nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int misaligned_fpu_load ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift, int do_paired_load ) { int error ; int destreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_EMULATION_FAULTS, 1, 0, regs, address ) ; <END_BUG> destreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; __u32 buflo, bufhi ; if (! access_ok ( VERIFY_READ, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } if ( __copy_user ( & buffer, ( const void * ) ( int ) address, ( 1 << width_shift ) ) > 0 ) { return - 1 ; } if ( last_task_used_math == current ) { enable_fpu ( ) ; save_fpu ( current ) ; disable_fpu ( ) ; last_task_used_math = NULL ; regs -> sr |= SR_FD ; } buflo = * ( __u32 * ) & buffer ; bufhi = * ( 1 + ( __u32 * ) & buffer ) ; switch ( width_shift ) { case 2 : current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = buflo ; break ; case 3 : if ( do_paired_load ) { current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = buflo ; current -> thread. xstate -> hardfpu. fp_regs [ destreg + 1 ] = bufhi ; } else { # if defined ( CONFIG_CPU_LITTLE_ENDIAN ) current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = bufhi ; current -> thread. xstate -> hardfpu. fp_regs [ destreg + 1 ] = buflo ; # else current -> thread. xstate -> hardfpu. fp_regs [ destreg ] = buflo ; current ->

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 static inline int btif_hl_select_close_connected ( void ) { char sig_on = btif_hl_signal_select_close_connected ; BTIF_TRACE_DEBUG ( "btif_hl_select_close_connected" ) ; <START_BUG> return send ( signal_fds [ 1 ], & sig_on, sizeof ( sig_on ), 0 ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) ; return TEMP_FAILURE_RETRY ( <S2SV_ModStart>, 0 ) )
Buggy code:
 error_t ksz8851ReceivePacket ( NetInterface * interface ) { size_t n ; uint16_t status ; Ksz8851Context * context ; NetRxAncillary ancillary ; context = ( Ksz8851Context * ) interface -> nicContext ; <START_BUG> status = ksz8851ReadReg ( interface, KSZ8851_REG_RXFHSR ) ; <END_BUG>  if ( ( status & RXFHSR_RXFV )!= 0 ) <START_BUG> { <END_BUG> if ( ( status & ( RXFHSR_RXMR | RXFHSR_RXFTL | RXFHSR_RXRF | RXFHSR_RXCE ) ) == 0 )  { <START_BUG> n = ksz8851ReadReg ( interface, KSZ8851_REG_RXFHBCR ) & RXFHBCR_RXBC_MASK ; <END_BUG> if ( n > 0 && n <= ETH_MAX_FRAME_SIZE ) {  ksz8851WriteReg ( interface, KSZ8851_REG_RXFDPR, RXFDPR_RXFPAI ) ; <START_BUG> <END_BUG> ksz8851SetBit ( interface, KSZ8851_REG_RXQCR, RXQCR_SDA ) ;  ksz8851ReadFifo ( interface, context -> rxBuffer, n ) ; <START_BUG> ksz8851ClearBit ( interface, KSZ8851_REG_RXQCR, RXQCR_SDA ) ; <END_BUG> ancillary = NET_DEFAULT_RX_ANCILLARY ; nicProcessPacket ( interface, context -> rxBuffer, n, & ancillary ) ; return NO_ERROR ; } } }  ksz8851SetBit ( interface, KSZ8851_REG_RXQCR, RXQCR_RRXEF ) ; <START_BUG> return ERROR_INVALID_PACKET ; }<END_BUG>

Fix:
<S2SV_ModStart> ( interface, KSZ8851_RXFHSR <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( status & KSZ8851_RXFHSR_RXFV <S2SV_ModEnd> )!= 0 <S2SV_ModStart> status & ( KSZ8851_RXFHSR_RXMR | KSZ8851_RXFHSR_RXFTL | KSZ8851_RXFHSR_RXRF | KSZ8851_RXFHSR_RXCE <S2SV_ModEnd> ) ) == <S2SV_ModStart> ( interface, KSZ8851_RXFHBCR ) & KSZ8851_RXFHBCR_RXBC <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( interface, KSZ8851_RXFDPR, KSZ8851_RXFDPR_RXFPAI <S2SV_ModEnd> ) ; ksz8851SetBit <S2SV_ModStart> ( interface, KSZ8851_RXQCR, KSZ8851_RXQCR_SDA <S2SV_ModEnd> ) ; ksz8851ReadFifo <S2SV_ModStart> ( interface, KSZ8851_RXQCR, KSZ8851_RXQCR_SDA <S2SV_ModEnd> ) ; ancillary <S2SV_ModStart> ( interface
Buggy code:
 int rds_recvmsg ( struct kiocb * iocb, struct socket * sock, struct msghdr * msg, size_t size, int msg_flags ) { struct sock * sk = sock -> sk ; struct rds_sock * rs = rds_sk_to_rs ( sk ) ; long timeo ; int ret = 0, nonblock = msg_flags & MSG_DONTWAIT ; struct sockaddr_in * sin ; struct rds_incoming * inc = NULL ; timeo = sock_rcvtimeo ( sk, nonblock ) ; <START_BUG> rdsdebug ( "size   %zu   flags   0x%x   timeo   %ld\\n", size, msg_flags, timeo ) ; <END_BUG> msg -> msg_namelen = 0 ; if ( msg_flags & MSG_OOB ) goto out ; while ( 1 ) { if (! list_empty ( & rs -> rs_notify_queue ) ) { ret = rds_notify_queue_get ( rs, msg ) ; break ; } if ( rs -> rs_cong_notify ) { ret = rds_notify_cong ( rs, msg ) ; break ; } if (! rds_next_incoming ( rs, & inc ) ) { if ( nonblock ) { ret = - EAGAIN ; break ; } timeo = wait_event_interruptible_timeout ( * sk_sleep ( sk ), (! list_empty ( & rs -> rs_notify_queue ) || rs -> rs_cong_notify || rds_next_incoming ( rs, & inc ) ), timeo ) ; rdsdebug ( "recvmsg   woke   inc   %p   timeo   %ld\\n", inc, timeo ) ; if ( timeo > 0 || timeo == MAX_SCHEDULE_TIMEOUT ) continue ; ret = timeo ; if ( ret == 0 ) ret = - ETIMEDOUT ; break ; } rdsdebug ( "copying   inc   %p   from   %pI4:%u   to   user\\n", inc, & inc -> i_conn -> c_faddr, ntohs ( inc -> i_hdr. h_sport ) ) ; ret = inc -> i_conn -> c_trans -> inc_copy_to_user ( inc, msg -> msg_iov, size ) ;

Fix:
<S2SV_ModStart>, timeo ) <S2SV_ModEnd> ; if (
Buggy code:
 static Image * ReadXCFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char magick [ 14 ] ; Image * image ; int foundPropEnd = 0 ; MagickBooleanType status ; MagickOffsetType offset ; register ssize_t i ; size_t image_type, length ; ssize_t count ; XCFDocInfo doc_info ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } count = ReadBlob ( image, 14, ( unsigned char * ) magick ) ; if ( ( count!= 14 ) || ( LocaleNCompare ( ( char * ) magick, "gimp   xcf", 8 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; ( void ) ResetMagickMemory ( & doc_info, 0, sizeof ( XCFDocInfo ) ) ; doc_info. exception = exception ; doc_info. width = ReadBlobMSBLong ( image ) ; doc_info. height = ReadBlobMSBLong ( image ) ; if ( ( doc_info. width > 262144 ) || ( doc_info. height > 262144 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; doc_info. image_type = ReadBlobMSBLong ( image ) ; image -> columns = doc_info. width ; image -> rows = doc_info. height ; image_type = doc_info. image_type ; doc_info. file_size = GetBlobSize ( image ) ; image -> compression = NoCompression ; image -> depth = 8 ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) {

