nus-yam/ex-repair huggingface dataset:
Buggy code:
 INTERNAL void vterm_screen_free ( VTermScreen * screen ) { vterm_allocator_free ( screen -> vt, screen -> buffers [ 0 ] ) ; <START_BUG> if ( screen -> buffers [ 1 ] ) <END_BUG> vterm_allocator_free ( screen -> vt, screen -> buffers [ 1 ] ) ; vterm_allocator_free ( screen -> vt, screen -> sb_buffer ) ; vterm_allocator_free ( screen -> vt, screen ) ; }

Fix:
<S2SV_ModStart> ] ) ; <S2SV_ModEnd> vterm_allocator_free ( screen
Buggy code:
 Datum txid_snapshot_recv ( PG_FUNCTION_ARGS ) { StringInfo buf = ( StringInfo ) PG_GETARG_POINTER ( 0 ) ; TxidSnapshot * snap ; txid last = 0 ; int nxip ; int i ; <START_BUG> int avail ; <END_BUG> int expect ; txid xmin, xmax ; nxip = pq_getmsgint ( buf, 4 ) ;  avail = buf -> len - buf -> cursor ; <START_BUG> expect = 8 + 8 + nxip * 8 ; <END_BUG> if ( nxip < 0 || nxip > avail || expect > avail )  goto bad_format ; xmin = pq_getmsgint64 ( buf ) ; xmax = pq_getmsgint64 ( buf ) ; if ( xmin == 0 || xmax == 0 || xmin > xmax || xmax > MAX_TXID ) goto bad_format ; snap = palloc ( TXID_SNAPSHOT_SIZE ( nxip ) ) ; snap -> xmin = xmin ; snap -> xmax = xmax ; snap -> nxip = nxip ; SET_VARSIZE ( snap, TXID_SNAPSHOT_SIZE ( nxip ) ) ; for ( i = 0 ; i < nxip ; i ++ ) { txid cur = pq_getmsgint64 ( buf ) ; if ( cur <= last || cur < xmin || cur >= xmax ) goto bad_format ; snap -> xip [ i ] = cur ; last = cur ; } PG_RETURN_POINTER ( snap ) ; bad_format : elog ( ERROR, "invalid   snapshot   data" ) ; return ( Datum ) NULL ; }

Fix:
<S2SV_ModStart> int i ; <S2SV_ModEnd> txid xmin, <S2SV_ModStart> 4 ) ; <S2SV_ModEnd> if ( nxip <S2SV_ModStart> || nxip > TXID_SNAPSHOT_MAX_NXIP <S2SV_ModEnd> ) goto bad_format
Buggy code:
 void netsnmp_init_mib ( void ) { const char * prefix ; char * env_var, * entry ; PrefixListPtr pp = & mib_prefixes [ 0 ] ; char * st = NULL ; if ( Mib ) return ; netsnmp_init_mib_internals ( ) ; netsnmp_fixup_mib_directory ( ) ; env_var = strdup ( netsnmp_get_mib_directory ( ) ) ; if (! env_var ) return ; <START_BUG> netsnmp_mibindex_load ( ) ; <END_BUG> DEBUGMSGTL ( ( "init_mib", "Seen   MIBDIRS:   Looking   in   \'%s\'   for   mib   dirs  ...\\n", env_var ) ) ; entry = strtok_r ( env_var, ENV_SEPARATOR, & st ) ; while ( entry ) { add_mibdir ( entry ) ; entry = strtok_r ( NULL, ENV_SEPARATOR, & st ) ; } SNMP_FREE ( env_var ) ; env_var = netsnmp_getenv ( "MIBFILES" ) ; if ( env_var!= NULL ) { if ( * env_var == '+' ) entry = strtok_r ( env_var + 1, ENV_SEPARATOR, & st ) ; else entry = strtok_r ( env_var, ENV_SEPARATOR, & st ) ; while ( entry ) {  add_mibfile ( entry, NULL, NULL ) ; <START_BUG> entry = strtok_r ( NULL, ENV_SEPARATOR, & st ) ; } } netsnmp_init_mib_internals ( ) ; env_var = netsnmp_getenv ( "MIBS" ) ; if ( env_var == NULL ) { if ( confmibs!= NULL ) env_var = strdup ( confmibs ) ; else env_var = strdup ( NETSNMP_DEFAULT_MIBS ) ; } else { env_var = strdup ( env_var ) ; } if ( env_var && ( ( * env_var == '+' ) || ( * env_var == '-' ) ) ) { entry = ( char * ) malloc ( strlen ( NETSNMP_DEFAULT_MIBS ) + strlen ( env_var ) + 2<END_BUG>

Fix:
<S2SV_ModStart> ) return ; <S2SV_ModEnd> DEBUGMSGTL ( ( <S2SV_ModStart> add_mibfile ( entry <S2SV_ModEnd>, NULL )
Buggy code:
 static int fstring_find_literal ( const char * * str, const char * end, int raw, PyObject * * literal, int recurse_lvl, struct compiling * c, const node * n ) { <START_BUG> const char * literal_start = * str ; <END_BUG> const char * literal_end ; int in_named_escape = 0 ; int result = 0 ; assert ( * literal == NULL ) ;  for ( ; * str < end ; ( * str ) ++ ) { <START_BUG> char ch = * * str ; <END_BUG> if (! in_named_escape && ch == '{' && ( * str ) - literal_start >= 2 &&  * ( * str - 2 ) == '\\\\' && * ( * str - 1 ) == 'N' ) { in_named_escape = 1 ; } else if ( in_named_escape && ch == '}' ) { <START_BUG> in_named_escape = 0 ; <END_BUG> } else if ( ch == '{' || ch == '}' ) { if ( recurse_lvl == 0 ) {  if ( * str + 1 < end && * ( * str + 1 ) == ch ) { <START_BUG> literal_end = * str + 1 ; * str += 2 ; result = 1 ; goto done ; } if ( ch == '}' ) { <END_BUG> ast_error ( c, n, "f-string:   single   \'}\'   is   not   allowed" ) ;  return - 1 ; } } <START_BUG> break ; <END_BUG> } }  literal_end = * str ; <START_BUG> <END_BUG> assert ( * str <= end ) ;  <START_BUG> assert ( * str == end || * * str == '{' || * * str == '}' ) ; <END_BUG> done :  if ( literal_start!= literal_end ) { <START_BUG> if ( raw ) * literal = PyUnicode_DecodeUTF8Stateful ( literal_start, <END_BUG> literal_end - literal_start,  NULL, NULL ) ; else * literal = decode_unicode_with_escapes ( c, n, literal_start, <START_BUG> literal_end - literal_start ) ; <END_BUG> if (! * literal ) return - 1 ; } return result ; }

