nus-yam/ex-repair huggingface dataset:
Buggy code:
 static int pad_pkcs1 ( bn_t m, int * p_len, int m_len, int k_len, int operation ) { uint8_t * id, pad = 0 ; <START_BUG> int len, result = RLC_OK ; <END_BUG> bn_t t ; bn_null ( t ) ; RLC_TRY { bn_new ( t ) ; switch ( operation ) { case RSA_ENC : bn_zero ( m ) ; bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, RSA_PUB ) ; * p_len = k_len - 3 - m_len ; for ( int i = 0 ; i < * p_len ; i ++ ) { bn_lsh ( m, m, 8 ) ; do { rand_bytes ( & pad, 1 ) ; } while ( pad == 0 ) ; bn_add_dig ( m, m, pad ) ; } bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, 0 ) ; bn_lsh ( m, m, m_len * 8 ) ;  break ; <START_BUG> case RSA_DEC : m_len = k_len - 1 ; bn_rsh ( t, m, 8 * m_len ) ; <END_BUG> if (! bn_is_zero ( t ) ) {  <START_BUG> result = RLC_ERR ; <END_BUG> } * p_len = m_len ; m_len -- ; bn_rsh ( t, m, 8 * m_len ) ; pad = ( uint8_t ) t -> dp [ 0 ] ;  if ( pad!= RSA_PUB ) { <START_BUG> <END_BUG> result = RLC_ERR ;  } do { m_len -- ; bn_rsh ( t, m, 8 * m_len ) ; pad = ( uint8_t ) t -> dp [ 0 ] ; } while ( pad!= 0 && m_len > 0 ) ; * p_len -= ( m_len - 1 ) ; bn_mod_2b ( m, m, ( k_len - * p_len ) * 8 ) ; <START_BUG> break ; <END_BUG> case RSA_SIG : id = hash_id ( MD_MAP, & len ) ; bn_zero ( m ) ; bn_lsh ( m, m, 8 ) ; bn_add

Fix:
<S2SV_ModStart>, result = RLC_ERR <S2SV_ModEnd> ; bn_t t <S2SV_ModStart> 8 ) ; result = RLC_OK ; <S2SV_ModStart> ; if ( <S2SV_ModEnd> bn_is_zero ( t <S2SV_ModStart> ) ) { <S2SV_ModEnd> * p_len = <S2SV_ModStart> if ( pad == <S2SV_ModEnd> RSA_PUB ) { <S2SV_ModStart> RSA_PUB ) { <S2SV_ModEnd> do { m_len <S2SV_ModStart> 8 ) ; result = ( m_len > <S2SV_ModEnd> 0? RLC_OK <S2SV_ModStart> RLC_ERR ) ; } } break ; case RSA_SIG : id = hash_id ( MD_MAP, & len ) ; bn_zero ( m ) ; bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, RSA_PRV ) ; * p_len = k_len - 3 - m_len - len ; for ( int i = 0 ; i < * p_len ; i ++ ) { bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, RSA_PAD ) ; } bn_lsh ( m, m, 8 ) ; bn_add_dig ( m, m, 0 ) ; bn_lsh ( m, m, 8 * len )
Buggy code:
 static inline void jiffies_to_compat_timeval ( unsigned long jiffies, struct compat_timeval * value ) { u64 nsec = ( u64 ) jiffies * TICK_NSEC ; <START_BUG> long rem ; <END_BUG>  value -> tv_sec = div_long_long_rem ( nsec, NSEC_PER_SEC, & rem ) ; <START_BUG> value -> tv_usec = rem // NSEC_PER_USEC ; }<END_BUG>

Fix:
<S2SV_ModStart> * TICK_NSEC ; u32 <S2SV_ModEnd> rem ; value <S2SV_ModStart> -> tv_sec = div_u64_rem <S2SV_ModEnd> ( nsec,
Buggy code:
 static int userauth_pubkey ( struct ssh * ssh ) { Authctxt * authctxt = ssh -> authctxt ; struct passwd * pw = authctxt -> pw ; <START_BUG> struct sshbuf * b ; <END_BUG> struct sshkey * key = NULL ;  char * pkalg, * userstyle = NULL, * key_s = NULL, * ca_s = NULL ; <START_BUG> <END_BUG> u_char * pkblob, * sig, have_sig ;  size_t blen, slen ; int r, pktype ; int authenticated = 0 ; struct sshauthopt * authopts = NULL ; <START_BUG> if (! authctxt -> valid ) { <END_BUG> debug2 ( "%s:   disabled   because   of   invalid   user", __func__ ) ; return 0 ; } if ( ( r = sshpkt_get_u8 ( ssh, & have_sig ) )!= 0 || ( r = sshpkt_get_cstring ( ssh, & pkalg, NULL ) )!= 0 || ( r = sshpkt_get_string ( ssh, & pkblob, & blen ) )!= 0 ) fatal ( "%s:   parse   request   failed:   %s", __func__, ssh_err ( r ) ) ; pktype = sshkey_type_from_name ( pkalg ) ; if ( pktype == KEY_UNSPEC ) { verbose ( "%s:   unsupported   public   key   algorithm:   %s", __func__, pkalg ) ; goto done ; } if ( ( r = sshkey_from_blob ( pkblob, blen, & key ) )!= 0 ) { error ( "%s:   could   not   parse   key:   %s", __func__, ssh_err ( r ) ) ; goto done ; } if ( key == NULL ) { error ( "%s:   cannot   decode   key:   %s", __func__, pkalg ) ; goto done ; } if ( key -> type!= pktype ) { error ( "%s:   type   mismatch   for   decoded   key   " "(received   %d,   expected   %d)", __func__, key -> type, pktype ) ; goto done ; } if ( sshkey_type_plain ( key -> type ) == KEY_RSA && ( ssh -> compat & SSH_BUG_RSASIGMD

Fix:
<S2SV_ModStart> sshbuf * b = NULL <S2SV_ModStart> char * pkalg = NULL <S2SV_ModStart> u_char * pkblob = NULL <S2SV_ModStart>, * sig = NULL <S2SV_ModStart> ; if ( <S2SV_ModEnd> ( r = <S2SV_ModStart> r ) ) ; } if (! authctxt -> valid || authctxt -> user == NULL ) { debug2 ( "%s: <S2SV_blank> disabled <S2SV_blank> because <S2SV_blank> of <S2SV_blank> invalid <S2SV_blank> user", __func__ ) ; goto done <S2SV_ModStart> b ) ; <S2SV_ModEnd> auth2_record_key ( authctxt <S2SV_ModStart> ) ) ; if (! authctxt -> valid || authctxt -> user == NULL ) { debug2 ( "%s: <S2SV_blank> disabled <S2SV_blank> because <S2SV_blank> of <S2SV_blank> invalid <S2SV_blank> user", __func__ ) ; goto done ; } <S2SV_ModStart> ca_s ) ; free ( sig ) ;
Buggy code:
 <START_BUG> int utf8s_to_utf16s ( const u8 * s, int len, wchar_t * pwcs ) <END_BUG> { u16 * op ; int size ; unicode_t u ; op = pwcs ;  while ( * s && len > 0 ) { <START_BUG> if ( * s & 0x80 ) { size = utf8_to_utf32 ( s, len, & u ) ; if ( size < 0 ) return - EINVAL ; <END_BUG> if ( u >= PLANE_SIZE ) {  <START_BUG> u -= PLANE_SIZE ; <END_BUG>  * op ++ = ( wchar_t ) ( SURROGATE_PAIR | <START_BUG> <END_BUG> ( ( u >> 10 ) & SURROGATE_BITS ) ) ;  * op ++ = ( wchar_t ) ( SURROGATE_PAIR | SURROGATE_LOW | <START_BUG> ( u & SURROGATE_BITS ) ) ; <END_BUG> } else {  * op ++ = ( wchar_t ) u ; <START_BUG> } s += size ; len -= size ; } else { <END_BUG> * op ++ = * s ++ ;  len -- ; } } return op - pwcs ; }

