nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> static void count_segs_sb ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG>  MODE_INFO * * mi_8x8, <START_BUG> int * no_pred_segcounts, int ( * temporal_predictor_count ) [ 2 ], int * t_unpred_seg_counts, int mi_row, int mi_col, BLOCK_SIZE bsize ) { <END_BUG> const VP9_COMMON * const cm = & cpi -> common ;  const int mis = cm -> mi_stride ; int bw, bh ; const int bs = num_8x8_blocks_wide_lookup [ bsize ], hbs = bs // 2 ; if ( mi_row >= cm -> mi_rows || mi_col >= cm -> mi_cols ) return ; <START_BUG> bw = num_8x8_blocks_wide_lookup [ mi_8x8 [ 0 ] -> mbmi. sb_type ] ; <END_BUG>  bh = num_8x8_blocks_high_lookup [ mi_8x8 [ 0 ] -> mbmi. sb_type ] ; <START_BUG> if ( bw == bs && bh == bs ) { <END_BUG> count_segs ( cpi, tile, mi_8x8, no_pred_segcounts, temporal_predictor_count,  t_unpred_seg_counts, bs, bs, mi_row, mi_col ) ; } else if ( bw == bs && bh < bs ) { <START_BUG> count_segs ( cpi, tile, mi_8x8, no_pred_segcounts, temporal_predictor_count, <END_BUG> t_unpred_seg_counts, bs, hbs, mi_row, mi_col ) ;  count_segs ( cpi, tile, mi_8x8 + hbs * mis, no_pred_segcounts, <START_BUG> temporal_predictor_count, t_unpred_seg_counts, bs, hbs, mi_row + hbs, mi_col ) ; } else if ( bw < bs && bh == bs ) { <END_BUG> count_segs ( cpi, tile, mi_8x8, no_pred_segcounts, temporal_predictor_count,  t_unpred_seg_counts, hbs, bs, mi_row, mi_

Fix:
<S2SV_ModStart> void count_segs_sb ( const VP9_COMMON * cm, MACROBLOCKD * xd, <S2SV_ModEnd> const TileInfo * <S2SV_ModStart> const TileInfo * tile, <S2SV_ModEnd> MODE_INFO * * <S2SV_ModStart> MODE_INFO * * mi <S2SV_ModEnd>, int * <S2SV_ModStart> bsize ) { <S2SV_ModEnd> const int mis <S2SV_ModStart> = num_8x8_blocks_wide_lookup [ mi <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> = num_8x8_blocks_high_lookup [ mi <S2SV_ModEnd> [ 0 ] <S2SV_ModStart> { count_segs ( cm, xd, tile, mi <S2SV_ModEnd>, no_pred_segcounts, <S2SV_ModStart> { count_segs ( cm, xd, tile, mi <S2SV_ModEnd>, no_pred_segcounts, <S2SV_ModStart> ; count_segs ( cm, xd, tile, mi <S2SV_ModEnd> + hbs * <S2SV_ModStart> { count_segs ( cm, xd, tile, mi <S2SV_ModEnd>, no_pred_segcounts, <S2SV_ModStart> ; count_segs ( cm, xd, tile, mi <S2SV_ModEnd> + hbs, <S2SV_ModStart> ; count_segs_sb ( cm, xd <S2SV_ModEnd>, tile, <S2SV_ModStart> tile, & mi <S2SV_ModEnd> [ mi_dr *
Buggy code:
 struct xt_table_info * xt_alloc_table_info ( unsigned int size ) { struct xt_table_info * info = NULL ; <START_BUG> size_t sz = sizeof ( * info ) + size ; <END_BUG> if ( ( SMP_ALIGN ( size ) >> PAGE_SHIFT ) + 2 > totalram_pages ) return NULL ; if ( sz <= ( PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER ) ) info = kmalloc ( sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY ) ; if (! info ) { info = vmalloc ( sz ) ; if (! info ) return NULL ; } memset ( info, 0, sizeof ( * info ) ) ; info -> size = size ; return info ; }

Fix:
<S2SV_ModStart> ) + size ; if ( sz < sizeof ( * info ) ) return NULL
Buggy code:
 vpx_codec_err_t vpx_codec_dec_init_ver ( vpx_codec_ctx_t * ctx, vpx_codec_iface_t * iface, <START_BUG> vpx_codec_dec_cfg_t * cfg, <END_BUG> vpx_codec_flags_t flags, int ver ) { vpx_codec_err_t res ; if ( ver!= VPX_DECODER_ABI_VERSION ) res = VPX_CODEC_ABI_MISMATCH ; else if (! ctx ||! iface ) res = VPX_CODEC_INVALID_PARAM ; else if ( iface -> abi_version!= VPX_CODEC_INTERNAL_ABI_VERSION ) res = VPX_CODEC_ABI_MISMATCH ;  else if ( ( flags & VPX_CODEC_USE_XMA ) &&! ( iface -> caps & VPX_CODEC_CAP_XMA ) ) <START_BUG> res = VPX_CODEC_INCAPABLE ; else if ( ( flags & VPX_CODEC_USE_POSTPROC ) &&! ( iface -> caps & VPX_CODEC_CAP_POSTPROC ) ) res = VPX_CODEC_INCAPABLE ; else if ( ( flags & VPX_CODEC_USE_ERROR_CONCEALMENT ) &&! ( iface -> caps & VPX_CODEC_CAP_ERROR_CONCEALMENT ) ) res = VPX_CODEC_INCAPABLE ; else if ( ( flags & VPX_CODEC_USE_INPUT_FRAGMENTS ) &&! ( iface -> caps & VPX_CODEC_CAP_INPUT_FRAGMENTS ) ) res = VPX_CODEC_INCAPABLE ; else if (! ( iface -> caps & VPX_CODEC_CAP_DECODER ) ) res = VPX_CODEC_INCAPABLE ; else { memset ( ctx, 0, sizeof ( * ctx ) ) ; ctx -> iface = iface ; ctx -> name = iface -> name ; ctx -> priv = NULL ; ctx -> init_flags = flags ; ctx -> config. dec = cfg ; <END_BUG> res = VPX_CODEC_OK ;  if (! ( flags & VPX_CODE

Fix:
<S2SV_ModStart> * iface, const <S2SV_ModStart> ( flags & <S2SV_ModEnd> VPX_CODEC_USE_POSTPROC ) && <S2SV_ModStart> ; res = <S2SV_ModEnd> ctx -> iface <S2SV_ModStart> ) ; } <S2SV_ModEnd> } return SAVE_STATUS
Buggy code:
 static int _6502_op ( RAnal * anal, RAnalOp * op, ut64 addr, const ut8 * data, int len ) { char addrbuf [ 64 ] ; const int buffsize = sizeof ( addrbuf ) - 1 ; memset ( op, '\\0', sizeof ( RAnalOp ) ) ; op -> size = snes_op_get_size ( 1, 1, & snes_op [ data [ 0 ] ] ) ; op -> addr = addr ; op -> type = R_ANAL_OP_TYPE_UNK ; op -> id = data [ 0 ] ; r_strbuf_init ( & op -> esil ) ; switch ( data [ 0 ] ) { case 0x02 : case 0x03 : case 0x04 : case 0x07 : case 0x0b : case 0x0c : case 0x0f : case 0x12 : case 0x13 : case 0x14 : case 0x17 : case 0x1a : case 0x1b : case 0x1c : case 0x1f : case 0x22 : case 0x23 : case 0x27 : case 0x2b : case 0x2f : case 0x32 : case 0x33 : case 0x34 : case 0x37 : case 0x3a : case 0x3b : case 0x3c : case 0x3f : case 0x42 : case 0x43 : case 0x44 : case 0x47 : case 0x4b : case 0x4f : case 0x52 : case 0x53 : case 0x54 : case 0x57 : case 0x5a : case 0x5b : case 0x5c : case 0x5f : case 0x62 : case 0x63 : case 0x64 : case 0x67 : case 0x6b : case 0x6f : case 0x72 : case 0x73 : case 0x74 : case 0x77 : case 0x7a : case 0x7b : case 0x7c : case 0x7f : case 0x80 : case 0x82 : case 0x83 : case 0x87 : case 0x89 : case 0x8b : case 0x8f : case 0x92 : case 0x

