nus-yam/ex-repair huggingface dataset:
Buggy code:
 error_t ksz8851SendPacket ( NetInterface * interface, const NetBuffer * buffer, size_t offset, NetTxAncillary * ancillary ) { size_t n ; size_t length ; Ksz8851TxHeader header ; Ksz8851Context * context ; context = ( Ksz8851Context * ) interface -> nicContext ; length = netBufferGetLength ( buffer ) - offset ; if ( length > ETH_MAX_FRAME_SIZE ) { osSetEvent ( & interface -> nicTxEvent ) ; return ERROR_INVALID_LENGTH ; } <START_BUG> n = ksz8851ReadReg ( interface, KSZ8851_REG_TXMIR ) & TXMIR_TXMA_MASK ; <END_BUG> if ( n < ( length + 8 ) ) { return ERROR_FAILURE ; } netBufferRead ( context -> txBuffer, buffer, offset, length ) ;  header. controlWord = htole16 ( TX_CTRL_TXIC | ( context -> frameId ++ & TX_CTRL_TXFID ) ) ; <START_BUG> header. byteCount = htole16 ( length ) ; <END_BUG> ksz8851SetBit ( interface, KSZ8851_REG_RXQCR, RXQCR_SDA ) ;  ksz8851WriteFifo ( interface, ( uint8_t * ) & header, sizeof ( Ksz8851TxHeader ) ) ; ksz8851WriteFifo ( interface, context -> txBuffer, length ) ; <START_BUG> ksz8851ClearBit ( interface, KSZ8851_REG_RXQCR, RXQCR_SDA ) ; <END_BUG>  ksz8851SetBit ( interface, KSZ8851_REG_TXQCR, TXQCR_METFE ) ; <START_BUG> <END_BUG> n = ksz8851ReadReg ( interface, KSZ8851_REG_TXMIR ) & TXMIR_TXMA_MASK ;  if ( n >= ( ETH_MAX_FRAME_SIZE + 8 ) ) { osSetEvent ( & interface -> nicTxEvent ) ; } return NO_ERROR ; }

Fix:
<S2SV_ModStart> ( interface, KSZ8851_TXMIR ) & KSZ8851_TXMIR_TXMA <S2SV_ModEnd> ; if ( <S2SV_ModStart> = htole16 ( KSZ8851_TX_CTRL_TXIC <S2SV_ModEnd> | ( context <S2SV_ModStart> frameId ++ & KSZ8851_TX_CTRL_TXFID <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( interface, KSZ8851_RXQCR, KSZ8851_RXQCR_SDA <S2SV_ModEnd> ) ; ksz8851WriteFifo <S2SV_ModStart> ( interface, KSZ8851_RXQCR, KSZ8851_RXQCR_SDA <S2SV_ModEnd> ) ; ksz8851SetBit <S2SV_ModStart> ( interface, KSZ8851_TXQCR, KSZ8851_TXQCR_METFE <S2SV_ModEnd> ) ; n <S2SV_ModStart> ( interface, KSZ8851_TXMIR ) & KSZ8851_TXMIR_TXMA <S2SV_ModEnd> ; if (
Buggy code:
 static VALUE ossl_cipher_pkcs5_keyivgen ( int argc, VALUE * argv, VALUE self ) { EVP_CIPHER_CTX * ctx ; const EVP_MD * digest ; VALUE vpass, vsalt, viter, vdigest ; unsigned char key [ EVP_MAX_KEY_LENGTH ], iv [ EVP_MAX_IV_LENGTH ], * salt = NULL ; int iter ; rb_scan_args ( argc, argv, "13", & vpass, & vsalt, & viter, & vdigest ) ; StringValue ( vpass ) ; if (! NIL_P ( vsalt ) ) { StringValue ( vsalt ) ; if ( RSTRING_LEN ( vsalt )!= PKCS5_SALT_LEN ) ossl_raise ( eCipherError, "salt   must   be   an   8-octet   string" ) ; salt = ( unsigned char * ) RSTRING_PTR ( vsalt ) ; } iter = NIL_P ( viter )? 2048 : NUM2INT ( viter ) ; digest = NIL_P ( vdigest )? EVP_md5 ( ) : GetDigestPtr ( vdigest ) ; GetCipher ( self, ctx ) ; EVP_BytesToKey ( EVP_CIPHER_CTX_cipher ( ctx ), digest, salt, ( unsigned char * ) RSTRING_PTR ( vpass ), RSTRING_LENINT ( vpass ), iter, key, iv ) ; if ( EVP_CipherInit_ex ( ctx, NULL, NULL, key, iv, - 1 )!= 1 ) ossl_raise ( eCipherError, NULL ) ; OPENSSL_cleanse ( key, sizeof key ) ; OPENSSL_cleanse ( iv, sizeof iv ) ; <START_BUG> return Qnil ; <END_BUG> }

Fix:
<S2SV_ModStart> iv ) ; rb_ivar_set ( self, id_key_set, Qtrue ) ;
Buggy code:
 static int check_symlinks ( struct archive_write_disk * a ) { <START_BUG> # if! defined ( HAVE_LSTAT ) <END_BUG> ( void ) a ; return ( ARCHIVE_OK ) ; # else char * pn ; char c ; int r ; struct stat st ; pn = a -> name ; if ( archive_strlen ( & ( a -> path_safe ) ) > 0 ) { char * p = a -> path_safe. s ; while ( ( * pn!= '\\0' ) && ( * p == * pn ) ) ++ p, ++ pn ; } if ( pn == a -> name && pn [ 0 ] == '//' ) ++ pn ; c = pn [ 0 ] ; while ( pn [ 0 ]!= '\\0' && ( pn [ 0 ]!= '//' || pn [ 1 ]!= '\\0' ) ) { while ( * pn!= '\\0' && * pn!= '//' ) ++ pn ; c = pn [ 0 ] ; pn [ 0 ] = '\\0' ;  r = lstat ( a -> name, & st ) ; <START_BUG> <END_BUG> if ( r!= 0 ) {  if ( errno == ENOENT ) { break ; } else { return ( ARCHIVE_FAILED ) ; } } else if ( S_ISLNK ( st. st_mode ) ) { if ( c == '\\0' ) { if ( unlink ( a -> name ) ) { <START_BUG> archive_set_error ( & a -> archive, errno, <END_BUG> "Could   not   remove   symlink   %s", a -> name ) ; pn [ 0 ] = c ; return ( ARCHIVE_FAILED ) ;  } <START_BUG> a -> pst = NULL ; <END_BUG> if (! S_ISLNK ( a -> mode ) ) {  archive_set_error ( & a -> archive, 0, "Removing   symlink   %s", a -> name ) ; } pn [ 0 ] = c ; return ( 0 ) ; } else if ( a -> flags & ARCHIVE_EXTRACT_UNLINK ) { if ( unlink ( a -> name )!= 0 ) { archive_set_error ( & a -> archive, 0, "Cannot   remove   intervening   symlink   %s", a -> name ) ; pn [ 0 ] = c ; return ( ARCHIVE_FAILED ) ; } a -> pst = NULL ; } else { archive_set_error

Fix:
<S2SV_ModStart> a ) { struct archive_string error_string ; int error_number ; int rc ; archive_string_init ( & error_string ) ; rc = check_symlinks_fsobj <S2SV_ModEnd> ( a -> <S2SV_ModStart> name, & error_number, & error_string, a -> flags <S2SV_ModEnd> ) ; if <S2SV_ModStart> ; if ( rc!= ARCHIVE_OK <S2SV_ModEnd> ) { archive_set_error <S2SV_ModStart> -> archive, error_number, "%s", error_string. s <S2SV_ModEnd> ) ; } <S2SV_ModStart> ) ; } archive_string_free ( & error_string ) ; <S2SV_ModStart> = NULL ; return rc ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static Image * ReadPICTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { <START_BUG> # define ThrowPICTException ( exception, message ) { if ( tile_image!= ( Image * ) NULL ) tile_image = DestroyImage ( tile_image ) ; if ( read_info!= ( ImageInfo * ) NULL ) read_info = DestroyImageInfo ( read_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; } <END_BUG> char geometry [ MagickPathExtent ], header_ole [ 4 ] ; Image * image, * tile_image ; ImageInfo * read_info ; int c, code ; MagickBooleanType jpeg, status ; PICTRectangle frame ; PICTPixmap pixmap ; Quantum index ; register Quantum * q ; register ssize_t i, x ; size_t extent, length ; ssize_t count, flags, j, version, y ; StringInfo * profile ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } read_info = ( ImageInfo * ) NULL ; tile_image = ( Image * ) NULL ; pixmap. bits_per_pixel = 0 ; pixmap. component_count = 0 ; header_ole [ 0 ] = ReadBlobByte ( image ) ; header_ole [ 1 ] = ReadBlobByte ( image ) ; header_ole [ 2 ] = ReadBlobByte ( image ) ; header_ole [ 3 ] = ReadBlobByte ( image ) ; if (! ( ( header_ole [ 0 ] == 0x50 ) && ( header_ole [ 1 ] == 0x49 ) && ( header_ole [ 2 ] == 0x43 ) && ( header_ole [ 3 ] == 0

