nus-yam/ex-repair huggingface dataset:
Buggy code:
 void messageAddArgument ( message * m, const char * arg ) { int offset ; char * p ; assert ( m!= NULL ) ; if ( arg == NULL ) return ; while ( isspace ( * arg ) ) arg ++ ; if ( * arg == '\\0' ) return ; cli_dbgmsg ( "messageAddArgument,   arg=\'%s\'\\n", arg ) ; if (! usefulArg ( arg ) ) return ; for ( offset = 0 ; offset < m -> numberOfArguments ; offset ++ ) if ( m -> mimeArguments [ offset ] == NULL ) break ; else if ( strcasecmp ( arg, m -> mimeArguments [ offset ] ) == 0 ) return ; if ( offset == m -> numberOfArguments ) { char * * q ; m -> numberOfArguments ++ ; q = ( char * * ) cli_realloc ( m -> mimeArguments, m -> numberOfArguments * sizeof ( char * ) ) ; if ( q == NULL ) { m -> numberOfArguments -- ; return ; } m -> mimeArguments = q ; } p = m -> mimeArguments [ offset ] = rfc2231 ( arg ) ; if (! p ) { cli_dbgmsg ( "messageAddArgument,   error   from   rfc2231()\\n" ) ; return ; } if ( strchr ( p, '=' ) == NULL ) { if ( strncmp ( p, "filename", 8 ) == 0 ) { <START_BUG> cli_dbgmsg ( "Possible   data   corruption   fixed\\n" ) ; <END_BUG> p [ 8 ] = '=' ; } else {  if ( * p ) <START_BUG> cli_dbgmsg ( "messageAddArgument,   \'%s\'   contains   no   \'=\'\\n", p ) ; free ( m -> mimeArguments [ offset ] ) ; m -> mimeArguments [ offset ] = NULL ; return ; } } if ( ( strncasecmp ( p, "filename=", 9 ) == 0 ) || ( strncasecmp ( p, "name=", 5 ) == 0 ) ) if ( messageGetMimeType ( m ) == NOMIME ) { cli_dbgmsg ( "Force   mime   encoding   to   application\\n" ) ; messageSetMimeType ( m, "application" ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { if ( strlen ( p ) > 8 ) { <S2SV_ModStart> } else { cli_dbgmsg ( "Possible <S2SV_blank> data <S2SV_blank> corruption <S2SV_blank> not <S2SV_blank> fixed\\n" ) ; } } else {
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register IndexPacket * indexes ; register ssize_t x ; register PixelPacket * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char *

Fix:
<S2SV_ModStart> { if ( HeapOverflowSanityCheck <S2SV_ModEnd> ( ( image <S2SV_ModStart> { if ( HeapOverflowSanityCheck <S2SV_ModEnd> ( number_pixels,
Buggy code:
 int add_mibdir ( const char * dirname ) { <START_BUG> FILE * ip ; <END_BUG> const char * oldFile = File ; char * * filenames ; int count = 0 ; int filename_count, i ;  # if! ( defined ( WIN32 ) || defined ( cygwin ) ) <START_BUG> char * token ; char space ; char newline ; struct stat dir_stat, idx_stat ; char tmpstr [ 300 ] ; char tmpstr1 [ 300 ] ; # endif DEBUGMSGTL ( ( "parse-mibs", "Scanning   directory   %s\\n", dirname ) ) ; <END_BUG> # if! ( defined ( WIN32 ) || defined ( cygwin ) )  token = netsnmp_mibindex_lookup ( dirname ) ; if ( token && stat ( token, & idx_stat ) == 0 && stat ( dirname, & dir_stat ) == 0 ) { if ( dir_stat. st_mtime < idx_stat. st_mtime ) { DEBUGMSGTL ( ( "parse-mibs", "The   index   is   good\\n" ) ) ; if ( ( ip = fopen ( token, "r" ) )!= NULL ) { fgets ( tmpstr, sizeof ( tmpstr ), ip ) ; while ( fscanf ( ip, "%127s%c%299[^\\n]%c", token, & space, tmpstr, & newline ) == 4 ) { if ( space!=' '|| newline!= '\\n' ) { snmp_log ( LOG_ERR, "add_mibdir:   strings   scanned   in   from   %s//%s   " "are   too   large.     count   =   %d\\n   ", dirname, ".index", count ) ; break ; } snprintf ( tmpstr1, sizeof ( tmpstr1 ), "%s//%s", dirname, tmpstr ) ; tmpstr1 [ sizeof ( tmpstr1 ) - 1 ] = 0 ; new_module ( token, tmpstr1 ) ; count ++ ; } fclose ( ip ) ; return count ; } else DEBUGMSGTL ( ( "parse-mibs", "Can\'t   read   index\\n" ) ) ; } else DEBUGMSGTL ( ( "parse-mibs", "Index   outdated\\n"

Fix:
<S2SV_ModStart> dirname ) { <S2SV_ModEnd> const char * <S2SV_ModStart>, i ; <S2SV_ModEnd> DEBUGMSGTL ( ( <S2SV_ModStart> ) ) ; <S2SV_ModEnd> filename_count = scan_directory <S2SV_ModStart> 0 ) { <S2SV_ModEnd> for ( i <S2SV_ModStart>, '//' ) <S2SV_ModEnd> ) == 0 <S2SV_ModStart> File = oldFile <S2SV_ModEnd> ; free (
Buggy code:
 void btsnoop_net_write ( const void * data, size_t length ) { # if (! defined ( BT_NET_DEBUG ) || ( BT_NET_DEBUG!= TRUE ) ) return ; # endif pthread_mutex_lock ( & client_socket_lock_ ) ; if ( client_socket_!= - 1 ) { <START_BUG> if ( send ( client_socket_, data, length, 0 ) == - 1 && errno == ECONNRESET ) { <END_BUG> safe_close_ ( & client_socket_ ) ; } } pthread_mutex_unlock ( & client_socket_lock_ ) ; }

Fix:
<S2SV_ModStart> { if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> length, 0 )
Buggy code:
 static int mwifiex_pcie_alloc_cmdrsp_buf ( struct mwifiex_adapter * adapter ) { struct pcie_service_card * card = adapter -> card ; struct sk_buff * skb ; skb = dev_alloc_skb ( MWIFIEX_UPLD_SIZE ) ; if (! skb ) { mwifiex_dbg ( adapter, ERROR, "Unable   to   allocate   skb   for   command   response   data.\\n" ) ; return - ENOMEM ; } skb_put ( skb, MWIFIEX_UPLD_SIZE ) ; if ( mwifiex_map_pci_memory ( adapter, skb, MWIFIEX_UPLD_SIZE, <START_BUG> PCI_DMA_FROMDEVICE ) ) <END_BUG>  return - 1 ; <START_BUG> card -> cmdrsp_buf = skb ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> PCI_DMA_FROMDEVICE ) ) { kfree_skb ( skb ) ; <S2SV_ModStart> - 1 ; }
Buggy code:
 static int <START_BUG> mptctl_do_fw_download ( int ioc, char __user * ufwbuf, size_t fwlen ) <END_BUG> { FWDownload_t * dlmsg ;  MPT_FRAME_HDR * mf ; <START_BUG> MPT_ADAPTER * iocp ; FWDownloadTCSGE_t * ptsge ; MptSge_t * sgl, * sgIn ; char * sgOut ; struct buflist * buflist ; struct buflist * bl ; dma_addr_t sgl_dma ; int ret ; int numfrags = 0 ; int maxfrags ; int n = 0 ; u32 sgdir ; u32 nib ; int fw_bytes_copied = 0 ; int i ; int sge_offset = 0 ; u16 iocstat ; pFWDownloadReply_t ReplyMsg = NULL ; unsigned long timeleft ; <END_BUG> if ( mpt_verify_adapter ( ioc, & iocp ) < 0 ) {  printk ( KERN_DEBUG MYNAM "ioctl_fwdl   -   ioc%d   not   found!\\n", ioc ) ; return - ENODEV ; } else { if ( ( mf = mpt_get_msg_frame ( mptctl_id, iocp ) ) == NULL ) return - EAGAIN ; <START_BUG> } <END_BUG> dctlprintk ( iocp, printk ( MYIOC_s_DEBUG_FMT "mptctl_do_fwdl   called.   mptctl_id   =   %xh.\\n", iocp -> name, mptctl_id ) ) ; dctlprintk ( iocp, printk ( MYIOC_s_DEBUG_FMT "DbG:   kfwdl.bufp     =   %p\\n", iocp -> name, ufwbuf ) ) ; dctlprintk ( iocp, printk ( MYIOC_s_DEBUG_FMT "DbG:   kfwdl.fwlen   =   %d\\n",  iocp -> name, ( int ) fwlen ) ) ; <START_BUG> dctlprintk ( iocp, printk ( MYIOC_s_DEBUG_FMT "DbG:   kfwdl.ioc       =   %04xh<END_BUG>

