nus-yam/ex-repair huggingface dataset:
Buggy code:
 bool_t ksz8851IrqHandler ( NetInterface * interface ) { bool_t flag ; size_t n ; uint16_t ier ; uint16_t isr ; flag = FALSE ; <START_BUG> ier = ksz8851ReadReg ( interface, KSZ8851_REG_IER ) ; <END_BUG>  ksz8851WriteReg ( interface, KSZ8851_REG_IER, 0 ) ; <START_BUG> <END_BUG> isr = ksz8851ReadReg ( interface, KSZ8851_REG_ISR ) ;  if ( ( isr & ISR_LCIS )!= 0 ) { <START_BUG> ier &= ~ IER_LCIE ; <END_BUG> interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; }  if ( ( isr & ISR_TXIS )!= 0 ) <START_BUG> { <END_BUG> ksz8851WriteReg ( interface, KSZ8851_REG_ISR, ISR_TXIS ) ;  <START_BUG> n = ksz8851ReadReg ( interface, KSZ8851_REG_TXMIR ) & TXMIR_TXMA_MASK ; <END_BUG> if ( n >= ( ETH_MAX_FRAME_SIZE + 8 ) ) { flag |= osSetEventFromIsr ( & interface -> nicTxEvent ) ; } }  if ( ( isr & ISR_RXIS )!= 0 ) <START_BUG> { <END_BUG> ier &= ~ IER_RXIE ;  interface -> nicEvent = TRUE ; flag |= osSetEventFromIsr ( & netEvent ) ; } <START_BUG> ksz8851WriteReg ( interface, KSZ8851_REG_IER, ier ) ; <END_BUG> return flag ; }

Fix:
<S2SV_ModStart> ( interface, KSZ8851_IER <S2SV_ModEnd> ) ; ksz8851WriteReg <S2SV_ModStart> ( interface, KSZ8851_IER <S2SV_ModEnd>, 0 ) <S2SV_ModStart> ( interface, KSZ8851_ISR ) ; if ( ( isr & KSZ8851_ISR_LCIS <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ier &= ~ KSZ8851_IER_LCIE <S2SV_ModEnd> ; interface -> <S2SV_ModStart> ( isr & KSZ8851_ISR_TXIS <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ( interface, KSZ8851_ISR, KSZ8851_ISR_TXIS <S2SV_ModEnd> ) ; n <S2SV_ModStart> ( interface, KSZ8851_TXMIR ) & KSZ8851_TXMIR_TXMA <S2SV_ModEnd> ; if ( <S2SV_ModStart> ( isr & KSZ8851_ISR_RXIS <S2SV_ModEnd> )!= 0 <S2SV_ModStart> ier &= ~ KSZ8851_IER_RXIE <S2SV_ModEnd> ; interface -> <S2SV_ModStart> ( interface, KSZ8851_IER <S2SV_ModEnd>, ier )
Buggy code:
 static noinline_for_stack int ccp_run_sha_cmd ( struct ccp_cmd_queue * cmd_q, struct ccp_cmd * cmd ) { struct ccp_sha_engine * sha = & cmd -> u. sha ; struct ccp_dm_workarea ctx ; struct ccp_data src ; struct ccp_op op ; unsigned int ioffset, ooffset ; unsigned int digest_size ; int sb_count ; const void * init ; u64 block_size ; int ctx_size ; int ret ; switch ( sha -> type ) { case CCP_SHA_TYPE_1 : if ( sha -> ctx_len < SHA1_DIGEST_SIZE ) return - EINVAL ; block_size = SHA1_BLOCK_SIZE ; break ; case CCP_SHA_TYPE_224 : if ( sha -> ctx_len < SHA224_DIGEST_SIZE ) return - EINVAL ; block_size = SHA224_BLOCK_SIZE ; break ; case CCP_SHA_TYPE_256 : if ( sha -> ctx_len < SHA256_DIGEST_SIZE ) return - EINVAL ; block_size = SHA256_BLOCK_SIZE ; break ; case CCP_SHA_TYPE_384 : if ( cmd_q -> ccp -> vdata -> version < CCP_VERSION ( 4, 0 ) || sha -> ctx_len < SHA384_DIGEST_SIZE ) return - EINVAL ; block_size = SHA384_BLOCK_SIZE ; break ; case CCP_SHA_TYPE_512 : if ( cmd_q -> ccp -> vdata -> version < CCP_VERSION ( 4, 0 ) || sha -> ctx_len < SHA512_DIGEST_SIZE ) return - EINVAL ; block_size = SHA512_BLOCK_SIZE ; break ; default : return - EINVAL ; } if (! sha -> ctx ) return - EINVAL ; if (! sha -> final && ( sha -> src_len & ( block_size - 1 ) ) ) return - EINVAL ; if ( cmd_q -> ccp -> vdata -> version == CCP_VERSION ( 3, 0 ) ) { if (! sha -> src_len ) { unsigned int digest_len ; const u8 * sha_zero ; if (! sha -> final ) return 0 ; if (

Fix:
<S2SV_ModStart> ; default : kfree ( hmac_buf ) ; <S2SV_ModStart> EINVAL ; goto e_data <S2SV_ModEnd> ; } memset
Buggy code:
 static int bgp_attr_print ( netdissect_options * ndo, <START_BUG> u_int atype, const u_char * pptr, u_int len ) <END_BUG> { int i ; uint16_t af ; uint8_t safi, snpa, nhlen ; union { float f ; uint32_t i ; } bw ; int advance ; u_int tlen ; const u_char * tptr ; char buf [ MAXHOSTNAMELEN + 100 ] ; int as_size ; tptr = pptr ; tlen = len ; switch ( atype ) { case BGPTYPE_ORIGIN : if ( len!= 1 ) ND_PRINT ( ( ndo, "invalid   len" ) ) ; else { ND_TCHECK ( * tptr ) ; ND_PRINT ( ( ndo, "%s", tok2str ( bgp_origin_values, "Unknown   Origin   Typecode", tptr [ 0 ] ) ) ) ; } break ; case BGPTYPE_AS4_PATH : case BGPTYPE_AS_PATH : if ( len % 2 ) { ND_PRINT ( ( ndo, "invalid   len" ) ) ; break ; } if (! len ) { ND_PRINT ( ( ndo, "empty" ) ) ; break ; } as_size = bgp_attr_get_as_size ( ndo, atype, pptr, len ) ; while ( tptr < pptr + len ) { ND_TCHECK ( tptr [ 0 ] ) ; ND_PRINT ( ( ndo, "%s", tok2str ( bgp_as_path_segment_open_values, "?", tptr [ 0 ] ) ) ) ; ND_TCHECK ( tptr [ 1 ] ) ; for ( i = 0 ; i < tptr [ 1 ] * as_size ; i += as_size ) { ND_TCHECK2 ( tptr [ 2 + i ], as_size ) ; ND_PRINT ( ( ndo, "%s   ", as_printf ( ndo, astostr, sizeof ( astostr ), as_size == 2? EXTRACT_16BITS ( & tptr [ 2 + i ] ) : EXTRACT_32BITS ( & tptr [ 2 + i ] ) ) ) ) ; } ND_T

Fix:
<S2SV_ModStart>, u_int len, const unsigned attr_set_level <S2SV_ModStart> } if ( attr_set_level == 10 ) ND_PRINT ( ( ndo, "(too <S2SV_blank> many <S2SV_blank> nested <S2SV_blank> levels, <S2SV_blank> not <S2SV_blank> recursing)" ) ) ; else if ( <S2SV_ModStart> tptr, alen, attr_set_level + 1
Buggy code:
 void CLASS parse_minolta ( int base ) { int save, tag, len, offset, high = 0, wide = 0, i, c ; short sorder = order ; fseek ( ifp, base, SEEK_SET ) ; if ( fgetc ( ifp ) || fgetc ( ifp ) - 'M' || fgetc ( ifp ) - 'R' ) return ; order = fgetc ( ifp ) * 0x101 ; <START_BUG> offset = base + get4 ( ) + 8 ; <END_BUG> while ( ( save = ftell ( ifp ) ) < offset ) { for ( tag = i = 0 ; i < 4 ; i ++ ) tag = tag << 8 | fgetc ( ifp ) ; len = get4 ( ) ;  switch ( tag ) <START_BUG> { case 0x505244 : fseek ( ifp, 8, SEEK_CUR ) ; high = get2 ( ) ; wide = get2 ( ) ; # ifdef LIBRAW_LIBRARY_BUILD imgdata. makernotes. sony. prd_ImageHeight = get2 ( ) ; imgdata. makernotes. sony. prd_ImageWidth = get2 ( ) ; fseek ( ifp, 1L, SEEK_CUR ) ; imgdata. makernotes. sony. prd_RawBitDepth = ( ushort ) fgetc ( ifp ) ; imgdata. makernotes. sony. prd_StorageMethod = ( ushort ) fgetc ( ifp ) ; fseek ( ifp, 4L, SEEK_CUR ) ; imgdata. makernotes. sony. prd_BayerPattern = ( ushort ) fgetc ( ifp ) ; # endif break ; # ifdef LIBRAW_LIBRARY_BUILD case 0x524946 : if (! strncasecmp ( model, "DSLR-A100", 9 ) ) { fseek ( ifp, 8, SEEK_CUR ) ; imgdata. color. WB_Coeffs [ LIBRAW_WBI_Tungsten ] [ 0 ] = get2 ( ) ; imgdata. color. WB_Coeffs [ LIBRAW_WBI_Tungsten ] [ 2 ] = get2 ( ) ; imgdata. color. WB_Coeffs [ LIBRAW_<END_BUG>

