nus-yam/ex-repair huggingface dataset:
Buggy code:
 int ceph_set_acl ( struct inode * inode, struct posix_acl * acl, int type ) { int ret = 0, size = 0 ; const char * name = NULL ; char * value = NULL ; struct iattr newattrs ; umode_t new_mode = inode -> i_mode, old_mode = inode -> i_mode ; switch ( type ) { case ACL_TYPE_ACCESS : name = XATTR_NAME_POSIX_ACL_ACCESS ; if ( acl ) { <START_BUG> ret = posix_acl_equiv_mode ( acl, & new_mode ) ; <END_BUG> if ( ret < 0 ) goto out ; if ( ret == 0 ) acl = NULL ; } break ; case ACL_TYPE_DEFAULT : if (! S_ISDIR ( inode -> i_mode ) ) { ret = acl? - EINVAL : 0 ; goto out ; } name = XATTR_NAME_POSIX_ACL_DEFAULT ; break ; default : ret = - EINVAL ; goto out ; } if ( acl ) { size = posix_acl_xattr_size ( acl -> a_count ) ; value = kmalloc ( size, GFP_NOFS ) ; if (! value ) { ret = - ENOMEM ; goto out ; } ret = posix_acl_to_xattr ( & init_user_ns, acl, value, size ) ; if ( ret < 0 ) goto out_free ; } if ( new_mode!= old_mode ) { newattrs. ia_mode = new_mode ; newattrs. ia_valid = ATTR_MODE ; ret = __ceph_setattr ( inode, & newattrs ) ; if ( ret ) goto out_free ; } ret = __ceph_setxattr ( inode, name, value, size, 0 ) ; if ( ret ) { if ( new_mode!= old_mode ) { newattrs. ia_mode = old_mode ; newattrs. ia_valid = ATTR_MODE ; __ceph_setattr ( inode, & newattrs ) ; } goto out_free ; } ceph_set_cached_acl ( inode, type, acl ) ; out_free : kfree ( value ) ; out : return ret ; }

Fix:
<S2SV_ModStart> { ret = posix_acl_update_mode ( inode, & new_mode, & acl ) ; if ( ret ) goto out <S2SV_ModEnd> ; } break
Buggy code:
 void vp9_lookahead_destroy ( struct lookahead_ctx * ctx ) { if ( ctx ) { if ( ctx -> buf ) { unsigned int i ; for ( i = 0 ; i < ctx -> max_sz ; i ++ ) <START_BUG> vp9_free_frame_buffer ( & ctx -> buf [ i ]. img ) ; <END_BUG> free ( ctx -> buf ) ; } free ( ctx ) ; } }

Fix:
<S2SV_ModStart> i ++ ) vpx_free_frame_buffer <S2SV_ModEnd> ( & ctx
Buggy code:
 error_t httpParseParam ( const char_t * * pos, HttpParam * param ) { error_t error ; size_t i ; uint8_t c ; bool_t escapeFlag ; bool_t separatorFound ; const char_t * p ; if ( pos == NULL || param == NULL ) return ERROR_INVALID_PARAMETER ; param -> name = NULL ; param -> nameLen = 0 ; param -> value = NULL ; param -> valueLen = 0 ; escapeFlag = FALSE ; separatorFound = FALSE ; error = ERROR_IN_PROGRESS ; i = 0 ; p = * pos ; while ( error == ERROR_IN_PROGRESS ) { c = ( uint8_t ) p [ i ] ; if ( param -> name == NULL ) { if ( c == '\\0' ) { error = ERROR_NOT_FOUND ; } else if ( c ==' '|| c == '\\t' || c == ',' || c == ';' ) { } <START_BUG> else if ( isalnum ( c ) || strchr ( "!#$%&\'*+-.^_`|~", c ) || c >= 128 ) <END_BUG> { param -> name = p + i ; } else { error = ERROR_INVALID_SYNTAX ; } } else if ( param -> nameLen == 0 ) { if ( c == '\\0' || c == ',' || c == ';' ) { param -> nameLen = p + i - param -> name ; error = NO_ERROR ; } else if ( c ==' '|| c == '\\t' ) { param -> nameLen = p + i - param -> name ; } else if ( c == '=' ) { separatorFound = TRUE ; param -> nameLen = p + i - param -> name ; }  else if ( isalnum ( c ) || strchr ( "!#$%&\'*+-.^_`|~", c ) || c >= 128 ) <START_BUG> { } else { error = ERROR_INVALID_SYNTAX ; } } else if (! separatorFound ) { if ( c == '\\0' || c == ',' || c == ';' ) { error = NO_ERROR ; } else if ( c ==' '|| c == '\\t' ) { } else if ( c == '=' ) { separatorFound = TRUE ; } else if ( c == \'\\"\' ) { i = param -> name + param -> nameLen - p ; error<END_BUG>

Fix:
<S2SV_ModStart> c ) || osStrchr <S2SV_ModEnd> ( "!#$%&\'*+-.^_`|~", <S2SV_ModStart> c ) || osStrchr <S2SV_ModEnd> ( "!#$%&\'*+-.^_`|~", <S2SV_ModStart> c ) || osStrchr <S2SV_ModEnd> ( "!#$%&\'*+-.^_`|~", <S2SV_ModStart> c ) || osStrchr <S2SV_ModEnd> ( "!#$%&\'*+-.^_`|~", <S2SV_ModStart> c ) || osStrchr <S2SV_ModEnd> ( "!#$%&\'*+-.^_`|~",
Buggy code:
 static MagickBooleanType DecodeImage ( Image * image, unsigned char * luma, unsigned char * chroma1, unsigned char * chroma2, ExceptionInfo * exception ) { # define IsSync ( sum ) ( ( sum & 0xffffff00UL ) == 0xfffffe00UL ) <START_BUG> # define PCDGetBits ( n ) { sum = ( sum << n ) & 0xffffffff ; bits -= n ; while ( bits <= 24 ) { if ( p >= ( buffer + 0x800 ) ) { count = ReadBlob ( image, 0x800, buffer ) ; p = buffer ; } sum |= ( ( unsigned int ) ( * p ) << ( 24 - bits ) ) ; bits += 8 ; p ++ ; } } <END_BUG> typedef struct PCDTable { unsigned int length, sequence ; MagickStatusType mask ; unsigned char key ; } PCDTable ; PCDTable * pcd_table [ 3 ] ; register ssize_t i, j ; register PCDTable * r ; register unsigned char * p, * q ; size_t bits, length, plane, pcd_length [ 3 ], row, sum ; ssize_t count, quantum ; unsigned char * buffer ; assert ( image!= ( const Image * ) NULL ) ; assert ( image -> signature == MagickCoreSignature ) ; if ( image -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image -> filename ) ; assert ( luma!= ( unsigned char * ) NULL ) ; assert ( chroma1!= ( unsigned char * ) NULL ) ; assert ( chroma2!= ( unsigned char * ) NULL ) ; buffer = ( unsigned char * ) AcquireQuantumMemory ( 0x800, sizeof ( * buffer ) ) ; if ( buffer == ( unsigned char * ) NULL ) ThrowBinaryException ( ResourceLimitError, "MemoryAllocationFailed", image -> filename ) ; sum = 0 ; bits = 32 ; p = buffer + 0x800 ; for ( i = 0 ; i < 3 ; i ++ ) { pcd_table [ i ] = ( PCDTable * ) NULL ; pcd_length [ i ] = 0 ; } for ( i = 0 ; i < ( image -> columns > 1536? 3 : 1 ) ; i ++ ) { PCDGetBits ( 8 ) ; length = ( sum