Fix:
<S2SV_ModStart> const char * s = * str ; const char * literal_start = s <S2SV_ModEnd> ; int result <S2SV_ModStart> NULL ) ; while ( s < end ) { char ch = * s ++ <S2SV_ModEnd> ; if ( <S2SV_ModStart> if (! raw && ch == '\\\\' && s < end ) { ch = * s ++ ; if ( ch == 'N' ) { if ( s < end && * s ++ == '{' ) { while ( s < end && * s ++!= <S2SV_ModEnd> '}' ) { <S2SV_ModStart> '}' ) { } continue ; } break ; } if ( ch == '{' && warn_invalid_escape_sequence ( c, n, ch ) < 0 ) { return - 1 ; } } <S2SV_ModEnd> if ( ch <S2SV_ModStart> { if ( s < end && * s == ch ) { * str = s + 1 <S2SV_ModEnd> ; result = <S2SV_ModStart> '}' ) { * str = s - 1 ; <S2SV_ModStart> ; } } s -- ; <S2SV_ModStart> ; } } * str = s <S2SV_ModEnd> ; assert ( <S2SV_ModStart> ; assert ( s <S2SV_ModEnd> <= end ) <S2SV_ModStart> ; assert ( s <S2SV_ModEnd> == end || <S2SV_ModStart> end || * s <S2SV_ModEnd> == '{' || <S2SV_ModStart> '{' || * s <S2SV_ModEnd> == '}' ) <S2SV_ModStart> ( literal_start!= s <S2SV_ModEnd> ) { if <S2SV_ModStart> ( literal_
Buggy code:
 int btpan_tap_send ( int tap_fd, const BD_ADDR src, const BD_ADDR dst, UINT16 proto, const char * buf, UINT16 len, BOOLEAN ext, BOOLEAN forward ) { UNUSED ( ext ) ; UNUSED ( forward ) ; if ( tap_fd!= INVALID_FD ) { tETH_HDR eth_hdr ; memcpy ( & eth_hdr. h_dest, dst, ETH_ADDR_LEN ) ; memcpy ( & eth_hdr. h_src, src, ETH_ADDR_LEN ) ; eth_hdr. h_proto = htons ( proto ) ; char packet [ TAP_MAX_PKT_WRITE_LEN + sizeof ( tETH_HDR ) ] ; memcpy ( packet, & eth_hdr, sizeof ( tETH_HDR ) ) ; if ( len > TAP_MAX_PKT_WRITE_LEN ) { LOG_ERROR ( "btpan_tap_send   eth   packet   size:%d   is   exceeded   limit!", len ) ; return - 1 ; } memcpy ( packet + sizeof ( tETH_HDR ), buf, len ) ; <START_BUG> int ret = write ( tap_fd, packet, len + sizeof ( tETH_HDR ) ) ; <END_BUG> BTIF_TRACE_DEBUG ( "ret:%d", ret ) ; return ret ; } return - 1 ; }

Fix:
<S2SV_ModStart> int ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> sizeof ( tETH_HDR )
Buggy code:
 static REFERENCE_MODE read_block_reference_mode ( VP9_COMMON * cm, const MACROBLOCKD * xd, <START_BUG> vp9_reader * r ) { <END_BUG> if ( cm -> reference_mode == REFERENCE_MODE_SELECT ) { const int ctx = vp9_get_reference_mode_context ( cm, xd ) ; const REFERENCE_MODE mode =  ( REFERENCE_MODE ) vp9_read ( r, cm -> fc. comp_inter_prob [ ctx ] ) ; <START_BUG> <END_BUG> if (! cm -> frame_parallel_decoding_mode )  ++ cm -> counts. comp_inter [ ctx ] [ mode ] ; return mode ; } else { return cm -> reference_mode ; } }

Fix:
<S2SV_ModStart> * xd, vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> ( REFERENCE_MODE ) vpx_read <S2SV_ModEnd> ( r, <S2SV_ModStart> cm -> fc -> <S2SV_ModEnd> comp_inter_prob [ ctx <S2SV_ModStart> ] ) ; FRAME_COUNTS * counts = xd -> counts ; if ( counts ) ++ counts -> <S2SV_ModEnd> comp_inter [ ctx
Buggy code:
 static FILE * pw_tmpfile ( int lockfd ) { FILE * fd ; char * tmpname = NULL ; <START_BUG> char * dir = "//etc" ; <END_BUG>  if ( ( fd = xfmkstemp ( & tmpname, dir ) ) == NULL ) { <START_BUG> ulckpwdf ( ) ; err ( EXIT_FAILURE, _ ( "can\'t   open   temporary   file" ) ) ; } copyfile ( lockfd, fileno ( fd ) ) ; tmp_file = tmpname ; return fd ; }<END_BUG>

Fix:
<S2SV_ModStart> = NULL ; <S2SV_ModEnd> if ( ( <S2SV_ModStart> & tmpname, "//etc", ".vipw" <S2SV_ModEnd> ) ) ==
Buggy code:
 static int store_xauthority ( void ) { fs_build_mnt_dir ( ) ; char * src ; char * dest = RUN_XAUTHORITY_FILE ; FILE * fp = fopen ( dest, "w" ) ; if ( fp ) { fprintf ( fp, "\\n" ) ; SET_PERMS_STREAM ( fp, getuid ( ), getgid ( ), 0600 ) ; fclose ( fp ) ; } if ( asprintf ( & src, "%s//.Xauthority", cfg. homedir ) == - 1 ) errExit ( "asprintf" ) ; struct stat s ; if ( stat ( src, & s ) == 0 ) { if ( is_link ( src ) ) { <START_BUG> fprintf ( stderr, "Error:   invalid  .Xauthority   file\\n" ) ; <END_BUG> exit ( 1 ) ; } pid_t child = fork ( ) ; if ( child < 0 ) errExit ( "fork" ) ; if ( child == 0 ) { drop_privs ( 0 ) ;  int rv = copy_file ( src, dest ) ; <START_BUG> if ( rv ) fprintf ( stderr, "Warning:   cannot   transfer  .Xauthority   in   private   home   directory\\n" ) ; else { fs_logger2 ( "clone", dest ) ; } _exit ( 0 ) ; } waitpid ( child, NULL, 0 ) ; <END_BUG> if ( chown ( dest, getuid ( ), getgid ( ) ) == - 1 )  errExit ( "fchown" ) ; if ( chmod ( dest, 0600 ) == - 1 ) errExit ( "fchmod" ) ; return 1 ; } return 0 ; }

Fix:
<S2SV_ModStart> ( stderr, "Warning: <S2SV_blank> invalid <S2SV_blank>.Xauthority <S2SV_blank> file\\n" ) ; return 0 ; } copy_file_as_user <S2SV_ModEnd> ( src, <S2SV_ModStart> ( src, <S2SV_ModEnd> dest, getuid <S2SV_ModStart> getgid ( ), 0600 ) ; fs_logger2 ( "clone", dest <S2SV_ModEnd> ) ; return
Buggy code:
 static vpx_codec_err_t update_error_state ( vpx_codec_alg_priv_t * ctx, const struct vpx_internal_error_info * error ) { if ( error -> error_code ) <START_BUG> ctx -> base. err_detail = error -> has_detail? error -> detail : NULL ; <END_BUG> return error -> error_code ; }

Fix:
<S2SV_ModStart> -> error_code ) set_error_detail ( ctx, <S2SV_ModEnd> error -> has_detail <S2SV_ModStart> detail : NULL )
Buggy code:
 RD_BOOL cssp_read_tsrequest ( STREAM token, STREAM pubkey ) { STREAM s ; int length ; int tagval ; <START_BUG> s = tcp_recv ( NULL, 4 ) ; <END_BUG> if ( s == NULL ) return False ; if ( s -> p [ 0 ]!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) { logger ( Protocol, Error, "cssp_read_tsrequest(),   expected   BER_TAG_SEQUENCE|BER_TAG_CONSTRUCTED,   got   %x", s -> p [ 0 ] ) ; return False ; } if ( s -> p [ 1 ] < 0x80 ) length = s -> p [ 1 ] - 2 ; else if ( s -> p [ 1 ] == 0x81 ) length = s -> p [ 2 ] - 1 ; else if ( s -> p [ 1 ] == 0x82 ) length = ( s -> p [ 2 ] << 8 ) | s -> p [ 3 ] ; else return False ; s = tcp_recv ( s, length ) ;  if (! ber_in_header ( s, & tagval, & length ) || <START_BUG> tagval!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_CTXT_SPECIFIC | BER_TAG_CONSTRUCTED | 0 ) ) return False ; <END_BUG> in_uint8s ( s, length ) ;  if ( token ) { if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_CTXT_SPECIFIC | BER_TAG_CONSTRUCTED | 1 ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_SEQUENCE | BER_TAG_CONSTRUCTED ) ) return False ; if (! ber_in_header ( s, & tagval, & length ) || tagval!= ( BER_TAG_CTXT_SPECIFIC | BER_TAG

