nus-yam/ex-repair huggingface dataset:
Buggy code:
 static Image * ReadHRZImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; register ssize_t x ; register PixelPacket * q ; register unsigned char * p ; ssize_t count, y ; size_t length ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> columns = 256 ; image -> rows = 240 ; image -> depth = 8 ; <START_BUG> pixels = ( unsigned char * ) AcquireQuantumMemory ( image -> columns, 3 * <END_BUG> sizeof ( * pixels ) ) ; if ( pixels == ( unsigned char * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; length = ( size_t ) ( 3 * image -> columns ) ; for ( y = 0 ; y < ( ssize_t ) image -> rows ; y ++ ) { count = ReadBlob ( image, length, pixels ) ; if ( ( size_t ) count!= length ) ThrowReaderException ( CorruptImageError, "UnableToReadImageData" ) ; p = pixels ; q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) break ; for ( x = 0 ; x < ( ssize_t ) image -> columns ; x ++ ) { SetPixelRed ( q, ScaleCharToQuantum ( 4 * * p ++ ) ) ; SetPixelGreen ( q, ScaleCharToQuantum ( 4 * * p ++ ) ) ; SetPixelBlue ( q, ScaleCharToQuantum ( 4 * * p ++ ) ) ; SetPixelOpacity ( q, OpaqueOpacity ) ; q ++ ; } if ( SyncAuth

Fix:
<S2SV_ModStart> = 8 ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static struct prog_entry * predicate_parse ( const char * str, int nr_parens, int nr_preds, parse_pred_fn parse_pred, void * data, struct filter_parse_error * pe ) { struct prog_entry * prog_stack ; struct prog_entry * prog ; const char * ptr = str ; char * inverts = NULL ; int * op_stack ; int * top ; int invert = 0 ; int ret = - ENOMEM ; int len ; int N = 0 ; int i ; nr_preds += 2 ; op_stack = kmalloc_array ( nr_parens, sizeof ( * op_stack ), GFP_KERNEL ) ; if (! op_stack ) return ERR_PTR ( - ENOMEM ) ; prog_stack = kcalloc ( nr_preds, sizeof ( * prog_stack ), GFP_KERNEL ) ; if (! prog_stack ) { parse_error ( pe, - ENOMEM, 0 ) ; goto out_free ; } inverts = kmalloc_array ( nr_preds, sizeof ( * inverts ), GFP_KERNEL ) ; if (! inverts ) { parse_error ( pe, - ENOMEM, 0 ) ; goto out_free ; } top = op_stack ; prog = prog_stack ; * top = 0 ; while ( * ptr ) { const char * next = ptr ++ ; if ( isspace ( * next ) ) continue ; switch ( * next ) { case '(' : if ( top - op_stack > nr_parens ) <START_BUG> return ERR_PTR ( - EINVAL ) ; <END_BUG> * ( ++ top ) = invert ; continue ; case '!' : if (! is_not ( next ) ) break ; invert =! invert ; continue ; } if ( N >= nr_preds ) { parse_error ( pe, FILT_ERR_TOO_MANY_PREDS, next - str ) ; goto out_free ; } inverts [ N ] = invert ; prog [ N ]. target = N - 1 ; len = parse_pred ( next, data, ptr - str, pe, & prog [ N ]. pred ) ; if ( len < 0 ) { ret = len ; goto out_free ; } ptr = next + len ; N ++ ; ret = - 1 ; while (

Fix:
<S2SV_ModStart> > nr_parens ) { ret = - EINVAL ; goto out_free ; } <S2SV_ModEnd> * ( ++
Buggy code:
 int mp_unpack_full ( lua_State * L, int limit, int offset ) { size_t len ; const char * s ; mp_cur c ; int cnt ; int decode_all = (! limit &&! offset ) ; s = luaL_checklstring ( L, 1, & len ) ; if ( offset < 0 || limit < 0 ) return luaL_error ( L, "Invalid   request   to   unpack   with   offset   of   %d   and   limit   of   %d.", offset, len ) ; else if ( offset > len ) return luaL_error ( L, "Start   offset   %d   greater   than   input   length   %d.", offset, len ) ; if ( decode_all ) limit = INT_MAX ; mp_cur_init ( & c, ( const unsigned char * ) s + offset, len - offset ) ; for ( cnt = 0 ; c. left > 0 && cnt < limit ; cnt ++ ) { mp_decode_to_lua_type ( L, & c ) ; if ( c. err == MP_CUR_ERROR_EOF ) { return luaL_error ( L, "Missing   bytes   in   input." ) ; } else if ( c. err == MP_CUR_ERROR_BADFMT ) { return luaL_error ( L, "Bad   data   format   in   input." ) ; } } if (! decode_all ) { int offset = len - c. left ; <START_BUG> lua_pushinteger ( L, c. left == 0? - 1 : offset ) ; <END_BUG> lua_insert ( L, 2 ) ; cnt += 1 ; } return cnt ; }

Fix:
<S2SV_ModStart>. left ; luaL_checkstack ( L, 1, "in <S2SV_blank> function <S2SV_blank> mp_unpack_full" ) ;
Buggy code:
 void vtp_print ( netdissect_options * ndo, const u_char * pptr, u_int length ) { int type, len, tlv_len, tlv_value, mgmtd_len ; const u_char * tptr ; const struct vtp_vlan_ * vtp_vlan ; if ( length < VTP_HEADER_LEN ) goto trunc ; tptr = pptr ; ND_TCHECK2 ( * tptr, VTP_HEADER_LEN ) ; type = * ( tptr + 1 ) ; ND_PRINT ( ( ndo, "VTPv%u,   Message   %s   (0x%02x),   length   %u", * tptr, tok2str ( vtp_message_type_values, "Unknown   message   type", type ), type, length ) ) ; if ( ndo -> ndo_vflag < 1 ) { return ; } ND_PRINT ( ( ndo, "\\n\\tDomain   name:   " ) ) ; mgmtd_len = * ( tptr + 3 ) ; if ( mgmtd_len < 1 || mgmtd_len > 32 ) { ND_PRINT ( ( ndo, "   [invalid   MgmtD   Len   %d]", mgmtd_len ) ) ; return ; } fn_printzp ( ndo, tptr + 4, mgmtd_len, NULL ) ; ND_PRINT ( ( ndo, ",   %s:   %u", tok2str ( vtp_header_values, "Unknown", type ), * ( tptr + 2 ) ) ) ; tptr += VTP_HEADER_LEN ; switch ( type ) { case VTP_SUMMARY_ADV : ND_TCHECK2 ( * tptr, 8 ) ; ND_PRINT ( ( ndo, "\\n\\t     Config   Rev   %x,   Updater   %s", EXTRACT_32BITS ( tptr ), ipaddr_string ( ndo, tptr + 4 ) ) ) ; tptr += 8 ; ND_TCHECK2 ( * tptr, VTP_UPDATE_TIMESTAMP_LEN ) ; ND_PRINT ( ( ndo, ",   Timestamp   0x%08x   0x%08x  

