nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int __sys_sendmsg ( struct socket * sock, struct msghdr __user * msg, struct msghdr * msg_sys, unsigned flags, struct used_address * used_address ) { struct compat_msghdr __user * msg_compat = ( struct compat_msghdr __user * ) msg ; struct sockaddr_storage address ; struct iovec iovstack [ UIO_FASTIOV ], * iov = iovstack ; unsigned char ctl [ sizeof ( struct cmsghdr ) + 20 ] __attribute__ ( ( aligned ( sizeof ( __kernel_size_t ) ) ) ) ; unsigned char * ctl_buf = ctl ; int err, ctl_len, iov_size, total_len ; err = - EFAULT ; if ( MSG_CMSG_COMPAT & flags ) { if ( get_compat_msghdr ( msg_sys, msg_compat ) ) return - EFAULT ; } else if ( copy_from_user ( msg_sys, msg, sizeof ( struct msghdr ) ) ) return - EFAULT ; err = - EMSGSIZE ; if ( msg_sys -> msg_iovlen > UIO_MAXIOV ) goto out ; err = - ENOMEM ; iov_size = msg_sys -> msg_iovlen * sizeof ( struct iovec ) ; if ( msg_sys -> msg_iovlen > UIO_FASTIOV ) { iov = sock_kmalloc ( sock -> sk, iov_size, GFP_KERNEL ) ; if (! iov ) goto out ; } if ( MSG_CMSG_COMPAT & flags ) { err = verify_compat_iovec ( msg_sys, iov, ( struct sockaddr * ) & address, VERIFY_READ ) ; } else err = verify_iovec ( msg_sys, iov, ( struct sockaddr * ) & address, VERIFY_READ ) ; if ( err < 0 ) goto out_freeiov ; total_len = err ; err = - ENOBUFS ; if ( msg_sys -> msg_controllen > INT_MAX ) goto out_freeiov ; ctl_len = msg_sys -> msg_controllen ; if ( ( MSG_CMSG_COMPAT & flags ) && ctl_len ) { err = cmsghdr_from_user

Fix:
<S2SV_ModStart> ( used_address && msg_sys -> msg_name && <S2SV_ModStart> -> name, msg_sys <S2SV_ModEnd> -> msg_name, <S2SV_ModStart> -> msg_namelen ; if ( msg_sys -> msg_name ) <S2SV_ModStart> -> name, msg_sys <S2SV_ModEnd> -> msg_name,
Buggy code:
 int button_open ( Button * b ) { char * p, name [ 256 ] ; int r ; assert ( b ) ; b -> fd = safe_close ( b -> fd ) ; p = strjoina ( "//dev//input//", b -> name ) ; b -> fd = open ( p, O_RDWR | O_CLOEXEC | O_NOCTTY | O_NONBLOCK ) ; if ( b -> fd < 0 ) return log_warning_errno ( errno, "Failed   to   open   %s:   %m", p ) ; r = button_suitable ( b ) ; if ( r < 0 ) return log_warning_errno ( r, "Failed   to   determine   whether   input   device   is   relevant   to   us:   %m" ) ; if ( r == 0 ) return log_debug_errno ( SYNTHETIC_ERRNO ( EADDRNOTAVAIL ), "Device   %s   does   not   expose   keys   or   switches   relevant   to   us,   ignoring.", p ) ; if ( ioctl ( b -> fd, EVIOCGNAME ( sizeof ( name ) ), name ) < 0 ) { r = log_error_errno ( errno, "Failed   to   get   input   name:   %m" ) ; goto fail ; } ( void ) button_set_mask ( b ) ; <START_BUG> r = sd_event_add_io ( b -> manager -> event, & b -> io_event_source, b -> fd, EPOLLIN, button_dispatch, b ) ; <END_BUG> if ( r < 0 ) { log_error_errno ( r, "Failed   to   add   button   event:   %m" ) ; goto fail ; } log_info ( "Watching   system   buttons   on   //dev//input//%s   (%s)", b -> name, name ) ; return 0 ; fail : b -> fd = safe_close ( b -> fd ) ; return r ; }

Fix:
<S2SV_ModStart> b ) ; b -> io_event_source = sd_event_source_unref ( b -> io_event_source ) ;
Buggy code:
 static int try_read_command ( conn * c ) { assert ( c!= NULL ) ; assert ( c -> rcurr <= ( c -> rbuf + c -> rsize ) ) ; assert ( c -> rbytes > 0 ) ; if ( c -> protocol == negotiating_prot || c -> transport == udp_transport ) { if ( ( unsigned char ) c -> rbuf [ 0 ] == ( unsigned char ) PROTOCOL_BINARY_REQ ) { c -> protocol = binary_prot ; } else { c -> protocol = ascii_prot ; } if ( settings. verbose > 1 ) { fprintf ( stderr, "%d:   Client   using   the   %s   protocol\\n", c -> sfd, prot_text ( c -> protocol ) ) ; } } if ( c -> protocol == binary_prot ) { if ( c -> rbytes < sizeof ( c -> binary_header ) ) { return 0 ; } else { # ifdef NEED_ALIGN if ( ( ( long ) ( c -> rcurr ) ) % 8!= 0 ) { memmove ( c -> rbuf, c -> rcurr, c -> rbytes ) ; c -> rcurr = c -> rbuf ; if ( settings. verbose > 1 ) { fprintf ( stderr, "%d:   Realign   input   buffer\\n", c -> sfd ) ; } } # endif protocol_binary_request_header * req ; req = ( protocol_binary_request_header * ) c -> rcurr ; if ( settings. verbose > 1 ) { int ii ; fprintf ( stderr, "<%d   Read   binary   protocol   data:", c -> sfd ) ; for ( ii = 0 ; ii < sizeof ( req -> bytes ) ; ++ ii ) { if ( ii % 4 == 0 ) { fprintf ( stderr, "\\n<%d       ", c -> sfd ) ; } fprintf ( stderr, "   0x%02x", req -> bytes [ ii ] ) ; } fprintf ( stderr, "\\n" ) ; } c -> binary_header = * req ; c -> binary_header. request. keylen = ntohs ( req -> request. keylen ) ; c -> binary_header. request. bodylen = ntohl ( req -> request. bodylen ) ; c -> binary_header. request. cas = ntoh