Fix:
<S2SV_ModStart> int tagval ; struct stream packet ; <S2SV_ModStart> length ) ; packet = * s ; <S2SV_ModStart> return False ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "cssp_read_tsrequest(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> version <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } <S2SV_ModStart> return False ; if (! s_check_rem ( s, length ) ) { rdp_protocol_error ( "cssp_read_tsrequest(), <S2SV_blank> consume <S2SV_blank> of <S2SV_blank> token <S2SV_blank> from <S2SV_blank> stream <S2SV_blank> would <S2SV_blank> overrun", & packet ) ; } s_realloc ( token, length ) ; s_reset ( token ) <S2SV_ModEnd> ; out_uint8p (
Buggy code:
 int fdt_find_regions ( const void * fdt, char * const inc [ ], int inc_count, char * const exc_prop [ ], int exc_prop_count, struct fdt_region region [ ], int max_regions, char * path, int path_len, int add_string_tab ) { int stack [ FDT_MAX_DEPTH ] = { 0 } ; char * end ; int nextoffset = 0 ; uint32_t tag ; int count = 0 ; int start = - 1 ; int depth = - 1 ; int want = 0 ; int base = fdt_off_dt_struct ( fdt ) ; <START_BUG> end = path ; <END_BUG> * end = '\\0' ; do { const struct fdt_property * prop ; const char * name ; const char * str ; int include = 0 ; int stop_at = 0 ; int offset ; int len ; offset = nextoffset ; tag = fdt_next_tag ( fdt, offset, & nextoffset ) ; stop_at = nextoffset ;  switch ( tag ) { <START_BUG> case FDT_PROP : include = want >= 2 ; stop_at = offset ; prop = fdt_get_property_by_offset ( fdt, offset, NULL ) ; str = fdt_string ( fdt, fdt32_to_cpu ( prop -> nameoff ) ) ; if (! str ) return - FDT_ERR_BADSTRUCTURE ; if ( str_in_list ( str, exc_prop, exc_prop_count ) ) include = 0 ; break ; case FDT_NOP : include = want >= 2 ; stop_at = offset ; break ; case FDT_BEGIN_NODE : depth ++ ; if ( depth == FDT_MAX_DEPTH ) return - FDT_ERR_BADSTRUCTURE ; <END_BUG> name = fdt_get_name ( fdt, offset, & len ) ;  if ( end - path + 2 + len >= path_len ) return - FDT_ERR_NOSPACE ; if ( end!= path + 1 ) * end ++ = '//' ; strcpy ( end, name ) ; end += len ; stack [ depth ] = want ; if ( want == 1 ) stop_at = offset ; if ( str_in_list ( path, inc, inc_count ) ) want = 2 ; else if

Fix:
<S2SV_ModStart> fdt ) ; bool expect_end = false ; <S2SV_ModStart> = nextoffset ; if ( expect_end && tag!= FDT_END ) return - FDT_ERR_BADLAYOUT ; <S2SV_ModStart> & len ) ; if (! depth && * name ) return - FDT_ERR_BADLAYOUT <S2SV_ModStart> = '\\0' ; if ( depth == - 1 ) expect_end = true ;
Buggy code:
 static uint16_t transmit_data_on ( int fd, uint8_t * data, uint16_t length ) { assert ( data!= NULL ) ; assert ( length > 0 ) ; uint16_t transmitted_length = 0 ; while ( length > 0 ) { <START_BUG> ssize_t ret = write ( fd, data + transmitted_length, length ) ; <END_BUG> switch ( ret ) { case - 1 : LOG_ERROR ( "In   %s,   error   writing   to   the   serial   port   with   fd   %d:   %s", __func__, fd, strerror ( errno ) ) ; return transmitted_length ; case 0 : return transmitted_length ; default : transmitted_length += ret ; length -= ret ; break ; } } return transmitted_length ; }

Fix:
<S2SV_ModStart> ssize_t ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> transmitted_length, length )
Buggy code:
 static void flush_end_io ( struct request * flush_rq, int error ) { struct request_queue * q = flush_rq -> q ; struct list_head * running ; bool queued = false ; struct request * rq, * n ; unsigned long flags = 0 ; struct blk_flush_queue * fq = blk_get_flush_queue ( q, flush_rq -> mq_ctx ) ; if ( q -> mq_ops ) { <START_BUG> spin_lock_irqsave ( & fq -> mq_flush_lock, flags ) ; <END_BUG> flush_rq -> tag = - 1 ; } running = & fq -> flush_queue [ fq -> flush_running_idx ] ; BUG_ON ( fq -> flush_pending_idx == fq -> flush_running_idx ) ; fq -> flush_running_idx ^= 1 ; if (! q -> mq_ops ) elv_completed_request ( q, flush_rq ) ; list_for_each_entry_safe ( rq, n, running, flush. list ) { unsigned int seq = blk_flush_cur_seq ( rq ) ; BUG_ON ( seq!= REQ_FSEQ_PREFLUSH && seq!= REQ_FSEQ_POSTFLUSH ) ; queued |= blk_flush_complete_seq ( rq, fq, seq, error ) ; } if ( queued || fq -> flush_queue_delayed ) { WARN_ON ( q -> mq_ops ) ; blk_run_queue_async ( q ) ; } fq -> flush_queue_delayed = 0 ; if ( q -> mq_ops ) spin_unlock_irqrestore ( & fq -> mq_flush_lock, flags ) ; }

Fix:
<S2SV_ModStart> mq_ops ) { struct blk_mq_hw_ctx * hctx ; <S2SV_ModStart> mq_flush_lock, flags ) ; hctx = q -> mq_ops -> map_queue ( q, flush_rq -> mq_ctx -> cpu ) ; blk_mq_tag_set_rq ( hctx, flush_rq -> tag, fq -> orig_rq
Buggy code:
 static int do_ipv6_getsockopt ( struct sock * sk, int level, int optname, char __user * optval, int __user * optlen, unsigned int flags ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; int len ; int val ; if ( ip6_mroute_opt ( optname ) ) return ip6_mroute_getsockopt ( sk, optname, optval, optlen ) ; if ( get_user ( len, optlen ) ) return - EFAULT ; switch ( optname ) { case IPV6_ADDRFORM : if ( sk -> sk_protocol!= IPPROTO_UDP && sk -> sk_protocol!= IPPROTO_UDPLITE && sk -> sk_protocol!= IPPROTO_TCP ) return - ENOPROTOOPT ; if ( sk -> sk_state!= TCP_ESTABLISHED ) return - ENOTCONN ; val = sk -> sk_family ; break ; case MCAST_MSFILTER : { struct group_filter gsf ; int err ; if ( len < GROUP_FILTER_SIZE ( 0 ) ) return - EINVAL ; if ( copy_from_user ( & gsf, optval, GROUP_FILTER_SIZE ( 0 ) ) ) return - EFAULT ; if ( gsf. gf_group. ss_family!= AF_INET6 ) return - EADDRNOTAVAIL ; lock_sock ( sk ) ; err = ip6_mc_msfget ( sk, & gsf, ( struct group_filter __user * ) optval, optlen ) ; release_sock ( sk ) ; return err ; } case IPV6_2292PKTOPTIONS : { struct msghdr msg ; struct sk_buff * skb ; if ( sk -> sk_type!= SOCK_STREAM ) return - ENOPROTOOPT ; msg. msg_control = optval ; msg. msg_controllen = len ; msg. msg_flags = flags ; lock_sock ( sk ) ; skb = np -> pktoptions ; if ( skb ) ip6_datagram_recv_ctl ( sk, & msg, skb ) ; release_sock ( sk ) ; if (! skb ) { if ( np -> rxopt. bits. rxinfo ) { struct in6_pktinfo src_info ; src_info. ipi6_ifindex =