Fix:
<S2SV_ModStart>, message ) \\\n{ <S2SV_ModEnd> if ( tile_image <S2SV_ModStart> ) ) ; \\\n} <S2SV_ModEnd> char geometry [ <S2SV_ModStart> ) break ; if ( <S2SV_ModEnd> fputc ( c <S2SV_ModStart>, file )!= c ) break
Buggy code:
 void * merge_directory_configs ( apr_pool_t * mp, void * _parent, void * _child ) { directory_config * parent = ( directory_config * ) _parent ; directory_config * child = ( directory_config * ) _child ; directory_config * merged = create_directory_config ( mp, NULL ) ; # ifdef DEBUG_CONF ap_log_perror ( APLOG_MARK, APLOG_STARTUP | APLOG_NOERRNO, 0, mp, "Merge   parent   %pp   child   %pp   RESULT   %pp", _parent, _child, merged ) ; # endif if ( merged == NULL ) return NULL ; merged -> is_enabled = ( child -> is_enabled == NOT_SET? parent -> is_enabled : child -> is_enabled ) ; merged -> reqbody_access = ( child -> reqbody_access == NOT_SET? parent -> reqbody_access : child -> reqbody_access ) ; merged -> reqbody_buffering = ( child -> reqbody_buffering == NOT_SET? parent -> reqbody_buffering : child -> reqbody_buffering ) ; merged -> reqbody_inmemory_limit = ( child -> reqbody_inmemory_limit == NOT_SET? parent -> reqbody_inmemory_limit : child -> reqbody_inmemory_limit ) ; merged -> reqbody_limit = ( child -> reqbody_limit == NOT_SET? parent -> reqbody_limit : child -> reqbody_limit ) ; merged -> reqbody_no_files_limit = ( child -> reqbody_no_files_limit == NOT_SET? parent -> reqbody_no_files_limit : child -> reqbody_no_files_limit ) ; merged -> resbody_access = ( child -> resbody_access == NOT_SET? parent -> resbody_access : child -> resbody_access ) ; merged -> of_limit = ( child -> of_limit == NOT_SET? parent -> of_limit : child -> of_limit ) ; merged -> if_limit_action = ( child -> if_limit_action == NOT_SET? parent -> if_limit_action : child -> if_limit_action ) ; merged -> of_limit_action = ( child -> of_limit_action == NOT_SET? parent

Fix:
<S2SV_ModStart> crypto_hash_framesrc_pm ) ; merged -> xml_external_entity = ( child -> xml_external_entity == NOT_SET? parent -> xml_external_entity : child -> xml_external_entity ) ;
Buggy code:
 static mif_hdr_t * mif_hdr_get ( jas_stream_t * in ) { <START_BUG> uchar magicbuf [ MIF_MAGICLEN ] ; <END_BUG> char buf [ 4096 ] ; mif_hdr_t * hdr ; bool done ; jas_tvparser_t * tvp ; int id ; hdr = 0 ; tvp = 0 ; if ( jas_stream_read ( in, magicbuf, MIF_MAGICLEN )!= MIF_MAGICLEN ) { goto error ; } if ( magicbuf [ 0 ]!= ( MIF_MAGIC >> 24 ) || magicbuf [ 1 ]!= ( ( MIF_MAGIC >> 16 ) & 0xff ) || magicbuf [ 2 ]!= ( ( MIF_MAGIC >> 8 ) & 0xff ) || magicbuf [ 3 ]!= ( MIF_MAGIC & 0xff ) ) { jas_eprintf ( "error:   bad   signature\\n" ) ; goto error ; } if (! ( hdr = mif_hdr_create ( 0 ) ) ) { goto error ; } done = false ; do { if (! mif_getline ( in, buf, sizeof ( buf ) ) ) { jas_eprintf ( "mif_getline   failed\\n" ) ; goto error ; } if ( buf [ 0 ] == '\\0' ) { continue ; } JAS_DBGLOG ( 10, ( "header   line:   len=%d;   %s\\n", strlen ( buf ), buf ) ) ; if (! ( tvp = jas_tvparser_create ( buf ) ) ) { jas_eprintf ( "jas_tvparser_create   failed\\n" ) ; goto error ; } if ( jas_tvparser_next ( tvp ) ) { jas_eprintf ( "cannot   get   record   type\\n" ) ; goto error ; } id = jas_taginfo_nonull ( jas_taginfos_lookup ( mif_tags2, jas_tvparser_gettag ( tvp ) ) ) -> id ; jas_tvparser_destroy ( tvp ) ; tvp = 0 ; switch ( id ) { case MIF_CMPT : if ( mif_process_cmpt ( hdr, buf ) )

Fix:
<S2SV_ModStart> in ) { jas_uchar <S2SV_ModEnd> magicbuf [ MIF_MAGICLEN
Buggy code:
 static struct fc_host_statistics * bfad_im_get_stats ( struct Scsi_Host * shost ) { struct bfad_im_port_s * im_port = ( struct bfad_im_port_s * ) shost -> hostdata [ 0 ] ; struct bfad_s * bfad = im_port -> bfad ; struct bfad_hal_comp fcomp ; union bfa_port_stats_u * fcstats ; struct fc_host_statistics * hstats ; bfa_status_t rc ; unsigned long flags ; fcstats = kzalloc ( sizeof ( union bfa_port_stats_u ), GFP_KERNEL ) ; if ( fcstats == NULL ) return NULL ; hstats = & bfad -> link_stats ; init_completion ( & fcomp. comp ) ; spin_lock_irqsave ( & bfad -> bfad_lock, flags ) ; memset ( hstats, 0, sizeof ( struct fc_host_statistics ) ) ; rc = bfa_port_get_stats ( BFA_FCPORT ( & bfad -> bfa ), fcstats, bfad_hcb_comp, & fcomp ) ; spin_unlock_irqrestore ( & bfad -> bfad_lock, flags ) ; <START_BUG> if ( rc!= BFA_STATUS_OK ) <END_BUG> return NULL ;  wait_for_completion ( & fcomp. comp ) ; <START_BUG> hstats -> seconds_since_last_reset = fcstats -> fc. secs_reset ; hstats -> tx_frames = fcstats -> fc. tx_frames ; hstats -> tx_words = fcstats -> fc. tx_words ; hstats -> rx_frames = fcstats -> fc. rx_frames ; hstats -> rx_words = fcstats -> fc. rx_words ; hstats -> lip_count = fcstats -> fc. lip_count ; hstats -> nos_count = fcstats -> fc. nos_count ; hstats -> error_frames = fcstats -> fc. error_frames ; hstats -> dumped_frames = fcstats -> fc. dropped_frames ; hstats -> link_failure_count = fcstats -> fc. link_failures ; hstats -> loss_of_sync_count = fcstats -> fc. loss_of_syncs<END_BUG>