Fix:
<S2SV_ModStart> ) tptr ; if ( len < VTP_VLAN_INFO_FIXED_PART_LEN ) goto trunc ; <S2SV_ModStart> ) ) ; len -= VTP_VLAN_INFO_FIXED_PART_LEN ; tptr += VTP_VLAN_INFO_FIXED_PART_LEN ; if ( len < 4 * ( ( <S2SV_ModEnd> vtp_vlan -> name_len <S2SV_ModStart> vtp_vlan -> name_len + 3 ) // 4 ) ) goto trunc ; ND_TCHECK2 ( * tptr, <S2SV_ModEnd> vtp_vlan -> name_len <S2SV_ModStart> vtp_vlan -> name_len ) ; fn_printzp ( ndo, tptr, <S2SV_ModEnd> vtp_vlan -> name_len <S2SV_ModStart> vtp_vlan -> name_len, NULL ) ; len -= 4 * ( ( vtp_vlan -> name_len + 3 ) // 4 ) ; tptr += 4 * ( ( vtp_vlan -> name_len <S2SV_ModStart> 0 ) { if ( len < 2 ) goto trunc ; ND_TCHECK2 ( * tptr, 2 ) ; <S2SV_ModStart> ; if ( len < tlv_len * 2 + 2 ) { ND_PRINT ( ( ndo, " <S2SV_blank>
Buggy code:
 static struct berval * * krb5_encode_krbsecretkey ( krb5_key_data * key_data_in, int n_key_data, krb5_kvno mkvno ) { struct berval * * ret = NULL ; int currkvno ; int num_versions = 1 ; int i, j, last ; krb5_error_code err = 0 ; krb5_key_data * key_data ; if ( n_key_data <= 0 ) return NULL ; key_data = k5calloc ( n_key_data, sizeof ( * key_data ), & err ) ; if ( key_data_in == NULL ) goto cleanup ; memcpy ( key_data, key_data_in, n_key_data * sizeof ( * key_data ) ) ; for ( i = 0 ; i < n_key_data ; i ++ ) { if ( key_data [ i ]. key_data_ver == 1 ) { key_data [ i ]. key_data_ver = 2 ; key_data [ i ]. key_data_type [ 1 ] = KRB5_KDB_SALTTYPE_NORMAL ; key_data [ i ]. key_data_length [ 1 ] = 0 ; key_data [ i ]. key_data_contents [ 1 ] = NULL ; } } for ( i = 0 ; i < n_key_data - 1 ; i ++ ) if ( key_data [ i ]. key_data_kvno!= key_data [ i + 1 ]. key_data_kvno ) num_versions ++ ; ret = ( struct berval * * ) calloc ( num_versions + 1, sizeof ( struct berval * ) ) ; if ( ret == NULL ) { err = ENOMEM ; goto cleanup ; } for ( i = 0, last = 0, j = 0, currkvno = key_data [ 0 ]. key_data_kvno ; i < n_key_data ; i ++ ) { krb5_data * code ; if ( i == n_key_data - 1 || key_data [ i + 1 ]. key_data_kvno!= currkvno ) { ret [ j ] = k5alloc ( sizeof ( struct berval ), & err ) ; if (

Fix:
<S2SV_ModStart> + 1 ; if ( i < n_key_data - 1 ) <S2SV_ModStart> key_data [ i + 1
Buggy code:
 tsize_t t2p_readwrite_pdf_image ( T2P * t2p, TIFF * input, TIFF * output ) { tsize_t written = 0 ; unsigned char * buffer = NULL ; unsigned char * samplebuffer = NULL ; tsize_t bufferoffset = 0 ; tsize_t samplebufferoffset = 0 ; tsize_t read = 0 ; tstrip_t i = 0 ; tstrip_t j = 0 ; tstrip_t stripcount = 0 ; tsize_t stripsize = 0 ; tsize_t sepstripcount = 0 ; tsize_t sepstripsize = 0 ; # ifdef OJPEG_SUPPORT toff_t inputoffset = 0 ; uint16 h_samp = 1 ; uint16 v_samp = 1 ; uint16 ri = 1 ; uint32 rows = 0 ; # endif # ifdef JPEG_SUPPORT unsigned char * jpt ; float * xfloatp ; uint64 * sbc ; unsigned char * stripbuffer ; tsize_t striplength = 0 ; uint32 max_striplength = 0 ; # endif if ( t2p -> t2p_error!= T2P_ERR_OK ) return ( 0 ) ; if ( t2p -> pdf_transcode == T2P_TRANSCODE_RAW ) { # ifdef CCITT_SUPPORT if ( t2p -> pdf_compression == T2P_COMPRESS_G4 ) { buffer = ( unsigned char * ) _TIFFmalloc ( t2p -> tiff_datasize ) ; if ( buffer == NULL ) { TIFFError ( TIFF2PDF_MODULE, "Can\'t   allocate   %lu   bytes   of   memory   for   " "t2p_readwrite_pdf_image,   %s", ( unsigned long ) t2p -> tiff_datasize, TIFFFileName ( input ) ) ; t2p -> t2p_error = T2P_ERR_ERROR ; return ( 0 ) ; } TIFFReadRawStrip ( input, 0, ( tdata_t ) buffer, t2p -> tiff_datasize ) ; if ( t2p -> tiff_fillorder == FILLORDER_LSB2MSB ) { TIFFReverseBits ( buffer, t2p -> tiff_datasize ) ;

Fix:
<S2SV_ModStart>, buffer, t2p -> tiff_datasize,
Buggy code:
 BOOLEAN UIPC_Send ( tUIPC_CH_ID ch_id, UINT16 msg_evt, UINT8 * p_buf, UINT16 msglen ) { UNUSED ( msg_evt ) ; BTIF_TRACE_DEBUG ( "UIPC_Send   :   ch_id:%d   %d   bytes", ch_id, msglen ) ; UIPC_LOCK ( ) ; <START_BUG> if ( write ( uipc_main. ch [ ch_id ]. fd, p_buf, msglen ) < 0 ) <END_BUG> { BTIF_TRACE_ERROR ( "failed   to   write   (%s)", strerror ( errno ) ) ; } UIPC_UNLOCK ( ) ; return FALSE ; }

Fix:
<S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> p_buf, msglen )
Buggy code:
 static krb5_error_code decode_sequence_of ( const uint8_t * asn1, size_t len, const struct atype_info * elemtype, void * * seq_out, size_t * count_out ) { krb5_error_code ret ; void * seq = NULL, * elem, * newseq ; const uint8_t * contents ; size_t clen, count = 0 ; taginfo t ; * seq_out = NULL ; * count_out = 0 ; while ( len > 0 ) { <START_BUG> ret = get_tag ( asn1, len, & t, & contents, & clen, & asn1, & len ) ; <END_BUG> if ( ret ) goto error ; if (! check_atype_tag ( elemtype, & t ) ) { ret = ASN1_BAD_ID ; goto error ; } newseq = realloc ( seq, ( count + 1 ) * elemtype -> size ) ; if ( newseq == NULL ) { ret = ENOMEM ; goto error ; } seq = newseq ; elem = ( char * ) seq + count * elemtype -> size ; memset ( elem, 0, elemtype -> size ) ; ret = decode_atype ( & t, contents, clen, elemtype, elem ) ; if ( ret ) goto error ; count ++ ; } * seq_out = seq ; * count_out = count ; return 0 ; error : free_sequence_of ( elemtype, seq, count ) ; free ( seq ) ; return ret ; }

Fix:
<S2SV_ModStart>, & len, 0
Buggy code:
 static int hi3660_stub_clk_probe ( struct platform_device * pdev ) { struct device * dev = & pdev -> dev ; struct resource * res ; unsigned int i ; int ret ; stub_clk_chan. cl. dev = dev ; stub_clk_chan. cl. tx_done = NULL ; stub_clk_chan. cl. tx_block = false ; stub_clk_chan. cl. knows_txdone = false ; stub_clk_chan. mbox = mbox_request_channel ( & stub_clk_chan. cl, 0 ) ; if ( IS_ERR ( stub_clk_chan. mbox ) ) return PTR_ERR ( stub_clk_chan. mbox ) ; res = platform_get_resource ( pdev, IORESOURCE_MEM, 0 ) ; <START_BUG> freq_reg = devm_ioremap ( dev, res -> start, resource_size ( res ) ) ; <END_BUG> if (! freq_reg ) return - ENOMEM ; freq_reg += HI3660_STUB_CLOCK_DATA ; for ( i = 0 ; i < HI3660_CLK_STUB_NUM ; i ++ ) { ret = devm_clk_hw_register ( & pdev -> dev, & hi3660_stub_clks [ i ]. hw ) ; if ( ret ) return ret ; } return devm_of_clk_add_hw_provider ( & pdev -> dev, hi3660_stub_clk_hw_get, hi3660_stub_clks ) ; }

