nus-yam/ex-repair huggingface dataset:
Buggy code:
 static Image * ReadHDRImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { char format [ MaxTextExtent ], keyword [ MaxTextExtent ], tag [ MaxTextExtent ], value [ MaxTextExtent ] ; double gamma ; Image * image ; int c ; MagickBooleanType status, value_expected ; register Quantum * q ; register ssize_t i, x ; register unsigned char * p ; ssize_t count, y ; unsigned char * end, pixel [ 4 ], * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; } image -> columns = 0 ; image -> rows = 0 ; * format = '\\0' ; c = ReadBlobByte ( image ) ; if ( c == EOF ) { image = DestroyImage ( image ) ; return ( ( Image * ) NULL ) ; } while ( isgraph ( c ) && ( image -> columns == 0 ) && ( image -> rows == 0 ) ) { if ( c == ( int ) '#' ) { char * comment ; register char * p ; size_t length ; length = MaxTextExtent ; comment = AcquireString ( ( char * ) NULL ) ; for ( p = comment ; comment!= ( char * ) NULL ; p ++ ) { c = ReadBlobByte ( image ) ; if ( ( c == EOF ) || ( c == ( int ) '\\n' ) ) break ; if ( ( size_t ) ( p - comment + 1 ) >= length ) { * p = '\\0' ; length <<= 1 ; comment = ( char * ) ResizeQuantumMemory ( comment, length + MaxTextExtent, sizeof ( * comment ) ) ; if ( comment == ( char * ) NULL ) break ; p = comment + strlen (

Fix:
<S2SV_ModStart>!= '\\0' ) && ( c!= EOF ) <S2SV_ModStart> 2 ] ; if ( <S2SV_ModEnd> sscanf ( value <S2SV_ModStart> 1 ] ) == 8 ) { <S2SV_ModEnd> image -> chromaticity <S2SV_ModStart> 1 ] ; } <S2SV_ModStart>, width ; if ( <S2SV_ModEnd> sscanf ( value <S2SV_ModStart> & width ) == 2 ) { <S2SV_ModEnd> image -> columns <S2SV_ModStart> ) height ; }
Buggy code:
 WORD32 ih264d_parse_islice ( dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice ) { dec_pic_params_t * ps_pps = ps_dec -> ps_cur_pps ; dec_slice_params_t * ps_slice = ps_dec -> ps_cur_slice ; UWORD32 * pu4_bitstrm_buf = ps_dec -> ps_bitstrm -> pu4_buffer ; UWORD32 * pu4_bitstrm_ofst = & ps_dec -> ps_bitstrm -> u4_ofst ; UWORD32 u4_temp ; WORD32 i_temp ; WORD32 ret ; if ( ps_slice -> u1_nal_ref_idc!= 0 ) { if (! ps_dec -> ps_dpb_cmds -> u1_dpb_commands_read ) <START_BUG> ps_dec -> u4_bitoffset = ih264d_read_mmco_commands ( <END_BUG> ps_dec ) ; else ps_dec -> ps_bitstrm -> u4_ofst += ps_dec -> u4_bitoffset ; } i_temp = ps_pps -> u1_pic_init_qp + ih264d_sev ( pu4_bitstrm_ofst, pu4_bitstrm_buf ) ; if ( ( i_temp < 0 ) || ( i_temp > 51 ) ) return ERROR_INV_RANGE_QP_T ; ps_slice -> u1_slice_qp = i_temp ; COPYTHECONTEXT ( "SH:   slice_qp_delta", ps_slice -> u1_slice_qp - ps_pps -> u1_pic_init_qp ) ; if ( ps_pps -> u1_deblocking_filter_parameters_present_flag == 1 ) { u4_temp = ih264d_uev ( pu4_bitstrm_ofst, pu4_bitstrm_buf ) ; COPYTHECONTEXT ( "SH:   disable_deblocking_filter_idc", u4_temp ) ; if ( u4_temp > SLICE_BOUNDARY_DBLK_DISABLED ) { return ERROR_INV_SLICE_HDR_

Fix:
<S2SV_ModStart> -> u1_dpb_commands_read ) { i_temp = ih264d_read_mmco_commands ( ps_dec ) ; if ( i_temp < 0 ) { return ERROR_DBP_MANAGER_T ; } <S2SV_ModStart> -> u4_bitoffset = i_temp ; } <S2SV_ModEnd> else ps_dec ->
Buggy code:
 <START_BUG> VP9Decoder * vp9_decoder_create ( const VP9D_CONFIG * oxcf ) { <END_BUG>  VP9Decoder * const pbi = vpx_memalign ( 32, sizeof ( * pbi ) ) ; <START_BUG> <END_BUG> VP9_COMMON * const cm = pbi? & pbi -> common : NULL ;  if (! cm ) return NULL ; vp9_zero ( * pbi ) ; if ( setjmp ( cm -> error. jmp ) ) { cm -> error. setjmp = 0 ; vp9_decoder_remove ( pbi ) ; return NULL ; } cm -> error. setjmp = 1 ; <START_BUG> vp9_initialize_dec ( ) ; <END_BUG> vp9_rtcd ( ) ; vpx_memset ( & cm -> ref_frame_map, - 1, sizeof ( cm -> ref_frame_map ) ) ;  cm -> current_video_frame = 0 ; <START_BUG> <END_BUG> pbi -> oxcf = * oxcf ;  pbi -> ready_for_new_data = 1 ; <START_BUG> pbi -> decoded_key_frame = 0 ; <END_BUG>  vp9_init_dequantizer ( cm ) ; <START_BUG> vp9_loop_filter_init ( cm ) ; cm -> error. setjmp = 0 ; vp9_worker_init ( & pbi -> lf_worker ) ; return pbi ; }<END_BUG>

Fix:
<S2SV_ModStart> * vp9_decoder_create ( BufferPool * const pool <S2SV_ModEnd> ) { VP9Decoder <S2SV_ModStart> { VP9Decoder * volatile <S2SV_ModStart> ; VP9_COMMON * volatile <S2SV_ModStart> = 1 ; CHECK_MEM_ERROR ( cm, cm -> fc, ( FRAME_CONTEXT * ) vpx_calloc ( 1, sizeof ( * cm -> fc ) ) ) ; CHECK_MEM_ERROR ( cm, cm -> frame_contexts, ( FRAME_CONTEXT * ) vpx_calloc ( FRAME_CONTEXTS, sizeof ( * cm -> frame_contexts ) ) ) ; pbi -> need_resync = 1 ; once ( initialize_dec ) ; memset <S2SV_ModEnd> ( & cm <S2SV_ModStart> ) ) ; memset ( & cm -> next_ref_frame_map, - 1, sizeof ( cm -> next_ref_frame_map ) ) ; <S2SV_ModStart> ; pbi -> <S2SV_ModEnd> ready_for_new_data = 1 <S2SV_ModStart> ; pbi -> common. buffer_pool = pool ; cm -> bit_depth = VPX_BITS_8 ; cm -> dequant_bit_depth = VPX_BITS_8 ; cm -> alloc_mi = vp9_dec_alloc_mi ;
Buggy code:
 int handle_unaligned_access ( insn_size_t instruction, struct pt_regs * regs, struct mem_access * ma, int expected, unsigned long address ) { u_int rm ; int ret, index ; if ( instruction_size ( instruction )!= 2 ) return - EINVAL ; index = ( instruction >> 8 ) & 15 ; rm = regs -> regs [ index ] ; if (! expected ) { unaligned_fixups_notify ( current, instruction, regs ) ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, 0, <END_BUG> regs, address ) ; } ret = - EFAULT ; switch ( instruction & 0xF000 ) { case 0x0000 : if ( instruction == 0x000B ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) regs -> pc = regs -> pr ; } else if ( ( instruction & 0x00FF ) == 0x0023 ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) regs -> pc += rm + 4 ; } else if ( ( instruction & 0x00FF ) == 0x0003 ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) { regs -> pr = regs -> pc + 4 ; regs -> pc += rm + 4 ; } } else { goto simple ; } break ; case 0x1000 : goto simple ; case 0x2000 : goto simple ; case 0x4000 : if ( ( instruction & 0x00FF ) == 0x002B ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) regs -> pc = rm ; } else if ( ( instruction & 0x00FF ) == 0x000B ) { ret = handle_delayslot ( regs, instruction, ma ) ; if ( ret == 0 ) { regs -> pr = regs -> pc + 4 ; regs -> pc = rm ; } } else { goto simple ; } break ; case 0x5000 : goto simple ; case 0x6000 : goto simple ; case 0x8000 : switch ( instruction & 0x0F00 ) { case 0x0100 : goto simple ; case 0x0500 : goto simple ; case 0x0B00 : break ; case 0x0

