nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int sessionCookieDirective ( MaState * state, cchar * key, cchar * value ) { char * options, * option, * ovalue, * tok ; if (! maTokenize ( state, value, "%*", & options ) ) { return MPR_ERR_BAD_SYNTAX ; } if ( smatch ( options, "disable" ) ) { httpSetAuthSession ( state -> route -> auth, 0 ) ; return 0 ; } else if ( smatch ( options, "enable" ) ) { httpSetAuthSession ( state -> route -> auth, 1 ) ; return 0 ; } for ( option = maGetNextArg ( options, & tok ) ; option ; option = maGetNextArg ( tok, & tok ) ) { <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if (! ovalue || * ovalue == '\\0' ) continue ; if ( smatch ( option, "visible" ) ) { httpSetRouteSessionVisibility ( state -> route, scaselessmatch ( ovalue, "visible" ) ) ; } else if ( smatch ( option, "name" ) ) { httpSetRouteCookie ( state -> route, ovalue ) ; } else { mprLog ( "error   appweb   config", 0, "Unknown   SessionCookie   option   %s", option ) ; return MPR_ERR_BAD_SYNTAX ; } } return 0 ; }

Fix:
<S2SV_ModStart> { option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 error_t tja1100Init ( NetInterface * interface ) { uint16_t value ; TRACE_INFO ( "Initializing   TJA1100...\\r\\n" ) ; if ( interface -> phyAddr >= 32 ) { interface -> phyAddr = TJA1100_PHY_ADDR ; } if ( interface -> smiDriver!= NULL ) { interface -> smiDriver -> init ( ) ; } if ( interface -> extIntDriver!= NULL ) { interface -> extIntDriver -> init ( ) ; } tja1100WritePhyReg ( interface, TJA1100_BASIC_CTRL, TJA1100_BASIC_CTRL_RESET ) ; while ( tja1100ReadPhyReg ( interface, TJA1100_BASIC_CTRL ) & TJA1100_BASIC_CTRL_RESET ) { } tja1100DumpPhyReg ( interface ) ; value = tja1100ReadPhyReg ( interface, TJA1100_EXTENDED_CTRL ) ; value |= TJA1100_EXTENDED_CTRL_CONFIG_EN ; tja1100WritePhyReg ( interface, TJA1100_EXTENDED_CTRL, value ) ; value = tja1100ReadPhyReg ( interface, TJA1100_CONFIG1 ) ; value &= ~ TJA1100_CONFIG1_MII_MODE ; <START_BUG> value |= TJA1100_CONFIG1_MII_MODE_RMII_25MHZ ; <END_BUG> tja1100WritePhyReg ( interface, TJA1100_CONFIG1, value ) ; value = tja1100ReadPhyReg ( interface, TJA1100_CONFIG1 ) ; value |= TJA1100_CONFIG1_AUTO_OP ; tja1100WritePhyReg ( interface, TJA1100_CONFIG1, value ) ; interface -> phyEvent = TRUE ; osSetEvent ( & netEvent ) ; return NO_ERROR ; }

Fix:
<S2SV_ModStart> ; value |= TJA1100_CONFIG1_MII_MODE_RMII_25MHZ_XTAL <S2SV_ModEnd> ; tja1100WritePhyReg (
Buggy code:
 static bool dccp_new ( struct nf_conn * ct, const struct sk_buff * skb, unsigned int dataoff, unsigned int * timeouts ) { struct net * net = nf_ct_net ( ct ) ; struct dccp_net * dn ; struct dccp_hdr _dh, * dh ; const char * msg ; u_int8_t state ; <START_BUG> dh = skb_header_pointer ( skb, dataoff, sizeof ( _dh ), & dh ) ; <END_BUG> BUG_ON ( dh == NULL ) ; state = dccp_state_table [ CT_DCCP_ROLE_CLIENT ] [ dh -> dccph_type ] [ CT_DCCP_NONE ] ; switch ( state ) { default : dn = dccp_pernet ( net ) ; if ( dn -> dccp_loose == 0 ) { msg = "nf_ct_dccp:   not   picking   up   existing   connection   " ; goto out_invalid ; } case CT_DCCP_REQUEST : break ; case CT_DCCP_INVALID : msg = "nf_ct_dccp:   invalid   state   transition   " ; goto out_invalid ; } ct -> proto. dccp. role [ IP_CT_DIR_ORIGINAL ] = CT_DCCP_ROLE_CLIENT ; ct -> proto. dccp. role [ IP_CT_DIR_REPLY ] = CT_DCCP_ROLE_SERVER ; ct -> proto. dccp. state = CT_DCCP_NONE ; ct -> proto. dccp. last_pkt = DCCP_PKT_REQUEST ; ct -> proto. dccp. last_dir = IP_CT_DIR_ORIGINAL ; ct -> proto. dccp. handshake_seq = 0 ; return true ; out_invalid : if ( LOG_INVALID ( net, IPPROTO_DCCP ) ) nf_log_packet ( net, nf_ct_l3num ( ct ), 0, skb, NULL, NULL, NULL, "%s", msg ) ; return false ; }

Fix:
<S2SV_ModStart> ), & _dh <S2SV_ModEnd> ) ; BUG_ON
Buggy code:
 static inline void VectorClamp3 ( DDSVector3 * value ) { <START_BUG> value -> x = MinF ( 1.0f, MaxF ( 0.0f, value -> x ) ) ; <END_BUG>  value -> y = MinF ( 1.0f, MaxF ( 0.0f, value -> y ) ) ; <START_BUG> <END_BUG> value -> z = MinF ( 1.0f, MaxF ( 0.0f, value -> z ) ) ;  }

Fix:
<S2SV_ModStart> -> x = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f, <S2SV_ModStart> -> y = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f, <S2SV_ModStart> -> z = MagickMin <S2SV_ModEnd> ( 1.0f, <S2SV_ModStart> ( 1.0f, MagickMax <S2SV_ModEnd> ( 0.0f,
Buggy code:
 static int ext2_xattr_set2 ( struct inode * inode, struct buffer_head * old_bh, struct ext2_xattr_header * header ) { struct super_block * sb = inode -> i_sb ; struct buffer_head * new_bh = NULL ; int error ; <START_BUG> if ( header ) { <END_BUG> new_bh = ext2_xattr_cache_find ( inode, header ) ; if ( new_bh ) { if ( new_bh == old_bh ) { ea_bdebug ( new_bh, "keeping   this   block" ) ; } else { ea_bdebug ( new_bh, "reusing   block" ) ; error = dquot_alloc_block ( inode, 1 ) ; if ( error ) { unlock_buffer ( new_bh ) ; goto cleanup ; } le32_add_cpu ( & HDR ( new_bh ) -> h_refcount, 1 ) ; ea_bdebug ( new_bh, "refcount   now=%d", le32_to_cpu ( HDR ( new_bh ) -> h_refcount ) ) ; } unlock_buffer ( new_bh ) ; } else if ( old_bh && header == HDR ( old_bh ) ) { new_bh = old_bh ; get_bh ( new_bh ) ;  ext2_xattr_cache_insert ( new_bh ) ; <START_BUG> } else { ext2_fsblk_t goal = ext2_group_first_block_no ( sb, EXT2_I ( inode ) -> i_block_group ) ; int block = ext2_new_block ( inode, goal, & error ) ; if ( error ) goto cleanup ; ea_idebug ( inode, "creating   block   %d", block ) ; new_bh = sb_getblk ( sb, block ) ; if ( unlikely (! new_bh ) ) { ext2_free_blocks ( inode, block, 1 ) ; mark_inode_dirty ( inode ) ; error = - ENOMEM ; goto cleanup ; } lock_buffer ( new_bh ) ; memcpy ( new_bh -> b_data, header, new_bh -> b_size<END_BUG>

