nus-yam/ex-repair huggingface dataset:
Buggy code:
 static alias_ty alias_for_import_name ( struct compiling * c, const node * n, int store ) { identifier str, name ; loop : switch ( TYPE ( n ) ) { case import_as_name : { node * name_node = CHILD ( n, 0 ) ; str = NULL ; name = NEW_IDENTIFIER ( name_node ) ; if (! name ) return NULL ; if ( NCH ( n ) == 3 ) { node * str_node = CHILD ( n, 2 ) ; str = NEW_IDENTIFIER ( str_node ) ; if (! str ) return NULL ; if ( store && forbidden_name ( c, str, str_node, 0 ) ) return NULL ; } else { if ( forbidden_name ( c, name, name_node, 0 ) ) return NULL ; } return alias ( name, str, c -> c_arena ) ; } case dotted_as_name : if ( NCH ( n ) == 1 ) { n = CHILD ( n, 0 ) ; goto loop ; } else { node * asname_node = CHILD ( n, 2 ) ; alias_ty a = alias_for_import_name ( c, CHILD ( n, 0 ), 0 ) ; if (! a ) return NULL ; assert (! a -> asname ) ; a -> asname = NEW_IDENTIFIER ( asname_node ) ; if (! a -> asname ) return NULL ; if ( forbidden_name ( c, a -> asname, asname_node, 0 ) ) return NULL ; return a ; } break ; case dotted_name : if ( NCH ( n ) == 1 ) { node * name_node = CHILD ( n, 0 ) ; name = NEW_IDENTIFIER ( name_node ) ; if (! name ) return NULL ; if ( store && forbidden_name ( c, name, name_node, 0 ) ) return NULL ; return alias ( name, NULL, c -> c_arena ) ; } else { int i ; size_t len ; char * s ; PyObject * uni ; len = 0 ; for ( i = 0 ; i < NCH ( n ) ; i += 2 ) len += strlen ( STR ( CHILD ( n, i ) ) ) + 1 ; len -- ; str = PyBytes_FromStringAndSize ( NULL, len ) ; if (

Fix:
<S2SV_ModStart> ; if (! str ) return NULL ; if (
Buggy code:
 static bool LookupModMask ( struct xkb_context * ctx, const void * priv, xkb_atom_t field, enum expr_value_type type, xkb_mod_mask_t * val_rtrn ) { const char * str ; xkb_mod_index_t ndx ; const LookupModMaskPriv * arg = priv ; const struct xkb_mod_set * mods = arg -> mods ; enum mod_type mod_type = arg -> mod_type ; if ( type!= EXPR_TYPE_INT ) return false ; str = xkb_atom_text ( ctx, field ) ; <START_BUG> if ( istreq ( str, "all" ) ) { <END_BUG> * val_rtrn = MOD_REAL_MASK_ALL ; return true ; } if ( istreq ( str, "none" ) ) { * val_rtrn = 0 ; return true ; } ndx = XkbModNameToIndex ( mods, field, mod_type ) ; if ( ndx == XKB_MOD_INVALID ) return false ; * val_rtrn = ( 1u << ndx ) ; return true ; }

Fix:
<S2SV_ModStart> ; if (! str ) return false ; if (
Buggy code:
 rrd_info_t * rrd_graph_v ( int argc, char * * argv ) { image_desc_t im ; rrd_info_t * grinfo ; rrd_graph_init ( & im ) ; rrd_graph_options ( argc, argv, & im ) ; if ( rrd_test_error ( ) ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } if ( optind >= argc ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; rrd_set_error ( "missing   filename" ) ; return NULL ; } if ( strlen ( argv [ optind ] ) >= MAXPATH ) { rrd_set_error ( "filename   (including   path)   too   long" ) ; rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } strncpy ( im. graphfile, argv [ optind ], MAXPATH - 1 ) ; im. graphfile [ MAXPATH - 1 ] = '\\0' ; if ( strcmp ( im. graphfile, "-" ) == 0 ) { im. graphfile [ 0 ] = '\\0' ; } rrd_graph_script ( argc, argv, & im, 1 ) ; if ( rrd_test_error ( ) ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } if ( graph_paint ( & im ) == - 1 ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; return NULL ; } if ( im. imginfo && * im. imginfo ) { rrd_infoval_t info ; char * path ; char * filename ; if ( bad_format_imginfo ( im. imginfo ) ) { rrd_info_free ( im. grinfo ) ; im_free ( & im ) ; <START_BUG> rrd_set_error ( "bad   format   for   imginfo" ) ; <END_BUG> return NULL ; } path = strdup ( im. graphfile ) ; filename = basename ( path ) ; info. u_str = sprintf_alloc ( im. imginfo, filename, ( long ) (

Fix:
<S2SV_ModStart> im ) ; <S2SV_ModEnd> return NULL ;
Buggy code:
 static void ip_expire ( unsigned long arg ) { struct ipq * qp ; struct net * net ; qp = container_of ( ( struct inet_frag_queue * ) arg, struct ipq, q ) ; net = container_of ( qp -> q. net, struct net, ipv4. frags ) ; spin_lock ( & qp -> q. lock ) ; if ( qp -> q. last_in & INET_FRAG_COMPLETE ) goto out ; ipq_kill ( qp ) ; IP_INC_STATS_BH ( net, IPSTATS_MIB_REASMTIMEOUT ) ; IP_INC_STATS_BH ( net, IPSTATS_MIB_REASMFAILS ) ; if ( ( qp -> q. last_in & INET_FRAG_FIRST_IN ) && qp -> q. fragments!= NULL ) { struct sk_buff * head = qp -> q. fragments ; <START_BUG> rcu_read_lock ( ) ; <END_BUG> head -> dev = dev_get_by_index_rcu ( net, qp -> iif ) ;  if (! head -> dev ) <START_BUG> goto out_rcu_unlock ; <END_BUG> if ( qp -> user == IP_DEFRAG_CONNTRACK_IN &&! skb_dst ( head ) ) {  const struct iphdr * iph = ip_hdr ( head ) ; int err = ip_route_input ( head, iph -> daddr, iph -> saddr, iph -> tos, head -> dev ) ; if ( unlikely ( err ) ) goto out_rcu_unlock ; if ( skb_rtable ( head ) -> rt_type!= RTN_LOCAL ) goto out_rcu_unlock ; <START_BUG> } <END_BUG> icmp_send ( head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0 ) ; out_rcu_unlock : rcu_read_unlock ( ) ; } out : spin_unlock ( & qp -> q. lock ) ; ipq_put ( qp ) ; }

Fix:
<S2SV_ModStart>. fragments ; const struct iphdr * iph ; int err ; <S2SV_ModStart> head -> dev ) goto out_rcu_unlock ; skb_dst_drop ( head ) ; iph = ip_hdr ( head ) ; err = ip_route_input_noref ( head, iph -> daddr, iph -> saddr, iph -> tos, head -> dev ) ; if ( err <S2SV_ModStart> == IP_DEFRAG_CONNTRACK_IN && <S2SV_ModEnd> skb_rtable ( head <S2SV_ModStart> goto out_rcu_unlock ; <S2SV_ModEnd> icmp_send ( head
Buggy code:
 sctp_disposition_t sctp_sf_do_5_2_4_dupcook ( struct net * net, const struct sctp_endpoint * ep, const struct sctp_association * asoc, const sctp_subtype_t type, void * arg, sctp_cmd_seq_t * commands ) { sctp_disposition_t retval ; struct sctp_chunk * chunk = arg ; struct sctp_association * new_asoc ; int error = 0 ; char action ; struct sctp_chunk * err_chk_p ; if (! sctp_chunk_length_valid ( chunk, sizeof ( sctp_chunkhdr_t ) ) ) return sctp_sf_violation_chunklen ( net, ep, asoc, type, arg, commands ) ; chunk -> subh. cookie_hdr = ( struct sctp_signed_cookie * ) chunk -> skb -> data ; if (! pskb_pull ( chunk -> skb, ntohs ( chunk -> chunk_hdr -> length ) - sizeof ( sctp_chunkhdr_t ) ) ) goto nomem ; new_asoc = sctp_unpack_cookie ( ep, asoc, chunk, GFP_ATOMIC, & error, & err_chk_p ) ; if (! new_asoc ) { switch ( error ) { case - SCTP_IERROR_NOMEM : goto nomem ; case - SCTP_IERROR_STALE_COOKIE : sctp_send_stale_cookie_err ( net, ep, asoc, chunk, commands, err_chk_p ) ; return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; case - SCTP_IERROR_BAD_SIG : default : return sctp_sf_pdiscard ( net, ep, asoc, type, arg, commands ) ; } } action = sctp_tietags_compare ( new_asoc, asoc ) ; switch ( action ) { case 'A' : retval = sctp_sf_do_dupcook_a ( net, ep, asoc, chunk, commands, new_asoc ) ; break ; case 'B' : retval = sctp_sf_do_dupcook_b ( net, ep, asoc, chunk, commands