Fix:
<S2SV_ModStart> 0 ) ; if (! res ) return - EINVAL ;
Buggy code:
 <START_BUG> MB_PREDICTION_MODE vp9_left_block_mode ( const MODE_INFO * cur_mi, <END_BUG> const MODE_INFO * left_mi, int b ) { if ( b == 0 || b == 2 ) { if (! left_mi || is_inter_block ( & left_mi -> mbmi ) ) return DC_PRED ; return get_y_mode ( left_mi, b + 1 ) ; } else { assert ( b == 1 || b == 3 ) ; return cur_mi -> bmi [ b - 1 ]. as_mode ; } }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> PREDICTION_MODE <S2SV_ModEnd> vp9_left_block_mode ( const
Buggy code:
 void icmp_print ( netdissect_options * ndo, const u_char * bp, u_int plen, const u_char * bp2, int fragmented ) { char * cp ; const struct icmp * dp ; const struct icmp_ext_t * ext_dp ; const struct ip * ip ; const char * str, * fmt ; const struct ip * oip ; const struct udphdr * ouh ; const uint8_t * obj_tptr ; uint32_t raw_label ; const u_char * snapend_save ; const struct icmp_mpls_ext_object_header_t * icmp_mpls_ext_object_header ; u_int hlen, dport, mtu, obj_tlen, obj_class_num, obj_ctype ; char buf [ MAXHOSTNAMELEN + 100 ] ; struct cksum_vec vec [ 1 ] ; dp = ( const struct icmp * ) bp ; ext_dp = ( const struct icmp_ext_t * ) bp ; ip = ( const struct ip * ) bp2 ; str = buf ; ND_TCHECK ( dp -> icmp_code ) ; switch ( dp -> icmp_type ) { case ICMP_ECHO : case ICMP_ECHOREPLY : ND_TCHECK ( dp -> icmp_seq ) ; ( void ) snprintf ( buf, sizeof ( buf ), "echo   %s,   id   %u,   seq   %u", dp -> icmp_type == ICMP_ECHO? "request" : "reply", EXTRACT_16BITS ( & dp -> icmp_id ), EXTRACT_16BITS ( & dp -> icmp_seq ) ) ; break ; case ICMP_UNREACH : ND_TCHECK ( dp -> icmp_ip. ip_dst ) ; switch ( dp -> icmp_code ) { case ICMP_UNREACH_PROTOCOL : ND_TCHECK ( dp -> icmp_ip. ip_p ) ; ( void ) snprintf ( buf, sizeof ( buf ), "%s   protocol   %d   unreachable", ipaddr_string ( ndo, & dp -> icmp_ip. ip_dst ), dp -> icmp_ip. ip_p ) ; break ; case IC

Fix:
<S2SV_ModStart> ndo -> ndo_snapend ; ND_TCHECK_16BITS ( & ip -> ip_len )
Buggy code:
 MonoReflectionMethod * mono_reflection_bind_generic_method_parameters ( MonoReflectionMethod * rmethod, MonoArray * types ) { MonoClass * klass ; MonoMethod * method, * inflated ; MonoMethodInflated * imethod ; MonoGenericContext tmp_context ; MonoGenericInst * ginst ; MonoType * * type_argv ; int count, i ; MONO_ARCH_SAVE_REGS ; if (! strcmp ( rmethod -> object. vtable -> klass -> name, "MethodBuilder" ) ) { # ifndef DISABLE_REFLECTION_EMIT MonoReflectionMethodBuilder * mb = NULL ; MonoReflectionTypeBuilder * tb ; MonoClass * klass ; mb = ( MonoReflectionMethodBuilder * ) rmethod ; tb = ( MonoReflectionTypeBuilder * ) mb -> type ; klass = mono_class_from_mono_type ( mono_reflection_type_get_handle ( ( MonoReflectionType * ) tb ) ) ; method = methodbuilder_to_mono_method ( klass, mb ) ; # else g_assert_not_reached ( ) ; method = NULL ; # endif } else { method = rmethod -> method ; } klass = method -> klass ; if ( method -> is_inflated ) method = ( ( MonoMethodInflated * ) method ) -> declaring ; count = mono_method_signature ( method ) -> generic_param_count ; if ( count!= mono_array_length ( types ) ) return NULL ; type_argv = g_new0 ( MonoType *, count ) ; for ( i = 0 ; i < count ; i ++ ) { MonoReflectionType * garg = mono_array_get ( types, gpointer, i ) ; type_argv [ i ] = mono_reflection_type_get_handle ( garg ) ; } ginst = mono_metadata_get_generic_inst ( count, type_argv ) ; g_free ( type_argv ) ; tmp_context. class_inst = klass -> generic_class? klass -> generic_class -> context. class_inst : NULL ; tmp_context. method_inst = ginst ; inflated = mono_class_inflate_generic_method ( method, & tmp_context ) ; im

Fix:
<S2SV_ModStart> ) ; } if (! mono_verifier_is_method_valid_generic_instantiation ( inflated ) ) mono_raise_exception ( mono_get_exception_argument ( "typeArguments", "Invalid <S2SV_blank> generic <S2SV_blank> arguments" ) ) ;
Buggy code:
 void vp8_optimize_mby ( MACROBLOCK * x ) { int b ; int type ; int has_2nd_order ; ENTROPY_CONTEXT_PLANES t_above, t_left ; ENTROPY_CONTEXT * ta ; ENTROPY_CONTEXT * tl ; if (! x -> e_mbd. above_context ) return ; if (! x -> e_mbd. left_context ) return ; <START_BUG> vpx_memcpy ( & t_above, x -> e_mbd. above_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <END_BUG>  vpx_memcpy ( & t_left, x -> e_mbd. left_context, sizeof ( ENTROPY_CONTEXT_PLANES ) ) ; <START_BUG> ta = ( ENTROPY_CONTEXT * ) & t_above ; tl = ( ENTROPY_CONTEXT * ) & t_left ; has_2nd_order = ( x -> e_mbd. mode_info_context -> mbmi. mode!= B_PRED && x -> e_mbd. mode_info_context -> mbmi. mode!= SPLITMV ) ; type = has_2nd_order? PLANE_TYPE_Y_NO_DC : PLANE_TYPE_Y_WITH_DC ; for ( b = 0 ; b < 16 ; b ++ ) { optimize_b ( x, b, type, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; } if ( has_2nd_order ) { b = 24 ; optimize_b ( x, b, PLANE_TYPE_Y2, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; check_reset_2nd_coeffs ( & x -> e_mbd, PLANE_TYPE_Y2, ta + vp8_block2above [ b ], tl + vp8_block2left [ b ] ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> ) return ; memcpy <S2SV_ModEnd> ( & t_above <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & t_left
Buggy code:
 ssize_t nghttp2_session_mem_recv ( nghttp2_session * session, const uint8_t * in, size_t inlen ) { const uint8_t * first = in, * last = in + inlen ; nghttp2_inbound_frame * iframe = & session -> iframe ; size_t readlen ; ssize_t padlen ; int rv ; int busy = 0 ; nghttp2_frame_hd cont_hd ; nghttp2_stream * stream ; size_t pri_fieldlen ; nghttp2_mem * mem ; DEBUGF ( "recv:   connection   recv_window_size=%d,   local_window=%d\\n", session -> recv_window_size, session -> local_window_size ) ; mem = & session -> mem ; rv = nghttp2_session_adjust_idle_stream ( session ) ; if ( nghttp2_is_fatal ( rv ) ) { return rv ; } if (! nghttp2_session_want_read ( session ) ) { return ( ssize_t ) inlen ; } for ( ; ; ) { switch ( iframe -> state ) { case NGHTTP2_IB_READ_CLIENT_MAGIC : readlen = nghttp2_min ( inlen, iframe -> payloadleft ) ; if ( memcmp ( & NGHTTP2_CLIENT_MAGIC [ NGHTTP2_CLIENT_MAGIC_LEN - iframe -> payloadleft ], in, readlen )!= 0 ) { return NGHTTP2_ERR_BAD_CLIENT_MAGIC ; } iframe -> payloadleft -= readlen ; in += readlen ; if ( iframe -> payloadleft == 0 ) { session_inbound_frame_reset ( session ) ; iframe -> state = NGHTTP2_IB_READ_FIRST_SETTINGS ; } break ; case NGHTTP2_IB_READ_FIRST_SETTINGS : DEBUGF ( "recv:   [IB_READ_FIRST_SETTINGS]\\n" ) ; readlen = inbound_frame_buf_read ( iframe, in, last ) ; in += readlen ; if ( nghttp2_buf_mark_avail ( & iframe -> sbuf ) ) { return in - first ; } if ( iframe -> sbuf. pos [ 3 ]!= NGHTTP2_SETTINGS || (

