nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static INLINE int cost_coeffs ( MACROBLOCK * x, <END_BUG> int plane, int block, ENTROPY_CONTEXT * A, ENTROPY_CONTEXT * L, TX_SIZE tx_size, const int16_t * scan, const int16_t * nb, int use_fast_coef_costing ) { MACROBLOCKD * const xd = & x -> e_mbd ; MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; const struct macroblock_plane * p = & x -> plane [ plane ] ; const struct macroblockd_plane * pd = & xd -> plane [ plane ] ; const PLANE_TYPE type = pd -> plane_type ; const int16_t * band_count = & band_counts [ tx_size ] [ 1 ] ; const int eob = p -> eobs [ block ] ;  const int16_t * const qcoeff = BLOCK_OFFSET ( p -> qcoeff, block ) ; <START_BUG> unsigned int ( * token_costs ) [ 2 ] [ COEFF_CONTEXTS ] [ ENTROPY_TOKENS ] = x -> token_costs [ tx_size ] [ type ] [ is_inter_block ( mbmi ) ] ; uint8_t token_cache [ 32 * 32 ] ; int pt = combine_entropy_contexts ( * A, * L ) ; <END_BUG> int c, cost ;  assert ( type == PLANE_TYPE_Y? mbmi -> tx_size == tx_size <START_BUG> : get_uv_tx_size ( mbmi ) == tx_size ) ; <END_BUG> if ( eob == 0 ) { cost = token_costs [ 0 ] [ 0 ] [ pt ] [ EOB_TOKEN ] ; c = 0 ; } else { int band_left = * band_count ++ ; int v = qcoeff [ 0 ] ;  int prev_t = vp9_dct_value_tokens_ptr [ v ]. token ; <START_BUG> <END_BUG> cost = ( * token_costs ) [ 0 ] [ pt ] [ prev_t ] + vp9_dct_value_cost_ptr [ v ] ;  token_cache [ 0 ] = vp9_pt_energy_class [ prev_t ] ; ++ token_costs ; for ( c = 1 ; c < eob ;

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static <S2SV_ModEnd> int cost_coeffs ( <S2SV_ModStart> ] ; const tran_low_t <S2SV_ModEnd> * const qcoeff <S2SV_ModStart>, cost ; # if CONFIG_VP9_HIGHBITDEPTH const int16_t * cat6_high_cost = vp9_get_high_cost_table ( xd -> bd ) ; # else const int16_t * cat6_high_cost = vp9_get_high_cost_table ( 8 ) ; # endif <S2SV_ModStart> get_uv_tx_size ( mbmi, pd <S2SV_ModStart> 0 ] ; int16_t prev_t ; EXTRABIT e ; vp9_get_token_extra ( v, & prev_t, & e ) <S2SV_ModEnd> ; cost = <S2SV_ModStart> prev_t ] + vp9_get_cost ( prev_t, e, cat6_high_cost ) <S2SV_ModEnd> ; token_cache [ <S2SV_ModStart> c ] ; int16_t <S2SV_ModEnd> t ; v <S2SV_ModStart> rc ] ; vp9_get_token_extra ( v, & t, & e ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> t ] + vp9_get_cost ( t, e, cat6_high_cost
Buggy code:
 static int check_entry_size_and_hooks ( struct ipt_entry * e, struct xt_table_info * newinfo, const unsigned char * base, const unsigned char * limit, const unsigned int * hook_entries, const unsigned int * underflows, unsigned int valid_hooks ) { unsigned int h ; int err ; if ( ( unsigned long ) e % __alignof__ ( struct ipt_entry )!= 0 || ( unsigned char * ) e + sizeof ( struct ipt_entry ) >= limit || ( unsigned char * ) e + e -> next_offset > limit ) { duprintf ( "Bad   offset   %p\\n", e ) ; return - EINVAL ; } if ( e -> next_offset < sizeof ( struct ipt_entry ) + sizeof ( struct xt_entry_target ) ) { duprintf ( "checking:   element   %p   size   %u\\n", e, e -> next_offset ) ; return - EINVAL ; } if (! ip_checkentry ( & e -> ip ) ) return - EINVAL ; <START_BUG> err = xt_check_entry_offsets ( e, e -> target_offset, e -> next_offset ) ; <END_BUG> if ( err ) return err ; for ( h = 0 ; h < NF_INET_NUMHOOKS ; h ++ ) { if (! ( valid_hooks & ( 1 << h ) ) ) continue ; if ( ( unsigned char * ) e - base == hook_entries [ h ] ) newinfo -> hook_entry [ h ] = hook_entries [ h ] ; if ( ( unsigned char * ) e - base == underflows [ h ] ) { if (! check_underflow ( e ) ) { pr_debug ( "Underflows   must   be   unconditional   and   " "use   the   STANDARD   target   with   " "ACCEPT//DROP\\n" ) ; return - EINVAL ; } newinfo -> underflow [ h ] = underflows [ h ] ; } } e -> counters = ( ( struct xt_counters ) { 0, 0 } ) ; e -> comefrom = 0 ; return 0 ; }

Fix:
<S2SV_ModStart>, e -> elems, e ->
Buggy code:
 ssize_t cdf_read_short_sector ( const cdf_stream_t * sst, void * buf, size_t offs, size_t len, const cdf_header_t * h, cdf_secid_t id ) { size_t ss = CDF_SHORT_SEC_SIZE ( h ) ; size_t pos = CDF_SHORT_SEC_POS ( h, id ) ; assert ( ss == len ) ; <START_BUG> if ( pos > CDF_SEC_SIZE ( h ) * sst -> sst_len ) { <END_BUG> DPRINTF ( ( "Out   of   bounds   read   %" SIZE_T_FORMAT "u   >   %" SIZE_T_FORMAT "u\\n",  pos, CDF_SEC_SIZE ( h ) * sst -> sst_len ) ) ; <START_BUG> return - 1 ; } ( void ) memcpy ( ( ( char * ) buf ) + offs, ( ( const char * ) sst -> sst_tab ) + pos, len ) ; return len ; }<END_BUG>

Fix:
<S2SV_ModStart> if ( pos + len <S2SV_ModStart> "u\\n", pos + len
Buggy code:
 static int keyring_search_iterator ( const void * object, void * iterator_data ) { struct keyring_search_context * ctx = iterator_data ; const struct key * key = keyring_ptr_to_key ( object ) ; <START_BUG> unsigned long kflags = key -> flags ; <END_BUG> kenter ( "{%d}", key -> serial ) ; if ( key -> type!= ctx -> index_key. type ) { kleave ( "   =   0   [!type]" ) ; return 0 ; } if ( ctx -> flags & KEYRING_SEARCH_DO_STATE_CHECK ) { if ( kflags & ( ( 1 << KEY_FLAG_INVALIDATED ) | ( 1 << KEY_FLAG_REVOKED ) ) ) { ctx -> result = ERR_PTR ( - EKEYREVOKED ) ; kleave ( "   =   %d   [invrev]", ctx -> skipped_ret ) ; goto skipped ; } if ( key -> expiry && ctx -> now. tv_sec >= key -> expiry ) { if (! ( ctx -> flags & KEYRING_SEARCH_SKIP_EXPIRED ) ) ctx -> result = ERR_PTR ( - EKEYEXPIRED ) ; kleave ( "   =   %d   [expire]", ctx -> skipped_ret ) ; goto skipped ; } } if (! ctx -> match_data. cmp ( key, & ctx -> match_data ) ) { kleave ( "   =   0   [!match]" ) ; return 0 ; } if (! ( ctx -> flags & KEYRING_SEARCH_NO_CHECK_PERM ) && key_task_permission ( make_key_ref ( key, ctx -> possessed ), ctx -> cred, KEY_NEED_SEARCH ) < 0 ) { ctx -> result = ERR_PTR ( - EACCES ) ; kleave ( "   =   %d   [!perm]", ctx -> skipped_ret ) ; goto skipped ; } if ( ctx -> flags & KEYRING_SEARCH_DO_STATE_CHECK ) {  if ( kflags & ( 1 << KEY_FLAG_NEGATIVE ) ) { <START_BUG> smp_rmb ( ) ; <END_BUG> ctx -> result = ERR_PTR ( key -> reject_error ) ;  kleave ( "   =   %d   [neg]", ctx -> skipped_ret )

