nus-yam/ex-repair huggingface dataset:
Buggy code:
 static void decode_macroblock ( VP8D_COMP * pbi, MACROBLOCKD * xd, unsigned int mb_idx ) { MB_PREDICTION_MODE mode ; int i ; # if CONFIG_ERROR_CONCEALMENT int corruption_detected = 0 ; <START_BUG> # endif <END_BUG> if ( xd -> mode_info_context -> mbmi. mb_skip_coeff ) { vp8_reset_mb_tokens_context ( xd ) ; } else if (! vp8dx_bool_error ( xd -> current_bc ) ) { int eobtotal ; eobtotal = vp8_decode_mb_tokens ( pbi, xd ) ; xd -> mode_info_context -> mbmi. mb_skip_coeff = ( eobtotal == 0 ) ; } mode = xd -> mode_info_context -> mbmi. mode ; if ( xd -> segmentation_enabled ) vp8_mb_init_dequantizer ( pbi, xd ) ; # if CONFIG_ERROR_CONCEALMENT if ( pbi -> ec_active ) { int throw_residual ; throw_residual = (! pbi -> independent_partitions && pbi -> frame_corrupt_residual ) ; throw_residual = ( throw_residual || vp8dx_bool_error ( xd -> current_bc ) ) ; if ( ( mb_idx >= pbi -> mvs_corrupt_from_mb || throw_residual ) ) { pbi -> frame_corrupt_residual = 1 ;  vpx_memset ( xd -> qcoeff, 0, sizeof ( xd -> qcoeff ) ) ; <START_BUG> vp8_conceal_corrupt_mb ( xd ) ; corruption_detected = 1 ; <END_BUG> vpx_memset ( xd -> eobs, 0, 25 ) ;  } } # endif if ( xd -> mode_info_context -> mbmi. ref_frame == INTRA_FRAME ) { vp8_build_intra_predictors_mbuv_s ( xd, xd -> recon_above [ 1 ], xd -> recon_above [ 2 ], xd -> recon_left [ 1 ], xd -> recon_left [ 2 ], xd -> recon_left_stride [ 1 ], xd -> dst. u_buffer, xd -> dst. v_buffer, xd -> dst

Fix:
<S2SV_ModStart> 0 ; # else ( void ) mb_idx ; # <S2SV_ModStart> = 1 ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> = 1 ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart>. mb_skip_coeff ) memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> dst_stride ) ; memset <S2SV_ModEnd> ( b -> <S2SV_ModStart> qcoeff ) ; memset <S2SV_ModEnd> ( b -> <S2SV_ModStart> qcoeff ) ; memset <S2SV_ModEnd> ( b ->
Buggy code:
 int parse_sym_line ( buf, which_set ) char * buf ; int which_set ; { int val, i ; struct symparse * symp ; <START_BUG> char * bufp, * commentp, * altp ; <END_BUG> mungspaces ( buf ) ; if ( ( commentp = rindex ( buf, '#' ) )!= 0 && commentp [ - 1 ] ==' ') commentp [ - 1 ] = '\\0' ; bufp = index ( buf, '=' ) ; altp = index ( buf, ':' ) ; if (! bufp || ( altp && altp < bufp ) ) bufp = altp ; if (! bufp ) { if ( strncmpi ( buf, "finish", 6 ) == 0 ) { if ( chosen_symset_start ) chosen_symset_end = TRUE ; chosen_symset_start = FALSE ; return 1 ; } config_error_add ( "No   \\"finish\\"" ) ; return 0 ; } ++ bufp ; if ( * bufp ==' ') ++ bufp ; symp = match_sym ( buf ) ; if (! symp ) { config_error_add ( "Unknown   sym   keyword" ) ; return 0 ; } if (! symset [ which_set ]. name ) { if ( symp -> range == SYM_CONTROL ) { struct symsetentry * tmpsp, * lastsp ; for ( lastsp = symset_list ; lastsp ; lastsp = lastsp -> next ) if (! lastsp -> next ) break ; switch ( symp -> idx ) { case 0 : tmpsp = ( struct symsetentry * ) alloc ( sizeof * tmpsp ) ; tmpsp -> next = ( struct symsetentry * ) 0 ; if (! lastsp ) symset_list = tmpsp ; else lastsp -> next = tmpsp ; tmpsp -> idx = symset_count ++ ; tmpsp -> name = dupstr ( bufp ) ; tmpsp -> desc = ( char * ) 0 ; tmpsp -> handling = H_UNK ; tmpsp -> nocolor = 0 ; tmpsp -> primary = 0 ; tmpsp -> rogue = 0 ; break ; case 2 : tmpsp = lastsp ; for ( i = 0 ; known_handling [ i ]

Fix:
<S2SV_ModStart>, * altp ; if ( strlen ( buf ) >= BUFSZ ) buf [ BUFSZ - 1 ] = '\\0'
Buggy code:
 <START_BUG> static TX_SIZE read_tx_size ( VP9_COMMON * cm, MACROBLOCKD * xd, TX_MODE tx_mode, <END_BUG>  BLOCK_SIZE bsize, int allow_select, vp9_reader * r ) { <START_BUG> const TX_SIZE max_tx_size = max_txsize_lookup [ bsize ] ; if ( allow_select && tx_mode == TX_MODE_SELECT && bsize >= BLOCK_8X8 ) return read_selected_tx_size ( cm, xd, max_tx_size, r ) ; else return MIN ( max_tx_size, tx_mode_to_biggest_tx_size [ tx_mode ] ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * xd, <S2SV_ModEnd> int allow_select, <S2SV_ModStart> int allow_select, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> r ) { TX_MODE tx_mode = cm -> tx_mode ; BLOCK_SIZE bsize = xd -> mi [ 0 ] -> mbmi. sb_type ;
Buggy code:
 static void findoprnd ( ITEM * ptr, int32 * pos ) <START_BUG> { <END_BUG> # ifdef BS_DEBUG elog ( DEBUG3, ( ptr [ * pos ]. type == OPR )? "%d     %c" : "%d     %d", * pos, ptr [ * pos ]. val ) ; # endif if ( ptr [ * pos ]. type == VAL ) { ptr [ * pos ]. left = 0 ; ( * pos ) -- ; } else if ( ptr [ * pos ]. val == ( int32 ) '!' ) { ptr [ * pos ]. left = - 1 ; ( * pos ) -- ; findoprnd ( ptr, pos ) ; } else { ITEM * curitem = & ptr [ * pos ] ; int32 tmp = * pos ; ( * pos ) -- ; findoprnd ( ptr, pos ) ; curitem -> left = * pos - tmp ; findoprnd ( ptr, pos ) ; } }

Fix:
<S2SV_ModStart> pos ) { check_stack_depth ( ) ;
Buggy code:
 <START_BUG> double vp9_convert_qindex_to_q ( int qindex ) { <END_BUG>  return vp9_ac_quant ( qindex, 0 ) // 4.0 ; <START_BUG> <END_BUG> } 

Fix:
<S2SV_ModStart> ( int qindex, vpx_bit_depth_t bit_depth ) { # if CONFIG_VP9_HIGHBITDEPTH switch ( bit_depth ) { case VPX_BITS_8 : <S2SV_ModEnd> return vp9_ac_quant ( <S2SV_ModStart> qindex, 0, bit_depth <S2SV_ModStart> // 4.0 ; case VPX_BITS_10 : return vp9_ac_quant ( qindex, 0, bit_depth ) // 16.0 ; case VPX_BITS_12 : return vp9_ac_quant ( qindex, 0, bit_depth ) // 64.0 ; default : assert ( 0 && "bit_depth <S2SV_blank> should <S2SV_blank> be <S2SV_blank> VPX_BITS_8, <S2SV_blank> VPX_BITS_10 <S2SV_blank> or <S2SV_blank> VPX_BITS_12" ) ; return - 1.0 ; } # else return vp9_ac_quant ( qindex, 0, bit_depth ) // 4.0 ; # endif
Buggy code:
 static int get_results ( struct iperf_test * test ) { int r = 0 ; cJSON * j ; cJSON * j_cpu_util_total ; cJSON * j_cpu_util_user ; cJSON * j_cpu_util_system ; cJSON * j_sender_has_retransmits ; int result_has_retransmits ; cJSON * j_streams ; int n, i ; cJSON * j_stream ; cJSON * j_id ; cJSON * j_bytes ; cJSON * j_retransmits ; cJSON * j_jitter ; cJSON * j_errors ; cJSON * j_packets ; cJSON * j_server_output ; int sid, cerror, pcount ; double jitter ; iperf_size_t bytes_transferred ; int retransmits ; struct iperf_stream * sp ; j = JSON_read ( test -> ctrl_sck ) ; if ( j == NULL ) { i_errno = IERECVRESULTS ; r = - 1 ; } else { j_cpu_util_total = cJSON_GetObjectItem ( j, "cpu_util_total" ) ; j_cpu_util_user = cJSON_GetObjectItem ( j, "cpu_util_user" ) ; j_cpu_util_system = cJSON_GetObjectItem ( j, "cpu_util_system" ) ; j_sender_has_retransmits = cJSON_GetObjectItem ( j, "sender_has_retransmits" ) ; if ( j_cpu_util_total == NULL || j_cpu_util_user == NULL || j_cpu_util_system == NULL || j_sender_has_retransmits == NULL ) { i_errno = IERECVRESULTS ; r = - 1 ; } else { if ( test -> debug ) { printf ( "get_results\\n%s\\n", cJSON_Print ( j ) ) ; } <START_BUG> test -> remote_cpu_util [ 0 ] = j_cpu_util_total -> valuefloat ; <END_BUG>  test -> remote_cpu_util [ 1 ] = j_cpu_util_user -> valuefloat ; <START_BUG> <END_BUG> test -> remote_cpu_util [ 2 ] = j_cpu_util_system -> valuefloat ;  result_has_