Fix:
<S2SV_ModStart>! el ) { if ( c -> rbytes > 1024 ) { char * ptr = c -> rcurr ; while ( * ptr =='<S2SV_blank>') { ++ ptr ; } if ( strcmp ( ptr, "get <S2SV_blank> " ) && strcmp ( ptr, "gets <S2SV_blank> " ) ) { conn_set_state ( c, conn_closing ) ; return 1 ; } } return 0 ; } <S2SV_ModEnd> cont = el
Buggy code:
 PyObject * ast2obj_excepthandler ( void * _o ) { excepthandler_ty o = ( excepthandler_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { <START_BUG> Py_INCREF ( Py_None ) ; <END_BUG> return Py_None ; } switch ( o -> kind ) { case ExceptHandler_kind : result = PyType_GenericNew ( ExceptHandler_type, NULL, NULL ) ; if (! result ) goto failed ; value = ast2obj_expr ( o -> v. ExceptHandler. type ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_identifier ( o -> v. ExceptHandler. name ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_name, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_list ( o -> v. ExceptHandler. body, ast2obj_stmt ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_body, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; break ; } value = ast2obj_int ( o -> lineno ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_lineno, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> col_offset ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_col_offset, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> o ) { Py_RETURN_NONE <S2SV_ModEnd> ; } switch
Buggy code:
 static void rpl_daoack_print ( netdissect_options * ndo, const u_char * bp, u_int length ) { const struct nd_rpl_daoack * daoack = ( const struct nd_rpl_daoack * ) bp ; const char * dagid_str = "<elided>" ; ND_TCHECK2 ( * daoack, ND_RPL_DAOACK_MIN_LEN ) ; if ( length < ND_RPL_DAOACK_MIN_LEN ) goto tooshort ; bp += ND_RPL_DAOACK_MIN_LEN ; length -= ND_RPL_DAOACK_MIN_LEN ; if ( RPL_DAOACK_D ( daoack -> rpl_flags ) ) { ND_TCHECK2 ( daoack -> rpl_dagid, DAGID_LEN ) ; if ( length < DAGID_LEN ) goto tooshort ; dagid_str = ip6addr_string ( ndo, daoack -> rpl_dagid ) ; bp += DAGID_LEN ; length -= DAGID_LEN ; } ND_PRINT ( ( ndo, "   [dagid:%s,seq:%u,instance:%u,status:%u]", dagid_str, daoack -> rpl_daoseq, daoack -> rpl_instanceid, daoack -> rpl_status ) ) ; if ( ndo -> ndo_vflag > 1 ) { const struct rpl_dio_genoption * opt = ( const struct rpl_dio_genoption * ) bp ; rpl_dio_printopt ( ndo, opt, length ) ; } return ; trunc : <START_BUG> ND_PRINT ( ( ndo, "   [|dao-truncated]" ) ) ; <END_BUG> return ; tooshort : ND_PRINT ( ( ndo, "   [|dao-length   too   short]" ) ) ; return ; }

Fix:
<S2SV_ModStart> ( ndo, "%s", rpl_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 static void pci_populate_msixcap ( struct msixcap * msixcap, int msgnum, int barnum, uint32_t msix_tab_size ) { <START_BUG> assert ( msix_tab_size % 4096 == 0 ) ; <END_BUG> bzero ( msixcap, sizeof ( struct msixcap ) ) ; msixcap -> capid = PCIY_MSIX ; msixcap -> msgctrl = msgnum - 1 ; msixcap -> table_info = barnum & PCIM_MSIX_BIR_MASK ; msixcap -> pba_info = msix_tab_size | ( barnum & PCIM_MSIX_BIR_MASK ) ; }

Fix:
<S2SV_ModStart> msix_tab_size ) { <S2SV_ModEnd> bzero ( msixcap
Buggy code:
 <START_BUG> static void encode_rd_sb_row ( VP9_COMP * cpi, const TileInfo * const tile, <END_BUG> int mi_row, TOKENEXTRA * * tp ) { VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & cpi -> mb. e_mbd ; SPEED_FEATURES * const sf = & cpi -> sf ; int mi_col ;  vpx_memset ( & xd -> left_context, 0, sizeof ( xd -> left_context ) ) ; <START_BUG> vpx_memset ( xd -> left_seg_context, 0, sizeof ( xd -> left_seg_context ) ) ; <END_BUG> for ( mi_col = tile -> mi_col_start ; mi_col < tile -> mi_col_end ;  mi_col += MI_BLOCK_SIZE ) { <START_BUG> int dummy_rate ; <END_BUG> int64_t dummy_dist ;  BLOCK_SIZE i ; <START_BUG> MACROBLOCK * x = & cpi -> mb ; if ( sf -> adaptive_pred_interp_filter ) { <END_BUG> for ( i = BLOCK_4X4 ; i < BLOCK_8X8 ; ++ i ) {  const int num_4x4_w = num_4x4_blocks_wide_lookup [ i ] ; const int num_4x4_h = num_4x4_blocks_high_lookup [ i ] ; const int num_4x4_blk = MAX ( 4, num_4x4_w * num_4x4_h ) ; for ( x -> sb_index = 0 ; x -> sb_index < 4 ; ++ x -> sb_index ) for ( x -> mb_index = 0 ; x -> mb_index < 4 ; ++ x -> mb_index ) for ( x -> b_index = 0 ; x -> b_index < 16 // num_4x4_blk ; ++ x -> b_index ) get_block_context ( x, i ) -> pred_interp_filter = SWITCHABLE ; } } vp9_zero ( cpi -> mb. pred_mv ) ; <START_BUG> if ( ( sf -> partition_search_type == SEARCH_PARTITION && <END_BUG> sf -> use_lastframe_partitioning ) || sf -> partition_search_type == FIXED_PART

Fix:
<S2SV_ModStart> * cpi, ThreadData * td, TileDataEnc * tile_data, int mi_row, TOKENEXTRA * * tp ) { VP9_COMMON * const cm = & cpi -> common ; <S2SV_ModEnd> TileInfo * const <S2SV_ModStart> TileInfo * const tile_info = & tile_data -> tile_info ; MACROBLOCK * const x = & td -> mb ; MACROBLOCKD * const xd = & x -> e_mbd ; SPEED_FEATURES * const sf = & cpi -> sf ; int mi_col ; memset ( & xd -> left_context, 0, sizeof ( <S2SV_ModEnd> xd -> left_context <S2SV_ModStart> xd -> left_context ) ) ; memset ( xd -> left_seg_context <S2SV_ModStart> ( xd -> left_seg_context <S2SV_ModEnd> ) ) ; <S2SV_ModStart> ( mi_col = tile_info <S2SV_ModEnd> -> mi_col_start ; <S2SV_ModStart> ; mi_col < tile_info <S2SV_ModEnd> -> mi_col_end ; <S2SV_ModStart> MI_BLOCK_SIZE ) { const struct segmentation * const seg = & cm -> seg ; <S2SV_ModStart> int64_t dummy_dist ; RD_COST dummy_rdc ; int i ; int seg_skip = 0 ; const int
Buggy code:
 static PyObject * decode_unicode_with_escapes ( struct compiling * c, const node * n, const char * s, size_t len ) { <START_BUG> PyObject * u ; <END_BUG> char * buf ; char * p ;  const char * end ; <START_BUG> if ( len > SIZE_MAX // 6 ) return NULL ; u = PyBytes_FromStringAndSize ( ( char * ) NULL, len * 6 ) ; if ( u == NULL ) return NULL ; p = buf = PyBytes_AsString ( u ) ; end = s + len ; while ( s < end ) { if ( * s == '\\\\' ) { * p ++ = * s ++ ; <END_BUG> if ( * s & 0x80 ) {  strcpy ( p, "u005c" ) ; <START_BUG> p += 5 ; <END_BUG> } } if ( * s & 0x80 ) { PyObject * w ; int kind ; void * data ; Py_ssize_t len, i ; w = decode_utf8 ( c, & s, end ) ; if ( w == NULL ) { Py_DECREF ( u ) ; return NULL ; } kind = PyUnicode_KIND ( w ) ; data = PyUnicode_DATA ( w ) ; len = PyUnicode_GET_LENGTH ( w ) ; for ( i = 0 ; i < len ; i ++ ) { Py_UCS4 chr = PyUnicode_READ ( kind, data, i ) ; sprintf ( p, "\\\\U%08x", chr ) ; p += 10 ; }  assert ( p - buf <= Py_SIZE ( u ) ) ; <START_BUG> Py_DECREF ( w ) ; } else { * p ++ = * s ++ ; } } len = p - buf ; s = buf ; <END_BUG> return PyUnicode_DecodeUnicodeEscape ( s, len, NULL ) ;  }