Fix:
<S2SV_ModStart> image ) ; if ( GetNextImageInList ( image )!= ( Image * ) NULL )
Buggy code:
 static int nfp_abm_u32_knode_replace ( struct nfp_abm_link * alink, struct tc_cls_u32_knode * knode, __be16 proto, struct netlink_ext_ack * extack ) { struct nfp_abm_u32_match * match = NULL, * iter ; unsigned int tos_off ; u8 mask, val ; int err ; <START_BUG> if (! nfp_abm_u32_check_knode ( alink -> abm, knode, proto, extack ) ) <END_BUG>  goto err_delete ; <START_BUG> tos_off = proto == htons ( ETH_P_IP )? 16 : 20 ; val = be32_to_cpu ( knode -> sel -> keys [ 0 ]. val ) >> tos_off & 0xff ; mask = be32_to_cpu ( knode -> sel -> keys [ 0 ]. mask ) >> tos_off & 0xff ; list_for_each_entry ( iter, & alink -> dscp_map, list ) { u32 cmask ; if ( iter -> handle == knode -> handle ) { match = iter ; continue ; } cmask = iter -> mask & mask ; if ( ( iter -> val & cmask ) == ( val & cmask ) && iter -> band!= knode -> res -> classid ) { NL_SET_ERR_MSG_MOD ( extack, "conflict   with   already   offloaded   filter" ) ; <END_BUG> goto err_delete ;  } } if (! match ) { match = kzalloc ( sizeof ( * match ), GFP_KERNEL ) ; if (! match ) <START_BUG> return - ENOMEM ; <END_BUG>  list_add ( & match -> list, & alink -> dscp_map ) ; <START_BUG> } match -> handle = knode -> handle ; match -> band = knode -> res -> classid ; match -> mask = mask ; match -> val = val ; err = nfp_abm_update_band_map ( alink ) ; if ( err ) goto err_delete ; return 0 ; err_delete : nfp_abm_u32_knode_delete ( alink, knode ) ; <END_BUG> return - EOPNOTSUPP ;  }

Fix:
<S2SV_ModStart> extack ) ) { err = - EOPNOTSUPP ; <S2SV_ModStart> goto err_delete ; } <S2SV_ModStart> "conflict <S2SV_blank> with <S2SV_blank> already <S2SV_blank> offloaded <S2SV_blank> filter" ) ; err = - EOPNOTSUPP ; <S2SV_ModStart>! match ) { err = <S2SV_ModEnd> - ENOMEM ; <S2SV_ModStart> - ENOMEM ; goto err_delete ; } <S2SV_ModStart> ) ; return err <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 int read_filesystem_tables_4 ( ) { <START_BUG> long long directory_table_end, table_start ; <END_BUG> if ( read_xattrs_from_disk ( fd, & sBlk. s, no_xattrs, & table_start ) == 0 )  return FALSE ; <START_BUG> if ( read_uids_guids ( & table_start ) == FALSE ) <END_BUG> return FALSE ;  if ( parse_exports_table ( & table_start ) == FALSE ) <START_BUG> return FALSE ; <END_BUG>  if ( read_fragment_table ( & directory_table_end ) == FALSE ) <START_BUG> return FALSE ; if ( read_inode_table ( sBlk. s. inode_table_start, sBlk. s. directory_table_start ) == FALSE ) <END_BUG> return FALSE ;  if ( read_directory_table ( sBlk. s. directory_table_start, directory_table_end ) == FALSE ) return FALSE ; if ( no_xattrs ) sBlk. s. xattr_id_table_start = SQUASHFS_INVALID_BLK ; return TRUE ; <START_BUG> } <END_BUG>

Fix:
<S2SV_ModStart> { long long table_start ; if ( sBlk. s. xattr_id_table_start!= SQUASHFS_INVALID_BLK ) { if ( sBlk. s. xattr_id_table_start >= sBlk. s. bytes_used ) { ERROR ( "read_filesystem_tables: <S2SV_blank> xattr <S2SV_blank> id <S2SV_blank> table <S2SV_blank> start <S2SV_blank> too <S2SV_blank> large <S2SV_blank> in <S2SV_blank> super <S2SV_blank> block\\n" ) ; goto corrupted ; } <S2SV_ModEnd> if ( read_xattrs_from_disk <S2SV_ModStart> == 0 ) goto corrupted ; } else table_start = sBlk. s. bytes_used ; if ( sBlk. s. id_table_start >= table_start ) { ERROR ( "read_filesystem_tables: <S2SV_blank> id <S2SV_blank> table <S2SV_blank> start <S2SV_blank> too <S2SV_blank> large <S2SV_blank> in <S2SV_blank> super <S2SV_blank> block\\n" ) ; goto corrupted ; } if ( sBlk. s. no_ids == 0 ) { ERROR ( "read_filesystem_tables: <S2SV_blank> Bad <S2SV_blank> id <S2SV_blank> count <S2SV_blank> in <S2SV_blank> super <S2SV_blank> block\\n" ) ; goto corrupted ; } if ( sBlk. s. no_ids > ( sBlk. s. inodes
Buggy code:
 static int ath10k_usb_hif_tx_sg ( struct ath10k * ar, u8 pipe_id, struct ath10k_hif_sg_item * items, int n_items ) { struct ath10k_usb * ar_usb = ath10k_usb_priv ( ar ) ; struct ath10k_usb_pipe * pipe = & ar_usb -> pipes [ pipe_id ] ; struct ath10k_urb_context * urb_context ; struct sk_buff * skb ; struct urb * urb ; int ret, i ; for ( i = 0 ; i < n_items ; i ++ ) { urb_context = ath10k_usb_alloc_urb_from_pipe ( pipe ) ; if (! urb_context ) { ret = - ENOMEM ; goto err ; } skb = items [ i ]. transfer_context ; urb_context -> skb = skb ; urb = usb_alloc_urb ( 0, GFP_ATOMIC ) ; if (! urb ) { ret = - ENOMEM ; goto err_free_urb_to_pipe ; } usb_fill_bulk_urb ( urb, ar_usb -> udev, pipe -> usb_pipe_handle, skb -> data, skb -> len, ath10k_usb_transmit_complete, urb_context ) ; if (! ( skb -> len % pipe -> max_packet_size ) ) { urb -> transfer_flags |= URB_ZERO_PACKET ; } usb_anchor_urb ( urb, & pipe -> urb_submitted ) ; ret = usb_submit_urb ( urb, GFP_ATOMIC ) ; if ( ret ) { ath10k_dbg ( ar, ATH10K_DBG_USB_BULK, "usb   bulk   transmit   failed:   %d\\n", ret ) ; usb_unanchor_urb ( urb ) ; <START_BUG> ret = - EINVAL ; <END_BUG> goto err_free_urb_to_pipe ; } usb_free_urb ( urb ) ; } return 0 ; err_free_urb_to_pipe : ath10k_usb_free_urb_to_pipe ( urb

Fix:
<S2SV_ModStart> urb ) ; usb_free_urb ( urb ) ;
Buggy code:
 static void xcopy_pt_undepend_remotedev ( struct xcopy_op * xop ) { <START_BUG> struct se_device * remote_dev ; <END_BUG> if ( xop -> op_origin == XCOL_SOURCE_RECV_OP )  remote_dev = xop -> dst_dev ; <START_BUG> else <END_BUG> remote_dev = xop -> src_dev ;  pr_debug ( "Calling   configfs_undepend_item   for" "   remote_dev:   %p   remote_dev->dev_group:   %p\\n", remote_dev, & remote_dev -> dev_group. cg_item ) ; target_undepend_item ( & remote_dev -> dev_group. cg_item ) ; }