Fix:
<S2SV_ModStart> = j_cpu_util_total -> valuedouble <S2SV_ModEnd> ; test -> <S2SV_ModStart> = j_cpu_util_user -> valuedouble <S2SV_ModEnd> ; test -> <S2SV_ModStart> = j_cpu_util_system -> valuedouble <S2SV_ModEnd> ; result_has_retransmits = <S2SV_ModStart> = j_jitter -> valuedouble <S2SV_ModEnd> ; cerror =
Buggy code:
 static int pn_recvmsg ( struct kiocb * iocb, struct sock * sk, struct msghdr * msg, size_t len, int noblock, int flags, int * addr_len ) { struct sk_buff * skb = NULL ; struct sockaddr_pn sa ; int rval = - EOPNOTSUPP ; int copylen ; if ( flags & ~ ( MSG_PEEK | MSG_TRUNC | MSG_DONTWAIT | MSG_NOSIGNAL | MSG_CMSG_COMPAT ) ) <START_BUG> goto out_nofree ; <END_BUG> if ( addr_len ) * addr_len = sizeof ( sa ) ; skb = skb_recv_datagram ( sk, flags, noblock, & rval ) ; if ( skb == NULL ) goto out_nofree ; pn_skb_get_src_sockaddr ( skb, & sa ) ; copylen = skb -> len ; if ( len < copylen ) { msg -> msg_flags |= MSG_TRUNC ; copylen = len ; } rval = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copylen ) ; if ( rval ) { rval = - EFAULT ; goto out ; } rval = ( flags & MSG_TRUNC )? skb -> len : copylen ;  if ( msg -> msg_name!= NULL ) <START_BUG> <END_BUG> memcpy ( msg -> msg_name, & sa, sizeof ( struct sockaddr_pn ) ) ;  out : skb_free_datagram ( sk, skb ) ; out_nofree : return rval ; }

Fix:
<S2SV_ModStart> ) goto out_nofree <S2SV_ModEnd> ; skb = <S2SV_ModStart>!= NULL ) { <S2SV_ModStart>, sizeof ( sa ) ) ; * addr_len = sizeof ( sa ) ; } <S2SV_ModEnd> out : skb_free_datagram
Buggy code:
 static void update_golden_frame_stats ( VP9_COMP * cpi ) { RATE_CONTROL * const rc = & cpi -> rc ; if ( cpi -> refresh_golden_frame ) { rc -> frames_since_golden = 0 ; <START_BUG> if (! rc -> source_alt_ref_pending ) <END_BUG>  rc -> source_alt_ref_active = 0 ; <START_BUG> if ( rc -> frames_till_gf_update_due > 0 ) rc -> frames_till_gf_update_due -- ; } else if (! cpi -> refresh_alt_ref_frame ) { if ( rc -> frames_till_gf_update_due > 0 ) rc -> frames_till_gf_update_due -- ; rc -> frames_since_golden ++ ; } }<END_BUG>

Fix:
<S2SV_ModStart> -> source_alt_ref_pending ) { <S2SV_ModStart> = 0 ; }
Buggy code:
 static void set_fdc ( int drive ) <START_BUG> { <END_BUG> if ( drive >= 0 && drive < N_DRIVE ) {  fdc = FDC ( drive ) ; <START_BUG> current_drive = drive ; } <END_BUG> if ( fdc!= 1 && fdc!= 0 ) {  pr_info ( "bad   fdc   value\\n" ) ; return ; <START_BUG> } <END_BUG> set_dor ( fdc, ~ 0, 8 ) ; # if N_FDC > 1 set_dor ( 1 - fdc, ~ 8, 0 ) ; # endif if ( FDCS -> rawcmd == 2 ) reset_fdc_info ( 1 ) ; if ( fd_inb ( FD_STATUS )!= STATUS_READY ) FDCS -> reset = 1 ; }

Fix:
<S2SV_ModStart> drive ) { unsigned int new_fdc = fdc ; <S2SV_ModStart> N_DRIVE ) { new_fdc <S2SV_ModEnd> = FDC ( <S2SV_ModStart> } if ( new_fdc >= N_FDC <S2SV_ModEnd> ) { pr_info <S2SV_ModStart> return ; } fdc = new_fdc ;
Buggy code:
 STATIC int xfs_attr_node_addname ( xfs_da_args_t * args ) { xfs_da_state_t * state ; xfs_da_state_blk_t * blk ; xfs_inode_t * dp ; xfs_mount_t * mp ; int committed, retval, error ; trace_xfs_attr_node_addname ( args ) ; dp = args -> dp ; mp = dp -> i_mount ; restart : state = xfs_da_state_alloc ( ) ; state -> args = args ; state -> mp = mp ; state -> blocksize = state -> mp -> m_sb. sb_blocksize ; state -> node_ents = state -> mp -> m_attr_node_ents ; error = xfs_da3_node_lookup_int ( state, & retval ) ; if ( error ) goto out ; blk = & state -> path. blk [ state -> path. active - 1 ] ; ASSERT ( blk -> magic == XFS_ATTR_LEAF_MAGIC ) ; if ( ( args -> flags & ATTR_REPLACE ) && ( retval == ENOATTR ) ) { goto out ; } else if ( retval == EEXIST ) { if ( args -> flags & ATTR_CREATE ) goto out ; trace_xfs_attr_node_replace ( args ) ; args -> op_flags |= XFS_DA_OP_RENAME ; args -> blkno2 = args -> blkno ; args -> index2 = args -> index ; args -> rmtblkno2 = args -> rmtblkno ; args -> rmtblkcnt2 = args -> rmtblkcnt ; <START_BUG> args -> rmtblkno = 0 ; <END_BUG>  args -> rmtblkcnt = 0 ; <START_BUG> } retval = xfs_attr3_leaf_add ( blk -> bp, state -> args ) ; if ( retval == ENOSPC ) { if ( state -> path. active == 1 ) { xfs_da_state_free ( state ) ; state = NULL ; xfs_bmap_init ( args -> flist, args -> firstblock ) ; error = xfs_attr3_leaf_to_node ( args ) ; if (! error ) { error = xfs_bmap_finish ( & args -> trans, args -> flist, & committed<END_BUG>

