nus-yam/ex-repair huggingface dataset:
Buggy code:
 <START_BUG> int mi_sort_index ( MI_CHECK * param, register MI_INFO * info, char * name ) <END_BUG> { reg2 uint key ; reg1 MI_KEYDEF * keyinfo ; File new_file ; my_off_t index_pos [ HA_MAX_POSSIBLE_KEY ] ; uint r_locks, w_locks ; int old_lock ; MYISAM_SHARE * share = info -> s ; MI_STATE_INFO old_state ; DBUG_ENTER ( "mi_sort_index" ) ; for ( key = 0, keyinfo = & share -> keyinfo [ 0 ] ; key < share -> base. keys ; key ++, keyinfo ++ ) if ( keyinfo -> key_alg == HA_KEY_ALG_RTREE ) DBUG_RETURN ( 0 ) ; if (! ( param -> testflag & T_SILENT ) ) printf ( "-   Sorting   index   for   MyISAM-table   \'%s\'\\n", name ) ; fn_format ( param -> temp_filename, name, "", MI_NAME_IEXT, 2 + 4 + 32 ) ; if ( ( new_file = mysql_file_create ( mi_key_file_datatmp, fn_format ( param -> temp_filename, param -> temp_filename, "", INDEX_TMP_EXT, 2 + 4 ), 0, param -> tmpfile_createflag, MYF ( 0 ) ) ) <= 0 ) { mi_check_print_error ( param, "Can\'t   create   new   tempfile:   \'%s\'", param -> temp_filename ) ; DBUG_RETURN ( - 1 ) ; } if ( filecopy ( param, new_file, share -> kfile, 0L, ( ulong ) share -> base. keystart, "headerblock" ) ) goto err ; param -> new_file_pos = share -> base. keystart ; for ( key = 0, keyinfo = & share -> keyinfo [ 0 ] ; key < share -> base. keys ; key ++, keyinfo ++ ) { if (! mi_is_key_active ( info -> s -> state. key_map, key ) ) continue ; if ( share -> state. key_root [ key ]!= HA_OFFSET_ERROR ) { index

Fix:
<S2SV_ModStart> char * name, my_bool no_copy_stat <S2SV_ModStart>, INDEX_TMP_EXT, no_copy_stat? MYF ( MY_REDEL_NO_COPY_STAT ) :
Buggy code:
 <START_BUG> static void bfq_idle_slice_timer_body ( struct bfq_queue * bfqq ) <END_BUG> {  struct bfq_data * bfqd = bfqq -> bfqd ; <START_BUG> enum bfqq_expiration reason ; unsigned long flags ; <END_BUG> spin_lock_irqsave ( & bfqd -> lock, flags ) ;  bfq_clear_bfqq_wait_request ( bfqq ) ; if ( bfqq!= bfqd -> in_service_queue ) { spin_unlock_irqrestore ( & bfqd -> lock, flags ) ; return ; <START_BUG> } <END_BUG> if ( bfq_bfqq_budget_timeout ( bfqq ) ) reason = BFQQE_BUDGET_TIMEOUT ; else if ( bfqq -> queued [ 0 ] == 0 && bfqq -> queued [ 1 ] == 0 ) reason = BFQQE_TOO_IDLE ; else goto schedule_dispatch ; bfq_bfqq_expire ( bfqd, bfqq, true, reason ) ; schedule_dispatch : spin_unlock_irqrestore ( & bfqd -> lock, flags ) ; bfq_schedule_dispatch ( bfqd ) ; }

Fix:
<S2SV_ModStart> void bfq_idle_slice_timer_body ( struct bfq_data * bfqd, <S2SV_ModStart> bfqq ) { <S2SV_ModEnd> enum bfqq_expiration reason <S2SV_ModStart> lock, flags <S2SV_ModEnd> ) ; if <S2SV_ModStart> return ; } bfq_clear_bfqq_wait_request ( bfqq ) ;
Buggy code:
 static void mark_screen_rdonly ( struct mm_struct * mm ) { pgd_t * pgd ; pud_t * pud ; pmd_t * pmd ; pte_t * pte ; spinlock_t * ptl ; int i ; <START_BUG> pgd = pgd_offset ( mm, 0xA0000 ) ; <END_BUG> if ( pgd_none_or_clear_bad ( pgd ) ) goto out ; pud = pud_offset ( pgd, 0xA0000 ) ; if ( pud_none_or_clear_bad ( pud ) ) goto out ; pmd = pmd_offset ( pud, 0xA0000 ) ; split_huge_page_pmd ( mm, pmd ) ; if ( pmd_none_or_clear_bad ( pmd ) ) goto out ; pte = pte_offset_map_lock ( mm, pmd, 0xA0000, & ptl ) ; for ( i = 0 ; i < 32 ; i ++ ) { if ( pte_present ( * pte ) ) set_pte ( pte, pte_wrprotect ( * pte ) ) ; pte ++ ; } pte_unmap_unlock ( pte, ptl ) ; out :  flush_tlb ( ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> int i ; down_write ( & mm -> mmap_sem ) ; <S2SV_ModStart> ; out : up_write ( & mm -> mmap_sem ) ;
Buggy code:
 bool config_save ( const config_t * config, const char * filename ) { assert ( config!= NULL ) ; assert ( filename!= NULL ) ; assert ( * filename!= '\\0' ) ; <START_BUG> char * temp_filename = osi_calloc ( strlen ( filename ) + 5 ) ; <END_BUG>  if (! temp_filename ) { <START_BUG> LOG_ERROR ( "%s   unable   to   allocate   memory   for   filename.", __func__ ) ; return false ; } strcpy ( temp_filename, filename ) ; strcat ( temp_filename, ".new" ) ; FILE * fp = fopen ( temp_filename, "wt" ) ; if (! fp ) { LOG_ERROR ( "%s   unable   to   write   file   \'%s\':   %s", __func__, temp_filename, strerror ( errno ) ) ; goto error ; } for ( const list_node_t * node = list_begin ( config -> sections ) ; node!= list_end ( config -> sections ) ; node = list_next ( node ) ) { const section_t * section = ( const section_t * ) list_node ( node ) ; <END_BUG> fprintf ( fp, "[%s]\\n", section -> name ) ;  for ( const list_node_t * enode = list_begin ( section -> entries ) ; enode!= list_end ( section -> entries ) ; enode = list_next ( enode ) ) { const entry_t * entry = ( const entry_t * ) list_node ( enode ) ; <START_BUG> fprintf ( fp, "%s   =   %s\\n", entry -> key, entry -> value ) ; <END_BUG> } if ( list_next ( node )!= list_end ( config -> sections ) )  fputc ( '\\n', fp ) ; <START_BUG> } fflush ( fp ) ; <END_BUG> fclose ( fp ) ;  if ( chmod ( temp_filename, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP ) == - 1 ) { LOG_ERROR ( "%s   unable   to   change   file   permissions   \'%s\':   %s", __func__, filename, strerror ( errno ) ) ; goto error ; } if ( rename ( temp_filename, filename ) ==

Fix:
<S2SV_ModStart> '\\0' ) ; int dir_fd = - 1 ; FILE * fp = NULL ; static const char * temp_file_ext = ".new" ; const int filename_len = strlen ( filename ) ; const int temp_filename_len = filename_len + strlen ( temp_file_ext ) + 1 ; char * <S2SV_ModEnd> temp_filename = osi_calloc <S2SV_ModStart> = osi_calloc ( temp_filename_len ) ; snprintf ( temp_filename, temp_filename_len, "%s%s", filename, temp_file_ext ) ; char * temp_dirname = osi_strdup ( filename ) ; const char * directoryname = dirname ( temp_dirname <S2SV_ModEnd> ) ; if <S2SV_ModStart> if (! directoryname ) { LOG_ERROR ( "%s <S2SV_blank> error <S2SV_blank> extracting <S2SV_blank> directory <S2SV_blank> from <S2SV_blank> \'%s\': <S2SV_blank> %s", __func__, filename, strerror ( errno ) ) ; goto error ; } dir_fd = TEMP_FAILURE_RETRY ( open ( directoryname, O_RDONLY ) ) ; if ( dir_fd < 0 ) { LOG_ERROR ( "%s <S2SV_blank> unable <S2SV_blank> to <S2SV_blank> open <S2SV_blank> dir <S2SV_blank> \'%s
Buggy code:
 int inode_change_ok ( const struct inode * inode, struct iattr * attr ) { unsigned int ia_valid = attr -> ia_valid ; if ( ia_valid & ATTR_SIZE ) { int error = inode_newsize_ok ( inode, attr -> ia_size ) ; if ( error ) return error ; } if ( ia_valid & ATTR_FORCE ) return 0 ; if ( ( ia_valid & ATTR_UID ) && (! uid_eq ( current_fsuid ( ), inode -> i_uid ) ||! uid_eq ( attr -> ia_uid, inode -> i_uid ) ) && <START_BUG>! inode_capable ( inode, CAP_CHOWN ) ) <END_BUG> return - EPERM ; if ( ( ia_valid & ATTR_GID ) && (! uid_eq ( current_fsuid ( ), inode -> i_uid ) || (! in_group_p ( attr -> ia_gid ) &&! gid_eq ( attr -> ia_gid, inode -> i_gid ) ) ) && ! inode_capable ( inode, CAP_CHOWN ) ) <START_BUG> return - EPERM ; if ( ia_valid & ATTR_MODE ) { if (! inode_owner_or_capable ( inode ) ) return - EPERM ; if (! in_group_p ( ( ia_valid & ATTR_GID )? attr -> ia_gid : inode -> i_gid ) && <END_BUG>! inode_capable ( inode, CAP_FSETID ) )  attr -> ia_mode &= ~ S_ISGID ; } if ( ia_valid & ( ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET ) ) { if (! inode_owner_or_capable ( inode ) ) return - EPERM ; } return 0 ; }