Fix:
<S2SV_ModStart> ( commands, SCTP_CMD_SET_ASOC <S2SV_ModEnd>, SCTP_ASOC (
Buggy code:
 static int mount_entry ( const char * fsname, const char * target, const char * fstype, unsigned long mountflags, <START_BUG> const char * data, int optional ) <END_BUG> { # ifdef HAVE_STATVFS struct statvfs sb ; # endif  if ( mount ( fsname, target, fstype, mountflags & ~ MS_REMOUNT, data ) ) { <START_BUG> if ( optional ) { INFO ( "failed   to   mount   \'%s\'   on   \'%s\'   (optional):   %s", fsname, target, strerror ( errno ) ) ; return 0 ; } else { SYSERROR ( "failed   to   mount   \'%s\'   on   \'%s\'", fsname, target ) ; return - 1 ; } } if ( ( mountflags & MS_REMOUNT ) || ( mountflags & MS_BIND ) ) { DEBUG ( "remounting   %s   on   %s   to   respect   bind   or   remount   options", fsname? fsname : "(none)", target? target : "(none)" ) ; unsigned long rqd_flags = 0 ; if ( mountflags & MS_RDONLY ) rqd_flags |= MS_RDONLY ; # ifdef HAVE_STATVFS if ( statvfs ( fsname, & sb ) == 0 ) { unsigned long required_flags = rqd_flags ; if ( sb. f_flag & MS_NOSUID ) required_flags |= MS_NOSUID ; if ( sb. f_flag & MS_NODEV ) required_flags |= MS_NODEV ; if ( sb. f_flag & MS_RDONLY ) required_flags |= MS_RDONLY ; if ( sb. f_flag & MS_NOEXEC ) required_flags |= MS_NOEXEC ; DEBUG ( "(at   remount)   flags   for   %s   was   %lu,   required   extra   flags   are   %lu", fsname, sb. f_flag, required_flags ) ; if (! ( mountflags & MS_REMOUNT ) ) { if (! ( required_flags & ~ mountflags ) && rqd_flags == 0 ) { DEBUG ( "mountflags   already   was   %lu,   skipping   remount", mountflags ) ; goto<END_BUG>

Fix:
<S2SV_ModStart>, int optional, const char * rootfs <S2SV_ModStart> endif if ( safe_mount <S2SV_ModEnd> ( fsname, <S2SV_ModStart> MS_REMOUNT, data, rootfs <S2SV_ModStart>, data ) < 0
Buggy code:
 static void unix_detach_fds ( struct scm_cookie * scm, struct sk_buff * skb ) { int i ; scm -> fp = UNIXCB ( skb ). fp ; UNIXCB ( skb ). fp = NULL ; for ( i = scm -> fp -> count - 1 ; i >= 0 ; i -- ) <START_BUG> unix_notinflight ( scm -> fp -> fp [ i ] ) ; <END_BUG> }

Fix:
<S2SV_ModStart> -> fp -> user, scm -> fp ->
Buggy code:
 void virtio_config_writel ( VirtIODevice * vdev, uint32_t addr, uint32_t data ) { VirtioDeviceClass * k = VIRTIO_DEVICE_GET_CLASS ( vdev ) ; uint32_t val = data ; <START_BUG> if ( addr > ( vdev -> config_len - sizeof ( val ) ) ) <END_BUG> return ; stl_p ( vdev -> config + addr, val ) ; if ( k -> set_config ) { k -> set_config ( vdev, vdev -> config ) ; } }

Fix:
<S2SV_ModStart> if ( addr + <S2SV_ModEnd> sizeof ( val <S2SV_ModStart> ( val ) > vdev -> config_len ) { return ; } <S2SV_ModEnd> stl_p ( vdev
Buggy code:
 GF_Err MergeTrack ( GF_TrackBox * trak, GF_TrackFragmentBox * traf, GF_MovieFragmentBox * moof_box, u64 moof_offset, s32 compressed_diff, u64 * cumulated_offset, Bool is_first_merge ) { u32 i, j, chunk_size, track_num ; u64 base_offset, data_offset, traf_duration ; u32 def_duration, DescIndex, def_size, def_flags ; u32 duration, size, flags, prev_trun_data_offset, sample_index ; u8 pad, sync ; u16 degr ; Bool first_samp_in_traf = GF_TRUE ; Bool store_traf_map = GF_FALSE ; u8 * moof_template = NULL ; u32 moof_template_size = 0 ; Bool is_seg_start = GF_FALSE ; u64 seg_start = 0, sidx_start = 0, sidx_end = 0, frag_start = 0, last_dts = 0 ; GF_TrackFragmentRunBox * trun ; GF_TrunEntry * ent ; # ifdef GF_ENABLE_CTRN GF_TrackFragmentBox * traf_ref = NULL ; # endif GF_Err stbl_AppendTime ( GF_SampleTableBox * stbl, u32 duration, u32 nb_pack ) ; GF_Err stbl_AppendSize ( GF_SampleTableBox * stbl, u32 size, u32 nb_pack ) ; GF_Err stbl_AppendChunk ( GF_SampleTableBox * stbl, u64 offset ) ; GF_Err stbl_AppendSampleToChunk ( GF_SampleTableBox * stbl, u32 DescIndex, u32 samplesInChunk ) ; GF_Err stbl_AppendCTSOffset ( GF_SampleTableBox * stbl, s32 CTSOffset ) ; GF_Err stbl_AppendRAP ( GF_SampleTableBox * stbl, u8 isRap ) ; GF_Err stbl_AppendPadding ( GF_SampleTableBox * stbl, u8 padding ) ; GF_Err stbl_AppendDegradation (

Fix:
<S2SV_ModStart> ) ) { if ( saio -> offsets && saio -> entry_count ) { <S2SV_ModStart> ; } } saio = NULL ; } <S2SV_ModStart> break ; } saiz = NULL ;
Buggy code:
 static int atusb_read_reg ( struct atusb * atusb, uint8_t reg ) { struct usb_device * usb_dev = atusb -> usb_dev ; int ret ; <START_BUG> uint8_t value ; <END_BUG> dev_dbg ( & usb_dev -> dev, "atusb:   reg   =   0x%x\\n", reg ) ; ret = atusb_control_msg ( atusb, usb_rcvctrlpipe ( usb_dev, 0 ), ATUSB_REG_READ, ATUSB_REQ_FROM_DEV,  0, reg, & value, 1, 1000 ) ; <START_BUG> <END_BUG> return ret >= 0? value : ret ;  <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> ret ; uint8_t * buffer ; uint8_t value ; buffer = kmalloc ( 1, GFP_KERNEL ) ; if (! buffer ) return - ENOMEM <S2SV_ModEnd> ; dev_dbg ( <S2SV_ModStart>, reg, buffer <S2SV_ModEnd>, 1, <S2SV_ModStart> 1000 ) ; if ( <S2SV_ModEnd> ret >= 0 <S2SV_ModStart> ret >= 0 ) { value = buffer [ 0 ] ; kfree ( buffer ) ; return value ; } else { kfree ( buffer ) ; return <S2SV_ModEnd> ret ; } <S2SV_ModStart> ret ; } }
Buggy code:
 static int tpacket_rcv ( struct sk_buff * skb, struct net_device * dev, struct packet_type * pt, struct net_device * orig_dev ) { struct sock * sk ; struct packet_sock * po ; struct sockaddr_ll * sll ; union tpacket_uhdr h ; u8 * skb_head = skb -> data ; int skb_len = skb -> len ; unsigned int snaplen, res ; unsigned long status = TP_STATUS_USER ; unsigned short macoff, netoff, hdrlen ; struct sk_buff * copy_skb = NULL ; struct timespec ts ; __u32 ts_status ; <START_BUG> bool is_drop_n_account = false ; <END_BUG> BUILD_BUG_ON ( TPACKET_ALIGN ( sizeof ( * h. h2 ) )!= 32 ) ; BUILD_BUG_ON ( TPACKET_ALIGN ( sizeof ( * h. h3 ) )!= 48 ) ; if ( skb -> pkt_type == PACKET_LOOPBACK ) goto drop ; sk = pt -> af_packet_priv ; po = pkt_sk ( sk ) ; if (! net_eq ( dev_net ( dev ), sock_net ( sk ) ) ) goto drop ; if ( dev -> header_ops ) { if ( sk -> sk_type!= SOCK_DGRAM ) skb_push ( skb, skb -> data - skb_mac_header ( skb ) ) ; else if ( skb -> pkt_type == PACKET_OUTGOING ) { skb_pull ( skb, skb_network_offset ( skb ) ) ; } } snaplen = skb -> len ; res = run_filter ( skb, sk, snaplen ) ; if (! res ) goto drop_n_restore ; if ( skb -> ip_summed == CHECKSUM_PARTIAL ) status |= TP_STATUS_CSUMNOTREADY ; else if ( skb -> pkt_type!= PACKET_OUTGOING && ( skb -> ip_summed == CHECKSUM_COMPLETE || skb_csum_unnecessary ( skb ) ) ) status |= TP_STATUS_CSUM_VALID ; if ( snaplen > res ) snaplen = res ; if ( sk -> sk_type == SOCK_DGRAM