Fix:
<S2SV_ModStart> ; args -> rmtvaluelen2 = args -> rmtvaluelen ; args -> <S2SV_ModStart> args -> rmtblkcnt = 0 ; args -> rmtvaluelen <S2SV_ModStart> args -> rmtblkcnt2 ; args -> rmtvaluelen = args -> rmtvaluelen2
Buggy code:
 <START_BUG> static void fadst4 ( const int16_t * input, int16_t * output ) { <END_BUG>  int x0, x1, x2, x3 ; <START_BUG> int s0, s1, s2, s3, s4, s5, s6, s7 ; x0 = input [ 0 ] ; x1 = input [ 1 ] ; x2 = input [ 2 ] ; x3 = input [ 3 ] ; if (! ( x0 | x1 | x2 | x3 ) ) { output [ 0 ] = output [ 1 ] = output [ 2 ] = output [ 3 ] = 0 ; return ; } s0 = sinpi_1_9 * x0 ; s1 = sinpi_4_9 * x0 ; s2 = sinpi_2_9 * x1 ; s3 = sinpi_1_9 * x1 ; s4 = sinpi_3_9 * x2 ; s5 = sinpi_4_9 * x3 ; s6 = sinpi_2_9 * x3 ; s7 = x0 + x1 - x3 ; x0 = s0 + s2 + s5 ; x1 = sinpi_3_9 * s7 ; x2 = s1 - s3 + s6 ; x3 = s4 ; s0 = x0 + x3 ; s1 = x1 ; s2 = x2 - x3 ; s3 = x2 - x0 + x3 ; <END_BUG> output [ 0 ] = fdct_round_shift ( s0 ) ;  <START_BUG> output [ 1 ] = fdct_round_shift ( s1 ) ; <END_BUG>  output [ 2 ] = fdct_round_shift ( s2 ) ; <START_BUG> <END_BUG> output [ 3 ] = fdct_round_shift ( s3 ) ;  }

Fix:
<S2SV_ModStart> fadst4 ( const tran_low_t * input, tran_low_t <S2SV_ModEnd> * output ) <S2SV_ModStart> output ) { tran_high_t x0, x1, x2, x3 ; tran_high_t <S2SV_ModEnd> s0, s1 <S2SV_ModStart> 0 ] = ( tran_low_t ) <S2SV_ModStart> 1 ] = ( tran_low_t ) <S2SV_ModStart> 2 ] = ( tran_low_t ) <S2SV_ModStart> 3 ] = ( tran_low_t )
Buggy code:
 rpmRC rpmReadPackageFile ( rpmts ts, FD_t fd, const char * fn, Header * hdrp ) { char * msg = NULL ; Header h = NULL ; Header sigh = NULL ; hdrblob blob = NULL ; hdrblob sigblob = NULL ; rpmVSFlags vsflags = rpmtsVSFlags ( ts ) | RPMVSF_NEEDPAYLOAD ; rpmKeyring keyring = rpmtsGetKeyring ( ts, 1 ) ; struct rpmvs_s * vs = rpmvsCreate ( 0, vsflags, keyring ) ; struct pkgdata_s pkgdata = {. msgfunc = loghdrmsg,. fn = fn? fn : Fdescr ( fd ),. msg = NULL,. rc = RPMRC_OK, } ; if ( hdrp ) * hdrp = NULL ; rpmRC rc = rpmpkgRead ( vs, fd, & sigblob, & blob, & msg ) ; if ( rc ) goto exit ; rc = RPMRC_FAIL ; if (! rpmvsVerify ( vs, RPMSIG_VERIFIABLE_TYPE, handleHdrVS, & pkgdata ) ) { if ( hdrp ) { if ( hdrblobImport ( sigblob, 0, & sigh, & msg ) ) goto exit ; if ( hdrblobImport ( blob, 0, & h, & msg ) ) goto exit ; <START_BUG> headerMergeLegacySigs ( h, sigh ) ; <END_BUG> applyRetrofits ( h ) ; * hdrp = headerLink ( h ) ; } rc = RPMRC_OK ; } if ( rc == RPMRC_OK && pkgdata. rc ) rc = pkgdata. rc ; exit : if ( rc && msg ) rpmlog ( RPMLOG_ERR, "%s:   %s\\n", Fdescr ( fd ), msg ) ; hdrblobFree ( sigblob ) ; hdrblobFree ( blob ) ; headerFree ( sigh ) ; headerFree ( h ) ; rpmKeyringFree ( keyring ) ; rpmvsFree ( vs ) ; free ( msg ) ; return rc ; }

Fix:
<S2SV_ModStart> goto exit ; if ( <S2SV_ModStart> h, sigh, & msg ) ) goto exit <S2SV_ModEnd> ; applyRetrofits (
Buggy code:
 static void init_buffer_callbacks ( vpx_codec_alg_priv_t * ctx ) { <START_BUG> VP9_COMMON * const cm = & ctx -> pbi -> common ; <END_BUG>  cm -> new_fb_idx = - 1 ; <START_BUG> if ( ctx -> get_ext_fb_cb!= NULL && ctx -> release_ext_fb_cb!= NULL ) { <END_BUG> cm -> get_fb_cb = ctx -> get_ext_fb_cb ;  <START_BUG> cm -> release_fb_cb = ctx -> release_ext_fb_cb ; <END_BUG>  cm -> cb_priv = ctx -> ext_priv ; <START_BUG> } else { <END_BUG> cm -> get_fb_cb = vp9_get_frame_buffer ;  <START_BUG> cm -> release_fb_cb = vp9_release_frame_buffer ; <END_BUG>  if ( vp9_alloc_internal_frame_buffers ( & cm -> int_frame_buffers ) ) <START_BUG> vpx_internal_error ( & cm -> error, VPX_CODEC_MEM_ERROR, "Failed   to   initialize   internal   frame   buffers" ) ; <END_BUG> cm -> cb_priv = & cm -> int_frame_buffers ;  } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> ctx ) { int i ; for ( i = 0 ; i < ctx -> num_frame_workers ; ++ i ) { VPxWorker * const worker = & ctx -> frame_workers [ i ] ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; <S2SV_ModStart> cm = & frame_worker_data <S2SV_ModEnd> -> pbi -> <S2SV_ModStart> -> common ; BufferPool * const pool = cm -> buffer_pool ; <S2SV_ModStart> -> new_fb_idx = INVALID_IDX ; cm -> byte_alignment = ctx -> byte_alignment ; cm -> skip_loop_filter = ctx -> skip_loop_filter <S2SV_ModEnd> ; if ( <S2SV_ModStart> NULL ) { pool <S2SV_ModEnd> -> get_fb_cb = <S2SV_ModStart> -> get_ext_fb_cb ; pool <S2SV_ModEnd> -> release_fb_cb = <S2SV_ModStart> -> release_ext_fb_cb ; pool <S2SV_ModEnd> -> cb_priv = <S2SV_ModStart> } else { pool <S2SV_ModEnd> -> get_fb_cb = <S2SV_ModStart> = vp9_get_frame_buffer ; pool <S2SV_ModEnd> -> release_fb_cb = <S2SV_ModStart> vp9_alloc_internal_frame_buffers ( & pool <S2SV_ModEnd> -> int_frame_buffers ) <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> initialize <S2SV_blank> internal <S2SV_blank> frame
Buggy code:
 static int ssl_verify_cert ( struct tunnel * tunnel ) { int ret = - 1 ; int cert_valid = 0 ; unsigned char digest [ SHA256LEN ] ; unsigned int len ; struct x509_digest * elem ; char digest_str [ SHA256STRLEN ], * subject, * issuer ; char * line ; int i ; X509_NAME * subj ; char common_name [ FIELD_SIZE + 1 ] ; SSL_set_verify ( tunnel -> ssl_handle, SSL_VERIFY_PEER, NULL ) ; X509 * cert = SSL_get_peer_certificate ( tunnel -> ssl_handle ) ; if ( cert == NULL ) { log_error ( "Unable   to   get   gateway   certificate.\\n" ) ; return 1 ; } subj = X509_get_subject_name ( cert ) ; # ifdef HAVE_X509_CHECK_HOST <START_BUG> if ( X509_check_host ( cert, common_name, FIELD_SIZE, 0, NULL ) ) <END_BUG> cert_valid = 1 ; # else if ( subj && X509_NAME_get_text_by_NID ( subj, NID_commonName, common_name, FIELD_SIZE ) > 0 && strncasecmp ( common_name, tunnel -> config -> gateway_host, FIELD_SIZE ) == 0 ) cert_valid = 1 ; # endif if ( cert_valid && SSL_get_verify_result ( tunnel -> ssl_handle ) == X509_V_OK ) { log_debug ( "Gateway   certificate   validation   succeeded.\\n" ) ; ret = 0 ; goto free_cert ; } log_debug ( "Gateway   certificate   validation   failed.\\n" ) ; if ( X509_digest ( cert, EVP_sha256 ( ), digest, & len ) <= 0 || len!= SHA256LEN ) { log_error ( "Could   not   compute   certificate   sha256   digest.\\n" ) ; goto free_cert ; } for ( i = 0 ; i < SHA256LEN ; i ++ ) sprintf ( & digest_str [ 2 * i ], "%02x", digest [ i ] ) ; digest_str [ SHA256STRLEN - 1 ] = '\\0' ; for ( elem = tunnel -> config -> cert_whitelist ; elem!= NULL ; elem = elem -> next ) if