Fix:
<S2SV_ModStart> ; if ( len > 1 ) { if ( <S2SV_ModStart> <= 127 ) { <S2SV_ModStart> -> size ; } else { <S2SV_ModEnd> op -> jump <S2SV_ModStart> -> size ; } } else { op -> jump = addr ; }
Buggy code:
 char * curl_easy_unescape ( CURL * handle, const char * string, int length, int * olen ) { <START_BUG> int alloc = ( length? length : ( int ) strlen ( string ) ) + 1 ; <END_BUG> char * ns = malloc ( alloc ) ; unsigned char in ; int strindex = 0 ; unsigned long hex ;  CURLcode res ; <START_BUG> if (! ns ) return NULL ; while ( -- alloc > 0 ) { in = * string ; if ( ( '%' == in ) && ISXDIGIT ( string [ 1 ] ) && ISXDIGIT ( string [ 2 ] ) ) { char hexstr [ 3 ] ; char * ptr ; hexstr [ 0 ] = string [ 1 ] ; hexstr [ 1 ] = string [ 2 ] ; hexstr [ 2 ] = 0 ; hex = strtoul ( hexstr, & ptr, 16 ) ; in = curlx_ultouc ( hex ) ; <END_BUG> res = Curl_convert_from_network ( handle, & in, 1 ) ;  <START_BUG> if ( res ) { <END_BUG> free ( ns ) ; return NULL ; } string += 2 ; alloc -= 2 ; } ns [ strindex ++ ] = in ; string ++ ; } ns [ strindex ] = 0 ; if ( olen )  * olen = strindex ; <START_BUG> return ns ; }<END_BUG>

Fix:
<S2SV_ModStart> olen ) { char * str = NULL ; size_t inputlen = length ; size_t outputlen <S2SV_ModEnd> ; CURLcode res <S2SV_ModStart> ; CURLcode res = Curl_urldecode <S2SV_ModEnd> ( handle, <S2SV_ModStart> ( handle, string, inputlen, & str, & outputlen, FALSE <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( res ) return NULL <S2SV_ModEnd> ; if ( <S2SV_ModStart> * olen = curlx_uztosi ( outputlen ) ; return str <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static int <START_BUG> mptctl_mpt_command ( unsigned long arg ) <END_BUG> { struct mpt_ioctl_command __user * uarg = ( void __user * ) arg ;  struct mpt_ioctl_command karg ; <START_BUG> MPT_ADAPTER * ioc ; int iocnum ; int rc ; if ( copy_from_user ( & karg, uarg, sizeof ( struct mpt_ioctl_command ) ) ) { printk ( KERN_ERR MYNAM "%s@%d::mptctl_mpt_command   -   " "Unable   to   read   in   mpt_ioctl_command   struct   @   %p\\n", __FILE__, __LINE__, uarg ) ; return - EFAULT ; } <END_BUG> if ( ( ( iocnum = mpt_verify_adapter ( karg. hdr. iocnum, & ioc ) ) < 0 ) ||  ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_mpt_command()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; return - ENODEV ; } <START_BUG> rc = mptctl_do_mpt_command ( karg, & uarg -> MF ) ; <END_BUG> return rc ; }

Fix:
<S2SV_ModStart> int mptctl_mpt_command ( MPT_ADAPTER * ioc, <S2SV_ModStart> struct mpt_ioctl_command karg <S2SV_ModEnd> ; int rc <S2SV_ModStart> EFAULT ; } <S2SV_ModEnd> rc = mptctl_do_mpt_command <S2SV_ModStart> = mptctl_do_mpt_command ( ioc,
Buggy code:
 static Image * ReadPSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define BoundingBox "BoundingBox:" # define BeginDocument "BeginDocument:" # define BeginXMPPacket "<?xpacket   begin=" # define EndXMPPacket "<?xpacket   end=" # define ICCProfile "BeginICCProfile:" # define CMYKCustomColor "CMYKCustomColor:" # define CMYKProcessColor "CMYKProcessColor:" # define DocumentMedia "DocumentMedia:" # define DocumentCustomColors "DocumentCustomColors:" # define DocumentProcessColors "DocumentProcessColors:" # define EndDocument "EndDocument:" # define HiResBoundingBox "HiResBoundingBox:" # define ImageData "ImageData:" # define PageBoundingBox "PageBoundingBox:" # define LanguageLevel "LanguageLevel:" # define PageMedia "PageMedia:" # define Pages "Pages:" # define PhotoshopProfile "BeginPhotoshop:" # define PostscriptLevel "!PS-" # define RenderPostscriptText "     Rendering   Postscript...     " # define SpotColor "+   " char command [ MagickPathExtent ], * density, filename [ MagickPathExtent ], geometry [ MagickPathExtent ], input_filename [ MagickPathExtent ], message [ MagickPathExtent ], * options, postscript_filename [ MagickPathExtent ] ; const char * option ; const DelegateInfo * delegate_info ; GeometryInfo geometry_info ; Image * image, * next, * postscript_image ; ImageInfo * read_info ; int c, file ; MagickBooleanType cmyk, fitPage, skip, status ; MagickStatusType flags ; PointInfo delta, resolution ; RectangleInfo page ; register char * p ; register ssize_t i ; SegmentInfo bounds, hires_bounds ; short int hex_digits [ 256 ] ; size_t length ; ssize_t count, priority ; StringInfo * profile ; unsigned long columns, extent, language_level, pages, rows, scene, spotcolor ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo

Fix:
<S2SV_ModStart> "`%s\'", option ) ; page_geometry = DestroyString ( page_geometry
Buggy code:
 static void btif_dm_upstreams_evt ( UINT16 event, char * p_param ) { tBTA_DM_SEC * p_data = ( tBTA_DM_SEC * ) p_param ; tBTA_SERVICE_MASK service_mask ; uint32_t i ; bt_bdaddr_t bd_addr ; BTIF_TRACE_EVENT ( "btif_dm_upstreams_cback     ev:   %s", dump_dm_event ( event ) ) ; switch ( event ) { case BTA_DM_ENABLE_EVT : { BD_NAME bdname ; bt_status_t status ; bt_property_t prop ; prop. type = BT_PROPERTY_BDNAME ; prop. len = BD_NAME_LEN ; prop. val = ( void * ) bdname ; status = btif_storage_get_adapter_property ( & prop ) ; if ( status == BT_STATUS_SUCCESS ) { BTA_DmSetDeviceName ( ( char * ) prop. val ) ; } else { BTA_DmSetDeviceName ( btif_get_default_local_name ( ) ) ; } # if ( defined ( BLE_INCLUDED ) && ( BLE_INCLUDED == TRUE ) ) BTA_DmBleConfigLocalPrivacy ( BLE_LOCAL_PRIVACY_ENABLED ) ; # endif service_mask = btif_get_enabled_services_mask ( ) ; for ( i = 0 ; i <= BTA_MAX_SERVICE_ID ; i ++ ) { if ( service_mask & ( tBTA_SERVICE_MASK ) ( BTA_SERVICE_ID_TO_SERVICE_MASK ( i ) ) ) { btif_in_execute_service_request ( i, TRUE ) ; } } memset ( & pairing_cb, 0, sizeof ( btif_dm_pairing_cb_t ) ) ; pairing_cb. bond_type = BOND_TYPE_PERSISTENT ; btif_storage_load_bonded_devices ( ) ; btif_storage_load_autopair_device_list ( ) ; btif_enable_bluetooth_evt ( p_data -> enable. status ) ; } break ; case BTA_