Fix:
<S2SV_ModStart> break ; } if ( session -> obq_flood_counter_ >= session -> max_outbound_ack &&! ( iframe -> frame. hd. flags & NGHTTP2_FLAG_ACK ) ) { return NGHTTP2_ERR_FLOODED ; }
Buggy code:
 <START_BUG> static int isofs_read_inode ( struct inode * inode ) <END_BUG> { struct super_block * sb = inode -> i_sb ; struct isofs_sb_info * sbi = ISOFS_SB ( sb ) ; unsigned long bufsize = ISOFS_BUFFER_SIZE ( inode ) ; unsigned long block ; int high_sierra = sbi -> s_high_sierra ; struct buffer_head * bh = NULL ; struct iso_directory_record * de ; struct iso_directory_record * tmpde = NULL ; unsigned int de_len ; unsigned long offset ; struct iso_inode_info * ei = ISOFS_I ( inode ) ; int ret = - EIO ; block = ei -> i_iget5_block ; bh = sb_bread ( inode -> i_sb, block ) ; if (! bh ) goto out_badread ; offset = ei -> i_iget5_offset ; de = ( struct iso_directory_record * ) ( bh -> b_data + offset ) ; de_len = * ( unsigned char * ) de ; if ( offset + de_len > bufsize ) { int frag1 = bufsize - offset ; tmpde = kmalloc ( de_len, GFP_KERNEL ) ; if ( tmpde == NULL ) { printk ( KERN_INFO "%s:   out   of   memory\\n", __func__ ) ; ret = - ENOMEM ; goto fail ; } memcpy ( tmpde, bh -> b_data + offset, frag1 ) ; brelse ( bh ) ; bh = sb_bread ( inode -> i_sb, ++ block ) ; if (! bh ) goto out_badread ; memcpy ( ( char * ) tmpde + frag1, bh -> b_data, de_len - frag1 ) ; de = tmpde ; } inode -> i_ino = isofs_get_ino ( ei -> i_iget5_block, ei -> i_iget5_offset, ISOFS_BUFFER_BITS ( inode ) ) ; ei -> i_file_format = isofs_file_normal ; if ( de -> flags [ - high_sierra ] & 2 ) { if ( sbi -> s_dmode!= ISOFS_INVALID_MODE ) inode ->

Fix:
<S2SV_ModStart> inode * inode, int relocated <S2SV_ModStart> de, inode, relocated
Buggy code:
 static int <START_BUG> _Unpickler_MemoPut ( UnpicklerObject * self, Py_ssize_t idx, PyObject * value ) <END_BUG> { PyObject * old_item ; if ( idx >= self -> memo_size ) { if ( _Unpickler_ResizeMemoList ( self, idx * 2 ) < 0 ) return - 1 ; assert ( idx < self -> memo_size ) ; } Py_INCREF ( value ) ; old_item = self -> memo [ idx ] ; self -> memo [ idx ] = value ; if ( old_item!= NULL ) { Py_DECREF ( old_item ) ; } else { self -> memo_len ++ ; } return 0 ; }

Fix:
<S2SV_ModStart> * self, size_t <S2SV_ModEnd> idx, PyObject
Buggy code:
 int decompileAction ( int n, SWF_ACTION * actions, int maxn ) { <START_BUG> if ( n > maxn ) SWF_error ( "Action   overflow!!" ) ; <END_BUG> # ifdef DEBUG fprintf ( stderr, "%d:\\tACTION[%3.3d]:   %s\\n", actions [ n ]. SWF_ACTIONRECORD. Offset, n, actionName ( actions [ n ]. SWF_ACTIONRECORD. ActionCode ) ) ; # endif  switch ( actions [ n ]. SWF_ACTIONRECORD. ActionCode ) <START_BUG> { case SWFACTION_END : return 0 ; case SWFACTION_CONSTANTPOOL : decompileCONSTANTPOOL ( & actions [ n ] ) ; return 0 ; case SWFACTION_GOTOLABEL : return decompileGOTOFRAME ( n, actions, maxn, 1 ) ; case SWFACTION_GOTOFRAME : return decompileGOTOFRAME ( n, actions, maxn, 0 ) ; case SWFACTION_GOTOFRAME2 : return decompileGOTOFRAME2 ( n, actions, maxn ) ; case SWFACTION_WAITFORFRAME : decompileWAITFORFRAME ( & actions [ n ] ) ; return 0 ; case SWFACTION_GETURL2 : decompileGETURL2 ( & actions [ n ] ) ; return 0 ; case SWFACTION_GETURL : decompileGETURL ( & actions [ n ] ) ; return 0 ; case SWFACTION_PUSH : decompilePUSH ( & actions [ n ] ) ; return 0 ; case SWFACTION_PUSHDUP : decompilePUSHDUP ( & actions [ n ] ) ; return 0 ; case SWFACTION_STACKSWAP : decompileSTACKSWAP ( & actions [ n ] ) ; return 0 ; case SWFACTION_SETPROPERTY : decompileSETPROPERTY ( n, actions, maxn ) ; return 0 ; case SWFACTION_GETPROPERTY : decompileGETPROPERTY ( n, actions, maxn ) ; return 0 ; case SWFACTION_GETTIME : return decompileGETTIME ( n, actions, maxn ) ; case SWFACTION_TRACE : decompileTRACE ( n, actions, maxn ) ; return 0 ; case SWFACTION_CALLFRAME : decompileCALLFRAME ( n, actions, maxn ) ; return 0 ; case<END_BUG>

Fix:
<S2SV_ModStart> maxn ) { <S2SV_ModEnd> # ifdef DEBUG <S2SV_ModStart> endif switch ( OpCode ( actions, n, maxn ) <S2SV_ModEnd> ) { case
Buggy code:
 int dbd_st_prepare ( SV * sth, imp_sth_t * imp_sth, char * statement, SV * attribs ) { int i ; SV * * svp ; dTHX ; # if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION # if MYSQL_VERSION_ID < CALL_PLACEHOLDER_VERSION char * str_ptr, * str_last_ptr ; # if MYSQL_VERSION_ID < LIMIT_PLACEHOLDER_VERSION int limit_flag = 0 ; # endif # endif <START_BUG> int col_type, prepare_retval ; <END_BUG> MYSQL_BIND * bind, * bind_end ; imp_sth_phb_t * fbind ; # endif D_imp_xxh ( sth ) ; D_imp_dbh_from_sth ; if ( DBIc_TRACE_LEVEL ( imp_xxh ) >= 2 ) PerlIO_printf ( DBIc_LOGPIO ( imp_xxh ), "\\t->   dbd_st_prepare   MYSQL_VERSION_ID   %d,   SQL   statement:   %s\\n", MYSQL_VERSION_ID, statement ) ; # if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION imp_sth -> use_server_side_prepare = imp_dbh -> use_server_side_prepare ; if ( attribs ) { svp = DBD_ATTRIB_GET_SVP ( attribs, "mysql_server_prepare", 20 ) ; imp_sth -> use_server_side_prepare = ( svp )? SvTRUE ( * svp ) : imp_dbh -> use_server_side_prepare ; svp = DBD_ATTRIB_GET_SVP ( attribs, "async", 5 ) ; if ( svp && SvTRUE ( * svp ) ) { # if MYSQL_ASYNC imp_sth -> is_async = TRUE ; imp_sth -> use_server_side_prepare = FALSE ; # else do_error ( sth, 2000, "Async   support   was   not   built   into   this   version   of   DBD::mysql", "HY000" ) ; return 0 ; # endif } } imp_sth -> fetch_done = 0 ; # endif imp_sth -> done_desc = 0 ; imp_sth -> result = NULL ; imp_sth ->