Fix:
<S2SV_ModStart> + 8 ; # ifdef LIBRAW_LIBRARY_BUILD if ( offset > ifp -> size ( ) - 8 ) offset = ifp -> size ( ) - 8 ; # endif <S2SV_ModStart> ( ) ; if ( len < 0 ) return ;
Buggy code:
 void user_describe ( const struct key * key, struct seq_file * m ) { seq_puts ( m, key -> description ) ; <START_BUG> if ( key_is_instantiated ( key ) ) <END_BUG> seq_printf ( m, ":   %u", key -> datalen ) ; }

Fix:
<S2SV_ModStart> ; if ( key_is_positive <S2SV_ModEnd> ( key )
Buggy code:
 static int rx_cache_find ( const struct rx_header * rxh, const struct ip * ip, int sport, int32_t * opcode ) { int i ; struct rx_cache_entry * rxent ; uint32_t clip ; uint32_t sip ; UNALIGNED_MEMCPY ( & clip, & ip -> ip_dst, sizeof ( uint32_t ) ) ; UNALIGNED_MEMCPY ( & sip, & ip -> ip_src, sizeof ( uint32_t ) ) ; i = rx_cache_hint ; do { rxent = & rx_cache [ i ] ; if ( rxent -> callnum == EXTRACT_32BITS ( & rxh -> callNumber ) && rxent -> client. s_addr == clip && rxent -> server. s_addr == sip && <START_BUG> rxent -> serviceId == EXTRACT_32BITS ( & rxh -> serviceId ) && <END_BUG> rxent -> dport == sport ) { rx_cache_hint = i ; * opcode = rxent -> opcode ; return ( 1 ) ; } if ( ++ i >= RX_CACHE_SIZE ) i = 0 ; } while ( i!= rx_cache_hint ) ; return ( 0 ) ; }

Fix:
<S2SV_ModStart> -> serviceId == EXTRACT_16BITS <S2SV_ModEnd> ( & rxh
Buggy code:
 static int a2dp_ctrl_receive ( struct a2dp_stream_common * common, void * buffer, int length ) { <START_BUG> int ret = recv ( common -> ctrl_fd, buffer, length, MSG_NOSIGNAL ) ; <END_BUG> if ( ret < 0 ) { ERROR ( "ack   failed   (%s)", strerror ( errno ) ) ; if ( errno == EINTR ) {  ret = recv ( common -> ctrl_fd, buffer, length, MSG_NOSIGNAL ) ; <START_BUG> if ( ret < 0 ) { ERROR ( "ack   failed   (%s)", strerror ( errno ) ) ; skt_disconnect ( common -> ctrl_fd ) ; common -> ctrl_fd = AUDIO_SKT_DISCONNECTED ; return - 1 ; } } else { skt_disconnect ( common -> ctrl_fd ) ; common -> ctrl_fd = AUDIO_SKT_DISCONNECTED ; return - 1 ; } } return ret ; }<END_BUG>

Fix:
<S2SV_ModStart> int ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> length, MSG_NOSIGNAL ) <S2SV_ModStart> { ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> length, MSG_NOSIGNAL )
Buggy code:
 long vorbis_book_decodev_add ( codebook * book, ogg_int32_t * a, oggpack_buffer * b, int n, int point ) { if ( book -> used_entries > 0 ) { ogg_int32_t * v = book -> dec_buf ; int i, j ; if (! v ) return - 1 ; for ( i = 0 ; i < n ; ) { if ( decode_map ( book, b, v, point ) ) return - 1 ; <START_BUG> for ( j = 0 ; j < book -> dim ; j ++ ) <END_BUG> a [ i ++ ] += v [ j ] ; } } return 0 ; }

Fix:
<S2SV_ModStart> book -> dim && i < n
Buggy code:
 static BOOL autodetect_recv_bandwidth_measure_results ( rdpRdp * rdp, wStream * s, AUTODETECT_RSP_PDU * autodetectRspPdu ) { BOOL success = TRUE ; if ( autodetectRspPdu -> headerLength!= 0x0E ) return FALSE ; <START_BUG> WLog_VRB ( AUTODETECT_TAG, "received   Bandwidth   Measure   Results   PDU" ) ; <END_BUG> Stream_Read_UINT32 ( s, rdp -> autodetect -> bandwidthMeasureTimeDelta ) ; Stream_Read_UINT32 ( s, rdp -> autodetect -> bandwidthMeasureByteCount ) ; if ( rdp -> autodetect -> bandwidthMeasureTimeDelta > 0 ) rdp -> autodetect -> netCharBandwidth = rdp -> autodetect -> bandwidthMeasureByteCount * 8 // rdp -> autodetect -> bandwidthMeasureTimeDelta ; else rdp -> autodetect -> netCharBandwidth = 0 ; IFCALLRET ( rdp -> autodetect -> BandwidthMeasureResults, success, rdp -> context, autodetectRspPdu -> sequenceNumber ) ; return success ; }

Fix:
<S2SV_ModStart>, "received <S2SV_blank> Bandwidth <S2SV_blank> Measure <S2SV_blank> Results <S2SV_blank> PDU" ) ; if ( Stream_GetRemainingLength ( s ) < 8 ) return - 1
Buggy code:
 static struct mount * clone_mnt ( struct mount * old, struct dentry * root, int flag ) { struct super_block * sb = old -> mnt. mnt_sb ; struct mount * mnt ; int err ; mnt = alloc_vfsmnt ( old -> mnt_devname ) ; if (! mnt ) return ERR_PTR ( - ENOMEM ) ; if ( flag & ( CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE ) ) mnt -> mnt_group_id = 0 ; else mnt -> mnt_group_id = old -> mnt_group_id ; if ( ( flag & CL_MAKE_SHARED ) &&! mnt -> mnt_group_id ) { err = mnt_alloc_group_id ( mnt ) ; if ( err ) goto out_free ; } mnt -> mnt. mnt_flags = old -> mnt. mnt_flags & ~ ( MNT_WRITE_HOLD | MNT_MARKED ) ; <START_BUG> if ( ( flag & CL_UNPRIVILEGED ) && ( mnt -> mnt. mnt_flags & MNT_READONLY ) ) <END_BUG> mnt -> mnt. mnt_flags |= MNT_LOCK_READONLY ;  if ( ( flag & CL_UNPRIVILEGED ) && list_empty ( & old -> mnt_expire ) ) <START_BUG> mnt -> mnt. mnt_flags |= MNT_LOCKED ; atomic_inc ( & sb -> s_active ) ; mnt -> mnt. mnt_sb = sb ; mnt -> mnt. mnt_root = dget ( root ) ; mnt -> mnt_mountpoint = mnt -> mnt. mnt_root ; mnt -> mnt_parent = mnt ; lock_mount_hash ( ) ; list_add_tail ( & mnt -> mnt_instance, & sb -> s_mounts ) ; unlock_mount_hash ( ) ; if ( ( flag & CL_SLAVE ) || ( ( flag & CL_SHARED_TO_SLAVE ) && IS_MNT_SHARED ( old ) ) ) { list_add ( & mnt -> mnt_slave, & old -> mnt_slave_<END_BUG>

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> flag & CL_UNPRIVILEGED <S2SV_ModStart> & CL_UNPRIVILEGED ) { mnt -> mnt. mnt_flags |= MNT_LOCK_ATIME ; if <S2SV_ModEnd> ( mnt -> <S2SV_ModStart> mnt_flags & MNT_READONLY <S2SV_ModEnd> ) mnt -> <S2SV_ModStart> ; if ( mnt -> mnt. mnt_flags & MNT_NODEV ) mnt -> mnt. mnt_flags |= MNT_LOCK_NODEV ; if ( mnt -> mnt. mnt_flags & MNT_NOSUID ) mnt -> mnt. mnt_flags |= MNT_LOCK_NOSUID ; if ( mnt -> mnt. mnt_flags & MNT_NOEXEC ) mnt -> mnt. mnt_flags |= MNT_LOCK_NOEXEC ; } if (
Buggy code:
 <START_BUG> static void inc_mvs ( const MB_MODE_INFO * mbmi, const int_mv mvs [ 2 ], <END_BUG> nmv_context_counts * counts ) { int i ; for ( i = 0 ; i < 1 + has_second_ref ( mbmi ) ; ++ i ) {  const MV * ref = & mbmi -> ref_mvs [ mbmi -> ref_frame [ i ] ] [ 0 ]. as_mv ; <START_BUG> const MV diff = { mvs [ i ]. as_mv. row - ref -> row, mvs [ i ]. as_mv. col - ref -> col } ; vp9_inc_mv ( & diff, counts ) ; } }<END_BUG>