Fix:
<S2SV_ModStart> ( ) ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> usleep ( 100000 )
Buggy code:
 static vpx_codec_err_t ctrl_get_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> vp9_ref_frame_t * data = va_arg ( args, vp9_ref_frame_t * ) ;  if ( data ) { <START_BUG> YV12_BUFFER_CONFIG * fb ; <END_BUG> vp9_get_reference_dec ( ctx -> pbi, data -> idx, & fb ) ;  yuvconfig2image ( & data -> img, fb, NULL ) ; return VPX_CODEC_OK ; } else { return VPX_CODEC_INVALID_PARAM ; } }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> ; if ( ctx -> frame_parallel_decode ) { set_error_detail ( ctx, "Not <S2SV_blank> supported <S2SV_blank> in <S2SV_blank> frame <S2SV_blank> parallel <S2SV_blank> decode" ) ; return VPX_CODEC_INCAPABLE ; } if ( <S2SV_ModStart> * fb ; VPxWorker * const worker = ctx -> frame_workers ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; fb = get_ref_frame ( & frame_worker_data -> pbi -> common <S2SV_ModEnd>, data -> <S2SV_ModStart> data -> idx ) ; if ( fb == NULL ) return VPX_CODEC_ERROR <S2SV_ModEnd> ; yuvconfig2image (
Buggy code:
 void sctp_assoc_update ( struct sctp_association * asoc, struct sctp_association * new ) { struct sctp_transport * trans ; struct list_head * pos, * temp ; asoc -> c = new -> c ; asoc -> peer. rwnd = new -> peer. rwnd ; asoc -> peer. sack_needed = new -> peer. sack_needed ; <START_BUG> asoc -> peer. i = new -> peer. i ; <END_BUG> sctp_tsnmap_init ( & asoc -> peer. tsn_map, SCTP_TSN_MAP_INITIAL, asoc -> peer. i. initial_tsn, GFP_ATOMIC ) ; list_for_each_safe ( pos, temp, & asoc -> peer. transport_addr_list ) { trans = list_entry ( pos, struct sctp_transport, transports ) ; if (! sctp_assoc_lookup_paddr ( new, & trans -> ipaddr ) ) { sctp_assoc_rm_peer ( asoc, trans ) ; continue ; } if ( asoc -> state >= SCTP_STATE_ESTABLISHED ) sctp_transport_reset ( trans ) ; } if ( asoc -> state >= SCTP_STATE_ESTABLISHED ) { asoc -> next_tsn = new -> next_tsn ; asoc -> ctsn_ack_point = new -> ctsn_ack_point ; asoc -> adv_peer_ack_point = new -> adv_peer_ack_point ; sctp_ssnmap_clear ( asoc -> ssnmap ) ; sctp_ulpq_flush ( & asoc -> ulpq ) ; asoc -> overall_error_count = 0 ; } else { list_for_each_entry ( trans, & new -> peer. transport_addr_list, transports ) { if (! sctp_assoc_lookup_paddr ( asoc, & trans -> ipaddr ) ) sctp_assoc_add_peer ( asoc, & trans -> ipaddr, GFP_ATOMIC, trans -> state ) ; } asoc -> ctsn_ack_point = asoc -> next_tsn - 1 ; asoc -> adv_peer_ack_point = asoc -> ctsn_ack

Fix:
<S2SV_ModStart> -> peer. auth_capable = new -> peer. auth_capable ; asoc -> peer.
Buggy code:
 static int sysMapFD ( int fd, MemMapping * pMap ) { off_t start ; size_t length ; void * memPtr ; assert ( pMap!= NULL ) ; if ( getFileStartAndLength ( fd, & start, & length ) < 0 ) return - 1 ; memPtr = mmap ( NULL, length, PROT_READ, MAP_PRIVATE, fd, start ) ; if ( memPtr == MAP_FAILED ) { LOGW ( "mmap(%d,   R,   PRIVATE,   %d,   %d)   failed:   %s\\n", ( int ) length, fd, ( int ) start, strerror ( errno ) ) ; return - 1 ; } pMap -> addr = memPtr ; pMap -> length = length ; pMap -> range_count = 1 ; <START_BUG> pMap -> ranges = malloc ( sizeof ( MappedRange ) ) ; <END_BUG> pMap -> ranges [ 0 ]. addr = memPtr ; pMap -> ranges [ 0 ]. length = length ; return 0 ; }

Fix:
<S2SV_ModStart> ) ) ; if ( pMap -> ranges == NULL ) { LOGE ( "malloc <S2SV_blank> failed: <S2SV_blank> %s\\n", strerror ( errno ) ) ; munmap ( memPtr, length ) ; return - 1 ; }
Buggy code:
 void xmlParsePI ( xmlParserCtxtPtr ctxt ) { xmlChar * buf = NULL ; int len = 0 ; int size = XML_PARSER_BUFFER_SIZE ; int cur, l ; const xmlChar * target ; xmlParserInputState state ; int count = 0 ; if ( ( RAW == '<' ) && ( NXT ( 1 ) == '?' ) ) { xmlParserInputPtr input = ctxt -> input ; state = ctxt -> instate ; ctxt -> instate = XML_PARSER_PI ; SKIP ( 2 ) ; SHRINK ; target = xmlParsePITarget ( ctxt ) ; if ( target!= NULL ) { if ( ( RAW == '?' ) && ( NXT ( 1 ) == '>' ) ) { if ( input!= ctxt -> input ) { xmlFatalErrMsg ( ctxt, XML_ERR_ENTITY_BOUNDARY, "PI   declaration   doesn\'t   start   and   stop   in   the   same   entity\\n" ) ; } SKIP ( 2 ) ; if ( ( ctxt -> sax ) && (! ctxt -> disableSAX ) && ( ctxt -> sax -> processingInstruction!= NULL ) ) ctxt -> sax -> processingInstruction ( ctxt -> userData, <START_BUG> target, NULL ) ; <END_BUG> ctxt -> instate = state ; return ; } buf = ( xmlChar * ) xmlMallocAtomic ( size * sizeof ( xmlChar ) ) ; if ( buf == NULL ) { xmlErrMemory ( ctxt, NULL ) ; ctxt -> instate = state ; return ; } cur = CUR ; if (! IS_BLANK ( cur ) ) { xmlFatalErrMsgStr ( ctxt, XML_ERR_SPACE_REQUIRED, "ParsePI:   PI   %s   space   expected\\n", target ) ; } SKIP_BLANKS ; cur = CUR_CHAR ( l ) ; while ( IS_CHAR ( cur ) && ( ( cur!= '?' ) || ( NXT ( 1 )!= '>' ) ) ) { if ( len + 5 >= size ) { xmlChar * tmp ; size *= 2 ; tmp = ( xmlChar * ) xmlRealloc ( buf, size * sizeof ( xmlChar ) ) ; if ( tmp == NULL ) { xmlErrMemory ( ctxt, NULL ) ; xmlFree ( buf ) ; ctxt -> instate = state ; return ; } buf = tmp ; } count ++ ; if ( count > 50 ) { GROW ; count = 0 ; } COPY_BUF

Fix:
<S2SV_ModStart> NULL ) ; if ( ctxt -> instate!= XML_PARSER_EOF ) <S2SV_ModStart> ) ; } if ( <S2SV_ModStart> ctxt -> instate!= XML_PARSER_EOF ) ctxt -> instate
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; one = 1 ; image = AcquireImage ( image_info, exception ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse )

