nus-yam/ex-repair huggingface dataset:
Buggy code:
 void wiki_handle_rest_call ( HttpRequest * req, HttpResponse * res, char * func ) { if ( func!= NULL && * func!= '\\0' ) { if (! strcmp ( func, "page//get" ) ) { char * page = http_request_param_get ( req, "page" ) ; if ( page == NULL ) page = http_request_get_query_string ( req ) ; <START_BUG> if ( page && ( access ( page, R_OK ) == 0 ) ) <END_BUG> { http_response_printf ( res, "%s", file_read ( page ) ) ; http_response_send ( res ) ; return ; } } else if (! strcmp ( func, "page//set" ) ) { char * wikitext = NULL, * page = NULL ; if ( ( ( wikitext = http_request_param_get ( req, "text" ) )!= NULL ) && ( ( page = http_request_param_get ( req, "page" ) )!= NULL ) ) {  file_write ( page, wikitext ) ; <START_BUG> http_response_printf ( res, "success" ) ; http_response_send ( res ) ; <END_BUG> return ;  } } else if (! strcmp ( func, "page//delete" ) ) { char * page = http_request_param_get ( req, "page" ) ; if ( page == NULL ) page = http_request_get_query_string ( req ) ; <START_BUG> if ( page && ( unlink ( page ) > 0 ) ) <END_BUG> { http_response_printf ( res, "success" ) ; http_response_send ( res ) ; return ; } } else if (! strcmp ( func, "page//exists" ) ) { char * page = http_request_param_get ( req, "page" ) ; if ( page == NULL ) page = http_request_get_query_string ( req ) ;  if ( page && ( access ( page, R_OK ) == 0 ) ) <START_BUG> { http_response_printf ( res, "success" ) ; http_response_send ( res ) ; return ; } } else if (! strcmp ( func, "pages" ) ||! strcmp ( func, "search" ) ) { WikiPageList * * pages = NULL ; int n_pages,<END_BUG>

Fix:
<S2SV_ModStart> ( page && page_name_is_good ( page ) && <S2SV_ModStart> ) ) { if ( page_name_is_good ( page ) ) { <S2SV_ModStart> ; return ; } <S2SV_ModStart> ( page && page_name_is_good ( page ) && <S2SV_ModStart> if ( page && page_name_is_good ( page )
Buggy code:
 int ipmi_si_mem_setup ( struct si_sm_io * io ) { unsigned long addr = io -> addr_data ; int mapsize, idx ; if (! addr ) return - ENODEV ; <START_BUG> io -> io_cleanup = mem_cleanup ; <END_BUG> switch ( io -> regsize ) { case 1 : io -> inputb = intf_mem_inb ; io -> outputb = intf_mem_outb ; break ; case 2 : io -> inputb = intf_mem_inw ; io -> outputb = intf_mem_outw ; break ; case 4 : io -> inputb = intf_mem_inl ; io -> outputb = intf_mem_outl ; break ; # ifdef readq case 8 : io -> inputb = mem_inq ; io -> outputb = mem_outq ; break ; # endif default : dev_warn ( io -> dev, "Invalid   register   size:   %d\\n", io -> regsize ) ; return - EINVAL ; } for ( idx = 0 ; idx < io -> io_size ; idx ++ ) { if ( request_mem_region ( addr + idx * io -> regspacing, io -> regsize, DEVICE_NAME ) == NULL ) { mem_region_cleanup ( io, idx ) ; return - EIO ; } } mapsize = ( ( io -> io_size * io -> regspacing ) - ( io -> regspacing - io -> regsize ) ) ; io -> addr = ioremap ( addr, mapsize ) ; if ( io -> addr == NULL ) { mem_region_cleanup ( io, io -> io_size ) ; return - EIO ; }  return 0 ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> - ENODEV ; <S2SV_ModEnd> switch ( io <S2SV_ModStart> EIO ; } io -> io_cleanup = mem_cleanup ;
Buggy code:
 static int traceDirective ( MaState * state, cchar * key, cchar * value ) { HttpRoute * route ; char * option, * ovalue, * tok ; route = state -> route ; route -> trace = httpCreateTrace ( route -> trace ) ; for ( option = stok ( sclone ( value ), "   \\t", & tok ) ; option ; option = stok ( 0, "   \\t", & tok ) ) { <START_BUG> option = stok ( option, "   =\\t,", & ovalue ) ; <END_BUG> ovalue = strim ( ovalue, "\\"\'", MPR_TRIM_BOTH ) ; if ( smatch ( option, "content" ) ) { httpSetTraceContentSize ( route -> trace, ( ssize ) getnum ( ovalue ) ) ; } else { httpSetTraceEventLevel ( route -> trace, option, atoi ( ovalue ) ) ; } } return 0 ; }

Fix:
<S2SV_ModStart> { option = ssplit <S2SV_ModEnd> ( option,
Buggy code:
 static int coolkey_add_object ( coolkey_private_data_t * priv, unsigned long object_id, const u8 * object_data, size_t object_length, int add_v1_record ) { sc_cardctl_coolkey_object_t new_object ; int r ; memset ( & new_object, 0, sizeof ( new_object ) ) ; new_object. path = coolkey_template_path ; new_object. path. len = 4 ; ulong2bebytes ( new_object. path. value, object_id ) ; new_object. id = object_id ; new_object. length = object_length ; <START_BUG> if ( object_data ) { <END_BUG> new_object. data = malloc ( object_length + add_v1_record ) ; if ( new_object. data == NULL ) { return SC_ERROR_OUT_OF_MEMORY ; } if ( add_v1_record ) { new_object. data [ 0 ] = COOLKEY_V1_OBJECT ; new_object. length ++ ; } memcpy ( & new_object. data [ add_v1_record ], object_data, object_length ) ; } r = coolkey_add_object_to_list ( & priv -> objects_list, & new_object ) ; if ( r!= SC_SUCCESS ) { free ( new_object. data ) ; new_object. data = NULL ; } return r ; }

Fix:
<S2SV_ModStart> ; if ( coolkey_find_object_by_id ( & priv -> objects_list, object_id )!= NULL ) { return SC_ERROR_INTERNAL ; } if (
Buggy code:
 PyObject * ast2obj_arg ( void * _o ) { arg_ty o = ( arg_ty ) _o ; PyObject * result = NULL, * value = NULL ; if (! o ) { Py_RETURN_NONE ; } result = PyType_GenericNew ( arg_type, NULL, NULL ) ; if (! result ) return NULL ; value = ast2obj_identifier ( o -> arg ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_arg, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_expr ( o -> annotation ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_annotation, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; <START_BUG> value = ast2obj_int ( o -> lineno ) ; <END_BUG> if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_lineno, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> col_offset ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_col_offset, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> end_lineno ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_end_lineno, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; value = ast2obj_int ( o -> end_col_offset ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_end_col_offset, value ) < 0 ) goto failed ; Py_DECREF ( value ) ; return result ; failed : Py_XDECREF ( value ) ; Py_XDECREF ( result ) ; return NULL ; }

Fix:
<S2SV_ModStart> ; value = ast2obj_string ( o -> type_comment ) ; if (! value ) goto failed ; if ( _PyObject_SetAttrId ( result, & PyId_type_comment, value ) == - 1 ) goto failed ; Py_DECREF ( value ) ; value =
Buggy code:
 static struct berval * * krb5_encode_krbsecretkey ( krb5_key_data * key_data_in, int n_key_data, krb5_kvno mkvno ) { struct berval * * ret = NULL ; int currkvno ; int num_versions = 1 ; int i, j, last ; krb5_error_code err = 0 ; <START_BUG> krb5_key_data * key_data ; <END_BUG> if ( n_key_data <= 0 ) return NULL ; key_data = k5calloc ( n_key_data, sizeof ( * key_data ), & err ) ;  if ( key_data_in == NULL ) <START_BUG> goto cleanup ; memcpy ( key_data, key_data_in, n_key_data * sizeof ( * key_data ) ) ; for ( i = 0 ; i < n_key_data ; i ++ ) { if ( key_data [ i ]. key_data_ver == 1 ) { key_data [ i ]. key_data_ver = 2 ; key_data [ i ]. key_data_type [ 1 ] = KRB5_KDB_SALTTYPE_NORMAL ; key_data [ i ]. key_data_length [ 1 ] = 0 ; key_data [ i ]. key_data_contents [ 1 ] = NULL ; } } for ( i = 0 ; i < n_key_data - 1 ; i ++ ) if ( key_data [ i ]. key_data_kvno!= key_data [ i + 1 ]. key_data_kvno ) num_versions ++ ; ret = ( struct berval * * ) calloc ( num_versions + 1, sizeof ( struct berval * ) ) ; if ( ret == NULL ) { err = ENOMEM ; goto cleanup ; } for ( i = 0, last = 0, j = 0, currkvno = key_data [ 0 ]. key_data_kvno ; i < n_key_data ; i ++ ) { krb5_data * code ; if ( i == n_key_data - 1 || key_data [ i + 1 ]. key_data_kvno!= currkvno ) { ret [ j ] = k5alloc ( sizeof ( struct berval ), &<END_BUG>

