nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void sctp_sock_migrate ( struct sock * oldsk, struct sock * newsk, struct sctp_association * assoc, sctp_socket_type_t type ) { struct sctp_sock * oldsp = sctp_sk ( oldsk ) ; struct sctp_sock * newsp = sctp_sk ( newsk ) ; struct sctp_bind_bucket * pp ; struct sctp_endpoint * newep = newsp -> ep ; struct sk_buff * skb, * tmp ; struct sctp_ulpevent * event ; int flags = 0 ; newsk -> sk_sndbuf = oldsk -> sk_sndbuf ; newsk -> sk_rcvbuf = oldsk -> sk_rcvbuf ; inet_sk_copy_descendant ( newsk, oldsk ) ; newsp -> ep = newep ; newsp -> hmac = NULL ; pp = sctp_sk ( oldsk ) -> bind_hash ; sk_add_bind_node ( newsk, & pp -> owner ) ; sctp_sk ( newsk ) -> bind_hash = pp ; inet_sk ( newsk ) -> num = inet_sk ( oldsk ) -> num ; if ( PF_INET6 == assoc -> base. sk -> sk_family ) flags = SCTP_ADDR6_ALLOWED ; if ( assoc -> peer. ipv4_address ) flags |= SCTP_ADDR4_PEERSUPP ; if ( assoc -> peer. ipv6_address ) flags |= SCTP_ADDR6_PEERSUPP ; sctp_bind_addr_copy ( & newsp -> ep -> base. bind_addr, & oldsp -> ep -> base. bind_addr, SCTP_SCOPE_GLOBAL, GFP_KERNEL, flags ) ; sctp_skb_for_each ( skb, & oldsk -> sk_receive_queue, tmp ) { event = sctp_skb2event ( skb ) ; if ( event -> asoc == assoc ) { <START_BUG> sctp_sock_rfree ( skb ) ; <END_BUG> __skb_unlink ( skb, & oldsk -> sk_receive_queue ) ; __skb_queue_tail ( & newsk -> sk_receive_queue, skb ) ;  sctp_skb_

Fix:
<S2SV_ModStart> assoc ) { sctp_sock_rfree_frag <S2SV_ModEnd> ( skb ) <S2SV_ModStart> skb ) ; sctp_skb_set_owner_r_frag <S2SV_ModEnd> ( skb, <S2SV_ModStart> assoc ) { sctp_sock_rfree_frag <S2SV_ModEnd> ( skb ) <S2SV_ModStart> skb ) ; sctp_skb_set_owner_r_frag <S2SV_ModEnd> ( skb, <S2SV_ModStart> sctp_clear_pd ( oldsk ) ; } sctp_skb_for_each ( skb, & assoc -> ulpq. reasm, tmp ) { sctp_sock_rfree_frag ( skb ) ; sctp_skb_set_owner_r_frag ( skb, newsk ) ; } sctp_skb_for_each ( skb, & assoc -> ulpq. lobby, tmp ) { sctp_sock_rfree_frag ( skb ) ; sctp_skb_set_owner_r_frag ( skb, newsk
Buggy code:
 static void temporal_filter_iterate_c ( VP9_COMP * cpi, <START_BUG> int frame_count, <END_BUG> int alt_ref_index, int strength, struct scale_factors * scale ) { int byte ; int frame ; int mb_col, mb_row ; unsigned int filter_weight ;  int mb_cols = cpi -> common. mb_cols ; <START_BUG> <END_BUG> int mb_rows = cpi -> common. mb_rows ;  int mb_y_offset = 0 ; int mb_uv_offset = 0 ; <START_BUG> DECLARE_ALIGNED_ARRAY ( 16, unsigned int, accumulator, 16 * 16 * 3 ) ; <END_BUG>  DECLARE_ALIGNED_ARRAY ( 16, uint16_t, count, 16 * 16 * 3 ) ; <START_BUG> <END_BUG> MACROBLOCKD * mbd = & cpi -> mb. e_mbd ;  <START_BUG> YV12_BUFFER_CONFIG * f = cpi -> frames [ alt_ref_index ] ; <END_BUG> uint8_t * dst1, * dst2 ;  DECLARE_ALIGNED_ARRAY ( 16, uint8_t, predictor, 16 * 16 * 3 ) ; <START_BUG> const int mb_uv_height = 16 >> mbd -> plane [ 1 ]. subsampling_y ; <END_BUG> uint8_t * input_buffer [ MAX_MB_PLANE ] ;  int i ; <START_BUG> assert ( mbd -> plane [ 1 ]. subsampling_x == mbd -> plane [ 1 ]. subsampling_y ) ; <END_BUG> for ( i = 0 ; i < MAX_MB_PLANE ; i ++ ) input_buffer [ i ] = mbd -> plane [ i ]. pre [ 0 ]. buf ; for ( mb_row = 0 ; mb_row < mb_rows ; mb_row ++ ) {  # if ALT_REF_MC_ENABLED <START_BUG> cpi -> mb. mv_row_min = - ( ( mb_row * 16 ) + ( 17 - 2 * VP9_INTERP_EXTEND ) ) ; <END_BUG> cpi -> mb. mv_row_max = ( ( cpi -> common. mb_rows - 1 - mb_row ) * 16 )  + ( 17 - 2 * VP9_INTERP_EXTEND ) ; <START_BUG> # endif <END_BUG> for ( mb_col = 0 ; mb_col

Fix:
<S2SV_ModStart> * cpi, YV12_BUFFER_CONFIG * * frames, <S2SV_ModStart> int mb_cols = ( frames [ alt_ref_index ] -> y_crop_width + 15 ) >> 4 <S2SV_ModEnd> ; int mb_rows <S2SV_ModStart> int mb_rows = ( frames [ alt_ref_index ] -> y_crop_height + 15 ) >> 4 <S2SV_ModEnd> ; int mb_y_offset <S2SV_ModStart> = 0 ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> int, accumulator [ <S2SV_ModEnd> 16 * 16 <S2SV_ModStart> 16 * 3 ] ) ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> uint16_t, count [ <S2SV_ModEnd> 16 * 16 <S2SV_ModStart> 16 * 3 ] <S2SV_ModStart> & cpi -> td. <S2SV_ModStart> * f = <S2SV_ModEnd> frames [ alt_ref_index <S2SV_ModStart> * dst2 ; # if CONFIG_VP9_HIGHBITDEPTH DECLARE_ALIGNED ( 16, uint16_t, predictor16 [ 16 * 16 * 3 ] ) ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart>, uint8_t, predictor8 [ 16 * 16 * 3 ] ) ; uint8_t * predictor ; # else DECLARE_ALIGNED ( 16, uint8_t, predictor
Buggy code:
 int perf_event_task_disable ( void ) <START_BUG> { <END_BUG> struct perf_event * event ; mutex_lock ( & current -> perf_event_mutex ) ;  list_for_each_entry ( event, & current -> perf_event_list, owner_entry ) <START_BUG> <END_BUG> perf_event_for_each_child ( event, perf_event_disable ) ;  mutex_unlock ( & current -> perf_event_mutex ) ; return 0 ; }