Fix:
<S2SV_ModStart> -> rows = 1 <S2SV_ModEnd> ; image -> <S2SV_ModStart> ( BImgBuff ) <S2SV_ModEnd> ; break ;
Buggy code:
 static inline void header_put_be_int ( SF_PRIVATE * psf, int x ) <START_BUG> { if ( psf -> headindex < SIGNED_SIZEOF ( psf -> header ) - 4 ) <END_BUG>  { psf -> header [ psf -> headindex ++ ] = ( x >> 24 ) ; <START_BUG> <END_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 16 ) ;  <START_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 8 ) ; <END_BUG>  psf -> header [ psf -> headindex ++ ] = x ; <START_BUG> <END_BUG> } ;  }

Fix:
<S2SV_ModStart> x ) { <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. ptr [ <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> x ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 int options_cmdline ( char * arg1, char * arg2 ) { char * name ; CONF_TYPE type ; # ifdef USE_WIN32 ( void ) arg2 ; # endif if (! arg1 ) { name = # ifdef CONFDIR CONFDIR # ifdef USE_WIN32 "\\\\" # else "//" # endif # endif "stunnel.conf" ; type = CONF_FILE ; } else if (! strcasecmp ( arg1, "-help" ) ) { <START_BUG> parse_global_option ( CMD_PRINT_HELP, NULL, NULL ) ; <END_BUG> parse_service_option ( CMD_PRINT_HELP, NULL, NULL, NULL ) ; log_flush ( LOG_MODE_INFO ) ; return 2 ; } else if (! strcasecmp ( arg1, "-version" ) ) {  parse_global_option ( CMD_PRINT_DEFAULTS, NULL, NULL ) ; <START_BUG> parse_service_option ( CMD_PRINT_DEFAULTS, NULL, NULL, NULL ) ; log_flush ( LOG_MODE_INFO ) ; return 2 ; } else if (! strcasecmp ( arg1, "-sockets" ) ) { socket_options_print ( ) ; log_flush ( LOG_MODE_INFO ) ; return 2 ; } else if (! strcasecmp ( arg1, "-options" ) ) { print_ssl_options ( ) ; log_flush ( LOG_MODE_INFO ) ; return 2 ; } else # ifndef USE_WIN32 if (! strcasecmp ( arg1, "-fd" ) ) { if (! arg2 ) { s_log ( LOG_ERR, "No   file   descriptor   specified" ) ; print_syntax ( ) ; return 1 ; } name = arg2 ; type = CONF_FD ; } else # endif { name = arg1 ; type = CONF_FILE ; } if ( type == CONF_FILE ) { # ifdef HAVE_REALPATH char * real_path = NULL ; # ifdef MAXPATHLEN real_path = malloc ( MAXPATHLEN ) ; # endif real_path = realpath ( name, real_path ) ; if (! real_path ) { s_log ( LOG_ERR, "Invalid   configuration   file   name   \\"%s\\"", name ) ; ioerror ( "realpath" ) ; return 1 ; } configuration_file = str_dup ( real_path )<END_BUG>

Fix:
<S2SV_ModStart> NULL, NULL, NULL <S2SV_ModStart> parse_global_option ( CMD_PRINT_DEFAULTS, NULL
Buggy code:
 static int misaligned_fpu_store ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift, int do_paired_load ) { int error ; int srcreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, address ) ; <END_BUG> srcreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; __u32 buflo = 0xffffffffUL, bufhi = 0xffffffffUL ; if (! access_ok ( VERIFY_WRITE, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } if ( last_task_used_math == current ) { enable_fpu ( ) ; save_fpu ( current ) ; disable_fpu ( ) ; last_task_used_math = NULL ; regs -> sr |= SR_FD ; } switch ( width_shift ) { case 2 : buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; break ; case 3 : if ( do_paired_load ) { buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; bufhi = current -> thread. xstate -> hardfpu. fp_regs [ srcreg + 1 ] ; } else { # if defined ( CONFIG_CPU_LITTLE_ENDIAN ) bufhi = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg + 1 ] ; # else buflo = current -> thread. xstate -> hardfpu. fp_regs [ srcreg ] ; bufhi = current -> thread. xstate -> hardfpu. fp_regs [ srcreg + 1 ] ; # endif } break ; default : printk ( "Unexpected   width_shift   %d   in   misaligned_fpu_store,   PC=%08lx

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 static void ndpi_reset_packet_line_info ( struct ndpi_packet_struct * packet ) { packet -> parsed_lines = 0, packet -> empty_line_position_set = 0, packet -> host_line. ptr = NULL, packet -> host_line. len = 0, packet -> referer_line. ptr = NULL, packet -> referer_line. len = 0, packet -> content_line. ptr = NULL, packet -> content_line. len = 0, packet -> accept_line. ptr = NULL, packet -> accept_line. len = 0, packet -> user_agent_line. ptr = NULL, packet -> user_agent_line. len = 0, packet -> http_url_name. ptr = NULL, packet -> http_url_name. len = 0, packet -> http_encoding. ptr = NULL, packet -> http_encoding. len = 0, packet -> http_transfer_encoding. ptr = NULL, packet -> http_transfer_encoding. len = 0, <START_BUG> packet -> http_contentlen. ptr = NULL, packet -> http_contentlen. len = 0, packet -> http_cookie. ptr = NULL, <END_BUG> packet -> http_cookie. len = 0, packet -> http_origin. len = 0, packet -> http_origin. ptr = NULL, packet -> http_x_session_type. ptr = NULL, packet -> http_x_session_type. len = 0, packet -> server_line. ptr = NULL, packet -> server_line. len = 0, packet -> http_method. ptr = NULL, packet -> http_method. len = 0, packet -> http_response. ptr = NULL, packet -> http_response. len = 0, packet -> http_num_headers = 0 ; }

Fix:
<S2SV_ModStart>, packet -> content_disposition_line. ptr = NULL, packet -> content_disposition_line. len = 0, packet ->
Buggy code:
 static void exif_mnote_data_fuji_load ( ExifMnoteData * en, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataFuji * n = ( ExifMnoteDataFuji * ) en ; ExifLong c ; size_t i, tcount, o, datao ; if (! n ||! buf ||! buf_size ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short   MakerNote" ) ; return ; } datao = 6 + n -> offset ; if ( CHECKOVERFLOW ( datao, buf_size, 12 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short   MakerNote" ) ; return ; } n -> order = EXIF_BYTE_ORDER_INTEL ; datao += exif_get_long ( buf + datao + 8, EXIF_BYTE_ORDER_INTEL ) ; if ( CHECKOVERFLOW ( datao, buf_size, 2 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short   MakerNote" ) ; return ; } c = exif_get_short ( buf + datao, EXIF_BYTE_ORDER_INTEL ) ; datao += 2 ; exif_mnote_data_fuji_clear ( n ) ; n -> entries = exif_mem_alloc ( en -> mem, sizeof ( MnoteFujiEntry ) * c ) ; if (! n -> entries ) { EXIF_LOG_NO_MEMORY ( en -> log, "ExifMnoteDataFuji", sizeof ( MnoteFujiEntry ) * c ) ; return ; } tcount = 0 ; for ( i = c, o = datao ; i ; -- i, o += 12 ) { size_t s ; <START_BUG> if ( CHECKOVERFLOW ( o, buf_size, 12 ) ) { <END_BUG> exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteData

