nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int update_fragments ( vpx_codec_alg_priv_t * ctx, const uint8_t * data, unsigned int data_sz, vpx_codec_err_t * res ) { * res = VPX_CODEC_OK ; if ( ctx -> fragments. count == 0 ) { <START_BUG> vpx_memset ( ( void * ) ctx -> fragments. ptrs, 0, sizeof ( ctx -> fragments. ptrs ) ) ; <END_BUG>  vpx_memset ( ctx -> fragments. sizes, 0, sizeof ( ctx -> fragments. sizes ) ) ; <START_BUG> } if ( ctx -> fragments. enabled &&! ( data == NULL && data_sz == 0 ) ) { ctx -> fragments. ptrs [ ctx -> fragments. count ] = data ; ctx -> fragments. sizes [ ctx -> fragments. count ] = data_sz ; ctx -> fragments. count ++ ; if ( ctx -> fragments. count > ( 1 << EIGHT_PARTITION ) + 1 ) { ctx -> fragments. count = 0 ; * res = VPX_CODEC_INVALID_PARAM ; return - 1 ; } return 0 ; } <END_BUG> if (! ctx -> fragments. enabled )  { ctx -> fragments. ptrs [ 0 ] = data ; ctx -> fragments. sizes [ 0 ] = data_sz ; ctx -> fragments. count = 1 ; } return 1 ; }

Fix:
<S2SV_ModStart> 0 ) { memset <S2SV_ModEnd> ( ( void <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( ctx -> <S2SV_ModStart> fragments. enabled && ( data == NULL && data_sz == 0 ) ) { return 0 ; } if (! ctx -> fragments. enabled
Buggy code:
 void enc28j60WritePhyReg ( NetInterface * interface, uint16_t address, uint16_t data ) { <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MIREGADR, address & REG_ADDR_MASK ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_MIWRL, LSB ( data ) ) ; <START_BUG> <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_MIWRH, MSB ( data ) ) ;  <START_BUG> while ( ( enc28j60ReadReg ( interface, ENC28J60_REG_MISTAT ) & MISTAT_BUSY )!= 0 ) <END_BUG> { } }

Fix:
<S2SV_ModStart> ( interface, ENC28J60_MIREGADR <S2SV_ModEnd>, address & <S2SV_ModStart> ( interface, ENC28J60_MIWRL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_MIWRH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_MISTAT ) & ENC28J60_MISTAT_BUSY <S2SV_ModEnd> )!= 0
Buggy code:
 qboolean S_AL_Init ( soundInterface_t * si ) { # ifdef USE_OPENAL const char * device = NULL ; const char * inputdevice = NULL ; int i ; if (! si ) { return qfalse ; } for ( i = 0 ; i < MAX_RAW_STREAMS ; i ++ ) { streamSourceHandles [ i ] = - 1 ; streamPlaying [ i ] = qfalse ; streamSources [ i ] = 0 ; streamNumBuffers [ i ] = 0 ; streamBufIndex [ i ] = 0 ; } s_alPrecache = Cvar_Get ( "s_alPrecache", "1", CVAR_ARCHIVE ) ; s_alGain = Cvar_Get ( "s_alGain", "1.0", CVAR_ARCHIVE ) ; s_alSources = Cvar_Get ( "s_alSources", "128", CVAR_ARCHIVE ) ; s_alDopplerFactor = Cvar_Get ( "s_alDopplerFactor", "1.0", CVAR_ARCHIVE ) ; s_alDopplerSpeed = Cvar_Get ( "s_alDopplerSpeed", "9000", CVAR_ARCHIVE ) ; s_alMinDistance = Cvar_Get ( "s_alMinDistance", "120", CVAR_CHEAT ) ; s_alMaxDistance = Cvar_Get ( "s_alMaxDistance", "1024", CVAR_CHEAT ) ; s_alRolloff = Cvar_Get ( "s_alRolloff", "2", CVAR_CHEAT ) ; s_alGraceDistance = Cvar_Get ( "s_alGraceDistance", "512", CVAR_CHEAT ) ; <START_BUG> s_alDriver = Cvar_Get ( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH ) ; <END_BUG> s_alInputDevice = Cvar_Get ( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_LATCH ) ;  s_alDevice = Cvar_Get ( "s_alDevice", "", CVAR_ARCHIVE | CVAR_LATCH ) ;

Fix:
<S2SV_ModStart> CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED <S2SV_ModStart> CVAR_LATCH ) ; if ( COM_CompareExtension ( s_alDriver -> string, ".pk3" ) ) { Com_Printf ( "Rejecting <S2SV_blank> DLL <S2SV_blank> named <S2SV_blank> \\"%s\\"", s_alDriver -> string ) ; return qfalse ; }
Buggy code:
 static HeadReturn con_header_read ( agooCon c, size_t * mlenp ) { char * hend = strstr ( c -> buf, "\\r\\n\\r\\n" ) ; agooMethod method ; struct _agooSeg path ; char * query = NULL ; char * qend ; char * b ; size_t clen = 0 ; long mlen ; agooHook hook = NULL ; agooPage p ; struct _agooErr err = AGOO_ERR_INIT ; if ( NULL == hend ) { if ( sizeof ( c -> buf ) - 1 <= c -> bcnt ) { return bad_request ( c, 431, __LINE__ ) ; } return HEAD_AGAIN ; } if ( agoo_req_cat. on ) { * hend = '\\0' ; agoo_log_cat ( & agoo_req_cat, "%s   %llu:   %s", agoo_con_kind_str ( c -> bind -> kind ), ( unsigned long long ) c -> id, c -> buf ) ; * hend = '\\r' ; } for ( b = c -> buf ;'  '!= * b ; b ++ ) { if ( '\\0' == * b ) { return bad_request ( c, 400, __LINE__ ) ; } } switch ( toupper ( * c -> buf ) ) { case 'G' : if ( 3!= b - c -> buf || 0!= strncmp ( "GET", c -> buf, 3 ) ) { return bad_request ( c, 400, __LINE__ ) ; } method = AGOO_GET ; break ; case 'P' : { const char * v ; int vlen = 0 ; char * vend ; if ( 3 == b - c -> buf && 0 == strncmp ( "PUT", c -> buf, 3 ) ) { method = AGOO_PUT ; } else if ( 4 == b - c -> buf && 0 == strncmp ( "POST", c -> buf, 4 ) ) { method = AGOO_POST ; } else { return bad_request ( c, 400, __LINE__ ) ; } if ( NULL == ( v = agoo_con_header_value ( c -> buf, ( int ) ( hend - c -> buf ),

Fix:
<S2SV_ModStart> = NULL ; memcpy ( c -> req -> remote, c -> remote, sizeof ( c -> remote ) ) ;
Buggy code:
 struct key * request_key_and_link ( struct key_type * type, const char * description, const void * callout_info, size_t callout_len, void * aux, struct key * dest_keyring, unsigned long flags ) { struct keyring_search_context ctx = {. index_key. type = type,. index_key. description = description,. cred = current_cred ( ), <START_BUG>. match_data. cmp = type -> match, <END_BUG>. match_data. raw_data = description,. match_data. lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT, } ; struct key * key ; key_ref_t key_ref ; int ret ; kenter ( "%s,%s,%p,%zu,%p,%p,%lx", ctx. index_key. type -> name, ctx. index_key. description, callout_info, callout_len, aux, dest_keyring, flags ) ; if ( type -> match_preparse ) { ret = type -> match_preparse ( & ctx. match_data ) ; if ( ret < 0 ) { key = ERR_PTR ( ret ) ; goto error ; } } key_ref = search_process_keyrings ( & ctx ) ; if (! IS_ERR ( key_ref ) ) { key = key_ref_to_ptr ( key_ref ) ; if ( dest_keyring ) { construct_get_dest_keyring ( & dest_keyring ) ; ret = key_link ( dest_keyring, key ) ; key_put ( dest_keyring ) ; if ( ret < 0 ) { key_put ( key ) ; key = ERR_PTR ( ret ) ; goto error_free ; } } } else if ( PTR_ERR ( key_ref )!= - EAGAIN ) { key = ERR_CAST ( key_ref ) ; } else { key = ERR_PTR ( - ENOKEY ) ; if (! callout_info ) goto error_free ; key = construct_key_and_link ( & ctx, callout_info, callout_len, aux, dest_keyring, flags ) ; } error_free : if ( type -> match_free ) type -> match_free ( & ctx. match_data )

