nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int br_multicast_add_group ( struct net_bridge * br, struct net_bridge_port * port, struct br_ip * group ) { struct net_bridge_mdb_entry * mp ; struct net_bridge_port_group * p ; struct net_bridge_port_group __rcu * * pp ; unsigned long now = jiffies ; int err ; spin_lock ( & br -> multicast_lock ) ; if (! netif_running ( br -> dev ) || ( port && port -> state == BR_STATE_DISABLED ) ) goto out ; mp = br_multicast_new_group ( br, port, group ) ; err = PTR_ERR ( mp ) ; if ( IS_ERR ( mp ) ) goto err ; if (! port ) { <START_BUG> hlist_add_head ( & mp -> mglist, & br -> mglist ) ; <END_BUG> mod_timer ( & mp -> timer, now + br -> multicast_membership_interval ) ; goto out ; } for ( pp = & mp -> ports ; ( p = mlock_dereference ( * pp, br ) )!= NULL ; pp = & p -> next ) { if ( p -> port == port ) goto found ; if ( ( unsigned long ) p -> port < ( unsigned long ) port ) break ; } p = kzalloc ( sizeof ( * p ), GFP_ATOMIC ) ; err = - ENOMEM ; if ( unlikely (! p ) ) goto err ; p -> addr = * group ; p -> port = port ; p -> next = * pp ; hlist_add_head ( & p -> mglist, & port -> mglist ) ; setup_timer ( & p -> timer, br_multicast_port_group_expired, ( unsigned long ) p ) ; setup_timer ( & p -> query_timer, br_multicast_port_group_query_expired, ( unsigned long ) p ) ; rcu_assign_pointer ( * pp, p ) ; found : mod_timer ( & p -> timer, now + br -> multicast_membership_interval ) ; out : err = 0 ; err : spin_unlock ( & br -> multicast_lock ) ; return err ; }

Fix:
<S2SV_ModStart> port ) { if ( hlist_unhashed ( & mp -> mglist ) )
Buggy code:
 static void printFlow ( u_int16_t id, struct ndpi_flow_info * flow, u_int16_t thread_id ) { FILE * out = results_file? results_file : stdout ; u_int8_t known_tls ; char buf [ 32 ], buf1 [ 64 ] ; u_int i ; double dos_ge_score ; double dos_slow_score ; double dos_hulk_score ; double ddos_score ; double hearthbleed_score ; double ftp_patator_score ; double ssh_patator_score ; double inf_score ; if ( csv_fp!= NULL ) { float data_ratio = ndpi_data_ratio ( flow -> src2dst_bytes, flow -> dst2src_bytes ) ; double f = ( double ) flow -> first_seen, l = ( double ) flow -> last_seen ; dos_ge_score = Dos_goldeneye_score ( flow ) ; dos_slow_score = Dos_slow_score ( flow ) ; dos_hulk_score = Dos_hulk_score ( flow ) ; ddos_score = Ddos_score ( flow ) ; hearthbleed_score = Hearthbleed_score ( flow ) ; ftp_patator_score = Ftp_patator_score ( flow ) ; ssh_patator_score = Ssh_patator_score ( flow ) ; inf_score = Infiltration_score ( flow ) ; double benign_score = dos_ge_score < 1 && dos_slow_score < 1 && dos_hulk_score < 1 && ddos_score < 1 && hearthbleed_score < 1 && ftp_patator_score < 1 && ssh_patator_score < 1 && inf_score < 1? 1.1 : 0 ; fprintf ( csv_fp, "%u,%u,%.3f,%.3f,%.3f,%s,%u,%s,%u,", flow -> flow_id, flow -> protocol, f // 1000.0, l // 1000.0, ( l - f ) // 1000.0, flow -> src_name, ntohs ( flow -> src_port ), flow -> dst_name, ntohs ( flow ->

Fix:
<S2SV_ModStart> ( out, "[URL: <S2SV_blank> %s][StatusCode: <S2SV_blank> %u]" <S2SV_ModEnd>, flow -> <S2SV_ModStart> ( out, "[Content-Type: <S2SV_blank> %s]" <S2SV_ModEnd>, flow -> <S2SV_ModStart> ( out, "[User-Agent: <S2SV_blank> %s]" <S2SV_ModEnd>, flow ->
Buggy code:
 static int dcbnl_ieee_fill ( struct sk_buff * skb, struct net_device * netdev ) { struct nlattr * ieee, * app ; struct dcb_app_type * itr ; const struct dcbnl_rtnl_ops * ops = netdev -> dcbnl_ops ; int dcbx ; int err ; if ( nla_put_string ( skb, DCB_ATTR_IFNAME, netdev -> name ) ) return - EMSGSIZE ; ieee = nla_nest_start ( skb, DCB_ATTR_IEEE ) ; if (! ieee ) return - EMSGSIZE ; if ( ops -> ieee_getets ) { struct ieee_ets ets ; <START_BUG> err = ops -> ieee_getets ( netdev, & ets ) ; <END_BUG> if (! err && nla_put ( skb, DCB_ATTR_IEEE_ETS, sizeof ( ets ), & ets ) ) return - EMSGSIZE ; } if ( ops -> ieee_getmaxrate ) { struct ieee_maxrate maxrate ;  err = ops -> ieee_getmaxrate ( netdev, & maxrate ) ; <START_BUG> if (! err ) { err = nla_put ( skb, DCB_ATTR_IEEE_MAXRATE, sizeof ( maxrate ), & maxrate ) ; if ( err ) return - EMSGSIZE ; } } if ( ops -> ieee_getpfc ) { <END_BUG> struct ieee_pfc pfc ;  err = ops -> ieee_getpfc ( netdev, & pfc ) ; if (! err && nla_put ( skb, DCB_ATTR_IEEE_PFC, sizeof ( pfc ), & pfc ) ) return - EMSGSIZE ; } app = nla_nest_start ( skb, DCB_ATTR_IEEE_APP_TABLE ) ; if (! app ) return - EMSGSIZE ; spin_lock ( & dcb_lock ) ; list_for_each_entry ( itr, & dcb_app_list, list ) { if ( itr -> ifindex == netdev -> ifindex ) { err = nla_put ( skb

Fix:
<S2SV_ModStart> ieee_ets ets ; memset ( & ets, 0, sizeof ( ets ) ) ; <S2SV_ModStart> ieee_maxrate maxrate ; memset ( & maxrate, 0, sizeof ( maxrate ) ) ; <S2SV_ModStart> struct ieee_pfc pfc ; memset ( & pfc, 0, sizeof ( pfc ) ) <S2SV_ModStart> ieee_ets ets ; memset ( & ets, 0, sizeof ( ets ) ) ; <S2SV_ModStart> struct ieee_pfc pfc ; memset ( & pfc, 0, sizeof ( pfc ) )
Buggy code:
 static void xen_netbk_tx_submit ( struct xen_netbk * netbk ) { struct gnttab_copy * gop = netbk -> tx_copy_ops ; struct sk_buff * skb ; while ( ( skb = __skb_dequeue ( & netbk -> tx_queue ) )!= NULL ) { struct xen_netif_tx_request * txp ; struct xenvif * vif ; u16 pending_idx ; unsigned data_len ; pending_idx = * ( ( u16 * ) skb -> data ) ; vif = netbk -> pending_tx_info [ pending_idx ]. vif ; txp = & netbk -> pending_tx_info [ pending_idx ]. req ; if ( unlikely ( xen_netbk_tx_check_gop ( netbk, skb, & gop ) ) ) { netdev_dbg ( vif -> dev, "netback   grant   failed.\\n" ) ; skb_shinfo ( skb ) -> nr_frags = 0 ; kfree_skb ( skb ) ; continue ; } data_len = skb -> len ; memcpy ( skb -> data, ( void * ) ( idx_to_kaddr ( netbk, pending_idx ) | txp -> offset ), data_len ) ; if ( data_len < txp -> size ) { txp -> offset += data_len ; txp -> size -= data_len ; } else { <START_BUG> xen_netbk_idx_release ( netbk, pending_idx ) ; <END_BUG> } if ( txp -> flags & XEN_NETTXF_csum_blank ) skb -> ip_summed = CHECKSUM_PARTIAL ; else if ( txp -> flags & XEN_NETTXF_data_validated ) skb -> ip_summed = CHECKSUM_UNNECESSARY ; xen_netbk_fill_frags ( netbk, skb ) ; if ( skb_headlen ( skb ) < PKT_PROT_LEN && skb_is_nonlinear ( skb ) ) { int target = min_t ( int, skb -> len, PKT_PROT_LEN ) ; __pskb_pull_tail ( skb, target - skb_