Fix:
<S2SV_ModStart> int len, enum utf16_endian endian, <S2SV_ModStart> wchar_t * pwcs, int maxlen <S2SV_ModStart> ; while ( <S2SV_ModEnd> len > 0 <S2SV_ModStart> len > 0 && maxlen > 0 && * s <S2SV_ModStart> - EINVAL ; s += size ; len -= size ; <S2SV_ModStart> PLANE_SIZE ) { if ( maxlen < 2 ) break ; <S2SV_ModStart> -= PLANE_SIZE ; put_utf16 ( op ++, <S2SV_ModEnd> SURROGATE_PAIR | ( <S2SV_ModStart> & SURROGATE_BITS ), endian ) ; put_utf16 ( op ++, <S2SV_ModEnd> SURROGATE_PAIR | SURROGATE_LOW <S2SV_ModStart> & SURROGATE_BITS ), endian ) ; maxlen -= 2 <S2SV_ModEnd> ; } else <S2SV_ModStart> } else { put_utf16 ( op ++, u, endian ) ; maxlen -- ; } <S2SV_ModEnd> } else { <S2SV_ModStart> } else { put_utf16 ( op ++, * s ++, endian ) ; len -- ; maxlen <S2SV_ModEnd> -- ; }
Buggy code:
 static int decode_unit ( SCPRContext * s, PixelModel * pixel, unsigned step, unsigned * rval ) { GetByteContext * gb = & s -> gb ; RangeCoder * rc = & s -> rc ; unsigned totfr = pixel -> total_freq ; unsigned value, x = 0, cumfr = 0, cnt_x = 0 ; int i, j, ret, c, cnt_c ; if ( ( ret = s -> get_freq ( rc, totfr, & value ) ) < 0 ) return ret ; while ( x < 16 ) { cnt_x = pixel -> lookup [ x ] ; if ( value >= cumfr + cnt_x ) cumfr += cnt_x ; else break ; x ++ ; } c = x * 16 ; cnt_c = 0 ; while ( c < 256 ) { cnt_c = pixel -> freq [ c ] ; if ( value >= cumfr + cnt_c ) cumfr += cnt_c ; else break ; c ++ ; } <START_BUG> if ( ( ret = s -> decode ( gb, rc, cumfr, cnt_c, totfr ) ) < 0 ) <END_BUG> return ret ; pixel -> freq [ c ] = cnt_c + step ; pixel -> lookup [ x ] = cnt_x + step ; totfr += step ; if ( totfr > BOT ) { totfr = 0 ; for ( i = 0 ; i < 256 ; i ++ ) { unsigned nc = ( pixel -> freq [ i ] >> 1 ) + 1 ; pixel -> freq [ i ] = nc ; totfr += nc ; } for ( i = 0 ; i < 16 ; i ++ ) { unsigned sum = 0 ; unsigned i16_17 = i << 4 ; for ( j = 0 ; j < 16 ; j ++ ) sum += pixel -> freq [ i16_17 + j ] ; pixel -> lookup [ i ] = sum ; } } pixel -> total_freq = totfr ; * rval = c & s -> cbits ; return 0 ; }

Fix:
<S2SV_ModStart> } if ( x >= 16 || c >= 256 ) { return AVERROR_INVALIDDATA ; } if (
Buggy code:
 void rrd_graph_options ( int argc, char * argv [ ], image_desc_t * im ) { int stroff ; char * parsetime_error = NULL ; char scan_gtm [ 12 ], scan_mtm [ 12 ], scan_ltm [ 12 ], col_nam [ 12 ] ; time_t start_tmp = 0, end_tmp = 0 ; long long_tmp ; rrd_time_value_t start_tv, end_tv ; long unsigned int color ; # define LONGOPT_UNITS_SI 255 struct option long_options [ ] = { { "alt-autoscale", no_argument, 0, 'A' }, { "imgformat", required_argument, 0, 'a' }, { "font-smoothing-threshold", required_argument, 0, 'B' }, { "base", required_argument, 0, 'b' }, { "color", required_argument, 0, 'c' }, { "full-size-mode", no_argument, 0, 'D' }, { "daemon", required_argument, 0, 'd' }, { "slope-mode", no_argument, 0, 'E' }, { "end", required_argument, 0, 'e' }, { "force-rules-legend", no_argument, 0, 'F' }, { "imginfo", required_argument, 0, 'f' }, { "graph-render-mode", required_argument, 0, 'G' }, { "no-legend", no_argument, 0, 'g' }, { "height", required_argument, 0, 'h' }, { "no-minor", no_argument, 0, 'I' }, { "interlaced", no_argument, 0, 'i' }, { "alt-autoscale-min", no_argument, 0, 'J' }, { "only-graph", no_argument, 0, 'j' }, { "units-length", required_argument, 0, 'L' }, { "lower-limit", required_argument, 0, 'l' }, { "alt-autoscale-max", no

Fix:
<S2SV_ModStart> : if ( bad_format_axis ( optarg ) ) { <S2SV_ModEnd> return ; } <S2SV_ModStart> : if ( bad_format_axis ( optarg ) ) { <S2SV_ModEnd> return ; }
Buggy code:
 static void yydestruct ( const char * yymsg, int yytype, YYSTYPE * yyvaluep, void * yyscanner, RE_LEX_ENVIRONMENT * lex_env ) { YYUSE ( yyvaluep ) ; YYUSE ( yyscanner ) ; YYUSE ( lex_env ) ; if (! yymsg ) yymsg = "Deleting" ; YY_SYMBOL_PRINT ( yymsg, yytype, yyvaluep, yylocationp ) ; YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN switch ( yytype ) { case 6 : <START_BUG> # line 96 "re_grammar.y" <END_BUG> { yr_free ( ( ( * yyvaluep ). class_vector ) ) ; }  # line 1045 "re_grammar.c" <START_BUG> break ; case 26 : <END_BUG> # line 97 "re_grammar.y"  { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1051 "re_grammar.c" break ; case 27 : <START_BUG> # line 98 "re_grammar.y" <END_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1057 "re_grammar.c" break ; case 28 :  # line 99 "re_grammar.y" <START_BUG> { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1063 "re_grammar.c" break ; case 29 : <END_BUG> # line 100 "re_grammar.y"  { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1069 "re_grammar.c" break ; default : break ; } YY_IGNORE_MAYBE_UNINITIALIZED_END }

Fix:
<S2SV_ModStart> : # line 104 <S2SV_ModEnd> "re_grammar.y" { yr_free <S2SV_ModStart> } # line 1053 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 105 "re_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1059 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 106 "re_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1065 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 107 "re_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1071 <S2SV_ModEnd> "re_grammar.c" break ; <S2SV_ModStart> : # line 108 "re_grammar.y" { yr_re_node_destroy ( ( ( * yyvaluep ). re_node ) ) ; } # line 1077 <S2SV_ModEnd> "re_grammar.c" break ;
Buggy code:
 int ImagingPcdDecode ( Imaging im, ImagingCodecState state, UINT8 * buf, int bytes ) { int x ; int chunk ; UINT8 * out ; UINT8 * ptr ; ptr = buf ; chunk = 3 * state -> xsize ; for ( ; ; ) { if ( bytes < chunk ) return ptr - buf ; out = state -> buffer ; for ( x = 0 ; x < state -> xsize ; x ++ ) { out [ 0 ] = ptr [ x ] ; out [ 1 ] = ptr [ ( x + 4 * state -> xsize ) // 2 ] ; out [ 2 ] = ptr [ ( x + 5 * state -> xsize ) // 2 ] ; <START_BUG> out += 4 ; <END_BUG> } state -> shuffle ( ( UINT8 * ) im -> image [ state -> y ], state -> buffer, state -> xsize ) ; if ( ++ state -> y >= state -> ysize ) return - 1 ; out = state -> buffer ; for ( x = 0 ; x < state -> xsize ; x ++ ) { out [ 0 ] = ptr [ x + state -> xsize ] ; out [ 1 ] = ptr [ ( x + 4 * state -> xsize ) // 2 ] ; out [ 2 ] = ptr [ ( x + 5 * state -> xsize ) // 2 ] ;  out += 4 ; <START_BUG> } state -> shuffle ( ( UINT8 * ) im -> image [ state -> y ], state -> buffer, state -> xsize ) ; if ( ++ state -> y >= state -> ysize ) return - 1 ; ptr += chunk ; bytes -= chunk ; } }<END_BUG>

