nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int DecodeGifImg ( struct ngiflib_img * i ) { struct ngiflib_decode_context context ; long npix ; u8 * stackp ; u8 * stack_top ; u16 clr ; u16 eof ; u16 free ; u16 act_code = 0 ; u16 old_code = 0 ; u16 read_byt ; u16 ab_prfx [ 4096 ] ; u8 ab_suffx [ 4096 ] ; u8 ab_stack [ 4096 ] ; u8 flags ; u8 casspecial = 0 ; if (! i ) return - 1 ; i -> posX = GetWord ( i -> parent ) ; i -> posY = GetWord ( i -> parent ) ; i -> width = GetWord ( i -> parent ) ; i -> height = GetWord ( i -> parent ) ; if ( ( i -> width > i -> parent -> width ) || ( i -> height > i -> parent -> height ) ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "***   ERROR   ***   Image   bigger   than   global   GIF   canvas  !\\n" ) ; # endif return - 1 ; } if ( ( i -> posX + i -> width ) > i -> parent -> width ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "***   WARNING   ***   Adjusting   X   position\\n" ) ; # endif i -> posX = i -> parent -> width - i -> width ; } if ( ( i -> posY + i -> height ) > i -> parent -> height ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "***   WARNING   ***   Adjusting   Y   position\\n" ) ; # endif i -> posY = i -> parent -> height - i -> height ; } context. Xtogo = i -> width ; context. curY = i -> posY ; # ifdef NGIFLIB_INDEXED_ONLY # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p8 = i -> parent ->

Fix:
<S2SV_ModStart> = act_code ; if ( npix > 0 ) <S2SV_ModStart> = casspecial ; if ( npix >= ( <S2SV_ModEnd> stack_top - stackp <S2SV_ModStart> - stackp ) ) { WritePixels ( i, & context, stackp, stack_top - stackp ) ; } else if ( npix > 0 ) { WritePixels ( i, & context, stackp, npix ) ; } <S2SV_ModEnd> npix -= (
Buggy code:
 int ath9k_wmi_cmd ( struct wmi * wmi, enum wmi_cmd_id cmd_id, u8 * cmd_buf, u32 cmd_len, u8 * rsp_buf, u32 rsp_len, u32 timeout ) { struct ath_hw * ah = wmi -> drv_priv -> ah ; struct ath_common * common = ath9k_hw_common ( ah ) ; u16 headroom = sizeof ( struct htc_frame_hdr ) + sizeof ( struct wmi_cmd_hdr ) ; struct sk_buff * skb ; unsigned long time_left ; int ret = 0 ; if ( ah -> ah_flags & AH_UNPLUGGED ) return 0 ; skb = alloc_skb ( headroom + cmd_len, GFP_ATOMIC ) ; if (! skb ) return - ENOMEM ; skb_reserve ( skb, headroom ) ; if ( cmd_len!= 0 && cmd_buf!= NULL ) { skb_put_data ( skb, cmd_buf, cmd_len ) ; } mutex_lock ( & wmi -> op_mutex ) ; if ( unlikely ( wmi -> stopped ) ) { ret = - EPROTO ; goto out ; } wmi -> cmd_rsp_buf = rsp_buf ; wmi -> cmd_rsp_len = rsp_len ; ret = ath9k_wmi_cmd_issue ( wmi, skb, cmd_id, cmd_len ) ; if ( ret ) goto out ; time_left = wait_for_completion_timeout ( & wmi -> cmd_wait, timeout ) ; if (! time_left ) { ath_dbg ( common, WMI, "Timeout   waiting   for   WMI   command:   %s\\n", wmi_cmd_to_name ( cmd_id ) ) ; mutex_unlock ( & wmi -> op_mutex ) ; <START_BUG> return - ETIMEDOUT ; <END_BUG> } mutex_unlock ( & wmi -> op_mutex ) ; return 0 ; out : ath_dbg ( common, WMI, "WMI   failure   for:   %s\\n", wmi_cmd_to_name ( cmd_id ) ) ; mutex_

Fix:
<S2SV_ModStart> op_mutex ) ; kfree_skb ( skb ) ;
Buggy code:
 <START_BUG> static void cost ( int * costs, vp9_tree tree, const vp9_prob * probs, <END_BUG> int i, int c ) {  const vp9_prob prob = probs [ i // 2 ] ; <START_BUG> int b ; for ( b = 0 ; b <= 1 ; ++ b ) { const int cc = c + vp9_cost_bit ( prob, b ) ; <END_BUG> const vp9_tree_index ii = tree [ i + b ] ;  if ( ii <= 0 ) costs [ - ii ] = cc ; else cost ( costs, tree, probs, ii, cc ) ; } }

Fix:
<S2SV_ModStart> * costs, vpx_tree <S2SV_ModEnd> tree, const <S2SV_ModStart> tree, const vpx_prob <S2SV_ModEnd> * probs, <S2SV_ModStart> ) { const vpx_prob <S2SV_ModEnd> prob = probs <S2SV_ModStart> ) ; const vpx_tree_index <S2SV_ModEnd> ii = tree
Buggy code:
 u32 h264bsdInitDpb ( dpbStorage_t * dpb, u32 picSizeInMbs, u32 dpbSize, u32 maxRefFrames, u32 maxFrameNum, u32 noReordering ) { u32 i ; ASSERT ( picSizeInMbs ) ; ASSERT ( maxRefFrames <= MAX_NUM_REF_PICS ) ; ASSERT ( maxRefFrames <= dpbSize ) ; ASSERT ( maxFrameNum ) ; <START_BUG> ASSERT ( dpbSize ) ; <END_BUG> dpb -> maxLongTermFrameIdx = NO_LONG_TERM_FRAME_INDICES ; dpb -> maxRefFrames = MAX ( maxRefFrames, 1 ) ; if ( noReordering ) dpb -> dpbSize = dpb -> maxRefFrames ; else dpb -> dpbSize = dpbSize ; dpb -> maxFrameNum = maxFrameNum ; dpb -> noReordering = noReordering ; dpb -> fullness = 0 ; dpb -> numRefFrames = 0 ; dpb -> prevRefFrameNum = 0 ; ALLOCATE ( dpb -> buffer, MAX_NUM_REF_IDX_L0_ACTIVE + 1, dpbPicture_t ) ; if ( dpb -> buffer == NULL ) return ( MEMORY_ALLOCATION_ERROR ) ; H264SwDecMemset ( dpb -> buffer, 0, ( MAX_NUM_REF_IDX_L0_ACTIVE + 1 ) * sizeof ( dpbPicture_t ) ) ; for ( i = 0 ; i < dpb -> dpbSize + 1 ; i ++ ) { ALLOCATE ( dpb -> buffer [ i ]. pAllocatedData, ( picSizeInMbs * 384 + 32 + 15 ), u8 ) ; if ( dpb -> buffer [ i ]. pAllocatedData == NULL ) return ( MEMORY_ALLOCATION_ERROR ) ; dpb -> buffer [ i ]. data = ALIGN ( dpb -> buffer [ i ]. pAllocatedData, 16 ) ; } ALLOCATE ( dpb -> list, MAX_NUM_REF_IDX_L0_ACTIVE + 1, dpbPicture_t * ) ; ALLOCATE ( dpb -> outBuf, dpb -> dpbSize + 1, dpbOutPicture_t ) ; if ( dpb -> list == NULL || dpb -> out

Fix:
<S2SV_ModStart> dpbSize ) ; if ( picSizeInMbs > ( UINT32_MAX - 32 - 15 ) // 384 ) { ALOGE ( "b//28533562" ) ; android_errorWriteLog ( 0x534e4554, "28533562" ) ; return ( MEMORY_ALLOCATION_ERROR ) ; }
Buggy code:
 static void __xml_acl_post_process ( xmlNode * xml ) { xmlNode * cIter = __xml_first_child ( xml ) ; xml_private_t * p = xml -> _private ; if ( is_set ( p -> flags, xpf_created ) ) { xmlAttr * xIter = NULL ; <START_BUG> for ( xIter = crm_first_attr ( xml ) ; xIter!= NULL ; xIter = xIter -> next ) { <END_BUG> const char * prop_name = ( const char * ) xIter -> name ;  if ( strcmp ( prop_name, XML_ATTR_ID ) == 0 ) { <START_BUG> continue ; } else if ( __xml_acl_check ( xml, NULL, xpf_acl_write ) ) { crm_trace ( "Creation   of   %s=%s   is   allowed", crm_element_name ( xml ), ID ( xml ) ) ; break ; } else { <END_BUG> char * path = xml_get_path ( xml ) ;  crm_trace ( "Cannot   add   new   node   %s   at   %s", crm_element_name ( xml ), path ) ; if ( xml!= xmlDocGetRootElement ( xml -> doc ) ) { xmlUnlinkNode ( xml ) ; xmlFreeNode ( xml ) ; } free ( path ) ; return ; } } <START_BUG> } <END_BUG> while ( cIter!= NULL ) { xmlNode * child = cIter ; cIter = __xml_next ( cIter ) ; __xml_acl_post_process ( child ) ; } }