Fix:
<S2SV_ModStart> ) &&! capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode, <S2SV_ModStart> ) &&! capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode, <S2SV_ModStart> ) &&! capable_wrt_inode_uidgid <S2SV_ModEnd> ( inode,
Buggy code:
 cJSON * cJSON_GetObjectItem ( cJSON * object, const char * string ) { <START_BUG> cJSON * c = object -> child ; <END_BUG> while ( c && cJSON_strcasecmp ( c -> string, string ) ) c = c -> next ; return c ; }

Fix:
<S2SV_ModStart> c = object? object -> child : 0 <S2SV_ModEnd> ; while (
Buggy code:
 const u_char * smb_fdata ( netdissect_options * ndo, const u_char * buf, const char * fmt, const u_char * maxbuf, int unicodestr ) { static int depth = 0 ; char s [ 128 ] ; char * p ; while ( * fmt ) { switch ( * fmt ) { case '*' : fmt ++ ; while ( buf < maxbuf ) { const u_char * buf2 ; depth ++ ; <START_BUG> buf2 = smb_fdata ( ndo, buf, fmt, maxbuf, unicodestr ) ; <END_BUG> depth -- ; if ( buf2 == NULL ) return ( NULL ) ; if ( buf2 == buf ) return ( buf ) ; buf = buf2 ; } return ( buf ) ; case '|' : fmt ++ ; if ( buf >= maxbuf ) return ( buf ) ; break ; case '%' : fmt ++ ; buf = maxbuf ; break ; case '#' : fmt ++ ; return ( buf ) ; break ; case '[' : fmt ++ ; if ( buf >= maxbuf ) return ( buf ) ; memset ( s, 0, sizeof ( s ) ) ; p = strchr ( fmt, ']' ) ; if ( ( size_t ) ( p - fmt + 1 ) > sizeof ( s ) ) { return ( buf ) ; } strncpy ( s, fmt, p - fmt ) ; s [ p - fmt ] = '\\0' ; fmt = p + 1 ; buf = smb_fdata1 ( ndo, buf, s, maxbuf, unicodestr ) ; if ( buf == NULL ) return ( NULL ) ; break ; default : ND_PRINT ( ( ndo, "%c", * fmt ) ) ; fmt ++ ; break ; } } if (! depth && buf < maxbuf ) { size_t len = PTR_DIFF ( maxbuf, buf ) ; ND_PRINT ( ( ndo, "Data:   (%lu   bytes)\\n", ( unsigned long ) len ) ) ; smb_print_data ( ndo, buf, len ) ; return ( buf + len ) ; } return ( buf ) ; }

Fix:
<S2SV_ModStart> depth ++ ; if ( depth == 10 ) ND_PRINT ( ( ndo, "(too <S2SV_blank> many <S2SV_blank> nested <S2SV_blank> levels, <S2SV_blank> not <S2SV_blank> recursing)" ) ) ; else
Buggy code:
 <START_BUG> static char * print_object ( cJSON * item, int depth, int fmt ) <END_BUG> { char * * entries = 0, * * names = 0 ; char * out = 0, * ptr, * ret, * str ; int len = 7, i = 0, j ; cJSON * child = item -> child ; int numentries = 0, fail = 0 ;  while ( child ) { <START_BUG> ++ numentries ; child = child -> next ; } if (! ( entries = ( char * * ) cJSON_malloc ( numentries * sizeof ( char * ) ) ) ) return 0 ; if (! ( names = ( char * * ) cJSON_malloc ( numentries * sizeof ( char * ) ) ) ) { cJSON_free ( entries ) ; return 0 ; } memset ( entries, 0, sizeof ( char * ) * numentries ) ; memset ( names, 0, sizeof ( char * ) * numentries ) ; child = item -> child ; ++ depth ; if ( fmt ) len += depth ; while ( child ) { <END_BUG> names [ i ] = str = print_string_ptr ( child -> string ) ;  <START_BUG> entries [ i ++ ] = ret = print_value ( child, depth, fmt ) ; <END_BUG> if ( str && ret ) len += strlen ( ret ) + strlen ( str ) + 2 + ( fmt? 2 + depth : 0 ) ; else fail = 1 ; child = child -> next ; }  if (! fail ) { <START_BUG> out = ( char * ) cJSON_malloc ( len ) ; if (! out ) fail = 1 ; <END_BUG> }  if ( fail ) { <START_BUG> for ( i = 0 ; i < numentries ; ++ i ) { <END_BUG> if ( names [ i ] ) cJSON_free ( names [ i ] ) ; if ( entries [ i ] ) cJSON_free ( entries [ i ] ) ; } cJSON_free ( names ) ; cJSON_free ( entries ) ; return 0 ; } * out = '{' ; ptr = out + 1 ;  if ( fmt ) <START_BUG> * ptr ++ = '\\n' ; * ptr = 0 ; <END_BUG> for ( i = 0 ; i < numentries ; ++ i ) {  if ( fmt ) <START_BUG> for ( j = 0 ; j < depth ; ++ j ) <END_BUG> * ptr ++ = '\\t' ;  strcpy ( ptr, names [ i

Fix:
<S2SV_ModStart>, int fmt, printbuffer * p <S2SV_ModStart> = 0 ; size_t tmplen = 0 ; <S2SV_ModStart> ( child ) numentries ++, child = child -> next ; if (! numentries ) { if ( p ) out = ensure ( p, fmt? depth + 4 : 3 ) ; else out = ( char * ) cJSON_malloc ( fmt? depth + 4 : 3 ) ; if (! out ) return 0 ; ptr = out ; * ptr ++ = '{' ; if ( fmt ) { * ptr ++ = '\\n' ; for ( i = 0 ; i < depth ; i ++ ) * ptr ++ = '\\t' ; } * ptr ++ = '}' ; * ptr ++ = 0 ; return out ; } if ( p ) { i = p -> offset ; len = fmt? 2 : 1 ; ptr = ensure ( p, len + 1 ) ; if (! ptr ) return 0 ; * ptr ++ = '{' ; if ( fmt ) * ptr ++ = '\\n' ; * ptr = 0 ; p -> offset += len ; child = item -> child ; depth ++ ; while ( child ) { if ( fmt ) { ptr = ensure ( p, depth ) ; if (! ptr ) return 0
Buggy code:
 <START_BUG> void pointZZ_pMul ( PointZZ_p * rop, const PointZZ_p * point, const mpz_t scalar, const CurveZZ_p * curve ) { <END_BUG> PointZZ_p R0, R1, tmp ; mpz_inits ( R1. x, R1. y, tmp. x, tmp. y, NULL ) ; mpz_init_set ( R0. x, point -> x ) ; mpz_init_set ( R0. y, point -> y ) ; pointZZ_pDouble ( & R1, point, curve ) ; int dbits = mpz_sizeinbase ( scalar, 2 ), i ; for ( i = dbits - 2 ; i >= 0 ; i -- ) { if ( mpz_tstbit ( scalar, i ) ) { mpz_set ( tmp. x, R0. x ) ; mpz_set ( tmp. y, R0. y ) ; pointZZ_pAdd ( & R0, & R1, & tmp, curve ) ; mpz_set ( tmp. x, R1. x ) ; mpz_set ( tmp. y, R1. y ) ; pointZZ_pDouble ( & R1, & tmp, curve ) ; } else { mpz_set ( tmp. x, R1. x ) ; mpz_set ( tmp. y, R1. y ) ; pointZZ_pAdd ( & R1, & R0, & tmp, curve ) ; mpz_set ( tmp. x, R0. x ) ; mpz_set ( tmp. y, R0. y ) ; pointZZ_pDouble ( & R0, & tmp, curve ) ; } } mpz_init_set ( rop -> x, R0. x ) ; mpz_init_set ( rop -> y, R0. y ) ; mpz_clears ( R0. x, R0. y, R1. x, R1. y, tmp. x, tmp. y, NULL ) ; }