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address
Buggy code:
 vpx_codec_err_t vpx_codec_decode ( vpx_codec_ctx_t * ctx, const uint8_t * data, unsigned int data_sz, void * user_priv, long deadline ) { vpx_codec_err_t res ; <START_BUG> if (! ctx || (! data && data_sz ) ) <END_BUG> res = VPX_CODEC_INVALID_PARAM ; else if (! ctx -> iface ||! ctx -> priv ) res = VPX_CODEC_ERROR ; else {  res = ctx -> iface -> dec. decode ( ctx -> priv -> alg_priv, data, data_sz, <START_BUG> user_priv, deadline ) ; } return SAVE_STATUS ( ctx, res ) ; }<END_BUG>

Fix:
<S2SV_ModStart> && data_sz ) || ( data &&! data_sz ) <S2SV_ModStart>. decode ( get_alg_priv ( ctx ) <S2SV_ModEnd>, data,
Buggy code:
 static Image * ReadVIFFImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define VFF_CM_genericRGB 15 # define VFF_CM_ntscRGB 1 # define VFF_CM_NONE 0 # define VFF_DEP_DECORDER 0x4 # define VFF_DEP_NSORDER 0x8 # define VFF_DES_RAW 0 # define VFF_LOC_IMPLICIT 1 # define VFF_MAPTYP_NONE 0 # define VFF_MAPTYP_1_BYTE 1 # define VFF_MAPTYP_2_BYTE 2 # define VFF_MAPTYP_4_BYTE 4 # define VFF_MAPTYP_FLOAT 5 # define VFF_MAPTYP_DOUBLE 7 # define VFF_MS_NONE 0 # define VFF_MS_ONEPERBAND 1 # define VFF_MS_SHARED 3 # define VFF_TYP_BIT 0 # define VFF_TYP_1_BYTE 1 # define VFF_TYP_2_BYTE 2 # define VFF_TYP_4_BYTE 4 # define VFF_TYP_FLOAT 5 # define VFF_TYP_DOUBLE 9 typedef struct _ViffInfo { unsigned char identifier, file_type, release, version, machine_dependency, reserve [ 3 ] ; char comment [ 512 ] ; unsigned int rows, columns, subrows ; int x_offset, y_offset ; float x_bits_per_pixel, y_bits_per_pixel ; unsigned int location_type, location_dimension, number_of_images, number_data_bands, data_storage_type, data_encode_scheme, map_scheme, map_storage_type, map_rows, map_columns, map_subrows, map_enable, maps_per_cycle, color_space_model ; } ViffInfo ; double min_value, scale_factor, value ; Image * image ; int bit ; MagickBooleanType status ; MagickSizeType number_pixels ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bytes_per_pixel, max_packets, quantum ; ssize_t count, y ; unsigned char * pixels ; unsigned long ls

Fix:
<S2SV_ModStart> { if ( HeapOverflowSanityCheck <S2SV_ModEnd> ( ( image <S2SV_ModStart> { if ( HeapOverflowSanityCheck <S2SV_ModEnd> ( number_pixels,
Buggy code:
 static int num_stmts ( const node * n ) { int i, l ; node * ch ; switch ( TYPE ( n ) ) { case single_input : if ( TYPE ( CHILD ( n, 0 ) ) == NEWLINE ) return 0 ; else return num_stmts ( CHILD ( n, 0 ) ) ; case file_input : l = 0 ; for ( i = 0 ; i < NCH ( n ) ; i ++ ) { ch = CHILD ( n, i ) ; if ( TYPE ( ch ) == stmt ) l += num_stmts ( ch ) ; } return l ; case stmt : return num_stmts ( CHILD ( n, 0 ) ) ; case compound_stmt : return 1 ; case simple_stmt : return NCH ( n ) // 2 ; case suite : if ( NCH ( n ) == 1 ) return num_stmts ( CHILD ( n, 0 ) ) ; else { i = 2 ; l = 0 ; if ( TYPE ( CHILD ( n, 1 ) ) == TYPE_COMMENT ) i += 2 ; for ( ; i < ( NCH ( n ) - 1 ) ; i ++ ) l += num_stmts ( CHILD ( n, i ) ) ; return l ; } default : { char buf [ 128 ] ; sprintf ( buf, "Non-statement   found:   %d   %d", TYPE ( n ), NCH ( n ) ) ; Py_FatalError ( buf ) ; } } <START_BUG> assert ( 0 ) ; <END_BUG> return 0 ; }

Fix:
<S2SV_ModStart> ; } } abort ( ) <S2SV_ModEnd> ; } <S2SV_null>
Buggy code:
 void M_LoadDefaults ( void ) { int i ; int len ; FILE * f ; char def [ 80 ] ; char strparm [ 100 ] ; char * newstring ; int parm ; boolean isstring ; numdefaults = sizeof ( defaults ) // sizeof ( defaults [ 0 ] ) ; for ( i = 0 ; i < numdefaults ; i ++ ) * defaults [ i ]. location = defaults [ i ]. defaultvalue ; i = M_CheckParm ( "-config" ) ; if ( i && i < myargc - 1 ) { defaultfile = myargv [ i + 1 ] ; printf ( "\tdefault   file:   %s\\n", defaultfile ) ; } else defaultfile = basedefault ; f = fopen ( defaultfile, "r" ) ; if ( f ) { while (! feof ( f ) ) { isstring = false ; <START_BUG> if ( fscanf ( f, "%79s   %[^\\n]\\n", def, strparm ) == 2 ) <END_BUG> { if ( strparm [ 0 ] == \'"\' ) { isstring = true ; len = strlen ( strparm ) ; newstring = ( char * ) malloc ( len ) ; strparm [ len - 1 ] = 0 ; strcpy ( newstring, strparm + 1 ) ; } else if ( strparm [ 0 ] == '0' && strparm [ 1 ] == 'x' ) sscanf ( strparm + 2, "%x", & parm ) ; else sscanf ( strparm, "%i", & parm ) ; for ( i = 0 ; i < numdefaults ; i ++ ) if (! strcmp ( def, defaults [ i ]. name ) ) { if (! isstring ) * defaults [ i ]. location = parm ; else * defaults [ i ]. location = ( int ) newstring ; break ; } } } fclose ( f ) ; } for ( i = 0 ; i < numdefaults ; i ++ ) { if ( defaults [ i ]. scantranslate ) { parm = * defaults [ i ]. location ; defaults [ i ]. untranslated = parm ; * defaults [ i ]. location = scantokey [ parm ] ; } } }

Fix:
<S2SV_ModStart> ( f, "%79s <S2SV_blank> %99[^\\n]\\n" <S2SV_ModEnd>, def,
Buggy code:
 <START_BUG> static void fdct16 ( const int16_t in [ 16 ], int16_t out [ 16 ] ) { <END_BUG>  int step1 [ 8 ] ; <START_BUG> <END_BUG> int step2 [ 8 ] ;  <START_BUG> int step3 [ 8 ] ; <END_BUG>  int input [ 8 ] ; <START_BUG> <END_BUG> int temp1, temp2 ;  input [ 0 ] = in [ 0 ] + in [ 15 ] ; input [ 1 ] = in [ 1 ] + in [ 14 ] ; input [ 2 ] = in [ 2 ] + in [ 13 ] ; input [ 3 ] = in [ 3 ] + in [ 12 ] ; input [ 4 ] = in [ 4 ] + in [ 11 ] ; input [ 5 ] = in [ 5 ] + in [ 10 ] ; input [ 6 ] = in [ 6 ] + in [ 9 ] ; input [ 7 ] = in [ 7 ] + in [ 8 ] ; step1 [ 0 ] = in [ 7 ] - in [ 8 ] ; step1 [ 1 ] = in [ 6 ] - in [ 9 ] ; step1 [ 2 ] = in [ 5 ] - in [ 10 ] ; step1 [ 3 ] = in [ 4 ] - in [ 11 ] ; step1 [ 4 ] = in [ 3 ] - in [ 12 ] ; step1 [ 5 ] = in [ 2 ] - in [ 13 ] ; step1 [ 6 ] = in [ 1 ] - in [ 14 ] ; step1 [ 7 ] = in [ 0 ] - in [ 15 ] ; { <START_BUG> int s0, s1, s2, s3, s4, s5, s6, s7 ; <END_BUG>  int t0, t1, t2, t3 ; <START_BUG> <END_BUG> int x0, x1, x2, x3 ;  s0 = input [ 0 ] + input [ 7 ] ; s1 = input [ 1 ] + input [ 6 ] ; s2 = input [ 2 ] + input [ 5 ] ; s3 = input [ 3 ] + input [ 4 ] ; s4 = input [ 3 ] - input [ 4 ] ; s5 = input [ 2 ] - input [ 5 ] ; s6 = input [ 1 ] - input [ 6 ] ; s7 = input [ 0 ] - input [ 7 ] ; x0 = s0 + s3 ; x1 = s1 + s2 ; x2 = s1 -