Fix:
<S2SV_ModStart> * mbmi, const MB_MODE_INFO_EXT * mbmi_ext, <S2SV_ModStart> ref = & mbmi_ext <S2SV_ModEnd> -> ref_mvs [
Buggy code:
 static void ext4_invalidatepage ( struct page * page, unsigned long offset ) { <START_BUG> journal_t * journal = EXT4_JOURNAL ( page -> mapping -> host ) ; <END_BUG> if ( offset == 0 ) ClearPageChecked ( page ) ; if ( journal ) jbd2_journal_invalidatepage ( journal, page, offset ) ; else block_invalidatepage ( page, offset ) ; }

Fix:
<S2SV_ModStart> mapping -> host ) ; if ( ext4_should_dioread_nolock ( page -> mapping -> host ) ) ext4_invalidatepage_free_endio ( page, offset
Buggy code:
 error_t enc624j600ReceivePacket ( NetInterface * interface ) { error_t error ; <START_BUG> uint16_t n ; <END_BUG> uint32_t status ;  Enc624j600Context * context ; <START_BUG> context = ( Enc624j600Context * ) interface -> nicContext ; <END_BUG> if ( enc624j600ReadReg ( interface, ENC624J600_REG_ESTAT ) & ESTAT_PKTCNT )  { <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_ERXRDPT, context -> nextPacket ) ; <END_BUG> enc624j600ReadBuffer ( interface, ENC624J600_CMD_RRXDATA,  ( uint8_t * ) & context -> nextPacket, sizeof ( uint16_t ) ) ; <START_BUG> context -> nextPacket = letoh16 ( context -> nextPacket ) ; enc624j600ReadBuffer ( interface, ENC624J600_CMD_RRXDATA, ( uint8_t * ) & n, sizeof ( uint16_t ) ) ; n = letoh16 ( n ) ; enc624j600ReadBuffer ( interface, ENC624J600_CMD_RRXDATA, ( uint8_t * ) & status, sizeof ( uint32_t ) ) ; status = letoh32 ( status ) ; <END_BUG> if ( ( status & RSV_RECEIVED_OK )!= 0 )  { <START_BUG> n = MIN ( n, ETH_MAX_FRAME_SIZE ) ; <END_BUG>  enc624j600ReadBuffer ( interface, ENC624J600_CMD_RRXDATA, context -> rxBuffer, n ) ; <START_BUG> error = NO_ERROR ; } else { error = ERROR_INVALID_PACKET ; } if ( context -> nextPacket == ENC624J600_RX_BUFFER_START ) { <END_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_ERXTAIL, ENC624J600_RX_BUFFER_STOP ) ;  } else { <START_BUG> enc624j600WriteReg ( interface, ENC624J600_REG_ERXTAIL, context -> nextPacket - 2 ) ; <END_BUG> }  enc624j600SetBit ( interface, ENC624J600_REG_ECON1,

Fix:
<S2SV_ModStart> error ; uint16_t length <S2SV_ModEnd> ; uint32_t status <S2SV_ModStart> uint32_t status ; uint8_t header [ 8 ] ; <S2SV_ModStart> ( interface, ENC624J600_ESTAT ) & ENC624J600_ESTAT_PKTCNT <S2SV_ModEnd> ) { enc624j600WriteReg <S2SV_ModStart> ( interface, ENC624J600_ERXRDPT <S2SV_ModEnd>, context -> <S2SV_ModStart>, ENC624J600_CMD_RRXDATA, header <S2SV_ModEnd>, sizeof ( <S2SV_ModStart>, sizeof ( header ) ) ; context -> nextPacket = LOAD16LE ( header ) ; length = LOAD16LE ( header + 2 ) ; status = LOAD32LE ( header + 4 <S2SV_ModEnd> ) ; if <S2SV_ModStart> ( status & ENC624J600_RSV_RECEIVED_OK <S2SV_ModEnd> )!= 0 <S2SV_ModStart> 0 ) { length <S2SV_ModEnd> = MIN ( <S2SV_ModStart> = MIN ( length <S2SV_ModEnd>, ETH_MAX_FRAME_SIZE ) <S2SV_ModStart> -> rxBuffer, length <S2SV_ModEnd> ) ; error <S2SV_ModStart> ( interface, ENC624J600_ERXTAIL, <S2SV_ModEnd> ENC624J600_RX_BUFFER_STOP ) ; <S2SV_ModStart> ( interface, ENC624J600_ERXTAIL,
Buggy code:
 static int recv_msg ( struct kiocb * iocb, struct socket * sock, struct msghdr * m, size_t buf_len, int flags ) { struct sock * sk = sock -> sk ; struct tipc_port * tport = tipc_sk_port ( sk ) ; struct sk_buff * buf ; struct tipc_msg * msg ; long timeout ; unsigned int sz ; u32 err ; int res ; if ( unlikely (! buf_len ) ) return - EINVAL ; lock_sock ( sk ) ; if ( unlikely ( sock -> state == SS_UNCONNECTED ) ) { res = - ENOTCONN ; goto exit ; } <START_BUG> m -> msg_namelen = 0 ; <END_BUG> timeout = sock_rcvtimeo ( sk, flags & MSG_DONTWAIT ) ; restart : while ( skb_queue_empty ( & sk -> sk_receive_queue ) ) { if ( sock -> state == SS_DISCONNECTING ) { res = - ENOTCONN ; goto exit ; } if ( timeout <= 0L ) { res = timeout? timeout : - EWOULDBLOCK ; goto exit ; } release_sock ( sk ) ; timeout = wait_event_interruptible_timeout ( * sk_sleep ( sk ), tipc_rx_ready ( sock ), timeout ) ; lock_sock ( sk ) ; } buf = skb_peek ( & sk -> sk_receive_queue ) ; msg = buf_msg ( buf ) ; sz = msg_data_sz ( msg ) ; err = msg_errcode ( msg ) ; if ( (! sz ) && (! err ) ) { advance_rx_queue ( sk ) ; goto restart ; } set_orig_addr ( m, msg ) ; res = anc_data_recv ( m, msg, tport ) ; if ( res ) goto exit ; if (! err ) { if ( unlikely ( buf_len < sz ) ) { sz = buf_len ; m -> msg_flags |= MSG_TRUNC ; } res = skb_copy_datagram_iovec ( buf, msg_hdr_sz ( msg ), m -> msg_iov, sz ) ; if ( res ) goto exit ; res = sz ; } else { if ( ( sock -> state == SS_READY ) || ( ( err == TIPC_

Fix:
<S2SV_ModStart> exit ; } <S2SV_ModEnd> timeout = sock_rcvtimeo
Buggy code:
 <START_BUG> static void fadst16 ( const int16_t * input, int16_t * output ) { <END_BUG>  int s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15 ; <START_BUG> <END_BUG> int x0 = input [ 15 ] ;  <START_BUG> int x1 = input [ 0 ] ; <END_BUG>  int x2 = input [ 13 ] ; <START_BUG> <END_BUG> int x3 = input [ 2 ] ;  <START_BUG> int x4 = input [ 11 ] ; <END_BUG>  int x5 = input [ 4 ] ; <START_BUG> <END_BUG> int x6 = input [ 9 ] ;  <START_BUG> int x7 = input [ 6 ] ; <END_BUG>  int x8 = input [ 7 ] ; <START_BUG> <END_BUG> int x9 = input [ 8 ] ;  <START_BUG> int x10 = input [ 5 ] ; <END_BUG>  int x11 = input [ 10 ] ; <START_BUG> <END_BUG> int x12 = input [ 3 ] ;  <START_BUG> int x13 = input [ 12 ] ; <END_BUG>  int x14 = input [ 1 ] ; <START_BUG> <END_BUG> int x15 = input [ 14 ] ;  s0 = x0 * cospi_1_64 + x1 * cospi_31_64 ; s1 = x0 * cospi_31_64 - x1 * cospi_1_64 ; s2 = x2 * cospi_5_64 + x3 * cospi_27_64 ; s3 = x2 * cospi_27_64 - x3 * cospi_5_64 ; s4 = x4 * cospi_9_64 + x5 * cospi_23_64 ; s5 = x4 * cospi_23_64 - x5 * cospi_9_64 ; s6 = x6 * cospi_13_64 + x7 * cospi_19_64 ; s7 = x6 * cospi_19_64 - x7 * cospi_13_64 ; s8 = x8 * cospi_17_64 + x9 * cospi_15_64 ; s9 = x8 * cospi_15_64 - x9 * cospi_17_64 ; s10 = x10 * cospi_21_64 + x11 * cospi_11_64 ; s