Fix:
<S2SV_ModStart> long kflags = READ_ONCE ( key -> flags ) ; short state = READ_ONCE ( key -> state ) <S2SV_ModEnd> ; kenter ( <S2SV_ModStart> { if ( state < 0 ) { <S2SV_ModEnd> ctx -> result <S2SV_ModStart> = ERR_PTR ( state <S2SV_ModEnd> ) ; kleave
Buggy code:
 static int nlmsg_populate_mdb_fill ( struct sk_buff * skb, struct net_device * dev, struct br_mdb_entry * entry, u32 pid, u32 seq, int type, unsigned int flags ) { struct nlmsghdr * nlh ; struct br_port_msg * bpm ; struct nlattr * nest, * nest2 ; nlh = nlmsg_put ( skb, pid, seq, type, sizeof ( * bpm ), NLM_F_MULTI ) ; if (! nlh ) return - EMSGSIZE ; bpm = nlmsg_data ( nlh ) ; <START_BUG> bpm -> family = AF_BRIDGE ; <END_BUG> bpm -> ifindex = dev -> ifindex ; nest = nla_nest_start ( skb, MDBA_MDB ) ; if ( nest == NULL ) goto cancel ; nest2 = nla_nest_start ( skb, MDBA_MDB_ENTRY ) ; if ( nest2 == NULL ) goto end ; if ( nla_put ( skb, MDBA_MDB_ENTRY_INFO, sizeof ( * entry ), entry ) ) goto end ; nla_nest_end ( skb, nest2 ) ; nla_nest_end ( skb, nest ) ; return nlmsg_end ( skb, nlh ) ; end : nla_nest_end ( skb, nest ) ; cancel : nlmsg_cancel ( skb, nlh ) ; return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> nlh ) ; memset ( bpm, 0, sizeof ( * bpm ) ) ;
Buggy code:
 void * leak_memalign ( size_t alignment, size_t bytes ) { if ( alignment <= MALLOC_ALIGNMENT ) return leak_malloc ( bytes ) ; if ( alignment & ( alignment - 1 ) ) alignment = 1L << ( 31 - __builtin_clz ( alignment ) ) ; <START_BUG> size_t size = ( alignment - MALLOC_ALIGNMENT ) + bytes ; <END_BUG> void * base = leak_malloc ( size ) ; if ( base!= NULL ) { intptr_t ptr = ( intptr_t ) base ; if ( ( ptr % alignment ) == 0 ) return base ; ptr += ( ( - ptr ) % alignment ) ; ( ( void * * ) ptr ) [ - 1 ] = MEMALIGN_GUARD ; ( ( void * * ) ptr ) [ - 2 ] = base ; return ( void * ) ptr ; } return base ; }

Fix:
<S2SV_ModStart> + bytes ; if ( size < bytes ) { return NULL ; }
Buggy code:
 static int read_tfra ( MOVContext * mov, AVIOContext * f ) { MOVFragmentIndex * index = NULL ; int version, fieldlength, i, j ; int64_t pos = avio_tell ( f ) ; uint32_t size = avio_rb32 ( f ) ; void * tmp ; if ( avio_rb32 ( f )!= MKBETAG ( 't', 'f', 'r', 'a' ) ) { return 1 ; } av_log ( mov -> fc, AV_LOG_VERBOSE, "found   tfra\\n" ) ; index = av_mallocz ( sizeof ( MOVFragmentIndex ) ) ; if (! index ) { return AVERROR ( ENOMEM ) ; } tmp = av_realloc_array ( mov -> fragment_index_data, mov -> fragment_index_count + 1, sizeof ( MOVFragmentIndex * ) ) ; if (! tmp ) { av_freep ( & index ) ; return AVERROR ( ENOMEM ) ; } mov -> fragment_index_data = tmp ; mov -> fragment_index_data [ mov -> fragment_index_count ++ ] = index ; version = avio_r8 ( f ) ; avio_rb24 ( f ) ; index -> track_id = avio_rb32 ( f ) ; fieldlength = avio_rb32 ( f ) ; index -> item_count = avio_rb32 ( f ) ; index -> items = av_mallocz_array ( index -> item_count, sizeof ( MOVFragmentIndexItem ) ) ; if (! index -> items ) { index -> item_count = 0 ; return AVERROR ( ENOMEM ) ; } for ( i = 0 ; i < index -> item_count ; i ++ ) { <START_BUG> int64_t time, offset ; <END_BUG> if ( version == 1 ) { time = avio_rb64 ( f ) ; offset = avio_rb64 ( f ) ; } else { time = avio_rb32 ( f ) ; offset = avio_rb32 ( f ) ; } index -> items [ i ]. time = time ; index -> items [ i ]. moof_offset = offset ; for ( j = 0 ; j

Fix:
<S2SV_ModStart>, offset ; if ( avio_feof ( f ) ) { index -> item_count = 0 ; av_freep ( & index -> items ) ; return AVERROR_INVALIDDATA ; }
Buggy code:
 void ext2_xattr_delete_inode ( struct inode * inode ) { struct buffer_head * bh = NULL ; <START_BUG> struct mb_cache_entry * ce ; <END_BUG> down_write ( & EXT2_I ( inode ) -> xattr_sem ) ; if (! EXT2_I ( inode ) -> i_file_acl ) goto cleanup ; bh = sb_bread ( inode -> i_sb, EXT2_I ( inode ) -> i_file_acl ) ; if (! bh ) { ext2_error ( inode -> i_sb, "ext2_xattr_delete_inode", "inode   %ld:   block   %d   read   error", inode -> i_ino, EXT2_I ( inode ) -> i_file_acl ) ; goto cleanup ; } ea_bdebug ( bh, "b_count=%d", atomic_read ( & ( bh -> b_count ) ) ) ; if ( HDR ( bh ) -> h_magic!= cpu_to_le32 ( EXT2_XATTR_MAGIC ) || HDR ( bh ) -> h_blocks!= cpu_to_le32 ( 1 ) ) { ext2_error ( inode -> i_sb, "ext2_xattr_delete_inode", "inode   %ld:   bad   block   %d", inode -> i_ino, EXT2_I ( inode ) -> i_file_acl ) ; goto cleanup ; }  ce = mb_cache_entry_get ( ext2_xattr_cache, bh -> b_bdev, bh -> b_blocknr ) ; <START_BUG> lock_buffer ( bh ) ; if ( HDR ( bh ) -> h_refcount == cpu_to_le32 ( 1 ) ) { <END_BUG> if ( ce )  mb_cache_entry_free ( ce ) ; ext2_free_blocks ( inode, EXT2_I ( inode ) -> i_file_acl, 1 ) ; get_bh ( bh ) ; bforget ( bh ) ; unlock_buffer ( bh ) ; } else { <START_BUG> le32_add_cpu ( & HDR ( bh ) -> h_refcount, - 1 ) ; <END_BUG> if ( ce ) mb_cache_entry_release ( ce ) ; ea_bdebug ( bh, "ref

