nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int rawv6_sendmsg ( struct sock * sk, struct msghdr * msg, size_t len ) <START_BUG> { <END_BUG> struct ipv6_txoptions opt_space ; DECLARE_SOCKADDR ( struct sockaddr_in6 *, sin6, msg -> msg_name ) ; struct in6_addr * daddr, * final_p, final ; struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct raw6_sock * rp = raw6_sk ( sk ) ; struct ipv6_txoptions * opt = NULL ; struct ip6_flowlabel * flowlabel = NULL ; struct dst_entry * dst = NULL ; struct raw6_frag_vec rfv ; struct flowi6 fl6 ; int addr_len = msg -> msg_namelen ; int hlimit = - 1 ; int tclass = - 1 ; int dontfrag = - 1 ; u16 proto ; int err ; if ( len > INT_MAX ) return - EMSGSIZE ; if ( msg -> msg_flags & MSG_OOB ) return - EOPNOTSUPP ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; fl6. flowi6_mark = sk -> sk_mark ; if ( sin6 ) { if ( addr_len < SIN6_LEN_RFC2133 ) return - EINVAL ; if ( sin6 -> sin6_family && sin6 -> sin6_family!= AF_INET6 ) return - EAFNOSUPPORT ; proto = ntohs ( sin6 -> sin6_port ) ; if (! proto ) proto = inet -> inet_num ; else if ( proto!= inet -> inet_num ) return - EINVAL ; if ( proto > 255 ) return - EINVAL ; daddr = & sin6 -> sin6_addr ; if ( np -> sndflow ) { fl6. flowlabel = sin6 -> sin6_flowinfo & IPV6_FLOWINFO_MASK ; if ( fl6. flowlabel & IPV6_FLOWLABEL_MASK ) { flowlabel = fl6_sock_lookup ( sk, fl6. flowlabel ) ; if (! flowlabel ) return - EINVAL ; } } if ( sk -> sk_state == TCP_ESTABLISHED

Fix:
<S2SV_ModStart> len ) { struct ipv6_txoptions * opt_to_free = NULL ; <S2SV_ModStart>! opt ) { opt = txopt_get ( np ) ; opt_to_free = opt ; } <S2SV_ModEnd> if ( flowlabel <S2SV_ModStart> flowlabel ) ; txopt_put ( opt_to_free ) ;
Buggy code:
 void bandwidth_pid ( pid_t pid, const char * command, const char * dev, int down, int up ) { EUID_ASSERT ( ) ; EUID_ROOT ( ) ; char * comm = pid_proc_comm ( pid ) ; EUID_USER ( ) ; if (! comm ) { fprintf ( stderr, "Error:   cannot   find   sandbox\\n" ) ; exit ( 1 ) ; } if ( strcmp ( comm, "firejail" )!= 0 ) { fprintf ( stderr, "Error:   cannot   find   sandbox\\n" ) ; exit ( 1 ) ; } free ( comm ) ; char * name ; if ( asprintf ( & name, "//run//firejail//network//%d-netmap", pid ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( name, & s ) == - 1 ) { fprintf ( stderr, "Error:   the   sandbox   doesn\'t   use   a   new   network   namespace\\n" ) ; exit ( 1 ) ; } pid_t child ; if ( find_child ( pid, & child ) == - 1 ) { fprintf ( stderr, "Error:   cannot   join   the   network   namespace\\n" ) ; exit ( 1 ) ; } EUID_ROOT ( ) ; if ( join_namespace ( child, "net" ) ) { fprintf ( stderr, "Error:   cannot   join   the   network   namespace\\n" ) ; exit ( 1 ) ; } if ( strcmp ( command, "set" ) == 0 ) bandwidth_set ( pid, dev, down, up ) ; else if ( strcmp ( command, "clear" ) == 0 ) bandwidth_remove ( pid, dev ) ; char * devname = NULL ; if ( dev ) { char * fname ; if ( asprintf ( & fname, "%s//%d-netmap", RUN_FIREJAIL_NETWORK_DIR, ( int ) pid ) == - 1 ) errExit ( "asprintf" ) ; FILE * fp = fopen ( fname, "r" ) ; if (! fp ) { fprintf ( stderr, "Error:   cannot   read   network   map   file   %s\\n", fname ) ; exit ( 1 ) ; } char buf [ 1024

Fix:
<S2SV_ModStart> "setregid" ) ; <S2SV_ModEnd> char * arg <S2SV_ModStart> 0 ] = "//bin//sh" <S2SV_ModEnd> ; arg [
Buggy code:
 struct tcp_sock_t * tcp_open ( uint16_t port ) { struct tcp_sock_t * this = calloc ( 1, sizeof * this ) ; if ( this == NULL ) { <START_BUG> ERR ( "callocing   this   failed" ) ; <END_BUG> goto error ; } this -> sd = - 1 ;  this -> sd = socket ( AF_INET6, SOCK_STREAM, 0 ) ; <START_BUG> if ( this -> sd < 0 ) { <END_BUG> ERR ( "sockect   open   failed" ) ;  goto error ; } struct sockaddr_in6 addr ; memset ( & addr, 0, sizeof addr ) ; <START_BUG> addr. sin6_family = AF_INET6 ; <END_BUG> addr. sin6_port = htons ( port ) ;  addr. sin6_addr = in6addr_any ; <START_BUG> if ( bind ( this -> sd, ( struct sockaddr * ) & addr, sizeof addr ) < 0 ) { if ( g_options. only_desired_port == 1 ) <END_BUG> ERR ( "Bind   on   port   failed.   "  "Requested   port   may   be   taken   or   require   root   permissions." ) ; goto error ; } if ( listen ( this -> sd, HTTP_MAX_PENDING_CONNS ) < 0 ) { <START_BUG> ERR ( "listen   failed   on   socket" ) ; <END_BUG> goto error ; } return this ; error : if ( this!= NULL ) { if ( this -> sd!= - 1 ) { close ( this -> sd ) ; } free ( this ) ; } return NULL ; }

Fix:
<S2SV_ModStart> { ERR ( "IPv4: <S2SV_blank> callocing <S2SV_blank> this <S2SV_blank> failed" <S2SV_ModEnd> ) ; goto <S2SV_ModStart> = socket ( AF_INET <S2SV_ModEnd>, SOCK_STREAM, <S2SV_ModStart> { ERR ( "IPv4 <S2SV_blank> socket <S2SV_blank> open <S2SV_blank> failed" ) ; goto error ; } struct sockaddr_in <S2SV_ModEnd> addr ; memset <S2SV_ModStart> ; addr. sin_family = AF_INET ; addr. sin_port <S2SV_ModEnd> = htons ( <S2SV_ModStart> ; addr. sin_addr. s_addr = htonl ( 0x7F000001 ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ERR ( "IPv4 <S2SV_blank> bind <S2SV_blank> on <S2SV_blank> port <S2SV_blank> failed. <S2SV_blank> " <S2SV_ModEnd> "Requested <S2SV_blank> port <S2SV_blank> may <S2SV_blank> be <S2SV_blank> taken <S2SV_blank> or <S2SV_blank> require <S2SV_blank> root <S2SV_blank> permissions." ) ; <S2SV_ModStart> { ERR ( "IPv4 <S2SV_blank> listen <S2SV_blank> failed <S2SV_blank> on <S2SV_blank> socket" <S2SV_ModEnd> ) ; goto
Buggy code:
 BOOL license_read_new_or_upgrade_license_packet ( rdpLicense * license, wStream * s ) { UINT32 os_major ; UINT32 os_minor ; UINT32 cbScope, cbCompanyName, cbProductId, cbLicenseInfo ; wStream * licenseStream = NULL ; BOOL ret = FALSE ; BYTE computedMac [ 16 ] ; LICENSE_BLOB * calBlob ; DEBUG_LICENSE ( "Receiving   Server   New//Upgrade   License   Packet" ) ; calBlob = license_new_binary_blob ( BB_DATA_BLOB ) ; if (! calBlob ) return FALSE ; if (! license_read_encrypted_blob ( license, s, calBlob ) ) goto out_free_blob ; if ( Stream_GetRemainingLength ( s ) < 16 ) goto out_free_blob ; if (! security_mac_data ( license -> MacSaltKey, calBlob -> data, calBlob -> length, computedMac ) ) goto out_free_blob ; if ( memcmp ( computedMac, Stream_Pointer ( s ), sizeof ( computedMac ) )!= 0 ) { WLog_ERR ( TAG, "new   or   upgrade   license   MAC   mismatch" ) ; goto out_free_blob ; } if (! Stream_SafeSeek ( s, 16 ) ) goto out_free_blob ; licenseStream = Stream_New ( calBlob -> data, calBlob -> length ) ; if (! licenseStream ) goto out_free_blob ; <START_BUG> Stream_Read_UINT16 ( licenseStream, os_minor ) ; <END_BUG> Stream_Read_UINT16 ( licenseStream, os_major ) ; Stream_Read_UINT32 ( licenseStream, cbScope ) ; if ( Stream_GetRemainingLength ( licenseStream ) < cbScope ) goto out_free_stream ; # ifdef WITH_DEBUG_LICENSE WLog_DBG ( TAG, "Scope:" ) ; winpr_HexDump ( TAG, WLOG_DEBUG, Stream_Pointer ( licenseStream ), cbScope ) ; # endif Stream_Seek ( licenseStream, cbScope ) ;  Stream_Read_UINT32 ( licenseStream, cbCompanyName ) ; <START_BUG> if ( Stream_GetRemainingLength ( licenseStream ) < cbCompanyName ) goto out_free_stream ; # ifdef WITH_DEBUG_LICENSE<END_BUG>