Fix:
<S2SV_ModStart> { PyObject * v, * <S2SV_ModStart> char * end ; const char * first_invalid_escape <S2SV_ModStart> ; if ( s >= end || <S2SV_ModStart> p += 5 ; if ( s >= end ) break <S2SV_ModStart> - buf <= PyBytes_GET_SIZE <S2SV_ModEnd> ( u ) <S2SV_ModStart> = buf ; v = _PyUnicode_DecodeUnicodeEscape ( s, len, NULL, & first_invalid_escape ) ; if ( v!= NULL && first_invalid_escape!= NULL ) { if ( warn_invalid_escape_sequence ( c, n, * first_invalid_escape ) < 0 ) { Py_XDECREF ( u ) ; Py_DECREF ( v ) ; return NULL ; } } Py_XDECREF ( u ) ; return v <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 static void filter_selectively_vert ( uint8_t * s, int pitch, unsigned int mask_16x16, unsigned int mask_8x8, unsigned int mask_4x4, unsigned int mask_4x4_int, const loop_filter_info_n * lfi_n, const uint8_t * lfl ) { unsigned int mask ; for ( mask = mask_16x16 | mask_8x8 | mask_4x4 | mask_4x4_int ; mask ; mask >>= 1 ) { const loop_filter_thresh * lfi = lfi_n -> lfthr + * lfl ; if ( mask & 1 ) { if ( mask_16x16 & 1 ) { <START_BUG> vp9_lpf_vertical_16 ( s, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr ) ; <END_BUG> } else if ( mask_8x8 & 1 ) {  vp9_lpf_vertical_8 ( s, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr, 1 ) ; <START_BUG> } else if ( mask_4x4 & 1 ) { <END_BUG> vp9_lpf_vertical_4 ( s, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr, 1 ) ;  } } if ( mask_4x4_int & 1 ) vp9_lpf_vertical_4 ( s + 4, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr, 1 ) ; s += 8 ; lfl += 1 ; mask_16x16 >>= 1 ; mask_8x8 >>= 1 ; mask_4x4 >>= 1 ; mask_4x4_int >>= 1 ; } }

Fix:
<S2SV_ModStart> 1 ) { vpx_lpf_vertical_16 <S2SV_ModEnd> ( s, <S2SV_ModStart> 1 ) { vpx_lpf_vertical_8 <S2SV_ModEnd> ( s, <S2SV_ModStart> 1 ) { vpx_lpf_vertical_4 ( s, pitch, lfi -> mblim, lfi -> lim, lfi -> hev_thr, 1 ) ; } } if ( mask_4x4_int & 1 ) vpx_lpf_vertical_4 <S2SV_ModEnd> ( s +
Buggy code:
 static vpx_codec_err_t ctrl_set_invert_tile_order ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> ctx -> invert_tile_order = va_arg ( args, int ) ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args )
Buggy code:
 static int jpc_enc_encodemainhdr ( jpc_enc_t * enc ) { jpc_siz_t * siz ; jpc_cod_t * cod ; jpc_qcd_t * qcd ; int i ; long startoff ; long mainhdrlen ; jpc_enc_cp_t * cp ; jpc_qcc_t * qcc ; jpc_enc_tccp_t * tccp ; uint_fast16_t cmptno ; jpc_tsfb_band_t bandinfos [ JPC_MAXBANDS ] ; jpc_fix_t mctsynweight ; jpc_enc_tcp_t * tcp ; jpc_tsfb_t * tsfb ; jpc_tsfb_band_t * bandinfo ; uint_fast16_t numbands ; uint_fast16_t bandno ; uint_fast16_t rlvlno ; uint_fast16_t analgain ; jpc_fix_t absstepsize ; char buf [ 1024 ] ; jpc_com_t * com ; cp = enc -> cp ; startoff = jas_stream_getrwcount ( enc -> out ) ; if (! ( enc -> mrk = jpc_ms_create ( JPC_MS_SOC ) ) ) { return - 1 ; } if ( jpc_putms ( enc -> out, enc -> cstate, enc -> mrk ) ) { jas_eprintf ( "cannot   write   SOC   marker\\n" ) ; return - 1 ; } jpc_ms_destroy ( enc -> mrk ) ; enc -> mrk = 0 ; if (! ( enc -> mrk = jpc_ms_create ( JPC_MS_SIZ ) ) ) { return - 1 ; } siz = & enc -> mrk -> parms. siz ; siz -> caps = 0 ; siz -> xoff = cp -> imgareatlx ; siz -> yoff = cp -> imgareatly ; siz -> width = cp -> refgrdwidth ; siz -> height = cp -> refgrdheight ; siz -> tilexoff = cp -> tilegrdoffx ; siz -> tileyoff = cp -> tilegrdoffy ; siz -> tilewidth =

Fix:
<S2SV_ModStart> = JAS_CAST ( jas_uchar <S2SV_ModEnd> *, jas_strdup
Buggy code:
 int main ( int argc, char * * argv ) { const char * test_name = NULL ; bool skip_sanity_suite = false ; for ( int i = 1 ; i < argc ; ++ i ) { if (! strcmp ( "--help", argv [ i ] ) ) { print_usage ( argv [ 0 ] ) ; return 0 ; } if (! strcmp ( "--insanity", argv [ i ] ) ) { skip_sanity_suite = true ; continue ; } if (! is_valid ( argv [ i ] ) ) { printf ( "Error:   invalid   test   name.\\n" ) ; print_usage ( argv [ 0 ] ) ; return - 1 ; } if ( test_name!= NULL ) { printf ( "Error:   invalid   arguments.\\n" ) ; print_usage ( argv [ 0 ] ) ; return - 1 ; } test_name = argv [ i ] ; } if ( is_shell_running ( ) ) { printf ( "Run   \'adb   shell   stop\'   before   running   %s.\\n", argv [ 0 ] ) ; return - 1 ; } config_t * config = config_new ( CONFIG_FILE_PATH ) ; if (! config ) { printf ( "Error:   unable   to   open   stack   config   file.\\n" ) ; print_usage ( argv [ 0 ] ) ; return - 1 ; } for ( const config_section_node_t * node = config_section_begin ( config ) ; node!= config_section_end ( config ) ; node = config_section_next ( node ) ) { const char * name = config_section_name ( node ) ; if ( config_has_key ( config, name, "LinkKey" ) && string_to_bdaddr ( name, & bt_remote_bdaddr ) ) { break ; } } config_free ( config ) ; if ( bdaddr_is_empty ( & bt_remote_bdaddr ) ) { printf ( "Error:   unable   to   find   paired   device   in   config   file.\\n" ) ; print_usage ( argv [ 0 ] ) ; return - 1 ; } if (! hal_open ( callbacks_get_adapter_struct ( ) ) ) { printf ( "Unable   to   open  

