nus-yam/ex-repair huggingface dataset:
Buggy code:
 void vp9_rtcd ( ) { <START_BUG> vpx_scale_rtcd ( ) ; <END_BUG> once ( setup_rtcd_internal ) ; }

Fix:
<S2SV_ModStart> ( ) { <S2SV_ModEnd> once ( setup_rtcd_internal
Buggy code:
 static bool parse_cmdline ( int argc, char * * argv ) { int c ; bool reopen_log = false ; int signum ; struct utsname uname_buf ; int longindex ; int curind ; bool bad_option = false ; <START_BUG> unsigned facility ; <END_BUG> struct option long_options [ ] = { { "use-file", required_argument, NULL, 'f' }, # if defined _WITH_VRRP_ && defined _WITH_LVS_ { "vrrp", no_argument, NULL, 'P' }, { "check", no_argument, NULL, 'C' }, # endif # ifdef _WITH_BFD_ { "no_bfd", no_argument, NULL, 'B' }, # endif { "all", no_argument, NULL, 3 }, { "log-console", no_argument, NULL, 'l' }, { "log-detail", no_argument, NULL, 'D' }, { "log-facility", required_argument, NULL, 'S' }, { "log-file", optional_argument, NULL, 'g' }, { "flush-log-file", no_argument, NULL, 2 }, { "no-syslog", no_argument, NULL, 'G' },  # ifdef _WITH_VRRP_ <START_BUG> { "release-vips", no_argument, NULL, 'X' }, { "dont-release-vrrp", no_argument, NULL, 'V' }, # endif # ifdef _WITH_LVS_ { "dont-release-ipvs", no_argument, NULL, 'I' }, # endif { "dont-respawn", no_argument, NULL, 'R' }, { "dont-fork", no_argument, NULL, 'n' }, { "dump-conf", no_argument, NULL, 'd' }, { "pid", required_argument, NULL, 'p' }, # ifdef _WITH_VRRP_ { "vrrp_pid", required_argument, NULL, 'r' }, # endif # ifdef _WITH_LVS_ { "checkers_pid", required_<END_BUG>

Fix:
<S2SV_ModStart> ; unsigned facility ; mode_t new_umask_val <S2SV_ModStart> 'G' }, { "umask", required_argument, NULL, 'u' }, <S2SV_ModStart>, argv, ":vhlndu:DRS:f:p:i:mM::g::Gt::" <S2SV_ModEnd> # if defined <S2SV_ModStart> break ; case 'u' : new_umask_val = set_umask ( optarg ) ; if ( umask_cmdline ) umask_val = new_umask_val ; break ; case
Buggy code:
 void vp9_update_temporal_layer_framerate ( VP9_COMP * const cpi ) { SVC * const svc = & cpi -> svc ; <START_BUG> const VP9_CONFIG * const oxcf = & cpi -> oxcf ; <END_BUG>  LAYER_CONTEXT * const lc = get_layer_context ( svc ) ; <START_BUG> RATE_CONTROL * const lrc = & lc -> rc ; <END_BUG> const int layer = svc -> temporal_layer_id ;  <START_BUG> lc -> framerate = oxcf -> framerate // oxcf -> ts_rate_decimator [ layer ] ; <END_BUG>  lrc -> av_per_frame_bandwidth = ( int ) ( lc -> target_bandwidth // lc -> framerate ) ; <START_BUG> lrc -> max_frame_bandwidth = cpi -> rc. max_frame_bandwidth ; <END_BUG> if ( layer == 0 ) {  <START_BUG> lc -> avg_frame_size = lrc -> av_per_frame_bandwidth ; <END_BUG> } else { const double prev_layer_framerate =  oxcf -> framerate // oxcf -> ts_rate_decimator [ layer - 1 ] ; <START_BUG> const int prev_layer_target_bandwidth = <END_BUG> oxcf -> ts_target_bitrate [ layer - 1 ] * 1000 ;  lc -> avg_frame_size = ( int ) ( ( lc -> target_bandwidth - prev_layer_target_bandwidth ) // ( lc -> framerate - prev_layer_framerate ) ) ; } }

Fix:
<S2SV_ModStart> svc ; const VP9EncoderConfig <S2SV_ModEnd> * const oxcf <S2SV_ModStart> = get_layer_context ( cpi <S2SV_ModEnd> ) ; RATE_CONTROL <S2SV_ModStart> ; const int st_idx = svc -> spatial_layer_id * svc -> number_temporal_layers + <S2SV_ModEnd> svc -> temporal_layer_id <S2SV_ModStart> -> temporal_layer_id ; const int tl = svc -> temporal_layer_id ; lc -> framerate = cpi <S2SV_ModEnd> -> framerate // <S2SV_ModStart> -> ts_rate_decimator [ tl <S2SV_ModEnd> ] ; lrc <S2SV_ModStart> ; lrc -> avg_frame_bandwidth <S2SV_ModEnd> = ( int <S2SV_ModStart> ; if ( tl <S2SV_ModEnd> == 0 ) <S2SV_ModStart> = lrc -> avg_frame_bandwidth <S2SV_ModEnd> ; } else <S2SV_ModStart> double prev_layer_framerate = cpi <S2SV_ModEnd> -> framerate // <S2SV_ModStart> -> ts_rate_decimator [ tl <S2SV_ModEnd> - 1 ] <S2SV_ModStart> = oxcf -> layer_target_bitrate [ st_idx <S2SV_ModEnd> - 1 ] <S2SV_ModStart> - 1 ] <S2SV_ModEnd> ; lc ->
Buggy code:
 static int rd_cost_mbuv ( MACROBLOCK * mb ) { int b ; int cost = 0 ; MACROBLOCKD * x = & mb -> e_mbd ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; <START_BUG> vpx_memcpy ( & t_above, mb -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, mb -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; for ( b = 16 ; b < 24 ; b ++ ) cost += cost_coeffs ( mb, x -> block + b, PLANE_TYPE_UV, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; return cost ; }<END_BUG>

Fix:
<S2SV_ModStart> * tl ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left
Buggy code:
 int read_fru_area ( struct ipmi_intf * intf, struct fru_info * fru, uint8_t id, uint32_t offset, uint32_t length, uint8_t * frubuf ) { <START_BUG> uint32_t off = offset, tmp, finish ; <END_BUG> struct ipmi_rs * rsp ; struct ipmi_rq req ; uint8_t msg_data [ 4 ] ; if ( offset > fru -> size ) { lprintf ( LOG_ERR, "Read   FRU   Area   offset   incorrect:   %d   >   %d", offset, fru -> size ) ; return - 1 ; } finish = offset + length ; if ( finish > fru -> size ) {  finish = fru -> size ; <START_BUG> lprintf ( LOG_NOTICE, "Read   FRU   Area   length   %d   too   large,   " "Adjusting   to   %d", offset + length, finish - offset ) ; <END_BUG> }  memset ( & req, 0, sizeof ( req ) ) ; req. msg. netfn = IPMI_NETFN_STORAGE ; req. msg. cmd = GET_FRU_DATA ; req. msg. data = msg_data ; req. msg. data_len = 4 ; if ( fru -> max_read_size == 0 ) { uint16_t max_rs_size = ipmi_intf_get_max_response_data_size ( intf ) - 1 ; if ( max_rs_size <= 1 ) { lprintf ( LOG_ERROR, "Maximum   response   size   is   too   small   to   send   " "a   read   request" ) ; return - 1 ; } if ( max_rs_size - 1 > 255 ) { fru -> max_read_size = 255 ; } else { fru -> max_read_size = max_rs_size - 1 ; } if ( fru -> access ) { fru -> max_read_size &= ~ 1 ; } } <START_BUG> do { <END_BUG> tmp = fru -> access? off >> 1 : off ; msg_data [ 0 ] = id ; msg_data [ 1 ] = ( uint8_t ) ( tmp & 0xff ) ; msg_data [ 2 ] = ( uint8_t ) ( tmp >> 8