Fix:
<S2SV_ModStart> = NULL ; <S2SV_ModEnd> down_write ( & <S2SV_ModStart> cleanup ; } <S2SV_ModEnd> lock_buffer ( bh <S2SV_ModStart> ) ) { __u32 hash = le32_to_cpu ( HDR ( bh ) -> h_hash ) ; mb2_cache_entry_delete_block ( EXT2_SB ( inode -> i_sb ) -> s_mb_cache, hash, bh -> b_blocknr <S2SV_ModEnd> ) ; ext2_free_blocks <S2SV_ModStart>, - 1 <S2SV_ModEnd> ) ; ea_bdebug
Buggy code:
 static Image * ReadGIFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BitSet ( byte, bit ) ( ( ( byte ) & ( bit ) ) == ( bit ) ) # define LSBFirstOrder ( x, y ) ( ( ( y ) << 8 ) | ( x ) ) Image * image, * meta_image ; int number_extensionss = 0 ; MagickBooleanType status ; RectangleInfo page ; register ssize_t i ; register unsigned char * p ; size_t delay, dispose, duration, global_colors, image_count, iterations, one ; ssize_t count, opacity ; unsigned char background, c, flag, * global_colormap, header [ MaxTextExtent ], magick [ 12 ] ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } count = ReadBlob ( image, 6, magick ) ; if ( ( count!= 6 ) || ( ( LocaleNCompare ( ( char * ) magick, "GIF87", 5 )!= 0 ) && ( LocaleNCompare ( ( char * ) magick, "GIF89", 5 )!= 0 ) ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; page. width = ReadBlobLSBShort ( image ) ; page. height = ReadBlobLSBShort ( image ) ; flag = ( unsigned char ) ReadBlobByte ( image ) ; background = ( unsigned char ) ReadBlobByte ( image ) ; c = ( unsigned char ) ReadBlobByte ( image ) ; one = 1 ; global_colors = one << ( ( ( size_t ) flag & 0x07 ) + 1 ) ; global_colormap = ( unsigned char * ) AcquireQuantum

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static int er_supported ( ERContext * s ) { if ( s -> avctx -> hwaccel && s -> avctx -> hwaccel -> decode_slice ||! s -> cur_pic. f || <START_BUG> s -> cur_pic. field_picture || <END_BUG> s -> avctx -> profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO ) return 0 ; return 1 ; }

Fix:
<S2SV_ModStart> cur_pic. field_picture <S2SV_ModEnd> ) return 0
Buggy code:
 <START_BUG> void fadst4_sse2 ( __m128i * in ) { <END_BUG> const __m128i k__sinpi_p01_p02 = pair_set_epi16 ( sinpi_1_9, sinpi_2_9 ) ; const __m128i k__sinpi_p04_m01 = pair_set_epi16 ( sinpi_4_9, - sinpi_1_9 ) ; const __m128i k__sinpi_p03_p04 = pair_set_epi16 ( sinpi_3_9, sinpi_4_9 ) ; const __m128i k__sinpi_m03_p02 = pair_set_epi16 ( - sinpi_3_9, sinpi_2_9 ) ;  const __m128i k__sinpi_p03_p03 = _mm_set1_epi16 ( sinpi_3_9 ) ; <START_BUG> const __m128i kZero = _mm_set1_epi16 ( 0 ) ; const __m128i k__DCT_CONST_ROUNDING = _mm_set1_epi32 ( DCT_CONST_ROUNDING ) ; __m128i u [ 8 ], v [ 8 ] ; __m128i in7 = _mm_add_epi16 ( in [ 0 ], in [ 1 ] ) ; u [ 0 ] = _mm_unpacklo_epi16 ( in [ 0 ], in [ 1 ] ) ; u [ 1 ] = _mm_unpacklo_epi16 ( in [ 2 ], in [ 3 ] ) ; u [ 2 ] = _mm_unpacklo_epi16 ( in7, kZero ) ; u [ 3 ] = _mm_unpacklo_epi16 ( in [ 2 ], kZero ) ; u [ 4 ] = _mm_unpacklo_epi16 ( in [ 3 ], kZero ) ; v [ 0 ] = _mm_madd_epi16 ( u [ 0 ], k__sinpi_p01_p02 ) ; v [ 1 ] = _mm_madd_epi16 ( u [ 1 ], k__sinpi_p03_p04 ) ; v [ 2 ] = _mm_madd_epi16 ( u [ 2 ], k__sinpi_p<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t )
Buggy code:
 static void rpl_dao_print ( netdissect_options * ndo, const u_char * bp, u_int length ) { const struct nd_rpl_dao * dao = ( const struct nd_rpl_dao * ) bp ; const char * dagid_str = "<elided>" ; ND_TCHECK ( * dao ) ; if ( length < ND_RPL_DAO_MIN_LEN ) goto tooshort ; bp += ND_RPL_DAO_MIN_LEN ; length -= ND_RPL_DAO_MIN_LEN ; if ( RPL_DAO_D ( dao -> rpl_flags ) ) { ND_TCHECK2 ( dao -> rpl_dagid, DAGID_LEN ) ; if ( length < DAGID_LEN ) goto tooshort ; dagid_str = ip6addr_string ( ndo, dao -> rpl_dagid ) ; bp += DAGID_LEN ; length -= DAGID_LEN ; } ND_PRINT ( ( ndo, "   [dagid:%s,seq:%u,instance:%u%s%s,%02x]", dagid_str, dao -> rpl_daoseq, dao -> rpl_instanceid, RPL_DAO_K ( dao -> rpl_flags )? ",acK" : "", RPL_DAO_D ( dao -> rpl_flags )? ",Dagid" : "", dao -> rpl_flags ) ) ; if ( ndo -> ndo_vflag > 1 ) { const struct rpl_dio_genoption * opt = ( const struct rpl_dio_genoption * ) bp ; rpl_dio_printopt ( ndo, opt, length ) ; } return ; trunc : <START_BUG> ND_PRINT ( ( ndo, "   [|truncated]" ) ) ; <END_BUG> return ; tooshort : ND_PRINT ( ( ndo, "   [|length   too   short]" ) ) ; return ; }

Fix:
<S2SV_ModStart> ( ndo, "%s", rpl_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 bool_t xdr_krb5_principal ( XDR * xdrs, krb5_principal * objp ) { int ret ; char * p = NULL ; krb5_principal pr = NULL ; static krb5_context context = NULL ; if (! context && kadm5_init_krb5_context ( & context ) ) return ( FALSE ) ; switch ( xdrs -> x_op ) { case XDR_ENCODE : if ( * objp ) { if ( ( ret = krb5_unparse_name ( context, * objp, & p ) )!= 0 ) return FALSE ; } if (! xdr_nullstring ( xdrs, & p ) ) return FALSE ; if ( p ) free ( p ) ; break ; case XDR_DECODE : if (! xdr_nullstring ( xdrs, & p ) ) return FALSE ; if ( p ) { ret = krb5_parse_name ( context, p, & pr ) ; if ( ret!= 0 ) return FALSE ; * objp = pr ; free ( p ) ; } else * objp = NULL ; break ; case XDR_FREE : if ( * objp!= NULL ) krb5_free_principal ( context, * objp ) ; <START_BUG> break ; <END_BUG> } return TRUE ; }

Fix:
<S2SV_ModStart> objp ) ; * objp = NULL ;
Buggy code:
 static void vrrp_tfile_end_handler ( void ) { vrrp_tracked_file_t * tfile = LIST_TAIL_DATA ( vrrp_data -> vrrp_track_files ) ; struct stat statb ; FILE * tf ; int ret ; if (! tfile -> file_path ) { report_config_error ( CONFIG_GENERAL_ERROR, "No   file   set   for   track_file   %s   -   removing", tfile -> fname ) ; free_list_element ( vrrp_data -> vrrp_track_files, vrrp_data -> vrrp_track_files -> tail ) ; return ; } if ( track_file_init == TRACK_FILE_NO_INIT ) return ; ret = stat ( tfile -> file_path, & statb ) ; if (! ret ) { if ( track_file_init == TRACK_FILE_CREATE ) { return ; } if ( ( statb. st_mode & S_IFMT )!= S_IFREG ) { report_config_error ( CONFIG_GENERAL_ERROR, "Cannot   initialise   track   file   %s   -   it   is   not   a   regular   file", tfile -> fname ) ; return ; } if ( reload ) return ; } if (! __test_bit ( CONFIG_TEST_BIT, & debug ) ) { <START_BUG> if ( ( tf = fopen ( tfile -> file_path, "w" ) ) ) { <END_BUG> fprintf ( tf, "%d\\n", track_file_init_value ) ; fclose ( tf ) ; } else report_config_error ( CONFIG_GENERAL_ERROR, "Unable   to   initialise   track   file   %s", tfile -> fname ) ; } }