Fix:
<S2SV_ModStart>!= BFA_STATUS_OK ) { kfree ( fcstats ) ; <S2SV_ModStart> return NULL ; }
Buggy code:
 static void first_pass_motion_search ( VP9_COMP * cpi, MACROBLOCK * x, const MV * ref_mv, MV * best_mv, int * best_motion_err ) { MACROBLOCKD * const xd = & x -> e_mbd ; MV tmp_mv = { 0, 0 } ; MV ref_mv_full = { ref_mv -> row >> 3, ref_mv -> col >> 3 } ; <START_BUG> int num00, tmp_err, n, sr = 0 ; <END_BUG> int step_param = 3 ; int further_steps = ( MAX_MVSEARCH_STEPS - 1 ) - step_param ; const BLOCK_SIZE bsize = xd -> mi [ 0 ] -> mbmi. sb_type ; vp9_variance_fn_ptr_t v_fn_ptr = cpi -> fn_ptr [ bsize ] ;  int new_mv_mode_penalty = 256 ; <START_BUG> <END_BUG> const int quart_frm = MIN ( cpi -> common. width, cpi -> common. height ) ;  while ( ( quart_frm << sr ) < MAX_FULL_PEL_VAL ) ++ sr ; step_param += sr ; further_steps -= sr ; v_fn_ptr. vf = get_block_variance_fn ( bsize ) ; <START_BUG> tmp_err = cpi -> diamond_search_sad ( x, & ref_mv_full, & tmp_mv, <END_BUG> step_param,  x -> sadperbit16, & num00, & v_fn_ptr, <START_BUG> x -> nmvjointcost, x -> mvcost, ref_mv ) ; if ( tmp_err < INT_MAX ) tmp_err = vp9_get_mvpred_var ( x, & tmp_mv, ref_mv, & v_fn_ptr, 1 ) ; if ( tmp_err < INT_MAX - new_mv_mode_penalty ) tmp_err += new_mv_mode_penalty ; if ( tmp_err < * best_motion_err ) { * best_motion_err = tmp_err ; <END_BUG> best_mv -> row = tmp_mv. row ;  best_mv -> col = tmp_mv. col ; } n = num00 ; num00 =

Fix:
<S2SV_ModStart> tmp_err, n <S2SV_ModEnd> ; const BLOCK_SIZE <S2SV_ModStart> bsize ] ; const <S2SV_ModStart> int new_mv_mode_penalty = NEW_MV_MODE_PENALTY ; int step_param = 3 ; int further_steps = ( MAX_MVSEARCH_STEPS - 1 ) - step_param <S2SV_ModEnd> ; const int <S2SV_ModStart> ; const int sr = get_search_range ( cpi ) <S2SV_ModEnd> ; step_param += <S2SV_ModStart> bsize ) ; # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { v_fn_ptr. vf = highbd_get_block_variance_fn ( bsize, xd -> bd ) ; } # endif <S2SV_ModStart> x, & cpi -> ss_cfg, & <S2SV_ModStart>, & v_fn_ptr <S2SV_ModEnd>, ref_mv ) <S2SV_ModStart> = tmp_err ; * best_mv = tmp_mv <S2SV_ModEnd> ; } n <S2SV_ModStart> diamond_search_sad ( x, & cpi -> ss_cfg <S2SV_ModStart> & v_fn_ptr, <S2SV_ModEnd> ref_mv ) ; <S2SV_ModStart> = tmp_err ; * best_mv = tmp_mv <S2SV_ModEnd> ;
Buggy code:
 <START_BUG> static int ip_options_get_finish ( struct net * net, struct ip_options * * optp, <END_BUG>  struct ip_options * opt, int optlen ) <START_BUG> { while ( optlen & 3 ) <END_BUG> opt -> __data [ optlen ++ ] = IPOPT_END ;  <START_BUG> opt -> optlen = optlen ; <END_BUG>  if ( optlen && ip_options_compile ( net, opt, NULL ) ) { <START_BUG> kfree ( opt ) ; return - EINVAL ; } kfree ( * optp ) ; * optp = opt ; return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> net, struct ip_options_rcu <S2SV_ModEnd> * * optp <S2SV_ModStart> optp, struct ip_options_rcu <S2SV_ModEnd> * opt, <S2SV_ModStart> ) opt -> opt. <S2SV_ModStart> ; opt -> opt. <S2SV_ModStart> ( net, & opt ->
Buggy code:
 static int ___sys_recvmsg ( struct socket * sock, struct msghdr __user * msg, struct msghdr * msg_sys, unsigned int flags, int nosec ) { struct compat_msghdr __user * msg_compat = ( struct compat_msghdr __user * ) msg ; struct iovec iovstack [ UIO_FASTIOV ] ; struct iovec * iov = iovstack ; unsigned long cmsg_ptr ; int err, total_len, len ; struct sockaddr_storage addr ; struct sockaddr __user * uaddr ; int __user * uaddr_len ; if ( MSG_CMSG_COMPAT & flags ) { if ( get_compat_msghdr ( msg_sys, msg_compat ) ) return - EFAULT ; } else { err = copy_msghdr_from_user ( msg_sys, msg ) ; if ( err ) return err ; } if ( msg_sys -> msg_iovlen > UIO_FASTIOV ) { err = - EMSGSIZE ; if ( msg_sys -> msg_iovlen > UIO_MAXIOV ) goto out ; err = - ENOMEM ; iov = kmalloc ( msg_sys -> msg_iovlen * sizeof ( struct iovec ), GFP_KERNEL ) ; if (! iov ) goto out ; } uaddr = ( __force void __user * ) msg_sys -> msg_name ; uaddr_len = COMPAT_NAMELEN ( msg ) ; <START_BUG> if ( MSG_CMSG_COMPAT & flags ) { <END_BUG> err = verify_compat_iovec ( msg_sys, iov, & addr, VERIFY_WRITE ) ;  } else <START_BUG> err = verify_iovec ( msg_sys, iov, & addr, VERIFY_WRITE ) ; if ( err < 0 ) goto out_freeiov ; total_len = err ; cmsg_ptr = ( unsigned long ) msg_sys -> msg_control ; <END_BUG> msg_sys -> msg_flags = flags & ( MSG_CMSG_CLOEXEC | MSG_CMSG_COMPAT ) ;  if ( sock -> file -> f_flags & O_NONBLOCK ) flags |= MSG_DONTWAIT ; err = ( nosec? sock_recvmsg_nosec : sock_recvmsg ) ( sock, msg

Fix:
<S2SV_ModStart> & flags ) <S2SV_ModEnd> err = verify_compat_iovec <S2SV_ModStart> VERIFY_WRITE ) ; <S2SV_ModEnd> else err = <S2SV_ModStart> | MSG_CMSG_COMPAT ) ; msg_sys -> msg_namelen = 0
Buggy code:
 static jas_image_cmpt_t * jas_image_cmpt_create ( int_fast32_t tlx, int_fast32_t tly, int_fast32_t hstep, int_fast32_t vstep, int_fast32_t width, int_fast32_t height, uint_fast16_t depth, bool sgnd, uint_fast32_t inmem ) { jas_image_cmpt_t * cmpt ; size_t size ; <START_BUG> cmpt = 0 ; <END_BUG> if ( width < 0 || height < 0 || hstep <= 0 || vstep <= 0 ) { goto error ; } if (! jas_safe_intfast32_add ( tlx, width, 0 ) || ! jas_safe_intfast32_add ( tly, height, 0 ) ) { <START_BUG> goto error ; } if (! ( cmpt = jas_malloc ( sizeof ( jas_image_cmpt_t ) ) ) ) { goto error ; } cmpt -> type_ = JAS_IMAGE_CT_UNKNOWN ; cmpt -> tlx_ = tlx ; cmpt -> tly_ = tly ; cmpt -> hstep_ = hstep ; cmpt -> vstep_ = vstep ; cmpt -> width_ = width ; cmpt -> height_ = height ; cmpt -> prec_ = depth ; cmpt -> sgnd_ = sgnd ; cmpt -> stream_ = 0 ; cmpt -> cps_ = ( depth + 7 ) // 8 ; <END_BUG> if (! jas_safe_size_mul ( cmpt -> width_, cmpt -> height_, & size ) || ! jas_safe_size_mul ( size, cmpt -> cps_, & size ) ) { goto error ; } cmpt -> stream_ = ( inmem )? jas_stream_memopen2 ( 0, size ) : jas_stream_tmpfile ( ) ; if (! cmpt -> stream_ ) { goto error ; } if ( size > 0 ) { if ( size - 1 > LONG_MAX ) { goto error ; } if ( jas_stream_seek ( cmpt -> stream_, size - 1, SEEK_SET ) < 0 || jas_stream_putc (