Fix:
<S2SV_ModStart> ( n ) \\\n{ <S2SV_ModEnd> sum = ( <S2SV_ModStart> ++ ; } \\\n} <S2SV_ModEnd> typedef struct PCDTable <S2SV_ModStart> buffer ) ; for ( j = 0 ; j < i ; j ++ ) pcd_table [ j ] = ( PCDTable * ) RelinquishMagickMemory ( pcd_table [ j ] ) ; <S2SV_ModStart> RelinquishMagickMemory ( buffer ) ; for ( j = 0 ; j <= i ; j ++ ) pcd_table [ j ] = ( PCDTable * ) RelinquishMagickMemory ( pcd_table [ j ]
Buggy code:
 static void write_uncompressed_header ( VP9_COMP * cpi, <START_BUG> struct vp9_write_bit_buffer * wb ) { <END_BUG> VP9_COMMON * const cm = & cpi -> common ;  vp9_wb_write_literal ( wb, VP9_FRAME_MARKER, 2 ) ; <START_BUG> write_profile ( cm -> profile, wb ) ; <END_BUG> vp9_wb_write_bit ( wb, 0 ) ;  <START_BUG> vp9_wb_write_bit ( wb, cm -> frame_type ) ; <END_BUG>  vp9_wb_write_bit ( wb, cm -> show_frame ) ; <START_BUG> <END_BUG> vp9_wb_write_bit ( wb, cm -> error_resilient_mode ) ;  if ( cm -> frame_type == KEY_FRAME ) { <START_BUG> const COLOR_SPACE cs = UNKNOWN ; <END_BUG> write_sync_code ( wb ) ;  if ( cm -> profile > PROFILE_1 ) { <START_BUG> assert ( cm -> bit_depth > BITS_8 ) ; vp9_wb_write_bit ( wb, cm -> bit_depth - BITS_10 ) ; } vp9_wb_write_literal ( wb, cs, 3 ) ; if ( cs!= SRGB ) { vp9_wb_write_bit ( wb, 0 ) ; if ( cm -> profile >= PROFILE_1 ) { vp9_wb_write_bit ( wb, cm -> subsampling_x ) ; vp9_wb_write_bit ( wb, cm -> subsampling_y ) ; vp9_wb_write_bit ( wb, 0 ) ; } } else { <END_BUG> assert ( cm -> profile == PROFILE_1 ) ;  vp9_wb_write_bit ( wb, 0 ) ; } write_frame_size ( cm, wb ) ; } else { if (! cm -> show_frame ) vp9_wb_write_bit ( wb, cm -> intra_only ) ; if (! cm -> error_resilient_mode ) vp9_wb_write_literal ( wb, cm -> reset_frame_context, 2 ) ; if ( cm -> intra_only ) { write_sync_code ( wb ) ; vp9_wb_write_literal ( wb, get_refresh_mask ( cpi ), REF_FRAMES ) ;

Fix:
<S2SV_ModStart> cpi, struct vpx_write_bit_buffer <S2SV_ModEnd> * wb ) <S2SV_ModStart> -> common ; MACROBLOCKD * const xd = & cpi -> td. mb. e_mbd ; vpx_wb_write_literal <S2SV_ModEnd> ( wb, <S2SV_ModStart> wb ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> 0 ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> frame_type ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> show_frame ) ; vpx_wb_write_bit <S2SV_ModEnd> ( wb, <S2SV_ModStart> KEY_FRAME ) { write_sync_code ( wb ) ; write_bitdepth_colorspace_sampling ( cm, wb ) ; write_frame_size ( cm, wb ) ; } else { if (! cm -> show_frame ) vpx_wb_write_bit ( wb, cm -> intra_only ) ; if (! cm -> error_resilient_mode ) vpx_wb_write_literal ( wb, cm -> reset_frame_context, 2 ) ; if ( cm -> intra_only ) { <S2SV_ModEnd> write_sync_code ( wb <S2SV_ModStart> -> profile > PROFILE_
Buggy code:
 static __exit void sctp_exit ( void ) { sctp_v6_del_protocol ( ) ; sctp_v4_del_protocol ( ) ; <START_BUG> unregister_pernet_subsys ( & sctp_net_ops ) ; <END_BUG> sctp_v6_protosw_exit ( ) ;  sctp_v4_protosw_exit ( ) ; <START_BUG> sctp_v6_pf_exit ( ) ; sctp_v4_pf_exit ( ) ; sctp_sysctl_unregister ( ) ; free_pages ( ( unsigned long ) sctp_assoc_hashtable, get_order ( sctp_assoc_hashsize * sizeof ( struct sctp_hashbucket ) ) ) ; kfree ( sctp_ep_hashtable ) ; free_pages ( ( unsigned long ) sctp_port_hashtable, get_order ( sctp_port_hashsize * sizeof ( struct sctp_bind_hashbucket ) ) ) ; percpu_counter_destroy ( & sctp_sockets_allocated ) ; rcu_barrier ( ) ; kmem_cache_destroy ( sctp_chunk_cachep ) ; kmem_cache_destroy ( sctp_bucket_cachep ) ; }<END_BUG>

Fix:
<S2SV_ModStart> unregister_pernet_subsys ( & sctp_ctrlsock_ops <S2SV_ModEnd> ) ; sctp_v6_protosw_exit <S2SV_ModStart> ; sctp_v4_protosw_exit ( ) ; unregister_pernet_subsys ( & sctp_defaults_ops
Buggy code:
 static PyObject * ast_type_reduce ( PyObject * self, PyObject * unused ) { <START_BUG> PyObject * res ; <END_BUG> _Py_IDENTIFIER ( __dict__ ) ;  PyObject * dict = _PyObject_GetAttrId ( self, & PyId___dict__ ) ; <START_BUG> if ( dict == NULL ) { if ( PyErr_ExceptionMatches ( PyExc_AttributeError ) ) PyErr_Clear ( ) ; else return NULL ; } if ( dict ) { <END_BUG> res = Py_BuildValue ( "O()O", Py_TYPE ( self ), dict ) ;  Py_DECREF ( dict ) ; return res ; } return Py_BuildValue ( "O()", Py_TYPE ( self ) ) ; }

Fix:
<S2SV_ModStart> unused ) { <S2SV_ModEnd> _Py_IDENTIFIER ( __dict__ <S2SV_ModStart> PyObject * dict ; if ( lookup_attr_id <S2SV_ModEnd> ( self, <S2SV_ModStart>, & PyId___dict__, & dict ) < 0 ) { <S2SV_ModEnd> return NULL ; <S2SV_ModStart> dict ) { return Py_BuildValue ( "O()N" <S2SV_ModEnd>, Py_TYPE ( <S2SV_ModStart>, dict ) <S2SV_ModEnd> ; } return
Buggy code:
 void CleanWriters ( GF_List * writers ) { while ( gf_list_count ( writers ) ) { <START_BUG> TrackWriter * writer = ( TrackWriter * ) gf_list_get ( writers, 0 ) ; <END_BUG> gf_isom_box_del ( writer -> stco ) ; gf_isom_box_del ( ( GF_Box * ) writer -> stsc ) ; gf_free ( writer ) ; gf_list_rem ( writers, 0 ) ; } }

Fix:
<S2SV_ModStart> writers, 0 ) ; gf_list_del_item ( writer -> stbl -> child_boxes, writer -> stco ) ; gf_list_del_item ( writer -> stbl -> child_boxes, writer -> stsc
Buggy code:
 void lmp_print ( netdissect_options * ndo, register const u_char * pptr, register u_int len ) { const struct lmp_common_header * lmp_com_header ; const struct lmp_object_header * lmp_obj_header ; const u_char * tptr, * obj_tptr ; u_int tlen, lmp_obj_len, lmp_obj_ctype, obj_tlen ; <START_BUG> int hexdump ; <END_BUG> u_int offset ; u_int link_type ; union { float f ; uint32_t i ; } bw ; tptr = pptr ; lmp_com_header = ( const struct lmp_common_header * ) pptr ; ND_TCHECK ( * lmp_com_header ) ; if ( LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] )!= LMP_VERSION ) { ND_PRINT ( ( ndo, "LMP   version   %u   packet   not   supported", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ) ) ) ; return ; } if ( ndo -> ndo_vflag < 1 ) { ND_PRINT ( ( ndo, "LMPv%u   %s   Message,   length:   %u", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ), tok2str ( lmp_msg_type_values, "unknown   (%u)", lmp_com_header -> msg_type ), len ) ) ; return ; } tlen = EXTRACT_16BITS ( lmp_com_header -> length ) ; ND_PRINT ( ( ndo, "\\n\\tLMPv%u,   msg-type:   %s,   Flags:   [%s],   length:   %u", LMP_EXTRACT_VERSION ( lmp_com_header -> version_res [ 0 ] ), tok2str ( lmp_msg_type_values, "unknown,   type:   %u", lmp_com_header -> msg_type ), bittok2str ( lmp_header_flag_values, "none", lmp_