Fix:
<S2SV_ModStart> krb5_key_data * key_data = NULL ; if ( n_key_data < <S2SV_ModEnd> 0 ) return <S2SV_ModStart> ; if ( key_data <S2SV_ModEnd> == NULL ) <S2SV_ModStart> = 0 ; ret [ i ]!= NULL <S2SV_ModEnd> ; i ++ <S2SV_ModStart> i ++ ) <S2SV_ModEnd> free ( ret
Buggy code:
 static int decode_getacl ( struct xdr_stream * xdr, struct rpc_rqst * req, <START_BUG> size_t * acl_len ) <END_BUG> {  __be32 * savep ; <START_BUG> uint32_t attrlen, bitmap [ 3 ] = { 0 } ; struct kvec * iov = req -> rq_rcv_buf. head ; int status ; <END_BUG> * acl_len = 0 ;  if ( ( status = decode_op_hdr ( xdr, OP_GETATTR ) )!= 0 ) <START_BUG> goto out ; <END_BUG> if ( ( status = decode_attr_bitmap ( xdr, bitmap ) )!= 0 ) goto out ; if ( ( status = decode_attr_length ( xdr, & attrlen, & savep ) )!= 0 ) goto out ; if ( unlikely ( bitmap [ 0 ] & ( FATTR4_WORD0_ACL - 1U ) ) ) return - EIO ; if ( likely ( bitmap [ 0 ] & FATTR4_WORD0_ACL ) ) { size_t hdrlen ; u32 recvd ;  hdrlen = ( u8 * ) xdr -> p - ( u8 * ) iov -> iov_base ; <START_BUG> recvd = req -> rq_rcv_buf. len - hdrlen ; if ( attrlen > recvd ) { <END_BUG> dprintk ( "NFS:   server   cheating   in   getattr"  "   acl   reply:   attrlen   %u   >   recvd   %u\\n", attrlen, recvd ) ; return - EINVAL ; } xdr_read_pages ( xdr, attrlen ) ; <START_BUG> * acl_len = attrlen ; <END_BUG> } else status = - EOPNOTSUPP ; out : return status ; }

Fix:
<S2SV_ModStart> * req, struct nfs_getaclres * res <S2SV_ModEnd> ) { __be32 <S2SV_ModStart> __be32 * savep, * bm_p <S2SV_ModStart> int status ; res -> <S2SV_ModEnd> acl_len = 0 <S2SV_ModStart> ) goto out ; bm_p = xdr -> p <S2SV_ModStart> u32 recvd ; xdr -> p = bm_p ; res -> acl_data_offset = be32_to_cpup ( bm_p ) + 2 ; res -> acl_data_offset <<= 2 ; <S2SV_ModStart> iov -> iov_base ; attrlen += res -> acl_data_offset <S2SV_ModStart> recvd ) { if ( res -> acl_flags & NFS4_ACL_LEN_REQUEST ) { res -> acl_len = attrlen ; goto out ; } dprintk ( "NFS: <S2SV_blank> acl <S2SV_blank> reply: <S2SV_blank> attrlen <S2SV_blank> %u <S2SV_blank> > <S2SV_blank> recvd <S2SV_blank> %u\\n" <S2SV_ModEnd>, attrlen, <S2SV_ModStart> attrlen ) ; res -> <S2SV_ModEnd> acl_len = attrlen
Buggy code:
 static int af9005_identify_state ( struct usb_device * udev, struct dvb_usb_device_properties * props, struct dvb_usb_device_description * * desc, int * cold ) { int ret ; u8 reply, * buf ; buf = kmalloc ( FW_BULKOUT_SIZE + 2, GFP_KERNEL ) ; if (! buf ) return - ENOMEM ; ret = af9005_boot_packet ( udev, FW_CONFIG, & reply, buf, FW_BULKOUT_SIZE + 2 ) ; if ( ret ) goto err ; deb_info ( "result   of   FW_CONFIG   in   identify   state   %d\\n", reply ) ; if ( reply == 0x01 ) * cold = 1 ; else if ( reply == 0x02 ) * cold = 0 ; else <START_BUG> return - EIO ; <END_BUG> deb_info ( "Identify   state   cold   =   %d\\n", * cold ) ; err : kfree ( buf ) ; return ret ; }

Fix:
<S2SV_ModStart> 0 ; else ret = <S2SV_ModEnd> - EIO ; <S2SV_ModStart> - EIO ; if (! ret )
Buggy code:
 struct ipv6_txoptions * ipv6_renew_options ( struct sock * sk, struct ipv6_txoptions * opt, int newtype, struct ipv6_opt_hdr __user * newopt, int newoptlen ) { int tot_len = 0 ; char * p ; struct ipv6_txoptions * opt2 ; int err ; if ( opt ) { if ( newtype!= IPV6_HOPOPTS && opt -> hopopt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> hopopt ) ) ; if ( newtype!= IPV6_RTHDRDSTOPTS && opt -> dst0opt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> dst0opt ) ) ; if ( newtype!= IPV6_RTHDR && opt -> srcrt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> srcrt ) ) ; if ( newtype!= IPV6_DSTOPTS && opt -> dst1opt ) tot_len += CMSG_ALIGN ( ipv6_optlen ( opt -> dst1opt ) ) ; } if ( newopt && newoptlen ) tot_len += CMSG_ALIGN ( newoptlen ) ; if (! tot_len ) return NULL ; tot_len += sizeof ( * opt2 ) ; opt2 = sock_kmalloc ( sk, tot_len, GFP_ATOMIC ) ; if (! opt2 ) return ERR_PTR ( - ENOBUFS ) ; memset ( opt2, 0, tot_len ) ; <START_BUG> opt2 -> tot_len = tot_len ; <END_BUG> p = ( char * ) ( opt2 + 1 ) ; err = ipv6_renew_option ( opt? opt -> hopopt : NULL, newopt, newoptlen, newtype!= IPV6_HOPOPTS, & opt2 -> hopopt, & p ) ; if ( err ) goto out ; err = ipv6_renew_option ( opt? opt -> dst0opt : NULL, newopt, newoptlen, newtype!= IPV6_RTHDRDSTOPTS, & opt2 -> dst0opt, & p ) ; if ( err ) goto out ; err = ipv6_renew_option ( opt? opt -> srcrt : NULL, new

Fix:
<S2SV_ModStart> tot_len ) ; atomic_set ( & opt2 -> refcnt, 1 ) ;
Buggy code:
 <START_BUG> static char * print_string ( cJSON * item ) <END_BUG> {  return print_string_ptr ( item -> valuestring ) ; <START_BUG> }<END_BUG>

Fix:
<S2SV_ModStart> cJSON * item, printbuffer * p <S2SV_ModStart> item -> valuestring, p
Buggy code:
 static void setup_pass ( struct stream_state * stream, struct VpxEncoderConfig * global, int pass ) { if ( stream -> config. stats_fn ) { if (! stats_open_file ( & stream -> stats, stream -> config. stats_fn, pass ) ) fatal ( "Failed   to   open   statistics   store" ) ; } else { if (! stats_open_mem ( & stream -> stats, pass ) ) fatal ( "Failed   to   open   statistics   store" ) ; } <START_BUG> stream -> config. cfg. g_pass = global -> passes == 2 <END_BUG>? pass? VPX_RC_LAST_PASS : VPX_RC_FIRST_PASS : VPX_RC_ONE_PASS ;  if ( pass ) <START_BUG> stream -> config. cfg. rc_twopass_stats_in = stats_get ( & stream -> stats ) ; <END_BUG> stream -> cx_time = 0 ;  stream -> nbytes = 0 ; stream -> frames_out = 0 ; }