Fix:
<S2SV_ModStart> = NULL ; char * path = xml_get_path ( xml ) ; <S2SV_ModStart> ) == 0 && strstr ( path, "//" XML_CIB_TAG_ACLS "//" ) == NULL <S2SV_ModStart> } else { <S2SV_ModEnd> crm_trace ( "Cannot <S2SV_blank> add <S2SV_blank> new <S2SV_blank> node <S2SV_blank> %s <S2SV_blank> at <S2SV_blank> %s" <S2SV_ModStart> ; } } free ( path ) ;
Buggy code:
 AV * dbd_st_fetch ( SV * sth, imp_sth_t * imp_sth ) { dTHX ; int num_fields, ChopBlanks, i, rc ; unsigned long * lengths ; AV * av ; int av_length, av_readonly ; MYSQL_ROW cols ; D_imp_dbh_from_sth ; MYSQL * svsock = imp_dbh -> pmysql ; imp_sth_fbh_t * fbh ; D_imp_xxh ( sth ) ; # if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION MYSQL_BIND * buffer ; # endif MYSQL_FIELD * fields ; if ( DBIc_TRACE_LEVEL ( imp_xxh ) >= 2 ) PerlIO_printf ( DBIc_LOGPIO ( imp_xxh ), "\\t->   dbd_st_fetch\\n" ) ; # if MYSQL_ASYNC if ( imp_dbh -> async_query_in_flight ) { if ( mysql_db_async_result ( sth, & imp_sth -> result ) <= 0 ) { return Nullav ; } } # endif # if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION if ( imp_sth -> use_server_side_prepare ) { if (! DBIc_ACTIVE ( imp_sth ) ) { do_error ( sth, JW_ERR_SEQUENCE, "no   statement   executing\\n", NULL ) ; return Nullav ; } if ( imp_sth -> fetch_done ) { do_error ( sth, JW_ERR_SEQUENCE, "fetch()   but   fetch   already   done", NULL ) ; return Nullav ; } if (! imp_sth -> done_desc ) { if (! dbd_describe ( sth, imp_sth ) ) { do_error ( sth, JW_ERR_SEQUENCE, "Error   while   describe   result   set.", NULL ) ; return Nullav ; } } } # endif ChopBlanks = DBIc_is ( imp_sth, DBIcf_ChopBlanks ) ; if ( DBIc_TRACE_LEVEL ( imp_xxh ) >= 2 ) PerlIO_printf ( DBIc_LOGPIO ( imp_xxh ), "\\t\\tdbd_st_fetch   for  

Fix:
<S2SV_ModStart> ; buffer -> buffer = ( char * ) fbh -> data ; imp_sth -> stmt -> bind [ i ]. buffer_length = fbh -> length ; imp_sth -> stmt -> bind [ i ].
Buggy code:
 int res_unpack ( vorbis_info_residue * info, vorbis_info * vi, oggpack_buffer * opb ) { int j, k ; codec_setup_info * ci = ( codec_setup_info * ) vi -> codec_setup ; memset ( info, 0, sizeof ( * info ) ) ; info -> type = oggpack_read ( opb, 16 ) ; if ( info -> type > 2 || info -> type < 0 ) goto errout ; info -> begin = oggpack_read ( opb, 24 ) ; info -> end = oggpack_read ( opb, 24 ) ; info -> grouping = oggpack_read ( opb, 24 ) + 1 ; info -> partitions = ( char ) ( oggpack_read ( opb, 6 ) + 1 ) ; info -> groupbook = ( unsigned char ) oggpack_read ( opb, 8 ) ; if ( info -> groupbook >= ci -> books ) goto errout ; info -> stagemasks = _ogg_malloc ( info -> partitions * sizeof ( * info -> stagemasks ) ) ; info -> stagebooks = _ogg_malloc ( info -> partitions * 8 * sizeof ( * info -> stagebooks ) ) ; for ( j = 0 ; j < info -> partitions ; j ++ ) { int cascade = oggpack_read ( opb, 3 ) ; if ( oggpack_read ( opb, 1 ) ) cascade |= ( oggpack_read ( opb, 5 ) << 3 ) ; info -> stagemasks [ j ] = cascade ; } for ( j = 0 ; j < info -> partitions ; j ++ ) { for ( k = 0 ; k < 8 ; k ++ ) { if ( ( info -> stagemasks [ j ] >> k ) & 1 ) { unsigned char book = ( unsigned char ) oggpack_read ( opb, 8 ) ; if ( book >= ci -> books ) goto errout ; info -> stagebooks [ j * 8 + k ] = book ; if ( k + 1 > info -> stages ) info -> stages = k + 1 ; } else info -> stagebooks [ j * 8 + k ] = 0xff ; } } if ( oggpack_eop ( opb ) ) goto errout ; <START_BUG> return<END_BUG>

Fix:
<S2SV_ModStart> goto errout ; int limit = ( info -> type == 2? vi -> channels : 1 ) * ci -> blocksizes [ 1 ] // 2 ; if ( info -> begin > info -> end || info -> end > limit ) { goto errout ; }
Buggy code:
 static void user_login ( struct mt_connection * curconn, struct mt_mactelnet_hdr * pkthdr ) { struct mt_packet pdata ; unsigned char md5sum [ 17 ] ; char md5data [ 100 ] ; struct mt_credentials * user ; char * slavename ; <START_BUG> read_userfile ( ) ; <END_BUG> if ( ( user = find_user ( curconn -> username ) )!= NULL ) { md5_state_t state ; # if defined ( __linux__ ) && defined ( _POSIX_MEMLOCK_RANGE ) mlock ( md5data, sizeof ( md5data ) ) ; mlock ( md5sum, sizeof ( md5sum ) ) ; if ( user -> password!= NULL ) { mlock ( user -> password, strlen ( user -> password ) ) ; } # endif  md5data [ 0 ] = 0 ; <START_BUG> <END_BUG> strncpy ( md5data + 1, user -> password, 82 ) ;  <START_BUG> memcpy ( md5data + 1 + strlen ( user -> password ), curconn -> pass_salt, 16 ) ; <END_BUG> md5_init ( & state ) ;  md5_append ( & state, ( const md5_byte_t * ) md5data, strlen ( user -> password ) + 17 ) ; <START_BUG> md5_finish ( & state, ( md5_byte_t * ) md5sum + 1 ) ; md5sum [ 0 ] = 0 ; init_packet ( & pdata, MT_PTYPE_DATA, pkthdr -> dstaddr, pkthdr -> srcaddr, pkthdr -> seskey, curconn -> outcounter ) ; curconn -> outcounter += add_control_packet ( & pdata, MT_CPTYPE_END_AUTH, NULL, 0 ) ; send_udp ( curconn, & pdata ) ; if ( curconn -> state == STATE_ACTIVE ) { return ; } } if ( user == NULL || memcmp ( md5sum, curconn -> trypassword, 17 )!= 0 ) { syslog ( LOG_NOTICE, _ ( "(%d)   Invalid   login   by   %s." ), curconn -> seskey, curconn -> username ) ; abort_connection ( curconn, pkthdr, _ ( "Login   failed,   incorrect   username   or   password\\r\\n<END_BUG>