Fix:
<S2SV_ModStart> curve ) { if ( pointZZ_pIsIdentityElement ( point ) ) { return pointZZ_pSetToIdentityElement ( rop ) ; }
Buggy code:
 static gboolean prplcb_xfer_new_send_cb ( gpointer data, gint fd, b_input_condition cond ) { PurpleXfer * xfer = data ; struct im_connection * ic = purple_ic_by_pa ( xfer -> account ) ; struct prpl_xfer_data * px = xfer -> ui_data ; PurpleBuddy * buddy ; const char * who ; buddy = purple_find_buddy ( xfer -> account, xfer -> who ) ; who = buddy? purple_buddy_get_name ( buddy ) : xfer -> who ; px -> ft = imcb_file_send_start ( ic, ( char * ) who, xfer -> filename, xfer -> size ) ; <START_BUG> px -> ft -> data = px ; <END_BUG> px -> ft -> accept = prpl_xfer_accept ; px -> ft -> canceled = prpl_xfer_canceled ; px -> ft -> free = prpl_xfer_free ; px -> ft -> write_request = prpl_xfer_write_request ; return FALSE ; }

Fix:
<S2SV_ModStart> size ) ; if (! px -> ft ) { return FALSE ; }
Buggy code:
 <START_BUG> static int frame_max_bits ( const RATE_CONTROL * rc, const VP9_CONFIG * oxcf ) { <END_BUG>  int64_t max_bits = ( ( int64_t ) rc -> av_per_frame_bandwidth * <START_BUG> ( int64_t ) oxcf -> two_pass_vbrmax_section ) // 100 ; if ( max_bits < 0 ) max_bits = 0 ; else if ( max_bits > rc -> max_frame_bandwidth ) max_bits = rc -> max_frame_bandwidth ; return ( int ) max_bits ; }<END_BUG>

Fix:
<S2SV_ModStart> rc, const VP9EncoderConfig <S2SV_ModEnd> * oxcf ) <S2SV_ModStart> ) rc -> avg_frame_bandwidth <S2SV_ModEnd> * ( int64_t
Buggy code:
 static rsRetVal initZMQ ( instanceData * pData ) { DEFiRet ; if ( NULL == s_context ) { zsys_handler_set ( NULL ) ; s_context = zctx_new ( ) ; if ( s_workerThreads > 0 ) zctx_set_iothreads ( s_context, s_workerThreads ) ; } pData -> socket = zsocket_new ( s_context, pData -> type ) ; if ( NULL == pData -> socket ) { errmsg. LogError ( 0, RS_RET_NO_ERRCODE, "omzmq3:   zsocket_new   failed   for   %s:   %s", pData -> description, zmq_strerror ( errno ) ) ; ABORT_FINALIZE ( RS_RET_NO_ERRCODE ) ; } if ( pData -> identity ) zsocket_set_identity ( pData -> socket, ( char * ) pData -> identity ) ; if ( pData -> sndBuf > - 1 ) zsocket_set_sndbuf ( pData -> socket, pData -> sndBuf ) ; if ( pData -> rcvBuf > - 1 ) zsocket_set_sndbuf ( pData -> socket, pData -> rcvBuf ) ; if ( pData -> linger > - 1 ) zsocket_set_linger ( pData -> socket, pData -> linger ) ; if ( pData -> backlog > - 1 ) zsocket_set_backlog ( pData -> socket, pData -> backlog ) ; if ( pData -> sndTimeout > - 1 ) zsocket_set_sndtimeo ( pData -> socket, pData -> sndTimeout ) ; if ( pData -> rcvTimeout > - 1 ) zsocket_set_rcvtimeo ( pData -> socket, pData -> rcvTimeout ) ; if ( pData -> maxMsgSize > - 1 ) zsocket_set_maxmsgsize ( pData -> socket, pData -> maxMsgSize ) ; if ( pData -> rate > - 1 ) zsocket_set_rate ( pData -> socket, pData -> rate ) ; if ( pData -> recoveryIVL > - 1 ) zsocket_set_recovery_ivl ( pData -> socket, pData -> recoveryIVL ) ; if ( pData -> multicastHops

Fix:
<S2SV_ModStart> -> socket, "%s", <S2SV_ModStart> -> socket, "%s",
Buggy code:
 int main ( int argc, char * argv [ ] ) { char * fin, * fout ; FILE * fpin, * fpout ; uint8_t * inbuf, * outbuf ; uint8_t * inbuf_u, * outbuf_u ; uint8_t * inbuf_v, * outbuf_v ; int f, frames ; <START_BUG> int width, height, target_width, target_height ; <END_BUG> if ( argc < 5 ) { printf ( "Incorrect   parameters:\\n" ) ;  usage ( argv [ 0 ] ) ; <START_BUG> return 1 ; } fin = argv [ 1 ] ; fout = argv [ 4 ] ; if (! parse_dim ( argv [ 2 ], & width, & height ) ) { printf ( "Incorrect   parameters:   %s\\n", argv [ 2 ] ) ; <END_BUG> usage ( argv [ 0 ] ) ;  return 1 ; } if (! parse_dim ( argv [ 3 ], & target_width, & target_height ) ) { printf ( "Incorrect   parameters:   %s\\n", argv [ 3 ] ) ; <START_BUG> usage ( argv [ 0 ] ) ; <END_BUG> return 1 ; } fpin = fopen ( fin, "rb" ) ; if ( fpin == NULL ) { printf ( "Can\'t   open   file   %s   to   read\\n", fin ) ;  usage ( argv [ 0 ] ) ; <START_BUG> return 1 ; } fpout = fopen ( fout, "wb" ) ; if ( fpout == NULL ) { printf ( "Can\'t   open   file   %s   to   write\\n", fout ) ; <END_BUG> usage ( argv [ 0 ] ) ;  return 1 ; } if ( argc >= 6 ) frames = atoi ( argv [ 5 ] ) ; else frames = INT_MAX ; printf ( "Input   size:     %dx%d\\n", width, height ) ; printf ( "Target   size:   %dx%d,   Frames:   ", target_width, target_height ) ; if ( frames == INT_MAX ) printf ( "All\\n" ) ; else printf ( "%d\\n", frames ) ; inbuf = ( uint8_t * ) malloc ( width * height * 3 // 2 ) ; outbuf = ( uint8_t * ) m