Fix:
<S2SV_ModStart> IPV6_DSTOPTS : { struct ipv6_txoptions * opt ; <S2SV_ModStart> sk ) ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> ( sk, <S2SV_ModEnd> opt, optname
Buggy code:
 void * pvPortMalloc ( size_t xWantedSize ) { BlockLink_t * pxBlock, * pxPreviousBlock, * pxNewBlockLink ; void * pvReturn = NULL ; configASSERT ( pxEnd ) ; vTaskSuspendAll ( ) ; { if ( ( xWantedSize & xBlockAllocatedBit ) == 0 ) { <START_BUG> if ( xWantedSize > 0 ) <END_BUG> { xWantedSize += xHeapStructSize ; if ( ( xWantedSize & portBYTE_ALIGNMENT_MASK )!= 0x00 ) {  xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ; <START_BUG> } else { mtCOVERAGE_TEST_MARKER ( ) ; } } else { mtCOVERAGE_TEST_MARKER ( ) ; } if ( ( xWantedSize > 0 ) && ( xWantedSize <= xFreeBytesRemaining ) ) { pxPreviousBlock = & xStart ; pxBlock = xStart. pxNextFreeBlock ; while ( ( pxBlock -> xBlockSize < xWantedSize ) && ( pxBlock -> pxNextFreeBlock!= NULL ) ) { pxPreviousBlock = pxBlock ; pxBlock = pxBlock -> pxNextFreeBlock ; } if ( pxBlock!= pxEnd ) { pvReturn = ( void * ) ( ( ( uint8_t * ) pxPreviousBlock -> pxNextFreeBlock ) + xHeapStructSize ) ; pxPreviousBlock -> pxNextFreeBlock = pxBlock -> pxNextFreeBlock ; if ( ( pxBlock -> xBlockSize - xWantedSize ) > heapMINIMUM_BLOCK_SIZE ) { pxNewBlockLink = ( void * ) ( ( ( uint8_t * ) pxBlock ) + xWantedSize ) ; pxNewBlockLink -> xBlockSize = pxBlock -> xBlockSize - xWantedSize ; pxBlock -> xBlockSize = xWantedSize ; prvInsertBlockIntoFreeList ( ( pxNewBlockLink ) ) ; } else { mtCOVERAGE_TEST_MARKER ( ) ; } xFreeBytesRemaining -= pxBlock -> xBlockSize ; if ( xFreeBytesRemaining < xMinimumEverFreeBytesRemaining ) { xMinimumEverFreeBytesRemaining = xFreeBytesRemaining ; } else { mtCOVERAGE_TEST_MARKER<END_BUG>

Fix:
<S2SV_ModStart> { if ( ( <S2SV_ModStart> > 0 ) && ( ( xWantedSize + xHeapStructSize ) > xWantedSize ) ) <S2SV_ModStart> 0x00 ) { if ( ( xWantedSize + <S2SV_ModEnd> ( portBYTE_ALIGNMENT - <S2SV_ModStart> portBYTE_ALIGNMENT_MASK ) ) ) > xWantedSize ) { xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ; } else { xWantedSize = 0 ; } } else { mtCOVERAGE_TEST_MARKER ( ) ; } } else { xWantedSize = 0 <S2SV_ModEnd> ; } if
Buggy code:
 static SockState SockParse ( Sock * sockPtr ) { const Tcl_DString * bufPtr ; const Driver * drvPtr ; Request * reqPtr ; char save ; SockState result ; NS_NONNULL_ASSERT ( sockPtr!= NULL ) ; drvPtr = sockPtr -> drvPtr ; NsUpdateProgress ( ( Ns_Sock * ) sockPtr ) ; reqPtr = sockPtr -> reqPtr ; bufPtr = & reqPtr -> buffer ; while ( reqPtr -> coff == 0u ) { char * s, * e ; size_t cnt ; s = bufPtr -> string + reqPtr -> roff ; e = memchr ( s, INTCHAR ( '\\n' ), reqPtr -> avail ) ; if ( unlikely ( e == NULL ) ) { return SOCK_MORE ; } if ( unlikely ( ( e - s ) > drvPtr -> maxline ) ) { sockPtr -> keep = NS_FALSE ; if ( reqPtr -> request. line == NULL ) { Ns_Log ( DriverDebug, "SockParse:   maxline   reached   of   %d   bytes", drvPtr -> maxline ) ; sockPtr -> flags = NS_CONN_REQUESTURITOOLONG ; Ns_Log ( Warning, "request   line   is   too   long   (%d   bytes)", ( int ) ( e - s ) ) ; } else { sockPtr -> flags = NS_CONN_LINETOOLONG ; Ns_Log ( Warning, "request   header   line   is   too   long   (%d   bytes)", ( int ) ( e - s ) ) ; } } cnt = ( size_t ) ( e - s ) + 1u ; reqPtr -> roff += cnt ; reqPtr -> avail -= cnt ; if ( likely ( e > s ) && likely ( * ( e - 1 ) == '\\r' ) ) { -- e ; } if ( unlikely ( e == s ) && ( reqPtr -> coff == 0u ) ) { reqPtr -> coff = EndOfHeader ( sockPtr ) ; if ( ( sockPtr -> flags & NS_CONN_CONTINUE )!= 0u ) { Ns_Log ( Ns_LogRequestDebug, "honoring   100-continue" ) ; if ( ( sockPtr -> flags & NS_CONN_ENTITYTOOLARGE

Fix:
<S2SV_ModStart> ; Ns_Log ( Debug <S2SV_ModEnd>, "=== <S2SV_blank> length <S2SV_blank> < <S2SV_blank> avail <S2SV_blank> (length <S2SV_blank> %" PRIuz <S2SV_ModStart> 0u ) { SockState chunkState <S2SV_ModEnd> ; size_t currentContentLength <S2SV_ModStart> size_t currentContentLength ; chunkState <S2SV_ModEnd> = ChunkedDecode ( <S2SV_ModStart> if ( ( chunkState == SOCK_MORE <S2SV_ModEnd> ) || ( <S2SV_ModStart> SOCK_MORE ; } else if ( chunkState!= SOCK_READY ) { return chunkState ; }
Buggy code:
 static ssize_t DecodePSDPixels ( const size_t number_compact_pixels, const unsigned char * compact_pixels, const ssize_t depth, const size_t number_pixels, unsigned char * pixels ) { # define CheckNumberCompactPixels if ( packets == 0 ) return ( i ) ; packets -- # define CheckNumberPixels ( count ) if ( ( ( ssize_t ) i + count ) > ( ssize_t ) number_pixels ) return ( i ) ; i += count int pixel ; register ssize_t i, j ; size_t length ; ssize_t packets ; packets = ( ssize_t ) number_compact_pixels ; for ( i = 0 ; ( packets > 1 ) && ( i < ( ssize_t ) number_pixels ) ; ) { packets -- ; length = ( size_t ) ( * compact_pixels ++ ) ; if ( length == 128 ) continue ; if ( length > 128 ) { length = 256 - length + 1 ; CheckNumberCompactPixels ; pixel = ( * compact_pixels ++ ) ; for ( j = 0 ; j < ( ssize_t ) length ; j ++ ) { switch ( depth ) { case 1 : { CheckNumberPixels ( 8 ) ; * pixels ++ = ( pixel >> 7 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 6 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 5 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 4 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 3 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 2 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 1 ) & 0x01? 0U : 255U ; * pixels ++ = ( pixel >> 0 ) & 0x01? 0U : 255U ; break ; } case 2 : { CheckNumberPixels ( 4 ) ; * pixels ++ = ( unsigned char ) ( ( pixel >> 6 ) & 0x03 ) ; * pixels ++ = ( unsigned char ) ( ( pixel >> 4 ) & 0x03 ) ; * pixels ++ = ( unsigned char ) ( ( pixel >> 2 ) & 0x03 ) ; * pixels ++ = ( unsigned