Fix:
<S2SV_ModStart> xop ) { <S2SV_ModEnd> if ( xop <S2SV_ModStart> == XCOL_SOURCE_RECV_OP ) pr_debug ( "putting <S2SV_blank> dst <S2SV_blank> lun_ref <S2SV_blank> for <S2SV_blank> %p\\n", <S2SV_ModEnd> xop -> dst_dev <S2SV_ModStart> xop -> dst_dev ) ; else pr_debug ( "putting <S2SV_blank> src <S2SV_blank> lun_ref <S2SV_blank> for <S2SV_blank> %p\\n", <S2SV_ModEnd> xop -> src_dev <S2SV_ModStart> xop -> src_dev ) ; percpu_ref_put ( xop -> remote_lun_ref <S2SV_ModEnd> ) ; }
Buggy code:
 error_t enc28j60SendPacket ( NetInterface * interface, const NetBuffer * buffer, size_t offset, NetTxAncillary * ancillary ) { size_t length ; length = netBufferGetLength ( buffer ) - offset ; if ( length > 1536 ) { osSetEvent ( & interface -> nicTxEvent ) ; return ERROR_INVALID_LENGTH ; } if (! interface -> linkState ) { osSetEvent ( & interface -> nicTxEvent ) ; return NO_ERROR ; } <START_BUG> enc28j60SetBit ( interface, ENC28J60_REG_ECON1, ECON1_TXRST ) ; <END_BUG>  enc28j60ClearBit ( interface, ENC28J60_REG_ECON1, ECON1_TXRST ) ; <START_BUG> <END_BUG> enc28j60ClearBit ( interface, ENC28J60_REG_EIR, EIR_TXIF | EIR_TXERIF ) ;  enc28j60WriteReg ( interface, ENC28J60_REG_ETXSTL, LSB ( ENC28J60_TX_BUFFER_START ) ) ; <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_ETXSTH, MSB ( ENC28J60_TX_BUFFER_START ) ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_EWRPTL, LSB ( ENC28J60_TX_BUFFER_START ) ) ; <START_BUG> <END_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_EWRPTH, MSB ( ENC28J60_TX_BUFFER_START ) ) ;  enc28j60WriteBuffer ( interface, buffer, offset ) ; <START_BUG> enc28j60WriteReg ( interface, ENC28J60_REG_ETXNDL, LSB ( ENC28J60_TX_BUFFER_START + length ) ) ; <END_BUG>  enc28j60WriteReg ( interface, ENC28J60_REG_ETXNDH, MSB ( ENC28J60_TX_BUFFER_START + length ) ) ; <START_BUG> <END_BUG> enc28j60SetBit ( interface, ENC28J60_REG_ECON1, ECON1_TXRTS ) ;  return NO_ERROR

Fix:
<S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_TXRST <S2SV_ModEnd> ) ; enc28j60ClearBit <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_TXRST <S2SV_ModEnd> ) ; enc28j60ClearBit <S2SV_ModStart> ( interface, ENC28J60_EIR, ENC28J60_EIR_TXIF | ENC28J60_EIR_TXERIF ) ; enc28j60WriteReg ( interface, ENC28J60_ETXSTL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_ETXSTH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_EWRPTL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_EWRPTH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_ETXNDL <S2SV_ModEnd>, LSB ( <S2SV_ModStart> ( interface, ENC28J60_ETXNDH <S2SV_ModEnd>, MSB ( <S2SV_ModStart> ( interface, ENC28J60_ECON1, ENC28J60_ECON1_TXRTS
Buggy code:
 <START_BUG> static vpx_codec_err_t vp8_get_reference ( vpx_codec_alg_priv_t * ctx, <END_BUG> int ctr_id, va_list args ) { vpx_ref_frame_t * data = va_arg ( args, vpx_ref_frame_t * ) ; if ( data &&! ctx -> yv12_frame_buffers. use_frame_threads ) { vpx_ref_frame_t * frame = ( vpx_ref_frame_t * ) data ; YV12_BUFFER_CONFIG sd ; image2yuvconfig ( & frame -> img, & sd ) ; return vp8dx_get_reference ( ctx -> yv12_frame_buffers. pbi [ 0 ], frame -> frame_type, & sd ) ; } else return VPX_CODEC_INVALID_PARAM ; }

Fix:
<S2SV_ModStart> vpx_codec_alg_priv_t * ctx <S2SV_ModEnd>, va_list args
Buggy code:
 static OM_uint32 kg_unseal_v1_iov ( krb5_context context, OM_uint32 * minor_status, krb5_gss_ctx_id_rec * ctx, gss_iov_buffer_desc * iov, int iov_count, size_t token_wrapper_len, int * conf_state, gss_qop_t * qop_state, int toktype ) { OM_uint32 code ; gss_iov_buffer_t header ; gss_iov_buffer_t trailer ; unsigned char * ptr ; int sealalg ; int signalg ; krb5_checksum cksum ; krb5_checksum md5cksum ; size_t cksum_len = 0 ; size_t conflen = 0 ; int direction ; krb5_ui_4 seqnum ; OM_uint32 retval ; size_t sumlen ; krb5_keyusage sign_usage = KG_USAGE_SIGN ; md5cksum. length = cksum. length = 0 ; md5cksum. contents = cksum. contents = NULL ; header = kg_locate_header_iov ( iov, iov_count, toktype ) ; assert ( header!= NULL ) ; trailer = kg_locate_iov ( iov, iov_count, GSS_IOV_BUFFER_TYPE_TRAILER ) ; if ( trailer!= NULL && trailer -> buffer. length!= 0 ) { <START_BUG> * minor_status = ( OM_uint32 ) KRB5_BAD_MSIZE ; <END_BUG> return GSS_S_DEFECTIVE_TOKEN ; }  if ( header -> buffer. length < token_wrapper_len + 14 ) { <START_BUG> * minor_status = 0 ; return GSS_S_DEFECTIVE_TOKEN ; } ptr = ( unsigned char * ) header -> buffer. value + token_wrapper_len ; signalg = ptr [ 0 ] ; signalg |= ptr [ 1 ] << 8 ; sealalg = ptr [ 2 ] ; sealalg |= ptr [ 3 ] << 8 ; if ( ptr [ 4 ]!= 0xFF || ptr [ 5 ]!= 0xFF ) { * minor_status = 0 ; return GSS_S_DEFECTIVE_TOKEN ; } if ( toktype!= KG_TOK_WRAP_MSG &&<END_BUG>

Fix:
<S2SV_ModStart> OM_uint32 ) KRB5_BAD_MSIZE ; return GSS_S_DEFECTIVE_TOKEN ; } if ( ctx -> seq == NULL ) { * minor_status = 0 <S2SV_ModStart> < token_wrapper_len + 22 <S2SV_ModEnd> ) { *
Buggy code:
 void AV1_RewriteESDescriptorEx ( GF_MPEGVisualSampleEntryBox * av1, GF_MediaBox * mdia ) { GF_BitRateBox * btrt = gf_isom_sample_entry_get_bitrate ( ( GF_SampleEntryBox * ) av1, GF_FALSE ) ; if ( av1 -> emul_esd ) gf_odf_desc_del ( ( GF_Descriptor * ) av1 -> emul_esd ) ; av1 -> emul_esd = gf_odf_desc_esd_new ( 2 ) ; av1 -> emul_esd -> decoderConfig -> streamType = GF_STREAM_VISUAL ; av1 -> emul_esd -> decoderConfig -> objectTypeIndication = GF_CODECID_AV1 ; if ( btrt ) { av1 -> emul_esd -> decoderConfig -> bufferSizeDB = btrt -> bufferSizeDB ; av1 -> emul_esd -> decoderConfig -> avgBitrate = btrt -> avgBitrate ; av1 -> emul_esd -> decoderConfig -> maxBitrate = btrt -> maxBitrate ; } <START_BUG> if ( av1 -> av1_config ) { <END_BUG> GF_AV1Config * av1_cfg = AV1_DuplicateConfig ( av1 -> av1_config -> config ) ; if ( av1_cfg ) { gf_odf_av1_cfg_write ( av1_cfg, & av1 -> emul_esd -> decoderConfig -> decoderSpecificInfo -> data, & av1 -> emul_esd -> decoderConfig -> decoderSpecificInfo -> dataLength ) ; gf_odf_av1_cfg_del ( av1_cfg ) ; } } }