Fix:
<S2SV_ModStart> int error ; struct mb2_cache * ext2_mb_cache = EXT2_SB ( sb ) -> s_mb_cache ; <S2SV_ModStart> ; ext2_xattr_cache_insert ( ext2_mb_cache, <S2SV_ModStart> ; ext2_xattr_cache_insert ( ext2_mb_cache, <S2SV_ModStart> new_bh ) { <S2SV_ModEnd> lock_buffer ( old_bh <S2SV_ModStart> ) ) { __u32 hash = le32_to_cpu ( HDR ( old_bh ) -> h_hash ) ; mb2_cache_entry_delete_block ( ext2_mb_cache, hash, old_bh -> b_blocknr <S2SV_ModEnd> ) ; ea_bdebug <S2SV_ModStart> 1 ) ; <S2SV_ModEnd> dquot_free_block_nodirty ( inode
Buggy code:
 mod_ty <START_BUG> Module ( asdl_seq * body, PyArena * arena ) <END_BUG> { mod_ty p ; p = ( mod_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = Module_kind ; p -> v. Module. body = body ;  return p ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> asdl_seq * body, asdl_seq * type_ignores <S2SV_ModStart> = body ; p -> v. Module. type_ignores = type_ignores ;
Buggy code:
 void process_packet_tail ( struct msg_digest * md ) { struct state * st = md -> st ; enum state_kind from_state = md -> v1_from_state ; const struct state_v1_microcode * smc = md -> smc ; bool new_iv_set = md -> new_iv_set ; bool self_delete = FALSE ; if ( md -> hdr. isa_flags & ISAKMP_FLAGS_v1_ENCRYPTION ) { endpoint_buf b ; dbg ( "received   encrypted   packet   from   %s", str_endpoint ( & md -> sender, & b ) ) ; if ( st == NULL ) { libreswan_log ( "discarding   encrypted   message   for   an   unknown   ISAKMP   SA" ) ; return ; } if ( st -> st_skeyid_e_nss == NULL ) { loglog ( RC_LOG_SERIOUS, "discarding   encrypted   message   because   we   haven\'t   yet   negotiated   keying   material" ) ; return ; } md -> encrypted = TRUE ; const struct encrypt_desc * e = st -> st_oakley. ta_encrypt ; if ( pbs_left ( & md -> message_pbs ) % e -> enc_blocksize!= 0 ) { loglog ( RC_LOG_SERIOUS, "malformed   message:   not   a   multiple   of   encryption   blocksize" ) ; return ; } md -> raw_packet = clone_bytes_as_chunk ( md -> packet_pbs. start, pbs_room ( & md -> packet_pbs ), "raw   packet" ) ; if (! new_iv_set ) { if ( st -> st_v1_iv. len == 0 ) { init_phase2_iv ( st, & md -> hdr. isa_msgid ) ; } else { restore_new_iv ( st, st -> st_v1_iv ) ; } } passert ( st -> st_v1_new_iv. len >= e -> enc_blocksize ) ; st -> st_v1_new_iv. len = e -> enc_blocksize ; if ( DBGP ( DBG_CRYPT ) ) { DBG_log ( "decrypt

Fix:
<S2SV_ModStart> np ), finite_states [ smc -> state ] <S2SV_ModEnd> -> name )
Buggy code:
 static void mincore_pmd_range ( struct vm_area_struct * vma, pud_t * pud, unsigned long addr, unsigned long end, unsigned char * vec ) { unsigned long next ; pmd_t * pmd ; pmd = pmd_offset ( pud, addr ) ; do { next = pmd_addr_end ( addr, end ) ; if ( pmd_trans_huge ( * pmd ) ) { if ( mincore_huge_pmd ( vma, pmd, addr, next, vec ) ) { vec += ( next - addr ) >> PAGE_SHIFT ; continue ; } } <START_BUG> if ( pmd_none_or_clear_bad ( pmd ) ) <END_BUG> mincore_unmapped_range ( vma, addr, next, vec ) ; else mincore_pte_range ( vma, pmd, addr, next, vec ) ; vec += ( next - addr ) >> PAGE_SHIFT ; } while ( pmd ++, addr = next, addr!= end ) ; }

Fix:
<S2SV_ModStart> } if ( pmd_none_or_trans_huge_or_clear_bad <S2SV_ModEnd> ( pmd )
Buggy code:
 static void parserule ( struct scanner * s, struct environment * env ) { struct rule * r ; char * var ; struct evalstring * val ; bool hascommand = false, hasrspfile = false, hasrspcontent = false ; r = mkrule ( scanname ( s ) ) ; scannewline ( s ) ; while ( scanindent ( s ) ) { var = scanname ( s ) ; parselet ( s, & val ) ; <START_BUG> ruleaddvar ( r, var, val ) ; <END_BUG> if ( strcmp ( var, "command" ) == 0 ) hascommand = true ; else if ( strcmp ( var, "rspfile" ) == 0 ) hasrspfile = true ; else if ( strcmp ( var, "rspfile_content" ) == 0 ) hasrspcontent = true ; } if (! hascommand ) fatal ( "rule   \'%s\'   has   no   command", r -> name ) ; if ( hasrspfile!= hasrspcontent ) fatal ( "rule   \'%s\'   has   rspfile   and   no   rspfile_content   or   vice   versa", r -> name ) ; envaddrule ( env, r ) ; }

Fix:
<S2SV_ModStart>, val ) ; if (! val ) continue
Buggy code:
 error_t coapClientSetRxBlockSize ( CoapClientRequest * request, uint_t blockSize ) { if ( request == NULL ) return ERROR_INVALID_PARAMETER ; osAcquireMutex ( & request -> context -> mutex ) ; if ( blockSize == 16 ) <START_BUG> request -> rxBlockSzx = COAP_BLOCK_SIZE_16 ; <END_BUG>  else if ( blockSize == 32 ) <START_BUG> <END_BUG> request -> rxBlockSzx = COAP_BLOCK_SIZE_32 ;  <START_BUG> else if ( blockSize == 64 ) <END_BUG>  request -> rxBlockSzx = COAP_BLOCK_SIZE_64 ; <START_BUG> <END_BUG> else if ( blockSize == 128 )  <START_BUG> request -> rxBlockSzx = COAP_BLOCK_SIZE_128 ; <END_BUG>  else if ( blockSize == 256 ) <START_BUG> <END_BUG> request -> rxBlockSzx = COAP_BLOCK_SIZE_256 ;  <START_BUG> else if ( blockSize == 512 ) <END_BUG>  request -> rxBlockSzx = COAP_BLOCK_SIZE_512 ; <START_BUG> <END_BUG> else  <START_BUG> request -> rxBlockSzx = COAP_BLOCK_SIZE_1024 ; <END_BUG> if ( request -> rxBlockSzx > coapClientGetMaxBlockSize ( ) )  request -> rxBlockSzx = coapClientGetMaxBlockSize ( ) ; <START_BUG> osReleaseMutex ( & request -> context -> mutex ) ; return NO_ERROR ; }<END_BUG>

Fix:
<S2SV_ModStart> == 16 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_16 ; } <S2SV_ModStart> == 32 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_32 ; } <S2SV_ModStart> == 64 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_64 ; } <S2SV_ModStart> == 128 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_128 ; } <S2SV_ModStart> == 256 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_256 ; } <S2SV_ModStart> == 512 ) { <S2SV_ModStart> = COAP_BLOCK_SIZE_512 ; } else { <S2SV_ModEnd> request -> rxBlockSzx <S2SV_ModStart> = COAP_BLOCK_SIZE_1024 ; } <S2SV_ModStart> ( ) ) { <S2SV_ModStart> ( ) ; }
Buggy code:
 <START_BUG> void vp9_setup_dst_planes ( MACROBLOCKD * xd, <END_BUG> const YV12_BUFFER_CONFIG * src, int mi_row, int mi_col ) {  uint8_t * const buffers [ 4 ] = { src -> y_buffer, src -> u_buffer, src -> v_buffer, <START_BUG> src -> alpha_buffer } ; <END_BUG> const int strides [ 4 ] = { src -> y_stride, src -> uv_stride, src -> uv_stride,  src -> alpha_stride } ; int i ; for ( i = 0 ; i < MAX_MB_PLANE ; ++ i ) { <START_BUG> struct macroblockd_plane * const pd = & xd -> plane [ i ] ; <END_BUG> setup_pred_plane ( & pd -> dst, buffers [ i ], strides [ i ], mi_row, mi_col, NULL, pd -> subsampling_x, pd -> subsampling_y ) ; } }