Fix:
<S2SV_ModStart>. cmp = key_default_cmp <S2SV_ModEnd>,. match_data
Buggy code:
 uint32_t virtio_config_readb ( VirtIODevice * vdev, uint32_t addr ) { VirtioDeviceClass * k = VIRTIO_DEVICE_GET_CLASS ( vdev ) ; uint8_t val ; <START_BUG> k -> get_config ( vdev, vdev -> config ) ; <END_BUG> if ( addr > ( vdev -> config_len - sizeof ( val ) ) ) return ( uint32_t ) - 1 ; val = ldub_p ( vdev -> config + addr ) ; return val ; }

Fix:
<S2SV_ModStart> uint8_t val ; if ( addr + sizeof ( val ) > vdev -> config_len ) { return ( uint32_t ) - 1 ; } <S2SV_ModStart> -> config ) <S2SV_ModEnd> ; val =
Buggy code:
 struct sock * cookie_v4_check ( struct sock * sk, struct sk_buff * skb, struct ip_options * opt ) { struct tcp_options_received tcp_opt ; u8 * hash_location ; struct inet_request_sock * ireq ; struct tcp_request_sock * treq ; struct tcp_sock * tp = tcp_sk ( sk ) ; const struct tcphdr * th = tcp_hdr ( skb ) ; __u32 cookie = ntohl ( th -> ack_seq ) - 1 ; struct sock * ret = sk ; struct request_sock * req ; int mss ; struct rtable * rt ; __u8 rcv_wscale ; bool ecn_ok ; if (! sysctl_tcp_syncookies ||! th -> ack || th -> rst ) goto out ; if ( tcp_synq_no_recent_overflow ( sk ) || ( mss = cookie_check ( skb, cookie ) ) == 0 ) { NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_SYNCOOKIESFAILED ) ; goto out ; } NET_INC_STATS_BH ( sock_net ( sk ), LINUX_MIB_SYNCOOKIESRECV ) ; memset ( & tcp_opt, 0, sizeof ( tcp_opt ) ) ; tcp_parse_options ( skb, & tcp_opt, & hash_location, 0 ) ; if (! cookie_check_timestamp ( & tcp_opt, & ecn_ok ) ) goto out ; ret = NULL ; req = inet_reqsk_alloc ( & tcp_request_sock_ops ) ; if (! req ) goto out ; ireq = inet_rsk ( req ) ; treq = tcp_rsk ( req ) ; treq -> rcv_isn = ntohl ( th -> seq ) - 1 ; treq -> snt_isn = cookie ; req -> mss = mss ; ireq -> loc_port = th -> dest ; ireq -> rmt_port = th -> source ; ireq -> loc_addr = ip_hdr ( skb ) -> daddr ; ireq -> rmt_addr = ip_hdr ( skb ) -> saddr ; ireq -> ecn_ok = ecn

Fix:
<S2SV_ModStart> sizeof ( struct ip_options_rcu <S2SV_ModEnd> ) + opt <S2SV_ModStart> && ip_options_echo ( & ireq -> opt <S2SV_ModEnd> -> opt,
Buggy code:
 <START_BUG> static void write_mb_modes_kf ( const VP9_COMP * cpi, MODE_INFO * * mi_8x8, <END_BUG>  vp9_writer * w ) { <START_BUG> const VP9_COMMON * const cm = & cpi -> common ; const MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; const struct segmentation * const seg = & cm -> seg ; const MODE_INFO * const mi = mi_8x8 [ 0 ] ; <END_BUG> const MODE_INFO * const above_mi = mi_8x8 [ - xd -> mi_stride ] ;  <START_BUG> const MODE_INFO * const left_mi = xd -> left_available? mi_8x8 [ - 1 ] : NULL ; <END_BUG> const MB_MODE_INFO * const mbmi = & mi -> mbmi ; const BLOCK_SIZE bsize = mbmi -> sb_type ; if ( seg -> update_map ) write_segment_id ( w, seg, mbmi -> segment_id ) ;  write_skip ( cpi, mbmi -> segment_id, mi, w ) ; <START_BUG> if ( bsize >= BLOCK_8X8 && cm -> tx_mode == TX_MODE_SELECT ) <END_BUG> write_selected_tx_size ( cpi, mbmi -> tx_size, bsize, w ) ;  if ( bsize >= BLOCK_8X8 ) { write_intra_mode ( w, mbmi -> mode, get_y_mode_probs ( mi, above_mi, left_mi, 0 ) ) ; } else { const int num_4x4_w = num_4x4_blocks_wide_lookup [ bsize ] ; const int num_4x4_h = num_4x4_blocks_high_lookup [ bsize ] ; int idx, idy ; for ( idy = 0 ; idy < 2 ; idy += num_4x4_h ) { for ( idx = 0 ; idx < 2 ; idx += num_4x4_w ) { const int block = idy * 2 + idx ; write_intra_mode ( w, mi -> bmi [ block ]. as_mode, get_y_mode_probs ( mi, above_mi, left_mi, block ) ) ; } } } write_

Fix:
<S2SV_ModStart> write_mb_modes_kf ( const VP9_COMMON * cm, const MACROBLOCKD * xd, <S2SV_ModEnd> MODE_INFO * * <S2SV_ModStart> * mi_8x8, vpx_writer * w ) { <S2SV_ModEnd> const struct segmentation <S2SV_ModStart> const above_mi = xd -> above_mi <S2SV_ModEnd> ; const MODE_INFO <S2SV_ModStart> = xd -> left_mi <S2SV_ModEnd> ; const MB_MODE_INFO <S2SV_ModStart> ; write_skip ( cm, xd <S2SV_ModEnd>, mbmi -> <S2SV_ModStart> ) write_selected_tx_size ( cm, xd <S2SV_ModEnd>, w )
Buggy code:
 vpx_codec_err_t vp9_copy_reference_dec ( VP9Decoder * pbi, VP9_REFFRAME ref_frame_flag, YV12_BUFFER_CONFIG * sd ) { VP9_COMMON * cm = & pbi -> common ; if ( ref_frame_flag == VP9_LAST_FLAG ) { <START_BUG> const YV12_BUFFER_CONFIG * const cfg = <END_BUG>  & cm -> frame_bufs [ cm -> ref_frame_map [ 0 ] ]. buf ; <START_BUG> if (! equal_dimensions ( cfg, sd ) ) vpx_internal_error ( & cm -> error, VPX_CODEC_ERROR, "Incorrect   buffer   dimensions" ) ; else vp8_yv12_copy_frame ( cfg, sd ) ; } else { vpx_internal_error ( & cm -> error, VPX_CODEC_ERROR, "Invalid   reference   frame" ) ; } return cm -> error. error_code ; }<END_BUG>

Fix:
<S2SV_ModStart> const cfg = get_ref_frame ( cm, 0 ) ; if ( cfg == NULL ) { vpx_internal_error ( <S2SV_ModStart> & cm -> error, VPX_CODEC_ERROR, "No <S2SV_blank> \'last\' <S2SV_blank> reference <S2SV_blank> frame" ) ; return VPX_CODEC_ERROR ; } <S2SV_ModEnd> if (!
Buggy code:
 void vp9_foreach_transformed_block_in_plane ( const MACROBLOCKD * const xd, BLOCK_SIZE bsize, int plane, foreach_transformed_block_visitor visit, void * arg ) { const struct macroblockd_plane * const pd = & xd -> plane [ plane ] ; const MB_MODE_INFO * mbmi = & xd -> mi [ 0 ] -> mbmi ; <START_BUG> const TX_SIZE tx_size = plane? get_uv_tx_size ( mbmi ) <END_BUG> : mbmi -> tx_size ; const BLOCK_SIZE plane_bsize = get_plane_block_size ( bsize, pd ) ; const int num_4x4_w = num_4x4_blocks_wide_lookup [ plane_bsize ] ; const int num_4x4_h = num_4x4_blocks_high_lookup [ plane_bsize ] ; const int step = 1 << ( tx_size << 1 ) ;  int i ; <START_BUG> <END_BUG> if ( xd -> mb_to_right_edge < 0 || xd -> mb_to_bottom_edge < 0 ) {  int r, c ; int max_blocks_wide = num_4x4_w ; int max_blocks_high = num_4x4_h ; if ( xd -> mb_to_right_edge < 0 ) max_blocks_wide += ( xd -> mb_to_right_edge >> ( 5 + pd -> subsampling_x ) ) ; <START_BUG> if ( xd -> mb_to_bottom_edge < 0 ) <END_BUG> max_blocks_high += ( xd -> mb_to_bottom_edge >> ( 5 + pd -> subsampling_y ) ) ;  i = 0 ; <START_BUG> <END_BUG> for ( r = 0 ; r < num_4x4_h ; r += ( 1 << tx_size ) ) {  for ( c = 0 ; c < num_4x4_w ; c += ( 1 << tx_size ) ) { <START_BUG> if ( r < max_blocks_high && c < max_blocks_wide ) <END_BUG> visit ( plane, i, plane_bsize, tx_size, arg ) ; i += step ; }  } <START_BUG> } else { for ( i = 0 ; i < num_4x4_w * num_4x4_h ; i<END_BUG>