Fix:
<S2SV_ModStart> int mptctl_do_fw_download ( MPT_ADAPTER * iocp <S2SV_ModEnd>, char __user <S2SV_ModStart> MPT_FRAME_HDR * mf <S2SV_ModEnd> ; FWDownloadTCSGE_t * <S2SV_ModStart> ; if ( <S2SV_ModEnd> ( mf = <S2SV_ModStart> - EAGAIN ; <S2SV_ModEnd> dctlprintk ( iocp <S2SV_ModStart> int ) fwlen <S2SV_ModEnd> ) ) ;
Buggy code:
 DECLAREcpFunc ( cpSeparate2ContigByRow ) { tsize_t scanlinesizein = TIFFScanlineSize ( in ) ; tsize_t scanlinesizeout = TIFFScanlineSize ( out ) ; tdata_t inbuf ; tdata_t outbuf ; register uint8 * inp, * outp ; register uint32 n ; uint32 row ; tsample_t s ; <START_BUG> inbuf = _TIFFmalloc ( scanlinesizein ) ; <END_BUG> outbuf = _TIFFmalloc ( scanlinesizeout ) ; if (! inbuf ||! outbuf ) goto bad ; _TIFFmemset ( inbuf, 0, scanlinesizein ) ; _TIFFmemset ( outbuf, 0, scanlinesizeout ) ; for ( row = 0 ; row < imagelength ; row ++ ) { for ( s = 0 ; s < spp ; s ++ ) { if ( TIFFReadScanline ( in, inbuf, row, s ) < 0 &&! ignore ) { TIFFError ( TIFFFileName ( in ), "Error,   can\'t   read   scanline   %lu", ( unsigned long ) row ) ; goto bad ; } inp = ( uint8 * ) inbuf ; outp = ( ( uint8 * ) outbuf ) + s ; for ( n = imagewidth ; n -- > 0 ; ) { * outp = * inp ++ ; outp += spp ; } } if ( TIFFWriteScanline ( out, outbuf, row, 0 ) < 0 ) { TIFFError ( TIFFFileName ( out ), "Error,   can\'t   write   scanline   %lu", ( unsigned long ) row ) ; goto bad ; } } if ( inbuf ) _TIFFfree ( inbuf ) ; if ( outbuf ) _TIFFfree ( outbuf ) ; return 1 ; bad : if ( inbuf ) _TIFFfree ( inbuf ) ; if ( outbuf ) _TIFFfree ( outbuf ) ; return 0 ; }

Fix:
<S2SV_ModStart> tsample_t s ; uint16 bps = 0 ; ( void ) TIFFGetField ( in, TIFFTAG_BITSPERSAMPLE, & bps ) ; if ( bps!= 8 ) { TIFFError ( TIFFFileName ( in ), "Error, <S2SV_blank> can <S2SV_blank> only <S2SV_blank> handle <S2SV_blank> BitsPerSample=8 <S2SV_blank> in <S2SV_blank> %s", "cpSeparate2ContigByRow" ) ; return 0 ; }
Buggy code:
 static void perf_event_for_each ( struct perf_event * event, void ( * func ) ( struct perf_event * ) ) { struct perf_event_context * ctx = event -> ctx ; struct perf_event * sibling ; <START_BUG> WARN_ON_ONCE ( ctx -> parent_ctx ) ; <END_BUG> mutex_lock ( & ctx -> mutex ) ; event = event -> group_leader ; perf_event_for_each_child ( event, func ) ; list_for_each_entry ( sibling, & event -> sibling_list, group_entry ) perf_event_for_each_child ( sibling, func ) ;  mutex_unlock ( & ctx -> mutex ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> * sibling ; lockdep_assert_held <S2SV_ModEnd> ( & ctx <S2SV_ModStart> func ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 static void start_auth_request ( PgSocket * client, const char * username ) { int res ; PktBuf * buf ; <START_BUG> client -> auth_user = client -> db -> auth_user ; <END_BUG> client -> pool = get_pool ( client -> db, client -> db -> auth_user ) ; if (! find_server ( client ) ) { client -> wait_for_user_conn = true ; return ; } slog_noise ( client, "Doing   auth_conn   query" ) ; client -> wait_for_user_conn = false ; client -> wait_for_user = true ; if (! sbuf_pause ( & client -> sbuf ) ) { release_server ( client -> link ) ; disconnect_client ( client, true, "pause   failed" ) ; return ; } client -> link -> ready = 0 ; res = 0 ; buf = pktbuf_dynamic ( 512 ) ; if ( buf ) { pktbuf_write_ExtQuery ( buf, cf_auth_query, 1, username ) ; res = pktbuf_send_immediate ( buf, client -> link ) ; pktbuf_free ( buf ) ; } if (! res ) disconnect_server ( client -> link, false, "unable   to   send   login   query" ) ; }

Fix:
<S2SV_ModStart> ; client -> <S2SV_ModEnd> pool = get_pool
Buggy code:
 static int nft_flush_table ( struct nft_ctx * ctx ) { int err ; struct nft_chain * chain, * nc ; struct nft_set * set, * ns ; <START_BUG> list_for_each_entry_safe ( chain, nc, & ctx -> table -> chains, list ) { <END_BUG> ctx -> chain = chain ; err = nft_delrule_by_chain ( ctx ) ; if ( err < 0 ) goto out ;  err = nft_delchain ( ctx ) ; <START_BUG> if ( err < 0 ) goto out ; } <END_BUG> list_for_each_entry_safe ( set, ns, & ctx -> table -> sets, list ) {  <START_BUG> if ( set -> flags & NFT_SET_ANONYMOUS && <END_BUG>! list_empty ( & set -> bindings ) ) continue ; err = nft_delset ( ctx, set ) ; if ( err < 0 ) goto out ; } err = nft_deltable ( ctx ) ; out : return err ; }

Fix:
<S2SV_ModStart> * ns ; list_for_each_entry ( chain <S2SV_ModEnd>, & ctx <S2SV_ModStart> goto out ; } list_for_each_entry_safe ( set, ns, & ctx -> table -> sets, list ) { if ( set -> flags & NFT_SET_ANONYMOUS &&! list_empty ( & set -> bindings ) ) continue ; err = nft_delset ( ctx, set <S2SV_ModEnd> ) ; if <S2SV_ModStart> } list_for_each_entry_safe ( chain, nc <S2SV_ModEnd>, & ctx <S2SV_ModStart> -> table -> chains <S2SV_ModEnd>, list ) <S2SV_ModStart> list ) { ctx -> chain = chain ; err = nft_delchain ( ctx <S2SV_ModEnd> ) ; if
Buggy code:
 SYSCALL_DEFINE5 ( perf_event_open, struct perf_event_attr __user *, attr_uptr, pid_t, pid, int, cpu, int, group_fd, unsigned long, flags ) { struct perf_event * group_leader = NULL, * output_event = NULL ; struct perf_event * event, * sibling ; struct perf_event_attr attr ; struct perf_event_context * ctx, * uninitialized_var ( gctx ) ; struct file * event_file = NULL ; struct fd group = { NULL, 0 } ; struct task_struct * task = NULL ; struct pmu * pmu ; int event_fd ; int move_group = 0 ; int err ; int f_flags = O_RDWR ; int cgroup_fd = - 1 ; if ( flags & ~ PERF_FLAG_ALL ) return - EINVAL ; err = perf_copy_attr ( attr_uptr, & attr ) ; if ( err ) return err ; if (! attr. exclude_kernel ) { if ( perf_paranoid_kernel ( ) &&! capable ( CAP_SYS_ADMIN ) ) return - EACCES ; } if ( attr. freq ) { if ( attr. sample_freq > sysctl_perf_event_sample_rate ) return - EINVAL ; } else { if ( attr. sample_period & ( 1ULL << 63 ) ) return - EINVAL ; } if (! attr. sample_max_stack ) attr. sample_max_stack = sysctl_perf_event_max_stack ; if ( ( flags & PERF_FLAG_PID_CGROUP ) && ( pid == - 1 || cpu == - 1 ) ) return - EINVAL ; if ( flags & PERF_FLAG_FD_CLOEXEC ) f_flags |= O_CLOEXEC ; event_fd = get_unused_fd_flags ( f_flags ) ; if ( event_fd < 0 ) return event_fd ; if ( group_fd!= - 1 ) { err = perf_fget_light ( group_fd, & group ) ; if ( err ) goto err_fd ; group_leader = group. file -> private_data ; if ( flags & PERF_FLAG_FD_OUTPUT ) output_event = group_leader ; if ( flags & PERF_

