nus-yam/ex-repair huggingface dataset:
Buggy code:
 int cx23888_ir_probe ( struct cx23885_dev * dev ) { struct cx23888_ir_state * state ; struct v4l2_subdev * sd ; struct v4l2_subdev_ir_parameters default_params ; int ret ; state = kzalloc ( sizeof ( struct cx23888_ir_state ), GFP_KERNEL ) ; if ( state == NULL ) return - ENOMEM ; spin_lock_init ( & state -> rx_kfifo_lock ) ; <START_BUG> if ( kfifo_alloc ( & state -> rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL ) ) <END_BUG> return - ENOMEM ;  state -> dev = dev ; <START_BUG> sd = & state -> sd ; v4l2_subdev_init ( sd, & cx23888_ir_controller_ops ) ; v4l2_set_subdevdata ( sd, state ) ; snprintf ( sd -> name, sizeof ( sd -> name ), "%s//888-ir", dev -> name ) ; sd -> grp_id = CX23885_HW_888_IR ; ret = v4l2_device_register_subdev ( & dev -> v4l2_dev, sd ) ; if ( ret == 0 ) { cx23888_ir_write4 ( dev, CX23888_IR_IRQEN_REG, 0 ) ; mutex_init ( & state -> rx_params_lock ) ; default_params = default_rx_params ; v4l2_subdev_call ( sd, ir, rx_s_parameters, & default_params ) ; mutex_init ( & state -> tx_params_lock ) ; default_params = default_tx_params ; v4l2_subdev_call ( sd, ir, tx_s_parameters, & default_params ) ; } else { kfifo_free ( & state -> rx_kfifo ) ; } return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> GFP_KERNEL ) ) { kfree ( state ) ; <S2SV_ModStart> - ENOMEM ; }
Buggy code:
 void vp8_pick_intra_mode ( MACROBLOCK * x, int * rate_ ) { int error4x4, error16x16 = INT_MAX ; int rate, best_rate = 0, distortion, best_sse ; MB_PREDICTION_MODE mode, best_mode = DC_PRED ; int this_rd ; unsigned int sse ; BLOCK * b = & x -> block [ 0 ] ; MACROBLOCKD * xd = & x -> e_mbd ; xd -> mode_info_context -> mbmi. ref_frame = INTRA_FRAME ; pick_intra_mbuv_mode ( x ) ; for ( mode = DC_PRED ; mode <= TM_PRED ; mode ++ ) { xd -> mode_info_context -> mbmi. mode = mode ; vp8_build_intra_predictors_mby_s ( xd, xd -> dst. y_buffer - xd -> dst. y_stride, xd -> dst. y_buffer - 1, xd -> dst. y_stride, xd -> predictor, 16 ) ; <START_BUG> distortion = vp8_variance16x16 <END_BUG> ( * ( b -> base_src ), b -> src_stride, xd -> predictor, 16, & sse ) ; rate = x -> mbmode_cost [ xd -> frame_type ] [ mode ] ; this_rd = RDCOST ( x -> rdmult, x -> rddiv, rate, distortion ) ; if ( error16x16 > this_rd ) { error16x16 = this_rd ; best_mode = mode ; best_sse = sse ; best_rate = rate ; } } xd -> mode_info_context -> mbmi. mode = best_mode ; error4x4 = pick_intra4x4mby_modes ( x, & rate, & best_sse ) ; if ( error4x4 < error16x16 ) { xd -> mode_info_context -> mbmi. mode = B_PRED ; best_rate = rate ; } * rate_ = best_rate ; }

Fix:
<S2SV_ModStart> ; distortion = vpx_variance16x16 <S2SV_ModEnd> ( * (
Buggy code:
 static Image * ReadPDBImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { unsigned char attributes, tag [ 3 ] ; Image * image ; MagickBooleanType status ; PDBImage pdb_image ; PDBInfo pdb_info ; Quantum index ; register ssize_t x ; register Quantum * q ; register unsigned char * p ; size_t bits_per_pixel, num_pad_bytes, one, packets ; ssize_t count, img_offset, comment_offset = 0, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } count = ReadBlob ( image, sizeof ( pdb_info. name ), ( unsigned char * ) pdb_info. name ) ; if ( count!= sizeof ( pdb_info. name ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; pdb_info. attributes = ( short ) ReadBlobMSBShort ( image ) ; pdb_info. version = ( short ) ReadBlobMSBShort ( image ) ; pdb_info. create_time = ReadBlobMSBLong ( image ) ; pdb_info. modify_time = ReadBlobMSBLong ( image ) ; pdb_info. archive_time = ReadBlobMSBLong ( image ) ; pdb_info. modify_number = ReadBlobMSBLong ( image ) ; pdb_info. application_info = ReadBlobMSBLong ( image ) ; pdb_info. sort_info = ReadBlobMSBLong ( image ) ; ( void ) ReadBlob ( image, 4, ( unsigned char * ) pdb_info. type ) ; ( void ) ReadBlob ( image, 4, ( unsigned char * ) pdb

Fix:
<S2SV_ModStart> ( packets + 257UL <S2SV_ModEnd>, image ->
Buggy code:
 void gps_tracker ( void ) { ssize_t unused ; int gpsd_sock ; char line [ 256 ], * temp ; struct sockaddr_in gpsd_addr ; int ret, is_json, pos ; fd_set read_fd ; struct timeval timeout ; pos = 0 ; gpsd_sock = socket ( AF_INET, SOCK_STREAM, 0 ) ; if ( gpsd_sock < 0 ) { return ; } gpsd_addr. sin_family = AF_INET ; gpsd_addr. sin_port = htons ( 2947 ) ; gpsd_addr. sin_addr. s_addr = inet_addr ( "127.0.0.1" ) ; if ( connect ( gpsd_sock, ( struct sockaddr * ) & gpsd_addr, sizeof ( gpsd_addr ) ) < 0 ) { return ; } FD_ZERO ( & read_fd ) ; FD_SET ( gpsd_sock, & read_fd ) ; timeout. tv_sec = 1 ; timeout. tv_usec = 0 ; is_json = select ( gpsd_sock + 1, & read_fd, NULL, NULL, & timeout ) ; if ( is_json ) { if ( recv ( gpsd_sock, line, sizeof ( line ) - 1, 0 ) <= 0 ) return ; is_json = ( line [ 0 ] == '{' ) ; if ( is_json ) { memset ( line, 0, sizeof ( line ) ) ; strcpy ( line, "?WATCH={\\"json\\":true};\\n" ) ; if ( send ( gpsd_sock, line, 22, 0 )!= 22 ) return ; memset ( line, 0, sizeof ( line ) ) ; if ( recv ( gpsd_sock, line, sizeof ( line ) - 1, 0 ) <= 0 ) return ; if ( strncmp ( line, "{\\"class\\":\\"DEVICES\\",\\"devices\\":[]}", 32 ) == 0 ) { close ( gpsd_sock ) ; return ; } else { pos = strlen ( line ) ; } } } while ( G. do_exit == 0 ) { usleep ( 500000 ) ; memset ( G. gps_loc, 0, sizeof ( float ) * 5 ) ; if ( is_json ) { if ( pos == sizeof