Fix:
<S2SV_ModStart> ++ ) { CheckNumberCompactPixels ; <S2SV_ModStart> ; } } <S2SV_ModEnd> compact_pixels ++ ;
Buggy code:
 boolean parse_config_line ( origbuf ) char * origbuf ; { # if defined ( MICRO ) &&! defined ( NOCWD_ASSUMPTIONS ) static boolean ramdisk_specified = FALSE ; # endif # ifdef SYSCF int n, src = iflags. parse_config_file_src ; # endif char * bufp, buf [ 4 * BUFSZ ] ; uchar translate [ MAXPCHARS ] ; int len ; boolean retval = TRUE ; <START_BUG> mungspaces ( strcpy ( buf, origbuf ) ) ; <END_BUG> bufp = find_optparam ( buf ) ; if (! bufp ) { config_error_add ( "Not   a   config   statement,   missing   \'=\'" ) ; return FALSE ; } ++ bufp ; if ( * bufp ==' ') ++ bufp ; if ( match_varname ( buf, "OPTIONS", 4 ) ) { bufp = find_optparam ( origbuf ) ; ++ bufp ; if (! parseoptions ( bufp, TRUE, TRUE ) ) retval = FALSE ; } else if ( match_varname ( buf, "AUTOPICKUP_EXCEPTION", 5 ) ) { add_autopickup_exception ( bufp ) ; } else if ( match_varname ( buf, "BINDINGS", 4 ) ) { if (! parsebindings ( bufp ) ) retval = FALSE ; } else if ( match_varname ( buf, "AUTOCOMPLETE", 5 ) ) { parseautocomplete ( bufp, TRUE ) ; } else if ( match_varname ( buf, "MSGTYPE", 7 ) ) { if (! msgtype_parse_add ( bufp ) ) retval = FALSE ; # ifdef NOCWD_ASSUMPTIONS } else if ( match_varname ( buf, "HACKDIR", 4 ) ) { adjust_prefix ( bufp, HACKPREFIX ) ; } else if ( match_varname ( buf, "LEVELDIR", 4 ) || match_varname ( buf, "LEVELS", 4 ) ) { adjust_prefix ( bufp, LEVELPREFIX ) ; } else if ( match_varname ( buf, "SAVEDIR", 4 ) ) { adjust_prefix ( bufp, SAVEPREFIX ) ; } else if ( match_varname (

Fix:
<S2SV_ModStart> = TRUE ; while ( * origbuf =='<S2SV_blank>'|| * origbuf == '\\t' ) ++ origbuf ; ( void ) strncpy ( buf, origbuf, sizeof buf - 1 ) ; buf [ sizeof buf - 1 ] = '\\0' ; mungspaces ( buf <S2SV_ModEnd> ) ; bufp
Buggy code:
 void add_interrupt_randomness ( int irq, int irq_flags ) { struct entropy_store * r ; struct fast_pool * fast_pool = this_cpu_ptr ( & irq_randomness ) ; struct pt_regs * regs = get_irq_regs ( ) ; unsigned long now = jiffies ; cycles_t cycles = random_get_entropy ( ) ; __u32 c_high, j_high ; __u64 ip ; unsigned long seed ; int credit = 0 ; if ( cycles == 0 ) cycles = get_reg ( fast_pool, regs ) ; c_high = ( sizeof ( cycles ) > 4 )? cycles >> 32 : 0 ; j_high = ( sizeof ( now ) > 4 )? now >> 32 : 0 ; fast_pool -> pool [ 0 ] ^= cycles ^ j_high ^ irq ; fast_pool -> pool [ 1 ] ^= now ^ c_high ; ip = regs? instruction_pointer ( regs ) : _RET_IP_ ; fast_pool -> pool [ 2 ] ^= ip ; fast_pool -> pool [ 3 ] ^= ( sizeof ( ip ) > 4 )? ip >> 32 : get_reg ( fast_pool, regs ) ; fast_mix ( fast_pool ) ; add_interrupt_bench ( cycles ) ; <START_BUG> if ( unlikely ( crng_init == 0 ) ) { <END_BUG> if ( ( fast_pool -> count >= 64 ) && crng_fast_load ( ( char * ) fast_pool -> pool, sizeof ( fast_pool -> pool ) ) ) { fast_pool -> count = 0 ; fast_pool -> last = now ; } return ; } if ( ( fast_pool -> count < 64 ) &&! time_after ( now, fast_pool -> last + HZ ) ) return ; r = & input_pool ; if (! spin_trylock ( & r -> lock ) ) return ; fast_pool -> last = now ; __mix_pool_bytes ( r, & fast_pool -> pool, sizeof ( fast_pool -> pool ) ) ; if ( arch_get_random_seed_long ( & seed ) ) { __mix_pool_bytes ( r, & seed, sizeof ( seed ) ) ; credit = 1 ; } spin_unlock ( & r -> lock ) ; fast_pool -> count = 0 ; credit_entropy

Fix:
<S2SV_ModStart> cycles ) ; this_cpu_add ( net_rand_state. s1, fast_pool -> pool [ cycles & 3 ] ) ;
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; PixelPacket * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; size_t Unknown6 ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image2 ; goto END_OF_READING ; } MAT

Fix:
<S2SV_ModStart> image2 ) ; if ( Frames == 0 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ;
Buggy code:
 <START_BUG> int vp8_denoiser_filter_c ( YV12_BUFFER_CONFIG * mc_running_avg, <END_BUG> YV12_BUFFER_CONFIG * running_avg, MACROBLOCK * signal, unsigned int motion_magnitude, int y_offset, int uv_offset ) { unsigned char * sig = signal -> thismb ; int sig_stride = 16 ;  unsigned char * mc_running_avg_y = mc_running_avg -> y_buffer + y_offset ; <START_BUG> int mc_avg_y_stride = mc_running_avg -> y_stride ; <END_BUG> unsigned char * running_avg_y = running_avg -> y_buffer + y_offset ;  int avg_y_stride = running_avg -> y_stride ; <START_BUG> int r, c, i ; <END_BUG> int sum_diff = 0 ;  int adj_val [ 3 ] = { 3, 4, 6 } ; <START_BUG> if ( motion_magnitude <= MOTION_MAGNITUDE_THRESHOLD ) { <END_BUG> for ( i = 0 ; i < 3 ; i ++ )  adj_val [ i ] += 1 ; } for ( r = 0 ; r < 16 ; ++ r ) { for ( c = 0 ; c < 16 ; ++ c ) { int diff = 0 ; int adjustment = 0 ; int absdiff = 0 ; diff = mc_running_avg_y [ c ] - sig [ c ] ; absdiff = abs ( diff ) ; <START_BUG> if ( absdiff <= 3 ) <END_BUG> { running_avg_y [ c ] = mc_running_avg_y [ c ] ;  sum_diff += diff ; <START_BUG> } else { <END_BUG> if ( absdiff >= 4 && absdiff <= 7 )  adjustment = adj_val [ 0 ] ; else if ( absdiff >= 8 && absdiff <= 15 ) adjustment = adj_val [ 1 ] ; else adjustment = adj_val [ 2 ] ; if ( diff > 0 ) { if ( ( sig [ c ] + adjustment ) > 255 ) running_avg_y [ c ] = 255 ; else running_avg_y [ c ] = sig [ c ] + adjustment ; <START_BUG> sum_diff += adjustment ; <END_BUG> } else { if ( ( sig [ c ] - adjustment ) < 0 ) running_avg_y [ c ] = 0 ; else  running_avg_y [ c ] = sig [ c ]

Fix:
<S2SV_ModStart> int vp8_denoiser_filter_c ( <S2SV_ModEnd> unsigned char * <S2SV_ModStart> char * mc_running_avg_y, int mc_avg_y_stride, <S2SV_ModEnd> unsigned char * <S2SV_ModStart> char * running_avg_y, int avg_y_stride, unsigned char * sig, int sig_stride, unsigned int motion_magnitude, int increase_denoising ) { unsigned char * running_avg_y_start = running_avg_y ; unsigned char * sig_start = sig ; int sum_diff_thresh <S2SV_ModEnd> ; int r <S2SV_ModStart> r, c <S2SV_ModEnd> ; int sum_diff <S2SV_ModStart> 4, 6 } ; int shift_inc1 = 0 ; int shift_inc2 = 1 ; int col_sum [ 16 ] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 <S2SV_ModStart> MOTION_MAGNITUDE_THRESHOLD ) { if ( increase_denoising ) { shift_inc1 = 1 ; shift_inc2 = 2 ; } adj_val [ 0 ] += shift_inc2 ; adj_val [ 1 ] += shift_inc2 ; adj_val [
Buggy code:
 <START_BUG> static int detect_transition_to_still ( struct twopass_rc * twopass, <END_BUG> int frame_interval, int still_interval, double loop_decay_rate, double last_decay_rate ) {  int trans_to_still = 0 ; <START_BUG> <END_BUG> if ( frame_interval > MIN_GF_INTERVAL &&  loop_decay_rate >= 0.999 && last_decay_rate < 0.9 ) { int j ; <START_BUG> const FIRSTPASS_STATS * position = twopass -> stats_in ; <END_BUG> FIRSTPASS_STATS tmp_next_frame ; for ( j = 0 ; j < still_interval ; ++ j ) {  if ( EOF == input_stats ( twopass, & tmp_next_frame ) ) <START_BUG> break ; <END_BUG> if ( tmp_next_frame. pcnt_inter - tmp_next_frame. pcnt_motion < 0.999 )  break ; } <START_BUG> reset_fpf_position ( twopass, position ) ; <END_BUG>  if ( j == still_interval ) <START_BUG> trans_to_still = 1 ; } <END_BUG> return trans_to_still ;  }