Fix:
<S2SV_ModStart> { gctx = __perf_event_ctx_lock_double ( group_leader, ctx <S2SV_ModEnd> ) ; if <S2SV_ModStart> err_locked ; } if (! ( group_leader -> group_caps & PERF_EV_CAP_SOFTWARE ) ) { if ( gctx!= ctx ) { err = - EINVAL ; goto err_locked ; } else { perf_event_ctx_unlock ( group_leader, gctx ) ; move_group = 0 ; } } <S2SV_ModStart> ( move_group ) perf_event_ctx_unlock ( group_leader, gctx <S2SV_ModEnd> ) ; mutex_unlock <S2SV_ModStart> ( move_group ) perf_event_ctx_unlock ( group_leader, gctx <S2SV_ModEnd> ) ; mutex_unlock
Buggy code:
 static int msg_parse_fetch ( struct ImapHeader * h, char * s ) { char tmp [ SHORT_STRING ] ; char * ptmp = NULL ; if (! s ) return - 1 ; while ( * s ) { SKIPWS ( s ) ; if ( mutt_str_strncasecmp ( "FLAGS", s, 5 ) == 0 ) { s = msg_parse_flags ( h, s ) ; if (! s ) return - 1 ; } else if ( mutt_str_strncasecmp ( "UID", s, 3 ) == 0 ) { s += 3 ; SKIPWS ( s ) ; if ( mutt_str_atoui ( s, & h -> data -> uid ) < 0 ) return - 1 ; s = imap_next_word ( s ) ; } else if ( mutt_str_strncasecmp ( "INTERNALDATE", s, 12 ) == 0 ) { s += 12 ; SKIPWS ( s ) ; if ( * s!= \'\\"\' ) { mutt_debug ( 1, "bogus   INTERNALDATE   entry:   %s\\n", s ) ; return - 1 ; } s ++ ; ptmp = tmp ; <START_BUG> while ( * s && * s!= \'\\"\' ) <END_BUG> * ptmp ++ = * s ++ ; if ( * s!= \'\\"\' ) return - 1 ; s ++ ; * ptmp = '\\0' ; h -> received = mutt_date_parse_imap ( tmp ) ; } else if ( mutt_str_strncasecmp ( "RFC822.SIZE", s, 11 ) == 0 ) { s += 11 ; SKIPWS ( s ) ; ptmp = tmp ;  while ( isdigit ( ( unsigned char ) * s ) ) <START_BUG> * ptmp ++ = * s ++ ; * ptmp = '\\0' ; if ( mutt_str_atol ( tmp, & h -> content_length ) < 0 ) return - 1 ; } else if ( ( mutt_str_strncasecmp ( "BODY", s, 4 ) == 0 ) || ( mutt_str_strncasecmp ( "RFC822.HEADER", s, 13 ) == 0 ) ) { return - 2 ; } else if ( * s == ')' ) s ++ ; else if ( * s ) { imap_error ( "msg_parse<END_BUG>

Fix:
<S2SV_ModStart> * s && ( <S2SV_ModStart> s!= \'\\"\' ) && ( ptmp!= ( tmp + sizeof ( tmp ) - 1 ) ) <S2SV_ModStart> ) * s ) && ( ptmp!= ( tmp + sizeof ( tmp ) - 1 )
Buggy code:
 long tty_ioctl ( struct file * file, unsigned int cmd, unsigned long arg ) { struct tty_struct * tty = file_tty ( file ) ; struct tty_struct * real_tty ; void __user * p = ( void __user * ) arg ; int retval ; struct tty_ldisc * ld ; if ( tty_paranoia_check ( tty, file_inode ( file ), "tty_ioctl" ) ) return - EINVAL ; real_tty = tty_pair_get_tty ( tty ) ; switch ( cmd ) { case TIOCSETD : case TIOCSBRK : case TIOCCBRK : case TCSBRK : case TCSBRKP : retval = tty_check_change ( tty ) ; if ( retval ) return retval ; if ( cmd!= TIOCCBRK ) { tty_wait_until_sent ( tty, 0 ) ; if ( signal_pending ( current ) ) return - EINTR ; } break ; } switch ( cmd ) { case TIOCSTI : return tiocsti ( tty, p ) ; case TIOCGWINSZ : return tiocgwinsz ( real_tty, p ) ; case TIOCSWINSZ : return tiocswinsz ( real_tty, p ) ; case TIOCCONS : return real_tty!= tty? - EINVAL : tioccons ( file ) ; case FIONBIO : return fionbio ( file, p ) ; case TIOCEXCL : set_bit ( TTY_EXCLUSIVE, & tty -> flags ) ; return 0 ; case TIOCNXCL : clear_bit ( TTY_EXCLUSIVE, & tty -> flags ) ; return 0 ; case TIOCGEXCL : { int excl = test_bit ( TTY_EXCLUSIVE, & tty -> flags ) ; return put_user ( excl, ( int __user * ) p ) ; } case TIOCNOTTY : if ( current -> signal -> tty!= tty ) return - ENOTTY ; no_tty ( ) ; return 0 ; case TIOCSCTTY : return tiocsctty ( real_tty, file, arg ) ; case TIOCGPGRP : return tiocgpgrp ( tty, real_tty, p ) ; case TIOCSPGRP

Fix:
<S2SV_ModStart> TIOCGETD : return tiocgetd ( tty, <S2SV_ModEnd> p ) ;
Buggy code:
 gpol_ret * get_policy_2_svc ( gpol_arg * arg, struct svc_req * rqstp ) { static gpol_ret ret ; kadm5_ret_t ret2 ; char * prime_arg, * funcname ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_principal_ent_rec caller_ent ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_gpol_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; funcname = "kadm5_get_policy" ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } prime_arg = arg -> name ; ret. code = KADM5_AUTH_GET ; if (! CHANGEPW_SERVICE ( rqstp ) && kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_INQUIRE, NULL, NULL ) ) ret. code = KADM5_OK ; else { ret. code = kadm5_get_principal ( handle -> lhandle, handle -> current_caller, & caller_ent, KADM5_PRINCIPAL_NORMAL_MASK ) ; if ( ret. code == KADM5_OK ) { if ( caller_ent. aux_attributes & KADM5_POLICY && strcmp ( caller_ent. policy, arg -> name ) == 0 ) { ret. code = KADM5_OK ; } else ret. code = KADM5_AUTH_GET ; ret2 = kadm5_free_principal_ent ( handle -> lhandle, & caller_ent ) ; ret. code = ret. code? ret. code : ret2 ; } } if ( ret. code == KADM5_OK ) { ret. code =