Fix:
<S2SV_ModStart> void ) { struct perf_event_context * ctx ; <S2SV_ModStart>, owner_entry ) { ctx = perf_event_ctx_lock ( event ) ; <S2SV_ModStart> ( event, _perf_event_disable ) ; perf_event_ctx_unlock ( event, ctx ) ; } <S2SV_ModEnd> mutex_unlock ( &
Buggy code:
 <START_BUG> static void encode_sb_rt ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> TOKENEXTRA * * tp, int mi_row, int mi_col,  int output_enabled, BLOCK_SIZE bsize ) { <START_BUG> VP9_COMMON * const cm = & cpi -> common ; <END_BUG> MACROBLOCK * const x = & cpi -> mb ;  MACROBLOCKD * const xd = & x -> e_mbd ; <START_BUG> const int bsl = b_width_log2 ( bsize ), hbs = ( 1 << bsl ) // 4 ; <END_BUG> int ctx ; PARTITION_TYPE partition ; BLOCK_SIZE subsize ; if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; if ( bsize >= BLOCK_8X8 ) {  MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; <START_BUG> const int idx_str = xd -> mi_stride * mi_row + mi_col ; MODE_INFO * * mi_8x8 = cm -> mi_grid_visible + idx_str ; ctx = partition_plane_context ( xd, mi_row, mi_col, bsize ) ; subsize = mi_8x8 [ 0 ] -> mbmi. sb_type ; } else { ctx = 0 ; subsize = BLOCK_4X4 ; } partition = partition_lookup [ bsl ] [ subsize ] ; <END_BUG> switch ( partition ) {  case PARTITION_NONE : <START_BUG> if ( output_enabled && bsize >= BLOCK_8X8 ) <END_BUG> cm -> counts. partition [ ctx ] [ PARTITION_NONE ] ++ ;  encode_b_rt ( cpi, tile, tp, mi_row, mi_col, output_enabled, subsize ) ; <START_BUG> break ; case PARTITION_VERT : <END_BUG> if ( output_enabled )  cm -> counts. partition [ ctx ] [ PARTITION_VERT ] ++ ; * get_sb_index ( x, subsize ) = 0 ; encode_b_rt ( cpi, tile, tp, mi_row, mi_col, output_enabled, subsize ) ; <START_BUG> if ( mi_col + hbs < cm -> mi_cols ) { <END_BUG> * get_sb_index ( x, subsize ) = 1 ; encode

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, <S2SV_ModStart>, BLOCK_SIZE bsize, PC_TREE * pc_tree <S2SV_ModStart> x = & td <S2SV_ModEnd> -> mb ; <S2SV_ModStart> int bsl = b_width_log2_lookup [ bsize ] <S2SV_ModEnd>, hbs = <S2SV_ModStart> BLOCK_8X8 ) { <S2SV_ModEnd> const int idx_str <S2SV_ModStart> subsize ] ; if ( output_enabled && bsize!= BLOCK_4X4 ) td -> counts -> partition [ ctx ] [ partition ] ++ ; <S2SV_ModStart> case PARTITION_NONE : <S2SV_ModEnd> encode_b_rt ( cpi <S2SV_ModStart> ( cpi, td, tile, tp, mi_row, mi_col, output_enabled, subsize, & pc_tree -> none <S2SV_ModEnd> ) ; break <S2SV_ModStart> case PARTITION_VERT : encode_b_rt ( cpi, td, tile, tp, mi_row, mi_col, output_enabled, subsize, & pc_tree -> vertical [ 0 ] <S2SV_ModEnd> ) ; if <S2SV_ModStart> cm -> mi_cols && bsize > BLOCK_8X8 ) { encode_b_rt ( cpi, td, tile, tp, mi_row, mi_col + hbs, output_enabled, subsize
Buggy code:
 static int sc_pkcs15emu_sc_hsm_init ( sc_pkcs15_card_t * p15card ) { sc_card_t * card = p15card -> card ; sc_hsm_private_data_t * priv = ( sc_hsm_private_data_t * ) card -> drv_data ; sc_file_t * file = NULL ; sc_path_t path ; u8 filelist [ MAX_EXT_APDU_LENGTH ] ; int filelistlength ; int r, i ; sc_cvc_t devcert ; struct sc_app_info * appinfo ; struct sc_pkcs15_auth_info pin_info ; struct sc_pkcs15_object pin_obj ; struct sc_pin_cmd_data pindata ; u8 efbin [ 1024 ] ; u8 * ptr ; size_t len ; LOG_FUNC_CALLED ( card -> ctx ) ; appinfo = calloc ( 1, sizeof ( struct sc_app_info ) ) ; if ( appinfo == NULL ) { LOG_FUNC_RETURN ( card -> ctx, SC_ERROR_OUT_OF_MEMORY ) ; } appinfo -> aid = sc_hsm_aid ; appinfo -> ddo. aid = sc_hsm_aid ; p15card -> app = appinfo ; sc_path_set ( & path, SC_PATH_TYPE_DF_NAME, sc_hsm_aid. value, sc_hsm_aid. len, 0, 0 ) ; r = sc_select_file ( card, & path, & file ) ; LOG_TEST_RET ( card -> ctx, r, "Could   not   select   SmartCard-HSM   application" ) ; p15card -> card -> version. hw_major = 24 ; p15card -> card -> version. hw_minor = 13 ; if ( file && file -> prop_attr && file -> prop_attr_len >= 2 ) { p15card -> card -> version. fw_major = file -> prop_attr [ file -> prop_attr_len - 2 ] ; p15card -> card -> version. fw_minor = file -> prop_attr [ file -> prop_attr_len - 1 ] ; } sc_file_free ( file ) ; if ( priv -> EF_C_DevAut && priv -> EF_

Fix:
<S2SV_ModStart> "Skipping <S2SV_blank> optional <S2SV_blank> EF.C_DevAut" ) ; if ( len > 0 ) { <S2SV_ModStart> = len ; }
Buggy code:
 WORD32 impeg2d_get_slice_pos ( dec_state_multi_core_t * ps_dec_state_multi_core ) { WORD32 u4_bits ; WORD32 i4_row ; dec_state_t * ps_dec = ps_dec_state_multi_core -> ps_dec_state [ 0 ] ; WORD32 i4_prev_row ; stream_t s_bitstrm ; WORD32 i4_start_row ; WORD32 i4_slice_bistream_ofst ; WORD32 i ; s_bitstrm = ps_dec -> s_bit_stream ; i4_prev_row = - 1 ; ps_dec_state_multi_core -> ps_dec_state [ 0 ] -> i4_start_mb_y = 0 ; ps_dec_state_multi_core -> ps_dec_state [ 1 ] -> i4_start_mb_y = - 1 ; ps_dec_state_multi_core -> ps_dec_state [ 2 ] -> i4_start_mb_y = - 1 ; ps_dec_state_multi_core -> ps_dec_state [ 3 ] -> i4_start_mb_y = - 1 ; ps_dec_state_multi_core -> ps_dec_state [ 0 ] -> i4_end_mb_y = ps_dec -> u2_num_vert_mb ; ps_dec_state_multi_core -> ps_dec_state [ 1 ] -> i4_end_mb_y = - 1 ; ps_dec_state_multi_core -> ps_dec_state [ 2 ] -> i4_end_mb_y = - 1 ; ps_dec_state_multi_core -> ps_dec_state [ 3 ] -> i4_end_mb_y = - 1 ; if ( ps_dec -> i4_num_cores == 1 ) return 0 ; impeg2_jobq_reset ( ( jobq_t * ) ps_dec -> pv_jobq ) ; i4_start_row = - 1 ; i4_slice_bistream_ofst = 0 ; while ( 1 ) { WORD32 i4_is_slice ; if ( s_bitstrm. u4_offset + START_CODE_LEN >=

Fix:
<S2SV_ModStart> if ( i4_prev_row < <S2SV_ModEnd> i4_row ) { <S2SV_ModStart> i4_row ; } else if ( i4_prev_row > i4_row ) { android_errorWriteLog ( 0x534e4554, "26070014" ) ; }
Buggy code:
 SPL_METHOD ( SplDoublyLinkedList, offsetSet ) { zval * zindex, * value ; spl_dllist_object * intern ; if ( zend_parse_parameters ( ZEND_NUM_ARGS ( ), "zz", & zindex, & value ) == FAILURE ) { return ; } intern = Z_SPLDLLIST_P ( getThis ( ) ) ; if ( Z_TYPE_P ( zindex ) == IS_NULL ) { spl_ptr_llist_push ( intern -> llist, value ) ; } else { zend_long index ; spl_ptr_llist_element * element ; index = spl_offset_convert_to_long ( zindex ) ; if ( index < 0 || index >= intern -> llist -> count ) { <START_BUG> zval_ptr_dtor ( value ) ; <END_BUG> zend_throw_exception ( spl_ce_OutOfRangeException, "Offset   invalid   or   out   of   range", 0 ) ; return ; } element = spl_ptr_llist_offset ( intern -> llist, index, intern -> flags & SPL_DLLIST_IT_LIFO ) ; if ( element!= NULL ) { if ( intern -> llist -> dtor ) { intern -> llist -> dtor ( element ) ; } zval_ptr_dtor ( & element -> data ) ; ZVAL_COPY_VALUE ( & element -> data, value ) ; if ( intern -> llist -> ctor ) { intern -> llist -> ctor ( element ) ; } } else { zval_ptr_dtor ( value ) ; zend_throw_exception ( spl_ce_OutOfRangeException, "Offset   invalid", 0 ) ; return ; } } }