Fix:
<S2SV_ModStart> off = offset ; uint32_t tmp ; uint32_t finish ; uint32_t size_left_in_buffer <S2SV_ModEnd> ; struct ipmi_rs <S2SV_ModStart> size ) { memset ( frubuf + fru -> size, 0, length - fru -> size ) ; <S2SV_ModStart> offset ) ; length = finish - offset ; <S2SV_ModStart> ; } } size_left_in_buffer = length ; <S2SV_ModStart> 0 ] ; if ( rsp -> data_len < 1 || tmp > rsp -> data_len - 1 || tmp > size_left_in_buffer ) { printf ( " <S2SV_blank> Not <S2SV_blank> enough <S2SV_blank> buffer <S2SV_blank> size" ) ; return - 1 ; } <S2SV_ModStart> += tmp ; size_left_in_buffer -= tmp ;
Buggy code:
 static int xmlParse3986Port ( xmlURIPtr uri, const char * * str ) { const char * cur = * str ; unsigned port = 0 ; if ( ISA_DIGIT ( cur ) ) { while ( ISA_DIGIT ( cur ) ) { port = port * 10 + ( * cur - '0' ) ; cur ++ ; } if ( uri!= NULL ) <START_BUG> uri -> port = port & INT_MAX ; <END_BUG> * str = cur ; return ( 0 ) ; } return ( 1 ) ; }

Fix:
<S2SV_ModStart> = port & USHRT_MAX <S2SV_ModEnd> ; * str
Buggy code:
 static void _isdn_setup ( struct net_device * dev ) { isdn_net_local * lp = netdev_priv ( dev ) ; ether_setup ( dev ) ; dev -> flags = IFF_NOARP | IFF_POINTOPOINT ; <START_BUG> dev -> header_ops = NULL ; <END_BUG> dev -> netdev_ops = & isdn_netdev_ops ; dev -> tx_queue_len = 30 ; lp -> p_encap = ISDN_NET_ENCAP_RAWIP ; lp -> magic = ISDN_NET_MAGIC ; lp -> last = lp ; lp -> next = lp ; lp -> isdn_device = - 1 ; lp -> isdn_channel = - 1 ; lp -> pre_device = - 1 ; lp -> pre_channel = - 1 ; lp -> exclusive = - 1 ; lp -> ppp_slot = - 1 ; lp -> pppbind = - 1 ; skb_queue_head_init ( & lp -> super_tx_queue ) ; lp -> l2_proto = ISDN_PROTO_L2_X75I ; lp -> l3_proto = ISDN_PROTO_L3_TRANS ; lp -> triggercps = 6000 ; lp -> slavedelay = 10 * HZ ; lp -> hupflags = ISDN_INHUP ; lp -> onhtime = 10 ; lp -> dialmax = 1 ; lp -> flags = ISDN_NET_CBHUP | ISDN_NET_DM_MANUAL ; lp -> cbdelay = 25 ; lp -> dialtimeout = - 1 ; lp -> dialwait = 5 * HZ ; lp -> dialstarted = 0 ; lp -> dialwait_timer = 0 ; }

Fix:
<S2SV_ModStart> ; dev -> priv_flags &= ~ IFF_TX_SKB_SHARING ; dev ->
Buggy code:
 static int install_thread_keyring ( void ) { struct cred * new ; int ret ; new = prepare_creds ( ) ; if (! new ) <START_BUG> return - ENOMEM ; <END_BUG> BUG_ON ( new -> thread_keyring ) ; ret = install_thread_keyring_to_cred ( new ) ; if ( ret < 0 ) { abort_creds ( new ) ; return ret ; } return commit_creds ( new ) ; }

Fix:
<S2SV_ModStart> return - ENOMEM <S2SV_ModEnd> ; ret =
Buggy code:
 error_t enc28j60UpdateMacAddrFilter ( NetInterface * interface ) { uint_t i ; uint_t k ; uint32_t crc ; uint8_t hashTable [ 8 ] ; MacFilterEntry * entry ; TRACE_DEBUG ( "Updating   MAC   filter...\\r\\n" ) ; osMemset ( hashTable, 0, sizeof ( hashTable ) ) ; for ( i = 0 ; i < MAC_ADDR_FILTER_SIZE ; i ++ ) { entry = & interface -> macAddrFilter [ i ] ; if ( entry -> refCount > 0 ) { crc = enc28j60CalcCrc ( & entry -> addr, sizeof ( MacAddr ) ) ; k = ( crc >> 23 ) & 0x3F ; hashTable [ k // 8 ] |= ( 1 << ( k % 8 ) ) ; } } <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_EHT0, hashTable [ 0 ] ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_EHT1, hashTable [ 1 ] ) ; <START_BUG> <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_EHT2, hashTable [ 2 ] ) ;  <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_EHT3, hashTable [ 3 ] ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_EHT4, hashTable [ 4 ] ) ; <START_BUG> <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_EHT5, hashTable [ 5 ] ) ;  <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_EHT6, hashTable [ 6 ] ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_EHT7, hashTable [ 7 ] ) ; <START_BUG> <END_BUG> TRACE_DEBUG ( "     EHT0   =   %02" PRIX8 "\\r\\n", enc28j60ReadReg ( interface, ENC28J60_REG_EHT0 ) ) ;  <START_BUG> TRACE_DEBUG ( "     EHT1   =   %02" PRIX8 "\\r\\n", enc28j60ReadReg ( interface,<END_BUG>

Fix:
<S2SV_ModStart> ( interface, ENC28J60_EHT0 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT1 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT2 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT3 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT4 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT5 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT6 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT7 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC28J60_EHT0 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC28J60_EHT1 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC28J60_EHT2 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC28J60_EHT3 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC28J60_EHT4 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC28J60_EHT5 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC28J
Buggy code:
 static int dprintf_formatf ( void * data, int ( * stream ) ( int, FILE * ), const char * format, va_list ap_save ) { const char * digits = lower_digits ; char * f ; int done = 0 ; long param ; long param_num = 0 ; va_stack_t vto [ MAX_PARAMETERS ] ; char * endpos [ MAX_PARAMETERS ] ; char * * end ; char work [ BUFFSIZE ] ; va_stack_t * p ; char * workend = & work [ sizeof ( work ) - 2 ] ; if ( dprintf_Pass1 ( format, vto, endpos, ap_save ) ) return - 1 ; end = & endpos [ 0 ] ; f = ( char * ) format ; while ( * f!= '\\0' ) { int is_alt ; long width ; long prec ; int is_neg ; long base ; mp_uintmax_t num ; mp_intmax_t signed_num ; char * w ; if ( * f!= '%' ) { do { OUTCHAR ( * f ) ; } while ( * ++ f && ( '%'!= * f ) ) ; continue ; } ++ f ; if ( * f == '%' ) { ++ f ; OUTCHAR ( '%' ) ; continue ; } param = dprintf_DollarString ( f, & f ) ; if (! param ) param = param_num ; else -- param ; param_num ++ ; p = & vto [ param ] ; if ( p -> flags & FLAGS_WIDTHPARAM ) { width = ( long ) vto [ p -> width ]. data. num. as_signed ; param_num ++ ; if ( width < 0 ) { width = - width ; p -> flags |= FLAGS_LEFT ; p -> flags &= ~ FLAGS_PAD_NIL ; } } else width = p -> width ; if ( p -> flags & FLAGS_PRECPARAM ) { prec = ( long ) vto [ p -> precision ]. data. num. as_signed ; param_num ++ ; if ( prec < 0 ) prec = - 1 ; } else if ( p -> flags & FLAGS_PREC ) prec = p -> precision ; else prec = - 1 ; is_alt = ( p -> flags & FLAGS_ALT )? 1 : 0 ; switch ( p -> type ) { case FORMAT_INT : num =