Fix:
<S2SV_ModStart> ) ; } # if CONFIG_FP_MB_STATS if ( stream -> config. fpmb_stats_fn ) { if (! stats_open_file ( & stream -> fpmb_stats, stream -> config. fpmb_stats_fn, pass ) ) fatal ( "Failed <S2SV_blank> to <S2SV_blank> open <S2SV_blank> mb <S2SV_blank> statistics <S2SV_blank> store" ) ; } else { if (! stats_open_mem ( & stream -> fpmb_stats, pass ) ) fatal ( "Failed <S2SV_blank> to <S2SV_blank> open <S2SV_blank> mb <S2SV_blank> statistics <S2SV_blank> store" ) ; } # endif <S2SV_ModStart> ( pass ) { <S2SV_ModStart> stats ) ; # if CONFIG_FP_MB_STATS stream -> config. cfg. rc_firstpass_mb_stats_in = stats_get ( & stream -> fpmb_stats ) ; # endif }
Buggy code:
 static PyObject * _pickle_UnpicklerMemoProxy_copy_impl ( UnpicklerMemoProxyObject * self ) { <START_BUG> Py_ssize_t i ; <END_BUG> PyObject * new_memo = PyDict_New ( ) ; if ( new_memo == NULL ) return NULL ; for ( i = 0 ; i < self -> unpickler -> memo_size ; i ++ ) { int status ; PyObject * key, * value ; value = self -> unpickler -> memo [ i ] ; if ( value == NULL ) continue ; key = PyLong_FromSsize_t ( i ) ; if ( key == NULL ) goto error ; status = PyDict_SetItem ( new_memo, key, value ) ; Py_DECREF ( key ) ; if ( status < 0 ) goto error ; } return new_memo ; error : Py_DECREF ( new_memo ) ; return NULL ; }

Fix:
<S2SV_ModStart> self ) { size_t <S2SV_ModEnd> i ; PyObject
Buggy code:
 const char * nghttp2_strerror ( int error_code ) { switch ( error_code ) { case 0 : return "Success" ; case NGHTTP2_ERR_INVALID_ARGUMENT : return "Invalid   argument" ; case NGHTTP2_ERR_BUFFER_ERROR : return "Out   of   buffer   space" ; case NGHTTP2_ERR_UNSUPPORTED_VERSION : return "Unsupported   SPDY   version" ; case NGHTTP2_ERR_WOULDBLOCK : return "Operation   would   block" ; case NGHTTP2_ERR_PROTO : return "Protocol   error" ; case NGHTTP2_ERR_INVALID_FRAME : return "Invalid   frame   octets" ; case NGHTTP2_ERR_EOF : return "EOF" ; case NGHTTP2_ERR_DEFERRED : return "Data   transfer   deferred" ; case NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE : return "No   more   Stream   ID   available" ; case NGHTTP2_ERR_STREAM_CLOSED : return "Stream   was   already   closed   or   invalid" ; case NGHTTP2_ERR_STREAM_CLOSING : return "Stream   is   closing" ; case NGHTTP2_ERR_STREAM_SHUT_WR : return "The   transmission   is   not   allowed   for   this   stream" ; case NGHTTP2_ERR_INVALID_STREAM_ID : return "Stream   ID   is   invalid" ; case NGHTTP2_ERR_INVALID_STREAM_STATE : return "Invalid   stream   state" ; case NGHTTP2_ERR_DEFERRED_DATA_EXIST : return "Another   DATA   frame   has   already   been   deferred" ; case NGHTTP2_ERR_START_STREAM_NOT_ALLOWED : return "request   HEADERS   is   not   allowed" ; case NGHTTP2_ERR_GOAWAY_ALREADY_SENT : return "GOAWAY   has   already   been   sent" ; case NGHTTP2_ERR_INVALID_HEADER_BLOCK : return "Invalid   header   block" ; case NGHTTP2_ERR_INVALID_STATE : return "Invalid   state" ; case NGHTTP2_ERR_TEMPORAL_

Fix:
<S2SV_ModStart> "Flooding <S2SV_blank> was <S2SV_blank> detected <S2SV_blank> in <S2SV_blank> this <S2SV_blank> HTTP//2 <S2SV_blank> session, <S2SV_blank> and <S2SV_blank> it <S2SV_blank> must <S2SV_blank> be <S2SV_blank> " "closed" ; case NGHTTP2_ERR_TOO_MANY_SETTINGS : return "SETTINGS <S2SV_blank> frame <S2SV_blank> contained <S2SV_blank> more <S2SV_blank> than <S2SV_blank> the <S2SV_blank> maximum <S2SV_blank> allowed <S2SV_blank> entries" ;
Buggy code:
 static void calc_av_activity ( VP8_COMP * cpi, int64_t activity_sum ) { # if ACT_MEDIAN { unsigned int median ; unsigned int i, j ; unsigned int * sortlist ; unsigned int tmp ; CHECK_MEM_ERROR ( sortlist, vpx_calloc ( sizeof ( unsigned int ), cpi -> common. MBs ) ) ; <START_BUG> vpx_memcpy ( sortlist, cpi -> mb_activity_map, <END_BUG> sizeof ( unsigned int ) * cpi -> common. MBs ) ; for ( i = 1 ; i < cpi -> common. MBs ; i ++ ) { for ( j = i ; j > 0 ; j -- ) { if ( sortlist [ j ] < sortlist [ j - 1 ] ) { tmp = sortlist [ j - 1 ] ; sortlist [ j - 1 ] = sortlist [ j ] ; sortlist [ j ] = tmp ; } else break ; } } median = ( 1 + sortlist [ cpi -> common. MBs >> 1 ] + sortlist [ ( cpi -> common. MBs >> 1 ) + 1 ] ) >> 1 ; cpi -> activity_avg = median ; vpx_free ( sortlist ) ; } # else cpi -> activity_avg = ( unsigned int ) ( activity_sum // cpi -> common. MBs ) ; # endif if ( cpi -> activity_avg < VP8_ACTIVITY_AVG_MIN ) cpi -> activity_avg = VP8_ACTIVITY_AVG_MIN ; if ( ALT_ACT_MEASURE ) cpi -> activity_avg = 100000 ; }

Fix:
<S2SV_ModStart> ) ) ; memcpy <S2SV_ModEnd> ( sortlist,
Buggy code:
 WORD32 ihevcd_ref_list ( codec_t * ps_codec, pps_t * ps_pps, sps_t * ps_sps, slice_header_t * ps_slice_hdr ) { <START_BUG> WORD32 i ; <END_BUG> WORD32 st_rps_idx ; WORD32 num_neg_pics, num_pos_pics ; WORD8 * pi1_used ; WORD16 * pi2_delta_poc ; UWORD32 u4_max_poc_lsb ; pic_buf_t * ps_pic_buf ; mv_buf_t * ps_mv_buf ; UWORD32 r_idx ; dpb_mgr_t * ps_dpb_mgr = ( dpb_mgr_t * ) ps_codec -> pv_dpb_mgr ; buf_mgr_t * ps_mv_buf_mgr = ( buf_mgr_t * ) ps_codec -> pv_mv_buf_mgr ; WORD32 ai4_poc_st_curr_before [ MAX_DPB_SIZE ], ai4_poc_st_foll [ MAX_DPB_SIZE ], ai4_poc_st_curr_after [ MAX_DPB_SIZE ] ; WORD32 ai4_poc_lt_curr [ MAX_DPB_SIZE ], ai4_poc_lt_foll [ MAX_DPB_SIZE ] ; UWORD32 u4_num_st_curr_before, u4_num_st_foll, u4_num_st_curr_after, u4_num_lt_curr, u4_num_lt_foll ; UWORD32 u4_num_total_curr ; WORD8 ai1_curr_delta_poc_msb_present_flag [ MAX_DPB_SIZE ], ai1_foll_delta_poc_msb_present_flag [ MAX_DPB_SIZE ] ; pic_buf_t * as_ref_pic_lt_curr [ MAX_DPB_SIZE ] ; pic_buf_t * as_ref_pic_lt_foll [ MAX_DPB_SIZE ] ; pic_buf_t * as_ref_pic_st_curr_after [ MAX_DPB_