Fix:
<S2SV_ModStart> -> enable ( false
Buggy code:
 enum nss_status _nss_mymachines_getpwnam_r ( const char * name, struct passwd * pwd, char * buffer, size_t buflen, int * errnop ) { _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL ; _cleanup_bus_message_unref_ sd_bus_message * reply = NULL ; _cleanup_bus_flush_close_unref_ sd_bus * bus = NULL ; const char * p, * e, * machine ; uint32_t mapped ; uid_t uid ; size_t l ; int r ; assert ( name ) ; assert ( pwd ) ; p = startswith ( name, "vu-" ) ; if (! p ) goto not_found ; e = strrchr ( p, '-' ) ; <START_BUG> if (! e || e == p ) <END_BUG> goto not_found ; r = parse_uid ( e + 1, & uid ) ; if ( r < 0 ) goto not_found ; machine = strndupa ( p, e - p ) ; if (! machine_name_is_valid ( machine ) ) goto not_found ; r = sd_bus_open_system ( & bus ) ; if ( r < 0 ) goto fail ; r = sd_bus_call_method ( bus, "org.freedesktop.machine1", "//org//freedesktop//machine1", "org.freedesktop.machine1.Manager", "MapFromMachineUser", & error, & reply, "su", machine, ( uint32_t ) uid ) ; if ( r < 0 ) { if ( sd_bus_error_has_name ( & error, BUS_ERROR_NO_SUCH_USER_MAPPING ) ) goto not_found ; goto fail ; } r = sd_bus_message_read ( reply, "u", & mapped ) ; if ( r < 0 ) goto fail ; l = strlen ( name ) ; if ( buflen < l + 1 ) { * errnop = ENOMEM ; return NSS_STATUS_TRYAGAIN ; } memcpy ( buffer, name, l + 1 ) ; pwd -> pw_name = buffer ; pwd -> pw_uid = mapped ; pwd -> pw_gid = 65534

Fix:
<S2SV_ModStart> e == p ) goto not_found ; if ( e - p > HOST_NAME_MAX - 1
Buggy code:
 static Image * ReadWPGImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { typedef struct { size_t FileId ; MagickOffsetType DataOffset ; unsigned int ProductType ; unsigned int FileType ; unsigned char MajorVersion ; unsigned char MinorVersion ; unsigned int EncryptKey ; unsigned int Reserved ; } WPGHeader ; typedef struct { unsigned char RecType ; size_t RecordLength ; } WPGRecord ; typedef struct { unsigned char Class ; unsigned char RecType ; size_t Extension ; size_t RecordLength ; } WPG2Record ; typedef struct { unsigned HorizontalUnits ; unsigned VerticalUnits ; unsigned char PosSizePrecision ; } WPG2Start ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType1 ; typedef struct { unsigned int Width ; unsigned int Height ; unsigned char Depth ; unsigned char Compression ; } WPG2BitmapType1 ; typedef struct { unsigned int RotAngle ; unsigned int LowLeftX ; unsigned int LowLeftY ; unsigned int UpRightX ; unsigned int UpRightY ; unsigned int Width ; unsigned int Height ; unsigned int Depth ; unsigned int HorzRes ; unsigned int VertRes ; } WPGBitmapType2 ; typedef struct { unsigned int StartIndex ; unsigned int NumOfEntries ; } WPGColorMapRec ; Image * image ; unsigned int status ; WPGHeader Header ; WPGRecord Rec ; WPG2Record Rec2 ; WPG2Start StartWPG ; WPGBitmapType1 BitmapHeader1 ; WPG2BitmapType1 Bitmap2Header1 ; WPGBitmapType2 BitmapHeader2 ; WPGColorMapRec WPG_Palette ; int i, bpp, WPG2Flags ; ssize_t ldblk ; size_t one ; unsigned char * BImgBuff ; tCTM CTM ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; one = 1 ; image = AcquireImage ( image_info, exception ) ; image -> depth = 8 ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) {

Fix:
<S2SV_ModStart> ; UnpackRaster : status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if ( status == MagickFalse ) break ; <S2SV_ModStart> Bitmap2Header1. Height ; status = SetImageExtent ( image, image -> columns, image -> rows, exception ) ; if ( status == MagickFalse ) break <S2SV_ModStart> ; } } <S2SV_ModEnd> Finish : (
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 <START_BUG> char <END_BUG> magick [ 12 ] ; Image * image ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; Quantum index ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, number_planes, number_planes_filled, one, pixel_info_length ; ssize_t count, offset, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ;  count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; <START_BUG> if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { <END_BUG> image -> page. x = ReadBlobLSBShort ( image ) ;  <START_BUG> image -> page. y = ReadBlobLSBShort ( image ) ; <END_BUG> image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> alpha_trait = flags & 0x

Fix:
<S2SV_ModStart> define EOFOp 0x07 # define ThrowRLEException ( exception, message ) \\\n{ if ( colormap!= ( unsigned char * ) NULL ) colormap = ( unsigned char * ) RelinquishMagickMemory ( colormap ) ; if ( pixel_info!= ( MemoryInfo * ) NULL ) pixel_info = RelinquishVirtualMemory ( pixel_info ) ; ThrowReaderException ( ( exception ), ( message ) ) ; \\\n} <S2SV_ModStart> ) ) ; colormap = ( unsigned char * ) NULL ; pixel_info = ( MemoryInfo * ) NULL ; <S2SV_ModStart>. x = ( ssize_t ) <S2SV_ModStart>. y = ( ssize_t ) <S2SV_ModStart> "ImproperImageHeader" ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowRLEException ( CorruptImageError, "UnexpectedEndOfFile" ) ; <S2SV_ModStart>!= MagickFalse ) ThrowRLEException ( <S2SV_ModEnd> CorruptImageError, "UnexpectedEndOfFile" <S2SV_ModStart> CorruptImageError, "UnexpectedEndOfFile" ) ; if ( number_colormaps!= 0 ) { <S2SV_ModEnd> colormap = ( <S2SV_ModStart> char * ) AcquireQuantumMemory ( number_colormaps, 3 * map_length * sizeof (
Buggy code:
 bool zx_confirmZxLiquidTx ( uint32_t data_total, const EthereumSignTx * msg ) { ( void ) data_total ; const TokenType * token ; char constr1 [ 40 ], constr2 [ 40 ], * arStr = "" ; uint8_t * tokenAddress, * deadlineBytes ; bignum256 tokenAmount, tokenMinAmount, ethMinAmount ; uint64_t deadline ; if ( isAddLiquidityEthCall ( msg ) ) { arStr = "uniswap   add   liquidity" ; } else if ( isRemoveLiquidityEthCall ( msg ) ) { arStr = "uniswap   remove   liquidity" ; } else { return false ; } tokenAddress = ( uint8_t * ) ( msg -> data_initial_chunk. bytes + 4 + 32 - 20 ) ; token = tokenByChainAddress ( msg -> chain_id, tokenAddress ) ; bn_from_bytes ( msg -> data_initial_chunk. bytes + 4 + 32, 32, & tokenAmount ) ; bn_from_bytes ( msg -> data_initial_chunk. bytes + 4 + 2 * 32, 32, & tokenMinAmount ) ; bn_from_bytes ( msg -> data_initial_chunk. bytes + 4 + 3 * 32, 32, & ethMinAmount ) ; deadlineBytes = ( uint8_t * ) ( msg -> data_initial_chunk. bytes + 4 + 6 * 32 - 8 ) ; deadline = ( ( uint64_t ) deadlineBytes [ 0 ] << 8 * 7 ) | ( ( uint64_t ) deadlineBytes [ 1 ] << 8 * 6 ) | ( ( uint64_t ) deadlineBytes [ 2 ] << 8 * 5 ) | ( ( uint64_t ) deadlineBytes [ 3 ] << 8 * 4 ) | ( ( uint64_t ) deadlineBytes [ 4 ] << 8 * 3 ) | ( ( uint64_t ) deadlineBytes [ 5 ] << 8 * 2 ) | ( ( uint64_t ) deadlineBytes [ 6 ] << 8 * 1 ) | ( ( uint64_t ) deadlineBytes [ 7 ] ) ; char tokbuf [ 32 ] ; ethereumFormatAmount ( & tokenAmount, token, msg -> chain_id, tokbuf, sizeof ( tokbuf ) ) ; snprintf