Fix:
<S2SV_ModStart> fdct16 ( const tran_low_t <S2SV_ModEnd> in [ 16 <S2SV_ModStart> 16 ], tran_low_t <S2SV_ModEnd> out [ 16 <S2SV_ModStart> ] ) { tran_high_t <S2SV_ModEnd> step1 [ 8 <S2SV_ModStart> 8 ] ; tran_high_t <S2SV_ModEnd> step2 [ 8 <S2SV_ModStart> 8 ] ; tran_high_t <S2SV_ModEnd> step3 [ 8 <S2SV_ModStart> 8 ] ; tran_high_t <S2SV_ModEnd> input [ 8 <S2SV_ModStart> 8 ] ; tran_high_t <S2SV_ModEnd> temp1, temp2 <S2SV_ModStart> ] ; { tran_high_t <S2SV_ModEnd> s0, s1 <S2SV_ModStart>, s7 ; tran_high_t <S2SV_ModEnd> t0, t1 <S2SV_ModStart>, t3 ; tran_high_t <S2SV_ModEnd> x0, x1 <S2SV_ModStart> 0 ] = ( tran_low_t ) <S2SV_ModStart> 4 ] = ( tran_low_t ) <S2SV_ModStart> 8 ] = ( tran_low_t ) <S2SV_ModStart> 12 ] = ( tran_low_t ) <S2SV_ModStart> 2 ] = ( tran_low_t ) <S2SV_ModStart> 6 ] = ( tran_low_t ) <S2SV_ModStart> 10 ] = ( tran_low_t ) <S2SV_ModStart> 14 ] = ( tran_low_t ) <S2SV_ModStart> 2 ] * cospi_24_64 + <S2SV_ModEnd> step3 [ 5 <S2SV_ModStart> 2 ] * cos
Buggy code:
 static int adjust_scalar_min_max_vals ( struct bpf_verifier_env * env, struct bpf_insn * insn, struct bpf_reg_state * dst_reg, struct bpf_reg_state src_reg ) { struct bpf_reg_state * regs = cur_regs ( env ) ; u8 opcode = BPF_OP ( insn -> code ) ; bool src_known, dst_known ; s64 smin_val, smax_val ; u64 umin_val, umax_val ; u64 insn_bitness = ( BPF_CLASS ( insn -> code ) == BPF_ALU64 )? 64 : 32 ; smin_val = src_reg. smin_value ; smax_val = src_reg. smax_value ; umin_val = src_reg. umin_value ; umax_val = src_reg. umax_value ; src_known = tnum_is_const ( src_reg. var_off ) ; <START_BUG> dst_known = tnum_is_const ( dst_reg -> var_off ) ; <END_BUG> switch ( opcode ) { case BPF_ADD : if ( signed_add_overflows ( dst_reg -> smin_value, smin_val ) || signed_add_overflows ( dst_reg -> smax_value, smax_val ) ) { dst_reg -> smin_value = S64_MIN ; dst_reg -> smax_value = S64_MAX ; } else { dst_reg -> smin_value += smin_val ; dst_reg -> smax_value += smax_val ; } if ( dst_reg -> umin_value + umin_val < umin_val || dst_reg -> umax_value + umax_val < umax_val ) { dst_reg -> umin_value = 0 ; dst_reg -> umax_value = U64_MAX ; } else { dst_reg -> umin_value += umin_val ; dst_reg -> umax_value += umax_val ; } dst_reg -> var_off = tnum_add ( dst_reg -> var_off, src_reg. var_off ) ; break ; case BPF_SUB : if ( signed_

Fix:
<S2SV_ModStart> var_off ) ; if (! src_known && opcode!= BPF_ADD && opcode!= BPF_SUB && opcode!= BPF_AND ) { __mark_reg_unknown ( dst_reg ) ; return 0 ; }
Buggy code:
 VALUE request_env ( agooReq req, VALUE self ) { if ( Qnil == ( VALUE ) req -> env ) { volatile VALUE env = rb_hash_new ( ) ; rb_hash_aset ( env, request_method_val, req_method ( req ) ) ; rb_hash_aset ( env, script_name_val, req_script_name ( req ) ) ; rb_hash_aset ( env, path_info_val, req_path_info ( req ) ) ; rb_hash_aset ( env, query_string_val, req_query_string ( req ) ) ; <START_BUG> rb_hash_aset ( env, server_name_val, req_server_name ( req ) ) ; <END_BUG> rb_hash_aset ( env, server_port_val, req_server_port ( req ) ) ; fill_headers ( req, env ) ; rb_hash_aset ( env, rack_version_val, rack_version_val_val ) ; rb_hash_aset ( env, rack_url_scheme_val, req_rack_url_scheme ( req ) ) ; rb_hash_aset ( env, rack_input_val, req_rack_input ( req ) ) ; rb_hash_aset ( env, rack_errors_val, req_rack_errors ( req ) ) ; rb_hash_aset ( env, rack_multithread_val, req_rack_multithread ( req ) ) ; rb_hash_aset ( env, rack_multiprocess_val, Qfalse ) ; rb_hash_aset ( env, rack_run_once_val, Qfalse ) ; rb_hash_aset ( env, rack_logger_val, req_rack_logger ( req ) ) ; rb_hash_aset ( env, rack_upgrade_val, req_rack_upgrade ( req ) ) ; rb_hash_aset ( env, rack_hijackq_val, Qtrue ) ; rb_hash_aset ( env, rack_hijack_val, self ) ; rb_hash_aset ( env, rack_hijack_io_val, Qnil ) ; if ( agoo_server. rack_early_hints ) { volatile VALUE eh = agoo_early_hints_new ( req ) ; rb_hash_aset ( env

Fix:
<S2SV_ModStart> ( env, remote_addr_val, req_remote_addr ( req ) ) ; rb_hash_aset ( env, server_port_val, req_server_port ( req ) ) ; rb_hash_aset ( env, <S2SV_ModStart> server_name_val, req_server_name <S2SV_ModEnd> ( req )
Buggy code:
 static int ospf6_print_lshdr ( netdissect_options * ndo, register const struct lsa6_hdr * lshp, const u_char * dataend ) { if ( ( const u_char * ) ( lshp + 1 ) > dataend ) goto trunc ; <START_BUG> ND_TCHECK ( lshp -> ls_type ) ; <END_BUG> ND_TCHECK ( lshp -> ls_seq ) ; ND_PRINT ( ( ndo, "\\n\\t     Advertising   Router   %s,   seq   0x%08x,   age   %us,   length   %u", ipaddr_string ( ndo, & lshp -> ls_router ), EXTRACT_32BITS ( & lshp -> ls_seq ), EXTRACT_16BITS ( & lshp -> ls_age ), EXTRACT_16BITS ( & lshp -> ls_length ) - ( u_int ) sizeof ( struct lsa6_hdr ) ) ) ; ospf6_print_ls_type ( ndo, EXTRACT_16BITS ( & lshp -> ls_type ), & lshp -> ls_stateid ) ; return ( 0 ) ; trunc : return ( 1 ) ; }

Fix:
<S2SV_ModStart> ( lshp -> ls_length <S2SV_ModEnd> ) ; ND_PRINT
Buggy code:
 static void <START_BUG> l2tp_proxy_auth_id_print ( netdissect_options * ndo, const u_char * dat ) <END_BUG> {  const uint16_t * ptr = ( const uint16_t * ) dat ; <START_BUG> ND_PRINT ( ( ndo, "%u", EXTRACT_16BITS ( ptr ) & L2TP_PROXY_AUTH_ID_MASK ) ) ; }<END_BUG>