Fix:
<S2SV_ModStart> 0 ) { if ( width >= ( long ) sizeof ( work ) ) width = sizeof ( work ) - 1 ; <S2SV_ModStart> 0 ) { size_t maxprec = sizeof ( work ) - 2 ; double val = p -> data. dnum ; while ( val >= 10.0 ) { val //= 10 ; maxprec -- ; } if ( prec > ( long ) maxprec ) prec = maxprec - 1 ; <S2SV_ModStart> dnum ) ; # ifdef CURLDEBUG assert ( strlen ( work ) <= sizeof ( work ) ) ; # endif
Buggy code:
 <START_BUG> static VALUE read_memory ( VALUE klass, VALUE content ) <END_BUG> { xmlRelaxNGParserCtxtPtr ctx = xmlRelaxNGNewMemParserCtxt ( ( const char * ) StringValuePtr ( content ), ( int ) RSTRING_LEN ( content )  ) ; <START_BUG> xmlRelaxNGPtr schema ; <END_BUG> VALUE errors = rb_ary_new ( ) ;  VALUE rb_schema ; xmlSetStructuredErrorFunc ( ( void * ) errors, Nokogiri_error_array_pusher ) ; # ifdef HAVE_XMLRELAXNGSETPARSERSTRUCTUREDERRORS xmlRelaxNGSetParserStructuredErrors ( ctx, Nokogiri_error_array_pusher, ( void * ) errors ) ; # endif schema = xmlRelaxNGParse ( ctx ) ; xmlSetStructuredErrorFunc ( NULL, NULL ) ; xmlRelaxNGFreeParserCtxt ( ctx ) ; if ( NULL == schema ) { xmlErrorPtr error = xmlGetLastError ( ) ; if ( error ) Nokogiri_error_raise ( NULL, error ) ; else rb_raise ( rb_eRuntimeError, "Could   not   parse   document" ) ; return Qnil ; } rb_schema = Data_Wrap_Struct ( klass, 0, dealloc, schema ) ; rb_iv_set ( rb_schema, "@errors", errors ) ; <START_BUG> return rb_schema ; <END_BUG> }

Fix:
<S2SV_ModStart> VALUE read_memory ( int argc, VALUE * argv, VALUE klass ) { VALUE content ; VALUE parse_options ; xmlRelaxNGParserCtxtPtr ctx ; xmlRelaxNGPtr schema ; VALUE errors ; VALUE rb_schema ; int scanned_args = 0 ; scanned_args = rb_scan_args ( argc, argv, "11", & content, & parse_options ) ; if ( scanned_args == 1 ) { parse_options = rb_const_get ( rb_const_get ( mNokogiriXml, rb_intern ( "ParseOptions" ) ), rb_intern ( "DEFAULT_SCHEMA" ) ) ; } ctx <S2SV_ModEnd> = xmlRelaxNGNewMemParserCtxt ( <S2SV_ModStart> ( content ) ) ; <S2SV_ModEnd> errors = rb_ary_new <S2SV_ModStart> rb_ary_new ( ) <S2SV_ModEnd> ; xmlSetStructuredErrorFunc ( <S2SV_ModStart> errors ) ; rb_iv_set ( rb_schema, "@parse_options", parse_options ) ;
Buggy code:
 static int add_push_report_sideband_pkt ( git_push * push, git_pkt_data * data_pkt, git_buf * data_pkt_buf ) { git_pkt * pkt ; const char * line, * line_end ; size_t line_len ; int error ; int reading_from_buf = data_pkt_buf -> size > 0 ; if ( reading_from_buf ) { git_buf_put ( data_pkt_buf, data_pkt -> data, data_pkt -> len ) ; line = data_pkt_buf -> ptr ; line_len = data_pkt_buf -> size ; } else { line = data_pkt -> data ; line_len = data_pkt -> len ; } while ( line_len > 0 ) { error = git_pkt_parse_line ( & pkt, line, & line_end, line_len ) ; if ( error == GIT_EBUFS ) { if (! reading_from_buf ) git_buf_put ( data_pkt_buf, line, line_len ) ; error = 0 ; goto done ; } else if ( error < 0 ) goto done ; line_len -= ( line_end - line ) ; line = line_end ; <START_BUG> if ( pkt == NULL ) <END_BUG> continue ; error = add_push_report_pkt ( push, pkt ) ; git_pkt_free ( pkt ) ; if ( error < 0 && error!= GIT_ITEROVER ) goto done ; } error = 0 ; done : if ( reading_from_buf ) git_buf_consume ( data_pkt_buf, line_end ) ; return error ; }

Fix:
<S2SV_ModStart> = line_end ; <S2SV_ModEnd> error = add_push_report_pkt
Buggy code:
 static int fetch_token_in_cc ( OnigToken * tok, UChar * * src, UChar * end, ScanEnv * env ) { int num ; OnigCodePoint c, c2 ; OnigSyntaxType * syn = env -> syntax ; OnigEncoding enc = env -> enc ; UChar * prev ; UChar * p = * src ; PFETCH_READY ; if ( PEND ) { tok -> type = TK_EOT ; return tok -> type ; } PFETCH ( c ) ; tok -> type = TK_CHAR ; tok -> base = 0 ; tok -> u. c = c ; tok -> escaped = 0 ; if ( c == ']' ) { tok -> type = TK_CC_CLOSE ; } else if ( c == '-' ) { tok -> type = TK_CC_RANGE ; } else if ( c == MC_ESC ( syn ) ) { if (! IS_SYNTAX_BV ( syn, ONIG_SYN_BACKSLASH_ESCAPE_IN_CC ) ) goto end ; if ( PEND ) return ONIGERR_END_PATTERN_AT_ESCAPE ; PFETCH ( c ) ; tok -> escaped = 1 ; tok -> u. c = c ; switch ( c ) { case 'w' : tok -> type = TK_CHAR_TYPE ; tok -> u. prop. ctype = ONIGENC_CTYPE_WORD ; tok -> u. prop. not = 0 ; break ; case 'W' : tok -> type = TK_CHAR_TYPE ; tok -> u. prop. ctype = ONIGENC_CTYPE_WORD ; tok -> u. prop. not = 1 ; break ; case 'd' : tok -> type = TK_CHAR_TYPE ; tok -> u. prop. ctype = ONIGENC_CTYPE_DIGIT ; tok -> u. prop. not = 0 ; break ; case 'D' : tok -> type = TK_CHAR_TYPE ; tok -> u. prop. ctype = ONIGENC_CTYPE_DIGIT ; tok -> u. prop. not = 1 ; break ; case's' : tok -> type = TK_CHAR_TYPE ; tok -> u. prop. ctype = ONIGENC_CTYPE_SPACE ; tok -> u. prop. not = 0 ; break ; case 'S' : tok -> type = TK_CHAR_TYPE ;

Fix:
<S2SV_ModStart> num < 0 || num >= 256
Buggy code:
 static int su3000_power_ctrl ( struct dvb_usb_device * d, int i ) { struct dw2102_state * state = ( struct dw2102_state * ) d -> priv ; <START_BUG> u8 obuf [ ] = { 0xde, 0 } ; <END_BUG> info ( "%s:   %d,   initialized   %d", __func__, i, state -> initialized ) ; if ( i &&! state -> initialized ) {  state -> initialized = 1 ; <START_BUG> <END_BUG> return dvb_usb_generic_rw ( d, obuf, 2, NULL, 0, 0 ) ;  <START_BUG> } <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> -> priv ; int ret = 0 <S2SV_ModEnd> ; info ( <S2SV_ModStart> initialized ) { mutex_lock ( & d -> data_mutex ) ; state -> data [ 0 ] = 0xde ; state -> data [ 1 ] = 0 ; <S2SV_ModStart> = 1 ; ret = <S2SV_ModEnd> dvb_usb_generic_rw ( d <S2SV_ModStart> ( d, state -> data <S2SV_ModEnd>, 2, <S2SV_ModStart> 0 ) ; mutex_unlock ( & d -> data_mutex ) ; } return ret <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int set_register ( pegasus_t * pegasus, __u16 indx, __u8 data ) { <START_BUG> int ret ; <END_BUG> ret = usb_control_msg ( pegasus -> usb, usb_sndctrlpipe ( pegasus -> usb, 0 ), PEGASUS_REQ_SET_REG, PEGASUS_REQT_WRITE, data,  indx, & data, 1, 1000 ) ; <START_BUG> if ( ret < 0 ) netif_dbg ( pegasus, drv, pegasus -> net, "%s   returned   %d\\n", __func__, ret ) ; <END_BUG> return ret ;  }