Fix:
<S2SV_ModStart> ; int hexdump, ret <S2SV_ModStart> ) ) ; ret = <S2SV_ModEnd> lmp_print_data_link_subobjs ( ndo <S2SV_ModStart>, 12 ) ; if ( ret == - 1 ) goto trunc ; if ( ret == TRUE <S2SV_ModStart> ) ) ; ret = <S2SV_ModEnd> lmp_print_data_link_subobjs ( ndo <S2SV_ModStart>, 36 ) ; if ( ret == - 1 ) goto trunc ; if ( ret == TRUE <S2SV_ModStart> ) ) ; ret = <S2SV_ModEnd> lmp_print_data_link_subobjs ( ndo <S2SV_ModStart>, 12 ) ; if ( ret == - 1 ) goto trunc ; if ( ret == TRUE
Buggy code:
 void vpx_yv12_copy_y_c ( const YV12_BUFFER_CONFIG * src_ybc, YV12_BUFFER_CONFIG * dst_ybc ) { int row ; const uint8_t * src = src_ybc -> y_buffer ; uint8_t * dst = dst_ybc -> y_buffer ; <START_BUG> for ( row = 0 ; row < src_ybc -> y_height ; ++ row ) { <END_BUG>  vpx_memcpy ( dst, src, src_ybc -> y_width ) ; <START_BUG> src += src_ybc -> y_stride ; dst += dst_ybc -> y_stride ; } }<END_BUG>

Fix:
<S2SV_ModStart> -> y_buffer ; # if CONFIG_VP9_HIGHBITDEPTH if ( src_ybc -> flags & YV12_FLAG_HIGHBITDEPTH ) { const uint16_t * src16 = CONVERT_TO_SHORTPTR ( src ) ; uint16_t * dst16 = CONVERT_TO_SHORTPTR ( dst ) ; <S2SV_ModStart> row ) { memcpy ( dst16, src16, src_ybc -> y_width * sizeof ( uint16_t ) ) ; src16 += src_ybc -> y_stride ; dst16 += dst_ybc -> y_stride ; } return ; } # endif for ( row = 0 ; row < src_ybc -> y_height ; ++ row ) { memcpy <S2SV_ModEnd> ( dst,
Buggy code:
 static Image * ReadCMYKImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * canvas_image, * image ; MagickBooleanType status ; MagickOffsetType scene ; QuantumInfo * quantum_info ; QuantumType quantum_type ; register ssize_t i ; size_t length ; ssize_t count, y ; unsigned char * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info ) ; if ( ( image -> columns == 0 ) || ( image -> rows == 0 ) ) ThrowReaderException ( OptionError, "MustSpecifyImageSize" ) ; SetImageColorspace ( image, CMYKColorspace ) ; if ( image_info -> interlace!= PartitionInterlace ) { status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } if ( DiscardBlobBytes ( image, image -> offset ) == MagickFalse ) ThrowFileException ( exception, CorruptImageError, "UnexpectedEndOfFile", image -> filename ) ; } canvas_image = CloneImage ( image, image -> extract_info. width, 1, MagickFalse, exception ) ; ( void ) SetImageVirtualPixelMethod ( canvas_image, BlackVirtualPixelMethod ) ; quantum_info = AcquireQuantumInfo ( image_info, canvas_image ) ; if ( quantum_info == ( QuantumInfo * ) NULL ) ThrowReaderException ( ResourceLimitError, "MemoryAllocationFailed" ) ; pixels = GetQuantumPixels ( quantum_info ) ; quantum_type = CMYKQuantum ; if ( LocaleCompare ( image_info -> magick, "CMYKA" ) == 0 ) { quantum_type = CMYKAQuantum ; image -> matte = MagickTrue ; } if ( image_

Fix:
<S2SV_ModStart> ) break ; status = SetImageExtent ( image, image -> columns, image -> rows ) ; if ( status == MagickFalse ) { InheritException ( exception, & image -> exception ) ; return ( DestroyImageList ( image ) ) ; }
Buggy code:
 static int br_parse_ip_options ( struct sk_buff * skb ) { struct ip_options * opt ; struct iphdr * iph ; struct net_device * dev = skb -> dev ; u32 len ; iph = ip_hdr ( skb ) ; opt = & ( IPCB ( skb ) -> opt ) ; if ( iph -> ihl < 5 || iph -> version!= 4 ) goto inhdr_error ; if (! pskb_may_pull ( skb, iph -> ihl * 4 ) ) goto inhdr_error ; iph = ip_hdr ( skb ) ; if ( unlikely ( ip_fast_csum ( ( u8 * ) iph, iph -> ihl ) ) ) goto inhdr_error ; len = ntohs ( iph -> tot_len ) ; if ( skb -> len < len ) { IP_INC_STATS_BH ( dev_net ( dev ), IPSTATS_MIB_INTRUNCATEDPKTS ) ; goto drop ; } else if ( len < ( iph -> ihl * 4 ) ) goto inhdr_error ; if ( pskb_trim_rcsum ( skb, len ) ) { IP_INC_STATS_BH ( dev_net ( dev ), IPSTATS_MIB_INDISCARDS ) ; goto drop ; } <START_BUG> if ( iph -> ihl == 5 ) { <END_BUG> memset ( IPCB ( skb ), 0, sizeof ( struct inet_skb_parm ) ) ; return 0 ;  } <START_BUG> opt -> optlen = iph -> ihl * 4 - sizeof ( struct iphdr ) ; if ( ip_options_compile ( dev_net ( dev ), opt, skb ) ) goto inhdr_error ; if ( unlikely ( opt -> srr ) ) { struct in_device * in_dev = __in_dev_get_rcu ( dev ) ; if ( in_dev &&! IN_DEV_SOURCE_ROUTE ( in_dev ) ) goto drop ; if ( ip_options_rcv_srr ( skb ) ) goto drop ; } return 0 ; inhdr_error : IP_INC_STATS_BH ( dev_net ( dev ), IPSTATS_MIB_INHDRERRORS ) ; drop : return<END_BUG>

Fix:
<S2SV_ModStart> drop ; } memset ( IPCB ( skb ), 0, sizeof ( struct inet_skb_parm ) ) ; <S2SV_ModStart> == 5 ) <S2SV_ModEnd> return 0 ; <S2SV_ModStart> return 0 ; <S2SV_ModEnd> opt -> optlen
Buggy code:
 <START_BUG> static int bad_format_imginfo ( <END_BUG> char * fmt ) {  char * ptr ; <START_BUG> int n = 0 ; ptr = fmt ; while ( * ptr!= '\\0' ) if ( * ptr ++ == '%' ) { if ( * ptr == '\\0' ) return 1 ; if ( * ptr == '%' ) ptr ++ ; else if ( * ptr =='s' || * ptr == 'S' ) { n = 1 ; ptr ++ ; } else { if ( * ptr ==' ') ptr ++ ; while ( * ptr >= '0' && * ptr <= '9' ) ptr ++ ; if ( * ptr ++!= 'l' ) return 1 ; if ( * ptr == 'u' ) ptr ++ ; else return 1 ; n ++ ; } } return ( n!= 3 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> <S2SV_null> <S2SV_ModEnd> int bad_format_imginfo ( <S2SV_ModStart> fmt ) { return bad_format_check ( "^" SAFE_STRING "%s" SAFE_STRING "%lu" SAFE_STRING "%lu" SAFE_STRING "$", fmt <S2SV_ModEnd> ) ; }
Buggy code:
 int sequencer_write ( int dev, struct file * file, const char __user * buf, int count ) { unsigned char event_rec [ EV_SZ ], ev_code ; int p = 0, c, ev_size ; int mode = translate_mode ( file ) ; dev = dev >> 4 ; DEB ( printk ( "sequencer_write(dev=%d,   count=%d)\\n", dev, count ) ) ; if ( mode == OPEN_READ ) return - EIO ; c = count ; while ( c >= 4 ) { if ( copy_from_user ( ( char * ) event_rec, & ( buf ) [ p ], 4 ) ) goto out ; ev_code = event_rec [ 0 ] ; if ( ev_code == SEQ_FULLSIZE ) { int err, fmt ; dev = * ( unsigned short * ) & event_rec [ 2 ] ; if ( dev < 0 || dev >= max_synthdev || synth_devs [ dev ] == NULL ) return - ENXIO ; if (! ( synth_open_mask & ( 1 << dev ) ) ) return - ENXIO ; fmt = ( * ( short * ) & event_rec [ 0 ] ) & 0xffff ; <START_BUG> err = synth_devs [ dev ] -> load_patch ( dev, fmt, buf, p + 4, c, 0 ) ; <END_BUG> if ( err < 0 ) return err ; return err ; } if ( ev_code >= 128 ) { if ( seq_mode == SEQ_2 && ev_code == SEQ_EXTENDED ) { printk ( KERN_WARNING "Sequencer:   Invalid   level   2   event   %x\\n", ev_code ) ; return - EINVAL ; } ev_size = 8 ; if ( c < ev_size ) { if (! seq_playing ) seq_startplay ( ) ; return count - c ; } if ( copy_from_user ( ( char * ) & event_rec [ 4 ], & ( buf ) [ p + 4 ], 4 ) ) goto out ; } else { if ( seq_mode == SEQ_2 ) { printk ( KERN_WARNING "Sequencer:   4   byte   event   in   level   2   mode\\n"