Fix:
<S2SV_ModStart> count ) { <S2SV_ModEnd> zend_throw_exception ( spl_ce_OutOfRangeException
Buggy code:
 int main ( int argc, char * * argv ) { int frame_cnt = 0 ; FILE * outfile = NULL ; vpx_codec_ctx_t codec ; vpx_codec_err_t res ; VpxVideoReader * reader = NULL ; const VpxInterface * decoder = NULL ; const VpxVideoInfo * info = NULL ; exec_name = argv [ 0 ] ; if ( argc!= 3 ) die ( "Invalid   number   of   arguments." ) ; reader = vpx_video_reader_open ( argv [ 1 ] ) ; if (! reader ) die ( "Failed   to   open   %s   for   reading.", argv [ 1 ] ) ; if (! ( outfile = fopen ( argv [ 2 ], "wb" ) ) ) die ( "Failed   to   open   %s   for   writing", argv [ 2 ] ) ; info = vpx_video_reader_get_info ( reader ) ; decoder = get_vpx_decoder_by_fourcc ( info -> codec_fourcc ) ; if (! decoder ) die ( "Unknown   input   codec." ) ; <START_BUG> printf ( "Using   %s\\n", vpx_codec_iface_name ( decoder -> interface ( ) ) ) ; <END_BUG>  res = vpx_codec_dec_init ( & codec, decoder -> interface ( ), NULL, <START_BUG> VPX_CODEC_USE_POSTPROC ) ; if ( res == VPX_CODEC_INCAPABLE ) die_codec ( & codec, "Postproc   not   supported   by   this   decoder." ) ; if ( res ) die_codec ( & codec, "Failed   to   initialize   decoder." ) ; while ( vpx_video_reader_read_frame ( reader ) ) { vpx_codec_iter_t iter = NULL ; vpx_image_t * img = NULL ; size_t frame_size = 0 ; const unsigned char * frame = vpx_video_reader_get_frame ( reader, & frame_size ) ; ++ frame_cnt ; if ( frame_cnt % 30 == 1 ) { vp8_postproc_cfg_t pp = { 0, 0, 0 } ; if ( vpx_codec_control ( & codec, VP8_SET_POSTPROC, & pp<END_BUG>

Fix:
<S2SV_ModStart> ( decoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart>, decoder -> codec_interface <S2SV_ModEnd> ( ),
Buggy code:
 static void common_hrtimer_rearm ( struct k_itimer * timr ) { struct hrtimer * timer = & timr -> it. real. timer ; if (! timr -> it_interval ) return ; <START_BUG> timr -> it_overrun += ( unsigned int ) hrtimer_forward ( timer, <END_BUG> timer -> base -> get_time ( ), timr -> it_interval ) ; hrtimer_restart ( timer ) ; }

Fix:
<S2SV_ModStart> -> it_overrun += <S2SV_ModEnd> hrtimer_forward ( timer
Buggy code:
 GF_Err urn_Read ( GF_Box * s, GF_BitStream * bs ) { u32 i, to_read ; char * tmpName ; GF_DataEntryURNBox * ptr = ( GF_DataEntryURNBox * ) s ; if (! ptr -> size ) return GF_OK ; to_read = ( u32 ) ptr -> size ; tmpName = ( char * ) gf_malloc ( sizeof ( char ) * to_read ) ; if (! tmpName ) return GF_OUT_OF_MEM ; gf_bs_read_data ( bs, tmpName, to_read ) ; i = 0 ; <START_BUG> while ( ( tmpName [ i ]!= 0 ) && ( i < to_read ) ) { <END_BUG> i ++ ; } if ( i == to_read ) { gf_free ( tmpName ) ; return GF_ISOM_INVALID_FILE ; } if ( i == to_read - 1 ) { ptr -> nameURN = tmpName ; ptr -> location = NULL ; return GF_OK ; } ptr -> nameURN = ( char * ) gf_malloc ( sizeof ( char ) * ( i + 1 ) ) ; if (! ptr -> nameURN ) { gf_free ( tmpName ) ; return GF_OUT_OF_MEM ; } ptr -> location = ( char * ) gf_malloc ( sizeof ( char ) * ( to_read - i - 1 ) ) ; if (! ptr -> location ) { gf_free ( tmpName ) ; gf_free ( ptr -> nameURN ) ; ptr -> nameURN = NULL ; return GF_OUT_OF_MEM ; } memcpy ( ptr -> nameURN, tmpName, i + 1 ) ; memcpy ( ptr -> location, tmpName + i + 1, ( to_read - i - 1 ) ) ; gf_free ( tmpName ) ; return GF_OK ; }

Fix:
<S2SV_ModStart> ; while ( ( i < to_read ) && <S2SV_ModStart>!= 0 ) <S2SV_ModEnd> ) { i
Buggy code:
 static void swap_frame_buffers ( VP9Decoder * pbi ) { int ref_index = 0, mask ; VP9_COMMON * const cm = & pbi -> common ; <START_BUG> for ( mask = pbi -> refresh_frame_flags ; mask ; mask >>= 1 ) { <END_BUG>  if ( mask & 1 ) { <START_BUG> const int old_idx = cm -> ref_frame_map [ ref_index ] ; <END_BUG> ref_cnt_fb ( cm -> frame_bufs, & cm -> ref_frame_map [ ref_index ],  <START_BUG> cm -> new_fb_idx ) ; <END_BUG>  if ( old_idx >= 0 && cm -> frame_bufs [ old_idx ]. ref_count == 0 ) <START_BUG> cm -> release_fb_cb ( cm -> cb_priv, & cm -> frame_bufs [ old_idx ]. raw_frame_buffer ) ; } ++ ref_index ; } cm -> frame_to_show = get_frame_new_buffer ( cm ) ; cm -> frame_bufs [ cm -> new_fb_idx ]. ref_count -- ; for ( ref_index = 0 ; ref_index < 3 ; ref_index ++ ) <END_BUG> cm -> frame_refs [ ref_index ]. idx = INT_MAX ;  }

Fix:
<S2SV_ModStart> -> common ; BufferPool * const pool = cm -> buffer_pool ; RefCntBuffer * const frame_bufs = cm -> buffer_pool -> frame_bufs ; lock_buffer_pool ( pool ) ; <S2SV_ModStart> 1 ) { const int old_idx = cm -> ref_frame_map [ ref_index ] ; decrease_ref_count ( old_idx, frame_bufs, pool ) ; if ( <S2SV_ModEnd> ( mask & <S2SV_ModStart> & 1 ) && old_idx >= 0 ) { decrease_ref_count ( old_idx, frame_bufs, pool ) ; } cm -> ref_frame_map [ ref_index ] = cm -> next_ref_frame_map [ ref_index ] ; ++ ref_index ; } for ( ; ref_index < REF_FRAMES &&! cm -> show_existing_frame ; ++ ref_index ) <S2SV_ModStart> ref_index ] ; decrease_ref_count ( old_idx, frame_bufs, pool ) ; cm -> ref_frame_map [ ref_index ] = cm -> next_ref_frame_map [ ref_index ] ; } unlock_buffer_pool ( pool ) ; pbi -> hold_ref_buf
Buggy code:
 static int jpc_dec_tiledecode ( jpc_dec_t * dec, jpc_dec_tile_t * tile ) { int i ; int j ; jpc_dec_tcomp_t * tcomp ; jpc_dec_rlvl_t * rlvl ; jpc_dec_band_t * band ; int compno ; int rlvlno ; int bandno ; int adjust ; int v ; jpc_dec_ccp_t * ccp ; jpc_dec_cmpt_t * cmpt ; if ( jpc_dec_decodecblks ( dec, tile ) ) { jas_eprintf ( "jpc_dec_decodecblks   failed\\n" ) ; return - 1 ; } for ( compno = 0, tcomp = tile -> tcomps ; compno < dec -> numcomps ; ++ compno, ++ tcomp ) { ccp = & tile -> cp -> ccps [ compno ] ; for ( rlvlno = 0, rlvl = tcomp -> rlvls ; rlvlno < tcomp -> numrlvls ; ++ rlvlno, ++ rlvl ) { if (! rlvl -> bands ) { continue ; } for ( bandno = 0, band = rlvl -> bands ; bandno < rlvl -> numbands ; ++ bandno, ++ band ) { if (! band -> data ) { continue ; } jpc_undo_roi ( band -> data, band -> roishift, ccp -> roishift - band -> roishift, band -> numbps ) ; if ( tile -> realmode ) { jas_matrix_asl ( band -> data, JPC_FIX_FRACBITS ) ; jpc_dequantize ( band -> data, band -> absstepsize ) ; } } } } for ( compno = 0, tcomp = tile -> tcomps ; compno < dec -> numcomps ; ++ compno, ++ tcomp ) { ccp = & tile -> cp -> ccps [ compno ] ; jpc_tsfb_synthesize ( tcomp -> tsfb, tcomp -> data ) ; } switch ( tile -> cp -> mctid ) { case JPC_MCT_RCT : if ( dec -> numcomps < 3 ) { <START_BUG> jas_eprintf ( "R<END_BUG>