Fix:
<S2SV_ModStart> { WORD32 i, j <S2SV_ModStart> ; for ( j = 0 ; j < ps_codec -> i4_max_dpb_size ; j <S2SV_ModEnd> ++ ) { <S2SV_ModStart> -> pv_mv_buf_mgr, j <S2SV_ModEnd>, BUF_MGR_REF )
Buggy code:
 static void add_password ( AUTH_HDR * request, unsigned char type, CONST char * password, char * secret ) { MD5_CTX md5_secret, my_md5 ; unsigned char misc [ AUTH_VECTOR_LEN ] ; int i ; int length = strlen ( password ) ; unsigned char hashed [ 256 + AUTH_PASS_LEN ] ; unsigned char * vector ; attribute_t * attr ; if ( length > MAXPASS ) { length = MAXPASS ; } if ( length == 0 ) { length = AUTH_PASS_LEN ; } if ( ( length & ( AUTH_PASS_LEN - 1 ) )!= 0 ) { length += ( AUTH_PASS_LEN - 1 ) ; length &= ~ ( AUTH_PASS_LEN - 1 ) ; } memset ( hashed, 0, length ) ; <START_BUG> memcpy ( hashed, password, strlen ( password ) ) ; <END_BUG> attr = find_attribute ( request, PW_PASSWORD ) ; if ( type == PW_PASSWORD ) { vector = request -> vector ; } else { vector = attr -> data ; } MD5Init ( & md5_secret ) ; MD5Update ( & md5_secret, ( unsigned char * ) secret, strlen ( secret ) ) ; my_md5 = md5_secret ; MD5Update ( & my_md5, vector, AUTH_VECTOR_LEN ) ; MD5Final ( misc, & my_md5 ) ; xor ( hashed, misc, AUTH_PASS_LEN ) ; for ( i = 1 ; i < ( length >> 4 ) ; i ++ ) { my_md5 = md5_secret ; MD5Update ( & my_md5, & hashed [ ( i - 1 ) * AUTH_PASS_LEN ], AUTH_PASS_LEN ) ; MD5Final ( misc, & my_md5 ) ; xor ( & hashed [ i * AUTH_PASS_LEN ], misc, AUTH_PASS_LEN ) ; } if ( type == PW_OLD_PASSWORD ) { attr = find_attribute ( request, PW_OLD_PASSWORD ) ; } if (! attr ) { add_attribute ( request, type, hashed, length ) ; } else { memcpy ( attr -> data, hashed, length ) ; } }

Fix:
<S2SV_ModStart>, password, length <S2SV_ModEnd> ) ; attr
Buggy code:
 static Image * ReadMATImage ( const ImageInfo * image_info, ExceptionInfo * exception ) { Image * image, * image2 = NULL, * rotated_image ; register Quantum * q ; unsigned int status ; MATHeader MATLAB_HDR ; size_t size ; size_t CellType ; QuantumInfo * quantum_info ; ImageInfo * clone_info ; int i ; ssize_t ldblk ; unsigned char * BImgBuff = NULL ; double MinVal, MaxVal ; unsigned z, z2 ; unsigned Frames ; int logging ; int sample_size ; MagickOffsetType filepos = 0x80 ; BlobInfo * blob ; size_t one ; unsigned int ( * ReadBlobXXXLong ) ( Image * image ) ; unsigned short ( * ReadBlobXXXShort ) ( Image * image ) ; void ( * ReadBlobDoublesXXX ) ( Image * image, size_t len, double * data ) ; void ( * ReadBlobFloatsXXX ) ( Image * image, size_t len, float * data ) ; assert ( image_info!= ( const ImageInfo * ) NULL ) ; assert ( image_info -> signature == MagickCoreSignature ) ; assert ( exception!= ( ExceptionInfo * ) NULL ) ; assert ( exception -> signature == MagickCoreSignature ) ; logging = LogMagickEvent ( CoderEvent, GetMagickModule ( ), "enter" ) ; image = AcquireImage ( image_info, exception ) ; status = OpenBlob ( image_info, image, ReadBinaryBlobMode, exception ) ; if ( status == MagickFalse ) { image = DestroyImageList ( image ) ; return ( ( Image * ) NULL ) ; <START_BUG> } <END_BUG> clone_info = CloneImageInfo ( image_info ) ; if ( ReadBlob ( image, 124, ( unsigned char * ) & MATLAB_HDR. identific )!= 124 ) ThrowReaderException ( CorruptImageError, "ImproperImageHeader" ) ; if ( strncmp ( MATLAB_HDR. identific, "MATLAB", 6 )!= 0 ) { image2 = ReadMATImageV4 ( image_info, image, exception ) ; if ( image2 == NULL ) goto MATLAB_KO ; image = image2 ; goto END_OF_READING ;

Fix:
<S2SV_ModStart> ) ; } quantum_info = ( QuantumInfo * ) NULL ; <S2SV_ModStart> BImgBuff ) ; if ( quantum_info!= ( QuantumInfo * ) NULL )
Buggy code:
 void luaD_shrinkstack ( lua_State * L ) { int inuse = stackinuse ( L ) ; <START_BUG> int goodsize = inuse + ( inuse // 8 ) + 2 * EXTRA_STACK ; <END_BUG> if ( goodsize > LUAI_MAXSTACK ) goodsize = LUAI_MAXSTACK ; if ( inuse <= ( LUAI_MAXSTACK - EXTRA_STACK ) && goodsize < L -> stacksize ) luaD_reallocstack ( L, goodsize, 0 ) ; else condmovestack ( L, { }, { } ) ; luaE_shrinkCI ( L ) ; }

Fix:
<S2SV_ModStart> = inuse + BASIC_STACK_SIZE <S2SV_ModEnd> ; if (
Buggy code:
 static stmt_ty ast_for_funcdef_impl ( struct compiling * c, const node * n0, asdl_seq * decorator_seq, bool is_async ) { const node * const n = is_async? CHILD ( n0, 1 ) : n0 ; identifier name ; arguments_ty args ; asdl_seq * body ; expr_ty returns = NULL ; int name_i = 1 ; int end_lineno, end_col_offset ; <START_BUG> REQ ( n, funcdef ) ; <END_BUG> name = NEW_IDENTIFIER ( CHILD ( n, name_i ) ) ; if (! name ) return NULL ; if ( forbidden_name ( c, name, CHILD ( n, name_i ), 0 ) ) return NULL ; args = ast_for_arguments ( c, CHILD ( n, name_i + 1 ) ) ; if (! args ) return NULL ; if ( TYPE ( CHILD ( n, name_i + 2 ) ) == RARROW ) { returns = ast_for_expr ( c, CHILD ( n, name_i + 3 ) ) ; if (! returns ) return NULL ; name_i += 2 ; }  body = ast_for_suite ( c, CHILD ( n, name_i + 3 ) ) ; <START_BUG> if (! body ) return NULL ; get_last_end_pos ( body, & end_lineno, & end_col_offset ) ; <END_BUG> if ( is_async )  <START_BUG> return AsyncFunctionDef ( name, args, body, decorator_seq, returns, <END_BUG> LINENO ( n0 ), n0 -> n_col_offset, end_lineno, end_col_offset, c -> c_arena ) ; else  return FunctionDef ( name, args, body, decorator_seq, returns, <START_BUG> LINENO ( n ), n -> n_col_offset, end_lineno, end_col_offset, c -> c_arena ) ; }<END_BUG>