Fix:
<S2SV_ModStart> fmt, buf + p <S2SV_ModEnd>, c,
Buggy code:
 static void send_auth ( char * username, char * password ) { struct mt_packet data ; unsigned short width = 0 ; unsigned short height = 0 ; char * terminal = getenv ( "TERM" ) ; char md5data [ 100 ] ; unsigned char md5sum [ 17 ] ; <START_BUG> int plen ; <END_BUG> md5_state_t state ; # if defined ( __linux__ ) && defined ( _POSIX_MEMLOCK_RANGE ) mlock ( md5data, sizeof ( md5data ) ) ; mlock ( md5sum, sizeof ( md5data ) ) ; # endif  md5data [ 0 ] = 0 ; <START_BUG> <END_BUG> strncpy ( md5data + 1, password, 82 ) ;  md5data [ 83 ] = '\\0' ; <START_BUG> memcpy ( md5data + 1 + strlen ( password ), pass_salt, 16 ) ; <END_BUG> md5_init ( & state ) ;  md5_append ( & state, ( const md5_byte_t * ) md5data, strlen ( password ) + 17 ) ; <START_BUG> md5_finish ( & state, ( md5_byte_t * ) md5sum + 1 ) ; md5sum [ 0 ] = 0 ; init_packet ( & data, MT_PTYPE_DATA, srcmac, dstmac, sessionkey, outcounter ) ; plen = add_control_packet ( & data, MT_CPTYPE_PASSWORD, md5sum, 17 ) ; plen += add_control_packet ( & data, MT_CPTYPE_USERNAME, username, strlen ( username ) ) ; plen += add_control_packet ( & data, MT_CPTYPE_TERM_TYPE, terminal, strlen ( terminal ) ) ; if ( is_a_tty && get_terminal_size ( & width, & height )!= - 1 ) { width = htole16 ( width ) ; height = htole16 ( height ) ; plen += add_control_packet ( & data, MT_CPTYPE_TERM_WIDTH, & width, 2 ) ; plen += add_control_packet ( & data, MT_CPTYPE_TERM_HEIGHT, & height, 2 ) ; } outcounter += plen ; send_udp ( & data, 1 ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ; int plen, act_pass_len <S2SV_ModStart> ; # endif act_pass_len = strnlen ( password, 82 ) ; <S2SV_ModStart> = 0 ; memcpy <S2SV_ModEnd> ( md5data + <S2SV_ModStart>, password, act_pass_len ) <S2SV_ModEnd> ; memcpy ( <S2SV_ModStart> + 1 + act_pass_len <S2SV_ModEnd>, pass_salt, <S2SV_ModStart> ) md5data, 1 + act_pass_len + 16 <S2SV_ModEnd> ) ; md5_finish
Buggy code:
 static void WritePixel ( struct ngiflib_img * i, struct ngiflib_decode_context * context, u8 v ) { struct ngiflib_gif * p = i -> parent ; if ( v!= i -> gce. transparent_color ||! i -> gce. transparent_flag ) { # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif * context -> frbuff_p. p8 = v ; # ifndef NGIFLIB_INDEXED_ONLY } else * context -> frbuff_p. p32 = GifIndexToTrueColor ( i -> palette, v ) ; # endif } if ( -- ( context -> Xtogo ) <= 0 ) { # ifdef NGIFLIB_ENABLE_CALLBACKS if ( p -> line_cb ) p -> line_cb ( p, context -> line_p, context -> curY ) ; # endif context -> Xtogo = i -> width ; switch ( context -> pass ) { case 0 : context -> curY ++ ; break ; case 1 : context -> curY += 8 ; <START_BUG> if ( context -> curY >= p -> height ) { <END_BUG> context -> pass ++ ; context -> curY = i -> posY + 4 ; } break ; case 2 : context -> curY += 8 ;  if ( context -> curY >= p -> height ) { <START_BUG> context -> pass ++ ; context -> curY = i -> posY + 2 ; } break ; case 3 : context -> curY += 4 ; <END_BUG> if ( context -> curY >= p -> height ) {  context -> pass ++ ; context -> curY = i -> posY + 1 ; } break ; case 4 : context -> curY += 2 ; <START_BUG> break ; <END_BUG> } # ifndef NGIFLIB_INDEXED_ONLY if ( p -> mode & NGIFLIB_MODE_INDEXED ) { # endif # ifdef NGIFLIB_ENABLE_CALLBACKS context -> line_p. p8 = p -> frbuff. p8 + ( u32 ) context -> curY * p -> width ; context -> frbuff_p. p8 = context -> line_p. p8 + i -> posX ; # else context -> frbuff_p. p8 = p -> frbuff. p8 + (

Fix:
<S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 8 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> += 4 ; <S2SV_ModEnd> break ; case <S2SV_ModStart> ; break ; } while ( context -> pass > 0 && context -> pass < 4 && context -> curY >= p -> height ) { switch ( ++ context -> pass ) { case 2 : context -> curY = i -> posY + 4 ; break ; case 3 : context -> curY = i -> posY + 2 ; break ; case 4 : context -> curY = i -> posY + 1 ; break ; }
Buggy code:
 static int create_problem_dir ( GHashTable * problem_info, unsigned pid ) { if ( g_settings_nMaxCrashReportsSize > 0 ) { if ( low_free_space ( g_settings_nMaxCrashReportsSize, g_settings_dump_location ) ) exit ( 1 ) ; } gchar * dir_basename = g_hash_table_lookup ( problem_info, "basename" ) ; if (! dir_basename ) dir_basename = g_hash_table_lookup ( problem_info, FILENAME_TYPE ) ; char * path = xasprintf ( "%s//%s-%s-%u.new", g_settings_dump_location, dir_basename, iso_date_string ( NULL ), pid ) ; g_hash_table_remove ( problem_info, "basename" ) ; <START_BUG> struct dump_dir * dd = dd_create ( path, client_uid, DEFAULT_DUMP_DIR_MODE ) ; <END_BUG> if (! dd ) { error_msg_and_die ( "Error   creating   problem   directory   \'%s\'", path ) ; } dd_create_basic_files ( dd, client_uid, NULL ) ; dd_save_text ( dd, FILENAME_ABRT_VERSION, VERSION ) ; gpointer gpkey = g_hash_table_lookup ( problem_info, FILENAME_CMDLINE ) ; if (! gpkey ) { char * cmdline = get_cmdline ( pid ) ; if ( cmdline ) { dd_save_text ( dd, FILENAME_CMDLINE, cmdline ) ; free ( cmdline ) ; } } char uid_str [ sizeof ( long ) * 3 + 2 ] ; sprintf ( uid_str, "%lu", ( long ) client_uid ) ; dd_save_text ( dd, FILENAME_UID, uid_str ) ; GHashTableIter iter ; gpointer gpvalue ; g_hash_table_iter_init ( & iter, problem_info ) ; while ( g_hash_table_iter_next ( & iter, & gpkey, & gpvalue ) ) { dd_save_text ( dd, ( gchar * ) gpkey, ( gchar * ) gpvalue ) ; } dd_close ( dd ) ; g_hash_table_destroy ( problem_info ) ;