Fix:
<S2SV_ModStart> size_t s ; memset ( & n -> entries [ tcount ], 0, sizeof ( MnoteFujiEntry ) ) ;
Buggy code:
 static vpx_codec_err_t encoder_encode ( vpx_codec_alg_priv_t * ctx, const vpx_image_t * img, vpx_codec_pts_t pts, unsigned long duration, vpx_enc_frame_flags_t flags, unsigned long deadline ) { vpx_codec_err_t res = VPX_CODEC_OK ; <START_BUG> if ( img ) <END_BUG>  res = validate_img ( ctx, img ) ; <START_BUG> pick_quickcompress_mode ( ctx, duration, deadline ) ; vpx_codec_pkt_list_init ( & ctx -> pkt_list ) ; if ( ( ( flags & VP8_EFLAG_NO_UPD_GF ) && ( flags & VP8_EFLAG_FORCE_GF ) ) || ( ( flags & VP8_EFLAG_NO_UPD_ARF ) && ( flags & VP8_EFLAG_FORCE_ARF ) ) ) { ctx -> base. err_detail = "Conflicting   flags." ; return VPX_CODEC_INVALID_PARAM ; } <END_BUG> if ( flags & ( VP8_EFLAG_NO_REF_LAST | VP8_EFLAG_NO_REF_GF |  VP8_EFLAG_NO_REF_ARF ) ) { int ref = 7 ; if ( flags & VP8_EFLAG_NO_REF_LAST ) ref ^= VP9_LAST_FLAG ; if ( flags & VP8_EFLAG_NO_REF_GF ) ref ^= VP9_GOLD_FLAG ; if ( flags & VP8_EFLAG_NO_REF_ARF ) ref ^= VP9_ALT_FLAG ; vp9_use_as_reference ( ctx -> cpi, ref ) ; } if ( flags & ( VP8_EFLAG_NO_UPD_LAST | VP8_EFLAG_NO_UPD_GF | VP8_EFLAG_NO_UPD_ARF | VP8_EFLAG_FORCE_GF | VP8_EFLAG_FORCE_ARF ) ) { int upd = 7 ; if ( flags & VP8_EFLAG_NO_UPD_LAST ) upd ^= VP9_LAST_

Fix:
<S2SV_ModStart> = VPX_CODEC_OK ; VP9_COMP * const cpi = ctx -> cpi ; const vpx_rational_t * const timebase = & ctx -> cfg. g_timebase ; size_t data_sz ; <S2SV_ModStart> if ( img!= NULL ) { <S2SV_ModEnd> res = validate_img <S2SV_ModStart> img ) ; if ( res == VPX_CODEC_OK && cpi!= NULL ) { data_sz = ctx -> cfg. g_w * ctx -> cfg. g_h * get_image_bps ( img ) // 8 * ( cpi -> multi_arf_allowed? 8 : 2 ) ; if ( data_sz < 4096 ) data_sz = 4096 ; if ( ctx -> cx_data == NULL || ctx -> cx_data_sz < data_sz ) { ctx -> cx_data_sz = data_sz ; free ( ctx -> cx_data ) ; ctx -> cx_data = ( unsigned char * ) malloc ( ctx -> cx_data_sz ) ; if ( ctx -> cx_data == NULL ) { return VPX_CODEC_MEM_ERROR ; } } } } <S2SV_ModStart> VPX_CODE
Buggy code:
 static void Sp_search ( js_State * J ) { js_Regexp * re ; const char * text ; Resub m ; text = checkstring ( J, 0 ) ; if ( js_isregexp ( J, 1 ) ) js_copy ( J, 1 ) ; else if ( js_isundefined ( J, 1 ) ) js_newregexp ( J, "", 0 ) ; else js_newregexp ( J, js_tostring ( J, 1 ), 0 ) ; re = js_toregexp ( J, - 1 ) ; <START_BUG> if (! js_regexec ( re -> prog, text, & m, 0 ) ) <END_BUG> js_pushnumber ( J, js_utfptrtoidx ( text, m. sub [ 0 ]. sp ) ) ; else js_pushnumber ( J, - 1 ) ; }

Fix:
<S2SV_ModStart> if (! js_doregexec ( J, <S2SV_ModEnd> re -> prog
Buggy code:
 static MagickBooleanType EncodeImage ( const ImageInfo * image_info, Image * image, const size_t data_size ) { # define MaxCode ( number_bits ) ( ( one << ( number_bits ) ) - 1 ) # define MaxHashTable 5003 # define MaxGIFBits 12UL # define MaxGIFTable ( 1UL << MaxGIFBits ) <START_BUG> # define GIFOutputCode ( code ) { if ( bits > 0 ) datum |= ( size_t ) ( code ) << bits ; else datum = ( size_t ) ( code ) ; bits += number_bits ; while ( bits >= 8 ) { packet [ length ++ ] = ( unsigned char ) ( datum & 0xff ) ; if ( length >= 254 ) { ( void ) WriteBlobByte ( image, ( unsigned char ) length ) ; ( void ) WriteBlob ( image, length, packet ) ; length = 0 ; } datum >>= 8 ; bits -= 8 ; } if ( free_code > max_code ) { number_bits ++ ; if ( number_bits == MaxGIFBits ) max_code = MaxGIFTable ; else max_code = MaxCode ( number_bits ) ; } } <END_BUG> IndexPacket index ; short * hash_code, * hash_prefix, waiting_code ; size_t bits, clear_code, datum, end_of_information_code, free_code, length, max_code, next_pixel, number_bits, one, pass ; ssize_t displacement, offset, k, y ; unsigned char * packet, * hash_suffix ; assert ( image!= ( Image * ) NULL ) ; one = 1 ; packet = ( unsigned char * ) AcquireQuantumMemory ( 256, sizeof ( * packet ) ) ; hash_code = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_code ) ) ; hash_prefix = ( short * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_prefix ) ) ; hash_suffix = ( unsigned char * ) AcquireQuantumMemory ( MaxHashTable, sizeof ( * hash_suffix ) ) ; if ( ( packet == ( unsigned char * ) NULL ) || ( hash_code == ( short * ) NULL ) || ( hash_prefix == ( short * ) NULL ) || ( hash_suffix == ( unsigned char * ) NULL ) ) { if (

Fix:
<S2SV_ModStart> ( code ) \\\n{ <S2SV_ModEnd> if ( bits <S2SV_ModStart> ) ; } \\\n} <S2SV_ModEnd> IndexPacket index ; <S2SV_ModStart> ++ ) { next_pixel = MagickFalse ; displacement = 1 ; <S2SV_ModStart> -= MaxHashTable ; if ( k < 0 ) continue <S2SV_ModEnd> ; if (
Buggy code:
 int pure_strcmp ( const char * const s1, const char * const s2 ) { <START_BUG> return pure_memcmp ( s1, s2, strlen ( s1 ) + 1U ) ; <END_BUG> }

Fix:
<S2SV_ModStart> s2 ) { const size_t s1_len = strlen ( s1 ) ; const size_t s2_len = strlen ( s2 ) ; const size_t len = ( s1_len < s2_len )? s1_len : s2_len ; <S2SV_ModStart>, s2, len + 1 <S2SV_ModEnd> ) ; }
Buggy code:
 static bool has_byte ( const eager_reader_t * reader ) { assert ( reader!= NULL ) ; fd_set read_fds ; FD_ZERO ( & read_fds ) ; FD_SET ( reader -> bytes_available_fd, & read_fds ) ; struct timeval timeout ; timeout. tv_sec = 0 ; timeout. tv_usec = 0 ; <START_BUG> select ( reader -> bytes_available_fd + 1, & read_fds, NULL, NULL, & timeout ) ; <END_BUG> return FD_ISSET ( reader -> bytes_available_fd, & read_fds ) ; }