Fix:
<S2SV_ModStart> goto out_free_blob ; if ( Stream_GetRemainingLength ( licenseStream ) < 8 ) goto out_free_stream ; <S2SV_ModStart> cbScope ) ; if ( Stream_GetRemainingLength ( licenseStream ) < 4 ) goto out_free_stream ; <S2SV_ModStart> cbCompanyName ) ; if ( Stream_GetRemainingLength ( licenseStream ) < 4 ) goto out_free_stream ; <S2SV_ModStart> cbProductId ) ; if ( Stream_GetRemainingLength ( licenseStream ) < 4 ) goto out_free_stream ;
Buggy code:
 static int save_new_data ( struct chfn_control * ctl ) { char * gecos ; int len ; len = xasprintf ( & gecos, "%s,%s,%s,%s,%s", ctl -> newf. full_name, ctl -> newf. office, ctl -> newf. office_phone, ctl -> newf. home_phone, ctl -> newf. other ) ; if (! ctl -> newf. other ) { while ( len > 0 && gecos [ len - 1 ] == ',' ) len -- ; gecos [ len ] = 0 ; } # ifdef HAVE_LIBUSER if ( set_value_libuser ( "chfn", ctl -> username, ctl -> pw -> pw_uid, LU_GECOS, gecos ) < 0 ) { # else ctl -> pw -> pw_gecos = gecos ; <START_BUG> if ( setpwnam ( ctl -> pw ) < 0 ) { <END_BUG> warn ( "setpwnam   failed" ) ; # endif printf ( _ ( "Finger   information   *NOT*   changed.     Try   again   later.\\n" ) ) ; return - 1 ; } free ( gecos ) ; printf ( _ ( "Finger   information   changed.\\n" ) ) ; return 0 ; }

Fix:
<S2SV_ModStart> ctl -> pw, ".chfn"
Buggy code:
 static int kvm_vm_ioctl_assign_device ( struct kvm * kvm, struct kvm_assigned_pci_dev * assigned_dev ) { int r = 0, idx ; struct kvm_assigned_dev_kernel * match ; struct pci_dev * dev ; <START_BUG> if (! ( assigned_dev -> flags & KVM_DEV_ASSIGN_ENABLE_IOMMU ) ) <END_BUG> return - EINVAL ; mutex_lock ( & kvm -> lock ) ; idx = srcu_read_lock ( & kvm -> srcu ) ; match = kvm_find_assigned_dev ( & kvm -> arch. assigned_dev_head, assigned_dev -> assigned_dev_id ) ; if ( match ) { r = - EEXIST ; goto out ; } match = kzalloc ( sizeof ( struct kvm_assigned_dev_kernel ), GFP_KERNEL ) ; if ( match == NULL ) { printk ( KERN_INFO "%s:   Couldn\'t   allocate   memory\\n", __func__ ) ; r = - ENOMEM ; goto out ; } dev = pci_get_domain_bus_and_slot ( assigned_dev -> segnr, assigned_dev -> busnr, assigned_dev -> devfn ) ; if (! dev ) { printk ( KERN_INFO "%s:   host   device   not   found\\n", __func__ ) ; r = - EINVAL ; goto out_free ; }  if ( pci_enable_device ( dev ) ) { <START_BUG> printk ( KERN_INFO "%s:   Could   not   enable   PCI   device\\n", __func__ ) ; r = - EBUSY ; goto out_put ; } r = pci_request_regions ( dev, "kvm_assigned_device" ) ; if ( r ) { printk ( KERN_INFO "%s:   Could   not   get   access   to   device   regions\\n", __func__ ) ; goto out_disable ; } pci_reset_function ( dev ) ; pci_save_state ( dev ) ; match -> pci_saved_state = pci_store_saved_state ( dev ) ; if (! match -> pci_saved<END_BUG>

Fix:
<S2SV_ModStart> * dev ; u8 header_type ; <S2SV_ModStart> out_free ; } pci_read_config_byte ( dev, PCI_HEADER_TYPE, & header_type ) ; if ( ( header_type & PCI_HEADER_TYPE )!= PCI_HEADER_TYPE_NORMAL ) { r = - EPERM ; goto out_put ; } r = probe_sysfs_permissions ( dev ) ; if ( r ) goto out_put ;
Buggy code:
 void vp9_tokens_from_tree ( struct vp9_token * tokens, <START_BUG> const vp9_tree_index * tree ) { <END_BUG> tree2tok ( tokens, tree, 0, 0, 0 ) ; }

Fix:
<S2SV_ModStart> tokens, const vpx_tree_index <S2SV_ModEnd> * tree )
Buggy code:
 int cipso_v4_sock_setattr ( struct sock * sk, const struct cipso_v4_doi * doi_def, const struct netlbl_lsm_secattr * secattr ) { int ret_val = - EPERM ; unsigned char * buf = NULL ; u32 buf_len ; u32 opt_len ; <START_BUG> struct ip_options * opt = NULL ; <END_BUG> struct inet_sock * sk_inet ; struct inet_connection_sock * sk_conn ; if ( sk == NULL ) return 0 ; buf_len = CIPSO_V4_OPT_LEN_MAX ; buf = kmalloc ( buf_len, GFP_ATOMIC ) ; if ( buf == NULL ) { ret_val = - ENOMEM ; goto socket_setattr_failure ; } ret_val = cipso_v4_genopt ( buf, buf_len, doi_def, secattr ) ; if ( ret_val < 0 ) goto socket_setattr_failure ; buf_len = ret_val ; opt_len = ( buf_len + 3 ) & ~ 3 ; opt = kzalloc ( sizeof ( * opt ) + opt_len, GFP_ATOMIC ) ; if ( opt == NULL ) { ret_val = - ENOMEM ; goto socket_setattr_failure ; }  memcpy ( opt -> __data, buf, buf_len ) ; <START_BUG> <END_BUG> opt -> optlen = opt_len ;  <START_BUG> opt -> cipso = sizeof ( struct iphdr ) ; <END_BUG> kfree ( buf ) ; buf = NULL ; sk_inet = inet_sk ( sk ) ;  if ( sk_inet -> is_icsk ) { <START_BUG> sk_conn = inet_csk ( sk ) ; <END_BUG> if ( sk_inet -> opt )  <START_BUG> sk_conn -> icsk_ext_hdr_len -= sk_inet -> opt -> optlen ; <END_BUG>  sk_conn -> icsk_ext_hdr_len += opt -> optlen ; <START_BUG> sk_conn -> icsk_sync_mss ( sk, sk_conn -> icsk_pmtu_cookie ) ; } <END_BUG> opt = xchg ( & sk_inet -> opt, opt ) ;  kfree ( opt ) ; return 0 ; socket_setattr_failure : kfree ( buf