Fix:
<S2SV_ModStart> fadst16 ( const tran_low_t <S2SV_ModEnd> * input, <S2SV_ModStart> * input, tran_low_t <S2SV_ModEnd> * output ) <S2SV_ModStart> output ) { tran_high_t <S2SV_ModEnd> s0, s1 <S2SV_ModStart> s7, s8 ; tran_high_t <S2SV_ModEnd> s9, s10 <S2SV_ModStart>, s15 ; tran_high_t <S2SV_ModEnd> x0 = input <S2SV_ModStart> 15 ] ; tran_high_t <S2SV_ModEnd> x1 = input <S2SV_ModStart> 0 ] ; tran_high_t <S2SV_ModEnd> x2 = input <S2SV_ModStart> 13 ] ; tran_high_t <S2SV_ModEnd> x3 = input <S2SV_ModStart> 2 ] ; tran_high_t <S2SV_ModEnd> x4 = input <S2SV_ModStart> 11 ] ; tran_high_t <S2SV_ModEnd> x5 = input <S2SV_ModStart> 4 ] ; tran_high_t <S2SV_ModEnd> x6 = input <S2SV_ModStart> 9 ] ; tran_high_t <S2SV_ModEnd> x7 = input <S2SV_ModStart> 6 ] ; tran_high_t <S2SV_ModEnd> x8 = input <S2SV_ModStart> 7 ] ; tran_high_t <S2SV_ModEnd> x9 = input <S2SV_ModStart> 8 ] ; tran_high_t <S2SV_ModEnd> x10 = input <S2SV_ModStart> 5 ] ; tran_high_t <S2SV_ModEnd> x11 = input <S2SV_ModStart> 10 ] ; tran_high_t <S2SV_ModEnd> x12 = input <S2SV_ModStart> 3 ] ; tran_high_t
Buggy code:
 static int process_options ( int argc, char * argv [ ], char * operation ) { int error = 0 ; int i = 0 ; if ( ( error = handle_options ( & argc, & argv, my_long_options, get_one_option ) ) ) goto exit ; if ( opt_print_defaults ) { error = - 1 ; goto exit ; } if ( opt_basedir ) { i = ( int ) strlength ( opt_basedir ) ; if ( opt_basedir [ i - 1 ]!= FN_LIBCHAR || opt_basedir [ i - 1 ]!= FN_LIBCHAR2 ) { char buff [ FN_REFLEN ] ; <START_BUG> strncpy ( buff, opt_basedir, sizeof ( buff ) - 1 ) ; <END_BUG> # ifdef __WIN__ strncat ( buff, "//", sizeof ( buff ) - strlen ( buff ) - 1 ) ; # else strncat ( buff, FN_DIRSEP, sizeof ( buff ) - strlen ( buff ) - 1 ) ; # endif buff [ sizeof ( buff ) - 1 ] = 0 ; my_free ( opt_basedir ) ; opt_basedir = my_strdup ( buff, MYF ( MY_FAE ) ) ; } } if (! opt_no_defaults && ( ( error = get_default_values ( ) ) ) ) { error = - 1 ; goto exit ; } strcpy ( operation, "" ) ; if ( ( error = check_options ( argc, argv, operation ) ) ) { goto exit ; } if ( opt_verbose ) { printf ( "#         basedir   =   %s\\n", opt_basedir ) ; printf ( "#   plugin_dir   =   %s\\n", opt_plugin_dir ) ; printf ( "#         datadir   =   %s\\n", opt_datadir ) ; printf ( "#   plugin_ini   =   %s\\n", opt_plugin_ini ) ; } exit : return error ; }

Fix:
<S2SV_ModStart> FN_REFLEN ] ; memset ( buff, 0, sizeof ( buff ) ) ;
Buggy code:
 static void show_stream_config ( struct stream_state * stream, struct VpxEncoderConfig * global, struct VpxInputContext * input ) { # define SHOW ( field ) fprintf ( stderr, "         %-28s   =   %d\\n", # field, stream -> config. cfg. field ) if ( stream -> index == 0 ) { fprintf ( stderr, "Codec:   %s\\n", <START_BUG> vpx_codec_iface_name ( global -> codec -> interface ( ) ) ) ; <END_BUG> fprintf ( stderr, "Source   file:   %s   Format:   %s\\n", input -> filename,  input -> use_i420? "I420" : "YV12" ) ; <START_BUG> } if ( stream -> next || stream -> index ) fprintf ( stderr, "\\nStream   Index:   %d\\n", stream -> index ) ; fprintf ( stderr, "Destination   file:   %s\\n", stream -> config. out_fn ) ; fprintf ( stderr, "Encoder   parameters:\\n" ) ; SHOW ( g_usage ) ; SHOW ( g_threads ) ; SHOW ( g_profile ) ; SHOW ( g_w ) ; SHOW ( g_h ) ; <END_BUG> SHOW ( g_timebase. num ) ;  SHOW ( g_timebase. den ) ; SHOW ( g_error_resilient ) ; SHOW ( g_pass ) ; SHOW ( g_lag_in_frames ) ; SHOW ( rc_dropframe_thresh ) ; <START_BUG> SHOW ( rc_resize_allowed ) ; <END_BUG> SHOW ( rc_resize_up_thresh ) ; SHOW ( rc_resize_down_thresh ) ; SHOW ( rc_end_usage ) ; SHOW ( rc_target_bitrate ) ; SHOW ( rc_min_quantizer ) ; SHOW ( rc_max_quantizer ) ; SHOW ( rc_undershoot_pct ) ; SHOW ( rc_overshoot_pct ) ; SHOW ( rc_buf_sz ) ; SHOW ( rc_buf_initial_sz ) ; SHOW ( rc_buf_optimal_sz ) ; SHOW ( rc_2pass_vbr_bias_pct ) ; SHOW ( rc_2pass_vbr_minsection_pct ) ; SHOW ( rc_2pass_vbr_maxsection

Fix:
<S2SV_ModStart> -> codec -> codec_interface ( ) ) ) ; fprintf ( stderr, "Source <S2SV_blank> file: <S2SV_blank> %s <S2SV_blank> File <S2SV_blank> Type: <S2SV_blank> %s <S2SV_blank> Format: <S2SV_blank> %s\\n", <S2SV_ModEnd> input -> filename <S2SV_ModStart> -> filename, file_type_to_string ( input -> file_type ), image_format_to_string ( input -> fmt ) <S2SV_ModEnd> ) ; } <S2SV_ModStart> ; SHOW ( g_bit_depth ) ; SHOW ( g_input_bit_depth ) ; SHOW ( <S2SV_ModStart> SHOW ( rc_resize_allowed ) ; SHOW ( rc_scaled_width ) ; SHOW ( rc_scaled_height
Buggy code:
 WORD32 ixheaacd_qmf_hbe_data_reinit ( ia_esbr_hbe_txposer_struct * ptr_hbe_txposer, WORD16 * p_freq_band_tab [ 2 ], WORD16 * p_num_sfb, WORD32 upsamp_4_flag ) { WORD32 synth_size, sfb, patch, stop_patch ; if ( ptr_hbe_txposer!= NULL ) { ptr_hbe_txposer -> start_band = p_freq_band_tab [ LOW ] [ 0 ] ; ptr_hbe_txposer -> end_band = p_freq_band_tab [ LOW ] [ p_num_sfb [ LOW ] ] ; ptr_hbe_txposer -> synth_size = 4 * ( ( ptr_hbe_txposer -> start_band + 4 ) // 8 + 1 ) ; ptr_hbe_txposer -> k_start = ixheaacd_start_subband2kL_tbl [ ptr_hbe_txposer -> start_band ] ; ptr_hbe_txposer -> upsamp_4_flag = upsamp_4_flag ; if ( upsamp_4_flag ) { if ( ptr_hbe_txposer -> k_start + ptr_hbe_txposer -> synth_size > 16 ) ptr_hbe_txposer -> k_start = 16 - ptr_hbe_txposer -> synth_size ; } else if ( ptr_hbe_txposer -> core_frame_length == 768 ) { if ( ptr_hbe_txposer -> k_start + ptr_hbe_txposer -> synth_size > 24 ) ptr_hbe_txposer -> k_start = 24 - ptr_hbe_txposer -> synth_size ; } memset ( ptr_hbe_txposer -> synth_buf, 0, 1280 * sizeof ( FLOAT32 ) ) ; synth_size = ptr_hbe_txposer -> synth_size ; ptr_hbe_txposer -> synth_buf_offset = 18 * synth_size ; switch ( synth_size ) { case 4 : ptr_hbe_txposer -> synth_