Fix:
<S2SV_ModStart> av1 -> av1_config && av1 -> av1_config -> config
Buggy code:
 static void intern_rec ( value * dest ) { unsigned int code ; tag_t tag ; mlsize_t size, len, ofs_ind ; value v ; asize_t ofs ; header_t header ; unsigned char digest [ 16 ] ; struct custom_operations * ops ; char * codeptr ; struct intern_item * sp ; sp = intern_stack ; ReadItems ( dest, 1 ) ; while ( sp!= intern_stack ) { dest = sp -> dest ; switch ( sp -> op ) { case OFreshOID : <START_BUG> if ( Int_val ( Field ( ( value ) dest, 1 ) ) >= 0 ) <END_BUG> caml_set_oo_id ( ( value ) dest ) ; sp -- ; break ; case OShift : * dest += sp -> arg ; sp -- ; break ; case OReadItems : sp -> dest ++ ; if ( -- ( sp -> arg ) == 0 ) sp -- ; code = read8u ( ) ; if ( code >= PREFIX_SMALL_INT ) { if ( code >= PREFIX_SMALL_BLOCK ) { tag = code & 0xF ; size = ( code >> 4 ) & 0x7 ; read_block : if ( size == 0 ) { v = Atom ( tag ) ; } else { v = Val_hp ( intern_dest ) ; if ( intern_obj_table!= NULL ) intern_obj_table [ obj_counter ++ ] = v ; * intern_dest = Make_header ( size, tag, intern_color ) ; intern_dest += 1 + size ; if ( tag == Object_tag ) { Assert ( size >= 2 ) ; ReadItems ( & Field ( v, 2 ), size - 2 ) ; PushItem ( ) ; sp -> op = OFreshOID ; sp -> dest = ( value * ) v ; sp -> arg = 1 ; ReadItems ( & Field ( v, 0 ), 2 ) ; } else ReadItems ( & Field ( v, 0 ), size ) ; } } else { v = Val_int ( code & 0x3F ) ; } } else { if ( code >= PREFIX_SMALL_STRING ) { len = ( code & 0x1F ) ; read_string : size = ( len + sizeof ( value ) ) // sizeof ( value ) ; v = Val_hp ( intern_dest ) ; if ( intern_obj_table!= NULL ) intern_obj_table

Fix:
<S2SV_ModStart> : if ( Long_val <S2SV_ModEnd> ( Field (
Buggy code:
 static xsltCompMatchPtr xsltCompilePatternInternal ( const xmlChar * pattern, xmlDocPtr doc, xmlNodePtr node, xsltStylesheetPtr style, xsltTransformContextPtr runtime, int novar ) { xsltParserContextPtr ctxt = NULL ; xsltCompMatchPtr element, first = NULL, previous = NULL ; int current, start, end, level, j ; if ( pattern == NULL ) { xsltTransformError ( NULL, NULL, node, "xsltCompilePattern   :   NULL   pattern\\n" ) ; return ( NULL ) ; } ctxt = xsltNewParserContext ( style, runtime ) ; if ( ctxt == NULL ) return ( NULL ) ; ctxt -> doc = doc ; ctxt -> elem = node ; current = end = 0 ; while ( pattern [ current ]!= 0 ) { start = current ; while ( IS_BLANK_CH ( pattern [ current ] ) ) current ++ ; end = current ; level = 0 ; while ( ( pattern [ end ]!= 0 ) && ( ( pattern [ end ]!= '|' ) || ( level!= 0 ) ) ) { if ( pattern [ end ] == '[' ) level ++ ; else if ( pattern [ end ] == ']' ) level -- ; else if ( pattern [ end ] == '\\'' ) { end ++ ; while ( ( pattern [ end ]!= 0 ) && ( pattern [ end ]!= '\\'' ) ) end ++ ; } else if ( pattern [ end ] == \'"\' ) { end ++ ; while ( ( pattern [ end ]!= 0 ) && ( pattern [ end ]!= \'"\' ) ) end ++ ; } <START_BUG> end ++ ; <END_BUG> } if ( current == end ) { xsltTransformError ( NULL, NULL, node, "xsltCompilePattern   :   NULL   pattern\\n" ) ; goto error ; } element = xsltNewCompMatch ( ) ; if ( element == NULL ) { goto error ; } if ( first == NULL ) first = element ; else if ( previous!= NULL ) previous -> next = element ; previous = element ; ctxt -> comp = element ; ctxt -> base = xmlStrndup ( & pattern [ start ], end - start ) ; if ( ctxt -> base == NULL ) goto error ; ctxt -> cur = & ( ctxt -> base ) [ current - start ] ; element -> pattern = ctxt -> base ; element -> nsList = xmlGetNsList ( doc, node ) ; j = 0 ; if ( element -> ns

Fix:
<S2SV_ModStart> ++ ; } if ( pattern [ end ] == 0 ) break ;
Buggy code:
 void vp9_foreach_transformed_block ( const MACROBLOCKD * const xd, BLOCK_SIZE bsize, foreach_transformed_block_visitor visit, void * arg ) { int plane ; <START_BUG> for ( plane = 0 ; plane < MAX_MB_PLANE ; plane ++ ) <END_BUG> vp9_foreach_transformed_block_in_plane ( xd, bsize, plane, visit, arg ) ; }

Fix:
<S2SV_ModStart> < MAX_MB_PLANE ; ++ plane <S2SV_ModEnd> ) vp9_foreach_transformed_block_in_plane (
Buggy code:
 void rfbScaledScreenUpdateRect ( rfbScreenInfoPtr screen, rfbScreenInfoPtr ptr, int x0, int y0, int w0, int h0 ) { int x, y, w, v, z ; int x1, y1, w1, h1 ; int bitsPerPixel, bytesPerPixel, bytesPerLine, areaX, areaY, area2 ; unsigned char * srcptr, * dstptr ; if ( screen == ptr ) return ; x1 = x0 ; y1 = y0 ; w1 = w0 ; h1 = h0 ; rfbScaledCorrection ( screen, ptr, & x1, & y1, & w1, & h1, "rfbScaledScreenUpdateRect" ) ; x0 = ScaleX ( ptr, screen, x1 ) ; y0 = ScaleY ( ptr, screen, y1 ) ; w0 = ScaleX ( ptr, screen, w1 ) ; h0 = ScaleY ( ptr, screen, h1 ) ; bitsPerPixel = screen -> bitsPerPixel ; bytesPerPixel = bitsPerPixel // 8 ; bytesPerLine = w1 * bytesPerPixel ; srcptr = ( unsigned char * ) ( screen -> frameBuffer + ( y0 * screen -> paddedWidthInBytes + x0 * bytesPerPixel ) ) ; dstptr = ( unsigned char * ) ( ptr -> frameBuffer + ( y1 * ptr -> paddedWidthInBytes + x1 * bytesPerPixel ) ) ; areaX = ScaleX ( ptr, screen, 1 ) ; areaY = ScaleY ( ptr, screen, 1 ) ; area2 = areaX * areaY ; if ( ( x1 + w1 ) > ( ptr -> width ) ) { if ( x1 == 0 ) w1 = ptr -> width ; else x1 = ptr -> width - w1 ; } if ( ( y1 + h1 ) > ( ptr -> height ) ) { if ( y1 == 0 ) h1 = ptr -> height ; else y1 = ptr -> height - h1 ; } if ( screen -> serverFormat. trueColour ) { unsigned char * srcptr2 ; unsigned long pixel_value, red, green, blue ; unsigned int redShift = screen -> serverFormat. redShift ; unsigned int greenShift = screen -> serverFormat. greenShift ; unsigned int blueShift = screen -> serverFormat. blueShift ; unsigned long redMax =