Fix:
<S2SV_ModStart> ; bool is_drop_n_account = false ; bool do_vnet <S2SV_ModStart> -> has_vnet_hdr ) { <S2SV_ModStart> virtio_net_hdr ) ; do_vnet = true ; } <S2SV_ModStart> < 0 ) { <S2SV_ModStart> = 0 ; do_vnet = false ; } <S2SV_ModStart> -> max_frame_len ; do_vnet = false ; <S2SV_ModStart> ; if ( do_vnet <S2SV_ModEnd> ) { if
Buggy code:
 <START_BUG> void vp9_cost_tokens ( int * costs, const vp9_prob * probs, vp9_tree tree ) { <END_BUG> cost ( costs, tree, probs, 0, 0 ) ; }

Fix:
<S2SV_ModStart> costs, const vpx_prob <S2SV_ModEnd> * probs, <S2SV_ModStart> * probs, vpx_tree <S2SV_ModEnd> tree ) {
Buggy code:
 int oe_iov_pack ( const struct oe_iovec * iov, int iovcnt, void * * buf_out, <START_BUG> size_t * buf_size_out ) <END_BUG> { int ret = - 1 ; struct oe_iovec * buf = NULL ; size_t buf_size = 0 ; size_t data_size = 0 ; if ( buf_out ) * buf_out = NULL ; if ( buf_size_out ) * buf_size_out = 0 ;  if ( iovcnt < 0 || ( iovcnt > 0 &&! iov ) ||! buf_out ||! buf_size_out ) <START_BUG> goto done ; if ( iovcnt == 0 ) { if ( iov ) { if (! ( buf = oe_calloc ( 1, sizeof ( uint64_t ) ) ) ) goto done ; buf_size = sizeof ( uint64_t ) ; } * buf_out = buf ; <END_BUG> * buf_size_out = buf_size ;  buf = NULL ; ret = 0 ; goto done ; } for ( int i = 0 ; i < iovcnt ; i ++ ) data_size += iov [ i ]. iov_len ; buf_size = ( sizeof ( struct oe_iovec ) * ( size_t ) iovcnt ) + data_size ; if (! ( buf = oe_calloc ( 1, buf_size ) ) ) goto done ; { uint8_t * p = ( uint8_t * ) & buf [ iovcnt ] ; size_t n = data_size ; int i ; for ( i = 0 ; i < iovcnt ; i ++ ) { const size_t iov_len = iov [ i ]. iov_len ; const void * iov_base = iov [ i ]. iov_base ; if ( iov_len ) { buf [ i ]. iov_len = iov_len ; buf [ i ]. iov_base = ( void * ) ( p - ( uint8_t * ) buf ) ; if (! iov_base ) goto done ; if ( oe_memcpy_s ( p, n, iov_base, iov_len )!= OE_OK ) goto done

Fix:
<S2SV_ModStart> size_t * buf_size_out, size_t * data_size_out <S2SV_ModStart> ; if ( data_size_out ) * data_size_out = 0 ; if ( <S2SV_ModStart> ||! buf_size_out ||! data_size_out <S2SV_ModStart> buf_size_out = buf_size ; * data_size_out = data_size <S2SV_ModStart> = buf_size ; * data_size_out = data_size ;
Buggy code:
 <START_BUG> static struct ion_handle * ion_handle_get_by_id ( struct ion_client * client, <END_BUG> int id ) { struct ion_handle * handle ; mutex_lock ( & client -> lock ) ;  handle = idr_find ( & client -> idr, id ) ; <START_BUG> if ( handle ) ion_handle_get ( handle ) ; mutex_unlock ( & client -> lock ) ; <END_BUG> return handle? handle : ERR_PTR ( - EINVAL ) ;  }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> struct ion_handle * <S2SV_ModStart> ; handle = ion_handle_get_by_id_nolock ( client, id <S2SV_ModEnd> ) ; mutex_unlock <S2SV_ModStart> ; return handle <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int send_results ( struct iperf_test * test ) { int r = 0 ; cJSON * j ; cJSON * j_streams ; struct iperf_stream * sp ; cJSON * j_stream ; int sender_has_retransmits ; iperf_size_t bytes_transferred ; int retransmits ; j = cJSON_CreateObject ( ) ; if ( j == NULL ) { i_errno = IEPACKAGERESULTS ; r = - 1 ; } else { <START_BUG> cJSON_AddFloatToObject ( j, "cpu_util_total", test -> cpu_util [ 0 ] ) ; <END_BUG>  cJSON_AddFloatToObject ( j, "cpu_util_user", test -> cpu_util [ 1 ] ) ; <START_BUG> <END_BUG> cJSON_AddFloatToObject ( j, "cpu_util_system", test -> cpu_util [ 2 ] ) ;  if (! test -> sender ) sender_has_retransmits = - 1 ; else sender_has_retransmits = test -> sender_has_retransmits ; <START_BUG> cJSON_AddIntToObject ( j, "sender_has_retransmits", sender_has_retransmits ) ; <END_BUG> if ( test -> role =='s' && test -> get_server_output ) { if ( test -> json_output ) { cJSON_AddItemReferenceToObject ( j, "server_output_json", test -> json_top ) ; } else { size_t buflen = 0 ; struct iperf_textline * t ; TAILQ_FOREACH ( t, & ( test -> server_output_list ), textlineentries ) { buflen += strlen ( t -> line ) ; } char * output = calloc ( buflen + 1, 1 ) ; TAILQ_FOREACH ( t, & ( test -> server_output_list ), textlineentries ) { strncat ( output, t -> line, buflen ) ; buflen -= strlen ( t -> line ) ; } cJSON_AddStringToObject ( j, "server_output_text", output ) ; } } j_streams = cJSON_CreateArray ( ) ; if ( j_streams == NULL ) { i_errno = IEPACKAGERESULTS ; r = - 1 ; } else { cJSON_AddItemToObject