Fix:
<S2SV_ModStart> jas_eprintf ( "RCT <S2SV_blank> requires <S2SV_blank> at <S2SV_blank> least <S2SV_blank> three <S2SV_blank> components\\n" ) ; return - 1 ; } if (! jas_image_cmpt_domains_same ( dec -> image ) ) { jas_eprintf ( "RCT <S2SV_blank> requires <S2SV_blank> all <S2SV_blank> components <S2SV_blank> have <S2SV_blank> the <S2SV_blank> same <S2SV_blank> domain\\n" <S2SV_ModStart> 1 ; } if (! jas_image_cmpt_domains_same ( dec -> image ) ) { jas_eprintf ( "RCT <S2SV_blank> requires <S2SV_blank> all <S2SV_blank> components <S2SV_blank> have <S2SV_blank> the <S2SV_blank> same <S2SV_blank> domain\\n" ) ; return - 1 ; }
Buggy code:
 static guint32 parse_wbxml_tag_defined ( proto_tree * tree, tvbuff_t * tvb, guint32 offset, guint32 str_tbl, guint8 * level, guint8 * codepage_stag, guint8 * codepage_attr, const wbxml_decoding * map ) { guint32 tvb_len = tvb_reported_length ( tvb ) ; <START_BUG> guint32 off = offset ; <END_BUG> guint32 len ; guint str_len ; guint32 ent ; guint32 idx ; guint8 peek ; guint32 tag_len ; guint8 tag_save_known = 0 ; guint8 tag_new_known = 0 ; const char * tag_save_literal ; const char * tag_new_literal ; guint8 parsing_tag_content = FALSE ; tag_save_literal = NULL ;  DebugLog ( ( "parse_wbxml_tag_defined   (level   =   %u,   offset   =   %u)\\n", * level, offset ) ) ; <START_BUG> while ( off < tvb_len ) { peek = tvb_get_guint8 ( tvb, off ) ; DebugLog ( ( "STAG:   (top   of   while)   level   =   %3u,   peek   =   0x%02X,   off   =   %u,   tvb_len   =   %u\\n", * level, peek, off, tvb_len ) ) ; if ( ( peek & 0x3F ) < 4 ) switch ( peek ) { case 0x00 : * codepage_stag = tvb_get_guint8 ( tvb, off + 1 ) ; proto_tree_add_text ( tree, tvb, off, 2, "             |   Tag       |   T   -->%3d   " "|   SWITCH_PAGE   (Tag   code   page)           " "|", * codepage_stag ) ; off += 2 ; break ; case 0x01 : if ( tag_save_known ) { proto_tree_add_text ( tree, tvb, off, 1, "     %3d   |   Tag       |<END_BUG>

Fix:
<S2SV_ModStart> off = offset, last_off <S2SV_ModStart> offset ) ) ; last_off = off <S2SV_ModStart> ; } } if ( off < last_off ) { THROW ( ReportedBoundsError ) ; } last_off = off ;
Buggy code:
 static unsigned char * read_chunk ( struct mschm_decompressor_p * self, struct mschmd_header * chm, struct mspack_file * fh, unsigned int chunk_num ) { struct mspack_system * sys = self -> system ; unsigned char * buf ; <START_BUG> if ( chunk_num > chm -> num_chunks ) return NULL ; <END_BUG> if (! chm -> chunk_cache ) { size_t size = sizeof ( unsigned char * ) * chm -> num_chunks ; if (! ( chm -> chunk_cache = ( unsigned char * * ) sys -> alloc ( sys, size ) ) ) { self -> error = MSPACK_ERR_NOMEMORY ; return NULL ; } memset ( chm -> chunk_cache, 0, size ) ; } if ( chm -> chunk_cache [ chunk_num ] ) return chm -> chunk_cache [ chunk_num ] ; if (! ( buf = ( unsigned char * ) sys -> alloc ( sys, chm -> chunk_size ) ) ) { self -> error = MSPACK_ERR_NOMEMORY ; return NULL ; } if ( sys -> seek ( fh, ( off_t ) ( chm -> dir_offset + ( chunk_num * chm -> chunk_size ) ), MSPACK_SYS_SEEK_START ) ) { self -> error = MSPACK_ERR_SEEK ; sys -> free ( buf ) ; return NULL ; } if ( sys -> read ( fh, buf, ( int ) chm -> chunk_size )!= ( int ) chm -> chunk_size ) { self -> error = MSPACK_ERR_READ ; sys -> free ( buf ) ; return NULL ; } if (! ( ( buf [ 0 ] == 0x50 ) && ( buf [ 1 ] == 0x4D ) && ( buf [ 2 ] == 0x47 ) && ( ( buf [ 3 ] == 0x4C ) || ( buf [ 3 ] == 0x49 ) ) ) ) { self -> error = MSPACK_ERR_SEEK ; sys -> free ( buf ) ; return NULL ; } return chm -> chunk_cache [ chunk_num ] = buf ; }

Fix:
<S2SV_ModStart> if ( chunk_num >= <S2SV_ModEnd> chm -> num_chunks
Buggy code:
 int Util_handle0Escapes ( char * buf ) { int editpos ; int insertpos ; ASSERT ( buf ) ; for ( editpos = insertpos = 0 ; * ( buf + editpos )!= '\\0' ; editpos ++, insertpos ++ ) { if ( * ( buf + editpos ) == '\\\\' ) { switch ( * ( buf + editpos + 1 ) ) { case '0' : if ( * ( buf + editpos + 2 ) == 'x' ) { <START_BUG> * ( buf + insertpos ) = x2c ( & buf [ editpos + 3 ] ) ; <END_BUG> editpos += 4 ; } break ; default : * ( buf + insertpos ) = * ( buf + editpos ) ; } } else { * ( buf + insertpos ) = * ( buf + editpos ) ; } } * ( buf + insertpos ) = '\\0' ; return insertpos ; }

Fix:
<S2SV_ModStart> insertpos ) = _x2c <S2SV_ModEnd> ( & buf
Buggy code:
 generic_ret * rename_principal_2_svc ( rprinc_arg * arg, struct svc_req * rqstp ) { static generic_ret ret ; <START_BUG> char * prime_arg1, <END_BUG> * prime_arg2 ;  gss_buffer_desc client_name, <START_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; restriction_t * rp ; const char * errmsg = NULL ; size_t tlen1, tlen2, clen, slen ; char * tdots1, * tdots2, * cdots, * sdots ; xdr_free ( xdr_generic_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> src, & prime_arg1 ) || krb5_unparse_name ( handle -> context, arg -> dest, & prime_arg2 ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } tlen1 = strlen ( prime_arg1 ) ; trunc_name ( & tlen1, & tdots1 ) ; tlen2 = strlen ( prime_arg2 ) ; trunc_name ( & tlen2, & tdots2 ) ; clen = client_name. length ; trunc_name ( & clen, & cdots ) ; slen = service_name. length ; trunc_name ( & slen, & sdots ) ; ret. code = KADM5_OK ; if (! CHANGEPW_SERVICE ( rqstp ) ) { if (! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_DELETE, arg -> src, NULL ) ) ret. code = KADM5_AUTH_DELETE ; if (! kadm5int_acl_check ( handle -> context<END_BUG>