Fix:
<S2SV_ModStart> netbk, pending_idx, XEN_NETIF_RSP_OKAY
Buggy code:
 void Init_ossl_cipher ( void ) { # if 0 mOSSL = rb_define_module ( "OpenSSL" ) ; eOSSLError = rb_define_class_under ( mOSSL, "OpenSSLError", rb_eStandardError ) ; # endif cCipher = rb_define_class_under ( mOSSL, "Cipher", rb_cObject ) ; eCipherError = rb_define_class_under ( cCipher, "CipherError", eOSSLError ) ; rb_define_alloc_func ( cCipher, ossl_cipher_alloc ) ; rb_define_copy_func ( cCipher, ossl_cipher_copy ) ; rb_define_module_function ( cCipher, "ciphers", ossl_s_ciphers, 0 ) ; rb_define_method ( cCipher, "initialize", ossl_cipher_initialize, 1 ) ; rb_define_method ( cCipher, "reset", ossl_cipher_reset, 0 ) ; rb_define_method ( cCipher, "encrypt", ossl_cipher_encrypt, - 1 ) ; rb_define_method ( cCipher, "decrypt", ossl_cipher_decrypt, - 1 ) ; rb_define_method ( cCipher, "pkcs5_keyivgen", ossl_cipher_pkcs5_keyivgen, - 1 ) ; rb_define_method ( cCipher, "update", ossl_cipher_update, - 1 ) ; rb_define_method ( cCipher, "final", ossl_cipher_final, 0 ) ; rb_define_method ( cCipher, "name", ossl_cipher_name, 0 ) ; rb_define_method ( cCipher, "key=", ossl_cipher_set_key, 1 ) ; rb_define_method ( cCipher, "auth_data=", ossl_cipher_set_auth_data, 1 ) ; rb_define_method ( cCipher, "auth_tag=", ossl_cipher_set_auth_tag, 1 ) ; rb_define_method ( cCipher, "auth_tag", ossl_cipher_get_auth_tag, - 1 ) ; rb_define_method ( cCipher, "auth_tag

Fix:
<S2SV_ModStart> "auth_tag_len" ) ; id_key_set = rb_intern_const ( "key_set" ) ;
Buggy code:
 static u_int ldp_pdu_print ( netdissect_options * ndo, register const u_char * pptr ) { const struct ldp_common_header * ldp_com_header ; const struct ldp_msg_header * ldp_msg_header ; const u_char * tptr, * msg_tptr ; u_short tlen ; u_short pdu_len, msg_len, msg_type, msg_tlen ; int hexdump, processed ; ldp_com_header = ( const struct ldp_common_header * ) pptr ; ND_TCHECK ( * ldp_com_header ) ; if ( EXTRACT_16BITS ( & ldp_com_header -> version )!= LDP_VERSION ) { ND_PRINT ( ( ndo, "%sLDP   version   %u   packet   not   supported", ( ndo -> ndo_vflag < 1 )? "" : "\\n\\t", EXTRACT_16BITS ( & ldp_com_header -> version ) ) ) ; return 0 ; } pdu_len = EXTRACT_16BITS ( & ldp_com_header -> pdu_length ) ; if ( pdu_len < sizeof ( const struct ldp_common_header ) - 4 ) { ND_PRINT ( ( ndo, "%sLDP,   pdu-length:   %u   (too   short,   <   %u)", ( ndo -> ndo_vflag < 1 )? "" : "\\n\\t", pdu_len, ( u_int ) ( sizeof ( const struct ldp_common_header ) - 4 ) ) ) ; return 0 ; } ND_PRINT ( ( ndo, "%sLDP,   Label-Space-ID:   %s:%u,   pdu-length:   %u", ( ndo -> ndo_vflag < 1 )? "" : "\\n\\t", ipaddr_string ( ndo, & ldp_com_header -> lsr_id ), EXTRACT_16BITS ( & ldp_com_header -> label_space ), pdu_len ) ) ; if ( ndo -> ndo_vflag < 1 ) return 0 ; tptr = pptr + sizeof ( const struct ldp_

Fix:
<S2SV_ModStart> ( ndo, "%s", tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 static int inet_create ( struct net * net, struct socket * sock, int protocol, int kern ) { struct sock * sk ; struct inet_protosw * answer ; struct inet_sock * inet ; struct proto * answer_prot ; unsigned char answer_flags ; int try_loading_module = 0 ; <START_BUG> int err ; <END_BUG> sock -> state = SS_UNCONNECTED ; lookup_protocol : err = - ESOCKTNOSUPPORT ; rcu_read_lock ( ) ; list_for_each_entry_rcu ( answer, & inetsw [ sock -> type ], list ) { err = 0 ; if ( protocol == answer -> protocol ) { if ( protocol!= IPPROTO_IP ) break ; } else { if ( IPPROTO_IP == protocol ) { protocol = answer -> protocol ; break ; } if ( IPPROTO_IP == answer -> protocol ) break ; } err = - EPROTONOSUPPORT ; } if ( unlikely ( err ) ) { if ( try_loading_module < 2 ) { rcu_read_unlock ( ) ; if ( ++ try_loading_module == 1 ) request_module ( "net-pf-%d-proto-%d-type-%d", PF_INET, protocol, sock -> type ) ; else request_module ( "net-pf-%d-proto-%d", PF_INET, protocol ) ; goto lookup_protocol ; } else goto out_rcu_unlock ; } err = - EPERM ; if ( sock -> type == SOCK_RAW &&! kern &&! ns_capable ( net -> user_ns, CAP_NET_RAW ) ) goto out_rcu_unlock ; sock -> ops = answer -> ops ; answer_prot = answer -> prot ; answer_flags = answer -> flags ; rcu_read_unlock ( ) ; WARN_ON (! answer_prot -> slab ) ; err = - ENOBUFS ; sk = sk_alloc ( net, PF_INET, GFP_KERNEL, answer_prot, kern ) ; if (! sk ) goto out ; err = 0 ; if ( INET_PROTOSW_REUSE & answer_flags ) sk -> sk_reuse = SK_CAN_REUSE ; inet = inet_sk ( sk ) ; inet -> is_icsk = ( INET_PROTOSW_IC

Fix:
<S2SV_ModStart> ; int err ; if ( protocol < 0 || protocol >= IPPROTO_MAX ) return - EINVAL
Buggy code:
 static Image * ReadHDRImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char format [ MaxTextExtent ], keyword [ MaxTextExtent ], tag [ MaxTextExtent ], value [ MaxTextExtent ] ; double gamma ; Image * image ; int c ; MagickBooleanType status, value_expected ; register PixelPacket * q ; register unsigned char * p ; register ssize_t i, x ; ssize_t count, y ; unsigned char * end, pixel [ 4 ], * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> columns = 0 ; image -> rows = 0 ; * format = '\\0' ; c = ReadBlobByte ( image ) ; if ( c == EOF ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } while ( isgraph ( c ) && ( image -> columns == 0 ) && ( image -> rows == 0 ) ) { if ( c == ( int ) '#' ) { char * comment ; register char * p ; size_t length ; length = MaxTextExtent ; comment = AcquireString ( ( char * ) NULL ) ; for ( p = comment ; comment!= ( char * ) NULL ; p ++ ) { c = ReadBlobByte ( image ) ; if ( ( c == EOF ) || ( c == ( int ) '\\n' ) ) break ; if ( ( size_t ) ( p - comment + 1 ) >= length ) { * p = '\\0' ; length <<= 1 ; comment = ( char * ) ResizeQuantumMemory ( comment, length + MaxTextExtent, sizeof ( * comment ) ) ; if ( comment == ( char * ) NULL ) break ; p = comment + strlen ( comment ) ; }