Fix:
<S2SV_ModStart> line ) - pos -
Buggy code:
 static vpx_codec_err_t ctrl_copy_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG>  vpx_ref_frame_t * data = va_arg ( args, vpx_ref_frame_t * ) ; <START_BUG> if ( data ) { vpx_ref_frame_t * frame = ( vpx_ref_frame_t * ) data ; YV12_BUFFER_CONFIG sd ; <END_BUG> image2yuvconfig ( & frame -> img, & sd ) ;  <START_BUG> return vp9_copy_reference_dec ( ctx -> pbi, <END_BUG> ( VP9_REFFRAME ) frame -> frame_type, & sd ) ; } else { return VPX_CODEC_INVALID_PARAM ; } }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> * ) ; if ( ctx -> frame_parallel_decode ) { set_error_detail ( ctx, "Not <S2SV_blank> supported <S2SV_blank> in <S2SV_blank> frame <S2SV_blank> parallel <S2SV_blank> decode" ) ; return VPX_CODEC_INCAPABLE ; } <S2SV_ModStart> YV12_BUFFER_CONFIG sd ; VPxWorker * const worker = ctx -> frame_workers ; FrameWorkerData * const frame_worker_data = ( FrameWorkerData * ) worker -> data1 ; <S2SV_ModStart> return vp9_copy_reference_dec ( frame_worker_data <S2SV_ModEnd> -> pbi,
Buggy code:
 Datum hstore_recv ( PG_FUNCTION_ARGS ) { int32 buflen ; HStore * out ; Pairs * pairs ; int32 i ; int32 pcount ; StringInfo buf = ( StringInfo ) PG_GETARG_POINTER ( 0 ) ; pcount = pq_getmsgint ( buf, 4 ) ; if ( pcount == 0 ) { out = hstorePairs ( NULL, 0, 0 ) ; PG_RETURN_POINTER ( out ) ; } <START_BUG> pairs = palloc ( pcount * sizeof ( Pairs ) ) ; <END_BUG> for ( i = 0 ; i < pcount ; ++ i ) { int rawlen = pq_getmsgint ( buf, 4 ) ; int len ; if ( rawlen < 0 ) ereport ( ERROR, ( errcode ( ERRCODE_NULL_VALUE_NOT_ALLOWED ), errmsg ( "null   value   not   allowed   for   hstore   key" ) ) ) ; pairs [ i ]. key = pq_getmsgtext ( buf, rawlen, & len ) ; pairs [ i ]. keylen = hstoreCheckKeyLen ( len ) ; pairs [ i ]. needfree = true ; rawlen = pq_getmsgint ( buf, 4 ) ; if ( rawlen < 0 ) { pairs [ i ]. val = NULL ; pairs [ i ]. vallen = 0 ; pairs [ i ]. isnull = true ; } else { pairs [ i ]. val = pq_getmsgtext ( buf, rawlen, & len ) ; pairs [ i ]. vallen = hstoreCheckValLen ( len ) ; pairs [ i ]. isnull = false ; } } pcount = hstoreUniquePairs ( pairs, pcount, & buflen ) ; out = hstorePairs ( pairs, pcount, buflen ) ; PG_RETURN_POINTER ( out ) ; }

Fix:
<S2SV_ModStart> ) ; } if ( pcount < 0 || pcount > MaxAllocSize // sizeof ( Pairs ) ) ereport ( ERROR, ( errcode ( ERRCODE_PROGRAM_LIMIT_EXCEEDED ), errmsg ( "number <S2SV_blank> of <S2SV_blank> pairs <S2SV_blank> (%d) <S2SV_blank> exceeds <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> (%d)", pcount, ( int ) ( MaxAllocSize // sizeof ( Pairs ) ) ) ) ) ;
Buggy code:
 <START_BUG> static int decode_unsigned_max ( struct vp9_read_bit_buffer * rb, int max ) { <END_BUG>  const int data = vp9_rb_read_literal ( rb, get_unsigned_bits ( max ) ) ; <START_BUG> return data > max? max : data ; }<END_BUG>

Fix:
<S2SV_ModStart> decode_unsigned_max ( struct vpx_read_bit_buffer <S2SV_ModEnd> * rb, <S2SV_ModStart> int data = vpx_rb_read_literal <S2SV_ModEnd> ( rb,
Buggy code:
 static int forbidden_name ( struct compiling * c, identifier name, const node * n, int full_checks ) { assert ( PyUnicode_Check ( name ) ) ; <START_BUG> if ( PyUnicode_CompareWithASCIIString ( name, "__debug__" ) == 0 ) { <END_BUG> ast_error ( c, n, "assignment   to   keyword" ) ; return 1 ; } if ( full_checks ) { const char * const * p ; for ( p = FORBIDDEN ; * p ; p ++ ) {  if ( PyUnicode_CompareWithASCIIString ( name, * p ) == 0 ) { <START_BUG> ast_error ( c, n, "assignment   to   keyword" ) ; return 1 ; } } } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart> ; if ( _PyUnicode_EqualToASCIIString <S2SV_ModEnd> ( name, <S2SV_ModStart>, "__debug__" ) <S2SV_ModEnd> ) { ast_error <S2SV_ModStart> { if ( _PyUnicode_EqualToASCIIString <S2SV_ModEnd> ( name, <S2SV_ModStart> * p ) <S2SV_ModEnd> ) { ast_error
Buggy code:
 void vp8_vertical_band_2_1_scale_c ( unsigned char * source, unsigned int src_pitch, unsigned char * dest, unsigned int dest_pitch, unsigned int dest_width ) { ( void ) dest_pitch ; ( void ) src_pitch ; <START_BUG> vpx_memcpy ( dest, source, dest_width ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ) src_pitch ; memcpy <S2SV_ModEnd> ( dest,
Buggy code:
 static int juniper_parse_header ( netdissect_options * ndo, const u_char * p, const struct pcap_pkthdr * h, struct juniper_l2info_t * l2info ) { const struct juniper_cookie_table_t * lp = juniper_cookie_table ; u_int idx, jnx_ext_len, jnx_header_len = 0 ; uint8_t tlv_type, tlv_len ; uint32_t control_word ; int tlv_value ; const u_char * tptr ; l2info -> header_len = 0 ; l2info -> cookie_len = 0 ; l2info -> proto = 0 ; l2info -> length = h -> len ; l2info -> caplen = h -> caplen ; ND_TCHECK2 ( p [ 0 ], 4 ) ; l2info -> flags = p [ 3 ] ; l2info -> direction = p [ 3 ] & JUNIPER_BPF_PKT_IN ; if ( EXTRACT_24BITS ( p )!= JUNIPER_MGC_NUMBER ) { ND_PRINT ( ( ndo, "no   magic-number   found!" ) ) ; return 0 ; } if ( ndo -> ndo_eflag ) ND_PRINT ( ( ndo, "%3s   ", tok2str ( juniper_direction_values, "---", l2info -> direction ) ) ) ; jnx_header_len = 4 ; if ( ndo -> ndo_vflag > 1 ) ND_PRINT ( ( ndo, "\\n\\tJuniper   PCAP   Flags   [%s]", bittok2str ( jnx_flag_values, "none", l2info -> flags ) ) ) ; if ( ( l2info -> flags & JUNIPER_BPF_EXT ) == JUNIPER_BPF_EXT ) { tptr = p + jnx_header_len ; ND_TCHECK2 ( tptr [ 0 ], 2 ) ; jnx_ext_len = EXTRACT_16BITS ( tptr ) ; jnx_header_len += 2 ; tptr += 2 ; jnx_header_len += j

Fix:
<S2SV_ModStart> ) ) ; ND_TCHECK_16BITS ( p + l2info -> cookie_len ) ;
Buggy code:
 <START_BUG> static void pack_mb_tokens ( vp9_writer * w, <END_BUG>  TOKENEXTRA * * tp, const TOKENEXTRA * stop ) { <START_BUG> TOKENEXTRA * p = * tp ; while ( p < stop && p -> token!= EOSB_TOKEN ) { const int t = p -> token ; const struct vp9_token * const a = & vp9_coef_encodings [ t ] ; <END_BUG> const vp9_extra_bit * const b = & vp9_extra_bits [ t ] ;  <START_BUG> int i = 0 ; <END_BUG> int v = a -> value ; int n = a -> len ; if ( p -> skip_eob_node ) { n -= p -> skip_eob_node ; i = 2 * p -> skip_eob_node ; } if ( t >= TWO_TOKEN && t < EOB_TOKEN ) { int len = UNCONSTRAINED_NODES - p -> skip_eob_node ; int bits = v >> ( n - len ) ; vp9_write_tree ( w, vp9_coef_tree, p -> context_tree, bits, len, i ) ; vp9_write_tree ( w, vp9_coef_con_tree, vp9_pareto8_full [ p -> context_tree [ PIVOT_NODE ] - 1 ], v, n - len, 0 ) ; } else { vp9_write_tree ( w, vp9_coef_tree, p -> context_tree, v, n, i ) ; } if ( b -> base_val ) { const int e = p -> extra, l = b -> len ; if ( l ) { const unsigned char * pb = b -> prob ; int v = e >> 1 ; int n = l ; int i = 0 ; do { const int bb = ( v >> -- n ) & 1 ;  vp9_write ( w, bb, pb [ i >> 1 ] ) ; <START_BUG> i = b -> tree [ i + bb ] ; } while ( n ) ; } <END_BUG> vp9_write_bit ( w, e & 1 ) ;  } ++ p ; } * tp = p + ( p -> token == EOSB_TOKEN ) ; }