Fix:
<S2SV_ModStart> target_width, target_height ; exec_name = argv [ 0 ] <S2SV_ModStart> ; usage ( <S2SV_ModEnd> ) ; return <S2SV_ModStart> ; usage ( <S2SV_ModEnd> ) ; return <S2SV_ModStart> ; usage ( <S2SV_ModEnd> ) ; return <S2SV_ModStart> ; usage ( <S2SV_ModEnd> ) ; return <S2SV_ModStart> ; usage ( <S2SV_ModEnd> ) ; return
Buggy code:
 static int tiffcp ( TIFF * in, TIFF * out ) { <START_BUG> uint16 bitspersample, samplesperpixel ; <END_BUG>  uint16 input_compression, input_photometric ; <START_BUG> copyFunc cf ; uint32 width, length ; struct cpTag * p ; CopyField ( TIFFTAG_IMAGEWIDTH, width ) ; CopyField ( TIFFTAG_IMAGELENGTH, length ) ; CopyField ( TIFFTAG_BITSPERSAMPLE, bitspersample ) ; CopyField ( TIFFTAG_SAMPLESPERPIXEL, samplesperpixel ) ; if ( compression!= ( uint16 ) - 1 ) TIFFSetField ( out, TIFFTAG_COMPRESSION, compression ) ; else CopyField ( TIFFTAG_COMPRESSION, compression ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_COMPRESSION, & input_compression ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_PHOTOMETRIC, & input_photometric ) ; if ( input_compression == COMPRESSION_JPEG ) { TIFFSetField ( in, TIFFTAG_JPEGCOLORMODE, JPEGCOLORMODE_RGB ) ; } else if ( input_photometric == PHOTOMETRIC_YCBCR ) { uint16 subsamplinghor, subsamplingver ; TIFFGetFieldDefaulted ( in, TIFFTAG_YCBCRSUBSAMPLING, & subsamplinghor, & subsamplingver ) ; if ( subsamplinghor!= 1 || subsamplingver!= 1 ) { fprintf ( stderr, "tiffcp:   %s:   Can\'t   copy//convert   subsampled   image.\\n", TIFFFileName ( in ) ) ; return FALSE ; } } if ( compression == COMPRESSION_JPEG ) { if ( input_photometric == PHOTOMETRIC_RGB && jpegcolormode == JPEGCOLORMODE_RGB ) TIFFSetField ( out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR ) ; else TIFFSetField ( out, TIFFTAG_PHOTOMETRIC, input_photometric ) ; } else if ( compression == COMPRESSION_SGILOG || compression == COMPRESSION_SGILOG24 ) TIFFSetField ( out, TIFFTAG_PHOTOMETRIC, samplesperpixel == 1? PHOTOMETRIC_LOGL : PHOTOMETRIC_LOGLUV ) ; else if ( input_compression ==<END_BUG>

Fix:
<S2SV_ModStart> bitspersample, samplesperpixel = 1 <S2SV_ModStart> input_compression, input_photometric = PHOTOMETRIC_MINISBLACK
Buggy code:
 static void optimize_b ( MACROBLOCK * mb, int ib, int type, ENTROPY_CONTEXT * a, ENTROPY_CONTEXT * l ) { BLOCK * b ; BLOCKD * d ; vp8_token_state tokens [ 17 ] [ 2 ] ; unsigned best_mask [ 2 ] ; const short * dequant_ptr ; const short * coeff_ptr ; short * qcoeff_ptr ; short * dqcoeff_ptr ; int eob ; int i0 ; int rc ; int x ; int sz = 0 ; int next ; int rdmult ; int rddiv ; int final_eob ; int rd_cost0 ; int rd_cost1 ; int rate0 ; int rate1 ; int error0 ; int error1 ; int t0 ; int t1 ; int best ; int band ; int pt ; int i ; int err_mult = plane_rd_mult [ type ] ; b = & mb -> block [ ib ] ; d = & mb -> e_mbd. block [ ib ] ; <START_BUG> # if 0 <END_BUG> vp8_strict_quantize_b ( b, d ) ; # endif dequant_ptr = d -> dequant ; coeff_ptr = b -> coeff ; qcoeff_ptr = d -> qcoeff ; dqcoeff_ptr = d -> dqcoeff ; i0 =! type ; eob = * d -> eob ; rdmult = mb -> rdmult * err_mult ; if ( mb -> e_mbd. mode_info_context -> mbmi. ref_frame == INTRA_FRAME ) rdmult = ( rdmult * 9 ) >> 4 ; rddiv = mb -> rddiv ; best_mask [ 0 ] = best_mask [ 1 ] = 0 ; tokens [ eob ] [ 0 ]. rate = 0 ; tokens [ eob ] [ 0 ]. error = 0 ; tokens [ eob ] [ 0 ]. next = 16 ; tokens [ eob ] [ 0 ]. token = DCT_EOB_TOKEN ; tokens [ eob ] [ 0 ]. qc = 0 ; * ( tokens [ eob ] + 1 ) = * ( tokens [ eob ] + 0 ) ; next = eob ; for ( i = eob ; i -- > i0 ; ) { int base_bits ; int d2 ; int dx ; rc = vp8_default_zig_zag1

Fix:
<S2SV_ModStart> ib ] ; <S2SV_ModEnd> dequant_ptr = d
Buggy code:
 void vp9_setup_pre_planes ( MACROBLOCKD * xd, int idx, const YV12_BUFFER_CONFIG * src, int mi_row, int mi_col, const struct scale_factors * sf ) { if ( src!= NULL ) { int i ; <START_BUG> uint8_t * const buffers [ 4 ] = { src -> y_buffer, src -> u_buffer, src -> v_buffer, <END_BUG> src -> alpha_buffer } ;  const int strides [ 4 ] = { src -> y_stride, src -> uv_stride, src -> uv_stride, <START_BUG> src -> alpha_stride } ; for ( i = 0 ; i < MAX_MB_PLANE ; ++ i ) { struct macroblockd_plane * const pd = & xd -> plane [ i ] ; setup_pred_plane ( & pd -> pre [ idx ], buffers [ i ], strides [ i ], mi_row, mi_col, sf, pd -> subsampling_x, pd -> subsampling_y ) ; } } }<END_BUG>

Fix:
<S2SV_ModStart> const buffers [ MAX_MB_PLANE <S2SV_ModEnd> ] = { <S2SV_ModStart> src -> v_buffer <S2SV_ModEnd> } ; const <S2SV_ModStart> int strides [ MAX_MB_PLANE <S2SV_ModEnd> ] = { <S2SV_ModStart> src -> uv_stride <S2SV_ModEnd> } ; for
Buggy code:
 cJSON * cJSON_GetArrayItem ( cJSON * array, int item ) { <START_BUG> cJSON * c = array -> child ; <END_BUG>  while ( c && item > 0 ) { <START_BUG> -- item ; c = c -> next ; <END_BUG> }  return c ; }

Fix:
<S2SV_ModStart> c = array? array -> child : 0 <S2SV_ModEnd> ; while ( <S2SV_ModStart> > 0 ) item --, <S2SV_ModEnd> c = c <S2SV_ModStart> -> next ; <S2SV_ModEnd> return c ;
Buggy code:
 static void extend_plane ( uint8_t * const src, int src_stride, int width, int height, int extend_top, int extend_left, int extend_bottom, int extend_right ) { int i ; const int linesize = extend_left + extend_right + width ; uint8_t * src_ptr1 = src ; uint8_t * src_ptr2 = src + width - 1 ; uint8_t * dst_ptr1 = src - extend_left ; uint8_t * dst_ptr2 = src + width ; for ( i = 0 ; i < height ; ++ i ) { <START_BUG> vpx_memset ( dst_ptr1, src_ptr1 [ 0 ], extend_left ) ; <END_BUG>  vpx_memset ( dst_ptr2, src_ptr2 [ 0 ], extend_right ) ; <START_BUG> src_ptr1 += src_stride ; src_ptr2 += src_stride ; dst_ptr1 += src_stride ; dst_ptr2 += src_stride ; } src_ptr1 = src - extend_left ; src_ptr2 = src + src_stride * ( height - 1 ) - extend_left ; dst_ptr1 = src + src_stride * - extend_top - extend_left ; dst_ptr2 = src + src_stride * height - extend_left ; for ( i = 0 ; i < extend_top ; ++ i ) { <END_BUG> vpx_memcpy ( dst_ptr1, src_ptr1, linesize ) ;  dst_ptr1 += src_stride ; } for ( i = 0 ; i < extend_bottom ; ++ i ) { <START_BUG> vpx_memcpy ( dst_ptr2, src_ptr2, linesize ) ; <END_BUG> dst_ptr2 += src_stride ; } }