Fix:
<S2SV_ModStart> # endif int <S2SV_ModEnd> prepare_retval ; MYSQL_BIND <S2SV_ModStart> ( stderr, "ERROR: <S2SV_blank> Trying <S2SV_blank> to <S2SV_blank> prepare <S2SV_blank> new <S2SV_blank> stmt <S2SV_blank> while <S2SV_blank> we <S2SV_blank> have <S2SV_blank> \\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> already <S2SV_blank> not <S2SV_blank> closed <S2SV_blank> one <S2SV_blank> \\n" <S2SV_ModEnd> ) ; imp_sth <S2SV_ModStart> imp_xxh ), "\\t\\tERROR: <S2SV_blank> Unable <S2SV_blank> to <S2SV_blank> return <S2SV_blank> MYSQL_STMT <S2SV_blank> structure <S2SV_blank> \\\n <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> <S2SV_blank> from <S2SV_blank> mysql_stmt_init(): <S2SV_blank> ERROR <S2SV_blank> NO: <S2SV_blank> %d <S2SV_blank> ERROR <S2SV_blank> MSG:%s\\n" <S2SV_ModEnd>, mysql_errno ( <S2SV_ModStart> 0 ) { <S2SV_ModEnd> imp_sth -> bind <S2SV_ModStart> ++ ) { bind -> buffer_type = MYSQL_TYPE_STRING <S2SV_ModEnd> ; bind ->
Buggy code:
 static Image * ReadDDSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status, cubemap = MagickFalse, volume = MagickFalse, matte ; CompressionType compression ; DDSInfo dds_info ; DDSDecoder * decoder ; size_t n, num_images ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } if ( ReadDDSInfo ( image, & dds_info )!= MagickTrue ) { ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; } if ( dds_info. ddscaps2 & DDSCAPS2_CUBEMAP ) cubemap = MagickTrue ; if ( dds_info. ddscaps2 & DDSCAPS2_VOLUME && dds_info. depth > 0 ) volume = MagickTrue ; ( void ) SeekBlob ( image, 128, SEEK_SET ) ; if ( dds_info. pixelformat. flags & DDPF_RGB ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { matte = MagickTrue ; decoder = ReadUncompressedRGBA ; } else { matte = MagickTrue ; decoder = ReadUncompressedRGB ; } } else if ( dds_info. pixelformat. flags & DDPF_LUMINANCE ) { compression = NoCompression ; if ( dds_info. pixelformat. flags & DDPF_ALPHAPIXELS ) { ThrowReaderException ( CorruptImageError, "ImageTypeNotSupported" ) ; } else { matte = MagickFalse ; decoder = ReadUn

Fix:
<S2SV_ModStart> ) ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 int credential_from_url_gently ( struct credential * c, const char * url, int quiet ) { const char * at, * colon, * cp, * slash, * host, * proto_end ; credential_clear ( c ) ; proto_end = strstr ( url, ":////" ) ; <START_BUG> if (! proto_end ) <END_BUG> return 0 ; cp = proto_end + 3 ; at = strchr ( cp, '@' ) ; colon = strchr ( cp, ':' ) ; slash = strchrnul ( cp, '//' ) ; if (! at || slash <= at ) { host = cp ; } else if (! colon || at <= colon ) { c -> username = url_decode_mem ( cp, at - cp ) ; host = at + 1 ; } else { c -> username = url_decode_mem ( cp, colon - cp ) ; c -> password = url_decode_mem ( colon + 1, at - ( colon + 1 ) ) ; host = at + 1 ; } if ( proto_end - url > 0 ) c -> protocol = xmemdupz ( url, proto_end - url ) ; c -> host = url_decode_mem ( host, slash - host ) ; while ( * slash == '//' ) slash ++ ; if ( * slash ) { char * p ; c -> path = url_decode ( slash ) ; p = c -> path + strlen ( c -> path ) - 1 ; while ( p > c -> path && * p == '//' ) * p -- = '\\0' ; } if ( check_url_component ( url, quiet, "username", c -> username ) < 0 || check_url_component ( url, quiet, "password", c -> password ) < 0 || check_url_component ( url, quiet, "protocol", c -> protocol ) < 0 || check_url_component ( url, quiet, "host", c -> host ) < 0 || check_url_component ( url, quiet, "path", c -> path ) < 0 ) return - 1 ; return 0 ; }

Fix:
<S2SV_ModStart>! proto_end ) { if (! quiet ) warning ( _ ( "url <S2SV_blank> has <S2SV_blank> no <S2SV_blank> scheme: <S2SV_blank> %s" ), url ) ; return - 1 ; } <S2SV_ModEnd> cp = proto_end
Buggy code:
 static int cbs_av1_read_uvlc ( CodedBitstreamContext * ctx, GetBitContext * gbc, const char * name, uint32_t * write_to, uint32_t range_min, uint32_t range_max ) { <START_BUG> uint32_t value ; <END_BUG>  int position, zeroes, i, j ; <START_BUG> char bits [ 65 ] ; if ( ctx -> trace_enable ) position = get_bits_count ( gbc ) ; <END_BUG> zeroes = i = 0 ;  while ( 1 ) { <START_BUG> if ( get_bits_left ( gbc ) < zeroes + 1 ) { <END_BUG> av_log ( ctx -> log_ctx, AV_LOG_ERROR, "Invalid   uvlc   code   at   " "%s:   bitstream   ended.\\n", name ) ; return AVERROR_INVALIDDATA ; }  if ( get_bits1 ( gbc ) ) { <START_BUG> bits [ i ++ ] = '1' ; <END_BUG> break ;  } else { bits [ i ++ ] = '0' ; ++ zeroes ; } } if ( zeroes >= 32 ) { value = MAX_UINT_BITS ( 32 ) ; } else { value = get_bits_long ( gbc, zeroes ) ; for ( j = 0 ; j < zeroes ; j ++ ) <START_BUG> bits [ i ++ ] = ( value >> ( zeroes - j - 1 ) & 1 )? '1' : '0' ; <END_BUG>  value += ( 1 << zeroes ) - 1 ; <START_BUG> } if ( ctx -> trace_enable ) { bits [ i ] = 0 ; ff_cbs_trace_syntax_element ( ctx, position, name, NULL, bits, value ) ; } if ( value < range_min || value > range_max ) { av_log ( ctx -> log_ctx, AV_LOG_ERROR, "%s   out   of   range:   " "%" PRIu32 ",   but   must   be   in   [%" PRIu32 ",%" PRIu32 "].\\n", name, value, range_min, range_max ) ; return AVERROR_INVALIDDATA ; } * write_to = value ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { uint32_t zeroes, bits_value, <S2SV_ModStart> ; int position <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; zeroes = <S2SV_ModEnd> 0 ; while <S2SV_ModStart> gbc ) < <S2SV_ModEnd> 1 ) { <S2SV_ModStart> gbc ) ) break ; ++ zeroes ; } if ( zeroes >= 32 ) { value = MAX_UINT_BITS ( 32 ) ; } else { if ( get_bits_left ( gbc ) < zeroes ) { av_log ( ctx -> log_ctx, AV_LOG_ERROR, "Invalid <S2SV_blank> uvlc <S2SV_blank> code <S2SV_blank> at <S2SV_blank> " "%s: <S2SV_blank> bitstream <S2SV_blank> ended.\\n", name ) ; return AVERROR_INVALIDDATA ; } bits_value = get_bits_long ( gbc, zeroes ) ; value = bits_value + ( UINT32_C ( 1 ) << zeroes ) - 1 ; } if ( ctx -> trace_enable ) { char bits [ 65 ] ; int i, j, k ; if ( zeroes >= 32 ) { while ( zeroes > 32 ) { k = FFMIN ( zeroes - 32, 32 ) ; for ( i = 0 ; i < k ; i ++ ) bits [ i ] = '0' ; bits
Buggy code:
 long do_io_submit ( aio_context_t ctx_id, long nr, struct iocb __user * __user * iocbpp, bool compat ) { struct kioctx * ctx ; long ret = 0 ; int i = 0 ; struct blk_plug plug ; struct kiocb_batch batch ; if ( unlikely ( nr < 0 ) ) return - EINVAL ; if ( unlikely ( nr > LONG_MAX // sizeof ( * iocbpp ) ) ) nr = LONG_MAX // sizeof ( * iocbpp ) ; if ( unlikely (! access_ok ( VERIFY_READ, iocbpp, ( nr * sizeof ( * iocbpp ) ) ) ) ) return - EFAULT ; ctx = lookup_ioctx ( ctx_id ) ; if ( unlikely (! ctx ) ) { pr_debug ( "EINVAL:   io_submit:   invalid   context   id\\n" ) ; return - EINVAL ; } kiocb_batch_init ( & batch, nr ) ; blk_start_plug ( & plug ) ; for ( i = 0 ; i < nr ; i ++ ) { struct iocb __user * user_iocb ; struct iocb tmp ; if ( unlikely ( __get_user ( user_iocb, iocbpp + i ) ) ) { ret = - EFAULT ; break ; } if ( unlikely ( copy_from_user ( & tmp, user_iocb, sizeof ( tmp ) ) ) ) { ret = - EFAULT ; break ; } ret = io_submit_one ( ctx, user_iocb, & tmp, & batch, compat ) ; if ( ret ) break ; } blk_finish_plug ( & plug ) ; <START_BUG> kiocb_batch_free ( & batch ) ; <END_BUG> put_ioctx ( ctx ) ; return i? i : ret ; }