Fix:
<S2SV_ModStart> data ) { u8 * buf ; int ret ; buf = kmemdup ( & data, 1, GFP_NOIO ) ; if (! buf ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart>, indx, buf <S2SV_ModEnd>, 1, <S2SV_ModStart> ret ) ; kfree ( buf ) ;
Buggy code:
 static Image * ReadLABELImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char geometry [ MaxTextExtent ], * property ; const char * label ; DrawInfo * draw_info ; Image * image ; MagickBooleanType status ; TypeMetric metrics ; size_t height, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; ( void ) ResetImagePage ( image, "0x0+0+0" ) ; property = InterpretImageProperties ( image_info, image, image_info -> filename ) ; ( void ) SetImageProperty ( image, "label", property ) ; property = DestroyString ( property ) ; label = GetImageProperty ( image, "label" ) ; draw_info = CloneDrawInfo ( image_info, ( DrawInfo * ) NULL ) ; draw_info -> text = ConstantString ( label ) ; metrics. width = 0 ; metrics. ascent = 0.0 ; status = GetMultilineTypeMetrics ( image, draw_info, & metrics ) ; if ( ( image -> columns == 0 ) && ( image -> rows == 0 ) ) { <START_BUG> image -> columns = ( size_t ) ( metrics. width + draw_info -> stroke_width + 0.5 ) ; <END_BUG> image -> rows = ( size_t ) floor ( metrics. height + draw_info -> stroke_width + 0.5 ) ; } else if ( ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) || ( fabs ( image_info -> pointsize ) < MagickEpsilon ) ) { double high, low ; for ( ; ; draw_info -> pointsize *= 2.0 ) { ( void ) FormatLocaleString ( geometry, MaxTextExtent, "%+g%+g", - metrics. bounds. x1, metrics. ascent ) ; if ( draw_info -> gravity == UndefinedGravity ) ( void ) CloneString ( & draw_info -> geometry, geometry

Fix:
<S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor <S2SV_ModStart> ( size_t ) floor
Buggy code:
 cJSON * cJSON_DetachItemFromObject ( cJSON * object, const char * string ) { int i = 0 ; cJSON * c = object -> child ; <START_BUG> while ( c && cJSON_strcasecmp ( c -> string, string ) ) { <END_BUG> ++ i ; c = c -> next ;  } <START_BUG> if ( c ) return cJSON_DetachItemFromArray ( object, i ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> string ) ) i ++, <S2SV_ModEnd> c = c <S2SV_ModStart> -> next ; <S2SV_ModEnd> if ( c
Buggy code:
 static int http_read_header ( URLContext * h, int * new_location ) { HTTPContext * s = h -> priv_data ; char line [ MAX_URL_SIZE ] ; int err = 0 ; <START_BUG> s -> chunksize = - 1 ; <END_BUG> for ( ; ; ) { if ( ( err = http_get_line ( s, line, sizeof ( line ) ) ) < 0 ) return err ; av_log ( h, AV_LOG_TRACE, "header=\'%s\'\\n", line ) ; err = process_line ( h, line, s -> line_count, new_location ) ; if ( err < 0 ) return err ; if ( err == 0 ) break ; s -> line_count ++ ; } if ( s -> seekable == - 1 && s -> is_mediagateway && s -> filesize == 2000000000 ) h -> is_streamed = 1 ; cookie_string ( s -> cookie_dict, & s -> cookies ) ; av_dict_free ( & s -> cookie_dict ) ; return err ; }

Fix:
<S2SV_ModStart> -> chunksize = UINT64_MAX <S2SV_ModEnd> ; for (
Buggy code:
 static int32 makepol ( QPRS_STATE * state ) { int32 val = 0, type ; int32 lenval = 0 ; char * strval = NULL ; int32 stack [ STACKDEPTH ] ; int32 lenstack = 0 ; uint16 flag = 0 ; <START_BUG> while ( ( type = gettoken_query ( state, & val, & lenval, & strval, & flag ) )!= END ) <END_BUG> { switch ( type ) { case VAL : pushval_asis ( state, VAL, strval, lenval, flag ) ; while ( lenstack && ( stack [ lenstack - 1 ] == ( int32 ) '&' || stack [ lenstack - 1 ] == ( int32 ) '!' ) ) { lenstack -- ; pushquery ( state, OPR, stack [ lenstack ], 0, 0, 0 ) ; } break ; case OPR : if ( lenstack && val == ( int32 ) '|' ) pushquery ( state, OPR, val, 0, 0, 0 ) ; else { if ( lenstack == STACKDEPTH ) elog ( ERROR, "stack   too   short" ) ; stack [ lenstack ] = val ; lenstack ++ ; } break ; case OPEN : if ( makepol ( state ) == ERR ) return ERR ; while ( lenstack && ( stack [ lenstack - 1 ] == ( int32 ) '&' || stack [ lenstack - 1 ] == ( int32 ) '!' ) ) { lenstack -- ; pushquery ( state, OPR, stack [ lenstack ], 0, 0, 0 ) ; } break ; case CLOSE : while ( lenstack ) { lenstack -- ; pushquery ( state, OPR, stack [ lenstack ], 0, 0, 0 ) ; } ; return END ; break ; case ERR : default : ereport ( ERROR, ( errcode ( ERRCODE_SYNTAX_ERROR ), errmsg ( "syntax   error" ) ) ) ; return ERR ; } } while ( lenstack ) { lenstack -- ; pushquery ( state, OPR, stack [ lenstack ], 0, 0, 0 ) ; } ; return END ; }

Fix:
<S2SV_ModStart> = 0 ; check_stack_depth ( ) ;
Buggy code:
 const vpx_image_t * vpx_codec_get_preview_frame ( vpx_codec_ctx_t * ctx ) { vpx_image_t * img = NULL ; if ( ctx ) { if (! ctx -> iface ||! ctx -> priv ) ctx -> err = VPX_CODEC_ERROR ; else if (! ( ctx -> iface -> caps & VPX_CODEC_CAP_ENCODER ) ) ctx -> err = VPX_CODEC_INCAPABLE ; else if (! ctx -> iface -> enc. get_preview ) ctx -> err = VPX_CODEC_INCAPABLE ; else <START_BUG> img = ctx -> iface -> enc. get_preview ( ctx -> priv -> alg_priv ) ; <END_BUG> } return img ; }

Fix:
<S2SV_ModStart>. get_preview ( get_alg_priv ( ctx ) <S2SV_ModEnd> ) ; }
Buggy code:
 static inline char * parse_ip_address_ex ( const char * str, size_t str_len, int * portno, int get_err, zend_string * * err ) { char * colon ; char * host = NULL ; # ifdef HAVE_IPV6 <START_BUG> char * p ; <END_BUG> if ( * ( str ) == '[' && str_len > 1 ) {  p = memchr ( str + 1, ']', str_len - 2 ) ; <START_BUG> if (! p || * ( p + 1 )!= ':' ) { if ( get_err ) { * err = strpprintf ( 0, "Failed   to   parse   IPv6   address   \\"%s\\"", str ) ; } return NULL ; } <END_BUG> * portno = atoi ( p + 2 ) ;  return estrndup ( str + 1, p - str - 1 ) ; } # endif if ( str_len ) { colon = memchr ( str, ':', str_len - 1 ) ; } else { colon = NULL ; } if ( colon ) { <START_BUG> * portno = atoi ( colon + 1 ) ; <END_BUG> host = estrndup ( str, colon - str ) ;  } else { <START_BUG> if ( get_err ) { * err = strpprintf ( 0, "Failed   to   parse   address   \\"%s\\"", str ) ; } return NULL ; } <END_BUG> return host ;  }