Fix:
<S2SV_ModStart> char * prime_arg1 = NULL, * prime_arg2 = NULL <S2SV_ModEnd> ; gss_buffer_desc client_name <S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : free ( prime_arg1 ) ; free ( prime_arg2 ) ; gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 void ipv4_pktinfo_prepare ( const struct sock * sk, struct sk_buff * skb ) { struct in_pktinfo * pktinfo = PKTINFO_SKB_CB ( skb ) ; bool prepare = ( inet_sk ( sk ) -> cmsg_flags & IP_CMSG_PKTINFO ) || ipv6_sk_rxinfo ( sk ) ; if ( prepare && skb_rtable ( skb ) ) { if ( pktinfo -> ipi_ifindex == LOOPBACK_IFINDEX ) pktinfo -> ipi_ifindex = inet_iif ( skb ) ; pktinfo -> ipi_spec_dst. s_addr = fib_compute_spec_dst ( skb ) ; } else { pktinfo -> ipi_ifindex = 0 ; pktinfo -> ipi_spec_dst. s_addr = 0 ; } <START_BUG> skb_dst_drop ( skb ) ; <END_BUG> }

Fix:
<S2SV_ModStart> 0 ; } if ( unlikely ( IPCB ( skb ) -> opt. optlen ) ) skb_dst_force ( skb ) ; else
Buggy code:
 static void bgp_packet_mpattr_tea ( struct bgp * bgp, struct peer * peer, struct stream * s, struct attr * attr, uint8_t attrtype ) { unsigned int attrlenfield = 0 ; unsigned int attrhdrlen = 0 ; struct bgp_attr_encap_subtlv * subtlvs ; struct bgp_attr_encap_subtlv * st ; const char * attrname ; if (! attr || ( attrtype == BGP_ATTR_ENCAP && (! attr -> encap_tunneltype || attr -> encap_tunneltype == BGP_ENCAP_TYPE_MPLS ) ) ) return ; switch ( attrtype ) { case BGP_ATTR_ENCAP : attrname = "Tunnel   Encap" ; subtlvs = attr -> encap_subtlvs ; if ( subtlvs == NULL ) return ; attrlenfield = 2 + 2 ; attrhdrlen = 1 + 1 ; break ; <START_BUG> # if ENABLE_BGP_VNC <END_BUG> case BGP_ATTR_VNC : attrname = "VNC" ; subtlvs = attr -> vnc_subtlvs ; if ( subtlvs == NULL ) return ; attrlenfield = 0 ; attrhdrlen = 2 + 2 ; break ; # endif default : assert ( 0 ) ; } for ( st = subtlvs ; st ; st = st -> next ) { attrlenfield += ( attrhdrlen + st -> length ) ; } if ( attrlenfield > 0xffff ) { zlog_info ( "%s   attribute   is   too   long   (length=%d),   can\'t   send   it", attrname, attrlenfield ) ; return ; } if ( attrlenfield > 0xff ) { stream_putc ( s, BGP_ATTR_FLAG_TRANS | BGP_ATTR_FLAG_OPTIONAL | BGP_ATTR_FLAG_EXTLEN ) ; stream_putc ( s, attrtype ) ; stream_putw ( s, attrlenfield & 0xffff ) ; } else { stream_putc ( s, BGP_ATTR_FLAG_TRANS | BGP_ATTR_FLAG_OPTIONAL ) ; stream_putc ( s, attrtype ) ; stream_putc ( s, attrlenfield & 0xff ) ; } if ( attrtype ==

Fix:
<S2SV_ModStart> ; # if ENABLE_BGP_VNC_ATTR <S2SV_ModEnd> case BGP_ATTR_VNC :
Buggy code:
 static int userfaultfd_unregister ( struct userfaultfd_ctx * ctx, unsigned long arg ) { struct mm_struct * mm = ctx -> mm ; struct vm_area_struct * vma, * prev, * cur ; int ret ; struct uffdio_range uffdio_unregister ; unsigned long new_flags ; bool found ; unsigned long start, end, vma_end ; const void __user * buf = ( void __user * ) arg ; ret = - EFAULT ; if ( copy_from_user ( & uffdio_unregister, buf, sizeof ( uffdio_unregister ) ) ) goto out ; ret = validate_range ( mm, uffdio_unregister. start, uffdio_unregister. len ) ; if ( ret ) goto out ; start = uffdio_unregister. start ; end = start + uffdio_unregister. len ; ret = - ENOMEM ; if (! mmget_not_zero ( mm ) ) goto out ; down_write ( & mm -> mmap_sem ) ; vma = find_vma_prev ( mm, start, & prev ) ; if (! vma ) goto out_unlock ; ret = - EINVAL ; if ( vma -> vm_start >= end ) goto out_unlock ; if ( is_vm_hugetlb_page ( vma ) ) { unsigned long vma_hpagesize = vma_kernel_pagesize ( vma ) ; if ( start & ( vma_hpagesize - 1 ) ) goto out_unlock ; } found = false ; ret = - EINVAL ; for ( cur = vma ; cur && cur -> vm_start < end ; cur = cur -> vm_next ) { cond_resched ( ) ; BUG_ON (!! cur -> vm_userfaultfd_ctx. ctx ^!! ( cur -> vm_flags & ( VM_UFFD_MISSING | VM_UFFD_WP ) ) ) ; if (! vma_can_userfault ( cur ) ) goto out_unlock ; found = true ; } BUG_ON (! found ) ; if ( vma -> vm_start < start ) prev = vma ; ret = 0 ; do { cond_resched ( ) ;

Fix:
<S2SV_ModStart> ) ) ; WARN_ON (! ( vma -> vm_flags & VM_MAYWRITE ) ) ;
Buggy code:
 tdata_t _TIFFmalloc ( tsize_t s ) <START_BUG> { <END_BUG> return ( malloc ( ( size_t ) s ) ) ; }

Fix:
<S2SV_ModStart> s ) { if ( s == 0 ) return ( ( void * ) NULL ) ;
Buggy code:
 static ssize_t pipe_read ( struct kiocb * iocb, const struct iovec * _iov, unsigned long nr_segs, loff_t pos ) { struct file * filp = iocb -> ki_filp ; struct pipe_inode_info * pipe = filp -> private_data ; int do_wakeup ; ssize_t ret ; struct iovec * iov = ( struct iovec * ) _iov ; size_t total_len ; <START_BUG> total_len = iov_length ( iov, nr_segs ) ; <END_BUG> if ( unlikely ( total_len == 0 ) )  return 0 ; <START_BUG> do_wakeup = 0 ; ret = 0 ; __pipe_lock ( pipe ) ; for ( ; ; ) { int bufs = pipe -> nrbufs ; if ( bufs ) { int curbuf = pipe -> curbuf ; struct pipe_buffer * buf = pipe -> bufs + curbuf ; const struct pipe_buf_operations * ops = buf -> ops ; <END_BUG> void * addr ;  <START_BUG> size_t chars = buf -> len ; <END_BUG>  int error, atomic ; <START_BUG> if ( chars > total_len ) chars = total_len ; error = ops -> confirm ( pipe, buf ) ; if ( error ) { if (! ret ) ret = error ; break ; } <END_BUG> atomic =! iov_fault_in_pages_write ( iov, chars ) ;  redo : if ( atomic ) addr = kmap_atomic ( buf -> page ) ; else addr = kmap ( buf -> page ) ; error = pipe_iov_copy_to_user ( iov, addr + buf -> offset, chars, atomic ) ; if ( atomic ) kunmap_atomic ( addr ) ; else kunmap ( buf -> page ) ; if ( unlikely ( error ) ) { if ( atomic ) { atomic = 0 ; goto redo ; } if (! ret ) ret = error ; break ; } ret += chars ; buf -> offset += chars ; buf -> len -= chars ; if ( buf -> flags & PIPE_BUF_FLAG_PACKET ) { total_len = chars ; buf -> len = 0 ; } if (! buf -> len ) { buf -> ops = NULL ; ops -> release ( pipe, buf ) ; curbuf = ( curbuf + 1 )