Fix:
<S2SV_ModStart> get_uv_tx_size ( mbmi, pd <S2SV_ModStart> ; int i = 0, r, c ; const int max_blocks_wide = num_4x4_w + <S2SV_ModEnd> ( xd -> <S2SV_ModStart> xd -> mb_to_right_edge >= 0? 0 : <S2SV_ModEnd> xd -> mb_to_right_edge <S2SV_ModStart> ) ) ; const int max_blocks_high = num_4x4_h + <S2SV_ModEnd> ( xd -> <S2SV_ModStart> xd -> mb_to_bottom_edge >= 0? 0 : <S2SV_ModEnd> xd -> mb_to_bottom_edge <S2SV_ModStart> ) ) ; const int extra_step = ( ( num_4x4_w - max_blocks_wide ) >> tx_size ) * step <S2SV_ModEnd> ; for ( <S2SV_ModStart> = 0 ; <S2SV_ModEnd> r < max_blocks_high <S2SV_ModStart> r < max_blocks_high ; r += ( 1 << tx_size ) ) { for ( c = 0 ; <S2SV_ModEnd> c < max_blocks_wide <S2SV_ModStart> c < max_blocks_wide ; c += ( 1 << tx_size ) ) { <S2SV_ModEnd> visit ( plane <S2SV_ModStart> step ; } i += extra_step <S2SV_ModEnd> ; } }
Buggy code:
 static l_int32 pixHtmlViewer ( const char * dirin, const char * dirout, const char * rootname, l_int32 thumbwidth, l_int32 viewwidth ) { char * fname, * fullname, * outname ; char * mainname, * linkname, * linknameshort ; char * viewfile, * thumbfile ; char * shtml, * slink ; char charbuf [ 512 ] ; char htmlstring [ ] = "<html>" ; char framestring [ ] = "<//frameset><//html>" ; l_int32 i, nfiles, index, w, d, nimages, ret ; l_float32 factor ; PIX * pix, * pixthumb, * pixview ; SARRAY * safiles, * sathumbs, * saviews, * sahtml, * salink ; PROCNAME ( "pixHtmlViewer" ) ; if (! dirin ) return ERROR_INT ( "dirin   not   defined", procName, 1 ) ; if (! dirout ) return ERROR_INT ( "dirout   not   defined", procName, 1 ) ; if (! rootname ) return ERROR_INT ( "rootname   not   defined", procName, 1 ) ; if ( thumbwidth == 0 ) thumbwidth = DEFAULT_THUMB_WIDTH ; if ( thumbwidth < MIN_THUMB_WIDTH ) { L_WARNING ( "thumbwidth   too   small;   using   min   value\\n", procName ) ; thumbwidth = MIN_THUMB_WIDTH ; } if ( viewwidth == 0 ) viewwidth = DEFAULT_VIEW_WIDTH ; if ( viewwidth < MIN_VIEW_WIDTH ) { L_WARNING ( "viewwidth   too   small;   using   min   value\\n", procName ) ; viewwidth = MIN_VIEW_WIDTH ; } # ifndef _WIN32 snprintf ( charbuf, sizeof ( charbuf ), "mkdir   -p   %s", dirout ) ; ret = system ( charbuf ) ; # else ret = CreateDirectory ( dirout, NULL )? 0 : 1 ; # endif if ( ret ) { L_ERROR ( "output   directory   %s   not   made\\n", procName, dirout ) ; return 1 ; } if ( ( safiles = getFilenamesIn

Fix:
<S2SV_ModStart> 1 ) ; snprintf ( charbuf, sizeof ( charbuf ) <S2SV_ModEnd>, "%s//%s.html", <S2SV_ModStart> charbuf ) ; snprintf ( charbuf, sizeof ( charbuf ) <S2SV_ModEnd>, "%s//%s-links.html", <S2SV_ModStart> factor ) ; snprintf ( charbuf, sizeof ( charbuf ) <S2SV_ModEnd>, "%s_thumb_%03d",
Buggy code:
 static Image * ReadDPXImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char magick [ 4 ], value [ MaxTextExtent ] ; DPXInfo dpx ; Image * image ; MagickBooleanType status ; MagickOffsetType offset ; QuantumInfo * quantum_info ; QuantumType quantum_type ; register ssize_t i ; size_t extent, samples_per_pixel ; ssize_t count, n, row, y ; unsigned char component_type ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } offset = 0 ; count = ReadBlob ( image, 4, ( unsigned char * ) magick ) ; offset += count ; if ( ( count!= 4 ) || ( ( LocaleNCompare ( magick, "SDPX", 4 )!= 0 ) && ( LocaleNCompare ( ( char * ) magick, "XPDS", 4 )!= 0 ) ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; image -> endian = LSBEndian ; if ( LocaleNCompare ( magick, "SDPX", 4 ) == 0 ) image -> endian = MSBEndian ; ( void ) ResetMagickMemory ( & dpx, 0, sizeof ( dpx ) ) ; dpx. file. image_offset = ReadBlobLong ( image ) ; offset += 4 ; offset += ReadBlob ( image, sizeof ( dpx. file. version ), ( unsigned char * ) dpx. file. version ) ; ( void ) FormatImageProperty ( image, "dpx:file.version", "%.8s", dpx. file. version ) ; dpx. file. file_size =

Fix:
<S2SV_ModStart> return ( GetFirstImageInList ( image ) ) ; } status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList
Buggy code:
 <START_BUG> void nego_process_negotiation_failure ( rdpNego * nego, wStream * s ) <END_BUG> { BYTE flags ; UINT16 length ; UINT32 failureCode ;  WLog_DBG ( TAG, "RDP_NEG_FAILURE" ) ; <START_BUG> Stream_Read_UINT8 ( s, flags ) ; Stream_Read_UINT16 ( s, length ) ; Stream_Read_UINT32 ( s, failureCode ) ; switch ( failureCode ) { case SSL_REQUIRED_BY_SERVER : WLog_WARN ( TAG, "Error:   SSL_REQUIRED_BY_SERVER" ) ; break ; case SSL_NOT_ALLOWED_BY_SERVER : WLog_WARN ( TAG, "Error:   SSL_NOT_ALLOWED_BY_SERVER" ) ; nego -> sendNegoData = TRUE ; break ; case SSL_CERT_NOT_ON_SERVER : WLog_ERR ( TAG, "Error:   SSL_CERT_NOT_ON_SERVER" ) ; nego -> sendNegoData = TRUE ; break ; case INCONSISTENT_FLAGS : WLog_ERR ( TAG, "Error:   INCONSISTENT_FLAGS" ) ; break ; case HYBRID_REQUIRED_BY_SERVER : WLog_WARN ( TAG, "Error:   HYBRID_REQUIRED_BY_SERVER" ) ; break ; default : WLog_ERR ( TAG, "Error:   Unknown   protocol   security   error   %" PRIu32 "", failureCode ) ; break ; } nego -> state = NEGO_STATE_FAIL ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> BOOL <S2SV_ModEnd> nego_process_negotiation_failure ( rdpNego <S2SV_ModStart>, "RDP_NEG_FAILURE" ) ; if ( Stream_GetRemainingLength ( s ) < 7 ) return FALSE <S2SV_ModStart> = NEGO_STATE_FAIL ; return TRUE ;
Buggy code:
 hive_h * hivex_open ( const char * filename, int flags ) { hive_h * h = NULL ; assert ( sizeof ( struct ntreg_header ) == 0x1000 ) ; assert ( offsetof ( struct ntreg_header, csum ) == 0x1fc ) ; h = calloc ( 1, sizeof * h ) ; if ( h == NULL ) goto error ; h -> msglvl = flags & HIVEX_OPEN_MSGLVL_MASK ; const char * debug = getenv ( "HIVEX_DEBUG" ) ; if ( debug && STREQ ( debug, "1" ) ) h -> msglvl = 2 ; DEBUG ( 2, "created   handle   %p", h ) ; h -> writable =!! ( flags & HIVEX_OPEN_WRITE ) ; h -> filename = strdup ( filename ) ; if ( h -> filename == NULL ) goto error ; # ifdef O_CLOEXEC h -> fd = open ( filename, O_RDONLY | O_CLOEXEC | O_BINARY ) ; # else h -> fd = open ( filename, O_RDONLY | O_BINARY ) ; # endif if ( h -> fd == - 1 ) goto error ; # ifndef O_CLOEXEC fcntl ( h -> fd, F_SETFD, FD_CLOEXEC ) ; # endif struct stat statbuf ; if ( fstat ( h -> fd, & statbuf ) == - 1 ) goto error ; <START_BUG> h -> size = statbuf. st_size ; <END_BUG> if (! h -> writable ) { h -> addr = mmap ( NULL, h -> size, PROT_READ, MAP_SHARED, h -> fd, 0 ) ; if ( h -> addr == MAP_FAILED ) goto error ; DEBUG ( 2, "mapped   file   at   %p", h -> addr ) ; } else { h -> addr = malloc ( h -> size ) ; if ( h -> addr == NULL ) goto error ; if ( full_read ( h -> fd, h -> addr, h -> size ) < h -> size ) goto error ; if ( close ( h -> fd ) == - 1 ) goto error ; h -> fd = - 1 ; } if ( h -> hdr -> magic [ 0 ]!= 'r' || h -> hdr -> magic [ 1 ]!= 'e' || h -> hdr -> magic [