Fix:
<S2SV_ModStart> ( path, g_settings_privatereports? 0 :
Buggy code:
 int y4m_input_open ( y4m_input * _y4m, FILE * _fin, char * _skip, int _nskip, int only_420 ) { <START_BUG> char buffer [ 80 ] ; <END_BUG> int ret ; int i ; for ( i = 0 ; i < 79 ; i ++ ) { if ( _nskip > 0 ) { buffer [ i ] = * _skip ++ ; _nskip -- ; } else { if (! file_read ( buffer + i, 1, _fin ) ) return - 1 ; } if ( buffer [ i ] == '\\n' ) break ; } if ( _nskip > 0 ) return - 1 ; if ( i == 79 ) { fprintf ( stderr, "Error   parsing   header;   not   a   YUV2MPEG2   file?\\n" ) ; return - 1 ; } buffer [ i ] = '\\0' ; if ( memcmp ( buffer, "YUV4MPEG", 8 ) ) { fprintf ( stderr, "Incomplete   magic   for   YUV4MPEG   file.\\n" ) ; return - 1 ; } if ( buffer [ 8 ]!= '2' ) { fprintf ( stderr, "Incorrect   YUV   input   file   version;   YUV4MPEG2   required.\\n" ) ; } ret = y4m_parse_tags ( _y4m, buffer + 5 ) ; if ( ret < 0 ) { fprintf ( stderr, "Error   parsing   YUV4MPEG2   header.\\n" ) ; return ret ; } if ( _y4m -> interlace == '?' ) { fprintf ( stderr, "Warning:   Input   video   interlacing   format   unknown;   " "assuming   progressive   scan.\\n" ) ; } else if ( _y4m -> interlace!= 'p' ) { fprintf ( stderr, "Input   video   is   interlaced;   " "Only   progressive   scan   handled.\\n" ) ; return - 1 ; } _y4m -> vpx_fmt = VPX_IMG_FMT_I420 ;  _y4m -> vpx_bps = 12 ; <START_BUG> <END_BUG> if ( strcmp ( _y4m -> chroma_

Fix:
<S2SV_ModStart> [ 80 ] = { 0 } <S2SV_ModStart> ; _y4m -> bps <S2SV_ModEnd> = 12 ; <S2SV_ModStart> = 12 ; _y4m -> bit_depth = 8 ; <S2SV_ModStart> -> chroma_type, "420p10" ) == 0 ) { _y4m -> src_c_dec_h = 2 ; _y4m -> dst_c_dec_h = 2 ; _y4m -> src_c_dec_v = 2 ; _y4m -> dst_c_dec_v = 2 ; _y4m -> dst_buf_read_sz = 2 * ( _y4m -> pic_w * _y4m -> pic_h + 2 * ( ( _y4m -> pic_w + 1 ) // 2 ) * ( ( _y4m -> pic_h + 1 ) // 2 ) ) ; _y4m -> aux_buf_sz = _y4m -> aux_buf_read_sz = 0 ; _y4m -> convert = y4m_convert_null ; _y4m -> bit_depth = 10 ; _y4m -> bps = 15 ; _y4m -> vpx
Buggy code:
 int mi_repair_parallel ( MI_CHECK * param, register MI_INFO * info, <START_BUG> const char * name, int rep_quick ) <END_BUG> { int got_error ; uint i, key, total_key_length, istep ; ulong rec_length ; ha_rows start_records ; my_off_t new_header_length, del ; File new_file ; MI_SORT_PARAM * sort_param = 0 ; MYISAM_SHARE * share = info -> s ; ulong * rec_per_key_part ; HA_KEYSEG * keyseg ; char llbuff [ 22 ] ; IO_CACHE new_data_cache ; IO_CACHE_SHARE io_share ; SORT_INFO sort_info ; ulonglong UNINIT_VAR ( key_map ) ; pthread_attr_t thr_attr ; ulong max_pack_reclength ; int error ; DBUG_ENTER ( "mi_repair_parallel" ) ; start_records = info -> state -> records ; got_error = 1 ; new_file = - 1 ; new_header_length = ( param -> testflag & T_UNPACK )? 0 : share -> pack. header_length ; if (! ( param -> testflag & T_SILENT ) ) { printf ( "-   parallel   recovering   (with   sort)   MyISAM-table   \'%s\'\\n", name ) ; printf ( "Data   records:   %s\\n", llstr ( start_records, llbuff ) ) ; } param -> testflag |= T_REP ; if ( info -> s -> options & ( HA_OPTION_CHECKSUM | HA_OPTION_COMPRESS_RECORD ) ) param -> testflag |= T_CALC_CHECKSUM ; DBUG_PRINT ( "info", ( "is   quick   repair:   %d", rep_quick ) ) ; bzero ( ( char * ) & sort_info, sizeof ( sort_info ) ) ; mysql_mutex_init ( mi_key_mutex_MI_SORT_INFO_mutex, & sort_info. mutex, MY_MUTEX_INIT_FAST ) ; mysql_cond_init ( mi_key_cond_MI_SORT_INFO_cond, & sort_info. cond

Fix:
<S2SV_ModStart>, int rep_quick, my_bool no_copy_stat <S2SV_ModStart> 0 ) { myf flags = 0 ; if ( param -> testflag & T_BACKUP_DATA ) flags |= MY_REDEL_MAKE_BACKUP ; if ( no_copy_stat ) flags |= MY_REDEL_NO_COPY_STAT ; <S2SV_ModStart>, DATA_TMP_EXT, flags <S2SV_ModEnd> ) || mi_open_datafile
Buggy code:
 static vpx_codec_err_t vp8e_init ( vpx_codec_ctx_t * ctx, vpx_codec_priv_enc_mr_cfg_t * mr_cfg ) { vpx_codec_err_t res = VPX_CODEC_OK ; <START_BUG> struct vpx_codec_alg_priv * priv ; <END_BUG> vpx_codec_enc_cfg_t * cfg ; unsigned int i ; struct VP8_COMP * optr ; vp8_rtcd ( ) ; if (! ctx -> priv ) {  priv = calloc ( 1, sizeof ( struct vpx_codec_alg_priv ) ) ; <START_BUG> if (! priv ) { return VPX_CODEC_MEM_ERROR ; } <END_BUG> ctx -> priv = & priv -> base ;  ctx -> priv -> sz = sizeof ( * ctx -> priv ) ; ctx -> priv -> iface = ctx -> iface ; ctx -> priv -> alg_priv = priv ; ctx -> priv -> init_flags = ctx -> init_flags ; if ( ctx -> config. enc ) { <START_BUG> ctx -> priv -> alg_priv -> cfg = * ctx -> config. enc ; <END_BUG>  ctx -> config. enc = & ctx -> priv -> alg_priv -> cfg ; <START_BUG> } cfg = & ctx -> priv -> alg_priv -> cfg ; for ( i = 0 ; extracfg_map [ i ]. usage && extracfg_map [ i ]. usage!= cfg -> g_usage ; i ++ ) ; <END_BUG> priv -> vp8_cfg = extracfg_map [ i ]. cfg ;  priv -> vp8_cfg. pkt_list = & priv -> pkt_list. head ; priv -> cx_data_sz = priv -> cfg. g_w * priv -> cfg. g_h * 3 // 2 * 2 ; if ( priv -> cx_data_sz < 32768 ) priv -> cx_data_sz = 32768 ; priv -> cx_data = malloc ( priv -> cx_data_sz ) ; if (! priv -> cx_data ) { return VPX_CODEC_MEM_ERROR ; } if ( mr_cfg ) ctx -> priv -> enc. total_encoders = mr_cfg -> mr_total_resolutions ; else ctx -> priv -> enc. total_encoders = 1 ; res = validate_config