Fix:
<S2SV_ModStart> ; kiocb_batch_free ( ctx,
Buggy code:
 static int udf_read_inode ( struct inode * inode, bool hidden_inode ) { struct buffer_head * bh = NULL ; struct fileEntry * fe ; struct extendedFileEntry * efe ; uint16_t ident ; struct udf_inode_info * iinfo = UDF_I ( inode ) ; struct udf_sb_info * sbi = UDF_SB ( inode -> i_sb ) ; struct kernel_lb_addr * iloc = & iinfo -> i_location ; unsigned int link_count ; unsigned int indirections = 0 ; int ret = - EIO ; reread : if ( iloc -> logicalBlockNum >= sbi -> s_partmaps [ iloc -> partitionReferenceNum ]. s_partition_len ) { udf_debug ( "block=%d,   partition=%d   out   of   range\\n", iloc -> logicalBlockNum, iloc -> partitionReferenceNum ) ; return - EIO ; } bh = udf_read_ptagged ( inode -> i_sb, iloc, 0, & ident ) ; if (! bh ) { udf_err ( inode -> i_sb, "(ino   %ld)   failed  !bh\\n", inode -> i_ino ) ; return - EIO ; } if ( ident!= TAG_IDENT_FE && ident!= TAG_IDENT_EFE && ident!= TAG_IDENT_USE ) { udf_err ( inode -> i_sb, "(ino   %ld)   failed   ident=%d\\n", inode -> i_ino, ident ) ; goto out ; } fe = ( struct fileEntry * ) bh -> b_data ; efe = ( struct extendedFileEntry * ) bh -> b_data ; if ( fe -> icbTag. strategyType == cpu_to_le16 ( 4096 ) ) { struct buffer_head * ibh ; ibh = udf_read_ptagged ( inode -> i_sb, iloc, 1, & ident ) ; if ( ident == TAG_IDENT_IE && ibh ) { struct kernel_lb_addr loc ; struct indirectEntry * ie ; ie = ( struct indirectEntry * ) ibh -> b_data ; loc = lelb_to_cpu ( ie -> indirectICB. extLocation ) ; if ( ie -> indirectICB. extLength ) { brelse ( ibh ) ; mem

Fix:
<S2SV_ModStart> -> i_unique ; if ( iinfo -> i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ) { if ( iinfo -> i_lenAlloc!= inode -> i_size ) goto out ; if ( inode -> i_size > inode -> i_sb -> s_blocksize - udf_file_entry_alloc_offset ( inode ) ) goto out ; }
Buggy code:
 PyObject * ast2obj_alias ( void * _o ) { alias_ty o = ( alias_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } result = PyType_GenericNew ( alias_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_identifier ( o -> name ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_name, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_identifier ( o -> asname ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_asname, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } result
Buggy code:
 static void tokenize_b ( int plane, int block, BLOCK_SIZE plane_bsize, TX_SIZE tx_size, void * arg ) { struct tokenize_b_args * const args = arg ; VP9_COMP * cpi = args -> cpi ; <START_BUG> MACROBLOCKD * xd = args -> xd ; <END_BUG> TOKENEXTRA * * tp = args -> tp ; uint8_t token_cache [ 32 * 32 ] ;  struct macroblock_plane * p = & cpi -> mb. plane [ plane ] ; <START_BUG> struct macroblockd_plane * pd = & xd -> plane [ plane ] ; MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; int pt ; int c ; TOKENEXTRA * t = * tp ; int eob = p -> eobs [ block ] ; const PLANE_TYPE type = pd -> plane_type ; <END_BUG> const int16_t * qcoeff = BLOCK_OFFSET ( p -> qcoeff, block ) ;  const int segment_id = mbmi -> segment_id ; const int16_t * scan, * nb ; const scan_order * so ; const int ref = is_inter_block ( mbmi ) ; unsigned int ( * const counts ) [ COEFF_CONTEXTS ] [ ENTROPY_TOKENS ] = cpi -> coef_counts [ tx_size ] [ type ] [ ref ] ; vp9_prob ( * const coef_probs ) [ COEFF_CONTEXTS ] [ UNCONSTRAINED_NODES ] = <START_BUG> cpi -> common. fc. coef_probs [ tx_size ] [ type ] [ ref ] ; <END_BUG> unsigned int ( * const eob_branch ) [ COEFF_CONTEXTS ] =  cpi -> common. counts. eob_branch [ tx_size ] [ type ] [ ref ] ; <START_BUG> const uint8_t * const band = get_band_translate ( tx_size ) ; const int seg_eob = get_tx_eob ( & cpi -> common. seg, segment_id, tx_size ) ; <END_BUG> int aoff, loff ;  txfrm_block_to_raster_xy ( plane_bsize, tx_size, block, & aoff, & loff ) ; pt = get_entropy_context ( tx_size, pd -> above_context

Fix:
<S2SV_ModStart> -> cpi ; ThreadData * const td = args -> td ; MACROBLOCK * const x = & td -> mb ; MACROBLOCKD * const xd = & x -> e_mbd <S2SV_ModEnd> ; TOKENEXTRA * <S2SV_ModStart> p = & x -> <S2SV_ModEnd> plane [ plane <S2SV_ModStart> plane_type ; const tran_low_t * qcoeff = BLOCK_OFFSET ( p -> qcoeff, block ) ; const int segment_id = mbmi -> segment_id ; const int16_t * scan, * nb ; const scan_order * so ; const int ref = is_inter_block ( mbmi ) ; unsigned int ( * const counts ) [ COEFF_CONTEXTS ] [ ENTROPY_TOKENS ] = td -> rd_counts. coef_counts [ tx_size ] [ type ] [ ref ] ; vpx_prob <S2SV_ModEnd> ( * const <S2SV_ModStart> common. fc -> <S2SV_ModEnd> coef_probs [ tx_size <S2SV_ModStart> COEFF_CONTEXTS ] = td -> counts -> <S2SV_ModEnd> eob_branch [ tx_size <S2SV_ModStart> tx_size ) ; int16_t token ; EXTRABIT extra ; <S2SV_ModStart> ] ; } vp9_get_token_extra ( v, & token, & extra )
Buggy code:
 static ssize_t _hostsock_recv ( oe_fd_t * sock_, void * buf, size_t count, int flags ) { ssize_t ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_errno = 0 ; <START_BUG> if (! sock || ( count &&! buf ) ) <END_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; if ( buf ) { if ( oe_memset_s ( buf, count, 0, count )!= OE_OK ) OE_RAISE_ERRNO ( OE_EINVAL ) ; } if ( oe_syscall_recv_ocall ( & ret, sock -> host_fd, buf, count, flags )!= OE_OK ) OE_RAISE_ERRNO ( OE_EINVAL ) ;  done : <START_BUG> return ret ; }<END_BUG>