Fix:
<S2SV_ModStart> ; out += 3 <S2SV_ModEnd> ; } state <S2SV_ModStart> ; out += 3 <S2SV_ModEnd> ; } state
Buggy code:
 static Image * ReadSCREENSHOTImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = ( Image * ) NULL ; # if defined ( MAGICKCORE_WINGDI32_DELEGATE ) { BITMAPINFO bmi ; DISPLAY_DEVICE device ; HBITMAP bitmap, bitmapOld ; HDC bitmapDC, hDC ; Image * screen ; int i ; MagickBooleanType status ; register PixelPacket * q ; register ssize_t x ; RGBTRIPLE * p ; ssize_t y ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; i = 0 ; device. cb = sizeof ( device ) ; image = ( Image * ) NULL ; while ( EnumDisplayDevices ( NULL, i, & device, 0 ) && ++ i ) { if ( ( device. StateFlags & DISPLAY_DEVICE_ACTIVE )!= DISPLAY_DEVICE_ACTIVE ) continue ; hDC = CreateDC ( device. DeviceName, device. DeviceName, NULL, NULL ) ; if ( hDC == ( HDC ) NULL ) ThrowReaderException ( CoderError, "UnableToCreateDC" ) ; screen = AcquireImage ( image_info ) ; screen -> columns = ( size_t ) GetDeviceCaps ( hDC, HORZRES ) ; screen -> rows = ( size_t ) GetDeviceCaps ( hDC, VERTRES ) ; screen -> storage_class = DirectClass ; <START_BUG> status = SetImageExtent ( screen, screen -> columns, screen -> rows ) ; <END_BUG> if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }  if ( image == ( Image * ) NULL ) <START_BUG> image = screen ; else AppendImageToList ( & image, screen ) ; bitmapDC = CreateCompatibleDC ( hDC ) ; if ( bitmapDC == ( HDC ) NULL ) { DeleteDC ( hDC ) ; ThrowReaderException ( CoderError, "UnableToCreateDC" ) ; } (<END_BUG>

Fix:
<S2SV_ModStart> = DirectClass ; if ( image == ( Image * ) NULL ) image = screen ; else AppendImageToList ( & image, screen ) ; <S2SV_ModStart> ) ; } <S2SV_ModEnd> bitmapDC = CreateCompatibleDC
Buggy code:
 <START_BUG> void fadst16_8col ( __m128i * in ) { <END_BUG> __m128i s [ 16 ], x [ 16 ], u [ 32 ], v [ 32 ] ; const __m128i k__cospi_p01_p31 = pair_set_epi16 ( cospi_1_64, cospi_31_64 ) ; const __m128i k__cospi_p31_m01 = pair_set_epi16 ( cospi_31_64, - cospi_1_64 ) ; const __m128i k__cospi_p05_p27 = pair_set_epi16 ( cospi_5_64, cospi_27_64 ) ; const __m128i k__cospi_p27_m05 = pair_set_epi16 ( cospi_27_64, - cospi_5_64 ) ; const __m128i k__cospi_p09_p23 = pair_set_epi16 ( cospi_9_64, cospi_23_64 ) ; const __m128i k__cospi_p23_m09 = pair_set_epi16 ( cospi_23_64, - cospi_9_64 ) ; const __m128i k__cospi_p13_p19 = pair_set_epi16 ( cospi_13_64, cospi_19_64 ) ; const __m128i k__cospi_p19_m13 = pair_set_epi16 ( cospi_19_64, - cospi_13_64 ) ; const __m128i k__cospi_p17_p15 = pair_set_epi16 ( cospi_17_64, cospi_15_64 ) ; const __m128i k__cospi_p15_m17 = pair_set_epi16 ( cospi_15_64, - cospi_17_64 ) ; const __m128i k__cospi_p21_p11 = pair_set_epi16 ( cospi_21_64, cospi_11_64 ) ; const __m128i k__cospi_p11_m21 = pair_set_epi16 ( cospi_11_64, - cospi_21_64 ) ; const

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t ) <S2SV_ModStart> = _mm_set1_epi16 ( ( int16_t )
Buggy code:
 void vp8_copy_mem8x4_c ( unsigned char * src, int src_stride, unsigned char * dst, int dst_stride ) { int r ; for ( r = 0 ; r < 4 ; r ++ ) { <START_BUG> # if! ( CONFIG_FAST_UNALIGNED ) <END_BUG> dst [ 0 ] = src [ 0 ] ; dst [ 1 ] = src [ 1 ] ; dst [ 2 ] = src [ 2 ] ; dst [ 3 ] = src [ 3 ] ; dst [ 4 ] = src [ 4 ] ; dst [ 5 ] = src [ 5 ] ; dst [ 6 ] = src [ 6 ] ; dst [ 7 ] = src [ 7 ] ; # else ( ( uint32_t * ) dst ) [ 0 ] = ( ( uint32_t * ) src ) [ 0 ] ; ( ( uint32_t * ) dst ) [ 1 ] = ( ( uint32_t * ) src ) [ 1 ] ; # endif src += src_stride ; dst += dst_stride ; } }

Fix:
<S2SV_ModStart> ++ ) { memcpy ( dst, src, 8 ) ; <S2SV_ModEnd> src += src_stride
Buggy code:
 int sock_send_all ( int sock_fd, const uint8_t * buf, int len ) { int s = len ; int ret ; while ( s ) { <START_BUG> do ret = send ( sock_fd, buf, s, 0 ) ; <END_BUG> while ( ret < 0 && errno == EINTR ) ; if ( ret <= 0 ) { BTIF_TRACE_ERROR ( "sock   fd:%d   send   errno:%d,   ret:%d", sock_fd, errno, ret ) ; return - 1 ; } buf += ret ; s -= ret ; } return len ; }

Fix:
<S2SV_ModStart> do ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> s, 0 )
Buggy code:
 static expr_ty ast_for_atom ( struct compiling * c, const node * n ) { node * ch = CHILD ( n, 0 ) ; switch ( TYPE ( ch ) ) { case NAME : { PyObject * name = NEW_IDENTIFIER ( ch ) ; if (! name ) return NULL ; return Name ( name, Load, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } case STRING : { PyObject * kind, * str = parsestrplus ( c, n ) ; <START_BUG> const char * raw, * s = STR ( CHILD ( n, 0 ) ) ; <END_BUG> int quote = Py_CHARMASK ( * s ) ; char * ch, s_kind [ 3 ] = { 0, 0, 0 } ; ch = s_kind ; raw = s ; while ( * raw && * raw!= '\\'' && * raw!= \'"\' ) { * ch ++ = * raw ++ ; } kind = PyUnicode_FromString ( s_kind ) ; if (! kind ) { return NULL ; } if (! str ) { # ifdef Py_USING_UNICODE if ( PyErr_ExceptionMatches ( PyExc_UnicodeError ) ) { PyObject * type, * value, * tback, * errstr ; PyErr_Fetch ( & type, & value, & tback ) ; errstr = PyObject_Str ( value ) ; if ( errstr ) {  char * s = "" ; <START_BUG> char buf [ 128 ] ; s = _PyUnicode_AsString ( errstr ) ; PyOS_snprintf ( buf, sizeof ( buf ), "(unicode   error)   %s", s ) ; ast_error ( n, buf ) ; Py_DECREF ( errstr ) ; } else { ast_error ( n, "(unicode   error)   unknown   error" ) ; } Py_DECREF ( type ) ; Py_DECREF ( value ) ; Py_XDECREF ( tback ) ; } # endif return NULL ; } PyArena_AddPyObject ( c -> c_arena, str ) ; return Str ( str, kind, LINENO ( n ), n -> n_col_offset, c -> c_arena ) ; } case NUMBER : { PyObject * pynum = parsenumber ( c, STR ( ch )<END_BUG>

Fix:
<S2SV_ModStart>, 0 ) <S2SV_ModEnd> ) ; char <S2SV_ModStart> errstr ) { const
Buggy code:
 static void btu_exec_tap_fd_read ( void * p_param ) { struct pollfd ufd ; int fd = ( int ) p_param ; if ( fd == INVALID_FD || fd!= btpan_cb. tap_fd ) return ; for ( int i = 0 ; i < PAN_POOL_MAX && btif_is_enabled ( ) && btpan_cb. flow ; i ++ ) { BT_HDR * buffer = ( BT_HDR * ) GKI_getpoolbuf ( PAN_POOL_ID ) ; if (! buffer ) { BTIF_TRACE_WARNING ( "%s   unable   to   allocate   buffer   for   packet.", __func__ ) ; break ; } buffer -> offset = PAN_MINIMUM_OFFSET ; buffer -> len = GKI_get_buf_size ( buffer ) - sizeof ( BT_HDR ) - buffer -> offset ; UINT8 * packet = ( UINT8 * ) buffer + sizeof ( BT_HDR ) + buffer -> offset ; if (! btpan_cb. congest_packet_size ) { <START_BUG> ssize_t ret = read ( fd, btpan_cb. congest_packet, sizeof ( btpan_cb. congest_packet ) ) ; <END_BUG> switch ( ret ) { case - 1 : BTIF_TRACE_ERROR ( "%s   unable   to   read   from   driver:   %s", __func__, strerror ( errno ) ) ; GKI_freebuf ( buffer ) ; btsock_thread_add_fd ( pan_pth, fd, 0, SOCK_THREAD_FD_RD, 0 ) ; return ; case 0 : BTIF_TRACE_WARNING ( "%s   end   of   file   reached.", __func__ ) ; GKI_freebuf ( buffer ) ; btsock_thread_add_fd ( pan_pth, fd, 0, SOCK_THREAD_FD_RD, 0 ) ; return ; default : btpan_cb. congest_packet_size = ret ; break ; } } memcpy ( packet, btpan_cb. congest_packet, MIN ( btpan_cb. congest_packet_size, buffer -> len ) ) ; buffer -> len =