Fix:
<S2SV_ModStart> = VPX_CODEC_OK ; vp8_rtcd ( ) ; vpx_dsp_rtcd ( ) ; vpx_scale_rtcd ( ) ; if (! ctx -> priv ) { <S2SV_ModStart> vpx_codec_alg_priv * priv = <S2SV_ModEnd> ( struct vpx_codec_alg_priv <S2SV_ModStart> ( struct vpx_codec_alg_priv * ) vpx_calloc ( 1, sizeof ( * priv <S2SV_ModStart> -> priv = ( vpx_codec_priv_t * ) <S2SV_ModEnd> priv ; ctx <S2SV_ModStart> enc ) { priv <S2SV_ModEnd> -> cfg = <S2SV_ModStart> enc = & priv -> cfg ; } <S2SV_ModEnd> priv -> vp8_cfg <S2SV_ModStart> -> vp8_cfg = default_extracfg <S2SV_ModEnd> ; priv -> <S2SV_ModStart> set_vp8e_config ( & priv <S2SV_ModEnd> -> oxcf, <S2SV_ModStart> -> oxcf, priv -> cfg, priv <S2SV_ModEnd> -> vp8_cfg, <S2SV_ModStart> mr_cfg ) ; priv -> cpi <S2SV_ModEnd> = vp8_create_compressor ( <S2SV_ModStart> vp8_create_compressor ( & priv <S2SV_ModEnd> -> oxcf ) <S2SV_ModStart> if (! priv -> cpi <S2SV_ModEnd> ) res = <S2SV_ModStart> = VPX_CODEC_MEM_ERROR ; <S2SV_ModEnd>
Buggy code:
 void nw_buf_free ( nw_buf_pool * pool, nw_buf * buf ) { if ( pool -> free < pool -> free_total ) { pool -> free_arr [ pool -> free ++ ] = buf ; <START_BUG> } else { <END_BUG> uint32_t new_free_total = pool -> free_total * 2 ; void * new_arr = realloc ( pool -> free_arr, new_free_total * sizeof ( nw_buf * ) ) ; if ( new_arr ) { pool -> free_total = new_free_total ; pool -> free_arr = new_arr ; pool -> free_arr [ pool -> free ++ ] = buf ; } else { free ( buf ) ; }  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ; } else if ( pool -> free_total < NW_BUF_POOL_MAX_SIZE ) <S2SV_ModStart> ; } } else { free ( buf ) ; }
Buggy code:
 <START_BUG> static const SvcInternal * get_const_svc_internal ( const SvcContext * svc_ctx ) { <END_BUG> if ( svc_ctx == NULL ) return NULL ;  return ( const SvcInternal * ) svc_ctx -> internal ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> static const SvcInternal_t <S2SV_ModEnd> * get_const_svc_internal ( <S2SV_ModStart> return ( const SvcInternal_t <S2SV_ModEnd> * ) svc_ctx
Buggy code:
 static int loadImage ( TIFF * in, struct image_data * image, struct dump_opts * dump, unsigned char * * read_ptr ) { uint32 i ; float xres = 0.0, yres = 0.0 ; <START_BUG> uint16 nstrips = 0, ntiles = 0, planar = 0 ; <END_BUG> uint16 bps = 0, spp = 0, res_unit = 0 ; uint16 orientation = 0 ; uint16 input_compression = 0, input_photometric = 0 ; uint16 subsampling_horiz, subsampling_vert ; uint32 width = 0, length = 0 ; uint32 stsize = 0, tlsize = 0, buffsize = 0, scanlinesize = 0 ; uint32 tw = 0, tl = 0 ; uint32 tile_rowsize = 0 ; unsigned char * read_buff = NULL ; unsigned char * new_buff = NULL ; int readunit = 0 ; static uint32 prev_readsize = 0 ; TIFFGetFieldDefaulted ( in, TIFFTAG_BITSPERSAMPLE, & bps ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_SAMPLESPERPIXEL, & spp ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_PLANARCONFIG, & planar ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_ORIENTATION, & orientation ) ; if (! TIFFGetFieldDefaulted ( in, TIFFTAG_PHOTOMETRIC, & input_photometric ) ) TIFFError ( "loadImage", "Image   lacks   Photometric   interpreation   tag" ) ; if (! TIFFGetField ( in, TIFFTAG_IMAGEWIDTH, & width ) ) TIFFError ( "loadimage", "Image   lacks   image   width   tag" ) ; if (! TIFFGetField ( in, TIFFTAG_IMAGELENGTH, & length ) ) TIFFError ( "loadimage", "Image   lacks   image   length   tag" ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_XRESOLUTION, & xres ) ; TIFFGetFieldDefaulted ( in, TIFFTAG_YRESOLUTION, & yres ) ; if (! TIFFGetFieldDefaulted ( in, TIFFTAG_RESOLUTIONUNIT, & res_unit ) ) res_unit = RESUNIT_INCH ; if

Fix:
<S2SV_ModStart> = 0.0 ; uint32 nstrips = 0, ntiles = 0 ; uint16 <S2SV_ModEnd> planar = 0 <S2SV_ModStart>! read_buff ) { if ( buffsize > 0xFFFFFFFFU - 3 ) { TIFFError ( "loadImage", "Unable <S2SV_blank> to <S2SV_blank> allocate//reallocate <S2SV_blank> read <S2SV_blank> buffer" ) ; return ( - 1 ) ; } <S2SV_ModStart> 3 ) ; } <S2SV_ModStart> buffsize ) { if ( buffsize > 0xFFFFFFFFU - 3 ) { TIFFError ( "loadImage", "Unable <S2SV_blank> to <S2SV_blank> allocate//reallocate <S2SV_blank> read <S2SV_blank> buffer" ) ; return ( - 1 ) ; }
Buggy code:
 static const uint8_t * decode_tiles_mt ( VP9Decoder * pbi, const uint8_t * data, const uint8_t * data_end ) { <START_BUG> VP9_COMMON * const cm = & pbi -> common ; <END_BUG> const uint8_t * bit_reader_end = NULL ; const int aligned_mi_cols = mi_cols_aligned_to_sb ( cm -> mi_cols ) ; const int tile_cols = 1 << cm -> log2_tile_cols ; const int tile_rows = 1 << cm -> log2_tile_rows ;  const int num_workers = MIN ( pbi -> oxcf. max_threads & ~ 1, tile_cols ) ; <START_BUG> <END_BUG> TileBuffer tile_buffers [ 1 << 6 ] ;  int n ; int final_worker = - 1 ; assert ( tile_cols <= ( 1 << 6 ) ) ; assert ( tile_rows == 1 ) ; ( void ) tile_rows ; if ( pbi -> num_tile_workers == 0 ) { <START_BUG> const int num_threads = pbi -> oxcf. max_threads & ~ 1 ; <END_BUG> int i ; CHECK_MEM_ERROR ( cm, pbi -> tile_workers,  vpx_malloc ( num_threads * sizeof ( * pbi -> tile_workers ) ) ) ; <START_BUG> for ( i = 0 ; i < num_threads ; ++ i ) { <END_BUG> VP9Worker * const worker = & pbi -> tile_workers [ i ] ;  ++ pbi -> num_tile_workers ; <START_BUG> vp9_worker_init ( worker ) ; <END_BUG> CHECK_MEM_ERROR ( cm, worker -> data1, vpx_memalign ( 32, sizeof ( TileWorkerData ) ) ) ; CHECK_MEM_ERROR ( cm, worker -> data2, vpx_malloc ( sizeof ( TileInfo ) ) ) ;  if ( i < num_threads - 1 &&! vp9_worker_reset ( worker ) ) { <START_BUG> vpx_internal_error ( & cm -> error, VPX_CODEC_ERROR, "Tile   decoder   thread   creation   failed" ) ; } } } for ( n = 0 ; n < num_workers ; ++ n ) { <END_BUG> pbi -> tile_workers [ n ]. hook = ( VP9WorkerHook ) tile_worker

Fix:
<S2SV_ModStart> pbi -> common ; const VPxWorkerInterface * const winterface = vpx_get_worker_interface ( ) <S2SV_ModStart> ( pbi -> <S2SV_ModEnd> max_threads & ~ <S2SV_ModStart> tile_buffers [ 1 ] [ 1 <S2SV_ModStart> = pbi -> <S2SV_ModEnd> max_threads & ~ <S2SV_ModStart> pbi -> tile_workers ) ) ) ; assert ( ( sizeof ( * pbi -> tile_worker_data ) % 16 ) == 0 ) ; CHECK_MEM_ERROR ( cm, pbi -> tile_worker_data, vpx_memalign ( 32, num_threads * sizeof ( * pbi -> tile_worker_data ) ) ) ; CHECK_MEM_ERROR ( cm, pbi -> tile_worker_info, vpx_malloc ( num_threads * sizeof ( * pbi -> tile_worker_info <S2SV_ModStart> i ) { VPxWorker <S2SV_ModEnd> * const worker <S2SV_ModStart> -> num_tile_workers ; winterface -> init ( worker <S2SV_ModEnd> ) ; if <S2SV_ModStart> 1 &&! winterface -> reset <S2SV_ModEnd> ( worker ) <S2SV_ModStart> n ) { VPxWorker * const worker = & <S2SV_ModStart> [ n ] ; winterface -> sync ( worker ) ; worker -> <S2SV_ModEnd> hook = ( <S2SV_ModStart> hook = ( VPxWorkerHook <S2SV_ModEnd> )
Buggy code:
 int sock_recv_all ( int sock_fd, uint8_t * buf, int len ) { int r = len ; int ret = - 1 ; while ( r ) { <START_BUG> do ret = recv ( sock_fd, buf, r, MSG_WAITALL ) ; <END_BUG> while ( ret < 0 && errno == EINTR ) ; if ( ret <= 0 ) { BTIF_TRACE_ERROR ( "sock   fd:%d   recv   errno:%d,   ret:%d", sock_fd, errno, ret ) ; return - 1 ; } buf += ret ; r -= ret ; } return len ; }