Fix:
<S2SV_ModStart> u_char * dat, u_int length <S2SV_ModStart> ) dat ; if ( length < 2 ) { ND_PRINT ( ( ndo, "AVP <S2SV_blank> too <S2SV_blank> short" ) ) ; return ; }
Buggy code:
 static int forward_search_range ( regex_t * reg, const UChar * str, const UChar * end, UChar * s, UChar * range, UChar * * low, UChar * * high, UChar * * low_prev ) { UChar * p, * pprev = ( UChar * ) NULL ; # ifdef ONIG_DEBUG_SEARCH fprintf ( stderr, "forward_search_range:   str:   %d,   end:   %d,   s:   %d,   range:   %d\\n", ( int ) str, ( int ) end, ( int ) s, ( int ) range ) ; # endif p = s ; if ( reg -> dmin > 0 ) { if ( ONIGENC_IS_SINGLEBYTE ( reg -> enc ) ) { p += reg -> dmin ; } else { UChar * q = p + reg -> dmin ; <START_BUG> while ( p < q ) p += enclen ( reg -> enc, p ) ; <END_BUG> } } retry : switch ( reg -> optimize ) { case ONIG_OPTIMIZE_EXACT : p = slow_search ( reg -> enc, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_EXACT_IC : p = slow_search_ic ( reg -> enc, reg -> case_fold_flag, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_EXACT_BM : p = bm_search ( reg, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_EXACT_BM_NOT_REV : p = bm_search_notrev ( reg, reg -> exact, reg -> exact_end, p, end, range ) ; break ; case ONIG_OPTIMIZE_MAP : p = map_search ( reg -> enc, reg -> map, p, range ) ; break ; } if ( p && p < range ) { if ( p - reg -> dmin < s ) { retry_gate : pprev = p ; p += enclen ( reg -> enc, p ) ; goto retry ; } if ( reg -> sub_anchor ) { UChar *

Fix:
<S2SV_ModStart> -> dmin ; if ( q >= end ) return 0 ;
Buggy code:
 static vpx_codec_err_t ctrl_set_active_map ( vpx_codec_alg_priv_t * ctx, <START_BUG> int ctr_id, va_list args ) { <END_BUG> vpx_active_map_t * const map = va_arg ( args, vpx_active_map_t * ) ; if ( map ) {  if (! vp9_set_active_map ( ctx -> cpi, map -> active_map, map -> rows, map -> cols ) ) <START_BUG> return VPX_CODEC_OK ; else return VPX_CODEC_INVALID_PARAM ; } else { return VPX_CODEC_INVALID_PARAM ; } }<END_BUG>

Fix:
<S2SV_ModStart> * ctx, <S2SV_ModEnd> va_list args ) <S2SV_ModStart> -> active_map, ( int ) <S2SV_ModStart> -> rows, ( int )
Buggy code:
 static int fx_command ( effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, void * pCmdData, uint32_t * replySize, void * pReplyData ) { struct effect_s * effect = ( struct effect_s * ) self ; if ( effect == NULL ) return - EINVAL ; switch ( cmdCode ) { case EFFECT_CMD_INIT : if ( pReplyData == NULL || * replySize!= sizeof ( int ) ) return - EINVAL ; * ( int * ) pReplyData = 0 ; break ; case EFFECT_CMD_SET_CONFIG : { if ( pCmdData == NULL || cmdSize!= sizeof ( effect_config_t ) || pReplyData == NULL || * replySize!= sizeof ( int ) ) { ALOGV ( "fx_command()   EFFECT_CMD_SET_CONFIG   invalid   args" ) ; return - EINVAL ; } * ( int * ) pReplyData = session_set_config ( effect -> session, ( effect_config_t * ) pCmdData ) ; if ( * ( int * ) pReplyData!= 0 ) break ; if ( effect -> state!= EFFECT_STATE_ACTIVE ) * ( int * ) pReplyData = effect_set_state ( effect, EFFECT_STATE_CONFIG ) ; } break ; case EFFECT_CMD_GET_CONFIG : if ( pReplyData == NULL || * replySize!= sizeof ( effect_config_t ) ) { ALOGV ( "fx_command()   EFFECT_CMD_GET_CONFIG   invalid   args" ) ; return - EINVAL ; } session_get_config ( effect -> session, ( effect_config_t * ) pReplyData ) ; break ; case EFFECT_CMD_RESET : break ; case EFFECT_CMD_GET_PARAM : { if ( pCmdData == NULL || cmdSize < ( int ) sizeof ( effect_param_t ) || pReplyData == NULL || <START_BUG> * replySize < ( int ) sizeof ( effect_param_t ) ) { <END_BUG> ALOGV ( "fx_command()   EFFECT_CMD_GET_PARAM   invalid   args" ) ; return - EINVAL ; } effect_param_t * p = ( effect_param_t * ) p

Fix:
<S2SV_ModStart> ( int ) sizeof ( effect_param_t ) || ( ( effect_param_t * ) pCmdData ) -> psize > * replySize -
Buggy code:
 static int sctp_v6_xmit ( struct sk_buff * skb, struct sctp_transport * transport ) { struct sock * sk = skb -> sk ; struct ipv6_pinfo * np = inet6_sk ( sk ) ; <START_BUG> struct flowi6 fl6 ; <END_BUG> memset ( & fl6, 0, sizeof ( fl6 ) ) ; fl6. flowi6_proto = sk -> sk_protocol ; fl6. daddr = transport -> ipaddr. v6. sin6_addr ; fl6. saddr = transport -> saddr. v6. sin6_addr ; fl6. flowlabel = np -> flow_label ; IP6_ECN_flow_xmit ( sk, fl6. flowlabel ) ; if ( ipv6_addr_type ( & fl6. saddr ) & IPV6_ADDR_LINKLOCAL ) fl6. flowi6_oif = transport -> saddr. v6. sin6_scope_id ; else fl6. flowi6_oif = sk -> sk_bound_dev_if ; if ( np -> opt && np -> opt -> srcrt ) { struct rt0_hdr * rt0 = ( struct rt0_hdr * ) np -> opt -> srcrt ; fl6. daddr = * rt0 -> addr ; } pr_debug ( "%s:   skb:%p,   len:%d,   src:%pI6   dst:%pI6\\n", __func__, skb,  skb -> len, & fl6. saddr, & fl6. daddr ) ; <START_BUG> <END_BUG> SCTP_INC_STATS ( sock_net ( sk ), SCTP_MIB_OUTSCTPPACKS ) ;  if (! ( transport -> param_flags & SPP_PMTUD_ENABLE ) ) skb -> local_df = 1 ; <START_BUG> return ip6_xmit ( sk, skb, & fl6, np -> opt, np -> tclass ) ; <END_BUG> }

Fix:
<S2SV_ModStart> ; struct flowi6 * fl6 = & transport -> fl. u. ip6 ; <S2SV_ModEnd> pr_debug ( "%s: <S2SV_blank> skb:%p, <S2SV_blank> len:%d, <S2SV_blank> src:%pI6 <S2SV_blank> dst:%pI6\\n" <S2SV_ModStart>, & fl6 -> <S2SV_ModEnd> saddr, & <S2SV_ModStart>, & fl6 -> <S2SV_ModEnd> daddr ) ; <S2SV_ModStart> daddr ) ; IP6_ECN_flow_xmit ( sk, fl6 -> flowlabel <S2SV_ModEnd> ) ; if <S2SV_ModStart> = 1 ; SCTP_INC_STATS ( sock_net ( sk ), SCTP_MIB_OUTSCTPPACKS ) ; <S2SV_ModStart>, skb, <S2SV_ModEnd> fl6, np
Buggy code:
 long do_rt_tgsigqueueinfo ( pid_t tgid, pid_t pid, int sig, siginfo_t * info ) { if ( pid <= 0 || tgid <= 0 ) return - EINVAL ; <START_BUG> if ( info -> si_code >= 0 ) <END_BUG>  return - EPERM ; <START_BUG> info -> si_signo = sig ; return do_send_specific ( tgid, pid, sig, info ) ; }<END_BUG>