Fix:
<S2SV_ModStart> ) ixheaacd_analy_cos_sin_table_kl_8 ; ptr_hbe_txposer -> <S2SV_ModStart> & ixheaacd_real_synth_fft_p2 ; ptr_hbe_txposer -> <S2SV_ModStart> ) ixheaacd_analy_cos_sin_table_kl_16 ; ptr_hbe_txposer -> <S2SV_ModStart> & ixheaacd_real_synth_fft_p2 ; ptr_hbe_txposer -> <S2SV_ModStart> ) ixheaacd_analy_cos_sin_table_kl_24 ; ptr_hbe_txposer -> <S2SV_ModStart> & ixheaacd_real_synth_fft_p3 ; ptr_hbe_txposer -> <S2SV_ModStart> ) ixheaacd_analy_cos_sin_table_kl_32 ; ptr_hbe_txposer -> <S2SV_ModStart> & ixheaacd_real_synth_fft_p2 ; ptr_hbe_txposer -> <S2SV_ModStart> ) ixheaacd_analy_cos_sin_table_kl_8 ; ptr_hbe_txposer -> <S2SV_ModStart> & ixhea
Buggy code:
 <START_BUG> static void fix_interp_filter ( VP9_COMMON * cm ) { <END_BUG> if ( cm -> interp_filter == SWITCHABLE ) { int count [ SWITCHABLE_FILTERS ] ; int i, j, c = 0 ; for ( i = 0 ; i < SWITCHABLE_FILTERS ; ++ i ) { count [ i ] = 0 ; for ( j = 0 ; j < SWITCHABLE_FILTER_CONTEXTS ; ++ j )  count [ i ] += cm -> counts. switchable_interp [ j ] [ i ] ; <START_BUG> c += ( count [ i ] > 0 ) ; } if ( c == 1 ) { for ( i = 0 ; i < SWITCHABLE_FILTERS ; ++ i ) { if ( count [ i ] ) { cm -> interp_filter = i ; break ; } } } } }<END_BUG>

Fix:
<S2SV_ModStart> VP9_COMMON * cm, FRAME_COUNTS * counts <S2SV_ModStart> i ] += counts -> <S2SV_ModEnd> switchable_interp [ j
Buggy code:
 int arm_cpu_caps ( void ) { int flags ; int mask ; if (! arm_cpu_env_flags ( & flags ) ) { return flags ; } mask = arm_cpu_env_mask ( ) ; <START_BUG> # if HAVE_EDSP <END_BUG> flags |= HAS_EDSP ; # endif # if HAVE_MEDIA flags |= HAS_MEDIA ; # endif  # if HAVE_NEON <START_BUG> flags |= HAS_NEON ; # endif return flags & mask ; }<END_BUG>

Fix:
<S2SV_ModStart> ; # if <S2SV_ModEnd> HAVE_MEDIA flags |= <S2SV_ModStart> # if HAVE_NEON || HAVE_NEON_ASM
Buggy code:
 static void exif_mnote_data_fuji_load ( ExifMnoteData * en, const unsigned char * buf, unsigned int buf_size ) { ExifMnoteDataFuji * n = ( ExifMnoteDataFuji * ) en ; ExifLong c ; size_t i, tcount, o, datao ; if (! n ||! buf ||! buf_size ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short   MakerNote" ) ; return ; } datao = 6 + n -> offset ; <START_BUG> if ( ( datao + 12 < datao ) || ( datao + 12 < 12 ) || ( datao + 12 > buf_size ) ) { <END_BUG> exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short   MakerNote" ) ; return ; } n -> order = EXIF_BYTE_ORDER_INTEL ; datao += exif_get_long ( buf + datao + 8, EXIF_BYTE_ORDER_INTEL ) ;  if ( ( datao + 2 < datao ) || ( datao + 2 < 2 ) || <START_BUG> ( datao + 2 > buf_size ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short   MakerNote" ) ; return ; } c = exif_get_short ( buf + datao, EXIF_BYTE_ORDER_INTEL ) ; datao += 2 ; exif_mnote_data_fuji_clear ( n ) ; n -> entries = exif_mem_alloc ( en -> mem, sizeof ( MnoteFujiEntry ) * c ) ; if (! n -> entries ) { EXIF_LOG_NO_MEMORY ( en -> log, "ExifMnoteDataFuji", sizeof ( MnoteFujiEntry ) * c ) ; return ; } tcount = 0 ; for ( i = c, o = datao ; i ; -- i, o += 12 ) { size_t s ; <END_BUG> if ( ( o + 12 < o )

Fix:
<S2SV_ModStart> ; if ( CHECKOVERFLOW ( datao, buf_size, 12 <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; if ( CHECKOVERFLOW ( datao, buf_size, 2 <S2SV_ModEnd> ) ) { <S2SV_ModStart> ; if ( CHECKOVERFLOW ( o, buf_size, 12 ) ) { exif_log ( en -> log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteDataFuji", "Short <S2SV_blank> MakerNote" ) ; break ; } n -> entries [ tcount ]. tag = exif_get_short ( buf + o, n -> order ) ; n -> entries [ tcount ]. format = exif_get_short ( buf + o + 2, n -> order ) ; n -> entries [ tcount ]. components = exif_get_long ( buf + o + 4, n -> order ) ; n -> entries [ tcount ]. order = n -> order ; exif_log ( en -> log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataFuji", "Loading <S2SV_blank> entry <S2SV_blank> 0x%x <S2SV_blank> (\'%s\')...", n -> entries [ tcount ]. tag, mnote_fuj
Buggy code:
 WORD32 ih264d_parse_sps ( dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm ) { UWORD8 i ; dec_seq_params_t * ps_seq = NULL ; <START_BUG> UWORD8 u1_profile_idc, u1_level_idc, u1_seq_parameter_set_id ; <END_BUG> UWORD16 i2_max_frm_num ; UWORD32 * pu4_bitstrm_buf = ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_bitstrm -> u4_ofst ; UWORD8 u1_frm, uc_constraint_set0_flag, uc_constraint_set1_flag ; WORD32 i4_cropped_ht, i4_cropped_wd ; UWORD32 u4_temp ; WORD32 pic_height_in_map_units_minus1 = 0 ; UWORD32 u2_pic_wd = 0 ; UWORD32 u2_pic_ht = 0 ; UWORD32 u2_frm_wd_y = 0 ; UWORD32 u2_frm_ht_y = 0 ; UWORD32 u2_frm_wd_uv = 0 ; UWORD32 u2_frm_ht_uv = 0 ; UWORD32 u2_crop_offset_y = 0 ; UWORD32 u2_crop_offset_uv = 0 ; WORD32 ret ; UWORD32 u4_num_reorder_frames ; WORD32 i4_i ; UWORD8 u1_frame_cropping_flag, u1_frame_cropping_rect_left_ofst, u1_frame_cropping_rect_right_ofst, u1_frame_cropping_rect_top_ofst, u1_frame_cropping_rect_bottom_ofst ; SWITCHONTRACE ; u1_profile_idc = ih264d_get_bits_h264 ( ps_bitstrm, 8 ) ; COPYTHECONTEXT ( "SPS:   profile_idc", u1_profile_idc ) ; uc_constraint_set0_flag = ih264d_get_bit_h264

Fix:
<S2SV_ModStart> u1_level_idc, u1_seq_parameter_set_id, u1_mb_aff_flag = 0 <S2SV_ModStart>! u1_frm ) u1_mb_aff_flag = ih264d_get_bit_h264 ( ps_bitstrm ) ; if ( ( ps_dec -> i4_header_decoded & 1 ) && ( ps_seq -> u1_mb_aff_flag!= u1_mb_aff_flag ) ) { ps_dec -> u1_res_changed = 1 ; return IVD_RES_CHANGED ; } if (! u1_frm ) <S2SV_ModStart> -> u1_mb_aff_flag = u1_mb_aff_flag <S2SV_ModEnd> ; COPYTHECONTEXT (
Buggy code:
 vpx_codec_err_t vpx_svc_set_options ( SvcContext * svc_ctx, const char * options ) { <START_BUG> SvcInternal * const si = get_svc_internal ( svc_ctx ) ; <END_BUG> if ( svc_ctx == NULL || options == NULL || si == NULL ) { return VPX_CODEC_INVALID_PARAM ; } strncpy ( si -> options, options, sizeof ( si -> options ) ) ; si -> options [ sizeof ( si -> options ) - 1 ] = '\\0' ; return VPX_CODEC_OK ; }

Fix:
<S2SV_ModStart> options ) { SvcInternal_t <S2SV_ModEnd> * const si
Buggy code:
 <START_BUG> static VALUE read_memory ( VALUE klass, VALUE content ) <END_BUG> { xmlSchemaPtr schema ;  xmlSchemaParserCtxtPtr ctx = xmlSchemaNewMemParserCtxt ( <START_BUG> ( const char * ) StringValuePtr ( content ), ( int ) RSTRING_LEN ( content ) <END_BUG> ) ;  VALUE rb_schema ; VALUE errors = rb_ary_new ( ) ; xmlSetStructuredErrorFunc ( ( void * ) errors, Nokogiri_error_array_pusher ) ; # ifdef HAVE_XMLSCHEMASETPARSERSTRUCTUREDERRORS xmlSchemaSetParserStructuredErrors ( ctx, Nokogiri_error_array_pusher, ( void * ) errors ) ; # endif schema = xmlSchemaParse ( ctx ) ; xmlSetStructuredErrorFunc ( NULL, NULL ) ; xmlSchemaFreeParserCtxt ( ctx ) ; if ( NULL == schema ) { xmlErrorPtr error = xmlGetLastError ( ) ; if ( error ) Nokogiri_error_raise ( NULL, error ) ; else rb_raise ( rb_eRuntimeError, "Could   not   parse   document" ) ; return Qnil ; } rb_schema = Data_Wrap_Struct ( klass, 0, dealloc, schema ) ; rb_iv_set ( rb_schema, "@errors", errors ) ; <START_BUG> return rb_schema ; <END_BUG> }