Fix:
<S2SV_ModStart> } else { cJSON_AddNumberToObject <S2SV_ModEnd> ( j, <S2SV_ModStart> ] ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j, <S2SV_ModStart> ] ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j, <S2SV_ModStart> -> sender_has_retransmits ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j, <S2SV_ModStart> - 1 ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j_stream, <S2SV_ModStart> id ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j_stream, <S2SV_ModStart> bytes_transferred ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j_stream, <S2SV_ModStart> retransmits ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j_stream, <S2SV_ModStart> jitter ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j_stream, <S2SV_ModStart> cnt_error ) ; cJSON_AddNumberToObject <S2SV_ModEnd> ( j_stream,
Buggy code:
 static int calc_arf_boost ( VP9_COMP * cpi, int offset, int f_frames, int b_frames, int * f_boost, int * b_boost ) { <START_BUG> FIRSTPASS_STATS this_frame ; <END_BUG> struct twopass_rc * const twopass = & cpi -> twopass ; int i ; double boost_score = 0.0 ; double mv_ratio_accumulator = 0.0 ; double decay_accumulator = 1.0 ; double this_frame_mv_in_out = 0.0 ; double mv_in_out_accumulator = 0.0 ; double abs_mv_in_out_accumulator = 0.0 ; int arf_boost ; int flash_detected = 0 ; for ( i = 0 ; i < f_frames ; ++ i ) {  if ( read_frame_stats ( twopass, & this_frame, ( i + offset ) ) == EOF ) <START_BUG> break ; <END_BUG> accumulate_frame_motion_stats ( & this_frame,  & this_frame_mv_in_out, & mv_in_out_accumulator, & abs_mv_in_out_accumulator, & mv_ratio_accumulator ) ; flash_detected = detect_flash ( twopass, i + offset ) || detect_flash ( twopass, i + offset + 1 ) ; if (! flash_detected ) { <START_BUG> decay_accumulator *= get_prediction_decay_rate ( & cpi -> common, & this_frame ) ; <END_BUG> decay_accumulator = decay_accumulator < MIN_DECAY_FACTOR? MIN_DECAY_FACTOR : decay_accumulator ; }  boost_score += ( decay_accumulator * <START_BUG> <END_BUG> calc_frame_boost ( cpi, & this_frame, this_frame_mv_in_out ) ) ;  } * f_boost = ( int ) boost_score ; boost_score = 0.0 ; mv_ratio_accumulator = 0.0 ; decay_accumulator = 1.0 ; this_frame_mv_in_out = 0.0 ; mv_in_out_accumulator = 0.0 ; abs_mv_in_out_accumulator = 0.0 ; for ( i = - 1 ; i >= -

Fix:
<S2SV_ModStart> b_boost ) { TWO_PASS <S2SV_ModEnd> * const twopass <S2SV_ModStart> i ) { const FIRSTPASS_STATS * this_frame = read_frame_stats ( twopass, i + offset ) ; if ( this_frame == NULL <S2SV_ModEnd> ) break ; <S2SV_ModStart> ; accumulate_frame_motion_stats ( <S2SV_ModEnd> this_frame, & <S2SV_ModStart> *= get_prediction_decay_rate ( cpi, <S2SV_ModEnd> this_frame ) ; <S2SV_ModStart> } boost_score += decay_accumulator * <S2SV_ModEnd> calc_frame_boost ( cpi <S2SV_ModStart> ( cpi, this_frame, this_frame_mv_in_out, GF_MAX_BOOST <S2SV_ModEnd> ) ; } <S2SV_ModStart> i ) { const FIRSTPASS_STATS * this_frame = read_frame_stats ( twopass, i + offset ) ; if ( this_frame == NULL <S2SV_ModEnd> ) break ; <S2SV_ModStart> ; accumulate_frame_motion_stats ( <S2SV_ModEnd> this_frame, & <S2SV_ModStart> *= get_prediction_decay_rate ( cpi, <S2SV_ModEnd> this_frame ) ; <S2SV_ModStart> } boost_score += decay_accumulator * <S2SV_ModEnd> calc_frame_boost ( cpi <S2SV_ModStart> ( cpi, this_frame, this_frame_mv
Buggy code:
 static inline int l2cap_config_rsp ( struct l2cap_conn * conn, struct l2cap_cmd_hdr * cmd, u8 * data ) { struct l2cap_conf_rsp * rsp = ( struct l2cap_conf_rsp * ) data ; u16 scid, flags, result ; struct sock * sk ; scid = __le16_to_cpu ( rsp -> scid ) ; flags = __le16_to_cpu ( rsp -> flags ) ; result = __le16_to_cpu ( rsp -> result ) ; BT_DBG ( "scid   0x%4.4x   flags   0x%2.2x   result   0x%2.2x", scid, flags, result ) ; sk = l2cap_get_chan_by_scid ( & conn -> chan_list, scid ) ; if (! sk ) return 0 ; switch ( result ) { case L2CAP_CONF_SUCCESS : break ; case L2CAP_CONF_UNACCEPT : <START_BUG> if ( ++ l2cap_pi ( sk ) -> conf_retry < L2CAP_CONF_MAX_RETRIES ) { <END_BUG> char req [ 128 ] ;  l2cap_send_cmd ( conn, l2cap_get_ident ( conn ), L2CAP_CONF_REQ, <START_BUG> l2cap_build_conf_req ( sk, req ), req ) ; <END_BUG> goto done ;  } default : sk -> sk_state = BT_DISCONN ; sk -> sk_err = ECONNRESET ; l2cap_sock_set_timer ( sk, HZ * 5 ) ; { struct l2cap_disconn_req req ; req. dcid = cpu_to_le16 ( l2cap_pi ( sk ) -> dcid ) ; req. scid = cpu_to_le16 ( l2cap_pi ( sk ) -> scid ) ; l2cap_send_cmd ( conn, l2cap_get_ident ( conn ), L2CAP_DISCONN_REQ, sizeof ( req ), & req ) ; } goto done ; } if ( flags & 0x01 ) goto done ; l2cap_pi ( sk ) -> conf_state |= L2CAP_CONF_INPUT_

Fix:
<S2SV_ModStart> : if ( l2cap_pi ( sk ) -> num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP ) { int len = cmd -> len - sizeof ( * rsp ) ; char req [ 64 ] ; result = L2CAP_CONF_SUCCESS ; len = l2cap_parse_conf_rsp ( sk, rsp -> data, len, req, & result ) ; if ( len < 0 ) { struct l2cap_disconn_req req ; req. dcid = cpu_to_le16 ( l2cap_pi ( sk ) -> dcid ) ; req. scid = cpu_to_le16 ( l2cap_pi ( sk ) -> scid ) <S2SV_ModEnd> ; l2cap_send_cmd ( <S2SV_ModStart> conn ), L2CAP_DISCONN_REQ, sizeof ( req ), & <S2SV_ModEnd> req ) ; <S2SV_ModStart> ; goto done ; } l2cap_send_cmd ( conn, l2cap_get_ident ( conn ), L2CAP_CONF_REQ, len, req ) ; l2cap_pi ( sk ) -> num_conf_req ++ ; if ( result!= L2CAP_
Buggy code:
 <START_BUG> static void <END_BUG> horAcc8 ( TIFF * tif, uint8 * cp0, tmsize_t cc ) { tmsize_t stride = PredictorState ( tif ) -> stride ; unsigned char * cp = ( unsigned char * ) cp0 ;  assert ( ( cc % stride ) == 0 ) ; <START_BUG> if ( cc > stride ) { if ( stride == 3 ) { unsigned int cr = cp [ 0 ] ; unsigned int cg = cp [ 1 ] ; unsigned int cb = cp [ 2 ] ; cc -= 3 ; cp += 3 ; while ( cc > 0 ) { cp [ 0 ] = ( unsigned char ) ( ( cr += cp [ 0 ] ) & 0xff ) ; cp [ 1 ] = ( unsigned char ) ( ( cg += cp [ 1 ] ) & 0xff ) ; cp [ 2 ] = ( unsigned char ) ( ( cb += cp [ 2 ] ) & 0xff ) ; cc -= 3 ; cp += 3 ; } } else if ( stride == 4 ) { unsigned int cr = cp [ 0 ] ; unsigned int cg = cp [ 1 ] ; unsigned int cb = cp [ 2 ] ; unsigned int ca = cp [ 3 ] ; cc -= 4 ; cp += 4 ; while ( cc > 0 ) { cp [ 0 ] = ( unsigned char ) ( ( cr += cp [ 0 ] ) & 0xff ) ; cp [ 1 ] = ( unsigned char ) ( ( cg += cp [ 1 ] ) & 0xff ) ; cp [ 2 ] = ( unsigned char ) ( ( cb += cp [ 2 ] ) & 0xff ) ; cp [ 3 ] = ( unsigned char ) ( ( ca += cp [ 3 ] ) & 0xff ) ; cc -= 4 ; cp += 4 ; } } else { cc -= stride ; do { REPEAT4 ( stride, cp [ stride ] = ( unsigned char ) ( ( cp [ stride ] + * cp ) & 0xff ) ; cp ++ ) cc -= stride ; } while ( cc > 0 ) ; } } <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> horAcc8 ( TIFF <S2SV_ModStart> ) cp0 ; if <S2SV_ModEnd> ( ( cc <S2SV_ModStart> % stride )!= 0 ) { TIFFErrorExt ( tif -> tif_clientdata, "horAcc8", "%s", "(cc%stride)!=0" ) ; return 0 ; } <S2SV_ModEnd> if ( cc <S2SV_ModStart> ; } } return 1 ;
Buggy code:
 int ip6_append_data ( struct sock * sk, int getfrag ( void * from, char * to, int offset, int len, int odd, struct sk_buff * skb ), void * from, int length, int transhdrlen, int hlimit, int tclass, struct ipv6_txoptions * opt, struct flowi6 * fl6, struct rt6_info * rt, unsigned int flags, int dontfrag ) { struct inet_sock * inet = inet_sk ( sk ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct inet_cork * cork ; struct sk_buff * skb ; unsigned int maxfraglen, fragheaderlen ; int exthdrlen ; int hh_len ; int mtu ; int copy ; int err ; int offset = 0 ; int csummode = CHECKSUM_NONE ; __u8 tx_flags = 0 ; if ( flags & MSG_PROBE ) return 0 ; cork = & inet -> cork. base ; if ( skb_queue_empty ( & sk -> sk_write_queue ) ) { if ( opt ) { if ( WARN_ON ( np -> cork. opt ) ) return - EINVAL ; np -> cork. opt = kmalloc ( opt -> tot_len, sk -> sk_allocation ) ; if ( unlikely ( np -> cork. opt == NULL ) ) return - ENOBUFS ; np -> cork. opt -> tot_len = opt -> tot_len ; np -> cork. opt -> opt_flen = opt -> opt_flen ; np -> cork. opt -> opt_nflen = opt -> opt_nflen ; np -> cork. opt -> dst0opt = ip6_opt_dup ( opt -> dst0opt, sk -> sk_allocation ) ; if ( opt -> dst0opt &&! np -> cork. opt -> dst0opt ) return - ENOBUFS ; np -> cork. opt -> dst1opt = ip6_opt_dup ( opt -> dst1opt, sk -> sk_allocation ) ; if ( opt -> dst1opt &&! np -> cork. opt -> dst1opt ) return - ENOBUFS ; np -> cork. opt -> hopopt = ip6_opt_dup ( opt -> hopopt, sk