Fix:
<S2SV_ModStart>, end_col_offset ; node * tc ; string type_comment = NULL ; <S2SV_ModStart> 2 ; } if ( TYPE ( CHILD ( n, name_i + 3 ) ) == TYPE_COMMENT ) { type_comment = NEW_TYPE_COMMENT ( CHILD ( n, name_i + 3 ) ) ; if (! type_comment ) return NULL ; name_i += 1 ; } <S2SV_ModStart> ; if ( NCH ( CHILD ( n, name_i + 3 ) ) > 1 ) { tc = CHILD ( CHILD ( n, name_i + 3 ), 1 ) ; if ( TYPE ( tc ) == TYPE_COMMENT ) { if ( type_comment!= NULL ) { ast_error ( c, n, "Cannot <S2SV_blank> have <S2SV_blank> two <S2SV_blank> type <S2SV_blank> comments <S2SV_blank> on <S2SV_blank> def" ) ; return NULL ; } type_comment = NEW_TYPE_COMMENT ( tc ) ; if (! type_comment ) return NULL ; } } if ( <S2SV_ModStart> decorator_seq, returns, type_comment <S2SV_ModStart>, returns, type_comment,
Buggy code:
 const char * vpx_svc_dump_statistics ( SvcContext * svc_ctx ) { <START_BUG> int number_of_frames, number_of_keyframes, encode_frame_count ; <END_BUG> int i, j ; uint32_t bytes_total = 0 ; double scale [ COMPONENTS ] ; double psnr [ COMPONENTS ] ; double mse [ COMPONENTS ] ; double y_scale ;  SvcInternal * const si = get_svc_internal ( svc_ctx ) ; <START_BUG> if ( svc_ctx == NULL || si == NULL ) return NULL ; svc_log_reset ( svc_ctx ) ; <END_BUG> encode_frame_count = si -> encode_frame_count ;  <START_BUG> if ( si -> encode_frame_count <= 0 ) return vpx_svc_get_message ( svc_ctx ) ; <END_BUG> svc_log ( svc_ctx, SVC_LOG_INFO, "\\n" ) ;  number_of_keyframes = encode_frame_count // si -> kf_dist + 1 ; <START_BUG> <END_BUG> for ( i = 0 ; i < si -> layers ; ++ i ) {  <START_BUG> number_of_frames = encode_frame_count ; <END_BUG> if ( svc_ctx -> encoding_mode == ALT_INTER_LAYER_PREDICTION_IP && ( i == 1 || i == 3 ) ) { number_of_frames -= number_of_keyframes ; } svc_log ( svc_ctx, SVC_LOG_INFO, "Layer   %d   Average   PSNR=[%2.3f,   %2.3f,   %2.3f,   %2.3f],   Bytes=[%u]\\n", i, ( double ) si -> psnr_sum [ i ] [ 0 ] // number_of_frames, ( double ) si -> psnr_sum [ i ] [ 1 ] // number_of_frames, ( double ) si -> psnr_sum [ i ] [ 2 ] // number_of_frames, ( double ) si -> psnr_sum [ i ] [ 3 ] // number_of_frames, si -> bytes_sum [ i ] ) ; y_scale = si -> width * si -> height * 255.0 * 255.0 * number_of_frames ; scale [ 1 ] = y_scale ; scale [ 2 ] = scale [

Fix:
<S2SV_ModStart> { int number_of_frames <S2SV_ModEnd> ; int i <S2SV_ModStart> double y_scale ; SvcInternal_t <S2SV_ModEnd> * const si <S2SV_ModStart> svc_ctx ) ; number_of_frames = si -> psnr_pkt_received <S2SV_ModEnd> ; if ( <S2SV_ModStart> ; if ( number_of_frames <S2SV_ModEnd> <= 0 ) <S2SV_ModStart> "\\n" ) ; <S2SV_ModEnd> for ( i <S2SV_ModStart> ; i < svc_ctx -> spatial_layers <S2SV_ModEnd> ; ++ i <S2SV_ModStart> i ) { <S2SV_ModEnd> svc_log ( svc_ctx <S2SV_ModStart> } si -> psnr_pkt_received <S2SV_ModEnd> = 0 ;
Buggy code:
 error_t httpClientSetQueryString ( HttpClientContext * context, const char_t * queryString ) { size_t m ; size_t n ; char_t * p ; char_t * q ; if ( context == NULL || queryString == NULL ) return ERROR_INVALID_PARAMETER ; if ( context -> requestState!= HTTP_REQ_STATE_FORMAT_HEADER ) return ERROR_WRONG_STATE ; if ( context -> bufferLen > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_INVALID_SYNTAX ; context -> buffer [ context -> bufferLen ] = '\\0' ; <START_BUG> p = strchr ( context -> buffer,' ') ; <END_BUG> if ( p == NULL ) return ERROR_INVALID_SYNTAX ; p = strpbrk ( p + 1, "  ?" ) ; if ( p == NULL ) return ERROR_INVALID_SYNTAX ; if ( * p == '?' ) {  q = strchr ( p + 1,' ') ; <START_BUG> if ( q == NULL ) return ERROR_INVALID_SYNTAX ; m = q - p ; } else { q = p ; m = 0 ; } n = osStrlen ( queryString ) ; if ( n == 0 ) { osMemmove ( p, p + m, context -> buffer + context -> bufferLen + 1 - q ) ; } else { n ++ ; if ( ( context -> bufferLen + n - m ) > HTTP_CLIENT_BUFFER_SIZE ) return ERROR_BUFFER_OVERFLOW ; osMemmove ( p + n, q, context -> buffer + context -> bufferLen + 1 - q ) ; p [ 0 ] = '?' ; osStrncpy ( p + 1, queryString, n - 1 ) ; } context -> bufferLen = context -> bufferLen + n - m ; return NO_ERROR ; }<END_BUG>

Fix:
<S2SV_ModStart> ; p = osStrchr <S2SV_ModEnd> ( context -> <S2SV_ModStart> { q = osStrchr <S2SV_ModEnd> ( p +
Buggy code:
 void btsock_rfc_signaled ( UNUSED_ATTR int fd, int flags, uint32_t user_id ) { pthread_mutex_lock ( & slot_lock ) ; rfc_slot_t * slot = find_rfc_slot_by_id ( user_id ) ; if (! slot ) goto out ; bool need_close = false ; if ( flags & SOCK_THREAD_FD_RD &&! slot -> f. server ) { if ( slot -> f. connected ) { int size = 0 ; <START_BUG> if (! ( flags & SOCK_THREAD_FD_EXCEPTION ) || ( ioctl ( slot -> fd, FIONREAD, & size ) == 0 && size ) ) <END_BUG>  pthread_mutex_unlock ( & slot_lock ) ; <START_BUG> <END_BUG> BTA_JvRfcommWrite ( slot -> rfc_handle, slot -> id ) ;  } else { LOG_ERROR ( "%s   socket   signaled   for   read   while   disconnected,   slot:   %d,   channel:   %d", __func__, slot -> id, slot -> scn ) ; need_close = true ; } } if ( flags & SOCK_THREAD_FD_WR ) { if (! slot -> f. connected ||! flush_incoming_que_on_wr_signal ( slot ) ) { LOG_ERROR ( "%s   socket   signaled   for   write   while   disconnected   (or   write   failure),   slot:   %d,   channel:   %d", __func__, slot -> id, slot -> scn ) ; need_close = true ; } } if ( need_close || ( flags & SOCK_THREAD_FD_EXCEPTION ) ) { int size = 0 ; <START_BUG> if ( need_close || ioctl ( slot -> fd, FIONREAD, & size )!= 0 ||! size ) <END_BUG> cleanup_rfc_slot ( slot ) ; } out : ; pthread_mutex_unlock ( & slot_lock ) ; }

Fix:
<S2SV_ModStart> ) || ( TEMP_FAILURE_RETRY ( <S2SV_ModStart> & size ) ) <S2SV_ModStart> size ) ) { <S2SV_ModEnd> BTA_JvRfcommWrite ( slot <S2SV_ModStart> id ) ; } <S2SV_ModStart> ( need_close || TEMP_FAILURE_RETRY ( <S2SV_ModStart>, & size )
Buggy code:
 gstrings_ret * get_strings_2_svc ( gstrings_arg * arg, struct svc_req * rqstp ) { static gstrings_ret ret ; char * prime_arg ; <START_BUG> gss_buffer_desc client_name, <END_BUG> service_name ; OM_uint32 minor_stat ; kadm5_server_handle_t handle ; const char * errmsg = NULL ; xdr_free ( xdr_gstrings_ret, & ret ) ; if ( ( ret. code = new_server_handle ( arg -> api_version, rqstp, & handle ) ) ) goto exit_func ; if ( ( ret. code = check_handle ( ( void * ) handle ) ) ) goto exit_func ; ret. api_version = handle -> api_version ; if ( setup_gss_names ( rqstp, & client_name, & service_name ) < 0 ) { ret. code = KADM5_FAILURE ; goto exit_func ; } if ( krb5_unparse_name ( handle -> context, arg -> princ, & prime_arg ) ) { ret. code = KADM5_BAD_PRINCIPAL ; goto exit_func ; } if (! cmp_gss_krb5_name ( handle, rqst2name ( rqstp ), arg -> princ ) && ( CHANGEPW_SERVICE ( rqstp ) ||! kadm5int_acl_check ( handle -> context, rqst2name ( rqstp ), ACL_INQUIRE, arg -> princ, NULL ) ) ) { ret. code = KADM5_AUTH_GET ; log_unauth ( "kadm5_get_strings", prime_arg, & client_name, & service_name, rqstp ) ; } else { ret. code = kadm5_get_strings ( ( void * ) handle, arg -> princ, & ret. strings, & ret. count ) ; if ( ret. code!= 0 ) errmsg = krb5_get_error_message ( handle -> context, ret. code ) ; log_done ( "kadm5_get_strings", prime_arg, errmsg, & client_name, & service_name, rqstp ) ; if ( errmsg!= NULL ) krb5_free_error_message ( handle ->