Fix:
<S2SV_ModStart>. st_size ; if ( h -> size < 0x2000 ) { SET_ERRNO ( EINVAL, "%s: <S2SV_blank> file <S2SV_blank> is <S2SV_blank> too <S2SV_blank> small <S2SV_blank> to <S2SV_blank> be <S2SV_blank> a <S2SV_blank> Windows <S2SV_blank> NT <S2SV_blank> Registry <S2SV_blank> hive <S2SV_blank> file", filename ) ; goto error ; }
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_pps ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; WORD32 pps_id ; pps_t * ps_pps ; sps_t * ps_sps ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; if ( 0 == ps_codec -> i4_sps_done ) return IHEVCD_INVALID_HEADER ; UEV_PARSE ( "pic_parameter_set_id", value, ps_bitstrm ) ; pps_id = value ; if ( ( pps_id >= MAX_PPS_CNT ) || ( pps_id < 0 ) ) { if ( ps_codec -> i4_pps_done ) return IHEVCD_UNSUPPORTED_PPS_ID ; else pps_id = 0 ; } ps_pps = ( ps_codec -> s_parse. ps_pps_base + MAX_PPS_CNT - 1 ) ; ps_pps -> i1_pps_id = pps_id ; UEV_PARSE ( "seq_parameter_set_id", value, ps_bitstrm ) ; ps_pps -> i1_sps_id = value ; ps_pps -> i1_sps_id = CLIP3 ( ps_pps -> i1_sps_id, 0, MAX_SPS_CNT - 2 ) ; ps_sps = ( ps_codec -> s_parse. ps_sps_base + ps_pps -> i1_sps_id ) ; if ( 0 == ps_sps -> i1_sps_valid ) { return IHEVCD_INVALID_HEADER ; } BITS_PARSE ( "dependent_slices_enabled_flag", value, ps_bitstrm, 1 ) ; ps_pps -> i1_dependent_slice_enabled_flag = value ; BITS_PARSE ( "output_flag_present_flag", value, ps_bitstrm, 1 ) ; ps_pps -> i1

Fix:
<S2SV_ModStart> i1_tiles_enabled_flag ) { WORD32 wd = ALIGN64 ( ps_codec -> i4_wd ) ; WORD32 ht = ALIGN64 ( ps_codec -> i4_ht ) ; WORD32 max_tile_cols = ( wd + MIN_TILE_WD - 1 ) // MIN_TILE_WD ; WORD32 max_tile_rows = ( ht + MIN_TILE_HT - 1 ) // MIN_TILE_HT ; <S2SV_ModStart> -> i1_num_tile_columns > max_tile_cols <S2SV_ModEnd> ) || ( <S2SV_ModStart> -> i1_num_tile_rows > max_tile_rows <S2SV_ModEnd> ) ) return
Buggy code:
 int fit_image_load ( bootm_headers_t * images, ulong addr, const char * * fit_unamep, const char * * fit_uname_configp, int arch, int image_type, int bootstage_id, enum fit_load_op load_op, ulong * datap, ulong * lenp ) { int cfg_noffset, noffset ; const char * fit_uname ; const char * fit_uname_config ; const char * fit_base_uname_config ; const void * fit ; void * buf ; void * loadbuf ; size_t size ; int type_ok, os_ok ; ulong load, load_end, data, len ; uint8_t os, comp ; # ifndef USE_HOSTCC uint8_t os_arch ; # endif const char * prop_name ; int ret ; fit = map_sysmem ( addr, 0 ) ; fit_uname = fit_unamep? * fit_unamep : NULL ; fit_uname_config = fit_uname_configp? * fit_uname_configp : NULL ; fit_base_uname_config = NULL ; prop_name = fit_get_image_type_property ( image_type ) ; printf ( "##   Loading   %s   from   FIT   Image   at   %08lx  ...\\n", prop_name, addr ) ; bootstage_mark ( bootstage_id + BOOTSTAGE_SUB_FORMAT ) ; <START_BUG> if ( fit_check_format ( fit, IMAGE_SIZE_INVAL ) ) { <END_BUG>  printf ( "Bad   FIT   %s   image   format!\\n", prop_name ) ; <START_BUG> bootstage_error ( bootstage_id + BOOTSTAGE_SUB_FORMAT ) ; <END_BUG> return - ENOEXEC ;  } bootstage_mark ( bootstage_id + BOOTSTAGE_SUB_FORMAT_OK ) ; if ( fit_uname ) { bootstage_mark ( bootstage_id + BOOTSTAGE_SUB_UNIT_NAME ) ; noffset = fit_image_get_node ( fit, fit_uname ) ; } else { bootstage_mark ( bootstage_id + BOOTSTAGE_SUB_NO_

Fix:
<S2SV_ModStart> BOOTSTAGE_SUB_FORMAT ) ; ret = <S2SV_ModEnd> fit_check_format ( fit <S2SV_ModStart>, IMAGE_SIZE_INVAL ) ; if ( ret <S2SV_ModStart> { printf ( "Bad <S2SV_blank> FIT <S2SV_blank> %s <S2SV_blank> image <S2SV_blank> format! <S2SV_blank> (err=%d)\\n", prop_name, ret ) ; if ( CONFIG_IS_ENABLED ( FIT_SIGNATURE ) && ret == - EADDRNOTAVAIL ) printf ( "Signature <S2SV_blank> checking <S2SV_blank> prevents <S2SV_blank> use <S2SV_blank> of <S2SV_blank> unit <S2SV_blank> addresses <S2SV_blank> (@) <S2SV_blank> in <S2SV_blank> nodes\\n" <S2SV_ModEnd> ) ; bootstage_error <S2SV_ModStart> ) ; return ret <S2SV_ModEnd> ; } bootstage_mark
Buggy code:
 <START_BUG> void vp9_tree_probs_from_distribution ( vp9_tree tree, <END_BUG> unsigned int branch_ct [ ] [ 2 ], const unsigned int num_events [ ] ) { convert_distribution ( 0, tree, branch_ct, num_events ) ; }