Fix:
<S2SV_ModStart> i ) { memset <S2SV_ModEnd> ( dst_ptr1, <S2SV_ModStart> extend_left ) ; memset <S2SV_ModEnd> ( dst_ptr2, <S2SV_ModStart> i ) { memcpy <S2SV_ModEnd> ( dst_ptr1, <S2SV_ModStart> i ) { memcpy <S2SV_ModEnd> ( dst_ptr2,
Buggy code:
 PTA * ptaReadStream ( FILE * fp ) { char typestr [ 128 ] ; l_int32 i, n, ix, iy, type, version ; l_float32 x, y ; PTA * pta ; PROCNAME ( "ptaReadStream" ) ; if (! fp ) return ( PTA * ) ERROR_PTR ( "stream   not   defined", procName, NULL ) ; if ( fscanf ( fp, "\\n   Pta   Version   %d\\n", & version )!= 1 ) return ( PTA * ) ERROR_PTR ( "not   a   pta   file", procName, NULL ) ; if ( version!= PTA_VERSION_NUMBER ) return ( PTA * ) ERROR_PTR ( "invalid   pta   version", procName, NULL ) ; <START_BUG> if ( fscanf ( fp, "   Number   of   pts   =   %d;   format   =   %s\\n", & n, typestr )!= 2 ) <END_BUG> return ( PTA * ) ERROR_PTR ( "not   a   pta   file", procName, NULL ) ; if (! strcmp ( typestr, "float" ) ) type = 0 ; else type = 1 ; if ( ( pta = ptaCreate ( n ) ) == NULL ) return ( PTA * ) ERROR_PTR ( "pta   not   made", procName, NULL ) ; for ( i = 0 ; i < n ; i ++ ) { if ( type == 0 ) { if ( fscanf ( fp, "       (%f,   %f)\\n", & x, & y )!= 2 ) { ptaDestroy ( & pta ) ; return ( PTA * ) ERROR_PTR ( "error   reading   floats", procName, NULL ) ; } ptaAddPt ( pta, x, y ) ; } else { if ( fscanf ( fp, "       (%d,   %d)\\n", & ix, & iy )!= 2 ) { ptaDestroy ( & pta ) ; return ( PTA * ) ERROR_PTR ( "error   reading   ints", procName, NULL ) ; } ptaAddPt ( pta, ix, iy

Fix:
<S2SV_ModStart> ( fp, " <S2SV_blank> Number <S2SV_blank> of <S2SV_blank> pts <S2SV_blank> = <S2SV_blank> %d; <S2SV_blank> format <S2SV_blank> = <S2SV_blank> %127s\\n" <S2SV_ModEnd>, & n
Buggy code:
 bt_status_t btif_storage_add_bonded_device ( bt_bdaddr_t * remote_bd_addr, LINK_KEY link_key, uint8_t key_type, uint8_t pin_length ) { bdstr_t bdstr ; bdaddr_to_string ( remote_bd_addr, bdstr, sizeof ( bdstr ) ) ; int ret = btif_config_set_int ( bdstr, "LinkKeyType", ( int ) key_type ) ; ret &= btif_config_set_int ( bdstr, "PinLength", ( int ) pin_length ) ; ret &= btif_config_set_bin ( bdstr, "LinkKey", link_key, sizeof ( LINK_KEY ) ) ; <START_BUG> btif_config_flush ( ) ; <END_BUG> return ret? BT_STATUS_SUCCESS : BT_STATUS_FAIL ; }

Fix:
<S2SV_ModStart> ) ) ; if ( is_restricted_mode ( ) ) { BTIF_TRACE_WARNING ( "%s: <S2SV_blank> \'%s\' <S2SV_blank> pairing <S2SV_blank> will <S2SV_blank> be <S2SV_blank> removed <S2SV_blank> if <S2SV_blank> unrestricted", __func__, bdstr ) ; btif_config_set_int ( bdstr, "Restricted", 1 ) ; }
Buggy code:
 error_t enc624j600Init ( NetInterface * interface ) { uint16_t temp ; Enc624j600Context * context ; TRACE_INFO ( "Initializing   ENC624J600   Ethernet   controller...\\r\\n" ) ; interface -> spiDriver -> init ( ) ; interface -> extIntDriver -> init ( ) ; context = ( Enc624j600Context * ) interface -> nicContext ; context -> nextPacket = ENC624J600_RX_BUFFER_START ; context -> rxBuffer = memPoolAlloc ( ETH_MAX_FRAME_SIZE ) ; if ( context -> rxBuffer == NULL ) { return ERROR_OUT_OF_MEMORY ; } enc624j600SoftReset ( interface ) ; <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_ECON2, ECON2_ETHEN | ECON2_STRCH ) ; <END_BUG> if ( macCompAddr ( & interface -> macAddr, & MAC_UNSPECIFIED_ADDR ) ) {  temp = enc624j600ReadReg ( interface, ENC624J600_REG_MAADR1 ) ; <START_BUG> interface -> macAddr. w [ 0 ] = letoh16 ( temp ) ; <END_BUG> temp = enc624j600ReadReg ( interface, ENC624J600_REG_MAADR2 ) ;  interface -> macAddr. w [ 1 ] = letoh16 ( temp ) ; <START_BUG> temp = enc624j600ReadReg ( interface, ENC624J600_REG_MAADR3 ) ; <END_BUG> interface -> macAddr. w [ 2 ] = letoh16 ( temp ) ; macAddrToEui64 ( & interface -> macAddr, & interface -> eui64 ) ; } else { temp = htole16 ( interface -> macAddr. w [ 0 ] ) ;  enc624j600WriteReg ( interface, ENC624J600_REG_MAADR1, temp ) ; <START_BUG> temp = htole16 ( interface -> macAddr. w [ 1 ] ) ; <END_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_MAADR2, temp ) ;  temp = htole16 ( interface -> macAddr. w [ 2 ] ) ; <START_BUG> enc624j600WriteReg ( interface,<END_BUG>

Fix:
<S2SV_ModStart> ( interface, ENC624J600_ECON2, ENC624J600_ECON2_ETHEN | ENC624J600_ECON2_STRCH <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( interface, ENC624J600_MAADR1 <S2SV_ModEnd> ) ; interface <S2SV_ModStart> ( interface, ENC624J600_MAADR2 <S2SV_ModEnd> ) ; interface <S2SV_ModStart> ( interface, ENC624J600_MAADR3 <S2SV_ModEnd> ) ; interface <S2SV_ModStart> ( interface, ENC624J600_MAADR1 <S2SV_ModEnd>, temp ) <S2SV_ModStart> ( interface, ENC624J600_MAADR2 <S2SV_ModEnd>, temp ) <S2SV_ModStart> ( interface, ENC624J600_MAADR3 <S2SV_ModEnd>, temp ) <S2SV_ModStart> ( interface, ENC624J600_ERXST <S2SV_ModEnd>, ENC624J600_RX_BUFFER_START ) <S2SV_ModStart> ( interface, ENC624J600_ERXTAIL <S2SV_ModEnd>, ENC624J600_RX_BUFFER_STOP ) <S2SV_ModStart> ( interface, ENC624J600_ERXFCON, ENC624J600_ERXFCON_HTEN | ENC
Buggy code:
 static int gfs2_bmap_alloc ( struct inode * inode, const sector_t lblock, struct buffer_head * bh_map, struct metapath * mp, const unsigned int sheight, const unsigned int height, const unsigned int maxlen ) { struct gfs2_inode * ip = GFS2_I ( inode ) ; struct gfs2_sbd * sdp = GFS2_SB ( inode ) ; <START_BUG> struct buffer_head * dibh = mp -> mp_bh [ 0 ] ; <END_BUG> u64 bn, dblock = 0 ; unsigned n, i, blks, alloced = 0, iblks = 0, branch_start = 0 ; unsigned dblks = 0 ; unsigned ptrs_per_blk ;  const unsigned end_of_metadata = height - 1 ; <START_BUG> int eob = 0 ; enum alloc_state state ; __be64 * ptr ; __be64 zero_bn = 0 ; BUG_ON ( sheight < 1 ) ; BUG_ON ( dibh == NULL ) ; gfs2_trans_add_bh ( ip -> i_gl, dibh, 1 ) ; if ( height == sheight ) { struct buffer_head * bh ; ptr = metapointer ( end_of_metadata, mp ) ; bh = mp -> mp_bh [ end_of_metadata ] ; dblks = gfs2_extent_length ( bh -> b_data, bh -> b_size, ptr, maxlen, & eob ) ; BUG_ON ( dblks < 1 ) ; state = ALLOC_DATA ; } else { ptrs_per_blk = height > 1? sdp -> sd_inptrs : sdp -> sd_diptrs ; dblks = min ( maxlen, ptrs_per_blk - mp -> mp_list [ end_of_metadata ] ) ; if ( height == ip -> i_height ) { iblks = height - sheight ; state = ALLOC_GROW_DEPTH ; } else { state = ALLOC_GROW_HEIGHT ; iblks = height - ip -> i_height ; branch_start = metapath_branch_start ( mp ) ; iblks += ( height - branch_start ) ; } } blks = dblks + iblks<END_BUG>