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> ) ; } exit_func : gss_release_buffer ( & minor_stat, & client_name ) ; gss_release_buffer ( & minor_stat, & service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 static int multiSelect ( Parse * pParse, Select * p, SelectDest * pDest ) { int rc = SQLITE_OK ; Select * pPrior ; Vdbe * v ; SelectDest dest ; Select * pDelete = 0 ; sqlite3 * db ; assert ( p && p -> pPrior ) ; assert ( ( p -> selFlags & SF_Recursive ) == 0 || p -> op == TK_ALL || p -> op == TK_UNION ) ; assert ( p -> selFlags & SF_Compound ) ; db = pParse -> db ; pPrior = p -> pPrior ; dest = * pDest ; if ( pPrior -> pOrderBy || pPrior -> pLimit ) { sqlite3ErrorMsg ( pParse, "%s   clause   should   come   after   %s   not   before", pPrior -> pOrderBy!= 0? "ORDER   BY" : "LIMIT", selectOpName ( p -> op ) ) ; rc = 1 ; goto multi_select_end ; } v = sqlite3GetVdbe ( pParse ) ; assert ( v!= 0 ) ; if ( dest. eDest == SRT_EphemTab ) { assert ( p -> pEList ) ; sqlite3VdbeAddOp2 ( v, OP_OpenEphemeral, dest. iSDParm, p -> pEList -> nExpr ) ; dest. eDest = SRT_Table ; } if ( p -> selFlags & SF_MultiValue ) { rc = multiSelectValues ( pParse, p, & dest ) ; if ( rc >= 0 ) goto multi_select_end ; rc = SQLITE_OK ; } assert ( p -> pEList && pPrior -> pEList ) ; assert ( p -> pEList -> nExpr == pPrior -> pEList -> nExpr ) ; # ifndef SQLITE_OMIT_CTE if ( p -> selFlags & SF_Recursive ) { generateWithRecursiveQuery ( pParse, p, & dest ) ; } else # endif if ( p -> pOrderBy ) { return multiSelectOrderBy ( pParse, p, pDest ) ; } else { # ifndef SQLITE_OMIT_EXPLAIN if ( pPrior -> pPrior == 0 ) { ExplainQueryPlan ( ( pParse, 1, "COMPOUND   QUERY" ) ) ; ExplainQueryPlan

Fix:
<S2SV_ModStart> } if ( pParse -> nErr ) goto multi_select_end ; if (
Buggy code:
 void __kvm_migrate_pit_timer ( struct kvm_vcpu * vcpu ) { struct kvm_pit * pit = vcpu -> kvm -> arch. vpit ; struct hrtimer * timer ; if (! kvm_vcpu_is_bsp ( vcpu ) ||! pit ) return ; timer = & pit -> pit_state. timer ; <START_BUG> if ( hrtimer_cancel ( timer ) ) <END_BUG> hrtimer_start_expires ( timer, HRTIMER_MODE_ABS ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart>. timer ; mutex_lock ( & pit -> pit_state. lock ) ; <S2SV_ModStart> HRTIMER_MODE_ABS ) ; mutex_unlock ( & pit -> pit_state. lock ) ;
Buggy code:
 INST_HANDLER ( sbrx ) { int b = buf [ 0 ] & 0x7 ; int r = ( ( buf [ 0 ] >> 4 ) & 0xf ) | ( ( buf [ 1 ] & 0x01 ) << 4 ) ; <START_BUG> RAnalOp next_op ; <END_BUG> avr_op_analyze ( anal, & next_op, op -> addr + op -> size, buf + op -> size, len - op -> size, cpu ) ; r_strbuf_fini ( & next_op. esil ) ; op -> jump = op -> addr + next_op. size + 2 ; op -> cycles = 1 ; ESIL_A ( "%d,1,<<,r%d,&,", b, r ) ; ESIL_A ( ( buf [ 1 ] & 0xe ) == 0xc? "!," : "!,!," ) ; ESIL_A ( "?{,%" PFMT64d ",pc,=,},", op -> jump ) ; }

Fix:
<S2SV_ModStart> ; RAnalOp next_op = { 0 }
Buggy code:
 void nsexec ( void ) { int pipenum ; jmp_buf env ; int sync_child_pipe [ 2 ], sync_grandchild_pipe [ 2 ] ; struct nlconfig_t config = { 0 } ; pipenum = initpipe ( ) ; if ( pipenum == - 1 ) return ; <START_BUG> nl_parse ( pipenum, & config ) ; <END_BUG> update_oom_score_adj ( config. oom_score_adj, config. oom_score_adj_len ) ; if ( config. namespaces ) { if ( prctl ( PR_SET_DUMPABLE, 0, 0, 0, 0 ) < 0 ) bail ( "failed   to   set   process   as   non-dumpable" ) ; } if ( socketpair ( AF_LOCAL, SOCK_STREAM, 0, sync_child_pipe ) < 0 ) bail ( "failed   to   setup   sync   pipe   between   parent   and   child" ) ; if ( socketpair ( AF_LOCAL, SOCK_STREAM, 0, sync_grandchild_pipe ) < 0 ) bail ( "failed   to   setup   sync   pipe   between   parent   and   grandchild" ) ; switch ( setjmp ( env ) ) { case JUMP_PARENT : { int len ; pid_t child, first_child = - 1 ; bool ready = false ; prctl ( PR_SET_NAME, ( unsigned long ) "runc:[0:PARENT]", 0, 0, 0 ) ; child = clone_parent ( & env, JUMP_CHILD ) ; if ( child < 0 ) bail ( "unable   to   fork:   child_func" ) ; while (! ready ) { enum sync_t s ; int ret ; syncfd = sync_child_pipe [ 1 ] ; close ( sync_child_pipe [ 0 ] ) ; if ( read ( syncfd, & s, sizeof ( s ) )!= sizeof ( s ) ) bail ( "failed   to   sync   with   child:   next   state" ) ; switch ( s ) { case SYNC_ERR : if ( read ( syncfd, & ret, sizeof ( ret ) )!= sizeof ( ret ) ) bail ( "failed   to   sync   with   child:   read(error   code)" ) ; exit ( ret ) ; case SYNC_

Fix:
<S2SV_ModStart> ) return ; if ( ensure_cloned_binary ( ) < 0 ) bail ( "could <S2SV_blank> not <S2SV_blank> ensure <S2SV_blank> we <S2SV_blank> are <S2SV_blank> a <S2SV_blank> cloned <S2SV_blank> binary" ) ;
Buggy code:
 int vp8dx_start_decode ( BOOL_DECODER * br, const unsigned char * source, unsigned int source_sz, <START_BUG> vp8_decrypt_cb * decrypt_cb, <END_BUG> void * decrypt_state ) { br -> user_buffer_end = source + source_sz ; br -> user_buffer = source ; br -> value = 0 ; br -> count = - 8 ; br -> range = 255 ; br -> decrypt_cb = decrypt_cb ; br -> decrypt_state = decrypt_state ; if ( source_sz &&! source ) return 1 ; vp8dx_bool_decoder_fill ( br ) ; return 0 ; }

Fix:
<S2SV_ModStart> int source_sz, vpx_decrypt_cb <S2SV_ModEnd> decrypt_cb, void
Buggy code:
 static gboolean netscreen_seek_read ( wtap * wth, gint64 seek_off, struct wtap_pkthdr * phdr, Buffer * buf, int * err, gchar * * err_info ) { <START_BUG> int pkt_len ; <END_BUG>  char line [ NETSCREEN_LINE_LENGTH ] ; <START_BUG> char cap_int [ NETSCREEN_MAX_INT_NAME_LENGTH ] ; gboolean cap_dir ; char cap_dst [ 13 ] ; if ( file_seek ( wth -> random_fh, seek_off, SEEK_SET, err ) == - 1 ) { return FALSE ; } if ( file_gets ( line, NETSCREEN_LINE_LENGTH, wth -> random_fh ) == NULL ) { * err = file_error ( wth -> random_fh, err_info ) ; if ( * err == 0 ) { * err = WTAP_ERR_SHORT_READ ; } return FALSE ; } <END_BUG> pkt_len = parse_netscreen_rec_hdr ( phdr, line, cap_int, & cap_dir,  cap_dst, err, err_info ) ; <START_BUG> if ( pkt_len == - 1 ) <END_BUG> return FALSE ; if (! parse_netscreen_hex_dump ( wth -> random_fh, pkt_len, cap_int, cap_dst, phdr, buf, err, err_info ) ) return FALSE ; return TRUE ; }