Fix:
<S2SV_ModStart> opt_len ; struct ip_options_rcu * old, <S2SV_ModEnd> * opt = <S2SV_ModStart> ( opt -> opt. <S2SV_ModStart> ; opt -> opt. <S2SV_ModStart> ; opt -> opt. <S2SV_ModStart> sk ) ; old = rcu_dereference_protected ( sk_inet -> inet_opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> ; if ( old <S2SV_ModEnd> ) sk_conn -> <S2SV_ModStart> -> icsk_ext_hdr_len -= old -> opt. <S2SV_ModEnd> optlen ; sk_conn <S2SV_ModStart> += opt -> opt. <S2SV_ModStart> ) ; } rcu_assign_pointer ( sk_inet -> inet_opt, opt ) ; if ( old ) call_rcu ( & old -> rcu, opt_kfree_rcu <S2SV_ModEnd> ) ; return
Buggy code:
 static int <START_BUG> mptctl_eventreport ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_eventreport __user * uarg = ( void __user * ) arg ; struct mpt_ioctl_eventreport karg ;  MPT_ADAPTER * ioc ; <START_BUG> int iocnum ; int numBytes, maxEvents, max ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_eventreport ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_eventreport   -   " "Unable   to   read   in   mpt_ioctl_eventreport   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; <END_BUG> return - EFAULT ;  } if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) || ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_eventreport()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } dctlprintk ( ioc, printk ( MYIOC_s_DEBUG_FMT "mptctl_eventreport   called.\\n", ioc -> name ) ) ; numBytes = karg. hdr. maxDataSize - sizeof ( mpt_ioctl_header ) ; maxEvents = numBytes // sizeof ( MPT_IOCTL_EVENTS ) ; max = MPTCTL_EVENT_LOG_SIZE < maxEvents? MPTCTL_EVENT_LOG_SIZE : maxEvents ; if ( ( max < 1 ) ||! ioc -> events ) return - ENODATA ; ioc -> aen_event_read_flag = 0 ; numBytes = max * sizeof ( MPT_IOCTL_EVENTS ) ; if ( copy_to_user ( uarg -> eventData, ioc -> events, numBytes ) ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_eventreport   -   " "Unable   to   write   out   mpt_ioctl_eventreport   struct   @   %p

Fix:
<S2SV_ModStart> int mptctl_eventreport ( MPT_ADAPTER * ioc, <S2SV_ModStart> mpt_ioctl_eventreport karg ; <S2SV_ModEnd> int numBytes, <S2SV_ModStart> return - EFAULT <S2SV_ModEnd> ; } dctlprintk
Buggy code:
 static Image * ReadDCMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char explicit_vr [ MagickPathExtent ], implicit_vr [ MagickPathExtent ], magick [ MagickPathExtent ], photometric [ MagickPathExtent ] ; DCMStreamInfo * stream_info ; Image * image ; int * bluemap, datum, * greenmap, * graymap, index, * redmap ; MagickBooleanType explicit_file, explicit_retry, polarity, sequence, use_explicit ; MagickOffsetType offset ; Quantum * scale ; register ssize_t i, x ; register Quantum * q ; register unsigned char * p ; size_t bits_allocated, bytes_per_pixel, colors, depth, height, length, mask, max_value, number_scenes, quantum, samples_per_pixel, signed_data, significant_bits, status, width, window_width ; ssize_t count, rescale_intercept, rescale_slope, scene, window_center, y ; unsigned char * data ; unsigned short group, element ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> depth = 8UL ; image -> endian = LSBEndian ; stream_info = ( DCMStreamInfo * ) AcquireMagickMemory ( sizeof ( * stream_info ) ) ; if ( stream_info == ( DCMStreamInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; ( void ) ResetMagickMemory ( stream_info, 0, sizeof ( * stream_info ) ) ; count = ReadBlob ( image, 128, ( unsigned char * ) magick ) ; if

Fix:
<S2SV_ModStart> 0x0004 : { if ( data == ( unsigned char * ) NULL ) break ; <S2SV_ModStart> 0x0008 : { if ( data == ( unsigned char * ) NULL ) break ; <S2SV_ModStart> 0 ; i <= <S2SV_ModEnd> ( ssize_t ) <S2SV_ModStart> ( ssize_t ) <S2SV_ModEnd> GetQuantumRange ( depth <S2SV_ModStart> GetQuantumRange ( depth <S2SV_ModEnd> ) ; i <S2SV_ModStart> NULL ) { if ( pixel. red <= GetQuantumRange ( depth ) ) <S2SV_ModStart> red ] ; if ( pixel. green <= GetQuantumRange ( depth ) ) <S2SV_ModStart> green ] ; if ( pixel. blue <= GetQuantumRange ( depth ) )
Buggy code:
 static int filter_frame ( AVFilterLink * inlink, AVFrame * in ) { AVFilterContext * ctx = inlink -> dst ; FlipContext * s = ctx -> priv ; AVFilterLink * outlink = ctx -> outputs [ 0 ] ; AVFrame * out ; uint8_t * inrow, * outrow ; int i, j, plane, step ; out = ff_get_video_buffer ( outlink, outlink -> w, outlink -> h ) ; if (! out ) { av_frame_free ( & in ) ; return AVERROR ( ENOMEM ) ; } av_frame_copy_props ( out, in ) ; if ( av_pix_fmt_desc_get ( inlink -> format ) -> flags & AV_PIX_FMT_FLAG_PAL ) memcpy ( out -> data [ 1 ], in -> data [ 1 ], AVPALETTE_SIZE ) ; <START_BUG> for ( plane = 0 ; plane < 4 && in -> data [ plane ] ; plane ++ ) { <END_BUG> const int width = ( plane == 1 || plane == 2 )? FF_CEIL_RSHIFT ( inlink -> w, s -> hsub ) : inlink -> w ; const int height = ( plane == 1 || plane == 2 )? FF_CEIL_RSHIFT ( inlink -> h, s -> vsub ) : inlink -> h ; step = s -> max_step [ plane ] ; outrow = out -> data [ plane ] ; inrow = in -> data [ plane ] + ( width - 1 ) * step ; for ( i = 0 ; i < height ; i ++ ) { switch ( step ) { case 1 : for ( j = 0 ; j < width ; j ++ ) outrow [ j ] = inrow [ - j ] ; break ; case 2 : { uint16_t * outrow16 = ( uint16_t * ) outrow ; uint16_t * inrow16 = ( uint16_t * ) inrow ; for ( j = 0 ; j < width ; j ++ ) outrow16 [ j ] = inrow16 [ - j ] ; } break ; case 3 : { uint8_t * in = inrow ; uint8_t * out = outrow ; for ( j = 0 ; j < width ; j ++, out += 3, in -= 3 )

Fix:
<S2SV_ModStart> [ plane ] && in -> linesize [ plane ]
Buggy code:
 void xmlrpc_char_encode ( char * outbuffer, const char * s1 ) { long unsigned int i ; unsigned char c ; char buf2 [ 15 ] ; mowgli_string_t * s = mowgli_string_create ( ) ; * buf2 = '\\0' ; * outbuffer = '\\0' ; if ( (! ( s1 ) || ( * ( s1 ) == '\\0' ) ) ) { return ; } for ( i = 0 ; s1 [ i ]!= '\\0' ; i ++ ) { c = s1 [ i ] ; if ( c > 127 ) { snprintf ( buf2, sizeof buf2, "&#%d;", c ) ; s -> append ( s, buf2, strlen ( buf2 ) ) ; } else if ( c == '&' ) { s -> append ( s, "&amp;", 5 ) ; } else if ( c == '<' ) { s -> append ( s, "&lt;", 4 ) ; } else if ( c == '>' ) { s -> append ( s, "&gt;", 4 ) ; } else if ( c == \'"\' ) { s -> append ( s, "&quot;", 6 ) ; } else { s -> append_char ( s, c ) ; } } <START_BUG> memcpy ( outbuffer, s -> str, XMLRPC_BUFSIZE ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ; } } s -> append_char ( s, 0 ) ; strncpy <S2SV_ModEnd> ( outbuffer,
Buggy code:
 <START_BUG> static int prob_diff_update_cost ( vp9_prob newp, vp9_prob oldp ) { <END_BUG> int delp = remap_prob ( newp, oldp ) ; return update_bits [ delp ] * 256 ; }