Fix:
<S2SV_ModStart> = 0 ; TEMP_FAILURE_RETRY ( <S2SV_ModStart> & timeout ) )
Buggy code:
 error_t rawSocketReceiveIpPacket ( Socket * socket, SocketMsg * message, uint_t flags ) { error_t error ; SocketQueueItem * queueItem ; if ( ( flags & SOCKET_FLAG_DONT_WAIT ) == 0 ) { if ( socket -> receiveQueue == NULL ) { socket -> eventMask = SOCKET_EVENT_RX_READY ; osResetEvent ( & socket -> event ) ; osReleaseMutex ( & netMutex ) ; osWaitForEvent ( & socket -> event, socket -> timeout ) ; osAcquireMutex ( & netMutex ) ; } } if ( socket -> receiveQueue!= NULL ) { queueItem = socket -> receiveQueue ; message -> length = netBufferRead ( message -> data, queueItem -> buffer, queueItem -> offset, message -> size ) ; <START_BUG> message -> srcIpAddr = queueItem -> srcIpAddr ; <END_BUG> message -> srcPort = queueItem -> srcPort ; message -> destIpAddr = queueItem -> destIpAddr ; message -> ttl = queueItem -> ancillary. ttl ; # if ( ETH_SUPPORT == ENABLED ) message -> srcMacAddr = queueItem -> ancillary. srcMacAddr ; message -> destMacAddr = queueItem -> ancillary. destMacAddr ; # endif # if ( ETH_PORT_TAGGING_SUPPORT == ENABLED ) message -> switchPort = queueItem -> ancillary. port ; # endif # if ( ETH_TIMESTAMP_SUPPORT == ENABLED ) message -> timestamp = queueItem -> ancillary. timestamp ; # endif if ( ( flags & SOCKET_FLAG_PEEK ) == 0 ) { socket -> receiveQueue = queueItem -> next ; netBufferFree ( queueItem -> buffer ) ; } rawSocketUpdateEvents ( socket ) ; error = NO_ERROR ; } else { message -> length = 0 ; error = ERROR_TIMEOUT ; } return error ; }

Fix:
<S2SV_ModStart> ; message -> interface = queueItem -> interface ; message ->
Buggy code:
 static void update_alt_ref_frame_stats ( VP8_COMP * cpi ) { VP8_COMMON * cm = & cpi -> common ; if (! cpi -> auto_gold ) cpi -> frames_till_gf_update_due = DEFAULT_GF_INTERVAL ; if ( ( cpi -> pass!= 2 ) && cpi -> frames_till_gf_update_due ) { cpi -> current_gf_interval = cpi -> frames_till_gf_update_due ; cpi -> gf_overspend_bits += cpi -> projected_frame_size ; cpi -> non_gf_bitrate_adjustment = cpi -> gf_overspend_bits // cpi -> frames_till_gf_update_due ; } <START_BUG> vpx_memset ( cpi -> gf_active_flags, 1, ( cm -> mb_rows * cm -> mb_cols ) ) ; <END_BUG> cpi -> gf_active_count = cm -> mb_rows * cm -> mb_cols ; cpi -> frames_since_golden = 0 ; cpi -> source_alt_ref_pending = 0 ; cpi -> source_alt_ref_active = 1 ; }

Fix:
<S2SV_ModStart> frames_till_gf_update_due ; } memset <S2SV_ModEnd> ( cpi ->
Buggy code:
 BOOL nego_read_request ( rdpNego * nego, wStream * s ) { BYTE li ; BYTE type ; UINT16 length ; if (! tpkt_read_header ( s, & length ) ) return FALSE ; if (! tpdu_read_connection_request ( s, & li, length ) ) return FALSE ; if ( li!= Stream_GetRemainingLength ( s ) + 6 ) { WLog_ERR ( TAG, "Incorrect   TPDU   length   indicator." ) ; return FALSE ; } if (! nego_read_request_token_or_cookie ( nego, s ) ) { WLog_ERR ( TAG, "Failed   to   parse   routing   token   or   cookie." ) ; return FALSE ; } if ( Stream_GetRemainingLength ( s ) >= 8 ) { Stream_Read_UINT8 ( s, type ) ; if ( type!= TYPE_RDP_NEG_REQ ) { WLog_ERR ( TAG, "Incorrect   negotiation   request   type   %" PRIu8 "", type ) ; return FALSE ; } <START_BUG> nego_process_negotiation_request ( nego, s ) ; <END_BUG> } return tpkt_ensure_stream_consumed ( s, length ) ; }

Fix:
<S2SV_ModStart> FALSE ; } if (! <S2SV_ModStart>, s ) ) return FALSE
Buggy code:
 void parser ( void ) { char * arg ; # ifndef MINIMAL char * sitearg ; # endif # ifdef WITH_RFC2640 char * narg = NULL ; # endif size_t n ; # ifdef IMPLICIT_TLS ( void ) tls_init_new_session ( ) ; data_protection_level = CPL_PRIVATE ; # endif for ( ; ; ) { xferfd = - 1 ; if ( state_needs_update!= 0 ) { state_needs_update = 0 ; setprocessname ( "pure-ftpd   (IDLE)" ) ; # ifdef FTPWHO if ( shm_data_cur!= NULL ) { ftpwho_lock ( ) ; shm_data_cur -> state = FTPWHO_STATE_IDLE ; * shm_data_cur -> filename = 0 ; ftpwho_unlock ( ) ; } # endif } doreply ( ) ; alarm ( idletime * 2 ) ; switch ( sfgets ( ) ) { case - 1 : # ifdef BORING_MODE die ( 421, LOG_INFO, MSG_TIMEOUT ) ; # else die ( 421, LOG_INFO, MSG_TIMEOUT_PARSER ) ; # endif case - 2 : return ; } # ifdef DEBUG if ( debug!= 0 ) { addreply ( 0, "%s", cmd ) ; } # endif n = ( size_t ) 0U ; while ( ( isalpha ( ( unsigned char ) cmd [ n ] ) || cmd [ n ] == '@' ) && n < cmdsize ) { cmd [ n ] = ( char ) tolower ( ( unsigned char ) cmd [ n ] ) ; n ++ ; } if ( n >= cmdsize ) { die ( 421, LOG_WARNING, MSG_LINE_TOO_LONG ) ; } if ( n == ( size_t ) 0U ) { nop : addreply_noformat ( 500, "?" ) ; continue ; } # ifdef SKIP_COMMAND_TRAILING_SPACES while ( isspace ( ( unsigned char ) cmd [ n ] ) && n < cmdsize ) { cmd [ n ++ ] = 0 ; } arg = cmd + n ; while ( cmd [ n ]!= 0 && n < cmdsize ) { n ++ ; } n -- ; while ( isspace ( ( unsigned char ) cmd [ n ] )

Fix:
<S2SV_ModStart> NULL ) { flush_cmd ( ) ;
Buggy code:
 static int copy_verifier_state ( struct bpf_verifier_state * dst_state, const struct bpf_verifier_state * src ) { struct bpf_func_state * dst ; int i, err ; for ( i = src -> curframe + 1 ; i <= dst_state -> curframe ; i ++ ) { free_func_state ( dst_state -> frame [ i ] ) ; dst_state -> frame [ i ] = NULL ; <START_BUG> } <END_BUG> dst_state -> curframe = src -> curframe ; for ( i = 0 ; i <= src -> curframe ; i ++ ) { dst = dst_state -> frame [ i ] ; if (! dst ) { dst = kzalloc ( sizeof ( * dst ), GFP_KERNEL ) ; if (! dst ) return - ENOMEM ; dst_state -> frame [ i ] = dst ; } err = copy_func_state ( dst, src -> frame [ i ] ) ; if ( err ) return err ; } return 0 ; }