Fix:
<S2SV_ModStart> ) ; struct super_block * sb = sdp -> sd_vfs ; struct <S2SV_ModStart> height - 1 ; int ret <S2SV_ModStart> ++ ) ; if ( buffer_zeronew ( bh_map ) ) { ret = sb_issue_zeroout ( sb, dblock, dblks, GFP_NOFS ) ; if ( ret ) { fs_err ( sdp, "Failed <S2SV_blank> to <S2SV_blank> zero <S2SV_blank> data <S2SV_blank> buffers\\n" ) ; clear_buffer_zeronew ( bh_map ) ; } }
Buggy code:
 struct sctp_chunk * sctp_process_asconf ( struct sctp_association * asoc, struct sctp_chunk * asconf ) { <START_BUG> sctp_addiphdr_t * hdr ; <END_BUG> union sctp_addr_param * addr_param ; sctp_addip_param_t * asconf_param ; struct sctp_chunk * asconf_ack ; __be16 err_code ; int length = 0 ; int chunk_len ; __u32 serial ;  int all_param_pass = 1 ; <START_BUG> chunk_len = ntohs ( asconf -> chunk_hdr -> length ) - sizeof ( sctp_chunkhdr_t ) ; hdr = ( sctp_addiphdr_t * ) asconf -> skb -> data ; serial = ntohl ( hdr -> serial ) ; length = sizeof ( sctp_addiphdr_t ) ; addr_param = ( union sctp_addr_param * ) ( asconf -> skb -> data + length ) ; chunk_len -= length ; length = ntohs ( addr_param -> p. length ) ; asconf_param = ( void * ) addr_param + length ; chunk_len -= length ; asconf_ack = sctp_make_asconf_ack ( asoc, serial, chunk_len * 4 ) ; if (! asconf_ack ) goto done ; <END_BUG> while ( chunk_len > 0 ) {  err_code = sctp_process_asconf_param ( asoc, asconf, <START_BUG> asconf_param ) ; <END_BUG> if ( SCTP_ERROR_NO_ERROR!= err_code )  all_param_pass = 0 ; <START_BUG> if (! all_param_pass ) sctp_add_asconf_response ( asconf_ack, <END_BUG> asconf_param -> crr_id, err_code,  asconf_param ) ; if ( SCTP_ERROR_RSRC_LOW == err_code ) goto done ; <START_BUG> length = ntohs ( asconf_param -> param_hdr. length ) ; <END_BUG> asconf_param = ( void * ) asconf_param + length ; chunk_len -= length ; } done : asoc -> peer. addip_serial ++ ; if ( asconf_ack ) { sctp_chunk_hold ( asconf_ack )

Fix:
<S2SV_ModStart> asconf ) { sctp_addip_chunk_t * addip = ( sctp_addip_chunk_t * ) asconf -> chunk_hdr ; bool all_param_pass = true ; union sctp_params param ; <S2SV_ModStart> __u32 serial ; <S2SV_ModEnd> chunk_len = ntohs <S2SV_ModStart> goto done ; sctp_walk_params ( param, addip, addip_hdr. params ) { if ( param. p -> type == SCTP_PARAM_IPV4_ADDRESS || param. p -> type == SCTP_PARAM_IPV6_ADDRESS ) continue ; <S2SV_ModEnd> err_code = sctp_process_asconf_param <S2SV_ModStart>, asconf, param. addip ) ; if ( err_code!= SCTP_ERROR_NO_ERROR <S2SV_ModEnd> ) all_param_pass = <S2SV_ModStart> ) all_param_pass = false <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( asconf_ack, param. addip <S2SV_ModEnd> -> crr_id, <S2SV_ModStart> -> crr_id, err_code, param. addip ) ; if ( err_code == SCTP_ERROR_RSRC_LOW <S2SV_ModEnd> ) goto done <S2SV_ModStart> goto done ; <S2SV_ModEnd> } done
Buggy code:
 IHEVCD_ERROR_T ihevcd_cabac_init ( cab_ctxt_t * ps_cabac, bitstrm_t * ps_bitstrm, WORD32 qp, WORD32 cabac_init_idc, const UWORD8 * pu1_init_ctxt ) { ASSERT ( ps_cabac!= NULL ) ; ASSERT ( ps_bitstrm!= NULL ) ; ASSERT ( ( qp >= 0 ) && ( qp < 52 ) ) ; ASSERT ( ( cabac_init_idc >= 0 ) && ( cabac_init_idc < 3 ) ) ; UNUSED ( qp ) ; UNUSED ( cabac_init_idc ) ; # if FULLRANGE ps_cabac -> u4_range = ( UWORD32 ) 510 << RANGE_SHIFT ; BITS_GET ( ps_cabac -> u4_ofst, ps_bitstrm -> pu4_buf, ps_bitstrm -> u4_bit_ofst, ps_bitstrm -> u4_cur_word, ps_bitstrm -> u4_nxt_word, ( 9 + RANGE_SHIFT ) ) ; # else ps_cabac -> u4_range = ( UWORD32 ) 510 ; BITS_GET ( ps_cabac -> u4_ofst, ps_bitstrm -> pu4_buf, ps_bitstrm -> u4_bit_ofst, ps_bitstrm -> u4_cur_word, ps_bitstrm -> u4_nxt_word, 9 ) ; # endif memcpy ( ps_cabac -> au1_ctxt_models, pu1_init_ctxt, IHEVC_CAB_CTXT_END ) ; DEBUG_RANGE_OFST ( "init", ps_cabac -> u4_range, ps_cabac -> u4_ofst ) ; <START_BUG> return ( ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ) ; <END_BUG> }

Fix:
<S2SV_ModStart> u4_ofst ) ; if ( ps_cabac -> u4_ofst >= ps_cabac -> u4_range ) { return ( ( IHEVCD_ERROR_T ) IHEVCD_FAIL ) ; }
Buggy code:
 static int userauth_hostbased ( struct ssh * ssh ) { Authctxt * authctxt = ssh -> authctxt ; struct sshbuf * b ; struct sshkey * key = NULL ; char * pkalg, * cuser, * chost ; u_char * pkblob, * sig ; size_t alen, blen, slen ; int r, pktype, authenticated = 0 ; <START_BUG> if (! authctxt -> valid ) { <END_BUG> debug2 ( "%s:   disabled   because   of   invalid   user", __func__ ) ; return 0 ; } if ( ( r = sshpkt_get_cstring ( ssh, & pkalg, & alen ) )!= 0 || ( r = sshpkt_get_string ( ssh, & pkblob, & blen ) )!= 0 || ( r = sshpkt_get_cstring ( ssh, & chost, NULL ) )!= 0 || ( r = sshpkt_get_cstring ( ssh, & cuser, NULL ) )!= 0 || ( r = sshpkt_get_string ( ssh, & sig, & slen ) )!= 0 ) fatal ( "%s:   packet   parsing:   %s", __func__, ssh_err ( r ) ) ; debug ( "%s:   cuser   %s   chost   %s   pkalg   %s   slen   %zu", __func__, cuser, chost, pkalg, slen ) ; # ifdef DEBUG_PK debug ( "signature:" ) ; sshbuf_dump_data ( sig, siglen, stderr ) ; # endif pktype = sshkey_type_from_name ( pkalg ) ; if ( pktype == KEY_UNSPEC ) { logit ( "%s:   unsupported   public   key   algorithm:   %s", __func__, pkalg ) ; goto done ; } if ( ( r = sshkey_from_blob ( pkblob, blen, & key ) )!= 0 ) { error ( "%s:   key_from_blob:   %s", __func__, ssh_err ( r ) ) ; goto done ; } if ( key == NULL ) { error ( "%s:   cannot   decode   key:   %s", __func__, pkalg ) ; goto done ;