Fix:
<S2SV_ModStart> void vp9_setup_dst_planes ( struct macroblockd_plane planes [ MAX_MB_PLANE ] <S2SV_ModEnd>, const YV12_BUFFER_CONFIG <S2SV_ModStart> const buffers [ MAX_MB_PLANE <S2SV_ModEnd> ] = { <S2SV_ModStart> src -> v_buffer <S2SV_ModEnd> } ; const <S2SV_ModStart> int strides [ MAX_MB_PLANE <S2SV_ModEnd> ] = { <S2SV_ModStart> src -> uv_stride <S2SV_ModEnd> } ; int <S2SV_ModStart> pd = & planes <S2SV_ModEnd> [ i ]
Buggy code:
 static int sock_close ( struct inode * inode, struct file * filp ) { <START_BUG> sock_release ( SOCKET_I ( inode ) ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> filp ) { __sock_release <S2SV_ModEnd> ( SOCKET_I ( <S2SV_ModStart> ( inode ), inode
Buggy code:
 void vp8_rd_pick_inter_mode ( VP8_COMP * cpi, MACROBLOCK * x, int recon_yoffset, int recon_uvoffset, int * returnrate, <START_BUG> int * returndistortion, int * returnintra ) <END_BUG> { BLOCK * b = & x -> block [ 0 ] ; BLOCKD * d = & x -> e_mbd. block [ 0 ] ; MACROBLOCKD * xd = & x -> e_mbd ; int_mv best_ref_mv_sb [ 2 ] ; int_mv mode_mv_sb [ 2 ] [ MB_MODE_COUNT ] ; int_mv best_ref_mv ; int_mv * mode_mv ; MB_PREDICTION_MODE this_mode ; int num00 ; int best_mode_index = 0 ; BEST_MODE best_mode ; int i ; int mode_index ; int mdcounts [ 4 ] ; int rate ; RATE_DISTORTION rd ; int uv_intra_rate, uv_intra_distortion, uv_intra_rate_tokenonly ; int uv_intra_tteob = 0 ; int uv_intra_done = 0 ; MB_PREDICTION_MODE uv_intra_mode = 0 ; int_mv mvp ; int near_sadidx [ 8 ] = { 0, 1, 2, 3, 4, 5, 6, 7 } ; int saddone = 0 ; int sr = 0 ; unsigned char * plane [ 4 ] [ 3 ] ; int ref_frame_map [ 4 ] ; int sign_bias = 0 ; int intra_rd_penalty = 10 * vp8_dc_quant ( cpi -> common. base_qindex, cpi -> common. y1dc_delta_q ) ; # if CONFIG_TEMPORAL_DENOISING  unsigned int zero_mv_sse = INT_MAX, best_sse = INT_MAX, <START_BUG> <END_BUG> best_rd_sse = INT_MAX ;  # endif mode_mv = mode_mv_sb [ sign_bias ] ; best_ref_mv. as_int = 0 ; best_mode. rd = INT_MAX ; best_mode. yrd = INT_MAX ; best_mode. intra_rd = INT_MAX ; <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> int * returnintra, int mb_row, int mb_col <S2SV_ModStart> int zero_mv_sse = UINT_MAX <S2SV_ModEnd>, best_sse = <S2SV_ModStart>, best_sse = UINT_MAX <S2SV_ModEnd>, best_rd_sse = <S2SV_ModStart>, best_rd_sse = UINT_MAX <S2SV_ModEnd> ; # endif <S2SV_ModStart> = INT_MAX ; memset <S2SV_ModEnd> ( mode_mv_sb, <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( & best_mode <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( & best_mode <S2SV_ModStart> mv. as_int <S2SV_ModEnd> ; further_steps = <S2SV_ModStart> noise_sensitivity ) { int block_index = mb_row * cpi -> common. mb_cols + mb_col ; <S2SV_ModStart> recon_yoffset, recon_uvoffset, & cpi -> common. lf_info, mb_row, mb_col, block_index <S2SV_ModStart> skip ) { <S2SV_ModEnd> * returnrate = <S2SV_ModStart> return ; } memcpy <S2SV_ModEnd> ( & x <S2SV_ModStart>. as_int ; memcpy <S2SV_ModEnd> ( x ->
Buggy code:
 static int tcos_decipher ( sc_card_t * card, const u8 * crgram, size_t crgram_len, u8 * out, size_t outlen ) { sc_context_t * ctx ; sc_apdu_t apdu ; u8 rbuf [ SC_MAX_APDU_BUFFER_SIZE ] ; u8 sbuf [ SC_MAX_APDU_BUFFER_SIZE ] ; tcos_data * data ; int tcos3, r ; assert ( card!= NULL && crgram!= NULL && out!= NULL ) ; ctx = card -> ctx ; tcos3 = ( card -> type == SC_CARD_TYPE_TCOS_V3 ) ; data = ( tcos_data * ) card -> drv_data ; LOG_FUNC_CALLED ( ctx ) ; sc_log ( ctx, "TCOS3:%d   PKCS1:%d\\n", tcos3,!! ( data -> pad_flags & SC_ALGORITHM_RSA_PAD_PKCS1 ) ) ; sc_format_apdu ( card, & apdu, crgram_len > 255? SC_APDU_CASE_4_EXT : SC_APDU_CASE_4_SHORT, 0x2A, 0x80, 0x86 ) ; apdu. resp = rbuf ; apdu. resplen = sizeof ( rbuf ) ; apdu. le = crgram_len ; apdu. data = sbuf ; apdu. lc = apdu. datalen = crgram_len + 1 ; sbuf [ 0 ] = tcos3? 0x00 : ( ( data -> pad_flags & SC_ALGORITHM_RSA_PAD_PKCS1 )? 0x81 : 0x02 ) ; <START_BUG> memcpy ( sbuf + 1, crgram, crgram_len ) ; <END_BUG> r = sc_transmit_apdu ( card, & apdu ) ; LOG_TEST_RET ( card -> ctx, r, "APDU   transmit   failed" ) ; if ( apdu. sw1 == 0x90 && apdu. sw2 == 0x00 ) { size_t len = ( apdu. resplen > outlen )? outlen : apdu. resplen ; unsigned int offset = 0 ; if ( tcos3 && ( data -> pad_flags & SC_ALGORITHM_RSA_PAD_

Fix:
<S2SV_ModStart> 0x02 ) ; if ( sizeof sbuf - 1 < crgram_len ) return SC_ERROR_INVALID_ARGUMENTS ;
Buggy code:
 void vp8_de_noise ( VP8_COMMON * cm, YV12_BUFFER_CONFIG * source, YV12_BUFFER_CONFIG * post, int q, int low_var_thresh, <START_BUG> int flag ) <END_BUG> { double level = 6.0e-05 * q * q * q -.0067 * q * q +.306 * q +.0065 ; int ppl = ( int ) ( level +.5 ) ;  int mb_rows = source -> y_width >> 4 ; <START_BUG> <END_BUG> int mb_cols = source -> y_height >> 4 ;  unsigned char * limits = cm -> pp_limits_buffer ; ; <START_BUG> int mbr, mbc ; <END_BUG> ( void ) post ; ( void ) low_var_thresh ; ( void ) flag ;  vpx_memset ( limits, ( unsigned char ) ppl, 16 * mb_cols ) ; <START_BUG> for ( mbr = 0 ; mbr < mb_rows ; mbr ++ ) { vp8_post_proc_down_and_across_mb_row ( source -> y_buffer + 16 * mbr * source -> y_stride, source -> y_buffer + 16 * mbr * source -> y_stride, source -> y_stride, source -> y_stride, source -> y_width, limits, 16 ) ; <END_BUG> vp8_post_proc_down_and_across_mb_row (  source -> u_buffer + 8 * mbr * source -> uv_stride, source -> u_buffer + 8 * mbr * source -> uv_stride, source -> uv_stride, source -> uv_stride, source -> uv_width, limits, 8 ) ; vp8_post_proc_down_and_across_mb_row ( source -> v_buffer + 8 * mbr * source -> uv_stride, source -> v_buffer + 8 * mbr * source -> uv_stride, <START_BUG> source -> uv_stride, source -> uv_stride, source -> uv_width, limits, 8 ) ; <END_BUG> } }