Fix:
<S2SV_ModStart> size_t size ; JAS_DBGLOG ( 100, ( "jas_image_cmpt_create(%ld, <S2SV_blank> %ld, <S2SV_blank> %ld, <S2SV_blank> %ld, <S2SV_blank> %ld, <S2SV_blank> %ld, <S2SV_blank> %d, <S2SV_blank> %d, <S2SV_blank> %d)\\n", JAS_CAST ( long, tlx ), JAS_CAST ( long, tly ), JAS_CAST ( long, hstep ), JAS_CAST ( long, vstep ), JAS_CAST ( long, width ), JAS_CAST ( long, height ), JAS_CAST ( int, depth ), sgnd, inmem ) ) ; <S2SV_ModStart> tly, height, 0 ) ) { goto error ; } if (! jas_safe_intfast32_mul3 ( width, height, depth <S2SV_ModStart> if (! jas_safe_size_mul3 <S2SV_ModEnd> ( cmpt -> <S2SV_ModStart> cmpt -> height_ <S2SV_ModEnd>, cmpt ->
Buggy code:
 static enum hrtimer_restart bfq_idle_slice_timer ( struct hrtimer * timer ) { struct bfq_data * bfqd = container_of ( timer, struct bfq_data, idle_slice_timer ) ; struct bfq_queue * bfqq = bfqd -> in_service_queue ; if ( bfqq ) <START_BUG> bfq_idle_slice_timer_body ( bfqq ) ; <END_BUG> return HRTIMER_NORESTART ; }

Fix:
<S2SV_ModStart> ) bfq_idle_slice_timer_body ( bfqd,
Buggy code:
 cJSON * cJSON_CreateStringArray ( const char * * strings, int count ) { int i ; cJSON * n = 0, * p = 0, * a = cJSON_CreateArray ( ) ; <START_BUG> for ( i = 0 ; a && i < count ; ++ i ) { <END_BUG> n = cJSON_CreateString ( strings [ i ] ) ;  if (! i ) <START_BUG> a -> child = n ; else suffix_object ( p, n ) ; p = n ; } return a ; }<END_BUG>

Fix:
<S2SV_ModStart> < count ; i ++ <S2SV_ModEnd> ) { n <S2SV_ModStart> ] ) ; if (! n ) { cJSON_Delete ( a ) ; return 0 ; }
Buggy code:
 static int encrypt ( struct blkcipher_desc * desc, struct scatterlist * dst, struct scatterlist * src, unsigned int nbytes ) { struct blkcipher_walk walk ; struct crypto_blkcipher * tfm = desc -> tfm ; struct salsa20_ctx * ctx = crypto_blkcipher_ctx ( tfm ) ; int err ; blkcipher_walk_init ( & walk, dst, src, nbytes ) ; err = blkcipher_walk_virt_block ( desc, & walk, 64 ) ; salsa20_ivsetup ( ctx, walk. iv ) ; <START_BUG> if ( likely ( walk. nbytes == nbytes ) ) <END_BUG> { salsa20_encrypt_bytes ( ctx, walk. dst. virt. addr, walk. src. virt. addr, nbytes ) ; return blkcipher_walk_done ( desc, & walk, 0 ) ; } while ( walk. nbytes >= 64 ) { salsa20_encrypt_bytes ( ctx, walk. dst. virt. addr, walk. src. virt. addr, walk. nbytes - ( walk. nbytes % 64 ) ) ; err = blkcipher_walk_done ( desc, & walk, walk. nbytes % 64 ) ; } if ( walk. nbytes ) { salsa20_encrypt_bytes ( ctx, walk. dst. virt. addr, walk. src. virt. addr, walk. nbytes ) ; err = blkcipher_walk_done ( desc, & walk, 0 ) ; } return err ; }

Fix:
<S2SV_ModStart> iv ) ; <S2SV_ModEnd> while ( walk
Buggy code:
 static int asf_build_simple_index ( AVFormatContext * s, int stream_index ) { ff_asf_guid g ; ASFContext * asf = s -> priv_data ; int64_t current_pos = avio_tell ( s -> pb ) ; int64_t ret ; if ( ( ret = avio_seek ( s -> pb, asf -> data_object_offset + asf -> data_object_size, SEEK_SET ) ) < 0 ) { return ret ; } if ( ( ret = ff_get_guid ( s -> pb, & g ) ) < 0 ) goto end ; while ( ff_guidcmp ( & g, & ff_asf_simple_index_header ) ) { int64_t gsize = avio_rl64 ( s -> pb ) ; if ( gsize < 24 || avio_feof ( s -> pb ) ) { goto end ; } avio_skip ( s -> pb, gsize - 24 ) ; if ( ( ret = ff_get_guid ( s -> pb, & g ) ) < 0 ) goto end ; } { int64_t itime, last_pos = - 1 ; int pct, ict ; int i ; int64_t av_unused gsize = avio_rl64 ( s -> pb ) ; if ( ( ret = ff_get_guid ( s -> pb, & g ) ) < 0 ) goto end ; itime = avio_rl64 ( s -> pb ) ; pct = avio_rl32 ( s -> pb ) ; ict = avio_rl32 ( s -> pb ) ; av_log ( s, AV_LOG_DEBUG, "itime:0x%" PRIx64 ",   pct:%d,   ict:%d\\n", itime, pct, ict ) ; for ( i = 0 ; i < ict ; i ++ ) { int pktnum = avio_rl32 ( s -> pb ) ; int pktct = avio_rl16 ( s -> pb ) ; int64_t pos = s -> internal -> data_offset + s -> packet_size * ( int64_t ) pktnum ; <START_BUG> int64_t index_pts = FFMAX ( av_rescale ( itime<END_BUG>

Fix:
<S2SV_ModStart> 0 ) ; if ( avio_feof ( s -> pb ) ) { ret = AVERROR_INVALIDDATA ; goto end ; }
Buggy code:
 VOID ixheaacd_esbr_postradixcompute2 ( WORD32 * ptr_y, WORD32 * ptr_x, const WORD32 * pdig_rev_tbl, WORD32 npoints ) { WORD32 i, k ; WORD32 h2 ; WORD32 x_0, x_1, x_2, x_3 ; WORD32 x_4, x_5, x_6, x_7 ; <START_BUG> WORD32 x_8, x_9, x_a, x_b, x_c, x_d, x_e, x_f ; <END_BUG> WORD32 n00, n10, n20, n30, n01, n11, n21, n31 ; WORD32 n02, n12, n22, n32, n03, n13, n23, n33 ; WORD32 n0, j0 ; WORD32 * x2, * x0 ; WORD32 * y0, * y1, * y2, * y3 ; y0 = ptr_y ; y2 = ptr_y + ( WORD32 ) npoints ; x0 = ptr_x ; x2 = ptr_x + ( WORD32 ) ( npoints >> 1 ) ; y1 = y0 + ( WORD32 ) ( npoints >> 2 ) ; y3 = y2 + ( WORD32 ) ( npoints >> 2 ) ; j0 = 8 ; n0 = npoints >> 1 ; for ( k = 0 ; k < 2 ; k ++ ) { for ( i = 0 ; i < npoints >> 1 ; i += 8 ) { h2 = * pdig_rev_tbl ++ >> 2 ; x_0 = * x0 ++ ; x_1 = * x0 ++ ; x_2 = * x0 ++ ; x_3 = * x0 ++ ; x_4 = * x0 ++ ; x_5 = * x0 ++ ; x_6 = * x0 ++ ; x_7 = * x0 ++ ;  n00 = x_0 + x_2 ; <START_BUG> n01 = x_1 + x_3 ; n20 = x_0 - x_2 ; n21 = x_1 - x_3 ; n10 = x_4 + x_6 ; n11 = x_5 + x_7 ;<END_BUG>