Fix:
<S2SV_ModStart> void pack_mb_tokens ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> const TOKENEXTRA * const stop, vpx_bit_depth_t bit_depth <S2SV_ModEnd> ) { TOKENEXTRA <S2SV_ModStart> t ] ; int i = 0 ; int v = a -> value ; int n = a -> len ; # if CONFIG_VP9_HIGHBITDEPTH <S2SV_ModStart> const vp9_extra_bit * b ; if ( bit_depth == VPX_BITS_12 ) b = & vp9_extra_bits_high12 [ t ] ; else if ( bit_depth == VPX_BITS_10 ) b = & vp9_extra_bits_high10 [ t ] ; else <S2SV_ModEnd> b = & <S2SV_ModStart> t ] ; # else const vp9_extra_bit * const b = & vp9_extra_bits [ t ] ; ( void ) bit_depth ; # endif <S2SV_ModEnd> if ( p <S2SV_ModStart> & 1 ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> ) ; } vpx_write_bit <S2SV_ModEnd> ( w,
Buggy code:
 static inline void header_put_le_3byte ( SF_PRIVATE * psf, int x ) <START_BUG> { if ( psf -> headindex < SIGNED_SIZEOF ( psf -> header ) - 3 ) <END_BUG>  { psf -> header [ psf -> headindex ++ ] = x ; <START_BUG> <END_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 8 ) ;  <START_BUG> psf -> header [ psf -> headindex ++ ] = ( x >> 16 ) ; <END_BUG>  } ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> x ) { <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. ptr [ <S2SV_ModEnd> psf -> header <S2SV_ModStart> psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> psf -> header. ptr <S2SV_ModStart> [ psf -> header. indx <S2SV_ModEnd> ++ ] = <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static size_t send_control_msg ( VirtIOSerial * vser, void * buf, size_t len ) { VirtQueueElement elem ; VirtQueue * vq ; vq = vser -> c_ivq ; if (! virtio_queue_ready ( vq ) ) { return 0 ; } if (! virtqueue_pop ( vq, & elem ) ) { return 0 ; } <START_BUG> memcpy ( elem. in_sg [ 0 ]. iov_base, buf, len ) ; <END_BUG> virtqueue_push ( vq, & elem, len ) ; virtio_notify ( VIRTIO_DEVICE ( vser ), vq ) ; return len ; }

Fix:
<S2SV_ModStart> 0 ; } iov_from_buf <S2SV_ModEnd> ( elem. <S2SV_ModStart> elem. in_sg, elem. in_num, 0 <S2SV_ModEnd>, buf,
Buggy code:
 NOEXPORT int verify_callback ( int preverify_ok, X509_STORE_CTX * callback_ctx ) { SSL * ssl ; CLI * c ; ssl = X509_STORE_CTX_get_ex_data ( callback_ctx, SSL_get_ex_data_X509_STORE_CTX_idx ( ) ) ; c = SSL_get_ex_data ( ssl, index_ssl_cli ) ; if (! c -> opt -> option. verify_chain &&! c -> opt -> option. verify_peer ) { s_log ( LOG_INFO, "Certificate   verification   disabled" ) ; return 1 ; } <START_BUG> if ( verify_checks ( c, preverify_ok, callback_ctx ) ) { <END_BUG> SSL_SESSION * sess = SSL_get1_session ( c -> ssl ) ; if ( sess ) { int ok = SSL_SESSION_set_ex_data ( sess, index_session_authenticated,  ( void * ) ( - 1 ) ) ; <START_BUG> SSL_SESSION_free ( sess ) ; if (! ok ) { sslerror ( "SSL_SESSION_set_ex_data" ) ; return 0 ; } } return 1 ; } <END_BUG> if ( c -> opt -> option. client || c -> opt -> protocol )  return 0 ; <START_BUG> if ( c -> opt -> redirect_addr. names ) <END_BUG> return 1 ; return 0 ; }

Fix:
<S2SV_ModStart> callback_ctx ) ) return 1 ; if ( c -> opt -> option. client || c -> opt -> protocol ) return 0 ; if ( c -> opt -> redirect_addr. names ) <S2SV_ModStart>, index_session_authenticated, NULL <S2SV_ModEnd> ) ; SSL_SESSION_free <S2SV_ModStart> 1 ; } <S2SV_ModEnd> return 0 ; <S2SV_ModStart> return 0 ; <S2SV_ModEnd> } <S2SV_null> <S2SV_null>
Buggy code:
 int handle_unaligned_access ( insn_size_t instruction, struct pt_regs * regs, struct mem_access * ma, int expected, unsigned long address ) { u_int rm ; int ret, index ; if ( instruction_size ( instruction )!= 2 ) return - EINVAL ; index = ( instruction >> 8 ) & 15 ; rm = regs -> regs [ index ] ; if (! expected ) { unaligned_fixups_notify ( current, instruction, regs ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, <END_BUG> regs, address ) ; } ret = - EFAULT ; switch ( instruction & 0xF000 ) { case 0x0000 : if ( instruction == 0x000B ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) regs -> pc = regs -> pr ; } else if ( ( instruction & 0x00FF ) == 0x0023 ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) regs -> pc += rm + 4 ; } else if ( ( instruction & 0x00FF ) == 0x0003 ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) { regs -> pr = regs -> pc + 4 ; regs -> pc += rm + 4 ; } } else { goto simple ; } break ; case 0x1000 : goto simple ; case 0x2000 : goto simple ; case 0x4000 : if ( ( instruction & 0x00FF ) == 0x002B ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) regs -> pc = rm ; } else if ( ( instruction & 0x00FF ) == 0x000B ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) { regs -> pr = regs -> pc + 4 ; regs -> pc = rm ; } } else { goto simple ; } break ; case 0x5000 : goto simple ; case 0x6000 : goto simple ; case 0x8000 : switch ( instruction & 0x0F00 ) { case 0x0100 : goto simple ; case 0x0500 : goto simple ; case 0x0B00 : break ; case 0x0F

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 static krb5_error_code pkinit_server_return_padata ( krb5_context context, krb5_pa_data * padata, krb5_data * req_pkt, krb5_kdc_req * request, krb5_kdc_rep * reply, krb5_keyblock * encrypting_key, krb5_pa_data * * send_pa, krb5_kdcpreauth_callbacks cb, krb5_kdcpreauth_rock rock, krb5_kdcpreauth_moddata moddata, krb5_kdcpreauth_modreq modreq ) { krb5_error_code retval = 0 ; krb5_data scratch = { 0, 0, NULL } ; krb5_pa_pk_as_req * reqp = NULL ; krb5_pa_pk_as_req_draft9 * reqp9 = NULL ; int i = 0 ; unsigned char * subjectPublicKey = NULL ; unsigned char * dh_pubkey = NULL, * server_key = NULL ; unsigned int subjectPublicKey_len = 0 ; unsigned int server_key_len = 0, dh_pubkey_len = 0 ; krb5_kdc_dh_key_info dhkey_info ; krb5_data * encoded_dhkey_info = NULL ; krb5_pa_pk_as_rep * rep = NULL ; krb5_pa_pk_as_rep_draft9 * rep9 = NULL ; krb5_data * out_data = NULL ; krb5_octet_data secret ; krb5_enctype enctype = - 1 ; krb5_reply_key_pack * key_pack = NULL ; krb5_reply_key_pack_draft9 * key_pack9 = NULL ; krb5_data * encoded_key_pack = NULL ; pkinit_kdc_context plgctx ; pkinit_kdc_req_context reqctx ; int fixed_keypack = 0 ; * send_pa = NULL ; if ( padata -> pa_type == KRB5_PADATA_PKINIT_KX ) { return return_pkinit_kx ( context, request, reply, encrypting_key, send_pa ) ; } if