Fix:
<S2SV_ModStart>, int flag, int uvfilter ) { int mbr ; <S2SV_ModEnd> double level = <S2SV_ModStart> int mb_rows = cm -> mb_rows <S2SV_ModEnd> ; int mb_cols <S2SV_ModStart> int mb_cols = cm -> mb_cols <S2SV_ModEnd> ; unsigned char <S2SV_ModStart> pp_limits_buffer ; ; <S2SV_ModEnd> ( void ) <S2SV_ModStart> ) flag ; memset <S2SV_ModEnd> ( limits, <S2SV_ModStart> 16 ) ; if ( uvfilter == 1 ) { <S2SV_ModStart>, limits, 8 ) ; } <S2SV_ModEnd> } } <S2SV_null>
Buggy code:
 static struct sk_buff * batadv_frag_merge_packets ( struct hlist_head * chain, struct sk_buff * skb ) { struct batadv_frag_packet * packet ; struct batadv_frag_list_entry * entry ; struct sk_buff * skb_out = NULL ; int size, hdr_size = sizeof ( struct batadv_frag_packet ) ; packet = ( struct batadv_frag_packet * ) skb -> data ; size = ntohs ( packet -> total_size ) ; if ( size > batadv_frag_size_limit ( ) ) goto free ; entry = hlist_entry ( chain -> first, struct batadv_frag_list_entry, list ) ; hlist_del ( & entry -> list ) ; skb_out = entry -> skb ; kfree ( entry ) ; <START_BUG> if ( pskb_expand_head ( skb_out, 0, size - skb -> len, GFP_ATOMIC ) < 0 ) { <END_BUG> kfree_skb ( skb_out ) ; skb_out = NULL ; goto free ; } skb_pull_rcsum ( skb_out, hdr_size ) ; memmove ( skb_out -> data - ETH_HLEN, skb_mac_header ( skb_out ), ETH_HLEN ) ; skb_set_mac_header ( skb_out, - ETH_HLEN ) ; skb_reset_network_header ( skb_out ) ; skb_reset_transport_header ( skb_out ) ; hlist_for_each_entry ( entry, chain, list ) { size = entry -> skb -> len - hdr_size ; memcpy ( skb_put ( skb_out, size ), entry -> skb -> data + hdr_size, size ) ; } free : batadv_frag_clear_chain ( chain ) ; return skb_out ; }

Fix:
<S2SV_ModStart>, size - skb_out <S2SV_ModEnd> -> len,
Buggy code:
 static struct stream_state * new_stream ( struct VpxEncoderConfig * global, struct stream_state * prev ) { struct stream_state * stream ; stream = calloc ( 1, sizeof ( * stream ) ) ; <START_BUG> if (! stream ) <END_BUG>  fatal ( "Failed   to   allocate   new   stream." ) ; <START_BUG> if ( prev ) { memcpy ( stream, prev, sizeof ( * stream ) ) ; stream -> index ++ ; prev -> next = stream ; } else { vpx_codec_err_t res ; <END_BUG> res = vpx_codec_enc_config_default ( global -> codec -> interface ( ),  & stream -> config. cfg, global -> usage ) ; if ( res ) fatal ( "Failed   to   get   config:   %s\\n", vpx_codec_err_to_string ( res ) ) ; stream -> config. cfg. g_timebase. den = 1000 ; stream -> config. cfg. g_w = 0 ; stream -> config. cfg. g_h = 0 ; <START_BUG> stream -> config. stereo_fmt = STEREO_FORMAT_MONO ; <END_BUG>  stream -> config. write_webm = 1 ; <START_BUG> # if CONFIG_WEBM_IO <END_BUG> stream -> ebml. last_pts_ms = - 1 ;  # endif stream -> ebml. debug = global -> debug ; if ( global -> deadline == VPX_DL_REALTIME ) stream -> config. cfg. g_lag_in_frames = 0 ; } stream -> config. out_fn = NULL ; stream -> next = NULL ; return stream ; }

Fix:
<S2SV_ModStart> ; if ( stream == NULL ) { <S2SV_ModEnd> fatal ( "Failed <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> new <S2SV_blank> stream." <S2SV_ModStart> "Failed <S2SV_blank> to <S2SV_blank> allocate <S2SV_blank> new <S2SV_blank> stream." ) ; } <S2SV_ModStart> -> codec -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart> -> config. write_webm = 1 ; # if CONFIG_WEBM_IO stream -> config. <S2SV_ModStart> ; stream -> ebml. last_pts_ns <S2SV_ModEnd> = - 1 <S2SV_ModStart> = - 1 ; stream -> ebml. writer = NULL ; stream -> ebml. segment = NULL
Buggy code:
 int ipmi_destroy_user ( struct ipmi_user * user ) { <START_BUG> _ipmi_destroy_user ( user ) ; <END_BUG> cleanup_srcu_struct ( & user -> release_barrier ) ; kref_put ( & user -> refcount, free_user ) ; return 0 ; }

Fix:
<S2SV_ModStart> _ipmi_destroy_user ( user <S2SV_ModEnd> ) ; kref_put
Buggy code:
 PyObject * ast2obj_mod ( void * _o ) { mod_ty o = ( mod_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } switch ( o -> kind ) { case Module_kind : result = PyType_GenericNew ( Module_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. Module. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. Module. type_ignores, ast2obj_type_ignore ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_ignores, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case Interactive_kind : result = PyType_GenericNew ( Interactive_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. Interactive. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case Expression_kind : result = PyType_GenericNew ( Expression_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_expr ( o -> v. Expression. body ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; case FunctionType_kind : result = PyType_GenericNew ( FunctionType_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_list ( o -> v. FunctionType. argtypes, ast2obj_expr ) ; if (! value ) goto failed ;

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } switch
Buggy code:
 static UINT rdpei_recv_pdu ( RDPEI_CHANNEL_CALLBACK * callback, wStream * s ) { UINT16 eventId ; UINT32 pduLength ; UINT error ; <START_BUG> Stream_Read_UINT16 ( s, eventId ) ; <END_BUG> Stream_Read_UINT32 ( s, pduLength ) ; # ifdef WITH_DEBUG_RDPEI WLog_DBG ( TAG, "rdpei_recv_pdu:   eventId:   %" PRIu16 "   (%s)   length:   %" PRIu32 "", eventId, rdpei_eventid_string ( eventId ), pduLength ) ; # endif switch ( eventId ) { case EVENTID_SC_READY : if ( ( error = rdpei_recv_sc_ready_pdu ( callback, s ) ) ) { WLog_ERR ( TAG, "rdpei_recv_sc_ready_pdu   failed   with   error   %" PRIu32 "!", error ) ; return error ; } if ( ( error = rdpei_send_cs_ready_pdu ( callback ) ) ) { WLog_ERR ( TAG, "rdpei_send_cs_ready_pdu   failed   with   error   %" PRIu32 "!", error ) ; return error ; } break ; case EVENTID_SUSPEND_TOUCH : if ( ( error = rdpei_recv_suspend_touch_pdu ( callback, s ) ) ) { WLog_ERR ( TAG, "rdpei_recv_suspend_touch_pdu   failed   with   error   %" PRIu32 "!", error ) ; return error ; } break ; case EVENTID_RESUME_TOUCH : if ( ( error = rdpei_recv_resume_touch_pdu ( callback, s ) ) ) { WLog_ERR ( TAG, "rdpei_recv_resume_touch_pdu   failed   with   error   %" PRIu32 "!", error ) ; return error ; } break ; default : break ; } return CHANNEL_RC_OK ; }