Fix:
<S2SV_ModStart> mtu, flags, rt
Buggy code:
 static vpx_codec_err_t vp8_set_decryptor ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctrl_id, <END_BUG> va_list args ) {  vp8_decrypt_init * init = va_arg ( args, vp8_decrypt_init * ) ; <START_BUG> if ( init ) { ctx -> decrypt_cb = init -> decrypt_cb ; ctx -> decrypt_state = init -> decrypt_state ; } else { ctx -> decrypt_cb = NULL ; ctx -> decrypt_state = NULL ; } return VPX_CODEC_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> args ) { vpx_decrypt_init <S2SV_ModEnd> * init = <S2SV_ModStart> ( args, vpx_decrypt_init <S2SV_ModEnd> * ) ;
Buggy code:
 int vp8_refining_search_sad_c ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int error_per_bit, int search_range, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { MV neighbors [ 4 ] = { { - 1, 0 }, { 0, - 1 }, { 0, 1 }, { 1, 0 } } ; int i, j ; short this_row_offset, this_col_offset ; int what_stride = b -> src_stride ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; unsigned char * best_address = ( unsigned char * ) ( base_pre + d -> offset + ( ref_mv -> as_mv. row * pre_stride ) + ref_mv -> as_mv. col ) ; unsigned char * check_here ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; bestsad = fn_ptr -> sdf ( what, what_stride, best_address, <START_BUG> in_what_stride, UINT_MAX ) <END_BUG> + mvsad_err_cost ( ref_mv, & fcenter_mv, mvsadcost, error_per_bit ) ; for ( i = 0 ; i < search_range ; i ++ ) { int best_site = - 1 ; for ( j = 0 ; j < 4 ; j ++ ) { this_row_offset = ref_mv -> as_mv. row +

Fix:
<S2SV_ModStart> best_address, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; if
Buggy code:
 static struct task_struct * copy_process ( unsigned long clone_flags, unsigned long stack_start, struct pt_regs * regs, unsigned long stack_size, int __user * child_tidptr, struct pid * pid, int trace ) { int retval ; struct task_struct * p ; int cgroup_callbacks_done = 0 ; if ( ( clone_flags & ( CLONE_NEWNS | CLONE_FS ) ) == ( CLONE_NEWNS | CLONE_FS ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_THREAD ) &&! ( clone_flags & CLONE_SIGHAND ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_SIGHAND ) &&! ( clone_flags & CLONE_VM ) ) return ERR_PTR ( - EINVAL ) ; if ( ( clone_flags & CLONE_PARENT ) && current -> signal -> flags & SIGNAL_UNKILLABLE ) return ERR_PTR ( - EINVAL ) ; retval = security_task_create ( clone_flags ) ; if ( retval ) goto fork_out ; retval = - ENOMEM ; p = dup_task_struct ( current ) ; if (! p ) goto fork_out ; ftrace_graph_init_task ( p ) ; rt_mutex_init_task ( p ) ; # ifdef CONFIG_PROVE_LOCKING DEBUG_LOCKS_WARN_ON (! p -> hardirqs_enabled ) ; DEBUG_LOCKS_WARN_ON (! p -> softirqs_enabled ) ; # endif retval = - EAGAIN ; if ( atomic_read ( & p -> real_cred -> user -> processes ) >= p -> signal -> rlim [ RLIMIT_NPROC ]. rlim_cur ) { if (! capable ( CAP_SYS_ADMIN ) &&! capable ( CAP_SYS_RESOURCE ) && p -> real_cred -> user!= INIT_USER ) goto bad_fork_free ; } retval = copy_creds ( p, clone_flags ) ; if ( retval < 0 ) goto bad_fork_free ; retval = - EAGAIN ; if ( nr_threads >= max_threads ) goto bad_fork_cleanup_count ; if (! try_module_get ( task_

Fix:
<S2SV_ModStart> ; bad_fork_cleanup_io : if <S2SV_ModEnd> ( p -> <S2SV_ModStart> p -> io_context ) exit_io_context ( p
Buggy code:
 static int rose_parse_ccitt ( unsigned char * p, struct rose_facilities_struct * facilities, int len ) { unsigned char l, n = 0 ; char callsign [ 11 ] ; do { switch ( * p & 0xC0 ) { case 0x00 : <START_BUG> p += 2 ; <END_BUG> n += 2 ; len -= 2 ; break ; case 0x40 :  p += 3 ; <START_BUG> n += 3 ; len -= 3 ; break ; case 0x80 : <END_BUG> p += 4 ;  n += 4 ; len -= 4 ; break ; case 0xC0 : <START_BUG> l = p [ 1 ] ; <END_BUG> if ( l < 10 || l > 20 ) return - 1 ; if ( * p == FAC_CCITT_DEST_NSAP ) { memcpy ( & facilities -> source_addr, p + 7, ROSE_ADDR_LEN ) ; memcpy ( callsign, p + 12, l - 10 ) ; callsign [ l - 10 ] = '\\0' ; asc2ax ( & facilities -> source_call, callsign ) ; } if ( * p == FAC_CCITT_SRC_NSAP ) { memcpy ( & facilities -> dest_addr, p + 7, ROSE_ADDR_LEN ) ; memcpy ( callsign, p + 12, l - 10 ) ; callsign [ l - 10 ] = '\\0' ; asc2ax ( & facilities -> dest_call, callsign ) ; } p += l + 2 ; n += l + 2 ; len -= l + 2 ; break ; } } while ( * p!= 0x00 && len > 0 ) ; return n ; }