Fix:
<S2SV_ModStart> if ( rep!= NULL && rep <S2SV_ModStart>. data = ( char * )
Buggy code:
 static struct tok_state * tok_new ( void ) { struct tok_state * tok = ( struct tok_state * ) PyMem_MALLOC ( sizeof ( struct tok_state ) ) ; if ( tok == NULL ) return NULL ; tok -> buf = tok -> cur = tok -> end = tok -> inp = tok -> start = NULL ; tok -> done = E_OK ; tok -> fp = NULL ; tok -> input = NULL ; tok -> tabsize = TABSIZE ; tok -> indent = 0 ; tok -> indstack [ 0 ] = 0 ; tok -> atbol = 1 ; tok -> pendin = 0 ; tok -> prompt = tok -> nextprompt = NULL ; tok -> lineno = 0 ; <START_BUG> tok -> level = 0 ; <END_BUG> tok -> altwarning = 1 ; tok -> alterror = 1 ; tok -> alttabsize = 1 ; tok -> altindstack [ 0 ] = 0 ; tok -> decoding_state = STATE_INIT ; tok -> decoding_erred = 0 ; tok -> read_coding_spec = 0 ; tok -> enc = NULL ; tok -> encoding = NULL ; tok -> cont_line = 0 ; # ifndef PGEN tok -> filename = NULL ; tok -> decoding_readline = NULL ; tok -> decoding_buffer = NULL ; # endif tok -> async_def = 0 ; tok -> async_def_indent = 0 ; tok -> async_def_nl = 0 ;  return tok ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> level = 0 <S2SV_ModEnd> ; tok -> <S2SV_ModStart> = 0 ; tok -> async_always = 0 ;
Buggy code:
 static int skcipher_recvmsg ( struct kiocb * unused, struct socket * sock, struct msghdr * msg, size_t ignored, int flags ) { struct sock * sk = sock -> sk ; struct alg_sock * ask = alg_sk ( sk ) ; struct skcipher_ctx * ctx = ask -> private ; unsigned bs = crypto_ablkcipher_blocksize ( crypto_ablkcipher_reqtfm ( & ctx -> req ) ) ; struct skcipher_sg_list * sgl ; struct scatterlist * sg ; unsigned long iovlen ; struct iovec * iov ; int err = - EAGAIN ; int used ; long copied = 0 ; <START_BUG> lock_sock ( sk ) ; <END_BUG> msg -> msg_namelen = 0 ; for ( iov = msg -> msg_iov, iovlen = msg -> msg_iovlen ; iovlen > 0 ; iovlen --, iov ++ ) { unsigned long seglen = iov -> iov_len ; char __user * from = iov -> iov_base ; while ( seglen ) { sgl = list_first_entry ( & ctx -> tsgl, struct skcipher_sg_list, list ) ; sg = sgl -> sg ; while (! sg -> length ) sg ++ ; used = ctx -> used ; if (! used ) { err = skcipher_wait_for_data ( sk, flags ) ; if ( err ) goto unlock ; } used = min_t ( unsigned long, used, seglen ) ; used = af_alg_make_sg ( & ctx -> rsgl, from, used, 1 ) ; err = used ; if ( err < 0 ) goto unlock ; if ( ctx -> more || used < ctx -> used ) used -= used % bs ; err = - EINVAL ; if (! used ) goto free ; ablkcipher_request_set_crypt ( & ctx -> req, sg, ctx -> rsgl. sg, used, ctx -> iv ) ; err = af_alg_wait_for_completion ( ctx -> enc? crypto_ablkcipher_encrypt ( & ctx -> req ) : crypto_ablkcipher_decrypt ( & ctx -> req ), & ctx -> completion ) ; free : af_alg_free_sg ( & ctx -> rsgl ) ; if (

Fix:
<S2SV_ModStart> ( sk ) <S2SV_ModEnd> ; for (
Buggy code:
 <START_BUG> void vp9_cost_tokens_skip ( int * costs, const vp9_prob * probs, vp9_tree tree ) { <END_BUG> assert ( tree [ 0 ] <= 0 && tree [ 1 ] > 0 ) ; costs [ - tree [ 0 ] ] = vp9_cost_bit ( probs [ 0 ], 0 ) ; cost ( costs, tree, probs, 2, 0 ) ; }

Fix:
<S2SV_ModStart> costs, const vpx_prob <S2SV_ModEnd> * probs, <S2SV_ModStart> * probs, vpx_tree <S2SV_ModEnd> tree ) {
Buggy code:
 void cib_remote_connection_destroy ( gpointer user_data ) { <START_BUG> cib_client_t * client = user_data ; <END_BUG> if ( client == NULL ) { return ; } crm_trace ( "Cleaning   up   after   client   disconnect:   %s//%s", crm_str ( client -> name ), client -> id ) ; if ( client -> id!= NULL ) { if (! g_hash_table_remove ( client_list, client -> id ) ) { crm_err ( "Client   %s   not   found   in   the   hashtable", client -> name ) ; } } crm_trace ( "Destroying   %s   (%p)", client -> name, user_data ) ; num_clients -- ; crm_trace ( "Num   unfree\'d   clients:   %d", num_clients ) ;  free ( client -> name ) ; <START_BUG> free ( client -> callback_id ) ; free ( client -> id ) ; free ( client -> user ) ; <END_BUG> free ( client ) ;  crm_trace ( "Freed   the   cib   client" ) ; if ( cib_shutdown_flag ) { cib_shutdown ( 0 ) ; } return ; }

Fix:
<S2SV_ModStart> client = user_data ; int csock = 0 <S2SV_ModStart> num_clients ) ; if ( client -> remote_auth_timeout ) { g_source_remove ( client -> remote_auth_timeout ) ; } if ( client -> encrypted ) { # ifdef HAVE_GNUTLS_GNUTLS_H if ( client -> session ) { void * sock_ptr = gnutls_transport_get_ptr ( * client -> session ) ; csock = GPOINTER_TO_INT ( sock_ptr ) ; if ( client -> handshake_complete ) { gnutls_bye ( * client -> session, GNUTLS_SHUT_WR ) ; } gnutls_deinit ( * client -> session ) ; gnutls_free ( client -> session ) ; } # endif } else { csock = GPOINTER_TO_INT ( client -> session ) ; } client -> session = NULL ; if ( csock > 0 ) { close ( csock ) ; } <S2SV_ModStart> free ( client -> recv_buf ) ; free ( client
Buggy code:
 static int dccp_v6_send_response ( const struct sock * sk, struct request_sock * req ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct sk_buff * skb ; struct in6_addr * final_p, final ; struct flowi6 fl6 ; int err = - 1 ; struct dst_entry * dst ; memset ( & fl6, 0, sizeof ( fl6 ) ) ; fl6. flowi6_proto = IPPROTO_DCCP ; fl6. daddr = ireq -> ir_v6_rmt_addr ; fl6. saddr = ireq -> ir_v6_loc_addr ; fl6. flowlabel = 0 ; fl6. flowi6_oif = ireq -> ir_iif ; fl6. fl6_dport = ireq -> ir_rmt_port ; fl6. fl6_sport = htons ( ireq -> ir_num ) ; security_req_classify_flow ( req, flowi6_to_flowi ( & fl6 ) ) ; <START_BUG> final_p = fl6_update_dst ( & fl6, np -> opt, & final ) ; <END_BUG> dst = ip6_dst_lookup_flow ( sk, & fl6, final_p ) ; if ( IS_ERR ( dst ) ) { err = PTR_ERR ( dst ) ; dst = NULL ; goto done ; } skb = dccp_make_response ( sk, dst, req ) ; if ( skb!= NULL ) { struct dccp_hdr * dh = dccp_hdr ( skb ) ; dh -> dccph_checksum = dccp_v6_csum_finish ( skb, & ireq -> ir_v6_loc_addr, & ireq -> ir_v6_rmt_addr ) ; fl6. daddr = ireq -> ir_v6_rmt_addr ;  err = ip6_xmit ( sk, skb, & fl6, np -> opt, np -> tclass ) ; <START_BUG> err = net_xmit_eval ( err ) ; } done : dst_release ( dst ) ; return err ;<END_BUG>