Fix:
<S2SV_ModStart>, NULL ) == 1
Buggy code:
 int main ( int argc, char * argv [ ] ) { opj_dinfo_t * dinfo ; opj_event_mgr_t event_mgr ; int tnum ; unsigned int snum ; opj_mj2_t * movie ; mj2_tk_t * track ; mj2_sample_t * sample ; unsigned char * frame_codestream ; FILE * file, * outfile ; char outfilename [ 50 ] ; mj2_dparameters_t parameters ; if ( argc!= 3 ) { printf ( "Usage:   %s   mj2filename   output_location\\n", argv [ 0 ] ) ; printf ( "Example:   %s   foreman.mj2   output//foreman\\n", argv [ 0 ] ) ; return 1 ; } file = fopen ( argv [ 1 ], "rb" ) ; if (! file ) { fprintf ( stderr, "failed   to   open   %s   for   reading\\n", argv [ 1 ] ) ; return 1 ; } memset ( & event_mgr, 0, sizeof ( opj_event_mgr_t ) ) ; event_mgr. error_handler = error_callback ; event_mgr. warning_handler = warning_callback ; event_mgr. info_handler = info_callback ; dinfo = mj2_create_decompress ( ) ; opj_set_event_mgr ( ( opj_common_ptr ) dinfo, & event_mgr, stderr ) ; memset ( & parameters, 0, sizeof ( mj2_dparameters_t ) ) ; movie = ( opj_mj2_t * ) dinfo -> mj2_handle ; mj2_setup_decoder ( movie, & parameters ) ; if ( mj2_read_struct ( file, movie ) ) { return 1 ; } tnum = 0 ; while ( movie -> tk [ tnum ]. track_type!= 0 ) { tnum ++ ; } track = & movie -> tk [ tnum ] ; fprintf ( stdout, "Extracting   %d   frames   from   file...\\n", track -> num_samples ) ; for ( snum = 0 ; snum < track -> num_samples ; snum ++ ) { sample = & track -> sample [ snum ]

Fix:
<S2SV_ModStart> file ) ; int num = snprintf <S2SV_ModEnd> ( outfilename, <S2SV_ModStart> ( outfilename, sizeof ( outfilename ), <S2SV_ModStart> snum ) ; if ( num >= sizeof ( outfilename ) ) { fprintf ( stderr, "maximum <S2SV_blank> length <S2SV_blank> of <S2SV_blank> output <S2SV_blank> prefix <S2SV_blank> exceeded\\n" ) ; return 1 ; }
Buggy code:
 void Com_WriteConfig_f ( void ) { char filename [ MAX_QPATH ] ; if ( Cmd_Argc ( )!= 2 ) { <START_BUG> Com_Printf ( "Usage:   writeconfig   <filename>\\n" ) ; <END_BUG> return ; } Q_strncpyz ( filename, Cmd_Argv ( 1 ), sizeof ( filename ) ) ; COM_DefaultExtension ( filename, sizeof ( filename ), ".cfg" ) ; Com_Printf ( "Writing   %s.\\n", filename ) ; Com_WriteConfigToFile ( filename ) ; }

Fix:
<S2SV_ModStart> Com_Printf ( "Usage: <S2SV_blank> writeconfig <S2SV_blank> <filename>\\n" ) ; return ; } if (! COM_CompareExtension ( filename, ".cfg" ) ) { Com_Printf ( "Com_WriteConfig_f: <S2SV_blank> Only <S2SV_blank> the <S2SV_blank> \\".cfg\\" <S2SV_blank> extension <S2SV_blank> is <S2SV_blank> supported <S2SV_blank> by <S2SV_blank> this <S2SV_blank> command!\\n"
Buggy code:
 static void read_intra_frame_mode_info ( VP9_COMMON * const cm, MACROBLOCKD * const xd, <START_BUG> int mi_row, int mi_col, vp9_reader * r ) { <END_BUG> MODE_INFO * const mi = xd -> mi [ 0 ] ; MB_MODE_INFO * const mbmi = & mi -> mbmi ;  const MODE_INFO * above_mi = xd -> mi [ - cm -> mi_stride ] ; <START_BUG> <END_BUG> const MODE_INFO * left_mi = xd -> left_available? xd -> mi [ - 1 ] : NULL ;  const BLOCK_SIZE bsize = mbmi -> sb_type ; int i ; <START_BUG> mbmi -> segment_id = read_intra_segment_id ( cm, xd, mi_row, mi_col, r ) ; <END_BUG> mbmi -> skip = read_skip ( cm, xd, mbmi -> segment_id, r ) ;  mbmi -> tx_size = read_tx_size ( cm, xd, cm -> tx_mode, bsize, 1, r ) ; <START_BUG> mbmi -> ref_frame [ 0 ] = INTRA_FRAME ; mbmi -> ref_frame [ 1 ] = NONE ; switch ( bsize ) { case BLOCK_4X4 : for ( i = 0 ; i < 4 ; ++ i ) mi -> bmi [ i ]. as_mode = read_intra_mode ( r, get_y_mode_probs ( mi, above_mi, left_mi, i ) ) ; mbmi -> mode = mi -> bmi [ 3 ]. as_mode ; break ; case BLOCK_4X8 : mi -> bmi [ 0 ]. as_mode = mi -> bmi [ 2 ]. as_mode = read_intra_mode ( r, get_y_mode_probs ( mi, above_mi, left_mi, 0 ) ) ; mi -> bmi [ 1 ]. as_mode = mi -> bmi [ 3 ]. as_mode = mbmi -> mode = read_intra_mode ( r, get_y_mode_probs ( mi, above_mi, left_mi, 1 ) ) ; break ; case BLOCK_8X4 : mi -> bmi [ 0 ]. as_mode = mi -> bmi [ 1 ]. as_mode<END_BUG>

Fix:
<S2SV_ModStart> int mi_col, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> = xd -> above_mi <S2SV_ModEnd> ; const MODE_INFO <S2SV_ModStart> = xd -> left_mi <S2SV_ModEnd> ; const BLOCK_SIZE <S2SV_ModStart> int i ; const int mi_offset = mi_row * cm -> mi_cols + mi_col ; const int bw = xd -> plane [ 0 ]. n4_w >> 1 ; const int bh = xd -> plane [ 0 ]. n4_h >> 1 ; const int x_mis = MIN ( cm -> mi_cols - mi_col, bw ) ; const int y_mis = MIN ( cm -> mi_rows - mi_row, bh ) ; <S2SV_ModStart> ( cm, mi_offset, x_mis, y_mis <S2SV_ModEnd>, r ) <S2SV_ModStart> cm, xd <S2SV_ModEnd>, 1,
Buggy code:
 <START_BUG> static INLINE void add_token ( TOKENEXTRA * * t, const vp9_prob * context_tree, <END_BUG>  int16_t extra, uint8_t token, <START_BUG> uint8_t skip_eob_node, unsigned int * counts ) { ( * t ) -> token = token ; ( * t ) -> extra = extra ; ( * t ) -> context_tree = context_tree ; ( * t ) -> skip_eob_node = skip_eob_node ; ( * t ) ++ ; ++ counts [ token ] ; }<END_BUG>

Fix:
<S2SV_ModStart> t, const vpx_prob <S2SV_ModEnd> * context_tree, <S2SV_ModStart> * context_tree, int32_t <S2SV_ModEnd> extra, uint8_t
Buggy code:
 int rds_sendmsg ( struct socket * sock, struct msghdr * msg, size_t payload_len ) { struct sock * sk = sock -> sk ; struct rds_sock * rs = rds_sk_to_rs ( sk ) ; DECLARE_SOCKADDR ( struct sockaddr_in *, usin, msg -> msg_name ) ; __be32 daddr ; __be16 dport ; struct rds_message * rm = NULL ; struct rds_connection * conn ; int ret = 0 ; int queued = 0, allocated_mr = 0 ; int nonblock = msg -> msg_flags & MSG_DONTWAIT ; long timeo = sock_sndtimeo ( sk, nonblock ) ; if ( msg -> msg_flags & ~ ( MSG_DONTWAIT | MSG_CMSG_COMPAT ) ) { ret = - EOPNOTSUPP ; goto out ; } if ( msg -> msg_namelen ) { if ( msg -> msg_namelen < sizeof ( * usin ) || usin -> sin_family!= AF_INET ) { ret = - EINVAL ; goto out ; } daddr = usin -> sin_addr. s_addr ; dport = usin -> sin_port ; } else { lock_sock ( sk ) ; daddr = rs -> rs_conn_addr ; dport = rs -> rs_conn_port ; release_sock ( sk ) ; } <START_BUG> if ( daddr == 0 || rs -> rs_bound_addr == 0 ) { <END_BUG>  ret = - ENOTCONN ; <START_BUG> goto out ; <END_BUG> }  if ( payload_len > rds_sk_sndbuf ( rs ) ) { ret = - EMSGSIZE ; goto out ; } ret = rds_rm_size ( msg, payload_len ) ; if ( ret < 0 ) goto out ; rm = rds_message_alloc ( ret, GFP_KERNEL ) ; if (! rm ) { ret = - ENOMEM ; goto out ; } if ( payload_len ) { rm -> data. op_sg = rds_message_alloc_sgs ( rm, ceil ( payload_len, PAGE_SIZE ) ) ; if (! rm -> data. op_sg ) { ret = - ENOMEM ; goto out ; } ret = rds_message_copy_from_user ( rm, &