Fix:
<S2SV_ModStart> int prob_diff_update_cost ( vpx_prob newp, vpx_prob <S2SV_ModEnd> oldp ) {
Buggy code:
 static int inv_recenter_nonneg ( int v, int m ) { if ( v > 2 * m ) return v ; <START_BUG> return v % 2? m - ( v + 1 ) // 2 : m + v // 2 ; <END_BUG> }

Fix:
<S2SV_ModStart> v ; return ( v & 1 ) <S2SV_ModEnd>? m - <S2SV_ModStart>? m - ( <S2SV_ModStart> + 1 ) >> 1 ) <S2SV_ModEnd> : m + <S2SV_ModStart> : m + ( v >> 1 ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void vp8_change_config ( VP8_COMP * cpi, VP8_CONFIG * oxcf ) { VP8_COMMON * cm = & cpi -> common ; int last_w, last_h, prev_number_of_layers ; if (! cpi ) return ; if (! oxcf ) return ; # if CONFIG_MULTITHREAD if ( cpi -> b_lpf_running ) { sem_wait ( & cpi -> h_event_end_lpf ) ; cpi -> b_lpf_running = 0 ; } # endif if ( cm -> version!= oxcf -> Version ) { cm -> version = oxcf -> Version ; vp8_setup_version ( cm ) ; } last_w = cpi -> oxcf. Width ; last_h = cpi -> oxcf. Height ; prev_number_of_layers = cpi -> oxcf. number_of_layers ; cpi -> oxcf = * oxcf ; switch ( cpi -> oxcf. Mode ) { case MODE_REALTIME : cpi -> pass = 0 ; cpi -> compressor_speed = 2 ; if ( cpi -> oxcf. cpu_used < - 16 ) { cpi -> oxcf. cpu_used = - 16 ; } if ( cpi -> oxcf. cpu_used > 16 ) cpi -> oxcf. cpu_used = 16 ; break ; case MODE_GOODQUALITY : cpi -> pass = 0 ; cpi -> compressor_speed = 1 ; if ( cpi -> oxcf. cpu_used < - 5 ) { cpi -> oxcf. cpu_used = - 5 ; } if ( cpi -> oxcf. cpu_used > 5 ) cpi -> oxcf. cpu_used = 5 ; break ; case MODE_BESTQUALITY : cpi -> pass = 0 ; cpi -> compressor_speed = 0 ; break ; case MODE_FIRSTPASS : cpi -> pass = 1 ; cpi -> compressor_speed = 1 ; break ; case MODE_SECONDPASS : cpi -> pass = 2 ; cpi -> compressor_speed = 1 ; if ( cpi -> oxcf. cpu_used < - 5 ) { cpi -> oxcf. cpu_used = -

Fix:
<S2SV_ModStart> : DEFAULT_GF_INTERVAL ; <S2SV_ModEnd> # if ( <S2SV_ModStart> prev_number_of_layers ) { if ( cpi -> temporal_layer_id > 0 ) { cpi -> temporal_layer_id = 0 ; } <S2SV_ModStart> ) ; } if (! cpi -> initial_width ) { cpi -> initial_width = cpi -> oxcf. Width ; cpi -> initial_height = cpi -> oxcf. Height ; } cm -> Width = cpi -> oxcf. Width <S2SV_ModEnd> ; cm -> <S2SV_ModStart> oxcf. Height ; assert ( cm -> Width <= cpi -> initial_width ) ; assert ( cm -> Height <= cpi -> initial_height ) <S2SV_ModStart> width, height, cm -> mb_rows, cm -> mb_cols, cpi -> oxcf. noise_sensitivity
Buggy code:
 static void otp_verify ( krb5_context context, krb5_data * req_pkt, krb5_kdc_req * request, krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data * pa, krb5_kdcpreauth_callbacks cb, krb5_kdcpreauth_rock rock, krb5_kdcpreauth_moddata moddata, krb5_kdcpreauth_verify_respond_fn respond, void * arg ) { krb5_keyblock * armor_key = NULL ; krb5_pa_otp_req * req = NULL ; struct request_state * rs ; krb5_error_code retval ; krb5_data d, plaintext ; char * config ; <START_BUG> enc_tkt_reply -> flags |= TKT_FLG_PRE_AUTH ; <END_BUG> armor_key = cb -> fast_armor ( context, rock ) ; if ( armor_key == NULL ) { retval = KRB5KDC_ERR_PREAUTH_FAILED ; com_err ( "otp", retval, "No   armor   key   found   when   verifying   padata" ) ; goto error ; } d = make_data ( pa -> contents, pa -> length ) ; retval = decode_krb5_pa_otp_req ( & d, & req ) ; if ( retval!= 0 ) { com_err ( "otp", retval, "Unable   to   decode   OTP   request" ) ; goto error ; } retval = decrypt_encdata ( context, armor_key, req, & plaintext ) ; if ( retval!= 0 ) { com_err ( "otp", retval, "Unable   to   decrypt   nonce" ) ; goto error ; } retval = nonce_verify ( context, armor_key, & plaintext ) ; if ( retval!= 0 ) retval = timestamp_verify ( context, & plaintext ) ; krb5_free_data_contents ( context, & plaintext ) ; if ( retval!= 0 ) { com_err ( "otp", retval, "Unable   to   verify   nonce   or   timestamp" ) ; goto error ; } rs = k5alloc ( sizeof ( struct request_state ),

Fix:
<S2SV_ModStart> * config ; <S2SV_ModEnd> armor_key = cb <S2SV_ModStart> respond = respond ; rs -> enc_tkt_reply = enc_tkt_reply
Buggy code:
 static struct nfs4_opendata * nfs4_opendata_alloc ( struct path * path, <START_BUG> struct nfs4_state_owner * sp, int flags, <END_BUG> const struct iattr * attrs ) { struct dentry * parent = dget_parent ( path -> dentry ) ; struct inode * dir = parent -> d_inode ; struct nfs_server * server = NFS_SERVER ( dir ) ; struct nfs4_opendata * p ; p = kzalloc ( sizeof ( * p ), GFP_KERNEL ) ; if ( p == NULL ) goto err ; p -> o_arg. seqid = nfs_alloc_seqid ( & sp -> so_seqid ) ; if ( p -> o_arg. seqid == NULL ) goto err_free ; p -> path. mnt = mntget ( path -> mnt ) ; p -> path. dentry = dget ( path -> dentry ) ; p -> dir = parent ; p -> owner = sp ; atomic_inc ( & sp -> so_count ) ; p -> o_arg. fh = NFS_FH ( dir ) ;  p -> o_arg. open_flags = flags, <START_BUG> p -> o_arg. clientid = server -> nfs_client -> cl_clientid ; p -> o_arg. id = sp -> so_owner_id. id ; p -> o_arg. name = & p -> path. dentry -> d_name ; p -> o_arg. server = server ; p -> o_arg. bitmask = server -> attr_bitmask ; p -> o_arg. claim = NFS4_OPEN_CLAIM_NULL ; if ( flags & O_EXCL ) { u32 * s = ( u32 * ) p -> o_arg. u. verifier. data ; s [ 0 ] = jiffies ; s [ 1 ] = current -> pid ; } else if ( flags & O_CREAT ) { p -> o_arg. u. attrs = & p -> attrs ; memcpy ( & p -> attrs, attrs, sizeof ( p -> attrs ) ) ; } p -> c_arg. fh = & p -> o_res. fh ; p -> c_arg. stateid = & p -> o_res. stateid ; p -> c_arg. seqid = p<END_BUG>

Fix:
<S2SV_ModStart> nfs4_state_owner * sp, fmode_t fmode <S2SV_ModStart> open_flags = flags ; p -> o_arg. fmode = fmode & ( FMODE_READ | FMODE_WRITE ) ; <S2SV_ModEnd> p -> o_arg
Buggy code:
 Expr * sqlite3CreateColumnExpr ( sqlite3 * db, SrcList * pSrc, int iSrc, int iCol ) { Expr * p = sqlite3ExprAlloc ( db, TK_COLUMN, 0, 0 ) ; if ( p ) { struct SrcList_item * pItem = & pSrc -> a [ iSrc ] ; <START_BUG> p -> y. pTab = pItem -> pTab ; <END_BUG> p -> iTable = pItem -> iCursor ; if ( p -> y. pTab -> iPKey == iCol ) { p -> iColumn = - 1 ; } else { p -> iColumn = ( ynVar ) iCol ;  testcase ( iCol == BMS ) ; <START_BUG> testcase ( iCol == BMS - 1 ) ; pItem -> colUsed |= ( ( Bitmask ) 1 ) << ( iCol >= BMS? BMS - 1 : iCol ) ; } } <END_BUG> return p ;  }