Fix:
<S2SV_ModStart> UINT error ; if ( Stream_GetRemainingLength ( s ) < 6 ) return ERROR_INVALID_DATA ;
Buggy code:
 int sdma_init ( struct hfi1_devdata * dd, u8 port ) { unsigned this_idx ; struct sdma_engine * sde ; struct rhashtable * tmp_sdma_rht ; u16 descq_cnt ; void * curr_head ; struct hfi1_pportdata * ppd = dd -> pport + port ; u32 per_sdma_credits ; uint idle_cnt = sdma_idle_cnt ; size_t num_engines = chip_sdma_engines ( dd ) ; int ret = - ENOMEM ; if (! HFI1_CAP_IS_KSET ( SDMA ) ) { HFI1_CAP_CLEAR ( SDMA_AHG ) ; return 0 ; } if ( mod_num_sdma && mod_num_sdma <= chip_sdma_engines ( dd ) && mod_num_sdma >= num_vls ) num_engines = mod_num_sdma ; dd_dev_info ( dd, "SDMA   mod_num_sdma:   %u\\n", mod_num_sdma ) ; dd_dev_info ( dd, "SDMA   chip_sdma_engines:   %u\\n", chip_sdma_engines ( dd ) ) ; dd_dev_info ( dd, "SDMA   chip_sdma_mem_size:   %u\\n", chip_sdma_mem_size ( dd ) ) ; per_sdma_credits = chip_sdma_mem_size ( dd ) // ( num_engines * SDMA_BLOCK_SIZE ) ; init_waitqueue_head ( & dd -> sdma_unfreeze_wq ) ; atomic_set ( & dd -> sdma_unfreeze_count, 0 ) ; descq_cnt = sdma_get_descq_cnt ( ) ; dd_dev_info ( dd, "SDMA   engines   %zu   descq_cnt   %u\\n", num_engines, descq_cnt ) ; dd -> per_sdma = kcalloc_node ( num_engines, sizeof ( * dd -> per_sdma ), GFP_KERNEL, dd -> node ) ;

Fix:
<S2SV_ModStart> < 0 ) { kfree ( tmp_sdma_rht ) ; <S2SV_ModStart> goto bail ; }
Buggy code:
 static int misaligned_load ( struct pt_regs * regs, __u32 opcode, int displacement_not_indexed, int width_shift, int do_sign_extend ) { int error ; int destreg ; __u64 address ; error = generate_and_check_address ( regs, opcode, displacement_not_indexed, width_shift, & address ) ; if ( error < 0 ) { return error ; } <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, regs, address ) ; <END_BUG> destreg = ( opcode >> 4 ) & 0x3f ; if ( user_mode ( regs ) ) { __u64 buffer ; if (! access_ok ( VERIFY_READ, ( unsigned long ) address, 1UL << width_shift ) ) { return - 1 ; } if ( __copy_user ( & buffer, ( const void * ) ( int ) address, ( 1 << width_shift ) ) > 0 ) { return - 1 ; } switch ( width_shift ) { case 1 : if ( do_sign_extend ) { regs -> regs [ destreg ] = ( __u64 ) ( __s64 ) * ( __s16 * ) & buffer ; } else { regs -> regs [ destreg ] = ( __u64 ) * ( __u16 * ) & buffer ; } break ; case 2 : regs -> regs [ destreg ] = ( __u64 ) ( __s64 ) * ( __s32 * ) & buffer ; break ; case 3 : regs -> regs [ destreg ] = buffer ; break ; default : printk ( "Unexpected   width_shift   %d   in   misaligned_load,   PC=%08lx\\n", width_shift, ( unsigned long ) regs -> pc ) ; break ; } } else { __u64 lo, hi ; switch ( width_shift ) { case 1 : misaligned_kernel_word_load ( address, do_sign_extend, & regs -> regs [ destreg ] ) ; break ; case 2 : asm ( "ldlo.l   %1,   0,   %0" : "=r" ( lo ) : "r" ( address ) ) ; asm ( "ldhi.l   %1,   3,   %0" : "=r" ( hi ) :

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 static int crypto_report_kpp ( struct sk_buff * skb, struct crypto_alg * alg ) { struct crypto_report_kpp rkpp ; <START_BUG> strlcpy ( rkpp. type, "kpp", sizeof ( rkpp. type ) ) ; <END_BUG> if ( nla_put ( skb, CRYPTOCFGA_REPORT_KPP, sizeof ( struct crypto_report_kpp ), & rkpp ) ) goto nla_put_failure ; return 0 ; nla_put_failure : return - EMSGSIZE ; }

Fix:
<S2SV_ModStart> crypto_report_kpp rkpp ; strncpy <S2SV_ModEnd> ( rkpp.
Buggy code:
 int yr_re_ast_create ( RE_AST * * re_ast ) { * re_ast = ( RE_AST * ) yr_malloc ( sizeof ( RE_AST ) ) ; if ( * re_ast == NULL ) return ERROR_INSUFFICIENT_MEMORY ; ( * re_ast ) -> flags = 0 ; <START_BUG> ( * re_ast ) -> root_node = NULL ; <END_BUG> return ERROR_SUCCESS ; }

Fix:
<S2SV_ModStart> re_ast ) -> levels = 0 ; ( * re_ast ) ->
Buggy code:
 static int db_dict_iter_lookup_key_values ( struct db_dict_value_iter * iter ) { struct db_dict_iter_key * key ; string_t * path ; const char * error ; int ret ; array_sort ( & iter -> keys, db_dict_iter_key_cmp ) ; path = t_str_new ( 128 ) ; str_append ( path, DICT_PATH_SHARED ) ; array_foreach_modifiable ( & iter -> keys, key ) { if (! key -> used ) continue ; str_truncate ( path, strlen ( DICT_PATH_SHARED ) ) ; <START_BUG> ret = var_expand ( path, key -> key -> key, iter -> var_expand_table, & error ) ; <END_BUG>  if ( ret <= 0 ) { <START_BUG> <END_BUG> auth_request_log_error ( iter -> auth_request, AUTH_SUBSYS_DB,  <START_BUG> "Failed   to   expand   key   %s:   %s", key -> key -> key, error ) ; <END_BUG> return - 1 ; }  ret = dict_lookup ( iter -> conn -> dict, iter -> pool, <START_BUG> str_c ( path ), & key -> value, & error ) ; if ( ret > 0 ) { auth_request_log_debug ( iter -> auth_request, AUTH_SUBSYS_DB, "Lookup:   %s   =   %s", str_c ( path ), key -> value ) ; } else if ( ret < 0 ) { auth_request_log_error ( iter -> auth_request, AUTH_SUBSYS_DB, "Failed   to   lookup   key   %s:   %s", str_c ( path ), error ) ; return - 1 ; } else if ( key -> key -> default_value!= NULL ) { auth_request_log_debug ( iter -> auth_request, AUTH_SUBSYS_DB, "Lookup:   %s   not   found,   using   default   value   %s", str_c ( path ), key -> key -> default_value ) ; key -> value = key -> key -> default_value ; } else { return 0 ; } } return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; str_append ( path, key -> key -> key ) ; ret = dict_lookup ( iter -> conn -> dict, iter -> pool, str_c ( path ), & key -> value <S2SV_ModEnd>, & error <S2SV_ModStart> if ( ret > <S2SV_ModEnd> 0 ) { <S2SV_ModStart> 0 ) { auth_request_log_debug ( iter -> auth_request, AUTH_SUBSYS_DB, "Lookup: <S2SV_blank> %s <S2SV_blank> = <S2SV_blank> %s", str_c ( path ), key -> value ) ; } else if ( ret < 0 ) { <S2SV_ModStart>, AUTH_SUBSYS_DB, "Failed <S2SV_blank> to <S2SV_blank> lookup <S2SV_blank> key <S2SV_blank> %s: <S2SV_blank> %s", str_c ( path ) <S2SV_ModEnd>, error ) <S2SV_ModStart> 1 ; } <S2SV_ModEnd> else if (
Buggy code:
 static struct inode * ext4_alloc_inode ( struct super_block * sb ) { struct ext4_inode_info * ei ; ei = kmem_cache_alloc ( ext4_inode_cachep, GFP_NOFS ) ; if (! ei ) return NULL ; ei -> vfs_inode. i_version = 1 ; ei -> vfs_inode. i_data. writeback_index = 0 ; memset ( & ei -> i_cached_extent, 0, sizeof ( struct ext4_ext_cache ) ) ; INIT_LIST_HEAD ( & ei -> i_prealloc_list ) ; spin_lock_init ( & ei -> i_prealloc_lock ) ; jbd2_journal_init_jbd_inode ( & ei -> jinode, & ei -> vfs_inode ) ; ei -> i_reserved_data_blocks = 0 ; ei -> i_reserved_meta_blocks = 0 ; ei -> i_allocated_meta_blocks = 0 ; ei -> i_da_metadata_calc_len = 0 ; ei -> i_delalloc_reserved_flag = 0 ; spin_lock_init ( & ( ei -> i_block_reservation_lock ) ) ; # ifdef CONFIG_QUOTA ei -> i_reserved_quota = 0 ; # endif INIT_LIST_HEAD ( & ei -> i_completed_io_list ) ; <START_BUG> ei -> cur_aio_dio = NULL ; <END_BUG> ei -> i_sync_tid = 0 ; ei -> i_datasync_tid = 0 ; return & ei -> vfs_inode ; }