Fix:
<S2SV_ModStart> # ifdef HAVE_IPV6 <S2SV_ModEnd> if ( * <S2SV_ModStart> 1 ) { char * <S2SV_ModStart> - 2 ), * e = NULL <S2SV_ModStart> * portno = strtol <S2SV_ModEnd> ( p + <S2SV_ModStart> p + 2, & e, 10 ) ; if ( e && * e ) { if ( get_err ) { * err = strpprintf ( 0, "Failed <S2SV_blank> to <S2SV_blank> parse <S2SV_blank> address <S2SV_blank> \\"%s\\"", str ) ; } return NULL ; } <S2SV_ModEnd> return estrndup ( <S2SV_ModStart> colon ) { char * e = NULL ; <S2SV_ModStart> * portno = strtol ( colon + 1, & e, 10 ) ; if (! e ||! * e ) { return <S2SV_ModEnd> estrndup ( str <S2SV_ModStart> ) ; } } <S2SV_ModEnd> if ( get_err <S2SV_ModStart> NULL ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static int selectExpander ( Walker * pWalker, Select * p ) { Parse * pParse = pWalker -> pParse ; int i, j, k ; SrcList * pTabList ; ExprList * pEList ; struct SrcList_item * pFrom ; sqlite3 * db = pParse -> db ; Expr * pE, * pRight, * pExpr ; u16 selFlags = p -> selFlags ; u32 elistFlags = 0 ; p -> selFlags |= SF_Expanded ; if ( db -> mallocFailed ) { return WRC_Abort ; } assert ( p -> pSrc!= 0 ) ; if ( ( selFlags & SF_Expanded )!= 0 ) { return WRC_Prune ; } if ( pWalker -> eCode ) { p -> selId = ++ pParse -> nSelect ; } pTabList = p -> pSrc ; pEList = p -> pEList ; sqlite3WithPush ( pParse, p -> pWith, 0 ) ; sqlite3SrcListAssignCursors ( pParse, pTabList ) ; for ( i = 0, pFrom = pTabList -> a ; i < pTabList -> nSrc ; i ++, pFrom ++ ) { Table * pTab ; assert ( pFrom -> fg. isRecursive == 0 || pFrom -> pTab!= 0 ) ; if ( pFrom -> fg. isRecursive ) continue ; assert ( pFrom -> pTab == 0 ) ; # ifndef SQLITE_OMIT_CTE if ( withExpand ( pWalker, pFrom ) ) return WRC_Abort ; if ( pFrom -> pTab ) { } else # endif if ( pFrom -> zName == 0 ) { # ifndef SQLITE_OMIT_SUBQUERY Select * pSel = pFrom -> pSelect ; assert ( pSel!= 0 ) ; assert ( pFrom -> pTab == 0 ) ; if ( sqlite3WalkSelect ( pWalker, pSel ) ) return WRC_Abort ; if ( sqlite3ExpandSubquery ( pParse, pFrom ) ) return WRC_Abort ; # endif } else { assert ( pFrom -> pTab == 0 ) ; pFrom -> pTab = pTab = sqlite3LocateTableItem ( pParse, 0, pFrom ) ; if ( pTab == 0 ) return WRC_Abort ; if ( pTab ->

Fix:
<S2SV_ModStart> } if ( pParse -> nErr ||
Buggy code:
 static TPM_RC StartAuthSession ( TSS2_SYS_CONTEXT * sapi_context, SESSION * session ) { TPM_RC rval ; TPM2B_ENCRYPTED_SECRET key ; char label [ ] = "ATH" ; UINT16 bytes ; int i ; key. t. size = 0 ; if ( session -> nonceOlder. t. size == 0 ) { session -> nonceOlder. t. size = GetDigestSize ( TPM_ALG_SHA1 ) ; for ( i = 0 ; i < session -> nonceOlder. t. size ; i ++ ) session -> nonceOlder. t. buffer [ i ] = 0 ; } session -> nonceNewer. t. size = session -> nonceOlder. t. size ; rval = Tss2_Sys_StartAuthSession ( sapi_context, session -> tpmKey, session -> bind, 0, & ( session -> nonceOlder ), & ( session -> encryptedSalt ), session -> sessionType, & ( session -> symmetric ), session -> authHash, & ( session -> sessionHandle ), & ( session -> nonceNewer ), 0 ) ; if ( rval == TPM_RC_SUCCESS ) { if ( session -> tpmKey == TPM_RH_NULL ) session -> salt. t. size = 0 ; if ( session -> bind == TPM_RH_NULL ) session -> authValueBind. t. size = 0 ; if ( session -> tpmKey == TPM_RH_NULL && session -> bind == TPM_RH_NULL ) { session -> sessionKey. b. size = 0 ; } else { bool result = string_bytes_concat_buffer ( ( TPM2B_MAX_BUFFER * ) & key, & ( session -> authValueBind. b ) ) ; if (! result ) { return TSS2_SYS_RC_BAD_VALUE ; } result = string_bytes_concat_buffer ( ( TPM2B_MAX_BUFFER * ) & key, & ( session -> salt. b ) ) ; if (! result ) { return TSS2_SYS_RC_BAD_VALUE ; } bytes = GetDigestSize ( session -> authHash ) ; if ( key. t. size == 0 ) { session -> sessionKey. t. size = 0 ; }

Fix:
<S2SV_ModStart> = tpm_kdfa ( <S2SV_ModEnd> session -> authHash
Buggy code:
 static void ProcessRadioRxDone ( void ) { LoRaMacHeader_t macHdr ; ApplyCFListParams_t applyCFList ; GetPhyParams_t getPhy ; PhyParam_t phyParam ; LoRaMacCryptoStatus_t macCryptoStatus = LORAMAC_CRYPTO_ERROR ; LoRaMacMessageData_t macMsgData ; LoRaMacMessageJoinAccept_t macMsgJoinAccept ; uint8_t * payload = RxDoneParams. Payload ; uint16_t size = RxDoneParams. Size ; int16_t rssi = RxDoneParams. Rssi ; int8_t snr = RxDoneParams. Snr ; uint8_t pktHeaderLen = 0 ; uint32_t downLinkCounter = 0 ; uint32_t address = MacCtx. NvmCtx -> DevAddr ; uint8_t multicast = 0 ; AddressIdentifier_t addrID = UNICAST_DEV_ADDR ; FCntIdentifier_t fCntID ; MacCtx. McpsConfirm. AckReceived = false ; MacCtx. McpsIndication. Rssi = rssi ; MacCtx. McpsIndication. Snr = snr ; MacCtx. McpsIndication. RxSlot = MacCtx. RxSlot ; MacCtx. McpsIndication. Port = 0 ; MacCtx. McpsIndication. Multicast = 0 ; MacCtx. McpsIndication. FramePending = 0 ; MacCtx. McpsIndication. Buffer = NULL ; MacCtx. McpsIndication. BufferSize = 0 ; MacCtx. McpsIndication. RxData = false ; MacCtx. McpsIndication. AckReceived = false ; MacCtx. McpsIndication. DownLinkCounter = 0 ; MacCtx. McpsIndication. McpsIndication = MCPS_UNCONFIRMED ; MacCtx. McpsIndication. DevAddress = 0 ; MacCtx. McpsIndication. DeviceTimeAnsReceived = false ; Radio. Sleep ( ) ; TimerStop ( & MacCtx. RxWindowTimer2 ) ; if ( LoRaMacClassBRxBeacon ( payload, size ) == true ) { MacCtx. MlmeIndication. BeaconInfo. Rssi = rssi ; MacCtx. MlmeIndication. BeaconInfo. Snr = snr ; return ; } if (