Fix:
<S2SV_ModStart> size_t total_len ; struct iov_iter iter ; <S2SV_ModStart> ) return 0 ; iov_iter_init ( & iter, iov, nr_segs, total_len, 0 ) <S2SV_ModStart> -> ops ; <S2SV_ModEnd> size_t chars = <S2SV_ModStart> buf -> len ; size_t written <S2SV_ModStart> ; int error <S2SV_ModEnd> ; if ( <S2SV_ModStart> break ; } written = copy_page_to_iter ( buf -> page, buf -> offset, chars, & iter ) ; if ( unlikely ( written < chars ) ) { if (! ret ) ret = - EFAULT <S2SV_ModEnd> ; break ;
Buggy code:
 Datum path_in ( PG_FUNCTION_ARGS ) { char * str = PG_GETARG_CSTRING ( 0 ) ; PATH * path ; int isopen ; char * s ; int npts ; <START_BUG> int size ; <END_BUG> int depth = 0 ; if ( ( npts = pair_count ( str, ',' ) ) <= 0 ) ereport ( ERROR, ( errcode ( ERRCODE_INVALID_TEXT_REPRESENTATION ), errmsg ( "invalid   input   syntax   for   type   path:   \\"%s\\"", str ) ) ) ; s = str ; while ( isspace ( ( unsigned char ) * s ) ) s ++ ; if ( ( * s == LDELIM ) && ( strrchr ( s, LDELIM ) == s ) ) { s ++ ; depth ++ ; }  size = offsetof ( PATH, p [ 0 ] ) + sizeof ( path -> p [ 0 ] ) * npts ; <START_BUG> path = ( PATH * ) palloc ( size ) ; SET_VARSIZE ( path, size ) ; path -> npts = npts ; if ( (! path_decode ( TRUE, npts, s, & isopen, & s, & ( path -> p [ 0 ] ) ) ) && (! ( ( depth == 0 ) && ( * s == '\\0' ) ) ) &&! ( ( depth >= 1 ) && ( * s == RDELIM ) ) ) ereport ( ERROR, ( errcode ( ERRCODE_INVALID_TEXT_REPRESENTATION ), errmsg ( "invalid   input   syntax   for   type   path:   \\"%s\\"", str ) ) ) ; path -> closed = (! isopen ) ; path -> dummy = 0 ; PG_RETURN_PATH_P ( path ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; int size ; int base_size <S2SV_ModStart> ++ ; } base_size = sizeof ( path -> <S2SV_ModEnd> p [ 0 <S2SV_ModStart> 0 ] ) * npts ; size = offsetof ( PATH, <S2SV_ModEnd> p [ 0 <S2SV_ModStart> 0 ] ) + base_size ; if ( base_size // npts!= sizeof ( path -> p [ 0 ] ) || size <= base_size ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "too <S2SV_blank> many <S2SV_blank> points <S2SV_blank> requested" ) ) ) <S2SV_ModEnd> ; path =
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * frame ) { AVFilterContext * ctx = inlink -> dst ; const AVPixFmtDescriptor * desc = av_pix_fmt_desc_get ( inlink -> format ) ; uint32_t plane_checksum [ 4 ] = { 0 }, checksum = 0 ; int i, plane, vsub = desc -> log2_chroma_h ; <START_BUG> for ( plane = 0 ; plane < 4 && frame -> data [ plane ] ; plane ++ ) { <END_BUG> int64_t linesize = av_image_get_linesize ( frame -> format, frame -> width, plane ) ; uint8_t * data = frame -> data [ plane ] ; int h = plane == 1 || plane == 2? FF_CEIL_RSHIFT ( inlink -> h, vsub ) : inlink -> h ; if ( linesize < 0 ) return linesize ; for ( i = 0 ; i < h ; i ++ ) { plane_checksum [ plane ] = av_adler32_update ( plane_checksum [ plane ], data, linesize ) ; checksum = av_adler32_update ( checksum, data, linesize ) ; data += frame -> linesize [ plane ] ; } } av_log ( ctx, AV_LOG_INFO, "n:%" PRId64 "   pts:%s   pts_time:%s   pos:%" PRId64 "   " "fmt:%s   sar:%d//%d   s:%dx%d   i:%c   iskey:%d   type:%c   " "checksum:%08X   plane_checksum:[%08X", inlink -> frame_count, av_ts2str ( frame -> pts ), av_ts2timestr ( frame -> pts, & inlink -> time_base ), av_frame_get_pkt_pos ( frame ), desc -> name, frame -> sample_aspect_ratio. num, frame -> sample_aspect_ratio. den, frame -> width, frame -> height,! frame -> interlaced_frame? 'P' : frame -> top_field_first? 'T' : 'B', frame -> key_frame, av_get_picture_type_char ( frame -> pict_type ), checksum, plane_checksum [ 0 ] ) ;

Fix:
<S2SV_ModStart> frame -> data [ plane ] && frame -> linesize <S2SV_ModStart> [ plane ] && frame -> linesize [ plane ]
Buggy code:
 int bzrtp_packetParser ( bzrtpContext_t * zrtpContext, bzrtpChannelContext_t * zrtpChannelContext, const uint8_t * input, uint16_t inputLength, bzrtpPacket_t * zrtpPacket ) { int i ; uint8_t * messageContent = ( uint8_t * ) ( input + ZRTP_PACKET_HEADER_LENGTH + ZRTP_MESSAGE_HEADER_LENGTH ) ; switch ( zrtpPacket -> messageType ) { case MSGTYPE_HELLO : { bzrtpHelloMessage_t * messageData ; messageData = ( bzrtpHelloMessage_t * ) malloc ( sizeof ( bzrtpHelloMessage_t ) ) ; memcpy ( messageData -> version, messageContent, 4 ) ; messageContent += 4 ; memcpy ( messageData -> clientIdentifier, messageContent, 16 ) ; messageContent += 16 ; memcpy ( messageData -> H3, messageContent, 32 ) ; messageContent += 32 ; memcpy ( messageData -> ZID, messageContent, 12 ) ; messageContent += 12 ; messageData -> S = ( ( * messageContent ) >> 6 ) & 0x01 ; messageData -> M = ( ( * messageContent ) >> 5 ) & 0x01 ; messageData -> P = ( ( * messageContent ) >> 4 ) & 0x01 ; messageContent += 1 ; messageData -> hc = MIN ( ( * messageContent ) & 0x0F, 7 ) ; messageContent += 1 ; messageData -> cc = MIN ( ( ( * messageContent ) >> 4 ) & 0x0F, 7 ) ; messageData -> ac = MIN ( ( * messageContent ) & 0x0F, 7 ) ; messageContent += 1 ; messageData -> kc = MIN ( ( ( * messageContent ) >> 4 ) & 0x0F, 7 ) ; messageData -> sc = MIN ( ( * messageContent ) & 0x0F, 7 ) ; messageContent += 1 ; if ( zrtpPacket -> messageLength!= ZRTP_HELLOMESSAGE_FIXED_LENGTH + 4 * ( ( uint16_t ) ( messageData -> hc ) + ( uint16_t ) ( messageData -> cc ) + ( uint16_t ) ( messageData -> ac ) + ( uint16_t ) (