Fix:
<S2SV_ModStart> ) ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static struct sk_buff * nf_ct_frag6_reasm ( struct nf_ct_frag6_queue * fq, struct net_device * dev ) { struct sk_buff * fp, * op, * head = fq -> q. fragments ; int payload_len ; fq_kill ( fq ) ; WARN_ON ( head == NULL ) ; WARN_ON ( NFCT_FRAG6_CB ( head ) -> offset!= 0 ) ; payload_len = ( ( head -> data - skb_network_header ( head ) ) - sizeof ( struct ipv6hdr ) + fq -> q. len - sizeof ( struct frag_hdr ) ) ; if ( payload_len > IPV6_MAXPLEN ) { pr_debug ( "payload   len   is   too   large.\\n" ) ; goto out_oversize ; } if ( skb_cloned ( head ) && pskb_expand_head ( head, 0, 0, GFP_ATOMIC ) ) { pr_debug ( "skb   is   cloned   but   can\'t   expand   head" ) ; goto out_oom ; } if ( skb_has_frags ( head ) ) { struct sk_buff * clone ; int i, plen = 0 ; if ( ( clone = alloc_skb ( 0, GFP_ATOMIC ) ) == NULL ) { pr_debug ( "Can\'t   alloc   skb\\n" ) ; goto out_oom ; } clone -> next = head -> next ; head -> next = clone ; skb_shinfo ( clone ) -> frag_list = skb_shinfo ( head ) -> frag_list ; skb_frag_list_init ( head ) ; for ( i = 0 ; i < skb_shinfo ( head ) -> nr_frags ; i ++ ) plen += skb_shinfo ( head ) -> frags [ i ]. size ; clone -> len = clone -> data_len = head -> data_len - plen ; head -> data_len -= clone -> len ; head -> len -= clone -> len ; clone -> csum = 0 ; clone -> ip_summed = head -> ip_summed ; NFCT_FRAG6_CB ( clone ) -> orig = NULL ; atomic_add ( clone -> truesize, & nf_init

Fix:
<S2SV_ModStart> ; if ( fp &&
Buggy code:
 struct sk_buff * skb_segment ( struct sk_buff * head_skb, netdev_features_t features ) { struct sk_buff * segs = NULL ; struct sk_buff * tail = NULL ; struct sk_buff * list_skb = skb_shinfo ( head_skb ) -> frag_list ; skb_frag_t * frag = skb_shinfo ( head_skb ) -> frags ; unsigned int mss = skb_shinfo ( head_skb ) -> gso_size ; <START_BUG> unsigned int doffset = head_skb -> data - skb_mac_header ( head_skb ) ; <END_BUG> unsigned int offset = doffset ; unsigned int tnl_hlen = skb_tnl_header_len ( head_skb ) ; unsigned int headroom ; unsigned int len ; __be16 proto ; bool csum ; int sg =!! ( features & NETIF_F_SG ) ; int nfrags = skb_shinfo ( head_skb ) -> nr_frags ; int err = - ENOMEM ; int i = 0 ; int pos ; proto = skb_network_protocol ( head_skb ) ; if ( unlikely (! proto ) ) return ERR_PTR ( - EINVAL ) ; csum =!! can_checksum_protocol ( features, proto ) ; __skb_push ( head_skb, doffset ) ; headroom = skb_headroom ( head_skb ) ; pos = skb_headlen ( head_skb ) ; do { struct sk_buff * nskb ; skb_frag_t * nskb_frag ; int hsize ; int size ; len = head_skb -> len - offset ; if ( len > mss ) len = mss ; hsize = skb_headlen ( head_skb ) - offset ; if ( hsize < 0 ) hsize = 0 ; if ( hsize > len ||! sg ) hsize = len ; if (! hsize && i >= nfrags && skb_headlen ( list_skb ) && ( skb_headlen ( list_skb ) == len || sg ) ) { BUG_ON ( skb_headlen ( list_skb ) > len ) ; i = 0

Fix:
<S2SV_ModStart> ( head_skb ) ; struct sk_buff * frag_skb = head_skb <S2SV_ModStart> -> frags ; frag_skb = list_skb ; <S2SV_ModStart> -> frags ; frag_skb = list_skb ; <S2SV_ModStart> err ; } if ( unlikely ( skb_orphan_frags ( frag_skb, GFP_ATOMIC ) ) ) goto err ;
Buggy code:
 static int pgx_gethdr ( jas_stream_t * in, pgx_hdr_t * hdr ) { int c ; <START_BUG> uchar buf [ 2 ] ; <END_BUG> if ( ( c = jas_stream_getc ( in ) ) == EOF ) { goto error ; } buf [ 0 ] = c ; if ( ( c = jas_stream_getc ( in ) ) == EOF ) { goto error ; } buf [ 1 ] = c ; hdr -> magic = buf [ 0 ] << 8 | buf [ 1 ] ; if ( hdr -> magic!= PGX_MAGIC ) { jas_eprintf ( "invalid   PGX   signature\\n" ) ; goto error ; } if ( ( c = pgx_getc ( in ) ) == EOF ||! isspace ( c ) ) { goto error ; } if ( pgx_getbyteorder ( in, & hdr -> bigendian ) ) { jas_eprintf ( "cannot   get   byte   order\\n" ) ; goto error ; } if ( pgx_getsgnd ( in, & hdr -> sgnd ) ) { jas_eprintf ( "cannot   get   signedness\\n" ) ; goto error ; } if ( pgx_getuint32 ( in, & hdr -> prec ) ) { jas_eprintf ( "cannot   get   precision\\n" ) ; goto error ; } if ( pgx_getuint32 ( in, & hdr -> width ) ) { jas_eprintf ( "cannot   get   width\\n" ) ; goto error ; } if ( pgx_getuint32 ( in, & hdr -> height ) ) { jas_eprintf ( "cannot   get   height\\n" ) ; goto error ; } return 0 ; error : return - 1 ; }

Fix:
<S2SV_ModStart> int c ; jas_uchar <S2SV_ModEnd> buf [ 2
Buggy code:
 static int name_len ( netdissect_options * ndo, const unsigned char * s, const unsigned char * maxbuf ) { const unsigned char * s0 = s ; unsigned char c ; if ( s >= maxbuf ) return ( - 1 ) ; ND_TCHECK2 ( * s, 1 ) ; c = * s ; if ( ( c & 0xC0 ) == 0xC0 ) return ( 2 ) ; while ( * s ) { if ( s >= maxbuf ) return ( - 1 ) ; ND_TCHECK2 ( * s, 1 ) ; s += ( * s ) + 1 ; <START_BUG> } <END_BUG> return ( PTR_DIFF ( s, s0 ) + 1 ) ; trunc : return ( - 1 ) ; }

Fix:
<S2SV_ModStart> + 1 ; ND_TCHECK2 ( * s, 1 ) ;
Buggy code:
 static int get_bitmap_file ( struct mddev * mddev, void __user * arg ) { mdu_bitmap_file_t * file = NULL ; char * ptr ; int err ; <START_BUG> file = kmalloc ( sizeof ( * file ), GFP_NOIO ) ; <END_BUG> if (! file ) return - ENOMEM ; err = 0 ; spin_lock ( & mddev -> lock ) ; if (! mddev -> bitmap_info. file ) file -> pathname [ 0 ] = '\\0' ; else if ( ( ptr = file_path ( mddev -> bitmap_info. file, file -> pathname, sizeof ( file -> pathname ) ) ), IS_ERR ( ptr ) ) err = PTR_ERR ( ptr ) ; else memmove ( file -> pathname, ptr, sizeof ( file -> pathname ) - ( ptr - file -> pathname ) ) ; spin_unlock ( & mddev -> lock ) ; if ( err == 0 && copy_to_user ( arg, file, sizeof ( * file ) ) ) err = - EFAULT ; kfree ( file ) ; return err ; }

Fix:
<S2SV_ModStart> ; file = kzalloc <S2SV_ModEnd> ( sizeof (
Buggy code:
 static int cp2112_gpio_direction_output ( struct gpio_chip * chip, unsigned offset, int value ) { struct cp2112_device * dev = gpiochip_get_data ( chip ) ; struct hid_device * hdev = dev -> hdev ; u8 * buf = dev -> in_out_buffer ; <START_BUG> unsigned long flags ; <END_BUG> int ret ;  spin_lock_irqsave ( & dev -> lock, flags ) ; <START_BUG> ret = hid_hw_raw_request ( hdev, CP2112_GPIO_CONFIG, buf, CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, HID_REQ_GET_REPORT ) ; if ( ret!= CP2112_GPIO_CONFIG_LENGTH ) { hid_err ( hdev, "error   requesting   GPIO   config:   %d\\n", ret ) ; goto fail ; } buf [ 1 ] |= 1 << offset ; buf [ 2 ] = gpio_push_pull ; ret = hid_hw_raw_request ( hdev, CP2112_GPIO_CONFIG, buf, CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, HID_REQ_SET_REPORT ) ; if ( ret < 0 ) { hid_err ( hdev, "error   setting   GPIO   config:   %d\\n", ret ) ; goto fail ; } <END_BUG> spin_unlock_irqrestore ( & dev -> lock, flags ) ;  cp2112_gpio_set ( chip, offset, value ) ; return 0 ; fail : <START_BUG> spin_unlock_irqrestore ( & dev -> lock, flags ) ; <END_BUG> return ret < 0? ret : - EIO ; }