Fix:
<S2SV_ModStart> ; gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER ; gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER <S2SV_ModEnd> ; OM_uint32 minor_stat <S2SV_ModStart> prime_arg ) ; exit_func : <S2SV_ModStart> service_name ) ; <S2SV_ModEnd> free_server_handle ( handle
Buggy code:
 char * my_asctime ( time_t t ) { struct tm * tm ; char * str ; int len ; <START_BUG> tm = localtime ( & t ) ; <END_BUG> str = g_strdup ( asctime ( tm ) ) ; len = strlen ( str ) ; if ( len > 0 ) str [ len - 1 ] = '\\0' ; return str ; }

Fix:
<S2SV_ModStart> ( & t ) ; if ( tm == NULL ) return g_strdup ( "???"
Buggy code:
 static const u_char * ikev2_ID_print ( netdissect_options * ndo, u_char tpay, const struct isakmp_gen * ext, u_int item_len _U_, const u_char * ep _U_, uint32_t phase _U_, uint32_t doi _U_, uint32_t proto _U_, int depth _U_ ) { <START_BUG> struct ikev2_id id ; <END_BUG> int id_len, idtype_len, i ; unsigned int dumpascii, dumphex ; const unsigned char * typedata ;  ND_TCHECK ( * ext ) ; <START_BUG> UNALIGNED_MEMCPY ( & id, ext, sizeof ( id ) ) ; ikev2_pay_print ( ndo, NPSTR ( tpay ), id. h. critical ) ; id_len = ntohs ( id. h. len ) ; ND_PRINT ( ( ndo, "   len=%d", id_len - 4 ) ) ; if ( 2 < ndo -> ndo_vflag && 4 < id_len ) { ND_PRINT ( ( ndo, "   " ) ) ; if (! rawprint ( ndo, ( const uint8_t * ) ( ext + 1 ), id_len - 4 ) ) goto trunc ; } idtype_len = id_len - sizeof ( struct ikev2_id ) ; dumpascii = 0 ; dumphex = 0 ; typedata = ( const unsigned char * ) ( ext ) + sizeof ( struct ikev2_id ) ; switch ( id. type ) { case ID_IPV4_ADDR : ND_PRINT ( ( ndo, "   ipv4:" ) ) ; dumphex = 1 ; break ; case ID_FQDN : ND_PRINT ( ( ndo, "   fqdn:" ) ) ; dumpascii = 1 ; break ; case ID_RFC822_ADDR : ND_PRINT ( ( ndo, "   rfc822:" ) ) ; dumpascii = 1 ; break ; case ID_IPV6_ADDR : ND_PRINT ( ( ndo, "   ipv6:" ) ) ; dumphex = 1 ; break ; case ID_DER_ASN1_DN : ND_PRINT ( ( ndo<END_BUG>

Fix:
<S2SV_ModStart> _U_ ) { const struct ikev2_id * idp ; <S2SV_ModStart> * typedata ; idp = ( const struct ikev2_id * ) ext ; <S2SV_ModStart> ND_TCHECK ( * idp <S2SV_ModEnd> ) ; UNALIGNED_MEMCPY
Buggy code:
 void init_usm ( void ) { struct snmp_secmod_def * def ; char * type ; DEBUGMSGTL ( ( "init_usm", "unit_usm:   %" NETSNMP_PRIo "u   %" NETSNMP_PRIo "u\\n", usmNoPrivProtocol [ 0 ], usmNoPrivProtocol [ 1 ] ) ) ; sc_init ( ) ; def = SNMP_MALLOC_STRUCT ( snmp_secmod_def ) ; if ( def == NULL ) return ; def -> encode_reverse = usm_secmod_rgenerate_out_msg ; def -> encode_forward = usm_secmod_generate_out_msg ; def -> decode = usm_secmod_process_in_msg ; <START_BUG> def -> pdu_free_state_ref = usm_free_usmStateReference ; <END_BUG> def -> session_setup = usm_session_init ; def -> handle_report = usm_handle_report ; def -> probe_engineid = usm_discover_engineid ; def -> post_probe_engineid = usm_create_user_from_session_hook ; if ( register_sec_mod ( USM_SEC_MODEL_NUMBER, "usm", def )!= SNMPERR_SUCCESS ) { SNMP_FREE ( def ) ; snmp_log ( LOG_ERR, "could   not   register   usm   sec   mod\\n" ) ; return ; } snmp_register_callback ( SNMP_CALLBACK_LIBRARY, SNMP_CALLBACK_POST_PREMIB_READ_CONFIG, init_usm_post_config, NULL ) ; snmp_register_callback ( SNMP_CALLBACK_LIBRARY, SNMP_CALLBACK_SHUTDOWN, deinit_usm_post_config, NULL ) ; snmp_register_callback ( SNMP_CALLBACK_LIBRARY, SNMP_CALLBACK_SHUTDOWN, free_engineID, NULL ) ; register_config_handler ( "snmp", "defAuthType", snmpv3_authtype_conf, NULL, "MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224" ) ; register_config_handler ( "snmp", "defPrivType", snmpv

Fix:
<S2SV_ModStart> ; def -> pdu_clone = usm_clone ; def ->
Buggy code:
 IHEVCD_ERROR_T ihevcd_parse_pps ( codec_t * ps_codec ) { IHEVCD_ERROR_T ret = ( IHEVCD_ERROR_T ) IHEVCD_SUCCESS ; WORD32 value ; WORD32 pps_id ; pps_t * ps_pps ; sps_t * ps_sps ; bitstrm_t * ps_bitstrm = & ps_codec -> s_parse. s_bitstrm ; if ( 0 == ps_codec -> i4_sps_done ) return IHEVCD_INVALID_HEADER ; UEV_PARSE ( "pic_parameter_set_id", value, ps_bitstrm ) ; pps_id = value ; if ( ( pps_id >= MAX_PPS_CNT ) || ( pps_id < 0 ) ) { if ( ps_codec -> i4_pps_done ) return IHEVCD_UNSUPPORTED_PPS_ID ; else pps_id = 0 ; } ps_pps = ( ps_codec -> s_parse. ps_pps_base + MAX_PPS_CNT - 1 ) ; ps_pps -> i1_pps_id = pps_id ; UEV_PARSE ( "seq_parameter_set_id", value, ps_bitstrm ) ; ps_pps -> i1_sps_id = value ; ps_pps -> i1_sps_id = CLIP3 ( ps_pps -> i1_sps_id, 0, MAX_SPS_CNT - 2 ) ; ps_sps = ( ps_codec -> s_parse. ps_sps_base + ps_pps -> i1_sps_id ) ; if ( 0 == ps_sps -> i1_sps_valid ) { return IHEVCD_INVALID_HEADER ; } BITS_PARSE ( "dependent_slices_enabled_flag", value, ps_bitstrm, 1 ) ; ps_pps -> i1_dependent_slice_enabled_flag = value ; BITS_PARSE ( "output_flag_present_flag", value, ps_bitstrm, 1 ) ; ps_pps -> i1