Fix:
<S2SV_ModStart> case 0x00 : if ( len < 2 ) return - 1 ; <S2SV_ModStart> case 0x40 : if ( len < 3 ) return - 1 ; <S2SV_ModStart> case 0x80 : if ( len < 4 ) return - 1 ; <S2SV_ModStart> case 0xC0 : if ( len < 2 ) return - 1 ;
Buggy code:
 static void processCertificateElements ( struct ndpi_detection_module_struct * ndpi_struct, struct ndpi_flow_struct * flow, u_int16_t p_offset, u_int16_t certificate_len ) { struct ndpi_packet_struct * packet = & flow -> packet ; u_int num_found = 0, i ; <START_BUG> char buffer [ 64 ] = { '\\0' }, rdnSeqBuf [ 1024 ] = { '\\0' } ; <END_BUG> u_int rdn_len = 0 ; # ifdef DEBUG_TLS printf ( "[TLS]   %s()   [offset:   %u][certificate_len:   %u]\\n", __FUNCTION__, p_offset, certificate_len ) ; # endif for ( i = p_offset ; i < certificate_len ; i ++ ) { if ( ( packet -> payload [ i ] == 0x55 ) && ( packet -> payload [ i + 1 ] == 0x04 ) && ( packet -> payload [ i + 2 ] == 0x03 ) ) { int rc = extractRDNSequence ( packet, i, buffer, sizeof ( buffer ), rdnSeqBuf, & rdn_len, sizeof ( rdnSeqBuf ), "CN" ) ; if ( rc == - 1 ) break ; # ifdef DEBUG_TLS printf ( "[TLS]   %s()   [%s][%s:   %s]\\n", __FUNCTION__, ( num_found == 0 )? "Subject" : "Issuer", "Common   Name", buffer ) ; # endif } else if ( ( packet -> payload [ i ] == 0x55 ) && ( packet -> payload [ i + 1 ] == 0x04 ) && ( packet -> payload [ i + 2 ] == 0x06 ) ) { int rc = extractRDNSequence ( packet, i, buffer, sizeof ( buffer ), rdnSeqBuf, & rdn_len, sizeof ( rdnSeqBuf ), "C" ) ; if ( rc == - 1 ) break ; # ifdef DEBUG_TLS printf ( "[TLS]   %s()   [%s][%s:   %s]\\n", __FUNCTION__, ( num_found == 0 )? "Subject" : "Issuer", "Country", buffer ) ; # endif } else if

Fix:
<S2SV_ModStart>, rdnSeqBuf [ 2048 <S2SV_ModEnd> ] = {
Buggy code:
 FepClient * fep_client_open ( const char * address ) { FepClient * client ; struct sockaddr_un sun ; ssize_t sun_len ; int retval ; if (! address ) address = getenv ( "LIBFEP_CONTROL_SOCK" ) ; if (! address ) return NULL ; if ( strlen ( address ) + 1 >= sizeof ( sun. sun_path ) ) { fep_log ( FEP_LOG_LEVEL_WARNING, "unix   domain   socket   path   too   long:   %d   +   1   >=   %d", strlen ( address ), sizeof ( sun. sun_path ) ) ; free ( address ) ; return NULL ; } client = xzalloc ( sizeof ( FepClient ) ) ; client -> filter_running = false ; client -> messages = NULL ; memset ( & sun, 0, sizeof ( struct sockaddr_un ) ) ; sun. sun_family = AF_UNIX ; <START_BUG> # ifdef __linux__ <END_BUG>  sun. sun_path [ 0 ] = '\\0' ; <START_BUG> memcpy ( sun. sun_path + 1, address, strlen ( address ) ) ; <END_BUG> sun_len = offsetof ( struct sockaddr_un, sun_path ) + strlen ( address ) + 1 ;  # else memcpy ( sun. sun_path, address, strlen ( address ) ) ; sun_len = sizeof ( struct sockaddr_un ) ; # endif client -> control = socket ( AF_UNIX, SOCK_STREAM, 0 ) ; if ( client -> control < 0 ) { free ( client ) ; return NULL ; } retval = connect ( client -> control, ( const struct sockaddr * ) & sun, sun_len ) ; if ( retval < 0 ) { close ( client -> control ) ; free ( client ) ; return NULL ; } return client ; }

Fix:
<S2SV_ModStart> = AF_UNIX ; memcpy ( <S2SV_ModEnd> sun. sun_path <S2SV_ModStart> sun. sun_path <S2SV_ModEnd>, address, <S2SV_ModStart> ; sun_len = sizeof <S2SV_ModEnd> ( struct sockaddr_un <S2SV_ModStart> ( struct sockaddr_un ) ; <S2SV_ModEnd> client -> control
Buggy code:
 static vpx_codec_err_t decoder_destroy ( vpx_codec_alg_priv_t * ctx ) { <START_BUG> if ( ctx -> pbi ) { <END_BUG> vp9_decoder_remove ( ctx -> pbi ) ;  ctx -> pbi = NULL ; <START_BUG> } vpx_free ( ctx ) ; return VPX_CODEC_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> ( ctx -> frame_workers!= NULL ) { int i ; for ( i = 0 ; i < ctx -> num_frame_workers ; ++ i ) { VPxWorker * const worker = & ctx -> frame_workers [ i ] ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; vpx_get_worker_interface ( ) -> end ( worker ) ; vp9_remove_common ( & frame_worker_data -> pbi -> common ) ; # if CONFIG_VP9_POSTPROC vp9_free_postproc_buffers ( & frame_worker_data -> pbi -> common ) ; # endif vp9_decoder_remove ( frame_worker_data <S2SV_ModEnd> -> pbi ) <S2SV_ModStart> pbi ) ; vpx_free ( frame_worker_data -> scratch_buffer ) ; # if CONFIG_MULTITHREAD pthread_mutex_destroy ( & frame_worker_data -> stats_mutex ) ; pthread_cond_destroy ( & frame_worker_data -> stats_cond ) ; # endif vpx_free ( frame_worker_data ) ; } # if CONFIG_MULTITHREAD pthread_mutex_
Buggy code:
 struct dst_entry * inet_csk_route_req ( struct sock * sk, const struct request_sock * req ) { struct rtable * rt ; const struct inet_request_sock * ireq = inet_rsk ( req ) ; <START_BUG> struct ip_options * opt = inet_rsk ( req ) -> opt ; <END_BUG> struct net * net = sock_net ( sk ) ; struct flowi4 fl4 ; flowi4_init_output ( & fl4, sk -> sk_bound_dev_if, sk -> sk_mark, RT_CONN_FLAGS ( sk ), RT_SCOPE_UNIVERSE, sk -> sk_protocol, inet_sk_flowi_flags ( sk ),  ( opt && opt -> srr )? opt -> faddr : ireq -> rmt_addr, <START_BUG> ireq -> loc_addr, ireq -> rmt_port, inet_sk ( sk ) -> inet_sport ) ; security_req_classify_flow ( req, flowi4_to_flowi ( & fl4 ) ) ; rt = ip_route_output_flow ( net, & fl4, sk ) ; if ( IS_ERR ( rt ) ) goto no_route ; <END_BUG> if ( opt && opt -> is_strictroute && rt -> rt_dst!= rt -> rt_gateway )  goto route_err ; return & rt -> dst ; route_err : ip_rt_put ( rt ) ; no_route : IP_INC_STATS_BH ( net, IPSTATS_MIB_OUTNOROUTES ) ; return NULL ; }