Fix:
<S2SV_ModStart> ) ; } lock_sock ( sk ) ; <S2SV_ModStart> 0 ) { release_sock ( sk ) ; <S2SV_ModStart> out ; } release_sock ( sk ) ;
Buggy code:
 <START_BUG> static BLOCK_SIZE get_rd_var_based_fixed_partition ( VP9_COMP * cpi, <END_BUG> int mi_row, int mi_col ) {  unsigned int var = get_sby_perpixel_diff_variance ( cpi, & cpi -> mb, <START_BUG> mi_row, mi_col, BLOCK_64X64 ) ; if ( var < 8 ) return BLOCK_64X64 ; else if ( var < 128 ) return BLOCK_32X32 ; else if ( var < 2048 ) return BLOCK_16X16 ; else return BLOCK_8X8 ; }<END_BUG>

Fix:
<S2SV_ModStart> VP9_COMP * cpi, MACROBLOCK * x <S2SV_ModStart> cpi, & x -> plane [ 0 ]. src <S2SV_ModEnd>, mi_row,
Buggy code:
 int ares_parse_a_reply ( const unsigned char * abuf, int alen, struct hostent * * host ) { unsigned int qdcount, ancount ; int status, i, rr_type, rr_class, rr_len, naddrs ; long int len ; int naliases ; const unsigned char * aptr ; char * hostname, * rr_name, * rr_data, * * aliases ; struct in_addr * addrs ; struct hostent * hostent ; * host = NULL ; if ( alen < HFIXEDSZ ) return ARES_EBADRESP ; qdcount = DNS_HEADER_QDCOUNT ( abuf ) ; ancount = DNS_HEADER_ANCOUNT ( abuf ) ; if ( qdcount!= 1 ) return ARES_EBADRESP ; aptr = abuf + HFIXEDSZ ; status = ares_expand_name ( aptr, abuf, alen, & hostname, & len ) ; if ( status!= ARES_SUCCESS ) return status ; if ( aptr + len + QFIXEDSZ > abuf + alen ) { free ( hostname ) ; return ARES_EBADRESP ; } aptr += len + QFIXEDSZ ; addrs = malloc ( ancount * sizeof ( struct in_addr ) ) ; if (! addrs ) { free ( hostname ) ; return ARES_ENOMEM ; } aliases = malloc ( ( ancount + 1 ) * sizeof ( char * ) ) ; if (! aliases ) { free ( hostname ) ; free ( addrs ) ; return ARES_ENOMEM ; } naddrs = 0 ; naliases = 0 ; for ( i = 0 ; i < ( int ) ancount ; i ++ ) { status = ares_expand_name ( aptr, abuf, alen, & rr_name, & len ) ; if ( status!= ARES_SUCCESS ) break ; aptr += len ; if ( aptr + RRFIXEDSZ > abuf + alen ) { free ( rr_name ) ; status = ARES_EBADRESP ; break ; } rr_type = DNS_RR_TYPE ( aptr ) ; rr_class = DNS_RR_CLASS ( aptr ) ; rr_len = DNS_RR_LEN ( aptr ) ; <START_BUG> aptr += RRFIXEDSZ ; <END_BUG> if ( rr

Fix:
<S2SV_ModStart> += RRFIXEDSZ ; if ( aptr + rr_len > abuf + alen ) { free ( rr_name ) ; status = ARES_EBADRESP ; break ; }
Buggy code:
 static char * fp_readl ( char * s, int size, struct tok_state * tok ) { PyObject * bufobj ; const char * buf ; Py_ssize_t buflen ; assert ( size > 0 ) ; size -- ; if ( tok -> decoding_buffer ) { bufobj = tok -> decoding_buffer ; Py_INCREF ( bufobj ) ; } else { <START_BUG> bufobj = PyObject_CallObject ( tok -> decoding_readline, NULL ) ; <END_BUG> if ( bufobj == NULL ) goto error ; } if ( PyUnicode_CheckExact ( bufobj ) ) { buf = PyUnicode_AsUTF8AndSize ( bufobj, & buflen ) ; if ( buf == NULL ) { goto error ; } } else { buf = PyByteArray_AsString ( bufobj ) ; if ( buf == NULL ) { goto error ; } buflen = PyByteArray_GET_SIZE ( bufobj ) ; } Py_XDECREF ( tok -> decoding_buffer ) ; if ( buflen > size ) { tok -> decoding_buffer = PyByteArray_FromStringAndSize ( buf + size, buflen - size ) ; if ( tok -> decoding_buffer == NULL ) goto error ; buflen = size ; } else tok -> decoding_buffer = NULL ; memcpy ( s, buf, buflen ) ; s [ buflen ] = '\\0' ; if ( buflen == 0 ) s = NULL ; Py_DECREF ( bufobj ) ; return s ; error : Py_XDECREF ( bufobj ) ; return error_ret ( tok ) ; }

Fix:
<S2SV_ModStart> { bufobj = _PyObject_CallNoArg <S2SV_ModEnd> ( tok -> <S2SV_ModStart> tok -> decoding_readline <S2SV_ModEnd> ) ; if
Buggy code:
 <START_BUG> static void encode_frame ( vpx_codec_ctx_t * codec, <END_BUG> vpx_image_t * img, int frame_index, int flags,  VpxVideoWriter * writer ) { <START_BUG> vpx_codec_iter_t iter = NULL ; const vpx_codec_cx_pkt_t * pkt = NULL ; const vpx_codec_err_t res = vpx_codec_encode ( codec, img, frame_index, 1, flags, VPX_DL_GOOD_QUALITY ) ; if ( res!= VPX_CODEC_OK ) die_codec ( codec, "Failed   to   encode   frame" ) ; <END_BUG> while ( ( pkt = vpx_codec_get_cx_data ( codec, & iter ) )!= NULL ) {  if ( pkt -> kind == VPX_CODEC_CX_FRAME_PKT ) { const int keyframe = ( pkt -> data. frame. flags & VPX_FRAME_IS_KEY )!= 0 ; if (! vpx_video_writer_write_frame ( writer, pkt -> data. frame. buf, pkt -> data. frame. sz, pkt -> data. frame. pts ) ) { die_codec ( codec, "Failed   to   write   compressed   frame" ) ; } printf ( keyframe? "K" : "." ) ; fflush ( stdout ) ; } } <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> encode_frame ( vpx_codec_ctx_t <S2SV_ModStart> writer ) { int got_pkts = 0 ; <S2SV_ModStart> NULL ) { got_pkts = 1 ; <S2SV_ModStart> ; } } return got_pkts ;
Buggy code:
 static void nfs_printfh ( netdissect_options * ndo, register const uint32_t * dp, const u_int len ) { my_fsid fsid ; uint32_t ino ; const char * sfsname = NULL ; char * spacep ; if ( ndo -> ndo_uflag ) { u_int i ; char const * sep = "" ; ND_PRINT ( ( ndo, "   fh[" ) ) ; for ( i = 0 ; i < len ; i ++ ) { ND_PRINT ( ( ndo, "%s%x", sep, dp [ i ] ) ) ; sep = ":" ; } ND_PRINT ( ( ndo, "]" ) ) ; return ; } Parse_fh ( ( const u_char * ) dp, len, & fsid, & ino, NULL, & sfsname, 0 ) ; if ( sfsname ) { <START_BUG> static char temp [ NFSX_V3FHMAX + 1 ] ; <END_BUG>  strncpy ( temp, sfsname, NFSX_V3FHMAX ) ; <START_BUG> <END_BUG> temp [ sizeof ( temp ) - 1 ] = '\\0' ;  spacep = strchr ( temp,' ') ; if ( spacep ) * spacep = '\\0' ; ND_PRINT ( ( ndo, "   fh   %s//", temp ) ) ; } else { ND_PRINT ( ( ndo, "   fh   %d,%d//", fsid. Fsid_dev. Major, fsid. Fsid_dev. Minor ) ) ; } if ( fsid. Fsid_dev. Minor == 257 ) ND_PRINT ( ( ndo, "%s", fsid. Opaque_Handle ) ) ; else ND_PRINT ( ( ndo, "%ld", ( long ) ino ) ) ; }