Fix:
<S2SV_ModStart> BZRTP_PARSER_ERROR_UNMATCHINGMAC ; } { uint8_t computedHvi [ 32 ] ; uint16_t HelloMessageLength = zrtpChannelContext -> selfPackets [ HELLO_MESSAGE_STORE_ID ] -> messageLength ; uint16_t DHPartHelloMessageStringLength = zrtpPacket -> messageLength + HelloMessageLength ; uint8_t * DHPartHelloMessageString = ( uint8_t * ) malloc ( DHPartHelloMessageStringLength * sizeof ( uint8_t ) ) ; memcpy ( DHPartHelloMessageString, input + ZRTP_PACKET_HEADER_LENGTH, zrtpPacket -> messageLength ) ; memcpy ( DHPartHelloMessageString + zrtpPacket -> messageLength, zrtpChannelContext -> selfPackets [ HELLO_MESSAGE_STORE_ID ] -> packetString + ZRTP_PACKET_HEADER_LENGTH, HelloMessageLength ) ; zrtpChannelContext -> hashFunction ( DHPartHelloMessageString, DHPartHelloMessageStringLength, 32, computedHvi ) ; free ( DHPartHelloMessageString ) ; if ( memcmp ( computedHvi, peer
Buggy code:
 void vp8dx_bool_decoder_fill ( BOOL_DECODER * br ) { const unsigned char * bufptr = br -> user_buffer ; VP8_BD_VALUE value = br -> value ; int count = br -> count ; <START_BUG> int shift = VP8_BD_VALUE_SIZE - 8 - ( count + 8 ) ; <END_BUG> size_t bytes_left = br -> user_buffer_end - bufptr ; size_t bits_left = bytes_left * CHAR_BIT ; int x = ( int ) ( shift + CHAR_BIT - bits_left ) ; int loop_end = 0 ; unsigned char decrypted [ sizeof ( VP8_BD_VALUE ) + 1 ] ; if ( br -> decrypt_cb ) {  size_t n = bytes_left > sizeof ( decrypted )? sizeof ( decrypted ) : bytes_left ; <START_BUG> br -> decrypt_cb ( br -> decrypt_state, bufptr, decrypted, ( int ) n ) ; bufptr = decrypted ; } if ( x >= 0 ) { count += VP8_LOTS_OF_BITS ; loop_end = x ; } if ( x < 0 || bits_left ) { while ( shift >= loop_end ) { count += CHAR_BIT ; value |= ( VP8_BD_VALUE ) * bufptr << shift ; ++ bufptr ; ++ br -> user_buffer ; shift -= CHAR_BIT ; } } br -> value = value ; br -> count = count ; }<END_BUG>

Fix:
<S2SV_ModStart> = VP8_BD_VALUE_SIZE - CHAR_BIT <S2SV_ModEnd> - ( count <S2SV_ModStart> ( count + CHAR_BIT <S2SV_ModEnd> ) ; size_t <S2SV_ModStart> size_t n = MIN ( sizeof ( decrypted ), bytes_left ) <S2SV_ModEnd> ; br ->
Buggy code:
 static inline int check_entry_size_and_hooks ( struct arpt_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct arpt_entry )!= 0 || ( unsigned char * ) e + sizeof ( struct arpt_entry ) >= limit || ( unsigned char * ) e + e -> next_offset > limit ) { duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct arpt_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } err = check_entry ( e ) ; if ( err ) return err ; for ( h = 0 ; h < NF_ARP_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { <START_BUG> pr_err ( "Underflows   must   be   unconditional   and   " <END_BUG> "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart> ) ) { pr_debug <S2SV_ModEnd> ( "Underflows <S2SV_blank> must <S2SV_blank> be <S2SV_blank> unconditional <S2SV_blank> and <S2SV_blank> " "use <S2SV_blank> the <S2SV_blank> STANDARD <S2SV_blank> target <S2SV_blank> with <S2SV_blank> "
Buggy code:
 static void * listen_fn_ ( UNUSED_ATTR void * context ) { prctl ( PR_SET_NAME, ( unsigned long ) LISTEN_THREAD_NAME_, 0, 0, 0 ) ; listen_socket_ = socket ( AF_INET, SOCK_STREAM, IPPROTO_TCP ) ; if ( listen_socket_ == - 1 ) { LOG_ERROR ( "%s   socket   creation   failed:   %s", __func__, strerror ( errno ) ) ; goto cleanup ; } int enable = 1 ; if ( setsockopt ( listen_socket_, SOL_SOCKET, SO_REUSEADDR, & enable, sizeof ( enable ) ) == - 1 ) { LOG_ERROR ( "%s   unable   to   set   SO_REUSEADDR:   %s", __func__, strerror ( errno ) ) ; goto cleanup ; } struct sockaddr_in addr ; addr. sin_family = AF_INET ; addr. sin_addr. s_addr = htonl ( LOCALHOST_ ) ; addr. sin_port = htons ( LISTEN_PORT_ ) ; if ( bind ( listen_socket_, ( struct sockaddr * ) & addr, sizeof ( addr ) ) == - 1 ) { LOG_ERROR ( "%s   unable   to   bind   listen   socket:   %s", __func__, strerror ( errno ) ) ; goto cleanup ; } if ( listen ( listen_socket_, 10 ) == - 1 ) { LOG_ERROR ( "%s   unable   to   listen:   %s", __func__, strerror ( errno ) ) ; goto cleanup ; } for ( ; ; ) { <START_BUG> int client_socket = accept ( listen_socket_, NULL, NULL ) ; <END_BUG> if ( client_socket == - 1 ) { if ( errno == EINVAL || errno == EBADF ) { break ; } LOG_WARN ( "%s   error   accepting   socket:   %s", __func__, strerror ( errno ) ) ; continue ; } pthread_mutex_lock ( & client_socket_lock_ ) ; safe_close_ ( & client_socket_ ) ; client_socket_ = client_socket ;  send ( client_socket_, "btsnoop\\0\\0\\0\\0\\1\\0\\0\\

Fix:
<S2SV_ModStart> int client_socket = TEMP_FAILURE_RETRY ( <S2SV_ModStart> NULL, NULL ) <S2SV_ModStart> = client_socket ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> 16, 0 )
Buggy code:
 static void * gp_worker_main ( void * pvt ) { struct gp_thread * t = ( struct gp_thread * ) pvt ; struct gp_query * q = NULL ; char dummy = 0 ; int ret ; while (! t -> pool -> shutdown ) { gp_debug_set_conn_id ( 0 ) ; pthread_mutex_lock ( & t -> cond_mutex ) ; while ( t -> query == NULL ) { pthread_cond_wait ( & t -> cond_wakeup, & t -> cond_mutex ) ; <START_BUG> if ( t -> pool -> shutdown ) { <END_BUG> pthread_exit ( NULL ) ; } } q = t -> query ; t -> query = NULL ; pthread_mutex_unlock ( & t -> cond_mutex ) ; gp_debug_set_conn_id ( gp_conn_get_cid ( q -> conn ) ) ; GPDEBUGN ( 3, "[status]   Handling   query   input:   %p   (%zu)\\n", q -> buffer, q -> buflen ) ; gp_handle_query ( t -> pool, q ) ; GPDEBUGN ( 3, "[status]   Handling   query   output:   %p   (%zu)\\n", q -> buffer, q -> buflen ) ; pthread_mutex_lock ( & t -> pool -> lock ) ; q -> next = t -> pool -> reply_list ; t -> pool -> reply_list = q ; if (! t -> pool -> shutdown ) { LIST_DEL ( t -> pool -> busy_list, t ) ; LIST_ADD ( t -> pool -> free_list, t ) ; } pthread_mutex_unlock ( & t -> pool -> lock ) ; ret = write ( t -> pool -> sig_pipe [ 1 ], & dummy, 1 ) ; if ( ret == - 1 ) { GPERROR ( "Failed   to   signal   dispatcher!" ) ; } } pthread_exit ( NULL ) ; }