Fix:
<S2SV_ModStart> VALUE read_memory ( int argc, VALUE * argv, VALUE klass ) { VALUE content ; VALUE parse_options ; int parse_options_int ; xmlSchemaParserCtxtPtr ctx ; <S2SV_ModEnd> xmlSchemaPtr schema ; <S2SV_ModStart> xmlSchemaPtr schema ; VALUE errors ; VALUE rb_schema ; int scanned_args = 0 ; scanned_args = rb_scan_args ( argc, argv, "11", & content, & parse_options ) ; if ( scanned_args == 1 ) { parse_options = rb_const_get ( rb_const_get ( mNokogiriXml, rb_intern ( "ParseOptions" ) ), rb_intern ( "DEFAULT_SCHEMA" ) ) ; } parse_options_int = ( int ) NUM2INT ( rb_funcall ( parse_options, rb_intern ( "to_i" ), 0 ) ) ; <S2SV_ModEnd> ctx = xmlSchemaNewMemParserCtxt <S2SV_ModStart> ( content ) ) ; <S2SV_ModEnd> errors = rb_ary_new <S2SV_ModStart> errors ) ; rb_iv_set ( rb_schema, "@parse_options", parse_options ) ;
Buggy code:
 static struct scatterlist * alloc_sgtable ( int size ) { int alloc_size, nents, i ; struct page * new_page ; struct scatterlist * iter ; struct scatterlist * table ; nents = DIV_ROUND_UP ( size, PAGE_SIZE ) ; table = kcalloc ( nents, sizeof ( * table ), GFP_KERNEL ) ; if (! table ) return NULL ; sg_init_table ( table, nents ) ; iter = table ; for_each_sg ( table, iter, sg_nents ( table ), i ) { new_page = alloc_page ( GFP_KERNEL ) ; if (! new_page ) { iter = table ; for_each_sg ( table, iter, sg_nents ( table ), i ) { new_page = sg_page ( iter ) ; if ( new_page ) __free_page ( new_page ) ; } <START_BUG> return NULL ; <END_BUG> } alloc_size = min_t ( int, size, PAGE_SIZE ) ; size -= PAGE_SIZE ; sg_set_page ( iter, new_page, alloc_size, 0 ) ; } return table ; }

Fix:
<S2SV_ModStart> ) ; } kfree ( table ) ;
Buggy code:
 static const uint8_t * decode_tiles ( VP9Decoder * pbi, const uint8_t * data, const uint8_t * data_end ) { <START_BUG> VP9_COMMON * const cm = & pbi -> common ; <END_BUG> const int aligned_cols = mi_cols_aligned_to_sb ( cm -> mi_cols ) ; const int tile_cols = 1 << cm -> log2_tile_cols ; const int tile_rows = 1 << cm -> log2_tile_rows ; TileBuffer tile_buffers [ 4 ] [ 1 << 6 ] ; int tile_row, tile_col ;  const uint8_t * end = NULL ; <START_BUG> <END_BUG> vp9_reader r ;  assert ( tile_rows <= 4 ) ; assert ( tile_cols <= ( 1 << 6 ) ) ; <START_BUG> vpx_memset ( cm -> above_context, 0, <END_BUG> sizeof ( * cm -> above_context ) * MAX_MB_PLANE * 2 * aligned_cols ) ;  vpx_memset ( cm -> above_seg_context, 0, <START_BUG> <END_BUG> sizeof ( * cm -> above_seg_context ) * aligned_cols ) ;  for ( tile_row = 0 ; tile_row < tile_rows ; ++ tile_row ) { for ( tile_col = 0 ; tile_col < tile_cols ; ++ tile_col ) { <START_BUG> const int last_tile = tile_row == tile_rows - 1 && <END_BUG> tile_col == tile_cols - 1 ; const size_t size = get_tile ( data_end, last_tile, & cm -> error, & data ) ; TileBuffer * const buf = & tile_buffers [ tile_row ] [ tile_col ] ; buf -> data = data ; buf -> size = size ; data += size ; } } for ( tile_row = 0 ; tile_row < tile_rows ; ++ tile_row ) { for ( tile_col = 0 ; tile_col < tile_cols ; ++ tile_col ) { const int col = pbi -> oxcf. inv_tile_order? tile_cols - tile_col - 1 : tile_col ; const int last_tile = tile_row == tile_rows - 1 && col == tile_cols - 1 ; const TileBuffer * const buf = & tile_buffers [

Fix:
<S2SV_ModStart> pbi -> common ; const VPxWorkerInterface * const winterface = vpx_get_worker_interface ( ) <S2SV_ModStart>, tile_col ; int mi_row, mi_col ; TileData * tile_data <S2SV_ModEnd> = NULL ; <S2SV_ModStart> = NULL ; if ( cm -> lf. filter_level &&! cm -> skip_loop_filter && pbi -> lf_worker. data1 == NULL ) { CHECK_MEM_ERROR ( cm, pbi -> lf_worker. data1, vpx_memalign ( 32, sizeof ( LFWorkerData ) ) ) ; pbi -> lf_worker. hook = ( VPxWorkerHook ) vp9_loop_filter_worker ; if ( pbi -> max_threads > 1 &&! winterface -> reset ( & pbi -> lf_worker ) ) { vpx_internal_error ( & cm -> error, VPX_CODEC_ERROR, "Loop <S2SV_blank> filter <S2SV_blank> thread <S2SV_blank> creation <S2SV_blank> failed" ) ; } } if ( cm -> lf. filter_level &&! cm -> skip_loop_filter ) { LFWorkerData * const lf_data = ( LFWorkerData * ) pbi -> lf_worker. data1 ;
Buggy code:
 static int i40e_setup_macvlans ( struct i40e_vsi * vsi, u16 macvlan_cnt, u16 qcnt, struct net_device * vdev ) { struct i40e_pf * pf = vsi -> back ; struct i40e_hw * hw = & pf -> hw ; struct i40e_vsi_context ctxt ; u16 sections, qmap, num_qps ; struct i40e_channel * ch ; int i, pow, ret = 0 ; u8 offset = 0 ; if ( vsi -> type!= I40E_VSI_MAIN ||! macvlan_cnt ) return - EINVAL ; num_qps = vsi -> num_queue_pairs - ( macvlan_cnt * qcnt ) ; pow = fls ( roundup_pow_of_two ( num_qps ) - 1 ) ; qmap = ( offset << I40E_AQ_VSI_TC_QUE_OFFSET_SHIFT ) | ( pow << I40E_AQ_VSI_TC_QUE_NUMBER_SHIFT ) ; sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID ; sections |= I40E_AQ_VSI_PROP_SCHED_VALID ; memset ( & ctxt, 0, sizeof ( ctxt ) ) ; ctxt. seid = vsi -> seid ; ctxt. pf_num = vsi -> back -> hw. pf_id ; ctxt. vf_num = 0 ; ctxt. uplink_seid = vsi -> uplink_seid ; ctxt. info = vsi -> info ; ctxt. info. tc_mapping [ 0 ] = cpu_to_le16 ( qmap ) ; ctxt. info. mapping_flags |= cpu_to_le16 ( I40E_AQ_VSI_QUE_MAP_CONTIG ) ; ctxt. info. queue_mapping [ 0 ] = cpu_to_le16 ( vsi -> base_queue ) ; ctxt. info. valid_sections |= cpu_to_le16 ( sections ) ; vsi -> rss_size = max_t ( u16, num_qps, qcnt ) ; ret = i40e_vsi_config_rss ( vsi ) ; if ( ret ) { dev_info ( & pf

Fix:
<S2SV_ModStart> - EINVAL ; kfree ( ch ) ;
Buggy code:
 int obj2ast_slice ( PyObject * obj, slice_ty * out, PyArena * arena ) { int isinstance ; PyObject * tmp = NULL ; if ( obj == Py_None ) { * out = NULL ; return 0 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) Slice_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { expr_ty lower ; expr_ty upper ; expr_ty step ; <START_BUG> if ( exists_not_none ( obj, & PyId_lower ) ) { <END_BUG> int res ;  tmp = _PyObject_GetAttrId ( obj, & PyId_lower ) ; <START_BUG> if ( tmp == NULL ) goto failed ; res = obj2ast_expr ( tmp, & lower, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; <END_BUG> } else {  lower = NULL ; } if ( exists_not_none ( obj, & PyId_upper ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_upper ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_expr ( tmp, & upper, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { upper = NULL ; } if ( exists_not_none ( obj, & PyId_step ) ) { int res ; tmp = _PyObject_GetAttrId ( obj, & PyId_step ) ; if ( tmp == NULL ) goto failed ; res = obj2ast_expr ( tmp, & step, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } else { step = NULL ; } * out = Slice ( lower, upper, step, arena ) ; if ( * out == NULL ) goto failed ; return 0 ; } isinstance = PyObject_IsInstance ( obj, ( PyObject * ) ExtSlice_type ) ; if ( isinstance == - 1 ) { return 1 ; } if ( isinstance ) { asdl_seq * dims ; if ( _PyObject_HasAttrId ( obj, & PyId_dims ) ) { int res ; Py_ssize_t len ; <START_BUG> Py_ssize_t i ; <END_BUG> tmp = _PyObject

