_logout_request ( r, c, session, url ) ; } else if ( oidc_is_back_channel_logout ( url ) ) { return oidc_handle_logout_backchannel ( r, c ) ; } if ( ( url == NULL ) || ( apr_strnatcmp ( url, "" ) == 0 ) ) { url = c -> default_slo_url ; } else {  const char * error_description = NULL ; <START_BUG> apr_uri_t uri ; if ( apr_uri_parse ( r -> pool, url, & uri )!= APR_SUCCESS ) { const char * error_description = apr_psprintf ( r -> pool, "Logout   URL   malformed:   %s", url ) ; oidc_error ( r, "%s", error_description ) ; return oidc_util_html_send_error ( r, c -> error_template, <END_BUG> "Malformed   URL", error_description,  HTTP_INTERNAL_SERVER_ERROR ) ; } const char * c_host = oidc_get_current_url_host ( r ) ; if ( ( uri. hostname!= NULL ) && ( ( strstr ( c_host, uri. hostname ) == NULL ) || ( strstr ( uri. hostname, c_host ) == NULL ) ) ) { error_description = apr_psprintf ( r -> pool, "logout   value   \\"%s\\"   does   not   match   the   hostname   of   the   current   request   \\"%s\\"", apr_uri_unparse ( r -> pool, & uri, 0 ), c_host ) ; oidc_error ( r, "%s", error_description ) ; return oidc_util_html_send

Fix:
<S2SV_ModStart> = NULL ; char * error_str = NULL ; char * error_description = NULL ; <S2SV_ModStart> } else { if ( oidc_validate_post_logout_url ( r, url, & error_str, & error_description ) == FALSE ) { <S2SV_ModEnd> return oidc_util_html_send_error ( <S2SV_ModStart> -> error_template, error_str, error_description, HTTP_BAD_REQUEST <S2SV_ModEnd> ) ; }
Buggy code:
 struct clock_source * dce110_clock_source_create ( struct dc_context * ctx, struct dc_bios * bios, enum clock_source_id id, const struct dce110_clk_src_regs * regs, bool dp_clk_src ) { struct dce110_clk_src * clk_src = kzalloc ( sizeof ( struct dce110_clk_src ), GFP_KERNEL ) ; if (! clk_src ) return NULL ; if ( dce110_clk_src_construct ( clk_src, ctx, bios, id, regs, & cs_shift, & cs_mask ) ) { clk_src -> base. dp_clk_src = dp_clk_src ; return & clk_src -> base ; } <START_BUG> BREAK_TO_DEBUGGER ( ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> base ; } kfree ( clk_src ) ;
Buggy code:
 static void ikev2_parent_outI1_continue ( struct pluto_crypto_req_cont * pcrc, struct pluto_crypto_req * r, err_t ugh ) { struct ke_continuation * ke = ( struct ke_continuation * ) pcrc ; struct msg_digest * md = ke -> md ; struct state * const st = md -> st ; stf_status e ; DBG ( DBG_CONTROLMORE, DBG_log ( "ikev2   parent   outI1:   calculated   ke+nonce,   sending   I1" ) ) ; if ( st == NULL ) { loglog ( RC_LOG_SERIOUS, "%s:   Request   was   disconnected   from   state", __FUNCTION__ ) ; if ( ke -> md ) release_md ( ke -> md ) ; return ; } passert ( ugh == NULL ) ; passert ( cur_state == NULL ) ; passert ( st!= NULL ) ; passert ( st -> st_suspended_md == ke -> md ) ; set_suspended ( st, NULL ) ; set_cur_state ( st ) ; st -> st_calculating = FALSE ; e = ikev2_parent_outI1_tail ( pcrc, r ) ; if ( ke -> md!= NULL ) { complete_v2_state_transition ( & ke -> md, e ) ; if ( ke -> md ) release_md ( ke -> md ) ; } reset_cur_state ( ) ; reset_globals ( ) ; <START_BUG> passert ( GLOBALS_ARE_RESET ( ) ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>