Fix:
<S2SV_ModStart> iSrc ] ; Table * pTab = <S2SV_ModStart> ) iCol ; if ( pTab -> tabFlags & TF_HasGenerated ) { Column * pColumn = pTab -> aCol + iCol ; if ( pColumn -> colFlags & COLFLAG_GENERATED ) { testcase ( pTab -> nCol == 63 ) ; testcase ( pTab -> nCol == 64 ) ; if ( pTab -> nCol >= 64 ) { pItem -> colUsed = ALLBITS ; } else { pItem -> colUsed = MASKBIT ( pTab -> nCol ) - 1 ; } } } else { <S2SV_ModStart> ; } } }
Buggy code:
 static long __media_device_enum_links ( struct media_device * mdev, struct media_links_enum * links ) { struct media_entity * entity ; entity = find_entity ( mdev, links -> entity ) ; if ( entity == NULL ) return - EINVAL ; if ( links -> pads ) { unsigned int p ; for ( p = 0 ; p < entity -> num_pads ; p ++ ) { struct media_pad_desc pad ; <START_BUG> media_device_kpad_to_upad ( & entity -> pads [ p ], & pad ) ; <END_BUG> if ( copy_to_user ( & links -> pads [ p ], & pad, sizeof ( pad ) ) ) return - EFAULT ; } } if ( links -> links ) { struct media_link_desc __user * ulink ; unsigned int l ; for ( l = 0, ulink = links -> links ; l < entity -> num_links ; l ++ ) { struct media_link_desc link ; if ( entity -> links [ l ]. source -> entity!= entity ) continue ;  media_device_kpad_to_upad ( entity -> links [ l ]. source, <START_BUG> & link. source ) ; media_device_kpad_to_upad ( entity -> links [ l ]. sink, & link. sink ) ; link. flags = entity -> links [ l ]. flags ; if ( copy_to_user ( ulink, & link, sizeof ( * ulink ) ) ) return - EFAULT ; ulink ++ ; } } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> media_pad_desc pad ; memset ( & pad, 0, sizeof ( pad ) ) ; <S2SV_ModStart> ) continue ; memset ( & link, 0, sizeof ( link ) ) ;
Buggy code:
 static struct tok_state * tok_new ( void ) { struct tok_state * tok = ( struct tok_state * ) PyMem_MALLOC ( sizeof ( struct tok_state ) ) ; if ( tok == NULL ) return NULL ; tok -> buf = tok -> cur = tok -> end = tok -> inp = tok -> start = NULL ; tok -> done = E_OK ; tok -> fp = NULL ; tok -> input = NULL ; tok -> tabsize = TABSIZE ; tok -> indent = 0 ; tok -> indstack [ 0 ] = 0 ; tok -> atbol = 1 ; tok -> pendin = 0 ; tok -> prompt = tok -> nextprompt = NULL ; tok -> lineno = 0 ; tok -> level = 0 ; tok -> altindstack [ 0 ] = 0 ; tok -> decoding_state = STATE_INIT ; tok -> decoding_erred = 0 ; tok -> read_coding_spec = 0 ; tok -> enc = NULL ; tok -> encoding = NULL ; tok -> cont_line = 0 ; # ifndef PGEN tok -> filename = NULL ; tok -> decoding_readline = NULL ; tok -> decoding_buffer = NULL ; # endif <START_BUG> return tok ; <END_BUG> }

Fix:
<S2SV_ModStart> ; # endif tok -> type_comments = 0 ;
Buggy code:
 static bool parse_notify ( struct pool * pool, json_t * val ) { char * job_id, * prev_hash, * coinbase1, * coinbase2, * bbversion, * nbit, * ntime, * header ; size_t cb1_len, cb2_len, alloc_len ; unsigned char * cb1, * cb2 ; bool clean, ret = false ; int merkles, i ; json_t * arr ; arr = json_array_get ( val, 4 ) ; if (! arr ||! json_is_array ( arr ) ) goto out ; merkles = json_array_size ( arr ) ; job_id = json_array_string ( val, 0 ) ; prev_hash = json_array_string ( val, 1 ) ; coinbase1 = json_array_string ( val, 2 ) ; coinbase2 = json_array_string ( val, 3 ) ; bbversion = json_array_string ( val, 5 ) ; nbit = json_array_string ( val, 6 ) ; ntime = json_array_string ( val, 7 ) ; clean = json_is_true ( json_array_get ( val, 8 ) ) ; if (! job_id ||! prev_hash ||! coinbase1 ||! coinbase2 ||! bbversion ||! nbit ||! ntime ) { if ( job_id ) free ( job_id ) ; if ( prev_hash ) free ( prev_hash ) ; if ( coinbase1 ) free ( coinbase1 ) ; if ( coinbase2 ) free ( coinbase2 ) ; if ( bbversion ) free ( bbversion ) ; if ( nbit ) free ( nbit ) ; if ( ntime ) free ( ntime ) ; goto out ; } cg_wlock ( & pool -> data_lock ) ; free ( pool -> swork. job_id ) ; free ( pool -> swork. prev_hash ) ; free ( pool -> swork. bbversion ) ; free ( pool -> swork. nbit ) ; free ( pool -> swork. ntime ) ; pool -> swork. job_id = job_id ; pool -> swork. prev_hash = prev_hash ; cb1_len = strlen ( coinbase1 ) // 2 ; cb2_len = strlen ( coinbase2 ) // 2 ; pool -> s

Fix:
<S2SV_ModStart> ) ) ) { applog ( LOG_WARNING, "%s: <S2SV_blank> Failed <S2SV_blank> to <S2SV_blank> convert <S2SV_blank> header <S2SV_blank> to <S2SV_blank> header_bin, <S2SV_blank> got <S2SV_blank> %s", __func__, header ) ; pool_failed ( pool ) ; return false ; } <S2SV_ModEnd> cb1 = (
Buggy code:
 int secure_check ( void * data ) { const at91_secure_header_t * header ; void * file ; <START_BUG> if ( secure_decrypt ( data, sizeof ( * header ), 0 ) ) <END_BUG>  return - 1 ; <START_BUG> header = ( const at91_secure_header_t * ) data ; if ( header -> magic!= AT91_SECURE_MAGIC ) <END_BUG> return - 1 ;  file = ( unsigned char * ) data + sizeof ( * header ) ; <START_BUG> return secure_decrypt ( file, header -> file_size, 1 ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> * file ; int ret = - 1 ; <S2SV_ModStart> 0 ) ) goto secure_wipe_keys <S2SV_ModEnd> ; header = <S2SV_ModStart>!= AT91_SECURE_MAGIC ) goto secure_wipe_keys <S2SV_ModEnd> ; file = <S2SV_ModStart> header ) ; ret = <S2SV_ModEnd> secure_decrypt ( file <S2SV_ModStart> 1 ) ; secure_wipe_keys : wipe_keys ( ) ; return ret ;
Buggy code:
 static void rx_cache_insert ( netdissect_options * ndo, const u_char * bp, const struct ip * ip, int dport ) { struct rx_cache_entry * rxent ; const struct rx_header * rxh = ( const struct rx_header * ) bp ; if ( ndo -> ndo_snapend - bp + 1 <= ( int ) ( sizeof ( struct rx_header ) + sizeof ( int32_t ) ) ) return ; rxent = & rx_cache [ rx_cache_next ] ; if ( ++ rx_cache_next >= RX_CACHE_SIZE ) rx_cache_next = 0 ; rxent -> callnum = EXTRACT_32BITS ( & rxh -> callNumber ) ; UNALIGNED_MEMCPY ( & rxent -> client, & ip -> ip_src, sizeof ( uint32_t ) ) ; UNALIGNED_MEMCPY ( & rxent -> server, & ip -> ip_dst, sizeof ( uint32_t ) ) ; rxent -> dport = dport ; <START_BUG> rxent -> serviceId = EXTRACT_32BITS ( & rxh -> serviceId ) ; <END_BUG> rxent -> opcode = EXTRACT_32BITS ( bp + sizeof ( struct rx_header ) ) ; }