Fix:
<S2SV_ModStart> ssize_t ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> btpan_cb. congest_packet ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> 1, 0 )
Buggy code:
 static void dissect_ppi ( tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree ) { proto_tree * ppi_tree = NULL, * ppi_flags_tree = NULL, * seg_tree = NULL, * ampdu_tree = NULL ; proto_tree * agg_tree = NULL ; proto_item * ti = NULL ; tvbuff_t * next_tvb ; int offset = 0 ; guint version, flags ; gint tot_len, data_len ; guint data_type ; guint32 dlt ; guint32 n_ext_flags = 0 ; guint32 ampdu_id = 0 ; fragment_head * fd_head = NULL ; fragment_item * ft_fdh = NULL ; gint mpdu_count = 0 ; gchar * mpdu_str ; gboolean first_mpdu = TRUE ; guint last_frame = 0 ; gint len_remain, ampdu_len = 0 ; <START_BUG> struct ieee_802_11_phdr phdr ; <END_BUG> col_set_str ( pinfo -> cinfo, COL_PROTOCOL, "PPI" ) ; col_clear ( pinfo -> cinfo, COL_INFO ) ; version = tvb_get_guint8 ( tvb, offset ) ; flags = tvb_get_guint8 ( tvb, offset + 1 ) ; tot_len = tvb_get_letohs ( tvb, offset + 2 ) ; dlt = tvb_get_letohl ( tvb, offset + 4 ) ; col_add_fstr ( pinfo -> cinfo, COL_INFO, "PPI   version   %u,   %u   bytes", version, tot_len ) ; if ( tree ) { ti = proto_tree_add_protocol_format ( tree, proto_ppi, tvb, 0, tot_len, "PPI   version   %u,   %u   bytes", version, tot_len ) ; ppi_tree = proto_item_add_subtree ( ti, ett_ppi_pph ) ; proto_tree_add_item ( ppi_tree, hf_ppi_head_version, tvb, offset, 1, ENC_LITTLE_ENDIAN

Fix:
<S2SV_ModStart> struct ieee_802_11_phdr phdr ; int wtap_encap ; struct eth_phdr eth ; void * phdrp <S2SV_ModStart> } else { wtap_encap = wtap_pcap_encap_to_wtap_encap ( dlt ) ; switch ( wtap_encap ) { case WTAP_ENCAP_ETHERNET : eth. fcs_len = - 1 ; phdrp = & eth ; break ; default : phdrp = NULL ; break ; } dissector_try_uint_new <S2SV_ModEnd> ( wtap_encap_dissector_table, <S2SV_ModStart> ( wtap_encap_dissector_table, wtap_encap <S2SV_ModEnd>, next_tvb, <S2SV_ModStart> pinfo, tree, TRUE, phdrp
Buggy code:
 <START_BUG> static void nfs_set_open_stateid ( struct nfs4_state * state, nfs4_stateid * stateid, int open_flags ) <END_BUG> { write_seqlock ( & state -> seqlock ) ;  nfs_set_open_stateid_locked ( state, stateid, open_flags ) ; <START_BUG> write_sequnlock ( & state -> seqlock ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * stateid, fmode_t fmode <S2SV_ModEnd> ) { write_seqlock <S2SV_ModStart>, stateid, fmode <S2SV_ModEnd> ) ; write_sequnlock
Buggy code:
 static bool parse_notify ( struct pool * pool, json_t * val ) { char * job_id, * prev_hash, * coinbase1, * coinbase2, * bbversion, * nbit, * ntime, header [ 228 ] ; unsigned char * cb1 = NULL, * cb2 = NULL ; size_t cb1_len, cb2_len, alloc_len ; bool clean, ret = false ; int merkles, i ; json_t * arr ; arr = json_array_get ( val, 4 ) ; if (! arr ||! json_is_array ( arr ) ) goto out ; merkles = json_array_size ( arr ) ; job_id = json_array_string ( val, 0 ) ; prev_hash = __json_array_string ( val, 1 ) ; coinbase1 = json_array_string ( val, 2 ) ; coinbase2 = json_array_string ( val, 3 ) ; bbversion = __json_array_string ( val, 5 ) ; nbit = __json_array_string ( val, 6 ) ; ntime = __json_array_string ( val, 7 ) ; clean = json_is_true ( json_array_get ( val, 8 ) ) ; <START_BUG> if (! job_id ||! prev_hash ||! coinbase1 ||! coinbase2 ||! bbversion ||! nbit ||! ntime ) { <END_BUG>  if ( job_id ) <START_BUG> free ( job_id ) ; if ( coinbase1 ) free ( coinbase1 ) ; if ( coinbase2 ) free ( coinbase2 ) ; goto out ; } cg_wlock ( & pool -> data_lock ) ; free ( pool -> swork. job_id ) ; pool -> swork. job_id = job_id ; snprintf ( pool -> prev_hash, 65, "%s", prev_hash ) ; cb1_len = strlen ( coinbase1 ) // 2 ; cb2_len = strlen ( coinbase2 ) // 2 ; snprintf ( pool -> bbversion, 9, "%s", bbversion ) ; snprintf ( pool -> nbit, 9, "%s", nbit ) ; snprintf ( pool -> ntime, 9, "%s", ntime ) ; pool -> swork. clean = clean ; alloc_len = pool -> coinbase_len<END_BUG>