Fix:
<S2SV_ModStart> ) ) ; rcu_read_lock ( ) ; <S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ) <S2SV_ModStart>, & final ) ; rcu_read_unlock ( <S2SV_ModStart> -> ir_v6_rmt_addr ; rcu_read_lock ( ) ; <S2SV_ModStart> & fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ), <S2SV_ModEnd> np -> tclass <S2SV_ModStart> np -> tclass ) ; rcu_read_unlock (
Buggy code:
 static void icmp6_opt_print ( netdissect_options * ndo, const u_char * bp, int resid ) { const struct nd_opt_hdr * op ; const struct nd_opt_prefix_info * opp ; const struct nd_opt_mtu * opm ; const struct nd_opt_rdnss * oprd ; const struct nd_opt_dnssl * opds ; const struct nd_opt_advinterval * opa ; const struct nd_opt_homeagent_info * oph ; const struct nd_opt_route_info * opri ; const u_char * cp, * ep, * domp ; struct in6_addr in6 ; const struct in6_addr * in6p ; size_t l ; u_int i ; # define ECHECK ( var ) if ( ( const u_char * ) & ( var ) > ep - sizeof ( var ) ) return cp = bp ; ep = ndo -> ndo_snapend ; while ( cp < ep ) { op = ( const struct nd_opt_hdr * ) cp ; ECHECK ( op -> nd_opt_len ) ; if ( resid <= 0 ) return ; if ( op -> nd_opt_len == 0 ) goto trunc ; if ( cp + ( op -> nd_opt_len << 3 ) > ep ) goto trunc ; ND_PRINT ( ( ndo, "\\n\\t     %s   option   (%u),   length   %u   (%u):   ", tok2str ( icmp6_opt_values, "unknown", op -> nd_opt_type ), op -> nd_opt_type, op -> nd_opt_len << 3, op -> nd_opt_len ) ) ; switch ( op -> nd_opt_type ) { case ND_OPT_SOURCE_LINKADDR : l = ( op -> nd_opt_len << 3 ) - 2 ; print_lladdr ( ndo, cp + 2, l ) ; break ; case ND_OPT_TARGET_LINKADDR : l = ( op -> nd_opt_len << 3 ) - 2 ; print_lladdr ( ndo, cp + 2, l ) ; break ; case ND_OPT_PREFIX_INFORMATION : opp = ( const struct nd_opt_prefix_info *

Fix:
<S2SV_ModStart> ( ndo, "%s", icmp6_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 static int uECC_sign_with_k ( const uint8_t * private_key, const uint8_t * message_hash, unsigned hash_size, uECC_word_t * k, uint8_t * signature, uECC_Curve curve ) { uECC_word_t tmp [ uECC_MAX_WORDS ] ; uECC_word_t s [ uECC_MAX_WORDS ] ; uECC_word_t * k2 [ 2 ] = { tmp, s } ; <START_BUG> # if uECC_VLI_NATIVE_LITTLE_ENDIAN <END_BUG> uECC_word_t * p = ( uECC_word_t * ) signature ; # else uECC_word_t p [ uECC_MAX_WORDS * 2 ] ; # endif uECC_word_t carry ; wordcount_t num_words = curve -> num_words ; wordcount_t num_n_words = BITS_TO_WORDS ( curve -> num_n_bits ) ; bitcount_t num_n_bits = curve -> num_n_bits ; if ( uECC_vli_isZero ( k, num_words ) || uECC_vli_cmp ( curve -> n, k, num_n_words )!= 1 ) { return 0 ; } carry = regularize_k ( k, tmp, s, curve ) ;  EccPoint_mult ( p, curve -> G, k2 [! carry ], 0, num_n_bits + 1, curve ) ; <START_BUG> if ( uECC_vli_isZero ( p, num_words ) ) { return 0 ; } if (! g_rng_function ) { uECC_vli_clear ( tmp, num_n_words ) ; tmp [ 0 ] = 1 ; } else if (! uECC_generate_random_int ( tmp, curve -> n, num_n_words ) ) { return 0 ; } uECC_vli_modMult ( k, k, tmp, curve -> n, num_n_words ) ; uECC_vli_modInv ( k, k, curve -> n, num_n_words ) ; uECC_vli_modMult ( k, k<END_BUG>

Fix:
<S2SV_ModStart> s } ; uECC_word_t * initial_Z = 0 ; <S2SV_ModStart> curve ) ; if ( g_rng_function ) { if (! uECC_generate_random_int ( k2 [ carry ], curve -> p, num_words ) ) { return 0 ; } initial_Z = k2 [ carry ] ; } <S2SV_ModStart> carry ], initial_Z <S2SV_ModEnd>, num_n_bits +
Buggy code:
 void perf_event_disable ( struct perf_event * event ) { <START_BUG> struct perf_event_context * ctx = event -> ctx ; <END_BUG> struct task_struct * task = ctx -> task ; if (! task ) { cpu_function_call ( event -> cpu, __perf_event_disable, event ) ; return ; } retry : if (! task_function_call ( task, __perf_event_disable, event ) ) return ; raw_spin_lock_irq ( & ctx -> lock ) ; if ( event -> state == PERF_EVENT_STATE_ACTIVE ) { raw_spin_unlock_irq ( & ctx -> lock ) ; task = ctx -> task ; goto retry ; } if ( event -> state == PERF_EVENT_STATE_INACTIVE ) { update_group_times ( event ) ;  event -> state = PERF_EVENT_STATE_OFF ; <START_BUG> } raw_spin_unlock_irq ( & ctx -> lock ) ; }<END_BUG>

Fix:
<S2SV_ModStart> perf_event_context * ctx ; ctx = perf_event_ctx_lock <S2SV_ModEnd> ( event ) <S2SV_ModStart> event ) ; _perf_event_disable ( event ) ; perf_event_ctx_unlock ( event, ctx <S2SV_ModEnd> ) ; }
Buggy code:
 long keyctl_read_key ( key_serial_t keyid, char __user * buffer, size_t buflen ) { struct key * key ; key_ref_t key_ref ; long ret ; key_ref = lookup_user_key ( keyid, 0, 0 ) ; if ( IS_ERR ( key_ref ) ) { ret = - ENOKEY ; goto error ; } key = key_ref_to_ptr ( key_ref ) ; <START_BUG> ret = key_permission ( key_ref, KEY_NEED_READ ) ; <END_BUG> if ( ret == 0 ) goto can_read_key ; if ( ret!= - EACCES ) goto error2 ; if (! is_key_possessed ( key_ref ) ) { ret = - EACCES ; goto error2 ; } can_read_key : ret = - EOPNOTSUPP ; if ( key -> type -> read ) { down_read ( & key -> sem ) ; ret = key_validate ( key ) ; if ( ret == 0 ) ret = key -> type -> read ( key, buffer, buflen ) ; up_read ( & key -> sem ) ; } error2 : key_put ( key ) ; error : return ret ; }