Fix:
<S2SV_ModStart> case FRAME_TYPE_JOIN_ACCEPT : if ( size < LORAMAC_JOIN_ACCEPT_FRAME_MIN_SIZE ) { MacCtx. McpsIndication. Status = LORAMAC_EVENT_INFO_STATUS_ERROR ; PrepareRxDoneAbort ( ) ; return ; } <S2SV_ModStart> ; if ( ( <S2SV_ModStart> ( int16_t ) LORAMAC_FRAME_PAYLOAD_OVERHEAD_SIZE <S2SV_ModEnd> ) ) > <S2SV_ModStart> phyParam. Value ) || ( size < LORAMAC_FRAME_PAYLOAD_MIN_SIZE )
Buggy code:
 static MYSQL * db_connect ( char * host, char * database, char * user, char * passwd ) { MYSQL * mysql ; if ( verbose ) fprintf ( stdout, "Connecting   to   %s\\n", host? host : "localhost" ) ; if (! ( mysql = mysql_init ( NULL ) ) ) return 0 ; if ( opt_compress ) mysql_options ( mysql, MYSQL_OPT_COMPRESS, NullS ) ; if ( opt_local_file ) mysql_options ( mysql, MYSQL_OPT_LOCAL_INFILE, ( char * ) & opt_local_file ) ; <START_BUG> # ifdef HAVE_OPENSSL <END_BUG> if ( opt_use_ssl ) { mysql_ssl_set ( mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca, opt_ssl_capath, opt_ssl_cipher ) ; mysql_options ( mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl ) ; mysql_options ( mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath ) ; } mysql_options ( mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, ( char * ) & opt_ssl_verify_server_cert ) ; # endif if ( opt_protocol ) mysql_options ( mysql, MYSQL_OPT_PROTOCOL, ( char * ) & opt_protocol ) ; if ( opt_bind_addr ) mysql_options ( mysql, MYSQL_OPT_BIND, opt_bind_addr ) ; # if defined ( _WIN32 ) &&! defined ( EMBEDDED_LIBRARY ) if ( shared_memory_base_name ) mysql_options ( mysql, MYSQL_SHARED_MEMORY_BASE_NAME, shared_memory_base_name ) ; # endif if ( opt_plugin_dir && * opt_plugin_dir ) mysql_options ( mysql, MYSQL_PLUGIN_DIR, opt_plugin_dir ) ; if ( opt_default_auth && * opt_default_auth ) mysql_options ( mysql, MYSQL_DEFAULT_AUTH, opt_default_auth ) ; mysql_options ( mysql, MYSQL_SET_CHARSET_NAME, default_charset ) ; mysql_options ( mysql, MYSQL_OPT_CONNECT_ATTR_RESET, 0 ) ; mysql_options4 ( mysql, MYSQL_OPT_CONNECT_

Fix:
<S2SV_ModStart> opt_local_file ) ; SSL_SET_OPTIONS ( mysql ) ; <S2SV_ModEnd> if ( opt_protocol
Buggy code:
 void xenvif_disconnect ( struct xenvif * vif ) { <START_BUG> struct net_device * dev = vif -> dev ; <END_BUG>  if ( netif_carrier_ok ( dev ) ) { <START_BUG> rtnl_lock ( ) ; netif_carrier_off ( dev ) ; if ( netif_running ( dev ) ) <END_BUG> xenvif_down ( vif ) ;  <START_BUG> rtnl_unlock ( ) ; <END_BUG> xenvif_put ( vif ) ; } atomic_dec ( & vif -> refcnt ) ; wait_event ( vif -> waiting_to_free, atomic_read ( & vif -> refcnt ) == 0 ) ; del_timer_sync ( & vif -> credit_timeout ) ; if ( vif -> irq ) unbind_from_irqhandler ( vif -> irq, vif ) ; unregister_netdev ( vif -> dev ) ; xen_netbk_unmap_frontend_rings ( vif ) ; free_netdev ( vif -> dev ) ; }

Fix:
<S2SV_ModStart> vif ) { <S2SV_ModEnd> if ( netif_carrier_ok <S2SV_ModStart> ( netif_carrier_ok ( vif -> <S2SV_ModEnd> dev ) ) <S2SV_ModStart> dev ) ) xenvif_carrier_off <S2SV_ModEnd> ( vif ) <S2SV_ModStart> vif ) ; <S2SV_ModEnd> atomic_dec ( &
Buggy code:
 static void timer_enter_running ( Timer * t ) { _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL ; int r ; assert ( t ) ; if ( unit_stop_pending ( UNIT ( t ) ) ) return ; r = manager_add_job ( UNIT ( t ) -> manager, JOB_START, UNIT_TRIGGER ( UNIT ( t ) ), JOB_REPLACE, true, & error, NULL ) ; if ( r < 0 ) goto fail ; dual_timestamp_get ( & t -> last_trigger ) ; if ( t -> stamp_path ) <START_BUG> touch_file ( t -> stamp_path, true, t -> last_trigger. realtime, UID_INVALID, GID_INVALID, 0 ) ; <END_BUG> timer_set_state ( t, TIMER_RUNNING ) ; return ; fail : log_unit_warning ( UNIT ( t ), "Failed   to   queue   unit   startup   job:   %s", bus_error_message ( & error, r ) ) ; timer_enter_dead ( t, TIMER_FAILURE_RESOURCES ) ; }

Fix:
<S2SV_ModStart>, GID_INVALID, MODE_INVALID <S2SV_ModEnd> ) ; timer_set_state
Buggy code:
 <START_BUG> static inline long decode_twos_comp ( ulong c, int prec ) <END_BUG> { long result ; assert ( prec >= 2 ) ; jas_eprintf ( "warning:   support   for   signed   data   is   untested\\n" ) ; result = ( c & ( ( 1 << ( prec - 1 ) ) - 1 ) ) - ( c & ( 1 << ( prec - 1 ) ) ) ; return result ; }

Fix:
<S2SV_ModStart> long decode_twos_comp ( jas_ulong <S2SV_ModEnd> c, int
Buggy code:
 int main ( int argc, char * * argv ) { char * oldshell ; int nullshell = 0 ; const uid_t uid = getuid ( ) ; struct sinfo info = { 0 } ; struct passwd * pw ; sanitize_env ( ) ; setlocale ( LC_ALL, "" ) ; bindtextdomain ( PACKAGE, LOCALEDIR ) ; textdomain ( PACKAGE ) ; atexit ( close_stdout ) ; parse_argv ( argc, argv, & info ) ; if (! info. username ) { pw = getpwuid ( uid ) ; if (! pw ) errx ( EXIT_FAILURE, _ ( "you   (user   %d)   don\'t   exist." ), uid ) ; } else { pw = getpwnam ( info. username ) ; if (! pw ) errx ( EXIT_FAILURE, _ ( "user   \\"%s\\"   does   not   exist." ), info. username ) ; } # ifndef HAVE_LIBUSER if (! ( is_local ( pw -> pw_name ) ) ) errx ( EXIT_FAILURE, _ ( "can   only   change   local   entries" ) ) ; # endif # ifdef HAVE_LIBSELINUX if ( is_selinux_enabled ( ) > 0 ) { if ( uid == 0 ) { if ( checkAccess ( pw -> pw_name, PASSWD__CHSH )!= 0 ) { security_context_t user_context ; if ( getprevcon ( & user_context ) < 0 ) user_context = ( security_context_t ) NULL ; errx ( EXIT_FAILURE, _ ( "%s   is   not   authorized   to   change   the   shell   of   %s" ), user_context? : _ ( "Unknown   user   context" ), pw -> pw_name ) ; } } if ( setupDefaultContext ( _PATH_PASSWD )!= 0 ) errx ( EXIT_FAILURE, _ ( "can\'t   set   default   context   for   %s" ), _PATH_PASSWD ) ; } # endif oldshell = pw -> pw_shell ; if ( oldshell == NULL || * oldshell == '\\0' ) { oldshell = _PATH_BSHELL ; nullshell = 1 ; } # ifdef HAVE_LIBUSER if ( get