Fix:
<S2SV_ModStart> ( tf = fopen_safe <S2SV_ModEnd> ( tfile ->
Buggy code:
 static int jpc_pi_nextrpcl ( register jpc_pi_t * pi ) { int rlvlno ; jpc_pirlvl_t * pirlvl ; jpc_pchg_t * pchg ; int prchind ; int prcvind ; int * prclyrno ; int compno ; jpc_picomp_t * picomp ; int xstep ; int ystep ; uint_fast32_t r ; uint_fast32_t rpx ; uint_fast32_t rpy ; uint_fast32_t trx0 ; uint_fast32_t try0 ; pchg = pi -> pchg ; if (! pi -> prgvolfirst ) { goto skip ; } else { pi -> xstep = 0 ; pi -> ystep = 0 ; for ( compno = 0, picomp = pi -> picomps ; compno < pi -> numcomps ; ++ compno, ++ picomp ) { for ( rlvlno = 0, pirlvl = picomp -> pirlvls ; rlvlno < picomp -> numrlvls ; ++ rlvlno, ++ pirlvl ) { <START_BUG> xstep = picomp -> hsamp * ( 1 << ( pirlvl -> prcwidthexpn + <END_BUG> picomp -> numrlvls - rlvlno - 1 ) ) ;  ystep = picomp -> vsamp * ( 1 << ( pirlvl -> prcheightexpn + <START_BUG> picomp -> numrlvls - rlvlno - 1 ) ) ; pi -> xstep = (! pi -> xstep )? xstep : JAS_MIN ( pi -> xstep, xstep ) ; pi -> ystep = (! pi -> ystep )? ystep : JAS_MIN ( pi -> ystep, ystep ) ; } } pi -> prgvolfirst = 0 ; } for ( pi -> rlvlno = pchg -> rlvlnostart ; pi -> rlvlno < pchg -> rlvlnoend && pi -> rlvlno < pi -> maxrlvls ; ++ pi -> rlvlno ) { for ( pi -> y = pi -> ystart ; pi -> y < pi -> yend ; pi -> y += pi -> ystep - ( pi -> y % pi -> ystep ) ) {<END_BUG>

Fix:
<S2SV_ModStart> pirlvl ) { if ( pirlvl -> prcwidthexpn + pi -> picomp -> numrlvls > JAS_UINTFAST32_NUMBITS - 2 || pirlvl -> prcheightexpn + pi -> picomp -> numrlvls > JAS_UINTFAST32_NUMBITS - 2 ) { return - 1 ; } <S2SV_ModStart> hsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << <S2SV_ModEnd> ( pirlvl -> <S2SV_ModStart> vsamp * ( JAS_CAST ( uint_fast32_t, 1 ) << <S2SV_ModEnd> ( pirlvl -> <S2SV_ModStart> ) % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpx ) <S2SV_ModStart> x % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpx ) <S2SV_ModStart> ) % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpy ) <S2SV_ModStart> y % ( JAS_CAST ( uint_fast32_t, 1 ) <S2SV_ModEnd> << rpy )
Buggy code:
 static inline void process_get_command ( conn * c, token_t * tokens, size_t ntokens, bool return_cas ) { char * key ; size_t nkey ; int i = 0 ; item * it ; token_t * key_token = & tokens [ KEY_TOKEN ] ; char * suffix ; assert ( c!= NULL ) ; do { while ( key_token -> length!= 0 ) { key = key_token -> value ; nkey = key_token -> length ; if ( nkey > KEY_MAX_LENGTH ) { out_string ( c, "CLIENT_ERROR   bad   command   line   format" ) ; while ( i -- > 0 ) { item_remove ( * ( c -> ilist + i ) ) ; } return ; } <START_BUG> it = item_get ( key, nkey, c, DO_UPDATE ) ; <END_BUG> if ( settings. detail_enabled ) { stats_prefix_record_get ( key, nkey, NULL!= it ) ; } if ( it ) { if ( i >= c -> isize ) { item * * new_list = realloc ( c -> ilist, sizeof ( item * ) * c -> isize * 2 ) ; if ( new_list ) { c -> isize *= 2 ; c -> ilist = new_list ; } else { STATS_LOCK ( ) ; stats. malloc_fails ++ ; STATS_UNLOCK ( ) ; item_remove ( it ) ; break ; } } if ( return_cas ||! settings. inline_ascii_response ) { MEMCACHED_COMMAND_GET ( c -> sfd, ITEM_key ( it ), it -> nkey, it -> nbytes, ITEM_get_cas ( it ) ) ; if ( i >= c -> suffixsize ) { char * * new_suffix_list = realloc ( c -> suffixlist, sizeof ( char * ) * c -> suffixsize * 2 ) ; if ( new_suffix_list ) { c -> suffixsize *= 2 ; c -> suffixlist = new_suffix_list ; } else { STATS_LOCK ( ) ; stats. malloc_fails ++ ; STATS_UNLOCK ( ) ; item_remove ( it ) ; break ; } } suffix = do_cache_alloc ( c -> thread -> suffix_cache ) ; if ( suffix == NULL ) { ST

Fix:
<S2SV_ModStart> } it = limited_get <S2SV_ModEnd> ( key, <S2SV_ModStart> nkey, c <S2SV_ModEnd> ) ; if
Buggy code:
 static int raptor_rdfxml_parse_start ( raptor_parser * rdf_parser ) { raptor_uri * uri = rdf_parser -> base_uri ; raptor_rdfxml_parser * rdf_xml_parser ; rdf_xml_parser = ( raptor_rdfxml_parser * ) rdf_parser -> context ; if (! uri ) return 1 ; raptor_sax2_set_option ( rdf_xml_parser -> sax2, RAPTOR_OPTION_NORMALIZE_LANGUAGE, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_NORMALIZE_LANGUAGE ) ) ; raptor_sax2_set_option ( rdf_xml_parser -> sax2, RAPTOR_OPTION_NO_NET, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_NO_NET ) ) ; raptor_sax2_set_option ( rdf_xml_parser -> sax2, RAPTOR_OPTION_NO_FILE, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_NO_FILE ) ) ; <START_BUG> if ( rdf_parser -> uri_filter ) <END_BUG> raptor_sax2_set_uri_filter ( rdf_xml_parser -> sax2, rdf_parser -> uri_filter, rdf_parser -> uri_filter_user_data ) ; raptor_sax2_parse_start ( rdf_xml_parser -> sax2, uri ) ; if ( rdf_xml_parser -> id_set ) { raptor_free_id_set ( rdf_xml_parser -> id_set ) ; rdf_xml_parser -> id_set = NULL ; } if ( RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_CHECK_RDF_ID ) ) { rdf_xml_parser -> id_set = raptor_new_id_set ( rdf_parser -> world ) ; if (! rdf_xml_parser -> id_set ) return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; raptor_sax2_set_option ( rdf_xml_parser -> sax2, RAPTOR_OPTION_LOAD_EXTERNAL_ENTITIES, NULL, RAPTOR_OPTIONS_GET_NUMERIC ( rdf_parser, RAPTOR_OPTION_LOAD_EXTERNAL_ENTITIES ) ) ;
Buggy code:
 struct se_portal_group * tcm_loop_make_naa_tpg ( struct se_wwn * wwn, struct config_group * group, const char * name ) { struct tcm_loop_hba * tl_hba = container_of ( wwn, struct tcm_loop_hba, tl_hba_wwn ) ; struct tcm_loop_tpg * tl_tpg ; char * tpgt_str, * end_ptr ; int ret ; unsigned short int tpgt ; tpgt_str = strstr ( name, "tpgt_" ) ; if (! tpgt_str ) { printk ( KERN_ERR "Unable   to   locate   \\"tpgt_#\\"   directory" "   group\\n" ) ; return ERR_PTR ( - EINVAL ) ; } tpgt_str += 5 ; tpgt = ( unsigned short int ) simple_strtoul ( tpgt_str, & end_ptr, 0 ) ; <START_BUG> if ( tpgt > TL_TPGS_PER_HBA ) { <END_BUG> printk ( KERN_ERR "Passed   tpgt:   %hu   exceeds   TL_TPGS_PER_HBA:" "   %u\\n", tpgt, TL_TPGS_PER_HBA ) ; return ERR_PTR ( - EINVAL ) ; } tl_tpg = & tl_hba -> tl_hba_tpgs [ tpgt ] ; tl_tpg -> tl_hba = tl_hba ; tl_tpg -> tl_tpgt = tpgt ; ret = core_tpg_register ( & tcm_loop_fabric_configfs -> tf_ops, wwn, & tl_tpg -> tl_se_tpg, tl_tpg, TRANSPORT_TPG_TYPE_NORMAL ) ; if ( ret < 0 ) return ERR_PTR ( - ENOMEM ) ; printk ( KERN_INFO "TCM_Loop_ConfigFS:   Allocated   Emulated   %s" "   Target   Port   %s,t,0x%04x\\n", tcm_loop_dump_proto_id ( tl_hba ), config_item_name ( & wwn -> wwn_group