Fix:
<S2SV_ModStart> shutdown ) { pthread_mutex_unlock ( & t -> cond_mutex ) ;
Buggy code:
 void snd_usb_mixer_disconnect ( struct usb_mixer_interface * mixer ) { <START_BUG> usb_kill_urb ( mixer -> urb ) ; <END_BUG> usb_kill_urb ( mixer -> rc_urb ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> mixer ) { if ( mixer -> disconnected ) return ; if ( mixer -> urb ) <S2SV_ModStart> urb ) ; if ( mixer -> rc_urb ) <S2SV_ModStart> rc_urb ) ; mixer -> disconnected = true ;
Buggy code:
 void ih264d_init_decoder ( void * ps_dec_params ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ps_dec_params ; dec_slice_params_t * ps_cur_slice ; pocstruct_t * ps_prev_poc, * ps_cur_poc ; WORD32 size ; size = sizeof ( pred_info_t ) * 2 * 32 ; memset ( ps_dec -> ps_pred, 0, size ) ; size = sizeof ( disp_mgr_t ) ; memset ( ps_dec -> pv_disp_buf_mgr, 0, size ) ; size = sizeof ( buf_mgr_t ) + ithread_get_mutex_lock_size ( ) ; memset ( ps_dec -> pv_pic_buf_mgr, 0, size ) ; size = sizeof ( dec_err_status_t ) ; memset ( ps_dec -> ps_dec_err_status, 0, size ) ; size = sizeof ( sei ) ; memset ( ps_dec -> ps_sei, 0, size ) ; size = sizeof ( dpb_commands_t ) ; memset ( ps_dec -> ps_dpb_cmds, 0, size ) ; size = sizeof ( dec_bit_stream_t ) ; memset ( ps_dec -> ps_bitstrm, 0, size ) ; size = sizeof ( dec_slice_params_t ) ; memset ( ps_dec -> ps_cur_slice, 0, size ) ; size = MAX ( sizeof ( dec_seq_params_t ), sizeof ( dec_pic_params_t ) ) ; memset ( ps_dec -> pv_scratch_sps_pps, 0, size ) ; size = sizeof ( ctxt_inc_mb_info_t ) ; memset ( ps_dec -> ps_left_mb_ctxt_info, 0, size ) ; size = ( sizeof ( neighbouradd_t ) << 2 ) ; memset ( ps_dec -> ps_left_mvpred_addr, 0, size ) ; size = sizeof ( buf_mgr_t ) + ithread_get_mutex_lock_size ( ) ; memset ( ps_dec -> pv_mv_buf_mgr, 0, size ) ; ih264

Fix:
<S2SV_ModStart> ) ) ; memset ( ps_dec -> ps_cur_slice, 0, sizeof ( dec_slice_params_t ) ) ;
Buggy code:
 static u_int ieee802_11_print ( netdissect_options * ndo, const u_char * p, u_int length, u_int orig_caplen, int pad, u_int fcslen ) { uint16_t fc ; u_int caplen, hdrlen, meshdrlen ; struct lladdr_info src, dst ; int llc_hdrlen ; caplen = orig_caplen ; if ( length < fcslen ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return caplen ; } length -= fcslen ; if ( caplen > length ) { fcslen = caplen - length ; caplen -= fcslen ; ndo -> ndo_snapend -= fcslen ; } if ( caplen < IEEE802_11_FC_LEN ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return orig_caplen ; } fc = EXTRACT_LE_16BITS ( p ) ; hdrlen = extract_header_length ( ndo, fc ) ; if ( hdrlen == 0 ) { return ( 0 ) ; } if ( pad ) hdrlen = roundup2 ( hdrlen, 4 ) ; if ( ndo -> ndo_Hflag && FC_TYPE ( fc ) == T_DATA && DATA_FRAME_IS_QOS ( FC_SUBTYPE ( fc ) ) ) { <START_BUG> meshdrlen = extract_mesh_header_length ( p + hdrlen ) ; <END_BUG> hdrlen += meshdrlen ; } else meshdrlen = 0 ; if ( caplen < hdrlen ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return hdrlen ; } if ( ndo -> ndo_eflag ) ieee_802_11_hdr_print ( ndo, fc, p, hdrlen, meshdrlen ) ; length -= hdrlen ; caplen -= hdrlen ; p += hdrlen ; src. addr_string = etheraddr_string ; dst. addr_string = etheraddr_string ; switch ( FC_TYPE ( fc ) ) { case T_MGMT : get_mgmt_src_dst_mac

Fix:
<S2SV_ModStart> ) ) { if ( caplen < hdrlen + 1 ) { ND_PRINT ( ( ndo, "%s", tstr ) ) ; return hdrlen ; }
Buggy code:
 static noinline int create_pending_snapshot ( struct btrfs_trans_handle * trans, struct btrfs_fs_info * fs_info, struct btrfs_pending_snapshot * pending ) { struct btrfs_key key ; struct btrfs_root_item * new_root_item ; struct btrfs_root * tree_root = fs_info -> tree_root ; struct btrfs_root * root = pending -> root ; struct btrfs_root * parent_root ; struct btrfs_block_rsv * rsv ; struct inode * parent_inode ; struct btrfs_path * path ; struct btrfs_dir_item * dir_item ; struct dentry * parent ; struct dentry * dentry ; struct extent_buffer * tmp ; struct extent_buffer * old ; struct timespec cur_time = CURRENT_TIME ; int ret ; u64 to_reserve = 0 ; u64 index = 0 ; u64 objectid ; u64 root_flags ; uuid_le new_uuid ; path = btrfs_alloc_path ( ) ; if (! path ) { ret = pending -> error = - ENOMEM ; goto path_alloc_fail ; } new_root_item = kmalloc ( sizeof ( * new_root_item ), GFP_NOFS ) ; if (! new_root_item ) { ret = pending -> error = - ENOMEM ; goto root_item_alloc_fail ; } ret = btrfs_find_free_objectid ( tree_root, & objectid ) ; if ( ret ) { pending -> error = ret ; goto no_free_objectid ; } btrfs_reloc_pre_snapshot ( trans, pending, & to_reserve ) ; if ( to_reserve > 0 ) { ret = btrfs_block_rsv_add ( root, & pending -> block_rsv, to_reserve, BTRFS_RESERVE_NO_FLUSH ) ; if ( ret ) { pending -> error = ret ; goto no_free_objectid ; } } ret = btrfs_qgroup_inherit ( trans, fs_info, root -> root_key. objectid, objectid, pending -> inherit ) ; if ( ret ) { pending -> error = ret ; goto

Fix:
<S2SV_ModStart> == - EEXIST || ret == - EOVERFLOW
Buggy code:
 static void hub_activate ( struct usb_hub * hub, enum hub_activation_type type ) { struct usb_device * hdev = hub -> hdev ; struct usb_hcd * hcd ; int ret ; int port1 ; int status ; bool need_debounce_delay = false ; unsigned delay ; <START_BUG> if ( type == HUB_INIT2 ) <END_BUG> goto init2 ;  if ( type == HUB_INIT3 ) <START_BUG> goto init3 ; if ( type!= HUB_RESUME ) { if ( hdev -> parent && hub_is_superspeed ( hdev ) ) { ret = usb_control_msg ( hdev, usb_sndctrlpipe ( hdev, 0 ), HUB_SET_DEPTH, USB_RT_HUB, hdev -> level - 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT ) ; if ( ret < 0 ) dev_err ( hub -> intfdev, "set   hub   depth   failed\\n" ) ; } if ( type == HUB_INIT ) { delay = hub_power_on_good_delay ( hub ) ; hub_power_on ( hub, false ) ; INIT_DELAYED_WORK ( & hub -> init_work, hub_init_func2 ) ; queue_delayed_work ( system_power_efficient_wq, & hub -> init_work, msecs_to_jiffies ( delay ) ) ; usb_autopm_get_interface_no_resume ( to_usb_interface ( hub -> intfdev ) ) ; return ; } else if ( type == HUB_RESET_RESUME ) { hcd = bus_to_hcd ( hdev -> bus ) ; if ( hcd -> driver -> update_hub_device ) { ret = hcd -> driver -> update_hub_device ( hcd, hdev, & hub -> tt, GFP_NOIO ) ; if ( ret < 0 ) { dev_err ( hub -> intfdev, "Host   not   " "accepting   hub   info   " "update.\\n" ) ; dev_err ( hub -> intfdev, "LS//FS   devices   " "and   hubs   may   not   work   " "under   this   hub\\n." ) ; } } hub<END_BUG>

Fix:
<S2SV_ModStart> type == HUB_INIT2 || type == HUB_INIT3 ) { device_lock ( hub -> intfdev ) ; if ( hub -> disconnected ) { device_unlock ( hub -> intfdev ) ; kref_put ( & hub -> kref, hub_release ) ; return ; } if ( type == HUB_INIT2 <S2SV_ModStart> goto init2 ; goto init3 ; } kref_get ( & hub -> kref ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) ; device_unlock ( hub -> intfdev ) ; <S2SV_ModStart> ) ) ; if ( type == HUB_INIT2 || type == HUB_INIT3 ) device_unlock ( hub -> intfdev ) ; kref_put ( & hub -> kref, hub_release ) ;