Fix:
<S2SV_ModStart> i_completed_io_list ) ; spin_lock_init ( & ei -> i_completed_io_lock ) ;
Buggy code:
 static void build_masks ( const loop_filter_info_n * const lfi_n, const MODE_INFO * mi, const int shift_y, const int shift_uv, LOOP_FILTER_MASK * lfm ) { const MB_MODE_INFO * mbmi = & mi -> mbmi ; const BLOCK_SIZE block_size = mbmi -> sb_type ; const TX_SIZE tx_size_y = mbmi -> tx_size ; <START_BUG> const TX_SIZE tx_size_uv = get_uv_tx_size ( mbmi ) ; <END_BUG> const int filter_level = get_filter_level ( lfi_n, mbmi ) ; uint64_t * const left_y = & lfm -> left_y [ tx_size_y ] ; uint64_t * const above_y = & lfm -> above_y [ tx_size_y ] ; uint64_t * const int_4x4_y = & lfm -> int_4x4_y ; uint16_t * const left_uv = & lfm -> left_uv [ tx_size_uv ] ; uint16_t * const above_uv = & lfm -> above_uv [ tx_size_uv ] ; uint16_t * const int_4x4_uv = & lfm -> int_4x4_uv ; int i ; if (! filter_level ) { return ; } else { const int w = num_8x8_blocks_wide_lookup [ block_size ] ; const int h = num_8x8_blocks_high_lookup [ block_size ] ; int index = shift_y ; for ( i = 0 ; i < h ; i ++ ) {  vpx_memset ( & lfm -> lfl_y [ index ], filter_level, w ) ; <START_BUG> index += 8 ; } } * above_y |= above_prediction_mask [ block_size ] << shift_y ; * above_uv |= above_prediction_mask_uv [ block_size ] << shift_uv ; * left_y |= left_prediction_mask [ block_size ] << shift_y ; * left_uv |= left_prediction_mask_uv [ block_size ] << shift_uv ; if ( mbmi -> skip && is_inter_block ( mb<END_BUG>

Fix:
<S2SV_ModStart> TX_SIZE tx_size_uv = get_uv_tx_size_impl ( tx_size_y, block_size, 1, 1 <S2SV_ModEnd> ) ; const <S2SV_ModStart> ++ ) { memset <S2SV_ModEnd> ( & lfm <S2SV_ModStart> block_size ] & 0xffffffffffffffffULL <S2SV_ModEnd> ) << shift_y
Buggy code:
 xmlAttrPtr xsltAttrListTemplateProcess ( xsltTransformContextPtr ctxt, xmlNodePtr target, xmlAttrPtr attrs ) { xmlAttrPtr attr, copy, last ; xmlNodePtr oldInsert, text ; xmlNsPtr origNs = NULL, copyNs = NULL ; const xmlChar * value ; xmlChar * valueAVT ; if ( ( ctxt == NULL ) || ( target == NULL ) || ( attrs == NULL ) ) return ( NULL ) ; oldInsert = ctxt -> insert ; ctxt -> insert = target ; if ( target -> properties ) { last = target -> properties ; while ( last -> next!= NULL ) last = last -> next ; } else { last = NULL ; } attr = attrs ; do { # ifdef XSLT_REFACTORED if ( attr -> psvi == xsltXSLTAttrMarker ) { goto next_attribute ; } # else if ( ( attr -> ns!= NULL ) && xmlStrEqual ( attr -> ns -> href, XSLT_NAMESPACE ) ) { goto next_attribute ; } # endif if ( attr -> children!= NULL ) { if ( ( attr -> children -> type!= XML_TEXT_NODE ) || ( attr -> children -> next!= NULL ) ) { xsltTransformError ( ctxt, NULL, attr -> parent, "Internal   error:   The   children   of   an   attribute   node   of   a   " "literal   result   element   are   not   in   the   expected   form.\\n" ) ; goto error ; } value = attr -> children -> content ; if ( value == NULL ) value = xmlDictLookup ( ctxt -> dict, BAD_CAST "", 0 ) ; } else value = xmlDictLookup ( ctxt -> dict, BAD_CAST "", 0 ) ; copy = xmlNewDocProp ( target -> doc, attr -> name, NULL ) ; if ( copy == NULL ) { if ( attr -> ns ) { xsltTransformError ( ctxt, NULL, attr -> parent, "Internal   error:   Failed   to   create   attribute   \'{%s}%s\'.\\n", attr -> ns -> href, attr -> name ) ; } else { xsltTransformError ( ctxt, NULL, attr -> parent, "Internal   error:   Failed   to   create   attribute   \'%s\'.\\n", attr -> name ) ; } goto error ; } copy -> parent = target ; if ( last ==

Fix:
<S2SV_ModStart> -> dict ) && xmlDictOwns ( ctxt -> dict, value )
Buggy code:
 static void sas_scsi_clear_queue_lu ( struct list_head * error_q, struct scsi_cmnd * my_cmd ) { struct scsi_cmnd * cmd, * n ; list_for_each_entry_safe ( cmd, n, error_q, eh_entry ) { if ( cmd -> device -> sdev_target == my_cmd -> device -> sdev_target && cmd -> device -> lun == my_cmd -> device -> lun ) <START_BUG> sas_eh_defer_cmd ( cmd ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> -> lun ) sas_eh_finish_cmd <S2SV_ModEnd> ( cmd )
Buggy code:
 static asdl_seq * ast_for_comprehension ( struct compiling * c, const node * n ) { int i, n_fors ; asdl_seq * comps ; n_fors = count_comp_fors ( c, n ) ; if ( n_fors == - 1 ) return NULL ; comps = _Ta3_asdl_seq_new ( n_fors, c -> c_arena ) ; if (! comps ) return NULL ; for ( i = 0 ; i < n_fors ; i ++ ) { comprehension_ty comp ; asdl_seq * t ; expr_ty expression, first ; node * for_ch ; <START_BUG> int is_async = 0 ; <END_BUG> REQ ( n, comp_for ) ;  if ( TYPE ( CHILD ( n, 0 ) ) == ASYNC ) { <START_BUG> is_async = 1 ; <END_BUG> }  if ( is_async && c -> c_feature_version < 6 ) { ast_error ( c, n, "Async   comprehensions   are   only   supported   in   Python   3.6   and   greater" ) ; return NULL ; } <START_BUG> for_ch = CHILD ( n, 1 + is_async ) ; <END_BUG> t = ast_for_exprlist ( c, for_ch, Store ) ; if (! t ) return NULL ;  expression = ast_for_expr ( c, CHILD ( n, 3 + is_async ) ) ; <START_BUG> if (! expression ) return NULL ; first = ( expr_ty ) asdl_seq_GET ( t, 0 ) ; if ( NCH ( for_ch ) == 1 ) comp = comprehension ( first, expression, NULL, is_async, c -> c_arena ) ; else comp = comprehension ( Tuple ( t, Store, first -> lineno, first -> col_offset, c -> c_arena ), expression, NULL, is_async, c -> c_arena ) ; if (! comp ) return NULL ; <END_BUG> if ( NCH ( n ) == ( 5 + is_async ) ) {  int j, n_ifs ; asdl_seq * ifs ; <START_BUG> n = CHILD ( n, 4 + is_async ) ; <END_BUG> n_ifs = count_comp_ifs ( c