Fix:
<S2SV_ModStart> if (! valid_hex ( job_id ) ||! valid_hex ( prev_hash ) ||! valid_hex ( coinbase1 ) ||! valid_hex ( coinbase2 ) ||! valid_hex ( bbversion ) ||! valid_hex ( nbit ) ||! valid_hex ( ntime ) ) { free <S2SV_ModEnd> ( job_id ) <S2SV_ModStart> ( job_id ) ; free ( coinbase1 ) ; <S2SV_ModEnd> free ( coinbase2
Buggy code:
 MONGO_EXPORT int mongo_insert_batch ( mongo * conn, const char * ns, const bson * * bsons, int count, mongo_write_concern * custom_write_concern, int flags ) { mongo_message * mm ; mongo_write_concern * write_concern = NULL ; int i ; char * data ; <START_BUG> int overhead = 16 + 4 + strlen ( ns ) + 1 ; <END_BUG>  int size = overhead ; <START_BUG> if ( mongo_validate_ns ( conn, ns )!= MONGO_OK ) return MONGO_ERROR ; for ( i = 0 ; i < count ; i ++ ) { size += bson_size ( bsons [ i ] ) ; if ( mongo_bson_valid ( conn, bsons [ i ], 1 )!= MONGO_OK ) return MONGO_ERROR ; } if ( ( size - overhead ) > conn -> max_bson_size ) { conn -> err = MONGO_BSON_TOO_LARGE ; return MONGO_ERROR ; } if ( mongo_choose_write_concern ( conn, custom_write_concern, & write_concern ) == MONGO_ERROR ) { return MONGO_ERROR ; } mm = mongo_message_create ( size, 0, 0, MONGO_OP_INSERT ) ; data = & mm -> data ; if ( flags & MONGO_CONTINUE_ON_ERROR ) data = mongo_data_append32 ( data, & ONE ) ; else data = mongo_data_append32 ( data, & ZERO ) ; data = mongo_data_append ( data, ns, strlen ( ns ) + 1 ) ; for ( i = 0 ; i < count ; i ++ ) { data = mongo_data_append ( data, bsons [ i ] -> data, bson_size ( bsons [ i ] ) ) ; } if ( write_concern ) { if ( mongo_message_send ( conn, mm ) == MONGO_ERROR ) { return MONGO_ERROR ; } return mongo_check_last_error ( conn, ns, write_concern ) ; } else { return mongo_message_send ( conn, mm ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> * data ; size_t <S2SV_ModEnd> overhead = 16 <S2SV_ModStart> + 1 ; size_t <S2SV_ModEnd> size = overhead
Buggy code:
 static int fanout_add ( struct sock * sk, u16 id, u16 type_flags ) { struct packet_rollover * rollover = NULL ; struct packet_sock * po = pkt_sk ( sk ) ; struct packet_fanout * f, * match ; u8 type = type_flags & 0xff ; u8 flags = type_flags >> 8 ; int err ; switch ( type ) { case PACKET_FANOUT_ROLLOVER : if ( type_flags & PACKET_FANOUT_FLAG_ROLLOVER ) return - EINVAL ; case PACKET_FANOUT_HASH : case PACKET_FANOUT_LB : case PACKET_FANOUT_CPU : case PACKET_FANOUT_RND : case PACKET_FANOUT_QM : case PACKET_FANOUT_CBPF : case PACKET_FANOUT_EBPF : break ; default : return - EINVAL ; } mutex_lock ( & fanout_mutex ) ; <START_BUG> err = - EINVAL ; <END_BUG> if (! po -> running ) goto out ; err = - EALREADY ; if ( po -> fanout ) goto out ; if ( type == PACKET_FANOUT_ROLLOVER || ( type_flags & PACKET_FANOUT_FLAG_ROLLOVER ) ) { err = - ENOMEM ; rollover = kzalloc ( sizeof ( * rollover ), GFP_KERNEL ) ; if (! rollover ) goto out ; atomic_long_set ( & rollover -> num, 0 ) ; atomic_long_set ( & rollover -> num_huge, 0 ) ; atomic_long_set ( & rollover -> num_failed, 0 ) ; po -> rollover = rollover ; } if ( type_flags & PACKET_FANOUT_FLAG_UNIQUEID ) { if ( id!= 0 ) { err = - EINVAL ; goto out ; } if (! fanout_find_new_id ( sk, & id ) ) { err = - ENOMEM ; goto out ; } flags &= ~ ( PACKET_FANOUT_FLAG_UNIQUEID >> 8 ) ; } match = NULL ; list_for_each_entry ( f, & fanout_list, list ) { if ( f -> id == id

Fix:
<S2SV_ModStart> err = - <S2SV_ModEnd> EALREADY ; if <S2SV_ModStart> - EINVAL ; spin_lock ( & po -> bind_lock ) ; if ( po -> running && <S2SV_ModEnd> match -> type <S2SV_ModStart> ; } } spin_unlock ( & po -> bind_lock ) ; if ( err &&! refcount_read ( & match -> sk_ref ) ) { list_del ( & match -> list ) ; kfree ( match ) ; }
Buggy code:
 krb5_error_code pkinit_check_kdc_pkid ( krb5_context context, pkinit_plg_crypto_context plg_cryptoctx, pkinit_req_crypto_context req_cryptoctx, pkinit_identity_crypto_context id_cryptoctx, unsigned char * pdid_buf, unsigned int pkid_len, int * valid_kdcPkId ) { krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED ; PKCS7_ISSUER_AND_SERIAL * is = NULL ; const unsigned char * p = pdid_buf ; int status = 1 ; X509 * kdc_cert = sk_X509_value ( id_cryptoctx -> my_certs, id_cryptoctx -> cert_index ) ; * valid_kdcPkId = 0 ; pkiDebug ( "found   kdcPkId   in   AS   REQ\\n" ) ; is = d2i_PKCS7_ISSUER_AND_SERIAL ( NULL, & p, ( int ) pkid_len ) ; if ( is == NULL ) <START_BUG> goto cleanup ; <END_BUG> status = X509_NAME_cmp ( X509_get_issuer_name ( kdc_cert ), is -> issuer ) ; if (! status ) { status = ASN1_INTEGER_cmp ( X509_get_serialNumber ( kdc_cert ), is -> serial ) ; if (! status ) * valid_kdcPkId = 1 ; } retval = 0 ;  cleanup : <START_BUG> X509_NAME_free ( is -> issuer ) ; ASN1_INTEGER_free ( is -> serial ) ; free ( is ) ; return retval ; }<END_BUG>

Fix:
<S2SV_ModStart> == NULL ) return retval <S2SV_ModEnd> ; status = <S2SV_ModStart> = 0 ; <S2SV_ModEnd> X509_NAME_free ( is
Buggy code:
 WORD32 ih264d_mark_err_slice_skip ( dec_struct_t * ps_dec, WORD32 num_mb_skip, UWORD8 u1_is_idr_slice, UWORD16 u2_frame_num, pocstruct_t * ps_cur_poc, WORD32 prev_slice_err ) { WORD32 i2_cur_mb_addr ; UWORD32 u1_num_mbs, u1_num_mbsNby2 ; UWORD32 u1_mb_idx = ps_dec -> u1_mb_idx ; UWORD32 i2_mb_skip_run ; UWORD32 u1_num_mbs_next, u1_end_of_row ; const UWORD32 i2_pic_wdin_mbs = ps_dec -> u2_frm_wd_in_mbs ; UWORD32 u1_slice_end ; UWORD32 u1_tfr_n_mb ; UWORD32 u1_decode_nmb ; dec_bit_stream_t * const ps_bitstrm = ps_dec -> ps_bitstrm ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; deblk_mb_t * ps_cur_deblk_mb ; dec_mb_info_t * ps_cur_mb_info ; parse_pmbarams_t * ps_parse_mb_data ; UWORD32 u1_inter_mb_type ; UWORD32 u1_deblk_mb_type ; UWORD16 u2_total_mbs_coded ; UWORD32 u1_mbaff = ps_slice -> u1_mbaff_frame_flag ; parse_part_params_t * ps_part_info ; WORD32 ret ; if ( ps_dec -> ps_dec_err_status -> u1_err_flag & REJECT_CUR_PIC ) { ih264d_err_pic_dispbuf_mgr ( ps_dec )

Fix:
<S2SV_ModStart> -> ps_cur_slice -> <S2SV_ModEnd> u1_slice_type = P_SLICE
Buggy code:
 <START_BUG> void nego_process_negotiation_response ( rdpNego * nego, wStream * s ) <END_BUG> { UINT16 length ; WLog_DBG ( TAG, "RDP_NEG_RSP" ) ; if ( Stream_GetRemainingLength ( s ) < 7 ) { WLog_ERR ( TAG, "Invalid   RDP_NEG_RSP" ) ; nego -> state = NEGO_STATE_FAIL ;  return ; <START_BUG> } Stream_Read_UINT8 ( s, nego -> flags ) ; Stream_Read_UINT16 ( s, length ) ; Stream_Read_UINT32 ( s, nego -> SelectedProtocol ) ; nego -> state = NEGO_STATE_FINAL ; <END_BUG> } 

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> BOOL <S2SV_ModEnd> nego_process_negotiation_response ( rdpNego <S2SV_ModStart> NEGO_STATE_FAIL ; return FALSE <S2SV_ModStart> = NEGO_STATE_FINAL ; return TRUE ;
Buggy code:
 int uinput_create ( char * name ) { struct uinput_dev dev ; int fd, x = 0 ; for ( x = 0 ; x < MAX_UINPUT_PATHS ; x ++ ) { <START_BUG> fd = open ( uinput_dev_path [ x ], O_RDWR ) ; <END_BUG> if ( fd < 0 ) continue ; break ; } if ( x == MAX_UINPUT_PATHS ) { BTIF_TRACE_ERROR ( "%s   ERROR:   uinput   device   open   failed", __FUNCTION__ ) ; return - 1 ; } memset ( & dev, 0, sizeof ( dev ) ) ; if ( name ) strncpy ( dev. name, name, UINPUT_MAX_NAME_SIZE - 1 ) ; dev. id. bustype = BUS_BLUETOOTH ; dev. id. vendor = 0x0000 ; dev. id. product = 0x0000 ; dev. id. version = 0x0000 ;  if ( write ( fd, & dev, sizeof ( dev ) ) < 0 ) { <START_BUG> BTIF_TRACE_ERROR ( "%s   Unable   to   write   device   information", __FUNCTION__ ) ; close ( fd ) ; return - 1 ; } <END_BUG> ioctl ( fd, UI_SET_EVBIT, EV_KEY ) ;  <START_BUG> ioctl ( fd, UI_SET_EVBIT, EV_REL ) ; <END_BUG>  ioctl ( fd, UI_SET_EVBIT, EV_SYN ) ; <START_BUG> for ( x = 0 ; key_map [ x ]. name!= NULL ; x ++ ) <END_BUG> ioctl ( fd, UI_SET_KEYBIT, key_map [ x ]. mapped_id ) ;  <START_BUG> if ( ioctl ( fd, UI_DEV_CREATE, NULL ) < 0 ) { <END_BUG> BTIF_TRACE_ERROR ( "%s   Unable   to   create   uinput   device", __FUNCTION__ ) ; close ( fd ) ; return - 1 ; } return fd ; }