Fix:
<S2SV_ModStart> x_e, x_f <S2SV_ModEnd> ; WORD32 n0 <S2SV_ModStart> x0 ++ ; y0 [ h2 ] = ixheaacd_add32_sat ( x_0, x_2 ) ; y0 [ h2 + 1 ] = ixheaacd_add32_sat ( x_1, x_3 ) ; y1 [ h2 ] = ixheaacd_add32_sat ( x_4, x_6 ) ; y1 [ h2 + 1 ] = ixheaacd_add32_sat ( x_5, x_7 ) ; y2 [ h2 ] = ixheaacd_sub32_sat ( x_0, x_2 ) ; y2 [ h2 + 1 ] = ixheaacd_sub32_sat ( x_1, x_3 ) ; y3 [ h2 ] = ixheaacd_sub32_sat ( x_4, x_6 ) ; y3 [ h2 + 1 ] = ixheaacd_sub32_sat ( x_5, x_7 ) ; x_8 = * x2 ++ ; x_
Buggy code:
 WORD32 ih264d_video_decode ( iv_obj_t * dec_hdl, void * pv_api_ip, void * pv_api_op ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ( dec_hdl -> pv_codec_handle ) ; WORD32 i4_err_status = 0 ; UWORD8 * pu1_buf = NULL ; WORD32 buflen ; UWORD32 u4_max_ofst, u4_length_of_start_code = 0 ; UWORD32 bytes_consumed = 0 ; UWORD32 cur_slice_is_nonref = 0 ; UWORD32 u4_next_is_aud ; UWORD32 u4_first_start_code_found = 0 ; WORD32 ret = 0, api_ret_value = IV_SUCCESS ; WORD32 header_data_left = 0, frame_data_left = 0 ; UWORD8 * pu1_bitstrm_buf ; ivd_video_decode_ip_t * ps_dec_ip ; ivd_video_decode_op_t * ps_dec_op ; ithread_set_name ( ( void * ) "Parse_thread" ) ; ps_dec_ip = ( ivd_video_decode_ip_t * ) pv_api_ip ; ps_dec_op = ( ivd_video_decode_op_t * ) pv_api_op ; { UWORD32 u4_size ; u4_size = ps_dec_op -> u4_size ; memset ( ps_dec_op, 0, sizeof ( ivd_video_decode_op_t ) ) ; ps_dec_op -> u4_size = u4_size ; } ps_dec -> pv_dec_out = ps_dec_op ; if ( ps_dec -> init_done!= 1 ) { return IV_FAIL ; } DATA_SYNC ( ) ; if ( 0 == ps_dec -> u1_flushfrm ) { if ( ps_dec_ip -> pv_stream_buffer == NULL ) { ps_dec_op -> u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM ; ps_dec_op -> u4_error_code |= IVD_DEC_FRM_

Fix:
<S2SV_ModStart> == ERROR_UNAVAIL_MVBUF_T ) || ( ret == ERROR_INV_SPS_PPS_T ) ) { ps_dec -> u4_slice_start_code_found = 0 ; <S2SV_ModEnd> break ; } <S2SV_ModStart> == ERROR_UNAVAIL_MVBUF_T ) || ( ret == ERROR_INV_SPS_PPS_T )
Buggy code:
 static int errorLogDirective ( MaState * state, cchar * key, cchar * value ) { MprTicks stamp ; char * option, * ovalue, * tok, * path ; ssize size ; int level, flags, backup ; if ( mprGetCmdlineLogging ( ) ) { mprLog ( "info   appweb   config", 4, "Already   logging.   Ignoring   ErrorLog   directive" ) ; return 0 ; } size = MAXINT ; stamp = 0 ; level = 0 ; backup = 0 ; path = 0 ; flags = 0 ; for ( option = maGetNextArg ( sclone ( value ), & tok ) ; option ; option = maGetNextArg ( tok, & tok ) ) { if (! path ) { path = mprJoinPath ( httpGetRouteVar ( state -> route, "LOG_DIR" ), httpExpandRouteVars ( state -> route, option ) ) ; } else { <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if ( smatch ( option, "size" ) ) { size = ( ssize ) getnum ( ovalue ) ; } else if ( smatch ( option, "level" ) ) { level = atoi ( ovalue ) ; } else if ( smatch ( option, "backup" ) ) { backup = atoi ( ovalue ) ; } else if ( smatch ( option, "anew" ) ) { flags |= MPR_LOG_ANEW ; } else if ( smatch ( option, "stamp" ) ) { stamp = httpGetTicks ( ovalue ) ; } else { mprLog ( "error   appweb   config", 0, "Unknown   ErrorLog   option   %s", option ) ; } } } if ( size < ( 10 * 1000 ) ) { mprLog ( "error   appweb   config", 0, "Size   is   too   small.   Must   be   larger   than   10K" ) ; return MPR_ERR_BAD_SYNTAX ; } if ( path == 0 ) { mprLog ( "error   appweb   config", 0, "Missing   filename" ) ; return MPR_ERR_

Fix:
<S2SV_ModStart> { option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 void vp9_setup_scale_factors_for_frame ( struct scale_factors * sf, int other_w, int other_h, int this_w, int this_h ) { <START_BUG> if (! check_scale_factors ( other_w, other_h, this_w, this_h ) ) { <END_BUG> sf -> x_scale_fp = REF_INVALID_SCALE ; sf -> y_scale_fp = REF_INVALID_SCALE ; return ; } sf -> x_scale_fp = get_fixed_point_scale_factor ( other_w, this_w ) ; sf -> y_scale_fp = get_fixed_point_scale_factor ( other_h, this_h ) ; sf -> x_step_q4 = scaled_x ( 16, sf ) ; sf -> y_step_q4 = scaled_y ( 16, sf ) ; if ( vp9_is_scaled ( sf ) ) { sf -> scale_value_x = scaled_x ; sf -> scale_value_y = scaled_y ; } else { sf -> scale_value_x = unscaled_value ; sf -> scale_value_y = unscaled_value ; } if ( sf -> x_step_q4 == 16 ) { if ( sf -> y_step_q4 == 16 ) {  sf -> predict [ 0 ] [ 0 ] [ 0 ] = vp9_convolve_copy ; <START_BUG> sf -> predict [ 0 ] [ 0 ] [ 1 ] = vp9_convolve_avg ; sf -> predict [ 0 ] [ 1 ] [ 0 ] = vp9_convolve8_vert ; sf -> predict [ 0 ] [ 1 ] [ 1 ] = vp9_convolve8_avg_vert ; sf -> predict [ 1 ] [ 0 ] [ 0 ] = vp9_convolve8_horiz ; sf -> predict [ 1 ] [ 0 ] [ 1 ] = vp9_convolve8_avg_horiz ; } else { <END_BUG> sf -> predict [ 0 ] [ 0 ] [ 0 ] = vp9_convolve8_vert ;  sf -> predict [ 0 ] [ 0 ] [ 1 ] = vp9_convolve8_avg_vert ; sf -> predict [ 0 ] [ 1 ] [ 0 ] = vp9_convolve8_vert ; sf -> predict [ 0 ] [ 1

Fix:
<S2SV_ModStart> this_h ) { # endif <S2SV_ModStart> if (! valid_ref_frame_size <S2SV_ModEnd> ( other_w, <S2SV_ModStart> 0 ] = vpx_convolve_copy ; sf -> predict [ 0 ] [ 0 ] [ 1 ] = vpx_convolve_avg ; sf -> predict [ 0 ] [ 1 ] [ 0 ] = vpx_convolve8_vert ; sf -> predict [ 0 ] [ 1 ] [ 1 ] = vpx_convolve8_avg_vert ; sf -> predict [ 1 ] [ 0 ] [ 0 ] = vpx_convolve8_horiz ; sf -> predict [ 1 ] [ 0 ] [ 1 ] = vpx_convolve8_avg_horiz <S2SV_ModEnd> ; } else <S2SV_ModStart> 0 ] = vpx_scaled_vert ; sf -> predict [ 0 ] [ 0 ] [ 1 ] = vpx_scaled_avg_vert ; sf -> predict [ 0 ] [ 1 ] [ 0 ] = vpx_scaled_vert ; sf -> predict [ 0 ] [ 1 ] [ 1 ] = vpx_scaled_avg_vert ; sf -> predict [ 1 ] [ 0 ] [ 0 ] = vpx_scaled_2d ; sf -> predict
Buggy code:
 static int ext4_end_io_nolock ( ext4_io_end_t * io ) { struct inode * inode = io -> inode ; loff_t offset = io -> offset ; ssize_t size = io -> size ; int ret = 0 ; ext4_debug ( "ext4_end_io_nolock:   io   0x%p   from   inode   %lu,list->next   0x%p," "list->prev   0x%p\\n", io, inode -> i_ino, io -> list. next, io -> list. prev ) ; if ( list_empty ( & io -> list ) ) return ret ; if ( io -> flag!= EXT4_IO_UNWRITTEN ) return ret ; <START_BUG> if ( offset + size <= i_size_read ( inode ) ) <END_BUG> ret = ext4_convert_unwritten_extents ( inode, offset, size ) ; if ( ret < 0 ) { printk ( KERN_EMERG "%s:   failed   to   convert   unwritten" "extents   to   written   extents,   error   is   %d" "   io   is   still   on   inode   %lu   aio   dio   list\\n", __func__, ret, inode -> i_ino ) ; return ret ; } io -> flag = 0 ; return ret ; }