Fix:
<S2SV_ModStart> NULL ; } dst_state -> speculative = src -> speculative ;
Buggy code:
 int ras_validate ( jas_stream_t * in ) { <START_BUG> uchar buf [ RAS_MAGICLEN ] ; <END_BUG> int i ; int n ; uint_fast32_t magic ; assert ( JAS_STREAM_MAXPUTBACK >= RAS_MAGICLEN ) ; if ( ( n = jas_stream_read ( in, buf, RAS_MAGICLEN ) ) < 0 ) { return - 1 ; } for ( i = n - 1 ; i >= 0 ; -- i ) { if ( jas_stream_ungetc ( in, buf [ i ] ) == EOF ) { return - 1 ; } } if ( n < RAS_MAGICLEN ) { return - 1 ; } magic = ( JAS_CAST ( uint_fast32_t, buf [ 0 ] ) << 24 ) | ( JAS_CAST ( uint_fast32_t, buf [ 1 ] ) << 16 ) | ( JAS_CAST ( uint_fast32_t, buf [ 2 ] ) << 8 ) | buf [ 3 ] ; if ( magic!= RAS_MAGIC ) { return - 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> in ) { jas_uchar <S2SV_ModEnd> buf [ RAS_MAGICLEN
Buggy code:
 static long perf_ioctl ( struct file * file, unsigned int cmd, unsigned long arg ) { struct perf_event * event = file -> private_data ; <START_BUG> void ( * func ) ( struct perf_event * ) ; <END_BUG> u32 flags = arg ; switch ( cmd ) { case PERF_EVENT_IOC_ENABLE : func = perf_event_enable ; break ; case PERF_EVENT_IOC_DISABLE : func = perf_event_disable ; break ; case PERF_EVENT_IOC_RESET : func = perf_event_reset ; break ; case PERF_EVENT_IOC_REFRESH : return perf_event_refresh ( event, arg ) ;  case PERF_EVENT_IOC_PERIOD : <START_BUG> <END_BUG> return perf_event_period ( event, ( u64 __user * ) arg ) ;  case PERF_EVENT_IOC_ID : { u64 id = primary_event_id ( event ) ; if ( copy_to_user ( ( void __user * ) arg, & id, sizeof ( id ) ) ) return - EFAULT ; return 0 ; } case PERF_EVENT_IOC_SET_OUTPUT : { int ret ; if ( arg!= - 1 ) { struct perf_event * output_event ; struct fd output ; ret = perf_fget_light ( arg, & output ) ; if ( ret ) return ret ; output_event = output. file -> private_data ; ret = perf_event_set_output ( event, output_event ) ; fdput ( output ) ; } else { ret = perf_event_set_output ( event, NULL ) ; } return ret ; } <START_BUG> case PERF_EVENT_IOC_SET_FILTER : <END_BUG> return perf_event_set_filter ( event, ( void __user * ) arg ) ; default : return - ENOTTY ; } if ( flags & PERF_IOC_FLAG_GROUP ) perf_event_for_each ( event, func ) ; else perf_event_for_each_child ( event, func ) ; return 0 ; }

Fix:
<S2SV_ModStart> -> private_data ; struct perf_event_context * ctx ; long ret ; ctx = perf_event_ctx_lock ( event ) ; ret = _perf_ioctl ( event, cmd <S2SV_ModEnd>, arg ) <S2SV_ModStart> arg ) ; perf_event_ctx_unlock <S2SV_ModEnd> ( event, <S2SV_ModStart> ( event, ctx ) ; <S2SV_ModEnd> return ret ; <S2SV_ModStart> ret ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static void skel ( const char * homedir, uid_t u, gid_t g ) { char * fname ; if (! arg_shell_none && ( strcmp ( cfg. shell, "//usr//bin//zsh" ) == 0 || strcmp ( cfg. shell, "//bin//zsh" ) == 0 ) ) { if ( asprintf ( & fname, "%s//.zshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; if ( stat ( "//etc//skel//.zshrc", & s ) == 0 ) { <START_BUG> if ( copy_file ( "//etc//skel//.zshrc", fname, u, g, 0644 ) == 0 ) { <END_BUG> fs_logger ( "clone   //etc//skel//.zshrc" ) ; }  } <START_BUG> else { FILE * fp = fopen ( fname, "w" ) ; if ( fp ) { fprintf ( fp, "\\n" ) ; SET_PERMS_STREAM ( fp, u, g, S_IRUSR | S_IWUSR ) ; fclose ( fp ) ; fs_logger2 ( "touch", fname ) ; <END_BUG> }  } free ( fname ) ; } else if (! arg_shell_none && strcmp ( cfg. shell, "//bin//csh" ) == 0 ) { if ( asprintf ( & fname, "%s//.cshrc", homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( fname, & s ) == 0 ) return ; if ( stat ( "//etc//skel//.cshrc", & s ) == 0 ) { <START_BUG> if ( copy_file ( "//etc//skel//.cshrc", fname, u, g, 0644 ) == 0 ) { <END_BUG> fs_logger ( "clone   //etc//skel//.cshrc" ) ; }  } <START_BUG> else { FILE * fp = fopen ( fname, "w" ) ; if ( fp ) { fprintf ( fp, "\\n" ) ; SET_PERMS_STREAM ( fp, u, g, S_IRUSR | S_IWUSR ) ; fclose ( fp ) ; fs_logger2 ( "touch", fname ) ;<END_BUG>

Fix:
<S2SV_ModStart> 0 ) { <S2SV_ModEnd> copy_file ( "//etc//skel//.zshrc" <S2SV_ModStart>, 0644 ) ; <S2SV_ModEnd> fs_logger ( "clone <S2SV_blank> //etc//skel//.zshrc" <S2SV_ModStart> ) ; } else { touch_file_as_user ( fname, u, g, 0644 <S2SV_ModEnd> ) ; fs_logger2 <S2SV_ModStart> fname ) ; <S2SV_ModEnd> } free ( <S2SV_ModStart> 0 ) { <S2SV_ModEnd> copy_file ( "//etc//skel//.cshrc" <S2SV_ModStart>, 0644 ) ; <S2SV_ModEnd> fs_logger ( "clone <S2SV_blank> //etc//skel//.cshrc" <S2SV_ModStart> ) ; } else { touch_file_as_user ( fname, u, g, 0644 <S2SV_ModEnd> ) ; fs_logger2 <S2SV_ModStart> fname ) ; <S2SV_ModEnd> } free ( <S2SV_ModStart> 0 ) { <S2SV_ModEnd> copy_file ( "//etc//skel//.bashrc" <S2SV_ModStart>, 0644 ) ; <S2SV_ModEnd> fs_logger ( "clone <S2SV_blank> //etc//skel//.bashrc" <S2SV_ModStart> ) ; } <S2SV_ModEnd> free ( fname
Buggy code:
 BOOL transport_connect_nla ( rdpTransport * transport ) { freerdp * instance ; rdpSettings * settings ; if ( transport -> layer == TRANSPORT_LAYER_TSG ) return TRUE ; if (! transport_connect_tls ( transport ) ) return FALSE ; if ( transport -> settings -> Authentication!= TRUE ) return TRUE ; settings = transport -> settings ; instance = ( freerdp * ) settings -> instance ; if ( transport -> credssp == NULL ) transport -> credssp = credssp_new ( instance, transport, settings ) ; if ( credssp_authenticate ( transport -> credssp ) < 0 ) { if (! connectErrorCode ) connectErrorCode = AUTHENTICATIONERROR ; fprintf ( stderr, "Authentication   failure,   check   credentials.\\n" "If   credentials   are   valid,   the   NTLMSSP   implementation   may   be   to   blame.\\n" ) ; credssp_free ( transport -> credssp ) ; <START_BUG> return FALSE ; <END_BUG> } credssp_free ( transport -> credssp ) ; return TRUE ; }