Fix:
<S2SV_ModStart> int detect_transition_to_still ( VP9_COMP * cpi <S2SV_ModEnd>, int frame_interval <S2SV_ModStart> last_decay_rate ) { TWO_PASS * const twopass = & cpi -> twopass ; RATE_CONTROL * const rc = & cpi -> rc <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( frame_interval > rc -> min_gf_interval <S2SV_ModEnd> && loop_decay_rate >= <S2SV_ModStart> int j ; <S2SV_ModEnd> for ( j <S2SV_ModStart> j ) { const FIRSTPASS_STATS * stats = & twopass -> stats_in [ j ] ; if ( stats >= twopass -> stats_in_end <S2SV_ModEnd> ) break ; <S2SV_ModStart> ; if ( stats -> pcnt_inter - stats -> <S2SV_ModEnd> pcnt_motion < 0.999 <S2SV_ModStart> break ; } return <S2SV_ModEnd> j == still_interval <S2SV_ModStart> j == still_interval <S2SV_ModEnd> ; } return <S2SV_ModStart> ; } return 0 <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 vpx_codec_err_t vpx_codec_destroy ( vpx_codec_ctx_t * ctx ) { vpx_codec_err_t res ; if (! ctx ) res = VPX_CODEC_INVALID_PARAM ; else if (! ctx -> iface ||! ctx -> priv ) res = VPX_CODEC_ERROR ; else { <START_BUG> if ( ctx -> priv -> alg_priv ) <END_BUG>  ctx -> iface -> destroy ( ctx -> priv -> alg_priv ) ; <START_BUG> ctx -> iface = NULL ; ctx -> name = NULL ; ctx -> priv = NULL ; res = VPX_CODEC_OK ; } return SAVE_STATUS ( ctx, res ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; else { <S2SV_ModEnd> ctx -> iface <S2SV_ModStart> -> destroy ( ( vpx_codec_alg_priv_t * ) <S2SV_ModStart> ctx -> priv <S2SV_ModEnd> ) ; ctx
Buggy code:
 static int resize ( int new_rows, int new_cols, VTermPos * delta, void * user ) { VTermScreen * screen = user ; int is_altscreen = ( screen -> buffers [ 1 ] && screen -> buffer == screen -> buffers [ 1 ] ) ; int old_rows = screen -> rows ; int old_cols = screen -> cols ; int first_blank_row ; if (! is_altscreen && new_rows < old_rows ) { VTermPos pos = { 0, 0 } ; VTermPos cursor = screen -> state -> pos ; for ( pos. row = old_rows - 1 ; pos. row >= new_rows ; pos. row -- ) if (! vterm_screen_is_eol ( screen, pos ) || cursor. row == pos. row ) break ; first_blank_row = pos. row + 1 ; if ( first_blank_row > new_rows ) { VTermRect rect = { 0, 0, 0, 0 } ; rect. end_row = old_rows ; rect. end_col = old_cols ; scrollrect ( rect, first_blank_row - new_rows, 0, user ) ; vterm_screen_flush_damage ( screen ) ; delta -> row -= first_blank_row - new_rows ; } } screen -> buffers [ 0 ] = realloc_buffer ( screen, screen -> buffers [ 0 ], new_rows, new_cols ) ; if ( screen -> buffers [ 1 ] ) screen -> buffers [ 1 ] = realloc_buffer ( screen, screen -> buffers [ 1 ], new_rows, new_cols ) ; screen -> buffer = is_altscreen? screen -> buffers [ 1 ] : screen -> buffers [ 0 ] ; screen -> rows = new_rows ; screen -> cols = new_cols ; <START_BUG> if ( screen -> sb_buffer ) <END_BUG> vterm_allocator_free ( screen -> vt, screen -> sb_buffer ) ; screen -> sb_buffer = vterm_allocator_malloc ( screen -> vt, sizeof ( VTermScreenCell ) * new_cols ) ; if ( new_cols > old_cols ) { VTermRect rect ; rect. start_row = 0 ; rect. end_row = old_rows ; rect. start_col = old_cols ; rect. end_col = new

Fix:
<S2SV_ModStart> = new_cols ; <S2SV_ModEnd> vterm_allocator_free ( screen
Buggy code:
 int pci_emul_add_msixcap ( struct pci_vdev * dev, int msgnum, int barnum ) { uint32_t tab_size ; struct msixcap msixcap ; <START_BUG> assert ( msgnum >= 1 && msgnum <= MAX_MSIX_TABLE_ENTRIES ) ; <END_BUG> assert ( barnum >= 0 && barnum <= PCIR_MAX_BAR_0 ) ; tab_size = msgnum * MSIX_TABLE_ENTRY_SIZE ; tab_size = roundup2 ( tab_size, 4096 ) ; dev -> msix. table_bar = barnum ; dev -> msix. pba_bar = barnum ; dev -> msix. table_offset = 0 ; dev -> msix. table_count = msgnum ; dev -> msix. pba_offset = tab_size ; dev -> msix. pba_size = PBA_SIZE ( msgnum ) ;  pci_msix_table_init ( dev, msgnum ) ; <START_BUG> pci_populate_msixcap ( & msixcap, msgnum, barnum, tab_size ) ; pci_emul_alloc_bar ( dev, barnum, PCIBAR_MEM32, tab_size + dev -> msix. pba_size ) ; return ( pci_emul_add_capability ( dev, ( u_char * ) & msixcap, sizeof ( msixcap ) ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> msixcap msixcap ; if ( msgnum > MAX_MSIX_TABLE_ENTRIES ) { pr_err ( "%s: <S2SV_blank> Too <S2SV_blank> many <S2SV_blank> entries!\\n", __func__ ) ; return - 1 ; } <S2SV_ModEnd> tab_size = msgnum <S2SV_ModStart> msgnum ) ; if ( <S2SV_ModStart>, msgnum )!= 0 ) return - 1
Buggy code:
 static int jpc_qcd_dumpparms ( jpc_ms_t * ms, FILE * out ) { jpc_qcd_t * qcd = & ms -> parms. qcd ; int i ; fprintf ( out, "qntsty   =   %d;   numguard   =   %d;   numstepsizes   =   %d\\n", ( int ) qcd -> compparms. qntsty, qcd -> compparms. numguard, qcd -> compparms. numstepsizes ) ; for ( i = 0 ; i < qcd -> compparms. numstepsizes ; ++ i ) { fprintf ( out, "expn[%d]   =   0x%04x;   mant[%d]   =   0x%04x;\\n", <START_BUG> i, ( unsigned ) JPC_QCX_GETEXPN ( qcd -> compparms. stepsizes [ i ] ), <END_BUG>  i, ( unsigned ) JPC_QCX_GETMANT ( qcd -> compparms. stepsizes [ i ] ) ) ; <START_BUG> } return 0 ; }<END_BUG>