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> if ( ( <S2SV_ModStart> } if (! authctxt -> valid || authctxt -> user == NULL ) { debug2 ( "%s: <S2SV_blank> disabled <S2SV_blank> because <S2SV_blank> of <S2SV_blank> invalid <S2SV_blank> user", __func__ ) ; goto done ; } if (
Buggy code:
 static struct sk_buff * udp6_ufo_fragment ( struct sk_buff * skb, netdev_features_t features ) { struct sk_buff * segs = ERR_PTR ( - EINVAL ) ; unsigned int mss ; unsigned int unfrag_ip6hlen, unfrag_len ; struct frag_hdr * fptr ; u8 * packet_start, * prevhdr ; u8 nexthdr ; u8 frag_hdr_sz = sizeof ( struct frag_hdr ) ; int offset ; __wsum csum ; int tnl_hlen ; mss = skb_shinfo ( skb ) -> gso_size ; if ( unlikely ( skb -> len <= mss ) ) goto out ; if ( skb_gso_ok ( skb, features | NETIF_F_GSO_ROBUST ) ) { int type = skb_shinfo ( skb ) -> gso_type ; if ( unlikely ( type & ~ ( SKB_GSO_UDP | SKB_GSO_DODGY | SKB_GSO_UDP_TUNNEL | SKB_GSO_GRE | SKB_GSO_IPIP | SKB_GSO_SIT | SKB_GSO_MPLS ) ||! ( type & ( SKB_GSO_UDP ) ) ) ) goto out ; skb_shinfo ( skb ) -> gso_segs = DIV_ROUND_UP ( skb -> len, mss ) ; segs = NULL ; goto out ; } if ( skb -> encapsulation && skb_shinfo ( skb ) -> gso_type & SKB_GSO_UDP_TUNNEL ) segs = skb_udp_tunnel_segment ( skb, features ) ; else { offset = skb_checksum_start_offset ( skb ) ; csum = skb_checksum ( skb, offset, skb -> len - offset, 0 ) ; offset += skb -> csum_offset ; * ( __sum16 * ) ( skb -> data + offset ) = csum_fold ( csum ) ; skb -> ip_summed = CHECKSUM_NONE ; tnl_hlen = skb_tnl_header_len ( skb ) ; <START_BUG> if ( sk<END_BUG>

Fix:
<S2SV_ModStart> ; if ( skb -> mac_header <S2SV_ModEnd> < ( tnl_hlen
Buggy code:
 static int cbs_jpeg_split_fragment ( CodedBitstreamContext * ctx, CodedBitstreamFragment * frag, int header ) { AVBufferRef * data_ref ; uint8_t * data ; size_t data_size ; int unit, start, end, marker, next_start, next_marker ; int err, i, j, length ; if ( frag -> data_size < 4 ) { return AVERROR_INVALIDDATA ; } for ( i = 0 ; i + 1 < frag -> data_size && frag -> data [ i ]!= 0xff ; i ++ ) ; if ( i > 0 ) { av_log ( ctx -> log_ctx, AV_LOG_WARNING, "Discarding   %d   bytes   at   " "beginning   of   image.\\n", i ) ; } for ( ++ i ; i + 1 < frag -> data_size && frag -> data [ i ] == 0xff ; i ++ ) ; if ( i + 1 >= frag -> data_size && frag -> data [ i ] ) { av_log ( ctx -> log_ctx, AV_LOG_ERROR, "Invalid   JPEG   image:   " "no   SOI   marker   found.\\n" ) ; return AVERROR_INVALIDDATA ; } marker = frag -> data [ i ] ; if ( marker!= JPEG_MARKER_SOI ) { av_log ( ctx -> log_ctx, AV_LOG_ERROR, "Invalid   JPEG   image:   first   " "marker   is   %02x,   should   be   SOI.\\n", marker ) ; return AVERROR_INVALIDDATA ; } for ( ++ i ; i + 1 < frag -> data_size && frag -> data [ i ] == 0xff ; i ++ ) ; if ( i + 1 >= frag -> data_size ) { av_log ( ctx -> log_ctx, AV_LOG_ERROR, "Invalid   JPEG   image:   " "no   image   content   found.\\n" ) ; return AVERROR_INVALIDDATA ; } marker = frag -> data [ i ] ; start = i + 1 ; for ( unit = 0 ; ; unit ++ ) { if ( marker == JPEG_MARKER_EOI ) { break ; } else if ( marker == JPEG_MARKER_SOS ) { for

Fix:
<S2SV_ModStart> start ) ; if ( length > end - start ) return AVERROR_INVALIDDATA ;
Buggy code:
 void vp9_frame_init_quantizer ( VP9_COMP * cpi ) { <START_BUG> cpi -> zbin_mode_boost = 0 ; <END_BUG>  vp9_init_plane_quantizers ( cpi, & cpi -> mb ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> cpi ) { <S2SV_ModEnd> vp9_init_plane_quantizers ( cpi <S2SV_ModStart> & cpi -> td.
Buggy code:
 static int handle_keywordonly_args ( struct compiling * c, const node * n, int start, asdl_seq * kwonlyargs, asdl_seq * kwdefaults ) { PyObject * argname ; node * ch ; expr_ty expression, annotation ; arg_ty arg = NULL ; int i = start ; int j = 0 ; if ( kwonlyargs == NULL ) { ast_error ( c, CHILD ( n, start ), "named   arguments   must   follow   bare   *" ) ; return - 1 ; } assert ( kwdefaults!= NULL ) ; while ( i < NCH ( n ) ) { ch = CHILD ( n, i ) ; switch ( TYPE ( ch ) ) { case vfpdef : case tfpdef : if ( i + 1 < NCH ( n ) && TYPE ( CHILD ( n, i + 1 ) ) == EQUAL ) { expression = ast_for_expr ( c, CHILD ( n, i + 2 ) ) ; if (! expression ) goto error ; asdl_seq_SET ( kwdefaults, j, expression ) ; i += 2 ; } else { asdl_seq_SET ( kwdefaults, j, NULL ) ; } if ( NCH ( ch ) == 3 ) { annotation = ast_for_expr ( c, CHILD ( ch, 2 ) ) ; if (! annotation ) goto error ; } else { annotation = NULL ; } ch = CHILD ( ch, 0 ) ; argname = NEW_IDENTIFIER ( ch ) ; if (! argname ) goto error ; if ( forbidden_name ( c, argname, ch, 0 ) ) goto error ; arg = arg ( argname, annotation, NULL, LINENO ( ch ), ch -> n_col_offset, ch -> n_end_lineno, ch -> n_end_col_offset, c -> c_arena ) ; if (! arg ) goto error ; asdl_seq_SET ( kwonlyargs, j ++, arg ) ; i += 1 ; <START_BUG> if ( TYPE ( CHILD ( n, i ) ) == COMMA ) <END_BUG> i += 1 ; break ; case TYPE_COMMENT : arg -> type_comment = NEW_TYPE_COMMENT ( ch ) ; if (! arg -> type_comment ) goto error ; i += 1 ; break ; case DOUBLESTAR : return i ; default :

Fix:
<S2SV_ModStart> ; if ( i < NCH ( n ) &&
Buggy code:
 <START_BUG> void vp9_iht8x8_add ( TX_TYPE tx_type, const int16_t * input, uint8_t * dest, <END_BUG> int stride, int eob ) { if ( tx_type == DCT_DCT ) { vp9_idct8x8_add ( input, dest, stride, eob ) ; } else { vp9_iht8x8_64_add ( input, dest, stride, tx_type ) ; } }

Fix:
<S2SV_ModStart> tx_type, const tran_low_t <S2SV_ModEnd> * input,
Buggy code:
 static vpx_codec_err_t encoder_init ( vpx_codec_ctx_t * ctx, vpx_codec_priv_enc_mr_cfg_t * data ) { <START_BUG> return encoder_common_init ( ctx ) ; <END_BUG> }