Fix:
<S2SV_ModStart> key_ref ) ; if ( test_bit ( KEY_FLAG_NEGATIVE, & key -> flags ) ) { ret = - ENOKEY ; goto error2 ; }
Buggy code:
 static void copy_asoundrc ( void ) { char * src = RUN_ASOUNDRC_FILE ; char * dest ; if ( asprintf ( & dest, "%s//.asoundrc", cfg. homedir ) == - 1 ) errExit ( "asprintf" ) ; if ( is_link ( dest ) ) { fprintf ( stderr, "Error:   %s   is   a   symbolic   link\\n", dest ) ; exit ( 1 ) ; } <START_BUG> pid_t child = fork ( ) ; <END_BUG> if ( child < 0 ) errExit ( "fork" ) ; if ( child == 0 ) { drop_privs ( 0 ) ;  int rv = copy_file ( src, dest ) ; <START_BUG> if ( rv ) fprintf ( stderr, "Warning:   cannot   transfer  .asoundrc   in   private   home   directory\\n" ) ; else { fs_logger2 ( "clone", dest ) ; } _exit ( 0 ) ; } waitpid ( child, NULL, 0 ) ; <END_BUG> if ( chown ( dest, getuid ( ), getgid ( ) ) < 0 )  errExit ( "chown" ) ; <START_BUG> if ( chmod ( dest, S_IRUSR | S_IWUSR ) < 0 ) <END_BUG> errExit ( "chmod" ) ; unlink ( src ) ; }

Fix:
<S2SV_ModStart> ) ; } copy_file_as_user <S2SV_ModEnd> ( src, <S2SV_ModStart> ( src, <S2SV_ModEnd> dest, getuid <S2SV_ModStart> getgid ( ) <S2SV_ModEnd>, S_IRUSR | <S2SV_ModStart> | S_IWUSR ) ; fs_logger2 ( "clone", dest <S2SV_ModEnd> ) ; unlink
Buggy code:
 void GKI_delay ( UINT32 timeout_ms ) { struct timespec delay ; delay. tv_sec = timeout_ms // 1000 ; delay. tv_nsec = 1000 * 1000 * ( timeout_ms % 1000 ) ; int err ; do { <START_BUG> err = nanosleep ( & delay, & delay ) ; <END_BUG> } while ( err == - 1 && errno == EINTR ) ; }

Fix:
<S2SV_ModStart> { err = TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & delay )
Buggy code:
 void irc_mode_channel_update ( struct t_irc_server * server, struct t_irc_channel * channel, char set_flag, char chanmode, const char * argument ) { char * pos_args, * str_modes, * * argv, * pos, * ptr_arg ; char * new_modes, * new_args, str_mode [ 2 ], * str_temp ; int argc, current_arg, chanmode_found, length ; if (! channel -> modes ) channel -> modes = strdup ( "+" ) ; if (! channel -> modes ) return ; argc = 0 ; argv = NULL ; pos_args = strchr ( channel -> modes,' ') ; if ( pos_args ) { str_modes = weechat_strndup ( channel -> modes, pos_args - channel -> modes ) ; if (! str_modes ) return ; pos_args ++ ; while ( pos_args [ 0 ] ==' ') pos_args ++ ; argv = weechat_string_split ( pos_args, "   ", NULL, WEECHAT_STRING_SPLIT_STRIP_LEFT | WEECHAT_STRING_SPLIT_STRIP_RIGHT | WEECHAT_STRING_SPLIT_COLLAPSE_SEPS, 0, & argc ) ; } else { str_modes = strdup ( channel -> modes ) ; if (! str_modes ) return ; } new_modes = malloc ( strlen ( channel -> modes ) + 1 + 1 ) ; new_args = malloc ( ( ( pos_args )? strlen ( pos_args ) : 0 ) + ( ( argument )? 1 + strlen ( argument ) : 0 ) + 1 ) ; if ( new_modes && new_args ) { new_modes [ 0 ] = '\\0' ; new_args [ 0 ] = '\\0' ; current_arg = 0 ; chanmode_found = 0 ; pos = str_modes ; while ( pos && pos [ 0 ] ) { if ( ( pos [ 0 ] == '+' ) || ( pos [ 0 ] == '-' ) ) { str_mode [ 0 ] = pos [ 0 ] ; str_mode [ 1 ] = '\\0' ; strcat ( new_modes, str_mode ) ; } else { ptr_arg = NULL ;

Fix:
<S2SV_ModStart> chanmode ) { if (! chanmode_found ) { <S2SV_ModStart> } } } }
Buggy code:
 static Image * ReadXBMImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char buffer [ MaxTextExtent ], name [ MaxTextExtent ] ; Image <START_BUG> * image ; <END_BUG> MagickBooleanType status ; register IndexPacket * indexes ; register ssize_t i, x ; register PixelPacket * q ; register unsigned char * p ; short int hex_digits [ 256 ] ; ssize_t y ; unsigned char * data ; unsigned int bit, byte, bytes_per_line, height, length,  padding, <START_BUG> value, version, width ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } width = 0 ; height = 0 ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) if ( sscanf ( buffer, "#define   %32s   %u", name, & width ) == 2 ) if ( ( strlen ( name ) >= 6 ) && ( LocaleCompare ( name + strlen ( name ) - 6, "_width" ) == 0 ) ) break ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) if ( sscanf ( buffer, "#define   %32s   %u", name, & height ) == 2 ) if ( ( strlen ( name ) >= 7 ) && ( LocaleCompare ( name + strlen ( name ) - 7, "_height" ) == 0 ) ) break ; image -> columns = width ; image -> rows = height ; image -> depth = 8 ; image -> storage_class = PseudoClass ; image -> colors = 2 ; version = 11 ; while ( ReadBlobString ( image, buffer )!= ( char * ) NULL ) { if ( sscanf ( buffer, "static   short   %<END_BUG>

Fix:
<S2SV_ModStart> Image * image ; int c <S2SV_ModStart> length, padding <S2SV_ModEnd>, version, <S2SV_ModStart> ) ) { c <S2SV_ModEnd> = XBMInteger ( <S2SV_ModStart>, hex_digits ) ; if ( c < 0 ) break <S2SV_ModStart> unsigned char ) c <S2SV_ModEnd> ; if ( <S2SV_ModStart> char ) ( c <S2SV_ModEnd> >> 8 ) <S2SV_ModStart> hex_digits ) ; if ( c < 0 ) break ; <S2SV_ModStart> unsigned char ) c ; } if ( EOFBlob ( image )!= MagickFalse ) { data = ( unsigned char * ) RelinquishMagickMemory ( data ) ; ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) <S2SV_ModEnd> ; } p <S2SV_ModStart> byte = ( unsigned int <S2SV_ModEnd> ) ( *
Buggy code:
 void vp9_twopass_postencode_update ( VP9_COMP * cpi ) { <START_BUG> # ifdef DISABLE_RC_LONG_TERM_MEM <END_BUG> const uint64_t bits_used = cpi -> rc. this_frame_target ; # else const uint64_t bits_used = cpi -> rc. projected_frame_size ; # endif cpi -> twopass. bits_left -= bits_used ; cpi -> twopass. bits_left = MAX ( cpi -> twopass. bits_left, 0 ) ;  if ( cpi -> common. frame_type == KEY_FRAME ) { <START_BUG> cpi -> twopass. kf_group_bits += cpi -> rc. this_frame_target - bits_used ; } else { cpi -> twopass. kf_group_bits -= bits_used ; <END_BUG> cpi -> twopass. gf_group_bits -= bits_used ;  <START_BUG> cpi -> twopass. gf_group_bits = MAX ( cpi -> twopass. gf_group_bits, 0 ) ; <END_BUG>  } <START_BUG> cpi -> twopass. kf_group_bits = MAX ( cpi -> twopass. kf_group_bits, 0 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> cpi ) { TWO_PASS * const twopass = & cpi -> twopass ; RATE_CONTROL * const rc = & cpi -> rc ; const int bits_used = rc -> base_frame_target ; rc -> vbr_bits_off_target += rc -> base_frame_target - rc -> projected_frame_size ; twopass -> bits_left = MAX ( twopass -> bits_left - bits_used, 0 ) ; if ( rc -> total_actual_bits ) { rc -> rate_error_estimate = ( int ) ( ( rc -> vbr_bits_off_target * 100 ) // rc -> total_actual_bits ) ; rc -> rate_error_estimate = clamp ( rc -> rate_error_estimate, - 100, 100 ) ; } else { rc -> rate_error_estimate = 0 ; } <S2SV_ModEnd> if ( cpi <S2SV_ModStart> common. frame_type!= KEY_FRAME &&! vp9_is_upper_layer_key_frame ( cpi ) ) { twopass -> <S2SV_ModEnd> kf_group_bits -= bits_used <S2SV_ModStart> -= bits_used ; twopass -> last_kfgroup
Buggy code:
 int SWFInput_readSBits ( SWFInput input, int number ) { int num = SWFInput_readBits ( input, number ) ; <START_BUG> if ( num & ( 1 << ( number - 1 ) ) ) <END_BUG> return num - ( 1 << number ) ; else return num ; }