Fix:
<S2SV_ModStart> pixel_value += ( ( unsigned long )
Buggy code:
 static void SaltTextAway ( XtermWidget xw, int which, CELL * cellc, CELL * cell ) { TScreen * screen = TScreenOf ( xw ) ; SelectedCells * scp ; int i ; int eol ; <START_BUG> int need = 0 ; <END_BUG> Char * line ; Char * lp ; CELL first = * cellc ; CELL last = * cell ; if ( which < 0 || which >= MAX_SELECTIONS ) { TRACE ( ( "SaltTextAway   -   which   selection?\\n" ) ) ; return ; } scp = & ( screen -> selected_cells [ which ] ) ; TRACE ( ( "SaltTextAway   which=%d,   first=%d,%d,   last=%d,%d\\n", which, first. row, first. col, last. row, last. col ) ) ; if ( isSameRow ( & first, & last ) && first. col > last. col ) { int tmp ; EXCHANGE ( first. col, last. col, tmp ) ; } -- last. col ; if ( isSameRow ( & last, & first ) ) { need = Length ( screen, first. row, first. col, last. col ) ; } else { need += Length ( screen, first. row, first. col, screen -> max_col ) + 1 ; for ( i = first. row + 1 ; i < last. row ; i ++ ) need += Length ( screen, i, 0, screen -> max_col ) + 1 ; if ( last. col >= 0 ) need += Length ( screen, last. row, 0, last. col ) ; } if_OPT_WIDE_CHARS ( screen, {  need *= 4 ; <START_BUG> } ) ; if ( need < 0 ) return ; if ( scp -> data_limit <= ( unsigned ) need ) { if ( ( line = ( Char * ) malloc ( ( size_t ) need + 1 ) ) == 0 ) SysError ( ERROR_BMALLOC2 ) ; free ( scp -> data_buffer ) ; scp -> data_buffer = line ; scp -> data_limit = ( size_t ) ( need + 1 ) ; } else { line = scp -> data_buffer ; } if ( line == 0 ) return ; line [ need ] = '\\0' ; lp = line ; if ( isSameRow ( & last<END_BUG>

Fix:
<S2SV_ModStart> ; int need = 0 ; size_t have <S2SV_ModStart> screen, { if ( need > 0 ) { if ( screen -> max_combining > 0 ) need += screen -> max_combining ; need *= 6 ; } <S2SV_ModEnd> } ) ; <S2SV_ModStart> = '\\0' ; have = ( size_t ) ( lp - line ) ; if ( ( have * 2 ) < ( size_t ) need ) { scp -> data_limit = have + 1 ; line = realloc ( line, scp -> data_limit ) ; } <S2SV_ModStart> ( unsigned ) have <S2SV_ModEnd>, visibleChars ( <S2SV_ModStart> ( unsigned ) have <S2SV_ModEnd> ) ) ) <S2SV_ModStart> -> data_length = have <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static mf_t * open_mf_pattern ( void * talloc_ctx, struct demuxer * d, char * filename ) { struct mp_log * log = d -> log ; int error_count = 0 ; int count = 0 ; mf_t * mf = talloc_zero ( talloc_ctx, mf_t ) ; mf -> log = log ; if ( filename [ 0 ] == '@' ) { struct stream * s = stream_create ( filename + 1, d -> stream_origin | STREAM_READ, d -> cancel, d -> global ) ; if ( s ) { while ( 1 ) { char buf [ 512 ] ; int len = stream_read_peek ( s, buf, sizeof ( buf ) ) ; if (! len ) break ; bstr data = ( bstr ) { buf, len } ; int pos = bstrchr ( data, '\\n' ) ; data = bstr_splice ( data, 0, pos < 0? data. len : pos + 1 ) ; bstr fname = bstr_strip ( data ) ; if ( fname. len ) { if ( bstrchr ( fname, '\\0' ) >= 0 ) { mp_err ( log, "invalid   filename\\n" ) ; break ; } char * entry = bstrto0 ( mf, fname ) ; if (! mp_path_exists ( entry ) ) { mp_verbose ( log, "file   not   found:   \'%s\'\\n", entry ) ; } else { MP_TARRAY_APPEND ( mf, mf -> names, mf -> nr_of_files, entry ) ; } } stream_seek_skip ( s, stream_tell ( s ) + data. len ) ; } free_stream ( s ) ; mp_info ( log, "number   of   files:   %d\\n", mf -> nr_of_files ) ; goto exit_mf ; } mp_info ( log, "%s   is   not   indirect   filelist\\n", filename + 1 ) ; } if ( strchr ( filename, ',' ) ) { mp_info ( log, "filelist:   %s\\n", filename ) ; bstr bfilename = bstr0 ( filename ) ; while ( bfilename. len ) { bstr bfname ; bstr_split_tok (

Fix:
<S2SV_ModStart> exit_mf ; } size_t fname_avail = <S2SV_ModEnd> strlen ( filename <S2SV_ModStart> ) + 32 ; char * fname = talloc_size ( mf, fname_avail <S2SV_ModStart> } # endif const char * f = filename ; int MAXDIGS = 3, nspec = 0, bad_spec = 0, c ; while ( nspec < 2 && ( c = * f ++ ) ) { if ( c!= '%' ) continue ; if ( * f!= '%' ) { nspec ++ ; if ( * f == '.' ) f ++ ; for ( int ndig = 0 ; mp_isdigit ( * f ) && ndig < MAXDIGS ; ndig ++, f ++ ) ; if ( * f!= 'd' ) { bad_spec ++ ; break ; } } f ++ ; } if ( bad_spec || nspec!= 1 ) { mp_err ( log, "unsupported <S2SV_blank> expr <S2SV_blank> format: <S2SV_blank> \'%s\'\\n", filename ) ; goto exit_mf ; } <S2SV_ModStart> 5 ) { if ( snprintf ( fname, fname_avail <S2SV_ModEnd>, filename, <S2SV_ModStart> count ++ ) >= fname_avail ) { mp_err ( log, "format <S2SV_blank> result <S2SV_blank>
Buggy code:
 <START_BUG> static void nsc_encode_argb_to_aycocg ( NSC_CONTEXT * context, const BYTE * data, <END_BUG> UINT32 scanline ) { UINT16 x ; UINT16 y ; UINT16 rw ; BYTE ccl ; const BYTE * src ; BYTE * yplane = NULL ; BYTE * coplane = NULL ; BYTE * cgplane = NULL ; BYTE * aplane = NULL ; INT16 r_val ; INT16 g_val ; INT16 b_val ; BYTE a_val ;  UINT32 tempWidth ; <START_BUG> tempWidth = ROUND_UP_TO ( context -> width, 8 ) ; rw = ( context -> ChromaSubsamplingLevel? tempWidth : context -> width ) ; ccl = context -> ColorLossLevel ; <END_BUG> for ( y = 0 ; y < context -> height ; y ++ )  { src = data + ( context -> height - 1 - y ) * scanline ; yplane = context -> priv -> PlaneBuffers [ 0 ] + y * rw ; coplane = context -> priv -> PlaneBuffers [ 1 ] + y * rw ; cgplane = context -> priv -> PlaneBuffers [ 2 ] + y * rw ; aplane = context -> priv -> PlaneBuffers [ 3 ] + y * context -> width ; for ( x = 0 ; x < context -> width ; x ++ ) { switch ( context -> format ) { case PIXEL_FORMAT_BGRX32 : b_val = * src ++ ; g_val = * src ++ ; r_val = * src ++ ; src ++ ; a_val = 0xFF ; break ; case PIXEL_FORMAT_BGRA32 : b_val = * src ++ ; g_val = * src ++ ; r_val = * src ++ ; a_val = * src ++ ; break ; case PIXEL_FORMAT_RGBX32 : r_val = * src ++ ; g_val = * src ++ ; b_val = * src ++ ; src ++ ; a_val = 0xFF ; break ; case PIXEL_FORMAT_RGBA32 : r_val = * src ++ ; g_val = * src ++ ; b_val = * src ++ ; a_val = * src ++ ; break ; case PIXEL_FORMAT_BGR24 : b_val = * src ++ ; g_val = * src ++