Fix:
<S2SV_ModStart> return ret ; <S2SV_ModEnd> ret = ext4_convert_unwritten_extents
Buggy code:
 boolean proc_wizkit_line ( buf ) char * buf ; { <START_BUG> struct obj * otmp = readobjnam ( buf, ( struct obj * ) 0 ) ; <END_BUG> if ( otmp ) { if ( otmp!= & zeroobj ) wizkit_addinv ( otmp ) ; } else { config_error_add ( "Bad   wizkit   item:   \\"%.60s\\"", buf ) ; return FALSE ; } return TRUE ; }

Fix:
<S2SV_ModStart> struct obj * otmp ; if ( strlen ( buf ) >= BUFSZ ) buf [ BUFSZ - 1 ] = '\\0' ;
Buggy code:
 static int calc_iframe_target_size_one_pass_cbr ( const VP9_COMP * cpi ) { <START_BUG> const RATE_CONTROL * rc = & cpi -> rc ; <END_BUG> int target ; if ( cpi -> common. current_video_frame == 0 ) {  target = ( ( cpi -> oxcf. starting_buffer_level // 2 ) > INT_MAX ) <START_BUG> <END_BUG>? INT_MAX : ( int ) ( cpi -> oxcf. starting_buffer_level // 2 ) ;  } else { const int initial_boost = 32 ; <START_BUG> int kf_boost = MAX ( initial_boost, ( int ) ( 2 * cpi -> output_framerate - 16 ) ) ; <END_BUG>  if ( rc -> frames_since_key < cpi -> output_framerate // 2 ) { <START_BUG> kf_boost = ( int ) ( kf_boost * rc -> frames_since_key // <END_BUG> ( cpi -> output_framerate // 2 ) ) ;  } <START_BUG> target = ( ( 16 + kf_boost ) * rc -> av_per_frame_bandwidth ) >> 4 ; <END_BUG> } return vp9_rc_clamp_iframe_target_size ( cpi, target ) ; }

Fix:
<S2SV_ModStart> cpi -> rc ; const VP9EncoderConfig * oxcf = & cpi -> oxcf ; const SVC * const svc = & cpi -> svc <S2SV_ModStart> = ( ( rc -> <S2SV_ModEnd> starting_buffer_level // 2 <S2SV_ModStart> int ) ( rc -> starting_buffer_level // 2 ) ; } else { int kf_boost = 32 ; double framerate = cpi -> framerate ; if ( svc -> number_temporal_layers > 1 && oxcf -> rc_mode == VPX_CBR ) { const int layer = LAYER_IDS_TO_IDX ( svc -> spatial_layer_id, svc -> temporal_layer_id, svc -> number_temporal_layers ) ; const LAYER_CONTEXT * lc = & svc -> layer_context [ layer ] ; framerate = lc -> framerate ; } <S2SV_ModEnd> kf_boost = MAX <S2SV_ModStart> = MAX ( kf_boost, ( int ) ( 2 * framerate <S2SV_ModEnd> - 16 ) <S2SV_ModStart> -> frames_since_key < framerate <S2SV_ModEnd> // 2 ) <S2SV_ModStart> frames_since_key // ( framerate <S2SV_ModEnd> // 2 ) <S2SV_ModStart> * rc -> avg_frame_bandwidth <S2SV_ModEnd> ) >> 4
Buggy code:
 static int gtco_probe ( struct usb_interface * usbinterface, const struct usb_device_id * id ) { struct gtco * gtco ; struct input_dev * input_dev ; struct hid_descriptor * hid_desc ; char * report ; int result = 0, retry ; int error ; struct usb_endpoint_descriptor * endpoint ; gtco = kzalloc ( sizeof ( struct gtco ), GFP_KERNEL ) ; input_dev = input_allocate_device ( ) ; if (! gtco ||! input_dev ) { dev_err ( & usbinterface -> dev, "No   more   memory\\n" ) ; error = - ENOMEM ; goto err_free_devs ; } gtco -> inputdevice = input_dev ; gtco -> usbdev = interface_to_usbdev ( usbinterface ) ; gtco -> intf = usbinterface ; gtco -> buffer = usb_alloc_coherent ( gtco -> usbdev, REPORT_MAX_SIZE, GFP_KERNEL, & gtco -> buf_dma ) ; if (! gtco -> buffer ) { dev_err ( & usbinterface -> dev, "No   more   memory   for   us   buffers\\n" ) ; error = - ENOMEM ; goto err_free_devs ; } gtco -> urbinfo = usb_alloc_urb ( 0, GFP_KERNEL ) ; if (! gtco -> urbinfo ) { dev_err ( & usbinterface -> dev, "Failed   to   allocate   URB\\n" ) ; error = - ENOMEM ; goto err_free_buf ; } <START_BUG> endpoint = & usbinterface -> altsetting [ 0 ]. endpoint [ 0 ]. desc ; <END_BUG> dev_dbg ( & usbinterface -> dev, "gtco   #   interfaces:   %d\\n", usbinterface -> num_altsetting ) ; dev_dbg ( & usbinterface -> dev, "num   endpoints:           %d\\n", usbinterface -> cur_altsetting -> desc. bNumEndpoints ) ; dev_dbg ( & usbinterface -> dev, "interface   class:       %d\\n", usbinterface -> cur_altsetting -> desc. bInterface

Fix:
<S2SV_ModStart> err_free_buf ; } if ( usbinterface -> altsetting [ 0 ]. desc. bNumEndpoints < 1 ) { dev_err ( & usbinterface -> dev, "Invalid <S2SV_blank> number <S2SV_blank> of <S2SV_blank> endpoints\\n" ) ; error = - EINVAL ; goto err_free_urb ; }
Buggy code:
 static inline int unuse_pmd_range ( struct vm_area_struct * vma, pud_t * pud, unsigned long addr, unsigned long end, swp_entry_t entry, struct page * page ) { pmd_t * pmd ; unsigned long next ; int ret ; pmd = pmd_offset ( pud, addr ) ; do { next = pmd_addr_end ( addr, end ) ; <START_BUG> if ( unlikely ( pmd_trans_huge ( * pmd ) ) ) <END_BUG> continue ; if ( pmd_none_or_clear_bad ( pmd ) ) continue ; ret = unuse_pte_range ( vma, pmd, addr, next, entry, page ) ; if ( ret ) return ret ; } while ( pmd ++, addr = next, addr!= end ) ; return 0 ; }

Fix:
<S2SV_ModStart> ; if ( pmd_none_or_trans_huge_or_clear_bad <S2SV_ModEnd> ( pmd )
Buggy code:
 int ca_validate_pubkey ( struct iked * env, struct iked_static_id * id, void * data, size_t len, struct iked_id * out ) { BIO * rawcert = NULL ; RSA * peerrsa = NULL, * localrsa = NULL ; EC_KEY * peerec = NULL ; EVP_PKEY * peerkey = NULL, * localkey = NULL ; int ret = - 1 ; FILE * fp = NULL ; char idstr [ IKED_ID_SIZE ] ; char file [ PATH_MAX ] ; struct iked_id idp ; switch ( id -> id_type ) { case IKEV2_ID_IPV4 : case IKEV2_ID_FQDN : case IKEV2_ID_UFQDN : case IKEV2_ID_IPV6 : break ; default : log_debug ( "%s:   unsupported   public   key   type   %s", __func__, print_map ( id -> id_type, ikev2_id_map ) ) ; return ( - 1 ) ; } bzero ( & idp, sizeof ( idp ) ) ; if ( ( idp. id_buf = ibuf_new ( id -> id_data, id -> id_length ) ) == NULL ) goto done ; idp. id_type = id -> id_type ; idp. id_offset = id -> id_offset ; if ( ikev2_print_id ( & idp, idstr, sizeof ( idstr ) ) == - 1 ) goto done ; if ( len == 0 && data ) { peerkey = ( EVP_PKEY * ) data ; } if ( len > 0 ) { if ( ( rawcert = BIO_new_mem_buf ( data, len ) ) == NULL ) goto done ; if ( ( peerkey = EVP_PKEY_new ( ) ) == NULL ) goto sslerr ; if ( ( peerrsa = d2i_RSAPublicKey_bio ( rawcert, NULL ) ) ) { if (! EVP_PKEY_set1_RSA ( peerkey, peerrsa ) ) { goto sslerr ; } } else if ( BIO_reset ( rawcert ) == 1 && ( peerec = d2i_EC_PUBKEY_bio ( rawcert, NULL ) )