Fix:
<S2SV_ModStart> info -> si_code!= SI_QUEUE ) { WARN_ON_ONCE ( info -> si_code < 0 ) ; <S2SV_ModEnd> return - EPERM <S2SV_ModStart> - EPERM ; }
Buggy code:
 void httpParseAuthorizationField ( HttpConnection * connection, char_t * value ) { char_t * p ; char_t * token ; token = osStrtok_r ( value, "   \\t", & p ) ; if ( token == NULL ) { return ; } # if ( HTTP_SERVER_BASIC_AUTH_SUPPORT == ENABLED ) else if (! osStrcasecmp ( token, "Basic" ) ) { error_t error ; size_t n ; char_t * separator ; connection -> request. auth. mode = HTTP_AUTH_MODE_BASIC ; token = osStrtok_r ( NULL, "   \\t", & p ) ; if ( token!= NULL ) { error = base64Decode ( token, osStrlen ( token ), token, & n ) ; if (! error ) { token [ n ] = '\\0' ; <START_BUG> separator = strchr ( token, ':' ) ; <END_BUG> if ( separator!= NULL ) { * separator = '\\0' ; strSafeCopy ( connection -> request. auth. user, token, HTTP_SERVER_USERNAME_MAX_LEN ) ; token = separator + 1 ; connection -> request. auth. password = token ; } } } TRACE_DEBUG ( "Authorization   header:\\r\\n" ) ; TRACE_DEBUG ( "     username:   %s\\r\\n", connection -> request. auth. user ) ; TRACE_DEBUG ( "     password:   %s\\r\\n", connection -> request. auth. password ) ; } # endif # if ( HTTP_SERVER_DIGEST_AUTH_SUPPORT == ENABLED ) else if (! osStrcasecmp ( token, "Digest" ) ) { size_t n ; char_t * separator ; char_t * name ; connection -> request. auth. mode = HTTP_AUTH_MODE_DIGEST ; token = osStrtok_r ( NULL, ",", & p ) ; while ( token!= NULL ) {  separator = strchr ( token, '=' ) ; <START_BUG> if ( separator!= NULL ) { * separator = '\\0' ; name = strTrimWhitespace ( token ) ; value = strTrimWhitespace ( separator + 1 ) ; n = osStrlen ( value ) ; if ( n > 0 && value [ n - 1 ] == \'\\"\' ) value [ n - 1 ] = '\\0' ; if ( value [<END_BUG>

Fix:
<S2SV_ModStart> ; separator = osStrchr <S2SV_ModEnd> ( token, <S2SV_ModStart> { separator = osStrchr <S2SV_ModEnd> ( token,
Buggy code:
 void SetTransferMatrix ( double x11, double x12, double x21, double x22, double x, double y ) { if ( ( fabs ( x11 - 1. ) > 0.001 ) || ( fabs ( x22 - 1. ) > 0.001 ) || ( fabs ( x12 ) > 0.001 ) || ( fabs ( x21 ) > 0.001 ) || ( fabs ( x ) > 0.001 ) || ( fabs ( y ) > 0.001 ) ) { <START_BUG> outpos += <END_BUG> sprintf ( outpos, "%12.3f   %12.3f   %12.3f   %12.3f   %12.3f   %12.3f   cm\\n", x11, x12, x21, x22, x, y ) ;  } <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> ) ) { sprintf ( outputbuffer <S2SV_ModEnd>, "%12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> %12.3f <S2SV_blank> cm\\n", <S2SV_ModStart> y ) ; sendClean ( outputbuffer ) ;
Buggy code:
 <START_BUG> static int set_registers ( pegasus_t * pegasus, __u16 indx, __u16 size, void * data ) <END_BUG> {  int ret ; <START_BUG> ret = usb_control_msg ( pegasus -> usb, usb_sndctrlpipe ( pegasus -> usb, 0 ), PEGASUS_REQ_SET_REGS, PEGASUS_REQT_WRITE, 0, <END_BUG> indx, data, size, 100 ) ;  if ( ret < 0 ) netif_dbg ( pegasus, drv, pegasus -> net, "%s   returned   %d\\n", __func__, ret ) ; <START_BUG> return ret ; <END_BUG> }

Fix:
<S2SV_ModStart> __u16 size, const <S2SV_ModStart> data ) { u8 * buf ; int ret ; buf = kmemdup ( data, size, GFP_NOIO ) ; if (! buf ) return - ENOMEM <S2SV_ModEnd> ; ret = <S2SV_ModStart>, indx, buf <S2SV_ModEnd>, size, <S2SV_ModStart> ret ) ; kfree ( buf ) ;
Buggy code:
 static Image * ReadRLEImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { # define SkipLinesOp 0x01 # define SetColorOp 0x02 # define SkipPixelsOp 0x03 # define ByteDataOp 0x05 # define RunDataOp 0x06 # define EOFOp 0x07 char magick [ 12 ] ; Image * image ; int opcode, operand, status ; MagickStatusType flags ; MagickSizeType number_pixels ; MemoryInfo * pixel_info ; Quantum index ; register ssize_t x ; register Quantum * q ; register ssize_t i ; register unsigned char * p ; size_t bits_per_pixel, map_length, number_colormaps, number_planes, number_planes_filled, one, pixel_info_length ; ssize_t count, offset, y ; unsigned char background_color [ 256 ], * colormap, pixel, plane, * pixels ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; if ( image_info -> debug!= MagickFalse ) ( void ) LogMagickEvent ( TraceEvent, GetMagickModule ( ), "%s", image_info -> filename ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) return ( DestroyImageList ( image ) ) ; count = ReadBlob ( image, 2, ( unsigned char * ) magick ) ; if ( ( count!= 2 ) || ( memcmp ( magick, "\\122\\314", 2 )!= 0 ) ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; do { image -> page. x = ReadBlobLSBShort ( image ) ; image -> page. y = ReadBlobLSBShort ( image ) ; image -> columns = ReadBlobLSBShort ( image ) ; image -> rows = ReadBlobLSBShort ( image ) ; flags = ( MagickStatusType ) ReadBlobByte ( image ) ; image -> alpha_trait = flags & 0x04? BlendPixelTrait :

Fix:
<S2SV_ModStart> pixel_info ) ; ( void ) ResetMagickMemory ( pixels, 0, pixel_info_length ) ;
Buggy code:
 static int fts3tokFilterMethod ( sqlite3_vtab_cursor * pCursor, int idxNum, const char * idxStr, int nVal, sqlite3_value * * apVal ) { int rc = SQLITE_ERROR ; Fts3tokCursor * pCsr = ( Fts3tokCursor * ) pCursor ; Fts3tokTable * pTab = ( Fts3tokTable * ) ( pCursor -> pVtab ) ; UNUSED_PARAMETER ( idxStr ) ; UNUSED_PARAMETER ( nVal ) ; fts3tokResetCursor ( pCsr ) ; if ( idxNum == 1 ) { const char * zByte = ( const char * ) sqlite3_value_text ( apVal [ 0 ] ) ; int nByte = sqlite3_value_bytes ( apVal [ 0 ] ) ; <START_BUG> pCsr -> zInput = sqlite3_malloc ( nByte + 1 ) ; <END_BUG> if ( pCsr -> zInput == 0 ) { rc = SQLITE_NOMEM ; } else { memcpy ( pCsr -> zInput, zByte, nByte ) ; pCsr -> zInput [ nByte ] = 0 ; rc = pTab -> pMod -> xOpen ( pTab -> pTok, pCsr -> zInput, nByte, & pCsr -> pCsr ) ; if ( rc == SQLITE_OK ) { pCsr -> pCsr -> pTokenizer = pTab -> pTok ; } } } if ( rc!= SQLITE_OK ) return rc ; return fts3tokNextMethod ( pCursor ) ; }