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static BOOL <S2SV_ModEnd> nsc_encode_argb_to_aycocg ( NSC_CONTEXT <S2SV_ModStart> ; UINT32 tempWidth ; if (! context || data || ( scanline == 0 ) ) return FALSE <S2SV_ModStart> -> ColorLossLevel ; if ( context -> priv -> PlaneBuffersLength < rw * scanline ) return FALSE ; if ( rw < scanline * 2 ) return FALSE ; <S2SV_ModStart> ) ; } return TRUE ;
Buggy code:
 sds sdsnewlen ( const void * init, size_t initlen ) { void * sh ; sds s ; char type = sdsReqType ( initlen ) ; if ( type == SDS_TYPE_5 && initlen == 0 ) type = SDS_TYPE_8 ; int hdrlen = sdsHdrSize ( type ) ; unsigned char * fp ; <START_BUG> sh = s_malloc ( hdrlen + initlen + 1 ) ; <END_BUG> if ( sh == NULL ) return NULL ; if ( init == SDS_NOINIT ) init = NULL ; else if (! init ) memset ( sh, 0, hdrlen + initlen + 1 ) ; s = ( char * ) sh + hdrlen ; fp = ( ( unsigned char * ) s ) - 1 ; switch ( type ) { case SDS_TYPE_5 : { * fp = type | ( initlen << SDS_TYPE_BITS ) ; break ; } case SDS_TYPE_8 : { SDS_HDR_VAR ( 8, s ) ; sh -> len = initlen ; sh -> alloc = initlen ; * fp = type ; break ; } case SDS_TYPE_16 : { SDS_HDR_VAR ( 16, s ) ; sh -> len = initlen ; sh -> alloc = initlen ; * fp = type ; break ; } case SDS_TYPE_32 : { SDS_HDR_VAR ( 32, s ) ; sh -> len = initlen ; sh -> alloc = initlen ; * fp = type ; break ; } case SDS_TYPE_64 : { SDS_HDR_VAR ( 64, s ) ; sh -> len = initlen ; sh -> alloc = initlen ; * fp = type ; break ; } } if ( initlen && init ) memcpy ( s, init, initlen ) ; s [ initlen ] = '\\0' ; return s ; }

Fix:
<S2SV_ModStart> * fp ; assert ( initlen + hdrlen + 1 > initlen ) ;
Buggy code:
 NOEXPORT int options_file ( char * path, CONF_TYPE type, SERVICE_OPTIONS * * section_ptr ) { DISK_FILE * df ; char line_text [ CONFLINELEN ], * errstr ; char config_line [ CONFLINELEN ], * config_opt, * config_arg ; int i, line_number = 0 ; # ifndef USE_WIN32 int fd ; char * tmp_str ; # endif s_log ( LOG_NOTICE, "Reading   configuration   from   %s   %s", type == CONF_FD? "descriptor" : "file", path ) ; # ifndef USE_WIN32 if ( type == CONF_FD ) { fd = ( int ) strtol ( path, & tmp_str, 10 ) ; if ( tmp_str == path || * tmp_str ) { s_log ( LOG_ERR, "Invalid   file   descriptor   number" ) ; print_syntax ( ) ; return 1 ; } df = file_fdopen ( fd ) ; } else # endif df = file_open ( path, FILE_MODE_READ ) ; if (! df ) { s_log ( LOG_ERR, "Cannot   open   configuration   file" ) ; if ( type!= CONF_RELOAD ) print_syntax ( ) ; return 1 ; } while ( file_getline ( df, line_text, CONFLINELEN ) >= 0 ) { memcpy ( config_line, line_text, CONFLINELEN ) ; ++ line_number ; config_opt = config_line ; if ( line_number == 1 ) { if ( config_opt [ 0 ] == ( char ) 0xef && config_opt [ 1 ] == ( char ) 0xbb && config_opt [ 2 ] == ( char ) 0xbf ) { s_log ( LOG_NOTICE, "UTF-8   byte   order   mark   detected" ) ; config_opt += 3 ; } else { s_log ( LOG_NOTICE, "UTF-8   byte   order   mark   not   detected" ) ; } } while ( isspace ( ( unsigned char ) * config_opt ) ) ++ config_opt ; for ( i = ( int ) strlen ( config_opt ) - 1 ; i >= 0 && isspace ( ( unsigned char ) config_opt [ i ] ) ; -- i

Fix:
<S2SV_ModStart> ( CMD_SET_VALUE, & new_global_options,
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; MATLAB_HDR. Version = ReadBlobLSBShort ( image ) ; if ( ReadBlob ( image, 2, ( unsigned char * ) & MATLAB_HDR. EndianIndicator )!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( logging ) ( void ) LogMagickEvent ( C

Fix:
<S2SV_ModStart>, sizeof ( double <S2SV_ModEnd> ) ) ;
Buggy code:
 static void header_seek ( SF_PRIVATE * psf, sf_count_t position, int whence ) { switch ( whence ) { case SEEK_SET : <START_BUG> if ( position > SIGNED_SIZEOF ( psf -> header ) ) <END_BUG> { psf_fseek ( psf, position, whence ) ; return ; } ;  if ( position > psf -> headend ) <START_BUG> <END_BUG> psf -> headend += psf_fread ( psf -> header + psf -> headend, 1, position - psf -> headend, psf ) ;  psf -> headindex = position ; break ; case SEEK_CUR : <START_BUG> if ( psf -> headindex + position < 0 ) <END_BUG> break ;  if ( psf -> headindex >= SIGNED_SIZEOF ( psf -> header ) ) <START_BUG> { psf_fseek ( psf, position, whence ) ; return ; } ; <END_BUG> if ( psf -> headindex + position <= psf -> headend )  { psf -> headindex += position ; break ; } ; <START_BUG> if ( psf -> headindex + position > SIGNED_SIZEOF ( psf -> header ) ) <END_BUG> {  psf -> headindex = psf -> headend ; <START_BUG> psf_fseek ( psf, position, SEEK_CUR ) ; break ; } ; <END_BUG> psf -> headend += psf_fread ( psf -> header + psf -> headend, 1, position - ( psf -> headend - psf -> headindex ), psf ) ;  <START_BUG> psf -> headindex = psf -> headend ; <END_BUG> break ; case SEEK_END : default : psf_log_printf ( psf, "Bad   whence   param   in   header_seek().\\n" ) ; break ; } ; return ; }