Fix:
<S2SV_ModStart> if ( tpgt >= <S2SV_ModEnd> TL_TPGS_PER_HBA ) {
Buggy code:
 int mainloop ( CLIENT * client ) { struct nbd_request request ; struct nbd_reply reply ; gboolean go_on = TRUE ; # ifdef DODBG int i = 0 ; # endif negotiate ( client -> net, client, NULL ) ; DEBUG ( "Entering   request   loop!\\n" ) ; reply. magic = htonl ( NBD_REPLY_MAGIC ) ; reply. error = 0 ; while ( go_on ) { char buf [ BUFSIZE ] ; size_t len ; # ifdef DODBG i ++ ; printf ( "%d:   ", i ) ; # endif readit ( client -> net, & request, sizeof ( request ) ) ; request. from = ntohll ( request. from ) ; request. type = ntohl ( request. type ) ; if ( request. type == NBD_CMD_DISC ) { msg2 ( LOG_INFO, "Disconnect   request   received." ) ; if ( client -> server -> flags & F_COPYONWRITE ) { if ( client -> difmap ) g_free ( client -> difmap ) ; close ( client -> difffile ) ; unlink ( client -> difffilename ) ; free ( client -> difffilename ) ; } go_on = FALSE ; continue ; } len = ntohl ( request. len ) ; if ( request. magic!= htonl ( NBD_REQUEST_MAGIC ) ) err ( "Not   enough   magic." ) ; <START_BUG> if ( len > BUFSIZE + sizeof ( struct nbd_reply ) ) <END_BUG> err ( "Request   too   big!" ) ; # ifdef DODBG printf ( "%s   from   %llu   (%llu)   len   %d,   ", request. type? "WRITE" : "READ", ( unsigned long long ) request. from, ( unsigned long long ) request. from // 512, len ) ; # endif memcpy ( reply. handle, request. handle, sizeof ( reply. handle ) ) ; if ( ( request. from + len ) > ( OFFT_MAX ) ) { DEBUG ( "[Number   too   large!]" ) ; ERROR ( client, reply, EINVAL ) ; continue ; } if ( ( ( ssize_t ) ( ( off_t ) request. from + len ) > client ->

Fix:
<S2SV_ModStart> len > BUFSIZE - <S2SV_ModEnd> sizeof ( struct
Buggy code:
 static void handle_mlppp ( netdissect_options * ndo, const u_char * p, int length ) { if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "MLPPP,   " ) ) ; <START_BUG> ND_PRINT ( ( ndo, "seq   0x%03x,   Flags   [%s],   length   %u", <END_BUG> ( EXTRACT_16BITS ( p ) ) & 0x0fff, bittok2str ( ppp_ml_flag_values, "none", * p & 0xc0 ), length ) ) ; }

Fix:
<S2SV_ModStart> ) ) ; if ( length < 2 ) { ND_PRINT ( ( ndo, "[|mlppp]" ) ) ; return ; } if (! ND_TTEST_16BITS ( p ) ) { ND_PRINT ( ( ndo, "[|mlppp]" ) ) ; return ; }
Buggy code:
 static int nr_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int flags ) { struct sock * sk = sock -> sk ; struct sockaddr_ax25 * sax = ( struct sockaddr_ax25 * ) msg -> msg_name ; size_t copied ; struct sk_buff * skb ; int er ; lock_sock ( sk ) ; if ( sk -> sk_state!= TCP_ESTABLISHED ) { release_sock ( sk ) ; return - ENOTCONN ; } if ( ( skb = skb_recv_datagram ( sk, flags & ~ MSG_DONTWAIT, flags & MSG_DONTWAIT, & er ) ) == NULL ) { release_sock ( sk ) ; return er ; } skb_reset_transport_header ( skb ) ; copied = skb -> len ; if ( copied > size ) { copied = size ; msg -> msg_flags |= MSG_TRUNC ; } er = skb_copy_datagram_iovec ( skb, 0, msg -> msg_iov, copied ) ; if ( er < 0 ) { skb_free_datagram ( sk, skb ) ; release_sock ( sk ) ; return er ; } if ( sax!= NULL ) { <START_BUG> memset ( sax, 0, sizeof ( sax ) ) ; <END_BUG> sax -> sax25_family = AF_NETROM ; skb_copy_from_linear_data_offset ( skb, 7, sax -> sax25_call. ax25_call, AX25_ADDR_LEN ) ; } msg -> msg_namelen = sizeof ( * sax ) ; skb_free_datagram ( sk, skb ) ; release_sock ( sk ) ; return copied ; }

Fix:
<S2SV_ModStart>, sizeof ( *
Buggy code:
 static void cmd_anal_esil ( RCore * core, const char * input ) { RAnalEsil * esil = core -> anal -> esil ; ut64 addr = core -> offset ; ut64 adr ; char * n, * n1 ; int off ; int stacksize = r_config_get_i ( core -> config, "esil.stack.depth" ) ; int iotrap = r_config_get_i ( core -> config, "esil.iotrap" ) ; int romem = r_config_get_i ( core -> config, "esil.romem" ) ; int stats = r_config_get_i ( core -> config, "esil.stats" ) ; int noNULL = r_config_get_i ( core -> config, "esil.noNULL" ) ; ut64 until_addr = UT64_MAX ; unsigned int addrsize = r_config_get_i ( core -> config, "esil.addr.size" ) ; const char * until_expr = NULL ; RAnalOp * op ; switch ( input [ 0 ] ) { case 'p' : switch ( input [ 1 ] ) { case 'c' : if ( input [ 2 ] ==' ') { r_core_cmdf ( core, "ar   PC=%s", input + 3 ) ; r_core_cmd0 ( core, ".ar*" ) ; } else { eprintf ( "Missing   argument\\n" ) ; } break ; case 0 : r_anal_pin_list ( core -> anal ) ; break ; case '-' : if ( input [ 2 ] ) addr = r_num_math ( core -> num, input + 2 ) ; r_anal_pin_unset ( core -> anal, addr ) ; break ; case' ': r_anal_pin ( core -> anal, addr, input + 2 ) ; break ; default : r_core_cmd_help ( core, help_msg_aep ) ; break ; } break ; case 'r' : cmd_anal_reg ( core, input + 1 ) ; break ; case '*' : if ( core -> anal -> esil ) { r_cons_printf ( "trap:   %d\\n", core -> anal ->