Fix:
<S2SV_ModStart> -> in_out_buffer ; <S2SV_ModEnd> int ret ; <S2SV_ModStart> int ret ; mutex_lock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; ret <S2SV_ModStart> fail ; } mutex_unlock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; cp2112_gpio_set <S2SV_ModStart> ; fail : mutex_unlock <S2SV_ModEnd> ( & dev <S2SV_ModStart> dev -> lock <S2SV_ModEnd> ) ; return
Buggy code:
 void ping_unhash ( struct sock * sk ) { struct inet_sock * isk = inet_sk ( sk ) ; pr_debug ( "ping_unhash(isk=%p,isk->num=%u)\\n", isk, isk -> inet_num ) ; if ( sk_hashed ( sk ) ) { write_lock_bh ( & ping_table. lock ) ; hlist_nulls_del ( & sk -> sk_nulls_node ) ; <START_BUG> sock_put ( sk ) ; <END_BUG> isk -> inet_num = 0 ; isk -> inet_sport = 0 ; sock_prot_inuse_add ( sock_net ( sk ), sk -> sk_prot, - 1 ) ; write_unlock_bh ( & ping_table. lock ) ; } }

Fix:
<S2SV_ModStart> sk_nulls_node ) ; sk_nulls_node_init ( & sk -> sk_nulls_node ) ;
Buggy code:
 void lcdSetPixels_ArrayBuffer_flat ( JsGraphics * gfx, short x, short y, short pixelCount, unsigned int col ) { unsigned char * ptr = ( unsigned char * ) gfx -> backendData ; unsigned int idx = lcdGetPixelIndex_ArrayBuffer ( gfx, x, y, pixelCount ) ; ptr += idx >> 3 ; unsigned int whiteMask = ( 1U << gfx -> data. bpp ) - 1 ; bool shortCut = ( col == 0 || ( col & whiteMask ) == whiteMask ) && (! ( gfx -> data. flags & JSGRAPHICSFLAGS_ARRAYBUFFER_VERTICAL_BYTE ) ) ; while ( pixelCount -- ) { if ( gfx -> data. bpp & 7 ) { idx = idx & 7 ; if ( shortCut && idx == 0 ) { int wholeBytes = ( gfx -> data. bpp * ( pixelCount + 1 ) ) >> 3 ; if ( wholeBytes ) { char c = ( char ) ( col? 0xFF : 0 ) ; pixelCount = ( short ) ( pixelCount + 1 - ( wholeBytes * 8 // gfx -> data. bpp ) ) ; while ( wholeBytes -- ) { * ptr = c ; ptr ++ ; } continue ; } } unsigned int mask = ( unsigned int ) ( 1 << gfx -> data. bpp ) - 1 ; unsigned int existing = ( unsigned int ) * ptr ; unsigned int bitIdx = ( gfx -> data. flags & JSGRAPHICSFLAGS_ARRAYBUFFER_MSB )? 8 - ( idx + gfx -> data. bpp ) : idx ; <START_BUG> * ptr = ( char ) ( ( existing & ~ ( mask << bitIdx ) ) | ( ( col & mask ) << bitIdx ) ) ; <END_BUG> if ( gfx -> data. flags & JSGRAPHICSFLAGS_ARRAYBUFFER_VERTICAL_BYTE ) { ptr ++ ; } else { idx += gfx -> data. bpp ; if ( idx >= 8 ) ptr ++ ; } } else { int i ; for ( i = 0 ; i < gfx -> data. bpp ; i += 8 ) { * ptr = ( char ) ( col >> i ) ; ptr ++ ; } } } }

Fix:
<S2SV_ModStart> : idx ; assert ( ptr >= gfx -> backendData && ptr < ( ( char * ) gfx -> backendData + graphicsGetMemoryRequired ( gfx ) ) ) ;
Buggy code:
 int blk_rq_map_user_iov ( struct request_queue * q, struct request * rq, struct rq_map_data * map_data, const struct iov_iter * iter, gfp_t gfp_mask ) { bool copy = false ; unsigned long align = q -> dma_pad_mask | queue_dma_alignment ( q ) ; struct bio * bio = NULL ; struct iov_iter i ; int ret ; <START_BUG> if ( map_data ) <END_BUG> copy = true ; else if ( iov_iter_alignment ( iter ) & align ) copy = true ; else if ( queue_virt_boundary ( q ) ) copy = queue_virt_boundary ( q ) & iov_iter_gap_alignment ( iter ) ; i = * iter ; do { ret = __blk_rq_map_user_iov ( rq, map_data, & i, gfp_mask, copy ) ; if ( ret ) goto unmap_rq ; if (! bio ) bio = rq -> bio ; } while ( iov_iter_count ( & i ) ) ; if (! bio_flagged ( bio, BIO_USER_MAPPED ) ) rq -> cmd_flags |= REQ_COPY_USER ; return 0 ; unmap_rq : __blk_rq_unmap_user ( bio ) ;  rq -> bio = NULL ; <START_BUG> return - EINVAL ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if (! iter_is_iovec ( iter ) ) goto fail ; if ( <S2SV_ModStart> bio ) ; fail :
Buggy code:
 static int fanout_add ( struct sock * sk, u16 id, u16 type_flags ) { <START_BUG> struct packet_sock * po = pkt_sk ( sk ) ; <END_BUG> struct packet_fanout * f, * match ; u8 type = type_flags & 0xff ; u8 flags = type_flags >> 8 ; int err ; switch ( type ) { case PACKET_FANOUT_ROLLOVER : if ( type_flags & PACKET_FANOUT_FLAG_ROLLOVER ) return - EINVAL ; case PACKET_FANOUT_HASH : case PACKET_FANOUT_LB : case PACKET_FANOUT_CPU : case PACKET_FANOUT_RND : case PACKET_FANOUT_QM : case PACKET_FANOUT_CBPF : case PACKET_FANOUT_EBPF : break ; default : return - EINVAL ; }  if (! po -> running ) <START_BUG> <END_BUG> return - EINVAL ;  if ( po -> fanout ) <START_BUG> return - EALREADY ; <END_BUG> if ( type == PACKET_FANOUT_ROLLOVER || ( type_flags & PACKET_FANOUT_FLAG_ROLLOVER ) ) {  po -> rollover = kzalloc ( sizeof ( * po -> rollover ), GFP_KERNEL ) ; <START_BUG> <END_BUG> if (! po -> rollover )  return - ENOMEM ; <START_BUG> atomic_long_set ( & po -> rollover -> num, 0 ) ; <END_BUG>  atomic_long_set ( & po -> rollover -> num_huge, 0 ) ; <START_BUG> <END_BUG> atomic_long_set ( & po -> rollover -> num_failed, 0 ) ;  <START_BUG> } <END_BUG> mutex_lock ( & fanout_mutex ) ; match = NULL ; list_for_each_entry ( f, & fanout_list, list ) { if ( f -> id == id && read_pnet ( & f -> net ) == sock_net ( sk ) ) { match = f ; break ; } } err = - EINVAL ; if ( match && match -> flags!= flags ) goto out ; if (! match ) { err = - ENOMEM ; match = kzalloc ( sizeof ( * match ), GFP_KERNEL ) ; if (! match ) goto out