Fix:
<S2SV_ModStart> -> serviceId = EXTRACT_16BITS <S2SV_ModEnd> ( & rxh
Buggy code:
 void inode_init_owner ( struct inode * inode, const struct inode * dir, umode_t mode ) { inode -> i_uid = current_fsuid ( ) ; if ( dir && dir -> i_mode & S_ISGID ) { inode -> i_gid = dir -> i_gid ; if ( S_ISDIR ( mode ) ) mode |= S_ISGID ; <START_BUG> } else <END_BUG> inode -> i_gid = current_fsgid ( ) ; inode -> i_mode = mode ; }

Fix:
<S2SV_ModStart> |= S_ISGID ; else if ( ( mode & ( S_ISGID | S_IXGRP ) ) == ( S_ISGID | S_IXGRP ) &&! in_group_p ( inode -> i_gid ) &&! capable_wrt_inode_uidgid ( dir, CAP_FSETID ) ) mode &= ~ S_ISGID ;
Buggy code:
 static int kvm_vm_ioctl_create_vcpu ( struct kvm * kvm, u32 id ) { int r ; struct kvm_vcpu * vcpu, * v ; vcpu = kvm_arch_vcpu_create ( kvm, id ) ; if ( IS_ERR ( vcpu ) ) return PTR_ERR ( vcpu ) ; preempt_notifier_init ( & vcpu -> preempt_notifier, & kvm_preempt_ops ) ; r = kvm_arch_vcpu_setup ( vcpu ) ; if ( r ) goto vcpu_destroy ; mutex_lock ( & kvm -> lock ) ; <START_BUG> if ( atomic_read ( & kvm -> online_vcpus ) == KVM_MAX_VCPUS ) { <END_BUG> r = - EINVAL ; goto unlock_vcpu_destroy ; } kvm_for_each_vcpu ( r, v, kvm ) if ( v -> vcpu_id == id ) { r = - EEXIST ; goto unlock_vcpu_destroy ; } BUG_ON ( kvm -> vcpus [ atomic_read ( & kvm -> online_vcpus ) ] ) ; kvm_get_kvm ( kvm ) ; r = create_vcpu_fd ( vcpu ) ; if ( r < 0 ) { kvm_put_kvm ( kvm ) ; goto unlock_vcpu_destroy ; } kvm -> vcpus [ atomic_read ( & kvm -> online_vcpus ) ] = vcpu ; smp_wmb ( ) ; atomic_inc ( & kvm -> online_vcpus ) ; mutex_unlock ( & kvm -> lock ) ; return r ; unlock_vcpu_destroy : mutex_unlock ( & kvm -> lock ) ; vcpu_destroy : kvm_arch_vcpu_destroy ( vcpu ) ; return r ; }

Fix:
<S2SV_ModStart> ; if (! kvm_vcpu_compatible ( vcpu ) ) { r = - EINVAL ; goto unlock_vcpu_destroy ; } if (
Buggy code:
 static int usb_audio_probe ( struct usb_interface * intf, const struct usb_device_id * usb_id ) { struct usb_device * dev = interface_to_usbdev ( intf ) ; const struct snd_usb_audio_quirk * quirk = ( const struct snd_usb_audio_quirk * ) usb_id -> driver_info ; struct snd_usb_audio * chip ; int i, err ; struct usb_host_interface * alts ; int ifnum ; u32 id ; alts = & intf -> altsetting [ 0 ] ; ifnum = get_iface_desc ( alts ) -> bInterfaceNumber ; id = USB_ID ( le16_to_cpu ( dev -> descriptor. idVendor ), le16_to_cpu ( dev -> descriptor. idProduct ) ) ; if ( get_alias_id ( dev, & id ) ) quirk = get_alias_quirk ( dev, id ) ; if ( quirk && quirk -> ifnum >= 0 && ifnum!= quirk -> ifnum ) return - ENXIO ; err = snd_usb_apply_boot_quirk ( dev, intf, quirk, id ) ; if ( err < 0 ) return err ; chip = NULL ; mutex_lock ( & register_mutex ) ; for ( i = 0 ; i < SNDRV_CARDS ; i ++ ) { if ( usb_chip [ i ] && usb_chip [ i ] -> dev == dev ) { if ( atomic_read ( & usb_chip [ i ] -> shutdown ) ) { dev_err ( & dev -> dev, "USB   device   is   in   the   shutdown   state,   cannot   create   a   card   instance\\n" ) ; err = - EIO ; goto __error ; } chip = usb_chip [ i ] ; atomic_inc ( & chip -> active ) ; break ; } } if (! chip ) { for ( i = 0 ; i < SNDRV_CARDS ; i ++ ) if (! usb_chip [ i ] && ( vid [ i ] == - 1 || vid [ i ] == USB_ID_VENDOR ( id ) ) && ( pid [ i ] == - 1 || pid [ i ]

Fix:
<S2SV_ModStart> chip ) { atomic_dec ( & chip -> active ) ; <S2SV_ModStart> card ) ; <S2SV_ModEnd> } mutex_unlock (
Buggy code:
 static int hgcm_call_preprocess_linaddr ( const struct vmmdev_hgcm_function_parameter * src_parm, void * * bounce_buf_ret, size_t * extra ) { void * buf, * bounce_buf ; bool copy_in ; u32 len ; int ret ; buf = ( void * ) src_parm -> u. pointer. u. linear_addr ; len = src_parm -> u. pointer. size ; copy_in = src_parm -> type!= VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT ; if ( len > VBG_MAX_HGCM_USER_PARM ) return - E2BIG ; bounce_buf = kvmalloc ( len, GFP_KERNEL ) ; if (! bounce_buf ) return - ENOMEM ; <START_BUG> if ( copy_in ) { <END_BUG> ret = copy_from_user ( bounce_buf, ( void __user * ) buf, len ) ; if ( ret ) return - EFAULT ; } else { memset ( bounce_buf, 0, len ) ; }  * bounce_buf_ret = bounce_buf ; <START_BUG> hgcm_call_add_pagelist_size ( bounce_buf, len, extra ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> - ENOMEM ; * bounce_buf_ret = bounce_buf ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> hgcm_call_add_pagelist_size ( bounce_buf
Buggy code:
 static int opl3_load_patch ( int dev, int format, const char __user * addr, <START_BUG> int offs, int count, int pmgr_flag ) <END_BUG> { struct sbi_instrument ins ; if ( count < sizeof ( ins ) ) { printk ( KERN_WARNING "FM   Error:   Patch   record   too   short\\n" ) ; return - EINVAL ; }  if ( copy_from_user ( & ( ( char * ) & ins ) [ offs ], addr + offs, sizeof ( ins ) - offs ) ) <START_BUG> return - EFAULT ; if ( ins. channel < 0 || ins. channel >= SBFM_MAXINSTR ) { printk ( KERN_WARNING "FM   Error:   Invalid   instrument   number   %d\\n", ins. channel ) ; return - EINVAL ; } ins. key = format ; return store_instr ( ins. channel, & ins ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * addr, <S2SV_ModEnd> int count, <S2SV_ModStart> copy_from_user ( & ins, addr <S2SV_ModEnd>, sizeof ( <S2SV_ModStart> ( ins ) <S2SV_ModEnd> ) ) return
Buggy code:
 static void pci_cfgrw ( struct vmctx * ctx, int vcpu, int in, int bus, int slot, int func, int coff, int bytes, uint32_t * eax ) { struct businfo * bi ; struct slotinfo * si ; struct pci_vdev * dev ; struct pci_vdev_ops * ops ; int idx, needcfg ; uint64_t addr, bar, mask ; bool decode, ignore_reg_unreg = false ; bi = pci_businfo [ bus ] ; if ( bi!= NULL ) { si = & bi -> slotinfo [ slot ] ; dev = si -> si_funcs [ func ]. fi_devi ; } else dev = NULL ; if ( dev == NULL || ( bytes!= 1 && bytes!= 2 && bytes!= 4 ) || ( coff & ( bytes - 1 ) )!= 0 ) { if ( in ) * eax = 0xffffffff ; return ; } ops = dev -> dev_ops ; if ( strcmp ( "passthru", ops -> class_name ) ) { if ( coff >= PCI_REGMAX + 1 ) { if ( in ) { * eax = 0xffffffff ; if ( coff <= PCI_REGMAX + 4 ) * eax = 0x00000000 ; } return ; } } if ( in ) { if ( ops -> vdev_cfgread!= NULL ) { needcfg = ops -> vdev_cfgread ( ctx, vcpu, dev, coff, bytes, eax ) ; } else { needcfg = 1 ; } if ( needcfg ) * eax = CFGREAD ( dev, coff, bytes ) ; pci_emul_hdrtype_fixup ( bus, slot, coff, bytes, eax ) ; } else { if ( ops -> vdev_cfgwrite!= NULL && ( * ops -> vdev_cfgwrite ) ( ctx, vcpu, dev, coff, bytes, * eax ) == 0 ) return ; if ( coff >= PCIR_BAR ( 0 ) && coff < PCIR_BAR ( PCI_BARMAX + 1 ) ) { if ( bytes!= 4 || ( coff & 0x3 )!= 0 ) return ; idx = ( coff - PCIR_BAR ( 0 ) ) // 4 ; mask = ~ (