Fix:
<S2SV_ModStart> err_info ) { <S2SV_ModEnd> char line [ <S2SV_ModStart> line [ NETSCREEN_LINE_LENGTH <S2SV_ModEnd> ] ; if <S2SV_ModStart> FALSE ; } return parse_netscreen_packet ( wth -> random_fh, phdr, buf <S2SV_ModEnd>, line, <S2SV_ModStart>, line, <S2SV_ModEnd> err, err_info <S2SV_ModStart> err_info ) ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int pidfile_write ( const char * pid_file, int pid ) { FILE * pidfile = NULL ; <START_BUG> int pidfd = creat ( pid_file, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH ) ; <END_BUG> if ( pidfd!= - 1 ) pidfile = fdopen ( pidfd, "w" ) ; if (! pidfile ) { log_message ( LOG_INFO, "pidfile_write   :   Cannot   open   %s   pidfile", pid_file ) ; return 0 ; } fprintf ( pidfile, "%d\\n", pid ) ; fclose ( pidfile ) ; return 1 ; }

Fix:
<S2SV_ModStart> int pidfd = open ( pid_file, O_NOFOLLOW | O_CREAT | O_WRONLY | O_TRUNC <S2SV_ModEnd>, S_IRUSR |
Buggy code:
 static void decode_residue ( vorb * f, float * residue_buffers [ ], int ch, int n, int rn, uint8 * do_not_decode ) { int i, j, pass ; Residue * r = f -> residue_config + rn ; int rtype = f -> residue_types [ rn ] ; int c = r -> classbook ; int classwords = f -> codebooks [ c ]. dimensions ; <START_BUG> int n_read = r -> end - r -> begin ; <END_BUG> int part_read = n_read // r -> part_size ; int temp_alloc_point = temp_alloc_save ( f ) ; # ifndef STB_VORBIS_DIVIDES_IN_RESIDUE uint8 * * * part_classdata = ( uint8 * * * ) temp_block_array ( f, f -> channels, part_read * sizeof ( * * part_classdata ) ) ; # else int * * classifications = ( int * * ) temp_block_array ( f, f -> channels, part_read * sizeof ( * * classifications ) ) ; # endif CHECK ( f ) ; for ( i = 0 ; i < ch ; ++ i ) if (! do_not_decode [ i ] ) memset ( residue_buffers [ i ], 0, sizeof ( float ) * n ) ; if ( rtype == 2 && ch!= 1 ) { for ( j = 0 ; j < ch ; ++ j ) if (! do_not_decode [ j ] ) break ; if ( j == ch ) goto done ; for ( pass = 0 ; pass < 8 ; ++ pass ) { int pcount = 0, class_set = 0 ; if ( ch == 2 ) { while ( pcount < part_read ) { int z = r -> begin + pcount * r -> part_size ; int c_inter = ( z & 1 ), p_inter = z >> 1 ; if ( pass == 0 ) { Codebook * c = f -> codebooks + r -> classbook ; int q ; DECODE ( q, f, c ) ; if ( q == EOP ) goto done ; # ifndef STB_VORBIS_DIVIDES_IN_RESIDUE part_classdata [ 0 ] [ class_set ] = r -> classdata [ q ] ; #

Fix:
<S2SV_ModStart>. dimensions ; unsigned int actual_size = rtype == 2? n * 2 : n ; unsigned int limit_r_begin = ( r -> begin < actual_size? r -> begin : actual_size ) ; unsigned int limit_r_end = ( r -> end < actual_size? r -> end : actual_size ) ; <S2SV_ModStart> int n_read = limit_r_end - limit_r_begin <S2SV_ModEnd> ; int part_read
Buggy code:
 SYSCALL_DEFINE3 ( shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf ) { struct shmid_kernel * shp ; int err, version ; struct ipc_namespace * ns ; if ( cmd < 0 || shmid < 0 ) return - EINVAL ; version = ipc_parse_version ( & cmd ) ; ns = current -> nsproxy -> ipc_ns ; switch ( cmd ) { case IPC_INFO : case SHM_INFO : case SHM_STAT : case IPC_STAT : return shmctl_nolock ( ns, shmid, cmd, version, buf ) ; case IPC_RMID : case IPC_SET : return shmctl_down ( ns, shmid, cmd, buf, version ) ; case SHM_LOCK : case SHM_UNLOCK : { struct file * shm_file ; rcu_read_lock ( ) ; shp = shm_obtain_object_check ( ns, shmid ) ; if ( IS_ERR ( shp ) ) { err = PTR_ERR ( shp ) ; goto out_unlock1 ; } audit_ipc_obj ( & ( shp -> shm_perm ) ) ; err = security_shm_shmctl ( shp, cmd ) ; if ( err ) goto out_unlock1 ; ipc_lock_object ( & shp -> shm_perm ) ; if (! ns_capable ( ns -> user_ns, CAP_IPC_LOCK ) ) { kuid_t euid = current_euid ( ) ; err = - EPERM ; if (! uid_eq ( euid, shp -> shm_perm. uid ) &&! uid_eq ( euid, shp -> shm_perm. cuid ) ) goto out_unlock0 ; if ( cmd == SHM_LOCK &&! rlimit ( RLIMIT_MEMLOCK ) ) goto out_unlock0 ; } shm_file = shp -> shm_file ; <START_BUG> if ( is_file_hugepages ( shm_file ) ) <END_BUG> goto out_unlock0 ; if ( cmd == SHM_LOCK ) { struct user_struct * user = current_user ( ) ; err = shmem_lock ( shm_file,

Fix:
<S2SV_ModStart> ; if ( shm_file == NULL ) { err = - EIDRM ; goto out_unlock0 ; } if (
Buggy code:
 static void ext4_xattr_release_block ( handle_t * handle, struct inode * inode, struct buffer_head * bh ) { <START_BUG> struct mb_cache_entry * ce = NULL ; <END_BUG>  int error = 0 ; <START_BUG> struct mb_cache * ext4_mb_cache = EXT4_GET_MB_CACHE ( inode ) ; ce = mb_cache_entry_get ( ext4_mb_cache, bh -> b_bdev, bh -> b_blocknr ) ; BUFFER_TRACE ( bh, "get_write_access" ) ; error = ext4_journal_get_write_access ( handle, bh ) ; if ( error ) goto out ; lock_buffer ( bh ) ; if ( BHDR ( bh ) -> h_refcount == cpu_to_le32 ( 1 ) ) { <END_BUG> ea_bdebug ( bh, "refcount   now=0;   freeing" ) ;  <START_BUG> if ( ce ) <END_BUG> mb_cache_entry_free ( ce ) ; get_bh ( bh ) ; unlock_buffer ( bh ) ; ext4_free_blocks ( handle, inode, bh, 0, 1, EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET ) ; } else { le32_add_cpu ( & BHDR ( bh ) -> h_refcount, - 1 ) ;  if ( ce ) <START_BUG> mb_cache_entry_release ( ce ) ; if ( ext4_handle_valid ( handle ) ) error = ext4_handle_dirty_xattr_block ( handle, inode, bh ) ; unlock_buffer ( bh ) ; if (! ext4_handle_valid ( handle ) ) error = ext4_handle_dirty_xattr_block ( handle, inode, bh ) ; if ( IS_SYNC ( inode ) ) ext4_handle_sync ( handle ) ; dquot_free_block ( inode, EXT4_C2B ( EXT4_SB ( inode -> i_sb ), 1 ) ) ; ea_bdebug ( bh, "refcount   now=%d;   releasing", le32_to_cpu ( BHDR ( bh ) -> h_refcount ) ) ; } out : ext4_std_error ( inode -> i_sb, error ) ; return ; }<END_BUG>