Fix:
<S2SV_ModStart> { fd = TEMP_FAILURE_RETRY ( <S2SV_ModStart> ], O_RDWR ) <S2SV_ModStart> ; if ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> sizeof ( dev ) <S2SV_ModStart> 1 ; } TEMP_FAILURE_RETRY ( <S2SV_ModStart>, EV_KEY ) ) ; TEMP_FAILURE_RETRY ( <S2SV_ModEnd> ioctl ( fd <S2SV_ModStart>, EV_REL ) ) ; TEMP_FAILURE_RETRY ( <S2SV_ModEnd> ioctl ( fd <S2SV_ModStart> UI_SET_EVBIT, EV_SYN ) <S2SV_ModStart> x ++ ) TEMP_FAILURE_RETRY ( <S2SV_ModStart>. mapped_id ) ) ; if ( TEMP_FAILURE_RETRY <S2SV_ModEnd> ( ioctl ( <S2SV_ModStart> UI_DEV_CREATE, NULL )
Buggy code:
 <START_BUG> void show_progress ( int frame_in, int frame_out, uint64_t dx_time ) { <END_BUG> fprintf ( stderr, "%d   decoded   frames//%d   showed   frames   in   %" PRId64 "   us   (%.2f   fps)\\r", frame_in, frame_out, dx_time, ( double ) frame_out * 1000000.0 // ( double ) dx_time ) ; }

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> static
Buggy code:
 static int _hostresolver_getaddrinfo ( oe_resolver_t * resolver, const char * node, const char * service, const struct oe_addrinfo * hints, struct oe_addrinfo * * res ) { int ret = OE_EAI_FAIL ; uint64_t handle = 0 ; struct oe_addrinfo * head = NULL ; struct oe_addrinfo * tail = NULL ; struct oe_addrinfo * p = NULL ; OE_UNUSED ( resolver ) ; if ( res ) * res = NULL ; if (! res ) { ret = OE_EAI_SYSTEM ; OE_RAISE_ERRNO ( OE_EINVAL ) ; } { int retval = OE_EAI_FAIL ; if ( oe_syscall_getaddrinfo_open_ocall ( & retval, node, service, hints, & handle )!= OE_OK ) { ret = OE_EAI_SYSTEM ; OE_RAISE_ERRNO ( OE_EINVAL ) ; } if (! handle ) { ret = retval ; goto done ; } } for ( ; ; ) { int retval = 0 ; <START_BUG> size_t canonnamelen = 0 ; <END_BUG>  if (! ( p = oe_calloc ( 1, sizeof ( struct oe_addrinfo ) ) ) ) <START_BUG> { ret = OE_EAI_MEMORY ; goto done ; } if ( oe_syscall_getaddrinfo_read_ocall ( & retval, handle, <END_BUG> & p -> ai_flags,  <START_BUG> & p -> ai_family, <END_BUG>  & p -> ai_socktype, <START_BUG> <END_BUG> & p -> ai_protocol,  p -> ai_addrlen, <START_BUG> & p -> ai_addrlen, <END_BUG> NULL,  canonnamelen, <START_BUG> & canonnamelen, NULL )!= OE_OK ) { ret = OE_EAI_SYSTEM ; OE_RAISE_ERRNO ( OE_EINVAL ) ; } if ( retval == 1 ) break ; if ( retval!= - 1 || oe_errno!= OE_ENAMETOOLONG ) { ret = OE_EAI_SYSTEM ; OE_RAISE_ERRNO ( oe_errno ) ; } <END_BUG> if ( p ->

Fix:
<S2SV_ModStart> 0 ; size_t canonnamelen_in <S2SV_ModEnd> = 0 ; <S2SV_ModStart> = 0 ; size_t canonnamelen_out = 0 ; struct oe_addrinfo p_out ; memset ( & p_out, 0, sizeof ( struct oe_addrinfo ) ) ; <S2SV_ModEnd> if ( oe_syscall_getaddrinfo_read_ocall <S2SV_ModStart> handle, & p_out. <S2SV_ModEnd> ai_flags, & <S2SV_ModStart> ai_flags, & p_out. <S2SV_ModEnd> ai_family, & <S2SV_ModStart> ai_family, & p_out. <S2SV_ModEnd> ai_socktype, & <S2SV_ModStart> ai_socktype, & p_out. ai_protocol, p_out. <S2SV_ModEnd> ai_addrlen, & <S2SV_ModStart> ai_addrlen, & p_out. <S2SV_ModEnd> ai_addrlen, NULL <S2SV_ModStart>, NULL, canonnamelen_in, & canonnamelen_out <S2SV_ModEnd>, NULL ) <S2SV_ModStart> ) ; } switch ( p_out. ai_family ) { case OE_AF_INET : if ( p_out. ai_addrlen!= sizeof ( struct oe_sockaddr ) ) { ret = OE_EAI_FAIL ; goto done
Buggy code:
 int secure_decrypt ( void * data, unsigned int data_length, int is_signed ) { at91_aes_key_size_t key_size ; unsigned int cmac_key [ 8 ], cipher_key [ 8 ] ; unsigned int iv [ AT91_AES_IV_SIZE_WORD ] ; unsigned int computed_cmac [ AT91_AES_BLOCK_SIZE_WORD ] ; unsigned int fixed_length ; const unsigned int * cmac ; int rc = - 1 ; init_keys ( & key_size, cipher_key, cmac_key, iv ) ; at91_aes_init ( ) ; if ( is_signed ) { if ( at91_aes_cmac ( data_length, data, computed_cmac, key_size, cmac_key ) ) goto exit ; fixed_length = at91_aes_roundup ( data_length ) ; cmac = ( const unsigned int * ) ( ( char * ) data + fixed_length ) ; <START_BUG> if ( memcmp ( cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE ) ) <END_BUG> goto exit ; } if ( at91_aes_cbc ( data_length, data, data, 0, key_size, cipher_key, iv ) ) goto exit ; rc = 0 ; exit : at91_aes_cleanup ( ) ; memset ( cmac_key, 0, sizeof ( cmac_key ) ) ; memset ( cipher_key, 0, sizeof ( cipher_key ) ) ; memset ( iv, 0, sizeof ( iv ) ) ; return rc ; }

Fix:
<S2SV_ModStart> ; if (! consttime_memequal <S2SV_ModEnd> ( cmac,
Buggy code:
 static gboolean export_desktop_file ( const char * app, const char * branch, const char * arch, GKeyFile * metadata, const char * const * previous_ids, int parent_fd, const char * name, struct stat * stat_buf, char * * target, GCancellable * cancellable, GError * * error ) { gboolean ret = FALSE ; glnx_autofd int desktop_fd = - 1 ; g_autofree char * tmpfile_name = g_strdup_printf ( "export-desktop-XXXXXX" ) ; g_autoptr ( GOutputStream ) out_stream = NULL ; g_autofree gchar * data = NULL ; gsize data_len ; g_autofree gchar * new_data = NULL ; gsize new_data_len ; g_autoptr ( GKeyFile ) keyfile = NULL ; g_autofree gchar * old_exec = NULL ; gint old_argc ; g_auto ( GStrv ) old_argv = NULL ; g_auto ( GStrv ) groups = NULL ; GString * new_exec = NULL ; g_autofree char * escaped_app = maybe_quote ( app ) ; g_autofree char * escaped_branch = maybe_quote ( branch ) ; g_autofree char * escaped_arch = maybe_quote ( arch ) ; int i ; if (! flatpak_openat_noatime ( parent_fd, name, & desktop_fd, cancellable, error ) ) goto out ; if (! read_fd ( desktop_fd, stat_buf, & data, & data_len, error ) ) goto out ; keyfile = g_key_file_new ( ) ; if (! g_key_file_load_from_data ( keyfile, data, data_len, G_KEY_FILE_KEEP_TRANSLATIONS, error ) ) goto out ; if ( g_str_has_suffix ( name, ".service" ) ) { g_autofree gchar * dbus_name = NULL ; g_autofree gchar * expected_dbus_name = g_strndup ( name, strlen ( name ) - strlen ( ".service" ) ) ; dbus_name = g_key_file_get_string ( keyfile