Fix:
<S2SV_ModStart> * slavename ; int act_pass_len ; <S2SV_ModStart> } # endif act_pass_len = strlen ( user -> password ) ; act_pass_len = act_pass_len <= 82? act_pass_len : 82 ; <S2SV_ModStart> = 0 ; memcpy <S2SV_ModEnd> ( md5data + <S2SV_ModStart> -> password, act_pass_len <S2SV_ModEnd> ) ; memcpy <S2SV_ModStart> + 1 + act_pass_len <S2SV_ModEnd>, curconn -> <S2SV_ModStart> ) md5data, 1 + act_pass_len + 16 <S2SV_ModEnd> ) ; md5_finish
Buggy code:
 static void sum_intra_stats ( VP8_COMP * cpi, MACROBLOCK * x ) { const MACROBLOCKD * xd = & x -> e_mbd ; const MB_PREDICTION_MODE m = xd -> mode_info_context -> mbmi. mode ; const MB_PREDICTION_MODE uvm = xd -> mode_info_context -> mbmi. uv_mode ; # ifdef MODE_STATS const int is_key = cpi -> common. frame_type == KEY_FRAME ; ++ ( is_key? uv_modes : inter_uv_modes ) [ uvm ] ; if ( m == B_PRED ) { unsigned int * const bct = is_key? b_modes : inter_b_modes ; int b = 0 ; do { ++ bct [ xd -> block [ b ]. bmi. mode ] ; } while ( ++ b < 16 ) ; } <START_BUG> # endif <END_BUG> ++ x -> ymode_count [ m ] ; ++ x -> uv_mode_count [ uvm ] ; }

Fix:
<S2SV_ModStart> ; } # else ( void ) cpi ; #
Buggy code:
 GF_Err dinf_Read ( GF_Box * s, GF_BitStream * bs ) { GF_Err e = gf_isom_box_array_read ( s, bs, dinf_AddBox ) ; if ( e ) { return e ; } if (! ( ( GF_DataInformationBox * ) s ) -> dref ) { <START_BUG> GF_LOG ( GF_LOG_ERROR, GF_LOG_CONTAINER, ( "[iso   file]   Missing   dref   box   in   dinf\\n" ) ) ; <END_BUG>  ( ( GF_DataInformationBox * ) s ) -> dref = ( GF_DataReferenceBox * ) gf_isom_box_new ( GF_ISOM_BOX_TYPE_DREF ) ; <START_BUG> } return GF_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> dref ) { GF_Box * dref ; <S2SV_ModStart> ( "[iso <S2SV_blank> file] <S2SV_blank> Missing <S2SV_blank> dref <S2SV_blank> box <S2SV_blank> in <S2SV_blank> dinf\\n" ) ) ; dref = gf_isom_box_new ( GF_ISOM_BOX_TYPE_DREF <S2SV_ModStart> GF_DataReferenceBox * ) dref ; gf_isom_box_add_for_dump_mode ( s, dref <S2SV_ModEnd> ) ; }
Buggy code:
 static char_u * did_set_string_option ( int opt_idx, char_u * * varp, int new_value_alloced, char_u * oldval, char_u * errbuf, int opt_flags ) { char_u * errmsg = NULL ; char_u * s, * p ; int did_chartab = FALSE ; char_u * * gvarp ; long_u free_oldval = ( options [ opt_idx ]. flags & P_ALLOCED ) ; # ifdef FEAT_GUI int redraw_gui_only = FALSE ; # endif gvarp = ( char_u * * ) get_varp_scope ( & ( options [ opt_idx ] ), OPT_GLOBAL ) ; if ( ( secure # ifdef HAVE_SANDBOX || sandbox!= 0 # endif ) && ( options [ opt_idx ]. flags & P_SECURE ) ) { errmsg = e_secure ; } else if ( ( options [ opt_idx ]. flags & P_NFNAME ) && vim_strpbrk ( * varp, ( char_u * ) "//\\\\*?[|<>" )!= NULL ) { errmsg = e_invarg ; } else if ( varp == & T_NAME ) { if ( T_NAME [ 0 ] == NUL ) errmsg = ( char_u * ) N_ ( "E529:   Cannot   set   \'term\'   to   empty   string" ) ; # ifdef FEAT_GUI if ( gui. in_use ) errmsg = ( char_u * ) N_ ( "E530:   Cannot   change   term   in   GUI" ) ; else if ( term_is_gui ( T_NAME ) ) errmsg = ( char_u * ) N_ ( "E531:   Use   \\":gui\\"   to   start   the   GUI" ) ; # endif else if ( set_termname ( T_NAME ) == FAIL ) errmsg = ( char_u * ) N_ ( "E522:   Not   found   in   termcap" ) ; else redraw_later_clear ( ) ; } else if ( gvarp == & p_bkc ) { char_u * bkc = p_bkc ; unsigned int * flags =

Fix:
<S2SV_ModStart> b_p_keymap ) { if (! valid_filetype ( * varp ) ) errmsg = e_invarg ; else <S2SV_ModStart> gui_mch_set_rendering_options ( p_rop ) ) errmsg = e_invarg ; } # endif # ifdef FEAT_AUTOCMD else if ( gvarp == & p_ft ) { if (! valid_filetype ( * varp ) ) errmsg = e_invarg ; } # endif # ifdef FEAT_SYN_HL else if ( gvarp == & p_syn ) { if (! valid_filetype ( * varp
Buggy code:
 static void do_runtime ( HttpRequest req, HttpResponse res ) { int pid = exist_daemon ( ) ; char buf [ STRLEN ] ; do_head ( res, "_runtime", "Runtime", 1000 ) ; StringBuffer_append ( res -> outputbuffer, "<h2>Monit   runtime   status<//h2>" ) ; StringBuffer_append ( res -> outputbuffer, "<table   id=\'status-table\'><tr>" "<th   width=\'40%%\'>Parameter<//th>" "<th   width=\'60%%\'>Value<//th><//tr>" ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Monit   ID<//td><td>%s<//td><//tr>", Run. id ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Host<//td><td>%s<//td><//tr>", Run. system -> name ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Process   id<//td><td>%d<//td><//tr>", pid ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Effective   user   running   Monit<//td>" "<td>%s<//td><//tr>", Run. Env. user ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Controlfile<//td><td>%s<//td><//tr>", Run. files. control ) ; if ( Run. files. log ) StringBuffer_append ( res -> outputbuffer, "<tr><td>Logfile<//td><td>%s<//td><//tr>", Run. files. log ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Pidfile<//td><td>%s<//td><//tr>", Run. files. pid ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>State   file<//td><td>%s<//td><//tr>", Run. files. state ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Debug<//td><td>%s<//td><//tr>", Run. debug? "True" : "False" ) ; StringBuffer_append ( res -> outputbuffer, "<tr><td>Log<//td><td>%s<//td><//tr>", ( Run. flags & Run_Log )? "True" : "False" ) ; StringBuffer_append ( res