Fix:
<S2SV_ModStart> case PCIBAR_MEMHI64 : <S2SV_ModEnd> mask = ~ <S2SV_ModStart> ; default : pr_err ( "%s: <S2SV_blank> invalid <S2SV_blank> bar <S2SV_blank> type <S2SV_blank> %d\\n", __func__, dev -> bar [ idx ]. type ) ; return <S2SV_ModEnd> ; } pci_set_cfgdata32
Buggy code:
 static int sgi_timer_set ( struct k_itimer * timr, int flags, struct itimerspec * new_setting, struct itimerspec * old_setting ) { unsigned long when, period, irqflags ; int err = 0 ; cnodeid_t nodeid ; struct mmtimer * base ; struct rb_node * n ; if ( old_setting ) sgi_timer_get ( timr, old_setting ) ; sgi_timer_del ( timr ) ; <START_BUG> when = timespec_to_ns ( new_setting -> it_value ) ; <END_BUG>  period = timespec_to_ns ( new_setting -> it_interval ) ; <START_BUG> if ( when == 0 ) return 0 ; base = kmalloc ( sizeof ( struct mmtimer ), GFP_KERNEL ) ; if ( base == NULL ) return - ENOMEM ; if ( flags & TIMER_ABSTIME ) { struct timespec n ; unsigned long now ; getnstimeofday ( & n ) ; <END_BUG> now = timespec_to_ns ( n ) ;  if ( when > now ) when -= now ; else when = 0 ; } when = ( when + sgi_clock_period - 1 ) // sgi_clock_period + rtc_time ( ) ; period = ( period + sgi_clock_period - 1 ) // sgi_clock_period ; preempt_disable ( ) ; nodeid = cpu_to_node ( smp_processor_id ( ) ) ; spin_lock_irqsave ( & timers [ nodeid ]. lock, irqflags ) ; base -> timer = timr ; base -> cpu = smp_processor_id ( ) ; timr -> it. mmtimer. clock = TIMER_SET ; timr -> it. mmtimer. node = nodeid ; timr -> it. mmtimer. incr = period ; timr -> it. mmtimer. expires = when ; n = timers [ nodeid ]. next ; mmtimer_add_list ( base ) ; if ( timers [ nodeid ]. next == n ) { spin_unlock_irqrestore ( & timers [ nodeid ]. lock, irqflags ) ; preempt_enable ( ) ; return err ; } if ( n ) mmtimer_disable_

Fix:
<S2SV_ModStart> = timespec_to_ns ( & <S2SV_ModStart> = timespec_to_ns ( & <S2SV_ModStart> = timespec_to_ns ( &
Buggy code:
 <START_BUG> static int enable ( void ) { <END_BUG>  LOG_INFO ( "%s", __func__ ) ; <START_BUG> if (! interface_ready ( ) ) return BT_STATUS_NOT_READY ; stack_manager_get_interface ( ) -> start_up_stack_async ( ) ; return BT_STATUS_SUCCESS ; }<END_BUG>

Fix:
<S2SV_ModStart> int enable ( bool start_restricted <S2SV_ModEnd> ) { LOG_INFO <S2SV_ModStart> { LOG_INFO ( LOG_TAG, "%s: <S2SV_blank> start <S2SV_blank> restricted <S2SV_blank> = <S2SV_blank> %d", __func__, start_restricted ) ; restricted_mode = start_restricted <S2SV_ModEnd> ; if (
Buggy code:
 Datum bqarr_in ( PG_FUNCTION_ARGS ) { char * buf = ( char * ) PG_GETARG_POINTER ( 0 ) ; WORKSTATE state ; int32 i ; QUERYTYPE * query ; int32 commonlen ; ITEM * ptr ; NODE * tmp ; int32 pos = 0 ; # ifdef BS_DEBUG StringInfoData pbuf ; # endif state. buf = buf ; state. state = WAITOPERAND ; state. count = 0 ; state. num = 0 ; state. str = NULL ; makepol ( & state ) ; if (! state. num ) ereport ( ERROR, ( errcode ( ERRCODE_INVALID_PARAMETER_VALUE ), errmsg ( "empty   query" ) ) ) ; <START_BUG> commonlen = COMPUTESIZE ( state. num ) ; <END_BUG> query = ( QUERYTYPE * ) palloc ( commonlen ) ; SET_VARSIZE ( query, commonlen ) ; query -> size = state. num ; ptr = GETQUERY ( query ) ; for ( i = state. num - 1 ; i >= 0 ; i -- ) { ptr [ i ]. type = state. str -> type ; ptr [ i ]. val = state. str -> val ; tmp = state. str -> next ; pfree ( state. str ) ; state. str = tmp ; } pos = query -> size - 1 ; findoprnd ( ptr, & pos ) ; # ifdef BS_DEBUG initStringInfo ( & pbuf ) ; for ( i = 0 ; i < query -> size ; i ++ ) { if ( ptr [ i ]. type == OPR ) appendStringInfo ( & pbuf, "%c(%d)   ", ptr [ i ]. val, ptr [ i ]. left ) ; else appendStringInfo ( & pbuf, "%d   ", ptr [ i ]. val ) ; } elog ( DEBUG3, "POR:   %s", pbuf. data ) ; pfree ( pbuf. data ) ; # endif PG_RETURN_POINTER ( query ) ; }

Fix:
<S2SV_ModStart> ) ) ; if ( state. num > QUERYTYPEMAXITEMS ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> query <S2SV_blank> items <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", state. num, ( int ) QUERYTYPEMAXITEMS ) ) ) ;
Buggy code:
 int yr_object_copy ( YR_OBJECT * object, YR_OBJECT * * object_copy ) { YR_OBJECT * copy ; YR_OBJECT * o ; YR_STRUCTURE_MEMBER * structure_member ; YR_OBJECT_FUNCTION * func ; YR_OBJECT_FUNCTION * func_copy ; int i ; * object_copy = NULL ; FAIL_ON_ERROR ( yr_object_create ( object -> type, object -> identifier, NULL, & copy ) ) ; switch ( object -> type ) { case OBJECT_TYPE_INTEGER : <START_BUG> ( ( YR_OBJECT_INTEGER * ) copy ) -> value = UNDEFINED ; <END_BUG> break ; case OBJECT_TYPE_STRING :  ( ( YR_OBJECT_STRING * ) copy ) -> value = NULL ; <START_BUG> break ; case OBJECT_TYPE_FUNCTION : func = ( YR_OBJECT_FUNCTION * ) object ; func_copy = ( YR_OBJECT_FUNCTION * ) copy ; FAIL_ON_ERROR_WITH_CLEANUP ( yr_object_copy ( func -> return_obj, & func_copy -> return_obj ), yr_object_destroy ( copy ) ) ; for ( i = 0 ; i < MAX_OVERLOADED_FUNCTIONS ; i ++ ) func_copy -> prototypes [ i ] = func -> prototypes [ i ] ; break ; case OBJECT_TYPE_STRUCTURE : structure_member = ( ( YR_OBJECT_STRUCTURE * ) object ) -> members ; while ( structure_member!= NULL ) { FAIL_ON_ERROR_WITH_CLEANUP ( yr_object_copy ( structure_member -> object, & o ), yr_object_destroy ( copy ) ) ; FAIL_ON_ERROR_WITH_CLEANUP ( yr_object_structure_set_member ( copy, o ), yr_free ( o ) ; yr_object_destroy ( copy ) ) ; structure_member = structure_member -> next ; } break ; case OBJECT_TYPE_ARRAY : yr_object_copy ( ( ( YR_OBJECT_ARRAY * ) object ) -> prototype_item, & o ) ; ( ( YR_OBJECT_ARRAY * ) copy ) -> prototype_item = o ; break ; case OBJECT_TYPE_DICTIONARY : yr_object_copy ( ( ( YR_OBJECT_DICTIONARY * )<END_BUG>