Fix:
<S2SV_ModStart> bh ) { <S2SV_ModEnd> int error = <S2SV_ModStart> error = 0 <S2SV_ModEnd> ; BUFFER_TRACE ( <S2SV_ModStart> ) ) { __u32 hash = le32_to_cpu ( BHDR ( bh ) -> h_hash ) ; <S2SV_ModStart> "refcount <S2SV_blank> now=0; <S2SV_blank> freeing" ) ; mb2_cache_entry_delete_block ( EXT4_GET_MB_CACHE ( inode ), hash, bh -> b_blocknr <S2SV_ModEnd> ) ; get_bh <S2SV_ModStart> ; if ( <S2SV_ModEnd> ext4_handle_valid ( handle
Buggy code:
 int dbd_bind_ph ( SV * sth, imp_sth_t * imp_sth, SV * param, SV * value, IV sql_type, SV * attribs, int is_inout, IV maxlen ) { dTHX ; int rc ; int param_num = SvIV ( param ) ; int idx = param_num - 1 ; <START_BUG> char err_msg [ 64 ] ; <END_BUG> D_imp_xxh ( sth ) ; # if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION STRLEN slen ; char * buffer = NULL ; int buffer_is_null = 0 ; int buffer_length = slen ; unsigned int buffer_type = 0 ; IV tmp ; # endif D_imp_dbh_from_sth ; ASYNC_CHECK_RETURN ( sth, FALSE ) ; if ( DBIc_TRACE_LEVEL ( imp_xxh ) >= 2 ) PerlIO_printf ( DBIc_LOGPIO ( imp_xxh ), "       Called:   dbd_bind_ph\\n" ) ; attribs = attribs ; maxlen = maxlen ; if ( param_num <= 0 || param_num > DBIc_NUM_PARAMS ( imp_sth ) ) { do_error ( sth, JW_ERR_ILLEGAL_PARAM_NUM, "Illegal   parameter   number", NULL ) ; return FALSE ; } if ( SvOK ( value ) && ( sql_type == SQL_NUMERIC || sql_type == SQL_DECIMAL || sql_type == SQL_INTEGER || sql_type == SQL_SMALLINT || sql_type == SQL_FLOAT || sql_type == SQL_REAL || sql_type == SQL_DOUBLE ) ) { if (! looks_like_number ( value ) ) {  sprintf ( err_msg, <START_BUG> "Binding   non-numeric   field   %d,   value   %s   as   a   numeric!", <END_BUG> param_num, neatsvpv ( value, 0 ) ) ;  do_error ( sth, JW_ERR_ILLEGAL_PARAM_NUM, err_msg, NULL ) ; } } if ( is_inout ) { do_error ( sth, JW_ERR_NOT_IMPLEMENTED, "Output   parameters   not   implemented", NULL ) ; return FALSE ; } rc = bind_param

Fix:
<S2SV_ModStart> 1 ; char * err_msg <S2SV_ModEnd> ; D_imp_xxh ( <S2SV_ModStart> ) ) { err_msg = SvPVX ( sv_2mortal ( newSVpvf ( <S2SV_ModEnd> "Binding <S2SV_blank> non-numeric <S2SV_blank> field <S2SV_blank> %d, <S2SV_blank> value <S2SV_blank> %s <S2SV_blank> as <S2SV_blank> a <S2SV_blank> numeric!", param_num <S2SV_ModStart> value, 0 ) )
Buggy code:
 static void sas_eh_finish_cmd ( struct scsi_cmnd * cmd ) { struct sas_ha_struct * sas_ha = SHOST_TO_SAS_HA ( cmd -> device -> host ) ; <START_BUG> struct sas_task * task = TO_SAS_TASK ( cmd ) ; <END_BUG> sas_end_task ( cmd, task ) ;  scsi_eh_finish_cmd ( cmd, & sas_ha -> eh_done_q ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ) ; struct domain_device * dev = cmd_to_domain_dev ( cmd ) ; struct <S2SV_ModStart> task ) ; if ( dev_is_sata ( dev ) ) { list_move_tail ( & cmd -> eh_entry, & sas_ha -> eh_ata_q ) ; return ; }
Buggy code:
 void receive_carbon ( void * * state ) { prof_input ( "//carbons   on" ) ; prof_connect ( ) ; assert_true ( stbbr_received ( "<iq   id=\'*\'   type=\'set\'><enable   xmlns=\'urn:xmpp:carbons:2\'//><//iq>" ) ) ; stbbr_send ( "<presence   to=\'stabber@localhost\'   from=\'buddy1@localhost//mobile\'>" "<priority>10<//priority>" "<status>On   my   mobile<//status>" "<//presence>" ) ; assert_true ( prof_output_exact ( "Buddy1   (mobile)   is   online,   \\"On   my   mobile\\"" ) ) ; prof_input ( "//msg   Buddy1" ) ; assert_true ( prof_output_exact ( "unencrypted" ) ) ; stbbr_send ( <START_BUG> "<message   type=\'chat\'   to=\'stabber@localhost//profanity\'   from=\'buddy1@localhost\'>" <END_BUG> "<received   xmlns=\'urn:xmpp:carbons:2\'>" "<forwarded   xmlns=\'urn:xmpp:forward:0\'>" "<message   id=\'prof_msg_7\'   xmlns=\'jabber:client\'   type=\'chat\'   lang=\'en\'   to=\'stabber@localhost//profanity\'   from=\'buddy1@localhost//mobile\'>" "<body>test   carbon   from   recipient<//body>" "<//message>" "<//forwarded>" "<//received>" "<//message>" ) ; assert_true ( prof_output_regex ( "Buddy1//mobile:  .+test   carbon   from   recipient" ) ) ; }

Fix:
<S2SV_ModStart> ; stbbr_send ( "<message <S2SV_blank> type=\'chat\' <S2SV_blank> to=\'stabber@localhost//profanity\' <S2SV_blank> from=\'stabber@localhost\'>" <S2SV_ModEnd> "<received <S2SV_blank> xmlns=\'urn:xmpp:carbons:2\'>" "<forwarded <S2SV_blank> xmlns=\'urn:xmpp:forward:0\'>" "<message <S2SV_blank> id=\'prof_msg_7\' <S2SV_blank> xmlns=\'jabber:client\' <S2SV_blank> type=\'chat\' <S2SV_blank> lang=\'en\' <S2SV_blank> to=\'stabber@localhost//profanity\' <S2SV_blank> from=\'buddy1@localhost//mobile\'>"
Buggy code:
 static int sctp_setsockopt_auto_asconf ( struct sock * sk, char __user * optval, unsigned int optlen ) { int val ; struct sctp_sock * sp = sctp_sk ( sk ) ; if ( optlen < sizeof ( int ) ) return - EINVAL ; if ( get_user ( val, ( int __user * ) optval ) ) return - EFAULT ; if (! sctp_is_ep_boundall ( sk ) && val ) return - EINVAL ; if ( ( val && sp -> do_auto_asconf ) || (! val &&! sp -> do_auto_asconf ) ) return 0 ; <START_BUG> if ( val == 0 && sp -> do_auto_asconf ) { <END_BUG> list_del ( & sp -> auto_asconf_list ) ; sp -> do_auto_asconf = 0 ; } else if ( val &&! sp -> do_auto_asconf ) { list_add_tail ( & sp -> auto_asconf_list, & sock_net ( sk ) -> sctp. auto_asconf_splist ) ; sp -> do_auto_asconf = 1 ; }  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> return 0 ; spin_lock_bh ( & sock_net ( sk ) -> sctp. addr_wq_lock ) ; <S2SV_ModStart> 1 ; } spin_unlock_bh ( & sock_net ( sk ) -> sctp. addr_wq_lock ) ;
Buggy code:
 int ovl_setattr ( struct dentry * dentry, struct iattr * attr ) { int err ; struct dentry * upperdentry ; err = ovl_want_write ( dentry ) ; if ( err ) goto out ; <START_BUG> upperdentry = ovl_dentry_upper ( dentry ) ; <END_BUG>  if ( upperdentry ) { <START_BUG> mutex_lock ( & upperdentry -> d_inode -> i_mutex ) ; err = notify_change ( upperdentry, attr, NULL ) ; mutex_unlock ( & upperdentry -> d_inode -> i_mutex ) ; <END_BUG> } else {  err = ovl_copy_up_last ( dentry, attr, false ) ; } ovl_drop_write ( dentry ) ; out : return err ; }