Fix:
<S2SV_ModStart> -> outputbuffer, "<td <S2SV_blank> style=\'color:red;\'>" "<form <S2SV_blank> method=POST <S2SV_blank> action=\'_runtime\'>Stop <S2SV_blank> Monit <S2SV_blank> http <S2SV_blank> server? <S2SV_blank> " "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'securitytoken\' <S2SV_blank> value=\'%s\'>" "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'action\' <S2SV_blank> value=\'stop\'>" "<input <S2SV_blank> type=submit <S2SV_blank> value=\'Go\'>" "<//form>" "<//td>", res -> token ) ; StringBuffer_append ( res -> outputbuffer, "<td>" "<form <S2SV_blank> method=POST <S2SV_blank> action=\'_runtime\'>Force <S2SV_blank> validate <S2SV_blank> now? <S2SV_blank> " "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'securitytoken\' <S2SV_blank> value=\'%s\'>" "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'action\' <S2SV_blank> value=\'validate\'>" "<input <S2SV_blank> type=submit <S2SV_blank> value=\'Go\'>" "<//form>" "<//td>", res -> token <S2SV_ModEnd> ) ; if <S2SV_ModStart> -> outputbuffer, "<td>" "<form <S2SV_blank> method=POST <S2SV_blank> action=\'_viewlog\'>View <S2SV_blank> Monit <S2SV_blank> logfile? <S2SV_blank> " "<input <S2SV_blank> type=hidden <S2SV_blank> name=\'securitytoken\' <S2SV_blank> value=\'%s\'>" "<input <S2SV_blank> type=submit <S2SV_blank> value=\'
Buggy code:
 static void process_options ( argc, argv ) int argc ; char * argv [ ] ; { int i, l ; while ( argc > 1 && argv [ 1 ] [ 0 ] == '-' ) { argv ++ ; argc -- ; l = ( int ) strlen ( * argv ) ; if ( l < 4 ) l = 4 ; switch ( argv [ 0 ] [ 1 ] ) { case 'D' : case 'd' : if ( ( argv [ 0 ] [ 1 ] == 'D' &&! argv [ 0 ] [ 2 ] ) ||! strcmpi ( * argv, "-debug" ) ) { wizard = TRUE, discover = FALSE ; } else if (! strncmpi ( * argv, "-DECgraphics", l ) ) { load_symset ( "DECGraphics", PRIMARY ) ; switch_symbols ( TRUE ) ; } else { <START_BUG> raw_printf ( "Unknown   option:   %s", * argv ) ; <END_BUG> } break ; case 'X' : discover = TRUE, wizard = FALSE ; break ; # ifdef NEWS case 'n' : iflags. news = FALSE ; break ; # endif case 'u' : if ( argv [ 0 ] [ 2 ] ) { ( void ) strncpy ( plname, argv [ 0 ] + 2, sizeof plname - 1 ) ; } else if ( argc > 1 ) { argc -- ; argv ++ ; ( void ) strncpy ( plname, argv [ 0 ], sizeof plname - 1 ) ; } else { raw_print ( "Player   name   expected   after   -u" ) ; } break ; case 'I' : case 'i' : if (! strncmpi ( * argv, "-IBMgraphics", l ) ) { load_symset ( "IBMGraphics", PRIMARY ) ; load_symset ( "RogueIBM", ROGUESET ) ; switch_symbols ( TRUE ) ; } else {  raw_printf ( "Unknown   option:   %s", * argv ) ; <START_BUG> } break ; case 'p' : if ( argv [ 0 ] [ 2 ] ) { if ( ( i = str2role ( & argv [ 0 ] [ 2 ] ) ) >= 0 ) flags. initrole = i ; } else if ( argc > 1 ) { argc -- ;<END_BUG>

Fix:
<S2SV_ModStart> { raw_printf ( "Unknown <S2SV_blank> option: <S2SV_blank> %.60s" <S2SV_ModEnd>, * argv <S2SV_ModStart> { raw_printf ( "Unknown <S2SV_blank> option: <S2SV_blank> %.60s" <S2SV_ModEnd>, * argv
Buggy code:
 static guint32 finalizer_thread ( gpointer unused ) { while (! finished ) { g_assert ( mono_domain_get ( ) == mono_get_root_domain ( ) ) ; # ifdef MONO_HAS_SEMAPHORES MONO_SEM_WAIT ( & finalizer_sem ) ; # else WaitForSingleObjectEx ( finalizer_event, INFINITE, FALSE ) ; # endif mono_console_handle_async_ops ( ) ; # ifndef DISABLE_ATTACH mono_attach_maybe_start ( ) ; <START_BUG> # endif <END_BUG> if ( domains_to_finalize ) { mono_finalizer_lock ( ) ; if ( domains_to_finalize ) { DomainFinalizationReq * req = domains_to_finalize -> data ; domains_to_finalize = g_slist_remove ( domains_to_finalize, req ) ; mono_finalizer_unlock ( ) ; finalize_domain_objects ( req ) ; } else { mono_finalizer_unlock ( ) ; } } mono_gc_invoke_finalizers ( ) ; SetEvent ( pending_done_event ) ; } SetEvent ( shutdown_event ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; # endif reference_queue_proccess_all ( ) ;
Buggy code:
 H264SwDecRet H264SwDecInit ( H264SwDecInst * decInst, u32 noOutputReordering ) { u32 rv = 0 ; decContainer_t * pDecCont ; DEC_API_TRC ( "H264SwDecInit#" ) ; if ( ( ( - 1 ) >> 1 )!= ( - 1 ) ) { DEC_API_TRC ( "H264SwDecInit#   ERROR:   Right   shift   is   not   signed" ) ; return ( H264SWDEC_INITFAIL ) ; } if ( decInst == NULL ) { DEC_API_TRC ( "H264SwDecInit#   ERROR:   decInst   ==   NULL" ) ; return ( H264SWDEC_PARAM_ERR ) ; } <START_BUG> pDecCont = ( decContainer_t * ) H264SwDecMalloc ( sizeof ( decContainer_t ) ) ; <END_BUG> if ( pDecCont == NULL ) { DEC_API_TRC ( "H264SwDecInit#   ERROR:   Memory   allocation   failed" ) ; return ( H264SWDEC_MEMFAIL ) ; } # ifdef H264DEC_TRACE sprintf ( pDecCont -> str, "H264SwDecInit#   decInst   %p   noOutputReordering   %d", ( void * ) decInst, noOutputReordering ) ; DEC_API_TRC ( pDecCont -> str ) ; # endif rv = h264bsdInit ( & pDecCont -> storage, noOutputReordering ) ; if ( rv!= HANTRO_OK ) { H264SwDecRelease ( pDecCont ) ; return ( H264SWDEC_MEMFAIL ) ; } pDecCont -> decStat = INITIALIZED ; pDecCont -> picNumber = 0 ; # ifdef H264DEC_TRACE sprintf ( pDecCont -> str, "H264SwDecInit#   OK:   return   %p", ( void * ) pDecCont ) ; DEC_API_TRC ( pDecCont -> str ) ; # endif * decInst = ( decContainer_t * ) pDecCont ; return ( H264SWDEC_OK ) ; }

Fix:
<S2SV_ModStart> ( decContainer_t ), 1
Buggy code:
 static vpx_codec_err_t ctrl_set_svc_parameters ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> VP9_COMP * const cpi = ctx -> cpi ;  vpx_svc_parameters_t * const params = va_arg ( args, vpx_svc_parameters_t * ) ; <START_BUG> <END_BUG> if ( params == NULL )  return VPX_CODEC_INVALID_PARAM ; <START_BUG> cpi -> svc. spatial_layer_id = params -> spatial_layer ; <END_BUG>  cpi -> svc. temporal_layer_id = params -> temporal_layer ; <START_BUG> <END_BUG> cpi -> lst_fb_idx = params -> lst_fb_idx ;  <START_BUG> cpi -> gld_fb_idx = params -> gld_fb_idx ; <END_BUG>  cpi -> alt_fb_idx = params -> alt_fb_idx ; <START_BUG> if ( vp9_set_size_literal ( ctx -> cpi, params -> width, params -> height )!= 0 ) return VPX_CODEC_INVALID_PARAM ; ctx -> cfg. rc_max_quantizer = params -> max_quantizer ; ctx -> cfg. rc_min_quantizer = params -> min_quantizer ; set_encoder_config ( & ctx -> oxcf, & ctx -> cfg, & ctx -> extra_cfg ) ; vp9_change_config ( ctx -> cpi, & ctx -> oxcf ) ; return VPX_CODEC_OK ; }<END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> -> cpi ; vpx_svc_extra_cfg_t <S2SV_ModEnd> * const params <S2SV_ModStart> ( args, vpx_svc_extra_cfg_t <S2SV_ModEnd> * ) ; <S2SV_ModStart> * ) ; int sl, tl ; for ( sl = 0 ; sl < <S2SV_ModEnd> cpi -> svc <S2SV_ModStart> -> svc. number_spatial_layers ; ++ sl ) { for ( tl = 0 ; tl < <S2SV_ModEnd> cpi -> svc <S2SV_ModStart> -> svc. number_temporal_layers ; ++ tl ) { const int layer = LAYER_IDS_TO_IDX ( sl, tl, cpi -> svc. number_temporal_layers ) ; LAYER_CONTEXT * lc = & cpi -> svc. layer_context [ layer ] ; lc -> max_q <S2SV_ModEnd> = params -> <S2SV_ModStart> = params -> max_quantizers [ sl ] ; lc -> min_q <S2SV_ModEnd> = params -> <S2SV_ModStart> = params -> min_quantizers [ sl ] ; lc -> scaling_factor_num <S2SV_ModEnd> = params -> <S2SV_ModStart> = params -> scaling_factor_num [ sl ] ; lc -> scaling_factor_den <S2SV_ModEnd> = params -> <S2SV_ModStart> = params -> scaling_factor_den [ sl ] ; } }
Buggy code:
 static void InsertRow ( unsigned char * p, ssize_t y, Image * image, int bpp ) { ExceptionInfo * exception ; int bit ; ssize_t x ; register PixelPacket * q ; IndexPacket index ; register IndexPacket * indexes ; exception = ( & image -> exception ) ; switch ( bpp ) { case 1 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) break ; indexes = GetAuthenticIndexQueue ( image ) ; for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 7 ) ; x += 8 ) { for ( bit = 0 ; bit < 8 ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( indexes + x + bit, index ) ; SetPixelRGBO ( q, image -> colormap + ( ssize_t ) index ) ; q ++ ; } p ++ ; } if ( ( image -> columns % 8 )!= 0 ) { for ( bit = 0 ; bit < ( ssize_t ) ( image -> columns % 8 ) ; bit ++ ) { index = ( ( * p ) & ( 0x80 >> bit )? 0x01 : 0x00 ) ; SetPixelIndex ( indexes + x + bit, index ) ; SetPixelRGBO ( q, image -> colormap + ( ssize_t ) index ) ; q ++ ; } p ++ ; } if (! SyncAuthenticPixels ( image, exception ) ) break ; break ; } case 2 : { q = QueueAuthenticPixels ( image, 0, y, image -> columns, 1, exception ) ; if ( q == ( PixelPacket * ) NULL ) break ; indexes = GetAuthenticIndexQueue ( image ) ; <START_BUG> for ( x = 0 ; x < ( ( ssize_t ) image -> columns - 1 ) ; x += 2 ) <END_BUG> { index = ConstrainColormapIndex ( image, ( * p >> 6 ) & 0x3 ) ; SetPixelIndex ( indexes + x, index ) ; SetPixelRGBO ( q, image -> colormap + ( ssize_t ) index ) ; q ++ ; index = ConstrainColormapIndex ( image, ( * p >> 4 ) & 0x3