Fix:
<S2SV_ModStart>! buf ) || count > OE_SSIZE_MAX <S2SV_ModStart> OE_EINVAL ) ; if ( ret > ( ssize_t ) count ) { ret = - 1 ; OE_RAISE_ERRNO ( OE_EINVAL ) ; }
Buggy code:
 R_API char * r_socket_http_post ( const char * url, const char * data, int * code, int * rlen ) { RSocket * s ; bool ssl = r_str_startswith ( url, "https:////" ) ; char * uri = strdup ( url ) ; if (! uri ) { return NULL ; } char * host = strstr ( uri, ":////" ) ; if (! host ) { free ( uri ) ; printf ( "Invalid   URI" ) ; return NULL ; } host += 3 ; char * port = strchr ( host, ':' ) ; if (! port ) { port = ( ssl )? "443" : "80" ; } else { * port ++ = 0 ; } char * path = strchr ( host, '//' ) ; if (! path ) { path = "" ; } else { * path ++ = 0 ; } s = r_socket_new ( ssl ) ; if (! s ) { printf ( "Cannot   create   socket\\n" ) ; free ( uri ) ; return NULL ; } if (! r_socket_connect_tcp ( s, host, port, 0 ) ) { eprintf ( "Cannot   connect   to   %s:%s\\n", host, port ) ; free ( uri ) ; return NULL ; } r_socket_printf ( s, "POST   //%s   HTTP//1.0\\r\\n" "User-Agent:   radare2   " R2_VERSION "\\r\\n" "Accept:   *//*\\r\\n" "Host:   %s\\r\\n" "Content-Length:   %i\\r\\n" "Content-Type:   application//x-www-form-urlencoded\\r\\n" "\\r\\n", path, host, ( int ) strlen ( data ) ) ; free ( uri ) ; r_socket_write ( s, ( void * ) data, strlen ( data ) ) ; <START_BUG> return r_socket_http_answer ( s, code, rlen ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return socket_http_answer <S2SV_ModEnd> ( s, <S2SV_ModStart> code, rlen, 0
Buggy code:
 static PyObject * patch ( PyObject * self, PyObject * args ) { char * origData, * newData, * diffBlock, * extraBlock, * diffPtr, * extraPtr ; Py_ssize_t origDataLength, newDataLength, diffBlockLength, extraBlockLength ; PyObject * controlTuples, * tuple, * results ; off_t oldpos, newpos, x, y, z ; int i, j, numTuples ; if (! PyArg_ParseTuple ( args, "s#nO!s#s#", & origData, & origDataLength, & newDataLength, & PyList_Type, & controlTuples, & diffBlock, & diffBlockLength, & extraBlock, & extraBlockLength ) ) return NULL ; newData = PyMem_Malloc ( newDataLength + 1 ) ; if (! newData ) return PyErr_NoMemory ( ) ; oldpos = 0 ; newpos = 0 ; diffPtr = diffBlock ; extraPtr = extraBlock ; numTuples = PyList_GET_SIZE ( controlTuples ) ; for ( i = 0 ; i < numTuples ; i ++ ) { tuple = PyList_GET_ITEM ( controlTuples, i ) ; if (! PyTuple_Check ( tuple ) ) { PyMem_Free ( newData ) ; PyErr_SetString ( PyExc_TypeError, "expecting   tuple" ) ; return NULL ; } if ( PyTuple_GET_SIZE ( tuple )!= 3 ) { PyMem_Free ( newData ) ; PyErr_SetString ( PyExc_TypeError, "expecting   tuple   of   size   3" ) ; return NULL ; } x = PyLong_AsLong ( PyTuple_GET_ITEM ( tuple, 0 ) ) ; y = PyLong_AsLong ( PyTuple_GET_ITEM ( tuple, 1 ) ) ; z = PyLong_AsLong ( PyTuple_GET_ITEM ( tuple, 2 ) ) ; if ( newpos + x > newDataLength || <START_BUG> diffPtr + x > diffBlock + diffBlockLength || <END_BUG> extraPtr + y > extraBlock + extraBlockLength ) { PyMem_Free ( newData ) ; PyErr_SetString ( PyExc_ValueError, "corrupt   patch   (overflow)" ) ; return NULL ; }  memcpy ( newData + newpos, diffPtr, x ) ; <START_BUG> diff<END_BUG>

Fix:
<S2SV_ModStart> diffBlock + diffBlockLength ) { PyMem_Free ( newData ) ; PyErr_SetString ( PyExc_ValueError, "corrupt <S2SV_blank> patch <S2SV_blank> (overflow)" ) ; return NULL ; } memcpy ( newData + newpos, diffPtr, x ) ; diffPtr += x ; for ( j = 0 ; j < x ; j ++ ) if ( ( oldpos + j >= 0 ) && ( oldpos + j < origDataLength ) ) newData [ newpos + j ] += origData [ oldpos + j ] ; newpos += x ; oldpos += x ; if ( newpos + y > newDataLength <S2SV_ModStart> NULL ; } <S2SV_ModEnd> memcpy ( newData
Buggy code:
 vpx_fixed_buf_t * vpx_codec_get_global_headers ( vpx_codec_ctx_t * ctx ) { vpx_fixed_buf_t * buf = NULL ; if ( ctx ) { if (! ctx -> iface ||! ctx -> priv ) ctx -> err = VPX_CODEC_ERROR ; else if (! ( ctx -> iface -> caps & VPX_CODEC_CAP_ENCODER ) ) ctx -> err = VPX_CODEC_INCAPABLE ; else if (! ctx -> iface -> enc. get_glob_hdrs ) ctx -> err = VPX_CODEC_INCAPABLE ; else <START_BUG> buf = ctx -> iface -> enc. get_glob_hdrs ( ctx -> priv -> alg_priv ) ; <END_BUG> } return buf ; }