Fix:
<S2SV_ModStart> ; if ( number &&
Buggy code:
 void jas_matrix_asr ( jas_matrix_t * matrix, int n ) { <START_BUG> int i ; <END_BUG> int j ; jas_seqent_t * rowstart ;  int rowstep ; <START_BUG> jas_seqent_t * data ; assert ( n >= 0 ) ; if ( jas_matrix_numrows ( matrix ) > 0 && jas_matrix_numcols ( matrix ) > 0 ) { assert ( matrix -> rows_ ) ; rowstep = jas_matrix_rowstep ( matrix ) ; for ( i = matrix -> numrows_, rowstart = matrix -> rows_ [ 0 ] ; i > 0 ; -- i, rowstart += rowstep ) { for ( j = matrix -> numcols_, data = rowstart ; j > 0 ; -- j, ++ data ) { * data = jas_seqent_asr ( * data, n ) ; } } } }<END_BUG>

Fix:
<S2SV_ModStart> n ) { jas_matind_t i ; jas_matind_t <S2SV_ModEnd> j ; jas_seqent_t <S2SV_ModStart> * rowstart ; jas_matind_t <S2SV_ModEnd> rowstep ; jas_seqent_t
Buggy code:
 static int _hostsock_getpeername ( oe_fd_t * sock_, struct oe_sockaddr * addr, oe_socklen_t * addrlen ) { int ret = - 1 ; sock_t * sock = _cast_sock ( sock_ ) ; oe_socklen_t addrlen_in = 0 ; <START_BUG> oe_errno = 0 ; <END_BUG>  if (! sock ) <START_BUG> OE_RAISE_ERRNO ( OE_EINVAL ) ; <END_BUG> if ( addrlen )  <START_BUG> addrlen_in = * addrlen ; <END_BUG> if ( oe_syscall_getpeername_ocall ( & ret, sock -> host_fd, ( struct oe_sockaddr * ) addr, addrlen_in,  addrlen )!= OE_OK ) <START_BUG> { OE_RAISE_ERRNO ( OE_EINVAL ) ; } <END_BUG> done :  return ret ; }

Fix:
<S2SV_ModStart> = 0 ; oe_socklen_t addrlen_out = 0 ; <S2SV_ModStart> (! sock ||! addr ||! addrlen <S2SV_ModStart> OE_EINVAL ) ; <S2SV_ModEnd> addrlen_in = * <S2SV_ModStart> = * addrlen ; if ( addrlen_in < 0 ) OE_RAISE_ERRNO ( OE_EINVAL ) <S2SV_ModStart>, addrlen_in, & addrlen_out <S2SV_ModEnd> )!= OE_OK <S2SV_ModStart> ) ; } if ( addrlen_out > sizeof ( struct oe_sockaddr_storage ) ) OE_RAISE_ERRNO ( OE_EINVAL ) ; * addrlen = addrlen_out ;
Buggy code:
 int CLASS parse_jpeg ( int offset ) { int len, save, hlen, mark ; fseek ( ifp, offset, SEEK_SET ) ; if ( fgetc ( ifp )!= 0xff || fgetc ( ifp )!= 0xd8 ) return 0 ; while ( fgetc ( ifp ) == 0xff && ( mark = fgetc ( ifp ) )!= 0xda ) { order = 0x4d4d ; len = get2 ( ) - 2 ; save = ftell ( ifp ) ; if ( mark == 0xc0 || mark == 0xc3 || mark == 0xc9 ) { fgetc ( ifp ) ; raw_height = get2 ( ) ; raw_width = get2 ( ) ; } order = get2 ( ) ; hlen = get4 ( ) ; <START_BUG> if ( get4 ( ) == 0x48454150 ) <END_BUG> { # ifdef LIBRAW_LIBRARY_BUILD  imgdata. lens. makernotes. CameraMount = LIBRAW_MOUNT_FixedLens ; <START_BUG> imgdata. lens. makernotes. LensMount = LIBRAW_MOUNT_FixedLens ; # endif parse_ciff ( save + hlen, len - hlen, 0 ) ; } if ( parse_tiff ( save + 6 ) ) apply_tiff ( ) ; fseek ( ifp, save + len, SEEK_SET ) ; } return 1 ; }<END_BUG>

Fix:
<S2SV_ModStart> ) == 0x48454150 <S2SV_ModEnd> # ifdef LIBRAW_LIBRARY_BUILD <S2SV_ModStart> # ifdef LIBRAW_LIBRARY_BUILD && ( save + hlen ) >= 0 && ( save + hlen ) <= ifp -> size ( ) # endif ) { # ifdef LIBRAW_LIBRARY_BUILD
Buggy code:
 uint16_t http_DissectRequest ( struct sess * sp ) { struct http_conn * htc ; struct http * hp ; uint16_t retval ; CHECK_OBJ_NOTNULL ( sp, SESS_MAGIC ) ; htc = sp -> htc ; CHECK_OBJ_NOTNULL ( htc, HTTP_CONN_MAGIC ) ; hp = sp -> http ; CHECK_OBJ_NOTNULL ( hp, HTTP_MAGIC ) ; hp -> logtag = HTTP_Rx ; retval = http_splitline ( sp -> wrk, sp -> fd, hp, htc, HTTP_HDR_REQ, HTTP_HDR_URL, HTTP_HDR_PROTO ) ; if ( retval!= 0 ) { WSPR ( sp, SLT_HttpGarbage, htc -> rxbuf ) ; return ( retval ) ; } http_ProtoVer ( hp ) ; <START_BUG> retval = htc_request_check_host_hdr ( hp ) ; <END_BUG> if ( retval!= 0 ) {  WSP ( sp, SLT_Error, "Duplicated   Host   header" ) ; <START_BUG> return ( retval ) ; } <END_BUG> return ( retval ) ;  }

Fix:
<S2SV_ModStart> ; retval = htc_request_check_hdrs <S2SV_ModEnd> ( sp, <S2SV_ModStart> ( sp, hp <S2SV_ModEnd> ) ; return <S2SV_ModStart> ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 static OM_uint32 init_ctx_new ( OM_uint32 * minor_status, spnego_gss_cred_id_t spcred, gss_ctx_id_t * ctx, send_token_flag * tokflag ) { OM_uint32 ret ; spnego_gss_ctx_id_t sc = NULL ; <START_BUG> sc = create_spnego_ctx ( ) ; <END_BUG> if ( sc == NULL ) return GSS_S_FAILURE ; ret = get_negotiable_mechs ( minor_status, spcred, GSS_C_INITIATE, & sc -> mech_set ) ; if ( ret!= GSS_S_COMPLETE ) goto cleanup ; sc -> internal_mech = & sc -> mech_set -> elements [ 0 ] ; if ( put_mech_set ( sc -> mech_set, & sc -> DER_mechTypes ) < 0 ) { ret = GSS_S_FAILURE ; goto cleanup ; } sc -> ctx_handle = GSS_C_NO_CONTEXT ; * ctx = ( gss_ctx_id_t ) sc ; sc = NULL ; * tokflag = INIT_TOKEN_SEND ; ret = GSS_S_CONTINUE_NEEDED ; cleanup : release_spnego_ctx ( & sc ) ; return ret ; }