Fix:
<S2SV_ModStart> ) { struct packet_rollover * rollover = NULL ; struct <S2SV_ModStart> EINVAL ; } mutex_lock ( & fanout_mutex ) ; err = - EINVAL ; <S2SV_ModStart> -> running ) goto out ; err = - EALREADY <S2SV_ModEnd> ; if ( <S2SV_ModStart> -> fanout ) goto out <S2SV_ModEnd> ; if ( <S2SV_ModStart> ) ) { err = - ENOMEM ; <S2SV_ModEnd> rollover = kzalloc <S2SV_ModStart> sizeof ( * <S2SV_ModEnd> rollover ), <S2SV_ModStart> if (! rollover ) goto out <S2SV_ModEnd> ; atomic_long_set ( <S2SV_ModStart> atomic_long_set ( & <S2SV_ModEnd> rollover -> num <S2SV_ModStart> atomic_long_set ( & <S2SV_ModEnd> rollover -> num_huge <S2SV_ModStart> atomic_long_set ( & <S2SV_ModEnd> rollover -> num_failed <S2SV_ModStart> 0 ) ; po -> rollover = rollover ; } <S2SV_ModEnd> match = NULL <S2SV_ModStart> } out : if ( err && rollover ) { kfree ( rollover ) ; po -> rollover = NULL ; } <S2SV_ModStart> fanout_mutex ) ; <S2SV_ModEnd> return err ;
Buggy code:
 static int parse_options ( char * options, struct super_block * sb, unsigned long * journal_devnum, unsigned int * journal_ioprio, ext4_fsblk_t * n_blocks_count, int is_remount ) { struct ext4_sb_info * sbi = EXT4_SB ( sb ) ; char * p ; substring_t args [ MAX_OPT_ARGS ] ; int data_opt = 0 ; int option ; # ifdef CONFIG_QUOTA int qfmt ; # endif if (! options ) return 1 ; while ( ( p = strsep ( & options, "," ) )!= NULL ) { int token ; if (! * p ) continue ; args [ 0 ]. to = args [ 0 ]. from = 0 ; token = match_token ( p, tokens, args ) ; switch ( token ) { case Opt_bsd_df : ext4_msg ( sb, KERN_WARNING, deprecated_msg, p, "2.6.38" ) ; clear_opt ( sbi -> s_mount_opt, MINIX_DF ) ; break ; case Opt_minix_df : ext4_msg ( sb, KERN_WARNING, deprecated_msg, p, "2.6.38" ) ; set_opt ( sbi -> s_mount_opt, MINIX_DF ) ; break ; case Opt_grpid : ext4_msg ( sb, KERN_WARNING, deprecated_msg, p, "2.6.38" ) ; set_opt ( sbi -> s_mount_opt, GRPID ) ; break ; case Opt_nogrpid : ext4_msg ( sb, KERN_WARNING, deprecated_msg, p, "2.6.38" ) ; clear_opt ( sbi -> s_mount_opt, GRPID ) ; break ; case Opt_resuid : if ( match_int ( & args [ 0 ], & option ) ) return 0 ; sbi -> s_resuid = option ; break ; case Opt_resgid : if ( match_int ( & args [ 0 ], & option ) ) return 0 ; sbi -> s_resgid = option ; break ; case Opt_sb : break ; case Opt_err_panic : clear_opt ( sbi -> s_

Fix:
<S2SV_ModStart> ; break ; case Opt_dioread_nolock : set_opt ( sbi -> s_mount_opt, DIOREAD_NOLOCK ) ; break ; case Opt_dioread_lock : clear_opt ( sbi -> s_mount_opt, DIOREAD_NOLOCK ) ; break ;
Buggy code:
 static int readContigTilesIntoBuffer ( TIFF * in, uint8 * buf, uint32 imagelength, uint32 imagewidth, uint32 tw, uint32 tl, tsample_t spp, uint16 bps ) { int status = 1 ; tsample_t sample = 0 ; tsample_t count = spp ; uint32 row, col, trow ; uint32 nrow, ncol ; uint32 dst_rowsize, shift_width ; uint32 bytes_per_sample, bytes_per_pixel ; uint32 trailing_bits, prev_trailing_bits ; uint32 tile_rowsize = TIFFTileRowSize ( in ) ; uint32 src_offset, dst_offset ; uint32 row_offset, col_offset ; uint8 * bufp = ( uint8 * ) buf ; unsigned char * src = NULL ; unsigned char * dst = NULL ; tsize_t tbytes = 0, tile_buffsize = 0 ; tsize_t tilesize = TIFFTileSize ( in ) ; unsigned char * tilebuf = NULL ; bytes_per_sample = ( bps + 7 ) // 8 ; bytes_per_pixel = ( ( bps * spp ) + 7 ) // 8 ; if ( ( bps % 8 ) == 0 ) shift_width = 0 ; else { if ( bytes_per_pixel < ( bytes_per_sample + 1 ) ) shift_width = bytes_per_pixel ; else shift_width = bytes_per_sample + 1 ; } tile_buffsize = tilesize ; if ( tilesize == 0 || tile_rowsize == 0 ) { TIFFError ( "readContigTilesIntoBuffer", "Tile   size   or   tile   rowsize   is   zero" ) ; exit ( - 1 ) ; } if ( tilesize < ( tsize_t ) ( tl * tile_rowsize ) ) { # ifdef DEBUG2 TIFFError ( "readContigTilesIntoBuffer", "Tilesize   %lu   is   too   small,   using   alternate   calculation   %u", tilesize, tl * tile_rowsize ) ; # endif tile_buffsize = tl * tile_rowsize ; if ( tl!= ( tile_buffsize // tile_rowsize ) ) { TIFFError ( "readContigTilesIntoBuffer", "Integer   overflow   when  

Fix:
<S2SV_ModStart> ; } } if ( tile_buffsize > 0xFFFFFFFFU - 3 ) { TIFFError ( "readContigTilesIntoBuffer", "Integer <S2SV_blank> overflow <S2SV_blank> when <S2SV_blank> calculating <S2SV_blank> buffer <S2SV_blank> size." ) ; exit ( - 1 ) ; } <S2SV_ModStart> _TIFFmalloc ( tile_buffsize + 3 <S2SV_ModStart> 0 ) return 0 ; tilebuf [ tile_buffsize ] = 0 ; tilebuf [ tile_buffsize + 1 ] = 0 ; tilebuf [ tile_buffsize + 2 ] =
Buggy code:
 void test_base64_lengths ( void ) { const char * in = "FuseMuse" ; char out1 [ 32 ] ; char out2 [ 32 ] ; size_t enclen ; int declen ; enclen = mutt_b64_encode ( out1, in, 0, 32 ) ; if (! TEST_CHECK ( enclen == 0 ) ) { TEST_MSG ( "Expected:   %zu", 0 ) ; TEST_MSG ( "Actual     :   %zu", enclen ) ; } out1 [ 0 ] = '\\0' ; <START_BUG> declen = mutt_b64_decode ( out2, out1 ) ; <END_BUG> if (! TEST_CHECK ( declen == - 1 ) ) { TEST_MSG ( "Expected:   %zu", - 1 ) ; TEST_MSG ( "Actual     :   %zu", declen ) ; } for ( size_t i = 1 ; i <= 8 ; ++ i ) { enclen = mutt_b64_encode ( out1, in, i, 32 ) ; size_t exp = ( ( i + 2 ) // 3 ) << 2 ; if (! TEST_CHECK ( enclen == exp ) ) { TEST_MSG ( "Expected:   %zu", exp ) ; TEST_MSG ( "Actual     :   %zu", enclen ) ; }  declen = mutt_b64_decode ( out2, out1 ) ; <START_BUG> if (! TEST_CHECK ( declen == i ) ) { TEST_MSG ( "Expected:   %zu", i ) ; TEST_MSG ( "Actual     :   %zu", declen ) ; } out2 [ declen ] = '\\0' ; if (! TEST_CHECK ( strncmp ( out2, in, i ) == 0 ) ) { TEST_MSG ( "Expected:   %s", in ) ; TEST_MSG ( "Actual     :   %s", out2 ) ; } } }<END_BUG>

Fix:
<S2SV_ModStart> out2, out1, sizeof ( out2 ) <S2SV_ModStart> out2, out1, sizeof ( out2 )
Buggy code:
 int commonio_sort ( struct commonio_db * db, int ( * cmp ) ( const void *, const void * ) ) { struct commonio_entry * * entries, * ptr ; size_t n = 0, i ; # if KEEP_NIS_AT_END struct commonio_entry * nis = NULL ; # endif for ( ptr = db -> head ; ( NULL!= ptr ) # if KEEP_NIS_AT_END <START_BUG> && ( NULL!= ptr -> line ) <END_BUG>  && ( ( '+'!= ptr -> line [ 0 ] ) <START_BUG> <END_BUG> && ( '-'!= ptr -> line [ 0 ] ) )  # endif ; ptr = ptr -> next ) { n ++ ; } # if KEEP_NIS_AT_END <START_BUG> if ( ( NULL!= ptr ) && ( NULL!= ptr -> line ) ) { <END_BUG> nis = ptr ; } # endif if ( n <= 1 ) { return 0 ; } entries = malloc ( n * sizeof ( struct commonio_entry * ) ) ; if ( entries == NULL ) { return - 1 ; } n = 0 ; for ( ptr = db -> head ; # if KEEP_NIS_AT_END nis!= ptr ; # else NULL!= ptr ; # endif ptr = ptr -> next ) { entries [ n ] = ptr ; n ++ ; } qsort ( entries, n, sizeof ( struct commonio_entry * ), cmp ) ; db -> head = entries [ 0 ] ; n -- ; # if KEEP_NIS_AT_END if ( NULL == nis ) # endif { db -> tail = entries [ n ] ; } db -> head -> prev = NULL ; db -> head -> next = entries [ 1 ] ; entries [ n ] -> prev = entries [ n - 1 ] ; # if KEEP_NIS_AT_END entries [ n ] -> next = nis ; # else entries [ n ] -> next = NULL ; # endif for ( i = 1 ; i < n ; i ++ ) { entries [ i ] -> prev = entries [ i - 1 ] ; entries [ i ] -> next = entries [ i + 1 ] ; } free ( entries ) ; db -> changed = true ; return 0 ; }