Fix:
<S2SV_ModStart> -> zInput = sqlite3_malloc64 <S2SV_ModEnd> ( nByte +
Buggy code:
 int cib_remote_signon ( cib_t * cib, const char * name, enum cib_conn_type type ) { int rc = pcmk_ok ; cib_remote_opaque_t * private = cib -> variant_opaque ; if ( private -> passwd == NULL ) { struct termios settings ; int rc ; rc = tcgetattr ( 0, & settings ) ; settings. c_lflag &= ~ ECHO ; rc = tcsetattr ( 0, TCSANOW, & settings ) ; fprintf ( stderr, "Password:   " ) ; private -> passwd = calloc ( 1, 1024 ) ; rc = scanf ( "%s", private -> passwd ) ; fprintf ( stdout, "\\n" ) ; if ( rc < 1 ) { private -> passwd = NULL ; } settings. c_lflag |= ECHO ; rc = tcsetattr ( 0, TCSANOW, & settings ) ; } if ( private -> server == NULL || private -> user == NULL ) { rc = - EINVAL ; } if ( rc == pcmk_ok ) { <START_BUG> rc = cib_tls_signon ( cib, & ( private -> command ) ) ; <END_BUG> } if ( rc == pcmk_ok ) {  rc = cib_tls_signon ( cib, & ( private -> callback ) ) ; <START_BUG> } if ( rc == pcmk_ok ) { xmlNode * hello = cib_create_op ( 0, private -> callback. token, CRM_OP_REGISTER, NULL, NULL, NULL, 0, NULL ) ; crm_xml_add ( hello, F_CIB_CLIENTNAME, name ) ; crm_send_remote_msg ( private -> command. session, hello, private -> command. encrypted ) ; free_xml ( hello ) ; } if ( rc == pcmk_ok ) { fprintf ( stderr, "%s:   Opened   connection   to   %s:%d\\n", name, private -> server, private -> port ) ; cib -> state = cib_connected_command ; cib -> type = cib_command ; } else { fprintf ( stderr, "%s:   Connection   to   %s:%d   failed:   %s\\n", name, private -> server, private -> port, pc<END_BUG>

Fix:
<S2SV_ModStart> -> command ), FALSE <S2SV_ModStart> -> callback ), TRUE
Buggy code:
 static inline int do_exception ( struct pt_regs * regs, int access, unsigned long trans_exc_code ) { struct task_struct * tsk ; struct mm_struct * mm ; struct vm_area_struct * vma ; unsigned long address ; unsigned int flags ; int fault ; if ( notify_page_fault ( regs ) ) return 0 ; tsk = current ; mm = tsk -> mm ; fault = VM_FAULT_BADCONTEXT ; if ( unlikely (! user_space_fault ( trans_exc_code ) || in_atomic ( ) ||! mm ) ) goto out ; address = trans_exc_code & __FAIL_ADDR_MASK ; <START_BUG> perf_sw_event ( PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address ) ; <END_BUG> flags = FAULT_FLAG_ALLOW_RETRY ; if ( access == VM_WRITE || ( trans_exc_code & store_indication ) == 0x400 ) flags |= FAULT_FLAG_WRITE ; retry : down_read ( & mm -> mmap_sem ) ; fault = VM_FAULT_BADMAP ; vma = find_vma ( mm, address ) ; if (! vma ) goto out_up ; if ( unlikely ( vma -> vm_start > address ) ) { if (! ( vma -> vm_flags & VM_GROWSDOWN ) ) goto out_up ; if ( expand_stack ( vma, address ) ) goto out_up ; } fault = VM_FAULT_BADACCESS ; if ( unlikely (! ( vma -> vm_flags & access ) ) ) goto out_up ; if ( is_vm_hugetlb_page ( vma ) ) address &= HPAGE_MASK ; fault = handle_mm_fault ( mm, vma, address, flags ) ; if ( unlikely ( fault & VM_FAULT_ERROR ) ) goto out_up ; if ( flags & FAULT_FLAG_ALLOW_RETRY ) { if ( fault & VM_FAULT_MAJOR ) { tsk -> maj_flt ++ ;  perf_sw_event ( PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0, <START_BUG> regs, address ) ; } else { tsk -> min_flt ++ ; <END_BUG> perf_sw_event ( PERF_COUNT_SW_PAGE_

Fix:
<S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address <S2SV_ModStart>, 1, <S2SV_ModEnd> regs, address <S2SV_ModStart> PERF_COUNT_SW_PAGE_FAULTS_MIN, 1 <S2SV_ModEnd>, regs,
Buggy code:
 static void init_encode_frame_mb_context ( VP9_COMP * cpi ) { <START_BUG> MACROBLOCK * const x = & cpi -> mb ; <END_BUG> VP9_COMMON * const cm = & cpi -> common ; MACROBLOCKD * const xd = & x -> e_mbd ; const int aligned_mi_cols = mi_cols_aligned_to_sb ( cm -> mi_cols ) ;  x -> act_zbin_adj = 0 ; <START_BUG> <END_BUG> vp9_setup_src_planes ( x, cpi -> Source, 0, 0 ) ;  vp9_setup_pre_planes ( xd, 0, get_ref_frame_buffer ( cpi, LAST_FRAME ), 0, 0, NULL ) ; vp9_setup_dst_planes ( xd, get_frame_new_buffer ( cm ), 0, 0 ) ; vp9_setup_block_planes ( & x -> e_mbd, cm -> subsampling_x, cm -> subsampling_y ) ; <START_BUG> xd -> mi [ 0 ] -> mbmi. mode = DC_PRED ; <END_BUG> xd -> mi [ 0 ] -> mbmi. uv_mode = DC_PRED ; vpx_memset ( xd -> above_context [ 0 ], 0, sizeof ( * xd -> above_context [ 0 ] ) * 2 * aligned_mi_cols * MAX_MB_PLANE ) ;  vpx_memset ( xd -> above_seg_context, 0, <START_BUG> sizeof ( * xd -> above_seg_context ) * aligned_mi_cols ) ; }<END_BUG>

Fix:
<S2SV_ModStart> & cpi -> td. <S2SV_ModStart> mi_cols ) ; <S2SV_ModEnd> vp9_setup_src_planes ( x <S2SV_ModStart> cpi -> Source <S2SV_ModEnd>, 0, <S2SV_ModStart> subsampling_y ) ; memset <S2SV_ModEnd> ( xd -> <S2SV_ModStart> MAX_MB_PLANE ) ; memset <S2SV_ModEnd> ( xd ->
Buggy code:
 <START_BUG> static void search_filter_level ( const YV12_BUFFER_CONFIG * sd, VP9_COMP * cpi, <END_BUG> int partial_frame ) {  VP9_COMMON * const cm = & cpi -> common ; <START_BUG> <END_BUG> struct loopfilter * const lf = & cm -> lf ;  const int min_filter_level = 0 ; const int max_filter_level = get_max_filter_level ( cpi ) ; <START_BUG> int best_err ; <END_BUG> int filt_best ;  int filt_direction = 0 ; <START_BUG> int filt_mid = clamp ( lf -> filter_level, min_filter_level, max_filter_level ) ; int filter_step = filt_mid < 16? 4 : filt_mid // 4 ; <END_BUG> int ss_err [ MAX_LOOP_FILTER + 1 ] ;  <START_BUG> vpx_memset ( ss_err, 0xFF, sizeof ( ss_err ) ) ; <END_BUG> vpx_yv12_copy_y ( cm -> frame_to_show, & cpi -> last_frame_uf ) ; best_err = try_filter_frame ( sd, cpi, filt_mid, partial_frame ) ; filt_best = filt_mid ; ss_err [ filt_mid ] = best_err ; while ( filter_step > 0 ) { const int filt_high = MIN ( filt_mid + filter_step, max_filter_level ) ; const int filt_low = MAX ( filt_mid - filter_step, min_filter_level ) ;  int filt_err ; <START_BUG> int bias = ( best_err >> ( 15 - ( filt_mid // 8 ) ) ) * filter_step ; <END_BUG> if ( cpi -> twopass. section_intra_rating < 20 )  <START_BUG> bias = bias * cpi -> twopass. section_intra_rating // 20 ; <END_BUG> if ( cm -> tx_mode!= ONLY_4X4 ) bias >>= 1 ; if ( filt_direction <= 0 && filt_low!= filt_mid ) { if ( ss_err [ filt_low ] < 0 ) {  filt_err = try_filter_frame ( sd, cpi, filt_low, partial_frame ) ; <START_BUG> <END_BUG> ss_err [ filt_low ] = filt_err ;  } else { filt_err = ss_err