Fix:
<S2SV_ModStart> constr1 ) ; <S2SV_ModEnd> confirm ( ButtonRequestType_ButtonRequest_ConfirmOutput
Buggy code:
 static Image * ReadAVSImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; MagickBooleanType status ; register PixelPacket * q ; register ssize_t x ; register unsigned char * p ; size_t height, width ; ssize_t count, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } width = ReadBlobMSBLong ( image ) ; height = ReadBlobMSBLong ( image ) ; if ( EOFBlob ( image )!= MagickFalse ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( ( width == 0UL ) || ( height == 0UL ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { ssize_t length ; image -> columns = width ; image -> rows = height ; image -> depth = 8 ; if ( ( image_info -> ping!= MagickFalse ) && ( image_info -> number_scenes!= 0 ) ) if ( image -> scene >= ( image_info -> scene + image_info -> number_scenes - 1 ) ) break ; <START_BUG> pixels = ( unsigned char * ) AcquireQuantumMemory ( image -> columns, <END_BUG> 4 * sizeof ( * pixels ) ) ; if ( pixels == ( unsigned char * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; length = ( size_t ) 4 * image -> columns ; for ( y = 0 ; y < ( ssize_t ) image -> rows ; y ++ ) { count = ReadBlob ( image, length, pixels ) ; if ( count!= length ) ThrowReaderException ( CorruptImageError, "UnableToReadImageData"

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static int rfcomm_sock_getname ( struct socket * sock, struct sockaddr * addr, int * len, int peer ) { struct sockaddr_rc * sa = ( struct sockaddr_rc * ) addr ; struct sock * sk = sock -> sk ; <START_BUG> BT_DBG ( "sock   %p,   sk   %p", sock, sk ) ; <END_BUG> sa -> rc_family = AF_BLUETOOTH ; sa -> rc_channel = rfcomm_pi ( sk ) -> channel ; if ( peer ) bacpy ( & sa -> rc_bdaddr, & bt_sk ( sk ) -> dst ) ; else bacpy ( & sa -> rc_bdaddr, & bt_sk ( sk ) -> src ) ; * len = sizeof ( struct sockaddr_rc ) ; return 0 ; }

Fix:
<S2SV_ModStart> sock, sk ) ; memset ( sa, 0, sizeof ( * sa )
Buggy code:
 void vp8_default_coef_probs ( VP8_COMMON * pc ) { <START_BUG> vpx_memcpy ( pc -> fc. coef_probs, default_coef_probs, <END_BUG> sizeof ( default_coef_probs ) ) ; }

Fix:
<S2SV_ModStart> pc ) { memcpy <S2SV_ModEnd> ( pc ->
Buggy code:
 GF_Err abst_box_read ( GF_Box * s, GF_BitStream * bs ) { GF_AdobeBootstrapInfoBox * ptr = ( GF_AdobeBootstrapInfoBox * ) s ; int i ; u32 tmp_strsize ; char * tmp_str ; GF_Err e ; ISOM_DECREASE_SIZE ( ptr, 25 ) ptr -> bootstrapinfo_version = gf_bs_read_u32 ( bs ) ; ptr -> profile = gf_bs_read_int ( bs, 2 ) ; ptr -> live = gf_bs_read_int ( bs, 1 ) ; ptr -> update = gf_bs_read_int ( bs, 1 ) ; ptr -> reserved = gf_bs_read_int ( bs, 4 ) ; ptr -> time_scale = gf_bs_read_u32 ( bs ) ; ptr -> current_media_time = gf_bs_read_u64 ( bs ) ; ptr -> smpte_time_code_offset = gf_bs_read_u64 ( bs ) ; i = 0 ; if ( ptr -> size < 8 ) return GF_ISOM_INVALID_FILE ; <START_BUG> tmp_strsize = ( u32 ) ptr -> size - 8 ; <END_BUG> tmp_str = gf_malloc ( sizeof ( char ) * tmp_strsize ) ; if (! tmp_str ) return GF_OUT_OF_MEM ; memset ( tmp_str, 0, sizeof ( char ) * tmp_strsize ) ; while ( tmp_strsize ) { ISOM_DECREASE_SIZE ( ptr, 1 ) tmp_str [ i ] = gf_bs_read_u8 ( bs ) ; tmp_strsize -- ; if (! tmp_str [ i ] ) break ; i ++ ; } if ( i ) { ptr -> movie_identifier = gf_strdup ( tmp_str ) ; } ISOM_DECREASE_SIZE ( ptr, 1 ) ptr -> server_entry_count = gf_bs_read_u8 ( bs ) ; for ( i = 0 ; i < ptr -> server_entry_count ; i ++ ) { int j = 0 ; tmp_strsize = ( u32 ) ptr -> size ; while ( tmp_strsize ) { ISOM_DECREASE_SIZE (

Fix:
<S2SV_ModStart> ptr -> size <S2SV_ModEnd> ; tmp_str =
Buggy code:
 void vp9_encode_intra_block_plane ( MACROBLOCK * x, BLOCK_SIZE bsize, int plane ) { const MACROBLOCKD * const xd = & x -> e_mbd ; struct encode_b_args arg = { x, NULL, & xd -> mi [ 0 ] -> mbmi. skip } ; <START_BUG> vp9_foreach_transformed_block_in_plane ( xd, bsize, plane, encode_block_intra, <END_BUG> & arg ) ; }

Fix:
<S2SV_ModStart>, plane, vp9_encode_block_intra <S2SV_ModEnd>, & arg
Buggy code:
 static void do_winop ( void ) { int arg1 = term. csi_argv [ 1 ], arg2 = term. csi_argv [ 2 ] ; if ( * cfg. suppress_win && contains ( cfg. suppress_win, term. csi_argv [ 0 ] ) ) return ; switch ( term. csi_argv [ 0 ] ) { when 1 : win_set_iconic ( false ) ; when 2 : win_set_iconic ( true ) ; when 3 : win_set_pos ( arg1, arg2 ) ; when 4 : win_set_pixels ( arg1, arg2 ) ; when 5 : if ( term. csi_argc!= 1 ) return ; win_set_zorder ( true ) ; when 6 : if ( term. csi_argc!= 1 ) return ; win_set_zorder ( false ) ; when 7 : win_invalidate_all ( false ) ; when 8 : { int def1 = term. csi_argv_defined [ 1 ], def2 = term. csi_argv_defined [ 2 ] ; int rows, cols ; win_get_screen_chars ( & rows, & cols ) ; win_set_chars ( arg1? : def1? rows : term. rows, arg2? : def2? cols : term. cols ) ; } when 9 : { if ( term. csi_argc!= 2 ) return ; int rows0 = term. rows0, cols0 = term. cols0 ; if ( arg1 == 2 ) { win_set_geom ( 0, - 1, 0, - 1 ) ; term. rows0 = rows0 ; term. cols0 = cols0 ; } else if ( arg1 == 3 ) { win_set_geom ( - 1, 0, - 1, 0 ) ; term. rows0 = rows0 ; term. cols0 = cols0 ; } else if ( arg1 == 1 ) { win_maximise ( 1 ) ; term. rows0 = rows0 ; term. cols0 = cols0 ; } else if ( arg1 == 0 ) { win_maximise ( 0 ) ; win_set_chars ( rows0, cols0 ) ; } <START_BUG> } <END_BUG> when 10 : if ( term. csi_argc!= 2 ) return ; if ( arg1 == 2 ) win_maximise ( - 2