Fix:
<S2SV_ModStart> ) ; else if ( strcmp ( arg, "@@" ) == 0 || strcmp ( arg, "@@u" ) == 0 ) g_print ( _ ( "Skipping <S2SV_blank> invalid <S2SV_blank> Exec <S2SV_blank> argument <S2SV_blank> %s\\n" ), arg ) ; else
Buggy code:
 void vp8_mbpost_proc_across_ip_c ( unsigned char * src, int pitch, int rows, int cols, int flimit ) { int r, c, i ; unsigned char * s = src ; unsigned char d [ 16 ] ; for ( r = 0 ; r < rows ; r ++ ) { int sumsq = 0 ; int sum = 0 ; for ( i = - 8 ; i < 0 ; i ++ ) s [ i ] = s [ 0 ] ; <START_BUG> for ( i = cols ; i < cols + 17 ; i ++ ) <END_BUG> s [ i ] = s [ cols - 1 ] ; for ( i = - 8 ; i <= 6 ; i ++ ) { sumsq += s [ i ] * s [ i ] ; sum += s [ i ] ; d [ i + 8 ] = 0 ; } for ( c = 0 ; c < cols + 8 ; c ++ ) { int x = s [ c + 7 ] - s [ c - 8 ] ; int y = s [ c + 7 ] + s [ c - 8 ] ; sum += x ; sumsq += x * y ; d [ c & 15 ] = s [ c ] ; if ( sumsq * 15 - sum * sum < flimit ) { d [ c & 15 ] = ( 8 + sum + s [ c ] ) >> 4 ; } s [ c - 8 ] = d [ ( c - 8 ) & 15 ] ; } s += pitch ; } }

Fix:
<S2SV_ModStart> ( i = 0 ; i < 17 ; i ++ ) s [ i + cols <S2SV_ModEnd> ] = s
Buggy code:
 static int DecodeGifImg ( struct ngiflib_img * i ) { struct ngiflib_decode_context context ; long npix ; u8 * stackp ; u8 * stack_top ; u16 clr ; u16 eof ; u16 free ; u16 act_code = 0 ; u16 old_code = 0 ; u16 read_byt ; u16 ab_prfx [ 4096 ] ; u8 ab_suffx [ 4096 ] ; u8 ab_stack [ 4096 ] ; u8 flags ; u8 casspecial = 0 ; if (! i ) return - 1 ; i -> posX = GetWord ( i -> parent ) ; i -> posY = GetWord ( i -> parent ) ; i -> width = GetWord ( i -> parent ) ; i -> height = GetWord ( i -> parent ) ; <START_BUG> context. Xtogo = i -> width ; <END_BUG> context. curY = i -> posY ; # ifdef NGIFLIB_INDEXED_ONLY # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width ; context. frbuff_p. p8 = context. line_p. p8 + i -> posX ; # else context. frbuff_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width + i -> posX ; # endif # else if ( i -> parent -> mode & NGIFLIB_MODE_INDEXED ) { # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width ; context. frbuff_p. p8 = context. line_p. p8 + i -> posX ; # else context. frbuff_p. p8 = i -> parent -> frbuff. p8 + ( u32 ) i -> posY * i -> parent -> width + i -> posX ; # endif } else { # ifdef NGIFLIB_ENABLE_CALLBACKS context. line_p. p32 = i -> parent -> frbuff. p32 + ( u32 ) i ->

Fix:
<S2SV_ModStart> parent ) ; if ( ( i -> width > i -> parent -> width ) || ( i -> height > i -> parent -> height ) ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "*** <S2SV_blank> ERROR <S2SV_blank> *** <S2SV_blank> Image <S2SV_blank> bigger <S2SV_blank> than <S2SV_blank> global <S2SV_blank> GIF <S2SV_blank> canvas <S2SV_blank>!\\n" ) ; # endif return - 1 ; } if ( ( i -> posX + i -> width ) > i -> parent -> width ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "*** <S2SV_blank> WARNING <S2SV_blank> *** <S2SV_blank> Adjusting <S2SV_blank> X <S2SV_blank> position\\n" ) ; # endif i -> posX = i -> parent -> width - i -> width ; } if ( ( i -> posY + i -> height ) > i -> parent -> height ) { # if! defined ( NGIFLIB_NO_FILE ) if ( i -> parent -> log ) fprintf ( i -> parent -> log, "*** <S2SV_blank> WARNING <S2SV_blank> *** <S2SV_blank> Adjusting <S2SV_blank> Y <S2SV_blank> position\\n" ) ; # endif
Buggy code:
 vpx_codec_err_t vpx_codec_enc_init_multi_ver ( vpx_codec_ctx_t * ctx, vpx_codec_iface_t * iface, vpx_codec_enc_cfg_t * cfg, int num_enc, vpx_codec_flags_t flags, vpx_rational_t * dsf, int ver ) { vpx_codec_err_t res = VPX_CODEC_OK ; if ( ver!= VPX_ENCODER_ABI_VERSION ) res = VPX_CODEC_ABI_MISMATCH ; else if (! ctx ||! iface ||! cfg || ( num_enc > 16 || num_enc < 1 ) ) res = VPX_CODEC_INVALID_PARAM ; else if ( iface -> abi_version!= VPX_CODEC_INTERNAL_ABI_VERSION ) res = VPX_CODEC_ABI_MISMATCH ; else if (! ( iface -> caps & VPX_CODEC_CAP_ENCODER ) ) res = VPX_CODEC_INCAPABLE ; <START_BUG> else if ( ( flags & VPX_CODEC_USE_XMA ) &&! ( iface -> caps & VPX_CODEC_CAP_XMA ) ) <END_BUG> res = VPX_CODEC_INCAPABLE ; else if ( ( flags & VPX_CODEC_USE_PSNR ) &&! ( iface -> caps & VPX_CODEC_CAP_PSNR ) ) res = VPX_CODEC_INCAPABLE ; else if ( ( flags & VPX_CODEC_USE_OUTPUT_PARTITION ) &&! ( iface -> caps & VPX_CODEC_CAP_OUTPUT_PARTITION ) ) res = VPX_CODEC_INCAPABLE ; else { int i ; void * mem_loc = NULL ; if (! ( res = iface -> enc. mr_get_mem_loc ( cfg, & mem_loc ) ) ) { for ( i = 0 ; i < num_enc ; i ++ ) { vpx_codec_priv_enc_mr_cfg_t mr_cfg ; if ( dsf -> num < 1 || dsf -> num > 4096 || dsf -> den