Fix:
<S2SV_ModStart>, i, JAS_CAST ( unsigned, <S2SV_ModEnd> JPC_QCX_GETEXPN ( qcd <S2SV_ModStart> i ] ) ) <S2SV_ModStart>, i, JAS_CAST ( unsigned, <S2SV_ModEnd> JPC_QCX_GETMANT ( qcd <S2SV_ModStart> ] ) ) )
Buggy code:
 int ptrace_setxregs ( struct task_struct * child, void __user * uregs ) { struct thread_info * ti = task_thread_info ( child ) ; struct pt_regs * regs = task_pt_regs ( child ) ; elf_xtregs_t * xtregs = uregs ; <START_BUG> int ret = 0 ; <END_BUG> # if XTENSA_HAVE_COPROCESSORS coprocessor_flush_all ( ti ) ; coprocessor_release_all ( ti ) ; ret |= __copy_from_user ( & ti -> xtregs_cp, & xtregs -> cp0, sizeof ( xtregs_coprocessor_t ) ) ; # endif ret |= __copy_from_user ( & regs -> xtregs_opt, & xtregs -> opt, sizeof ( xtregs -> opt ) ) ; ret |= __copy_from_user ( & ti -> xtregs_user, & xtregs -> user, sizeof ( xtregs -> user ) ) ; return ret? - EFAULT : 0 ; }

Fix:
<S2SV_ModStart> ret = 0 ; if (! access_ok ( VERIFY_READ, uregs, sizeof ( elf_xtregs_t ) ) ) return - EFAULT
Buggy code:
 static int ext4_ext_split ( handle_t * handle, struct inode * inode, unsigned int flags, struct ext4_ext_path * path, struct ext4_extent * newext, int at ) { struct buffer_head * bh = NULL ; int depth = ext_depth ( inode ) ; struct ext4_extent_header * neh ; struct ext4_extent_idx * fidx ; int i = at, k, m, a ; ext4_fsblk_t newblock, oldblock ; __le32 border ; ext4_fsblk_t * ablocks = NULL ; int err = 0 ; <START_BUG> if ( unlikely ( path [ depth ]. p_ext > EXT_MAX_EXTENT ( path [ depth ]. p_hdr ) ) ) { <END_BUG> EXT4_ERROR_INODE ( inode, "p_ext   >   EXT_MAX_EXTENT!" ) ; return - EFSCORRUPTED ; } if ( path [ depth ]. p_ext!= EXT_MAX_EXTENT ( path [ depth ]. p_hdr ) ) { border = path [ depth ]. p_ext [ 1 ]. ee_block ; ext_debug ( "leaf   will   be   split." "   next   leaf   starts   at   %d\\n", le32_to_cpu ( border ) ) ; } else { border = newext -> ee_block ; ext_debug ( "leaf   will   be   added." "   next   leaf   starts   at   %d\\n", le32_to_cpu ( border ) ) ; } ablocks = kcalloc ( depth, sizeof ( ext4_fsblk_t ), GFP_NOFS ) ; if (! ablocks ) return - ENOMEM ; ext_debug ( "allocate   %d   blocks   for   indexes//leaf\\n", depth - at ) ; for ( a = 0 ; a < depth - at ; a ++ ) { newblock = ext4_ext_new_meta_block ( handle, inode, path, newext, & err, flags ) ; if ( newblock == 0 ) goto cleanup ; ablocks [ a ] = newblock ; } newblock = ablocks [ -- a ] ; if ( unlikely ( newblock == 0 ) ) { EXT4_ERROR_INODE

Fix:
<S2SV_ModStart> = 0 ; size_t ext_size = 0 ; <S2SV_ModStart> ) ; } ext_size = sizeof ( struct ext4_extent_header ) + sizeof ( struct ext4_extent ) * le16_to_cpu ( neh -> eh_entries ) ; memset ( bh -> b_data + ext_size, 0, inode -> i_sb -> s_blocksize - ext_size ) ; <S2SV_ModStart> ) ; } ext_size = sizeof ( struct ext4_extent_header ) + ( sizeof ( struct ext4_extent ) * le16_to_cpu ( neh -> eh_entries ) ) ; memset ( bh -> b_data + ext_size, 0, inode -> i_sb -> s_blocksize - ext_size ) ;
Buggy code:
 <START_BUG> static void encode_mv_component ( vp9_writer * w, int comp, <END_BUG> const nmv_component * mvcomp, int usehp ) { int offset ; const int sign = comp < 0 ; const int mag = sign? - comp : comp ; const int mv_class = vp9_get_mv_class ( mag - 1, & offset ) ; const int d = offset >> 3 ; const int fr = ( offset >> 1 ) & 3 ; const int hp = offset & 1 ; assert ( comp!= 0 ) ;  vp9_write ( w, sign, mvcomp -> sign ) ; <START_BUG> vp9_write_token ( w, vp9_mv_class_tree, mvcomp -> classes, & mv_class_encodings [ mv_class ] ) ; if ( mv_class == MV_CLASS_0 ) { vp9_write_token ( w, vp9_mv_class0_tree, mvcomp -> class0, & mv_class0_encodings [ d ] ) ; } else { int i ; const int n = mv_class + CLASS0_BITS - 1 ; for ( i = 0 ; i < n ; ++ i ) <END_BUG> vp9_write ( w, ( d >> i ) & 1, mvcomp -> bits [ i ] ) ;  } vp9_write_token ( w, vp9_mv_fp_tree, mv_class == MV_CLASS_0? mvcomp -> class0_fp [ d ] : mvcomp -> fp, & mv_fp_encodings [ fr ] ) ; if ( usehp ) <START_BUG> vp9_write ( w, hp, <END_BUG> mv_class == MV_CLASS_0? mvcomp -> class0_hp : mvcomp -> hp ) ; }

Fix:
<S2SV_ModStart> void encode_mv_component ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> 0 ) ; vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> ++ i ) vpx_write <S2SV_ModEnd> ( w, <S2SV_ModStart> ( usehp ) vpx_write <S2SV_ModEnd> ( w,
Buggy code:
 int vp8_full_search_sadx3 ( MACROBLOCK * x, BLOCK * b, BLOCKD * d, int_mv * ref_mv, int sad_per_bit, int distance, vp8_variance_fn_ptr_t * fn_ptr, int * mvcost [ 2 ], int_mv * center_mv ) { unsigned char * what = ( * ( b -> base_src ) + b -> src ) ; int what_stride = b -> src_stride ; unsigned char * in_what ; int pre_stride = x -> e_mbd. pre. y_stride ; unsigned char * base_pre = x -> e_mbd. pre. y_buffer ; int in_what_stride = pre_stride ; int mv_stride = pre_stride ; unsigned char * bestaddress ; int_mv * best_mv = & d -> bmi. mv ; int_mv this_mv ; unsigned int bestsad ; unsigned int thissad ; int r, c ; unsigned char * check_here ; int ref_row = ref_mv -> as_mv. row ; int ref_col = ref_mv -> as_mv. col ; int row_min = ref_row - distance ; int row_max = ref_row + distance ; int col_min = ref_col - distance ; int col_max = ref_col + distance ; unsigned int sad_array [ 3 ] ; int * mvsadcost [ 2 ] ; int_mv fcenter_mv ; mvsadcost [ 0 ] = x -> mvsadcost [ 0 ] ; mvsadcost [ 1 ] = x -> mvsadcost [ 1 ] ; fcenter_mv. as_mv. row = center_mv -> as_mv. row >> 3 ; fcenter_mv. as_mv. col = center_mv -> as_mv. col >> 3 ; in_what = base_pre + d -> offset ; bestaddress = in_what + ( ref_row * pre_stride ) + ref_col ; best_mv -> as_mv. row = ref_row ; best_mv -> as_mv. col = ref_col ; bestsad = fn_ptr -> sdf ( what, what_stride, bestaddress, <START_BUG> in_what_stride, UINT_MAX ) <END_BUG> +

Fix:
<S2SV_ModStart> bestaddress, in_what_stride <S2SV_ModEnd> ) + mvsad_err_cost <S2SV_ModStart> check_here, in_what_stride <S2SV_ModEnd> ) ; if
Buggy code:
 static vpx_codec_err_t ctrl_get_reference ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG>  vp9_ref_frame_t * frame = va_arg ( args, vp9_ref_frame_t * ) ; <START_BUG> if ( frame!= NULL ) { <END_BUG> YV12_BUFFER_CONFIG * fb ;  <START_BUG> vp9_get_reference_enc ( ctx -> cpi, frame -> idx, & fb ) ; <END_BUG> yuvconfig2image ( & frame -> img, fb, NULL ) ; return VPX_CODEC_OK ; } else { return VPX_CODEC_INVALID_PARAM ; } }