Fix:
<S2SV_ModStart> sfsname ) { <S2SV_ModEnd> char temp [ <S2SV_ModStart> 1 ] ; u_int stringlen ; stringlen = len ; if ( stringlen > NFSX_V3FHMAX ) stringlen = NFSX_V3FHMAX ; <S2SV_ModStart>, sfsname, stringlen <S2SV_ModEnd> ) ; temp <S2SV_ModStart> ; temp [ stringlen <S2SV_ModEnd> ] = '\\0'
Buggy code:
 int config__parse_args ( struct mosquitto_db * db, struct mosquitto__config * config, int argc, char * argv [ ] ) { int i ; int port_tmp ; for ( i = 1 ; i < argc ; i ++ ) { if (! strcmp ( argv [ i ], "-c" ) ||! strcmp ( argv [ i ], "--config-file" ) ) { if ( i < argc - 1 ) { db -> config_file = argv [ i + 1 ] ; if ( config__read ( db, config, false ) ) { log__printf ( NULL, MOSQ_LOG_ERR, "Error:   Unable   to   open   configuration   file." ) ; return MOSQ_ERR_INVAL ; } } else { log__printf ( NULL, MOSQ_LOG_ERR, "Error:   -c   argument   given,   but   no   config   file   specified." ) ; return MOSQ_ERR_INVAL ; } i ++ ; } else if (! strcmp ( argv [ i ], "-d" ) ||! strcmp ( argv [ i ], "--daemon" ) ) { config -> daemon = true ; } else if (! strcmp ( argv [ i ], "-h" ) ||! strcmp ( argv [ i ], "--help" ) ) { print_usage ( ) ; return MOSQ_ERR_INVAL ; } else if (! strcmp ( argv [ i ], "-p" ) ||! strcmp ( argv [ i ], "--port" ) ) { if ( i < argc - 1 ) { port_tmp = atoi ( argv [ i + 1 ] ) ; if ( port_tmp < 1 || port_tmp > 65535 ) { log__printf ( NULL, MOSQ_LOG_ERR, "Error:   Invalid   port   specified   (%d).", port_tmp ) ; return MOSQ_ERR_INVAL ; } else { if ( config -> default_listener. port ) { log__printf ( NULL, MOSQ_LOG_WARNING, "Warning:   Default   listener   port   specified   multiple   times.   Only   the   latest   will   be   used." ) ; } config -> default_listener. port = port_tmp ; } } else { log__printf ( NULL, M

Fix:
<S2SV_ModStart>. security_options. acl_file = config -> default_listener. security_options. acl_file ; config -> listeners [ config -> listener_count - 1 ]. security_options.
Buggy code:
 static SCSIRequest * scsi_new_request ( SCSIDevice * d, uint32_t tag, uint32_t lun, void * hba_private ) { SCSIDiskState * s = DO_UPCAST ( SCSIDiskState, qdev, d ) ; SCSIRequest * req ; <START_BUG> SCSIDiskReq * r ; <END_BUG> req = scsi_req_alloc ( & scsi_disk_reqops, & s -> qdev, tag, lun, hba_private ) ;  r = DO_UPCAST ( SCSIDiskReq, req, req ) ; <START_BUG> r -> iov. iov_base = qemu_blockalign ( s -> bs, SCSI_DMA_BUF_SIZE ) ; return req ; }<END_BUG>

Fix:
<S2SV_ModStart> * req ; <S2SV_ModEnd> req = scsi_req_alloc <S2SV_ModStart> hba_private ) ; <S2SV_ModEnd> return req ;
Buggy code:
 PyObject * ast2obj_stmt ( void * _o ) { stmt_ty o = ( stmt_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } switch ( o -> kind ) { case FunctionDef_kind : result = PyType_GenericNew ( FunctionDef_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_identifier ( o -> v. FunctionDef. name ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_name, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_arguments ( o -> v. FunctionDef. args ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_args, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. FunctionDef. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. FunctionDef. decorator_list, ast2obj_expr ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_decorator_list, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> v. FunctionDef. returns ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_returns, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_string ( o -> v. FunctionDef. type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_comment, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case AsyncFunctionDef_kind : result

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } switch
Buggy code:
 void btif_hl_select_monitor_callback ( fd_set * p_cur_set, fd_set * p_org_set ) { UNUSED ( p_org_set ) ; BTIF_TRACE_DEBUG ( "entering   %s", __FUNCTION__ ) ; for ( const list_node_t * node = list_begin ( soc_queue ) ; node!= list_end ( soc_queue ) ; node = list_next ( node ) ) { btif_hl_soc_cb_t * p_scb = list_node ( node ) ; if ( btif_hl_get_socket_state ( p_scb ) == BTIF_HL_SOC_STATE_W4_READ ) { if ( FD_ISSET ( p_scb -> socket_id [ 1 ], p_cur_set ) ) { BTIF_TRACE_DEBUG ( "read   data   state=   BTIF_HL_SOC_STATE_W4_READ" ) ; btif_hl_mdl_cb_t * p_dcb = BTIF_HL_GET_MDL_CB_PTR ( p_scb -> app_idx, p_scb -> mcl_idx, p_scb -> mdl_idx ) ; assert ( p_dcb!= NULL ) ; if ( p_dcb -> p_tx_pkt ) { BTIF_TRACE_ERROR ( "Rcv   new   pkt   but   the   last   pkt   is   still   not   been" "     sent   tx_size=%d", p_dcb -> tx_size ) ; btif_hl_free_buf ( ( void * * ) & p_dcb -> p_tx_pkt ) ; } p_dcb -> p_tx_pkt = btif_hl_get_buf ( p_dcb -> mtu ) ; if ( p_dcb ) { <START_BUG> int r = ( int ) recv ( p_scb -> socket_id [ 1 ], p_dcb -> p_tx_pkt, <END_BUG>  p_dcb -> mtu, MSG_DONTWAIT ) ; <START_BUG> if ( r > 0 ) { BTIF_<END_BUG>

Fix:
<S2SV_ModStart> ( int ) TEMP_FAILURE_RETRY ( <S2SV_ModStart>, MSG_DONTWAIT ) )
Buggy code:
 int append_camera_metadata ( camera_metadata_t * dst, const camera_metadata_t * src ) { <START_BUG> if ( dst == NULL || src == NULL ) return ERROR ; <END_BUG> if ( dst -> entry_capacity < src -> entry_count + dst -> entry_count ) return ERROR ; if ( dst -> data_capacity < src -> data_count + dst -> data_count ) return ERROR ; memcpy ( get_entries ( dst ) + dst -> entry_count, get_entries ( src ), sizeof ( camera_metadata_buffer_entry_t [ src -> entry_count ] ) ) ; memcpy ( get_data ( dst ) + dst -> data_count, get_data ( src ), sizeof ( uint8_t [ src -> data_count ] ) ) ; if ( dst -> data_count!= 0 ) { camera_metadata_buffer_entry_t * entry = get_entries ( dst ) + dst -> entry_count ; for ( size_t i = 0 ; i < src -> entry_count ; i ++, entry ++ ) { if ( calculate_camera_metadata_entry_data_size ( entry -> type, entry -> count ) > 0 ) { entry -> data. offset += dst -> data_count ; } } } if ( dst -> entry_count == 0 ) { dst -> flags |= src -> flags & FLAG_SORTED ; } else if ( src -> entry_count!= 0 ) { dst -> flags &= ~ FLAG_SORTED ; } else { } dst -> entry_count += src -> entry_count ; dst -> data_count += src -> data_count ; assert ( validate_camera_metadata_structure ( dst, NULL ) == OK ) ; return OK ; }