Fix:
<S2SV_ModStart> void vp9_tree_probs_from_distribution ( vpx_tree <S2SV_ModEnd> tree, unsigned
Buggy code:
 static void init_frame ( VP8D_COMP * pbi ) { VP8_COMMON * const pc = & pbi -> common ; MACROBLOCKD * const xd = & pbi -> mb ; if ( pc -> frame_type == KEY_FRAME ) { <START_BUG> vpx_memcpy ( pc -> fc. mvc, vp8_default_mv_context, sizeof ( vp8_default_mv_context ) ) ; <END_BUG> vp8_init_mbmode_probs ( pc ) ; vp8_default_coef_probs ( pc ) ;  vpx_memset ( xd -> segment_feature_data, 0, sizeof ( xd -> segment_feature_data ) ) ; <START_BUG> xd -> mb_segement_abs_delta = SEGMENT_DELTADATA ; <END_BUG> vpx_memset ( xd -> ref_lf_deltas, 0, sizeof ( xd -> ref_lf_deltas ) ) ;  <START_BUG> vpx_memset ( xd -> mode_lf_deltas, 0, sizeof ( xd -> mode_lf_deltas ) ) ; <END_BUG> pc -> refresh_golden_frame = 1 ; pc -> refresh_alt_ref_frame = 1 ; pc -> copy_buffer_to_gf = 0 ; pc -> copy_buffer_to_arf = 0 ; pc -> ref_frame_sign_bias [ GOLDEN_FRAME ] = 0 ; pc -> ref_frame_sign_bias [ ALTREF_FRAME ] = 0 ; } else { if (! pc -> use_bilinear_mc_filter ) { xd -> subpixel_predict = vp8_sixtap_predict4x4 ; xd -> subpixel_predict8x4 = vp8_sixtap_predict8x4 ; xd -> subpixel_predict8x8 = vp8_sixtap_predict8x8 ; xd -> subpixel_predict16x16 = vp8_sixtap_predict16x16 ; } else { xd -> subpixel_predict = vp8_bilinear_predict4x4 ; xd -> subpixel_predict8x4 = vp8_bilinear_predict8x4 ; xd -> subpixel_predict8x8 = vp8_bilinear_predict8x8 ; xd -> subpixel_predict16x16 = vp8_b

Fix:
<S2SV_ModStart> KEY_FRAME ) { memcpy <S2SV_ModEnd> ( pc -> <S2SV_ModStart> pc ) ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> = SEGMENT_DELTADATA ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( xd ->
Buggy code:
 MAPI_Attr * * mapi_attr_read ( size_t len, unsigned char * buf ) { size_t idx = 0 ; uint32 i, j ; assert ( len > 4 ) ; <START_BUG> uint32 num_properties = GETINT32 ( buf + idx ) ; <END_BUG> MAPI_Attr * * attrs = CHECKED_XMALLOC ( MAPI_Attr *, ( num_properties + 1 ) ) ; idx += 4 ; if (! attrs ) return NULL ; for ( i = 0 ; i < num_properties ; i ++ ) { MAPI_Attr * a = attrs [ i ] = CHECKED_XCALLOC ( MAPI_Attr, 1 ) ; MAPI_Value * v = NULL ; CHECKINT16 ( idx, len ) ; a -> type = GETINT16 ( buf + idx ) ; idx += 2 ; CHECKINT16 ( idx, len ) ; a -> name = GETINT16 ( buf + idx ) ; idx += 2 ; if ( a -> name & GUID_EXISTS_FLAG ) { a -> guid = CHECKED_XMALLOC ( GUID, 1 ) ; copy_guid_from_buf ( a -> guid, buf + idx, len ) ; idx += sizeof ( GUID ) ; CHECKINT32 ( idx, len ) ; a -> num_names = GETINT32 ( buf + idx ) ; idx += 4 ; if ( a -> num_names > 0 ) { size_t i ; a -> names = CHECKED_XCALLOC ( VarLenData, a -> num_names ) ; for ( i = 0 ; i < a -> num_names ; i ++ ) { size_t j ; CHECKINT32 ( idx, len ) ; a -> names [ i ]. len = GETINT32 ( buf + idx ) ; idx += 4 ; a -> names [ i ]. data = CHECKED_XMALLOC ( unsigned char, a -> names [ i ]. len ) ;  for ( j = 0 ; j < ( a -> names [ i ]. len >> 1 ) ; j ++ ) <START_BUG> a -> names [ i ]. data [ j ] = ( buf + idx ) [ j * 2 ] ; idx += pad_to_4byte ( a -> names [ i ]. len ) ; } } else { CHECKINT32 ( idx, len ) ; a -> name = GETINT32 ( buf +<END_BUG>

Fix:
<S2SV_ModStart> buf + idx ) ; assert ( ( num_properties + 1 )!= 0 <S2SV_ModStart> len ) ; assert ( ( idx + ( a -> names [ i ]. len * 2 ) ) <= len ) ; <S2SV_ModStart> += 4 ; assert ( v -> len + idx <= len ) ; <S2SV_ModStart> szMAPI_UNICODE_STRING ) { assert ( v -> len!= 0 ) ;
Buggy code:
 static int on_http_message_complete ( http_parser * parser ) { struct clt_info * info = parser -> data ; ws_svr * svr = ws_svr_from_ses ( info -> ses ) ; info -> request -> version_major = parser -> http_major ; info -> request -> version_minor = parser -> http_minor ; info -> request -> method = parser -> method ; dict_entry * entry ; dict_iterator * iter = dict_get_iterator ( info -> request -> headers ) ; while ( ( entry = dict_next ( iter ) )!= NULL ) { log_trace ( "Header:   %s:   %s", ( char * ) entry -> key, ( char * ) entry -> val ) ; } dict_release_iterator ( iter ) ; if ( info -> request -> method!= HTTP_GET ) goto error ; if ( http_request_get_header ( info -> request, "Host" ) == NULL ) goto error ; double version = info -> request -> version_major + info -> request -> version_minor * 0.1 ; if ( version < 1.1 ) goto error ; const char * upgrade = http_request_get_header ( info -> request, "Upgrade" ) ; if ( upgrade == NULL || strcasecmp ( upgrade, "websocket" )!= 0 ) goto error ; const char * connection = http_request_get_header ( info -> request, "Connection" ) ; <START_BUG> if ( connection == NULL ) <END_BUG> goto error ; else { bool found_upgrade = false ; int count ; sds * tokens = sdssplitlen ( connection, strlen ( connection ), ",", 1, & count ) ; if ( tokens == NULL ) goto error ; for ( int i = 0 ; i < count ; i ++ ) { sds token = tokens [ i ] ; sdstrim ( token, "   " ) ; if ( strcasecmp ( token, "Upgrade" ) == 0 ) { found_upgrade = true ; break ; } } sdsfreesplitres ( tokens, count ) ; if (! found_upgrade ) goto error ; } const char * ws_version = http_request_get_header ( info -> request, "Sec-WebSocket-Version" ) ; if ( ws_version == NULL || strcmp ( ws_version, "13" )!= 0 ) goto error ; const char * ws

Fix:
<S2SV_ModStart> connection == NULL || strlen ( connection ) > UT_WS_SVR_MAX_HEADER_SIZE
Buggy code:
 static int vmci_transport_dgram_dequeue ( struct kiocb * kiocb, struct vsock_sock * vsk, struct msghdr * msg, size_t len, int flags ) { int err ; int noblock ; struct vmci_datagram * dg ; size_t payload_len ; struct sk_buff * skb ; noblock = flags & MSG_DONTWAIT ; if ( flags & MSG_OOB || flags & MSG_ERRQUEUE ) return - EOPNOTSUPP ; <START_BUG> msg -> msg_namelen = 0 ; <END_BUG> err = 0 ; skb = skb_recv_datagram ( & vsk -> sk, flags, noblock, & err ) ; if ( err ) return err ; if (! skb ) return - EAGAIN ; dg = ( struct vmci_datagram * ) skb -> data ; if (! dg ) goto out ; payload_len = dg -> payload_size ; if ( payload_len!= skb -> len - sizeof ( * dg ) ) { err = - EINVAL ; goto out ; } if ( payload_len > len ) { payload_len = len ; msg -> msg_flags |= MSG_TRUNC ; } err = skb_copy_datagram_iovec ( skb, sizeof ( * dg ), msg -> msg_iov, payload_len ) ; if ( err ) goto out ; if ( msg -> msg_name ) { struct sockaddr_vm * vm_addr ; vm_addr = ( struct sockaddr_vm * ) msg -> msg_name ; vsock_addr_init ( vm_addr, dg -> src. context, dg -> src. resource ) ; msg -> msg_namelen = sizeof ( * vm_addr ) ; } err = payload_len ; out : skb_free_datagram ( & vsk -> sk, skb ) ; return err ; }