Fix:
<S2SV_ModStart> do ret = TEMP_FAILURE_RETRY ( <S2SV_ModStart> r, MSG_WAITALL )
Buggy code:
 static void decode_mb_rows ( VP8D_COMP * pbi ) { VP8_COMMON * const pc = & pbi -> common ; MACROBLOCKD * const xd = & pbi -> mb ; MODE_INFO * lf_mic = xd -> mode_info_context ; int ibc = 0 ; int num_part = 1 << pc -> multi_token_partition ; int recon_yoffset, recon_uvoffset ; int mb_row, mb_col ; int mb_idx = 0 ; YV12_BUFFER_CONFIG * yv12_fb_new = pbi -> dec_fb_ref [ INTRA_FRAME ] ; int recon_y_stride = yv12_fb_new -> y_stride ; int recon_uv_stride = yv12_fb_new -> uv_stride ; unsigned char * ref_buffer [ MAX_REF_FRAMES ] [ 3 ] ; unsigned char * dst_buffer [ 3 ] ; unsigned char * lf_dst [ 3 ] ; unsigned char * eb_dst [ 3 ] ; int i ; int ref_fb_corrupted [ MAX_REF_FRAMES ] ; ref_fb_corrupted [ INTRA_FRAME ] = 0 ; for ( i = 1 ; i < MAX_REF_FRAMES ; i ++ ) { YV12_BUFFER_CONFIG * this_fb = pbi -> dec_fb_ref [ i ] ; ref_buffer [ i ] [ 0 ] = this_fb -> y_buffer ; ref_buffer [ i ] [ 1 ] = this_fb -> u_buffer ; ref_buffer [ i ] [ 2 ] = this_fb -> v_buffer ; ref_fb_corrupted [ i ] = this_fb -> corrupted ; } eb_dst [ 0 ] = lf_dst [ 0 ] = dst_buffer [ 0 ] = yv12_fb_new -> y_buffer ; eb_dst [ 1 ] = lf_dst [ 1 ] = dst_buffer [ 1 ] = yv12_fb_new -> u_buffer ; eb_dst [ 2 ] = lf_dst [ 2 ] = dst_buffer [ 2 ] = yv12_fb_new -> v_buffer ; xd -> up_available = 0 ; if ( pc -> filter_level ) vp8_loop_filter_frame_init

Fix:
<S2SV_ModStart> -> above_context ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> + recon_uvoffset ; if ( xd -> mode_info_context -> mbmi. ref_frame >= LAST_FRAME ) { const MV_REFERENCE_FRAME ref = xd -> mode_info_context -> mbmi. ref_frame ; <S2SV_ModStart> = ref_buffer [ ref <S2SV_ModEnd> ] [ 0 <S2SV_ModStart> = ref_buffer [ ref <S2SV_ModEnd> ] [ 1 <S2SV_ModStart> = ref_buffer [ ref <S2SV_ModEnd> ] [ 2 <S2SV_ModStart> + recon_uvoffset ; } else { xd -> pre. y_buffer = 0 ; xd -> pre. u_buffer = 0 ; xd -> pre. v_buffer = 0 ; }
Buggy code:
 static void temporal_filter_predictors_mb_c ( MACROBLOCKD * xd, uint8_t * y_mb_ptr, uint8_t * u_mb_ptr, uint8_t * v_mb_ptr, int stride, <START_BUG> int uv_block_size, <END_BUG> int mv_row, int mv_col, uint8_t * pred, struct scale_factors * scale, int x, int y ) { const int which_mv = 0 ; const MV mv = { mv_row, mv_col } ; const InterpKernel * const kernel =  vp9_get_interp_kernel ( xd -> mi [ 0 ] -> mbmi. interp_filter ) ; <START_BUG> enum mv_precision mv_precision_uv ; int uv_stride ; <END_BUG> if ( uv_block_size == 8 ) {  uv_stride = ( stride + 1 ) >> 1 ; mv_precision_uv = MV_PRECISION_Q4 ; } else { uv_stride = stride ; mv_precision_uv = MV_PRECISION_Q3 ; } <START_BUG> vp9_build_inter_predictor ( y_mb_ptr, stride, <END_BUG> & pred [ 0 ], 16, & mv, scale, 16, 16, which_mv, kernel, MV_PRECISION_Q3, x, y ) ; vp9_build_inter_predictor ( u_mb_ptr, uv_stride,  & pred [ 256 ], uv_block_size, <START_BUG> & mv, scale, uv_block_size, uv_block_size, which_mv, kernel, mv_precision_uv, x, y ) ; vp9_build_inter_predictor ( v_mb_ptr, uv_stride, <END_BUG> & pred [ 512 ], uv_block_size,  & mv, scale, uv_block_size, uv_block_size, which_mv, kernel, mv_precision_uv, x, y ) ; }

Fix:
<S2SV_ModStart> stride, int uv_block_width, int uv_block_height <S2SV_ModEnd>, int mv_row <S2SV_ModStart> const kernel = vp9_filter_kernels [ <S2SV_ModEnd> xd -> mi <S2SV_ModStart> mbmi. interp_filter ] <S2SV_ModEnd> ; enum mv_precision <S2SV_ModStart> ; if ( uv_block_width <S2SV_ModEnd> == 8 ) <S2SV_ModStart> MV_PRECISION_Q3 ; } # if CONFIG_VP9_HIGHBITDEPTH if ( xd -> cur_buf -> flags & YV12_FLAG_HIGHBITDEPTH ) { vp9_highbd_build_inter_predictor ( y_mb_ptr, stride, & pred [ 0 ], 16, & mv, scale, 16, 16, which_mv, kernel, MV_PRECISION_Q3, x, y, xd -> bd ) ; vp9_highbd_build_inter_predictor ( u_mb_ptr, uv_stride, & pred [ 256 ], uv_block_width, & mv, scale, uv_block_width, uv_block_height, which_mv, kernel, mv_precision_uv, x, y, xd -> bd ) ; vp9_highbd_build_inter_
Buggy code:
 void cipso_v4_req_delattr ( struct request_sock * req ) { <START_BUG> struct ip_options * opt ; <END_BUG> struct inet_request_sock * req_inet ; req_inet = inet_rsk ( req ) ; opt = req_inet -> opt ;  if ( opt == NULL || opt -> cipso == 0 ) <START_BUG> return ; cipso_v4_delopt ( & req_inet -> opt ) ; }<END_BUG>

Fix:
<S2SV_ModStart> ) { struct ip_options_rcu <S2SV_ModEnd> * opt ; <S2SV_ModStart> || opt -> opt.
Buggy code:
 int asn1_ber_decoder ( const struct asn1_decoder * decoder, void * context, const unsigned char * data, size_t datalen ) { const unsigned char * machine = decoder -> machine ; const asn1_action_t * actions = decoder -> actions ; size_t machlen = decoder -> machlen ; enum asn1_opcode op ; unsigned char tag = 0, csp = 0, jsp = 0, optag = 0, hdr = 0 ; const char * errmsg ; size_t pc = 0, dp = 0, tdp = 0, len = 0 ; int ret ; unsigned char flags = 0 ; # define FLAG_INDEFINITE_LENGTH 0x01 # define FLAG_MATCHED 0x02 # define FLAG_LAST_MATCHED 0x04 # define FLAG_CONS 0x20 # define NR_CONS_STACK 10 unsigned short cons_dp_stack [ NR_CONS_STACK ] ; unsigned short cons_datalen_stack [ NR_CONS_STACK ] ; unsigned char cons_hdrlen_stack [ NR_CONS_STACK ] ; # define NR_JUMP_STACK 10 unsigned char jump_stack [ NR_JUMP_STACK ] ; if ( datalen > 65535 ) return - EMSGSIZE ; next_op : pr_debug ( "next_op:   pc=\\e[32m%zu\\e[m//%zu   dp=\\e[33m%zu\\e[m//%zu   C=%d   J=%d\\n", pc, machlen, dp, datalen, csp, jsp ) ; if ( unlikely ( pc >= machlen ) ) goto machine_overrun_error ; op = machine [ pc ] ; if ( unlikely ( pc + asn1_op_lengths [ op ] > machlen ) ) goto machine_overrun_error ; if ( op <= ASN1_OP__MATCHES_TAG ) { unsigned char tmp ; if ( ( op & ASN1_OP_MATCH__COND && flags & FLAG_MATCHED ) || <START_BUG> dp == datalen ) { <END_BUG> flags &= ~ FLAG_LAST_MATCHED ; pc += asn1_op_lengths [ op ] ; goto next_op ; } flags = 0 ; hdr = 2 ; if ( unlikely ( dp >= datalen - 1