Fix:
<S2SV_ModStart> src == NULL ) return ERROR ; if ( src -> entry_count + dst -> entry_count < src -> entry_count ) return ERROR ; if ( src -> data_count + dst -> data_count < src -> data_count
Buggy code:
 <START_BUG> void unix_inflight ( struct file * fp ) <END_BUG> { struct sock * s = unix_get_socket ( fp ) ; spin_lock ( & unix_gc_lock ) ; if ( s ) { struct unix_sock * u = unix_sk ( s ) ; if ( atomic_long_inc_return ( & u -> inflight ) == 1 ) { BUG_ON (! list_empty ( & u -> link ) ) ; list_add_tail ( & u -> link, & gc_inflight_list ) ; } else { BUG_ON ( list_empty ( & u -> link ) ) ; } unix_tot_inflight ++ ; }  fp -> f_cred -> user -> unix_inflight ++ ; <START_BUG> spin_unlock ( & unix_gc_lock ) ; }<END_BUG>

Fix:
<S2SV_ModStart> void unix_inflight ( struct user_struct * user, <S2SV_ModStart> ++ ; } <S2SV_ModEnd> user -> unix_inflight
Buggy code:
 int StreamTcpPacket ( ThreadVars * tv, Packet * p, StreamTcpThread * stt, PacketQueue * pq ) { SCEnter ( ) ; DEBUG_ASSERT_FLOW_LOCKED ( p -> flow ) ; SCLogDebug ( "p->pcap_cnt   %" PRIu64, p -> pcap_cnt ) ; HandleThreadId ( tv, p, stt ) ; TcpSession * ssn = ( TcpSession * ) p -> flow -> protoctx ; if ( ssn!= NULL ) { ssn -> tcp_packet_flags |= p -> tcph -> th_flags ; if ( PKT_IS_TOSERVER ( p ) ) ssn -> client. tcp_flags |= p -> tcph -> th_flags ; else if ( PKT_IS_TOCLIENT ( p ) ) ssn -> server. tcp_flags |= p -> tcph -> th_flags ; if ( ssn -> flags & STREAMTCP_FLAG_ASYNC && ssn -> client. tcp_flags!= 0 && ssn -> server. tcp_flags!= 0 ) { SCLogDebug ( "ssn   %p:   removing   ASYNC   flag   as   we   have   packets   on   both   sides", ssn ) ; ssn -> flags &= ~ STREAMTCP_FLAG_ASYNC ; } } if ( ( p -> tcph -> th_flags & ( TH_SYN | TH_ACK ) ) == ( TH_SYN | TH_ACK ) ) { StatsIncr ( tv, stt -> counter_tcp_synack ) ; } else if ( p -> tcph -> th_flags & ( TH_SYN ) ) { StatsIncr ( tv, stt -> counter_tcp_syn ) ; } if ( p -> tcph -> th_flags & ( TH_RST ) ) { StatsIncr ( tv, stt -> counter_tcp_rst ) ; } if (! ( p -> tcph -> th_flags & TH_ACK ) && TCP_GET_ACK ( p )!= 0 ) { <START_BUG> StreamTcpSetEvent ( p, STREAM_PKT_BROKEN_ACK ) ; <END_BUG> } if ( StreamTcpCheckFlowDrops ( p ) == 1 ) { SCLogDebug ( "This   flow//stream   triggered   a   drop   rule" ) ; FlowSetNoPacketInspection

Fix:
<S2SV_ModStart>, STREAM_PKT_BROKEN_ACK ) ; goto error
Buggy code:
 bool btsock_thread_remove_fd_and_close ( int thread_handle, int fd ) { if ( thread_handle < 0 || thread_handle >= MAX_THREAD ) { APPL_TRACE_ERROR ( "%s   invalid   thread   handle:   %d", __func__, thread_handle ) ; return false ; } if ( fd == - 1 ) { APPL_TRACE_ERROR ( "%s   invalid   file   descriptor.", __func__ ) ; return false ; } sock_cmd_t cmd = { CMD_REMOVE_FD, fd, 0, 0, 0 } ; <START_BUG> return send ( ts [ thread_handle ]. cmd_fdw, & cmd, sizeof ( cmd ), 0 ) == sizeof ( cmd ) ; <END_BUG> }

Fix:
<S2SV_ModStart> } ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 static void oz_usb_handle_ep_data ( struct oz_usb_ctx * usb_ctx, struct oz_usb_hdr * usb_hdr, int len ) { struct oz_data * data_hdr = ( struct oz_data * ) usb_hdr ; switch ( data_hdr -> format ) { case OZ_DATA_F_MULTIPLE_FIXED : { struct oz_multiple_fixed * body = ( struct oz_multiple_fixed * ) data_hdr ; u8 * data = body -> data ; <START_BUG> int n = ( len - sizeof ( struct oz_multiple_fixed ) + 1 ) <END_BUG> // body -> unit_size ; while ( n -- ) { oz_hcd_data_ind ( usb_ctx -> hport, body -> endpoint, data, body -> unit_size ) ; data += body -> unit_size ; } } break ; case OZ_DATA_F_ISOC_FIXED : { struct oz_isoc_fixed * body = ( struct oz_isoc_fixed * ) data_hdr ; int data_len = len - sizeof ( struct oz_isoc_fixed ) + 1 ; int unit_size = body -> unit_size ; u8 * data = body -> data ; int count ; int i ; if (! unit_size ) break ; count = data_len // unit_size ; for ( i = 0 ; i < count ; i ++ ) { oz_hcd_data_ind ( usb_ctx -> hport, body -> endpoint, data, unit_size ) ; data += unit_size ; } } break ; } }

Fix:
<S2SV_ModStart> ; int n ; if (! body -> unit_size ) break ; n
Buggy code:
 static int nfs4_proc_create ( struct inode * dir, struct dentry * dentry, struct iattr * sattr, int flags, struct nameidata * nd ) { struct path path = {. mnt = nd -> path. mnt,. dentry = dentry, } ; struct nfs4_state * state ; struct rpc_cred * cred ; <START_BUG> int status = 0 ; <END_BUG> cred = rpc_lookup_cred ( ) ; if ( IS_ERR ( cred ) ) { status = PTR_ERR ( cred ) ; goto out ; }  state = nfs4_do_open ( dir, & path, flags, sattr, cred ) ; <START_BUG> d_drop ( dentry ) ; if ( IS_ERR ( state ) ) { status = PTR_ERR ( state ) ; goto out_putcred ; } d_add ( dentry, igrab ( state -> inode ) ) ; nfs_set_verifier ( dentry, nfs_save_change_attribute ( dir ) ) ; if ( flags & O_EXCL ) { struct nfs_fattr fattr ; status = nfs4_do_setattr ( state -> inode, cred, & fattr, sattr, state ) ; if ( status == 0 ) nfs_setattr_update_inode ( state -> inode, sattr ) ; nfs_post_op_update_inode ( state -> inode, & fattr ) ; } if ( status == 0 && ( nd -> flags & LOOKUP_OPEN )!= 0 ) <END_BUG> status = nfs4_intent_set_file ( nd, & path, state ) ;  else <START_BUG> nfs4_close_sync ( & path, state, flags ) ; <END_BUG> out_putcred : put_rpccred ( cred ) ; out : return status ; }

Fix:
<S2SV_ModStart> * cred ; fmode_t fmode = flags & ( FMODE_READ | FMODE_WRITE ) ; <S2SV_ModStart>, & path, fmode <S2SV_ModStart> path, state, fmode <S2SV_ModStart>, state, fmode <S2SV_ModEnd> ) ; out_putcred
Buggy code:
 static void config_monitor ( config_tree * ptree ) { int_node * pfilegen_token ; const char * filegen_string ; const char * filegen_file ; FILEGEN * filegen ; filegen_node * my_node ; attr_val * my_opts ; int filegen_type ; int filegen_flag ; if ( ptree -> stats_dir ) stats_config ( STATS_STATSDIR, ptree -> stats_dir ) ; pfilegen_token = HEAD_PFIFO ( ptree -> stats_list ) ; for ( ; pfilegen_token!= NULL ; pfilegen_token = pfilegen_token -> link ) { filegen_string = keyword ( pfilegen_token -> i ) ; filegen = filegen_get ( filegen_string ) ; <START_BUG> DPRINTF ( 4, ( "enabling   filegen   for   %s   statistics   \'%s%s\'\\n", <END_BUG> filegen_string, filegen -> prefix, filegen -> basename ) ) ; filegen -> flag |= FGEN_FLAG_ENABLED ; } my_node = HEAD_PFIFO ( ptree -> filegen_opts ) ; for ( ; my_node!= NULL ; my_node = my_node -> link ) { filegen_file = keyword ( my_node -> filegen_token ) ; filegen = filegen_get ( filegen_file ) ;  filegen_flag = filegen -> flag ; <START_BUG> filegen_type = filegen -> type ; filegen_flag |= FGEN_FLAG_ENABLED ; my_opts = HEAD_PFIFO ( my_node -> options ) ; for ( ; my_opts!= NULL ; my_opts = my_opts -> link ) { switch ( my_opts -> attr ) { case T_File : filegen_file = my_opts -> value. s ; break ; case T_Type : switch ( my_opts -> value. i ) { default : NTP_INSIST ( 0 ) ; break ; case T_None : filegen_type = FILEGEN_NONE ; break ; case T_Pid : filegen_type = FILEGEN_PID ; break ; case T_Day : filegen_type = FILEGEN_DAY ; break ; case T_Week : filegen_type = FILEGEN_WEEK ;<END_BUG>