Fix:
<S2SV_ModStart> = value ; if ( ( ps_pps -> i1_tiles_enabled_flag ) && ( ps_sps -> i1_log2_ctb_size == 4 ) && ( ( ps_sps -> i2_pic_width_in_luma_samples >= 4096 ) || ( ps_sps -> i2_pic_height_in_luma_samples >= 4096 ) ) ) { return IHEVCD_INVALID_HEADER ; }
Buggy code:
 void vrrp_print ( netdissect_options * ndo, register const u_char * bp, register u_int len, register const u_char * bp2, int ttl ) { int version, type, auth_type = VRRP_AUTH_NONE ; const char * type_s ; ND_TCHECK ( bp [ 0 ] ) ; version = ( bp [ 0 ] & 0xf0 ) >> 4 ; type = bp [ 0 ] & 0x0f ; type_s = tok2str ( type2str, "unknown   type   (%u)", type ) ; ND_PRINT ( ( ndo, "VRRPv%u,   %s", version, type_s ) ) ; if ( ttl!= 255 ) ND_PRINT ( ( ndo, ",   (ttl   %u)", ttl ) ) ; if ( version < 2 || version > 3 || type!= VRRP_TYPE_ADVERTISEMENT ) return ; ND_TCHECK ( bp [ 2 ] ) ; ND_PRINT ( ( ndo, ",   vrid   %u,   prio   %u", bp [ 1 ], bp [ 2 ] ) ) ; ND_TCHECK ( bp [ 5 ] ) ; if ( version == 2 ) { auth_type = bp [ 4 ] ; ND_PRINT ( ( ndo, ",   authtype   %s", tok2str ( auth2str, NULL, auth_type ) ) ) ; ND_PRINT ( ( ndo, ",   intvl   %us,   length   %u", bp [ 5 ], len ) ) ; } else { uint16_t intvl = ( bp [ 4 ] & 0x0f ) << 8 | bp [ 5 ] ; ND_PRINT ( ( ndo, ",   intvl   %ucs,   length   %u", intvl, len ) ) ; } if ( ndo -> ndo_vflag ) { int naddrs = bp [ 3 ] ; int i ; char c ; if ( version == 2 && ND_TTEST2 ( bp [ 0 ], len ) ) { struct cksum_vec vec [ 1 ] ; vec [ 0 ]. ptr = bp ; vec [ 0 ]. len = len ; <START_BUG> if ( in_cksum<END_BUG>

Fix:
<S2SV_ModStart> 1 ) ) { ND_TCHECK_16BITS ( & bp [ 6 ] ) ; <S2SV_ModStart> ) ) ; }
Buggy code:
 <START_BUG> cJSON * cJSON_CreateFloatArray ( double * numbers, int count ) <END_BUG> { int i ; cJSON * n = 0, * p = 0, * a = cJSON_CreateArray ( ) ;  for ( i = 0 ; a && i < count ; ++ i ) { <START_BUG> <END_BUG> n = cJSON_CreateFloat ( numbers [ i ] ) ;  <START_BUG> if (! i ) <END_BUG> a -> child = n ; else suffix_object ( p, n ) ; p = n ; } return a ; }

Fix:
<S2SV_ModStart> * cJSON_CreateFloatArray ( const float <S2SV_ModEnd> * numbers, <S2SV_ModStart> < count ; i ++ <S2SV_ModEnd> ) { n <S2SV_ModStart> { n = cJSON_CreateNumber <S2SV_ModEnd> ( numbers [ <S2SV_ModStart> ] ) ; if (! n ) { cJSON_Delete ( a ) ; return 0 ; }
Buggy code:
 static int newkeys_to_blob ( struct sshbuf * m, struct ssh * ssh, int mode ) { struct sshbuf * b ; struct sshcipher_ctx * cc ; struct sshcomp * comp ; struct sshenc * enc ; struct sshmac * mac ; struct newkeys * newkey ; int r ; if ( ( newkey = ssh -> state -> newkeys [ mode ] ) == NULL ) return SSH_ERR_INTERNAL_ERROR ; enc = & newkey -> enc ; mac = & newkey -> mac ; comp = & newkey -> comp ; cc = ( mode == MODE_OUT )? ssh -> state -> send_context : ssh -> state -> receive_context ; if ( ( r = cipher_get_keyiv ( cc, enc -> iv, enc -> iv_len ) )!= 0 ) return r ; if ( ( b = sshbuf_new ( ) ) == NULL ) return SSH_ERR_ALLOC_FAIL ; if ( ( r = sshbuf_put_cstring ( b, enc -> name ) )!= 0 || ( r = sshbuf_put ( b, & enc -> cipher, sizeof ( enc -> cipher ) ) )!= 0 || ( r = sshbuf_put_u32 ( b, enc -> enabled ) )!= 0 || ( r = sshbuf_put_u32 ( b, enc -> block_size ) )!= 0 || ( r = sshbuf_put_string ( b, enc -> key, enc -> key_len ) )!= 0 || ( r = sshbuf_put_string ( b, enc -> iv, enc -> iv_len ) )!= 0 ) goto out ; if ( cipher_authlen ( enc -> cipher ) == 0 ) { if ( ( r = sshbuf_put_cstring ( b, mac -> name ) )!= 0 || ( r = sshbuf_put_u32 ( b, mac -> enabled ) )!= 0 || ( r = sshbuf_put_string ( b, mac -> key, mac -> key_len ) )!= 0 ) goto out ; } if ( ( r = sshbuf_put_u32 ( b, comp -> type ) )!= 0 || <START_BUG> ( r = sshbuf_put_u32 ( b, comp -> enabled ) )!= 0 || <END_BUG> ( r = sshbuf_put_cstring ( b, comp -> name ) )!= 0 ) goto out

Fix:
<S2SV_ModStart> ( r = <S2SV_ModEnd> sshbuf_put_cstring ( b
Buggy code:
 static void perf_event_task_output ( struct perf_event * event, struct perf_task_event * task_event ) { struct perf_output_handle handle ; struct perf_sample_data sample ; struct task_struct * task = task_event -> task ; int ret, size = task_event -> event_id. header. size ; perf_event_header__init_id ( & task_event -> event_id. header, & sample, event ) ; ret = perf_output_begin ( & handle, event, <START_BUG> task_event -> event_id. header. size, 0, 0 ) ; <END_BUG> if ( ret ) goto out ; task_event -> event_id. pid = perf_event_pid ( event, task ) ; task_event -> event_id. ppid = perf_event_pid ( event, current ) ; task_event -> event_id. tid = perf_event_tid ( event, task ) ; task_event -> event_id. ptid = perf_event_tid ( event, current ) ; perf_output_put ( & handle, task_event -> event_id ) ; perf_event__output_id_sample ( event, & handle, & sample ) ; perf_output_end ( & handle ) ; out : task_event -> event_id. header. size = size ; }

Fix:
<S2SV_ModStart> size, 0 <S2SV_ModEnd> ) ; if
Buggy code:
 hive_h * hivex_open ( const char * filename, int flags ) { hive_h * h = NULL ; assert ( sizeof ( struct ntreg_header ) == 0x1000 ) ; assert ( offsetof ( struct ntreg_header, csum ) == 0x1fc ) ; h = calloc ( 1, sizeof * h ) ; if ( h == NULL ) goto error ; h -> msglvl = flags & HIVEX_OPEN_MSGLVL_MASK ; const char * debug = getenv ( "HIVEX_DEBUG" ) ; if ( debug && STREQ ( debug, "1" ) ) h -> msglvl = 2 ; DEBUG ( 2, "created   handle   %p", h ) ; h -> writable =!! ( flags & HIVEX_OPEN_WRITE ) ; h -> filename = strdup ( filename ) ; if ( h -> filename == NULL ) goto error ; # ifdef O_CLOEXEC h -> fd = open ( filename, O_RDONLY | O_CLOEXEC | O_BINARY ) ; # else h -> fd = open ( filename, O_RDONLY | O_BINARY ) ; # endif if ( h -> fd == - 1 ) goto error ; # ifndef O_CLOEXEC fcntl ( h -> fd, F_SETFD, FD_CLOEXEC ) ; # endif struct stat statbuf ; if ( fstat ( h -> fd, & statbuf ) == - 1 ) goto error ; h -> size = statbuf. st_size ; if ( h -> size < 0x2000 ) { SET_ERRNO ( EINVAL, "%s:   file   is   too   small   to   be   a   Windows   NT   Registry   hive   file", filename ) ; goto error ; } if (! h -> writable ) { h -> addr = mmap ( NULL, h -> size, PROT_READ, MAP_SHARED, h -> fd, 0 ) ; if ( h -> addr == MAP_FAILED ) goto error ; DEBUG ( 2, "mapped   file   at   %p", h -> addr ) ; } else { h -> addr = malloc ( h -> size ) ; if ( h -> addr == NULL ) goto error ; if ( full_read ( h -> fd, h -> addr, h -> size ) < h -> size ) goto error ; if (