Fix:
<S2SV_ModStart> KEEP_NIS_AT_END && ( ( NULL == <S2SV_ModEnd> ptr -> line <S2SV_ModStart> -> line ) || ( ( '+'!= ptr -> line [ 0 ] ) && ( '-' <S2SV_ModEnd>!= ptr -> <S2SV_ModStart> 0 ] ) <S2SV_ModEnd> ) ) # <S2SV_ModStart> KEEP_NIS_AT_END if ( NULL!= ptr <S2SV_ModEnd> ) { nis
Buggy code:
 static void record_and_restart ( struct perf_event * event, unsigned long val, <START_BUG> struct pt_regs * regs, int nmi ) <END_BUG> { u64 period = event -> hw. sample_period ; s64 prev, delta, left ; int record = 0 ; if ( event -> hw. state & PERF_HES_STOPPED ) { write_pmc ( event -> hw. idx, 0 ) ; return ; } prev = local64_read ( & event -> hw. prev_count ) ; delta = check_and_compute_delta ( prev, val ) ; local64_add ( delta, & event -> count ) ; val = 0 ; left = local64_read ( & event -> hw. period_left ) - delta ; if ( period ) { if ( left <= 0 ) { left += period ; if ( left <= 0 ) left = period ; record = 1 ; event -> hw. last_period = event -> hw. sample_period ; } if ( left < 0x80000000LL ) val = 0x80000000LL - left ; } write_pmc ( event -> hw. idx, val ) ; local64_set ( & event -> hw. prev_count, val ) ; local64_set ( & event -> hw. period_left, left ) ; perf_event_update_userpage ( event ) ; if ( record ) { struct perf_sample_data data ; perf_sample_data_init ( & data, ~ 0ULL ) ; data. period = event -> hw. last_period ; if ( event -> attr. sample_type & PERF_SAMPLE_ADDR ) perf_get_data_addr ( regs, & data. addr ) ;  if ( perf_event_overflow ( event, nmi, & data, regs ) ) <START_BUG> power_pmu_stop ( event, 0 ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> pt_regs * regs <S2SV_ModEnd> ) { u64 <S2SV_ModStart> ( event, <S2SV_ModEnd> & data,
Buggy code:
 static struct ucma_multicast * ucma_alloc_multicast ( struct ucma_context * ctx ) { struct ucma_multicast * mc ; mc = kzalloc ( sizeof ( * mc ), GFP_KERNEL ) ; if (! mc ) return NULL ; mutex_lock ( & mut ) ; <START_BUG> mc -> id = idr_alloc ( & multicast_idr, mc, 0, 0, GFP_KERNEL ) ; <END_BUG> mutex_unlock ( & mut ) ; if ( mc -> id < 0 ) goto error ; mc -> ctx = ctx ; list_add_tail ( & mc -> list, & ctx -> mc_list ) ; return mc ; error : kfree ( mc ) ; return NULL ; }

Fix:
<S2SV_ModStart> & multicast_idr, NULL <S2SV_ModEnd>, 0,
Buggy code:
 static int parse_exp ( Node * * np, PToken * tok, int term, UChar * * src, UChar * end, ScanEnv * env, int group_head ) { <START_BUG> int r, len, group = 0 ; <END_BUG> Node * qn ;  Node * * tp ; <START_BUG> * np = NULL ; if ( tok -> type == ( enum TokenSyms ) term ) <END_BUG> goto end_of_token ;  switch ( tok -> type ) { case TK_ALT : case TK_EOT : end_of_token : * np = node_new_empty ( ) ; CHECK_NULL_RETURN_MEMERR ( * np ) ; return tok -> type ; break ; case TK_SUBEXP_OPEN : r = parse_bag ( np, tok, TK_SUBEXP_CLOSE, src, end, env ) ; if ( r < 0 ) return r ; if ( r == 1 ) { if ( group_head == 0 ) group = 1 ; else { Node * target = * np ; * np = node_new_group ( target ) ; if ( IS_NULL ( * np ) ) { onig_node_free ( target ) ; return ONIGERR_MEMORY ; } group = 2 ; } } else if ( r == 2 ) { Node * target ; OnigOptionType prev = env -> options ; env -> options = BAG_ ( * np ) -> o. options ; r = fetch_token ( tok, src, end, env ) ; if ( r < 0 ) return r ; r = parse_subexp ( & target, tok, term, src, end, env, 0 ) ; env -> options = prev ; if ( r < 0 ) { onig_node_free ( target ) ; return r ; } NODE_BODY ( * np ) = target ; return tok -> type ; } break ; case TK_SUBEXP_CLOSE : if (! IS_SYNTAX_BV ( env -> syntax, ONIG_SYN_ALLOW_UNMATCHED_CLOSE_SUBEXP ) ) return ONIGERR_UNMATCHED_CLOSE_PARENTHESIS ; if ( tok -> escaped ) goto tk_raw_byte ; else goto tk_byte ; break ; case TK_STRING : tk_byte : { * np = node_new_str ( tok -> backp, * src ) ; CHECK

Fix:
<S2SV_ModStart> len, group <S2SV_ModEnd> ; Node * <S2SV_ModStart> * * tp ; unsigned int parse_depth ; group = 0 <S2SV_ModStart> ) goto end_of_token ; parse_depth = env -> parse_depth <S2SV_ModStart> return ONIGERR_TARGET_OF_REPEAT_OPERATOR_INVALID ; parse_depth ++ ; if ( parse_depth > ParseDepthLimit ) return ONIGERR_PARSE_DEPTH_LIMIT_OVER ;
Buggy code:
 static int adjust_scalar_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, struct bpf_reg_state * dst_reg, struct bpf_reg_state src_reg ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; bool src_known, dst_known ; s64 smin_val, smax_val ; u64 umin_val, umax_val ; <START_BUG> u64 insn_bitness = ( BPF_CLASS ( insn -> code ) == BPF_ALU64 )? 64 : 32 ; <END_BUG> smin_val = src_reg. smin_value ; smax_val = src_reg. smax_value ; umin_val = src_reg. umin_value ; umax_val = src_reg. umax_value ; src_known = tnum_is_const ( src_reg. var_off ) ; dst_known = tnum_is_const ( dst_reg -> var_off ) ; if ( ( src_known && ( smin_val!= smax_val || umin_val!= umax_val ) ) || smin_val > smax_val || umin_val > umax_val ) { __mark_reg_unknown ( dst_reg ) ; return 0 ; } if (! src_known && opcode!= BPF_ADD && opcode!= BPF_SUB && opcode!= BPF_AND ) { __mark_reg_unknown ( dst_reg ) ; return 0 ; } switch ( opcode ) { case BPF_ADD : if ( signed_add_overflows ( dst_reg -> smin_value, smin_val ) || signed_add_overflows ( dst_reg -> smax_value, smax_val ) ) { dst_reg -> smin_value = S64_MIN ; dst_reg -> smax_value = S64_MAX ; } else { dst_reg -> smin_value += smin_val ; dst_reg -> smax_value += smax_val ; } if ( dst_reg -> umin_value + umin_val < umin_val || dst_reg -> umax_