Fix:
<S2SV_ModStart> filegen_string ) ; if ( NULL == filegen ) { msyslog ( LOG_ERR, "stats <S2SV_blank> %s <S2SV_blank> unrecognized", filegen_string ) ; continue ; } <S2SV_ModStart> filegen_file ) ; if ( NULL == filegen ) { msyslog ( LOG_ERR, "filegen <S2SV_blank> category <S2SV_blank> \'%s\' <S2SV_blank> unrecognized", filegen_file ) ; continue ; }
Buggy code:
 static void server_real_connect ( SERVER_REC * server, IPADDR * ip, const char * unix_socket ) { GIOChannel * handle ; IPADDR * own_ip = NULL ; const char * errmsg ; char * errmsg2 ; char ipaddr [ MAX_IP_LEN ] ; int port ; g_return_if_fail ( ip!= NULL || unix_socket!= NULL ) ; signal_emit ( "server   connecting", 2, server, ip ) ; if ( server -> connrec -> no_connect ) return ; if ( ip!= NULL ) { own_ip = ip == NULL? NULL : ( IPADDR_IS_V6 ( ip )? server -> connrec -> own_ip6 : server -> connrec -> own_ip4 ) ; port = server -> connrec -> proxy!= NULL? server -> connrec -> proxy_port : server -> connrec -> port ; handle = server -> connrec -> use_ssl? <START_BUG> net_connect_ip_ssl ( ip, port, own_ip, server -> connrec -> ssl_cert, server -> connrec -> ssl_pkey, <END_BUG> server -> connrec -> ssl_cafile, server -> connrec -> ssl_capath, server -> connrec -> ssl_verify ) : net_connect_ip ( ip, port, own_ip ) ; } else { handle = net_connect_unix ( unix_socket ) ; } if ( handle == NULL ) { errmsg = g_strerror ( errno ) ; errmsg2 = NULL ; if ( errno == EADDRNOTAVAIL ) { if ( own_ip!= NULL ) { net_ip2host ( own_ip, ipaddr ) ; errmsg2 = g_strconcat ( errmsg, ":   ", ipaddr, NULL ) ; } server -> no_reconnect = TRUE ; } if ( server -> connrec -> use_ssl && errno == ENOSYS ) server -> no_reconnect = TRUE ; server -> connection_lost = TRUE ; server_connect_failed ( server, errmsg2? errmsg2 : errmsg ) ; g_free ( errmsg2 ) ; } else { server -> handle = net_sendbuffer_create ( handle, 0 ) ; # ifdef HAVE_OPENSSL if ( server -> connrec -> use_ssl ) server_connect_callback_init_ssl ( server, handle ) ; else # endif server ->

Fix:
<S2SV_ModStart>, port, server -> connrec -> address,
Buggy code:
 static int asn1_decode_entry ( sc_context_t * ctx, struct sc_asn1_entry * entry, const u8 * obj, size_t objlen, int depth ) { void * parm = entry -> parm ; int ( * callback_func ) ( sc_context_t * nctx, void * arg, const u8 * nobj, size_t nobjlen, int ndepth ) ; size_t * len = ( size_t * ) entry -> arg ; int r = 0 ; callback_func = parm ; sc_debug ( ctx, SC_LOG_DEBUG_ASN1, "%*.*sdecoding   \'%s\',   raw   data:%s%s\\n", depth, depth, "", entry -> name, sc_dump_hex ( obj, objlen > 16? 16 : objlen ), objlen > 16? "..." : "" ) ; switch ( entry -> type ) { case SC_ASN1_STRUCT : if ( parm!= NULL ) r = asn1_decode ( ctx, ( struct sc_asn1_entry * ) parm, obj, objlen, NULL, NULL, 0, depth + 1 ) ; break ; case SC_ASN1_NULL : break ; case SC_ASN1_BOOLEAN : if ( parm!= NULL ) { if ( objlen!= 1 ) { sc_debug ( ctx, SC_LOG_DEBUG_ASN1, "invalid   ASN.1   object   length:   %" SC_FORMAT_LEN_SIZE_T "u\\n", objlen ) ; r = SC_ERROR_INVALID_ASN1_OBJECT ; } else * ( ( int * ) parm ) = obj [ 0 ]? 1 : 0 ; } break ; case SC_ASN1_INTEGER : case SC_ASN1_ENUMERATED : if ( parm!= NULL ) { r = sc_asn1_decode_integer ( obj, objlen, ( int * ) entry -> parm ) ; sc_debug ( ctx, SC_LOG_DEBUG_ASN1, "%*.*sdecoding   \'%s\'   returned   %d\\n", depth, depth, "", entry -> name, * ( ( int * ) entry -> parm ) ) ; } break ; case SC_ASN1_BIT_STRING_NI : case SC_ASN1_BIT_STRING : if

Fix:
<S2SV_ModStart> SC_ASN1_UNSIGNED ) && objlen > 1 && <S2SV_ModStart> ] == 0x00 <S2SV_ModEnd> ) { objlen
Buggy code:
 static void mt_decode_mb_rows ( VP8D_COMP * pbi, MACROBLOCKD * xd, int start_mb_row ) { volatile const int * last_row_current_mb_col ; volatile int * current_mb_col ; int mb_row ; VP8_COMMON * pc = & pbi -> common ; const int nsync = pbi -> sync_range ; const int first_row_no_sync_above = pc -> mb_cols + nsync ; int num_part = 1 << pbi -> common. multi_token_partition ; int last_mb_row = start_mb_row ; YV12_BUFFER_CONFIG * yv12_fb_new = pbi -> dec_fb_ref [ INTRA_FRAME ] ; YV12_BUFFER_CONFIG * yv12_fb_lst = pbi -> dec_fb_ref [ LAST_FRAME ] ; int recon_y_stride = yv12_fb_new -> y_stride ; int recon_uv_stride = yv12_fb_new -> uv_stride ; unsigned char * ref_buffer [ MAX_REF_FRAMES ] [ 3 ] ; unsigned char * dst_buffer [ 3 ] ; int i ; int ref_fb_corrupted [ MAX_REF_FRAMES ] ; ref_fb_corrupted [ INTRA_FRAME ] = 0 ; for ( i = 1 ; i < MAX_REF_FRAMES ; i ++ ) { YV12_BUFFER_CONFIG * this_fb = pbi -> dec_fb_ref [ i ] ; ref_buffer [ i ] [ 0 ] = this_fb -> y_buffer ; ref_buffer [ i ] [ 1 ] = this_fb -> u_buffer ; ref_buffer [ i ] [ 2 ] = this_fb -> v_buffer ; ref_fb_corrupted [ i ] = this_fb -> corrupted ; } dst_buffer [ 0 ] = yv12_fb_new -> y_buffer ; dst_buffer [ 1 ] = yv12_fb_new -> u_buffer ; dst_buffer [ 2 ] = yv12_fb_new -> v_buffer ; xd -> up_available = ( start_mb_row!= 0 ) ; for ( mb_row = start_mb_row ; mb

Fix:
<S2SV_ModStart> -> above_context ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> 1 ) { memcpy <S2SV_ModEnd> ( ( pbi <S2SV_ModStart> 16 ) ; memcpy <S2SV_ModEnd> ( ( pbi <S2SV_ModStart> 8 ) ; memcpy <S2SV_ModEnd> ( ( pbi