Fix:
<S2SV_ModStart> <S2SV_null> <S2SV_null> static int <S2SV_ModEnd> search_filter_level ( const <S2SV_ModStart> partial_frame ) { const <S2SV_ModStart> -> common ; const <S2SV_ModStart> ) ; int <S2SV_ModEnd> filt_direction = 0 <S2SV_ModStart> filt_direction = 0 ; int64_t best_err ; int filt_best <S2SV_ModStart> // 4 ; int64_t <S2SV_ModEnd> ss_err [ MAX_LOOP_FILTER <S2SV_ModStart> 1 ] ; memset <S2SV_ModEnd> ( ss_err, <S2SV_ModStart> min_filter_level ) ; int64_t <S2SV_ModEnd> bias = ( <S2SV_ModStart> filter_step ; if ( ( cpi -> oxcf. pass == 2 ) && <S2SV_ModStart> < 20 ) ) bias = ( <S2SV_ModEnd> bias * cpi <S2SV_ModStart> twopass. section_intra_rating ) <S2SV_ModStart> 0 ) { ss_err [ filt_low ] <S2SV_ModEnd> = try_filter_frame ( <S2SV_ModStart> partial_frame ) ; } if ( ( ss_err [ filt_low ] <S2SV_ModEnd> - bias ) <S2SV_ModStart> { if ( ss_err [ filt_low ] < best_err ) best_err = ss_err [ filt_low ] <S2SV_ModEnd> ; filt_best = <S2SV_ModStart> 0 ) { ss_err [ filt_high ] <S2SV_ModEnd> = try_filter_frame (
Buggy code:
 static int handle_keywordonly_args ( struct compiling * c, const node * n, int start, asdl_seq * kwonlyargs, asdl_seq * kwdefaults ) { PyObject * argname ; node * ch ; expr_ty expression, annotation ; arg_ty arg = NULL ; int i = start ; int j = 0 ; if ( kwonlyargs == NULL ) { ast_error ( c, CHILD ( n, start ), "named   arguments   must   follow   bare   *" ) ; return - 1 ; } assert ( kwdefaults!= NULL ) ; while ( i < NCH ( n ) ) { ch = CHILD ( n, i ) ; switch ( TYPE ( ch ) ) { case vfpdef : case tfpdef : if ( i + 1 < NCH ( n ) && TYPE ( CHILD ( n, i + 1 ) ) == EQUAL ) { expression = ast_for_expr ( c, CHILD ( n, i + 2 ) ) ; if (! expression ) goto error ; asdl_seq_SET ( kwdefaults, j, expression ) ; i += 2 ; } else { asdl_seq_SET ( kwdefaults, j, NULL ) ; } if ( NCH ( ch ) == 3 ) { annotation = ast_for_expr ( c, CHILD ( ch, 2 ) ) ; if (! annotation ) goto error ; } else { annotation = NULL ; } ch = CHILD ( ch, 0 ) ; argname = NEW_IDENTIFIER ( ch ) ; if (! argname ) goto error ; if ( forbidden_name ( c, argname, ch, 0 ) ) goto error ; arg = arg ( argname, annotation, NULL, LINENO ( ch ), ch -> n_col_offset, c -> c_arena ) ; if (! arg ) goto error ; asdl_seq_SET ( kwonlyargs, j ++, arg ) ; i += 1 ; <START_BUG> if ( TYPE ( CHILD ( n, i ) ) == COMMA ) <END_BUG> i += 1 ; break ; case TYPE_COMMENT : arg -> type_comment = NEW_TYPE_COMMENT ( ch ) ; if (! arg -> type_comment ) goto error ; i += 1 ; break ; case DOUBLESTAR : return i ; default : ast_error ( c, ch, "unexpected   node" ) ; goto error ;

Fix:
<S2SV_ModStart> ; if ( i < NCH ( n ) &&
Buggy code:
 <START_BUG> static INLINE int write_bit_gte ( vp9_writer * w, int word, int test ) { <END_BUG>  vp9_write_literal ( w, word >= test, 1 ) ; <START_BUG> return word >= test ; }<END_BUG>

Fix:
<S2SV_ModStart> int write_bit_gte ( vpx_writer <S2SV_ModEnd> * w, <S2SV_ModStart> test ) { vpx_write_literal <S2SV_ModEnd> ( w,
Buggy code:
 static block_t * Encode ( encoder_t * p_enc, picture_t * p_pic ) { encoder_sys_t * p_sys = p_enc -> p_sys ; block_t * p_block, * p_output_chain = NULL ; SchroFrame * p_frame ; bool b_go = true ; if (! p_pic ) { if (! p_sys -> started || p_sys -> b_eos_pulled ) return NULL ; if (! p_sys -> b_eos_signalled ) { p_sys -> b_eos_signalled = 1 ; schro_encoder_end_of_stream ( p_sys -> p_schro ) ; } } else { p_sys -> p_format -> interlaced =! p_pic -> b_progressive ; p_sys -> p_format -> top_field_first = p_pic -> b_top_field_first ; if ( p_sys -> b_auto_field_coding ) schro_encoder_setting_set_double ( p_sys -> p_schro, "interlaced_coding",! p_pic -> b_progressive ) ; } if (! p_sys -> started ) { date_t date ; if ( p_pic -> format. i_chroma!= p_enc -> fmt_in. i_codec ) { char chroma_in [ 5 ], chroma_out [ 5 ] ; vlc_fourcc_to_char ( p_pic -> format. i_chroma, chroma_in ) ; chroma_in [ 4 ] = '\\0' ; chroma_out [ 4 ] = '\\0' ; vlc_fourcc_to_char ( p_enc -> fmt_in. i_codec, chroma_out ) ; msg_Warn ( p_enc, "Resetting   chroma   from   %s   to   %s", chroma_out, chroma_in ) ; if (! SetEncChromaFormat ( p_enc, p_pic -> format. i_chroma ) ) { msg_Err ( p_enc, "Could   not   reset   chroma   format   to   %s", chroma_in ) ; return NULL ; } }

Fix:
<S2SV_ModStart> 5 ) ; if ( len > UINT32_MAX - sizeof ( eos ) ) return NULL ;
Buggy code:
 static void merge_param ( HashTable * params, zval * zdata, zval * * * current_param, zval * * * current_args TSRMLS_DC ) { zval * * ptr, * * zdata_ptr ; php_http_array_hashkey_t hkey = php_http_array_hashkey_init ( 0 ) ; # if 0 { zval tmp ; INIT_PZVAL_ARRAY ( & tmp, params ) ; fprintf ( stderr, "params   =   " ) ; zend_print_zval_r ( & tmp, 1 TSRMLS_CC ) ; fprintf ( stderr, "\\n" ) ; } # endif hkey. type = zend_hash_get_current_key_ex ( Z_ARRVAL_P ( zdata ), & hkey. str, & hkey. len, & hkey. num, hkey. dup, NULL ) ; if ( ( hkey. type == HASH_KEY_IS_STRING &&! zend_hash_exists ( params, hkey. str, hkey. len ) ) || ( hkey. type == HASH_KEY_IS_LONG &&! zend_hash_index_exists ( params, hkey. num ) ) ) { zval * tmp, * arg, * * args ; zend_hash_get_current_data ( Z_ARRVAL_P ( zdata ), ( void * ) & ptr ) ; Z_ADDREF_PP ( ptr ) ; MAKE_STD_ZVAL ( tmp ) ; array_init ( tmp ) ; add_assoc_zval_ex ( tmp, ZEND_STRS ( "value" ), * ptr ) ; MAKE_STD_ZVAL ( arg ) ; array_init ( arg ) ; zend_hash_update ( Z_ARRVAL_P ( tmp ), "arguments", sizeof ( "arguments" ), ( void * ) & arg, sizeof ( zval * ), ( void * ) & args ) ; * current_args = args ; if ( hkey. type == HASH_KEY_IS_STRING ) { zend_hash_update ( params, hkey. str, hkey. len, ( void * ) & tmp, sizeof ( zval * ), ( void * ) & ptr ) ;

Fix:
<S2SV_ModStart> ) == IS_ARRAY && Z_TYPE_PP ( ptr ) == IS_ARRAY
Buggy code:
 <START_BUG> static INLINE void write_buffer_16x16 ( int16_t * output, __m128i * in0, <END_BUG> __m128i * in1, int stride ) { write_buffer_8x8 ( output, in0, stride ) ; write_buffer_8x8 ( output + 8 * stride, in0 + 8, stride ) ; output += 8 ; write_buffer_8x8 ( output, in1, stride ) ; write_buffer_8x8 ( output + 8 * stride, in1 + 8, stride ) ; }