Fix:
<S2SV_ModStart>. get_glob_hdrs ( get_alg_priv ( ctx ) <S2SV_ModEnd> ) ; }
Buggy code:
 static int ax25_create ( struct net * net, struct socket * sock, int protocol, int kern ) { struct sock * sk ; ax25_cb * ax25 ; <START_BUG> if (! net_eq ( net, & init_net ) ) <END_BUG> return - EAFNOSUPPORT ; switch ( sock -> type ) { case SOCK_DGRAM : if ( protocol == 0 || protocol == PF_AX25 ) protocol = AX25_P_TEXT ; break ; case SOCK_SEQPACKET : switch ( protocol ) { case 0 : case PF_AX25 : protocol = AX25_P_TEXT ; break ; case AX25_P_SEGMENT : # ifdef CONFIG_INET case AX25_P_ARP : case AX25_P_IP : # endif # ifdef CONFIG_NETROM case AX25_P_NETROM : # endif # ifdef CONFIG_ROSE case AX25_P_ROSE : # endif return - ESOCKTNOSUPPORT ; # ifdef CONFIG_NETROM_MODULE case AX25_P_NETROM : if ( ax25_protocol_is_registered ( AX25_P_NETROM ) ) return - ESOCKTNOSUPPORT ; break ; # endif # ifdef CONFIG_ROSE_MODULE case AX25_P_ROSE : if ( ax25_protocol_is_registered ( AX25_P_ROSE ) ) return - ESOCKTNOSUPPORT ; # endif default : break ; } break ; case SOCK_RAW : break ; default : return - ESOCKTNOSUPPORT ; } sk = sk_alloc ( net, PF_AX25, GFP_ATOMIC, & ax25_proto, kern ) ; if ( sk == NULL ) return - ENOMEM ; ax25 = ax25_sk ( sk ) -> cb = ax25_create_cb ( ) ; if (! ax25 ) { sk_free ( sk ) ; return - ENOMEM ; } sock_init_data ( sock, sk ) ; sk -> sk_destruct = ax25_free_sock ; sock -> ops = & ax25_proto_ops ; sk -> sk_protocol = protocol ; ax25 -> sk = sk ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( protocol < 0 || protocol > SK_PROTOCOL_MAX ) return - EINVAL ; if (
Buggy code:
 void bn_sqr_comba8 ( BN_ULONG * r, const BN_ULONG * a ) { <START_BUG> BN_ULONG t1, t2 ; <END_BUG> BN_ULONG c1, c2, c3 ; c1 = 0 ; c2 = 0 ; c3 = 0 ; sqr_add_c ( a, 0, c1, c2, c3 ) ; r [ 0 ] = c1 ; c1 = 0 ; sqr_add_c2 ( a, 1, 0, c2, c3, c1 ) ; r [ 1 ] = c2 ; c2 = 0 ; sqr_add_c ( a, 1, c3, c1, c2 ) ; sqr_add_c2 ( a, 2, 0, c3, c1, c2 ) ; r [ 2 ] = c3 ; c3 = 0 ; sqr_add_c2 ( a, 3, 0, c1, c2, c3 ) ; sqr_add_c2 ( a, 2, 1, c1, c2, c3 ) ; r [ 3 ] = c1 ; c1 = 0 ; sqr_add_c ( a, 2, c2, c3, c1 ) ; sqr_add_c2 ( a, 3, 1, c2, c3, c1 ) ; sqr_add_c2 ( a, 4, 0, c2, c3, c1 ) ; r [ 4 ] = c2 ; c2 = 0 ; sqr_add_c2 ( a, 5, 0, c3, c1, c2 ) ; sqr_add_c2 ( a, 4, 1, c3, c1, c2 ) ; sqr_add_c2 ( a, 3, 2, c3, c1, c2 ) ; r [ 5 ] = c3 ; c3 = 0 ; sqr_add_c ( a, 3, c1, c2, c3 ) ; sqr_add_c2 ( a, 4, 2, c1, c2, c3 ) ; sqr_add_c2 ( a, 5, 1, c1, c2, c3 ) ; sqr_add_c2 ( a, 6

Fix:
<S2SV_ModStart> ) { BN_ULONG <S2SV_ModEnd> c1, c2
Buggy code:
 int serverCron ( struct aeEventLoop * eventLoop, long long id, void * clientData ) { int j, loops = server. cronloops ++ ; REDIS_NOTUSED ( eventLoop ) ; REDIS_NOTUSED ( id ) ; REDIS_NOTUSED ( clientData ) ; server. unixtime = time ( NULL ) ; updateLRUClock ( ) ; if ( server. shutdown_asap ) { if ( prepareForShutdown ( ) == REDIS_OK ) exit ( 0 ) ; redisLog ( REDIS_WARNING, "SIGTERM   received   but   errors   trying   to   shut   down   the   server,   check   the   logs   for   more   information" ) ; } for ( j = 0 ; j < server. dbnum ; j ++ ) { long long size, used, vkeys ; size = dictSlots ( server. db [ j ]. dict ) ; used = dictSize ( server. db [ j ]. dict ) ; vkeys = dictSize ( server. db [ j ]. expires ) ; if (! ( loops % 50 ) && ( used || vkeys ) ) { redisLog ( REDIS_VERBOSE, "DB   %d:   %lld   keys   (%lld   volatile)   in   %lld   slots   HT.", j, used, vkeys, size ) ; } } if ( server. bgsavechildpid == - 1 && server. bgrewritechildpid == - 1 ) { if (! ( loops % 10 ) ) tryResizeHashTables ( ) ; if ( server. activerehashing ) incrementallyRehash ( ) ; } if (! ( loops % 50 ) ) { redisLog ( REDIS_VERBOSE, "%d   clients   connected   (%d   slaves),   %zu   bytes   in   use", listLength ( server. clients ) - listLength ( server. slaves ), listLength ( server. slaves ), zmalloc_used_memory ( ) ) ; } if ( ( server. maxidletime &&! ( loops % 100 ) ) || server. bpop_blocked_clients ) closeTimedoutClients ( ) ; if ( server. bgsavechildpid!= - 1 || server. bgrewritechildpid!= - 1 ) { int statloc ; pid_t pid ; if ( ( pid = wait

Fix:
<S2SV_ModStart> ( ) ; <S2SV_ModEnd> while ( server <S2SV_ModStart> ( server. ds_enabled <S2SV_ModEnd> && zmalloc_used_memory ( <S2SV_ModStart> > server. cache_max_memory ) { cacheFreeOneEntry ( ) ; <S2SV_ModEnd> } if (
Buggy code:
 static void build_intra_predictors ( const MACROBLOCKD * xd, const uint8_t * ref, int ref_stride, uint8_t * dst, int dst_stride, <START_BUG> MB_PREDICTION_MODE mode, TX_SIZE tx_size, <END_BUG> int up_available, int left_available, int right_available, int x, int y, int plane ) { int i ;  DECLARE_ALIGNED_ARRAY ( 16, uint8_t, left_col, 64 ) ; <START_BUG> DECLARE_ALIGNED_ARRAY ( 16, uint8_t, above_data, 128 + 16 ) ; uint8_t * above_row = above_data + 16 ; const uint8_t * const_above_row = above_row ; const int bs = 4 << tx_size ; int frame_width, frame_height ; int x0, y0 ; const struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; <END_BUG> once ( init_intra_pred_fn_ptrs ) ;  if ( plane == 0 ) { frame_width = xd -> cur_buf -> y_width ; frame_height = xd -> cur_buf -> y_height ; } else { frame_width = xd -> cur_buf -> uv_width ; frame_height = xd -> cur_buf -> uv_height ; } x0 = ( - xd -> mb_to_left_edge >> ( 3 + pd -> subsampling_x ) ) + x ; y0 = ( - xd -> mb_to_top_edge >> ( 3 + pd -> subsampling_y ) ) + y ; <START_BUG> vpx_memset ( left_col, 129, 64 ) ; <END_BUG> if ( left_available ) { if ( xd -> mb_to_bottom_edge < 0 ) { if ( y0 + bs <= frame_height ) { for ( i = 0 ; i < bs ; ++ i ) left_col [ i ] = ref [ i * ref_stride - 1 ] ; } else { const int extend_bottom = frame_height - y0 ; for ( i = 0 ; i < extend_bottom ; ++ i ) left_col [ i ] = ref [ i * ref_stride - 1 ] ; for ( ; i < bs ; ++ i ) left_col [ i ] =

Fix:
<S2SV_ModStart> int dst_stride, PREDICTION_MODE <S2SV_ModEnd> mode, TX_SIZE <S2SV_ModStart> int i ; DECLARE_ALIGNED <S2SV_ModEnd> ( 16, <S2SV_ModStart> uint8_t, left_col [ 32 ] ) ; DECLARE_ALIGNED ( 16, uint8_t, above_data [ 64 + 16 ] <S2SV_ModEnd> ) ; uint8_t <S2SV_ModStart> plane ] ; <S2SV_ModEnd> if ( plane <S2SV_ModStart> + y ; if ( extend_modes [ mode ] & NEED_LEFT ) { <S2SV_ModEnd> if ( left_available <S2SV_ModStart> ; } } else { memset ( left_col, 129, bs ) ; } } if ( extend_modes [ mode ] & NEED_ABOVE ) { <S2SV_ModStart> ( x0 + <S2SV_ModEnd> bs <= frame_width <S2SV_ModStart> frame_width ) { memcpy ( above_row, above_ref, bs ) ; } else if ( x0 <S2SV_ModEnd> <= frame_width ) <S2SV_ModStart> - x0 ; memcpy ( above_row, above_ref, r ) ; memset ( above_row + r, above_row [ r - 1 ], x0 + bs - frame_width ) ; } <S2SV_ModEnd> } else { <S2SV_ModStart> } else { memcpy ( above_row