Fix:
<S2SV_ModStart> : 32 ; if ( insn_bitness == 32 ) { coerce_reg_to_size ( dst_reg, 4 ) ; coerce_reg_to_size ( & src_reg, 4 ) ; } <S2SV_ModStart> 4 ) ; <S2SV_ModEnd> } __reg_deduce_bounds (
Buggy code:
 static int jpc_ppm_getparms ( jpc_ms_t * ms, jpc_cstate_t * cstate, jas_stream_t * in ) { jpc_ppm_t * ppm = & ms -> parms. ppm ; cstate = 0 ; ppm -> data = 0 ; if ( ms -> len < 1 ) { goto error ; } if ( jpc_getuint8 ( in, & ppm -> ind ) ) { goto error ; } ppm -> len = ms -> len - 1 ; if ( ppm -> len > 0 ) { if (! ( ppm -> data = jas_malloc ( ppm -> len ) ) ) { goto error ; } <START_BUG> if ( JAS_CAST ( uint, jas_stream_read ( in, ppm -> data, ppm -> len ) )!= ppm -> len ) { <END_BUG> goto error ; } } else { ppm -> data = 0 ; } return 0 ; error : jpc_ppm_destroyparms ( ms ) ; return - 1 ; }

Fix:
<S2SV_ModStart> ( JAS_CAST ( jas_uint <S2SV_ModEnd>, jas_stream_read (
Buggy code:
 <START_BUG> INST_HANDLER ( lds ) { <END_BUG> int d = ( ( buf [ 0 ] >> 4 ) & 0xf ) | ( ( buf [ 1 ] & 0x1 ) << 4 ) ; int k = ( buf [ 3 ] << 8 ) | buf [ 2 ] ; op -> ptr = k ; __generic_ld_st ( op, "ram", 0, 1, 0, k, 0 ) ; ESIL_A ( "r%d,=,", d ) ; }

Fix:
<S2SV_ModStart> lds ) { if ( len < 4 ) { return ; }
Buggy code:
 static int __vcpu_run ( struct kvm_vcpu * vcpu ) { int r ; struct kvm * kvm = vcpu -> kvm ; vcpu -> srcu_idx = srcu_read_lock ( & kvm -> srcu ) ; <START_BUG> r = vapic_enter ( vcpu ) ; <END_BUG> if ( r ) { srcu_read_unlock ( & kvm -> srcu, vcpu -> srcu_idx ) ; return r ; } r = 1 ; while ( r > 0 ) { if ( vcpu -> arch. mp_state == KVM_MP_STATE_RUNNABLE &&! vcpu -> arch. apf. halted ) r = vcpu_enter_guest ( vcpu ) ; else { srcu_read_unlock ( & kvm -> srcu, vcpu -> srcu_idx ) ; kvm_vcpu_block ( vcpu ) ; vcpu -> srcu_idx = srcu_read_lock ( & kvm -> srcu ) ; if ( kvm_check_request ( KVM_REQ_UNHALT, vcpu ) ) { kvm_apic_accept_events ( vcpu ) ; switch ( vcpu -> arch. mp_state ) { case KVM_MP_STATE_HALTED : vcpu -> arch. pv. pv_unhalted = false ; vcpu -> arch. mp_state = KVM_MP_STATE_RUNNABLE ; case KVM_MP_STATE_RUNNABLE : vcpu -> arch. apf. halted = false ; break ; case KVM_MP_STATE_INIT_RECEIVED : break ; default : r = - EINTR ; break ; } } } if ( r <= 0 ) break ; clear_bit ( KVM_REQ_PENDING_TIMER, & vcpu -> requests ) ; if ( kvm_cpu_has_pending_timer ( vcpu ) ) kvm_inject_pending_timer_irqs ( vcpu ) ; if ( dm_request_for_irq_injection ( vcpu ) ) { r = - EINTR ; vcpu -> run -> exit_reason = KVM_EXIT_INTR ; ++ vcpu -> stat. request_irq_exits ; } kvm_check_async_pf_completion ( vcpu

Fix:
<S2SV_ModStart> srcu ) ; <S2SV_ModEnd> r = 1 <S2SV_ModStart> srcu_idx ) ; <S2SV_ModEnd> return r ;
Buggy code:
 long dgnc_mgmt_ioctl ( struct file * file, unsigned int cmd, unsigned long arg ) { unsigned long flags ; void __user * uarg = ( void __user * ) arg ; switch ( cmd ) { case DIGI_GETDD : { struct digi_dinfo ddi ; spin_lock_irqsave ( & dgnc_global_lock, flags ) ; <START_BUG> ddi. dinfo_nboards = dgnc_NumBoards ; <END_BUG> sprintf ( ddi. dinfo_version, "%s", DG_PART ) ; spin_unlock_irqrestore ( & dgnc_global_lock, flags ) ; if ( copy_to_user ( uarg, & ddi, sizeof ( ddi ) ) ) return - EFAULT ; break ; } case DIGI_GETBD : { int brd ; struct digi_info di ; if ( copy_from_user ( & brd, uarg, sizeof ( int ) ) ) return - EFAULT ; if ( brd < 0 || brd >= dgnc_NumBoards ) return - ENODEV ; memset ( & di, 0, sizeof ( di ) ) ; di. info_bdnum = brd ; spin_lock_irqsave ( & dgnc_Board [ brd ] -> bd_lock, flags ) ; di. info_bdtype = dgnc_Board [ brd ] -> dpatype ; di. info_bdstate = dgnc_Board [ brd ] -> dpastatus ; di. info_ioport = 0 ; di. info_physaddr = ( ulong ) dgnc_Board [ brd ] -> membase ; di. info_physsize = ( ulong ) dgnc_Board [ brd ] -> membase - dgnc_Board [ brd ] -> membase_end ; if ( dgnc_Board [ brd ] -> state!= BOARD_FAILED ) di. info_nports = dgnc_Board [ brd ] -> nasync ; else di. info_nports = 0 ; spin_unlock_irqrestore ( & dgnc_Board [ brd ] -> bd_lock, flags ) ; if ( copy_to_user ( uarg, & di, sizeof ( di ) )

Fix:
<S2SV_ModStart> flags ) ; memset ( & ddi, 0, sizeof ( ddi ) ) ;
Buggy code:
 static int aiff_read_chanmap ( SF_PRIVATE * psf, unsigned dword ) { const AIFF_CAF_CHANNEL_MAP * map_info ; unsigned channel_bitmap, channel_decriptions, bytesread ; int layout_tag ; bytesread = psf_binheader_readf ( psf, "444", & layout_tag, & channel_bitmap, & channel_decriptions ) ; if ( ( map_info = aiff_caf_of_channel_layout_tag ( layout_tag ) ) == NULL ) return 0 ; psf_log_printf ( psf, "     Tag         :   %x\\n", layout_tag ) ; if ( map_info ) psf_log_printf ( psf, "     Layout   :   %s\\n", map_info -> name ) ; if ( bytesread < dword ) psf_binheader_readf ( psf, "j", dword - bytesread ) ; if ( map_info -> channel_map!= NULL ) <START_BUG> { size_t chanmap_size = psf -> sf. channels * sizeof ( psf -> channel_map [ 0 ] ) ; <END_BUG> free ( psf -> channel_map ) ; if ( ( psf -> channel_map = malloc ( chanmap_size ) ) == NULL ) return SFE_MALLOC_FAILED ; memcpy ( psf -> channel_map, map_info -> channel_map, chanmap_size ) ; } ; return 0 ; }

Fix:
<S2SV_ModStart> size_t chanmap_size = SF_MIN ( <S2SV_ModStart> sf. channels, layout_tag & 0xffff )
Buggy code:
 static void handle_rx ( struct vhost_net * net ) { struct vhost_net_virtqueue * nvq = & net -> vqs [ VHOST_NET_VQ_RX ] ; struct vhost_virtqueue * vq = & nvq -> vq ; unsigned uninitialized_var ( in ), log ; struct vhost_log * vq_log ; struct msghdr msg = {. msg_name = NULL,. msg_namelen = 0,. msg_control = NULL,. msg_controllen = 0,. msg_iov = vq -> iov,. msg_flags = MSG_DONTWAIT, } ; struct virtio_net_hdr_mrg_rxbuf hdr = {. hdr. flags = 0,. hdr. gso_type = VIRTIO_NET_HDR_GSO_NONE } ; size_t total_len = 0 ; int err, mergeable ; s16 headcount ; size_t vhost_hlen, sock_hlen ; size_t vhost_len, sock_len ; struct socket * sock ; mutex_lock ( & vq -> mutex ) ; sock = vq -> private_data ; if (! sock ) goto out ; vhost_disable_notify ( & net -> dev, vq ) ; vhost_hlen = nvq -> vhost_hlen ; sock_hlen = nvq -> sock_hlen ; vq_log = unlikely ( vhost_has_feature ( & net -> dev, VHOST_F_LOG_ALL ) )? vq -> log : NULL ; mergeable = vhost_has_feature ( & net -> dev, VIRTIO_NET_F_MRG_RXBUF ) ; while ( ( sock_len = peek_head_len ( sock -> sk ) ) ) { sock_len += sock_hlen ; vhost_len = sock_len + vhost_hlen ; headcount = get_rx_bufs ( vq, vq -> heads, vhost_len, & in, vq_log, & log, likely ( mergeable )? UIO_MAXIOV : 1 ) ; if ( unlikely ( headcount < 0 ) ) break ; <START_BUG> if (! headcount ) { <END_BUG> if ( unlikely ( vhost_enable_notify ( & net -> dev, vq )