Fix:
<S2SV_ModStart> ; x += 4 <S2SV_ModEnd> ) { index
Buggy code:
 static int ext4_ext_grow_indepth ( handle_t * handle, struct inode * inode, unsigned int flags ) { struct ext4_extent_header * neh ; struct buffer_head * bh ; ext4_fsblk_t newblock, goal = 0 ; struct ext4_super_block * es = EXT4_SB ( inode -> i_sb ) -> s_es ; int err = 0 ; <START_BUG> if ( ext_depth ( inode ) ) <END_BUG> goal = ext4_idx_pblock ( EXT_FIRST_INDEX ( ext_inode_hdr ( inode ) ) ) ; if ( goal > le32_to_cpu ( es -> s_first_data_block ) ) { flags |= EXT4_MB_HINT_TRY_GOAL ; goal -- ; } else goal = ext4_inode_to_goal_block ( inode ) ; newblock = ext4_new_meta_blocks ( handle, inode, goal, flags, NULL, & err ) ; if ( newblock == 0 ) return err ; bh = sb_getblk_gfp ( inode -> i_sb, newblock, __GFP_MOVABLE | GFP_NOFS ) ; if ( unlikely (! bh ) ) return - ENOMEM ; lock_buffer ( bh ) ; err = ext4_journal_get_create_access ( handle, bh ) ; if ( err ) { unlock_buffer ( bh ) ; goto out ; }  memmove ( bh -> b_data, EXT4_I ( inode ) -> i_data, <START_BUG> <END_BUG> sizeof ( EXT4_I ( inode ) -> i_data ) ) ;  neh = ext_block_hdr ( bh ) ; if ( ext_depth ( inode ) ) neh -> eh_max = cpu_to_le16 ( ext4_ext_space_block_idx ( inode, 0 ) ) ; else neh -> eh_max = cpu_to_le16 ( ext4_ext_space_block ( inode, 0 ) ) ; neh -> eh_magic = EXT4_EXT_MAGIC ; ext4_extent_block_csum_set ( inode, neh ) ; set_buffer_uptodate ( bh ) ; unlock_buffer ( bh ) ; err = ext4_handle_dirty_metadata ( handle, inode,

Fix:
<S2SV_ModStart> = 0 ; size_t ext_size = 0 ; <S2SV_ModStart> out ; } ext_size = sizeof ( EXT4_I ( inode ) -> i_data ) ; <S2SV_ModStart> -> i_data, ext_size ) ; memset ( bh -> b_data + ext_size, 0, inode -> i_sb -> s_blocksize - ext_size <S2SV_ModEnd> ) ; neh
Buggy code:
 int main ( int argc, char * * argv ) { FILE * infile = NULL ; vpx_codec_ctx_t codec = { 0 } ; vpx_codec_enc_cfg_t cfg = { 0 } ; int frame_count = 0 ; vpx_image_t raw ; vpx_codec_err_t res ; VpxVideoInfo info = { 0 } ; VpxVideoWriter * writer = NULL ; const VpxInterface * encoder = NULL ; int update_frame_num = 0 ; const int fps = 30 ; const int bitrate = 200 ; exec_name = argv [ 0 ] ; if ( argc!= 6 ) die ( "Invalid   number   of   arguments" ) ; encoder = get_vpx_encoder_by_name ( "vp8" ) ; if (! encoder ) die ( "Unsupported   codec." ) ; update_frame_num = atoi ( argv [ 5 ] ) ; if (! update_frame_num ) die ( "Couldn\'t   parse   frame   number   \'%s\'\\n", argv [ 5 ] ) ; info. codec_fourcc = encoder -> fourcc ; info. frame_width = strtol ( argv [ 1 ], NULL, 0 ) ; info. frame_height = strtol ( argv [ 2 ], NULL, 0 ) ; info. time_base. numerator = 1 ; info. time_base. denominator = fps ; if ( info. frame_width <= 0 || info. frame_height <= 0 || ( info. frame_width % 2 )!= 0 || ( info. frame_height % 2 )!= 0 ) { die ( "Invalid   frame   size:   %dx%d", info. frame_width, info. frame_height ) ; } if (! vpx_img_alloc ( & raw, VPX_IMG_FMT_I420, info. frame_width, info. frame_height, 1 ) ) { die ( "Failed   to   allocate   image." ) ; } <START_BUG> printf ( "Using   %s\\n", vpx_codec_iface_name ( encoder -> interface ( ) ) ) ; <END_BUG>  res = vpx_codec_enc_config_default ( encoder -> interface ( ), & cfg, 0 ) ; <START_BUG> if ( res ) die_codec ( & codec,<END_BUG>

Fix:
<S2SV_ModStart> ( encoder -> codec_interface <S2SV_ModEnd> ( ) ) <S2SV_ModStart> ( encoder -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart>, encoder -> codec_interface <S2SV_ModEnd> ( ), <S2SV_ModStart> ) ; } while ( <S2SV_ModStart>, writer ) ) { } <S2SV_ModEnd> printf ( "\\n"
Buggy code:
 static void put_prev_task ( struct rq * rq, struct task_struct * prev ) { if ( prev -> se. on_rq ) update_rq_clock ( rq ) ; <START_BUG> rq -> skip_clock_update = 0 ; <END_BUG> prev -> sched_class -> put_prev_task ( rq, prev ) ; }

Fix:
<S2SV_ModStart> rq ) ; <S2SV_ModEnd> prev -> sched_class
Buggy code:
 static void addFormVars ( cchar * buf ) { char * pair, * tok ; pair = stok ( sclone ( buf ), "&", & tok ) ; <START_BUG> while ( pair!= 0 ) { <END_BUG> mprAddItem ( app -> formData, sclone ( pair ) ) ; pair = stok ( 0, "&", & tok ) ; } }