Fix:
<S2SV_ModStart> goto out ; err = ovl_copy_up ( dentry ) ; if (! err ) { <S2SV_ModStart> dentry ) ; <S2SV_ModEnd> mutex_lock ( & <S2SV_ModStart> ) ; } <S2SV_ModEnd> ovl_drop_write ( dentry
Buggy code:
 static int mobility_opt_print ( netdissect_options * ndo, const u_char * bp, const unsigned len ) { unsigned i, optlen ; for ( i = 0 ; i < len ; i += optlen ) { ND_TCHECK ( bp [ i ] ) ; if ( bp [ i ] == IP6MOPT_PAD1 ) optlen = 1 ; else { if ( i + 1 < len ) { ND_TCHECK ( bp [ i + 1 ] ) ; optlen = bp [ i + 1 ] + 2 ; } else goto trunc ; } if ( i + optlen > len ) goto trunc ; ND_TCHECK ( bp [ i + optlen ] ) ; switch ( bp [ i ] ) { case IP6MOPT_PAD1 : ND_PRINT ( ( ndo, "(pad1)" ) ) ; break ; case IP6MOPT_PADN : if ( len - i < IP6MOPT_MINLEN ) { ND_PRINT ( ( ndo, "(padn:   trunc)" ) ) ; goto trunc ; } ND_PRINT ( ( ndo, "(padn)" ) ) ; break ; case IP6MOPT_REFRESH : if ( len - i < IP6MOPT_REFRESH_MINLEN ) { ND_PRINT ( ( ndo, "(refresh:   trunc)" ) ) ; goto trunc ; } ND_TCHECK_16BITS ( & bp [ i + 2 ] ) ; ND_PRINT ( ( ndo, "(refresh:   %u)", EXTRACT_16BITS ( & bp [ i + 2 ] ) << 2 ) ) ; break ; case IP6MOPT_ALTCOA : if ( len - i < IP6MOPT_ALTCOA_MINLEN ) { ND_PRINT ( ( ndo, "(altcoa:   trunc)" ) ) ; goto trunc ; } <START_BUG> ND_PRINT ( ( ndo, "(alt-CoA:   %s)", ip6addr_string ( ndo, & bp [ i + 2 ] ) ) ) ; <END_BUG> break ; case IP6MOPT_NONCEID : if ( len - i < IP6MOPT_NONCEID_MINLEN ) { ND_PRINT ( ( ndo, "(ni:   trunc)" ) ) ; goto trunc ;

Fix:
<S2SV_ModStart> trunc ; } ND_TCHECK_128BITS ( & bp [ i + 2 ] ) ;
Buggy code:
 static void joint_motion_search ( VP9_COMP * cpi, MACROBLOCK * x, BLOCK_SIZE bsize, int_mv * frame_mv, int mi_row, int mi_col, int_mv single_newmv [ MAX_REF_FRAMES ], int * rate_mv ) { <START_BUG> const int pw = 4 * num_4x4_blocks_wide_lookup [ bsize ] ; <END_BUG> const int ph = 4 * num_4x4_blocks_high_lookup [ bsize ] ; MACROBLOCKD * xd = & x -> e_mbd ; MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; const int refs [ 2 ] = { mbmi -> ref_frame [ 0 ], mbmi -> ref_frame [ 1 ] < 0? 0 : mbmi -> ref_frame [ 1 ] } ; int_mv ref_mv [ 2 ] ; int ite, ref ;  uint8_t * second_pred = vpx_memalign ( 16, pw * ph * sizeof ( uint8_t ) ) ; <START_BUG> <END_BUG> const InterpKernel * kernel = vp9_get_interp_kernel ( mbmi -> interp_filter ) ;  struct buf_2d backup_yv12 [ 2 ] [ MAX_MB_PLANE ] ; <START_BUG> struct buf_2d scaled_first_yv12 = xd -> plane [ 0 ]. pre [ 0 ] ; <END_BUG> int last_besterr [ 2 ] = { INT_MAX, INT_MAX } ; const YV12_BUFFER_CONFIG * const scaled_ref_frame [ 2 ] = { vp9_get_scaled_ref_frame ( cpi, mbmi -> ref_frame [ 0 ] ), vp9_get_scaled_ref_frame ( cpi, mbmi -> ref_frame [ 1 ] ) } ;  for ( ref = 0 ; ref < 2 ; ++ ref ) { <START_BUG> <END_BUG> ref_mv [ ref ] = mbmi -> ref_mvs [ refs [ ref ] ] [ 0 ] ;  if ( scaled_ref_frame [ ref ] ) { int i ; for ( i = 0 ; i < MAX_MB_PLANE ; i ++ ) backup_yv12 [ ref ] [ i ] = xd -> plane [ i ]. pre [

Fix:
<S2SV_ModStart> ) { const VP9_COMMON * const cm = & cpi -> common ; const <S2SV_ModStart>, ref ; <S2SV_ModEnd> const InterpKernel * <S2SV_ModStart> * kernel = vp9_filter_kernels [ <S2SV_ModEnd> mbmi -> interp_filter <S2SV_ModStart> mbmi -> interp_filter ] ; struct scale_factors sf <S2SV_ModEnd> ; struct buf_2d <S2SV_ModStart> MAX_MB_PLANE ] ; <S2SV_ModEnd> int last_besterr [ <S2SV_ModStart> ) } ; # if CONFIG_VP9_HIGHBITDEPTH DECLARE_ALIGNED ( 16, uint16_t, second_pred_alloc_16 [ 64 * 64 ] ) ; uint8_t * second_pred ; # else DECLARE_ALIGNED ( 16, uint8_t, second_pred [ 64 * 64 ] ) ; # endif <S2SV_ModStart> ref ] = x -> mbmi_ext <S2SV_ModEnd> -> ref_mvs [ <S2SV_ModStart> as_int ; } # if CONFIG_VP9_HIGHBITDEPTH vp9_setup_scale_factors_for_frame ( & sf, cm -> width, cm -> height, cm -> width, cm -> height, cm -> use_highbitdepth ) ; # else vp9_setup_scale_factors_for_
Buggy code:
 static int snd_usb_create_streams ( struct snd_usb_audio * chip, int ctrlif ) { struct usb_device * dev = chip -> dev ; struct usb_host_interface * host_iface ; struct usb_interface_descriptor * altsd ; void * control_header ; <START_BUG> int i, protocol ; <END_BUG> host_iface = & usb_ifnum_to_if ( dev, ctrlif ) -> altsetting [ 0 ] ; control_header = snd_usb_find_csint_desc ( host_iface -> extra, host_iface -> extralen, NULL, UAC_HEADER ) ; altsd = get_iface_desc ( host_iface ) ; protocol = altsd -> bInterfaceProtocol ; if (! control_header ) { dev_err ( & dev -> dev, "cannot   find   UAC_HEADER\\n" ) ; return - EINVAL ; }  switch ( protocol ) { <START_BUG> default : dev_warn ( & dev -> dev, "unknown   interface   protocol   %#02x,   assuming   v1\\n", protocol ) ; case UAC_VERSION_1 : { struct uac1_ac_header_descriptor * h1 = control_header ; <END_BUG> if (! h1 -> bInCollection ) {  <START_BUG> dev_info ( & dev -> dev, "skipping   empty   audio   interface   (v1)\\n" ) ; <END_BUG> return - EINVAL ; } if ( h1 -> bLength < sizeof ( * h1 ) + h1 -> bInCollection ) { dev_err ( & dev -> dev, "invalid   UAC_HEADER   (v1)\\n" ) ; return - EINVAL ; } for ( i = 0 ; i < h1 -> bInCollection ; i ++ ) snd_usb_create_stream ( chip, ctrlif, h1 -> baInterfaceNr [ i ] ) ; break ; } case UAC_VERSION_2 : { struct usb_interface_assoc_descriptor * assoc = usb_ifnum_to_if ( dev, ctrlif ) -> intf_assoc ; if (! assoc ) { struct usb_interface * iface = usb_ifnum_to_if ( dev, ctrlif + 1 ) ; if ( iface && iface -> intf_assoc && iface -> intf_assoc -> bFunctionClass ==