Fix:
<S2SV_ModStart> credssp ) ; transport -> credssp = NULL ;
Buggy code:
 <START_BUG> static unsigned int convert_distribution ( unsigned int i, vp9_tree tree, <END_BUG> unsigned int branch_ct [ ] [ 2 ], const unsigned int num_events [ ] ) { unsigned int left, right ; if ( tree [ i ] <= 0 ) left = num_events [ - tree [ i ] ] ; else left = convert_distribution ( tree [ i ], tree, branch_ct, num_events ) ; if ( tree [ i + 1 ] <= 0 ) right = num_events [ - tree [ i + 1 ] ] ; else right = convert_distribution ( tree [ i + 1 ], tree, branch_ct, num_events ) ; branch_ct [ i >> 1 ] [ 0 ] = left ; branch_ct [ i >> 1 ] [ 1 ] = right ; return left + right ; }

Fix:
<S2SV_ModStart> int i, vpx_tree <S2SV_ModEnd> tree, unsigned
Buggy code:
 static int md_analyze_line ( MD_CTX * ctx, OFF beg, OFF * p_end, const MD_LINE_ANALYSIS * pivot_line, MD_LINE_ANALYSIS * line ) { unsigned total_indent = 0 ; int n_parents = 0 ; int n_brothers = 0 ; int n_children = 0 ; MD_CONTAINER container = { 0 } ; int prev_line_has_list_loosening_effect = ctx -> last_line_has_list_loosening_effect ; OFF off = beg ; OFF hr_killer = 0 ; int ret = 0 ; line -> indent = md_line_indentation ( ctx, total_indent, off, & off ) ; total_indent += line -> indent ; line -> beg = off ; while ( n_parents < ctx -> n_containers ) { MD_CONTAINER * c = & ctx -> containers [ n_parents ] ; if ( c -> ch == _T ( '>' ) && line -> indent < ctx -> code_indent_offset && off < ctx -> size && CH ( off ) == _T ( '>' ) ) { off ++ ; total_indent ++ ; line -> indent = md_line_indentation ( ctx, total_indent, off, & off ) ; total_indent += line -> indent ; if ( line -> indent > 0 ) line -> indent -- ; line -> beg = off ; } else if ( c -> ch!= _T ( '>' ) && line -> indent >= c -> contents_indent ) { line -> indent -= c -> contents_indent ; } else { break ; } n_parents ++ ; } if ( off >= ctx -> size || ISNEWLINE ( off ) ) { if ( n_brothers + n_children == 0 ) { while ( n_parents < ctx -> n_containers && ctx -> containers [ n_parents ]. ch!= _T ( '>' ) ) n_parents ++ ; } } while ( TRUE ) { if ( pivot_line -> type == MD_LINE_FENCEDCODE ) { line -> beg = off ; if ( line -> indent < ctx -> code_indent_offset ) { if ( md_is_closing_code_fence ( ctx, CH ( pivot_line -> beg ), off, & off ) ) { line -> type = MD_LINE_BLANK ; ctx -> last_

Fix:
<S2SV_ModStart> == MD_LINE_TEXT && off < ctx -> size && ISANYOF2 ( off, <S2SV_ModEnd> _T ( '=' <S2SV_ModStart> ( '=' ), <S2SV_ModEnd> _T ( '-' <S2SV_ModStart> ctx -> code_indent_offset && off < ctx -> size <S2SV_ModEnd> && off >= <S2SV_ModStart> off >= hr_killer && ISANYOF ( off, _T ( "-_*" ) ) ) <S2SV_ModEnd> { if ( <S2SV_ModStart> -> n_containers && ISANYOF2_ <S2SV_ModStart> container. ch, <S2SV_ModEnd> _T ( '.' <S2SV_ModStart> ( '.' ), <S2SV_ModEnd> _T ( ')' <S2SV_ModStart> -> code_indent_offset && off < ctx -> size && <S2SV_ModStart> } if ( off < ctx -> size && ISANYOF2 ( off, _T ( '`' ), _T ( '~' ) ) ) { if ( md_is_opening_code_fence ( ctx, off, & off ) ) { line -> type = MD_LINE_FENCEDCODE ; line -> data = 1 ; break ; } } if ( off < ctx -> size && <S2SV_ModStart> == _T ( <S2SV_ModEnd> '<' ) && <S2SV_ModStart> type == MD_LINE_TEXT && off < ctx -> size && ISANYOF3 ( off, <S2SV_ModEnd> _T ( '|' <S2SV_ModStart> ( '|' )
Buggy code:
 int fixExec2Error ( int action, u_char * var_val, u_char var_val_type, size_t var_val_len, u_char * statP, oid * name, size_t name_len ) { netsnmp_old_extend * exten = NULL ; unsigned int idx ; idx = name [ name_len - 1 ] - 1 ; exten = & compatability_entries [ idx ] ; <START_BUG> # ifndef NETSNMP_NO_WRITE_SUPPORT <END_BUG> switch ( action ) { case MODE_SET_RESERVE1 : if ( var_val_type!= ASN_INTEGER ) { snmp_log ( LOG_ERR, "Wrong   type  !=   int\\n" ) ; return SNMP_ERR_WRONGTYPE ; } idx = * ( ( long * ) var_val ) ; if ( idx!= 1 ) { snmp_log ( LOG_ERR, "Wrong   value  !=   1\\n" ) ; return SNMP_ERR_WRONGVALUE ; } if (! exten ||! exten -> efix_entry ) { snmp_log ( LOG_ERR, "No   command   to   run\\n" ) ; return SNMP_ERR_GENERR ; } return SNMP_ERR_NOERROR ; case MODE_SET_COMMIT : netsnmp_cache_check_and_reload ( exten -> efix_entry -> cache ) ; } # endif return SNMP_ERR_NOERROR ; }

Fix:
<S2SV_ModStart> ] ; # if! defined ( NETSNMP_NO_WRITE_SUPPORT ) && ENABLE_EXTEND_WRITE_ACCESS <S2SV_ModEnd> switch ( action
Buggy code:
 void CLASS panasonic_load_raw ( ) { int row, col, i, j, sh = 0, pred [ 2 ], nonz [ 2 ] ; pana_bits ( 0 ) ; <START_BUG> for ( row = 0 ; row < height ; row ++ ) <END_BUG> { # ifdef LIBRAW_LIBRARY_BUILD checkCancel ( ) ; # endif for ( col = 0 ; col < raw_width ; col ++ ) { if ( ( i = col % 14 ) == 0 ) pred [ 0 ] = pred [ 1 ] = nonz [ 0 ] = nonz [ 1 ] = 0 ; if ( i % 3 == 2 ) sh = 4 >> ( 3 - pana_bits ( 2 ) ) ; if ( nonz [ i & 1 ] ) { if ( ( j = pana_bits ( 8 ) ) ) { if ( ( pred [ i & 1 ] -= 0x80 << sh ) < 0 || sh == 4 ) pred [ i & 1 ] &= ~ ( ( ~ 0u ) << sh ) ; pred [ i & 1 ] += j << sh ; } } else if ( ( nonz [ i & 1 ] = pana_bits ( 8 ) ) || i > 11 ) pred [ i & 1 ] = nonz [ i & 1 ] << 4 | pana_bits ( 4 ) ;  if ( ( RAW ( row, col ) = pred [ col & 1 ] ) > 4098 && col < width ) <START_BUG> derror ( ) ; } } }<END_BUG>

Fix:
<S2SV_ModStart> ; row < raw_height <S2SV_ModEnd> ; row ++ <S2SV_ModStart> col < width && row < height