Fix:
<S2SV_ModStart> ) ; } usleep ( 1000 ) ; <S2SV_ModStart> 2 : 0 ) ; usleep ( 1000
Buggy code:
 static struct env * <START_BUG> createenv ( const struct rule * rule ) <END_BUG> { struct env * env ; u_int i ; env = malloc ( sizeof ( * env ) ) ; if (! env ) err ( 1, NULL ) ; RB_INIT ( & env -> root ) ;  env -> count = 0 ; <START_BUG> if ( rule -> options & KEEPENV ) { extern char * * environ ; for ( i = 0 ; environ [ i ]!= NULL ; i ++ ) { struct envnode * node ; const char * e, * eq ; size_t len ; char keybuf [ 1024 ] ; e = environ [ i ] ; if ( ( eq = strchr ( e, '=' ) ) == NULL || eq == e ) continue ; len = eq - e ; if ( len > sizeof ( keybuf ) - 1 ) continue ; memcpy ( keybuf, e, len ) ; keybuf [ len ] = '\\0' ; node = createnode ( keybuf, eq + 1 ) ; if ( RB_INSERT ( envtree, & env -> root, node ) ) { freenode ( node ) ; } else { env -> count ++ ; } } <END_BUG> }  return env ; }

Fix:
<S2SV_ModStart> rule * rule, const struct passwd * mypw, const struct passwd * targpw <S2SV_ModStart> count = 0 ; addnode ( env, "DOAS_USER", mypw -> pw_name ) <S2SV_ModStart> } } } else { static const char * copyset [ ] = { "DISPLAY", "TERM", NULL } ; addnode ( env, "HOME", targpw -> pw_dir ) ; addnode ( env, "LOGNAME", targpw -> pw_name ) ; addnode ( env, "PATH", getenv ( "PATH" ) ) ; addnode ( env, "SHELL", targpw -> pw_shell ) ; addnode ( env, "USER", targpw -> pw_name ) ; fillenv ( env, copyset ) ; }
Buggy code:
 static int chacha20_poly1305_ctrl ( EVP_CIPHER_CTX * ctx, int type, int arg, void * ptr ) { EVP_CHACHA_AEAD_CTX * actx = aead_data ( ctx ) ; switch ( type ) { case EVP_CTRL_INIT : if ( actx == NULL ) actx = ctx -> cipher_data = OPENSSL_zalloc ( sizeof ( * actx ) + Poly1305_ctx_size ( ) ) ; if ( actx == NULL ) { EVPerr ( EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_INITIALIZATION_ERROR ) ; return 0 ; } actx -> len. aad = 0 ; actx -> len. text = 0 ; actx -> aad = 0 ; actx -> mac_inited = 0 ; actx -> tag_len = 0 ; actx -> nonce_len = 12 ; actx -> tls_payload_length = NO_TLS_PAYLOAD_LENGTH ; return 1 ; case EVP_CTRL_COPY : if ( actx ) { EVP_CIPHER_CTX * dst = ( EVP_CIPHER_CTX * ) ptr ; dst -> cipher_data = OPENSSL_memdup ( actx, sizeof ( * actx ) + Poly1305_ctx_size ( ) ) ; if ( dst -> cipher_data == NULL ) { EVPerr ( EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_COPY_ERROR ) ; return 0 ; } } return 1 ; case EVP_CTRL_AEAD_SET_IVLEN : if ( arg <= 0 || arg > CHACHA_CTR_SIZE ) return 0 ; actx -> nonce_len = arg ; return 1 ; case EVP_CTRL_AEAD_SET_IV_FIXED : if ( arg!= 12 ) return 0 ; actx -> nonce [ 0 ] = actx -> key. counter [ 1 ] = CHACHA_U8TOU32 ( ( unsigned char * ) ptr ) ; actx -> nonce [ 1 ] = actx -> key. counter [ 2 ] = CHACHA_U8TOU32 ( ( unsigned char * ) ptr + 4 ) ;

Fix:
<S2SV_ModStart> encrypt ) { if ( len < POLY1305_BLOCK_SIZE ) return 0 ;
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; PixelPacket * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; size_t Unknown6 ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; MATLAB_HDR. Version = ReadBlobLSBShort ( image ) ; if ( ReadBlob ( image, 2, ( unsigned char * ) & MATLAB_HDR. EndianIndicator )!= 2 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( logging ) ( void ) LogMagickEvent ( C

Fix:
<S2SV_ModStart> 2 ) ; quantum_info = DestroyQuantumInfo ( quantum_info ) ;
Buggy code:
 static void esis_print ( netdissect_options * ndo, const uint8_t * pptr, u_int length ) { const uint8_t * optr ; u_int li, esis_pdu_type, source_address_length, source_address_number ; const struct esis_header_t * esis_header ; if (! ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "ES-IS" ) ) ; if ( length <= 2 ) { ND_PRINT ( ( ndo, ndo -> ndo_qflag? "bad   pkt!" : "no   header   at   all!" ) ) ; return ; } esis_header = ( const struct esis_header_t * ) pptr ; ND_TCHECK ( * esis_header ) ; li = esis_header -> length_indicator ; optr = pptr ; if ( esis_header -> nlpid!= NLPID_ESIS ) { ND_PRINT ( ( ndo, "   nlpid   0x%02x   packet   not   supported", esis_header -> nlpid ) ) ; return ; } if ( esis_header -> version!= ESIS_VERSION ) { ND_PRINT ( ( ndo, "   version   %d   packet   not   supported", esis_header -> version ) ) ; return ; } if ( li > length ) { ND_PRINT ( ( ndo, "   length   indicator(%u)   >   PDU   size   (%u)!", li, length ) ) ; return ; } if ( li < sizeof ( struct esis_header_t ) + 2 ) { ND_PRINT ( ( ndo, "   length   indicator   %u   <   min   PDU   size:", li ) ) ; while ( pptr < ndo -> ndo_snapend ) ND_PRINT ( ( ndo, "%02X", * pptr ++ ) ) ; return ; } esis_pdu_type = esis_header -> type & ESIS_PDU_TYPE_MASK ; if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "%s%s,   length   %u",

Fix:
<S2SV_ModStart> ND_TCHECK ( * tptr <S2SV_ModEnd> ) ; ND_PRINT <S2SV_ModStart> } trunc : ND_PRINT ( ( ndo, "[|esis]" ) ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void BezierCircle ( double r, char * action ) <START_BUG> { <END_BUG> outpos += sprintf ( outpos, "   %12.3f   0   m   %12.3f   %12.3f   %12.3f   %12.3f   0   %12.3f   c\\n", - r, - r, r * BzK, - r * BzK, r, r ) ; outpos += sprintf ( outpos, "   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   0   c\\n", r * BzK, r, r, r * BzK, r ) ; outpos += sprintf ( outpos, "   %12.3f   %12.3f   %12.3f   %12.3f   0   %12.3f   c\\n", r, - r * BzK, r * BzK, - r, - r ) ; outpos += sprintf ( outpos, "   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   0   c   %s\\n", - r * BzK, - r, - r, - r * BzK, - r, action ) ;  } <START_BUG><END_BUG>