Fix:
<S2SV_ModStart>! esil ) { return ; } <S2SV_ModEnd> r_anal_esil_to_reil_setup ( esil
Buggy code:
 static void Np_toString ( js_State * J ) { <START_BUG> char buf [ 32 ] ; <END_BUG> js_Object * self = js_toobject ( J, 0 ) ; int radix = js_isundefined ( J, 1 )? 10 : js_tointeger ( J, 1 ) ; if ( self -> type!= JS_CNUMBER ) js_typeerror ( J, "not   a   number" ) ; if ( radix == 10 ) { js_pushstring ( J, jsV_numbertostring ( J, buf, self -> u. number ) ) ; return ; } if ( radix < 2 || radix > 36 ) js_rangeerror ( J, "invalid   radix" ) ; { static const char digits [ ] = "0123456789abcdefghijklmnopqrstuvwxyz" ;  char buf [ 100 ] ; <START_BUG> double number = self -> u. number ; int sign = self -> u. number < 0 ; js_Buffer * sb = NULL ; uint64_t u, limit = ( ( uint64_t ) 1 << 52 ) ; int ndigits, exp, point ; if ( number == 0 ) { js_pushstring ( J, "0" ) ; return ; } if ( isnan ( number ) ) { js_pushstring ( J, "NaN" ) ; return ; } if ( isinf ( number ) ) { js_pushstring ( J, sign? "-Infinity" : "Infinity" ) ; return ; } if ( sign ) number = - number ; exp = 0 ; while ( number * pow ( radix, exp ) > limit ) -- exp ; while ( number * pow ( radix, exp + 1 ) < limit ) ++ exp ; u = number * pow ( radix, exp ) + 0.5 ; while ( u > 0 && ( u % radix ) == 0 ) { u //= radix ; -- exp ; } ndigits = 0 ; while ( u > 0 ) { buf [ ndigits ++ ] = digits [ u % radix ] ; u //= radix ; } point = ndigits - exp ; if ( js_try ( J ) ) { js_free ( J, sb ) ; js_throw ( J ) ; } if ( sign ) js_putc ( J, & sb, '-' ) ; if ( point <= 0 ) { js_putc ( J, & sb, '0'<END_BUG>

Fix:
<S2SV_ModStart> char buf [ 100 <S2SV_ModEnd> ] ; js_Object <S2SV_ModStart> = "0123456789abcdefghijklmnopqrstuvwxyz" ; <S2SV_ModEnd> double number =
Buggy code:
 static int decoding_feof ( struct tok_state * tok ) { if ( tok -> decoding_state!= STATE_NORMAL ) { return feof ( tok -> fp ) ; } else { PyObject * buf = tok -> decoding_buffer ; if ( buf == NULL ) { <START_BUG> buf = PyObject_CallObject ( tok -> decoding_readline, NULL ) ; <END_BUG> if ( buf == NULL ) { error_ret ( tok ) ; return 1 ; } else { tok -> decoding_buffer = buf ; } } return PyObject_Length ( buf ) == 0 ; } }

Fix:
<S2SV_ModStart> { buf = _PyObject_CallNoArg <S2SV_ModEnd> ( tok -> <S2SV_ModStart> tok -> decoding_readline <S2SV_ModEnd> ) ; if
Buggy code:
 int av_reallocp_array ( void * ptr, size_t nmemb, size_t size ) { void * * ptrptr = ptr ; * ptrptr = av_realloc_f ( * ptrptr, nmemb, size ) ; <START_BUG> if (! * ptrptr &&! ( nmemb && size ) ) <END_BUG> return AVERROR ( ENOMEM ) ; return 0 ; }

Fix:
<S2SV_ModStart> * ptrptr && <S2SV_ModEnd> nmemb && size <S2SV_ModStart> nmemb && size <S2SV_ModEnd> ) return AVERROR
Buggy code:
 static stmt_ty ast_for_for_stmt ( struct compiling * c, const node * n0, bool is_async ) { const node * const n = is_async? CHILD ( n0, 1 ) : n0 ; asdl_seq * _target, * seq = NULL, * suite_seq ; expr_ty expression ; expr_ty target, first ; const node * node_target ; int end_lineno, end_col_offset ; <START_BUG> REQ ( n, for_stmt ) ; <END_BUG>  if ( NCH ( n ) == 9 ) { <START_BUG> <END_BUG> seq = ast_for_suite ( c, CHILD ( n, 8 ) ) ;  if (! seq ) return NULL ; } node_target = CHILD ( n, 1 ) ; _target = ast_for_exprlist ( c, node_target, Store ) ; if (! _target ) return NULL ; first = ( expr_ty ) asdl_seq_GET ( _target, 0 ) ; if ( NCH ( node_target ) == 1 ) target = first ; else target = Tuple ( _target, Store, first -> lineno, first -> col_offset, node_target -> n_end_lineno, node_target -> n_end_col_offset, c -> c_arena ) ; expression = ast_for_testlist ( c, CHILD ( n, 3 ) ) ; if (! expression ) return NULL ; <START_BUG> suite_seq = ast_for_suite ( c, CHILD ( n, 5 ) ) ; <END_BUG> if (! suite_seq ) return NULL ; if ( seq!= NULL ) { get_last_end_pos ( seq, & end_lineno, & end_col_offset ) ; } else { get_last_end_pos ( suite_seq, & end_lineno, & end_col_offset ) ; }  if ( is_async ) <START_BUG> <END_BUG> return AsyncFor ( target, expression, suite_seq, seq,  LINENO ( n0 ), n0 -> n_col_offset, end_lineno, end_col_offset, c -> c_arena ) ; else <START_BUG> return For ( target, expression, suite_seq, seq, <END_BUG> LINENO ( n ), n -> n_col_offset, end_lineno, end_col_offset, c -> c_arena

Fix:
<S2SV_ModStart>, end_col_offset ; int has_type_comment ; string type_comment ; <S2SV_ModStart>, for_stmt ) ; has_type_comment = TYPE ( CHILD ( n, 5 ) ) == TYPE_COMMENT <S2SV_ModStart> ) == 9 + has_type_comment <S2SV_ModStart> n, 8 + has_type_comment <S2SV_ModStart> n, 5 + has_type_comment <S2SV_ModStart> } if ( has_type_comment ) { type_comment = NEW_TYPE_COMMENT ( CHILD ( n, 5 ) ) ; if (! type_comment ) return NULL ; } else type_comment = NULL ; if ( <S2SV_ModStart>, seq, type_comment, <S2SV_ModStart> suite_seq, seq, type_comment
Buggy code:
 static int bnep_sock_ioctl ( struct socket * sock, unsigned int cmd, unsigned long arg ) { struct bnep_connlist_req cl ; struct bnep_connadd_req ca ; struct bnep_conndel_req cd ; struct bnep_conninfo ci ; struct socket * nsock ; void __user * argp = ( void __user * ) arg ; int err ; BT_DBG ( "cmd   %x   arg   %lx", cmd, arg ) ; switch ( cmd ) { case BNEPCONNADD : if (! capable ( CAP_NET_ADMIN ) ) return - EACCES ; if ( copy_from_user ( & ca, argp, sizeof ( ca ) ) ) return - EFAULT ; nsock = sockfd_lookup ( ca. sock, & err ) ; if (! nsock ) return err ; if ( nsock -> sk -> sk_state!= BT_CONNECTED ) { sockfd_put ( nsock ) ; return - EBADFD ; } <START_BUG> err = bnep_add_connection ( & ca, nsock ) ; <END_BUG> if (! err ) { if ( copy_to_user ( argp, & ca, sizeof ( ca ) ) ) err = - EFAULT ; } else sockfd_put ( nsock ) ; return err ; case BNEPCONNDEL : if (! capable ( CAP_NET_ADMIN ) ) return - EACCES ; if ( copy_from_user ( & cd, argp, sizeof ( cd ) ) ) return - EFAULT ; return bnep_del_connection ( & cd ) ; case BNEPGETCONNLIST : if ( copy_from_user ( & cl, argp, sizeof ( cl ) ) ) return - EFAULT ; if ( cl. cnum <= 0 ) return - EINVAL ; err = bnep_get_connlist ( & cl ) ; if (! err && copy_to_user ( argp, & cl, sizeof ( cl ) ) ) return - EFAULT ; return err ; case BNEPGETCONNINFO : if ( copy_from_user ( & ci, argp, sizeof ( ci ) ) ) return - EFAULT ; err = bnep_get_conninfo ( & ci ) ; if (! err && copy_to_user ( argp, & ci,