Fix:
<S2SV_ModStart> ( peerkey && <S2SV_ModEnd> EVP_PKEY_cmp ( peerkey <S2SV_ModStart>, localkey )!= 1
Buggy code:
 int libevt_record_values_read_event ( libevt_record_values_t * record_values, uint8_t * record_data, size_t record_data_size, uint8_t strict_mode, libcerror_error_t * * error ) { static char * function = "libevt_record_values_read_event" ; size_t record_data_offset = 0 ; size_t strings_data_offset = 0 ; ssize_t value_data_size = 0 ; uint32_t data_offset = 0 ; uint32_t data_size = 0 ; uint32_t members_data_size = 0 ; uint32_t size = 0 ; uint32_t size_copy = 0 ; uint32_t strings_offset = 0 ; uint32_t strings_size = 0 ; uint32_t user_sid_offset = 0 ; uint32_t user_sid_size = 0 ; # if defined ( HAVE_DEBUG_OUTPUT ) uint32_t value_32bit = 0 ; uint16_t value_16bit = 0 ; # endif if ( record_values == NULL ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s:   invalid   record   values.", function ) ; return ( - 1 ) ; } if ( record_data == NULL ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s:   invalid   record   data.", function ) ; return ( - 1 ) ; } if ( record_data_size > ( size_t ) SSIZE_MAX ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s:   invalid   record   data   size   value   exceeds   maximum.", function ) ; return ( - 1 ) ; } if ( record_data_size < ( sizeof ( evt_record_event_header_t ) + 4 ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_

Fix:
<S2SV_ModStart> { if ( user_sid_size > ( ( record_data_size - 4 ) - user_sid_offset ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: <S2SV_blank> user <S2SV_blank> SID <S2SV_blank> data <S2SV_blank> size <S2SV_blank> value <S2SV_blank> out <S2SV_blank> of <S2SV_blank> bounds.", function ) ; goto on_error ; } if ( <S2SV_ModStart> 0 ) { if ( strings_size > ( ( record_data_size - 4 ) - strings_offset ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: <S2SV_blank> strings <S2SV_blank> size <S2SV_blank> value <S2SV_blank> out <S2SV_blank> of <S2SV_blank> bounds.", function ) ; goto on_error ; } <S2SV_ModStart> 0 ) { if ( data_size > ( ( record_data_size - 4 ) - record_data_offset ) ) { libcerror_error_set ( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE
Buggy code:
 static const char * cmd_hash_engine ( cmd_parms * cmd, void * _dcfg, const char * p1 ) { directory_config * dcfg = ( directory_config * ) _dcfg ; if ( dcfg == NULL ) return NULL ; if ( strcasecmp ( p1, "on" ) == 0 ) { dcfg -> hash_is_enabled = HASH_ENABLED ; dcfg -> hash_enforcement = HASH_ENABLED ; } else if ( strcasecmp ( p1, "off" ) == 0 ) { dcfg -> hash_is_enabled = HASH_DISABLED ; dcfg -> hash_enforcement = HASH_DISABLED ; } <START_BUG> else return apr_psprintf ( cmd -> pool, "ModSecurity:   Invalid   value   for   SecRuleEngine:   %s", p1 ) ; <END_BUG> return NULL ; }

Fix:
<S2SV_ModStart> -> pool, "ModSecurity: <S2SV_blank> Invalid <S2SV_blank> value <S2SV_blank> for <S2SV_blank> SexHashEngine: <S2SV_blank> %s" <S2SV_ModEnd>, p1 )
Buggy code:
 static int virtualHostDirective ( MaState * state, cchar * key, cchar * value ) { state = maPushState ( state ) ; if ( state -> enabled ) { state -> route = httpCreateInheritedRoute ( httpGetHostDefaultRoute ( state -> host ) ) ; state -> route -> ssl = 0 ; state -> auth = state -> route -> auth ; state -> host = httpCloneHost ( state -> host ) ; httpResetRoutes ( state -> host ) ; httpSetRouteHost ( state -> route, state -> host ) ; httpSetHostDefaultRoute ( state -> host, state -> route ) ; if ( value ) { <START_BUG> httpSetHostName ( state -> host, stok ( sclone ( value ), "   \\t,", NULL ) ) ; <END_BUG> httpSetRouteName ( state -> route, sfmt ( "default-%s", state -> host -> name ) ) ; state -> endpoints = sclone ( value ) ; } } return 0 ; }

Fix:
<S2SV_ModStart> -> host, ssplit <S2SV_ModEnd> ( sclone (
Buggy code:
 static void set_ppflags ( const vpx_codec_alg_priv_t * ctx, vp9_ppflags_t * flags ) { flags -> post_proc_flag = <START_BUG> # if CONFIG_POSTPROC_VISUALIZER <END_BUG> ( ctx -> dbg_color_ref_frame_flag? VP9D_DEBUG_CLR_FRM_REF_BLKS : 0 ) | ( ctx -> dbg_color_mb_modes_flag? VP9D_DEBUG_CLR_BLK_MODES : 0 ) | ( ctx -> dbg_color_b_modes_flag? VP9D_DEBUG_CLR_BLK_MODES : 0 ) | ( ctx -> dbg_display_mv_flag? VP9D_DEBUG_DRAW_MV : 0 ) | # endif ctx -> postproc_cfg. post_proc_flag ; flags -> deblocking_level = ctx -> postproc_cfg. deblocking_level ; flags -> noise_level = ctx -> postproc_cfg. noise_level ;  # if CONFIG_POSTPROC_VISUALIZER <START_BUG> flags -> display_ref_frame_flag = ctx -> dbg_color_ref_frame_flag ; flags -> display_mb_modes_flag = ctx -> dbg_color_mb_modes_flag ; flags -> display_b_modes_flag = ctx -> dbg_color_b_modes_flag ; flags -> display_mv_flag = ctx -> dbg_display_mv_flag ; # endif }<END_BUG>

Fix:
<S2SV_ModStart> -> post_proc_flag = <S2SV_ModEnd> ctx -> postproc_cfg <S2SV_ModStart>. noise_level ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 <START_BUG> static void kgdb_hw_overflow_handler ( struct perf_event * event, int nmi, <END_BUG> struct perf_sample_data * data, struct pt_regs * regs ) { struct task_struct * tsk = current ; int i ; for ( i = 0 ; i < 4 ; i ++ ) if ( breakinfo [ i ]. enabled ) tsk -> thread. debugreg6 |= ( DR_TRAP0 << i ) ; }

Fix:
<S2SV_ModStart> perf_event * event <S2SV_ModEnd>, struct perf_sample_data
Buggy code:
 static grub_disk_addr_t grub_ext2_read_block ( grub_fshelp_node_t node, grub_disk_addr_t fileblock ) { struct grub_ext2_data * data = node -> data ; struct grub_ext2_inode * inode = & node -> inode ; int blknr = - 1 ; unsigned int blksz = EXT2_BLOCK_SIZE ( data ) ; int log2_blksz = LOG2_EXT2_BLOCK_SIZE ( data ) ; if ( grub_le_to_cpu32 ( inode -> flags ) & EXT4_EXTENTS_FLAG ) { <START_BUG> # ifndef _MSC_VER <END_BUG>  char buf [ EXT2_BLOCK_SIZE ( data ) ] ; <START_BUG> # else char * buf = grub_malloc ( EXT2_BLOCK_SIZE ( data ) ) ; # endif struct grub_ext4_extent_header * leaf ; struct grub_ext4_extent * ext ; int i ; leaf = grub_ext4_find_leaf ( data, buf, ( struct grub_ext4_extent_header * ) inode -> blocks. dir_blocks, fileblock ) ; if (! leaf ) { <END_BUG> grub_error ( GRUB_ERR_BAD_FS, "invalid   extent" ) ;  return - 1 ; } ext = ( struct grub_ext4_extent * ) ( leaf + 1 ) ; for ( i = 0 ; i < grub_le_to_cpu16 ( leaf -> entries ) ; i ++ ) { if ( fileblock < grub_le_to_cpu32 ( ext [ i ]. block ) ) break ; } if ( -- i >= 0 ) { fileblock -= grub_le_to_cpu32 ( ext [ i ]. block ) ; <START_BUG> if ( fileblock >= grub_le_to_cpu16 ( ext [ i ]. len ) ) <END_BUG> return 0 ;  else <START_BUG> { grub_disk_addr_t start ; start = grub_le_to_cpu16 ( ext [ i ]. start_hi ) ; start = ( start << 32 ) + grub_le_to_cpu32 ( ext [ i ]. start ) ; <END_BUG> return fileblock + start ;  } } else { grub_