Fix:
<S2SV_ModStart> i, protocol ; int rest_bytes <S2SV_ModStart> EINVAL ; } rest_bytes = ( void * ) ( host_iface -> extra + host_iface -> extralen ) - control_header ; if ( rest_bytes <= 0 ) { dev_err ( & dev -> dev, "invalid <S2SV_blank> control <S2SV_blank> header\\n" ) ; return - EINVAL ; } <S2SV_ModStart> ; if ( rest_bytes < sizeof ( * h1 ) ) { dev_err ( & dev -> dev, "too <S2SV_blank> short <S2SV_blank> v1 <S2SV_blank> buffer <S2SV_blank> descriptor\\n" ) ; return - EINVAL ; } if ( <S2SV_ModStart> dev, "skipping <S2SV_blank> empty <S2SV_blank> audio <S2SV_blank> interface <S2SV_blank> (v1)\\n" ) ; return - EINVAL ; } if ( rest_bytes < h1 -> bLength ) { dev_err ( & dev -> dev, "invalid <S2SV_blank> buffer <S2SV_blank> length <S2SV_blank> (v1)\\n"
Buggy code:
 int fpm_stdio_init_child ( struct fpm_worker_pool_s * wp ) { # ifdef HAVE_SYSLOG_H if ( fpm_globals. error_log_fd == ZLOG_SYSLOG ) { closelog ( ) ; } else # endif if ( fpm_globals. error_log_fd > 0 ) { close ( fpm_globals. error_log_fd ) ; } fpm_globals. error_log_fd = - 1 ; zlog_set_fd ( - 1 ) ; <START_BUG> if ( wp -> listening_socket!= STDIN_FILENO ) { <END_BUG> if ( 0 > dup2 ( wp -> listening_socket, STDIN_FILENO ) ) { zlog ( ZLOG_SYSERROR, "failed   to   init   child   stdio:   dup2()" ) ; return - 1 ; } } return 0 ; }

Fix:
<S2SV_ModStart> 1 ) ; <S2SV_ModEnd> return 0 ;
Buggy code:
 static int __poke_user ( struct task_struct * child, addr_t addr, addr_t data ) { struct user * dummy = NULL ; addr_t offset ; if ( addr < ( addr_t ) & dummy -> regs. acrs ) { if ( addr == ( addr_t ) & dummy -> regs. psw. mask ) { unsigned long mask = PSW_MASK_USER ; mask |= is_ri_task ( child )? PSW_MASK_RI : 0 ; <START_BUG> if ( ( data & ~ mask )!= PSW_USER_BITS ) <END_BUG> return - EINVAL ; if ( ( data & PSW_MASK_EA ) &&! ( data & PSW_MASK_BA ) ) return - EINVAL ; } * ( addr_t * ) ( ( addr_t ) & task_pt_regs ( child ) -> psw + addr ) = data ; } else if ( addr < ( addr_t ) ( & dummy -> regs. orig_gpr2 ) ) { offset = addr - ( addr_t ) & dummy -> regs. acrs ; # ifdef CONFIG_64BIT if ( addr == ( addr_t ) & dummy -> regs. acrs [ 15 ] ) child -> thread. acrs [ 15 ] = ( unsigned int ) ( data >> 32 ) ; else # endif * ( addr_t * ) ( ( addr_t ) & child -> thread. acrs + offset ) = data ; } else if ( addr == ( addr_t ) & dummy -> regs. orig_gpr2 ) { task_pt_regs ( child ) -> orig_gpr2 = data ; } else if ( addr < ( addr_t ) & dummy -> regs. fp_regs ) { return 0 ; } else if ( addr < ( addr_t ) ( & dummy -> regs. fp_regs + 1 ) ) { if ( addr == ( addr_t ) & dummy -> regs. fp_regs. fpc ) if ( ( unsigned int ) data!= 0 || test_fp_ctl ( data >> ( BITS_PER_LONG - 32 ) ) ) return - EINVAL ; offset = addr - ( addr_t ) & dummy -> regs. fp_regs ; * ( addr_t * ) ( ( addr_t ) & child -> thread. fp_regs +

Fix:
<S2SV_ModStart> ( ( data ^ PSW_USER_BITS ) <S2SV_ModStart> ~ mask ) return - EINVAL ; if ( ( data & PSW_MASK_ASC ) == PSW_ASC_HOME <S2SV_ModEnd> ) return -
Buggy code:
 static int lmp_print_data_link_subobjs ( netdissect_options * ndo, const u_char * obj_tptr, int total_subobj_len, int offset ) { int hexdump = FALSE ; int subobj_type, subobj_len ; union { float f ; uint32_t i ; } bw ; while ( total_subobj_len > 0 && hexdump == FALSE ) { subobj_type = EXTRACT_8BITS ( obj_tptr + offset ) ; subobj_len = EXTRACT_8BITS ( obj_tptr + offset + 1 ) ; ND_PRINT ( ( ndo, "\\n\\t         Subobject,   Type:   %s   (%u),   Length:   %u", tok2str ( lmp_data_link_subobj, "Unknown", subobj_type ), subobj_type, subobj_len ) ) ; if ( subobj_len < 4 ) { ND_PRINT ( ( ndo, "   (too   short)" ) ) ; break ; } if ( ( subobj_len % 4 )!= 0 ) { ND_PRINT ( ( ndo, "   (not   a   multiple   of   4)" ) ) ; break ; } if ( total_subobj_len < subobj_len ) { ND_PRINT ( ( ndo, "   (goes   past   the   end   of   the   object)" ) ) ; break ; } switch ( subobj_type ) { case INT_SWITCHING_TYPE_SUBOBJ : ND_PRINT ( ( ndo, "\\n\\t             Switching   Type:   %s   (%u)", tok2str ( gmpls_switch_cap_values, "Unknown", EXTRACT_8BITS ( obj_tptr + offset + 2 ) ), EXTRACT_8BITS ( obj_tptr + offset + 2 ) ) ) ; ND_PRINT ( ( ndo, "\\n\\t             Encoding   Type:   %s   (%u)", tok2str ( gmpls_encoding_values, "Unknown", EXTRACT_8BITS ( obj_tptr + offset + 3 ) ), EXTRACT_8BITS ( obj_t

Fix:
<S2SV_ModStart> ) ) ; ND_TCHECK_32BITS ( obj_tptr + offset + 4 ) ; <S2SV_ModStart> hexdump ) ; trunc : return - 1 ;
Buggy code:
 static ssize_t yurex_read ( struct file * file, char __user * buffer, size_t count, loff_t * ppos ) { struct usb_yurex * dev ; <START_BUG> int retval = 0 ; <END_BUG> int bytes_read = 0 ; char in_buffer [ 20 ] ; unsigned long flags ; dev = file -> private_data ; mutex_lock ( & dev -> io_mutex ) ; if (! dev -> interface ) {  retval = - ENODEV ; <START_BUG> goto exit ; } spin_lock_irqsave ( & dev -> lock, flags ) ; <END_BUG> bytes_read = snprintf ( in_buffer, 20, "%lld\\n", dev -> bbu ) ;  spin_unlock_irqrestore ( & dev -> lock, flags ) ; <START_BUG> if ( * ppos < bytes_read ) { <END_BUG> if ( copy_to_user ( buffer, in_buffer + * ppos, bytes_read - * ppos ) ) retval = - EFAULT ; else { retval = bytes_read - * ppos ; * ppos += bytes_read ; } } exit : mutex_unlock ( & dev -> io_mutex ) ;  return retval ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> dev ; int len <S2SV_ModEnd> = 0 ; <S2SV_ModStart> interface ) { mutex_unlock ( & dev -> io_mutex ) ; return - ENODEV <S2SV_ModEnd> ; } spin_lock_irqsave <S2SV_ModStart> flags ) ; len <S2SV_ModEnd> = snprintf ( <S2SV_ModStart> flags ) ; <S2SV_ModEnd> mutex_unlock ( & <S2SV_ModStart> ) ; return simple_read_from_buffer ( buffer, count, ppos, in_buffer, len ) <S2SV_ModEnd> ; } <S2SV_null>