Fix:
<S2SV_ModStart> EBADFD ; } ca. device [ sizeof ( ca. device ) - 1 ] = 0 ;
Buggy code:
 static stmt_ty ast_for_classdef ( struct compiling * c, const node * n, asdl_seq * decorator_seq ) { PyObject * classname ; asdl_seq * s ; expr_ty call ; REQ ( n, classdef ) ; if ( NCH ( n ) == 4 ) { s = ast_for_suite ( c, CHILD ( n, 3 ) ) ; if (! s ) return NULL ; classname = NEW_IDENTIFIER ( CHILD ( n, 1 ) ) ; if (! classname ) return NULL ; if ( forbidden_name ( c, classname, CHILD ( n, 3 ), 0 ) ) return NULL ; return ClassDef ( classname, NULL, NULL, s, decorator_seq, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } if ( TYPE ( CHILD ( n, 3 ) ) == RPAR ) { s = ast_for_suite ( c, CHILD ( n, 5 ) ) ; if (! s ) return NULL ; classname = NEW_IDENTIFIER ( CHILD ( n, 1 ) ) ; if (! classname ) return NULL ; if ( forbidden_name ( c, classname, CHILD ( n, 3 ), 0 ) ) return NULL ; return ClassDef ( classname, NULL, NULL, s, decorator_seq, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } { PyObject * dummy_name ; expr_ty dummy ; dummy_name = NEW_IDENTIFIER ( CHILD ( n, 1 ) ) ; if (! dummy_name ) return NULL ; dummy = Name ( dummy_name, Load, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; <START_BUG> call = ast_for_call ( c, CHILD ( n, 3 ), dummy ) ; <END_BUG> if (! call ) return NULL ; } s = ast_for_suite ( c, CHILD ( n, 6 ) ) ; if (! s ) return NULL ; classname = NEW_IDENTIFIER ( CHILD ( n, 1 ) ) ; if (! classname ) return NULL ; if ( forbidden_name ( c, classname, CHILD ( n, 1 ), 0 ) ) return NULL ; return ClassDef ( classname, call -> v.

Fix:
<S2SV_ModStart> ), dummy, false
Buggy code:
 static Image * ReadSGIImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; SGIInfo iris_info ; size_t bytes_per_pixel, quantum ; ssize_t count, y, z ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } iris_info. magic = ReadBlobMSBShort ( image ) ; do { if ( iris_info. magic!= 0x01DA ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; iris_info. storage = ( unsigned char ) ReadBlobByte ( image ) ; switch ( iris_info. storage ) { case 0x00 : image -> compression = NoCompression ; break ; case 0x01 : image -> compression = RLECompression ; break ; default : ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; } iris_info. bytes_per_pixel = ( unsigned char ) ReadBlobByte ( image ) ; if ( ( iris_info. bytes_per_pixel == 0 ) || ( iris_info. bytes_per_pixel > 2 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; <START_BUG> iris_info. dimension = ReadBlobMSBShort ( image ) ; <END_BUG> iris_info. columns = ReadBlobMSBShort ( image ) ; iris_info. rows = ReadBlobMSBShort ( image ) ; iris_

Fix:
<S2SV_ModStart> ReadBlobMSBShort ( image ) ; if ( ( iris_info. dimension == 0 ) || ( iris_info. dimension > 3 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader"
Buggy code:
 int pgx_validate ( jas_stream_t * in ) { <START_BUG> uchar buf [ PGX_MAGICLEN ] ; <END_BUG> uint_fast32_t magic ; int i ; int n ; assert ( JAS_STREAM_MAXPUTBACK >= PGX_MAGICLEN ) ; if ( ( n = jas_stream_read ( in, buf, PGX_MAGICLEN ) ) < 0 ) { return - 1 ; } for ( i = n - 1 ; i >= 0 ; -- i ) { if ( jas_stream_ungetc ( in, buf [ i ] ) == EOF ) { return - 1 ; } } if ( n < PGX_MAGICLEN ) { return - 1 ; } magic = ( buf [ 0 ] << 8 ) | buf [ 1 ] ; if ( magic!= PGX_MAGIC ) { return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> in ) { jas_uchar <S2SV_ModEnd> buf [ PGX_MAGICLEN
Buggy code:
 static void _out_verify ( conn_t out, nad_t nad ) { int attr, ns ; jid_t from, to ; conn_t in ; char * rkey ; int valid ; attr = nad_find_attr ( nad, 0, - 1, "from", NULL ) ; if ( attr < 0 || ( from = jid_new ( NAD_AVAL ( nad, attr ), NAD_AVAL_L ( nad, attr ) ) ) == NULL ) { log_debug ( ZONE, "missing   or   invalid   from   on   db   verify   packet" ) ; nad_free ( nad ) ; return ; } attr = nad_find_attr ( nad, 0, - 1, "to", NULL ) ; if ( attr < 0 || ( to = jid_new ( NAD_AVAL ( nad, attr ), NAD_AVAL_L ( nad, attr ) ) ) == NULL ) { log_debug ( ZONE, "missing   or   invalid   to   on   db   verify   packet" ) ; jid_free ( from ) ; nad_free ( nad ) ; return ; } attr = nad_find_attr ( nad, 0, - 1, "id", NULL ) ; if ( attr < 0 ) { log_debug ( ZONE, "missing   id   on   db   verify   packet" ) ; jid_free ( from ) ; jid_free ( to ) ; nad_free ( nad ) ; return ; } in = xhash_getx ( out -> s2s -> in, NAD_AVAL ( nad, attr ), NAD_AVAL_L ( nad, attr ) ) ; if ( in == NULL ) { log_debug ( ZONE, "got   a   verify   for   incoming   conn   %.*s,   but   it   doesn\'t   exist,   dropping   the   packet", NAD_AVAL_L ( nad, attr ), NAD_AVAL ( nad, attr ) ) ; jid_free ( from ) ; jid_free ( to ) ; nad_free ( nad ) ; return ; } rkey = s2s_route_key ( NULL, to ->

Fix:
<S2SV_ModStart> attr >= 0 && xhash_get ( in -> states, rkey ) == ( void * ) conn_INPROGRESS
Buggy code:
 int vp8_find_best_sub_pixel_step ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * bestmv, int_mv * ref_mv, int error_per_bit, const vp8_variance_fn_ptr_t * vfp, int * mvcost [ 2 ], int * distortion, unsigned int * sse1 ) { int bestmse = INT_MAX ; int_mv startmv ; int_mv this_mv ; unsigned char * z = ( * ( b -> base_src ) + b -> src ) ; int left, right, up, down, diag ; unsigned int sse ; int whichdir ; int thismse ; int y_stride ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; # if ARCH_X86 || ARCH_X86_64 MACROBLOCKD * xd = & x -> e_mbd ; unsigned char * y_0 = base_pre + d -> offset + ( bestmv -> as_mv. row ) * pre_stride + bestmv -> as_mv. col ; unsigned char * y ; y_stride = 32 ; vfp -> copymem ( y_0 - 1 - pre_stride, pre_stride, xd -> y_buf, y_stride, 18 ) ; y = xd -> y_buf + y_stride + 1 ; # else unsigned char * y = base_pre + d -> offset + ( bestmv -> as_mv. row ) * pre_stride + bestmv -> as_mv. col ; y_stride = pre_stride ; # endif <START_BUG> bestmv -> as_mv. row <<= 3 ; <END_BUG>  bestmv -> as_mv. col <<= 3 ; <START_BUG> startmv = * bestmv ; bestmse = vfp -> vf ( y, y_stride, z, b -> src_stride, sse1 ) ; * distortion = bestmse ; bestmse += mv_err_cost ( bestmv, ref_mv, mvcost, error_per_bit ) ; this_mv. as_mv. row = startmv. as_mv. row ; this_mv. as_mv. col = ( ( startmv. as_mv.<END_BUG>