Fix:
<S2SV_ModStart> : if ( psf -> header. indx + position >= psf -> header. len ) psf_bump_header_allocation ( psf, position ) ; if ( position > psf -> header. len <S2SV_ModEnd> ) { psf_fseek <S2SV_ModStart> > psf -> header. end ) psf -> header. end <S2SV_ModEnd> += psf_fread ( <S2SV_ModStart> psf -> header. ptr + psf -> header. end <S2SV_ModEnd>, 1, <S2SV_ModStart> - psf -> header. end, psf ) ; psf -> header. indx <S2SV_ModEnd> = position ; <S2SV_ModStart> ( psf -> header. indx + position >= psf -> header. len ) psf_bump_header_allocation ( psf, position ) ; if ( psf -> header. indx <S2SV_ModEnd> + position < <S2SV_ModStart> ( psf -> header. indx >= psf -> header. len <S2SV_ModEnd> ) { psf_fseek <S2SV_ModStart> ( psf -> header. indx <S2SV_ModEnd> + position <= <S2SV_ModStart> <= psf -> header. end ) { psf -> header. indx <S2SV_ModEnd> += position ; <S2SV_ModStart> ( psf -> header. indx <S2SV_ModEnd> + position > <S2SV_ModStart> + position > psf -> header. len ) { psf -> header. indx <S2SV_ModEnd> = psf -> <S2SV_ModStart> = psf -> header. end <S2SV_ModEnd> ; psf_fseek ( <S2SV_ModStart> ; psf -> header. end <S2SV_ModEnd> += psf
Buggy code:
 void impeg2d_dec_hdr ( void * pv_dec, impeg2d_video_decode_ip_t * ps_ip, impeg2d_video_decode_op_t * ps_op ) { UWORD32 u4_bits_read ; dec_state_t * ps_dec ; UWORD32 u4_size = ps_ip -> s_ivd_video_decode_ip_t. u4_num_Bytes ; ps_dec = ( dec_state_t * ) pv_dec ; ps_op -> s_ivd_video_decode_op_t. u4_error_code = 0 ; if ( u4_size > MAX_BITSTREAM_BUFFER_SIZE ) { u4_size = MAX_BITSTREAM_BUFFER_SIZE ; } memcpy ( ps_dec -> pu1_input_buffer, ps_ip -> s_ivd_video_decode_ip_t. pv_stream_buffer, u4_size ) ; impeg2d_bit_stream_init ( & ( ps_dec -> s_bit_stream ), ps_dec -> pu1_input_buffer, u4_size ) ; { { IMPEG2D_ERROR_CODES_T e_error ; e_error = impeg2d_process_video_header ( ps_dec ) ; if ( ( IMPEG2D_ERROR_CODES_T ) IVD_ERROR_NONE!= e_error ) { ps_op -> s_ivd_video_decode_op_t. u4_error_code = e_error ; u4_bits_read = impeg2d_bit_stream_num_bits_read ( & ps_dec -> s_bit_stream ) ; ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed = u4_bits_read >> 3 ; if ( ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed > ps_ip -> s_ivd_video_decode_ip_t. u4_num_Bytes ) { ps_op -> s_ivd_video_decode_op_t. u4_num_bytes_consumed = ps_ip -> s

Fix:
<S2SV_ModStart> = 0 ; if ( 0 == ps_dec -> u4_frm_buf_stride ) { ps_dec -> u4_frm_buf_stride = ps_dec -> u2_horizontal_size ; }
Buggy code:
 static ssize_t ocfs2_direct_IO ( struct kiocb * iocb, struct iov_iter * iter ) { struct file * file = iocb -> ki_filp ; struct inode * inode = file -> f_mapping -> host ; struct ocfs2_super * osb = OCFS2_SB ( inode -> i_sb ) ; get_block_t * get_block ; if ( OCFS2_I ( inode ) -> ip_dyn_features & OCFS2_INLINE_DATA_FL ) return 0 ; if ( iocb -> ki_pos + iter -> count > i_size_read ( inode ) &&! ocfs2_supports_append_dio ( osb ) ) return 0 ; if ( iov_iter_rw ( iter ) == READ ) <START_BUG> get_block = ocfs2_get_block ; <END_BUG> else  get_block = ocfs2_dio_get_block ; <START_BUG> return __blockdev_direct_IO ( iocb, inode, inode -> i_sb -> s_bdev, iter, get_block, ocfs2_dio_end_io, NULL, 0 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) get_block = ocfs2_lock_get_block <S2SV_ModEnd> ; else get_block <S2SV_ModStart> else get_block = ocfs2_dio_wr_get_block <S2SV_ModEnd> ; return __blockdev_direct_IO
Buggy code:
 void jslGetTokenString ( char * str, size_t len ) { if ( lex -> tk == LEX_ID ) { <START_BUG> strncpy ( str, "ID:", len ) ; <END_BUG>  strncat ( str, jslGetTokenValueAsString ( ), len ) ; <START_BUG> } else if ( lex -> tk == LEX_STR ) { <END_BUG> strncpy ( str, "String:\'", len ) ;  <START_BUG> strncat ( str, jslGetTokenValueAsString ( ), len ) ; <END_BUG> strncat ( str, "\'", len ) ; } else jslTokenAsString ( lex -> tk, str, len ) ; }

Fix:
<S2SV_ModStart> LEX_ID ) { espruino_snprintf <S2SV_ModEnd> ( str, <S2SV_ModStart> ( str, len, "ID:%s" <S2SV_ModEnd>, jslGetTokenValueAsString ( <S2SV_ModStart> jslGetTokenValueAsString ( ) <S2SV_ModEnd> ) ; } <S2SV_ModStart> LEX_STR ) { espruino_snprintf <S2SV_ModEnd> ( str, <S2SV_ModStart> ( str, len, "String:\'%s\'" <S2SV_ModEnd>, jslGetTokenValueAsString ( <S2SV_ModStart> jslGetTokenValueAsString ( ) <S2SV_ModEnd> ) ; }
Buggy code:
 void processInputBuffer ( client * c ) { server. current_client = c ; while ( sdslen ( c -> querybuf ) ) { if (! ( c -> flags & CLIENT_SLAVE ) && clientsArePaused ( ) ) break ; if ( c -> flags & CLIENT_BLOCKED ) break ; <START_BUG> if ( c -> flags & CLIENT_CLOSE_AFTER_REPLY ) break ; <END_BUG> if (! c -> reqtype ) { if ( c -> querybuf [ 0 ] == '*' ) { c -> reqtype = PROTO_REQ_MULTIBULK ; } else { c -> reqtype = PROTO_REQ_INLINE ; } } if ( c -> reqtype == PROTO_REQ_INLINE ) { if ( processInlineBuffer ( c )!= C_OK ) break ; } else if ( c -> reqtype == PROTO_REQ_MULTIBULK ) { if ( processMultibulkBuffer ( c )!= C_OK ) break ; } else { serverPanic ( "Unknown   request   type" ) ; } if ( c -> argc == 0 ) { resetClient ( c ) ; } else { if ( processCommand ( c ) == C_OK ) resetClient ( c ) ; if ( server. current_client == NULL ) break ; } } server. current_client = NULL ; }

Fix:
<S2SV_ModStart> -> flags & ( CLIENT_CLOSE_AFTER_REPLY | CLIENT_CLOSE_ASAP ) <S2SV_ModEnd> ) break ;
Buggy code:
 struct VP8_COMP * vp8_create_compressor ( VP8_CONFIG * oxcf ) { int i ; VP8_COMP * cpi ; VP8_COMMON * cm ; cpi = vpx_memalign ( 32, sizeof ( VP8_COMP ) ) ; if (! cpi ) return 0 ; cm = & cpi -> common ; <START_BUG> vpx_memset ( cpi, 0, sizeof ( VP8_COMP ) ) ; <END_BUG> if ( setjmp ( cm -> error. jmp ) ) { cpi -> common. error. setjmp = 0 ; vp8_remove_compressor ( & cpi ) ; return 0 ; } cpi -> common. error. setjmp = 1 ; CHECK_MEM_ERROR ( cpi -> mb. ss, vpx_calloc ( sizeof ( search_site ), ( MAX_MVSEARCH_STEPS * 8 ) + 1 ) ) ; vp8_create_common ( & cpi -> common ) ; init_config ( cpi, oxcf ) ; memcpy ( cpi -> base_skip_false_prob, vp8cx_base_skip_false_prob, sizeof ( vp8cx_base_skip_false_prob ) ) ; cpi -> common. current_video_frame = 0 ; cpi -> temporal_pattern_counter = 0 ;  cpi -> kf_overspend_bits = 0 ; <START_BUG> cpi -> kf_bitrate_adjustment = 0 ; cpi -> frames_till_gf_update_due = 0 ; cpi -> gf_overspend_bits = 0 ; cpi -> non_gf_bitrate_adjustment = 0 ; cpi -> prob_last_coded = 128 ; cpi -> prob_gf_coded = 128 ; cpi -> prob_intra_coded = 63 ; cpi -> recent_ref_frame_usage [ INTRA_FRAME ] = 1 ; cpi -> recent_ref_frame_usage [ LAST_FRAME ] = 1 ; cpi -> recent_ref_frame_usage [ GOLDEN_FRAME ] = 1 ; cpi -> recent_ref_frame_usage [ ALTREF_FRAME ] = 1 ; cpi -> common. ref_frame_sign_bias [ ALTREF_FRAME ] = 1 ;<END_BUG>