Fix:
<S2SV_ModStart> -> value = ( ( YR_OBJECT_INTEGER * ) object ) -> value <S2SV_ModEnd> ; break ; <S2SV_ModStart> case OBJECT_TYPE_STRING : if ( <S2SV_ModStart> YR_OBJECT_STRING * ) object ) -> value!= NULL ) { ( ( YR_OBJECT_STRING * ) copy ) -> value = sized_string_dup ( ( ( YR_OBJECT_STRING * ) object ) -> value ) ; } else { ( ( YR_OBJECT_STRING * ) copy ) -> value = NULL ; } break ; case OBJECT_TYPE_FLOAT : ( ( YR_OBJECT_DOUBLE * ) copy ) -> value = ( ( YR_OBJECT_DOUBLE * ) object ) -> value <S2SV_ModEnd> ; break ;
Buggy code:
 int raptor_turtle_writer_set_option ( raptor_turtle_writer * turtle_writer, raptor_option option, int value ) { if ( value < 0 ||! raptor_option_is_valid_for_area ( option, RAPTOR_OPTION_AREA_TURTLE_WRITER ) ) return 1 ; switch ( option ) { case RAPTOR_OPTION_WRITER_AUTO_INDENT : if ( value ) turtle_writer -> flags |= TURTLE_WRITER_AUTO_INDENT ; else turtle_writer -> flags &= ~ TURTLE_WRITER_AUTO_INDENT ; break ; case RAPTOR_OPTION_WRITER_INDENT_WIDTH : turtle_writer -> indent = value ; break ; case RAPTOR_OPTION_WRITER_AUTO_EMPTY : case RAPTOR_OPTION_WRITER_XML_VERSION : case RAPTOR_OPTION_WRITER_XML_DECLARATION : break ; case RAPTOR_OPTION_SCANNING : case RAPTOR_OPTION_ALLOW_NON_NS_ATTRIBUTES : case RAPTOR_OPTION_ALLOW_OTHER_PARSETYPES : case RAPTOR_OPTION_ALLOW_BAGID : case RAPTOR_OPTION_ALLOW_RDF_TYPE_RDF_LIST : case RAPTOR_OPTION_NORMALIZE_LANGUAGE : case RAPTOR_OPTION_NON_NFC_FATAL : case RAPTOR_OPTION_WARN_OTHER_PARSETYPES : case RAPTOR_OPTION_CHECK_RDF_ID : case RAPTOR_OPTION_HTML_TAG_SOUP : case RAPTOR_OPTION_MICROFORMATS : case RAPTOR_OPTION_HTML_LINK : case RAPTOR_OPTION_WWW_TIMEOUT : case RAPTOR_OPTION_STRICT : case RAPTOR_OPTION_NO_NET : case RAPTOR_OPTION_NO_FILE : <START_BUG> case RAPTOR_OPTION_RELATIVE_URIS : <END_BUG> case RAPTOR_OPTION_RESOURCE_BORDER : case RAPTOR_OPTION_LITERAL_BORDER : case RAPTOR_OPTION_BNODE_BORDER : case RAPTOR_OPTION_RESOURCE_FILL : case RAPTOR_OPTION_LITERAL_FILL : case RA

Fix:
<S2SV_ModStart> RAPTOR_OPTION_NO_FILE : case RAPTOR_OPTION_LOAD_EXTERNAL_ENTITIES : case
Buggy code:
 static struct sk_buff * ipv6_gso_segment ( struct sk_buff * skb, netdev_features_t features ) { struct sk_buff * segs = ERR_PTR ( - EINVAL ) ; struct ipv6hdr * ipv6h ; const struct net_offload * ops ; int proto ; struct frag_hdr * fptr ; unsigned int unfrag_ip6hlen ; unsigned int payload_len ; u8 * prevhdr ; int offset = 0 ; bool encap, udpfrag ; int nhoff ; bool gso_partial ; skb_reset_network_header ( skb ) ; nhoff = skb_network_header ( skb ) - skb_mac_header ( skb ) ; if ( unlikely (! pskb_may_pull ( skb, sizeof ( * ipv6h ) ) ) ) goto out ; encap = SKB_GSO_CB ( skb ) -> encap_level > 0 ; if ( encap ) features &= skb -> dev -> hw_enc_features ; SKB_GSO_CB ( skb ) -> encap_level += sizeof ( * ipv6h ) ; ipv6h = ipv6_hdr ( skb ) ; __skb_pull ( skb, sizeof ( * ipv6h ) ) ; segs = ERR_PTR ( - EPROTONOSUPPORT ) ; proto = ipv6_gso_pull_exthdrs ( skb, ipv6h -> nexthdr ) ; if ( skb -> encapsulation && skb_shinfo ( skb ) -> gso_type & ( SKB_GSO_IPXIP4 | SKB_GSO_IPXIP6 ) ) udpfrag = proto == IPPROTO_UDP && encap ; else udpfrag = proto == IPPROTO_UDP &&! skb -> encapsulation ; ops = rcu_dereference ( inet6_offloads [ proto ] ) ; if ( likely ( ops && ops -> callbacks. gso_segment ) ) { skb_reset_transport_header ( skb ) ; segs = ops -> callbacks. gso_segment ( skb, features ) ; } if ( IS_ERR_OR_NULL ( segs ) ) goto out ; gso_partial =!! ( skb_shinfo ( segs ) -> gso

Fix:
<S2SV_ModStart> prevhdr ) ; if ( unfrag_ip6hlen < 0 ) return ERR_PTR ( unfrag_ip6hlen ) ;
Buggy code:
 int lzxd_decompress ( struct lzxd_stream * lzx, off_t out_bytes ) { register unsigned int bit_buffer ; register int bits_left, i = 0 ; unsigned char * i_ptr, * i_end ; register unsigned short sym ; int match_length, length_footer, extra, verbatim_bits, bytes_todo ; int this_run, main_element, aligned_bits, j ; unsigned char * window, * runsrc, * rundest, buf [ 12 ] ; unsigned int frame_size = 0, end_frame, match_offset, window_posn ; unsigned int R0, R1, R2 ; if (! lzx || ( out_bytes < 0 ) ) return MSPACK_ERR_ARGS ; if ( lzx -> error ) return lzx -> error ; i = lzx -> o_end - lzx -> o_ptr ; if ( ( off_t ) i > out_bytes ) i = ( int ) out_bytes ; if ( i ) { if ( lzx -> sys -> write ( lzx -> output, lzx -> o_ptr, i )!= i ) { return lzx -> error = MSPACK_ERR_WRITE ; } lzx -> o_ptr += i ; lzx -> offset += i ; out_bytes -= i ; } if ( out_bytes == 0 ) return MSPACK_ERR_OK ; RESTORE_BITS ; window = lzx -> window ; window_posn = lzx -> window_posn ; R0 = lzx -> R0 ; R1 = lzx -> R1 ; R2 = lzx -> R2 ; end_frame = ( unsigned int ) ( ( lzx -> offset + out_bytes ) // LZX_FRAME_SIZE ) + 1 ; while ( lzx -> frame < end_frame ) { if ( lzx -> reset_interval && ( ( lzx -> frame % lzx -> reset_interval ) == 0 ) ) { if ( lzx -> block_remaining ) { D ( ( "%d   bytes   remaining   at   reset   interval", lzx -> block_remaining ) ) return lzx -> error = MSPACK_ERR_DECRUNCH ; } lzxd

Fix:
<S2SV_ModStart> = 1 ; if ( bits_left == 0 ) <S2SV_ModStart> ( 16 ) <S2SV_ModEnd> ; bits_left =