Fix:
<S2SV_ModStart> void write_buffer_16x16 ( tran_low_t <S2SV_ModEnd> * output,
Buggy code:
 static void t1mac_output_ascii ( char * s, int len ) { if ( blocktyp == POST_BINARY ) { output_current_post ( ) ; blocktyp = POST_ASCII ; } if ( len > 0 && s [ len - 1 ] == '\\n' ) s [ len - 1 ] = '\\r' ; t1mac_output_data ( ( byte * ) s, len ) ; if ( strncmp ( s, "//FontName", 9 ) == 0 ) { <START_BUG> for ( s += 9 ; isspace ( * s ) ; s ++ ) ; <END_BUG> if ( * s == '//' ) { const char * t = ++ s ;  while ( * t &&! isspace ( * t ) ) t ++ ; <START_BUG> free ( font_name ) ; font_name = ( char * ) malloc ( t - s + 1 ) ; memcpy ( font_name, s, t - s ) ; font_name [ t - s ] = 0 ; } } }<END_BUG>

Fix:
<S2SV_ModStart> ; isspace ( ( unsigned char ) <S2SV_ModStart>! isspace ( ( unsigned char )
Buggy code:
 static int track_header ( VividasDemuxContext * viv, AVFormatContext * s, uint8_t * buf, int size ) { int i, j, ret ; int64_t off ; int val_1 ; int num_video ; AVIOContext pb0, * pb = & pb0 ; ffio_init_context ( pb, buf, size, 0, NULL, NULL, NULL, NULL ) ; ffio_read_varlen ( pb ) ; avio_r8 ( pb ) ; val_1 = ffio_read_varlen ( pb ) ; for ( i = 0 ; i < val_1 ; i ++ ) { int c = avio_r8 ( pb ) ; if ( avio_feof ( pb ) ) return AVERROR_EOF ; for ( j = 0 ; j < c ; j ++ ) { if ( avio_feof ( pb ) ) return AVERROR_EOF ; avio_r8 ( pb ) ; avio_r8 ( pb ) ; } } avio_r8 ( pb ) ; off = avio_tell ( pb ) ; off += ffio_read_varlen ( pb ) ; avio_r8 ( pb ) ; num_video = avio_r8 ( pb ) ; avio_seek ( pb, off, SEEK_SET ) ; if ( num_video!= 1 ) { av_log ( s, AV_LOG_ERROR, "number   of   video   tracks   %d   is   not   1\\n", num_video ) ; return AVERROR_PATCHWELCOME ; } for ( i = 0 ; i < num_video ; i ++ ) { AVStream * st = avformat_new_stream ( s, NULL ) ; int num, den ; if (! st ) return AVERROR ( ENOMEM ) ; st -> id = i ; st -> codecpar -> codec_type = AVMEDIA_TYPE_VIDEO ; st -> codecpar -> codec_id = AV_CODEC_ID_VP6 ; off = avio_tell ( pb ) ; off += ffio_read_varlen ( pb ) ; avio_r8 ( pb ) ; avio_r8 ( pb )

Fix:
<S2SV_ModStart> int xd_size = 1 <S2SV_ModEnd> ; int data_len <S2SV_ModStart> xd_size += len + 1 + len // 255 ; } ret = ff_alloc_extradata ( st -> codecpar, xd_size <S2SV_ModEnd> ) ; if <S2SV_ModStart> ] ) ; av_assert0 ( delta <= xd_size - offset ) ; <S2SV_ModEnd> offset += delta <S2SV_ModStart> break ; } av_assert0 ( data_len [ j ] <= xd_size - offset ) ;
Buggy code:
 <START_BUG> static int decode_uniform ( vp9_reader * r ) { <END_BUG> const int l = 8 ; const int m = ( 1 << l ) - 191 ;  const int v = vp9_read_literal ( r, l - 1 ) ; <START_BUG> <END_BUG> return v < m? v : ( v << 1 ) - m + vp9_read_bit ( r ) ;  }

Fix:
<S2SV_ModStart> int decode_uniform ( vpx_reader <S2SV_ModEnd> * r ) <S2SV_ModStart> int v = vpx_read_literal <S2SV_ModEnd> ( r, <S2SV_ModStart> - m + vpx_read_bit <S2SV_ModEnd> ( r )
Buggy code:
 void pci_lintr_release ( struct pci_vdev * dev ) { struct businfo * bi ; struct slotinfo * si ; int pin ; bi = pci_businfo [ dev -> bus ] ; <START_BUG> assert ( bi!= NULL ) ; <END_BUG> si = & bi -> slotinfo [ dev -> slot ] ; for ( pin = 1 ; pin < 4 ; pin ++ ) { si -> si_intpins [ pin ]. ii_count = 0 ; si -> si_intpins [ pin ]. ii_pirq_pin = 0 ; si -> si_intpins [ pin ]. ii_ioapic_irq = 0 ; } }

Fix:
<S2SV_ModStart> bus ] ; if ( bi == NULL ) { pr_err ( "%s: <S2SV_blank> pci <S2SV_blank> [%s] <S2SV_blank> has <S2SV_blank> wrong <S2SV_blank> bus <S2SV_blank> %d <S2SV_blank> info!\\n", __func__, dev -> name, dev -> bus ) ; return ; } <S2SV_ModEnd> si = &
Buggy code:
 void shutdown_mib ( void ) { unload_all_mibs ( ) ; if ( tree_top ) { if ( tree_top -> label ) SNMP_FREE ( tree_top -> label ) ; SNMP_FREE ( tree_top ) ; } tree_head = NULL ; Mib = NULL ; <START_BUG> if ( _mibindexes ) { <END_BUG> int i ; for ( i = 0 ; i < _mibindex ; ++ i ) SNMP_FREE ( _mibindexes [ i ] ) ; free ( _mibindexes ) ; _mibindex = 0 ; _mibindex_max = 0 ; _mibindexes = NULL ; } if ( Prefix!= NULL && Prefix!= & Standard_Prefix [ 0 ] ) SNMP_FREE ( Prefix ) ; if ( Prefix ) Prefix = NULL ; SNMP_FREE ( confmibs ) ; SNMP_FREE ( confmibdir ) ; }

Fix:
<S2SV_ModStart> ; if ( <S2SV_ModEnd> Prefix!= NULL
Buggy code:
 krb5_error_code k5_asn1_full_decode ( const krb5_data * code, const struct atype_info * a, void * * retrep ) { krb5_error_code ret ; const uint8_t * contents, * remainder ; size_t clen, rlen ; taginfo t ; * retrep = NULL ; ret = get_tag ( ( uint8_t * ) code -> data, code -> length, & t, & contents, <START_BUG> & clen, & remainder, & rlen ) ; <END_BUG> if ( ret ) return ret ; if (! check_atype_tag ( a, & t ) ) return ASN1_BAD_ID ; return decode_atype_to_ptr ( & t, contents, clen, a, retrep ) ; }

Fix:
<S2SV_ModStart>, & rlen, 0
Buggy code:
 int ethertype_print ( netdissect_options * ndo, u_short ether_type, const u_char * p, u_int length, u_int caplen, const struct lladdr_info * src, const struct lladdr_info * dst ) { switch ( ether_type ) { case ETHERTYPE_IP : ip_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_IPV6 : ip6_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_ARP : case ETHERTYPE_REVARP : arp_print ( ndo, p, length, caplen ) ; return ( 1 ) ; case ETHERTYPE_DN : decnet_print ( ndo, p, length, caplen ) ; return ( 1 ) ; case ETHERTYPE_ATALK : if ( ndo -> ndo_vflag ) ND_PRINT ( ( ndo, "et1   " ) ) ; atalk_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_AARP : aarp_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_IPX : ND_PRINT ( ( ndo, "(NOV-ETHII)   " ) ) ; ipx_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_ISO : if ( length == 0 || caplen == 0 ) { ND_PRINT ( ( ndo, "   [|osi]" ) ) ; return ( 1 ) ; } <START_BUG> isoclns_print ( ndo, p + 1, length - 1, caplen - 1 ) ; <END_BUG> return ( 1 ) ; case ETHERTYPE_PPPOED : case ETHERTYPE_PPPOES : case ETHERTYPE_PPPOED2 : case ETHERTYPE_PPPOES2 : pppoe_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_EAPOL : eap_print ( ndo, p, length ) ; return ( 1 ) ; case ETHERTYPE_RRCP : rrcp_print ( ndo, p, length, src, dst ) ; return ( 1 ) ; case ETHER

Fix:
<S2SV_ModStart> length - 1 <S2SV_ModEnd> ) ; return