Fix:
<S2SV_ModStart> as_mv. row *= 8 <S2SV_ModEnd> ; bestmv -> <S2SV_ModStart> as_mv. col *= 8 <S2SV_ModEnd> ; startmv =
Buggy code:
 static ssize_t userfaultfd_ctx_read ( struct userfaultfd_ctx * ctx, int no_wait, struct uffd_msg * msg ) { ssize_t ret ; DECLARE_WAITQUEUE ( wait, current ) ; struct userfaultfd_wait_queue * uwq ; LIST_HEAD ( fork_event ) ; struct userfaultfd_ctx * fork_nctx = NULL ; spin_lock ( & ctx -> fd_wqh. lock ) ; __add_wait_queue ( & ctx -> fd_wqh, & wait ) ; for ( ; ; ) { set_current_state ( TASK_INTERRUPTIBLE ) ; spin_lock ( & ctx -> fault_pending_wqh. lock ) ; uwq = find_userfault ( ctx ) ; if ( uwq ) { write_seqcount_begin ( & ctx -> refile_seq ) ; list_del ( & uwq -> wq. entry ) ; __add_wait_queue ( & ctx -> fault_wqh, & uwq -> wq ) ; write_seqcount_end ( & ctx -> refile_seq ) ; * msg = uwq -> msg ; spin_unlock ( & ctx -> fault_pending_wqh. lock ) ; ret = 0 ; break ; } spin_unlock ( & ctx -> fault_pending_wqh. lock ) ; spin_lock ( & ctx -> event_wqh. lock ) ; uwq = find_userfault_evt ( ctx ) ; if ( uwq ) { * msg = uwq -> msg ; if ( uwq -> msg. event == UFFD_EVENT_FORK ) { fork_nctx = ( struct userfaultfd_ctx * ) ( unsigned long ) uwq -> msg. arg. reserved. reserved1 ; list_move ( & uwq -> wq. entry, & fork_event ) ; <START_BUG> spin_unlock ( & ctx -> event_wqh. lock ) ; <END_BUG> ret = 0 ; break ; } userfaultfd_event_complete ( ctx, uwq ) ; spin_unlock ( & ctx -> event_wqh. lock ) ; ret = 0 ; break ; } spin_unlock ( & ctx -> event_wqh. lock )

Fix:
<S2SV_ModStart> fork_event ) ; userfaultfd_ctx_get ( fork_nctx ) ; <S2SV_ModStart> msg ) ; <S2SV_ModEnd> spin_lock ( & <S2SV_ModStart> ) ) { userfaultfd_ctx_put ( fork_nctx ) ; <S2SV_ModStart> wq ) ; if ( likely (! ret ) ) <S2SV_ModStart> ) ; } else { if ( ret ) userfaultfd_ctx_put ( fork_nctx ) ; } spin_unlock ( & ctx -> event_wqh. lock ) ; <S2SV_ModEnd> } return ret
Buggy code:
 static void * btif_hh_poll_event_thread ( void * arg ) { btif_hh_device_t * p_dev = arg ; APPL_TRACE_DEBUG ( "%s:   Thread   created   fd   =   %d", __FUNCTION__, p_dev -> fd ) ; struct pollfd pfds [ 1 ] ; int ret ; pfds [ 0 ]. fd = p_dev -> fd ; pfds [ 0 ]. events = POLLIN ; uhid_set_non_blocking ( p_dev -> fd ) ; while ( p_dev -> hh_keep_polling ) { <START_BUG> ret = poll ( pfds, 1, 50 ) ; <END_BUG> if ( ret < 0 ) { APPL_TRACE_ERROR ( "%s:   Cannot   poll   for   fds:   %s\\n", __FUNCTION__, strerror ( errno ) ) ; break ; } if ( pfds [ 0 ]. revents & POLLIN ) { APPL_TRACE_DEBUG ( "btif_hh_poll_event_thread:   POLLIN" ) ; ret = uhid_event ( p_dev ) ; if ( ret ) { break ; } } } p_dev -> hh_poll_thread_id = - 1 ; return 0 ; }

Fix:
<S2SV_ModStart> { ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> 1, 50 )
Buggy code:
 static int rfcomm_get_dev_list ( void __user * arg ) { struct rfcomm_dev * dev ; struct rfcomm_dev_list_req * dl ; struct rfcomm_dev_info * di ; int n = 0, size, err ; u16 dev_num ; BT_DBG ( "" ) ; if ( get_user ( dev_num, ( u16 __user * ) arg ) ) return - EFAULT ; if (! dev_num || dev_num > ( PAGE_SIZE * 4 ) // sizeof ( * di ) ) return - EINVAL ; size = sizeof ( * dl ) + dev_num * sizeof ( * di ) ; <START_BUG> dl = kmalloc ( size, GFP_KERNEL ) ; <END_BUG> if (! dl ) return - ENOMEM ; di = dl -> dev_info ; spin_lock ( & rfcomm_dev_lock ) ; list_for_each_entry ( dev, & rfcomm_dev_list, list ) { if ( test_bit ( RFCOMM_TTY_RELEASED, & dev -> flags ) ) continue ; ( di + n ) -> id = dev -> id ; ( di + n ) -> flags = dev -> flags ; ( di + n ) -> state = dev -> dlc -> state ; ( di + n ) -> channel = dev -> channel ; bacpy ( & ( di + n ) -> src, & dev -> src ) ; bacpy ( & ( di + n ) -> dst, & dev -> dst ) ; if ( ++ n >= dev_num ) break ; } spin_unlock ( & rfcomm_dev_lock ) ; dl -> dev_num = n ; size = sizeof ( * dl ) + n * sizeof ( * di ) ; err = copy_to_user ( arg, dl, size ) ; kfree ( dl ) ; return err? - EFAULT : 0 ; }

Fix:
<S2SV_ModStart> ; dl = kzalloc <S2SV_ModEnd> ( size,
Buggy code:
 static Image * ReadTXTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char colorspace [ MagickPathExtent ], text [ MagickPathExtent ] ; Image * image ; long x_offset, y_offset ; PixelInfo pixel ; MagickBooleanType status ; QuantumAny range ; register ssize_t i, x ; register Quantum * q ; ssize_t count, type, y ; unsigned long depth, height, max_value, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( text, 0, sizeof ( text ) ) ; ( void ) ReadBlobString ( image, text ) ; if ( LocaleNCompare ( ( char * ) text, MagickID, strlen ( MagickID ) )!= 0 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { width = 0 ; height = 0 ; max_value = 0 ; * colorspace = '\\0' ; count = ( ssize_t ) sscanf ( text + 32, "%lu,%lu,%lu,%s", & width, & height, & max_value, colorspace ) ; if ( ( count!= 4 ) || ( width == 0 ) || ( height == 0 ) || ( max_value == 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; image -> columns = width ; image -> rows = height ; <START_BUG> for ( depth = 1 ; ( GetQuantumRange ( depth ) + 1 ) < max_value ; depth ++ ) ; <END_BUG> image -> depth = depth ; status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ;

Fix:
<S2SV_ModStart> depth ++ ) if ( depth >= 64 ) break