Fix:
<S2SV_ModStart> setpwnam ( pw, ".chsh"
Buggy code:
 static void copy_move_file ( CopyMoveJob * copy_job, GFile * src, GFile * dest_dir, gboolean same_fs, gboolean unique_names, char * * dest_fs_type, SourceInfo * source_info, TransferInfo * transfer_info, GHashTable * debuting_files, GdkPoint * position, gboolean overwrite, gboolean * skipped_file, gboolean readonly_source_fs ) { GFile * dest, * new_dest ; g_autofree gchar * dest_uri = NULL ; GError * error ; GFileCopyFlags flags ; char * primary, * secondary, * details ; int response ; ProgressData pdata ; gboolean would_recurse, is_merge ; CommonJob * job ; gboolean res ; int unique_name_nr ; gboolean handled_invalid_filename ; job = ( CommonJob * ) copy_job ; if ( should_skip_file ( job, src ) ) { * skipped_file = TRUE ; return ; } unique_name_nr = 1 ; handled_invalid_filename = * dest_fs_type!= NULL ; if ( unique_names ) { dest = get_unique_target_file ( src, dest_dir, same_fs, * dest_fs_type, unique_name_nr ++ ) ; } else if ( copy_job -> target_name!= NULL ) { dest = get_target_file_with_custom_name ( src, dest_dir, * dest_fs_type, same_fs, copy_job -> target_name ) ; } else { dest = get_target_file ( src, dest_dir, * dest_fs_type, same_fs ) ; } if ( test_dir_is_parent ( dest_dir, src ) ) { if ( job -> skip_all_error ) { goto out ; } primary = copy_job -> is_move? g_strdup ( _ ( "You   cannot   move   a   folder   into   itself." ) ) : g_strdup ( _ ( "You   cannot   copy   a   folder   into   itself." ) ) ; secondary = g_strdup ( _ ( "The   destination   folder   is   inside   the   source   folder." ) ) ; response = run_cancel_or_skip_warning ( job

Fix:
<S2SV_ModStart> ) ) { mark_desktop_file_executable <S2SV_ModEnd> ( job,
Buggy code:
 static const char * escape_xml ( const char * text ) { static char * escaped ; static size_t escaped_size ; char * out ; size_t len ; <START_BUG> if (! strlen ( text ) ) return "empty   string" ; <END_BUG> for ( out = escaped, len = 0 ; * text ; ++ len, ++ out, ++ text ) { if ( ( len + 8 ) > escaped_size ) { char * bigger_escaped ; escaped_size += 128 ; bigger_escaped = realloc ( escaped, escaped_size ) ; if (! bigger_escaped ) { free ( escaped ) ; escaped = NULL ; escaped_size = 0 ; return ">>>   out   of   memory   <<<" ; } out = bigger_escaped + len ; escaped = bigger_escaped ; } switch ( * text ) { case '&' : strcpy ( out, "&amp;" ) ; len += strlen ( out ) - 1 ; out = escaped + len ; break ; case '<' : strcpy ( out, "&lt;" ) ; len += strlen ( out ) - 1 ; out = escaped + len ; break ; case '>' : strcpy ( out, "&gt;" ) ; len += strlen ( out ) - 1 ; out = escaped + len ; break ; default : * out = * text ; break ; } } * out = '\\x0' ; return escaped ; }

Fix:
<S2SV_ModStart> ) ) return "" <S2SV_ModEnd> ; for (
Buggy code:
 static int header_read ( SF_PRIVATE * psf, void * ptr, int bytes ) { int count = 0 ; <START_BUG> if ( psf -> headindex >= SIGNED_SIZEOF ( psf -> header ) ) <END_BUG>  return psf_fread ( ptr, 1, bytes, psf ) ; <START_BUG> <END_BUG> if ( psf -> headindex + bytes > SIGNED_SIZEOF ( psf -> header ) )  { int most ; most = SIGNED_SIZEOF ( psf -> header ) - psf -> headend ; psf_fread ( psf -> header + psf -> headend, 1, most, psf ) ; memcpy ( ptr, psf -> header + psf -> headend, most ) ; psf -> headend = psf -> headindex += most ; psf_fread ( ( char * ) ptr + most, bytes - most, 1, psf ) ; return bytes ; } ; <START_BUG> if ( psf -> headindex + bytes > psf -> headend ) <END_BUG>  { count = psf_fread ( psf -> header + psf -> headend, 1, bytes - ( psf -> headend - psf -> headindex ), psf ) ; <START_BUG> <END_BUG> if ( count!= bytes - ( int ) ( psf -> headend - psf -> headindex ) )  { psf_log_printf ( psf, "Error   :   psf_fread   returned   short   count.\\n" ) ; return count ; } ; <START_BUG> psf -> headend += count ; <END_BUG> } ;  memcpy ( ptr, psf -> header + psf -> headindex, bytes ) ; <START_BUG> <END_BUG> psf -> headindex += bytes ;  return bytes ; }

Fix:
<S2SV_ModStart> ( psf -> header. indx + bytes >= <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. len && psf_bump_header_allocation ( psf, bytes <S2SV_ModStart> ) ) return count <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( psf -> header. indx <S2SV_ModEnd> + bytes > <S2SV_ModStart> > psf -> header. end <S2SV_ModEnd> ) { count <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> + psf -> header. end <S2SV_ModEnd>, 1, <S2SV_ModStart> ( psf -> header. end <S2SV_ModEnd> - psf -> <S2SV_ModStart> - psf -> header. indx <S2SV_ModEnd> ), psf <S2SV_ModStart> ( psf -> header. end <S2SV_ModEnd> - psf -> <S2SV_ModStart> - psf -> header. indx <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; psf -> header. end <S2SV_ModEnd> += count ; <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> + psf -> header. indx <S2SV_ModEnd>, bytes ) <S2SV_ModStart> ; psf -> header. indx <S2SV_ModEnd> += bytes ;
Buggy code:
 static int Unpickler_set_memo ( UnpicklerObject * self, PyObject * obj ) { PyObject * * new_memo ; <START_BUG> Py_ssize_t new_memo_size = 0 ; <END_BUG> Py_ssize_t i ; if ( obj == NULL ) { PyErr_SetString ( PyExc_TypeError, "attribute   deletion   is   not   supported" ) ; return - 1 ; } if ( Py_TYPE ( obj ) == & UnpicklerMemoProxyType ) { UnpicklerObject * unpickler = ( ( UnpicklerMemoProxyObject * ) obj ) -> unpickler ; new_memo_size = unpickler -> memo_size ; new_memo = _Unpickler_NewMemo ( new_memo_size ) ; if ( new_memo == NULL ) return - 1 ;  for ( i = 0 ; i < new_memo_size ; i ++ ) { <START_BUG> Py_XINCREF ( unpickler -> memo [ i ] ) ; new_memo [ i ] = unpickler -> memo [ i ] ; } } else if ( PyDict_Check ( obj ) ) { Py_ssize_t i = 0 ; PyObject * key, * value ; new_memo_size = PyDict_GET_SIZE ( obj ) ; new_memo = _Unpickler_NewMemo ( new_memo_size ) ; if ( new_memo == NULL ) return - 1 ; while ( PyDict_Next ( obj, & i, & key, & value ) ) { Py_ssize_t idx ; if (! PyLong_Check ( key ) ) { PyErr_SetString ( PyExc_TypeError, "memo   key   must   be   integers" ) ; goto error ; } idx = PyLong_AsSsize_t ( key ) ; if ( idx == - 1 && PyErr_Occurred ( ) ) goto error ; if ( idx < 0 ) { PyErr_SetString ( PyExc_ValueError, "memo   key   must   be   positive   integers." ) ; goto error ; } if ( _Unpickler_MemoPut ( self, idx, value ) < 0 ) goto error ; } } else { PyErr_Format ( PyExc_TypeError, "\'memo\'   attribute   must   be   an   UnpicklerMemoProxy  <END_BUG>