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> { vp9_ref_frame_t * const <S2SV_ModStart> YV12_BUFFER_CONFIG * fb = get_ref_frame ( & <S2SV_ModEnd> ctx -> cpi <S2SV_ModStart> ctx -> cpi -> common <S2SV_ModStart> frame -> idx ) ; if ( fb == NULL ) return VPX_CODEC_ERROR <S2SV_ModEnd> ; yuvconfig2image (
Buggy code:
 static MagickRealType ApplyEvaluateOperator ( RandomInfo * random_info, const Quantum pixel, const MagickEvaluateOperator op, const MagickRealType value ) { MagickRealType result ; result = 0.0 ; switch ( op ) { case UndefinedEvaluateOperator : break ; case AbsEvaluateOperator : { result = ( MagickRealType ) fabs ( ( double ) ( pixel + value ) ) ; break ; } case AddEvaluateOperator : { result = ( MagickRealType ) ( pixel + value ) ; break ; } case AddModulusEvaluateOperator : { result = pixel + value ; result -= ( QuantumRange + 1.0 ) * floor ( ( double ) result // ( QuantumRange + 1.0 ) ) ; break ; } case AndEvaluateOperator : { <START_BUG> result = ( MagickRealType ) ( ( size_t ) pixel & ( size_t ) ( value + 0.5 ) ) ; <END_BUG> break ; } case CosineEvaluateOperator : { result = ( MagickRealType ) ( QuantumRange * ( 0.5 * cos ( ( double ) ( 2.0 * MagickPI * QuantumScale * pixel * value ) ) + 0.5 ) ) ; break ; } case DivideEvaluateOperator : { result = pixel // ( value == 0.0? 1.0 : value ) ; break ; } case ExponentialEvaluateOperator : { result = ( MagickRealType ) ( QuantumRange * exp ( ( double ) ( value * QuantumScale * pixel ) ) ) ; break ; } case GaussianNoiseEvaluateOperator : { result = ( MagickRealType ) GenerateDifferentialNoise ( random_info, pixel, GaussianNoise, value ) ; break ; } case ImpulseNoiseEvaluateOperator : { result = ( MagickRealType ) GenerateDifferentialNoise ( random_info, pixel, ImpulseNoise, value ) ; break ; } case LaplacianNoiseEvaluateOperator : { result = ( MagickRealType ) GenerateDifferentialNoise ( random_info, pixel, LaplacianNoise, value ) ; break ; } case LeftShiftEvaluateOperator : {  result = ( MagickRealType ) ( ( size_t ) pixel << ( size_t ) ( value + 0.5 ) ) ; <START_BUG> break ; } case LogEvaluateOperator : { if<END_BUG>

Fix:
<S2SV_ModStart> ) ( ( ssize_t <S2SV_ModEnd> ) pixel & <S2SV_ModStart> pixel & ( ssize_t <S2SV_ModEnd> ) ( value <S2SV_ModStart> ) ( ( ssize_t <S2SV_ModEnd> ) pixel << <S2SV_ModStart> pixel << ( ssize_t <S2SV_ModEnd> ) ( value <S2SV_ModStart> ) ( ( ssize_t <S2SV_ModEnd> ) pixel | <S2SV_ModStart> pixel | ( ssize_t <S2SV_ModEnd> ) ( value <S2SV_ModStart> ) ( ( ssize_t <S2SV_ModEnd> ) pixel >> <S2SV_ModStart> pixel >> ( ssize_t <S2SV_ModEnd> ) ( value <S2SV_ModStart> ) ( ( ssize_t <S2SV_ModEnd> ) pixel ^ <S2SV_ModStart> pixel ^ ( ssize_t <S2SV_ModEnd> ) ( value
Buggy code:
 static int compare_tile_buffers ( const void * a, const void * b ) { const TileBuffer * const buf1 = ( const TileBuffer * ) a ; const TileBuffer * const buf2 = ( const TileBuffer * ) b ; <START_BUG> if ( buf1 -> size < buf2 -> size ) { <END_BUG> return 1 ; } else if ( buf1 -> size == buf2 -> size ) { return 0 ; } else { return - 1 ; } }

Fix:
<S2SV_ModStart> ) b ; return ( int ) ( buf2 -> size - <S2SV_ModEnd> buf1 -> size <S2SV_ModStart> buf1 -> size ) ; } <S2SV_ModEnd> <S2SV_null> <S2SV_null> <S2SV_null>
Buggy code:
 stmt_ty <START_BUG> AsyncFor ( expr_ty target, expr_ty iter, asdl_seq * body, asdl_seq * orelse, int <END_BUG> lineno, int col_offset, int end_lineno, int end_col_offset, PyArena * arena ) { stmt_ty p ; if (! target ) { PyErr_SetString ( PyExc_ValueError, "field   target   is   required   for   AsyncFor" ) ; return NULL ; } if (! iter ) { PyErr_SetString ( PyExc_ValueError, "field   iter   is   required   for   AsyncFor" ) ; return NULL ; } p = ( stmt_ty ) PyArena_Malloc ( arena, sizeof ( * p ) ) ; if (! p ) return NULL ; p -> kind = AsyncFor_kind ; p -> v. AsyncFor. target = target ; p -> v. AsyncFor. iter = iter ; p -> v. AsyncFor. body = body ;  p -> v. AsyncFor. orelse = orelse ; <START_BUG> p -> lineno = lineno ; p -> col_offset = col_offset ; p -> end_lineno = end_lineno ; p -> end_col_offset = end_col_offset ; return p ; }<END_BUG>

Fix:
<S2SV_ModStart> * orelse, string type_comment, int <S2SV_ModEnd> lineno, int <S2SV_ModStart> orelse = orelse ; p -> v. AsyncFor. type_comment = type_comment
Buggy code:
 <START_BUG> static int update_open_stateid ( struct nfs4_state * state, nfs4_stateid * open_stateid, nfs4_stateid * delegation, int open_flags ) <END_BUG> { struct nfs_inode * nfsi = NFS_I ( state -> inode ) ; struct nfs_delegation * deleg_cur ; int ret = 0 ;  open_flags &= ( FMODE_READ | FMODE_WRITE ) ; <START_BUG> rcu_read_lock ( ) ; deleg_cur = rcu_dereference ( nfsi -> delegation ) ; if ( deleg_cur == NULL ) goto no_delegation ; spin_lock ( & deleg_cur -> lock ) ; if ( nfsi -> delegation!= deleg_cur || <END_BUG> ( deleg_cur -> type & open_flags )!= open_flags )  goto no_delegation_unlock ; if ( delegation == NULL ) delegation = & deleg_cur -> stateid ; else if ( memcmp ( deleg_cur -> stateid. data, delegation -> data, NFS4_STATEID_SIZE )!= 0 ) goto no_delegation_unlock ; nfs_mark_delegation_referenced ( deleg_cur ) ; <START_BUG> __update_open_stateid ( state, open_stateid, & deleg_cur -> stateid, open_flags ) ; <END_BUG> ret = 1 ; no_delegation_unlock : spin_unlock ( & deleg_cur -> lock ) ; no_delegation : rcu_read_unlock ( ) ; if (! ret && open_stateid!= NULL ) {  __update_open_stateid ( state, open_stateid, NULL, open_flags ) ; <START_BUG> ret = 1 ; } return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> * delegation, fmode_t fmode <S2SV_ModEnd> ) { struct <S2SV_ModStart> = 0 ; fmode <S2SV_ModEnd> &= ( FMODE_READ <S2SV_ModStart> -> type & fmode )!= fmode <S2SV_ModEnd> ) goto no_delegation_unlock <S2SV_ModStart> -> stateid, fmode <S2SV_ModEnd> ) ; ret <S2SV_ModStart>, NULL, fmode <S2SV_ModEnd> ) ; ret