Fix:
<S2SV_ModStart> - EOPNOTSUPP ; <S2SV_ModEnd> err = 0
Buggy code:
 void pdf_summarize ( FILE * fp, const pdf_t * pdf, const char * name, pdf_flag_t flags ) { int i, j, page, n_versions, n_entries ; FILE * dst, * out ; char * dst_name, * c ; dst = NULL ; dst_name = NULL ; if ( name ) { <START_BUG> dst_name = malloc ( strlen ( name ) * 2 + 16 ) ; <END_BUG> sprintf ( dst_name, "%s//%s", name, name ) ; if ( ( c = strrchr ( dst_name, '.' ) ) && ( strncmp ( c, ".pdf", 4 ) == 0 ) ) * c = '\\0' ; strcat ( dst_name, ".summary" ) ; if (! ( dst = fopen ( dst_name, "w" ) ) ) { ERR ( "Could   not   open   file   \'%s\'   for   writing\\n", dst_name ) ; return ; } } out = ( dst )? dst : stdout ; n_versions = pdf -> n_xrefs ; if ( n_versions && pdf -> xrefs [ 0 ]. is_linear ) -- n_versions ; for ( i = 1 ; i < pdf -> n_xrefs ; ++ i ) if ( pdf -> xrefs [ i ]. end == 0 ) -- n_versions ; if (! pdf -> n_xrefs || (! n_versions && pdf -> xrefs [ 0 ]. is_linear ) ) n_versions = 1 ; n_entries = 0 ; for ( i = 0 ;! ( const int ) pdf -> has_xref_streams && i < pdf -> n_xrefs ; i ++ ) { if ( flags & PDF_FLAG_QUIET ) continue ; for ( j = 0 ; j < pdf -> xrefs [ i ]. n_entries ; j ++ ) { ++ n_entries ; fprintf ( out, "%s:   --%c--   Version   %d   --   Object   %d   (%s)", pdf -> name, pdf_get_object_status ( pdf, i, j ), pdf -> xrefs [ i ]. version, pdf -> xrefs [ i ]. entries [ j ]. obj_id, get_type ( fp, pdf -> xrefs [ i ]. entries [ j

Fix:
<S2SV_ModStart> { dst_name = safe_calloc <S2SV_ModEnd> ( strlen (
Buggy code:
 struct crypto_alg * crypto_larval_lookup ( const char * name, u32 type, u32 mask ) { struct crypto_alg * alg ; if (! name ) return ERR_PTR ( - ENOENT ) ; mask &= ~ ( CRYPTO_ALG_LARVAL | CRYPTO_ALG_DEAD ) ; type &= mask ; alg = crypto_alg_lookup ( name, type, mask ) ; if (! alg ) { <START_BUG> request_module ( "%s", name ) ; <END_BUG> if (! ( ( type ^ CRYPTO_ALG_NEED_FALLBACK ) & mask & CRYPTO_ALG_NEED_FALLBACK ) )  request_module ( "%s-all", name ) ; <START_BUG> alg = crypto_alg_lookup ( name, type, mask ) ; } if ( alg ) return crypto_is_larval ( alg )? crypto_larval_wait ( alg ) : alg ; return crypto_larval_add ( name, type, mask ) ; }<END_BUG>

Fix:
<S2SV_ModStart> { request_module ( "crypto-%s" <S2SV_ModEnd>, name ) <S2SV_ModStart> ) request_module ( "crypto-%s-all" <S2SV_ModEnd>, name )
Buggy code:
 error_t httpParseRequestLine ( HttpConnection * connection, char_t * requestLine ) { error_t error ; char_t * token ; char_t * p ; char_t * s ; token = osStrtok_r ( requestLine, "   \\r\\n", & p ) ; if ( token == NULL ) return ERROR_INVALID_REQUEST ; error = strSafeCopy ( connection -> request. method, token, HTTP_SERVER_METHOD_MAX_LEN ) ; if ( error ) return ERROR_INVALID_REQUEST ; token = osStrtok_r ( NULL, "   \\r\\n", & p ) ; if ( token == NULL ) return ERROR_INVALID_REQUEST ; <START_BUG> s = strchr ( token, '?' ) ; <END_BUG> if ( s!= NULL ) { * s = '\\0' ; error = httpDecodePercentEncodedString ( token, connection -> request. uri, HTTP_SERVER_URI_MAX_LEN ) ; if ( error ) return ERROR_INVALID_REQUEST ; if ( osStrlen ( s + 1 ) > HTTP_SERVER_QUERY_STRING_MAX_LEN ) return ERROR_INVALID_REQUEST ; osStrcpy ( connection -> request. queryString, s + 1 ) ; } else { error = httpDecodePercentEncodedString ( token, connection -> request. uri, HTTP_SERVER_URI_MAX_LEN ) ; if ( error ) return ERROR_INVALID_REQUEST ; connection -> request. queryString [ 0 ] = '\\0' ; } if (! osStrcasecmp ( connection -> request. uri, "//" ) ) osStrcpy ( connection -> request. uri, connection -> settings -> defaultDocument ) ; pathCanonicalize ( connection -> request. uri ) ; token = osStrtok_r ( NULL, "   \\r\\n", & p ) ; if ( token == NULL ) { connection -> request. version = HTTP_VERSION_0_9 ; connection -> request. keepAlive = FALSE ; } else if (! osStrcasecmp ( token, "HTTP//1.0" ) ) { connection -> request. version = HTTP_VERSION_1_0 ; connection -> request. keepAlive = FALSE ; } else if (! osStrcasecmp ( token, "HTTP//1.1" ) ) { connection -> request. version = HTTP_VERSION_1_1 ; connection -> request. keepAlive = TRUE ; } else { return ERROR_INVALID

Fix:
<S2SV_ModStart> ; s = osStrchr <S2SV_ModEnd> ( token,
Buggy code:
 static int gtStripSeparate ( TIFFRGBAImage * img, uint32 * raster, uint32 w, uint32 h ) { TIFF * tif = img -> tif ; tileSeparateRoutine put = img -> put. separate ; unsigned char * buf = NULL ; unsigned char * p0 = NULL, * p1 = NULL, * p2 = NULL, * pa = NULL ; uint32 row, y, nrow, rowstoread ; tmsize_t pos ; tmsize_t scanline ; uint32 rowsperstrip, offset_row ; uint32 imagewidth = img -> width ; tmsize_t stripsize ; tmsize_t bufsize ; int32 fromskew, toskew ; int alpha = img -> alpha ; int ret = 1, flip ; uint16 colorchannels ; stripsize = TIFFStripSize ( tif ) ; bufsize = _TIFFMultiplySSize ( tif, alpha? 4 : 3, stripsize, "gtStripSeparate" ) ; if ( bufsize == 0 ) { return ( 0 ) ; } flip = setorientation ( img ) ; if ( flip & FLIP_VERTICALLY ) { y = h - 1 ; toskew = - ( int32 ) ( w + w ) ; } else { y = 0 ; toskew = - ( int32 ) ( w - w ) ; } switch ( img -> photometric ) { case PHOTOMETRIC_MINISWHITE : case PHOTOMETRIC_MINISBLACK : case PHOTOMETRIC_PALETTE : colorchannels = 1 ; break ; default : colorchannels = 3 ; break ; } TIFFGetFieldDefaulted ( tif, TIFFTAG_ROWSPERSTRIP, & rowsperstrip ) ; scanline = TIFFScanlineSize ( tif ) ; fromskew = ( w < imagewidth? imagewidth - w : 0 ) ; for ( row = 0 ; row < h ; row += nrow ) { <START_BUG> rowstoread = rowsperstrip - ( row + img -> row_offset ) % rowsperstrip ; <END_BUG> nrow = ( row + rowstoread > h? h - row : rowstoread ) ; offset_row = row + img -> row_offset ;  if ( buf == NULL ) <START_BUG> { if ( _TIFFReadEncodedStripAndAllocBuffer ( tif<END_BUG>