Fix:
<S2SV_ModStart> ENOTSUP, "%s: <S2SV_blank> page <S2SV_blank> size <S2SV_blank> %zu <S2SV_blank> at <S2SV_blank> 0x%zx, <S2SV_blank> bad <S2SV_blank> registry", filename, page_size, off ) ; goto error ; } if ( off + page_size > h -> size ) { SET_ERRNO ( ENOTSUP, "%s: <S2SV_blank> page <S2SV_blank> size <S2SV_blank> %zu <S2SV_blank> at <S2SV_blank> 0x%zx <S2SV_blank> extends <S2SV_blank> beyond <S2SV_blank> end <S2SV_blank> of <S2SV_blank> file, <S2SV_blank> bad <S2SV_blank> registry"
Buggy code:
 void ih264d_init_decoder ( void * ps_dec_params ) { dec_struct_t * ps_dec = ( dec_struct_t * ) ps_dec_params ; dec_slice_params_t * ps_cur_slice ; <START_BUG> pocstruct_t * ps_prev_poc, * ps_cur_poc ; <END_BUG> ih264d_free_dynamic_bufs ( ps_dec ) ; ps_cur_slice = ps_dec -> ps_cur_slice ; ps_dec -> init_done = 0 ; ps_dec -> u4_num_cores = 1 ; ps_dec -> u2_pic_ht = ps_dec -> u2_pic_wd = 0 ; ps_dec -> u1_separate_parse = DEFAULT_SEPARATE_PARSE ; ps_dec -> u4_app_disable_deblk_frm = 0 ; ps_dec -> i4_degrade_type = 0 ; ps_dec -> i4_degrade_pics = 0 ; ps_dec -> i4_app_skip_mode = IVD_SKIP_NONE ; ps_dec -> i4_dec_skip_mode = IVD_SKIP_NONE ; memset ( ps_dec -> ps_pps, 0, ( ( sizeof ( dec_pic_params_t ) ) * MAX_NUM_PIC_PARAMS ) ) ; memset ( ps_dec -> ps_sps, 0, ( ( sizeof ( dec_seq_params_t ) ) * MAX_NUM_SEQ_PARAMS ) ) ; ps_dec -> p_DeblockPicture [ 0 ] = ih264d_deblock_picture_non_mbaff ; ps_dec -> p_DeblockPicture [ 1 ] = ih264d_deblock_picture_mbaff ; ps_dec -> s_cab_dec_env. pv_codec_handle = ps_dec ; ps_dec -> u4_num_fld_in_frm = 0 ; ps_dec -> ps_dpb_mgr -> pv_codec_handle = ps_dec ; ps_dec -> ps_sei -> u1_is_valid = 0 ; ps_dec -> ps_cur_pps = NULL ; ps_dec -> ps_cur_sps = NULL ; ps_dec -> u

Fix:
<S2SV_ModStart>, * ps_cur_poc ; WORD32 size ; size = sizeof ( pred_info_t ) * 2 * 32 ; memset ( ps_dec -> ps_pred, 0, size ) ; size = sizeof ( disp_mgr_t ) ; memset ( ps_dec -> pv_disp_buf_mgr, 0, size ) ; size = sizeof ( buf_mgr_t ) + ithread_get_mutex_lock_size ( ) ; memset ( ps_dec -> pv_pic_buf_mgr, 0, size ) ; size = sizeof ( dec_err_status_t ) ; memset ( ps_dec -> ps_dec_err_status, 0, size ) ; size = sizeof ( sei ) ; memset ( ps_dec -> ps_sei, 0, size ) ; size = sizeof ( dpb_commands_t ) ; memset ( ps_dec -> ps_dpb_cmds, 0, size ) ; size = sizeof ( dec_bit_stream_t ) ; memset ( ps_dec -> ps_bitstrm, 0, size ) ; size = sizeof ( dec_slice_params_t ) ; mem
Buggy code:
 static int daemon_msg_findallif_req ( uint8 ver, struct daemon_slpars * pars, uint32 plen ) { char errbuf [ PCAP_ERRBUF_SIZE ] ; char errmsgbuf [ PCAP_ERRBUF_SIZE ] ; char sendbuf [ RPCAP_NETBUF_SIZE ] ; int sendbufidx = 0 ; pcap_if_t * alldevs = NULL ; pcap_if_t * d ; struct pcap_addr * address ; struct rpcap_findalldevs_if * findalldevs_if ; <START_BUG> uint16 nif = 0 ; <END_BUG> if ( rpcapd_discard ( pars -> sockctrl, plen ) == - 1 ) { return - 1 ; } if ( pcap_findalldevs ( & alldevs, errmsgbuf ) == - 1 ) goto error ; if ( alldevs == NULL ) { if ( rpcap_senderror ( pars -> sockctrl, ver, PCAP_ERR_NOREMOTEIF, "No   interfaces   found!   Make   sure   libpcap//WinPcap   is   properly   installed" "   and   you   have   the   right   to   access   to   the   remote   device.", errbuf ) == - 1 ) { rpcapd_log ( LOGPRIO_ERROR, "Send   to   client   failed:   %s", errbuf ) ; return - 1 ; } return 0 ; }  for ( d = alldevs ; d!= NULL ; d = d -> next ) <START_BUG> { nif ++ ; if ( d -> description ) <END_BUG> plen += strlen ( d -> description ) ;  if ( d -> name ) <START_BUG> plen += strlen ( d -> name ) ; <END_BUG>  plen += sizeof ( struct rpcap_findalldevs_if ) ; <START_BUG> for ( address = d -> addresses ; address!= NULL ; address = address -> next ) { switch ( address -> addr -> sa_family ) { case AF_INET : # ifdef AF_INET6 case AF_INET6 : # endif <END_BUG> plen += ( sizeof ( struct rpcap_sockaddr ) * 4 ) ;  break ; default : break ; } } } if ( sock_bufferize ( NULL, sizeof ( struct rpcap_header ), NULL, & sendbufidx, RPCAP_NETBUF_SIZE, SOCK

Fix:
<S2SV_ModStart> * findalldevs_if ; uint32 replylen ; <S2SV_ModStart> 0 ; } replylen = 0 ; <S2SV_ModStart> -> description ) replylen <S2SV_ModEnd> += strlen ( <S2SV_ModStart> -> name ) replylen <S2SV_ModEnd> += strlen ( <S2SV_ModStart> name ) ; replylen <S2SV_ModEnd> += sizeof ( <S2SV_ModStart> : # endif replylen <S2SV_ModEnd> += ( sizeof <S2SV_ModStart>, nif, replylen <S2SV_ModEnd> ) ; for
Buggy code:
 static int mount_entry_on_relative_rootfs ( struct mntent * mntent, const char * rootfs ) { char path [ MAXPATHLEN ] ; int ret ; ret = snprintf ( path, sizeof ( path ), "%s//%s", rootfs, mntent -> mnt_dir ) ; if ( ret >= sizeof ( path ) ) { ERROR ( "path   name   too   long" ) ; return - 1 ; } <START_BUG> return mount_entry_on_generic ( mntent, path ) ; <END_BUG> }

Fix:
<S2SV_ModStart> mntent, path, rootfs
Buggy code:
 static int __ptrace_may_access ( struct task_struct * task, unsigned int mode ) { const struct cred * cred = current_cred ( ), * tcred ; int dumpable = 0 ; if ( same_thread_group ( task, current ) ) return 0 ; rcu_read_lock ( ) ; tcred = __task_cred ( task ) ; if ( uid_eq ( cred -> uid, tcred -> euid ) && uid_eq ( cred -> uid, tcred -> suid ) && uid_eq ( cred -> uid, tcred -> uid ) && gid_eq ( cred -> gid, tcred -> egid ) && gid_eq ( cred -> gid, tcred -> sgid ) && gid_eq ( cred -> gid, tcred -> gid ) ) goto ok ; if ( ptrace_has_cap ( tcred -> user_ns, mode ) ) goto ok ; rcu_read_unlock ( ) ; return - EPERM ; ok : rcu_read_unlock ( ) ; smp_rmb ( ) ; if ( task -> mm ) dumpable = get_dumpable ( task -> mm ) ; rcu_read_lock ( ) ; <START_BUG> if (! dumpable &&! ptrace_has_cap ( __task_cred ( task ) -> user_ns, mode ) ) { <END_BUG> rcu_read_unlock ( ) ; return - EPERM ; } rcu_read_unlock ( ) ; return security_ptrace_access_check ( task, mode ) ; }

Fix:
<S2SV_ModStart> ; if ( dumpable!= SUID_DUMP_USER && <S2SV_ModEnd>! ptrace_has_cap (