Fix:
<S2SV_ModStart> ; if ( lookup_attr_id <S2SV_ModEnd> ( obj, <S2SV_ModStart>, & PyId_lower, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; lower = NULL ; } else <S2SV_ModEnd> { int res <S2SV_ModStart> int res ; <S2SV_ModEnd> res = obj2ast_expr <S2SV_ModStart> ) ; } if ( lookup_attr_id ( obj, & PyId_upper, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; upper = NULL ; } else { int res ; res = obj2ast_expr ( tmp, & upper, arena ) ; if ( res!= 0 ) goto failed ; Py_CLEAR ( tmp ) ; } if ( lookup_attr_id ( obj, & PyId_step, & tmp ) < 0 ) { return 1 ; } if ( tmp == NULL || tmp == Py_None ) { Py_CLEAR ( tmp ) ; step = NULL ; } else { int res ; res = obj2ast_expr ( tmp, & step, arena ) ; if ( res!= 0 ) goto
Buggy code:
 <START_BUG> int ip_options_get_from_user ( struct net * net, struct ip_options * * optp, <END_BUG> unsigned char __user * data, int optlen ) {  struct ip_options * opt = ip_options_get_alloc ( optlen ) ; <START_BUG> if (! opt ) return - ENOMEM ; <END_BUG> if ( optlen && copy_from_user ( opt -> __data, data, optlen ) ) {  kfree ( opt ) ; return - EFAULT ; } return ip_options_get_finish ( net, optp, opt, optlen ) ; }

Fix:
<S2SV_ModStart> net, struct ip_options_rcu <S2SV_ModEnd> * * optp <S2SV_ModStart> ) { struct ip_options_rcu <S2SV_ModEnd> * opt = <S2SV_ModStart> ( opt -> opt.
Buggy code:
 static void write_display_size ( const VP9_COMMON * cm, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG> const int scaling_active = cm -> width!= cm -> display_width || cm -> height!= cm -> display_height ;  vp9_wb_write_bit ( wb, scaling_active ) ; <START_BUG> if ( scaling_active ) { <END_BUG> vp9_wb_write_literal ( wb, cm -> display_width - 1, 16 ) ;  <START_BUG> vp9_wb_write_literal ( wb, cm -> display_height - 1, 16 ) ; <END_BUG> } }

Fix:
<S2SV_ModStart> cm, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> -> display_height ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> scaling_active ) { vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> 16 ) ; vpx_wb_write_literal <S2SV_ModEnd> ( wb,
Buggy code:
 vpx_codec_err_t vpx_codec_encode ( vpx_codec_ctx_t * ctx, const vpx_image_t * img, vpx_codec_pts_t pts, unsigned long duration, vpx_enc_frame_flags_t flags, unsigned long deadline ) { vpx_codec_err_t res = VPX_CODEC_OK ; if (! ctx || ( img &&! duration ) ) res = VPX_CODEC_INVALID_PARAM ; else if (! ctx -> iface ||! ctx -> priv ) res = VPX_CODEC_ERROR ; else if (! ( ctx -> iface -> caps & VPX_CODEC_CAP_ENCODER ) ) res = VPX_CODEC_INCAPABLE ; else { unsigned int num_enc = ctx -> priv -> enc. total_encoders ; FLOATING_POINT_INIT ( ) ; if ( num_enc == 1 ) <START_BUG> res = ctx -> iface -> enc. encode ( ctx -> priv -> alg_priv, img, pts, <END_BUG> duration, flags, deadline ) ; else { int i ; ctx += num_enc - 1 ; if ( img ) img += num_enc - 1 ; for ( i = num_enc - 1 ; i >= 0 ; i -- ) {  if ( ( res = ctx -> iface -> enc. encode ( ctx -> priv -> alg_priv, img, pts, <START_BUG> duration, flags, deadline ) ) ) break ; ctx -- ; if ( img ) img -- ; } ctx ++ ; } FLOATING_POINT_RESTORE ( ) ; } return SAVE_STATUS ( ctx, res ) ; }<END_BUG>

Fix:
<S2SV_ModStart>. encode ( get_alg_priv ( ctx ) <S2SV_ModEnd>, img, <S2SV_ModStart>. encode ( get_alg_priv ( ctx ) <S2SV_ModEnd>, img,
Buggy code:
 VOID ixheaacd_esbr_radix4bfly ( const WORD32 * w, WORD32 * x, WORD32 index1, WORD32 index ) { int i ; WORD32 l1, l2, h2, fft_jmp ; <START_BUG> WORD32 xt0_0, yt0_0, xt1_0, yt1_0, xt2_0, yt2_0 ; <END_BUG>  WORD32 xh0_0, xh1_0, xh20_0, xh21_0, xl0_0, xl1_0, xl20_0, xl21_0 ; <START_BUG> WORD32 x_0, x_1, x_l1_0, x_l1_1, x_l2_0, x_l2_1 ; WORD32 x_h2_0, x_h2_1 ; WORD32 si10, si20, si30, co10, co20, co30 ; WORD64 mul_1, mul_2, mul_3, mul_4, mul_5, mul_6 ; WORD64 mul_7, mul_8, mul_9, mul_10, mul_11, mul_12 ; WORD32 * x_l1 ; WORD32 * x_l2 ; WORD32 * x_h2 ; const WORD32 * w_ptr = w ; WORD32 i1 ; h2 = index << 1 ; l1 = index << 2 ; l2 = ( index << 2 ) + ( index << 1 ) ; x_l1 = & ( x [ l1 ] ) ; x_l2 = & ( x [ l2 ] ) ; x_h2 = & ( x [ h2 ] ) ; fft_jmp = 6 * ( index ) ; for ( i1 = 0 ; i1 < index1 ; i1 ++ ) { for ( i = 0 ; i < index ; i ++ ) { si10 = ( * w_ptr ++ ) ; co10 = ( * w_ptr ++ ) ; si20 = ( * w_ptr ++ ) ; co20 = ( * w_ptr ++ ) ; si30 = ( * w_ptr ++ ) ; co30 = ( * w_ptr ++ ) ; x_0 = x [ 0 ] ; x_h2_0 = x [ h2 ]<END_BUG>