Fix:
<S2SV_ModStart> nrow ) { uint32 temp ; <S2SV_ModStart> -> row_offset ; temp = ( row + img -> row_offset ) % rowsperstrip + nrow ; if ( scanline > 0 && temp > ( size_t ) ( TIFF_TMSIZE_T_MAX // scanline ) ) { TIFFErrorExt ( tif -> tif_clientdata, TIFFFileName ( tif ), "Integer <S2SV_blank> overflow <S2SV_blank> in <S2SV_blank> gtStripSeparate" ) ; return 0 ; } <S2SV_ModStart>, bufsize, temp <S2SV_ModEnd> * scanline ) <S2SV_ModStart>, p0, temp <S2SV_ModEnd> * scanline ) <S2SV_ModStart>, p1, temp <S2SV_ModEnd> * scanline ) <S2SV_ModStart>, p2, temp <S2SV_ModEnd> * scanline ) <S2SV_ModStart>, pa, temp <S2SV_ModEnd> * scanline )
Buggy code:
 static void model_rd_for_sb ( VP9_COMP * cpi, BLOCK_SIZE bsize, MACROBLOCK * x, MACROBLOCKD * xd, <START_BUG> int * out_rate_sum, int64_t * out_dist_sum ) { <END_BUG> int i ; int64_t rate_sum = 0 ; int64_t dist_sum = 0 ; const int ref = xd -> mi [ 0 ] -> mbmi. ref_frame [ 0 ] ; unsigned int sse ;  for ( i = 0 ; i < MAX_MB_PLANE ; ++ i ) { <START_BUG> struct macroblock_plane * const p = & x -> plane [ i ] ; struct macroblockd_plane * const pd = & xd -> plane [ i ] ; const BLOCK_SIZE bs = get_plane_block_size ( bsize, pd ) ; <END_BUG> ( void ) cpi -> fn_ptr [ bs ]. vf ( p -> src. buf, p -> src. stride,  <START_BUG> pd -> dst. buf, pd -> dst. stride, & sse ) ; <END_BUG>  if ( i == 0 ) <START_BUG> <END_BUG> x -> pred_sse [ ref ] = sse ;  <START_BUG> if ( cpi -> speed > 4 ) { <END_BUG> int64_t rate ;  int64_t dist ; <START_BUG> <END_BUG> int64_t square_error = sse ;  <START_BUG> int quantizer = ( pd -> dequant [ 1 ] >> 3 ) ; <END_BUG> if ( quantizer < 120 ) rate = ( square_error * ( 280 - quantizer ) ) >> 8 ; else rate = 0 ; dist = ( square_error * quantizer ) >> 8 ; rate_sum += rate ; dist_sum += dist ; } else {  int rate ; <START_BUG> int64_t dist ; vp9_model_rd_from_var_lapndz ( sse, 1 << num_pels_log2_lookup [ bs ], pd -> dequant [ 1 ] >> 3, & rate, & dist ) ; rate_sum += rate ; dist_sum += dist ; } } <END_BUG> * out_rate_sum = ( int ) rate_sum ;  * out_dist_sum = dist_sum << 4 ; }

Fix:
<S2SV_ModStart> int64_t * out_dist_sum, int * skip_txfm_sb, int64_t * skip_sse_sb <S2SV_ModStart> int sse ; unsigned int var = 0 ; unsigned int sum_sse = 0 ; int64_t total_sse = 0 ; int skip_flag = 1 ; const int shift = 6 ; int rate ; int64_t dist ; const int dequant_shift = # if CONFIG_VP9_HIGHBITDEPTH ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH )? xd -> bd - 5 : # endif 3 ; x -> pred_sse [ ref ] = 0 ; <S2SV_ModStart> pd ) ; const TX_SIZE max_tx_size = max_txsize_lookup <S2SV_ModEnd> [ bs ] <S2SV_ModStart> [ bs ] ; const BLOCK_SIZE unit_size = txsize_to_bsize [ max_tx_size ] ; const int64_t dc_thr = p -> quant_thred [ 0 ] >> shift ; const int64_t ac_thr = p -> quant_thred [ 1 ] >> shift ; const int64_t low_dc_thr = MIN ( 50
Buggy code:
 static void ast_dealloc ( AST_object * self ) <START_BUG> { <END_BUG> Py_CLEAR ( self -> dict ) ; Py_TYPE ( self ) -> tp_free ( self ) ; }

Fix:
<S2SV_ModStart> self ) { PyObject_GC_UnTrack ( self ) ;
Buggy code:
 static expr_ty fstring_compile_expr ( const char * expr_start, const char * expr_end, struct compiling * c, const node * n ) { <START_BUG> int all_whitespace = 1 ; <END_BUG> int kind ; void * data ; PyCompilerFlags cf ;  mod_ty mod ; <START_BUG> char * str ; <END_BUG> PyObject * o, * fstring_name ;  Py_ssize_t len ; Py_ssize_t i ; assert ( expr_end >= expr_start ) ; assert ( * ( expr_start - 1 ) == '{' ) ; assert ( * expr_end == '}' || * expr_end == '!' || * expr_end == ':' ) ; <START_BUG> o = PyUnicode_DecodeUTF8 ( expr_start, expr_end - expr_start, NULL ) ; <END_BUG> if ( o == NULL ) return NULL ; len = PyUnicode_GET_LENGTH ( o ) ; kind = PyUnicode_KIND ( o ) ; data = PyUnicode_DATA ( o ) ; for ( i = 0 ; i < len ; i ++ ) { if (! Py_UNICODE_ISSPACE ( PyUnicode_READ ( kind, data, i ) ) ) { all_whitespace = 0 ; break ; } } Py_DECREF ( o ) ; if ( all_whitespace ) { ast_error ( c, n, "f-string:   empty   expression   not   allowed" ) ; return NULL ; } len = expr_end - expr_start ; str = PyMem_RawMalloc ( len + 3 ) ; if ( str == NULL )  return NULL ; <START_BUG> str [ 0 ] = '(' ; memcpy ( str + 1, expr_start, len ) ; str [ len + 1 ] = ')' ; str [ len + 2 ] = 0 ; cf. cf_flags = PyCF_ONLY_AST ; <END_BUG> fstring_name = PyUnicode_FromString ( "<fstring>" ) ;  mod = string_object_to_c_ast ( str, fstring_name, Py_eval_input, & cf, c -> c_feature_version, c -> c_arena ) ; Py_DECREF ( fstring_name ) ; <START_BUG> PyMem_RawFree ( str ) ; <END_BUG> if (! mod ) return NULL ; return mod -> v. Expression. body ; }

Fix:
<S2SV_ModStart> n ) { <S2SV_ModEnd> PyCompilerFlags cf ; <S2SV_ModStart> PyCompilerFlags cf ; node * mod_n ; <S2SV_ModStart> * str ; Py_ssize_t len ; const char * s ; PyObject * fstring_name <S2SV_ModEnd> ; assert ( <S2SV_ModStart> ':' ) ; for ( s = expr_start ; s!= expr_end ; s ++ ) { char c = * s ; if (! ( c =='<S2SV_blank>'|| c == '\\t' || c == '\\n' || c == '\\f' ) ) { break ; } } if ( s == expr_end ) { ast_error ( c, n, "f-string: <S2SV_blank> empty <S2SV_blank> expression <S2SV_blank> not <S2SV_blank> allowed" ) ; return NULL ; } len = <S2SV_ModEnd> expr_end - expr_start <S2SV_ModStart> expr_end - expr_start <S2SV_ModEnd> ; str = <S2SV_ModStart> == NULL ) { PyErr_NoMemory ( ) ; return NULL ; } <S2SV_ModEnd> str [ 0 <S2SV_ModStart> = PyCF_ONLY_AST ; mod_n = PyParser_SimpleParseStringFlagsFilename ( str, "<fstring>", Py_eval_input, 0 ) ; if (! mod_n ) { PyMem_RawFree ( str ) ; return NULL ; } str [
Buggy code:
 void process_bitmap_updates ( STREAM s ) { <START_BUG> uint16 num_updates ; <END_BUG> uint16 left, top, right, bottom, width, height ; uint16 cx, cy, bpp, Bpp, compress, bufsize, size ; uint8 * data, * bmpdata ; int i ;  logger ( Protocol, Debug, "%s()", __func__ ) ; <START_BUG> in_uint16_le ( s, num_updates ) ; for ( i = 0 ; i < num_updates ; i ++ ) { <END_BUG> in_uint16_le ( s, left ) ;  in_uint16_le ( s, top ) ; in_uint16_le ( s, right ) ; in_uint16_le ( s, bottom ) ; in_uint16_le ( s, width ) ; in_uint16_le ( s, height ) ; in_uint16_le ( s, bpp ) ; Bpp = ( bpp + 7 ) // 8 ; in_uint16_le ( s, compress ) ; in_uint16_le ( s, bufsize ) ; cx = right - left + 1 ; cy = bottom - top + 1 ; logger ( Graphics, Debug, "process_bitmap_updates(),   [%d,%d,%d,%d],   [%d,%d],   bpp=%d,   compression=%d", left, top, right, bottom, width, height, Bpp, compress ) ; if (! compress ) { int y ; bmpdata = ( uint8 * ) xmalloc ( width * height * Bpp ) ; for ( y = 0 ; y < height ; y ++ ) { in_uint8a ( s, & bmpdata [ ( height - y - 1 ) * ( width * Bpp ) ], width * Bpp ) ; } ui_paint_bitmap ( left, top, cx, cy, width, height, bmpdata ) ; xfree ( bmpdata ) ; continue ; } if ( compress & 0x400 ) { size = bufsize ; } else { in_uint8s ( s, 2 ) ; in_uint16_le ( s, size ) ; in_uint8s ( s, 4 ) ; } in_uint8p ( s, data, size ) ; bmpdata = ( uint8 * ) xmalloc (