Fix:
<S2SV_ModStart> * for_ch ; node * sync_n ; <S2SV_ModStart> ; if ( NCH ( n ) == 2 <S2SV_ModEnd> ) { is_async <S2SV_ModStart> = 1 ; REQ ( CHILD ( n, 0 ), NAME ) ; assert ( strcmp ( STR ( CHILD ( n, 0 ) ), "async" ) == 0 ) ; sync_n = CHILD ( n, 1 ) ; } else { sync_n = CHILD ( n, 0 ) ; } REQ ( sync_n, sync_comp_for ) ; <S2SV_ModEnd> if ( is_async <S2SV_ModStart> = CHILD ( sync_n, 1 <S2SV_ModEnd> ) ; t <S2SV_ModStart>, CHILD ( sync_n, 3 <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( NCH ( sync_n ) == 5 <S2SV_ModEnd> ) { int <S2SV_ModStart> = CHILD ( sync_n, 4 <S2SV_ModEnd> ) ; n_ifs
Buggy code:
 static authz_status lua_authz_check ( request_rec * r, const char * require_line, const void * parsed_require_line ) { apr_pool_t * pool ; ap_lua_vm_spec * spec ; lua_State * L ; ap_lua_server_cfg * server_cfg = ap_get_module_config ( r -> server -> module_config, & lua_module ) ; const ap_lua_dir_cfg * cfg = ap_get_module_config ( r -> per_dir_config, & lua_module ) ; <START_BUG> const lua_authz_provider_spec * prov_spec = parsed_require_line ; <END_BUG> int result ; int nargs = 0 ; spec = create_vm_spec ( & pool, r, cfg, server_cfg, prov_spec -> file_name, NULL, 0, prov_spec -> function_name, "authz   provider" ) ; L = ap_lua_get_lua_state ( pool, spec, r ) ; if ( L == NULL ) { ap_log_rerror ( APLOG_MARK, APLOG_ERR, 0, r, APLOGNO ( 02314 ) "Unable   to   compile   VM   for   authz   provider   %s", prov_spec -> name ) ; return AUTHZ_GENERAL_ERROR ; } lua_getglobal ( L, prov_spec -> function_name ) ; if (! lua_isfunction ( L, - 1 ) ) { ap_log_rerror ( APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO ( 02319 ) "Unable   to   find   entry   function   \'%s\'   in   %s   (not   a   valid   function)", prov_spec -> function_name, prov_spec -> file_name ) ; ap_lua_release_state ( L, spec, r ) ; return AUTHZ_GENERAL_ERROR ; } ap_lua_run_lua_request ( L, r ) ;  if ( prov_spec -> args ) { <START_BUG> int i ; <END_BUG> if (! lua_checkstack ( L, prov_spec -> args -> nelts ) ) {  ap_log_rerror ( APLOG_MARK, APLOG_ERR

Fix:
<S2SV_ModStart> ) ; const lua_authz_provider_func * prov_func = parsed_require_line ; const <S2SV_ModStart> * prov_spec = prov_func -> spec <S2SV_ModEnd> ; int result <S2SV_ModStart> ; if ( prov_func <S2SV_ModEnd> -> args ) <S2SV_ModStart> ( L, prov_func <S2SV_ModEnd> -> args -> <S2SV_ModStart> ; i < prov_func <S2SV_ModEnd> -> args -> <S2SV_ModStart> = APR_ARRAY_IDX ( prov_func <S2SV_ModEnd> -> args, <S2SV_ModStart> } nargs = prov_func <S2SV_ModEnd> -> args ->
Buggy code:
 GF_Err SetupWriters ( MovieWriter * mw, GF_List * writers, u8 interleaving ) { u32 i, trackCount ; TrackWriter * writer ; GF_TrackBox * trak ; GF_ISOFile * movie = mw -> movie ; mw -> total_samples = mw -> nb_done = 0 ; if (! movie -> moov ) return GF_OK ; trackCount = gf_list_count ( movie -> moov -> trackList ) ; for ( i = 0 ; i < trackCount ; i ++ ) { <START_BUG> trak = gf_isom_get_track ( movie -> moov, i + 1 ) ; <END_BUG>  GF_SAFEALLOC ( writer, TrackWriter ) ; <START_BUG> if (! writer ) goto exit ; writer -> sampleNumber = 1 ; writer -> mdia = trak -> Media ; writer -> stbl = trak -> Media -> information -> sampleTable ; writer -> timeScale = trak -> Media -> mediaHeader -> timeScale ; writer -> all_dref_mode = Media_SelfContainedType ( writer -> mdia ) ; if ( trak -> sample_encryption ) writer -> prevent_dispatch = GF_TRUE ; writer -> isDone = 0 ; writer -> DTSprev = 0 ; writer -> chunkDur = 0 ; writer -> chunkSize = 0 ; writer -> constant_size = writer -> constant_dur = 0 ; if ( writer -> stbl -> SampleSize -> sampleSize ) writer -> constant_size = writer -> stbl -> SampleSize -> sampleSize ; if ( writer -> stbl -> TimeToSample -> nb_entries == 1 ) { writer -> constant_dur = writer -> stbl -> TimeToSample -> entries [ 0 ]. sampleDelta ; if ( writer -> constant_dur > 1 ) writer -> constant_dur = 0 ; } if (! writer -> constant_dur ||! writer -> constant_size || ( writer -> constant_size >= 10 ) ) writer -> constant_size = writer -> constant_dur = 0 ; writer -> stsc = ( GF_SampleToChunkBox * ) gf_isom_box_new ( GF_ISOM_BOX_TYPE_STSC ) ; if (! writer -> stsc ) return GF_OUT_OF_MEM ; if ( writer -> stbl -> ChunkOffset -> type == GF_ISOM_BOX_<END_BUG>

Fix:
<S2SV_ModStart> ++ ) { GF_SampleTableBox * stbl ; <S2SV_ModStart> 1 ) ; stbl = ( trak -> Media && trak -> Media -> information )? trak -> Media -> information -> sampleTable : NULL ; if (! stbl ||! stbl -> SampleSize ||! stbl -> ChunkOffset ||! stbl -> SampleToChunk ) { return GF_ISOM_INVALID_FILE ; }
Buggy code:
 static ssize_t map_write ( struct file * file, const char __user * buf, size_t count, loff_t * ppos, int cap_setid, struct uid_gid_map * map, struct uid_gid_map * parent_map ) { struct seq_file * seq = file -> private_data ; struct user_namespace * ns = seq -> private ; struct uid_gid_map new_map ; unsigned idx ; struct uid_gid_extent extent ; char * kbuf = NULL, * pos, * next_line ; ssize_t ret ; if ( ( * ppos!= 0 ) || ( count >= PAGE_SIZE ) ) return - EINVAL ; kbuf = memdup_user_nul ( buf, count ) ; if ( IS_ERR ( kbuf ) ) return PTR_ERR ( kbuf ) ; mutex_lock ( & userns_state_mutex ) ; memset ( & new_map, 0, sizeof ( struct uid_gid_map ) ) ; ret = - EPERM ; if ( map -> nr_extents!= 0 ) goto out ; if ( cap_valid ( cap_setid ) &&! file_ns_capable ( file, ns, CAP_SYS_ADMIN ) ) goto out ; ret = - EINVAL ; pos = kbuf ; for ( ; pos ; pos = next_line ) { next_line = strchr ( pos, '\\n' ) ; if ( next_line ) { * next_line = '\\0' ; next_line ++ ; if ( * next_line == '\\0' ) next_line = NULL ; } pos = skip_spaces ( pos ) ; extent. first = simple_strtoul ( pos, & pos, 10 ) ; if (! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; extent. lower_first = simple_strtoul ( pos, & pos, 10 ) ; if (! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; extent. count = simple_strtoul ( pos, & pos, 10 ) ; if ( * pos &&! isspace ( * pos ) ) goto out ; pos = skip_spaces ( pos ) ; if ( * pos!= '\\0' ) goto out ; if ( ( extent. first ==