Fix:
<S2SV_ModStart> EXT4_EXTENTS_FLAG ) { char * buf = grub_malloc ( <S2SV_ModEnd> EXT2_BLOCK_SIZE ( data <S2SV_ModStart> ( data ) ) ; if (! buf ) { return - 1 ; } <S2SV_ModEnd> struct grub_ext4_extent_header * <S2SV_ModStart> GRUB_ERR_BAD_FS, "invalid <S2SV_blank> extent" ) ; free ( buf <S2SV_ModStart> len ) ) { free ( buf ) ; <S2SV_ModStart> return 0 ; } <S2SV_ModStart> start ) ; free ( buf ) ; <S2SV_ModStart> "something <S2SV_blank> wrong <S2SV_blank> with <S2SV_blank> extent" ) ; free ( buf ) ; <S2SV_ModStart> 1 ; } free ( buf ) ; <S2SV_ModStart>! indir ) { <S2SV_ModStart> return grub_errno ; } <S2SV_ModStart> indir ) ) { <S2SV_ModStart> return grub_errno ; } <S2SV_ModStart>! indir ) { <S2SV_ModStart> return grub_errno ; } <S2SV_ModStart> indir ) ) { <S2SV_ModStart> return grub_errno ; } <S2SV_ModStart> indir ) ) { <S2SV_ModStart> return grub_errno ; }
Buggy code:
 static int <START_BUG> cib_tls_signon ( cib_t * cib, struct remote_connection_s * connection ) <END_BUG> { int sock ; cib_remote_opaque_t * private = cib -> variant_opaque ;  struct sockaddr_in addr ; <START_BUG> int rc = 0 ; <END_BUG> char * server = private -> server ;  int ret_ga ; struct addrinfo * res ; struct addrinfo hints ; xmlNode * answer = NULL ; xmlNode * login = NULL ; static struct mainloop_fd_callbacks cib_fd_callbacks = <START_BUG> { <END_BUG> . dispatch = cib_remote_dispatch, <START_BUG> <END_BUG>. destroy = cib_remote_connection_destroy,  } ; connection -> socket = 0 ; connection -> session = NULL ; <START_BUG> sock = socket ( PF_INET, SOCK_STREAM, IPPROTO_TCP ) ; <END_BUG> if ( sock == - 1 ) { crm_perror ( LOG_ERR, "Socket   creation   failed" ) ; return - 1 ; } bzero ( & hints, sizeof ( struct addrinfo ) ) ; hints. ai_flags = AI_CANONNAME ; hints. ai_family = AF_INET ; hints. ai_socktype = SOCK_RAW ; if ( hints. ai_family == AF_INET6 ) { hints. ai_protocol = IPPROTO_ICMPV6 ; } else { hints. ai_protocol = IPPROTO_ICMP ; } crm_debug ( "Looking   up   %s", server ) ; ret_ga = getaddrinfo ( server, NULL, & hints, & res ) ; if ( ret_ga ) { crm_err ( "getaddrinfo:   %s", gai_strerror ( ret_ga ) ) ; close ( sock ) ; return - 1 ; } if ( res -> ai_canonname ) { server = res -> ai_canonname ; } crm_debug ( "Got   address   %s   for   %s", server, private -> server ) ; if (! res -> ai_addr ) { fprintf ( stderr, "getaddrinfo   failed" ) ; crm_exit ( 1 ) ; } # if 1 memcpy ( & addr, res -> ai_addr, res -> ai_addrlen ) ; # else memset ( & addr

Fix:
<S2SV_ModStart> remote_connection_s * connection, gboolean event_channel <S2SV_ModStart> -> variant_opaque ; <S2SV_ModEnd> int rc = <S2SV_ModStart> = 0 ; int disconnected = 0 <S2SV_ModEnd> ; xmlNode * <S2SV_ModStart> mainloop_fd_callbacks cib_fd_callbacks = { 0, } ; cib_fd_callbacks <S2SV_ModEnd>. dispatch = <S2SV_ModStart>. dispatch = event_channel? cib_remote_callback_dispatch : cib_remote_command_dispatch ; cib_fd_callbacks <S2SV_ModEnd>. destroy = <S2SV_ModStart> destroy = cib_remote_connection_destroy <S2SV_ModEnd> ; connection -> <S2SV_ModStart> ; sock = crm_remote_tcp_connect ( private -> server, private -> port ) ; if ( sock <= 0 ) { crm_perror ( LOG_ERR, "remote <S2SV_blank> tcp <S2SV_blank> connection <S2SV_blank> to <S2SV_blank> %s:%d <S2SV_blank> failed", private -> server, private -> port ) ; } connection -> socket = sock ; <S2SV_ModEnd> if ( connection <S2SV_ModStart> # ifdef HAVE_GNUTLS_GNUTLS_H if ( remote_gnutls_credentials_init == FALSE ) { <S2SV_ModStart> anon_cred_c ) ; remote_gnutls_credentials_init = TRUE ; } connection -> session = crm_
Buggy code:
 static int ng_pkt ( git_pkt * * out, const char * line, size_t len ) { git_pkt_ng * pkt ; const char * ptr ; size_t alloclen ; pkt = git__malloc ( sizeof ( * pkt ) ) ; GITERR_CHECK_ALLOC ( pkt ) ; pkt -> ref = NULL ; pkt -> type = GIT_PKT_NG ; <START_BUG> line += 3 ; <END_BUG>  if (! ( ptr = strchr ( line,' ') ) ) <START_BUG> goto out_err ; len = ptr - line ; GITERR_CHECK_ALLOC_ADD ( & alloclen, len, 1 ) ; pkt -> ref = git__malloc ( alloclen ) ; GITERR_CHECK_ALLOC ( pkt -> ref ) ; memcpy ( pkt -> ref, line, len ) ; pkt -> ref [ len ] = '\\0' ; <END_BUG> line = ptr + 1 ;  <START_BUG> if (! ( ptr = strchr ( line, '\\n' ) ) ) <END_BUG> goto out_err ; len = ptr - line ; GITERR_CHECK_ALLOC_ADD ( & alloclen, len, 1 ) ; pkt -> msg = git__malloc ( alloclen ) ; GITERR_CHECK_ALLOC ( pkt -> msg ) ; memcpy ( pkt -> msg, line, len ) ; pkt -> msg [ len ] = '\\0' ; * out = ( git_pkt * ) pkt ; return 0 ; out_err : giterr_set ( GITERR_NET, "invalid   packet   line" ) ; git__free ( pkt -> ref ) ; git__free ( pkt ) ; return - 1 ; }

Fix:
<S2SV_ModStart> = GIT_PKT_NG ; if ( len < 3 ) goto out_err ; <S2SV_ModStart> += 3 ; len -= 3 ; <S2SV_ModStart> ( ptr = memchr <S2SV_ModEnd> ( line, <S2SV_ModStart> line,'<S2SV_blank> ', len <S2SV_ModStart> = '\\0' ; if ( len < 1 ) goto out_err ; <S2SV_ModStart> + 1 ; len -= 1 ; <S2SV_ModStart> ( ptr = memchr <S2SV_ModEnd> ( line, <S2SV_ModStart> line, '\\n', len
Buggy code:
 static void perf_event_comm_output ( struct perf_event * event, struct perf_comm_event * comm_event ) { struct perf_output_handle handle ; struct perf_sample_data sample ; int size = comm_event -> event_id. header. size ; int ret ; perf_event_header__init_id ( & comm_event -> event_id. header, & sample, event ) ; ret = perf_output_begin ( & handle, event, <START_BUG> comm_event -> event_id. header. size, 0, 0 ) ; <END_BUG> if ( ret ) goto out ; comm_event -> event_id. pid = perf_event_pid ( event, comm_event -> task ) ; comm_event -> event_id. tid = perf_event_tid ( event, comm_event -> task ) ; perf_output_put ( & handle, comm_event -> event_id ) ; __output_copy ( & handle, comm_event -> comm, comm_event -> comm_size ) ; perf_event__output_id_sample ( event, & handle, & sample ) ; perf_output_end ( & handle ) ; out : comm_event -> event_id. header. size = size ; }

Fix:
<S2SV_ModStart> header. size <S2SV_ModEnd>, 0 )
Buggy code:
 <START_BUG> int file_is_y4m ( const char detect [ 4 ] ) { <END_BUG> if ( memcmp ( detect, "YUV4", 4 ) == 0 ) { return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static