Fix:
<S2SV_ModStart> s ) { <S2SV_ModEnd> int i ; <S2SV_ModStart> int i ; uint16 num_updates <S2SV_ModEnd> ; in_uint16_le ( <S2SV_ModStart> ++ ) { process_bitmap_data ( s <S2SV_ModEnd> ) ; }
Buggy code:
 error_t enc624j600UpdateMacAddrFilter ( NetInterface * interface ) { uint_t i ; uint_t k ; uint32_t crc ; uint16_t hashTable [ 4 ] ; MacFilterEntry * entry ; TRACE_DEBUG ( "Updating   MAC   filter...\\r\\n" ) ; osMemset ( hashTable, 0, sizeof ( hashTable ) ) ; for ( i = 0 ; i < MAC_ADDR_FILTER_SIZE ; i ++ ) { entry = & interface -> macAddrFilter [ i ] ; if ( entry -> refCount > 0 ) { crc = enc624j600CalcCrc ( & entry -> addr, sizeof ( MacAddr ) ) ; k = ( crc >> 23 ) & 0x3F ; hashTable [ k // 16 ] |= ( 1 << ( k % 16 ) ) ; } } <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_EHT1, hashTable [ 0 ] ) ; <END_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_EHT2, hashTable [ 1 ] ) ;  enc624j600WriteReg ( interface, ENC624J600_REG_EHT3, hashTable [ 2 ] ) ; <START_BUG> <END_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_EHT4, hashTable [ 3 ] ) ;  <START_BUG> TRACE_DEBUG ( "     EHT1   =   %04" PRIX16 "\\r\\n", enc624j600ReadReg ( interface, ENC624J600_REG_EHT1 ) ) ; <END_BUG>  TRACE_DEBUG ( "     EHT2   =   %04" PRIX16 "\\r\\n", enc624j600ReadReg ( interface, ENC624J600_REG_EHT2 ) ) ; <START_BUG> <END_BUG> TRACE_DEBUG ( "     EHT3   =   %04" PRIX16 "\\r\\n", enc624j600ReadReg ( interface, ENC624J600_REG_EHT3 ) ) ;  <START_BUG> TRACE_DEBUG ( "     EHT4   =   %04" PRIX16 "\\r\\n", enc624j600ReadReg ( interface, ENC624J<END_BUG>

Fix:
<S2SV_ModStart> ( interface, ENC624J600_EHT1, hashTable [ 0 ] ) ; enc624j600WriteReg ( interface, ENC624J600_EHT2 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC624J600_EHT3 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC624J600_EHT4 <S2SV_ModEnd>, hashTable [ <S2SV_ModStart> ( interface, ENC624J600_EHT1 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC624J600_EHT2 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC624J600_EHT3 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, ENC624J600_EHT4 <S2SV_ModEnd> ) ) ;
Buggy code:
 void jas_matrix_clip ( jas_matrix_t * matrix, jas_seqent_t minval, jas_seqent_t maxval ) { <START_BUG> int i ; <END_BUG> int j ; jas_seqent_t v ; jas_seqent_t * rowstart ; jas_seqent_t * data ;  int rowstep ; <START_BUG> if ( jas_matrix_numrows ( matrix ) > 0 && jas_matrix_numcols ( matrix ) > 0 ) { assert ( matrix -> rows_ ) ; rowstep = jas_matrix_rowstep ( matrix ) ; for ( i = matrix -> numrows_, rowstart = matrix -> rows_ [ 0 ] ; i > 0 ; -- i, rowstart += rowstep ) { data = rowstart ; for ( j = matrix -> numcols_, data = rowstart ; j > 0 ; -- j, ++ data ) { v = * data ; if ( v < minval ) { * data = minval ; } else if ( v > maxval ) { * data = maxval ; } } } } }<END_BUG>

Fix:
<S2SV_ModStart> maxval ) { jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; jas_seqent_t <S2SV_ModStart> * data ; jas_matind_t <S2SV_ModEnd> rowstep ; if
Buggy code:
 static int usb_parse_configuration ( struct usb_device * dev, int cfgidx, struct usb_host_config * config, unsigned char * buffer, int size ) { struct device * ddev = & dev -> dev ; unsigned char * buffer0 = buffer ; int cfgno ; int nintf, nintf_orig ; int i, j, n ; struct usb_interface_cache * intfc ; unsigned char * buffer2 ; int size2 ; struct usb_descriptor_header * header ; int len, retval ; u8 inums [ USB_MAXINTERFACES ], nalts [ USB_MAXINTERFACES ] ; unsigned iad_num = 0 ; memcpy ( & config -> desc, buffer, USB_DT_CONFIG_SIZE ) ; if ( config -> desc. bDescriptorType!= USB_DT_CONFIG || config -> desc. bLength < USB_DT_CONFIG_SIZE || config -> desc. bLength > size ) { dev_err ( ddev, "invalid   descriptor   for   config   index   %d:   " "type   =   0x%X,   length   =   %d\\n", cfgidx, config -> desc. bDescriptorType, config -> desc. bLength ) ; return - EINVAL ; } cfgno = config -> desc. bConfigurationValue ; buffer += config -> desc. bLength ; size -= config -> desc. bLength ; nintf = nintf_orig = config -> desc. bNumInterfaces ; if ( nintf > USB_MAXINTERFACES ) { dev_warn ( ddev, "config   %d   has   too   many   interfaces:   %d,   " "using   maximum   allowed:   %d\\n", cfgno, nintf, USB_MAXINTERFACES ) ; nintf = USB_MAXINTERFACES ; } n = 0 ; for ( ( buffer2 = buffer, size2 = size ) ; size2 > 0 ; ( buffer2 += header -> bLength, size2 -= header -> bLength ) ) { if ( size2 < sizeof ( struct usb_descriptor_header ) ) { dev_warn ( ddev, "config   %d   descriptor   has   %d   excess   " "byte%s,   ignoring\\n", cfgno, size2,

Fix:
<S2SV_ModStart> USB_DT_INTERFACE_ASSOCIATION ) { struct usb_interface_assoc_descriptor * d ; d = ( struct usb_interface_assoc_descriptor * ) header ; if ( d -> bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE ) { dev_warn ( ddev, "config <S2SV_blank> %d <S2SV_blank> has <S2SV_blank> an <S2SV_blank> invalid <S2SV_blank> interface <S2SV_blank> association <S2SV_blank> descriptor <S2SV_blank> of <S2SV_blank> length <S2SV_blank> %d, <S2SV_blank> skipping\\n", cfgno, d -> bLength ) ; continue ; } <S2SV_ModStart> iad_num ] = d <S2SV_ModEnd> ; iad_num ++
Buggy code:
 int pnm_validate ( jas_stream_t * in ) { <START_BUG> uchar buf [ 2 ] ; <END_BUG> int i ; int n ; assert ( JAS_STREAM_MAXPUTBACK >= 2 ) ; if ( ( n = jas_stream_read ( in, buf, 2 ) ) < 0 ) { return - 1 ; } for ( i = n - 1 ; i >= 0 ; -- i ) { if ( jas_stream_ungetc ( in, buf [ i ] ) == EOF ) { return - 1 ; } } if ( n < 2 ) { return - 1 ; } if ( buf [ 0 ] == 'P' && isdigit ( buf [ 1 ] ) ) { return 0 ; } return - 1 ; }

Fix:
<S2SV_ModStart> in ) { jas_uchar <S2SV_ModEnd> buf [ 2