Fix:
<S2SV_ModStart> while ( pair <S2SV_ModEnd> ) { mprAddItem
Buggy code:
 void vp8_print_modes_and_motion_vectors ( MODE_INFO * mi, int rows, int cols, int frame ) { int mb_row ; int mb_col ; int mb_index = 0 ; FILE * mvs = fopen ( "mvs.stt", "a" ) ; mb_index = 0 ; fprintf ( mvs, "Mb   Modes   for   Frame   %d\\n", frame ) ; for ( mb_row = 0 ; mb_row < rows ; mb_row ++ ) { for ( mb_col = 0 ; mb_col < cols ; mb_col ++ ) { fprintf ( mvs, "%2d   ", mi [ mb_index ]. mbmi. mode ) ; mb_index ++ ; } fprintf ( mvs, "\\n" ) ; mb_index ++ ; } fprintf ( mvs, "\\n" ) ; mb_index = 0 ; fprintf ( mvs, "Mb   mv   ref   for   Frame   %d\\n", frame ) ; for ( mb_row = 0 ; mb_row < rows ; mb_row ++ ) { for ( mb_col = 0 ; mb_col < cols ; mb_col ++ ) { fprintf ( mvs, "%2d   ", mi [ mb_index ]. mbmi. ref_frame ) ; mb_index ++ ; } fprintf ( mvs, "\\n" ) ; mb_index ++ ; } fprintf ( mvs, "\\n" ) ; mb_index = 0 ; fprintf ( mvs, "UV   Modes   for   Frame   %d\\n", frame ) ; for ( mb_row = 0 ; mb_row < rows ; mb_row ++ ) { for ( mb_col = 0 ; mb_col < cols ; mb_col ++ ) { fprintf ( mvs, "%2d   ", mi [ mb_index ]. mbmi. uv_mode ) ; mb_index ++ ; } mb_index ++ ; fprintf ( mvs, "\\n" ) ; } <START_BUG> fprintf ( mvs, "\\n" ) ; <END_BUG> mb_index = 0 ; fprintf ( mvs, "Mbs   for   Frame   %d\\n", frame ) ; { int b_row ; for ( b_row =

Fix:
<S2SV_ModStart>, "\\n" ) <S2SV_ModEnd> ; fprintf ( <S2SV_ModStart> "\\n" ) ; <S2SV_ModEnd> fprintf ( mvs
Buggy code:
 <START_BUG> static void tree2tok ( struct vp9_token * tokens, const vp9_tree_index * tree, <END_BUG> int i, int v, int l ) { v += v ; ++ l ; do {  const vp9_tree_index j = tree [ i ++ ] ; <START_BUG> if ( j <= 0 ) { tokens [ - j ]. value = v ; tokens [ - j ]. len = l ; } else { tree2tok ( tokens, tree, j, v, l ) ; } } while ( ++ v & 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> tokens, const vpx_tree_index <S2SV_ModEnd> * tree, <S2SV_ModStart> do { const vpx_tree_index <S2SV_ModEnd> j = tree
Buggy code:
 static int remove_bond ( const bt_bdaddr_t * bd_addr ) <START_BUG> { <END_BUG> if ( interface_ready ( ) == FALSE ) return BT_STATUS_NOT_READY ; return btif_dm_remove_bond ( bd_addr ) ; }

Fix:
<S2SV_ModStart> bd_addr ) { if ( is_restricted_mode ( ) &&! btif_storage_is_restricted_device ( bd_addr ) ) return BT_STATUS_SUCCESS ;
Buggy code:
 int cdf_read_property_info ( const cdf_stream_t * sst, const cdf_header_t * h, uint32_t offs, cdf_property_info_t * * info, size_t * count, size_t * maxcount ) { const cdf_section_header_t * shp ; cdf_section_header_t sh ; const uint8_t * p, * q, * e ; int16_t s16 ; int32_t s32 ; uint32_t u32 ; int64_t s64 ; uint64_t u64 ; cdf_timestamp_t tp ; size_t i, o, o4, nelements, j ; cdf_property_info_t * inp ; if ( offs > UINT32_MAX // 4 ) { errno = EFTYPE ; goto out ; } shp = CAST ( const cdf_section_header_t *, ( const void * ) ( ( const char * ) sst -> sst_tab + offs ) ) ; if ( cdf_check_stream_offset ( sst, h, shp, sizeof ( * shp ), __LINE__ ) == - 1 ) goto out ; sh. sh_len = CDF_TOLE4 ( shp -> sh_len ) ; # define CDF_SHLEN_LIMIT ( UINT32_MAX // 8 ) if ( sh. sh_len > CDF_SHLEN_LIMIT ) { errno = EFTYPE ; goto out ; } sh. sh_properties = CDF_TOLE4 ( shp -> sh_properties ) ; # define CDF_PROP_LIMIT ( UINT32_MAX // ( 4 * sizeof ( * inp ) ) ) if ( sh. sh_properties > CDF_PROP_LIMIT ) goto out ; DPRINTF ( ( "section   len:   %u   properties   %u\\n", sh. sh_len, sh. sh_properties ) ) ; if ( * maxcount ) { if ( * maxcount > CDF_PROP_LIMIT ) goto out ; * maxcount += sh. sh_properties ; inp = CAST ( cdf_property_info_t *, realloc ( * info, * maxcount * sizeof ( * inp ) ) ) ; } else { * maxcount = sh. sh_properties ; inp = CAST ( cdf_property_info_t *, malloc ( * maxcount *

Fix:
<S2SV_ModStart> if ( q < p || q
Buggy code:
 static int perf_swevent_add ( struct perf_event * event, int flags ) { struct swevent_htable * swhash = this_cpu_ptr ( & swevent_htable ) ; struct hw_perf_event * hwc = & event -> hw ; struct hlist_head * head ; if ( is_sampling_event ( event ) ) { hwc -> last_period = hwc -> sample_period ; perf_swevent_set_period ( event ) ; } hwc -> state =! ( flags & PERF_EF_START ) ; head = find_swevent_head ( swhash, event ) ; <START_BUG> if (! head ) { <END_BUG> WARN_ON_ONCE ( swhash -> online ) ; return - EINVAL ;  } <START_BUG> hlist_add_head_rcu ( & event -> hlist_entry, head ) ; perf_event_update_userpage ( event ) ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( WARN_ON_ONCE ( <S2SV_ModStart>! head ) ) <S2SV_ModEnd> return - EINVAL <S2SV_ModStart> - EINVAL ; <S2SV_ModEnd> hlist_add_head_rcu ( &
Buggy code:
 void * vpx_memalign ( size_t align, size_t size ) { void * addr, * x = NULL ; <START_BUG> # if CONFIG_MEM_MANAGER <END_BUG> int number_aau ; if ( vpx_mm_create_heap_memory ( ) < 0 ) { _P ( printf ( "[vpx][mm]   ERROR   vpx_memalign()   Couldn\'t   create   memory   for   Heap.\\n" ) ; ) } number_aau = ( ( size + align - 1 + ADDRESS_STORAGE_SIZE ) >> SHIFT_HMM_ADDR_ALIGN_UNIT ) + 1 ; addr = hmm_alloc ( & hmm_d, number_aau ) ; # else addr = VPX_MALLOC_L ( size + align - 1 + ADDRESS_STORAGE_SIZE ) ;  # endif <START_BUG> if ( addr ) { x = align_addr ( ( unsigned char * ) addr + ADDRESS_STORAGE_SIZE, ( int ) align ) ; ( ( size_t * ) x ) [ - 1 ] = ( size_t ) addr ; } return x ; }<END_BUG>

Fix:
<S2SV_ModStart> = NULL ; addr = malloc <S2SV_ModEnd> ( size + <S2SV_ModStart> ADDRESS_STORAGE_SIZE ) ; <S2SV_ModEnd> if ( addr
Buggy code:
 static void uipc_read_task ( void * arg ) { int ch_id ; int result ; UNUSED ( arg ) ; prctl ( PR_SET_NAME, ( unsigned long ) "uipc-main", 0, 0, 0 ) ; raise_priority_a2dp ( TASK_UIPC_READ ) ; while ( uipc_main. running ) { uipc_main. read_set = uipc_main. active_set ; <START_BUG> result = select ( uipc_main. max_fd + 1, & uipc_main. read_set, NULL, NULL, NULL ) ; <END_BUG> if ( result == 0 ) { BTIF_TRACE_EVENT ( "select   timeout" ) ; continue ; } else if ( result < 0 ) { BTIF_TRACE_EVENT ( "select   failed   %s", strerror ( errno ) ) ; continue ; } UIPC_LOCK ( ) ; uipc_check_interrupt_locked ( ) ; uipc_check_task_flags_locked ( ) ; uipc_check_fd_locked ( UIPC_CH_ID_AV_AUDIO ) ; for ( ch_id = 0 ; ch_id < UIPC_CH_NUM ; ch_id ++ ) { if ( ch_id!= UIPC_CH_ID_AV_AUDIO ) uipc_check_fd_locked ( ch_id ) ; } UIPC_UNLOCK ( ) ; } BTIF_TRACE_EVENT ( "UIPC   READ   THREAD   EXITING" ) ; uipc_main_cleanup ( ) ; uipc_main. tid = 0 ; BTIF_TRACE_EVENT ( "UIPC   READ   THREAD   DONE" ) ; }