Fix:
<S2SV_ModStart>, fft_jmp ; WORD64 <S2SV_ModEnd> xt0_0, yt0_0 <S2SV_ModStart>, yt2_0 ; WORD64 <S2SV_ModEnd> xh0_0, xh1_0 <S2SV_ModStart> ; xh0_0 = ( WORD64 ) x_0 + ( WORD64 ) <S2SV_ModEnd> x_l1_0 ; xl0_0 <S2SV_ModStart> ; xl0_0 = ( WORD64 ) x_0 - ( WORD64 ) <S2SV_ModEnd> x_l1_0 ; xh20_0 <S2SV_ModStart> ; xh20_0 = ( WORD64 ) x_h2_0 + ( WORD64 ) <S2SV_ModEnd> x_l2_0 ; xl20_0 <S2SV_ModStart> ; xl20_0 = ( WORD64 ) x_h2_0 - ( WORD64 ) <S2SV_ModEnd> x_l2_0 ; x <S2SV_ModStart> 0 ] = ( WORD32 ) ixheaacd_add64_sat ( xh0_0, xh20_0 ) <S2SV_ModEnd> ; xt0_0 = <S2SV_ModStart> ; xt0_0 = ( WORD64 ) xh0_0 - ( WORD64 ) <S2SV_ModEnd> xh20_0 ; x_1 <S2SV_ModStart> ; xh1_0 = ( WORD64 ) x_
Buggy code:
 uint16_t dm9000ReadPhyReg ( uint8_t address ) { <START_BUG> dm9000WriteReg ( DM9000_REG_EPAR, 0x40 | address ) ; <END_BUG>  dm9000WriteReg ( DM9000_REG_EPCR, EPCR_EPOS | EPCR_ERPRR ) ; <START_BUG> <END_BUG> while ( ( dm9000ReadReg ( DM9000_REG_EPCR ) & EPCR_ERRE )!= 0 )  { } <START_BUG> dm9000WriteReg ( DM9000_REG_EPCR, EPCR_EPOS ) ; <END_BUG> usleep ( 5 ) ;  return ( dm9000ReadReg ( DM9000_REG_EPDRH ) << 8 ) | dm9000ReadReg ( DM9000_REG_EPDRL ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> { dm9000WriteReg ( DM9000_EPAR <S2SV_ModEnd>, 0x40 | <S2SV_ModStart> ; dm9000WriteReg ( DM9000_EPCR, DM9000_EPCR_EPOS | DM9000_EPCR_ERPRR <S2SV_ModEnd> ) ; while <S2SV_ModStart> ( dm9000ReadReg ( DM9000_EPCR ) & DM9000_EPCR_ERRE <S2SV_ModEnd> )!= 0 <S2SV_ModStart> } dm9000WriteReg ( DM9000_EPCR, DM9000_EPCR_EPOS <S2SV_ModEnd> ) ; usleep <S2SV_ModStart> ( dm9000ReadReg ( DM9000_EPDRH <S2SV_ModEnd> ) << 8 <S2SV_ModStart> | dm9000ReadReg ( DM9000_EPDRL <S2SV_ModEnd> ) ; }
Buggy code:
 char * _dl_dst_substitute ( struct link_map * l, const char * name, char * result, int is_path ) { <START_BUG> char * last_elem, * wp ; <END_BUG> last_elem = wp = result ; do { if ( * name == '$' ) { const char * repl ; size_t len ;  if ( ( ( ( strncmp ( & name [ 1 ], "ORIGIN", 6 ) == 0 && ( len = 7 )!= 0 ) <START_BUG> <END_BUG> || ( strncmp ( & name [ 1 ], "PLATFORM", 8 ) == 0 && ( len = 9 )!= 0 ) )  && ( name [ len ] == '\\0' || name [ len ] == '//' || ( is_path && name [ len ] == ':' ) ) ) || ( name [ 1 ] == '{' && ( ( strncmp ( & name [ 2 ], "ORIGIN}", 7 ) == 0 && ( len = 9 )!= 0 ) || ( strncmp ( & name [ 2 ], "PLATFORM}", 9 ) == 0 && ( len = 11 )!= 0 ) ) ) ) { repl = ( ( len == 7 || name [ 2 ] == 'O' ) <START_BUG>? ( __libc_enable_secure? NULL : l -> l_origin ) <END_BUG> : _dl_platform ) ; if ( repl!= NULL && repl!= ( const char * ) - 1 ) { wp = __stpcpy ( wp, repl ) ; name += len ; } else { wp = last_elem ; name += len ; while ( * name!= '\\0' && (! is_path || * name!= ':' ) ) ++ name ; } } else * wp ++ = * name ++ ; } else if ( is_path && * name == ':' ) { * wp ++ = * name ++ ; last_elem = wp ; } else * wp ++ = * name ++ ; } while ( * name!= '\\0' ) ; * wp = '\\0' ; return result ; }

Fix:
<S2SV_ModStart> is_path ) { const char * const start = name ; <S2SV_ModStart> 1 ], "ORIGIN}" <S2SV_ModEnd>, 6 ) <S2SV_ModStart> 1 ], "PLATFORM}" <S2SV_ModEnd>, 8 ) <S2SV_ModStart>? ( __libc_enable_secure && ( ( name [ len ]!= '\\0' && (! is_path || name [ len ]!= ':' ) ) || ( name!= start && (! is_path || name [ - 1 ]!= ':' ) ) )
Buggy code:
 static int do_ipv6_getsockopt ( struct sock * sk, int level, int optname, char __user * optval, int __user * optlen, unsigned int flags ) { struct ipv6_pinfo * np = inet6_sk ( sk ) ; int len ; int val ; if ( ip6_mroute_opt ( optname ) ) return ip6_mroute_getsockopt ( sk, optname, optval, optlen ) ; if ( get_user ( len, optlen ) ) return - EFAULT ; switch ( optname ) { case IPV6_ADDRFORM : if ( sk -> sk_protocol!= IPPROTO_UDP && sk -> sk_protocol!= IPPROTO_UDPLITE && sk -> sk_protocol!= IPPROTO_TCP ) return - ENOPROTOOPT ; if ( sk -> sk_state!= TCP_ESTABLISHED ) return - ENOTCONN ; val = sk -> sk_family ; break ; case MCAST_MSFILTER : { struct group_filter gsf ; int err ; if ( len < GROUP_FILTER_SIZE ( 0 ) ) return - EINVAL ; if ( copy_from_user ( & gsf, optval, GROUP_FILTER_SIZE ( 0 ) ) ) return - EFAULT ; if ( gsf. gf_group. ss_family!= AF_INET6 ) return - EADDRNOTAVAIL ; lock_sock ( sk ) ; err = ip6_mc_msfget ( sk, & gsf, ( struct group_filter __user * ) optval, optlen ) ; release_sock ( sk ) ; return err ; } case IPV6_2292PKTOPTIONS : { struct msghdr msg ; struct sk_buff * skb ; if ( sk -> sk_type!= SOCK_STREAM ) return - ENOPROTOOPT ; msg. msg_control = optval ; msg. msg_controllen = len ; msg. msg_flags = flags ; lock_sock ( sk ) ; skb = np -> pktoptions ; if ( skb ) ip6_datagram_recv_ctl ( sk, & msg, skb ) ; release_sock ( sk ) ; if (! skb ) { if ( np -> rxopt. bits. rxinfo ) { struct in6_pktinfo src_info ; src_info. ipi6_ifindex

Fix:
<S2SV_ModStart> IPV6_DSTOPTS : { struct ipv6_txoptions * opt ; <S2SV_ModStart> sk ) ; opt = rcu_dereference_protected ( np -> opt, sock_owned_by_user ( sk ) ) ; <S2SV_ModStart> ( sk, <S2SV_ModEnd> opt, optname
Buggy code:
 void vp9_vaq_frame_setup ( VP9_COMP * cpi ) { VP9_COMMON * cm = & cpi -> common ; <START_BUG> struct segmentation * seg = & cm -> seg ; <END_BUG> const double base_q = vp9_convert_qindex_to_q ( cm -> base_qindex ) ; const int base_rdmult = vp9_compute_rd_mult ( cpi, cm -> base_qindex + cm -> y_dc_delta_q ) ; int i ; if ( cm -> frame_type == KEY_FRAME || cpi -> refresh_alt_ref_frame || ( cpi -> refresh_golden_frame &&! cpi -> rc. is_src_frame_alt_ref ) ) { vp9_enable_segmentation ( seg ) ; vp9_clearall_segfeatures ( seg ) ; seg -> abs_delta = SEGMENT_DELTADATA ;  vp9_clear_system_state ( ) ; <START_BUG> <END_BUG> for ( i = ENERGY_MIN ; i <= ENERGY_MAX ; i ++ ) {  <START_BUG> int qindex_delta, segment_rdmult ; <END_BUG>  if ( Q_RATIO ( i ) == 1 ) { <START_BUG> RDMULT_RATIO ( i ) = 1 ; continue ; } <END_BUG> qindex_delta = vp9_compute_qdelta ( & cpi -> rc, base_q, base_q * Q_RATIO ( i ) ) ;  <START_BUG> vp9_set_segdata ( seg, SEGMENT_ID ( i ), SEG_LVL_ALT_Q, qindex_delta ) ; <END_BUG>  vp9_enable_segfeature ( seg, SEGMENT_ID ( i ), SEG_LVL_ALT_Q ) ; <START_BUG> <END_BUG> segment_rdmult = vp9_compute_rd_mult ( cpi, cm -> base_qindex + qindex_delta +  cm -> y_dc_delta_q ) ; RDMULT_RATIO ( i ) = ( double ) segment_rdmult // base_rdmult ; } } }

Fix:
<S2SV_ModStart> cm -> seg <S2SV_ModEnd> ; int i <S2SV_ModStart> = SEGMENT_DELTADATA ; vpx_clear_system_state <S2SV_ModEnd> ( ) ; <S2SV_ModStart> ( i = 0 ; i < MAX_SEGMENTS ; ++ i <S2SV_ModEnd> ) { int <S2SV_ModStart> { int qindex_delta = vp9_compute_qdelta_by_rate ( & cpi -> rc, cm -> frame_type, cm -> base_qindex, rate_ratio [ i ], cm -> bit_depth ) <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; if ( ( cm -> base_qindex!= 0 ) && ( ( cm -> base_qindex + qindex_delta ) == 0 ) ) { qindex_delta = - cm -> base_qindex + 1 ; } if ( rate_ratio [ i ] == 1.0 ) { <S2SV_ModEnd> continue ; } <S2SV_ModStart> continue ; } <S2SV_ModEnd> vp9_set_segdata ( seg <S2SV_ModStart> ( seg, i <S2SV_ModEnd>, SEG_LVL_ALT_Q, <S2SV_ModStart> ( seg, i <S2SV_ModEnd>, SEG_LVL_ALT_Q ) <S2SV_ModStart> SEG_LVL_ALT_Q ) ; <S2SV_ModEnd> } } }