Fix:
<S2SV_ModStart> action ) { char * outpos = outputbuffer ; <S2SV_ModStart> action ) ; sendClean ( outputbuffer ) ;
Buggy code:
 void DDGifSlurp ( GifInfo * info, bool decode, bool exitAfterFrame ) { GifRecordType RecordType ; GifByteType * ExtData ; int ExtFunction ; GifFileType * gifFilePtr ; gifFilePtr = info -> gifFilePtr ; uint_fast32_t lastAllocatedGCBIndex = 0 ; do { if ( DGifGetRecordType ( gifFilePtr, & RecordType ) == GIF_ERROR ) { break ; } bool isInitialPass =! decode &&! exitAfterFrame ; switch ( RecordType ) { case IMAGE_DESC_RECORD_TYPE : if ( DGifGetImageDesc ( gifFilePtr, isInitialPass ) == GIF_ERROR ) { break ; } if ( isInitialPass ) { int_fast32_t widthOverflow = gifFilePtr -> Image. Width - gifFilePtr -> SWidth ; int_fast32_t heightOverflow = gifFilePtr -> Image. Height - gifFilePtr -> SHeight ; if ( widthOverflow > 0 || heightOverflow > 0 ) { gifFilePtr -> SWidth += widthOverflow ; gifFilePtr -> SHeight += heightOverflow ; } SavedImage * sp = & gifFilePtr -> SavedImages [ gifFilePtr -> ImageCount - 1 ] ; int_fast32_t topOverflow = gifFilePtr -> Image. Top + gifFilePtr -> Image. Height - gifFilePtr -> SHeight ; if ( topOverflow > 0 ) { sp -> ImageDesc. Top -= topOverflow ; } int_fast32_t leftOverflow = gifFilePtr -> Image. Left + gifFilePtr -> Image. Width - gifFilePtr -> SWidth ; if ( leftOverflow > 0 ) { sp -> ImageDesc. Left -= leftOverflow ; } if (! updateGCB ( info, & lastAllocatedGCBIndex ) ) { break ; } } if ( decode ) { <START_BUG> int_fast32_t widthOverflow = gifFilePtr -> Image. Width - info -> originalWidth ; <END_BUG> int_fast32_t heightOverflow = gifFilePtr -> Image. Height - info -> originalHeight ;  const uint_fast32_t newRasterSize = gifFilePtr -> Image. Width * gifFilePtr -> Image. Height ; <START_BUG> if ( newRasterSize > info -> rasterSize || widthOverflow > 0 || heightOverflow > 0 ) { void * tmpRasterBits = reallocarray<END_BUG>

Fix:
<S2SV_ModStart> decode ) { <S2SV_ModEnd> const uint_fast32_t newRasterSize <S2SV_ModStart> Image. Height ; if ( newRasterSize == 0 ) { free ( info -> rasterBits ) ; info -> rasterBits = NULL ; info -> rasterSize = newRasterSize ; return ; } const int_fast32_t widthOverflow = gifFilePtr -> Image. Width - info -> originalWidth ; const int_fast32_t heightOverflow = gifFilePtr -> Image. Height - info -> originalHeight
Buggy code:
 static inline int mount_entry_on_systemfs ( struct mntent * mntent ) { <START_BUG> return mount_entry_on_generic ( mntent, mntent -> mnt_dir ) ; <END_BUG> }

Fix:
<S2SV_ModStart> mntent -> mnt_dir, NULL
Buggy code:
 static vpx_codec_err_t vp8e_set_config ( vpx_codec_alg_priv_t * ctx, const vpx_codec_enc_cfg_t * cfg ) { vpx_codec_err_t res ; <START_BUG> if ( ( ( cfg -> g_w!= ctx -> cfg. g_w ) || ( cfg -> g_h!= ctx -> cfg. g_h ) ) <END_BUG>  && ( cfg -> g_lag_in_frames > 1 || cfg -> g_pass!= VPX_RC_ONE_PASS ) ) <START_BUG> <END_BUG> ERROR ( "Cannot   change   width   or   height   after   initialization" ) ;  if ( ( cfg -> g_lag_in_frames > ctx -> cfg. g_lag_in_frames ) ) ERROR ( "Cannot   increase   lag_in_frames" ) ; res = validate_config ( ctx, cfg, & ctx -> vp8_cfg, 0 ) ; if (! res ) { ctx -> cfg = * cfg ; set_vp8e_config ( & ctx -> oxcf, ctx -> cfg, ctx -> vp8_cfg, NULL ) ; vp8_change_config ( ctx -> cpi, & ctx -> oxcf ) ; } return res ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> cfg -> g_w <S2SV_ModStart> cfg. g_w || <S2SV_ModEnd> cfg -> g_h <S2SV_ModStart>. g_h ) { if <S2SV_ModEnd> ( cfg -> <S2SV_ModStart>!= VPX_RC_ONE_PASS ) <S2SV_ModEnd> ERROR ( "Cannot <S2SV_blank> change <S2SV_blank> width <S2SV_blank> or <S2SV_blank> height <S2SV_blank> after <S2SV_blank> initialization" <S2SV_ModStart> "Cannot <S2SV_blank> change <S2SV_blank> width <S2SV_blank> or <S2SV_blank> height <S2SV_blank> after <S2SV_blank> initialization" ) ; if ( ( ctx -> cpi -> initial_width && ( int ) cfg -> g_w > ctx -> cpi -> initial_width ) || ( ctx -> cpi -> initial_height && ( int ) cfg -> g_h > ctx -> cpi -> initial_height ) ) ERROR ( "Cannot <S2SV_blank> increase <S2SV_blank> width <S2SV_blank> or <S2SV_blank> height <S2SV_blank> larger <S2SV_blank> than <S2SV_blank> their <S2SV_blank> initial <S2SV_blank> values" ) ; }
Buggy code:
 <START_BUG> static int read_segment_id ( vp9_reader * r, const struct segmentation * seg ) { <END_BUG>  return vp9_read_tree ( r, vp9_segment_tree, seg -> tree_probs ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> int read_segment_id ( vpx_reader <S2SV_ModEnd> * r, <S2SV_ModStart> ) { return vpx_read_tree <S2SV_ModEnd> ( r,
Buggy code:
 SYSCALL_DEFINE6 ( recvfrom, int, fd, void __user *, ubuf, size_t, size, unsigned int, flags, struct sockaddr __user *, addr, int __user *, addr_len ) { struct socket * sock ; struct iovec iov ; struct msghdr msg ; struct sockaddr_storage address ; int err, err2 ; int fput_needed ; if ( size > INT_MAX ) size = INT_MAX ; sock = sockfd_lookup_light ( fd, & err, & fput_needed ) ; if (! sock ) goto out ; msg. msg_control = NULL ; msg. msg_controllen = 0 ; msg. msg_iovlen = 1 ; msg. msg_iov = & iov ; iov. iov_len = size ; iov. iov_base = ubuf ; <START_BUG> msg. msg_name = ( struct sockaddr * ) & address ; <END_BUG>  msg. msg_namelen = sizeof ( address ) ; <START_BUG> if ( sock -> file -> f_flags & O_NONBLOCK ) flags |= MSG_DONTWAIT ; err = sock_recvmsg ( sock, & msg, size, flags ) ; if ( err >= 0 && addr!= NULL ) { err2 = move_addr_to_user ( & address, msg. msg_namelen, addr, addr_len ) ; if ( err2 < 0 ) err = err2 ; } fput_light ( sock -> file, fput_needed ) ; out : return err ; }<END_BUG>