Fix:
<S2SV_ModStart> data ) { vpx_codec_err_t res = VPX_CODEC_OK ; ( void ) data ; if ( ctx -> priv == NULL ) { vpx_codec_alg_priv_t * const priv = vpx_calloc ( 1, sizeof ( * priv ) ) ; if ( priv == NULL ) return VPX_CODEC_MEM_ERROR ; ctx -> priv = ( vpx_codec_priv_t * ) priv ; ctx -> priv -> init_flags = ctx -> init_flags ; ctx -> priv -> enc. total_encoders = 1 ; priv -> buffer_pool = ( BufferPool * ) vpx_calloc ( 1, sizeof ( BufferPool ) ) ; if ( priv -> buffer_pool == NULL ) return VPX_CODEC_MEM_ERROR ; # if CONFIG_MULTITHREAD if ( pthread_mutex_init ( & priv -> buffer_pool -> pool_mutex, NULL ) ) { return VPX_CODEC_MEM_ERROR ; } # endif if ( ctx -> config. enc ) { priv -> cfg = * ctx -> config. enc ; ctx -> config. enc = & priv -> cfg ;
Buggy code:
 static int store_xauthority ( void ) { fs_build_mnt_dir ( ) ; char * src ; char * dest = RUN_XAUTHORITY_FILE ; FILE * fp = fopen ( dest, "w" ) ; if ( fp ) { fprintf ( fp, "\\n" ) ; SET_PERMS_STREAM ( fp, getuid ( ), getgid ( ), 0600 ) ; fclose ( fp ) ; } if ( asprintf ( & src, "%s//.Xauthority", cfg. homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( src, & s ) == 0 ) { if ( is_link ( src ) ) { fprintf ( stderr, "Warning:   invalid  .Xauthority   file\\n" ) ; return 0 ; } <START_BUG> pid_t child = fork ( ) ; <END_BUG> if ( child < 0 ) errExit ( "fork" ) ; if ( child == 0 ) { drop_privs ( 0 ) ; int rv = copy_file ( src, dest, getuid ( ), getgid ( ), 0600 ) ;  if ( rv ) <START_BUG> fprintf ( stderr, "Warning:   cannot   transfer  .Xauthority   in   private   home   directory\\n" ) ; else { <END_BUG> fs_logger2 ( "clone", dest ) ;  } _exit ( 0 ) ; } waitpid ( child, NULL, 0 ) ; return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> 0 ; } copy_file_as_user <S2SV_ModEnd> ( src, <S2SV_ModStart> 0600 ) ; <S2SV_ModEnd> fs_logger2 ( "clone" <S2SV_ModStart> "clone", dest <S2SV_ModEnd> ) ; return
Buggy code:
 int vp8_decode_frame ( VP8D_COMP * pbi ) { vp8_reader * const bc = & pbi -> mbc [ 8 ] ; VP8_COMMON * const pc = & pbi -> common ; MACROBLOCKD * const xd = & pbi -> mb ; const unsigned char * data = pbi -> fragments. ptrs [ 0 ] ; const unsigned char * data_end = data + pbi -> fragments. sizes [ 0 ] ; ptrdiff_t first_partition_length_in_bytes ; int i, j, k, l ; const int * const mb_feature_data_bits = vp8_mb_feature_data_bits ; int corrupt_tokens = 0 ; int prev_independent_partitions = pbi -> independent_partitions ; YV12_BUFFER_CONFIG * yv12_fb_new = pbi -> dec_fb_ref [ INTRA_FRAME ] ; xd -> corrupted = 0 ; yv12_fb_new -> corrupted = 0 ; if ( data_end - data < 3 ) { if (! pbi -> ec_active ) { vpx_internal_error ( & pc -> error, VPX_CODEC_CORRUPT_FRAME, "Truncated   packet" ) ; } pc -> frame_type = INTER_FRAME ; pc -> version = 0 ; pc -> show_frame = 1 ; first_partition_length_in_bytes = 0 ; } else { unsigned char clear_buffer [ 10 ] ; const unsigned char * clear = data ; if ( pbi -> decrypt_cb ) { <START_BUG> int n = ( int ) ( data_end - data ) ; <END_BUG> if ( n > 10 ) n = 10 ; pbi -> decrypt_cb ( pbi -> decrypt_state, data, clear_buffer, n ) ; clear = clear_buffer ; } pc -> frame_type = ( FRAME_TYPE ) ( clear [ 0 ] & 1 ) ; pc -> version = ( clear [ 0 ] >> 1 ) & 7 ; pc -> show_frame = ( clear [ 0 ] >> 4 ) & 1 ; first_partition_length_in_bytes = ( clear [ 0 ] | ( clear [ 1 ] << 8 ) | ( clear [ 2 ] << 16 ) ) >> 5 ; if (! pbi -> ec_active && ( data + first_partition_length_

Fix:
<S2SV_ModStart> ( int ) MIN ( sizeof ( clear_buffer ), <S2SV_ModEnd> data_end - data <S2SV_ModStart> - data ) <S2SV_ModEnd> ; pbi -> <S2SV_ModStart> += 7 ; <S2SV_ModEnd> } else { <S2SV_ModStart> } else { memcpy <S2SV_ModEnd> ( & xd <S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( & xd <S2SV_ModStart> bc ) ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> update_mb_segmentation_map ) { memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> 0 ) { memcpy <S2SV_ModEnd> ( & pc <S2SV_ModStart> ; } } memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> } # endif memset <S2SV_ModEnd> ( pc -> <S2SV_ModStart> 0 ) { memcpy <S2SV_ModEnd> ( & pc
Buggy code:
 static void rpl_dio_print ( netdissect_options * ndo, const u_char * bp, u_int length ) { const struct nd_rpl_dio * dio = ( const struct nd_rpl_dio * ) bp ; const char * dagid_str ; ND_TCHECK ( * dio ) ; dagid_str = ip6addr_string ( ndo, dio -> rpl_dagid ) ; ND_PRINT ( ( ndo, "   [dagid:%s,seq:%u,instance:%u,rank:%u,%smop:%s,prf:%u]", dagid_str, dio -> rpl_dtsn, dio -> rpl_instanceid, EXTRACT_16BITS ( & dio -> rpl_dagrank ), RPL_DIO_GROUNDED ( dio -> rpl_mopprf )? "grounded," : "", tok2str ( rpl_mop_values, "mop%u", RPL_DIO_MOP ( dio -> rpl_mopprf ) ), RPL_DIO_PRF ( dio -> rpl_mopprf ) ) ) ; if ( ndo -> ndo_vflag > 1 ) { const struct rpl_dio_genoption * opt = ( const struct rpl_dio_genoption * ) & dio [ 1 ] ; rpl_dio_printopt ( ndo, opt, length ) ; } return ; trunc : <START_BUG> ND_PRINT ( ( ndo, "   [|truncated]" ) ) ; <END_BUG> return ; }

Fix:
<S2SV_ModStart> ( ndo, "%s", rpl_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 ssize_t socket_write_and_transfer_fd ( const socket_t * socket, const void * buf, size_t count, int fd ) { assert ( socket!= NULL ) ; assert ( buf!= NULL ) ; if ( fd == INVALID_FD ) return socket_write ( socket, buf, count ) ; struct msghdr msg ; struct iovec iov ; char control_buf [ CMSG_SPACE ( sizeof ( int ) ) ] ; iov. iov_base = ( void * ) buf ; iov. iov_len = count ; msg. msg_iov = & iov ; msg. msg_iovlen = 1 ; msg. msg_control = control_buf ; msg. msg_controllen = sizeof ( control_buf ) ; msg. msg_name = NULL ; msg. msg_namelen = 0 ; struct cmsghdr * header = CMSG_FIRSTHDR ( & msg ) ; header -> cmsg_level = SOL_SOCKET ; header -> cmsg_type = SCM_RIGHTS ; header -> cmsg_len = CMSG_LEN ( sizeof ( int ) ) ; * ( int * ) CMSG_DATA ( header ) = fd ; <START_BUG> ssize_t ret = sendmsg ( socket -> fd, & msg, MSG_DONTWAIT ) ; <END_BUG> close ( fd ) ; return ret ; }

Fix:
<S2SV_ModStart> ssize_t ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> msg, MSG_DONTWAIT )
Buggy code:
 void vp9_pack_bitstream ( VP9_COMP * cpi, uint8_t * dest, size_t * size ) { uint8_t * data = dest ; size_t first_part_size, uncompressed_hdr_size ; <START_BUG> struct vp9_write_bit_buffer wb = { data, 0 } ; <END_BUG>  struct vp9_write_bit_buffer saved_wb ; <START_BUG> write_uncompressed_header ( cpi, & wb ) ; saved_wb = wb ; <END_BUG> vp9_wb_write_literal ( & wb, 0, 16 ) ;  <START_BUG> uncompressed_hdr_size = vp9_rb_bytes_written ( & wb ) ; <END_BUG> data += uncompressed_hdr_size ;  vp9_compute_update_table ( ) ; <START_BUG> vp9_clear_system_state ( ) ; first_part_size = write_compressed_header ( cpi, data ) ; data += first_part_size ; <END_BUG> vp9_wb_write_literal ( & saved_wb, ( int ) first_part_size, 16 ) ;  data += encode_tiles ( cpi, data ) ; * size = data - dest ; }

Fix:
<S2SV_ModStart> uncompressed_hdr_size ; struct vpx_write_bit_buffer <S2SV_ModEnd> wb = { <S2SV_ModStart> } ; struct vpx_write_bit_buffer <S2SV_ModEnd> saved_wb ; write_uncompressed_header <S2SV_ModStart> = wb ; vpx_wb_write_literal <S2SV_ModEnd> ( & wb <S2SV_ModStart> ; uncompressed_hdr_size = vpx_wb_bytes_written <S2SV_ModEnd> ( & wb <S2SV_ModStart> += uncompressed_hdr_size ; vpx_clear_system_state <S2SV_ModEnd> ( ) ; <S2SV_ModStart> += first_part_size ; vpx_wb_write_literal <S2SV_ModEnd> ( & saved_wb