Fix:
<S2SV_ModStart> ) ; struct ip_options_rcu <S2SV_ModEnd> * opt = <S2SV_ModStart> && opt -> opt. <S2SV_ModStart>? opt -> opt. <S2SV_ModStart> && opt -> opt.
Buggy code:
 int cdc_parse_cdc_header ( struct usb_cdc_parsed_header * hdr, struct usb_interface * intf, u8 * buffer, int buflen ) { struct usb_cdc_union_desc * union_header = NULL ; struct usb_cdc_header_desc * header = NULL ; struct usb_cdc_ether_desc * ether = NULL ; struct usb_cdc_mdlm_detail_desc * detail = NULL ; struct usb_cdc_mdlm_desc * desc = NULL ; unsigned int elength ; int cnt = 0 ; memset ( hdr, 0x00, sizeof ( struct usb_cdc_parsed_header ) ) ; hdr -> phonet_magic_present = false ; while ( buflen > 0 ) { elength = buffer [ 0 ] ; if (! elength ) { dev_err ( & intf -> dev, "skipping   garbage   byte\\n" ) ; elength = 1 ; <START_BUG> goto next_desc ; <END_BUG> } if ( buffer [ 1 ]!= USB_DT_CS_INTERFACE ) { dev_err ( & intf -> dev, "skipping   garbage\\n" ) ; goto next_desc ; } switch ( buffer [ 2 ] ) { case USB_CDC_UNION_TYPE : if ( elength < sizeof ( struct usb_cdc_union_desc ) ) goto next_desc ; if ( union_header ) { dev_err ( & intf -> dev, "More   than   one   union   descriptor,   skipping  ...\\n" ) ; goto next_desc ; } union_header = ( struct usb_cdc_union_desc * ) buffer ; break ; case USB_CDC_COUNTRY_TYPE : if ( elength < sizeof ( struct usb_cdc_country_functional_desc ) ) goto next_desc ; hdr -> usb_cdc_country_functional_desc = ( struct usb_cdc_country_functional_desc * ) buffer ; break ; case USB_CDC_HEADER_TYPE : if ( elength!= sizeof ( struct usb_cdc_header_desc ) ) goto next_desc ; if ( header ) return - EINVAL ; header = ( struct usb_cdc_header_desc * ) buffer ; break ; case USB_

Fix:
<S2SV_ModStart> ; goto next_desc ; } if ( ( buflen < elength ) || ( elength < 3 ) ) { dev_err ( & intf -> dev, "invalid <S2SV_blank> descriptor <S2SV_blank> buffer <S2SV_blank> length\\n" ) ; break
Buggy code:
 <START_BUG> static void write_partition ( VP9_COMMON * cm, MACROBLOCKD * xd, <END_BUG> int hbs, int mi_row, int mi_col,  PARTITION_TYPE p, BLOCK_SIZE bsize, vp9_writer * w ) { <START_BUG> const int ctx = partition_plane_context ( xd, mi_row, mi_col, bsize ) ; <END_BUG> const vp9_prob * const probs = get_partition_probs ( cm, ctx ) ;  const int has_rows = ( mi_row + hbs ) < cm -> mi_rows ; const int has_cols = ( mi_col + hbs ) < cm -> mi_cols ; if ( has_rows && has_cols ) { vp9_write_token ( w, vp9_partition_tree, probs, & partition_encodings [ p ] ) ; } else if (! has_rows && has_cols ) { assert ( p == PARTITION_SPLIT || p == PARTITION_HORZ ) ; <START_BUG> vp9_write ( w, p == PARTITION_SPLIT, probs [ 1 ] ) ; <END_BUG> } else if ( has_rows &&! has_cols ) { assert ( p == PARTITION_SPLIT || p == PARTITION_VERT ) ;  vp9_write ( w, p == PARTITION_SPLIT, probs [ 2 ] ) ; <START_BUG> } else { assert ( p == PARTITION_SPLIT ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> void write_partition ( const VP9_COMMON * const cm, const MACROBLOCKD * const <S2SV_ModEnd> xd, int <S2SV_ModStart> BLOCK_SIZE bsize, vpx_writer <S2SV_ModEnd> * w ) <S2SV_ModStart> ) ; const vpx_prob * const probs = xd -> partition_probs [ ctx ] <S2SV_ModEnd> ; const int <S2SV_ModStart> PARTITION_HORZ ) ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> PARTITION_VERT ) ; vpx_write <S2SV_ModEnd> ( w,
Buggy code:
 <START_BUG> static void calc_segtree_probs ( int * segcounts, vp9_prob * segment_tree_probs ) { <END_BUG> const int c01 = segcounts [ 0 ] + segcounts [ 1 ] ; const int c23 = segcounts [ 2 ] + segcounts [ 3 ] ; const int c45 = segcounts [ 4 ] + segcounts [ 5 ] ; const int c67 = segcounts [ 6 ] + segcounts [ 7 ] ; segment_tree_probs [ 0 ] = get_binary_prob ( c01 + c23, c45 + c67 ) ; segment_tree_probs [ 1 ] = get_binary_prob ( c01, c23 ) ; segment_tree_probs [ 2 ] = get_binary_prob ( c45, c67 ) ; segment_tree_probs [ 3 ] = get_binary_prob ( segcounts [ 0 ], segcounts [ 1 ] ) ; segment_tree_probs [ 4 ] = get_binary_prob ( segcounts [ 2 ], segcounts [ 3 ] ) ; segment_tree_probs [ 5 ] = get_binary_prob ( segcounts [ 4 ], segcounts [ 5 ] ) ; segment_tree_probs [ 6 ] = get_binary_prob ( segcounts [ 6 ], segcounts [ 7 ] ) ; }

Fix:
<S2SV_ModStart> * segcounts, vpx_prob <S2SV_ModEnd> * segment_tree_probs )
Buggy code:
 struct file * get_empty_filp ( void ) { const struct cred * cred = current_cred ( ) ; static long old_max ; struct file * f ; int error ; if ( get_nr_files ( ) >= files_stat. max_files &&! capable ( CAP_SYS_ADMIN ) ) { if ( percpu_counter_sum_positive ( & nr_files ) >= files_stat. max_files ) goto over ; } f = kmem_cache_zalloc ( filp_cachep, GFP_KERNEL ) ; if ( unlikely (! f ) ) return ERR_PTR ( - ENOMEM ) ; percpu_counter_inc ( & nr_files ) ; f -> f_cred = get_cred ( cred ) ; error = security_file_alloc ( f ) ; if ( unlikely ( error ) ) { file_free ( f ) ; return ERR_PTR ( error ) ; } <START_BUG> INIT_LIST_HEAD ( & f -> f_u. fu_list ) ; <END_BUG> atomic_long_set ( & f -> f_count, 1 ) ; rwlock_init ( & f -> f_owner. lock ) ; spin_lock_init ( & f -> f_lock ) ; eventpoll_init_file ( f ) ; return f ; over : if ( get_nr_files ( ) > old_max ) { pr_info ( "VFS:   file-max   limit   %lu   reached\\n", get_max_files ( ) ) ; old_max = get_nr_files ( ) ; } return ERR_PTR ( - ENFILE ) ; }

Fix:
<S2SV_ModStart> ) ; } <S2SV_ModEnd> atomic_long_set ( &
Buggy code:
 int ImagingFliDecode ( Imaging im, ImagingCodecState state, UINT8 * buf, int bytes ) { UINT8 * ptr ; int framesize ; int c, chunks ; int l, lines ; int i, j, x = 0, y, ymax ; if ( bytes < 4 ) return 0 ; ptr = buf ; framesize = I32 ( ptr ) ; if ( framesize < I32 ( ptr ) ) return 0 ; if ( I16 ( ptr + 4 )!= 0xF1FA ) { state -> errcode = IMAGING_CODEC_UNKNOWN ; return - 1 ; } chunks = I16 ( ptr + 6 ) ; ptr += 16 ; for ( c = 0 ; c < chunks ; c ++ ) { UINT8 * data = ptr + 6 ; switch ( I16 ( ptr + 4 ) ) { case 4 : case 11 : break ; case 7 : lines = I16 ( data ) ; data += 2 ; for ( l = y = 0 ; l < lines && y < state -> ysize ; l ++, y ++ ) { UINT8 * buf = ( UINT8 * ) im -> image [ y ] ; int p, packets ; packets = I16 ( data ) ; data += 2 ; while ( packets & 0x8000 ) { if ( packets & 0x4000 ) { y += 65536 - packets ; if ( y >= state -> ysize ) { state -> errcode = IMAGING_CODEC_OVERRUN ; return - 1 ; } buf = ( UINT8 * ) im -> image [ y ] ; } else { buf [ state -> xsize - 1 ] = ( UINT8 ) packets ; } packets = I16 ( data ) ; data += 2 ; } for ( p = x = 0 ; p < packets ; p ++ ) { x += data [ 0 ] ; if ( data [ 1 ] >= 128 ) { i = 256 - data [ 1 ] ; if ( x + i + i > state -> xsize ) break ; for ( j = 0 ; j < i ; j ++ ) { buf [ x ++ ] = data [ 2 ] ; buf [ x ++ ] = data [ 3 ] ; } data += 2 + 2 ; } else { i = 2 * ( int ) data [ 1 ] ; if ( x + i > state -> xsize ) break ; memcpy ( buf + x, data + 2, i ) ; data += 2