Fix:
<S2SV_ModStart> ( flags & <S2SV_ModEnd> VPX_CODEC_USE_PSNR ) && <S2SV_ModStart> } if ( <S2SV_ModEnd> res ) break
Buggy code:
 static int wb_prep ( netdissect_options * ndo, const struct pkt_prep * prep, u_int len ) { int n ; const struct pgstate * ps ; const u_char * ep = ndo -> ndo_snapend ; ND_PRINT ( ( ndo, "   wb-prep:" ) ) ; <START_BUG> if ( len < sizeof ( * prep ) ) { <END_BUG> return ( - 1 ) ;  } <START_BUG> n = EXTRACT_32BITS ( & prep -> pp_n ) ; ps = ( const struct pgstate * ) ( prep + 1 ) ; while ( -- n >= 0 && ND_TTEST ( * ps ) ) { const struct id_off * io, * ie ; char c = '<' ; ND_PRINT ( ( ndo, "   %u//%s:%u", EXTRACT_32BITS ( & ps -> slot ), ipaddr_string ( ndo, & ps -> page. p_sid ), EXTRACT_32BITS ( & ps -> page. p_uid ) ) ) ; io = ( const struct id_off * ) ( ps + 1 ) ; for ( ie = io + ps -> nid ; io < ie && ND_TTEST ( * io ) ; ++ io ) { ND_PRINT ( ( ndo, "%c%s:%u", c, ipaddr_string ( ndo, & io -> id ), EXTRACT_32BITS ( & io -> off ) ) ) ; c = ',' ; } ND_PRINT ( ( ndo, ">" ) ) ; ps = ( const struct pgstate * ) io ; } return ( ( const u_char * ) ps <= ep? 0 : - 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> * prep ) ||! ND_TTEST ( * prep ) ) <S2SV_ModEnd> return ( - <S2SV_ModStart> 1 ) ; <S2SV_ModEnd> n = EXTRACT_32BITS
Buggy code:
 MYSOFA_EXPORT struct MYSOFA_HRTF * mysofa_load ( const char * filename, int * err ) { struct READER reader ; struct MYSOFA_HRTF * hrtf = NULL ; if ( filename == NULL ) filename = CMAKE_INSTALL_PREFIX "//share//libmysofa//default.sofa" ; if ( strcmp ( filename, "-" ) ) reader. fhd = fopen ( filename, "rb" ) ; else reader. fhd = stdin ; if (! reader. fhd ) { log ( "cannot   open   file   %s\\n", filename ) ; * err = errno ; return NULL ; } reader. gcol = NULL ; reader. all = NULL ; <START_BUG> * err = superblockRead ( & reader, & reader. superblock ) ; <END_BUG> if (! * err ) { hrtf = getHrtf ( & reader, err ) ; } superblockFree ( & reader, & reader. superblock ) ; gcolFree ( reader. gcol ) ; if ( strcmp ( filename, "-" ) ) fclose ( reader. fhd ) ; return hrtf ; }

Fix:
<S2SV_ModStart> = NULL ; reader. recursive_counter = 0 ;
Buggy code:
 <START_BUG> static void encode_term_subexp ( vp9_writer * w, int word ) { <END_BUG> if (! write_bit_gte ( w, word, 16 ) ) {  vp9_write_literal ( w, word, 4 ) ; <START_BUG> } else if (! write_bit_gte ( w, word, 32 ) ) { <END_BUG> vp9_write_literal ( w, word - 16, 4 ) ;  } else if (! write_bit_gte ( w, word, 64 ) ) { <START_BUG> vp9_write_literal ( w, word - 32, 5 ) ; <END_BUG> } else { encode_uniform ( w, word - 64 ) ; } }

Fix:
<S2SV_ModStart> void encode_term_subexp ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> ) ) { vpx_write_literal <S2SV_ModEnd> ( w, <S2SV_ModStart> ) ) { vpx_write_literal <S2SV_ModEnd> ( w, <S2SV_ModStart> ) ) { vpx_write_literal <S2SV_ModEnd> ( w,
Buggy code:
 MAPI_Attr * * mapi_attr_read ( size_t len, unsigned char * buf ) { size_t idx = 0 ; uint32 i, j ; assert ( len > 4 ) ; <START_BUG> uint32 num_properties = GETINT32 ( buf + idx ) ; <END_BUG> MAPI_Attr * * attrs = CHECKED_XMALLOC ( MAPI_Attr *, ( num_properties + 1 ) ) ; idx += 4 ; if (! attrs ) return NULL ; for ( i = 0 ; i < num_properties ; i ++ ) { MAPI_Attr * a = attrs [ i ] = CHECKED_XCALLOC ( MAPI_Attr, 1 ) ; MAPI_Value * v = NULL ; CHECKINT16 ( idx, len ) ; a -> type = GETINT16 ( buf + idx ) ; idx += 2 ; CHECKINT16 ( idx, len ) ; a -> name = GETINT16 ( buf + idx ) ; idx += 2 ; if ( a -> name & GUID_EXISTS_FLAG ) { a -> guid = CHECKED_XMALLOC ( GUID, 1 ) ; copy_guid_from_buf ( a -> guid, buf + idx, len ) ; idx += sizeof ( GUID ) ; CHECKINT32 ( idx, len ) ; a -> num_names = GETINT32 ( buf + idx ) ; idx += 4 ; if ( a -> num_names > 0 ) { size_t i ; a -> names = CHECKED_XCALLOC ( VarLenData, a -> num_names ) ; for ( i = 0 ; i < a -> num_names ; i ++ ) { size_t j ; CHECKINT32 ( idx, len ) ; a -> names [ i ]. len = GETINT32 ( buf + idx ) ; idx += 4 ; a -> names [ i ]. data = CHECKED_XMALLOC ( unsigned char, a -> names [ i ]. len ) ;  for ( j = 0 ; j < ( a -> names [ i ]. len >> 1 ) ; j ++ ) <START_BUG> a -> names [ i ]. data [ j ] = ( buf + idx ) [ j * 2 ] ; idx += pad_to_4byte ( a -> names [ i ]. len ) ; } } else { CHECKINT32 ( idx, len ) ; a -> name = GETINT32 ( buf + idx<END_BUG>

Fix:
<S2SV_ModStart> buf + idx ) ; assert ( ( num_properties + 1 )!= 0 <S2SV_ModStart> len ) ; assert ( ( idx + ( a -> names [ i ]. len * 2 ) ) <= len ) ; <S2SV_ModStart> += 4 ; assert ( v -> len + idx <= len ) ; <S2SV_ModStart> szMAPI_UNICODE_STRING ) { assert ( v -> len!= 0 ) ;
Buggy code:
 int cli_scanpe ( cli_ctx * ctx ) { uint16_t e_magic ; uint16_t nsections ; uint32_t e_lfanew ; uint32_t ep, vep ; uint8_t polipos = 0 ; time_t timestamp ; struct pe_image_file_hdr file_hdr ; union { struct pe_image_optional_hdr64 opt64 ; struct pe_image_optional_hdr32 opt32 ; } pe_opt ; struct pe_image_section_hdr * section_hdr ; char sname [ 9 ], epbuff [ 4096 ], * tempfile ; uint32_t epsize ; ssize_t bytes, at ; <START_BUG> unsigned int i, found, upx_success = 0, min = 0, max = 0, err, overlays = 0 ; <END_BUG> unsigned int ssize = 0, dsize = 0, dll = 0, pe_plus = 0, corrupted_cur ; int ( * upxfn ) ( const char *, uint32_t, char *, uint32_t *, uint32_t, uint32_t, uint32_t ) = NULL ; const char * src = NULL ; char * dest = NULL ; int ndesc, ret = CL_CLEAN, upack = 0, native = 0 ; size_t fsize ;  uint32_t valign, falign, hdr_size, j ; <START_BUG> struct cli_exe_section * exe_sections ; char timestr [ 32 ] ; struct pe_image_data_dir * dirs ; struct cli_bc_ctx * bc_ctx ; fmap_t * map ; struct cli_pe_hook_data pedata ; # ifdef HAVE__INTERNAL__SHA_COLLECT int sha_collect = ctx -> sha_collect ; # endif const char * archtype = NULL, * subsystem = NULL ; uint32_t viruses_found = 0 ; # if HAVE_JSON int toval = 0 ; struct json_object * pe_json = NULL ; char jsonbuf [ 128 ] ; # endif if (! ctx ) { cli_errmsg ( "cli_scanpe:   ctx   ==   NULL\\n" ) ; return CL_ENULLARG ; } # if HAVE_JSON if ( cli_json_timeout_cycle_check ( ctx, & toval )!=<END_BUG>

Fix:
<S2SV_ModStart> int i, j, <S2SV_ModStart> overlays = 0, rescan = 1 <S2SV_ModStart> falign, hdr_size <S2SV_ModEnd> ; struct cli_exe_section <S2SV_ModStart> ; # endif while ( rescan == 1 ) { rescan = 0 ; <S2SV_ModStart> ++ ) { exe_sections [ i ]. rva = PEALIGN ( EC32 ( section_hdr [ i ]. VirtualAddress ), valign ) ; exe_sections [ i ]. vsz = PESALIGN ( EC32 ( section_hdr [ i ]. VirtualSize ), valign ) ; exe_sections [ i ]. raw = PEALIGN ( EC32 ( section_hdr [ i ]. PointerToRawData ), falign ) ; exe_sections [ i ]. rsz = PESALIGN ( EC32 ( section_hdr [ i ]. SizeOfRawData ), falign ) ; exe_sections [ i ]. chr = EC32 ( section_hdr [ i ]. Characteristics ) ; exe_sections [ i ]. urva = EC32 ( section_hdr [ i ]. VirtualAddress ) ; exe_sections [ i ]. uvsz = EC32 ( section_hdr [ i ]. VirtualSize ) ; exe_sections [ i ]