Fix:
<S2SV_ModStart>. msg_name = addr? <S2SV_ModStart> ) & address : NULL <S2SV_ModStart>. msg_namelen = 0 <S2SV_ModEnd> ; if (
Buggy code:
 int vp8_alloc_frame_buffers ( VP8_COMMON * oci, int width, int height ) { int i ; vp8_de_alloc_frame_buffers ( oci ) ; if ( ( width & 0xf )!= 0 ) width += 16 - ( width & 0xf ) ; if ( ( height & 0xf )!= 0 ) height += 16 - ( height & 0xf ) ; for ( i = 0 ; i < NUM_YV12_BUFFERS ; i ++ ) { oci -> fb_idx_ref_cnt [ i ] = 0 ; oci -> yv12_fb [ i ]. flags = 0 ; if ( vp8_yv12_alloc_frame_buffer ( & oci -> yv12_fb [ i ], width, height, VP8BORDERINPIXELS ) < 0 ) goto allocation_fail ; } oci -> new_fb_idx = 0 ; oci -> lst_fb_idx = 1 ; oci -> gld_fb_idx = 2 ; oci -> alt_fb_idx = 3 ; oci -> fb_idx_ref_cnt [ 0 ] = 1 ; oci -> fb_idx_ref_cnt [ 1 ] = 1 ; oci -> fb_idx_ref_cnt [ 2 ] = 1 ; oci -> fb_idx_ref_cnt [ 3 ] = 1 ; if ( vp8_yv12_alloc_frame_buffer ( & oci -> temp_scale_frame, width, 16, VP8BORDERINPIXELS ) < 0 ) goto allocation_fail ; oci -> mb_rows = height >> 4 ; oci -> mb_cols = width >> 4 ; oci -> MBs = oci -> mb_rows * oci -> mb_cols ; oci -> mode_info_stride = oci -> mb_cols + 1 ; oci -> mip = vpx_calloc ( ( oci -> mb_cols + 1 ) * ( oci -> mb_rows + 1 ), sizeof ( MODE_INFO ) ) ; if (! oci -> mip ) goto allocation_fail ; oci -> mi = oci -> mip + oci -> mode_info_stride + 1 ; oci -> above_context = vpx_calloc ( sizeof ( ENTROPY_CONTEXT_PLANES ) * oci -> mb_cols, 1 ) ; if (! oci -> above_context ) goto allocation_fail

Fix:
<S2SV_ModStart> = 0 ; memset <S2SV_ModEnd> ( & oci <S2SV_ModStart> ) ) ; memset <S2SV_ModEnd> ( oci ->
Buggy code:
 void ihevcd_parse_sei_payload ( codec_t * ps_codec, UWORD32 u4_payload_type, UWORD32 u4_payload_size, WORD8 i1_nal_type ) { parse_ctxt_t * ps_parse = & ps_codec -> s_parse ; bitstrm_t * ps_bitstrm = & ps_parse -> s_bitstrm ; WORD32 payload_bits_remaining = 0 ; sps_t * ps_sps ; UWORD32 i ; for ( i = 0 ; i < MAX_SPS_CNT ; i ++ ) { ps_sps = ps_codec -> ps_sps_base + i ; if ( ps_sps -> i1_sps_valid ) { break ; } } if ( NULL == ps_sps ) { return ; } if ( NAL_PREFIX_SEI == i1_nal_type ) { switch ( u4_payload_type ) { case SEI_BUFFERING_PERIOD : ps_parse -> s_sei_params. i1_sei_parameters_present_flag = 1 ; ihevcd_parse_buffering_period_sei ( ps_codec, ps_sps ) ; break ; case SEI_PICTURE_TIMING : ps_parse -> s_sei_params. i1_sei_parameters_present_flag = 1 ; ihevcd_parse_pic_timing_sei ( ps_codec, ps_sps ) ; break ; case SEI_TIME_CODE : ps_parse -> s_sei_params. i1_sei_parameters_present_flag = 1 ; ihevcd_parse_time_code_sei ( ps_codec ) ; break ; case SEI_MASTERING_DISPLAY_COLOUR_VOLUME : ps_parse -> s_sei_params. i4_sei_mastering_disp_colour_vol_params_present_flags = 1 ; ihevcd_parse_mastering_disp_params_sei ( ps_codec ) ; break ; case SEI_USER_DATA_REGISTERED_ITU_T_T35 : ps_parse -> s_sei_params. i1_sei

Fix:
<S2SV_ModStart> = 1 ; if ( ps_parse -> s_sei_params. i4_sei_user_data_cnt >= USER_DATA_MAX ) { for ( i = 0 ; i < u4_payload_size // 4 ; i ++ ) { ihevcd_bits_flush ( ps_bitstrm, 4 * 8 ) ; } ihevcd_bits_flush ( ps_bitstrm, ( u4_payload_size - i * 4 ) * 8 ) ; } else { <S2SV_ModStart> u4_payload_size ) ; } <S2SV_ModStart> = 1 ; if ( ps_parse -> s_sei_params. i4_sei_user_data_cnt >= USER_DATA_MAX ) { for ( i = 0 ; i < u4_payload_size // 4 ; i ++ ) { ihevcd_bits_flush ( ps_bitstrm, 4 * 8 ) ; } ihevcd_bits_flush ( ps_bitstrm, ( u4_payload_size - i * 4 ) * 8 ) ; } else { <S2SV_ModStart> u4_payload_size ) ; }
Buggy code:
 static Image * ReadSUNImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define RMT_EQUAL_RGB 1 # define RMT_NONE 0 # define RMT_RAW 2 # define RT_STANDARD 1 # define RT_ENCODED 2 # define RT_FORMAT_RGB 3 typedef struct _SUNInfo { unsigned int magic, width, height, depth, length, type, maptype, maplength ; } SUNInfo ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; size_t bytes_per_line, extent, length ; ssize_t count, y ; SUNInfo sun_info ; unsigned char * sun_data, * sun_pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } ( void ) ResetMagickMemory ( & sun_info, 0, sizeof ( sun_info ) ) ; sun_info. magic = ReadBlobMSBLong ( image ) ; do { if ( sun_info. magic!= 0x59a66a95 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; sun_info. width = ReadBlobMSBLong ( image ) ; sun_info. height = ReadBlobMSBLong ( image ) ; sun_info. depth = ReadBlobMSBLong ( image ) ; sun_info. length = ReadBlobMSBLong ( image ) ; sun_info. type = ReadBlobMSBLong ( image ) ; sun_info. maptype = ReadBlobMSBLong ( image ) ; sun_info. ma

Fix:
<S2SV_ModStart> RT_ENCODED ) && ( ( number_pixels * <S2SV_ModEnd> sun_info. depth <S2SV_ModStart> sun_info. depth ) > ( 8 * <S2SV_ModEnd> sun_info. length <S2SV_ModStart> sun_info. length ) <S2SV_ModStart> ( bytes_per_line + bytes_per_line <S2SV_ModEnd> % 2 )