Fix:
<S2SV_ModStart> ; if ( unlikely ( headcount > UIO_MAXIOV ) ) { <S2SV_ModEnd> msg. msg_iovlen <S2SV_ModStart>. msg_iovlen = 1 <S2SV_ModEnd> ; err = <S2SV_ModStart> & msg, 1 <S2SV_ModEnd>, MSG_DONTWAIT | <S2SV_ModStart> MSG_TRUNC ) ; pr_debug ( "Discarded <S2SV_blank> rx <S2SV_blank> packet: <S2SV_blank> len <S2SV_blank> %zd\\n", sock_len ) ; continue ; } if (! headcount ) { if ( unlikely ( vhost_enable_notify ( & net -> dev, vq ) ) ) { vhost_disable_notify ( & net -> dev, vq ) ; continue ; } break ; } if ( unlikely ( ( vhost_hlen ) ) ) move_iovec_hdr ( vq -> iov, nvq -> hdr, vhost_hlen, in ) ; else copy_iovec_hdr ( vq -> iov, nvq -> hdr, sock_hlen, in ) ; msg. msg_iovlen = in ; err = sock -> ops -> recvmsg ( NULL, sock, & msg, sock_len, MSG_DONTWAIT | MSG_TRUNC ) ;
Buggy code:
 static int irda_create ( struct net * net, struct socket * sock, int protocol, int kern ) { struct sock * sk ; struct irda_sock * self ; <START_BUG> if ( net!= & init_net ) <END_BUG> return - EAFNOSUPPORT ; switch ( sock -> type ) { case SOCK_STREAM : case SOCK_SEQPACKET : case SOCK_DGRAM : break ; default : return - ESOCKTNOSUPPORT ; } sk = sk_alloc ( net, PF_IRDA, GFP_KERNEL, & irda_proto, kern ) ; if ( sk == NULL ) return - ENOMEM ; self = irda_sk ( sk ) ; pr_debug ( "%s()   :   self   is   %p\\n", __func__, self ) ; init_waitqueue_head ( & self -> query_wait ) ; switch ( sock -> type ) { case SOCK_STREAM : sock -> ops = & irda_stream_ops ; self -> max_sdu_size_rx = TTP_SAR_DISABLE ; break ; case SOCK_SEQPACKET : sock -> ops = & irda_seqpacket_ops ; self -> max_sdu_size_rx = TTP_SAR_UNBOUND ; break ; case SOCK_DGRAM : switch ( protocol ) { # ifdef CONFIG_IRDA_ULTRA case IRDAPROTO_ULTRA : sock -> ops = & irda_ultra_ops ; self -> max_data_size = ULTRA_MAX_DATA - LMP_PID_HEADER ; self -> max_header_size = IRDA_MAX_HEADER + LMP_PID_HEADER ; break ; # endif case IRDAPROTO_UNITDATA : sock -> ops = & irda_dgram_ops ; self -> max_sdu_size_rx = TTP_SAR_UNBOUND ; break ; default : sk_free ( sk ) ; return - ESOCKTNOSUPPORT ; } break ; default : sk_free ( sk ) ; return - ESOCKTNOSUPPORT ; } sock_init_data ( sock, sk ) ; sk -> sk_family = PF_IRDA ; sk -> sk_protocol = protocol ; self -> ckey = irlmp_register_client ( 0, NULL, NULL, NULL

Fix:
<S2SV_ModStart> ; if ( protocol < 0 || protocol > SK_PROTOCOL_MAX ) return - EINVAL ; if (
Buggy code:
 static void mspack_fmap_free ( void * mem ) { <START_BUG> free ( mem ) ; <END_BUG>  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> mem ) { if ( mem ) { <S2SV_ModStart> mem ) ; mem = NULL ; } return ;
Buggy code:
 static int ip6_frag_queue ( struct frag_queue * fq, struct sk_buff * skb, struct frag_hdr * fhdr, int nhoff ) { struct sk_buff * prev, * next ; struct net_device * dev ; int offset, end ; struct net * net = dev_net ( skb_dst ( skb ) -> dev ) ; if ( fq -> q. last_in & INET_FRAG_COMPLETE ) goto err ; offset = ntohs ( fhdr -> frag_off ) & ~ 0x7 ; end = offset + ( ntohs ( ipv6_hdr ( skb ) -> payload_len ) - ( ( u8 * ) ( fhdr + 1 ) - ( u8 * ) ( ipv6_hdr ( skb ) + 1 ) ) ) ; if ( ( unsigned int ) end > IPV6_MAXPLEN ) { IP6_INC_STATS_BH ( net, ip6_dst_idev ( skb_dst ( skb ) ), IPSTATS_MIB_INHDRERRORS ) ; icmpv6_param_prob ( skb, ICMPV6_HDR_FIELD, ( ( u8 * ) & fhdr -> frag_off - skb_network_header ( skb ) ) ) ; return - 1 ; } if ( skb -> ip_summed == CHECKSUM_COMPLETE ) { const unsigned char * nh = skb_network_header ( skb ) ; skb -> csum = csum_sub ( skb -> csum, csum_partial ( nh, ( u8 * ) ( fhdr + 1 ) - nh, 0 ) ) ; } if (! ( fhdr -> frag_off & htons ( IP6_MF ) ) ) { if ( end < fq -> q. len || ( ( fq -> q. last_in & INET_FRAG_LAST_IN ) && end!= fq -> q. len ) ) goto err ; fq -> q. last_in |= INET_FRAG_LAST_IN ; fq -> q. len = end ; } else { if ( end & 0x7 ) { IP6_INC_STATS_BH ( net, ip6_dst_idev ( skb_dst ( skb ) ), IPSTATS_MIB_INH

Fix:
<S2SV_ModStart> if ( prev && <S2SV_ModEnd> ( FRAG6_CB ( <S2SV_ModStart> ) - offset <S2SV_ModEnd> > 0 ) <S2SV_ModStart> > 0 ) goto discard_fq ; if <S2SV_ModEnd> ( next && <S2SV_ModStart> < end ) goto discard_fq ; <S2SV_ModEnd> FRAG6_CB ( skb <S2SV_ModStart> - 1 ; discard_fq : fq_kill ( fq ) ;
Buggy code:
 int fit_image_verify ( const void * fit, int image_noffset ) { <START_BUG> const void * data ; <END_BUG> size_t size ;  int noffset = 0 ; <START_BUG> <END_BUG> char * err_msg = "" ;  if ( fit_image_get_data_and_size ( fit, image_noffset, & data, & size ) ) { err_msg = "Can\'t   get   image   data//size" ; <START_BUG> printf ( "error!\\n%s   for   \'%s\'   hash   node   in   \'%s\'   image   node\\n", <END_BUG>  err_msg, fit_get_name ( fit, noffset, NULL ), <START_BUG> fit_get_name ( fit, image_noffset, NULL ) ) ; return 0 ; } <END_BUG> return fit_image_verify_with_data ( fit, image_noffset, data, size ) ;  }

Fix:
<S2SV_ModStart> ) { const char * name = fit_get_name ( fit, image_noffset, NULL ) ; const <S2SV_ModStart> size_t size ; <S2SV_ModEnd> char * err_msg <S2SV_ModStart> = "" ; if ( strchr ( name, '@' ) ) { err_msg = "Node <S2SV_blank> name <S2SV_blank> contains <S2SV_blank> @" ; goto err ; } <S2SV_ModStart> = "Can\'t <S2SV_blank> get <S2SV_blank> image <S2SV_blank> data//size" ; goto err ; } return fit_image_verify_with_data <S2SV_ModEnd> ( fit, <S2SV_ModStart> ( fit, image_noffset, data, size ) ; err : printf ( "error!\\n%s <S2SV_blank> in <S2SV_blank> \'%s\' <S2SV_blank> image <S2SV_blank> node\\n", err_msg <S2SV_ModEnd>, fit_get_name ( <S2SV_ModStart> 0 ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>