Fix:
<S2SV_ModStart> & new_map ) <S2SV_ModEnd> ) goto out <S2SV_ModStart> lower_first ; } ret = sort_idmaps ( & new_map ) ; if ( ret < 0 ) goto out ;
Buggy code:
 INST_HANDLER ( cpse ) { int r = ( buf [ 0 ] & 0xf ) | ( ( buf [ 1 ] & 0x2 ) << 3 ) ; int d = ( ( buf [ 0 ] >> 4 ) & 0xf ) | ( ( buf [ 1 ] & 0x1 ) << 4 ) ; <START_BUG> RAnalOp next_op ; <END_BUG> avr_op_analyze ( anal, & next_op, op -> addr + op -> size, buf + op -> size, len - op -> size, cpu ) ; r_strbuf_fini ( & next_op. esil ) ; op -> jump = op -> addr + next_op. size + 2 ; op -> cycles = 1 ; ESIL_A ( "r%d,r%d,^,!,", r, d ) ; ESIL_A ( "?{,%" PFMT64d ",pc,=,},", op -> jump ) ; }

Fix:
<S2SV_ModStart> ; RAnalOp next_op = { 0 }
Buggy code:
 static void test_headers_bad ( Test * test, gconstpointer data ) { GHashTable * headers ; headers = web_socket_util_new_headers ( ) ; g_hash_table_insert ( headers, g_strdup ( "Cookie" ), g_strdup ( "CockpitAuth=v=1;k=blah" ) ) ; if ( cockpit_auth_check_cookie ( test -> auth, "//cockpit", headers ) ) g_assert_not_reached ( ) ; g_hash_table_remove_all ( headers ) ; g_hash_table_insert ( headers, g_strdup ( "Cookie" ), g_strdup ( "CockpitAuth=v=2;k=blah" ) ) ; if ( cockpit_auth_check_cookie ( test -> auth, "//cockpit", headers ) ) g_assert_not_reached ( ) ; <START_BUG> g_hash_table_destroy ( headers ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ( ) ; g_hash_table_remove_all ( headers ) ; g_hash_table_insert ( headers, g_strdup ( "Cookie" ), g_strdup ( "cockpit=d" ) ) ; if ( cockpit_auth_check_cookie ( test -> auth, "//cockpit", headers ) ) g_assert_not_reached ( ) ;
Buggy code:
 static void tw5864_handle_frame ( struct tw5864_h264_frame * frame ) { # define SKIP_VLCBUF_BYTES 3 struct tw5864_input * input = frame -> input ; struct tw5864_dev * dev = input -> root ; struct tw5864_buf * vb ; struct vb2_v4l2_buffer * v4l2_buf ; int frame_len = frame -> vlc_len - SKIP_VLCBUF_BYTES ; u8 * dst = input -> buf_cur_ptr ; u8 tail_mask, vlc_mask = 0 ; int i ; u8 vlc_first_byte = ( ( u8 * ) ( frame -> vlc. addr + SKIP_VLCBUF_BYTES ) ) [ 0 ] ; unsigned long flags ; int zero_run ; u8 * src ; u8 * src_end ; # ifdef DEBUG if ( frame -> checksum!= tw5864_vlc_checksum ( ( u32 * ) frame -> vlc. addr, frame_len ) ) dev_err ( & dev -> pci -> dev, "Checksum   of   encoded   frame   doesn\'t   match!\\n" ) ; # endif spin_lock_irqsave ( & input -> slock, flags ) ; vb = input -> vb ; input -> vb = NULL ; spin_unlock_irqrestore ( & input -> slock, flags ) ; <START_BUG> v4l2_buf = to_vb2_v4l2_buffer ( & vb -> vb. vb2_buf ) ; <END_BUG>  if (! vb ) { <START_BUG> dev_dbg ( & dev -> pci -> dev, "vb   is   empty,   dropping   frame\\n" ) ; return ; } if ( input -> buf_cur_space_left < frame_len * 5 // 4 ) { dev_err_once ( & dev -> pci -> dev, "Left   space   in   vb2   buffer,   %d   bytes,   is   less   than   considered   safely   enough   to   put   frame   of   length   %d.   Dropping   this   frame.\\n", input -> buf_cur_space_left, frame_len ) ; return ; } for ( i =<END_BUG>

Fix:
<S2SV_ModStart> flags ) ; if (! vb ) { dev_dbg ( & dev -> pci -> dev, "vb <S2SV_blank> is <S2SV_blank> empty, <S2SV_blank> dropping <S2SV_blank> frame\\n" ) ; return ; } <S2SV_ModStart> vb2_buf ) ; <S2SV_ModEnd> if ( input
Buggy code:
 NOEXPORT char * pgsql_server ( CLI * c, SERVICE_OPTIONS * opt, const PHASE phase ) { uint8_t buffer [ 8 ], ssl_ok [ 1 ] = { 'S' } ; <START_BUG> ( void ) opt ; <END_BUG> if ( phase!= PROTOCOL_EARLY )  return NULL ; <START_BUG> memset ( buffer, 0, sizeof buffer ) ; s_read ( c, c -> local_rfd. fd, buffer, sizeof buffer ) ; <END_BUG> if ( safe_memcmp ( buffer, ssl_request, sizeof ssl_request ) ) {  <START_BUG> s_log ( LOG_ERR, "PostgreSQL   client   did   not   request   TLS,   rejecting" ) ; <END_BUG> throw_exception ( c, 1 ) ; }  s_write ( c, c -> local_wfd. fd, ssl_ok, sizeof ssl_ok ) ; <START_BUG> return NULL ; }<END_BUG>

Fix:
<S2SV_ModStart> 'S' } ; static const uint8_t gss_request [ 8 ] = { 0, 0, 0, 8, 0x04, 0xd2, 0x16, 0x30 } ; static const uint8_t gss_response [ 62 ] = { 'E', 0, 0, 0, 61, 'S', 'E', 'R', 'R', 'O', 'R', 0, 'C', 'X', 'X', '0', '0', '0', 0, 'M', 'S', 'S', 'L','<S2SV_blank> ', 'e', 'x', 'p', 'e', 'c', 't', 'e', 'd','<S2SV_blank> ', 'b', 'u', 't','<S2SV_blank> ', 'n', 'o', 't','<S2SV_blank> ', 'r', 'e', 'q', 'u', 'e','s', 't', 'e', 'd','<S2SV_blank> ', '
Buggy code:
 static void t1_check_unusual_charstring ( void ) { char * p = strstr ( t1_line_array, charstringname ) + strlen ( charstringname ) ; int i ; if ( sscanf ( p, "%i", & i )!= 1 ) { strcpy ( t1_buf_array, t1_line_array ) ; t1_getline ( ) ; <START_BUG> strcat ( t1_buf_array, t1_line_array ) ; <END_BUG> strcpy ( t1_line_array, t1_buf_array ) ; t1_line_ptr = eol ( t1_line_array ) ; } }

Fix:
<S2SV_ModStart> ( ) ; alloc_array ( t1_buf, strlen ( t1_line_array ) + strlen ( t1_buf_array ) + 1, T1_BUF_SIZE ) ; <S2SV_ModStart> t1_buf_array, t1_line_array ) ; alloc_array ( t1_line, strlen ( t1_buf_array ) + 1, T1_BUF_SIZE