Fix:
<S2SV_ModStart> = create_spnego_ctx ( 1
Buggy code:
 static void _send ( Socket_T S, const char * request, StringBuffer_T data ) { _argument ( data, "format", "text" ) ; char * _auth = _getBasicAuthHeader ( ) ; <START_BUG> int rv = Socket_print ( S, <END_BUG> "POST   %s   HTTP//1.0\\r\\n" "Content-Type:   application//x-www-form-urlencoded\\r\\n"  "Content-Length:   %d\\r\\n" <START_BUG> "%s" "\\r\\n" "%s", <END_BUG> request,  StringBuffer_length ( data ), _auth? _auth : "", StringBuffer_toString ( data ) ) ; FREE ( _auth ) ; if ( rv < 0 ) THROW ( IOException, "Monit:   cannot   send   command   to   the   monit   daemon   --   %s", STRERROR ) ; }

Fix:
<S2SV_ModStart> ( ) ; MD_T token ; StringBuffer_append ( data, "%ssecuritytoken=%s", StringBuffer_length ( data ) > 0? "&" : "", Util_getToken ( token ) ) ; <S2SV_ModStart>, "POST <S2SV_blank> %s <S2SV_blank> HTTP//1.0\\r\\n" "Content-Type: <S2SV_blank> application//x-www-form-urlencoded\\r\\n" "Cookie: <S2SV_blank> securitytoken=%s\\r\\n" <S2SV_ModStart> "%s", request, token
Buggy code:
 static unsigned int tt_activity_measure ( VP8_COMP * cpi, MACROBLOCK * x ) { unsigned int act ; unsigned int sse ; <START_BUG> act = vp8_variance16x16 ( x -> src. y_buffer, <END_BUG> x -> src. y_stride, VP8_VAR_OFFS, 0, & sse ) ; act = act << 4 ; if ( act < 8 << 12 ) act = act < 5 << 12? act : 5 << 12 ; return act ; }

Fix:
<S2SV_ModStart> int sse ; ( void ) cpi ; act = vpx_variance16x16 <S2SV_ModEnd> ( x ->
Buggy code:
 static ssize_t sof_dfsentry_write ( struct file * file, const char __user * buffer, size_t count, loff_t * ppos ) { # if IS_ENABLED ( CONFIG_SND_SOC_SOF_DEBUG_IPC_FLOOD_TEST ) struct snd_sof_dfsentry * dfse = file -> private_data ; struct snd_sof_dev * sdev = dfse -> sdev ; unsigned long ipc_duration_ms = 0 ; bool flood_duration_test = false ; unsigned long ipc_count = 0 ; struct dentry * dentry ; int err ; # endif size_t size ; char * string ; int ret ; string = kzalloc ( count, GFP_KERNEL ) ; if (! string ) return - ENOMEM ; size = simple_write_to_buffer ( string, count, ppos, buffer, count ) ; ret = size ; # if IS_ENABLED ( CONFIG_SND_SOC_SOF_DEBUG_IPC_FLOOD_TEST ) dentry = file -> f_path. dentry ; if ( strcmp ( dentry -> d_name. name, "ipc_flood_count" ) && strcmp ( dentry -> d_name. name, "ipc_flood_duration_ms" ) ) <START_BUG> return - EINVAL ; <END_BUG> if (! strcmp ( dentry -> d_name. name, "ipc_flood_duration_ms" ) ) flood_duration_test = true ; if ( flood_duration_test ) ret = kstrtoul ( string, 0, & ipc_duration_ms ) ; else ret = kstrtoul ( string, 0, & ipc_count ) ; if ( ret < 0 ) goto out ; if ( flood_duration_test ) { if (! ipc_duration_ms ) { ret = size ; goto out ; } if ( ipc_duration_ms > MAX_IPC_FLOOD_DURATION_MS ) ipc_duration_ms = MAX_IPC_FLOOD_DURATION_MS ; } else { if (! ipc_count ) { ret = size ; goto out ; } if ( ipc_count > MAX_IPC_FLOOD

Fix:
<S2SV_ModStart> "ipc_flood_duration_ms" ) ) { ret = <S2SV_ModEnd> - EINVAL ; <S2SV_ModStart> - EINVAL ; goto out ; }
Buggy code:
 static int tcp_v6_send_synack ( const struct sock * sk, struct dst_entry * dst, struct flowi * fl, struct request_sock * req, struct tcp_fastopen_cookie * foc, bool attach_req ) { struct inet_request_sock * ireq = inet_rsk ( req ) ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; struct flowi6 * fl6 = & fl -> u. ip6 ; struct sk_buff * skb ; int err = - ENOMEM ; if (! dst && ( dst = inet6_csk_route_req ( sk, fl6, req, IPPROTO_TCP ) ) == NULL ) goto done ; skb = tcp_make_synack ( sk, dst, req, foc, attach_req ) ; if ( skb ) { __tcp_v6_send_check ( skb, & ireq -> ir_v6_loc_addr, & ireq -> ir_v6_rmt_addr ) ; fl6 -> daddr = ireq -> ir_v6_rmt_addr ; if ( np -> repflow && ireq -> pktopts ) fl6 -> flowlabel = ip6_flowlabel ( ipv6_hdr ( ireq -> pktopts ) ) ; <START_BUG> err = ip6_xmit ( sk, skb, fl6, np -> opt, np -> tclass ) ; <END_BUG> err = net_xmit_eval ( err ) ; } done : return err ; }

Fix:
<S2SV_ModStart>, fl6, rcu_dereference ( <S2SV_ModStart> np -> opt ), <S2SV_ModEnd> np -> tclass
Buggy code:
 static int list_devices ( struct file * filp, struct dm_ioctl * param, size_t param_size ) { unsigned int i ; struct hash_cell * hc ; size_t len, needed = 0 ; struct gendisk * disk ; struct dm_name_list * orig_nl, * nl, * old_nl = NULL ; uint32_t * event_nr ; down_write ( & _hash_lock ) ; for ( i = 0 ; i < NUM_BUCKETS ; i ++ ) { list_for_each_entry ( hc, _name_buckets + i, name_list ) { needed += align_val ( offsetof ( struct dm_name_list, name ) + strlen ( hc -> name ) + 1 ) ; needed += align_val ( sizeof ( uint32_t ) ) ; } } nl = orig_nl = get_result_buffer ( param, param_size, & len ) ; <START_BUG> if ( len < needed ) { <END_BUG> param -> flags |= DM_BUFFER_FULL_FLAG ; goto out ; } param -> data_size = param -> data_start + needed ; nl -> dev = 0 ; for ( i = 0 ; i < NUM_BUCKETS ; i ++ ) { list_for_each_entry ( hc, _name_buckets + i, name_list ) { if ( old_nl ) old_nl -> next = ( uint32_t ) ( ( void * ) nl - ( void * ) old_nl ) ; disk = dm_disk ( hc -> md ) ; nl -> dev = huge_encode_dev ( disk_devt ( disk ) ) ; nl -> next = 0 ; strcpy ( nl -> name, hc -> name ) ; old_nl = nl ; event_nr = align_ptr ( nl -> name + strlen ( hc -> name ) + 1 ) ; * event_nr = dm_get_event_nr ( hc -> md ) ; nl = align_ptr ( event_nr + 1 ) ; } } BUG_ON ( ( char * ) nl - ( char * ) orig_nl!= needed ) ; out : up_write ( & _hash_lock ) ; return 0 ; }

Fix:
<S2SV_ModStart> len < needed || len < sizeof ( nl -> dev )