Fix:
<S2SV_ModStart> ; result = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, NULL ) )
Buggy code:
 static int <START_BUG> mptctl_getiocinfo ( unsigned long arg, unsigned int data_size ) <END_BUG> { struct mpt_ioctl_iocinfo __user * uarg = ( void __user * ) arg ; struct mpt_ioctl_iocinfo * karg ;  MPT_ADAPTER * ioc ; <START_BUG> <END_BUG> struct pci_dev * pdev ;  int iocnum ; unsigned int port ; int cim_rev ; struct scsi_device * sdev ; VirtDevice * vdevice ; if ( data_size == sizeof ( struct mpt_ioctl_iocinfo_rev0 ) ) cim_rev = 0 ; else if ( data_size == sizeof ( struct mpt_ioctl_iocinfo_rev1 ) ) cim_rev = 1 ; else if ( data_size == sizeof ( struct mpt_ioctl_iocinfo ) ) cim_rev = 2 ; else if ( data_size == ( sizeof ( struct mpt_ioctl_iocinfo_rev0 ) + 12 ) ) cim_rev = 0 ; else return - EFAULT ; karg = memdup_user ( uarg, data_size ) ; if ( IS_ERR ( karg ) ) { printk ( KERN_ERR MYNAM "%s@%d::mpt_ioctl_iocinfo()   -   memdup_user   returned   error   [%ld]\\n", __FILE__, __LINE__, PTR_ERR ( karg ) ) ; <START_BUG> return PTR_ERR ( karg ) ; <END_BUG> } if ( ( ( iocnum = mpt_verify_adapter ( karg -> hdr. iocnum, & ioc ) ) < 0 ) || ( ioc == NULL ) ) { printk ( KERN_DEBUG MYNAM "%s::mptctl_getiocinfo()   @%d   -   ioc%d   not   found!\\n", __FILE__, __LINE__, iocnum ) ; kfree ( karg ) ; return - ENODEV ; } if ( karg -> hdr. maxDataSize!= data_size ) { printk ( MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo   -   " "Structure   size  

Fix:
<S2SV_ModStart> int mptctl_getiocinfo ( MPT_ADAPTER * ioc, <S2SV_ModStart> * karg ; <S2SV_ModEnd> struct pci_dev * <S2SV_ModStart> pci_dev * pdev <S2SV_ModEnd> ; unsigned int <S2SV_ModStart> ( karg ) <S2SV_ModEnd> ; } if
Buggy code:
 static void update_logging ( ) { bool should_log = module_started && ( logging_enabled_via_api || stack_config -> get_btsnoop_turned_on ( ) ) ; if ( should_log == is_logging ) return ; is_logging = should_log ; if ( should_log ) { btsnoop_net_open ( ) ; const char * log_path = stack_config -> get_btsnoop_log_path ( ) ; if ( stack_config -> get_btsnoop_should_save_last ( ) ) { char last_log_path [ PATH_MAX ] ; snprintf ( last_log_path, PATH_MAX, "%s.%llu", log_path, btsnoop_timestamp ( ) ) ; if (! rename ( log_path, last_log_path ) && errno!= ENOENT ) LOG_ERROR ( "%s   unable   to   rename   \'%s\'   to   \'%s\':   %s", __func__, log_path, last_log_path, strerror ( errno ) ) ; } <START_BUG> logfile_fd = open ( log_path, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH ) ; <END_BUG> if ( logfile_fd == INVALID_FD ) { LOG_ERROR ( "%s   unable   to   open   \'%s\':   %s", __func__, log_path, strerror ( errno ) ) ; is_logging = false ; return ; }  write ( logfile_fd, "btsnoop\\0\\0\\0\\0\\1\\0\\0\\x3\\xea", 16 ) ; <START_BUG> } else { if ( logfile_fd!= INVALID_FD ) close ( logfile_fd ) ; logfile_fd = INVALID_FD ; btsnoop_net_close ( ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> } logfile_fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart> S_IWGRP | S_IROTH ) <S2SV_ModStart> return ; } TEMP_FAILURE_RETRY ( <S2SV_ModStart> "btsnoop\\0\\0\\0\\0\\1\\0\\0\\x3\\xea", 16 )
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 <START_BUG> char <END_BUG> magick [ 12 ] ; Image * image ; IndexPacket index ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; register IndexPacket * indexes ; register ssize_t x ; register PixelPacket * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, number_planes, number_planes_filled, one, pixel_info_length ; ssize_t count, offset, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ;  count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; <START_BUG> if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { <END_BUG> image -> page. x = ReadBlobLSBShort ( image ) ;  <START_BUG> image -> page. y = ReadBlobLSBShort ( image ) ; <END_BUG> image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> matte = flags & 0x04

Fix:
<S2SV_ModStart> define EOFOp 0x07 # define ThrowRLEException ( exception, message ) \\\n{ if ( colormap!= ( unsigned char * ) NULL ) colormap = ( unsigned char * ) RelinquishMagickMemory ( colormap ) ; if ( pixel_info!= ( MemoryInfo * ) NULL ) pixel_info = RelinquishVirtualMemory ( pixel_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; \\\n} <S2SV_ModStart> ) ) ; colormap = ( unsigned char * ) NULL ; pixel_info = ( MemoryInfo * ) NULL ; <S2SV_ModStart>. x = ( ssize_t ) <S2SV_ModStart>. y = ( ssize_t ) <S2SV_ModStart> "ImproperImageHeader" ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowRLEException ( CorruptImageError, "UnexpectedEndOfFile" ) ; <S2SV_ModStart>!= MagickFalse ) ThrowRLEException ( <S2SV_ModEnd> CorruptImageError, "UnexpectedEndOfFile" <S2SV_ModStart> CorruptImageError, "UnexpectedEndOfFile" ) ; <S2SV_ModEnd> colormap = ( <S2SV_ModStart> x ++ ) { <S2SV_ModStart> ) ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowRLEException ( CorruptImageError, "UnexpectedEndOf
Buggy code:
 static void __udf_read_inode ( struct inode * inode ) { struct buffer_head * bh = NULL ; struct fileEntry * fe ; struct extendedFileEntry * efe ; uint16_t ident ; struct udf_inode_info * iinfo = UDF_I ( inode ) ; struct udf_sb_info * sbi = UDF_SB ( inode -> i_sb ) ; <START_BUG> unsigned int link_count ; <END_BUG> bh = udf_read_ptagged ( inode -> i_sb, & iinfo -> i_location, 0, & ident ) ; if (! bh ) { udf_err ( inode -> i_sb, "(ino   %ld)   failed  !bh\\n", inode -> i_ino ) ; make_bad_inode ( inode ) ; return ; } if ( ident!= TAG_IDENT_FE && ident!= TAG_IDENT_EFE && ident!= TAG_IDENT_USE ) { udf_err ( inode -> i_sb, "(ino   %ld)   failed   ident=%d\\n", inode -> i_ino, ident ) ; brelse ( bh ) ; make_bad_inode ( inode ) ; return ; } fe = ( struct fileEntry * ) bh -> b_data ; efe = ( struct extendedFileEntry * ) bh -> b_data ; if ( fe -> icbTag. strategyType == cpu_to_le16 ( 4096 ) ) { struct buffer_head * ibh ; ibh = udf_read_ptagged ( inode -> i_sb, & iinfo -> i_location, 1, & ident ) ; if ( ident == TAG_IDENT_IE && ibh ) {  struct buffer_head * nbh = NULL ; <START_BUG> struct kernel_lb_addr loc ; struct indirectEntry * ie ; ie = ( struct indirectEntry * ) ibh -> b_data ; loc = lelb_to_cpu ( ie -> indirectICB. extLocation ) ; <END_BUG> if ( ie -> indirectICB. extLength &&  <START_BUG> ( nbh = udf_read_ptagged ( inode -> i_sb, & loc, 0, <END_BUG> & ident ) ) ) { if ( ident == TAG_IDENT_FE || ident == TAG_IDENT_EFE ) { memcpy ( & iinfo -> i_location, & loc, sizeof ( struct