Fix:
<S2SV_ModStart> FLAG_MATCHED ) || ( op & ASN1_OP_MATCH__SKIP && <S2SV_ModStart> dp == datalen )
Buggy code:
 static void perf_event_mmap_output ( struct perf_event * event, struct perf_mmap_event * mmap_event ) { struct perf_output_handle handle ; struct perf_sample_data sample ; int size = mmap_event -> event_id. header. size ; int ret ; perf_event_header__init_id ( & mmap_event -> event_id. header, & sample, event ) ; ret = perf_output_begin ( & handle, event, <START_BUG> mmap_event -> event_id. header. size, 0, 0 ) ; <END_BUG> if ( ret ) goto out ; mmap_event -> event_id. pid = perf_event_pid ( event, current ) ; mmap_event -> event_id. tid = perf_event_tid ( event, current ) ; perf_output_put ( & handle, mmap_event -> event_id ) ; __output_copy ( & handle, mmap_event -> file_name, mmap_event -> file_size ) ; perf_event__output_id_sample ( event, & handle, & sample ) ; perf_output_end ( & handle ) ; out : mmap_event -> event_id. header. size = size ; }

Fix:
<S2SV_ModStart> header. size <S2SV_ModEnd>, 0 )
Buggy code:
 static void mldv2_query_print ( netdissect_options * ndo, const u_char * bp, u_int len ) { const struct icmp6_hdr * icp = ( const struct icmp6_hdr * ) bp ; u_int mrc ; int mrt, qqi ; u_int nsrcs ; register u_int i ; if ( len < 28 ) { ND_PRINT ( ( ndo, "   [invalid   len   %d]", len ) ) ; return ; } ND_TCHECK ( icp -> icmp6_data16 [ 0 ] ) ; mrc = EXTRACT_16BITS ( & icp -> icmp6_data16 [ 0 ] ) ; if ( mrc < 32768 ) { mrt = mrc ; } else { mrt = ( ( mrc & 0x0fff ) | 0x1000 ) << ( ( ( mrc & 0x7000 ) >> 12 ) + 3 ) ; } if ( ndo -> ndo_vflag ) { ND_PRINT ( ( ndo, "   [max   resp   delay=%d]", mrt ) ) ; } ND_TCHECK2 ( bp [ 8 ], sizeof ( struct in6_addr ) ) ; ND_PRINT ( ( ndo, "   [gaddr   %s", ip6addr_string ( ndo, & bp [ 8 ] ) ) ) ; if ( ndo -> ndo_vflag ) { ND_TCHECK ( bp [ 25 ] ) ; if ( bp [ 24 ] & 0x08 ) { ND_PRINT ( ( ndo, "   sflag" ) ) ; } if ( bp [ 24 ] & 0x07 ) { ND_PRINT ( ( ndo, "   robustness=%d", bp [ 24 ] & 0x07 ) ) ; } if ( bp [ 25 ] < 128 ) { qqi = bp [ 25 ] ; } else { qqi = ( ( bp [ 25 ] & 0x0f ) | 0x10 ) << ( ( ( bp [ 25 ] & 0x70 ) >> 4 ) + 3 ) ; } ND_PRINT ( ( ndo, "   qqi=%d", qqi ) ) ; } ND_TCHECK2 ( bp [ 26

Fix:
<S2SV_ModStart> ( ndo, "%s", mldv2_tstr <S2SV_ModEnd> ) ) ;
Buggy code:
 int regexec ( Reprog * prog, const char * sp, Resub * sub, int eflags ) { Resub scratch ; int i ; if (! sub ) sub = & scratch ; sub -> nsub = prog -> nsub ; for ( i = 0 ; i < MAXSUB ; ++ i ) sub -> sub [ i ]. sp = sub -> sub [ i ]. ep = NULL ; <START_BUG> return! match ( prog -> start, sp, sp, prog -> flags | eflags, sub ) ; <END_BUG> }

Fix:
<S2SV_ModStart> NULL ; return <S2SV_ModEnd> match ( prog <S2SV_ModStart> eflags, sub, 0
Buggy code:
 WORD32 ih264d_start_of_pic ( dec_struct_t * ps_dec, WORD32 i4_poc, pocstruct_t * ps_temp_poc, UWORD16 u2_frame_num, dec_pic_params_t * ps_pps ) { pocstruct_t * ps_prev_poc = & ps_dec -> s_cur_pic_poc ; pocstruct_t * ps_cur_poc = ps_temp_poc ; pic_buffer_t * pic_buf ; ivd_video_decode_op_t * ps_dec_output = ( ivd_video_decode_op_t * ) ps_dec -> pv_dec_out ; dec_slice_params_t * ps_cur_slice = ps_dec -> ps_cur_slice ; dec_seq_params_t * ps_seq = ps_pps -> ps_sps ; UWORD8 u1_bottom_field_flag = ps_cur_slice -> u1_bottom_field_flag ; UWORD8 u1_field_pic_flag = ps_cur_slice -> u1_field_pic_flag ; high_profile_tools_t s_high_profile ; WORD32 ret ; H264_MUTEX_LOCK ( & ps_dec -> process_disp_mutex ) ; ps_prev_poc -> i4_pic_order_cnt_lsb = ps_cur_poc -> i4_pic_order_cnt_lsb ; ps_prev_poc -> i4_pic_order_cnt_msb = ps_cur_poc -> i4_pic_order_cnt_msb ; ps_prev_poc -> i4_delta_pic_order_cnt_bottom = ps_cur_poc -> i4_delta_pic_order_cnt_bottom ; ps_prev_poc -> i4_delta_pic_order_cnt [ 0 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 0 ] ; ps_prev_poc -> i4_delta_pic_order_cnt [ 1 ] = ps_cur_poc -> i4_delta_pic_order_cnt [ 1 ] ; ps_prev_

Fix:
<S2SV_ModStart> = 0 ; <S2SV_ModEnd> { ps_dec ->
Buggy code:
 <START_BUG> static void construct_get_dest_keyring ( struct key * * _dest_keyring ) <END_BUG> { struct request_key_auth * rka ; const struct cred * cred = current_cred ( ) ; struct key * dest_keyring = * _dest_keyring, * authkey ;  kenter ( "%p", dest_keyring ) ; <START_BUG> if ( dest_keyring ) { key_get ( dest_keyring ) ; <END_BUG> } else {  switch ( cred -> jit_keyring ) { case KEY_REQKEY_DEFL_DEFAULT : case KEY_REQKEY_DEFL_REQUESTOR_KEYRING : if ( cred -> request_key_auth ) { authkey = cred -> request_key_auth ; down_read ( & authkey -> sem ) ; rka = authkey -> payload. data [ 0 ] ; if (! test_bit ( KEY_FLAG_REVOKED, & authkey -> flags ) ) dest_keyring = key_get ( rka -> dest_keyring ) ; up_read ( & authkey -> sem ) ; if ( dest_keyring ) <START_BUG> break ; <END_BUG> } case KEY_REQKEY_DEFL_THREAD_KEYRING : dest_keyring = key_get ( cred -> thread_keyring ) ; if ( dest_keyring ) break ; case KEY_REQKEY_DEFL_PROCESS_KEYRING : dest_keyring = key_get ( cred -> process_keyring ) ; if ( dest_keyring ) break ; case KEY_REQKEY_DEFL_SESSION_KEYRING : rcu_read_lock ( ) ; dest_keyring = key_get ( rcu_dereference ( cred -> session_keyring ) ) ; rcu_read_unlock ( ) ; if ( dest_keyring ) break ; case KEY_REQKEY_DEFL_USER_SESSION_KEYRING : dest_keyring = key_get ( cred -> user -> session_keyring ) ; break ; case KEY_REQKEY_DEFL_USER_KEYRING : dest_keyring = key_get ( cred -> user -> uid_keyring ) ; break ; case KEY_REQKEY_DEFL_GROUP_KEYRING : default : BUG ( ) ; }  } <START_BUG> * _dest_keyring<END_BUG>

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> construct_get_dest_keyring ( struct <S2SV_ModStart> * authkey ; int ret ; <S2SV_ModStart> } else { bool do_perm_check = true ; <S2SV_ModStart> ( dest_keyring ) { do_perm_check = false ; break ; } <S2SV_ModEnd> } case KEY_REQKEY_DEFL_THREAD_KEYRING <S2SV_ModStart> ) ; } if ( dest_keyring && do_perm_check ) { ret = key_permission ( make_key_ref ( dest_keyring, 1 ), KEY_NEED_WRITE ) ; if ( ret ) { key_put ( dest_keyring ) ; return ret ; } } <S2SV_ModStart> ) ; return 0