Fix:
<S2SV_ModStart> -> common ; memset <S2SV_ModEnd> ( cpi, <S2SV_ModStart> ; cpi -> temporal_layer_id = - 1 ; cpi -> <S2SV_ModStart> endif cpi -> mse_source_denoised = 0 ; cpi -> <S2SV_ModStart> // 5 ; if ( cpi -> oxcf. number_of_layers == 1 ) { cpi -> cyclic_refresh_mode_max_mbs_perframe = ( cpi -> common. mb_rows * cpi -> common. mb_cols ) // 20 ; } else if ( cpi -> oxcf. number_of_layers == 2 ) { cpi -> cyclic_refresh_mode_max_mbs_perframe = ( cpi -> common. mb_rows * cpi -> common. mb_cols ) // 10 ; } <S2SV_ModStart> ) NULL ; CHECK_MEM_ERROR ( cpi -> consec_zero_last, vpx_calloc ( cm -> mb_rows * cm -> mb_cols, 1 ) ) ; CHECK_MEM_ERROR ( cpi -> consec_zero_last_mvbias, vpx_calloc ( ( cpi -> common. mb_rows * cpi -> common. mb_cols )
Buggy code:
 void olsr_print ( netdissect_options * ndo, const u_char * pptr, u_int length, int is_ipv6 ) { union { const struct olsr_common * common ; const struct olsr_msg4 * msg4 ; const struct olsr_msg6 * msg6 ; const struct olsr_hello * hello ; const struct olsr_hello_link * hello_link ; const struct olsr_tc * tc ; const struct olsr_hna4 * hna ; } ptr ; u_int msg_type, msg_len, msg_tlen, hello_len ; uint16_t name_entry_type, name_entry_len ; u_int name_entry_padding ; uint8_t link_type, neighbor_type ; const u_char * tptr, * msg_data ; tptr = pptr ; if ( length < sizeof ( struct olsr_common ) ) { goto trunc ; } ND_TCHECK2 ( * tptr, sizeof ( struct olsr_common ) ) ; ptr. common = ( const struct olsr_common * ) tptr ; length = min ( length, EXTRACT_16BITS ( ptr. common -> packet_len ) ) ; ND_PRINT ( ( ndo, "OLSRv%i,   seq   0x%04x,   length   %u", ( is_ipv6 == 0 )? 4 : 6, EXTRACT_16BITS ( ptr. common -> packet_seq ), length ) ) ; tptr += sizeof ( struct olsr_common ) ; if ( ndo -> ndo_vflag < 1 ) { return ; } while ( tptr < ( pptr + length ) ) { union { const struct olsr_msg4 * v4 ; const struct olsr_msg6 * v6 ; } msgptr ; int msg_len_valid = 0 ; <START_BUG> ND_TCHECK2 ( * tptr, sizeof ( struct olsr_msg4 ) ) ; <END_BUG> if ( is_ipv6 ) { msgptr. v6 = ( const struct olsr_msg6 * ) tptr ; msg_type = msgptr. v6 -> msg_type ; msg_len = EXTRACT_16BITS ( msgptr. v6 -> msg

Fix:
<S2SV_ModStart> = 0 ; if ( is_ipv6 ) { <S2SV_ModStart> sizeof ( struct olsr_msg6 ) ) ; <S2SV_ModEnd> msgptr. v6 <S2SV_ModStart> } else { ND_TCHECK2 ( * tptr, sizeof ( struct olsr_msg4 ) ) ; <S2SV_ModStart> { u_int name_entries ; u_int addr_size ; int name_entries_valid ; u_int i ; if ( msg_tlen < 4 ) goto trunc ; ND_TCHECK2 ( * msg_data, 4 ) ; name_entries <S2SV_ModStart> 2 ) ; <S2SV_ModEnd> addr_size = 4 <S2SV_ModStart> = 4 ; if ( is_ipv6 ) addr_size = 16 ; <S2SV_ModEnd> name_entries_valid = 0 <S2SV_ModStart> name_entries_valid = 0 <S2SV_ModEnd> ; if ( <S2SV_ModStart> name_entries_valid = 1 <S2SV_ModEnd> ; ND_PRINT (
Buggy code:
 void BezierOval ( double w, double h, char * action ) <START_BUG> { <END_BUG> outpos += sprintf ( outpos, "   %12.3f   0   m   %12.3f   %12.3f   %12.3f   %12.3f   0   %12.3f   c\\n", - w, - w, h * BzK, - w * BzK, h, h ) ; outpos += sprintf ( outpos, "   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   0   c\\n", w * BzK, h, w, h * BzK, w ) ; outpos += sprintf ( outpos, "   %12.3f   %12.3f   %12.3f   %12.3f   0   %12.3f   c\\n", w, - h * BzK, w * BzK, - h, - h ) ; outpos += sprintf ( outpos, "   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   0   c   %s\\n", - w * BzK, - h, - w, - h * BzK, - w, action ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> action ) { char * outpos = outputbuffer ; <S2SV_ModStart> action ) ; sendClean ( outputbuffer ) ;
Buggy code:
 static void <START_BUG> l2tp_call_errors_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> { const uint16_t * ptr = ( const uint16_t * ) dat ; uint16_t val_h, val_l ;  ptr ++ ; <START_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "CRCErr=%u   ", ( val_h << 16 ) + val_l ) ) ; <END_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ;  val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "FrameErr=%u   ", ( val_h << 16 ) + val_l ) ) ; <START_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; <END_BUG> val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "HardOver=%u   ", ( val_h << 16 ) + val_l ) ) ;  val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; <START_BUG> val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "BufOver=%u   ", ( val_h << 16 ) + val_l ) ) ; <END_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ;  val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "Timeout=%u   ", ( val_h << 16 ) + val_l ) ) ; <START_BUG> val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; <END_BUG> val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; ND_PRINT ( ( ndo, "AlignErr=%u   ", ( val_h << 16 ) + val_l ) ) ; }

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart>, val_l ; if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } ptr ++ ; length -= 2 ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; length -= 2 ; val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; length -= 2 <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> ) ) ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } val_h = EXTRACT_16BITS ( ptr ) ; ptr ++ ; length -= 2 ; val_l = EXTRACT_16BITS ( ptr ) ; ptr ++ ; length -= 2 <S2SV_ModEnd> ; ND_PRINT ( <S2SV_ModStart> ) ) ; if ( length < 4 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; } val_h = EXTRACT_16BITS (
Buggy code:
 void impeg2d_dec_user_data ( dec_state_t * ps_dec ) { UWORD32 u4_start_code ; stream_t * ps_stream ; ps_stream = & ps_dec -> s_bit_stream ; u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; while ( u4_start_code == USER_DATA_START_CODE ) { impeg2d_bit_stream_flush ( ps_stream, START_CODE_LEN ) ; <START_BUG> while ( impeg2d_bit_stream_nxt ( ps_stream, START_CODE_PREFIX_LEN )!= START_CODE_PREFIX ) <END_BUG> { impeg2d_bit_stream_flush ( ps_stream, 8 ) ; } u4_start_code = impeg2d_bit_stream_nxt ( ps_stream, START_CODE_LEN ) ; } }

Fix:
<S2SV_ModStart> ; while ( ( <S2SV_ModStart> )!= START_CODE_PREFIX ) && ( ps_stream -> u4_offset < ps_stream -> u4_max_offset )