Fix:
<S2SV_ModStart> int link_count ; unsigned int indirections = 0 ; reread : <S2SV_ModStart> ) { struct <S2SV_ModEnd> kernel_lb_addr loc ; <S2SV_ModStart> indirectICB. extLength ) { brelse ( bh ) ; brelse ( ibh ) ; memcpy ( & iinfo -> i_location <S2SV_ModEnd>, & loc <S2SV_ModStart> & loc, sizeof ( struct kernel_lb_addr ) ) ; if ( ++ indirections > UDF_MAX_ICB_NESTING ) { udf_err ( inode -> i_sb, "too <S2SV_blank> many <S2SV_blank> ICBs <S2SV_blank> in <S2SV_blank> ICB <S2SV_blank> hierarchy" " <S2SV_blank> (max <S2SV_blank> %d <S2SV_blank> supported)\\n", UDF_MAX_ICB_NESTING ) ; make_bad_inode <S2SV_ModEnd> ( inode ) <S2SV_ModStart> return ; } goto reread <S2SV_ModEnd> ; } }
Buggy code:
 int xfs_attr_shortform_list ( xfs_attr_list_context_t * context ) { attrlist_cursor_kern_t * cursor ; xfs_attr_sf_sort_t * sbuf, * sbp ; xfs_attr_shortform_t * sf ; xfs_attr_sf_entry_t * sfe ; xfs_inode_t * dp ; int sbsize, nsbuf, count, i ; int error ; ASSERT ( context!= NULL ) ; dp = context -> dp ; ASSERT ( dp!= NULL ) ; ASSERT ( dp -> i_afp!= NULL ) ; sf = ( xfs_attr_shortform_t * ) dp -> i_afp -> if_u1. if_data ; ASSERT ( sf!= NULL ) ; if (! sf -> hdr. count ) return 0 ; cursor = context -> cursor ; ASSERT ( cursor!= NULL ) ; trace_xfs_attr_list_sf ( context ) ; if ( context -> bufsize == 0 || ( XFS_ISRESET_CURSOR ( cursor ) && ( dp -> i_afp -> if_bytes + sf -> hdr. count * 16 ) < context -> bufsize ) ) { for ( i = 0, sfe = & sf -> list [ 0 ] ; i < sf -> hdr. count ; i ++ ) { error = context -> put_listent ( context, sfe -> flags, sfe -> nameval, ( int ) sfe -> namelen, ( int ) sfe -> valuelen, & sfe -> nameval [ sfe -> namelen ] ) ; if ( context -> seen_enough ) break ; if ( error ) return error ; sfe = XFS_ATTR_SF_NEXTENTRY ( sfe ) ; } trace_xfs_attr_list_sf_all ( context ) ; return 0 ; } if ( context -> bufsize == 0 ) return 0 ; sbsize = sf -> hdr. count * sizeof ( * sbuf ) ; sbp = sbuf = kmem_alloc ( sbsize, KM_SLEEP | KM_NOFS ) ; nsbuf = 0 ; for ( i = 0, sfe = & sf -> list [ 0 ] ; i < sf -> hdr. count ; i ++ ) { if ( unlikely (

Fix:
<S2SV_ModStart> ( error ) { kmem_free ( sbuf ) ; <S2SV_ModStart> return error ; }
Buggy code:
 static inline void encode_openhdr ( struct xdr_stream * xdr, const struct nfs_openargs * arg ) { __be32 * p ; RESERVE_SPACE ( 8 ) ; WRITE32 ( OP_OPEN ) ; WRITE32 ( arg -> seqid -> sequence -> counter ) ; <START_BUG> encode_share_access ( xdr, arg -> open_flags ) ; <END_BUG> RESERVE_SPACE ( 28 ) ; WRITE64 ( arg -> clientid ) ; WRITE32 ( 16 ) ; WRITEMEM ( "open   id:", 8 ) ; WRITE64 ( arg -> id ) ; }

Fix:
<S2SV_ModStart>, arg -> fmode <S2SV_ModEnd> ) ; RESERVE_SPACE
Buggy code:
 int main ( int argc, char * * argv ) { char * filein, * str, * tempfile, * prestring, * outprotos, * protostr ; const char * spacestr = "   " ; <START_BUG> char buf [ L_BUF_SIZE ] ; <END_BUG> l_uint8 * allheaders ; l_int32 i, maxindex, in_line, nflags, protos_added, firstfile, len, ret ; size_t nbytes ; L_BYTEA * ba, * ba2 ; SARRAY * sa, * safirst ; static char mainName [ ] = "xtractprotos" ; if ( argc == 1 ) { fprintf ( stderr, "xtractprotos   [-prestring=<string>]   [-protos=<where>]   " "[list   of   C   files]\\n" "where   the   prestring   is   prepended   to   each   prototype,   and   \\n" "protos   can   be   either   \'inline\'   or   the   name   of   an   output   " "prototype   file\\n" ) ; return 1 ; } prestring = outprotos = NULL ; in_line = FALSE ; nflags = 0 ; maxindex = L_MIN ( 3, argc ) ; for ( i = 1 ; i < maxindex ; i ++ ) { if ( argv [ i ] [ 0 ] == '-' ) { if (! strncmp ( argv [ i ], "-prestring", 10 ) ) { nflags ++ ;  ret = sscanf ( argv [ i ] + 1, "prestring=%s", buf ) ; <START_BUG> if ( ret!= 1 ) { fprintf ( stderr, "parse   failure   for   prestring\\n" ) ; return 1 ; } <END_BUG> if ( ( len = strlen ( buf ) ) > L_BUF_SIZE - 3 ) {  L_WARNING ( "prestring   too   large;   omitting!\\n", mainName ) ; } else { buf [ len ] =' '; buf [ len + 1 ] = '\\0' ; prestring = stringNew ( buf ) ; } } else if (! strncmp ( argv [ i ], "-protos", 7 ) ) { nflags ++ ; <START_BUG> ret = sscanf ( argv [<END_BUG>

Fix:
<S2SV_ModStart> char buf [ L_BUFSIZE <S2SV_ModEnd> ] ; l_uint8 <S2SV_ModStart> + 1, "prestring=%490s" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ) ) > L_BUFSIZE <S2SV_ModEnd> - 3 ) <S2SV_ModStart> + 1, "protos=%490s" <S2SV_ModEnd>, buf ) <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, " <S2SV_blank> * <S2SV_blank> <S2SV_blank> These <S2SV_blank> prototypes <S2SV_blank> were <S2SV_blank> autogen\'d <S2SV_blank> by <S2SV_blank> xtractprotos, <S2SV_blank> v. <S2SV_blank> %s", <S2SV_ModStart> ( buf, L_BUFSIZE <S2SV_ModEnd>, "cpp <S2SV_blank> -ansi <S2SV_blank> -DNO_PROTOS <S2SV_blank> %s <S2SV_blank> %s",
Buggy code:
 static int renameTableSelectCb ( Walker * pWalker, Select * pSelect ) { int i ; RenameCtx * p = pWalker -> u. pRename ; <START_BUG> SrcList * pSrc = pSelect -> pSrc ; <END_BUG> if ( pSrc == 0 ) { assert ( pWalker -> pParse -> db -> mallocFailed ) ; return WRC_Abort ; } for ( i = 0 ; i < pSrc -> nSrc ; i ++ ) { struct SrcList_item * pItem = & pSrc -> a [ i ] ; if ( pItem -> pTab == p -> pTab ) { renameTokenFind ( pWalker -> pParse, p, pItem -> zName ) ; } } renameWalkWith ( pWalker, pSelect ) ; return WRC_Continue ; }

Fix:
<S2SV_ModStart> pSelect -> pSrc ; if ( pSelect -> selFlags & SF_View ) return WRC_Prune