Fix:
<S2SV_ModStart> * new_memo ; size_t new_memo_size = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; for ( size_t <S2SV_ModStart> new_memo_size ) { for ( size_t i = new_memo_size - 1 ; i!= SIZE_MAX ; i -- <S2SV_ModEnd> ) { Py_XDECREF
Buggy code:
 <START_BUG> static int can_open_delegated ( struct nfs_delegation * delegation, mode_t open_flags ) <END_BUG> {  if ( ( delegation -> type & open_flags )!= open_flags ) <START_BUG> return 0 ; if ( test_bit ( NFS_DELEGATION_NEED_RECLAIM, & delegation -> flags ) ) return 0 ; nfs_mark_delegation_referenced ( delegation ) ; return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> * delegation, fmode_t fmode <S2SV_ModEnd> ) { if <S2SV_ModStart> -> type & fmode )!= fmode <S2SV_ModEnd> ) return 0
Buggy code:
 <START_BUG> void rdp_read_flow_control_pdu ( wStream * s, UINT16 * type ) <END_BUG> {  UINT8 pduType ; <START_BUG> Stream_Read_UINT8 ( s, pduType ) ; * type = pduType ; Stream_Seek_UINT8 ( s ) ; Stream_Seek_UINT8 ( s ) ; Stream_Seek_UINT8 ( s ) ; Stream_Seek_UINT16 ( s ) ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> BOOL <S2SV_ModEnd> rdp_read_flow_control_pdu ( wStream <S2SV_ModStart> { UINT8 pduType ; if (! type ) return FALSE ; if ( Stream_GetRemainingLength ( s ) < 6 ) return FALSE <S2SV_ModStart> s ) ; return TRUE ;
Buggy code:
 int rpc_pack ( rpc_pkg * pkg, void * * data, uint32_t * size ) { static void * send_buf ; static size_t send_buf_size ; <START_BUG> uint32_t pkg_size = RPC_PKG_HEAD_SIZE + pkg -> ext_size + pkg -> body_size ; <END_BUG> if ( send_buf_size < pkg_size ) { if ( send_buf ) free ( send_buf ) ; send_buf_size = pkg_size * 2 ; send_buf = malloc ( send_buf_size ) ;  assert ( send_buf!= NULL ) ; <START_BUG> } memcpy ( send_buf, pkg, RPC_PKG_HEAD_SIZE ) ; if ( pkg -> ext_size ) memcpy ( send_buf + RPC_PKG_HEAD_SIZE, pkg -> ext, pkg -> ext_size ) ; if ( pkg -> body_size ) memcpy ( send_buf + RPC_PKG_HEAD_SIZE + pkg -> ext_size, pkg -> body, pkg -> body_size ) ; pkg = send_buf ; pkg -> magic = htole32 ( RPC_PKG_MAGIC ) ; pkg -> command = htole32 ( pkg -> command ) ; pkg -> pkg_type = htole16 ( pkg -> pkg_type ) ; pkg -> result = htole32 ( pkg -> result ) ; pkg -> sequence = htole32 ( pkg -> sequence ) ; pkg -> req_id = htole64 ( pkg -> req_id ) ; pkg -> body_size = htole32 ( pkg -> body_size ) ; pkg -> ext_size = htole16 ( pkg -> ext_size ) ; pkg -> crc32 = 0 ; pkg -> crc32 = htole32 ( generate_crc32c ( send_buf, pkg_size ) ) ; * data = send_buf ; * size = pkg_size ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; uint32_t pkg_size ; if ( pkg -> body_size > RPC_PKG_MAX_BODY_SIZE ) { return - 1 ; } pkg_size <S2SV_ModStart> send_buf_size ) ; if ( send_buf == NULL ) { return - 1 ; } <S2SV_ModEnd> } memcpy (
Buggy code:
 long keyctl_chown_key ( key_serial_t id, uid_t user, gid_t group ) { struct key_user * newowner, * zapowner = NULL ; struct key * key ; key_ref_t key_ref ; long ret ; kuid_t uid ; kgid_t gid ; uid = make_kuid ( current_user_ns ( ), user ) ; gid = make_kgid ( current_user_ns ( ), group ) ; ret = - EINVAL ; if ( ( user!= ( uid_t ) - 1 ) &&! uid_valid ( uid ) ) goto error ; if ( ( group!= ( gid_t ) - 1 ) &&! gid_valid ( gid ) ) goto error ; ret = 0 ; if ( user == ( uid_t ) - 1 && group == ( gid_t ) - 1 ) goto error ; key_ref = lookup_user_key ( id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, KEY_NEED_SETATTR ) ; if ( IS_ERR ( key_ref ) ) { ret = PTR_ERR ( key_ref ) ; goto error ; } key = key_ref_to_ptr ( key_ref ) ; ret = - EACCES ; down_write ( & key -> sem ) ; if (! capable ( CAP_SYS_ADMIN ) ) { if ( user!= ( uid_t ) - 1 &&! uid_eq ( key -> uid, uid ) ) goto error_put ; if ( group!= ( gid_t ) - 1 &&! gid_eq ( gid, key -> gid ) &&! in_group_p ( gid ) ) goto error_put ; } if ( user!= ( uid_t ) - 1 &&! uid_eq ( uid, key -> uid ) ) { ret = - ENOMEM ; newowner = key_user_lookup ( uid ) ; if (! newowner ) goto error_put ; if ( test_bit ( KEY_FLAG_IN_QUOTA, & key -> flags ) ) { unsigned maxkeys = uid_eq ( uid, GLOBAL_ROOT_UID )? key_quota_root_maxkeys : key_quota_maxkeys ; unsigned maxbytes = uid_eq ( uid, GLOBAL_ROOT_UID )? key_quota_root_maxbytes : key

Fix:
<S2SV_ModStart> ; if ( key -> state!= KEY_IS_UNINSTANTIATED <S2SV_ModEnd> ) { atomic_dec
Buggy code:
 static int mp_join_print ( netdissect_options * ndo, const u_char * opt, u_int opt_len, u_char flags ) { const struct mp_join * mpj = ( const struct mp_join * ) opt ; <START_BUG> if (! ( opt_len == 12 && flags & TH_SYN ) && <END_BUG>! ( opt_len == 16 && ( flags & ( TH_SYN | TH_ACK ) ) == ( TH_SYN | TH_ACK ) ) && ! ( opt_len == 24 && flags & TH_ACK ) ) <START_BUG> return 0 ; if ( opt_len!= 24 ) { if ( mpj -> sub_b & MP_JOIN_B ) ND_PRINT ( ( ndo, "   backup" ) ) ; ND_PRINT ( ( ndo, "   id   %u", mpj -> addr_id ) ) ; } switch ( opt_len ) { case 12 : ND_PRINT ( ( ndo, "   token   0x%x" "   nonce   0x%x", EXTRACT_32BITS ( mpj -> u. syn. token ), EXTRACT_32BITS ( mpj -> u. syn. nonce ) ) ) ; break ; case 16 : ND_PRINT ( ( ndo, "   hmac   0x%" PRIx64 "   nonce   0x%x", EXTRACT_64BITS ( mpj -> u. synack. mac ), EXTRACT_32BITS ( mpj -> u. synack. nonce ) ) ) ; break ; case 24 : { size_t i ; ND_PRINT ( ( ndo, "   hmac   0x" ) ) ; for ( i = 0 ; i < sizeof ( mpj -> u. ack. mac ) ; ++ i ) ND_PRINT ( ( ndo, "%02x", mpj -> u. ack. mac [ i ] ) ) ; } default : break ; } return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> == 12 && ( <S2SV_ModStart> & TH_SYN ) ) <S2SV_ModStart> == 24 && ( <S2SV_ModStart> flags & TH_ACK )