Fix:
<S2SV_ModStart> memcpy ( buf <S2SV_ModEnd>, data,
Buggy code:
 static int ras_getcmap ( jas_stream_t * in, ras_hdr_t * hdr, ras_cmap_t * cmap ) { int i ; int j ; int x ; int c ; int numcolors ; int actualnumcolors ; switch ( hdr -> maptype ) { case RAS_MT_NONE : break ; case RAS_MT_EQUALRGB : { jas_eprintf ( "warning:   palettized   images   not   fully   supported\\n" ) ; numcolors = 1 << hdr -> depth ; <START_BUG> assert ( numcolors <= RAS_CMAP_MAXSIZ ) ; <END_BUG> actualnumcolors = hdr -> maplength // 3 ; for ( i = 0 ; i < numcolors ; i ++ ) { cmap -> data [ i ] = 0 ; } if ( ( hdr -> maplength % 3 ) || hdr -> maplength < 0 || hdr -> maplength > 3 * numcolors ) { return - 1 ; } for ( i = 0 ; i < 3 ; i ++ ) { for ( j = 0 ; j < actualnumcolors ; j ++ ) { if ( ( c = jas_stream_getc ( in ) ) == EOF ) { return - 1 ; } x = 0 ; switch ( i ) { case 0 : x = RAS_RED ( c ) ; break ; case 1 : x = RAS_GREEN ( c ) ; break ; case 2 : x = RAS_BLUE ( c ) ; break ; } cmap -> data [ j ] |= x ; } } } break ; default : return - 1 ; break ; } return 0 ; }

Fix:
<S2SV_ModStart> -> depth ; if ( numcolors > RAS_CMAP_MAXSIZ ) { return - 1 ; } <S2SV_ModEnd> actualnumcolors = hdr
Buggy code:
 int obj2ast_mod ( PyObject * obj, mod_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) Module_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { <START_BUG> asdl_seq * body ; <END_BUG> if ( _PyObject_LookupAttrId ( obj, & PyId_body, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL ) { PyErr_SetString ( PyExc_TypeError, "required   field   \\"body\\"   missing   from   Module" ) ; return 1 ; } else { int res ; Py_ssize_t len ; Py_ssize_t i ; if (! PyList_Check ( tmp ) ) { PyErr_Format ( PyExc_TypeError, "Module   field   \\"body\\"   must   be   a   list,   not   a   %.200s", tmp -> ob_type -> tp_name ) ; goto failed ; } len = PyList_GET_SIZE ( tmp ) ; body = _Py_asdl_seq_new ( len, arena ) ; if ( body == NULL ) goto failed ; for ( i = 0 ; i < len ; i ++ ) { stmt_ty val ; res = obj2ast_stmt ( PyList_GET_ITEM ( tmp, i ), & val, arena ) ; if ( res!= 0 ) goto failed ; if ( len!= PyList_GET_SIZE ( tmp ) ) { PyErr_SetString ( PyExc_RuntimeError, "Module   field   \\"body\\"   changed   size   during   iteration" ) ; goto failed ; } asdl_seq_SET ( body, i, val ) ; } Py_CLEAR ( tmp ) ; }  * out = Module ( body, arena ) ; <START_BUG> if ( * out == NULL ) goto failed ; return 0 ; } <END_BUG> isinstance = PyObject_IsInstance ( obj, ( PyObject * ) Interactive_type ) ;  if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { asdl_seq * body ; if ( _PyObject_Lookup

Fix:
<S2SV_ModStart> asdl_seq * body ; asdl_seq * type_ignores <S2SV_ModStart> ) ; } if ( _PyObject_LookupAttrId <S2SV_ModEnd> ( obj, <S2SV_ModStart> ( obj, & PyId_type_ignores <S2SV_ModEnd>, & tmp <S2SV_ModStart> ( PyExc_TypeError, "required <S2SV_blank> field <S2SV_blank> \\"type_ignores\\" <S2SV_blank> missing <S2SV_blank> from <S2SV_blank> Module" <S2SV_ModEnd> ) ; return <S2SV_ModStart> ( PyExc_TypeError, "Module <S2SV_blank> field <S2SV_blank> \\"type_ignores\\" <S2SV_blank> must <S2SV_blank> be <S2SV_blank> a <S2SV_blank> list, <S2SV_blank> not <S2SV_blank> a <S2SV_blank> %.200s" <S2SV_ModEnd>, tmp -> <S2SV_ModStart> tmp ) ; type_ignores <S2SV_ModEnd> = _Py_asdl_seq_new ( <S2SV_ModStart> ; if ( type_ignores <S2SV_ModEnd> == NULL ) <S2SV_ModStart> ++ ) { type_ignore_ty <S2SV_ModEnd> val ; res <S2SV_ModStart> ; res = obj2ast_type_ignore <S2SV_ModEnd> ( PyList_GET_ITEM ( <S2SV_ModStart> ( PyExc_RuntimeError, "Module <S2SV_blank> field <S2SV_blank> \\"type_ignores\\" <S2SV_blank> changed <S2SV_blank> size <S2SV_blank> during <S2SV_blank> iteration" <S2SV_ModEnd> ) ; goto <S2SV_ModStart> } asdl_seq_SET ( type_ignores <S2SV_ModEnd>, i, <S2SV_ModStart> * out = Module ( body, type_ignores <S2SV_ModEnd>, arena ) <S2SV_ModStart> Py
Buggy code:
 static int smtp_mailaddr ( struct mailaddr * maddr, char * line, int mailfrom, char * * args, const char * domain ) { char * p, * e ; if ( line == NULL ) return ( 0 ) ; if ( * line!= '<' ) return ( 0 ) ; e = strchr ( line, '>' ) ; if ( e == NULL ) return ( 0 ) ; * e ++ = '\\0' ; while ( * e ==' ') e ++ ; * args = e ; if (! text_to_mailaddr ( maddr, line + 1 ) ) return ( 0 ) ; p = strchr ( maddr -> user, ':' ) ; if ( p!= NULL ) { p ++ ; memmove ( maddr -> user, p, strlen ( p ) + 1 ) ; } <START_BUG> if (! valid_localpart ( maddr -> user ) || <END_BUG> ! valid_domainpart ( maddr -> domain ) ) { <START_BUG> if ( mailfrom && maddr -> user [ 0 ] == '\\0' && maddr -> domain [ 0 ] == '\\0' ) return ( 1 ) ; if ( maddr -> user [ 0 ] == '\\0' ) return ( 0 ) ; if ( maddr -> domain [ 0 ] == '\\0' ) { ( void ) strlcpy ( maddr -> domain, domain, sizeof ( maddr -> domain ) ) ; return ( 1 ) ; } return ( 0 ) ; } return ( 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> } if ( mailfrom && maddr -> user [ 0 ] == '\\0' && maddr -> domain [ 0 ] == '\\0' ) return ( 1 ) ; if ( maddr -> user [ 0 ] == '\\0' || <S2SV_ModStart> -> user ) ) return ( 0 ) ; if ( maddr -> domain [ 0 ] == '\\0' ) { ( void ) strlcpy ( maddr -> domain, domain, sizeof ( maddr -> domain ) ) ; } if ( <S2SV_ModEnd>! valid_domainpart ( <S2SV_ModStart> domain ) ) return ( 0 ) ; <S2SV_ModEnd> return ( 1
Buggy code:
 static void llc_sap_rcv ( struct llc_sap * sap, struct sk_buff * skb, struct sock * sk ) { struct llc_sap_state_ev * ev = llc_sap_ev ( skb ) ; ev -> type = LLC_SAP_EV_TYPE_PDU ; ev -> reason = 0 ; <START_BUG> skb -> sk = sk ; <END_BUG> llc_sap_state_process ( sap, skb ) ; }

Fix:
<S2SV_ModStart> = 0 ; skb_orphan ( skb ) ; sock_hold ( sk ) ; <S2SV_ModStart> sk = sk ; skb -> destructor = sock_efree
Buggy code:
 static int hns_xgmac_get_sset_count ( int stringset ) { <START_BUG> if ( stringset == ETH_SS_STATS ) <END_BUG> return ARRAY_SIZE ( g_xgmac_stats_string ) ; return 0 ; }

Fix:
<S2SV_ModStart> stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS